diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index f9d982e542..38266abdb5 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -508,6 +508,10 @@ "master": [ "Publish", "Pdf" + ], + "atp-api-danm": [ + "Publish", + "Pdf" ] }, "need_generate_pdf_url_template": true, diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index f3234c0e64..5b0aef0b16 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -1,14 +1,89 @@ { "redirections": [ { - "source_path": "windows/deployment/update/waas-windows-insider-for-business-aad.md", - "redirect_url": "https://docs.microsoft.com/en-us/windows-insider/at-work-pro/wip-4-biz-add", - "redirect_document_id": true - }, +"source_path": "windows/deployment/update/waas-windows-insider-for-business-aad.md", +"redirect_url": "https://docs.microsoft.com/en-us/windows-insider/at-work-pro/wip-4-biz-add", +"redirect_document_id": true +}, { - "source_path": "windows/deployment/update/waas-windows-insider-for-business-faq.md", - "redirect_url": "https://docs.microsoft.com/en-us/windows-insider/at-work-pro/wip-4-biz-get-started", - "redirect_document_id": true +"source_path": "windows/deployment/update/waas-windows-insider-for-business-faq.md", +"redirect_url": "https://docs.microsoft.com/en-us/windows-insider/at-work-pro/wip-4-biz-get-started", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows.md", +"redirect_url": "/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/encrypted-hard-drive.md", +"redirect_url": "/windows/security/information-protection/encrypted-hard-drive", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/secure-the-windows-10-boot-process.md", +"redirect_url": "/windows/security/information-protection/secure-the-windows-10-boot-process", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md", +"redirect_url": "/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/tpm/change-the-tpm-owner-password.md", +"redirect_url": "/windows/security/information-protection/tpm/change-the-tpm-owner-password", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/tpm/how-windows-uses-the-tpm.md", +"redirect_url": "/windows/security/information-protection/tpm/how-windows-uses-the-tpm", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md", +"redirect_url": "/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/tpm/manage-tpm-commands.md", +"redirect_url": "/windows/security/information-protection/tpm/manage-tpm-commands", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/tpm/manage-tpm-lockout.md", +"redirect_url": "/windows/security/information-protection/tpm/manage-tpm-lockout", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md", +"redirect_url": "/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/tpm/tpm-fundamentals.md", +"redirect_url": "/windows/security/information-protection/tpm/tpm-fundamentals", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/tpm/tpm-recommendations.md", +"redirect_url": "/windows/security/information-protection/tpm/tpm-recommendations", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-overview.md", +"redirect_url": "/windows/security/information-protection/tpm/trusted-platform-module-overview", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md", +"redirect_url": "/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings", +"redirect_document_id": true +}, +{ +"source_path": "windows/security/hardware-protection/tpm/trusted-platform-module-top-node.md", +"redirect_url": "/windows/security/information-protection/tpm/trusted-platform-module-top-node", +"redirect_document_id": true }, { "source_path": "windows/deployment/update/waas-windows-insider-for-business.md", @@ -5186,11 +5261,6 @@ "redirect_document_id": true }, { -"source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields-1803.md", -"redirect_url": "/windows/configuration/basic-level-windows-diagnostic-events-and-fields", -"redirect_document_id": true -}, -{ "source_path": "windows/configuration/windows-diagnostic-data-1709.md", "redirect_url": "/windows/configuration/windows-diagnostic-data", "redirect_document_id": true @@ -6566,6 +6636,21 @@ "redirect_document_id": true }, { +"source_path": "windows/configuration/kiosk-shared-pc.md", +"redirect_url": "/windows/configuration/kiosk-methods", +"redirect_document_id": true +}, +{ +"source_path": "windows/configuration/setup-kiosk-digital-signage.md", +"redirect_url": "/windows/configuration/kiosk-single-app", +"redirect_document_id": true +}, +{ +"source_path": "windows/configuration/multi-app-kiosk-xml.md", +"redirect_url": "/windows/configuration/kiosk-xml", +"redirect_document_id": true +}, +{ "source_path": "windows/configure/lock-down-windows-10-to-specific-apps.md", "redirect_url": "/windows/configuration/lock-down-windows-10-to-specific-apps", "redirect_document_id": true @@ -6686,11 +6771,6 @@ "redirect_document_id": true }, { -"source_path": "windows/configuration/multi-app-kiosk-xml.md", -"redirect_url": "windows/configuration/kiosk-xml.md", -"redirect_document_id": true -}, -{ "source_path": "windows/configure/provisioning-uninstall-package.md", "redirect_url": "/windows/configuration/provisioning-packages/provisioning-uninstall-package", "redirect_document_id": true @@ -13646,6 +13726,11 @@ "redirect_document_id": true }, { +"source_path": "windows/privacy/basic-level-windows-diagnostic-events-and-fields.md", +"redirect_url": "/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803", +"redirect_document_id": true +}, +{ "source_path": "windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703.md", "redirect_url": "/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703", "redirect_document_id": true diff --git a/browsers/edge/Index.md b/browsers/edge/Index.md deleted file mode 100644 index f8a80c7b8d..0000000000 --- a/browsers/edge/Index.md +++ /dev/null @@ -1,71 +0,0 @@ ---- -description: Overview information about Microsoft Edge, the default browser for Windows 10. This topic includes links to other Microsoft Edge topics. -ms.assetid: 70377735-b2f9-4b0b-9658-4cf7c1d745bb -author: shortpatti -ms.prod: edge -ms.mktglfcycl: general -ms.sitesec: library -title: Microsoft Edge - Deployment Guide for IT Pros (Microsoft Edge for IT Pros) -ms.localizationpriority: high -ms.date: 10/16/2017 ---- - -# Microsoft Edge - Deployment Guide for IT Pros - -**Applies to:** - -- Windows 10 -- Windows 10 Mobile - ->Learn more about what features and functionality are supported in each Windows edition at [Compare Windows 10 Editions](https://www.microsoft.com/en-us/WindowsForBusiness/Compare). - -Microsoft Edge is the new, default web browser for Windows 10, helping you to experience modern web standards, better performance, improved security, and increased reliability. Microsoft Edge also introduces new features like Web Note, Reading View, and Cortana that you can use along with your normal web browsing abilities. - -Microsoft Edge lets you stay up-to-date through the Microsoft Store and to manage your enterprise through Group Policy or your mobile device management (MDM) tools. - ->[!Note] ->For more information about the potential impact of using Microsoft Edge in a large organization, refer to the [Measuring the impact of Microsoft Edge](https://www.microsoft.com/itpro/microsoft-edge/technical-benefits) topic on the Microsoft Edge IT Center. - ->If you are looking for Internet Explorer 11 content, please visit the [Internet Explorer 11 (IE11)](https://docs.microsoft.com/en-us/internet-explorer/) area. - -## In this section - -| Topic | Description | -| -----------------------| ----------------------------------- | -|[Change history for Microsoft Edge](change-history-for-microsoft-edge.md) |Lists new and updated topics in the Microsoft Edge documentation for both Windows 10 and Windows 10 Mobile. | -|[Enterprise guidance about using Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) |Guidance about how to use both Microsoft Edge and Internet Explorer 11 in your enterprise.| -| [Microsoft Edge requirements and language support](hardware-and-software-requirements.md) |Microsoft Edge is pre-installed on all Windows 10-capable devices that meet the minimum system requirements and are on the supported language list.| -| [Available policies for Microsoft Edge](available-policies.md) |Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings.

Group Policy objects (GPO's) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. By using Group Policy and Intune, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple security settings in a GPO that's linked to a domain, and then apply all of those settings to every computer in the domain. | -| [Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md) |If you have specific web sites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the web sites will automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work properly with Microsoft Edge, you can set all intranet sites to automatically open using IE11.

Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. | -|[Microsoft Edge Frequently Asked Questions (FAQs)](microsoft-edge-faq.md)|Answering frequently asked questions about Microsoft Edge features, integration, support, and potential problems. - -## Interoperability goals and enterprise guidance - -Our primary goal is that your modern websites work in Microsoft Edge. To that end, we've made Microsoft Edge the default browser. - -However, if you're running web apps that continue to use: - -* ActiveX controls - -* x-ua-compatible headers - -* <meta> tags - -* Enterprise mode or compatibility view to address compatibility issues - -* legacy document modes - -You'll need to keep running them using IE11. If you don't have IE11 installed anymore, you can download it from the Microsoft Store or from the [Internet Explorer 11 download page](https://go.microsoft.com/fwlink/p/?linkid=290956). Alternatively, you can also use Enterprise Mode with Microsoft Edge to transition only the sites that need these technologies to load in IE11. For info about Enterprise Mode and Edge, see [Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md). - -## Related topics - -- [Total Economic Impact of Microsoft Edge: Infographic](https://www.microsoft.com/download/details.aspx?id=55956) - -- [Total Economic Impact of Microsoft Edge: Forrester Study](https://www.microsoft.com/download/details.aspx?id=55847) - -- [Download Internet Explorer 11](https://go.microsoft.com/fwlink/p/?linkid=290956) - -- [Internet Explorer 11 (IE11) - Deployment Guide for IT Pros](https://go.microsoft.com/fwlink/p/?LinkId=760644) - -- [Internet Explorer Administration Kit 11 (IEAK 11) - Administrator's Guide](https://go.microsoft.com/fwlink/p/?LinkId=760646) - diff --git a/browsers/edge/TOC.md b/browsers/edge/TOC.md index 21eef4d813..15060d33b4 100644 --- a/browsers/edge/TOC.md +++ b/browsers/edge/TOC.md @@ -1,26 +1,36 @@ -#[Microsoft Edge - Deployment guidance for IT Pros](index.md) +# [Microsoft Edge deployment for IT Pros](index.yml) -##[New Microsoft Edge Group Policies and MDM settings](new-policies.md) +## [System requirements and supported languages](about-microsoft-edge.md) -##[Deploy Microsoft Edge kiosk mode](microsoft-edge-kiosk-mode-deploy.md) +## [Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md) -##Group Policy configuration options -###[Home button settings](group-policies/home-button-gp.md) -###[Prelaunch Microsoft Edge and preload tabs](group-policies/prelaunch-preload-gp.md) -###[Search engine customization](group-policies/search-engine-customization-gp.md) -###[Security and privacy management](group-policies/security-privacy-management-gp.md) -###[Start pages settings](group-policies/start-pages-gp.md) -###[Sync browser settings](group-policies/sync-browser-settings-gp.md) -###[Interoperability and enterprise guidance](group-policies/interoperability-enterprise-guidance-gp.md) +## [(Preview) New Microsoft Edge Group Policies and MDM settings](new-policies.md) -##[Change history for Microsoft Edge](change-history-for-microsoft-edge.md) +## [(Preview) Deploy Microsoft Edge kiosk mode](microsoft-edge-kiosk-mode-deploy.md) -##[Microsoft Edge requirements and language support](hardware-and-software-requirements.md) - -##[Available policies for Microsoft Edge](available-policies.md) - -##[Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md) - -##[Microsoft Edge Frequently Asked Questions (FAQs)](microsoft-edge-faq.md) +## [Group policies & configuration options](group-policies/index.yml) +### [All group policies](available-policies.md) +### [Address bar settings](group-policies/address-bar-settings-gp.md) +### [Adobe settings](group-policies/adobe-settings-gp.md) +### [Books Library management](group-policies/books-library-management-gp.md) +### [Browser settings management](group-policies/browser-settings-management-gp.md) +### [Developer settings](group-policies/developer-settings-gp.md) +### [Extensions management](group-policies/extensions-management-gp.md) +### [Favorites management](group-policies/favorites-management-gp.md) +### [Home button settings](group-policies/home-button-gp.md) +### [Interoperability and enterprise guidance](group-policies/interoperability-enterprise-guidance-gp.md) +### [New tab page settings](group-policies/new-tab-page-settings-gp.md) +### [Prelaunch Microsoft Edge and preload tabs](group-policies/prelaunch-preload-gp.md) +### [Search engine customization](group-policies/search-engine-customization-gp.md) +### [Security and privacy management](group-policies/security-privacy-management-gp.md) +### [Start pages settings](group-policies/start-pages-gp.md) +### [Sync browser settings](group-policies/sync-browser-settings-gp.md) +### [Telemetry and data collection](group-policies/telemetry-management-gp.md) + + + +## [Change history for Microsoft Edge](change-history-for-microsoft-edge.md) + +## [Microsoft Edge Frequently Asked Questions (FAQs)](microsoft-edge-faq.md) diff --git a/browsers/edge/about-microsoft-edge.md b/browsers/edge/about-microsoft-edge.md new file mode 100644 index 0000000000..60c5343bac --- /dev/null +++ b/browsers/edge/about-microsoft-edge.md @@ -0,0 +1,160 @@ +--- +title: Microsoft Edge system and language requirements +description: Overview information about Microsoft Edge, the default browser for Windows 10. This topic includes links to other Microsoft Edge topics. +ms.assetid: 70377735-b2f9-4b0b-9658-4cf7c1d745bb +author: shortpatti +ms.prod: edge +ms.mktglfcycl: general +ms.sitesec: library +title: Microsoft Edge for IT Pros +ms.localizationpriority: medium +ms.date: 07/29/2018 +--- + +# Microsoft Edge system and language requirements +>Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile + +Microsoft Edge is the new, default web browser for Windows 10, helping you to experience modern web standards, better performance, improved security, and increased reliability. Microsoft Edge lets you stay up-to-date through the Microsoft Store and to manage your enterprise through Group Policy or your mobile device management (MDM) tools. + + +>[!IMPORTANT] +>The Long-Term Servicing Branch (LTSB) versions of Windows, including Windows Server 2016, don’t include Microsoft Edge or many other Universal Windows Platform (UWP) apps. Systems running the LTSB operating systems do not support these apps because their services get frequently updated with new functionality. For customers who require the LTSB for specialized devices, we recommend using Internet Explorer 11. + + + +## Minimum system requirements +Some of the components might also need additional system resources. Check the component's documentation for more information. + + +| Item | Minimum requirements | +| ------------------ | -------------------------------------------- | +| Computer/processor | 1 gigahertz (GHz) or faster (32-bit (x86) or 64-bit (x64)) | +| Operating system |

**Note**
For specific Windows 10 Mobile requirements, see the [Minimum hardware requirements for Windows 10 Mobile](https://go.microsoft.com/fwlink/p/?LinkID=699266) topic. | +| Memory |

| +| Hard drive space | | +| DVD drive | DVD-ROM drive (if installing from a DVD-ROM) | +| Display | Super VGA (800 x 600) or higher-resolution monitor with 256 colors | +| Graphics card | Microsoft DirectX 9 or later with Windows Display Driver Model (WDDM) 1.0 driver | +| Peripherals | Internet connection and a compatible pointing device | + +  + +## Supported languages + + +Microsoft Edge supports all of the same languages as Windows 10, including: + + +| Language | Country/Region | Code | +| ------------------------ | -------------- | ------ | +| Afrikaans (South Africa) | South Africa | af-ZA | +| Albanian (Albania) | Albania | sq-AL | +| Amharic | Ethiopia | am-ET | +| Arabic (Saudi Arabia) | Saudi Arabia | ar-SA | +| Armenian | Armenia | hy-AM | +| Assamese | India | as-IN | +| Azerbaijani (Latin, Azerbaijan) | Azerbaijan | az-Latn-AZ | +| Bangla (Bangladesh) | Bangladesh | bn-BD | +| Bangla (India) | India | bn-IN | +| Basque (Basque) | Spain | eu-ES | +| Belarusian (Belarus) | Belarus | be-BY | +| Bosnian (Latin) | Bosnia and Herzegovina | bs-Latn-BA | +| Bulgarian (Bulgaria) | Bulgaria | bg-BG | +| Catalan (Catalan) | Spain | ca-ES | +| Central Kurdish (Arabic) | Iraq | ku-Arab-IQ | +| Cherokee (Cherokee) | United States | chr-Cher-US | +| Chinese (Hong Kong SAR) | Hong Kong Special Administrative Region | zh-HK | +| Chinese (Simplified, China) | People's Republic of China | zh-CN | +| Chinese (Traditional, Taiwan) | Taiwan | zh-TW | +| Croatian (Croatia) | Croatia | hr-HR | +| Czech (Czech Republic) | Czech Republic | cs-CZ | +| Danish (Denmark) | Denmark | da-DK | +| Dari | Afghanistan | prs-AF | +| Dutch (Netherlands) | Netherlands | nl-NL | +| English (United Kingdom) | United Kingdom | en-GB | +| English (United States) | United States | en-US | +| Estonian (Estonia) | Estonia | et-EE | +| Filipino (Philippines) | Philippines | fil-PH | +| Finnish (Finland) | Finland | fi_FI | +| French (Canada) | Canada | fr-CA | +| French (France) | France | fr-FR | +| Galician (Galician) | Spain | gl-ES | +| Georgian | Georgia | ka-GE | +| German (Germany) | Germany | de-DE | +| Greek (Greece) | Greece | el-GR | +| Gujarati | India | gu-IN | +| Hausa (Latin, Nigeria) | Nigeria | ha-Latn-NG | +| Hebrew (Israel) | Israel | he-IL | +| Hindi (India) | India | hi-IN | +| Hungarian (Hungary) | Hungary | hu-HU | +| Icelandic | Iceland | is-IS | +| Igbo | Nigeria | ig-NG | +| Indonesian (Indonesia) | Indonesia | id-ID | +| Irish | Ireland | ga-IE | +| isiXhosa | South Africa | xh-ZA | +| isiZulu | South Africa | zu-ZA | +| Italian (Italy) | Italy | it-IT | +| Japanese (Japan) | Japan | ja-JP | +| Kannada | India | kn-IN | +| Kazakh (Kazakhstan) | Kazakhstan | kk-KZ | +| Khmer (Cambodia) | Cambodia | km-KH | +| K'iche' | Guatemala | quc-Latn-GT | +| Kinyarwanda | Rwanda | rw-RW | +| KiSwahili | Kenya, Tanzania | sw-KE | +| Konkani | India | kok-IN | +| Korean (Korea) | Korea | ko-KR | +| Kyrgyz | Kyrgyzstan | ky-KG | +| Lao (Laos) | Lao P.D.R. | lo-LA | +| Latvian (Latvia) | Latvia | lv-LV | +| Lithuanian (Lithuania) | Lithuania | lt-LT | +| Luxembourgish (Luxembourg) | Luxembourg | lb-LU | +| Macedonian (Former Yugoslav Republic of Macedonia) | Macedonia (FYROM) | mk-MK | +| Malay (Malaysia) | Malaysia, Brunei, and Singapore | ms-MY | +| Malayalam | India | ml-IN | +| Maltese | Malta | mt-MT | +| Maori | New Zealand | mi-NZ | +| Marathi | India | mr-IN | +| Mongolian (Cyrillic) | Mongolia | mn-MN | +| Nepali | Federal Democratic Republic of Nepal | ne-NP | +| Norwegian (Nynorsk) | Norway | nn-NO | +| Norwegian, Bokmål (Norway) | Norway | nb-NO | +| Odia | India | or-IN | +| Polish (Poland) | Poland | pl-PL | +| Portuguese (Brazil) | Brazil | pt-BR | +| Portuguese (Portugal) | Portugal | pt-PT | +| Punjabi | India | pa-IN | +| Punjabi (Arabic) | Pakistan | pa-Arab-PK | +| Quechua | Peru | quz-PE | +| Romanian (Romania) | Romania | ro-RO | +| Russian (Russia) | Russia | ru-RU | +| Scottish Gaelic | United Kingdom | gd-GB | +| Serbian (Cyrillic, Bosnia, and Herzegovina) | Bosnia and Herzegovina | sr-Cyrl-BA | +| Serbian (Cyrillic, Serbia) | Serbia | sr-Cyrl-RS | +| Serbian (Latin, Serbia) | Serbia | sr-Latn-RS | +| Sesotho sa Leboa | South Africa | nso-ZA | +| Setswana (South Africa) | South Africa and Botswana | tn-ZA | +| Sindhi (Arabic) | Pakistan | sd-Arab-PK | +| Sinhala | Sri Lanka | si-LK | +| Slovak (Slovakia) | Slovakia | sk-SK | +| Slovenian (Slovenia) | Slovenia | sl-SL | +| Spanish (Mexico) | Mexico | es-MX | +| Spanish (Spain, International Sort) | Spain | en-ES | +| Swedish (Sweden) | Sweden | sv-SE | +| Tajik (Cyrillic) | Tajikistan | tg-Cyrl-TJ | +| Tamil (India) | India and Sri Lanka | ta-IN | +| Tatar | Russia | tt-RU | +| Telugu | India | te-IN | +| Thai (Thailand) | Thailand | th-TH | +| Tigrinya (Ethiopia) | Ethiopia | ti-ET | +| Turkish (Turkey) | Turkey | tr-TR | +| Turkmen | Turkmenistan | tk-TM | +| Ukrainian (Ukraine) | Ukraine | uk-UA | +| Urdu | Pakistan | ur-PK | +| Uyghur | People's Republic of China | ug-CN | +| Uzbek (Latin, Uzbekistan) | Uzbekistan | uz-Latn-UZ | +| Valencian | Spain | ca-ES-valencia | +| Vietnamese | Vietnam | vi-VN | +| Welsh | United Kingdom | cy-GB | +| Wolof | Senegal | wo-SN | +| Yoruba | Nigeria | yo-NG | +--- \ No newline at end of file diff --git a/browsers/edge/available-policies.md b/browsers/edge/available-policies.md index 44bbbb103c..f21ac4a827 100644 --- a/browsers/edge/available-policies.md +++ b/browsers/edge/available-policies.md @@ -16,6 +16,10 @@ ms.date: 07/20/2018 > Applies to: Windows 10, Windows 10 Mobile +Set up a policy setting once and then copy that setting onto many computers. + + + Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPOs) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. By using Group Policy and Intune, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple security settings in a GPO that is linked to a domain, and then apply all of those settings to every computer in the domain. diff --git a/browsers/edge/change-history-for-microsoft-edge.md b/browsers/edge/change-history-for-microsoft-edge.md index ea57180317..2af18fcf6f 100644 --- a/browsers/edge/change-history-for-microsoft-edge.md +++ b/browsers/edge/change-history-for-microsoft-edge.md @@ -11,9 +11,12 @@ author: shortpatti --- # Change history for Microsoft Edge -This topic lists new and updated topics in the Microsoft Edge documentation for both Windows 10 and Windows 10 Mobile. +Discover what's new and updated in the Microsoft Edge for both Windows 10 and Windows 10 Mobile. -For a detailed feature list of what's in the current Microsoft Edge releases, the Windows Insider Preview builds, and what was introduced in previous releases, see the [Microsoft Edge changelog](https://developer.microsoft.com/microsoft-edge/platform/changelog/). + + + +# [2017](#tab/2017) ## September 2017 |New or changed topic | Description | @@ -25,23 +28,22 @@ For a detailed feature list of what's in the current Microsoft Edge releases, th |----------------------|-------------| |[Available Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](available-policies.md) |Added new Group Policy and MDM settings for the Windows Insider Program. Reformatted for easier readability outside of scrolling table. | + +# [2016](#tab/2016) + ## November 2016 |New or changed topic | Description | |----------------------|-------------| |[Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) |Added the infographic image and a download link.| |[Use Enterprise Mode to improve compatibility](emie-to-improve-compatibility.md) |Added a note about the 65 second wait before checking for a newer version of the site list .XML file. | |[Available policies for Microsoft Edge](available-policies.md) |Added notes to the Configure the Enterprise Mode Site List Group Policy and the EnterpriseModeSiteList MDM policy about the 65 second wait before checking for a newer version of the site list .XML file. | -|[Microsoft Edge - Deployment Guide for IT Pros](index.md) |Added a link to the Microsoft Edge infographic, helping you to evaluate the potential impact of using Microsoft Edge in your organization. | +|Microsoft Edge - Deployment Guide for IT Pros |Added a link to the Microsoft Edge infographic, helping you to evaluate the potential impact of using Microsoft Edge in your organization. | |[Browser: Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) |Added a link to the Microsoft Edge infographic, helping you to evaluate the potential impact of using Microsoft Edge in your organization. | ## July 2016 |New or changed topic | Description | |----------------------|-------------| |[Microsoft Edge requirements and language support](hardware-and-software-requirements.md)| Updated to include a note about the Long Term Servicing Branch (LTSB). | - -## July 2016 -|New or changed topic | Description | -|----------------------|-------------| |[Enterprise guidance about using Microsoft Edge and Internet Explorer 11](enterprise-guidance-using-microsoft-edge-and-ie11.md) | Content moved from What's New section. | |[Available policies for Microsoft Edge](available-policies.md) |Updated | @@ -56,3 +58,5 @@ For a detailed feature list of what's in the current Microsoft Edge releases, th |New or changed topic | Description | |----------------------|-------------| |[Available Policies for Microsoft Edge](available-policies.md) | Added new policies and the Supported versions column for Windows 10 Insider Preview. | + +--- \ No newline at end of file diff --git a/browsers/edge/emie-to-improve-compatibility.md b/browsers/edge/emie-to-improve-compatibility.md index 3f8deb3963..dbb4851e18 100644 --- a/browsers/edge/emie-to-improve-compatibility.md +++ b/browsers/edge/emie-to-improve-compatibility.md @@ -64,12 +64,14 @@ You must turn on the **Configure the Enterprise Mode Site List** Group Policy se - **HTTP location**: *“SiteList”=”http://localhost:8080/sites.xml”* - - **Local network**: *"SiteList"="\\\\network\\shares\\sites.xml"* + - **Local network**: *"SiteList"="\\\network\\shares\\sites.xml"* - - **Local file**: *"SiteList"="file:///c:\\\\Users\\\\<user>\\\\Documents\\\\testList.xml"* + - **Local file**: *"SiteList"="file:///c:/Users/<username>/Documents/testList.xml"* All of your managed devices must have access to this location if you want them to be able to access and use Enterprise Mode and your site list. + + 3. Refresh your policy in your organization and then view the affected sites in Microsoft Edge.

The site shows a message in Microsoft Edge, saying that the page needs IE. At the same time, the page opens in IE11; in a new frame if it's not yet running, or in a new tab if it is. ## Fix your intranet sites @@ -96,6 +98,3 @@ You can add the **Send all intranet traffic over to Internet Explorer** Group Po * [Enterprise Mode for Internet Explorer 11 (IE11)](https://go.microsoft.com/fwlink/p/?linkid=618377) * [Set the default browser using Group Policy]( https://go.microsoft.com/fwlink/p/?LinkId=620714)   - - - diff --git a/browsers/edge/group-policies/address-bar-settings-gp.md b/browsers/edge/group-policies/address-bar-settings-gp.md index 7fe1afeed2..39cc4f17f8 100644 --- a/browsers/edge/group-policies/address-bar-settings-gp.md +++ b/browsers/edge/group-policies/address-bar-settings-gp.md @@ -5,7 +5,7 @@ services: keywords: Don’t add or edit keywords without consulting your SEO champ. author: shortpatti ms.author: pashort -ms.date: 07/25/2018 +ms.date: 07/29/2018 ms.topic: article ms.prod: edge ms.mktglfcycl: explore @@ -13,11 +13,11 @@ ms.sitesec: library --- # Address bar settings ->*Supported versions: Microsoft Edge on Windows 10* - -I need a description here -[!INCLUDE [allow-address-bar-suggestions-include](../includes/allow-address-bar-suggestions-include.md)] -[!INCLUDE [configure-search-suggestions-address-bar-include](../includes/configure-search-suggestions-address-bar-include.md)] \ No newline at end of file +## Allow Address bar drop-down list suggestions +[!INCLUDE [allow-address-bar-suggestions-include.md](../includes/allow-address-bar-suggestions-include.md)] + +## Configure search suggestions in Address bar +[!INCLUDE [configure-search-suggestions-address-bar-include.md](../includes/configure-search-suggestions-address-bar-include.md)] \ No newline at end of file diff --git a/browsers/edge/group-policies/adobe-settings-gp.md b/browsers/edge/group-policies/adobe-settings-gp.md index f910a747dd..36461a27fe 100644 --- a/browsers/edge/group-policies/adobe-settings-gp.md +++ b/browsers/edge/group-policies/adobe-settings-gp.md @@ -13,12 +13,13 @@ ms.sitesec: library --- # Adobe settings ->*Supported versions: Microsoft Edge on Windows 10* - -I need a description here, maybe with scenarios - -[!INCLUDE [allow-adobe-flash-include](../includes/allow-adobe-flash-include.md)] -[!INCLUDE [configure-adobe-flash-click-to-run-include](../includes/configure-adobe-flash-click-to-run-include.md)] + +## Allow Adobe Flash +[!INCLUDE [allow-adobe-flash-include.md](../includes/allow-adobe-flash-include.md)] + + +## Configure the Adobe Flash Click-to-Run setting +[!INCLUDE [configure-adobe-flash-click-to-run-include.md](../includes/configure-adobe-flash-click-to-run-include.md)] diff --git a/browsers/edge/group-policies/books-library-management-gp.md b/browsers/edge/group-policies/books-library-management-gp.md index 95761893b2..2851dafc5b 100644 --- a/browsers/edge/group-policies/books-library-management-gp.md +++ b/browsers/edge/group-policies/books-library-management-gp.md @@ -13,15 +13,18 @@ ms.sitesec: library --- # Books Library management ->*Supported versions: Microsoft Edge on Windows 10* - -I need a description here, maybe with scenarios -[!INCLUDE [allow-shared-folder-books-include](../includes/allow-shared-folder-books-include.md)] -[!INCLUDE [allow-config-updates-books-include](../includes/allow-config-updates-books-include.md)] -[!INCLUDE [allow-ext-telemetry-books-tab-include](../includes/allow-ext-telemetry-books-tab-include.md)] +## Allow a shared books folder +[!INCLUDE [allow-shared-folder-books-include.md](../includes/allow-shared-folder-books-include.md)] -[!INCLUDE [always-enable-book-library-include](../includes/always-enable-book-library-include.md)] \ No newline at end of file +## Allow configuration updates for the Books Library +[!INCLUDE [allow-config-updates-books-include.md](../includes/allow-config-updates-books-include.md)] + +## Allow extended telemetry for the Books tab +[!INCLUDE [allow-ext-telemetry-books-tab-include.md](../includes/allow-ext-telemetry-books-tab-include.md)] + +## Always show the Books Library in Microsoft Edge +[!INCLUDE [always-enable-book-library-include.md](../includes/always-enable-book-library-include.md)] \ No newline at end of file diff --git a/browsers/edge/group-policies/bowser-settings-management-gp.md b/browsers/edge/group-policies/browser-settings-management-gp.md similarity index 93% rename from browsers/edge/group-policies/bowser-settings-management-gp.md rename to browsers/edge/group-policies/browser-settings-management-gp.md index e38cacbf4c..213c901cfb 100644 --- a/browsers/edge/group-policies/bowser-settings-management-gp.md +++ b/browsers/edge/group-policies/browser-settings-management-gp.md @@ -13,9 +13,7 @@ ms.sitesec: library --- # Browser settings management ->*Supported versions: Microsoft Edge on Windows 10* -I need a description here, maybe with scenarios diff --git a/browsers/edge/group-policies/developer-settings-gp.md b/browsers/edge/group-policies/developer-settings-gp.md index 22cdbb9c06..9108424f87 100644 --- a/browsers/edge/group-policies/developer-settings-gp.md +++ b/browsers/edge/group-policies/developer-settings-gp.md @@ -13,9 +13,9 @@ ms.sitesec: library --- # Developer settings ->*Supported versions: Microsoft Edge on Windows 10* -I need a description here, maybe with scenarios + + ## Allow Developer Tools [!INCLUDE [allow-dev-tools-include](../includes/allow-dev-tools-include.md)] diff --git a/browsers/edge/group-policies/extensions-management-gp.md b/browsers/edge/group-policies/extensions-management-gp.md index 0d236f343b..4f12302469 100644 --- a/browsers/edge/group-policies/extensions-management-gp.md +++ b/browsers/edge/group-policies/extensions-management-gp.md @@ -13,9 +13,8 @@ ms.sitesec: library --- # Extensions management ->*Supported versions: Microsoft Edge on Windows 10* -I need a description here, maybe with scenarios + ## Allow Extensions [!INCLUDE [allow-extensions-include](../includes/allow-extensions-include.md)] diff --git a/browsers/edge/group-policies/favorites-management-gp.md b/browsers/edge/group-policies/favorites-management-gp.md index 8f9645dee1..e488c71611 100644 --- a/browsers/edge/group-policies/favorites-management-gp.md +++ b/browsers/edge/group-policies/favorites-management-gp.md @@ -1,8 +1,8 @@ --- title: Microsoft Edge - Favorites management -description: 115-145 characters including spaces. Edit the intro para describing article intent to fit here. This abstract displays in the search result. +description: services: -keywords: Don’t add or edit keywords without consulting your SEO champ. +keywords: author: shortpatti ms.author: pashort ms.date: 07/25/2018 @@ -13,9 +13,7 @@ ms.sitesec: library --- # Favorites management ->*Supported versions: Microsoft Edge on Windows 10* -I need a description here, maybe with scenarios ## Configure Favorites Bar @@ -28,4 +26,4 @@ I need a description here, maybe with scenarios [!INCLUDE [prevent-changes-to-favorites-include](../includes/prevent-changes-to-favorites-include.md)] ## Provision Favorites -[!INCLUDE [provision-favorites-shortdesc](../shortdesc/provision-favorites-shortdesc.md)] \ No newline at end of file +[!INCLUDE [provision-favorites-include](../includes/provision-favorites-include.md)] \ No newline at end of file diff --git a/browsers/edge/group-policies/home-button-gp.md b/browsers/edge/group-policies/home-button-gp.md index 442126a454..5d7808dfa9 100644 --- a/browsers/edge/group-policies/home-button-gp.md +++ b/browsers/edge/group-policies/home-button-gp.md @@ -12,14 +12,14 @@ ms.sitesec: library # Home button configuration options >*Supported versions: Microsoft Edge on Windows 10, next major update to Windows* -Microsoft Edge shows the home button and by clicking it the Start page loads by default. You can configure the Home button to load the New tab page or a URL defined in the Set Home button URL policy. You can also configure Microsoft Edge to hide the home button. +Microsoft Edge shows the home button and by clicking it the Start page loads by default. You can configure the Home button to load the New tab page or a URL defined in the Set Home Button URL policy. You can also configure Microsoft Edge to hide the home button. + +## Relevant group policies + +- [Configure Home Button](#configure-home-button) +- [Set Home Button URL](#set-home-button-url) +- [Unlock Home Button](#unlock-home-button) -## Policies -- [Configure Home button](../new-policies.md#configure-home-button) - -- [Set Home button URL](../new-policies.md#set-home-button-url) - -- [Unlock Home Button](../new-policies.md#unlock-home-button) ## Configuration options @@ -29,3 +29,13 @@ Microsoft Edge shows the home button and by clicking it the Start page loads by ![Hide home button](../images/home-button-hide-v4-sm.png) + +## Configure Home Button +[!INCLUDE [configure-home-button-include.md](../includes/configure-home-button-include.md)] + +## Set Home Button URL +[!INCLUDE [set-home-button-url-include](../includes/set-home-button-url-include.md)] + +## Unlock Home Button +[!INCLUDE [unlock-home-button-include.md](../includes/unlock-home-button-include.md)] + diff --git a/browsers/edge/group-policies/index.md b/browsers/edge/group-policies/index.md deleted file mode 100644 index 33786107dc..0000000000 --- a/browsers/edge/group-policies/index.md +++ /dev/null @@ -1,205 +0,0 @@ -### YamlMime:YamlDocument - -documentType: LandingData - -title: Microsoft Edge Group Policy configuration options - -metadata: - - document_id: - - title: Microsoft Edge Group Policy configuration options - - description: Learn about the different configuration options available in Microsoft Edge on Windows 10. - - text: Some of the features coming to Microsoft Edge gives you the ability to set a custom URL for the New tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. - - keywords: Microsoft Edge, Windows 10 - - ms.localizationpriority: high - - author: shortpatti - - ms.author: pashort - - ms.date: 07/23/2018 - - ms.topic: article - - ms.devlang: na - -sections: - -- title: Learn about... - -- items: - - - type: markdown - - text: Get ready to deploy Microsoft Edge. - -- items: - - - type: list - - style: cards - - className: cardsE - - columns: 3 - - items: - - - href: \browsers\edge\group-policies - - html:

Learn about the Always On VPN deployment and where to get started.

- - image: - - src: https://docs.microsoft.com/media/common/i_get-started.svg - - title: Begin your journey - - - href: \windows-server\remote\remote-access\vpn\vpn-map-da - - html:

Learn how Always On VPN has expanded the VPN functionality beyond the capabilities of DirectAccess.

- - image: - - src: https://docs.microsoft.com/media/common/i_quick-start.svg - - title: DirectAccess and Always On VPN feature comparison - - - href: \windows-server\remote\remote-access\vpn\always-on-vpn\always-on-vpn-enhancements - - html:

Learn about the key improvements in integration, security, connectivity, networking control, and compatibility.

- - image: - - src: https://docs.microsoft.com/media/common/i_whats-new.svg - - title: Enhancements in Always On VPN - - - href: \windows-server\remote\remote-access\vpn\always-on-vpn\always-on-vpn-technology-overview - - html:

Learch about the technologies used in the Always On VPN deployment.

- - image: - - src: https://docs.microsoft.com/media/common/i_overview.svg - - title: Technology overview - - - href: \windows-server\remote\remote-access\vpn\always-on-vpn\deploy\always-on-vpn-adv-options - - html:

Learn about the advanced VPN features you can add to improve the security and availability of your VPN connection.

- - image: - - src: https://docs.microsoft.com/media/common/i_advanced.svg - - title: Extend Always On VPN with advanced features - -- title: Get started... - - items: - - - type: paragraph - - text: 'Deploy Always On VPN connections for domain-joined Windows 10 client computers. You can also migrate from DirectAccess to Always On VPN and configure conditional access using Azure AD.' - - - type: list - - style: cards - - className: cardsE - - columns: 3 - - items: - - - href: \windows-server\remote\remote-access\vpn\always-on-vpn\deploy\always-on-vpn-deploy-deployment - - html:

Discover what's needed to deploy VPN connections.

- - image: - - src: https://docs.microsoft.com/media/common/i_architecture.svg - - title: Deployment workflow and scenarios - - - href: \windows-server\remote\remote-access\da-always-on-vpn-migration\da-always-on-migration-overview - - html:

Start planning the migration from DirectAccess to Always On VPN.

- - image: - - src: https://docs.microsoft.com/media/common/i_upgrade.svg - - title: Migrate from DirectAccess - - - href: \windows-server\remote\remote-access\vpn\always-on-vpn\deploy\always-on-vpn-deploy-planning - - html:

Start planning and preparing your Always On VPN deployment.

- - image: - - src: https://docs.microsoft.com/media/common/i_guidelines.svg - - title: Plan the Always On VPN deployment - - - href: \windows-server\remote\remote-access\vpn\always-on-vpn\deploy\vpn-deploy-server-infrastructure - - html:

Start setting up and configuring the VPN infrastructure along with the Windows 10 client VPN connectivity.

- - image: - - src: https://docs.microsoft.com/media/common/i_setup.svg - - title: Deploy the VPN infrastructure - - - href: \windows-server\remote\remote-access\vpn\ad-ca-vpn-connectivity-windows10 - - html:

Fine-tune how VPN users access your resources using Azure AD conditional access.

- - image: - - src: https://docs.microsoft.com/media/common/i_setup.svg - - title: Configure conditional access - -- items: - - - type: list - - style: cards - - className: cardsL - - items: - - - title: Troubleshoot Always On VPN - - html:

VPN_Profile.ps1 script issues

- -

Always On VPN client connection issues

- -

Azure AD Conditional Access connection issues

- -

Error codes


- -

Log files

- - - title: Additional resources - - html:

Windows 10 VPN Technical Guide

- -

VPNv2 CSP

- -

Active Directory Certificate Services Overview

- -

Certificate Templates

- -

Public Key Infrastructure Design Guidance

- -

AD CS Step by Step Guide - Two Tier PKI Hierarchy Deployment

diff --git a/browsers/edge/group-policies/index.yml b/browsers/edge/group-policies/index.yml new file mode 100644 index 0000000000..1918d89136 --- /dev/null +++ b/browsers/edge/group-policies/index.yml @@ -0,0 +1,231 @@ +### YamlMime:YamlDocument + +documentType: LandingData + +title: Microsoft Edge group policies + +metadata: + + document_id: + + title: Microsoft Edge group policies + + description: Learn how to configure group policies in Microsoft Edge on Windows 10. + + text: Some of the features coming to Microsoft Edge gives you the ability to set a custom URL for the New tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. + + keywords: Microsoft Edge, Windows 10, Windows 10 Mobile + + ms.localizationpriority: medium + + author: shortpatti + + ms.author: pashort + + ms.date: 07/26/2018 + + ms.topic: article + + ms.devlang: na + +sections: + +- title: + +- items: + + - type: markdown + + text: Microsoft Edge works with Group Policy and Microsoft Intune to help you manage your organization's computer settings. Group Policy objects (GPOs) can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. + +- items: + + - type: list + + style: cards + + className: cardsE + + columns: 3 + + items: + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/available-policies + + html:

View all available group policies for Microsoft Edge on Windows 10.

+ + image: + + src: https://docs.microsoft.com/media/common/i_policy.svg + + title: All group policies + + - href: address-bar-settings-gp + + html:

Learn how you can configure Microsoft Edge to show search suggestions in the address bar.

+ + image: + + src: https://docs.microsoft.com/media/common/i_http.svg + + title: Address bar settings + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/adobe-settings-gp + + html:

Learn how you can configure Microsoft Edge to load Adobe Flash content automatically.

+ + image: + + src: https://docs.microsoft.com/media/common/i_setup.svg + + title: Adobe Flash settings + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/books-library-management-gp + + html:

Learn how you can set up and use the books library, such as using a shared books folder for students and teachers.

+ + image: + + src: https://docs.microsoft.com/media/common/i_library.svg + + title: Books library management + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/browser-settings-management-gp + + html:

Learn how you can customize the browser settings, such as printing and saving browsing history, plus more.

+ + image: + + src: https://docs.microsoft.com/media/common/i_management.svg + + title: Browser settings + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy + + html:

Learn how Microsoft Edge kiosk mode works with assigned access to let IT administrators create a tailored browsing experience designed for kiosk devices.

+ + image: + + src: https://docs.microsoft.com/media/common/i_categorize.svg + + title: Deploy Microsoft Edge kiosk mode + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/developer-settings-gp + + html:

Learn how configure Microsoft Edge for development and testing.

+ + image: + + src: https://docs.microsoft.com/media/common/i_config-tools.svg + + title: Developer tools & settings + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp + + html:

Learn how you use Microsoft Edge and Internet Explorer together for a full browsing experience.

+ + image: + + src: https://docs.microsoft.com/media/common/i_management.svg + + title: Enterprise mode + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/extensions-management-gp + + html:

Learn how you can configure Microsoft Edge to either prevent or allow users to install and run unverified extensions.

+ + image: + + src: https://docs.microsoft.com/media/common/i_extensions.svg + + title: Extensions management + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/favorites-management-gp + + html:

Learn how you can provision a standard favorites list as well as keep the favorites lists in sync between IE11 and Microsoft Edge.

+ + image: + + src: https://docs.microsoft.com/media/common/i_link.svg + + title: Favorites management + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/home-button-gp + + html:

Learn how you can customize the home button or hide it.

+ + image: + + src: https://docs.microsoft.com/media/common/i_setup.svg + + title: Home button settings + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/new-tab-page-settings-gp + + html:

Learn how to configure the New tab page in Microsoft Edge.

+ + image: + + src: https://docs.microsoft.com/media/common/i_setup.svg + + title: New tab page settings + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/prelaunch-preload-gp + + html:

Learn how pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start up Microsoft Edge.

+ + image: + + src: https://docs.microsoft.com/media/common/i_setup.svg + + title: Prelaunch Microsoft Edge and preload tabs + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/search-engine-customization-gp + + html:

Learn how you can set the default search engine and configure additional ones.

+ + image: + + src: https://docs.microsoft.com/media/common/i_search.svg + + title: Search engine management + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/security-privacy-management-gp + + html:

Learn how you can keep your environment and users safe from attacks.

+ + image: + + src: https://docs.microsoft.com/media/common/i_security-management.svg + + title: Security & privacy management + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/start-pages-gp + + html:

Learn how to configure the Start pages in Microsoft Edge.

+ + image: + + src: https://docs.microsoft.com/media/common/i_setup.svg + + title: Start page settings + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/sync-browser-settings-gp + + html:

Learn how to you can prevent the "browser" group from syncing and prevent users from turning on the the Sync your Settings toggle.

+ + image: + + src: https://docs.microsoft.com/media/common/i_sync.svg + + title: Sync browser settings + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/telemetry-management-gp + + html:

Learn how you can configure Microsoft Edge to collect certain data.

+ + image: + + src: https://docs.microsoft.com/media/common/i_data-collection.svg + + title: Telemetry and data collection diff --git a/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md b/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md index 760bd9aeee..9168988d09 100644 --- a/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md +++ b/browsers/edge/group-policies/interoperability-enterprise-guidance-gp.md @@ -12,12 +12,30 @@ ms.sitesec: library # Interoperability and enterprise guidance >*Supported versions: Microsoft Edge on Windows 10* + +Microsoft Edge lets you continue to use IE11 for sites that are on your corporate intranet or included on your Enterprise Mode Site List. If you are running web apps that continue to use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in IE11. IE11 offers additional security, manageability, performance, backward compatibility, and modern standards support. + + +>[!TIP] +> If you are running an earlier version of Internet Explorer, then we recommend upgrading to IE11, so any legacy apps continue to work correctly. + +**Technology not supported by Microsoft Edge** +- ActiveX controls +- x-ua-compatible headers +- <meta> tags +- Legacy document modes + + + +>[!TIP] +>You can also use Enterprise Mode with Microsoft Edge to transition only the sites that need these technologies to load in IE11. For info about Enterprise Mode and Edge, see [Use Enterprise Mode to improve compatibility](../emie-to-improve-compatibility.md). + + If you have specific websites and apps that you know have compatibility problems with Microsoft Edge, you can use the Enterprise Mode site list so that the websites automatically open using Internet Explorer 11. Additionally, if you know that your intranet sites aren't going to work correctly with Microsoft Edge, you can set all intranet sites to open using IE11 automatically. Using Enterprise Mode means that you can continue to use Microsoft Edge as your default browser, while also ensuring that your apps continue working on IE11. - -**Policies** +## Relevant group policies 1. [Configure the Enterprise Mode Site List](#configure-the-enterprise-mode-site-list) 2. [Send all intranet sites to Internet Explorer 11](#send-all-intranet-sites-to-internet-explorer-11) @@ -27,7 +45,6 @@ Using Enterprise Mode means that you can continue to use Microsoft Edge as your ![Use Enterprise Mode with Microsoft Edge to improve compatibility](../images/use-enterprise-mode-with-microsoft-edge-sm.png) - ## Configure the Enterprise Mode Site List [!INCLUDE [configure-enterprise-mode-site-list-include](../includes/configure-enterprise-mode-site-list-include.md)] diff --git a/browsers/edge/group-policies/new-tab-page-settings-gp.md b/browsers/edge/group-policies/new-tab-page-settings-gp.md index c9058539c8..bc6f5d500d 100644 --- a/browsers/edge/group-policies/new-tab-page-settings-gp.md +++ b/browsers/edge/group-policies/new-tab-page-settings-gp.md @@ -11,7 +11,6 @@ ms.sitesec: library # New tab page ->*Supported versions: Microsoft Edge on Windows 10* Microsoft Edge loads the default New tab page by default. You can configure Microsoft Edge to load a New tab page URL and prevent users from changing it. When you enable this policy, and you disable the Allow web content on New tab page policy, Microsoft Edge ignores any URL specified in this policy and opens about:blank. diff --git a/browsers/edge/group-policies/prelaunch-preload-gp.md b/browsers/edge/group-policies/prelaunch-preload-gp.md index 7cb69d09f4..e5558942b9 100644 --- a/browsers/edge/group-policies/prelaunch-preload-gp.md +++ b/browsers/edge/group-policies/prelaunch-preload-gp.md @@ -7,7 +7,7 @@ ms.date: 07/25/2018 --- # Prelaunch Microsoft Edge and preload tabs in the background ->*Supported versions: Microsoft Edge on Windows 10, next major update to Windows* + Microsoft Edge pre-launches as a background process during Windows startup when the system is idle waiting to be launched by the user. Pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start up Microsoft Edge. You can also configure Microsoft Edge to prevent Microsoft Edge from pre-launching. @@ -15,11 +15,10 @@ Microsoft Edge pre-launches as a background process during Windows startup when Additionally, Microsoft Edge preloads the Start and New tab pages during Windows sign in, which minimizes the amount of time required to start Microsoft Edge and load a new tab. You can also configure Microsoft Edge to prevent preloading of tabs. -## Policies +## Relevant group policies -- [Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed](../new-policies.md#allow-microsoft-edge-to-pre-launch-at-windows-startup-when-the-system-is-idle-and-each-time-microsoft-edge-is-closed) - -- [Allow Microsoft Edge to start and load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed](../new-policies.md#allow-microsoft-edge-to-start-and-load-the-start-and-new-tab-page-at-windows-startup-and-each-time-microsoft-edge-is-closed) +- [Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed](#allow-microsoft-edge-to-pre-launch-at-windows-startup-when-the-system-is-idle-and-each-time-microsoft-edge-is-closed) +- [Allow Microsoft Edge to load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed](#allow-microsoft-edge-to-start-and-load-the-start-and-new-tab-page-at-windows-startup-and-each-time-microsoft-edge-is-closed) ## Configuration options @@ -28,4 +27,12 @@ Additionally, Microsoft Edge preloads the Start and New tab pages during Windows ![Prelauch Microsoft Edge and preload Start and New tab pages](../images/prelaunch-edge-and-preload-tabs-sm.png) -![Only prelaunch Microsoft Edge during Windows startup](../images/prelaunch-edge-only-sm.png) \ No newline at end of file +![Only prelaunch Microsoft Edge during Windows startup](../images/prelaunch-edge-only-sm.png) + + + +## Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed +[!INCLUDE [allow-prelaunch-include](../includes/allow-prelaunch-include.md)] + +## Allow Microsoft Edge to load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed +[!INCLUDE [allow-tab-preloading-include](../includes/allow-tab-preloading-include.md)] \ No newline at end of file diff --git a/browsers/edge/group-policies/search-engine-customization-gp.md b/browsers/edge/group-policies/search-engine-customization-gp.md index cc58a01261..1ce3437a76 100644 --- a/browsers/edge/group-policies/search-engine-customization-gp.md +++ b/browsers/edge/group-policies/search-engine-customization-gp.md @@ -10,7 +10,7 @@ ms.date: 07/25/2018 By default, Microsoft Edge uses the default search engine specified in App settings, which lets users make changes to it. You can configure Microsoft Edge to use the policy-set search engine specified in the OpenSearch XML file. You can also prevent users from making changes to the search engine settings. -**Policies** +## Relevant group policies - [Set default search engine](#set-default-search-engine) - [Allow search engine customization](#allow-search-engine-customization) diff --git a/browsers/edge/group-policies/security-privacy-management-gp.md b/browsers/edge/group-policies/security-privacy-management-gp.md index 6b576d712b..2af6f28da2 100644 --- a/browsers/edge/group-policies/security-privacy-management-gp.md +++ b/browsers/edge/group-policies/security-privacy-management-gp.md @@ -3,25 +3,17 @@ title: Microsoft Edge - Security and privacy management description: Microsoft Edge helps to defend from increasingly sophisticated and prevalent web-based attacks against Windows. While most websites are safe, some sites have been designed to steal personal information or gain access to your system’s resources. ms.author: pashort author: shortpatti -ms.date: 07/25/2018 +ms.date: 07/27/2018 --- # Security and privacy management ->*Supported versions: Microsoft Edge on Windows 10* -Microsoft Edge helps to defend from increasingly sophisticated and prevalent web-based attacks against Windows. While most websites are safe, some sites are malicious in nature, like stealing personal information or gain access to your system’s resources. By no longer supporting VBScript, JScript, VML, Browser Helper Objects, Toolbars, ActiveX controls, and Internet Explorer document modes, Microsoft Edge significantly reduces attacks making the browser more secure. +Microsoft Edge is designed with improved security in mind, helping to defend people from increasingly sophisticated and prevalent web-based attacks against Windows. Because Microsoft Edge is designed like a Universal Windows app, changing the browser to an app, it fundamentally changes the process model so that both the outer manager process and the different content processes all live within app container sandboxes. +Microsoft Edge runs in 64-bit not just by default, but anytime it’s running on a 64-bit operating system. Because Microsoft Edge doesn’t support legacy ActiveX controls or 3rd-party binary extensions, there’s no longer a reason to run 32-bit processes on a 64-bit system. + +The value of running 64-bit all the time is that it strengthens Windows Address Space Layout Randomization (ASLR), randomizing the memory layout of the browser processes, making it much harder for attackers to hit precise memory locations. In turn, 64-bit processes make ASLR much more effective by making the address space exponentially larger and, therefore, more difficult for attackers to find sensitive memory components. -| | | -|---|---| -| **Windows Hello** | Authenticates the user and the website with asymmetric cryptography. | -| **Microsoft SmartScreen** | Defends against phishing by performing reputation checks on sites visited and blocking any site that is thought to be a phishing site. SmartScreen also helps to defend against installing malicious software or file downloads, even from trusted sites. | -| **Certificate Reputation system** | Collects data about certificates in use, detecting new certificates and flagging fraudulent certificates automatically. | -| **Microsoft EdgeHTML** | Defends against hacking through the following security standards features: | -| **Code integrity and image loading restrictions** | Prevents malicious DLLs from loading or injecting into the content processes. Only signed images are allowed to load in Microsoft Edge. Binaries on remote devices (such as UNC or WebDAV) can't load. | -| **Memory corruption mitigations** | Defends against memory corruption weaknesses and vulnerabilities with the use of [CWE-416: Use After Free](http://cwe.mitre.org/data/definitions/416.html) (UAF). | -| **Memory Garbage Collector (MemGC) mitigation** | Replaces Memory Protector and helps to defend the browser from UAF vulnerabilities by freeing memory from the programmer and automating it, only freeing memory when the automation detects that there are no more references left pointing to a given block of memory. | -| **Control Flow Guard** | Compiles checks around code that performs indirect jumps based on a pointer, restricting those jumps to only going to function entry points with known addresses. Control Flow Guard is a Microsoft Visual Studio technology. | ## Configure cookies @@ -46,3 +38,14 @@ Microsoft Edge helps to defend from increasingly sophisticated and prevalent web [!INCLUDE [prevent-localhost-address-for-webrtc-include](../includes/prevent-localhost-address-for-webrtc-include.md)] + +| | | +|---|---| +| **[Windows Hello](http://blogs.windows.com/bloggingwindows/2015/03/17/making-windows-10-more-personal-and-more-secure-with-windows-hello/)** | Authenticates the user and the website with asymmetric cryptography technology. Microsoft Edge natively supports Windows Hello as a more personal, seamless, and secure way to authenticate on the web, powered by an early implementation of the [Web Authentication (formerly FIDO 2.0 Web API) specification](http://w3c.github.io/webauthn/). | +| **Microsoft SmartScreen** | Defends against phishing by performing reputation checks on sites visited and blocking any site that is thought to be a phishing site. SmartScreen also helps to defend against installing malicious software or file downloads, even from trusted sites. | +| **Certificate Reputation system** | Collects data about certificates in use, detecting new certificates and flagging fraudulent certificates automatically. | +| **Microsoft EdgeHTML** | Defends against hacking through the following security standards features: | +| **Code integrity and image loading restrictions** | Prevents malicious DLLs from loading or injecting into the content processes. Only signed images are allowed to load in Microsoft Edge. Binaries on remote devices (such as UNC or WebDAV) can't load. | +| **Memory corruption mitigations** | Defends against memory corruption weaknesses and vulnerabilities with the use of [CWE-416: Use After Free](http://cwe.mitre.org/data/definitions/416.html) (UAF). | +| **Memory Garbage Collector (MemGC) mitigation** | Replaces Memory Protector and helps to defend the browser from UAF vulnerabilities by freeing memory from the programmer and automating it, only freeing memory when the automation detects that there are no more references left pointing to a given block of memory. | +| **Control Flow Guard** | Compiles checks around code that performs indirect jumps based on a pointer, restricting those jumps to only going to function entry points with known addresses. Control Flow Guard is a Microsoft Visual Studio technology. | \ No newline at end of file diff --git a/browsers/edge/group-policies/start-pages-gp.md b/browsers/edge/group-policies/start-pages-gp.md index 2dd04e1e28..ddb428bcc4 100644 --- a/browsers/edge/group-policies/start-pages-gp.md +++ b/browsers/edge/group-policies/start-pages-gp.md @@ -9,13 +9,13 @@ ms.mktglfcycl: explore ms.sitesec: library --- -# Start pages +# Start pages configuration options >*Supported versions: Microsoft Edge on Windows 10, next major update to Windows* Microsoft Edge loads the pages specified in App settings as the default Start pages. You can configure Microsoft Edge to load either the Start page, New tab page, previously opened pages, or a specific page or pages. You can also configure Microsoft Edge to prevent users from making changes. -**Policies** +## Relevant group policies - [Configure Open Microsoft Edge With](#configure-open-microsoft-edge-with) - [Configure Start Pages](#configure-start-pages) @@ -35,7 +35,7 @@ Microsoft Edge loads the pages specified in App settings as the default Start pa [!INCLUDE [disable-lockdown-of-start-pages-include](../includes/disable-lockdown-of-start-pages-include.md)] -## Configuration options +### Configuration options | **Configure Open Microsoft Edge With** | **Configure Start Pages** | **Disabled Lockdown of Start Pages** | **Outcome** | | --- | --- | --- | --- | diff --git a/browsers/edge/group-policies/sync-browser-settings-gp.md b/browsers/edge/group-policies/sync-browser-settings-gp.md index 9a056e4c25..957e790520 100644 --- a/browsers/edge/group-policies/sync-browser-settings-gp.md +++ b/browsers/edge/group-policies/sync-browser-settings-gp.md @@ -3,19 +3,18 @@ title: Microsoft Edge - Sync browser settings options description: By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. ms.author: pashort author: shortpatti -ms.date: 07/23/2018 +ms.date: 08/06/2018 --- # Sync browser settings options ->*Supported versions: Microsoft Edge on Windows 10, next major update to Windows* - -By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. The “browser” group uses the Sync your Settings option in Settings to sync information like history and favorites. You can configure Microsoft Edge to prevent the “browser” group from syncing and prevent users from turning on the Sync your Settings toggle in Settings. If you want syncing turned off by default but not disabled, select the _Allow users to turn “browser” syncing_ option in the Do not sync browser policy. -## Policies -- [Do not sync browser settings](../available-policies.md#do-not-sync-browser-settings) +By default, the “browser” group syncs automatically between the user’s devices, letting users make changes. The “browser” group uses the Sync your Settings option in Settings to sync information like history and favorites. You can configure Microsoft Edge to prevent the “browser” group from syncing and prevent users from turning on the _Sync your Settings_ toggle in Settings. If you want syncing turned off by default but not disabled, select the _Allow users to turn “browser” syncing_ option in the Do not sync browser policy. -- [Prevent users from turning on browser syncing](../new-policies.md#prevent-users-from-turning-on-browser-syncing) + +## Relevant policies +- [Do not sync browser settings](#do-not-sync-browser-settings) +- [Prevent users from turning on browser syncing](#prevent-users-from-turning-on-browser-syncing) ## Configuration options @@ -27,6 +26,13 @@ By default, the “browser” group syncs automatically between the user’s dev ## Verify the configuration To verify if syncing is turned on or off: -1. In the upper-right corner of Microsoft Edge, click the ellipses \(**...**\). +1. In the upper-right corner of Microsoft Edge, click **More** \(**...**\). 2. Click **Settings**. -3. Under Account, see if the setting is toggled on or off.

![Verify configuration](../images/sync-settings.PNG) \ No newline at end of file +3. Under Account, see if the setting is toggled on or off.

![Verify configuration](../images/sync-settings.PNG) + + +## Do not sync browser settings +[!INCLUDE [do-not-sync-browser-settings-include](../includes/do-not-sync-browser-settings-include.md)] + +## Prevent users from turning on browser syncing +[!INCLUDE [prevent-users-to-turn-on-browser-syncing-include](../includes/prevent-users-to-turn-on-browser-syncing-include.md)] \ No newline at end of file diff --git a/browsers/edge/group-policies/telemetry-management-gp.md b/browsers/edge/group-policies/telemetry-management-gp.md index e69de29bb2..242ecf0298 100644 --- a/browsers/edge/group-policies/telemetry-management-gp.md +++ b/browsers/edge/group-policies/telemetry-management-gp.md @@ -0,0 +1,26 @@ +--- +title: Microsoft Edge - Telemetry and data collection +description: +ms.author: pashort +author: shortpatti +ms.date: 07/29/2018 +--- + +# Telemetry and data collection + + + +## Allow extended telemetry for the Books tab +[!INCLUDE [allow-ext-telemetry-books-tab-include.md](../includes/allow-ext-telemetry-books-tab-include.md)] + +## Configure collection of browsing data for Microsoft 365 Analytics +[!INCLUDE [configure-browser-telemetry-for-m365-analytics-include](../includes/configure-browser-telemetry-for-m365-analytics-include.md)] + + + +## Configure Do Not Track +[!INCLUDE [configure-do-not-track-include.md](../includes/configure-do-not-track-include.md)] + + +## Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start +[!INCLUDE [prevent-live-tile-pinning-start-include](../includes/prevent-live-tile-pinning-start-include.md)] \ No newline at end of file diff --git a/browsers/edge/images/allow-shared-books-folder_sm.png b/browsers/edge/images/allow-shared-books-folder_sm.png new file mode 100644 index 0000000000..fc49829b14 Binary files /dev/null and b/browsers/edge/images/allow-shared-books-folder_sm.png differ diff --git a/browsers/edge/images/home-button-hide-sm.png b/browsers/edge/images/home-button-hide-sm.png new file mode 100644 index 0000000000..beab1c22ef Binary files /dev/null and b/browsers/edge/images/home-button-hide-sm.png differ diff --git a/browsers/edge/images/home-button-hide-v4-sm.png b/browsers/edge/images/home-button-hide-v4-sm.png index b8adce292b..fe21f0523c 100644 Binary files a/browsers/edge/images/home-button-hide-v4-sm.png and b/browsers/edge/images/home-button-hide-v4-sm.png differ diff --git a/browsers/edge/images/home-button-hide-v4.png b/browsers/edge/images/home-button-hide-v4.png index ef43ce6f77..761143f0c8 100644 Binary files a/browsers/edge/images/home-button-hide-v4.png and b/browsers/edge/images/home-button-hide-v4.png differ diff --git a/browsers/edge/images/home-button-hide.png b/browsers/edge/images/home-button-hide.png new file mode 100644 index 0000000000..761143f0c8 Binary files /dev/null and b/browsers/edge/images/home-button-hide.png differ diff --git a/browsers/edge/images/load-any-start-page-let-users-make-changes.ai b/browsers/edge/images/load-any-start-page-let-users-make-changes.ai deleted file mode 100644 index 04b3c0b6ca..0000000000 --- a/browsers/edge/images/load-any-start-page-let-users-make-changes.ai +++ /dev/null @@ -1,7588 +0,0 @@ -%PDF-1.5 % -1 0 obj <>/OCGs[13 0 R 76 0 R 138 0 R 200 0 R 262 0 R]>>/Pages 3 0 R/Type/Catalog>> endobj 2 0 obj <>stream - - - - - application/pdf - - - Print - - - 2018-07-22T15:12:45-07:00 - 2018-07-22T15:12:45-07:00 - 2018-07-22T15:02:37-07:00 - Adobe Illustrator CC 22.1 (Windows) - - - - 176 - 256 - JPEG - /9j/4AAQSkZJRgABAgEASABIAAD/7QAsUGhvdG9zaG9wIDMuMAA4QklNA+0AAAAAABAASAAAAAEA AQBIAAAAAQAB/+4ADkFkb2JlAGTAAAAAAf/bAIQABgQEBAUEBgUFBgkGBQYJCwgGBggLDAoKCwoK DBAMDAwMDAwQDA4PEA8ODBMTFBQTExwbGxscHx8fHx8fHx8fHwEHBwcNDA0YEBAYGhURFRofHx8f Hx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8fHx8f/8AAEQgBAACwAwER AAIRAQMRAf/EAaIAAAAHAQEBAQEAAAAAAAAAAAQFAwIGAQAHCAkKCwEAAgIDAQEBAQEAAAAAAAAA AQACAwQFBgcICQoLEAACAQMDAgQCBgcDBAIGAnMBAgMRBAAFIRIxQVEGE2EicYEUMpGhBxWxQiPB UtHhMxZi8CRygvElQzRTkqKyY3PCNUQnk6OzNhdUZHTD0uIIJoMJChgZhJRFRqS0VtNVKBry4/PE 1OT0ZXWFlaW1xdXl9WZ2hpamtsbW5vY3R1dnd4eXp7fH1+f3OEhYaHiImKi4yNjo+Ck5SVlpeYmZ qbnJ2en5KjpKWmp6ipqqusra6voRAAICAQIDBQUEBQYECAMDbQEAAhEDBCESMUEFURNhIgZxgZEy obHwFMHR4SNCFVJicvEzJDRDghaSUyWiY7LCB3PSNeJEgxdUkwgJChgZJjZFGidkdFU38qOzwygp 0+PzhJSktMTU5PRldYWVpbXF1eX1RlZmdoaWprbG1ub2R1dnd4eXp7fH1+f3OEhYaHiImKi4yNjo +DlJWWl5iZmpucnZ6fkqOkpaanqKmqq6ytrq+v/aAAwDAQACEQMRAD8A9Q29vb/V4v3SfYX9keGK qn1a3/30n/AjFXfVrf8A30n/AAIxV31a3/30n/AjFXfVrf8A30n/AAIxV31a3/30n/AjFXfVrf8A 30n/AAIxV31a3/30n/AjFXfVrf8A30n/AAIxV31a3/30n/AjFXfVrf8A30n/AAIxV31a3/30n/Aj FXfVrf8A30n/AAIxV31a3/30n/AjFXfVrf8A30n/AAIxV31a3/30n/AjFXfVrf8A30n/AAIxV31a 3/30n/AjFXfVrf8A30n/AAIxV31a3/30n/AjFXfVrf8A30n/AAIxVZNBCqqVjUEOlCAAftjFV9t/ vPF/qL+rFWHN5uS1hntk1S0ivRqlxDcSXr+qtrBzkKPJGJI2VPhVFqyj4hmd+Xsg8JrhHLqdnEOc AEWLvr096WT/AJmakk9tEq2xaWMCblGVWMmP1PrVfX9ZrfgfU/uQONRzqMtGhjR5/jpyq+nP4MDq jdbfjrz5fD4plZeaJ7fyzqepyahBdSLfvDb3qLztSCUVeKyXESInX7U4UHue9csAOSMaI9PLr936 GYzEQMrB359Pv/ShdN88eZry0TURDaNavIsItVjk9ZmXTxfSkP6rJ8XFkReJ6ipNN5T0uOJ4d7/4 9w9zGGeZ32r/AI7fem+peaby20Ky1QPb26X1x+69ZCa2zh2iohliJldApIBJ3NEY7ZTDADMx3ND7 fly/Fts8pEQdhZ/Hx/FMZuPzI1jTrREku7S+vkFx9Zj9ARFWRpVQH/SuZ4mL4gsR26lTvmUNFGR5 EDbr7v6P6XHOplHqCd/x9TI7TV/MNtea1Fqd7Zzz2Vil1BaQwNFQlHJYcpZHZOS8Sf1dMxpY4ERM QdzV3+xvjOYJEiNh3ftSG7/M2/tdIku/rNhdyrGk0ctvERAzGIyS2pMtzHSVPh+yzNQ/3dQRmRHQ gyqpD7/f9PL8W0T1ZjC7B/HLnz/FKl5+YusQSSKj2MjUkMtuqkSWPC6SAC6aW4hjY8X7tHv7UqI6 OJ7/APitr22P6WU9TIXy/Vv13H6E7n8030enaLNcTWemtqCM893P+/t6oAVjj9GYKXmDck/enYH7 RygYAZSAuVdOR+0dPc2nMaiTQv8AHf196W2HnPzDqF1ZWdnPpzz3zJ6pEMziyJjmkeCdRMOUtIdt 06H4aUOWT00IgkiVD3b8txty382Ec8pGgY2fs57Hf9SAsfM2trPNqtzcQqbtYwDIbkWtoCtiHdoz cemyL9bYluKtUVLBT8NksEKEQDt7rP1eXkwGSQuRI399Dl5+fki2/Mi4h0qSSSeylvmKCxMausVy BqE9rI8amRmKiGBX2bYnqajI/kgZcjXXy9IP3lI1R4dyL+/1ELJPPnmi1uJLa4is5JobcTScQsQo 9uJvWVGunuGjiZgj8YSDRm5r0BGkxkWL5/pqvpqz7/gj8xMSo1y/B+q66cvimeleZpU0rVdTnv7a 9hh1SCE3kPJbVYHFrHI0YaSTgqq7MfjK8qt0ynJg9UYgEek7db9TbDL6TIkHfn06JafP11dm49Oa 1khSUNZxwiQSNHHfpCkkjpOrgMhFVMYRv5j8SC38oBXPz/0vu/Tf3sPHJ6j8S9/4+xdN548wWsKJ fT6bazPbJeC9kimFv+8iLpahTMGMrMrcW57gfZrtiNLAnYSO9Vtfv5clOeQG5iPPp7ubONMuZLrT bS6kAEk8McrhagAugY0rXbfMCcakR5uXE2AUTkGTsVU5/sD/AF0/4mMVdbf7zxf6i/qxVJx5iuRJ c3UtpHBoVo80c2oSTESkwFldkt1jaq+onAfHyPZcyPBGwv1npXf5tXiGya9I6/sWf468siYQtcTL NWjxNa3SvGSyqPVUxAxVLrTnTqPEY/lclXX2j9e6BqIfgH8D4oPTfzB06e1a5v4zZoSWghRLqacx gvWSSIW6MgCx1JHJR3PjZPRyBob/ACr72EdSCLO3z/Ui9V8w+VrjRi15cyNp94j/AN0tyruqTx27 AeiBL/eyolB1r3Fchjw5BLYeoe7uvrtyZZMsOHc7H399dEVYeY9JvIp1071JWtYy6wCGWEuq1WkX qKgccl4/DUA7ZCeGUSOLr5s45AeXRBab5ygnNtFd27JcXcEt1GLJZ72IRw8QyvIkKUlBahjCmh2r VlBnPTEXR2Breh+nl5sI5+QI3PdZ/RzU77zz5Wkgkt2+tXSycIbiGGzu2ZRPKbbjJSMcG5hhxJDb UALUGShpcgN7D4jpv3/sYy1MOW5+B93cu1HzVHpWs2ujx28TRNFbFVadluik8jxfubb03aX0hFyf 4gQMENPxxMr7+m23eb2vomWbhkI/p3+A6qFtrnknT7ua9R7hLqYlJxLFfO8ILg8WikVvqyM8goOK qe2SliyyFbV/m/g/aiOTGDe+/wDW/A+xMl84+X3l9JJ5WcsFULb3B5A8v3ikR0aP4GrIPgFNzlX5 afd9o/F+XNs8aP4B/Hx5J1lDaoXtlb3ts9tcBvSehPpu8TgqwZSrxlXUggGoOSjIxNhEogii6wsL WwtI7S0T04I68VLM5qxLMSzFmYliSSTXGczI2VjEAUFfIpdirsVQWq6NYapCIbxZGjFQRHLLCSrC jKxiZCysOqnY5ZjyGBsMJwEhRRiIiIqIoVFAVVUUAA2AAGVks28VdiqnP9gf66f8TGKutv8AeeL/ AFF/ViqTXPlK3nNyn1+8isrpnlewjeMRLLJUmRCY2lU8z6lOfHlvTMiOoIrYWOv428mk4ee5ruWJ 5Lsf9Mee8urm4vwouriVog7cGUqQEjRFoI1XZaU998P5k7UAAPx3qMIF2SbS7WfJF0IFbQrlobz0 WtWmllWOkLg1FRBOGBYgleIOwoy03sx6oX6xtz/G4/HRhkwmvSd/x5H8dUXY+QrG2aAtfXUqW3Ew 27GIRI31iG6cqBHz+OW2UmrnYmmQlqyb2G/6iPuKRpwDdn8EH9CK0fyfpWkSXsllWNr3kCyx26PG GYsQsscSStu23qO2RyamU6vp7/118qZY8EYEkdfd+r70PP5GtbgSGfUrySab1frE5+rBpRMsC0ZR AI6L9UjoAorQ8uQJyQ1RHID7fPz8yx/L+Z+zy8vJ2neQ9L0/TJrC1uLiNZpI5hMPQDpJDcNcoY1W IRACRvs8ONNqYz1cpSBIH291d9rDTRjHhB+7vvupNbrRra5e+d3kDahapZTFGCkRp6tGQgVDfv23 +WUxyEV5G/u/U2mAN+YpiVx+XFxbcoNGuzDbXrodTd2hh5Irq1BBDbCNhQNxCmOhJqSDTMwa0HeQ 3HLn95P63GOmI2idjz5fq/UmNv8Alvolsf8ARpZYAJknX0orNGHAllX1VgEpoT9ouXHZtzWs62Z5 /p/XX6PJnHSxHLv8v1ft82V5huS7FXYq7FXYq7FXYq7FXYq7FVOf7A/10/4mMVdbf7zxf6i/qxVU xVjHnjz7p3lO3tzPBJd3l4xW1tIqBm40qSTWg+IDod8y9LpJZiaNAdXG1OqjiAvcno7yV58sPNCX USW8ljqNi3C7sZvtpuRUGgrupB2qDjqtIcVb3E8iun1Uct1sRzCM1jzloOkagtjfSyJIIRc3Eqwy PDbwMWVZbmVVKRI7RsqlyOh8DmI5KS6z+cn5caVbCd9bt7pmKBYLWRJZCJF9QNTkAqhPiYsRT5kY ppNP+VieRP33+5+wrblxMPXj+Exusb137NIo+kYopo/mH5NbT5b601SK/iieKH0rEm5maW4FYY0i i5OzSb0FOx/laitKFv8Aml+Xk0Rk/T9nCyKrywzyrDLHzIFJI5OLIwLgMCNu+KaV3/MPyWscMiat bzxzX0elh4WEqrdzAmONyleNeJ3O2KKQFh+b35eXsbTJrMEMAMojlnYRCQQFhIyBvi4r6Z3IHbxx TSOP5j+QgGP6fsaIZVb9+mzQAGQdeo5jbvXbFaQVt+bfkK6m1eK11NJzotrJfXbRAurW8MayySQl a+oFVx069q4rS2H83vy/eRI5tVjtHaD6zILr9yY1LIqrIHoVdvUDKv8AL8XTFaR2ofmN5LsdOfUZ dVhkso5praSeA+sizW8D3EkbGPkA/pxNxB3Y0ArUYopK5Pzp/LqNiG1QBeYRHKMFb/SI7Z2BIHwx yTLyrTapFaHFNM0trm3uraK6tpVmtp0WWGaMhkdHHJWVhsQQag4oVMVdirsVdiqnP9gf66f8TGKu tv8AeeL/AFF/ViqpirB/zM/L6580x2N1YXKW+o6czGP1uXpurFTQlalSCuxAzP0OsGGxIXEuFrNK ctEGpRVfIPka70K+1XWdTnil1XV5WklS25ejGrO0hVC4DGrN3GDV6sZBGMR6Y9/NOl0pxmUifVIo Lz9J+W51yO38y3U9rd3Foq3BimuIYntucnofWPRKqQkpdoyfstU7ZguaElg8sfkTfzQaXFcJPcTN cBYjc3HqNLfwxWc5lYtUSSfV0Q8qH1NvtGmK7sb0Hy/+R1zbNLeatdagl36k0BlNxALe2ohS2Kp2 IiVlU9aKQBtUJ3Zxpfln8nxbXraZPDAddukufViupIrhru2X1la3YsJRLF6/IhdwWKkfs4QEEsdj 8lfkXqMF3NdXDXVpczpLa2kstyPQf6vaxyFIySzSS+kpkkILNuK/CcyZaPKDVNEdVAiwWQX/AJb/ ACbitJdMvZYUt5ZecsT3MwrJCstvUMGrVfWkGx6iv7O0Y6XIeUSylqIDmQltlon5JJ9Y9GV7COKa eO4tjc3EKP6kgkPKIP8AFH6hDJUdRt0yZ0WUVtzYjVQ335LpvJ/5KR3cLLcOb6OdVtFhvLgzRSSy qkRiAfkogeJSlNloD/LkRpMnOknUQBq2U2v5U+SrWK8itrWWKK/spdNukFxMQ9tNFHCynk53CRCh 6jfMdutI9Z/ITyle2qx2N1e6ddCqfW1uJZGEckZhmVVZ+CmWI8WIG/euK2nmn/lL5CsNEfRINMX9 HSXsepPCWY1uIipQ1BHwjhTj0pUd8VtRsPye8hafPZzWVlJA9iYzCEuJgp9KeK5QOvKjD1reN6Hu MVtlelaZZ6VpdnpdkhjsrCCO2toySxWKFAiDk1SaKo3OKEVirsVdirsVU5/sD/XT/iYxV1t/vPF/ qL+rFVTFWm+yflirl+yPlirzX8ztZjsdYWvkg+ZJoLITwaiYTLFGSZg0bkRydOApSp+M9K7qQkvl u50Y+YfrrflzNazadDcTR6lawSFZ1hihkhkhjkjiMkkz8vTEgDKRWvJjilNtVn0mO5R4PIplt59O tpHMlqVnSMgQi3aNUYI8cXw/a+GngMzMOmjONmQBtxcmeUZUASEX5YutLmutJ06PyjPbWkT3bwXd 9A0jwzSMJZJfUkVipmZ35Gu7U7Y5NKIRJ4gSK5LDOZEDhIBZePKnlkAAaVaAAcR+5TYcVXw/lQDK fzGT+cfm2eFDuC6fyx5cnZ2m0y1kaXl6haFCW5tzatRvVt/ngGeY5SKTiieYCFn8jeUp7v61LpcD SEFWTiBG1SDVox8DHbqRkxqsgFcRYnBAm6RZ8s+XTIsh0y25oyyK3pJUMhLKw26gsch48+8svDj3 BMsqZuxV2KuxV2KuxV2KuxV2Kqc/2B/rp/xMYq62/wB54v8AUX9WKqmKtN9k/LFXL9kfLFVG+vre ytmuJyRGtBsKkk9AMVU4tW0+Sw+vmZYrXo0kpCBTXjRidhucVdBq+lzxQSxXcTJdKr255gFw681o Dvuu+Krn1LTkpzuoVrSlZFFeW4798VUhruiEqo1C2JY8VAmjqWorUG/Wkin/AGQ8cVbudb0e2SZ7 i+gjW3r6/KRQU4ip5CtQaDFV1xq+lW1ubie8hjgDCMys6hQ5FeNa9ab/AC3xV36X0nky/XYOSCrj 1UqAWCb7/wAzAfPFVSG/sZpTDDcxSzBeRjR1ZgoPGtAa0rtiqvirsVdirsVdirsVdirsVU5/sD/X T/iYxV1t/vPF/qL+rFVTFWm+yflirl+yPliqE1iya8024t0VWmZGMAkJVfUAqnJgGIHLqQDthjV7 8kG625qUGjWzaNFp13ErJxjadEZipkUhyQ3wsRzHgMTV7KGNXnk7yBDe3l/dzqlxAIYZXE5RrdfR SGCM8CDuEVl5VNfbFKE1PyR+UDT/AFm8+qxzgW9i8n1xlYiJFjghekm9FQHffbl74qjNU8t/ltBb +hevFBDdSzzhPrDjk6JHHOq0bssSKyj5dTk4Y5S5C2EpxjzKl5g8m/lbdmSXVli/ffWJpyLmRQ4Z 3mnLcH3HIMfam3TDHFM8gVlOI5lGw+TPIFsv1dI4kHry3rqZ2qzsVilLktUrz4gg7csjwS7k2Enu /wAvvyyiiubWKcWMztFDcyC4Z5OPMIIh6pela8NunTJDFM9EGce9PPLvlnyP5buDNpDR2rSxiEJ9 YLIVch1orMQWO3xdSPbI8Eu4p4gnd1r2i2srRXF7DFIiPI6s4qqxlQxbwoZF6+OGOKR3AQckRzLj r2iCP1Df24Tlw5GVB8XMx06/zimPhT7injj3uh13RZ1laK+gdYXaOUiRfhdCFYHfsWA+nE4pDoVE 4nqqnU9NUVa7hA2G8i9SxQd/5gR88gYkdE2FOPWtHkkMSXsDSLIISokWvqN9lBvux8BgSuTV9Jk9 T072B/RDNLxlQ8AlCxah248hWvjiq6DU9OuJzBBdQyzheZiSRWfjt8XEGtPiG/viqJxVTn+wP9dP +JjFXW3+88X+ov6sVVMVab7J+WKuX7I+WKt4q7FWMectM0r9H3M9xYXF99daCG5htnkUsEcFGPA7 cabECtT26gq89VdCtdMRYvJN3b6PY3cd1cGaSZRyihlKypUDkvx8at1FKjwUIiGXyxdaFZtb+TtV msLtpTNBEZeXK+ZJCz1ZfUUiCN1NdiE+i7Fnnj+k/j8Fqy4Yz+ofj8BkPl/yB5P1fRhPc6XLbSTE i4tXluBxIZ3WhfgSKTcqgdfll35/LfP7A1/k8dEVz/H6U5f8tvKL24tvqrpBylZo0mlAYzOsjcqN vRkWnyyI1uS7tl+WhVUsuPyx8m3D8pbN2qasvrSgH42cA/F0Bkb78Rrso6/Yp0uM8wsH5V+RxMs3 1AmVU4czLJU/Dxqfi+174fz+WqtH5THd1ujpfIvlqQ3zNbMG1Eym6YSOC3rukklN9uTRg7ZWNVkF b8v0MzghvtzQkX5Y+TY7ua7Wyb15gQzGaU0rIJPhBbb4hkzrspFWwGkxiXFW6zV/yv8AKuowyIIn tZJefqTQueREsolkqG5KS3GlSK0+WHHrskT3rk0kJDu/G61/yq8nGD0I7eWKFiokRJn+JFaRvTJJ JAJmatN/fK8upnkFSLPHghD6QuuPyu8pyac9jFFLbo6lPVjlf1FRgVKqzFqfC1Aeo2I3GUW3IxvI HlRr2e8NlSW4T0pFDuE48eNAgbitBXp4nBaqnl/yT5c8vy+rpVs0DcGiAMkjgI5ViKOzftIDiqe4 qpz/AGB/rp/xMYq62/3ni/1F/ViqpirTfZPyxVy/ZHyxVvFXYqx3UvPGl6dNrMU0ckjaLAlxOsJj kkcMnMokYbnzCkGhHceIxVji/np5Cmna2Zrj02t7mfk0JZXjt5zBtStfVpzUGnwlSaVxVNdX/NLy xpN39XuhOIgOJmERCh+CyLHxbi3Io+23t1phpVn/ACtvyd69tAZLgS3ao8Ceg5JWSRY0NBXr6it8 vfbGlREH5leXZ7u3tI1nMt3ape2pCKVkjkiMoCkMfiotCD3xpUJon5u+VtWtmkhS6jmW2lvGt2iq wiiVXrzUtH8SyKR8VPEjJQgZEAdWMpULXSfmt5dSGTjHNLeRJMxtowrrygUFh6ykxkEsFBBzLGgn fl+vycc6uHx3+xbb/m75SltbedmmV7gqixCMsfUIWqjoTu4FafhiezsgJHcga3GQD3q7/mh5cEFr cos7Wd1FLMsxQJRYi6miOVdt4m+yDTavXB+RnZG1hl+bhQPQtwfmj5WuXdLYzyukcjj9yyqTFbm5 ZAzUHL01P+dMToMg51+DSjVwJofja/uULD82PLl4ZisVyiRFEXknxMzRGUgLXagWnzwz7PnGuSIa uEr5/gW1P+b/AJOjChJJ5JZIjNFGImBIDMgG9KEsn0V370R2dl8kHW4+XWmp/wA2NGt7dZZrS4jJ jnZ0IX4Xt5fRKEg/tP0PhvhHZ8iaBHT7d1OriBZB6/YaTPQfzB8ua5qCafYvKbp43lCvGwHFCAfi 6D7XfKsujnjjxHk2Y9TCRoc2SZit6nP9gf66f8TGKutv954v9Rf1YqqYq032T8sVcv2R8sVbxV2K oLVLS4ksbs6eUg1KWJhBcFV+2B8AckNVa9fbJ4yBIXyYyBo1zYMvl381gxdtTtJGZEQ/CFFY5G6r 6W4ZAOQr+0fDM/xdN/NP4+LiCGfqQr6rY/mvdyX4sW063jZnFm0w+IugPpF+KOfSJAqPt/RtmuNO YmXlzTfMh1+8u9esrMgQrDDfRKvqNRlcxrtX0gd15Ubsa0BxSyoQwgqQigoOKEAbDwGBWxFEKURR QECgHQ0qPwxVoW8AFBGoHSgUeAH6gBhsopQttJ0y1kllt7SKKSaQzSuiKC0hABYmnXbJSySPMoEA OQVJ7KzuIWgngjkhZSpjZQV4t1FD44BIg2CkgFeIIRWka79dh4cf1bYLKabMMRNSikk1JoOvSv44 2Vpb9Xt619JK+PEe/wDzUcbKKc1vbuatEjHfcqD16/fjxFaUrLTdPsYzHZW0duhZnKxqFq0h5Mdv E4ZTlLmbRGIHIInIslOf7A/10/4mMVdbf7zxf6i/qxVUxVpvsn5Yq5fsj5Yq3irsVYzq1n51kn1z 9H3MccNxaqmjlmA9KdV+JivAn4mb+btiqS3en/nEXjW2v7ARRqSjvUOztEVUSgRkFUkarcd2A2o3 UqiRpn5qtawBtTskuIJLk0CnhIgEf1USkozE/DIJKU+0O4xVd+jfzMmSxa4v7ZJ1gIv/AKuSkTS+ pIfgVkdvsGPfkOjbb5k4Z4hH1Cy0zjMnY7IZNP8AzdlvoWuL2xjtQsQlERYGvwNLtw3+JSB7E5eZ 6YDYStpjHPe5jX4tHxxfmcotOUlg8rRwfXWJYRq6SzGUIoTkecbxb1/ZNAK5WTg3+rrX2V+lkBm2 uun6b/Qgza/m8szmO5sDG9GYOSeLemqlUHDYcwxH0e+T4tNXKSKz3/CjbC3/ADOW+Rr27057VTIr IiOoZQpEb92BZtyK7ZXM6ethK2UBlvchCvpX5nyWTs2pW8d/LPGaRmkSQpGwNKxt8RcgmnUjwyYy acHkar8dUcOWuYtda2f5qSBze3llHT1REkG5IaGURs7GPcrKY+gGMpaccgfwR591oiM38RHwQ8sf 5uWl1FaRTWd7bMnBLwqAyusNeU1ePw+pt8IJOSB0xF7g93x6IPjg1sR+zqrIv5shbaOV7EysLxrm aOgjACRC1UBl5ci5kPSmwrt8Jxc5x8XouvNvxcdeur8lGxh/N+0niF3LY3sct1ykEZICQHk7qSyB l6BIyOVK7g9RS2s+wK7FVOf7A/10/wCJjFXW3+88X+ov6sVVMVab7J+WKuX7I+WKuJI6An5U/jir XJv5D+H9cVdyb+Q/h/XFXcm/kP4f1xV3Jv5D+H9cVdyb+Q/h/XFXcm/kP4f1xV3Jv5D+H9cVdyb+ Q/h/XFXcm/kP4f1xV3Jv5D+H9cVdyb+Q/h/XFXcm/kP4f1xV3Jv5D+H9cVdyb+Q/h/XFXcm/kP4f 1xVsMa/ZI+7+uKrJ/sD/AF0/4mMVdbf7zxf6i/qxVUxVhf5ifmD/AIX+p2drBHc6lf8AL0xM4iij RaDm7GnUmgFRmdo9H4tkmohw9VqvCoAXKSt5C88S+YWv7C/s/qOsaVJ6V5Crc4zuVqrexUgj8cjq 9KMdGJuMuSdNqfEsEVKPNM9T85aDpmpHT7uV0kih+s3k6xSNb20RDlHuZwpjhD+k3HmwrTMNy0l1 n85Py40q2E763b3TMUCwWsiSyESL6ganIBVCfExYinzIxTSaj8wvIxMoGvWJMJdZaTp8JiID13/Z qMUUoXH5meSItIk1aHVIr6zilit2NlW5f1pv7tOEQZqtimlNfzW/Lk2ZvP8AEFmIBH6vxPxfh6jR V9MgP9tCOn6xitLL381/IVjeWdteaosCX9nHqFrdyK627QTeoY6ykcVZhBIQrU+z44rSLP5j+QA7 ofMWnho3Mb1uYgAwDEgnlT9g/wCZGKKTywvrPULKG9spluLS4QSQTRmqsjCoIOKq+KuxV2KuxV2K uxV2KuxV2Kqc/wBgf66f8TGKutv954v9Rf1YqqYqxfzn5Jj1+ax1C3ufqOraYzPaXJjWZKHfi8bU ruKg12zL02q8MGJFxlzcbPp+Mgg1KPJb5E8h23leO7mNx9b1DUGEl1OEESClSERATxFWPfHVas5a FUAjTaYYrPMy5pT52k/LX9PyQeYLqa1u5rRVvvSmuIoHh5MkP1j0iEZ42kLRkiqbNt8OYjlhJYPL H5E380GlxXCT3EzXAWI3Nx6jS38MVnOZWLVEkn1dEPKh9Tb7Rpiu7HfL2hfkjNC091q91qKXXrS2 4mNxCtvbsgVbcon+QoKD5cQKioTuzXTfKf5RXGmX9hptzHFb+ZrrncpHeSRS3MyKJGiXk6u9BN8a b0Lb0IFChK4fKH5Hx3p1Eq4nKtG5mnugFSRjMBRm6dAoG9Ke+ZH5TJ3NP5iPeyZ/y7/L3zBpbQSW /wBfgW0ttKNyZZDL6FjI00SCWvL7cnJiD8W3UAZTKBjsWwSB5JNZ/wDOPnkgXVxc6objVJWneSxM srr9VhbkRDHRq7M/Ll4gUA3rFlb0HRNGsNF0m00nT0MdlZRrDAjMzkKvSrMSTihG4q7FXYq7FXYq 7FXYq7FXYqpz/YH+un/Exirrb/eeL/UX9WKqmKtN9k/LFXL9kfLFXnH5iWHmubXWm0jyvp+rwjT6 JqF0kckiyqtyzQ8HdOdZFtyvzcd8UhIvLflnzLbeYDqU/kTT1+ow3EljcxmK2muGEULWokT1Zo45 mkRy7Ny4E7d2KlkN5oNzJc2TxeTrFPrNnDDfwyLC4gIiMfpCVWUMIk4oCq9Af8nMnFDGY3I0Wicp g7DZW8o6bMl5a6RqXlq3t4LCOa8truQC5dJLmQNIRK3PjLLIzs++/wAhvLLixxjxRle6IZJk1IUy pfK3ltQwGmW1HIZ6xKeRClakkb/CxGU+PPvLPwo9yJ0rSrHS7NbOyj9OBSzBakmrnkxJPucjkyGZ spjERFBF5Bk7FXYq7FXYq7FXYq7FXYq7FXYqpz/YH+un/Exirrb/AHni/wBRf1YqqYq032T8sVcv 2R8sVWzzLDBJMwJWNS5A60UVxVLtI11dQmkhMPpPGCRRuQIBoey+OKob/G/lcSXUcl8sTWcrwziQ MtGjcRsdx9kOQten3jMj8rk225tXjw7+SlN+YfkyK1e4/SsLois3FCSx4AGgHiagDxJwjR5Sa4WJ 1OMC7TbTdY0zVIml0+5S5iQlWeM1WoJHXv0ymeOUPqFNsZiXIozIMnYq7FXYq7FXYq7FXYq7FXYq 7FXYqpz/AGB/rp/xMYq62/3ni/1F/ViqpirTfZPyxVy/ZHyxVsgEEEVB6jFUk8teXrrRzdm4vzf/ AFhw0dYUi9NRX4BwJ5Dfvl2XJGVcMeFrxwIuzbCvNn+Jra/vPqHkCz1C3Zp3a5ZopWuByjKPQFXQ vJIzOpUn4ajlgGoyDkTsk4YHoGNafc+eL6L6yn5ZWcc0P7uO3cLBGyTweseQdwpIXgvIg8WBXZmo kvzWX+cWPgY+4J9a6z+aelxJFpnkqyEkod7lYONsjSepNxFTKQtI0Q13BJoKVFKp5JS5m2yMAOS8 ecvzwR0WXyhbyK0cju0b0KOiuVjIM5Dc2j+0D0YbV2yLJVvvOn5yh4lsfJkchMaesss0ahZPRjMp V/WoyiZ3RR/KvKvxbKGQ2Ou/mI2j3k135YiXUoIke0t0vYwtxKzUZBXl6YRd6u2/TbrirE9d/Mb8 39Pn42/kczxFrl1ZWMn7iGRljr6bNR2QA709uuylGr5v/OY3UKv5QhjtgYRcP6qSMWKK0ioFmFBW vxmoWoHxcWOKqK+bPzy+tenJ5Qt1owRWSeNoWUlRyJMqspFGatafs7khsVS/VPPH58vpjLaeUEtb yZylvNtLxCqj82QSsF5/EoDdCdz8Jqqncnm/83zJNFbeUInKBjDLLMsSOVK0r+9fjyXkwG9OQXco eSrLvLOoeZry3J13Sk02ZYrZgUmWUSSyQK9wAq14CKUlBVjWlcUJ1irsVdiqnP8AYH+un/Exirrb /eeL/UX9WKqmKtN9k/LFXL9kfLFUp1Xzb5e0m8FpqV4trMUSSsgYKEkZ1Vi9OIHKMg77beIy7Hp5 zFxFtU80ImiaQw8/eUDIVGpxcVTm0hNFAoWpv3oP4dcn+UydyPHh3uvfPflu0MfOeR0ljjljkihk kUpMJGjIKrvUQvt7Yx0sz0/H4KnPAfj8dzdt598qXFobsX6RwBigeUNHUrEsxpyG9EcffTrglpMg NV+OSjUQIu1s/wCYHlG3lkin1BIpI2CsrBq0YKefT7I57k+B8MI0mQ8gp1EBzKbaXq+m6rbfWtOu FubfkU9VKlSQATQ9+uU5McoGpCi2QmJCwbCLyDJ2KuxV2KuxV2KuxV2KuxV2KuxVTn+wP9dP+JjF XW3+88X+ov6sVVMVab7J+WKuX7I+WKsI87Q6mNUnvJNDtdV0S100SuJERp57lLiq2yMSSo4/ECV4 8uppXLIZZR5EhhLHGXMWl9vY6x9cvmm8j2SyKjyQXa+lSWQFloV5Fujmg/aHhk/zGSq4ix8GF3QW KfNLaEGufKGny30CpZ3ELSQoptkjHIA8iqha8hvsDTtUxGaY6nvT4ce5eYfMEVlb8PJdjdSC6dpr WNoIWhjmjiHrBXdgxYeorDkPsBcPjz/nFfCj3BTOneZ9QM91qHk3TFvJtPacu/GUvdlkH1djzVqE eo3Km/w9KGpjqMgFCRRLDAmyAjYdX846bYWn6M8q20Uc7Syaisc0caQOJ1RmYcgN46k0J360pQ1y mZGybZxiByV/07+Zgj1FjotutxB6C6fbGRSLj4pRcOreqCop6R3+zXvkWSFbXPzcXVklOiwHSz6s UkIZOa8ZSI56+rViU34D5V74qm11q35gLNqkVtpEEvoq7aZKzhElYTKsaOS5+1ESxbbjTpvTFUtt PMf5pSI5l8vW6gu7RusqOpi4sy04y/aBCrT9qtfhpiq2bzL+aTKP+dfhtWHNz+8WYtwDMI0HqIWZ uIrt0rTscUI7W/M3nuCeZdJ8sm7gHAwSSzRxlle3LnkC+zJN8BH3dahSsuNa/MyHVLwJoltcWCCA WoEwjNXkHqkuWJYLG3Xgu4rTtiqp5p1/z/aMq6PoUcyfWCjTvNGwMIeHi4UvFvIGkXh1rQj3VUG8 y/mM97LAnl+KO2hc8rkypJ8Ar8IUSIee6dditWp2xVDad5g/NmRxFc+XolDCpuGkjQKFjX9hZWJL urdelR1GKso8s33mO6tf9zmmrYTJHEeQlSTnIy1lHFOXEI21a/F4DAqaz/YH+un/ABMYq62/3ni/ 1F/ViqpirTfZPyxVy/ZHyxV5V+aV15QOtiz1O/1aK+aOGun2AIjMMztC01WUx/GH4tU78ONK9SqA sNW8nxaRfX9vrut3VodOeBpKFZmVLoRJNBy4BZY5LhCOSjt/lDFChcaP5LtoJpGvdbMbmew1ASSx TU9BI2mklX4+benIrKd9gCOi1VROpXH5fG0stTj1XWYFv4Gt7U24ZHaNZyifaVTyQhvSb9giuxpi qhpY8h3GgQ6pFqurtbXZR4VcjnDIEFxwBdVWgjdQFO1H7gtiqGv5vIOqJes95rC6TLdXF7cTKI4o /UupjIVRCtWUPGxNRXZeu2Ko/U9W/L26FlKuq6qqfVHt7BolqvFZfXIVyp4OtVSrEAfD/LUKoS8P k6xFjC1xrU3qUtpIRLE4UzQxzCSQEjqsIoxHyxVmsPkDRtXt47631rUHjktLW2gliuFqgtV4huSA j1HDMJD1NT7UUq0n5XaawseGp30X1GFLdVjkVUdYzUFkC0rXceBxtV13+WOnXC2KjU79Bp8k8lup m5r++DLwKsCOCq5XitKrscbVDR/lHp0csMg1rVX9J/VYSzq5dxGUDOxTkSObN1oWJYitKNqqXX5X 29wGtzq17HYhQIlSQ+stXlYqHaqhAsoVVC9K+JxtW4Pyr0yGexkGqajIljJayxwyTB42a0na4Xmp Wh5O256+FK42qlL+UenSXV3cjWtVjkvCxlEdwFWr0DHjxozMg4sWqTjao/SPy9ttM1uPVl1S+uJI 2LehPKHiNY3j3UjqefJmG5beu5BCssxVTn+wP9dP+JjFXW3+88X+ov6sVVMVab7J+WKuX7I+WKtN 6RajcSx2oaV8f4YqtIt0BBCKPtMDQfaNan5kY0q0NZBJGBjCQsxlPw0RgvxcvA8Tv7YaKLX+jDt8 C/DWmw2qan78CVGGz06NXiihiUM7SyIqru7k83I8Sa1OFVt9p+l3kS217BFNEzqyQyqpDOnxD4T1 pTFVZorWOJuaRpCgZmqAFAI+Int064Aq70Yak8Fq1Kmg3p0+7FW44440CRqERdlVQAB8gMVXYq7F XYq7FXYq7FXYq7FVOf7A/wBdP+JjFXW3+88X+ov6sVVMVab7J+WKuX7I+WKvKvzNvfLUfmZLfUBq y6rLagWhsTEsRQLMQAzso5U9ZqHf4DTtXLwauWMUACHHy6cTN2R7kLaT/l7qVpeQC/1KeO54yXNy 8dHItoZbxo68Q1DFK4pT9mg95/nZAggDb9n6kHTRIIJO/wCP0rLKy/L28LLBrOpxxOHV4D8KyxwQ maXnGF5N8MDcqipNP8nJfn5d0WP5SPeUE2u+QrD6jN+ltamaX6tLFFKV4yK08Z5/FRR+0Dv0BHhW MtaT/DFI0wHWSOlvPJkdrqF1FJqfr393DYzxwpGrQveS/XqRtRAUbhSg+4cq4Pzsttht+qk/lo77 nf8AXagYfKzvJeW2t6pJpxM8Ls7LG8T2TxGR4nm4FtpQFCAk1J/ZOT/PmvpjbH8rv9RW6rr3kGSb TeV7q6Wf1WaCORSPTZYl9M80avJpHlc8jtVT0GQjrJC9o7m2UtMDW52bs4vJN3qw0m28x65LcGtp 8JZ09V7b1mHIKxqEepHYsR05Us/Pn+bH5Nf5MfzpfNltl+bPlW2txa3bXQmtIYDIxQXDusxRI2/c GTmzcqsFGxqvWgOBI2bcwbBW1D83vK1jbW1xLHdmO7jaWGkXaOc27q1TRSrKT7jpXBSVzfm75QQB mNyELBFcRVBLKrjoTT4JAxr9n9qh2xpVq/mzoMsF3cW9tcSQ2qI6tRV9TlNFCeK8q0D3C70/m8N2 lbi/N3yi94lqzTrJO4W2pEz+orSpErUWrCrP0Ir9O2NKg9Q/Ory7YvqUUlhfGfS39K5j4RD4yxjX iTJ8StKjpyH8h9qtKmV/+avlOxC+vJMrvai8VPTJb06FmFK/aUKSfHoKmgxpUdo3nrRdVv4tPgEq XkqGRY2TYqiK0p5AnaMyIpJpuy064FZFiqnP9gf66f8AExirrb/eeL/UX9WKqmKtN9k/LFXL9kfL FWFecm88/pGWPRNV0mxslt0et4D9aWRnKdw6cP5SRuSVwqlrR+d77RbSxtdU0e7Z42TVp5aP6kbI gFU4faCrKNxQr1xQ1FrfnO80e01HTbnSmk9W4F2sMkNUt45Ui9RXPJKiICWTstafEAKqoaHUPPEV lcXF9rehG2VZZLaX4QoUHmiFDGG4kLQAb0r1NMVRWpz/AJjzXsk+k6vokenJcO0PqN8TByyQrJxF K+myUFd2Fa0+HFUPqd159MotY9a0RGniacRSlAV9QBEe3bjty+JkL8jSnXfFUZ5hHmq/tpLeK50W PT44bYXFtessoEiSOs3rcVoqs/EUHRl67kYqhxqXnNIbe3sNU0cfVYUFzdXEkXx3fxi4VSg6RUXk eKmrnwxVW1LUNftNTsrk6joNgkyrb3YkKmZrkTzSRQB6fZrt2+LmeuKoKxvfzDS+j+ta5o5RZRBc xyN8PqRGH60EQKlPTCv1fbkRWpFFUbFcea7DWJFvtd0ZrK51J3tobkxiRbMCUCNFQRVkrBUjf4lO +xxVRtLjzhdEQWutaS1nbukGpyPJDPIJZByKrxiWMeo1CFK9KClQcVQehjzkNduY5brSXkhig09d WkMRnklY+qSlAxf4l+y3VvHjiqYXV153kXToo9Y0htWrJHeW8UiLE8xYzRqoZJmr6O+4716/aVXw Wfm54DcXWuaXHfTfVXkuIRCq0tnmneMMY2YqYTAwLV4/EaU6qoGym/M6bU5isujJeLbxwJdUTncS ehLyEXEs3ATxryqOoNK8SMVepJy4jl9qg5UNd/nQfqwJWT/YH+un/Exirrb/AHni/wBRf1YqqYq0 32T8sVcv2R8sVeZ+e3/LmPzb6PmOO5nu7y0VaIXESxtILfhSMqf3qzMGJ6AHcEjCqzRL78tm80ac bGS7tr0STwwW8nP0vXKIsok5cypCoqA1ANSAT8WKEHp19+Ttutn9WsbgK8E1pByEpHG6jrIjFn2Z 1Zk5NQe4WhxVamsflDeve6hNBeXZMai4urj1iXjl4lWo7D7arWhFaAjrsVVltZ/lfp3mC60a+tr6 a61K8MSepzeOST1TCIwsLGix0qC29G+jFV+rz/lWmnwWd7BdW1taui28EDGRj9WDoJHVGf05GjSY EmjhKhqFlBVUtN1z8mU0BmksZrazuonhntpTK54XEyyNAfjPL4oVO1fAH7WKqjJ+VFmIZLfS7xfV vprZwHkVo7y0WhakknFjH6xoynh9rftiq21T8qntTeabot9c/Uo4ri0jQyKxa9mVAsSNIGMge4UG q/ecVQmtan+TuqQ6iwe/hmu7qWO6nt45mdpWkaWQItGBDcWZXAK0bY9gqjtXf8nLW1CS6dJIdIpP bpGXrzvlS+Wjq+5PFFBavEEgfDyxVHaJY/lb5jlNhYRzwy3/APpsyM8imZUqjJydmPcjiKNQVHw7 4qyO4/K7ynJpz2MUUtujqU9WOV/UVGBUqrMWp8LUB6jYjcY2lUvvyy8l32pPqNzYl7iQKpCyypGA kaxAKiMqr8CAGg3pgVRb8qvJzJBCbeU2kFSLT1X9Nm426qzb1qv1OM7Hc7muNqqQ/lb5IhaEpp54 W8hliiaWVkDkua8S3/Fh/DG1ZUiKihFFFUAKB2AxVZP9gf66f8TGKutv954v9Rf1YqqYq032T8sV cv2R8sVWyJAWrIqlqAVYCtAajr74qseKykNXSNyCrAsFJ5IeSnfuDuMVUbfTdItmuGgt4Y2u3Ml0 yqoMjMOJL+O22Kt3thpd9D6N5DFcQ81k9OQKylkNVJBxVXIty3I8C1Qa7VqOmKtCO0DFgsYZqlmo tSWpWvz4j7sVQ6aZo6Xst8ttALyYKstxxXmwSvEFuu1cVRBS1JqQhO+9B+19r7++KtqLZQAoRQuy gUFOnT7sVQyaXo0d3NeJbQLdXChJ5gq8nVa0BPh8RxVVS105JJZUiiWSZhJM4VQXdUEYZj3IRQvy 2xVyWunpcvdJFEtzIqo8wChyqcuIJ67c2+/FVb1I/wCYfeMVd6kf8w+8Yq71I/5h94xV3qR/zD7x irYdCaBgT4VxVZP9gf66f8TGKutv954v9Rf1YqqYqkHm3znpPlqCA3glmubxjHZ2luoeWRhStASo oOQrv3zI0+mllJrkOZaM+ojjq+Z5B3lLznpXmSG4Foktvd2TCO9srheEsTbjcAnaqkfRjqNNLFV7 g8iFwaiOS65jmE8eeBJY4nkVZZa+lGWAZuIq3EHc0HWmY7et+t2v1YXXrJ9VKCQT8h6fAioblWnG m9cVXpLE7OqOrNE3CRQQSrFQ1Gp0PFgfkcVbVlZQykMrCqsNwQcVUxd2hRXE0fB3MSNyFGkBKlAa 7tUEUxVVxVbJJHFG8sriOOMFndiAqqBUkk9AMVajuIJTSORXIVXIVgfhevFtuzU2xVczKqlmIVVF WY7AAYq1FLHLGskTrJG4qjqQVIPcEYquxV2KuxV2KuxV2KuxVTn+wP8AXT/iYxV1t/vPF/qL+rFV TFWB/mf5F1DzC+m6jppikvNMZj9VnYokqMVOzLuCpX/PvsNDq447jLlJwdZpjkMZDnFv8uPJWraP farresmJNQ1Vq/VrckxxryLHc9SSfHHW6qMxGEfpj3p0mnlAylL6pdzfnnyA3mLzLpN+L63tVhia AiSLndLxniuhJZvzT05f3HHlQ0UnY5r3OBYbF+Qfm06dDp915zmntY47mJ4WWco4mtI7ePkDNUhH j5UrQdqYraaeUfyq13RPNVrrU3nGW4s/rU8lxpUbSCF5Htkt1tw0sszyCH0Ao5ktxRe4ritqS/k9 52+q6fA3mlY4tOsbawS1gW7ihlitAqLFIsdylEmRAZGWj8ujcdsVtCD8iPMBYpD5rIto7m5uLYBL itu8pYqYlW4CB1Ztz7ClGLMWltXg/J3zW8wdPPd2bZ0LPYxPcGKNZlI4RM1w8vpqqoIyz8qL1riQ QvEEdrX5Q6zrWmWVk3meWSyisHtH5G4YSBvWKH4bhVdXWaPn6gY/ukodziQtobzP+R1/qevXWqaT q0WkB+P1ZYopjMCLN7Tk85m51UOKBaLt0rUlW1fTvyX1W2lup7vzBJqF1eaTcaTNPcG4cgTWsMKu qtOy7SRO5BG/LxAIVtIdZ/I7znpFvMnlDX5pbOYJGNJlllto1co3KcvDLGBwnczKqAb0FGAoVbZR 5J/K/wA26F5ih1XVPNtzrFvG10z2s5kIY3IUKKc+AoRyPwde3grb0vFDsVdirsVdirsVU5/sD/XT /iYxV1t/vPF/qL+rFVTFWm+yflirl+yPlirFvNv5eaZ5m1Sxv7u6uIGsleMxwsoDxuCGUkgla8vi p12r0GKQWPx/kukWpaTdReY9RNvpkzTtbuyn1GZg5bmAKMeCgmh/a/mxW3XH5EeW5LyO5g1LUbP0 5muiLeZUJnaRnMvIoSrUfj8NNgMVtNtB/LhtNsEtpNbv+cWoC+R7WQwKYo68LR1+MGA1LMgpUk9q YrbEobTye2p3dtbapqkKW4nklaN0RCkUguDKgC1YFmVVYddu2boyy8IJjHev1OsAhxEAy/G6itv5 NtONvYahq73SoYmhWVIUZacDyNOJ4I1eIr8qk5K8p3IjSBGA2BlbMNK/MHyhYaJBb28lzNBpyR2n 90WkpGojRmC/zmgBHfwzCyaPJKZJrfdyYaiEY0L22Rcv5l+Xo4fWYTGJnYRMqD40Ro0aTcig5S9D v8J2yA0Uya/HVkdTFcv5keXms5r3jcC1hSFzL6YPL1i4CqoJYlfSau3bB+SndbWv5mNX0Uz+aPlb 0vVVp3T4q8YiSCgcmqg16Rk16fjh/I5PJfzUFe6/MTy7b3bWreu8qsqt6cfMVYhaCh3ozAGn0VGR jo5kXsk6iINIe9/M/wAvW88kEazTywtKsihOH9xXkVL8Qa8GA+WTjoZkXsg6mIWx/mn5ellCxxXD xl1T1BHX7RKfZBJ+1xFOprUdDidBMdyBqosxzCcl2KuxV2Kqc/2B/rp/xMYq62/3ni/1F/Viqpir TfZPyxVy/ZHyxVh/nnT/AMzLq9tD5R1G0s7LhwvUuRWTkJkfnGfTkFTGjR77fET1AxSlnlzSfzkt tRtX1PVLObS0ErS20pEk/L0ZVhV5Uhj5L6jRlqb/AAnc91dmUaZB5wY6ZNq09osqJONWt7MN6DsT +4MPqqZdh9qrDLImPCQRv0YEGxXJPMrZLPQgrX01qRxJoOlKU+WGytKctjZTKqy28cgUsVDIpoXB ViKjaocg/M4RMjkUGIdbWFjbW629vBHFAgCrGqgCgxlMk2SoiAqG3gIoY0I3FCo7mp+84LK0tktb WRo2khRmiYPGSoJVgCAw8CAx+/ESIWgpppmnRzSzpbRiWbiJXCirBFKrX5KSMkZyqrXhCuYoiSSi kkgk0G5FKH6KDI2lowQE1Ma1NaniO/XGytNC2txSkSbUI+Efs9Pu7Y8RRSpgS7FXYq7FVOf7A/10 /wCJjFVO3uLf6vF+9T7C/tDwxVU+s2/+/U/4IYq01zb8T+9Tp/MMVctzb8R+9Tp/MMVb+s2/+/U/ 4IYq76zb/wC/U/4IYq76zb/79T/ghirvrNv/AL9T/ghirvrNv/v1P+CGKu+s2/8Av1P+CGKu+s2/ +/U/4IYq76zb/wC/U/4IYq76zb/79T/ghirvrNv/AL9T/ghirvrNv/v1P+CGKu+s2/8Av1P+CGKu +s2/+/U/4IYq76zb/wC/U/4IYq76zb/79T/ghirvrNv/AL9T/ghirvrNv/v1P+CGKrJp4WVQsikl 0oAQT9sYq//Z - - - - uuid:178ca91c-4446-47fe-87e7-cc201ed2746d - xmp.did:b132cbc3-f97a-b241-8ad1-65f31666f2b2 - uuid:5D20892493BFDB11914A8590D31508C8 - proof:pdf - - uuid:d1c078a0-2746-42b2-b0d1-25aedff8fb1e - xmp.did:1b6690ed-28a8-c141-9479-b6a9cf6be651 - uuid:5D20892493BFDB11914A8590D31508C8 - proof:pdf - - - - - saved - xmp.iid:b132cbc3-f97a-b241-8ad1-65f31666f2b2 - 2018-07-22T15:02:38-07:00 - Adobe Illustrator CC 22.1 (Windows) - / - - - - Document - Print - False - False - 1 - - 9.998823 - 14.680556 - Inches - - - - - SegoeUI-Light - Segoe UI - Light - Open Type - Version 5.54 - False - segoeuil.ttf - - - SegoeUI-Italic - Segoe UI - Italic - Open Type - Version 5.30 - False - segoeuii.ttf - - - SegoeUI-Semilight - Segoe UI - Semilight - Open Type - Version 5.54 - False - segoeuisl.ttf - - - SegoeUI - Segoe UI - Regular - Open Type - Version 5.55 - False - segoeui.ttf - - - SegoeUI-Bold - Segoe UI - Bold - Open Type - Version 5.54 - False - segoeuib.ttf - - - SegoeUI-SemiboldItalic - Segoe UI - Semibold Italic - Open Type - Version 5.30 - False - seguisbi.ttf - - - SegoeUI-Semibold - Segoe UI - Semibold - Open Type - Version 5.54 - False - seguisb.ttf - - - SegoeUI-SemilightItalic - Segoe UI - Semilight Italic - Open Type - Version 5.30 - False - seguisli.ttf - - - - - - Cyan - Magenta - Yellow - Black - ms-blue-dark - - - - - - Default Swatch Group - 0 - - - - White - CMYK - PROCESS - 0.000000 - 0.000000 - 0.000000 - 0.000000 - - - Black - CMYK - PROCESS - 0.000000 - 0.000000 - 0.000000 - 100.000000 - - - CMYK Red - CMYK - PROCESS - 0.000000 - 100.000000 - 100.000000 - 0.000000 - - - CMYK Yellow - CMYK - PROCESS - 0.000000 - 0.000000 - 100.000000 - 0.000000 - - - CMYK Green - CMYK - PROCESS - 100.000000 - 0.000000 - 100.000000 - 0.000000 - - - CMYK Cyan - CMYK - PROCESS - 100.000000 - 0.000000 - 0.000000 - 0.000000 - - - CMYK Blue - CMYK - PROCESS - 100.000000 - 100.000000 - 0.000000 - 0.000000 - - - CMYK Magenta - CMYK - PROCESS - 0.000000 - 100.000000 - 0.000000 - 0.000000 - - - C=15 M=100 Y=90 K=10 - CMYK - PROCESS - 15.000000 - 100.000000 - 90.000000 - 10.000000 - - - C=0 M=90 Y=85 K=0 - CMYK - PROCESS - 0.000000 - 90.000000 - 85.000000 - 0.000000 - - - C=0 M=80 Y=95 K=0 - CMYK - PROCESS - 0.000000 - 80.000000 - 95.000000 - 0.000000 - - - C=0 M=50 Y=100 K=0 - CMYK - PROCESS - 0.000000 - 50.000000 - 100.000000 - 0.000000 - - - C=0 M=35 Y=85 K=0 - CMYK - PROCESS - 0.000000 - 35.000000 - 85.000000 - 0.000000 - - - C=5 M=0 Y=90 K=0 - CMYK - PROCESS - 5.000000 - 0.000000 - 90.000000 - 0.000000 - - - C=20 M=0 Y=100 K=0 - CMYK - PROCESS - 20.000000 - 0.000000 - 100.000000 - 0.000000 - - - C=50 M=0 Y=100 K=0 - CMYK - PROCESS - 50.000000 - 0.000000 - 100.000000 - 0.000000 - - - C=75 M=0 Y=100 K=0 - CMYK - PROCESS - 75.000000 - 0.000000 - 100.000000 - 0.000000 - - - C=85 M=10 Y=100 K=10 - CMYK - PROCESS - 85.000000 - 10.000000 - 100.000000 - 10.000000 - - - C=90 M=30 Y=95 K=30 - CMYK - PROCESS - 90.000000 - 30.000000 - 95.000000 - 30.000000 - - - C=75 M=0 Y=75 K=0 - CMYK - PROCESS - 75.000000 - 0.000000 - 75.000000 - 0.000000 - - - C=80 M=10 Y=45 K=0 - CMYK - PROCESS - 80.000000 - 10.000000 - 45.000000 - 0.000000 - - - C=70 M=15 Y=0 K=0 - CMYK - PROCESS - 70.000000 - 15.000000 - 0.000000 - 0.000000 - - - C=85 M=50 Y=0 K=0 - CMYK - PROCESS - 85.000000 - 50.000000 - 0.000000 - 0.000000 - - - C=100 M=95 Y=5 K=0 - CMYK - PROCESS - 100.000000 - 95.000000 - 5.000000 - 0.000000 - - - C=100 M=100 Y=25 K=25 - CMYK - PROCESS - 100.000000 - 100.000000 - 25.000000 - 25.000000 - - - C=75 M=100 Y=0 K=0 - CMYK - PROCESS - 75.000000 - 100.000000 - 0.000000 - 0.000000 - - - C=50 M=100 Y=0 K=0 - CMYK - PROCESS - 50.000000 - 100.000000 - 0.000000 - 0.000000 - - - C=35 M=100 Y=35 K=10 - CMYK - PROCESS - 35.000000 - 100.000000 - 35.000000 - 10.000000 - - - C=10 M=100 Y=50 K=0 - CMYK - PROCESS - 10.000000 - 100.000000 - 50.000000 - 0.000000 - - - C=0 M=95 Y=20 K=0 - CMYK - PROCESS - 0.000000 - 95.000000 - 20.000000 - 0.000000 - - - C=25 M=25 Y=40 K=0 - CMYK - PROCESS - 25.000000 - 25.000000 - 40.000000 - 0.000000 - - - C=40 M=45 Y=50 K=5 - CMYK - PROCESS - 40.000000 - 45.000000 - 50.000000 - 5.000000 - - - C=50 M=50 Y=60 K=25 - CMYK - PROCESS - 50.000000 - 50.000000 - 60.000000 - 25.000000 - - - C=55 M=60 Y=65 K=40 - CMYK - PROCESS - 55.000000 - 60.000000 - 65.000000 - 40.000000 - - - C=25 M=40 Y=65 K=0 - CMYK - PROCESS - 25.000000 - 40.000000 - 65.000000 - 0.000000 - - - C=30 M=50 Y=75 K=10 - CMYK - PROCESS - 30.000000 - 50.000000 - 75.000000 - 10.000000 - - - C=35 M=60 Y=80 K=25 - CMYK - PROCESS - 35.000000 - 60.000000 - 80.000000 - 25.000000 - - - C=40 M=65 Y=90 K=35 - CMYK - PROCESS - 40.000000 - 65.000000 - 90.000000 - 35.000000 - - - C=40 M=70 Y=100 K=50 - CMYK - PROCESS - 40.000000 - 70.000000 - 100.000000 - 50.000000 - - - C=50 M=70 Y=80 K=70 - CMYK - PROCESS - 50.000000 - 70.000000 - 80.000000 - 70.000000 - - - ms-blue-dark - SPOT - 100.000000 - RGB - 0 - 120 - 215 - - - R=10 G=10 B=10 - PROCESS - 100.000000 - CMYK - 74.135953 - 67.489123 - 66.359955 - 85.912865 - - - - - - Grays - 1 - - - - C=0 M=0 Y=0 K=100 - CMYK - PROCESS - 0.000000 - 0.000000 - 0.000000 - 100.000000 - - - C=0 M=0 Y=0 K=90 - CMYK - PROCESS - 0.000000 - 0.000000 - 0.000000 - 89.999400 - - - C=0 M=0 Y=0 K=80 - CMYK - PROCESS - 0.000000 - 0.000000 - 0.000000 - 79.998800 - - - C=0 M=0 Y=0 K=70 - CMYK - PROCESS - 0.000000 - 0.000000 - 0.000000 - 69.999700 - - - C=0 M=0 Y=0 K=60 - CMYK - PROCESS - 0.000000 - 0.000000 - 0.000000 - 59.999100 - - - C=0 M=0 Y=0 K=50 - CMYK - PROCESS - 0.000000 - 0.000000 - 0.000000 - 50.000000 - - - C=0 M=0 Y=0 K=40 - CMYK - PROCESS - 0.000000 - 0.000000 - 0.000000 - 39.999400 - - - C=0 M=0 Y=0 K=30 - CMYK - PROCESS - 0.000000 - 0.000000 - 0.000000 - 29.998800 - - - C=0 M=0 Y=0 K=20 - CMYK - PROCESS - 0.000000 - 0.000000 - 0.000000 - 19.999700 - - - C=0 M=0 Y=0 K=10 - CMYK - PROCESS - 0.000000 - 0.000000 - 0.000000 - 9.999100 - - - C=0 M=0 Y=0 K=5 - CMYK - PROCESS - 0.000000 - 0.000000 - 0.000000 - 4.998800 - - - - - - Brights - 1 - - - - C=0 M=100 Y=100 K=0 - CMYK - PROCESS - 0.000000 - 100.000000 - 100.000000 - 0.000000 - - - C=0 M=75 Y=100 K=0 - CMYK - PROCESS - 0.000000 - 75.000000 - 100.000000 - 0.000000 - - - C=0 M=10 Y=95 K=0 - CMYK - PROCESS - 0.000000 - 10.000000 - 95.000000 - 0.000000 - - - C=85 M=10 Y=100 K=0 - CMYK - PROCESS - 85.000000 - 10.000000 - 100.000000 - 0.000000 - - - C=100 M=90 Y=0 K=0 - CMYK - PROCESS - 100.000000 - 90.000000 - 0.000000 - 0.000000 - - - C=60 M=90 Y=0 K=0 - CMYK - PROCESS - 60.000000 - 90.000000 - 0.003100 - 0.003100 - - - - - - - Adobe PDF library 10.01 - - - - - - - - - - - - - - - - - - - - - - - - - -endstream endobj 3 0 obj <> endobj 15 0 obj <>/Resources<>/ExtGState<>/Font<>/ProcSet[/PDF/Text]/Properties<>>>/Thumb 269 0 R/TrimBox[0.0 0.0 719.915 1057.0]/Type/Page>> endobj 264 0 obj <>stream -HW[o~_qRjI ̓\54\~s9Nݦrfrξ?7g/ϭy 5ۃcn3\va_͋7W懛ߖNv)^i65Ei׋f{o lߛ?,\31U$6~fjOC?pS{k/ڼ^|?ڰtե#>ɰr_> ]qGU~gO:峴SiΤKg^,7HљA m6ɇP~#p{k0xc|dXNJ8X+?F1|/^csw{/<㠇E2GcMo˕+ě㈠:"}94z<JK`î/JIte8Vo^o۟.vfSZo/vd%MzJd/4G!#Y5e#7 f6N2 y r4AlxbDsuys\&ڇ7))NNO"n+L5ͥl-F2&ڹZ6V/Yr9D\fp$v³g,w6SJa/N`<Ѷfz"iw7qBPY7GzH.W'sQm-+Ƃb*(P?xo/cnіioхOv7UNװգNG;8| - S!r -=>z-V;a^.isAU36wWxOǏ.[$WQ Ψ-#McZƐih sFNCLl@Ĉe0Lz5GwqĽ%fobȪ'>{I3rXs#zyaKgd o<7*Ԯ@̛Ѣ2!XHdy$VBUfU+'&4 qJqx-[X 0$ -N3:*Yڰj51堖C#L^ݱ#ST}N$=bEW,`O, =5c@DQOJb (t -g GXnngT'!wj2 K+%,ȩAF QL+1%$6H8/ Bk59“@!JTGud19wV'i'։u)Vm%QB"IsǒH*o JcibjX$Lw4ytvӠGtia` mTƵ,˕b(!+I $ƫS( f R/sw3[BQۺP]='Q- +E($WU/3kp3dz嚧Ј 53_)^yI$,HqN\8 %e.):=b&b&Trhcsp&gM?2.2m IJSmmNa!WiBN`@lO,EnEjfWJ5ЊwTBT@#)4u͡jl.D$Rq19ꄁ$NLPjKK_Mr $(G R/م)ZX@CUY,/pmrV,1Sɻ.IaxڶYpz;DrR8+l%"H ^:G%cxcAJfM9xi%}EvYVzdJIONNl˽sJ.0, uaLZR)@rd2;-!W&Or=rT7q3Ĕ;񶷨)?*9.v=Ф֨a_hlKW_)/Lr.%&gE!zz}ezmJVͮ_|,ivpekVzV'I <ƫDiu`=oInDW ZBu7*# SZcuI3HEJ!Y֔S 5/|6FjLΧjj݇4 =9=uY[PHȔ%2*{u?mFE~ڜiΖªz+] iC#k(`&UxGW-ŭz;\2LJ -S!' ,Â4 2&DUVea#5l=_@>cp^C(KkL0񏂱^/LY\=,7~g]"vs\R -q\0q\γtV?ɩ 8O2rovyqYh9\.as}}'Uܶ D{$g, ~tzq|N&a:o)[J&۷2[u>|`b%.NQ4^и5[s;}9?l #l1ޙBcsqATe?xdi6L_x xevv^C i qcir=--mA~JvsbZ=y'{Kpy ( tFeS= YǕ5Rw%ߔQ֗h7lvXŵRWP %tWe%C!ƮvXn`f$*Ap{ч1n8XBl;@ ~Rk[,C LH9pG%ZA'~][.fAל|y+"e(Z:)(*(PPPЍ -7u'aA"X*}Z  >{|xAya@vpO%$!^>stream -8;ZDo9=CT<&;K",1VsT3`q5:;GM/$?\r6Bne'nI'`!CtZSA+)N"=*^nb'GVbA]XD[ -(g.'F1QlCrk2t*^8VSS(briu_DZ404f.`L/NW%3__[YNFg=mX/TCr`L?tBb:8J$+cUZIK1@P[Aar5QGmbrn-*#c#T$J&_ZkLG:CWJ23RJ-4jU%FMkN8V`T%1")4LTto18jJ -q1`E!e3j,%GSYPX,C5cU1EF[*a0B9C$umVb[I\L_4oRsd@G@re]DU!RI"N')0g*c> -DslYrKX9_7p#UCWKmLE@I53qCq$HTWJu&9$F8!WlTP5o61S/W9&UD;>hcTA4>*Wt7 ->+rO+C.3N"cZ:H$LoO:$XjojFA`u"GMF4T/nIqMfI-b&Yj#?,UH..RjkKA9s^2[F6 -Hfd:@LK$/f?ts0N)rk";FN%%N&AOar*1D/o9Xp;a!`?s`ao<(!.HA6Fj$Y/K#U;)m -7*#"bs65Y?]+U0_s#k$$6*l(&O:t(]qg"VU -cc=\q>d2 -endstream endobj 270 0 obj [/Indexed/DeviceRGB 255 271 0 R] endobj 271 0 obj <>stream -8;X]O>EqN@%''O_@%e@?J;%+8(9e>X=MR6S?i^YgA3=].HDXF.R$lIL@"pJ+EP(%0 -b]6ajmNZn*!='OQZeQ^Y*,=]?C.B+\Ulg9dhD*"iC[;*=3`oP1[!S^)?1)IZ4dup` -E1r!/,*0[*9.aFIR2&b-C#soRZ7Dl%MLY\.?d>Mn -6%Q2oYfNRF$$+ON<+]RUJmC0InDZ4OTs0S!saG>GGKUlQ*Q?45:CI&4J'_2j$XKrcYp0n+Xl_nU*O( -l[$6Nn+Z_Nq0]s7hs]`XX1nZ8&94a\~> -endstream endobj 262 0 obj <> endobj 272 0 obj [/View/Design] endobj 273 0 obj <>>> endobj 254 0 obj <> endobj 255 0 obj <> endobj 256 0 obj <> endobj 257 0 obj <> endobj 258 0 obj <> endobj 259 0 obj <> endobj 260 0 obj <> endobj 261 0 obj <> endobj 281 0 obj <> endobj 282 0 obj <>stream -HlxTg>2D;tI8{Qu]@06^  Nph(!3”@]{B!7}w};kH OM. }dRQxFޭO&59*oin Gg[Tŕhn,lYRIelTsz>O -E+2~ϥ'D'&D^\h a B AC"@@2B̀tȀL a&̆Yp6Cah@B~Z#p$:p@]p4A_ñ菍-]q'D'aN@SqN  0x pHb61b3l-0%G I) -[C6S1 C#z8^A Tu4afbfcY8=т^s1qyv ;OpS}gO_7tҷt/W`Q:F:ET 3t t~KtU R\p1.̓Yk:̼C'-}z#O٣>/lʆ)J6`#(6ȁe -Y5v-+GbzL=PO%)ZQϪe&| -ʦ,H9#<9|.|!_%|)_/|_W)=_?k:okp]W W7/|/on;y"ab!FQb#|+81^Lap -pHRE+C(b))))R)ieP&eQ6LE)((CE/$d(b/⑘.D0ݴ[y1ƐM^ Kf0M{ɾ}woF /K2-BY*̆90ȧbXK!-eV@&UTjXka P 9lͰ6;`'삏 vhٰ>OS >/`+-pa8GYji]Uyݼ+$pup5_W&<7Of|<7Y_˳yKQ9uh` "V577-([680仰zЋ X:??X>?_`l)h1L&TI1&L l1 [`6V`[lvN v\ƿ_aw|c{`O셽>M -StQ:Fb8 c ,$tF^7MY%oD$z#{򾬖a( b*SʲZ$[wۼc5j3L8C:`"La2c(3ÌÍ O?7~aihdl2^1Fknk(kdYޅ)| _ʗ|_)$YW֓ɲ~g1Fƫ85_70ooi\YDc0 !,'P"^԰|##MV5ڰl ﱵlC[8 DC"l#^ȁδ Z6LBQTA4flCsiͧЎ>ZJh9\մ4P5T)V>H9J5C -#H:LiSR)j([cZhY²8KZʊjXk%X5DU۪c%YuzVUjjDUKVuTJSuݧj -n/=DOK*KNw*??r|_~ gYr#yr\ ? "X.K2\P-JJejڨj:8vqV\rb/$9%_E?qN 3GW7 ߈f%ޛP=&v^μYJb)3N̴pgQ2GTgGFV9t͈횫-`5Z lM`4/[8fjV6N1Z V -XpwK DGŚMеc뫇Ǵb޾yqVnJ߯},ݫg??{ܮ]:tء}m[d5HoiKIJzjī8K1aPwT:~'33' ;Rڮ1iNϞQtRM"=s#WdǑsXNck<1)KQ'cҢҊϧ3CRF򜼡Vf4MwFV@zXH[S-,*'|%x'?byђ.f="tVnWdM!dS|5:7dC񮷙w$nwE{ܧ?-M8v&q.]%Ђ,]Bb_JYBJC!qBRFYa.QT&б -ܚE]E]_dqLr3===a/2\6D+آ͆$fYJ\^x508ﶠqȍIU˃!z!b_sB ^CVI4֫U6vctwI yJ|q)Y7H&]&RKޣ'p‰"8CoUFSSSjIjLNL:L 4M'5bMӪMiҨX>ނMo`{?m"(˲bPJ0ZspT f/:Z-uv,(Mک?֕'R@t 51$^ERUY G6GS[mPw=7*aY$C\T 5"hDb DOq@FzOr2lAY Q.C<8\-.DŞP{Q#TR6%SSR/{) NS斠ML_&DvA:?-o|nӯ*rAS;s$Y-@nIڂ_(o"nlmMlWg/V<(ྚA my#CJZtXyT)EDH&2!jaW$zUFM2 MTLǀ|*(Xab+ndWAD\&u^2Hf*rb"8Fp@f݃pVARa_ a3\% $>E&ņ\}0!5 -QPLA",s؅x/ľ:Ilx$=k$R24~lDn9ۍh!08?wyhZ3V+jdB{9& ^~2!iCLQ0kyN|+V.,k|vWa0`­G7%HfY6qLb$H`b4joC i,tܕ6gPC8͡[`j.MfNNJNj-&lͲ396*A)Es\N \Ė`i\\CQfZ߭^U/ =kwoG.2Xȸ^}K2'to4>ݪabiēK):V$,&vfY,W$Rzaav6-?? |ϷH8Z^JWyCI`Ҭ/#UѩYsL3JC`&F.'KLѬc_-*c<,ܖL:]gLNXFAXbX0U ,tT$yrK:vLbmB!N |b԰lpa' \R Zet17fYT}f n,38㗾gIl*uNe&=TtbdW4gm:u@7>ؼ7MdBp'wĠ!d)Ѧg_>HuIsR❧;* d/p 6A멎F}g[XPU`ɦRm[M@rXIp,f[l^pfCP.)3aMxśxo' }}:^N:@#ػrGYaif.ѩ0joݺh{ nѬ^8Ds I !`a9SX$/Q' -=]m~D$dyԽ7z]MΛO8 -mz1zUT\go/}v-zkWj@}0ppgI+"YdcXN]v Apk|KTvmJS}}A5&?ckʰl2u] {[+L?̞zW"khol>RCu+_8y[ؽmoEbޒgTXF G~Z\(zUu]u{/DA1|@DOD%Qji+;V[cTm4ɠFӔttFc$jVSmi!+\|{8g)o%O:{)drׁ"&(3<$g0C -%";HJ㊓""bUrB@1>&ҕe)"ua |SVUua>]{zq]K8]b߹ǐiCzd/Tmym߅3A6(VLTx+NikeFECu+2/Dvգ۴)WmM|S .})_bs#g],:RV#_a/uGڰk'+Jʄ5Qx IW=ݾ1|x4bV$dsDG۞^@mΧ`ml$.Qaᦷaz#:yـgFu6_Ϭ+:q͈ tUF2?2MȈ4r9^{މUY7!;Z;A1,~ƭ'Nx<[nvVYaGCTeQfoV*Z Mkaї~h\H1Ie˵T&F|4C -iZ -rޤV(LV,kgˎ"/mNlMm%e 5-'d"u0Ti?:M:*QK*ֺ$ -TH1 sq5OPd%%Tl -G_9Q Rϫ;¢΢|1'7QiN Pe;دv`1P:!qcvc zNS -^W#+=,i8G밯yHiT\:ܙNZb㞗qPhy1}{J+^TO=^\T#EcVg:/#d+Ώ3~`a R_{QN':Ӥ@Wr;r`4s+, t4Qx/AE _c\h{!W Jq?p@{0:A;Y Sk@ br 8,P7D4ƉV:,ϝT!ukutf}n\:*Wt'~g}Gs5`=#u˚ 2#5ud7VԨXHޡG\ |<1q8y)xHDˣe4R@H*3m\#ޞI䑟Szj` -Ɂn1! fi`r_½ ,MP澨{S@_ -UƯ==Gר =>Mc|MpAhPO4U@m|9瓱7r4{unpJDbޯ0U>}XoL3Zl*尗1O=yӅr{Ri=@^k>S0>>>>>׽d_zGuq]q{of@EqI] &J Q#XVQI@kl+m ąDc$HGmE 'ZEB.5Խ7?k's>c-{ksiw.}?33F9k;f5B]QY4ZIÜTi(@ >ib@ 'ch Ω4zxw`_ [E!Q* /3* ?F僾~FEFj-gւegx>Fض}7Akp'd6Wa#h߂m N5yFD8^7vֈuܵvg 9 r#`g1zv - VѝK`X2:L@_Z~΋j'8jѴ~HW;rZK z510X8%p3 dII:67>-Bl8|dP'ZI(a F𙡴^A})\54SxiA!E9Tu]Ƚ|!xbi"-T= ~_FBUȞ;KewQ^dwmb^gei a9&mNܥW>bdJ -N6j`^ukMG}e2BGo&"F=fWC `~ f_FP[َ -GFLP߁k@-ڏav> 5BըCNBx>@Lk~{-A+w=|<\y nk5r'Э96C>yN-e6jtJALB-4FJ:wl>)g«"*~G֣V=tyŦAE#iB1ޢрbdl2# \2)WڄϣB9{?74O^esUěI`8JiF='ަG4 U)Lq嘧E-sk' '4kz]4mޮYN/E-3x?|$_a<]SM5ЙAX é9]㯣K@Z 4ـPwZwdZ|W7ώro琓_P8*#[Ip6dԥ=yW[e@̣Zw:+p*},M.}M]؋yv:^yg9:yo#w˨`sS8;'djܭ#rtsvQS<( t q+s^Fc'+gЃ8I -jZI kI8I׆[@7#frٴךBly&Tccu`i_8>? \<վ>X^`/2f$XVE2h?d9M*jdngᯕ M _~c5S <; Uߌp&fT5r'ei̴S i#}kʴZ-.~]>Os51`'Ƹ_=]׆o=lc]`!ɗ]gӟ%O/c WÅzw耖{ctB#㏈;i]mE-|>dZ( @(WG/&6a]UԂ,!mp -i@*AcROɓW|NrM-2˞*M?_DğsYLob;O"9m7vl<bd[Lgo۫Ýj-%ȺE V"k:'†R6 Fmya;~wٶtght4w6D(G >3{_?kv!eU3ђhuП4GDҝ;NHBBB=N qz8\&3Nx?G Cqb{5\>ȭkJtYiOg;M4&:Sdc_bÕ* -+>0=I*vQƵiIW+NqD?ckLȚܨ贞/]F q엞Q$x NRE+ui_hJ$<ۮ?ՙr,>dӶ:>;>kԵi X2&)C2N/vqxA4,ȳzyN5-ty䴖mIU_>V ?ϩc9135*u#d'v2T&_!ߤ a3'e:梨@pwb .?"'wɥvā@=y|%a[kcKdIt,{<5IvOhs7a.yK.o\y 6O?\~.`d;y1,I|mn=g%4h/^}5 o!}\o4@nvX<`~:?zI}ܭr~tnn 7/֌gj;V.'fN+AS1LiUfd:iC-p@Vھx:!|o ico^[(,[?ޮMA]vcz8$guY:=N3';^.rKQ^kV0.[-upR;$%&s}]z_ _ 3u<frl:6˜ϙ[{&S_I˰\N:P&_YC%CM/?:<Y -+WQ؎~`)1ǝ^I{M/K/^dζ gIgrÒnυ>L0SKa\`a&N^Ft$wH,wHgGUȺrqlm%㻠twML2񿈵`㵒mIfʨS^$&dμW-#,z;eGs</ɦΏ>z=gI6sQzgW{婆gd^s{ا۷Z~MNgtrqOT'cu~"':a5Tuu^p?v:hku~UbSUgw#}:dNݜUrx^>1)24yl4>Rڔ6\qy#%j_U{r欒=23+Im[wāLsISL83;{lKQ#l2v/}L yEDMSEIX" AAj>$@B(4$%E4U]!m#Zˬy3s3Fs֏oKwA/a;b[#ߡ|vm%uhG=_9k9bi{ߵq*ХtmЯ]Cv6aoTӗCgYYyQP!W1>95oo=bM#pv*̙{8 (36,?+l;G?*XF2 CsM]-JqfV8KSڐO1-7~7}tE)Zy8R;Jy( v -i`hB{wPF9XA@tR<(w{(`&m{UkӓTƟLI%BMX=ir+r }ًącL:kt}A^D| @+kn -\+{%W`\-ǚT賮X2}s}o>ICr*rsxBn=[x(o~g^=Q$^5^tGA8W^X pk<f\qd y<xr@[ ח0cds-|#&3xyZFevYG<'*@9PV 6u43!b-3 FL++iegdfY ʦR-CƠq.уƻTmvҾ>ob}/zGVM=t֭4n~i%x]ݸKKmȱm;+ v> endobj 283 0 obj <>stream -Hy\T=3aqEDfdpc}ںDE `5IV?iR|jbL4qCDEaע;H{wν}= aB¨1/uLjFf~Sf)GR;}(-kzƟK"l%3R#zDu!Aj#uԌ^R/j3S)H`|`42g5ix,59&*2g/YR&{( XC|fϢ4Ҕ`"O18wt>.F@u W}wCIr hTʮRXU}ӴȔcZgZo/XkxGט K嘺GJ52X3UUO23&]h6~IDZ Fh DmLۣj*FN=Zwֻ}AHZ`G#tD;;:9F:82k8 s6uj6v.dg:pmvpvs}:*pr]pUD'GDEgʉɉuŶ5ڇkO?7z̞pOOQR[S_W]WSWmuQ.5-56/ [x[4]D'}L| ^+D R~bh-`%Xex :V 6=#|O)V3| __X5M$<屛 IH$ -.2H%2>"/"4b!lIT\djSK>8"qLzTޤ'EE mjDPcz{復fS3ʰ2"jN/Ԋ5OcjGЧOjOWg3#uԅ%uzN_Qغb]JRz -}G}/? 4~Yu–6d+۲xg;mmvM}k%o؅vw89 xݼpg 哜ǧ4O -7,+l,u9˝t>qV9_8CKmi6nFn}M]`u;^w{^P~qnȽu:D0#tN֛6K,}E2]+g%\e|m.|WWz&y='NN卼41Mo>9lm}__`?ןzYU[z[]>GXS}Wjlkmhƶmjil6hlM6ͦ ilͱ6[hls[lK_Gi A4PFiQ4XGiMI4TFiͤY4\Gi-ETJi -eVJZEi u6F6f*-vA;i=~:@#tq:A'3tG1>_oS:O[}A_HH?^KzE w}10r9.̆+pEĕ -[ʎ\s ɵ8ks q0\snȍ17܌#88c8888S88388s88 9s ܊[U[|] W*\pn- w.܃#x O)<^+x o-Cay  VX +c(XVXka@ :!auaclMF`$Fa4`,a<&`"&a2`*a:f`&fa6`.a>`!as,l-6a{v.aw=>y˽Jo[qA8PqQ8XqNI88u8?t.Aw=>Aa !0p#a10xaL)0t3ă90|X abXKa,VjXka >M` lmvNa}Aoa8Gw\uWt\Ni8gLqy8B\R\q4l`*Jbm/_K>Rwwewww@d`bBMqK^Οy 2m7.-v;y=K}A>ćc|OI>ŧ vܞ;pGw]s wrF=6?^Mӷ}O?Џ܉;s*3do+r n2bM]ݪtНmʼ-[A=cz\OI~ѳzWooi[͟H/rL_$y/E\ʋy /e#~O)?_+~oIsŮ6&d;~o|s.q.ą0.MDHDIHI$H$IHIdHdIHIHIs)i!-6VI{ t.UIw!=v.Ehb]>WI e !2Tp!#e12Vx eL)2Ut}~p?]{{]Kv).եt2]v9.|M9SdlcrMhm ZWi}m 6&TiFjFkjk&j&kjkfjfkjkj6b-R[ikmmQ;ig]vS{io}:P`Cu:RGhcu :Q'dSuN:SgloOyGGQ];| Yp`fH Tw !0 "hjQB[z4h[9m"!|P>3IOOg4WJ\Zlu،7F4pvc2|7; Vg[-:uuuuuu:EX5Lt9{-#tdfP-&ְcz@sX+'D\$.&$%´[mB}l?aۏ!#n=FhhqnmYY???!z@@ ExFgv򡲙3JKO -L\4iǏ}o -Fwxևxy:h`Pq˹.IdΜLG&!>0^N,ࠨݭ)L[qpѤ۽Y jAᥟ^aa.CGh {<*y7T+iq.SGMLP6W~'BmeyDn$es7CN ~šiv -09"d\;B0b=GtjG=a-K's@:ꀄQ3;h A(XM O [SLwZ$Ŵo>M{Zа SR Y)'z^Ъ%Ftm2D}b\憹=F {uE;Z.3xZN3ݴRA?^W5DŤ [<*WnLz?kah|{ck4YaްY8=n5ƚTzc\P|h50hrC\fA3ZkYK|Ղ mY4zv8X>H 'q́4]ˤ<O z@bQ8J6hq$IŝLy1J s,/ɞ?cpXVm|n!lN5GUziE* zhuz#Oi{kփACz(j!] Q#֞l5Y7h, F5 ԿU塶ux -oRsXXL=~ؔN>g93HIBfyiroSdV<+gGM'D٘NU{i]th25=Qb_Z=9}m>n]Xo8都5~t1dSQ*|@sOJ}spZd77lSCUsS's ~Zjt?){G tv]?xݭF6NSSnE7WUҕ2ϒIYDˬuj_5֨iWkpg_z[JeɊCki-HS6Z(@x m<``` %)MGm QJ -%3 C$3A$mPٕL S{{w;!T vGn^⮁u㵲&kKZ5 \ބ ߴSYGճ:Ai?E)+Cqpѭ~`t߾ZC{_*=?)8hb@"# uZ?HEga} .3ʀ,2>HW$ -g_ r`A\E\Vbm-!o`2EA||oEJ P8xzPDƙ}/K}Oq[~C.i{ Ixᛵ;)ziKf vR(EvblQ 6F2 hZi%1> luzmUdwFQ }XH'Ųϓ9N'&rc@7:TB7)BUQqAАG +C{fqՙN7c 3a[&Go = jܷmjԚ8Ff=ܱ)'FY[15BN4=+`f:3S4QWw%F}V_nyܭ>h - /7՗ԥ_sfbb&N2RYIb=KBӆw[8eLtq -FdiH\?Gn~P/R|~CMZWaְy$利UD~O*>HkU".)fHßOYT961dϓR1ڥgbsyq}.̄,&ʨGUL>rk2KZ -*es(Λ6m!d+Zg~($- $K[ؗi3k%Q,ą -b|aaYH/q[k0=Ӡ^^N[@砠4|L7IgfJ"67 OHBƠ`7O+G[1k oHa#8YAg*Cpa^;y雏[ªMڰwnfuu@=C۸GM?x -؍>w6 M1[߂@'~Xɰ6RW?S{`d+ζzq}R}]J0c2)?X caӂ7ķŘ%$ *^XV/CHCÌaVx^-QUg?{7w܆W0HIAB&`Gl$PRD-T@€(m5 V"E(RHʣcRNjeTPܽBc3w7q;};e3bO,wYJ/?zߚ}>}K2#qS~VE:؎AFXs]dG}F{D$4ru3lW^kt2TZ|Y%8V -{\rw冕/-^v3r>1;垥^'_ܭXr0; p'+onq< z5:lrpBX-- \ M#G !P( -O~-[0T+ٻrj]nw@&Q/Sُ4twY]\|$6B]]cu E‚٣ks4;X`ΛWI{;މmlf9>y؁ӛbO{`ͦzNA/-ԛ[oVhƉ f!g- z]0pg49M*U|6U{dSutȹ^J.+3B)#:b2<Ή%& E^k -N3IbP2kJ De6pЃcU1K7TUʍNXH \xuPS L(U(iTE.OVu ~,۬c͠vrk3v 0b -WX[Ҥnգ({$3*8ge: ^g͝Z˂Ӗ 97lCY^ʾlqsL:{jif-pE -U@p< -.cnǞ_'u?83O]uOIum?7iSêfn3[M?2OuնB V05FxE'&BF}^_T636uQ]u~OuxĻ7C]+ thRw3`f@Ϣ7/we -ɽ5ytpO[{ER[>%xN~^Q~9 %C>5w|r2H}ח+tx˫ 5 __=X7.MvaZ^ Vh}hu4ͤ aj)OΦNGFZ cm9}R@+৊QFO=$2g|"f\XuzV[\j4[zF| 񿡱0ZUT}B-Rdjanm όrZXcWXyrר'~r8!FQt,[ajobðJĺH<xvbZ͎05M}CT5J#tUvEܻh|Pu[nUs&0+ʫ 9Mr<C:ΦDW*T=jQ{'vQI1r>;K"})tU"sEҰBsPkϡmb҃tjybgx뼫I}mTLo_zb:݋za QOazkSnjn~u_*eJT -xfD~`/R^%njuUmlSQ>_Ey46J~Ep8§0ԧpjl}J=53⌅z56e&?}UU'puT -cWCK- -jU jVUK{7pROH*<|)/>OBgКtX A LSa!mEy<{i7BՔ oFe~ ~Vkzթ)5z4ސ۱5cvKse5K[mJ_}zMk.ZdDvO;F_}yplzP76W0zD41dl^Kćo=wwｿ RHQ R/!-5<@NLJ+/"" X PD($<e$P~%9?>sݻwٳ5UbzE6Vk0&ׂ9 ?pL(7Gi>gd uC2)c~RD Fd("gw(@+Qm?ib'\G΁u;efEB>%4* ؿ)pNJw$?Bss\|"4"Ұa{ݑr\^qLke=Tmt0\=)M\!a)kMRmh{xRV0TrP JΑ!kT58jE -P ʭNJVr7G+~P Yp C6Pe++׵{Ў]޺hurk]?ke఻ae Y)e=}Ywtdm]AZ:cХYݏBc!(iaЇ\AiPrc  -S4;E`nWt{v  s!jl Y?ѕKQ= -1ݎ$;\v:cQK7iCms}9聚} -M6s'"o"JҹM{6oūlYH8x;",0.{'7aԪYU,i } 5m3bOQ1]}T?4zL{_@!45{mIgB#_Jt.GC[{qKȳݼ}85{' 뺹>4D6tvDenNwIiTΚUMXCކ<$ߢut'7YS:ER[Xm1)U!؏z?n>I>r= wI)Z5McW8Pi 1 9`03V<6YG 1qFDz.ZzV@G,%yt cԮ~NZ -"qk2(HV\U`,QBe—YF@]N!DB-2sثEv77l}=ӱB̽+OՉ'lbo }~R/J/{Jy;`>CF-V@݀d~L'sE8 .ɇ >lC昍3h&/Δ*Q9{u0J"SxWWp~"4я|݇~q8 -ea߽ZCs'sep<ֽ: 1(iy&V|C}hkfI|V:m)ȥXk5ʷ+XS+_w 9 fÆDZÍC;|#}Mm &%k&c/M`M.8{ +̮rC}k>ssI.LvP4e΅11ek %᛻5hY.T6J;)[S*]x}<~>djE*ͼM~-5[,='=m?XJһHH4x3CoHg}?W*p(}! .j[9ؒgd (Ri!}νdVxg_mSo&v ]I;S*ѩyUbV1[>'MyVC޽輕vXd[ho21*4G&߬<t97"3ӽ=b*{a}SM& ی}W$7vJF͡}Č}o4> [k#Cjكc2cQo7fW0:IQ:^8>yK X%J=8GCk֩%Z>\+/~L0GPkw@%o;)g }y[͙;.JWL]EtLGq^"Ǭ# -%iT_ʞ}y#WȉNrwh1B>k' e{d*:ip8,,gA$`5n aN#G8,Y+rYl]we=VD J?rfLV''v-N5TEW/?p-[F! ΒJ)kP&-G/ oR2ϭMvP>Μ3S.Zp)[:,gu-3ƙ:ewLcӐo mKS/uekI`\G:~TF!Ov.riH%}u8XOb'~[蟮~ޔ:0v9G[/< Z:Qni ']Oo_""QIiA,9s3ϣ|Sh֎{/#[Oơ KD[Q_j~CQq|DeUG@Lԓ|^9'67HN|K;Y.$cE~ay4ȥ\x2h"1@ /x ~{xrWJs&qԋE}"'hD]tv?d' 䕩EȫæӗX;(f05xu3gyّty9ZS4<ɷ -|(#3ꉽoӶj_CW1?cC^&UUg߻ܛp BX -S -J#%R)/ A; -TV %1 В ʀP%RU@Rʖ{F;7Ϳg_]Ti>#ۑQ+߭G)WB 'o7`3m6?G>S+xVw7yؖ37+gRue|Ji)^..sdis :a@Ӭ-КbF9 6vc rL ?|ws<~)oz y?6&8hu5k*tVV"Yz:De:,#Tin"e=LO2ZJ -@8;H^,w2D2Gu (tl} OKsln*$Ic&YІrGNIWרn/Fr]qB(?苐0v:KޘT q~KIbwyco: [ݛUH{"yVgm?Kv:ƬXNBJ4 CE#)ŚXuK <x\%ŎE.`XKEpUuս`Sƚ)OzuD^9/b^k*omfUR|_<)xڗuvxb&ɌݓkpD:#I }]ι5wuaq7:V#{2>e}B:mvnp^p2wzu" }}sBV1bn> ULkal:"oH4&B.T΋*Ht^f>@@{4xʞ\ m`c{J6 '`<5p*y;r(:!CO{܂pN9P7r١ 280 vD/0&ad - - W=, :InPc <p ftu(YWu -?V89ʾ  Y`'9CKho Fs K>c̃8~-oNK $lIx$)/D$Ya2 y45`e -(B(23j)PPZbGYR:C˯{W"2Z_|~{v?/ŀk Av1eGNJ_fS ;Cs! g -_Qp)O4Tަ4u9 - oT"kd(+ij]E5+uR:>E䃔BαTol$.%Qy$#~Hxzx1exwo G H3_' f$*B\3 oEg^v$=woX-<9Bi)VQFϩh ?u颀 [akcƽPs]Zaq4a~zY?TJ%~;(G8b9 M[F{weg!Rb>ʳ|m 6GArzR\ @; -i-t-mT۩ -c = }N31`OF#XgFi"eN,i#y$"1y~2;U ]WwgG t%tY)G+DǕs~ Y NstV -mMfwX~ֵ\Bsq?7T_Fȑ~I=;q~h~(}'hf3bOn[oa`N.>b/{ol)lyUɅO ?^SUxj/+}Y%]&LE)yRTz'<>Iz7]tkZs먡LEl`C[짛[żv7YUBi;wf \v)ިRYGC,asqƺ) -8~(lAAqw~ꋏa{Vx:uaL'8s=Ϭg:϶Ƅ6Ny+M/Wn5ك 6|'ۜ%&A}o{8"r?k7ÅHǽ(j$g01D68q#JD"H$D"H$D"H$D"H$D"H$D"H$D"H$D"H$D"H$D"_ˆ7-*ekWk}<bŲKUW yvdU^Vm`H9Hº ŶoCt? Ii?UI+WӼ iZڴ`͒>-<޴o3Y{_JI}S3Ʊ!ؾE^GIm~B7"#Flo6nt;[o4nэl[0nYL,&c^a-blHXj_g)vu]Ut)bpO L8ͫz:-_YkGYn@h&y4+#~|oW6?5XݪЯ7w`}j|öOxcjcc> endobj 284 0 obj <>stream -H}tWǿy&/L3ÄaBbEdF nU=cmVX]e[z!-*2$3{'Tc9{߽}s3w@|z#65 N:?P<~${^tb ЍOεNВY9Ic~C7=:e-z) >$S} -o^[`+fށ#pɻd ey[5|u: xg5Ȟ$7AR&HaD$D?____=uUc| x\ٯVܦy> ymR(pcfwȕaa#NAj:TMQǩ buzT-S jҬZSi Zk[/XB,VKe%ÒgYc`hUg5XZAvVe&[9Nn6n>A!Q)Y%[mdVdv=2sZnE1111!ow񗒏K>-qq!>xgs3ݜ2ѕ*p5[XP\[_k~KTX9\0MF/Wg>v/Mi[͜h.nW*UJ#RCUMMVSPorڨ> ub~Z䗮k{Z3~XR-3, -O vx_uR+bNH~K~_N+y2cʯR^CۑX=%vtpCÜe͍-4/5vk\a޴ȴдTz=֔vi8aH3&D&f>I뺒gZ6}~w9f:rSv$G6P3rByW&7mgM~~m7Xr ~6m+Z~*sy?'YOx=};Iz 3(,,xG?uCvc9Vb#b+DX F&WlVB>p1&"cN"N ay>d42\ďXi D10 9|@!bb,g؆",۸8HCiIhW(ӫpMFRDhHEEC4~Goh,N(oiAoR:eP&eD8,;-GP"_k8& qRuA8+J9q^ (߉%qY7X7D\?B\JTE↸)nmqG4hEx G'X<N,ZKLc= f66{rnfc@`Pvܞ9;[iUZ6܅+Gs7)ϠXŽW܇_܏㸿n.AnNhLA<x -9 -^x  ? -$pDpF'/ -DAQHEDQQL%DIQJeDYQNDEQIT*>GbXꢆ)j4Q[a^x*5xo- o=#|O)>_+|o-XH$ DQW;I#vH#2^4b'L -<*H08(WqQq*A%QqL'2TQy@_۩2UqҝT>tv:,FTjPME)P]գO)էs5/KJ!5Ԅ)5ԂZR+Z=UϨ5}\r.;Wl窓Co vBuNԙ~r9u'<X8H`bz)=׻]gl流]r f6Zǎxj'؉vl0;Nma#Lig(;F9vgc|.vo XlA[ElQ[.m [Җm[֖m[.ù O0{.Ź}&|ڧbƟs7/_qCn7`n͹w܊܍sɽ7܏Dst Ӑr方ͥu-tk=@#'tN)zNizt>#>O,s;#k򦲩fj Sicڛ 2M 7&ĘXę5&ͤ&d3zaL1w]gGyf^pK&]A\L./eWpUj^k9:NDNS97pNק?<x8yLinYw=t/uՕ`p{%@'# (ݥҖK!ۥ}-nKx5Yw H ,h88 \ |8}] ^W]{I^JHbHRHZ8P -49es匜 rQr|-W\~gÂ`l0.LV&+)L 'Y~_7O~?M%%_]'ԗQ@i !4pA#i14x@iM)4tA3iͦ94|Z@ i-%rZA+i5z@imB[imvnC{ita:BGt>St> }BgtB<]7H_%LwAW+'}C9"zIJ5;20r).̊˲a>.–a\+pEJñ9pUI)i\kpMřŵ9p]7FܘpSn ~~ܒ[qky|om;|܀< 6 >< -16clͰ9o[6{[b+lcll#vb7='].wW+Uj?8p88 -GpAa !0p#a10xaL)0t3ă90|X a,%rX+a5zal[alvn{ap]㮅CpQ8ǭXk6'p:8 gp>.\p9P*<P!J+_RS_%̹1s9 q>q.뜏|ޙ\tTQ*NY'׭6 niU7z-v;y=׭x?|>8!܆r;ۇ-gtM:=]G<~;pGĝMR-U ޵l[{>,Mz٠UlMYrdlu7wlݲG>/rQ9&儜tr.8*Yştm2T&Mkx>/^j#.r!?%+U߶ljF\¯\[Vmd#loyMw{}'S?_EKc\M)Sڔ1d(Sx&`B61cMЄ0STlM)6զta*pSDHeM5q&$&T1UM5dMI5i&dꦆij<{޲mc-/m}eKckؚʹYͶul][ַ lC6VPRUcD5UTsUFJ -RQ¥DHDIHI$HeI*RUI$KJKTRSjIdImɖ:RWY&3w'y?%攋]\10 ,,!2yGx7MЦ%%iBҦm -)Pi4LiI2dN -M۳ḷn~w7_5FOgAjahz:6FM:Σ&MJt!]D4Eb..rh7]Mеt}Fn.0 -BBzt}>A{`h"HB -vn~j^X ih:xsX7&5HswJۥsHÈy{H9"+-#NzKzS="m'7< yxË|/w{}RZjG|1%_>>>E<d[tKDUT))TZLWf(~eRJH (JX "q;Nws78Dpʽ^3p^sc8"^+w~r  -WY_8yr ?EFK/]~%¯ GzY[ȓLȕAgOeM CWCP߄+Ȥ>>|pUp]T  n r"An'戹Ȱ -1 y[E V( -rEx2"^ j=_y=Gݢʄ".`pX7|؂c@ J -6Y0<쵾hpP!MbǟʞW#RI<}Rf^fȡׅ[w1HEK1x}LR 0\U{{%::O^LSK LwjT}̟ lO^VKu7z4bVm.ظ#nCaإN5' --'aL -/EMf:T2`qy[M,LyXd2utrY-;̑afhŃـWaB)X3vXW /#iKo6moVmS7(:rldtǾXb+hIH$2Z'r%4.HM(l?|W{Ty>P@YTlhcIOvH5 -ZE+MbPQIJԢU|h1>PcxDLz=4ylC7 -9;3w߽72Buڿ~Wc1*)=&ҵD2FG~p61^i1hC2ʼ$) ҆Ih7D`0cWM-INϨ3dgS?<nj2M 3Ć%I_1ʒi6x)8pVc /$B=Α,].89?/TJOT VE&F䑓hAö2;';!/%x1^}#Sr&SFN)YLaak-1q){E <;m3ƌN>$ȟv_C9L -y~mu'xnT9WuU?6uDQmx"5 ܤo4Ie -fm87LܜômQJ(t:.>7}dzz87/` y.rx]ݯW}S˿.>ްtkޟ5s^WYـ"7`}JɧDA:avK4f;j6`k GP4Xpv9%Ф03c֬ݎ+ػ6Y~㫋~5kiRl~")wW\QEUu!vtَQX"e(nMLL3dsQ:JCOi@wm9ڵ&s2N珞9I9y{ -ag5 @e?("Ŋxx tFc&M~TĥJPC`o܄goLga㹎v>.uPosPsWgo^t IJ l-^7(^D{VƬ"4iOlӀ֮$\[(tyoǧ+7;\eӫ0L_!QmGłG8je<ălT4fV@!]AutAkC!)t`AO6 W޴NRS^`ʋQ-R%Bd։?0:'ʆC -ۯq5x+.L\nۙw7w>^QJ*|xy7ݹnR8vˁT{\vI -M[,""8-~kxp s="+{xjv3,À{*J-035'd7)<)js;'11kKIBΐt9}VW_ˠ=kehT%DڙQ!g/3&~Hqn:UxU+T5~q_}rҋG>Z3 WE!wsM)4D"â1T -t$YN &#D*5P̀L~WKܨ9ڼstTתTcӿi-_Vׂzq v9WY)/pN OBXs 7FE-ߩ*Ȥ7PSt}61w&uqryNEuDc>@Y>mnu ?,~aI pcc*BKf*}llv{UgLxeaV)Vga sԇWr Y$2,|mQ.Džт RlygOK#&m ll(KpIE -GC@ ^e?XOA[+׭n+?ЃOQɳ9fB#efvfvS)D6 |@WL|@;D4?ckK^a#ðWuZn~(j#$3BlV]zk02E>/?/J+o%QU9d? -IpxMF=N|L*MFSuhY/ج2?[:!Vlife9IV u]!CM'5)، HV;܀Z1t&i)0 PR^?y}WsϹy:V쵋d3rIW(R&Ѿ\b~́K4yn5N u7?NK!ސXi6oqi:"ɌHp,u~\ͷ͒^BXe;4HzTBrZ -t%H©r͔r{3%J.97JBZ3?lƝlyѮ,58M2sJN<¾R$%ߣztRUQ/i#l@kN9+Gf97=ڥͅ9PkBll'J1s&Jg0 Y"xi?[ 8"N)Be1 -ws>ּzJ5q]nt{EMYkSc[csj}T5e$P߬]p h dM -w28o -.sۂ&ZbI7~Z.cLR'œO'I]3vS!u/59/9Nq}&b[yyA慹4 ׳T|- -YܗXm򛎙\d}ӳRYb풓zdB'qV<;I]t-[kԨOP;<(9nCh=Q?wBO-65 ؆ɓm54Z AﳩaR.b 8ZlFa0QrkyR5;'i<KW`Uclތ_kM еuR{Xau`0r%@ldm?}:D޲[+/(ΩCF_5иOo|px؝C/`7I)oBƩڗQ^*c2O?a5>A㤿%O~^c}̒%bf~J\ߏ:dr|PY';]>3$i|QKܩ=H:`|[2VsS g!Z+4_FeZOblb׻3% '^L1= hGipF5r P;Au1u.t.? ->'UA'rvqlp9gw/jN{'8QpoȚ9ȧg9bUqD잲cht4F$sA1qf, *ùts\͙tGut~zW+&z `eX3z7]e>{ՐK ];/5?W@38=g3/cۗRxxڋ2 -~ޣ?y~ y'<t_O}+ޠ)s@I/` @  -@x|<\_ܫ B p$:/|wt}0ff'u|=/_SByg&mbf*D>C[;&)tM9T -ȇ^O_ߙ9.6WGឡud䝄u>7]}Dz&7/u9tﰶPVRî v%kBp1 ouג?!o 1r1"2))ɔgM>F]f]],CIzkE5wDtƾ=.Pg/ܱS}ӓD ﺑ`tC/>Ѻ!Ⱥ&ǔ|.s5ο#K/GN,TO3~_XєQ=c=fZz+||o4vI݃9{]t9U3;:i7V&nTyMߕ1O? z_mo^s;;͹lzք6=A60ֱ`^ƟKAYF<4])C^/#z}5Ih S\Qnֵ`F91_cR{ -40CrWcv˳o;dƗwr2qy3޻ ͹r8ΞsP"A␚ `[PMi@()ШRHZK<,Z3T`tlPu^n cw{v/lflVLe> i좏T]Xcg0{ewHw)s[|IXyta>( fPv3,)J7Ft)ީ7o˭{a=NsDG=qg!:E2cTZ㗊d.:{4]{4ȌmJڻrKf=&!/d#ˤ/`mE7ߑTc>#__Ca)6L_q}У+cM6ߑ ~ MHׂj ܥhN{?DՖj^ߩl/{wcFLٛMT"KpBbf䦵BrU}yi${÷XNܩpwskQ9.[6Eq&dB,sૌqܭJ@Zv*ddhww\R y{X۹TVX}v8? ͖h -ketDrN<&S6B#*+~]6pw*o*J5UB{5h_[z^ -m -mL*hk{B{Q -z|F{cʬݎmf{/Ǽcڊ#koƗmƆsXi|5!ϚCσQ~o-?ky%k+0g9'nfw$?鎖;422x֋WAM*!FR:s^&mT/<N6_ _4uS_cx۹?$M1Wjq,9|_ I7ZԚ0$b vw!7Wy3Pz.SW3xvY2 iA㹊;w=}W·ґbN>_9 _12ҝ(tD>xv5øCiGvlFYgcOȯ,]Ax{C.D,cJ_k|4<7.iu. -Wu*5ڕuQnfԶks%\yY(ƞ{gx;ܩ\=pFCG'7Ji ̿ Y1d*nVߍllGOixil;}^Fa>[-I-2=Am9m}븸9+l/j -oJ(4|C~:zp!9'l%__o?c<4F|;XLW -&Eߕ@q[GkoOIwkyEwS#m#O>IQϲ3yzexL_O;ԐrW:i>ײԜݩr h~\g&^tbrID,zȑsr WS#@2}Nk/IG/vR!=\v}|"^{K}r=51?ӽ̞fC_<=%#@ O?63-ԔybMndh1IH-9_ɃyydL9ėNJbSi3j4NE*+ Sa2yܣ+}$L_༁ t^ֺ̓fy^Cw<9hG/vY拺&Xr;g4gԱ{&ϱDM\Y>w.7& -y/L9~wF?xVҾ\8/  -N% R0$E+ DQK 4' -6CkE)j}00K/)(VrsɗHޙ={GK}T4'N)or،a;v$"c6SURބ?*:7Ѧ7V=}h;9RCs |.8ߤVK9s66؃>oσF*59;NYpzs&'@(nޕ_VACw@V4XK,(QJi- 9{_[<)mOM7Mg"?SmxZi-ޜ) _|b<4|A˼xQbj5ERI{ks e%GΖo"/QyOF^|:_505۟80wO"Q鹘sƴt}ϝ#7\%f-f37 ruAԺ$lWuaO -:|Eޓṕ _Pw/ 톲z&ͶXio|,H/wܮp(͵@jdZWRܧqL5VC`A+C~_t>e7`bC% Iw/=B8#eE"ct[rc#]eK(Ӵ3^}K?<%_*ʯb*7:%&#_ֶ+̀ƟM-C<5o1aNoYslHg W0~OyM֦+2(Sڽh{e\6(Ol1^:\IW]lp -ZdJt+ClZ3~{;d6v!ۇla-2ƮEwQ:)Jns(_ҹ|ֶ,vOR$9ߥ.rev;1GTccYRhO#'h\lX$FNV;;c,֔C|SqK丟p^%F/%P{Sdsɡݓs'AbeO~kdFp0y͝y?1p7qA1zzeqRފlLrnc )q*SFgO1=rKfțD `KGjڕOFzK~8ߴouRfZ&cgP#Λq%Rƹ.U~!oXm5~Rf.Im,|u8ec'wHZ6\-"RzBs:俓WX/=pm>͑g#LNyg<9)pnM|PKnrg:R|.w8G1g\ \ֹa2/R#]M~AwR[+rL ũK {Ovm7{9Y?]v8tt)ғ6qRg;\5'Yg_?WMR;>1L -I?GmZۥݯ(odW<=j߶c~ȅH65vim8?6|G+yR$WE%k Z置~rƸhwדXM2b65Wt#-D[N=[n|Q̒[,O] 9rqD'|HJRwcv#)Jyߟ_H SwIA2rrKr]ھJAG.6t~U)ZSTN"9]%%䰎W(:ZM\J5/YB?IH -|t">8'C>B$6{wCN{h K^/]5s_@@rH.104pS?ل!\JP SE7c/MݓjmS vaMڋ1]dX -7{Z]KM4ٜpH} ؼ W8d#gM7"nK}2r%bB{_!k( zq(|0 \ǃ~WY]|K[d$ $M -%)`$<’"}! $@Xe+Vdm0 (X2Xt( 0Xʌt`ؾ{/!Z0?n2w]{=Cb)V݂Vr60~u3sf7N -j9 ĕ~ QO Tcu:aoCF! T{Qwis1'q$]hqe®.m[/QYGJRn㡏#W^>yZ&p7/M˵h,_z=@|dx 9NįHiǠAa66\$x&*RC\P50@GP :FJɁO}4t{Mn#B 8A\ny1*< )#WZ' l8@.dO2Zw-ϯ -, ~(rʻNp.~~ep`>]QA=3t~ނdd@^;&r l@>a m܀|ȆӰ>SX Գ韅tG"u~5Cmp9kAzww)J߈ߌ?o6iULj2cCB2a,aI;y\:XdQF>RC5)u=S&~q2#凤x#&!rtr7$3|y)E^s㎔Xw?,?vdGxicN?j޽zIxW|)҃1^q $I Oc16)JI2 c%;s ne~ V%P/XO{=>K;UAJ콀gSERfwӾ>~'_ [ˠ_4d~CdGdrj|Q,vߐjcq#â 1򡳻j\y{Z=j̡@ٛwTFTGIw:wo|ԫ1_uitjırNPlXV:w]x\9>hpr~>B{s,4{7OJUnC5]\w3JZ뤪YTk"GՑ29ȻibOt'hK,Yn^%B7!67D.C*K" 6lvVH @ɒf+-OJ/J`B)ioo'mIIkr,ݓ ?jh+#(p~Jȁ^Z&>}RRޗN<?gĚÜ:h(N;UoaoB;jٝ!TJ!kS!NdFuYrd>kg=sV$I4uLCR}7iBʍk -$1sfg k#!cwydH{KҢ$v՚(Qu*F:3WPg0;ܖ8ҷkuYSĞvdeψ:r׻l ٥e#U>*"0_wu sȭ}ޙʒm.I>yrO\AZ7~y~SԤNݽ;A7U2Oyuy0/9z -IUan,w< m_ǟh4Fh4Fh4Fh4Fh4Fh4Fh4Fh4Fh4Fh4>"Cc^vOL2^l#j, -IKb 6zlDwђi5hJݠnJK9-OFt[ .z8>0sydaѴOfz:7I7.hR"? -&3a̢n ZL>KM ZZǐ?yng~ܡƱVG۸[j&1tF7.x)xx]gE+Q=F -1smfj+[}fYĩ?d_%N]b ^ QP(%H(5Qa[fL|qFl -ajt贆p3CE"),h`C֠JMPjD  ߹`g.R sY_Ĕf> endobj 285 0 obj <>stream -Hl XGyUhP5^+  xERQuxjT&1kl/ʑOZwWb -u@e[|y(UEiRI1؀GAB9Ouyl.6MEgu+W8&/Ն;^r%+RK3t7 UՆr/LJX?6l[_k3 .]]s]rmsI먹j6K h|3vQh&n= }>BC4}UFhdNF`a 17757u4u5i^>ApS鑻ݼSa3r5mpHGJBB/W///{Nwo -Ѻܺzj77vjd?ۛח%x`eh5Kk ; 'ԆP-gX g+;4JiTwn\:w}lTa|ӨG&j_xoԵUGwZ9S+s3fHG%iMx fb_οTG|+}x$ci_EW{W }jGQ/ba-}/%UN"'vA1,UF&eV>U6", FuͰ u3|{1 ~N  Bh(SPg,;` PX"\X a%C$@$B2@ -A*̇tX YdC.Bȇ<C!"?aE?4 !C3qN&@pNF @<-q*N'+NY80\!a*`$Fa4Z0`[8tv;-aG|;PL$LL4]bW1_CWtC 3p4@#ԁ u4 c&fa6`..=b*)> :D__0}E__oY+#tq:AetNi:CgQh:GTA]Kt* -]kt]ť -\;33փdXoևy2/k ^g`{y!l2\PJ06`#(1fcX|rKex6MddX "FQb4Dܒ&E#~w=zT=WOeIzZ=Uϩjbi氹l QΉ1b,Y<\|^ y_%/rpjjkZ? =oUM -}?x w|V1 -+81^L$1Y(b.f(~8HhP *>G@DɔBF)2heReSBʣ|*B*Eob-D#GO@<D}p <ȓx2O<ߜW xU379͙o,[,$n@kۤ @m]YkmQ6QZa -VT-.[k{fΜsf̙|>_|>/h+L fx0Û.[B, Ű2X+`%Vށ5P a>l,ȆMl#>OEsh 9  `7i=mOg9Y{apP.Cr9| +8"Ųl.[Ȗ2Mr̐d̒KelPRZa8̑m*m$\ -Vj@Fr܀ЃQ1q (ߓˍr@n$L/?ɏ'b#`*-JZͱwh4L ls vsv;v."?X=N쉽7>o_xmvnڃE88{> `1ޏ? %}7-GJP*I%q>'3|y;ė -_k\luE\?/%}žj_k dQ q0&DxUf ~c=h ʭ0C[[XZY[OX0I&V*/M\ E̚#{?'i3 n=k=gpk5m1Ҡqxe+RJ9*B*Rs|ʣ' -i mrB/bHkųb*j*ZlNЙA; /SWeJUz Ih6͡ס=4ӛ-&h1-4At1:Vxu&.d{r.{G KQN#_0]õGGv!1U)UH,ȃn]eUBs<4FJIGtNi:Cg tQu(EuUy]tc9999ZhR[:Lky9;9qD:D;1N; N$;)N}5iY'kMWPPuSU*PJ(P=ԝzipS9jIF7ITVנ2~߾frg~F&"fM`0dQ]3/f2BMD0.GH^ѠEwۧww-kΝ!}mrZggeHOk٢yM}F OINJLԋ(1<̒ !MuK\=^?ʛYq OsEL7(P%r]LݥkzL~)B7,ռޥen߳#妽q>_+S˘ۻ[zޗR劢@Wr`mxY\SA2Yma -O'"JaWąNmfv4Bb\gBnr"eCe&e%rz.>ob` *LjAq7TE8QZr"&"0C<\jɅ m -0Cݼ# Lތ%eezMt!IuAuAxݼRWTzҫ+Ʈ_qk*aStQ 񆶻mp´C%6G!KBJƦ|)n ݨ4W7ԑ0{ƫ5 bcs ' l6؀m$sIH-M*H(r-]ڎVQd[E:5bڢc6:MEca~DŽ6,}|^\p7i- - 0C虈Lnsmyqnb&K[2FS8N32gJ^R0hv$"BCHn({-Ž7f2DO3 '$K=pR#x֤ɤ%w0C3D*Y/@Ұw0 sR"JtUf8W|zށ< - t\~܀gH)&%{3P9W-wa4GQ a>\[j$)XE;XxrWWEE\zDطm+<( ƬXʢj`hj$tASp"T;Ȗf?vM&ThC6uUM CUtgxTݾr{ڷ4D66o,uǮ]_މYJ$O>qAWo[ȉ*6m]1Y3 J nr%ܔRɸ4;Hd(L:&R{yƤ!Иoh'Q6T}سd*0 7o^>Yl6*ֻ۪w XBeᕂCehGPϳ,_q-O<_!BY!VT>6DO"}r@<KpT&~{_UBXݍӳ\j7wI&sPjCb :4ؠrۛ}/sw/iIqI~l)d8*ύԋoo>t=Z7 Wm؁c̈́F)jM[/݌wTQߝ-zz06ԹA%8V-*ɖ ELڃPPv%ø@l<-&Mǖǹ'KJ©S*)EJqd/<'gj*?檤IE*ʕkKbElQ6Rڒ5ٚc8BZ41I| - .O\k -\L~{,`h[w%2^s;}\=IbpE=/*;oښZHڔJ~p.b.9>8z=~hr;`!4(~ Ȃb"%Y -9WGz0SUV.K!b"PupJ.}ihhٹcVW]/<KC0p.bbkF> 7sr벧=8FTΊ1 [K6['1E  HL(S-2^ T'662ҫJIwǺ^;Gwd閊թENdhaxxGxB%; k!l}ޝ{j(%P;'lUUv߹;×CAAVQqDTDW"*1T5.qk -BRbquk,ckRcLkkMZvKtN̽#5N{s}3dv v"Xh)DJP &#PQӵ%bΙ/[wyΜ,ػ"9ilb_UmkǬ_g+ޘZݗUޘ+?Uzt}V? 6ȕt" &-eUt#ìf?ֺݬ9vQ_S -cF;i#J~5-,y{ȥVZ3\D[#~6|~:AFx916Xrm -Ի&Yᗽƾ(fa1HqXx<C&M*)?/NEO4?hVYY>hB_ʢhuqdӐ}{ d_XԏJPtΈϷŻFf/lR3vT*\u @jO<[uR̡f-5]vWSB5j$V%ESֳ[L]r> -6ͳ-eTR6bhmq7ݺNr;b~^wm4PLUb?M"&=.nDkv1uuB9a;BI \4POjeJ׬,jDf穃sgu]5M\~|+=*3q:nua SV#ǣΉꆭlCx6MH@yr\q~+huc&S9q:xd ޻z 0n*{ `#]WgZp5:" -<@h -q -3+?D=5˺a}FX,!vhuf繟GE75辻8N; tb8\_apdԟlӜskmJw[\YoI kE:aCUZ Y*]bD#"fzbC+2tQ -znG>yf.ty -y [lv܍WkPK3ޢ /kh~yyM -g(/792*]g\PvG=AvXm }$J;1YtRW|[iN&pM6zP'pYN<:WuXWfȞ=֏4󬓭cM4Eb]UO(+q޷0[ZTcUSY~{KA~ְ| -Ma8w;bMrgyu^ѽa+my`5!989ƴ΃y 薻so_ҟ[)υsO gû\TR|3cVuX4+9 3IO™%YO=7_ܭ«_:>Ldģk2:w9NE: A# T,F`0X U@"P&18êEPBLR"q2w;ݗOg|~9k紝K=`#/{ Cy% -=%@ȃwBzvphX2P  z8.Zs>B[N[Θ\"2?EOMѝ:HH{:뒜_GK>Ӄe罅yoa޻y -tyWwޗ{L̫/:x'eNZ?wKذ_0.#)t!.#4Z*3Q0=+4mlUpFDz̑~~%c&ߠ K&cɝȧNI-^żq#]j\P+"\zß!Ok۔9<wr>CLbbnhh #tkWi~SA%R+S8+/BY)dB;:K7'-CݡrʇoyAcQ ^/OnZOnFR L#Jep{9T⾇g*= -~+ p~cٷST;[ -~gR - -~g#A%a -;6A[Ȃb*M̷e rK`,amiJ*NeKcx%= y ɪPI-ca^MZվɷiAi7E"iMN%^_ᝲ1A$|Knn!CCz!Gxo,;5fb,A.䬮$ol.wg;XwFs[/ X}{jLU<y&ӽWVw&K!ٺ> k7![S% r7ߞZÎqj2b2D @ƪ!}ouPۅv^+,gDY>jҘ#v$m FQSEХQ*h)E=cAGTF+inMQ%{}nn1k}kssg}v22ymTk"G -pc swůj#ĉ-N-⫒>G6-6(Sqs$lCT;-w;]{w@K`у =˃A8O)GR*r"$e`~ c0J-q@,W߳ NĹw~7}X'E[]x{D{[A l[ "Ȧ@ -B'p : 9@ pinTkZ=za^CV^ͦü43誙O_zqEZ@fH;B. m&2_A/LQ3[ pSh{7SĩNmp&mt{KN;dz@§wjrk=wR*9E{3p :`sr@3~CسF}jO56tO|="'%L-"ZX8Z -|1:,^WgN~ksh=!P2p)$rg ]}c%[ɾjJV[<"7+ 6v`z5 pњvM~%Rh۠7 qP|2` ->`wQ_JMr{4#N RB3}pN]3>C~o2=ܿג:AgQo\aFg?FSOzKy?wH>+Mv 2 |Hs v|)6yq>5 yAОsʸOWDoy}oKgop/*\H -#P}p817b1H|AVUhj5"xu1#G0l '4 ?f&0:43YLK"r߱&fn>RG]9c}>k:@?(̧9%'ô; /ޅ,6Mc|gߜ+_ơyyi?ѫ_7fx}N.TGi~]0o0' M&߇_;7-1OY< PMY(b ¤ѻ'5Ētw&U፡UcvP_A:=Z;?K@#j;Pۼ!]H_7q|X*gbUR7Oכ(x@]R$? -cݞ|ֶsi{Oob~,#qo3I[z4UW8_B ]s)_/Gn(r\]Gm HS_Uo/-{e|G~zI/91wt1kW.♲.m'RRf!8B$MKQcpI5Jnmǀp;D7 Hͅj8o&h1E2OyuL#q<NɠL6k5yy!CnLij4WQɼ@+ K7eꤦ'[nFS.oUi:f9:cnw+.YtNVX}" zD@wms.%΅=lR)o? 1zZۅ!6a) u$ÀÐs=Btp9̩ -'g~ь\- -w%ڸ?pV7*StEl˞U][tsЊ^3 -xߐ\@_֮:7re*-5lɫEº[ݱfM_eXJ`N3+:ɨ9nxr*^:# M~c&oVjGܣlSЏBR⯟OG1 {:?|ߕKE$yH۽C}H^j};IDu歰W59t?YB'q~QBͲM(fi=%ӈu#m3Oi>ᔜ;|uRa;z\kZh@,pKj\ʄVTC -ȗbO)$W#+}z5c/װgJ8;>"v:{{"w#wNoVET'wc5$.u{*ΊN3tB{gcy[)^mN)%GR/M}mucn81'!6ޥ|̻䷩4_>b~[E)^mZ:NGϰCXBo*)85iRN!m*cFwF}|_1mٻ13n n֮дMvӻm>.f28 7uoQDVzQ!6XZɊ/ث}zN)g%ʹ[KM~K!~LϰV[F m,6AuIpb@}Pveg[S_VJ~3~ NF R9FY6֢p0!N3c߅Հx+JXM)_E9Gd%I(v&MdyC @ @ @ @ @ @ (3BkD%QM#S8)z-S!DtEtw -}NT7FK"7EuF,!KʣqQ]U룺V{iqI[| A{^_K}`^ x7&kk5fe9+3;:?(1Fj$$\6Ivv5J\;. λKweuΥ:n%M~ .weC+ZE*jr9Yvէ;YZ.Z; flRI{pc#s'AUΥx1+&k¬g!*h J>6]=8>{O`7tWm2I۱]Ҷ/Lb<u\h,+˗^`e͘kSSmLk/`yomYYZXK%V*Y:: cñ́ì=N Cm8@AIJh6) #ԝ2ݏYXǰXWX M -7W@Eo+@fk5^;0!o`bP%NN웕`JlͿ/%rZs6(I=c-q9&^VLĤ\5#KӲQ%YDHi>=I==ls:svg_͙:Xꔝ|bTJcB1!ZUXׄJPg`Y( IaFSCJ{XH=3}0V:K2Cs 9+T+k2gQUɐ-{OHsyJwnQ 3fJi0evaziyz+#_f"=,b8i pr PD -΀ ' A@AJ99> endobj 286 0 obj <>stream -Hl\G?Qh /gbEwzKv(6b..Qc9=X Eλ7{wg激 9` y|cCZ@plt?E)zv%a،N{4 *clp]FS~{#d6W8;D&e%AO]&4KZH,p - ]i@dIKyKb}G5J*ʶ7DSZLiB|9)p`Ȕ8xd]GgKv~":EqEmu||64h -GʦR! 2SghooH5d ; Oə&?-c4rY[k6IR_]nQnnGJ;ܴ6]j ϵcEP{Mt{}p_OoGFflit5n)F?bV&4h -5=`74j||||||\13u `UX\~!ȿ(׹ַ_ K|<,ea!ðDXcm(3oWD|\sb@MXͦ5UVGU 'TזH~ŎXUNUzUZU*r W*/W}ݼ]^]~ƹB- ;2!_p͓ھʩ$!R֖u+ƦH_(풴GƢ7фgnEoߨ.I_)KDS\ԪTWy5SƼa}:77FIkqR; I=*`32X (+]6Ͱr8 -7- ~]NIA AP8%pB);?@\a=D]+ -"!b! !,I0!RgH HLX+ ِ% <8р 9 -/q$8UtB8}pb |D1ILSoe$Q0P(Q8E()(b((,@D4R((2(ʢlʡGLt1Cl1G?CH~Ÿ~:x8>#| a8GpR^3fvnc^5 -Ni8gF_u|-oxKx湼|=oۈi=m@c0fM$oCw|ơD|7߃ DLz6>!b#L#1M)6C6 H0[P5m,lI[h+0s0[acklm;ag]v ЇK/80o58#tq:A'q`Cq>Op8!Ni:CguyCޔ5V4)"U4yWޓe +@qePPu:/-m1f&F@ X00 06ʍ3Ə -cό猟c_47^05LElot/+J eLdllF7KD_6^1&i\Qc0 !,'P"^$X^#MֲuF텷z%MMDSL+҅#~itlAD=E3h6Mл4w\*X6=|E|V/NdٚNY}Nx3Np@8/ޯ _^d#Fhc5*jĴeI:K=Wg2Czb[ҧWTػWAݻuҹS[jI6KIN$ī8K1cFXt|N$7TkmW1NIIt vv3t-Кf͂G౻n~V0ԯ)EN^tLfQzE4H-_tPg:Vei2NSn3 -z@Y.U+A~_Q[׍w"VubkF]c"J*gWhr -dr<8Am2|$71m-e^h7)??!8v&q.]Ln3<7Yty ȕVk -;vq( -V'rl24֧4xr T@+wyF]3x;y _bˢ+FPY]FiƝPlTZV]@D롤dC#{?d-w|Aw(45i^'hw+:cl76SI[}@Iek t$D__غ%6P[P`]|Uy" SmuޏI7f?jRg&,t狾WfJ`{33{ckcﲘZ<0g]n%܆BP)D*jq没)4"Vh┤\zF6B R-c!$ž/w g$TWQ,i@.r+'*** U"Q` AEog)}aQۀXFѭPBS` VM{2Art+yD\ 0څ5udܦ"n,>uG?Ec)p #I@]- Frun"; nE\(b;*r6Bz~ymyn Y@;9!dF -ϒϟL^pOKX!  75m1`nA7Pp#Y(`˂q}KUXhU"iqO,eȄE0U^Or#$VXLdBvjQ_/ u^F76c҆A*n3dD{jlƸK~D(S QNөQЏi,1 t&B?<դqW,Wt -9g3f)guY|@.H6 u/ B٤vDURl'A6IM ibO&q;KH1<G1Ql%κ)DLHTh@ӗE!fuD#Ys[BJKgOz쥧L704<bC( C"+\XZU2;oc#-P#x˔2!{ϴyW` (q`_rN:1-` Pom  "< CCJRtBͤh'H8c4ӘFⶶU -ڤBDfpZ;tbj:m/]ZO!y|8%Èe RR%̄Z`0c0rnZ4-JTf=4f a:Npn2$Oc\_PRFӯ<>ƀW|L|A.0rXnL\B&[\5֢34Y*DN-(2JKvT(Ajs2'zYfwIYћ_>9gsPvꖃ+W| Λftϛwa+_ٿmGw9;\ Ռ ޒsL.=p&;Bְ*3 A* ҩ0utѳ"k.Yqr+^6W"nKW !Q6شjdj&I(HDN(,œq΃E8:[Ps^`/Sdb*Ki,Xָn: !*vG0p,YN'V\ٜVͦT1s:Nȥ%4!>u;h~LP Xݧ~%ILktE8ZG/k{~RAˌ+zx!Gg"h_x3Yo=9dBِ SVs*;=tDC)[ؾ;ǗؓWA/OXdkl.KK -OMK/[Shͱ/ 鬉~2KIJšm-ZAD/11#9ɦUT~ׁi8:lA^c˱|-9}{wц+ܤ^+"Q\9?_#hC -(9KX8"?a jt%u'—D66dE`2P3fعϝ6!\h-NJХl022'oO~a:?FY7~S`\tyv_1&~N8 ~'5e%S̳PI8:P"! N;ej 9@hٯ;3hxV[M߂]+|V6aLݒiݒ$vIeI.ykus̽v4CʚqZ}͜}JOԙ3&Z(/l/}^u0PlK =E`B!whb ~4E/Y+qK{Ribww - ڧFqūͮ˕$]AH -YbeCv@ h!'Z=,L&牆sGfJw9ބH"T bPT)CY *Dl -DJd --PR" BEEfjkC&2HAY 9}N7w}9r;e -5#K&*.7[1ǺEMf҂g } );pj9|[9H'# V_TäHmi#gLcjc>nV9emYng*8goJTGZjfG0IuyC#E$j`,]\㘬 V _rFODIg!"+|.<": "#'`u %-3k(/0ԋrjg"7T&^f5=0詆</utsLg#*`kU:M7%2 FycچNfeF.c/vb$:Հ(U_5t`Jz'آ{쳗b3nzpW/5-Dnt?Q):3}}c\2*)r>fjoלs8ߦroWǑM:ϣS+7݃\9{QJ[(%E7dK,97#ٿEwƸY7PFw p@{b=$KJ̅sR"䘭Q?O0܏wcȡ/BVo>q[tҝuÜG{K617P£ NjJy83,?lǯ'U 3+l^&&ům/>~z~o5_[3.Jm -˾ݜ z/#MrTb$>Vc37ˈihq~VjR  CKNGJ'8I6o1ycɓW~gw3qHj?W1~ؙ~tjZ{=Zp/*5ǯ'OOM{3mA>֗S++2E&=؜rC9*kfN1G|w0CS $v}pM>}=Sv_qATv%^#Edhıc|S!q#tm:%y#=RbýlW]fo؉CQ)CguT,=]Dk4(+;> ź8M$ -$]l4أ=vCQF52&Kkw׫Gߗաdr9፸F -|~#xnADZ:,u3bV^E4t4C~}}36Zg79ƭ.P%zyK+ f;LVb=c@bcDȌ}D1yXJ| ߇wx֞8 s3rƽ^ߺ6L#Ԍ -([l^x-nk3$7,QAK~8,5npZːø;Ř{"w N"T»ǫra|~OXz@y"##a?aRяnF/&xw1ë`$2_"WYo>Q;rPʝDSZ4F[yOZuVLf"˛|o -cо΁pu)#6%ߗ+_۽jkӽ:dwj2@NӹϣG y\@'~%R-vD§\QS̵0E`'-(Di|DEJb^9?2"_dg9w0[`<Ff E -NP/{4k!easڗeļ (I-[ / -:sFMh8GėKNav)uo=+s{y!Ʃs߉LdwTMش̮!7tsz?Z]2|o7 -CznZ~Џn^ zKݦ31kq>Wsg8?E< ݩ9%k[賁'Z{;~h8kn-;e kiD;Ets=vPRPO jNuݎ:>6y9v0yj~ġ ܿ153+p5lǡ7[,jN|Υ0CWjľ"_ms~PL{ GC3XbKs43a3EJO=9~s A=+Y0d?]2YB2E(tםE$"T{ ?ʬ.2OO rc{ ƍmtNn0nl}Ɩ'`X77vރ`=.f}vqc-q6 c1;P0c| \>X.qmc77 ƍ aǃC4h W ԘV`-HC#!;`ge)wlwWDlpd5?{ڜAa>M0kaWaݠ_ F@U\jy86`5}|~(BE|J^}LPf - .;q-Qgh }oM*i4]dۦvg:KeJ'.#u? UwڧP;12w<W$/c70Na^ug,=P!wR>ֺ6l1Ty2*3.iBN@[T3)"ߤn!+S\C2 +`e>e+j{/nxur3oT|F&q(wa&@; R_9_".D]ݖ&+5*zӕj탨GQlYԷɣUWWS{RL[ɛ "CЗ3sBDHCFKq7@4a^*S`o1abZ7w\l}4vE? ;U/ -b#]ysF3Z_P^~-0~ry7P_k4}&DmkSOA qz eKMȮJ]+O84<$Ї7\Lq6ἳ^gSe8FDlĻ0N#e+u Ы|uG)A&rjٚWcz03{?2ؚF؛GG7ӟkՈjZ G|MT,1r[!(բc,Wh -Ϗ| *$/C|D㹡ZYcD1czǠGY#<O736O|VNm+D<ceo1úfw-5yi˝[8k|zsk90L?kyYDmK*E[7]Uu«( Bb gf|3KmgFeEj+3FoQLN'½$TP/S$/9篕C4EB/m{@h,9ǞlԸnTfj,2^4u"0KW͐*mV/E j]WytG?L_+T -!8D+n 3Vsh|J3ycLGKׁz}lspcQ;s %_r4뇙4V+FA&vyIWksg0^cg|@I6-~&oUb]F4?)O5Hž{2sbαΎgr-X&WHwC~1>ķ: -r$ O!Hw p ~rMGQ7*p?pV9O47~A.NDlBo#fKX`| xq?n|sZc -~˿c3`E~%tM~H(G:PZ4BykB!JDIu<r#g@sOe8֍Ax/ʍ\*yŚ]SyrCqMfi' = {*KQ~ I˳d*Om1J]Jr;>c"%u>L1%~DtO2uOCL~Y^qjf1~]@3 @Cܧ ]*a\vDORKjkr6QIb[KT(Ө%*Pus T-T%{Vo#*O)hƥԂSGgYDK!?r#i6CkS\n]!qzcl/Eh2Ts ._|"֙<ʷ Fm̥ҋpD@ w%jX` Tr"2e{ݬ-eTCkUw*5^Sny= (:U+2Cfɛ6g}2X;*`%2ߣIwag/zީ[!YeOPNB9˜!{5jupOcS<^(p "/9 d&Cn7x>hNj(n&A)J `4u t=c0b=֡]@~/?CY`z =b~w'`H|i̦~P,0" -s)\HwA^]j w0A?6\QCm0wſz| u4/b <ȱ0(y"Q| 楔\/1CID/^GzLMcsncEek֔6gd"ƠHI?班ng8~gmt3W5:t̙v5 x.]Ԅgh}f/U|'hgLj+-; .}8nJFX&`_hf0 x- Əw)K;1qC@0x0FGQ8e/zZ"#u u<T;'[hrz#oo\>_jm/wxOn>`tuJ8D'-'r7vy`xY6 yLżCfἃy c\ 卆=ߑ)Q}a3jأ2z -#=}𬁰LJՖ_==Ds ɨ+J E|BzT_>#'̾\"f!~iRA.s',ely -`'hՈczI߄.S*쵛Oß~b|j4W>^=XSG&QKy_uÕb(qSII2ij"dpqG+r -wvKu5Jl 岴=@i]mYi0(B@|H4E.^Ex Ԙ/(?A03HG73O#Gو.{,@j\ZFt]o[}65!MyںyjO?]a<^` \a@%klς&9Ov}p;ux6Zԣٯ>xwf7~bnщv{> VCo|3r v#g;B읒{AC%[} Y-Wg_-.OM rz3 ql4fc5A|<[SLqW|{έéw -VU|{>:*;$WyEY~Y~7Yy CCi_ɋWA0LG.9:OCU+!64 y{;XO=[.< -W<(^pI]"|]T( -BP( -BP( -BP( -BP( -BP( -BP(FtM!Jiiվ+;TBWnhNSPudA{ -GӋht?JQA3fFwtAs֡ }A(8l̪k,tv+o,gs|&6 yhHps]C1ݝMz1ݛqS=۩uF6RF>Lrl_ vsGw}/t i.RP(K6y7ml'5>ِ'[֡9b͐w5-0r^5Y5͉NGbRh;o7moMnsmmۦc(mcFMFM{.]m0G -endstream endobj 276 0 obj <> endobj 287 0 obj <>stream -HyTW~)Qa `\c5n v[3.1&㉎ǙA9Q5;㊈ -QDE5gμ>wv xBA1="V_ܒRrC 1!%)6R͑;+]q=1=gmg@d/jHKN= n-C;e. !Ǟsg;LoܮʴܴXu$@@xa w;9Av {@7 S!Bj! ( -(5h6lPs1uossh.DDf -uu+t}HSSZN_Qz}^ ㆝ ݣdjǞvZ^vZoOx]ÌG麩mpr*xy呙m&f064O1̫-Eo[-,%2ԒlIuҬXZYOYZZ’Rla΅ íõSDM殛ZbmKS491X ֘XTTw54IӚFtsu9odZF/AAL =lUuMlUͫ%*xcQ3Rή14B]r[Yʉ- ]|S>LD*nPUJQ Vv DsyyU ;?.5vIfvEo[ٝpvI]gW=)ٕsvJ7+㋡Npq:rv΁! bٽt)U5jTb/}Lk鏯 uj`X7{]peV s&j@cҞmwRg3<աijfjjSS%fC먉,WV9u<^_[ -bw^TW W%H{,rG+VV.p=2d+n7j([鵁 gV6xMc1ۘe| Ʒj^L -ǕW.vOQzUsi;VA":jߞAAG|#w_,~~_;姾ZOjcc[c-o>ￇ~Ȁ+ T~" -*ak.,/`rj׆5gpn_` x -p6 -)%IHcp)8 g<9P _%!j,,ȄlȅE`~X#qN)8^eB -b0}30nC` fa6 c4-C v}eǙpTTЌ8 gcЊa`!.O~.nP U;}vnOibvC0;Žc8;NS/ `gYVα._ -ʮ o uvde+gYTVɪ]vUv=`=bY{S=g {ɜ51I 1"ғH <ɋɇ|H~Om()LԖ -$BfPG\KS rDV -ԅԍS8EݓHM}MQ_G_xK %CoQ,QKmHh0 n  a4Fл@#i%qb8@U-VX)Vw{bX#ޗI/AtX:"IǥIsKx&DD3]"wĩBFf. s83!8 NvۥHp wBp) 8(k)+]v{ao}8`CqqHq q8'Ddi8g=+e98|\ z,2\+p%ո:\p#nX܌[p+nw.S|KCh( [3FP Q4XGiMI4TF);4#F?LE'Csiͧb9uH ܦ%rZA+i5z@ifS05M-ij:gƦijTMUK;Nn{螺辺zzA#tGzjqz'Iziz3,=[zz^KRL/+JVQoұzb2LsDimژGybgigzN]+uԃzR/M}/4 CǐO!i `,W${ V*a 6&2MV( `;쀝 v `?8(#pqp)8 "p2\U5!uI ) -i)܍{p/x x1G>(@E(GeUVM*HeW*Dy*ʩr*ʫ*T*\E*ڥ*J:ʪrc[x3_7|Yp!q1p)q#.܄r3n-s9\pp.:\+pu7܆;p}x<'sx/7ޡ6"VX .*у^(hЇ~X&` a0`(a8F`$Fa48u0b&b=LdLTiY 0s!a>`!a1`)a#,b3l-=l!51~g9~_WΞaϴgٳ9\l#vb7='b?p 8h#n1@[>O3/+htN@Wݡ^@_a A0PaQ0XaLI0TāY0\a,E5,%PKa,VjXka 6Va?S&0#p$88p"N843p&r:\˵]pѭVvF.?1>',n[{4u^`[5:jMvhƺqnmuαs^r^+y57Fěy omwNŻy>r+s\1W5s07-:IYOEoΤt:D st?܆]~PGt[sRs\t eTuxY*d^l/+쥲Z6F$elm]vNݲG>ºkXsnva}8EnnyOIg Ewp'y')_y &B6Ch:K3;|^ė`Xq1 '/%|9_}rWK@'l_7-{j^*Wu8 'tsq*z0q`!ze3p&p6*<|…6p1."\Ÿ Kp9@b> P>}YW*)?)G1rB9RN+g9rAHF;juB]._7 |(Kw.܍*q}?׎|ѱ'WO-I壄$${O$Og3A1{҆%?iG$Fx6@l| &6D %X| #O¬#T6tWk(ߔ?oY|KMl/&˵lr_撿dn,˕TE7|ҕM#I|WD/'ߗ!Dn tsJo4t CáGba#ᙀB~ȍ#B\Qa;\?@4]%Y^9Hzb_2Be^;IQp.ß_oDV1W-=RoI `!lAÍki탓yO5̇ōiVBID.b:CL8`\J#~*l% mMiy8Sx/k"͠!!=@4DJ:O a#{ĩH1"JfU---?mY(L R.E1@J NVC!{lKL B@dzʄblgV1ѣFH 2tAO~~}\Ru3 O:>>>]6c,ZOuDn&Aw)N8l^5RfY1$d1IrhR#U@CJSJ|\%] OPM8` 1v{.Y$w -a2԰"v=!&C3J 6& &$g:ԎN瓜P%5.>bU!*E32H(Q\ T)^Pڤ fv9 1yfPDzӺPDMFї#Ƞv8,fKN0 -bY~I?D -az"|\sצ R*&$Hr0PS\!!*eQ[0)nJ5 -ǝPB ,=#[Vb -ZA%h+0\u ljISDrBF,SAmSch=!g+4jSĨn64, Nnb1wq'RQ] ՞a|gAPz\^e[;kZ.Tejc8~ޗw{wxuw_+SbAb MA!&HZ@h"+ -& mF-)(R(E9vڪ=˳;<|c`j208^FD-/2) =[4U -C>_aWK^!>bfA2[`f-ڨD%4 }Q惊R^*(Hl -Hf[m c ,Fe"AƢ`Hk/FahxamӞu*ڢ\@z"˓+y-)L> W5CS\ڔ6JFo,;$K+TRhrCZdQSL1nKWE*JP0Y'*&&^d#vIÍ08)/k걊/m]l0Gx3_ -h䄿KZR2KJԙ0H=6F*K*Tpk}]$٦.25</_rhk|{GJfsfg杻NnHUZG$)iHRF;eWUո*JD~* 5۰j$fD.9)/]gi)gzuoZm}]wkOao=ws:׹[֡ A-rcy(9f3(ށ瀊1ͥӉt($ǠB[qiz` wfAP|xKaV0wCcuKen՝tSnسf)M$Vp.7YLvápzVe[#C zofG}YӱQvp‡R -jCb*я (7WQ0X^zXت7bpT<F}ؑPj!!4 -BpJp&4K͛rqM.Y7P.8 )b W]}}Z:' -}8t3?ل/YlՍ]ν~V;>Y`^moyosE"B-ZƲ BSʀ;F*\J'i. 5w2vdLI,RZ $ڬ5ƺ1w2ܻeG]>@uJ߾?{D 3G43d9H *yޢ(AvN.]xPQ4 R}G slߺԉ=c3Y"*`Fj},8O2>|rY|Q&6stH $T Pƽބca(8\$FMh(jm Ldȹm"vs_Z9~Vn/n?сM$HF9uzyd  `;@ r%e^Ճ=Gt* MEH)Be9-kA.mW0}Ľ{ֵsn_̃șwo|Pnתfvh609xɠ 1 -!\-WȆ# -z޹l$;< iINڸ<ǀǓ1PalɶDQ-a+|},.? YVme۱ ZtDDDPt!ƴhL0Xlj4R'uMC:Fʹ~.U2s<޽|sتmoUϞjCkӚ72$yGӒ|͛mpކļDN! N{wOLD5BgKiɾi@FiVhS+o@C{@!fɋC -s|㿝-:SWH1;xu(`4Ci:n-v5J9wt^%rʹu{ʒ5K{(j)[3?j#ٍ,{ D;p셣& 9l(7~VՃK}NEYa-:" h~rd)y ~z#J]1gf3?)- Xr H, -dD { 7. :G3FxFS䊠INz4PϤLR>+ÝSw&=d%It"Ϥx}ftHgωEg?[wju]Oyz{?鱲EHz=V #Sv癈$ -x0'<[SV?׭5:03N[mB_8W/Dț܌AM-RR x$+-l.fD+kVbZʭfenΫcƠŌh`Lń76:m;v/<w-:}Y|rͩn\)e(. w|BOEX[@[*sf1v=rQO[gY k.@YB{ ii>*1l'e,/>T0T7b8wG de[ !-E(cR)R7(_F$*}bkY^lR{nиy5H/[ tnpIloʄsg֧7[y?:οb W-گ>!j+nR*=6m$Tdr 3ѫs#ǰ ) H-d|\H)N!Z`of y*Г 9jb j56QjV bUTX{樽4?͙qy(ٜ@:iֱ|jṞdKinCiGqjELEVU.Fur&YZ5UE~\$mt]$8t9qC8nYG,_},Pdw d -ua -Z삼j*jQ)4Ǵl9"rAcLsݰWGλ& ~ǂsr =j>LrԥvSTdWՂX.GkiT`jbx8?v#\ -YFs!+,֑w<s6rX8~2D@-[*7D.B>|>Ec-& &,ۨ@dihm/DXb2n#z~ϸqYo1֠6zf T!#LML>ԂuUF]>pFq/hj mQ#1׫/ܓ1x?Q'*`qEqkM5%{ -jh%V&ZY\9c~f}C+JRY"_,xn^o'1s_|ŜMe/_'Ah߆>\21hnho~o>jEM1|(kg0={GCgT1ٮ^Hb3]\>@GΛg#FGu(7k|ֵ1ق|g8Γ%gZJ46x>H5sՌs?wE} mUR7r6ڑCg|Mx?LSA/\5NPXs-Zk\eKU;|^~{u7UrZ1(j0_SPw;gUϡ3nF,)]!xxpϜװ\/bvvktc=H^D .P2:J. &bpzKY:6Gaذh} .{[Yt9;q|8c޻ĻLJkR4`J5;C5l3vm[I8YsY쫚TG' 6JU 2hvfʎƹK]Alj͗ϯjr&?#%OynDӠ7=AʑC!g΂f Nj-ox,<Apʷ`#7ς-`}A K̩p tPsО@W@fl5Sr8^0=g92Awx}uZƽsr/wz~Υמz8]8x>βpGtk6-۝_ w8A?j_t~C|ʾtM\Q淙=ΓtEwѪ/1Bџܟ7oCh6բW' Foϋ{c/l WP`#?5t8yph_ ~mss|aߗh>L>X?Q&쟅.ZW(mU|7NKA9Sls|iPDk>ݚM <^i [' M r.zoTyky'JNə}v^ ~P:E[.(1Xnh.5ro-^?eS;-Mh<:x5Lol.cv_N4^cF͋)q_.ԊOq3 ռnե5Ue9.ׇ=anhcyj3$gww,'nš6[MM_BLU_th? ]V"do2Z fb3m>w爇%W5l,tJSVӤ_NSnU_/e5٢z4^&NȥWP[k6{f׼Xq'ߔ^.Ns˧Ш%R>M@/Y_iy;Xivjײ67R"yչy4_3"/יZI|ȝ۳ܵXb?*FɅLub%i#fRQj]ŦG:ejtwtH8Ϡdj{fゼc?N<.CUM6p+XOуHU^ 1eۋXSvmkC͕Ⱦye,nYH.]Ha?77؇RĂ^(kn玗d"uYjVgZu_oo3S&3Ry,'&tViӓ+} ~vC\{ -_\9j<5bܑ4 n'la 7r^y't`oNJ\ r}=4}=k,vc>6wy搳^sL vԸ -2Ϊ{}YDY#5օ)FȄ(0ZͰ2Z !MhVw;ET`+JU*^X{}J_o;Zqv u}3M"g\<&9m>1"Nj1tjJ: 5/l{l~ -s}}4tVg3c*gY|.3t>/H >rɭ6_-9A9B']*r1e4q4`vF{ KId4ɚSMDV\m+e@İ-jx@ێ{TE){)߼XcJm 6)X/q2W+<+R7dg,l͜"6;>ɪU'~:k?78Ρ}Rʐ+3N^ _&v{9סU}:L)FS2'>C?oJگPs_A|EhJ)NlNF;"$b..5k̤zbڞ3NT6AjTn{fThX/5m!=U#9/q?|< ZߥYJq*)fWl;CIWڕz7h?36;IM!k>9 F!(eؼ*f9 -;4,!Kyi]rbiU3@zP>$WF[PI]|/Y:{(5*&=#rq Hsk{yDf=6sB"{:ɜkYƁ[Ͳ@LO#. -hZIIv^=UD}2ýC~w 7]x\,'x ?:wA?tf:<, i %+kttҶɻ)G}tM UiA9Gk~oq3`k:;ߜH)JTuwN/.m2(9f,vJ=zZ7/KgbsdS)2ЬZs\h#5ljKYϔ5Ɵ\gL#YA_ u+'ZYqMf=+=nGdñ~P5u%v Rxk#4Xz tՌ`R8k[oy^TS}Яcy٧γ dK%otOlBJl˼fhIOB>#VJ͌? ]MSAjhh nI/{iܥ"c~ ۙ_&~ -`Δ +q]ãDln"7vN~OS"ZewAv" o#o_&EĀ_͑ҜdL u~x{o b|ߝMacLs+˙X+_K͟R.{䀍R*KTv?F|[)V,t&f1ydݹ۠gI|ayd#[eLKQ+7w MM[* C3d:t9^+; #5Ƌdrzic`)(͑`(U`;FCI׶{ꎉ],C#~ity 4) %չ8 穕ec)Ɖ") )Jw-ٵVcgEYf:bFK&IPUh$/bO"E+GI%auM"/1/3o8ʾ$:|1r]oJڭ<&euJ\m2PɵV/1O@KjLo*3ʧ^cNcmgs:#ج[L#~n&b~Y`nL&\$/>G%bI& ($HwW(Ԫd5J6ږyR;:> SȷDz=L n)24}j*$[$s x=k.C'WdX -#YfXeUFV0j1gۍ5,QфmR3nBZtZM,+{lvbb`O-{+юrVAwVGn9loOTS8G%L4 Wҭ?3ډ9_Yw (^6{%s˹,/:~zD_Wh_4\T/!r8d;SjkAk|mx#׃FglRv,FwGnFtZsPãS^M}t$zh"t }ykǽvc(;3p&Bקv<]?nlG/:nNp"qHݚso8 X;vHmIQh>Q/3|}^6Znqb/NQֳU|Q\i}iыRhG eX#J'i_`WD:moTlÅ2J\늘+ixzO1 +v(kuc%yUy;1>Y7*:. -x]̙2'&W -TYtj V+!.ȃTHhE֨@KXmҭЍ sI39Ȅb ט)TfȇdSG.>M WR OXEgk|݁r -`u4KtY7=JYiPH]؏y - u9>*G Oa2->,%3[ C:V%%2`O`>'+alq -?9 XqV'zC<|,󴹃1W6=aa8޴jm [W芖DBJ&xma -ƒE~JnTĩ^s`<5)icLN<}Xgu5ۛG8EG沷ӮkU#Mka[mȉ5庱|}ZnG1w! X;qa>kh6Wq> _>sq5O7zK)]z -vs[䳔l0] -nJb](n`ѷq_.}/+t -dN`&g9q#VVRXBهxRb?߬/P{r?_+I6ʕN`-'|J2Ĺ6e.ޫ—7#xl$QCӑWͳǴCoSwp}ݖs8Pʓ{~i~ш;C[2 V=P/#ƞbl>.&b]BXTr50B02}9JD*Pu{~x16[:ͽi`Oj/Zj%JIJÍ/(hź}x+Uꧥk:vY|LIw`Ӱ#uat13j_0pn ~ JG~9؇f;뢙7~KL;nTl؏$'U -+ pgݓ^O)-GEP&lQGkMęy 59[.SRĉ̹>Cel+-UQ/PS\X,b_֔JdȐӇR=aw!Ew{,]y98M{b$%y -Wc$p \q (@ @ @ @ @ @ @ @ @ (!闔M=d%R(vIWb%;m7k"PdrZ\V!.Slh'\fqY@UaYqJ-GWpmsx͍NE?LEs!=JZZzjn!hCjS@eStT{f+:O\g,b+S90-4 -!7g O3א>_d|K5h3{q5@g̍q{Y5ۛ1okQo@Wo ,yh zO`%ʠr);?z̸Ϣغmw̿-(6lD،iiGضqX_"\ un:}8>ʳ+xUVǝ^ciqDr(//C?_pf:+:%+~eP>up`hG2O4X/EX3U5czV۬0PY1N؎`Ao+?_)G/Zdۓ6{k۝r_0AWOӫVsWxfrOzV*K] -Kϣ~K]6wnWVC6LM`Wwvʽ<s=oxRxܳ=|mG<4ÓU`%$Cl)fw#[c#]",9`$y+r=bIVE^*3ٕ;ٝfl= r4sM'd'Y5a9)6{C&9d &9T9#-/KsrΑeֱNOgi@N`R`b ;0! d<Ԁ;` 9@LK QPKç <+gi4\4 0웙 -endstream endobj 275 0 obj <> endobj 288 0 obj <>stream -H{tWǿ޳{9Y#y؈wJ*HUTy=X99ZؾN{'nHz֤}y@ h䴔 ^d)=hS*w;` @r险)T2,~ffwd6#%#-2P?=+sVsxh7]iY-c\ -[XVQg^:_uBztza3$ I#4Mt6qc8y*;t: txk6ɞ$7AE2q"\}~~~;ox^y\ohkp'ʷӔi5=ttu{^Q*VW"{}3ZЭ'5T&#uPݯUKkjZ:4uպk8m6^jikl3-0syy9ӼʼEg1X,KkjttX-)4K]uu A!Qi9kUXJXjXzXf.HgTPT]~ZUsO`cq&G{(Gt6H yZ'2^`hgL6V -ESTV%WI~U_rb/;_WRPjjxuz@I^W4H~h+ӲmV_` $syyy |$KMLlW`7AKk7˄H4+wv%v_}q\c]Sl3Mrqs>rV9B\ii)ϔ)YNpJMަsg*?MeĶ ~>ǯFffٲmYL [mmmm-6і*OrWU2ihi5zunLW6nGu@T^{J7Uw(]jU wוNUK\je~en,ZNk《nݸݜ-_Q^]^Qjwi+wL xwX$`>4zj rh}[[Lvc-ԁFᴈi1K|C):QgD-Es'/ZC߈C[^FASGŏ'qL'IqJgt 8'yqAⒸ,%~WU]?]qM"RqCrQ!*MUZԈ[ⶸ#~w=Q+N<M<ODx*Q4 p2Xzl`#+lb7vgVþ­ Pn*klf eVJZE[9ù#Gp']8 UA܍8_ܓ{qo]]3]rxN0q_yAr]ʉ<_y'PxcaXao-mrB9RN+g9X9\PJ%'1G-oX7p<Ϲy_sgM WoW[#fijkgDDDDDDH""b " TUz"=Sǡ8 p48p2N8 p68\?.\yZ+0SPZ< 5kqH&1q [0 b2`*n4܎w.̰:Yi&͢4> -\p -*5(vn=al<a1Yfg}a_!9,GrBN)9-g䬜rA.%,W\rCn--wl{>z8=DtGzz'z:AO =Sҳ=W'ya/CԏHh0J(Ih44Hh2M@h:͠4fK4h>-Lh1- -ZIh5S -m6Jh;vKh?t:J8tN:K<]t.J:ݠtnD?ҟ/7H3SeReS;20rG21(kစ-w]qA8paqQ8XqNI -= ]+tzB/ }/0  q000F( c`,0&$ S`*$43`&̂0B"̃$ `!$"X K`),V*X k`-`#lͰ6;`'ݰ+ܕ8.}y %' 8 p60 \ɸERQS -)¦2*|omǘN|9hvN;g*sʹŗu'IVETQULW%TI%mې/1RjN 7f[yoӭûx7ὼ>ȇ0| ;7-g=iO=KOw 3B;?_JܙpWƴUUGQ{2P`UJ8"CepwMq7+dL2I&* Rt!3epTe|EUsMfsNEk:ˉ/l_k~o?gN T l^OjY9ʑDO =2 ;G\AH%$,J_BWkp+K t{:,e 1X,,![ +dlj':%@kILLdN -کM4 L'ɔNI2œLSܳ+{Gs==( Yl6þJ]l.S<6-` ʂlbVV*RVB-c5l9[fl%[V5ճ5ul=t500EY38Fq8Vg-~66ΒP -w\P`̇T"XKNŶdiz6X eP/%xY8l;v ˲^RT2ZX `5:X a#4A"`@!q hV mItBl`B^pơzNrbww7%MDmW6;`'d v×anOG| %_???C<:dO\I/3,=G_:N_kuDߤo[|k_ -G$"><8_o00qO 3yrz~)W~ēȁCxJ<\%EdD3YEyŋkȑ.!K<-dJC2? oz_CM"DX35 3oȧ!]Y NJG*ȰyO$VDr9,i62R^*-!_\%@{&Ӟ&?A넠O~D_d'#ar!=("^BɁ&'ZQM^s"nS&&$AȌIqRBSxDSG'#ZZμՙB0ΩӪ>8`<İC$'J8p+P^p& -!"^-ީIӈ(`:~-H gL':hihf>/EY &/ZW>^)y?iWQ$RZ ގ6qvMQN)waD1זԨýЬ,[Cbt£<҅[v$8${L*YgS%k`Z09`NȨNzQI3/W9N4wel).2u뒋ɗRz!]. PM. G76DS4" XdEa|%?OE>K}Hi׳B@+N8A0y2$ge^Cg'zM5#DNڋ -2.Sú3Űgtff/r`y)=F|n(?x)m#)>3`! /(J q .4 -*rrzemGu!ܦ-K:grKyf}hĩ4lgcqQZe Ӳ:Cs~*xp˪?=#LahU( a-ьMH+ -k9I.[Xsk亳 Z_ѻt[_^]S&UkW#ΡpuRUF5-Ukq(v$_^ +xMJK)}l%I406g 2T+K1K*bC($7 Xc!Kbj+U=;_WXn.hLӈ8_]KLC&5*ܠ'5sx.I}hQe"<"Lb$,?BRQOܢ;K(Wu8*T6&Rf34(cQ!Ar{<@0S9pO_ݹ޻Ʀ} ljʛxjl߃>n+\tvʿT5_ȎTSa5!B4x|I%ɖ9NJ?VxfL[ƨ$jr8iمo% 'N̝$?NO{ۦ;cNEubR61BJP=ifOy"#4GE _ajoCڑHߚK=O\{qݺ7=bR9{;/,]|6zOG2ӛj~x~ޛ;><34,ȁd_apPEHbH#Zae2?>)^zty锵_;O5=QF݉l.,} 04Yu G|"3-. l ,lV6BZ>2nt0󺝡VK$ \, [p59uZnmޚԼ kw{q/qsc͞)LFRNՒֽ?Q׏|j_&Pp{Mf]=y3f5&8)NKN{zj7yƷLB*ԓDCA3T8[WsbIhw(z }4r2z2d쁆7>O7%'q3&xEq{x)'wrK]^wCC@DEi=c5Z3jikRGJ#:֩&5vL:4mt҉LZmrK{ -qp~~?/-)Rta1dIM"%oSߋ\$efT(4$(iK$dW=8yZZC~r81/N#war p -=-@+i|q*辘0˅IW8'ͨDda2q(xcpOgוm[ݿ)G{.u?/8YX]DtÅ,@! KY_`HG ^K(iϞz-g?o EeeδE]%-]{n5o.شؑ5+6gf6*Q^ŋy9Ƃa z|~8C >näa[GjW9z5'8O+q?kv+?uh::RUb8mI @sqp,.R0شT\VAS -t)lF`mƂ=#(`p-!\ofxY[Yg/c{ArqC]K{u3hFe֘L`#!)4eo+%$2݃Owq?>]>73WsXX}YzZⲞ*}uĖKzjXfSle!HIxMڣbVKZVaJ &>*%+Z*K{vmvv4^sMGfp@`ngNX9RV9Y@˴ +j]H -]j@#MTB-fO9զ=<<x+ޤMvpf PSCJt)ɣΡkzA`< \x=y*{Px9 -v-VҤ*(T0đReh" +?fMqzȫcn9 ~#݀p <I+S;?Kc\bXt{bTTDư&Ĥ+1 -p^mHFl!B3Hb"@ԩ9e*_Vc x[2uf=kjUN˨Zנ|g9{rB΂|Cp{U\/`UzYM,󳬒osuP+SB:Ѳ$|/"JŤDz *bŤ=IN$q.PMm5W={`ZSٞ+]{K_ھrwmǛnZշ ȆיjvfTg-/:s*8sM058"0ᔠ/zQYDhbg:!CO~<,ϙܶ wDo-I}L^Ibw2srƖ{Хt!C{F;xhNm-1/s3M9vv9"3.i$f<|!bZ->]*l.9JL)sIYiɦ؜EE%IyPyxwsf%$ԘRϯ<|"\Y)ȤǐhhwӺaMRÍ? 9*׭J@@;“Oڃ{N_ɜAN1$X+9W _QiR<~R@ __x:/_vUł6#.۔S(AhAw KRFtȺ?^/`X Ik0J=P d$:0/t(!0NI+N$|!i+ozI9?jB&G,LJlPܳӢȱnm0C-Z gHzZ4ja0bfʋ3 t垲sN2F̫K]U(J!Gʏ'cbga -ڈ{h%f@U:yk+}09͵.gr)7yOgJw=AP8vְ)e+;# Xi ZY$%QaHXN[A;,NFBRPBwkx/$tosϹog%5˪92ʀefܯCnKlDVuB -uyP,'9}ϭ}h$cyC?#ю%̗PKwFT[&{w!ȷ ޅ*GwL1jk>PO; Wfj5ZD-E28j(Mg0uBrjDk\b)0Ϲ+js̳U{1X䣖.8=xCj`'Ƌޢs_dFİ(Bw8G|-<;h,v"YNG/.ԇk!Tkn1eMau9#c~Z{vya?a_tbUtb|K-A]j]2p~s9Z7~Y!\?$>~/(g᳀ܺ%n"C9]נ=cd8RuݬI93m[YO@CJ(с>.~fl4z>ks/0f̹oӿn2zү"sjd|أ˅~+>G7Ƥą+#0FM6hlp`M̋1#t`ZL.D=8M19 b-?֗9oNa} -s|IU Ù-2?e?crY/|~N[֑&6Ϯ1k=Y[㱰&h/dCԧx[_)(ikv[{O'soIΑ5c;ixӮC9u]2Ϣ7Yr؝y9dY{@7S(E3&s2fr9T}sY,H}wy5#Sõ}^;) ~m Dl bEn+C3{I&qBߐXS﹨f_15" n -y_o:N`J6dy/y){؈(uWbl)k%vs-Q%Sq\7{-\.u'DwˑD|ɡNo1';vI #">D{ae~L>}||T!׼{dFksJ{߆UqLm^Gj_4# ǠGj_l4s.'@'wR#6"oC}Wr8074Пgly8eO iDujǰ_L_mr쯥ǭnE%m&_7_ٯa3o9[GGstͫDW=H,y*.׳TUHo{ &_}TOan!zI ($ -#D@jdEPԇYݭ\UnVWDqCޮ##\|~}G>{"eUZAE0Q}7B8bt%p^."R+}( m>PG]=bG.Գ5縗8D grȜKS݄iJPn/] <5b=*}G_o""w$cD*/"nJ0r7G=bC `u9hɟB U>FFUv(e惲]eC%uwfrL/l -8t|S`SXJ37TǙ2:ۘJa1W>&b礪mD`Lr5nϡ u̟-vԮqH~>vO5R_BZ)޲|XF˽߶3Y0{"N<2?oN6b:jHq#Q%(b:=P^'H\]%(zJOoΞ '8=gp'tg{ j}L nN&}vX`]C\ͻg+ile-P`~ z{0u4kUEPwXT5+^-Z;ˌ]7}flA۲?oj8ޥ:cJ~Wu7^ao8{b -&B$$@j#a eeX@q:Z7P(bDHle@Z*0CLKi-#T(sŏOôo?~w߹vEfdckx!:!~QGkPiiL=j7.!rLK?NbT&-'MJr;?kl!nAi${W̲u"꽭$/v60[8aҟ~9=h!9j{B232l!UZ~VGo7H,qL~]]ZzuWVJQz&[2n>W_MRD})J$>旒v_`.ܓ2x:^|9*ڭr{KNՌͯ{RX!ȧ]/?FM>zt {}|CA/rNK:laק<N#;u<\铒گ1` Y4JESLjvKi=ۻgcGL/ j:֘%\lgȔ=a1{_JfjȍIRvpfBi[q/}\8DHrrHCTýtkJȋYթ@.(^JxT+hWoPߦIUK2enVx;#nwn/oyw+x=ulsHꛠz^v)6wLdg.3V߄/^/5 PyY&WY|L0"W|5gGs]3|ӆ,mx&?e12̴̏C/uۂnDkԽԳmI0L&:&?>%wlŹ>+qy1;r`Ė <$FJ.h\ ߨKdUbgOr-ޣ8U{'K_ǹHJܗ{OD6ݎ;VD5(nm娍졊v -S/yѿz[wc>˚Rg%MO8.<.R2~q_jsg,Q Vn!qw ;naJ St۟i8<^OҎǷ{ep&̒73+S`R|oI }i7_|It$gTOa՘ kyF.NXcw[Rg Ȃ."Eq7'#5T~KRGN,yO=gUٳ"yC;QjF-̷%Dz@J# ̕#wgu\]oΝCnEF9>͹$HW+ W-m05|Gj;yTji*;XP@G=DF8M. -u)7a/A5N^zolmƵgOޫ!l\(^HRJ#r#"|Sm+O+[&]ڤMLӛ wqRo^R6#.4FnSC00Xul[426H!'iǑw34'2h?EM2̇O.\ > - B -6H`n|ӶUjW=iDcزUmԎ4k؞)YlipJJ;J[r3La -zlӑ?!=v^%ݾUg_lG5uf9Sm1wi66\Hn14cOOzm1:64ڮ]ou?!MEc7՟MS}1Yp1 -c#Z=Rg|^Ը2ZS>WӰkC 4~OF_q_괯GEѲ:Mu py|mbq݋G0y0z{vIru>x ̇s^w5IRO|~W#Izyzh?EqP~\_^x ;y;lVH,,-1^?dHZ'.vPUDT61SKo!v>-}F'ɤ>:;d)w?M]H{'To'Hl)^3F2x@QՖ'~VM:jM>X˹!ZcNuiOS7I -ֳ]1 44u@# Gl -o!N{1.6jsGx:1gcznnKѳ<#FIږ8nf-]&WqGQhkƼ)z;$'\<8^<1bk7 KK^BxCa ?n ȿGiA,|;c^~tct y3L8C0Q&7E ǤҾ&Fa޷G8>w6`F{N!Q(?)u]˳Hp(01#d|Nmڮ} ]lF1rUg {qULbRe.&yX(SuGGލ3dAV jGl͚ڬ&z}b6!t66\2|xk2l\7e(ΪGO37~f\1ȿF1jEƖI0|gs(9I|Fo>1>p݌b"ęyU_AoSIq"=jmD w pi6NtaS.r vͱ߮dr>jY䢟0AP?hy2k>Ȟ%^yλ^8C,oaA,&F6v -':5IJ05k #zMU]jzzs;t\3>N8) -{oT-r(`>94$쇊VsL3==ғq=UݪAUultwNwIs֩5ǩu>WAm @~OqB-y廼(u7O ꡱq(;DT!AAsݱD&zzo㤷§|˨^DZPu#L<>KNy:9'aEO7_F.f/'eߛ&6\ӏ*10E!!dJa[RV~-F/P YW]- 7Tt`g)G-+gi~Wʣ8a8 -Zvs` uZh͗spu; -.a|% 7~v⿤ t=hܧ$R$ CIb,ki$-AⒺt46|Q&TV$GTְFmS֚SJf*whֵs;y{kAlQ!OlI(x{ntfDfjX+clqLIU`7Z~̗S`5{i-#IX jݝ95&H6>_5a+gQB@/[%)A+^vy|E~1RD_Abٜs[˩O¤3]Ub[W͇x+[I{k|[l RBbSpoR$ /@נmS\{Xke>ȷ )^k -g{Z=$q(R~1UsV( -F2d9r"rPg!΍jX·P>gxO7>Df JKO*}r_N=̉`LBfq_eG΂ elkncG(kzF%{QWS>9ߓb?r(Br5[jOWϼ) $Ж[*h@Z~׭\Z/Y;ÃP yv1ڷv ;X;F넬[!f69ė"e.Y'*dkX ("";i'eJW6 >UI.2e"~ [feQ2ږAŶFl3KiQlɏ\CԷ#ېe Rջ^u݌5ސv0V=xa y+_k>M4ZkqĴVXv4D*,C2.-}zyN⌰{"j|&BgA>9%v*0ʉWnLZGa H.K,G>U9~{ɽ^ڑێ3j[.Sw)MJ rBvZ!w9ߝ0YTr4?ʤ5qhzR;yA9G5 >;}o~Fk;Iߗۡސ K'XN0[fۙY,NTs{s8Œo<-Ut4YtX҃qnzq,`^$5¿N\ςpM4>ID`S mJ2V{Rn_O~U?x_uKXcO9Ԣ_n3x>WDJ#D>71g"7{FGDZ Q'Kiմd%.pHd6qKBu,b@JUN2Q#Bц!f ^z my_3 7J!~ 0> endobj 289 0 obj <>stream -HiTW~)A FԈD Ҡ(BD\FQ'1ccFk%"B(=g>w^ԭ׀@Ic'uAt8s h4#rnNnq7;s%,h -5k4k55z}ZC jm!tu.f&Yj]\ݚq=yvӏӟП;+}y(O'Siy\&_+&E+VJ2LIVruR7ߠ } c acFTAժMF}j69ی{_ˌg׌uipsžȮ^tӒJ.qIim[mmњfbdϳ6TXH\AdJ@t_ P1I,.\\%T \8A[L(Tv`U><Br#䤗e|E)7ˏ#( NW,J^) A0ѐd6,2'B0ENظiN*' s=S"`'|+J<N[?N06Ԗ`:-s Z`x䨁v:G!vÝsD\?Z4VtBD!v@kO>\m-ηγZ-Vu5ǚemeͰ3iUEΪU\@Uտ'[ f=7^Prc}ʵ%z2Uw֬pFkj kTզWLrz1șF5<;^l}~~֋S޼6A>%|w7v1m c~Ab=j0>cVkq-nWïyoZ;#^Ŀ1ޱ/m6ڹ)g~OW:^>;a%`#܁"a7a|D&M& -{#Sp>`&t8 AKq/`BCi PMoI-M4R'Ƌ{bhk:xWFT*~Je1tB:)NKgDwh -`J09sg|ăӲ]v$x-]K(ŵVZ]kd;l#vb7='b?p 80#p$88`"N2+432˫lsq^IzZq .eWJ\q u7F܄q nmwNSԠA4PFiQ4XGiMI4TFҌ f4~4_PU -V!*Tp"U!UXQEU1U\T%TIUJVe>UVWTyUAUTU%U31 omxx+>w >g_K| w;?G)d MH*I C::|*Yܔ)/| -PAuB:PS:.PSER!*LE(,S gD%s9(4TSH2U}IE_ReN5&EQ4P-Mu.գyG (VU&ܤԈSSJHͨ9ԊZSItɐLu6̆ƹn7m&!n3?G#ENϝbc6'l=iO=kh/T{^W5{ް7mM6f[MMmmfc[ֶmkl{vͶIRS$Zb( - -J7ԖZRGJ=/ $V|_/ΖLH60圜}p es.A!aV _/ qa.E\Kqi.e -\+qexHK)-ZJ(S -ʣOTHETL%TJeTNTIUTM5TKh5Hh3mIh7:H0t :I4Kg=:K<]t~Cow]#=>O -]k)}FOg =g^KzE e; \21s=܀=nȊ5܈sn͸9܊[sn=w`?܉3rݸ; 0(܋c7r܏9ȃx0<)_N\=7G 6܁g =!<3x/%ޢDu$d]X QFaclM6[aklm;av@]v=1{a Xqa<&`q!8p#q18xqN)8t3q9NYq:00S0030p."\Kp).l\nin;3&$ S`*L0f, s  R  2 `.̃"X K`),lX9 + VB>@!A1@)A9T@%TA5@-հ:X`#lͰ6;`'ݰ> p: p 8 ങafYfc1sqJ,",,2, -*UZo][ǭ뾣]r?+|m -'www;ʗ}ž}n[w͉qzN*s6(W6y]^t"#|q>'w g1OST^ȧ鼈3,>s<>|!_KJ _W5|-_S};MﲉO,Ezl@dY+&ư6D!J&;.$U "1XvT1TL`SJ1$&27eސAGb}&+beUqG1q*TP[8#Reն~ <"V`%^X_Wxy] .`Љ -A/.8oT'Q-^99le-1XKba[EX~,e*C!0u55p0 ǛxCU}(S2hθzE3){-%kffJ9(Z3hL*Gâ-CrTcVr\gDk,bq#&/:('Ӭ訜MtVNgXSR)9E<ϚΞPKefW(_*_'/j*s,r5K*_«٬,^bˬwR&|LJ:+?(?2nbfA~C$\eZoE!2P&fE{Dv)\rP]R:~PtO*:}lȽ^uFGB3US Ut>L vPjt"1nDdB)b(ҝ =iW( l3h< i?pʧ%9X! :*LMZoQ|A& !A^TzW!kg&7@h!w -s5~z_o_(aIL*=G#zD4B( @hkRg{<19t#gH]3ƨyNp̡*t2Sf |!Fz}zzLѽ[<3;u|SI۵MlӺU ͝O:O4{I|cYQZ LiA[]xWjt:v՘y -pZԘD0]!%٫&>lF'o:ȹV sV=K>jᰩQ K#~<[$M/%^zfw_ޟʎ`f1ޕ5K*4n$S!UmH@Ef$UgP5O\BsHN?"ϩڈ:{`ґtu 7a@DA' 4ů:cw]2@1Q׭|5e\1Ti^S./_vZRԂ)>كmefh;!5GANpfMdkҝݹk9;S? ю.ǙJ:uTI[$&23Eqyv5kW }Z!#V$K[4#I糫 ͯ={0<#uk}6aDFO՚Hwǝt/H'&:a_CO'IQ_OuǥdEȊVLzDuٚIzy'SAؘN{@AjM4;v]w-{5Vg!>}=(+|<ֻ;]w f8^kcP<1xy8ll]ȒȤ!P\jTU6mqVi۔$P[$ܢUSD4%Q*J3;j=sgkHR#aRcCqܽVoօ-JYCϖK ]1J3\:W_xISy[)FL2[vWKc+dcT$g𿙽>ÊǺ>+)7IӳD/ -tQ'sݚua|F{j -xoKR)ꡗ-vPmYisW$˥e,˖{ Uz.Eޝv!betǶxf,h"}m YUVL[ܒmJ pvYq;Yb&jIϐK]J]hW}mŭ. 䵕ŭD{2mѼƱkIcXݶx-#9/J]Etr^{tG[x/])4w5_UYo3w,FB젠ӥݧZȄ'pjhƂS{rxWOf9{3=w^griII ݯtp灹:yS*5YCPX˻+IW~f᷂̅8mH5 X؜ !f]z&gV1;v{rs2{>gJ"~e]y(ăLfJLO5j6A ϪXҒ/= -H*Ґ=ǝ[))}Wxco0%2jNq%lOHl (1[p1.Vs1&>I -C_`R{$ Ä\\I8M4Âa=fedZ[LPU`BYDah4)L28}3g|kF̣s9sǹ\d7fqcfXUD(<Ϗ -GO'sD\ȕzn " j'mBJ6-NMoYlm! *ԛ0}uN_3$a9qz9|E>4ʭ,"2,"݇x|f/AqE9Ӆ?c!_Ar8x - -+WxS -#xt@#8r0L9uއ_nNQ~q.:?r6\vP!qk Ȣek]\dAf,\yVQ(U -* -HHFB[I*^ThjJ]S6a9pO7|eulz~{o}rf`\`F^HΞS 1.q3).`Lʮ0t!N[3g0P 28X4YXE[Ju0|mү7yŒؗi,vNEFP-$@ 4/#֜SejWZh2k{ 1 &i;vݍdFA~TAH̙ "%l<۞]s/v+:m<ᙝu̚?zIA:*{$Q!D3PH`8``FmF`ۇYЇZ)|!X0sj,E)~2ģjhdcd T`^|8ƟV {7zuٞ=zz]m>zsi^Ju1fS -t E{PqiԮ.I墐0R3Et;0-fS1 I793Z `  nHFд'q-5w^={}͏?:4s_5#fZs}M v9q}dA;lZ7@Ŏvcӭv1 7\OTLcxhc:J]fd>ذzB݃M˻~n_ЙryT+T=kC7@AG->U 6Qz[\YU]:R~OR|EFo9YL"I[cɓʈR]g[Ee,}6kN(J -jkڃjA`q$ݧ2zYo5Џtm|x2. +/tF!)BĴF(\ %Fy'|9,ݕ{ZV(;~MVg;桞Db2J:7" TRxA^Ёt5klh&!rKogYcjZ2>b+,ͣ(|CGiep"xcEh7:_)?=;: -h~z~;@קns}9'0}_y9 0p T4loϑ~ח͈ONuljM3Bdέb,a!aRz mzsE~6֐|D3ᢑd)?#@N.\Fuy\ ,d6;pPF*^ыJOcV"_2) -4Ly'O*> -U#i7N4FD H 4n . MsFMUs09˭9_8n[XՑΛ7WO~aPݘ(,3-)#hymڦ12=a}5yxu{6<uo ꧴4ރ{Ny&yoXyѣ˲-9aʤl+ *v 2Z,-vbW;b@G)7PaeF{JйѯF9]8JJU ΛYzH]"*hUfg\(y /!,d1^x&#U3ћ|qf!`W D_ʫs{ t"TDʴ2f!%tH cYXƌqSC6a␾DDGy lk8uLgqδs}Ž~{9|waipZ*4dbo^㨹nw,rxY fY-Z9ؔf,`' ccq1UU1$}m¦Yh*eTbo63MS4f_ -_MtW*$?]ͭ?EvK񩹏Ӱ˹f}/XfQA tsFx:'Uy>33<:c'S\kM,rZR̋znڱMA9B*ฆ=,2ĿC_-;|ww^vĒ~)ojwcD)_y1|s}h"^ʒ%j7P#d:jEb2"#^/2+_06'@5HqEmQؚG鲉"K!X㺃"fpd/ϢT)5 -ịyϩ]t-{Z.) v~*8k*Ja\*E_#RHtQrJB {Y*nvȾB!/;q?^5i5AJN,%51LarVnٳI4sT]זk,"&%`}OK|O@\N;D nӐ}x.*UY㬐-u -OD~R$Zk[:)*Tb33O*5Ej|s63u x,yjFuƭ1wPCl )TB3lf9Q?hg(5x<6QEf=u4hZJ6 -{Tgt,a} <&>] Fh+|Q+Zh+c|f`|lKcc]-kcuYo8|.4*QuNb;-Pz=|=@vT!^WiǵGWqZ-sv5M m6]*{~ʄfNL~_u |%bk[TlC|Qp o_96y2F0_kO=GkqCI -z6M".08 /BjF;DOW3VsnvΘsxN`C^`?Y~AFK9<6,Z~P1Χs{Џ^zÜ"T2,V}y^VQ'x̧M/X[qVw)`7&^:i|OŒ94,o+^ JN`IIˬ:kX cםaY -}p/P1:ox>|>1O ?X7 - G}g@_η%:X=>X$/Dp/T.Tc}7:"dm\Tq.Br;TA2`ފMꌵH@לRJ7ϛxg"ӓ< $MC|El^q9~F6 ̆O>M8GqN7Q kYZQ |qX¬Lt3Ngh/uMbLIE|}8Aq<%;8gzjDV8sР HʫW40>3[y)pgFssԳ{^0\):zJSC.p}mrs8yHݓ#娯Ɲ o%>pwu -=&Y\vnkjqDNyq9QJq^\,d97^ໄ <SUgBMg5|^꤇''psD@.r>ʛ}eNc:|.Pz8vx`(x|z}.0o݇yc"v3"fӌC?B/_`糪֬?c#Kl/(vG؝ȑGZ<זWs!:CcaชO r~ZR07rts}WK<:@pttY:4L3OkZfԢL\}?zDkhiʝj v2\1\ 9jWk]{ ޝwV/6vS~hwm58>Ľ -DѫCYr-Tne -TgU2$Cw/z1v!_ 1b1uRy+~|XQg/oߠ)r-j2|w|ìt= A˔G:>{LwPoL[BEʔX0QEJeU~-JHaB7 jjE>UUVBiȐuad)fVl -FdYpC!^Ϲ/T}s999?H{Tڟo}_ՠKR#ͳQ^r~DkDԄպQ#3迣<,UIa~o:Gv?Z+ב߱6E.wÜ3ISCqȣeN}gƋt+ͭr X681=h-IF_H]_vl2y=_[7Ph>19%:(9!)h6himB_$v."[~)Wt9GS{M.ywpɾ,9b:N#g3Yu}UDI.Fi]|4{2 kė V֒YpA#9L2n{WsvpKܸ~:usg˒ [_Ɩ8J'1=xAqh8sQk7)GW{W;q5 -"6ؒ,bJ. 3oVxrXH,pg5J(ʒkR% kƨ bKDbJR4O'ciİqtC9z';yYcXB&`c.t[aN .%VZ:,OdJ^$^W8:5NdT{Q$MڃDSXfz @1wtT"G2vL}<}7ꝑTp.{g?;od%/qS{} -з;<<QB\> = -doCn?ZgV> U -?nBt] UD|+2Ba - ?>'5Ja>gJ=uliQj[6p :oF961*F`~eBJ48XC8W@a8WY@cq?a5s?wAB8=J⠿$0ǿ@V'vxy|S`cBz|boUp _r л;W x[k"N?/5~Ųٮ$\)$5k ӸE̺VPL(uz位RE.USDe#wv;cy=qthֻ}˨ G.+u=f΋C4;eOm:O^t_ O+;$\/t6{t$oc'3ºNpw$OPSTN-qaYalc=RyW\puu[OV`<㾂.㋒ gob㰗qQVgYT[$/6|w咋O/=);(ܜxWJYcrdu5WwǝY[%f@߈w7X&[0o~o7Gc'lOW #ah_2o)^e$q<֩XRcuMho2\m}\ ]PF\(? Rg.{ÿ y tZ$k00L*PYn|[VRBOZ3LB>є58mC74W2L8`;~՜> .pG&8EoW@ {-ismo2r,_!ťS1_k.OH%\ۿ=N纭}k>u[FIsVZ9D|vV٦m@_u" &gh[[wQtvE%{鼖7E4ms!l_vE5RVޗp󈑶Gۦ 'x4߆mgI_Sy=:w$Uo3: U>O}l/ps}{w_;%F=&h){J }+J'g# -`L*x߭!:R~{췋IdS!5>j{N󡴍dgC,6T{;ݥ ,11;+h:$LI/Sv\֮'Gyk?} {hL@#|)ČwƜ(nٽ&m5Tϥ4o7]jU⃳]s&$z:4xW؜(l%x!5(;ÓA,gqʆgR'w?"{m޸_qy{lk`^7HNbI$e!?V^J=e]gx|ZIɁSܣg*35U<]أH8Pj&*"Ӎ})2BX%)ӜPG'CǑ2:1=ڕCُ$~^ $5r51MC{WU\ww%Q?(J)mhC ҠQ(@b(hlSƊ0MAig UQXuƊ֎ViѾ~gｏxg9{ٽ{`9Iާ/.+)uʻVx/6 -k dqa5Lỉ)F9Ɨ(p@Zy7Ş%me7μڑIMgF#G'2'} vJߜ2 UDvd ۼlKDzȗn e;F΂?6HsWA|^oJiW'+r] ϐ]Γ]vj-?0Rlo|i7BZKRl:dMFvb/f+ '$YɪWHOuL]jWdONR07'csO|a7\2p#Wi;VOZxۍ(~K`#&J_ sY0'~wVzV:tE'75h9mGvJ)*>$yVngؙ=qvhy/dXHMM!H[ B:^M| "r ]Cӕ&>d:t&KM3W;KЍ?J9'OsN+M9]5H pg{ y',g?kE#gm3YwtMC8氯7l0+vwRHB&BM.km< )fo&)5_הx̿wI + -Fbݲp׊~~#ztA:ژ\>@ :MΞ,&!65 ;Ȗvdvh歶Kqa[2`" Q3n]0M9Eq>:o]tLs|Mg`{dH~GG:9_Yo;Ajm?ڨJ/C nڮNldw>2zKO}9>n .K,[qJ`GnoޟRH!vc'_uΝU@s>8,cb) qN;rh -oi#&q ~ -=C 3N+'.9Eۨ?o^4`k2r=vBQ|px - -wﯗ9z^ 1EMvKo& Jl AoE4ϻTmW_psxz9ۙ;&`ϛ.t.طWGeƸr'++14 o!6m.X[9vEF^${sD?OUg3;Ӷ5ƥ B>><#ϋP* ي -L -oE"{)zIȞӱy<= ,z͉hd5;YvS]Q>Z2?Qד`=|wjFA="k2{([i]ufD#G#eľ#e@. P>?ܐ -sYő<]=2wϵ%!]'Z(e|x e IjS@M0O?y(>1ⱏ6}֥ 9Xt'춬ѻ:X)ObJ♩̕IFmӐE Nj/%eyCMĻ+[iRn|*)( WЦ^~ec, P ao3y0/ye/b7˅v8o;w7}(u_w5@9&a6Q.IF˒LI#$].=ʥ_÷RZ*Edd%QG,Zg^b3HwB&,Q.DHH%R\Qm\RA_$;r6<>-5d'Eg2q.ӁAN7!MfxV?zX"̭2 Yr|4x[NA\ -=V;>$&˙_5iI\kz^鹰zɥ^oJeR6k̗}tDJ(YN$S RVT-N*ATMV+aq,2ՙUDCI¼tt˩iZa{ybZݟ{u]u_}}|{ve* XWe11{$V&OcI$ e`XTOtMXn=kn݇cr^`Fzȳă8ǽz -^zZ -VNi -1drNfRe>v=+Tʹ^`,'&]A[`W&eT>CarI{O&'06Jwud32$oD]`+ YRRelI1~/A)i\C9 5}(>.R -M-T>]=~K*iZƿ50G~Jy(tyeӳd@qXkፙ-m7װ UuXe>9arr(FU-i'Gr8{kh$a8{T[Hquy38vW *C~kYW87Gd}QZX#cI-1x~x㩏j.G6Vz ֡8KkTh*PqW[}|oTC*R.1##s}J'[g]y"gJeRfHt|Юv$[F3jRӰCT(E)mSE -hw<(;̓ZlÛPsj%YB>< -^)EVJZ4=a,Y'Cq2]prL`^ C|z/&2{S`0,S:=iuN<A:,C#IϘ`h͇[`*wiG.hmh~6> -`&<O@dx6RVt0_'"`=Lq(8^υpN - p!ކmPsa+٪V6|Z,8LY)M}wvia]?bn/ Ly:JW$;;*GֿtL1ޖ$H Z[F8/GŒKFr`{Kb{y]~> ],A㠴ǣaL$N DmFҎ%ZAB/`@ND{r%HE -q[{NBe=ۚd(z{{51#vQ_3>fOdm@ ]-:./+ހcNu98bK`~A5Я{}n}e3xؽ`#_GӪD"јxd5?c-I4{-3h8/0QNS$鈦w0Aʣe%,rIs J,OJiR]!Zo QVz o˾$ij:dy%&XFCnp.L yB#uU&ZQ2c5c2}GgKKl7 q+y]Vwmo~Q`ywRry -{ч{ȺC9@;hoFOsnK<1@6+pNuؽf䒋?"u>ymskK<ϙIA`̖kb7$Nf$j2[sZt>gt3DK Y|w"-8NH7^{=C|DחI9C<5ZHWKF|i g%)tUΡҭs#~薨y{L49XULQQdPW1 kn^ro[!+F:֏3D?$+{@kЏ<ę(VB} Tqg`]*q&4>[iWg${0?6KAٮkͮn{8'YQt&3`}2p$Ig;{{iq._jBK9=.}JYp9>f -|/ʺN]gnpscPrAb)xYYu^ͫ|5>W}LцoQV=gK% V)C8_̷$\7P8UCn7ߞg2rYmңYϯe3h6:(hDORhOzJAs-I ttrHOÚ|ܵw_QVYnSMowUrӈJal8{/ ,,%H h.M(~<7*Lf\E&3I>$3ԙNK cmFδuɌbK՘NGܳmlss޳;gg&&H?9{Wñ pg.d xWH#%Xz#In; $AAAAAAAAAAAAAAAAAAAA#aÏ!$Ȇ0r| 0.j\ w% ]2Ŏ6Hzד^>?MzLz4asnxz`wg,jj 0[adbڋ!t -[`C`FDԏu?~m -i؄B'p~`/ԋc *ƕZkEF~8fw'oǜgeP}i x/GVwb܋2$^( [wĞڊLO5)S2ᔩJʔq2r0pB?z_]wzKMׄ~,ЋB ='3BO =%'(f=,) _qcB (eir/s TCnڳK>K/e0ʎ(wwM |eJ'?8Z.VѦ7)@8M)M_\: $X=B3ʵLܚhMYg.juRo5y>3[>6aR5?]l|5c͚]DZ^:r fS-ܪ+É_`O2U䪬W+4j]_^4|B'*I"ff$|L)7j\iaT׈IV\),Ҍ ~v [YlMV/'}jpc6&vzk: Y:WO g+}ڍiE}l%2i۶MKӏkuŖbLRP:JK5>sc8'oqւ'K׌`k>;kci<37|DKjuikԙ w)*cAjWܔC,8\TRԩC=xyc:KlwcUdSԿblU꼹Io{Yxm^9*oSkcQB;ì ߘߔzEXdzXD3D!58ۜlz9X&`voc8~;3Q"QWubClF NTUdĵ:P]$* g521Y W,UHRtRŝiwd:mNYIseM F,Ar_v{G¬,o?+GdR2T/ы"=^=Gwvݦ:hW4lVqìUg,cuc֔tʁUN7{6Y<X3eݪZhhfs_aYk !j~ /#B⇼:[^jV[֋8řu5>2t)ַa%∈#\ҾNC|hjwY3lē~DYuQ3i1C 3< RK׬d gstd R*q" -"#x/}~-~_K"? ?OI~/c30?ħAcſI<(U 6 -endstream endobj 268 0 obj <> endobj 266 0 obj [/ICCBased 290 0 R] endobj 267 0 obj [/Separation/ms-blue-dark 291 0 R<>] endobj 291 0 obj [/ICCBased 292 0 R] endobj 292 0 obj <>stream -HyTSwoɞc [5laQIBHADED2mtFOE.c}08׎8GNg9w߽'0 ֠Jb  - 2y.-;!KZ ^i"L0- @8(r;q7Ly&Qq4j|9 -V)gB0iW8#8wթ8_٥ʨQQj@&A)/g>'Kt;\ ӥ$պFZUn(4T%)뫔0C&Zi8bxEB;Pӓ̹A om?W= -x-[0}y)7ta>jT7@tܛ`q2ʀ&6ZLĄ?_yxg)˔zçLU*uSkSeO4?׸c. R ߁-25 S>ӣVd`rn~Y&+`;A4 A9=-tl`;~p Gp| [`L`< "A YA+Cb(R,*T2B- -ꇆnQt}MA0alSx k&^>0|>_',G!"F$H:R!zFQd?r 9\A&G rQ hE]a4zBgE#H *B=0HIpp0MxJ$D1D, VĭKĻYdE"EI2EBGt4MzNr!YK ?%_&#(0J:EAiQ(()ӔWT6U@P+!~mD eԴ!hӦh/']B/ҏӿ?a0nhF!X8܌kc&5S6lIa2cKMA!E#ƒdV(kel }}Cq9 -N')].uJr - wG xR^[oƜchg`>b$*~ :Eb~,m,-ݖ,Y¬*6X[ݱF=3뭷Y~dó ti zf6~`{v.Ng#{}}jc1X6fm;'_9 r:8q:˜O:ϸ8uJqnv=MmR 4 -n3ܣkGݯz=[==<=GTB(/S,]6*-W:#7*e^YDY}UjAyT`#D="b{ų+ʯ:!kJ4Gmt}uC%K7YVfFY .=b?SƕƩȺy چ k5%4m7lqlioZlG+Zz͹mzy]?uuw|"űNwW&e֥ﺱ*|j5kyݭǯg^ykEklD_p߶7Dmo꿻1ml{Mś nLl<9O[$h՛BdҞ@iءG&vVǥ8nRĩ7u\ЭD-u`ֲK³8%yhYѹJº;.! -zpg_XQKFAǿ=ȼ:ɹ8ʷ6˶5̵5͵6ζ7ϸ9к<Ѿ?DINU\dlvۀ܊ݖޢ)߯6DScs 2F[p(@Xr4Pm8Ww)Km -endstream endobj 290 0 obj <>stream -HuTKtKKJI,t(݋4K%ҹH4J#Ғ(H -wqyy~3̙g<3Y9El -@ ]!O-@\+BVKK :OX~WCaiHKL0qY `5ck -X]x= 8 XĿ׽>.f#aPn D^{y8  dp H st:Y׬cxc IV?S!:_9[YbQP~+rA -ShHht^ '0߅™kYXY9Yqqpl'WzEE$%D>,^|t*K)%/`\ҫ:&D [7dplDa5|mb4,yy{e5 3⚅,t+whlA   m k -xYUH&%Ȥ -qO'Mz3KT@v[NUnn^\o]abTrtlmE]e~U+jאZ:zaqi5};CS[\_ۆwCaQ1;>L$Lz}4:%8M7l̎Χ/}XT^]X>\Ym[n!ycskkƶʷ;v{pIs0Xݯ3s󝋒&$WWW*)!$$%!e$cHNOAKIMEq ƕ;KLw@YX;ؚ8^+DspfKOTCPpJ%D=++O%$*8IZ\Z^UK_wL"dx]}>9=;s_G8/̹N!Gz[<=2|B}PQzlH0Wc(Een|Pds::5&89yFT"od䳔i/ZK^&gd:fgQl kJХeJ*+篍kj5U[ZUh0|em6]B@`PpH?QM1Msψ*iϛ.Z [JYZ)X-]R޸Ѻپw?@?5 ǖ'vNg -W3gLC#u!MMMEvAms˔FVNA̝GLwA̬,llؿsݛnͽ+!B²" 'R&k?3?4+:6oT\ұڿ6VʝoF?LT;:>::>:;eqvx^sawݥʕ'_EFO\DKLtAnFF)F|ԭ6\`@z?m+F;LwiAhy͖)Mgw~_ @ZH_XA,"F)%/*9aZ:Q,\B^_AU񡒀2 -*'[j o5[uR1uh`fm$1xJgBdrltlyyEe$feg-g#`dGbwj0TOC9; ܨݿxz6zx8IP=A!.aAxۑϊ}bG-ޒēx`G/Ԝq_O?0"۬խЮ˯ǰı²µŶȷ͸ӹۺ 0@RfzƏǦȾ *GcЀџҿ'LsٛFsM6+1MZ:{T?~ò~i~L}~cbA~Dad~ty~W~O>~\/~|~`Cx}%H}1X}%z}K} {N}׋<_~7A~-ψ||Dz|+E|[s|z} ^}wO@}-~ċ {Gu{Dz{]Ĭ{f{Zx|[]|ϕM?}R<}Ǝz]YzHħz|z={LNw{\|=>|v|ېI8z/r z;bz'sMzd6zɬqv{D[{0> |;|yyaIy?yazYvzݮ[{^=c{ФI{R*y߄yfUy`VyyuKzZi{ <{z%zȎ~+~}͇}W0}3}HtЄ}Zk}=~zɇ}!~Єd*s}Y<9wpSwuuVrUW؈|;,뇔{RsѲ;:8q)PCV:4.8Ȅ2񡂡?Up Vu9S c bփR.ՁNn U388A/ͬδz6߆өn1T\e7݀tXT)$̯̕6;eCʷˆ imw3SƀV7M -\lGNػځNāa5tNzlߴS<H6*-N}o2ن N%է>w֣A}⇤\fXMݘ2, KԐ3g°[} -0e6M _1 ? 1ӣǾI^I|B̯dܪwLe1$: rW] 1S{z|diL g0\ U{[G{!{ ޔ`{&yE{xbie{Jr|/c5}~ -~:f#MKx+Ca|uI~.yW ώәߎ%¡唘[w!^T`^H*- 5GȨ瘎=Π4rv_ҍRGf,ދ̋|,ƕ{ Ҙtٕ^1Fő,;',#h%T,Qۥ{[s:9󅼓&^!Փa@!" y -.Jl6mHju,bU6+s hܸd-ʥ}wi-sun=0Ľi-_*)U_ˈb$na+;ϧT;ppA7C4.*Iߥa8Mm.ACi7\j|fiԫ)]ޭjʄU]3(í whJch-4x7h׿*P0H됎L랇ڡuÂ,{Bz}8vggҲd[!XTZZ.vlAg -{;Sm`vؿ`~?ga. -3Ì{L^WYe4]L7ok!wI~Ira^=C#Zh`Wu}p)"z7ff&3$FJ8Ҷ5m -uR_,^VS&aR~PfLL_Dw*`\-9]q  TI6)>u6 D`e͢/xqY%9ʜ;åOd\˾P&eRz;].R<oΡ]P{?: r̨\ʻb Ҥ3|m s؟W9oZt]RnÅ\cW#+nI&gyAjsN06HiD'@J+a5V~cRI̫vwtUc[3+?F|l(iU^+O?Rs1Hqil$Wþh=(RE -1BvџnF/ BsGMY9>ܖ3ȗqI ڣ5V_1ȣβiJiX0WVH[8g_/ -n3 ` 38A.|f|ј0I6bv%& ;Y㿜҄#dD.).p'3J12K[Duɥ$s8IƊ.z^48e!R6}vcMiozo0'=~i,3:?-?oS,9w#ROa; ?pB -֞IO ݟe#}ԯN$\l?], y,>&Рq]yh0AqK)ĝBFҍcH:-h-ǟcf)K9T127]qEjL<>h;|U -dpG -ƫ`&!8al`83>.qɂnA9 -; `HByg KB*k㰗2fF=#OM eT? -mTm_OBۊV<ɆF('n3uG~Ȯ#7Њ9[١`Ns.P..콤 'KnpF\? B>-`NWOOWBlfxW^b-_x&*/(j_=߆󑊢zF`LdE:SNʔ@S 03|TOKokto}bFz$4-,.m'j*J|)J6BP ^3ewܫpX.*,07xPڳ:2XOT21|"7=0ߴy}ĸB)H[Fs V+̯+Y(I(x&9JAI'tXmyG=X[8TK)2<TSRvxlȓGO|g/{>4/gRFȶ&A52 uЯ*B幃AuFǞѧuD)B,*?n` 'qQIzK֗4{B_g68#ʉ2.A$69!̒ub1&D3Qx" >ɏnνxVG&TۨÓ)sxd-5KxߣD&1±jdGjJ|J{Z ޲f6/vTp̄ub PmBU#gBg˷)-*E -ar>>Ƶrn[ɭF-IByѸP=ĶKUC wG D}"vN.p]]Q8uY{#qCv}sax_oyiNr( d8aw2CQ}V8UWO\g \yk@dcZt9$u -p-1z(=f) -vě92 w u煼ת#{P6+Dq3HIi%BCb!kc5&U ):X$܎[b2*@PkcӘdoTB_L1Uwi")=2#pI9,RO>T@>;bnDPuCfk^^\G~ oLRcHqܮ=-8^5Ońy*9:-\g8:T<?*C;[yX+I;lRL߭$DvYTQ6DyVmfy%/sIsmXP1Lռȭvow)QBb_LVwupeėO*|+](uHװ4WU.{ 4\m.QwR~MAiRz+%BKz?'{ k҉aa{H]sX}da~3_auQz VM\ĵv5I0LM)DŽp1:5,&4 %!$}ocޤA]R^xT◬M&/B:DwA24?cd&g]5b4a?iǐ Ĉ.OA 6vfvsd(5yTH/P=(a;zUs bWxDa)Eʼ $sgPJreY3w`cFo0|U[j5k.5J&eTor È´}I lpjC8c5J=g%Uo|L58E" -ِ[Ak]J͆VBM"{NrQihЦ@Y?6^߫ZWٯ]ذc؋hKSLj:>O ɲ.ݰQ{5mm<ٷ?^v"}ъw9O&vX7km[ ,70nΒ7|eP\I;-wgFN cIP#qWI ;NٶA)H~7i thl~~dzY Cx2>*c&mb{9f1X*L #> - V@g蒼]7n249=MK% ;,F\j 1klZi؊ΐ.|Q9а$_.!;̿lE,ɥDi}D3^a`Y5g{J=mɳy3CM'jM-iЦm n5? SJE+U~ ;q.tXd~~p*QeS%.Ћ"ưBsZ6-6[\d;^z4`;64藸ͱw;|+&AfLU3XTm)lF'l VɺgcGObbɜ9;v \CL, >B?KGCe"z -@EHILp<5'҉$>8#gL2m c1 c Fw)P+rkC qp/u8#!*g°Pa`vu@oH`"Ž:z_Q<,D>'ӅWP .`xW3|!6 -5 El[",0 e[Oz0~lUO+&xkPc|u$k.?{Qp""kr6isVa=~@W_ -.<7 -2#h?c~m'rE_xs6aG+K 14L^kUp^^_mS^dШ'>}5$:τ!E[bJx&n t(m;ZsF5uqX.ՂBqKP *l%{ٓ{'f';,TT,bhUq2Z3;}T9vwRR;GD - K*/@hUv$j!@ vyבm,W|-͢ ^ ~D_􆭍"ĉ#c禘*X/Ϝe>|XH;:)d9gƖ4aBQ4Ew,C -ۯBU#>SV$L-5gV ϯ*B#} npþtdU$Db&$^\^&Z"/˺+-}%Z:}9AYu rTlP0"~! ͚*@5K?߫Z-P=j>܈[O?)a5 -?WUsy5^(ge${Cm> "Gգ+$踿ϫ& Xw8?g,'ō="/xNM)'EFqrf CįQ9ZY$r!6m)4 V9kJ$# FьX٥Cp[ģ)CS;rFP#ImKGɺzj>>X9,ZL-jIbkȉ8˚?vtxPIO}_ay@:|Ve6ubd/e3<֭ztea'cLaM -lz&,f^_!?l2x2Xyń3D)\?ye ~4O+9$  -EVDTSؓ7X?MM!ԼuOtP Cbt;iްa@gW#@4c9.Do z2>M5i~u0 qswQ9ǸLt삟Mz)>kɝI;io"U)]$YL >$$T:gUo$UK,C`sCMAJMÄKC(g]ٮ9sUG0?L5QM%0Ol5&`Ƒ1,x'{k+mY}-Js#\d:i/NK\8HstQ#-ND).s*Zymnf\1l{(E=VGW9s:?wǟQZsC6A1ƃ6K@8OUY^`7j6@9?,yt4&}"T- -\Y&kVx녣391ٵqQ=beMq\`/nņ|2͌JkzDmͫIR4\~5NlօKɁZ]TC3l̅D3jSS)tWw$IX[wV -WTUw^PeUhWE^ؓ~Wchs sIg`wgs (5mr] B`7JfAaA3ƓG?{O[ ?xj/Z*7exXz Ά})C?`KcMՌ&)Y5J]q':]$؞]Yv x(ıH1eU>_0b?*񸨎b¤،D;Wxm]|N7U13*;.=>SÜj)CM>.eI1/QvН6Tkk+Ɯn\\FFV#Xde&~WE7"bju^I@j@bQ Wk8w_D ^z xZKA _`T}] -x}ЁM0S,rV+ KO&ƈ`;E{irf0F] w86f fm_8c3V<)r1p +hs|p!QP'Ղʛ2rӤej4Y r, r?4! Uq]f(*&umM+;1 --c8CjL=L1TDJ7>)BH*cHY}~xI,{7WjWާʇhg_YovMKiN> QRǧ}AQj^G syJG"?txt,L>֍p_>Po$^<%}KDS4 -*S<ܖyd;éIJ~JMn>ȸcI6uɖژ䩊i77_5W2' 9t^}/8%wd0k)ͦF9kih3ShPBULzs'0$Y/L3ol|f ɪ\AW#siS-O^I+36xas @M -A hm45V-' ѵ1S+ ~*%~k˝ʉl * -lك=3_2~OgPs -Ccd[aے{<ХjA {! ߲ۓ;O'9+wEHE&JV?fiӺ j05瀶bhWZxo=ƺ 0zhK5mov (YOut;e=R*yMVn,$v:QڳE.yVl;svn,Wi.[@34SD_!MF>J柣ND @$Y~-CMu (+lBpБ^#$~2è /@̣6 3nh -;۪.3Fq3\َvZnZ"/vNFNJ2V{#ΚVse_쑮Ta8C¢!Η>FL\M{5eH~7;F AB?VY=۩Q i9J.sӿc%FVbdեiL`a)kD=W \ne>NX7Ƒ†2IYf-to7/~Uas[`W*v3_`~:kjR("E -* -e)DDIss,f_n6":hmh+]AqñQqSa9{~8|~bh6GZĠםN\h+(E30~kTMGβ1:zka'LG2>,gt X&@?e% -=@Ihs)HUOeX^m7R7~,, \jJԌfͬ8!*]JR:WR]Mɚ PZ;JN.8ɦ,[r*Α]MM"waX)Lbjd`>:?|:?u>^G$fa. -ʥ_S%ED8 J=ĕK{6r zGG Ui<Kg"^ q -I6vPWy^,uc/5@:ǹ+[N+li{P#^yv,ñ-NѳH⺣<֡gxV</nb6󴳜Ρ +nhB˾PoT(W##ĉTwZU} w-vT-9O᭺HIz) z9R'dI5aZGS˟agW=.P1ٜ y?2X)r4VaGXBe`9Q1͚@85$W?D}z2* -pt +;Br\ܕ'> -vCNeʔL-ʌqKHr 7I d<BgNelB^փRγF2AqCR&t7߄{" D9u)Cw1t}?"'[7o̩~1{>Ru* ʖdClutqf2[l~{S4>J$.nQnlP#x])By`r+wLH?VD:|iUG~ժ+&+Rb gP>}WԹkQǖ]WSkqwZ -DQdVd24KGMvU35KJ~4&jwJ*y;X߉˔O@5hw)񘴕o-9E:_̂o&6#V(ѽS-te$ פp}4%4mrnzhe4KX*KÃ29ʩ~'Ǥl|O5ÍB -;^j㛑Q`exH;J\*`l˴Khk -&tF|(8VǡܷR:ϳoG*UjSKknRgl ޅ-6&Nŗ7O4rGmO[du_TvY{ ̏Iy\aRKy&P7ݪJ)l"W5{K S_j0WSW;wixF1^lО伴^'1b%OAXhq)L7j}=9PX=n`ɗKX#CùA *7{ jWܴTByufכd=Af]F=_u*`q+_i݋\^`BaE|S&%Z a8+QgQ[IK-jIKr2Tcju=A ʧQ"7{ٮם*X|,Yzѽ}ƈf:jCo[>]x^hlhNrϳEDkcCǪ ת9c Ht<)}z!hE~DBӳ2S͆i{;ouIp??砃46ٺ^"1R<-65sjpCSjqi6dzھİ紈 41.$5EG9:=ob쾄 v#[xﯦAF+T(C@RQF772I$^a$Eq>.AEbiO0]ТK5ΫPÛG ZdJ*$d ^}E*֤>?Ƅ$dO _tl%$^7[KSECqz"$]*B]}W zT[Rk"n]EUYvFUW\B6-RB^Me2B4/wͺh4Ek5˖<1U[tD>Q!.kR涧7uJc>c -l/i^3;iڐ0sĀZnS -qW7Np:([568ViAFޜ~h9Pldüj2dO -+61--1Ewv =JCHW34܏&x8,&#Rc3Dvz6RSyu_N/nmكvT֥Y˼?RFװKzn9Q4gC^5l`P\ܲG&ޫ` 9PҞٲXr6 -V4,{a؄\tcY`]lǿԾar鴯؏=b!&Yb ^[\aYt$w -[R)i[{$7f"o Xp -zBz'hO|Ō4ǐ|-j -:}̴a%Tv5Y9QK d0 ?$ćH|#uD3 phrd@,@XmVKY@ou([8#!OM~.7SoJn%OG" -Ü3N|/'O-R_1Vh&׺ NPz8de 勊ZTH;XQ6}+'h_|ȋCcuHjBA,NOS{3 L`]1> A rxӴ*E^.ؐ`Q5 v{`=W6뼟\9avGOXc& v1w~0W:ʎ~f: 0/˵%m KRKAcR% P#CSߥfmD5oEx17B0<&Yd8"1wܡ5 TaaJ3p57A>+yIMcu Zd?Bk1x-rsV9sH6p]DGgO| y5S$aE`$Ls -[Ym ~u8p`6*I ߕ`S88sn9O3nXOE /7f^lbN[PBFO.9Z_.5>F S̉R'}ΪѬ`_dX|{dHXԾ3QlZe7PRqشO5OkZrx5u`aǂ:*`T), -DPQʮdߓJRk=H+ -*#u)h) )B6s9߹瞏HZGzGT"93hDͺ sr|b4y $TK "$I~$v(B#].qi?CN ~ޱ|ܷLcOnT~vxj̦5<.f\K<2p:CpSy,66>|zC -E -T)f/:X1}J+>_~Q;^ㆪvs&۸>.k7yZS:˩㜍rݖۜaKa!l.g57Kv0!;ڗfe %]"XT J3aժlwVj=v姠αe=bI/gH& :g,(y 27>aba88fVVqɌT0NɉB`( _"fo! t}Wg_0}HX 9,Qx=~Jٹx>ӱe9M2mFS)Vk-eZFF٥btg0O?Dǐ%7eyښ6WSCyeUS}l`a8i g"1лJ"|PKڝc,$+&PvꖴGBoj_t4I vqf熚(eC!b׼^SbYi1¨;2W`/7uh?4 -!z@#(T 6 ^!R S#>E/Sq9z_ /G%ӈ0C9[ۼ@(٩P ,}XTOkpQȫUG6 x2e,> -?ϭQެYz/T5FL^`tީ3\#̬D:,vw[mDW)TBZ`0Ֆ`3tBQ˟kks41y `\޸cV#z`XHhwA0چFTyqӵܫ*F˪%*/>9 -gS'"b'zL=N)cs*bR)W<#S 癛)K -&L\9WtW!Y17i*%wJ_ 閥nWJ!p-0T`:K6B+SzlL,~J#ZLHBEe߈Eq1 -ڸTD}bB;*OTCnՍl$OYQ0mz7o9NŻ|hDV[Ve֩b7YZÖHl~I)ܻJ5oOݑ%(,hZGҼmRd!/NEWutV57z;jjs^^lDǾ0-a_aL؁w44簍b^ppi&nX uƻ-݂ -cY4_g ?jGIfH %J҂[%ϩC6OzvWzoZtA$?z;ؼFT2/+0@@S<@>0bSuqw;j4S'/4sEթ(P[V^5ƊHkg/ۄw 0*֭ ajyB5TC J(_F4!m, RN ?S9 :״OfOV"յڇ1,V)S@._ -#Q`K|ͨ%cj/&\: [Ft^Z"q٤Jm뙊jMarח`VCg -w"~>< 8i}XT8dzQVY<p%HG/Û`rq;Nm~Ms\/Zh:(MXа^F.꜋.Ys}5`a((X0T+JS 4&~|iB!! !)$)ʰ WFY]E븎3x,˽}|dc -|i-0Ws -Q_GpRjy0׿tjT̎ԍD1څڍ›N:ka? 7ek_%]a;זF=9-b= &Mm0-vD'^j+/5(er^+EL F1$1KWE|fOFMKm::1`ڥfXЩM*i9 -l?+Lw?-Nx͈wɳ\C0瑃f sM;iđ`$O0z*RٹB9@"k5v~.lB?ug]ed8JAj͹um.DO^^v:y;ske+,L¶vŝҼخd_5Z;q#k> MU\J{l*͟ґ3Doy"UDcu#H)BPit/ v`_Sʝ{e5mpPpy=-2[m+v6*.WۿSǔ] -^DMk,2.#ɲ\!{^I4Ԉ.~çlDcBU\b"c jvJG|H`_2rHѥ tHHBaG :Bf{'9 -[jaЧe -&hz6Fdy?>gۑx&l$^:^nx-'-]O 5@S Uڏy]Tu _,zWPT|BJ,ɕ}`8ߴy?p7gˢu\JO(_vOUue4+Qbi?A.jCxyRJ駥Pt㸲rTfdd$ֺFR>PaL'v2M*׵T]`W*cD*hAe#"ɆKO9JKL2J( KgK3jԉfZnL5oM(_>FOӹGi}<@w#Ndhoo4Y ̾Fٸ2YAz$W֜5Copli\ 32l;a<;S?B>zprjsm1tZc̥{s/J{c*#3ހfϡneh->Bc9SJ"չO8'8ހ `yHϤu-*` x[c')Oy\x!QS9q*;$;d'=NY ,|ܶ34qT=ka%hs䬺UX7Fl[ o1apuxf9QGk4;e -˸7荇5xB:yZdͫ,`2?_a[0~9iY Fs3g Ë9u<,yx87 1Ja,O@/gO㔛94 |.]16'^@1'p:XtwL,jVQv@wl{έ̱\?R^UV\GI+9D03oyd[R<""" -.2}"!<4tH~(-r25DH@l"K濣,/S}"+~wF}V dRz,:w&?C~FqJ}JݢJirjzEgU#p]ZF%+[PjewVjlW7wR/*C%%jGx @EFH)&0_Օ|Xu -DRNXA\0JSH307͛73 CWc+U#r# aQOL4Eљ?s~{sIy?y>ҒLָKd-ޣJ1v*fH 6hz+~BO:IQqZUՍP[UD#BM >$ z|?^!J0W8N WzXfщ@'h< -%sdR۔e[$z,Z2H5[&Ht L UO 췯+52j&P6uRɮ! -a+rk!o4 `ܗP)f%VQTF(Z]s,TR|O)O?ho# ]6yл)OU,F٠E})gsٴGyҘp/kw~˖I'Y;TdgYU'I8@F* 8 $I+A2((+y8OϋWȗE {բbW"@}@C׌teYgvֈHofE`eagbN_4!/e%O;mhtWv6[iyFy4ʔat V] au #QYm3rM/q{~tjD 7fiɷ  . =[n`4qShBrx_5wԐ %nQ~x'G[ `+qb]Q2Ըi=UGn~ڋJ(Aݪd E7Kz +M]!} jnh-Cզ_魺a٭Dfrj6$-4nUZF)Zpux'@]U/ٳۿ3Ug`iU}ڰULWu+SU[;uXJPvOŀ{$KF,qQruH.}imfZh~atMBb0*iWC䶧jZmn[nKfi c+.&oV.&ʭ{5_s9dmIA. *s5: 1Ů m!|fl'6#N -Z>\oMkCZ8)*bEE@(27{I" $!0a=+vUZŁ`-xEJUǺ -~~7TSsV6i1=2J眆Jh@ Uu;7!0 -߽\醮%-;=.e/T7D$v{.ʫ|ZѮmcDֲ+-Cu_{>1H1]"D^nR ٺ:E3[h9 7TJOW+3 vœLimc @6'[c`Ǧ8v!bR{1_ӵuoPE2\@;4"mO m{ ߺE1dA}C=WB}[3']\PJG5VmnYG Xyahd'J[U~ vWۅWo]WnGnR9H7ѨAu 1vZm]lUrTVA -sj6lhm,My4A*0vJR? Ĵ>2C!*#q0MJ!:ŏCR|dFa?2݂ch3dBzSIt?%LmF[AxYGҏ0m;GY1űh%[sጒ@9 q_8G>r Wn)jodEzC.qJviN&If8bg - v|sd%:uTf&L0~p.(RU -; _)w%$/ t# -~#u`u[w.qsY_-*'̳ɩk/)2* i9$7fUzflc9}],툏WYCIkS-ty7>T! 26Kݲ m&cӣh' ..+upC6&@j5tdP0=I˂Ė -C{޶$tR:(ϭuOR4$=jluq1?פ9Si|cqF!_z^SK}`d%DT wV>;<'V=(5H%jWMV#9YD2֓p~~J }D]gNSsjJmn->,vg&SLl#>^i8ʞ%4'RJDhRN0hBA0(r0K+aMY|"EGE_R^v4/?m[˨yN`K/5[71[Gؒ' '铯RGhqꭁ]>iIX -5'\GB ćd^ux+[^%e ֪pxE - 6%!Itި@Ҿ#% :*h$r7שׁ55׈Ց'I+6*ЮwȰ%U#zD+Jt BaUؕ 6}uOr7dP Cu}FEua7RV"KST20 EN{^lkƕ$vW(,F7b ˢÞOy<"_).kh[n 9W?gڈ7yș*ӼuA@ OpIRrP($e[iVYR -n#(aFq&mq3%\g?%ӆM5XD3b$ʁW ƿ5&͔D4®KcᏊ . -1Zo -^`~¿`6z q aXǰ)Ӽ܄'84 n"Db.yC<K d},{*h -ڸh>wMv^ c8Iƻ(~j? -eoyl/Dl5Żרpy1ܣܵ^004{ .%CA22dWuQ>okL<5.ſȠiffh7S-|^TjX[wCY*sG^1Ve֗+˃L3 /2y{+.;CtJ } ->٫y6q< WxA_PZ? Q y1>yK\.!OqM -0Cl];Sk)=RZ@[ɷ5JBeǐ$Ni"0 -úR4H~9.☫|Dϸah-)r~"eoMK%4 _7"‘e -QD~0T.>"x*O>酧.Ey+HVy55RWsEk*PxEGB;(J X(8hiqmh^ 0`}_APWDLZ‹]<4zG֦`oyZR|u^gCF#nr)Va5ƪw9njyIt -xI1bIy>}-AگOShKFx6xqqQ -3SU\ka椚̩Di~ ?{>J3mtߐZt]YNju]ɒQYlZZsNѴѷW>Sݥ0Bj+7q҄fU7m :8^;#eտ+*,_CY3MSU*LX.jQȖg_IWJ5a"9R'C\y׳qH)VU-Z.\+Ѥ/aen/|F[?SPkr" -^Y>VH9 &yaIxQfd}+] -U.o.=q-y][viRgk*`/pLBu+A@[)&PYQ?im/K,Y*gu(i2`؀V"fJSs=RU@7+>dْsmY)w=U?ο3D qjv83׽} 1r@vy:{Eͩԡ.޸,珈~CH{ksv_l毁@"lOR."0Fl]]C˧Mfi nq˶Q{56ef e l[IuY_(i&;to 5kZ/ jjp~Ch⨿䦿iRs!G-֠5 -&wa7WAƫXUr8+}E)oVӃIÌ}qZlh<gw -A?=$6-ޡ|,)!<*ǘ*z!8߀ϸuPpD|Ŝe=sm4'ҢؽYaPOZ(vj?VGgxI=V-̹uMCJH_-C]B~2A\8*E8PTΔTo 9/whaߣby\'F,Ռo%wU/ժnM*T Ƌ{5NJԢT9L;y _fXD\uַA:x")V%V/*]1# )ԋ@X"SVӅ4u.f?Uչk%Nj;c~?]Pۺ˄WҌ=V듍1 -E ֻqd{q׉; -NYHdfttc #&vPtQjd1o ­R)ʽ@}<7 &8wyybH04͂@>o` ~M`Oi#T2"-!NSn\ z$SC%Q%;OzcT)!M.wf.Po1U=Bl1F#F0HD\u̞rڜ*ujQO5u8E$7:"І(UuANgulWYE*Z"cT\kTxlx)$8(YBIY`[}.Bb T$=U8Oŧ yP-x$]0_ -j(sOH|/=wKR` ptl>f*ӡuU<=Ts(&zpKA?sLo`N0Mq+~*m-~F7^5惬H]${|-Ҷ9Y&=X'Vu+^ϖEm -Y/0X cAdPc_X VRx6b|C6^FeC]o-F?f7Q3V>͝yFsy]ݯMF͊k^NնI#FZ.7ƆQfeϫCJn;AjB JFw -mԗ6t(I5beElXQ͌ i,)6QS 1zJezVBf ۹ʹ/ HQ89SnE%o-4NJ``,)~utyQN]vحp+e"xN6y*,7$'x\CQL[8.d@}CɏE)1D?@晹b$?7 - YM N| _Td'wa}0Z<9|3閗3~o=Y>l0Wb=P1jmE XR[louv:.C=;.a.BřS[nWJ3ǟN1='\Xr8۲:KXj6e g΀ap%z"K1.c1ɇzɭGTRiVBe-)K@iͬ!u@_`&2q up%P -SЧ|NWP !o-t_ nyV|ؤ賐e`HʏE=>\Tǀ|cҎkIST!%Gu,%[IR'+#T}m3\/df)`n2#\M(CQd6flqGv첵).Z&wITe{JQܕQE\m`p`Ҵ\z[v7OVo9ݜQ}$SSFMWdnyuя: *o[3 O FRJ0ոl+L+&oE+d- -@?^fEkoo\fyJ8zΰXmi  -Nw}OYpz&@>gݪHc. ]7Mz#fe"g\a@\qyºJc\3ܔ r'WQVE D|PLs\h_h#9Z-TdL>˼!WS/bniA3.1Fx@Ǡ3UNN^nPOZdtvWO&-8ךshveSȉ`wPU_cař=շ}m`<<$+UV66do88{ηzkG}ڻ<<7\jvg!5M!w&GmpfSgO3x? -wZsLRq/~lK]QV:om<Q' R]AMXyu ^ȩ $}! 9LHaH8hʡrTtD-*fY]]wuu[bgg޼ߛ"ȹ I7HR7HBHudt *Ჲ=eJtj| #TI/W?{ΝO^'`v'$^E=7ITF2˵7-^'Z"[x ;[U7,QyWrr9E6cy'I gIRm2ZQ -{0K,^H/>>G@l`T=FZnZH ѳ$m¯鵩KA3D;w7ŏw^J<`i$M_x8wU-,/h!pbP1|*k _U;N45jX_:]$ %ͫX+é Miwzz{7`fOE5FohX}fL}k%Jq_b_A54WK'h?:lTHmm. m&"X7rV7l̨b]r+ OpK[{0EuwrfӵFajCCPktMݻVw[FR(Y-VE8 P?)p>͛5 #TtF%3 qhk ;`LVOpZۓ. j&\Cʡ <*g!r)J;ȁ&xK0N\B&Գ$bԍ7fpt(0H23ӲG1d?ź -bVֆ|\[w+tjj?b7hwJCmm#b.^VBDRb8E]4J 7LGc.Xd/a&ڎ @顢zQuֈ4Tqi˽èb˕ 43~,ymoθ[0 -l} TCuLBt 2ZW>Eh@+[Řy0= -sU"r];û](̏{e E=ma^2'FKv~.Оm0Oj(esߺ Pk*!3IBЦs4{^|{6k\* }XYǠD=A %$hǹWǂORV UBꯪr+Ca6 Kԣe :Zڿu6&?W&k).]%],lb7MX][H"}WL)RIrfr?AƁY&I~_IB${XlZXE&|w#؆`_vߢfu3fm89?9 -̟NՎ`jz1*.@爎܋`oْJ_+-4α6@/DWEjE}HRDl;Y+ z/1Dѓ(z)oι&;.4aZ#gsbZ+XWi;<~n"( M'b6!G lP<^\nM8--aG+dyXP^s:0q \p3bWu.,R&rm#қs)lej(^ ,=/FV6fj;ex%Dk%!FW@ao2QTvs 5h0B{UHiGCOzL'pbIq+'_1Lv -QA%$[H~}{1fKٲ:HmWS -ëd}2w7 j< O7i2G;SWݒ!@YsZ~*PƐ6xQܡ/9i7cGHVf3R>K2jZxH"Z")vHD} @} YJ64T(P_(*C]miSJqOZgA(ny8}wν37;?߇*x"D6HaeZ -5K e -tE=H\ƒW8 72ym]Ly 1N<8͍@:> >6pӹ$.7$C$pA)hJewT*FmKg-lm*{{v\ܲsJa>3_*ݑہ>V5|WG_>RR_YL!RFjz S5fځO2< `}I\:XiZkRH*4[(xX$u|I9̺TkVzl_׼gC%*wXR nY)N.9+wZ[E9ľWJ%wp`Nj[.b|JOsdW,R~#* ĽyFdwCp*L(8OelL˞)A vfFʹ.Knd~A򥾺]Di(i]YʯJߟ?>w[侾7KK6w"!eDp5V* 3VEa{:KoEDcɾJ#oOU44lTjFk,>{S?ýSk>Su=|j}T -SU.nk.mcŮ)RxbT<TV*yÙ<+`RC;S^0-itp<ȗ2IZ_0ȡVVKHWol9=fd jb%}DCy{sI*{ZL1r`n}+D_*Uz3}i779_kjxL+u ;FxL.mmQ`sKzK#>&ޗxiBV^\s3_XX_رC+ҭj|S kϽ|j|[X -ΆBL.?\DCqߢ7nO(M&JOiݖw0IJLM,NCOYPoQRSTUVX Y#Z:[Q\f]x^_`abcdfgh#i3jBkRl^mgnqozpqrstuvwxyz{|}~ˀɁǂф{pdXL@3& ֜ȝ|jWE3 תū}kYG6$ڷȸ~kYG5"ŵƣǑ~lYD.оѧҐyaI1ڲۘ}bG,{W3qHvU3sIa)\ Z, -     !"#$%&'()*+,-./0123456789:;~<|=|>|?}@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`acdeefghijklmnopqrstuvwxyz{|z}o~dXMA5)ۈʉq`N=, -ٖɗmZH6%ؤʥwog`ZTOLIFEDEFHJNRW]cjr{ĄŊƐǖȝɥʭ˶̿*7DQ^kyކߔ ,8CNYcjnoldVD/h 2 -R e r xzzzyuph^RE7)4=@?:4 ,!#"#$$%&'()*+,-./|0p1d2Y3M4A566+7!89 ::;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{||}v~oiaZQH>5+! ؎͏Ðxpjc^YURPOOPRUY_fnx̰߱ 8Ql»!Ceª9^ɂʦ2TtҔӲ6Lat݇ޘߧoX\[VL=*b/fMq T - p_L7! }tfUA, !"#$%z&d'N(9)%**+,-./01y2g3U4D526"7889:;<=>?@}AoBbCUDIE~% ہ‚rW; ϊ}bG-ޒēx`G/Ԝq_O?0"۬խЮ˯ǰı²µŶȷ͸ӹۺ 0@RfzƏǦȾ *GcЀџҿ'LsٛFsM6+1MZ:{OX͙~ʹ~y~eL~j~Qc=9~|4~cl@~]̳~nf~C~لOiZ/gP8v}6q}0}>ϲ:}i^},~ ׉_LpK-~~,*~&E()D9vyowy=TS3wI!D)J%OBvwN64;>FVWm -S^Di*bPkpة?%"1#!ϼK`L<n-e2*+) X䥂C@v2l Q?(=0q MzǃIz7MEY; Y@K (-\U&>rI^2IMe;Ya"VN,S;o_%sD;fƎ.R?l ;0Dq>8zDKG)3o+&<4@n͗0EO94#ҐnW9 b_7}B2yːv/ąJH삻Ȧp$ȫވy;Æǘfo虔F¨LsI,KhW2!AjHE^τ _wdlXggΩr!jU)[%B\DCfp <_\?k,.wȲirJRݐ=>0+cvZ{HllLVAc۠ ^{6oCҏSمbȏ:sz 7jP@Q;[wg|z30Uq`!P-~|X3+z2lIђ:_p-FOJ*Yr(".O'qäfrCRJ'dc~h!€?`}WzBd;hѲGϲmT SAij9< -ߨ%@`8xLTqė=,Mk $hJdx_r̰gʱhtG,KytomVK0X?R=Џ ]ٛa`sʠ7g&Grŀ?>r&z`b>&z%sxbw&{~څ]"WR%c"zD zA rs!֝=jcf]rmANJl$ے#ؑ >wTfGFF699<׵.'SZ*˺#-Jl.ZZx%m*| o 2ӝ_TWK4eRsu33'jRFBWl| -Fgml0L1, y+Hu2f;[T0BE{:qntoT]okI, - LgV_R:Kϋ0dP?= vE̷փ(M4m\Tk׉o,H=Zw/EI-LQ[ 8F/g֖'$?[u~fghXjݚ- VImKՀ,%ibQ*e97WKMYiHtXTBUDw-49#iԗ/r]hGވ/ - -lD2 h‘%TTT*Fdw">GY?"[f r5ʊ4`TAo4H5rWS8Xy;$Yr'q vUPV&4m/5LJE:S7Hvy.. kPXAl` -,e: E$@BKr.!{A$A,CY[EA;| TJkU>41aƜdcT.Us R&BchR) - Pd;ʟHbl?1;_:i^mMh9Ӝ+,x+(‡j3=P6u>a}&b (0=.À<2&m%u9_~zL!S`(6͟>թVlW䨸m5ypg!2< PR%wC>ubvbF.0UK$K;؂P,!rA5%\v" -[2gwdxJ:_'Eښ_+^Cژ I! v,V72UJLNITUKɎIy/R+=+(֨v6!M @PB%R--3|4-)#ͯ w.ܘ<;b#;*>$eG ->3"و~AZ$xOUx f𜓜x;٥Q h X(Zx=`dš 8b†id, ϐ!enZ -b /޲І2P0~ +1baktT ?g)˧9 С`.ޓ`>'4\DRdPaxԗ?i|9,t Ĵq]"m-9OD'Ex>#Bz6Nk%tm6BDzVQGq,2O: y{iHcy[]vaZT5 ȨR 345N@qG!fYXr{3^M7HX1ey87ҙ;NP9tn/D=}*I:2s̋%G{7abTBm6ۺ4JZmI׶Fהz\FD*rEyք ̣V-8ˉi#7XmZLW:2 -$Iⷱd`U+z3 8"}Y\E^\Qܵ)<&uZ!FM)V"ڟ}&à/ ď 5 O546PW눤0 fGlEbdc 'ƪrӬ[{K("M/y%0=zFBx}{w6{Y50%,40R}ԓvTp>K@fR$7HU( /10f<,1BS>٨RI3#&&pa5j19#yTH9cI[էjU̟~? +7NzM`k|-kqJ}(Ҙ2SaӼGi ; b:`uǤayU}T 2Ftm̔%OpuDU0m~L-_:qWg0~huw-] NVrP =<]x;Y1iw@8,n\(zqb !$zB&5dn61Q& & CuЎy#c%$7]w'z\0Lk{8 ;fGS Fx¬P~Km%t3MccM(bCB$ _ J,@՜ %ӸZ;.6B)PT~~:_tHNITScΤ5_3bO6-[o 7$cn:zNqnE2~7\NT' "[fTT^2F&+c5r~ԕ(jl 48mWDC]X#<n_ T 45 C0 V~ m&AGA7w@w;Q8Q ?d9#1yʕq_eS]y|d*&6Q30J(WG>HN vAg+[o:y1ډGmUV'pJ{"M@3X|*oƙޞ%sfJ<ߔ[-0R'G i++qNPF\&XT~ykPx>–~u2LX'P MOW rة Z?qU\+w>-q}y/sRQQJ@737Ka[t̷E8X,Tp!PVK$`Κ׵bu~*LlBz-f{i8DbMp/ŲF_<`w[Uq. Y!'i7L' Rz$v]c-ީ%HY~ٕ 鞀ws{)Wa˹ԑ`{[z ϡZ& z -- U@uBP.8jz B{GtϤ1ޕq# ^o2N*`DZm錞c@QY@Oy`ŕ^ )H??s %J@f-H%{#}řPKn@u5w:=YX9(5#p 9#Av(~-"]Qb'䠡ya -'£ +vO@%7_*Z-r*~z Ց4!wBpG-q.a+c"wmqk=WfB +k^0>npu5㞃= m]0o-1:ǒ~%ui;pVO/a3;0oKܼL6Ed@ZU%{ ^ ͰyOVNHLmu?uMBEQ1\IُOui@L7Nk\dd[i|lRܰ3"rW^  -19~(VZQjsfb5~Nl, $LAE \Yv3k"*Ie.gj4uDk"*T~~g^ ~<|1cPx7kF84K(/AI\%HG;'6`kK -ZJAFqKq$5GT#.a;1 p't.t-SSUn;QY(sў*M8= -BHZ# GcDS{d',Utl=,}*vcr+](_1rØ@?A[KDlv'”o>=ԏ[?Q ôn!ܘeoiB]u3PzP'ߧ%44Qw L7@?;gSVjgohop7syR\7V%xL| 3n|2Q|-GotuV֘Gk}fd'̐yQ/;^+b#&~ي2(ɚpTֆ)$Dru:5zj,|~0T\~>*,6Y -]7E9!7;au*8Y?Ң#WfiA~\mB\$OwDhE16:_JqBR%*X3 !O:`Iok2+}Y'1%Y GPMJ{rK w_ L&N NyA'ճmﺾo4gz"v;L je %Ɯ{NS6U'*@djNcvo^=Bi 795l€Aⶫ627ICkyV_}B.I=YR2U^c~o\Ƙa3Ƹ2@eU*Tlmcӱ~ xnNU)o`Iχa]PFŚVTC&ϣ࿋Y=d]/..FBXs+$=}buM>RWm6Ŗ6ᢐFX 5x{v*j;zv<_~AVUJϐ^IjQxｼuQo=lK_ՑEkZ\4sqU7vOa J?Q)4C^\k[{3y~M|J'g4Ay,$0( jHl:Q"V҉1X&e s)MZ(W |Ϲ\88&tcpҔa͔ CC GU$^fb|8u̸&A֍9ke7;㥦koAvՏ0o5y'M3q"y$[Y@SgÓ=ݎP1)L \!B;U!)/C$N$A³ueuU},3Y'/Jc .8_[ON-<"NawGm_+yj~P]ſ^\y X,r-|㒒ܳ<L^T},^eDR,nkqց%|r,!gJx=~p{"\eeEN;Þ=${q@Q_\?/иLe>u#Mp'Yn_e<q㼅Ra8pLB=(YK[l`BKB#4;c;HS^OA>Ʉx\+0lkOԼ`Fcfup.wlCnKJIi]&fXPAn1کFTKBoI!ӮZ f)~Xhy9 ݨOC5&|T2ӲnSLB5eD0:yP;(w9mΪnWhKu{`wk -kH>*ڲ1 wp5Q݌$;LvvJ1f3n*Tg@oO#9|}?V0M5.ۀz{" NK?C_$ P&B̆e>(qIu`|ob|_0l2WꂝsCܴLTIa?f(/+PIwB WhgšH EiŮ(G6 -"  -"(H2̙dfr $xZEP>ţC~EF:}< \{ -% rH6N$(߫Nᷘ_%1]2:$o-8ȥ I-qt;'kTjJW^}kfQUr\ulNkHn᫂H*Wd6M2 *{`V%VRoJJ`+"yO|s86Vy8 :+;9ɨ=.qqѝ=ɥ^ӏwldG;fH^2`zBȳ ŞO*{M2MoR0i:T~%$9ED~cj<}${.-+P]c=Vzpwz\S;!?C:GFIױqYŞ ݇>;]mS)yrEz_n˕aI"l|sGvmߵ_7e]֭>ГU)i:D΂G}V W5*{f? -($p\)9D$ZYr|(4D܁OHʳ ;ܫv۱jxLr_r ;Wi nV|Rudܦ;@YNl-QnJȲc/14C:'K&̕BOJ{ߴzfsW|F-q2 ?}Y[pXdY<\v+M{ir8~LJޯ vlL: ?@o[g`}>?UrǛI2Lk.}GpI8QRV%܂L0/PUE ?ɹTcۼfHs^QMC!)$ ; ej uIy W6#LMi9ĦͱP*HʘFg]mߝn+|X$Z6K'OQJq m(B~ljSuZ ťbhWP"z@UVJ΂\,<\HA 5Oaf΍C75O Uݮx7F>QL~:ʥ#][eTS2%c Æ~EWg9i%3W4ފ:}޼0_X|-ƣµVu8H{YF"qĔ-F95E!L/3zLw@"FRmOQ&[#ZO/xˤr~9T00bܬ 4Pߋb>_nMFY%MOaN$ʡ˖~ &($~>tBM%^i3ϐEf8UB '`-icIaͨ+ دR=ZȾŁ=5U#5HR>njky/s6H؃E oLyCG/?QE%FvMMz)=ZB.ϡƋ/•3O85&YKլ(ST eҝZVx'xaV4Ë*H]z~h~ i0d,K8CZy{jCF')b|xNJ>V{0e#|SE1b狛*_R"37Boξ(p3_<ݥ%-tɫBetƓpx HuRuɵ)H?mf@Iz͂qrgM_D|Ce -ӯ_wCՄYK/Ԩ 佨/Y0y̸7.]*ѳa !d[m9#{-;W[ U$mb?ci3ؘsq6ĂT t֠} dlv{Fyt/ټt̰KQ8 N"4ʻc'׸Ns6I ][#?wsb,4U_ f)Eď* uä6Go76ɵ{'CGa+RUA=@5_rgs1OUG*ʚO&Q͡4%nlc=%Z vY Zeਝ4? eC` _wvĦ10KB/*Brv4όwM 0r `$CܝGa6;g-N_&ɰ.` `0M/s\PMf`p3 $A7 i c(y jӍ 5!UiMSD-rBFL&^:OF-T4w T3c q]2Rd/3U\;?Up=@b -TYRJ3O)*+sWu.[L6ǼA. 귒hoN_=C|HW Gz}w\2h{?Ur_ס,[<4DmD〷C/Fl Mr_򑹾g"P\TMIiDw$=` IӐ }6.jYx^h}]"]l -8"ӽ΃ǐL"Hڝk:^֖Tm.^@1~qxTlU#U75:LE|4&W25exz*̖̆;M0do^lpmaIS7kD#'͊$"lL?bADINmEh 8Ԍ*"vұE݌5Z5 `z~x[MN&a|b(ǁ$ch |cq)M_Ɔw>bSО$  Dpz!G@o3a]PnN2);K4 U"p+q 7bLay$04iCc9(6>E3a{ R䏡0`?s07y9'`Lq`ScLr&MP.ڽ,_ru/F=܏=1ltŜ 9>1lם -KX_t+ =#ثL -uuWK̹ u)F@jR_$YuBśGbQl+$,o8qlg!) n2QήU>Ytw(^'Y! %GU9, &>YcwU Mj"Zo6VWF9=al mynqA/2AI̐i -qAN?!9NxlbO{eiYQ̶>SZ .&sbj?1_ǡPkٟx`дY!n6fVJ?ffon06l)7BuyMAѢ&m>>Nj#4J%&|E]ۊ:i2g0io*6zXh +҂3;1"2ҍ+O?KjaY|nMHpA/LsI5cu*ΐDx!W {|mpq%qehrYbBt M7uA- -w%5,x+ z!Ί}|%wpȩxeXx|Yy$M}yAz5{+=}5"6~{άq~p^Q~Md~*XŸ~,LU~S@~5 ~+f2T"P{pUIpf P[AE;Z1ٓ0U)Fj"0΂op~7f ![BPY_EE;T\1撠C)k"djpmfr=[M,1P\ǑES;`Ћ1')}"Ρmfni=pkqr^mtolVurX wtDyw'0|Yz>̾jqźjlr`ntpu0rnvgkbtgwWIv~yCtxz0b{x|bh|~j|l|^n|~pp|j\s}AVtu[}Bw}0z~l;fׇ i -9kDmh5})oviNqꂿUtXBEv=/yVǧeP{qgi卞|l{nohLp(TsuSAv@Z/ryX_dִ2f}}hƖMk/zmtLgdojT3rxAKuI/8xσ[c&5e[}gܞrQj.xylfoDSr d@u/x\ębp vdܫg%iwy3kyenbSq@to.wUad`RfWh-xkkemn)Rq\@?t@.wZtf4uhvjxxm0xyosekz.qR|{itP?|w-~zK'rp{sqԜu#svFtgwwtudxw*Qz%x?E{zb-}|Xpzr'zssj{@(t{vxv|cwy|Qy -}>z}-R|~H(oYpq݃^s=uPt;bvSPPx <>Ay-|0m{opzrt?s^auQOw+T=y>,{¹luSmoou{psGrlatqOvk?=txj,{ @k mܖnlprxqؔM`WsNuȌ=&x,zj׫4lgmomqq0_s*9N uI_|2so|u]}@vLO}xT;"~z-*|Ly(x*yyr z$y gWTaˢĮkTd@D\dPPp-HG&]30;sCg( 1DE*n6ܵaz*&>P3ĸg| ,X񦁓`S$>BG DǕu#i#܌-`xJ!wم:(`[HWeQ2UFD`|:Cd2~TvkdEeUb2̽p ʠ~[@QdF!7H$ #dLt!BOK*G-iCrB.UlmO> ,B2W<+367ߛ@ )۠&KO 0ޏO igm82=D 4FB[!AIb4~Z *fz\OtF&ӝN&3xF[Hjz&3n14bM zB! |+ -/hw{V\lsTjg?қ۟u 깮D}û.5ʺ(wM ұ=Ljeo(u\ yPXƢ8p2232"uh0 ;(3-ybݷ3WdsF@w ,8#!H*9)iF^ -P7Dg3I33D_)JQNdOm2ta':=J.۱ -s`d+uu- ǵiȵ\L -kw/i&G1|91:H^gW@-Eif?QF?/KvřMkz݈uN0:ӎ3BJ]PU@׊VVzDPC9>RTl{=EY^ScyjN96b~mwj[ Zl'd}[YގM:tU9WI-#d=sѣS IKuƷ6i/JO{s{c@6oPU,'9cV~M6IQ1WwoT+mlF0\Od?oi4M4MC%HfM[r0p[p|R’/Ld/_c8]׍ YpFKM(Ewo@jjI0/kad[H>|/ѓL |00SVRׂV2Cæav4x,'L82'7&n&CĿf]9-f]i{Ta4EeNٟή"V_ǔ3tf65ҷ, jP6Ex)ͻUSu@6M6dFVSˬGŦwƠuy@>.TȆVOdj?#驺sycA)w,zl<ـB*7ij,\P#;}}~r4fxO"ZhNMBe@(78,iA#FaN}qǖ*lf Zۋ M2HB-7߅,yY#p9|qeےNYƐ*M}"A튘6؈U,ۅ#||(qW,esY!MANJje6Ç,}#5tPcjOf=_`rhTkHm=op2s(Hv "zbtu5k#jl_-$nnSjpDHrB=tytn2ݑOv)yL |triIs ^ٟtSuSHt#v=_.x02y)B{! -}~st(o.w]^`cCcHlVf+;t)i0aldOȯ>tsw[-wnw\-_AMb0ke#SsShA!a7kO|o>#r -v0[Dn^aaShdL%rg{`j哟On-=rfv-vm3Zp]­ `܄cr f؝C` jRNnb=q-vBw~o`^q&ccrfBti quk_wInN1yq<{u8,-}pymjynlpptnRrp/qsr_;utMwv2>@?nC)HKс#Eu$%`^>[ -(?`~^x0_+OËv&"YD>s5x']~-if~>NF" P^OG# ǖ0<7ӆ7 :sXL!kݱrx{6Rt"+@q*7k1U誘Y}(~\H`J䞂\ -52[{F;Onݦ *C{2Hpuw0D(MHOB$vKѻX{'V' 5c - -sh]T4I DGãTD(2BNlz9eB_ ݫ.#JUbGɰ Pc36߅!3?o/˼ 4Ta1l-vKWZApɾ<>\Щހka8Z5$GdW#{{ߢ! e8l&Vlu4ʚ@ԸQWJ"쎛)9(6gf y'1?JL)b쭢l]4LkۘPpuﲹ)nCA Ŷ+2dEH'Hm&Y3uѷkѽӭ1n]_Z<ڮRvӛpjm9G݂#j}dA-uڠ -0\C"dhK>مٸ:IFq\BVhF'$[I&3BtK\ D'`;I ["%#N\I -|?a8+ş3"-Aש_ZZKO%u6`X{cͯw1 $+OM{'E],jz6+~ Qk a=_/E qbVk&S7fg\"&]KOÑ: %ijeB>%j:l=T1e~/ߪg I0^YV)<^ϑ% -զՏQS-WGpaθD8ߠ9D֑ՃXM' -UJ]I"mteuuE)-3`Ҍ SoO6Ju@$ZZǚ;oam>݄92)@m{>-V|WU>r$Ӳ]qّ¸zEYuɔ>GT@蚩\'}њG9mp.d.@L4c&,r;b ӂdlt3ݦ]Q<b-w Nk k bK%H@ j"W4sf|Aa{8c%J@bW\E':Ehsř=}9fǹTW !3ߔ% פԘ]YzĀ&XIkWdPيb]9gbIi $ O1wu_)xS$P)m/UI .mpsf5Uwl}oyh 4;=DUIKSDSjj:?2*w0P4o+G4O6jeu HW)ϛ=ݮȆs51 okaIӽ֒Wo0%>#}?V5N_r}%7 -Լ{!`D}K_4 -!Q\HҽzȔHN>uA-^Ჰbg%+k58W #wi+q0khcuTT[`5Z[`J &-v**cs0:-7o3G(Z!d  z Q}vx'E}aQ#*'viƷ|'in˵Y;eR{E1vikYT24o/;K |O c -Rr_T'UtKyγzaL= zs#k)|OĀ܇:axim&&^cŽoIѓ` -W82K/ױϬ˽^ipuO:JD:WtG<8YJ] - ՄyiZP-|xm4rQe`dZH ;4SX1̚`wpu>7 H2%Cd>zES?+&e{\Q>+) ^T9ZPFV+@l@ A B -r3L2$$x *,^-ڷ[]<**RInpdk ŻΫ :C>KXi<_TTՖqcs.JmZEŒ:^΄hsVIbm8tSX&^ a*Ɋn^m=A2s^mICca|k`K{"Y١:nf,ڱW x_n~ -!f睥# Aɧo(u -gįVg攷E)?n/ؠbdSu3QQIB`\C!d -P,2QC[Pһn`RXYU^',|Y5G4-},V{:T5zGFdx|4Zٲ u'ʦ"Ww[f^'0Xcx2rKJJDJmB|CÁ=55oc/hNL9'0jI. =$!_3s^>pX0]ScԹ`gi9Q?+,O|ekkC)6bf!),MjQZF_Y[-ۈfiv&mH!`5oIxudP#F -P&h_2nnmMsC?wOt[Pk+jnA ǐHځY*zל`L﵋TL01|w:44o(%j̨5YJ_|fyl00DO+/.5T"$8[g)T`MH?Ɠ\fިÕyL/\Zj@Ν(Wڢud>P"Yd'$$ʗVJ+W>pG[^Gڻ2|M 5kci{ZJbILFPCR7<]'wKÍQXb* -$f»~ ^̈́:)]}pA(+RXzE;b1t!9ݠBj` d> !L7gh%7nׅ _Qg1R2Ǽĸ:@n\KX)'WIC0hݤ!XL}4l5 Vh2,?bLb#(sÀytk]:ibP_"2S&F ߆*:/~5l6fݻ Ӡv(l1u;8qi7mL[@Wxlg Y<#nMDyYZOEX;/C<_IfGuROM++c7S -4ƊaZԃu Mߊ]>]o/m^&=Nh̕.g*>d_$ -]koj-]wz`g`@XRSZ^6uV^og~XQ 濮a%{s Tp4{HLydW)YU&R?FD/'gH7yOG -S0᪄g :po)-.XF:e*diG{.㯙nwn.tY<"`7dsSC!x$g:SX9Y%r_']4K . q cYv.㏢Mrm*ADbW냊M1Dqby9mT'buq7Or }yXK8`微.;~1K}wҭrB;ҏޒ &6 Rr*?j䆑lugICkM|vhZYHn8VzQ3N??֫zGP5|No(RGJ[5&Hs)qq}^&2n:zǰkFmP03;7Nsi+ZiӍ ^zs7Tm , zb@p22{96ʄ/= 4)c x -t&83B-(;^SedSy7yG^H@Es7<AQ|h[\jeZҎy1|i-M']|k!3h{&m5&[KiK%}UEk̀u hT[*FkkOZ e ev]G ؼ;GLW[d;oo3xY{OEk[@|l2섐^򒼗F6a 9uUQ[Em'*uWAw:^WfAw:Rc$DZ9-N7~c - -?;A34VfO 5*DvUe_Rqr_pMv]{қ[;f4( c5ڑGdxEjO-n -| g8 KٶŲ]{r3J(?ұqlu;S7qWA}ǰ=o -nxg|GCTpTaH͗O0U`llڤClt0jh~pڱY_,x',IUjn\[M zDBb<Ô]T7S0Co}2%sF͘MQ ś!7fSѕ&.!mFk(+O Oȏ@ W1fG 0JZ-#=qb>@@gIxFz|޴\E=Yg6atҺ*SY5T9vh  %2{}n}I90v zRf8kOʼjVo:*xH3_ 6WWx4\;5juK::i7rʶYAd~X:J1<;e -(;MsrlڪU[y5vw(k --OlHWeG㐣݆L9sŠFp6i&xИp0C2}TxmCH#ѽZyڇm{+EAaWdVSy%ې8bש"SLL14$Bs&Bj&d@Y?O+82}-D^ݒD(PR{Ѭ.s!$4Pڣo\i(#u"D8 -:]C>6ڒ׶*m@1GQm lìOrusg# tk-ۤ^G) yۂ2b+PgDWB;T+4Qv{9輵;!f6~/ė|@r~EM$,<`2+oMҿ$ȵk뤆)<$\nnu|LX+z-]:r"Xꗺ.KW;–YFC :Aǔ+IU u+U>.+͋;SN@] LUXKx6 ͑8=*U4^qݗۥ>S韒+Ż eLsf v?m!'粈Yv0zْ2GwT1e{BHM, &fr(y)% P Ehl% -$EVDĶt o \~6-s//E 2<뤪t :mbpVn(Q7:ziZNl*3miИ` snX -U\Пbi0^Kc=!!{pwpyKH&Ș/UDg#M@1&yf_sIrŔ\ Bc7HexXltbu!hI -&) ֩ršbps;Cu GFq~~c6RbO'l"<͖z [T0}5y V|EWrф\2aAA0 /ɷW&aA -AK]מ q\kPU"Jѻ?W{j#'rG^$U)~VHDTup7eÊ⚊R"I^w0^+mOXiMi-T5ȝ'N]~{e r5Ճ-wA-VYF~UgBOJt8y0.{KO(vlJ uS0փyk^?6Wc+ -Cl]Eko%ݼ脦g}h0[[tVۃw,U^|}X?4:a<X s%هU)<@ZQ/[6 . 0A=fxIҗQl3\PBoJ]Դ\>[3?,ЛMOyIOi> '|2kxo6oy*Zo9XYifNP?1k𾠣 *_BupֲB[ 4Xφ}P73d"dٮ&<ăT>x4Y"GXF%Ngt2S 8.hpq܏#~2HleҢ(j =~n$ Y9PKC‰/q䢘&lrS1|8+ۺp5q Z(QӸAX!\$$$CsrL2$L%,*OQuOłBuUX뵊]xV~n,[|nC --bY@X?(e92"կ)fm6@>_|Xȼ L N+VJ2v&ǂga:y*=>C,꽅zqwΣaVbP$Ԇ3H* -|tc^7CvfCUʆN\A X)MȊQrK{Fۏe"j%hCi24.$ҲɹDӮ?2]HMtaPZ+C9J*_r%QNH4r{W) |em}^e ٻ -.v_.e'T)V4(FoUgzf0=rƣ[(hGjKҢy}%]ʟ%(y쭬0L1sR1w^NJO7 نyoxõO`i0)¿6T@JJL#״C[!)9!w+@,&TQ0GU5a -5\1(-9]s41y3yʍ/ G䇫~IĴ41_35g%@.1N§ N̡Pi'74@rz8Z? i;f -cENOri@Du{A6.ѱ>1_:, Jf?/LCNN*E]٭!mq=p)ݍ -cFMH?b;t% 7r~L&3>ﰞ~6slD'9?6T­ϙ^ 5; -k[}gX0^hq$WKJm3qV/f̔&|}31sO[9"6ε6 9K+|dj8a&kɐ=9wUͩ?|0,lugzeU,}* e-^uGSoy77bC#Qşn[,( l^ 6!ʌ>":jbiq2$V1\$ǕwkGԣQ%[`ѐJ Ή `]+Y)u!*5(HIdaoElw17hYxЈrMyA39ScLYgBل*dlQ P/Džml)IR`i?ĞAY訌:et/ ysn琸M>dSG&HPe*p:vFӫ}9|%*CdڌTm ؍θSVkq~VQ< f -CB'LH? 6ǍZWzjxA|+cshi#a43 KZr?'H:m2AĽ eЭdcM^k^Cj#,@DL2I~tHGǫJ̀e W`_qZb -"pp߄CH I&d2L)xʪ*jXEtJJ]EZ_=@XY#>(UT#tgE UO4E]cDix`Ffw0b(U -Y]sAvjfhw@A,bx#iu+E_Xx˼U-EW'_@ce2b1( h^EN -`V[@-kbn_Pe:60lu-'\j|Dme;tHGD˪&աD!ߪ@M?B=rΕtSwo2Y!;DLž]򮆁˶Rf;˷-r0ۏ첸R}"?5#mk+3((.RxP{K$ ~?uX m(U$C[KIl9vL"F]C2q.OI61Qx 1iQZxle_)O&uZCj7$6} A~8zXmb|n^i>]fQBchJDj^ k]rou#Ih -8ЂTc1)üW+-*kxueI~PE:LR] &t-¬^*$M4-bB c鎳A9ZuKDۄT}pp;dzx0w - 7 ? rlJU/3BK3hf@jm1RזD*p֓2O(Vv -ndmMAO;1S`M-a6)N˛,_ -l[c.Hі%Ŗش+#]lcٶ$ s~&b~In^Y6-쪸ʟ/FRa` Ei|o$Գh:)=kZv6g|V'E;R^t\"ZW -YnN'⢒LiK[!6bjnf$=+ *.ӃKvIchP*%zډ,1-pGsD8DC7x&X8e!j5kL4Y &XqYLA)$]s_g^.[fx́{sHq  o݌ KFaa)1$PoגיDO̐Ńwq?0$װޮxYZN8$8 _ُ$`lcZ6ݐ?ȇY+0H5zቔkQ}Ö!~QQ2&P{BcH|7gz9^sylu^A ;RckU>)vQ 8:oVcsK68#7>^nNk_<w*>mڹ3"ΨŢl` D#ޣ7W-#hD:G"DxA4 >X( 6b-X>*'qkxOOX+{5| fP|~NEzEy?|S-2<3}=`[~#ltGPj_ _߷,cn$kaM=UlMQ"gɆ 5iЉ5M%7R%qvLSG[]]M vKsw>q| -7pL=#.[CjϨ^wUOlTvCe]j20uuFfձʪ:AƆ"E*S'_ -!Z:Qpt47rv윽Ys9{<Fr׃d+G1 F~ /bm1&&x, ^ LtZnDz4g?x7o߽06m3fB|=ksΛ 4|K5~Xp%&(*,.0<664^?|X@`PsB#b$ PX<1A͹O3l.O IrOS#?UBP' -BPT;} *~>22 -EOL_~[ g ,v,cy]zFl(}FVύPq㫪J6A$*H$Ρ`v0;f×9zL2ٞQC|QM5xzAR+Ԕ k*xGjsH%Ť^Vaݼr~Lȡ3h5$؋#2'$ -,FP].V!foDc&2`* _'ǹ{# ݰw%{2>aQ*X SV*5r1V/\2dL9x~dE ]0 -^z[AKmILŤSK``;m\ojc{.]w{]}A][UT5䄚T9"#֑$-QJ֙ -(R;7n^윆a:VVTST@e& -PkLlvw6ԷU8{`>5#8-Eʦhc5Ij ɱUx(EUu=XU=ux}{tjG -4a(=Gr(nËqZTivU肝 F7 :&|ؾĮȬ8CLNlG\nt{Bvx~T2?]ъ?:B': nAS+w."nG%PBRBz^MLpz&*T@ mHh؇Dc΢&ZT_Wj 5yI5LOї5m - һE/`v0;fˡp;ϙ־A}UlK8SQC#kדtYFUVErAF̾!b7E|{e wY쓌E8T@V4U4<7IIiA(R@: j:8vug*tE@EQ*r 럄B; !rIC@V@]_ӇQ5UW/)aY/-Ry%F2"  InK/i"tY{p8d|Q\Đxi'6ĩ/UUi5gԧyebLY(ke&\1q(h-Ev;wΛ6 !5kC(xH@m՝N&וy UFeaf5n\+#$,۾.wAڐ&T%_}ؗY6"s 9G&j ơR9aWLt~-m ANv$&! 2p0t{z$?5Z uTj]Ġ`9t& f,h؈!%gS$&T<6ncK /'z&bp`F*8b(@H3x!}': yo8IP&\P{C@Rt(ɓʌ*rH1𵐗&dx'McČ`$f>m|S~䃱ؕ$x0mq]Pe& i#eF6AWB~8QChiTɞ <|]z[u*nz!bg9Ԓr3lq Xr3" >4SPh=m@A8 {Ͼ+\Ǖ--F3a@4M6;ҩ'Z8JԐpjj6 DzQ0'չ=;Qv(X N#0-z#}2Ң>ƾ#Ahw8Vw5C/[r:mU5fYH7H)N6S PX'>}<5ӽe~y'NNdtOݗdjM Z̓x3YAdECM&-ڀjG ož>ْm\-u ZTS#%xG;Ѣ8]0^`#Hƺb~ںnA-9*ViTR8 -`'yM>aATm#GђZVZ˪ݐETD_l }mϒdo8zPc)VdjGT *:YϪ z*MSqKP}W7K۫Ov*om;Czzqt}JeVl|eryItV2j)kb腳h ?|lIlN^mzQr}\E+ݫl([Xp1ٔZ[m@_Xi䮠pvfy?q)?GZ3=@W =T2lvsdrڰP챢ށzE     q5YTp -yOCŻReb &l[Ghmb9M%>]8!p~{gkl’B42?ȩVnI6 -e%2G-8o QP6ncN/J/FQ&= }-9>#, +>nƙ,Π z,>3'ЏԍI6Mo$GWdosfܐT:jGyhKڻ)k[Leٓ#ceA>Vl oiEǪ2p˪lMe.{J~IT"Cvnc53}-"ÐhI'ِ,kHM"D[YjsUZCM:fD˂+)U -Naa␽Zfk@ 0,"IBLtrAlĐ  N9Vr:#Q1ha x!coDjԀE_dLqi&]8NLSNIS/)WKlƜ5==\[jTv]٨@(WKsm!fwO)iiLڤ?鑓#tɕOL=?ٯ9,o9̳t2UAP@C6-!d!@ BB6BĂQDkop94Mre9*ӍRMd0W:rB5*G1GRBd; ib"P'dh8^`B5yϕJ\ L΄*nW2b߭L)3t*E&' sdr* i@s?/=:Vh,~ߗ;{u15k}6EnA;xobhS$u,N%ɕ8j 'q/qO=`S)г ,Tרs=@o5-z$^˚Fk3(lUA?5(!4v(_uw1ff:w-}hXKvzqAOQ NϜ@:&z$B/ $Gc*8?z0;ߗ]/ZZV#sY]X&qzlKNCd P¶GFޜ=;èj!,z5ϥ+D`C^n"NJf90 2?}ɉ=yΝi*mJnL6M$_e A ($eEU Ȁӏ^9,>IoGs}YEHBWh֯յYTwL3rS1MOeS-)*d`[hh%؝jӣ͓\$|[XRK@-_JoЌ+כŋ8V"]?/&{d_$]B?,kʯ2xF5xun#s -[oyDs?{how1,8 fL?CVAyE% -K.?)-amU [5[ڜȺMtM0o?s}*Ϝ|-.̩ {JZVu (lIneC6%FQnj̍;\M{w 564q@p${{bKXQVx &\^fA{O򒻭m.B0b @ħ/d?4m/o -y0wA6kloz=vVtbd.RC{,DŽ4]@Г zӁ4#L#y,xK|}]XÿC>A𵲇i6pD1|܎,HψP(@c ii@Rq2[eaU^FR6Jz!` {v' fQm)0}^(6Rc$5 (r~P,y9wM:(^։gDHDϡyl"0A4t!5F5bl ”#@ -)ۚ+Ou`;\ mqׂZ4++'8bqu2ǬN Gt$ F7 G,)O '6bgSo/+WuQ.mlc`rj($oQM -0rIF?i#@I_S>8Z7gW-[ܫ J?&[1Ck\B"mф;[ - 7qD -$fØt;Sj͖%qzfg,;-^Q`-}"ҘGHv- 35Sl.J7oÉ@ 5pNgmwٱٙmu*ꊸ/#7H NH  @HB\$77!PxE.ov[O8bD>Π)Q6AY-aWjLGU-oF7k1Fj@3\=ۉ <'#Gޙ?uߎo qxeP IÉh1nzY=Wu Mզgԥ'(e]-gCGi.];^ɹ>~o[?) oOP^M!=aǠtRl69m^rU4\ O%%-,O]TB*s;?Mw+Pmv{ւC)#HܥO)ih\LC.!K'b1 HQs.w{ϟ/2Tp c6#s6"bI)i+˰exVz:;9 sYAnSKG?vOW{$a R*ը1o7l ˯WC^kh+qf7 :B|J+*u}B2#PCѦˋS%e*:g cCh܁li) -`Fm5{kï 5!>s^sUXt9UJ厓7YΆ-P7 $*gz0W]yl`\:XA>s97<5'&cE=ffӕDdyix M8ZH6."4Fm Iz9)d1 ź F+)mju@a7gDfFiUcԝRڊXxi>6|XG/@@+$kaQbќ0/nMҋ]%:c!רZTxY jq4Fּ]Xyw?=5a'v:u]㌵u=,"@n9 $$!+E@AHGBBpEA."(hA P뷙ӗ}Їw -oPEiԑ9qͩ[ q)Q<\Uh.gY}WS(35QEJYj)zS h/Pk<^~'?aS| A :8}F/R+|cha - 4Y^HjZU7 -[C1 ?w<}Aw{_Kyē]Pmp\+ؐ- TźˠRVYĐ[tX;-i(i7[9GPq4zg6@0=4kֈ\c-MANTij *A+7V |ZQ4fmld/ 5@ -ݽ#]w̋Usri07mN wˌ|!WQRQIc fWlerU:Gg&{ q? -n. |f0rg$u͚B869A$Vˊ:bVoi L,EUJ@!Og)Л@v4>4=A[+g $fy4"nv,9r1gJc:5J-AYL -:J匞Y*ϗȭy5Zg!W6@@6,GDOMBӆF`+٘^-+*uj/iuUcnC9K)7hsz 5]Nٰ;Td~>TJ4& *ow} u?zXcΑggS+~P2u.3MV&*1Z,_e%I#\iPpYRg/PphmsY}~'kGs4Tj`ޅX~>3en؈24"y 'ʸq~tZh/5kofصOa8s߸F_$@3q˰>'n9;7^^^=1.5?jD'_X,D,Qn?t/J\p &w!ב0؋gTStZ*j| D„=bCB3WYx{ot}5[,w$ 4LBA#oaQQ\xąʈ}IHNK ȇߠ Ke's}*_};v$p;$p\,1~ ?$ - - ! -9~|?}SRwp^@YH{VDrqQ"Ş'VpoTU$VdDױJtzt -*BM"{i1a=~oضR[ Q!q/eUV.yVH[(`IʪYL 1KWiE2c9rg0]DgQ])ܚd]ѯWiMU}:o@:vN?ćѱ@Fq?.[cT(y1oM70œh~8Jh.#lQDҭWF[3j;E#@O<~.;YKhk&qtd=rT}J+zPUX}Ψ9gTz<#8:<1)y/%O$yevUm:>Cn^!R$,@P18Qr .eFҺs&o|<#AD1@q47剜_NJ5yvAT8a@Â*2 -hc^3~13JEi颸r!:Aj$U^NMrs!&xt~8ۀ>4@sWѴm)9PV-kQŸiP8SYFR4c4Kl] IC4<Q zás!{2 ЅfNxfKH~JμΟuF^4܊prfJ@г:6BRBd -Am-[[ꍏm@Ch[kd+>~r`vS!CkBD+Y]d=a&JD;Dlw؛7c_so` - y툈z6tk4 6֗7Z *-Kآ&%ת#qfB׆cʡ2 GMTC?.X [ZH5:Wt6譥dUEFIҬŋ(ZǗkxZ,z0= >=P~?Y9=1y~4tV$aix%A!jLsLdEԶrV!tZQ<s`i ,{߸?xQ#/Ne`%zyx+UnGz)xVY'iNCV`k"|FyT&`y'_z>#n/F\Lz2Cs/)Tb%Ӌ\8yU B+|Ȫ/: {7Ӟ޸ho;A[,8N(V'O7* xUzjޝ;Wd(aCV%l`PPyp<}捑^gՕBkQG5wa…g7pkŭYlhd˿L^b/IİK(9w} ۿy7S[Zh=(L0~l.}-ZYn@."@P -gSDFd{W5d˸:n8 \o3K>^=ݻ_%%4$&8 j%| A -oմĶ^Ƿî:fԌ& 6-LzH| b?ӑu[}U -^^_b6QYU82Tݘi-434o'iͩZRn -ZoH͟sӹ?}W>ߪm7 -b#1en ?#s"*aQ{u5k ixtJK} -LjH -0}0:[gAM vtv3tљvZuծ]uC;rCDD @ !`BBHHBr;\BZPXnŋu ؇}f~/76ذQ @Bbh\Yuun^R! lQwLs6H-M{#RpRʒKʓ7k׌MrM'?gİkS!" q8@& xw3KsޖG!禼:􊑟 %X~H<齾vmWkaİu~AD -(Dh>F,AC~I)o|J"&xŭԤǮ03bgF}PM}3-z[6|ǓoK@C' 룐A PtD`#c{xʢHjl80bÀ!s'<jc/q/Ӄ@ | -8- QMxFeU>iHR|/1{.K<['-<+AIgPW7 K g - N H]iD/X"IYEMo( -g]Ytd_6]8|pR~ =)L}Uz{@ yf4HsRA:VPRX[CYqDu*ܹr. Y%3XlsZ~=*UN^i\U^,t{gP5y - AEr(ӣAeQq>IY`<<)`?5Y^2]b+0gnϪn]T_\Vc/=˚%>x[@A#I=,-B- g Vm<Ǿ_%߭PfZewJ-۸?{5# %SryUC ݠ>Ф'XʂRlFyCrsTI0%ŭҐǞ݌!Wi KFMvWZfC?]>jqF-VTyl?d^6b#Sl0bYKO̹4KftDuE5spx!DGSvWLv|j'mmcUZգ_E&Ѕmc~0 ֑ܙyWk:nv}þv sv$4y4A֏K磻2nuJUaDG222qwQ؃RpaWPgM/ uLnmXivu:3_0%yN䍡I/ɴQ:8nj %bP,|Tv@^@q;$8ΐBOGhOtP___r:!͆i`=li_(x1ra q#Ь$ $v@mdx8$ F{8 -;("a)^STS 7 -Ә>ɟAdL bc!3쨠bUom`kRS2i@1ȏlr>>^@=͚#K+ڴW+lc4`}_81CQ~u6hxF 0l? y;H !?)|$Y"3?iV徊H!fLSI̝Itx#{vMH!!M@0cr?H+e.%fNMcH͐/dLk V-I9wȫ_G 7^P6P%Ȩea-\`XL)jYFX| ך3"紒jro/&ꀣmjv;!NzA1 -1+d)VasYV.o*X0N?'Tg<'TZs{ZI=yw)=?S4О\ p|*N{?(ы -Q#eMeXqiJѳRSFz9XFRwOMnUzwOqKqOVgKx}E5qcu(:ʢ2 R^P)R @JHC"BE0 A\ gnև}99? ^!HyYz@-F*#1KcH9}b_Rh2/s/gf 97y7 HPa 0WRX3aA *v=A)%(j*5ybf?7 +@\MH@2 P7]APeB<*#q -r|h%x\N/bz|VViè- -5(n@ -^$k -$ub -wkd߁zf0]1>F)\d7KheRUr:[Dx%2Q5I%euaYI+tJ^%(G-il \~NSyU0.FyaM𔋵dCPq d&؜L,QdJ)BJ)dB֋$SC wNyߧ6Ʈ6/> -qJhMIlm"Y+q &WQ%+ŕm -Tbs@@ӞEoܭ-~b0䤶2'rą >UepKyBBc^3XVVIqUz1 >7O;AtzB;~ICțF-LZ,8GK(^4#J]cz9@YA}O_\;nzGPLh%%lƲ.I*\Y(ؼX%mK$ik ^-!Bs@i -?lu?ov9цwD%HS2{31| -n)c!5*!/Q)Hj&I A |sPsp3F>M/Gl|tĺκ>mw3ȭUNӑ98żbt,Bw2IjVs:L&9Z&9&^ MaݕɤvOeq'Ey+_hbh'GDzCȺB(kAzE*f5Ό0"4ӌ)ftPnjXo]+o?سB쨅手e36M$Po(u -v02`Ry=0^G/z*TN k㷩a#3 -sr%ۿ -Ve ˴?si1ߓAԇaqIw3SY*v5(Y51讆to40xQ9rl|Wӆus^Y~mKw|NQ^#Bqsғi1s̈9Zn0/GϷ`{|{cn[:6-2vk-oVZm-FC q4Fcqƴ(c j&Rߕ}L{#}9,Wϼ3 , S!VCfi}ؼþMGNK?z8O.{—`bc?[BD/b>bSPo93){J<#}Yw:W@F4 WAZY۾[hΪ8,v -]#xA7̀}@a zZ`C? O-"ܖ#>65ڷ;2"{+vM%\ -ypI^vq2_gQMg9=ǥ=Gg>(*(Ȏ;Hd%| ,심@EERVOU0l*wo{_;Ci zCg н|_H)Om;ݠ0ʃ]ʬ_Y4("65p`63q' ܭc~3!>G P~؎wr+ ..:rN@uᎅEc *lظ -zHMQ xzAԾDkW pN8t8@`s$@fka;PYln "b HQƺoc.᮳cً9 ܹ11?` v뀍5}wG!Bj/YD}鈿S -+5wqY.棇xcy/q14o(v7kHx AAn8x|A -e=1ı.${5pנq -&+0ȋ9 55l eԄJtJ{UK?Mj>"k>G>EOsE7ڙ+2k1`0)쉑KxP{ -]D#؄t -J2:xՙ&V"_8Cj71RuӲ -6YPsMҹ>jY,BOz;[Rd:MRhg75V]={__Зsbc kAENBv?k|?0j78H89PE --aoPoꤜYB#k 5*a\pP&k, -E|>O<3KbXC㟡m+y~oߛ`b<&Uȥ\59颦lY€VɋTg*uũ 6cdJ3Ft@6cv`^GKq;}^] -h;c;H N]/eS  VUfRe $7eMZYWF0W-3|@oΗ l1a ؜um%]V;B=vB\pW-%\gKERSy*ʐU(E_0}&79 @͟ -S߮\tncuO:>hp{+!Z#9RM2Ǫ* KH)T*mN6M2յ4\DgB9_2?B p%MumwuL@#pBA^ ST::8iQimlY"YY9}^Pd9(R6 D)LI3 %8)|'r2$E9)yW ro?(}Sӑ) ֩ COǥ]%c7M5Y,iY!iFy-_RM-ϻR?{9,Rl|RRF$5tYqE7 )ɏ<ޑ)  Y4PSF5;/xWg-^f72.ԊU!AyW2*R/}8Bfzc%9gʥAgjĥ:NwJCrgECzu6Wzsmsw~a5eJmN qȈԪkRbWH:&*_V/+w_rDgfIkU[4Pe1vGO}MO@ٛK_omϕY' YwFHNM?x=G_sb:Uݔɬyɮ|ɭRAb/+զtU|J -WmR}mNW)6'|cDŽ6%ňw3\Heܩ%w_J{1 GV(d2*uTnVyxիE5.vmyN5ҏ.b< >oDrZc}[-U$rD$j {.TB2/^#.SjПS3gi{ݒ>'Oqb_B]\~gݑ&ft{w t\ ꨎltz9)z68D WoZ?u#ꇗT ,iCzҏNF<,iQL?ЛO`S,W}ueyUL+vS;3$~S' j#*eߩ]o^T,7Y+O;'=#e4@ӑ/rdbO,B&xȏYhuX#wvݗ -C3깢L!rL:{NFN&&%ST˴}P<4Mt -/fVwWkS%*4ҩǡ; Ra:6p`F~ 0cFnuF##G! -E$Ks@9]0D Te8v,`X` N70I>~ r>ę["fȱ2E>ރwf6uw r3W)˕ 0b -WS $x9[LkpXBA{c7$;C#@!MO/ X/AbAh)c52 -E0"Z+l xj=ir$5w« /Urc3\嬃hD1w!av%8?)b|Jؠs~S6$ o=OQ3MAdpm:f2ɷ@Hq$KˡS YeLT~Sz7I}t _(Âh#t! NuM5exuH،x1bCp = Ȣ{v)Ki5)Zޤw=@0A}N7PF,`Ȅݾr<`&OlX+m$9CiFg#Zd= ̠W5o*oQ+~(F{.0F0Lw$sD% lggEw:v/@2ڿ.bϰ=l.R-:{RUp#V$BB Y$9Y$0Baod(PW+^!,E^y>9/yw}qzP!qO( CT=gd W o#oŸ_F M"#Q/IѯȷP(7b5. 0w~B~`9PXT?9; @X\V?, !tǻ4̡Y%ԴjH#uz:~CCoX}:No\{5MU?ͯO+r3nwfB` 9HY}LpuD(09ZMF5M.t+y&A ?,'L2򤨈2% `uM%;Ěsy~QC| %'bzjb72zjRXMI\I-)'Kb mB\@ḨOH8Ww~rCsk 3s63Q64r6[!¶K&~˙F"D]?L 49.5%Y =7pH`1],Y1W|rTMOweC/0m|L"H -Qo\JhKٍU}_6HϵIӹ{n OO?|{e/ʏU{Pu''L٠KT2^fq OhgK ^\RQ?& -lLjwxѬw݂{"YMв֞\;Tw}˄ nʦD֤ctB5YN7)S92 C'NEEC,PGI1YR PJ[rY¹}'}K5Uv Y/Ηg1c|I'SCR(NYd*R!Z2_ɞ*!hTAc2px3H]}=@]_Y0^}gwt# cOU EttAVJNSrY&U+UJJE1HaU@5ikwxN|ҹk5zC'KԘ<^-j3$/K5u&-Qp5 J暒Qr4rn,Am@7dK[>Tluٰ}së otxՕ`ߦ*P'B2p5 (\R' G&w5\gZ׻^<|}WwVPr9꘩{.+a%R!(Pq9g83mRa. $rt >SWV:rk>WX}rKEGK 2؀9ZG@$Ub\TDc+شB-h.YK}6(E[%XӸ$.wBly; -OU+ڼGr꽳ݳҚ7y(n)(A=Ǯ52:ZVf$+̂J]#EOP)=@/q֯/qxpoӡrΟ}=K+3FNȺ :VMi ӒLC5vDS7<]~QmP.rF/Pm`C߽yݏ:6Žў%GVg  uDЏ fB)7^^Lu)6Z2>u䝆c Ъh](VED$ -*d/FI - Œb#ngT-.uGܷ0n -B39+r?%RC]9˻RzU.y;w;l`Wqy-g?cS_iy=*| BKZJO6>b)MSXT*4VUj^cu:ZvctWn`>ӳ~˴[9N;W/9'%j:f8#mϲLviTv:^֚ۖǔ.[Wd1uV#eߴj%?Pbv$k4mv!&2yҶ]7tG۝8 /t)]8IWN0׵^bvWrRsLyc?=*˷ /m $KQ TL eP`F80+c_ĴŦXJU$& U% J>=r25j"#C##KnD]=q=ɑgDGw>ѝW!p|!ݲ7=^Jp|Rq^>(9!Q( HaY1!;BG.;QȞX?2n )~c3:Q/H&à r"d(|!/1B?T`GMG b ֶj+}<Aw#` 'p3nI`ǃѴ(ȦG@=# :d Ry=[9}Ʀ߷ V|aStD}Hp GP''C>i>ԓ}<9S|P6%_z=P5uv1 ġP/r. ܙIH@Z^(%Q| DJ/&8X`a:$I!a xa;{K!Ȉra93aӡ@ -eqqu1Syn-\Hnlf裆XT?go"aHi9C -crY3aaH @FVҖECm<$ 1n&x k&i}V3 #~{Pi کaa5, >.A C+Ĺ!<20DC:oe@Xu QS|pS\(nD{;rPo,'!6@f A c8Lש( _6 hLj] -䛙āh'#NwY3a)X<,a&Fc42Q)mkD,Bg_ ܒZTO.P&6+%_e- / _'E}4pR4Bo`,L\jV[x~IvX%=!+9x-7+__)[T-=YsSn\V/*G5f. 9sPl8PY^X#*EP.r`i^|onI)k-筮EҗvElSecM셦Y֓~G>A^W֯;8"߇UcPwGs-}5bc)pڳS2$kw[4UՇ5wtO7T]Kzuᔦp?VM63rz\?Y Brs9z!p2;ik#|r[a[!g=,Ʈlׂw1XWef ƫVD)tL^Nn?Γ8rFJF7qxg3Pr|UO3& S5`їƽ}/0~_5t<᳷9h[C䙆xO$_TN r0󖻍\g'9YߎAZ-՘MOd%LM59U}v!5J@XĖ1fGyPdвp.O80v9f< smOvcb8fZp(%-$T,,5K34HDuQP"KٗdZN<9\vupdi}{>Q `>7ZNHM$RCÆGda+2ZB'pĂp2SHr] -j yhC_K^hyb5b=lО# pQ,[8XG*cE_ODNCVNš)i8GU;ۈ&_HfPHZ!I!q"EmB"~>"pg#!(Ohg3aNQ4NB8kC{-!v,t5J d @T~|p7c1?#HKAo*V"t@' @ P{}dY7` -b u: Z34b(@,i!֡%`D(0~N} G69?CL  [(B[= q.Ш=4Bqq%xg`]y=;{5x5,k 2)Blp'0\Wx@c2;U ._ QM;#tp[\6scc~pG{ÜʘT e0} 5alZ(~'gYb.cny8=לOO11v -{*D̿D[!އ-L쑾h hśH 1%:K谺8|H!rP6 ca=,(^%~wBx/[bE܋=!9a grܑN6C=ڵQTUnE/?%'bW/wsᓸےRȬCAIɃL;8bXɜ!|n>sZzs~Ē7 ѯ4[؝>sQSYr_?ߓߑǷKWҋayu!CNF -;ڢ0xǡؐ|Ѹ#i{KcmJqkjobMZ:Oo tgw%;y}w,p>zݭB/M6小\!8D߲^7ZՐUPq̸%5:=iszGRUgcefobEf -b,g":z_Jמ 獡#NvF:unrsԱLvSQpxWZy}&6K&w*簩2yCgu9Irr{A"rYLtފ#oserɁ`{&^ɛu6LfJSdSy:qMP\Tee`KBE~Cb2isjrqؤϷ&,%!T ; (]@{:!PRB( R'DD H*" qwPagȇ99ߒs9I$(BVK S%> ~"^=7y^as`&ETSYAʨcGq'y3좂s‚nÔ/.w-XOlDde1%PD _*s:bhqИvN~Vqt`~xv>ǵ6Ç_TSq4Һ"މDnW49z)p}8EGדrlD@`VFExߡ³JdT=bH2`#7>"ak{?~л>;0y&6)!3)l09l:`9e̒ (FPyyX햅#`\/X˜pQ<cr9Ut(PZ=/2*PmC|zu;+lrJ'&I̩ZgTn$VlDt_$ X' ڤEmۓJper7ujRzdYgg穾P3Qֵ]SNA&&t.C#I.^hz-;XO#v>c>N6nkRlrk}xg.+98=7Q; pa``4ݣARP.F}CycJO$ ]ㅾjQPpav:MaC/ao,lfʹ%?wHo, ןDY\$o4(^U5"kUfJglYsVXV^ R x_md-;]:fֳ{l`^`h>jd~rgc" t^hXx@@!`CӘJ*䣃t'w9O~[=>*~fnsK;jZ|[=8t#42B/kd@su:pPQD-JSь6t7t䌞[_Ce!S -"gf(`*`Tݍ=.ne4.OH"Q(D'P\ЈhCFG t}JaFK!k.:7ict5A=Ș0EƬ_lWXi?M12qJ$ވ:&$*eQyPEY+:긺 (# ~| G E 3N:8ͺ;8Oz@5!8&cǴ -|5;Gk :{nq#x9g 8fӸ/<.ou[@1?s!p@3 if o^9-j y;Rf5@nrv' tR/2}e_^S\?zqfLxÞ7$>hp ANAF\2r6hjіI,[t;RZq3~.Ӿg\^3E&$ߑN_%| -, @`iRkCٽV@8y5l 9H:ff -(wĬMқ\?'?z u:Lw~v{ S?xJ;oe;5CB"/oSlKlYk3)Nd;9ut3{ܟ1N|ʸI/WIs >@e@>AngkJXO]%i2Bӟ֯eǤ鎣2Մ!n 1!ktkk:K7J?(}\[0G}Eb=l AdHQ@[!Mڮ{W{zn4yX)(6~;aj<ⵠ*+6EI>9?nj3qf K10$H 0<_^ ꝉh4 ]\ܒ\w,_!5{omwrqqQ{/3=.iH}!徽jϾ&)id`Oˬc6'vMUE]sz=H٤[ ע/Kj{FܕXRgkܴ?ZWLdUE7pQ=’_DőEQoQ3C:~AW= 1%ޙhFIiV V\-[SOxgWVS{zTg*|$1ZpqXqU_-khbOc/scs^r⦅sx!!n꽫QZM}y6Tvnj -Ҁ' ;#=T>)2U>(I*ي.Q$]qWVS4)u߀`_vP@cMjM給`:IkOk[ -lZ -ϗΉ#j3I%iCibVvr/]$8)NIC5Cǝ/: ;/1n&K `ŏX4jFtM@- - aPBzVYaLYㅘk|kObX3ٱ~&6r6ȻOOG6ɠDW9i"ӽQEhƜ ,0b*e9,'aՖS3c3{DQ4H0)ځPqE! -<Q=0i` 4LOt=.a.ʰ"aDCE4TQDU8 cPf([ .Rn(ASxX9xG r09ACڗZ1Jj ֨IGբ8hJ*\'8(>M\'ot b`8dLT;YR6*q~uF.J=QrNި?(KGyR$%zQQţGC1 0Vg်Qf@e;b/CxbQި$D*,,  ]彂w9zЧ[0OE-z c LZ` -c16\0j -#ڭaMzo0|?@uDЧj*[>*/x}P~|ݣ|ݥBY0< }c% \*fS1wM\H tdrtqƽ7jCd n]7{G}^kNtiD/5D/4Dj=|f~Rc5uԙqIDQ⊈ȾCHrsH }; - -#xZʴiZԱuZ>sx9||񐊵n.5YMAJ"KA 5 *#pL6#-pͶz7ӦJWn]Rc&S٥";H+,%p jHVJbe)Qa^b(,D y)|Z)qn3כ X)a zmVoRG,K)kȫvٕɎ|3LV&V%XU?@Uw(1ſ!1Ő(ZeW0Wi x6}=A{a.'M6eKȞ&!>6!$.ݙ[+tOfUUFW#ȑWy{R"wypьÝs8>Zﵡ7"fi-hgMoKKiIuHl7Iz7QCi -n -\+k{'B>p6?7{qevCd]@?ߓv> eЛbw8Gv廝xw{S;|)W[E?r/~V迒g9jfjk`s@=aSN3w1_3"ܑН]QM^i@AH ,!!   aȢ ѶNjkkGfܵ"hE .qj3/s{{sfW/=4rl4:&eUԉU'br(PV_}P#>NW8,9u >K~i]ԅ܋/a坟ÝyDUD^Rj NOD{Z\oO#"V7ЊwXN)iQOͿjr˹jʺZ\25/$7'6}&o 7}״Gm:i=ic l:;wP^Ս Ϳ㌊|QMD[}fpNۊ<zǷ1tmk|cm_blԶݜǸv ?6OvwP;;ye*pALdRԩ3vΰOJuvuO*vt/v^^ٳK޳[s.=͐^cHzak=U>GhùwK[w@9(+JcԾ"_L+)qZ;@U=h̦E;ȇ#J$ëpKi -נZV7n7ˁp;8]~QBi8 c>H7'""zBJ*'T"}kC]dR!EBXd/48pܑ~p֑ ͎,xx5quoC('u"4c )d $L.9t?$\0Q ‚̷C|n Pݠ}f>g#Ѕf!8w - -W(|!g5q ̤+$a.9N )Br=H$$(H-@TPiwgpZwl!_t1 b v{ cbh01dU!$Ą Va8*Ĥ@= >re(>/}K _2AR]`O!tZ -WR`HR~E$bP -ev0CKq'@7' - r\>&@~ aأ+{X>߀8rɀ7(qVH pIj*$&9f̙!vh7z+bMDbGd*FU'9oTת+-Πӧ<S@?IH䓐0)IO0M_=_3[|5略3h5gx/4x57xk}10=c ֟.)~ HEnZ{4:ML5y$҇V'c0l{nj]^An}SwQDMЮ$M|[:A8n@,ҘHB>#/~|qĒ2U<}̷;u 3+ޣ&Op/Bh3Pxtp_t=ᙨ*рK_걺I& (NBQ(e(:\ Ź77ǽ#g={ U[Zm7SH!zʿE-!ƚ+ƛ9ji&"N}} {o7sY Rʳj)s\ΞMoBVkNŲZД!cR֐ȧ̻$VqSmDcYi@~<4VJ' s<0,bK%!dW"fŹbR~]ʀs> *SINf패';Q̨<Ѡs,AeԽ"xBBZuh)MְBXRȶ[ȯ)\.<9q]QMi$((H*"@V,f5@ !LK@(h5x92NGǶsȇ߹~z}c)̓*u96Ϝ e^*3WuZM?YP2r}mob ZfkVPa~RM|%Qz|Ǹ$~(ŵO%n -%ZnUSOPj8=G`ߡ_ҥhܟ)<fA%z)U#%ܫefeE䶉ò3. ҼMBZ P+ڰ¦9$P%+2-%&DqlZ`ߗ+ ks9l3k2"Z*?﯊"you@+a{6 }jKKKbA*huE!j iTo5&#YP>e~L`C&ZSXQr5\k޸qM>ʮSkMmeCJ)׻_V& *W"5QXN< @>Bsoh\!B-"y3$0T`½z5:<̶ɖøPFm[ÉZUGJ>EMʪ|oHY8T*Wy-$W6Ec-sFF*"odRJ,48X`f:` -ؼbt̡Bpק{+y~š@~,6<_ɮdUL2d tt[Z?tBɐ!䭐\oJީr1p {@0uָ]r]Ky뀨1dzX]ksTu -BV&*)LU*CqP|Ce¬Aȿ!mpLp~Wy z{ô1){˻O9w&)HWԖu㕧4K3!i03"Y3JJTϑ+ r|ȭ^:OuW) {hshF}p|f+iZ@՜#H1\%wc홗.:3.f$p㦥NNzj5y˟>?}?Oq$6nfDgpG p =I=@+B;D7xxK>ؼ04+6g|`rŁfڵCk3eO=IW_zFοC#fwv~Qir -os+ k cLV-&۞˲?f`;Dx; ejgA'зhv 7|fkg/] z ٿկ{x`),@ [ߙ@C 8`64f1ƳGm4c5ȵ4W+jv8N Z] _;{ z LpA8"4```"pP, RFC` -l¥zb'&jA'^R -4TxPQ HG</chm6F&Vjr -l&e -#n#D -eSNCCC@:*"=S,kP%;LQRBlt$js_%nsFΐـ޻9sG^xWSo-Tj}'润 MuyVMg/hF5DӠDdEa0$L!g*Si=j0DG3t9G.ߌzFZd-tm%mӅZ!?9rNGؠq;EQ=QGNZ (M4LfΙIJz{zX[3ح ټkqyVcW\YgCSǟ"8(s9~P~Tx>좸6xx!IM8JEo`iǒ7g`Yûl;x -ʩg[at5#}!UgєPp6i 6-)>$VG7yTE_UF?UcP=LxI ds0<Z@{-ΑR.¸j8]ECF.-D -ǣ_:N N&!Ƚ2~"RVws܏^ZqO%(ߓok"!dc@13E4wкXD]c[lظ ]lq|,úՙ3 -\+ֹM.}7מEIRN+g^3?*I1ބS8Ä́!9&1<&_b7r2Wi1_ì͍dIUTfgT6k^QIɷ<^3{{j϶:-畅w_u+7nJG騘=C<R}ZVry^).jpdI*/Wy`vs-q-[ 5gdBV.YMY2O(g6yK.omZ>a"^.#NzK\ g8@U+beV%y:Ewn_Bu.Ϩ<PD H)#LQA,"tІFpF RD *1XQp]f%'nf=G}s=WR*x-^nAIܐ84wQSQQ;aQP_B61xCTT0^,p̕_-]Qךnܔm^`UfWH+v)OmRIޒ)ܤ޹oEDBLH$ oA26.98]pfnt.*[;hQ]&8+e6lDzBY[Q+HouSEg|2R>H{-H#BK&E20\ߖpQ )qXt)*+4W֕V"ҭ &ۖg:J $\IN^vNWFv -h[i Q^R"K0T꺭bQ#U+,-}).$)" -&{d1pq5k7٨&+46r5 j:^q:(X̝),dEK9wkE5/snAph}OQQQF_,Õ2ڃJwfm4Յlț5{V5d7DbRd+>6)uSu墈&ކ.uCq~hН) -Sxgz7.^܃ZZi>5Pt:2e^iRuI*Knm7rKs=M2 JnHC{p OpCpC:=zW? --4 ]@e*{磤ϖ)sg.VY97[pp֮(f):v!;ikw۪n{B.^R=lRMPzA]H-u̕IrbVύ>u4BcuGLBd.XPWvﰢqy7N}7{;s& 9:t}C@HĶQc$:2%@`u#BF6_s*ppqp5~'[-LjL.7h2h1=D[!b܍Y?.b/Qߪr#icؤ#7&s,17]Կ+_6dǁ\DU#c$&3+Y+&lU}'|2爦4SJM&-m):S]{ýqwx+}P2 -d.W)6ncmm,m -ib191 qBG|KV@E1aɂ:3jQ!9N,vP>'Sߨ־XԤN]O}&gI}D]\wa% R)i~=>BO͂82ٙ!.g.CX~خe6JlQ*\iTS@H.!y`b FdA@A 4 aJ"cD'( -(
Pϱ+߱}`:{uI ,c`#ց]{I|OdE?Xc{< -8b¯37*535.ClU4-B 8۰::paQpڱX'v1e| 2F9#a[ lA{̷Sɥ,s0\; -"_ h@ |9 fрW2:pb5 a|'&Gq b{̽D|^'Fa7BMhXt'=o) <_YؗڝW(5ܞdZnQcU!-[j!.z5{%-dp_jI:Pw1 d_hwWеL*D:臕fJ>Y)hץ(Sc +e&Ir2j}S_l_W- TC|)3I]':&ͺ(f^zLd/.XBVJ/)y+nd)˼hYh=w2٬ )vQ,yvi%)YaYYWCoadbτd`Π6AfҊ`u ؋M,hSbE nU/*H,X%%.ls>abAǐSN7=p w -%!9kųx)-vbE8{`u,= -*̃/ŖŔ fL7=[+"|WhW+BwK' ,:}mDss^R(shRX\)wPCTffU*'EL;mV1$bل-mWC_^!S~\[~ uI}q-v P߻`G)@N9@ΡKհSk -km N3<:fjm0ormڹ55K֤Uk|YxWWENѨQ?Jw0%wrf@Rɼe%ǘג3Ly)P@w_wOqץu*N:ڕyw[6~_U%1/;{xb ؅>K= c.Ul&׮VsǭX[-uMu^uY~%U4uyqx"*ʡvlC5ިxxŃJs`Vm\clTf3iwNl׶ݴMnc3w<>]لmqN -`TRiyFxs.q|r۵yyo띭}w8>9|nrolʖҵ-ˤe=UΧ䋜o)`"<#“QZ2\b$D+ mk ݾKvxr~Kqf(/]p6Q43` (; e /r*x> ].K< ^9e>gx:,fٌ M`tWDL+p`_+ǐ5|U"wxP w`EĄ+͸EQ"\!dAל8#P ܆Vk=!㼽ay4gTh֩ȑtG] ;z6& -,}sQD%IV%~pYJFii~Nu?V,'ZBsS` 9}yt{\T_b޼1zDw5Q]_Z|#x~sKn)$U9 48U*婄\C"⁒RX?"ZB =zOᨮFgyfG*˒V{3f{OBlMz 4eεFO >pZ`JUD/y:Ľr y̿_ # C{-4k-CF(^ԽfjppQ0f|7\^a3d{wUҕiM դ 0ь]}QNbWT.ŪUV^+1\"h:еg=Փp>j --b oЫ*CH׵Gh(MAcj1:QLtwxBOg tZf݈kVߙ^b]jP!SXIsGN/l7O3y|-0?a LYB6b>@p-3(.7RFvsնD7ó2?YWyĪw6vXhŽ]ٖ eɳјJgg]ȳfPQ%L^`}a`aQ PD0÷Q )Fal7Ls:q&3sޜ0e \[%%I8ù s>pٴi -]ʞQK @ ?IoUWp㠻6DC{=7ff:47BsP u~ڪ`v? lo>mnVGA '&:n1ߒBӡC U(| YO"$=3!Q2 @ׄBz=HfX0IF)_u@wPlP ( PC2hM? tB"A -kSRsӚEs@a=2`8Ȩl3q}JCHb >$L$)^>8qZt^wK-uD'3Ÿ2q'vABpaRNH^ɛB~ CXHPCnnDOZu T 52^HF"$W셺=W3uЯGnj6{ΆF.f#W'~#{;֫e=֥?:CןdNvå_…VW.D.rah+i 8Jc=a} Xa2bak7lcwݿfwܳmЗH=_2p5YIr4'jqbjQ3o7>xDxG#G퍼y13K~{ԷofÆ_$TT.nTwR7\v43g7p$I42w7y Y<=Aߎ~m1[b~(h-hHh\`%li<?"ﻝAtWΰ)83Aq^aQYpZӀ4ۥWsN)LjK$4%Ygu 煵Dğ |1SPk_yd`ZT[0VFr2zeN -K<׭EhJ3y5YxS}k]|tDP%VHEfuIcQؘo1}c%殺9Us0clƐfӧveٷ͙.J[}FG]z%WPt!A|BT*˗$S^X`EаtP7)r>0Oc m@o6Sm9`ߨIvV8ת\+Urg̬-l/VʣBYNxBKdń3_ ܣگ逋"`~ǸCBGGAӢñG%8XrӜ+wcNg3de7 }|aQ$G}%@~HJQbB'Ry"es8Ba+z|tٰ֠iEU9H.%:!_YW˫mks{H=%Qi/dj )Բb-in({HWFG'5ԗ25e;8a\sI}iqp)2t|b -~VA `T;!V.J亻r'?$ -K߱!u="!{KsH_[p"$bP[*( b ݜB~xmuSv%2MYY^aS̃$0(8qKQ[Q&']%3ZZ:WtCY?֠ȺYwrpnvC}V}^8vw֕z&Vk}j15,(-aW¨/U V]uTz>+C4-(lA~*h7#};jdEqmim2Gi9%5\y볿_x,?:_/aa ճ`>GSʹ -]=m]]@^7^/dٿA0Xnb>/!W[cv 幷%ޮB:B:㦉fz~t.tV.=Q7![@$oGx(3͉OF"Ʋ9u5ctmim##?r>o<Y, Q}hPv ec@¤b=%F:ފ] gBgb=3) ΙmU?nqxkzq 7/ޜS'Xc@ -v>ʵ sH:D&u9_[sc>oχ`|mq2oTh3q6٬܍~Ivl?ᮝn9~Wc2 Ng9ឋ@e.,x p iq6.a]xj_Ǻ%,e%V/YUKʥ#LyFr6#Y,/<爯1E#T{'trcIICm׀759`w -ﮃ^ł_9}PV )x=χ_u1>FH}oM+@ lzx> չle D((`W% 1`A,H@Dņ(< C-O1D!ODQDĂg0;=;{9F 9PY0s C Yҿ#DHNb:D X -ACFr<(g3J,Z=X=OZ8 `] h%+"6!j&;@:5ͣ1n@hm -}k7jGK(]48Zw }0`W.e@~5Gn+jM :kRsG?:=@ON}DoG=b{}`]$7bu)bѽ5t?+f 5(F?C?b>`hUŗ`RwŮ`0o4H%$"H>)k xCxjth(m0k0QLɼLDcOWI%KrW߀|ExNyn@߅BV5ջ ]x)[,<:t6ᑬt7J+&BZ7pC]h2ehTsE9塡|(T7Tj -:U3PŸ@7QMVen)wr{q]yMWՌCkp^øZsƝ{=fKm`f9/c)QDy P+Kz?'\z?#qnU듸c>;sC V}ҮBܾUXfLXD%L3lw`φ1H6G[g\qǜqy,wy"y_sW8-q;-v\#,s:Jvv:;9:wlqfLm|N:h{u A!8bnqm* -[u_epKؐ**2,m7֛l1l5)0.7TJ6 W\:dk\^V2Yg`(vF#9. % }#cwJFscS[ŋ6-X f%YZ=_ڽXU9 ֥t'+mZ#PM88>(cEV~O8qT oDѺk6+Y"ʐ-ʑg{fzmS,maeye//L:}?>4sЬD}>͟Po ;`k@xry`A1Zѓ٣L2eit,ET-RBg}[~=h(1:ӑ (X2 d 3lj2|/N&I I?Wbиlqr1_5׸S3Xejf<.iSGCp" -80(ٯ[u^ȉ̘AȈҢ}QXqR9Ӥ'S E ]|j)ǻMk"-&1sT?pjPEq췍Ҽ3NZ,ҿqBj;(v<.@0wlpvL8!f)xy\ԨLȵ" uyGEuqwgfd`.誈i*e60 URUZb2XYK(nQ@M\)GO-hknQ999s{}b<31=uO\u]D1D[~:s[<ס='ˍykP0e P0I(HҜy2s&3.N#56CiuXShvNޠGGp>36o_kE QY|7jdYc?4bIQ4I\tl-4 6)1D")!ΐc/T+b۵ \z/NFŋ~>\3T`'ٔuy%&G,5E^rR!+ea򗤚a6IѶE -$}LR¤r'Vaܦ 7w 3wY`%Rf5Q|'&`_ԥ;I 2ۭ^8cGbt8Nşi kܭz a5_b[7 W`=.Z -׆]4T[]Mo:`+@. -L p? f' iA̓0 8 ׃S -{t{Ȁ>-fn)Eϖ:4@ro9tXr0y TO&`R3`Q19*hZ]nusp2Nm U{0C{2OAy -vP7A%PJ^uqW}@w&cN7sG80u -p>-*ka{l(H/xArA$upup}DwPA;6yDt3=S-iw8O.ձ]#Zr_`HD)PY^K:_KFn )kp9}5O= G; pKŦ@ ؋+p By:xyDM?} :[KWO21 F.~EG+#ɗK q_po-~#nT]:˪^nb -8K!N>C<O}'iǠd[[k;ϯEf\ wNrgũ!p/394L`""}*/@%Spk6\KÍ8†NQp: -jp2`9Nű yy9t>`:G}vm(/cH?5'Ip?P;2z4.c: 'i8ڍVW0.bfzWt[=h/ - n{h˸_E zyɓTb5 O7?OEOHhq`t Dg)`Cʘ!]Zv{*vkphsѦŭ!CΉׇ7OZ4gI{Y*w}? A/zPg&2S:Qh MP3}:5<@SnT6hZ4uuqUҠ%YVkNq+5WSHOQZ*HyYITꩤމ&8biޡ'H}1 -"'b{d86Gji`6D3-vv]m / %^^%^DR[- & +[v\^'_H {BWG7&3ҿ| )-F{lM16ͱhIbƤ2l}C<@,L\5G$jW3NpZzfyմyQG}*.*D=P̎NQ-xyO |JOi:D'mxZѬSQ7uOg x $>[TujZ*W+F^kSRΌUighUjP yj9n/L]ns!I!X2)!K CmJ,S,HNe'e%9ĕىeܬJiybLR^[(TĻ|~$A& \9 4{IF ǪXnZ㻨1b12h![\npI%\BZ_ +/7+)ەN}?&zAI(^s?dN~7_mSJ<ñ TMAeZ$Sa2s -[jfKS\q7K]*Ӵ'Ԥ1n},)F??2 J/W袙h!kS.s(N9]Q;yIq#IlĦ3Ein8U(1} -$pGn?cUk(b,% J,v-I.. Eu݊#ʘOʘA'GHotE,9g0@X3}9ݓT84ɬOOZqIP/y_,*ʷ8o{PzN-gߑn1>c ӧ#% iJ-,KRĦwIp^4;D!:gk{Re܋$$ӻ0 -Lg6)C8cl7FgaTV?x B\,Il|ଥҨղYeY&rM"<'"*WB[+XIYIoR٢M^s=\wD\C5`0D"83ƹBqfL7JHCvKCviH#iȆe!Ԧ.e.I -^ ̦{~F`8[֘B99c@"u(AxI$ %_2JF_Tf!شzS۴Ne*Kv -PrQ? -_H -\ la d5i!݉tOR r+ZJWޕeE9X 0e,sòb 3КB[m(xuQ!b#IY}XLa[8 l5N /xF6#n7LŖ-lڶ* joAe}u͏Dt##s*g16Jҿ< pnPBUNP6t>2 kgBCfQttR@Z| 01O'06 z? 'Q@86!=Õx-~ 0h兠V>xڸ\[ 9/G0+"<5`#Ha 8iAu#y㼖➼ ŜG;/"WX_B_-'{9ȍN2I{F(;޾^S@y\|N u'^5Mw6'݁t$jV; . ={\\ ry =f -0^-z~I8m|E&w͜>ɤDtح;DM"P2$ydIOK exJVғ;؀DW!-tUU񭸆2Gq?"G@ο\!/"o™89iͦ=zГQ3pkMrpqUFjFgъSm$3‘O"%Cpb.đh8!x ܒNuY"o$[ TY:Sf*/G|6Eр&E :=؝~@JDd j|<\5x]7\uK18 Ψ)ؐ<޷=||E>86pcQgvǡJ? -`>e TNXI(ћ`Pl67HCNI6ܒCHrCEIίx̲\fimc?p}a2lEa$&4lLY(6COBao/}\)A55J .{]8..]n r[ۊ(%*XԱmSӦi3δv!mӴt2M3Mil/2f9ߞ>f&mJ`OfO-'_Ʌɍˍ "ܱj}6p/{Vp\qz܊5)hF+" ӚjLjIMs"fÙ!v43gNsCܠ"\4wYSe}~@DPCܦ+;t/m"hUc*7'sMέdFNfXa젶 i{~0ק=hgnK.UEg_  yyBrpeCmnNSgcDǐނA}ۘ~#ۥ悺\noӝQ ~+BY_٤+Ш>BIN1@QD,60aL@ش æ4g"dGٌt*tUVG5U~B$Zʜ5!M^Z{&Mpݵ6W&dw*&]g] ] -+"\F5uWep2CiJi -zE{RpqbS#uEuSnCw}jwςb_c٘B5Y3xwZ. -וywy_sjJ`&FOy]7Gif-PO՟ -f"1j=d\?_T䴼n"[n~i~-J#0GLQ;;ZPŽ0wn)j2@eE~W9tYV2s܁wyu65WGyu7HJxZ)st~P@1лoA^nhRqp@P>CfdJ U!#:¤zq65qMMKr)=kJu.ӞF D5-ʞ[ -d!st#2ƶc8ia=R|+,a_؉pH0ç] M&)|II74eָLZqhcq=dLO ej=N'$$O`fbI"qH+FB3sH\3oFH28O1p#Mύ!Z-v87 dRLL=e\,'`f< )H\8شhlX|s/#~qxqo n=<9) Ch_$uh -ПfIH^6]p) D"\ށX"vŌu+XEJʕA|-p~I|gėPG@pS%gi9i%ҿL/וP1M}SQQB_CRJSNhHER !|dB29>eȲZfǚ550żmw\]繟њ@ҚCeSeSE؈xxu`E D994|Cݬ`@c\ 0^_o !(`$' NRp>ٜ69mV<Z[9ɭ u;yr)ɘ+ƫf0jRӢ P676 -}@R;Nl_lL:X;:8 u'F7yۀ܋ouQ`= PSy -*_6XAEl<sDw' L7;0x0ZSלV/R"ȭN'w97?=G3sǼBOٌ<݋*%_꺑aуBFqd$$o+%9V)6 *5 Gp-'.o Y]> C+"/NyYG(2ꬢ:lΧq&9[<`_Gz)s 1'#`uQ/Z)ʤN`uSJY1ks4r.f~/Ȣ!ӝ7:WGP3ٌV"uC.b,lN%3_gpqoZ躙Y<8I + ᧾dJQϟ0ԊhI>K\P\͜E140M\ts :k42JC斒e.F` J.$A"gѦV84%^:e^.R/NZ*4؉zzu uawc3vE= 2,wwȍ>6^X㴱;MI(M"pX2 ʏqPze6>WNbOr۱t?63/QmvU揱-xN,+? bIaJ.l?=*q|]?o쵘ݖѨ)nyfQ%*W`U56YQ1 ^GXmnzxj3%Gyg{GFhh:!m3;m}PcjQevlMv`7v9Xgka}9VoE{X^nA+'C %bY(zԿ=}bi}z5 56t38zc?*ð1ӱ#9JYXR<,u*BSPۓ C%(Cg( -<'bg$LCRimE/R. aǜ|+W㬰@=ծL?2ԡHWO,TcNiB:[H+~vHZENһ\b͡\l{Jza|7[ +Θ_!90IB|B\`/.> \/E(TL : <&JAigV29Rz)d>rIv!cv RC⎙!c1# !a ؐHĄ -ѡIBTh0=4W -mSL -'-kzaRYA#[]dK3f H0$h\FFhM04ᘮiBdx0%|09_#M273(Bj+7& -"0#2L*8y2T2E$\Ct2_ۮfFmo^R=|yߔ-}ԋRR-)>Ϝ"3*{$efEim4%wW^zQM ʶ&fPndXVL#1Z[W,2Z2cI>&6j!<@ۖh!Y>q4M`,e,x 9*#fT{RclO8MIE,%eF+amڭku!u -j[5Vm8պʭVU_Z-mߺC[[7䷦A-Vsy\۾HJ1eRl4^kЯBnfs nԢ:D~aj^)K`eổf+]M"ˁ샓4(-wZ^;ir) 㞓nwF[Zi&sMk.:⽏B8jijpkxju-HN~spRb]05g9#э܆AV -xE{M\0pvƎ4Gh 1.::6zIù:bQG, r/ֱ>[#>AVG%h8ٜh[mӝihml҉GccPϡ_ONIt=.9_9%tzuR glf13] &;Jw>%}iBPWf2PWIU̫8rf`Db405nt;xZj~yl ҧp>HKo[ȝkrf>7vߐ@a5쇃L  B,$B&'fѿHi5\Buz}M=żtC:~5V)@C(M44sћ 4棱XׯuSDg-:XsE]>c}X+]`F>/jh   M@'_\h(Ac{)ezO=lK59cnE鄩zj>^TPnBHȅ@B.@!B- !"BAQDTRuκεgzvvnݥ]9o|=y2|k1;nmmW׆p%f.Ōb^pe^wqbpGX}qQ,MB!R}[;q+67Dĕ8.n0np̆vr|'p"~b!MX‘8p1Slӛ+,ejwѽW6\ڔsxiXJ$+܂d'wc.#2-޺[b_77 I}O0vG1QݟP{WH{1jm }=]8c,Pxub'k&j~GIF(}Ls1.è( Qv 0 .E!qbz]BgNtW2)ZXKM於C~ʚ%X$|@5敏)pS=e勔Ǡd#$Jr#K*C@ZԂvenx:) -f$sSk48?&"fE9OO5_{Hcq2Kc^2F9)_<Ay)(ѡ]QVE9*(Mp+Фtl ;|Us^lcQQfU=|ƌsdL3NY)GQF@:,xphRRW€ - WzPW [jƙEsjN1Ǩ}|H@1jO'Pݛz49D&N7@9z_ЦG t|4j JQU*;,:7:?L>fԏ /1*Go6Gg!=GrO4\Q|̒մoѽ =?eiѬ_> Tx -`5\@mj#5uiBuc:NVefZq1^Tr*L#NKT֬`o+&&uh<͔zSy(CC xIe_3LVe(%dtSV@uʹ[hUIѶ -X6# D(ЯvB / ?02xmY/sd?q5iݧg&#?E^`!! rB*d lnFf2SH/!-|H }z+NRi2Bz'6@m W7Dd;灼i06@0{]1K%5edX+aXo/m` ƣP;612@:Xvp {KO"ޣbrϯ.˥*4q~d%dԳճ|$$;G؍=g~Iރs{Ecpnk*>'͓|]%5!qw4V BB%}lN:PBp$aIvg9s~DD$<Ɂ' =Q%_BfjDd{=YpN')|FLN3,19%]`aB.(}INPWʤ8xd8Du:1>J;돟Ч[o pp p&t;1({@}>np/p_b?'v5Q5M+[4[Rjcr}Ǯ{GﱷEsS{^ =9כ `.AFhC+qrCH_i!eWk2[EB ;ɳtUvZ+~~vuGMD]쟀F3A#bÎZ̙m e|??[#(FXI 5hHKS?(4HИ9hb4qR<_Zق5b.@dP+^?jFؤsbguC |h4)ڏ$/{;vk.rrkmOqR-Yۤk#ވ ?;@_e.hza}D Bc>رlÎر;ꔏ<-zUv5ZVJ*T)W x+>hv@Iy _bh4ICgV)B^fUllF-n~TTj{OĎ\봷hh{NC-U'5vk}?UV0īܐe-5LbCfaJh*w\*v:"*p~9.ϔbUnܜoGEچ{hsVDh_wTb-pMD(9IQ&1S9DqpŚjdt/ a44ztc-Mh`yн\g̣:0+*"EPEaeXT7( -.ǚb&Zq_c5֥1xXҨZMD? \{0t^>|߂3s1TG9y%41W1~PŌV1V$ٍ6es[2͔-WJ3-WAMJ`?fr1 6 k`T78bEqgO9+h`U9Kq&(%a,pFIJHc0'+ ?:cx#%S3=|K!1'tTN쉽/[P%5)J)Iq$[d-`.s\ŧ<+SJM2ZbSI Qg[)#Si)ZdQ5DJH5ʜ4LiK+Rm9-QtzƦoԘТKj0;1Ue -v~ۘ7m]Č~2g V|F2-cY1YVEg56@cehKoPxve -G -r+^eti)̇ ߶LUvyWMP*սj4ʳrUS99~nբf@ pWKXN/`^ @8)a3/ffl^˹-~**uv4{Wnuٕ-thFt2K` Py;Nn{7M.v77\ĵ7TN(WRjgpG˽_&h'?mM^!A918P~!0qGBAlp.|7ݾ\Gx`K:9:A$'1 -G f:GMhI ކ* ]{.CvyH8ZZg8 U|J}'|/Fk~Eo#v{n;tk`3?M—Nñ=]|m--M< W8/t?úB9sIm|y=C魇 -ЏF{ok:KkOB<u:=K[Dp\џDlAOЕp@F=+1ɤI *!q|@#q8մNjB)odJOXWGta(V2:h䳣:FGqK]k!*WmWxvjgvBm1<{/H.ΐ}"1++YO䱜LYvNATúuLM&آMG2ӤO<JpW0`6``6` -$&!IsM4I&kf]zd=Uuӎv6դQҺN:mkUv޷dz{>I}R/xW%^սŋ7Zʥc:\G&dQqXtS gb"㙏5;e2|+ -O =.V%?{ewV,Y ,de#l33a*pN79nek4y g((FsP;."7)R.JŎ].%Yˏg m K(dXѢV 2X4Lq턶GIPݦ2=Ke6ҿ7Q׾H_Ny5K/Ib$SCrM6MNJ)&X:@w8]eos[<7C_kҝ6GYyҾLh_Fͱ 3k6Tmqeioi⧣"D{(Uh:D,xlO}fۯ_\DVyFWf/k\2,'XL5v IM[aS4,d +48/QxKEDd'{VwQi> fѩ6n5zqmIޚNuk>VֶJTzx#f(-Q[仗G~C(7_eJ"(YRZ X;TvPљN3eՔ1[(80EQ`#.x O~S -U..HgI*1'k*j;ʃ(`KO>=&z(쭥z MIv Y =DFۤ~&~OF'dDwK렴ĔDPKINA? L!w("d U9@pA҆GI#ydGΈ$ ?KŻ$ }*wJkYEHM%ZcUVQ[cȘ06HD:)y$OyZ'$bcxMćOb_O7xG?#~<Ši1"ѡ5UIJQ٘U!}z I$m8Ms`/68e|/Hu^dD~@cL<0""2 -* 5"(Ȧ(( (8* -+˩₩1n&DQc%i[5ǦMjԨI44>99=Ǚg}T:++Hϖs''- ŏ;q?>Əq)S&ժt"_u~uyzYWz+TXGO~>/~طb-v7R(=zB>C,N)V|^)P+[]G9DFx!Ngu%yab Qh@#`52yi>ZUƏq@Vf*%cDuX;;M,$ǩW5Ġ1 -㱟LVUG$oV*V[rcգ_Ks4g [{/^g A' -hEc)hdc)E -ZV,""[.v._iswr# kG>>wpelwUSVw JhYG%Vu.ZꚢZL-q"|Y܊TVjZ֤y-*s?RwTcxJ1lD%G(1,V aAي /иrF,؈lCuR#~=;iAo m -1 -ǽl09C"J (EӸъQ)5UkTtFF[4b0dǼa1|`!vS\7ya&po -K#.M ̣>0dQvMvD}}GEepcĠ`Ԉ\Ƹ5qiFkUظ/MjzbNs5MSTk7IOsf`f{{K9YeIPfRIIHJWzrҒR%SJMJM]j%7)MG`A,W}́z@y>9JTqd2јTI)& -`ҧ)1ݮEXgޭX`>x7e8نV7m\30*ǔ.SR3(;[9%ʩVdLE(}t jK4l)w)We 7v2l {Emg6k|m~sn0(z8E BװH~Rr_&,K8p.+*.]tqíAaa= Gw1]_5 ͩPFs([\!k\>ZiJɩm*si-䱎jb`;6{[ Vf6SDEVFr{ 6xh$2.c}cc}ǹ}7TGKH1Ia1y5빑oz v^x2 - 3#jrK y36 Y+0;g6~K8N[ u?E\vih2@o!ނ18I59͌# </W/RK ե e_&*F;Djǒ7pjY`\ U -\eN>aFї2gl MVżuؠu <=w'-]U'mu}r uvxa}k}Ӹ_C<ω <74}tWE/JD3|t*Ш-6KANw}eE|y\Y"qyW(29?9<{=;BDzQDJ^Gt<ΐ))y|X5<\i0w|G'X4HG# |4J=ͫ O[;i$Nb''sqbױsqiRM6Z:umU]K+T(L\Mh B6&B Ć m0ډ3??~:w}~{cc/V0]b -|Q_75O op}$1s4WG - :kѡ\i5ϫ~j%?L FX0i*\ъvif/hGɋ*ɒ5Q&>d -eEi׸?-Ye,-5jԪJ-ЬyC =ij׌!ƔiM5a<NjĮ1]ר鞒ה0F,Yڬ^FzЧ}c~,lZsLf1;5mnДEami21˘F-Jn\U c>nzRqU Zju~?>./8l>Xz{f,3qږ)Q)&iU֦-,xwnm~LъksxUa -WާyEit-<3M2s36{f 5dw*nנݧG=9bVr\Ym(TO5wU:koÇgZI"r=I8ce^FːH_mUPY^g8[R&Au׎*X;EuTo͉[=?kh=Rioޡyd,}TckDָTߖۿG.Ljj7T2|[/iW?ճ@su~NB/ ]m|5j RC%w{jc@霑sE՝GT*^eٻހ_p7ά濏YjN~#?yJ -ZUVnTTeOLCS-isCO,| $[[&[=>Vy54ИVA:R#Շ}…rn1*bQe\HnUCe٢CFS]C;'Ḵ{Mb?9WY73hzϣ3N Aۄ%n໣RU_*KT>`RـUA6 j`#e )>s2/]_SIǴ0:tf|0^ B-'F)ՃRuPAED6$dLeHKɘJ 'w([*H^T^r*7C%~(cFgJ D H~hObl3ɘ*QIʤ&*Lժ ըT@aتuL.EL%*Pl܎3% Ce{ˇvLJmϳ?ݿ}" JH%:bv̠RѰ$H@phĈ`ּ>5&ym xyX{g(b5 s/w)1WΣ0JWAJc6ԔG1 #uơK?C"<˚eße.o-q3<{>Mzmx_ShB?ʹ |5[By=g®r'oϳ.0gK2{9 2{2r{ 8|oaׄnZr1xvfK04&{CYi>>椏 ~q>J%?A۹B>zƸ%9j]cF2ur9ACa?/~곟B;i8'U9@mcAg|FW(ćW$ ^~Ea{3ظ!'}q=/XRl $Ip.G&& ҝjKt>oKOlH1ӝS{7$ۘ~S M̫2ґZv>Ϫ@VOS;tF=ğI |ݞpOѩye \0]׹ i"'kL>RXf)'Z:%t,ev+-H|';!.'v5LqTa'&3iB/mt9.hXIdn9L?Ev( ,r5^qOCr1/$v9u&q'-[|c!.yds.3: -On1.̓ي -U2E|$E/"|,||\q7˺LOgTT2CeO8[S6[.R^/i8:4D# <4(GJ31yJ}P\M曓Tp$:`v [6 jV^?!=8-:qHCh(fSwԫMԡAS4>. Y2a ݩЃj -=!vA@{ql5[=0fO53\6;ܠICtgUaɚR{Xi Tkh79|uq 5D,P}JEnGBTaT,5VŶDٜ*e/Hy&)7U9]N%}Ik2*#\gsó֣T= W|$^h)Ub{ -Fʳ'+מle'I.;FY)LTc|Pr:#x>3zhL9eHc_#yVR!: qq)ˑLS,yJO-QZZRL#}R\ z@IGeǕ6|W<h5 ћȅL|}^d+ -W\QhŔX]tȑ_$4(c,J*t=TO\K%7MEF4 gR]AQg]wEЪ(* --, -BmăD3iFUi;1&ͤNkNc̴L56i֣c,d?Y罾}FL+`WJQdv|dȕQ Jv\*C ~;+ιOcqX^8V±`>( *id_+;IFYIJdT'[y*u)ڋ'/ыp| <<_h&q;(@1τ;~$J ~dʼnJ**@0 :3"$ * !yURxP JlL_qÿ~Llu1JXbPt|R.Fz#ìCH Njų#aKgpK-/p -PH9ĜE̓}O?/Q_µEgKO F+k+:w%KF.(\/Qu`;ϰ-DMT\~vPBsy&1O _?f4`9VAZM.?Ppxs{Ez3r [d!m\@̳p}jΫ)$C7XlaX?X6N`LM6s6U|RMySpw+TQ"͡|ի^3uK a·A? XWY -q/O=r, w}qKCM~'q~g<>,O ڙzb/ku?#|agD:a/Caq0&Xku7F4(8!8G䠿&M sA ";`4"hu&x`x?NsfO8)w /:r΄;M6HhD9pɈH#88rpu\,b%% -~O -y.!MwAQj@|ν:+OQ8|H❧I~E?"sphBp;C->Un3o>$}|QX5=:7j ~{=Hj=k? -Ux3z]W]Rt+pk>\P\fFi3[GP'^uz|:z:~CE0-{/J'i : A ƸE+Zd$,%ض㷋\DKè!A6]Tyxscu9/pޏ#N[f|a -Gb]m;V]a;l/nvS<7v#dr EA+|2;17bۊtf.v#ʎ^DZ=B]F yBz}d%,ã%2vb\lQ*'a{:sυ.#U{~=7QBy5df'ީ~.=$8#`; ۓ=beد~ ?:CZEKo -rzSL9q,Ǭ`#vpFHo~:b&'2B". -8p@wtұkuԣj .3HxU32_ Vq G-*3VÑG&ȃceTY 1GT5Ii -De=G(\jycm+U5qr ?'L84^zJKXk'/SIF-6X3k,!K.l-HWMbHQuOzU&.UUfRqJL/tBEp |'6\p-^~w[62UcJӔjTM3Te|S**7WUV㖫hjͳUk}Eso*!=pm`cmzk.|q⛃SbUeMRŢ -MI*NS5[ֹ*ZS;IyW)7urR٩O+fL9p{HC -U |w*_ԖTRST:A575Kslʳ*VDEʞT5#}2.5-cD55,! ¿4`$|e}oJx  b I5AI*;œVYKfnVbUQyUۺuն]ﶹ]n9 d'y^z|*|̍W%Yety-Y*R OGrjU(Ek -&-V_vl4~PVg~”߬8Ki̥*PfYI(/TzT) jhQjE'Uo@ɾA%;Ċs2T\*>W?a;Rԃ|ǤJ pϊ|THپx&')ʨLiԪP*JnRbuDŚXFwlU|^U կ+|DUݬmo W -TP *1Q -<|.HF3ńٴF4P(NiO;JN3X3.kᡖ&lAĵ)0(41{$f[3K7E,^mfv)##ψvl/ dx:4z0^oQ&R1&J ȵ Ny=/亭Mԃ>!g}6blS|s>imd7yp.]6E,`c 5YQ>9fq/r9br9c/[yfg0% .mm,o:HCYk7f-Pl,`'&'ߡOQ!zt~"'(~sbϫ5*]Msv,!{_3hl<&Bh-TlDŽ0 ň2=r?F(8 -a:tPuVr4%-|4.F&1BJg蓳q\E?OAr3!pFpvR#<+;<au:Qx\(.A]6}fJ#+{^8i=syS~}=*:+G /P]Wiԟ%.~J~B.i\:ops0^/c_>Q\f -4G5t̻jL?~ʹy -JCxЙOEh47jvP}hũ߄3,ji0)(' -L5{ #u̼M`pEWhT՟W<~`;۹v0Ŵi%mx} %rǘ as9jj=7{L`e R5:%.Z;}Q`O#6Zm/u؞{݌VlEݥ Te е/iVқbX1\G.t욱k.l{]Z쇰V+#]Lb -Y:1~6ktv 5bׄE g?RX a2)snM?ӳٮ:e05&9(Fd}{\,XH.&=Fڍc~t!셱ۦv,n/f:z43UaKH}$A+oX&fp:9/:jQ6LC8JdRruaĉc;ǗN8NvlDZs:M$m״ K֭bBJAVSV1Dm0؀A h*h6&.ZQPG'e=:3Hì1V*f젗 c%Xz>A4lsGX 㰔gKH ;;Ѩ$:u42to>.& zg=;6%ʯc³x/U|8fwcniL".|5ը\nsL]:Yuv0-WxZ(m٣fA,ǔVr vM{RaG^{jSWKVZliDҸZJJ[;lWʺPɲ1%(n۬mjS" -ۧ:\G8N -6 -CC7]'caVDY]-vJ~%uJأjw)UԱ@ 1E(llVG!~*h<G -W^k[KBzNUy9-粼u7 ;\MZL3v@gi%r1O5m - ջ+rW]'OWT]HU+ީJ.Uq}\Kryr{oj'荓@.pm4$x#FE[תסץjWU DJ[զ~UT㟐ۿA |EFpJ偋rPOtk#Z!kR]'D~vy*婩&.W0#gGڅ2j<4)Gh/òRYcm݆]h44O#"YePP\u9rWɨUy}4t'[d"kdlUidJ%#DN *\d ԿEسA,$!=P ˀ91B4B6Lֺ"og4t@ mM@mݍ>T𚱮ib8d6cLll&qc|-0'3/<~w4\|tzFaɪ{Yנ6t-#Hb3ı8VjXCc1dOT -3oce}~z.hE75L\=5-Ch,I5$so%{sIFMı817v0&;XTVfH3׆A!s++z ))"ö[/:@ndwt/ ıv?~ޗ}S) -kyR{꣯s"!Rt{^sk^nh -Ƃz8K!Lt?I!q8feep#TxplCN.a0UXR|e>oH])a0K$SgX'0ٟq%=y2ղ1@ۏk#VR+{ @^y3xޔT'Y{.o?$ %KE&<{ŋsgW ml}y`}ò{ސ͚:Lm`VKs%O,~ccl:W {ś4썓dŧpO/yC/s /d"oGG,~~ͤyIKLWW^/}_%Կ,jg'ހ Ufyw?6sZ) -:2qӺ{Esxq~&̳gcۼ8m~v|;׉8iM鑶뵵)F=Cݠ$@cL ILHCC􏩈C$PP}~{<$% ݜ73 0(_fѯ=MgP^ O߰y ކ!$=~7V!Rd cse e:#h$>+xyK+Dgt*sB?Lm* у_u]S25t,v#Wȑq?>2S{R#aCdC/6k*< 3ϋJ\;-[Cw6Н@wY4:0 Gt7)T 2d V9-hm[=c0g!X=GG xl'[p3=ѲЄqQϰǦ![[-&v؉c'vة`;fL$GS\VY<:ށ(Na |ayjiȓ*ʝʕ3ݔ=$[愬epf(Hicc{SP2(:x$!(*n?/UK/w6$gGL*)r F%O9s* rg}-ckl@%!4 -AhߌM-]N9K-uma*$MG+],ljj@iCePPo)CН$PnNS!6J@e4U6]?MS'hu>[w4qu:@zJʱ{-hAz<2Lrr®Y~ΚE~A!ah66@A<0ǀfq&m&А ឦ ]` ta/)q ĮQaE{HYaNaV6 3]Qg6{9d7l[ Pb F -*e(P*SS -J/Pʥj-2 ʴ:ڱj 3Hm-ɞt;oel?V~YpYKbr5 c̉ջc,NY{&Μ&38]p~ᣴX,k:gHL6}?ѯ' v ?mI[-~x;gr!q68wsΕΒmQQ]·˨#rs[ 7c?}&{vdVĻH"8sIKi&xA;.Gd##h^e~WN0?HH3(qe3~VpNEj'[ٜ;nG<$H9X< WU~H<^W^ef\. euqDINۿ^p᳹ϏU6K<`,D$+5>>ɿJKb&>f- | -Ol.>IQAaM2z 2zQ{u΢k~8 p ޿z]uq-l$.%~u9Gem~~|?D~bz":'~BiUh -^VXe]SNڟ&hq48Zj%v؝lj~>^n.NC)u}v!~D_v<mv\pǝ;vd`IЈ"v;;eZu&v;#bl/"Vc(p< 4z"%kЙcp_/;muiG:ў؊ @ENA{;ӱ;arXeQÛ rW+b f8S a@䩾";=}ll>B~ *YoaT1v|*8=ط{Lcz\cQlz+۱ݍ>l`o6 ;s:>GNU QuCt~1lEоkپ Tc ~o~;@VdjYdg:YG-e:5c_ ;~σaWuMC,lr2ژT2c^y;u£)TE G7Y.wmkUh9WJ4fy$;B5ur%X| EΊ}ṗs&o/E̻,HK}ܥx#+iժDb񠂉jO˓˝lSMG;lqf܆i I|HbxSGdQh- ϻ|Iy"QX+3SD~ -& y24Xr5 9gϢ)K{caq+X³Yφ$/"\Cedj(fsI>'ݲ=&=#U0?;ӼMvū_nF5#\O&~mXflؒ! ||e6;A+h9/)>O&d\25 -r73D V:HJW xmǶAlcoC%K"K+>|pN+=`hiy׀)ޅ~F5}faX5 ZZ" -nUƱ3h:Z+neJ;=HYB6BIH@P !Ѻ/NT;նK2x:ɇ0p=!?}f^LRpφ`@Vr@G Aw"0<A!\ŜԪX<71 1 '#hGw_C0" 5m ṫ` ",B",BPGbP !BpS/ t3Ϟߧ"$/0` %:BrXa`F6;XApٕVb\r>i:_PK -:G/Ґ9c+.q|h"|X ~5.5uбFl 0a|x=u04.zE4)x C$Hl- yױ;'jn i\ W8tl-бk؎nA pNlEMlaY6{ר` -Y;y80_w97=Ecg@Ҁ= бQR$Ή {P1j` B΃Vݕ Yk`Õ(,7U -U+'F|` - ^EMB@n/+iQ'B/ paT/D;C!XB"0cr>Q88/l0݊M?xy~n07|cǎ0q)SMs^(d^^2l/WYn_zWl۾ܵ{"ވ־o|#G?>3L6ğ=w>1)BY"D-U5ڂ¢CiTSźƦffpvv]|nܼu}ŗ_o~OD%}y1<\'_ gK"0X8d$ D0QPp)#`@L6-F8n#mO@zH(=&c̾dݽz~x FEyy = % G X'$`(,K?W-=C o"[ ;=Qo;p0ȱ4Ï?!Idr -bXwAWM1 0 -z޻}_>xo=z;xɓOkMuDT__ba~CٖsJ:CR Z G#e&\WfHKi h0a@À 4 w|kfdKeUh_ݯAųs94HASe *g)AxӀ n_ToO*HSoTb.W]ޠZA Р%4(ײ3n膆>nE$YL!`*_mԝ/QsР 4y"ySIfuaƹgc,i0,5pCu~S9Ѡriȇ۝+]xWY"Z:ӸdM3^Dv 97V0N6CC4N۝#>1tdBG*@C'ie$5hͥotРUrS!\ʖrz$N:Ҡ#{脆ƒn#Hi КʷkJ -A˱)sNy6K"cwgI=q:E+6 Zg -Uo-/4CTРa;rV(ՕБu9'_4qbf՚ *ʶ̅ڸ|5ǢT۳,8Ȅ#Eƾt^鎗{<6XjwУ-VZzQQYkF}QLVנϋIh4X$&}49߻w?cW{YE˫}?Q -˱lpWDL|rV\`ƉмVmӰi4l6 m{Pdžg0|ǐ0aV]ց灡F!ʺ[Kn۹l{`?)`oh@lǧ"sf\޼-RtɌ)Nm-në= -5e'#1=0htHh#EAg"F Vh•Ibm0;;6 7`2>A :SvIQĢU]1W B% OXoL[n` `Q/c×hޫF'Jcs_+!DtU3(˗vjYy`xN+1™-x[VJf AƻC),ȗfjkۭTkëK/ck$fLGz(6lj;^i<)7m}Uɰw>&t%4aS&Hsĉe!e;l[԰0ݸ/WioƮOW}/>{cI_ᜲks,p!m,g9@Ov.Rgu6A$Ⱥ[5X=ښWǖͯslwrl$&";$&,aqJ'=ʲ[_vwMæaӰi7X?ښc˖9_ 0tJddD'%x:,&rA>'>\0EEh`NӽGWpkz^`x +Wc"R,Bq&<$Lci7_uA[=kV};Ǘ/ b$fǢ* ˱\PW@i.wEfx΁HmjiHW#-]`0(̩ IHL` HwEĴϙqrxsvB@E͌:yn8~ ^I3mfځ6MmҔK IJ qCwI֣yGﻭѾobKl˖%[^ p(t4uU}\?ɩk3Xb?<1{B1 )ʠ)u -e;5+jK״4Œ^S5x{z~q_=a8 ie/ŴxXj(Q@ӨʨVf =[rSPԤtuEhx{~ {/ͩ0/!=k[8P&ڪY V $7yMRULMogn`##4n%ubD@tPf*haTIȚ^ʸ,oe>OUq x -"8g3h.PԗMЬ] U,*WPW2M~K(d+\+x{ڍ^o_=NioYz!pg'ئb -Z(e^ik{dEDUۆa}B{_k_ӜB3sޔJ(6y -%<$iCPMAcqd"mnf:p~0HA\^0K Ì*QJ 82Eg`*)=P3؏6r[h/w`}o羣=\[u᣻nj:|ͶoZp7ȗ|ImKu:mlB%a50as5ޱwDGI^{Ivx\/$ٝh cD,IFIdB#mZ47"TՁ>m3V?1Yiޯ-:B}Ky/eN(^, -юd,A#$9Z6mtoJZmio=aqS5ݾ|OӂSacO0.v8hx'#TQ*LIHLʆt ޜYޖ~0˪a -аm=ć“!A)# xB1B 3QFg2R!@ R`, }owYr6[iì+auc71'R 9#lD}qNܱqZӝNUzuuk@zWEAAP I\Bx $F$@BȅpAEVԺ9;m-ʶ?*9M8bɢv:jh"(VV@ߠTei4EJtLpavwk}n䅜4~1+=n*(NU -<L;sYINiBx6 -_sZfFGܰZ)HB':!TUr_JDot$ H\$\VQ"Fa]|VaG ^j2#(Q6"*r*&!i"$]0 k A]0ݺ4!>DZр/rz[IV-9~`qL45z]ECmdULDD](ՀOICVt^DA$"C V[+{$SL:Q 1hG 5M|CF^kʇZx3UAPi/  n҄di=ۊ~i+zd%C6@>k\OX["d>Еq]iB6gx;iذ% -gd9 $*MM//uxUakfR2ȕ\o`*X( 0,OƤAq.<1*; O[T{j8lQƒ .3&Ba:A8/ W=hS g4IC΢/}ڐ:=kJ]* *8l]Kh-nH6j &_ciS 3Ҁir`xaؚDy]Mݧ 1M&o -Zr-s.j)kjTAAdGO۸7`pHGܤM$Հ!o?f*wm2~\?h2b۩z2lnʯK @1'TYY0FG)2UhӲ4`^2nK֬f{}Vm&pҁ-ZwZܥ5UUz(ԦMjJ m3GrA A%h4 `Z ЭlVy1>g~ |y؟~uG? ӷmHozޯ'|%:WS 8#^87Ѐ`SӏT]=r{L&u~C*gN{i%8 dp?3 x \aheeh jOy`~RMOU!KrUh>Du38lj,J0pzT~ޡ{&`jmյk˦t˸("R(HɼX&QoAqq˓2,ah6EeX=7eNަ ;63e0uOɧ4]jnH"QRĀvߌ帶la,/1 G#Œaܔ>ehi3~1k<ʞ1tȧiPQ'5D^LRMl)l8q(˛G| 0#xeX+)z 9Ys{xJ1?o'ud^H2kq2,9ʄq00|hahe>o옵fϘ+&;jpQNj$ -%h>鵐ifqfb5\Éߊys&``1k{ڦ4vTᢁ/AɩYL"2B5=+ v:̂*;\q`r!=\= ycʚqOZO:ᢉ/),duPbM97Fz\Wjz{Be7&H΋ ( un̬uyP>8Z?]'[E(fjY1)QUoh"^jN^l^$oGs4o-Ҁ28>u9Ƚyhlu^sKO3;(jzIyD. As\5KT1E7w>u>3mu *].NQ!iWcZDX ޲=7B^UtpQ+.hD2-hM;[l'Apd:d;,{OHgpj]<5jT:hCjJ -]QI%d@ [[ߎA;.}߆w[|pRB\G;A-٤}SKUT*K0)!D=eRoh`2xo.cxk{wt#;]ds=c?bv> k6`B:EM{MDZ"VE -Ӽgwo2oM{ ireӇŢ#3PS - }fj;8wym>3tE`uÅzAQlnwG6{xϫkE7]HH ~5_8ɯs뜀gq+>~?>].Lm`=acܜ>"ˑ~RJaiVUXaS/%(\bxa@ @Յ e nH\tzK?Y)ƶX f#fHvuqҨFą^DJ +a]XH:$?y.d_Y«ѶOo~~ZJ^]rrj[Eۛb.A\Ԓwͽ xYbN8ww`{-CplInF'LǬ/F>-/,zTB^O>{.V~1vtnYHI׽{Bc{C: >gώP:}$%_z^US~nˢeϪq%kҔIe?R˒6^L|,Oxri' ޥ^y/ >9}Ǿ+22AnB:@$dPɈğ?Ǐ۠d~u9;3'ܝd}/Ds;d~>O`?T.@WY4v,dG$xPt2\11 ЧO| @<(1>0nN\x??G )eUMuƥ6-k8b#S͢v횮馐J~Ү*`wo2`i(`!8):W@KD|Ъj){g3Wzǫqdq 1>, Ay-"8YhfNS%o_%B)X7oǶ;LyeT;- DA  p[ZT ͷ4zS>KkL7tDa 3fY`l^{j{~8 &x@ ?= -R7 -EUne2^dQDLr9I[M#D%@P؆~?VN8 o @A$o @ (pM@/6,qkًxդfu㍼*d %vk\Cn\ӂ9Xgh ?)lń(9 -R7DkPPqKf9T$Y?. c(w 5A3xی{6gsv` ;llHklԪa *,ђY.I38aOr791fkpoui6ٶ0 ( KJlK-Xo;_*%/K8 P*cK3\iaY< r|^|ǐk2L=>_USI;İ 6mNH OHT$+U=Td웒rl+Z3! 6?9(zI!73`zѯP^e-'ڜ2a@d#LҖ*1:HFמӼ(/J pEHy,pWt:;7 ^)m.3ȷ '=Zs&6qg -6q[ͷOG$$_py"!hgT6! !E f_+Rl.[buũ@36.}"~'>]W6SL - 1f񌒢Su<*qOhfuqi6gAm8%h?w=Oe4Ĕ=1a$P[k匭sH_g7)hv!oFVϷ0&96gtdul`5( _YT8PG]s߉5{4;~elH&{aL0Ejm<,P2|sszl e1- -?N٭s׏oPʝ~w8 JW14Gu'C0VЮ#ԫ%JFWV]R-fE`%la*2 -& 7Ym((C U5XB~dgr[7h~ }hč87w*A?:Lڞ64^or]҆Xѝ&jL/RiYvCA)Tu6Ae} -{48=?pkbPVg(3]BGiK{hnzicgXeTCP T!١} փNt[>59w#;vމ)/)+F $ev+Ӥ(󻒔.RPtSj]Τ -eGrJc(D 5f&P}j-~&swl&n.Yh)YQtвE~Nkbr[iWra;=VCjRic.TڄjP E &P)46_.K{OkVW<>D:Ewa>r:lHd(qm6r[uKT[|ks+AutpP.0Vhaf' ,լR:!]: sep1"@L)FK%tەYݑ@ 29!kZb.zۖ7.nޭY["B>ߝ1cEGC z)?"WWc{5: DUՄ/ -jDA?iW7lZ7ʷ;[%NJd&Dr'IY\hR60r-ʺ6WC`}UI$P,1oDAÖ/V:eņ-`,oY/ݱ)|! 1iTܽشDιt^73h0!-/]6(֣5~c#턉ӗR05nl:CLy! a1Q_sOq!)%5#03g!0̃T2^6:ע4C_XW L: ip='>sCa@Ci4kP z#T=saTؽ;`fVg  ;`xN@vvG! R\!pJCPy8Otغ.̾߄?m?.N8BpDt=~8+[Z!H[Ck#`X 0- - "dl2.b" >c @gaЫ\BXK&=ה%?}*_Ŗ͐iŢIbhX<" JFA0(&~> C e Cfpc/شLVbJ-?k.A7_"NDˊǣ%cƒ1;;AͲ^bYgT2Cb!,OK= yЫ7DvZC&3O&L%Hq1|4JYqZy->i':OJ|C> 1d#LĐ3ѫorٔTÛcM'M$cؚr]0IU=uf# ȮZT!΢<0ZOsjӞqkuQj-"eA` @XB$d%!@VI %$lj@AA VG;ߙuzݼ٦$DbRfw9WiQ^cUT-U3f5URmJ*0P 5ṗƝK@ޱ C? - ;61|3$-!xUF1x&(bJfX,tf(FނOg5p}o1(f|Sv/%V})$;͚F.MeםuEmvC'hQCݢYаsh],^trx77n97Lw@,Ddu,B %k{=eե:uS.uܥʐt*ڿB۷/7&V,tOmx} o*<^DAxbyލ0>P,8OkĸDT6.HO:{9F#OV{xAW~%=3ϭ/?ulmWۂ%/=J=:U|?HdeP2дpy7g3w{jd8⇃ȀX <&(Gdl1?Ƞʨ13?3vjjqBn8J:j`G'`21| ;7`&oPh1G a}C )ȁedD#O/6 P{]䈪F (䠀Kc.#KqgKhpu?ŀ׊@ؿtAC}"c_zAW;(v@ہ;\BPn  :w#-ya~ C'z6 UC_ - B 9t ;{p?*NN& n -nlw p?8_QC< -Lq;FVk)+>eRƜ%Y8ωgz4Q0kMa?M47q1콌!} Xu;1pC:b`!7Ey!%x„LiRK33oT-"֋2$+Ill2_;$'I$ʻ厐7Fz, \ GN-M"EǚT`R%~BL&6.dN(&pG~H988l' +]mE P7ȌE2&GrpI/9iγ"Szx2*}L|DjP'^81Nh~ʾ}8K ii1U vp9l Z$N0gy4x2L6AT'f=$7< Kl#&s)' /S՗@ A -N*1hb d| Q&O%xΗL(Ɠ+jU) QS4w75}M{Ҁ6D6%h'h ĈADA pm|("F-lTže 'Z88kaVmFwII7 -i~~~}FY;A2 Πq@PB ^WfΔT! sF.JsѯzJrИk8W\+e^_4 1b ,oB! APw}A"NUqSJxBrR9aC۴s%Ime]+nnYfSV)) !cHɽ_oCP% I/ ֔J zP*5aniԚ>Z*|a98fkz.7q{ʹ=O@dA (F0aDY0H R'uJP - ;-ִWSXmzNf+2~D]nt1k%~fo2 0~Py]܊?K -ՉLMeQkj\rU[kתKmVHaыLzqWb1CO@s0 -&߷uasQOԑLe-ZyUqR+ -Ygԕ[j2ZkkU6NQt.bA&b#VgL{BPz7CF7}V3GvHwVeU+mŲ.5[4my6kR-4UN#rH|jx>A2 91PRo<݂x.NW@Ʋ5΅ʃvz!0$lŜ KHH"N_Ԥy=Hzg04Ay,Ey٬,G} "}bg}OXeeK'!vD _0Yǩo"ȋąs^kJ86׍z99`t2~@2ȓCByvK߿靐E?)ԯ&X׺5\L^sv:F"ed? ƿK \⇻)t{]ue5yn4nq2ueI 1@&d tGeɍRR؞Z`nvb, S!O" -Hu rK}*e:.װ~vxcOѥ$Z"oieLMoʲ@[ F{^ ؙΜ.zD{@,D۵rZ ?8rD݁A bfL6lL0V;f`Kdp3% d 7 l+Gq@#[8ko G-x -,=j] bOrT!H4dT2-pSbj'tC>ZMISs?Ç k -LDFr$j@#H$C!ױAU&46Aw'(vGUNkp+o5SB!JbD}ӃP*CD}qIE3 aQ*qGt7Z#`&gV[VpV0wEJz@٦ }}/DІ.ݐr%`U 0j(6 -pUa/S 1f-u%o/&|E@j R|iA -~9_y" -c>CzϐBT0Bh2@EjpB e(;`uzP/R e@SWI-A+vw>o/e<{g@|˚]b={ǖ lMi24kp/70D'^' RʚBka~mg}#|%#3a&ϰ&5==-:+ZQԣuTD+ʅuBf! H,'$!Ҡ("e(U(Lx@e(λO}s7i /l>BG/`X/Ш[ DՄ.3#6'=0] 3ĉjқ:kci!i{JFӚ0#NI@Z -݀xr 9{"=qH{\v[laSBzYF -Hz1|`D>e1̦X 5Q5P7y7@?H @O< qzܻ,\>5F})b_d < y`ۣpnapE?tݦ,p89 ٹi$,~'<=E3ch/qǘcӬ*h䥄gx=?1x~M\!_;_[ 8> yȷ/5 Yt Ac|bIo#e\=;0 cÑ͢GV\_͘>؇:Cɹ>q%y?h] zjPo4L A f~ 'J8=leC5Q QI^M|or=񁬊@vܛ|ܛ,`:jp!ul,Ap#@䐏bv/f<#|`l \QރR܎V^N9OJtQ'i= -G,`Ow& iנ8 `ڹ} 3 ѻkJ&DD0 GMIT: wc;rjޑnct3:S ])lG en G `2w, oo~g1Ag[$KiPyRT'5kkCWlǷiYjl|(9Uѱrfr% 503o':M,s&[W8nR)UK]^6a֖ 6X~%dgEl|AWIg)E - b K1F|q B̳(V=1mxCY0;̂c&εk\,č `rlLjxcWʴ|Yu6NQaK:|a6.ݮX:ҝbMf*7CIC<\:W{}w/<صSS~ՍuquDPQT(bIl$$,D*0:ŒZ;NZ:nǵZP*2)UdK9}m^|^K.7VzaZjBK5}F_\c<\mzGiafӛ0ܻ=|j|4쳨Ǟ$MW?l{I]voqf"k[եm+UnzZh|:^Eh[m[?QIT"bŋxFR.p\T*m?;1te!WrΉDyjx,k#]!ԳQ>ňX&gk *Y>cȎcd%rQ)#5Ңq+QhG3bwF-!?&H#!EjZQq_qY_iRH #ܰ8΋ŊhM\ sp1nq9fG!~%d͠3Y /RLtFkӡ\Ob ICo2 : Ʃ:KayU4c&ϜBp,4? #G2_%dBR+>a.| sxF=qs@ ݄Y0)։AXISQ-~bOqp?;"s;TR4HH6•%t0 `Hp\"b4GvnM-13Vw_,Q1_@? `g]!gCzztPh -á.r=3'CM*${yCBEXtY m Rw26MV/z/钼vH?i3 lhS`¨DFf(Ь\_ܜvCrH1D%3O ;r,jߥh@aEvy7;S0 A1lz, -8HA6 MPnK|bH- z9DWUB𘂠z'~٨]BfoU A %@ǰlr2p`^cI<BW(w8 V)%$uWT5!zJ _6+_(ltrH e&f|U7h2}`t06 -cP2A J$7?OCj!L0lSAG~DuAYgV\7?QtR6?I:?K 94d0 \`Qr$TOCl6Vh%o eLpq__ӫڣI7?k~"-ցjWuDd !I 2 hQP(ThI ǭ{{̋yy~y$A'b*37EmJO%\OŚx4C  b'iݑ/f F}KF-%:v22vfAi:Oǡs=_H`0Z:*J?,m: 20% qqChmݨ6foT?'j݆49u NU<*А^ _b`406YAP24]f2e\w|D x~j&TxXp%=6s@4j rѐǓ -) [`bc1` i,p<f;/_ -|A;sT!5஘I 7X- eI$->CX?\Ij(cO3 4#76N0 Zd{߽\ml׷m#šC.9 !ƶ˜LV]Q[j6,KeDŽ =<Àd0 x9h@ZjKf{p?pjw˓S?+<ڕߡcSX8Z-PKj~!Bl0{R2Y:=,VGr=/mDP\s`z[k sBfjv,t^<{ j]7wZu@E מVET$xb%Rν)S $"B˸D5ŕhڷxHGz,߾ோ;^5YovYcS%]7+Îj~jrXUPPl,S.)Du2qrgH\&餢aH8, DO7"@@*,XSiy}-z.h umǟѨ1yHJ%e+f% b~jږʑ!K餈tXHFy1_d 9i9%FWa`FN֏oU6>\w1ҧ"6TU"Oe!<32%Q*f<%Ii#b|TȖ 8)GjD́dtm-,_tmkŃ]_t_w]|`eDAmLpfV"tnKR%q)yI㲇%dՈznLHK -B@ -6X֬6c7WG0}wv]:֋5-a9AZRNV -T#$Jđ%"\hrLǟ7J#rn<[%/sڥY-xg ~5=?Xt,S~gZxB/sI$4IŎ gj/C5z*4 F.!gCȚ0 -Em-xlۀl@З}pƁ}U7ܭ>"Ϳ{IŒ81k5Rji`MK vXQdbF0 v<[_o7l@陣UeEmz]~?hn/$%8vC2]$ow/4WԀWKկh!Ab;,å` -tYk24cGfMcݬ?Q }#ف!'Gz6⼆pq^o 7}:Y0y!`XNKg j,eUL9or^!p]/?4$BQ.X=㴞0&+Am;2]>0GzbL;Z hk ,A}kPdk-[me{Vg]1f=Ϝt{jx&{9:jo|}{׉ϾGt~;߁pF:0Yc>:̓|ޖy9ӡ7Fy:-p.]gQMy? q -.,* l!!!{ I 7kKGwKU#-X+:uA=zL[8 -B|潚|w]=hil*5{.]0wp3GN RqU"֘[>asbOn"){>G6bڸ-Gx}HY|HC4ЄaX(AQ> a@TNq Gq2͓$ߡ(2)*%`8z dE!; qL.}6D3e|4|Es262'aqh/Ȣhf3 2* (\GAi,; <As -Ru t:3ALd> 1y -J ' JCʀÄF KTaP-!DXK/ldAV'ɺ.g Ivg|[xbd=xM4d'ѡ`1IgB'^9pGCI<ے!ٟ -tNf@x&v.Ywg!>Y/yB t&xCȀ. &E [D(@/8nBܖ>BE<C!ρ ُQx /(#hPy#o1&BPPCUꓠ4 ʝ =GBH#3 KGR9 &'}HNJ1&QOn=[}KAݝ <Ϡ#4>(:qLT}å -A1(Iy -|v{8TgP^RWhʟk4Owyw:?.)4½a#*}P23L}*QhAd$?ҵj}jzoW ˦QӅQ9g0"7x&XśU@|e渱jGʰs)wtuV+neEc88ᑾx_~aKyrpf.l=tГ|{]Ċ:&N'ؐ=ա#1+mWU]GF&K_ -n[nZd(0[mmECSC-_zl/yAo"ؔ-Y#zY[|%+p2\+9TcqK?gK:-;,J/Y_8Z4h 8NJ),9yL~#d+ȷ.ͱLlK2ȟ9( vmpo]_JSMk{As_%Q{k7%γfGpYeM>'( dȾWOz4̣a[4;Yp؛=n[m .ѕ++ۗn)ztAGd9׉+eU|Yy+׾ʾݮ~.'0FfQC5&2%?1Ad袻[~mC?h9|{ɉǪ]]mK:j\]Etm_Wly8yƟ8H%CESf_˖889v!5dl!ҴeFiK4L^XYA@3AZ6]MDj+.;fw9&G7%ƞgTF.8M$, -%tIIlb樒I^֥N{:+vxof:4 kRe i"anH^lYXVt/#\Ԉ 5=/%z*"9z&,9j649j>$)j%=֓0{"_B4{YS.uEp@ -k%Y5_qOfKf|Pw .F -&BWLxYN\;.v% -#<{+UͤHߴzrLNM~jK -ODdg%222YI„)x䇑 ~d7*a:<:~7ǎ.DDaDrxY~nSћjᮽ&ʷmZ_s2P"wZ~ܙ *d 8ᇧOq#Rgy)~[& `A O_B'=q/n&yd,@؆%`mY`Yn`ug=w4{@7|I:H5 ?BHI t`{R"n>|bf/s/m!?삐OV"xF`'!,ɹ 0z}OX ҂Ag,7{Ɇ_g"D.ǃ -QvGlYMtBt"s+]*W5Fh+ !:i__#;?=G+b `>7ҁO=3@$fAb"h%[WWGmtp:f}6aי D @+5zq$X?r'j"Du"֕ -S g8@> JdHJ[Q+<: D3q,]bk,d;2{!8?Ds3듀UHXAPAK -},N&-*unH2 _x+lƴEwÆ؃Q7Q9/9}pŀw3Wq>&!?{ԯZ{d>@V#֊ArArUU=,7J$6^Z^%s^[%*7!q+C;Q 8/DN&A-d_Ɠ|Ň-֑{@w. …lٲt[R["WQT;KRgIO{[7c! qe#C1$WLhb- -#G4g _4egy?YH_κs[+▲%kҞ+o.J{IEeW@ܩj$>đ|)֑6UTN-g7G8/yZ\ИNn}%7,ܫQ=V!Jy27ңv[V-@g_Bidg'=6M%sz_e_- ~6K]nt^7 -r 9戞;O?O9$w&8|[ٮ]ٖ2h[ͩ㲦ԷƴwI dgQ@zlZhRjwZOkCf>VEuv$ٳ!}*$\KlWv#Ir8}`ZjMk귚}#ꆵVE}Ƹ|{[)!yDmH@6o<l&} ԭmݣFyN$,P}U.+*wWdS6g4e6d\Kٙ٫NQdsqYUDH$[G dΥ‘2VrG6O]m5n6;^.{vW6g?h䷙6 -[ -+eyU; jks?լ}0RiN0-1VU0.{$mJ l޲T͡ p<߽Vԫ{58xthWflYWf6nIY\#-lTWO0vZn|Z^03 iMqTU?(˷y{)L|28k݃(7x_h {YGՌF6Z -Ě*yeNfSkʦԒ4Sb:ST41L a&.&{S͠|>rǔmݭ%"J};uʍbBf\.1M),,ոLZ^ُĀ>ӐX:)(UƔLV&Bٜ3(CU沧iFuh:'ʿ۝j[W[Ģx=rzSS -nW&./fkIiViqUX٬5X9SY׺-CuyTe4\ѪuMBXEAaIXE@0qWzZD -REAPAܵEܗ#n=3v -cNUԞ,gg|~zy}?ѐf͂1=ŧoA4ӵV+ok2?mW{$QRYk+;.b}˶S"{qIyy%w,>{I@m˶\6E~у*!ݮ3FtmuM原Tյh'ly}OqOj# Ǭ;&a)*>K_X?+w᜜}md}=@V^`O2w  Y٧DN6 u1ֳ.3&sՒ"/jT6慮;TnuÛf=,=sӪo2/ UYeCswFRևD"_IUǧ M%S,\RU\,=㰽CQ>wݩy'G,iY5-yc\vSѬc{SkRNo / Æ/?R>*FGRGCo#zTFtb=tG_]ҡkT%^ 1MmDd+/d/>08g6;>'^:1U>>f6#9(TѰ臝Dw]۽j/qTyÈM{\]ۑފ_q3m,k |VS\1s6zڌ1יӣ vyŴ#>3D]!h`?Utr뮈ӖO}[8:>˼&<ت};hVFByCx]DFvAu:yDgD7#jnfʯӖ"kNkzżr =ZkCO]JOxVcz>Fȵ=U͊t2T8w(C@u752ω.4>/N͈V/y/eTFWfɯfOxdחa3/N׷!oc.܂M |{FD7$/!5Z!Dul+Xvv'_=7-)_3{p~jZxY4C -UClw~d5IJAlbY?hGXaD|K#Q;#JÎ7n:Z(3 -BHc?d`l.ATVK\_0l_Lj*P5˿C)EpVCԿ.4YEjE( "A% #@#r A("HM׫XVG+VWZ]gߝ/g|g]ך$i VcjD0!D -hzG[Cq n@=_\r}As}F} -ns[x -ϫAy9*Φ9|f9DY@DB(KD*׌F!.mz?2a4;Na1vk -ZC狰oR # ~H{/px*ٽ_ -LJjٰb׻ͷ=o:~y_#!|\qw| $|ÃQ>P@)wusW`Qn2#5hyR/ף5n3Q-߇/5uM  -N :!x\$hB6&P(APo8.S3)mOEHd`\iXf6iK'Ed Rtv阽';' :>|$l*@zg!U 4S V, =vS^jR -\g [ͨ.Ǭ="w99)xOHKU|%i t D0^y(ewE&:bh F 0$@@)=Į%Ωs?A şS~+[ovlLqɥgr"2.GRIZYEࡄc|;+#vl6Knsc$SA -j)0@7b-ǮȳCcSSfz3%쥓a㹱.#->J ;,3*o&e=d}06ߐp]PW%n 8r r`d0q-=-@Ѝ}M>*g./.qL'꒮O+IX") ]E7!=*nFgfONTF*=ERώ\>fP陕}z;D/*'Dˡ9a~5i(akRe --D}/ -=˷Duz|o.5-Bg7߿f6x@ wqo]GSI:mu~nG߶a6޲z1hQoge!̩R^[.*KחkUM/+(L U~P^^Z6j`0pXWwT hu:yMt52-&bEKh}]m[UM6]e_Q*P+K+njQ@ɵgCe"y;B;9S w!!tC}fh@nj ՔUOguUMbW]CVm7ϐNԱu/ D{X[~|pL[V)DBwNc=fh rͲ]5gm[Gn˞YʆܠRzBNQH~T -Ș -Ht@ĖZYpـp{C |i/CC._-+aNn݉[S;mŴݭՌV"0G)js23^;B|3$toL>,u'{RFj+E^O?dr7 N07]X!@*Bw]Ad Bc _ݤt{+k/7ZT_ks76mDna-r[;~cx|D_|J>KˎEћԂEG->v8T)Nв@]n|;)T{s%35q0Ͷm@yW5;dd&GyS-<D6zvc_֍Yco,dYbjmt"\8\ۅHMkD Ds;^ ,4㹼~ocd 8= TxV{ .\;vhH5mL¯.CwC׏ma3>^gsX~G[BQ(e>*  MCraxayFc xGaw$xKp' l`3vog&_$*BM# |Ʉ@CBZ(( *.\,\ xH` X&c ࠇW!fpU3+l?D"\" Hų: Ix -C =q?/8T 籎簝'c??g5|M˾Erb(xS(b -DZDhĒT /j!8K"f5SdZm$=m2] -{ --HEbfy"z} ];ҏ|!iү 9ꏨbD2wa1xd] ԠkyXzLVG'zB9 q h( F|?b2 ?ɜgfn3~_r -B,#dX,TzGPA}1a4{W#"f2ς友#; @vȨAKH?0q}5HpvE,UO ɯ)cI -n e@t 1W͈1Ҵʀ﫧4OmbEۄ?+[+M:VHiPv}>dj3q]3r57`g0o/iK9XߎM9#sdkQ5nBN y\8 <; ?QB+ y#p!uNxʶ [Ÿ] X&wg<%ݫ:0/<8S6|n:9@틼H뉸Axh|KD~F!ZS4.y} - -|&t3I l}#fr+Ȧ0k4f,9nD$s& J{jUwQ1k n$o<.x:rVȖQF"vIv$5 -Jst0k울 NeNEOU{JX( Z0D] -(ަi0E&pJהFߍyǷ ʣl2v2&%ݵI ť3ɵD K%)^U - -/ -Es -!Bh`/ {o. -c2{WTKEV}9{[I rU:]M/6 %}_7[͖7[|ĒC_dD[ :U7JHu!ܪ5*5LNe莖˜=jС&K<\YH)ʨ+d nQnz 1!Y*bRSv10x{J.7[$5; לvU< uSTbt<%7GEϒ׳dYa$8̯~Lđd"412D -Xp;O눠kXMaщԭq-5ǷUWFRW%TVzeRkYE;')O'̝{/!s[Y)(J"j& pk0hkZ1i8f .ZU*+{H˔Ԥj<|/_|b +.1]$[=gp{W#vVvYB{>bc'ٸQ9jU#'!@jYR.:S%񫚙'+|*'88|"*;R%S"h5[KLqf`34&w3T1Lz-#6-.Y(l5+ȼ&WdC#- n -Va#FpV#ZX+*_ͿE{Wp ``#6ფ!ly +@N{Ss\»JC:՞A=q;mAԣ͈zL(Auy{oq`w0@-vвuq1Q -q/xl#GN *v:s9>Վiq\r@ o/"s;ٿ}52GpsgN kdӻ iWRX0o39jUmW;'2w(tێLݒc} 9. ra ut 4|$@MH3v;b=IQ>as7[MΦ[sf -fjvg:`Kږ:duȎ1{\E+WwA'@?@ίXΟH m!f[Bਞ_l쫏^'1)i}g6Ky+wVn|8x8]Mh_ο-3'pC"HvY(9yѡY&/J9hZru3W/~,=A}ny;P gD.~gЗL{(m# a!: 5px7?ՙSa20 f`FP"JQ,X"q%Uc jtE=.Y{uƵG"%( -!;O}}'~$~0Ofh#v^R+uBW e{; F;m_ x(6Q}اD֍"j)]5GPps`|(|H?-"")bϏ߈5X/v~nH>6J-߳* .C4'DD8?( - - А:H>0ZArCOY -yJLX R`Ev%,M4/q-T{cDAD 38Ӆ㡽.Cw&]mqm{w'♯E^d֬QSzɫly]jyh'P=9]}GK4wV{Ju#qg|&xBSFӉПHD1v( Cjxm#TFtfNLPɮ+( }߆}fDTDDYaVePYM*X&FM0.59Ѵ1ihKs޼[ą3r { ʏ2hnڒ۪1Sb_ǯ*Ҫ=RDna_Y9sMF"",MB0R߯iPQt &VX) wj+\ټwIl徼Tʜl~Yv)(NBQj& -S(Xlaᮔ^;4>#80Pk=uL{Ӽ/xE}ZhBg./c$18%#p0U$MK]O=O>d(NGQb. -w`1JD}P:}'ih`A=hcZU4u kbMeՉV9iҊ~-FX_r'N>++D8E; -QB`4ԃs5ԃz{vH[Cje-ZEM+c-$u))Y$TzU7 Uxm];xs6pk -bJsS 5PH3@/*Ʌ.3rev.+k_ٶ0Ӥ{,wdh9(w辩KpBr_:lEX z.,^.Vô6T~GK5=Z)GvMw[n̳>\Q缮kD{xv;a="zNϤB 4MC rfh a]';m$gxF[bFl6_7 o7䴺)AU輺ɡQA5h8AzvV,Ns!eL83 Gx*NgLбB㐱Um -kpooȱ>^AwP~1?OH1Łi=3LL{յ3OǨޥzZtnT!ACӷyFsh"D3\p-Ds8I?DMy`%6U" lBgE b eJ2L^U++fMOe?Y-k7g]ew+bG)F)O+a5Xs\3 )ς@x+܊f֟btRk(j/˔? 'ODT up~ `$lF򙔱xV2eы,?xO{*PuAo_t?_#?%7j`X~|0^@0WANx絔Ahieޞ`og?hΓ|9g|Ht7B|{`'  zh%hp440ppX%B0H1Bo FʗRQ>= X=Q[LɅCy+)hEˉH #[!`|E~\BAYpS8RB7(ˉ -ro }bL x`B/Hb͇C<hƠ3̕A#z jAM,H`Z&)&5t>2L$U)}~D^ KK0hȠ ]̝ACo l`rI$! 2A%r|INeJvv :2hOZ1[•XB\RJj٨B: Bw,\'u}GEugqSFA"3u -DPAd230 ",BK5ZWcM=hbY-b'su߻}9(zy'V&q_ Nq%]ev^Hihde-r8hQA:'hE"[|}mqBLb?ǖ( zŨ-,rw( e}ow?$kxo%7WCgҋ_w?=߷{'+E;oKQܒ(['e8s21E3fNPxpz]8oW.Z ?Y̬ Y 0/2]7\ -g'\e -/p@w$@/#@oZP/^z~>+]}A&ݙ;U'Eb;w>3_q)0JƧ(:@38]z~@Iw}҆<4{~ެ>;ܛs\Z&Uٳg7'dY>=x5qχ&G<ޚ~f

#z}b!\ C a ZdC_E yN68=qh~y&sL?ݢ?`xOn>A]gwd-MwN6]V@A`Wal-pM9G2p:ҋ},b>H.p ,ݨ?$Ev/6߹r{Z6A[K:K7]`'QkԱO/&f~e%<疈JGT؃q=ѱ{#4=]7nmtۯ6lM%YK#٪w͡hOPc8O7cq>_'d$8,d_۝P=>Ұ;.AԵ$lSlEGtmMֈ6eY˩1sC9z:N(#5hWұ0e7gRYp" S'g67c{g7'upKJFu=1Ŭ-![ܪYĕ6/Yn"UVѩ6̥2+yy]7Li :Ƣ8н}I ڍ0۔)oS1ņ,؛m ;s䬞l/^g\Pu1$U)&uMCR.־:acE|sejkQ)Wjvţ3q$2 -ÍxAe Z!3|gVglnG^[΢ DY f itMuZ<ʾ$ɱHѩII'ܴI7r/Z52ĉȴI0.x82LcTe} -AO)tX6eiʟPj=VٵuZaIBC]U(ReS*,˶I+-K5;w01E]#.BdSc -PFF 9Pg?\Nay4;ʛfq+ Fuj,ĚqҘFYdNʊmLXŠKhLX9:RXU[<^H}ݍkW J8 -(8g6NZ`jNmzN?f`afnMPEESkٺn]6eyZ(*X -)JYYػہΞ;0}'MZB׋ǽ2-c$)nJjG%W?ō'=vpUB`J56<ցYki3d^S`gꪉ~E+߷bz + |NXc.tsȥձK,i)X,1$f=baoy-~KU^)5cFi(ޔmJצJGxiqoMnx$p̆; .X$lhIix^IUDnIcDܵZ"sVIdގ5^u+7r~v'l3`Jy*qEX[Qsl$S}Fna)kֹ9[V̭3ʮ؇-%$}0=5P-gťʁi\&TwWQXJ(W wݣwy2df3]/ӪKR\;-] lI6h )wHp8_\ɞ:P;`yVCNdQ7F׍j)3u{&կro7$1T(c1f`6ɝ.`2Wûùf6hXt$ G<gSFcwAUQ˴2-Z-~ˣQ;"ijro`R?PTY@Ƈ& cO!g|&_$#%;`?;}MCO"h-ݰ} `;+BgDi#3~n`k/b݅ F I'3@9=.ak[,m03Lv^NOй^6Am?tuނvU*3N5?evSO Hflo|oa1:w4;pPA7 -`s̟ɹ2;ك?e[V`'` x@7BdNqL9ćᇡ7\.,P.W/{rg̎ X>̽o,v$'ehB| CG{"$(C iJ0~OzJclr}jO][B 9 <9Sb(T/yf(ў:-TDA@'/R'yN[ߛ3?;nD$_}š-&¸P9U^x<~4^.0#;ߟi%G\ )PaI6Re١Ԫ֏ k괶MM6ѮAbN} :F9UrꧠǕiE`_PKufT :kA+i_ !7!q6Tt-? A$b@k"q$>ǫPZ%vٱDX}ب]ti;֨ڹS+D7Lj:##ݢ{-T3$88t%|t$ˉWӵ ki-Η=>wqڹ\wYsssy6%6{6&]jH`T$>5@| q4Ay@+#Wӝt[ZF⋴dډS5?gcb)+ )yLeKgMi4Hm5M'UvSUX*iIXgk{YjveVc5 Sհ|w cemyUWo5+ o" JbZE( K!@k@E(޸junkn۱vvt;ad?=s9s߰NJbMH k) ^ ك{x s%' 0!n%&,%^JR/5|ϹR3qS։ةPG2{4!xW!s΀e$ kg|¾Ct+J\V卵WI*9}V8=0MTL$[ƒۘI=!CCY=2/.H]r³ זDظTuYc繥ΕAt_fMMtfv<gTF0즎Їyj^]w!S[lϩ mn6gu4Caͤ&s>*Ie#YBCDHYCB>9Ήװ{^.p!g 0e b GP5&0z -ޝ,}`k~ I_Zȭusf털\;')Yh?P[xJ$  |s×jߢ7 A R7 -`LRʢܺKeM - "]`Ȭ3VVs͆v~YQaIH?+)/n(|+)1"4#Ucpу. {F[UQyнŜX[W]_]j6BJj9%m|cqP4*Ht+rޠ5~#0t`aB 8Y0O0{Ͳny\VQS -(2UXEj/-唞ה^dޗd3MD1AJ^W%fA=X4By#45Zѫ ޥ~E@C]S_kͭif!azSz;\Yu:\YHUITf"P _]AxkC?4 -`Cz'f,@w -;kW j0\Ž-nؾ$mˉuY [uMeW/ة)ZxM* u]xpNA{&q38;p;@57h~D@t[ۛ NDn^>pW BCȃz`uP y2cc}8ܻy3itu` cOx>>ޏ;x}~lFຕ@Cq \֥)bJr:ɣP-g< <ܗ\;JܖᦼUp8^E' 霽:'8^vMm -,U)Q٬jifM~/-߿-4˩ŸS۟*p-lQ犓|P:Ma(UOUϰfRn1MPm6MWf7 -l0Ԭ7m\keYb׭Vh %? Z+jslgXgzj~:J[EJ,6PnLW . )lڜk\]n^bԼfy\d\h,7W9aSs\ Nq+H -eu-??;w -WtX1QcJejtȴ* -OY4KTh;7h.?~vP}^P}n#~zБ]N-:3.mKvʺ{:+=TFiXCEqYZX, -SvfU6zY_L.4W:~Frǜ !{vziBЏdO%⹷7ubM7gjHwP,,ΏL떢u͌lsdvq);|a\NwYo _G=97Y#Y.{{3~,K`E=^&W{^VocvJ4yRp }بR=9$A_ٍCf =s c;eH~kZLtNr"}zpppc-4CJbe6%%ppj\&#}YI %)֘ꌉ!;_3T#R4b JIOde7 1P,,.V:,UHA@*`-k1Xb]QQD#UѱrԊ:k+ڙs@wŤ,F/(GFWύ8;jSxTQWc(a>_# }xk+$|dm8IZ%BN(If4-yYrR"!1ba\eLBUt|M,9"V6:p kv - A>0^舶Kgųf] ޹>-)9;r=$eѹ~Ȝ9aّʰ4$Khz: w=}lIV|(fYb.sFx <%!e3˦˂KQ~-'-Vy[M(Yc^IWؒSڎ]*lH!)6=g;ؖm^!I.I}*$BP# `hKWjlҪP3yU UeXxUYRzVnQyTWW+>j -a^c{s2|s@鎭WU[` |7q8P3kH̐ Y I{6+1n2w55w1lmxk:VXX\s;}FZ:K+* <moԪYG]׏[\?Mx,i+q1K6HVȆjdCLN2T+䃶^7τ={tW -MDofm]2 kPO  3CwǀPosc6.C}$NKE%q\[Hv l#z,za ˞u?0 &5M:0h`<c=F`ӒrXBz\U3X>"$d382;s `. 00(лв]:!e -mv0o E2 -N?!kvN}'5) i{M'܋HDrA..iT5/Z\/_\JyC2h/`pB/뭐yO33OW:赦;X_*8kx!v7\[cی@77,]N)KOgͣp4x0mځ=jz/ȏI~"r~T<</qC.נ(++7&F,(,ȲܖEvvrY˂+  ".!xCEh&Fmc6If:i:MSM[vڴ}z<_9y>|e >X6e7pmŕOK\@$ dXqu,xFVe -*U-])[kkݵMp={aj1drrr_w~ko7CfC $r"CkKGmoWkqKp/4 nRZ.GRZpP9E;}VC)g~֬(b}Bq}Lq==WΑHH둄CHW ׇG17r}G͛`!:)3aNi(-)>)wfi^Qg2z{88w}Hca kl!Mw07ߟWЧ>(U Qϊ귙.=CӞOQ[2 $<%b޿{?@ωlsc9ʅ49Lføv33 @fkזs5ތF~OF-L/jOJ[>})iNؕND"BWO_zp}b0L -&tRݱp@Gt>ի/`wg[]6^g@ێ֬@wV?Ӓt3Fݼ^wKZVw#ơ#"$9p7\G߷`=` -ci`@J0C1)Q0󊸞<+ߝ[ВrE 9{NÈaޒWޕ m'2H1D>O1wW9K(D}7 -A) iN3X&{m.,5V4 -ZE5=!8)Ae_HSGD瘃[xqz~\__z_ΒhlViI]lvcI>Yb9Jl5N-,+̃RaYLPZIXn6iH; \>b';(}-ügyQۼxQ}z ?jXxc^.=.vv)jdҐ0@+w(RV, Ư\2ZBm6^V{Nr1糨{{i'҈ߕ>j@k<ɃȣP]S!> kjX?7vy@E}eaOp}P, -(q]ՠƂADET,NPXh{,G$1qu]{Xۏ{@xgygΑڛ%_>`Q2l]f(2C/)멷4y赌A.| b38~Z9P rxë;<+"Q1ír\\p4éUp,2!9V3yLYǻH?RO VF*gS݀cju#`WDak261ZCcIڲ*K%\@]+!=bԝC݉Eݸr6ԯ_ȠAVh6#GdeYPV: S^ jO-Pwm.߃k=?CIl3Yw8ߕF6eل\dikbR5љ&+"CV!V`zmDQ7+|; R@.Wtll]> 7 Lb|II}g'&w!h!y6N(F{;Q׋]# DuOrLhv/C?[7lO 1yI#_ҐWhv<xռmּExD3=桍i<,`!Pqk6@kA? $#dYM6RDJvRK!u/+~xI!쨭PpW;H32$t䐍dur -.2i.'WG ƙ5H?2|B>N"u9RkC:k%2SVo>~CG7A8RWm! -GzjXjMf|tX@Tjds"@# ~I p'4q7F \hK_hZG9&ۇGx}Lԙ0&He%rM8O_ŠS 8tZ%#R9SThgG8A'5qU˲h%|:bN+qJ'98̃UYê -4jpHՀ&|W2cjAxQeNW^/'7~}6}pV7lGX3`?`8nsWu2:AC=84aT9F@YBz7ˈn.yJ\C;N;tQwðԹGT{$aL敃*|Tx{JHfKi -IA3!!Z=k, `;孁Pg} lʎcPR(bdl HVJ TX)Iy'e~LY֐՝FRK03Ov@ol=P4[Gas8OgHy!s!) !!9!5!U!쐣eOKC"#TțY?]8iG,=c~3XP7la(<`G`q8AZc"[eLeʳƕLFEq2ݸS^~EX(\(I< ԝn_>|r8nU =+LXcFie%-7e&2Lt\E)EjZL1S-0FlSϏ8gj1=6 ,Pe s :W|j -{Kھ>XX? -#e&5E\F3+Pydvf>6#hE ()Tm(O|ǧJx bca@OdFwƒ0XiQGdcNR̎LNNγ]mMV71.!Fh*a`+"}ccbuX2qH &̏(͍͎)K#"q4!SR4VhuGEyafav .D&葨((("0 ̌ (qh]\Q0.cMh4rZ=&Ic\kmm&A;8}}yIirjIjI4j{'JxU?3~F[6a>(ѠԦ*CPnH t$=WV^PVOW5MߡYgMYHc֋*^TZRES.qaQؑlZVudD9TfCi*LiPlJN]Y(_Yeƕjq&˸KΘqZqC&#CT ҏ}mf`69x%RuԘTfbK0ʬcQbBA>dbJxyhI%){rs~0AZy(R+‘R9HLT I\E4L6-U]ު^WY>J"r,JB2`y)PK8]LWA߳H^FB@̯}a瞂hĺ0ǝ"ĸ3ndX宖Ns/nO}M><<P{ - ~u@7hYGo ڥŠ$;Fc@G8;#\<өG] - <M hw=n];G;65+P`0^ہN``~ jCp(C!EAeaqC1}C"? 6je6րv1.Ao8]@8B{|a#hB>n~psynu󘈿+27ԝXg&Qs459=@{?0# pZM3lF{p3,?gyٟ!a{(pm>/д.d/`=fC70ԧ'J"H5K\~¿ƍ b^?EnD|B]k4RCIX= -(z%-BR&kOm?rw޸p0>&?62j4hGLAIþxq1GxPR*Ǎ+GsMԝPS20l<@?F-5Aո޸5ZxWXwq+0"<⢤MT8UKƱs qW\ %uW7hZpYӉQ\ňv ¸C8? ΍3n&<ĉIdGoN~:G ӊx0n11W&%atrF&0- _NI~GH) -^?`ST!|:lG0V#ӝ84ߛш3۱j웹 Cv`p>ݳ10v%%U'8V? _LHjȹ{<3&̬)8>'$r&cp{T`: 5cgP'vö~ak?|^ .l ->/څCք|/@܎FcyG92]ұcq6-.Rlw/# û º]bO~qui;X\/=R}F4XLk6c9 b r&G/Ė$W|ٱVW.jձ*]إ[/vI!-;*ޕb$7SjU=c;3Ҙ?ov$/޸ذ, -Xn}+Ra%=W.H Ƅ'NQ?RjjWr^\ Ekp4riӊ 2)I~<'yNGWJVRn0͐/BBl4ԉC6 rUe8T.j* w4eߓ(N*;STu˯lU' j^,^h71nFȘyP"\ֹ-B-΂d,NJ`/( -bAAdHyղ֯dۆ4fi,5L}2dZU%3_S11׫=W̽H;Xx:O#c㳪EpFIB81(rБ-6!Q"ګ{dwY>ey&& MCMZMZr4;ej\A+XEq 挄2r˲S/dSYlN)ݹINuVR55I4)I%)RCm|GiJ%i"ߋk$UNjr!ۥɕ,]]EBLHuW ]򲪣r|ը纯UUT -U+Wg`/*!mMVXE] k#ݳFz}IEDŽdAyZ8Z1~SIOrYSZU!ϸ\R㻤Ž@H55 IFJd$LEb<[ðu ⽉f`ׂX.omBw{P ޻bh'bh*6FU {'Za'|/^@,%#k& jU8"W-EĪdĢn+ºKuG|qXYĖ,$&niTUk_p -"$DԒPJ2UcLUjj:Jϕ:Gr#y<꒕Ȭ g*]FhI#tM#44B3`i M7-a *tfpY Sa*gC~mw@^dQbOE*<7Ps#)7Fay -믐 - -̟j_v;\y)`jcmAv3yf.fN5`={e!/b򥈥Rpq/R?- T@iڔʿ4A~kS>jmVҾU^#_WOjYQx?Vv&gR\)"K/ʥk%O<Xp1Pom$5qQ cXFTޕe) -SM4PIYhx>]B IϕR)51JjIb۶21 ocR P RCk(b Wovm7) - ĚzrjE oTK;$]++>v۽ c~ǏZZ}-ͥbbjW#0Gi%oFɺUh$/5?(G ~ŏc0$~b9EQ:_|F^}I;l 5wKa MchJV0E:\:Ǣt%B{ KuL/gds2y4]!T=AOI.?H+XMXPܥq>gA*KczM#c/v?>>~_zNo:ptp0JSjc &C0&51II1/gה_q0ބ10fXP+` -6ПPOls&\wV6= 0a&~j [Z=W^u_:Rtzme.4+k4xƠF -)O ίu/`@hȉ+f7r}!>w7%,gҹYn!Kktv> KP_ ٤4*3ZzCǪljjm3S/`R _Z- -N!Mhon6\[b6R\wϑc*=Vc=?jCZyF+n{>@NZ5/bF*#r#7i{YQǍԨ+ƌG(HyNd7xg{=Ê6Wvg"7*l.an ZЭ跔=Js'jvLbR53fg̈YaT2c?5b/ScSbM#I̯\%gˌ\}2|))enE1>=*U)@=Da)fn$[IcuhuX&L;by7q3qFzWhD{o͌ qڽ]iVK4+>B =5#>4`%ۆ)6ZSmD{d[1ѶИ`+UXj,m\Fλݳ 1g$b>ã0{ KHe K"I&L2IfLB&$$C!"ITBR, @!(}cVVc] -B_Hg3s9|/>X$E ҐcU8E5IsT@U-wdґ -G@2#Xa:Ŏ;BGYn;[ycq9.YK$_mqg.j]L,kc acSUU -TE<',ݩӣgFsQ3Lw[,q+'+yN+fNj?g8IK+MuJ,Ty]̈Qif3ȝ;KnEFk\mǽvo[Vr_\GF9ƱlMԀxꉧ,'r`fE8;J9SU3GK= qɔϛ\o@^o1Mfg<`9={4cVy+󱕒c}fCV?8+/n-xBRgT7\c_-or}'w*Q?_n0#b&w[I^+Z\xm&}$=o%PF0 7f|>xhA,BeVVQ2#*RzTVj|&)ԥ`- -V(!x lc 4o2cؒbی-͸"ۈ+c/bO~o&j`C5o(]k(FӜUʥWj֪"ͬFnԴnM=ɵ(zۚ\16&gJm<h|Pu<شZՃ4>\3 i7ѴxMmthJcuC2Mjӄ6ii|qkzCz[Qk`mD#hl#Yy&-)tS4s!&E:TKXܗ.S p8.jkaR3нAWe4ހRbc‡/L>e~>g|A`fNmh5@8 -q P`%:X>qBx_]}%~1%ޅ&V#7B%B70vޯեh>g^}~$%zEs`@}xËWbCaADA z,EL -Fe;{v0-[nrt#Lqjh8Чm>GulꖀiEP0'oeX׈?L0?gpjJU^lbPx;w@x#F7b;&"awQ\r㑗#G~-QXM7gQ;O-SQp2"G#q$*q`i9-2 v/kΘV#cak6X.#/a86`Cj~c>11_Cqy,$Ȱ31;VcJlYi$+6%90HAOPKL=PISA&ze?Z#tI %UoW9R2yWP~XaJy;RU496*pz9֧1ڌv d?}ѓݙCM7!Y'KG=2%|'>KL!rl/碗͙s1  ec [Do=9 V8PxWtS9ڕ{QNUy^ g#?¡3m>K,;&Ygɸl`\*cїyŸ_΂j -([ -OaZ p6¥jJ4 ꚰ>ªzB$a-@Sf4(cCO# 1.aV-EWQ|řh/΃D*.m^4aS$E0 u3J$a"?JE>Nśi^t!:Q%,r\pVhЬEv6VZk`n&AaԾ& EQH5咸Oͫz4KI='=駛qfܚ%piQ)CSU6UhԕêӣAgF&}F F@NZOIB[%*%qX'{j}񻋿UZLXj`-P:FC#j -1tBo Ag}Bcr:#w#K V5HA 5Їf$&"p|wHdꓰb | .&7P[M`븪oR#$32R$uHYjA\, iD"*cDAtH8MENLm]'{LwXǿ *pʐ%DqEׁ /BEyjMl`֓&8֪16Mn?H}~~=~_Y⦎%( )Dn(/WS:`ʖ@Φ%r2mKʡ|2LhLcx, W<$Rk3`\r2#s͡jgQ[ ٙek,3ƛvsZ+*Pb[嵅OΗg -S3`VjeSˌ[ۑCh(u:.:.Xn0g<̙+[F_sa -SyH1g`^.@Us$z 4fp'Eg  -m=E'{xK4bX94s퉮j#MCd;srÎ]ر;ر;h(|Ful]pwr߇ {)5՜ ݌>4Ap&B4hΏ{Hc_N`G#I#ůKuX4`;1'-cٮqux-tɞ%CR[1Y~ւ}8694.HbU(Mm™&>v ~fتnc8!;ݪu.4@W 9| -Mywt{>Sӆ#I? {YrU -nGL_M%݁{ց 0=&&OVۃAcYp drXw@0C̄9P eP`~aY̍;ټ' K==⭇܁uޔ_8 l4r9 scxƎi )>s]u ~˯| | \K68ش +/cHgi? ؂.c*Zkl7ң49Y}]ZZ9flAMOŢ:#WϚdDeo{g)Q~hAN^Z0UiEUUnE&herU|w+Wrm]w?<5nk0I!vßWÕ_n/*}cJ;U *4X;<1*J,{T\,POfӌov?)E]C)!*mU2a.mTAE5k)7Vy~7L9ɚ?^3kz7P2VkJ6Ҥ3J &=UjE7%gaz<+Ŗ7fn^ jzM9X=G(eJSF,BW(5x&k\A yOcB+%FXZ(.EQ6XU<+Ė|l%69i!]552{+w >4)l&MPjX&и /SJ -ج%E҈ CE#\ 06C9,{rhaVᮚɑJ쭉}5 5D㢒46jR'ktQ@#bjxFOCcNjH, Q-נ\ZZ#mPGjRRc<5>_b5&.R)qo%jd%ŧix|4,ޤ5^JأNh`'P-?<*?we1 $n "" 2,0QNHAA(MqZ5q4զM6mzĸ&ƚXa9}"ΡlX?m _fK1SU@Y(/ir'+; ,E&C2 2UZJRSdHPR>%RBNJO %$HrT#,g= 3 -boeȜ6RpeE+#=ItsjLJ26(\MG'qA;Nw(4bS:F @QU5IVcwU^56=VS5Y!r>><ekzP -)iluOy-P0yڇ>+7{4>]5o_pS$l7SO7=ϡ~z&j"9Ff3A(h ܚ4K}i~i<[dZ8ZL-P kygຈmlyh*^/|3Xs"kĚC 7IÚ%%m,1ϵxXE# C N01ҾCP"p8iFjz͚ 5Jc{Jj}?@?6f p뤰;YT':ppzybFcI7xZZ+ow^BmxBP\wFzw>{pbGs֏ ŜC9VM(gU8@xuq?Nx;AEquO/Nj[9WuqN ?%wŗ̺75f/NLN>V 1,vb{%Ө;[|;xR>prWJU}s_DщTMNΨ@Ə7𣋼:~ŏZu[8}D|E Bm'|.85go-/(t"шZ:s_lخ|l6bsll29=قldsۮ"G'#$:D b]Pr\l.`w,$ -ϓTVWUD̮r]9 ];A1B9 (hr4*Ѩf,Ry ZDd+G#r"pvrԾѿ+`ܵ^ Gk4:ıT-TiL\Yn0˰/2,3,31 $vcxKʭk7V괪*RRU~V.Q*Jc;R{;G: rq+YȦcn:JFd)ﱰG}VuWj폴~UeZr6f_T=/F|Tg"S8%S[K8]ͱlsrx[}嘽,Lr fÄce.vLg2=&> 1,wvi9Tk%?k5t2Y$Dq"nG9orj8`!E8\IL&1B(iK{SH9#3jJCq'_vDSyʝi%SK,'r %pj6iLU1݌2ьQfL4-0`tݙ2y_ d2LG_d}>'.zi{XdU˜jɌf*3Y&w/4i'p y-0ws_c=om)]Ɲo6t=&ezX✖.kߜ,ȔjٯZ͛ٗs J*fwa=V|En+x O=ūt?*%o^ΒVGaֺ"tQޓDY3%R=V -=xz1{GN]a92k=c`~53tRLrH[(m $`H#Ϸ\_!9 -}ue1ӿH4)$(~I$ =5XE_Z#_t ^}Wt,RT$k$S @:;I Th$9")Obp/ yvOL\Mb&&+#rrC|ǥĠp!ҮZjBVCq$Y!6BLaCSl aTdo1'"lgqHLݢէ9(Ji+"J_1uBp:ع DSbsMa}aܰnBywx fkf?T#VJ٭aH=Aa+\89JI_4)ҟMDZYXI׃(ORS_US[Ƕ\[U\=%=@vP5,O8"Y=%]6mzI0H_)K0l>.wR )ZL-vj5!/Cp'V54Xք,(z۩g C|D' z "9&5xZpT% -vz'57` BcㆎS}&Tyi0(:5 : HtRwKc)j<)^xrS긭Mz[95YiGcݲ9S OkI7e.5ӍB 2{2ceey(Kk]XXXv]`9DPEEE-}3Ѫ68ƨǚ&5UcըʹMG϶&iLL9l?qg~e}yG㣍 Y&FaV[O?r&4ݑ Cƹߢԩ~?pҪ 'Ki.g]l穋 LhݷS c)+C7`?vj $ur.{gxhV.37kznP7I7M;*D2f;y6U+6S|}.UXzM|;]jsrE5zH]< t9}" v@ Z3a,tS|=t}M>|\sOzO BVȆB}24FQG@Ǘ9 3ЕbA\Ru!u>}p?^0zݣ׽C.RC('~n>_~fb/%||% -x6Otk?Sn)qG>H^WBԟqsϨسu8Mhl6uF*ާVc%>V2e e摍ϯilJfSQM49αͷhf x%{Z1p"ơ4-6o,P -4jИTmnq_x y-5+8{wn}W0zh%KdhVWfvWc!޽LӺR8MI~Tc&X[Us<1=/gjjb(Gˋla5øph?YCif5iJ_&U}M (Q]HѸ8C5 TFU[UWo<=ߏ2pFqZ#-93#gjҔ>(BlQmp֘~+~e_UC,dlְڪ!T~q >O ИUEktI"2¡9*PJ4@);҃i Vgd(͑TG9du(9YgdrF wAF2:)SB}ځγ$:P^ ,g3_Yٲ5(ۢt%ggWk̮*\Jp5fuoQeEຬ(]EgS WgђL1P%PR]e`Yr#+sY<9Sg<);S2Ez7+;y*sIaSDn[X,4&rP ^pV,o4 P!2WdU薡PE#Q4NE --ZE'̃>8dY]p9dj FEvǮ"!fRzD1j56$HӚ1ZsL5Gڴ4uSv~LLJ=}}}J,}Zҗe-=/kMي\!iZP[OhgJ(~ԏ0h.CM& lXoӈ`]~񣇋5顸{ ٽ ]k4N>brK $B])f:[`ki8`ogg~rr9H};¥{Ev$9P,z)YJ\BcU?t-=7L0cQq-)8ť|?ct$`]9sMxB@w~DŽ q` -a2B5XXQfezE|^&WT_?xNDH x&@QGՠoLNי1]e -?>Ǐ?Y>c2D|oI9d 88>//w@<)3̤NL ?>ď0՝?{wgROyN9%x%cd5^ \{%e3)/&.lخlln应wEVوvϓ:^<@G!.b(?hDcy2ĶuDڄ]?Sm+_qх*?J&v%} (nC -D:\fkmt*t3zs7]/Rk3ɰZ嶥jm\Lʤ"iʒUTZM8K[T`T}wj9ME$QnrvJˤ3i ƗR-gE)v8T:Lũ#5-u&0PiєA^MԬI_ ەO_ kx -G҂Ҋ. `+ܔ9"T0k#Qi*7eyG(AuY`w]`e]]6xM0xD⠉hhԦ:M4=$ΤvI۴;^37{y{wiJ>SMM,)O"t]-)n~]6pDo}=׿%؃ -M|!.oNP9M1#U3&_,UVSSE嶶i] u.XwzHb=xpgيlAS!|(^UEUY\QYM29m^a,-<ٗоY.e|9)-0pvӍ*-M0 &]*pĪ̑,Wi*-5,TRŮ:&5UW27j{/h*u]9rFc3e.KFB|P e;GYli*.RQyVe(S^&OF{f)ӡQ]FV>L+y>FG*^3T͑[|oF׸[SQ5SӨ|3kWo2|ەۯ4 \UZ FoTQ=Fh.& B -}/P06Fk[yoHCY2uLRz` XmJ-ocB2)f(= &rkxȧPPɡf%*!BCC݊S\bo+6znڌ5]0Pp]W>mĤX6&*%p¹J[4,p(.ܨ0/6&|f,4b96Dx5ƌ@=|mA{D'Rb45AC[R@pDT#EMaP<0iBSBca<}P{{$7eh6ugrј?v6ʜMncښ 0mx9c8GXfH⽓1[s)V)m)nql( ".ɣ=åM$wc:<_O&(ӧ &⩒iX tSK(kRˆpp [eg%yt2'9drcN/8&s-[ֳji'7UjCm^0}ƛnr ]"W4y&걙ztG7B=V6,Ԣ\1ovaM]QD:Ro ig3tt:~͍[`+<(f"$#I̯e'{5N1bhof=Cc@~ Wad 0*r޸ΞqM&:$fϼɀ$`8dA>ؠAd,-=qB~#M][}wuO|ʯ~g ryAXzEa N -n2.SY4yy]C4b9eh'{̻Ja,#tZ\S Z!}5}L>U3 xG;h^ms{V3]8 -Je|INS4hTO[}?#ĞIybZg)W*7eƻjArz}}Fwㄧ ShGV4\ԭ~b&Tb n_}ث ѫmM-v,ϵ'`| />g,ƒ8B-^T*G_L|7{٢mӉ9:w [iɨ Fܤ`< W;k,ExNT2yg?fۈ_FtA7 -Z9#9NZ֓I:Y' -\9yv2È?#KBh&t0UjgBF5׏p6XfƱZtR'e]o;v.p8qNlp9&MNv-mvJWrT+[v h5[@QZXA\1& -  -!:'}<_+Qˌ7ъFQ4$M,c]OxaYEVW^eN{{J;Q>!ctM:^FݏNtf6R;Iha:fmMEQڣ^C")RQXs< -uM!}*FjT tj"W5=dƲ7k 7,jpV7PE,+s_ܴb%4J{JCvJ.Ym\)Weʘ&+W*ߩd~ -Z4ZHAD˜*@#S4hтk"6P:MAZ]ƴwRIJfa X<1ٔ0974dnҀ9~sb}kIieF˜, WrFAeY*]YzJ9ZM `<ĉeȖ" X-V(b ֣.:c -7(hߡ} -Skj.7-}G\ܓ<:B %CYXc)O/;Qb-SOYrʫYVI6+^UrD~ǤZ[ث&xFNjr;^Ɋphƒ8$:j0.kQmRD5jq*P mZjj9Ffy|Bu|A5WU| qOPٍQ4` z=^0>Eü^P.Z\jvW]/ۧv5GT_?(g\.&9=A6Á23|43 #7964U_.4&ab1۸zsVW6t-ribAL"c+ǶDObIcN9TYPs46LJs;0c`w^@nwUf 5V1!a5&9f6Ԍn&لnތc+Z$_-xIL|1yyuz8c}:`?GgisyǼO& ٷ=0ۃ>9g4OdNi8)<|.[O+q8O^aX\ūÚRZ#u}g\"ӿ30+FHaW MqM7-:uqSu_qp?a`ә>^h^; s͌I.1_^ }C~w=ue|>r,!݆!ytVLX1K/W[e2c̦Z^ً@'~yy_=ͫ O8v?;NDZ%n;7zImvݺ6[E֪] Bҁ( ʠ*kT.T`@`m2sQS>w{y+8!hn X_8wp@7)82}]c^e?̫ -<߅o79|NFb-COoc\#Wp9/|^u¹|<~KhM^#80lO1|e.c_ރw&2؉_3/^P'=C%i/pZO~|1!} -"zARBLy,|>Osyx4c$csyy0;G{ W=hϳ<*wnY6e6NY]adZyN8K΋eT/·df }?edNaA{)tg"֣=Sqy9 ܯ3 -OTnawj~ m+'`6@;vahO0y$>f{;{n2ŵSϰހa<_֜B~c7EE]TK2/{]B?J5hgI8Zrs̜y)u&x"<参 ǃ-hQt1"Eo2KnB>@6X=GRff}6CKc@ ZbKI~hyYE6VhF~ , )Y}E SQiT]ILkiS;,>Dj+>V%%9ib"6N&!ˀXf2ez˪cU99Ty:;QޣeJZV2V˼jQAE-\RrU!u9Eqs mohn0*]7t ԵTiU)CjꔴXSҤZnicƄYEyj0*h|JTgX>E:'?'n݅=XK۳|ý49u_;-s)(WaQV+TѦhEJgάkpnr*[yZsrW^Ru pSngN5pwoc-u@[>C )VB.1WljtU(r+RW:긂 -ܫuonkUsJ5_#9ϫ}*s:Ļv|OA?tbqo&FxL -y,j+P[ZޠMyu7)6U>(g9|'e="|Ruޜp-ĺV|e:^$Z"s~|KwF@܁rҪ d%"#O Y_%xQgTxSJ}NBw3h&hڡ{Pa\a.UF|rFBt-:'kt,=2GWY!D.5Wi8{ 5سly Cc~;7zUSr cN1d5OQy|Lj78SEc*hct U -9?ހڣس^V>7CPǵIrag+Z -eʖʚpȒp1xiE%ɔL%I$1ILY( IpB'Po+h{$qh~\r߅uc H^"sʢ!Sʩ%) -S jV `V4NaRRRl֝Iّ]hϠņd6h3//LH/S/9t5Hu i࿏{vw #A<0sqsc,1|rl7mF1f#+>i<>]s 4y%lH*P_rsN0+8t&ܧH()^b)e`.ɐц?:񣛜M'х.;q+\̎ ')'/aS} 0Pc7!g y?QK9d% .5u!}0klVO)^ތ6)`{`5=0XI}ƏuaK}u\kWr@nzcyGY<D^%-ći 5M7a&X90Os6&j>괟d+V곟Xl!y}K؟6Sϟ!s=U|R</hr뭁H(!0 XBqaC*5?+8plI>| L}_cuM;9`ͅ9x7Z}k -Ǹ(dD\,FN?#'')3q˥|xCulb3׻Z>W]yD&Qp$ U\0!Vs%q@ϓs ,QTg~)!ĻeW9IнFsƺFA}pC&k@&0@>r0u-ys% kTmr YWIe{1܏-S׀CX5ȵG6(пјwUH}r:~\eM! s?ΣijOZ{$U1#1J ]v[>_mpmu })'hЗQ* 8fy ->=w$) t9Ïa|$љY;6f_)b 5خǶ&b{gbx O)5dt;mG/Q'*;)p XUf{&wѺИPn.NVjd ~E=Kx:\?דDtO`X >-`U2K@ +\gQQH/5?z ORz^Nl߰Ǩc~g;h$i= lYnl WP:l7`{'!n-n_%sŃtAzDwm_P|ت]>`tdJa7#u:IDQR-4,MGZYmbÛV͵ǐy,G1C,E'9 'F;5:KQL䥅L>f2H6lq~+93=\ssAOǾٚ5E^8BpDJ8jnV_D*P#ĸc7|8V3pw1wG6Q)pd‘GnRx੅M؟Ld4HR1è:g(UW^1DwAýxK#>6s13:mԐ`ˀ)𔰓U W\ᚈxC v~nw]Al}`hi`, Y̹ßI)&;U^U'4$yRTRLPij݊.V8uS_T(u)G9%RQ}_ι_m>@xV˻JP=Eՙa2åL2TYrEm5WEA{kߢ^y䶝UrF8Xʸ HjFJޗO4:Vđ,Y**U" 3X|WF\~96>>`b:ɧ20ہZyVJ)7WJI*vf*RRY N@9U*!k]S˵HNZe^+쮳9ALk=YHI;cQ5WR> BK?/M< -*ϗ'';A׃AA?L pew^g;n ,$$\ T -D8V^Bq2ZN6#2Ң >q;9oyn'[鐫%g+{ ]Il% -e VP!d"Z "8<<]LpUq-@ԉhܛ_! -c> ) $Uc֥ &Sa -(Hw#)<as29C>q-JFP .~1͵~L{ MHi 4 -JG ll+@5c`*o >40E70cۭ +W/pdK,1!a7fF3bll m B&xjG؄;@ |Ro.<)> ?:cm9&'4^6O/3JκsܺbCg\o3@jiy\g6^g8 9@/}o1DNQCbwD&AzkN# -:Ncnx_`='d62!'#FW?r&eRR;㚅ͬU[uv ~&v6IZFPI`%XEnE㮥>yl>7 ,f=F5\3KTh\5!%>擤!s`1kD- ^[csX|0>CMlFY} s$A n–Z5d||X`5?b ߝ%b&&ϰo_`aM<~H{xy71RX:8{WYIň%@#_&A%WL$u8xWXQ>8B>0uUJ &^pKd|G|FwUV3]6KD_PLpoFp*%U~/N )ڇGNvSO8jQv85mjd+~Ɵ9D!Mǧ);Lr+jOU,U*.V_ZUbRmP*Q!y7^'q~&>@^gUcS;Y))*wzT0TjĞb{*tT(Ѭj-JsHOU/Zl( "Tr O%*HV^SSSI++5W0*7BMJ3:eK1VmlxRS4Na\ɑJb1ǐ' A9J@!%7=A9$e(ϗP&#}cr?8ʫ -o6$,fwI6l~vIHBH&@J$ -$AkJJJRZjŢXZdZQt:0VvږaV;0/۽=s}o -|ӷCyd}Ke+{y3݌slP⼫`M2|ey*(!Uh+ت`>9ò7RN-F 6`|KZi -|A|lr :)wr(4KP -Q~RpBpNˆ/B׏܆hDѲ!|PNc%|a#hpJF0ߕKżbxLq㤸Sn~ǐ Ѐ (%]%\a8g|JHlHOq4di X65|ՆoexhE0W!Д./n{y೎Y|< scZlŏv0 :rEE0&u٦0k@3nIk%e o!ya|HsvB!'KA#KYd>`]*Y Ճr\tuL-1GlkKx_ o8I/9kA!h.\c 2ꄯMS~w9Xeqrđ&fNjn q/X6,ao=puV?&kyGC&g3dL(9!Qjgky?ۇG>-})wžk) -!#6ko,c\ɊA(fC~yCv&ړ{OK߹F*JyW=烀% qe#3pH\΀j<9y{@&/|N:gT "bc|'ku4Jg-_-__߃?[mrrz{ҿrGQ --@t%"}v̨N|StLF8$P3\PEM/3y^b}"3ɹ#LV92l+C -3l3ԑ)eX%x?<>j* - --tL4&qXsh^x_xONjqJtR{L(P&˽v+p^Z!3Ne8qY Squ sa(C2M~] -{mf{Lm5:'`6?)=|w|_APŎL籟.Li$_y=Bz?"kzDZ}p_!B%}'] J)(<5kn tb#BŅ9!:NwpCȎn$|_)nSV"xfO*xlyxH%k7xxSspd;I쯇o9r8+[@ -ԁ8cҕhC|E\ -;{Tn6ٻ4wX܍*ɝyyrgEo/(3?do%3$$`BH@ Ud(Q"EED -TPM(Ȗ-Z""Kw;=4s3_sg}ߖ6(M@rAk&Ь%vJ^ ; KgM@ úZ|u9I<9v,}l+팸 O8:C_ mk<b$J.!)A-A&.~OHtOHZsѴѪŭ$NVi%M["VxsRܢx:{u>4 gqYBzt}N}.ѽzDEģgq%+ġ~ŢNy}d8/aKbrg*bNE} -A3A "M~K[4[<~M [[%VA[rNj?]༆ey|1G@(h`*]S@K!M>b Gs)4 N_(| SC,u%7$ђ4ų `6уv-dwCaآļb1a11NSaȤϋ8!5F -ESw':{U!<\>y0?*>⎤3&C̙",\&57K?GӚ -4JC96g! -dSCI23!rm3A{Z"%I cfqdZ$-*<|6xcw!^"0Å("qkNƤ5!96"M%3 Cso#:24s4/%RLZJkM[f -ESjhrٓ\gRGB %xPEWjI],-VI^T0 GFZќ^IRkA#VN,c.'ZϕW:g/\hL1$iRUkkuRG[bNڱEAΚh˺نTIn}Rɻ@S3$( 4[f\" h /\4DSGwΆ݊+yލCF3gDv6gTT a[>u 4UFhF4B@?hI| baX_MbHДt%0>BS .z$f*|ըj@8:FF0'YPyH`pΪ4M LH9:KFf T{|jHh#OS4puddq'qm*i~RRB7 ೛%ljۛ ZoIq@>CRM}jP~D&%x8(D笚|9*Ŭvh֘Ws/wQqN2,AI5F(SB)RV$M׍luxUyd./(ǘn+ДЬB݆j>׍l[ {T38؂r99<cBvOUdN[`(Y9y -6izEqe-Z^Yqխ暶U_WݱSv7٫w8vC 1r17~¤Snco5{gκos~?.x?.|EO<䩥˖xz3ϮZ k^Z~Ɨ7ymn߱s[{o{>Og𑯎~}Ϝ=ϟ.\JJ]IYWQdg+/RKrR+kAݔ7) nƃe-ʅpa2b"NLUV܉w+3~ܘP~< y G+K<Ô+/b:&e+8fMy[sP>| T}<:I?().^J>\ͻ%~__b2lvǣaO G8#1<\|LҚ7?3' t뮶;f[mq&O6}ƽfϝ7 [xe+.j[ȤƟILiLT*Nhj~o'G~83gϞ;w?]pƶehbm֮-;zW_5a3Жj꩛sӲZdOG. 54PCC 54PCC w +u%^]/9 _ԏ-~kwe ܝVOѢ'~HPG VFծ=Ͽ1}C&|ww>/n{y /Mٵzo.Ѳ{_d'װ6Rk]/޳̾{ttp|gvzffgi;fiNд2/AoF)TLP. E["-)'-߶g/yޘᎀN"_ -)Uka"a>W~ՓĢ ?J!&vezzc-̣>$CkSFkCe\ )j3J-)|ʉ鱶d(;nZs>w'C71}fDmX4 >J6 3O;F.^hW}F]υ -{E"f(/c`4Ѭ7h^!}w>85KhʙHAΡ 5.-F\ |{Gq{im=/ZtUppdK*8+#KD0 -3{717@AoPa.57d0~DK2qH9yBCOmHLU1tՔl2"8dX2, K%e( %6@du= -םj^A\ˎ*$,!2.KGv[=ZP -$A=]+#zw^ XaF*bZ*SRD &^\4h`C͏@v~'x<\վAGi]8^@(WI<}IXA-edYÍDVa( e Zg:8QCHz,I^PQ%xI-02,탡2Ad jk.s[g-HQ$Xi}yJ&E|Ne2@ZFO AF# zw/؄9Ќވ0RYeJ($9J;C`M􂜇}0 P/69&Il됼:y*LYT~?W@lͥt%SYBfaC*Pn;ӑW_ހ}]M*'(bN)%O2qbzȅ)}^KgX $'mo N_u_q y[r=P"fUdVp=!:qܴ.K``ZJ s^9z5-&i *ઑ9u(I#ObDQHnƖP VKE2jVwn '\G&ǼԲ֠m0NJ\ɰuUH Z %4Y@" 5Pog1ip`䉳ߦq/g(MEɱZ,T"V $KM2TjA})Ï9;g/(Ė>Ȝf+Z5b m @92v~ jl̆q'G%7B#~̇ސt& n磛#XB. xю?S]1a^‹w>LpP8:H"Ol@H4@D E> Eߧh x 3{ =p~@bIb)y`o%65~) -}OztGr( yĆ_ x {L|@mT+5s7*Nȁ3GR]xڅ)|9x^d\ \dyb.pPdmkkm_"8'q*)c{&B?P|5 -b} \hXL35j1|%/h`?b!4У( ^@9 Sa6r%'Pb 5A(=)|FIS|F!'AcIn#V4jBkn    {C.bE aԞ=ag*"tVP*GhHLf)sUQ͚H%PY~5[y6V!zgkhpwK -Ly}\DM3 3]WdkijJ$#d=U$yA -7B-P%P_6`ׅ3$}N+5AIL62U`#%yWFSE E[V\Ks2[nh`ԱCbx. 蕽|Đ -Cű-NV>ߊ=jVy& ޠe=ή0ۯk@G -*h\̰O^LA m(U42fwO'pxa0|YPa47(t%1 Ο;\0^vwvgԟg oB l;e^cdUd ~Pb07(PfG?^;87rzĸ~_|)8Wх5SSrITdC!b@ As/=s߼tD[gnyQAA$LN'3 c8FBm}.)u#=g4b4~noUc[Q8ܾMYBy͇fBHOI8t8:K - |H{ȠLdT}ūoݸ\7gMӫ[e`Gp=ϡnO"@EdYs@\4yjlflV/o.=ٴBj:*n%}lNmg[SeJKn/T^P@QQQ@@PA/],YinmyRؽ -e[ -C>yE@)H;a#ssEfKϖ?,?_V3|~lEfAx8䌃XH?Br_({Jh3[^^0_S 3`p^AkOot7$磐dmÐА -P+6/ -f^ Gp1~)$T1|RB.玦TMI千.YoA777SCkCɦC ?#4wPO?Nfo0qZbNYLn~(VbOKmkZeu8MB ̵Օ??#Ȏ,kNDs:#:'>V\9Oe t̚R2'L掞8Nhmנ镡1!?mb#~GPqEfV 7UO$K.R+ \f9\cLu%uMXyߪoNhkGWF 5Ak(9ԁZ$)93Ε4RfiNb]6*MZInAӉW2v -&Ġڷ6[ɐiuL Ye>3YK@e6rU/"4 SjbMCb"5b@ ЇIUBEI*w:SW.+Է[i>9Eߔ+UKr7Se@p^*6A3x!Y!,!*y-vANEM&ACӫ cuԆnvC$e^X_/.bm[rĠyb g \)ƴ&} IQRVmz;hgyn46,bhغ ;WB;b>tv/KWt:A`jNmg\}CEŴ6NΠ7Ҥ}4E111t"/,1AaO\4FٴC AJd2ȫ(8Um3R HaD ذ$[n+A? - cSΙ# ͺvUD֜Zא )F/ -(F;Lj! -14! -rfס^w Y]1|6QHUU5gvŹ=utsԚSͳe׈2xRKFEMP81H|ZOgk15zq4`.dzXFPV(3Kd&Z/asbP+KVPBCǎOf{~4]=|RPIZ-` I-|M)z圾ЂxME os?߻IocA?c)ґ]쉗RtIZbAe򺣕EHE)B)2*AW8/1/o\#=s#ǒF#l{t%/NՓ % ʸtM~aB4|}MG 5 qtl^44ra8((>' ) 1tIDIz*5+ @};XpgӻG\^km'#!_ٴ_DTXrR,-s4A8K`qqY9UX[~M6®QUA۠]tw \ԮUGg<6`**9{".#u 7 '8́j');m{k&h ho''DX_A!NW1K)LY[FfZy on: L㆚ P 5ۗ@+@t =  򆶤YIVS~AƷST*e\W;^^'cF:/n΢wt@s[\d FPEt$H3>eOsJ0)/(kh@>Ӭn fvhN1{vgo'h9_ >u6EgZcin=aqWu7h4(N~ ="l'h0SFI721MGMl/ 4d`B mȠ84'<@sgV;5Q9Ts ny*rQ(FRiھ,&#{ZsJgK|ݶ ۷6@|ftgB&'=TeH[H}U{˚6˪Zs}I/S9K 'h߷ -T7P1!O I=;scPcƪQm%WY.(IM7ـ Ad|LgGX"nJVx+9J%rS}Zd5LV%THdHm/6%^AfdP] ={}-*[[|SJј*9(#6a"[R)|Υt9Xe*\of{{8 o@eЅ փos{Ȑ選 WtEi2ȕMe*icAfa<&ZOki*QCP:gZd`"/zn߽ʯ'mytSqф̚t^s4{g%wQ5g,lmEڬJgd୛ m?gz݋NP*|3I;! RʼnC䖸 5mkey_goMi#֊NǺ_ъbZԊ"( D K! ـ!!@BB "ua(nXQHU^h?ܿʪ@-g{~o٦w7iaݯ'^ EQG TŶȟEa|1Hx]&]-E"͚`^?eܡaWtLmqu~)~?;I _)OԄi_hY=A.3+ݑq+rnW-n/^2禰gl}'=$qϛ2 &[ftC2.L?+N -z*)ShSes s -)[+,vU%8Zyps T z;v6ُ.3 -#0l&. . x D ꞏ|ces`"5^Y{JOD'"E5 2p!8 ;Bq(7n\v{>F+,Uyv.5ก -.I- -vA@Dl 8p}!:.uXb,15(`ռbYȅK2Uw ׇ _ yC7^R@qX;o;w]8|6s\FV[a4,/Aqp[k=;\ȯ f+7@!H26:C6 pm mlO +8{q\ׁD!P@rԣag -BdIR&ԉqMYϢhc.ƓޜG{a87Nso5dX݋`J#o;A ccx⇿LNHVvL7(I sU g F3LcL.SITS󞞹's1{.bXܛ|mz^y3-9D^鮒d L4T ~m8d{嘳@_h[;V'(PJIki)%F'\WTonuwWIeU'z+fjol/c}I6K m+ΨU\f\VnFeoÅwE*I> fh:֥ݰ˧֚.n&(袔[1Z(>D$h $k+{*%KGuS[o{d<5mq|셽qj??gpzB9(RF/oeV[׃ZE-M]5rI@.i' 7crk]:_Szp؜q봋sd 2hD Ӌ>n_ҧʫW\[1(\Ax*P& e~Qaўw5rr,` )||dh2e"1!>LpW1CBzmM><\( WyPzѿdf--hxomP1^R#g¦iIIVD6)/D~R:.rЬ,N/TV ֭],[y -)u߃'/RBHoƒHgyQ0 -L=ED] -DI(>݂]+Q[W_M[f1-cC\ÿDa)5:6`5\,+E$Eq$rV7z߂jZ'W ۄpN%4X`E3@D߅P Y &( Nv /Wm FI,ˣF9"/*J~ ?*\8 'C| X d}51RL܁i k|s'Z8B$1"۳ uod8:;r8 8DC+D8CN@;)/S~l ZCDݑA5"*{&#Ud8p@>3Nl ]80 {`ma CVsX@s`5Qd3c&?.n)TC*בֿ$\)/]N`,w[V6/SW1F@g JUTC4$"1 Bg $*AHP ' `jAj9H7Z $d;A, Q^jC>Ak6*8$l(|g<59jCo_j@nEDioK 0W, `{kX3_*yBJZJEZ n $/F.D>y;5?5HoCIH>,1Sd{jC<, 5ujS h5<:y)!j@Ky4@ݿ4$ig>3MM$" q:y;*CaӇ,.1ҽ?'qL.\|Q&$NzEseP ONM%O_P@<Ґֻ<eh@!Z jYu&o5C\D.S^GU$ͅ`̐n1p=pS4\:9x Va dYˤ~Hg/$'gK'd= iN%  t=n?e5&S74!i HCJ9@ї^\Z;=z4C1O# - FI%>aOЀ~9x,&i<4А͛lG68`H7K -ANmtaLs)JM - - -.QY2%Y")u"bb] -q@$8@50Eڿp0̿bv9YCu7DrV,8dI6Rr<ĵH i(ߴ׵G>trÛV/,أO[C0L]5SI =V E fKt XBkUSjOL~Wi_  鶅 ^9k>=퓝#ۃ͑QqMzZA(VIXb>Yʙ,uIr- RzV]@j -齒B  dW'`#g! ƽßo=UǹC;|{Z#"[o]MIjRE6') oTWV(VX5֝U[++h(\Aj|l>m/^7K>fs,ؐ'NYJdXʮK2_f dzh F<ߪ!zA=P4;A%r@Esw]kЙM? _p8#,-:Ym+jQYņ<YK G*hez}I$jp^ixo\GJ9t[ivO=W{y{7QUmqYd -݄/4s -b)R$Ī8V}pKsةUu_8t#Tov4t_6=sꋈw]`X ҊsdU4a|S$$E#LMaT! LdN)σM~kcK_o}vvo8~,x8<⻘4j̒byƉ_Qy"Z4`k0mz{i4hހ&ǁqܵy 9O"n|@F 'gR> ݈6fYM\d2m&Vp73pp,gnWA8vx2 5c/OOp>D962{"1>m"S^gEYQϸĐ҂z6 -v|yl@jGr j`bCo+ o=]ޜ3a93WgC3"㧉1ԸkxI!/)uJTm sE7Cj?EXzf?l^s_);xًٳa'fKf`cfKʂCgy!$a~W}g{e(]P;# Q7la -8 -` xd( yBr&gp>;~`}juBR*G!lu))6<קix A;/CԞPH i =H1= bPz\Qoh<-^(eCUM-tZ':-"%,X8.λی-~^m灴\qJw֮ udO~q|2PG( ac>lpNj2[Ke8vGEłH "BH)$${$!H*(( X.l"(3{9W?p.Y{ofF0  dI_}Rb/Wx"xW]^ <|s8ųq0}<Nb8!cVx} sw[1,b]YHLelQuҬ`ZdY-IVQ¾guDY@< ␋ -_x:[9pˣ!5Q-e'& -㤞-Pq$FDk -(ܚ|9ǻenkxn1P` #|"Ȝ̍j]w{MEP[[L('1F:רgKjJPER+.4ŧ3M7XN-Kt_>kDP"ga^c'qqK>˞^=SgsוGŜ*OJ)*JS9ZSXW -tr]:ǐ,ȣ+*,4EC>UuӜХKe"[q`/j, -IgMk@76޺|tŦڳ1ѥ|~y -M_La˭LQM-àͥXL$}9UBȹn&;t$=)Y-0epD`anj{9vZkgoaGQudC g Kv1[F?!RS -zdH4%Y0aN8u)H d9s8g[lIJŴ\u]I㚚G1hhjsP+]ռ\}xn~sDr^G{TAPI =uz:ڬ5>tk7ͤ﾿Mw/uk zDs7u#)y)6YAO9e;푷T֦P{@!AsSwZCRs?U O>Rj&;ߨ}M[Z -W}^w76MUK,Ց=8RAbyڰsԁ ֫ uTqZV"D '(`A^Iyݿ20duQ琯UPi5w["I^OjfƵ<ɕawY9*y;zZ]k^wiT4لݔxwg 10dBVI۰ՙ!NG|=xa~iw\p7?W^)m,m*m+w4XƋk/ TA!GRpn .q.qst [q3c>VFn=RRL{ e"Ibw:C/8hΎCBh$3b\PpJx֮CyK2c~q_vdrT]ptInpF"Sp},t66!l"FMl I3Ff9X!AN{H+RƍQgSwy*wlHڨTG= cpsdX"[,G\Z $7@t6KH  -/im>MKH{ -D6XkBA2]d (["O@~bN{@i 9Z F?x9 ϙaciǩF9ݬۜ{1HH@?!i&Ri#g.Qi@sTnBz!<y1v> eJ ?Vެ#Cbhw/e=(}z,~L:%|HŞcdA@6}GnRŨj=˱j*n_J2}rcf32gҎ$MIٔqQ~7לG᜻ vfOJsE]Y*HPkPNaZnZweCI~T~%c"7*kHNT$Kc͢ܧEw/ sGxvt'g@B6$7ϰ&5oT#G:i)E edY$oH I؄ld)C@+R>}/Ç}07H^0iƟRO~O$,i,K0)QN|BȢ`z@`/A\$%%!5v_k]7t 7S.lt9nF f=ް|܁Uǵ6[B!ڐgiznT[$߮sڀxoʐ8dgWos0f3iApZ@bڢ2Mq? n.a~DX+"UP"  "d&R0 w~T]sJ/)h -k0x QbF-&*E jQQDkbaĠ8?R9Q_3kỵ@` ܦO_,Z_t86]aɿe?'#a dëcV[L:@?}b#o$`W{tC -5@; A_m@%kPkj~CfeK0Jjn@A((g4:I?|kXyI*x $%Rtfffjj3Q*jS$bZ\uab'q(\} Tp0zSs( 2A hBmT‰c4탱!]~^qD:M"!#M)Xag -'d&n,D#fa$ȋO0K!G>(B'j m6s+.\I9MD*9N` (7Fx!$fツ^kx]2_K,GT-t@B{,Z_]$$)\Na8XE= Ìzs\2Nl숄^ RMVBd2ePڠfV*`u}P\\cB瀿<JmQۂG0ց~Ӯ^ 7Pz<^O$B°7yi}>Ǎhc'|>B':8<WC𼍑2M0,؀oNXׂ䣮wvkʯHH|;čWH^: 4.x#=h1, -GrR:" `q'yq~=@$= &j ڐw c!o& 0 *r4bY0CFsȒ,!M[t=NU")3`^D`0~폰I𱤡-YI|89H  #D:#eDN3afȎ\E%+!_q U7xw܎ pN}!kH) -'c-uh&W؁/1("B`p7Yke9⬐˶ETxATGLroc?KO~K RSS?{i_c#:u6ᐼJUOjoSp -'r"Rqΐ1QcM#)'XkF/%mG{~B?d%KD.vX5u3Qi`slBE|q볢0H+z/}+K~?Hcd`v1n O ?dh=L-6kq=NƙLR -=d,GJfb *`[%ƶh>U^ذl`=>ԧٝG0odg>$nޤ__I\2s)pFn[lu4v?5c5vwֿ) eG+ ˙%5oDH:2p~LξɹΧ}⏰O2t.KC 7:y, TzdVG[ʾ=VF9Pis.)/w"`8P#~}bC:1J"n!ȼ=sSbMsF])c~.SPnrn(W%3ʓNcžQ[=T ,BBxyɮht9e5hp[Ԋ˓vja̭J9jsT}vi.|oC#$ -$Z-2dAC.q {'i:&C D,{ږ^;2(+r9gJ' -*GUYs[eu-FvAdOse}N6V i(&A;}_;c䰛p­s}Vt*YIVe˯W6嵨~[TsdJiujejekq@H[2YD,%!iAGF>s:jh[i~W#J:Q#gW *J-eٍŻuMj*UgirYB?uz@Q5B];sk:~#-4)A)ԡZ I - -*HDP]@?8*~Yѳ}ssv: {:,{~'ŠBzjZƲԨ3Y i%9ՙp0W(D/D)췉y@4!M?a{g6-—KR.~4qj4h^\:Y]_^+(.*N/gd)ŒԌ 񟱒@:mCySn~c+ǯx`q_8ΩZAd -ёTaiEfFajŜ¾#E%/KiG $I;8-88 w>\/~e*=3rpAO^?۶[cK8!)LjFU^Y\Q/?//[>_LRZbٛ$8I rԫ⾶oý؁{q{nvh䘽a^k]gOhV0qјĴdL^M0TWõO5Ki1oxU+q@6\ET)I}QFˣ{*޴!ݖ17ݶa LjiO$3#>$Mr,ȅ#q)MU2Cu6d7m\N ;~8I jTDfl\o,jo: {FeDzS{“zbb#; WקjHjNgv̦_ -8$t%diF4;$ݑFSh䑎T^Ŗ86_p& ׄ!q쁊D$߁!c`V761=/{5JqP)^^ >;JBf6gdtmB᱃F՜ACƾ,ǴPOhޝ6wBš(whñԉ9mb%~cPI _}8-ۤН /οQKrk{5.T@%uR=w1щXE_R^K>KC  />/iE%FoZgaAլ HkU-ɫV"WCW9FHՔ}B[Z~Z/9})gOrveNfB82GuRbE| |#5lYwT [`wi} ӣ}x={ɏPcMeC0cy^a[I2ކP_B-7:=P&\hΆ80dWPh' bpN't/}hc{6m@]Ĭ Pet7||ϔA$י T%OX黀 >]4.#`\5ƨ LϬ_9,P-R ,?S@5"Ib-adVp'EBP>0O]QM^[TzYuQ Ɛ9! I@ @ A@(rUZPE -*Ȱw;9]笇ظm@X  o#D/a$vla,|Fk~`We0;xۜ{!p .B i+n hkrx[6?nǹQ'q-[FÖ8āh=н0 D Aq1O#pR=%~h@m 3@ ҵ@ez$|e[IZ؀ ws*CfV=zG%v?&W0e 'waO"w6x   Æ9~/ϸnl$;C8 T7[ځ|فa䮛 N!F#{4i!U!_ٔ>oA%W;9-<þ$`ODfhl<%n|TQG wN::>r~u.;Zm`.W&<AȍԄȾD WA3JJb;D|IoKIyO%^H>J3*dS -4p1:?,y7s_pyP]yW~1GyFԦЎ'XGE6&Z,L( %;Hi{I 2+F,,jB&)&:Wn*J.eW{;i4IsȒVIT|(0g-$Z.UíN2 +TU% iC -nE>rSiT՟՟y z ߾C7u27ۉZ5/[|ٲ[WjʙN[QM*jmU-M-4cR<7U>42_%di> -35LA,ty ]lrxOgwۂ_;CO=aCAֶ2fS<֨ThX%B}0/D=$קUR:U)?RHӎ1thkuNf Gkf,ںkyWS:s-=hUR*S Y#0deIU+*"0$N%ǘq5@:g6t1f_Km^t?p#`:Ἇ7R4ԲwVW e2raS(hr+F$!ˬeHP<3Sd[X15@ cbfq݉Ř]K0W4t QrFVXY_aS֗pRK qb\&-O+=JA]4_8̗-,qi O -1P= f<^g̍Kv;φڻp;iSe #ݓ &ZJMr`:/2O_^*yNi7.*a^\W<ƴH=;af~.al̽s0W0}Wu8/l_t.ҳWl:j~IH (" ;BBB@aG(Vԩ#.uSw -,0EtVEq=c= bʎϼO;~|}&GPnj'Stbo~~́ՍҴ껥? eUe>6 S9Gg?2ɃVEnvK7rk. ^H -/usYq[[ 7sbMFuaӶ9Y k -U E┆u9&NMit tIn3 .3^9w^SǰVՑ|פЭ37\X%XQ"L{~:ܮԶʬymdmC9TeZl7$chI-if+ qA3$MScCV{n Э _}#/zq|εIJŕJ*-A#HOr{kJxBrA7좑ܭt~NZn2I##rߒwYQ۞7<{7ú{cDfknNS2KR2LH.$ &zrX艨Y? -^3C \?bY>.Ԉd#hݐky˰qooLlqd)jMlp-:2{-O)zIH8!J"HX>--t?x9g#0 ee:@i5 !e96̰p\C8hՇ" `Bʂ,R)!*Bk ;[s@\#/x7){4<ǃ.fqq!cBE1"ST,B%W"=U^jo3v+w)n࿡) ->HmW] f{!և‡ T\cMPCj1de6C!>Q DHhu«)5QʤL @JM 0&jTًH CָCR6 Qrq Zلq鄏 gLQغ|AACil2} fl)2HϠY_8!e+<8!vCKľāIp1\h"G$wH -.HpAFڕLw8(XahS-^dltf',rw6&`FQ4%oL::!Az;׈Qɛo%Cҹ7I{-GK+ D4ȝP*yLa5%B )mP1oL6Ɍ=~iޫԆ&7rGQo1IyCWW/dclLg)BCBt!ő,:飔c}!"LPƷ:̚ bϱMr6s_`kcN8MEqkKXܪ {H @ b B-@"D@D -A^VPֶ^u9ߞ3)1 ŌyD>$ < {>p}n0 1[ n32+$lw} b:XۯQ)GrU`0kq&LxO1 Q f#@O[ a#O}kTm=0}ډ}Bs"oףX}i$6hWѰV0+ -s~1e9XET2K^Q9A~E6fLH@S@V@((C^ -d!o5n3aNKǪ]/wt9Q~uqXN-Q1J8yj^NB03S?*?g$z$ {s羚P?llew]O~{GI=VkȉŔe&tir:NfQJ8Y9$Q)JRR^y:m<$HX|\^ԯsv-K.O}ݪ7rV>VANfgf1ӋjMOu^>/NPJԷ$?IIeH\@\k X -:G.5yionm>KWg(Kɔ4m#%']ƍϬfeiƴ$:7<-3.#%. lb$ zob0[=\&:7;/j;E W_v_U*є(ɧB-K^P•Djω^H;)ʋ*|˔|J d!"5.7 Eg0ri={vUM-ݥ :gv_cĄr5-4uFxb$[ܒ\A?LQGl2d=iv'poٻǩѕ7w6qiD>YP|]>&Q*4qw mWB-PA;?k#t{h5h0phUw-uHy^/;,1 -0idҌ,M6ɍOhoht#$1a-0 pF;0r]m3`fouw)^lw+{/J#E] J ˒B'Q:*(v#-3>xJ÷!a m̝`,߷A ,hrO-i~%s0ɇv9-t9(ax@!p`9 l ,n0aߌ@v;(ݎ[G%];1MοÞOʾ\O%(wƁfdlfGmrޟ~n^BL Ѿ"4 I\dLCpfbc!Ń5RlOh0P¡Ej9Nh8b#MN dBBgCbrDd9CVI;hdFo۸O@p꣞Sc>k ᳐ENCP@^ᆌE gސlB@|<:S!RԨ/Do/G [1|l hf;U:A=*$(j='os背f2N/d~~C]'^OaM)^Rq|m$ y$ rȋACrr]3CS2.TkyP~@ȏA~6dJ -|:a9z[ gBƄ>c8i80 :W=79>Эvc4ۂnAPAu,lȗQ!ѿ)^E*T'* d#d@G4LX( aaV4D{%1K튢|O"Ə y%~Gnwv?DsdڐT ߳`F5}E=z&L`dcn= -'\y0.+\2lZb憘gMOsN=ɪHӞK{*+y&O\0TAtLi/vNuĂ 7ucżsJ>?.\0s}Իym9,?-wnog\?]}oD|$u0R.`ḁS.͇=/4[/[$ɿ(*n)1wƎKNw=Rv<[7E)F$z".5,uL,Xo?T48˽oҐ17*fhiHRRF酒EMs-3ԧL4'L]c;ڣϳۋd)!J~r}EoY{|_y"űo2ksk._YB|Ʋ.͊c/5K9P|>wϹ%VKedZ n)J{4/#/x -b}_`߻FܽR|~vLU k,WTy|zߜ_);qc2i@Vs%dM}Q ỐOsڷYVp3? c> tF}i1\Ci`mrkU{*7iw<狹_(o3~n9h2m:oHXնf>L0?I8XUA)ғ`B(@( =jjA@P((2눸zQ 3{f{vV|>_NnMF*1&8xxot~ |NΌъXQuTY٭9.}|gWF>UVJoO&51/'&Tſ -NZ 4D#/C -+2TVkrRtLgve뢰%1Gz ;ryr)R~1)ܿ>YƪLa&KEļus->TC"{٘p#W7 ưnA:hO6zIw VzE':J 9U*%IeQ'Nt=h/L@ -TP![ ד`]tk 5]Rwҗ]&ok7BۣKq-IM79'LWBȎr0yL, -M1e?0Y~rD#CdUV&z 0_@]=hxVr⸁pD0`ƿޟ:esZdjJh*dAC1b)VO(P T{kn~x{oeFgC5='ݼios~)wC,D쏹k5t$9ǐ27zO17ml36E|blՋ6<ȕ~WNP0- 7HP5 #(^C}lgIqLO΅sd?8{ &`V`ǘ9f32g̠촋#:JR%n+Wq gC5(~/r!Z Ɯ% Ygf~,"/|&x6dtmGUnߣCnO6p`sY9P@ -HUY.B )RyLR7*71[hP),SOeNwen6sew,~^p\O;Cde.|-{2!aYb3V]5+ꊟJJMWӌV}(>o;6kb6ە/a+~*p<@k:> }Kې_|4kC:(r:k!T -5C^pZ>}w <H[_Hh \~:L:IvMQ" -ְD{P9Jڍrw2Iu|u &9+m8)@ g)kHE vȜ` dYTg;Av5&@ $$$6!)67,E*n8RA[EQ}k=ťӊ֭Uq3_ۙx;}srpig0 bɴA$ -ZH2E1ʴ JYec'6PT9I~(“Fp [83ؘǰ' hiCzu%icj&v&ON߃Ѓ`O B Jπ_.xzǂ6p0~b8A\4uxg3O>C|x\-,@0Yï {M;H3)W;=%wÔ/x0ȃ&|<BDd,H:τ(} Xict `)$- ?&^[?i >Th\H>D,Ku YB !2m@½V"i EknٓWB_ a5W\R'H#ݘZXc!F](#,2S֛CMʆd͔dpG#vg&W߉ڏux!px.S lH`8G!ք`gr{Qv4bgمD)t01&*4 _c3fE;v7{^u~%;4 sI\I>{7s~c -RV$4ePͦ24/-!E: >&ϵ|3So"j9O=w60G=/xߑI;vM +3 " D[1`@*&D3>+ߤL_$~YT|?V.z}nFs#b{=bwUywTyߥ7 Q> v&c a$7d;3,!7#ўL {g c NrPչ_Khȹ&v߅s1D <}Ip"Xˀ|ăs8Ép'4!ιtl2K %dsobɬ&?$3K/w)|*Ι=G :Pui㟈&LUw( dx CIb̀B R2 -{ƛ*WI5GneЌeJѢDNgN˽^w05@rp_Rhhɠj_Ȁ꘴?lww}Kop[b RH~6[EFVQlƯuNV+.Y*Ns:v(@Vo?,r=K%};;RC ˷W$VCؓ/M7&wУ(#Qo̩G06NX'3ZȖgaks&%C>_GT䷫I+&gRVRZfQ6Qmv>-"{9צU[^RZ*^Q$ސA.o9wGxS#VD5\j}\?!m,DPSO;!oQzR[3~:7SohUڻR]\Qo+/]%n.Y'k*ڤXUMYW0Y?U)aDm{gՕAP_&(TLf ֦CnAlMU``|wBmMIs2<;?n-_[])XSY/^],+oWԖ~*鏬(9]VrUQ.rՕT iiQohjl5M]_M:4:-p|澮PѶ[ZT.kzlXпBаliTW}" aQ(B @ؑm( ""PYdY(.Pjg: eLm 8ȢTEgǙ3=a>~s>9 -f?pfތ=!)B3&w7- :íT~!3߷1 ײ~\btqjZVWdx,ҬdX]~at,^}w:}.();x{Br%FeTA:']Hx uE:L8˄M|j2$Z%&EŹ;itK+L)(I:Z㟘75Qp|o~ ^BD&}8jh]π4\nAG byэWYoP|&lmM95qU;U.puVnTUy?? Ȫ=us5:r%j8Of.-lHa^ttz/Z}=b]Zfx;:ƞ͒G7(=:}B|BF:V7^:{Nx -۵W:?yO^T]ׇ^+F5);ǃѽAOﺴ4BU\ۘ{>ȔF|rT^^v=#}#mJ6'jEVH]r.;hHO2pl`)0?cWh-KjэcǚD&Zn*Q<ZG+2[2Q)'9O7^F;uߑ.> g_E̟d+?Āp{߆L3Npp~; ơwRL2,X -kmb>E !T*ք!>8^LI dlT,q*+N׶>~LW4Ӡg3s'|:Dx ꩻDa5`ɿ | 9_!(_SW"y֑vuc8aڽ԰ye=c\\tm2YYpO'-Ba -|P&(Pq%HђBW=iS `0F3 1 -Ә+{XY2kY|uS}.?@O߁2``Aa1 -5ZJTP+Л^4#h=up,08XKt0Ļ75LU$;x #0%uj}4d/K P@領F)AWJ) (t" EƖF;R!"Jh`8 AhyǵHsq'*.Zoω7r,ɖXD8(g?E,A660G \ QJ\ Y ?ψrȝ/j:YB(>\E t1QB0MƲ!Y 2Pͺ(EQK  gijoĨ;Kx,(RfBҜ0SD% ݂5%;_t߸Jkx(i ZG>b9 z }z3u< -qz:O|I~`V=.h` t "7N qQTM ֆAH$2Ī3l5c ~[>`-c5Sfe~ #Ɯ}Ƃٽ0L ƋBF cJjH}1@LIJQz#r߇zVM#ٳn'AF}xiۻnzЂL0X^W6!``U8ߐ4|3-5.!q1GQkG,7[޸VNa{rq&ՐΗB;_ y4F=֧#TX`̿6M{W"H7Bd]沼5_g.}ʎ{fk"f|*k1vWZ~޴b.#" t?>1>Kg O.Qx,ŀ^ `38xػ,|+>Iq峜DKm%8opks=}2f43J>}pIʡ^~3G 4@x{;W`2@_VBkcڝ"_!y٦9zw,;XýȒp>IdY>--\!BEݔjoBWhN(Ԏ}ɂWD+,z*2m;xBa"4hR~/C);ªțfc?]Y뫊]H[@Y1BVaߩSGB:j&Z4y/#g$H;$l61ױTW*H}$B%M\(/, - nOY xb - ;jp:DUʎ0\2ckY,ͦ&k\wUEbʊ:NFQ _r*(VP~[|(B0l5g>BU t]*щvutc%߱0Nkc,l 3R5n^Ԑb]P+uHd|&3e#30x=KvHU=ki;m_0ptn.>'n_Zm}W ->H[4@oƤ`GLspf=1Ze_LRs`6`a(nQ5 S≧3JӾU_zk;qolcoLc9a91 5Rk)C:{PWX\(nvW(hdDzs۵ DQ:8[3.O08ĵ}ݶYٶG1ֻ5]ƶD\"ΡKԼ -*/= 0"&\Bֿl!:!#ԑufq:': ;#;?:kXݵ&$F$W1h|~z=}?o ? n3b{˜XFӛ̊VsBs>)Kk ~ׅBy yV?Kv@x D? ŸBG0qLd0%c Mc{ xgu7v+{u+}u+5=Jp_A_F9\w`l7@0JttTa4F1ned8 Y8ebIeI 52@cs'?25P@` EԔP\ 1l1 l01LF>ba c/jwJRC,Hn!? ۞ Fz0EYf&\TOal>/r* QD('UDE -尢O\\DEM‘0Qn ƹ28_BX=&P3] ^"°O,ߨ[VeJڤRUUG/Tgs⧪+⇪n}Sq[{jVwF@/eP`}\zi=u\Ԏc|p<˘VtS~U*~QV@do}v5uv^ͥQw5y2FkHWɕ(az{tGh.R0#3{g$inuD;nݽov%n=N7coK;bOIǶˮޖ]}$7,5ƣSk<:OQ0-mH8&dհd'dXdYIgs3e]~õ5NW7HL4\rA׭][ަm}^9U3~fݐ{S"6&d2:HF'6Q7t̓МЏyTbq~t[]͙i{iBέ\ΥM8t2&}w }q_GRJEϺ4tKGtfmL,+zwNq›NxLdnG*/ZN~I[rMuG5}qIK@H &8L 5! !!!!B-D~AumγMzvqwHEӒԫ|90;Fzx5OռQQBgC$kP|sKMgZ;> .=w$e@q<;eb6tU!ŕFQ=.Q#U"tGr VMN|D#2fo+) ;i Dokvpa2v\wz`Ys:P{qG2ˬ6d:jH343!ZHXi\:!$;D0ut [8?^|WA ,9ai;d8У;^rji&F7Q*Vnbh -CJdCJ,K!).R.>H_RT -DQ!5({AW ie$J/wwT_ZIqae-Q(w=|kXhރk}twKfWvzoUk%ƜyTe7J| EueTam5-hftd֌W RUXz͏eDL5;hϴ`!@[+{} =L۪_9w^ܧHr+pڸVwU9)ECi6P3&4l6m&lbB&fBdk*=[\?ޅ;`@Iv0ʾd Qџ\ЛvPԓ}-bnV>h0-<m[8u{\r#?Z_#3M/eȐoewbp8S-]YrNaUy,"_M|Tn'UԐZ\&MaSހׯT%=Oz{U z9gIO1!E41C׹z. 銌hԯ-iw {=k aC,CRDNئC -GgsYg./1n_nߘ7wϰ_d8"i46[4X\3 嵄 37%_A_Kn^ ,Pisc ?\tN B`hDSEoOu̐&ʡ'Q <8H1&FTȅ?G|&^(=7ت.Dv6ltvS!{lOVԆ!aP~`*ZpӄqtL:R͠LCsR|I_EuqӱKO,^&?u-Ñ#w6N/►*♺2jw*vEME4ʈhn -ҵПƃL##Z3p'S2'2h,ď,Q ;mu\ݾU{w+igaˣlnsۧ.eqhWD>F` }lAmstl6+Bx4sPzd\yʔŊBb5e Λ]7w+w_cmBKI"KPUvv4 t6L睦y 4,B8,pc7p5aFrD{̔=jG|Ŗ6\!uSiz)kN>*ve]]q+aMLtX*b72):F[\B:qP?Y@PU/bT5?F37Y-gUYv|cVtbYk25X2}ۗiӾ-K;4NҌA^6 ru КHW?w|98/#j8g> ̛fM -KeKr?R|Z9E5.fo/u$F!@n ulJA@5@XYE#.`ǕxZjUlF2Z;sng.8g>>&u)1$~*2~DV]Y$ILLl'bopk9@[D;W"!+H^૫QMmG3ӭ>ȵNSWV:u.NLVH:.K$Mr"91{b7P.8EC`{Jm]inTśXVʳmʲ Y咢LSAFK^z:kQ;kiZ2E]\PUnZV=CU`QJV$YNM.)g')v'(ds8]ٚ&3&I*`Fga4g˨}=@W:Eh[+WV(DVerی"ԒJiRqì5Mh'*o{DZŜb'z|K}jpvAH{WALl:O^UniCan4:vfGɖiY6I55تzv++ETuQOL9DU0DR/i?WS (l BԶ۠rW~>oJn -㬖u1D mRUjNaug}Pw5n|5s U3b7%zCt}v=7[*J5PjfqoEz S:BL6ψiO3ڐk6V*Y%]ֺ)s`7΁-Zòf&^l'~L !߽PvK'^e.=ӑ#Af'OЏl=R-4+Y֕mYdbkufM_Osak%[F~mf6zP(hU((H"y5E/_fm7A|oi=3zj,}{=e{g7>=f>yz LwoTy#@D rH!O.tȇe|5r B<x GhfL{'0yZLA8 c< -0~2$o򏁜a?O@ ([@z0F=7 30z ׋z9cQ- 7ö́1j5򄌑+)?W $ïK(ۍ(0` -2=1 |f Lmo08qLJ8 ƍcGg 0H YG6.Yc \#'+q/?dyTSWK¾!/@ Z*,ʾHHXHԸТH݊8mک^ENw~NrOqw¢)^/  (sHlCbh&M+_<8 xKKO>Nctf' HbGZdAC6=|Gwѽ8}|K ߑgcr?F>c!SMA\=iOcOg#SbH5|'.5ԘhZz%BSE]3QDtNSEWG-M1fO u?Ax}aM>nۓO_)S 'zRC*}I d+d[}̛~?$'7$XW<.z60s;pv*f} τp-#k -,IK`btV`Y.u˻w52U&߽6]n|ѳMF<My~ozIfC޿Ʀ76# uAmaG-Ƽ\%9Zy%FjM0=favo}OOՀ)c>׬>~?l\Ȃ aha߿~}'l_o0'([wb+`50@hlFcYqeF9 3Йۨ(֑p< u}ֽK{BVq -nn -+ogY^G-=w[k [?0^c_t-ě:aqFbe=-V؝՜vkNo o ;(61'ǖg;͑ض9 -|/=7SЅt>LCO!l/5ѓc;)մ31bGں=[n[cm\L_&X'\=* 1X쁭! Bwa0$Ѱѡ 1&T,ҨCh-Mfٚޔ$7'V94%6ҫVovZC,nKCQQ}܈.K]¸c]"0Iiq' AR :Jm(sEM^ğPи(Ƭ Ų\+gjm܂RZW#P BUQVW-Su=#*x!Tc' jLޤQ8' •\CT" RFM.P1ha, 1(6-+Id,[MQPSV -;ej׻ȵe=nRq4ew8],X\iP%28Z2 XNvQSK髂X& Z:\Q-Qg9(J+FuiWIcn(YS üIwypB{a4ܷ 7XFU7(oE42 ÍbrkS,klEV^UM*U.$W4 *\ݢXq04k 3!A4(ADqpU֩Z -X+ -8"8KlUk+.D:Zu}_Z?y}r?hL1+'Ǫ$;LZ_3~Pec^:A?iÖ8g~&h;+Wƒ&^I>7AR9{u{d*`}¬4=f15x/j\jѫ;|v G X{EwϔLmn5l%$ ݓWoy?8lJeҁ529ega:__qڋQq=C89NwnXۚ]2xuj8QgCls4و<+al܃?/ b, q=0DGcr504/"~}Ts{re.r,EvܜGD7H}zQI;q-ri9Ѩ }>mmV ⭱5^tWtSYNq̟Xbߢm_6*m管;k莿+gs' v}8 .B- 8Dz 6PF mmmmdۤ}hͮnyc!xP:շn+9 -d ;H΢l@@ѺEA0[TV%=вdKƠE4++JDuIU>%Kſ+ -T Oﳿ&3{_3[_ wE .R.uCKɗ"ۡrAWY E ] ombj/e?fSXhf? rh^U?mwfpػ>pbP٭P؋!vI/3xG@S` -j'hjXU5@¨#񥤆5kxk ^]zB/Hf,d~Љٖ@ˀO&|P:t^;5o -@] a\:$dwXNR]% -RJ:RpUu~ߜ%Hx]/dϦ{̽j  ~O9^D.Ue纍.O<Otc BTPwk`w%襸MtlVGKf#d<3#Kwa5,Ն!]jr}va2v7Ἰ}[S-.R\ -@!nӀ\!Cu~a/ZlEY`<7"{n\$n q͸Ah?J ŀ2EyuŹf)4S6b*B:Ul| 2ۚ0#Zŭ i4UT$wT9Si̴MuڴWUb*PԅJc~ 2W :b\Qq}nE%󖱢2YQjPYl:e^Ɯ>iNs8ar8.hvO820|aj|tmGF8BF"xY;ը&(n1PO|3Bq"zQt8/ǃKGhE2 jĪ}Eb'{c\jl!B!$K@$6Ibر@ 8X$vl'Y&vL=i&I:Mm433{y9^+b?uUL$L(8/~?b.JϤTJ> FI l -|,Ki #ޖ_LAYB e"dDG_ŞvQe sIZOKB/yȝK3kFJ0}n3уL̽{T -rr\9fW 9eAEEr5 z!֜l=+;ŝ\2S cr0GY)kXP!JEBlkdJ'+RRD.0ԓy 5LG aŸ!5Gh@h@DЯ$a!0\̜/񨻍(#AḦ́˚Ͱy 4iӥr)uQL6WlzUDQs=\,+ {xw/\: >ulG<>G~=<𞍄r98 z1iVIEזƌ3SZPJ\ܞx"Y|RԡZoS'&>Ij){|K !hQ< 0*A-3^d hE0cJ!MaCqG_NU{ʭ.m#۩mv4BfFԤYJh,]KNi~ɦ[ڴ߮%'7؇1wޭF0w]żcX[kN&U&VfG TF4nQZjFn5r]FЮk/'Yt6~5F_EO,g50_.|\}DW1y+Zu/iВFEtUG9*=QYhc5T4sm&Z@bbR&# -ӏJ!@xU&K>zpu6͘79o=Flc 61]ASF4[˩ -ʪnX;恸Jqʟp|&]ՇȗIz"CG/_p3u8mx 8لǚyRHG"^mQlFY]gTֵL}qq:46ZGHX#*qe_k%xa>}g6ּ::1wvw ҠMζm֖Ljn=LnhG; --Zeijg[nAYè>_b9Qe5^Rs|^b;Gxa}x&ּ+?1s [ܮhhw~{I6W*֕IvFVvǘ:˩ -zy{-ns[ -[gDdZ$E,,siJg|XHCBr<(ds r뀯hf'07!_R:WƊ2B_}(VM* 6U M Me0?;ϋgnse@@Ӏs%`-TMP^q7W;AT(ĉff>XxkU@c^_ c?\p/0Qz:Ue@+ n:ԤnZpC͐7݀3!/o)ca؉?DZڏCKswُM>0U﵀&Ѓ)yocܤQ}E.>o9G윸x~Q`:ϞWXx}ͼ{~｠5i`M󞬉"CFQl`.~ <_ @]Q }Fi -ͦIٴ66*TL';1E;w<;A&W E8>UQ1=H?y,NxdJ<2uQ-R.iOeEBvWjz/+/ x=K{+~rK NX2Z*L-!Kel%]ϒ%#/X -|* -})v\UlSl}Mbc#?4esZ 4tU\q/Q]}IEcdOΔﰦ)[+ZW(7[sUͪ #s5oPtU]*60>kt&T Q?wQ=F*Nm %4N)h"/_WfWdkr6hvج o"nYo̠6ABmАc̿B$Q~<)p0EaWHiCxڰܰъ_({NV ^ -]dLk$d>=H(aAha^S}ZO#=vn4ݛjfWpj/s'Ϡ?FJ׀7GbCdr#H91Pf蛤^'Ygi3lz2 h8;8R}J_#6{܎~f췏l:lvژȉ醕1aRVtYFtbaʅ&-jiّ" )+G7Niq4%CrcG ;ғ=FYcP'pFnXoEF|O v"-6Q͠hfLΈIM=ߐe41zWCR[c@a [5{砚}>)8 -|`BV `)-,5!Z>ʔULM7]?1nݗbWq\>r{c ;ғm|/#Y.h=?goÌX<5/e GAkТ!#@ Az@TBt]OZa]-3umn~L _|?~i扫t$))2k89ǹ0ՒJT2k7gk[=LڃYSL^&3iH$%QS{ Krٻ>5`:d1UKkR$iAzc~97⚣[XVu'4i^ԛ4#uNpK J?sYIjeC?14LӱظP\!?kԜsr2\ VAZwmꔌ5I^Z Iz-Y/(bkی8(bq1;¬Ay¤c> xc&;b|G:1SYQ1#:As9|ҩw X=|}鄓2v q~ x́GO4=ˠ5½ -PBEE(z<(O=޷z]ɸ-w "N! t;< Ji7N}7PHI2$9CԿp;7qBƝIS0"@!tIeKo4pe" WX0/#tpL.#?o05w1cbzx;~~ 3 'MJpT,=/^`Q|9Y0y\t$o>r|O~|F!Dϵg/PdcE]cAnArKĂܑlX Y,?`/G|b‡hEE>{F)[6SDϣ̘.c x6o>&w -C}1<%ă=&YEyCp m49q42,&$ Ud=LZțNr qO?/ -z%qx:)$D-"d% d+APg?u1q -xk%w~AE?4tN"|G҉Xy8&>y;uvQ ?uR8ۃo>?pnA+r7Fx@qnT\9C41$[1jlf4h:Ӆ/u<;HT}Pem:X5$p 1$$"B"QmCToB -~ZC j]FҊ6\lU~\_qQBYOU"1J F* !zR}/&4w|kuWa\QƗ#.hVs|يs=1|Nw'#k"uqb  $?-2zp۸%Wb7;>ŹU8ӽz4Þ8ٳ'z^m8k:CO`kO]"_ǘ٧1-O$.E&꟏Q8ÑEOg`f_BfOr2lav lpxixm71Fd7w_AB> ' ]8\Q|L|4h9'6{6`ٮf:S-ڙLv.Yݤ]nnbkwrܺ!g5CV_>T-ÈG<&w銿6ZY=[|0,Ga_pҍ6 [tyجs0t%zmu:vMl*[/m[bJ,ѝ.ݒ6x,m!J? -O?$[FM|@380J]b^q!ވ,fM\2]WʶUqKiB}YHҤ_%o5OW̸񢔐O%RkL!jy{Io$('ClH&$%IfQmNpM$2BZ -P )Ҟs=n#ڌ2tŪh1hNMaf3sRNaC1,36 -K5e0j*` -G11E٫`Sg~+Ofz^b)K29sG1sӐc 7_k*ԘҐi:A/OL_LoWUPQ*L,Ch>rp:>iBzeE6l r1M4侍>'d[PJYҪ2 ܤW(6uy8ƓuE^W(6ҜN`g!XK- 5?OY=1#?ov` UyvΟ-R%(ZBe“LUQݭqZ>8,;9,?y™'ʝQxɷTd8GڳX@~*P`ڢQ3a6=$fb+ -rٲWZPėX}5 + .ka][׫m]NVM_jUTXE gܤ:![G-^]4:u&rDiי; ^Q%k}j_ooUwj,\ub3^wY Gr`C3}Qye1LȸfnowKlE~F/zGn)\)\*ܮ6,x2Js KtNRS*4~$'j+텒x|Q䋃7q2 t7畖Kr!Yw]Q{;TiޣTďQV"_ <3:S P4vNO~%npUFQ9FXҘlRir* J$?IRF*ErVe*IXPT!*E9!{:;)`Tҝui />aB0H1șldBLf(5\ZO N$I2Cp0]<^PU T$ -QSo&7h"i4L#UOs: {\?a0G!=p:c 066)a ~nL>\yTƟ3, -ʦ0 '-Dk$F5O465"eE 8Hpj%&*.TӨ(1> -&y{E -9^٬IθI&9]hBm^]u KY+ǢVwdX'!-'Y00g#YT:Gaf)r -/lV&TƜҘXe\*T%R=PC_7f1&yeVr dia=H>}BR8Ο,$}oɽX{c?&ؾc~RĬvywR@Դ`5GQk׋WI%0PCi4K+MA/@t Cc4b嘆HG;rX/usRغv)XHk}/q ;z8x@Mi3_pz"©G3*ViDhe -B*"r8*Ǣk$T͆U[U}VRS0\$1θلyY&7Vlc<.=c6$z =08WO] Թԩy$&ߓBwp_F;~v[.vB-ӎxJd"%"SB ԩN 5j{q|˿C?N?D_/b"Od -fRg>u p6Q)\s;SU[whWp}+\D ZBӅ9 H^!M?Ө3m&SǎXC56sjnݸX|8%:Uj- @oX ^zXHo2L77Z3X Ȧ -󸮥F5*phf,Nc'Y@*o1zuAS;hvcGbl ^;CQ T6`sQl -n?Jp!! "',Y<8}hHBmcj"G:rĦ lZDB4zT픊51n(T{GUHOic{WT^o}kd4hg7Pih2X8 PbxņiuBT#'Ib9/a2a"axFq-ENcEv:Y=k=ן@|U߶^pĦXcBIXcզQ74QZek!0}$-3-rPe*S,1mU,65*N*$Pf)盅"JCơqs5>}{`%v,iȵ2j/e[&IK-Ŗ兖 y%[a)-%yjťeyޙ{D K] qDpFf`fD -5.Kq-5zXTkĜ4mz5m<96ij4Iۓd1w= |zemA6G#ulI1kLslJFɄU&3-X,VUZMI[a(wcm<+1Vl y+6"SH"?7wg:xuH?6#<MXmE%4X2EZ -S,7{2 -ۼZ[b~^*6o]BeKa?LK^Ze}%s4kahEI٦*t۲mPj+KlbͫqֵRul:lsm/ԬkCzu]˸9Dq-빮l-#QW -eʔ$#JLHY"8Xr]+~)W$/U~Q)ʅpEy'<[!܃Yż1t7|ۊQBRu&T@j:\L5IRԀXݭRYVxO^YՐLܢߗuJ@o/K} J#Pdc:9pHG#KPX&.q5َ,Gjo2;uq.,q3l>P/^0GO4l^\NGV G3 -w><\$丌X]9bCJLWcqҦ6H&gltҥ^եOuo4gH꣰+y|'{X[rzTB^i$1qO➉ŞdyRaX,|!S$.TFO&ͽNkpoRrFIII>KB^ޠgS@-H zdW BVHX+' ; <)XTeʆUVU(ebNL,n{OKqޫ)ڸʐ6'.S8\>84ʕ] \n ~OFo }HYSs >Ź͚پSX[hbBڟ8tf`5 |?` 4HnX< S1?$0o.f0fi8Ycc 1Qu@fύC PD3I&s[1efƌhLoiqڪ3fL ((@Lс<؈ =x*)`|W ~KwQ{s+=o^[6 Q1LLjۢ0m,&MSX<`*30`1FkZن;aX"FԎG=a֐Qe۩BFT'%`^ v>ۣ0} ڣ1}t'i;w,ǠF ؂ h?[?CAzdݛX'$b_f1G Dqrº+RW,] Lz?]  |d8paD8vs 0CK77[7E. ̹3_oI}^3vi=EWGA a:-Dr:0 3G_l]BG>Z{#=`7ԧ__ DQԾI@!j{r aCя =aOpaȞߓ{G{]E Ybj٬5{#|Dc1=GO>g`|C x/y=dO4 rjbE 20*;o!"\>'ug_KH2kDT} ** EZnnhYDQA@B"2bM01rRV&NRV8ff\*5qܢo~T{=缤O~ld!Hu'3enDٍ^ӉYDdd"d3AvtS"oq?xW?" ~ 1 1tKlF3`'5ڨqssg#>mj O9z<&ȿ?eg7N&qdOT@EꬤF5j8s#5P{8g;V!}i_2:2G;C5ķQĝL%_AԌ3sӨCBjF%5jH-_'QB//} Moq~$7 /DÁc 9}r]*|=c\| urQDUԨF-5>V9wd4o鋫˴wi0Z"6;ٙ0eG'\;kBq5JN&gͣp y]U -Dh9YВSG|kwqlCyeÆo$O^17x Ұ,\p9bu,ǙU85|z6S 9G#qGF^Qߠ1] sh!ȓx吻|!+ȍpy~.)DpM1lt-C[ :jtmD6toO$xm}qoc<6WL7OfRߛ70L.Ot%wW􎝆|=^ }`M.Ůk:-ScJ O9Sylv M=D+4xB y4O3 : -]&s6L*gsf2ϴaR4{bW*UY[Q?kP7S+}]s_\uS^})ZO.;v{{bs%}4h1' >VlDoj|P[*BoηUX3P>G\=X6rޏb|Y,yP<\{-]~tS\ `*aRJ=ʔXLAҎ"eBY$,W ˔br+-]--YtI#e?!,CG߈.10vƲ1-Zָ. Uc6C}PUT:(PLy!E_H^X -1cx@k[Hb[fB+:q#1&.헥{Rh2q<3I+s#kvxa>Y=DlvBP&-~,"d%ĞXVjI 5bԴc1ZiCvZ3\o1\r{y{lb>Kz 4&Vq.]#4"!RhX0&>'dӀ~M}̽5G%]3G%>4G%VhdeT>` - 38E<gTJ&;iHbR48%LSh@jT6Q}Ҧ+:mҲ+3m),)tUShShdArCc#˰ Jsz2gکOzguStV_ٱ -ώS -˙МSPE9kS+c͹,2L/RXݲ|އB}0 f8*]A -, V@a Zƨe|,3mIU7"ue<-\GacFgWA+%r:!-;klql}Q3dcMW2UP -#[yL@^RE7_W?7Hq؃R)`+5okTg/S |!adg,@PՑXuw\ xº2s/)kS -܍>iޖloaHa1~R=Ci}_CP o,^Ç<OXI-A GhFoz<^ÒsdwT2GvNI8Eag0?:Ǚg -hrM@-H| -/:'֣?<ŕldllj֟%hMFg&9GEq\#dG(+t|+e`؛=vEHrsh@:st4CjQNFi-9c֋]DNg:ЙCGaoA:N:K(gJm5b>i-mP՝ U|ǴUl';cWC(NzM=~WO2|u{7W ?w1ԄZY?T}40VEq*  zM f*7h+;8WYEYy!GsC+-)%)a_ڸŵ7+x(0fl#Yik͊P- %,@=# ^+eOiJWZxR#2Q>_ -h- ZE%Hy!@$ $BТmN!Zҭ͵{3nu;֞vNZ!~>Ͻ`͊O= S&',V iw$uLs0^5K>[R)G{Z -6g-=Xaڌ -pŸQ ?|mX -o^:"YDX\f!U<ຒX`d?|lΞH)EkӰ:;9:rLh)GCN9u]Q-\ʰQjIY̡TP/*IT80Tf?گ>8b팣E5yhV-O j Q`e<y [v&*w _4#2]Y&H4cO79rZM;렂Ʊ _39j&c6.N:tpQæ_/'EYQZ' ̆wd%["G+ ?Xu ;i& }60(Ӱ9lT4 -a+,ƕ(5`1h(.z^ɊLC2iTVh#HEc[LyB~'Z$[s8ܦIpf -bLa5eXX0QRBq*[`4(0zOd:yc/"ɴfIJG=L+s3Y&Pa0JR si:K0PTf̊ʽЗ?]yX}"z\loTBe(me-rA/{"z`-]c,Mb{,KQhO|+UA[YJ*WC][:l1pYUD+~g9 ۀ}M.G}\fN*KqC0TGB_]"hj!&y5*P9P:+ZlW3 tu WH=*gDjUO!wIBFs/QwZǀ'Ɇ5y0(Ȑ_{8CAGL V;V߈Vx2oR/#{Z$y HDGqKU(=C$ s[*e^ Oo*2}QHGZ"țRڔM*,o6`YUHj"ѿK['?m$4CB$!s;ڹ'Zg[#cR3 Hi@R$bi,i]G[Xܪ ;u Fl 11man% ¼"EB̺1q}~ux@s `3]9 ;v#%L-[Jpmcr60%&^JI$"|HL8x˥^ȩI @@ \*""^b2T@W=j>gmt]36v[NvݦsT|?D~;K NH#H3i#ϑm%1|I1G,Cy|G3y~g_2)ѐ,O"ƯgFCldbOajWL#>[_0o69aOƒ #5 &$dP/:jTι_72~w1N.~vp:kߤ0ڍ>$%qαRgrragaoj^ԓ24jZ}\ q>)tvpgp//^_ğYopjG708=]O͙xԓ3I<87+]Jjbf@FRcn)C\vV{k4Wy? C~9wyD)B8%3/ DQU^jM]c:ut='ye&I-`SGch"x^Qy1H}^Y:9?"56qj66LubTZGKB<kW)hVub]X1eG;Kf ?6I:E1g ~s7ڧmFeV -5f4`Up>V.X6!QҌ%!X50<_EugxG|Lw -d*g> Iǚl)X>#"BTGP\,SEsajTϭCFTmCyTG@Y̋ Qo -O}؂ձ!|u iKd煕Q~X=u1cQl2jPkDe qN̏,Q⟠Hn (D -•>.SL >{Hh%kS'F$ $Ơ\*C4 z$d(OB܉(L\|2dp:F87`O9Ia0x'29gIigk譞>'B>e`H![BIFlp&9H*F^r%K))w"KyUȢ(S`n:ظv``볎>VG-}+Ǣ$t(#R#O -J٪\Rݰ#+F¤QsDyUd _Ads6x:ْ>(}T"O -:X5)hĄLm6KaLAn6tۑ? HcNAF?V'.w/Zd=F.V}0,9ԋa+`ԧ!Ð -}Bk\q=LH5|Q4@A4 " F'Aj?xK1#MQ2gLdL3a Yt -ZL ԙyH!RU2d"9k^>d{|~y0Bc{?wp$(^ J5ři h!Pۢf"Ֆ UlRHqCSyRHoԾsGBl$va3#{/u+9Tq/𹼜<\z1:EPyCYH΋D# -rGd $:m:!qAEk-b]g|A#% 9i?wQ{">9*VK!G%=B$A ;y @TQ `NQ#"7#xŠO!m9B!H@+9Κ~/;9_ -4s]QQXWeueߑE=-fQ(̸ `T 0q8QU bզAlVMM`L6{bCRc4how{ xmcb-fJM`PW`ŘՔhSE(4\ldZR[_yE`oجloCkiYΧ6B}3UXO|)uF(6VvЫ -dά<Ȇ3D$ͭlJabWS2mzAWڄf_0'xni]' )vba'luPC!d|R[Yp156v)40wIwvjQ:jXG .@Z.Z}-Kbna14,ttN_tb\KK34@ o/uahj!j6pENc$\bq'-%r?= kgY,zA&Z@q.IX4iÁ=9]lix3o'3#MF{- ~FK.wuNĐv>Q@$M1p2 u1(}\4׸7qț|m‘3}ldIƿ>_{[4Ү)yWP(]%| [6]?>FC#c61qF./l~ `0)`(bJzآ~d|isY;}/\pedZ AwH0Ŵ}k1˰_}- :55u]|gu N|OCx̹7T} c ضa{.0.S0I v͏C8 Zנ"ZIJa/`߈"ih~1/Ƕ \M?Ч<~b*-a8k7刦NƠABc")}gcfcߪ^N*ȎSD2P-T+nKK_ϡ1L4ʓIg#?EhXrc;YvO^Ö}51%;JUhi#:cFg1v՜\; keҧ.]:6k 8qW:Dy{+ePvw9] ƧimZqGiV9hsV8s\ -eJ]*TNuA2_T=z6k\FXᷔaw͆SUnZ=̣U9R%3EiI *4,\JhX|~C9>5fSvVfspN_FъpuQ7N :sh@ h;3bʹvK| ]9ʎ UVd21fF ֌=Vi)=MSf)kRb5)\c7+9Zh|qݚy};`sآ#;EXojz\kj|MV*%~&unS5Qr5.at_7W=hTbF&6jdѳm/uT@T@S2 0 ]`H䲨1 `y ^K$Zf*hY)=Zֶɶv:k%ִܓ?>y}}˚ƎL}%q4bb\9\0 -_EUG$+7ª\eGڔYQ5ʌ5EJTjl,5?NܛEra #NJ + q-z -)?zrX͎1*#&U,*-ήԸjYR)JNإ2%Șx~)S'FNm[q88GE9^2LTaJ3D)Ր KB JI,Pr\%ͪiV'4˸Q2ː.;?^b911AaaV٦0QG%#dɔ$cRf%*1D ɏȐRfřE[*| w)<@75؇~gא2jSHdd8̓d4*yS~NC@SKoޖt/*zXlȤ,bI&XP,cR4QE -*(M+NTV) -M-Ճ%4CJɧ䔼K>yC6&35‹JzYQ΅Zz-X҉oya+>J+)5I0=hD{&3SV$_VqOjlyʳ<˳:8e ,\~Zʹ4\SHl2y1!P&JOոJ? HyU%ʳ*UcQe{"n[FVKիUF.wZVmhȠF΅ǩzr@LI1Z(7T:B(GFe遺 : ;лX_mQg?ߎI~%g#=Rb|J cʥUÛйM\\k1>$mIgiໝSQ;vMG'$]0P`C@uQN w+ -}|7[ًO -FwJ]#y‘PRa#> eԥ8 t4v71qzjiW|?-/҃ -܏WO1xNA^SIAN$'gR,Yhmy׵u/`ͅ35b%Ұ>Z ҅\Opn!p8>c"5ec,ýKKf+ų`ߐoO!|z-Kp\uCѫ 7RnWosܦHv;; PeP hfh(MEyEևb7:󺮢gKp>5HCax$q`\,?Yu !yaMZ`{!`{9)E h̏Qh;:.iofp^'Ѻ7/}J3G~1`9U~ YKm@k6Ӣ?ڵzGOѺѩlS$8AQn<r_ w_pYX;|r"𓈏4-"el -ֱc X:V;؎t^*ׅ5h 9$ V,a߆};plՐZ| -]ɳ|kyF;lݘ؀m@an_L b -M&kk^5SWUv6ҤjTiViӤݴnUNC}>}}.Wy%z"Y/_{Ob> -ۻ3>wiJ>EOOUE79𓣛}!\+q~F6e;K 0"WҽMyޑ`HRsxx/Yڱ8]c~9Xze TtOҢQB|c29wxz8-RLSγhqyi'Ooi=lff1s c`4!F?јop4Vc:Wy,=|`oŔ>1 D`1*u`6ƎjLza"ΏnhF0pC LÒ{_CI"%M{MlbdK II%LTc,QcI%:0,APڀ!i H;0 EldcdsI^EwUtmDG{+3wLYfV 37C;1"##) /ՆCГք6tw`z?:GϘ2іyYwz ^ω?9B x6`uKlfiq'L) (R‚@v9NgѦUGޜ!4LE4?-xo s@Ïy uQD\, Nݿ{xmtMc[:oCxhdj2q@FV Z' -ܨ-ZKg1TΡRav+(7~@N<_&-7p%~X Rud h,LGz}jTpp2Ԣ؄ -c;E즣(3@y6uX-/>K%"Y=r`wps:T:&9&*Mp a7Qn.CŅRKlm$iXga]GQ"}opKcm*q-$ RG7u2VP֊&E&.wm  li&IX9㡭BS5uv۠T!ӆ^(Fp -Ho"!R䳈=%.p$[;xuwIE덂99r(ݬ«CׂL:|Hu!7 yI$lBr ҖHlI-_Y̷۴?77s, ijڥZ Qn Y8H!ůܟd2pAф;! !3 OqF_|g|AfY㼓#VA}FK=J} io{eD$ - B - -D !L`0!J{e7#bɽ6ɼ0Xa,L|qzJ] PSSm$;8D'!b8 --,FI> d0 1y7ȹf{5"Iq[\9 N98|_%~ / .) ._\Z!,8 ]u'0B(5wN FO3朜>dPg\Ҥ}jCtrt\\ȯkK8D??8{=<<wrx\O &5y vh}q- t=! P Fj0ؔf/TdV [=v]Ku_}K7펝ץc+ XASZQvg+tB-l7?ckncgX>Ntho+|+{n* ^k踂?t\B{lum29wtt"w71pyG\Vx塿ۏa -]x: k %^i optDoq>!;p(cv;i w|-88,~>^rlWaد@Z=ZAXf8Z_m&:-D`kwp~ >szK?"'f)X~vcN^F[4Eт&tl2!'*,42"^q6Q{rר_\1a#bP Gcᨆc2pӜ.E(>;Fvf|¤n 3a#<H#8 --F"t)rkKwմZ)eZTmjKU}*{lVEσF]W=x2undy>уnOun5W&h{j3T힫qCU1Bc=U9^= y.RJxh~Km**qtS>TgYB*ݨ|V {Sy+0w^s6|;:rT -?Oj_J#5ߤb*ꛪa}sTw+?\Co50hv++2*3䞲B#u jv}L$7TA* 2 (F588CB)7P9!_) t21RJq%ڕP -xwۜC^_IqD7g C"De(#<[JԈ -DNRRl٣Zw}L֘Kp(щCp`<9k6d>FBr<̨~J2(-*F)QJ+):C ׀r%j"ǭٴ]&gzWq2}61dZʧyo":*1CБTCd3F*'k\T%b.TLje΁kJJ%QC|`jK0~a||}XzfXd/,`0oJfJj_5 TE -WQ%+@3T.¤Vބ;@_Kڕ|VKH F7D`aLr_hvȣ<ȣ<iFF6wh es-**12eXI3b3Ism2Q"@zcn^NVN$)I&O/\T ypײ ~ h -x Nw 8 ^o7h:9ϚQL3xm\|pZ+>V4X9np 9 -%pb]79E|Fk.=tqߣp_ ~ @z! 8d -%8b&qO, 7G;[s}F7}#8>oDX׏xobE.!}F'W\G8?#} -y 7{//x8xB/?xxd!]ʥ?8 -Jqq`2ϓ9cʚv鷈uXi<^^G~_['228}@-1/i z]@"b#v91::f)d̲%8 )=`A}`7x#vL*%x[fEA>Nlb=Ӊe2į~xVav];aA-63ڧamFnf:iyZG1cW6!~>gbE,C %F3QVXn8ױwl=>t 3mIB6wh=X)p1b8{V e5YЕ(އq#%Y/>`ݍ.F($ p< -G - 68jȣZӴ<G UJ\ #J7á{6h^b{?v[!{8v -!J$D @2-Dʂ xPW`k,@9GY?[ԟ0G^m8rК.5~a_\0A O:YT W*N.gd m$VM{Mn+rޓ+}GXo|/DA]U9fy;kfTW5-hr,lSNCݚ;d\%X mh#aǕ~Iww[~8:ZڲE7*HFyb=41\ T3f(8NYɲGNWfd2"+Y&YMj:.,/>R+цhkknтҖQ|k9T(ƛm,S/My2̣d3[n\F)%fĬШW#^wh 8ӂ%mhY y>̠NSikTF.+_l# 0 3ΰl -(0.D4Dwq;hc9&٬i&VLlkXSi&=iZcܲUt=}kPqQE! 0ԩ,+7lFSNx1WUJ3nUK)rF7r+%.^nrn-d߂Y?=N#_<&0ҧzs+&OQA1#RVg&),3]Y -*հI2dPp<(0C9?(8/<39AM֪lTi&Sy?;pMgq$*rkPHnȐP`~˿̖qHA>+#C *B ܼg9G0s%\*(EYX'btTP%b_qq-OI,WWҍ1 %gحNՠ:iV4x i|U<}/!㤀A+ Р2|ˌ)h`yr\rYX -0嘵rCƠSW.jB豉4/Ɩd%ӛ BM -0wE=\.BD."c'1!Mdb61;-s8KpG`O+yɇK*a@ȡ3$x \ \5\t5\@5д!`u+-M_M;"88Lum6{&P\ U jbibh[6ҋP@/DG=lyC2D-\X:` -XX G} 35ã9p5XᲈXĢ.$ml||<[\ -nm 5ʡ]ֱ@!H]/Y@ & -VxҏVx£%RZq.|j&UL+q4+ZOX9HfF$|6K[w+(݋ < d۹xvzю(8r965]@:r;zgAK2>Ab{婋t} A===uh $߽V3u"o%9KɓFbvI9V#= u̐ǜc@E?eb(Ea.^zCU>_Z>QA\%!Կ_p55AGy1~ [/ g?>q&8Ǣ%Yzq]9@"g 57<Ǽ=f/΀w9Q|P5Xr*.S 8yP  q-M\׸p@E~_).: x~B>G"QUmpA0ҷx̯5c=U K+<.$;?1?R>@k?eέx -^?ni 53|5ezqA#_L -^.{8 3w𗿂8#=C=:n$2y?t,Y?8VrEr?أ8G:rXD^]M2m~A馲.= ݠ&救GZq+YȑLLV8DDRKX%_"6cvv'iP6Դl_+u:~G-rE.9ϢB1į DWc Ğ2 YNy: ߰Z_j%yWx=19v-{E'{Cf$Ilq1 BjrԑdkL76`0`n&&`CbH'@B(HB[Fi.K@%Ye (mfi6AZN]5mӺ}m6MӦM۪}ؤjڥ4G.S =z?y99『w f 8$7el{W('ߡܿ$xqÖ8 1Ua#f<ߦg3q;cX5#Df= MSw)h5졅p$v1iL.x -8K)gYBDim` $]v>NK<n'2LY%u )tY='e*\v/q~J M5+ɢmIښQ{rڒ˵9%M)aES՜USj61m"Z~D XR(j ?R/1~ -b:m:r"8+GS IږVQQU6`(VBZ7֫޸Qu6Mݪ5Ri3)yNU -VUX>T3SKH'bCطEȓ&K"L3TgU\Z_5ZjUm(hک_Qgͪ,mUb{Sg;>S#{Lo&Yg{(C$;I!Qk,ekͭ*[*m媰W^2GJ[SI39OQsWޜw6 %33IcuKZ~vlF9{IW3SNʜ.*8'"WH>涩 Gyv?ʬQ5` Q)-[J&RVj0vƟ^Dw;X҃][K> 'dMSfI,kr@ ʨVz(PRB=J -)1N0uR;HfbM ~f/w_ዾKax e"'q!a$|:xĞqbMG#a{i{sp mx AY2`͐ѐb: }0q8k]A(nbL4n"LvLavL"&i0bK4A<&?åC){1ǎJw ցJ9>c;cܘɋ9.?7FҳB_Hx| -:;_ U:G;0\|Hv,bb,R(2 $y{8G^~;?oسEi㗩WH*_%p p Ǎ' 67%X,e -2X&8ҫ>_{Ŵna"r܄*_a |n]M>gVcB~PW -Iʊt9c/ggTW6\ۏ_ݛ¸oo=^I/G!R6\{tƟ6%inmzK4IIKKEZ.E\1AAȠ ás)`e2q2&sӝYiOs~/<Yz,GG>ۇ;h -{mf5*c?,ks51#ꋚ b԰>_8?@}^Gnx7u6v̀/b@2(CAw6ڦq-gҿu7g8?R<7{{BGeER?.jK?wvT=:uч踂89,C%tz gz@{཮kz _>/߈M_p귪һܷtɜGG8qyqa6WqR6K'Hz0v]_p|ܟ>ݛ,::)tGsc88#8Zܬ}d/ _R@m!B#_y \b3e'"֯MzGek=:Bt5JR=pt±nѽ(\Sݰt*O.r?b̘C"f'Q~mmIG<4vPAo ɠy#ynsmEo - 8,OUB$P]*,Od_ 2\G{?vX-s^tSsd+\x -)c:h_P -~/k$?fOyF>OqmrѺ!.sSc>;\䱧"p᪇pMdptvZf^w@dG\ȝ --a4uAL&cjHָA9ʂ͞*P}LHuª4Z59_'`K0\RE-U$Fp+mw_ղqlI&&cqjHNQ8:CjU`b+4$JUI -$5ȗ4VH%oUqOxBwU`BSDEOƮGm%#P1i(bPɨ!Ft94y4T*Rjܤbs -*HW5r[)\ʱ\zD $#F#ϯw泥8!7#kȍߚ -YJ-*RBK -UX):Jn[rm3/T}RcxGi3-»[1nŌsJnFS'R*U`cO۞<{r%r9|I );AY㕙>MNgҝ+*{^2^5MlkH=Sl-~@ Fy24+iSө̌\P -93*=+4L={l]< K7#L_O̔zvx75RxeXՅ|vꤖz P#6(e3Ǣ49\#L*Yek.{LddHO*sLIs#>|o #c`;3 mcHrSCn|Ĥ* Y|vY -ke,K)EmJ.+x U\Qy|;rȻ chiCG3#t27^RL%VJe,u) % VRYH 2*ۡXxK^n"/˴2K-pg]9]m jF_-CF2֓b$&@>*-JLx_b}^ SH~gCcc ~cUEp>4q*=NsaXFh11+)`bA MhPi`0MA C?Vj)x6{LzӐأVBV7q7 $K%l\xa0t\x ǸcBHuhcC걓zCON0yy@0"dF\1RkRivHMdM4pġӄ&45GoLLk.Khhh k\ni)![ 9<h#;?;: 6+Xy#tp 30hs1 ; 9tG7&4nrхU]Gy,AUEpܳ:^J<a<2h6ƺ gGI'M/uE賏FG.Y'ṿ; 1pa0p{Lߐ {%W@Ca!WқO c *r1@_RqpfLtLRl`ut^o$6hVӐq -8.sfp>rFqخR+_W.0Y āt0Rοgjs;pH}A#GGs"^@ aG>|Tp!X4T |pƲ~kg88K8G<N]zS'u/ >z:=E;N*ңn<7U#` :._ORܠԍp/h=k!G!^7YJgz\hDt*bn 6^ 489x,؋h2GM>:p6Nv4#ԥY EfUR0we mXu8# teDt2!Ue/Z"\B.j(fmV]O{ jȭ7\~t \χc9)2xYŮC-Z@泳R\ ,F}9(48ĵ5xW:EiU5YJϨ.&j$ -n1 BxS(fYjC(i>'{ogG;k}+l$n9C5rxxK;\p%'/\p k4\5hr#{#PN. -idgqedY1@3zMaL$?r2C&X5>ȡ1A.%jTPFgiD a!w+'tCV:7)5C)O( 1|!OwDt.Xm)1PANO!ǁ紆*dT^Ur .eGxGRZySbdSd{< =ZQ1]!2YQ,jLN\r,rNi 9~LSeLȄ*W*,qB=9  -NUHO]pwL,Xߕ|VLl)f9#'CNPEyLxl2{2yeLJUD0(-U3Ui0v|:ɮL1v -ͥB+tr)D]᥊y -ݸ~0)\*ָɽû{Xfmհ2V|ߵ=růĔTMT۩jEZWj^vqq*B˄ΆKZ[µo5c[_U`8,G bK^2ٓ:hh5i|1/jZVXA>ך_,N7Ѧ _\[=_iu`xD@yy_2%ʹx>r؏{Թr`jf>+Te$9 `cU: I ~%ٱ/袁/h _s)qqlK3[j ML_>7\;ֲc4QkTT((kx[w -ሕKk4U@{.J1P╢4 ŗqE`ƎUn\ɼEi]l'${.yǵ1Ja} !Ϛ:mfG3m4I3]4E35q^'$;i츎[u r@ -1T<ȸѹm a-߉MKvǀz(j-|BL9~3p.Q3 xԭGn߶dN;|ܛ}6'Ѷ$3'qR<%&4S|qJ~DzR>ދx/9f |ʸ'yj= kâٱ ]0!,ڣp~ӳq0rN<Qٗc;ޥ`|<\^\e>PF<?WOcq|xiorM_a{ u| =&RK忚6W$dv}*1?X߶i{#_\Y3Nmc} 6>|d)];__/9Գ -3%OlOI' 3d,mB=E;bW8{; -,g_^U*IltBtl x( $/g :{'iv6l`gv;8hûCQO)͠s'I=. \x)9)#+yJ9ۉxs'5ۆ Tx>)3tSI/ WB)t~-vk~ƻFvNZMsEp]z>Dk;ddI8,ybi|ENbWVf{crVրco5(Xe1/sSG j+GYvꎣ7b%8pTȊ*J3LJY–ٲ_h9 -ukTz.?.7i<%oD,!`R8\)`. .jȥHB@H1%폎@TXb/&f:.cK4#1wsb=8|LfҖxxCCxt $2N(mt 5&j0T?CpmG2aEh9K(U/0q&{@AkX = =Y&zfͺ uЭ>HV^iPfPwމЋlxH9,4ٲ5f` ,x808!qM٠)]I l"10BTI##P$Ccba܍2Sc5#&F&G;Τ-gҖH#D >[3F5b( Ab${izз9&l^}p"F;b2!{asE -D&x#8j$,byb!p,dLY]ّ!1CHlp\q .U%NLH-Rdch -^@D3Hvgxq|Dp*жhcHu}67jʌ -?R#3I3< PS,> ؞Eq\=-R'6;9IAzɆٜI6|XdA,@W־+Y?[ړC iBF-(ӊ -A[(oq@j ȡ^s8j$,AE$h~?Xhڊ>ǁ-•a0|!St+R)5D@*zmahCFnlV7qm͐pnyQњ+{O#Ok R>5y]Nbs0 ;P^84~EJcil)%dtUY#Wq€rFtGz](9dj_8`]భKJ7HKwsؗ1TT..(rۮѵ}4f>z{ϟࣵLAϻsƌzfzkfL(քC ~h?j}CJ3E%/c_TVJ*pT_xEy\_^Hڨ;Wi YA"ҭ[l!Iv^يR9$Vd2nqy>=/<y;s+Nw $ ӟmWy0\*c<0gלuN@B! +G[Yu?R|^rrH/坑,~$K]Kn`l=Z5[7q|gUnr"~F8ߛ-cY đ\ೖ-K1Es)`[>zyH]PF(볫ܤ;dqFV Lk-zPߔJK{wWy~P'C8d,ߴ. :J@7 dzqF@` V" 6X ##  ZeWŔԃN~a~qfu#E".lйy.?Xϊ ;m HK=`(tu4G!gn_:^!B@zhCLZ8l$@ -+ @ e!OAx C8~ⷎNs]=/I֣3ѡM*{q6ljK~!}9Ym!!_7Hlް(Qppj`0GXs,D`+/xGF@ҚSШ -s=t##URuMT?|zq+[:sMnִ䂹33o\P7.B *OEtO1o,N4GO\ٞ~pc݌)GR0XQAl(f4 M)h@<׹L"]NJYsr,'%hݹv - ݆/U)|JnPW -x kFEQ`0|=t[ 1x}fpc3A&ŽpJ ~ 7%1,۰PRND,^HU0uf>7웻ñ]zQZVq6 S d`0XA#GVJ[(9 -RWvHo^0x3 bx -p`+gQ(^1ױ>9ږ騬*^x#qb ,Y2aHwcVMOb/f=-ȁ/} - `=瀾}k) -4`" C!)p3:mu@XoQv ngn3w:s+*qBV- M$NreO{}v R` 83JyMO4)XZGyQj{DM {_πY ̸Ӻ|)weUefᨈ.A]]dciI~\w<8/t Pg+e >*7E`S# 3\GHpχHn aKS[K 5uk;mɶcVރ iEHD_+߾U\'9GVXJ¬9M<~̨փI+qijL9%A0pcF"((`77Q#'q h[:-H,n#*Z_YXO -=Vy!pLYzY*K;x2}{"w7er"Iw:GSy\V[<6'Rչn%:溬'5mDtbZL\&$ -ܾ~vן{}߻<%E&gINDHJ"NƄdD] Q!c@ -d *>7 8PW% \ h`3^l:93cM|;egA :܂8XJ[7XI|0|N7w[{EkvcJȬi%J-Q#u|FBѵ<~ԠVTw|_JvV{J,͓ɯ)l/` R|Vxfm 96pL1c3Y0ߜ,/NP[@Qt+eKTe9ۏ-p -Ȯ|BpW$ %IHO޿y:~0?_(gD,rE}KcШ+)J_*=I,?!4l=Å[Pծ=Ğ [ }g OZO$o!xL=5dbBC) Oմ>RIr\r"#;@V2[kclzi5a#*Xm?;62.#:ĉ֙Li_8L+ -endstream endobj 265 0 obj <> endobj 293 0 obj <> endobj 294 0 obj <>stream -%!PS-Adobe-3.0 -%%Creator: Adobe Illustrator(R) 17.0 -%%AI8_CreatorVersion: 22.1.0 -%%For: (Patti Short) () -%%Title: (load-any-start-page-let-users-make-changes.ai) -%%CreationDate: 7/22/2018 3:12 PM -%%Canvassize: 16383 -%%BoundingBox: 24 -1106 746 -47 -%%HiResBoundingBox: 24.4402151107743 -1105.55978488922 745.475070788551 -47.4402151107788 -%%DocumentProcessColors: Cyan Magenta Yellow Black -%AI5_FileFormat 13.0 -%AI12_BuildNumber: 312 -%AI3_ColorUsage: Color -%AI7_ImageSettings: 0 -%%DocumentCustomColors: (ms-blue-dark) -%%RGBCustomColor: 0 0.470588237047195 0.843137264251709 (ms-blue-dark) -%%CMYKProcessColor: 0.741359531879425 0.674891233444214 0.66359955072403 0.859128654003143 (R=10 G=10 B=10) -%%+ 1 1 1 1 ([Registration]) -%AI3_Cropmarks: 24.9999999999955 -1105 744.915285899329 -48 -%AI3_TemplateBox: 396.5 -612.5 396.5 -612.5 -%AI3_TileBox: 90.9576429496628 -960.5 678.957642949663 -192.5 -%AI3_DocumentPreview: None -%AI5_ArtSize: 14400 14400 -%AI5_RulerUnits: 0 -%AI9_ColorModel: 2 -%AI5_ArtFlags: 0 0 0 1 0 0 1 0 0 -%AI5_TargetResolution: 800 -%AI5_NumLayers: 1 -%AI17_Begin_Content_if_version_gt:17 1 -%AI9_OpenToView: -372 -44 1 1544 914 18 1 0 1998 154 0 0 0 1 1 0 1 1 0 1 -%AI17_Alternate_Content -%AI9_OpenToView: -372 -44 1 1544 914 18 1 0 1998 154 0 0 0 1 1 0 1 1 0 1 -%AI17_End_Versioned_Content -%AI5_OpenViewLayers: 7 -%%PageOrigin:90 -1008 -%AI7_GridSettings: 72 8 72 8 1 0 0.800000011920929 0.800000011920929 0.800000011920929 0.899999976158142 0.899999976158142 0.899999976158142 -%AI9_Flatten: 1 -%AI12_CMSettings: 00.MS -%%EndComments - -endstream endobj 295 0 obj <>stream -%%BoundingBox: 24 -1106 746 -47 -%%HiResBoundingBox: 24.4402151107743 -1105.55978488922 745.475070788551 -47.4402151107788 -%AI7_Thumbnail: 88 128 8 -%%BeginData: 9839 Hex Bytes -%0000330000660000990000CC0033000033330033660033990033CC0033FF -%0066000066330066660066990066CC0066FF009900009933009966009999 -%0099CC0099FF00CC0000CC3300CC6600CC9900CCCC00CCFF00FF3300FF66 -%00FF9900FFCC3300003300333300663300993300CC3300FF333300333333 -%3333663333993333CC3333FF3366003366333366663366993366CC3366FF -%3399003399333399663399993399CC3399FF33CC0033CC3333CC6633CC99 -%33CCCC33CCFF33FF0033FF3333FF6633FF9933FFCC33FFFF660000660033 -%6600666600996600CC6600FF6633006633336633666633996633CC6633FF -%6666006666336666666666996666CC6666FF669900669933669966669999 -%6699CC6699FF66CC0066CC3366CC6666CC9966CCCC66CCFF66FF0066FF33 -%66FF6666FF9966FFCC66FFFF9900009900339900669900999900CC9900FF -%9933009933339933669933999933CC9933FF996600996633996666996699 -%9966CC9966FF9999009999339999669999999999CC9999FF99CC0099CC33 -%99CC6699CC9999CCCC99CCFF99FF0099FF3399FF6699FF9999FFCC99FFFF -%CC0000CC0033CC0066CC0099CC00CCCC00FFCC3300CC3333CC3366CC3399 -%CC33CCCC33FFCC6600CC6633CC6666CC6699CC66CCCC66FFCC9900CC9933 -%CC9966CC9999CC99CCCC99FFCCCC00CCCC33CCCC66CCCC99CCCCCCCCCCFF -%CCFF00CCFF33CCFF66CCFF99CCFFCCCCFFFFFF0033FF0066FF0099FF00CC -%FF3300FF3333FF3366FF3399FF33CCFF33FFFF6600FF6633FF6666FF6699 -%FF66CCFF66FFFF9900FF9933FF9966FF9999FF99CCFF99FFFFCC00FFCC33 -%FFCC66FFCC99FFCCCCFFCCFFFFFF33FFFF66FFFF99FFFFCC110000001100 -%000011111111220000002200000022222222440000004400000044444444 -%550000005500000055555555770000007700000077777777880000008800 -%000088888888AA000000AA000000AAAAAAAABB000000BB000000BBBBBBBB -%DD000000DD000000DDDDDDDDEE000000EE000000EEEEEEEE0000000000FF -%00FF0000FFFFFF0000FF00FFFFFF00FFFFFF -%524C45FD58FFA8FDAFFFA8FD55FFA8FD06FFA9FD07FFA9FD23FF84FD0BFF -%A9FD05FFA9FD18FF7EA9A885A8A984A95AA9FFA9A8847EFFA9FFA8A95AA9 -%84A97E5AA8FF7EA9A8A9A87EA8A9A8FF84A9848484857E5AA8A97EA9A8A9 -%7EA984A95A84FFFFA88484A97EA9A884A8FD13FFA9FFA984A97E5A7EA9A8 -%FF7E5A7E857E85FFA97E85A97E5AA97EFF84A97EA95A85A85A5A85FF85A8 -%85A95A7E857E8584A97EAF5A855A7E7EA984FF84A97EA95A857E8584A9FD -%0FFFA8FFFFFFFD067E5A7E5AA9A85A54A9A8847EFF847E7E7E5A5AFF85A8 -%A95A855A5A7E7E5A7E7EFF7E845A847EAF7EA97E845A845A5AA87E7E845A -%A9FF7E5A7E7E7EA8A97E7E7EFD14FFA9FFA9FD07FFA9FFFFFF7EFD0BFFA8 -%A9FFFFFFA95AAFFD04FFA9FFAFFD05FF7E85FD0AFFAFFD06FFA95AFD10FF -%A8FD05FFA9FD11FFA8FD09FFA9FFAFFD0FFFA9FD11FFA9FD16FF5AA9FD05 -%FF7E7EFFA9FD05FFA9FFA984A8A9FFFFFFAFA8FF7E8584FD05FFA9FD2EFF -%A8FFFFFF7EFFFF855A7E5A7E5AA97E7E5AAF7E7E5A5AA8FF84A95AA95A7E -%5A5AFF845AA95A7E5A7E7E5A5AA9FD2AFFA8FD05FFA984FF7EA95AFF7EA9 -%7E85A97E7E8584855AFFFFA97EA9845A7EFF84FF7EFFA97E54FF7E7E7E85 -%84FD31FF847EA97EA9A8A9A8AF7E5A7E847EFFA885FFFF7EA97EA97EA9A9 -%A9FFA9FFAF7EA95A7EA8A984A9FD3AFFA97EFD16FFA9A8FD30FFA8FDAFFF -%A8FD61FFA9305A84FD04FFA8FD04FFA8FD07FFA8FD09FFA8FD07FFA8FFA8 -%A8FD08FFA8FFA8FD18FFA8FD09FF0D5A2F0EA8FFFF7D527D5276274B527D -%767D527D7D7652525276527D52522752527D527D527D52277D7D5252527D -%52A17D52275227527DFD15FFA8FD0AFFA9365A850DA9FFFF7D7DFD065227 -%52525227A8525227522752767DFD06524B524B5252A876524B52272752A8 -%27FD04527DFD21FF2F36305AA9FFFFFFA8A8A8FFA8FF527DA8FD04FFA8A8 -%7DFFFFA8FFA8FFCAFFA8FFA8A8A8FFA8FFA8FFA8A87D52A8FFFFFFA8FFA8 -%FFA8FD22FF7E85FD22FFA9FD28FFA8FD0BFFCFFD04FF7D27FD04527D2776 -%527D52A87DA82F7E5A7E7E845A7E2F5A5A5A7E7E547EFD39FFA87D7D7D52 -%52A2A87DA87D7DA87DA8A9848584A984857EA95A5A7EA9848584FD28FFA8 -%FD13FFA8FFA8FFFFFFA9FFA8FD0DFFA9FD3EFF7D525252277D7DA85A5A5A -%7E5A5AFD39FFA8FD10FFA852FD047DA17DA97E845A847EFD37FFA8FDC4FF -%A8FD44FFA8FD0BFFA8FD05FFA8A87DFFFFA87DFFA8FFFD0DA8FFFD09A8FD -%38FFA8A8FFFF7DA8537D7DA85252527D7D847DA87D7D527D7DA87D7D527D -%525252A8FD25FFA8FD12FFA884FFFFFFA8A8A8FFA8FFA8FFA8FFA9FFA8FF -%A8FFA8FFA8FFA8FFA884A8FFA8FD38FFA9A9FD43FFA8FD11FFA9FD06FFFD -%05A87DA8A8AF7E84A8A97E85A8A9A8FFA8847E85A8A984A9A9A97EA97EA9 -%84A97E84A8A9A8A9FD05A8FFA8A8A8FFA8A8A8FD07FFA8FD1AFF7DFF5252 -%7DA8537D7D7E5A5A5A7E305A7E855A7E5A5A307E545A7E855AA97E5A305A -%7E855A7E305A5A84527D7DA853A852A87D5252A8FD23FFA8FFA8FFA8FFFF -%FFA8FFA8AFA8FFA9FFA8FFA9FFA8FFA9FFA8FFA9FFAFFFA9A9A9FFFFFFA8 -%85A9AFA8A8A8FFA8A8FFFFA8FFA8FFA8FD24FFFD067DA87D537DFD33FFA8 -%FD0BFFA8FD0DFFA87E7DA8A87D52A87D7D7DFD52FFAFFD38FFA8FD70FF7D -%FFA8A87DA8A8FFFD05A8FFA8FFA8FFA87DA8FFA9A9A8FF7E85A9FFA9AFA8 -%A9A9AFA8FFA9857EFFA9AFA8AF8485A8A984A9A8FD0AFFA8FD17FFA87DA8 -%7D2752277D7D7D5252537D277D7D7D52A852525385545A545A0D5A2F5A54 -%845A5A2F5A5A842F5A5A7E545A2F5A5A7E535A2F365AFD07FFA8FD1AFFA8 -%FFFFFFA8FFA9FFFFFFA8FFA8A8FD0AFFA9FFFFA97EFD05FFA8FD05FFA9FF -%FFFFA9FFFFFFAFFFAF85A8FD25FF842F5A545AA8FD057DA8FD4CFFA88584 -%857EA87DA87DA859A8FD31FFA8FD0BFFA8FD13FFA8FD52FFA8FD0BFFA9FF -%FFFFAFFD0DFFA9FFA9FFFFFFAFFD18FFA8FD18FF7DA87D527D527D52A853 -%7D52A9547E5A5A307E5A855A7EFD055A7E5AA95A7E7E5A5A7E5A7E547E5A -%7E2FA97D7E527D7DA8FD25FF7DFFA8A87DA87D7DA8A87E7DA88584855A85 -%848584857EA97E7F7E857EA9A984A8A97E7E7EA9A8A95A5A7E7E7E7DA8FD -%047DFD0CFFA8FD41FFA8FFFFFFA8FFFFFFA8FD0BFFA8FDFCFFFD0DFFA8FD -%0BFFA8FD07FFA9FFFFFFA9FFFFFFA9FFFFFFA9FFFFFFA9FFFFFFA9FFFFFF -%A9FFFFFFA9FFFFFFA9FFFFFFA9FFFFFFA9FFFFFFA9FFFFFFA9FFFFFFA9FF -%FFFFA9FFFFFFA9FD5FFFA8FD0AFFA97EFD55FF7E30365AFD04FFA8FD04FF -%A8FD07FFA8FD05FFA8FD32FFA8FD08FFA90D5A5A0EA8FFFF7D527D527627 -%4B527D7D7D527D7D52527D52527D7D27527D7D52767DFD29FFA8FD0AFFA9 -%367E7E0DFFFFFF7D7DFD06522752525227FF5252275252A17D7D27522727 -%2752FD35FF7E5A2F84FD04FFA8FFA8FFA8FF527DA8FFA8FFFD05A8FFA8FF -%FFFF5252A8FFA8FD36FFA8FD4CFFA8FD0BFFCFFD04FF7D52765252527D27 -%76527D52A87DA85A7E5A7E7EA9FD43FFA8A17D7D5276A8A87DA87D7DA87D -%A8A97EA97E7FA9FD32FFA8FD10FFA8FD057DFFFFFF84A97EAFAFFD05FFA8 -%FD44FFFD0452277D7D7D845A7E7E3085FD39FFA8FD11FFA8CAA8FFA8FFA8 -%FFA8FFFFA984FD37FFA8FDC4FFA8A8A8FD09FFAFFD38FFA8FD0BFFA8FD06 -%FFA87DA8A8FF5A5A7E5A537E5A5A54A9FD4AFFA8A8FFFFAF7EA97E857E7E -%7E85A9FD36FFA8FD13FF5A7EFFFFCAFFA8A8A1A87DA87DA87DA87DA17DA8 -%A8A87DA87DFFFFFFA8A87DA8A1A87DA87DA87DA87DA87D527DA8A87D7DFD -%2BFFA85252272727522752525227524BFD0552275252FF76522727275227 -%52525227525252275227522752275276FD12FFA8FD19FFA8A87DA1A8FFA8 -%A8A8FFFD07A8FFA8FFFFFFA8A87D7DFD07A8FFA8A87DFD04A8FFA8FD11FF -%A8FDCCFFA9FD3CFFA8FD0BFFA8FD04FF8454FD055A7E855A5A2F847E7E7E -%5A5A5A54A9FD43FFA9A97EA97E857EA9A9A98485A9A984FF7E857E85A9FD -%32FFA8FD10FFA87DFFA8A8A9A87DFFA8A8A8FFA8A9FD05A8FFFD07A87D7D -%FFFD04A87DFD04A8A97DA8FFFFA8A8A87DA8A9AFFFA8A8A8FFA8A87DFD04 -%A8FD18FFFD047D52A87D527DA8527D7E7D527D52A87D7D84527D7D52A852 -%7D52527DA852A87D52527D7D7D527D7DA8597D52A8527D7DA87D7D527D52 -%7D7D5952FD047DFD06FFA8FD12FFA8A8FFA8FFA8A8FFA8A8FFA8FFA8FFA8 -%FFA8FFA8A8A8FFA8FFA8FFA8FFFFFFA8FFA8FFA8FFA8FFA8FFA8FFA8FFFF -%FFA8FFFFFFFD05A8FFA8FFA8FFA8FD05FFA8FD12FFA87D527D7DFFA87D52 -%7E7DA8FD057DA87D847DA852A8A8FD047D7E7DA87D7E7D847E7D7DA8A8FD -%067D84A8A859FD047DA8527D7DA87D84FD1AFFA87D7E7D7E7DA87DA87DA8 -%A8A87DA87D7DFD04A87DA8A8A87DA87DA87DA8A87E7D7D84A87DA87EA87D -%A87D847DA8A8FD047DA87DA8A8FD067DFD1BFFA87DFFA8FFA8A8FFA8A8FF -%FFFFA8A8FFFFA8FFA8A8A8FFA8FFFD04A87DFD28FFA8FD0BFFA8FD04FF7D -%2752287D7D7D537E7D7D52A8525227A87D7D527D7D52527D527D7D7D5252 -%7DFD47FFA9A8FFA8FFFFFF7DFFFFFFA8FFA8FD2AFFA8FDAFFFA8FD11FFA8 -%FFFFFFA8FFA8FD07FFA9FFA8FFFFFFA8FD2FFFA8FD12FF7E5A5A855AA95A -%5A5A855A7E5A85848554A97E7E5A855AA9847E5A5A5A7F5AAFFD38FFA97E -%847EA9A88584845A857E7E5AA9A87EA8857E5A5A84A8A95A855A7E5A7EA8 -%FD38FFA8A87DFFA8FFA8FFA8FFA8A9A8A87DA8A8A87DFFA8A8A8FFA884A8 -%FFFD05A8FFA8FFA8A87DFFA8A8A8AF7DA87DA8A8FFA8A87DA87DFFA8FFA8 -%A8A8FD0AFFA8FD0BFFA8FD04FF7D277D527D7D7D527D7D7D527D2752597D -%7D7D527D7D7D527DFD0552A87DFD0452A85252527D5252527D7D7D527D27 -%7D7D527D527D7D527D537D7DFD1CFFA8FFFFFFA8FD07FFA8FD07FFA8FFFF -%FF7DA8FD04FFA8FFFFFFA8FFFFFFA8FD05FFA8FFA8A8FD04FFA8FFA8FFA8 -%FFA8FD0AFFA8FD10FFA8525252FF7D7D7DA87D7D527D7DA87D7D527D7D7D -%537DA8A87D7D7DA87D7DA8A8527D527D52A87D527DA87DA8527D527D7D7E -%52A8527D52FD077DA8FD18FFA8A87DA8A8A87D7DA8A87DA87DA8A8A87DA8 -%7DA8A8A87DA884A87DA97DA87DFD05A87DA8A8A87DA8A8A87EA8A8A852FD -%05A87DA8A8FFA8A852A87DFD08FFA8FD11FFFD05A8FF7DFD04A8FFA8A8A8 -%FFFD04A87DFD05A87DA8A8AFA8A97DFD07A87DA87E7EA8FFA8A8A8FFA8A8 -%7DFFA8FFA8FFA8A8A8FD07FFA8FD12FF7D7D537D7D7DA8597D7DA8A8527D -%7D7D52A8527D847D527D7DA87D5252FD047D527DA8527D527D7D52527D52 -%A8527D7DA853A8527D527D7D7D52FD047DFD19FFA8A8FFFFA87EFFFFFFA8 -%FFA8FFFFFF7EA8FD04FFA8FD07FFA8FFA8FFA8FFFFFFA8A8A8FFAFFFFFFF -%A8A8A8FFA8A8FFFFA8FFA8AF7EFFA8FFA8FD1AFFA8A8A8FFA8FFFFFFA8A8 -%A8FFA8FFA8FF84A8A8A9A8FFA8A8A8FFA8A9FFA884FFA8FF7DAFA8FFA8FF -%A8FF7DA8A8FD1AFFA8FD0BFFA8FD04FF7D277D527D52A8527D527D5252FD -%047D277D7D7D5252277D5252527D527D527D7D7DFD04527D7D7D52527D7D -%FD2CFFAFFFA9FFA8FF7EFFA8FFFFFF7DFD05FFA8FFFFFF7DA8A8FD09FF7D -%FFFFFFA8FFA8FFA8FD1AFFA8FDAFFFA8FD11FFA8FFFFFFA8FFFFFFA8FFFF -%FFA8FFFFFFA8FFFFFFA8FFFFFFA8FFFFFFA8FFFFFFA8FFFFFFA8FFFFFFA8 -%FFFFFFA8FFFFFFA8FFFFFFA8FFFFFFA8FFFFFFA8FFFFFFA8FFFFFFA8FDBC -%FF5A7EA9FD4AFFA8FD09FF2F362F5AA9FFFFFF7DFFA8FFFFCAA8FFFFFFA8 -%FFFFFFA8FFA8FD08FFFD04A8FD05FFA8FD2CFFA9365AA90EA9FFFFA85252 -%527D7D5252527D7D7DA87D7D52767D527D767D52A1A87D4B7D5252527D52 -%7D7D52527D767D527DFD1DFFA8FD09FF2F5A3036A9FFFFA8525227522752 -%272727A84B5227524B524B5227272752527D2752A85227272752767D524B -%2727F82752FD27FFAF5A5AA8FD04FFA8FFFFA8FFA8FD04FFA8A8FFA8FFA8 -%CAA8FD09FFA8FFA8FFA8FFFFFFA8A852FFA8FD1EFFA8FD11FFA8FD05FFA8 -%FFA8FD05FFA9FFFFFFA9FFFFFFA9FD2DFFA8FD12FFA852527D7D527D7D52 -%52527D7DA87D7F5A855A5A5A855A85FD41FF52A17D7D27A1A87D527D527D -%7DA1A8845A857EA97E85A8FD50FF84AFFFFFA9A97EFFA9AFA8AFA9AF84FF -%84FFA8AFA9A9A8FFA9A9A8FFA9A97EA984A9A8FD14FFA8FD0BFFA8FD13FF -%5A5A7E845A5A547E2F5A7E5A5A855A5A547E7E5A2F5A5A5A7E5A5A7E5A5A -%5A7E2F5A5A7EFD27FFA8FD0DFFAFFD04FFAFA8A9AFFD05FFA9FFFFAFA9FF -%84FD09FFA9FFAFFD16FFA8FD10FFA827FD0452A876AF5AFD4EFFA8FD057D -%A87DFFA9FD3DFFA8FD55FFA8FDFCFFFD0DFFA8FFA8FFA8FFA8FFA8FFA8FF -%A8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FF -%A8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FF -%A8FFA8FFA8FFA8FFA8FFA8FFA8FFA8FF -%%EndData - -endstream endobj 296 0 obj <>stream -fW}CZrĵ/F}OdKzKX},n?~ġ.~)8 ץ]lz'zkzU#?l _Fiã*jJ=cG|?f(~d h, pr3>v[p즅vQ4&qݙ+,KūxŨ6݇ڰ]w/Ϗ|~i!FhPB۫Vڛe(Nl3VJ v%6ɶ ]7c -԰ (!*~ƥ\rrsu|زfAќ,1|bҶpU틣ړCa][V!LU-&?l3 -Ta@K/+ޝa^U=[T RU4'Mq賍qw?޴ՕVL]YQ -SE5]o3, w8ܲ4}An;pƔ53n"3j_]nj?׌b"4q9"AheԈ>f YZL=ǩz0.Ⲳ9z^V+> ʋG`_)0#k#5+z{s)fRɪRg~hzє>~[ᡕRpɻk{`S"kͻmׯ -wsAaQVbmbuuMԎ 6xu#`ۀHV!Y[6h uҴi͛#"fPC.i|acgӓچp 쪧劚Q6^HJCP~RRT[ͽ@7*zy8;H3/Lu2W+Jd¦n-6KlBb]Tо -; AM >U/èsBźPlY!d; {HzXB@C*Yq^6ejVѭy&%lJd캇UtQM;9ӅBs.|5%<-$ -:m5!ќ_ ǔXikMQ[:a -PԮӚ9fO0=4 W+.BFEb &\tr/U쓷 !dK_K՛!hY/;bO]$=A Q|oVȴ~Ǎ21AlZ\5{/g+s3KLO[y@t_\5vjT'G4XW/$m¥.[8 *`:{9Wd>i|ixdqϴ*>)Nr͚RSlȬ5#\m=O{`3J 6뢿Ɏ sռZАh/n"4nE_I>bDZ3d?$-/d ޮ_x8ޏȊ:~ lÆ,00bYm|)iuĮ YyE۰pAՐ]m׶BcW-+tۅwQ0>h%/i+6/b.YV7Q? 4DLkX*r"Z65;]_=Yκ&6>ztvڋJ#cj þ{=#0x3--mUݐvB̽Eee_43 -/ae/7'FEOLǴ'i|Lw ,iE[RWDAuAplljY7E!kG5{C@@7m;"jYTE-kcFp;#L*SE̹G9[1FѶ u]G@kvTQ\с[R -6GhMvt񁏂` ?O0H#-7jxoЀ/ %!`a0ܵxm;b`!Q%mVKι$`1+ZFV 䖛 -6Tš W2rd-fg94ء;c|\چ޷S;CszYiͣm*IR!6bٲ;Uǐ bMϓ,ƶg}Y0 Դle4.iI+FRɷݖEݟrLLz~Lp_Y&giG}NubS'YzqLXt9b~<ޏkiz8/vR$W«o X̫`_'-~>wG0k6B |m;c<ڪZj/1ɓ5*b)<8),ﶉ^|K "D[mH/6nÉnTwVŧ??LJ~X&r_.nٓ6Ї@76.GBxvˀW=*^Nw:愻Yq3tC_{5wMը«w'K¯e>Vq^]ɬwCn@#8sVX)qNV3n}''ZpLԘ?'*W2ʹ)VV;)\>XR6[W; dc!H|Hs/1pڎ:fآ53 -@$q|ݏIqŀ8E,cFkj|y)΂D.ɱIZrYɮXrV"¢Y$.0IM@Eq#< N}2iYVA7gw ACSܼ̆q8G [. ԾmIjD|EsCq*G{hFYA׍G03<yC? \Kpq6뫟c}4LB(XΏ)I&nN,^EF5vGp%6 !-E+ȹnyY󥡺y+_w9lB/!'4AEӛ5"g -Kyֿ6X3@l"L}+-lxuA#bx.~kFژѣ<4I7J\ -#碞sN7WKI*renѧ㔌c70oN?%GV_G$ǜU21_#Ğ!cĦ\uh nis"Ͻ9_}h~@ӻK6zAT.YOW]1r/[J^Ğ"PU=CCzGHܖꓖuK\:EQ+_JP.>/m~೗^w36αlEyW59%!kͩfIK 5p ,*k1gwѭɮ닃[vb4;}>.!#.+ \BVٸ}dYmf-C"k%މxeLHMh%_8w]1O~le6W*.x5w)oO۔M<؜ILbc;ZG=~yQOcM3j^rHꅠ++F\ͦ1f^VvӒwQ=wZH}.|bZܔU%Oq/Or}:ka7>0^gF߱ 2mym?ZwJÝ=Xp󳴜?T7I i> ~?9)}rlZ\\*~}nCn[894O3=1 !b5y3'ÿso4ҮQjvU>& љ˙/<+E=eWaϠR_s}rY?&o>.{Cm9E]ҿyY/YoӝY7U,>p`iOyϖTAHTHHٶc\}3&cj -u~u y -hDⒻFz59 ?S>{>A0Z養hP읭j(h8m`Lj>t+&wes+1T{΃='p0vˉ/O;>JsЈkxRC -_պݴrNby4u@>su8R@ S,1 -48B@5hn0)kФK=MQW&p oxf`$LЬ]`dTq_'-{$ hݰ5yY!{L-[+G~X1j=P-(A\AokV?ZUcʇ:Rޘn5`r\}i%9M~b1ج952uY/\1Wm̊>`PoDtoՃy[5)]q+hVŨ"PE4zmSuRKYRjy2uՈ6՜8sʪ3/ @/"=Z3a*fevt9ٙ=-ZlQD-n ĨClWSws=LHΫ31nوYt,_r ;ow>cs =9Y(_1ӯZ01gt>#CF6ȅG)=S8!SKWͼ{N:ݲjd.鈅KirIӦ[.‮!XZ,4\j]O2+ڛS΍^/ ?Mw?=gm9#~jR685bՉ+Z2f#V=xՁΟգgt~yF0Ҫ7m -b1WZ#Y/<їY=vB,XsԴe 4ދ|SCZlxݜ.}Oԧ͍QGa&ȨAd졟I ķ)ٰsƈ&)`BT5+oxCM]@8YȣܫG=W]֬۸ddM̆=zJyoG_0qAcm[^>(rͧY!3.7'n0[N -~9&D%=" #,ɹ3Ä19yr^1ՔBg݂`FhUJlҼq'^ukV@IMG>vRM 99(0,`; 'd_RȀ-Y5b7PIi h%[-G}=kc--Ý8ZcF$ugh菣{mS6M5360 -u!h{n&UϭLY &pvME=o"C@,Y1s!KZf)ߋKq%#oV0@c|AC[52Ӱ9"\r6iIqɻC2od0jQ@-Տ'^\E`6"o8Do/8ao]}u&YǪ>|hHP^qU摱_fu_g[~yr6%m;Q^bT5)?Й>xύ-r_M bՄ/EiM;Se'q1^pB$-WINFY4=1Es*je ^q.8dW٩h5V႞YPruR6g`C,my{hFǭQ >~mU4Km4Ȯ8lD[G5N6_榁|l=kgLM[qzFq9*o) /HoXMek[Zm_toRй#BWZONL>hU}tXͶ~}Y B_+U,脰M۴X42懠>H츤9bNkv!cw{{TXZF>d"̨9U3w'͔4MUkdãlzkvJѼ4e -7}.2;^u+d>Ժ))h. hhEQ#k'ݤZhb=ȉ|B@쏙\e'psk.vFϞ&j:[١mut0p{L8'[ F.$rZ-xK:Fps#gA8mx֎nzQt٪ n (_jyԂ!Jم99'0;L^9۫ͶR V9;D -0oT$Wbgl.5 ы6!)dR| -s͟5+ dV-…H@%l.j?lZ hMW=BXr1 eySrbʼ\LthCR}!8m 16nJO)Xs[s 8%3u1oc' ~L8e~],mM6Fy@}k+lδn͵vDSPä\(&@mW=o fj톇Y #Ԛ -MQʆ57-  7oj:ACvr{Bb1gez|eu`kUd,e'~uC\ Gg`S`4Ԍaa_P t`<ֶ]5r~aA: -Vr2#{0)$C@ҋ|rV[N*U\Pֺj}+QvtOxV} -G%^lAH_6˗ 0Nj{(>u;ԯ,Zp3gmgܦQ)"~v0&t_qd- u6fH'\0u2g%SՇq"h@YsɹjZqMrV?L͝36ڔkiկ.nɄmƩaR8ͷ"Q }GE,KVL亳uABvpR mYU;d%^s+f/EZp[n6iACkL6>H'[z6\jhZA3p^OX=9bmXԜ;64@G\{(ycɪ,46 w@кCltZǨ( |]̙4u-W\iC_Q]5ڝ:($vVZx}̒ud`93ֿ3% z谍 &n{Jڙv:[S ڂ1o@=Ҥ]짧8 ~%>mᐇ^r`z>zk\$ٛmMVmG ŋv&2mzq6iՅ/ENаbզ_br vն_ع3-hø9~{F:\duzĵQ{gE;.lݙ$6W;؋pqn#rE^NHasJ}TM7^:I3a[5,w!XUKv>rJ~V@(u -F&+t:e=`sooYfzu,}I$Z,E.9 ^j!7CG-2Vo|E,}k\Ɓ7R+W)ŭZ!$h`=,T`R3-:}?-nY̕Q.qwN]7 4TdSnYB -]e]8ZH!Lʈ9֣ݘ۝lO]_݇ tr - v9 .c>em3R $Q gGD)gi[6#F[XxGMtq\\/.+ HJ># %w[Zޛ.2ޓmh,ZQk~׼h'2 Ir=L&J!|굌N0L6UC]Cխ~5C2,/^LG\SS֜}C[cS%[e^\&u`{[#ߴ0li]&ۚI* _. _gk BŌV6ʅק,+$ -G">x5qs)YEq^:zYv<!+rZ>6@ruMt)W^;o:/؟vfSݖoଫKviC8y=3X?{Q黥iZy'`V;T%G.i"RF^0˙ bP0ǡ>2 ,>(̣rF7#~+%QÍ8do,̖Kr+',FWvI}{* (>I 9«*r0V.g$O?{{Nl,ȸ _UbGZ~F%eXUuZ.:Q0|!UKN效~)=Euإ)aWnd.{ 6u{:{fl\K+ )ݭ}sp6ފI zd|既2ř|>QZ6p,2}ڰḰr&u^L!i:AJ}PPRp"g[Xv -<|lO铢cW.G=2獒'ݽzAyS*'UWS-}.mR+ltjtFU:]5]0d+$ZԻ3?RH̻+oaW-"ܼЫ夎>S C<4&d*~$O̠69拢_zA^xj؃7+wR'DsEpk˶( r(VDt832鼘hhX\xZ԰5a׺|0Dܱo?WT / -rlřH|^^+(&w2q׋ ?KNԜV= :)sl72~mJFQvG3`̒qS]=4i I*ݩob.סGo4"n4JNF'rNdu>vZrؓϫ.^O;=8 WJ< "V G5\kcq5_/>Ÿz},>]x<)Cӛ(O{yZD,%ڃ򰧱cUYu4.Sو<&Qt{LV`{,ھRD@ {u`݅γ/߁O\Wvֳ{ a^ԇƟx<>[z"tJkw V;>,31rB\H+^[|b6|[=.}Qc" a4}\`6,w*:},sۭYEaYoTL Sd\ -1^ 5*t2" N*΋:dzyezC-#[!JƘb|F3KW=5*3@,<;,@p*LkLd:"NTy7>HO hA+zGN;E&mYB,CG*/N ]I Y? $׋k`I4Р]D]4{c6XoSbȑ؀)7Sc=PsÂ1caW5]bԋDaX|T1t̲Ekg -C^y4Rz*X35ލzZyeByo]S%$ƃKgE|@K((ᑆލuKVj(`&G($vCف -IaZMSZs+HXر<Ʉ UHïB[r=Y \tK84lv ,־'SdO)pAI̊;i̻Y%0=iF0<2FV5PFsf9!ϯƧ3 -i__ E♊0uNmߍrqWqؓEƗ/xnQ53M=CctYIfޅ,Qoi4.*֒Ecq0Z -RvΜO ~5#S!1qKVe'-8Ve! Ojﲗ %?aB巒 9G'a/foՀ{qtF %豾7ֶ^(bT˫ԩIW2/ESgDYfZFY8* -?xTQ|PK[k)_P<ĺQ\ņ ť-.)6"C հ9 I%]bW%=GX@(wK;z%5`l:EAY K_smgvTSRiqwW(^BB%tHÓqHW{Dq=Iee{mGQGtCvfxpAgl]UTj&?&z=u]GP?4mjtY&m"ܲu^r57H]l+|#㽻3,a& -x3L=^u"Z2Z%E=-O12҉ܪV>qʽ2UY/$K8qɖ1L_Ww1A1X hƻGޮm~xjMuMEroS'e*bMBMʼysi׃Z[ɏfsgǻIa83ak֡j*tyY)|䚘>-u}mMxID6WGO}#)MբLC^ 3i[YYq4/i+kI6ѡ)kw8'mcL,.cTYz_Mz#*(@i Dnm$z]`SyG!agQߞԬ2 92TUlCߩӶ\ AIj[З\h幩*B{L=Z3OeGK:3ePi5q֣'Uy@XxQ>Yյ位BSCɦmu6il+&򚪷w],հZ!gs[A-0OϥmJkZ.lS.(7ȱ[SȨ%|IB8=&W+?)&sTHШlcjqt41l*ZJxaRI~񝱭bGquT0RYdm*nTz ;0.%-kZWRBY, 3җEc^TB/14̌_DmXP]8/63hQ6Uly@=W/5Zst,­ :ld[,YUrL*vSRm2&dGqi`i+q ^ö'(qG{Ej':fy~Dbwyλ(Hlj*8ӳ{3H41pO=[*\-f`GIƥW*KRna&%$lt?YnY>*hJYʂ -nnN -U<(JOyw{ abbZjR72ЇBfhmwn-b[ޝWKLvÀkA@>Z6ִۣEaCYwD' eMX뚫ٚX|oe̷>[kw.؊$f̺MU-<[ٝ"|~~d`TTб^z2_)؟JN=ypI.)= %:Y=\81,&- QreadJ7(S(XG5oŔAt]BIoVZs~(8-EQ"5+mR⊔T}嗓3䤭AٺKCRfB]OOZ&-eD]:7Iz#OG( ^$6vPiE~-uU*9:Y֥B${*Nc5}kc%yUr8ꝩBK=4"3~wCZ')3 0K~= ybrZSo8fY&QV)&.#&Zn%!'&[m"¯Z\gvȂ -jR݇՚ƭ lUWs%:'II\[K2e" )_3pѕ2Xz;`?͂ڳ.:MLgLOO?1 p`RSr3WVN%s$[Q'B㘂OAެblj!hVjmk2*ꊒyʣe.Ѫ`C+,lk$ho']d$>z 4ZsOs3>~c0evwЎz܅}5u33HK>d#eM{o? <͠IdzyrO)NWZPE[&`oӯ ݗ@Ct^Qmbt{h8*&Fo ^z9B{='pQ? Ęņ_?"F8ߐ}CW2Z %^9an)3>*|fjIIblHZt%eYf3ۧ0Ru>0Q{pa?l R54YOO㮭|SBșjjWN- ppIy5˜vn`63zg))!hZUąC%15}7\Ԗ{k9/9z&2AU3n&= '=ՔQb(>ޫ=jzhiz_=E؛ۦc y#JڧqYu n9d_LCW &XC) XtWFH)xe+rN@ÎҰ՞Gz!ϯ \oB¶ .)ottyxxuR%h9؝1宂ixPYuT]y!S'-Z俷gFBE ){ic RBOE-?P~5(5 -vHa!s׌%o`BbNuك rOr Ʃq`]GapKO4}#`½)>UEξq&kal⎘~f{@>%*t״d=TeG:ґ2Z+k;ù3nNjN];8,wcnGO1(66):4Rk kG<πDзZv))G >0,|j?8|EYYW+.^̻J#z )ѥ_ ]~hjNv}k_G R\ӐMT=PYpf띥w)Y.%5)#':$7ֱ }S¥iz?-CԌO4ukvíRy3H]^=;[ZoJe{##ĝX]=~SRb!.yAvAi?+* ~s>A+(")EG@owCl YWzot\RvCBKBh.*")K D%<  [үkb.pc/O@ZcR=S|kr"gF374d^="Dj~ޟ:&*M֙|OTfrGiȉ.nYh!0a]51`c4u?!^DeFxȱA{{utq?g:p^yWGF&.DN0&?"lY PG[-wCh#>kOx=᪲ݏCWUB˔ -kA'zU@BN_}'\S.Qn9>؜{HO/?2o v̷]4"厬߬"諽aLe&N{)k'.9pz6N 25kFEjjӮ,ue6}L20pc]]%3](dYhο/|4=6[LdυKsb>5 <7>ƈq~^EWݖ -nmaZK)+S/Z5c$ w}.xRhsi,x_MtNR\S+ɿY4K~1 -]x_,N15W$t@s"}gD&eD ].{Y|䕥,ŏ9W?e].ӑA%Ө  ,Y$>#v<26 6%CxTx11=ķA!*=2JܳgNbc{?d? -YBO\S#O 7EwsFh #ɹօz5H e\:UQ\@ms-i5~Ylμdju |o[5<@Gl ]]m*ׇx$;roO -y.ͷso4B.ᣮ-w@B6I1v-u"(9Ԙkryi5Ȅ R1V:[dhciu~ J#=\hhOO-}u.k#~^?mE8AI6@[oݷ >p[)L-ZV\~aO"z%QPӘ*rث C{mUSVlъ^@WSa'*ZwV ~ܟdM2s-s ŷL97W: -z#'7_[G-//j#_hJl$15CAh'I[ޛeHn Ƅ>A -?v";s[p 7품ua}bXȰx䅩ڒ8V@Qb5kr͵;&@_Ie bk 0J/$R,g6Wyw1SR-vs;)̼+䵔@&<̫$W2T|fMWDM!#}jZ?S/mg<+a'sn95\ EVP'$(%NAv=DYExB؞dQ+`ZvESۖ~Xbc{[po5ijD$Ԍ#drw'?L1.P~MKygYWs2hxwu@ͷ߱R-#uW-盽1b'U߆|܍ywڦqq\kq ;^н˟߂y/塖}En toF?6rc8"[F06$_\lޙu}2)']/m3"BXu3KH[mcΕn ЗһIL\O+9Vyf`O.@}UNٺz#I ^x^hǽ rnzTj/Z}x!_ۧI+-חnwn@uײβ.%8npN죅OWZc?pHI9#w)点eX9$ƄoL=F~#%,tļl[\U*ƣ!z3n.Y&Q0][v[_Gsfũ'p`OOAYFIRZځ ߟ&yiƉ#1)0h*!2F_j-)&su0+Þn}B:V99e.&F}̽c? %m,ɿaj)}b =mj/zRx۫8\'$H\l D+$L?Du1A)bkj9VS;ON)%P*썢:Z7={@]{}PYCvC$yee5Х:z :RSWl%親79զ %Y&P7JkN|ruqre}ek3=͇j֍ S7#_>~"g}jZ<6=.~ |w:P,g]е# %o7|m֔[o/؄AFEYu8UzcKъП)7T wMǥq&<<;.5ϾKYQ8T{/xCʀ8XizO݅Kno ^)?ƒtHI>+`? ,zkUhi肿CBI;`SU -kSJYLtEy6Pb0# q@8Yd׬!G W-RTޟu_tO2ߖ6YЀK3 O>:ߨ疲9?أBÄƦ%̨_Z3ɠNAQ3z&hבszJ23'l"%[!b>|WVQzʥug\iHbe1%o8%w4WAfRG΍qXyZWbKڕ!Ciz[-B{o9UuO*aB[ oLɘ!|GB=pv)%e xcM9LJ5Y km7 /wzQo2Fc??bgQ)DuhC59X{\\3Q&ﹶ曥:3r~5 wWXh-aCw{JXbJ8)6ҋBx)^>)٥< 6bV6V{TMdž:#=)*?J)yR_XLͽt8!3ELN`c-btms`oW1sح-::x6t q8Vt@:D(78 u.:/\_(!§IooX~6 ..d^>0rG|K.PS&1}GYXN˝q6Ur>%)2 -[>j塎YV 06[Yb:B]bDķE:«'Ye&ezKUSp][uç~%f-2 qgXP>-ff,~¿7B5uM,ϫ]CHSS -?sSUs=ejrZO͍[klcCL( Cbs݊J8]"皲.~1TuwDtu3>We^)l&`".4_\a7yѫgk%cN(~>es~ /Z6xFs%'8#-HMwLavF˟s.V2L*P5#/"3 "H.wH!@ا+rϗ -@;NaQLȱYtۇ}α#C=l=9PAL=TT`eAQk#ӹj]ʞ[o<)fTE3#:9SxH!5͡"3q>c~en..GZ\CZЕ~_ךzcη a]YQl,ڇ82z6PyfI7iLGFNjw ^PZd?[䤕ATp Kp=pǭtɨ;,ё~5xbܯg?\pIMz@e<@&to ES@)>e0*F񁉋sj)YN96:zlmo'B:@Me= 6b|챶>&' B򮘚 m!W )%ge]*Ps(pik9&vD|)i:[}ɧÎ*ൎY׬` @MYeV3GL)j 5:,'Je.0<ʣ` ϗx9. Ԓc˿; z7|zr,r^5SW|PsC}%CmίKkiش#mqnȽ|Yr8"9ڛG8g*R -~O@#R|`íIh! ] 4x_O#̢` t(~3 *bt:Q0_z.5C?1\WQtRGo'{+eGxtig"t*e?Ajj.7dE䅍>hJ}YUU6^CG2r.oR:.`SEjw=_s6jZOM|ο'g6Maa83t֞xl8uIr5Ԃ)Zk^V6x9[b`NW)e c-׫kbؤ;cE2dQ|ldCӄXgwSȰ޼'KwQ!QȂzT\K'YvF`oW:@ovɶI2hhjqqZj7|ciFJ^c%!tN#i- 29)#-2JTקڇx7-'k@E5O#.e% -(}S6taCWe.šֆq:-8,|_ -uϔ,v9\ԫ0HW'Gmaw J_K)e̱qd)fs@ڰJ'4@* h-%{g$b-zw}ì -YAu-#GqMlEUίvs-cuum𽉒gIKhbmfjkeoT8u.,QK,2sjЪ2oYZlU֜Y.-.۩(- -5>7xe& OMSM(~6+D9&11_eSC5m_J=SL`>= 4A@pYi^()ڨmchycj֡{\06 nwՐ-q3&Z[E;d}3{ 2\] -kθԜz&* jx +CT|rD`0$=}m/IBKŅζA_KO,k؞vmw viwi['ޏַ=9A"SS -D=[Z5LKhg|VK>^d:DRjte ># m}k: Mb< -B邀~$#Ct%gm֬;7>;*v١=]pRd@<%(<3޹3ĤyFms`_πwi*wn.ѭ(蹨q\_O)>_1:F:x4ֲrZ£ħ |S^5pk kPs}q/C",YJy~o>BX%G:"KɉZ.%#8$0)ZGX;Im,|;B(ERɉRGIz{Q |Ǻ+UCazna G@ K\ҡƧlW7}Y[ǩA*Њ~#kT%P\Ka> u Ғ~Tf47 x]5Rrk<oa\R',;ÀRS܁iD 1 - +㬴)AQ k.HG&'zB@ѳ%`me 4Sh<盹FMۑ -=zu[Fm B; o-ut )_o&.@C(q}%>}odeTzL" MaUOG?oLaVx\yZj`v;:2}>5ԁ~WUZ낽v'Ur Q)F#s#B. g'+ߟBl< ;|'ʿ)%bO%uKo>e>] ٛ;e",S2'FN"$<~_N9x5INxCB??T;So~u`\j.\}ЅyLF/GFr[_yԞ|5pRm[]MSeoO4y.h頕nS7T1ЋmrRg%e' \KIJ2fၾnwvg왢6>wZ%t-hmV)gDlfyz!~mglC<0!+g{fȾݗ~;M;RΗZlRrY9]^pddt `5pmY9nUǡ!yԜ##D9hѱ35v!@τx4LOI83>/R{2&xqzZ} ){e4hF偁 -FlU bN"n+JEa ]OEx/seg -cUʎMu >=VZPabx@-QYowkGϞKuƉ -3 ys>-;|9vc<*̷˪^m5ɥB7PW{!wDNYD]ƿ~eCNM<"Q.g&HiNMBA:sG:0Ͱ-"DPsp)b.H} mKbdԴ!Le>RԚq3NUsc%c4%7C$;wi@O01~=)ӣ!.0qçcC҃:|]_S=2i+fBD8|w*هzzɷeDe+CU#CK(.2(pK*ʐQ.' ozA BՆy!9KIzīO"]$DzԍYOWݮb×&e@o|ΡA$ڧJCzrjǃ*|@C#bm?X9f*6x[B/?85 \Fv):1;cBbŮB.pʯ![',u&Sį呾׷ -y -k?N#$, -F<ľk(\kt3SO niZh7&>s ;0P -=^49M6G,RjѢuBY\PQs5uj:LԖ_Džzt^rf xr;A|::2xsfIZrG|j?sHa ,k!$uL<,P_׸E:{ hզARCey#{BL̷U&ʯ%9dgsy: on,ⳁ?Mm'Z2Z>vOU7{寀> ?RP 5#pe}"TL@^m^,z&\ڿ܂ݳH7Qjw r`Z,\XI;0KTLl* - -\c|N9hgc-uC9_2,J "x{tL|?# U՚MAs^6YY~|t#Yk8 dYiEqYulUTR7o-N ȧ\"5epOk\ we÷qAa)9nxfַm~sD[ R/t@XA;Rګ9Y\"WWhްJ@|l2M4ٟ= ;gKTdPR̂Qһ -ϫZܭC=W[ <_*(pE:f916bb[89JUxxu 2@,Et A,Уf`0x+e$u,m"GKp+n ܥ`| -QCd#1{Q|'[e0t62t^3*c"(~,"&PI/{aLқ)ja\,,<#pU {SDk G{pRCS[C۟"9>dg3|ZbΑmEqY;V)6|dWqje~51ӯz n dGDį~:PFFٷ%dh*45qDA]jl{;]ancWdez,t Kc <\f[ -s:t߹Q@]qgZۿnG:|Op%ݩ'vu+OG-kWPu[| -fհbjSEｆvzXy6Ǟ˶B﫱;R\S@|8]|ߣ&I9~cEgs\.eXs4j (Q$Rb`  ":Lbȩs΍9ޝצ=vˮ\e-,V,pw^vE4F<;S_K_š!5jmB]{oW*3NX{f2D7Tݜ0vMk8!kŴq^U~TTUIX۞Y -:ZN5@EHܜT &0E0 6Ǚ^L8`-ew,0C+^:D]xy$(iWvLr$(_#h@@- 3 -pck4Uif Чb̾!؜f V =὏ͱ o4k['x'#qxސݴWS?[YĔ&b [+97e=欛73^=xȧ9YOϭKM_n}þB&b#v[,aA+՝&;r4,i Z|'CNKLM) O/FEAۮ /̽l;I&ΣiTt)dqq2=hՏ˯<]jF} I;.vfo=6P|7 - T8ߖ]Irm̂;`7t*l7Q67<+9V%! Eڵɶk#v.<ɓM"X~GhIP5&ȹKԋӌC.Yr7qEq*bU݁ZvjnjCJޙ0RN <&>6fe|ߌ7ͫoJDDͫ}Twhs#7f4DW5sgpm<hI;NsIoj NsA*W&U 꿂.b\L3yo6U]TM i ?V=jX~/ښRb̡ZUϾ#Y`n~|jTK/A J=v9`-1'ϰʖN¦(Wz^d-LT#lFvgfW~gd뱈<&#UMLI.$ f \$o/Y̅mlLz)aV&]}~ZmWЛ!y0%#5I#)ϣ=j΃t>p9Dǡ&19ebD1î{Aˍ>&"s~)28l dtliY5QG}s#i!zJQTqieˑ1v bVQW)D-#木p5n!lN]ǝꋻbBo|Io4|w?Xߊ:E [IʺPP5C=vqJA+L}8r%agN.6CiqV_}~?1 YZQ=1o]~tUYxMȩ;.nN4Y-I6~*15$d:/gmM5ۙQVMS;5)qja|6*.0)s=h81y)nfT\ֈ:yC%nM>+ZzFQw_|M4`sZ6.Hf†׼9F~x`eax,\(L1L*|C>͍QZmϱ-7A7IiIT'VM]E!>W6?f?aj>) kdT84aUIWW^,8p*4u2;eo7Z吺#s_- zkK'_&IN034h3W&4d -[Ir~O'bz!u}Lnxh-oJ" 2A7}8~ɕFtgF7m9 հ\4P|ZVyHGmJ8hu|))PLX#VYG7YwW%gbNT+ED5!̿h83.{uDXy-d`5wĬrivg$*3VjEʥ Ͱʽ2{cw޿}Zv)e2-0q_#6!e}Va7orjrꄕeÅG@KY7Uto7{iűOpV"A=,bv! \q14{2k*zQp[0 -pIQqkF^sTˮ9mO85Q#f*cz1> *4~09aPpf1xORXy%1٧gaE4"\Pũj{eS2HA];S#z1#le⭩Se+35ݘڀ:A;/.(o_v`^Ł1ŭq$bnL+E}Ìko',7˾pݮ}^\ǬtX&(eWทLjٌ:' -yHϩK01*C-zzz0bS/o]7dgiX?a}Uu98%\^{^_^yúNP5ETaFqǑN… m>t>aV휶ԬX݉'wq!q-1?ec4xD,MҩALrv{o/jtO_{9jfCҩNy!'鹇8dM@J:Odž̤k-GP'#kC1zmL/}OX;J/h=¦># YQPnIs"ah]9wpnyHjcX]?4 bqʻRPQ# \@drS&LDqR|g]|W&ޞIP'h>8Vu -!Pq#r)7qCZ•[!]77ÌhIDf՜ʨSmUB C[5?+%fs#:!5mMFEC<ݒ/W\}C4,>5i0PwOa*f%45ֆj .Y|ᖊQ|Re?l7KZ'[u4=SѴ:Ҟ}kraKEE-#=_a -xk<b*"!&.-.qE׾ #a|3(C:!. -X2 Q5|iUu)s/H93ow$mʌ[$IvIP#'U܀2B`[G[o~\rt v)? -QGmۛ7eֆWqGܪX=e}A-Nlw{VY]uܭ.i)V`$b4]I)G* }, 븍sRi#jЪ!5wU{ gz51bF65natkU#ykwKK1ըt 1iu($iRs5,]Zm3+mɤ׎}~p $8ttm+MsvՎWߙSv9f>p7C+6Oe]K١>҂ߡjaLK-hU~5ja;复մ6pUlѯfqFƨ1JⓚC*GB2R}6C8\{40/qg&ۯv^([8ʛ-Q=zZ>I8a&֤Q_&Z􌊠^Jڜ, Owo%s-N,_Y4w*$t﫦C%cT&mMB*n}X-'}csn&'~8C13-g6,\啯F9o9Xpfrq*{R.M^-%akV> =+=7qZ1+uTZ$817>%3 9wstUŪhq33a6;so\!}>Uyrzgi$$`sd3f%2vUqpt(CZrdcsa\MsH[SkAs2sIZ;)! zgŒB}UH\ԀkU˟OYŁ\^;JqsϚnNgRNΨ @AYJٔ|ya>s)Y3&nS7LD,iqc)J^\KR)at6ё }mSgQƨzQ$ۗm^5X~x2Km,쌙m돛W`?/WZ]<κ9gޜQ+u~woNf={n_>ͯ8#kM Zh;ݎ{oΘYLۜ6F9q3eVnޚĝW{1&"^ -Vǵ*:Op&p4b}\X2"(_|N8qQ?s?XcL)M9A <_cTG(O5{iVyb !^ET䂄Vݲ265VZMs!ڎ|=nf7G,"B:xkFNs=%^x;>t$-RnrYjK;Ԍ7bWG[P#'i} (R2.ek]m:zRxrv)7@|BS7G&ɗ|S Sʹ #f\{z?EG-B"jw2wDX^+?9Z7#i_ Ja#[\ KŢGMyteܠy;5Ϳ֩|xzE#`hÔs)"D̫F:Nm<r "_-# sy/TM)|aW^i=3k#Fpcǵ"R\#Xx~fXpIY׳/g!-mmt~먚\2NVkod]U&D\.`7GuBXӜ ɤws[3r<)_.N}:t"U ^bQӐD͌*i_Z3OZmMI\3a_Eq;^!'#nWGE_Tw:~(cEnD&T{Hs-<+31=n 4vAǛfZM:x)b#%gBЊ,u}jz;9 1f2ޞ{ILߘ\0!!XLé6v:q6B8x%n:SɧTmMjF,+|#׭X~sd]&hׂ·e_i?[zTm7ICԉ":NmʨjU?gfX: ~S%*_nIۓc2QjZvJ)Ӓ -^yrWē > RrIF)Psox%Hq)70#۞-;:Z9M ;ż딞J߂}*V}'gs1 -jSъZzb3sjJ$-YO1%iY.%g%m/ձSˣKm℞׹U,?YĄ}\iQH EŗǦW?>ߪF REpH;m3ҷg:T "DSy_|؅[kOFRN|˟b_0Kc&^qVy%fm{dиQs텅gyFL.f\kX-).e!K\Ƭ]"嬾TՃKٙYr_rk羷Q !xUUl2J*OsS2.EtuLKΛ{q_ݏ.#}1#{*v}}uQ0tf -,pH)¯<hk³/^4r; ;뭆nACz甃QLS9F9;aw{K8vɳ ޠ%}4 NlgG_i'z%i(ިw__'S6$;5∨_7F5UWMZ}phmX }P{~.uVH; =O1# "5+cCBNw|Zm(>n?W3fWew2߸ǵ75cE_; 'U%b/{Kd^"-mnDv[%b/{Kd^"-mnDv[%b/{Kd^"-mnDv[%b/{Kd^"-mnDv[%b/{Kd^"-mnDv[%b/{Kd^"-mnDv[%b/{;}g~R_'shT¯~(| -Ε~wRIh;Wƥ(LeUg;þرg>#S/CN8GO=}':q'>u3>䩟O8|ı'=~>q̙ӧO?y8u(v3g:sԩoHo:/8'u~O?9s ~2=1ӏkzB'L5a~KAH$\Pֽi59fv}GwIlIm??O;pdz>#xXm;}P">yMIFje_4Րrk#ZXE,Q K!q}럡] LJzajՊڣz~6J )a(l%1}&Egr-n?0)a_nFg^DZ)f1%Mr+z;vyk:/mLN5QQ;&"^U +ڤ츁UKzڻS]JZ7JI7yCG|K Vi eD5"\xZF"QpyytMw+˾ Hh85NBL$ԕ kh>9CER/լ[EĔU!LؕA]ǯRP7; N3j鈛i7r,XU $ԬQ=&afT/W:Z4iUd,"ʶS*Le|dmtycZ7U!ki>9? kt -)DjZu/ADĀ^H$9KHG|b'%Ψ\Ӓ&LbH-q9,Dl֘2ЮG --̚MHM;EkOڅUHi)Ej՘ۆ:.1/f`ʠ*%}stnyC^҉:npו77 ;3m9+ois;HqYJER:b1pNEJX$86RO-J8I5 2E&C :^cpW0 -?$ʿQu'JzeMO JGDEPtY_%2oOd\쓂/*:#^NHy(` jFF|G%*SN#nSXiOʹGٗB?552bWƔUSfULͫOdVגmP !!ӓ6 #i ΞE D^NE, ->ꖉ+3PX/ĝVpC^|ݤWH*o`#zR.8i&-p9$䪰BtCl"r0'jdV'ʴVv2jIܙ^@n>ɺnJ8Z!\q=zWW']7 ΁!PK#&jIå .֐r*{PRڥ쌛ےv]DMY.hڔ]1K*vNTu?nL5 )7>NeW,"OPa SƌՐ0 -|ӸSZnMS fsu^8 wh5bhLXU1ǵ HI?#^Efsp_rZ#މ jLں7fzUh%0j6rioO^7 z)15nv=֛W~Ȩ6n sQ/Q. *JHAף/^6d_Q)(fF7V^5 L_N)%)S%B)ߠ:K.JD +6}:e,V+EWkImY&8.bqY;4̽=A-888ELEE%f-Bb"@/,br,g?+Iu fzSn)?T -| de敷;{,¬kq9w.fn5Zsa؃MHB,֔لIE);0H51c45 !=1b`ŭIО[L.g_MDK8()"t&RF,Q|Z^ `ߖU3[3vföx-2/!KڂzJihYi!d[a+Hi罙Qv ҥݐЫvv3j4rQޭLXYJx 5xmjjV n]:Kk ie!5>526lL1s7@ǬR.$n[2JFl0:\zŅohVy`r7J:Eʸ]}zd- x\pC:EB@0*e$.R 3̄=''Ō`{ u)v}I8$֮ Ꭼ% -3 ֆWBün?4IMUlVԱ칕/)ru{L9v-b11mR$N;jfNjtdbJ2ke\„"jmeXp6s2{rm[$IBFCcffzu9tV"@=RQ@_ &||sey$=+' -%6.eBƶWz쬀rqp!M12+1)UWR6vK&gՆt݂[vHHEDDvNK^TKI$)E9f[@̃=FlC U KcQ"n%VZbl<1txcx!Ҳ=Qw@s+*{ui10C2+N 7=҃3J:r^HIuSS7yum"h:vuLKn=:JMs+F1qe~\'x8aHa *0 "zzi̬ٚ_X|q$8zz؈x#$#_ c c\<,clBe4(<܋)f;ϛ͜Άu?G4 ?5'ê13u]i#Hvs o\Hy6&\Xn=:{_-jJܨU9zdE׋*X|Z0(>rPJI0#m' jIW4+0OHbGXǩŰ%i/t p*u|U kGD^~^r:F㦚pysU{X~ވMG*аz╤Uiv)w0qp 4A4ľ۞ -)ĥM8$K.ޞ+/{XB:A-)X};;/lqے6=aQUt̵QQ"v0luSL{df{a#We9 2R B>:'\/)&MNv#Pv<]-`eSĮhCZr~D1kQsM& B=}\ʾɔaiW&Glגѫږ+Õ߭V_^_/l?Q3?VuЌQ /q ˶l&g"ƌ/_p]Z!hY5a`DŗkC:w*Ii .8(M΅&;υg(WC3|D癸RF CD iiE[gmA E6,⽋ӹt &Bjo|%fHˣm~\%]M`c`u>⋪LjVuG9ns{€8@hŨLXx-w61%8`u' -=a^O9{QG@ur;JqtP[[9w:vkloMYA)Q(Ul\p2|om m2N8ɧ J@,s,Ȕ+;󲮬W%JfʻHECONBOQ0ۋɇ΢'bFL|lP7㐋 o=#)c&fU†A4M[KyeW.OY*8=+W{S ff2}pHJƨ 覭sYOeYq#jV^'1E+h;eM$m"FNsTǮMyi6,Fu)# HYRӋ&g}Sċq#2i4LPC3*cǍƵſx;5?}K\kvIEqL3I()2J&K3N1k{N3Q-@g` -"aQE%6O8{y`3Z{02Բ[@:P%vr%6|#;xLkxq*iWύN򀽮  v tX`Iˣdb bc"vf=+v$DRnç\]":s۲ BnzN>XJ{%$hňV R e>)7l_al0">RL)oWO#..a{Q*%=헙HQ摺N$ z6^ֳ*1o:|J1xkX)W!b*Vv)3Z'=4X8 ꀆ~-?I)I -:ִǓoP_0"SoBܸFT6h;r8t]1R!-xu i葅U֐]9F LҊT,Gܺw-Ǭwk FDC-D@'|c-GBSm91t[I:5!!78p(m96Sf$m OPE/jEHIejɨ h5ܶY!M2?"NԢ:V -+7. 5D ":j0 4]HL~V -XhKĜQBOyC|bP -&nRS b1:+CmҒ$I2z?M/N/6z9 -[J?o4 Mr}uۖI7Q-)}WsS 5nQ [S)"΋c[BbHѵsi\q({[P:-1#>5p| (4m=SK=1p2eW 3& }<Kcg)؏]OBDROPQ{/O5 ;S޻YLD Y-ِegEJ.dP]zn*n3iv7~=f u*dIxXdKw[M2!V^DuaI֟b!.y:; uJ8i5w"PC&RL,7JeHϩ Ak|σ,c#%f稣; #Yؓ\ZۜTu --3>kq~[rnZzIA==a!]M!j:OϬ3 -tL0"*Raڊ]&noVѳ[Bc|>/ {Iqsu_*VCaI-|됂gW HE9]|zj@qYIkS'5fW gD3xsrZYƌxMJv޽$Z(X~K<QQC< ՄYu Gm~2HS@HQq3U򢚻c ItyHaY(@ bU&O& L}?rsg>mQc7c>୞cMB̮nD$楘vIyiXA"|#J8ʄ=>!j@[rS!9as3Ԫ&=7^^ ܋oD -Nݟ}|v?e•» [C1G߽v#d`.l-`״,O. N=[뤤zt.ĭbVowDǪhkOZ1eӣzFEoW_4v>b]{`y%h|!ha*ŝ%qvn}$Un.NظK 7\.&M 6:^ ƁinVƾ_FӴkSU+'^++reOE+G3qgX/%lwb(V!)TR|H#Y~ Z(en{oo{oXR @.ZmygkH/&QK~ Y7)͡{E{ոw!n" 9U0Q l}}ԦK̒ ic -^YL,He[. ӸV(| rn{zz4dzU'^Vu3nyfq+tiJAªiEq+97Z+ kJ| 87 @Ve8賰۲4~k÷IVSvV( -G3 -{vm\T/G q[jfIb!.O;Nbny5z܊%fOOߘșZ(4IJXq^{i^뎣׆9Dw{EáA]q2Q YQ 5iή.ԁ ոok)YVǖp9nSψIDNhOZ%LZ:?($)Lz j6WZ%'<%lN Z#N( NŨ[NƜM5I9{5(;VBA2q cM -^$&e"AWϏw\~3bƶ^'$B*.Kʟ{CJxoUzo; G7~ ૻgAVnKXˮEYBMX-:Czr$JPu-.l{]x n]SKȗ!avr)fٛʞČXyY6jkBԄa&D=.ԣOG- Ƹei\7 -+9;<5@RQ^v޲&\M8 0Mz NΏ RE -<4j =f.ub΢ 39Z+Q2J$!mj-FɗbZ^1)jDTʷ&yJ3qٕca5>bUPkh)NaN,tt -4 (Nʦwi~*aWQТ56av0\1yvq'pj6){ohG~ӕu+VuT]w Y;|s0xI[[7J13)؟ycgMص*ܣH@LG1ztU/ċSHkPc _Vśδ3[BR  !(nq!@ As}xppkd&di2+Ǭ`!#Hgd6RAlVفBʱ*3pl.#h*#Zo>s-:ʤ]=q(3eFcpQ{2,AQ=964CP$K9 槚{7]i{ qF 1I:)r.ZT@G|چ`)bz?+n}tڬuwGh1r8944ixmxՕvCy 썓&i#Ibls~ b;0R€Lr jZJž+Eh#u4%99 w |&ǾCb|K1IQ{ -6xZk~8CC54?C̷hue}3' ym,ű-:kO![=-PN߅})@MK9!F/v#6GAf9#ui =5Lg=-=mWQ'ٕC5i>c(K>Ф@]@yj#x9҈PGT̴s<<9gXtQ}wJ0M#&X4D:#ԥ4!J ԟ)zWD:,6ڏ<kg/4dxZ7 r - XEr,cb,Т;z aH =վ:x>vBV?P -j(-@bIτliNoE;TacO{=.PHۖỵ\9aY eR}(G$gTc-#IqÉ2`gޗe3`þB@]$1@c*c-**Fʾb{U; -qs|F?Z|41(9 &+feټ9$=%|<Šy6hJLB5.<3=$ x&gK.,saV3F)QV*dXr!/hHћcx]q2S7$h ;JBÇOAaE}'3E o.4-G`fw5Q0_ cDzN#5=D&g?{ÙÙ0}-nVq Sb<ЃRzM)-bN^|؉:3DKsl<l//q4]q<'(QNt<&mropq'SS ꬂeVE.@PҾؓcMc$SllF9GJcsM1=_C`$Hm!Bx2.^1!fq&ǛQALC/'RHgo8P U'OTyJg$?B=PQ/SMG:xgHtd tfp䞚g E<5邵az̾|WQiVC>ؤw}- ೲ̪=mȮ&poJ$YF5az\[SX1;Mqvy2U~22"3+.mhVgn'g :ڬ >^/a,&9᧖1<A]Gǥhf5pgǸi)>ʞ6#G%`@kP˴H -'MYI3+}5"g &@/i1N8h[?PqC / jiNyi 񮜝O *o_%`>vԍuoNyڙihaۣy#] KFxޤ;Ԩtޯ)qLK>*|W!8R N@N.0I&#qb&A3io9>|O%j{tؓ2>ӡ -oR@>Rsʎ2 -~Ns?ԣ t/2p n OF׺1n*|Y!4E*_ks41ӾK#}  }n Q`l9$o+Q"{.6q9sIL!&?=9В-Z ~ g9mEVE @@)9#vU&MnY]һ)>e գeE퉷[& -QYtwpy@ʞ&#(iy]-ik eCh ̤go>ĂGW] Xåh)jju\.d2/#4X8PI*REAޞOW2SӁLIܖ"=(#y8 \b,p"Oypj/[M£{t6p64s#%`eC5/9]tPj_hG/8 0?8zMx2F9QJzq\T5e -@k -LL1o[׀9u4Sw8mѓ5\ҁτr,=Yd:H]jyj.ʢ*z2Er@/<^:Y,9〿)qf9%@E)(pYqqa_]v 0h8ށ`M8P6nKiV;ߖ n /;CԐ!6f?m-rsgRB行ߗ0-?IqJ辄w(c 1cGTؗc0= PBCdF,w}W11w9tc! -yBH0Or |{ 9/#EmR }c'^qr Dұ?Ot|$;uk;N EJIiGX&Et<}{4hҧg*9;D]8cNt EI77>gā79v񾊃Wc6RL`ՎQ' v&J<_6HL>ざڛǀ΢BdzB '@ Y4wc6,ޖUSL tL$)0vۖb|Nt, _y*<5p*>*ȳZ  .ZdzсdQ][0=mn%Gl49.k[Jo->N^fEf=f٢~|(1D<龂G,0ÎN<:PF >{z$a$B=GYY%кLN1EIyqJZwʧO mH'lV 9< yn4e/}$Va`FvJ#,_Й !i e{/Ƙ@^0b6yzJ 8̈Z&z-֣o-+-i嶺Ԧٮ?{bJOڗ4{)`go H>koMe C72Iٟ \vzS>&{cȍ^|=iҚf9iu0A5 ̣x?0)x;C< 3I\"|[iK[D|4`<'f)vExɑЙYIJ!s_N;V3Q_Ce%Fv\y$CD~ i <%71BZ//i <Uߋ5qs}M8Re= w16; - H6J3oDД i:(m4;w3VOu܂_m::)^F/W]d+͇?XoAuԌ|l v6J };z+JS%~!7Nl0!`NkˍD;OMܤI`Bi85[gEOUV&`e!y ?N$OyTlꡅO 6%ЋsΑvǸiS?OEܟЊwZKK~5_xފv@ك:IZFpň糵@{"t|𿱟EzĢC 4԰ fO+m(a*AV/ml꛼4恪$vx3]9gQF9ImmqSu8Ҫn$6C)Bʁ5v3, -J.sۊPFźXp̷vԧ4;MiSYnzBwi -iie@rD٭5d/=a/0}=pؘv6yߕ~AMyFI>&י'+ 4>7i˝쨝~ 3fi冤7;=hWS/}"R R+sC[mNշ#>lvo"h_^nHu)P\o^nI|F9{ЎPכ>RjiH56ETt%歶4|m3@Xk9Lrq{r(_ Z~ߢ`aM1]z+mYérċZ 3}'4Ȉྮ`LU=|B]Lp91n:t2}n.tU(n70z3u&z)孲80Ƅ0⚦(bA[Et$\̆?%m $/S+RmR^Nd_WF[iF}TvCzr&䮄aIs\i,ڞj//FZ 5l)lMiV?~m46T N'Ug|߫$g7=nv|=R dvLU&a^c #`:@r}'<\}:#ZmʇF{4+Zb"^CsBB CHZ,RCJSbCkUiqq uqvB=iwHH14v3uo4@K @},J(v1]LY{GYso,'ni ܊_v!VW`-/+=]xks0wF8k]xOҤgioW GjM Ѓ\k~]nH{+{d<3J;C?$D  ;8'GîLfYr\SßTἯ| tz;M{psszcLrS$=#z}л_{] -(}09<ǯ ݴ7;#+cY1+r"a]}.\\LPt f&d0UDzxNJ#\VG'T翉.`3qn1.iFўCH{>n]IaI>~jTF#8|Mi:V6Í5QX8UtK|%4|u3-xЎ҉wKz-/ -M2ux ٕF:y?B#\73(j7B+|8 -oc0;=iu dvkK=TC{Uɮ/zqw8ZM_k="Jst>^o2Ҥ粜;H+]s?T:̇Vl ^W/t[Uh@ۮнWH+ϋMv 6觓yV!4Mbyi.N|)M|&ɏ{0(_:L؄u_nx) G3#r/dޖQ{ڑCcJ#A +$awn^cte+֋>&].v7鉆~J: e z -A=L%vQ -ٚKdUY\=eIj7+YWQR;xWw47̏W&3R? cJ_/4Ig_!auEAérь't3"{[ݜFy14?7Ӿ'a#Ϫ_H^tdSjh^CO)IA~;ȎZl;{c@PltnX,쎮8jHW΍'6yAZ#R n&嵶"4WM 6Wi(M۝D-v*~،sΊ|0\qk7 -C}﮴I[R߁ڰՔ<݌| -a۰V)9%*̧4&̧Ge º_jϺunmghMmp0AVG<]m![35oSɯs5XЇ?i qIuEa.ei͕ŚĠFaB ;y5|NeC;a՝|#LV8vc(r}FgMYM Lu[u9⃦<`e[؈.y+yt n)vjxY~Ci^Խ?YNM'X 疾d죅߲ޝl)6|aLqe6s1>(H!wCԈqXkNY}-AxNWz{N-}ЀK^m8W.6bߓsߟ)Jr=GnZO|[]qoa=^B9e~D |uF]p]:ZUp(澦(ԪrIE5=A!z}@Lo;j3}gD2le#(9;;𶲔3W/S$=͉+yԟxD y6SNѽ%awAV 5yOsD†Ksiß/r#W%7?e9g},@ܕO3)1@ސ%>n`:F{1Hm^*K{)_~ܞ/nb|#ꃺ,(J=DNQAН:SNۥR_z \ga걟3O5<5ŽYeM|C9Q]IE#ތ7kl|i*neM 4ڠ z;=xT{y:oc+goGa. -m7]/a]'<5b\x𗬐Wgʩ^i]â@W][.8ꉦ2F(m3WOy?[ -tqDoy^8q o.%H硬8Q6N߉_`"zw' #:_$_kd%Yo ns I6a#F:F ^MYiH~6j_1$R#pɳluQ}鬽,Z&BL5qD7kΧu%KmܤG3tg-t$'ꎴ0+]G4 -0 NfZ';V[eGDe_fF>.{.f)NҼҬ!We7V2,0Њw#?wRCׇ9ifܷQqԍɌ?0Ƴ"nKs/0(Jj }҄w^ke$8D0'5#u૜[UyH{gfFJ1/7{g-dcn.N\_~<( -yu~y v'bF7|uyַsӕQDžT& ,RÂ}ϿkH.P^,.{m "vTc7#`ln;_JQrs2b ?{c0?0@ [8ʿǽyԜb?WZVzOQC[lsgZq9o@o6X1C90s5+-i>=S'*NT$Ͷ";O$Yk?l!M#Tyڕva*4I"/5>d_]z?\lNvΏt ҆tQ;Wj<#F 5iqk=]A* r|Sr5`ӟNbZKàB[kJ.~, 끔3;i*̭!1y mM|=dO p<]W]rS',,5앥 /jtMtނ$FRU~j3kԂukLy.Zm/w??G>GZú8~-0VRz2Q_!pp6~O]h/v1B4ϺR \UD?[mqیf]Ix8ZTdJ֦} -9zc"ﹲw鄙{佹F OZ #POy ~%n qQ3I7gփh%mw wM{߶GxЇ,?UeFt BkmLC490٩NCg["K]oW^o\zhM$LÕxV8E3V,G}7SZCocվ|?TM˹Tԏ]X6J3u\J+JSb7]Wxqi%'q)^Wu;㬔nR;i 4tV3xd&F7֛E^'nO0SL2:rk1΄ƅ:-ya w)fp -78v$}9T?gs'h de{Ҝ\h:y plſzSؚC0tzY11Fb |3~]X5[mJ8Ur9fgO2Mq+N|8NZ} tzLy P4Ui_U%$+aj ^^j# -*-}6[ _jD9n1#gɞAr, JsQMg-L5=`u~$4Ki1Z;U ք>ƺ/cP"h:}y} -L庴"]F7bob0QAVBWAXsk(΍P 'mu}PMhVXޒ[,wP}CDoc6׉K -Ar.{{ʲ7>F}B>:b=_(.{9JYhcGmdQVXQ겴M@Pga~r00] yԛsu5ǯ Uo!1U?(,wu IoVqޛbff7>؏oH4otAACӰob WݴjYqܫ2faQguBg*QoehV )dKXDq,&Yix^1ӆs6 ?@(ĢZuXD^RI{6DU@VҢyJ04'86+Fxgyoh*-7ȟgk^Ð>. (v?m pa!ncO ]j%,м?~Dz_V57Z81+m$]-Wx6SM^"j~yIrh+>N>`<މMx)|J~ٟAXh9 3nr"%XrImԋDKrܱ"/ZoO~Мl7ۂX&MSw)'՜b2׵N^^ e)]$J򸖟r2%',OqX@O&YǘhO\<0@ ے?&WZI |n;ùb=.ck7/utnii@_fyg;2Rtm5ASFy{x"Ӱ}5_} DCsr1#U}%ė=b~%1jVb9<'T~dPL_ߩa{ ~[ 2^1&`&vCjj|0BQ- -ˢұʉyqCN~KxJ~Zvtܟ?9<<}uycґ^d`d4IPˊѼt6A-!J#1f~PK=9ro܄=r o-GcEX' Mڔ˃Di%`~Fq^gpPby>Ωw6gq.oGĴ,|0~礬ϴa<%w:7+LԅJ25ȕgYlnuO-p]p%X7?:IʌGL(1RnYanɲ[c!z?HGe>y]̉?Ov)݅oNN~Q]!Ԣ٤x^D\ĝe'ĜNٽ=G7Νv0ǰXwʐaDzz !k!:HbϖlbBqrYnLi)W@އ۾9<{7 Ë{ g_\Tnyi XQڳAl UkPAK@vr1勰n\݇{vŸa0ؕ?πq_}k{77񾺒I׵G*D~9,2";yr:)waqm^lo[xܸt ]&cc7ׇXhJK Ĥn`{.U1>ozxi)W͝0+g.y=<./)D_,IzԃsnOEVߪH;0Oki xөnh70_0[kW]=rvyӿso`f11,ޜw$b>zT#}xw`7n^^ -sx؃Ka7o?;{8^W -ɟfZ2s72ܰbFn:2%+k[a݅9>z37^ pOث7`hO?: 4 HلYQIiѲZ@>yy]B=S/o9 `.| -rzQQt]KPħekbl9f|bxD߿~s+k ݀=i494r1h ꠮~ԏc"3hI)i)H6TW؛w`o%ӳG`1ykswZJBNAKM#_RM6O~3R4PCN#Rnr9X?}{t::xNk/o^ݽzv`w/\}{r 8_}!)$Y~~>3#m_N+t!H8n613;oݸ }*>׭vX<߼|g`.8pmQUdu Gx~yDURNoa߇۾s/{z.˰¼ct6<঺NJk#{4]Tϲr&>Q x v*'Xw07vw.>}-ְxq nTKmh[ 'u[&bTHя񐳝4´EyؔΧڀZ]|ϳ߄];v 7nì>9A>ZH2 -_*\U25,jS936&S+؇awA|ueSP:߂9f}>,鷼k1 >-)6˦/Oug['سX}m_yv;.߽ {q1ˠO1/b"+PߣN4 Bntuq&x<ć{ŒE^iס䵕̹％l|+9SFQpgס)ϵ`G_֕ۙδ6iia8cffm13%33l1%,f2$mgz!pcK[g9{Ћd"U/6f4~[^%kTn0CEh{5?|男QlRy{؋Wv yt+Zd:S/ --&|S-?S9_/0E=Vpc4*)!kG!oM)OWؔכSdkY?V:ewlFG8Y턇$ed}N@_b̩o>?}ƥ -o87geZ۩.)%&tFҳ E}9MQ3khUVmҲo_ y?ݸsg2^&~ɭ׻I۳,[AqڰN1qZ3L2:paVN0?+}OHqw ߿vԣ_n,̜K2?%V7~ˁ3Џ=Ч"vY;far}XQp0NuGN Qt`!? ywR?'ۑ?2ɦ.bAC*:ܧcpm@uVIrfx1m:<ޛe/$T@sS ->khu*0rȹ %e-kȍzefoKc,l/:|0MʈJ(_~u#%WfZw_]gW3M#ǀhI u|*:U[L{xvI1NH) Ӏ nIFkCmYvu rlpyX_lc/2+"SyVfGܝç^zirzq^YXX2S>C9ؽ9hqfI zrGF9] uC*l+Zeto-QzL1/RM$4_%9DleԾMxй 1!k#m`[fu7:,b"Jw -i{U ,CA[h ȁ C}HtCP0`v dkLYEZX )9AYWt[Fm *{=kuu6!j|w_åOcmVY=XD-rvI^!%Q=xcP3P`PkBfmYRQB*>+gubF2&uwX'W9. 8,񫽒fOKZj}bX\m{b |J6%A{rG3ؕLJhsTz[I -endstream endobj 297 0 obj <>stream -q2 kd0u -BO@6cՄcPPBZِqs ܖ-Z,RRYDa]nu|$SP2;F]rrQ#4*i~%}B,N>HAm4a׭Ypn- -ŦӦ8 (IKQ?*fEI^aHOD,*аzd0B::ڶ`u']wu ݹa-˰R*&/ -^%r_'; s|:)ƶkMMpaw5I7Xd=욵iذ谰XTbJtmlo@D?dC~UxPImelF=Sk|om_eЙ%&ĨR+b@ŌҘ9SI1v!:-nslDSbs-/ڽrdc\|lGDu]#!UX@;1ᖑ_&j lbq%bir|u-FtASMA X]ۂ';'l-W 0Q7fD m#k4[0G*8 Wݟѐ!Z84ѳ+計Ŋ -&~T/˿h mtﯓc-Lİ콩ٺ5%*.XG˯|Vt'b! _#ڧZJ'tIp3aZ]擑Z*&[l[Ax 3–$r+S+$lLߺDJ=35|k5ag}O) ?ʮ )8Z畓kw>)*7ޟvxOSs ☖94|2L[w''4FW@>QX. gϱMG̎'ʰA5,&6;5'%t摞9kbZbc>S+>4H-CԚ" -c۽r@OJbmsmĀ?G[LCL[!Lm}>5||šMV! -DQX#+풣rTWʉM^ r1搏Lұ:ԠJ -/^;J6`{ݐQ#бf{zc -K>XsKpQ#RBo9>Y ^OXgI9*վɈiK ?rݱaԐ*Rc2{mR&-%M&MM!wwN ܉xwnr飂ϡמ]9gIG65 sAx -_:a ֯&C?n2%F: -QaBRTm޾mMQ}KX]DاQU2*1pgsOL*ߛVVU|""egYaMA *w=tML"ȱ_E8I@,=hO%Gbñ7%m7EH[B5R9 -iׁx.1*<O肽;= >2v E  'fCn Jo⁒ubh'_\44 IURՑkzQR0~pe@Bs.rf9V6Ӑ~@\W= N1RQMr, %s[0]8bwym qJ(=R"*&" Oy*qQ3QG*.'&I9+ V2ADq5M><`[ -*̳ -ϊqj+ЌJBE)0h9xVT!&VXgITkz鵜Uk@D -%ky\ k௭?[)GFgR -d{s%ykyO+1ql um]G4l{’}"ۈxԽԻMQۻ msxizTxo F*j -A |dw&WP{+؂k;{ju蕩w7Ƚܚ -IL3*?f$cFTuD/55X@*p*Я} -ZKDϢ[z٠b=rD}?{7MɈզaBn@5Pvw,xHFj_Ӷ+y?7=4>pNOl@>Wv4>0w Ew9Ⱦzl9`;z~040=_H-H=gȽrb"c>l -*dW6 G8V#,F} VSSVXKCĴ4@)2ǵMߚ=hC6!X"涡R\!-ؒ8qcހMa2_{]Y? -oCS\d: -/ZngxYg׹J:Qƶ.5΁BH{ ωf6:v7p+6Xel$h]sWsȤ9VO; 9{@emGCw5䂮p6̡6ǡ@rYxqΕdh9ě  -0!-ˢ2 -X"ȥ"虥?g懛- ] z5QyOwV5y-)^ɓ4q?]$Aл?zƮצk IJ+CCu?do~)8öܘXhJʨ坕7DQ 1ufas RaKļKrfSiX'~FL.?d魸{0[" >y4 Koiߘڳ8jlIa-9I/xyxQɽhG%1K1_}%W -8啿~ -'w'ix 4BL<Ւ!C.D0~7Z|k7^'#m4:%$G:^y%=EOg!NM>g_n3H2VHy}ld 51OKnEthPD$U\_IGu |&l%bJDa@/qٰVjSjЕGf:ΧC\RJmPo]u!Q>!:ȅq %87:"6sH=28IU|E:D\7 Vް=4?h|VL)b M#Z!4\p@e@/m ,]Gõqd_%NBK?w7|)$,sȩ W3*HIn4\=1Uģ/\8İm_#|bFWkQ &$U UuT(a{(,aZW8k\Z+ج"2`h[2nś JnM LDiq<ˈ4,<W@nj75ns~d<*6m!t7\3*"?ƈMOݚٳrs&~rW߳<820h\%L_LmM[[}JHzgޑP?_>_~ؠB*TLÓU3e7'CP^L+ѭ[Lvh9aPE`UkAX[k΅ 3P~. -UDD.Q*~>2qGZHD2}kaLNmv.+ܠ h'^!ae5rmZT1>%44MI#o͌ F*ЋDQOm&P3ph#g]Dm{y3{ nA}(, - f꫹3~2>+ !Wk  \l3*-Cb64,ŗ-+O=쳈#Zl{b -}B@Q9y؛ [f,lM4?/INE 茔ZtV=adkh GE\͝ QGǴti鹪G3pbooxXt(Ⴥ -hHWTAG^g nk憄񥆟@-4&9<ͭXǚӀXy%:R# ǧم?3+I}w'a9H@ghbCJ|_ + U~ o[BfcKkzgU?æ^^m~@A:!)4$iX -SWCB@s7'ܲ7Yv'nN;Qw['TM_yH=5-䒋?_{Xm~YU?2OE-e5wZŴDП͚gֆ-(p^BUw MoBRlԏFLMH>bvvGf*xТF -qA%&Wk/i*UBát.ҶO✭}`-Z@d ql -k,<z}dڵ QPA?> 8>:2$aO6:Ǐ | 7aܳ|oG'Q/Eҫqлe| -%":߿gk?mTY"ԆeĺxxKCI;#i?h}F{yH)c&[,`!"rÃن:JじU4ݜA|_o=u+ \ó[~zo\9Ya5 [OZNzЅ> xڳΊ-+KoLa_pA1qhݭ/vFj^g>cj¦DJZ28%гxT -<:Vyl[/[9g@i馗gٝn|n4\y2Vz'nxq͊x,RTP[7x]lb%Fo5*:#f4`OB -Hڻ&'SƿCi1.hhd>Pzhcq i0Ͷ-BRʼnI0|c?蘒T?.^{׫t9E,D~ha -\yքiDY~ѽ=j.uWrj|N>Kc~pTue1f[AeWPexCM*A= G Qc̱{mhpGngtВJ\KNK?yeݱ6yXfZl _MڽE|wf[_YgFuZ?{k*V~b_dd,a)g8VQ^A5 P0!j:<ޫDlu -)S:e"Xz驦6=)UBwrAMEoQli1kTfi|d,mx9T~ԓ1Wvˏ0{ eL桞K &D'!r74X]e4G uwfnϔ_f?nw9J|=XP"D,BPIpryGʶ+=8<ָ>1)]# -c;+7!, 1ZC4k-e__TWx޵33V&}B+L6&{%)]UZYXj^rK(#e -ٝ-|l.|cz{o;]v}oF?V "FcUxWpd{SQ[\ W+*nWpLdvMt$)+>ޙAfUhhEHMeTc\!l,\/,c%[xeo( BT ? 81(UpM'f<(fb"Z.;c6AҳLO . \3x;Ͽ^ g Jꇟt}7 -!_?M :J0x=-]'[A -+$&졂O{ >Hl/igsR.*mTZW_WaKJ\[+:랄ͼUʜ"\GFj=d~x6gs*ޒT ޚgcI-Ε!:w]49#rR}X撒:%gBmj B^o-s`trc?bgtgi_g6 ;` &^zޘ_ܜ{HUam e w]"5ul&^I.|?[n]d&1n/cm -w+.o5K_ue ; O>ϵ&0 -.+$tOH͉2~KIy$4_ -ΌiqI ~d12J.9J84a8팜[{}{T3u$ErKI%Ղ7?H/ϗ^|nyٟV|˱]uZ}/G[8:aXNh(uDʹD{ZPƗʷ_iX"|5M>=Is/['2/ګnX&a/ݐr|Xԓ Єdž5hh@m)0%~%pk>븴yh|Sm@r*;IYf2廡Ɨ q.jة ϣ2R2XUk,UuvL| _bidh"3)?B\<꜋֣@,yN>p,}Rl#g6ǛmS-ė8)5YPI ƭDa@ j -o:ZTLGɄ4l̯fSlbJ,2'@/n/ھyx$Y:(f czwoШQ3RꝋqL^0S^5ᐒlR hQ wRH,d!Ӱ&b6Q!V/ӪniVr;uЊs-a3*iJŗFYu?)~럜K9kcO p㭽ɺ۾l[+a|9 -9#sNYwGPciAnFy* -^2 -pn"8hJ,!37GJ.['ʮ*;2B?bv_\')T!yb2CE vyP`4޻ʭ!B*&F@/P*T*"^>}3tsdžݵ/"Rm$7~ ^萠GPMA3Z.ۘTO|Qq3}dLLr\wR'*|ךk1,{{"4ys`7Z#r#R9ٚ+`@@pCtb!A-DOrZ?X쨦1ϗ(宥_s;зiL572`TR&e[SĽeTʑF82G&$fՇMFqׅoh u -73wgmv'%T'U]3_yɕ^2VWtoXS~ J8 pKQ1+xMIG^r -1yNzՙ'.E1/`>d_ÔdtWDu&o_KSq;˷+qh3%.69혂$,:*#7:Xpӄ_TB2 8 -q鑀bpkMP- x -:)"4킐;ej4IӖ{q+UgNd?A䜟Edk/9W_7'}漌SrkW 3o@Hn-"A !&FYf[[[߄_;{w30QʾO;vfδN]hiKK;!! DHqwO+>s -Kޟd BEi<Vt͏bz뀨Μ+uO)Z_.+.^EeUO}t؂ r\Ϻw[~s --LJ_|ۑtjU Y7wEWC݅7E]?k>M0 cLGXi׎+۴+ƅ-m駤)?s*_T@~ .o:lQ18pSZiڞie:Wsc<Лly)u?@o`Y1}I#j/#tbW}?l$E=*l|6Zɡ/ j?VrB*=WC7Ӳ )toKލu3}rn[wc\n}a8B?̓nuu~ -s? y'DMN# 5+"oa洨ꢃ wȌKG'w<-1&鯩Ah݆P?&)bUyH?fm:]k2[윅sL/ctUo3/l]M)}:*&5=$9jK˟XgG /d[s8g `4ڿ_&im'83kz6>8=y -I_KZhښ ]jDǔ uZ Ov7ݜUM3š={ Jh&bVlyXWT۫G]tv/ksvDزAş,)zh3N߇i:`~Fn9:z^t넲5c͎nbV|n)Ḩ+:5+˭0 MY䨖Pw*pΙKˬβ{2T/̺',;_%ׂ;1E}c4)>2W9z/!nzDڲ< UDqWܑ#!N3?妓Xr,.f&]0~)m4Y(1-ą傼Pu}C#VLɶɇ;p\ <cӉ.4->-f L>p1r~1O׆ 0fRu.pEO5S~V?:.mz~jRpmzIlQkӓ}UyE K4CS%&] -eBm?m?Dn?=Gzu7t/s<[|CSfnf-UW1n-UwsڃSPيPd栽b=>r9+B2O51ٿfc@tso~<)cf1s,ZВ#\{lkgfٝoUwΈ1vJKaƤ8Կ療Oa8;'/H20#SrKqxvmLJY#rwG\\ɋ{'FuﶁxmK~詸1ؕ#7fb5sKچ3S%uk8I!ye-}a8x K<󴪭j+PN j]?CNpne+[W[V'rۏiwx}Ŕ+'$Ky8I=]oy:n2JlмlN=7!>^%w'77츨ͭ8ܞyr [}u\t}RrgY| Ϗ wғK.;6 "sɂ,XkV],8e@V@{1;.s+ȥZӲx*dž@o"4N}.+D@a o -/ocW<:JAϼw"WS?[s7;`"k@o͈VUƟv -i;5W$Ҙ锬겋_wU׾_?3an5 7 ΫM掍^z\4?YO5^1@V qj-X1wSk ›͝)oZ{nLMLfAٔd|AxhaxW⭯@mz2"W>Z7<Җq2QQ#dCt#BDY:C_ M1 2fT,p%Q29%\ζZPbF1aQ&fM @ f7+Fjܴ Vq7|$ ݴlⷼ=އ0b7|tľeV\ rqPJOnmhI-,}|=aÅZ2#3|u/8{Vjن*!6Ltvge Tz̉XrR[+BikNX_a&8bӢzBC3OII啈Q8MW?FyegfZC3iqzFE$՗:];\Cz3tp8lv[savF阽1.{/$eWU :@Oy絸2doe6J%ic*h1Ac~P.Vp<-2yq;ݯS4IFϪC%INmY1uém >=詽\L(:}'A^Uo=)Gro}|(WR(0\w+$,Ǿ9ūqLucG\ _q}nƗ:Kշl7NHj UrT)eG)iBؐ nbQݒ`7=6*'捈cⶌU (NM?o%$:7Xph{֎5++͎ Pekvd@/xqL *n" =&7>JT֞SU#fԬYV>vAKkKZdec:t涇W -Κ)e>KZPqagt:Cl֜&!+:TpパK˺旫VDW 0Iɪ W6>'voAMAoVLu+VD^[>B6WV]qSICdd́LI6_4ҧQ\ӎWjDg45Kp.z.)6% + gǡ㽭gS1OH]6Pmߌ);YNHƤ~HxE|bMm!;: 3qB>na#iY-&ELw*AҾfwS RGEwjdA~G"19+Vb`ĉ@w{ZWffnZU;MoC"p⮋9<&m?=Tκ`$(X;]) u\0iZBVٻĜGPO S@<)KmVVzUFTO&l 9,*㜏]~kň :B3n};Ж|SX1x>%EI3Mj%MiO%MF @? -/ u>?%mztrN- եUlޝ-3`Y՞k2ս3/ op2^8 -S1H3C3ZCJRTQWƘ5_=[פ4"{Qg7lp۳ t茟fԕ%uY?I~.@!~##ֽ]9s,9vvU|N͛z`^w>]3f;_EgԤ5Y冭M҄іW 5Ģ_lEʻ^N?\V1gBZsp^.eJnZҚG42 ?"Iqňz傟OIBq] 96\Q+/ -}p&ȴT!s6!9JuҪ\6?(oN+{ڴM}tLk8bE7l[˫PNN MiB(!w_n +!VVؓ׎;`RӚRW_q!Rc3.zu|mI9O :FB|@|ecǻaXO;ywL +OZ^_>a"? RfWTNrRxP|ك—|}"wвU$kDR{C>5G"_}pE[uLQucYUswaF_˽ҫ'k[#:dѣ̇~cѿ9!c/Hl`e]$Q>P^_sటzfYw)YДZhE(qv0u+vdΚњ"CwVЈ۞W]'{,[~qݩGnRӇ S vTԼ\9%,8Ewoτsv|<ڶ [cE`'pFN<.n!h~3ˤƞE9펗иT~_&ɘ3f挊jn-AE>LMh t2a>\yoZv:QgL"GFUC`t(PGa/F]jfݚ]s87cIϛ@'gGO -x Y+yπY-|ZˊZ e17mhZL§0{o߾#fg{-{cT ?o'U-9(5{c~PKkɍ[ғ˖LY:#0xi\oycڛ&|Yڨ|z7 )5! @F}9=,sɄ)]QW]L䊏޿$tE845Pwc_pNٕQs)f!՛W?kdyfXzzŜ9!Cg: [RjE~fpkw9uiW f|ɘYb悟hUlȚa3z/>FGq%#|ʇ -&_rT{5TɊ]6k8f'aU\Ponrg8ȹqqq ow]d}0+(>ʡL)#e06X)3Ys{ـב*{> -ݒjA.p>~+YKeS~N@!mYk@(޲+mH\uf2.j{k;#+iӐsVzXg7F5/fՇ.[rsUVHڞ^EϘfT[P>"7mXvRv >¥N(愃q: qx8{Kl\qJLE=|Fo=U|Wuq[x:_xMn6jn9vFQrMi 5nΌ[?âK*I,}F!GϓxAݰF~)!/ 'a=W{uh[Zfrܾ$>O0;clJj[8kyA] ][.d񖏍?ĢZ3+e, :l֨>)='?EEJY fԨy:pMǘ]@9]w{!iDŽt̪Y jGiQ>F9 /-[PVT_G͘ˆ -uVe@fm 6jÂ`@.Y@FZݼ@$Dd FBٸZ4:D.5P۶GlQ̄/oy3* ,8y%osm^ aNZۊ_2brݚljK99+ArLjG9ʋ?il995;e3@\\ԖѶqyݛ!:->;>R^4Ȣ[01KXQ̬vFvXR`#5 u RQ.|}dqXwh1&wJA9~RC8-2}VP [~H#m/5nu1"}߾@UlyUWYa' nr$Ǧ\,_>̗-WIAEjXr:׃Qeg.qCh_~|S&87IPKfZݬ\`T͚Usx!`̻{&VS@|;iQFÂ;دW"vX{6iVߝ:JE̸b# P3^l V%zFi Ś1`Mm d{ޭ7 ޅԩÙL?=/bՇ)|?q"Jv]5 >Ps5 (i\? rYknuwo{DuHcVhENu{^I:%fw,DUgt+&nknb4=I)e WRO1c ={Jm 2Jٖ6 [^ 5jC aLʬX;ck~&jڀɟҡRc_pV}=ea@7Tķ(1n#+ 0ً&j`<̮ O<64Hx{xQjkO]з$̪[OjA  f;7ᡶ>Q @c<5kg4ĺ~X{y?.yYȨ /3vb/XăA݂͜$mhU4H_ʦꂡH@kmz5cJ+^6ia.+T2 1nAXl\vKyiEn(e'Ē%70ؚ 퀮2ҪW׃꼓 #ȬIF3js"&ddFm1.s=niwc۽9ݣښvI&g5@;0vX v[i@l9q:.j'5n)ȕ Ԯ1n߸#qBh-ذ᧣&9/=~k~2xMmsZ>a=[=k΁-^WG'4fx<,u|y½QrtVy*(Fm?j_fÁ(YE^% -8S؎:EvBRs%N)e! edyu_z/驔1a,)5>3{Q34{F^КW\줚8a'"pDO*Xug-RSĘ:Fd e$eMkH5 lEmi#<Vr׶yQpAOPZw-)椶Et9+}. O*Y!AM;y@u sQ['uqͷ|a0"A< D8a"ЂK"\ -+v&8"$nЕ[>j89 WO"ݲ1iFW:oJY=9v{ I.)$q S ܦC[=iuZx֡>{#^[礁ݘ7;+hCL -`S&j(7In1n!s>(z+ePbթz2UUۡ^NX03)0 =)LI^$v[% ?ac4(ARJDZ|x9@,z)35ΗMK\[S"ʘ@ r6l[m~l1[#0;!nF)`Bl^NA:tƜм=Mƿ_WǨ.cg[;ٙuF(X8h{稉adN-Xnc/7mzX2Z5]j梞{y]ƝP"UR-HΓ&KPW4R񲡷{'3NSD!sM,=g0@U~!>7Uq\/CKPkX2M]9`Ah}ڀ>lJVPZU['ZPG\ipVvD (Du.ӫlYi5Fd _2W]+ w74@-@iS*r9g cc?"P~Yox`eؽ{h&>If콌@줷ɩ).sNECe2V+ 17og5qD[ts`NJ3fʀVjUjj[r=6`^;a^`k.&|lBK\vKiY-u-VrѣFӐG!|y@ OqT.CzλPY+\-i1@17g=Ć)иVFXŐ7|>E.׻}͓>ڄ]&!%-Ssr zLED,6Gݙ^@7ɓ|RYe>w0:M"j椥ZJ錇ؙ3=i|#o=i/>0,e)P _$ _ -8uj.baҫKFS A+łanI_4AE#T*b%8d9YbۚmWWs͙_UfCρٿwU1~TEkAhM@+N@n%yC$a`O, p1'u%3%?ߥNܹ[rхy~$ &Y:D^aKwG[cڰV Ќ&>B/7{ - x֪[P%z ;Ӓ~P!)3r k!UL A&-^ٻ -{~äGcf6Y Խ7䦦_8SXR$6y3>J"O)%Q|\y3:G'y0@Oh +$P3iB+^.Ɂ]N<]?PCr_{gYmыo1"sf>gLf \K&1;m]USyo )^w%_HT[B6aR\ʊMZ56rM &࠺R*RI{5|!b`ucIJ⽚lʳyZ'tD -pPcE.** LV͢[]ӑ[v9;6l %}I -^ڷẲyTs"H⽏i'j -?u}wfOIW[}N Oaj0چ.`ʑP mpD|CG߯8^Tj;<wB^dґs➼@C"Fo>?bAF[dLNyM - Ǔ"/R.} q`$1w:C[<* bA֨?"fU2?g* pJ'qFp]wGJ2wʎ=wz~xpܯ*wjw[. -݃AykL}VSӎ# |MN0p{ CdN猴sR*51=Cz^ -q䏿<~.YG%ʈěnh -2 $R(T-8ZǝD̉;/GyGrx(!0;YIetQBtgS -?$fǧa=}w?? 7rOp+q^WXCUrzV @_:F.q%U ?xM:&ZvW-b>WQ2f옓\s`VEȐD9rg;wE?A8ϭF')>ouXJXf)ג._H2)4I O::4I^2 UJ-mB@54~ ԑ Y ȓTFܹ{-q9A*/.{v@wXԮgoϸS -ڄ kC fVe\wJE͇ 7;?.%HV>XI$yW̙5NRIzfU vS&-ʼnW750ӝF_ CgK5}go&OI+O)άށ=\C^Ĉ4醴lSC#61NsĪ."1/D]"] Q2|#JV9j^2xNsҬ lA+sAk-bNEslQDQK"^OQ7de5 6j{R8x!1Gx[2U!J[4[qfⷫS\޴U>eGlb`HW6H_4F/@]ʿ2^ ۑxa_!hr!Q{7kKP1e:]:s[" - Aj4K?NCS̹>pIg;.bHoQ,zeCFv}VdP:  =>kqPJk* uBTV4砀Î>E?dhy:pWooOwAmB8oe~A?QódtŜʺOTߪ{B{LQ5}O\[b'<"j%H2{h$Zm8_w⸧]G^OUs7DKtzRCȝTlʨZ#ƌZlh$pJa[P*Rx]YkǪB8WDQݯҔj5N(#t̗y -_K 9&o@*rH&dђujIoO18П-65Ȕa]Tj*WyqfAk׋OLy'"._/钝شPWFyi3)n*ŵ>խS_*a|@`Qۭ@JҾw]w!&5j17=rCyoZc3Vjb`в4LXԫ9RY*O<`7[< Puw0}X&͟){6 -\2k>t|36]1Y暳+ޡF(eNUghB`Ʒ4!~nC/9OTCzRI zjٶ[^yXi3Eý1NkxHh8=fvvOKʶpI& ]NM Zx!vgQ!A|`;Y#p: 8dig/cg/ S~P΢厛a35~v -q"سyy\al;^dU燎?EXQqcs0not'랾$d7ZX漢-iϋ>߱6Aw$Yq\?aoy놕gܙ&,Ty;fݞT_J.7s"K>P-zy#tClS7?+<++?Lq3E>LR_ޏlQLjJTp),*U>0}^ o]娾N3Ίuy¬"rTSs]3T*WIvVڟ m3+n|2ab Ytcvj i8zAT}A| \ C5׷ l  i›;&|mA/ 7ӊg6r_{&dAPy3;fD/^mxe<<?8u Q+8wnXsѕ%U+!f9]j_5<]PV_hAyh@d|%cv݄ (cAtjˁ.jy6*hO2M5M[ϹҿfjnY!3).2hnng. >]w9p@3偋Uvj˂):΢VpS@o[`i{\͘=H˿~Gdn)}C潻-uYn\e^G},Mp Q=4mXlӜ;NAmQQ#A-Z_EWEWwͯwm{%ZV ;2wOl^4Asؖ'm;n\վ0+{NZpsY^x悼._U+$3bZϑβOuGGVtseM UJv=Цa*8}n\?]R8DLvN!wʏ!l۸#@V)6oo+9{a7?^T_Q6<\;2mjI0v&^X;f\[2;zo~֢,Eg[LJ;[||k3m׾y-suTBKi k!B]@<]Cff{f>C!rDZc-N!#Ojy`a0& >y`+D{偹v(8N`jVWPR2 d(&>%N3zЏ@^mκ6ZxeB;|/}h0)f!IfC?5d_ԧ9V"g=2!>7z ,P$7ZzSt6)$dlFۧss?a5\~V72lC_Ɂ~ȿ7w~Cy̯dz^&[dՔϳ""q;CMjhAk -+'+/ͽYKkɻދ -xjsabc퓰(`s)2籚:@>';5X9סFǛ&`a[49ͭc4ҝ|sR%ry!tIDSWY[<^-w7QXvc>=/dJfL\ -zG̢ Het]y˛اQ^qَ - ap\/> Kmv_bQ] -Z()DI9Q#*\()jЯ=3Ч=ۚ_O! *zYYϳғ9j[.}&뷕3=nV;݃AJn/.bo?>[m\_j- 6WDg/*0y =S?Ppa` )nuι感U ?k2/fHɫ Gkʽq8F-w'|?KiFS7v:Rj x!0H6p J(7' /ښSm*JU)^dv`\.I6%6~_/fg˦*V7)nCݞk~=mmϓ_@V]DӘn:5Ã?D=mu5?>3VzG\^wإ[})M PC4:hPdݙPyA@i -*Bn_EAzbZSz٭UV~[RBix&0ә=]U4X\͍?;AQ-q^{  =YPnV9eg^:6fOUɡgwGȉ6T׷*Z>Y $r;bs?;sXUB -ԥ",!ZJvwQJ[5N@ 2 39CM[{ũf,h ʂM '113>Bˮj_+= -MFP45yg>QBVO_R~qHqG -11- !k0Jk9y{)־J(adJDMAzO)K`[ύ0RNMSN"2B9O,AB<o,}a̽I;?M8R -6+^.8X߇ 5 `3q|b)TMa -׻wBluJP) obyM;>;m.x8OkKGK<}Ia/9!ZeM -Ⱦj>oC0[暄=q3ힼ+?bnܳV1o?NJo06Ha«s -qKMeq&M]yG5^pѠ6Èw7;ΙdfF0am)߫< &fEnҭ.7yXq?x}3?_;GNlbߔܐWY|}YӘiD?u1q!^βQ\ubgFi XNoM"7z)#[$`G۝MeANJğG(a?mh]>|o=?& N4bSށ\pȉQLeBKŖ[㬬j-{wM3bC#ŷ =6 o,+}`pI1Fzg g2s[QjAF梻ܱJYIZF;ڇ*˽d Vt)GXGYIQ]:S.bb afg 0N=?/9Qabg -s04`4dJA.JU):v+Hҧ>eqv2㬄 2>/'M}rQwђo\YJNt)>l+ 6t%:ꇬ8. tc $:ppU÷uqWO f o js[͂$(Ʀd4?vO=@zԬ 9YcWwz#auJ+&E囃ė3DKYsf=+q, WSE"ζ]׼u9bKoo!7Q撻ݘnÕsM;,cXܫc̈Vso/6VD%D_~{9Lf]f;DIֶ@ цz_c=QVJ2ua@?_x{e]C_M_+h0; _V'y{^;nV|#ԄLݔқ[QHǔŖ؛ߌV=\aaO+9;'1qt0%X ]kUES7+N+@ |*P(tN2?"'8I?S3ٖؐ W_Cnks.+y!#5\[ΆH-WO/6%RU?ߔzf)忛a/~{5 s)j/Ҏ|n 1c!N/ݴ װн>tXQ :6b-5~!᧝$ERpj?5?זY" 5V]SxYY`8b42Ry\mK!Ef0g;`! Fk>ٺ Y׬'lp1q= 6$feN .$>#=s4͚fGET?6DEzTyݗqw[̈́V2z&\w`8GՈ9d~TDzۛ= %:-FnRvG Q+[ 76qbr[UC6&YD.lfG鍵`L=W`]:Ͼ|_zc]+.\9 "]J7$Zhy-bCCw=("ٯR5؟O,4s:G+K˓pQr9۝wa?ns{ -p4?f -hY0ks葺:a;*CX@?ZkG<1;&iRvvB0 f"q.tщ;}^80])@ǰQ[ذTvx2%n:(/ws+]+$9S|{%RSS}5Vv6M*iIbyʛ+ooY&ȉ+ 9|*H ts-?\@źBhv=]IΥ|Zc*bbG%}ki2j!7L6;ȮU,o¦-`@ ~Laa`y4|8=!D{>2+dzbaڇ[ڦ3>|gF]i +(r0B0g_^o@nG n,>ɿӍxb%E;FQrbkѽ«izM1 _"f`AQOb7)d1$'o"s/nu7NPN0:)c}df/ o)s/~ğk(E}$,TqUQvLW">ÔͨW(Y+` 3J %wwl?7[9]톆HYg{A\[SQ;2Ն_X{rs | >KJ<%.|V~ !#&[2/ B\T4_W7Bn0O}§˻wm>[}~CV[{#љ{ !hz{gZKn^RcϼFh\RNgx0)zn- s+0n 9SEBMp)^6x8^ d+QV֩ v$-eg]h{p@8g5kC~9:ʺ/[|qO8;6i ҫç- #9٨LiV!Wz -nw[9r yڔ|V12IJC2|E\yu3G- 8\oG?2^JMqOSR@kݖr~x8Ջ2ry2JIXh;fgE6 ›K{$_Z}[|m!A+*3.'Y{Ե Ҳ-*ƻTrU"-#v) Zڭf̱`Z.45 Ur!x6nS*$t!)\e8 bYӫdCƇ_An6>LxdŅazu\&L?Qro -.G1v=}S-S7JM&o"0觎Ijs5Jr.|n7V;M~]feOK1žlu@'yd ?C&DGhabcdF1aIbGWE_dͽE<_mnu1_)2DꇊpFx m*F2 ec C!)tQqjGR)Yy;'UAqCA#ZmR|ᜈH9!ɦ[c;G)smǻÂRx%9ïpatZW}P;v]!ζ_q͐F_HXd gy[;5UY]rj}[`GvƵ>Qa>tm)f_P=Ym?(f1u_NJ(ncWA~P'IjzGݭ~x筆պv-9y9,.WCO{=׍ -3ߗ3mS I|OIH>ђr=e vK=W: -n1iF Cbӕ.MY5uiCtf7`AVrCUC*,uJe !Gidžy;n}ZY?Xk-"|4Kw+)}@%k)Q>5ܧd[ƱQ[shc&gM*P4.w-S Ss- OA=5OrO ;"qS]tr.D>t[\!^p @KNRӴ| 6ۃ_'ṾP`CCo͍.9mBwVLnҾƄ[C:^[O-7X9M8p@_ſ0O2EG OOL@_̿Oyzq}z7\$tbG˥{lcd>sNbcRJCW+ͽ.ku*hFY񒐳?AIZAf){Z}ӴL x7ϯaB-1Qn%xhЭb&ɗ?\ps,:O]P+ݴ@gxb@,y`#%BMUKϩ[a[cհ!v!IdjGIqcSkկ˕Ue8U9.dM Yީ#n==pHJ=B1MQӬ:fE'Scc |zֳ!#!$ }D &%"YJ+XŞE>ުfYehPݝ]Z[,6OT"WÌ,/ou!nvUgSդjίSFKͥГ&&d%'j8Yޗ?Xik97ǐ/w ȭ^rr&t&Kń+ٛ!k25g7 BRlGIp)9eF);WN7M-J~qSrCVL]խ>Dc:YXdD+%85I]^]^_Գ{ pGq* IЇӺڜ45ɧZӮ4A|l= >c %`jGGZhia.5*?V)5 's4>+"ĸBһ׻ %`yUhiwzj`.Wզi*1Zw;jJ'[ Iϧ{t|[ǧ5| hU(=\ge=Yfb_7j- -y[>,m" wG8$buƁ/MߪPhV viz]QvR D0"=KlU\;!ٴޜTMI\ZSد]b?*m^5b[a$O㨰{KOA'|ۨys* -fA`_K+`~wvPɦ10qg]AZf$~Dޟk:3Ɋ^.H<ĻR(sN0 1 He}ogP.q=wg5̴+KMޢ=ο4u/:ZS-Zy0 h9^L BSeOޥWxߩcoSp/)j[M-gr aT)f!ȇ ][i(8@&ٻ%KoS̿id4#Jg8F Q}l#80:f*7U3`.l.iHEKhBL]05N2W:Jn-Zz_W9;YNVb ϭ b]ʡ⡼jrGE<*PqDysAEL^ƥK]_h͹|0kSE]91֥`o+tx฀<7*4edη(eOC랭_ef z1=Em Ÿ'б2BKÂγ>k@&9ᒾlVQP38,0{Q:Kȇ7cjQY:u.xh|,-z~2/ٔUo>oUr965>۪D՚W֛wr{T$Vb2le ly<.%~ |Y] xt"]Y1M -Jo - C4[7;uqQ0/w <_"xawGa[̈́&DXlF Jh=0t#M'}İqaMQL[+c^ξ{8,7ZoϾm@β{&nく:UoU$>EԮdlwƒ;/,RZ7Gیu0hx(g@6g_jNd, uȍANF:ŧ$!*q1fڔ_5icD_1⑲rlS iqcNN޵kDnbD?'훲.юTZ5liTKmn\L}5Y6.ۿ:DLSJLadV4e_6_F1ibѼy$쑡~]z&cCLcČ7Ye\@; -nW-վ5Hdg\{{iQK]HI9Fms`/]+h{dhWҊZ>zsROV,Urs<wV<>.}!Ⴖ)y 0gKh/ ^ yc⹢5Dz``TfA?ץV){%p^L˽BEƅUU] +UXzC#| bX?=Q2ðH cRa;3"0'm\T5~g"gK((IiGzJ񡖘]${V߮ f ofYhp;u?oԼ Ӳ=ZNZF>]n+.EJLvy_TXP">rB~ v гIx'*2ׅ q5~lfy H+p@D"w4GTY3?T4B/J/+󯬽?'U㬌qVKu ?LV~0)Ey)w l0kK楅ʖ{_u,d%lol3|]Ft=9&xQL\ȡa-w-bwܖzEߘ} -gS~4yD -?!bk}߇KUve5,%$=?T3NX +KKg|zrC,6 rsӰ$b"śBno|tm^BE= 3LŏzRۦ)޹=ɱ+xC+9&"GG[i "LYJh0 s)zJѧ:a_ʆ,@gfշNWzAK notB{ttHQ)mWi}kVl- - YPt,AD{̿v*]@ *Q.(/5\CM5FO]:zʪ? {uk)ǫu=u*\ C#cMokCt* ٖ0 WVUߩJVyof-6ELiϵTUtXWڡjz[ϪX0;Y3zj@-@U|eMd3{)"%軥>znl>E*-yQ ^U5YM6H/  ߂[`WU>3B[pL*lW*SMLOaS~ ӳThm۔ -յZq`A~㕶'?7=n% k_Q;TKE2S])Bz)뽘'F4#*?Wa\*]#&Z8)fgt!0Hۧjs,Bt98F7KIaQJ3I(qQS,5שLvA -qʘt5+=s4,9֑sӘANLp:&0|v!<3#5%!Ed7AX$0<i!'[ n cy@.5ß_mq,5133w8OcFՔ<q;ZdT|Zrω9!B3H? x )ku-916̓ZdTlGAt qh@qP:ǷJVhw3P2zgTd$es-V ݠGVߥ=:5u2Ã˯/^_~gV Q>·bw^Dh),EL Ԡ}SPrJ`=CVާ3g^2e]2u iV]/M]Z!pk0q,En?M:x-=ٿ 0d= - j c#?cNr -6G@!~5= Iev@=?4^23f/3hF =٩ɉ\Jܡ`Cg.54[5)120'<%DN=Rr|::->&vG˞'p'uG(Yen%)ӭܯkBA&)#[Ij.!D*$b -x~KUF>$ڦ%Uqo{& >ӡ`ҡçoO mOì =7߷xMo˦r]*t4!xSӪ|}yk[(Fb}`UPs{Ͻ<>o ōE&@ߝZU,ʫwGKu53%9@Fqi'kl{Nw#' ${l[URSfs\ԑY ޟK_Vjk =I}c8\s)X9\)1<}6. p*)6%ա`|Z17^pøլ"P.e"#bC-vLrz&TzԀc)uMUEq+3"q #&lB] 2 !94%1r&tKF8YqVL2ZqhW`v$ԕ^䓍A i녁ceUvW -NeaSl -z0>2:\QO9؍ƑIan<=[&} $9:>PÂzOZb4u꟣~Q{5 UuͧU&xn+cTbb2tn7|Ko]GV)%ۡ{5?v9 -c= c/\Q/_-1C+ړ X5dS\T%|cX@Ze@ k+4hs0EK}5ūf 9bnjͺCw8K/9^x$hm :ګYbsRk*Ĩ8Y ̀O<)F-~?2mbmr؄S_GhQgVCi39g@Nhp0"1Oqk9N9צf4\bmQJ0NNǫbo^hVs<뱓_j_V,C.>kzϡCVL4ԭt `goҳ:_}=Y O\rFF{)NĿuIgul}٠Tq_v>x$%sg؞wc{<ީ$ZtAN$_|^Q>!Go]&d5rQAv!ulai⢭843Ӳ:{@/v*vޑ<= -v󪙥~= q<Ź5b +`8>ʡA7p/m%7O <h򑮚u4'IbZLl ff0 Q N USr-)xP NM ӣ"{B[ rgZ/,e8/ˍ޹wr>|9 YL@ΤkO7>X|tk쓬R$-1J>62Kh)al|KշAOk>>MP_Ik9ЃqD m=*:xruK˂8|wFr/hVU{|;AϬik\qN959 532 JQ+l-cB=fFy.ܣ! Zj:ģAMG`!QBCE/6WȓXǻcӉ&)9Ѫ'ZX𾂾9Y?b~]khW,vPҡ'+u6j^Y"p¥$?X!` 8)48g^{{kiK/h;n븏~?ye6O?kZ]2x}ߒEwO{r\Ԫ&}Cr_RXpyhsϹkEC[zfZ?!?ĺ%ͧ6<]83]goȜ}rmԳ{fRh}Qi_z)(sA=/sb]{}{`oOˆ{3s'zi[_݋zv|yzCnڹ 'Oߜy9.njɅ?Ω;nGߝ{O?9tkכ&u}v'+{S6t9"蚧:NwhEyߎ1Ck@o >O/oh=oɵ?}m:ޝ]ta /SYv}|jK'Wwvm3JS5Բzg`/u K;NgpzӢWu7\g'?{pEOvrnŤ^qySϜ߹pw="?_x ioouԟ\74}{r~Kf+[ZʮKOn?}/-Yr}wu=ίh8zvYu_{mn^9vn {S`_޹pi;?~ >~aÙuӎl?6#7;Cx'y:;=z3,|;>5w>yy.~s;{Ħo[35?v=]]?v%߱lŽXø9㎂|vBأ '*ss.mϿsƉ?o|wc+6v>~r#ޝ;-nXo}̩ {0v79qUO:vi?{̦#6ݻ뗏>?,ۚo>O-ᙳ;w~??|荖G]>Y=plCCW\韟9}nGϼ sg64X3Gmwb}wW=ۇ?GJi:"/q֣ۇW7ﹺ̥ٗm>~j‰W?i+?[̌uN3o<~ﷂ;l~ae#+Lsq坝3Oͽs.o]c{f~5ow4NX{Q>{|BЖ;ōKί|Y?73~u~zuvۻ\za[_ /wfCk-G/|䒋`8> -7Ów|'̡s[1xdeS=OWvM<0ڧyck.g޿0 -3lZYߚs=񾡝Ͻxn??>u3ih@3O9jybmK{6t8L8 qG@Gy~pEߔO~vxw`_[^K[rGlɳ2_=wz=e{/7;<̉ ͟K^7.ll|얃+ַyus?c?c+ǁ_rÞ=m7=pbMġslȜ¯3ǯ-?{k15;=sۺ o9"ey=~⮎:GOܒ<>>|~7:v;즍>~y֗㣷/֜ټk?9;33=rag_'O⮁)jyB煝cw}#o|:uսoyC-W,~acs['ޖo:/}|KǏq?1;?}쇎?rS֠r=^[_쥭7w?q W`ʶ‚K{h8nIO>Zpυ]m=+^̳gtO?ahm kSgV-|NM˕Gjά>ziWO-woQ>C}w]=sh=I<smw?{f\ؾ4>rSk;'e]WgE[eoy>O~?;=`.|S:,Rbh,힉`^38p:.˟3?,PXԴ}[坽ԏvVooB_؊&Oւ27u_[=}y`~Smؿ>ڔ;>_1_=k?_p‰=o7)[d~Ozyg׶=|i{Wv_'}oqھwu=a=go>=yiy/?ckٟzjM66Άs̓ۧ9l:'[Zvk[zf_:VS[{Ͽzx5\= mS>xq^X׏~ĚdP:>~yk7w9:N{b}K,]~g^<vۉum.ʧMz9ŭ3vk>{ wyg\W[qɵ} ulmǣq}ܖ{K{{L|Uv;'^o<ϭy}S+]suasK֦z~:gչGOlb_,~qҮ'h4?}igh<5_twz`??y}{Klyy{Գg+L&ްȚ>WrS5f֘๸>K5:;έo}kㇿ}b^OoZvuIg.n}Zh4lw'{?[ϗnsag܋ }yc~>{U Ӿˆf]Sh̦f]~?Ì🻗-iI oκϱx#{ߧ?|bͲOz}leCGn{݅S ONpvK[^˟+ -}lI֧^Z}I;bO|{.m_ݿZ3cqĚGQ\;'C=?TyжA.>ѓ;&6um_/wlЖE١m}{^sZׁOi_eלoѢ{{XG֋ڦ8oS{+}5s;ͅWrή}:+/no}{NMٵls&~6TZGlu>?wS=w>~|Ի>]߀Sطh݃]'k5^:ܔk[t]ٵƞ-ygxZsbU槗._߻7G˞7}zuO?c.7o`\tL O?}eҁ k_+{3_W.8n1cצwS.XVb f̦K^=̆O^smwsWs0~3k<ޥ O< iv-鿶{^ } ^`%җ9Q{9~?]}{+SWgyywo/}ʾeO_==MOT˕_8 6gY m^}as?; 72O-gO7ns:9!lv㳕.]'쏏}oo%]ޱdѵ_k銁G3W]_f zoNW_^L8{q\Gw[Q-l3<:rPpReLشemWM>_ d m&/j% 6 "5X-*Ef#ͺV49:' L 4NVN1F)՛y0tKXkBЗo*|)+/r]il!= KOv±ʹ}K嗋WAÛ#A,3H,e]EQ;Or*DJku2Gr5-חOgʧ۲+o\gw7[(i}C!Ǫy=!R36qN+954qN4qNAz/c9->ȗoZ~ߴ%M1)M\&iKoStLkK5FU2Z)UV:$n uňIUhoyB?ib*M}#¯S+P7?"mϑ%2J0*A61Q~QkiF>/*&,$/˷Qv[ -U.@`ӹ\]ː^Tx"QFz3}#l*JHueJ@2f-\Wo!u3oVn$Mœhq}cWKZo )lWh]l z5`< ss!jIƔj$VEo7f4Ri!~\!|vaT|#*֨a^FYg mB YjTȥjQZeDBX)HpofE*MD -|&fk5[^%o[aTDFc9-zX>d JZ7x̪$^ -'oj]5l_ 2U>_nvJȩW<ǨR%Us k\~P|ޫCG>Tv)kS%;Qi[;JL*&;nMvt62 7:Pd%B*RjmFIT<V+}eAijTWWcZ#.)\؎+>v,ZH3Tw56F&腦_K02 Ec6љ/*?E\e RJ$E G=PQj% Jۥ]Dto|x6wʵ Yܜ-dK{\8vd2S鉹o jp-&.E/hrl%4:˅Tc x@iRҴ P.k:KBBlGGI' -:ʸӊr%HjV[։.vbMMd4uʥw@ӣrԪ,SKMUo-s/n:]Jj*?gQVKśUT -UM(4JңvԒڥv)]k[vT-#]F? ]laYU5jңvԪLh|)j,*eK:\Q(dyFT|i@ͦKI_J+/xUX h%bQW<%D,N@ x \D(&B1 Tb"Ţb0Xb(SkʉWc5i7d DӒ62?JY|*`j)Weݢ:Nf:t5x"xlWs%5ʡL00WʵI;vTؐhUZeRKhk4jҌb6RkԱRR ?|>DkJFߺ#_Z=*>HRrQ29|IbkY-)JbU"ӹ\o7zc9HĵH2agf`!2zgc4!ԪXy{y*-uf -%Uʥ-բoJ{UjVZĎ&\ [j KN&/#Aͯl~Ol~OͿ.JI6?Sl>הIBa+J2Ikp וanVڍfCoAf[Zz3.Jj˅LGGnh;mx67^lD_7Vu*QbˌZW*~MITq8bU,+ś'Z界mg2]c͌3 ۚ۟ud -c汹|k҅$Xv*>,逿 R6ajq0¥!'_(sjB +ZCRCy,e/jKow& c[:&S)`78~o 5tI$*D%$DHTJ"Qq'DHT9I$DOӗ;;~צ m4n3|Dڨ?^MML UIڴTI(i/qP5qP5qP8\5*AUwjf;UGZJ:o)7MZTgZZ꺈tIQGbT@z%kEN逿|R6e/R}ʅ 7, Y %&C2Ahj3$K.6)E$ݹL).QKwo&Zb@Ko>&6h0FydtWߌђdw#Ш(o?P\!|\XF#t8 aWE>£!ԪXz{ez*-ufJsqQʣ#[ʎ"':9`UKX*%Q+I'ߜ;Y-zd͕ѭ1Lܝ[Uط!snT3\:-p=ӟ؆RU\+A1Ir EoxZ|[ѷ 7,g)<( -,Y=٩mj(ś-uM)YjF+۫.bwtۍt+Y-ݪܾVS|j,1tz\@SY -5JM‰jNT8Zq|%] S]-%\Sc}nMD|n$&{,$s%qXFd餢+N&rs4>ݮG0Ar]S`ZV+3ٮ~ۤn)ׁL +5nM5~[" f-¿= --@Q3f<ޛ5j5uTFWuj:azT c {uX`&uZ5Jj/fT\jJf“v.uh51KZpm~Q:vVESgű?jթYS׹^+Kq 0U &:J5 &pl& Zږmɕ:@R0ekT6k53-g/}Pq+mDS-\S4- L%"zڊhF~ILCZ&|DT 1]** 0ӀA`\ڮ&l]3ึaP -ڶ9cf1Nu] 9D 8viް-atE S1qahqZ j. <|:!̀`*.MRp(mi#S^a ! SﻶfV瘆A8C: rmx/b8Z;u0:0ؚ+ - #u{DRQ`.%G2L@$ 4 Ib;&M̈́4? v ՐF8£aX+I0]^;( ^PPAi5)ƪjk$pTI<;#c(,aHY0<kIP؈ķ8KP?ɡl^ Bs UQ.iz ǥh$_ LAsl؂T3 oMGu buj)Ħ:-2XNC0 s q]Eb,Q{.6@ 03A@b⾂iFc\3mX`VR,dT{W6p#r vmҩJQ8`[[GU1n9@D=JAsp5bHℊ3Bs|c6!GP&#vDq9.z))h[ F{HdgH: L"B;rhtԨi*/# Ea.YBYE☼ bxK^5 FBDe- c:`U5qb&G~@;lĐ1§pA4耭ajZ?>= K;ҤUXȶ8Ӈ\BiZ`*3-A#E-ZGXEdLqT^[eH:Q|QtK҈x${ZqDt48$9T.)8sX*p̈́,#,_'͍E+" ruژ!BR2@QrӞ`$]g =Lou)wG%Ss0U&m|4tS|( %Sr$伂c 91 7#kDhjPdưf~%}8e5k$WRiN߂@ix6ɛ4ZpEj4QQ& b_gj/PĜ^$-*az:wC#Ǒ2 -E>]sl|[& C݂jfL HT[}DȎSHb(JY۸p;[t*\' LK%Kme4\ &e$X\"wDBE]*D~8jtp5<* eJDYA3*A0~GَW40-8C@1a\}y/d*dYO!SN; œ(BϤρ*6 -}mR;bVEEWuC -@e4Q 0(j&1H]`Vl,"4C 4+fEfu8 F:)A+B '-N8bx be#S1y O!k0iH6l,FHm\8th33`XJ!IEA!KfCw1J\zDzẎ -@xilX_P#Ee#h& SlV aX@k,giy \ -?X,:ۦ,oBXx8+"A -6 M .BpHaA1CǰE'ȟ= "\p~K`it2q"`4~t6BE`PlXS,KlFb1(#odI4Xbi")3,}io`2w;) -Z1İn?r0&`FQ"@DN+80jb 5f E9SdW=J R4<-b->zf5| c0"QX\=|bO XMGdDBAa7  -Ejn<:2cwzB4ZHklF86 ×,sl{!p NA;z;o:/@r9qЬTM(%OCFXc DPYj7zZ!#`j,F=tdRr)H 3fF/AOӦ(?ЦIKdbn2)&LW8\C|K$?G !?`Ad$<(Yb(8LO!֦{p6 -"9Sk@ H13\haT0nWA$S0tJ&5%d,(M!@j H>f`1V!TާPQi(҄aG3L/2^h7()-E) ] /Bwɣhv)nF E3F, fߐyіaz@( -$PFq0@*;Әe05JPKEӁ$Նͽ2tς@N/gV]tcQMIbyɸ"s]$IK9-mQ5d#5%E)7\*8V,64㯓JSʱE,)Ih.ߋ$$[iS G!/Rm{D3Ũ;eP*a0fWTcg5#x0"y'*ҴdĦ\ ƨB[72he<tQՠm*&r`]A. -EeԱyMK1rgF! /'ᰢ6UQ9ÜQʼnuRp )HgI -ELõ=$ʮ"ijXn=AT1Gĝ]/K"ԤjJ[{HS0%G]`X%ߞ`K(RL!-ET?'Ab#z!7̆\e)%re% X &tt2J4f M9HAb\FQPFI:=B"*ھ$s?"x:eft$#sA(iŽes;Iq<źB:t6I4)ZCQgsZS#GAgt@ӳA%1 x,̉k y.W'+ }.fd˺yF}4ǟ¦"4"Lia^^"Iƪ YDjcU4{ZuCx~~ 9AnsKl4H%0Ѣk~NVŲұu4-IǓa[Ps0q Gl qlF:4Pl 2)vM1~զoãIAB9:KG|S^]5ܤBsň46gb ʹ2_aI<Bx,iGj~-/6 ȒW-iyњXP zxA0AL`*3Feu] ԜX @ T5M8EplaeiKfr&r*:ʐd9[=rh锺2r뒠0Q"U3七&`S;k/"ny)XʫY'Tv!SdڍFڒHJjXH"Ė)Ia$.5lVEhX.%\+QԱddWPTx=Q^96UXg sI]oE^C*fҫ;0Q6AkIٰ~8^&;7e e`8("X9+ԕY)>DjX\bܪmp(Q&bZ;Ka*M) -*iXLRR3yP˳˅N Cfƻ22J\2[3lMM$R϶^R$VI-`Vv~Kȁ%a'V(FAM -Eؼ_LЁqQ=YĹ -ت(US̡I*TȚXŗ]ȺE6}  ʬ(މ, -HaS)#j!)ta I0.4pC)FÒ;"%+sI#<b xppQ'VM,dqXTxI(J[e?bbZ 4Qpl 9KT(%lJ 9~(J`bKTvP1SENA0|2;;8x"ӌ!VDw(RJgS v?kZw ɒL+NHՌ/q5RRJHr< -% zjliK225mb5LҮpEFתih.$R(5#pX]U*Zą]rE,8.[V/"IOqu\{'3~|"ZҲ0ch79_B3 BѩfSAC$L,9E$ f[0)VE҈&Iey73V~:4Ek5r2x]#05HX3ƦĔcfQGW$hTEA*TM5*PXe^0 EkiqhTTɕ6 -:D%Jչ̬ӡؓ2<. WE+"~z9BE<9 wF"]dSЖ3((EZ"Z[z;aFGA -0P9T?0zKfo蓓NJYHD 2DBzN!MmKb[-ŀj8n\ -;؀|4/ -XG( RG1eUJ9g5 -@#U $#Z%4NBR= S:F.++_u"}xlqkdBK Ӵaj#hZb-V+|KSu^3D&(RwDoŊbKJ4UˍbI1~di#KE/YeB44@Q+6\^ - -x-(^1)H!WDM(V'RFAF>Jw h]ؿTȏ/A0aRE3,{,/*!(V'_]ΛHkm<Il$'8\0`O96Κ`R -ۂ1@9x"&˖)ȹ[.&E);wh:!ty.guc ׆u NSl4Tl -0w"ѭh+au #\ -8P0tzV1zB6RT#F,Bnuw?y$45Cay@7%1Fۈ{G"=vn(r(I -;[Qg,`uA".JNINY# ڴi Q8l !:=29QQazC!+xO-=L~'և'ڨ'lLь@'f\7uqpHϤp-\Qp8CZ]*0DvѸLct)FhR6L<Ś((OzdA-?ZrP:^*/O_q- #&:Y5L#h"t< C ŇF 頳07x3CiW]8 slǪE],M%qs$bDG, FX\-ؓET`#z"mYlR -r/8Kʫ5pRTj ObY !Cز8oC$51! ˇD!utBgXȬfx;kf=uASu*,j&/ h>k. -> +%˧qi3=Ga<kHѩ{56% <%&,`^ç(P ߳>$Dr EWh75#PtSzr-ie08 29y09io^iv\ XabFoe'_xΡEVd.N tAC$]* B;9v0i J!%%*fbQ-y=lh5g IE|P5ٴh4İ8 t0oޖ4 Y0nPw*]%q4D ޓ; |ۛN5ODZJa#{[I#`=٢ýePK`t}h-M9W]0e`0s |WLS7;=w YZxN%L Ξa, -*hb6*آi3^k<'f(F )/{ʯ4 e)ٻ򩊦xOmS*a.0D zbRR M s4yE˅<4nuz|H΅isU 5QN_Q5q93T>0ܗ= ͕>qBFlx+:פlWiOuf_om|i⋅EȾ+8p /8PmDi C/Wv.i~h|R]c5jf -5v'EZ"omQ -BUsHc~0(&uY@ۥ uǧh4|3V8di`Y=YbDaXAQ&lEQZ0Tm؁Kq?txi8nUI6B`#`Xd -{5Zz >stream -|mU*x#"ُЌiqj759<ޮfFaN"7Q~66tz^  -e@| d%'/}{oĦ7lC5x Yur\t v`4x(hhL} ^t^nqLE`LMR^,cocHˡor*5w:GT}JP«6 4KO v~^sLooLkHΫrS+5*F0XNGFuSjw@sŦy6@j6007zE1AT !@4i< f -rLH[T3yDpTc5)FK M6* -Q,z4d ėXc6B-u0!v]v6š01R f-d9X윯sѴuۛ5_u1 ꓄Kb|鳌oY#k{N9!_QF S嚸X2$YK~uo U{h`_.v< Oxfx vlӳ5]qy9=]c0pTm숏4&qZ  lWQ4Kˤ_KvUE:9](N}+F,f:ݓ`;:˷E H(ы$[R98-UE\-O~6|LJ.{DeN\1H Щ276q_Z&ݑx (壭{KwU<9i&䕪sj6)*2OC؃dSvx0]nӆ-kgr[#-g7at!#V߸XONbߤc55UC|՞ -nev,S̙TRCH{4kW,Pj \5jixV0Ȣ5L>AQN:P:#[e7x΅BZ֨4M~}Q`fyPuUX&O`(Z.xdLvj*to<'8*d5&J{#eçT,떌 crDђ6h^oܤʐv y20zHt9kys۶DcK,CKL(%-bȌIMc+*Gt:]ok*60A0g01M.nkaI|5<,/Tgmq&[p1;z| 7o`;.)K& ܪL6T,M^ EI2bk˕rڂ:J0$q7ר WM{;]s ƒ#Q/ve1g[/^Jj"gXT:]fH":Fx>qGFBvEAcDC!P(YMxpiͽmU}&%fג~lE>–d֔d ԙQBjSuAKPp(IXTH_S17ʗ5y"]& -C4 -!pYC:V8$L!50Be椮 ]ɕlՉ6W܉v((Kfu%3M0d$}DF%%6(Oq?HS]0+oj]n uluJq׈֮"t] %k( n0cvnOfAl]c.8OF%V6xB׸YXt3} +(6n)S>yg:1y:Nl⋫?itdl76kK9 |ǜlS@YAEYR CFݬ:z%’B¡-aO\OiYǓF6ߊKF599\] Δ] Uj[4{ay[ǻ82Xg[æ*M&_ٷBN֬t5h&VTF[-t#ՠ:c-٣ `M9&;gYe.4VDOQ - Mlb h -:Oo2-/1*Bp#\1zBVBe &VsP%T]:Mm_m;n,![D&$%upwJ(t;m%z [~EySF~]7(YG̖wK5jWq7ηSh*|o5?ℿJ{:_c؞@ưh={;3Y,_HHZCh#I!=j"LvUI+EH`#eqp+qoU\d7opr 9` /#n,XXDiFšUL1DA" t4~U4 n!kH˗)~{DbAwh2D4dd}"ߊf˥5A:"R-"ȝ-LeUx F(w %}nwdgzwbNKn:#QZAz >STBLxK '\4ه /sKNUU4C'R"y S4QpfxTF3 ]OWC$ -wԤMg}a̮?cg<4ru#,/,W7;H7Ba7v?kyRBR:r8|:dӁjaOپw/̸ݬa-ckLl :$i+j &HP"HsbĖ HRaA'[M>TƠ~uGt!Xl68TL[ `n/p<&. EHlDja1HҠ !\E" -CLlA=F7(%4%ؓٴ;QRR%H׉`|6(8XLz)S.|f8?A2+T |GmS \)VWiiIep(< ׽} uCԻL jҴ <%5a=`T39ZFB=c\@wEd4^q(_`Xi! R5P*ՍGz_'A -Bф?JYP\XпH/D@}{{) I -wFQca4M j/AiX|lye4l}}KxcU'|lI(ZBd̠eL + aTqo(,yV~C̏d ͑jH@VA% BGFd:)0kC; 5|%_ItZ(^ ,4sRZadOXxP}+% ,ȀD`[D)B]XY; -3*qdRE{| -d)q!$wdAu58(_J )RZbA4jDNHQR i|GC*S cs%ts5 ˨&-g:=G: xsĎيEE8#vB BWӊ]TN ] zNxHHNEI#f$9FJ!И|V1w:O!*\AP2>#ͧЂxӓfɡsqn$х4 "7hG\c8iޤ psk 7[«mԒ![ӻ^j 䧖 K/A~)5LU!ĕ"$f4#w|i&H.B44*LH:IxF/'6$_׍As 8*2|P JPŮ?&| ȥJQ'dT_I$pV tQBP#%K6uݾ(AEFF $roE22xѐ%TekJ:!Zptnߕ??.##,,z/iHí"d lPhFطN0))vWb`Iv9 (_gD!v,HGx_{ۄ›Dx|^+<^RfGv!AM&e$$.䊩omdvpt*NKiQam/UHʨxnPM >1N@xwIJHxP/J-'eT Ny"=cE- \a5m&7\SAXf?a[ϕG - Zl[x"l4pBYC#%2"}HwCɐ}fC25nM?i]v+z<A+ -x˱m_xz`x @v8w^+G#^FRa)HӖN 39|PpPoqQ 6Vفm-ہo Pz$ /R{1 -_%!(iI=].#ȓ$$%T~wBWY<ݐj8Vy3$O~qU>04`" - & 8`#5-oصO)?JS|H0AeN%0b1jI/&"Pc![ "*EvApWWh6┾?m] T{RpQ`JxedBx@'J+ؙ8)HJ % -fe5.؈-|[z2cCF3d -q|#WٝFg[F mNq="|҄@ [š|p Mp  -:J],A>iPh]RxIt VX0{,X[f@^ /3~tSjC_g[$4GECF:G.iC,.\GKC䬇g0^ys8h٤(MQŰHT8" -|I:Xa ">4i+@wyA4$Bj0X)aGe5pLg;SIrF}8t΀9:aB`LTM7pf̞ΚjURTJ%9?"5+Y_ȊDHdE"++YW$E"++Y_:,Hd, W3i-E"++Y",ZGHdE"W\*G -zNeHdE"W$"_ȊDVW$W$"u+Y_Ȋ_eIY_u+")++VgHʊz'W$eERVW$emb$THIY_d+YraO5+")+ERVW$eEZz6W$eOv;GIY")++")W$eEWW$y dJʊ{Hʊ_ȲDVW$E"++Y_:HdE"W$"i;U\RVwn`iԒޤ.ڲ~.)s(]ϑHUϭR~sW'L?_ ӨönEk-n[c,ܵL?\U_*DZrEɭj9KdE?VnJs8sPfuPqùs5J);Ȋ~=s~sq8c~FtI?w`Kb玵s -[Us`h2(WJ5C[0dE?_ I3ۅEѪ~v$nRnkY,s7%Yreѳ)s[r.Z[޲~X^iq\ϗilR[%.\t>=\ -L7ޑ30A@\nNX|,9 0MAus.t^uD!$(2{Ȋ}/ ckƄ@lyȼA.2Ciú\-tsGB,ZseJ]aB -QEV\<-Jn@HtsCS7xDY9Vd_>jk&%8=WmݜpB7RVRml愥jN+18ꉲ"Ce9TsŸBYw-[Nܾp) *;`$ \lk*] 㚹]$95sG;K5W;UqȰ5Ŷq[ܷl: ]BB3kHl՜pe,_[M`908V # E ՜pJnVu}Q hnNXu[9IAH^)YRK58f}4UJ5s`P-Ʃj90cdV]Lfmcaک[ٙTbn@u~(cyѩ֞vb=lk*7B -q9XZ2\r9rTr!`+r\/Lni媵*l;XC+xA[|-tUDxD -XlkĊ-ZQVp7Qr\l۵P`ؗḇ RTLR[Oe)ڜ1 w)ϱI*ʷ3v*./!iyQtG]QxFG/JPc'ďE/mHT~p[Ym3DBWmU+姵,J\UO)G/U@\aTѪjsI˺Yq{ -Du.y.98 E Q.BCtObOPDg%]( &&JB<.JnBb BamzʼnbprӁ˹Eb}Yǎ#֗dpR ֖"\xR_gx.RtRQfsT85XHq)ڗ-,nDg/K5nXhq924\uFd)ܗ;T^Kw%Z:^M*!Pm¶ }v- _Ӆkbخ,ybSoi;BZ($C BnaV$õPv2puUWP N̯tj \8"c<ґB0/; E.:v.> PR:OZչo{ -;wOK!؃JGu&sclAٲBSN - owvuPģ8DwhwI s: Z݅][[]:n 㳮$pحQ%{[Yafw˃ m\sE%ح-ђŒX"-.H cMKRgDi*9MK(;\ϴb>B0/Rvؗm¾(rڗs -)ZyTW<]̩y%ƍ˒lX&w> 3 L` {8ٍܜ- ia^R'\_u;-̺a|$~XaeLm,HGr^HK$c$˥7.:)C\xCY tfEN.JmV6VsjXfgXP 2&/kȋ=YY.nMD,C5&hAZ΢^X{u-E-{mEfW]aK GϹN+:&8.;7 -a?"?;2' *dٶ0s]Ю@4Y*f-'0ܼƹP #``~m(-/ATcV,矨4}j1c!ķdn r1۝dpLƜvv-.^r L;bDs;{XyHs=4y2RڬeVVAEqy4¹e]fUPוB ;VJ*e#efpv.5QCOv[*A.B$T,'7FX([@8ʬE[ЃB,3q"[XG2Jͅ8d. -膺ӨCXmha.r.]0BnO`sዉHڵB>0s#xmabXH7PQ=RtJ].kF/W0MP;l#1 zhu&@8E.ڥ5Z'ǢʖX}+շhg*rS}(LtebE ;3d]lE…pH`Q(-%ܹ@αcM^$w`BeGLdAY#{, -䵥E{Xsr] )N -WKZ%)N hYH,EgJ``erX| ,Xz]<]1-}qXq&;xqZqw'̽Z]_>keGn}@G%c@xYH0ьaA,k}c Ɖ_8KPjcF*QYD}ffgX6Jp)DF[(E/h[Ŵ)\anW1R(h_潜蜂W$YGIb-7nVZaK#i'`,>P !Y%瀖h:HCHxD`ntBq(Ko'pGĆw%[k?G g' -aٮEfIq4"BKڵ >GŞMr_س60~Z x/ -LĮJO?!S/(D`u5pҼsրo\r$M`[`A)=vG NJ46ISkF.ϷEJ8Չ 'U-k$!(#{A5: Y&\g ^w.ڴ'@H+ D!a|nŅWaeB墍fbW|)]'qP$u\:Vk X #]-uolW!\*:"KR׹u(q%\~EL8(^YŢiQa!ۘY*uk tkWK @\[ĒuU#̋Z[-u(k;Yo~no |$s'$,&eHsydyϽIW$z vWpieۮsY3EBZ5[y!:۰bYVhཽ"ofۯ%N.̭l5},{rͼkckqMoog~nv3}^ -Okθ/nCe hNA G$ɓٞFꛯ{C n&Hq,tPIF7G%X0ts6U 9ל({mn{I `|8sA;WclZqe:t`h2s4u _ǷU -,4C+Pa:UP4&: ~|g+N4EggA?WBs{/x:P -)*\pCv}CBmU-!@ ? a7]Df>}EF\RY2L&$ .T .,)fkb]kF -=uSOCǁm1.|[!ǚ!ÑZ:'Պ]tK˯XICZZ#$nAV q (eF"asɪEK|P*gQnh[CT+"7჆n JxfNʬ2PR%^nVaD/K5Xx)NA EBtĊv8r4@ -{ }]L`[nZE%T%og\OUbe* &kO%[I -THq( VjE#G puh#*KK ;m&~PEc~ mU hhE'{Nb,Ub/o<]Q'\H>Q"0*<R0Xf TEl\Sxst,# j#2#9=x7YaT -DL'¬IV1 6^N?n'V),ÙF1C4j.tSzIKXbPE#K%rFVb`Ue6}!r ^.m7[_HYHe|/t -Dž .DxG4+*>$ CgkkMb犎>NP&c["ംq!e_@<(Uvt̽'0Zb"4L?xZb~&C”MHg#XKcߘ)p+X\X`.x=JQv|M[)#=&X9bJw#>dI7)Itƫ F@YYr#@S9c<,b&F[Qك&O0=V7s,t"eJT}۝ LoJ:*Xi#@f*%JC11> Gv^S I0"BΡ2֤I - L I(A Qܻ3A (qh;[wء{Yð\pAkUw%8@&DfTA})* &B ZV1qaxst 1؈q{R?m,R|d) ɸOqaC`w:kKSXH1 nóm]\1 -ppΦO˱T-1 M3*VG) VxK?oFX<e"RnwtfE$F YV)[ - ;&UWGU[g;^ CeQ`e0W -Y+TEk T kTȂPȓѸžQ,x!ӫ{^S(QرUc_;6CQ!0هSg"d' P W1VS4@$74AZ ж:~b%<ðBsCKx.)5`=N5#`~|C1C8`uK҆ݍX19 oufD#<⩎BSˠX |C ;XcPQeAL͇fuR:S+1jS  pQGBSvlXG - -# i@%DxD抄h03ci\;h`K D B@2 c0(ܼ1VPc7ʔ$XHKd_+Y"!닄 Z YbV*G(4P Tum?>{xM;%*X 5hY! 78hdx " -)(z:5eM& -N0 "# `/vr9ݖÜ*ڛYtq+Td+R&oZ= -NJG x<'wKHA5 9ƂgdtM,d" T F&W I&E4xVNbeMl -mD08|竄/U[ J:fU1L}1RJP(00ǑJ&u"tҢON |=*bbFvTVv"$0K)1#5xzomD8ŊU -ي*)rQ:M`y(!EU֭KW$/κQ) p̭x"yVF᱋\x>`x*L8eQj/$q9vC+pS"X@jdIk*• l 蜊<[`e,(T E _ \ Hۆ0AT.OR&sڵj%"%I<[V<46tZȴÖn(+:.,11ؽ|bfa= 4(@ Vh/P%kK#qL1Юf Nٳ `^Ѹ "8j } -f84IE.1D@o0O -$vEXAbrTH u*@XcZ)ZIaU"(`ӑgYh\ddz1# b!)ȍ% p;{P2+<£ D:w0%2 . -۾a -cۂ7b -vCA*D n 232OYe7Y*?+M*LDst FH2ak%E;HT}F"Jۖy&/D:~S`)A=]b撦 k8hS:.WtH'dOo&Jp XA$BȒX`oY`FgY M[k>қt eA ֠OcnuZ bMzbΤ ѫxc s.M%@x2؄%Dҙ}!ʈ+AƖߠ:\PATz@qLa8iR'O DaQ1 -S11@I` -RP\Daא( a,L9X XFAHZ:6!qQ  tA1+СHLz"b AurhC$ f1Dl}Q`T'&x !v[r إW$ eY+3wVg$8dn9FގKEm#gL:y= 㰠 \`u`Px5Wě4 9t;X"lP@i:9D)pERf.̺,kJlN EjD_a 閣2 $q7"Z ..JY4QL[lp6m^YwJ \k@%*`4fFw88*Jp#&#?Ak]wȢEpI3ABŽo4cRTt"^;NXe'3w޵G$0" 7_=6k!e^!k ìpf/*pC3`eU;J'b(xt03CRPHaW). |0KHQ^[*bGy <`<;i96=QgI#ÓEPlOG(a :{BOUx W=ߍh3:n/ʌξsl녢BQ'iדnētg=k'q%xƳT\5ďeϘAkdm?_em|Pߜ}6k#HkC]W7ns6}seRsqޯl|cmң n]c7 pj榕@w6 -*':d?Wف|<'o't#M(CiD4.:Һev.0J<6fǣ=( -bܠc_GxfȀ(G\,,न36D p*š4zo; >$I\_L֮d"SAޱ{qN挿]!Κ`e})`灛w{q ;7wy1kY^*,r;VX9S6/@C2?] 2쏾9_p G f .=UOVAoa xɩT`7Q ]Hql~S#vc4{զr'kNfk*&W[F#~v«BNbt4+8;rz0>ePyB.{N|٨g>Z`>y=t>Gw({p|7"]&1٧9éۄ/Q1MtAFiբ'E}ez?0pV~skB-ș}`FR.BoR[c;o!kʎ.y&uԌjfGW@'дϒiT ِB' X~wo!ž%}Ir4W։n0X/0zDJe?',13$RRfq" 2Y,_92՟O: Y]={ɓw CDHϖ-%S.N  "蚡H(in,+"pGNI -@ -D<4|S:kWR;]$B'&h!`E%EP!GxP hb^"DX M9yÅ}>Et]q ՙR4&¿C|%rTeO #I?lykEbդiio\}:`l+J@r7`W x݂88Yts--cJ'zPWXh{Df=jWe8R@>A;¶+S6;~ c[.J x{|K՜^:+]ߟwfum VW@ZhyuGc O}8iO'az -+n=Mvhbz*dp9s??]ԣ>3SP|99C*RIs8LiaWOebN;k\5!̚O'3qo3 Ad4{n)W z]%XѬ93\FZs~083'ms1&W7BR̭YY_c*py3keۘ՟tN:of/f~pM~bN[qRcyK_tVDyO:I'yӤ]9kEHA]TG/a'/uCMb;ß,'K/$2J? \͠" Cl>Ç<$Cb{C2_|f"-UǷ_ٸ.-G(ڢ=~-aIʠzD/M{o?  E?1jAŞOFA -Na*Y0c9~fg4|\"~]z vl$ld'jC(Oo80|'2 #yz5 aoE|9`vOo~o^uK˛Butnv?% UOpr-w tV|ſ+vWfQSd۶5_$]Oz -fQnWq5UcMh\g5 -6A:ESP맆IB${ST?eS' 1܀:6 HF(PнL&=Ӳ50N粀>q{`N#2m2#8s -Cs# XN.|5 Eh!kęr:EkB¢syS?%.PES9AyJ,'D@N0"&!jɋ6e^-6ZlPL͈ɽ`kʂTa+n`/h#+жBA'ex4vU[bl8"<`CYCWlhYlTcі0-[cѝcKc6 3*Xj:`&%.{DwQY<#vlx=79|AySK\]QQ|)F;Pc*Ah&6vO<# _u߲uY.9w ¾Isnɇ.uҽᖚ0_5!5 -k eH@jː T]\D&,CJMF^ߛ )7qRywXܝ9!.U9L[4:]Mq%68Nm.2*USʅ -6|[R\:/@ÿBƒ-iV$6?nKGd6S:"}া eTU 7،asFZv`1jש[o~zxZ#f|eN{+W >_Q{>estV(ӡcA-ʌ:;=!7gI5ىd eg3Q/vL!}Y_EZ\p9;R'8amɁ@p|4SyTzCį`h2/ ~CLv87tD$-п(sD#kk݃__Y;S8l` "yhJG&y w"ӧ~S`1k/h}w]/C0oM脨Gt:LyrbPA( -ȟNmdz~]>?4?~9َ;Χ5Q#e>ͲUq4J?x|8Of,"?|AbsP/֓/ќš(zl; cO9|7MOn4J(nxxܤiy:W-M&\L{yoWahL:9 6%vk#>x),guF\"LiShNgo$XGw,d1O*]-挛0Ѣ;{g ,/t<-Wn{NYXQ'41 r)XsFK4')~^BٰQ%PՠFN0duq* 7b=)0/qP<לQЁO^z}3iS,8Rqevd -Zb-xlݙk:) N4:YCQִE);G96+gX.`x5Oq>Fzܓ՜'=xgOdD<]%-6~R)K_?XUowUnn](k 'KxƯb΄SW?M*aoڥx݀ j.m* ̈ﻖb(WAH$"<[: ѣ 35~hBW0ˮVTM} EL#"}sdc^4ۣa+]&:BB`ޫgO?]h?v ˬiYʎ7v.\(QNP#{C|CŃxuYTɡwelDO0B :-|" YikȎš4VXH@Yy+K}1^{EXۑT]|^~a?:&Tb:cIʻWͶBQ陿yٛ',7u6z'oq3}0ȍLFlFkyȖYTfXY]_KGS%mehi~󏴕KHü9-{YBAXCǯ莱Pa4*a5M{"4ڌH$rC _v5#tYZ#¾YUf˨|۳lHZ8!/M_{=_+fIsM&l (Z ~;ni^$FiYghD։ AZv K9ix!->@$pyK@J+Oly"#tݞWcqjzAඌ\ ?~Z6GOOf/wĶnSnPdҶZ(e< tf#:>iR,|4T -aQf5}xw|KmW| )}\N5:!Z>ٗGHل;}ެr:[mnoOx+sFӲu܀Po^s scD8w;+xw`}Ljcb''YlɎ9=n>8EI}&x9uѣz0`ʲPF@x\~ll|up,trƦXF5;F^GX146bOւO:cOH4~D h]\߼V{&`suZ;+b tƌfcK m;g406i~4ʜ-`_lc;CPw:u\nTQQV;ese#n2 -DZs Й@Y΁?_گLs|L =~̻`\tO1;?fN?'7#|ʮ3B UرT0Y{KeT5π@MQ3ó a&_W>$YpEjN>JN>snF2ç,'O#;p46,@$@PsmtkC?V yBV =-VjbFoUJovyw sim47pz.~ZpݲN/hqs bN۔IF\xGzvx` y|Gmo:wNu{Ae -#N.M`ucc?"FLw.Jbd+7.ox[݋QbFG쿱ʿ?{&m٠>;ڼ"k5fc%L|;ǎ1/THfO7'zq۷Һ-݄Ru Z ca坃p"[}&E(h39*toFwyu=[~MNĠl_Oŧ4y7J{mߛFq""^1wfu{IaQ}/^Up#t9>̇w4QXb2XJێ$XoKg')y's?$ZrH|%^k'iߝߞꍁN(t{ 뉪f'oսZ`_ݜՎϷw5q^jjKpMG{5򜚾^&E4FŚ~6X(Vxs㸕Io&tCI3$::DSyIMvF̌Y-Ankc|^^}{3/OB_dw[9* T9yVfۧN(TMuUK쵪A[#[7ziKy bq_rw^ \{ݳ몙ilCqH^QXaUWRTh7s ԸΚY4t(ϟS}(%/ōU,Vm*^a~ _#E﫦ޝ7\}x_`2t݌vI9*o7z{H_&OjzCz;A7woL/Rf{l簳GD= p;_i7iܫ̯my:Ȧ/ʇV< wI`'qK?O}pZQzxV:_/2r 뽐]r\ψ[kzjH{9<x*oBp8;9Ҹ9"mU 7aԾ ׁˮ5+'I|,˃71A|ŻD/(m5Rx͟BC-db&=lfk62A% -;F܏xؓ%tv۹`\ *Z%U[l(/'y»wSpxi1f[b! -a{sLqZqRڇToЉ_T륷Z$]nO2S/ȵl!U*!%=~_Nby"(âziX-Zʍӕ:T~TCś8kH yzݟߒV6)ws>p{Cw~2GG݇ě[ LJڞ.5M禧tpNz7^OO۹sJtK^r'Fyy&3@@  -dpƇaP.Q?yqi7oT8~lJҦ6iD2ӽ<;MF}V\enw{{+mW/;D[|lQZsuӛu9yʓG8Һ;g3`OFg/ͦUuwr/ ưzr&҇qHf=٩EL.$!O'6"nxLL'vˋIG7}(;ۉ09WEZmzKO+Ƒ7^7"-;Lfr|j沲TQ).a䂱V>W ťaygJ%NN2"į^g͜~NxiFtSA8?zl(zF8(uRr}.gOs=~R~LN"s8;R1`&*^<}nbUh|7vf\n[ϭtT~4HK>P϶''[-v{\?}+=2^zul/KsFJJ8ZU<ϺWeAiץwg+%~jJoUrJ2c% 'eu7s2^~MF^ie+Ϧ7 P&FJzvF4}4ɲwQn$69L'{#?*T* -ɂ̿;op,ƣmqp[]M%n2.V=|P5`(IvJ`^QQn~>6҉ҭX#q_v$߂󻭇vu[ML՞'ҜɃۓX+[Ƿ'qf&]K극^;m޽iBA&i7%_ЯKY"Im_^W6*V<&A.Te|jn]p{>OWf|__DSMpWHHFxT;VZ,&Tvr漽z >Y0$)[ogFq<]Efv8#'/_JR5+ۧ=%Nz(T ^_9ޏҩ1;Nvsq"?\wǩl}Tz6.{a6w -n+4Ļt>ڊs3l"Ubs$aN 鬱yγ@Lә:w3zj3KD^˓SyȌ;L=5Ke7k'Hi4QOKwoS,GJxzCh}2 -SX53p8ռ; OAɤ8O^Nуx.v:ʕTaV:RWv^zv/f2FajoNLcӧTSC)(1f8 t5l[<rO:]o4J'yY6nu*d00/uwZU7o&N]_Z|T7gs3:X)Sh&:SM: 9mLIX;C@b尿HE{3m<^&J{!^n F&ztجm%Kum6fQ:׌_f7_Z:F6JgN3rFuRZDfwyr ** 3wc,oI&nd -Qo7[Cz8y;Lyv83LG>/P쒤GiPc~`=6|۵DrY8N˦f/ݫtFEZZf$yzC!6!vs8!w7Ai;'(T SMg` -7} '9oqC:~׾{R.DcG'1o_R,%חz<=^* }fyV/JWYc[bڹNd: iJ瘒ϯ8QJ94sˡtܔ{ԕ˽4O1-2K<;{Ln@*_ C.<գ6β^_16g'R$=(ldA_/Eo鷄"e{w-){qk+G& ;菄KPZpE9T!e1ifpQ7%wڋVGB\"Fi͛N_%Bx~؟ʆ9r{غl9QwC|H srjZ J^)G@' }G(o'qf[es{t֟j٣aRޔv3hinD1VeG'!JFygr(v63oҦ~JLs~'kb{:8by鰓Zf1K%sQq#-Jge(_h7!oMÝJEܻaBy۩{sMk~_ؾ}+ԇisW9VfT((m&M6擣b RPۭ}* : rY:ej54 b2{ШJ덋4ф))GҹcA˛6xHGRkyL. =\Etc>gFT_rFVSW[F9–anػ{/+$yifwNr/MJ9ZKbl#r:~W'g^n vc27ߨn$o !5ڮzZWQ(D5&fa8j29 iBؙnNrؖ7 o9^MXqqt:4Wuq}efJYz-@m|yy=*rwPj'6OJgf̴e'>KBq?e/ b+Y?NK9%Z"حV#Z$͹Z-w}Hlނ=۹ wgQXxeգA=+cSgBF͠C:v:{ė t{wGHnPxݜ -{e$d_wns> UKT&Br;Ȟ^ŞT9#ٞёo6 -rF8LkFxg - %X~ڦ?3ӹbmwkuV=Ӽ FqP>m:ioՍtY}-NӽRmV8FEaT$#µGn7[pf4qxu%n|4;܍-r~pUo[WfĂh|{~k^ŲB&'Q9JD/&{?t3٣ie3xvΎG;f}jqcc{^#+7zOb"ۉަ4_.wbAOyn+t[ZD9sAb{m=B1kUTyo /޺ aH}TʦZ{:K:C| ,NִۈD{{Kz\{ !|?(]fTܚusN]6@_1D/gݫLu=* 嶣kh>.`c^<+gN=4u˛ך?P$*[_1yEZfnC-5z8:'y$?0JNϨ"_ru<J=]qP~$yQ;Wjn } P\,i6i; } O2I}P/k!)Y:qjƢwS98MVY :3ķu\I,e%s>Hbql*1MB.W2h/IxW0qTpSJVK:(m8xQ'O+ /vnN$Za*<`:/Dz_[btry_CzL{b_TfErPb( -ӄ1a=xh1jV>=0mJuÏ,܀I;/+wū O+c4fM׬M 59R fߣ~R7gf릋3R^r0fJ@z'o[hୈн=/zkp.Ȥ,V>𞹨T:Fu.(Gv\3A>4 -p)NىxH85qpCb=+U%,)q/E5GG LxED): k&Vwȟud^!s3-Vج]&Ecũ.ŕExy9|a5!rWv0o5qb7ْuUgb"!r7[(gR6D -Nqr)E- wyx3B^珧j#$o07FF!iNd9E3)zu; lxuˋ+H71+O = aqocm@x|)Nm"Ę=_ w{0~Fz1p־j -q}lVI٣UQ8 ?1RMY{$7Ǘ/rcgtt@5C<2c~ʨehMB__9r}Vv3 [^ۚVkn_޼d"= 6M ˺D?R96>jmѕx]˱~tn~$71%VJ\}2_Oqe<#.vI7+P+n ZH]7ngܢ'ǺF[ /X]ǂ_.k <' VwIץww )$XXk!Hk - )wo;l&9E =Q"[#ݩ[Pw[8z|,6Z[_eҶ^~u V=BP+| |o)'HF1:͠}κ8Ԑɵֻ(<&KJJ8F=(}-ʳR_|8m5;FF%t4a(JrömZ -aldT~CyqI%ea'b<8R%fKN;)hT 4Smku_@˦}=._z`Ô o|"=\, OgaMNto)Ee8 -Me갆C~v(5t29f 54 B"L-oWjU{5ȝ;zNWw2 ~_lыF DӢ[]-IٵΔ *e}ހAJw -Hޚv_.%uyqpkQRgp? A6Y"*9T J6\~ 4@@ - unoW"56ъqv[ /hCu5~XԘ/! -m{̠nDE[#X&t :iFbL:'ؗfi\Qϥs=+>4W*NݹqDuZЧ%~?{PӅ U]%74ء 0/lot5F\Z2jf'Igi N^`Q7}]jv[ _e*V; =꧆8+ЪDuqwo~BE}Կ xBzJ33Z^w{O==7c Z<SR5iZN(=*\\3#$8fBvUyei|L?]> |\jp&7-&0>8riod|ާ1W4#Em<Pcٴ%,Ɏ ӫ*kU3`zDB+˪Ω-Hk.ocWKvlvYM2wp4쟏Mmz[\fNmt:Э -2Q^cn}n w~ْ8{ⴋ)dj(=,ˏv l+=dBN%=U\v3;w;(h6?–[>W0s^m5PESܖҟ;tTk,QM7ܒ5P -6[n]('xpMJ-7P5VĈދZQz!h`z}X$鏄RJz/hΉ &.ܔ#Ɵ8 -?7YxQB UPrEpɥqL[.%dQ쭝V(̺j[`ESޜ#I< Y3b>`y5f?¡煹f#]BM3%C*i a^'֩G_́Wx Di㳷@: *9GR|QeHԞ^WruA8cC:Эd3.NBziM^\`F*2>U3ٕ -n[v"5r]^O*75FI-wJ][b5u.D?=!&KxW9 -uœ,͑.KWްQ'(&nr8-9*uL=6LwU. (wFGfR7#Qn|,8B?H]|8l1b.@pm]x0 -Z!Gd" ~׈]R]Tt3u+ۏu ɝ`Ucd +M7n?MQ \ Xv Vڂ=B[24TI-upqOXљIS|Z+7s.4 Mr ӎtמXס V`N[!7nz5ժV/: 8Kl3H/@;7ŝ~O'$U#GLSw9}{JT(Oܖ;O9??u|Ju, P5iXD:En;݉m,H$XÊmvE-Wq̧ԼWj*!5(H,K~NI&NH)DuJ}.+WZaFc;!DExT;f|2+uR7}PV,/Kͽɜ R '4|wX 4w-߂LTچ =cXKkyc*8f - .yǚ0̪~ӊyC|`'d=~~x1/$Fp|R9tYҽO$g\lsP_W.߬M]{xW#~QFZǞy9oPh/>q:&cSihf[b}pSg8hG0'\h9mXn4ajs8aQeopVշƓsU;wYP#/<ܜD!8'mg>j7GΗi7Lᤍ~ $"feA\>wqe\W(UI.Jv-xrJ,-OKz䒨J)G J_¥e ŨQrҪ7g¢jBk4i{+uhԍ5`;l7x5H36']#RiVl)QZm!ȎqHնex_d2W²HRҟ6ae_VHq` LiƖz);Fβ:A-+nynW9phI9s˻ЖUt)㳄en/_$#gbZZTHW2R%͌j 9<[=z0wͩ-(^Wlj禄zLhmOqo`'ٌkV~SUifbG>_tؑ\*F~x\KoWBh[=l\ *0=$n[R] ";a I}CoXIWN#+VGlB- IK,|2]U/~EntZZӭGtH&jgg>b@EHvnߦJ ʠ+IZy.(1'wa dw>N3dGZBg8P (9"\h:xVCE;Sjʿe6K! c9g,=dRP[U͡WPo` dZPRK㦤gA6fFڗh%WI-X}(4cBtC7GٮDWJ~jrߛX$*ywNADo,]C%yCV~y eFTӍ'Xfwn B!}`Ipq]]Dt| o NJC3Rͭ/c Iz5: CkVn| %i2ƙY)xJ]/J{Ty`NycRy4@lRMnjo"s2ٞ}D }n/W~-\Bexy0\+-?\AG40tS)uՕ>uY7MTk E|F5g>漥* " ϚKX.a/zZԇ3:SJ %Vhѷfo1:vwZke: }0Ps# K`&#'mzZ=>{]V{EEv9f@Ԗ/m%uI~loF[t}& -8؞jܱ;UxHg?#gerr١񯈱^e`'7]sb2\`yRE?mb3 v<֡ǽwSي7)c -+ /9]hvQŇ. qvpfLTkzJ. Cc*b6m5Ke7R C 1aɾKs6Qo uٱ#3 -9ȏc1c\^T/]mj}y5̼,σb%YNi e$,dQZ>G(vy) n@jaZ-fJWs:k}Z2F -Zwr>^GYiund(;2d1!="= OH{#|t~1^gT -j;f8֐xoRʸ,M[X?(0XZzʇ(IaT4Mвn}*VwSȺXPޭ=EuS0AEͿ$P)b!v)Ze fٶG3D0/ҬVkQ?&.'ɦ.Xin"4,=GxaW(Fzn l#^ -%7FB(㮭"&z'}ӣ!Yju+a |OP̱ sV> /M^zw {c!r݉LΆK2gIGa49klɛڦP?K;瓸&Y9VYs}?30f[UK-DnOޛVm;ź{.H$T?D}0/H&(Y3 ;_D-4ZH cZeG}}''/,,,c0_C[.fUe7?XYb#%S8q]9C]a5Hl:L4޼ըtXṳ^tpOLT*p6S FiG|'l%ܸܭ}Yk>١TUCž*IBzx䭖Έ"HN:T:ho]0\hJS]{@!*%9dZӄ5إy1{+nn-|ܠtQ~1Y &`$bt9I)̤?n&=Țޗ(ކhg[-0U & &ۨ+ vf vuF]:pQ\y󎘥KEb/aQ:/>⦉^Ft|aӞ=U(bTsG᳓r "XK]BA\r$_quk+Ӽh"'eKW@͇v`J鸱\֑=b:=,,s$` -u@O؉6_#)d?$9>Lvb8[.כ+!e.>_Gk~V~riбXBsʰMeW9x2TR!7"LOI?^Mk'0 - )IY[=sTWLW\:_ vEͤڼҿB0S$C\iEs5i,wxXJ -ܗ»ky[Z ˅m^ؼeDL#}*9Nۘ[jcq=gY;a IqϾ!HL?ۻH,LycΆf _'&{PAeF S> b(yI2EG4Wh5JK/L`&i 55TUʒ5yF 3vƿޜ~ˮ{МBMwr y ?/h2vUŭ0"^h[O9(7<'gn+͔g>]z f(>^J. ZvZrKŸĉC[M|v5ڵipYwt3 6:deTxas?B co|\]?;wY+xt-džZX̅؝l1 7>nZ\׻ߣ\I:uf!uD1nG`3GGCkwJW/ Ȩ|wY.eF&f-`Pګ`t]uYS]v"sY96h -N dIZыj` OGFHVn moٯmMT|Q棠/|Ft?HJTЫAuu ~FꓻܑEUץ 3RڞvmRַh2U@ eՏ.IŲ]'$:ۑ:l.1x -2ǝ]vwgC WnICN?9n@%}˱M\ckk̞ހ̒6T]g8 ox`~5%!94H֌buj!/:;jnQ6sWFRyCnUKRpP߮v? 3,pVh4?/;ϋ%D}2^oe\k H 8jϦNR|ŇG|(.w~fV4{ ?o,h˿] H -=mG>SjӚGհpԏτ5wqNKxJ02DCۍs[ܪx}3 >6z@^na5TփV=5V1֋הGTWv.:nxςj_؜jpPO^=8VÊq-Fs+wN5{Xq#֗+Jj5ϫ}C*=h '.Kc2Y{cH"!V?$2,hv_&1nתY]+c9bpq[G<+N |~mgY;Lִ֝_V5J3%0#mTSŭ^y]4+b-{x)ct5WN_9?z] םeEB`JFT|> G">gKB?NWJTZthTUzQ=!6\7bAnMOwHr7qcwT -9q4 -ʼnT*䀆v,Bn=gسVK:A5]R.1GG5Rg^P?6FCrfd}yh?(jPl? _9Y&d?t{}C|6L]`SL1wltzVH= T4ĂGl4g|ckWKZNCs/Wk0KKKî{|tO~FG^ 񩴮WC12VR>",nk~qQ5?0[ߘD&!2 J5nG6p*^kWgTSO:Sm%q*4b9<ˎe -ΠDZҪG=9Up&5'Un۱N -EJF8RfXinw=.z`GGFX@?yZF;vo]V}qߴ0S6ZrLC}vMPǔtCq2\>q'e'LI47 -e{] sskפ[u +z{OR8Z -_bjHz*~yTo z~ `5yCBCG/axI\ 9h|O6YDARqJ(~ډ#HF<`iYR"n qE"K5vmpUv-Zk `t^6%+ ^sPh _r!d>--dkU|Ea~5 a}M^ܓb1j߫7IikHU%RкO7G"4S 6PŭulFWWy[ؐ!82 C{W{Kж%ff%V(E?H|xh/>:(mh&ރqcʵ4wx3]¶u^6hM?Y(.eK5>:S~xŞf~Wtꤢ[1}INjhCmPss'M_TRiL-%oofݖ+ӌеDbU|K -Fs_2qARw⻲P}LҚYqJd^ ͑yB_)M M]*T7%AA0NFVv@2GsMⳉzGS~n Rt~ KZq?qdkyy}05$/ p_|\xm4,aC܏MFDߊ}FR BCԱjg&Žh~L>X)WjpNwVaˉ;zMQYz<) bTBv)Z[R'|$՚\Noy3k"hfd3 -̄  -$ܰ>|肎Αh-D -]'`BKծ |̭ktpΟ'ɸ20X@2(QQ4MR62?ۦԥ/bQy>wO=9?Zdnk[] 'B[Ï#q @ _T5$P{Imotfz[3檚 kQ"6xkBYlPy+†_VꢢɗXSeGKTc:vpiSQS8R)KX{B`xgd!Mהy$::Х9s* jSuAU5YbB }n;KBnKs\lHL(T9sԹ ?EMNT˅>=lဣ ºGݻ6wL1`%JR {.Q.Jצ#0͙9.boQywU&Swwg^q^R!?"tɯ0ﳡdX"e -rhg98` ?O/* ,$I]f;q:CNL(23q_.˚ߟkr MYC.# ft ouޖފCAܶʋiK`l>/㝰t]z5̦^9ͪ6ZՂh_ew -j-anWS+,<'tuj;2.cu*:~{ɩ.!d!:>vyݻ Dގaqtg7QCeUfu99 qSrVy5zç$G#,Xm; [mx-f -׉E:?X:E\z=-*㖅~u'>b{GMn r,ѪD*oy#-ݤJ^5cvLOL~nTRM /0Š d * Zܞǰ -~Gh>qKcx0 {|yw)Bf:򾶤̵kaH iQa>bcr&K 9Wѯx|Fy!󏻾˒xfҘܑeXiI?;GR5=|mSw?>G],yĥbnI}>rYO,wQ!yVC . w -O'es;"`<|c|֝[+,9b$顳ZXi7(}`L'9NLRRRɳ̼>B ~}_HPsI}yuF /? qQ)t.l\Da5u5F;Q4pc`1emo >2HO;؛x<+G\K,ԅsnQVJVmy#qU^jfh -.殶-pz7r%T(S5{y ċH#5.ntXz3l$Ƕvx)k_6ua[hn?^!?n'nqebo5q!3vyd:.Kn"{e W>݃Wh-^^=) oXu7_Ak 0'<a{5$r}\S,o# (xӏNi=؞ p"GJDBI a􍫣ơDqBi[ r\N"UĔTFw*ʉ6b[CԄ%_b:ޥߜfZ!*5^Y>2gs򲷽@ @ukY,n?$GvTQQmc -"i$+j<D`:x'!f~MK$1YX`!F'1uܜH'fc0͜xuڎjDȋ- -Eĺiɟλi1gxs7E \o=Q} ]G!:r}Zv W<#ӳqPܞ?:,$S^\!PY%Ӊ=<|-7B]DlFc#OY,AL M7d0VXZk.CHL HOx~1;yK%-XxtYVǣ&<?ӯ(C21l5i#M}o3Rv9rS%;'/HrܷW:~X`.^~'sp<4zR,b:! 87ޓ{ ^) j9*M8#B7HI.b -ZίyF@"fj`FuH nJi*$Ω΢Fm%[fSel&F3X>9 ]ݛqc ȧ!мo Y Ϫ[6VWH^H$drz'B`S7R_ONM>35\OK@6[f||6*\}Zoq 6ΐcpa2n?Sg5ܦb-;lj2;I\S^8_7 ʒe:[J}TM]Il'Pf=S. Ph)SJ,d<&] Yж1)5͆fUOTkS3aSo1p lGwn͓.!lo.coYqr嚚eQieGyk9\vs=7VI$?5DzH&^}KZk4>9ZEkFNܧoKj,#دjb(YRF,5 >둡&(;]>k̡b6^i|(PIz낊֑4ȬR*-?bp 8)мmZ#_DqJXJ |!yv*$[bp%0(zL +A #$J^{H{a]өT>t{mE}TCҠR;ۃHԺ\vZ$aN:'$z闾yTadBZ8Oe<ǐ <О~$ʮA{۫HmM7ǜ}{wZg\}Y,E9M{ -YrN>6B܏ tV6 ^ ToLʹ@Q&Ͷ)~d›UVi]CCwjqPvpz2f~Z9~ iT^CFS3tzMmO׿b'הgYadD*ÔV3rTU3ɨ:&+権Η}Nb ?G?lqo;JL)@À)}*kׇ7mޔW[%LѝԌ|vED /B$F -e(E_dt&$i)$Ce!hᯍl qӬKRB3kͣ|/;}&H[M0 "ԗ:M0Zfy>e+sF^`5r0F$ -% e~#\O;K=ݲ,[s_EFwm}UV[#P$( O/:U{D9NOcuKK@H{`fDNܻ 3]%m )E2S''~/Us=? Rvu CjqDf?TkyId <">7o@9`Y󮚶^ꭙ?7J3p*rZy{*<3sRq7pImL9Ru޺Tc9cNkd/jQ1aB]Fi߯")EWޡ{/Лy罍 9[)'Ͽ$t>,pˊvUyR+£罺<)W#Ss+;oi;m3ӱKPoo -Q~5{ 3jA9bPrӡ^*+i]/od@]'A8ә3&kɶ9c^sko7N+w.|Ss,=+2)~ϛ q\`\n%`'wR9V/wv2Gy̲ښK_Ӊv*M2ֵz &7>AQı] 631,$cШkryi]U2 ~JJ~u!ު'HٹgME)o~q9Zg!xЬ寙z3GN@Tg~y/+!W>vi~Cg; ˹x5}4!'Pj|[^l@уj#@?Y&-[[[}7;ǣ~#rna7jz;Y~[Qʡ9,HEn2@!;TPtS:ATzGG'P]BӁBxH͂? یk?]o&}L<8{j L.MTMr9c)6䀂dk8jFqH5=: ^+A|VMlId%]lLaI))0T5<(;=lF8iQ<\yXLyklgqgQ^׺0mtp E=,"ۂ[퍿Íq*!DNz3r|+= kykiBN\=::_C46zgcaH Nog?1ƾg^p^]v^2VVЗGGd$P{P*Wo|[P; -Ý GKOob̽h!2uA<"{ -s-PȅHF9VS8,LPCXZr,aG0|o8SS:P(O4B8 arEG.W{l䟢tTݣx6 ˹p |駱,Ws -e|ľ@<@AT֣Qy"yuҪ/SN\Pdq|y p%Uq{NgSɊ[~&@nӾk[< -{Kg:.i s\+ݫnvlDJup'C˸st V-`4m -z('c`daɷiI M}O)Qg a ($,=CMPb8(t}%ŽYN,j:/Cw6Ori_:U&Θ|M˱ QEO0:G^`/2;x3ᴫ!uJjE]r\_;zn/ST\6}[HD鞰{e;[61Zm)RDKؾYhe| ,XP -Op\Xrob9תoj3%Taנ/'a[WhN{_@l^g}]P::tZ2k~7BY{YfuȴzӅ< 2Ց,]&1\_B<]sh'#`Wlʀvm=ƃ;WVpV;ڴ 7yp}[`/jbu뇧Qt=zGK7ǎdgwz9^7؏ /}vR̢3}WklG)+^d_i-8߈\H|(Fh1/ޙ -MMi4< OtZe:2pԔP/ݠ,Kbna42Ptu^v2m!p&LR:yhgrwǙL3i秸!,Q^V6]@@fc"MlLl=r,4V˯HϨ7^Z8P]`5~7ץQx)C4kĝjrղ5|-J*h|M8KjG>ͧǂvUY?2a?g6/m̜6eWyM m,ryӌm~2Ad }7=tVk_-8mU6bDJ4*VZ١Ս%raތUyx ȷ 'ʁtNwC%4PIYڧ -%!aE$ION#MkV wղx8ivc-.oVؿ Js$s޳wi(J ̵̈́T+vޜD:Q_\Jڜ?QeEFlyV^({ %,+24/3Ig݊,[[3%ٹ]y+2b>>]ʓModRhӳ=)0(Π>uiSl-#sF^7tʵԄq.w\I/w)"Yb roHyĮΐū xӳKn^?$\F LTF.v0щo\&Y%8zIkn9D`o9o6]N_-y*Y1-dW8 ?0w Hblف)ka.3BP*]i} Q\wޯ$4Ew/֡b=!Lm|}.s=mO6/-VA*ԤhtIn֖ڸSRk uօMp~+(<׏׭ j\oeNPF6|V}aժs($xɹTfB~e6J>eY6RGs{m-S!hޖ3Z}kJ- -fZV̙Zb\euwUedv2}1h{sLN,4˓j16w6Zq;RQ:VwҔYBQiՒQ20.o/Bw&9VkҥnZM~6IeUҺZC%j8HTumRڻR)1vNʆ;}4X]7^GK31hO5\8fҕ8͌ˏG&U^Lfi0|Obdm ߇%ԴI} -,>ݮ_;oY"jL;AZ}b}܅7\+v[nxBuJfDnoM=TF3ۗve}~x$_GdpN6Mg֙lb0kGǽNE Ұn։U=[a3]H G!Q~&*.k-a`'8{B'h$Ԯ,"t7) Y`x q'8_󀾭?Ft1O 5Al1ITU,4&]?H&mgKT(w:-t 퀾vZ?^Y`ZpNZ˵hFb5&;x >OK\yfsG}A~3Q_L ?U~:Q\>~r^{G@=+aϥw|]=_$YMM(-;3,7n@rF݂uuI(_Ŭ'E>2hfGB}V06a~WCeՆbT0/ś tuq_ \|#X:+ʼyA`?ySQ Ln2dhR$YU[߷?V].wF? 1nr?ĺWn|Njv{Q-ڴ-~ˁhxЧK k;+e4^I#DHQuԪ5n޹ZP8<"()09&5?^ @&扂 ?T  JdRr5]Yʋqr>' -9|3Ҭ*b/w@Rj ->H@jKV@vY(TLJ9^121lF?YJ wo6ΐkc+HǙtIÔYSuٴ|*a&WA6PhR$>b97;F7AGѲ?;s}ۜګar/L#\BkIgȢNRQvd$E|9mc[|1s92i)k,.6U~GcnE@R5;A<OQ0\$^+Fuvҟw1r)qP;4vZ ;_i=w벑7qD/gw@dmڭS!OTE?[C 6GEкV9trS42y`NV߰ -7=k*/4dX=?VRgҖ74{ZD~͹Ŧk~?yLx] j:y6ڨM(]>|=ʱӹc>k;n)x&}17 |jEYZ:ov6+tֈYnDX̓j̠ہA~@a>'xI5 Yv ^ꐩa8;2khZ<1ݵP@|7 \W ^C^@K}N͊3%©Ы`J8!K<X1WT=o #3 ^]w^We&&ȔU'/phI!/8/TZeSN.>oq>IzyFk1 -Q`w!>:T~;ފjrhLKE}!urp͢N -+,T>z;y,65z vn-Ӗif,xb|PAu:Cw> 806`r98so鏩T}uQhJCҐ|c.J𴿡޺`ubKHݵM#/T|+*ukb(ԗbJ߸:2b0W*7BfDe%Ҧ8Fl8 -X5?ŊD9 54/U9qުU¨uDSFі1 $i..MQ7g\MǵKY} o8{ԙ{=l>@S}\4c_a?ѯ$<Nɱyɘ)y/ZIf8PzԺނ# &,wfs_mvW7gOn=SmU}2z0:[4obp`( s}n|pe&k@sao|-g?O֝pL EY >X΃hՁ18gt"F~fX -7I -()2IK'ZsQk:,EhpB=a?L}ߧȚvR/v5Q'UuzlJS\|E)CVg6(+T\uj:19Y[E)XB0lC%GMN+CƃG[nsDV6̆1/Iv낚"&rg,|-@O\ĿvWٴI\AN̜)kel; 'hWP*lU/a_ҳΏ0T|j zʩc@Vw^%׭Y0`[J9 HbC#a.lƶ#l _< o*O{]W+H:0`ɡpK:Z hse~ltN=1Ѥ89Y"*Q.w8N)i_h' +fUӃ>{H͡+Xwх$"v8b9 ´b#5+[KYccsV- S_ 쇯U[j ymo pMsA?$I?$h'UT//ENl9y@9wio`޺ua -4~2E;4u+&q)Mn!A^Q"eUv/2p".=̊fJpd1Wm? <@Q?rYGB-_*^IVpuA_ 4>6  b쟃G6d$Yb7`mJYh*j_:@f:SIc1eWj,_Tտ,6o -r/7FDdYRj_͞F/Cx[Lp^=،[:Y}uaG/׆Vf\bCinғ24sSњAR֣8NwzWu6g7 (qe$@zLY!6\5`~-&(!y_H `XUٮw 2+\2՟_(2T`nNA$5O|՝1w 2Rp>ͱL9\zEiشTf5ktp+IZ#EW2`oTD ch1+!AJI,F/Whn*Nuf|*44 -Hd׸r^;__en AƇMZMyQ)*~耇>6}}Mթhǹ>&v`dY)NIT" l*`W?cC޾a {}&_8[;33fL*n[t0-@P/\ Uf~W:xZvҮ{2כƐy2;EOG#Qӊ-vY!oֵAXȍ\aꞸ7 䖦8jl."JL w`pB_fyp'?<(n|梙e½3pmrbª}6w#!'EnН'qX Kʱ\Ϲ3WN(t՟cBtrt 4^n]>Ԝ{67c(qw#;Uzhu2EQ8b0eRD zzbƼ ,gW'7RӶrg]0{R-0+{'żV';bdyAO/a -1dܜ1i{%s^yS8fmz&  dBns?;\K¥tŵu?喾|[%Z{Xc4TKhOUx! -Jw_AG&{zh,`gK[g60kn3@/9c+F *Ú&΅*5?^ܣ, oR@pbAm H%Ȯl ԑɐ`[ԅ |N}UhMATySp3o,{-(_S嫀X(HKӌؓL.R<ۇ["M^%.'DXw.ZMsZaq8ٯt,ib@e&baydpu ?!+/cp*׹H . ]CRYGf54h 9jaqٚ]W p~A<;rֹUu{{ V/׫N:j r3SJDObfy~.Q9|lI$YYmG-3hM*&ϟOݡR]Lɕ&[?(=8A*<-۪Z)7: yP#E/kc }kpQv(u&NֈnWQoX$yf%u6L]U&Gޓl9M~X#н),L4x*޷-~')x1dSv%(J+QGn1ɡoe\pjY;Vۇ%]jO(+SOFhb-NYN -71v?6^N)#Sk5 @= LeN$*yywwG!b?|Vbrض -a5{K`X/e49{*v>W1uO!%٨FE--*blVbȡtykաq\ZIgm_ -51)v߁8.]Qb XͲKҚ蝾Z DR`_C o9G ƾɵֲxa}3[a>B7.ֆE {`򦸩%!H=k!CW, - $7r'g3<V>uIC? xʶ: h_*ʴ~hyuCdMmFzDi vݦvBBЖ/{NgcP.s>XOٞ7ˌ\749᜿K*el6C-|!5 E`6WP V%-YWZ (ݼw8_PDdrB=0fn''"!À -endstream endobj 299 0 obj <>stream -iܔ5 VC~R," hR8JC#u;e֬|8Ҟm=2Ds{aw78YHX]\(^f|n?ssj@\N U̪nFwbb_7GZc?>fKISm%$mfnVuQ\U&ѿ$aBzviu3jQV?|LKOZ,XX=|H̸u-M-%Yl.WЗu%+_Ή~38Yhw-s?`ko *Y!O4* -Wrj1Fs hx>clrHHIޱ vYXIn M_.A׿##+ET>F -+5Tƫɺї5t@gMľ+f5iZ]hoj9]TΛJ bXk =h!ɯ`ik7Am*v/'R諮i(j.K4"jM1 @`OPx)UrHuGg02uwElxQ˅5䕖}l HҼ12mvXBѺ\)ڱT{)Q)ZX|]zd9#Iakl%E,>v२\3{0.K˟`V/J*Pw>3<\VE !f5/^B28h ^Q|[b1L!$Df}0ʀTxt7C6>)JcqvooC͉g SVsۗlZnxA8:U+ހvEޞÒnZVGma(p<ڠ>\ZЧ&?T}?~ݴc|Vq Mw"!F<´bZEA.j]F8QdV<4^ҊKf&[ۄ)u}S:>B2J~7wehW Jx\pE/$,"x3f:w1eCn5h.L'΍H1ۺ7{ȶU6Whqƃ$?~!l~lkKZ4bz8^D0X0hR;`bXy -qyT/G:ʡ(G7x$&9*6h64eUt B?U^.?Ms[X7"[1ol¯42#sXuc4XMhV [KΠnwVJ/Unw̥ oA/o VHBL/fo E%?dxtVYnl@?oyJH#0'+Oq"xnw灛!<q/8nih;(*357GLd|Gvb1QR{z&B,q;qOORe7.ʛP'8,g&Cj;+0t6j{{ID.Tc,skunV[ _]xFQN3fnw^bq/fq"E3MgvUϚ>&?<g/n=0 Ѧ >Pi|L~9 fث3_,f z\h?sǖGX@Fh{RmKsbJ@]_٪>J<cI1zryt).pFਛD֔BŰTPbvi`<`ajbVz)p*Kl{AEϞYѯc.}Z>lw:4έf?v4dlέg@v.Di/3^3yxx0Uj35 .0'tabYaKK(>WIWOA[oոvOv[;8995|D;]*Ki,k< ; ˽έAnHe-~nWi?|dbh}U -˝_m)/ǪF{q_%{mJa',tTV6vPwZ؄z#}#@ì;*ܨTcytwG`ympT۷U=:En5c\4tߚȏtkcw񩰩fgmО;Y" 1]pQ>\[1faͩûHY|h/ճ8ؔ"|> ^gYr=mUZFƢ&pZ"nFf1}v!x0qtFi,L _(6vIӝ)ef$iǕ!{@k3:[4Jd| aq>eƁ^ÙWWf2Ȳ^:1%gU%BɡKK 05Z2Ezj~_ӽ_v>F;\̇nZ]Grc -h멗[%b n5;RTh6 Y.NͶ5 -i7Ux -OfrMG4vN'HfҶq﹅QQ{24tPK?N,`2\P=kq{ѻMsO~W ]m1ӸZ嵖`5΋u('-v?bˋH\U!-hI]/\W?_.\5^nXTHq:]#)\yh7Vݳ)Z%)$fxį3֒ 끒<8mwʊ'`]&9pW%BS*/{/pH y,wa*[9$ C] Y κ @n]JC^f09 vYضߤ/D|] ,o< -L8p_z##< 2+?ht+ukԗm~>io[PҼݲ|ZȮg%p0a>鼊\/,nu0z;8_$ur( Ƭ*TDUOƼV|vW[>r+xci2Š(e#s n/m9nַass>YMOBJ#vv*O7x)_@?$@(;J^;)z(pFA{z()СA@ r5$5`{lڸ|RϿXi},Y(]!D؈Y? /Zrɾ/\nhW?V?#+H;omhf m]_EP>P>i"=J!xS_(\=s$1/ؑ5X&u3T\:譃yz &B/u~JP<_zK_@{4Q%Do[)I׻8Ǔ7>vB} Vުܭ1{;Gq *B,>Vo&Ѝ*<\ Tk9e+n%n+9-N~6DvPKkL:Ej 8DMpBLޥiK6t։b1Y_m C6ޓCKH!܃x{:9qky) Tsj} -Wjc. ZŠ -WᬉL jNcLMzIaWz8:oGۜCG<٦j)ЁX[G);yn>Fye88c mŸ.|~sFZvSg4-$aӘZz/ןLppWsg|B7:|8bzm%LH/A"ru8<o7ʢ䞑N(U;s_3}g`w)/zTYuÆDJ$,\]Bz(vh/gV'bNvI}窻u49Ԩ:9 Ѿ0,rUYi^uu&^X.1`cL54f J)e~ --N w& -w-ՐN/nDaG~>郇9^_h {Ւ/1Z /in4ӱR{qnԒֶxD9 -M,;ze6Wl+(aɧu` -3AD%(Ð3U_-LWU!"}P Yb/K|d[p.ryӟDΆv_XMKl%lcL0xduY*ULOWixIl,Yji.($7C>NH5?RlLqϢgplL1;SdLѕbyv%#N%T;oݔ/# -%/ 09 8wWZ.3({6Y;$-zvvJlquՓ!]])0Pv=>]`M1'L{_{]0fCB:f!iL^ k}fl-Z&Rў<_%-WM&ZMcNG7ҺG9$ѐМɽ5M(>Sf3}ix=_E'hhe/ -9@h[hhg^ 9OT_[A.5k|m^HutcinA>N:FZZWN[%JNzh)|?tWS:27 93\ǖ[) ?s4"-a?R 'YE;TUCK\[h9FU6g/N?'i}~%_j'} UFƭ)ϙQ-C6)c멓ʖZ"7vD?xgU;fO:a67V|h:;kgF*T3-mJGa$rc`)5.Fm+Ǩ "q>Lb2s22C?V!'<[F'] [ͻ2֬^`yP8ZYo FYLcj il>hec<Z}NyBxIE5^ u*CFCg}Bb;߿]AJ%6bsgnGs7N/չqqyZ>E=<+: i6KG#]#+ŕ^~/jvo46jW_Ɉ3Nw'2jn?=b_* -dZ*}~,i ,hh?¾AI]vz_]q`)Bp0'u&e.nŕ/NP cSuTӬ~ݲtd&73'7q?E`s6uno#GPN//{c6#eNutHpbՠa ZT̛wѳg맵v1X:xVn+fi%RPHȌg|@B%*eduM%KԸ?fFD5nQ>8-EG>8繻4O ֲSd/SMe^{R>c8*,)AEĪzo ˭P'M%HPfCe-( c ݷn/1 -3\jñ{9{>O__~q==iG"rm 8%xL&M*A\𣑡h.ؔ01zjj+DG??awU }<˿ es =niDE7砥n%:WkE2 _v0Xg;B͢Xyt#Y "ͨ ||U}"4e9tg0Lw\%jh`y}Fn6_7 -{N_#/t3jnJ1jŖɒ!I'z)՗aQLb4tTOS7a9I*w\k.KĬj߯JX(2-斯a/LZgu|n[fr `qeMS.yŶ2n\%kk,W(|d.ΒhSR60Ct+hI<ҳ:exl)H/Vyjάy3U)iubIzd~TxgU(J]`"I)*=NIy_ٵ3_D:> (}]w~12tk*v*)W>MVgb:iH%c-!QvQүXl1Yiqգ62+V ~jEq -~w+b#lyL,aYF2u?A0Fb,%>o1;HFL]҃U ݟ?|S6s7O_a9b纗CսN } 9u[_5*prr{@/N]ci:V5b/Dq6"{NFakٿ-i{WH,/݇Q뼵I3T u8q;VK/TRʶ ͕[lvp]€V2]+f0-xo[!Ujrd 6nmjO`4mt,]_GkƳ 'z[; U~֜rh};iwz6:ՑlQo0Q7Օ[>jlutrX-?(nC3"_MClP5~a)=XIoO^fTU פqNʳ]<]i AӁ.}A}u* &{z}o, #6jxAP P=>t< -_=9D\ ޖCY"=kBa0kc0UNkɸ\;o; ,ZW ]24}ϲ8u@edqS!\T%,oC-qBalzCOrr<5=k lPWpMԆM;/^уE Ox0EZw+3l'+L1/Kùvj?r f7d5bGb1b~#;UU~&l?(cݩMh*Yjo^˷xUN=nAdǜ5g",˗/q`jP?tbFZ Z$6-}SCȤ1x&qo$J~  -wV C@{ڿJox]eGꆅHHDW)UK>6j%k*^e6^NѸ0]Y3x#/߄VPoCȀFFTedY+! /ٞfc ,3v+Y{v:91c9TGljN~Ņ$*>\d?e -a`Td-15YcfۓX- -bP?X E4{̽lhh 691tp腵-WGx%Qge`1KJtUɧMvjNf*v)SN&a/^IFI7mĵvmgQK.GK Ow[ ]86}!fktJgSqxv GmtZ|w%8Kߤ|y$]d.vyqh$,Dz2_*Ĕs% _8 x5&Ϗ˗ݐYv Jy79`(Ux?zܙtջϑePՍ_)9V){~AH+9u*+) Ay0()5Of7*`;=m2cZึ'0S^|eY-D m4GZh EծTnϞ/"D!Rݩ@qnwSa9Xt+oT*7y$n8ۼ|[x4( 逸7ʜ\+gY -@I<8Ȧ~q~};'clv;Zu?ӝvi(B)}q `wܨiG Yv2Av-3B&tϒ-ֆj?[Jiv0m%nmj4zPjdv\fDfJڗ (Zw*'2YܐK{|~(J`bBs"!3Q~&w -~1M$nAOdU>< 0Y?JךⴷU3V\+WVK -GPeFj/w?<qH9W@=^)[ip -cEK֘?.lTGy -}wFIR,|8] ܎W3SSէf_Y:v݃{q` -~Ƚcy 4`4YZwENzC1%ೆ6 ။DEfuKCC<+#Vj6zB_$>mkc-,4|ɮjxvF/fz.{[o#@}F'}3̶ZW~zp&64 z氱TҍN -9^IT {&v][%lIMj'wjZ۽?X4w^տ3dr(:'mTWuN|ht' ?s>޸ȎuˎJa8T' `U$w xY`Lw*_6DR=LjKŦ%vOCk鸖LRjԠ(ʞ~z:lpCw=~' уZ.ۺF,mL|uFjmSz]x3Z/{W==_ڌQӰ,pn+ Q -H_8bv}B۾Y|mCG݀ !kQ;-&w.ȶ ũbULє-Jؿ o"wLmےEz`lY2*ka<'qYo-jNoZ#z,t!EZdg HM֊ޔ3.pd&Ѯ!Vm5tZ_wОp #okldG>wژ^7앲0{ϼLD#3A(@0p홈.fs] '.azh6̍:d+ ~n:em/ˡ -zm`2R3}0EG!`a)OG,W_ނ.%fҾ_qs}ԅ[iSt5P,_^@-luH{(CG6Soo}^^j;K_R=c[-xbzhRſ|jq)s -䪿X,")jn_yL>nI҆y%/Yyѿ m.(Z_Ge[{FFwM5ovt(b{T㻐[hnoМg/ ˣYX`J9@HiE`Jl ,g,j'Ϗj2]wpȊ2׵Zq%-ǻ?zm{~tלWZZďcH&͒$wƑj MYyZ'v,DP*cvT6 UB尟f(#fut5IrOcpoŨ^zj[ONuG`K5cmQ7Y>oPe+j[E0I;v'P{ dR5Ҽ󠌢UbHbqdcjfiVRD$?ʕ+}zZcId2`E\o]|ў)kB!g1= NnQީyGYu1$#AG ÍH*3 tO{d1jgis\Þ_[@z{ia*q[L/obb Æ28/\Ʋ/J5}$/T3BgQư8nt}͇XS'KR];Hb@lhNʌtUgd_Z[bXtѧ -ԗf[ l:(G0U꿵:7g/ч_f~vh8P~"|9onaZ{g"3g^X1HZQ{9nH#$ﯪSq(ķd|)onWk^g-SZ&֑ॱـ뷆bQoj eʥ7?CGߟmq8<Ǎg0H4:hnOf9ݤa|2R&2*:nKJ{u@z*M{W$sdݛHj"hx^'ʓ͞'-pR<~m8[F'MNYްE~tڸ¾mpl( ~/z5)@t"j0e9ffaMzdx^+:Ϟa6}|AM:-_o7"jk ^g&uS-vgPDrF1o=U7]7CbڡɄzKy^͈8v{m/f+/Z/'a<ۮ;PS罯I:h -|3AW):fNx@?TJa=ݷdc+Py7|op/׼J #a#ڼ7~[6W:w%ئl05m˘ p707ԨC@jt50)1M@lю|\Mdljv< -wYRdꈳF qo -1VOY?>7S8NEx?nI4\h]dc6Z6߯_C53e>a_|}@A_YQF%+!U̍RGNeZXԕj'AuP2+xǜZº>%<c͹ jGlĴLZiU/8Vnُ@)0hnm]QsT|W}tmcsrGٲVç7yP1'F,[{L`xJO#眹t>5uW䊛V$E]PϤ K8_ JRxI8Mm]ـ5tʛ|!?ISǣ;jz[ꯜd7uyLaW:2%d -O Apq^K%jb3Zڝ#ߋŠ7`Edˡ͓79sXMeYY>b<odE{ud6V`up'SJ%HHD75U7Z,2:5!>[}dIr6N=Ux.EQCRsɗJzI3f*P뵦*"M=L|:z(Ѯ+br|chYX4uW81o;D/{RXigs]੬1wr~q}|kv uEoG=I9տk;k_&{Z0|bQG-I H`vvXmyeHOoJ'D0}W=Pk|>s[TFU_&mm]-1YOer}%_00PE+Uf#˓, .}WC|{7\zH Ɛ,}{OT?B=;lnU6J=u(ȡK^JTutGQK .4n -9fý&qRS"]ua_$P_2xw:\X -[Sв^ⴕߋrQZL= ?ʡ]+e? zJ>^C1ɹκ2J ^c(6]n!q@YhR#\ma]h3sUWj߬MvsR'=I s9]pXPžsX g ?V;Z&~6q=+1 -+ǸZ9S p/k2!p@xnҴ~ @h_ASAv_W螝6鴫ɨbxYiFqUȌ ib])hYEӯpګbCv3h15p`2Wq9þr&7$I - ȳ0WFI88LёF|DrUk%UΰڛVKcpV%Yhf})´Ur9,iwTh2LMNےba_Q -Z1qX6.}-2Zu'8ܔן#Ŋ/{˓LZ7.^b['ӳZfD`P=JԊS6dS uBS2k*deP .f~:ݯfZPA5@m&Rh' yh  v.҈J_1JZ4Ϳ5Fq~iY{ OdzGeխǂGhu fEDlVWՄebxgsrK2`+iyq4I:5tiIowqy3hTġ?mVct]~R{ӋWƄBhx\5jbFZo9X634+Z`HG}`OcPj\g?`ff~<+$F@BGW}j/!~h|)6^gd4jW͜u ֠! 3mfl|oӄ&EL/g[%Vaeν^^ڜ擊~0.bWvӮ^uQ`p-2;0lEoqzVr0<._b- *ҷ`>Q-"Od `];6l]K fϜlߘrݛw#5'Ι2Xu3[T筻X)G'u _mքK^jS`->;W垤`(bP.^E[Kwu3.=s_vͶUYv K)Ɍ'{d]PCspIYlB/ciMPljR,p< a֌^zƵ>Si LZu rm~ j꿀I*nI)0:s;4A\{- S9<|Umx/;FؼP?/GCZ՛ ,*IE?EJz窼4shX^WI)(kDY)*?Qh1Pp}2hGǑSn^+ ,yZՖ!sO_[ޡ=?;]0y?N~NF;`缞l0!fMҘM/I|T!W ;}4;5PKz`]/Tzͭo溔D˚ʗ2C҇WqR)Qߧ^h-h~m%UVz`2qk'vKOz -+UbYo> XLyn=erTfv2UisTk}CM'3Nl4F,_ogCuEkͺq{jzNs@xToj|ו_ڀ[Yt`{&_@WA$zwe/-lMg~vwp5ՌKW8mxtP Z(UsfE4?Xe-p .wA) o72CyƘ_  !Ηw܎}XӇ7ff$7CX+(r1lw.,<7.Y?xY -ߛN;sS5;T>%ƒ *i,`sFf4[8\=̐xTW7m%,$"fŬ>]DFb/y5>eص^;*CrT]뼞ڡ C5~kXm'-K1_~C-_0 G-C-+*3Ni6R,_e飯kɐ~Kݤ).9yx{̓ĝoW8^ޱ_ꔙ6aiW'[F[}1G|&Ҁ;g0_j.? Y itl 244{_UUhiWU*åcw܋UF=VC%gz+ kSW -Cz[bIl[5&TWX&ŕ80."EmUIr+$?5۪n&%=7*!ǡzkӭWPx+]]PUǏ ia|Q:ThAݫ̥gpԸ7pqOYvz$dzW/!mPj\~x'^}R53I -+@QR mn/3CQrax7h-aex:\+3N,hϺCsa%| &pg?L@<򮊿7QWD %}):y!ܱ7:5ȻZJ7tra5[I[dpPyuk'P - -Q8W5S,%v=s8:Em +ۘmiNa\z:t7xR}nyDAM(o+Su#9$͆:X$]gJ -B"Ų̐LIN2k~]#ylSY{qX7hE+g '쑓|ڠ,1: f&T MQ\pE$X̓/)6UBJk}bby6Z>O6m6ʕ_/=U+惤JHߜ"XI^mց g0`3w/JbO OݝYngsrmRnpjA l@JŬ S#;45kXoX{2PLDCdcq:{KT3?4/':_jֻI1H6[±z: h֪15hi#ТwWz0MGB]O`#E<_z}yt2C3ӰE #m姭MZCdUWb_}FmD6n"i\SR:[VcB}>嵳^oBWבac0Ts{Ro` W]jԡy KFn? e[àb$vc6vϘ>]{bgv z0Anm t}J{o~'JA6C;}cb?vj&XHQi;Qlf6:F{k]n\("_; m#uqf#w֎i5ŦaiI0rZwg)p;MbWG{geBan^k?Nj9X@mXi_B<Ɔ>3{h? -fL12c1FJyѩɻV9l߷6fuf(otJ* W1=u ǟ -Zgo)/>TՑ7:x =`Y?y,;~"W^fv[{)ϊXdZw~h:w%R´8U]`3k Gؔj-2OVWԥe1?Fz-[NpUj_Sc,vb+ourLc /mg;bo(,̃=G{sp+0%2kdߑԾa^9֏_ZY!4qۿkvw0Žq)@&"9iT :6Ljן9 .QdB88u Z!; BwvپZݗ?žOlq(z7SdDT tt^ǧ6l~WT:t%{n~BAbTX04^>xNҡ/+IpVǾҗz#o2zP4aus JY[zȞ?>ʿYCe{slٝz:͹}5Cm/cE~z{1vj?=O*Tm;BN] D= Sg`+XE8ÙMnKW6utы$'_ \ҐO„Y핐؞] /rU2?yB -#oUO`UjwO_~g- -@fe r 9/;յ}")び=2lP̓85`j{]e~I~/`ƕh#k2Dh5x3!?YK?@{nNE> z᧰Aa3v?%44 פHJWG=NS"YZ ZݴНF uxsYZ~,ԧ^wzbu50C_MF͆&de] ~D,س50Y}*R$ bC)2ζ-jO㖬S\y @8B'J8y,ui\f]( +oy0GW y8iv\֌:zwqEj4-GF]R0`w@j:ڒO.ӚkY /~(Hɽ -xs[GQnS: FͰ˧`.ZiX w_s0 \_!}bԒL1 q -^!祪45"AR/yϫD~+Eڥ< Ҡs8oL끴[wȎzxW$3uw5H&[cfCxbN-~𐶼jXuD BFܺjdݰa'c=N˫㺯"5k!?!4㶤{}蚼G/!j ^iߥ`y58TQ:RfU3N[UXߵR}3m J[C짝:dx[1;0k$aW/9,]x\֏1ڝFqŨ} ^˭5lzP@ -rU\ޟ Lw̋H&0&3cBxH?\C)<ajOE;>b -YvƦ7AڏŊvv -Q hUP6Z p= b '$HTwd$' y0mM\Uag6 QVTIfDd Hܽj##6m{NI -]<`oHcUITX~/‹#]1ǻJ$nr{}F+j.¬k(vh׌\9*SlU`H1.RӢr`;0 -''\ʧ!íftrʐɧQ WXh 2ҦjX`K`ݛ^ُ^gWFeM&=+Roc&ڲe]JE'k~SX6Jc v~SNtRt4,{FzKG@p]$My&l-֑|h:IWT;IQϥDpsQ2pHE8#/DRMx 8l09L=xcʪ݊ v!s9y@ :WF, - (,rb%9J:jj~q -q~T[C7wCLYt0&e݂<\.՗p}]jrArnn4 -To:z=h WM[Ru̅6MӻӞqA'j%6J/5z M{v2I%vݞof?k8ɰt0 z'Ӯm۠Fm?/7V}qQ'z Y;$f~w޲˼۸$'ԸBZ[SOq50@>6",ݪ5C/|йДkxBS(COάRP[]AF9֬Mzi>=OB0{[ξխ1"'={N3~ FY.qذ业3xk{R;G99f~=gxNDyA)3íǎө[a=#>^Ԛ\:>jk{ i+1e9y;>AM8dh޽6?h0>hsv`V;cZ;Lvq@m4T+J A> .Q%Uٹ|_1Fv> >ޓH~i`,8/˭ g3{Ii)]1:d>1XR \"nQׂ?GHDM'҆1j_9osOO%n֪?.vxׅg>>[9cm=<17zO _pZɠ*m -wM>=To~rB1'yUlءsBٙ-w.p[xrmgު Ms?H%=u1Z_KBO=|~jh'摛#/˪ɦwM^=ZaoNtaݽ\2ޗQ#@\/ބSTKBS:}*܄,f̭efggɡMnpn&8wBjzhjzuyy +%tYBbGmZKtvԶD0(Fڟώr2rQyo􎛙z݀փH{2iقf#rV0n(:I>Cb3FCe/_DB7Ove7\}Yآb>P듢)Y2Jԯ%X-jkg*/5}C  -Ha-EWmvop?hT gqSE~Aw6m7J%*0'_<ǻ} -5,zm I21Z6{hp4ig !ȴF4Fe#,lv<ҴXw<W3Ct*Z4|Z1CC,?s~PצԴ,: WؒUIb!1k=Ścdp/Wlef I-EęŶ_GRޣd7-Hu,;| ռનs†~*f2 >A\CF޼8.#Dg ŦS#VX Q]> T}މ7܃I(oɵq߱@uQ>Lҕ:+{F=KAJSL)jԽŴoͅ+2ң"U6PrR?'}ܿFך~>p.ܥ{Ґ[qie('?VPˋI/ZON*R GWK6Ďoeُ EJ6/InV~vP:gENdZz 1x{͉A.m_{,ϳb39:1cp%T!# f8UxMo6d4o̿aЭc?g{η$tNw%jRB], PAGg݌+(5˲۝~=sGeBuĺ5{ 0S2dKGr&8Ϥ{T;isБ0CcPXO|= 4rmڼ|ѩE0V- :nf*@FuIu7-8I~^pax el-R -) puV7"%:d LҮ/6c-)BdW_w(Tր_[^#%a'fؙ"k/x;FEb>9S_jnt#FC4Z/z])7-/K -n}I*h#xcHyfƒ"re)dũv:?W,wd7M1pϦ+GL6!Ured;, #EbžFr`q t1+8]Rɑ |6i2$k=G23%ë_pqPW ce9}QiXJMk9 -Zq!p *bG '#>d9oijO[uXS7bdd%byH Zb":4%ȣ*d2hf{vZ>F5*]V}L(w@`gfjX0I쩻(ճ6XY/=WL.﵆MN.ȟ Ywr -;)ffbK_)ϙrˊBX]2c S YS{ _W0`)9uR5BGs¬H旪s+Oq/^sW\IlbeױaBXLEMo]$G .V3Ճl{ǒjU1iwf k y`QTB/WS^wBO.Mic$pr FR -LAO(֌, N- -k_Oxn*Ak˅n'5վ&a>DH\-o#L?emf)P9+K;E sYQE *Mk>{ #},Ph-v~Gk3=gI`Y[ƪl&fih囵ݪ{ rɎ^69WVmP}S&}|,.؞rS'}])[1\] D,Úc%RjJ4'ũ_'H8|1r6S'[sB3( ErnmX)AGE>slů@)̤/;U{Z6iѡM>=mL_3o(ltRSzH@MV8\iBf|9p4-FEk5XĬ{|<>QG1)2-蘾̩1\vk#`m:6YL īcT:k֏<¦b -\.*Rml 5sR~m;spRhXGşBWʡ8˟#3׈&VX_K['8cIy]못 ҡJoBrs[m GbkNCh|S޾(!^~4jeH߾\ݿё#g8NJ ? WK@ TCSr6=nr):ǁtK&O+f UGlIvﺧ âT5ĞL|{n@nm}!aOnhV2Aj'74} ܟ{8CkTRi[(%+s(#E0 +y&lèإ{Hjlv ,hDF;p#=ә-f2G~OL^e!}s5v!h.lDOci<EvuooV);R1eŰ_O5,6zAƥlKH>B-E{O6N]_Oa=">r 8CΡR5-ta|ּOJ?MR2=wvcŌZ0u]ñ n7T1{s`"*V5Eޕ 3OWCنn_ tl uUs -φo4ܒ0Tǖm>kN.@ }0plaMJw6t0!UOr[{mǚV)>ܣ_(=I^3g7:#/!^A 7U;[tCFQ@.}*)vPwE=-kajż94[)u|P"L`%6b XS; ׉"&Cj4xq ["ؕ[upMڲDܺP**F*u=Lu3sB#6,Qt}u2LaC{ -3EFG @OEי}]{ԭn<q85vVM*lԙV^?RmNԙkџrǗ78g4&c1|KT/W+:36FדRMB0s]_0~ͽr5P\*z_Էu -ʯ끛[B)|9꧀h{? ޳* -#~P0v{'IGg|o`H2{zY/[F"^ϕG"d!Zov$?E*W{K62I y3?;<@:Q8~j?Mz/oc 3͒afSG'6s#o:lPvx! -7v)F}Lܸ8=90qV}hn:ny$DLY \_EO)7̝HZ j-WS8ߢ hER9z<,VTur0]h[Yn]}]hiz`BK<"CQ_̎v?я+Ȭe{1M@VOyRvOo=noQ .կoM|hSaDX \Z.x2{)Rryƽ禘(˗pkG$i Xe0n= ;o踶r8IϻQUIG\hE\9 -$lk0]B[" Ix[O4S -5NaE}H}|e48K00khw T!|$Y 9BH~܂!GM“y!oP/"-c7^^z~bxڢSzwLwWm0v>Џ]RDXHVa{qQPqQ6l yۺ˖ ;n'+,Zk4+-w?Azh^aO]ll-70C:B.\>!.:M/Xh/|ؤ|Sw3@4"2˯ݻ{`[Sk~Ni[s,IbFFG:D9/MOD ->D~2A"EU4׶m|ߚ|Y2̓S~xVmS 5]7ǂoC-}<'EUMP͉".!vq!~۳c&:wsҮfKk݆w}݇}3aleq({`#*#U+)K4%m%,@P̺7[sE'enfu򶵍Ϙ=a|\ÿoe_62>X৘*-1Z48ֺoNzTaw$;]7i?{3XhP*|7#GB/PHVTg޹'>n}ok<2[׽g Tk,Zh!fêN܇B 3`YY(D7?h[tSF -آ{ -awSdtϤCҳ" ˘[$ݓدQa[O[N-; ->_dW49i%SW2f [|a0ĎmI^g#-<%mFo=ED g69Ckٹpl\YCtͯuܠxE۵zT`yjj7l] z=eNלmI%P+ƢVvw}0B4EZ[' 5>Q}ٶpPxny6^V.2X^U@O@i'o%ޢUOO/vQH[@-[?.wa&T(xs_HJGiR4uZ*>s͡*/r (]K?彜}yl.H=< Nk,ӈ_^}s'xKsxMF`m䊫t2s}io5{JÀw?KiEiA\S/ޏH9zc-*Z*VnZE@)<Ծ#u1}+V0+&$/D{ҥrķRD[7z> !Xf5^(o"=N&1b5h=˫Ԉ<P7Ca`MTωG= ޻/=I^)vX~ suB_28 Yj|hBsD_XҼlJ!./G\%Av ;Wn wVc )7gP3"4=qW~bk[#b cG,zṱ< I"j☱>Գ hfHB(޼li^q6ΐr!feM =ݏa~ ^e_.r=܆o1lWcWKy OwD<ۃƧ8F̉hp -boa۽vӈsRRxiG6Y9d[E1w|%OHѼ\Nz>ܺ:F]%p!J4.TURH;<6LeK\7к$5 -Wk'ry׵' - F]1f/ly.BA겪UMfXb%zkzJ32|QnnuWSX<9C2Bz' T^s\F6gD>qٽ_j,))PQ ]*y5;, (:$*Gt[0ť(mjF['۫Rᒡݎt8k7/\Q4u*ɒ㠳gvo]$r!wç a%{!g&E Ĭcce>E~%SQk4P5}ZMG [:/g.̹su2C@g {!$< IJs^ԖX(1w"i3W`=*,Dkk2rQʗǮ>pԽPS2׆my 5y5un֮?0>Py RG]}km q]{O۷ShJMr'/[s?z6.\~ȁ4WEb15(DE$K><#BjlgO{Qa5x,YeL#&T ?X̅]v@fN+$6˷Kvc5Ic_}XSM4Ph\'ߠ<$bc|JkwI` /i!َ{"XITÖWzJ,vܗ:}MZʆYE/.Iy ) }Ti2E5QZ,aluCiB7'Vėn gF) -#5X[ȨT%|驼NW.fHѨ͹OkȺrwu"F1c -UȌ:u1 - lb[;lr Zcg<\\mY8n4?yul wk~i -ʭlDL}׽)iJO>ǃG&90W}* ̰Gv-|qn:Ec$f%Za$b2 -Z=(/MQgXcYI]yZ|`%89#+W,x7cczB;sW R=K# nhI3s׳cM<`2=D:Ă*.tU%'Nt-Kz"C5ux[zWsqcmT,.ƚSd?3P:@Iо1: RQzH ̳twiF88RM?c{RR8vops"-y -y=a"ۆqj{CU~#$:Ua9Sq6D"F En<6|4R|Vql>. #3E`U~l;%) K(2S2ԖOeQOFdNCvֳ:*2G-%NІn41Wy,;IB4JRq!($4B޾bnsݐD裴n^-ni/XL4^/L)ڃ*m9fYg'LY'kޑ|vh0+*Aʚ>N׌@Xޚ4 -C+.gf.$[s۵У)4v-8fxh7z7ɋ>t])'Wˇˠ?Yi&70}1Tv*}Mpb$94Ċ'kJZ98r6'oF$I.ίbt "6oEA(OT=򐄑z1]Q.m[dgY$Z~s@UOiwZkW;5Qiec6ƍ u^ٟxrQ|*7WӚۚtE"B;_%Fm$A6$Z<0Jͪ)op8{y(+0-ѴGe]"y$3 OqUH~3@~_?Z~p7WU _Е'Zg@}L+K7>ָB (3hgSZ^ -uζrx $ẑM)r;9ya2l.Жّ_MY6[/)-0`X]dEX¤ޜ/PִH?,7S*C |Uw;q ;)Yw- uGRAgzsys%{&wxx[l%Un*cվ"[!xu y`U%>'[%=LjN+N>}WH -PXQjc^"y{‘>(4o'Aܕb50$A=ƭq<AT[zrBiCP -5sʂqY?<~:&>jZ\e1N 5ӸTqUa;П} 3Ϯ?^7&G=0.tO[X~NIgWժ>?;tv:\Oޔ|v= ?Z{Tp s-!o92,ijH͍g^ac7PVͦP:GҝD9ضfU_cl -|gԩr|"#L xKrag3LMaDf]I[7 -S+bx)G[*ʈ]b8 G%tvMKfTF Yҳ9Դ3ex2؟W&շ7 Y`YVN^fh9~u*O2eb(PLDLN`<Quu\7^?<A^TV$қ(.n;MdN#߷vyHiH &n1#fkv(j{9(̯JoC ȿHgֱF\''{RN{ .NFu:֍X3]2O 4͑WCP:r3S%.XQEl+L-s={V -^zck -bx#ڏ⪷&jejLVP"8}C-Zɭ!%iIN_M_@o l.u" ަF˺.3c2T?E};, U׊6grR\aOOy6xR15X\k?8o{" e֪=07{9Zk2)e$z OܓgsQQ#HT;D31cnH#L uAp"NJ8}߾D™Z/bZYNQԟRŲElTe[UjR_oe\^\lޒ}FG9|đhtUt+qa&AO *J%7"dzE2ЌI}-(]1\7_owf['te~8eC=pDnRTe:]rqx"_ 4 - z5bd;SHu1QG{3rt? i^ uu?iJbI -=#'vjՒ6 رJrDj='tم׶!ժ9WpWÒq+I5bRv ?{)qP.<i+sp 6Y j7h͏GO8PngF>_iI&~J7p}S1,tfkZSS}[~6}gx|"vw W8J;z9ݳ;V;U}^A'h̿k-ɮ+ DMW;^;֨@j=}Zw-DC;I8i%s(dz!9&O& -<\!8+G"7#e/oqƸmp3 -3}HaS,z+/0=VjFn](/D<*DT"V:'-ϖ9"З=ڍ G(he57:S6\+DƠpQ9s4|_5jZF:S 譌dN⍬0++[_r%fg;c>YwmLxьϷ W_$1?%xi['y$W} tp8}[`foJt9^;p/#C -\)gV_K$Ila^GWX}6W-| JxkzŶ:Zx$l"Ic?<צw0~u/A?,kuX#A3XLSws?Bت+DdКXX,c6>8(LsuҸDLYd#zH.tQTd1[PtE$JQہċ>74MFW_M$+y9l$#TǸ.W'0Cd ͽB Qǎ`@ZW2 f"Q$KGF\ YŤKF9fz,|$]@Ul<83Z\7 /;c6ϙ٨ 2D#bvQEatZ\XbR l Iê;m8[ -ѹ@]9%/1KC(䮯xj𢷹(uo%]鏶Ion*ա _6/Vf{0 P ℏ886zI/)wQ!_ufjfϰ\\cjOwQ8T2G0ܱWww%r=[ so:`I]@ ۀ~n[sNx -'<*`Y@>3,~.\&Hm |9{櫠}60.4h7B)W&ku3}7yDWķ.t*&]X$Rla tޭÀUzV,{Is(麃b^g\ScZVqJeIV*w;ˮ/؎k/2'=܀n4}s9s^RCmԆ`c J1M+ -+/]0+osaPGLJmvB귃,ԏu6Y0LsA!K)[jG⵴y.4k -,Un қqVYjVSZ_쐟@[:*7F;nuR}*k<]{wLt9KS<>O"[j~_'AwVVWwm0K:|eDbf)k啷r\E7ge{L=5OGzb0͂] "\gdsѝz8QG dFxBP_' pI00ػv,mg52|$#֔q>rIϽJ e\Qgh9A ,@wP*V o03{Ix-F;GF*뻰䐙F#No6 ;q&R;)[\^*}AC(5II6@v4% Y"Av$^#nxlR5Ov]x >e>̼Zڔ> ͭ(zrIR15h\)Ӕnmo_&k4S7 lFSPMSs.z )CQ.3[R 94x=\Q;=R;1u?ƉeUn۝n̓9R18BVPA=o/tDu8uYjM0oD,,cظv6vᱍn۳vÝ:}Vvx9R Pz3s&9"?JX8Hg"j!3TP.-*>-nLJqGwBY-U+K &iqA,]_v幇DZ1WPE kI g\0d -;qn ޶ziee$B?LDeV3BMT>Z\=wgWS)O }dN?O^B="];8 n4s;z>T|ѸtE;aV5|ggLdh 3׷w3t?AP}"~~_zCu@6!riZ1L76՜Hh}3w6=n)*15Kg-ug4tay5\=sӺ![@c {;3nd/M9JPZ{[gֶ aln97JJ;ԣDq3U,M`!oĠ%TE@N[6<יfťYxYɶaP.tUӄ}: T9]~W?ե5!1N9jgK'wPwavsCZeM"xb"maj'jFA=ydiI?<q3[nǭA]wڟ iWl6BS`"D^3jocʣ4*&;3OJ'DbB0)_?Mּrɫ}{+S'#u顩w,vbo22ɵZ̷xE:ls~M?4Df o;s0/mdZZ5*Bt/A8~qrxqvL/9bvyY]~R5L!2Kl'BkJxO9\:^<ґU?+ަB׫3YG҅g| !- I+,h@}&uwŋs>C` MWV3֠uCg{.zYubw(_ǟ?F?Kz"M)?Kze&YwWw0Wݱ|¿&$'0s3Eg{~+*Dzҙ٩Do*}cGZ~-~i{0y - lB[3?|n>Wx*..efd;x5<>[ :]:6ysMsO\O䅄QW[̊Y4S2TB  UP=&g - U/jsNX{dcmۙi/q7̯_075 -X-N@ӬY7 G5wq-gp\Ec乾ֽ4Ws뮳Z(7\{>&9^iP/ZHxz!i'ӭIЇҡnNofǷϼ~gڣ0Eۣœz1W\CWSH.\XEw+ {v0f5x|U*|Z$ީ'f3pes]~Ҁ==&TPS"UL@R6dL|փ -ׂ=h%9^6_e𱫙S{[֊3iThc!e*?׶/  wh}QD=N_֫}l/niB(D4O71 ؼ{+{U|3<$%cOl^ f[yO?3+Z= Tr.~Љ.CCw#|N~N}ȱRDMqSf-ۍQj41P;ה]hg9Sп ?EtX)Hn/l3JDTK'Vv]W^Cfwg,T|VL ibr5iF! h"~.U 18 U瞈Fqr {tRϷ\ָ j:;&aj Z{).xf"eE/MHٕN*폛m.KZ+*;Ў24ɽ^&DP?bLR%d(]H3 -bߗbЬq3ު7:~Mi#$s\FT{Wy]9 ,N\O1V_ժ4 {b8iv9wg. L:;<6vC/4H4FXt`.~?.!<{Qf~^z]b!]O9޻ntV!~5Us'/]ZgyqVj{ ޓ%珛 1ȞKU·fOI}}lwg\h'QTyCZT54b/Zvʛ1ᛁއ~",m9z`L T \8x;}8Llub-njTҶQ5<V=_QSK$ (杨:vA|:5$ #&$k#pZՄŃ-jpx9 h`z2?6͢2#ǂp85t;ks:b>$߅ãцq;&j4L憯' @na=.]u.qPw kD>>\|c r̟<ş< ɟ<<j[3M~x+| Hdj7>L^L}0iL^7 -Tf~rBJo^Ǿ ;! *5m-jBcV';j`g{*wB{D+5M? O'7c)wld[wFw-J5mGC[K6&,WNu.=-X {CZ57sJ2.P -SFS2;A0~Ԯ[}=_^;L. Eיq1> $q>TDB\1ւ?b\afrs! ֮G -sny\'P|7_+*xKγ`~uE5K${sQqzVr"s -Sx#Õ=Oߙ|f~1h-3cx- M޵PZ1H U*_=a>w:a#-g',[8Fk}=7UΛU:]Owcy|!^@۟ggMH1V}#azՐ[w撊RKөK۝#u\EGL.?10c+ى*o+WE_y*J{vyֳĥQຍi]zǹR:3(mEHWɳ4_v iEo$TD(=c_j_~=b]m?^Xz̥#ۋ s1zo tc4\kX*!m-;(OWJ7gMu^a.ma<}ϰ]yl㼲]vv{ٕZK_*>]vGx竬Š-7'qVrs}҅"訟 5sM5-k/.14DPk<1|f f߅*GɳTVfؾ.-ݱ-{mzˁNP]2;<>ZjhP뵪V5cWC*vOE 3H`1?b$$T'JRd~a,Wn΢39B֪F%4!l]'j7;VrVUq]n_iMw]"Zw q(6k8U?Ek;ڨӪ4WH݉)QKՊ2Ë}Jvlq'%( R޵,LNPDY9SeR6횉K备:t:'h=E8GE - -|}6Z@pX3҂Pi  yus4G;ݓj3oe@U-iVzb@BA<5 ÜiIm2J@~b>lU"])X6@MaRf-ɡYE 2*59h0zu`z H[ Uڌ߇o\oq\|`%;ں*~ƒk"z~Z-vt1T7 FZ,8lʌ"  -N7.PvbZ}n6>}tʻTЄFXrjeeͥgVۣޗO3ODu& t! -y%(elFk>߼ Iط]Ȯme{o׀:_]ӡSZ NK¤EhnFF$* -hk}W1I;L|2 CRaJ{>:hKGճ:o9EG.Ic4z1$Qy\_"|k~V[q'$Qerg -WILq7n\r/8_ba鞎&]W{GG}*u^ڟV=Ӳ $_TgI,GQ?3ͧ,eߪ*_/I3߬?/W_<6 -| y&|71P A"7]WgnžþAW=fV՞j?0 q=qZ8 -˺v5w^Oo:IYWYF[[ꙮP=l%MJ%FG% -%~ 4Lѐs!rTꞕ{^Z1!q^4pd{fЛcilԦм,sG!,g>:< ju~WH%ĭ~@AZɒ#,ԫCcM&y4.`RL.z|OTYr~y y`cBl=WHĭjvTsN%Y< #ar޳^ 8>oR&qeUZel|s;EcÏ~'5[9y/{N%OIvvw}GieiskbpND;+睞~T^u/dhp; _![WG[Id>RU=le}ԈsEQ[vMo*H 4aNd}U|Bx/0ٚ{x>8Ґj֒!9i>c꺘ZCU͝AG[]s oZ'X1d`(6$'z;о^mYy%~$ɥ}e *q|fw:<(';!|eo1<\ѭcnm`T*z6HAEP\9J{!nϪ4[/qsv>(q7+eu\'LU3k}K{){gNdPE_o ]c@c4onH)R$Yy هC/N|!\nYU/4<_pXȀ"3h'>Oq{D;2eveMkRO]fv=0U'hid)lWDKPG$fXpT_.(uCInNi^327~ccaBNH;o&?HVGfH0Qh'{@ϥ9Ž[dzNxXWcqq8fCwjH܋J*Hn/n?2N:q+Zqf#Tk{]-%b|k1Ң̰Z&?f=ia+mڻF_KgOA:6_,7]jvOiUsXmF -6c 5[5zЄ",QoM;^B4w%;L -~.n)I0+O+ -rZ,H/w =J[DV?Ysg¤i -o+"2|}v6]i0/ps;Zn?45F}H@õ7s}`=@&Ɋ8U; rWVH0 4 6,ԍ6YHpm>~A }0cyJ9H.3pD̪cS \E}MFs@<`M~'gF36}b*ar:y{[ྏS2Br*+uz?=L֋G*! mTͥݧu֒R }YQBOEd:#ʝt.KubU?i+}/LaLoUTQgO߶/__]_ij~Zσ_T/rKXy9%N3Ox^w/4}j/]p\`n*u%8<J,5.oeˉyP -'3v\}d,P -Wz¢70}\z=ЯY;"W#ר0yqu /*556M5^vX{EChU c:m o޺5WHfACFz/˱Wdk7wTHy[$:'HIW2 D5И1]>yE[_.޳ݰ_Х{{"i]sX14 ;^3{^j-颯{ KG}WC24n -?=f drM} &MAMX2[ϼz3H&#׎s;AҊ2w[u tdhitӨWZx?>(oJUj c$pG\/դ2_ɒLLYerq~ew 6zxY<LF9uaT)}M۱(sgQj.Q%4Y2Q{j,'w@lڽ4`;w|.KޞbI'Iůxǵl_yW)&&t{q'3)NydN͆O.6yLM|@Qi{4zL-'tI ۗN O)y(FwrZVڐeY$L֏Vy!jMJ:qs /g -7q!N]0捷jxoOSKUi[LvqⲝIŸ*/H.X{Տ0Iɤ6DUPf~/F5zqpԵFgnZW>GZE-`bw'C+B&ys$ەԽB -\iNa5ciC^݆T"1A,|!M뾕VsOsG֢Iq+빯X?2OvˉŅUtQyZo/F?.Dy]rjL3%Jt "H]^# }0rs;f&T;⸿0Yӆ3;cU*>ߍylM1z;Kf͒f'S +R~xsד4H7ēVg$jG;=b_663rq>r7J4J33_Mӂ衧}qk^iF3l17?-?V[~#XU:G1v@qVNx|l6aLn1Hjq̢{ 3V~i+}dP%6}~ utI;쟫o|3@%yI?_kD{ 83&ad ~)DЭNeP?sL49VI XGQhLG E8ƀ%+@4ׅd20p>k4wu}i{`mwo%1i)W읮avvlhfHtY'ox3 i~\iT~+?m[39Yh\N,Eb)%VOTwL4(UUf-s|깇[87Vq닙WN|W7 M(wj'+"T)o~ݭ=%h~#H2Q]f)u6%DvWSSϪ|6QV7!|3!l&v9Ґyz4&Sְx I=}>6^y]B8u6c_U&1zfnHFKM̷o Ep*B_O-HIqZ6 (܋ҍU7V=U`esyc={p̀mلq.mbYUQ{=83W[^q=K<LU+֙^-c Lρܦ6湫eEXI>OZ :nHQj -.!ߐ{AHjSӵl.qC^XzLU3,.+CnI,m>k -繞^*tf Cm:PkqC{Z7\D#͒){77\6zy!Af+S*qu;t ,Ntv~՗^)KIʍ9I qvBE*Z ng |Z|ys7Oa=L=~}4n;NBzYיm糂ze˼;pq]ⶊ.ⷜV_q?' UMfMMaLY7ts$>J=Z챱iSqt(|« [hH-yE}%Y iT9!W$I,zxuG0GPk=.[2nt/_w,0z_idz FP1h41˸وc{I~{~dZ팒V><պ# b6idZ{ ?mIM%>ծg{hj)S:8-QM]eC@1Qi^7g4ƭ{ eqCi\orQhd72A)FOHXNw}YFCc{'HC,I,G*go!h[-~Mz6-G!w?\J$Q f;E C46ôC=(a3YG 3-#䓚2ʧ9(]pfI.#$!?P~ -lIb8-py7FȵfH%'Ѽ1޿b9 4%4Z DiB0lt2)}=SNws}}ŭ [wyJ؄xßdI,V6qߤm}y]=aE4Vo>sVȶ*P '6b@O f˚q+s^<67񮄩OOUo%G+W }Ӛhԭ+>5mL ^|U~֐ V"} s\}cD -C&nj7v`U>ܩV P"$]2 e?hh35_$Wb !lx/} Aq2ZkƲ_q~rIm*c``.yTyYu:%]< mkz]}lp[ n5%xtsP¤ Gops2v!kPhE3-ų^Oʰ]$zM*AXHWףZ;Z}nbwZI@=#%QSs<|mcnGd mh8 oxkmt~q;AMfEl)ק*']X -tQY4T.xAk,g y - xjqf6,t $7X@e<>So|37!?nYqtdSYNxbyرb=2c4RWqݙij4bwN _|fSi'Χ`_{A` Sx ة8zCH~?^Q{8OEe_N,As9} 9p[B8}4/7ƷꦱXoPrq2EFrVrQ'NjAĎZ;QdKk\-cK=s"ZÙ57WsdnѪ{̌޶JqH TjW:6Uok׺U\(@ @2 -/~YGTߣP ־d䣕`-l>}kхKӵ[{ B[[;vNc k]wk}q/t_Un74܋uAOf{h۽Ļt^-.1X9M*mfcsv'cK7mo\!6ok|N";hb5a]5ƫǵ͊N:hI+͟ý!&F\G -C R|f[v>RCAݕbLV[yѬ"tm&2 -["]tzw񳪼a -yIv4OcC\f\p%zMvjR~wmo1{㮊`vo bX shkVXg#xP+4%qM -Q?C0Q5$|.l72я#jGc;zN^Z K%(9E7&}$NKyyp=_WF @nDdc_Ym3Xf8զ(Q$WA:aO_R&\N{r16*ISk'?2Tviicl(Q=e9Ǖ]QnFy'r ̧NN!k3s J@Jw(1tӅ&ē*i^(nX9;d_rHtl-CeY~tϝj5J}C.=!Uk]\~BRo(HTF*i^gz?]fɇ*xL2o;Px־SHh~0>| ie:+0^Bl]#R"8Zh^$마栓|KjbAˇϊn.V17^9Oͺ7%× -c2` f,KOHfRR]Ror>:5| wza1ľ6oqi$ue~?>{cD}RHZg2Mh-zl"񥏽mj,w{Ȋ}Qb_|wHC,~V5ZqVvy4Ԥ zs;VNUV6ac u&]ՋwZ޺X9>ڻX,,|X83 m~=HL.7\ZZ7d'k>u&Q_OjpWwa­`RӳnKͼws'&voTmmKU<-0a~¾ O $ _+-#oc#dGegCBJD,7_2/Y1m` -NЦ=gԽM?V z<(YH  ]$ O̒\0[\k䵑XɃ^O&xeVdtA&놊'=.S_ -"1z3V"80M's4/4[?D6 ;]U Z֫ H9fRa#g8 9j2oX[6#T-_]p8|hPcuwncݶmZmpձkP -LT -x:3X1ނ#ãUmkJ o)9l4~ؔwq~+GfoWv=w(QU2rhŘ4O&MKkr^X'ʏ4|pI#!5n?8\F}4HZfԜzc>,* -@Ag;LzsFIk)5ƛ-vfS;:Kz#硫[qzau+Wa'm&eN\ca+eZ=UA_*6wO\§‰\j -c f2Ȩ?9?v ϯǭwUtdc 7"£DuE Nl"m_59]}jpz:QEt7yElߐF9X3q ]2Gv͍tV([x7s]޼|FaSVTSOo .㭫 ~:R;m|u(]`i.ؼRᱍDkݿ¼O9N!q*r 䈾t9Dj-DOl0oQ_U~9ӗȇdlX%4}vk(.uj|UNs?jt?bnwr;odŰ*7񦘸?&N7gk )H*TMe'Ϡ>C{nnVgc:_4d (B $\"vVv;+~l;zWjM>wN`Oڍf4R]rK?@x临eZJ<=l -@No DIm$~mntGlg-gϚPݠ@FЁ8t?H($ȵif57r+ K]S\;a#iDs gu33@qmfz6HnR[Ew qkt5nY߮zLRAC@#3OPC\]a[lUWa 5CJVA0EOt'=$ ?V7VuůUx:1ΪCqh.{-~@̩̖K,^&S a^{XhC23$NHgk_ŸNreB)'ei҂\R!ʣɸ-,W =oLj&/٬- -#r !mcE&טtɶhz]M51@Ÿq٠Y^Q~PzP9*,4ėk`-3ޮ'N Ġ@{|>M+ie 'ڛ|J9p{TrD3 H>Q޲lqDHAXYGuTe8Ƿ|FRUڃ^2O`կ4%"Q(W򗃿B(=jIlV.]8c+vg;;Fv>)p+vS=4@ %s2"28J*crwFFKΏjjkx= @ܬPBySi︰E-NNJ6y\.^J~WDP@v:Q \MWJmA1J%S!aGgm-_N% /)ܬ%\w:|8V*ǯVwQ| `ݡӊ2Le&gbPoo ##>@hl0?\Qy ~Wt%A:{^J+Ӏ J9SD5Lv}$;JlOK:IJupm O6M)+gI^ឈE˞ȯSaaa2AVX뛥B\*m3)?i J$-zdn{a3fr:o[MæiW^޸i|nj@j߀P(>stream -n75*U4z)繸ҭqu_Kz^lY8Ո.Q^4~lN6=-\j❟-N,?wL -mO76c4K%qYwZUϸ5FIѽVZv c<|\맸Rz/Њ=7GF)lrR#PfLmҩ)~Z׳><n_4헫?/$&:+ T7zO$]ҼD4#kѹ;.baK[fn Vo4;Sn{~Ӭ7R+$Rkj^"^iZ@)$Pg7Pqt|'"k]n{eo\^&unMLjݾ2ivӎeFsc7?#-LaG 4\C~SiPal^>Ps^lcX͜>Wrw/v<'ݏg}E;vM͌oxdD'[$nk %[*=ȸvS0bbek?ƛMM>^3X= xi:88v38;!v0vhESn}`c] -t㟑H$& ߉MoJeuPKbaEr»e+uo4%\9)*m}X -o1s;laNpS79kcmU\UA?&ݾ7rIJC$X,>p]R?ףp{-V.2jBY`[;9Ps">b6,VUQ{hwl2g q蠒bʴd&P/{6Њ=߽hO"e q>2zp[sFQoCWodjQS2Zq+b O%uIcTsK7PHuUb[H̹&(81Lz~oLj3+Úc˭i 􃻲J o@n̆$!6I,ΣvwQ~;I_N?oN"(lT~j ̠OVG}޹|=tyfMcw!-Pm/>T5 ۶qt 's9 oG[sG*@D{2&:3O\v :_z_qvcu#ۮ0Vl֋_yl*#*iDreuqYL {iyq>YM0m%Tu|X]%<~gԷxNv7BTN7iы;e9{۱{i%aEXXwn)MS4ǛlTiLr/ r@s^{>l0{5u(UmKbsW2M%zL5-/TmV:/PܹGDQE : Ig8uU%ۻ ǝYYR7~{ݺ+]t Fb<3 -ӻ<: e#@mqf'IZ٫±q91;BoAއNySu֤GЩn6HDM_R=+H^f󉟩ƯwEyD;0"|cy|"?@K( -*L(s'^ޝrXr۽yd1]ך2nuy-QslЈb6i*FFqn\~2enmXLv7{0P_xPUŇ]̛WVgy2t!u_Taeť*RGa3^nSOڪ1m^448\[GZX.^( ~{aFgJ1wcֿmeH4F|WL(#sfDy.=Wɀ;E2kor# j[lIy*:C_]3Tz 6Ëk_gF -* -/ Ek08| ;!xݝPj'OqC#8{lwqX -sTRP||̡ڻ }ҿf+\V٥_dCpMVFI6mg$%:R9~nO]?ԪYFrƿ"R (T|]7w\ v(oW*乬ێ6|D0gЀ{ VB+tq[qEkdyX%?zywd}+v&|3/ö6v5ZV K3 Q2&kXMW$9@?%%3]/%CAƥVgBa=[<d*sǛ[)ͅ}?-= ;WE\ܚb:zSof~)?ol ّqx9ֹnvƣ?F䆾rq>K]_u^g-֩ك{c9AĂLݜ}UG4~➾!jj{g_'M_n#~ޢ4bQ;LjW -n?XixOӧ Q_Wq{+iZ;(i=AaA+!ⷊ7gB>gpǣ^nE9ݭD\;uqk{h(*hj nl,Ol}PO/R|t I;\ rȬ]@JIPjz' -.G'Q@ڮhf -襪i+G -ODkHo~P3*9rw?7jؒ3C>*-X5Hu+|11i'R>5@T&bh|hwj>bp7|irCN=F9myH8W3Cv7tT+9nVzD^ bh#@<o -f=Ff}NߥAfA]Ҽz~ҔO @CzI.R̯:DSd~lj^I~ćm#7>MѻR4]lξkЫt XOf:-%|3}iI;(Q]x s].͓8 fo&E*`7MGwn526NQFIЉTkvHo:4PV{i0LXSݍ d^{_[5k+lbHY3~'Y}sT#bJ|m.ҎOcԢd7mw}j"ua `[j7(y.˰ "I ot9?o4=fp[La{"7pd GL#d-}n p#зǭ>ޘ91Mch O3R"u$R|(QW5AOtF\+jm~Ǖ TKT3|sU8YK;9FX|:~GCKG3;@GkRP6]s5t9jm^evdT/L5]<:.ۘō/D:HյB9ߐ}c0ͣXo}-)Eƪ> -UKdV%Sd±K7 J'ii@?#j-鷤/AePi!fs^+ ו~^|c;:=[ȎeXynOS_{{[ .uB je.ބYQm"nćuER\V9;|H?=;(UP^T0#U89=?5(Cv -NJ&* ?X>TTe -||`͔mSoz0N\_s7(oeEIQ?r$ ~"-6r}+Y?Q1c~rh9`kU"?saq9]2h5P{y.^#;wqqzC͂J00_/,NuYޛD+;ba+4%2V7g$#iv~Csnd~M_}`qh|lǺUC5wY -Nw,_*bk8X!H=NffGڛOs6db_,uP-l15 ݪIL>[Mw7){ӨJ\X4ĝrfjw]`˓Gcj4M칯9`ѡ&BF2<  -`J3LhKg^^{%^0ލ7S_kM)0u"> 8:"1>y=8tADt-U=9Δi^ȟPC?AEQ7K>>D(דiYZ[s:f=W3یiO2<X(vxWXڦnӀ|لqy_B6eYm>/\PZTR -׳c'"ǀf F9BmƗZ:3{uKUJ2Et+Zҭ?#zK?X*$ޢ?`TMZws¨}hmyyM#no1N1޳JTtg%νH5F-ƀrA q dzgI/2To0z(})N:{vKݶx]n,m4i3Da4X &1w9>2E'c T4˄Yt܄czӑN첅eB,T}ÿ&^&aGB++V1j* -oH;q7dKhrRO]gBl ?h.W;ky-JC'sa ԟqeИO9kMi;HVw3j5et\eJs[91=0B[J#NhVuemOi΍gDɍ 7\<_gl?5B&W[ZiUe -s_CCWW0yeHs{jag n:pvv]h<ذ|nNzmzWc-zlaJ-ǤeVw=s%؜)'/wv'siNuЄ!pjBmTkEզ6o$23rbX;,"+Vj⧼`|iRm1m}0@70_Hn (s > -hf]kFj[E b+a==8~ -D\lB2Z$71֌hF,zH)~WRwiK\0=rTmPMS|*T@!D&zG'zr"V$:|;Oxc`5ꢊg?3.E}%"JĚ~>%wح]M,@[;*(VW>%zDo@A@q5{B'&R-/NKeoaśh!Dr#(:Z"0uucb~,|*vD % H+SP\NZtk"JĂ/(88&ߨx_oKoMх U<Խ}xWzW\$vĚ|4;˟@ԡf!ie$z?S=H[":5Ɠq^{-]4KۛO7g[ -|ڹӦwcſF :QwdnBX67M#,{OWb.9rGTuޡWg:ۇ'62xGM3Zki3zCLPً#[@~_@֠:4cܷHb\cNzWE_~+3s3fgfKK?sڳ(-~U]v;=Ձ IKn_5b҄_ -Pa\JWl4^XLw[ "9@_$}x|M伸>nrQZ'iL =:q`3&];8Q%{ư F!?nHf72 jHZ0n. -}ejnq+ۢ.%Oĸ;+Iٟv_~GĮ<۽f" @w zk}uک - %PO>W@z&]CM ^F>R@NAIIm_qGVp*~hG'v:NwI-o̭, p2aK-nUk2 Wju&*(t6zaci.>>^.wu~~WF j&iܵR4i32}dw򆋍BNZ֔_Vzi"دK'Rv`F`^87ʻPwOGx^G?{|e`k<|A.r駋j UY\i 8 )_ H~vI^Ƀ'qPnC[5>69V]-C^­%cLܣKP'ʦ1+fGž, -'@@'n/-JZm>I*I_*ZcF[xÓN^'Y -h)`&0bRf;",]^OYVI$`~RѮ -?KU"Օ&:̞H~4j$]h~/.qG8,fZ䲱̳ -%fKG1C.t*;ba6_Emza |%g$4G9I_bCPxZ8 7Kbc|  -{:AO7zޖwv#`9ťÒ2豤rS֧p|M3fnJl"y%Djl@y3|&(}%پ%] Nh=+:\N-AO ?W%:#}|U{BmMyYǗO - 3_ Odn(7(qU̫st/9;= ::WPǕ}az?5/c-V=բ* W{v6JMb #H^ևüW8^'R]JC/eͳKz#rr^A`&KF嵴5dM<1^׆| ㄾۢ>+rܺPFW;OϤ>BrOM<u% @/tvFh'R*fH+kaZo'wVq nWwdr#XgyA~ED꛼VȄ}tr𬺑m<{ϔ:0C-;Ie^T4P%6X_W䣡]ec KFUsZO@UV\KcFb4A4x:_׶lgcZ92p!OTl%1HmWWJxokt@ 7GhA> 4+ldnb-ԷQX+n ڷ)MjwOk":W-ŸP {tqu%q([)ܒv_6ؔza:t v9B5[NZ8> Zncݽmw')Eu}zaǵPE5~M#s#/)Bup/:P -qm![˰+ aLڌ.Us[|FEE]TNYBkɷ(>nnp5$4Uw*^v^QKcK*Vjc+=q]leQE3XB7aOv4mO֊F _7dky!Ԑ`.V W$=YZMz o^}qA!ֱL'D -P^,(d#\AE"܃{PŘFU@t?i;Z.|<냼!A~ k /w,S $Cg>D'p 4 䅃F<zO(QV^Lӽ5rPM2&{\j78b P"vHĮ)P(lQIi vh%8@~U$CjޮydScNk?{WMZR\@b(K<.R"UӠ<(`:y`]DO$[`qLFhM"hXcWZO~(.ym_9((%ft\Ndt*N0|7$zwľ(o -F6-og"PB<曛|x y 'my,7i?$*(£P!ky0}69 1P۠H}X@!$x?1|5oo._oLg"(As:gJ?&zڄU 9 W8^ȉ5$v6i$}ps݀>>]\4;bT5ֆO, -{R's-H-%gsw-4S_]l~EҍʉTgHĐ 7 -G26@sW4Oj^6R/hm7֧HU7mkWi/ ]=øِ: p/>I|C+ x$j: :,GN _ڏ3/Bאg&lW>FVD{tO5"+-"U}e}]eYV*N}Щ,Elrc{ߖ6_x;)!jX+2W԰_1<&L0KAn/^#uIݳsoӧOR4;fqu^ruA#VohV\:+@Q%p%QЧSIcYF[ ֯텰q^:xݼOjMg]kDZVhr߹qjjFH٭^mۊ:^lV\BU٠!+/{zLڨ0M|KI'O t۫ orB[K͛]39_QaN{?^Ydn*Ү3A7v׶up4]mњ*w+%:Y&iwZ0VgMug~eS:IVYZidNCˑ_nIvT wuS;㓵fVH+ WU)sP۞x+ɃiFD)=>41f&0h{ɘ™i:Bzz%ajqWVD!I[[e^nYyd '}~χ1) `"Ns0J\ͧ{80܃{Uŗ6n+-[Ťjk oWOkV\+:-Oh.# 8eEiHjH32sTDItmJU%Rs87WF<$cY'j[_\'l1iqTkJ9=)LBqqduPIUgȋ $M ֿ^<tv+HgPJV`/k\݊ʝc@+LUVjjo)w\ dsى1ˈ G+y֘z6()0E+>_i \@i~ލEzsSr3w*lG_E_Ň;|͕f7ͪO.X>% ^\0WAdIHo6)@i| 4d N-- }$geo 簤j\̫eC[[lwf>FP)qGda qX玛j !Z"@K` OuJ:Ŝߟn:ao\v&^`$l",pt<[Ԛ4Y_r|agpU{r|q"U>}~?" -5ӹ&;,t/I ɭUHA_[ƌ2T ~¹5dr[^v<[OuP&#k&mk=u=Rs| ܪS_"/ͤH7`K[ny_vz{us5=5W%g h -bgg-gyRMv/yiCl6Bမo ?*>ӏ*$o$^] ?ڠt><kfYIr7ѧ]2bԇz3zp -RSJ[څ(,.1r+'{81~e@Bs$I$S/ bpԝt)=pVs̫ko~P-ވw>۾=Gvjk/^"~~[*a bôz裓m3 oWiYs5Kұ}X(3* cZ|vJ YWEK#1 2˸k=;*i-Gnu|ܙ\쯸{Yh~9A{5kY*Zk4nJ*Em%MqlȻ7!P<( W kvDWUmqVGM -۵RjyWZ4A:h>M+wirڼyL5;?l໮YjOYfu}p}6ՐRfoB?[+=4lt7bpԩY|f<ߚ-769mr$?nWX ZVYA$8/\.ʩtBQik-}Skaoi\n֖&zD:t# 8nvu;<."H:57j/?9nkҨ%vv_⵾,!w;cy%Э*dV mh=uy޷=͹[k;1hćq I>OTjӪ!DWb7\@S^sbaB%uHf1Gh]SVM?dܐ.aOIN5G`p6ml&T7Œ}dSCUOy6)t(ќb%F0H?0OM骙Z)_MRfsŔ2mcyZ+܎G^E̯ʼn?T,s'mApC2^wbG߱+0xӠ\=kz^ZZ?uJ}+U$a񱗨b_L :ka&>FMw8|`M0aTuNaH6’:@6 ;^d,ddh _Q3g!Bg -gv Kg@9 4}ُwJ]\/$:5) \O@s :"xڭnlF \p0GC7^* L~1EcGgx lx/$*?D/ -jh_._5q"v贵m"ֹ'b^Z#$QxV<'jŔS։[?*LH>E1{M/x;9NԠ([=֛=' yg_@e-(h>\X~prcl K5otT^UozJ jx{* Nj/AGGzCmIll'J5vO2a [*r+Ƨrd =S|,#ny_Eg;2j`(O._#kS>b}3S6!hO|4DS;w*q}R+n@WNY8!|_H*()4%>=@ h"f74-Ajx<ZWBx~ܷދwƃ~]>Y;˔ /f7PeIN̾0%![oO `x"w 3a!vo+"jTgͳ-}Bn vq]9kE! -'8Es'>̳;q/`NlU`1 3&*Y3j?JE*Di<{Gsnҥh[XO8^8T1mV6ѳՂOZYkJlR Tﻺ5xud@U -`H4䮳|ss5H%1& 쯻7IϭI8wkqt^G7Is_3~,g;,| \Ew3zV0s_iUMLdixyLWXUWoWɍ#5r;$/Ƿw[~Qt - 9T[qȵѱ4tg3jUDsm%~ju?yRZdN7׉.xS>ϫJ -bސH//4")(rg nTޯnӏc{;0KXf.4{W3kTT*k73\ݮCӴR T*.*qؓZɈT9I2i[6La HF&jpH}7 -1_GwɾnA?v)oi>i&eN/[ָJ$|}F-: -xbʦg -̻a -zh0;+Z)WJ! Twz _SeP λۛZNgO'Y>y"Op8Jl{W<ڢţT ݁pq8Oɔ:+s/nLm҉,R|R--=ĉi/$%})yWS.ܟ n -wql^R?嬖1ĮUքwcIrDZ\ZcMqK*hb|31c=y -Չ7/l{D*[֞FF4u\̡u)pat7, } D* "|*<5[y豧|8+:G+iz=sBfHw<|Sh?iGJC'댇@gA>w'v9p -;|tpjyOk*Z=ޏ**JOV YRcge{z{#ބNĜ(V#]=v0+{tpLs ΕM;8jOg8刺%~z6X:=紽$vd޳N5tdVZՕI.R@&'72<ӥ=iϷKn8@kߓv#k+}ȖƎw5/|'9ÃCx'|[џZe]W%I>Ƕ-6E0gLa%LM*x'Ѵ2 6GzL)X?] C't9Ofۋ;Ktx/CڣnbVQI5 魽brbԅ=pb=K؏~qW|9v8"wrS 3ݽqLVv6rw+!?_.Y˥~ qaYe̜urj$q3F-g9wd>e53 @aE6u@5۸;^v!f:Ziu urxv֋sg6͊f;U`+G0"Zy9[NC!Ql -| k=:PQKgZbg S]6eڥj.ԺM%UpS3ZTaþUtސLFTr($<7k1݄0v@o5L#v}y%Mel^ETw -1[KsiקO1ǰhWlxaOjYӋV"gT|D9>ۊٚ2i-7 ~C(P!{"۷{[:.Z]ZKjl9ЍDiAhuS+MXϜV/XD }U,E<ŽY ! x2QU3"ۑ-\Zu )]/-MM|q_-ׇ֭mwvdq9j9yс*lxjV $XKa]>D"QOLZ4'Os@,sv/ nu_ nͤZ&Hr5PzTn3a_M}}6Hס[=lei&8Vj@wPBAmbdEkF GV"LXr/9tO `}x&F}t@sRr6+F@m7\)'`[ Y t /!o3MIm;o8\Pj8 -Gb@.ُl@s 5b0'VK0z ơ[!~EEGNRDEqaGKUvsoE[<}/oҙ'm|i(>KҀ˗@WAc%! D&A ] ʋH'1dbӏzf>u a)֊wM? c,e5O20$lx}Xoh@_R3M\Ar3x.k]̫|q01bU3юӌx,g^>Wuc_Wu_>͋φs`SB{>,G -t;3_0_NtT2SirX~\ڪ8'agl fbr Had3s?[[?HIPYoS!iD4H -A>}g'(.Z=?S)PR/t|Or;GGe 7[7E_,غv>c?t.<ڃp -o@`| -sEM/=f|ܠr*}u3F?jMk}~/q֔moq+ u6do419C\Jvг5{ Dln -~&\eBu|sܪ si-.ck:w'*cEsSu(r?H;5ws*eDK[13W DjHs5+[x^Uv|X2sypt颓;XzM' Kyܕ">m髭Sth&즰ώqKu.g]g?jyv I{?M> Un$^א-o4~=n~}9!LٕmvAl2W2ucysٽ'TaYT*+ZNu~zc,z/l1]ܞ -ʽcXEu[*n5oXCXY|n>E/8;;(UWz"\4bEj4 1wzكDe9yd)Ͼq)C챞h j&@a,{EGfpj}`EkVq}O'Ѫvm0zӄyFJ0bZl}OWGɹxz{kqf|b%Y!iيbRI&n*ul}*|/ --XdͩVčeW"N6!8o{1U@}Gp z-u-9\ܛb ̢vk DK6!e}3/7ͫcV>+KXqDƦ7Ylbm9 q[>P=K-2Αg<Bp6B x6|YYb3Szډd@g o1)>7%wЫJoӶ2IW͑Ո@ev)_" Och1mqk\W_̇M!m$`4Jtȷ#4w1y!d8AtazV25YGʘx[+c68EWfGyrQ5l:`%\sYcϮz[GGE6w`|ֻW7/, Z^xf~GB0fT/։|v9+W -3J\W@<#Wr9^3n|_Z:.I1a7|jfvPJjuPA)Ws`2~)HynGX8f1ZpY A7)sל"cqm_сu.Los%3M`Tʪ5,Ը\\djj}I~GI͒@p<7o[_]5c۫l[ܹ0:ܨ~`<)d$?kY+! LS?&zwTm4!+}U:ƃj\hc4eUFJW2)ͲhX2_oS۳^o L/rw]xwaYgg-5bpk - /}>Yf?ks]m<83b^YBL9rtc?eP sqƐG:Jw޶Yj;0=מ=vaȭ wнZnGόn$X?wc&nz`Ez} &㩁{Dsc  Wo]jwtvq.eKXV8<[վjUiӳi)v_HTkUfzo2ޡ\ƙDe~wmھ^<&wux@.>_GDvml{tWm&к/F3aSn`74ڔh6ƞjtPw|/l͵5+h6_18i{+QAGz$#k#kArCɴϳbg-d-<MlӻLCwB: qQk#$xgj0O jp\M c=P>CoT2dpf;OIԈO0dqjt:ܺ;h׸Jm5yS{]?tݪS۶X6*yڕ‹eʗS+4+x-nng&a=˩}L+x&חΏʱSlĘo\/\ (^RK~KjoPAWFaY(]S+5JMq¢2y]-wPU&|>.f~-5yyez3ng?v͖λUR[Jl` [.7z\UBjgR&ZE&z I*1ύi Ƨ3v4ol:X&J;I/ͮwRyl/Ji]ѱz\ڧʼ͹e_KX6(AZ7y|x6A]G#¦Cͺ·"PT ى7=!,jז_YUP qPBƇк$P%M}@|d) $xm@ Ka-H'Ow=%阖Uh5Fx>MΗ׿n? ]ŅQzv:MI{mp@^΁@ .{ dW/9<@z $8I&n .iZ2C!q~Z;twＤ]mlkqmk3Ij&@`豓?_|SC~|᳾]:tOyxdsp*(tomӒ;nWVLQ[Vq0-L= &c~4lps/KǐonN4*eyJ}֮mQ^V<%o˫׸; GDnlW*.H Aװ5xb\џUC$+X9ct&pd}/t#l;2xleng Jhž^)o_}]' KIxQdbT&Ւ |[ ŇeVY/1-hp5*v4ؐ&= i}OsiYT{ZY3B. [a%cUHKrBRf=F8\ --ӕ5}wT}ؙ̬,hzw} 2'?] ՞qIHW<Ƴsi? v,Җgv\^r->fYzܲ mߞ`>Ry'hy,N3y7|ۋV59:/>U]Z3*AmkS, ]^XSlR~K^hf$,fS(WZa#rѾIaBP9N]Ljvy:+CxmCW嫄yodETǗm/tOZ!,qsgG+c ϭy)ޢў1rοReXE%l7dǟ([glzs\񐩎C܏CҔ0:;*y[:D۽dmT_Q1(涗`!#:deߒ"+^#wDc.~Nl޽ȆW#w3guBL^2+PX`e}3;|J}ϸ//2A K#!' dhpV+1rޫ})!pR=ل25% #Bq/S|Si#|+(u$=zˇ!5%?ח)jTʓTYQG,Nup'&xZ^5A;Gn(ڠ~dOx> JAl{՝\]Il6ֵZulF:t6۝xP|ЬJCvN5mNUzg!X6~t?>q.!Ur#Q7.~AM:'yĵ:)K2[Ԕx+l^5:j҄QAr]nu׀lQvRkOxԽ~E9vpϚ&6{LvJf. -Nq/n-_UH:QBAޏ[mGUԯsU|&+QZaA7u,P^D? :ܱ=4fW#ե -i^k˧l#\@oպ9 ;5[ 5 *= ӹV -] Z.<*j5O+ɲ(şcyŦ\l 7_!gyc#)Rp|y"ӖrSNØFGkuSC3ЅJ?yw*yQIQlA/|,fis_Q)SHdi,S}vS$N01?<=\={9 gs:E3mnq}ة)5|:TsT)Fk%q8{j.'_ZpܨQLW6Np`>3B]Kc &ň0mj^j!L'XqüVdc`پvީ3#*œJ-Jv^z:[9(nqeio}B]S?C! -)\T"ά8Cv4;Cvs{'C/,tA@*A@Va ;?Av/@Lo@mA昉@f=@F\D|2RوK \#w2l+#vHp|XN @k]I}ޘUSޘRPS;PAD`.ck ]e4Ȟ dmY@ .C&Ȁ|T@@W \-~grM`<B 2؞@BQT^)WsW l_Y9aVK},@d/nI pR()xJ' ۋ %*7lj\/G$_1}.V 2¦hg'@&R~"%Evnty) V "񤧤_LZkE8FlFPyA*Y=n*TsBo5B?,ؾj~V~@;pPs5I 10#6*s^ԎpyU)f2ҳbPN^2ǫ?>Dð_(?6~Avp*@ܷv5ч@Yv&p?n:޷Vx^wVeYO![tcd/!,W ֪ @ EJ~6?kor|zi |G[b?Ӡ[i]wzw{xnuiՏ gݟ;_v_2ַ2|t4yuFW)(R _~Xx۹ƿޕntiQ=9a.!edO_H|Cm n6ZOߥ͔#zw7@ ăciᑡOqE7 -ow˂yme2`ǎnb&}*&"k:׸]Ii?/$zOPT"q>6 {x׬1 caU3ضĵ|aJnD^:fzǥᘱiCJL\ö^oC-xMwIM hoVX;=LMo/b^M;̐ƥm9ʰ{\VΛTϋ)c3kC{@/SM3W]}uF3:?*󕔿KV"@N@wf`J>Gmى 'Ɯ3YoR~2o Ԣ?Ws}Ľqmϼ8D(ݑHqN 3Sj՗xtu|)KMOj9AjRdiorJ^wZU;st"M; W&S;.KTWK%v:h.ED]gdxVIؤXzoy0̲4> ع, ~s v[dȦ^t{::xEti *3ڍ ~c DMKJ:eX{%Zt|q6֢%7FpjMwvdgr+J I$ReP ,չb*Qx8XnsvesjyMC`GJ0u*l$OMbKda#b?^u2(.Vk 惙0gŦ|ghYb𽙢R @107S.t+p(m߈fm -M.cR:3=y.%k H9cf曉 [,zjcfZ7΀}MXHԧ DcQēY]K'識wvoB%CVҦWV[S㾌QoJkٲ/zkmpkl[Yeq;`>-uR4AҽLW/qÌj}8;PnyutXs2=/{"7؎Uo2T8^zn>V7,cY.x LjԃGG2)|-UhQς(%IPP$(#_3zv5)Wg;le&eҭlybG<6x~fvɭՂ'VI"[b&EWfy8vgspJs{LL[KL[f#OU+_$e޸Ks,b-ͺd`#$ÈOm ʝ𐫹l~->7\qŒcݎRbƨ\ |πU/3w0oh9{6)~tə>VRs.;/e62j6W~(]\.TEc7!.G3xT+;]DPTh.ג;}/AY'혇 OֹFzyzE* sDAPo {I+1Ezqd}ć-oa<"l@I fiYFA0]"[wnѨ!f:ng9΋3n5U!})\˫lg1.wFK6^AY4/u0Ihaԑ{n,=(h=GDdm7,q5e9bdl ͹X -`2OKl~JQ'ӹfV0g6A2D@`koD%{*5wمZzUƯ9j7gU_˫uvلKc}MXb'K1 _%xyg8aǾ[k -h{"" -o6ܦkHo;4tlC^g' QX -ԥ[Nmj}څ._Nը7:Xjؓ͹ -TF ë3bͮ j{.h{k6U,՚ 5νˠl}fnYp9!epu2`zda6tJT]pBI\ -:,e.eìu%[|Gy4 _: nqM\ E}Z{༆UAJ4Hun늧Jy;9y-ҳ$x򺥢<[k -ړN{F8ghf5g54hE&>KLvƈL3}hmF -%MQkwӪzy䄮x;[)=|m$KxrjQ.PnFW|1[簎rN)g [ -ǔ X=od z.*:10Fw#MK!Z9eJYSD&2/4Z<;?Y5} a$b|v?I&rIҗZ~lT&xL׍~> PLwRX}.)r -R('»6_rl'zsuSVAuRy=̻D_!_50~Năl6|),]h–Q&CK\ݨJ]i ޝlQn?I%߂oK -%L$[E˛:1=sv 슏sWGƻ{%r1h - /Cgho .٠x-Ɲ`G `z? %}(\Iaek$ )YYzq;_ 6qͻ ?pՌ aW -v%_b ,M; {? -zj^V>lՂdPG|KnCl>I]bH,-~[1i9]?tJt}[<ޘ]|wo: &  e#mjak7 tSCI]KCIlh O-~eǎ,rU;  K9vÆ} ,7ˆl̬lEc#>wn9O>uثMs^aحABMݢ~&ӃtޕUNJr<ZT^:^{S #[=Gsslw;C̔~\/W˥ͶsH[;6= kC38֑ˉ6MU/|IHC֒aߍܰ}R~.VnԸίwo25uY\l&7Y[TTɛ}Y_vw9$qVb#?*r׫?!)tk|!-݀: G>>˅hG}ݏ_uʦm:>!%J 6'ٜ[yv:{.[}0ԥ-Ȏp}]/cCD71}w[#mޅ#+3FK*GڕڟOpDZx6h>͹KS3ֵGܒ6"[G6|'okn=G;}4fs4e5 -qpQvPNȵAHr2^RsZ,Hm8TPz͝=kܘ -|~ -C.„eć)'eY!)@AK[:lv[[mtUw3YQZv@CS=m0_mXBsVRK$=e n{'yZc|GAGX"yEs&Nq%Gǯ3gW -x}_\И]^fxZ}m;(Z#^edE>'vŖ[q -Φďg#1,, -m *@+9ҿYn2FwQa _8>算C![TO/XmmaU0=eY78%U -\TΪ=]yi "U,2:Y2kg<&lƷϫ#C4gh=ԈQ[$G0|衈8!0O:;=f'Z/9DF-}E艚.m{ܸãI1Q#CeMe ry7]Z=/{ -&dp\W -Bx% -fD 0-B%)hlvMߵbޣg߻?Jw7{lc[v5wP5I/j99Fq[`Üwٔxj{ -0á u*9 *7A?gDs;H@'Tew.kzwhFw#4}&{![.;n-E2LggiX {#l?0ܟ*=7D>A=H0EjoecO\AjHd~^Kw*3nkV=t;俬]J߸FJ-4](C'Fuwx, @-J3VH}1X'VwnƩn&6;vY3*ـ=2iXA^׶o_V3j~=wm̚^te.}GO;%I\X/ԋ ml 3_T=! 0Vz^V=op2^n0UMXg͎ݟ:‹E|]ƅoJ4J}~G&MZVѭw k`-"Qmv̋` ZI [1*tܖ4/YW tVب_~] T]vN ~1~XqAkU@AWVʡBkR m>M ˣ/:[V*bPզOh xHyzᬚn͎:4e -՗݄&>ˡ!_ǰ*׍]iW_KUOJ5C_j'|V] X+ nzr:dt~6hlH׫:դ8v|r -+T2,S!W_S-Rn, Xv9 MQ গ2qߔY+?`?S{/H7t+biVUk 0 P- ׹,XYgsJb>^5;`gk:of?%qϤYY:y+P݈0: ӉG5^8j|= yC-3mu}\-;ީljX[uEz"j>'HC48k]fgj/p<޷x[rBXpcwCj&Hbԭmʮ6"lӖ9xm ו^w F^WѬ[ssdol -÷5wb\0%%MHono|\N57ѾfX^8^]D&kS3MZ_-'JџwѩExzNϵX>[S5{iCAf~IftIyzgte~Iz[vOǞ7_/S^+N6rENj8_2BU&?$Uz+N'pz`쭍4%կVW3KiΡf_·)R? Y"4Z6y<˓־HΘu1:7w -UqIxٜʪ\3. p!+fmz/O..{9tՂ RΘx!ސ\,Nzp-igj]_[^O4PqY \O{ kJ 6 lsmOScY[; w8!(".;f՟x3=4]6X[Ke.y>h:lw Ӡ_rT3Qw O6-s[yֻd.ڸS)}Xhřo.Suc-8=W*1*Z(~]UrVaEz۷ɾޢCs ~ nf\g 0X(ըG?N} ŸNy2?,;j*G\OY oG^B<ߡ?<Ǻ*V|3d }e/B3Ixz\=V6҈y!AެEbO}wL9֦TuS8z/}vJ~Ikh(g3:y3zn8C2j+'{oV.ˣl2Oq~q%P4| HFY6Rw0!i ޒKXe?%kʊa9?`VƲ+Ҩ娭Oz?p mv9WQ 4_(c'xkB߱,8g 5rBvz:BVY~f?JŚ~ 뫹 ӹn -]'% txQt6F/1 Q 90]d,6ĹfV„xW_aFUQ"+O fZ*6w&h ~.&utp_Zw=+T{)|n:83JĬ1D]0~@7gM}Iߖ*S2wHd^][^+lV6wp0?\0Tr*gA!iPʥ*m_]/%v)KH.(ֶq~x8+֗XW_Yq1D)C6l|3.zZ7ŒMpv8Rޭrx`Q|#*(mR(Å N~A M Z%8%R\,~4^K 1WODzRkcϾu{yy/3wY쵒ʟyMUoЮN:ptpyJq>tR %-CiV쿅} F!]y]uYV[{W݀՘gbcbֺ1i]LQSVeTn{(ER.@m{>RN Q@t Ph*0_/AS V~^iOnva%N.\l88ᦣ'S88Ò¤qϧ ߧ8:qȧ֢F <]oz#_g,<oc>kwW6#[KQ ߿Tn.+Ix5w5JH⧂TЧ) +vm^/"~\t(Q*Ϛt>Y!^|]| /=%P#HfI/]*uP|{ߍBIޥn,8 -Ӽ8A!w$oKnJFς\k74ym0eY~q: %rn[k)<\&7PE]'9;$ -~H=ɏ%}-L,@xT;ps0J{vGܴ$9lnoxL;RÓ -iuaֺs۲n3VH8&UƞNjpF/+i%/o$D񨳾o& `s^iZp/$ ݼ_2-\{N5[k ef{k7W ճ9ő:qkzve{M.dbjG1AB mu !wZ$D7?S{ve7JH WA8JiǦXrg=0^OAՏU4taݡl -qw$+Mɧ|fғKN5񸵸s}ilh$iZpϻu̽{`i" -̼sf=[-ű˦㯵Qhͬzpg9)q„"Di=k>4G۽,Z±8VT:d t?9꽫 icTxMf5v1Byp hi0wfmeŝEqx|t]D]M?3["(<Ҁ!hқO7m=Tʋ8^4q ش -{eXͩ2D= VšmR&Z9:y&# (gE{ӜVwh5+dE줈_VC[,SIf QN icۣF 7Eנ}NM=^k\6J#6~ -^^9P܋MB}IS;q?ES"7nAő@J%]ȷˌӤAXx M*3W touE_!mkfdYiwAIo@1{ TXwc!ϿU95moON ݇ҧ){#c1ե>w<9rw& YUcZ5B/!ggLk6CDYKwI}qx`]f"< Ə0 d#"ͺi]܏ed0nwr -7Dz2r3s?Z0:^Eo6vGw Jp|Gf睞z:ʳؐLF$h'Pߴ<~dUf˾3>4IM/CM40agU2˫?ösL8^n`:=];>³̇ZrEhWmg\*d-,ﱂSQKG/;ܣMmԧ_RB-#m)~ !YP7;ǻ&al%_#֒ZSQ&*=Ezb*>=̶P TmXy,ޙG 0ҨˈO]쩤~gzHZ׺$=q)7r`V!)%\.ϼ s:z+'~M͚]X49fJV}1V3yyD#֯7o*ɔp;M*G؍v{eA_*>(L2v[T_6%狷`Xv{t޼|OJU.û=IgOܝRtAVʢ3 1a#mΉVjX6eM֛Tz@,L)Y0*ӠGN1ν*~58Wc|B$+9covvAp*7A)6νǡrѠ=kM-2bS\^slDkl#(.fǫO.ʥToM|CVRwV}g՞G~)bqi˖UcdøO{"BH`Zevk}l1x[?S-cU -[~>ynD2RUЧP! YUJ;2rU염;)X+\i4QK*o˙&d-Fܴ"JC-5,)G!]N6rڂRu]vWb E^,  SG`,r`0_o ~ 5 Oɜs7:٢f6{9=*?0M'ޞ?Ϯc-}5a< -SP>h=yػGX%צz@/k۹?/7;BHDF{%Жs:eM>ysҕg#78tw#9?l#x k&~4<_Yǫt_z89yP]̄@_x}  Y?YlLmrr8xVyϜ0-,6K?G쪭W[-*G>}bYzu - Ђ!R0ӤFzq^fq>繩 w-{?d1 W/[\˾Mdt^!: N V,k[ts7ěbu:o{+Oޛ7Y$Îrose< -tn8;,:OKl<'W<^: {P;^::縥r}jAB&U8 r[uz廛}-Lr/i ܡT)g_jNK&IRh -K cQu mzLwɕGZvZ;l(c*$_b-fb&O:J?;fzIF.EtcSGq8srS!Gp:u/|]H$TցXb{9jpR/IŔ]@o8[)t[#g( mSdh="dbzmf2z;0^ Q{̨fo塚~`P];iwShW >As }{#\T[$+yn>vĀb=|w#oV\?/f= /{ fPԇMS;o4s=D4=u%*{C ƮZ]wcUCb*ӱ^1ٰ89-`)x3+㕋FnOH;ｆD`(էP>RVuRrڬ璛/b,寔,0QE!FHJĻnlniBq䂁]FT)L6yCF~S:= hj]kp/+W|uHkSR -h~;~/RȎ9xv8Sǯ+'xQ:B.^CBQS}BRSaY?R_,')/aeQ;Ȑtܮw`J[E>[ -a_-MA|#O'VrLOfƲ~UǏVG1 RODF$w(˪eIrJ͊u I pTenY!LqYi,z꥗K8Aq "xc1Z*YZ7,+7#5?y"9&7{RdCFdk=1ʧkQ ]Q|x"ͻ!ILMvS\V3P oyO2l|7Pqlz*TXc}s+$8ԍjlNiJA"2%1 'WxLwM?`B`=` -b=,f$(փKbq|vW.[ԜU__JN=5zإ?.Fiڭ23X[XDs5GSH{JqHPlƽ1X1'>PU#(#}@X3 .oJ5,9Yd OB0Un>ݘ{sv=-fFCPj^''DA‘[|V6 ~$$fͪʡh4z]Tz˲GWjt I= -+7y 3umA<tA9ϕV -vͶ ؂Ѣ.C||wN_I^DzTp\s& -U˯nSpP6rp*# UIBn:¬ATYEj}{wDž'Ƌf~LãhT*imrnǥ3OJ%^w͔*b@.J`%*lRZPFw06):y)?6ۡg4ߪS^Cox{sjf@'24ơus#u\:٣bn0*Z$Y^~7S) w/U -o@ dư`aa ll/e\cdGA1k l\:-j7rHg3=G.5 |x9ri3|d(s+_tyhwZAz4@ A[*WV^ f"O|QĘSZj[(#fSc^6e͋}GfLٞqY9=Riz-4@~@<|P -GZ62k@4~]+#wL⸉$;ơG!GXvg/̡^H+< d}ˇT3;P+ԱVuГ`{Џb` -0EYVk\]g?~u(ӗQӴ -iUYMRƴҔČŅHsQϼas=}( ?UX|S 躧Uֵ8+ƿjṹ@cw3wKP7v%Yt\ƠqSzy>Ixr_itzNnN9jڻKe(g4-Ѩ.]b%^'n3Omq,؊Cwҟx_8}u:UtidBXo>Jzum͎s/⩞M?yKDy7יn\t1oK55y4ܩh45^v 㿤87z7VT+Y}}oX*^8];_.(A'; hq675:꾶Oص=dQYo<~?HFW=?WNumQJNSEy$69rS<Y kUvM*>e2F>t}SM /OcrDpCF>oH3C|W>3~X+u7INcCŮ-vBoG4#Jyls; -4 -[SY\CXV*Y hc'Zua& >38' ܏󴕌! ;ɽ@< q}g=[;\fY=採Jo~GdIWF2N9-?:QTnmhVfOTo{Ӛm/> noƞ)~t5rZ%fY[0pWX`j>;'𣏕=`Ϳ]_֩ϖ 93%aZء3fu+ջ1}W@\PF-im6SXqnYzqd190={oVYT)g'g_&GzNF(oCFGǺ)wxtIэ1W>%#w`1O)o+WǗl|bV&b@ ˸J?V.&>tfաn/;-NF'ϴ/?ҷ&2Sߚd|`\3Hc2Z v$01Pa'ܶZߔj"SGu=륰k)rrkcV?n[Smyw-{K;{LFMKwHa<-&CB~v~ŠJEX1`pW嵮:+WI FԕcMs.4@A2R -o7UĨsok×$|qy)ڜP<1mmiF48P⁕j'^*+W -(.G߇fw~!V䥰DskSxxV(st&/p^dP1-%Bp}'n8t _ߔxZ$;%jԪ.B>~^;7f*)qm>j^A!rC3 LGmN^~?h~qݲx&=i -kGqpr_"hjB',jKެބέw?$eo&cgA?LtD>ҋʹF}rLLV:_2?<~R~I˒&*R# E?L PM|h(q <=fƼvQ -:{]J͏7jǞ we s~'$5*6ӇAavh!!)7ܘ7yF^J=ڮ>z1c}!;yn܅U\0O:^u˧v7{9b3p8W(p+͗\WR\/7c9KWoTIWl靺xB2k1k7aVjuK{?9r/{:-+ffخ߁ xn_P#o/Mԓ[_W%zk8Қ==Z}iu)`. ݔ -߾ݔK8%ZuSK/ON±s;aYe:ڪJYuCq/#m\H0ͫɬ.'dl6~P# -Kwqob!OX\!V_cYp( 7S87SV={9jV -P-h+ni8S.=X:֕/sM^I_N*vg{@7Vk=?+dM' 寥ƕ&"n?ȺҬ!wvo[q?[D붱:? Jp1i#G_ ڡĻNcRZI)&:Zyڸ@۰{຃Re]. -~O r mSU̸=-CIUǿ)GjCni5pQv߯@͆i귆)'<"(I]]+9`A1Ǹ `EIb,Ȧ#H`]%`PIthxs;J۷fѶ۶KmomRơҶcx;M9mW}ÃT-[{IҊnR)#< ^uTү&yHVd7HCqf~CI\Fgݹ 1c}'ANͣQ'8} ;7i] ; %ŗ&B#c>{va(􈭎U`VuC!+1&l 9zLJ|Y0~0%elD]֨Mɺ-~~ZF/,_"CUTRI39pvmn.y!f`L'v}8|%7iV,olzS<<;)kU^/Z;Z^,kL&9VnLZ!J^_ˤo^gwݯ -7_]\{FxT $Duo ΤZZEn(gA'_^YqxӫwX9Mއk2H2=6@g5@,U 7Ly $˥ΦXJڝja\A3Wo0 /L9^!t)OZ6UN^Z({}Thbp ,im~V`[ sU gb2c8 K@l8Hfop}4qn꼗] MCW -[\6QlY"PA 2T@ei{蓨e J#Urƅd `\!;RCrjEHq2<{l@=/ǧtMm۬xND4Ja} X,6 -bإ: |&NSol.RW5GQ$ '3!@h ;J Qj p>ݝ @ނ&@@ڳpP3C-!7ctiP⟣C}lW߷ ̋Ѽ3  }j{NK"? <H&~n^% g@ 4 Zz42@)@@'g'KgoU4eTv )3K!'}rjE֞lIЛ=JCտ;/zv{\'7߮{2y_wz2.H;g2YfV?)h\{, Bf!bo/,za|ӧwJ/ʓ݀!Uao1o տ Qj$`r{p~tKDďGrBOߩn*G*[U!{;&w^٥߉,jkW2n"?Β7\gtIw}ZTgPE"ONꞈ 'nzkE49&|6`HG -O[T-o[kڻC۳ 6_٥՘TV`(Jzsݣ֫3Hןc~-˶_cQcS^kט{V{7%GP7V}DwaDĩ9_sZvy ehžr,r#]WШy/ {%f%b7#jJٵQAlo\G(Nv.[~c=z+r|-~]Mk:zj/.Ի?];Ymߩo0{A~V&1Y -Aa˼nۅmb{3M6>9Vk=wC^qY.~)s珰`{JJ4ýCHZ 1{ -6۽# ;,*ʙ;OY"ib:~t74]݊(}bW"jɴ9S RBFѕmTwq`h~;Ƈ9/35</|+S$.+,̌>tiuy8 [L=i;xG*C&G94cY.vF=n$~2msg%Ǯ3o`?s9OnѲ2>ZxߘdRUix֮htJk(jI'}܎7]63p?= 5=C-\' !C~_IR>sՖu0 q{IFjFd1wq6:Gkn:ϽNTu4B%se9#W(A kHpfe=g@Nv.f7fr7ӎ TyRo⁌9Uy7T֎Ik~8֒zARqNzNIuSqі>k숔ÙfPvk *Br?׻\w;bV%vMWX,^=<"ydܵҩ%[u,D* ZCy0e:9t,P͊X$-]T?WOwUlknz+Āyrژ=7͵~D;cp[v5"B -rX/st99ycINE,zcn `-)o4~MDG{R ȚSj(Dabi}tN謼^T厹>G=6 -plK}ّLN~e t͟VƒGёFHbjzh~)J5{ݩMuIo_m|j̙3'M?|pECDp>Qpx/0u|/jUT_o_@^73Q>qU=j)ٷ}ݸrlnln"2l\XjYsA6X3KjY?2< -*u[iJnjxfZI E*'s<68Rz3E/s}j w"[sf쪌D]F9#1sa㭖X8&=[%gMvF4WUQz`-)rtA>|ě+G7;9yUv~[lHn*.2R M*YJTҍB7knFЍmoGTX`&daާQZ|= wb?H]~Q{'0n|L]AK^4=E}tC^.jY.TkVL7ȢtX |!T8$:r专HF?̃T[K<04K: -{3_w~,qjWn1pƗM7n\ux35]SСLPmz!eD\9a~㏚mI`>jt:Ȃ[ͩVh=t,4/S}콺5hm-" LčLQrKJBj?UҠ-8ac2?Y6[![*)1L"2!Q>N4k'ThcdmtDFU8Lp#HHԺfgL8YU/[k[,Ϸ//ܾ?`o] aTMu5xs OSMW|)&AJ@)Z VZ̯p2>k]810O``gXqFzP̸߽FD>VZx-8j} eѾ#M{b)v8IsU ;kTk&Vk–8Z ѣ@% ɐz @^5=Ch9hG7J}*Jk299s+\- l@qC[XnO2ċ31;d9]x`9}Mjorq5BS{v,_S2t0J̚l[84<^j|oVI w oNr m1CO Ԏ(@öl [[{h_#]7#XEz_mwYB(J_NàLx8~zxq\X.`ϭ̱s__s LUiUYᲹNEZVFɉ{!}7P(Lr@2R緻-F1l֢_rt}޻[4n@'9繞DoU]]/m7Wg36gYOitV*% =pvgO, -ep~㝾vB-ɯvL(hu.$u{'':OkZlPfF'ݫNZM~dž: U+gsr&1׍MtcIƣPZ' -hlg/7[^-223(k GL11+_-GQ{TD0԰vV槩kh0@h \UǛP 90}-8WUu$=NqKLW OF_5[{ltg;C4>z}kJu6 80 4@<v},m@$IDAQLs¬љokqϢEj7qyjgAk״e֑e ep; 57%8>V[h੣i~/RE#'vk##Ϗʋ묢\D{:O8mAOz'`sZcYcc͉`xͷ{dҏL1:vbC. -soY%a[@_L8{ +\#'ZlղmbaCOƲd,jNP1oѤ@KF ˧Qbzi5 Py͍^Dy~V`lVm%ru|SfYQpd884ovg#=1YnOӵ.[E㢬Z^S ۑ:l窼o*h42qشi%aO]FnǭT>czTq|힎ZVp̍&&2qd]Y.{>!UkaR -+*$pK<T\j_F.Q6EeuwF'gCSG, Ru|x96E,2D[ ~*_?+wwb5jqr+yqrQ5iY7چr nq*/֏oUN}~nR?ؒnQ81|èGwxߨ_ q6{7i4c^g:=E3ڇM^: J>Kya{w8d$8,J7wC3V|IW-+}Q8O:Qқ -yߘ#L%1Eڵ&q<_󪵼[ͭ2 a'touj]ES[?"GjwZHNp6qUGTE#X57 }ww介2k -Ӄn!,eo+{^{mT!sA5T!ߤeEV%Q!wЌ[Q+r? I< s{ -pոAEpkb?#~ba?c$d?Ό._ly!!7oݨ.bEDԘ1>)eF5n%h[azBr5''Ԗhs# $¥Wa`sLL1"H1Fs3M鼳q#}2xa8vY^k:9sQ}Ǻbʼnsl_4B" X> Fة.tg w}NPyE9\\8S=@ znY~> vB+n6@ȅ9a}E_ZŪ5V s}O%ux<A8i -&wN^ -5 )ދn@e2Tl]4OؑU|Wַ_ z52<_щN?+fPa 'P~@0ą?Iz#@|4 JM -떢z>)Gɧ]Tq.x W+?I?NM뻚|[5fZu4ݫs4hwؾxatWR=ʗyB_s.eOOuCx"ɧ)>L{AVyx׷fչˎ(XB(yN'Uf -)*TY~4A={{ڝv]+fwMKa}Ot?zG7 }DIZR|9|⯘R -uλmvj& --qzڊΜe_ڋg.kjyWTaCs~XyB -{d-^SH4?cz|ZZcbsp<MmW5hn)ŀ_JC$;Fn3)O*N᩠NBd6n{|l/vSLSA7F"cacjTF!7b>h -7` =VQ?q??=#_i0+ޤ>YhڣK EΎbϣW$s(ѣ[ ANsA3}"Ŷ@m=dnJ3xף~sB=lМk ,'jO(b~~Go?\(|iht[VkLaؐ ;IH%Sci1<}=q]2qOQ &z8)gZvXXv hrF ~&4hVo{ĮVH>fG@Dg -˃<=\`9iq%{zɹ -"uVe/u#zf8tfN Gr+s;Z͂U*o>F#NqmV"Qe)ɼsS6P.i3oōI:t"v"ʾ*d ͹Zn#(}e e3]%k/? feȯiZrRm-1[4GǢ9uXʸJn~e;%YZ!.#y!ֵU$׸?WN| a+44y~<[pNոvns22:3䴎3ZomnlBo U>.3YU@; 6\wHkRG^,kYćf_ק'^}w6mv$T -=߬Z*H|y5ANQGevK~bP&͋󔐹=-V|- ^Ħw-Nn ^q^wIv˾? ;uqf2(n՛ D羦_'ueG^L@Ukt0j:fê>ŋ9|! B @sOQ(POejqda;bbL/*mUG+ZWrsB+.lr Tr^^D9'K ?enҎ@o>Znms94Qu4 Mp"$jSG ~&7ry*t(ˌ4Ldצ4K]'M-}OaInPlD~8ĥKKRDl,Ga;ɱ?\oTFloέ:3|Ul|^d]ХΒ6:PuRB{Mz#Nh 𖠟 L>Q|*VQIXnn=;Froaa/lX5,`r9ȥsW2܁^'$i1 &VֺL+w7ΣT~],K]&بld?PX&P tBv|db,TE4Zv~rcwÕMƳjwhC9{++;w# QGP}ExSu˲C NMT"2oAUt@`.1\rj 6+eV9@.J(+%"tf5NT!-/Riun9n_ ~i8]:lo|>S -sE؞CJxTZD>Ƥӂ }?,ҺH…y -!Ƴ kl{T;7 -k,ö.rYUwA,Dj'D" -°+Tlūkk>U xߢ^Ҡ q\om9Ϗ ,+0>7 ܜ6\[i~ɍvn߇MmdG&j⮡+V~'ӮCdCpGͨw)'cno!}g'ŭbp9659 'vn̚#.Gƹ`'^^pN'7Ue7qn;jcWWVEn: &}GlE\<*w2U-}mZ u@ru{=[+[hS,p@`!6qg-w+' 8uD\OOǗBߙ҃OQf2&# -k]" K -ԸH;o\g=/ۿZR$_PEBeEN@IZ - (2]=U 8@9TP9}y @ b:k%>XwemT4ա95UDXtW [>+ `G74X('X@3";6,S|-` %8V~0WR).J~mfx D0MI%Jnp'Qdz6ӡ- -Q fQRhTl8%`=v ع r}78*.M+7`kAHv[f#N)JzarbsWo׹Es%(ߘE{i_?V}Wr *H*TVʯԱ(=} kmKj1NqMt)2Ldޅ~!v㛽puyv=$Pcst){=ݏAD gbm4ԟ|K@ 3 -1au usgv:OQ:d?9|q SSCYu>pGE:WI]C!m r)hvlꮯ+rS5IT/;&k ; b|sCZiny͒M#ӹI X%Reoم\yy?I͠q'7]h/rj_RNs5sB ՟C'a!թ~R+;+i559+vu/#4i/ĢNbU:eZsl}" 'nFs%u=Fv($Fa0 d ].Wߛ3+=FlGvknN`]C$P,>NћкG$g-vLs^5nzVq#wQG }ԏӸ7#4 -endstream endobj 301 0 obj <>stream -";n#][k]_i`FGX -IȳmH۬g*e3ҏg\9+nsFM\xpA=ҟΔ6%qx_Ed~q5R{w~&qf}i6w&'-1܃q̓}|7mκ[iVZcԻ^_xJV߿sdt{ۺ}? uvӵV G&0zqѪƺ[8 w.Lׇkw&;ޟ -Qs^RgMsoǠ~ -urv+g\&q ˍGZߪj_؟LɴU~6q1Zŝl/jLHpV_' -Z*~Qb0L L ðo:deh܈ZCܮ5yRեMXSf*Y r̅aEM<6&|fuܪn= :V.?l:,7f2pLöYTPpsك&w? tdžɰθ\';|hԞ}&ӧ]M5]a+sqo;qzډ?5zyU/X;ja.q;ߛV ##y'K46E]']{iϴ]Mެ5㋲U YZkQǴP7;FcxVZK4&53NWyGONUEh(o+o~tWwXSaIe$qQ-z(&< 75YkR9ezK5mKڹ׵roWdޑ#Qq^DF!\@D$&O$wG݁4d(beKaKu0y^_ۂolyfkZ2[sx2l_Nn@kb:U!eվK2Y[QKzC\ڡ<̇2?ϥ]!)IQcUv\#vNJw^/q_')>=vo?{*ZSOdƲoI[LaU9Sn yD;YZ䎺d>[pS\Sj$Wvg@?B +@}O&ƖOnOf77=' ׊=A( F/Ć.o`1rѩ޴Jϣsϫ<o/J^ΕqmbUk}l`T[ -i4i-<9afyܽ͝>4\%(ʐFJX*mQ b/7-6%sX~TojbdVZTBh -lP!\(yR T><6ϵ&wW=g\eWcdˬ+,W7 fXfld=Dv1K}DwcGs#rdEw^\"2xZM2ף '̾&\UÂ"fCthdBvDk6]y 6Pz̸:&v~hr)ƘEU՗7XI37Oe*ˆ7{_9Qo HU"f5:_{hszEpF՞1L!CT J%8& ȭV[a -GNF6UtWku2-4bQBƲҜ1;Kmf-vf鹕i & V8jfMr;g 8l,¯X~~>uz#(J -koNQlsV Էx>V,(}IyqĪ?egC[M@ڕrFs[ě8HgM'Q'ꩃ9lXL9,\Lس[]- ӻQrtet+^YB'\gHlO ?K\312uDl0-q2'"0', ֜"ΥSv=|'VQQR_WztF=f99xBs BPCB7|YM78lj67 ҚUmW1Ow_{{uVl__r: -J#m: }ܯJaQ)QBoRs'exJ?Jbf4^a&+'jA!$܆)H2;=4oQ+dzҊJ*!'o-=RzT+wXʴH6IB>U -n@]B&^*0Xh=IwbenpWSuG陙-U֖DkŅ5Bu/9] x$"5| - -aR;]|[V H8wyKG:| TX "}"~k)Z_ωXR$-UOƜJKci1ZvؼYq\}=7K@|KA=@*qȶ$ Eg qbrbT9EEmW?yA!|`M~Uu$3a0H>[& K.EP Rș-S9 -Rse'!>zx P3ԾP]@.zr"6Q59}-@+@JͲsJiևՓZDF$I`Z@ XrA|[,B*r0eA^uz"LP02_]K_06,[[w%GRjVwD9Q,S,w$iY?WJՓCȕj|m1,`quxv_ O 6lI>3n -#voR|GS\AZnCaB&D۪clk B~ ^MF9; -TWR @@¼eT6T.3њD"7X_G\hSC^;:.um69J|N]&fN'a5t>?=$?d۽[ - EjȧD?|=X Ƚ8Gm;YSb«ﺵ͝=-drl)7LN NoOfq0AWx犥qSi7ػgqωD^ҲGuDnǥҚaų'WnΦݙA7>' -pμ 0niS{< -IT0b٣~;,I:e*ѕY/s|{?ޙd"hm3||efQԈ=0!a(\pe0ǒՏUЃfyd?.!_6: jb;7ww/hPqew1P}xaf%obDghlˋ'lK>J32+ZLdCM~]:z4c>*V$53^'g~ly7xrI>_[ěJ wUk:G'`BcҨٹ]f]mzyR󲝴6{Z(si =x@Πy?)įBӜ] mV߅1Wl79\zgwQL1E]Knsg b|]Px0ݺuh%<*A\4hԄYN@&mR[&zc$3`wNnjw VijMs:ܿC~z=.2O3^j?S*Bfڝ;D&Ҝ-l*kyuec{̽QoV$ -j.DeӥW/Tޢq2k7/`ώ9ϴkcfJX'64y0ȮJ{xY3ryt96X^7zc;W9-uĨf}a+ Ӳ3YzYYgaZX/wHn!}?Eb5?,AE'ԋ)^'{۝sz {7KG >>jn&W3Yaevo{1]cϠ7ՎԂN&\ ^hQ1uԊ&u+cձSs+'p͖k K*TX_İ6iv^-6jm1pM$0J5ujJ?YQ;ޘ5916DKD{j'ww @jP2䪼z,ņ.WG9@2O_*եXg&J=|oZuJY¡P!Sh?ĝ3̂LL|PtiͥD a7X;+jfjIי;(jf i":QzZd`Fe[0J}us&Nm_,<)B5Eq {zxtڵ(J'tAz#zʨp yﴑ$p *[/TpϝQ|D&;˂SU[Ӫm}lM-gxӒSVMN#8Ww[mGs72]3Te=m4] 8=d1G*AWONÌ+gث5C1)nԯ-q#&71H ~3yluBTSZ1=CmlG;jOΔ>ʒ-uģHl;{j -ī7Oo9 r g]oq`9! 2L'~MdG @ۋ2d\.w7G-v>V}dZv@씬Қ,o(D? pxGZdUr=*N$& g -{0*7 "|b&Ez|ek1ymR+r#8ux3tWQTKY2GC1*wQ6hry ILƮLm-zWSQ3u?d炪J{"(9gAQbNŜ:k}{y˪QV*oڕsI%)n;{C}L^嶧GwF;3pLSiPXdȅ:jGfFXI`bԍ:.}DN3Ě^,K7{ipx4ٖҮd@SO*Hou,6*̳Ǘq:eߡ|P8ŲA1>$uxaצ ƈL:JG3;bc^.|ƥ-NZ;bPS8#ewoe^1ǭjPoL.c(KVf^v252 5e.;ac~޿A/j:5݌ -z 4⨉%"a~\'^2+QWFD$!(IZ$T z!.uc5ۘx9EkZ,yH<~"E(v`, -rՃ2fk -(Oq\ Ea6ј>FvREr#by.T_1{_=bm*rp%W+BZk h*( D6',)`>[9@<г AhHq~fsEƭ:f1w TɜR)eHºGp]D^Z]P.`n0Eqb,:1>)$`QDIz)>Xg X\{6)f!`>AZGRO~4jτ$(|R0ӊ6baHtVY`%1?2ا · .e'/+.}lq<m@?Ÿǿ`LUW:z|.k<g,nI?'"ó$z+K1w|k 1!b7*nDly Ie3ow,nD- -tk:`|b0 Uop?3sN*yۮMgSC_=m-.QvQrx6@EOΝa>d3l+%̖t@con: 2oRS;ro ٧RVz,m04s=p糞y.^dKLL4 l;ks|(ձx?ٮH#U޽=`-MBDr}p*‘ӲKŀswq}kLdT Ƈ0[V9faWfCz9['{q]D\o_,DZ)me>JϵiFCb?Re3"Hl"xyT\:z7 ._Cor;6w8CSL"Zy"[ZmF]'<)lb@1ѿF&[ d(wA/3՞v7@Ag]Цzm.UF۴]v5un-Vn'_#Ԇ CN} 7;װDU5k¸X DU%NUrjH7CٮR5PkR.Bˍg?n48Qq%q-V5wEĎxT5Ч.WZ6LtRԒeᇽ{T 0n22fs7u3f7}IoX]JleC[ I#_.s\->S뇵z}:']5fQ'l[Gud6+1TBuC#<>H(Yf4WRR,h -NRVGFx[fǻ_ħO(++Ecnjn7׹~@D:iCn թiZ?*=, 8uO5򐹩bvĥ -{y/rv12ԸaT&Ƀxkc3nFb9U}cpXCqQ a]z:yUǷy- ȍF)psrΤ٨ ),s']wڌѦVKSh{/hx$U g.vYW fqͶSo+W$-0ypIK.v1s%Ãc,Wռ@P!I: - ģ&yA2߄9?rn{3SHRxHH*:jh?YwH/dn$|O 2HPs'l5˶ӫv{uz8Et^h\bj%7Tb(s!CR$3 KC(΄ A:df+N!Ǚ-T6KVU "#m)E=FfzWʤGQS*PK;d>Kk> S9]+.B[Ax⬽䓢Haz]mCp"f]C| )A$Jy$Y EutT})X$^8K3].5 7Zuw⁩N)ŶG힨1jey)2%x^;V0&Khz/ȟKPmm<`DEaxOߙ/ -F}i{-cUJ%Ӝ}="hvұ\q7^) b@TO찟B&2܂boi@Xو%rgP(5\fct}vF 6NNbyzDGܹ3(: 2qaZmfeD$\J!R:V@:Eb Z,U6zs~.Uʀ[@~Y`XƝ3lOɜy&5k1UxLQy{ ԝ"OaV=4 1E.S_J\E 0va ,IG/a-`X  9}RB*|gҚɜ_nloi6nXj˲> -2eC\[`}-ŻXZVɍg- `M[N\=šiݧf;빀6#`0آg9ٛIL~,"WƴWGDRx4T;落|"g؂Ih.mάuRLf3+p xNESNSl ebJ<"3 bL|u`M%t.IvO@P,|V0 wb(vHuT)1dS$?/"\.83Yޢ{շ70'Cxr"]; wNT m9 ]gq p2beR3=ȸԌk/(Fr9"_^IS?WY{:7v_ 'b5(J@EU lG*g@5Igz,.(j)FA5iDlڹlL%`أpi_*ߚT;OU}64~̢ \|z"l00g0r|$KiS{74;::zH9aW5ǃg l /?90mv\_3|:4yw#1Ig-X$(bjܰ+ġ~g1?}w>\z#Qwt֡uj'c]א*Φ[)?4xv|oѹ+o]mlڃc{}8uYȳh' Ү5Ĝ:GeBֻԛ6ni(?[7y{6LLEы' xnWib%bJyfWǍ@Z?}S缯3[-.5XExĞ6*zPϫe 2ee/SCO@ z؈{nwRx~3.\Vj_3kزV^Jl{ʺ2VBn,'Y\v2wOÆVvۤT40 ؔ)|HS\V-NNOwR10qY ϗՀX%ImzPaD(ޱtqbIyJ6bױ^0b`ja\lEZq|:[=B|B+$R,fݏ`\{w+|o925Ұ\aΝ_RصU /qa(p}H݋uDѼuoHzsI/u=ۈ*WRϨ-ىPMu8 -SDl{uU,nSb _h)EjV>>M>/WކԈ*Æ&ak1 2wy\i/_т% 'ϬYn1{xvvJȆ}sjff &F >59}["^P<1CSf][s/ -ءڦkrSUȂʛzhs/J~GwF6ԛϭO[bt:}%! 6^q1TQr&Džz7PRnT}?tUj  %} ܑ7MI^ WOl0|[.iX7 .14hCYeEoG/M0ЪTV{~}g\?˶PH3=cM\uXei7#7#}~cqX'N7kYPǖa՜AO}_~I;4&^zn_uPr癪{Őp{J f%ѩHH3jxDD1DvxuW])fY0uۭK'3UkVfFx M:vH[=w_P1|C~FG#c :&`#QBS**Rjoڎ/+/a/1EjM-W+%kf1 ˯]z/ATŸOlyh]&)OBqbߵEe E'm, -^MrI+1Ϛ g>W[>6IK''%ٰ'ۧ8+L> hk$;{m+_U+|fݿk$9D)WtqȖeW(6@ɹ2_4]\ܞ$>q0z`[$m31sbtB~я^]ѩub:;c.<W6noiԹSօW;a+zP-'s9!"PWȇos"{jPUeQUݒntm~b_/]I(5=>)_ ѳ>A}xsG/k#idͧZB)W ޖP % -%oJc%qTcO*܈}ef?1m͗ )X"srAl2DLbXXT@bCMN<x-wUvt'Gc[z}W(zɣ nwQ$pϱ2zϱdSY)Gk -ܓOG黹##?DP(L 3d1΄%x+?ØY&z}aK7^S*KU`/Q1EӴr"hehL>TZ"#ew ^c~^Ďk1ŚdÚJ;ƎƎ(=6'.tvV:'rq;|{!}xD98Mf{2wO ".dZV;A)L-&W[m2Ra>mGZ"'g!CZܢZMJx)չVҡʿy|}a^t^tV -eeL{+`AWZvY@;_?sz3F73gĒ n9x1v-h:2ߐvehڞFд-ah;<wr13FNC`Z\jJ,.R:=O - -(7o ZTyKvUd:b* w Bm$%𽩍DM3)yР>R -]@Ձ2(624 PFk (c`fɛ~~tPAwr&~4Km_Y|g9w B $))z+@b -BY>'ezE|m"sv؃vXÒ'm,0YUR?viί=$zVĥrr3vu$ ynA&Vm-ι*"hy pųM։[NJ]4^ηӘǜ$JmR daXC_\qƸ]69vnWmBD~Sy7.Wʲ$J%ϰ~eQsJϠ줊sn ZeH9RaWGg'X< e>^) -MX?V8hm+e>矚^as%&hBpx||(baW8>nWl@yc;]xYqRN*avQC:#\[.̶"w37KKd}Ȣ9 -#e\ ymZ=:I=ns#uunArN[7sk/xuaC]LORn-.f*5 P]HK˔XsB\xܥwgg}*#qHL{[a]=MS0vguaZ'5?7kJTZWWBޞWc-W\'l/_-E8_RaSS6{ۼ@-~m6 u5Xn>RZ{oj:TWeS Y/'u*sgQIj]/{N%oyX4y-xN`Q᳒W. pG@y屳m0eW9;4,-S%Vf9!Wi8()F\ MCo_qxLy<74? 'Ρj#:%}{\x{0N++a+ݷs^^G-vw4 dW-jIx%uJVF]l,yRWf#َ -O/{;ι'm+A9OeQ-AnsˏAmq [Se#mc}Λo~Y}D}:=FŢ\=܎\ox}r&T\7:[eoJ[ˬ%[ö]31c`!41[K207o)gwH庵mw=)܆ <-{ٻuF!(ܴ&c`ld!13_Yy7cbӠ71,kkQ{CR=Źڌ7UUEUn8sǽ]W] -AB&lQ)TlK -6d59JX>(Aն݁^Sm&+4A\ՓTyR%k +ځpG^Y4Yz){^4{'=|?[zр*km|FħﯖP)kVΊ48/㍒Vc:Tuv=:34a)ڥʧKSFHOD|-a|ާ;,9.H00E^ -{/, -Ӣ#b$,Oz !N1灰-a;wMz2H:7/ZLReDFEw2W@ٲ4:֚$XLF"a/ 1 -Qwط^U-6jr,8I뾸x&Oۆ {v3HY}G֘OD5dFuE?3@sҧ$JblOM[W&ׂЊpr_7>πez-~窕Fdeff.0}1ce.aJtLj3pC[B`qV;VpMUeA1z-4/tRI뽒6P1yF,\xU2auGyJ̨ٙK~69Zkke]=Wvwg;^vjrmZjQUL&.ᖒx2a|xR<3?: l>+LR=-8%F}}нӦ;PM Me mHFN.w/9z22ףYPMu+ҽ|=BUcymAlT9xq6r b|]C\-AQL:ӷcW{ÅNśCi@ oVv+ -19͠ ;$\t+DfO2Yk.*DfT{6)Cz՝rZsZW;doHUVX Xy}-vQ<ni]]:BNMzX_1o*QKMn2eJ~SW"rb}9-qNWJWۤUgY\敟^<%C"+oF tJ!D q)>CbHɰDa`aFf nY2tNg}s;dkP+k"&&!&_"*Kt" p̝ʋublǭP'/SBYQb&O\]"@/h&w<6OpU0֨/j$~z$y 4jwh4aT:"rǩ|M鎌b8w 1gNveWB}p;Ԛoߏ5Jz4(IJN1wScÆI_FA|zvT8&͆d3GmkCaXNn#=M!ƣgM`2BOnB9lw`AKR4sNJ쉹H;zX 'y)M+mz]JBG%)HG !{myd$b "Ç%s2]O񮁌ݛLM3K@F-iYGԮds⢶*yAДQ ,bv!!;t<#sB ȔR4;0SMQ~.n)> N+)fȼ&|*/B -Ǒ.ۦ2>:olOX&w)uk#3xLe؊N G;&rjB14@, 3-I -R4JN! CW@\.WabY@̯c@,rM2jjoT %l?#S vzO r H#Oqn$@v_ {șr7.w);@O9 c r>rO5q(@N @vE+8 U33j9jϡߝI-5SY"v;xĞ43_4! (e@ 4Ssh8@hR4\u ϖ Vm`GR2\zY1V`If-(ϳO6DIY2mUU@b [3l5Ýz1)`fLHU-&Pbd7`V S5N+M4'2%5V1%~f]rJfR^H+GTt02~Yڀ-净 c^5 -)9Q^8J`,`~ 3*/9Q?܍^V7hdD~SN%:\ bX3Eg?/֚U_+~=A˿w`sFi~M"#$ϥqvK֐"IT&vk/Q`5P1OUfAk+{|c;#\=V(ffiv?5{So86~Z/es' MaS'@1 Xq - -@1|O>GUMF{+~0mGUGs U}Ό7}PmRa=%Fx@+Ym6@kW%8;|pXx]Ku ǛgOž ;{dE$ rؖ^&n"&.FJٌe݋x5矶Ν{Ab{/<\$a+Qe>֧H>곭}#)\9sS8:+eUK=qo矦Q;W:u9v7^(&&l$GG!@cqipve6uPoy|͒FL\PpyF^[nS,Xa_d>A{b[Ŀw[~e18ٔ˷{gmC+MO@6$!=p@LߣcR7lGnWGP;j lFg-ߎ-7-x߼ -Zh0!lՏZ?s2~erʻ4P?zV(f>w{P\[~ȋh:؇UH5v "`.h~l:GKOܶ4kXzfᗖPzPc%^>w7R~m.\m#,L9aR|N& GuOLKcn[nk>zo],j@Vmba]{bٯ2ogJAϗXv֭TdfPAWqAj~Sdd -cXl*iDZeg6Q Juh6R+\꣒Ì扜6;w=5*Wo8&p2UX+pQ5E뫗ViΠ`MlMۮ5iM/֤AifyZiU&rIs -2w,W8B1?|YR2-χ~wאnMnXZrX&۲X1ܚXAw:bXgb6bYQg<gknU r_wWlYc=k ^rQTHV,kRˢ7i _A6h&YGY~x4Wfvq-׏{8 X]֏֮B]!j^";_kי}~]x-Elj -wsYӈ,?=M &cbf5bg)g=.Ê˖~O+Z5jUZ eFb3=Ԛ47Ӽ6ɺ= -].xj~YJv>ƶP B $~a2u'&i.djWWV:k)kg:s_*׍< sVyT"^U\!D,-g1Y"Qˉ\G"QW͕92"9uMV3#[r*19]gMuşQYSeR7j24T%G\PV-HB+Xw"?E¶`2\qgÝ!ϽK]&E~Vm&z`b1Uғ!f:&b۷!y&]0IiE.*LJeHLG@?0:LFXs~Z$kdݵczDtb"Q`"Y[zW.ƽJjH>?~9OEMcQZ7]LW㗴 cZ:@$ j5  "1ѹ{mqipRi!h`%tb#Le踧[D۷heS̢Cwy~a>zn3'Ҵ;Y7%r+{HPFQcD__!Nq4X 3mA=SR;ГIٿ;oAHŤ?fIQ. dvX]0a># M}Y^)-1+#̓w9 /lx=XMLt~Cd9qUk ({DG!xD.t.;wV -u -Ns|_r#|_ng4j2E;AN_OMy Ѐ7g 3,c}fFw~ʈ9});bRRE3$ -Ħԉ4\yaU*v|jXәaͮDMVױӾ1 ̲ oO4B$s-M6QN*eʄ!-9&0^> ~"I=ȥŒҗ,~̿oeu"Oz Be𱙌5҉~xO褘u3)u, Co$wj#|t| {92ҡEQ=+*' vn/`3I7ؗ\`F]ލyvN@Y U V )r#PFuHT6dtO/(%[J%?`./@!Eq`8ЌP1|{qn4,I.U/-n0(Pu(dINrG -jmJnЉ\W8+fFs8qZY\T\zKmA"5QEf.C:eǝ+d }ӅCJdB3B.UA;@{ r{׸m a#T]M}WsA[*,vvp;?9}؟zf;:߃i&c?medS?S٧&=?սMT>^x |  5s+6-m*8)F-=̈́wddb>|gYjh(k,؃]qrջtB7^vN:m:a!ll)Nמ`&<}r@as3$%>ck UO>ݞrtf>N}ۓ2߲ *J;d޺<{=vi˒mjJiZC4d`SERo?{{w{RD{]f[~o {2z*5ރ+CuO1e])CjTUŰ]5õoJ sV9,xe;Ql`|~r2$]&n6l[΄C z#9h',ޮ'elomwF T^lY·35r[8N]&daY~6e8`u*ݣ`7Wf7k~GY+뺀fwBY[OO:i=lPɑZq?hYJn9˺4 "b uB7=Z1*1g6ٍ -ŌV2̧Y׏~K.IJnkWíZRUMR qT T YC%rqd,ZFY^DdcQeD>mlj:ߌ &`X . ŌX^Qu9jTR} 냊bp+OϷlK͔%[li06C TYv/C<_:=ԞSøSh'rb8+w]O9Q+U;ctBy/%{n闿0󐧽K'& --![]H(M~Yz5u9UJsNtGFpoSlmLe}#9F뵁;lg -R YeT(V$-zBBI,'lHP] dz -x3u-p@[ʱ]abɲ==,t-gY>Iʣ`7yZld;)OPjfSCd=%V"i\.B;򇅼<5{ʉ{*douge *ߩHSmrV>73$#1>o˭A;(׌/Qv,ڭk0XpwMiR,('7q,K.0k% 8LFm~Mu>C͂OrtJ4MbA&IgjlC ߙpf>pcQc;Ǝ]ǙWM--X4U_P @vĵߍ\r>a4nfH3laI–잂H7:g"c@s7@Z|vΘ&]\r>vuQNs~PRkuE;ݳNr2(|i.(|2%Q>{Rw g-yyjKmG#*o"L}!҇:rWbn98rPy5t6>7VGp;*5W]Eyҕw5vW[{X#cZhG3<T~p9.6Hx":mfG5LXlwz{&Whw- 1b u꼌 ʸH; [ދ3쑞"5'?2A>gsYXyC; U y<@B_XG[ζrrUwx/ܢr P`s0c:Rb0/dmmXhNѕi$wư(/-G6;rY+͐[!)q - oEg=>P%K[SA]=^L} +kR*z3{~ݣ\"|!~xS7<>XZ᱔C7[_~"fn/Bv' 8ZTY?Pw{b `+ 0)s_E̔` 7'$/p.6J!`VAJ][=szm5ۛ -:DV_.Twygɬ>GfGZ'jg}fDno}y,p8vN D3. pwyL&7ޤ0ZIǮޅy%w+63fRnüݽ_oN8oQ@8Y#C|h|xiqx|JF J,"~"7m!Vs}|H%/;-״ fXPrM%b}/~`sw< ~g#4{?WG@  8:ǀ @W8  ]MO]D w) ^6>b" -^9HY|)ʒ]]̙qa\O\`;&{*_tмALa))K - D*2%@nY@nR"^;?%AT@r =vH2i~CQEx.u |{ƳC"$hsQzoLA-6Xw@H_CN1 //7 -.!zdt -.^ -PGKԆ0wAr>Q+*Vwe{s?s>=1_ȸT"B> P&OYȮwM@A0 -JL'2W~+i{07 :qRŏwUim*:D,<S-D|[SZgrPNrŤ``w3C`_@y_v};nڀu'giD8yMtkDcMfvOY8AGXE7†i._.@;2'A` -@W}r8{zF!U:ҟe1Hf:Jztq4#-&#)a3}S7$\P [ H\Hg -%k6$ |Zu^Uroe! ,s KPZSTy?9a7`?|kI3+'ҞëَJ,1P(Oow7`s~ib2©|:4"&8{[{]V Bk@ME-Ж6 -7?_z׷g@h(k `V,\Bt9'̬?ZR(vw*?ت;il=`vq@.*vܣ4 -K`] v.4u)ñ^l{xYOx],>TP,.?S9~[1+˪6WD }grlj -;.}vjǁ8Oi;objI -:+d.\tnl`9Du>o: -rF24d=,4UJپΔ^[Zݰwu՗0 cmO]m%S4I[^c=ӆa7 jM4jcxu>aW!48U{kqFoyEv<~pвQl 鐙v]#OpůQ?_lriicF\hq;uJwQ^>t[Վ}|WO-?Wlh'rKz+#ߔs>cQ^z/mPՕ^W\ʸ:J\^+Vq,nI()pY -:$H#Sr/d A+SR[{M1^%Ҟ'8ˤpVaˠk E33ȏf{`Y\e~/۽i+2cQcRT;M.-ZMRŨE& -e$0a|/y Dl3;I%7L^nśeMeї=eo M6`H,(z0 2>ݔ73nneXX\`Fսr4Տ9N&Ӹ nVq:J~iaZ - {6AED Y,DJYcݫ獊q2Qq7|FM8[t/^h%%'TmgW{'jc*)j*Vk EHvFeص}% WYGere-Xֺg2*+[<Œ=~+SEd̔p]^fղh?.+.m[^#ْťϒ?}$;$8>b0uzb0cbe13MBt\nY}ź5]l2Sh#{^IYUP1o$'읈˓˖hSߵXV+G&É%:!gR_ g~4!-e%Kd:OoeH+ACVˡ魝{m%u*SOnyZJ*/,ǃ AAQB $,:-z -*V(|na#,p5[༊r5鳗rAF1k2Mi3at Bs]IF 4_yO9Wp -[] < [{tYwzNye Ʉ+:hw~.=2>󀠦EHѤwsMYAY!ٔQS=oE-dWU#Zó:;P+/\3$8Qk벰f;–=Ό؏鑷HYAR!Pmri4CΟY7bDQQp(A#يz%3mz;.l7߬o 2{U}V9Sf 3F~|F?K:xS7}rSAA‡\@],_QEN[68}~n;D0!3XCx0nF]U S>n0zToʳ6 -L}Z: f&S`L M>sVĪ0etu!-·my -;_yQ'/Xg#h[PIĎċRU|gw'㢉9Z̕bkfsrm80;}<鸔SgJ,Gd!QgJkl#F3~$h)_Qi}"a ag \҅ nK dц hYHBRֳ Z $VɅU=c m~9'd1n OJԾ]X:v1s;L&-^ S|Y ,#CV@7; -RPD}{bΙg>o0r䜆)E\{л4Krs2hl'ĺ]=3緇yg!rg.DgCnMpYG -4 @Ȭ'd?g - @$GJl g$+oLK9D0{|t)AQ!LVm* _z_S>/@&J& @f}Pz$rMa - Ke)@Y PRL\t5R7H]S"0}q5Qi^[I -I]'G8r9 (U"Kz=IR"撏yI xP ̀BT(# #753#8S[}MCt+v&JYJɤa4F+jK"(#ˤ1LW;k ?SVR~>k1T>邸YgYʺ`yړn}C8`g&l*熏dHs},։7sOpquO\Dl" l9} -4#ݔhjԴF^DWм-\]axPU.Xj, _́#|g' Ko>^|$U\ NdA%rl\@?=7g/#`[ r8Vɓ"`/Q`%dح0$F(sC֔r_9?rvY`3_0\ӏ -~T_o&?rQ_ &AWjR3#nBmvC\N_pjMﯳi?km ,L&R$@"K} be -# +_y~*:#Zw.=hCg;N"҈Ͽt407ŬX?_mJX PS)^.P65P7PlLvny-|#k; O KYojNI+IsRDg& -vHǥ_tW-4}Z?nY+"a zm4mM7?v#1 =vB0*wUJ2!nsJ>0IcynfLyom_`MiPj#ױzzz_lӈ۔𦭸R|Z>\o)>u?Dג57ާߔc׆6 mGn 7/-pa3?П&bm*"faB8{mb>#kpi Rs-aX.K`J|Y}zMj3׆5-?fHei Ɵs~9561famz̵> -|L{|܌yg1`Wn̮ϟa-֟ݰvhwAh3j[pӬog3p/&vV˻Դd?q?5^iZY_^}~$FAc{#w{u:e$Uo#fPMluyuklM}j?!87,ӜA +֤8X37Rr+ `2tJc=F%;ev-DnTR?tJ+;9Sol.Zt0+^+eQ(duKh*K$%2ʘyneijgpY2ֽ}ͨhW Nf7kR Ֆg[{]@zwBZLm5gj:HaUMjyܤ7[Ḣ+Ԗm4**z[?8|XO'gt* ePR3ldl`zQP5jVRUG[1xz,ǗRGgْ?DmLm%|$Z%,R48 P4lo~W7]j F%ʰv`w"$O*[EJߛJ~%[m E1?_}ԞB%; nyܬnXnun[wGB-Ǫn,)cSZ"/1E-_)ߗbn`aO"ka=bb_U;$<Ϣ';y T^m7ẏ+ ,m CƄ -V+#ǶP6 VpjHu%E8/JsKd7 WwiG94nɷZM2e܅H}6\K.XMWg5Zʭ6YX,Q"n%Q#u(ev?of9^kf8"l!lb8>W~36}\Kd]GlkfG=,v4+"%ߏY4z4![dnDķbWNvN")V?^VׄYhӃQqvaQWwO*H#r:%rWT#~|}r[[5Bh_Zj(Ԫށ͒y=GTwɢ 2x9LM6Y"jvkqCCC[Eū=N@n`t7=~ fΈ -khܻ!SosAJ\8!geTbHƇ|cancR`@.֙.NܤĮTz*r -[E:J~24;Pe -\,ϯ+)[}yVou7tI0hj 6]k!kDnwp^\s_U#,Klz4ĊT -78-I,RSGh' -BD 6Rr({Cr"C2 ћ@^d?B= MDD.*cG42b|yϴRM]MVg1*٘MRQu#ek 0pӡXXZX#M~aP+AbR5 D#19="3Hn#mƺ+p+.PPbw6dn>tE+ WOtH,$27kD,Fb -(͇Ğy'Rd~C\2 +cq|Bs -yy!5B㷺V_`bO}[Bz83A0"o/;1D z$'Y1 ̗*da$8Q Em}$ʔ$TI`|2wDz2cX-ooPXHH<0 /f\ߥ$;D(,;8>[u6HҭZHr*!IBI,*Hʢ5r5cblnsg ѲĂV -0~W!l.5< iҘ i*#JB҃ I76Q$](@0@6H|+ KY$Eq7m4|Y9J#2&P1q7h&0Yޗ%K3|9d9Z$; -H9!dhɼ$x$#s7$̨OU6K=8Xo(5{oUol0ToX*tj_l} h~3|RRAioQ޷<'ݑ G 9σ/KXu7oo`d~r,%bp^#Z RJH]"-+#e9:u)s-mKɴ`?PI_z7aQtPfL)xAquMaH49fk`NCŷV9 bP 2fSmБU3`|<ZVD@x\᭪ -s\~4G0'6RR[HHMŷHm\gaq803ΉN̹|pcn$|&.nMy7 qؔx*f{0_Tv[SU$s|E:cixۊ9Zav<g2NR|["f'b#w"&;"@5Lͣ,a;S_R96Jkg+<.Yjn{3opKWdq| pf~?8̏b'I hI;|4~'p` xzGeC܎ϹQ(atT$Qv,uOlavz+ZKU艷@VSh5UChc'> v'q`ͤOxn9z)fsj0U$t/Dhh GUO3GF3Ew)_Oa=.a e.X޴2fVKri.zP2H~ڧ驁+CVt10묟}s;^$'CD sp[㺳gJy?1sQAl}龔JX4TI KIyDGY{3zׁ6ו]3|#u|КP|&yY.j̸?EDe/=`"gWkJ - q؞o5hr Zx-]\uOaJSϛPAjB:mvK(B>Lm_w0PvE[#"k v%;r[A3AA,SQYZ}_hHa&2nd̜TR۳#L "%oa'$iXSSdj羉nHKxke鴕rX?I^6qziZNE#-GIh9A|xAQ22qt ~<|nd(ETm  - 7]PG4$uٍuV}uo -#HxJe){ # $ :X@f~˟v_n6. ~L̲h8ʎмW;50*h-<YL1޾|1'9\y7|Ep~oO9A3٠"8a -l^wN_Oo=n9,> ˽3!)w{?)ѐfrϳ?(lnf -|*v6rgP?7#kBʆ 9/WJSv-4.88WA&Ic?@Ծ+%3?a3Z4o핗7xGRJ; 1b9L >W)O"l=о%G;A"މ<.N/3Vaʘ<;Eb[/9FRu)h2-p_ZC\eBXJ"L4rh?> l>@TONhY 3*CS`[ŧ[opሇ(waḌ"~g~9DÑMC:7U?FU!*g)y#!Ωsp^;sG=YT|Dp|m9DBݍ,ѰG&xݑZE<^}irA{Nz'W9 wߘvvPoaofyf>սtq3n\FkCkE?-9v< -·ȃ;K7L{>RufRҖXM -h&GV<9'jk1 -qDF)4 )N}o ,:80ۓ dTǏM@38򋲏+6q\.׏\FEXG&g[ws35mt~ޣ6l6;rRyJՈ^g0[;QlWSFJ6\IS 9|O˴'- bf9(jxfvi5},gʆȲoY9$Wޞ8w_T;==%JL(^1/`aQz-3̏J Z.;E*xjI{PQY+|Aь,HqcuDK񖊉{@$bu9 8v\-(}p f ]V1bi+Z\qlȡ?LQ;mF&֕96YrX;u?-&hik0%Rf\}TL3~0`|2JtNdz3Om6b͏|b2wb> FziAWƭs'_'Ji0hYjɛZp|1RߒdbYZ_w)|%gizf#(lE iOı5 .7Ùي. zmG[wlfk/"wNpvSWԝ Gk q\vB^UDSusT|b}4u'"&c`ᕇ0OUtp Q~@~r6B'.8LC -SOO~ pi_J_ )+pS!cM )nw6hȉs6g1INp`җgq` -Cۚ $ C8-T=2KZm}L0/71'¶1 s2F;Ќ׎VHJ Pez'$7XN1Dҫ<}i]ETw = F/>/7,>|Eyl爗嬕;[ r3 NJhh)Ί姰^^BvE=5Cӥec20]y,@ƾ׺+KZ>X S* -P"i*spLHSD4= -ӉzH^ppˣy.98lYMtg=X>Ž='@ jhPs -@͝3N!"ZY-"잭( G^v8|!Z7\K]p9@DI2\D,zOv3Gx9bEA#i;6qNZYȷ!D liڠ¡Gcy 3{*ziĪq;'tS$~*6gt/F-s-YB(aݱQ;N"'T8ds_ʞn8L2*I~4mZu(b]j"E #f'm{eHANsu>D"?`x4pXA~ą?$;+o/\> z> i#ԔRZ6 #ݏL)foKƣ >q -m0f2SA/C0?HY 'BmعK惯D6bjD`BdRv.F$4Vu;dНlmG#~G|=]^] -Ϭaw+Ul SeDVތ*} <Ւ eMmFRo InJr2v)!x72< rߗ>AF.OɊY@ /Fr* ڠ~8"J! ?u1 1X i0ƎI.DPEr_ͮOx@K# -J65kSbak)tgfyԼ+c; -# t -A/D[mwH~f׋5bO+y\rC`rm-0I৞~ʡH8KI?8~pR3EX~0nA -XLHLyp@Ε 0}BL%.ovowػq&U\œ6o{.CJ?pPSUSNdWnCGwLb*݅E~pS[cwϜq@9Ʉ_l?2!J PQzqz/)-|1eE|a1GBc]= GǺ}Lw<*@HMqܚiFu\^E -C7$6;16mE‰Kr$4SG˭CGMȟ}y@3Rrkpr +Az)l6",V/6mGVbS*yc w3Ř/ --DxlM4J* ڙԫ@].ʫX &f\LZGo{M e>%39%}2nBzҷbWbο#ʔ9.CNaFӪ֐uj8]6=0G<[ j:t1~:D죷+7"ݟ -t VAš*Q%eh`Fܻx-]e"AwaL{p/-&DMzdaǒKrk!G^]l3|P1Gzun$r\z^G;YX ^wN];h f|aU80N -\Lt4IH㛇/nsz 'wOtI3c{Tا;溬fi{].gk%W\ǖYX-zrKxB thޓmiI)G,:V"=~Gnb -xXv=l:Q1Q+Mit⪷˴/ l UXOY0hc$SkΤ蕸Ыު :/%:类Qwpmo/jQf -_F2WvAl:|4#*a@e1w2eSB -J --UODg[¥uM&8#lm78ئ MZ4ĻY0(,^KЇƪ2f`|bwJ -Ī~K6M /F-Iv2Wouhtd7P7ۛ%ka81I7wJ '@;-TWd4;=G/7w(rAK %ؔq8"`qSi% @wrIbgwfBV}|85?\IOm\'qܬz t- y+R"1*&Qorbװs -Ol%' - V.jcx=5KLM{kryV},#ZJj;(;.ZϲU[WNPvoǑy27Fލ~#rbj`KdVnrWjuOvbJN䴆M2>KOqvZ9 4#FmE{JCb&Bt@c%MiqnNQf?;8G2u8&pR8Ld w6?^#~<^ٝ5"|z\ -s1cm%'zYK)p'zmT~F[=*wia+\|PXpTZIi#gٷ &w7L]wg~4{);!l^'ID -vHa -r6r q^~3/Q:T̎EbE#8ގ#EVZv(?[ILǑvnچ~$8N_8!~!"Uv#`y>LU}

IJE8KzJuC7 6j:E_{v)[ 2 -m鄫zSM`+K#GR,E+McċGWh48(q6 !U*S't'ʭb$7sOA&Ugq\ń4}p蓻a3u3w>(}!rTlf=}nKiK#E vor6J13٣:=ai8ʭ}@ .aH;Hu_+|PWlF_AɽK#o䉆{v ^A2V}T.qZ\iθΙ@M2 goD>t݄m㦁^پ^#@K#._P=/Q[;EW IXk qQ|̃Gx uʴ# OMQ^MXB\ӲikOI`~/<_0+5pMmiyx\50pƪ0t?123Otud:y@A`e̬DzzCV[ 3GS&>eYVcdy\Xo*6[QMIo/W_ 'WʒZh0VQn94~pGc@- ;Lć#Xo -c -gSd5k2*Qeڙrh]a;< #dA:;0ȡ{q:TP׹~hJL R]e4#QJ׸|kQZ0hp}347#T=(|WZuk^_:U$dѐor2h9fHSd_}) -Aq't*}y+w' [WWn`w~vQ7/C*s.=[e3i87ŝ+>/P/kXwk|xJF;ՠX/M|6Ne|YA.AjYҤCnhwpEC;NhW!FbM4_pVI%kD|gGb]T䦦wy2]禖.~sVqWNY|ojb2ϭ~RGdrm3~ZْG.*o*g0MpBKwQ?)n0n[`w{'g(C/zO<7>S6)E|/ZNG\%Zk?RZ,ԳZZⵦxϋ p-y -ҚŨkc-EHluN8z9n42Գj# (-|Z_LghMWUaͻ{7)N RQRjI+w6{ -$-DKcm@F-aՐzL[eDbdCG[pV"*gR:ufgaMJˎU^u}EolXf -^!Gerwq[jbS'Q0\ef>?9ǀW,T>2#X2dHQz:'ۮJ;R>ʂ9ݮuw"&Q4b~h }CQ(]yTY3$:7)l΁ЄAwOJ[ZdrńWi0lr\BY62x@Kne *u!u%۩Y}j#;bEZ`ÅPz˸'̨(@qssxx`('iC|\*ik87\1VyaƧۉ tn7XrmH|D3i#9A[}p:pkvJzQҮnV9+-"G2{ٰ#K:tx$4ms-%H_@(wFDrcp9kKE` iVpp9\v ^S%3UL+g"2u1|^bql/8ؽg5tt%kckܶ+EXz}V:H!0 -@ͭ,c𭤳oe| 3l>/7AT/3O*Y9WyLn8# -BeZxhRhaFU'J1Us2H1S.Ez KCsv4CebhľOwŨ5 Kyys\rbfy5U|K,S5#&FWNN NvvNܴr`0Yq1W>*Ρ6y(BU>'Fq*qvh_,3î>?n٦E!oO4~qwɸPC"}IM8aN&|^v~f#c_R ߖ*@K}?[+>]I6HDF074(W&2N$mzPݱyC^Wp hG~*J-%g߾ߖbi>*^5ݥS[|Ǜnʝ~f~J@3V^\:tѰ#4Ƌ .Z}M9> -}<=ܫѥ]4ia[L^u:kEK5z`;[iE>+}ƥ㢬C~%b\hhtV_zZFPL-dӏNG*^z>uҜќ99HM#?G'~Nh .8A3?&0n9QR@O@ P@,=#ȟ֍R]1VơuЏ|c6@&!g9kk 8]) RI_d݇/pF??T&~!%TUܩ A3UoG)1ɢfσ~Qfsw9ZOj͞^o~rCϞO4~^UQ%Dհt,}GToxu':Jxo>?;: -[lXvWq!QLQ1Sƙ8Xս=j^\"ytGe>_EXl謑3_d`eЋb\.z=phXbPD^9oSi -d+z|txKn]%h.~/D'#A#w+M~ٲlYmJm0nLKw㈟pu?+_PAOVbT$t4R\$6mi;ތ덀I+՛U،uup^L0 RIVN>in*vi5\{c;d'쨦֘fCKWTY{hw:9D8ݮ#E.]v*j|o~Lpbm#ّy{s"ffFnʟ?>o"f?1=ݼh%k2^Dj22)q2_;8z BǮ>pu ڳ<\&"7G%.L fNXХI̊uTKze?z7V,ucF942e(UvIt-ѽjrˉMs\h<;ꬔbmNz5'b9&O> b/\c6Dy+(a"]aԐD9L 4aWF[,c^ຠ+S'^JN">AbzS#dGl0Tti8*VPMf#Xa*Q?s-@rXOj-&3Zkz b+37{ԧ&Br7!HQ[8u0cS ]lC[zrzÜX5H:}nzuLkm B{^Z[\Zk[髏nS @YKO#t?ZMpPRT|2h8,{+b6FzpYê{Rp 8>vqS?.C|Mk^ PNzjZK\y""%LFǦ'EobxZeٜL7ar\d ,dcğzA[# ,ɳw-}aaX *ODR1읆'HҮE{̟(U^}~oI#Ǭ -z3=ErP}-O/zEN^B/U?w^or~N׵U8w楙WՉO{X.A? !TU%wvhcOy^suX sCiO哂m .ve=۪]fg97'̖(I{Ƹ-7l^[*, %L$#+?UTUU,;垲~{7랪!dFlWmQު1ؔ3)/xuHw:vW}3;fS a2# i,z=^#MF(-Š&x}lSAe%4y/yfGIzs97~^mk0bafXA1?܍ }<%ʸ+ey,uZwnPriF?NBVf8YzΟtkuP݅+^-o/| 89h}ß>i+#KR_n'~ -BHon l6 M'aBiБ7ha7Vјhhn]j|f<|Ipvn>FT%-VAU1.S\b֍)qQrZY3rt[ cF[^Jk8|I=Z.?(ndq3,ӭ -#k0o~l(~Z*?Knʩ09^8S"z\ -6'c4(`8Ncq=mpf2] L&~ |~+{rl"@qj1/ OH3k WݎS0b{kX(p`F|Q:!G/߽`I :FFn8 ?A;P.ӎMP`CΛ2WXW C1.C^d: 9&>yYQnA2%}AINJANhڋ AFvgetH4}sS 7lh1*m<m)iA E %ݧaiF  nDky"Y&ծq"AA'׻+G~vL61lϫI:-aMKp#U_{PGU8Q{NaDq?- @NBgPE {',Ͻ)>7Mg!`+ Be>gGMsFVzk[56w$-.vfWg[_xƣT+P[_x t ^ODM2$@[+v!KD{3չ+{/͚3Ϲ94 |u+ѭMb8?\dcD3_'0AYs>q_%zgT/g~>P5RVI,4zl3޵n~) 'BAk%8K 6;.վ +mwk79Αef/ =}a-IRR>k[z|zn=nVܪv.YɨΚo5!N+4\uK?8eZau`4k0[[tܾJ6J~]*ϣA^ɔT^G+Ϛ[eU3V9X;m +|6!ݴ^g}C4]{qv6/yPM (l҃]ii:޽ nB*qE|-]P2]ёF:V9[İ?(v?iXӴNp>ZqE[*q0 PjZ+jGu9Xm[h!}'V,drxGIH=;+NUѩFCqw~N8/tC7թ hڥ/˴dEݑ$# 4:WS,g[G -;?T[):4q/ U7 ^qF?~-z5Ɔ,-vv::GIx_ex%֘ -L??֨_ɏ;QQGKE˳H7?on-,,hߞKGd| ]`@uoNa/h+Y[9o/Ub~g.yz,1ˣy>t9J2k\H ě§`HO3qzFɜ\97i%_\{lvuyb&.6{bQ`r^җ5Q7_LubPL,UWtFy~Hov՜_'0@w6ѿd~,zWm`묩$9ki:tW nq߇c}V2G1)w;n;3k?qG_u;`49%7q~<cb&jI|4NJ2lj .˿9Ur ͹NK}{?ڝ/֐r9B -s~K{SԫOm2B7 Y)m{5 -f`53tFL$fJ.%2K -O_|aVq0>끭ju}LZ{  ۽^PwL#hA;>>pvoߙlNooIY '7mVsOi<Izh Ul~͝I^"xƠf w8MgB7z;{v Ϝ\7ݢrA3⪘c3\iBΕqj .u6o~ $&ĦA1D#ԑ;dsc'ߞ_'kOs_k\dLڊϧb8Bq4@Q_U?,9pAJwT•s3nz%b_䲅 kϲլ2?"ӢZ\4J //jm-;mGx4kOSde'ΝmrkqQ<?D96-4VRJ.Oz'; T {⊝8f!{-~ )_NlGF7{;o]VҨ?ӦeF -fj,@NmMՏ3>WZpQ xt7z_@gl'ڋna穗6ya4ɪU d}dv)8yM_uUz'Kdjڤ~UJar5UQTa*Oq3"^z*q3i[P#P6(p^czIA۠>@; r' -+ݗXnΰIaRknJ7A/B!f&/A|h;eʹ59=V<߫,Pؿ Bcv &x7]̉8g5lnWu*FV uCHk!n<nn5wuqЊ -T`TL3e s[_69 -%ՆWׁG-ݔ T/ԍ(졯i8| -q3*060 -㟺./œ5MwV<:Ϡ@P8H3PPJ:q]/[nOܫ$a)F%al7$R0P.`P 6%H7d}dzv`ZƜ^<=Gb UST}P<.@EVC-Cs~Uz޸UnDSCa"j^]}Ms_ g'uO#δP~(7h%fEeR4= WO9/JG޴n^N^A栍〛_}NOAv *# -diV-<ﾼds3@q66`\I 0P 8-NAпY^ՊL/)Y#Linmn+5,|k,WXݳǴHxv]l z$k4 @Qd`iPOqPՄ8-|۟ҁ߂BTKl-E-1^C~{sd0=v=w;! jZB`kwuqrf, ?7 9;\E`! h{@-Jo-h|X Gz jޥd<].A;g;-#򯧳W1+m!B+hI{׳ R&@鲹1]x Fq]ō*WG]j9"~)n<.bsI:<強+j5{U\(Bo(5D#_b`h]Ul % 0^VzC\㖚"Cu/Y꼵PS`^IQ;^^XnlV?n(~N߅fJ#keLW ܻBD6*igKՅn{iCuYQW[˯*+25H5s3T [QA}OBO=߃Xw%'Ӭ_6mF5操W|M7A䐡7{ifFouV\+Yꋕ[Y ۩x xXER#ɟ0+@,U╥ -)?!.3E9VA4ڷ#we1]?؆( -b5hnYpX|~4],j:c@* LMX@:[7yVໃ`mĩMoVcPͤwQl -NV+mtk=qL%2+T; nq// VlϪ7gb<|':Drǃ|I}Ot`szd?jmIHspdXiq-<]ډp!R@WZEaT2F~dR{m,>w.|YnU}[S,S֫_c/̖Y9ZfL3ڌ1X1?N!jSm5^׹C2+7=Khffyl6F{S;n@/:g}Y客en^LiG>\GLG$gG -+CmӘ@ X K>[U㱫=ℇv ~\"Iyq[-P.El}LOv9D'o4=wl"#4߃@qJ5DЗU -p䀲νK1y>|.].ҵUv[a􎜾Z -.F!58݈wI;uz#ܻ3r,B=~W)qVP\O@ྥf],(y$OUH}!Sؼڣ7 l*IMotBIv9 GOsCڣk+^K^;g+p୮F;{[[vGݷNT\@wfI PG'6]e0p,>;{c%[jXKV~srY:yrhݏX2awl;<vrnzh=Mlg(H~rw{;a3J~BoZ|mYږLL 0YqFq|.9kt24A(9~Ij=AlaGQ'N!,;9s[-l].5o1\:sm8;+{( ~S_pΨӤK/eT,.A۩\{aKKUoQؓ >Q$RYf/rp-7ۥoqδ ЬGj#d4F,' ͬ[AMol$sɊ\A+{i$UNF57m$SBN{cܱm s"꧛hA~?0z'/u:6Ǖ-3J"6)lTߏ6kSj8[fi.ZĠ`1ўW ?U eNK¥4jA2S?ˑ/6Ӷ!o[2M G/G󸢄*/])sLۺ)tgccuyOǹx%OʞǛlX%wvو:&VN=}΄?Cu\v+̉S5_VwOy6zXiis5U -ʕQeh 틍]482Z,f.kJbGf`# -b> ?i/A>@M2 (w57<ȧȹ's{8\'@ΧAv[G^fUyn*{B?i,5憐4…8G@^ jfPMeA @~l@޺F AЗayqrVr A^C>H9 *=f,toƽ:=79<{O&g6A66x ٸbr oBa}$Ux{ڂkR<7wg)t%>|\ޗ_QcXIQ.'|6Gkt+7(S2=(COC>AX|&a&[['ҎW5uvv1Wj~:III|PѨ?!}+GЖ/,ǿw?UeQ  w~m?6o.i߹6 x/Gk$c9/3ʑV.Bxt2+G| P'nS{I3;YɵP^H:.;sh7Օk~ 4N־v=ƽ.궓Zi[cfnۜTz<3@1/}oH؅eQsEQZ~lOt"GR\wB ~ _K5]/^I5ӟZfm2o{`^q|o#L}~,KY.4/<+w?L62.Hśou:[GZ]!ٺXqsW{<׳\;n(MѺӚ̬$8_Hm;T?O{'N >Lw>21f<(2^3SWnL -ѪxS>vy^I' sf 퍞07I /1ڄ[jS4զYFESZ7*q[4Z+=w ,6aVR])²9Lꂙrܖ} `3Tm|*-#ۀ@iL$sO_sw d˫QGy͔|{֢zDo~Pjr=t,Ǹ-iP۶u20VGW͛ 8$Z'Gah.,6 +Awt{ӗ2H+nqrΘT5"1Vh8$B>㻢Ev5El[4ݾ]ǏN,: h- N&Tm{!\}$+ȽVyWV0#I yc2έJK;ؼ'2 -Tgc[.<!cjF!{0uسdx歚Z_ON+KK_Yu)ãiPzZ.v?xE^9ﾎX.U&l? ]X^5$^qmk(}:o˯!O9g e5e'}V35m[N']pIU'gvzλU=K|gk1ɍiduUy0?h\m/[c:zS9jr&kdRb/4X^fhIɃʕ7Uy^;=)Ỳ2՞eªAKSMJpmXEv>D+طs.\bYꃑ\'Rr<3nd<uЬtϸz'Wj$RV魒mReSzI+^\noψ[Z",J:LTzeC{⩔Pzm*r]9l]ۣYʻ~ѩ6[VS^dR6JKoQ3iN 0VQT+]R? ްq8[(vAGʠm/Q YcEz'3[U?vCM\Btybi6)&E;o:Egբ& z@ -BSsL&k:ioDg2yms|ӗ^}+jdī Z+£ے:j]Zz9.Ƌ)r,)-E[ʅU1 -T`kuJg*|fa2oAlr?M  -endstream endobj 302 0 obj <>stream -vmE#"\:dd62#n%2 -2t5)<=85= úRЯ&Wd2yY#>4ȱ, _!ߥ's1*}dȖ*m‚^_ ȤAf*Am!s˭_㭶}8rY Uf _wG;+@Vيls+ rڇx@NX -?P*Cgd<e[k(;݃lJ7(TVCl17|) 7F RH, Z#@`` lwj/5v@I@ߠr A}}{/`h|>@Gӭ#Pvр!Ȩʯx ʻZ6AV<_]G;?[ٱ6?( Y(u=F ]|$^u؁vUŸSO~Iz.]ܚVp W].IξcT.ӣLJ^~OvJ<Gp*x4sO1h]NݞU=ucZghptv.,m;қ(+|(ˊϊ9O)2}gj[P5T?4fb@[&Ș=s&6<;yE7W; ':Teisk3Ŧjl~]&=8IFd4~s]&{qMtrOZEfNOJ #51&Ӵmd4Y~{EdZ %8IR=3I:x5=b ws޾zV]rU' -({KRMzV -TԧtlK:}{t}Juwd{)r;h?wޯ깾|Xz}N`7L̵=8Mvg\1#*ő- yN ?ua3d_ d d+p6Bs-'doϫZ|&Hq̔jC,@ܓuO!px v[Eb=:a\d΃/zTPI>^-=VhKVfWWUZY c*TmRj<`UL30AzJN~_ߕ '<7{P^v&Ea^Vbc%Itt~gk'xw Ze%(Ua71E]Ru嫏FZYUO$'!Go< יca]c MV! 7&#÷[\7wڧ#r 9$z- x[]F͍(~rI2[[j>'70<{4yNinSj KiMz:itͦd׭ɪNs[7񄴖岨]YpT`p݅nʕ2N n,TΉ ~gטw9N?mә4V9؜еTZtfNzŨ˒M7\yS齩[]ZP™^J8z %@Me2J_mqmNBӝL?Ji|cW*ZJb9h -zb^IPj*S%j֨tF:-ib1]ίNdvQ+5T|ů+%C)NQ)9R<3.I{^V Ucn\Xk~b]܅jE_RD5WyVҢHvRݘh#UQY鏂ܕ_,vPJ-I1;:dd3\7gg8o]dcݖ8k#鍀egU1̾W.՘Xlfq_2˱_+Uό:nĨ'~X3f{\k[rXXBY.8IUTnC_ ֩6qjfy5/?7ѦZ_ -JAjb*3jTz]i1W\21r`jl>LߛkV Ld`G4cQC۬W}T?–I_9>5ഢFTJ+ך]+(ycߤ}A/S‚O0,u6ӶX1ácS;;͐V%F^X އ?aT fOcw^_&qU6stk:.~븠O~ReJc9Ҡb0~#CG>*JtI;7'c"yk|Сs<~Ax$g̟xpk~:d,W;7]3jONĽ7|IF6آZhL=tVF+p7>2;tYT`Z0o? {rKݞP%M{@N)J=fP -FD. 8(v҄bO0i5[^;A4c` U*DFWң2k PgB -@tF?&$a+P cp \!"Իj a,)`ci 1Aѯ`aԠ:N3y%Q6MWt\i4 ;~071(5̠Jor5x"Pl#UsX|]vMlDg}U:V|iTVu ڷ~vW?P@zzO lm$5 u>҇5x%ҏz)-`s3)*ؿJi\^tǽ']@Pg+o\TH@ -E @[@l kaPt(O~JfMe(vؠ>cMٺiLsGh0Oá9:@&Do -dMd>q:OTz@K9\,nl+<F1oͳV֑pD\Obo$Cu gsu UR>O&9oDf`N78< /I+5YU<&"btd+D ލӺ>mseJ) @K-@J?4U-vy4_]⏫dusf3iOxoFS^*\C^|/PwbӉ]:.'4jwחrUX/fy%y$co5ST`7u ԗ 0́4^qO7 -U2l^< ^J\tnDGm~^q5{&8'`נk$&HAl ۸p/Q}fA|Lg2+vz9^jPNLdsׇ~w\j_u%E-KaK)Ĕ6 3F)M'^o99*z7kZ&OA・h;[:\N5i_6g&Ǔm֩O,H7Ҭ՘Z̏˒f}c?H (RwTߘ2>tUṔ@]۽ѿWqpk}b£8oV-qXRM[9nάtp+XiKƛ1!kl?sS:{N?d܆Rr"V 1?L_? />4W{: W&Y<'nw¬o\w~[4Ӗ/%'ھ Hcbpy ^aL ZL6n]n9R7d~ s8^0^/hiX {q8ݶXeqfU Kf% f;lQ:}j[ߕZBRd$'oxu_&o}Y)_m) -[ѢN/tNn!9>9v/VAKյO϶EZۇ[iXOEiCOgkSuL홐޷7X*GldV P}0vՌsК+|}67ҍq?_MHWcۡz-Dۻz6johl_\lcb5?@gdkSSohϗ*Mp8ս^+_TDGf^"-~vX?^(I ʑO/5CI?9 ڹnq}W3:uw-Z3絡3+/>Ё\* Cv[>k9jSiQC@ZlI)l^{.Iui52"R?a>IIbW~ DP-,ffiQ!ݔd~c m|`~Ѫlڍ_kQf} zVq 9"ta?*O{@g*=\d%KO4qQZZn_9.a~@r'C,oozyJGY-\!.ۼ~jI@Aj5Pwerr̟YsBi2ΨJi͕z심ԟ_T8rc=e,hsJS]Lb+uΎmyɇ}I])[]1"[]85]>9r^W&Z|"(qT2ʭ܊+;O$J^Dıh6;c%MZuŸ dFeܶw,oGjթnZa+84?yvBCrY${|K3X2AsW0O Y͓jd[-?GFwڧ{ON;\n -n]^uǢ,A/לoNlݪSlMgM'.am3%`.g^frYہXr@1k&_] V2N(;Bb%Q _\m4ʶ,(Mw+u#ʱ2O-vfFbz=mɟ}onY] ?cC:}eh6ZjiԭYmbK W!פT*RZ3xٞ3ڤs:fs_>)a2Q8ӱra^bM?,ɤ'B7/"Cd$zA T{/ƞzw]$1QY]QTӟ;Xũ=azl_Ӷz Zvb''M)"U)wG Z"f1TRn\#b9KZX(ԟFk5ʍu Dr 1HQӠ uP84x @baād1dm ^sHad;8b} f7XkuZ/`viILP@O9@ME2,@4xE_yKkj*r!fDb6X)ӗY9P˹hG`2`232[VpB(['1. -XX^tmاڃ}"*7d1@s=T(Y#79[)QY,j=R]\ioXCBNO?~5_7 n8j l1|ч/R(,ÇP߀ݦ-Z=87Ĕx YvNX5 -JQbQج.pvXE (u3Qx&zDh|S\/ -gXm )sg' $ FhԫR38> lc/0o`6PU|@! f ^d+_ӁWg`B*x -(84\XP]4cpJ2:w7fJ4Z!%k9KV4yv.ox-BR?@b <A -n"mbNCT:hq_r ՠkɐ㴲spa}D~c bD$|tր+: Q)9z5~ɧ|{JzX߻ݼWuRr /kJ-_ v.5{SJ {re>R jt -C@qta9/i !!={Q!%{w#{.oWj\㶽ܩ,mFӹݨBd7"P., -~3œ~&LM"@όɜqgd޿ -g(w!@2gQUN·sT2qڍ|>܇`\ͯ,ImXCs8_Ags~Ta Ȁt.|Uj*E.Ҿ~ݫŲd^l6^GCsyڦ +u-̍hum"JxN{dMXc{:3˯{(%ʀlc(.{f\q!ѾUqxd'G=O{2wynYlƖ^~~]ҏy̻n: -L[Jfc86%~M $9&zfu>tg~MrXę@sp0x/7o}\7&uIޥ既MφAe4.\󣳩V ~<ǝ$ɴѩz$@7(UaBfa H>w~Go<ў`MrŴ|0袾d27IJv wqpyųeY#2iɶ'x@4y~e\|62r51pݟoY$݅6l=62pGS=[#|9'8Twn9(I.2j1+ٝevi-&ȿN'G$MWLn9kX\_Ae!ֿ:/q~c|ʍCr.Ycɳ{huw$F{Vh_,L)&dqȳ~v.t%=?ʽB^kJ$֫N⢍a/71hq\A6soex0vbjlŕf*y ɤėٸ;mۭwן1^ܫ<Ӝ^ 0uLLt,.:O]lx[c;^)Zq߷8ީ5~f>U]_zFQ);jl޴wSek!RKX 6{ -QbK,7)Ɖ5Cz$s-J*}Q6+[L%|ƙa5v.A?2xv/Î !_:>vn^f!\7-USyuyq=PmL5D=U4SCnu ޺zM+kj3Wkz)Uų`^훲)W*Zˮ_`7z$s35z >ƕ -Írrl=HYe'lR2&]]HܓWUKZY=ͻۮądT$^IvWҍor\o;}iU۸ۚϨoTq 2?|J 0ҮVmT7팡d6 6r)9u"F ,kݖ5bY-f5-_  }<^j0ճo0pTʱu?$Oߛj~3;]/i~ki}̯ato-;}5|0{8:t" Zf;ƫ+o#i-4jnm5سW5=RxQzFz6\zVPRiyvՆ[|f8ܬ*Zs6Hk4lNϋztLA6,/oz3vCn-\&C*%֋k^3QCRLYH\XPK|~tČ);UOK0nx1`z 2?wM)44#wBZHmUeڐ>Uh͵@r@{&6w7a#gXcrn"aw28E/{njqU-=܌R _zn(U/g@Fi(W%RKv}Km'Ό?.ϼ/_w^1MJ~ʵ6qlJr#} ^n$F-sn:skß[mJz^.K:Q/wLC1V~ -ZXo&s= fuOգ! QO=8wբP}Pkԅ4٩@"T&{W쎃J?KxJa)ln֙]mǚح$(O}bV2ŵVKϔjrlesߛ)aG}?mk)teB^iKQ)(&*)# ɺ=h@=.^;Rk6XJH+]ߣ둽̨KJ."L-Gt2½*=]**>h&"+e zue,7Wt Jz$7{OzbYjftխ9>kz=o(boHUw^ya#UPXTY@Jxu JS5% ohG Fu֨6@r HQ#AH-?G+H'HMF(=RfAj!f_\@jaPwUހ(w:Zz(UHA3 TO+ EZ <.HEXh'?m)~i[:`nyu m4:"S8r(Zr+h Lp8Bt}\zN.+릇74>*Gډ;:O"9o}ʯ?֐~/wV;.3|Z+ tU|ŎϨЧCMzy$arWgH%T C}w &ȀHAoX]tsz~u! -v/?U`cS~tco@@'8;}rͰZY -Oh,d&{ ŢluJoUmɯAӷzxX>WWNM`[\?v>e([ﵾ\ϟeqm:PB,VJevoAvCO8#g !&x[>^F~_sio[nW]H^G\֍=AptsjypKyoL.\}%ܱiሩ`2``&PNrpt~xsBY3A;dDƅv`i=5w$,7v=h[fS/ I|w6v֋;Z*lӛyv=/w6l H[ }-@x'^t/;|}W7c-jUr>aU.56Wz@5ypvLY`ཋe9Li^T;r*=8wx|>tHGw#ut -}!^vQSnf'd JfǥB~3٭fys;Ke5Sܙn,v ȯHAx|mнq\Hz:v1;LvWܦ(bèa,1jͳ$3+]./BϭS 2ow6;V8:(yo ~lF1('\wZϫ~wfr~RsUe[- 'd7j` ʗO{wNqzon_qk```[:yWN؎ēҸtWX!'Ĩ֡Jׄ>؃YFQ3k3ni;Qd0-u^xh$uMwuru<&u6ӕFwaej~i?&;̖McM OǹaygNE;Tkδ%[\MaAvs5cԗ~>(հW)3BcΞ7}t{߮=4r>ڢ XaM~GbЯ՟ Z٪z^U{ .@n)gT"Z|7Y;q7pvbHHsN~f{$A:+k 1>Me=Mge 2O!FVWu]U J{ePf*?ɫ#7jNSnԭ9֜ vӊJhؖ8{τ¹Tr?j̶jMgu=,Wp{pb2I/ XosR4=M9 S^ :֫ 5ױ0_6[|.#ܒeًIyއyVV0C&q(20#G{lM]t1ֺLI52n([2OVnj*@,Tu6-Yg6jQ-T0e,h2#jt| WʁÝA$!ԡ]c*,lMf6G4whSl?RݙJ&]Br Z5C -XKּKV$O#n1HZ' sus>dGo~G?6أijTV'n9zmr[= bhCz -4%{/Sf)E(_ЬvFzbb\ýPy;*It0Բ߸gB?lQX_$o}5^LEyt-M- ^M^>'~tF d6} ܉-.ds2LubnFDwGV=r4%p?Xmv$h`o/.zkk2SLO;Kùj/w7bS9kori`n*;*=y^.YzӲW0 s=^`G+])m8 -.۠Uu8wfua_p9 4gPLZ Q~̯5 Π@"Y.^m5p\@Q q`='tllT7^~N}Qm>4֓[ߥW.Y_+lO2,4wyI,L -|Il-pfgֺz:ICc^FtIR$J*TV^y~3.,uYVw+G?%yD)CUd)^=6][ ejW6ƶm%GKSv-wa*kd -S KQaɪ~a}nߋ>Mm;}1\K(Vk)Gkc'`5޻r%vF\+]ʛJ|4K,T cgvbH"9hTq,ff0fr27*n׾Јuc6j*MOm5-.K"ņ~'M9{b͝YrzE桐}Yd䥼-N)u%U 9=:FLLp*-8VBb+vGrwb2AqY$mW7}J,Ȝө7v#3>GbDjauJ$Гd5#cU -µDҡy4#  Ȕa΋T5R˙ٕ"kTWb ]ո)[ko x5MKXY!ѣl#t!i 2+#S!7ƛB!)TiTH}ȻH$E㻉bwbG\,ދy.2Q.lZxj@6bQܲo$28v>phX騌a9pzl1@tn%~$1i}Q)SXIOϩIp=*=&?<)uxJ[@s&w~Q!f G4vJ~.9ڗo=݊|btyQ.Ň ~yw]@Z盈Ǯ' ?c&Q -|yLG*K/J>0FFO;Ax]tVy4Dg}ֿof -ySJ^)|;W/Φ#?B)en_0" hUEگƐ$-lx c9gF7Gov&U{i+B4Ew.kb3g+Mةv{s{}dns1ʼni?b9φ~aN KMIZ(u|Ued!ہuJv\js~84o&g,]ش޺? 8r6 zg ݼ}Ͷֲ).6=]9h%qCn9b Lޔ@:KO?Oe"):wk_/`Exї-w>ڟ|OgQOch4i}^v{" /]\z0k.yy1>Eezo@j/t+IMۖq4eL>K g;SX=&ȷp<0mYwi_zWYCVT]2k\ƹhlGJ( ?f@+$SҙUyΰat7k{-\,f?d -iyŒߕN*%훹bwa^2]26J=qꤴ'Cbh3 - ԇG5fJE@tWxgޏ99]^CfTn"ʨܫ5ŇZM~jH ?ZadJg>g'5!t+8{~2wŲZFfU΋=Hq 9;eu2UnR]iT>5FڔP7ޮE :f[݆h6獯mT㾡nZPҊ3ᶽ6ٛ*d31WJy'MR,Lͣ1=^cN?nWS`6{VNv9Ymy䓞3MuZX_ѥ.;`*IYbH-Ov&Xwmf}k^}~q_j~gd#`~G`˹n6'-j70Fm&AgTQj]f|d>ߒ&Ue(fgtp\ -:W ֨:|vj[/l}K]?G> O~le~T֍֤ʣמܽ ۀv/{ֹ_^ZEb;R.tiΈ?d M8Eb[D`m"?e.ك?{sRH9ͿF8#t3q^1{rz/kJCcn1å fʳ#5D G B5B;[piMl51_Rk2=E5S<<ٍpX2jezju7EʑR9rD_Z۱D+sqv]# &=SMԷ kvQk>kn^=֜D==tkl%qǹp`=dsWYJI/YW ۤ`kvU/L#QO-݁`IGLvognR.=[FH& -XeF50]p<٘]fyBڷ?ܼ -sslpsok@\+^ČYq}i$%KA'],.t(l:CpeR4:9>(ՋRφ}Ԥ;thOqnWs6m\h sU|P4b dbi.n%b嵛D\\P\y)E)itHV -ks\ Uk+"Wkֺ.v C/-4aaTLI-16mk6;Kq=׭&M}U']Rh\kWg|Tyo'݊77O4l6_F1Wm$T{VmdZ~uz686NvӘU*3[v*hMit|2~g>{)T>ިRY8Ul$V)uajԡTW*s}se>_f]sOXκ?Oݝ~{6ycĵOO"sU{rGV?IUAedTL:vOWrQ,V~O+ûP~uck7{z+s3`rQê9VdU"?+\edYiqʖSJ(oPr,RN/*| E}% c[O{\6ҚrfF߇ ?IRw#%3@Grzթ)aZ'D)̬~@]Q th 8\5K]^l9PE]r$,W3BewKL 3]!:)(S=|8(^-,K_ovq {qa4nH:3oZ(>[\7:)~+ji.>)o ~. oI9b|t1FWGm}D!@EG֯veZ Y=N>8mdR]t:rקz5zݓkZt*d)o -"4!jzyCRp5  ]#'cm!O` شeRc6!ϴt|J=H)WL?o@䑋\KN"9\u}}# HjNObƹK -VO0^]-twv}/ _3}"CCmȳ}o1DYF(e[ٚU •؊%Y; [ -ƹ Q,@/_G`'ArQ<+f -؊9*D3  YFQl6(.%!~ 'H?_k pC`nR*@9BYH;@,/ܨ0ϱ+|[A" ’޹!]׉ݎ^}% =ח#W0 X%Lɟm䨝z 0d:{ -@mHR -@KU5"CvcH:l.w*j?VlYSۓ`vHFƏO6ߚz##}A^t)7,Hn&sV+9\*oto]:HEejWWa`wχϩZJZ..hA+LY\ Q%0ϖ00WDn}* 3/O\ Ş?8Z 4=VmT|pXY["smǏ4s<],+ny \n?qg9~0}؂cO럯 \Fh5AyyS<`k֊jsɧg)Ou=^yut.2Ȕ{9rݥw%C3Yffk1;r(]FA'iIUh1-/ =ϵ!>I~ôGcG{o>=s?m}GNQķ5mY&n۵AS2?ů/I*Ā@p>H:R;IKs78osw)i - *kχLY:0Sލkmj;m;ol$ֲ8nr|%ljyZTvc>>89Rש H| -cr)uQ Ǔx$k~֪27ΑQ]$]QjaZ<9UѲELi Uk;QϷ5&99[P.+ڏ͗S t`ecWZ.:BLgY\ƜFlQXhoVpAզ3i黱SLu:x(ܡ24bt=g?-/y[ < -}Y.ծΰ\rr?{۬jtQ=&{ќdkXYԸ ѥltk= N$o?mj93vںVg9YWnLO2ɴ6|jQ Cf=Mk:va[VHقXR/pUfI1+]=Or2j= -BZ BYe~v[+_&VPR¹@|Q>w< -O~kgu3̲᪋g.إ<|hNvLuڮ75s!+X -1/^t;ǼPIf)9 h2on~%dg{m$R??syb1[zh7 hhj&Czh?9إX> l|҃]a)QWJBW$uNВhPU)}M>fs4C:ͫ&=ҢG}'AH2#3uQHzf:R]sd~HHHnF" e0'ȭ$|"՘+S@xMztSӺåVX4k-ݡB:^ 6G~_2U Kt:bw8pIx(T'X.[R;yxZaA;F.%|=!. -y+d+/ݓb|cCJ{Q*:A\OW"3X/]<:h^[ =ͷV`A Bl$;3!:2yO#bw װwb=1֕ W{ "_쉓^_Cd^PyN^u[myi@|Nߤ4;J -7NMY(d e|+elďcvO;L|묨wl-X+ddZ~i>z M(>!f5;/:; "X~9[9ShU$4*~Ө馁̀Z:md/~>-^{Fk*`}6)U[?ݤ5$m0HX͈dqvZi}Y2FڱUCf@Y6.0w&K -d @9Md/7W\ݼ{Vjp'#R?騁nTE2 ?g2eƑEV -uֽ*d~(X [ymlTs[U,^ -eq!>e#Dޙl??p.|˧Qf,kŘN.K+*[yI)cݵ޹#^Ulgynw-ᚬZܤFIK~[ܣG[n~~ZEbAL<ܒEFuPտ!QY#u%lqO2Ma,fx؃,b0GمSR}PcÞW{+txn :lj]iљ3W[qڷ9*GRV+*G\d\F#]ݬdMI튓uJJp[o_{|jPLӂ-{_c-bTzj\u6)UFlQu5)*`],diԠnh=3"Y0E:dVpp=K \Ԝ9]אxm;zgKE:F5725[.+b+rrlusa?1d]ww2m"b%2TS -&/D x5vz~CTFX\Gp\KH#hqϚ6 @z]tkt]m27~vJ+4iMt1< PUń YU ^s0Άj䳂NI^nRA~z!O^QY(>(^Q<৬C#g8o*z3B ^"N!m2@paCx!9zPY F%^!@RP(]ї"ҸA4\}D jsrE ʐf2@J#vF*WC-+`Ϙ.@4 {x#kG_-[7X@NSW"&\X[}Y -r}mTeSqxUjo@7 ѯOa7p7 -Q؟<x0G1}]Gq9EqA@䦋2d݈btQW )eG?"EǠCjϛOɔyZB9/FI 8:][b:H   Y$S]Տ8^7߇E~y,Kx }x~,߹~G=_7k7a+/`m| -/ڐ#I"n`'Ԯi }ۿuz"=bI>`[|xB4lL}|Ȣh7o6(|-5v[O+NAf~1A2r p'i""CSH"yFR}gV2xGLvkmyK~*nՋ<u}WAky.wcLJG,rXtK{7 sd~Xz4]|?mSog.7瓥P|⍯X\Q?)q#*-:f}Z9՜NG ^BBdmUK8Z7_LpޞMޝh>khXiun{/y2q^}"#Gx6܇8 ȯտ.P9>r.Mg^a8'=8l7g|]ZNMfqoIw:1d1v*Tg],NXr>bFZf0nMUS(t~H*P|?bwP䬕[f5'w돇5\5Vgr~! Q6sO{XՃ @?뎇vХs޵=Fv6Q]W{Ӝ|Q߇Fqi"4cUM֔vdޑ<{.efݻW f}T^C.NT;QƸuR՝/4;9Nd6,l@Ӎ.9?C^ᴧ)z2 "&W!pYn\9c nૉAYt_Ӊ]XӲ;}_q$-XP!6R/p55^uuSDn eW:W.ڤ#PnnOTj0hLк 7TtBvQ?\6H5{5tjd|mR'_( !Yt'!l%dIs<뭉榧,}N.y]AwWxeOj;+kTrj8[U7'snl@ eE.d`kX 0V?Ms{?s~@,`rj:QZf=q_VToI7ew9lదF+ U[RT12 4?4ho=}| ņŢeI lPMt+<~\qkg7c]{L5s&l}rΊ`YuNJn|j+Gҕ;njir2`5̅l4Σd+3igEM 7^Ʀ1֫YW+T)UyK3{áb6ΓJ+b|Ji6LFv0P"H7:ŴMlGF>|< 3gH}ճw W5"z_SsM:'UfW6}*&^0K`VM7(&R7X=4׎Wm5~’eN%ufW%nϳcVYRamjZjW+JoP,ŸYjOZ -}nTQo|ӢԶ˸\Kƹ-luj/gZ֜ TŸҿ\WDVOkeag2=Q 4Zs{딸)9oǦY8)0,L(:ݭ)dN\:fq>k)k9Ro@ZW3yRm3'nG=UCʡ%؋ -7 ->d!NLD_g+&ҧVrk \-߁H -ĝ!]sl/ReJddNCZ=$2Cru6z -yorQ(УϔʥT0Y]14uQe>h(ŸTqr?Apo&d$]H^0y ᚺyd՟ɞ{}g1cFsmַ(j?A FQCV:$DFyL7|Q$INĥ II=dup>WEgbsa%>dn/w/cJkލ(=:WQ4o CU?Qi"e!J26Ā%E0 -O?q,B,xeQ|3`:~}fѷCoQxEຆar&I[r5dCƕ jD!,H  Ǯx[|;a莿I.Fq:ZgW8wE-]}+>^Kf=G4󄌾7}3h!"r܏^.lá[>G~tXW~R㾥Τ@F|"BuȅTcP}Wֳ…r@<,Ut}$;yvz|Mr|9?H \pοy PKz@zt#.;[ HNgoc=XWrMuƄ+T;$\,5~'uTxBO 2:M`>*p!nPK}zϿԝ_Af?5#K"pϣ8?ϩ֪%yofYk^ @v7'=^{WݹTBǮ_`pߊ tf4prT .K6ڌe6f9.V^[?o.b*ԁ0KzJ]gBt3ޣ%7x%zd}f::Z$}'('$}AF\Md;!ZhQ.&Oi=K}9,u(\~v'@3/ sFSD)/3~UO:V/=&udzֈtetO\qzju ˧vz֊:7оg9qj7r -K%T\Mu-,5RJA'}" dJXy󮣑ȇQcu9:iWg%rzȷl};}Jf3vpw6EaG9u- jY*ypOΪ83݉ձ)OjWj6Uzc&zJp  [/#g5+!;K;=m3[iIc$Sy~^c]US]ID@sp]*m 欈 %H0A{1ָ -֤(Yw͚hpUxVr0ܤ0SRo3l2d.GV.3, )L1g֋z,A -5$,Pd|v^oHOlʤwT -(zoyV@թ Pe\rBP -1G㓰z~r0^`B_]ɰj̰0WǦw+=(Q&QB"~+{ٙt|ڹUɷma֣Q?aS@uν2[r4zRm -'N?lh%\ 1d8̰00w\lf4ZHO;H- {pnphNOO'[nxV{Uy˱< - R1ZvŊBrY -xhMOQl_tؾxؾd2,Xg3g䇬Wv6+mί,OÚ jw՞C@uĞʰUݒCCIC>P}ZZ!NLO[_ --4:Do׻=[jSCˬ;Hd>ӃjKe$9e>osuPp~6-d)9CxFsX5ez1:؅zXZ4Nw)WA0F}h]֫ (|:z-&3M-*OAZ -sj(kNiBRv[~Z1  -ÏۉvٶgѠI!UUuyLGWu"VZ6-SQ.n(lSPGK7)|j{xSt~)!5P+AZA%>ug kEKգ)е`w-^GK&iY&l\zb b=9PI zjkk0Fy~7 `OVGc -cNyDس %gMRR -S_[)TÉ8D|NtI5֠!9U WeZtsTIP^bc{AC9(0+ ")B[{;6K:ל$t] Bpoinۍ!Gޫl㿼 oty0 oĨa!u@#5j/;~{{h@'AW#v>V>tsJ:{Yߘɏ4S)8 -->j74?Y?5^΃T:o'G;2 ȴC -^]@)t;bviOұ(fЁίqkּ7j A .z(;3҆.uW!P&TO3-Gz!NO58d.V\u3t%bf˫bO?M+>My[fڴ~ /np>?d^$Eaw'W6ws! WiKcD߅wyxCѪ],lxۛ[sx^\f2#%کæowo-݉_-wF5X 靜R@~ NCS/s%oTrOT9غ]}}ƹ  s9ǧNOtu9&mkoo%l6^\&00]d9GBB9NV< E0KZj~|ʣx%g֏J?|ۣmm^%z_;u&a5y?-.+>oNɬlESWr$Շn둣$gMy<]+^JZ?p*sBkUD7 ul[Cӟ`>qjɴm;ћ~0<~Pt㠨!QA9I.X7eJXB-a_$: UR.6}kR1zwNA,A/E)V-+0:`_ެ_0Pl-kq/$ʠ\&A$3jntRzb×a]}g|*l= -Opt)p_ *1ކ*;n\ؙWשkѹ]A:nc>J;?Jk/kMVf?+[iڻ^zzejʪsӶ13⥈ (k%KϠfP~bY5vaVg#}W뤣 \»U)M]?gܳ?C卿5_]izBqWbzM"t^ -F˒2G ^V`I dBRSL * Ƨf#}Hn:>TxM#sUalaV] S|}9+Iŋa= 1[;xeh}oy 7 =l];jB[]b_~7t%*@~J]_6a -Q#o~}`pP3/qyWe=ꪝ1͇b|;lLql)^cɍ*Xn['Gַ-}Dnp^ΧMf:o/u_Cus[4XN -q\q64pW&7}. 3y&}x şeR/5z1DD ܸϗxם6bpcQ2镓2pjX۫V!BcPSFs^3:GЃTmGR2~G+qd_r=d:La8 Z^QŒ9r=m:n!H/LQ$Գxč>̳A^_#hq$zn \EV5$>GpyťW}>3`z$a㩨:yd Mݬmpi^1Ǩ}m'GSQaL,˔JPȔ>F)X-K.t 3j|1[C{>N+U%y>Q:oйaڃ^]/@JR/8!q' -~}F8}'~ꁽ^)!+myx6cIDٓj%'@5Um8Sbۑw(y}ȍ*^v%ụTQLOkam?v=) # &S?YN?FȐm`axQ1)y]S^栍v'Uv}v 4ƒ -- -Tqhp34-QJU8O  ]k6p\_̏jb~!Hk/s9:LC'z1qk.z^ߣ;Z>]Xhwg'@:qdtⷿ$jSޚVId͚KmcYyYfT46R#5'DQ2*:/jҗj;%ԽݲeI#..+>wTj-)nJ̤kLjt9_ߨ4;.%jWJlc|8.rT<39,ۿ=Mw\+[YF )@>^;vei٬_6sV؅]{?[)|U)9hM\}NsI$v6r9rMf8_eXa$+ׄmhCK8]sԭ/hsy PԢ99o~ }5+"@;@@Wl@/} @n˻aMVZCrp7BLl[{W*9[72o<>Y9]_/ޙn.qZ8o-jIȼ~&E6?IzO}$06dN^3-}& ,rkǓӷ2bs2/$չDi@_b2y${?LO_T S;AE~k-Bj#CCcJUS8{{3`&C>.RH5j.]+O?OrOTTD 9_497zV?Z})5Sfjb6sjeH4dO)I -"B6)ɱ$BL+~^kWiT"!+?fjoQMu&VvrOAO1R -_mA{;/yy\ۓۓfޛ[wqZ?ӡ'T89̆K1m߽?]ৠ)Yk#ހH]P˺q4nq .^&S vA&??c+VE-5"x(L{Ę 7.ޓc+֢ ^W<,u*Ht&qx3O6qH]WA+^ st{8y ]kPbvm6:geAwkXjjo}`jRS˕Qj5{ց>v1=á]< zfȡZzX6M5|*N=a{͵e?]n_g`%t9E‚/|\?%mғ%KM_XRj~_bl~OiVæߜNR^i˯}oP[}E Y jɺ~LӢJղI|[זzڡ Nnꖙq,G# 0PL{MGGԦBOB!V -7O!Y1hk,ZۅP׹ٱ*f֭N/ͨ=%<jL*|b(3V`r ;e[HṀvڎ`R(:sp -[DVWS/Fu0o5 ioړ٤Ih|1ᇊ^i5!5[Yi[o_K_QxqmO^˝~]pG^mpv?Go I.4\n(:Su$;x 6[?YV$9y,gMX'j6|qٞwrt}Trʃ[0+[7ѕ5N{cZ4r`P -<)ڳLD,@X/}[ d".p^l;\MNv -Nb$[ѵ[(.~\uZUQ}*IZ6LZ|$J٣D8SX<_}bF|޴bN8kB2! N?<:*!56K0跚ٱ {N!sk5fF#ִUoRPZc+kIv)ӉAو%ʖ+/mKP\ࡱYqp)wga - ;ZQh8y63]0Fo;[{k%fƖkoNkPG+5o+EeR$f0!jva|c.8C-~J5\_ЅyCǏz?N.3I -HU缍]Ѫ]UЍcX{9wZO볖 !MpW+~,>qXdR/qCo3෰3_L~ƕzjmWർ3f=d e -iF U2)m∟D'RrE>1HlðNe8.&=CtX gS zȔV^U\M^V|&% l5`=cM6L0QÜECqe#iH<0|=1h==`T!e.19FHǑB,>{T,YYɠnלRzf-q騯,'U:ؚĽL$NWFca# Ǧk:|=Eԑ|]@?- lNgylLhM 3Ur Ҵ53lf9W?%.?0*IGn?[m(ޚ`"f@G(}VT{i9P ZuUnsIdR2 Lo5 ]os|dt 4jZ X;n?vEqN+GhM87ҝ'!Z6chnfh"ޞyk&[պWTJUw*ŘxF9s*X z)ΪZ&Y)ee^nr\eb(l0k͞W݁ˆCQ0(O^GοpmgO`恥׏XE.m \XbWSH"vEN<T*,!HThyhW$L(wF%쒼:Й]P~ZgK"AR .a2Ն1Fx~oȴ4k-A'ܨo4c\Zr616gwޥ|jS0=!%$Ghps8HQog v= {/-MbVa؇d$ dlܪcЇ7' -зp43GZ`迆}j)JRp}FXb*xo&{u=mU[<4TK+߹woi -z}PP^X0Xl 6hc/hxauiqȆy\ ?Y5t -`<Ph^.WcDp`!jʗ3u=&^ (8@] 7@,D Ngb ZO_*IaapH%\^9:$4qg޶7ePf3k-{{oԒ]5w޿28F?h6l 1w"俒8XZho=NʮfSȊc>K11S4_-_?TVj~1$&Ͽʫ_?黙dLV6)~%<qgbK+ҁ6'*;:eg+vοJ\{*LϪ<;_[=l8Tj*=tkGAqPء/wſrY}ǚ*Pc G3w5v*<ҽކlWծSWxc,~GA_qd-O?p:|{#FF~軽{[wva/_øxsOp&i{~d%GՂoumwrd>tV"xɤMKi?S`Djt-+wHiq3>:j|q:ǒӄ]}cP;Pn\Sv7|ԫ5zxWDzS\~7r9nsg4#vmg~*AT[egTȒ?ˋ5޷8WYKvDLAo&LcOzxǽrXp@"ϼN? /ovP?"p14>q}mvpvDaLUt ЂhZFvd5E_EnsLC+e3s=vZ9c#1y@UC}\= ;υǢ| BO똛d|soQ(~eb"aBqZ -$A`>ͭ=EW/_Ze6w*5`X -ow̩un ?qF%76HW4yMzu|UKH5\ (7q}My-w\Ѿ<;g?[?VUV!sh-=f*ޔۚ -1Ϳк#?x/RmND2SN"_ -SvrOnMюl(̈G\m,0KuiAV*ʡ7$4;KT5=E1/E٫ܛ#Z~x^-B;%j*R}܍W>K+"ƻptŋ~uAf| Avf'iUu -/[s)=$%NLd - :J6A=Co'?S)3 _勜:8v4JȚ$9|^XJ4%_1`I7 z2;atBz:{s;Eys -Zlp5OPK9ql^Uw{ϥGͅz\-Ⱦj`U{ƽ8wǯ/}Ig"%pQ7yr19\)rIsI#lώlOv*lI} @j}֚yo -(7z&g&,wYNaJ˼e%l@bbM~.XhɼL٫^ .W(`ϚCGWD&t1.g(P3 eLFhNޙn6̖&y:b8CAqݗ ih/Fo;6߰ɩ>fٵ՚\?P&,'VqD6POMC/rZO-?(rx&^ {4S/9g1Tis*B%HlÞ -^1żDVU?(pl~KfASƷl\Li4m:rR~@Fb1/;;z᥆߇cXV/"j0;5# if'7#k0x"d/6k";;a!хkV;/Y@+ol4LyuTEF, mhU%%/.1ߊdI7΂?* )vxY#h=v =&z,utvV -'SH>C-c -ݏ -K,jZvS9dֶP $댞`[ z<P:.FEֵRP. ?&TQΪ:;wY*֐\["| -B|Gʹ?X&@-ntU0AD*mnm:ڐfsfRK0*IuEnlԍ7A?'U :9ɠh+} DϜFfK.ƻ \x1\\ ~$eǿ FDF[Kxz"ŧSGav$B#<&xzZ[fn9(VԲM?xV<P3v6~Cut$k"й̷sc'Gsѽ6h+ġ âM$:&B UɢT{ę3wjGHI/]#7v G2y=MI+`z>x][}[(e$S~;#Bn[;,>˘3IXd]~Dr'r;2Knَt6qgiZ~ޢAstj`BlTWV}k͔]ұ%K1oau2>1Vmqi |aǾN&BҜ(h|zҥN7_Eۤ53X!$mQ[^}'fu՛ޣv\MZSGdI^VRq 燕~?T 鷂OQQi†VY Jպfc+G wD^|= -c`  -@KhrW;6<16-95 -.G~1uOȰmCwFVI5HCrbaXĀ^S@o޺8pP*KF\'7a[z`~,Ysy ؂ZtTOC3h.;!:^)W|A)j/ -@BP1G[O٩yT Or - Kكg/c__Ht皪­QE$)EsО͵ tӔF F8~cLFJq*3t>VK8,E p*z0xh_Yi}D1`,sls:Rp#/`ip-O/prD>(NE2T㉻s~ILznUZGۀmt];c -pp|R|ԓ ] 3k p{3ga4d0x@*/4KC)P[`Q႖2'/%8uKjYor|~rI6 D`]&4DzDqo_BP6'XNv!_o{i~\n#2Vw]/  -E7{/<gؖ'&ӝ-`l[Lȩ>7V9s 7 laecNRFzce3Q:2"Xj@4EJ%Uw++Wlp%8|N9C-287h}_۩kuPЊe/--n`~Wp5zH~,Y(Z -\ɒyVTjLܦ 384Q+ h|cF47LF2MG~ސuʤu:yn ˳ .U(~ -QC WZ5A gRH h|r1=S#ٝ!Z,烙 kz#r ;3(g_C -yٯ (V^׭3Xp~' rocsG/.eҢSkdDi^=Kqwv7MwKuA; SMuE5e :Fψ;wnYo`'x&Rbo8 0'cne|N6wC#|+F`5?[Ѹ2-O]h;nvDwS;K@k~-7x O/AeWydr6YV?I 1km4(R[~Ký~Z/uMv<;ZGJ gZN-3뤻k-录a!)WZh6n茹WOrzc++w<#݃[; ϲ3NVGJ]w^yJzCNm˵ҥ2Ao&nf8תfƩwX4Gh35V5^<2:6R)M-"`*݈dr_+S9u6F ւcj@kR['IKŔ$S -Y>)UhTy1GFL%M%B ]wR :7e7 o]=K jx/y](g9czgUoM8'~gnWxtUN[!oL΅cաr+dUYz*4C)3D-bnDŽ,"E &t>}p ,qSdن> ]oMQY۵.)e+ӥzSMmo{*_|. -k8HoGd闤!$rEM[2f]t9v()"KRa1#jADVE2doPU;}te{"R׌R[h:T^>ݛbBZ;׊.{ߴ?lܬzL7Z}+>JLxmPX;6HpmM$c{;J Zao*U]a{anxpU@?3LeOφG#w{:>:^w_#FN [+G &u\=hU9O/'UPq)|x)kyߏֲ@i-zp^:.&mob<,ϱޤ|DM螪 29B -j<(vR)EhP @h#;j\5/XҒCҊֻZYE>HL\˂P4;<.)=s}^qhO):)nF5*M2ZU -*W -T -P)]LC tRh&%~2 tEsc~.WeDFQڮf#7mu1<:#265t[5/&wxOFybnNvVt1֝ -'O%BCV$B['udTV T,UGmCl a 7~^ɔ*sԪi`7+;QҮ R,/b-}ƞMfsWY,>QL:R V/頡N ?r=d2^Y"FU:>eak9Vz.tid.K%|Zb 7EuZ?GCfG-u^4_57zu7z53ms7-6*5XFl8_h6=*w$TȢ8:ՂbYahۂ).4dicUCMkCsYN -3FxmwŰyn'5ꞷ{Lb{Vwʒ[҈%Za=稺ޮ{>lV\z9"ȍ -RIOyخsVqu0;҇,W_Za?b%XN][L!37>̼g;mRJZuh -7͹dUvÅJѦl8/C`]9~{83I"2Y\W,ZP} $TpNlJmgj,aQw VZC=.~oS ݥ!ԕVg笚;=z^h/?M-FDd|'| ZB$%} -B.WN4}L'huNq GĉH~{zXMXh@Lo߅5$ E+7m:bGlg^xT9d$\EGeh~J)Ƀ9*%x8}#/,d$rYE?.M@:/ *)4 hR3|f;|2!T-(n=ǭW EG8(F5#Pc0*HFC@%6S{iNL~W=-&lr(/lu*jk N̨Tt*j8,"Ǧ5+4MY)?/}~=,Ve0 -` H;v΢]g ؋ ӸYuxZ>q`jHdؔGY{ ogm*uO:[cGIIjpOU?k>h!oPHC%lT ekFdȽ{`Ӈ)TR'Q~o__~e@~z@:gUo~K,) Nu?3+~C &Ьvc?ݲ?BBgT,,K#@CqE~\_Ow}9R< ok@f~]߰ NoMwJ?Җbޕ7<6vN߮+AX|oFC->_o쏤*_zޯ-+Bڥ_uGAolc??&u m-7Wg.[f/\r>/L\+tNTToZmzdWA؍w,QمLNy<,㛵|#~%߽^{"t ooTA&`EDpCfEs_ %UFgʋ ùHӕ6VlkHtb"~bO9Μo{+gk/ q}EAe'Bf 5]Uwݩ=&lN{xnQ~9||TOsXҳ/4.%Kuc2,ܮVN/5>sj91DƹxU` ظA숽`Y5|P~VSO\+\ȹ V#ǹEws+F 3~r ๋~E|Ծ6*OYdA :'}`!auWx3+x٥ T/ .PtgױU;猑IY`ߞ?Pۮ)/DyZzzޝi=\BPyy޿NP߫A(Ƶzj;tҡi 2y /|GgU暎n{: mEL[ZyҙMin eskq2?eEc6["4X/؁e~]jvݳ1Pg[#vq;OP޾ryPj!/WcC5ۋ,QFE>ތ+wM.GƳX#h2Do!JsCgrԤ']f1k4?6 ln۬wD:U{ngͰR -[`.Y{6nt.b]ӲOy_ds;i"Cב>z9Cq`h97eY7lbɣubulEѻ*MݻnFJUdڳj7.u\ue܅Dɟ_/c#a}ɄY5-"M^IuvjVT ֔)D!ַv8L^bVhzإ>L=^;A5"[àh&8-rbUxޞ![TީA[CB:joKjxTKTMktXufzy …Hg -wKUMw)8{3S}f{>{ɶ]N3á(P q]Cg6P&i6-Xŗ{A4sm=B:-5=OU͒dv+ W N4z-o1PT>WlG=˝ags(ۮWGQ&eE=,9uLsė7K=㘚*Er(2Re<cnU -&; 6hsJ4ӏ9 ߗ7'uʽ'J)Ǯ<ĘhRzT{i^ɛ~ 8Pu%UdnEF+)ozK?վT -ޛɮy'0Z>lL~S8XEؖb, - N+I)@O~*giC+vQIR?VQIzrԄdk1,+eߩw*`Yusr/΁oُV,ֱ{קwdoA,G>}*m5_TdX{,)6bv <柩(պ4Fi)WTS@,(SV r_fƭPHuA~=f%xYDvड׉Ϗ .Gr*{ylY)4aov`Xg^īR {:=I{ X8Yrhծ ͭ*!u2WPD@w4/Ⱦ9d -g'< ,b1Rf|)$pˤEMR|`Li`/cI#D]KkzOG~ч2z:gS^t0(;Vϕ#)A Iƥ~ -E Dd3 Rˏ: c -+<@EP] g/AgQ`Qe_@yDMŠܫA\+NheCۇ4zNj~4vDjkjT}i|Jo.ȹ#2r3P~v|1H%Xe~B -R`mK0(@H q~~D_l&cIy<8 Sᔆ׷"٨lF4Q '@p:bzIJ-#J0@T lOV3 ̢ ;kPk0?_4d*7 ¹&KH8C &vU؋PJHw]xgeC]کH'U>rޑyX6Uv<@qP Pm4`)5R%@('/,xɩIk9^OM{5(h -Z<8ƯX@]Sw(H~ `0@fQ,99#"`&BXʺ%2G::M LC~ T>ɀrБ+<*2 (|uhX&t֭a;5?Zv -W037-,2 xl^o4S6$'רOM4HMU;$˲dT(O 'v^-szLk7 /4|wb-DmbKݓ1!1'ID*ٯK5~]k<ʧ_W׀l6~yQfrCj^0| A@"N*Eh[]٥|lv.$O<`[d6hh_5/V/\+BwMޕ*ܐZl)>8=RιAXӫ/v9{mc>/VY9+<)lIm -b!AY2nX6qj07-Usu_H+A|»1o֒"$#pStm;jtk#}v{ ӣ'ra -;@ KwMշp;8Y?ozu"vnL3aK/8'_$\Ki}zÊT^TFWDn.٬#+÷Xô/u=8 Q9\ 1V{s~ܫn4)w^puK2hWbYRʮm0Q`2#9=W䎏 x1%]^՝ڈ_(:N%ҵv//frs;ݾ;#kIesdAڙ fdʱÊO]rF%w5ZʵEnW-Cy޼?s;y΃.hlu`G?UzPKɀl33g/.=w(7LwՌZ0L?A4ZMM'.@V6lJ!-w7K=:0(9YG~N~)b6T5T-: v\y0g7D}1@{Uաk&i̬IlZ%Q]ie*%fJyLYH5;SDf'CZ獵 y5' 4zaz`EkաMe1:Բ}@pWǫ<*brm;SWy(LWdv'BmSphˍݶ'Zz[8(5qoYWxn<{H$ h-Wc亱7z{檥8VgvjU:UYY]^^[7PSˏ-*R'*dmí^}xNmIբR1}Hgf̪o+SNwmW|z^=rL͖v9Hoܥ 'e/(pғoxތsor?:KJyzvL!XOiL^_3'9JB^-VovGWɐՖB_ -l~,L GMM.|J},^-l[r9>3̰Nofkj䰇`YGD:\{gZZY)MeRut_$YzZ4W@3"TKT0ZbV_vE &7Mf[qvbɵa+\Л!IOlu`D 1womdz^^=׭(qS^c(MKPɈ#yڍ<*>y7o0nE1#= {,1wgTg.5-%I*NI2ՠ$Jq( j$홵?Y3G*!9|}R[y|wixŘK."j/=k+3#W&zhr;15.[M2XBA,|P|&'T%#dg˸֗%Dz1&|-<bEgfdy\b5/ KD1q2^+biofJ, I3sW+%VۥA\c,\sٵ4IuLո~rgf[꽾,,=+jG[3/~gx9`jʮ/aBWNT1i*预t@4V(t((46)|߾6UֵMT.4+"=/og_;RݯWDGN7aa_zdKwK|_+әb[RHŔjhmwL>.D)3䋥|aאM5ǖiļl㉙/k+_fయ><O>sX\})RX_Q땷*p|^):thR@;X.oN䤉udYV!@0>ȵ/(GK>@&; `g[ff)dp}R06f:/G.v<7-[88~oJq:@|Ӈί$ EKo%vҦ sf߅qF :  h1Pu^3/ Hq+P~[zI3oN^#Ka(K3:FB6oS)ַh蟖ykE( 3tj+1 EKV9|8:ؐB4  `Rۙʃ*$m,P"#v))6Z5~kba?2Sbk/L~#e 8ʤ yq h> `Q@;+`GBO0/;snv6A"0k/\sk nv'c[%ZY"V*׽w1c>Tdo%]| ` ʗWT5B8$P$xBWx%z0v|DB\1#9Ð]U/( b#L;×Wz@d3 D +S_zS8)T-x{@6vxM.djb';.jR.8f,e}|(dR63u6)]WB#)P P TVfTc -RlT}Ĺ<Tng*cͥÈkŮ5Eg6Tɨv^I!GI+~NC)-P>G@*jTt }^4` - -0 j0Lui+a;3w 0^rXZ*O֤3YpbUؾ"=ߵLRsJYKl폸7l{dVq~~8\.[]]G6c Cr^CTo:/hCsNff_ Soa!<ψ~_urBq @uF@D7 ғo- 2D=3Q -D!?Oÿ!oLogʧ:g7k%Xgat sj!{X -r;lۜl; #n6ޯAv?⮎_ UG'[5 K\7,=&S+[˼xӎu"u"b=|wf'p5_A1%诸Xg~ ޷_´y3yW膴eK7]|PMo= p 67r/z. J lk,+9+bwk?!O[C&]Yѫy zܙ'@E#}gnI½L6NV\u!f= vz}NED-BuOWZ5&[(ʏ{4"~ҼԏAzy.hn.NjR5y<&jzԂ&d[lqBq/~*1ujG+W}Ay_.Y/k 6vAjߋ;n"g5RXW -ˏs>To/`VBmy ; ҵͥmap;Cwq/TZRe7ڠ Bm0E'@ -ܢ63ӏ;gvgPwSO`^;Ht<r# +;SCJs$=;7;k8~߳h NJ+l(_x@.ySBq4ڟf!fܓ6;fa(?H]a5QwQG #A - fՌhZj9opKZs61l،oayrF\rU/  -:e N]{vצoYsJХΣ\֟#]V,_iۋySx0kecvf*7d3bi=ӓ`&Gn8R:;fjm_>]Doc5B3I*Z4څrl:hM;u=̓5n -L%;3petK祧UyR򷞺lk亘J2V@i_CaໃY/Qmni؋:5̔yƨX C>=j mz[ғ^ڬ?SWF5liR0+U=[J=|G<З<t#zCukP3ը4G'vIA1Z19kh6|"JubIujj]EǦbw61uukN jYT{QgۤLBO7;/+bMCHG}R_Jʹ,'lyCOH Q_af)&Wܐ=Qe2J&$'s!fÜ0!Ƕ ~̏yc\L&pQ@BoK䲺y)T@95|^%3̡nRm8P٭UW?Ld2?T1r:TTk2m(ɒsbs97sZniJg0jQU6fydXAT/sIgrkQy&ӷ&`#C=//z|Xx: )w2W-NQ1j7X8.b| j5m)~ϦW5kø:ggl櫱m4gǒA9朅vćgM!H(eAg_i얢M,54Pv?ʱ"L7-aiA]yoyWH:gze<> BhwITQ|])b^8]gw+VZ28v!f}jN03fϕ>?d,Z@\QeSvi@W/]6}<$G}/_-G:Mb0"w9q5Q幗x٪Rs\v.$w&[b~?aIDad]S`0g7: PAzS 'zYۮ[uhDFO[ի9-4 T~BVYTkK_.ԫ'\ơҐle JӕWLU OsOO__._¯1~KӿZ1FS쵰-9ªܠ۳v -R3!T d=9 IFB[g%qN=*9|KŅ;04U#=lm\KqY;9>S k~{va&-lo6|yPWޕ#gTZI̽KOaͳ{Jj|=97",cN GVƯ0ӎ,~wWkҽ{M? be-gMc<+o8hqrjqWw\yx@߷-a5 r{Y}L1Ֆ> &^ȹu2ϴ_^~ڭ>݇a/Q>NNQҢ I&yse/ȘFnkiO2lR\kB֘R@;TEb*\01:ӻCkOD(h(}6EΣׅoCv;NC5v)<Qp g.q sv'Y-u,=8b:QR6kxx;a cҵVV!>[CMGU^E^,GFnGMS&U2oZ \Y83B$5 qeAN\?e';/1w<:3=bllD!w ~Q02_B»_{8i-*T`]yܽK~LX?;$> & TzH_-OK9$Hihj)*gO3PԔ 7)(X# -CxGrDBTgt@(s" Mi~nQB)؛tN~H_w 0Mİ{3K:%Hz' -h&}}b^ n"WG-[4n>˲ԵN$yê=~_ Ů“;q\aC9I1~`u[:lf%˙ c]t>dPIp̷Ke  ̓=Ts&_ٲ!NI[ڏ ^kt1h m} 7lK!pL 8 +Y%udf/wAs|\/kp@!D'Rqc8z(@$$H>$;a2Hnx[ ,E>)Fo8ZzO 7i; -: iL$ÿ4~&/p" -T,7P3PJ>jmJpmNwPz䭃;K0ZalĐ+@V yηXW*A.پ~[}N{So3 -i?7&Иhmu -@W"=a -2,H.л5.cR+xXwڬv$70tU9b :mN/]n_CZ`' ̶_TsO&tXF HYӗBRI?i=. %ȑ bho`o4O{g?=wE#MNQ_m*kA׊_q7HԌd~+K1V_kZ^qމYgSo/˜cD E8>ا_ç1#1liBj;Puܛ4O,⏿!w;3gv?pq=0bT@{4rBoaTccgu)\:>.vLzćTCdU ܨF&s=ҝvG[\=[ŧ߰c6Z sWƲC=[g[h>>9ԁ6Seǔ$Bx1ʣ:G~ -^[]t҂;!;bLLhJ-TY:m5/)?Kcu =+b>~?$;]hpwf*3|߼zPwQkGުPv|LpLA[4vhCC{nu{֭ F@֠/UOVͣ\YA8HZ~;PeJN֩=xxO\ў~vBHxv ڼ^tj#7֠Yj8]+U )W!vָqLREߢc{:M/@+PO^suZr{]7f7khR,A漀↵56`_ -4)ܫ *Ħ#͔vTb/C-:['~cV,[p!qA~Ahc>}R~lW 6*(df8L4xx`V{;7ɦFD*^WwUA7ū3-t'A NJ>_(7 9<3]ft7gUޕ:7lOR՛1f*rVGpVlhzA0#.ss6@sx=~r<}f~ C-ym?pG{󷛣e&~JEk8Sf- -r ޭ`veK~˨; re݋?Yf~4?F_<9v~9߼ ^@r"N>>Xc[XPx2^ #~pndLvb3Rq7T-$n~>|,:uZ:}ttYRƶnlXӏl0w7@%Vla:7NU^VyO=@m0ש6qZ -}^,+Rxkkk%m8?zR϶&Չ5f '̆_fTcY6=Vs%kfLjrlWZlᥴ&Z~`-wۮlo@6i;L7#CV(IwB#%(cʓy׎zyu\e ~m3Ccyu&hi+Ikؖ&3T)9[TQk+kGZJVr'~>'-Nr!u:j䋏~Z95lж-Y3ڤd>qz>C=jS#6K sBь7/?>&F+}RQOm ǕHKh.L~O@P?vX[~Xp:ܻz_ßBjXUJZwHiKE"Gor)=iDhɹeq-Kp - !6c~]UᖅqĄSЩmM 04֚٨WQ/)"U9-Kem&p+AEO1X0BP׷wuU?_喭O=W2D kL6\=C֜v^܉s·]j[ 2ɖ,HnO[|j$,Qs)߈]o0n WE}=5m2sm=Fy66πi kG W$/6y~;%VF(*g -lu\DEՌe$!vfLzڞS\kbۖpTU KJܦ6WkkC ]v߲%*t(3jtl|pp„a@ch!腍(L+VKf DG˕vʍ~ں=Uqy\b0`,ȕT4j`sf`[7 -*^ Ƌ*aPlDhrYp5E#H' iELmv~llT+BJȽ˭{GAWNZ9be,s 4& y{ -m L(4 @t%nG ȧ)yk@'rld_8'7DT].y=-PAF\}bvW4jX%Jq55D5E`+3N`$Tq(A4; :u@g%I4A}u/ ~\>& /ӉR0xt3݅:):j [ǚev v]2ʄUa); d C3tl+y`(@l,`ȲL;cw_X<[7*g19( -bMs٨[+żf = `MlM;\/ys ؋]}4Pۇ6Uޑ)Խ@M5Q% b*#d.p7\˚r<>/&:!aZj&,?;D z|xZov -m1P֧E5B>i_>OE:t*A/{. =) =%q&fl^ >H/t;ׅ }6/vH& -`z~ 0OK9ڍk8a6uof B]}чokoT˧]/]Q^?p9˳^xVʱOڇOtڣ˿ߌ8uΡAEP>|R{@yWAȽF5W18NB? ^-M%ӽེ=x%oR;E_xOKPo:l 'ѱJߟ|fgVyvzԁSC%nvfGZ @[ދxVhwiܹp6@iS/4 =7ɸB1 -.#a1XU=uIEBCs4a?ek -endstream endobj 303 0 obj <>stream -s|m;Ϳn 5=6#*{ȿVپt_1гY䈸Cq;_<> -?Q[e܍-ze1[4ov=iSv)])ꘝaL嬁v~_*{v+A"E{olԺqhU9>VX8W_K5h;7w\3m4j5xQFY QEr+ij%?S\O2MVoOEQ{g}]݇;4ZEm$u66zk[=zkQUsNͦjOgfVu%. -'WҮ1|4c1Fg)^HllؓQ4О&E쭵 ï+ؾё\k#{NUŁ_^J:|9TjݞtN` Z&' ҹ3S{C}]ɕ4q^,*+tnВ -Z)g=۳I'߬^&O,>&ܿ>]jC9hD:[^f m \d  d -Ⱥ'SY&&"g'hjVJ!۶7*W雀|냉sxQ`p[\ovsT.@l;AyfH@F:j4+@ -Hѱ)րJ0 ."%i &\i*Hj_UwU&9"%lV$]lU,~Xd*XF& ?S7.T*J4뀲9l`HL(7lvQP%d)@VEwc</;ן_g p L Re"S(MV$ " U@F~ {LXZIִFr-?x3##^Pؾ4+mQڎvwjiDM& -}^ұe W6&1|[I95 '6;@V0YC0D3x4* B$/*W?:t&x{Q#==}1 -D $ /$)^Shb 4sJ.Z:ZQ@+:+"[i,B)8gWfQǩIZ{S7tx]``t5):0^8BȖ){`JDRf TDK6, oSIAF -ۿ^$!7ל1"@EpcFuu}{gNó2{1TTCM gi{oxC}{褲t˖?S?V~h,2a@1Ȟ=iIt0b~*>BCm馂^z.U> EHs&O5 աWP'{_PNT^x+ -CÈ.{ltvDm{aLJ櫘Xh{Xjma_ihܟljt8֔&ԺDsjM3eSl7ߤc}Ҧ -B\6;cfgO*R6fS 'X] -ɏIgtx0|R{TZ4{n6ZJnVEtwBR/ojA=ޯK9j|sQD``?aL/V?*:;O7Ȍ?&:bƴRlS٪t>>z,\f~{7:?Yuqr.c^(HI։-o=7aY7GFtE07knLYf`<30== ,z/&w;Z:ԶsswV&KE8 \D Nj;vl}֛[~KΦ,0ᙀj5sO՗wN'ar]ݯZ-*M*Ul \lyR/m{~T>Z,;84&3fwjdN_aNOmKa@z5Y5OiMZU6WѴIS{7њNs7.W1q@n#E:ֆ9ٹs0oz/E7grE4(iz~7a\)uQG]똬#Vz%a$7ہAϘJ˼:Ǖk:88n*u2Q7yLjְ_hiLҋ=SLʽ -O^\U{\SVOG_CӃd|B ha4B>]RcBnUfy퇎5 _W W,[9LIjnܲK=IUʬ[CIgd/Iml"D 򗆎W z+_.mM9m;X<`;js)'YWᙎ(8{kve;kP¶6ϼ+3My sa,}78,^(ʼr?eYVfQ6 bљwP;x;<*n7ǰJ[@8DExEZEX Q$wsiq7˕tK#@"~Ť,1GTy$H7l232mh[vU3zW+WT\aZH*O 7%-c7hKr/5ĤI%s^%hL;j\}L\*ԋ (ҝN,61)Y,}.V%軨] EHka5l.Gp[@o@v@g -Xigea5x!S= {daܠQJ9ʋ;|TlΣȑcثKm:#VA4\T^޵: a)A3|T~?"_ ocp/^NV0 I:qOOU[ld-bS!&c!gu2hgbАlL@ \`ĈZb=b# @L @L- ft:Ne@= ݟWx2+n^[dGfÚ8eZ:x\l/Ɋ$0 z`#% [֋ v -g& NqLlW閬R l/4UUɮd޸o<=a|S/H襽N?`+erHh%@*H7re@v$T?"lYdOO l0M@-+ HgO=+:j̕KsihݬWYPS}*xӗJy@^DPD J2B(~r E chg7@I$8^Hzxۤ5@FZ -ȏNaKizj2:Ƞ⡭aۆǂPIU@&Y/|#+4Гf1ա` Gw806TMZ3DSmySؐ'ESW?+a=}OOVC- -~[5 6hƄ:3YCۇ`H,n7kZuL{PրCGy'?]繨m'819 &00k}Ӫt -]@ѺKD$_,X\@+ k{ h dGٮoI/;AIf,Hnt0{i!٠ZJV9ӗl}W@jE - -V -HHrJ $}I1$0:OY9 _G;cdVs'q9?xi<~!IF&o_k -P4Pq?*^yDPvPzS (rJ嗐+tޅKFq%2K{А$9ca7}Q,f3Exq 8ګo[0_Qy׉6;d9٥{VwkC ʧ -pgm6YYX,W-"?jw}j\oyif6*}޵¢9{oZJ+3L'f4~ 23mF]YCfoMl5oz򠌕Oʆkr*2ϗ~XU[>Ud}GA:±ZΝv&TTF7r9֒'plZk֤,[)LƶnΝ'o4'+oz}]9-&LYU'_"4>Z)}SMx o7rԦż{y78(]\DyUecmUu3*wR3yHV?oMa!=FZ-4uj T<|3eH4%ToRZ4$ԩ#lo{57T - &C;[̪رǟi.ߔllv#.dFTuR\+Zg4](G~S^κ T U,u۾iVI5HMW Bo@`98fǛpNzKBYa6E.N,RDWx_%`|S$.hvGUb*m}0i^mHOFUd۝.箜(n6-p]㮦[Wi?( \$)H9rCT -^[f/vjY -|ym^PuhþԬ0> -pI5q+w˦7OwN]cߩU~<5Hai8|| C!$WhA9; U*3hhbQ ٛZZ@A>{8zaJG~M*Y nvn1(I5RI}ٌ/4bx/nQ<]!΄L3\&!Q'.h:@ όN }8"Ƽoga#Mա!y?83xxxoHId2!Y[k+YR˙]䛻<>.B9 -i_o0(N9PN"H -H%@T'&D2!am@b H`y?6Y{.Sujk~+A.Աĩ/aluEPK%vB}0;Qa|1CCGb7IBIIO-ƫT+$[~RDѫXk} &тK"Nvqνgag1dJ)^7[YWI5 #)%EBGUL G(DRoD "9eP$@>! g14uHfIGr?NtmA>Hk%ȜceK>g@G5MVc(1ҀO@P $g6 hdR4u")2 h|Tǝꛅud_5/`؋#M'Z(9,\zI1SɲXԗ urQ (@; #-@`m5r)AH7!<~ -0Y%7g9$ݘSp1S?'msW79j.3Id+[V]$YI2`0Džz؀`S -`kKs\]_!;plw#9@| ݬO3ĀlW3_h.'uz\._jUFwԟro}1 -'.d$"<_~~H~:"/(hqK:f3&ݪIjh*áYO% .z?/l k-aW -HIf@n8)_4Uv5ߝ & iMS4^(?~訦w''~cm ր2瀲fHVK!P: '9~j@4W;[?p".pFl m]e{EL&pL&ѹG .^R@WyhO ڇڪ(I㍪Ɔ\^OmVJpo%"& e75}X{K gL":_\$*׸{U&t7`|5OmҒ]$ `-?2SzΙi|/oT vwp r"sX觉xIZC'v3Md߆i&`+]f vаEp6Ρ;-#oI$i=&O);㭟Yo %sr~ڎ MPplg֩P\Nh2O6sYfC9L/܎=:>JphI 7m7iGxf-?:' 5Ik#~*oc?ZfefN6!?Mn9Ѵ(pAc}Tdm\{nBo:uέ#=ӽ_AlmNMW26$F٤/N6fs. Co& R|`K}lrͲӭ3~\_Ʈ!ٵݳۜI 2ráƹ乿MdV#RxL/50gyKUI҆Hbd*8Hg+s74[|sMxH5a*|T=xZ.ZsWhRXM1Aϕĥ<*M٥wnzMdo¼UK&Y6JU8!m]6Ө*ڶBwR_}.&(;),\2 -.ژ''n].f)?UWEG6n{g^0W\N87{o9ٿ? $# IVCy&CWz]byYoEf4sV!/]~Z}}zWzd5 fsFҾn^Zm#XƷk2 -mJ[|1֜UQY:Tnf=3,f/Y~,Q RS;W\6ӻXae+L*I&e xWh -Y]*LUr3H6lgk۝%Td.>grGfe4h|ՈTjMXY3p͹WM7U RہI1_&^Qv^f+jKNQ; j»j|vu"j|4sBa]]8ܜhKfETd;1VJ悽CSأ&v]↫(|lֿ+I" 0j^d܌'`]ꫝRlk; hVYlIM#VT50PSeڇ%WK79MrzP6fHBϊDzH #- k{ynSqM7eUċ5џhP肠 ԸTϬܦ .Y+.m9Z&kPs\X@;j~@t+ фCSidGr"Yl%@RD(@5?Zy_U8҃E|~AZ5vp1L9==\CoBˑȆp~|WR.ݣO}rx\Q4 ( - ~ōՌv)՜%Rܫ"z-uwPkPņD;ݻŒHKď!bv Ffմ>Q1 /р/5Atŵ=;L=Zз -=C+ce*0tf5jم! +`'V|^@ p!veKReP!t&c"P 6l -d_ls'7 MRkmZXuI$>rHĠ;q)0 'E*bʡfNչ(@VNܝGeW$\;~(:$)"#>,9غJR -@ qhP*Ѱ!%Š#j3-djZ?8t7b"#aI>r -&&7W-hX{iBm~qPVFP%!?i sg%$b"o_koL$7IrHڵ%$wx`|0n%0fy Bta7-0 $oHoۍHz[Hv$u^+~9}X%#C)?5# /؅ݙ+#8M8:P|L{f8mmQm9Y̭twe ፑj yƑ\ }k|R9\'8lC1oYިN:s2sk+gWV.=''J:OjwԻѣ5 ;C$6),i0ĉ$~k◇WiHKup9EۛU r29qP9lF! -U j#~ҫ˟FG -.vG:_ `#0߮{6'\7aUmTd&=v$to B}l ;ZomCۆmohwr5y֘.˿jۆ՘J5P9 ҍClu:KA %SƛvGAD M7y$d]׶6]=4\brϧ.=Ƶ| n85]2*‡­0߉v-Ϊ:|$i`( %6vKpw yi_ۖ^Srߪ%XÜ-~%ݠ08v̆*8؍t.?I&&Hu,W2\g|hDJ?8d`KR~򟤁YV[G׵OۆZ~1V"Kj-UJ$V z`9J4Ζ lӏ6k`[(:T$-ښ4_ysuLG{L5B01&%9=l:dхL?f :m`kW;mӂcMjBZ͂϶aekb7whp&N>S,P ~syj^I9Kߐs"ye'N4&f \&SiSx Q"T=Cu{p^ S4/7xkr4*W -$U|pcˊ_%u9<sRZsuhSWS&͋w4an|O:Y,iT&j,Xsޓx&y'VJK6oS/;,V[5?'{T]Qa~4 )بU'aN p hz$ ;'pr -śԬhl׆iY' *RZ-0{dsK%5+3 -ItԆ8[ͱ``zA(B]DnՁh?=t T)F4@f<@|f~H5#1ILE'u]4+-x*bymjqeKx>!(o<Žr|`«6C[-􎈮-oy -F)1PQ gAqTʍ*#A$GtP<(2ryuHrKhȄB&C)Hێ<9QSGȕhk^ os 42{(}N`fn ':?]R$YHS;@8ѹf.*Dr~>k.ukM#R/]6j0`o (VD@xջΰn6Eho-`t$b ,IERV"K7#<fb¡M0 !WhAr#l;$"\o/dy= -' -%;bȭXbM@۹ zs^xܰ CFUn2]}/}I$<R8%:Lspx}g3*U=|"m纟?ʘ&5`dU;5C3I{&Yר;-rmo{}k p1<z|#셄C93 ҋF`:~64 ~xMs_O|r^)"X^uFUTUY8c_ -u3>B>i:Fg@ܔC7^7HJo&9v!G8"]yH>@oc@o{* j-իT>Nly6 %*M/ļ'@NZ߲hov|J :flz@芟$&j#l7C@Qbg o=zmYFӨf:O^S<p}S\3hB13XEUJT1[-?țry/=*3Q.5Ʊ7!q¿oL։Y/seX$Mt '\ z"p0>@"C)+,~fc /_֛Ԕ U"k8U%cj&&8W8J 4π0O ?2{d&3LEN@E{ZشqA7M%TO9 i~H6qjh1ZƁF\FwRCaWw\Ȗl:Tͯ 덭8/R{޿݊=P,h/`SR6 L6y=t @sWu^R61 -l֏f91LZ'|n $O''XLtn &*o'Vo/׮A.ܻs)slkihWبO~u5_e '8l_qmR`Ҁ+A֤Y w_'5Kj.q>=b|=?GI</3[{r^̘63g|,OXxtq~Qv  <t&껽mmxH ow C3Zț $οy HGmzɹNE2H5z40l`ڍs{:W'MB6Cqֽݸ m+OBMxSy4敠Tpcrpdl4w5E& uhoB){lrΣsN>ЎL##bުofsRl8R_:_ZEsպ=Tνγ DY M7 -3/5,C~7Y0$.x5rث1Gx\=4Y$6qg|շ J~A~M -S*UomUǕyO?pst$_FOcŒk6L$&!n8ʼnW0P-] -5߶r|Ens^鐫yظg=1NTHi5vVa6[+XY5ORy2L$1gs%Y IG!O:VhGؑN1>ijaǚԢu?L,XhX ;Dj; T%]vS,|EJRzã*5\C -މL(f-d!pfUf2vz `  oo'=dsє;:l!XΘ[3gkI?k #mz̐0*4\U~A8Z.]#1Sng@,t:CAn,;5s)M{~9+x@1mT(H~!s=I)"a$w X|q-)60MM]@EO7heZ0[&,H#_ ΘQӯO[PK S] -\'gdngItW - #)nx|}}ñ14Ѧt/kwCک߇Ou8onp -i=eJ>?)Гb1{LB!KӞ7@(U~ 4^賸04@ ]< -Lh\p(>ڀhYQ^Jazqz)񙊲,sqnfde4&=v%H12O0f~"z󈲓 ZHK.W :P^;>0Bѭ2&C!}D~9{s7NK ΐC//vCZvYm1'ZNgVNCNu>Uue; -G 0! 2^-GN؀yCr`d\:hKч")N}FfKdMűf ,dy?0W#qO\OE ^g8?:xBaKb<>sHTR8O'-UYx*q(H,o؈E`C[V8}4@PCn>' oh$ZHH;$X$ $Qk$H $,H( H,ӆ|&\XDX+'A‚,1DaDt/ ^!O_ߏ2}{Yfl ! @(pM z* fIчWYf{*a0o;:}=B<4v4@a3Q P}ZHp -좀rY@?TujW.05rM:DsRthѻuÐڵ~Cm<bs%7Kh_j AMN>`wV "loˀ9z7 `:`7st@x "o(Ʋ0A4*M}hKMPb#8,%_2k܆"{M.Cu@ -oui{v ҩH-Nb+$kحW+U8G>,u 9}I e¬,I\ eޒ;yCTA~ g|zܝ -o3c,dMiE"ڏ<6GxB(CwkI|N Q{;b 0J % -J\:J)w Jث k4p}>0-6x}?|A>=-&GxM̸[iwB5]Ƭ{v]ֹQLKMw.O/wcv-_ QsSx*]9OPCBx:,2ja=NU6=(U9-&׍+m}ZwDo 6RcU -3/wmSB7Ҷ->٣WuFH34_X<6/j"^me -032 6C4l|(V {-Jt uxMqfLiFۆ<Caٻa}po퍌XYF!C!b=yC}v/Z Rarg(_@93kRp7g\aQjJVaxjIFk-s# MU=;|pjpȹw n(Y8HBj(BWo%TS7כx6܏ _G'"w:>6jB/WU%jTpن@k BmQTs6xmʝ\+HAuiy|+, -RX< R1ŶU5SLiKo4:?h2>H$^mS)pS=@zZ3kKQt*iimRpTX}6Z|[bG_XCg1p|.SL}&7elr$y6%RLSupNALI2De#bJ[aPB/يMĪ7VjBt#&kWՄ3 'C#ϻ׆z&± 1d}'2&W&YRwt'*% 곆뤁, VIT; i'!,s*kn֨_:#n@ f@)Mztt,) ,i9e<+JK(׵e9jF6 vWb[3uxDu" ll{-^N;ELȘASL%'wE18Ԅ G EƄDwD ŔI)g G{6޲x)X&c .=愑Q"j_r}]_312ed$*/d -}@2}{Z/)?̓usnƓGQۥaI14iҍ㓫̏1~-{76C:2.$Q}؃Lƺf}K*XVc2z}Qb]k/}f{Bf/syKA2"RUD@q>cŒ^9)+=gWukX5"`o1cxgz6@F 0:z8ƈQv뤣BPwh="Cb4P&>k7Pw bQ% W 2W ks)~7|5&_f~H\WK.'E",xqG'c=be3QЫ QNl26CruXdop~:MCHe V r ;qqj% -3K᳜Pg,aMIMovIAX=ǒ/hA2h8[A4}T.}!RFg"F0(THr0I2@1@q u*}H&B43a)xW.9ÄVba4QFO6)QHqAcG eRS87 7R @-w (ī93@v+@V4@U1d:'XJO̓2mdֹ+~QcjcDI3t?xT|< -v}.'}x;< R1*N~(* P1[hhhxދ#բRaJ<aBڋx /܍}[lV -F:Ж6ãbG$# -׶5.>bEC@!\B;^D `O9/J#FD56S00<飛]8vq|OO1{cKED}Nt.(w]Ј*D)_uf:~ޭ QdP^- ʁ詻s -;!HnxIB4Bz]Y(Jĵv;_>=Ø= -*3d8F~z7xn嚄-3%%``0;AX!`V!ЖQ>vT X{0XX&#-z:3."}d r|P/љẠ9C*F^ =:ɌATDU9&`G8Xi8)#0O,U1́ZXBDeƞXJk.Je(%*$X,xQR*Z:lw%b4'q]Y]@|mxx!GSw؈(n .V U0ՔF}?Q3yUYU nayT̯h" |W(FdFL$RS C4@b@bL@[_@Rg%7|m^@Ӭbavbݨ;qQl,XhqEP|䁩>q_:W0k" wBarnDf2 =ܸ{\ -$31QY:'!8l0<^'`^?iӡ!qs5װB#6 %ZtAR+}PzP41uNjnEd1N$b.ӎ.C$:(dsu-+I L=Ҟ* вB u E̸&}ϚNUVyd MN\ ؊_*Zl_ך75\fV eydsߩǷ82rVrsF*9j]qo7_IS.~+݆|vj ݯ6W A7U2)cd6:kZ1޲oTE|3bѵLN.4{@VY+όӘz* #aȌAA)lTW=kZIm_`'cTZ36&vJrktqD#}^VиYQSt^̼:sҲw?T-zx)^z`ɺ1L*u7=J440OlJCCE5ts.eGXwx5 u2/{9%b:Ͷ]7kn[144d" -[ Crq<:wQVew, $Lq_INHĢdPczNOm;U,fWl!bpP`+N)YvGgV:^l f\j2;*8TkVx~e 4Qa`N;`UQ t>`G 3h*}zp? -Ⱥ0p[̽}Wxj 7֙n9ph]K~~6dL|Ŗېʯw2x\[~1O="=:UW>=>>[rU}\H.a՞w2xb8}?Ѹ̳Aܑez?`~7<ɯR_Sj)ƟYln}Iw]czHz, ( pBwF~7|,yRJ>$~L> -ӻLjNe矻}ÿiЛaQYI&}#o|OyOY+>{*lӨ*u;nn+OcƮf+Cl,Xt936ϩ's>jC,ܭ]oOB{pB\2w-z?3#ZCD;7.v!1O*/y3 -VWq ʽK֗mN[";]^pSdT# ]o7T~@UmÓs/kJ;׷w\i5[2}kש: { M~z}fwCڴvF˳[پZmmsNrhc89-C$%hx:'W /~(5Xٺ -\k0;Uꂔ͋ː{|w.ԧݽݔ\ (n~< |z?Jw 8=VyP'h2ʸN<)̛(Gqz^zЙ>/l P кi?^a1 s`TfID~Hdg{_7<31ONKa>7#Ѳb/q܅3j ^ qNDd('OKN[Enmdw B7(ԱٞV"n-KI愚Wn]OcnZܫ6;9.x{<5LF}JV/߃5"jJSJ~f/]w;e nv9T[tEk}rPIp=?9x``\aw,kw0ހ23cb!tZ/&qq {Cv?EmT$2TiP1kt!L %U<}]gQm|U{ٹnvfQ'wl U?]8+oR_?'+& OM){ۆ YXo~Ia3!pQ!& "?7 -YPvN%O1-}jjSΫ-G]ǯl替}|->Q7I}䇐bٓul){8I{j"_ -4SlA6?겻ÄOEG9y9u{ wֵТrQb Y̢T{TxL1cx=g -.^gc`Hɓܱ}*Tqz>n'wdE4@d9yg<;|M$/ѲifC,.Q;d?JͳzYB爵e ?kQ4Qx\I/OG5H5|d O2\KQ+ߍϑ){GX i d^Q<\fAD0\yR;8v=gGn=)n$]Hz(ld3rV?^[fj%z]~>+Z>S!U@&>uэw8c^XeLσ 2 q ŒOYh^t!POTG `"M=f)IZ:ZL\, yd4kk@%7IRw"厐t6FNOQhu ޒ;O3xY>{v}AXm䮒r~MFRm5 -eu4#tGؽ3tm>˧&S--d\8:}:DֹS-ehK,:(>|do0wD͍ nCi3wTO ^N3:;gEU:]]jͷ,L.cz$OL|OǺc:YtT/|}ԕ|w<ebZ6fOts2+nKTYeVfa )!xa-Ct===@:Sab4Zoqi!CQz hۧoG1Crݔe3mf?#L& - 6}Owo7n7qOmoZy77u7Y.{*E޼UNZrr7+oW\R ٲL1ҋMfp8D'ޏ6c5 iUYg)-զEZl*vUCJWdndv e°i7D~}y.vo͈;8CyXu~2۽KAq- c8YNӮ;}g -gx#E?3~ R{w{?D!0OC?6#y3~3?;~Ť?y?(N^[@u|z0 QY3$Z$:ӻa6?V}y_+.k[*m f)o7zeOGV>7Z[߄@ !|jT Z+Lo}̴X)t'A#j''1}3YN =̵NZ9q.r+4HU,@SӧDzϬ8NIԚ)ۛiHߘ2$ڃÒMf" -$taz<[gSE4L-MWkkhGWԌ}A~~8~of$g}rUuW|!,Y=m]Enҵ/ηbogZƛoG@R]˧UNJ{Qgee=pW *|xL-V[YC?Ų͹5iZu}h@^[ Qpq[^ sN_,>vls- dz)U c%Vd?b>i@G K+!Uzڃ7:FS `֋o]OŖqTiwlyS9͢Y},&*HU_ E鯟ʦ~63~}3>޶s69l}f!n 0T=*b@ϽQ1{ds#+Guk'qΤ g{gmgkUocM66荎R yJvߞrmT|`zwnarpOA(O<;T|1I{k"ή_oubJ%:ChV%vyACڳ|2'͒g]TMK-А>U U^KY6$jXvjv7_{Gίv.k)O kEnwOB4l#-lF_fѨ -W|}jtYypzxxH0kkg%, j)o٫Xmzg{H X\5lZpaB }".ـe$2q4BL=Jn)mLb#B Iw N$-it&h#1=/&{U_ѻ (9\_粘rwR`FeP4)j`On%Cu|2#>ڵdo51o=NFݎ| }O(m[+8wSܶ7[虨6뽣Ѐ>ƒ+_: ʻputm^ȭ&{ >=x5_!Mӳx[cDK5v9XuW m48ANⰃ47\o}hpmz׎j{Cdc3}< B&u+6b HދR ;3c>M>̀MTެE޿r׶p$rUgab_QT^z|c!ûiĒW8=O/S~?{L?s<=z??n~Ia3o~3O#'#|{)VĂa=Mǧ֧mħ. 9хfӸ,ݖyBl1nwxv1hR=题6C⛿(dR |C6>wYkBӃ63SVSQseBؾFS҆~7ζwlWS^j#/K\Kr Hߩz06f'8F'4fk8vz t]^vc/}jg[n;«f,O벥յ8g%XCˇF.偼'~9y?OVeOqMzR0Q¬^I7#V=eUoL~`J9S佬3N8NjZF6_OTIH@^0:-~kk;=lvtnP2~їB#$gJj?:zI?|E^Srg{g^f>|u;Di%aL)*Yʭt^|5S:m}$Ozǘ.UEGɮN&g2gY+觢s{:{WڠT{5ZXϷ/q[H!ʹwyYVk=>_hZ/FSz2~J|PH_}|,׻{eu~Wyo7u>u}.Omi1fj>M`OS'mT b' U:3k)%2}3"bHڭg[o:⭲ A@<Ch~#d Gi I?2 y^sXF^L=f++x}[f4眨 -kQmfQa꒒e_lyjp/3@r칐׺<69VslRL߶"ӝݩB͂в\q`Hp Eԧd͏ ;P 0 -dFx{vV"MaTnFZJ'/OPeHuQ|6~Hǣ/::&oSD#S F03\F{z{ ZcA^gPg , -z#eXɺ9S#f|lw$=wsHn?j5ݗRn~ۃKL"-b BLhUbݹF%9ҙa^Pd ZVk4:t!YpLDʧ3^7o5>nw6bXSM.^؜XɉD]^btL8d=-jZn=cx]S'G~hhy[qB=gvyT<ץ/ƫ[p1I(6-~_m#٠NPd`POqJ 6-*R-kJU*j1?m*{f+zY;0B|t=e/AqaN]l37ZW]$RV<ڰ"7NJ%zƣUVG |H?}%RZbj )[̔6{6:dԦy_-{r"JYmr=.ZeĜKzoy- (aC+R0v)|%'1OvUR0d pJ``XX>38cn_7ҙ3Ϟœ8c*YlY7y"/R_IO -9HUBJRM+d1z_ -L^K"Og⺝h_ǻrLUs- 9pߒξfy,}!>uOv}uZ} \irbϏQ z;f!0b H=c1'~sO  SOȲ J( Xͧ[ !6:y"ΝԾb쵥Uw+3w!Ѡse=l[_]TWy -MJIV'@I#v .Ϋ=rN.M:xq(Kujn(j[Ɛ ua߫H#VUI&~DP&];A -]1s3ٖ AiFKyE,ӹ5B-.KsʾKkf܉/w1d\FTV2e#ajJ Ai~|b@m]ta_<S_K!ٹa GzxEkK뭝}G7j j>e.cE|ޢ: nt{"+^GkrG.ʹZ[ӡ6;E1%M%VyhgJY΀# ߇`grQ6[k b" "J+؀ 5&#ɺo~P..Ng>myFjuji~z,9}BsOm~%닕8:V0.caaoeYi}ٸoN}NjCPFD`$wIBn"Z&V(;T\5nGy[V?55{2riHr'T:nR:XAf@m&^)Jh357T,̎gF :]jsEg†|Wݗ碸XK1n.\f<\ܪ -~zU_ȁ;VGoim&v-xNL\gP1^,Qt1R#o}<Di-vĪIJ|0V_Թa&׬ߒ)Z7 j1m~j,{hA].xZJ%6H @x'+3iT"pH̰qLpZ٠6n7|ޮO7\ E:"|Ϛy!$^{Lh 5P:kjɣ)y !^e'-s#"q5R;ߤV)N#A1ju:tcKiMGK 9c`Fr0m6sxA%ij||a 5H΁]n4r3vv/JWZur2uYR+&]o)qp<{Qݼ(+OD1t /7'٪shdv@kP[ mct}⹜L6m,&'Wm;̎vOȉY[ۈH$ּamj&3[;}v5[˜0|mpvn D3fCݝ`jX.?yXt&3[(M, -)]O3X̯TOD~lߖidf->቟y9("Ig(o S,<2|(sDAv}O;q}koXơҾPaH>2@aj|Pk+Ȫ[,v5cY`XSzP:Ux.` U!IJr( +=%s\ -f=hky+1%v~}܎6,sgQ(]FJhV-Xa{$; ,&(sHNA\-ԉ= Q1-[_c;$sֺx]^]{cDn5$guzu Py <lʝE?/WȡxZTGK`}%*O==[y7.ys8Ŏ+<4HvSKR3R3iVtC5OO3Ou>ӮsKTӠ((x#k]"bPz\|XOWs[gi.՝h΁6Cُc?J#̻x^qZ+r'OJ OZYYy@UT*ژ|`;x>ջXSLv &x gy8&,zeHi:6 ItD:jǑ4#1V@e\ -.蠒=c$|4XK o7B Oߌ`kI5We. 8Ut/V+(Ip'~y>nw`xjT {P)Q_I'%hZ+~Ims Fxvq8#ko3fE\7)jvߓ@YA@5@Ł1C?㿯"TzT8kEK;7j2p.FkR|6fV|,R#mJ{Gՙ8Tt#=K7o\uy:Hӆ|ʶ|_kۍ5:WȿcQ:y^ ' ɖAuX.{.5T.:OUKK5qqrOIV?_V=IFgŪVȚ$H,#.;}ƣ.REpU,Z땆vԞ b]\#GKU9k\ M+oMr+>IFkZU/;=]o:dzјA{bKm׸HOI͹cӈ+qz߾dv[L5;gzh(zfėFTs)@)ԣxTb mT/}5gJ`˾,Ү^2$Sj_>X%y_N>R>ӅE:`̥ʂ2Rs M.&]zPP)*Vv Ԏ< -kc'N%q137ySR}jqMy"?IGs -y)s Rg҅,S:]A9^}4Lܲ5P/ |Ό5[޼Dնu݅zs1ЯTZTpI %$~YX*:e/~f"YY~9\j;5c?6!][ɏn}\17mZm OY4Ocw޳ߥ_Pc*?~f3,q/h馴צ/dWh]|gs }ެ2nY7[ùtW)M8uiMClR@<|xb]"zWiY |H/'Zn`TLckhS H[.vEլ`i%Qi~UԧFMl2bKR"7/ H> 6R+j)x3 ֝{4w'/$OgzzLfW|Y]s)]1[(No:;zcW(4;t|D\.W.^Au[} _+:[Tv3vʛɥ4.J+-r>ͯ;X)}a %eRa:}3f$ Ү0oa/ #ֹ:Gzzm$7sqvF7판aՃ;8‚իTFrcD;L!L*R73n H*ez2-j$w£vK I*-cVt4{{h猜/~e5Mr6k9KrJ>ڟZ'5#*a\2 -iȺ4N><ʲH.L- guw͚֫LM36k۶t_!!zUϹ7Gh^  ,q*Q/j|d/ ~9wP j){!H6oYỴn}flZ -zn OBٻO9E٧hX|2IH1.5VܻdZNO3;;%<&5<&߉88ӯ7}YHvQR `b:a)~K^C=6)]ج9+!/ވ;5dE}aߟhÆ_1vTxã] x>meNTBMnE鲈ۊ[‘Kk`oLLBES^NF5ڵo<&mYaܠN3":Xb>J -f!'oN2rqƣ={]`aѩn5󝇾Do)Yw"e4Bk q.aϸg͹7ʛk߯Aoc2( {{\㜼^v[}X硝3۞YqV`zJkI/1:/!Y=abwPp~ }P/iRAiC)m_Ɍ!-${Վsyb5=hqT+hz.n.r?s)~R3濖q5Lu&'u}pܧ~0Pҷr, ~ -J J `3A#ߒaU2/qWHA˽-|m.o4i;m;ms2 y7_x&VԄ8=rȫ -P@XvjFe1x=!]>*tx\ŲKQ7ջbw% \ Uf xhS?=&jJ͌;aq5#|qe&W׀^k*wd{Yvk/,zDfMdzW!O4QDH])b:O]8*LGN/>h;yW|O=mzv3^Y<$-&WX+)J^V^ c1dgԀ&}?[P߉Y2l&j N:ђzyC$m{o]?ZgՏ5ͩ; `]f,ř0)^z$(c@ - ?@'ߥ~U/&ԏ3P&uvP^= ;ۣ-AS)WwrR=Xj@!/Z >ZJ.#ZNZ$ڏ\s30gznM8xf TF~{#^2n^z~Hq1\nB]=KKo |+\)>ti:f -fG+>\-IN3O"K-?@Sztⱔ_8F r?M">C˦\Naduj;=u]/؛v=X[.͞GrkOu2M (Q,5ϡ2᝛.ڱu5?a[U]Y\r}nt};TRzcef'~`2;fv'OJb?X@m-_hDї"ɖSu#l jtX鏥;[v#_ΊR7z̅%dh jUtTH@bs_/| N#Y~~N+-^ 3cp6Z*[,B~,ؒlV8ygF݌(nɐ{)S");!G~%M?GS}ӌPmo`} s|!tv%]}Ũ~XRHS۱RU3\Ho3ڃ5}ȟ}̈ĥGN~ -P -yRT;!9kxA{v~KCAwĢhY_ϛUviDܯcb7a42i<6݆EԢKv -] W/>/HiS@*KT -j) 6 Q #bpwuaĈ MBVs謍 =G?tzq'Oc*N?pa|X*x,0`~ -ܰ9J^i!q!zHYn=)h#uRK(|S\LY5G`RS2 5dxۧ᧕SL;yk;'6oc Ս-=7;>*@qT 1Mf/f>B< Cנ>JZ䱷gT4aG;$Iȿ)3]So[<7.r<3ul{b -m P/Sr]6PQ`WWA 5?h!9U]㑱>:ubĆ̥RD٠Suem niTb_2ljfis"E)_7Dcx9Bk{Ux.ԈhG``v';m-Gװ/zb(}wm0X9d-3(v 96xPsz'vy6Hh?t[K{&ۍGh 9y&uS&Sgn?i n !WpLxG/A)/xoZSR@% -U9z4LRni;vM\D\7@gRO/@gRWP[ -`Ή5P qDPKX;ș}}6 N h7@q"]Gf|V"pw֯T5ݞ:^dי\Db - -LR=xJMx*࠺č{bh<'Q24հB;{f'GWٮ~},uqk -Xp JVn 3?F|XzgXqk: Q8Ɠ}K gywgwάqi]N-O)^ZVbn,ռ} @j  !RXnX5|rǘ}5YЮe^bf>T2N lٳ|{:ĽuP}@ R#K<&@rid=ދ RxՔ -x)~8=.) ^F~ps7mwwc֮۽|&f_=4(IXלĭ*P4E/٬BFQ9CaČ z:V&lSZ-#V-Eb@n,&_+9j ʧI -~>(+rT}dih'鄈cK$(R&%iNiy1;EG @3}/Ӎ1Ǜl,9$?L ȘxO0J[)*~j5JZ-7rTͶQ˚t0xr/o 6zšAf+5UGA$sO=uO)Q(0 2.dt)6۹í+.z]E~pv͐l[>u,\Ϋ>,ǟK3#;J|rl%nPa+DB[Xmo [>O6nth;Rn;4YguR{ți,Ƌ*Hf`utOuJ꽁j[|jr`sWXx&'}_c[ IWZzxbh'yhF].3g< &F'(ݽJ=j= -0 -MLqj su]Ex]L'&׭Y b_y1ZhfFߠ8')pHVtBaq5W p0xXJR (}=§(>KwG -.|(Wͧ-!3ޜg_؟fRK(KS{!;5{$:&xOT N"&nY ;nϺnۭ 6r Ko͕[vپ*֑BGp4j}2n }^ĭ)RIwPL#PW߫"qi:l|1үdi jF=ܕ~o 5]U<(qUl_(>`64;$ߥ> TF_'?xY d),=sђ9UHƐd^j#Z btS j;K6'GKdʓp,q۴?xϤxI_EUQO޳tk7 3;ޣlk]Io{sfvXJw jdui–|-[h,иomK [VZ;?u,V@e@-/M/_<Wp˗MH'=4UZoT! ls~n [㺮\F>ᚧC|:3~˴j?"IOOONX*["U8aWV=F Yl `A4Y,cGXj+oN=^w㝕^n{e vov (3ϰsZ5pnI$m+Ֆwޟ2JYlNO;iJʈ6ә)a=M8vˋڭf8t֥2dOECuBFD^/p]gi~I*c:6,8Jt\IK=ě/WveuD~\MC>9[a\m-[{zߛn'02W6CG+.\."{\cܑP~nv'tk $YrKT17ót+uQ~oJO%`ך36Djfi-eSGy= ɱڇn;˷mZf+0q zMr=tcFv t#]IԪ+ Vxb0MJe|s;2P]HUVnEMi T^q?ePNP -J<<>IwE yo_g4Ho^࿔K'&(xX=K-6i p,5zS%R}8#␮cBz!(H,{2x+Nttt3NO܃"Mt h&e@xč@ѯ>AѠ3^ [8nb5 @dƠ`C|4>JXf@hd/;6NZ8b3@%Kdm0nn<b:ޏ V;ҹX5h5Dl9<,錓yvqaf–N -!/%(+PL)q?ar.=\%Vؗ^sjS;(X5&/ntjj3oڋUJ1E*>ڹw"IK.WxBA DP>(R -SA#=:Oxfx_MqM; m0nίpC )w"MzqkXb %Aw JJuMy(yG -%Q0/ya^x=aϵ`݊ir -U ښ?D\7heRM-X%M{q-F`Q]_X vMStڲ`Z>$ =Mts8-݂ãW=-K@0Qqğ9'bKϿ$Ė;!Qxm`Gz"^5\9o#i -{ ؜JS p}3KMnb0Jbdv@(x-MnrOsҜx/ {tњiAc^?1$T>MW6 /PmZOwhOfv|5S?"{M*T%)+qVr| :(nf'PTIs.ʽe۪m{wpθr:԰͜y{ɵև;ґzw貽u/x,Nq1_WorpZ{{S :uX;FIi~dҪ<;}k kṳVu֤4_Ϋrl*}ߔj|wz.SGQrl'zОyy=h;Nqz*yTݦ6Yï~ukGM&eF'y]Me?|(Bb># ?]o_GgPb8u˲PʮmW3l5O6<B{dO?gcIR W4&d@"%/HR`X9&+m[7iMA9m@hL@%wevtO)I9v " Rm+356EhU`}1e&?!DaʊV#8~!ȋa$;oRaDn~_gbAu9Pv.קϽ2×/Cرh=-eZEn-(A Oe iݽ"w= 1 Džjʿ@T}R *Z8mo߭{v;C';4O36Lr=;DZm|8zEj9x`W|oX7w5f/0/4SfSbkLέJv|$v v핺툰Dk r -TZF__sPC)Mg2 r*yi1ؗĢ {JTqքy sd?W? >?]ӝh `'{͙:oUL2SΪ7 BQj'˚TWlէ {R LƩ(gYlkt6V6D~<&=P=˳ u(noJ<c8؇5+lYHc^]&f;KqE3de3.VG K£QCM6R[JJ9X{rZkTn^7!KGB2ܒwkfFSjXVGE uYo5 q %H3m =/S![L+@{~T_Ww 2@)lEP/̟QMJ*j6ucHoǫuXٲ1sM%'^jH;%$ϊ8{'<1"{޻Czwӯۨ\A9Rq4㗴Ճ sP+kǼ>'yϊ^3L]}sztں(0ew[ Ws\馻[BJw?r),8 {?D̙0,d măbhoOzʾj;MHq~kyE$\J^0fNƖ -*2s7[4[Կ"#(;"톿`6Rwf}ZA -Ƈof>wRoFARJ!Ġ,}J@M{l04m\ ?Y3@kKi,7fw^>VFsIu~B&wkIW3L~hns. өC4-'譂c/+]NIl}}8?^Ȕ-a\Tis-eQGZ1LrC{݈twg؟>Ɋ+|ZtvG?!F)js7f!N2{f/ưCRͭ3F&͘hU+)j؟>U]c&Kh)dAu⹨[@?hWya†P5hFq]NFqP^ʱˣ[1οwcZ?r״jN)_±'!RqvFWmb%Pͮ99f- -U;ij1ϒbh6Pm-q_5T곡i_^ʫ@oْL{$[G}(HR(0?ZRVsfVx, H]H$v5Mg/4$֭f[wJȓoJC̋b!^i.6?:BtfƔ8u)Y@RFns3x*@;YZW^'KgS7 -ɊX?X9L#~cQ*@ Qn[h]Vc\^+ҢmEd}w7u\.JYWzDj4( C -suW޴ka?G+ñ#Fy(:KPosM, -EaR?4 - } V_ :\DtA \ypD[AŞS6;Ì.bh!ϣϪS0}ʼ}^L?eslU Bb^U@\ T *Q|.j0s` `%0P2J{؏yoxV#fy& U, P?`;WPNB2j2i?F!~1%@8u,)zxoex@b XzDQj}'lCI/v~*w$n1j\ H%t@}ؿo Y@օ* ±2cׅ)'{?\.Mi"*sQ';hn6v %9υVix*bꖕU4}!f)8@Sl# '].n -<+X7s0T3µ(mT!Oc=ί޳av]wH<2&EơSdǶ5ui-2}|fi Rau+МM- z@5㭥u,2 XW=FWqZN3Zb_~{wgo1Q|:T,n>PXoI[#sg@ Vy HJr0_32 -{ʋcsÜ3:zpkcOt+#׽skIYۚ6E3U۴w/зy{l2JC$0ry#ojhޑ0mV5aԏkvnҼMs$OWğF1{0]V\?}pR+r.e٦la5ԇ'0{znU5.V^|̨(TS\ ؖ: (Z-&X.h<-aDwi0qy_V0k-*h,X}0g1*v*͏ψv,Emx4fQ?7Pۀ*1dL"92/$jTN r?G'}#n-`.sk(-CšϠouVH vϧ?&סOg2y3 1&u[@! O7{~O\gT[*k93ZoӃQMrNor#rEPtF1'h7'?P9l-%J#ASWDuY\S7tż tUCrМTxwJ;=ӆn`}6rf,(#1诀\4bF84ȹ;h7Fۑ /??%^F{-rV[eOadT͚%WW0d8| dN4fr@j0N?|>A>{ ]_'wD䠼O[+4[QiZ:5xѩ+V1ZhG*0a\=]eiGB}1lݜ7_U-[5GM~66cRk -wV:8)oc7;zM.=w5O>$%+ǏwT9˳H'^.*gׄ/Ej5.&jNJ=k,}v -ͷU?^ܦ\jj -[j -GBtCPV h]7o\s^si2kt@sѱzöv&n@Y\ tkMhɪ,2倚i' -r_ԕڏ?ԲND9iCeQpDqxsǵeޯ^CY;n]2q]2i.^]FN=;mط ]%"5jLF,nlS"ޅ:}5l).U+:XR o}ϝ+RI: @ _Kʔ_2>78u_t~@J;V[?61ue``0(o=?O3-2@YlP{fOW"@ޛ@ ԅ}PWeZBR(u/k6 8ĺ0-l<8¼) uP:d `4r94OE}׈;#=1{V LW,C -sdL{+*qNGWP=޳}֍T`_UXH -nއyd# -=&@{ XrDWPV Վ!ZQ.wg1^ - Ū=`(:>|(z͒7j-Yzn_e?eAZ!1<+,sJ5U/PuQL%+ y/~> g-]02 7t=ϛMxzU^a}qu42o _Ѕ8$t­,-⒝C OX^;oeP^gg:&Ҟ.Oѱy4Qn5֭(WHCIxTC@ef˷^cW*cNӿ -Jg),*T."Ｋ^[O$xC;ŝU͇NW4C|V 9:wGSiw7@WGzk*b<0ڀp&aJ?X@ yt}MY%|ܣ \w ]]<\8*}TT% YߋZwyDeQ<:Qd->%~FŁݼfM֩!UY˩mnNz*}OXx{9wG1w}N9—>>8 -Ѝ6&~@_dC1 gPt;~6{kGWjrϜ<̶ϰ^ƅs+g<__wms߬xmo\Qjzod\^zXW,k*?]wAw 0Kz5qE4"]dvmpl VdyIpZGz.(]0C;hQSKlLEj3tؖ,VPyLTS|Ìdi@?c]3 ,mPym/97q 0.{֙n^a6.QǨY~/G˸PH1ghn<}5mBܼt# P_ @'j4`V>jxɻGwo\Q{:Ƥ[$v\L/v\X jD rDϴY78]fΐ`f"ۤgML%@4l -IrmvP'tz&I2cgw.[z^M:z5$GwHA,DiўJ vrhzƴDLc>S|#(+ G{ޕzTt ibht򶫬qڠyN1Z0qzޚЙkLJDjAGIyMc?! -af haL@J*ʿjS7l#,Si/}46w[_ eYLF9DLUF E\ܤRVG묥`9TZz[0D䰬A/Dw)u왰(: dqXѯl@M_]h۵[ny]bi^+P>_ >jyfF{FkG%nHuIj9̳Cdm =߫7>2AX&VnJolT-W8tyo`gJvzN2l:>DkQN&W"?Ra[Zـ>oghw ue/Rr:5֌NgLZzi)(8tsJ3Q,r6M -ui@Nw:'ӱo/d~7꼵|6d8Zlm]9pjl`N[3IQU~[R0E'cAU ׏:ݨinet[Uk+6LmyI*+I}t؉uNJf#wS6k9dnr9_[Xf۩<^O[R*X'ڊv,g곭T(JhݜIk~owP3Yq_{EvfU%R_fZ^YIb&S0 宻(Ϲ0s4 V6XMc}z}``{ 8‚ >wHi]ky:|tshXOZGInp]ϕ6CS,O;q>+5-|=Xų/2TCjnrG/z/;M4 -_qGfYZ۬^Vi/,+LnYh{_cGN'E ]["GR'mF%f|\N5PAsamH aJL) Z3Nn+qu51i9"`4Dw:ctGIP8| 'hlM6ͻN{({~ vt(lUG@-T[+! Է٩:w9rƎw:m+JOGGWV12&bBEARmIݮU?yI%=TaNh3w)ǣeb -'.F5S{P!u:|*TI벞o$Z0/7-g#E!:}_kc5n^+9^ekZ'rWڌ[I(Egb 4($xU_r)T5:Y06 ӷag+ |Zr"ur^ՕÖ NwN< T̥/uv+y1kAɝ6 ]]\p *X&?̏2Gy!/;$N}֨|jUPX HPeS^9ޕgFEg|?+O*77΁6-qzSdRȓ:l|:}'i ~mKL4[4'lٟv)HX{`Ȣ?S{RbM̔fqA2“ '{;Fz1$梾wV/tM#(9 Լ \H-=;@^ȼlB^A(@tdAˑJd6̶[Jd4IA%}djlcO_`q{qJMP#q/@@FSE_4D T8c&@OBbIYy{D٫VY΋"Q(oPhuHBo - f>2ӈW |x.Ҕp>Gbܳ{K9 kхf+?HFiPj*CEݻ0h@`Uq -J(M4anO9@n`EYoCƸ~j{|ntm4U\폻w>;,@>r`Ɩ+\8Qj%ʓ@+Uh6wya+0ltdz*ujߗݾ - \(}yIju ~PxvZb`\ƞtbQo0遲xs52 (*U*䳚oUׂIz{һe' @{+ Ph2?+}~׹_~Gܬ/z7af=Tﾼn/g] -wQ{y{an~@V`v&q?tCb;1 2 DT糜>^8w3vO5-nb< =1BBZe.EĦf-Kr?.)Q߻k+vՇG"7>ɶ@ -: ;=^H {Kb9[sx8Ư+|z5}k>lyJQJ}jCwj5P%纸z 0n`Ou&8 -4Ix_m! E2ZA=RmsfҚ=M;7rlZ~݋ p+X+WU碫NL&CS-jàQ& -.P7 (r]`+*[/,?>\747\7j5^v}6k@F^h< RyqudyE,`B0%c<翐g6lR"9J9_@w4]85±XLJrYo2m*bu]N1|Y Pbb3-ϙci0箧9ϛ%7W$BZp PDh!$vzBn΅x5uL~af}JrZ ߌ)㖝տ)gieUôi^^HO:RMc@VkkX73GJawwr Qܕsv B}_&@+Jlit4S09V3>RPOΩyZaWǣPϙLF;Z>_=9'v6Pjfn=T%Rɛc~G 4u%R~V4>yz"gjG}㵚8&9T7j41_yY<lYWUXA6,x|8 \cRO >ȝr~W9[K^c םsZ:`i9vq=E17(0j<‡hqhPx %ujGe,% V`wR:׸`r G1{8peVݸ  |[LeYʙTn-Ce8Ƚ/~@fScWyWc=DWN]$` -(5zm=<|ݶmyM~9uPw6D] rRu{<=%Zn9z d4yZ_<ӣ8?IuИ (`_^4jv/~.[  -o=TRO{=;v02H./WCG92k7NYL4lEOO1W`R %CH\C?l!lKQ ύH >X;6?(ڱ]mӚvjO+fIè՛^;T]QϢ./6[dz^wElMJc?A?aʩyoWu:vly)uڃ1 9԰ǯmi -0:bݟӊ䴂bjU=4υ*cK,.ϚKsL;ʵ7i7=vzϣG$ǟ^Ů(5HB/r4Y[mleXwo^+:;y$ -GAwVqb<,nJ9{'(4$S~L׶R;cܚ)=şxqe6q55KA)#s%鱣>`GM*c.*oq#QYj' ѭR4<-${% Á.Ժgv7/}c7 N𧭆xJu6UkǪfύ-W*OjJ̨Í::W a?[*:uBgWvI |41CƏ[{P]D3O]oa~w^idGi3?hX<Ô3/b ՠ(8h -w晤wIMZ@l]F=y& ([fYSYz=_ce =9Wui2, [ K,>/ A@liwd5d2 1 d(K$x$Hll>>@)(Ui;xm` { AVA@G?Ow> [RiSkA,d1!2l -b KFk'V Ծwa~Ȇ2aO5 Ⱦg < U`&mHE zw2IFv ;$b,5D-}ě\_s:E -u~xō&qwCidD V@ٿ̂l|a@P,^ܼ%d5_Nؙn܋Rt4^eQ1v_~䖕&nhw qJte*5y> @@Y)Dqi 8v9`_t&Ni$GmޣGޗH /s-KA<֩Bt`n` =&{{1̯Koq^ܮ.r4^ԨhI<-fuX3mvL 9X+hGS Y>pjW .̚:ޗ(oqTrCY9pʣpo5Q~KP - is`{NhXP1c4T\0F@%8pp63Tu!/ӨBȫkR36:y뼢$W yn-t9qJpy>K g%sh?M{*}<,Թ`~vtG*G -endstream endobj 304 0 obj <>stream -& -EcHV{]YoGͫvH\OھcD|7w^kCJI/O=M(sՔ׃hhX{`Yu% L*PV|57`z.~`.oCUc Ay{eΊm,V)i`"=$_(v&  >yxQ9dB;>)/=ꪭK95'^'ͪlR.vۥmkO!S4\"ӢۢsWX )Ʊo/cN}6:H{y=y's帚^sbZdzS-6vZE-?'aƲPGHs@qg7-Эxa氇}wD޴"5ˋlO6n\{Aj8/ uJ --C=$ܾc.#vآ)O-[J| ؖ2 oq=w2{ؙ$]G^2]l?珷UdisQ_'㴹 -3V1jLLnZk],\JAqʻnhMRo1ԾiTR0z vB N;Pj0*:>.VZCݏ15v5+l?0ڹ&B뭩;D@>I-ѻ=%[|à~XqwirݥY߱{9up5Z3U]g޳z<p=Zjyo:ٔ/˧9sLNȹ0JE y_nL/5SWz,%̺W^u6w2;)>:E1Y$关׍/wce { -]uxFݍf}3tK֕ h \SQr25甂>yΪJ눋4вRvCQ8-u6?dݳ_y{Qn;Yt viWyvJr  :Vg9XZAL -R85ش:[C r9جM]E+3;x7g%ǫ۪~+@vwXA0}g{E-nߐi`_3y | fA]ZPkpCƲn(=w -5YfY3{) co΅^ =6أ v b6(5jSYN{Oz)[ rVRl/&fRr`j4xK-~DF]M(pߴ4;r.l"}`0YxoAѡK^$UaԖZ e=U2ժ&6+i5ƳfhW`xp4SK:Fn Ԧ (/ 5,/=l5]Kv`Hо֧AH1\{jԪ۫W1Z}:Sʨ9UaCB6}.S:huBo98wgm2tN!&J=6 [֘,v([32.A+e\(6\1y[ -%t!)RFM-/lv5{iŇt,Q鵗$3F49c -]2jl\{ -eK6\K-*r1/$o(C˅%̱,or->۪2J[S _PQ.z) N$G+Q#g{|Qv[߱C95.& X|˧lMvHiTb>jf -o!GUQQ%ntV<S9w3%x)ĨUHeݝb".NvGreԀn[UeY?T>aVnFiڭ /%f7l0eΝ+O⸮Dkd>InbYDtKh5gDÚbp_ 3-A'?Hf\pO$8|K  <\: O9>?|Ҏ 9vREfur$;lr]OqޟGD'rΉ:ي+ rdQtB2@ tH0P sJ`OR*mNeH)x sR$-zuDy*ML'Kt*!@YXLqsC#2JR]䯫ԍ.E5L@V$5?^y]~tO$NVs\@GzT#^[M\'J]- !B*{ -Ӥ}QJ^~QK١۩ -}?nxhh_v>VIA0Ƕ#G`p38mt}[a|̂ .4>4ic2{-ѻPta9^~\b4mvp;wm o'܄z/$*}xHGǫt d<(@08 -.ǣ,{_*(p|/޳ỏ`=ƏOA퍝;-d}dEY_Dezrou ?^+5nCT(~8896ݒ݃K*!)*Y/]"xt{$B\A^F{r7]7WyHцSd儴㧃38T/֛D(l_fEqby1\{&RbI?2x<8Gv/x) ->*eM]>JGn m{[mc*ij«hrv0Ycd(bmm2mrlOo2EMEpyxkо>%^k|9V9p0Uxc7latWDMm&GboCo,v6F(!F[:A%?FU5#='_k-S^̧hVmԫn&ȞiaKRg?r#ѮA̛/Zwj պYfsZ*?XmW?H;|ohzmG8:Bxw>M3ڡ`{ 9zo9duj}x˭yOǞK Ddӟ-0A.Y_el9/$K4[I٤%>y<1[ ;L?eA˷oI=ukd=y*rzM.a7]`:'S.LKѬ K[f.fgQƛJ~b' 2E`P>QU6@p-<=^* -w׾,:uuʨzO_Zymlj.b=W(9QGr} 49մ(T$q?u<`te%jY:,t*8ϫ>k֝} V-8ϴ*7@FdhU9:mloswã#~oE&k5a/$u)dKB]./3kFݵΧfづt|cZn׶q{=h̓8bkgSbVVU#e ~""v߿gaDaTrc:6QRE\;ZO#S~H]ZڷQ91Wu*C%C%Ci1q[uxVr`lVԥ*`8YϾF-ND e0&,dq=&3H4,:䤑] zd -qaW{$KQUьK-YMVoQ⮭jZ}coq/r)Y>*tI3F(qOi2Q!Ge<ԲG%~Tҕm] u15_H>2LǗ72S2oEn~ϱu#Z.1ng/spLڰ -HIygʣlYjj7oo9߼]ϨtZ9b&ѵ|@Wi Կ'?HxW{} .QݠV1朲^!w]mn+Lܬ^سy3v^,\{8p n.o8.ޭ#<_HR=:oj8˟dJۺC+F~X"a1W7I;ąP`x7F~29wѱrʢ=43 Yp";i4r;^V%rS  _T4NgGkW^)+?2 4BۧtìڰK1 [;uz :{MTgLMun NʢVF:U<rE+Ǘ*kcȜ_jrHFj7/wm?7q[#s)5!1[dAi ~,zufHSjz$st٫<6V9.(Ru`;~yK r4hߵӴ} l7 ih?[HN_.]3ڼ<;܌ͳ^b;&j;U/zWjn?n-yo^r;w'f# ަdz2v6t:up cRYťѕ->j59\7J<++:*zNp{J*R[XY $*w_{'rcmڇkLre4V!U+QsԞngQή6[ekqygD7(%HORĩV헚#k.J\VFaH2;n xICDb:wEeKGJݕS)\6:+nN9mlmetNZ&MB'F 5Wbп<^4.=qrBf;lTMTfV/[)*;O/GSU]B''|oo[ 1_qqh\;X469@ ˣ€A3 FtqF;wMuyߖ+0nUQ3%OrW-_g!pfm첯;w/2bHuӰk8 H_6 UVV {/sv+@* -@}=tk8^a̹(] :Ns m|YJp\hZs @  P.I E - h!M柯,"9d: H+7HVXB>p)0O0 d`K0t}}^og:x l`\ JF{QFS _&'폃2F\"rt4 Vx JZIk x]&)Zxdpe;m]ۯ=ؽ*L{3(7ҥ' sC"u%R_rE?Tc2?H%%ǸOn-s[e\}"z(o«OC@7)^_`.Vt{{>m;g i'?H2H5y"ζQt 5 zC+{3vᵙY7u&@DLtvQǟ2 Mx!ϲ Zj7tٓqN -a:;ϥc3_кkdUvx7'k+/ey3Նb_J4Ѳgy!3)MGc,h!5{qꎉ ΙHوA$͏3eݔq8Unt4+CAp_+gRfǑ;2YW:ԲtL0^NVzDΰJE*%]w! ~ eNRhN.]n$=8SNc;`F^AhdKNR4U.KOyVgi=ؓfI0Ƕ㇂hߑTg´2g -]YWoR|ڃX gcL nC>>,-6 whslE01fKsI3<_jHb/MKUȝǃy~}9][P -=9ݷ @|A=p`ܼo|_F7sz^R]d_޽ -):b;E#aEPzq& -w\Ca>!\p7+կ|kHzHvsNnvN=|ʶ.˘m4v*7lY䙯/ -rpC2A3rL "| BN _#FozDɂkܺT/\1Y Yd3UN/<o&'7[{]zZ0.+^?4Zi ߩb+j٦7q; -t{x='koUj/d?e+:LL=27 uS;"/rgJvus>|ҠvX~=B?J!rnZʵdqE:GP^lKa;)}5'׏ѡ>Dh#vZ Ͱksp~F wbL=h/ >Zp}/oUȸdoX+\s"s7l6?um%1xտu!skf]R[Vڭk7rܬ]?<ӊzo%Тq];[AU{sS`ulVֽl1N)]q\;:-9Ӫ&Ȉ\B%2CZ#[ZuֿDjbg mT{M]79>Jh0?H]psڽ{JU'v'̤Ǧo2.(K%VMMxl~C7NR{tBM'3VTjW_{T(yir -e8猗"Y- Գa/nُ((3ͧg{auԟq} Iicʮ_.[ꀮmVx?P:'rXRJv-++0*f|A^Ҧ@yj;u(Z|j3A/osw%^sd|M:I4JlWѐmDPJ~(VX el7ȖțP*+zaҝPu_,M.D^Q6 Yn3^g1f1N$߉L.xS` >3)uUqބ/+>UV:QoSs1= -r~+ "9MfV7,o hrH6$@&CsZ-vhɏޮnʮśN{)ɓA ƅX,y}޿S:Z ?Uŋ\Bg `{˞KܸQi j%96Gvh _yCr΍{woVDu/ݎ-6WqyI.~T\vgOţAFh6c>k6I>чL}O6ע|:Я6`pzZG|qIr}+|̖UpN6M ٥Ӄ|YO,Tdqtj禙k%(Z/`Kk@[GT?}jᅟ9nkqVqn.Q_~p \^5\vtkBܽr;ߌi6ۺaVv;~r$7DC?! -X᫑]$uT\(Gm<w ]IX{Z3.vϙQp)ua cw<~tl|]3x-m;x81*F]xuErxm|cZtPbK/Lp hyֻFd!=Y9vD>,Xs}YBY]`TĵZ7,9xyUp39N31ҧx^Unzugԛ-~!Fd"5~._z<ݯ%.ro=T 5N ; +T}mjCvrM46&6.tr'%#>i`bRW vWJM^?K2^g} Qٺ=̻4mn7ߒNu}9*+͇LRq:}6:4(LV'"*mmAE89"\`EѨ6 G_H -h⚿ExH=u?d`sپ/{~=.xm:[My*7i#Xo`xQclueA\JM/{t_aS1^ǼTBRFȻ |켼V~tsFPL=~;xnٔ?Fh.+:fle*`9h}#h/pC8<!SF̀ND{0,Ȍ%?̏=5?ι)RG׿'`kcu.Z^Tյ쌜annK.TV+,rCάCy҄]-UDRR1'W.L*6V/^Oڧ@ɥ ssnY+[wǩAoM9X wt?~X$+\' ;;G7ߎR~T{ys̛״j-?qP f3TC+t]AGe8&UI|x:W ײYo͎-Jn"A7k3?w&:l~y'c2 UߖWݹ™~09LwEq򣉊 -JśhjK@5!*:fBn&^GJBwimJ%DCZYvUPD=V@0΋f#)_HMR/{?[M3My*ퟳ8l,nnx!1"Cx8׻Ҡ=)'9jG2-;C9d&6Bw~{7%LA™m4zvfspRa9xU{N D+ 'ߝPzdGKmy9cfFT縂¡|{%%sߩھL9~51(F9^I Sm61zer"j!ƍZ},4K1\sZԙRݹe Pa\P _֋y2dD /[5ݢ^3:-*<維^n:uo֥lMãvwOHF=rU&*ІPnUiwr%ʾ{-6nqOE2EGͤcςP`oY|[76Cw9^d\+<γbJxv]puiUm+>>(w]>Ʀdu -~QVb~ A -iʔ,o Tn{<ҬiGˑIGm8hho4b ! eTOаɊi9  -زR஧EjV| J.~Wxl\[n?If狻HbX.Va%NdoFR nRY*,t|kŸeMz=SbЫ_Ad%ͤȍrEAL ~>"U]ݖq -ڥcۭP`h5:`줞j՛dkj5D) '8PR7o;z 2tZBk|}I_z*3VU"#BfeH|("wbƠmHp&HWMUtpizmӨJ&79ciO#@ y~1M._!;iGؽ-'8$5?ժ 6TGNN4LĚ2 iЬpwC@f.&x6T: RtM㮪/bcD;˛뚵 -O%Qnf.nǻۭ$NY 9A"dƧF -,J@ w`;!.qo$@ -joaBvCIn-,Po5AWR7}4E4oO)=՞@ɬ + q0@K!-x)@&{.d~f6ē&@m𢡊h`ѽ;|i>_k.Lo1}c_vzR<ȸpX2%R#,J;L Al3[/Eluh -fopqo2wB/gUZVxKؚ!]a\;Q?#KQ*27-o39k~?$Z>sn?nf<~8~SUreL]]INA}OP3(SJRݱ?tb۰.sGvYzv3m\D -Z%:H$!ZYoÊ?D9y-|ؾVmddsmfIv[dϹ=A ÛwyREQi{#u:)>!U;QYMw_0-C8ӯid?udl|&W۩poFd|dfwwB&dz[hW'B9 S@SoBRlLא@GWGh޻Ohw(8qr"=X!ښQpW]Z$`DsYEX%IEY\R t_h8<\7>Td?K>/z"n괾Ps0zO`}Y۲mj߈JKP9Dv=b,wQ9hVh[o.]l&(^Wu6^@>s>O/w_N3܀poT̽p^6ԷYXڽVTk9rqWI,F5_];\jx=8 -\ao;Nzϝ:f+tGW_$%KPNG ]n n U+ix - -X6pv|LVgo`"gp;[mlmٺvY%ߛUGssC;ͯ[\EWk?٩lo\.R#ؖZs -pfka.^,[k5!qmM8W&0򗒯EdsE3ŶQz'ΘV(r]ڈk|1φQXyOb0a< K?UEqGW噁{y(Uu]aW.yI!x3Y1Z`̼4B;̳`PoܧE=`H';0bĭaN@'3 #CYw\MzI^oa_}Gؖ-pkQVIA GTױ2Ç.*#zx(H5` <|[RıjP^i!wel?v{ׅc m#f8ʵWْGG]եHY_鱘Y0KeOOӹΊm@GqH7ڏ*^mgFf EUs<Γ'HvٺZ1ǁkAz_Ad_ k}cpQZKk'Sl:1-dS{VHExej%X 5.08cۛC!s9kD*%qFtQ(jnl):+ߖHsV5my:NĦ|c4)m!y%y !~deYV#(mc`i8G̜TRv=h:At=߸`'gP*Kvsbp}3R&$=XSņΥMY-HKjyd -h}AW:^wxæ1!}wzѸd{Ì*7[UoK  &{U%ޭ. -"`.'LDSFkb'o3 " p/E - oQyFvq?,W=uݷ/ϻH;mq%vAP]]{?mv /[6"Wsil}-m<KI< $>aDe={/5gMcPձmMKjSajy}mm4=l_h᩟Fh]q' #jȌAjW&[ڮLn=:V7ecXc+E=ߛx._^퉔tjzkT2PT_6J_6|P?Y}=xpw(Dv0ޠԻfB'K?5unVfh(Ϋ~*YˎT,y^W.]4uY-V[8*_QKi֛9ދE}_YICj~ -մ[R!.\޻]tZT[|\_ azWVѕWGNM -9{bx^hiH2gȷ兩]3Qu_U#|{i3k腋bo˟w$v?,.HN@sڜ} Q:`Ê2;$-;M?Űd @ -Hs/]pIm\@^Ȏm||:V} -JSR藿-qHn40%FP{YЂrKRNT40 - I)j__׽jn?v -0Oq}Ԍ}<Vc8`V 6HRBYKytdTS&XUB ٤8yo^]J{e4H{Ɵյ]x#qqrR]#H]9шcC)+"% O<}8OlvMڻ}9Z @i73Ln>w2ܼ3*(rr]K7JA*xDRNTAb'.Jykg}Ӭ>|Py>ʣuO\&-'] YM{_=n3&_0=2r 1MmV)u585Ԃ1;q7w%.k^U ?Da=F& 5^KW=7(0q K"')=KIn&C`mO?rf\hw x~cF> yܹl~5-w^z%$m3,|A@c1r6{W/j|û}`zF%d^E0it"y&}A㦞䃠:#hS7܇/z~tN||l# NwH=~eE}N Džퟷo៻GikäLJag _5,H PIaeY'B5=;NOǃ.{ i轊=.$Tt'5<z"SgNOZ=nƖe$E Vkb :2" _Z'r0i@]י=q=u]UvxzS5Wv`GZ4na=> њuSus$M%b!{5~#ZϿL;4>V߱]ܾf~J'`#ݱ7_}ݼ%_MuZedǩK]c@qUjq=[oT ^B\w6h,gsOi=hL8ًWԳ}t:]1v.љg7ds7J =uBs?]GHξV6MOMܒ#kYԨ˲h/ҞN~{sz'۷8GHyPRvoou{|1Kg{L/*Z1m>FFg(q1&glZ{H̨q^X`.DFlIlq,9[x%+aK;X0M}Ӓ;7W.Ft35q{zUdNol4Iw&ɲމ)Lt\*9 5~:eĴ| flTf)rrAPAg)nA⬽С/fgx]w=fkCy=F?Bɺ'"*Wi{%ss芽1ʮ}a^oGܸt?LOɡ AI22u;Q|e -$81;*?w`_d )s .𪲥#,%3MbPk.t7|q^{;A3d|~RwL $6ʽӮ7lgKP2ڠj $UM &) w2e?_Unf+)Q?W6ٕlCd84ؗqYЮs{7o ̼\)}nO }cJc.+udGX 5^4P4+cmOu8lRIqEyfByt(a=I3pwt?۔ᐾv>KT{|WX"ҡN@Gw F mnzk{(?h{@j͚TŵYCp̭Z#uH[6ꕚHt"\[u5}ՄլWa -7g[F4.=>> vobR8Q]4X2*HGu^ҧچok_-2f#1ǰGf:[]Xanfݩ\I;suv3 MȰ(ѷ[kCgGnۑZ'c -wr -6tP ( -4^wzZ?&>fлie=1G s:z\ ˀJ1}).VyJsj>=j E7RزZfv7V _ o&$"|?b% D-0]|v7++=1A1Lw9t7"7WU$Zri2,:E2ѿtЃ-08W%0ڤygvdȲ1|&%Q ~,h͈+N78>Ͱppjnk%08kOR<_\'-1S]R -S^mdZ]p(ɶUX5?@x/{aK{-1]b^_\c[׫Q4P'X͑a1T%ʰ9Fgwė^Nj\[ 4A%o%vP ^*}E^k -a]^#XiE" {-#p\1cO!<LѨ94{{|8ͣ`,;X.I۠ Bysjpa)1!._Wʧ7\$HPR4YoC* ;fxxN8N*՞M?FTkaca?sP<ʧ{ԯMtGfRs6!6[Ŕ -{bN:nd  @7KMmgxCqXK7lx9Y=tͦK >,6O(!F7MJm?>\ﯴ- ^t*SBVҟA'7=6{ѱk}Q";<'NhË1J')(MZ}}n9)9ewOyqL5)X5E&ijmq)H*Rvה+BV~f.9Fq,ȔFz/^_v} -zQ]*}P7CNȉ?->O+IXƉ#q"8YVf?|qµ^)7E-8˒}[݋^eY3kiw`t7ߑ8N$y @*o5"3k#ӎV){51L?akԟob^O0PU0T:tE}6a^n8Oe8{_U'Ϩu\FREN0~ -ad΃vw|AnKapTa|nLJ j :jMox7w=KMܛkG^]=OKћǃ`Il$18Z`^zElb6[0!au*T~KHo>QL>L[eȜ`1<7Z6"Ȋ=JXH5C[ںkըeWㅾvNExb}潻 Js=Mmv=Mۖ}OY;ir,suYOY{Y/Y-I?vh_K×qL -­Jv Uo~g$~6ZBGI,bڞ0'lLw#^7[ .4SjJQ ?Ym]9sEsQZiV C'8`U ѹDzcaW>϶6hUStJӥ.Z8_Έb@sr6&?YW}wiY:lm-3|pї;OI{L#D*P$H|sAF8Etkn[Fxɶʆ4MhP H<@n;u|yz.yd5ƴț@]69 ƾY877 -'U$N@⎀폘ʭCa"5]یg]jɻ5H8Wwo>粱l~<6<̹UVٺ옖>P7"ZN7:[ #伍+0FX+'1Csh$d5P-PhoS:ܪJ'tGqmQ[3䲁<'Sp1I7㶴nK>nsKBN Ẃ>V؄"zuu zX,{-L1#de@ پYŞ `v\&жXИ_*g`RЄm )ETjz$t;&bv]{c%)MA9+Bs/ mV*{8Hp) 9l -G3 aRTm:nR%yOȸˈ8ŘVxFW"PSp+[݉.Zz4g,-x|?ceFmg 5:;VҖ!/?d)lBpƍVQ3.zoъlRN<i}01>_V>"w'M1<_M+kLujJ@^wb:ڮ!.D,h0# T쁓ɀ@cD.\~pT\L/7J&VcF-3|oy|IB1F 7Ggd$Gkv,xXPBfM9g9 =Րi=cJ f}gpYV.)_j;Jj϶cAi2̓:wO:z~$YY )< -X+(} +_FԨ"XVo^yWs8o߶|_??x[j+@,Ud#ŐǏyJY-Fhj<`kk҆>E&Ab$hz576hu Q_i< ]} χ.8^;́;b6?v]C3jv$)T/)&^oQ,bCsIq| O8C{ؠ+p67(.}W}Da'7dI4Aژ6qo>Ϭ;D|RR=]ir?oqz Uv-t1UV̥.xm: u-0x\6[4 =R8+1f/ZX_`o{>?| ?s!Ra,t)QBMT:R%jCiKh[=}kn &̲6,/PUʥ -2P^esw -Ͳ?o?WyVx_6'|Rk.by4sNa?} \ݷ6lgw.=){Ѯ;[rsu%>͗[Yi(mN?{$ϵ03|c*Xו$^ !_kLYj$Ǔvts~u.U}SŭUrY+'}Av9YrClT;7@"@ZRh>r}Nft^.cPI/7,[ -- fdKBD'a5gt wsam5=;/Vvn ,`<'^˳06`|H~Y\.Z/;̝8U`m`robzԄ{ceT:x4.w3n|Cy׎y$BieSߣ> Eԛ 2 Xw]ВhiR -kK3xh w' ǷBW%mq/mX030cұKO.2_}QgĤdį -yD(7U:euțg{hjn/[I169qÕgDH )ɪGA1+p}gtKY fNW0OBmEV^4hc -'tQCnuR{b|]SK@ -Rl7ew&ꋼ:$'nPUOY>6"&ROqf1o4Tt0Cq=Jȍu9_x-.y=**RH=.އ{ {8֌yii|k-])~G88A8=QyPUnZ=>xٽDua|ObZWYˆ4B#OB@(cnPpE܋HRsRNC r]8+zEGn ̤Wr^[/񲉕申lsQ~Kܢ𺹁Ⱥ -Csh{FI@b!t} # A-=m 뽧#TO駏dd'}fM"x^$ - 6{hb. 8 *q|TE~9Y=-<8DAݵDM;iQ{M,Nj#Q\|&2RR:$W$ӭ }${n !_gPtjӋ =qwP[}}y}B?(&$IrU^V-ͱX0i^#MM -.'9CQgo~MO澒R?yVbch他Y]ϫ_حv`O`k"mN!60&R -{{>TzzuuHwOz=$`8 h{3 jnw[GK^f]Oh`F=N˱;HFmhtpuP{) <AQ}W aeLHrq_>vk!/%Qۋټ!>mՁ} u -vT,^BU˦okyvVTGWw9/1\%&DOP-Z]xcsMٹ}b.~񬂘9Pݑ;*%=GuFrXp=\7pt 0\m0(f[Hob* FEt 4y7sD<a0[{?E72{/#\ /x/7r(‰Mj4))INv0G&pz8"ݴn6eRsMgvަePcJҥuB CI?%ZcgcErFJ9}2۞EP:/Ң9m3?!YQ~&֛HQsZ*@_2zY5[q|f5HE>ΈskYPq8oI+nQ7Np`>pUo%9VkxXk! 9΀7C/N~%[S[gyh/~&F_2z1W?9>=$&-uJwi9":gcĝ줺'q(ȼ01z;6>r@Z%c @ZL)P`u-pδ; L߆_2Z쇏ԫOtLR{,' ]]pvZ`eՙL\st:Kr*h< }Fۇ# {w5xTU- +v8VM( : kڳ,د[]9L @gG5tŠ/ ~_@i'3Ne7"yHt9"#=j~T# -ΉA+SNcvn)<-_SOCf2kUjB!™aτ݇ćl%=1/e7/FKRսW{!98nVUe:E#rU9y|.4ʜYjaz|Ж ,c_Csi7ExqНo*бldi#OzȢdsdY$2 aCy8[?m"Xu17ҟ'oh+',؂fvf60 0M'@x(Ã5+cD@H+e .3%x P`ۯA9^b;M|Ev7\Aȸ`dq/I-j#@)G00~n3G9X{_y*L${ Ě w~6!u*UACrwmZנ!,7l.(h|,Tt &e>st?/l=[Cӡ /_-Ykg>[ m];#ri1E킋6 !˸N tcաMGe'rIz\y ׻f@S@϶t ^?8 b:4o(fVmX6~?Uqr Z'[J/ڎc_'X=XLvTSN`!]-5Es{???!I|O~FvDYX$](|گ& KDcW+,.4fiWV+"QH|oyaqlBsO/.n<:?+n?^&TI~)~__E# 054/~/X_mO")M} -ag7?'>Ox.KaWI^ ---iߌåsI[a]vWA/gc7'W_7hzBYŵҬiwP.΍XkWzo/nu<'IDqϯ^e]k.If$zye@~8M+Gv -UZXlAc_}~[gɶ91<6: ,]s F`N輶ylxoZخ!wwxbU:0= DE=0nxU9\']ziHt=i;rǾp(յvٍ#;m!- fvr E) -^EYj导8kTZ u +H_1nc^ZϪ`t8wG=vtF?n9ļm$Z/^* ^ڪ~waHIKm-i/0ߓd;]ɻuCt" {7z3'=K1S1lrC/{Tj\idNnKK{*iOoɘ^uLJ[hԿxg:gaL|9Y5blq>qvfj4c -ʀP&9S1^}Z#6@|vu]~p x/|A?vx_d*}=& J^3f.n[_\&v'aގT+uXڐ4+2Iu7,Y]Cx;@MmO G4~mβ:ya)Q*kFYZ[ٮ;_C)G]ID$}TY57fQoZqg ExE<,Ĺ5ORMܻ>϶Bn,5w -n+NѹR~NhB#L2)[kWբi(%er ݒژJNzȦtWcPF8{/ 峝1A㳖T`yn2FyA)oAIi#e֬޺觙=H^lx=uB.RK|F™>!0Y#|d!^BXwyO\`tk'ׂ,ATn2PqC=mrkl5}F{F]q{sŸ=U;\AM۶X%Ĉ["c{FKNH$/x^ov f˦QA{Ʉ`AlJlPTlP\U +))J)?7 {7/ ̱͒ Qv>[9U7:ۦ GbtV2"iajBWX-4N+4;3ݘ3duT|3WsYaLsՖ]WEaemֵ˘۞~M%j򹿨ɽ]^_~e|f_ܘp5F.ҬjϽike28țkmvb; C"MܞL?/Hz>I -dYb4mbO21%24 -)`6 ?lM/]:kƱ"a *YZNcC"OrPkܷyre_ߦ+@+E +r\x˳d(N5a6Sh3- aI[^\}ivS}"U#=%Ě>Da^;Y˫v,v2V?u^g? /ƐiCEֲ[SmW*h:;UhtB0lt[F.--^߄}otlE'G dHF98~m1\k"=jyj)VeqU tԪZ)q}t#DJu|FbNxExip\\2Ҙ{uS^[jѵlw@{ٳ9wT~mic(eQ=WZuk"ދi)[kux8:%̭dh^"dwg!NjqӳR6r1޻Ufki1, 塏+u\UYT;H1 }dW"6K07oV=NO/6ك6g(z*ѓEFvFL >KS3h!osWBeBD#Fsps9Xz+*ݥ嬦; Vi5 @0 o 6 -$صK:d&{ n](zAJ7_sLߏ.ş]Tgwjj:dT:7|/Wɀڀ t mdȹuHp{!nu@edP`TU1 >& -( lPl:Ӊ LvpQ\SuN=\4Aw֐3?t~tDb@ *&P04 ]D 0CC&8Z?\RƂags=;bzL%RBn\; h?1M)6sLLM0XvQ%{,pp8U\}skJwu*sM:J -xQf(fQJ9J=|̺tiGӡߴ;MNR8xZ+o~w76HN>[E!DȖg1_nq,2 L$cRꭉ[؎cn\=ݬFқ';5D+wo$gON3QJ%`M $2v!bs*;/Y+#v*D[LJk'>NM?H~ w?du;~I61Dwm>Bcn^eIk/ܠa(,Z% Kjpyhox[>7:oĶ'^ɸă,Aq~qw.篱w#~*k1iW0DűI Wz> ~VFJL%>*.(Y5-<w;=?o)܏+3T|@(}:{pS/(n%J$n;;+YP9#q.۽u_Cr)LNs3rtNr[9z8'ހgݽUv::(<ٸpa)3:;+4U5/Fbvyto7EbF^ -Ik0Y'-\Lw.{ro˻On[F,Gw]lCZu٭7藺uY27ъF V £Cք[5xI w} -ԆY* ]f䫞LruUl2h/@JTe}_{sc|9ZZN\ӥ۹|gyD&EՑ(7U.ٸ  -dsjז *wU~i I氇:pjk`bn:'N4v 0TD g --; ǧ42o־mMFʿxq. {iDP6:T~o#2Kd^:y @!C9ON][\setzGHg>FztmN"H;=26֤'誘3ڞ2rO2\P^rQVOIE$v17ūr8#X-s6~qso=78d/$rd,*MkhmM]3ß׆Nu坔wqM/ȎAm޴a -]Z=?UY#um -k؅+>I(yjGDt-߬|' 3O{ǹ0,"wM_4@}]W$ _}BýBzn].IJ:6z?x?y\L~5dUUijEj9ww<",߳\t0L4;,"X!`edN+,ycrэWm,ةޙw7׎P-eT_ov=RTQ)jSJ]6EF);&D,&';ypE^ecJ1}l}^b+=Ice{L wuUR:>#k,׆RߕL /;b5‹Bt|k/6L:3<)~1+mBX&?ɠoG>-u$mVs'&j[)(ktŒDdCHH* aX(2﵇:ٮݖTZP4ד|^Œn*M -]1Gә  5w`8޶֯#|I%+];līVv@ +ÇH0:n{%_~SYjnv\w[ʞ*u˞j;E/Zi:1oDmz`/0qZtauR{qjꦙm'El4tD& S %m -MTKFYo d>z ^Ns۷W=p}̿rd^lX"cNR4S%j"χۻ{䬧\Irb8L1s'vam ˢ,٪JCCm=qSP-'BLz\?JsuenI?YKSkbW0AzR 3|;|(];'l /h+^?ʎ8oi-G1T̍؃ -{s&/pM:;dsɩfSvBۧ^Hq$ȏYtU&LjË(mt;>/{Ls/!>zƐĐxTrDL{sg 牐Q=k}瓡ƓNG -e&mz!K~)UHG:cCZs/%J}  Y_SJe%WgzZH=,“ĖEU}fD.Z{+l0}iMsS24|F&*'3Q.rW(ů{WZ}أ{QDɋ5jЭ5,mL~X^6 s H}4ٮ~i6=i%gP4ȜtT\n -AJ B4!h`4/hhdb4_P2 JN4QٷCˍ$K45FUU,JIfsUre@a6&9N4Q&>OխINDq>l fdmN#7ω.{0M$}~.v^):B 3k ~II:V duz_cv=R O V3@v䥝n Zbm 3K Pg.{eZ>^njQoKȏąMPXGO5ZLh'\'}B@_:l7xzi ~vLʲu8OEMG9+I8nMx }k G\ -0-3xf~Y2,W݊/`Ap8e8pٚBM%~qRsrFCW:ch>㾑!캱MWJs㍩CpH^\x:z˱n,]W7Hjv>mb{~.HE~rwFT#bn*fuw-gHg^7όk]73:W /oEcw>寘&^nlZMG!5Q1cqͨKy*ֽɺN -a)/j۱ڌGC۷Q9ؖxYcؙqr4~6Slxg/^boWR2-\k:x.;e9ݓ+K>gƈa# +}˩-3vɽ-P| S7B/Ǡ7a^*F?hΤpr٪83YƑ<ijn{5:Њk16gQ1 ᒣ£Rڡ-ҴmEg6{M~%R}qz# Qxv'xlex\rq-F\?Ej4eO"ʻ+>v[ 98҅_:L2س;w_𒝳{Ža -]heBuuz^s/^j;(X=:ȕgۃPi#)da!5rh˟Hb[NLEpYp.vsΕ缌&GyMoiPH KGЌV9E6ɰh{ll"zX>{toY)j|HW؆FǭAV"O7_8M\e`(L[ ~J)Nx9/*nٟ I`OGcX35л7ǬTg5v9+%g}؟)ML~FxG Ѹ-M[%!Droה[W՛涫>}lrSߣ>Wwct__c;;:[vM?K ?H :wjj#1f{)L{' n|߭o)Ջn߻ɕEbk'ۿtklٚn4пv1_ ?91z8\ȲjV R}Fd>F8ίdaZjwVelmmITrYX2\(rg**֙!]2voJz*w'ǚ_lE[l,&Q+s܌m4:f5I SLM|&;-Շ͵7If1;:8`50P3w8j֮QaeQP~*1qcSz)Lj؂>`#@Nc=$2pDݸƖM^Ֆa-dKaM*NfKg{`rt6<%0!0 ]"C5yAlW]7kʴ&1V5yuMt$FЯL˷trf$;<\n]0}^KA Ũۈ|>Y"R`lx;p6Inltž-ca^+o:bzTʋhp ̨VM5;qEǕ -puzT9*wԄZ(NθόlD,ȝg_\E~ԈF귱4~Sa$U'HŪAmÒD wkݫ!Sw fΨH6uO]VDƛjN%SȖ~' 8;D^uu9 ѹ/-X?BXmrK 4o]@oZϛ746MOgFq/|JƯXȲ%E#W߬HV}Zʱb1I^p \RcwR`6*E4/ꗬև麎 z",cg6zԨ:tՋQջxw~/_ P37؏HsKpc H3'N9Pl"? -j8JB cCFION0w\{yǷ<A5ת+̘ҧ_r咘%.jҪ]N#ްV%2PNh,v:&}mSȡ<& ݨj>L,VLVY3"OVrwKt*ҫTn -Eg>w -fw ;ϖO1 PYpңY9&r [-9 ()Ի#]~: 멃8K]rwUW9ZPDM@lW*v!T)Lz(v.weY̱w9WϺr>kz];yմV\]ZRgK/k!$5vn}|bcWA:_R^h>P\̦Zn꽜ڹB&n)[8sؖ*Z]}kk~/@GiЃ:(s?bt(OIJo -վ5Qo?45_ -'xԠ /%Yv^ WX`2_O0e<%)`Õ 0Of:?] ``3yJ" -`(vNCl37Jݚ3Wm"*[W,V^l0A2A\H@&0#@'9Ex6 -$ykOw}@Igҿ#F\s8S" dJU~v  \gp%qdlE@ oLcsmxryRO^uyx n: \ z1(yrFi3R`;5$!J-d^|~rnL,[^Q`J'V|1hMf& $_mz@z! 1 (lAEg@hpp9TN7MbR8K 6nȾXC6uBʹ2}1~"tuW47З{!u}}:d̤>z@ -ٍ7ͮėh.paHho~њ0a_Z)w󪯤^8ҁ&8d3x\QL|'J9jڌ2 -)#T k]ۍ ]`=F5˿3H趖`6뼸Yt̞tZjm~h}~lz}L+w:+a^"ՔǬT\)TL5vĉ -?e*b9 4RϳVէ7*vT?bty:Snk[]'kψghOAK}_V$׹h*4u_Qj弲w(>4yS@vW멌Z_(r|?l% xH/f>o(Z漟1gWoT8e[9=XJs~=i-z#\Nqn)KV)Ls'oU猌-)LjY"!Bo,v,*BbS$^~s +Gj(҄1o$gZĕZO"xX<q%q\`[2pIw3yml*ۃTqA˾ԢJj t\ ~(-nyRS '$oj2d"&y!wS ;[UxGK,-p`1o``ņ"c{0TGϺm3GvcWeVPO+E5/s@dP[Ţ^+lVh>Ae*|´\5 -Gm dQ 9%/l헬\KsD55q|$.f9vu"f\/n]cpà;AAanҲY?_\kB^͊T8lB?r9X'E%?ȟDfi2 -pڐ3\\]Ѵdμ8M,74_E/4A /)[T-m. lGwȽGhjsn(x~ai -X>[ J孽,4`%n꺒kׅo|Rijϣ -x-~X / $7rQ"#4l4<2d*fм-A+fV)UA,`%; f.\d륺eVs~`Q1ص[X%}O΁(a^?zAE~g܎`lP^oLR45;OL΀T< Uw@J>JfNM)Jώ uhat㕯c5Ag~)ޝT&u <Y'?;ãW}َ{Ӱ Wa] 1HHiun׀t@e@< xdYۺ|<)sez/܃u'ŏ+1|×6.h52pS}7Tȧ]5ٴ+r'W_?y0n߭3 Et% -y9*6wǶtvZ)D|rzͣuPp(?33<7$/<Wso_^m_w{W|]Wro>RVh]!&X_oywycv7Clfq5ݦk >?!6>nmiti~D#:_=&E(zED&}k|Nzm\5fq ^m|unCayeWc)b!b9S.t&;NMK7{tiw5! W/E c~훹.6FoPK=Rtwmwwя5k~>LHmu", . dgqG^!g~hbkyE&\/ϦTkT]t6ks/ #Ց2F#vd"vr,\NgFi1]fGkV޽ElhzOaX5=lq%[n><|;a|:љ-W[x61n}-+W@y556ƠQoN;GZnRXjV3h߸~v^=һwkw|GL}tjgþWls7'9_+4oRon }N#%ڠjJiCrmNZ1͔{)4B< [k9Lrn",1Ҏ _nR_}:"&^P)悯ΐQ|m!YiíbUAm6dp6jn<x0o7fХlGe{p'YoݐK J'˹7uG|g;iqT -Սm2˪ꛜUMĘkxS:2ۯ۟3Y`|>n oX΍Ý -t;Go.kAj g֑F[LJ=ηҐSz[՝MdOwx3zҵ6\E(0,z+;M6l!)<rySTZVTôդ&Z*sXTlaj)k)6i2 ' '{m/oD7DVmw5%^0={ ,Z ٴu]TCx.OZjgT^tEFeCXQ,5.گ<z)qt{dUNޙ귖e!5QG. jfs 7g"e&%T#Xjhe=YuuA eO?J^yHļvF)'x}!ky?\ZggVAsPkoU PIJARH٥*MU)+/-t(2.կT -ˇKIĽɽ˱ʽ5g`W7oțCWTϋ]"\6Ai^kI7Q*^v,+-\ \&'*?>߇9/ZgnH2z)&;X}VOmV'L)W:|D|էq+D]^#ֶu)ԙuHKޛ<rFhwpL~^L&7l Lx]bv2l.0D0ת0zW 'Xu23H1v&7,G4w'ܽ<4xzqm2[ }VWYaxzg7B*pbrY2eN{ͩaEgM{ ߸']b2(:CsBSQ\?nffZ?ͽG}i+'+oߓcnD\&h)?y!L 8 KWAL;JmgհE%yd($&8F\%oe~@VSWI])\;Wff`ګltL<;ӒyadjG;#BZM)L5v"_9H)J&[I\NS 7 .95,: ,{wȫbhyOIY۵#~J0~Sѷ^yZCGEORfqZH\N;t8@̀%3a<[Nv3AwV/ɢ4CHdRu|}Z, ]+ӡ]2{]&vT$l_?F!;hf۬d"pvOϟ鬒46X90pؾI:UJnK*Y,!0,.VT,1Mas?\ZHs*y!" kbcwH+_PeMzRߘ߻۱<ݨbgE6Ҟ>MUhPAv?=rC,ҪeN-,e{2C=_ 7!X -,"Oɟ?)xoh,v}z¡G|{l%`LNE>gTgOlEd;(wT(w =A2Pͭ,ol4ۯsZF{6)/Z;sŀ)-*-9]E?\vYZ]gs6'dd)SkWL4P^A8J mv{B8'hܚܚShQp-=zS3(\>"h4flY;0@s1%E],37-}v`}`]l`+R`{#`'ޢ -sؖޖ%_爷|<ϩ{ BBN:g Xz^J>S5_B׸h %:b;ݾ].qT64Xv ^B?T4M5TO@ӛLdF*:Z5#Fإ>`oVۧYfgs;םx]=BO9O^ k'q M Ȧ?n>} -V{)^جVBЅs%=Fx6vyi"BZNW6}=rUt"R;RI()@,ݜӄr}&k7 1՟\gujeh5`/(<] ^DοΡ~O/*(.̱-tέ)LvuQ?+n:FiGYb.p]Z#]?CW}7g~x53Wh;Wop=òUvuzU?GFzW3ukp4K5Wd:kl[`.AdF~>?h5F:}Lѩ=aq4e5?1;ΟBG -8>F҆SZȻsgU2X{:j6 *<V7L3YLF31Seӝ\]♩B{_+6Y/Vo=o0tϟbY?p`D J&"~9ckyb-\l(9i5c׋V̿f%v--}MFr4jUW+=7feG僃b#Z1TO,oZ)]SChNCJ ͻmqS=lLZm"s_b -ǫθ_a%xby&vbYW2hZ9]|eV) X.( -[YنT \͋xc&h[EՓQ-'i۳ZRo}Uj.DtXKKw%ٙ8w.6YuN8[/d.p򷩧[fhPcq8YW Nᡚ 0 ʴ\bUWuN RQP(U"uTs]|C'|:"ky`u8)O8e-pJ$91oift#@6RMr>3l?3e:<3Vl96zm#_9(Zp<{d+EyEj?:[a>D,S.`Ro4JR=c`ϐVCN9\yd+f!ı3cL)ՑPΰKmr+H6 Jz!ɝ̑MM)}2{b'cb$nR}qjײ~?/~ 95n 1RcΘ/9^3]}^tqCԦzASv*0cM!Nɔ8ؙ`%_w.T'f_O2hS2I=CPTv+;U'H t l͢0UqELHIBt(AUMoH3\{#&/Yy 舋h1#aDGL[DQ쏷mkS1hFN#4-q*D* zhҶ%[E8!c9 -[6P.xOi8bwb - `TG557(M'֦d4rLĻE{d.ǗT(\k׫Racuڎkhݢf8&1%xbs%ĔQ0AZ1t9 PS -%SŅv,W-fɽȥsz鿑]⹴hFx!;K -_Đּsٸ;:V.sMV:ݠ_&+SUB Pՠdz٠8ej꺰Ʉ;]? >Ϡq] -|LzO٘dG5[lF.is@S=&fwTSh֣9Cj;Ov&c*2t&BGcL ;s/vsggώUVkc'4s1ޓE.+gyºP&dj $JrM6E0Z!/X/w;+=ꦶpľR0Z 9݃=_ ʽ fa?S=}H VvhשYJ?-=Pi3WZg'haS%w@֮E|Ult35]4P$ T5O N ^ MҪ' $4kE@f: Aj}z_0v^蕢ӠK6Ux7^^.쓄TiFkoY0<"y=c! 2 x[ 핌NdkW"Qu/9<tǓacD~ɷ7USt|ja ϯ~ןP?z!Z Q.l :w<8|aL]cv3/loykF0ouqeHԴgǾNI4FvBY?:?:޿cܜ™ߨ8HGe3qvmmvj>vvREDwNsU6X - . -qa&nV'Z9!vøMrvO%|{NWox!F_qsy""\RxLP(q !­ qŽţwÐ-OWW2LR7d^읰Zj۰{,t_Zå8ܮIkB7Z3N\p3XEK=#z'Rߊ1cHcj{Эdw= DҹGQ#eZdϨ]GHy {& >_o ORF`"c -{k55zMvg_|sw % jV3t --h՛f) y]exf}z{=PY.N0CԚ0KB\|vѕ|V:ӭ#kcݪdn3A^ycos6 Q'nmKEԹ +g"P&巧j~ߦ%T,SNqyuW&3ŠFN[Kf-To~ZU+lT=Go:q4,ҿ9Nd8$ QSO`Wˊe6k\kfu=d76 M46bECNGɤZV+!eYcyN.v=k`qO\ֹt:򋪂鋳'[X5 <w[7{\ ߘJgY+CNjQЄ?Xݯ63H6{Ayֺ+woi2g֟`\-kn>oԟE SR1רzԢ hTTmYɮEcF55st|c~V+%6}b1vIٙDtC"ks!9"=1._q>l<7K͉,X4vǮN^X4 0ڄUGjLyW1՞(g}'r!^$AE =:z->dC&8bhv֦BuDMWh\k:/]g]V֩$8{n(4q[#TQwV@B[1CFD.J뉥$gjwSK")N :-ގRw 5").t_]D|I{-'/;;#;hoă2EG<JUV@|{ ֚ng(u%mFGN_lrpK͏vu#rRdATfgƖZh/&|\mz[+ra -srb]SPWgA)AVH~,TeR[3i+r7H'hGAb&wy>жNAqT{x5a cܶ%u>[lWBwr9ndLlL:1+i{\M*;Y8nG$_Kj8 hJF CHMq6%_@:>Gd$>LDGh;`_[=A|sDUUK,MX_p -W U0o)B*CصڴAjqaZĨj_āU8g1ㆣOrU$oăhunx} 0%ϻL:t3hPU4VInqEb"qKQDbђbq~qԦc*yEú4^%ܲMxM`w;զ=~nkcXW~!)gۖ;)Z)""SHPjVrH{#hJ[X?fߪ'9:]^e~ӭ_#r߀d9l|56[ HZRX%X:$TUDzt' -4!p+?&DΫyZ %C`9`Ln -3 d#zOJ¡Y6m;~xjO.ꃋAUI~D-vb5Gg[Ϸg'O>|i -S8j+}K}\rae/$ȾI6j7nи#˪>tPH}To*ɟ j_|DV++0Е!yl|+ ;d5bX˟qN5N0qvɫz,:Uuk_$gI &Ŝszs{ym*FdrM)tv@ [ӀXK9@ S@L'(A5,w3X;js#@7@-PT'T&bDCK]6ޏ[LA; sx@W aJ J`t΢;&ɧHL;֋Q/b34Qn/1^ ɀ~j>^3#FwF7b6fhʡ&[^ $2 Qwh{5إcKK,b 51`g/s1Wx 0$##) x\~4쾉h eϵ $.ShTNFx H TnX"Vޠ|i0Yc#Q4ԽAn"j,P;ŸN$"&o -+uήk  E@qE'm9|%&_Z{UcD{G\ڡ[?Mfm_&D;P50X{kkh]!ڋ?#h9s tb:g1&i"&oO@ސd:;*?4W||{ qȯO9=/7<4wW;h^\V7K7n&˕ -Hd$71 'UShG~;߭9s]ej)e ۵AdbaX7Ngs`;F&8ҠV+}c EDUZ-c>~shj=dnT'|~wmcĮ^adtXֲF}'g'_I%?*U 7l~q3'ެ;f駩w_{¾j2]˙.)5dQU]lUV[ry4e #>C},݆cIM/Ydd`8G饊ȕP_0QZJ1ŝڙetfZלPnIy*>י)E>gٍg̟y$>EPJM{{6~i.,?= -.TW4cd61=mf4JdUAܼ.r魃0M%1uWK\@{0n`,n~מE[|HAiJYt~v=[a'13MoA~n?׹ｌ}n90RH1cJb>=}m -o\C\}r@*_JZhڋ|1rߢ_Ymf}2Ev}_w>KsI4a7[F.(Tf+f9ӊUJ&S`q+PǒɸYJK4̟<^ rf -]mX)uo=A,;9m47RF ^mf́TæMZ甩TlEa [w]V|߬!9 1Nb,Ԣݎ*a|~R/и9,nLtw׳9pJ&R2U)[+~堰5{  +Tn|(Vnsg;8o&uoÜMhOF[Y9L-=!=ʤOe'|TYĜ4\@HnA_7n'x6P;^m#~"rpkHȦ ,HȽzܼպT D5Y')|uHU/iBi$r( λWsz137|Њ,g6ݠC҄8 9^72$4Ģ r!qWF/3t{&^(w{qZ֐fZy[m\N }_G"anFںi:yNG<`]*$|j#SL!5Y z~oD핌s_¿w#'R!ӎ bWH=. -eKc];_ wc%ܶawZMçIݽ&gb.Kh;ϥ6%q:V ")}JbܜbQUpw@A@r)9`Zw3q`PN\hйF#Ji[m ͂9XjGs&%be.hY S 4Y]gi+٧xeg]h< 5:=[~:7 -!O.U}Dwkoxu^({a)#tj/7v>%Y`ͥښg ^-{֩"bY~S\m`N!ٜi:^9CH d7A~H'V$;Srl\?YRl+7E-k|xe615mFUioP\#&|+,_o0jX4K$ZO=TPhX c&?qc?US$r}7ip..9 *j*ӅЙlFA* mjsZ3 Q?I4oI#2;* -endstream endobj 305 0 obj <>stream -ܲCwKDCe7ZQOn<\1K5i^NhE}>?o;f<5I<5CI5nj(/ -z9n"c6q[U/+FT[T%[Ux-MvHo?"=M-l2uh*k6i֐ѩگƤsm2{>@9~#½0mZUYeg{5-:)R,=p( -9^pu3zl=U]V|B:WfM3w Oz ۠T=[w>Y KqqRMoQ|SXM"F$Vܙwu(3Fw̾vyQwV֡r\Yʸ\/\?ҭݕTpFzp=]w_=ÂaZaQw.T5ba@i>,R\ٜʐkNe F{ywqR]yF}ڞ3cb專ls#s3օR>^lF?|X#lFT|uZ3 F,z{Wn -6. e@+u7^@kRR!V]kYpRW/Dehd?z^\K&F\5;puЦN ʨĶS꣢0[S˨|||B qL?|%<=F[GVsdJDVTvgر6d6.49#y}\= -+Z2l0RKvgGZa,꘭ͅ{|iYl=R8RvFi'jyG|=2Y@|GVk5Kb#/o25o|wԹnu&2PN?ZڏF_ -3\[:+e&783ݕ:ڲ v(&+SϤ￀`9˹dJo~v*3OhMԡC=R7@:rD!h8w8f@(z님ZFw.*)hIuT|V3o;H܍ kn9):C -G lUߋl5wjiudZ[v"v ʱTw\%fJI)zԩN&W[=<qoN7c>3dR -f`) ϭtwwfíΌzn7V),mxАP3=>}QC՟uہn6rkjT3no~lƸQkZpKw'@\2- O0тgϠV˕SmȈ#&x46L-L򺑡m¡gB9}~k %_knGi -wf_mAvesa+}.v:~{jhn])v-78pL:KLfKMhnPGu|lNirDٟiλfI4*dCi1('u3{E8VґP$$f0Q=i ZV@U0o]51<,쳁VjUސcp}hsԨC[eJ^L:J&}k=jY\Ig9MNо=`m=Fe}(@ICV;r E{5uA2°>>&yZ./i"ptda!W>I @vz)VmXw'\ /xFUy+!|gc}~V֫#G+cGG2)n#&]JڀCwxtU -*d!?6.(>+Q9+&Պѝi\%#W3]c;, F5AUUؐx" -EDM >h@h(gTull6v1B+ػ[w d `C(o~UoW.NyZmfK4H̃@wc&:]ijSp/RiX`( 1FjZыBD +xՖ*)7~p#wQ 8 '?4 zP7C18d3GNlפne"eӀ_3Sd'"Hj D/ŘuADQ+@[<A@SŏXfYrd|_3a73kmY.i K4@ )Fr%͐ G1S@# u(1֡ H[xRj!FD~a.W=8xg(,gЫ5ƳL4.mXF;ެSl;>h1^JPzꥭbLo:HCF2r PPPcT3P0QY@T#ԄMM4 \#f.Xc_b{!*loxX#F6QŨbLc H`1>u(ͨ^O1DRWh&ݾ*d=zU$'Y/OQYCγ:n-:w~ ~<v1cpƘp&V"`/` )Ƙv.(ٴәvnzlRI/ ,H~\ 8:{~/$bBƨFh `m8x|=߁@* iL|W~L,<چB(7bgD!` 6_vOD'gMt$o8%OpHboX0eEb7 rp)떪1'rﯵ7 Hܯmj ->uPL 3z@3zܫ4Z6D&X{O$!ɾ-\P".}B;Ry97וțWs/[Xrx@gp:v4LjKGej&&BK[+PF"Kc@Bl6gꝡns\a{YQ|=tpwv<`yC ^ƺ -*2EćD"&IPÏ*]ȟR\ VTi4qRf>ăh{:6εR\o ] -fxmxsqB!yGFO7j3yMG&¨JBP~aRy?FYd)\yy/L.d?$f%!!:,6wDÓ6'`nԤɍh=3b]em}pAȎ-XVeS;4E;=#`ߨߪa_6IM"&\޳,PL'4{h[a a?Y'PUw]:vJu\$+7nDhmlb-9 iRօÆ1AAvAn9ʄm\](+ZWYS%/M!n urnz{UԭSJ*UC4D[[50 z*lL?lzT~W݄S)oC-Az;Σ¿)YZxygCnaH&d#b*}7hDr zZ965,rj%s_wwe9mPPl靻Ŏq6tqr @i8ۭ"rq^glWA۬uc6VCR62`!?z< M -u_vm}nͷ'P)Uђ(gEgZNjX>6~>EzmW_nF8nfm=GcLNEy JbL XnMs{@~;sD a>.N㼈l/.?K[)TU,mn9͟ǚx-xwM`9.!tz޺MBtj_LxPGٙGx˻6\v 8mrYԥY-J>N;yFb}SyaP>._=N4JCnjGCBC[v;mq٪3 UW_vYolө]jRsT'm㣆TRnc8AWEvF7z%?,kivFnjn:S|=Xg)[o߻ÃH:R"}o9FEuEݛ8 e[vѕ\l,EkJ^z?4 VXg4{Uw%Zi -;Tr˚/N]nHHDL/[uÙ~3)j teO{ɝ^|qAb ~~?W-6gy]A'c3mH Q-stHo5楬Օ2E-|μ3RMW3)k -c$ -Ɯ=_܀T -$WzuvSl|Xf;̾s*c:qz+Uo5m|&W&׫^w,EVeyo\TKmQG2 g\7F(< ?ӡ,BV"+eΣMv9 ؊N.YSzՙI3IthpԍT{S79ף3%1:,'k@#ެn#A#%]k~,j/?F^_C@WS2m ._Sn(c뾃lS MեànCD-4Ǝ! H@p:1a&un+ fEN0bɣkeۣ9#`6~>>ar:91J),Zhq[ PgG /ﬓixқRi'14>Kn[^*Έ #t=rrE#C@j}-DknLv4—{i!(X*gqH|E8ZC+GM/)}m̵>]1F<߅-9dO^ )wstx%^mΡaZ{V6 Em4zǁ9ofLKxUPVO cLc Gi*^ -~}C$ƟͭI&}#ݴ/nZf~uOfRLaH>ҁ+evx7p8; -N닍:a )uXHRDR.p X9^JPOB~=ߥLLN7d'ⷘǸ|r 1z!WqpەP_ް1}&6@t %%"n.=Ĵ"1zHƽh<}A/z=OdjxM)-`,XOk- blE -@˹@-&Ptb<;- -kE<믖7Cp<\OHLD -`d 4/ v]2I[Fe-CtqvJ6rJKП4[\ޥ{5'n:rO!ݾ|vL#'N14 (1&!Ïbk'G3bHظ۫2Qk&*Ws.Vc<X @%~7W̊q|]>u9w[ꕎ:oˏ9ΏVtk9 FVhqv4YmEUCɂ(3Sbi@\66s.d@V oz$DS" ^ 8ѡlG8;D?Q?ߺ{?Qd7a*kAdӠ(cosӶt9'LRnJj$m}?q!C(ʰ1}@UPR -щ_!5@џ%ҫn $1':NlLjeM^͔[ղ${0cA;UomƕFw [8M]z:e=3 -1>m@f/M -^1Ct6r?Kwx+heYqT r9();2+%PҶ]fHпv_7]k-Q}Sw#~f~iICfW@M-@ZPMjZm@PkuMV9C Ξ'!{,X5$Pm.l"럊z:MKx+^GeE~g]M䅝x$U~IDyY:B('x9sn\_)LecC@O{x`Kf{ -y5t1N=38XO?_?K6ƾ))詣sLn5).e~ [wX~+YR!lw pY8lE>خh}֪,_- ہ-TM/pAby.o܉[Q]h}y>2 +>͎C0Be8+EFo -3³c݁VOѦ=Q姤jNY-B< -Xf*etE0ۈ6zoB`4?'ي;1-9}&pi*("}]s>R8vthNaz -=1=lif@z?c^Nm&~˩2z~?;Mաӣr;ꙇ^e5o1lV[TݐA݂^JyxE5LPf3ly0rIT4^)MԇIGþ6 V 8-!@=)2(QK/Ieuug*{f{=3s~T q> Oju>z.J>BDCֶsBs[=,SZU)Us]oꍡ)ys{u qrSsJ0tH޴x5Kd$Fzd K  W1}L$uKVL>ˮkk;a:[*{VB -$GU-%=ddF -A@'rM-JSK%|"c]3QwDzg;^GzPJJxhQqm;`(MNڤj)c2CɄ|GY9nyd T} IV5] т},GN|xv xvߵyjFJv;X3)iעr~-Yh}[HSV3L=.r)|ِV2h6)A MT1L"~%i -C*Ys`­/܉I`\ӧ%0'N3-2c1Ɯzs:7꩐Ie+h,Ξ0S ZB%4|;Si, -i} K|~Jq܆$tN,&[5V:в ƽR.pOA&DŹEHҕҴ-'.gPAӊiR}m5ՅQQ] a2}tus+Q+[b9b(S2z%ۅV7gnݢQrAL<1޶RDj4Dw+óT߬\%2'J)]!cX*G焚Mcд\3\#))'•/,;Ve+Fk9QAu8ŔB޳$fkDzd9g~$W ssD$"άWT4\l]B )XZ=37$t -lNcrDwNHUOέ7v_R=XPB29$VN]w:i_ت`Np6G+onkYGhʱj>z^:Lw_04fD&cWߚݢzlSN<IXc퉎6wkҲaG |޿\>zx,_BmaΔ1!&e= }T1%!ڡU/ -^y6+ĹZ+])܋shDS\,y Ow!]q8RcLeÝ^V#|(Df;`=f7`s&<=vrw; 6E4bS+:ܴh8WswXzюwb5bޣM)%<즙j#Q2WI:q((D~i9^e>|  {0Fd*#^nxUOFy9TֶDKS8fe9\9&7‡m >w6U6žB ;4BbItɗ[̚%V=@"@+ȤRdL),`@74ً4T8;R;Fk˳}iĠ^xn5z -gZ䀂DnrQ{d=8U=eq@e PQPPej Fލ,r;dkthU3\-px&&J `LVV o9&`"V?4?- #Lom@/o7<d t):j{M˴Gf_j#„Mj}+KEXF~}Vr5!؂ 'I)'3T|`Y S{)Cq꒜]3JYIΉm&V䞫gd|x X8*˽livqE`?{ϙ:#[!Fn5Qy="6`Fw1f0Uwng>:kP?ZQ0?y_?A 5h`C !S~f H$L9laiW]V}?ܶГT/ZmjVV]ٮU|n3rn;ym)~d?n 3S 'o7JYZpkbUJ:3k*[B[ȔӭJU)zaTo٩{kWVn^{-U/b*Kt9yscx6'{O,YXWj I\VQu>O)"Uzv\ɄS~NTMSǦSfa^HXWn*珩R ejCɪ806F9I35]s2Uۨ5zyYR-÷5ֿ*3F{^#TsɬeQPȺ6Q'e15q:uyyM2!/. xnt5x5b ”/أ|>yn͈) |cX^ aOiH hP9Iq>IM Ws24"dį5)RɜW 'gM75) j/Jh"=' W;5భOh}~j: ER`Y xhmTss g?&s$|JOt|䜬N,ºńbGYdǡ#gՉVCX-CPlv!gNJIZ[;MiJI:dh%a2΂m:"jEƳ9 .;YYcbg4/'=DWX#,lE&{+Fo*Β._H&v,"?o'W0C-Q<^.k~Q,uug[6.wؽBL-ǑL5ẋh%ch_&I&ZQ=W -꧳L0(1(uR7i#УwʒlTDWjݧL ح'rO'Z "1>>II][$VHf\ǎCThr-Lʸ E%}֗Ӕvaғ']kG JE/ ϔDMKhi1Q*|.h!8&t X?$i >}r+L%xF29̘2Ё`2p7r'M@[߄MUzJ|1r[Yg{ޡzpG'T#hd7h2:n$AoFYXUAoa%Y-@NpoJ&@P6 ^Qi\:̀v╵`^/4NJFզ%JB š)l3P>?<ݠշiHPB]IJ7ha2{p"W6yBcD;t -Xv@.@{-r<8 U-zpw Ah!] Sw}=.SɊA)/iܓ2;/evߦ `ɫJ V @~UB$`-NL @'`_' -V=,ud^RrB,x$P}DO–&$>%xe~x HP{>t$;RFf -@2!Hz$Go F/Q{KW90TxX"ľb>ӷ/e7s -@9$C@9&@rWN8K㘆~mWP=f3Y6Hfɹ!u֙6;9$[=0 tuݐ3 }zBIu~uA%85>r\ʣ>7?R/JEÜW|זJN6`ɞ|g5p`/M-ϭXsVuFR]| zun;ȳzfVGn8L{El963\j_<vBjlng &Z}+fbvg:Hۦ::T%|_C霋dL,䐋 e |?䜫e졙gF!9wr.T+o8u[K:*RwVlrވ%#HzJ#냹L77 zkolt8Ѕr򼗭aZ{K;Vw^={MYHalb }IԾX5Fj㇡\k;52} ZlAn͡R!^){WΧ{)ԱɛjbU4ut#)=Ox/!z=v"ϵJFL1)J=b`S.l>zY,:nkդ9RZ *rq_Pw9Vg"KĪzю5؊¸3T2^t"6Cתj'53@Տ@sr9mɤV5.QAiVٖ0QI :uPgoR/s9nlBfr^ZI)FrFT3*Isᓦ3rbXHQKs-d. WVK4 -|ۖrT^$SiⰃdE+g8܀Ddh%Ü\+Iݭw9U+ lͺV YfٜpGm5 ymb mBa܃UlcJ#. -CNnԫ T qxfDː\aҍ -LzY"Ip\4DjULXvHXe'NӨuBw{RpG^-pQN^JQ$0_Z)<ф܀3SWwA1谽\S@EcJO"2L &Ag0ǩ]`by\uq[ Za2HNG}R\lGqiV#\tgT2,¬[pb5?`B}o-[H5~Ȇ:%R> ` -[\o,O2Ps}x l-G㕫#U!fqjN"g5m3 rXOdEfͯꚭ}8 Z${Z3j '},ͼlэGSDT} Q1\ܯtmenJ1t-C' ŹDG2ׄzR[);t mȪݔf-"m>X%\WkGȾZ"8sFT؂`] HOv\$LM0U(DI=w\1R.lcZWGY;zI%45q(^$wbG7Tof r1>rUA*p}``PC7~" 1e/XiY>ܦv#W`̃8k+q12fl|4J]k(όM.y^}f -O(lBo2ܨPnuP"{ LJxao|<<|zچ'sag~@h >#ܱ?6a)th-Ft2,LmOI1W= :'"3M1MvshCH$r {G;7`~HY=hs0Q@z@ zF} bH2\"]P'!*r5l@3qUE{Ass -KT/8樲 `qD!(&4r:OՉ @q⁃TxJ,/$*A -5R"JK7C(ZLh1?56VX:;dVG̎ɓ3QB[6w,!wD.+A0~ z =-RT@q̓e -X̓Wd;B:EzkGM{C,&j0mGam`!Hf}"! := `f4KU r[i]`s&USTT|u6W+cOvL:S͸em3jQTB5ϞKLi'TȁBy"و?A0t5,:`ȞCylà 0P3{Nzz\z]|\zXPYkJ\4TK%֒ŲE,rn]$R2#3SL, Sl:.NUC}[6C X0lƛ{l<=krăw\bb\*O65,%LP֜?]e}b-=]8-ﯕ|MRVzxaH^4 kYp\\/fevs]@9;7BB|p?|?JbX"[AXWi+l_1@1gY k([)|a --5C'Qrvnev^_$~ω%u+ga B!Z l`4B!!]ih;AYBZ +'{̯hr؛tt|3=*"<Ȗ_[]Wvcid>cV}`t'RI*hLZT/.s\QVi˹d_k+_]͆q\׈Y(YS7.lUbyT6ߞ-zwKw443)ջ>鮷Y <1>ycyվݿZq>ՊļVq>utrog?P,\+n^1%- "&1U|՘ff>cOlƋ+*8 %Cj'1&^Tv.\*c%қ(yx6roR|u24ḼJZg3sfn@f,+Iy:>,7D-n3k\NKMKpg<=rGy{[ko\>ICNf~ğWJ ⺛j'77PݩZA ?OI}sY_=J&|\_V3UTl{rv>ř&iZ;<4ԬT/uQ1祉*ݪkǵiumS|2*n|gz~ZhCu*?s.t[jQ?xr zZ@H\z&Un+w*~ۗPƮ{r@o76L!Tu\XUQ3!2ʗ\q -kwkV@.ՊļZH{"W_u?sno1[o1[o1[o1[o1-5slÜRq'+'cfw! [^/pxH~O ɀG:o:^mQ 1hZ*Oxh?B?s:o-Lar?~xձB)n#^=(nLCR'.8n :汗.cl[[`VD'*C1Y[+f~coߕ)xwУ]}Yl`f"lُVM\7vCH)S3cɁ[H(a_FoM_y MWPWù/IW/7v )E< gj@O<{ؚoB57A-ULs;7i ߖ“*Q{1Lȅ?.71IYu{p\"r?[YTT=y6=WQom}A9~j7xAj.' -׽xyd^bdL;@˚?D~/Q^_V4._\CAR{ӭv=2N/5ݹxc+Sn1El쟷Houw -\n1?8韒9fMQf!w K?p2Lį  ˴Sّ7Ѵr3Wv,x^3n2,|OHW_vNZtX/_?R+~^P?w}!+zt -ûSƳBAnլ˹&2WwW"7l9S M*g.y=- ?uF;qa,g,<بuHwtB]]0[>g"y^__u1A72Meqs=[Nr_B!WX>p>{DL5M6ϒbz9<53Aw(J5佖O~խaߥ:.%ߨjoP717VRDNb1_vd [͠bb:2mMNE!tb؍N̠%6w7wxniodjߵ&S$>ıDg0v2 Qb?Az`?p % -mZtoDUz+c>AhިR}uU}͔_mTvZFnzGѬ7'aSm"s92H4)Dhjo?'޵ԋDzl 9իZ FN  Īst 3!#û/.8'2 5RwSI~x7V]0 +~̷{2U)wݏKN~ɜ4# -.{jKWx 6v1ZϷNkѸᗽU ,3 OK?~7Ey_.pSH@=='ogEv[]m91? gL[Ąoo娖?V -mx1>rVaA PlvV"q5'߆ ̼(&Yk+"X_T˜c\N:L ͌@tJs1,ph-{ONzq]ҕg{ g4ɎW7&g1ڇ%ݠ=|~}95D_ ~[NpV/wC54,V*}瑢*BCIJ=3wlЊ~M@x=0jd(wwf\ɏ^ͭZ n7~h&#'RHx_zSkjjJ?>< qi WW_L ڒ*Rγ8X_nD)JQzaa!w_fB^7*Ɔ!߿֗W7ۭJmK!, %Rm1' Hg4KK ppG -Bbr}B.c7~^ }9J5+уQ#&(ɄD2Z0#iWEF_Vg\Ÿ?rzЏs~A-Zn^GFwSr 3lY -3{)&jU-/IFWQy4 j= J6ܵkYLX Mb|EHIQ4ti>uj_g42c-N0Xc?$*A룔@ {RKƼsQ.uJWt6doM6h↏%Ei:"U9z_Fb(_tVk[иL*}M0b$o;I,m_KkKVe,ԇ0k毭[6onтk _[?TdX?. 4[t[4*=!LWԂ"5$QapOiyCz@ocٍGe(^h{ʛ3mlp].6Num恽:{2Ԯv;kP>^%:W$qN/t_%?nlZ_%.y:>FxE{UIJԾh!=B{Si :II0w83,kUuT,z}C#L\_aBbLB` -W9WD}MBnЍ$ LcM%z{W5\ (w$o@9C]}O]-~UZQu/oY(q҇qe`"6߽v7ĥU#e%\BJxLKRBvY˱K"G] ˜٨̖!)xgpN%C^?2%TcW'_W4c=Z^&^1ENw~-8K#ڹӲ/fz~U>kvN>Ʋ^՚ewU{5dI%p0*e~OY/TT[ 5lho}kJM -A{ -&ڗ)2u-/t)C57%-~|֕\;7߃9⾡>r~q炜kFѣco4y)CY\?⩅^X ~HM\|F?VfՖC_rISr -]+aEALە/c$ϒ"z=ޯ&+-uU2:%- ^oo;t-$۵hݖ\% .;ʶjNIEU;T('uo4^4FGvY Zq33 BK_vsPJigCץ/ٕ"nFkP֚}SnƣUǽN[P|w0Dd捫FhBKb/XomQDKsH-(fM)j#xvx׻csZYCvabkD#ݡ4mғزG?6tL7wԧY֥K|~VJg@B\p+ږiOMC v^ոɵhĢIқq;m3qUFm g}ň(^-(P·ϭM=/tHkHbS?(zP$R aR8/mvt}ר]lMaS%u?5Co4uh?<7Ī( kjיQy~կɳS9buϵo#+Z7vc7 ЄݢǺױTڐH@rϢȵVͽs'$ Cgsxh+K+[j̍zqWqhF7OW[ٚ#.9gǻ㠯v!.qZ MN[`н?f]m?kuB1D[ٮVh˵4V2q-6Z/}'dDW<£Sޗ]mWXNZaԟF}mJ.VOo4h,u81X9N.r)OE%#>H!>?ti_]UQqJ3DJ#4dr+jwgYt3{i5?cnFpjQe"*:.9?X'$wf=)vz'9>`n{}o5:ο`,Z],K`.w]Y-%n;>cwΧl>z|<ƧOrק񏽱]Nwyt49Gt^ԏ3>D nC@>$8?cA-OpbOky~D@@i>`l.w_ JqM<8[xh8b ~o?4?X7*E$ Wq|X4-b6k|>.o~b⤸q}W0654*ߝNH6{ᤀkv6>:[A w ob?,'h=9h3.a$GslfiH_=?96j -x!ȘWN;b: 9]$+c?1_n/##\nӇ& 6@y Ey?\.=MB[廈U19fG^! Oy3َJX !"s xIRnr 2T`*7U*]O7(WYmm3 +> Xۦ-j,1Ĥ#[$@O7x=}l !)*n}ƀV3z>oXQPq6ɸ5]/;pn{'1s8?~"Kye\'dNYӑ0b=0,sʺ mOUfgi L+ z߫]|{\7f qw/jk~ۅ%$|霊 qyЌ^;ǵ?E`9/ۂNvt򵅾;|YΤt7..Y!3jyg? -zfxMwg"8W -@`/( X-z]913RVH-9dGͷkʑ*AXmGI5h#.:#§=2Eөc'ef-c'M4PP.rWRZb -O6 -Wa=IOɟ~ٵZb]8m5g2Զ?k} I.D[xg5rGGƜICzhP#E副>%=]G.9 `DߢN|&*nhc5fKu=ߏCe_{j {4 jZ)us5aOb70hnxv4pZz -WFf欀}M1iu=@4n`& 6Qg9LOV*OOXR# -!ۘ9NYd+Dj&cw]ЀVӅ>Vs'ͥ'd8]4VO {75qQ fp==i1V'b~G^uSQPb^V,4v\&K.j");6Ú@%I qs3lp%kyp4Yo &\_HEM.̡L8s4ݓ]4P?c|MMlrHA[0_2&$չꛓޘvW 4%燃C'ErұaG<Hdd35&+ E2y1*A(l]Wn ->YNzMnXn$:2ad3snth庹 ֯O {> gXmKڗ!IX3X61V`%nЌ>SA6/5].BY)1 @Vzoⶫ3@Ꝟwj[#/ ѺGWJ~8OtEL?੄*Io4 s\ +nj5KY dx[k4VD2S&d>ˈ|Tz1_0P=6'vO9SA#Щ)¨$t€6#Ő0mKTS2D_ݵQOCuC@łV&İO&A(a{K>X@#t?̼@M`wʨOp4P )5f-H:-h !`ŰA5>AK $Rj {Gr0D!2hѰ3_œ! F0K^,p4D*>EBh\WAf;'4,xBu}bEaeҜ& -x6.0bEȹh$ƊVЅ"!v԰qI% 0d Fʐχw' -^]Mme^#&dLˌX h*%7LYҒhpќD 2P/n/n,O0c?ZbXug~/z3%8h! X,{h+̩f;smV-X -B724(he3y}z`{'-1JC^Hf>4]󤬖3:hy5bSv25/>GȺgl+%edV׆GB?V L՘3WM+ -5Wci~m‚;Tq-l򮅼_Lky<<\T5&u7ABݓ$]%- -G9XLXl޿kY#:YYpk> -24 pA8e5F( Gx >m$pOTJ 򐃾ICx/,h=gZ+(MgAΝX$;Y'eYOZ +87ON4U ]~WDH>`YcP|@wٸt -E5m@}pV1G 'wVbM@D*4 !ÙC[PEg4Ӿ -` `ԏD T#\ku`q.q`13XY- uxښ-g/˘ M2v+#1]rn.cNO2 Mtu s7]T -pq0F$svI[uf?~VΪ6AG ZeD/$H. rAO70Tkzpt;47[ٙ$[&l{ݤkMbLݫX=9kƋe_Ѥq/ݍд'YUkPcwN'>c6/\N{Z;[jP&X4"_<2=6nyw -_HZXP9-;{Q>LLM=,5r͟i–$MRfG/VT o~iJcJ$F.Βe>(k$:91-}!H[5 -$|>hl8R)|a 2-Pu;Dqޕ̎Wh]6Pڒ+)h9;d; o'dۀ/##^\`PO3lE[x4!??4d\{'3W:EI[GkwIhj3tidRŦYŜx#e8NPBzaGKMX֎4Z!NuQ>7u>.ܒE8 /"9?0i|*}Q-OV'bVr7H֑x5ڳ }&5c*"Y?Ӹ|?[|ǝiIJO |&PnW|p hf,OV 4-Gp TJX nGŵ}VADqVЈvijXoZxU7fGg3ƱI"m0KNg^*Ld 09ۤǝ8pCqQ ĩ-rJ fzAS˪.sp{UĮ-{ Yb -e{`Y\F̖i1р@Ns0{].Cq6+;]6$}ʟBpm,/0#G?0Y878w>Ǽ !C/;nGƶ:@N@m/@|IIux_ 91!Ub8A -,ن| T-ɜjq@5"4^ƐH]k\fh |Ӓ?Qzlb˲L)Чg[8>% _8P=r>Q=t/ ;0e/;7+ -qȒlWm\$w2a&AdάqqQOtbިupА b}O40cg<pqll((C, q6[Ǔ>u~DGy2̳RS.]سN6ts/w)5nZW:18XzՔ4MbZ|*a˰Qg1Ip;v?%Trj*v?KfNØAA3x$EfLFu2a4KJ"8LJr[P"'',Bs5wzb~"<0Ѓ#R?Ł ^e4O'<%̡[e\*_hT Wf89Z%ULVG(ܗ?B ire]3Ġb,ތ?G?'5so1 i$}굓i[QM1pBwBnTPfXfuhH4pXDF#tĽ/P'.PBmS ! x$$]2-{&f -j jwu_w݇Se4-78~VGzqA47 fi*K]pSBdвõ|\#RY*\dASYhacQ'UVH(OY 84Yhw {3u᳋vd(½vS̳y ,W&Jvى*S-&'NK~>ckؗU}}ЇIa[MMfLI^HZ8c1fכ~o;oaOJ,C?a=B9չֶRX&54r -nY -kFػXQŰJH'z9SgPۤ8X6Fb"z4p̭TbX1JJ`uk˵XL +x5݆(ikTbX?c7 8g+Гj;>XSk9Cń`uX )A]`VrQX߁"[jىc GGwz8w! ^9McuvzEǪ&7wGNbnĪ+i)s,]tX/jha+{zG}z蠱vVV>W$k7>RkΚjկ8Űbb.[L &ҺTǚw6 Vtx$μ:ņsbl(|=(&vZ -Rhh[ -kkaqiP}DDMt%9VHa]b]Kh #;QMM+Qa'$֕I``A)dV4{9IdTX*_b$T` -%6i+IwV`2a -ٿ; b˕\Kb`cM}1)bwL;?s;,jZ.sg ٭- -k[Xu=Wd#(XVE$NSkNMkN%2_lysmr_v6>uLVɧph{(pYw|Kgڕ}Pfz+a_ևk0MU/N}zM4t^H^k|2OSqa$d!.Z.ݹ paͯęC-mY+iyNOEuүWӁ{m5KT~8,ٴl~v줟~9uPuΜp]§bxuy:9^ME` ^ASeUz{ [Z -q^X4zr'\+jɈVZU3.G'}l304zДƾ M`") #UvPPJd#qZuXk/zz+P@&[ŰB<<Ŋ\! n X;,V:;B?H+.Xk+r*#wΚK䲋`to`u𰺾oi\Đ}ijrlĊ|1FĆ <ֺB߀k9  ֪ ?M1Ljd(SȮ#TSldD+7`I`nKĆp¾t;A#X! K-) OjJ0>=6Uy hT?$ 0jeU%t@Yǂd3{nUrU@b9;'75-~Ơ_ / z ˗$ad 1X04$?N'ĂyniǍ+q1` џq;ɺb#th /QV0p>eFVy#K/sMKZE/9hUKsZwxL_%MW y͝_$l=2@"J ->&J 3~I)D3ұx4d:͗BMGkKA;_ z | RDϋ qDW=2Z"Yiq1:DD}3i}pH\N!z䱻JNa..)P~WDMrX6 y8sڗE&8䍱zR-PF4y%Т԰_ul0Jcu[dd%}:S,fiA9n&9WޓB4ss{Ag*H[^&.\-=LziֻS,^jie)C$V҅ -ߴX6wCa @@f hKFhgIkj6fcn2L?N=c9ScJ= qvHA[|y~ezyhtή(NԡR&|p (0Зh n$;2/Pa;#=:oƒ:c)́buVżq"K4!y@栾:݃A*ep1FLH-Wn=- -hYĽ5 ;#tDRو2Zs߶@vVH$  z9_C/ОW,v&Z⛹PpR~SWdh nCJ2!4 -CB 1!/p@w6DRD`P۫ -]tP` hƻ*?w NM~) APXE5x;o/H~tQ -my N)&/;J.&*/qwq!KUE y0%EӚP -:oJkRn"YȑiXP_&Lik4rr9$  *3elݒW'"`|x($gAa@GIO?[Ec)G~d%n$h^Fc\j+Sf /NmMF0Qsm%}!KeeAъۆ+vjugƞO2f (:יPSMn@M В*a/J&Gƙ$5,+S{{?‹)8Į6l|A;`c V\tZ,7';.,z OK6kQ)^H|-@r>Z7hr>Z>/)瓯{*]|O r+Z>)|O:rkZt9|- -r>Z7^e|'Z>};̲|8|t^h/dK#usqA'屢kOZq0@,DP N --Ǧ TOeSJGP}eEiRR,/#Dn?lwt҅lnL ӛFKT{o1gb'-ѹJTQ`~Sر 7_VwcpJKިUɲ R`^PvwsۇQv'(ۭ@;IŎA—\u ^kbLJwJhRX>3 -^N_nmԳ1@/RLIW 1jKo[F9Ph d7} \Z[ʧ;}˼WM svVM2R!4Y X`hRMh =" ^| - -kw큨M:Wxc8N!,7'POLt;N 蚗qoJܐh -UQ@Y/(zeQh -e(ʻ?PQEyp4<G8ů i2dEBw>Ls EG!P"ybAHNL-M=.y0с  WWB`W2JOy@WTmeO1@eRQYGU-$ ^;2tīC;w}*)85:;4< Uo4'Uvו+QI ׭T -L",^ew9+!h_#W.H!խV7@2[~G4ִeԔ -o&wc`A/plUXUѾ sߥ =Dw᱀DylGRMohe ->c1PG3 -A,}[^qb]S2Ee=)Rx(*B[|C1\'֧7\4lT˴r߬'~ lz7GxٿR޾]A9簢>In_O8Ǎ#VOO<@Ta}1 ĪD{Aa;/*su¾Wb>'.Pү(E_Swa&ݩ-컞1,~uak -nd =R'f1JUE]닞9K>gu mlU_V'BP,tq_['>i}>1rP[/-#O̼[}D>"}ڍKmU(5}7=Fi1}zy?1.常Ҥ?H*a O܋{[a $$enݼWiUpTWJJu[~f: ]&Xu+[I(o{E8'O]'6;ބej>\$ZGĻOnO:ɽv>ʍu/{SV?tF0ZoD]pD -ҟbƢ{k7g?zM+QK]lk)ʽYHg6G`"ƍj4G\j%`$%yYT.'i72b ãL -RnzЖH7n1My2վk]خxCU>Î($9«$lem6 dvs]/*Ozw^x\ -N%%Ǖ[nJc/|@7ɔP(F^q =c\7JIof^$[&i8x&5LP^$wLZwe {e/nR^$Wb\<n[)O&v/u{K -nؾYvm\)me -ip }qU3g_LzEU,J[ HfSD{Mmʲ#+ddh-LM "vG-޽h/Jjd~ &q0x - ? ṋWV'.WYw#wR!S,`Xo+Md:k*.ͬT,h׌40>nu|%lt|>]r8]o!+]V $cowӱHWl+ܦ^V5H>a -U`pR/8bcٿqJ~)]3VIsi*K$>{5򺵛^ &(&(>|a3V%˓&2#lCYygx)!]Ə3f'C)Oz^j Y; v>!}x{*TEOIڠT/DJ;wՖRӸ}qi|g8Bh-p[ ]A_|~'nU1LGvJ6?IAb6O_D7JKPw$*G*J#es桒Dou,SRx7Rr$Qi= q(G|9]AIzDI?^tSt=/27 -! -b\VȆrȴW^VHs1 +=e> P=Q.< -cdo&\*MPqj @=}e_q̅jąY퐟ąUtR[RIw_x(2`m{/En;pC0E.pmr+vj'/<>}mv,(+y.X7.<WI^x(+˴䪋K2VɬLDiٓQX8ukLiFm®%[UxUiZ -\ӭ"FcPo=Nޏ*ӮVQZXp57z,w`/~?-*V{XםbE V ]Xmc kXb}N"$/XdkcìuLwlp݇N=Q/lL~`h(֫;1٭ۃ~T{je}L]>3LY=3 òo/-U %ڧ2Mc~Qz!rQPAch$kLu,zҚ]pf)WCv+SMUHR?sinV ¡=^1(mO͡mt,-*uu9'-vR. #7`YoF8Sԋ+|50'-gҐfhȡゖ -4Vʵ ->ɮd7a+1Q@[W 5aQMƼi7 ѧ#˱aLE鼑U4 -|`>(+Dy6̙g,><_  ̞pSЍ zPD,k&@O3ӟ3xPWG_Q)InhGEqQT:V%;<ς22krh}s؋^7Ú>5 f ݅DKAkoaMvh &X`}p }X57MFz2;n8q=Ԥ_h5v2t4'=}(ق ;r6O -Y#)o ֲq4s"LhkNaO&X+f.M1Nfq#{|`\$d)j(TԐ?TqOmӣ)<|O3mG$MpӴzCܡ=X.mv4˂oJj8KS8JSGӳQY8^LOZc@?c -/[ah8Ye'"ݠb'c*_leGU}4PZ`־llTbi6-E9|h<{=FfVR̜,Pbm4$WzK-0=Lb͸=7vZΠG LW A)UAm*lnrPkh0 ?9@vҦ爥I%\cwuszVCmCaMDfq,p{q)hct<=Ѽ͘}9<=~#툙Ti?C7N;ۭQlԦ|bx@&y×C.2 -C.TA,p8Do'!>+0_',aC Fͻ^r\ -;t.qCAcꔑ#LЗ2f0`UxyO81rd@BzcJ%2UxW[3]WJ(Ԃ\bdrH鸁v&^#EcF)G;h `xT#g4re<P9ySǍ)~ c2eJ#c}D`qa 2 @rL:\J$C\\FfURY|rybo*|?dSp} ^R+}#TkRA ]>#L;Q4:bntv@Z^< Քt6 SqӍe2L\`.qd9(A\5(~3( ^cXhw+x 7}<  ˆ؛! =J6)'dPsaRH`.lRPl'hQ -hor<^ANi%Sf4@ٟFMV&8 nc lBiL+եӏ4 ?;WdL&Q4pJ1huv)H0 -2-,i 6qRclg-`X@^ {"98=gO޼5$:ETl({ѮތhGQ7N9=q+cvϨ^JaD?$HLU>'Gϳ[eCS:yx$ -!@KΣŻ߿C&ǽ.USxw8^q -PhY)GR"!""g_Zn`1DJ/Voc2# <c;Lpy8Uoہu,ʉx.ܒ ʣE;..F̨6KDD -?:ekH7/cP7C5&& `gq佪7a.C+ Oki!ތjmP8N.m0"=<@ -E] ӾԐ C}=KKs*E1C oCh?2f1jL$|h3wxO6+h3![,j0T]>!j]UIvnڪ=Fs{8;0騸eK̙=m<׶XU5ǞJH;| ރхN;TEƞ ơùWb"ъ@a) jqG#MaHЁܑ^qc!BoS4f1bO˞ҊqƹDR@euي08C@Hup4@+\ZpnD`PEψ]a7f;#!M jpaHĿ^`XJXVe sΈ -h`ئr +4tyNHqړkģF,:MJxK&<{*Y+ⴓ?\D5(f dRYO3] -.O3{i@Æ +of~TPgn28Nqs|]k4&Nvjpi&( ;]vUFG -A`S:mГ$1=7 T摀` ->'jF ehRѝ ' '?N^8W~ #G]Tږ'(މc{:K9"CJD 5jT_lF+[@mJ= -L4yn %¨QBJ4ZOP R0 T .8Y=n -SDMWjets0͎R-*aԧiӯuH3kPcF-)cTm:J΁}VY' X?*Kwx6Þ`[Z8. K.x?,)6DyTI:tZS{u1O]`~88ҙdPC,:uH_/O,˯%n0&"C0z2%dn9glԶy\ 7ag͒ǰe_vPWn5=IQ$<) ?)*&e F8zQ-$%utᒊ-5_Npw ˺쏰ʻWH,h@(:t;tJx{㘲A+pn.H'SnB:T*7d{SJP~ j" -b Wfs]zʡ<ɯS,$m@9.jk٬6Ț2<3NQDs+ ni̵az9wV8y>ƑMCn!}F2䂎WB }x>lTűjp9Z 6TEҍ!eEu 1j#?^ī,yla.N ƧNod -,M`0|Bآr Yə i<tS?Ki3w -m}hÙ)fv`y~o0byh-G4$kFvYM̍[(oY*(rxo2Ep|Ԟt@ '~A6/lĻCg,y`l}ǭ,u)!Wcp߹OC'sxƆGl_Nv<|&-M#h_Q`1a90X&LAIh/^<(őʃ= ^jLs@"f@f(o:VSQ1]^O5#~ZBm~vTD]U^@hvd` -.g \@%pnJp\^n%^HvtჀ` I󓀢>5؍4SPSn4Pib3_3"8-X疛32qpdE7;#Jv5+=7.`h֭>d)2g*U]rwF4naJu,U30assNT%⠀Yf8A}RԳ}Br@M3pCwNVGHQ"L U/,Ƈ롥@$' -֍Tn/FJV;µ@?`IjduB/AR2\ d%R -}hBg7 NbԪ,{v%k;& N J@DdL4azٟ_>lIG{֝{=J;֮jg!W!rX[H/MDc#$[JFx*V{*\PK:r1/R!COTNl=Qh])~nzRntE@/3@ +W[4&ǽ[+xJP?ʌkPH1G:GRgrD%~J Z\D?OKv8-웜.Orh1[:> vS+u=}} - ^U+ jUӸq\Tv|+\洓J Z( -jh`a>m<ػ@-l!b7 ~UyתO -X##x3Ģyz[L/zBE5el/&A&..s~X#q&i>ZHR7,o9sBᅓXN֞f>=?;F6QN̷m+r**TMq$d#z/i6Bѫ:P:1JgUd]$|3h*}CMi\N=I%ޘWճN1|U~=U-9ß"w7 b't_l"%}Ay4y"+xs"}sEPʌ%/&TH>H%! jソfu -"ǿvӮ6N:ɋ׻zONle歞[mFdVoW~OGjjmDC/YpS9(|[α,\eaOE_%n@Z%%N@~1 -.v@vEjoTIS<N43*c*+a]XRB4Å??)ъ73qsx4>͑t?F" 'cq3b.>xnpDBF!mgFMI)>LXLWZNZ\$"NB*Պ[ZL=;sQe]Vnsuo`l؇^Y"Cz?}B \5gO䐝=098[MuO6@- F]Z3PV'FfNҰŸ́ʉx,j&2MzG2ssN[#yent}ĽWOqЦNa2ѠU|Myۇ?NqmDU~c tL⽽$vg&`_=lWZsO[v HQAJ|ptjH -L;j/ƛz*- :ZQSj[f*U41JgF/L8hWD-Oe@AJ?/(I!yi-Ly*b&xng}=)!ʝY=Z~;oCv,u*춌$jQdp u*ڄU_&my"aɉv:ORom7hIҜC.ywr*_Oz״bM)ͼz#3iRϩ{Zw1H/{{(Op0\/ED_ vCإzYߜ ^#z0_.O^r}.v#Rĵoӳʗ6(w5Ҧ(6?-k4Axw3mrIq]Ӳa~=iFCb ǃ-w1,O-^P<ͧo7͊ r{4>wTO_ҽ-y: q))e]ㆨQ@/K HMd@fRj^a4it\١q;^{7k;OM^ 0Ddf}%)a-穸`:޷nxCIiPV0P7y/㓧 /<#;POWDVT Oμ5t]~ pK%z5eeinZȳ5P5Vuf#౵naM=XԢ!\73ov%n5h'U֌sQh僾B!4l"7mppuJlZ| {Tbg1LfH\_E&os*jDߪP7y#ǚ>mY;inREn}YT+aԼXd9{t {1r^ MzvQS)~oۿ)xi1?o_F`nѻ< /E]8Ϗfpt=?.Q*#0L4?ya?RLʦ4N 8G2ǁP"G`wj$3z>OCn~#p9я@beMa5!ro3Uan?Y{ry,rJ)6^ -)}`M%oѠ ًvjy;Đˢf79]Eo'I!g eI;: Ul,ScE28{@t!dz$(eVKՔܡn{0Sa(?(P Gz|>FHH4c ~O^=RE~y݇Aw^S])?@{T PًԨ#BB,Skr_F s2r%¹7Qk8wM{v!v)sk!fk&bh -lGwjJ} ; ->:;?Vﯬȓgb4ުnԷsY]m`>]Y'EkD)JMGֹ0u]hOZ]]CX͉NӽD^'4*EDi֛Ĥ;-Gbm:c}&GXsE/&t5zISoHY=(qGAAH-w!F^hD-DDK~?T^9" RX֞D 2(9W,P%#Wݕ)i`]TT_ \o E}|Z]$G W9Hv|_G2IlY*|W nSEMO, -9jze[A6w:6\-LUEh2mM XXSGl< -G{݇eiKƜ )y -a+tPN s d"+gzBRg2'xեJu?w|n}A!@ !~,55^>iqh{Q RPiJd~TRA,4(%hONۡZj,MW_D5!WodRd\UQ;oVjqs@3X_ּK- -baߋ`NeNlT$\:b%.&Vl|QTqH,rp?*(ň`|2AUUWBAc?eHGFBfR_h>/6NgՂ -]UV=)Ï/ RID1~ƌJV@vDqD6Qj3ke^؈BьgE-'SލBR;i2߇>~rW+-jf vEˏJW&&9.%+ ^q@D`DO6b11imQ3;Q8O3ɽgoQtS}ἾtHb#qWٵ_hn}& /nrJމd3/@ߥ)l~tJd} SJbx]1SNx(ZO.ZZi(O6>%qrЍX! "ؽ:@wPB9Q-swv"Y(AjEd-Ag^F +Q2̀5c0M1;x.l}9g\mxd+}./?|c;D -Db_*j.Zhp}NO.^%oю)F:kZ,*AH|hA*Sg-eY\Pv] 4I>|bwn}%PB"/lA)J1]>pb5{Cډ[R)B.wc"zn^VEe ʟKrDƀ8t]UK͞!B IF,P ؜Q|p;5r$EhD5($'tM" 0d# []/llDHEXd?5<6k-ZҲ`"˫W9mF\DԳQM;i0R[ 8N%wݠLR8v47Pq#=lH(Uspһv8h\ y -/S"{ uvePHj&M ^B}uҘfㅌ,դ(#P>*@壼t*H 9'UB&&(utPJO8(SoTFҢ6W`P"58Y -#nq7W jŠmӓ9)Pi ʴk^As4ZNjNky-뿶vZm9oGeZi+>Lͺ%+G -d7o+h_ICyc磿cA=080(,QKQl|`qd˽E8(EBta8MpmAntT1)6JͳjB.N~sAjH z)=}뾍Ȣ8^Y QۘѩC/uO~_ _8-}qCmV]`8nu"2]c/' ]緯@ƻP\}K *%vh%V2倞d*6A(^G+TNB= o0y**@fWTɉ~kY#=0 -/4G:E? |`= ل&sS3j"(H3wq&=rPƣ\._p,xi0sga{%uS4. 'd -o7Y$-ʩ!)ceLbO),DCyAs:O$ޒD ݉nr#fϞ.>DI$z~vz;c\yCgaFkqׂstO\M}yY_v8[jՔUe)loLΛdy;sj.9ɐ{Ig\Ws]襽[$8) OZףTUu5R6?U(%~rwhP ޝ1@|x$C/8erHfs#48`,yhcNCreGFK qIr βjUK/DYДT]^g3w,r\Pj[2/ -Clt6S3bvOC^'6e-KVbK %gp%y xgm\ jUfPFyu -=T/%ONKQk5̌Za?hh?g0 VL߶Yj=`~Dni(=S'C2 HM3VK- *gfmHznrC-wu -7q\4|:Ѱ\LCC!b;ubݾy--Lz.+b/s'bYΝ-*okܠb]Ds'b Ν=n5 MMwfn} =~=pS" J -bnr% Q]mnߦq]iXrnn7l\FzO\1Fl̀ *ufF{5,Ql̀L>}PqHd~š^Z|MQ&T.RiKk ϳE^kUOI[{ \G2v:$$y2D{W$ChL -p*{Y@ {;QSTSiEJ^فzbk'ަ]q*7Ή\ܾ:u(qNUϻy*2G'VzbW29V9HArޢС24ތs M׉\Á. yElG=(oGw,WPx?};kiA*{ 2bU|%{~.I s2(8ڀ]ϊv -"tww4J;~j"gJ݄XHjLA\]/f$lx>=l>&|[w+i=l N<=;;'Գȑ蜋a4&[3۷diQɆXMXe"(|Ys"j~XBR'=3J*צONv8CBҭEKzi@]eϷf%3%!T5)=) ~6.vW;Z_ǿvӮ97n4hoL BJ3Џ y;d|Tll"BrW)~_B5ˊ*^2+EJf%f\43($9xqu%%$ݶ],욚 U^8K8\!y`~j^cl5Ͻ:@5Hj&K8 5l@mDj~J]</zu<;M^A*:kO'4*N("}㔭61Gov \ˏUE4*rKdS YdU2w8_Y3PIQ#u4S`dFom@O -x|1[=[ : +\ E×K&hr"L8kCbrr Ly) >X(? b)v4bNFfTo;g>:;$#]g%/.(g-u@Iܛz:lyL(xyqʢD7"[޸[;vsoF}Eћ[ [㢈R]5R_`GI~2{v{C3dP"Gnc4oGzw1PUJ5h)]`j[&EА,gk> i'ZxT.f,&1=a ^݄ϐIJLizB1]k RgѯCF5JҮ Ji{%7i^z -=W=}@ZE‘ϝQQj#MX sD?SIF‘}3\}qr[Ou $cQ#HQhхrsHrr5z]2د/ĻmmPyyaD\k~m>_> k_c6//. -^exc[~+wviJٯ&&XeN8/}@ _'_ -> 4NGեE%EݣVRm`s"W.UK_E^J>*Dai:X-F?rEB(_DK841Hy-g E ,T!LQH"Uaϓ* -REH0=eu7cS%"<6oǑ?jFk;HT3 "4Voltqeg+9;_/~R/0(@:ETm)I:"`jf򏯘.@:)e *vEhW;3zTrX-KHueSō -GJ-iB)1T]!,LbkZkg8xP'`pFeѠ˰k +E"M}5W.kr,ZKQ.~2JpT k~%sJY咽_=F~`Ӌs'7y9;6=š-$7:Mff=X#͈ -s3fDK]G9ع!8#!pCЮC=,'$D>zxꄇ@M):+w-#~ӞP -_c%Ṿ !GIpxxp{=acp?&1@i1H9 Fr𢿈}]Ơ(l &97ͧ8uF6> ڞ56z/{1q"8#ytGn_Y<\ގ]1j|._#=11m#=GziF0c7ݲȑe?YKf_ҷ> ~?m9Fdģ6E%^~c O|5:Yf2:.;>zg/&g}o'_:|rzE{URد_b-@د/_~}}z%sW˓BcE%){TFCZ7؊oc6R%sF4'p\(س-j8kFJC&KoGJ~a\ܦ/rXCW%WEGD_ܛ%מ; Eu\ն GQbT˱tE-,MTٶc:2 MwJnhf(/dB4ux|y9o9Wu\JK d9n;;TWps횦nںi ȴ㚮6IjlP Gn]Td:\Նb+%2\˱USl!ȡKwّϘ *=:ţvDSK|RJ)qhWN=;A%wUUveC}*L^>\8ȉMo^>y`=dc3xxaiSZh>]~uS\ՋqPyb>$|pqwk2?dP\]+OX k*6(媮+);VJ 4يa.cnk*Kxq|g1ei>,bx Q͒ ؓ̒I-L0!zr ]w?%h 2-}(IsSF wLE% 8`ZHnfJ)&P5^ NVT]5l 5͔:8NUagHWͭ{hk|5uZ+ijI{s,_7/3Sl>FI=kޗYS_Ys92uP5\?xyi fubpCvSGLfH=:2 PjL@>Knu ꢪ $$[>IO@Z uʫ$]5,HɺjCR6lؖGu+Ii^̆K"jjR]1MOZ ޲ [WL`Z45˅>M%A<8@3N-egzdu04MwTMV%Kiz%?.(ћ;QykHb[xg>IW{u@x\h שA'?CUV`])i]Űlf[QrMuDž Y5]u@2s4 $i&uM@d]]IPd 6 k IC_-WeJxt=q@ǜZNtvӴ#5e :nqwCS۳()d| ՑAS(ٌG٪F@Su - ׅ@` -5!3dZaAA 꺦Y}ty2TCq`f_+b;ؑf:rV qPmB -aP |88xdY}%tr!u8}It7he7?p  X-Ǡs >zx*o6ʜE>"Э*w:Ɓ^@.qMH45{^y\ !)LZɄQ݀HIDutߊ@` mA04- D-᯶XoJA24Ҭ+M_gȡx~)ؾC1%K\jcx&!7*a\1N%rޚ3I#upjWrqm*ީfh\\ދ.YZ`&NWysJ  -̴?ԝ@n"oY%6VG# h2,|a1 >%)0&54ͪ#ԡXPIT5zɇf  lJ8Y$O "3rҁhjp< q6]In6y>stream -%AI12_CompressedDataxms$7&]fyL7 on2IV[2IsckeT%qEֲXݣ< ^H2YU)DfF p}ݫ/ngOwwǛ/߽G_| ێw/{{u{덵[}jOw|+~%xgo/woس|򧋛/n/~5u 9Gۙm-7x3w7n~z6όMp muֹ[Cp<ޏ!GkߺЅ7llPlח7_ݾ|7?_l~!_l?/y~{s{_l{jɗW/ןǟ}{{pn7$ϔ/_]_r__oL/wWׯ~ X!XF(Ë/_o/A7?bܜb+ݾ.tϾ~wݟȿ~q t hй`FOM7%ѡmpM #'Cpq4s8~2уz8xuNt=UV/[`_}]{+[kO[ o)懿|{^vf?[<3-(7cƱێ>`F7g!_/ru_o~{scwwm,]7ͻ˻?\}9&k zn\f7ݏG-^|I14Ë=ﺹG_\/&_2gLyoƒf#?gww7X֏W/L|z%e& co^[-?$Ѝ #?IqOa1i-EݷztV|&޽~Hz -?yu㏗w6חqwo/n^|GJiαO|j=wzZH_}ޟ\޼xk= ˫Kr4ziz-`Hm=e/|9s~hW遯|wWo>5ie@Ha-}("bEzȅL20Jw]tܤަoKn[^]x}n՟w3?e2~.w⻷ 'As~ כHOg'>]~˧Pc$W'[N$Ԩ#飓_3kԼ|rH ND=vZZghtZª_׫\/UW:?v1+=D.:좷_ߋp.7_pg_$/_WW/DAC7?՛_=o)oӗ g_]^̪1~?O?a λ]4 x@/׷o i닛ieRRM?&,GoX|uԫ.LN?s4cZ<؆~۟6^O7޴NGϯˮ޾^ko=nU|uG"PqzI۾mz&|hi;_M,2{odry~rޛp7sʝMzh,ֳgK4m7[~sG5`"h|d_F ^4->`6x#m/ovՖrf˯l2ހrM2~ٿ5/_t???Nͩ=Oݩ?Ni<OwgϺ3sf3wφpƳywnygܟϟ:ukkkq\sqY\W9;f=v>a'AaAƀ=9`gzOwcZX}gvǮco>Yh-? -yGiyY$>B6؍ݮN3s4og` 0;7niJcrgAUcAlÂ9Xl l>SKR˗װBuC<τL;!0|\NX#E!\$E$sdk䒡r r|E|k?]mxOM7:8zG%XÍKp3лtŸ [6ye{YaFߏ? %7ٸ ֖>|WK[z6pb6 -9//~vI7Moö vxFY~1[ߛo;xc\æ7߄qyÏ0?t77/_m~m צ)-1)A./'W/S@re^!@;H[ vAr0ltdKO$TBGtb-6yWhqNY:o]hPWf2=x&26I*" P8ϤIV \ -$ɤA+)7-߰`Gݞ8p;S[튿u{n;rk[j}˖=N8tQbVo`ѵGWK++4qE\eWAOaP]z,vq]q8 -WPW )nuioXlv2Rr,IGJ3ʳ$ќAV˒\( - ((㒔K -t˜K2o/"r/>J$LT!a"q$E2R6&x*@}Lr2JJK"1<1fDqR}D&Yz&k/e5:KDCB]IBƂwy,k}7e_tYg*.T:N4h*ьrx!jb^l%{Dl1b9[HD16cI|DO,}uv3/' H/Xlx&hp;bLG00`0`Eab^c20h<W.c|̈́|tN~c -5N';U ;ɌU\v\q2 J6!&[!9#Cil0 b4Mט;14Rϲ1U A2ʫ<9gΘ^9cـYLK3CfmDrZ'?!j+%\*>sl?GM?c3 sVMdiU|ӛ)/hB܆>)Y9c!hݎKYL[1zc&h\I!o!_Gt$?Gښe+݈H^ z4gOEWq]vM-+.]UjKi+#ԒIX6=1-n:qSxqQ{]LjvaZb`) -Γ88`ӯ.|e -^_A]y -w]M⼮#1MPyT9(ڦŅAA{G󏬖[am x0 T,M* tr헡\vL0%|z -݊,~b8v7OS#U1;X8y;(rz_Jc~b@1Z|޲/ɐ C8S\t'3:}e-7sr9' '"E:9O# W\xS' +|^<҃(qat+ cc1:ycbPOQ8TuWqbKIiO#;]kOt}9j\}+i|Tc*A֢B-/=?H[ɝU5on P~3 Ccm{?S븙–) S2%ֱB3SxftIl5K0nkSx|=&Nј V;ebaWbѮO-6euPt|Qs >u.ND$R BCI&`EG|TkcV?f>V8x7dX7N@ ږpmj W,&ηTPX M9O1qt|e|n&8?˵d9 -$3.mWC玦/sKI\uu'>BO#8>BO"< -2Rp!Oɍ}_h[Mdn o ןNmC=N6cmO.O.O.O.O.O.s|?\\J\J\JG훿)G{/-?nq%v'^+7Xqΰ!V\b[l7,αI;G|*&8ç|23;͊3y^;bnrg+"͖(kf.~:W(әqa٥d"++i>{6Mw O]X{Vd_R"/dW? !N}Yh{mtOyz_IN|))BI$]pg}prjfl Yk I3<-B/bncIE'<ϒ)ivncSSzvf!y%1_ +j 1_,+#7w~˜OgvFzڧ9HC- tnv[炜Q= }Sl&&+0Y:=zJ#E9ؾ|rc'мBžCQ]]گPq8 \+#l2KR2uɡ~q2yMgFQ(n2{5 ^5%QPxB4NV |t0OPn9:Î|Q.ν'ɑ1 *͍Hrs0@rQ -0%1srmVm)n$7%M$JvHx3+Z9"*9Re;]\K!Z&Y)Z\- ҵ%R{e 6 8:c?t)u54I#Ccr4>_"]Ĕ,bW&.u֜&Li"k/R Mi"*M2QDI"Qt" 레竤U∸H1 7S o/l/jҼӹTI[2Z&h4ȮT"P̵$KH)dO6FFe2deؘM*Ԓ|ň49Ul8EMGfL&QrPphR #hi>Z&Vp IAKR -3hpv^0, -LbId% SrZ/2kvh9u\k9]a]B0Q?tM->-kaD-u^sX{8%l;./`-swuC!ɹ:8`E/Lb^&p])kuPM :>w(~<.PȪ:m`~=9cU m-P¸j-: Vvصg 1'59E)Qaj:H-l{Ug1'iK2,prliYߖuhbi栱)콂 *I#`?Gi@琩 ha;RDu=,m6JD,VXygzQf%Hz&NwsYdeQNAc{d9r#??~ qNxB x揻I޶IޮR -@(K:4u a惊L5j@Bx=),5 0)_JRD~4"L.s20!9rN8)OK81j~ޢH{ }rx4>)O ݺ\JJ$7ЭOzaJUbN f>vR?]uFѧSDN}:EQu}:E7Pq[t)cO)O>"t)O?9Empfx <8v*ys`Q}(v6#Nh,  8(nBֵ'6i9a`3j3LL3m%\2U].eV jBf%d02gv'ڒQ5E, x -N)m_w SU\t _DDEI5hgb>QJYf -SfOY_{v+:_IE+*h~TH6cʠ6kO5΋ g:Fp/^G̜f}W,i4 EbPWɒ*~360~*Cȁb͒h::؉=aM{0A[H@z/3bC0niRX莄t$~z =CN~T;?4lZTl4=,M$U-Q-lM|[37u!?,fy6FUh6uZSTxZ !/_EceLC%KhqA*jѐD w[H@YKk٤/E嚒^>Қ@Y~gjz/X@Ohqi1{PoCiA!3}ąjGBG(a0J} WYR`*mZװISBUىa:x/t_`H> @N,AN5Ѧ$S92Mhx5룄Fѹ~F/%?#C?̇«vHpV\-םO-~joʅT2hv.gfWX:v: -̎6^U~s8f['Z͇&HM΋tnF<|]9&'@y/yxgʍ"g 1)y.%<c>C.<-F2Ký5lgйK}R38w3)wh7bK朡9e gUIKҖLyBs?Z=!dxT: 0iRxx'/~{͏Ϟ-I~|קﾾnx~{}u%7BucܰeqƏ֌@}gq ΁q?5yK[w~5o{c6o+m]~ 9ݟ]y$,Nכ/v_qk⻫\SUNRTتYg8yqcbbq xmq`t:; wn>w~pdhm9M 0ؐ|&w ]> >7cа;h#24Z~ҁ/Ei( Fvb0 ?v-  F y[߃ -7ܿc-`1I6cX`ln-gڄmGNe em؂;%<:Ls p[hmmX:p!b?fK3HR/ /zWat7 y^Bי@;n39-dv,h15!PqL}$SGqKWà-Š,v)1]4:3TV1܁9DD1*/b"ؼz/MFH4DQΠah#` E zɥ` -F.楼 -PTHAC2C`vZoʉ 違^\0X KF%3Qa;Z@=tn7s3kP(I&Pׁa0=B0<0E;f`0v`V#&vA3h.;@R1ĉt yuxw8GGGdLɴx@8tcwX8;lKQ(4 1La|p[, ˍ |68&1)L ـ] c&,$ b\u@NkX"& w  "A~q|C7ZZGy,E>Ȓ1)^- y,\FcJCCfL;fo$cu -vZg@e{ t -&E6@4x,> E#l?%lM zA gel(8fu`GP[#@<"{ e-XxF0.:!D(&I3lӐ@1"@N@I$X~XY<QMLсi@kt9:Lҥc$qtBO" ug:<H~H0Pd@ŷw@R<7׿޽teQul W_}9@g0|fW3ۏ@Dej-5.,}(0gS ,(BZ! 6 @X?l}E4`=FRБ̺ʷt1qm{f`!|,x`2<>bA#3 -`k7HIT^_Ls{}Ϸa77C1+HCl(H@@`d;_%أc/Ďa *PhXNkF+ؙ.ʑ݆r -a PC8U7֗sWb]2+ LV)F߀׏ԈH{2Kh*0w6:ؼ\Q9‚u  G)/ % D ̖_HR6Z5THNNnaI4y(Ρ- <= #j3KgٲO0$Kf*w#{0' '3d>"WATБ -`a|A:9gK7.Xp 7p^6:n6ohɲQq[%48Jw{h.4?N,Mf)wx:!-뎉..Oc$/gK d'<%%0}@~ip}1]ZH# -e8@r%]s;HMG -y9FG1tǹ4@[issF/=32<`!JGԢAߦcbDUj-ЏxG_Hfq?!_v@Hä{ZXA8Vܤ){PO3 ր@=~"-[UAr13/_ELtw;!Ú5l ,z&=Χwxȼ3# Ck%粳j+. 4Ct2@aU-aC&ecr0m/)=hܯ8=6<Zr&@af ɋDkKAH@xf-SC?I?0>J9M*XX=(h/+T-`^э _!0A,=g gF\ %d/-Ks}gfsg;fI B: z2(HUEFOzz-V'nFldq8Ic'&9?7r~H[ɋI'' R2HW, wMJ0 -T ѐfn,9P:p3/::nގ?ФE2+.Ɍ@ψL)!-{O iW -`P%`{ٺA q=-9 +g퇵hFŅ (JpbIBѯ ;YJB,At&9 ,H#k -NtU -cV5R[nhyQ2NJ5B,dq(V:eQVhs`N,]¥w/am{nÀG GqL}\J4; +HT";bm@B$WqD JyBhy/J lx?Ɵ6 N4d< -`a׃`bC˫Xb !M;]-AlN /芤bLELQpH`1\2gq< ˉ] 0>Jg;jrrë~2U:}u-!{$hc -I^W?K7lOFou}jR&{dPKBw}T \/+Q7YA`GMh=;峥QiKS':44hw*n/M#Ʊ##6jrvgG~8o'O -MtzV@sC8=Wxbp<@ B\*NF?#@=ځ<0CGkT^Ca'y5:!4q g$8+Q"*F,9ˬ)&thG4DoRC5!pXz* 8X|]!3Ea39JQ(OP 08Z& -9ZQ'Of -rhU&}:*QR>Fp8-A[c6n0tQՍ Qhae1Ri -mB9IY짵ZFPF A&;MUF$32paNhd Nmba'0̌VF/dBb6lÞLrot@J[(ZG?ELх2 Q"KOg4+N⦇dĤD޷l040x-o4`"S>2b"Js"]z&)!R,=W'vL24taP(u(]-}/ej9cIcG8F2FyAV0CCA5Q)2`nȔjĈ2Zkjw!x覡T."@1N *v$o'.aT2!ћbD'.F b `x 0CDw:Alq<7X7m!sD嚊jՏb嬆P_g))^䊯kh( -C -hE IJ_uǻP`iy0wGr#7  -MB[i, -4C`Rٱc}G=^A= ֵ!YBO,|:d; e% EL(n\LUCjx8^?&* crjۜ։P,e4\ȓ$L/25(buG5iu}Lcvib %4{HH@NbAE vHG{7 ө;غTKizѿK$3$Cc'5zZ<;%x7q!W"gS#a%n02Րkʶ6>`X̶_ďPEYRCiMm4y(}lM(^8 {6Wy 0ID%۔" -!@I:@]| Y9ǦgpMM1ޥxt;2^}{$ + -qXP(IfPa̢ X_\qqdAeRyNv'.yFgPF (ؼB< ɠK+Dۃɹ(#胑crB[RgSRvq xrR`G'%`.9C0w=я}b&. d\#S/*tCMaNy/X#J]C0QFǎ9LYf#TV2̭)<-8o {!hr5$s°g rżi7K#e6y4N# ֦X m@N2NFd}H4a#fcBn _K]';9hpdN[+UOABDUc|QΝfMy_:nS (SF2zN gW维C74`Df<,[IU+ <0a=Ϣ@nI46cV @ m9[rؠC*614!<@jUTİ<{ASugbI.LAzi?n<ŭH~3+ H;L'\,cRkdX'Tl)fk%jzԻjf <`jspn"T:b -0!v3DF^i{"k<$bh4'WK6Ini -e yospp$' :7:6? 4l :^H (i+Jns/oē2IvH7^T fg` Y#"F6䤌)YoFE]._DdQ.~P + ,!0B?<1ud(g\8OP2"bWQ5|ZJF -bh0>э+7 bt\)Їdh9[\}'r0/@8+0:z;d(j"(YNT־2:!/W' s“ F891zi9IG\>Wu91NUGpDȫ0(Ys"s&#=s7oetS,XsB69NOS UpPS`{rx@yN"99ҷ|$lM?6$ -96Y=Jr\c0e ' Yf[D걒H3 n4SFS2N_'Be{Ic`j=A<,DEa4nQw`)"i,i42w9f>4SZڧ iu ub[6 KN[&Cs!RMޑRUa0 r^< /B<<$fufR`AGOHAe1uxxN$P]$,&%DsN9lQ9r>A>ȢnL=5Jf#Hg%kWDneMP M#҂<YCiwgK^kRBvNͮ0U(Csvm_FC9Qb[RZgVmR#&. eU O^Bd♒gJ*y$GM .ܤSgv Z/r]wRC7x4L<\o;"LE:*e)E)RWE,H|HÄϥwR9L;[e\k:kW56fOqÇJ@eJ{sUD#3^ɴ)+ ;JqfDrU :"&%a #a5fs!fezm)E W]sMRi0sxVM9u 1jW88Cq:N[<4Y1اu.l̇`\tGF)L/X+v (XڍsAQ4q'*gL\ zXNkDg:BU4SS7zߩ"8^.L(ZZN$Ƶ%!$WMAӁ'J%1ϵҰ vI? :1{tNSrح݌L!}H'g"= \rCIlJA2ÌA%!C[)p`)oAvkkhW;A!2<1Jcãf`Y@y'{INg^U<*Χ:*1{jL -L*|D ʀNe_*'~,ʾN_r*2uj3`!E *fP[.ەSURP6RAZۥVՀ&ຎYBVYYu\\enPfqՎ2;cRɩzkG¡JW M#)IMEQ}ioۣ`'һ3jb"[K+v}N5?NPk2`T[y/[*TYdihSij-)Cʟ͓_07!W+\(y(J7Uo2 -%(PE +q qJ*nB:BAhD*Cw+u:2QǪh$Gh=|փʷUhM9Ց>Z7cjEnҺru@鮃tCu\),uH6^!i uH6p"SGխ :9OفTО%X J*V[l_:Fi;S1 NGlTHf1 NeRc@:T4U쩲զ)UEl UZYx\eVʞBhJ* -Urn%\ZUuЯ@Gz>2QP <%[j5sQ7^,nS4J[0g9(aQ)g$X:-vG6vԾ}陝|{I0f S{eplMPP^;L5SUue蠗< g6N:Kɐitw/݇SG5J==͒jT/PP+t*X]\|-R;?!o 8E,Nx;ߨZF\yVēӈS0 hӪ! GX[ 9@.TԪJPu ԼEr!)\]ccpX6]Z -= DƋ"`o"dQq ݰ:x<&eL cULSJd J.xcU фبA8C 6](z7[NJ=[ cYB}[P((u+r<n?òxa.5ѠTBeM깘^t`fbU) Qa8SA0Fz?HedvZIèS 69RQ1YS(l)9~Q'JTvDY<ֵJ8&JX1 -*IƐ+X:H:?,to#i@П.460x5?631*!j -Rb]yBqo#C5(aI{3:C;K8 C% 1;&҄Wf\L C5-xemc{M^ -kbaƩd*l!}ʭu{ }0EJn:.v+7p=6/`Ah7xd9[#43/~~a^)_NگqUz+,d[DPD]TPcUAmRAm˺"O"ŔE-](7=U3=pf ra=JQIrmQRHnj(Ԡvn{*XAT&a5-r0}m-4n701s< iP/`-ItUSVvCčdLdt#z|F6PKn#*F\\:Pf30Bv%3yJ v+6XEH^unj3Lo#yԡ$0n<}O^CCs{ }]י ;6> 7GzimvX6uD儡6V12i'}F@q=99 Z^f3cD/1USUd:B3::^fRjUrkMu~lMWDۚ>ݚz4Ӈ۩wK * -5)T{} -S"i۴X"Zk?$,f; i.<\HRVh (zpTKVjPxYR)`F{>ei^]I1p Յ& Ln3 cCoX^TM SN~apUɓ`R=,˫<3kBM#XP0Á ܧWBMКFNyNU@x8F&&gc.ozCYf^P$;-婎"_/XӁMm doPÏMGų>4(+'B?q~{on/xsfGf?DV\R{k"M i`eTF -XC - (ᾑAu;hm,@_O-c 6r -Yi.1@M}ṙNAK+Z"fMJI}:(i\==a=#h-VR,$ʨa-i~&YD'%&H< 6m/Ť%n6Lb|1вޞ # ب^QD yn2pAIS *g,Ds [`hIFcG+Fal$àȘ^:G łEb Ϯ3$J2w -EF3 ɢ-:.} Ƿ}8'xDl$#,CyFrߞhSDŽ/F,'¸jb#l1UqC6¹T~~:D/<Žz*QYPaH"x M❜lX#g4صg 1rp0R3DֆAe[P -))P]̩19 m() @yc֐f1G͡cf2l@% Q,0O7K& gXVouze:<5W3)VB1-wd30$`#k!ƥ1,kxA(blQn  X vA0{: -Sds}/g!oJ1YDSL繅)G Xgg>xB ^( \v3LL Un\C[w0DR]q5m<TF. k5hz}B/r1 O=3` -!' - ARU-2:úzױyk!q, d ۇ}҄Q&ВzA)djy$V(:Ib|`2IIz})ėP_ -|5fyWYAZ%u9Wr:+dM曽ыE!LV}ӧ~JJt/DF..eMѷ#eE۱oe[.KL&A}}ힰ*zrv7P}Qw4og5B_OzY(Y5&1ߴv5'+X [FnҘ>yc>LF=kD f{ސ7u^d\AKӘYm -@gڻpL-jA'QjH7y<bL0T0䙨LidAS/5h#rc5I2H{$1F=0X-QdȤH9P֢Nz#}Y+z<6CWSF.Ê$ǶF;6b )00ܠ`+-*hśVZe+9{(g2w0&m -ʤjC` L{.e/"ٜ+Sg8v&+&γ47̤l M " d1ɶ"}KW]dkTOO?h 3O:H'6z&jIR?يlB -xuh7TVdћ̆!web[!h"GedfK$R 0Bb#E@/C4HmG VjϳʇAhztfҕ3@>Eۃ`T~'!,`>$r^98ĵ3*wӎO$-dt),d -ބa&C.JF'LY-*c6s`?BhGzb'Pa#t2U0\LH YvO:#52!)O}i19 -gfcYsw:&@5;0_^%TWIk[@QNcϔ3S0&u -qm.zg& ;yʄ5б-,tC)%>dvr* m%SD5HEѤ0lM.F|W;GfsYH\RUVc-8Kc*AVg$ph*Zv,PPpʭ8a#rwbR{N#o31x!uo4jX> X}xV%$RCeplI#XJ\Bd"r>b8iII$R#8XLeQ^U#NqÂv]4Dd5E8*0tc}GccHB\9a~3dVX;ISO$.Mu -[T yJzm!oRjk -5߬\e`Ya1_ណU1\FڸxR`X;mrfE&wAi$* xqh]@Aemf۔h)I7 'N:(۱ "PXd AC]/{kKr](㚙~˲[ l0 -a]v( -ߘ,ɴ,u+1oca2s2f#kڽ]y:AM#+Lyt3 -'z-)!_iqEcO۫Q́ YPЫ^\S4V̽C.=T5Y~}_DT]8\bѥ{ͥ H -%bn=B٨&vssI)[҅fWȧ2nZ;KaAĚZmtb(sks6`0^Pޫ|cM -eBs wp2VH=%o_a usݪSSnhSk\k=Z{Fw- t. W4n,\&݆LPSE;(Týˇۙk Ϡ$Q2a= "7.֫ 7r aI$ɫH {D}&cU@^ꄝs|o < ? [p -' -h `F+X![E >AnEŭݓ ~΅ .R408h^S\{ +<ր Kf38[`W`8"_C@0! Xuts!P#_69D32z>C _0b/Mq|\_g>fчFD#3` ] !cZƊ9z3B,4yo[$$BIH֕eV1dh g 7G6#1E~(O_tӾz_9wAv|+YF6oQWB(%Ex3sa;<\ ~'s=۹d<#͵38Y00f8C" SY$蜚g"bG L'[lGpИ fNJ۔XN?Deoxl;VV0x%"^1 g1 \dI[!7w~p1Pգ'×33E'_³GfdM&1,mhS<4*;j̖lelaI7bǸl}Wx_Z~Y|{Ӧ|56@H}>zOIg3KnWPyFzi-~?͵ǥ?/7۴>7]-oa!o X j߀QlX20i‹ 7?9RM…Jx&:aJnD7T._~+Gi-Qvl쏕yMƇ].̛8AzSکDM?lt'HQ YYDtYp%_=Ȟ6?K U,Z\MgŋvJJ1@WF@ޫy|ې%~$s \2r'v)RW{(ВG=#lztbҞ**#A6P,^뀘-#9E`D,!n[moMěI:HJDIݞy7'1!ΒEO3N]ZٓmRѿ -K6c}7GKn7͛@>jzIjoQn7+|>0G̘SڜjB.jxћgAV, t&-bϫP&FQ(K)ةثݦ!^ٙNj?X9 m%\Ftܾ~`]M|bOmb7RwTƊcGࢳ -6׷l76F n6XFo -dthUiƅ~ -͌e 8EUM_N%Ȫ7C Ukdc H{6%VZg( :t<H WKE2<>&DO0R1σ\J#1'h,&$‚ -rqR7K1A9-}i5 ~ 貋OZeS{俞_ -OrieWhzUXzk<vIyg&xyMT){VsWS2Y gz7垦l -)l}]#wXE > #yӉ/t޽_&l 4L/&[I0 iVe!WxE6Kl( {2cHvDԺ7$y |a!4ti~: *㜽%ۘ`F%1 PhZ b3pv6 M}pX%ؕâwl9މE6dY_zbY4wEԸ, -O-y "!{!%\hX.+P@ ƄyAؘCKё#ѰX4_s - -jk=,oHG;i;n+|>3/5E0j{4P~ -3|^>2vG]hhzB?4hf)x?0b%O [F%V0' ֜<3lw-3J2e$r7Nv,L^ԛw&6>%'x>^/lfAVک6(b1iuBW&MOh6 m[]5۪;+Ɖʨ򚽳7B4^s/ϓFca9'R ujD)0j*ngV h]_2 -kcV@Z.mh!k3u1x /gσ-m?˃>uX1 FF`8Hh #^Fv"Yv Qcsf&m^;J/YB=T~)욏 ]51h뒒l(=[:Sim|J6Bm3qŌ@Iή]CiVOsa;%*d:M["mnFBZS1D]6'_}ySɥ7oFI]ְ*W.x57lw꯷̮^fuPpd,1}4,4jA[; *snC"vd@rvl%y¥#9.>ˎ{"q1ȳ -1dP UKCd;"iEK؏z[VӔYS:Uj/,"Пk_ݐF?; sDp3(r$ 5a}7SHki=82߳KG}VsP#T}yf€gK\.lDbj W a<)}>|{f=sRZ*v/M7ٶi3 -/R!Qy=5\lG\>H`sppw8wr&+zR,?*[/*%jKZ8>ҷ [_-zk9 h$L&N +|Z'D7rR©mSW"'N}7CU2/zx֪:wSGEFyF|Cb&Aq|*a롭 ]yQ@BeO6{0w\ګ׌lƖ}3ˮw\lꍒ̀ZE'ývɻgʊ]3(bٻ4K޽t(-{Չ);y8b0p[{T`:ܵa4hVi =\тٞ»gb -Twa$tfpC,|uZp#V:D^sZBHoe]f ug`SGGsYkrZkyZbY 7|)nvu>}jͨsAEXnNz0 Z-rMȹ;|Sd_1\ov -d/lJ  0sYՁ.<=xW/< Gաf \T6mlzN"D3ony<gd2lՑ_P4.9ׅg{_ї)b˜,ȭ=˺Wgu=" ey.?  /ȩ'D mcݿH۫yTO(j\fIAc[7$u2y$f27sV=ѤSW6ȩ'؊jl_{Lu&=!P JK=fkL :x.5wN1p-m4heeA)Q .A2t nQG;SH}M+r逑$;Kzst':@6=-µ$)g Pܒ$G]']ϨN doL|*&PBT<ņA+>"xzɆh 2`萨-P`X<.`6afnIh)fl\J<ڔrJܗB'ڽt"f!o`{pGU}=Gm.EkU+Ս'8X -IЉwm?˙_ 5E6>}[6,ӕLIً{Ζ˯yۜv6B.C{IG/3%Է ?Oײ QU3*+᩾,E3\1זM@6:7)#S*W1=B.h xG^`T6#T1ˌk}I:":@5%ޢowf*myݶr:&p`XKgm|&tI8%bZu0l$/ҟKmz|8b HP2ݸy $dE&K"m0I !o(t*,mma=28tékNG|QFX#vФZ厪[ =)5m= --l"lRں`ZZf,M$GEAd\ >yOm >)oBa_&q{pP{ dx;2z䞻mPA;?Qwv|qD.iG0a9D"ǕZ wڡ66,7,.h f`y%>Bs@@%} en~$ϟJ~}ޥC{zJk~+49m+^Q*/>cUAx\خH/ H Ķ_Q C\yV&epvmL"g{É1?wApY{5f6+OWC?w6rdRaSзnPSBE@ EP!D.w]g,yժoyg բ$m(\ԛfU'K'_uII s?8AE./\_~<@쵆0cW&_%S 9*_MGcjZ:@(Է3Pr eQap)6 -mEImh^('ۋ]/g);UE}yŮWTp-N%peGwLG\C%y}qgw޷)[BADA(T | #'e&%15wV_7 Eu_Er*Ռ(.Ă(Ӝ`jQB6>0\8 pX`jd'#ۦm3F׈؏?ftz:щi.ౕZ{cN@ctĦbF]Ǫ;dWaGmF fҒKJ$!˅JslqS|#U39>, dP.+64AY< °+4+!!=zJ":2r;gWZ|ɈU؝N"=@Ϣu ov%)6RI8:Vv_ TvAm^>>XU2|ūݪ~JS$&Q/9/;>$4A$U n{*pTv{1ō -97)Eg[YOǗ96yMVunvՉ-oWC-ŋbBo/eC**`p[7Ԝb,e9wL$(47^IT`pk*1 ѝU^sA! `A72FI-/DbC̆i8&WWY"ӎti -4r˺@ҨaR 6jOOȠk*Y3NiRf(0J%gBA-Pq.f/AmAo@UjRoCޖ[hn zJM։q60&AN4*D7~@mV֧gN?+gӈPͦ؊S3~ExNJ ]b>ٲ$Ҝw81>B{ɵL/"uhL7@ -2x秙U?e tcSw~TO%GbL_g?oj-Na4/@):7!zYiI0'-J{h,ؓ鰼i!<^n%c"K{rmOa:iZkvn+hɈ)+pc]#ʼn8EDV#}a NjHW,;:bG;Eu"ډ!1& -ia:;̩?I":dW;'yM!NfsRM1UԩDש ߓ)_"p&T nU8̔7b(*y,;ePA^Fk\|.-r%z1zR$_,(Es|g.­D5?ݟvaqۂM ZmxP8F9"bne{g_w 7;+/q k*wQ/& goFDĹ;C+^,W b@rX ;Iocn]R$pyj9s7{nQP*A'DGl,#d.OJgBN;t8?_Q8E("hxD> QiKilU!?_]>6f:$0G $pM5yd G̗Twt_LX5 >3UDV1N`pi%;7HMe~34Nڇ(.yNd\qX/,$%~9˚=)<&S=D`'o}<Bh)fMjO9>> ]f*#Kh&,(LPl4}]=YdJIU"Z+}≺os -(5(`Tt+]k -ltmk -WkۜYN5B!;#ZSlq[tt~`ә|d4%zs4# -zV`h6{ap؃8 G[~GϪRq`'QYDImՍRj7aMo}3V;o.Cy3<*ܦ[[|~𓿜Gt<&8`βÜnC">_.lH=-VY뎵< 4y/$wӅk4wHilnJW.zAjܱc2ݲ'3[嬹k!ਠ y|WXf8h.]|f:B}{ p4JzG.Dwa& ]Ddz|]iMݽ5\Bs71Ix۶-GyĸԬ˖ŲKC9V&E63]` [=T6{ riV<3Im2ʼ(ʼOz``0-']^7fYdd;Y,ddg;@fY^{UbjmUkWWEy7T6o7fi1Tù&o u ۾s%ygyiQdAWG-GyK5*g5*g4*v1hTxiTs84*F0T#D*/#)F,Rl`\ Ra0T.maTmaTla\(R9(R9[VQrQrQri ~l l ?^?9vwI5J YgEB]"Z,f᝹;KARPX!G2/e,q,~J}b{?٭a ц=L! U8Wh UYjw}}ܪƽlA- >iن$Ksmn< b{.Uˠ&mW/ ߀09GpEYAbpʢG92+ 7֙;N($I"s!`0n5K=,B -BV$b-&5:n%*>]SIʍ&0 )7qj=HnH%Jn.KcM70M\ se"m(fh96 ҁf온248a*$xT}5ƱvyC!-ߙ# GECT9@zmYtci¢q: mȤ@B S% Jhؠ.$i6 KTz? s䝢e~1q1~ITdN߸ ӋLNz'_as@C' ’1ŷ$KYa׌!(<_+s6Зu,&( -{sT|/6?Q59Wy`97_3{ͭ&<7>+T*3&m~hzԼECU&鵸! R/S3k)Ra[щZ ؼwsms@ D0qj}S{SMD˽~iv&†fع֟%lm4̑c6ffȒ\UWpͶ$F $_%;zDt D'ФjWjdd5g1%u|_ 9g0 2yԢ9CߧC͂05pV͖nX%SSU[Y}>+;LYO4Mگ&L8h)ԩQx:$B^ۉTu6@Hq%T7r%p*7r/=FRېro!B 59ڑv~ mF͵$6A,#Llr_I/eK0>~ǃe -2x;d`3oK#?8Nӷ?o2x7_\ͦ%!kY \J4Q hj%C2vR2KeSmi[zĠgfB)DW*E4^J$jUԀ0{!̺&yJr͞Gg祥*0Jw: G2ntvM㧀"|Ͳc( -]Ӹ-סT䐉rvϏnaF7e*Vip)GEO3^K&1eU-HANk6[$rB[^Jє#Ep{H+ ;{вe˝<\*BaV5 -5QPp -ؙ @@z5Rt(߇:;T]uI$@MhkHi]&N234NξQ&"ƑJBT8Vob3O0 ܂sC,>F\*HtlxRIQ[,-#xC[9w&2yD@΄LD'O;߂A[` :H7¶y74ThOUW*t6YDdh<3J>d+i+9I zQ:.a)˫RTj2Oxu&5H}U b1cG@b#O.G -#˭с$Yҵv5]A>ըm݀h>͡zUZpr|HveZPu8 {^S; 4v:7\>Cf@3n5idp- -hr֪Hoԭ{P=7>Z>2ܣv_qIx 6 ZV-Ok N -`h^ I8apSK]Wgq3=9fm.P]EXP4jqyz@D鞔Gu:Bs{qI}4G2l{{/u4n3ZD5$ئmqo4A^kuu4%Ւ'tA'>vS<}MZ&%q6(d7Ij'EGsy~Xa!&}k `w RDAqk3ch;-ݦ{'v|Z3 -Y"wTIxaOC t/A.+>6nN%и2M L+L fZ?^m004%,ķn/"HGCK,4'w:Fv7@)A d0h Ā4D狠-:Il\g1Um,jzxF[nԓWalA!8R4C]癜Xf-vgU:!:N[H0`g=GG:|ODWvFEUx"3q@"𦢀icK؃t*n9dU!ޖG.FIa /63@+^hqUCC!˥a+# J2L[a7JQZ)6XmoC{s.<_ݙH@)770 x@+Ft06g+@!)s#FvONУJ AAygqWJ2\ addr7"+yg!I@,਻RCDZPٕP*F6PUJ0ve $D\WEr9ˡOhd`'C/vԪPjЇߙ88Qh@9HAte2ߥd[ -sz#Rz]6='+ob+Uv WX̌i*Viܾ6hU>9լA?1 S>Wŕ -O]+&߮+-+D ooan@% I0\0&ڷ:9%[и`U=mw*Ti.٬ -\L UOrmRA-b+AJ?)T%T!@szjT' ZfˆSaezʅNu{bekw :L$/V\ōnǕ;_0w7FRj}DC@/“q DMbmlc{p#k|N1 З04 8@{'0E˚Ik'-`pR; f~DnEu7Z KvyͶv,.Zc"!~!x\u4D[31Fl3E7*c 93`:xƘzgk<ь]ffHoLX̰/'3P9a9drf:#4 sB)cNjשorh{H u1C2\y˹`윛F4t1 džfϽ0B8q3ȡ!$$C+ɕ(Dwhe r졫f''BкډB "$Mŋڴ}b07vj"?dFfrq&Vś,t3f~ϵDYT0b5V7Aޤ9I^KVrJ! s O_c/+Wv*q.ܲpx~4KEK=%տs}~sI6~?&\K0T|~*^ax5?n:ԓ,$v7`Gޮ% ;B܄p%-˴ \SBٯt͓zET3w$ jh#ms `=o-^"9w֥-n|1fDcAI߇_>S&k6gw,6R?5#|ߜkET^#~qp`Wy,rEk|R#vpml.^4HCKqʡ8x}^AXz=y Hq&tGRIIP퉫ovj=~>Xݼ_?>r+^,fcS߯b" 9>ɾFz/~qq߯B8lW_hb<H|b.b_D5aEӄn}g=/l/D@htVh%Lb$Ç: oҹ8QtQ2O ΄r - )SI^t$BD(Lү*g'm0FHJezB͹9#gv'xnkX"XVEiLnۄwNfIzDlH_*m!Ir*Y[ )B`X/m{e`Fzi9352Ax4&ybo( Os &f 7>Y+ M*UMX y@[멡5|]B(%'RbqSA/&fӘϓ;s jq)ƵYHZH[V5-kY7Rt# {fijEBDj۵ #n8')4h6pt~șHmgoKX20WDL Nڝ~u#I%RQ#zzh!A+TS @km`V6z^@涌mOZTHK<֥ -{_<Ѽ{ 6~k/q6/F@W F,̋` +X0Mee# -DX!K<6a=z^iOɌPjǛkC(?}۽5rxZj28`"GÃhA<4~B3e ɀe6+C )a쑔YC|B:NPL{FD]WdFk˶\5> @WE8pJlWJpCD=3HE=$8Ẅ́j+JOڻ!4,|5s8fvm{9G$ڄ71[l.\{/Lz+*U$T|rgzUixiM_7Ҽu lTEݫ>"KK X`;ա]F?$鯚i,9+'|U6lge*|NC#9&G맅# "-"L 'qTۡ}KS}ԢAxsT!@dCgC+m22@.DO3WI2{%ڑqT7p -<'M'F$lr@tLo^eG. ܣ(Sj7~qؐtۓ&sSQwOG)pSӖѴuO\%`ϟymZQ'mv(؏&\DĝW-lzeTD$UMZT6@N6%X|7`We7_b+e2sByW(%3/}^#ۜGKċ{/NʿaS*ݶsxRhtwb -o^#[l Z -]\24E2f (_t1V>ij9qPj{9LRoF/|6wU+<&-z6{~#>ԮnǖT#ГT7[iV *lLxgkq&5C?Gs:O17e^nxogQSԴbIѝb4D4wګ%“+ tION$XPxf%qxCINe([|PmkraTc0.,uPY]e:n(M^uY} }A ?2RSc@HK]mᕡ]R7ΛD+X?)&DGD®EN|N'7o[:Ex[q!;6{^^i(Kvp#7}ojK\A#T'j@buxtϓ_۾[%U~/8ur>xyxOW^^gÔjj:LѸC^&۟ο7۟۟aGgNYК/-~ï?/~oofqշo~ǿcI>H ~|=y?~~ow7÷~s/~1u_ٯ7G~?' yW͉z#3~SOR雿ky?_g<?b~_g?ïW!8)2od^5S йm>"ߟ_q!asyv?o_͝{O/n_8l}_[? YnD؛^Fa{<=nvhᾸpzKpW-QNu3tuJVk4 -O07F ʜVPdrp!%D #dޱ",LɁGBu?&`šN2nQoдOtVw@I; ~$RHՑ1CA'rdQi]JPnrEO1tB&Ze kT+F(R]KgRc~H0 PIn݉A8$fW}hMm+}j.5W:s@!ǵ5,^]ikgݔf͏*j_O۪Q2/Ȉ+LW[\-GT@"Vێ^`J?K^*MX^s -*i];ZyD0 CZ۞$*GޯeR0Rݚt۠`&Pz-0UL -]ED!Gf߅8Z!OnOCA9@GǁҰ$LLv|CT E…&0alMr`!yW1̻f} Y)h SS?nw1lѼsr|ʓ9@[50gĮREHU]Fx{ 9]swP aZ06 &X 50hDEС6ѕSGp`Y4J̦R1I,skx6ӮkҁD9v+8yԈ|už`N4*vVgM|WPuKS $5΀\f&Zo߂vRl9W/+A2D9{=ձ >՞0 -eV.@`屛/ ν ~*bxͽ%ItXjUֺ'ggޓ L8v(wpqMmƾ"z*D_ /66ڊ!T%iϙx~dGYڸ 8 ^mc׆`j# idQiw#&1XFH -7s$t GF_ZC?SRJL(8a+aN3`]8D,6%$QhWس>ImaR'E7D"j4fٺk 4YM` afM(wej 0=x=sցR 5u)uJD!.lu[ /wO>Y,jL>9b!:4'cHi{7 j+d8R.΃CxxÁ|A X@1>|Q''|3f/y!kLp+kblj:eC$f.osXReߩB) Yѭ%Lhv)tl~!ߟ,8̜vZ"88 !8NZ!},80Η~ _"V9CD}58o(w -옣{}3zU]@ lRbmt:[g ŧD|(GD -orzp4hhH^)%lD7z88t0,ʪj)t~beAzPz{)cB&2'"H1=-\PRDLOD]0}/|2Q31ur$T^O -!Mideee'X=xHzсr-y ҹΥb2 -!;V0I嚏Va(f G62g+#) nU<扙`IaaAQ|r&)y$`ہuY\dJ[ CM<(c`$>h̹>9`;|M.ġrmSYH]2D4ү(<.=}j2 f -A0kv](G-`?%}%M4cvtLd`,M(H Aâ:2Ϗ"|wdZRӥlI=O򫢜J\0z8U1hsPW̃J9Q-q/IsO goUůt(gXӸS~'$`8`sqrУn<=^0͘RD-%,y$+٫Z"l 癀=Tz^G~^"E@OLsEլ`P}Z +p0H3Hm/'(풄gP@~PVNwQ@wLtUNA8uon8 -ө ^nOidTR`=e#|dy!inNd0_W692A_k<ĐY%ls#p]h@)v#^5[Oh}"]Q FTW=}#~4TCViqˎx_Z0VÃwag#q3QnKzɘi~ng(Ԃj ʅ8,@_{_` -,|`#q9r6҄wKKxK+0|84cOVÉYg`aLZ^nd<ثC(Ћ"8u/yӎE3"3G<Y x"Ҩouꑡ ޡloOw[ڦa~3>;_Escއ -+FS+J7{ %W~W&WA7t"F@Q"Y^"TmIWD'!WTaq(VPQŶc`F17~aT\L$ahV;BAGkfI6 rŝ:€1'ӤCL]5*e:.I)q oxa> @mBXQ` 0t 8S+&ś:bUHA ?M/<N6 |LPaĨWmg@:D&-IJ{q9uzCa !i,egјO9AEG= ZOF*ænqTX.s)at# ) +ca!ނo¤D]r#hS *WR&@݇R`ylة!!݇5ksu3p,G {KQQE4*,egHcw-?7xoEar8\MKOYAC) ⰿnH}'nN@hq ڄȶ%LlvAx޻ .4 D|`ff}TWUU$IGv҅Dh˱mlsoB#f=yX ۺXEk0d^3(F؊ -nTk kfӡLT(+[,H/G GL*^\$yC<݋Յڴ ~+ly{vȩU@(UB 7Sс)ΒH)y$'&:Ǥ4*ܾyJpW?^9 V5RBEB+АF4Bqe7!(uK_BFxEx9j<~@2Y2ik< -6Jx quH~ݏK6(uW&|Bx{B02 6 w~ƒڰPhN(Bc1ۍ%0=[ ĉUͣ_lyY&F;MLgر /)mCǖl3+DPRoel(ň@ (,R]7210 GAlTa`RŅmڠ|>)l4,x^uv6 XeZEL -"n'nMÄbSJ$!e Rt\|q0Ĝ+Do\1%pIZXfA'P!,GHP\wNUqS"*~XѮJ?JWX&.Ʀڿ4@@?sbh -a[Et:YN" #P'$:0\q;: q҃Lxav^7 ^Œ!Zf`:0B}jC#l 2cGh --vS0ȹ1?ۮ;r*R3Lh0ac|a!dCuX#oo~_0֮Z=2wV$f; JgXQxހe 8U6+Ǚtcf]25 J!dAdz~dݪ$ZPU`a̔U -KU6X -*okd`gF^6}4 _r?$_ <9LqpemYUp)q* Md8ls!Ɣ- -Y;4/ q2RE\~A*PZ ]ĐtQ011-8ZX wQ4S(/fgE8_8݅$p -"7䙱D\,xr ЁSR~VUi9"_p]j.CNP>vVA -%[XEe&&E 7"GrLq.5$5o"C32G7_Qbj-OkЎJ%FHåkk6H-uLoXJJJ Kmqi㎽/$"{i.?_ϯ˿O7t~W8ec*/hK#& -0O`??~$S{ 4;L*b#4@ /Z; 7Y*ĥ9EBcraWu౺dvV@Mj!٠y E\<Ǎ - fkJ԰DxTԉ႖Y®lpp" w=d\|,c4hC4|iަ -'ϩQ(OrxC:5eUݑ{9S7`5%@ty}Dۙ/t`y)K>lwƲ%$/G(7 ,R^^XdGu;UOr)^4'sŁң~冶Qo'ĐiF!Or?R2? -,A JIVåDcxEF'E)~!t.Vsd -Lp1 ^HD7krPI [2޻TF !FZc k -=2zͷ{4٭3#x\Ґu_WZ5sofo nR+D9>YR)r(Xx۬r\ZjMf 2<TɈ@ފ!l.1AvLzu/j,2i@y5.36 nGnWe$}_L};5!J-F4d5w+^g͍&^z$K5nÂd:Fy dQYwɡ^&ǔ} - y"I!2jɡsuucg{szW]#4:l,/^PK軥R$נ̰B6AdpeC(EBZs(1%,/Q(V1,/.E(Tl:RZ 5?;0\R` ae.'d bSnHrR#}),B8M(A xA֐VrO+22ip˶{)+3{j+*D(LqozY1j7^.4\5} Rޒ|K8 -nY,1;Dp%tRsbG77ȡl6GIPTw$W1MZ%Ar2Fے `cvB#'30Q$:*@eP+>H7":ḠmɯIMm0Ƨj -ְ Z,~J̒(>ؾݜPt3#Ӹ5o #t(߆rW0KfBЅ7AMvBqLC BݞI$m&PK,'lpOfQ}k-A$[BEHqaA@zn! W .f)9hV`y=QpL,)!_c.T=DR)큛تu!ЦNB4yh YNbzG{[Z%Ah(^1psLAP젦Nf]8"Q0o`z_Wk;ua]'0Y]Q-ȹk/7 -q M X;;=W)ZԐncb) -E϶%Pebq76R<ayH1áك-QfoƒdK 0K^^ :8ZdɃ.FG8ô{OiBr3'IDq|ͽ8|O w.2f]vIAzTC -s%v}įMnaQez3CKw B;iEڷ34JF7t7cPeC{T qf0b|FX@n[zہsC+L=2w0=l/Ke,v=J[NH誘6^T"D-) -n qhQDH/v 6#V~XdlFP)h–I_ f:n͑oK;OlHaBz"9!;wbRk; "*ިT3HP7}p<V:po%qXf82XwQ3d%X(*#UiHz 2wzC~z-HGoCaO~sPnz׫ҪXRԬoDn-F>Ŧc@Ҟ!-o2s--Dk)b@& -&GG0TiQS|֝Zn+0Vf ǒ; ;Y -~8i.& U}SS Zna>ذI& +=j;l%SAoo*9b;(d{ 5{b(aAK2c =P)B5ƹ0 c ץ>?!bJy+rֽ ONR6\pOyL-7|I#J)- -Kg\սrE!&&3uii\L\yuW'9rgB7(kHkVg*8eI5ajh=ͣH@z+p~aʼѣ5(7tzH߮造d&v3fQ.{9L"TD(W 8sz6x fE2*M9Pu+,>k=an0=鑂+}E̟O_ :рyPIth=ja#qD0#9ƓcP(`C7Yub; +<3 Ѓ @;4yہϞؖC}lr~6k-J8^7ˠYHKx|ʮ"xW< ɳ1K6t@UFd'x qQlS٤@̈́Gw-&ԀR؂ dΟ+0*VgdP]\z,gdX!%E?S~HoQ%Haj6]}y+grVKDVki40$^FbX$4:\ ]8q7PpȪh7΢ܣǹ$#`z,y_Cg^$]:1- - = ~%1f^ *Ʉ#l 9"Ho|)Y*ҝėEN|\cȃOqu@{ЂDWK5d@gw,}%q!d2Mm}P) rG%I;oI -5}G=j &>$#OY,D%ܗ_2Ы\[,{ȔhXfJ8Lu?ǛF- -CyJ1(PT즹0ك=XLb >b6#njS ێ#XWzp=ʗXB1Jk*JQ趗.3@_yCi'<҅JF |(|Lk߽^.5><}eYuհs>$~W&B?BY Ԑ ɚaR -S -y<[w5sy]G~< h~K7Dy3@foC,j1:b!F-!eīauIH {LգZPZBُx^ G`:Ku| $0ӢY61ϩ%L'C]Ɛ۩D@գ$L -[6 -3L.%JM0ɼKQ/{\)bȜ⪨Oe@]G~(S^=3~B.i+ RXޠ"%.`C&Q^ Ado/⑋ALWW"?3B ('.Xp6U(fHʽ!vCƔF74F -a]P|]?YR(/KX!$= -ڪ雱IFq*d_}XʂċP3ʿ]C ]CَB,C?WS2LIٖA*'Xa¾ ->-$@|-1BϿE J=ٯ4ƨRj80,loXup=_̆WX͠cHO,K`Aw'vP RF}=I G -t7OMGTϋӌK"97QV ?rJg h-p.툂*|7Ԍu^$z?ns??W[N*R -endstream endobj 307 0 obj <>stream -: -(X y]y *R[@Qzu?.gȈ V5 걞 V3۷AP+0fyPaR.ɐ#*zsa\fR~Q LcS-Ȣc:*]N,=Rj -ik@T A #r騔#]Doן)HWF " e/ 4arB (l-IhlI,%:r 3AtW2'a@rmlM>='yi2=NJM8+L$ -_=IC 2C DpJK !A&mNjdMIz,(M>]nI.迸gU 1 AtXDN\CJAmJ@ 02b%abȣ*c5cr:X:_gBf(T!}J~ .a4#x"frb >stream -sOMwdY^QUs`mKr$z1ᡫ۝94Ejk?i7Pz",*x3h}5<ߨ~U#lzwםJD2tA^Qq<vR;ٱ /r+Bovgr8DʣV^Gwm<ь0n/?pec{Dt"jw o^aWկxy -Bg4c( L†zhp%JG 7i0~ [j\r.52ڗ(y+ &H - |;.$ĦccOC1z}A_F: -#:qZ~4eD ^…P!WP%sq00:KJo"#qc^N#Tk3"4ӫOA~¹lxh5-yLɎߨ.i瘌S8ܣ.Aj_-HA4O^hDM) \>>OQ?{ke3< 7ܘ ~)/=s4<`Dׇ=Vz K Ԙ!VʹxNv¬蜤7UѶwKhKZXyRҗ}\'-^ADV+6Pڡ:<'QI>?ɔ=\<^<'o3+}ŷ - EЙ E0̄`K*Vtabt~N&Oo"rsifPM% 30VMjJэ*x ˝xGFn㦕ѕO*UoZ57} -HSa%q#0x3o'b -Wd 1߄`1k N)m\Atv֙$k,P~d>=ʣJ$[#HwÆz& -_ܨjoAڋ876sTR8b -'-1QV>YcCк9A'Zfl`AkʘeѰ)y"n60qЋz=57T|v5x-]BfRK8KcdJ[y1@5s\ Ti82G7?횷iu -&S/V̗ G7 MaRg$!^ub䦌[* qh]A,Gw^CT}DP5,HJ.Z%6sZ\FHm>к75ePG$t^CEr%B$Vg.px63希O>xr*)j *4tUɍ7ꌁ|90 ij[]t8'ȊW\ŊCkl_AS9A=B;gI=~qW(+,K@H49R`r@ϿCm.3VF HKy,Ǻ nǨ<4vKnKؠ>f̏&i ---PDC^Kىdn} -53#?PУգhS5m:^q/}ܔl -feRvZA&)9Sn:*/i޵{Օ#k !!.8D6k؉{E%=kpÈaDf34߈!PY)0ݠG7gH=xp‘)їQQ>=!ɗl{M7*n\jQMZ]\7'k<@Ser0O{]³91#$Z `XN>?z;N= nMfWu5nv@4(j{:7@ӵ((SO+=GL^0*'n'zΟwáiЯm4E1)pTyN[51-/8svhӅQP9: 77Q8=} %٫p Y qqALUPLF},~蕎z<'uo~FpJ:Ud`ci _TNbC?^y EِۤIo'pHC`.{/3FKXve РY~о춇2:%tcc揩'2Bu- rDT2aA QW-}, -}8 L׏JQQJ|=tUr^LXP5ĴY $RؽPFj|xV$Ly[+FZ.@zˏ=E `Am -|a dJEUECnā` y[ DHc",@S:1z(=!֌M+d1јQg5zEaiR_oJ"@8P X@QyױhPzjV^j>N55E"UL+0n/ {B=t(Ý+|!V?ɀ6,`eBUIF^)z@d_l~\юE`KP\Bׄ&+1Ӫ[ +>ؓB<+IfAABp.ŧlAxݪi9Ss8/3*WCG_ɬ=}f{rM-97'w&z,SQc}(ݔS!0 e8}߳Hk$ٞnSjg`cvdIUbߙ'ۼyrh"[QWg!bRGv/G yUjex灨*-p9}vy|(S5&As7CyR^C_$[)׻qj*Az53p@nʱ?E,i/TLBt35%LgnOQ>zPro#Gj2nr ]>gԼfK5 {UИojט8fϰnj w{J0zc<:S/yIا =덠RHRd=8 :IZgsY D%t$ݛ&RXKH'q4i<)fI"O`?E2̻(9:TENa;1\[x&Fפ4m};04_39}6?t9ePţa#>5,5$,d [#IcӷLՂ_]d/oeՔ3H~3>$ -ߤ2O`(Lӭi (i,XkkaH>Bˎ!{ uMj==6dn:Vr^0RbdnY!ZDa"F`W F{X5>vC=LBёA*_;PbQ9YSMp{mBR8(jkM%yGl[`DKRh9D {i]&6(hz5x>waNj@&΀'>CW`wꈚo>L9U쁅JOu]0%nw1%X\ꕮDncelS4WhzUe<>kM !I$i*@sUNÊȴ0E@$P_L%[ה`o\wÉBZ^LR~g;Q~:}81 ]_ QPgJFQլ{ ([##RhjR sܺ`"-h֎!HP [k-J `AE\yiUkDp pW?W -r$~>e6p^ Z)QX=$d<hSiv` -{DvR a9 oznl" h]!IoD~f+@ 4O9^U_<_K+JHG$hJ<51h5ݭi%W.i$n9)*"ǿ5C9}`|,o&YJYafZՐ O4{"G~IC٬0Klɪ L>C kG_vy ʐ2zʁ43[ Vx_ڱ(%NZ+A.Auܓ, eJW?ql( %E ji{7ċ~tw+Ho5_)po&RQzCѺwGi˘ ?DnzCe*B+Y ý%]Q?#{GXC&6ow_GO_?_7/_woSO?~B[hqcgŏ׹ׄ}p(U`Ҟ&zw+ *XEe;^ƅ-DBM->슻)#5)m_ю.B\f*v&q H}^aހ|٣]؁w#ch$EG 3cȌ[ u*GzLZyGhcq[hTΠp˂#;LY7b[B0bKM/:!0()|QLrCv"]~TAzCC%7}&r\'.͎ O 3ҵd @Qt2Bؐ^hG/|"OAüD ~(GA5jW:S%(Jfus.΁m6nǏn0WB>>~6ۍT7,+-I=4OC~ޟ{lS'zDtrw',V>GҼVYT ;] C{Js ;+Vgіw= )vWX b~[Oq3yt hMa& -I͘s)z 5@Z<)qRU0Q00aQ,>y"UttST]؋ܔP[[tC >{,w cq޻McAfEuZ%z""BG#q caF_\E*q4hI _-:DmE&ԯj%eOcEU<Ŵƍ8rUW>/z^SQUx }Z#Fl]ICbjwVcW:u5"Y^e:tR"ߤ>5vT,nЫXܐquP1:z}y[HGL9,s:ɉV{ J "{-Bg#:.|os6 ^ֻpcUʜ"{3p4f]UEx9*%*B>5XadR ѱ^)?)_A6\6>wIռֱ7$!5ZT{=:i>{Pv=g4C>c+'"?Ĭоg6V^-ACo,M 3-9e{80wN.=Ts*rpBxX zT_wbցJR =SLvD5v4z|5vWvfy^X.zG#!rprVddws-*)^YIg߼0__ZT -Ӵ=HǞ vW҇bo%rsTH&{{C4ݸ33Ѐ L^wF< Wy6rQ@$|ԕU."ȧBM5fA -9t8ogS[}0C[Ӧ;X)Li8QWkt* ceϓ;s߶5!{qp -AW>(aPo!5^FC:NDW+ /)NӀ ULw{/J-gHZ5 BQ^mp$6ФJQl!pF[`е 챢rF]Ϟ=d UV~2x&hPh}Jx?E,MًĎ(Tk̦<bx!mS|?nIZB!nZNΞ{1l0Fu! A}*/ ۗMmmA&ԔW:BH5{UH|אm(`(\paL>[k!Iɞ:u7]^Ux+ǠDFL}SJsms{ {0Yu#w/C)hL:B"6(4`o ׫ KWyJ>ZJߞ` a>k,;ؾ>C؋G`'%N/"j -8 cH#6P#`xHMW/ÁF3g"|Ю "$X72%{J" KS Cn^^zgɲ ,YLcP~=NŇ'i ASavlAp6[!O@bQ7j08uzS ۫wSVo'laIU2.'X T8H gv d}lgx~4 |_8@3U17y*m \I4q`t4(0bMH) Z\xqJ6ݺD3/,pR){rAEKż9%D@W=qՄ/ Nx=C YZYf KD2nGiu"q<;̜qL[>÷chttSd+@}gK=A~# CE{e}m-*/;0+_l;$MkӍ%⌽J׼/:S(A:'l޿8џ}ڴƓ{N.PۖU#,:l55ruǤ'vg>QaQx $蠇YĵR`7C¹ML.EkDXˠ=%Gx'auڷcڡ8Xu^6QDOXR I.%"k,랭X$ٶl_/[|1<{7jB$r/@?|EodSUeCV%,Ҥ|Y5A_6T}]eL-yZ0'^"gC#?Q!͑l,8ͩ\BVS*S-S!C*̠8KbtSDTR8VSs ֝cXJyI,ҷSaD8R?=[Y@#z- ۅc~B̖=ᵪ|B09%w -hz a{IO! t>բ^!w!u\:wdb5/?h|X"nT!$#=F%{ʑ!8Ja&';pT=^sx_JUvXzh7+050p#Qoq75! R;V+R)0 šϩBa.{evW𝴟=DMp\3@K$n ]'H{b<f'!B3 &=!ZkO8cuk=<C6 XW*,zʉ7UV2Qj%$G} DΤh^<Sʮ\ vTNjC7vTMĐ'Їz:u{!ie*{Q}$5I."_V9ygaFz?QNc'vc#%ň NH䂟L룐(ɦGOJK2~DB[c%﫬Y 2C 5aAw8=i Jd3o(!GLNS%Mf RjdiGЌ?~˦!G [zHUp,0@cД2"k,)Vyve ud<2q*hfy]~{u%eo,7Џ(tShLWssN\}f:c?><#OMDWf:׹)~`!605{HĘC. -PXCϱM+M[DjU]}Lztc8Uq*S)OJۨP)߯ji!;TWߚf%Lx-9~iNL;`YD(+ /#C2&LANG9LY({* AA(x&:~.=߃Wd50V! -\h^Jwd}?VNţT$þ (`g  cR1Hxs4P -g,pM9`! aPu)nmzgJ$DuY1~K$r $6dD D裈M/9dI kq)!0 -YhtǁJ= yF_|}]@ԍN${ֹ |ferV&9?nS;brCj@:LT v n=NgPqW7)/MsVOȨ]),I)'QCub^ۃ-#3Uhp Xj^q^5f Ê#,@@VlmHށd_O|>W;9JI=t;fC.AR9_xlZW|m -1N ІFm`0A}ן!d!+3A  b!&|ljԢL8W^[E?plA0vTUe@1p{osӓtGzQgPQ#}Laȉs|[p^!B5=5o}H!{eh$ɽ =`r=|v\nX D6H}c B =EI1Z{TYˬPe[UxswZBeacLv <+t4|%!9MR -\ pa 3 x/: !\j`?ءn6=B(YGE)Fy*W'=RpD`]ny1 %=/{gRNݢPu&CbNj!Wn+rҢǥ?(b`/J%Ydz u5u-*g"~HX րX -S=5:0ePÐE(p*; bBt19Zb"zgQC("{q'T]i05F8 Xuh)*I\EY(XIŪA{0,Q!HۯuɪݺV b/b+wJ%iBh:~TXJs5rmKX (ё;ן9+OH C Cp*O`% -3Z^QԜVHԞ$pyի!gRk2'8`(DW.pSUTثs\PdQ(>@2Q6)R0#KǴa5 -Dk{(5 -&ap JUxgtUk`/}s#0Q"TޣDtݍD6/; t>9Qk8r>=0!>3` WhإD4wY/hyKeZm--RS!_=]`v5<(RgR[0\_ڷAlgE(M)]AH._r=Ct-] 8RP졢_§f@7VD`#%Fjޗy/Οpu9; 1`>*ИܛH؋d1 N# -8H@[!\e-4 9(y*5ھ)PҊ>M `1eD\B8 #a{Wr^ -!ݘg\ 'P=4IA90 -pX(I(P-z:pӻi/;5ExHKbCfj+f(0Bh ]-lI]e"^5zZU ƐYe31*Ǹ0I:W#U3=),i:?/;sTh`;]Fiqs93"[IN(1յp=mBEaoF?dK҄:rve4WXT!KB 9^ZZfth7 nXE y|]\ |y̴8A 䕢P>ىM+&C i8EޛIɊ|Dd= Qj - SS%gWBl5@HI5Į ط$!@f -@y O=Dv^k"ݰWeC5݊詭$aiPpxx"l 0X8y)^Kv/ -dnYO>Pr(PJA9="0*SFFǰ --{[2͔BZ~`;BMD@_hvEm#:l.-RD$oٵUӶ IS{W ,`&K`;M~ TZK7;cX:x-ji} wQAXTj\.&%fذ29¡eYa$:e -.1Zܑ"rq?vngC4:uzy};67..t[zPta0Dx;C5 nx#._gĞS?˝KOnwEd?tM) -D:] -K4K0"n䭘 -Bl)n $ |=p

2f pkajK{*,ʂdS'6M7 CVqXs{W xK3l'0N -GHtQ᷽‹~bRi2J%1/Q"5P/K.CƜG4Kwl"G(1b,d+RpL BR#r&*'DT9ZJ8Ƭ_Nju^Gj/ड़q<༴kZL?uj|YU$񤴈u^ecv㑻_1Q s >hj2Ԣ{ګԎQCP~SX-`b*a?9; 3NDZYۛqnC^(^`uԿ! %]w@ LtC!>yݮ/O=02yn+$LT#*D57!&8ȚB|H!MxE@'XWX)8cڦ}ImŒׂ3린q>:y-xT{P1UxEj1}SXv a@eiVK|b龗j1RXA>ĎdjD Mki0$eY` Bzq'xRhPH)"o}dd<^jJ_Vwai^Լ]5X^ܻWq)4ʒFGsEFg:#$+\z^ _g ThF)ꮳ@ҁޙq^RIxK]/n&#O=gWRXTKdlXR.mA]]:@zG!XB~` WTަ0rGN-el~]=1' &Q8=ߊC`laK2 Rgʕ=)p0֬dvhh~_آCE:7- -lH9OlIw*X. `5+=/L@ e$J5DYWz0+J{RKÝRҞ02zd? - |AA/LU=A$!Rk-i1PxVpl^|F7Aj\5P4 -Ti;X~0A7@*;EMdƶ aAIo&{0Ö -ՀƟtLY>WFJn0TuG{:(zBV)i~<7yaBW n>WWфy@ {vTX!N/̊{,lG)8b nyב5bj 6m Y(a_7 K=I=Wϩ%h=!Tgȑ&Q7%z[VWZbkt n9%K?Je -bjgW --Z~x-'1=2ܻg` Y8J)(w؏?@YA+ob:[ h,U0@?ծ\X`zsmT{LȲvCBC&)э1M74*w" (0v!plnڑN*JbcJ/zu -&~Ȍ  ~>\Uo)XR_® y|i8MQͥrʡAkG+}||NАǡ: TMY~ &nZ]VNR,"qM$܉K^&$tSM*hQu b<jD $YٿzRt -"T'0gC%~ ze#M6x母ē lWTpeʁ<):g7j%?[0@_oi}gEp`S>W-Ga]G|)Goy~tuR.-1o Ima+@8~eD'_k?ϗ;r6z-f#Ǜ@Ea|ġlM$ClMU[СEEkJ1SqEߘo -$8L6k͖0u(8݀U דGmǴ% -Fdr@(;Rk,!gh+v8,gFXE*`n-25F6-V,[IM4Gt-+(fը2jY{A?WZ[4t`lt``b:礷?օ4=MTWwb[+hR'-gH@KTܣpx!>>#"29V^!Er T^%C+K:`R11v 2}lSY*TWLRlC(zTp5lK^Ϧiس /^`{'5 B{k.YCK{۱ -p"#;DSZnkH[xm|YTf ^i|p#鴏3F᷃㽵a[+,)ω cfTnM+y 'FU*;5U%hɦ-輊Ӷ5y *Z1%B}Fh KGԞUfE4Ztɠ$N=({0%p6A>?460Y-(6} -@/$eZ,gFX#EO7?RtUn=C4 T$O&vkTbsS(S, .CuꃤjVtqJ,Z@$m .  d 8%̽t02j(/ ˤ轄WP U8o? Ƭg<A[-qH*BE)<h9%( ȄkDo;vF .* -Jf餇wD+ akbd ׸lMtnpSJt]8E)]e&ɱ?O%W1$L׼y<alEOM"} Z>i墦|OHڭriWT|dzy ڦ*|]0Ln +`*Oܬ݀ JqFO9_Նua -01|~Ʌ*AS"I,MݍK䜽l˩$v8@Rԃ>ň Ξa_ݧP@onU͜oH^96ݲbJ'E2k|y*̖_J=T e-,1"4(z@A!j-c1_6<=rĖyBé!ہ;tܽnI=Y2 ->;Kk2ad"]hG7$ңe'e$T,ln{)5'ЗG~ -] CeiB`\Kz)udB@յ(5s/* .[8^G7P:Rv?vQA3;(f(NHJИϙf&A ct3rrxc$7 `m)IRk8Cę ,{"02{g#FXP*,gH7+xُD -}{PbOc߼zZ-+^?aK_ x`u Wvsy lMuC# - SǤC~3_BtE$/ !~ϳZ#&[Zu=:t҅ψ`'PQȕ4G84@DŽ5SMܓ^ -=${3( iJpu5,(IR}+])0DI>Hl>ihf»'/Ⱥ! $tO@/{}o 1jXG;N_=.Tmh Z[e( -Wt9>x38}\TUۓ]5tKh2ľHާ)J0"ӑҟ#;@m%w(%*uxx `$ -'ݢ@RU8ȩh #(Qn+ЎQX^4A'ccNu9Pm 3c~ǐE1GxV̮y ܌*PUWKkUHJ-Ikb _ -:r>!g0$Gc`V(7źH lG D6bzj,o?d5ڤp9aF=XV &ɇBHVTT9gSAW[9W4J'DL{̶̃"WG!]L}v2{bؕ׈Bs/Z7;'i=Lσ洛6)d$* jqAl/ -Wǧ`ӎB -('t C=b9P"9gh#5U)a*WQ8m"YG{>|zUfd3cGM5Qu<%zW $8tѵfeU>kDxRZ&FVtS 9lsS5PY{FMh>fq1"P'؏&wd@ R5 %*:SU}Oݨ -\E8PvKrt0CDPuU5tEBQJPb>j{J2XO -"'44&Le;hofw4!OB}v+r{("&mę“dhOԂ.( -cL$"x.8hاBrzLM^sDܪ'{8S?h$۟裗[\)FPSL<(JɵE7l - +\_Rc=fyZuA=ou&dK=n)%,Z3A orNQ%Ne5*⹔\lC!H P<hL96h.@֤43 L!GnwX@Z48IY; ~zMM#iP3 ӽ7B;r&ɩ'ڼyp{BSAhe;,Uy,&Wx{ XZoZ7yͬ)'rA>zd~tۋHtTSD9\BXPk>)iK:ΞL/ϐx)˦)TY䋤.Cm+IS㑸d<'fw^ə`aݕpP吙C)2@Ѩ=Y̏g^e^e4],غJ΀NSҘ`}Tסe#"+r?)l}WO p΁GW223M'3 B/n;K(Dff"n/G0 ; 9D_:s)#l -J\~=ŚBMsPN!X$ݛ-]E';222u`OFOD2x"-T{nFzaR SZ% ۭj)@2q=ÊR;CjUD\Z8;Elec({>r9eQ;'."@&~ _Wt Qs$uUl|D.5jH"c4ƟjD* ou2y<yJ*g`:{5lV$DhBZp@`EByߏ/q:}_y\Se"q'߷NPj\3UG!ѝ]]w _!΍oc<(BYĎc @u:8;X3h `CR( s P@Iġ,iڮXT2{o8=>>Df3y=@xF(\\XKb-0|=;pCB7PJA*ЇH&GӅ`$ ~#{yO 袩?#6{J D[ HhP7 )92z!Q}'?|Ư9zSS! `HW"z΃ _~Ȅ3f-5~Ϳ?ǟ[;) in3'ND"W`isGV/vD|9zEqk̽ޯе~ -lNExЮhPor Y3NvlB9l -烺H AKϦܠJvЭëLHøA{\V(VA -x٦z8ͨ[=$pXc#B{wduX,&,1zu alyyļ 1C:LZq"̡1Vg+p ׿6 y|Yy4=I% :#DߴgA/uP r\6~hkCL!A*D򹇎EbI 䭁Y$|1<&9Dj_C0P!sCӍ!7)16 Pw c=tx}"feҞi$:@SѫT)aMQ3?[0M]ҡ軱;M =S:U|{qlPnar}ew0PE+&SuPI[Y:bW_'aҴ -QB_޲%LOu@* -B[ڼRgnCXOHsn3NK>C%7,K7kGvh:Vm!WrLh0'@5Y_q @&B?"I_SQ]W9; xC|:(R']Uϻ/, :g|98lj&_ҸwA3,yhpo9Μ a]kL+ @:vEr "7-)8E-r ,Z`_T72.r=xwŵ on)n^GWL`>UAV ߷:f!}P~{."nfI>ÁК 8PI% 9D: -$]aC +*P5:h 7Zq 7>ڬłp>-l1w0;^_vN= wy_M5U>~qpew,4 0ڽfJFWrBu{2@$ 0PEY~eԕ"/4r@KS_5Ei'vOC,/ի A[Wp3u+lL -EIi@sʗjt(v EPdNcbD((o%ȄQ14qSBB:ʡ "@ZWYqx"q>P.ve7JNI? -yS!ZPP}e&fCHĈ^_oXWQRMxi CƇ[^tR/qwpLpNC=,J/u`}{px.Z݃Z_:⏬rUdCN}cjPΡ;ymwʫBRț^V z -r\~q8t\UyJ5w /{f@Y8P4S{*%0Bhf`Ov71|{cxҰcT"4&l^he1ӊ祠[eY) Uv4-9atwaSՂ}9@&3߷+Y25[! '{Eͣz,p2. (Ωܓչ@#K bh#=ޑ2O;櫕{|zc6TYh=5iw&3\Q"q= WP!_K@= 箽E!=+Dol3%&}:3FO lZU1coTp -3zi80Wܭ:2BQ04j`z%"U*;P*#4a ŨJ^Y'4DNcuDY2!5 Thp7ƴOլ3Q冧r+ĹVu Ż]+:ȼ>R'Wzv0VqRD{&,'0L. =hRvdx:v #aÔ'K;d%/KVD)veݐTnsA@#anT`knl0[ak ;,Ekӂ!b7 ᰧ,ٰĘݰ5LF4ȁY@b8DN@V2q䵐'>~k2cPbT?Suvex |F|}ݥs@kX#WCᗓ{+;UY;Vk'Q4G] -u!YOJ^# ?g3G*&BYgrVecߟG>&"l'N/%}6E o(>#*>B!ڎ3 w;7pk8jgؽ ^/cAėF>EJ=Zf9,c\dW[^{*dL`=^IO+ -M{m8epty/[ q!83:q!`%(pA;t.ZU}q;G dSUҹu@Yp9gEVWI4uU6=L  lf\m%DA5}iݪj{f8T88,SoΛl8^%Q+R)XJw&jlU,|QHA#د@h Ѭ[q?ʕ@9d. '靫> qY<2<_/w7 wѮeQg]y@V]UW'rU]nܽ7`$?{gJŋEoJCh0"3@e㣇zno=Sɉ&$rG?"͵/^1!GQ=հ7EҜJ1,z(9f2ws>GVd_ruݤ{E0 4!VD}V®C&Kϙܬ!e-Olc- YfG!IySx[aO&X(HƉ| xywA8-̑ qa)b -Z"'ZܴN8~sW9TqP/-r{1-(>"V8@EyIyH#s>z!O9DZu<2Rz4u!!aMxJl -:l,@>bRѪIАrZ@L`o<ځQ`{=@-UOZQіNq.ߘylyGzO-Q-ʉ#aW9)GíF=ȝn-=R|_ӪnN\DdQG{XɽvWFoS:1A!3rDZ!&= uj0u;7_cx9^c&(hb)%K6]"InDݺjd얔D}hNj9< - v-`ɤ yX Md޻! -$P#w{/_DZ [VnQQWD -T5h`=$G~GﯚQ`bP]eRg-Iw/GI EsPBvX}[jZ ^s܇[T )5h}t8[=dv % =ͩt4>{Pyk!W8|ԨqA_Zh/WEmNrJv!g؍p1_K Qa|C|1JHU|cK۩8@-a"?[#QCrc> (cbM=R)M S:E)TPO*K3#ÿ́NWbK`L'9OQW%VIv2vρl(+GZJ;Vi?R&f •t -T,+޵$+uT!/J -$-Юbiv-*[։=m; b;4'$r4h*Py(lx -Z~7H Pڪ!|70dQ/T6iY9Y(Α!0K=(iM?3A%SȦDep -fؒ_ $ RYPZzAa,ƨbvA\D4 $,pV=@WļpWșzd1i'E{;Ds -[aܑoW^iBi& U"Rx)֬j6܂WIv6~o(=%*R J01>ܞ[2VtwPYʞj0@vPE}=4]b hB]SW1>\p޶_0t@*hC5EX G?n$;'M/<:P{= ɯq2_gZ/dr ԐWtZ\LKIUBztXz;+!gb떢3,<-eI -铠x|;.i AD1ԑ"WUI*QXQ$yu\{AxuZw` ],>TɫC Du0IyI_2|ز&o߂־(Uaa=G,APd7 `O8Lvjq}'#ىt:Vޕ@l/J5e_˿}7VBΜK5FbcXkVzLd#tמzǕq=8Ӥ>Z Uk~5䀌Pk»L"ɮͩܨd?!Ȑ[(C -Ƌ^>E[Ƚ{ }Q jf^z㝠72ddo nibȿ\?RM[#fA,'τetiY"ņ#5Cp Ǒ1GH -C=Ӯ)K"Z: S,pp̠~pN yc: -k*{[7n[g )YK?{\Tr8Iٻx"sF衑qt z i@f62DH"e v(Vx5n^GǰJ!X*>`˙_cl!;Cv04{xSm0 ސj >mZlأhjvKftn -!vGLD|ւJIHr31b%s!=ح"iStr{6"$?Szм7yxLx{vlϐq~dBC7P:D,#$PML1 U;}L8ek(NP.i֝Fp"Cn8P(`k^:C,vOxNp։`q+ t ՕY9+y:f%ry֑ -zp9FҜ$ MY+ԏ Έ^/ -;)jT)vIiXDA` -trT3W  ٣tQW(`DVcd!T)CeCWe* gmxƞ902S3j>K |_͛@Vxw" &`Ag.24EJbn45 B]qWim,ז(kNqPKd -8vxCQQ5"M<3+iU - Pb zJ<\Y ];K"3xIwUӈ G,D}3X^!C:Pf{"K>cٵ;EیPBaΕqku9e 0"t{N+aXZ$ [M&(:9 lm=)T) ˞ CAn䊱eL"ZADXHTI@PO&P6~!ĕydc|^f>/֖ ǼfzuGwht'ߤ1„W1nN!!TuL7SPr!Ak(]d6#Ih)Ȭ0!Ҿ.-&K6|p#[EBAMTC2`)(EZN}!Y@}MYkJ6-T'MF/I/tzeҨF_MiU0%+D] I*0ϊH7jtsK#D~Fts Fp8N =K -$@қ.^<$DJݣp#d08׆ zGU6`Bd$~uW؏ vk$Xs=ݣ&28QǸ|MP0K눤O 0 m!ֱAPI ¼BM~^KL@FF#ZW -:\'TT4Z 6#AOގ ewg0 ?a/<2=^ wAޗsl`FXP!4Hi12(gߜjz)fN{I0K*9 |e;~q -γ{tښ=R1?K`5̦ m?L>0%?P󑈡oUC`ZMsPQUu!CjIkeT땷h)DMGCX?CQ}QV]A(-r -K#ϬQ+j$,.#xøhdH v{"_~N[F%uS@ -n{7<%Sr7KĖíV9ɡ3o"BSy$#_^JmhV |BnEW꩜y2uԊX)Yc/!futדS]~!bA4AHB^gF.2g.jk{AH.3-WVC@@)B:-m]mC0QɠY4"Sp}8& 'ddL|Tyi([5"8\<\\ zΜ'fqy TZ0:t{)5HzrOCFEv`ƫl&2eI4@ey\e>Zs,U?NIE ;V8̼C{"bKr0g7V3y -G_ *揌1w#n%)@J -h0 S!/$nJLV/ b2?O_V?Zq`.2G8Qe.s59kYËkjISjo$~>~9[;YTb( -o*Ӟ3 @ZVU\!\/$0 |@a0 lfPs+lɯg$=ly.b~k0euC [(P[j 4%x0@( -mlݧiEk)>ڟTIQ^2oB2Lw0e .&u>0JZ"5Qp Wqb6$AJ-P'dSrYwnKV4js3D@ـ+_kޒx*AVIOxI|YإX!Ԋ lmxl%~RCDw߀O ʨn{$p10E )HAtCIQY9킟+dyU|@!v\n9rT| 7T4Cң2ZnRj{z+PqÄ׆N: 'LnZ=X%O $R0{T14BvD(kDβ-4t8$!RN ae"/8t:_sIk- $DtLS$Bfi4#(~=k'/M -Gٚlje)@MV誅0BC -P:Ɲ0!}ӖFvZvCOvkª!{4ڃT8+O΂9.BT1^f?@@TYlQXG_6S\.|5@]ML#,x2 $=fhBq_XDyũI"mA>J{' *ikOG{yD~{1Drr31S8ww&ezNJE]Yn,Swd Z݊3vd8&ժd -V bAe<L)c>gH+GeVnHam}>w -gZvELm#ѣrQOۮm\Gq_ L:[ n< -ˣ:z ʶlÙ:¤>CՌ@'W0,Z(Qk)hC}to޿Ddu`2󸤊 ::mh" |>M*vt1@J?ѵcU\DuM͏QBn$,j1Aw(NcS^!vgfdlC-Ψ]'fѢЩXiSՃ0h !^Vqy.cn ",`WrԺ aJhG4+ -M0d{]#A~XAk hrl 0 [Y {u}ӣvY97JV)U}(&p?9֥Hn -r B^aܲ||ĨPXT'j~LTm6m͎ڑUwY A,yZ*g͚pݡHQ5֡/w_vd\#hlVT5m27ECA S'BX 3oa.Vx %輡wu#wQ5hG2"t'|4<#SH/ndfR\o {\ u٩֭ zuܵ<-hQ q[~k i,-b+#0A(ah72BF莙b0aqBD: QuךW<ϒJC|Yaoa}K)lK8؃?г{/ޏGkG.Ox⏧9r2n{۷,Cq:)̮\S*#EnpWi"'`.4c fsIX@S ccE=yrxǻtwsqN>,hC51/ I -H7CnU Z&%xw5_E~,KajS necF88Ov<ۺ9z`$=`$0NB ~ȱ5I `/s D0SQxEN#Q&X=?P'͢Kf9Wc2y9sKʇY_ݵq׺d GN[rSXNC{mV*MADM9 -knFqpFJHW@E/~9k/C-bVP%BOkY7BApף(,W{Wט8"Еnjc^s{ Jz~^՘4 14MNѥ!*sYҡ觰=77 ruo&<)%gH"nwT2{Y#t#GMnX֙v "D@:ek3zDbdh@A63^Af'GR~8@ps5Z8:6-pG A~W!rO҃aQk-;Z$M4]ع _γլ:xi' &P1JqN Z#>[Ûi{ZS5$6_`ie"'zlZN1F>gO >Sm 7佛AmmgW3[slÔT!LRh5I5'pƙ 6 I̳BC~[ŗAIs`d?{p|k]WXIDCkz3.}ǹu'>H!cYC3y*R1sa-.l6YKjHͼ<T 4ր&h6' X R|"id`ٴX c Zia$Qq?h̎hqk(UuJΆ1r`^uŞ|4 {VtHNܟZS!͹H7,PYߡd- -#>.g7T(GsfOK}rS3gVO0]kV&ɇ¢_No}~~T~z+QJ2ȝC<[:Bt<^2 $)I6h%"BR8LYVu{( -Cԗø")$,$Fo!vtH\گ1$Bc#J'*>+x -2X$[x-nL)|>G1"u6gF*H[IGp{,:RB J 9z(o č[nM/≩w1 ̰JCINLh{ h qX=| -ah$s.zkφvZC8L$$#l:Y~S -7㉮-K4RaE.Zs]m 8OTCp('4O`m$@"$@|~vb}4P"i&,7䎍(ʑV+ 4=ҊBw+ _ -0y(_"_>cm@QlJ]^4e-LJY qV?NC̀5S -?З[<-tEЦWT P>41q]%XpE<{&0a溘j|PDB_6pȓg(!Re<ɏ #J3wr (jZ-P1UeW;P=6wH?߅X7.3M[%}Vjt!50Z#Ztljs)7JJ#ј+2HRA^Iz`z/+Al K [ӳ?O4??w/W?_ }=?[>WcEM$~D3At ͏m"FIk +գGWMc{'=)@\2+[{m"}]ȶw&Y_Oz^Qo:e*$L>=p!у C֠GdϚd&h=U<pNjLALs%=dLnȾ;q -;܇ (5pm]1<p:@k A%= hlր_0"G v%SdItptcσj+_lݪ2%>}ccxD҆zTVi;пG[ Z>5# '?Q!)lOX< .W/X.N)OγC,.$qcL7qY:Z -?0!=P}=@tDzJ+TBqɍR6t9ڑ5m3yAn W{ܚ8u}2dTdaX՛Gm7=zXO]In1 ПTP<.|(\UechI gbR>8 -ù?yԃfB|x)S$,ks F)ajmѫE2%Bkݍ/^z!gY8_ԞU@ a ]- c{f`˻i;K"jr(mp:dğ {cW{}2"q:rcLDȹ  -H;;,ҭ{Cq-9ro 6>{)Yfc0\ʊ}vD$@kJ.Aۓ13n/'9ہXyE$[x^Ұ NE/&ϩ>]Fmx -wG*hՑGͬɎPFZ|8JSjJPn&'c}oX|t iZ(wnCȄbv_]YvvMAyT(pm Ҋ#w~  {NP(uHRH6-˟!иb#Zo -Bo-*Pne+GyD $Gf +Nw7?|PpTZc\n2b']* ^>.C{!.?{<.l`w%5$=ea^q_N1b碔d &]'S;sC:إ'|@Bw0="28>]%e zՎr.٭ -},aɤJfpIu2jpKp}dĹdtw4-L kj Y.v[fm8> -|HO -Dvv%ź j3Q-ү$Gʀڑ1e8c, -v,wk_!n,li}^a.TdYvr@=Ǎr}o h>Ыޓkj *$Bbs&IdG7j**V8L&"*j#u}x`eo0!I2Hc ;D:Ȱz!thvkY0ȼ5'}ofd(Sz0SYBr;Q`Maᗲ{hNCUDlULY|~h{=@\Z̓tJ:2$Er>ϐw)pNĆ~m"6ZDwPDZoñ4B*;eBi:b'^U[{[ WNX3,#.oz̨DAcV> -S -^2K.\?J;;{\M{b"ѻ'L7!"͵o>f۵]>nHRL`ù!c-ҵBz w-U -̉87KJ^%8P%֙u8Z?7^2V!ՆV8@\ҏxMl𰖹HAMעsY6Nѱ0ю -8² {<>]L<E~{%GOQFZr⦦D$cYՖe$z}{U٭wR{jcCU۷nUզ% `v ˟;|.RӍ8c13P$GSaAA*yׁc(l\HؕIƱS+fdPj{qކF3L2sKLn=1X=>g` flix1 :תj0$\o((( ba䁩y-xjhrCL Ϊ&y Xmh)nURu|SD:!yj{ כ32*nd }ýJ1U낮] A[~dKAи_FI$ - tm -ِvȀ -TŬ:?ҵ[[g:b0Db)Dg-iH:Y'k:SqT8l"G 4 ,`דceVeimU:,ܢ5zI\=Z0ak[TcVe-ftMgtY=س=4iU'-m]j0G - -FCx܆y08 AVR Wz؎rx\{OJ,r)Xu&ڔP"JkUZ9>>'R&?:槲=0Ƭ͠b~N`F15馆 8+Fl=48Q+s"X5}i$}FYh5D/1օ+ mL|BI -*G˗XyJjʢ (H - D - -\=pH -(ň:IAƖQPWMSE"}+ )io -[K+8N_*,4›qZ=,Fn>݄BȬ(i:s -J+olSukJsE gOP68C2 j{OwOa'0-@N@,XlVôǥ) wnY 9kpE|cpP;=y{dj^БB~?鵣f{1 c|ř0[Lk#Q9IYz Ɛiv$T_0G׽{tMe -҉DE[(7~2qiք - - 2?_س[n3IŅC"?ӟ! ,?ғlTyre#}(j0Wl`QTZr,s2F~mp/]qFK Wè[8#4&L~~ЍU^vPE"v1ޡmn>ya봳p4dj\ԔG)mҔ(݃ ]µu*s}Wq jCaD6?b;esȭ&85jYlg3Ct!6@ - -υ=-A~n+YsD+wTg^2Jk;$pogf"%@e@ NPEah2"ތ7Eu#JAFu)_G4DrTzoJof^7%}p֦ᢜ~gmP홰%; !H+0k!RVGYUԦ#_rX@",5lY|)c,Oag1Yط> KER۞Հpgi4,-R(r ViQZw/W%BG;7w4{=_~sb=Q Je<7=vqCiHPP`^p9BIAfYh^s ̙-a`]k\&i=m.BO2ԅﱛ?:᥃l }=|xG.CQ-=F?g @ŕ@L;`W  ytL-bF&B+-"]8CI4 ׊ ^7=R?e\g[HŔHW6),E|a{f oyY(JHвcdvd:xIݛj܅494 ?>5oQ %d2sX|瞩: <5uyt` \c$kiGjNe^:j c̮, )~gp󲃬G[S^\ZU~K0dH'= G fVI<"Kܒ -;D"Ѓd3vUu؀ ΁ȢJR_@BC<väF:\SJR=j ,J5?l M75GkJ@le)cܮЦWo4q%B![Y%"OpP>ŵ?~0u*nw_m),hb3ME޴ZcB1(Woz@8E×/!%x4)'.yǻ=+LT;oz<[8؁Z)su{UZEj5|x_O !Kf6*W #`PIRh$;8feRhW"p pN95G)(#+ձc[M0" N܀ xl0R1jz[*9 NLjàa:3~p(/i$}c??+}|l몉@(_bY>@t@\T=6K -)VK]Q:҂zztqOPkvȝH+ -1gȫKْI~gNVk sq( *S`1rV.MɅ6/I>lxHOkxp$P Jݜ6s*FJz d9jN_NU/C[nA|<SAՂd i \!MS>/\v@Ё 0 -70`Vv'K}"I'4xP{(G"qOH?RmG -k^eL:0%VWǩgƧBE"YGm8ܞ LHJy1ecNW@XeO&{ȡ`dqiؿFIKmZ:I00U -$n1" K?=3s'i⯶ㅘA>!0@ -V_ ~ç C2[U⒅C2KǶ<.K6ӑ3RMBpӘ_ZX &ѻ o4j XcF@*)n O<.0ugt ;LW XgA2rG0L.؄;75ĮF -LC.GdEי.bV51'm{@m"!ߴc1b?~ ݓ -W~x[ueG5>Cm ł:^3l/6-[w0Spd8sUrz*b5~JV!!>Y@3e/(xӼN[uIh -YR5F@r3WrBgnaYg{K\GQ"hs"Ƿ M*Z^$Evw 8=Nѣ:b`dKq&z8KD.5t BPCp+a*aяNApP3Q0+EV 5O?!kS%@2 '" nRh{Y䚠vB".L*uDN #=BJ4k$=N:\שvnd,v!z\)ez'oفu[@0}/D`suD28.vi%@SdΰRn" -DOYivB(@n;+i`OvtyS5;bPɄj3v`KR0BPaXOlDDϤ>T6IqJ^aC݁8 -8x*r KtfՔz)n I=W`݉|+G?*2V0/ YxT"$#V$djI$\I"EMҤ5X6V:󝍲t{4qt NISLl( - _;ǿ5x=|(; -,#,SaTp7Ra|Iz nL!h<:fɆ d:hoTWT0*NnL}ϴ?-KܠO'?Г4x -1@mWL4*9 -~ S}s ̮s4мqS[X*iT>\L 0k Slõ8|SXY]S@ұbHQ;:\랯 4 b=g ^ʯ[?2U -9:Ųᄾ!͜$_eWSOiZun<Vm&$-!9J]=vOPK=)F7IYta:/Bf% -ei u;S¤,Δj׳G,_>c)?3 -WAb(̹QSu[wUz]bWLaUJ}':Wи#wGXgu>eN$X28w -X aAWJ5sy!,r ?]+J)WkاB?"%]a|"C 1)D[ .#2^{ |dLmP9r ;YP-2 T^GG4C:Z]藭`#horin.7"d -agO= Q")^Y꟝EHVͿCfU";0"<k0vr|qB[:IASV!s kBuBs/rv|~L1#$ٷ t o,BIŵV@2i]_/jA\Y6v -YR<,xyWbV{{uyWB3Trr9 -Vϊ{lԯc}h;ssNz)lcDG 5s~:\ofn努6|v -TʈgQ`!"wVc#5O#>)v1La};wV!t|δU/𰔰xvH*X`VQ"~y3OIBn;Gq?H<[W +fr#, -+j*[Í?@˧ۢza$r?\ nu=ӹ;WEGvJ>Puϸnea_b͡t;V(ll -h[d}-l)E/Q -MO6FET,;%4OqUl@zt-87;0agŊNtY@4^:^!F[Nk&y\3 -k L:Ks -M:Z)#rqpȽSo?jx6:ќgD x*RX4ŰIOFR[İmPeByc߮ Et[5R{ЙUX?ژm~-L@a ݔuP r[9+hN/9o;?aHwYsZo~a@Cĉ2tj13'`>3wKh5kzҪ5"MuW$E(W|JΞ'/o>oI_+JkjHd}~jr+vEH5OU³"`ACDL!рş@ r7C و+@hNv*,BꭱF!Tk9 IqjSs^ҺGxp d3e% ؼ-++ڷ=J-…C@=mm15< ~RvFHp3JZ cwqfX[& -aSg] - 5S!`O{ y{eH6 Ci yIM# RjL"޹aU&yfϡ%(Ztů߅ֆJbR}ZِlCA Pyp޻x}Cb52{,=<˅S3 |H`ѱu(_~!L>q6ĀMz\O*;=*j15Fh&47G3v!dJo$wYDwLSۆa -sMs* O^/v Aa8 -`ZF>ۓS"S0ԃ=#z:A6l.4"X2i;FM7b{I47{kמ -ƣU-ݹG$xo)KUd!/5ToxFV;nM0Ns\D(X7ڑ聐=BܧJSLƬU@Ȝ%?_FKD0Fʣ?hۼRA_&\&<Ѷg0`ոBv/V:U?A) \T4Mէ੮Rb+=lxC HO`Eqi^h7O N{꤭E?H0S< )E!sկ:71;CJ@Q-n:Z$ #b]wgaTN]}n ZzXgs4!-\m^ɋ 8X&SΥܖDT,B"iF|I-X"AƬ -gwZM -B#@\"hZ=L@M;e b ^b[ٳt }kNK*؍! h׮Kwm #jLȨ:W5~t>FmGئ!XG -t)'co:^󷈿< t\Oxѓb˘q >8TX΢3|0tc-~;8.C2 ;M?ֆmZdxOգXv;Ed`u$եJi#\HX"#2!@rbQ榼c@q;=# @^47[;@}ڮ˜T \l{zk`]S;鏈ͫ]9I= j$8{tWQ)|M{{\є%,Y:|"k _ -a3c!0.4^92C}t|P6uE [DW,?=Im/IMCkl`IBOqPJH^qEj^֝]1lQuqc>Tܪ5"_KEe)(ߣp37#{\WusZǔ@٤S;W#vjU;gݔx`ǟHj -U7XN; Vl "]Xj*XN1CӭF ^SRo +#jy(R9GR ($_L$mc\3YT\=y"g8(8_2$[ўJ=|ָ*!qNYoWHm2?,mR`(3Ah RpuNR "E@C/C%;9=/kv:I0X(){޳0:s2qHc:WXބ&OvwoM,=&`_ہN+iǑBnuL2{%MY6w0hR"M¶P>̜&suz`kgB_*IT׳#Qjw\",9H=9CT b0-#܌{ð`h+G3嶻g"դ]4}J$chɚv$*k"F  -gfQha@kT%~5;@qaG]edUf4b1b]ɪдdX׹TeIz1{8>aQ5)Tgľ-=p##um(a*h\vUXUGD XΫ{(dYlQdLrU)"oe3b_6ny#wfG}8':_PbrM H5Bs\)-9-KdT.J=}Q^0k@I }h?p* j-{ʌ-K&͖)u=yW'k+㇈}J@Qe@|;ݟ<؞akO{zb1aU-6?|P!T:\bj?5yE\\y lQ1s k!#Xfj-{[QA̖ -t:%иx?`HNhnY2>`ET}!n;_KS_H{:&ˢ湲hRQq>úF|Z, ,F?S"KfS}cN~vӖ?VuxDaݎ^BaQL{WWR%+5wel=ŴN*t'!i-i{ ʉoAU9Y: ~豰~DoT[}:ɮ+!2nF ;e$%) }SW:RPpLhP ,#K Z[nC~mBڴ7n/+yR{S4Ԋl -ݥ<fхq" 99RbpM&F{ BtBS }𒨺lew g!_tb ]m T/AH(k25/ jr"1Y3`@}Dvr!4l S!5B/{(JwFHCyj&"l'Ofdۼ#(sGDJۭ# e A>ޖe!op˕ZuKV:,k:ҹjywt_RJF*Fv)~`w"-t#Q`aE1 m$啽"xuI;`T LW>bϐ~*}<>=G%TE - ұ#S?#pF*[ T;sc/W Vd̋7t{C+g+0r(r3 R u&KTwsc^>^4w?3p``P`-B% -OxqљDs{)5ۦ Ddk%Ǐ"0)j̀V|MpqzX3 cp^l1TSᅛ΍$<9׽ 2!a#aJ Sy|X*T.'Bn¦nωJhN*ܪ>\Mg Z]U|9=O4R? "BQܹwq (j!5f9g6{0C:THkvU䝈|C-ESw~H9'_}>8A}SV.y !\V~W:WkE-h*b"*E=z:z>#wz:^s>* !hS|$@FgOMO 6Z@1VDGH__-~]ϿL,Nm-A][k\{09B}FG7sfߥD_En8cE?a/gCabw -M Wn&"dqxr&NqcC#b\oYl6P]&#1#!A9uu8sՐKGLnzmѕ'_$(WfG/9D$?trl| Gh{ͽT$0b>sLDet#p Aj ;2OGA #tQ_)Rt[)҉rP,&Z3խ0ػJ9azo+R\:wV> !.Ns(46#֐rq#l ]G@d٘D䊯+nsf>)PɁK4ꇺE!# -|S%IQZr(K9Shř׋Uoq\2Fl>d)G`` xG֋tv H鳯y=#d]9ΑĢ#wm ړ3bAyEA@UbARW9 vh1TDq|!քR3_0X֧q"*4Q3d7h\z2OWœ 2gG7LPXv%3BWoW/ƞRDZ-DKX/ "Eg3aGԨqi捇^O햌K&3=䞓xݪ^e9[~ 2L8AVZOG[쟆`E -I+G)I0C -҄d $! ТAp"uL9"3hٞiS?"=>|qV`GH)綳u?' g>U0*O)iUVm1fD QI!YEC;`ٲZJ(+SZb&G÷jn |O~}PaM!hpA'gOZ~??O?ǿwbwݿ߿E \?\ʏQ50Դz-m5"lY翅mBݺ"@wp](fxOQz{" -!bwubgqk7809I0uWxc' -◃̉6bV-1c~NZM\T=5X[u;$&t)E(ڍUcdg=E ;䵔f!N@v}+=ր^髆Mko$# -:[;Ϋ>eo@#)#\p6wb2rDOqm\t%zɉ -b00CU<ʌ0 È"a\E>5b=лי? ݃3e4(iΩjÎp9"H״siA?)F )iҟIaƋl|ٞžAGÊ CCz} >zz I7N$,x, "b6@-3P;3{&>JO( ],wl)?|mm8 u:,jfՑߡ<#hBUdS5ܤhz{zgG= *B=bW1%vqÁ m/9 z;8 mn\›47o^a`A8"Pz0 JP)Z5;6ǿ ŧ-%aad[>E ` \%|a} +]ZA4(2 vPAwgZFޑ9R*7ƮL hn3?\-S} j Ǻ BxU3bԲsW$>z_M$#[}{oLJojϕN0*35h@ 7lDwг -9hDX[!H UF~{Oco#wW/ -r]#:!DWN(] ON̈,|[W;1s6ԕ(zB\iCc"dcgM>4I.Q=ˡ߁=_} ?" -B8n@EÁC[E|X -tg<1@a#(]x ^9e첿?'nqZ˳]@H,QsxZ&CkzF֜ 08J"P5 :J#1U&ޜL)3CGlE{o+Ӂ -kH=RxH 4`'B q]T=Xv|H@}g[U0v>5pѫh #b] JYp:>}y ߂Y? =5BX+XqfK{5cjV'e+Zw}/-T/L;$.ـaDhO`!\vXڡ=)ZA: -V P?̤;Rv}\ -|lMLͮE9+L/ Q(zضމp3?CSqpʹn~n ,ÑM -4 -Wn 4ͨW#T?=%D2^8 z[ RD%EFOgNn=N,/ WwlN9m{xUߵ !3ړÕ/yg:1"~ ح5Jȓ>+b%1Za@m!bU߶k( е~!ml^G o Z|K$ z>̛eO+ė'."rC:?Ee -ka ̫a3"? QKM:Z@/Of`]ȭMw@c -^4ѺD  IPVȪ;"E=jG1+]>BG`cg]& - gw\1L'-t]ݱִ#ꇢR)Rv)v~ -aJD~@ -W坛SFÚIHωZˠ"y32J/&sa:g)g̝6_ќs;sctT6SVFh{ Ɗ$"tuXjMwLU1pkò{&E۰+aP!+AɄy"yaJ[JB"+OU$0ڙ#0e>X*[~i[Q1] Hϒ=fݑNqĖ.>ߣm$;cP'C;Y?c%W\CS>rgrx]zK1bf*IQ0Ee>}on+wuY$ȠψMS:~8:R2LU%aGa -bϯpHYi!T/7#Pұ[ytfl}iciX -endstream endobj 309 0 obj <>stream -m57ߨ-O{am"~*jJVa!7eu*)6,IL`Jbc}}* Y&vg}'HJ!ǘq_VUOn'GO1 G+&S"$~P4Ii0v!VD{Uy\k_Á4> 0?~ Pu~^l"Xs'. _,<Krh[c -XidC-u`7%ZZ6* 9/g~N4k<x"̬/ :w:]4V^S~,n'.Fl|Fcm>J=gJ4f $/lB- #s`7p?sFi - |1VzMWZؐJy {EJ0qSUAhߘ7? T 'Jn[NDPٌqV5ۆfpFQ GďG-E%YV:<~(q Չ$eCh.៶e.1YFn{l`T -Srh:#b-li - 8-V4G&πSR׾>& sY֙z d$qnd_ڟVC q{V"=gGqox'DPRE?.<*v@Q46m Qg$Bʾ3C4,-XZD-8 \K;gwQ -˿QJxڮSAk<~qrpRx VWyuƣsJ^ 2pjצ-0|&uW+VRHuH+ܤ;o>G16O=O{trFaIY A#cKc; ~=W"ӯtY̞@ eflH!/LEmRN@GqJ~HatY0 Hy4:3&Ϲ,dpXVQ>.=#ܥ9 ]2`nIu2A?[w-~b/Z*MĊ ,*= L=12uq.&Z9;C' % bƻ&kw<=уY{l24H+@Ȏt m|ɯTu= `Cj$cXw]uf?E۶ذ,TJEaXTJ˥eX52ϝ0`t@`0ZuyW<ů3mS]TnhM"<0R\y[5l"ec^/|*l+zf;Բw Vʆ6G3!^!yuu>pVЕrd6&+=>.j#$Q7˔ÁV tFT*a tL˟/RO -Lry}WW7<x3AF.; w!NYۗr>&Li7&,VD%B2P]R>Twa6{{x;1¯<ޭDK6ӧ ` 1TI r3>`~V+M/v6k_HBfGbt86[ts #z>#v-HY'.h&"Ì#ZPo9YпUwo9`?˔IzҤN3^5ܜ /8Z2W\ߒVklq GS͍Y?]]u)913Usa5n͉Nxm.YXĈ+y(_x?"Sg\qx)[[]SA}"SfS׉tY jE{Xs(cɕf>cu XKtA]H)քU//.{8".HNo 1,T!(yY5n(J÷*)޲0晉lj >(A0i!ALa -J}`BZ2d=30D ޘ۵Ŕ9l ?"0XjM|D)d& zQ+bC {MZw.;3~ گU-gL^'J?`$x"ض_Nו<``mX j3tŒK`Յ!ʓ }naRM[NE}ED -Hj#9+,]_g#8OdU?J jJMz((Cia^Ȝ ^<8ʁ %(.BQY`n@x\yW_ ot9,mW `=mjL%yW~{T8NE2k5m*>{'_Gp`/y 6tF7 ʁ@3 K|`8\Te_@$7 }3! -EvflG!$qސ>GݽVӫ{lic>ԓiRݼb>3&wWs* +^O߾Ÿ]@O Gn57ٟF*Gr7N =dG(R~޻AL)4IL& I"SQÔ-Ѓ8 K &c全-<g6>Up@уTC3t<nntR`҂J*!Qݐe.[:z",|8Luf >K.j k(Sv>fHE(C"E_`S|뢤u ;AL5.6o# Tb{y F6})MA7Ld -y qSvT1;{JTWPKvTԣA1u{e#"%vu6+@#=i2ǖ*-[/n۝VK&?M݂6`ekGzCJ@h$ |ׯZ0~J.I՝\!"1P:c<X=x]U#ȟ'm  #N0 !<("9z(eSᝑ?'fRewEPa ‡`Q!̯Xh2=бeO[! vnAK~Liz"ߎ^PFV!QXo֧Wi=uv0}l@vaE*_ѷ E|x T&N T'ODϠ;",8T6Wdzu"ZùÆBǵ#mtl" _ؙ*=Jz8יeD4^۪Cm7Z_^ FxAT)M2#)VZM cI~#@H!:Ob{)7*<"q+Zk*,{^UPAŎH|_}}Oy᱐d&lh8Y[o,]q>Do^` )*%<&*zjA["U$Q\c!I: -3V\KūzVw7#;zH!i - (4L!u/R4GYD8@Ɏ0G)&ga[-fs)΂g IAjJW_+Fzx:clv[Ohr3*+=hjvF`3os% -eV6tnRx] "$}}s[طZ1FFv%YWtN8p{JlV}X keok׃|{:NZԞaQFcO 8m)ꊰxWּl94k-J?W|XH/ `<(~J% Yo#1^4=ehT lV]ʉxX_aqA ?] k!fr])[Bt:)XǕJN% MO )n--JG-Moםok``D]( 9ьSaU%<7tcFg8`.ovGkCNC [%2W,t>MahGkxl$,)-xu+==儰>sjfQS~uc:s -0Jċq8P`, ~[> r2TaB7n#eۖ!/hz {#nu㐖c[ -z-m|"U#.t!=~#iqܿePx S(ynp;vP --RV6p|[63맙4r Z\݊Y9;dT={άl#unyQ#~cro=CP[V%cX -,|BM/|"^ 7ޚT!)Vk#Dr%ИJ-)dEBvVb7J@ɦJ~|MZTTB稫r_sjj-lOH 7+ESĔy+BTL2M6a;E)ѓ>-_W|+ƶ|ǧEekJcWueXqk-8;| (vUA ]{:Wk=\mccK׫4$p(c>jkJF S+NBsl遢'8;" -`2Z|evY݈ -A!C#nAkPlDwU ʙM"<|} S[yWtF&>uqqDu~`YӘ gA:՚C (MVͅ;0c!-lA0ZIz.VJz?|"0=A5ͮE|#B<\yioI%G^d*/el{?`EpbS{։IYbxoIO_چ!ф"8de| 4=[0ƗF>D$q>.J\L̎#J mKT1= `yJ]ِgfg'_?)v2~|>h5ST|KU1% -:%/RhY>jq*~ P 9~L#沴U^;'֬ wwIT g 2lm{i<4M]ai잪bHf-@>0Aj!Q(~s0AJG c}!!Xq{-L794g _+ٕL{.jI_jщ)gG:vGsae_rRB[ZY uϰD| 8Ђ| GH0޷I~@% -Na5{Š3r؛{ܝ#pOjf{s^ -S_oÁXܤbp-= -gNy7c{1ţȧ C3Ag*I+OJ'Qah10;Q%NN@뗙52\"!{MfXί Be1/XOly#3vP.2XH2Bx-z)IhE3U2 w/jm] dψ%9<"v)f-YQ$a>TAH}Ds@RbS|| `:Uwl`@.$<?6\m*d5KNwE=mB?D9: ZdA7l6kp'rCpyfAr}<ԎҦ#.*5LP,8;<4xosû48PzeWJ.o?|\0il?Hg]XM p;ԫ\u"ڎx7jaFku}+3:ɭ?#~~b?*[VT^U˼3kB߱|[:M{?&QJ׬U<zѯA)=cl1sqҮ7dF]SW> Ws&Qd 9̧ظ˹1,f&B, D?=tfҭYZH 䵞ܠr"{ndE@SG;\`tu.PV݆jfQ* - 9U*(?ljgˉb(3(qk:7$yOQBv~Z!&xI:Xĩ:hK: w%NWuF$7us -(u oLQV߳oI-&Bw^=8&ܰ#nqۦZ-m=LEZikSESQD ꡁvL"3)(2DnjoNrGi{14э˯6B% #>pr)wdvJ1tX^QkƬ%PxhW/K\)ͮr{wy%m/fՊ6v8}E>CcmC?gՍZL`2Y>Pbj}۰R֠ߘ/wVڋ"v+88UF+:գM>eÞZ`O *ϮxDa8ȩ@E - .SGvh8?=Đs+Y -?_ot(KiyVDh=oypm!#b7ꞺCqRimrI$(61= d .hM'`QϲX\6-Op4k-c"x(_;H,GG{lrlZ0{ajE s,S ;2 8!Ez<[) Zg̲ʆ@pr}m6qF!h -r,(}jyGئҹ)yBA%gD~F(Ѯ6PːS"냳nH@=6=g:p#8eӜIUi7OtCiFNy':fiDusCUIڷψ\ vpB\ aty}$lTw ʫ4schh|XО) -.S=\Wowoc P珈͑nN= F!u=n=|Jv/\`,z߽J:]/i_ꆟaTRĎfBK*=fneGʡ>_658DPos,W@1x$I(:ߊr9bt:@skb嵽72О3 i/C*8&dVeFԺ^`.+˧%[g;\f8L 4EVbȚ[7="Z_L UsVvM3V5|4HVF3Cz"@ѭ5/X?ɑE+O!\`9*</ Æw rvnqv]DZ)7Wel{"q'/|2ۥjsH o3:7WfN%n[" z8A3y <Bɝؾu7,>P~qe\?guP𸬐kߑ9BWG_A+Z%sMb p۝;I tyD̀} -1b|aT+X*p*r S -8`&*v3|3,lÏo\TPQ ec~o84ww{ڔhXixOP& ؑlˏ˄mpַ6 RW2pQ/ְfl':ǁg8]n:SΎ+aeZ?X^_$ qŰ(N;Ϙ7T)L{G0o'BrrVO8» 6g>?/(C΀^{)ێ8wɽƷOEe˵Qwh6%Hؕ cG]%}' -z%L<'p #Lbmqʌqʹo#MF[ -fD4G5ZWpƸ\P#L unr -k]}nljw=*>?ow%iaZ5wNž*_z5ܤ O՛WU`^hlI$6 3FnT]Й*xIwQϯ~xp٧V=۠<M ćDڡ޷U5 -nÁA*(;l OZ%.?W-4fpMpqz\tRŠWYc"A@aR;ǁRձ1_5*1E)h_Lp,$ %H7A8!hH'TS2r|mTH:/W謬E|D@cKxa=yit3}%O ǹO d/E˒= &20V6̒!ߣ;Twc4:?L)xgsd(L#ytJCk~ &}1䍩eKO#D?M0h@z<zO.4b8BiĿopݩC;am_ -kZFO {GʱMKA(bߦdxY#m*ڒIO+oKgR8[x_tmYɃCIjJ;Nb'*v{GS68 }52< : {`[+†sӫh"3.B6d@}ӊ --4a +؅@1팑bQ-]Y~Pl0j,m5>6YAfSTǃI-$1.:#sOQYT> -p.Q> vOO0Fqv~M|X^_#[6S/jI4d/#0x -cN?cw !->™1i۳~m.Ma"]!AnJPa3K\o%+̆6t` ۞v9L;ym@~sA9r -`DDy$LѢ,*#_ڬL"YSDO7jE[aj_3w{._KNPL8XT^ώSt 8{&.NJN5%9MrNEZ]͍eas֜*0_u.nZV<\޲Vc3&-߯Vw -p}̓?#}/$t}sX`*Gh-Ɍ\u@V)=b+'3+lIΩ[ʲE0Q {igc IxzF`ϔǣ_>jԔ GZuJL^rbGJ/RߔT'Ս*t5WUZTOhGuy얏PLM #뀟qT6||zn;A¹j\4ҤYZ9Icw -'==Z3dB~oս&czﯺ)5mOn{VJ^ȳo;1q]@7ˋݳVc"cknM;Z$oϯ3=qŘ N)a3`]lNA) -dAh7 x$ozن%hi0{k."/ْb*v.9n42G#贞j\Ԁ/!|~Eoh17t 4;pHdgVέIZFԊh:)_+-CH!*%`c!0*X&G|&R/lT0F$3]k\Q=g@jS* -lHe"d'RLu+8IQVw@ vcVY|+Pvg֡1F cG1A`i<Y^ڣafUUY= x ҥܪJ/ꯣJ/A'[#5T'={|qX? I }|:Q=HJ@^@ad .Pb'p~`ʏfGw!DQh}GW&KCB{6%SEӯ8o|pJ+f ̵j-D^ ta3`CBڡRϸdtF9*t ZyK#DN8P Aj ˑwrLz8G({/'*9@lTRPXIR ;aշ@_/ia 5zVkrSn{$=!(`jHE & ]Kԃo/DeCtҢ=AL@SQ^ND\v7ٲ::/AIQV~G]4Ptڡʒ{ TS{^ĬL?=u8%Sܰ`C&lS?# -C87S/ڿR o|ſ7/_??/~wϿ/o~ů5*#m]qe & ~XbgqBQ:GU{ -W 'jP2sDW]oP̟xS_hb M$:fJ>2a*4+PO 9y w VDIDtC7T>R(U)rBnѣh%RXLw>D1-$0~c+з00-7\\v2!,l-K&*9Iїvy `Xƈ}e +K=̺ԘA1Ve -LZ+!nHd.2z=^hpL✭Sɦad 毜ԗ>㧣[M}@_vm9J?ړHP bQI tlغhמW0K@pEwq0 -t0pQx;V(* -@{})HHLTR(pӉ+-ƀ9oL2#ȳDU!΂Xm|l@g ױ~tWW>sH{^<' -;U/&ڌ:L^}>aM= À+NT] -&s@[F`ۡpcWiCZq;>"bw<-!~^cJt>aM3To24YK5"(wQ{7)bKQs)x<>;1"* 05qvJ3sإӶW[7Lynpz9BOR6(fWQL#hlOph^$#~DVʍ(և4@^8=1>1.V|v)EqUTK~+5*>Di:@%4@&.w㾒r]Qo<UOZ])CYCwSByIDqLK,Cw0ȁgVI+7`T;{]&b]e庢{O^P3OM{QدJKѓRn2e!Zfʼna`%EY ]'CǸsXd*@و%X*W](Z]?!E3V -Gv -]H9g7ǒûHr6b!;G9wg=ӏqD 5HQ  p2GA SeR0!"URSj~?9ߏb;n5 !<]=:E8IВߓ:.ՄbJ/}DW6l$z>a)V,gSiGjJ ʷ~p,sUUw Ώ=R3l?X%m۳s@-5f8s -%f{ӇC2Դ3Z8Ilu=FUA:w47|_G!AZ?ʥHn~]d9*D (mF݈5/̅#C3bsw`<>|Gn -oVQگu$$#[x SGfE3[$.1r*%\7soJād.?AlgTKꐍ3E0jW -\qhJVO6L-ťhy1`݈&5 HV-"6n.a_xa&j"hѳM.}͐[+[kZPi]s0+u__ٲ>q{wXN:UIy?#G}KQi_GNFWwXb -2kdԨׁf>8QyX Vˈ%4rLwDtB^lל `KK$.>ǥ7b>` FQ7@{Glp_j?%t6dHjv_i5&V/Y:J$ְ-u>Rؔ~l_m$oz0BjXĮ':+ևBuz8f4~(t}~b-#Y_4M`ϵN‰| -[^coQ&$ЪҐ@; !zLmQ ~nemǠL:5 -gw*%\?Kz> UXL{&y/m4lͲ0A&{ zK6&qKJ<=aKc0W'e `M6:38~וoTeb0ZY,>lrE }|Lug{ppP.׸9/k"Q,]ꉧy:\p"QG*v~=GB+lv 'm9*ףYQ&BеI3 U+u/z$)X}k lҨ"S<(:&Te0 1 s$=VTd`Q"p+U!B )ׁ֛8iX7y9:)U'~,hD9*6zK -tUA}=)CI& C!QLZ{ڐdg<3~{!&a!7Dk%- O4+iK_$mWҎ@uN -6N,qG1g[%}P),~{4 ݂7ex ! -sZG駰AKHo #.92 j"/04mx* h7o"_/}XՉZctTJdWs;LDLOcڪ@g0~"s|OIucWWng{.%>Gϰ?+#\@ބĎ}uUQq &nY+a|'odYZ[))^VH>g6,\" KO'r1pg'Nb!yC}G[w\"}Qd-upai+ -ʢsh=]- ;M"1U o āǹ(9oa;7ǥdRq* ?4"!aE1:|t0KOaL]^HGj,6OU^,i]y8\D`$]X:a" -a-}s3n:RQ0O7 -=6U~w#s`R~4,`i@PzT{\Cf.ܻ0EH-Le=◷[R@2-(ȓ+ Þ) ~Tx_}+xbڰ,eMXW! 6Ex -IA@FcEKłK -kW }yRwGCRl^J'bɅitJ׆|?}ftP.&򠏎n!E*ϗz eBr"U)d'6g(ξ -6.T.kG-?}J }yrR K|𲼹_5q#-5{4o@YbX=>6rF,hy~-c&L@hڈ U2~ T81st8l?ϛ0fyW -|B9`? uԕ600euj-)og rʓc0NǺ7D-=03A&dȫ(- -u[u|kĸM5ߏ.{+|Ѧ*i}ރ9vvz>wc̱It@0u.CfzJZ#pү5,:Bs,n}7QD ;[ ]6}+zOÉ - --$(:[|0Lkž`J=B.:%""ōzzmj)06XRQc-Ku6/TV(B=rYaFV@)> `F0M \rɴw'|ύ혣tԐ3iPUvۏhD!FbIQǸ~M+6?uPM".kDS8T, &8d5F:0Mp: 8Jl5Ds)ICus3,$7\DNl0 Hf@Ck)5Յ_@MyѪ\%ℨr'ɉ6Hyr?8Z:i ?<M -\֕0du*GNX˦mH 1v#$Fn"&8#hPW6%U{F/(ME.sa_< ͐[o:Ub[d+.ڶ-*(9 jPc*7/EKkҡQLǣ5 s8R1,nBuAa]Ms EIR&C s|ϭpV|-a@ƆڐMLI tET cj䥗e0W Ӎ jj,K <#pE#"lU',d,џ"wdCf6Fɚ֟Ӻf2!8-@lah*:ޙ7hMϗ'Ȱ']$ -LDX1]o`H -k~d8{=)EF9;1\j`\BvMʩpxI7-PotGR+Cܣy@ǰ -q%aJDf8GZ;aл,܀8ץuyt=&+M]xQ::zdBX`BݲZ&CMC,Õ!LȖ%~+8~EM~T3yk6/SySdsp6ؖ17T"L -瞝Ljf U*-o_lt/JnїSjFW/yF$StRbC'-;ߗu_c@[ RuiI/>\.[)=%hV^qQ,=*BՎ|mJ]:1#(a:CQr77)\@t\ t WhVzB>hwwIFژ"m WrxQjh]AsT=y'-8y[_+ -cGDyH.r~yԍ%BhB$g5;k 'UAY4ձ2ˢBO`QSl/93DH3]f=!y&wcgsiXoljM>:{t-)ZP᪰SBK%6xzZo椧1L,hρ -l -2~rs $2-ddŸ/hXS ;:2N ̀YqUP@=ؓ.#i>]G:p8#kRCz"Syv<}P9"r]yו=-`2wCK"R4,\K\ї -hCN~FmyҪ+Ӯ(=B{<#($[#dI;]R,Z88 %Ԉ(ʹQ 4=DV|ɗz!KLZsqB3U9] 9@[DP22ec}_?Ӓi;"j|b|bg3ZRBKMBk[$,ڎf|ݲ{IwI+xfp&!x"(>Z lV0hO &dNF@ܻWt0-S;ZhfٺvaTbB=}#bl R߸"R`S`oA&%;n}LE!Ͳ- %ǞIugODY2ŲPH0JT@}/#T ނ>uXk:whtRD_.&;zrjC9,+Š$B+g<# $is(<|UN9>.*^+{\EEJ{qA 5cpxhAR-0|)4=r!|FipwٍK@liTr)7<U@8ԃu@ER3A,=őK9ȳ8.@[^'P̴QBmz ;;_q _hw(rXǵ*{R^Ul 5o%)7gJxRNbOZ9o-#W6Y-EcZ8lzHJL+(v;/(,p]UQ7A-gLt=[n6v+}52SZA,FLM;z FY 54lU~{V!SHETuV=R,ל +veɀܻʁeі ~~.C?źJ"n{^L5ʿ |'D`en -3Mpsu'c 4lhgcaD"0ӵ9+KQ30*חN/Z?" :Z0C]Qp8KIp-jiGEqMa#SKcfOZNR-W' djRj?wexMvR˽&:r]:9(^1+VARs0HR]VKP>-Uӳp]73c-^7Tbf%?fgj?HB5h%I>2w{4S:dd~B>WX"W-uї^49f\{עZSbƲF+#nk)ӟJ>:I .SEp=Hk -e:ϐ԰tL?k= -O_ -MPI" G_=kRh}cOVδ؉&"P-.51!x,[g$T0\t}YExSF&4\oSF5Vdk@fU4hSx7WU.u 8U 4XS8HAu\yplw[I@K9 ΔPQX8Wq4!#5^D 8Rem ˣ=Ry!!ڣ[pĻww[Aj.JaƉhU]5銹E1g2R=r$;[§قʲh' iYKTc]OH:=5\2-kR5oEffQ [ɶJv6UMrV#JJ٩XՌ7ץ~gX S=0ٕPFbjJey( -=}QrXHu\D *=S}^*9x F,I%uIgK迺O%c xܜ-lBbas~k\YJEZMd#]z_Zwʸ8s2lRd[ TFRg4( mAmcifkf4x1ӴKwso)LiiADf89-/wC{Q˨TlIף_<oFocf{%4)Ԩ4Lf8]Z,.VdrQ&SI>ͻ@4T TI]xFTk$S6U=вe;z)p[B?Iv.{NhZ{mYW+GA7 mƺVhPہd O?k4ʕ\*=c%D\^hƥd): -ŧ򒊢g>߾OP|vآOI ‫?O4JAa54OIR#1t2qa`í3ky-|͙5 -h4%M2fG>l}%|/NDx ;nk" zP[t_F%jB"Qv:y"~-ǜXz,tVY<=Zb'ֽή#z?SLG<;gL>*uIt(L6^W}W2a_f@V HTZK,-,aO-2v ܼk cUנ\g`8Z9 qv+4vd6w9>kwfXCfK+zcPBGp/b`sBe`bS횮 -;(;/y!$~>[ ?ŧ  A鴏GA~KqoUJ=d;1~,J;XF+PCPH d" }rP0=j<,SSw>,PQW`}ё?݅E%Hմz"nP>0pY |Ya=| [uQIM,R(M9sIwوZ[xP0|`H:`ߦG~ -,6 S TdwJBWw#zk[d !mBWBa6K"֦E s^ +o;x|nCa,kaDю^3 8ڌKB4tJ$"T)vSxF$**j?q0HD(x$nDto>XRpCK-XL¯K.gNǤD~x3}%fYL%F4ȵH0{Xz$"< #x - ge8Nn1e>ypAV:/Ay%N%"~w7Je}SA(gQ0^9)dQ?н{(/h)rAH&34i -I @UFQ4W{p@Fǒܝ(ڰt˝ |P -cT^*x}ߑ8]dr^*ɦ5u3qh'`ؒ} -oocp͗*WC[}яHQ%e)0EξGG -Is)={.8>@<vuܖbiB4tD{ ٳcʾy ;vXT|33󽫎BZT QZ iE={@[|d^ - wHODhK_V+#9$ D\l#` 4N2 L+GK@vr̆$υХ[w 8O]~Q1A?pɼ?kuL%5 {樒J=dT)LkNz̄U5ݘ'p#]GX'T%̨7X=]^/a3Wy]a)3>LaeS¸<K(*nwYwO 1'@B,L9;%h(hM?_ 󺷤*GBQĽXsoj!`X2C|j>Uk 8qsC# -`^)Q <c"ӡT4dD۴m 1W֌[ $}]|W|4y wm>Kg!6-(Q~H%("sIb}ʊzb1܏[+qEDho!A9hC(;\WE>t¹T~+X%FҹȀY@I Ts tJkl,3o㥹O# NMfYF iU-Úr[kf T#uĂtp)մ][\A-}Z(#h+uСJ9I@v[ʤgv;KYz z?)h)spu}bCm3,$$MKZыjχo]MwÖ·^R*~]CUI2^dU.oX}QM5bDgv1^$ ]N@fxQ"w]؇ocYhcR3P+[Cv HĎjngJӕg\~64;8)AЧ -rd+{47AYI~A7ft=5ah%hγWȐYgB-L7Y@Al p_ -0 @Qٔ|0=d;8@EBKY3D"*25gn"@gV;W((Z +ɇҔU6B*܌n 3(RY.&+%k&YnpMB!9 ׳(}1zEX?ٷ<9_>1}EGڦy p9,nh,.a ׆ߦGVMK -X~qQ&I$aj?QyosTUObi=W737C ؐ*BB&cE\~&>%a{LIhĀy!Wgˀ8$`\t8M5j'p"$ذ98:` Ppۮٻn[ Zڐ{!f@FX;TiHMv[ 5Q -->+qW1#}P"KP>؉wrGWa;a2x\F @ĕ UB% ⊭3F1b])aZf̱7Ȩx5I,fRoq%j'j@P;4Fuu6L_R/y%fXӗd -TØyPi̓P%b\3Ԉ\귓Wr}h c~ƤįYq p2PRAM5! ͸eNT.Efl,c tD3g&G؛Lfgڬg,q&$"r;u̿J(UƉК=yNxEQV2bdìh./W7*fzaxJ& 8.!ӘP^ @.%VwB{[Y{$[2"zMpy-fq?JL" *{Hwlf| - -4{vBŊ {"bm*o E8 fovq1v?\AqSdH"?HA#qLd?PD+8<6  EJ5vqx}coϻ3&צ}ψUƄ!:vb u/y"irt`%DVh[slax {$/"@2$"wJ(?9Sdv|!(aY |U؏Evj^="&};lǒqxf~o׮t;My}D0lS%Y-YAvșKE CQ7']\ (`!]fRB4n@PZ!4|عQ7QY[LTͫ"1dWd- 6*; PyLmN`e$R^Y#!U#rH*lI1¯ &twJXf:q  YeQaK8&ݨekԜ3'ќ7OHtH /8S6!DTh_dn"iT z'B@~Ojb 2rnQ杘3a¬DHSݟ;e,tK,T{Xao;4i/K}Qlč6D"vTbydѾ&?< X[e"eDDW@(]RE~|]_CW4Dx?`YSxPO\WSN;$iCiyt"`G|\aez=<հGFN-s8'g "QtI -5i/ujB%iַRbމ,yXfx"^ ]J=CWA{~{CxW8PҢdAѺ>3qWJ!_^뽝Sc?YC&~ Nsq?0PHTqH(RqQ 9 χ$k QǽDkkG`YT {t3'-0:v~'UtXS/#lz"k$ez]呜F=OCWDC\\ѬzTdSK"K',T]! JV`92.w(F\.;2F~Z7Uq.Ey6 rn}8F g~k])Tf $F֑Խ!|.4/Gĥw E~86O@Frs]9 Ssoa- ԋMKJ;.SQ,<=zkUE8{FJ=+vY -Sc$(հ=.d.Xٷ/x4D_JKU:l"]Jt\(WY*V]z#̆klP"+BD\FboR^un!a 7iZb0:$x^M`l[j| 7 -zPGML<|%3 p2],jGk(!āO&XVz -͎P[`۷aٖ3Bq=Qb(o> Yl^_T3~GUjhp-<;ks̞{%gQU߿@H@9_1%COWTo? -H񂲟z y'L{Noyk UT5Ĭ" c:ތKL\l=j({ZlGtйwÉ0q?DƵ򫰪nr&(44'u5 ?ɨVO~?Q .?;Ӯ{6wtBy ;;hV5=ސ%n`b*Աٯ5?+U~=u \-Q2D7db] -{?Bti Y} }GB;#A4siF+D3'wbI~orgg"A>v"W" Bx.bl̡h5G ҍ<0UeZ?OUP?U?D6Ll[1`2~j+$X^MbeG KvBUǯI.Gs|DۂT^]{/ =q^"=60bZ|9"{s3\DhGRCV"`r8?lo -{` heڱq!RvGI2Kz *25$r -ww2U 5+kbyZ6h!-ai}?Q/zÔy$Gr@ia '{#^ ۉP8D;JJ^牷x782e o%wP%miW~#\ɤBNzM+,~zyT);e"'| @MzG.q\^/@shbOwkbe\MǼ0#\ -={0hcE4LGX]$m`1 [|-曽”^Տ,`l -dl:^g_ _4|ve7ӓto0`JdpȲhM̋8nYbZmU ^pe2T{Z5g3{T@Ž<`\{)u8>}Kay/.0%XB|EMcDbۣ,Mx+|CO+pȝE)vn2Q,疸-gq{!KO ["M օ>xd/@'k~9ø>F̟GCS -;MxYN]q;~8EyxN4#Q>Oq9BۇjˡvSxa0W ArgfB5w׌Vޞ GN{- [6R$L?{b[U2:,~xvsRpu(f c*T:Po+I|#cc.NI,΍gK,R{6QBs4`px4E"Cj&o YGZD.47Xb!AyGL 4r-*~Pd ,JE'; Z'!~Ĵ(h ٓTѣ{Z{hFCF°hCw]wbŽe%Ѵ~c~{A0k {T;tyLsqS-ʄWG`/Db |$g(&p<\JnBB5K}i-L19QU{ y6"xݚr%܅U{j2y 5$~ -"a{"AKʘc'c,ſ9Z>Hь3ʉ5:ֹB΀*jqB8<B8v?^R.a]D6ar} q"lLjVlE财9կvX%& ojޓ~Wn!R<90(4RVi|#p ?'8ɔM=id;us[J ;gRMR=n`bϺ1stdcUDn> -]061M{1z<{J\K"<Fuy@ '3p*Dm'vWuzBD$T`“|ml<~K ;;5Q7" -)XR0˳ɧ/{(_l:]Rq ,m@GU?2:Jy>9# HIRcvo\*! -\Hd-Og'II?jςq[yg{bq6`F[%B:1#|albg @Ws)F@.£Gm>]L|o"M~r|C~.тB6㭬:| RC"LY3=@.j|Gi0KQW5EE+ "1D9+@_H9KzQx<T@E ~bYŹbXW %l!YD Eq 7vb?PBXFr!PIXj{bŌl([S~ cJ0;,Ap= l cϘSSX_)Ѕ5n +aƕ%,\yOw q|G-ީEentZlDf AS-JLXd}u=Qo6C%lDpjSњEEfɗB*/pIrJa+jtc 0)/(7 -mNp۱Dg=bD{R->680!(SQ"9xwQ-W RкR 6w((uݬQE3|rǯRbf{ JMj71ķ UNX_" ֊[W;v.J kqRv֭fGy2y[<*MoGUOhשx'Ig^mF\g[`7f5@{G!A Q B:]*نRʸeѶ0 H^; 2Ph ;|uO^~fQL@HUNYqG{~.@Gu[/8?!;O/<˾B*.d"e߁򔫤փHr[A -y* A2O!'}j)z׽npt:~phfy -vaF¼oV<.h@}"f VR>3έ$O08Ȍ<ߢ`SRG&r dqfGH7׽i( 6ᑾxU<;ϙ4(/Z0m-/`ƒeFo/FDXeEʩ:[; Q䭶kٳ38iK9‚#MB'uʝT@ `dA! Ћ>#j΢fmYG)?ΠUNuLQuڐ52g{7 rp*Չ}-:$rg͉PA\ -16G *R'~@pxH:ӵfaVJ ^vE] zLc*D~8Q Q6fc _ Phn68Wlz4Ԡ+b&a!^+s[qf/eݦ܍+W9F7V<*P yxe) w-Gts|Q2N CR}mPBnbPfǖO)TZ#wmx:;%&S"3 Fn CTDo3..pwңr++0ufP83-z{)n'tg#9"6e=EQj|O֚[H~ZUm4J9ʠV+@ٝɦ\j:*)dPjn}ߠWђ+dF?34tJ?Iww$ e jmsW+RQZ#4nCkPn>se0f=ʤNy+{R1)SND0w0!ڬckև,d-$d/ƋC>-BMqQ P(ުz*WK|<rgcC׸!}m^}Oj+e -/|k&zԼE"Z4^~m;%XKt()8F8ur0 "CTqnEݸUTR -RhZT$:ݝ"nA /^Ug\ya!y{0|)Z4M!IOu` W͟T%t]ThD Kƞ*`}|G -xafqÈP:dƟU!%;,l`p[0Rq]^.׭r[o=g޵W2g8AzB2`epg :J<:#;4#µ%[P2af'h9$3S0ꭘi0#ʙgɺ|D _W"hR(kDPt/ۭМ-p,yqVbPp8 $3kӢ2x^*, g!.琇جa4SEcRd|NnO'wfRKFe!6Lɨӡ8B+:<[X PeY7YT5cTʓgU禱+D'C $Ԏg̼f_eO޽TYUhYfvfXPb{9e跐[Oמ>wב: q8>; -=Po$3̜ZP 2ƪƮnѶ\)Ո +ͨ9#'9RC/T9 ӑ-N*G;&66Ө" X'ז,cE%lPQF-)xEZX.H|`'ހ!z#sfV/|]-.n(0S4vNq̬cWuk390~1E5\,PZ9N#5tț'k UkvoI5tBcåk'^ndg 17t +Gjat;h5j(jo8aE"|.!!GyD05PT pE0V(~+-2w8G7TR)V]Dq4GTwY\{2v/)THx' qiH9}i8sb -uri0j+ŪNYSLFXh+̄ec7 -`ަ^ P{ѵ -XGMU2%B aXbڈvLjAi/ ^D SOJea!PM+.vz.FgQ%ݥ)r_pҷA( -a"(!fPH"Fȩʅyp$0]i9Z-TZ9Д3{QݴY3uO/o%+l/A >SgtnDô nm)]dmڷ S&"iӕkB1"9Sue3BM2NB yWL; -E5^Nt"v0hwVyR:5!-A8^!8 -#A9WwIi盒Gp;265`!1s SKɈ#RwGS!VbG?=a7 ]%Arl8|kGl"!Pt:TݵUFDqi6CEz \&[7*n -΁ɉG袮}ߝVIU#3MtXڸ( 8DsYYp>3:' ) -v6Bs}1ޥ-p~*̨;Ԋ`C*v,DxY%&: 83MM86I5Fv{nvpK7>gIVAz Gcݰ&h#jݗ"vug&; SpK~V@L`D(!SvM2/60t;ovO{4#-r.ca0^FD`F~I=X"H6F:qPI9wkS^9SPE*-,%K8ž#bAꓑ;Ko#%c,׀}2e;~um,Zvk@p2- FO;\'G&4ɧ=l&(3#RSTфrm]L{؀g_YLdyV]ǁ6pt]\LFH~0όۛtc=hg8YTy:F['oW^H "A[ Gƴ`譈w2*? BD=l@\g~*ctfwUbI{zF:_7=TnBJ4FPw'\z7[/r3։{f^v ?ŽN:OP~n3~e統 *}rQ%}90 {aʱRO"Ư -VgxW:˪33ss;o՘m IJJxE|o+:#.ITҿ?Ӥ wP+01~{P?7f9/sNukmY}ytzt#0@,;h -MΒ.4Do5w"%#-4! fE`z0(=RG3?Lg_Xu`^/t:36mé=𾐐MZnԪI1՟jQݛ0jg_(:gk7Ũe QۖƖ-LTwZbt}v<.Z>_؍Xpi"P#ӓ5{%JʈV^1:Ւ,۽zIOi:L^ |M" -~0-ykgj&) [W%2oX{ -]}!U51yJe_>~hGt-}?rb.2eg\AFةЎT0 NUzfl{x8nQ_\ai7}]z(h{H} -)d3EWw` -Nfm3ӑ֠>tuynrs= ㇈e)ͦaNڑY(?gAq/owiU{=&{Cj\HM5g,X]vSZ= w}iJQi 9Nh84VqHi/=L+!6Tx'b$B^u\OnݸÝ6E]FlFq&p왥qq5$VTNS;C燏dص?1JO=YCorrfT<{<=}"Q[b.Oq0f`4X-{`6I"w sE()̼ôTP[W.L;Z7Ow0Ģw^G0uS=z("%Bז\U@GF>\?KƢC@Pc 1yfq`rM$XC < T\ E{A>FD,5GF+B?EPf=w3{z5VpOO-2<0m-:ී";GÁS<ۓ#iJì -O w[gʪ;$CV.n??h"[` -X9`32Fni ƽ]gK ]OͫF{ uGOq %:S/&=}_=L -3΂hnq?#yS}Ys 4X@#~I"3X2jyMYdmחi -u;1B<@XH'% xnaF2u腡ӽmSoLyrZŢH7xti*}k*ql)8/u :5PaMRsCD)xx=+O.CQcNgoF(fl$KZSw3w`}VKJHtDSfςl\PPF/O;fMtsqgE3/XP3ސ@?)uI@?wQh@}[Oy?J\!Ҋ=}}q6Afxp> 3>ST Źk {̼.l$SmA0 -v_Xcb<ƀ2SX_clQH#=GM$)ӠPzMCi {'L3u &| `d"9p_a^m0̿SA+bڽm@Pi&x.D 0uF䇟)G)<|z%T5iz/|t'Iݓ,fT+2vC\a{mk{ZH)$C\@2b%_ᇱ] .WO+3Y'8oUY.RX1sh";uВ3PsLKSħ3- LOR䛯~0>YPFi6|ӰB v͐}ǝ:Ec3-F[|YavwTXkٌ8LI9܋Ss'ގ.R#jQ> Ec[y#\ϯ vYv&Z_ svĂl15&N_볝 - -YhB3Ÿ|Q4QY3Ҟ+$C KAbg:M" Bigl?}ge֕ 6r`-6tGDnQ7xv #vtÛ`V" `SogxNiJ|zڶ+=^6ÁF )"hw$ܝ| -ԻlzT^I׊y*&r=:OS! bg5]/e_kբ;υ6&C:s1@yjμSW _\ڃ@ͱ7 *ֱP/a̍-r pEiv%U/@oAtA  ?;BLwvQ"?@pNj~A,^Acf{#`ha|zG"k[Rx`=9m2TD|iU;X#NB:($ -3ĜH!Ͳu$O5Á"&+)o¹@m --,?|{0.Remc1G:/z=6fD!hZRAj:;D*39*|ʬWS<ΘfN;R(Π}(ǥxk" !(RHWb}C|7tQf[zd\Fت -YxGD 6M -ʾSQŗ]`퇈[|~0CQame-m%CtjQ3dQ Y@_Fp3q:\⬢H70HdMu"(3یMÐTZvsG=BZQ!*kh":s[ V6%>#@p)ƺ{a8>|" Dߎ@0~FSŻt(;б)}f*0n˹;axVXaakpvfMsB':".xgPc~ L7~m/!!ұs*AsR\]eWn-y/+TD^'|B'u-4w73Pf[ Lsmak]JŔ+W]$zfLol[)aw YsњQ~ &=ZF P ۠m ,b~.:~7-fgԋzućaGȑoP ds*q쭃},,l[҅-EIM{ y3Zh/ߵ^~J~a0Mw5r,e%N2y6UfpO/ڤM oKބf܏e[_hM˿##/h t_5~Wo/O?ݿ}ʟ?~BkDWL/7]? 3>Y'L,$ rϰX:_v6V^{0"E2 -o9gm9T+ aC0C+9 -2zhnEO#mD+Ot! -u{r?'Ҵ Vu.[kT)EήDX#4se_y E-ySMVȺ(ܟ\nڋ_Ѽo,@ߓ0y_Z¹ @VU J"F][ 'u.sh-ty-mJ^v/Z*HթNu~zG q;x^]}hWG,=$Dn9е 4_V$3eNB`Tr҄RlX[ dԕK`[R90[=6lzۺsUۉ)v:Ͽ{f>͢G@ tL_(r# 7~>e~X$# rBy#<zWpBM(󃜁^A#<% pBsG -75S\'PQs~fT-b /z,^B` ;hl$˱@~TA۷fZ`,=%T6{ғuT]h-Bt33D:]PG - -KH0?#]nw"B6t_nf}u'y5n6GTHb#~ pVm| k"~|?@{2cy&Aقxvb0ļxҦhvBޓrP[UC$mGr$?Fl*x)%~~iDL`0[x kx|ҿ1j &BM}.42961yS<=aeOC_5&SXhA /F6{Ю -ʭzYRϘ|hT+2F(7DH"ScOzhPII1Uh? [j8t pj$,{ksY:iM&HbҵY6P;LړZ>u Z¼V\ՍPM&ƱAW| "gDa(h5`z7rز3⾨Ww92HG;\Ӌt筍r -8 @XC -De0tE&-MΔyvʐQ.%M9ێy) 24ҰF-u<9`ca^wo91W~@*餓ЌNq98כ=m3䡚 "0U -A 3[,#] ܊SJ@\\l%ݏԃmUTE"rDYKy*4'te nui> -Ω:.)ϮRWJK׽Y$qx^\ZU:GPno+e_izUc{\kڭ=itnD ?2pɈR W,t)\ɩ!tEoŗ]0e0S/\ 0[@pUnj@1փ+mFTHo{1eθT(d4E Hf -C?ق<#cۺdڅԆ.>/hSrE#|n!<.!]X ~o+0ZfNۍVީV7Bx9a,\[iQ -̵u ?' 3c[_m:.ߝd&q֚W+n7qۄ(H{]Y֩0=pwj〓 q8Cybô5_@~|svT8G~?v.bSMu^qHq ۿ'=t<{F -arVAStoXgZiT[4Z/rr 'ڠZW'iڭjbQ(ixи2D$tb$a*8-9e7m4:L8|8{Uk?s: (*+O5Zk"3[d5Q[٦@5pKA?b^HOcMF{?ebv=,} 25ܝ/D##1Ӡs æ*x06;=і4IU7t2F߲FT뎮"3?KDc055jaɕd:QS#DP=J.rm HٸvBoқ -@TATPt?b%_h0M 7e~=C%Ac]5p-EǷo9Ud'u@T93Pϡ%ޒ2-;1X느>X|w":cA^X xVUfԧ@Z~ |P\A u3(!C&wLHf:d$s#ݞᾠ[σu ZlhJΫ8`*|Tk90q\l ?*ܚ+$~FOݰB{f|x/A - HX$%%p3Z4,KT"EXDx8TѼPɪǂ=[:+{&'bLX'.G,yH0[p=wJFuF@jd-˩{(.':/gSlؿT?}Cq&C663-'N89c^'MAzTZ*ugZߊtgoC57 ~ô9շ05َv-S1$$Rwi,"ku`x ?!|U_#6c+;\AG{-I ƾGv(VWjvwv'e699N7nPS=ikFή|,Y4p6w!ģuA{LVgacDz|ZcUr} -UpnwG֗J 9rr:1T īQψYMD}EuO[hi)R Gr?!J\3XH:ZA_WLn%](`ElgD^VM *~jjoqiuDry{zV-9c~y~"Ҭ/9 V.PW4="qֱ7l>UGO@g#lzbnuAY v#UÈ׳;xG&1JzȘ4Q1šijc}fWBJrMMAçܮc6,P>£Tv6_Bw*FQ=nX/1`V=,)Ba@q*m 9R&J=detL #**-u,mؚm.:PӥOqEI?G-kIxc:QytQ>)NaGsO5+9[e gAS;a`ѥflf~z?*AS d: {"vĽ(LJ0lW9!mo4qv;y5j0wl*-O7^{*SZ<8Щu]z({gv^H;XJ3_Rq5{A:e5VY9#͝D-mØz $Q by -VGɸÝVLarƣD;Tv; - [D-;7wvnLqopbMengȈg_E/{/|SВ -|P#@XkZo `ZvEi'$$<(*H Z/x 4h_\ /;0.P[_n~tUYݔJ*O*bmFƧ+(ex@ZMdL!+MT!B ߪLgD9]'ҙrPW_SGWOcZQD AQ_1DJ;!7p2~ED0c[K˩9qVw2L-c輁EE=z -'(DXv.R-wM@E2o=Ff̎y8ac89퇈KD1Pa!FlkԌ&#ʌ.ˉ: -yr(5ҫJ@)PLa)\wqJsM`؛!&06zO'*#3вzs~Z#~hOXX#Yx kAGn QXj8?"hS-'ʲOeslDp]* bfl -|nAe^P̀eg@p]^Y+dV0ՀY`GuK y[E#LFn[ڒEd01" z)80= f3H#^!y+jl@UpwO‚[R1Gi&̀z&ًR"G1_U [ՔE9יVxn%mVmrT;ƷVDpR(n -޹ȕ3L9Gȵ8d`]1 ^o? -j܌G^[U|?d ޮ\c ~[S]ܷH )=HF| w?VBN1Z%ׂ#hj 5^A4yMEbL(x=BԔ)pSc1opE>>mjq(@ZyIcս#r3ba&qPeZ 9z7`BP[QWv;4nLvrڭ!=o+rFlL(N@2tAcHian"XN5^bG9-IZz7m1:Ax"Y<8]_Nfdϻ=cakQ b-΅06?t0c2d7LwB3JP/T#@ˀ#D ~+>ÎE번G+ 32(cD8#F8.:0b샭[(٩o --B!FHG W GDrkPߢsS|~;9PT>駹nۄn݆cDez剟aF]c|[W6l̤pc&Es"bMNlsNq[\\ɋP j+麾E`($CwJZD褪@"LYx1fM hD^&Qc\"PR?p9`T/`(knkЪ'4?AhVtUfνU ~r7d؃3J3j3́CO 47~%Mg̦601ʪ .HmK -2ǩ .W&/wO/Z)*lv :(9i$ :$0?FWy3;Înut\JeJ#L;Uw>G X͍ڎ X][3eEhU&_Gg ԈMeÇr[s!Szl;*LbZW!d;1,XySk*S֣~6)(\&U3vr9Gz]-!Z?;*reD]sh75!4G0N}?ҰäZ J#gAnunK?Sa0M\aC -@K?%cEt/~:X+\_uGd3;ޭa,]:;2#D5f:Q/D4Z. xW5yf*֩~:sk}{M֕Py&<%qx{`&@/ԻQ07]aZXW#m`yYP\]C@6IoXSJDX01v J!KixqۇP1B*&{"ɯ1_rsKNXϺo,3`UQō}dkvm_A("@9ސ%ʡz\n`z{TC a ks%gd:L/(yW-Dmu:ݫ"iiurߞ^{i,,jU^Xa㋌U\fnG:J;wuE_|Z?ebFn9ANζL|J+<-l}#9&_(n_Δmkw0cLr- T~-&'"m=P*gyYÑ7U[ eR&˭^:RC[2 n6֫YӅΩeTE&YT 9 m$ϫa]ۈRcBc.}LFxb1F.&/FN. ࿛v[,W3KD+8/U(kd$ۥUj㬫D6=(#qxt_rҼ|7xU; -Żi =.;j|C-*/m&9zFr]6-}f}hȃּ eDr҅3aFկ1{o -gZq[6ZbGNFj\9B']bxnO`nuk@S.6m|B0]R+O!FiB4-]ƮxBa4v"0m 00njan=NPFlˉ(=A3s+Bgu-\*/g'w -:84$6Ȋڵ5S3+0Nu۝m7O_~i[k`a.  k=IIˏj[fhL~§ ߣw<ͽP:^]GU?(Aѷ2ݵ^|ONəC)P1ԫenۄKrw+%X;PV Ҟm [oMժMP\} M!UEW[ z1*Q8_Ah$箭 zϑ{*7|_dzl+;i8m_a-J ,./)I@VKbWrI+Ȱá{O,+s`R[{1h(d;9DBcX-Γ)(@Tl*Ƒ]g}l9;e;`@}oß#cID*hJ:01;a<03n*N=^{,|ֶEjGz-[=iN&BDZgX|YL>`/ -"iյo\K@<=hKe&CWj&A[`EQGL7)"X+8vݹ!Q) -endstream endobj 310 0 obj <>stream -vzBSraty*lБ{|lZ>Xg tPj2I <8gL/$jVpy[l90V8un<ܛd-HG#"Li/ -.-],m ->Yɤ!t#NJv+oreRBAjphw97ITleH&a ~1R-KjiH61\BGܨ(.jPy͚S%mr1J7Z d[RDU]G1iJAk+-=vhq}^Jyf2e5#GL}4啚Og8jzetxGnU\䞔@c+n=8axQo|hjt a^&1n"(șDhDBLjTϕ+|Ӗ5.gP `$ G -#XIa"G3]*}z#C3o'3=nznWgso}TrP5~З hؐ\44LWzzO@d`bhbi L(|k+j)fO6޴/RRV}[ޟW;V*{뤱͐:7-+6 -s U0{MįIu޳}m? ,;K ne)m" 'B"Y i@ӬҰ⃼ʛ|:qvAx5C]=. IK 84:%RdrV tZyb,AgdAKyA.G8 -_ա>mA:+kLZї"1I1=PӿxjBĝ0Fԝ{BɆ?|j74)nBWtzhiR7 4~[YzCUt$!d6{ [9ވa(pT4sY8f[9C`P:Y/E1 & U#&N -Fk펃1g| xlGWqDܮ*tO:|[y3 )=4g79. @_M̎=ENV/4hC'Ns@>'>2dUvK@X}r""Q"l۹O9=.ϩ~GqcbDm -._ JpLW@ۄ9T^V ~.F+@ƺRi cd˙s- '7^PVoԝƈ$SKSٵzYd9 Tn-=ݐQ&=iwLükO&!5 띾*/- B]H, #: cEmT@ ՠԯ^m[(^#6"^OFYh.<|an??BYDt\3:QOY@l"oПh -78*poc0Ai-m|"&= ׎/r*1VC/ rYw)gs-ҺD\-fPoFWNrS -6BUL&p,=YN5]>yt g(` [C<1bAnQ7vl0ib E51@ h[ub -QoT|_sY`c]*멊D j'rO"̤`qo~ jݲ(΃9~ ->AsBH7,`P)+¥*jʿ= -34ؕW:m-懮w(4I@wbLHzғ$ ct_[ih&ȧ -98qt:>yw.?Э ]k:>0(!3t´J(hEUQ#7m:|%O 3[|b?~?Cc?pՓ*0UU-H<*Iz[ۜfqh[mj4e(aJЉArS\u]BSïF@VTG<*_ƒ#z[E+mlo2&5dC ݛOU> Ⱦ(uэvsD,\η_ |޾n?0#I&:2 xh'{0MS+y0+F4 Y$UԜCѢ!Txi*]ɼwyqCPgM&ׂ$p{T(A \].s0\VL#I+jwxŜkP(}E1](X&1*󬍐^NddkTT< kZh@Ca?3*fjR:!@\0PD7PfKPJd'Hؿ7Z2-4렎wtWYNT^Yh™ݯFb.&cpn湔egGA;AVA׈ Qg -Q_'悌|ɇnglC/6:Zȁ] N -X7@60QbWjx98 |CAuEQ!@[#c -? UT_p"PT"T`b_Nђ٪<I9aCCJbx{gW3[t&@' w/݁,NA̒ltK  W1Hy֨t2l`$FtA9 M:,=`hf d|X -gVwoQ)kTJ _j4ո"sR؅?fP)9>im됫lK@5/8'ۛMh) -FSVK7A#R@sH+N;@7Jfrp+y'L/iٱrG%z,H:dv& p߯fA ̽рq"X2 v+~]mfFvKe_u*q ;Ft'VgCj , oȺ;H| ~ m+'6"@v .x}0\Boe;ЛɊFe` Kpu~ž#BƒKɥhnd-fqlѼ#@ދϩؚbr}#2J\c@.y%zIԓ_#Wee?zP2u$EM8tKc1QKؖ EZ0W~dtX4M̯SFTuI˯z^43GUadKZ?9AbCirjt(@ X򹼇Z/~n l&NDzޥ"}7oh{cD'k;" 裓(5n%MhI?ȩFlZVe$0"ܼon z0hGJp{%{:=HуS, -5eWqmzD3F.h!!-Ǯ̼^|It[\@80S6VR?r&41>KjSURIZ5%/&)`t}?bE'w}el0PG`rOgjvNͦ -LjSv "weELJwi1Ir4F-vU@A}%vg[֊Qbk\jiT>OU 1Ul9Wݐ|q]G+g(vVT3PU L[:6_h 3ܿ.(uL$Va -*6Uha Z{4zUBK5agWTWjH1e m5zcZe zws#Cz -۰@V]ێEF w>p,ŧ G**jVݱmcT䃪<ө:P[ V"/;.m[}X$l3دyiKe>3^w^tFչ].HrԢ?KL77翝/=33r6wAݭ;' A-c7R4qZB B^ZzZqSqHKt9WQU^&+3wF$=heFŎ2.7M3oNSiUB7xW gɩ4;@*e8[maa6h++>nr^M# 9[||74v$-]W +:G7]V VHkbRqMܷ]%\ -11rֲ\TmjLE^'i5n[Y Cޏ;J<VD#AtfFϰZ5¤?\e^j ȹyA @|oۢuI@9no vF^JqB7?{m~^T]o}")ȩWU3$XFXF4DЧwSyI"3J׳-ם}(f#$p| k_ajMgO b\d}67lX_2>"v+o8wy){fwS=xE G|FŞF`4 -Sf]6-O $XC/HkеW#oDiI9v9P1ThV$ֻmQk8ķ˸-ȔGEThx-^m%64btAV6\Z3b95C{{N36C,T8Ӈ]u -%ZI)|gP|Fs ǁ6"͛k@\Z 2b*ka/Ʃq/~<UJkS92&:ϤD/(Ԧ<.{G{Mu$'pVUɖjDnnDBR1i -ԭp7nXUNepE4}y܄aEu^eQ8_M,݇T+?W*jOp%=b3e/Я=gرGkY*w$ iH='??E⠿9 ^"y/*H_K܏0(zf_3w+܊H[Gq-qt7څI_HDͿ? r;$dUpt:)G79b@WiSrø,q2* pu)"@LA|BNx&B/؃ d7$q>lG $7UzK:"=V_mo#+}QUH7}* ع3WR~IZ)ipitE{c(S~AJբGzknE8W 0w4, -:$HVqЍb*ۮ" ߏ؇DVcc܈ju,:Vd{EX g9G&?D#QOG09vLH3 At@켪^%9!‰}ḿXhOߏd -Mybַ 2o~ԽZʎ^3b_>(neGNij&!ndZyB^ZlMKItfO%ylg{"hHH޾2w";4 >*ae_a{#V -@m4RPy@~+ ڢP9CJ>wI%@ۉ$q|C|1!%:qC+>2/%}8͑O kÚSE`GA*_Β0؝un8N4fԬ-7eFq?rbO';dKK[إ˾GNk9=3k/Cn(0;6 HDbmK8E=uq@A3bNr;AzTN^$UjiWq(`D'aZ/! K\j3ZDP$W'0-#FvWĪjf"d QG?̝=&}]Uԁ%1"BS(P^& =cݚ`aJ9?D$Gts`} T{zؘNĖcTUU׻ޟ983@Cg$)bcQ)"`mt^ WXzeF!OȬPx_l86FR0;Άx1Z+X)fNqpmZvdЭwtIٷ6Y|5Zw^gľ}-(<|2 \Z߉X;aU Yz,kzPf>Ñކv@l'/@u`SR#+Lxkrw8\5w`9D9SlZt1Z#ƴKuQVK[5zއcͮ1_81Q?TH z`Jn=ܸ݆g^X\mF*(DSF,3^嶕xƌb1EԬU`)ҍo@ӉH#Λc 0t?mbކOlݧJb{wUanjD)v mF{h9H@c^7 oNƴqkBqMfvg: omv]ʶ8lzҞ'O# -O16U(%w׿R4ck"~|lI}>@p)>$ʠ)gI.U\-(,G=i:k{g_޹p<0FWl%zwFөyc H`X%m> dm -M- nZI(w$94?%K~>\J%,wK3 I, -V7lIп^3/3Hqp77{  4'ucDr-Y̏ -hcҳ-SbO= J"Xkj<jT0J˲z9=zTk 6x&ӳob-I8I%;EbE^?\8*Xԥ^{/?Qγah0GB_Gi@hEf :UUFH44a`mAT?fV<=Pr-=֒h1ƬHJ t!%R_=yRh6f3l=t*{˄4|")#`|7*kE*BF/ K/MG7@ִ$7V [N6h98P,PLkfT ^`}$t%s2-ͷ,$.5 n.8.voD8ǢQ5NhNiWJJ4?vM좣"=8,E -)#@@%ykJ3ׯh2 /B#:EAP*d/P A !CtȯU M2=JZuK=VAe0~Xa02 mvR١t#ᄻ@2Q]X1 [jx&Ea T^azɟP -WEWlbQxbC>&6{~*<[ܧwB@Ӂ&b+7LaEQ K1eRPZE$*:=rJ8h>"kz |b))Tjl6s*6L2ܳYGtiq&Xw55'] :tWG*%D.YuM5SӋf`">6M-2S+@  MZ@sxPe|1 -eACy$iIaƢ4Kq -5l NnE(f6- B-,&tPўJo;hfPswy7 -*,xb8 vj6DY"]C< %.bBSnzMl{HdPb?<$)BI[xe!czu/д7TSp<8)T%_ Dj\nyjX+~(+?:A*X}1(e&*z &OZ>Rix390)07dkT%qPܞK֟Ge &@ DU@T/UП!d& j>$3":d#(=lN[DJĒX3Kڠ؊QAcXoFnQ\zoDJ"TUrP+<}pH - ŢU*vUʦHRGax>i0> BA+Q_w1~9-ib!!p]')[sA@ʒ00.9e@ Ȩ6e&0[GtGg5ś0#GZ48|h -2S8z0`np֥GnVHO֦lŒ#3Βl=_"ش^;)䑭Ċ H}" ?,Po`Yjhdǵ&!0_ ^Kvb13+FS#:lB D 6Xz +do61Ճ1nPo4* " eȒ6NTk2n~ ȉOٞOrKJ=S<\G`0bӂ <6nW|ws`lxԺ;M, 'mNhς[H5`BʘvT#u>vi'#HY) 頻!d N :BY3lY,{GWSAiE[ -|aUx}g͐~5b"xD,1L5MU[ßY€Q) T;P%4^y%׬68'+E:0%>0tybEQpɗa>7 -Y_L^7R3SYu1n0SWs“jF#uGRQA~S1^ݼlc2L5{:HK)7(i :?1I xzOhTMJf$eP^9ӳMcaF{h+- G=UAWYkP6]&Ik-1gJcӑ7izߧO_oqdUTdߙSkn |l&:%3G_53ןuy8`#jNVmHu˲6(: -*A;m,(qOqLhU빑d/tDzmO/$ ì-`@B&𽦵b}&5iGP|S-3H+"g2\I\4ZC2:p U:`_{AA$񉴲NPI2 -F͔izɊΪzΑMmT+دdYסOV#D(kQdn-X%qoփՈS59q& QJMJ) zl,F8@m !C%٩R jYKkT3 :# ǡag[]El~Csp/kkA((kUb7!v)fKrT0%MDr{|*ZǾ iK5d[ -Upey1Q;ЙC2PFy%6HE>zP&}RK+g?%`Q/ - b"Q<2!^>X@**h14-Qs׳x{9R׉9˻<90!#oh ^9Czi3vi  -4 *[=8l{?!l&'O@Eh>^T=Yz')@joSp6[BZ4; -l.#dsPp0W,Sn<`-n !'Po1{)K]QƐz;$0Jx=7uPECE0LZ.eW`6zP05koMGmI}Sz-{|fgCʀ@ -\}p޺Ɨ޺x1ΐ?ƨ2Z8*f$]aWCL#sj݂VX(j}pfnC6-bFyM*3L|Q%יHiЫ\.8]A]Zӏo'7HdU4? s>V{JEȸqWSQև`B}?wH&Z#@"_u#9#ljCDF(sRĄ3\lA y"4I[@6{]KL/K>.hALSYToAΘ ʞI,T!D]T^ui$%0ؾ~.R!غ)2du3JnlK5˝&0<[EnX]8$U$HzԆLnqpH3E-5jr*Rbr2u>m"=6t1uQѰ$sK[ؾ$3&,0/m5m1Ċ9 -{G I}<ԈarEd֚YW~ -w"Q|OC\gyOHHijN-t -: FL=WqCLѐ_L r45-A8n͍7RC5"ȻfPѧ-90)KW7}[ :o Pp[=4W%gf~ Ez#Y=.9*K5W\ycG2h)BȓBIؿ~%A `mOaXRITjR(ݴKܪaҐSvSW=8CF"+Qe~W0ʽPS[|$ K|6,VU& -giGv]cm0SߞS*ۥ&_-)ȄC`F' {ۛ͠H`Zd# %m@F Gg $(sʣلNFyNg: -k,-EȶAscZ(X46ہ>{ _vdJޝI\9zݵ\q:Y}HCh1ߺA`H}=cp;<})Ac8)9-Aǝ: -yDIWL߀W+Ч~ 3Jkfo:}Rv( -yV٦UH b*,",b٢Je!"a@$w&kJO%]!@2R} -EEub*=jNJOc!u&4T8:"ݔ+&@C֊JǠbhrm&[+q.=1?QXL$6C/3 *7,ed?|Fꈌ]MNA佦RZ xA}.׫!)תkaPш{L+NY;h]1"{&c1k({_OAU9VSa -_hݬt`_ (yQNH!'QMO%+NT(i#eAEav&5P&yF9 U p=M;dñRpb4CfhM?ځ DI⢌cMrh/[2ܭW^ʋp[s7l5Ll@Q梨|QJP&a wePXeu*T <z4%ǮWJ9ջI7!" GlMDA]v!צ:с 45SP؄W63)CZ_7>m]PI|4XPI2<)`xO!zr3AaӋz ԍ@5O|X)F$#,Z Pú"tQvU?B fV0M_0Mb0!;+rPFJG} a,a>w@Ljyk0F݄ 0yv"@pAEy(ќ>ZfXW|d!w -[% f#T [=TvVoLb -YW/Zcӥմb!J0!:P$ŚA8ހB"Y((r(F1Idu7Ҫ|>|.'S)|_17Rȳftd= 2 oݫ }8[5rQ 0̠"Jլ-%-.$65oa[x܆鵞z!U70B$9QǾգ+U(T@Jқ1%+| - ()( dm Fj}|'v@"q?cZ*@ᚡ)ljsT1-s7 jb=أ\7`:\5h(<ۋD_Oq|H mo/(

-Ol tR R p)c&)'|N׶,Bq uEEjdpa(Ъ 8ʯh+mLYhz2IW|?kO0DSF`Vpz jfO& J4ZZt3oT Z/4)&9kHUl:HD<Œ4@{ 6BHTKy>OoH)!2F0,tά84a;s%of>u70{YP9Lu^+ňM{x CP QJerQO=`>v:ZmE2EK6EAӾ5NXռ 7L3Y*>C~bl*}Jz4S.֋8{XWdRj`O#iP3N/xT%Fx$i^ _Mm%SO۸e4 -8ܢyTLn1<i/zR0S`bF%CgMڽJup) 24Vu%߲iOm J^x,fܗ\0ch/f>d4y^Fhɥ.˞b}|w7H\@-swUjrh $ VQ>ꑅC 4!z@6sh)HTPҀbb a`)gl0jMR%S\=sv(AQ骅isJCK,R}Ɨ8i^Y]T$-'"tfD^Dt+$pZۥ)&iS7ҽuha> /L^q*ͬI@0Lj2OCʤbcFUՍQqG$4kMXH8fofEh$qQ:eX;= -A -ʑRNV8Bvb {P.wPAeOcd)tlU8O6?uz4a*#C3,6M"<tK -ufOš"X }_:𸒅[=HAvA3fZh B`ŚryMۊ1m2{7!1mvG9RGqM !x[ :@Q l΀:x., -dt] bG&NY!0f ;6:մMѥ_Dl(vU&Q0AC -;rev;|25>aZaVjU*V&yȚ[a"[|-bdBdIEI2Ug#t%C^]à֑@m`>\0~[6P6IƸ":xp0n- R44ws\ bX$EF6LW)XFKD-( p9nv5Oˡ59=<:@,,Τ'?/ -XN#JA@@!+6[xyCLd ;'+4fT̊ wjCʊ)@/Kг,RbETH]rP.뺰^6 }F-R>Zsũj}=@"*!=FІa4hoB˜xhs%AL'^މC|ׯx}a<-\1%3U9[x>`I!@&GlEKsp3>*!njEaזsZxSie5>kdPvtk\+F6+7u*ŨHv@z,+ZiFk z}>z< F~PªrhQ&)3*|LDYVQCﱦSzx*T5t4HMnkS(jLt6 !VIg:Y..-%SڈA?GP̶=/~@1MZ0s2aw,CD=.CT4KL:Y9G` -Y>/R13_zlvI g;RX_qMsByF(bH-+BJ*q6F%[zV -D< 0Aa{. kYbM>1ͅ^L`rjm(g"P)TȋV!2%=+ڠxVّ^~5t&Cha]N&$RRe=ܟOSMUՄ!SLs;1M @OuHi)_\H8(.bP (Od3AAҬ>kmtapѳa2O{G`Q03x[i@ֺN!lm9M:>[xxE;}S_W`؝ޟZ:χRQ!\ђ!Rسn3%ESX[VI$8;׫CT@n8brXflN4ﶀ]rk>R.h9>w%;<$4gAKgj&ГE4mLfp7tyK~lG bvE 5b'Y݆ͤF GP&->8 '-dzaP-Z| -!(F41еG'rOpFLdyev@)S+$ɷD4e ՠCwg}"QF;Pv5XI5d@lA/ WM99e dfpJN.̳K*ɴBhe#L6I*%+%]OuS#D(=SfBQH3ohe!Lk)g~V'jdfڻ4Oxv] T5IWF1Nh "ٖ:(4!~P׌l7o`z$?'5gK `"҈PU -:$~;;S c#N@ 2)`!~ w6 n>I HD{OܝR76)x[$A @.m=өDK=bNԐrX/eoQM6+J #z|=2讎2d1%oʲג%)U/yBmmLXUf%SP)a&1rHp0~r$OѬnfa!$pLr!iAaY#`Q3\ dc Z}"A %ݏͰ떃L(]6]gG)e!>cg&mvYzڞ蠘tV3ckb ڡ6gvI)$Lk|*!@\:*,;YܲPe p/T +$W (٩$=,ʞ$DG4!h?{-x6V֣Lb( / l593RjGΟQYg۞"45$QʔoTM,U Pdo!YLSdN)ݵ0[Tpٖ/nxvqVWN䴟$䇹0 찁=m&t - `l*<wr9.I6`VEݔɂ$v 4 ݾkz`$NQTŕ5q[v$WQVy*l!RVt*irgBTO%^ E!K*(Ր/x))KD{pH̍&"؈p $nNƌYP˦r4({P2I౒t EJ8#1"r "Wz٫%NN}PTAVU* W Fqؗ0A4 ,`발,.K}DCm\̗@"A_j&~`cʀ; Vr(|#IY"/%bn+~ $O~gcsa"]a! -S0u߰vp'76?iǤ%ԲԽT0ua~!ĸp,*)0Qԡ"̲'NvNR4)2!IY&_L*$5|RȘʄ8*t'NT"%K+2#tdlzړ=Z=27JWz(?=hgKRQ}qa0&[_K%( ⏽:rz:hڳ瓣JE4R+ B H5ks^!ӔIJW~`25CxiI:GV7!r~gM MشòP9xq-$ɰ[(IɏNu++_ -@?6QͶU[aDdD J4*C^S=,5+4 ~z -4fćX(U h֨lR BG<ڝ@#6`HZV܁b~Dr z 2 hQKJ)DuUU[țIۭ!kxúMB,u i~RQ@`ȫ }~zqL dBTZl-0V|F~b> 5AL2_2M_(I"vwyagcۋnIyShk=&ß/z4G{[ՊN!YZn%GT \ig] EyݟEӓXRq%¢fE(s*:ZMQ~@CUXl顝^= ,MJm&A&YM-hF)+*@-AWg ,^) -&`_ΟeOVf%͟ -\!"?nmJgkXqZE;enJK=8-`tR;=?^>u82H}RV%|65()I=Z%4aa"Ar䓠i,p -e$N1.iM W(`֨( >$*\en3%{VVEHT022DfxP#* {zq5'i=uc?TR=qdܻx& Վ8e֓?F}{4VBfd8g1MŵR=L1lJ%GycguD+06saY@0#VNY=RR_4eǖ5*jVBo,!jE)AJ=LWZ&Q-*upRg%_. -&XG2$T^ lG$'NEE$'XEZ&>QJzvJ]M/IAiQmhG &sQhb*446~'aSU-Co,,H TN3(#G7ȬXpБV[8\L7:i 9&9LbeԇT'UnWԭ y}4cGf7=8 潢_ ksB?nXdiټm}GNvrǥ[pS?J\[q44;LByjBɪJ>H]L>@fQfv' -Heb꫽aJbTgrjZel򆌮S 4^Xx@{?P{񖐲Y1H!w`K&1 + -Z2%ZoXdAGkExw`Az)1^I L5wQ#&q]$c3Bbn^:~> JZ=<-]z`-$C P0aEW3EJ`**ЅR7T5Vldo70[-YSHN.&ͦ%H-#9P5n厦 O*[kdƯ24wC+UxIPlx,}izQ)v"v4 %*nS339g\0 ylx0蕯*(t<+`^ 0~V06G0qu2I2}T @t*ZXJ0ju5YP)Gi(>xj AaZ3"Mfeu  Gm4 "bȷ?< c%3IߝVu_S0JXS*KNsQb*;-)!c:;s(e*]|*C#Jq".Æ@(=^I8X I FV2*8J9dy@ys@t]%!7:m,GLQH@dzAAa:ex80㥳1(e@̖P݊Q -_Ɋ0FzK"EѢ[gоp?v6$VmgޜHRGUFG'V7X$bvap;1RCs> W*bH؛xlدr=BX'&oӋ7YSw%$DGIcD~:0 C*`ƶ9G& TM W3nK"M!}o)dCvCM%Xh -xu1N%=8/qR0#IIϚ?'6 wٵiթi`FH%8dT; -HݖQ~ޖ`m Mkcfgl: ª &Gj4*yQJU? ӈvN}DNןQF4!ŧ[Vu|O -q+&$3KqBc_)iفdޮW[|:J"Wa$V =eׯx#{N^GQaEuB*)~X#A d(A>N5ZYvjCVpy$|Ft`BF0 gWcl[6lE͐Z6lf8TC搫-yfv9#U3o~aՍ݈ԩn$cjrqFUȄ=DY brTk?F4A"8;=@F%`;&,rwMTgѶ#'WC0TY6-Bhzd)~HUk0> aZ|7,My}GY ꍤ&`t&}IY,5yb7YDmv{'0 w2N\46$JdTw ˰~h|vnCRWC JOBN <6R0PW@/ pϽ"(P-~Q-7u-`ݐ#9G8*9nΠ&Dy ҃}1=.#z0q^$dXY!6ҰGH=I] )tƘ9[| -|u`±!3.=oo z rBԓ8WE.UأHj0-xU\*8_,{{ &rb9Ir6B}YeWHT͑52oxH#  |]M{BƟ(ĐCeK*Jո<ɖ6U>7Ɣ׃p)IMCNhd`uXO<K8g/ -0 Spyc@  BhCbNxnfSYqov/̼U!P`a4IE((f'@*W=Hba H=:h=)/ѵdn \ "sM(qӳ6erYv#[FN#W=bz9c71u$K ђ.7/Y>İ; -NOiJC|[XuY$9GO@3 F=G:; d- ﶂvkYE)IfHbP5EĒڑ"W}>!WQ*C /FdҚ,\&H]1T({U@hTap=`e{ZTmЧn(!)bDMlɠfӃҵ]仺 .)E{Ko|f5$)ILRmRإy9Ai -.3'8Ü2a28uJ*DAkݖrR׷~=i_n_~Oۏ/;7}?ǿ?rRo~o}e 7݋w?\?/?;O?ܗ>?W~wӮw//rUo?}e/]o_*qPi~iԿ^ȟ ;?[??[0&n_s?pv?ZPĝDtۍ664Ͽs"~=(k{fbA6 c -^D:Wg| aaؾ=?"k3Ҿ4$/AckRniŕ}(} -RS!ZHڂw5 -~_ B»skvg 惓񼽼뎉sNfl֡HI<Ʊˊ)QFjLn^ƶx؟Su__wd`?moc>b  }ei?E I*j"W%?G{F]uU訏nϼjsFή'蚏_Zc41gՓ&IL +=.˹WkWSsNcJ=\esFnf/C.vF6s˫2Tix@v%t~y &(2>Ɵ j( 4TҰ}5IRIQ^\{kݞnGf|vآhx|[嫉uפcMPRR_+Ηv'=]d'x{cكCK?~h6_մQx5pfzW0gjdI3/.hÙ(ɵWa3dqެH471]x~=4fa H6czF_=W\oF;7n%gXkLyzT~y(:o! #toO csgΞ'X4Qj6~6'9e{cn/[l݋v"Ik\۞Fa@hw7(\ϻYtXX\?uÞIP쿦Z/ {@aG̨^]oF?sau5Uwּ"[8,HC8,mϽ]VJK~ۼ& wF},˓3e)Hq}BDy_wזmO!/}:j.z{y eiI#!xc7!ews׾uX~= n%"Y8x-(X;^0y~Admm$_5tKYC -en m^G5+}r| 讯Uޣ_c^j{_qی7[įn<>\^YŶ(K={S{yӸLTݕ%&@/zzM?w(ws|bAޙr@ڳgp7d5cO1G -;ۙ8~Eqw AR] AMi;?](v0Wmi+췔ⲯBrރ'_D|[c9m'OOI{Q۴~j{0}c/hݡ|R z> 2k#[ק'uUKBB6O2ޘ礘yV']YI}N2{1YB۾U,ak;4v}^[WM3%=m ͞q -o񺴔a7yMJ[NߝR'e/dV%Ĭamʻha9rfI攫ڛv{nۍZ)E^;R+FtF<1Y[vXltaX Nw+; }/rW} ٠Gvw}=kx 4z| ͫwtlgs\ 1Tdq73XK;ߓH)wy4 8m 7}>_헦ϕϧ3۪7e-!̋axdK8W;@{^}$liDCRg)pRͪ/J#%{V9 -Vﻫ83^׃^ ?vO F`T3@Y!=eM=nM[RHpFA?[w~{zֽ!<ƹ;w}úv1^YyܸHӑ X:)A.Js][ГlyB{;5βg'P̺˫4ˁSe4tMI{mύ2h W~:p5~ysbQ۳EMJaoiLc7ƽס )b=oD^%\#vUnnFn={=pFpjmdß/LVyqSh~7btLίtn3{|FHb~D|0n]qPSH6O52X^⩧H|шyuhn^pA.aZ^5SƔso,'CsX ?$-7\[8(˞\Ѫm?c(x/n<:D׾zT?_Gjv؍&՜ܗy!%X\i@xm'{WY2aA־ tUok%rsQ JF/JI>ͻNҜlV46,}h E\Z)"?VKka_"u 9݈?7:Y4AkK,BoE5VN$~ΨF? `yRۍٺq6ֈ(,n_a~f[t{5kW!ܴXg/٦büF^ΫN9WDޣߕȐ8ss~Gv56*Y}!Pٷ}z@1ϕj{z(j(Pʞ~;Y- -xƞZ#C0Ew 7 -j6;tGu02x!WA5 ,x gT(Hܼ^#d뷝SD) \udWg?ʾQ\͡KpQ: w;֎$>$+'qAkrJVRSqm~!W[w7kEwK> \oa"olZw{;uxHV8hd$YܒTԓͻ渟}ƴcM{<|kw)GE -|䷵s3۩ {/bŲXھ9#(K({`Ut?әo/z򰑾ٍ#tΏSG#ŽwB5g3@9bJk]B{$7}6a4~hx7滕y3-Q;#d1>&|O͟P3|:M2{qjM.ׂepŦk܀/`#F@Խ,q/sԞM ~|xhZJ6uIM~<ڮ`Bg,s_A:S 1tXI+M[M%֖|&z6BXFmuaww;4,^'zgyЍHc?nEѹ$YDk8s9yR|zmSGV k(o=Ԫ N ky_=mcڙ -F/U¦8miq)U#I@+:KB7g!'79bz`?" xVˉ5a+atYA&*{ÐLȰ'SP|DeCxMFoi!b om%YGj>ɪ ,"_ý{P $rصAIȚNQ*7i7Ka Ijiк{& HϯZ:U4(+r5B8K,'CF=BuLN ߳+sSMP7a.G-eC8߫|W<ʎؕ޷\wq\2 :f߲/h*$ÞېОFRd]!xߍ 8-친}X_J?NvGS)>^(х&0zc8x)\q;W7iu@73LF79Řx3Ecػ@꾬Ў@_G&fvH1FI6YE`7`_< &Goba_=J8`35H|wn+xL2>*?{熽y0-kߥOt#i(8S k}/c~887/[ﺧK:d)scgܬ"ȓP)Sw׷݆8Z\ݧJ7Dv)]a |W( 3ppdK0ɦލ`ܜR7>a>q6 wFY{{O ;g7jv{i3=Paw݈ɩ/ -*yc!Y^㌰1TJ҇MśE/-,} h:ak84y b~#4-{A{Fcӷ /F!Kk,&|P:_~D# K^ jo@C.qElT3E?Tf's_îwW[Nîgm c1 -}FHq/J8e$~ڴM\!+-Z@rF-SB=-߀W$A)-\oߩp;ioa/,R?Ot?A/O]aZz-s#, ¾w+],QY/5毓-qR$?-2ML϶9{3v|">;6V}E8[MJc6 gC3Mώor)<49&Vmw,ٙDatp_$>OިZrr`,]%eK4y#kM& -w3w୳-;C4Q+/:pڗ<1B;{v(;aUn8M+\ 3b+;ŋ3X1+*"{[s2l/ ݅f(GkwPɭKh>Jt\jGYͽ -md< X5jwIK9ђq.ѣh3@!hkla\ ; W|+O|I2#-V,!G^"^Iܴpx0N(Ďh/N$|`'=P .T_K=λd]VFru(?;a'ۣA$L :};{xׇF{bۺtYӵ^7uVWʮ ((9,˶dʢAH0)3"^\\\1\^vgZjquy'}O%{W8i ǑRa f[Q7ѝPen(;c"yrÜB%2u[Ƥr8E0a<At u`B -*lʄA.Tz!@SQ<UԦ -`1X)4u`&m>*jA^ -&8vEaPQh;0MFSe#DK%Aj6[T{Ea^WtK;w"R er"@%/`rwneL6TxW ]UJ%:S/,+7ILKQbyEvŮ$w Z`{M BETvP@˨\B*mڕ5G%P U,cQu4_#LUjs4cw4SKNOw>XZ$wqhFiBv%D^e} d2]LdUrT}e NaJOإ򸀎{c @؜]ddeA*UBk 6Xb>[!. ZďS 1Tȫ9ݟOB!4(48R.?+B0u# 8]ʋ.T$kaK'bk)e8#9G?rT+Kr]aёGJY֮sBľX YtMɋ\J݅Njޕ˩ r%Ü\7>pb(.}ڊVHN6A?LSjwqPs.-0}.PNU+@{n9|ʃK)c¬xn9U(PrRg~Yky!zn[1;Sŭ(z%eezG (#C䜲],x6(t.,Q{Wd E`l]C0V/j VFUUwW\ F-gVo,ZBUjh "Ƞ9˩K%}Ժ=\jl{.hSYJ(@8Tfuh]FgE7@hW!TQϗqRTIAXRA@qI}49\1KUOҺ(g12iaå -0v+ -*JN1 -Ixx9J ~#>x&7GwtLy'0ܲR*s%hȤ\`kM ( !yK[$gQ% Hn)Bg lU|wTa |M0YEa%tL}JM wHȤ+-./Sనemg1B6^ſ!d  /R.e0(B}BHN)2"!el䦜.ɄRLK*(lzÒ#V(Y2* -2 -]r9TZŠ$,qb, тAF}n 6r/WQ2.}iMaP!T̲ⰡwjHaXcH02JibUB˧ ('#)K <ˡT+NZd08ffA+UQ2gt"*T-0{oC\A" 9D(L .9)2b4{?ZBWTS`ba%:J}$ 2U5Y4E`o $0 c, -`btKcb LN1 Wc.TAE3"!CſT.SBy 2 -@fQ8QT%6r)khXO*_.X -D-P][r't,U9:JTjEE;&"}!ZI2{,2J-d,5^JT*`$IN5ZQFKA/E#qzɲMh{9dU!*q[O9H?jTRcFE"šFIrtX^%&/.+9}cй d?_!D2*.HjI֖"HI^Y6CSDt8T4U}CNF On'>NubI(_L`:Y -,xǪ(9Pݙ8FΡ&g育2* |K[Ȝ*JbQGCKeWXŃTe]'=er kX -:`9d@eBvRa׃EE5qY+<6gOsA-PGXt|x0;]RN} -J?\c吸qn/I{X [()&zpr٥.~,J !^$\&M=(//c>} TEfHR(U0yV.Em1*9l*Ċˠ+yrKOJ4*p]L:AˠP9F4TN5IUeR/spA+b"E}e8*Vነ^09Y>gdP:%Ojet.{M#R)qńå,bLO] YR)cОP`J'.]*"CJJEP;Qwi]^J5t?Kv8DNr&a.^⾭9ˑ２Rfe65)Fh')BlQ*XcS^U(m.y^*S ->p`ІLݥO2*:P̃I̲4tDBSFUꤲx&IK3 `d J܂2Ji rz̨:|" .?*s,L@w -[(mQITQ@^QZ Fe9eP(*f0T#.kWm R?A({ %*Pq6>gP蒵+a vY4I? tXîxOծĀbYlɬ+3t7pAFOifY*@[8(t -J -.rB8WHΥJJ(䵜΄)YYN9% A0]ǟK:ĆdFTvpKJ*.8f%BTTŸஊ:t QF FB.R- -u\ -):|b]uh2:HZWUN -*|O;T%Q3U u`ʜRA`:ዪU”lJZ̰$+RT#}nPr:];8ۦ{M*肜)+8TNy~VQ.r:ʤ2RJz€ԈQhsvP~ݨ+/'Pr#I'F%6:T)G}?j>&}nDg0iIxaRQ -R4=Bckb?qZی]dsԝL][_v*TAJHh9}- Fx=rJQߐPPTt|= c]tA,+ -+U>f3PmeNɰPϼq=奮,D$/etVVY4Sz.ZYHNPrصWVRJdx( -z-rw*4PjTNW)-J?T)C|_ُb*A0k0w~LQԞֲ== gl.*aBq(OBJBnI^#9ʅBtm6Gf KҴbyCsQc0WAANjwG٨-[o:!~)O\\E%\NdR S$V%M㷈~:%ChcK@ݣ?C9[X&Pg}(!ՃBen>\Y͖?n9R쇃=D4  -߶{̸u2wu`hW_iivW]hqQ- -O.gV2~lIӝ-5[OGG:W$w '+ -*VzlzEAD7&I9u_620@* -[(QF06VC"YLi㏴%/h%˞YF:k-QKoxKMgo=XxSZokmR%-P a-vyᴟ1yVd Y@ -h,b1XJL\EVӜ*'CXzi~!ʶ`U yJ%/D6!J@ ?Bt6Y a?F -7;j\&qbԷ5ۘP_5&\F"(ÜcS L£lyԮhzcRt|sBVv.sY]gbNscNոCox_M%&1{ti/p9ɖ߸1k],=g.n|g_r\zҷg\fҷ/kNUTǯtT$OL$^u3SČ*6#>n77֌GӛZSN44uг{mc(I:b&=}6=w {_moegqqﷳoֽV˻/nT<:7űiYM|FY9uM2nMw.;UguӲS9[Rr3nљG׷4j~9ycቔˬƼƬp (ԈAE5M޸S۴ky!h ixPKL@՝p%gGҮSxz' e_ݍmI-;%g'呞lbJ{40/Ό_+H{پӼ#I(CzśxonbVۖS/\;7R>y FF&פ}ھlX|ڔO֔+;a -b.]_:0t%4*F}n2*i'8pOFgWӗT?=ZETwz?X,>X-f,I$vC|~;s6(첳/>xPܧ}քLzֈ۬H՝4ƬeT3Џy6gaMW&f;ǝӎCIfsVzvˮnKzm]׹[^NtMO+P6߷{?^N]{9Շg~93u6 -1QyL4 di/T4'%Se&m~dIjXC]մ5M;5'=<[j~3e&ar&|]?oxR3}ǣv#anįIu'3)7; _oϾw mA>Isdj؎FNꅰdyP !?MMne5d#=V5d\&E%:`-xD@/ ߬SbˮϙǢ&}z^'K sRAyUd#ْ]]-~JLWٖkR *y>tt| 5O'HI8il6$%u nrNӛ]"m:o9Uk3S.o{a]Cf^#E?Ʉ.~G>t„GXw bUG62p-҈a yD6mfoʞ>(a8t&|6kkT0Ăm4WtozՓw^7):w|ƽ=oOf֟ܬϛފg1jUA>2qCc#[M[d?#{>:n(Hm֘['x5&17弲ƴt}n&bnŘWﾺ-}KLIOf&_=誜t柟}uoW2723=' sj1;I'!C3~+6KS.uK-> } -HR>AuҩLm蜾{㉾3sGe{_M9mz}_pݾi;=lCfvĠK{u)7xФɣ2o&=ִKݞv;; v/K+ ֬D\P'݉] gCzyʣH;?ް7Vlº`>-(ۈO~v΋uO˚r _ 7:h;)=tfމ5{߉YUI,}KݖKiПQO?łf#ؼGҔj.ѩWO?kkUϾfm?zY6뗷E72~[kQFq®jL۵mr_L \:1e}8kNuNG{NICg1d&Mܭly 8þҰn6(N'YIu)K̉j0 5wy{C7~⻾}˷D^'l>;PbVv67Dkc#98vܘ[}G|Jσn@gx4 el^Yu$ݽ{sCI: =PoM5cؗc]mJlZY^{{~︴?䌢pϬy1):um.`>֧:?|]_<8ɮ6ENE#؉CՔUDlȇVj<ޔ[ш{4]9/cNBҾ6ƫk']lxh2p*[R820Ixe|:|2b4P$<"zɶd0d ᯲a-f'~d;U#y~A#%B]T;o4G/#\= 5fkNVk~K6`g:Qңa`~Ekҧ^]. 좴=9|s咜[~(#lh΂ɴSfC&#z M׏^?}Du؆k}gspevvys5:{NR E:n[Ѽ>w~svز0RvymrD޽ʳ1|\p8|8֤GǏ8Gs[z~m磕oimN`` Uwŝª-HtN|V Gu0G{rܓ6ɞ^~z&O{ 1)g3f*cS&ݪW3׏xwGvl0o S=DOL~~[#sEpέ>ncܪjszÞ}sfȀݚYܴK@iuHê<;Q 2AUo6:m70cýtP\fI/(eoB,oMnflMd'2(!Ӂ 8`Ә[|:ꖜIDD+! -;m00ȈYhY6l/%6=^kGHѐ]qSOٞi/=\t΁^zGrnw1}.Ѝyp{ԟ]TX֪E.N _:`2M̅p:H|::P_ ztu+.y}|w :+8p O%}Ҧ<4yfw Y>>ds U5r Ք #sܥj%|s?kzٸ74ڔ]6>:pO˷=O^{"n?t[XOoNh:0^|:wuMۻ -O>9az"9 dߑd፱nnW=pj2(:+:v#[3=VǀOvĿ.՛{;\fG'S}WC4,sLtՃ?:x=źEj7AW@D'Жlڣ݊*\|WC§ۚM @W{^)"heWJ?0Gr>+;\rkc\6 -ɺ2y[/mFxN&\}'ѹlDޑ=IGob)pBI>+<Wo^tB{vM6 +;K&k>WeVEN#_aW GwVLDHwǜ\hn:?# `$ ঵0'7WեRXȶYŁ]69- ~}5}.ECٍp踣gwO'yIve)m̵^mCҮiHNGիG}WcD7i}LccAk(Y=aդI3QO 53t##9~7/oVl{KшA?_?h;z]oG߰>.>95]ـF@Uq'V]aq=|$ >=:+NO>ۗrJf Ф -)僶2v?fT!.0C۝q9L ҨCTs^ eۋu)mbp`uneǝSy/Vaauqu&q" i5+NltdM$%Yכg7sA9@;`cNəGV8sQ󟢠KU_.Wc>I6a%IQ`~e{~Y.jdy:嗷'2Ub!: 6uOOSI}ItT; @fhC98p ٗB_n`Ul/"d- YbJd(K9Yč>U׺$pkOȗ'x@'96fD'S^-Jؕ-Y+k3W=-WO&-Nj^J_4;GO[ٗ:MOӝ~BLcmCl5%ϣ“/ƺ8G3SlJY}$8Dtr(>#g/Vx_`hf01c2m`:&ӭx "q^ݿ5nju&=2`oA਀}'3&ܣ#@!o43b3b\"9\|Fю(p :)9'>z;tbec=?bL~m_M7 F:CT!ooißa^5ok -[+$z|d)̛ j$ Wބ"ρ/X$o jqn\>| 9föDIQ3Si~un^+Sx2eӣy5v *tW񐼕gC^,^ x8A&lNoL8g.Ug{ot&!Io6^ \o6d-4z3:\h_vAѓAvrdA6.51`u0,ty63JS^mkc5pZ^?|v_{v}_ ]JL oۄKӅ B"l&Upt&Z4WլZzqwe8q[8 G-eUlLOn.JM9ն!R|g߳O'جʗwZ^ryYWj~|?GtV0[3m#SħE8vbC|K7|^> 5[NyC.cQތTW5񰍕WcsCќ,6.< 02w}i z -P!?r)3wK AC<4x￘NpkUЏ(Mp\D'òV<$m-; :RUЧ6.L.,Xa47vm3a iE{u<8|A 2{LǪO=е|"=yU]  ZY28o5'}LGco&ÃEn^'AX-l}ůޘhfU6p oEu9R~ /4p#17oԥ7&1@:hb0';׶h4aԭs`nYC0"?Nvး]۶>)QNj\s\:?yt.}bkcqU֯<k@ e/X+wގNļM?J^͌^܆o{-$M9TϪ-x/Oz'ڮgwx'0π;nYڴd7r=:u|wKqFu8pKӝ3W'&dBa&47ti5XPt~ 浙ǜ[tHE6:͒2R N2e70Uح\sޤb|mI?NِQhWٲ吜DԂZ&,0Swm0p%d{ބGRIӬؘu^1y^_2%ob]xKV&F~p`=1+R^,Rwn!U'}քOݑB$1cS<ȇF,e:%]FQ©ڜK8tݯ oޗ,  FI|VrjV[[S=Gcf%ߟjzbNu{̩jZ<^jg=;e4{{mZY6g$5/d:֋s3 O:_ŭ>ȵΣ; AmvpSNAU'o ݬ{+瑷yja%I1mu׏{]:GxׯR&1 _;z!س 3KM ^> _sڐ];g?p}JT؜w挢t`o`4lWˏN+Ʀ=QmNt{vO-#O鐨.ܳ-:<$kG.|G_ ""[#(Vc 5k نn,#`Ϣ[a߄O/}:&Z%(Bg.8p=?„G+#ll4aO6\`K.jéޘ$}Z!Q#'+ڧЇ['8)c3$DD\BOpȫicy#M>!"2ܒe917!5=0|4 }N̏BͲB[i,}˫z/~a?n͹᛹[V'=شD+o%keaqIox4+˖Vڳ5kI8M೘GtOdK1YsZ䤾svbN=cݱ7ڎiiU̡S5&ڎsV}yS^ė_u]ѩ KyܠycBպtrq%>%_mLe~ve-KxmIZxcTct}Ăkm@iR1lBgkn8/|Й3s6ub֦kukyk̬lMҥ}EaLpe8Ǟ5a~>0Ib.*, Xp#;+kjR/^KyԽV2B+#BFwj_K\ -\^,^o>ýجLjNׅ LH֚ p3<o΄ܼ^ zBX[t6l ޕYX(Fl6le|}o͉[_NIFB7\ n+Ng3~u/B}XR 藙XPŃ!ͲB=fvd& ʸ[әfgńb蜩/2Wg%5K[PqrV눗pZ5I3 јߚլޚJxTĦ q~kJq&>nޜR׭폎+~4_k&R> KtFݶ18|,؇O+Nlawwp_f^3= XgTw[3 ; O2LoJoJ9F$oGTb-uuܡx|?GۇmC1AXlokwpPҧ^0JΉN~ 7CIQf7&g7@=Pɹ?^:t C,0ioN/t)eļ^J‚^'oWtacN; (DF+^P=5)b>-, |.6^MC^,} -xefXp$I>$ς'J"'(jlUA >JE9hJt=ǬNzXoRy'{nH(i{=M@_Ú{gS7U|m); \))!Eo6 a `Nju\ݰ:%;^ޯMԌe'lO%590]۝8z4x"=:lNR9U]L2Y]o7DsA tKw`m}]ai39r=l[XI- c|bԶ>Q-4%֤תC G1&9 ;pl}$kʥnOإgpA$$IGgӡޡwF8 80^E[bNVzKxp''ۋ&vX#ڴr;"iٙ}-Ti! RCg:`._P6a*hzfI Dw"AUg&>8tXS>U7>CXzWӂ#ؼu4ULf8`QbajnaUDV,^28`wn"AUúU.r& m4TH FvX0ZZUjwL{rC_ jgi.`}Z51o2fQ_"!s -HN!f{ -|h| = -^Ovr+P_첺۽Q{05\nN㳻Ԭ> -Vv~~,v龣ŝj":?bmxE}Ќ&N}kcͪzq{i%Љ7=s(F/hP?8ƃڊ.Ӊ0XStwdcFꮸ:8v9qĜI&ӥKYѶ z ؉v4LXw;5iԵ ])iMy06Iph4ڥ5^}kkm<;Xxe^rK7Vgkѧ\>ܯaIc: mNm;z΢y %Y@W}ِO{~a-qWv/Թo /4o7K*aٱo};-Ls]x/̅F?-؜ekN׽6_ܟ ve2xV< uFmZ!`"i԰Npj1F[0,Ģ7eEqL\:rݕO,_?ȣy4ѫV)C G#y:Y: nlD\Ft٣6gEUI P -=,|K,,xDŠTHPKe-6lam.5=,fh]Z`o lȬoՋT]o`^,_4ZwVlW31]̯'# ,P3Ky'A XS:7)`?Up5;ѱϢ36ulJ߾X~61.>9aM/XM| w`-$]j=3NsqG߾?0ai)g Z|V^{`lB~ bAuE-'SQ;`h.o.12-&ѢSQ/kf{Y)̭L X+IЕJ뱀k$yh4)7} }k vd` 9|p_ vfhk>Ӷ=Vwf 6 ӡ a/gBc)N_[PaṸ_x:HEΤQ|إ'g÷srn >5X$p8|eBJ^}`٠+H_jNJ޸ס5wO⦽6t|CL:,4xXX&Nd@'-VXAm57n/@v`|4D lXӇ3 d?->uI -nC'͏.Y(~)핵cnI}.pcRxl}J| -`kZ[ ښêY1vP٠11s`c[gw[ِA {YyЉȧ߬MA?.i]Pt@۟$Ff}ڞd9/rûWI>zө'|ZKްUwzU-d50G  WGN跠u0|cʩFXx l}ҷ|6k;+y~I-}ΦZt * p3(gl$4l8ĵ db|=K/H>HFn Y )6o2g6YXL*4x7A *7f4}s꺸g|OGnW?̫o3 Gzƒdx+oݭeByIvXֹ6%8/3GAx}? /A -ĉmQ[Gq`".Xs9m{ҭJtP/n֛*6Ek;cs -ZZ!6qi̼ؓA_6YW,#) 8tklt=w @=`vG٫[pYuhHl_ri_*;6<kjN~gڿ]#s퉬)A1{tgA/(zT%Nx-+7ft=QbN3 ]ZG%V6s&"s%YE"8t=7oU\(FpO/Z_I lAF 3sc . -[=c)͢+o"F <  z.Ê<(k?_ Yp'Ma"G՛O$Gc3$`^vIĦmM1ɵ}m<5a#x >TÚY4h( bns.p노GӍۄvcvYmҭ\}X~i&:+ٚ[ߜ-;~g Oty.^1W8GӬϙ~/KKotW(nI9ìI;gw}I9aj/٠3aNI䌺9m&x 0Up`l%:CDgq&Qu[DSI}_8˸}ý&鷦/i6l.JĵA+V p]Җ\l@՝t^~7qy5&>HxX/fɘ0"X]!eIEg>i]tvfIY1ٶW|]^8aEgR؀) X;daEOگ:U-gd,4rYC+&'mհ>sS 记F ɚ7'?U~/=n)Yu|Jt,9.ݮ[~uo 47] ĜTrNz:R4ug|JU5n2vm{|Zqnc}H3DqI$G_=MGbqXqڄӿ }U׏&aҩEB̡ly6:=ڭYiyUe.vp)[cpv'~#MʩܚVۀ3ny6o~W8 -zྤ}>b`ɹdl+ pU"D˃keY%G=19'<9!< '$ 6 8~IݦĜTƥlF{'5_O(jN)/# iY w+K+Q.*KL<:h=`wXԀ /\`Gj~n^՗pmMlmѭ{۶ET"[ {I{%H'Cm}9L? qfZZ@G![U9T_2`Cy<Ų=P XЮY藿:\%Z&\"| ?qg}_Zٌ9*G:&top1'XW\(U/?s>dU?AO>&D>I9O{cFyύFs7+{}>Փ2e_FK}mJT2kM<|y(\؃ qH9&DI:bw\כߟ(Q9i>a{w%u}e(|E54 :вe^g$!lPF'fw0}j(3JK}O3=6bjbH1wV144!z}=,r@Ƨ|ב̓^׹ 1 C:®v"$k)=%m>F\˨"UC˺a~a@Oո8كl"Lc`+KN'*R/=@9AZjke 1E+SiqL}JRҙqdCiv酎Yd DδظWȋ)J&/~2z -xY6pSt4II2pEL|jy]rS1.F -;(/.` <!Di1V%rfr8 9bvF(ܧGR\ągQcG}A1REJ4OV:/5Cͷ8lV}z. * fnSX۔Aqw8 =*II' -r -cYףaiЁ#ig8.~6u%g8Y -~)vя -sMXU9R0r;?4lvыr8S )k:1L>< sOt,7Ze4zt0JG)Z.$>:A9E }6 {==dm65): 7b¿إ6|thY=wzn;0adىpRt0Ynx-nu# Ss.?QPQUB_+<73\L"m1bAjytwXh}ܘ|*9o tGxU? ]/~R~f9n7>?:NHR&{cH֜g7f):£α6=DZf_Gdyu3D6'%+zlER77È/#$:Bǀܟsff̣/Rզ{Vf;Nn'V+sَ<YF Wk}[ƩIGOyo{ -^Vx `ЃؽA\/jSccQM-cfi6=8 {" d$*b-q`&DH b`em&~k=e)wJ3#kiua!- +k$)XNH<sm%Ǭ#H!OkMV).LI<ńacWC 5,ϧZy."}>C)8M|~֜b -{ۍ1}f#Ĝh!o-%Vj/LПꉎ]|d 5:$ymlt.e8זks]a]EƁOK/iV렯0k D}0S~~ -UA3K1|ІAl81y!;ȒTzd89*tì$r]v/gHA: LbЋ ݰcB_]m!}(qkWZ~ r.uݸhAhֱyY#i -V銄{HytXP()z^Ovgiqrm3 j_ONS~,k2OA׭ $߅c99z">lue>Ip&ނxupن5WꡯV\v:Poܸۛ0i`ɘ;دBMΓl͎b '-xG0uiv9.>G6MZp s[N}\|2a*a VOu\t" з>iyf=\}0 -ESI'LEFI0bC})XBM#ԃQFv?9"+ǘyArF;RMӥgTIA#$)'82p{x۝>u>i*FG˱"~eADZQu- MEozK?ًvЏ;-@mJ .&@OGQ\EG*9Yƞ-]Oj͈%Oe:01@}z>hPlxc{{cp;H_n,z},'['pr/5ewOk^LrcNκqGD[XTOeӕ>iG1tAYG㤄؇6s>s: ݀y|&CL"r'>(++MRZ|M Rc[-%!A^ )dԩ"S2􇞐k=VP|≞GZo#Z;]EJr&SV볃~ =0yY#pۃ7d7ZJV+.u 1lvOчڄSe+#}fGEuUpno)72rat a=Te J{&LEN@N3Ad?&&;w@nS'N帱\hꆺk FW1w  -lv;5X)-`qTv28Ќ`^/Wom&lua| mφ|{1yGKXkA1BiuosЖz*q"Z+%p7@{C\V of󟫄yk主{RR-yJ0N=NҐ@ZU*uF:+pKf% 9O>x1=D$7廚czv_ўh^o{c -*HG-5]w:ޫ 7@K_>ͥf$gKз}#IvM0Sb$/6[Q罞~$.H\6;~ j~bMVԧ)Q+jǫ uEXISĻUV[ fY46][wuIZA^DGIIOF *f])1GcVx7*v ?ⶡ9>q H -<BȇUdos_k)xPl"a2ᩆ9\\G -.^5_kz s:]d&yy%/r~r~ -nu%^Y~x|Z|#GUP]`䫱uj#fgɧVjkSd 1+͹/ .#;<+$&bܓfL3@.z1Wlp0FץBzBk\̧?ylO3 ɠ1fCn鄑ֻKcS -jkqq&)jG~4]kx/0f}8~kuyv`=1~B-;պS%hK&Rd>3J,嚂uΫui;qb܉<`#3 2ǙZ^%I½)b"R>pK_j,z5UlRQsl|H=ԘsɎMYΆ&.Ttx&xBeγk eIӝǝ~qiMfϟK5Ȥlhɗ۝(i .}GQ/Pmqw>G\k)ckď[q,g#WsOWf;+Y xOzP%wрRSkr<ʹ$q/ =a+spbyMA <rDй -r4^yV[ -xJ>|VGgBMKqhRSxqwwCNtmh%3K[KV_^h+ߖ;/q~$*d -xHuJӒ nvpa2bm7_j,n2b{1[şKU|FuS^w_GHjQrGN;Ly4LI{1r_B}4 a 9CG˵$Ն[@PP29~73^^D(E/f*q>EKzH~}$b# f%ei,~>rwIO)jE;z7ӱy}"892rޡT3`=ն|':AΣqznxC#8BNK^nSwhQ(+#İ[Oj ߟhhCLS<^2F9c5\+ry&dMبaqR31x -i<^z"AEA˜iF7j8al3FN;ҰJ )aQ<ɜ$=e Վ="F aMؐaZѹjX%? WRQ2Ng꫅od&G/ԃ_hx)w嬨]/wHfjRW]XQf癒O>MȐ{;]yn56ۋ> q3kQqUՅV%%@ -Zhٙa,0_lop -Ѕ G¦`A71aq^o3rmjn60]WPOo[ۊ>MoⲤW_JCmrx¹ 3KF6;JCϵb8.8іܟ;h&1/|?Q͍!24]v[^p1\} ]^Nv\'>tX3?BN<)gj>zwdZU!p{>e^:s\̉7F[ jj!PCN}/f} 3W-ڂ7g.>RS.a;YSOH\]~0H>!FA7+u}) -[000a:d^„>tXfRߧʼnO~*f8RmRQk.RWP_ -(v :gysv?PqS+ ];I@M圩(?ܳY.dbl<Ӣͅ½̲2f.|!v?=P/_hI)7_Qfx?VE@fgƅJr2PNS-N{1c9덶*cZ\,]zEIE9,Zl-|\X#3 -ݛxvx6LZ]|<lUHZr%8@F ?n>W)9*#S~4.fkL{X^}2\JyIFV7srsTbRּϦ65|1MrXI;&'wEnBQ7ׁHOJuHy M%'9jl}c9=ks5\DŃHKMNÔ;ܸ?q6;58DM}fQt|$6n֕҃ ReRMUrwi9ƨQdGRv\[W%t8BNv"NT 8@;։r(;Ѕrn;,n |aÄhf&j/4zKRr쉚?qjN62[ji8O 9UYϖ<,rZ6yIs9?*9;+ﷇɱ#lD94^i.7KpnUS6$/'bd).Pɀ,w#j!٢C'noNcegDdؤ:zZ8B-c&Ź=t *HFI{M7þczVD2Bf;J30>Ҭ")I\4fFUF59 \, -RJF -`j2*CW駵7[ٯS7,XU-Ȣ!_UVtJɹP0#eCm!$=b>[)}fVb^9`jU Gzn ȼ?z*疚`vcJVYAN3B({#\r軭6a5<5 Y f'1f:@*zxc-c\Os4.Zmz -endstream endobj 311 0 obj <>stream -)D>LBm(-$+FYiDIB!Ab4Y/:zB=2bifəؔjb z٩:Q3&9-`AQлfy6})waDYttEʹ ^'J>¾a$ǹ'qbFYbV-D0H &!ޤ"&ZgXRM羮y_Y67{lńna"O5B|mɇBC#k{+cZ5J:FS4>/p C/Km`wmuŶ):o&o]@S;о:qγҀQlֱG>.Z"' -6tߙޛ9է'Kk~oiQp^ica콍W()-E-6 0z7Ϸx͵eoM`c7(>Lᅾ|mT2'siO m̍F"wY^o7w;I@[}NjBjyH\Ջ j YLRmRmU/6z,lUH—]0~Deu"cDjF86\O Kpnv<iRMޔ)gșY*^TbJH)x;1r2 i7Q+g#gbNoC` Xn?_n>#%=lF$:sIs\DI`juO93BGc/L^#6c6I!]cia[<]Y?H;%TLXHP=5t#N5viAM<>lnhDiZ.B)|~?א~=|YPs^kz(#f/"t&jU -%EFir^ͷ:T`-.*&;}Ԥf~N7ti:(Ylyҝ@;_6k=TeK7A+OqAJ.exx_x'ε+ ?}q~ps]+pg\5\mi~Bz1;KCn`s.b/UgOF [gPˍg'*1}l ]HC')xg)HSݻ藭x*:;% -&"r%^laZ5r+ٟ?]x)vpl*5M Z3UU:=AKPn8^Lh]he@/~~qsYRWtv$}2׎RUߑҊO!v8􉜋|1%BЋ0>ʳ$6;- -6:j쇷1~)H__xg-coOvd؈)MQqdNc\k71Y*4,ಟ]PgaRAn{eS| =)3cWJIjyسYŬ.ukDfpӕįɷ/}/Qbb"^%%_'G^}%t0qS,Z!ۆ2Y^҂ʾN$|j(/#-Foz \>&, -$j{+NV .Y}5%C%1XDŽy])`cQT#ˋsңK yK\8Jzd>7~5{(X灁_ʿ,̽R -tqr{CG@7zvOP (/R3<<\O+2aCAnU5TAP˻%f\c]E\ -s{ Ԫ3( -|p3ЭkWAZxIR}sIWWf}2U}ƍViTgN!*%RNp0(  ǏAa/A@o *[ o'G0v+0*jc f2r7CAϟ"޼ GA7o\ ^'w++esH o5JncG*wIi@^rs}xy -z8WAρkxt 7 dTRn&frb~Kq=p g&Bpt @}'yJ#BS\섇䥑+Bxu3]x^ȿMǥGw}CۧAQ^!e߭ _*Ɂ+h6XXlqXU;TS_)+2:1".RF?S's{%0n}(w(!qNcNR衭a~6p;9pq=-pgrAN^!o6B xC7yW'bvN9+E*1? YW#<=@\:t| -pyz }30^Nw8<>qW"}%p_ `ۋ> 8`?\c p}qq%{><} -uvp=.c'PXOW*VrF1js܆:J ^v ;K)_@1NOA^ -zrA]\A PK!>wFx9t^9Y$$(kK_+H!a!W??Xv=k柠@?q=;1%a'07ՒnZB#bJ/~J5SG пpq7{O?{r} * \IpcsUTu<N[ -Ꞷz]& Dk脘?\ 9AOo \ ݳ `,?Dθ+Ae]@y#4Q {ZM并iO;(6642&6vϩW c ]y d>L4US)cm*G)A +3TW|wuxԁxik9rzw !b_SUIXjHM?P,GܭA?H%5|459{u=?%y]bzqr'3fw_//'ʱp9:A$Ƹa\isݪ,(9(ϛw:s9'rzxeHR5>F 1k*|EǜUs5iبjdsQV֍oݼ@@n/@n~΁;2J <1!;heRn c i,ClvQHݫ}N8G'_M `9P@wsv&K9׆8&aR0rgEUIre㶆SԽ.U ufef)MM(o_PĠ_.AӯNuP@@V>WPQNt3c>QMU%Ua ~ײ#B@g&Nk+9 yIIw2Dh.>[["f?Z, X*;_wՕ*RMA?R'(/,Tx%' ؼUˀ_ޓauVKZaEO7GDwZ[ jk=H?f$}'SyU}4_հ?%*F,CP+Uz9!H\(_4v-4;}̸3uˢXn(F5u[ -1aG%l+k$CwyJo]zzhҺƤN˭ry1YQ1@6l:Zt<% -H3bm>N[Fm w*Q+E4Ugc)k9V^[=Q.`]4MƺWR9__bTBIɃ펳2;QMRr_+uғimm.#%i<ƊᖖiksNƫl>i+ņ!QvcX+*ͳ5G33' 5߁ x:Ä'iqRQhoq]a@uy@KYه2D/xM,6MOzmړjmnhUWGhqz@eQFABtIU53P]OpS'؁}]U혉֊x݀0kmo^XVyc`Gq!r (Ё1e,ssHq@hGyI ɮW^4ʅ.L𯝚6\]YW]aTWo;FW+s"mSeqJ꾌7:RXU2rlS<ɼ@GX5fZegs-sugKSҳև0[RB81 -s*M].v6M?)I)jNmpFdU)F5)U\T%han#;MeaFİ>fL8Ֆs=*jϵ/f{Z.֪*9}xwDPxU4BUW]mR֊յ{ -~Ɇ)%E'{c$R_tV=ǫ5#5bV`cvn.r<%$T"mhgCWߺ5ҽiTrbAVU lŜ}^; -:GZzY'Y*kηNGtCϳV-jqjW,oPwOV VTe9bNfV-Ju$bEJruI*<l]Nq)ig֍>Tq>|| *xvmP{Z{WWeY&cM=[4i0'rx =59gZDG~[gyݑߝguoGCgLe-+SqgMJMFJE wOG5]}i_kbA\~:+d<۔"Cg[r?.zXځ]dA,'s meQwK}?(o>7YUVukEeX4Tq gtn*qƛ&H)FUK5+I':6X;|Eu>$cbIߟ=)@IU7Mb=,U5Z5Ρd)ޗ"ڏ4| :\;:m?5vZ Gjn=V7}w;NTTuCyb^ȴiu>C5AcX$lu9݉?Ǻ]ucSKq2dX|2])ḱWz`Uc=Ї<⑆A0+Ty`Y+¥4.ԗFׁ<-VjqvAF -_x<@KݏгyItBm-)0ߦ9(=v{w:Bo0 k]1j,VVv)Xl2Pyc0qTӵ=M"Jl -lVo@QЩQlsykolZBY6$/V. 2F1N&P3jVP3->yi{!Η56keIu778/,))'zEEHؕB}[S^ɠS@q\^?o]S0__8J&EȈ1݁bo. eߗʫO-ePmSLȶWkY|6WhVp F^/UJ>UF2+8M39Ӄ9+.;rUIF1HNUְ+QO^&w4#56ڬF)$@Iؔ1zHa&}X7`_@GNMRdFw|9si~6UbZ1H):0 lߟv vPt\QsM 'S1J %cnHNfD||P\ {v)6=9L(>W|1 [O5폒H`.fi3b{}5bkETn#cUsCSr;?Yv:O^)F5F<_h4y8^h..SOti|4%o(yi&:Ѥ!fhGSĤ9FREPwæ/ĬtA5myi6% SJ^7L.8 1z [cqTāEdzնFjUzy÷5ϥ^@^'Z5{ci1D/g ? c?7EuifU,>_i.? lnwCXj=H_Ꟁ>@ltZ~0sވ}F2i#$,o-zzY< mR$z#aqn/'{b7HyѷD) >Y ,2dkֱx@<"oZg麁Xab*ʲ@,u\{grRŮ]" |&I{*$'ԯ^A3"\0􃒑ouo4ɫT4ee,䡒wYETX'hog닑8Б{Xbue}61tB,&-!{PbA$[j?T,iX+9gB1:::þHN (9l >:G.ku5!]e/퓰$pmNͼ֓5ݯÖ{t"..xF'Iņ>C}>'憞/=&nU?,/8ֳGzɽ/f2)~ >4t\.@%ȥ9KQqT{ -uH=^JJIe܄/7RMĀ8Y ߾"lbc֣aX P=@J04<^& ^Sv3 ] 3lD䆂}^Ⱥ5{g"獲Ƽ+3)3uI9HP}}wI'yC{L7{i Q6z/R* DX`2 }bbu -m= -yX}.ۓ踍;E\BkX᳍#f_N!R@{$r,,ɿ:2@,S- { TdGF;g QpPגȻH-̲o< ˶'xue2XlcGJ[OĬ KRMC'@_*c} -\v1E'SX5 wJ7ZɶL@71!xD?9ӵL~'t^zdhڞE'oⲼJnnJ a6pk -5z㜩$i}cyRSzz㪿p WuQ1n9ƯeNm2TWH]@zE~.D4jZە!ӭs 1X{Tj ӽy+g#|K/' Oɗ7o]Up`;K?%lpsӺ?M S<2.%ez3LV?\vU|&AyjM2=+ %mBf%Q*a<66 -~(+Ϲ2CO?q_iBÀs6J^1P3Ekצ%2:0l}0HKML9g(z욅&XN* 4,c .9OLFCT^D- 7Urb~m1g7g; )1vl9E1'ZgW -;V|>VƮ ?w4v1i9t8VԄߚ*|q/J`0O [B|wIN"c]d:2}T7{Q s;sh~%XͣL؞Z{7 ENrkK^O]yq/=Egdٛk -jCZ!ls0+ F-}V}1৸}5yNx4,qm ޯf1=jJCT7t@-АyD" iN1<)y< {>pEqHyl} -IZ(prGm[y]M5e4w@ :QbpdukUsP|¦oW=7>Z@EOnQҟ~/f!w&Pq;֒ꆼƼkeO[1IX9c,]gkc&Qgq|*r(KTȉM<ȥ2䃩3>쌩j[] ѮQv kks 13G!m DKmo-xd}KsMSKdITpwy!׮t_{B,3U6!8`V<8h@|57iqx(,6L8U1>) >Mʸ-cLPrtbJu%7 ,}k\w-dԡFи5$ahLh.} ٬aFێgh`f1窂xvfG޽)HM. =2+\ -|'_zy@MFtU!*}[4r<$jwωrn]`9D}jꍆq]Hc -Z\΀3cv L%Qz:=s^g+朱;_CXZ=O( Wv ġ =xz\& }x2!- 7 ;`Yz} -d=QK9Id>㺡)Vpc` \#-e3k7&IJ&DO~]%#)Tt+42~_@u]9\[C8h -Jo ğwYS?A)z.yf_ 4Zݒ{WKl97q @kco뵮o*9lUHfhSR?W{ 5O̵q)&ЃAg -ᑛu!^VP/ ÓLjSg7g % -J=f;C1Z3+<OgֺX|uvo웦^em־_5 q/\ ~!PeiImyK#U`c@g3Hucu9+풊W%7ˆ:ʞN`"~!jH,6O=3XEo~LӝFḰK ҚڶqdWCc穞wIA{ElT1:6 _0!.)pP+ >s}%ݔs.Ji9WaL)Rr~Ef)|㍎_# al~}5sX_Z&AlSC¿} sȱ߸;W$'U R/t=1bSChNb*ӕo iZAoqP:ln_F>01Y$PY¤+%9`FxŔKzD]%bJCƳtT}cSb)Y)zlO^zj:hiE:#6yRMccX肼AG*>NXνe.>^ܞs!D&Lq,š<28N99ʯcٵ -5nOCEiÿ̍@?'jB -2tyX'h8fX;61^t"?qyg>KM?7 {܉d'NH91BDKKuKHι§} -`ucsֆkCyh_F-cr3W;YXm7)/=Ksamc_:+BoK;@#j5M.+$lu;+h醐yn6㿛=Ka˝1[xjbҏVỲwvIљ@oվy9;vK3ʠ9TSДC-FّqWw^۝4=|IiaiO~+ &sŖ;EHl+`5i*Mx;O(+4,"m ,Uv -"2p')b2N΢-3h풣Rtm@9wo;1y_M\yQ+z4:OŒG*~ε6!,8Pj3'Y[S7k%4rP%bzO&`z:<6սJ!ڥ$:+0kuoYe"0@`ފ#pf{ YĚz )1ガ౼i?.霘]1M.0U5gqBW{ -2& -~ pKٙ&iyC-{¢DKt`c6aWF*u1d#U 6 -hS@]F{wW:Re6qOAtqa7»38Y|>ְ_-_7T(K#hQ6`~`Y뛣CE~1B 1ΐ;Pi",ډ8o_Sٙ%{װهz.%{..2xNߙ-#ĈKyT4y!cgɹ61Zy1w2f*|߆J?ŏ'gl%! <w@r_Mߛt_-aNpAxm䑁Ss>5bSN,LT7In}q{ h+cOҵ4m`O!#<",. O#~i.gj +V2nt=ԾB3bBZ<1p_ĚC W|e拡eDc까{U{*M?4,g?K]J/ _Z?1: :qɗFcU`O'$}uQyL2ֹYĥ)!-sFWK(Zk 9> 7z2Sa\(b}٣ߥ_*2mjWœyz- //V1ngc-Fo !ｲ/k;SsСۣ NVS`274]qIe eg&_9 2B_B-"#W:nmTG穕Ӝ{'{ru7=J\Gw.sewC3%'YKړUXQcǥB [+LH]@udM}&vGI9JI{t C\j'8 -MpX0)cB5ukBZsRlBn~腼K.EM8RaP73hE(\Qɽk]6J]=w,'Ɩ#svI_ -i/=^̩bS xCb\iT73bO K\rR -="vw6sbn> Z3S{Ń# 0sW'nT2'#Z79nᓟAwU;cdYfiElOE,*IU:4_iYe ,?_,kKYdm>f<~c3Bt 4:7wӴ\4uGj['j#p,>%xe [Lt-sՑ;KKʐ/F*١ Av%]qMG -M>T!6kBɬe wŔ?{d͖K6t$1o@]H?2={P\Vi̋&PĮGt+h5Z@)i@\*Z[̀ +#3~}s_ؾ䥾⩮y&bgfهj~%fyC[By^ދ9Yơ;J -LtEg`KLS-NW^X+70cۯcu ?Tz`"&mc:\Vtou+&SbC${52[#M=ׯ`|20O蕱%bWLǥnw#eD#𞩗I<7I>Ԑ`yg|qz^6KYnyaC'{|]BW)ƖQ.[_ܙA'Kz}msW>kx[ǖ-r C~&=;ch-,bbT[NMWG\n,]*}=MȔ6R7[냄>7׼o3D)ٙ+}鑡:@qK# -?nh~j#~\\&895CsK%Aax0pW$pȈ%tG@jش.@00r˱yherE듰I' u)іqV{*: - -9PQPv ȁɻ"u~OA(ScKXen5O;X*eF/PqWT)"ـ]FF;B|R2۫gx= oڦd!v,[=3!m -Ie"-5Vg\A%2w)e(ޚD?_/@suTԡ+tځB)ѕ@g: 61Zf"mRrEJ8ݹ%mN -]K>CoV7eOŨ3~qc^z^[k ŠLc`lV>Y*+$ro+nE=Ai-4*q{o{l W hx,:~motKL("{ŏfywc19m8qwڗw⪐{{m2L3X&|Rbɡ -KVVx𱆉wI -R Ŀ܆zHEl =ߜFLRmczj^[n+ _~#불]]q]j*vm"LsR!3дY"}rA S*,°Manu] zx/&Gt_sVn}?^i-ny<@+ - 8!u -/Ϻ!a_0VmTF# YS3 *klOR k#ȭt챑N<6qbݡ_o T t#/|Nj0#=Yɴ>.>_Qg>~/!.LkRZDg*:\|f wHIe2Σ1.%QN)#J:`r~_*ׅ@V 1ք]l!(u[;:/(!J:w,1.% !]~RBKJ3@>.> ">y*pUn=eSP2ضg֦M{$ii{3P1ǫdGT]">||ghl~2C&gvq\5m.+¦xI}\v3J,x䜤.~BE4[#$ Da:"z`VU읱/C~^ @.5. <@b`kYsƕW{rzm7"uSq7C)}.dzɰ"VI!;QYqӬڭt"ޙz%^-ȳ sN Ƽ;k:Z0{ ,8/ysdVwF HCy׈WSK>̝47U{R\,o~eCFkwU?bM>{h`XV'oEI_W10{:&q_$Q]FnLBތsR]iqH(8HϲLTi[~Z}>&d<'be=a:P+:<^{C<]aZch# F)[n:kCGɹqZzٝئy[eNit=s4^\]_tͽH[h- Z)}l{=X3C/ -x/t@ǹ e3hl:f"Pʮ;ؘv\}So~>M<ΥW[Qq9d.<)${}!.jJSLS1d}#ˉŇ*|]+"j;/vFG> jJh{ ЇABb ] t'YT|ouza?O.VJ60޿П9`^Wljhh.m_CE,zc?+M" -''+Srߝٙ&AO,‘^γD%\؛8 ]Ses 4$|aks/,S]rlWIjlW2`Zi{YjܓQ*4TJPpGMtiwkk& -Z9_q hS q,DqAڞ$Ʌߙ[—:aѪ)KQ2?>v}0$)W°_:/TE]_=Y~t_wDD2f{k,bLi&uL-ÐPHUPYf_}95=XER_O?~g\ _+^k>騍:k@8gbYMANas]r᜘2 G.#p]@ţT)5G-еk/@/zvU}0axe^޽ɺH2Kߙ'JW@QMR}yVG)T_»>q5~e=ṣ\a#c#cSpl}0ӔMs[+_, *h C)F"+-Jwy0P/Vj{KGYJ鲠쑮ns;8Ra{d,Xcm⯋w':*}l@aGZx6+J~د،ZNCIZm+HO 6wz ~kfI S?lWL)t_`^^P5]^(Z Kt9vsO5lkD[ى=oce{sc,ձ7B|9/󚺽"-c%9isN,G KLoNT{rQ8'y7v&qy|}meγ #Y(hm\es4W^)HcrZ`e_V"!_&(=9-z%2=QXU-Z J~|yg.bc⹜rcne8<['u,bzg)멻 gĬ|eh}^'7_ -68HL͹f6e=rnRC.xU9Fe菹9*~,~5)*P>9 |S"Bgx,Ǖ4;N;VQk]b|kֹY)JBIc|`s1SEחj_ڄ̢Ͽ _pRZ7:bg 1K T$6E:y;@LX% e(VdkRPnz)k,{59]oqcuCkx)("FPĽH*ieު{qvgH/,oKqL}YC޶D2FMyh) szm*#&]sSo91SI9E&?IUDuQ?"7VgW]122 S02t!葑A$5 '+׍ "ԑyJ#qNV$ -e ?6`V1,.v Yua2^)'{y+^\g]&\hN8Jx, QOWi3"?o@BeݥOڡ@23 6E.I= jj(!;6# 1T2; 6j':qYDȼY,|_C$YkWrv=Zj%_:l_Hrֆʃ3y;Gj?9f"]yLOƨ-)6M/s+4E'P?#},f_յ쓦 ?TVTv~VI -'i#I:eTm{͑ʷ6*im ѫ$4,eRdީk)IRrK A2 B ޱLsx{?,l&yE.ts -WW.:ϓ - -,>xljȡC)yjuZ-$fhE["VNт)- "'ɿW}a -vVC|.ۘ?HIB11iN12q_)?֑чZ:%c ʅg+[fV(-~NVM@z"D}uhWʙcF/kZJvU3S -l_d^0'&~K.r,@싨dTQ*m *w^2?F^F]#])~3M+'(7F -J՞*5Yjc7. .k'!tTPvg&^pƵb]+衱 lEaBz]P]kc$a3D2rSxiBW)ທ,5$.? @Q/P*/<Dkp?WӮ[T g~A|.N|fwY豌Pn(yT>y}ob~Kzq+W5O)0k)yk+'i,ˉ> Ncyyrq}U/9G̽ ?SSj, g>gsKs󔤋UOlS8teUXqL/i{2R E^926[> qٛ8L}|%hH % p(|g.ҽ.At)&ZބbިZʞlrΔ'H-u}#=jǡɶɵ;b&d{i Nf6m_}1{#YBJ50pd,o)[ObVeuCյȋI|nn 2WRcq{[uJ&«$UlNC#7&+M=5YfbW&4OUZ}V9_ix&ܜ e]Ö^'Ϻ7ȿaCKz1?KxAnt1p]鼩*t)G౿S/*xEеn\3-3{S1\2zi.x[~ͥY%wbj7rCŃyB-!::-Ïn#ѥcA??'[eȳ %~A<㜮]BORi[?$ؾrΒ;ŏiW:K^g)EC·l(j"d=Y\o5MՆM״W'ǡQ "JCuMW -MZ<+`}< `C=tB/+Lm0̝ xʞuN!S }5!Qh0.>݈اyvQ#qkU9Fܙ^6~}a'za\FwMܵYF^ؑ۴3qq(^5lUP|2p$.s{)u*.$͒&ɱϓǑ~ e 9\46uFaR}d-~ׁNbصD.k_q.PkX"p_f/F~XMy|4>䓩T[Hw#LC780"Hy6+z()FF`vyecaϵ}Uu< Y풱^%7>[]&,"DSJ-ߚ ۄE^nxܙvHRf~F i vy"$DIX+u!]nKMtL!]"j`~R-kymIXhU`Zjo1|iZ~9C#2?+G^}O\bc >/&*#,89+oӸs3ĨPQmBe_]42zc}5p\m:0?=esg'^]e)?J^݁g@/5u}A+|,SĴ`,&:Z7vϔ}m-򓄖x p!/!5hBjf2rtk&i.HRaK g=1:]JJ Kߝ4]1RpRv&e"94uUGObbos8X_- }Z`(pHhp1?Cʚ*w2NE 'bZR].X~еC^Lb] bE81p: . PǤ虜F*a٧6=n䫉[o3PF*~ -^y9T~{㱎ю2'h{K L42AH2?4t0vFERS;p̽6 V_d\6g]Uүf si[f$ӒI23cbKbwT"#EA -ҤJWb-u2gsy>!l׺ -Z>.sw'סS*tҖKWAH?i "{KNdV6%N ^9W#=U~~-b!fb֚.6!+ca.zEm3h6e:zŊϝU!^OtC.oVhT;n/Z #:n%ENЊ*jg 0O<|)6uZ~5&w2[n7(י/~Dd>ܷI 6-2D\lbSKN;̵|wZsifN7w_r'H[ 0tSo!MGC3vBGܧD)ˌ5?+/c]ɝM@G(|8XƯ;.\:cm5vlղlcևm8[N#Zo oZELKbV ORp>Z)@|Խ7oUL |K9a6/K^sF(޵b> 5.dή[jN:x\|M->hHIۚ򋓘zj+ξK]vp3跻rݶ0 $mwҺlEfvU[1@ wmUc6ؖ%6ΝM㞏<~g\s3FgEdg[vFQF舖SnwXғrgd@&iUξ8l}<kρ~$M3#Vr鲋,FGnV͈+/HʮYsd•X()ಸ)*QAb7Utֈtn r~%޿=L{# q䰤~WPڷ.l:-} -V- ᮬKl/A:fcG6A#=W-`c쪓SuH,S+z e'^:0nKZ`sĒE\ɕS_-ZY]0FyEm !L~zխS]1~Ի3{nH&u_;msӶ!UyKNt@SCy0E3C!\zi˺p0Lߴv*x'@1gLᎆ,v=nA,^2  %y\z9䭘 gdwa~P٦`VݳOvGQ&vE1eU~ -5d,ۛa$PIL1LA~$A?k7]Qb s#;n|V^-H{?Pk>>kmZl AT {7Nظ sx亟GsPW"u{[m';!OGu;8ĨU i=!sTE~?)+A uQ#9kfFK7 ȡ{ R?φcSWS9kWnxM/exił+_⊶<,2V eF5?[vf{G;:RASc3Z =p,1X鎽5}ˆ.YfuJ3 .inqsNVoFlq#66v6/ f*@\jBM̚y);ąW &r鸖Q8G+52wF)S$9#>؉H\Rr亍af먖/ƕ_e:M(\6J=wGһkrՂS@XtrGk~jl^uѫ6bAYwbVdj2'2ٗpG,m'ng6nik^J01`7oxqA p 0sKm#,܎ _'zQq zF5wd5Odv.vy6ZS -H(1L{럅?ּj#7bżS. -XItLcA-i;^tAX#L(!͘c$ȾW!Tߙ\՚lᢵN -{a.v'( =;*_.XyqϨ5S&CV}4䆏YqUͫ|KR<fvV`WΚ)s6l!bϻi3)hzC;W岅X1LppӬȰ7i16ymq1 ~&fsM[C jt᪗O^6ݰ$lDВnKtAhh)'1"lK ߍS3Wmv9+q|4%PD@F4k-XuJlXup/4i\;E .co{gDu:<躃6pjG~)lc,ٺkve(Շ\rH^zϠ@]ɵ+4tBGzYYS:#}VI/v FZQz)ER+loKNnjou7ml˛Ry;+n!mFny &{-@jѴF[и)ed- 琗z+"|6LHdg{yL `h6=Ւ:J95'0h'yw|Ci9bU(5,)*b#v>b[aieK0Ơ}P5o}0\wҚL$o_pC¼悱Бz- `oʴva/+T CHbZ tzHe"C͑(=BRci kSzA_,h8`s|֎[_ͦSty4J4Bu쥣V*Ä2;&Z)&z阚3ZA Tg}%쌴Sv?Lx® -c*O%U(2ZAKf00Mz(c.X@_ug-rΜ=k嶌(3:zY2}*#wQ'oə+^A&eNy1{j ZŖ޴4l{INFsXO-!KvmRMزl̆2aÌI=)o0CC"m^&j+ uN[. x΁x_GͽUb&E*'FH!ܡܙ r+vٰ̲l'!R3n5l Ӳ.jPZ6BقZ vuo}ڀMZ󵁶G0e{!noB<ۦy i'5HwClZFsr4q%Y 2#|tjo\й;Al >88@z x{5СRڟ}9>f;h|R~tqZaEG#@vCbժG. 7x@1+*z_4fvNeSa z:{Uigi *&DMDޓ1V`W 9쿧Y!;aʯAnY8geVMm / -Au2ؘćc -FUMA:s6v-`Eo]VЛnTǩv-$#rXE_(e3v){/Zq A/'f ˗p6oVG, 8n>q6#ZaݴU1*]MV V+R;z^UĮPUMaf uۙRR;11oЖ?hEq#@o^bD,GM>ޡ -H*idC|"RQ}R+1 .>n)BϺ)S|aشf1WG14SnE%U n])0oRj. 41a 4ffotoFؙ's:_k/s)g#e]6E1i$m d-dN8n\崙PKzi=q|zH9UǑ2PD3cT-ca|K@oB@kԺ26GFɳKDy∹{t^Elը*W.h1*!&58D qwW:*LT: y j?dк׽QiMD9ENW*ۧcvyc8S&h96]LM1|]D_I.E Zsoq`+6B(|;Y`}WoiJQuqݬW eYZ>nY5ܮ7j豰} OQ+yTaJx uPjݎ(Tnmˊ$m{OOcS^aP+moHןRIϽYFlf sgkJ*ieJxz%=؋2+:MRn_:T.50pm̻<<],0Tj ׋Q׳Zϖ/BWCҞt3$"ױ-W+%AeSeDȏJM|9D !Y'qcgRnNk:@j`)`3)^H' -9T&a5<y%W㣲*O`oV3e]]; !fP(8r !zVIEB'8KQq'CU>"4ď&TrU4% :>ddS~$OWꚵ7ԉFg?.?VX.<_pKQFLt>*(x7B[ui03)uZw@d7S?<~R{,-J/YE_6E"H\ȥuQ7QE -?hmG(e0L׀%Cs*ȂPJ+qJtTKI&#/Gݽ4uJyԱc7n8n^|YmU]}5ˣbdGFK0 FsTGzzUaLNOe, w=YKv6dzZٛvղCC5Ike sН:͉wٔxuIiOgGݽS*u94ͼc FtO_{C;@PkD~w$\B0cZ(;(ﹴHEM#}Tjڨ.*zu? U5.KKdyR6f i@ -UY6 OQ - ,ltH.}H(ƽڨƑGIQD݈FDťĦ {~E28U@9v>kOz`^йX휊cG$?gw:qLw' -ӉQoUDݍDRyI,7"]svy׸MD7a'!_S -̥zȕ&&o%c c鹒o0G>A48㚨sdy - wSIuu cW G-ӗwaKok>K=ok̑,wiقIa}<[g; #?n}P码;`Пg쎱x!X~ZPms's<#D~u~-umߝR -5?e7.6y`EgD,RG0)䊧J1& 0*GdTFǵ},tQp$9BuIs - zNwP\dY8`GWS Mk읂#?|uI=PomuQI=q!@tQ-9ǣc  tA8={5llE~W!RsbؓDիoʇ.z줁#vjm*eWT儰%8=Kq<gcR??|}BhJ.hF tq2wrFrfR#֬5c]JTni+=L'T^<P{䏻Q1#1K$U\vr[ Ni :٫> Z#PX}ӵfYmqu,|2T%QnG} -r&弨#y£ť_I^IQ֚p/^ -ar /]%DZ=X2?(^wc^}n$Bޱ5[H`}_3bB]q.cgo&!.d LeɃTzHa 2e$N_8p#MB3D2WԑoWuUyժo=i:oQoln..zNJ;|jQ;Af5:#Wi钹ybg6gX݃:ί isEk#ÐS GohosfP;bj64X/J`h1/Eolejfvqm m3BTgET~X0/lPK&cPE+եnCLj+pq8r}8F|#(_dq}rw?Tvk!x{znsT˃lha\岓cS&]ā^AL&LH%Ca]`oӬ~<%G0n:M}Ta =eZ4SݕޫRkDѯҞwF4* ^:%'Ÿ/)cuTv^SgAANQp/>]ӜJPnۊ*]P"H&t޲w$Pi [Ǻ{6G(-^\DfZYtTRݧ1Ơ.IKZX-=~' NKuJ.#PWiƒ48@, xq=h$^ɥh;"uN\&g׫M +zl-;^:dVK]БjeV-EJvL" WޓR2A -iG/oIY>>inyѥa!oZG̘1qjNL`^4Mػ~c{堸FrU/F޵w{ZFM1}[jr>]3<Ԛ0cD2oq"DY%-С(v(;2,݋6 -FO nNmX_)ϛi:jKY"U}< 5 *+dU=XQ:QVEޖξ8X9Y$b(W>ءёB^ꂁQ!T︉#L\_778_](hԈOɵgCL¸gfY$ʮb,HO_ S{3i [%o&UikġL;qh+)\ ~zOk\&U,8!rƭTz;hkA6a [%nJ0d?i|z ͉-ۇߵuZMX|jL\rj&"]Wi`5m c{騫0@즭@yN8o^wc>L1_dI4b\jNKM/pԪ` $PV -6~>"u( ؉9k<~Ë_sg6F`'&uQ/,Us7]e7CҚKFVUdHPlOc ↹1~Q~?Y79#&WO.5ӘwgcwF>RY}4쇙Vlo7BվTs0Bi s֜Lq[:NCl fI}WSZ\zH,7獘-0CzmnК< -zZG-@g0%xuG;.\ӊ6hZ42@S|W67JW6Ō+Ú uzJB 7ES͛6D@;DϰH0g^{bbF9A6w} ^pUL;ŤC`GżհagKւ]UPz/a.Ժ*yTRxwԐ5·)ɾPO4~^|3ʘW7'{0BbbR)nhHW C=_3d8a!tsu ,ut->Sh߉-4BG,Z` ViL u]Uw &_S,чQ|IyD{ײTWPW@u6^8 yo4[ik-_ЖͪGtg_&-08;A;b%Wy-Yo{Xuꦌ #du/̻9adh8qGnL\՟ˢᅾF\bd5TG߱ ZDⴺVq0QF\&[ы.\}d]V===q6[S/؟{iTxǁH|5+vm^Tޚ*G zx¢y #՛6hTO%-Ͷ_2b tmшz?jN0uͱSsҒgYc3K );4\6sÈXozahM@ۑ#'3jTmK[q.c -۰vؼ *mM - &fď}'PAܟh_GivM1 L/v {t( 1߮}ӛ渨段!a[ q̈́شcsv|E32C5Ln;śfxʁ55.n']‚, |]/$w|ɲ0 ٢xUSt0Gٚ?+ 1nԚR4<6>n%>`e ަG}5uW˃qIӓIy˳ `!!O;3N91}s5++Où}5q*`?HC]l/ⒺƦ}9a旻v*h-kFxRDЋy%W5wB -nhU ,i[垷⒎"~1aNg74&e>hڹjݮxCߒ.}eSύ2NMˮXeKּE=o Av5mӋ+:H}I;o;}/_OLžSzf!,A0eXèO~t鼺\k!UrvjcW55«ޚG@ICKƗGH߂,k۵te/6Lw[ÇDղ*nZQqsA@? -|M)p\D q">`Emݳ/FM1i{>R`Sζ>q<"ajN&o3b0ڿŠW O7,$LjƩ%37hAI[AiQqŕ~-#hm:h|k"1)z`]uV&{+/^}v1`+jh}Fl9y`x[ҖęG_<øU-Ч;~nAԳ.*=ujboxAl_cwʇSS‚K*~|ꄴަvIkNYշ$j!2Ѝ Iu-{Z1ucq7pgэU=;,cOJnRO='u\H=饧e^ZU}O:ˆOyDXxx[㤲0#~諟{P]!7Lm HL|z:~yjV *9KN҉_djVhꄤʺ'v^]R^_dNZA_ے)`T@|AU8WqoCWQ,ڪ/ SklQ -tVDŽ:3@8 뽢c (~DPkKۑ_Ga%~ %LgO{A;snj[[4'Ы^ɍ)ku/|ĔsD -B/&a tgI}] pxWyUѭX(d@}_ߣ (a?N#{?7Dȧ8jߏ:" -c@_ȢSF(OC͂+Fe^v\m2m\6X8 L=cŽyEən慨WV^ KDqjT’ -g{o[#Ƅ-Awl?݌= dm4Go+KaVi'4[tAmxmi~:~S{?'j-~i۱ج鹗wƆNeIQusJ Q.7;b#Tl'W^D<'w'76(r([Cm &{o -g|uֵͯԷ'Fx}b$xY7 -^gj8fdVuUҪ_}bɆQ!^ q_=܏MoW aY)9$鷿ClƗ9V7v ǧ2.YϫwGmoX | Liw~е$8S4;PNd8߀vo[ߛ^pߜP# ϯfZ%W_;Pk_0r2NYgt ю[ϣ Վ8뢑z.վ^@^hv[җiJx)vq@/8ZKg.mnLر7 +ܰ6%x9Y&@$~00Yzͻ 3򹕚}:gNZ_[zYR>;Oƻ$T2(񾦌.ty?;tѢqO{ֽ!Q G#VX>x1TEW_z wo=>i}+䜰P*o-ixܴ[z*f6!${Uw܂;6TnMs`oIj3nC_6̀ϱr q3x))?ry;j|هH)ȯj2~]'׾䨍uzR,f]WC7]̳aq >xw}±cb$=魎4m;CmEFX֖.h952ɀ˿Q4xH[ڧnzI2aJKjΫ^礝3Ǖg7#Е]8+CmmjD¢K@ -qX[vtr5YQܞSޜV>06怸lNJ}S!A`Gٽ`gѵqmfNJ.SntW<뮍Uߟ^^槕< - ~|БnnU'5,πm_R7EXz(kImEڰ`r3')j_`SN|R_-pE|ۋ;:sbKU1vJ%-7-y^L|~zoV6Ԗ3OJߞrEiX9"bÆH;kg{J*W,5ݝwI?r斵)P5{4 -<@܊ż(mcZ7$;!;H*ieTR#m%uчFYw~C<\4i= VZͼ&(-8MIL.8;#ozL(9g>Z_EY\7:rτE'@7tDGŽבGS ˫ OLwk&\Obp+:3&.n$.M5ş GM3:xYQɽ M󍁺k8^}!NE򖏆XСإW<‡AIy\_e̖cx0 `9%8D{An "y};#g|U[͵ћch}[PcS9[Siyi-hr} ѻL.g|3] -@[g, 4LTߙW5?^!S>cؚ8]h\|,qRV~m.ϐ@r/Y)U 1;fLWuɂu -.ΪZӖMmnf!\!|TqQ7eeKҮRn;)ڲ*|章|w]H|ļ6EDu OoԤ@Wțvƺ&(AZR$f^YysFQrk"ȋM iRli^^ysJZq7=kIDX~n׆奟 -u] -ή6֧ PQ~e󋎆w' -{ði{@7f5{jڄU7j?<ژz_lWh^ЛowR}l53$ߜzܒG=sKɓ'>Voz .Iʦ'3gC<;XNxP'I!EEk/ 'b֕>]Sڢ6YpҸf$EyUcdd{HJ==]ro+*cD1lÊ]Sߙ\>++fh|}!,D}9>BGo[aS7ooYi[|0QprQ M{ C̐Ԡ HgalXQhF(12!Gx?gD̓@2$̊!+w? kFA_Sm?hkx@s܊ef}70MqNDg7lJ*Ya}t3+ qj0;ܶq=t7DqSȌM,~O -v^_S[S\TOP~.=,_l] O3aIھS ,[2c_Giy㳯>lD,ǬsuD]=Q{_mevu*W]'9 P9D693rBH 2BY`Wu/f]f^Zú %q}OIjvHi_@LKf!򄢵1v_g (Nyȑ6WsC@̚ieG׳[kNP3fFݎ-_|GI˄ ﳥwY6dGٶӳu6ƪ -*zg/(%߃-̨םZyߛަ)L⻆qag ?m -+ko~iyۆkko!N+>l6wIx33“[!-`~u#!׀iw؊SܛKC@GNA\^t2󽳼z[#^wNr#!)>9c~QM 'Zxp Wj^`fiI 7Oawb!rR!ǨEYf[ʩJ̡c|T%#׭_|\{\ߕYA^c^\gU9ȷĞD*\lf@l!0+~JVT#@Ԓj(F}k5*zEkbP6j뇝 +-uO~f~붧eug!SxOkX-Z13*}_q(|x1&!.YxA>a-9K ?3)<=Y\7gs -HvQb"ki(W۝'W,wˠ_;6юE71a>:s뺓`'E;(yY5C+XU.ȺO}ёREwܐK(BDD릋K'k϶~ГA%1E-t}'_6+vwӣwt6:)~{^rw7/^|=-(:`W+/sGʩYy:rWN* -hMa#95CkKnj%_7%E>sc1ˀmN="չMȈ.Ĝ_D]3=-j{ޏagMBj!ΫlS qs{k~Χ?@_2cv=ޘU旰d8 jkq.b㶧q) 0h͐RQp ^)" 9_98êN3#ZY~w:៥&Y렞K *8ʯU}e\F^2j8Wy"@7G9k~6 E_NQ}3ǘ1){p7ozdݭ^ΈCt֐l˫!lԊI Tt -,)6KbnاiAm }RbxO_}ӘUa(Ј >vE͐M-JFMBdlP}]K<9AxIKl[|2%fmQ핥a~rpI[T|Cx"n]QJbMܽcoOA?Tu&U旐S{]=yeskescz4SkOכ=?؆ENI f}[5.vO&L -Bn\C*K}QRͯ'-jYG>-4èQ8ZL3; ->]C]1*T܇W"II!GN{=ȅOn 'ugO驕9!ov ,pIӢcn))?!*4`T:')гOʎ[3>̐AMG2&tNӋ|2ZIXŅ:'A8☢'pqm+&2.D r|iw'{> -k;;f 4 )?4C `=蛖~b~Ls"Y{kZ~Uw/m^H bPVzNl֟z'4B/>1M+:XbF.;'~yeqCFkup3s.=aӄpU6+z±]}r>:*V}tC1 9[tRb-ܽ'>Z[B/[Q3!MLT@5_0 hI~/>1ݯik# +h|xD;k#:B[^Ռ?W=!Xkms@iۦin$bi}27h5&) ?qm ܸE Zӧ%W/6]jHE6BJOS \ZfcdAgSc<@U}T(cC;o`o !Ah8㟬?"ogH~gz<RQK\R\mےv\@v_lF.g 3JRJ8[乕T+?u]ъ)b I蹟#f}Ay(9[VSгVs_`yW ⢵pgc~>V7 5W5%Y3/6HH -J_iIؕBL;ѩCm=u?J[r?~aSvXrNPsT_2??5j~U:VG/6Ǜ%t2c}6%č"CN*W?6B+)M^ :tOSJ  >īNI ȅLiKo!a -Tޢ ˘-?fzbd՛_( ݫhw>Y~t=t]ʗu7~PFA-5k5%gGZ7'Xۀgf&fT}N?^}mׇً/g %ǦX ?Ȉ1Cxc oxy+,#:@,|#;Cb zi^g~3Nl'[17U<>Ni)Q\ƷTuG䭑1E8.{}yt{ŗv)Fg'L/A}C/NP?W'i -A%lr%GeZ'7S#m遝eD"f@Ko-+~0>)v{Qֵ Yum#tQ/qz 'tsUZz2({EG4j$Eubn@ѹ8, R:13Vlm)fAsƽ%qK޵ -4ɶ ZUPN-25ЃMMɶqBh+lu>a}yk\XknS':k}y>G5!$)sIz6ߕ1vlSbL8ЕƟ KJO:EĜˣL}G=`<#_zӐЪ7Ǹeۓ򠚇rJI /L6^)AN^ݹ輰`D&)ƘҴ},6FvM.(:b:= O6>)b`emy)Z3#U_!F"Z(AD`K]K,>8+-ŕF -C4<ϧ[G}@3uI)omCd<;C,͉1GAq w 7^sC>.fj^踷.ԯ s>-Z,=M xătįЭA7'9>ۣx5|0>3h}e/E\ZvZ䈑 =XYԈ6 "B~n \|!<Ր#֝eq{dK̀tgY*b:9 1LZx]]z?aVtQ}3)alPӷ)Yq5h Y_jstN@NZ饥/j<R2 &%E5jMПcZ, QL䄼⨜T3p7/` :;z!1fCZbk_p߯[lX dȻzzhŀsLҦ[iK1 kq0r:\M>6cjl}V[Ljk݌ -A F5Ċw5g#&=xaU}"g;^-=@Jtoݣࢗ!UgzZSB*|jPI*v[F(?k?"٣5xul^|EbS oI~CݕcmmϽ<*j(W|_);$ -dE uwWʎo孕Y/{*Sl Vofw<+}gA0+PW+OWx)*o_/@c5BtI5Y>#~[wgLp?nbvW:k4[\hc~;il[GH5{Q&#F&2y̹ş?I)XŧZvZ:$&Gk/!߇\V(#9g^q2LSNuP jnS԰a^%Qvt]#%aC̯H@3w,6ɥ M/N.\ j9bB[. (NsXE)8"5*kd|G_ÅyUr(_K[nn`|9ŨP?AN@oLמhӼ%eȻj~_s,hyobBBXť|NbBDG?lv/rtF_CUB{VuJٕC~FJbnqCҊZniy}y5 4z}p=bQnYrgWi'l:kWN jǑBȔޚsIl_oZA]Oî80z>qoV0{I1JRGEǼ!+"Wuͤ(8)j^g1R-rlZ@C.*)96=` sΎ-lƅ\m -v)EܰO S|4a`U%z[ʩIP)n#OŵbbדArRA.d "X3[@;\ h<42B, -y!-vL4\ h(;sC /jHhhd}{ s>s!k*K)E(Ud:1a= vPCuOsmm-%6jz«8(ݭRRL -̐fJ>کla>{. -"L}F KRw+V{p*] ݲNҋF'l`v"crz&WiLgy;E4ut{]+ F寛v-<켽vqYe`E/+ [_ -Be4ECu@4)M`LYe-b.ۤj-ku-tZLt* R!#w}_nF ,Ї.T51.rL km8%1S}z>e~^.D֜wu FmcDlD̺-;I[D\\z99BI#ZvH3vEu:_wN֕sjlѴ0!k[gs'fn4\j );!A׃w͌S}2Bm@uθrKJ@/yԸϲ*d1tt[#~dsgE2[•n ~t+XJ6MlrsѤ[L_酞ZD]->t)5~ ʯȓxq,%dƌlԮOݱp!Bf?AFxmbq 03`MM0'A< -З5օbSX4jj{8|V ֧ybPo8 >Mb .$2/fG.=˯w -ƹe85{]2@=oHi$JȄM^EէjX$u|sݴ`|)m[u@GU;GŜМX4!yg.bnA zf9^.煟[ |c);<3*uϰ+! pumg~9 eD"R׳\܈QHI`7lS5J$1\uԟqșٸ1ũZuR+3=#$l 7^X|8xoq+4HOLs}r11fښ g>W^9I%pvuߥjclOuBѹ g*RYXKGp(~ dcm_lQR -Rq@IZ!Xu*_P -:VIĈVNŭ1J[&@bb]i1<}V|9XONs)^9lw^x`+ja*V Jvr1+zgȹ>|X9-lͮY|[J/ږVїl xv:Q -ș˽3~)(njo[Xv)6I(y0g^A\24XUp:9ʪu?xXVZ~qĀX `G_j 8dUuhwGwKǪvL@o ]vϠ v@ jA-3h{@+4}{â/\pI(^8K.j]Oj -+H%)>=8/>mulR>se̋/#ujpy֡Km6jɣN% -7'|XLmUPt|6:@yt<ܘ]h恞O->OA.P^8N.@۪W?ŗD -uv){&y\=_Czf}9NNߞ,ܯAۇM69,h9зj\o_ \l("# { -lmr)& \G.Y)7n ֟͑(rCH£.1r[ƫwrjo|ԮDg]'D@D(+YV%qjKE#~iYZ81SFlݘ[bڈr*:-rX6f85+[iZ{y!$V1+@5bcQ9N\ !e4:BRaQ ۪= =Rՠ - -&2jbA I1*3x+c@2vmP߯?xĥm)(bqK]V.<=FBDZꃟ'&vMk㠎GKPIo&YVrZxS}p;z!q#_ޯ2fj?%316KW3o -A7.6dz RQHΰ4%QC{bC z.~gv;dE% ,tnd[&<|oP.A÷3*QhA@_Խ5qw"`v,|KYujYR޲7]XSvD|.0aL=-DB\TO1B|u{-aas86cջt4恉OO?lcTRK/r0a-&#itz؇sԒJuϒr-q΀> !Dgβ_6\dD E&<码΃m˅pTc^mEGYBsR7e͈F8!S4˛ӫ೐>]3ek^5étv̭|е2쓨Ƨߺ}3%niϰ=6Q`x>[{pbᐰJ1-aJ,!okq{s}:Ky %g-^kTsC*\_uJ)bG;[\RrWʪt5iza`? 0(`l;,j>1%FͿ_K3b{=3,ˆR-<ؚv:8/amÈi|^@C,in¯nmZm_,E9#Cjre@Ex؝cqKK[H dT|LD'Gq+%k :$(`ڦԘBL -&"f.=`$W.˯#3ܳ+=t?}fy\zNj<䘦o̿qmSˁ9ȩܯx9:7\}Aݒㆫo=V4 - !3e ; .5E0v/<ڇ%66f","!z1(gtXHŬX9..fՆt*b@CyU1-ݳ3]#59me BҐ`LiIXφUl,̢RYo~V~;RLۘAu 9LD؀/veFf$dt['@>ڽ;I_&oO:]/>:k ڄ@OblNK.9>ww$/wF-K׳`BZZk/)^z_h]n_v:EbAdG/pi#=o n6]8qNcSԺGe޿6ܘ]j,SRzinYOl[*g Ӹ8")e4&c@86<ܘecƖ]!1?!80/y&!d 4[kjT->X/WĢ.o䗢oԈQ" #:NcpήYH5h= W}jvW)\l'=zjO -iXuQ=cQ ߍ^#oax,J5évM - cӒl`_cۡYfypj|GY"fԧQ6Jګa;6qKNZxWJ_7Oրޚm^ݒ0u&Kȩ?4=#VӠ TrRKF)M Blg¬?ƩY19[cqqF!!} -jufn Jl6t|d2,zWzJOڐR`+1+6%Vȹ~mY{ݏ?E[yrվE hEm)ħl!z]l5OZQe_\5uFMݥfc2ifBt.IijE|קb'Dtt_<ӚZ>EcF^@*ha}0bhm[jnji@n|1s~hbZF_PhMa bsz5Mr߯լ ԝ\-yk -|lݙ~vv;A,E}kWWr⹓FȋQ;zZCX$G設 uYԱaI˫3 -z\N=#p`n[|vBo Â;S"<҇yA%_*YZ⛁^@.n .g!-òaYk 2Jh]79&mA]a$U{1lRoÍQlV|O5\[ٖX[*h;)V9?0ExW{A.vl䎑OYl -j[hv>kcw[쑠n%[.)*{kRI^M+':*ص4s0B1.C2QrCKqeq7j2L‹/ -kh>M39˫1-=SI>ei |@s8]<dXٝ'g E.)/gCB@snPG;%⯧y=(l`#:ccSaկ&%{$MsX3 -)P{vZ7t曙YbcR`qJ}sVn5!o[x5 yVS,d5WΪH)N >ӫΗՇ69ҫUF lLF:1WtKoM}wN-.giͮK#o\b@mW1 -1sۯ"9dTUP#S,5'ۧ׀gvJ1K\$U%`M([x1[3Zgj#Jf/f[R[yz[F:Ӱ9Jݯjv9,=05vM:hIxRTǁČvOjX\5A^2=gʯklo"z6tM =;!֝#fH9>{Ȅy3/ T ܳSՃ0.)`i@i9]">&!lp<+Vۧ.0JܺxmGEkѧԫr@o~5`;hXV9fuAm3# #8x4"5b8lzp1a"'YeRѫ.^>;r/f 5LՉ<X,!lM*6pW~r,f[{Us6n Xp\hƧR -<3glèYFENTU cĴ>TfӝP}@lM$ )90(Rw46p~o_`*tWN,2P{p7ׇWkzwٵ09zI䭨YhЭ 5VPF*1Sanքm>=fSQJ><y۴4j?$5I,Xf^՟^l<u!lfOT9L1~Yo :.-fbc2-؞PïmϠR[5 ,h]RbBEXG(̱n#5QŞ|'ynVއ ]qcևf9s,ԇE!ko9ZQ6 c榔] @}cgWHά )%>&Rr˟>-<Tf>i=fˋ?JjǴ}# gn/|? sĤឡTژ 3~t~3CݙwDn̹wr Urms얉P)>mGtb$hΞE([wxT>= 4LrOkzE[^Lj,]q'xgH;seY"x@Mߖ2Z)눨O[] +Yuum=B1mS"?j ȫ|Xa|ؤfj}qڏaVdwRf-*^ْulM[~y;ZYuFZUHp9 9!nyeҀZuyW[ TZ 9J<P,33_ٻ&!="lXzm#0݊ (m31RZYT:+kiBWƫrJ8X հA1NJ.u52ǀYe!e\H|pX`9Ɨڼ3F1șsl#T(+o%OKW iJkaK窐£A=KBvN\!Z &+뿙ZJ[hm )[RBb4)8OXok~ucp98v~7\ozԢDk9M˶o_e<<2't)E><:'=Xm b4);"s<v.l -K:_+"e1)tuԇZp0̔_a}!sV|ԃJ -dN@@_mbyϖ5:6_7-9,1~IlK8;]۝/3_V[ )gOZǥN2i}Qr*߃޷g& )wQjWk갊ڟMƟ1u=6)-mpkk?Y]3ң:oԹ+!;KY)?n:3*bѰjs=s=KףOԟ:9>6jc?5s0|ʓ?hf`zjcoE'/~g|힁IŀcNYj~rIP΀o~07 -ru - - q30jjp͡ lhܺ赠UP Ґt?,,13\ -8p.(qK@O/rM.V|pfwұ[2#Y|~?4cs)EߌZ1{#[ac[zKOٔ1 =W#ntxLr/(]=˃!E%hwYLݝֺ^/ a'EnOk6F_ltSm}u5 z98Vc}+=pA :*keW'aٿ"&·I%@;Kٛc7(Y~:3j.Zy[8' ^Mobw+;rّ#͎9lva#G9rȑfG6;rّ#͎9lva#G9rȑfG6;rّ#͎9lva#G9rȑfG6;rّ#͎9lva#G9rȑfG6;rّ#͎9lva#G9rȑfG6;rّ#͎9lva#G9rȑfG6;rّ#͎9l7MO'Oұ9(. t2:lBq8MKln %1(Ķ\;~ -?/>^uM"`c5Eŝ9~>;>,6C@qskn?]Kh86ۏ_rǗg~AL?$("lO|8q,x#.$'ߺ~xY]I\viCq| o%~ݍWno:~rF{7%?oq]gYsL߾3۶lْ%+(sAd"gT9A0 *焜+UPǼԩy~>`Õ_:?A\]ބ܂S&fVqC%nZɼc]99k%iqk}:1˿vU'1^[Pw&T-nM6ߊʗ_oef8r{9;q wkYknխK̪[˻㌣ IdZtӴ.t饠d㍤q[s]i.;ǺBrs]X{ §UP -J6t%A(Mނ:"2#E4H[֩ w9=3hZy:5 U[іøUziYK[m;Ӎl 7\{YYj(|JҮdYsYר$My;ӪvwtnQ}ާ‹C]M\K j.5+5_nt+ 5w/Szs9>=+A]5* +9 T -Vx՜y~Et;̡ff -V&"Zmaiku -+zDHG " *U ܒy%k#νF.fڇ-Df"l2^ܦHЧ@>!zoSgO͇,k'n|X+'gVqRs@M<#:M!fAYc>Nu;rLsoT<q}23k  XH}j.k)B~M\1:1=koY'R3J56HQ#ceOϳ%Kҍy,Lۏcyw0!aErAT)ZY;vמ53~8=qR6ug!k5W毠P39vtvVsr.E;0Ny"ŸGE('m&}|P*FgP@ I26ycjV^;m_bq|U姁ϙ*~x!fqbwvUW>|Q%6:Z6Չ3|*:(^n9,69%WF#ޟLcETP-DԂ8 #^ \K9I55R^q}/I4ҧ~ ZP^۳vDX#j1IsР52H||\EF ||> -5WJzy&dÜꌧD~> 9(hN)|_ -ksY >._%;Z'6iԥfzAjɈG}24 - OԼWuJ3y{>!B¯2?W|X#jcʎlB:}3~it[Su_nO7|s/G^5c|cO]k|y>za㧙i|P+:w~NS 4VB]o'Re[-i+keK-jXSHgE3#M5Ƀ1MqK ^q`_ϴY{ RƭmL -.-=mfk2=͉ KY٭7*u"kWw%mk;-vG!V*(nŜ zԞn6Pw !G/|GX8eSс]ӕ4`v w[;_8NNGwN&pO`s܋;cu_^⋆w?B85hg(7ru"u19Y=2-m=Jjh!G!X GC1Z4 P1S)J9ǹ_/ë}d܄QMf(n?;N%l ֣ ܧbcY+5~v F1VYv^X_B{sn3m6f:+mC]ʎ|`$*\\{DݖO2*,D]dXF}]$ oٜXsUG:ĥh-E {~e3T3`^T>4Rvn6"^~Mſ5v4xݷҵW]Sy!f#m56^u9Z'oۘ]ިsbRV򖴓_g#>N̺e1o'p䔴ՠ 2I<̯^9d®}6i橸E?=26i--ŰYG2(g>Tk}%ر -j-Ř+63Lޅz-ktPz@j:Ku_ȇ|Ȩ={9ӌ[Pv +ѠTD# {VL EݲQ4|z6jS;Tdh*.E1!|6ҧ^5*@@`#Nq513Q:e^U)oKdP#Gzb+{+E ԲJA,jH2Q^><8n|Lqќ9,}5aP}2]-heeXg 9*5D!*3Rאzsū?3AUH4咷P>Aufh|ڽ6m?gPv^T)ҳ_/?[!.)߅Bx4\Kq.ck>:\pw9k[c_ khdǑx\M> ѶWғ驮Y,|bg-,0/ -2%S3m0 )+$Σ wKw!i^Xډ Yy㳜9,۶u_ne_6aez}nkKN<|{o5}, ZEA3l]*#nu, >ߙ4ܔWCA0;]:u~E%#>"_$NýYlwRXZѐ HZ~Q3+Vqs\Ȅ>4 _]J9e)蕤u7ct/MŨFb_EN"}O0{+Z놁 -IZ.y4!0h0F `w qq}"!V9멨_#<M>f0SK:? -?%B~ƁB_W? 's^`Aݙ[ zZ)ڦUy̘3g!d]Z^)m$u\O4a>iA:Y{s/OJ3q,nխϩꬷU9bS6glg\t>+˝QٽN5-3-*_kawlikdJאN z-0)q>-ZK^+[ wᖃ{^Y;6`pc-mONӟ!>-9CYm?l (#8dxt,=/(ٝdONNa6!.YA)KPqs{+(H~wUޱҩQ.e0 c"}.,dD#B2ފPXܦ%h^+,juDDΤ}foHn2hԒTz%7?-cW(w+a+>8gIM+u昱 B~=v{rʛ332_MAxW6&;]$}fNݚTs%WRUTA,6ߴ,ύw ILN[[:"t3Gn Nzy:5 r8d܌3$m1'5'(YGť@a% - -֦ uu)a gu*mìZ&$@j{HׄC- \z аq9*?w1ZwV߲"N= -Vj5ԭQ 6dDz-V ?\Gs^v \+/bP/_c -Aa[]JD50|l,Iz-/*Ҡ *^"*!6g+,Ieu_Fp|D&B*"i#Cr&w Z"tsL@MfST䭄פ/0N''ÄW7铢9D@G-7323$x?OMǤ TH{ -0`TR`|ϢVTO'Olq=bcTV.(nޞ]UUgUdd8 p؛xs);1VHF2bF:6k0w٧w G4lnZ^ҳf~|Vۺ5-؅Zxr`wytgHhߨO 6Ǜ_i=\F5E "Vua7U+c\.X)ilAݱ1C[C]Vn}~kGWk\-|_֣# ^QlN.c^y^Lڇ:uUߗH8o2 i`0J dfɈ]itkǔlNۥ;6d0ԯd,NbgDTY`V Z칿O-Y]{s 0pbdu>Os@֦jϊ -ASwڡoM+[2iݱt{k 4Ibs{~wq/A5鉀VbO6e+I.eyu3)^ #ޟ:o6 ]Hn戬43u cCzԜO~]Ib 4`-J=)IԂkMב&VwN!sKy/v`.Yp'Oj%-i1+Ϯ}4\QQ#֞6}Wu >stream -OwF1?AKpv/ «k>MqJ7fG~GZo`W8mqwVRqdgv^sF)ToO5>.=+f'Š͗G5rk92y81qdY't~(>펋/UDP elBϨS$G+k(F"#dx9E{ a-]0u`{%c?lU|ꤨ4\t"x9WfY $\uҴK'O8] xУ:'ݧ{p [?n&5}xLOAA6QQ5d pwּ6=2.NF KF 1yK_6 ~{o䣽s-K9_ҼW6-J XߣBTgH$;3܋G\痠^IsØ[MB.ߙ[6URԂsy(Y#kY8IbJTu8 (ywn= ̩aÜ]P_7bITҌCZ 1k7 U{֦cty):k:.k託Kkq;dѥ'ߤW^hx1բǐ, w [9mSڜ}fl1Lŵ9ŠDOOͷE';w3S1 AzW1hfʻ X͊܂YVfYi4hM/ZHØPA#pq^A-h_8Œ(Ϲ4"}/ , \4yN@g5½pmԣ`AwS!bKՙ:oT^A7Gn#oZ2 JԮZj):#P;v)Ĵ붠qWr"Ɉ@vHv9A8LʡbƸIMDAv%Ј^y{**_fٝT7њI-_ ћ  F:_Pլa^zrF- zx>S>]esy?B\9Qxo\*ү`jp~$b4xx 齇,>.ҙ-dhcPE'Y* F@k"޴]͸ahwɷSȂꈅ@v9MJL<sj٩yq<0OYjV|c[8WgԜ2hJ)jWFҪ_Zů0 ()3!tĜ:mT%'8' `켬w4oOt=jtqljCIcC:}o61+JO[_.{Pg9gdOnrN^ g]&e7@>E aAIi'c^JW;Ee?@\bD[܈0#c}q`94lЦJ[QeU~,v%DBFJy-:Q)b|3R ?s <sz2/6XϝZËx_CxE-pߣ˨ص՘hB^_6jRKЀt.a\woWK֯OSK;DHKs}P{s?\\Ҫɨq*KTT%urԛsǠ@<%ԛރym۳̳ =9IiYf^ z 5 ~[_(`e(vY]1QJԫf{!)3GB=X2>yQ94w;s*zhWcQy?lFm -.,ـmL՗ђSo!Sybva wݨ[q+K?JNAorNH1Tsc*,j¼syH"1RPI9=5!vegU-_C9Դv2V[tu>3~$J6}u)r6Q%i#KPkOTOCioo;p/;M@}J&啶Z t`m -{z^X΢Ǿ6GD͸Urrfz%2}C1W!/ZAz#鹓 hɀ^bZM.*!f"( C[T؃WDr^ly,bURܜB=V!JQ {Kn1Ar#z=coI_V)neKP+xܛ (hH y#`oAtJFXV{ W/ ևUP.O_KK9@ƴdH[2A遷dY^.BCY/t{v׺k.3et}O܄~I^jO'ASqV޴ -j(/c&;Ͻ:u -ʨ h~`Nx5m0[&Fdۑo-5jAbpnq@ jOc5^mާcnѵd+Bªz#(C0ߓq]3WޕK{[ɂyvɁ1I绘}?ǔB2,lʺAְӳ촶33'g !ZHu"9cgרNLq/%'xW)F\ i[Tk;n9H5^ui_<< jEb`@fyFJ'^ރW1l00ȿ~Y;XgqQ($=bDuY|[rk_W%윲M& -yQ+Svunwtg=&dK$8V H<;pL$"Vrnq Sr -1CH-JHHPKƤL|Q58@O-vW߼[/ȨFTB-IjyDPҞ!𯭍wO.Kc>_RXXډ8uـxc2" wBA}AץzcӪ!>r;@%j>]y=Ei|tib|'`~ 0r~搳Iw^c}prNTKO|D]F5kM-)6ֹ)%> m5+2sԄ*7-œPS vfX'3njqiͤ#(,_T4jf.A|ϸWJC$Bz5C->_dF<"b4A-krۤ+П?V25 GAJC+bؽժa%Lw= GQ^Fjx5W /1˻\,lӚX)8ybۻrǪz -"63ٮ+Hm2CZezup"hb1T(\g%<"&"i;9|`>j]q9Xg«QZlħW$vΧb]WѾ7o͉+`l R~% hŘZBΌ֬ -Mv-} , S$}~xJzCnԃ+)Л NŰ(y+JIqI!zGߛ^֨XP+ =5#VQK$x$'2祵=wk ߣspgҢp]XDo!a3, cV43E z,UҶO%cvqƌ6GF鵷Xqr}(xL$! f1$lrn ɻ"¦cwsn2?~ŐҠ;ۓSi|PVh0_ -l@'ρqzK`s)`Y̭6ĭD|: 1I <~%9#c۪8"Q!t7ɘ^@6FNƞϠ:5GAWۿki3#,wg -ԥ|)kO@Xl9]F~ԽuQWݏŘU 5MVu }[0'9s[D5]RW.2-k3Q>NR;^L%˸ؗ==L^L**d!w\5Ɖh-2,ݏdL!YhvkJM93t{& -h.pY!ϯ`!soЅa OtGq.mc^B=wEu0 4B~~tRai;7at>jTy(u=9DT+l*zn=Ibx/wP~bD G{+7f ob_#^Q 7b>Q#hV}ܮၞ;`8  -+y)9>>(ީ#9qYv)|pk>ܼr#i]fC.EKZOy9ymfAB5*-;/NL}˲VQYzw!9=fʫ6ƅYGs6΅{1 uuwg8g<?=d{~ޡ!N<s36֙\Q#I-*S҂K/|Y;!O $ GObTDʎԬKjInwr*ink _z#Vgf;" -AfߋZnQÇc?bT λ] M'$L k9;*5ѽj3Ҋ *CJv+o%` `o~^.,uEGE7TSY&ݐp( (؅[q"1 32 8dRܧgl yE8Cy,\&\KL1,.Y\}V1'.ְ3vQxCo'gXgH@/'Pq=~TNgOهSS3y(# ,zҡ,d..qm:k+&'xqgI9zm6أOt~#2/\͉#룝VAIν8e)1Ѓ'ƅIwQ+Dvd48_lIٕgssl}e#<\}?kPphYUcvNռVyMcmVٌ{qkWzsV2~bz9Vvr״G! ҜUx>Sis(E\fub^V8Sњ]Lk6A(xrIfA\]!_J>p5;c]w6v!CR^5Y5!2t^P9oFt%;'̨SӚV̡Dlʖ ٝcY+b>`" j̩l?1'4f .5 I^p5m^N9=w9W:0+Oٹ%S_N)%^X%}*aYW-Y{e!Sgҳ6^wX/@Ɂ~"6+ψK#So8dzZF|\p9XxyFA8-ͬ^y)s'5-;/ǧ~OLY&N_ߝP7>-WAN?}~nUc1ѹbaƿ@It,=zI\/B/Yi}WrVs՞_f^9s.Ug~~Jt%=- -|:5/6_6}>3q`-s?ן7~_t+Yy^=?mP:7nhBMnM9;ӊk_o7}϶2~ʻg3R+o#}*V֦h kJ^ExŘN l+Ammji+Oھy<#a蓖1O0lCRj?=-x?V TPB$hX 91uh hf^ =CmN۵n93ŹDk<z# 4S 7o4~h3U~Lt_"j?̀w$ -J?WDSf_cܻOvG?%&ggȠNq$GjZRNg]";>_~~Ћ>5U]\|;sh=Ʒ0!W_&e+;#k/:lxy_C/cmƘ&kv&gx'h&xMvy27:x/믘?$'[o?:~y`x7;yt"V^4|8x|y,}]JM Jt9kfwбB|fw":ӎo5}`͟6B?JL^9ZP*m<nkNש)q5IS͗-_.=}^ow_Ê_/xǃCn|]`iL˪qe3/~^gOv|Rx_5_JRo+Gc8CCM|\5m?iapf_fg~\|E`췁._ǍN~:Dv&z_olzy뗁M3qtN/JO*˛#_~\yMX{e[#q gn}X|&?['EPOoG7^3oۮġ6?m<>zM{wnMS¥2k\\+ivcoC?ഝ)ooݟ&$%2̽/9卲?"xVZ^JLdy`x7vK|u^hr5brwF$%qɕgj8/UWo6KtOT;G_9uZJ]EJ%HwW"%$$8AcDph{|g_ - X={_?L-m@\zwٱR`S;1? bR򱦲$&ikߌ5R| -ٝfg{!7֚ӜNa?Pa!4?,ԁr5lzOZk}\Uq2IHQ~~re>3< <5 g4e}5%>p:EhE="3~4 -)t]Kr=.}0S,^MuS?<|3w[B)$ݚf>"o#oÝ.6WPښ)ՂG{ㄨJnn\SGQ]0)vXi"7+(ڢ 꾮:W -n'EȘ{!_o7 -?j+^ 2tr:re?ä. 9?.7r}丵ie%}E_tmYgf*WplV'cjSW -^S;< !~nG.Ղ'I)S_46Kyä9 -`0m 8ל(Bm ^#QBs2=Jx{$ezlYJMYӂeMSB_Ey7[]N.4Gy?WUO_-ÿ(9Yk_¿Nޑ\[|:BJOx"Gܘf_~RlΠRj>t.bR~|XA// bCDU]asv3?(?n8wuͩ/tiM7J!*1&H|3tAxyN/Me7'/'/9+yKWL `v|ѕhDxp[m~D~qD9`u`>Xl/b,5BA}^E t6dOLL`#~g k' Q.8B,5}^o-r|2~k\߃ĸ1b~{"bmk 𧦞x7}Ww&ql ہlɥB­Lߓ2?$*RZN9UQ>Q<2|7þ6[m, -^m-~RNҜZךvsO}u؄yތq<dmu̗㴸S=/;cޣ \3x(#"-]mz4+ E2;MmIpbU>Ǒ -e$\[遄\z.i.ar&NaqzށL;C@ ~z1Ŏ${՞6KV$<_j 7з{٩K+3^Np!o6PYg*g5Wb>a)ITi ?]U^Tt -xx*Be˵{57β(NGї~7Ai-ZϝX¿Z4Zmu%+剶m-/FH611}{E>W$п0[#61oY2,Gm]bCΫLIziv }GeIؽ&X$dm [ҵ>E|)>FDgQX/'m2O,DQlzׁ?N'y{bxc3 !`'=hYFII]!rV'"x%3G$%moNU2;ߖ;`ݨ9;ap>qZ1iijyYl]`spZ's>JwAFX}u !3_N=MNNmkTL0*X #XTR 2`d|?e~4Q<ڑ!\y4 -&(^/{ W*9f ȰqILԱlRҵM@ 0 O{-ݙ)O~@&w#3~sg3&*t&[hK!>w0!rZN/ۅv h&i)Z.QhqIL5A b\WmMŎb!Zܓ*]*pwnž^9 UTH\dnkUl*rkL[~(:C̊7'L{*n* ٗANS5.,)( 9[%p@ϔ04//'~(\U1DF!ˀn+t E>qeghG'xPfpy;BeUx,/+9aDamWpa!l@J}[(uYC5W?FY JnOؿpt鬀arJ;5lނYp񙋡w)z[7@)t^.v3#Fp!Dva gt>(:qjjlz(׻aur ^׌ ~@A;T*C'Q+!K/!'Z;o]}k>G Lc)XO5o;@Me+ˉ99ptFX]]%Lj( ?vs>POهkxrq -o{C+/0AO|0(eV 3ۀڳÎe2PN)&\SzrsƇ\w ;Zkޗ%t%?Ʌ3ٚa.陊vOBxݛz0^z0NLF -&k"sydK͙WZR٤ȟmܸIB}8[rV#%ۃ%> "4f)X-Ʃ%QR=vf{pőzJ~kV).0aAXl擵E~TmBݛ&XG3- z0K̶j(`!E>[p;V0QI.X(>GK?BY  ^Jt9"!&~4.jkL}(,>D삃 jx B}fw -Rv_yg5`iT⾜y2B&YCa^|+໿{ᾛ̿\(oF=';8f1;o87p&V;_t dl~5~QR3516Y;u/-C+9VmuғLzZ/#Ysxi6%3R4|[:?Y!{_8(w&165fS{2Vy I¾{^+ 5\J\EV9P]fLrlIlK5Fu}qa#n($a=Ӈ8R"O}/.D]Ne+=(Ueky2WYy -RtRm:b[4 9w lNT hzW-zi- Ee؄Ùr}Y=P()ޛ`F?8קX'Jc/z]Խ~nװ,^%][M/FOi},M*6 PTGo B~h[<2ܶQћcĂ>dd|aٴ_|pk ҏք-O{ Ҳ8&"'/qv l#yg%(k&(nr N22Q;kW {Qwo y# ]V!Dj(%\ŵ+;b~I\m&}lgD蚙3}̇|]n?Yn>X'ŖIJ,aOYXxI`jyՏ].23MblOVõ[CFW#DK?Y(~QeOAu~kF]pRF`SQyGL.>Tևvs zp*ܣ$.#%**2Z0h-բb4mϕ3'q;RT `Nc2n\ 7$ZQhe߿L}܎M|/fzSt}>v8u<%Z(Kn*~*L%{Enm%%bt5dk7(ׁq_ yRȘU9wI ):-9y}K`ϹVr9l mBXyuj>?':5%f+=Ƿ> pkWk >X4ǹ.)ZaQ p()~owYlخ1H.W„ w*sn{G9ʹt}?:n V%l07>R 0 @>yt_wB߂r=/5CS鉶YN'rmaY C$ztm^QuFvUHdP7@:\@9ޠ@Ώyz }(P/"o7"J?OW>-"'kd3r|)P7۷7|=qy9>=7 -z5`ܷAގ `HN+oznTjƎUR=1-XCz|5/RWP('rqs{lː&52~u|#JZ^1FExzT]RZU`! DX(co}mKzB>;^?m,lGm{$ȵvו1!}Q5|{$,w޼~#0__Q<邰bG:QQ'#UȂ'0Q3?z -| -0@9?}z|+%}u3"kq6zIȪMTE=S?X KO $Og 7o@/ݽv -x׏n_ 3/1+&f4xw[q*ܵQv2Y 8)8@@^rx'&!:Npw\%Y섆d+)*تtcőbeWMPMˈKe1Q҂A^Ggзou'_.tsBL ~؎Nvc^'u8ڷV`'ԀG9>| Ae9j!^j䈫h]tcEi֍JhJdlFpw{砷@y8<C^ptw2cIfQI 47ÌaTaW~;uŹ\__?v=s#(r׫+m=5g{ss܆m% oWBh=pxإ@񞞠(w Н@o3᝻_;sofSK<}0L1n -Q 4j( e#ˏ0OAn=Փ gנpIQk~}4I`QVVQ ]NVJsxbՐ/A_^8_9-A,޻qXC@/@a?.W$\GG^W3{3|ʖ^ -P<;>$:".J/xܜ^n] }>|z eK̴"xŎ MC ;y6*bxV ºIl6 EQF%-ȹJ<@3bd=e 殬`2uZd\(Icm*{!#a X3-XS :6>-.1=9ٱeqݥۃpucՄf&D$ݯ׈bE5=!qY|k.n 9(39 Җ;iQNQ&ƅ.XH~T^{SŸJ 6˥DK-B?M Nupx95,rABuF -*qNmG~2.w. NV|M FMu冢.keWO0Y}) ʋsPbeTN*,/De5mvMM;{3x>S'v5n'ie 0z)bqJ8E91Y_WWƫKpM;+b:!\ԍv/4 ;}I.MSSf)jɻF-1enV[[WFR|z_j9Ғ%nmΪ#au}]lשfVJmnkS,jz][Qiiַ6.Դh1Lu|싼6FgfA/D q-rja@KykCccM,0M(zÕjྶބeUsWG1@?Ѕ%qW@uT%lf<|plGVĪxk%?j*r{"ops 2XS겄o7%vUe: #/3gG'Z -m˜^Q᪸nlS[(UẹE.|Y?O)V 9Y[V&{*[15 vL9ь5ĴaR!dݦ 2z M?gFr0&?봪+ -cXymW]qC?]NKF)6J?iQXfOZQY)ͶJ[$uKd!ب . -E*]x{4K)OJft}x ߮ Jzk6ȪXJEBN3 IS6pF;c5doʎ=b-ӹ eW3K&F)xw0]8PWr,*ή6M -BS!&Dn J~`Bz)+`dj̀uj5ݢX娨AMN,YyOٟn,l[[7UݛZ %ryXIѻ -v9pε|V\ALQ޾TYpE?tE?S \@٧E) ,F|Bb>:evlEA^1 -trEEQ>Zh=Yi;^0腀b/kXi6Q׺a{ -&lum\F&(d?,&/UC4"o#B2jy96~ww?}=\]In3pV;cHLjdRau#~Ɋ{rx母nbMD#8('.zM.Gs<3M1,d%ROmk[a<u8O-ڟ&d&å[_o4M}vEG]cS7uO3KlrrALYj*q7 鳝fJ\#X8>>MͷOr\¡=uwТ8o_`t1NSz9!^/Ǚ'ʦ, ~ǯ^Jܓ #Fq-*bi^4\;8m?P7vڧ-J.z=Vw "`WBIWcյ=Y Tˣ]iu26.G=O 窛L'OF+յGS}%d{+,3 1٥{rzU(9s8YTD"#MC, #m"<&jIX/- kIXj Ζd'|Me}OS]W IrEņ̖OY٩q{4@ ~-cNI!PM-8Y*gY}6VwEWֺߴ0O;_j۝WGڱ:Qm~pxԲuqہPt5,ꏴ>Gz0v%)}{ݟhu!썑Ҏ昘MQZeIC+5&;cj'h`<|\rD,݁ # $c78iud؟&['Qig4bU:mThR纚Q7Kܒb{S䲓e^f0+f%91y<$1PEɶ)q"֤wziQ:wp`۬MԽx~(GgKjUp+F\[N*AQ~=n*acm}abG2݁bo8:u%a XW2l*R4`[+ ,j>iNѶqj.FOrZLkǧ8~ T\Ԟ]jIϲ*i}5;Yè'?o*4Iyl)%*ҪDe!qAy)e,CM2>dnOY΁SMbXFwghu>Zuv<]r$YhQ px?;y}3Yt{%ϵ³yj&g- X8qNU#MMJBG .(BֱZr>_|:{ -5P3XbǞͳ{ΑOfRRB9 -_h -LꉮA)m -{'JB -l+4[cŊF| rpr|K;_2;SIקNgiig`놆?^@$`]?"h5 -ۑ͓@C)<ޟoVu ր%aU%cC*JŞ1BɌ}8_ߛZ]M+>Yi/*pN?:73N25pDӟ)ao? ~lNw\|VnF>3}rϔߚr STE^oI-v6 gPKGD`S㓏Ԅ.{wS?,(ef[G) RjeJŸhC?c3Q i[YS7F01nd4i9;or + m 68AjRt4nU*fgs &HUh‚vDy^m( n~܏E?g խGڪ: 9ϪBi#퀶.aK)E'Uu{w^"Eۃw6_yd`0$(&% lvzпaam.C7\,J>[ g`rpQfT9C5DC/)yfj3:Hp<*>"g+P6 %mF[e3wY,uYI.n8#{2>%%G,MAEWS!6%.psA``ߍnCܟi1o%M"n"eQll#06AZ;Pbt{Ĥ35d~᯹gZ7.Q{5AJѶ&arvwdKOQ LVbfZ$x@c'τV -mGU&9)(%&n}_U'tE,=̡9QPf9& æ)igʚ虻Z{}a&4`wcLk gcCڬJrA퇅p)+b -J7.Zti_@X$ -QߚJ;bR^B7c6Uٟ !de (ul֑P`WcM <| _:7E]*vbE!D7*[ȥjxfB[YhNXye.0V ~^\v@ AR\ 7"om>8SNT4ME/2K6 4i!Ș[mWC/sO $C%zb@Ny8_hXK0B+u p`abDARڝv%qo* %ߟC *:^kpuD?׈n|>ыL\j/:9_.L-`Zl&dwJv_WYU ) 1C;9_,/).3IJ)&jO;6I)Џ!cŧk41]6 5QDs @0ȩ9k.4+ R ?hk3?e<;Y*jAkM؇`ah`>g*l -BUl* [wYlU\+U}(j>K\Q{"^k@0 z4:j~"L](WSwnTP-}{A8ֶ[0~3,Bebm.vkbWWVfk귤L4`e 2a|M:x>C/z]8&BQPi\:࿂ -\LmNʎ˙k{*l} -7)I9GZ_78P3q-%&qOIKۃ~dUI/vk(vuǸ}>U>Pg8)rUujO6J֚{.n&ע$Ԥ"\Ŀ9_i3 /3vsf2Nf_+[౧ޟMQ bϹƂw `!cz(_V7)#e.:I)7flcFK#_tLy3!v>I!gEK݉Z":sޛČQ|DzTsY2ʈS]uY-L|e ##ߵ#\5墭aRҜ??|\MP]1K2V9 k Q4<sj `PPx)8 [~7 >A@F(>rRzֱQz>SNxKRߕ+PՎ2om-0;XU_og#|IXI> a_Rr%o…7";gy6m:4ؔnz|:G-5%:ld|)1@pIȱ82&xgt@l! _j@DRToQv7AK},%ݗӳ/Wrv[t?owhؓʪOʨU شrn;Żws0k*45qk1͹}EX+|}Fx>6ӳR|?K5he1}N #,;$ś^s¤#hk0$w-Ü+yg ,9rޙ884T ܒ|4@pIFof8䋞./q2IO3mR陮jp_gP 5(&sϖ$0)ʊa6tNȻXEZXbZ;Y-{c0I^^B^a Oy\\<}h?4̟5:l 3Z0*`U9?"";{/ysｖrw5[GUdY -2A[ 9 ѝsy+粵3FPW@\F{+/k, -71PbW$ơY;\)s5!cu_K(A=$67Vj8)s²}`C zjs/j8gAB2/Ȅ\/SugdԸUQ_Lhk$6ëd<ĎTrO2d]q㾚?/ ->%bCoSƑ1&!$,`)b85[/dV1rixqg'(iWc{ao5œrv bն_j`XX0䍮5W Ooq1Z1~8\brw LWAҠ&a SvWL>Z(o'.Bch%N))纺?/NrG, -xdc3j7厚;4q_lJHK*wdP@%9&1AВڮ>)rfgcfn.&:=I -{ZZ塞,`YXԡjii~,@G*ϒAC5|2jL |cw-zK+"3IhZ_+;Ķ^^xcPu,p R}sZs4W ;=`^ZAHLHE(?'u_Ԧ9 MC w"ผm-MP_xϡ"h;3d^qObW:trGZsz$h&(CT*cvM6ґ! mm}~~d~3G.ښ;VqыHລis1M81 ϻakG}pR&;spU * WRJ3E{.4}C|sH7ϵV9v5\<.3?M#b\xtyVX|cc^#[ F0qWD~R=iW@ _'>}}3+4,ҙ}wᒄ}bg:kp9L _f,saSafٙgUj}rmÖ W6IMwg0)oMԤ)p][5MSIcg!BAԧK@.H4&؏HG~jOYؼ#+DA pOsQ Ąg[2RNpMl}w,e7es hm*ygi>V s/ػ^$K$ls'HV -2vSOaRxPc Ud 6;ku{j8y*ܫLvKq+C(, !BhqVVYy!gRӴ<%$Pp_y&֞쫞QprWCsK5XC32k׀/Z>nNS־?Z,r˞9tOUfذ=u@= |(HMckڅkG ]?V:+#y.y[ Q 2UϵkX=89Bȭa>6p_==)L0O% ;P1.)p߻Z&|Oή01\\vit)8Ʈ`3œYL:ao mNSK+cS+}Jd`3P!p.pu 3(2ku bWFjwgѩstQ6Rܛ֝}H'hpѼKywp6B5Oml7E71Cq_ǀ{$t#Y巙k>Bjӌ_I+]BtLʎ-qz*9MtIp ir=\g5r{9SK9k6A)μ>R=G,l&B>[H}+ EQ݁鋵e2/7Q~=:#h${"0)WB-r3sϾm.zwW3M2:7(*~G#%F<;ts]Q6)qbkXˆk -1vŦź==2p[V'\5K\N?Ud 8qB9s]-_V_ tzuT엋cD$MP}?Y@e:Xn -im,G_Wꇎ" -W "5SQK-XNoE>ϧZ n8匬?kߞXlyWSvnTCzPs1< SAv7B8QẦZzo*_`Ү>bwI?62*,]yoʿ-|1(7y-[RC`|W+O -.ɍ^,|2Z}`qxҎt(#+vevcVֶc[/ =HQ2b)H.? G%H=֦p kC/70q2a~\O+&ዅ 7a XP -C9#4}17- -mZFi^v҅qKԦbp -"MJ ,K턔3C -"P_/V >exemGKۘ@yܕqB1CMzJUpS}5ixq.y dC<\.Os6 ørQٝ7M}pLtRk厊2fJA A֟== += IM*Mb'5[:z0h-lXFwu-! x52`}Ls Sh̽pv5`WI/u:\w蕓u$?:BA@K,mЗƊ;MӐ rbh;ާf2Brͻ-^%.{e6mJ,vcឆmJq[ô;@>NУU \GA8f^5Y.<^&ncj7hms6 )EQ[swyc{wڶ⨅Yd߫\}6~3G# wXS<0$!ecWO& ^ .+t_6|ŶMӊRnp2udk<\7yp֊&Aj: -@X쨺܎y]ļ_e\yu_tgv:`/9pَ)RO ɥA$Xw:B ܑٻZ/7'mʹ״Nqoԗ8&_ -N -~d躡)(*W9V}0B>)0fAJtOw WgoXTR"𘀪&eZ%JpOf# 9v|*܅fI<Ag\n*?cilVj0ӯgI%Y>fK:jR -~-o$L %6ïg ,䮹}IPujwswuXbWCSgUm߆ fO݃ s츓於{AX)Ld|Yleft{XyImP=s~^6t0Vho 5b.|_Cr\,JR|}yQP+,RxVX`3Go7 m[ u%4?D 5>IZp -cL4)gFȻj*8W75m0E[*Bޖ -R7e40OY#ÖgE kbb,] j49( yݚ&$g(9Yrw -`j˹fh(nķBNRNܜbf]Ť!sMR[O=ؔVHu+; \ھi8hkti Gj7)kY"x>3LM7a~l*ywZgrcW`R -lkܛt.欒y|$)KUB]u{4йH#9S4l;ИdٳeM⾁bknj+@n3-ǟ-}= dB/:~+D$2y1κ4WkDFk_- R b bjve|^ $Ž`Ҫw-2HY/P?՘.d|;2&1)UGH0q"OI.y 7{zFY[w( klsH@֒@ x -_$W٤~z֍ژ˟c{=#\5~!`#i&r?$`- x|p6vSB,vM,&}P}פ[3kn fqI`#d cs} -=_y)gܙ_.77rH$&e'm!qJ{_;C?e#<ᤵ4B*2h_&mJ*_+jCS iu_=_pu$6U\8=Z?1؜E+L<;AwaνoXW{ܢmΪ8 4,#Egy5׀E49&%U8E$yo3M}cp1e^5 m* bB6^ہzՊih^z"wng;TQ7>j(L_LsKV險1Q{F2Ȑ2, ]sƯ9I A-tR]Ӡ!+ #zoֈFq~svroB3^t tJ}I8e뮼>T/?бjuBn\z'[kU?߫3 Z}3掵zޠ$R[u掊V5KpWƦڇrz%5kR`n>34]rH샕}/\t -юڏˣUJR+3O#|r ݚB>/1l⚁؜M F kH%C)\z3% J>Y`^u~t0?eoE&]]j f]vEX =ЈͱGs_N/[ΐqs`"D䁙 lY)Wb"bCw_vtĮP䙄tQR.">XyC̻G)L59&vT C)lܡI>4S fr"rLxOx_eSgA؆)j/ |: ʺ6{$hr!boVc}MmeV+9e(Rfzk}Zف۫|DǬٷ sZ{ CĥW\w[ //#BckX$_G:eƧv /\WE*H!ۦ~ԧة%ZBqi0q 9!@yT e"a.tt2 6-1QnHsºYo,S? ?wW8N8%2fi'\CA)>50M ʐSLc0wA޵vf>/%:*dQZե#K갱M)W{rFz⥥ v_(8e^?8Zqj&<\W§D@)I'-d"&/ij½֛d:q{:|1HYĶY݉BCI_πfגKvԄ,.1x {jkd_%dOryiGvazIs[MuϾK9RŶs#}27ၽQބyن*>;E_ g64\~}7" R@ -y뮎.zs{쇛8W 8(9CG9cgա;s݅̚&m"vue [R#;+rߝ e<9I9ZTLXHF(8$@%ڞFzdTwR PPjUrj}HcZ#||APG}uX=#1ŀAni{:jsA/.䧝pf0<Z'?ݻ0.5Yx̶-i\[N-ׅxm;Ջ2.ּMzЈɸ=_?) F{*?$"o )%#SШ w(pQTuL6 -6`4vެ!L15^Լ׵ < 49T9PnŎY" 3Zu9%qTԇ,2/: OMOڪcǰڸyqMcC]$q@Yt߄.xGyC6g] =K M͐dz.XO:L>9/ȿ5^%:&SȔ- Њz -#̉28':Aw]įfwu"<a}2k$玥Dg=Q\-5@s/4W>W7@ #7&X%ںrNF@=Y'w#E3m;i]p^\v}ܚyg"gD}uүrq#3e=4ciFd:pݯ';F^GK_﮸R|UL>ڷc׿1!sڋ.R y7fY'% _4g 8M~~]_g!%ŦnҕGXy/ Y*;Hð8u}s 1Fua"ү`fŠpt8>[8̀Z|>{0Kcx8[2tyQk"LQ27^8κP_h}|2\S[W84ݨ} -TκKOݞc*7(l=\7Igه~5G6Q2 -Js]&zf`7?^(oEa#_[U9h/5eTΊ-$0}DC4ش I[8k Gq>\$:=GlƳߗa[JL ;渊pezi)/r[*!Q.κJ&[왅ƸRВ*Z{iAԟXGuvwby䞱:U^vmEUo,buBԁq O+ET }J\vk7$䦩|yNc3wf5@mONu6gR&ȭwL"WCI9I |㞡,T'$P؟}3o_쬽za朻+#cˆPN˹EWI~Z,~ z}PHC~!BRdcS|]Y_v{uvzzs~Q 5C;uQ?^=q3ssS2ZΪ dk2)?v煌m5隮~2X>7p9] =>"c!pdm ش1J%{.VӀ` ExzT،pVAM\>`H~sT>˯u̐ӤB%wmqmͶZu0/T&:..oidvJ+~5" g"wYQpq;*:D/1KC;c멸a3 e `ꇿRR7I~ >ǫFǪ9eH=K\vH))>rǾu(՛ -6tcR .cgQ bm|w}YL\j(IhpifN]K{ 0L\P#Pp.執AL}7 wmݢnz1^rԔwqծ -(k5ѫcȄ%QÞY$^GI.pI!X26uL,=(Y',Vcۛ|zֲeYW$u;? NVǭL`3(׍M%owĎNS Ĝ{2FɥvP{V<@(zaα c+ެ # 6F ԋW߯ - C+,=Z3N,E\ͼOj=G5<ŗ _$?/Q&Ag su} dx'ЩR)5Zc !=Yܓj>Ʃ\fm-ҏ}'&愔ABf'<4+"asO pG . --v( c t6+9ǫ"R\}0I[F_E510_j]S5q^)R\Zh -.33I͕*ʭ$wM<7r;F&!'ܽE>EXq@U$1F'=G,Tv?隑/WhYNԫQ 䙱⮩ z>((^Zhq Vjxvo]P :ӭ@&ZF+{\nSsA{<nakvHQ ^|}˝cU+̇|ꗳ귺ƚ )%# [y*~M &y&I>) r/%KU7[QJVއy]b|eQpWI`>2hE!ſq/~"E*ʏ?Շ)Ɍ;.(>>BM)x$!9L/Äċa=$HSN}7㝯f~㡑sMTfSέ c-\pt':Aֵ;O2Jd}T{ r4.9 =S*0I\~'%#O/Q#74WuRdY+cKC(i1L3nsmB:nP*fڌ-b@gP -KcmIY41]0&[ʯ1CF`(H0؃.U7Tn@"ռ 9p}xcC7${F --.uռ6Bn!|ĒC:2El=DXobӎټ/;2_xc,sW j諕/Mи^;Vk6F(P#scQ=WvO*cdKWms[%K{AL}:Fxmƿ)Xk?ռ81Vq5J A4MOlO+楥gi`,80Ǧ9+,`ӗP:~յD{omN}a}Q7>+ڒF;-\^(%96֏xQ8)%PK٪G1ԉ6fPY)!TG^z ryk`͈$dڎ[nƾ5+8շǰ3뜬WPI'fǯM32!rELWtbZ)'p5Xs`pMc;,lui^pIYh@쳃F '/.Å dbC 3ֿ`y; xr^*qllcx){CouE.X sjSȿl+#+Cd}{qrq+x>m1X|9 zޟ'q͟TzR>;Wl?t EQݑQ ӑ~ &K^ ֑%$}Oz#mC[?zC#>wgKMvm!ևkĀfe$f!}^֧4 ͅ7K_۪;l bC#sdf3لf-s].fl$0.dܠ#U贠T ZagM`6ļcU-c;Pk#2lGco85M`ҹ K={ĵcaJ򚔖Pq`^嚔].Bz*ܥĦ1˃xLHڦM9 26p2+=P)aoND]/.rR)sKһS Jvf>jufj{ZڮI8p9RB9EsXUn%҈Hs/\зG&JR[u`+ 5*夆aO7cRE=sŮ˽oWHIK=D^1c$_zϜ茕ˀI֧a~|Z|#ÃlZ hxig@盓ӆ* -[ .91>J8&h i5~-ѯoF!c”95纩|!++b _6}f5SܒrQuyDIV )gñ5CeXOM3 -* JiQK.8+,ҰZw >mc!-NmGU% v#n-gAGgiT$R|Y֓/4Ok9)2Nh̭>ɣb< }"CZl[˱Mc㖧 )q!R%%eo2L ^^`+울&;S+]rJ%kC,ؔqank =9Y\k늯Z:W>W,v?R1&{'A=Z}*|G+ˆ(_JrBŸaC:?3cbV@O# fHRB J+CH6aKM B^o2j6.&\smS膔۔q kr 3jAZ `ޅAD99KrNJ|_#Ok^zfEi6>@I\в QV[[ϱJyVL!,,W'91ۀ(]VxUpjX8>*jX- \^sPr|jjSN.X&ekr.̭͍z90\wEYhh0:v=o!ٹ]#"?0[aO<ub}F[a@.q -j6&9eTs7v}oag/1slX`x/&n) OPVTlFXVʄlhDEo}JS0l&^T&0vSsOs}wrh]QGT7=z[8kuy(YQ3S(gVTEB|3_!{f9YaJ6dM΃y5u
g jАs -!%g.bެ֧pm쎮b{؇+_:)[F6 Z`Jjl'BY"$iHnWMr(`e0gfZd_S`v ʀZ¥PWww&rH>YwmjlR;ۯ$kd:u;ܵ0T*r.-RN9ԣb\J1EU_|S7֭Msc̬)V}^2Cțx)Ak5O7z;f(E^%f `-5tzIm5{tLȣ8 qp[Fӥᢧ%MlFL۔Q np)2JɦzQi]ņM=%qHA4JC?qg \Ց_c#[n`(j -{D!aeTZC4?Goֶ }vi-]# IQAPڞ}~~xd1.YYs\].Ŋ!eA -p@"&D䞃ٲabG;v|˜ӾmlEsދacVtMu˺nƺh%o;&ry^[j=6bmۻm\ɪo=܃St@M2f0ǧ혘%5OɮeEMJ(E:ޏv p1s2`}SW+sBڰ5cfi9&v0񛶎ukc̦m {0Xwb\p;W V c%5t0FClٛIfMun9aΎ]gyb'h]W -Tղ Qr䢛"@O:aVPk>Y>ߵ+w|%Rr]{~lp<\=z&]5kpճP#,H hNx^^8N0Rkv \G^ xʰi:dHkmx`16G95K+e0eM JRգZus/Xq=Ě-g;{}ٸ2N sM͈e@mؘͻ.UF`lLj;nulnuK)T:՝U=*L0&kNGn17--g+p״3ܚ`ot wCSmv*b@LY"%֤]񮫭mkSʷ4)e:|k7! Tnm mٚSmߖ:t6lT誩 fՍ3rB~7m-D7೗f¢r|~5,G^G\SR* 3USxуN;p0vmMu @lP9nISp=-s4wsW,L򔊖7.jʰscViKMՎ -:mJxQ1-aEŖ~rg#5k#m) |ROWtC -JƲ;6sږ:'=+Uͫ.R42(D[Ӗحanj6Ψҗt!qyT2m3zNܱ+V9e.;S"bxgm=r@mښFzJNL>jSf\i = 48ڰtu雡n>,^jM-ܱ3%Vū;rw'Z(VԊrEO]Ǭgy.,t^2*&̊Z=e}`TRx{JoMuIߟuH7Ǜi@N%[LL]͓F'l8vcoPal=]cCܿI)~ۖ>ᖅ'Y &]0p,Ǖv5WP%gySf٥zo*J q -Xx 0ZȘof_3-]w..̽r[_GּxF_75]p]vGղ qCڅv bf1ݝsZȼ=Zt8 l{!T{UcS혐ih+5a]|b{>'%mY+f&aA -QuvtԆ\2*67L/˺bZ)1ZzB/T4x>}c/q >_PWE;h% jsް xU{#|h5 ;RC5>J.\WP|=ԴZ+]2u3WM;Gj Zp>W[w0GY6!O7R4{'%뻗fDzi<'n}zhPEc~F DVڷiATV30fSjOcHPv1:[^lC(^- - _c\ ^Sy@ʼn߉DyʞΤ!z94Gr I,WL=[yV~Vw+&o.ܽE׵G^/z{y{'^WIF%6MdCa`hWT:bU[>ȗ˜B7#h1S8͋O~BbMA$UH3W l삥 1{teLl|x^.J)6z~'s4u;+1yNA6ioe5 ‹Fo^M7Ց]>%H뭸쎿A"?%1Kz[u ֝^^^"^\ʺDBؼӼ`sumÒnO('qS@yǕ*lo^ן* -_xBz/+8y! ӛK0W,nҬcnh71itE ōH-M9:Č_-zWSTi Wzv9B(.~^AcTQAgNis't4Tmf[U0WY׸[r>F>.]^ msԅ[^/ BgOT̠7L~ijGe?;#mF#k~Jn &u!:S\ -o }g(ീ}܅RŴ -˟psGWd×G>Ψ%Rr3PyEfvQ累A?^tɻJU^?Tz}!u7>(SLș::.LjXm4'Fx*k1J_Y,32q蹟B/| -{xS :o{)&K[Ja^%%Z0  %*.g %uttM硨g`AazS^^KX RQ]xWú.dKT!=Owc2ZM$^ O_|z7O}_=5``]Rrʨj6eʆ!k<&{E)@GNiӽs O!kxȇע5Ϩds>yLZaQvx|P/WSŷT5-U飨̎M6Cم/s1b^Uy8C,+K~ɔ/{;&d VC(H(Q48SmWRޗnW:4޳!^|Jn?L -A\HJgG+Qd)WӋ2u7&P+͊\Bz61^T-/>I(2k@B\VŘ/r?:k$~P`A9սSSD }w}Щ!H&Vϐ+0TId[rG8^SP%I-xVF7|m4!lIR/5)yP _0u7ϨY|[KvnVO78\`Kq0/|QhJɿ]~S$bt^ϵ袁yh"諜F]vtfKJBڌ"hՀ)t2[ݺR9ɑ)L5.|.nj>-FN/C?'x=|DZtW@W;?&,1a};֢Rp.TK9.c -M!_7Pѓ?0R۞5Fy\-YF;DŽ5NUkZ!Fs9i|3=]OUs'T_C;5Ah"E%u~@8Nl*cQMZRRl|LASt\Ey>EWܢ Ɛ^P]/WXGdfW*4 ʺ9F=ȶA\*C(kJ(`\y:gz\!ϭhN{r*TĽvS*R:Œ>U_Ve8N螹y8޵cIiRb遵mkDL -l|-&FTNv۟,aXE/*f m˶Mذ1m'֖}kCz:OgUenm!eOظI}7Ůl-uyYu]zA{ֈnTEb=mP`kwGCWf9-b>Y('5lSޔkг I@.}($ >d.Gz'v>1aԮށx>wlE yyX|l8su3G c7&Nsc?< |#k]ǠFj@]AP6A! ]ʢk Sgc`sK[WݘPTpsl8?o(Z>!B!|  flkש?oU'n|[k؛`wn;:6eܰaV- 91k1~F'.hIkfr*wIQ:/x !wivοk R -_6K'k-&qQєi,ּQS7~ 72,<{hǎ+0ӏ_{G9^j5D G<je@ JaPzBTV|cDK?:PKrjEE)}v\V6{0`RaG: %1a]cR畨49)\U_cDȑ7Ag9 56bقby8p7_Gn I cS׍gtwq6Ao`gSL2$.0 JTܶPr>Cz}^~NT?+DH)YC I&T+؉/5sM 4zIIM)S"L =Bb\̤1&di#<᪱i&,J, -2t#G+d;S|Δ $+35͇cW8c" F 6t#MzF^gYРF~uN)_T G{^*\'=BsOQ[\ԆU 72d₨&w:ekzHتu⢠Q;fH; E՗}2石$40!帤y`C/}= znmy:_9qK<ЖpA2+% |\}OwMGؚ):Bt{EQe;㉫;gd9[lNP3dۆ0:t9QSl 1Ik޼;hIJTpgp53Jd̤6-X,aK#M+zz塓u9ufTW'J`%&.D>垚)o`җбx&PGͼikJL,0*Ă?6dʂ̬{?iٟ5h>*ڐZR5-ԪC[3n]K,[QAоWthEŅ׀=Z–QR _o"l *6wj*pdI$lqҚ}YMIe1#T :iSِ(Tԇ zDGXa%wiG>t@7#g@jqfB6Q՘|@E"T{`Gm ghڰG6rgnm25< -Dܺ0p\?A6a<*X`Ɩʫ -':a/ftu"qKNݵ+Ԉ#M9[jX̡>_nlͿiMn= oB5:Xܺ>nόL65Ei3ȁ #Yк=#*d Q}^Q,M$oa;*xܞ -/VЈ-6D(:4!R"|wJOF܌O 9/9>Y6&ֵDP}W}圹N@@] 2|&6=Xύ7#*\t Lpy08`Zܰm=%'3m&ʮڰgi(<W{VlHMf=+YؕDkⲏst ZvU[&䒖HK/&d9s^-߮J +2lDO)nݧC ڂ`2d\`ߒS Ԛ 5$tuvU\P_qb:ϝ -, T{b#VI5`eQֳ-uYО!Ђ7B65A{z -uJXGXЋOO'zK}\<>H514bGtb".aP2[S-("p $ֱRl"VDyoݝI6FѶī]Ow5ei}7k#uIuP6\NKǃ_*kkjgr^Gߝ {h|#N,*|Î mhB5FEpA&Degyeץ= K. X{J{8FfdߛU:Uǚ=]mԞ.TGΟylBH`;b߂)^(/x2+zmXUW@~åOlVt_cΒp'vhNP賩sp[JhP컭 [pe%Afx2fY+C5Q:h/wCV,(QW$3:N;Y 8#GNtS$)uUt#uF[UNqs}vNZd4v6*;i<5|R?(4gU Z*D"u_)MZjcߊ3- >)zl`s}yyO7_;h#(dg\_WH=6O+U*ȩW5謓Q2dߊ++\6;wo.l3x_A_.2Oj-Z,zO})6 -͵%A,h&5c7dvzK_Ԅъnؚ2ز iYsKl\^Ww|fAA?-Z K'-͠aXkl_iM7C5ߔV>[]l8on 'l(>s~Q3"{Q~IFL?qkL2y?kBqꊀuY{;:W7^,z`m))K"dزngdߜ/.n+C=‚ ىE:h73n_C]|Qcv4-eﶲ́,iJf>5@sJMMbk.gE1_!lQ)!e^4'"?}uA/9ՓvՕ]),+zR{karѷf0:eGJve3!CRYO,]t=hUYfkK :eCZќpgnMZ0+-?ul* g[m "K;\U>9>}Mj'p{]NSSselS3dO 'Q`|3Pj(7{L(d+oH>j#ǻ* w Ҳ/S֥ekڠUIMH]0$K ;˩s>飼v5~C6a[ [$Oa*~x>Ցޒ$q -[䯥\:NsּGI2@#sUHXS( -sb:SwK!{IL%KkSJ/zi -=*%Z#+*Xܢ0G˟uf]re :vA W5=15e1ӳOKQvK{K]2eMZþ" ޔWz=Ζ9ZLꆢ&xxc5+9DN1- ߹ɰїe>#%_W~T6f?P/j' -MGvVC6R_EEG OEy)#F m)va\/ -Z.l^P`2xxǀJ>,ِߖ}4(maa7u[Xxe9"Spb!_͠G{NV:3;_, *Ǧp57m2%*zST(Y澘yOT7GWdMTYW]bWcO]/wt]mC<b|_Ylou\1v~߱0?6Rn8 qUI]貨6-<[N]U9,ySJ`o0?+|Qlad3k#r|vā\w_sDMn߰Rna9" La\zK4>1O{ke5MeaĿ M嚠!<_"ڊ>tV^@;Ig5)~e3զs]YVve0zF/JQ6F# #XOA`߶(qxɿg %,bw0wQ e5XK3+鎺<غyevwE]ahFgcJu2-]uxFW6\vhEgJFnKtEq\#lְg@utŢkH nEK37f_\^B_R~6㯭"t=5mhaxw~.}*AFD#Blj_Wg~ ,r^DLrtWrjmoharHخ ޑQ+kE޳S} Ґ$&/ʀEӽ/LЛy7ffy6aw3TN"\7?zkbuW~MWqKⲸ3"y\ wvfHjUJڦ;Jb쵩W{VDgD_էM-Df6Uy%IK x!뢲ښA~K'kNE~{]=Ł{ںٻBlU]S^XސoƎv=49LJonyfc?J_G?$#Y!)s&Ycw -_D,7`+uY/DGɞ'Os/=Ȩ~հC>XR/7%G暈#;<ɭ޶|jK<1f|o>I[U"lb%6WmH\RՇ -J?qQ[Գ LÙUHHwV5YC¬k#ͭƻS|6T_Nd<"P|Ӱ1V}dzO 伞:R?B,ڵ14h[ V 갩'Y޳/G9^UqL<2"vqVDĺATԽL{>CUpEӑ -t<kK=Bį LKHIￎS\!{GWsd$2fSQ.*ti{ W?Ʊ3bCY,ڐ}QהTÆ0' -,8[w`>X]|c$8UQRRvxOy?g(̒F1zh悸wUK,gNV%>yL7~E^w$þN4Sϳf:j59*෍wps5ODM -?H>Ơ~lĀ,1Co>_VCM{B$`wC+8[GS[ 'QXѩ;ۗ$(O8fRվ\7JZe:J `q.h=HSn;@O[śZd5=oD*[CCK^q'Ҽ"M&jΓ--*wT*G, :3PԒrSx2.-㢚Pom3Ԙ{ -t}3,ȁ+;ujm2l -8tbj 0K =⪈Y,WyEP}Y|Ow4:phG3  #hϽKmԑ ^L%iUdo-yP'{k5WgeQRԭk1{FRɢwkM ɀ6L83`3uMQ}5:J 'W71<ޖs{SOe̲6wM -\xuT _ՂH bӱ|usmBV# kQN}\6i5#C:%V<Ɂ ;z*?is ʚ/ -HȲdoUaڃau9.u[X$#䬩qiz{ZH䩥>ySh 9+?>zo 'Ftw;M`HK;%:hAP:qRlmm͹(% -h] Ն\a>\㢯 ol~ٞGGMCw9fyu~zj],髓Xyj#Z9õ˒ҷ̛4rUАm=*Ԑ~j#nk矁:6dji1q.tMZ.j&=ԅ٩} -"K:16ܰ: CfIƚʠuiɻUQy^ϡ mn -d2ptԄ[I$Y! +Ңcd7@O 7 Su6HҶ7幽+龋[_MSCU|f>I';_hku}g3E՜Жt`&U6l$AO γO&=vu4fc@TY0wGBd{󥡒;FHuy!ߏȐ=3,qSSeU,aBڵ|莭Q5Wd3@h+#g׵Ց6x٦)ZSgiyx2N %-z͋Jz$N\h#yQ#w4T/tP.Ҏ<:ŁAkJ/j*C3zSM3c $Ȏ cXZL&)xk;275*nQN0 u!w %lw;#Vɾrn >劮AvY$+QEI99I%b A0s$)ѽ{Oy=FsRs9};y#߿tgPoRʬSiM׽fgvmszv{{}- -yyA7f0V_W}[cCĪc4nN1* b[vL.ߴ}#~QR;hOE\S&(%) 8y79  -@4?K`{Tel ]U\` .+w`=ӈq1<ܽVsdU ~5Փ;嚅lx%)#_!|Uۿrk -ڶ=)k\咸fHo s͏_Y@]zHlNGzGI;_$o/{.Ǭ7d}/!%HZ%PB)⠜<2j{߷5Mz6e!Vش}{e;)ee`6o1*.=>fϬ mޙ.x.isZ]d; I3X&umOA 6ǠE!#&o^9Çx$RhV 51ڜ36߷sc*zkLqn_c]+ '̏oB\{`2{2ZSv]K,ý/n:'6mω1cgOf-cl WKS;~luQZ=.Kd; (ki%|O"NSw\u!|&w{y'%ׁ;`|\w'rA* cu5F'U=ca]c;^}v> ˘YNVj7Gڮ}onU_/'/z{ c ?it~ -uC%i9ޓ3v= 9Bobnv~7/nh_,[oOέ ,bRF&>,~nE~Q -Bڻ3p{z5427肸O i(]tpiӆ؝Eb{5}7GHh3S{)%7~d q>9mS?h:6BO*q7|ww(34ug]js{'1ܜ胬MnL!LZߓnlng:k9;ܕi^W&@gG=gPn}6LZ!,ڿGݫ]mOtqLvYy^{5y)weLOP -Ao(<-@܈>je镗9r$N} >bs ng;G.\}Y,`Iڍ_eW T1+8={:sZ&;ߛk|TOW0M/}*>Z7̬AA9 #F7vt(^!kŁc@gzژIq۝- ȑg3LQ;_8:{op 0 ـ{T)JI\A1X ΐQs v*1m_wlL;O!6^JIAw%Q=oͮRӡ ~y^{kZa}rr_Aa -CjRkjK15 Գ1` i\ -zr"v}{}"Č5.woNkY\q׶a ؀6Q`~5=Kڅ☉E qՐ޳c`~Z@6~'R+k}s^Tq^K`\(-o%T pк%Tpٵ7ݧVӺ>;UӁyzk@ -\XvAЛNȇXǘl)- 5/,W$ָװT̥ZcKtϛg{è?6fvgV>9 a `yq9\_Ah o -\_-H%lp_oCs} -r_\`V"[ WO8uuM~%`=2?4$tDPuͱӌӏ=ߪ:!k/{?<'WLӫ ?_^W&PW6ߵ{wVqs$hf/՟A~+osKkVz8-ENOJҟ}}{7;,|5ɮumS7?Dp%'_jGxNIST^L KiXS` - ?VjzTiY,9ltץSsP 7[$%5VP_$TQ+nK2<5h$[K]ĕ߾^K`MKE\0aUG4SnvS -h;CطڇK<])NmreWEtE\!̃3Ċ ̈́Uԟ^jQ9zfMgB"(:l^']B7 -Փ}5+ .ZbKH1:,Ӫ'ZgM/;Ά59b\Okü9 em&rc{FDyC0$B9]1d0fAJr4BPCi/f G3̊߷E-Txp?je_‹wՒ~+|lo{+B$o\сz* 6Ǜ 8lqlӽ-[C{vvP(|9TaA%]vƍ[ajjvmakPJN= Qyv(3%'IxP@g9 7|F.kQ<]2D~XGvOpս= -_{UTpzV8\O!\u\$`z&[T$pUYlQLFiLi8c,"8O͘4y= u3&TƄ9#bA<ΰ~@KC -:aAsn)sqMz(5mc-JΉs%<4HL)bG5`lOӛ+e6^㐋k/ڿOiG1Y$\l ,Qw׽c5򡚓g'wowXP3xYBmHbDG/ o;/^0 E>ˡaSlL|L GX55C=AN@V =,=1jJwWUekJdEҿZw);ySaтڬv\KAuXg2FoC/@N p7%eB=smR?A[~ *j3F&2c&9p(u`LzZmN (qydo *v͒!nP:nޙ6%y[!Ð'GnJnXF!Ea=oz] pƔ9N)ٹ]!Zŧrn4{׷'#J߼Ay*7B5kuL+SBDG) we², n FllTl$tP_@]y<5N:=PEBeBI -6Tt8垂_0"3+ -1=+{6-n$;{/U[o|=MNDU7?e"$6yI1nZz5,?~0 =kl=JzG&@⯹&wFρ<ɍ.~FTǂZ'%M"v0{ frnuW+oZNoh~:h#G4QRڂrtpKEt϶_L=("z5m"z` U3yn}υGL$#z!ӻ^NԨKRt畵@"葒Z6zont߳I) rgYp^" x!#a[He`֨^a/AwV`$JNmٞ躑23{vA_`ƫPVv> -((-A5)&{ȓTE̳-LCJژ[ 4p@b6`C\iv~[`Cffb":|O겉a'T<0OIKO;?&'('UVKkTˁ諶_v~my{1F6@;MBf'd{ո2" -"Ġo3b`>wXV~=\}RLoSp Ơ8\?l-G4|RreIvэJi#: W-' -11?S'zZ,iuuxGLCj -Q5%ds5':?wMS#"@gX:(0 L>{2FFq];/eyPPKAVy_ejLDy 0,-\rXMm(]!9:ƴ}} rk9R=?P !#*lcPLi]f>5` -rc438 ]30e`ccS2^ -`*ggW<' 5fmz6jxDURg[41{: (]?m%{o+PzV&(E;oڒЈͬ;¡:Ҡrt GAG'̒~3x~9aWJ i)s1M?xO[ jH}%(ǔ%tOhhi{?=X7 -@ݙ$xxLBe)f {Ѧo2lWF,˨uiz2tE<7!%@cP.W&XBi`R =G)Oy=k?K!ӧavz"b@1$,{w])hmq1-QANo]/+>osL -7FoOYԉN)1C()gSr[y(:4(Xyd@+>ŽHr/*2J{Z7I) eYc{l淚1Pzj}`zˉeΓۣ <[p0i^jkS bU\ -ot};?3-/p9z2 -endstream endobj 313 0 obj <>stream -\rN689v޻HZXa rMrpOWg·Jܞ@Uy> ̖ yr{He%&!5\5ńBk%j7{-l_Q3!q쵈9p=jvMYbXp7P4M<|B u˷u-v1l~F%lܟ ؔq])*b&8e퓑[C˾+zؙ—f{)q#>CKH &ƿ:q5 pi3{`%Z001.1 d!%g@ Գ%5b|Kи_Q" -Gzr<ָ^,J.w-ca=jH^D.p59BG:#]c,t~e\0^֟!/NуK/Rf]8qUaa{MgMߛ|;/셡o6'{fMJE=h7jq QڒFJ[D)ٞh=]D܈h0QQ۽r-|}3'e'/z5II5LdT,-,t5*XQQE|kq-`v@#TĀ -/뗟uٝB27c"σx>0If[\\Rctp[!{䜮%tuJе= ˙,e׉`@Y`6zew*IB>sg|wT )'^`4t}98Crv'9fh .sXĖ@Fй!3]":φ҈]#J[Y\O%t}9tu~)/7z~6Io xyJe  CB!c%ŕ`{r3\BG̙qFwA.`ctoUd{<,:ƠyyLYH h^%!cELbc\V}e!?jR -""4JMlmC|ޞG(9Șy *05Ý'jJGbKsw^A 3>j ¦Gӱ{a 2%jyyQs=;wE`_ÂmH~ 8x9)BCI5퓶o 광LNh =hOBmD,Ӛ*@Ъ -., wDr˓c_b~ZX%"fg+(13^qۏ~.@wѓw'N94m"C>p oRV@\'hHP'[_~93e퓤S+zzeI"Lll"nj,| ؠ[s!=DΒڢj6ѝbFDsXc&XyKyղU2G\5GoOAsjW?Twg^a7ȰQԟCj|ȁ}s`rR&.1-\nm7= -T2 s`V -!FLEmLX8瘖:'m>9w WQA]sؼ%q7)`R&BӞ -i])&|A_9ܙ4=AݧƇu\nM[f+"$-e4sTP1XƳMx;ddDMͬVt<廔H|7aލՉy1}("w24bt 1 Ԓ[WI i+q$f䞨߰guÚnPInYi;G"П}IÈf` b)mJ>w2Nxv6r5#wF4B@L#.氖۞}{X ئ%iVu#og,bQ@hVswf/lU`M(Hq# /8;. -#Z;aUK.|@y<y,dBf h["$Ԅf޼1*XyyewU2Qsd{}K]>ꚥׯ]C׭gdKl?4rpe`|_#";0ESmj<;‹wfW1>n&`fa\{۝3,Q@]RtwZ3zSzr ycg֧_y{EƀZu/['i7|cq8&;+P'F:bGX*%iλHA#$aC;=ȷ<SК=Mw>[m%,έ |n_Baf=m&eĵ^HM€iF^43?o= 3u~ܳ1{tNR-ĕzTڎ;aC Sgu-llF$M\Bp -W]ފU)0 ~DEz@ߎ@8GNltqYK[LAFulh{Q ЊY稵yV[DO>f}񍼯Ӥrw_0tE<J֦YMEV[X#?|9}ngsz#f0jSQ=^vgu1QRvg{{~98r/ddgv#$5g nP#܋Fegݰ}9nɯX?o92fzo@Atcn늨ᮓ1"!N\70WPk[=2\yBM޲3u=`B\F흞B0:zJDžR W a1}Yߠn]tMu_e*2mJص;KYĵ&i!A~bs>:١$d}y8gIQ%MjwcU~b} -U@ -h[Q7޴Ͷ4SelJ&-\TySҲ 3]mtz/.o"a='f``\Q"&؆[20^#q>93Ao:@4=(7<:.moo0aZZ{dWg?, 22^%Ƨb< XPOA\ WoB3a80Z"rRMLhOxP[oW +U) /N虽3_k=`KtHņլ@'Ap<U 9\wTP[FhdFBAڵ} ҤIDtC6_stW \rc1'nk`flIszbkBD,lTʥ&ߐYeqWa6RWNڜ ]Qgx>R|w\ :4nᐗG  -zہQcHh11=cO^ٳ@5Va1?lQ) 9 = =^5GP<2*>J!*deIlul;8Ȁ mi#)< -,A!喱^6Lu(ƫsqlBnBڜ -i3Ub+W3(JhB.Rr]\A'@+aKyl~z~ -QHNdV }V3`%bk:)UA_@X=;BrVGtW=]\'HjԝqXsd9q F_ևۘaԮasr 􃕅s`cSOBL$\\4%/쌵O7;Rlh< z;ӽ7ǻNmu楌qSY$`e,4̞Byϋ?z(bjJR}_? b<8c6C}K y|N,"w{W -TP3,ĦX"cI`%W _焴BP%m ..}6Fkۋq-ӆ@&O7!52V`ڬ-_sxYsPof@S&Ŷx9 >qd_RP:&U!̣Y8qko y柝籷l؞ 32z:Z{ڀHq "?amMb얀n_fY@&Wq >ueӏ y%m>1/sB+Ժxj_ƂO>)*Ͽ@:ĕ ZFWu\>3F,€tlڂm)NoO\·U mQؒ7cM2jþNHXDl7HÌmAXB8Ol4KѷRz.7pPq#avD06^7/lW[0:`:R@ :JtIF?}3a9j51oog~ SE ۳ܰMyVj6ǺNlo;oX Ws~rvW\Iv뉵 ~zEٷ -y P] Ҡ e/hX%:R噁xpɴ!dV$ +^oH}?36(&ɵsKWcZ-a}'8Z/ =ZIo\cݧ*ՐSirG% ?c> toD~5QUo6 /VޣnMs~;hZUg?9 |Ocs~1 -j9+8:o#$t,}Uؗ.FU1x7Q-90^屲C{|`c3F+iڲxM1sI/αEE_M eG6;rّ#͎9lva#G9rȑfG6;rّ#͎9lva#G9rȑfG6;rّ#͎9lva#G9rȑfG6;rّ#͎9lva#G9rȑfG6;rّ#͎9lva#G9rȑfG6;rّ#͎9lva#G9rȑfG6;rّ#`&Vw쿉R -΂QG/ 4,4[s V S)pX^g/\:v ';?7>:Vcf3NB-wBҿH9Ok YfZEk] N ~cSĔq%%\i\ z>0c@'=9Jg6@݊.P24GIU ZCTɐRd׹ S4Z#2LqLMnNYI@i& U9'q9ヵ?e`*fOL˧f%ۓ9LApZZܓ޸|!/:yWrBAoMOؙ^xv1 9x=}`|hLV0Z.&m$bI@O;O$ 8DLOȘx¥ldTEm+5a%/Fքܲ9r1q!'61 Yq0'Yl*>OIp!0F)+9Q#+'6wk谖H >oM0!%,L¦,LdD*qe :%YyԤhQ7!ֆƤ() 6&P@,!m"M)m17IٓбFgBj9XTgr|3(qՁEXޞK` -7Yb&f1/D <\L/$2U@znz0m6)Õ{A]9r?oJ쭋dl@QJKH ˋaQ=Sec$LlM/SflUڌ n>,vI[GtPM -k(1#ӱQ_ơ$. gwGc@%&,иBGltl̄U^%ǹ20u>[ bHmX{fJSrQ`^iU$5PrWHl ꈵ.)4۝ҌɒgV=dΌԒ1 I+mqSf8acRDL8_ u M_ YjfOPKQ%I-cߔmj'd .1^3ZbJr]Bm8LlEޘ-?11L;F, /QR|w'DԦaqA~:.HXh -u+n 5&Vא`Q@NV]TjlITKKlk9ݻ@k͓A^*}Ӿ)䕸朄819Js\bl }yPەuGNHDlG8<ol}n޷ɉam02&3mAf%-txFΤ3{`,MetE-}jGUlŀOkBO V #Z$fb:>.jhTOi *\p+} /&,,Tbc |~fJ9Xz BJBվC>sv6mMI/aA&8UXKi6Lx=4P:TqD&Uv(XlS1{&`S$/|Y@L 㖸ؼgc:r ,$|/W̲P82ڮ˻w07qui&Iz︮lt'8S$bf,A,Yd%[33YL޿;C.U֜{^[9b2~_al+;'jrn$`e6[̭dzkQ 9(amO6&XE&K)"|,c3ףcWI?CZI-癡yJ|WA i[[k]c}}yH䴍a­a][nSсi7AILo/.=fQ`hL@Uu3]t;Sr3Sy3U{ӯaU0J7ww#;&9ឪZ<7ڎS6G*.vX|ۼCkuBLЌ 5{5S@9іIwl,|„0͓!}}6cB&ry+agƬi̽Z'sC<4..;U`GY" ZB

dBʲ^s|jb_O- ͯ"֏>Rr7wN$9H^ LYQ=93[q}e #bws=w1? g'%GI Ef.tzdy&O{Wxzr-Tp>m}w;K+As`|7GQW,wS_j%=$YsmYG?}23jw, 1y{=EHrO.U7+:6{"SrS냥'9Vj.v.'`aJBt=Ϣ䆴,hvQȲ51OpS=j/g=#fDMB^l Ɔ8gĬ h in_F)q9`DʄZ_hi>5!5d$ld:oj!E /x,KEtA8d8FH}E`w^$Ml`/^ -nK% x(bG¶a0;+EQ}LIC"0qҋ(Q>c?{үȃ%5%'f᳢6(jc"qz>ŲO"Z߅u}]WsUČj`CUV^]xw ( -y$y({&nbocoT܈QWC M:=b V1t}W}vk}t`1 yڈŽke^@u+I5dhȥq3'iVӊw}(EH3]q٫¦F蘰3dofAP!$èk gB͒,kːB$i5I%@&8fo<`<*JWK+\.;-IXς< )A8lK| fk ̈<24'h`V%r0ʯ X`Eu+YS%9Ïh^@oOaD?jGBa, -_bs8_|N [Ygv搌$$l -bIi!ʣ"ȫgl+ ia<^Dmocga#Q3N*}rfg -|=bArW(F;g).+!7,xdS6KI7);{+bѷ},︠z{_6( ;Xq&tg}/ hEݳĴњ+䈲^U91RkfgEk}uORS}48C|qbomWuWF "Z 8u])]Doي1&)Aߋ&LQ}\ST 4} 5Q3eg=3̪F"ygUFaXN &܍K%'J9уJ>.cJ`&9]ḷn+IKCk~6 X+ԂK.aH IXEZ$ >e9OK qY KM655KdmYˋYl7cSvAV.%c{T4d^WjQKӘ Q+*kfafVyX6? C&X22W*:){}1Ss854uw \&h|'lOfny5w!KhayN@"'j{U TA}05t>|cxy=YǍƀBz˯yVѹ ?ԜA@ [$UZW -A4BZ ,499F1g-MIi{RP>ނZZ85Qh"JZ<,46\~fcHxMCWV)Yn%B^qk{ w78C.V\hĀ.N=X  -%x42 -;]{=^x7Qp7Uz>@ltB.]/nA`>x/(hP&lx:67tDumn> 6jix -iԐZʋCfxV6SKv:*fv랂ʀ] Kw풺G-bk -"\HXa \MQ' jE4V:V&xkcԔUcpw_5\bgn`l0Y$`ĭ<.j$dj\cjD#`Ōo̭`zڐ61_< -y!ɠ+l \/0k$:bYk0N.4^PC+-oֶޘ[=Iˌun%>Ω([ݪgnӁIw*kㄤY1{S<7Ą+f45h$T5 Y1+%A_'xؼL0c3Akt5MD'aaAؽ95Zz{̵t=z5 -YQTKYnr_!ʣ7c4<<QLݱ5b'CA 9fFo)8A <pgߕvM+s |.'+Qy:Ru5K,X! |'q^§+/.sOs<:;zzpm!pb5d^f0= Wqk{WS|OY/!9j5cW5[ӣihrx0!ua5?+cfv"RXAGb'9O<\ND*pAu2յ!Z2qOMjj ̀\L -\vꛃdCS! ᆜ|1qAܥDll|lM -ŢCŪp ]YY #r-Q#RI^MX'F-aC]C*mY$ -4z5F\kxoVB+Nx<;BUȉ|'Ѯ@ִJ/+TV>_w[g˅8/p9l3:>ͭf+t*Yӳui69fdQZjR߲3/iJ,!3W I>9C)y -z|T)YJ\w>}u<~'288h]QJ&}˛$]waΣ=eFԯ%mubuA99C^a>٧ ;Pvc@%Zs&6>#fT^i~]x$W~ZJ&Y' ꙕ;#!5Вmyֻ؀dP9@Ϊ@<5Q=ܧj|9}uinފk.az?DKL l !8ԌRZr85ۯGOROw7Mx -z r,jA`jIR׼>-/p -GZ #ձ3ԬQ^aK}_a)bV>t8_ff,b Da]{sWtNF,B^DY_޳ WMcoj|4lg܈/V$`k YZFσ&6 e(dVݱ5OnWz5_.dl|31r5h5"G-mR*N;w#O%!*5M%'d&iAivW,rM1r2pt=$`>"ňe".uvc瞡:GifaH%"^1R{ʛƒ i`mMvduҸN⛡fugbV@Y}3agot%oxR׉*!ٯٙPvU5IwP9ԵwysNۺ7ϱ&YG+Ayf}:zÆF]=S{ӧ=+HQKJ6Mc_%$"f\H!/\uw [^ R8-cc40# -߫r<62PࠄQc9T☹-%lBr cgV&:B'$Pz.67  ,b[ a.scnV HC^۞Ѳq~ӱ# z𬆧a c044?whYZvG^sOc -Q+b% %f1#f=`d*죈E ̋Մ|띕|}g,@75Ǿd 1YoN x㳁KpQ#sFjlV́z"{Ђ:F$cG=QFgz 5 ~c XP|,pYCtL-a 9%332w#=>ijVH%em7h3]. d,_έMw s AYa-0UtK]`Qr{8ǫ7Hq G4R,x71%ju aXK/EUL*yծVoBPVR0+:).gF+D䙪 98k@ͮɩ9aX$'fBr_O-#צm=n]cWܫ}66LEL9QS -Po~c4lj숂ׇӳ9dF cZ!=6ӥgxU"N,-Ek]#d-;j cȱؤȞZVA4 9;R#Bӫ!q໸4tȫçoL4X¹ =ꪛɂ})#䢈_%G 21$N9`k윮U3&|XБ 0q@'lV]N߻[p*nj+9mW1u~@- llPK) e!#rwޝ{ 2 h%Li+ab&+_x&1c>m ϑلU(}4&g}Ƿ/:L^-bȣ`ڭiFO/lkMȖ~S[w.$n񛫓D`"jɩէ|.n]HstL.j%bTlht=iy8(n젙K m/տ a:f#A!,pΒ:&je {kk % a0jf|HM7X%(xǛ] ؚ* Y1:6KH]J7Zv7fА0a# ưGB0JweO#6Э&o\G!_OI *Yql$k܌Z鯹蜢"!bjJ ϯMX.[r샭1#{FL\#\897\9D߈EP ~5Kam}[P^Ce7"r\JF.y|lTT)%,"AXlw^ؘ%uȚBcL jQ=ƣ!t{ϼ]5 j.ڡ*.mڒ3K#;ahh*IYc%ǝk!9-۞F1vwlLL:ldV j?ky\SN/,7Q-M"Ѥ Y`joh|oI,>(hd%ne"LY;7Rz|iWqw)#^UcGO|ѥRiFv6YŒE0ַk3)'< -yB۠EZy^1ˣlx,{Yn- 18v?d/& -13>U}£LC}|ᮝCj֫&gmL\ 阕5Y :sosp! 7aD -5Ra9xSz<,`<%Y 9,akJXZ6IݮMY8d_p4>k}kx_? -yA5a㳐5n' ֖5ao\dٿѪJONL~7.VK:0 2Ћ=]}ˋKtLmO3 [sI&&l| cK)lkX 3QJ| -=d퍹ޖ_NhҘYqBoa*06OM-]M,L>\C]TԶ9#_/b;U|Om:vU>Eށ݁<5p#HoNOR dŷ$/ _@ns7#YS!.ry6rmzECMd֘M"lηD{F#&JCI<40i}?#9ا -p\AH gm=AKLEA61z!b?UJV'؅^m}Y{K, &'Elyi[oo+C~Kuc#fV펕Rcv!w03Q~- 1=3ѫV 4?S-Q$qdߋ],EsASpn_/L|2d3LDǬO-C)$t(\34EMquezԸd&p/A#`ufhy;a#!ϯ&#!cǽ!C+dSE/ aBF s\G54Zdskc)>->ţ#GD^\F8٥M1ϝE>G(YȚBڹ[ hP.%+fbbf.mgA[>I,:bP#;u˲4h3gYǍasc(bz [Kc+@q`Ae1]c]7= ۇöȰH?FlHɩ12x /nS]p"h.pY&"ͲF:hn~jF|Hpṛ^iNRO6!2I!?ꌛyԄQ6ʂH>1m`F`>OMa8hK¹1JgEԔk(⢜A-0EFG a}JFO(A ȺW{4>'jT-E5|bX˩Ei~ =K]RmOBjR{RP6'()I apy Zӊv bN*XhegÔbJ*DLyO<&7=朤#0C*jCW{(/E1 -*rk?.S!+ɹ5)'j$ 쀖U6JDQh@I)2N&:GQ$DN 1 V=20 Ⱥr޶}7fdka5ن2_+f hvd]vכ8hzlr cabr<^%"n@ [*k/~sl?ؐVc3Zק{61nDŽbsQ2aˉ_2i4tR~ģw#z*jOMX |Բx2mT^XPoQ|Ⱦ6$y&kg+.|̾c5;$[C8Ǽ/ 1J -bs0b}>q&1`qŅ Buç eD2w:ycU2"drXa X؛DEE֥"a" yQ8߁ }7 lQٸEHp!91`&llR^ԷE]B/w8=f0.Q CP6*"FrA@- wEC>4/ysq;0J]қrN(5ůij+K3~Frg 4Σl W_XW{9\_EE>~\-9FcDw9FN^\t'Xy;Gy߯v GYw*E˞ brHM+A]{g[äFGu43c` s9J~ͺ>֜.?2z/T2Fj. \tϐS -B_Itn R/q SR"JnuHI -̠oy'.F/x7JRFPN%_BMqz[):=+Ei,o5DWfUa%zC>յSU3!ͯA֮Š舎܋1A~"nBNMB#~xd9{گ0j185A3ELv krr rg힤Eߍ.Bk6k/n g .224%30MNX훠y9 ^k_TjrNw31Yz^PũFLVTPn9! ;~wdyHK/dea.\ .!ue }ӫb`~XZ! ֫l,nνŸ_|GŸn,?ڋC~{A1}{nޙN Q=90ae!lQ~U#?EQ~(=2pXѪΩ[ϷFxe1c}TwFߝ3AK]6z٫O[%&-)  YE$k/;(FɦW'5-]鳕ڳH̿=s5.uNjaŕ}a988{ǨiqZ]pͥckʎlή 2]z&`U=ſn \Vy! \8c748pijzDǪX]|)M"nXˮN؅`[-g9gGhiGKqWپ4$1Jz!'mc=oSBWo+|#@ֆvNQ;[};9 ԃl򘣗pc]wVًn{Vul5"I ؉?o:2sسʯ` !}4J*0zx{} ,詽և晦Ar~Mǽ 諺}Ƨ?yt,1߯\܊>-K{!}riAjg֧<!r_NEjuDOu/b.kh{Y|xk}1J1  9uB}Y=k}:}f#a@)մbOAHEdm/[̅>bsw/g'9Pث[ +kN;iJ-w1,&Ͻ$^X|a9j7K~ʃmiQf#mt{=mёq٣ƅ_W zr•W%׺s6wb/[_ ~tZVX+fM~g2@ՙwWGus~ff›+O +EY(E_WZ_"]7!,ZP>''o n8Iw.Qg߂,YW2J76Z8n.نc!ƑUڇj{Uydh{0bUVs 1^B7xYzpF؟>.=`RO+h{@ũJʆJ~ ȩ15-VS_N,CZx].c-ǵ ̕Q.#c!6&gj},9:"C{ڞ~E]gI-/b2\Ӵ]gag{ S{A핇'\gy039-d/v.|=k-NՐw۟M?2S]Cn5kys{7Ex[}n=I17$b̽:flؐOScSs7GD{um72:+tW\Pyr򸱣Bz?RF`JDurʷ)kgߡ~3KZBgnzE+={ EZ 7f0*N(5kiksm}qvUQ]{r&z!;í"GrW5#0WSS67zpWVk؞X?Qekxo{Jޘ9|<- -|$+x){$kC{W=Pgn});QAځ`[/]z?IN1NM2<= -w׹ _R4ly7gWz(5UM?V&[f"5[{EcGQ`~msϪx:?%*:n9K -&hmIލϦEwa֞QU馒SI )c<ĤUVTZ|S} .oTwTQq*^x^ҫ_MGLO*& =+^/$\|_u䠮GuC]c7iz܇Κߌה G Z~<#(-1I;̯pDgLtw:L7[{կͥ++O5g}9D)^g/FY>bmqϱ7FV0r6k/Ͽ-EZ'];~Q/5+*uw>o!np+/a}(H#>RJuz㤹pߴ?zU%}FN9R+셹5'V>`/,ucV_sw?k= >{kctgxYS ɉa%1:?~qj//o W0.ɲSRr1HOWH~nxGߖvKޥ\~sisn}_z1Ju@0A4<:GKRҟ'_:ї )>Şd3%Iz ui=撹iרӦUQ<2ְl=py>fME{TC%N|e=dmK~Ms#/ʮz?TeG)I 9=FBnh~r齯oQ ei#& +WcmXyWt<l{5-.uWݛ{Wރ{Eݓ#z\qτ ޒ ,Hߜ5ǕSi|F=c2ml-o}\qQ֭/( !fs[a6'ŏkQO >)y?oRҾ3tR7zpنg~<.:yx 0$c$۳״5vde ls}YuXSn.٧k,\wcS*O,\7NZ1iq֏0k,ؔ msnN}Gߓ_tV!?$˳]|uYP}k~o&.G3u}Wh1 n?g/hDm-=w찲).܅YF1;oqrV \&77*ji^1)]&ݘU}j=GU 0ڤ0cY~FƬ0˥77V?2s_n:qcv!U<-기p;CQ-,!e=Wv汿X(jN1>-Nۻnm0%9DJֶ4,;5,Yb?\_>;.o.8mq5-uJᔬavc/G8gԿܪN>k?6䢝*ґ$}+\F\?%w!e(}ix}IGX.=NzJVPp,RZakkkl/:0.LDVT} ,=OYMp lo~~K= }r7U'6Ib(Bw tO;&8ר#>zۊkJo T݄lk|> 8dDvo#ܽk(%G5vPY/VH/s 5Jڛm{Zunhy%؋G1{M[ p^ e?+.wמdl r,UG M s5zA[Wc4WS2mf83WՉcz 7m]iY[4;3E}w#Y)w?n} eV$4%C]fCuS{ Rw=v`M֕-%?RE.c;WJ2,]g[|^X#R )uk̃_ )D4`bU[^]Wm6ә{KiBKiK,@$w+AΝyp8gȑ -z`C.%Yj{2I|o G -yԐq2M6X?QsNs3p3[`/#D'<&?sOPn%bc =QE[b=C&/f>V)V_+)9W},*Nj Ub꧋[y/ܓܓ!t<.?ҥ&#KZ,=tH"vm5x/՞g[ce[elbXy Ӎ>BW#'Yֻ˂؉~ 4m2f0yQ/.}jɥv &8b}Yy}CkADcN 0)xoTo g9v-eQ3 -:!gJZ_\SV"*"M ;^PzOs061>#qћVܷk[h5)bS pw$h{<$](9[A!Ȼg;Y/ӈ$?ˀ[#QnMvS o/wA>껠)7vXy3$;骘sI_x 8X-%en cZxrВ7=?Ɉڍ{/2F7!mT_v_I 5<"vJO}X($61.wMW3Gɩ3Uٷ'Hhw'׺oOhaW|U #":K@ͨ(;b[Hn;N]AE>:d PsKP1[}CL($)YK7CD Ҝ2LzOia)N%f r2xS9,I^.x_=X"Gt ð0 -+y7Ha$T@eW136- ZnϼU;й;ĸSԌ{*nf1fpfL?E⠝W#V &hRUa[nvSFJ?-E˿t Rܵ)zӅ] (rma؅_K4$* ^ ҡa­R2,ŁG*pcuf9.SJ4?l3=J -o -LsZX6i[Mr8AL FD;b_ d8Xk.k8^VU3Yo wF/tkSwdMJ~Nt-uºSW`~mS?uV1q)^ъwܸSSX?}c} -qbCVǰɁ|S: /&pTqc.?7cc|;$R9ih/ }Gf$"fc^hj;,QiF9gR~,s\&]"h3x`oTĚ&Q6htjg9*4It+8֩;o  H;Rb}e^ =׺O J ZR;,tyIBֹmUEҵAjJ7.taJƽ~;>˺4z8F\1TN>Xa\ZܖWlk~s(6GF@xNJwɸ}ĩ2JBK %7Z7c}]L]UMYmt灱*Ks #AN5:soB_.9\0p$ IN%|2`NOIec -CC--dm$FHc/-I+ȹy6˳P׿;oHiyRJE,sOs\KƄl¶:^&pqJ,fV ͸8_M{~.;`sիRZ@@[&¶>.w<_/y9/^b^E^i>&obznQ zQ:S]4c] - -3M+u+*o7Ō k<*_i jhԷA\Z'UL(~:׀ 74# -2-v_dW\oZ2J0Y _,="__a7E  92DwPhbC{~4յ&!mzӟXT:v}L.~GE=QXz`(}нgAO cwH~;Yԟ,IEQwHjQ&{#tԝNT%8OObcciRcNb?}>(YI7ʀjYL/YEucl2ىR!ߎZ.r~(1fLInji\Yo^xz(-PA̫$_iж&yPC/,551*n/|qUvm DV]o*μP|5нAD5B)i}xY]2̤ Aڼg"bG[]eRFi셖VZRDDy8<؈-#J -1MC:u6~[AC(fZZRvQyy$ͩo|zr ߮t9k}Zf!=@>(;"|SDxul]MY* P -o Tc>T%)~s$$>&<)l—?HIq {pXZذs5q 5oPE1w];,h@@Atb/XM>MN3*ɉlWΜ=|) n 3iT@V5"6LJK V9&ޭ۔-}V JӢVt>/~a j5;2VвY؍'KhiJa¨HP+Aw.=vtEП>w(74Xky ξQJ #P0#Q>RExш=-N?MI=Y7@%r߂B=r!۠3O"1a~_fkM$tb#J^ $ K&=΂]vХ3N@}XR'5~m\Pw&ɯZQ[mh&xyJfſz z{p!0WϟvųSC_mIf y8'^ v0'rp ^ -:P5b^7Wё"g\ -zv(]P_=uЕ<~t8^53꒦~c ZUCO%~Օл~n;w.p{Μ*Dں埼z -Mv2_&筌3 0ym1Vœ!*E]IEd o=q?r tXK@|' a'1w3K!K*ԣV22V')| -wt"Ek/.s{UГ[wA_~8Iͺ/B:ajr]FMpJǪK=u9#u?qa *b޽z l?\ż~y{:)~g˃x]7W71Bw5(UD^_B?z - -p|v -%t [_OuȰ~r#P{0*HEggљ"^ݸ z٫WA<=y^~Wnq={Jƃ>2&%`eyYFL_quw5(􍢄_?u ?@~  @Ac^>YUpmas070av§!~ }WP>_~,{PBP(:-ٓ@77.=yP'Dz;?p(e{.ݳe,CC/ߜ!d 5ҫo_OyJ -x e /~[_],:0g7^ zw57LrzvQ·)kKrL7K;&4)dGn{yq0C[w@_׀OBD\ո4uGڔVvu>bx+= >XWu7Э3g=} Xˤ7/O*>kf)cĀq!x-?|ށ"3{ȹܿ%I ھND}GZ>[+4OUʫPAvD-tàBa~[MhsJ.֯4"8& 6=<&)<5%ů R׆p񫽐W[R&jq cMDP}|w[T'E`G\ȕ?ᙧ@O_b:ΥĠϧᘷF~b7%zG*4I(1?.R.sq٨b>]_C> #%}? };. %wSOK`vU4;,WïW׹f|+jh0w23p Pěo {]żz -]~ A?eOpifYcLSJbc\P>7܀VujHA ]tqٕS)~@^]PjX dJɍN"'nenV+2r[cy'{[*&L30[pBVEdFyHJoB~~m0(6OEx o6āZ$4 -oJ3@C/%nu $bJn btVDﰌsizx+q3N J/`=,[u#um`Aа0תLuE UNZ]Edc@ߢ@Q '?z&(ܔ?jAlWʁ5L]([Z9@Y.QfZoxЧ+m͡.h32UK) ڕKB]߮jLlĎ1u9@&k ÍPm'#r<%X^,5Vʷ(^9ˡ[YlqzMMҷո^FZ gT\)qACX7_ _hMUU4슦幧ݛ3\U!Z|p{4T]MUt7;Z2 1I@R!inH㲃ՑSuy ٬"rfɎ }c^jyfĕ1dĪa62CFe[(fC@ugLZ[/]YdTZ4TUuuͶNlsg{1eMVuÇ1Ȭ3[=¦6.PS#|5"j囧~AXYj- {tGI[#jr+kD=5CeR#e:깢>^fLU|s2|k6cBE1#Ѓ &lɺ3D<7L2̚kiK:~aѲj7U[U<0.jK1)*],D3fADI\%DZ>("z`w_~m׉ݺGmVU$ v&q7 _{lkCSLtM䪜f=aEŪpmxm}CwAXgTrRN].uCY* 2Ǣ@h -ɥm5k7z7Tz0)jq_&E(= u糎 שc"ݛ6!}OGGW8 aJuYK)6<_EUz()h,LG:e쐝{ZrYJ+7$_^yRSrDٟiA - hn.#dX嘤M *iacU+u㬰gDZrmr|GEq(;ww%ő,oV53WohXfd$Шm - -lE;Է8T_@;Wd^140SSMH5Tngs_R?kтvo [<!5Mo1e^}]]C:&Yo"t4kV\x'6v4qY *,fەJGّѪ)7[*.Ӣl*\M+&IEQd7$̅>7G۟oiXP$1, ]{;he̴^ꂆ{|Эl -zME7N"# -L?&𝬱9\bU6+82dZo+0dSP;bVȷhUN')i.-.۫%k[fqQɛCEqlܡ9 gɥ|& !`C&*mI)c\3Q4Um@(>X"Wޜ eW5۵L$p.Ds3\ *;JsI7$@ .,%Ut -b$z& M*٥Qؔ92`ڝvgZ`\G v Cŕ_aam14"'yXxTUպ"rMwUt|.Z6neT}=Qw'p3|Ggxt,wZ ^kRPJιƁjQP -YFgF:CEE{u8Fkb}͎֭@8:jH|5F;TVj9,84_joZ**c2LIMth){\[E}sDfD`"Lqzw]]F:]11m} >N ]S27(;7t;xEbq%FG(@,W \9vzoh\rE%B-;"ם1XEN:1_l -3[[2N]2L 2qsmYp8W۾gip*xQ6, pXU1L E75 V@;}=U$p$,9|9mkfSGyn5bӶ+CrZIDH'^誈պvNC;-p]4t8hoq- [ QDLUa?koo׶Cn[ncYzawOӰQN~طȋ[CkG*a#Xc{[}a9,9[۶Pg".u?^,x|<k\a:Wt]J_8GA9Hx Z>ݡ=,Oow@yKdKڦ)+= -sM˺ a =+ͲK>¶$YXsr8+jU{M|3,ujkiԣWkeֱPi-܊9-{Ra:ہXtI냰sKomS!اB{۔ -ywֆ .p9@ޖ8Y.~'f|{Hۂ)g@FqKMerjoӯU'_2Ivhx~_6 *gc\j&̣վg&qY,Pav1\rCIL#bX2rc x$حd]3M}-i|TPb3j|EG6<E'j! +=%JjI;ymw -|P}}h3^W2x.76 tIFCL -lݟcjrUr*)e)rMM:%A|τV {5f!$'mA5 qT٪IN &C/QQ"C >4TW3w"5\Hx;Y b`S,6.'xs+F2ng2=&-Hz1Y?W -. fSbMRbG`@G㒶E]1\PZ4MsV!6 -h3N *ɬ(lt88Z%Ő˽iak#oja#[7{[+-5)W#ᦡȝsߋEI ܆NoKÀU7nM`6'NMucqSB/6B>7}b7{KXDQĮ V'1)sTwSC5c_+$s误]1*1DՌ==~RhUjdu -Pr \(2ҭc۴5}{ tUJp\0SAJrj& N5VR3,GM̴Kk=y/=eoVZK_=v|h)7۔u:Tm)үIڡ["EBύ"hSN(vΐRrW˂ -`i~Y+Js34C5+B}5 ">DD!agُ E|%|;\LwGBcs1`/h+ 1KE rR㒞rsÏ\URP_G.&=k[}d3DZk}\s zw8-lmћA]1£7G :!yEK(|=3MW~c^Տ 21Ou1 衞zZ*d_G,>БJjBYെ[; YC"m838[tY΀1q{&pϰYp4pNPVoKVmCM]ŰNrR|zjgC wI#o¨I~Sq? :&Tb8v&l¿jeg@'A -ty -:y7f,Ϻ{KU{Un::4tCE(Y>xcN_nrd$.4fh{{e7}#84K0Ԧe?* _'\Ϻ}-RBWnK`It/'~.r+ĸنҧ11pCc7`׻Jso^F s2oS^بaܻY gt5~/[>^9Zg"&*Wr"}JݳEB*iY\*AZn >^*Zxk/ybezUIxn#H7 1q-kD4âϮA".#j_G?Ϸ<%g[hG( -I72_:Qiq,̫O{*?pVjLqCt891G/?NQҮ0dԜ^܀x8%'Ĥ7w(}]u@SCuqpЏ&3a1S6BwG,%okүOc(ɑm4g?Rs:q9!NCz瞡A7zgqZKRnC(5gW{{Ra|N:'bN1 JGE/*}$ߜf]C~<5{{r~cWT^(+Rw99g~n-wͰf9 %&$8PE\g_xhiTSrh õ!%k.2 v-fV.mu(qp}*663cW:Kk-cq5[|s6}k v1,@eXäX߳^ y4GZ~PI qTGDiV_s.᣽*..&pwsvǶ:|㞊xu]UI>ߖt(h8h[Ӹ]1.~w|m?K6V6Qh#Jk]@/=M2vFڒ=Q; 4Dg"i<$99R!OĨ7r_9'0:6ǒƩ4\x,gm j[ lKCuOq{*Rk - ],˿օ|j>9NA&?~x\Z2͏xWs<бvRR2Ɗ\1*BE2:4P]?ALI~ur*_rw$&FifCF!8qeMy7oG -wF -_X G1Nы*멈8-&E_o3bT'\Zh-|2)O h 694^F#LP7?B[%?wh:߫_,{Pb=Ӥ|CG;e#Kj$mQ RX&61n!;M->\C KٕkE~MR|TQ3{o,~U1QC7 +X_ιپ[[a1Cd?+PRg -X }cֳԦx}u+oJ5+ta Gz"{h9 qiiBM@WlGAʛnĤji֖q{/iz)ye63Z9)ۡߣ l]i7q. y|OZٛ,?(I9VN?z\&D*Ⱥ&hIư3 Qr$GI.YE~1ˣ8rg O}w\j_C79-6,*y=T`5Or&h2\XlgKQȉƢ/'hIϏ)9 ww _~y~2rBcd- b\, {ǁ-/ƉfP_Os^ `BuЍȕn‡kU!g:*0 BWB!v= 1Pad#Rw$pv$^y ת;C.k~4θД"[eRC;[ͣkB[oy{ZJ ]ÊwjTʪ :~ͱ(? #=<8f5o-گf|˄EU-0I(?G:ݟe߷2,E^7f&)坫9XbQ}KLLvLSJ*=/[@,yݑ1LѴ=f[el&vw#B%03]c"5-6 XWZO0N% fخbmc|b3RSA`(5ͱX̷?5 -(RC= ?ok?>h昭=\Ԃ~']Dy44{{QvEh(64AJ]Yj[nI_ZhJ}=(yuAcPc_f\^P?W%<0.5\iH *ɩg93oĔ[QJ)INKTt!'yqy %2\G%xfyz\E ^轻ڼ?L&uNq\+1`{  -wuTQC "u ~h-%sv|眽 -zGHY"9|W o'c$G6رMyhcwt)1(o~*cJ&hsXb\#*i:?J;5tOSs̟c2Q"$*afQքM됬 -hDl(cW䎅5L:jbudľI)QQLmVQ0Ay|<9*?8MaJ~5Nｓ9t{(NC:ky_l+#moշsM8>^/҄kkK.ARKY!51Oھ54k'; -yuY"R3؆va1u}wITvYq Nŭ35 blp>4wݲ:YTP IIDEL[0]aV#^ IKwb;֦Z_lNcJ5vMKڔlJZh;>zpXBS03 ]t7)9 zM2 /N>Z\\럂'Tn/m}:('7.*/kշvu(cLyL-/cK}O] O\+Jl2;:rLk - ЖưU6ّk{6Jٜ-*U) Zb_NiH ;f&.e@| -rmXKo7vH5vO5:0HXn}>ӑW0@Nh2Gr[єl:utoˍn5@2]cM#RReLl]`N\= '6(q6\= =P~y}Zm|gFD2~Uвl=7*-"Jt _c 4X9cG``ozogrLсAٸ-%% G9rFa$Ȳ_w8`84_y,9❁%:ڞgے4hD-H;ZZkT ό(!i%P3e~Y\cGZЌm89i>ZAl*xOf "UyG!;E k$N Ogrꯍ/:zٛs20XG(<%jŨWVԼQlMgm5SG\ӡUgv̏( - z`r/;zl]6aNqP`CYGtV^YL'qg䜲 )Eц;qÝx  pæHkgCJ3>;&2k0x+kؒ{xgVgAˮIhRHEl,(H-}}f {[{31;G;z.1v0IGԎUԒ}@Lw$m-"5¢K; -lӾk ~&$[E WAoU?T(=GLw+{w]RL.9Q2?Jq=0 -R^Z}+K~[_tnynUT E]3qBݣ}u{Ƒ8bf@ϳᗐjr~oJS7ۅW6GZo!oϬ 3 ,ea r[i5a0!LʇU6؎P)Cchn3sksl\fG_C.S|3jg_C "ǡ?ʰ.XM$z*Y չcd<쮠kר !ɅWz;/|t:-y{IQ `#RX`v5ޒM6k2\Yx$2eK޵HhLËw <ƮC5Ӑ - ض緖XP3>nYz0-e{59XAE{ɑ8{J9tH{dcp>GGvAE0PQ#k|jk`= 2rwPyX޳ avM7Zil=<СLF`oeepJ/2~Ku~߂ Yk[O p󭍉{ٚQ)&p[;{KLiڑrw箉<sYQjRxPS%"0W7Q%)^|gl^@dF~w+.;MŸþ>'!^52vO;{eQ-I㓠!@m91ӱ5HOh-aH[{dsqlg]vQiCwˣ7?]]1n2+_s<\lNLX +H!0l۔6=-|O] WR_jI1w,p@ 4O`rd4 .k 8,7E|,>a˷AfHW=Qkbա`rvlŴ8Czt,=p"a -$arD=58 ʍzɥ1lR<9Nr9D_F(Y*yD'Yt6q.%wr132L^rh~Ĺe`힁 -;p؎IHZx6y1Nྛ-9IA=>G\5E8Ȧp}4& -H{N -2+5@?׮O /Q-7Wk_Ԝkz{\=<<]+U=xccnT@5pIHV[/ݽͅIk8:L8ټ#;tY|v`_C۞CA3㎒|#0C(>2w꓀_y&yj$l| o]3ռkR7~}lƂv4m) -Bo`فքrW,wzcEp#oc R~}m lmS3f3W]dm1i_04HbJb -TozutWzQt~SStѶ1K?se,s5%T<4< \骾mA3vq jL_vT! -*PE{]dɱ?/S3G"}/LLuKƍϿ=0x|wmt[ĴLGʐs @YPV:~J'{7cϵ>\=g`ZIc7"*: }kb{W;ҡ9Z̘jyC Ca 8Ėtl즂Rca,U&=|cATtrXzMܞWwW>k1@Ciߘ.o%?H@ˈ*D_ ±B~֋INl]{ ?kV/:~oQLft _oc =$kS 6sOm{>"ԬMڒ@Ru#Ѐؖ*-}-&fKhw_9xć۞q[V"~fsg9TWCm>$}=+: HV{Zے*.|sC5 -L_xn_恴-Yg'/SV:E>H 2#`/4xUd՞alG*y.W[ + ܱ -ړcʷ&rFm7`?J!9!9x#<ȌɈQ*/BT] EqCEDSL ͍;"O`h@ZEJ베Ůxh&öoL3CoN ~ۘ'ZU翘—?嶺mX6'0RؔJbI(2[s$˿0[CW.D׾睟g3њ haȫRΊ/n)Sodxgvs5qόT 8ؖgv{g`Q}5~;V}~p'@ -5?I_zjnMRCtDKdsʖwɾؘw , 2x}\ڒOg9aiG_tYx#,)SW<8"kNVYyC:̦8iWA(,+-¶{ -F!Pw*_3:m]ޞH)0yH"4{[Cky)$'/32N\#2 l>0F6&GdEM}G!)LLܡEHUzq_ϧHE^@st7_7޲^_nӪ+JFɅ%J@UwӍ$^Sپa) nc]Zz[_n/>6Q!3ZDؖ_"#O$8Tqt} '$Cm 7pTf@/:ҧ쨠yܚG_m_zEA{yZ{Og% ZB/1g-`fuҠd13/>M+}2)Ӑ a4$MRl:N/+ /**JA g'OA;)ukc b$`[huM"j;nx&ًs5ϿX^Xݘg'×FRO\trD+ސ> -9F2¯a1c6n:;~-23Yݯ{ {hFmovQ1-uu5#6EXgmJ?dwC2\_yq+vOgI?QK}59g0?(?xDv;I]s쟶;^%}v6=phXRQc잁GV+T𕽷No[ƷҗYxm̖*rY=袥躆|QJN8Ut5&5h`,$%^+ny!1V|?,iH#rtC=JbK@ӞUCJȼ-–M fGdY͓JCլS;} 0f꼱A@BZi9|=MO9D xح)j.c4"RxjX-l¯&T-cnO)} zh#BM >\ºsȒkɰ -_9ݑyƑv)XY3VTI֜vrW{Y@N2T2R.i#/ -X&ЕO&<so~]:c\\—K^A']8=U|e=?|-z„k_E'67WsgM\z)n{kz5=;+w#$,gx=K(y <+uob@<ݘ9*2e 0gSȓ3ޯ\r_iґ?;߻*zbGUԴ+wrjXYE@oST5ZG(+DJ7}mO$](ї_ò.~2|wvVooV:Y##uK -}'Vl̮Ej`8$Y,>.i9ּ5xkV]02~`YDv#_@ -~ -p*/x{+n6aYKꊧ>&dO5ՋP{ƞ1 $ih1y?{o[{u/$S*xUb%",TxD@FX{|U,CnJ_@xjC%~k -TF,ѓOi?E5X:FG6&u[*2T{'W#BP*cz\_S+'}`AؒυMgT5_=[n1_88ᖂ_WM-Sa)2>{%\r;"JBI` .ؐQkjzㆵ,Wh\ώ5t}gSό&: ,OD@3qٺo)_q+~9 {wFɬ̼wWc`]0p0zÍ>ҾY\κʧ?ۑAAFHFdO-M7 kn˙?ZT;9)kV`XhKj^ #%qjG/H^M'g[A61 7ے1ٔБ]Ɩ,3qd,W*E O7=6nyŕËurBd~'Gx`c 2-AXȏF'хQ.׷IqEBw -;Ӟ!6 ,| a{: }@*0N#&1%)dDLM~`M zvL !-D聍ٳp:&j_CnѲ+̠rPJϺGn#3E[ jBՖաZHg_)3a9:CmlIܱp^ )w(pW^O wt+*FO+sst"a{Wmt S7iVQg:l@h.'BOVyvowK_=hxgK *(%JwpW˯0K(:;Z貜V~iSEO?jS{6LB_0kޜv7\wc3zNm3yn)NRTt ռ>Qw79Xqm'jN0j~{̗߻!r\odyJ/*^$Oj))勼W?mwSg0u6nZ /JI5?=*Ж6̟%\_ }wrJA)J|l+vW6F/wAlNUr6=+&z^PFp=YAO #%^-qѴgyFOѱЖLYH|d6}X%BNtB` 0М]5=<ϑsxG LZpAؚf8mA1hN fiM_Ga3c\`Vܚm\gevVH-m=cMSin77uf\5 P)`P6}` >z_”I԰ `*wHls;ph,DXPXY;yda`-TOܷ066+kA9Y!4hlv'0"oPO'IAسuq˽͙G־[ NmW"iU}ۣ7|mOBK -igi~o0#O5tPD˄[jt¶r,.? A+9i_f|7_Y L~2 -۞*m/ ]O}\N@F^ qu#ݥƮvU f* knŦh;,=]5iChn~2ͺ@)$$Mpa>K%U㔽'@>^Yڏc SSĜ_]$ORH&㼎[~34t3n~6 z{O;fڞ;{VN!3ĒMG+ v:{8:h R׺nG8aw=%Xfx֗jJoapeMr$Ÿn:UBǁYwg1&ތrM ޝR2(w7`i*L( xGM07 lRe[̡R%]"cTm~ﱨ{ -`RS*n- "6v6lMԲRSoUmζx -ʐCϭf!zOyorC -xFD8Imt֟/[枬h.&w^PT:@-$6mͦNjCЛSJVzZӻǟ2+^QtTͽUQ953κ[uCdpνSԂ4SP#ɿfpvWܛg?ny}Er=# Sa ;-/QЫh1O3VXvG_n5{'k,S9|)*}.YkDuT͝-w^R~GԄC=Cgc3pX{F24Cm+IwӸwy{gݫoP(5tbl̔^bZaYgEw7g!SyxFL);#  -tNHlM1ܛQq{c[wU X7~mjzx4) N%j,`CɧljV%BO' 19dG?4x -]][{A)%g_=!GO=S)dʎ*?ة*nB9+=57Wc= -+ِ8Z}iÀFu/"c6#LG䙆&Jlil -ӚW/Liv]H15GscP[wȜ_VG:^{ĵ'xfI)BWF*i +I'6^瞉fh)X-a-eLG -JՖVgnPP=P%m-K=S (媜S3(A登ko,~QKX>w󜓌"(@?wNr T{)I[ҀT|mI`{+9\w}g홄Xp~}ZǪ[K쟔סetmkŚ: Qu}k߻X-<m jCJ,1OK|b͐][桽-"uQݭπ[晇ecqSGT':Ud&`"[|[y8),y~"&bMؑ ,5dW7P͵@6 JzS<6H?))wPaT+t4h$9\$n*Ā˯qʇx}n۳8٘'\Z?(,-0ji5td`=#8Gn-zzMlv̑KBz.u{ i5AlKqM> ʠi{zdyP*vK.)&[¯~0>6m˨ -J}H\L yZ9$c7Gpｧ%7EBᦄZ%gÈ rA]U;+oO5>V چmk󜚛 -^@G44URudk)ZaS=kSJSC;3v2~`6lkP{+FkЗyd -hybɉ>1xU=^nX-9+TT~1si^9^DJ{(ޥOXZƤcssofSvR@l k{ůc#-s**utU}a K%LEP)hu~%+ڧY^% ;x]=| -tvZE?JZhFA>y ,Ȉȑ!3s kR3rd=3ySsQ`= ڐ6xurI@i\`ԭsè:M/Zx -&㋂2zcZ"NWŁDo5ψi^<KښEưѱ2M)Ti2/-#7;3~v*I5*~Kܠ2 в`>%.BA>%<'`y XyL#K)-##6 -U0@nx({t _:HؘmH9`tY_w`Ƨ>)4{[Gi6uV蘰XomzdɻvR֒k!"Q̬wP*]='C;C󣺶Yo&4ĺ="*B0Q-j`jr\c Pv¡-Ss1&Q5&^4lxacdGv.1LTxXOڐ -㱱v RFgZH,֖X59*9ű49j6l0^U%BeXMm5s臫{v0?Iv -ZX -j¢tL^}:, --9|X%'ToiE4΄BцFV}Q 7 B3sՀk5ӫ|:r -h/ $'ՎnwQ;%%d $>ڞlx6 O19!53h=NR. N k?qL`̶-y+Ґk4D@1~]ڋ7KMl,Cʢ>5O-vT!NS6a`ǽ 5۸mҳ1y\sD|X Xe!5̂Gt*4[MtigC=)Gٛ=3 m`ٰ+rjK'(%3䪳kOHؔ@lcGxӒc@|.Pk3:?{IAr[Zګ~ -!BP ~5|`?Yx!EgTTPT@R\[Eͯgn̷VA^h ]V dϓw[?D,&AۦNap𭰰)dKÆo 1[U G_W0.} - i!Y"s&K)興8mD]quMED;k©]4PJr}XhɺI\PY@l<޶I*(F:`da˔6m-Cm=|T_Dl"5Gx]skmAluM7{U1] Υ~`T``p_:ʨchlimst8>]Aze%T&Yͺ1Zv> ->7PZ&)塢V_u,"{ 7 FA=:jBڨو}@/[c٘]зccQrju%5\T7hB&>k)޵ -vV mv66O ucbPLlcеi14VtRi̜0;'TwJZ,ڻc V `^h dM*|몄{b} !E oOXWp] "iZZdmjxMy)0*EO%ʡJxnR% "S:`Gtøw cuE/է7 |ZZKLG-70`zմ|Rl\ģ"q7H' Â2kOjϧ v22erÎ}^ؙCشٵ fI_WAƪbDCtc4_#ǚ%|}XmAg¶mleݧ&5ࡗ;?u&uaqȇ;=LR.gie!kdo.c\rrwo2tuBȿ-2yAodxhkF˳ᮜ>NtdtOZoic&n@<@F`+_.A\N8[!7,M>mZb{k -E1eq| WVs|\!,K4A USy iq-_QQA6D秨&A~Hl]߇̮=1] -ҝbw "4v39<}<ڊF7u W!aaL(5Z!Rf2Fs4 g},BRAɹO/zkJ҆^A*iߚj]r0SUw\{4_^i_hޝmWo/[kǵ2.lv7I;AZ_mk!B[)Oif+\"7-U7@' -#zB -Pi?EbMM+/۔|}?g'+T57%N RgGD"ݐF.Z,DA5_{؉!3?R䯘8#xC>A»^r;evx6!2/,Na9TmZf՘IY(VJ:eK~D;hIrf9Ak/S<>e;u7{tlkYS[삦ld恜j}jYh sT% -Vbjgy%́Rΐ7/|VK> -tI:2Ln_R'KN?C~!ƪa(Djъ_ޗ#7 CIx|s#-V -OPGOcLr ]{ONݺ{,lӰ}1?ZA4ʻ*%bS}s_P@ּJ% $->_akN.0`5kOttȯs>C*jfɚ8mc\޴˩(3! O]>e]{8Sgoݗ97n8:8:^ObK~s+.񢯩'}h{\נ 2EL%ttMmUW%J'2EZW(Yoo 1Q iº2Ⱥ/% -*q>^bO9'E9?D&p -rx}/i<g/dh K&j2Y-g -EVuxv#PN9  9FK1 pw^Dk}H/:8 ~J{,-*viiRP<(ŕmP^)Y@P,/ѤW0^Zfۍ1I׽R=|y5|Zc^[GڔVifeD:f-@O(k~J+#kI€yp9\BעGn$!*n6&ͷUyS״I(1M頖} ?{ĸQr?z\Ǚtli7b5%j2#5UŢ/euƕd`s*D{hl ~ /ŏ `#7G΅?:y~H4B -߷ՈҖ+Xe5:j@sY:Jz[8z'6_n~ykቕ?EPnҨoLNڒ)w zH-ڥ`#/}Rk`,w_S|[wPo?$gWk*5) 7aLIKJS1MXA!V<G=ÍO'dA}'7pf-G߲].rE9+~]ÇZGH -,)OSX2IxRjwK!.~(뱙ew3Pmϳ gT[>Bhֵ<(~\R5;-mʂ.=V"J^,՟v keO]Qrq]rjSѺMK9 ~1rb )홇Q:wE<7O8uxEwZ\r*_]wsΒBY`&ϰ=\XR>SҴj!$ŧLx3IE:gMb0lf4WO(ZRd`ǢjfIښi^i8W&p\ Ls9R6.1) ^/,K*k|gMrnڒ6=ȈHvav{P^YďQ"J;ob^8AlF}QHmn -3 -`{Z6:RG[eCbݥojT5jU@KO|ㄯ3=LHz +t- kFJ᪾ߔn8WmW)EԶ֞$-Wv6k^%opOɌ81XU!IUY# 3JIYVcOWKR1K>ڢ.8F'S]&E2ukeO:Rڒ7n7({F5RY/>ݍQ (1Y-bJdNMWxzaYu?Eo'E - N1R?&*5q4к ݛ(X5qzID+5zbɝGo=H5[\ɕg%Yw]ε+Zʸ:+Cvj-m#*xc QQ*7 -h|#^֦wK2!E'vZL=*e\.VpT^3)i=k(6у -ċI:^Q:U鹄H,3Yg֩BK[a!AЈ~txyclb 4LpU6>SHa?C3-k2%kQXWEd;*yU-.v9.M5ey_߮0YYӃUIE3"EyI+Z+jD./@;s]X}4^׸g(.\3V$CCyٮ87TcWfcMp\ (n눗4Djk-8 ?Z3s-c5pt@Κqnb&KX rp=

ě4LJ@#QTy%m$Kv` )#:T94V!tqXX5u+W ݲe-"-ԋi꾺q{wfW]lmć9sU vG&mqY[Pe8;-yF%5 G5kClȩbi*`w8mtբ^KCjjۀ9(6͢p_UyA" {J[dy:RB^}UD=76>6 a3`|213RY`wB,>AYYNWۦy؃3kuRt -:NE&:dQH757Y]52dmîvX6L|(;wEYTt]]:mi3 -ÜM1J\,\>9oKʽڍ?-!YPkZvpzA_kKSu"F^V5mbʱK2tMRm&ϕWZNZMU-Vm N+, -'>ʛ -q tP!蕪ECLDDTj@Vmp*A&=o ]/)ʺYkvj&+Xj~^tbBVWEPU ݦćd$)'b*q6XRSGiV [֔ 6 W%L7TE;C3rhdY(=Ѧ))PM|(-{2C-E+sYNKYQvҶ!|`Q2">bO;R21p'&l_K5=2lLfRds 0-bD(&̘"u^M4nX+)v!\Y|>Sy9 <3e&ʑhbk ]0r5iu[AZ U7|푲-*JC# td,;z_$5ߔ#c/(~w[8ۃ:WNJoH‚C=|qdf6GA)"ZR,_0D}=В2ZPsŬ%'cJ˸XR":?6*2,v\5ԌSK1aUɄ2_,q;:.bItqjOؕiFJ+m8 -ʦA׹SMoy3 JU$x6ϥVmaGU"[&J_.&3,̟ 20'צafGjz&Z6|NF137ǚzWM˺rhiyd'93 p-4zJiOF -endstream endobj 314 0 obj <>stream -?ZL}oWӷ}%-y"& |Tgr)%-bCS=5@NjB>_{8%ڛtGqWb|ԑaf:1@GRMZm{"(1gc#v1+"\eMg|ƚWem)jKR=טh%b;y U)5VSwkm?.Peؕ^`Qs8BG+R IQ7o'fn{}ldjjucA -c%NWsD;RD P J$Cc#}bu;ue1ŴRUݐbu )tcdC}t0RDG^C؝j⾑\UL4f(G/k;Z<qZ*ئ, VlEQv)iW)+䗋).L,hUQ]CI>SQ}9_VcRз=9!.FٕU{] QѳZHKLkU?%/ܑ~/߫osmk/J<3Gf|tQ$ƤIiW3W͕ -T\̐q1%\N -wa;CP916tK/ U5eΗWO-|]O=`L4,}py]}5 eUu>o]!WvE!SHڂÜ}z8XF.>.b=~>ۆr,}7TоX7 2WGݷEܚNz3@H[ -lF?eCh T{; -^85&N ړdMvG GzZց%+ dkЋouo&^w;OuB?cnp!{R|TUңaZBorJȭgʄ˃]+4D̓ەm)&d]2h,|8V{g1;&)J^Pa}c} 6$℧X^dܟUUz&t=x]'GZt)YW3t]u)q>4sha!7w{j"g- an 6 fWN!(c)핵;̣qvPYE!F}/e004&ٖvG<qPQġ8 kbbw\GNY6qCؔ=Os5q:? Ʃ^u&_NUTՌ.֏ږB=vfn[=5K[/;T;3=CzA{0s#.w:c{b![JU-# *9c~+٘tl[0"R\r6SZm.+f[*6ؐA}W>o+!'y5J\ `{=k}[+c˝(7)DlIu]73툏JnVbդ#9uGOǥ~7ƒ 5>xzgOFiYbO ΦȻ/׵ЛWL-d%;SA'HdžM)e1\mꃵ>\l/=raGB ]b%RLЦ{v9c[Hot nxϧn>bTL^\݋w >|>D]mCq}/gy@GZj/&.G1%7%;QAX_W!v)u ́ !e[N)i2 -2;I Ą=53gUb4/T|+Jq]|5 z%+)۳^e|4f'koSM½5h Y| Ayݬ=%9QOț"|wlJj{``"T}- mo H# 'sLDֲ Eqk4'kGmi. -}yY(.gC>PEn X(ƸRC|'yQ\y.1zѶޛ<]?+m;Vᩙ6I#!4|a&f͵f9pIW3OWv8J_H{u'%k){*bԮms3F!$δc<'^A 'pgk/oUH -Z#,t]lR\஬(ڗ4so6ފ@ 0JVJo=-nOۑ!Hnw{b _=J:KSq6ƀn+ (1οP`BI_GA#^2 gMIƇ⯷D1l -jX s0Vt<kyoI@JHDc+񑁜,}mI~n<6E?(&f}ՅS/EY=W}SG -ƥm gR덩" x 5K{>cP\lS^!>B0W6E0hԦ߶ɺ; -  f[cUfF:Yt>o!j7P ku1=V5:u'l$jYX7٘-{0ݘTbut\ 2C[˃1.|]R`UCMaܾ04sc:>5Nxad^퉑k%D/P [q1WU-D_/Kp_[2SC~~җ>XhCQ簸OM%}W{|_k˾ޛK?ݐh "r?,X{s k^lv#w帰rZ/P!N*Dc'Y ,(l kYJR c dVϿПei;eȀ;{J:2,=>SiZRnr -CڐJ3|[!Alp^Og+si6wzIz w[}YNv1XviGLey.:RRpa:hGZثDKsk]mƳFL+19!+m) 5p؁P2o 7 xu*t=Xb%ԄԉWZ=261>l!Tmژ;Ҁ&kf]sZAĩ |D}G]Y6t"}j^4LK}j-uО3POmȽxFXh'|{!öP~UCF>aEB -3eԗ7.95 'ZV.cQy}n6 1bO#@kvdq] |m<ۚzy9U|W{>GʈG}H}%B/ZSUO$]I!Z!z~Au7z&Į^)UA=-{~)͆nn`V=]H|蒐gnBv~=3T -[Rlо #z -=@ fP賣gqt!Yn9ε7W?-`Q$+bUı;Su[NWNȧ΢Z -"7!Es=P :jU:]e(0Ґ*.[Ct!N&&=#ζg~_}2L4CNll}9s Ogjӟ-f M7ӭyNRUN7 g}k };הഫ$D%/%۫]ؘ?'K쮢0r&R=ݙ FVYIdծǧ"{cRx`Ow%k!GkLM)nv3v4F' -c/M 1!pWI?1q;C59~G`q!ĜٻU 5D'n "f^/;. Nڈ{"l(pڎ8Pjb .p[O{:X;dEZXPlqeK9dd)^j(ijZ8 -u3̷\59+c)@, ӭ1Qړi=%)۔½6Cum2ۀtҗ=3jwNe]]eVHVg=ĝD)2Td=-Еf?"mih&*.,v5S'M1r맯C}VUÝۉɿj6Vﭢ؄χaO/O@ 7OcY{ >+=`w0&jn=ꎪ4XFYj\XC 1!N3]U[c-*$Nؒv|2\{}-9KXۮ81 mΤfs_/,J6#jG^ٖ -BM$K"§ -R{+L6AF|aa6dc5YFOd6ɱ򢠅|w)#쥈nGI/Xe 1'⊿M UF>hJpޒCZ}p?D_y`ߗ*OSxa2ח8ٝqqБÌ4.?ohqlоpA@Ͷ'^Ns\82slCԤN+P%kq{Ld;X7ڠ,=5!j{뮌9U#'%Gijf FЋu11ڮ.rތW=*YW>LZP: -'#3r# -#8[FlBT'%pya梏ut腙ؒaD[0=!zSFO$ݽ=DK x.gz.zc-襤_OtܝJp[*|b/*hyy Yݾ=hWy㭨0 'g<.rVt0K]!<6y hi1S_MB]u|R癅?,_e-t?w_3\&dĦ~"͔РztZծ\s7,T^oˉ{t}d`{YeOtV9Mƾ<Ã̅L^x̩;qPz.>`۰!TW[JNJ?w.hi‹6+'3N L0)AUJ[yVE՞< -F$ocD<ًQ3^ S2Ebhjo?j+MɈ_yEJjfr7[A|:H ~x')Vk&]2GZ piU -YME*2<&_H|zPsjxˉ}08sm1(%mOI\\Ksg¯ݵ&3dkRl'Xmә.#EH aWGFZM -ܯu0LJ:p r>h[aqvmM遮R{LHI_]6%)}^Er]$jr{+E m Y0.RB'>sfx;/X"1|dox;jv@;Q ϣt3C|=5- @^ _(y>ln*4 †^LY'clgnPBnYX+؉V5)5T\p8ʁi RBP;OM|_hi7:'>w_ {<4m*T } -,$ّ4(>l;:oDE)$b$Nyk`TߧE, Jg M->?6Al6jC#>=cHɜ}Vu]W4l² 6`M:{o/z_[*)X`el*I#@mK3}Qw3>p4 w^~ԗj+qkzf~3!WgH՜x{`7܋rNԚ;*3xC/PD€۵`#{OF^|e9.IǺeԵ~7B's`_;gFv;T&wnN}`* ծ!$C}P3#+Wy5 ԑ09lEŞЎCM &.:2/,1Ac͢#Km31T;Ր3NneB R kns-u:i6# (: `o7 vl. 3% CMQq.sB9Er93bvɶwƸgSm9o^TnkmM3ubfQN HQM ->. ;Pc,6q'F:bYmTОWYʧW5}% &XO˙邻tC]ͬ%'e{홺wyn{l$p>S^t/9ߏǹXD}!ly}CcE ~Vy)t}}ad|Wmo$$/֟XZ+S" (I3p:s1%^/.t=mOF2eR3X]rw5TM9y(*$D?2Ō^BK⃉'A]Ux'&y6#cMHҔv|w/Q]so"U>QgJjlPKChcEcYu {Dʺb,đt_B\- -婏Le1_k1g\__vxF ;R:xseS!jxL@=*=)/{S%/e9[_la XWh8v+m98Xï gZ2/?n*zTȟ\KkC˅fm~2?zuCN =lYՕr5yF#q('!8[騠!zg -Zd^*k{jV$-YkRF$X{tiٟ_kyo@\VZf腗 "|M<ǃ[]CM֊ł-sW[J@]?7sXa\N#EC(3͉=h/@TV}2ƄhWs-ϲkyP1[r6xcfufCU]R;&j rkq)5EvFOcԈ 1>H_}N~ߏ  2U01H?62^/YERTXm+mfycB4ى& i}ؑny3QB}pz + -{÷PMI꣱FmsM*2^o 7s]vϻ -LԪjn)Ox_05e+i5i-cE8M>v*qvcuɁ:5O T쾧CEl ! BM1 }OkrL,vlh0 Sͩ/wԳr=WW6 ;Qt(uL0=teYFM,[#f;ԋ1xr^FKYCq*ؔuQ((-dGk/ș':R(&ܮ^fX*w ]ӽn+7pU;RqSܓ)tI/O?ž_[Iⲋys߈M3?D\,elmμJ:R±v. ޕz6t[aW/-%>tb f#@X8557f|oʃn BƆZʪ9ٔVEE+ow0(aMV -Vj -^)d]Bn]r脻"=Ĩ/+"/_W\GL7>Qž|oz6LO:v-3?,&/v8o+ >K2JCCc][O4bWn]9k]J5סv†o+~uOf^lI| \䒄hu]BǞ$HO r\{T&E8&y9D㟈w -ϷA>M|D/.pܘz)HOʲJ!}s]t/&l2 b՘)&Cϥf ӭ!x]F E5O'&#qc- , B: <ے|E<2Qq:q?՝SUUvc%s[EV =2_~#ev1^LUѓIa -bs }ޑ#kwrve!9l3d.1 KJ9tGǾȦ(km7Ӛr[wĆ뺸oW %5=Tr4 G g櫹ȄĽalȞZRBz=`-x:VVSS6e0mQ책W&'ZҜqGZڑ|UjcwT,2q,()~UZ9DY,A{fVN쾊@a>yw~'%ƚr1;궱&z?1PEn!^IYo!GS=V?ԔtUYn_ 4C]q@UVp3©7\}gҊyqQbq)V<`0#%Q4e,udQ*vx]0lw|1SZ,̴GϕU~zDIIAjD薁]C!~U\1<މ9F̹0ҭ.3\|e@Qxg8 x8߫.5QON913\,-Y^lk֫*\́9.@c^-J}\lzяȐ1eAX;уbfآZȄK,?~j_)]. eɞ) &kc6)0ORJfح1[ٕ=?(<'}X/siT{1RCj~k{qY͗o-ܧ ,x7ϙ׍o ?/WU|j>tgsRr<">ά͸(G>:3лkj ;ƫw hm-a?}5Wk/#؍yAO60sa!-qm}~u q:bwbiF>/yMzw@Eϭ>*Q^9ƶ~_t]5G"g;^t U}Ձ+o[-~rªۂQ+V^~yȈV - z}7kޗ г_IfdVFh}7蓮_aW^/o+x˯)\nyiM@59t[4ysXɞB*tq#/F/=o7-h} P6'I׶No\1yP3Zϱ)W=/{ݭ$4+OJ*zs(&U>o1}Ki'TثQ=64-l.ũQ@T#% \4oq~sY q]#q=csLouΓf’Z)/as -~m,5<*x~ ;kwYUp O%,bGxѼ=FS}u۷T\p<4>bcw\B^"y_nlMv)ep iRfC#mNusHIV~ki2 5CF -Y[Ss=abĎFB/jHg|}${1D0>;@i$UŒAm -ZjKGLw8o_#N#*p768=kc 3bjkUЀO}sx&aqV&r.>;fa}*zq`8dZbeP)*EI:jg>04 ,LZ'W<͗'^7]y˶Q~QPݯa13_dʛ]2JSVP-Bm;UxcNnr[7DRL(uO-N.8^~C6(_~ů*ؔYuXWSk._lMZ 1鸉ӛ+/GU_@n؊}PΤM̎Rb.F<]}K:sjmy&!bs괖A^_yV֛|I #Ҩݕ4zx/ܹ̔1 ? V]uY>twmY -(!-zB;.6:4fE9efn8Cgs./[{{)\_+ĭĸפK[c3zO<=m7+~ -ty=x 'tƈp%گ$fl,|anݪh֒Pwng^WQ>q 7 %`w]2_ 3N&b[+Y_kXs} aHMnڞ%7DެxӃ-?$U6#=Q+&voE ȽwvSV 螲y!,`EkP_Cq?n:"TTʐѐ;PD67;@ -$<=$+}3ʌ^H,8\J8A;RšNߞlK_OlLp\ ѵ73yJWsGf5Y?b6giSA 2>lyV|<}tz!4W~Z^oPik|Ԫ^0?cԥ"jz;4(dDC=4ٞO%y#*f^w +?[ْ29ȝ^jkK"eGtĎqӻfz뎗G-xc~W e3x7}g7[ݚ:d@ʀZ316hyjU,h)N?{tPC\;SzձzԎYMcv6hY6F.iWY/71{6Ē 9ZM½ﭲپ9dM ]J>@M\l*ǡX'UoNJҍɮq.a"*A_ߘF97}HBn;);nrwJh[rNhLlT fy^g`ߛ5 Ӿo -]0V.:fڜpybkU|os&K@㴬ZͿ`v} ۄVN˶@(8k -1;*.@Xetak󬮠^O8JNҚV-jE\KK-DMk1zxѸ:;> Sn4n-R\Ç||xp~&\LٹXPGZS6!)mbT\J]yv(8oPwD,<[ĉYBMT/ m8iGi+QH'HPaݞ8ٞS?N|V֦┞̘ĜG -y"7 1=1( -)Q=!l 7NƍZz#e\Q"` tt\GnjMI3ϺGv\"a)dŵ|L(F4GBzzW%`n(EuꈁڙJ1ɤ똃KZ9|82h>jSƁXxx)5 0+d" ?l|ҖR~륷%a5ж/UռGY]c:ig7 Ƙ - $i`-AM.oJfC!h{66mUԚ)m!&1bX\LYXq#;5$Blp׽0d|uHIYy AJ@{&s %LlX@Ya+%V:4rm -蝮h3c:)9ҢzLDŒ+|@˦L1r?n<Ou{]hsmUqC!ޠ C?|4T߁"YiZmh{?: _J(1bs{rs׽/K-  C®BЛ2iI={{qw忏i谌sa!F2&ZKdb\Om͗ouh(b?{kQQV1-ou|ur}Q9krzc*bmVz>Ӊ &oa6WBzsB}~/|.Vf8 -_`{oM)LЃ]0qd{X᳗?wg8r)DY'rIIPc#fB\,$8h{ڑ<қ榭iJ%9jt󗀑ܬ&a]|E?2lMM N ?FucKo96&f@ǍʨTQ9w~& nJ^|k3) vz%(b#SYŨ -w%c4gL\d -sIsi94"Z܍H707HiI Y-q=#e"2V% -iɿ #`< p! ׯ]2Ou_lqE9fcԬG8E1ZVB]H~&4|dsHh_6~WZO{ 8k=j ( hg;/_Jhr 0goIW~jX-ۘ$ V~:%,[4 t@R88 -ܵU@HxȰڸ՗ _f`:m(aGt|d`Yhĕ.@+1V_9P4/S矒䥬Rp Q=ˬ kĠjr'Wm?5zS뽆@.)=w -vDnNPo5Bt*dxvKZ6L4xnay~A:cm)ھVɭI@ii \4ˤyX~Mv&4c.I1WM9'PNZ_BOjZ}_(^u^|[#OY2r/nXD3d输OS W3&Zw$'-t$\Pl0Q{?e, W4ov2Q!No wQ7xo?W~#-H$qAA/4ZVxu| D@I,{^!woA,Ą ?d`R=-g/Z݀z} -z4q1rl\&7.vTo_w?0=Ǫ)NƨsW҅Lɔy-i&֦BJ`O/a0n37xה˾$tfU* |V3p;e26V_!dtHR}3[qpI_w6T搖֜41i36ޫ;> ko T|\UŽաgQ-.1kMZcC>k| [}g|Yw;wX~aS? <8zL}Ijh $|L{RlL]*lNzϛltʍZv٧@ŬQ2?2rzsf #gKFV%1Q`=/I;6&vo6|3SZzoǥ'7_"D`e)7z^ZusFO툫=o]_e54I=ދ{CwR[kZy;ӌf%,=j!k&5,xXCTீpUA%˞7FQs,;)`H'Į.@]X}w9"V0-w}lklU@-p'բC*b}̄,\z^Jq=]\~<5{6i&\ L &,ukSK)Գ{'Qg}KyR]A_aA}y8oAŗ]WZb[lQ瑥 l]U(f^]}}pGviwea!NܚWE\Zj8-uK6̜/xҜKI M #1jaV&h⣃jF -wiIa\Ϻ+}@χ t;(p3|VWaYX eBB -j%d-\dAԺF+ B}97q@|r:8W1jj]RL,vi7ɿ_PLC:_6skS']O+? ʹM+ 1=' $Q.@LԪ՞J@#f>:/> *I (]_F0?<7Y7ƚ.EY~g ')V=[({윇G6SIAk~k1WPsvY5A*)I72&e!D_|s h7@Qj ~}U}&_~ḵ{#JlO4ٞ1=I. )X]IOP&x_JʾZxE|yujbUJ; 㟁_kj)B*\"vu*0Ey<GYoݾth]7t 1#gĵ'KyF}T'Tx?UȰQ0jcPM54|\<478PJB݅_ww VVo΂e -uNF)u[o%׼_˒FW%B숪]Y ZboS:|;L1Ho6ǻc[}K6Ʈ -d)v(B@AO\_]7x5rN4 Z~Ewq[ ~^)lB,TN$۞VGܜ@e*isC*j #Y/9G7>zƤEbjPQjZjc",ʆwS@;ؼ HDu?^_`˂He!ݹ16EyxAM9=_]adIgSQ#1 -+gd2׶)#nY,",,LO8@U<'|W˿)17/ "Y@j&ew7o< :᩿SK?ـ7$LߋFS%dzDq3掫ϯ_mN~Rwy>y…?D׹K'O^CUS`nt 'ap7kuHopC`_ܹ[K>y -8yrv48?~^{:$ㄲsO_IQQLM$ԸVB -9V{@莛9'#eUGUʸRv3clJ!3&%eZ*Bàn)ݛSWq|YtX'tu9mb;?M༠/0COc3PC쵄^R YZ1lJ9}A,xω -_S*֚r40j]TC\H]{K8}Iu9 SS!m2:'!ƅzPVF1F]yh\ZjDID^@[~qx%ؙ׭߅"CsV/FՌݙ2 -9º~VP%#|X@e`<褙ޕHE̚yPbZvGHͨYi3me퇍Y3`vb~.lNJg5IxA-6"Ge6<"QaQ~/S3N.>m&n V%ĊT2|N!#cbR6&•EtCj@+|+P+V0n4`6ZkBGIP$p>vXh٘o̒b6>nm -5:4(Z[T)#:k"3f19eSS = ƔHin59 y mR.!fT sF"/8-^m>kUg1 93 -Q؏ˏ㇔ -_Ԑ#:jЏ|r6 ;D^ZxZ놯:|iZG($̔U@H@M2>4zrN-iA,0;y|8ml`̖ٚ3{rVFWY 5+k&JKRK@,XCHD]:G + cz)9eq3n00!- ʅ L_{?e~z6Ԕ(V6kc,9 QRSŌf"lBZL7r6f_ԛ Y!bBM>_KظHhgeI~e`R6Jk‡M)ijY5Ӈ v%d攱t՜OY|q̺]_Ï"`n]}?r&jˎS/w#zXQ!rfj3)37&oq:CY $u̶Wݘ-Q$4!pb" D5֘26v+s f\tH =v{t7M.#?8 TK9ZMt{u Xϑŗ=Jz#5f78s`L҈UwiG5QJ́oiX==#w$8n]!8\qWW'g*ǬAƎm_vx`R$\Y~:S~lK긽y~7G oaG_vl@MC~&BUˆ-`V4q"!Sv!ckp%eGus +ǬۿO8W*Qw92*2zVoaSf>6kH =&{~N&fQv,X\ ́qiym6Ը- qc䕵/7б;UN̓?Y:`Q 17P1s ҍ]XV(k~e|MϩTBŐ<+xK%Ԗ7_:iz鷖^ߡ56~̮̙X)0ɾo}@ C@ILy較G9[S]Gj{73Hhx `DKo5~r@4ZVVobhZJI#gs~1)Q߉uI3I.XҜMD(uQ@Bl8`btcZr .VP{}bF|MnxvsRAҐ1!7]ؘ4?z⌋]K _.WX33F:e,9D##d!zF b6:` m cQ{Y~Es!`D֠R Ḏ j\<@2fauAx6Bju,2fòN5j7:Pbi1P{VG2 뱓}'@u)#ЀvFϟlByDKP/&ɕYà$#jfoXԆgȕ )ewnޯ7s ?zRrU -50w*چ*JNWJ`YHp%cIm߹W3cK8F'5ܞOq9'3=հILՀӰ) #c4g&%Ԗm%xьA@͘$̔AHHp&;E݂pc=`4NF55e*ۓf>9,f$RG"JoR6RS}:nŭ^0x|jgK-,Zw,m` y|f ]="nGPCOh{ >-eeFrmh҃:juo<)2.f_Dd..`|:TqݟMuO7қ&޵ oB >dh[Oޛ/氻X,T'$2%"j -pT+ZC%ϢHi5;?q;Ρ w&sޡNl{|cmg]y6 'a&bzjﾎx]D˸e aSf0e-2P@k ejBoZ1 9TnĕΔHd^N ̋[JN۾Si\I$aQ5˄PsӰ39jm,dC m"RZ>Hzu9nhi&M0313,ے,!c̲,̶d1Zv\}?uٲ4}sΥ!_o'ͿaB.KFJmGAQ;éW~\M j8xU)EOg_qd]uʡB@6.y -8Gq9l(0{dc@e}9l@UXC앓 -j`i\ #p2|;@|D:,?Qq\vc~SESpQR2KB@9>5SG 3Y HyGK~"iz*rԴRyɒP2I=t, %U^{WB_FysxP7 ->~cW352vb]Nvk 3Q0ǣEۧnjgY`N'Z2t(gFx#0Gb`hQR qS*:%'EMޙfZ聢uڮmy=_0ԕc4wE|KM@~1 -ۂf :!;3z|&Đ9\cTJôD k06} -߃iӥn `WZ -x^鄜bcxg tgց"CpΡcCZh펁 hKz䘵󰆅Ϲ5}w9c&"PN y58Y3AH 9?`9d颇kCW344w$zkgk̐O(~vOŹҍAR |P2jrT})&!nv+J6گC`d~p/fȀ  -5Azb>xz!;lAZ3YG@cX7M S֯<2ޫ:^U^&+jlrn[/h[&aL3Je. %-h`a|J:.kżƯTEǫvxEP?ޥ!RRW:Bj$ --WVj>gmN"b7 x7 M>CeCp<6 'fZҴ?/~s0-kZ-xh'zCh9dQbh/n 1=оKib$9>l.9^VW uxx]jdlĮW5^!,c,]WbrO9L 2fy*0_WI$.-P2%=1|73cO bBAPn !cwྶ+xe\<1u -9y:Ux;VOp6Scm/`|xAFs O=JLGG)2g_>PX f -Z'hE{37>gs;Gq֫9@FAx8CKS'SVFb7fqӒshhɒySޡJ!/Sܳ**9h0gqد U/%%:lYrz[*vx(ug>7K5tK9:jwJgM>)=>JK -+:lW+9b9wa= -/. (Fo(~{8wPZdw0\""#٫bO( h$5|r@3qqr1õ :Yp 9.uQӯ~}8) Vҏ}ec4 -k5豍!9P ."WLF73!+<FYy3 `&cyNJVYq%lޏ8j!Ւ%Q13s,P8TʖFojۿXX..w8$^l'#O kݺ:"__W"t6\!x wj?tFxct ض,gZT."RzFB\{Q(%>sMg`ka&U02_#`[ځ'W:^p'k|^wQ\i@L]ݶa޸yPn\J xWEJɩ(<ɇ$Ѳ盽)#שQӜ #{m>MMeaA r5AvE9j}nuJi>%|; ˛|R: :ؑq-$B<95;RQn5)0?+L -}l*\SGچnY;^to~MxkAŕ j̱ϭl+:`ҥ@Gq(N6ue[A{YjD7N<謃G[x!>3Դ"49iwh`RdJthfP]nFFWG)8^zueViU2yQWPa" U"cvF~;%!yu,|RU!sk2˖Pπ.B= U|QjK621nhhqʿ"~2 n=txVE q'10-WX"95T|=C>ӯ%BvJؗ^}p&da&6c`mJTlV6!R~Y;\)o J,ТZop aR)E.n Ajٲwyb:bw')5I7FbNHNڙH֛v_UrZ 1 -7MԲZ| 8C:#%"4#wo?ɹ;3O)<1$1#'de,k&u$XmAאrbWI/Hk$y ͡ħ'^MAo೎t*ZSƂ-jfRWˢJ~gEAP -]2v=5E8gY04]j̭!sr`Kr?hhգb]2R_C,^R|zB[GC{Ӧ~کiqj>L5A…u̲Z䒓ol -/UOc33}:t±XxH*PɇJLSgMBzw&5B3 /BbE! | wqPoL@A£{RwgK_H1EQoExMjKGKսGVE Aje;qeni+#נV|q{L,@ o K|wdtȩ$Ζ<еes< \Q_fo ]N,r:fm-!3 ChQʩ$$@-U\*^5? liO<5u˧  lu -е|w3ri} 쐎IY" *:@  -0ߓQ>%}e\-S=IToW;SN(,O, 0 8SsY69-ȗR}wG&`6{XdT,̯njl66K -j8䰉CI99i fVXjy>g,s'˂r,.XX iG,`Aӊٌ>Z /x0q.eiֵi0V9&.cں#SM[H/;C9/ϕuX|\ԸMQk,`"Rʩf6ɥ&gzuLђd+ .S&Bv`Z[& >K?,iWY=^,"~Q? \RAgm#^n-ds=,WkK -M&i +Bq?r'R>~PK!荚%.+dgBU7Kr|Cu^Nč gWbJ BtU>plW\9\6GʆΧ|ZQ>)`?:d}*r -7|ϋ9p&{@.؛Av"_p9'*-򺀾:x :,#[A6~1@ל I(l̃@OwA PIv=d|WI h5!\//6d_*_ aUV59i -ܪdaP[2Z~@U^R5N>eoh5l3Gޛe01N[-谁VӋzA,qXx |ݑI BliOk~P3ǫ4W?Zry.-)k#z&hFkL&`JD 6\|ܩr(wTjy 9hCJM݀\̯|b !&ztlZxӻD;͸ Pc=lo:V?ި?Z=ިsE!pnК(r)A 2RKf&qx'K6TN!eWZԧA{( o0&>kh.Wv{}fm`Be _-A<ߦf6 -xd!;aa*lԄ-BɉX\phO[!\z*c{πZv=ؘbEbMϑ6/ -h,h:Ӓ^51%T[]q(*6EzTlIkȵ=]MkPYgqs$[&bM -sok-d##=ilw>E˴넼#sU[hbP Xp.)@@-m Y6J*2.jro76%ұ*JQ̑S<3Q^bSߛ!@IqhY!70|G* ʫ5+T -r#x;3fcW0lW5&% MrX>ȥ _ŀ#kVW&=##FbUAtyr])5ۧmG݆(t"\w/0A*/wyλ({-\H[S99okԴM #[xf4Z^|,2p :E[uw\쁚 -Eb\?<?aĭ!؁N9F )" yk5N^ơs/K,U.9 VJ:g@6+ hip>⒱Jr*`[:7pA!P=I,rUxMXX {R:Uc};2I=@6/?\v 7CIu,TKGVl`cv߹@ )Edy 9ߣBF!/ zd/QY\Z-:φA UA>ǦyUeL}dҼjZ>4S!}e]X|(=^b*ttFpOT_nx ւ ݟ0O.{;z7`3jT 25my-g`m02g!9r\[@vi0q1?"ukk%QUMp(ҧК\bB) -v;Y bΤtt"BuqShEjxM|!n DE`olr4"`X 1`r^ -!<IT66NzL ~2,ԏ%ee"{;*QR=x5ˎ,|t$kT^Su0j({ ء iz4?]7aၱP|Fa%LlRL-^([8В yVj@ 6<4v))6EqS3݀y>11<%$9a:{{l1òG@nCjyeAFN PsHATsp~ =^!#gՌJ%~k{0bꡜ7C -w#Oecsz:Rќ81סМr>X/gE\ - - :7z(6Ka3<|FL2J|jrWI:ĺG0U -BGO ~=&գ B~x'Qs g?;EA B9\˧{5K -`1aA!3l48Ļ^H.dRC8#߆ tDxg`Yx$!`Du΄sugpE>DaGHO Haفd/>^G@C+ @8fjI%'jҭʊ -b9? -XgTOO-+NZGԼT&g"zt$ri?L; cB+]eaKC-K(T2W4U"&Bt䒠x -"ulfmU%-K]WGukI~9߫#=sp>CEph ;;#eOqo6zPsd>~gƼ*_xu;RPK j(>0KNHrI)>57a8َʭ|Z!-cRju'%pѶۃiYz81fg%D;d'k?дlʾ;^ǹ,~WAwPg> !pj$?@=ScV锰 yn9.6tNd`Zc6Y P -ޱkjSOq ROLLtHK/y%{shнк -4,h!#>럀 s7ذ>j`0?,tOIHΖqQa uuAG6@Rx -5%h|/9Z &2,` d<x``>/yZb⎖?W XzO,ژ$ŹUunr9\(`bჀX'Lqxkz81 8&egq^&ί§TBihɿTK+WA;䤴åևm3w_@jw)Ss]臶)B`C&>CY]Yli;w tϺM'!;fp1>99OǿWMPpRZ8>rm (^xy`#Uᓷ'Jo>rl[AHNwGIQYljqا x摯G~>+#gOޭu#昅ۃ7s.fё~%%D.)!i ryܯ |pot{(}Ρ&%92%f@C4h?-|O,=2ґ_C^ $I3%:5xl[.UbUJp+^%1Bk2B(9>KJ\7x?~BIdȠw/ -RbGJ?ü7CJpQ3iNW.u˘ »1s<6&dd(^%1pv69 x=!.&@s9i(y,z -\ j)rlSI-sEplf}:R^piufcr s|NUYxak#e\@?ݲx0CN ,a^8g)٠wAe/l@ρȡrC&fcR>vwۛ$ w0xr0 8_x6x|]2W Z;mzgyqkoOenQ"LK #!J:[s0}5x3~n%E#' 16 uMC%5~]?V:7;J__fq|msUlGmnaaeܐUj"%اI>̿WpmH1\.͞;a5ⷠ ?Rx <hKʆЄLT=bYm׌M;Z:~C> G >琒Z:-ej*USF7-r` ``ykb#n?01 -$-`7[r{38i^צg'Dooa,]If/m[5tsKm+ z`7e]˭7ʞn폒m؝~؍a=xC$ⱹ0髭 ޼+[7Ƒ/&ʞ[A_&IS!c횯O Jz+KQM:[GpJ0_xP_ }>j \\@@< 69_οjn9XpRz'>QBk~8F<@=^loƺW~joGwVJ/h~g.^?jf_m}Cy?;?[S}ѯ=g6i^3ogӄ (-ا;cą@,p+#W{M^vî2~4]F_ȿjlB9`[C觖+Ιr'p~%fGӋ򚚃)vj -h39-GEHϗ>ȻҚ!pCmsލ)rF@ϣΒS`V:ϩkN COqO-=Ž06]4.n.Msc&b~6NKMrƙkG}{ڬJn_*^)k=gK9}ȼY|o}/ AkJ;H[_5$kHXrX|j#?bai.StcFO5CSE(;cC;èW9>>,<mc_>{UrXR[xw0#u`=('G,},I_}FV IR.g[ȇ;mz -oX -hR~VUԖvpyV&إېGvru9N?ۏ~SzҒ{a\0.`ܝXU -rL:yaJqiMUOramS>8 ch+sLP?Fڃtb;z?፡1:pLARzW*J^.$7 [) %7u ?I)_ҾgIV.++wo -4W!뜥* oZ>bh<!jsogM j zJ`坁KSkٗØQ.5m}iM]w دgϿ͹^[s{incOI 2'G~>~ل(k۳ Ro6bij3(+RN$)ΰ GsNyx[In9>5Ԥ,!};}N ZU}}8)t~}9r첦2'$㴥hPY .ԽAjJ澥q?1!nV-5j{z{hzOuKk֯ӊ-gVⓍ>˕v-cCSS%UMYQُcC"E.H2NMI>HɣQAji.`*.''X_ _}ϸIn5kz'^ح9W^>x(2&ZI{+km{ſ/D*<ȖO Z'FK)./"vg-H^E>44ƾֽϿ; 򌶒s_UE{)*؅vcm?딮b 8"5'zqVw#-pUg1}(?^ĭ%]j>DU=RA^DI~&%8LH<5ˌj뽰g냹FQ^UEՑ_̼4~ KsOӋMXUyEBW)sv{6;:[s6u3&EWtM[) Ֆmy骲.zfT\8dn 7/z7.jΨ*Ni+sH)}ۦқz3E⊾~Xހ(lkp>+1L}ܷD~fi>S(m6Ij9vԧ*I◓(\~z'jqqZG<^,MW3nO? p3N=YocJ3)+.+_ _Kz)1?o6 [J޸aj>'~яy?mN FH z)n `c>ԃF̓ ~XqJF% -\= 'a|k܁yo*}FW)qybS.YG)rUѧtuR ~c#$>q7un=9>|?fX_Y3_)CK4 -S|]h쑩ࢩ1r{mc cVLlb[Z/ bʹ?1?6cbNoсLWWg`}UW;l(@up0BHOQR =4D},Lbgɣl9Ap1#^Գ]9-iPjiɸKs.#vQ/E=Ծ/NI=ώ.xK:`X]uҏ3=[)&js ɗ௷Gj/g5է`cMge{3"ȨוY?bW}1㗃bxE&|{j7/UPqf˴~|iV񗺨Qԟ Mg-MEw,TZU_0Uy紕Yg miZoIϘ-K8҈%ۋ\|.L5DmC_ccro~?O_E36g<{sNQyv/.ԋʒ7_6E&kj/: ZpIQC7g:ro1"~ǥt5ir&y:]ȗ{cug⼛#[۽eÒfyI> Sx1_w ^l V/mhi%'*JXSSk/n)iVvkt}zW$}'mH|-HEU1Z¿ӫWA?^>'&1̋݌nÕ+%eY:IogI_N`&}?HI9?ʸ({Usg|Zo~)XH ,mٿN'_icNzY_6*{ 2P\"Q׳O|ѓ`OA^u56vN;mhȹ0K>A׈x9W{ݱbv&X{#ȗʺ_>_~6n!J}?Yfv]>}y Hߋ~ah/0$w®o_)h3u ]i+rcj!ë(펈CR5!G 1zgci"'ɫ`,Fuu̟uyO[Z'xуw0Je昛W4Y?ҿd};N8Ԅ}5()7_nsh*Ҿ=+^j:AKK7(9eO*c.2S\#/OQ]yykoBZy3@|3}݇};HXxU".y| -䪗GƊJȼS8$.>rΒ&ԳYII>E^wi2/{O[!L>ц~">(HF'&ïP< -zc?֞|Q[ӥ}r>0|vq}m?/%}5zE'*kr/{U3So9gd8-hlxYFoڍ?no pP1jd-F/!sCM~R1bs|@>K;}~s s -Q]1Vb捺~wwH5b7#|7gy9gO<*k*ʹcdS+G=KuOOch̺3L}}A,7{yev[PSY9!ŧs*.ɾP_V ͝iRS#Xm.^?.-ިgYͿSzy;@K8N /M~?e~ص}@8FȠvqk}::9(yMQƛ3.W%_0]w1K Wv♓0[ -.~ -|9zjw JR!RxLm^mS5OaJ9CŃq;ukAܙr!ׇ=ǟMs_~ؑP{c!R<ߖiNYh{ij)^rgR05˝qԛC"G^ZU)gc7/6/AGO}d󙺢}Ĩzd9qw[PЋ]*PIޗr>.s=sb7xo.~3{4p+U}pcWSUWVĽ1JGqQ+fu샕8p -6w8н ;՞;;}[r~_ϼ\&ڦ.%=Z`% rMۀlu.z u/)F?wgm*>!Hn6S~;U3}F_nNGF~6/ɿc}jJGF=,v_1w]O,ݙ %L -J #EQufqvܹ Nm{_RiD~7΍i;DNc wsYFXὝYT̡LL?+gl s,(̿W7^o "&Qj6mS靭j9>C8btu@UbU6 Xg9ۚYgͰSL9ҪsSS)*|w֍xkH;kl}u>ܟ('m12ͥw7p R$ha#BU/oDZ \ Љ|jf|=z7ZoiLMŀGcȵsCW_ԦwIyXR?WN?fZ-$#njr*.|D(R?"oˮo #g {I\KhzkAsis晹* F(io?ը6Eu洀`(mn˻қy11AT֊ Hnue]&fHh{K4u_} $Fݵ5PzDG-ħȝAjuNܓpzy>rLqKGl]ϰ)W[ȍ!n\eEPXC|_Zn'FmMM}؅j/s7\_.b#: Z2~1ݴMq=gںô'Y祢F4LU!¨/#]e_7\tg@Y81ū`84]SŕvVTN(=INo&[ ,ۚW_<4hy›@Nq w&xPg56&VFh#;US3 -0ࣕZ}'mObgV% ymߒ54oћ垲g( a̫>ģLC*bhJ -.Xlt]2!* ](ie1FKUY֔Kvqq5ɗtYO tnwjʿQUծO]lC?Ilu>fJydBHp` ;/'9_Oc~V7^ݟ, aZt-wo#ZzmS(륮+äh,8xLliɺn͸2^{0nyEK_ӺTޜa<$riE1FP򇑺t&Гn#qd>ko\ xV9n+}g5LL8NV7N~HW<1*J"/G,Uv`iԃ5N\-؛-xs;h#;y$[:|cCMӞͰPb H yuD\2׀@z}0WW25/ʓ]k-jfg. S'ZˍTko%bUTDN)gtqN??oxfQ-G_Fnݺ{SJ)qw7=w! ya\d>#sr!.!6so,qVQ˝YKyK͜Fjf3~0r\rm JzW{JTGK&{gk{Aߔz 9|j.fWt[D+ͼdp=9,D ~m@&ΰٚ-*l2FK8XQ1 ^o/}ə"t7$ŒiNpe; ->l#ft%&Xui蘽i:j{4xcB[޳7k˭~Vl#|j3滹BtKgAT(*)#U"Vqc|~խ&`ZoV:qBXdž,•̢Jzc&i{:ݐt=Ks^kz$BgVmLLhwcwY+2ڲHlެ~{UчK_S}iNEδD>N}G0+}FPz{;2/GR_ݽrtqߙ@o_:pJGF5Ǥ\`R -bN܈{;U|:Ɂ!o#K/ OÁ}aFNOu6۱wAQm,ϸUI!_Q,.lr'&hc6Ɋ{Ȋ+UEIa!G ?}8ˆ -=I9|<#]? x~~e`wUI.Ѝ yt9P;G)I Aoܳd@eĂ -YuӍ1B[#, Q&e7t]BÅ}R0!oJcRGz(,)\TILfk1.9iWQ=>C7 n -7M0 -̈́@M5~^~v8݉_~z|<[GIq?.{Y.%ܡb"@>oS7p%ճp6%1k䕂KWx?W$ݑOGpQ'`aO`NN>|'agcNnJΦ7Ƙ+}َO#p}+oC~odَFb<7;$)9tīǮ;]$s~~?6B9T Ms싽9 -eWvX\d3cܕAB/CK8#Ȏ\N?y)W%;}_ˬ ,L0X|9I: -y@O^ݻzto[gπei.O9grzra8=Hr‡*/rRORG|?= Vo_=ez -|tYPOnNqfE\6?)D>l&]@Os N SsD% xs@{ -;𗟏3|l|;]IʳYqv̈DU5Tsy":H;7Ao󧠏;0'W@Qo_ .vD8#B?!V߉*FV֐?*聝 *$ -<'Է7@^>=| w22p|z2EЙN<z1GO^Rr="@*2O *ΠNy zx>go_}ƹz]`uP rF ,唼— !uy >T!Q 㢎~x6(kЋ79>:o@Μ=t4yqWP;bR:|u<׆lh#uQQwBC$~E~zwt Ѝӧzw♳^>{|$s#WvcܳkikXimCImJS}%z u% /~Û_] 07n\zw=7tbeU-R+4ijʫ݄Hc)Tۉ j%܀$~uA~^:A\ PO耠qO~r %\7UG^`CEmq%,a2Ͱ׆nrd5^ƎF_GDdFhд)< z1cNJ.pG]L{e=죘qu,nwa5k+*=#ހDr#G~ 8 P·GIPX~>tK̆ Mmʛ66YG^P"͘#\ȓN\Ŷ@s}=UMʄtm*!6**|S,3)x)$cC'PM;=L[/ -G;s ž>rWʂxk*i;2J޶QnKF͊5 !b7=~5[Wn,Rqe==Q~]p'򼺬|3 vwR2Ԁ:Rn= NU%ci<Ӂ_bo By{u1W֔>Q%䳾 Miƺ˿W(/[V,2"eoNPR:!,cԿZaq$īᖖ̱:<үQ'hbp*%Cܜm &٪: Ѫo55Ŧ)B&B\RF -hE!2R6Ķp__[ l&FX3Ϣꑻgza{a̳P;4|&Z:dSNY!Dk4卬ٱ*@u'M6QE>u&[+cũJCc==x$("ly>1D`MIsLC&`u:pWUBQFec/#C;<bf<l&115 Q3ҷIu6uuI^I8.FR[9tĭ \YG[e@JIN6 -;];27]֘L4 \CEL3Pt0]sNy=bKm9ĩoڙ:djOژhbhlc6+^#YE -OzUL=%PvU9w*.iUpuuEZۑ$ҕ1l&4EL[rc/+ySgLjl: -4X`#7e9Ц`-2.9]b5[T-ݫUY-}v17[U#6eܛ1 \ƿ527X:V%1צab}qzD{bс -w(E&=OR *~:,; S2r֜Z,fCz_!qGTηs\ ]Z`mUt]lwd4SWۺԇah{4 "TKT ܴGsXI^ɫŸVQahML*Y0 ޟ2]zfsF[GRVάNPkPEu%A[2ֻ$ N J!oIP?aiw4յ[2rEJH*.;CGoCqQaiL2wwoajR,nS+\>`+-9 N!s }UsmSIwj=˵?]Ya 4bi,ˀ- FaP)_bs_K8WOEγNAtf3 z36 -y4Z4ݘ}[Sxi#SJIdLUq:ʋаQ#E' Ш%bwSZ+2D?$cR -b]+0Ӛ`KTx~Q2*ƪL]Hq);_meF -"HkV gwPsԵ66Y)y_6ԗ0RØm:r}@{$"_b?l,ڣ~k:*|]pcվ_sftMME'I[ccflH;&F$v)X1iN5) - I7*-"c[EZda#͢`Xm)6uUDNݙ_m 3IHWsn漶i֢ŧ]J*Z\$"&C'ӮIp*.X{lށW?M*[.}cuV%9,im3Q@|9tPqV9.ũfz5҃=-0n%2qmtcs(&fwuu>gds&18,C.7(=%HyS?<|<$ԂqbLeM@Bw=d) E6}"lE(Щ -tUNJwg+5+$K90FRٞԙr{椒`OK*w8a|MuCxr?l/*xm1 ݖsF&Υ!1BUw߰klvPs}=QƱѻZíz&k.W\9\;20mXm9e -$[5 -,Aj{a)?욬3d9o6Z[k(*bs/$԰Z $( sQsއ躨]whIFlK. -{QT *&ĭUj(;#9m.ЌRz[DHuabۋـXOSWpag .NQ7_W/=p<ύ*HYhu+;@NHPN5.G'U] ,ک}Z.3qNmC϶t¾ -rLCK6GQ!ƼèxMkYbWoC/{ =.q_M.R|o1~^Wd{ -{M -@M0f 9E̳v": 6!'ڦH LN)wOG'y mAEO4p k=OjFy(2PWY0ɡ[%=˸,䮚ߖ MbTڎ\oW3wAsHN58".9Z<fYE!cgm\"fҲc<\茟u{& -щf1!@5Gٜ&lS&&`Ƽw'7!Xu p%c8Y`S$t|pTָm(l"h eN5$j荱-Kdy|E3H6 rHg\$c\5Q4Oħ[XVIkKY[r -r]A)ڞ'(ZH*6O -ڊ_z^ї3ƪ7]K$bmO ^ +DLqUXv Vwd>\4(TAX᪩h!Fi7U -FiA&alp9"76,ǠѦo )-~;Ce?¤N)/@5xd'@厨+mObJe^E||aT`*cb(,o~.BJ*Bu>|}fͻTst4x[!?cpa.5 }Т_p; -d*b} Iy3]φ6bC1P:lKNjhn#"r^h1WVJ-65@6;|h{n/dcSzj^@S_>w`i+X v1 Y/1TqWehLwu4</4BH\l-}=ېso.iIRnߏ2u64ܕU^'m|m_hb _f8" 19{.4[zEQ0c.6f?CbW -ƐƂo1\>ns֋X2׵>kE꒏s[D ;F]}-=Rx Iϰ Έ9!Ύtaw(l;ᩱ%o31_Ư/0W+Gg Uئ혰n [6O ܤ "?Qׄ9F[Fnl:>KvIQ d4 qi\Y5]=hOO,*^gYJ?-ץlO+CYET2:L61=/'m-R:ćv- gAö'Q9,btu%O'9l.zq\m֣˃Av-J‹cn 1 -oξθi}W-o &r  h><Yz0~r~%Ɩt|ֶSl!Y\)4ߔps|GBG{CmaFWQ_o,C? c'~?&"]7"%MFh䙥 'ՙo,Cf 2ζ"dlSv$zs$4\Ӡ+jr9Z6bu41jDF%%V>GyVؗ)r1ty %놚~k!F,amQB}dԮ^P֗ I\gh]2!Ed5zkWܚn ng^RSKg.e]lNgIb0.V_]` KA=R^ܬ/{WnK|JanоRbhHk,{{s4|wҗ>:׳(*jR_ƫ#Z4XDR19N. \n{eɽ}nXFyp8.1B$(+s7}]p9N Xŋ0]t4 gl -:Xޔ0Œ}\v!wg i@*蘮WAqB5vC谧]`Tޢ[ş$ :;hD"= `y֓x4zs(Iwd%!cAZa8/ӑГİs+Ă湂ysw٫<:t=ݐ [B_~ږqW#LøwY,\oK[nMoIP:|hY]+. \^r6Ʌ^<j}ױZ!f[P[=yO, -Zyمj&8%8@SƊ?XEsV')\p.=<- mt`aHק?-6p2 UP/kyO=hzq6|1 1B0~fvv$_E'lKPsnYEyO_tSFQ5'{Z<\nIՓxs8vUԎG[ $U{N'h͞Y6RIk8GC 9GGm!M"XUsNn}}45*sy+; hI>ݢԕ̍Qϟ|k,{1PXOԚ4 x;B/,] -F\]} MRsw$"B+ЭIlM2Di԰% Ra |fH`6VhhbTOf[)a Jk91BTِ}V.h%gη3$߱ ,fOk|?OYkÈ1l4;̲{3 92a+UQrmxO6 be?tC^ȇ=tD+"rK=ѰNAREK)y̺Ϝ'oz'yP}V/a$"fQ+b&5A/ b9ҏNSnXP"wXE?1Nα+yIFWC.J+=Eo}L} zƒx 6wLLkꇄ{{rj[BE/t_lK?M%Ns9ke}Ҟ6=.{cd2/Fg*kvմ -0|]]5/o??+ƙHXPlvNؤ^W_GŸTkMɥ[cH0&;de,n"٥%Cbo1Mp .-2աE4t܎rM1&nsw}WhlCdXIx ILyԍ r -έ#և] tj?NN3I -aӕ>lo_ uꚪg:`Z>֣~t dl gK W{R^hk3_|v4%`S\yU:eLpjrOp80 q.eST,xr_ٗ~| ٩tl<@#jL] 3WGV_SpoWk๎tw9a6Oۅ }<#VЙVL3\g4,ϙڮ#}h2|ǚ!8gVJQjVX$;e?4朌Yx;_ hON &R.r/1MV ->*g nĭ ö!\ԭzURdDL9.- o \oGhbF.rC\8ۃ/QwW % McoIyOGxIډqy@ և!e -h% NbUŮ EA|gFXpe[I8;v6R@z+)5o4ۜ}g)Jo7$huOV̩MڮeUm9>MXA\S=]YL#'X߱Vbk1oI.ږb{qƆO˝C &axm9okiQ -z6`6y -&D4 mRrL#n𗕶+И)VN -]3U}-tSB_WUcv1m - -ri'o*~essd̞bf}@aȯEN06n~5;We*ElS Z,~kdE_;X7 -j-c{A _3td?@06<[hB}r -N)FdzܬgiO589I#[DPJ <\ugVұ03l$.٣b`A9"[5\†]jW3c'Y -~Ft*MY曳 ;A{:O(&EFYŰpDy:\pyk9*٢"H;v$fW/Y'4#Cţ5յV? - A'\hD^R -#j /գcև m˝۶)B5E']Uۑ6bwP5`]z$Vn1Y^<ƚaX7=Fxu;mmA~c/əafӞ.b.M_{gB'u.|o>陮j?\:gXd ٖr]6Ρc-sS=]m]CN-cWzA hoS)#bz(Xh) wvguMpSJs]PYmW0KaV -qsbl+BN}}5+Q)["pR_Gcs)\ꪈ\t0SY#åȐ&iydib_6Vrݸ;j.zGMi2ޛy+k\r)8(A]ZaCBl 8.1AJMӶƔ{m raƃ1zҝT̥ b幆1\|;:ơR:ԭcSvjaYA)0~1U%uL5;`,"|A[js>Ү>"ƿ<9SdcmTMN0/t_R\n{>JHU 3->Wڥ? -ToroQa[K.~ZN^-%mp<(kayasX(BEwQ7@. z@,yv5@l2\*⪼7K ]A)f[DH7YA/Eo ]@/J)u%˩1z=˯nS;*̦m٘VIv )˫to-6=s׆i=Ы)Hꮁڝ|,杣P\jtyǣa{ZaP1V is7em@sDRwYiz[ֆ0 -kZt+Sgf`*^ 1Q\yRs]'򂌗v]xˠ[}oô3vf:zJ[Zb-!] $!Mp:ʳyoX+ -wNug2U-2uIh{8[xQ^"xK4iai\qh޶zbEN #lVN\%_"g1 J_U{a)gNF' ݈J5Rx- k_+߬G jgmB'G@;vr㆞}c6Cc[kEg߀w'|QQ~UۜCgs'~e3%/, 1K9)ro6So=0?#m _VU>[3U_oY(U3l ð/W?Oh>Mj6Mn9a떦~p:{/ [EOu<ӯˡ1 -jCGKѳ"=S)u΄$@,P_h~yWoiIS8*)#{o&&\]"m}'«;!A47-UkL5;jAnrR2퀏iϳ 92vN 2)i~F W{C5AuƸ:PESj,|Ml 0k#tȦ6v|є񽧣?+D$̩̺O;w4Q_M,iVVt~INHsIP Skb Փb`T(Ѝ)}h͹ -uҚZPl9!hd7虽Q26▖ٴK*ȹkVںR`"b;$M>#Ԇm PRLWfwq?p~VQ>۸ 6D}q򂪚 -S3=Gq|g/x\ кj99%3zx؄t,ޏq* my7F> - IjJ:n;lzXQ}8y ->ID9H܅ׅ[6xꊶ!baU!^4sz.xEC+Zy%״Zo!ISeW,E҇3=z. 4*4ޏcOn?,`SCecZ56n?ׁ]U&ZAu܂{.A};SPL6ukt@A2)d@$okX7rH9jvRǿ학_Ś5+bN&; GqnTɆ_lx@I_|#vGeK*'6dD'좎\w(R~{{ϽИ_4 {᭻)4ϨOwO_V8~J..+#Gh6W'4n~/D? ؏ITٞ2]\w|ve-mbLe8{b,f"Ս>\BnI[ftֶm%6ډ 6vEYCQ6uXS&C6:ȵ^ -|Y 4*(idtAJ{q htq $ nįN,TKztTyT$s0qɻ#u-4n}]yI+2nHYWg1'3 -]h:)zl敇=+!e# tQ{^8hEL#guM{K0O޲20_&[TK3$WVÃjHɜA%BeYiٛ}' XX@˿Џ_~BctF  ~ՠ@KΦس*Tƺ9#Ȼk}{m+yyUu6}TorGrNJݮXiu/z@g% KaizE7cؒo.>`Xfǎ/)NvW> endobj 76 0 obj <> endobj 138 0 obj <> endobj 200 0 obj <> endobj 210 0 obj [/View/Design] endobj 211 0 obj <>>> endobj 148 0 obj [/View/Design] endobj 149 0 obj <>>> endobj 86 0 obj [/View/Design] endobj 87 0 obj <>>> endobj 24 0 obj [/View/Design] endobj 25 0 obj <>>> endobj 263 0 obj [262 0 R] endobj 315 0 obj <> endobj xref -0 316 -0000000004 65535 f -0000000016 00000 n -0000000210 00000 n -0000066316 00000 n -0000000005 00000 f -0000000006 00000 f -0000000007 00000 f -0000000008 00000 f -0000000009 00000 f -0000000010 00000 f -0000000011 00000 f -0000000012 00000 f -0000000014 00000 f -0001828151 00000 n -0000000016 00000 f -0000066368 00000 n -0000000017 00000 f -0000000018 00000 f -0000000019 00000 f -0000000020 00000 f -0000000021 00000 f -0000000022 00000 f -0000000023 00000 f -0000000026 00000 f -0001828793 00000 n -0001828824 00000 n -0000000027 00000 f -0000000028 00000 f -0000000029 00000 f -0000000030 00000 f -0000000031 00000 f -0000000032 00000 f -0000000033 00000 f -0000000034 00000 f -0000000035 00000 f -0000000036 00000 f -0000000037 00000 f -0000000038 00000 f -0000000039 00000 f -0000000040 00000 f -0000000041 00000 f -0000000042 00000 f -0000000043 00000 f -0000000044 00000 f -0000000045 00000 f -0000000046 00000 f -0000000047 00000 f -0000000048 00000 f -0000000049 00000 f -0000000050 00000 f -0000000051 00000 f -0000000052 00000 f -0000000053 00000 f -0000000054 00000 f -0000000055 00000 f -0000000056 00000 f -0000000057 00000 f -0000000058 00000 f -0000000059 00000 f -0000000060 00000 f -0000000061 00000 f -0000000062 00000 f -0000000063 00000 f -0000000064 00000 f -0000000065 00000 f -0000000066 00000 f -0000000067 00000 f -0000000068 00000 f -0000000069 00000 f -0000000070 00000 f -0000000071 00000 f -0000000072 00000 f -0000000073 00000 f -0000000074 00000 f -0000000075 00000 f -0000000077 00000 f -0001828222 00000 n -0000000078 00000 f -0000000079 00000 f -0000000080 00000 f -0000000081 00000 f -0000000082 00000 f -0000000083 00000 f -0000000084 00000 f -0000000085 00000 f -0000000088 00000 f -0001828677 00000 n -0001828708 00000 n -0000000089 00000 f -0000000090 00000 f -0000000091 00000 f -0000000092 00000 f -0000000093 00000 f -0000000094 00000 f -0000000095 00000 f -0000000096 00000 f -0000000097 00000 f -0000000098 00000 f -0000000099 00000 f -0000000100 00000 f -0000000101 00000 f -0000000102 00000 f -0000000103 00000 f -0000000104 00000 f -0000000105 00000 f -0000000106 00000 f -0000000107 00000 f -0000000108 00000 f -0000000109 00000 f -0000000110 00000 f -0000000111 00000 f -0000000112 00000 f -0000000113 00000 f -0000000114 00000 f -0000000115 00000 f -0000000116 00000 f -0000000117 00000 f -0000000118 00000 f -0000000119 00000 f -0000000120 00000 f -0000000121 00000 f -0000000122 00000 f -0000000123 00000 f -0000000124 00000 f -0000000125 00000 f -0000000126 00000 f -0000000127 00000 f -0000000128 00000 f -0000000129 00000 f -0000000130 00000 f -0000000131 00000 f -0000000132 00000 f -0000000133 00000 f -0000000134 00000 f -0000000135 00000 f -0000000136 00000 f -0000000137 00000 f -0000000139 00000 f -0001828293 00000 n -0000000140 00000 f -0000000141 00000 f -0000000142 00000 f -0000000143 00000 f -0000000144 00000 f -0000000145 00000 f -0000000146 00000 f -0000000147 00000 f -0000000150 00000 f -0001828559 00000 n -0001828591 00000 n -0000000151 00000 f -0000000152 00000 f -0000000153 00000 f -0000000154 00000 f -0000000155 00000 f -0000000156 00000 f -0000000157 00000 f -0000000158 00000 f -0000000159 00000 f -0000000160 00000 f -0000000161 00000 f -0000000162 00000 f -0000000163 00000 f -0000000164 00000 f -0000000165 00000 f -0000000166 00000 f -0000000167 00000 f -0000000168 00000 f -0000000169 00000 f -0000000170 00000 f -0000000171 00000 f -0000000172 00000 f -0000000173 00000 f -0000000174 00000 f -0000000175 00000 f -0000000176 00000 f -0000000177 00000 f -0000000178 00000 f -0000000179 00000 f -0000000180 00000 f -0000000181 00000 f -0000000182 00000 f -0000000183 00000 f -0000000184 00000 f -0000000185 00000 f -0000000186 00000 f -0000000187 00000 f -0000000188 00000 f -0000000189 00000 f -0000000190 00000 f -0000000191 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0001828367 00000 n -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0001828441 00000 n -0001828473 00000 n -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000000000 00000 f -0000072536 00000 n -0000072925 00000 n -0000073416 00000 n -0000073802 00000 n -0000074179 00000 n -0000074549 00000 n -0000074930 00000 n -0000075334 00000 n -0000072344 00000 n -0001828909 00000 n -0000066906 00000 n -0000631782 00000 n -0000239061 00000 n -0000239098 00000 n -0000238947 00000 n -0000070752 00000 n -0000071779 00000 n -0000071829 00000 n -0000072418 00000 n -0000072450 00000 n -0000214038 00000 n -0000190472 00000 n -0000167819 00000 n -0000152383 00000 n -0000135928 00000 n -0000114829 00000 n -0000091719 00000 n -0000075728 00000 n -0000076007 00000 n -0000091990 00000 n -0000115093 00000 n -0000136189 00000 n -0000152663 00000 n -0000168077 00000 n -0000190744 00000 n -0000214290 00000 n -0000241947 00000 n -0000239260 00000 n -0000239297 00000 n -0000631858 00000 n -0000632462 00000 n -0000634092 00000 n -0000644175 00000 n -0000709765 00000 n -0000775355 00000 n -0000840945 00000 n -0000906535 00000 n -0000972125 00000 n -0001037715 00000 n -0001103305 00000 n -0001168895 00000 n -0001234485 00000 n -0001300075 00000 n -0001365665 00000 n -0001369021 00000 n -0001434611 00000 n -0001500201 00000 n -0001565791 00000 n -0001631381 00000 n -0001696971 00000 n -0001762561 00000 n -0001828936 00000 n -trailer -<<585392D59D30AD49AFE28BD05B83168A>]>> -startxref -1829123 -%%EOF diff --git a/browsers/edge/images/prelaunch-edge-and-preload-tabs-sm.png b/browsers/edge/images/prelaunch-edge-and-preload-tabs-sm.png index 51dfd7258a..823309be3e 100644 Binary files a/browsers/edge/images/prelaunch-edge-and-preload-tabs-sm.png and b/browsers/edge/images/prelaunch-edge-and-preload-tabs-sm.png differ diff --git a/browsers/edge/images/prelaunch-edge-and-preload-tabs.png b/browsers/edge/images/prelaunch-edge-and-preload-tabs.png index b786cfb3bb..a287ebb8fd 100644 Binary files a/browsers/edge/images/prelaunch-edge-and-preload-tabs.png and b/browsers/edge/images/prelaunch-edge-and-preload-tabs.png differ diff --git a/browsers/edge/images/prelaunch-edge-only-sm.png b/browsers/edge/images/prelaunch-edge-only-sm.png index 875f1a8ce6..365bddf96a 100644 Binary files a/browsers/edge/images/prelaunch-edge-only-sm.png and b/browsers/edge/images/prelaunch-edge-only-sm.png differ diff --git a/browsers/edge/images/prelaunch-edge-only.png b/browsers/edge/images/prelaunch-edge-only.png index 89e1152ec6..975a745f3f 100644 Binary files a/browsers/edge/images/prelaunch-edge-only.png and b/browsers/edge/images/prelaunch-edge-only.png differ diff --git a/browsers/edge/images/preload-tabs-only-sm.png b/browsers/edge/images/preload-tabs-only-sm.png index 5ee58403f1..32089d3fce 100644 Binary files a/browsers/edge/images/preload-tabs-only-sm.png and b/browsers/edge/images/preload-tabs-only-sm.png differ diff --git a/browsers/edge/images/preload-tabs-only.png b/browsers/edge/images/preload-tabs-only.png index da42bc5a0f..01181d6b82 100644 Binary files a/browsers/edge/images/preload-tabs-only.png and b/browsers/edge/images/preload-tabs-only.png differ diff --git a/browsers/edge/images/use-enterprise-mode-with-microsoft-edge-sm.png b/browsers/edge/images/use-enterprise-mode-with-microsoft-edge-sm.png index 8a9b11ff19..99c2e9bf12 100644 Binary files a/browsers/edge/images/use-enterprise-mode-with-microsoft-edge-sm.png and b/browsers/edge/images/use-enterprise-mode-with-microsoft-edge-sm.png differ diff --git a/browsers/edge/includes/allow-address-bar-suggestions-include.md b/browsers/edge/includes/allow-address-bar-suggestions-include.md index a4176410a8..bd15a448b8 100644 --- a/browsers/edge/includes/allow-address-bar-suggestions-include.md +++ b/browsers/edge/includes/allow-address-bar-suggestions-include.md @@ -7,6 +7,7 @@ ### Supported values + |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| |Disabled |0 |0 |Prevented/not allowed. Hide the Address bar drop-down functionality and disable the _Show search and site suggestions as I type_ toggle in Settings. |![Most restricted value](../images/check-gn.png) | diff --git a/browsers/edge/includes/allow-adobe-flash-include.md b/browsers/edge/includes/allow-adobe-flash-include.md index a00ce21139..669cdf2257 100644 --- a/browsers/edge/includes/allow-adobe-flash-include.md +++ b/browsers/edge/includes/allow-adobe-flash-include.md @@ -9,7 +9,7 @@ |Group Policy |MDM |Registry |Description | |---|:---:|:---:|---| |Disabled |0 |0 |Prevented/not allowed | -|Enabled
**(default)** |1 |1 |Allowed | +|Enabled **(default)** |1 |1 |Allowed | --- ### ADMX info and settings @@ -27,7 +27,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\Addons +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Addons - **Value name:** FlashPlayerEnabled - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/allow-clearing-browsing-data-include.md b/browsers/edge/includes/allow-clearing-browsing-data-include.md index 8e2a7e60bd..96e804b8cd 100644 --- a/browsers/edge/includes/allow-clearing-browsing-data-include.md +++ b/browsers/edge/includes/allow-clearing-browsing-data-include.md @@ -6,9 +6,10 @@ ### Supported values + |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Prevented/not allowed. Users can configure the _Clear browsing data_ option in Settings. | | +|Disabled or not configured **(default)** |0 |0 |Prevented/not allowed. Users can configure the _Clear browsing data_ option in Settings. | | |Enabled |1 |1 |Allowed. Clear the browsing data upon exit automatically. |![Most restricted value](../images/check-gn.png) | --- @@ -27,8 +28,8 @@ - **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/ClearBrowsingDataOnExit - **Data type:** Integer -#### *Registry -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Privacy +#### Registry +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Privacy - **Value name:** ClearBrowsingHistoryOnExit - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/allow-ext-telemetry-books-tab-include.md b/browsers/edge/includes/allow-ext-telemetry-books-tab-include.md index 96da415a28..5d516b75b6 100644 --- a/browsers/edge/includes/allow-ext-telemetry-books-tab-include.md +++ b/browsers/edge/includes/allow-ext-telemetry-books-tab-include.md @@ -8,8 +8,8 @@ |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Depending on the device configuration, Microsoft Edge gathers only basic diagnostic data. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Gathers both basic and additional diagnostic data. | | +|Disabled or not configured
**(default)** |0 |0 |Gather and send only basic diagnostic data. |![Most restricted value](../images/check-gn.png) | +|Enabled |1 |1 |Gather all diagnostic data. For this policy to work correctly, you must set the diagnostic data in _Settings > Diagnostics & feedback_ to **Full**. | | --- ### ADMX info and settings @@ -27,7 +27,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary - **Value name:** EnableExtendedBooksTelemetry - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/allow-extensions-include.md b/browsers/edge/includes/allow-extensions-include.md index 95895b9817..d779ecdd05 100644 --- a/browsers/edge/includes/allow-extensions-include.md +++ b/browsers/edge/includes/allow-extensions-include.md @@ -27,7 +27,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Extensions +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Extensions - **Value name:** ExtensionsEnabled - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/allow-full-screen-include.md b/browsers/edge/includes/allow-full-screen-include.md index b7fc715298..82d4ac9996 100644 --- a/browsers/edge/includes/allow-full-screen-include.md +++ b/browsers/edge/includes/allow-full-screen-include.md @@ -29,7 +29,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\Main +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main - **Value name:** AllowFullScreenMode - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/allow-inprivate-browsing-include.md b/browsers/edge/includes/allow-inprivate-browsing-include.md index 727ded18a6..aed98d6009 100644 --- a/browsers/edge/includes/allow-inprivate-browsing-include.md +++ b/browsers/edge/includes/allow-inprivate-browsing-include.md @@ -29,7 +29,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main - **Value name:** AllowInPrivate - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/allow-microsoft-compatibility-list-include.md b/browsers/edge/includes/allow-microsoft-compatibility-list-include.md index aabd2fb773..7feffa1941 100644 --- a/browsers/edge/includes/allow-microsoft-compatibility-list-include.md +++ b/browsers/edge/includes/allow-microsoft-compatibility-list-include.md @@ -27,7 +27,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\BrowserEmulation +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\BrowserEmulation - **Value name:** MSCompatibilityMode - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/allow-prelaunch-include.md b/browsers/edge/includes/allow-prelaunch-include.md index 4721684c1f..fc39431ec2 100644 --- a/browsers/edge/includes/allow-prelaunch-include.md +++ b/browsers/edge/includes/allow-prelaunch-include.md @@ -33,7 +33,7 @@ For more details about configuring the prelaunch and preload options, see [Prela - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\ +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\ - **Value name:** AllowPrelaunch - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/allow-printing-include.md b/browsers/edge/includes/allow-printing-include.md index e6bea96847..196a72daea 100644 --- a/browsers/edge/includes/allow-printing-include.md +++ b/browsers/edge/includes/allow-printing-include.md @@ -27,7 +27,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main - **Value name:** AllowPrinting - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/allow-saving-history-include.md b/browsers/edge/includes/allow-saving-history-include.md index f9d38d178e..db571b2059 100644 --- a/browsers/edge/includes/allow-saving-history-include.md +++ b/browsers/edge/includes/allow-saving-history-include.md @@ -16,7 +16,7 @@ ### ADMX info and settings #### ADMX info -- **GP English name:** Allow saving history +- **GP English name:** Allow Saving History - **GP name:** AllowSavingHistory - **GP path:** Windows Components/Microsoft Edge - **GP ADMX file name:** MicrosoftEdge.admx @@ -28,7 +28,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main - **Value name:** AllowSavingHistory - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/allow-search-engine-customization-include.md b/browsers/edge/includes/allow-search-engine-customization-include.md index 70eb67b646..0ee8c5866e 100644 --- a/browsers/edge/includes/allow-search-engine-customization-include.md +++ b/browsers/edge/includes/allow-search-engine-customization-include.md @@ -32,7 +32,7 @@ For more details about configuring the search engine, see [Search engine customi #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Protected +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Protected - **Value name:** AllowSearchEngineCustomization - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/allow-shared-folder-books-include.md b/browsers/edge/includes/allow-shared-folder-books-include.md index 16ea570af7..ca16e49ee0 100644 --- a/browsers/edge/includes/allow-shared-folder-books-include.md +++ b/browsers/edge/includes/allow-shared-folder-books-include.md @@ -8,9 +8,11 @@ |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| |Disabled or not configured
**(default)** |0 |0 |Prevented/not allowed, but Microsoft Edge downloads book files to a per-user folder for each user. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Allowed. Microsoft Edge downloads book files to a shared folder.| | +|Enabled |1 |1 |Allowed. Microsoft Edge downloads book files to a shared folder. For this policy to work correctly, you must also enable the Allow a Windows app to share application data between users group policy. Also, the users must be signed in with a school or work account.| | --- +![Allow a shared books folder](../images/allow-shared-books-folder_sm.png) + ### ADMX info and settings #### ADMX info @@ -26,8 +28,12 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\BooksLibrary - **Value name:** UseSharedFolderForBooks - **Value type:** REG_DWORD +### Related policies + +**Allow a Windows app to share application data between users:** [!INCLUDE [allow-windows-app-to-share-data-users-shortdesc](../shortdesc/allow-windows-app-to-share-data-users-shortdesc.md)] +

diff --git a/browsers/edge/includes/allow-sideloading-extensions-include.md b/browsers/edge/includes/allow-sideloading-extensions-include.md index 0ad2b3c542..b6ebf001c6 100644 --- a/browsers/edge/includes/allow-sideloading-extensions-include.md +++ b/browsers/edge/includes/allow-sideloading-extensions-include.md @@ -27,7 +27,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\Extensions +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Extensions - **Value name:** AllowSideloadingOfExtensions - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/allow-tab-preloading-include.md b/browsers/edge/includes/allow-tab-preloading-include.md index b80f9ce8b6..b09c405754 100644 --- a/browsers/edge/includes/allow-tab-preloading-include.md +++ b/browsers/edge/includes/allow-tab-preloading-include.md @@ -1,4 +1,4 @@ - + >*Supported versions: Microsoft Edge on Windows 10, version 1802*
>*Default setting: Enabled or not configured (Allowed)* @@ -8,10 +8,11 @@ |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| -|Enabled or not configured
**(default)** |0 |0 |Allowed. Preload Start and New tab pages. | | -|Disabled |1 |1 |Prevented/not allowed. |![Most restricted value](../images/check-gn.png) | +|Disabled |0 |0 |Prevented/not allowed. |![Most restricted value](../images/check-gn.png) | +|Enabled or not configured
**(default)** |1 |1 |Allowed. Preload Start and New tab pages. | | --- + ### Configuration options For more details about configuring the prelaunch and preload options, see [Prelaunch Microsoft Edge and preload tabs in the background](../group-policies/prelaunch-preload-gp.md). @@ -19,7 +20,7 @@ For more details about configuring the prelaunch and preload options, see [Prela ### ADMX info and settings #### ADMX info -- **GP English name:** Allow Microsoft Edge to start and load the Start and New Tab pages in the background at Windows startup and each time Microsoft Edge is closed +- **GP English name:** Allow Microsoft Edge to load the Start and New Tab pages in the background at Windows startup and each time Microsoft Edge is closed - **GP name:** AllowTabPreloading - **GP path:** Windows Components/Microsoft Edge - **GP ADMX file name:** MicrosoftEdge.admx diff --git a/browsers/edge/includes/allow-web-content-new-tab-page-include.md b/browsers/edge/includes/allow-web-content-new-tab-page-include.md index ac8e6d2951..7c6889225d 100644 --- a/browsers/edge/includes/allow-web-content-new-tab-page-include.md +++ b/browsers/edge/includes/allow-web-content-new-tab-page-include.md @@ -1,5 +1,5 @@ ->*Supported versions: Microsoft Edge on Windows 10*
+>*Supported versions: Microsoft Edge on Windows 10*
>*Default setting: Enabled (Default New tab page loads)* @@ -30,7 +30,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\ServiceUI - **Value name:** AllowWebContentOnNewTabPage - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/always-enable-book-library-include.md b/browsers/edge/includes/always-enable-book-library-include.md index d5f292b182..62804e3f93 100644 --- a/browsers/edge/includes/always-enable-book-library-include.md +++ b/browsers/edge/includes/always-enable-book-library-include.md @@ -28,7 +28,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main - **Value name:** AlwaysEnableBooksLibrary - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/configure-additional-search-engines-include.md b/browsers/edge/includes/configure-additional-search-engines-include.md index f49aa45f71..f77a076f2a 100644 --- a/browsers/edge/includes/configure-additional-search-engines-include.md +++ b/browsers/edge/includes/configure-additional-search-engines-include.md @@ -15,17 +15,7 @@ ### Configuration options -| **Set default search engine** | **Allow search engine customization** | **Configure additional search engines** | **Outcome** | -| --- | --- | --- | --- | -| Not configured (default) | Disabled | Disabled or not configured (default) | Default search engine specified in App settings. Users cannot make changes. | -| Not configured (default) | Enabled or not configured (default) | Disabled or not configured (default) | Default search engine specified in App settings. Users can make changes to the default search engine at any time. | -| Disabled | Disabled | Disabled or not configured (default) | Users cannot add, remove, or change any of the search engines, but they can set a default search engine. | -| Disabled | Enabled or not configured (default) | Disabled or not configured (default) | Users can add new search engines or change the default search engine, in Settings. | -| Enabled | Disabled | Disabled or not configured (default) | Set the default search engine preventing users from making changes. | -| Enabled | Enabled or not configured (default) | Disabled or not configured (default) | Set the default search engine and allow users to add search engines or make changes. | ---- - - +For more details about configuring the search engine, see [Search engine customization](../group-policies/search-engine-customization-gp.md). ### ADMX info and settings #### ADMX info @@ -42,7 +32,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\OpenSearch +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\OpenSearch - **Value name:** ConfigureAdditionalSearchEngines - **Value type:** REG_SZ diff --git a/browsers/edge/includes/configure-adobe-flash-click-to-run-include.md b/browsers/edge/includes/configure-adobe-flash-click-to-run-include.md index c1a93a7712..d7b0fa6adb 100644 --- a/browsers/edge/includes/configure-adobe-flash-click-to-run-include.md +++ b/browsers/edge/includes/configure-adobe-flash-click-to-run-include.md @@ -27,7 +27,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Security +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Security - **Value name:** FlashClickToRunMode - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/configure-allow-flash-url-list-include.md b/browsers/edge/includes/configure-allow-flash-url-list-include.md index 1f13125cd7..919215341c 100644 --- a/browsers/edge/includes/configure-allow-flash-url-list-include.md +++ b/browsers/edge/includes/configure-allow-flash-url-list-include.md @@ -29,7 +29,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\ +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\ - **Value name:** - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/configure-autofill-include.md b/browsers/edge/includes/configure-autofill-include.md index 5d4adef785..3464943193 100644 --- a/browsers/edge/includes/configure-autofill-include.md +++ b/browsers/edge/includes/configure-autofill-include.md @@ -1,6 +1,6 @@ >*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Not configured* +>*Default setting: Not configured (Blank)* [!INCLUDE [configure-autofill-shortdesc](../shortdesc/configure-autofill-shortdesc.md)] @@ -27,7 +27,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main - **Value name:** Use FormSuggest - **Value type:** REG_SZ diff --git a/browsers/edge/includes/configure-browser-telemetry-for-m365-analytics-include.md b/browsers/edge/includes/configure-browser-telemetry-for-m365-analytics-include.md index 669ba4bf75..3a0386c574 100644 --- a/browsers/edge/includes/configure-browser-telemetry-for-m365-analytics-include.md +++ b/browsers/edge/includes/configure-browser-telemetry-for-m365-analytics-include.md @@ -1,11 +1,16 @@ ->*Supported versions: Microsoft Edge on Windows 10, next major update to Windows*
+>*Supported versions: Microsoft Edge on Windows 10, next major update to Windows*
>*Default setting: Disabled or not configured (No data collected or sent)* [!INCLUDE [configure-browser-telemetry-for-m365-analytics-shortdesc](../shortdesc/configure-browser-telemetry-for-m365-analytics-shortdesc.md)] + +>[!IMPORTANT] +>For this policy to work, enable the Allow Telemetry policy with the _Enhanced_ option and enable the Configure the Commercial ID policy by providing the Commercial ID. + ### Supported values + |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| |Disabled or not configured
**(default)** |0 |0 |No data collected or sent |![Most restricted value](../images/check-gn.png) | @@ -14,8 +19,11 @@ |Enabled |3 |3 |Send both intranet and Internet history | | --- ->[!IMPORTANT] ->For this policy to work, enable the Allow Telemetry policy with the _Enhanced_ option and enable the Configure the Commercial ID policy by providing the Commercial ID. +>>You can find this policy and the related policies in the following location of the Group Policy Editor: +>> +>>**_Computer Configuration\\Administrative Templates\\Windows Components\\Data Collection and Preview Builds\\_** +>>
  • Allow Telemetry = Enabled, _Enhanced_
  • Configure the Commercial ID = String of the Commercial ID
  • Configure collection of browsing data for Microsoft 365 Analytics
+ ### ADMX info and settings @@ -34,13 +42,13 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection +- **Path:** HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection - **Value name:** MicrosoftEdgeDataOptIn - **Value type:** REG_DWORD ### Related policies -- Allow Telemetry: Determine the highest level of Windows diagnostic data sent to Microsoft. When you enable this policy, users can change their Telemetry Settings but prevent users from choosing a higher level than configured. +- Allow Telemetry: Allows Microsoft to run diagnostics on the device and troubleshoot. The default setting for Allow Telemetry is set to _Enhanced_ (2 for MDM). - Configure the Commercial ID: Define the Commercial ID used to associate the device's telemetry data as belonging to a given organization. -
\ No newline at end of file +
diff --git a/browsers/edge/includes/configure-do-not-track-include.md b/browsers/edge/includes/configure-do-not-track-include.md index 95011f3a6b..74478b6881 100644 --- a/browsers/edge/includes/configure-do-not-track-include.md +++ b/browsers/edge/includes/configure-do-not-track-include.md @@ -9,7 +9,7 @@ |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| |Not configured
**(default)** |Blank |Blank |Do not send tracking information but let users choose to send tracking information to sites they visit. | | -|Disabled |1 |1 |Never send tracking information. | | +|Disabled |0 |0 |Never send tracking information. | | |Enabled |1 |1 |Send tracking information. |![Most restricted value](../images/check-gn.png) | --- @@ -27,7 +27,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main - **Value name:** DoNotTrack - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/configure-edge-kiosk-reset-idle-timeout-include.md b/browsers/edge/includes/configure-edge-kiosk-reset-idle-timeout-include.md index 44539d481e..a1dfe3e91c 100644 --- a/browsers/edge/includes/configure-edge-kiosk-reset-idle-timeout-include.md +++ b/browsers/edge/includes/configure-edge-kiosk-reset-idle-timeout-include.md @@ -28,7 +28,7 @@ You must set the Configure kiosk mode policy to enabled (1 - InPrivate public br - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\KioskMode +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\KioskMode - **Value name:**ConfigureKioskResetAfterIdleTimeout - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/configure-enterprise-mode-site-list-include.md b/browsers/edge/includes/configure-enterprise-mode-site-list-include.md index 9d99e69788..6b347ce989 100644 --- a/browsers/edge/includes/configure-enterprise-mode-site-list-include.md +++ b/browsers/edge/includes/configure-enterprise-mode-site-list-include.md @@ -10,7 +10,7 @@ |Group Policy |MDM |Registry |Description | |---|:---:|:---:|---| |Disabled or not configured
**(default)** |0 |0 |Turned off. Microsoft Edge does not check the Enterprise Mode Site List, and in this case, users might experience problems while using legacy apps. | -|Enabled |1 |1 |Turned on. Microsoft Edge checks the Enterprise Mode Site List if configured. If an XML file exists in the cache container, IE11 waits 65 seconds and then checks the local cache for a new version from the server. If the server has a different version, Microsoft Edge uses the server file and stores it in the cache container. If you already use a site list, Enterprise Mode continues to work during the 65 second, but uses the existing file. To add the location to your site list, enter it in the **{URI}** box.

For details on how to configure the Enterprise Mode Site List, see the [Instructions](#instructions) section below. | +|Enabled |1 |1 |Turned on. Microsoft Edge checks the Enterprise Mode Site List if configured. If an XML file exists in the cache container, IE11 waits 65 seconds and then checks the local cache for a new version from the server. If the server has a different version, Microsoft Edge uses the server file and stores it in the cache container. If you already use a site list, Enterprise Mode continues to work during the 65 second, but uses the existing file. To add the location to your site list, enter it in the **{URI}** box.

For details on how to configure the Enterprise Mode Site List, see [Interoperability and enterprise guidance](../group-policies/interoperability-enterprise-guidance-gp.md). | --- ### ADMX info and settings @@ -29,7 +29,7 @@ - **Data type:** String #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\Main\EnterpriseMode +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main\EnterpriseMode - **Value name:** SiteList - **Value type:** REG_SZ @@ -50,66 +50,6 @@ - [Enterprise Mode and the Enterprise Mode Site List XML file](https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/what-is-enterprise-mode#enterprise-mode-and-the-enterprise-mode-site-list-xml-file). The Enterprise Mode Site List is an XML document that specifies a list of sites, their compat mode, and their intended browser. Using Enterprise Mode Site List Manager (schema v.2), you can automatically start a webpage using a specific browser. In the case of IE11, the webpage can also be launched in a specific compat mode, so it always renders correctly. Your users can easily view this site list by typing about:compat in either Microsoft Edge or IE11. -### Scenarios - -Certain sites or web apps still use ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology, which Microsoft Edge does not support. If you have web sites or web apps that still use this technology and need IE11 to run, you must use Enterprise Mode and the Enterprise Mode Site List to address common compatibility issues with legacy apps. Enterprise Mode is a compatibility -mode that runs on Internet Explorer 11 and Microsoft Edge on Windows 10 devices. - -### Instructions - - -You build your Enterprise Mode list with the Enterprise Mode Site List Manager and apply it with Group Policy. - -To turn it on for IE 11, you enable [Use the Enterprise Mode IE website list](https://docs.microsoft.com/en-us/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list), -which is the equivalent to this Microsoft Edge policy. - ->[!NOTE] ->We recommend that you store and download your website list from a secure web server (https://), to help protect against data tampering. After the list is downloaded, it is stored locally on your user's computer so if the centralized file location is unavailable, they can still use Enterprise Mode. - -- [Step 1. Turn on Enterprise Mode](#step-1-turn-on-enterprise-mode) -- [Step 2. (Optional) Import your Enterprise Mode Site List](#step-2-optional-import-your-enterprise-mode-site-list) -- [Step 3. Add sites to your list](#step-3-add-sites-to-your-list) -- [Step 4. Send all intranet sites to Internet Explorer 11](#step-5-send-all-intranet-sites-to-internet-explorer-11) - -#### Step 1. Turn on Enterprise Mode - -[!INCLUDE [turn-on-enterprise-mode-and-use-a-site-list](../../enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md)] - -#### Step 2. (Optional) Import your Enterprise Mode Site List - -[!INCLUDE [import-into-the-enterprise-mode-site-list-mgr-include](../../includes/import-into-the-enterprise-mode-site-list-mgr-include.md)] - -#### Step 3. Add sites to your list - -1. In the Enterprise Mode Site List Manager, click **Add**. - -2. In the **URL** box, type or paste the URL for the website experiencing compatibility problems, like *\*.com or *\*.com/*\*.

You do not need to include the `http://` or `https://` designation. The tool automatically tries both versions during validation. - -3. In the **Notes about URL**, enter any comments about the website.

Administrators can only see comments while they are in this tool. - -4. Click in the **Open in IE** column next to the URL that should open in IE11.

The path within a domain can require a different compatibility mode from the domain itself. For example, the domain might look fine in the default IE11 browser, but the path might have problems and require the use of Enterprise Mode. If you added the domain previously, your original compatibility choice is still selected. However, if the domain is new, Enterprise Mode is automatically selected. - -5. Click **Save** to validate your website and to add it to the site list for your enterprise.

If your site passes validation, it is added to the global compatibility list. If the site fails to pass validation, an error message displays explaining the problem. You can either cancel the site or ignore the validation problem and add it to your list anyway. - -6. On the **File** menu, go to where you want to save the file, and then click **Save to XML**.

You can save the file locally or to a network share. However, you must make sure you deploy it to the location specified in your Group Policy setting. - -#### Step 4. Send all intranet sites to Internet Explorer 11 - -Enabling the Send all intranet sites to Internet Explorer 11 policy automatically opens all intranet sites in IE11, even if the users have Microsoft Edge as their default browser. - -1. In Group Policy Editor, navigate to:

**Computer Configuration\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** - -2. Click **Enabled** and then refresh the policy and then vew the affected sites in Microsoft Edge.

A message displays saying that the page needs to open in IE. At the same time, the page opens in IE11 automatically; in a new frame if it is not yet running, or in a new tab. - -### Troubleshooting - -- If an XML already exists, make sure it is syntactically correct. - -- If an update or delete operation failed, check if the entry already exists in the site list. - -- If a user is not able to sign in, the account might not have access. Check if the account is marked as active. - -- Check if the Enterprise Mode Site List is loaded correctly by browsing to "about:compat" in both Microsoft Edge and Internet Explorer. Deselect the Microsoft Compatibility List to see your custom entries.

\ No newline at end of file diff --git a/browsers/edge/includes/configure-favorites-bar-include.md b/browsers/edge/includes/configure-favorites-bar-include.md index 1b797ebb79..f4f537218f 100644 --- a/browsers/edge/includes/configure-favorites-bar-include.md +++ b/browsers/edge/includes/configure-favorites-bar-include.md @@ -1,5 +1,5 @@ ->*Supported versions: Microsoft Edge on Windows 10, new major release*
+>*Supported versions: Microsoft Edge on Windows 10, new major release* >*Default setting: Not configured (Hidden)* @@ -8,9 +8,10 @@ ### Supported values + |Group Policy |MDM |Registry |Description | |---|:---:|:---:|---| -|Not configured
**(default)** |Blank |Blank |Hide the favorites bar but show it on the Start and New tab pages. The favorites bar toggle, in Settings, is set to Off but enabled allowing users to make changes. | +|Not configured **(default)** |Blank |Blank |Hide the favorites bar but show it on the Start and New tab pages. The favorites bar toggle, in Settings, is set to Off but enabled allowing users to make changes. | |Disabled |0 |0 |Hide the favorites bar on all pages. Also, the favorites bar toggle, in Settings, is set to Off and disabled preventing users from making changes. Microsoft Edge also hides the “show bar/hide bar” option in the context menu. | |Enabled |1 |1 |Show the favorites bar on all pages. Also, the favorites bar toggle, in Settings, is set to On and disabled preventing users from making changes. Microsoft Edge also hides the “show bar/hide bar” option in the context menu. | --- @@ -29,7 +30,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\Main +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main - **Value name:** ConfigureFavoritesBar - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/configure-home-button-include.md b/browsers/edge/includes/configure-home-button-include.md index c6362b39dc..d9cf247781 100644 --- a/browsers/edge/includes/configure-home-button-include.md +++ b/browsers/edge/includes/configure-home-button-include.md @@ -1,5 +1,5 @@ - ->*Supported versions: Microsoft Edge on Windows 10*
+ +>*Supported versions: Microsoft Edge on Windows 10, next major update to Windows* >*Default setting: Disabled or not configured (Show home button and load the Start page)* @@ -12,21 +12,21 @@ |---|:---:|:---:|---| |Disabled or not configured
**(default)** |0 |0 |Show home button and load the Start page. | |Enabled |1 |1 |Show home button and load the New tab page. | -|Enabled |2 |2 |Show home button and load the custom URL defined in the Set Home button URL policy. | +|Enabled |2 |2 |Show home button and load the custom URL defined in the Set Home Button URL policy. | |Enabled |3 |3 |Hide home button. | --- ### Configuration options -For more details about configuring the different Home button options, see [Home button](../group-policies/home-button-gp.md). +For more details about configuring the different Home button options, see [Home button configuration options](../group-policies/home-button-gp.md). >[!TIP] ->If you want to make changes to this policy:
  1. Enable the **Unlock Home Button** policy.
  2. Make changes to the **Configure Home button** policy or **Set Home button URL** policy.
  3. Disable the **Unlock Home Button** policy.
+>If you want to make changes to this policy:
  1. Enable the **Unlock Home Button** policy.
  2. Make changes to the **Configure Home Button** policy or **Set Home Button URL** policy.
  3. Disable the **Unlock Home Button** policy.
### ADMX info and settings #### ADMX info -- **GP English name:** Configure Home button +- **GP English name:** Configure Home Button - **GP name:** ConfigureHomeButton - **GP element:** ConfigureHomeButtonDropdown - **GP path:** Windows Components/Microsoft Edge @@ -39,15 +39,15 @@ For more details about configuring the different Home button options, see [Home - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings - **Value name:** ConfigureHomeButton - **Value type:** REG_DWORD ### Related policies -- [Set Home button URL](../new-policies.md#set-home-button-url): [!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] +- [Set Home Button URL](../new-policies.md#set-home-button-url): [!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] -- [Unlock Home button](../new-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)] +- [Unlock Home Button](../new-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)]
\ No newline at end of file diff --git a/browsers/edge/includes/configure-inprivate-include.md b/browsers/edge/includes/configure-inprivate-include.md index c04c0d0150..c29a818b47 100644 --- a/browsers/edge/includes/configure-inprivate-include.md +++ b/browsers/edge/includes/configure-inprivate-include.md @@ -25,7 +25,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\ +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\ - **Value name:** - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/configure-microsoft-edge-kiosk-mode-include.md b/browsers/edge/includes/configure-microsoft-edge-kiosk-mode-include.md index 034fd5b55e..54880f184f 100644 --- a/browsers/edge/includes/configure-microsoft-edge-kiosk-mode-include.md +++ b/browsers/edge/includes/configure-microsoft-edge-kiosk-mode-include.md @@ -32,7 +32,7 @@ For this policy to work, you must configure Microsoft Edge in assigned access; o - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\KioskMode +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\KioskMode - **Value name:** ConfigureKioskMode - **Value type:** REG_SZ diff --git a/browsers/edge/includes/configure-open-edge-with-include.md b/browsers/edge/includes/configure-open-edge-with-include.md index 95da8a5fbd..70ba21e6ab 100644 --- a/browsers/edge/includes/configure-open-edge-with-include.md +++ b/browsers/edge/includes/configure-open-edge-with-include.md @@ -22,7 +22,7 @@ ### Configuration options -For more details about configuring the Start pages, see [Start pages](../group-policies/start-pages-gp.md). +For more details about configuring the Start pages, see [Start pages configuration options](../group-policies/start-pages-gp.md). >[!TIP] @@ -44,7 +44,7 @@ For more details about configuring the Start pages, see [Start pages](../group-p - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings - **Value name:** ConfigureOpenEdgeWith - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/configure-password-manager-include.md b/browsers/edge/includes/configure-password-manager-include.md index 01ab2e2bea..eb1e236003 100644 --- a/browsers/edge/includes/configure-password-manager-include.md +++ b/browsers/edge/includes/configure-password-manager-include.md @@ -14,9 +14,8 @@ --- Verify not allowed/disabled settings: -1. In the upper-right corner of Microsoft Edge or Microsoft Edge for Windows 10 Mobile, click or tap ellipses (…). -2. Click **Settings** and select **View Advanced settings**. -3. Verify the settings **Save Password** is toggled off or on and is greyed out. +1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. +2. Verify the settings **Save Password** is toggled off or on and is greyed out. ### ADMX info and settings #### ADMX info @@ -32,7 +31,7 @@ Verify not allowed/disabled settings: - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\Main +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Main - **Value name:** FormSuggest Passwords - **Value type:** REG_SZ diff --git a/browsers/edge/includes/configure-pop-up-blocker-include.md b/browsers/edge/includes/configure-pop-up-blocker-include.md index 0b63fbd96e..cb5d637204 100644 --- a/browsers/edge/includes/configure-pop-up-blocker-include.md +++ b/browsers/edge/includes/configure-pop-up-blocker-include.md @@ -27,7 +27,7 @@ - **Data type:** Integer ### Registry -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main - **Value name:** AllowPopups - **Value type:** REG_SZ diff --git a/browsers/edge/includes/configure-search-suggestions-address-bar-include.md b/browsers/edge/includes/configure-search-suggestions-address-bar-include.md index 5ee81ccabb..fbe5457aa0 100644 --- a/browsers/edge/includes/configure-search-suggestions-address-bar-include.md +++ b/browsers/edge/includes/configure-search-suggestions-address-bar-include.md @@ -1,6 +1,6 @@ >*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Not configured* +>*Default setting: Not configured (Blank)* [!INCLUDE [configure-search-suggestions-in-address-bar-shortdesc](../shortdesc/configure-search-suggestions-in-address-bar-shortdesc.md)] @@ -27,7 +27,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\SearchScopes - **Value name:** ShowSearchSuggestionsGlobal - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/configure-start-pages-include.md b/browsers/edge/includes/configure-start-pages-include.md index 9a3c3c9861..4a5c023576 100644 --- a/browsers/edge/includes/configure-start-pages-include.md +++ b/browsers/edge/includes/configure-start-pages-include.md @@ -14,7 +14,7 @@ ### Configuration options -For more details about configuring the Start pages, see [Start pages](../group-policies/start-pages-gp.md). +For more details about configuring the Start pages, see [Start pages configuration options](../group-policies/start-pages-gp.md). ### ADMX info and settings #### ADMX info diff --git a/browsers/edge/includes/configure-windows-defender-smartscreen-include.md b/browsers/edge/includes/configure-windows-defender-smartscreen-include.md index 2baca3bc94..b9545d480d 100644 --- a/browsers/edge/includes/configure-windows-defender-smartscreen-include.md +++ b/browsers/edge/includes/configure-windows-defender-smartscreen-include.md @@ -8,15 +8,14 @@ |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| -|Not configured |Blank |Blank |Users can choose to use Windows Defender SmartScreen or not. | | +|Not configured |Blank |Blank |Users can choose to use Windows Defender SmartScreen. | | |Disabled |0 |0 |Turned off. Do not protect users from potential threats and prevent users from turning it on. | | |Enabled |1 |1 |Turned on. Protect users from potential threats and prevent users from turning it off. |![Most restricted value](../images/check-gn.png) | --- -To verify Windows Defender SmartScreen is turned off (disabled): -1. In the upper-right corner of Microsoft Edge or Microsoft Edge for Windows 10 Mobile, click or tap the ellipses (**...**). -2. Click **Settings** and select **View Advanced Settings**. -3. At the bottom, verify that **Help protect me from malicious sites and download with SmartScreen Filter** is greyed out.

![Verify that Windows Defender SmartScreen is turned off (disabled)](../images/allow-smart-screen-validation.PNG) +To verify Windows Defender SmartScreen is turned off (disabled): +1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. +2. Verify the setting **Help protect me from malicious sites and download with SmartScreen Filter** is disabled.

![Verify that Windows Defender SmartScreen is turned off (disabled)](../images/allow-smart-screen-validation.PNG) ### ADMX info and settings diff --git a/browsers/edge/includes/disable-lockdown-of-start-pages-include.md b/browsers/edge/includes/disable-lockdown-of-start-pages-include.md index 9ebf113025..06a0642481 100644 --- a/browsers/edge/includes/disable-lockdown-of-start-pages-include.md +++ b/browsers/edge/includes/disable-lockdown-of-start-pages-include.md @@ -8,13 +8,13 @@ |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| -|Not configured |0 |0 |Lockdown Start pages configured in either the Configure Open Microsoft Edge With policy and Configure Start Pages policy. |![Most restricted value](../images/check-gn.png) | +|Not configured |0 |0 |Lock down Start pages configured in either the Configure Open Microsoft Edge With policy and Configure Start Pages policy. |![Most restricted value](../images/check-gn.png) | |Enabled |1 |1 |Unlocked. Users can make changes to all configured start pages.

When you enable this policy and define a set of URLs in the Configure Start Pages policy, Microsoft Edge uses the URLs defined in the Configure Open Microsoft Edge With policy. | | --- ### Configuration options -For more details about configuring the Start pages, see [Start pages](../group-policies/start-pages-gp.md). +For more details about configuring the Start pages, see [Start pages configuration options](../group-policies/start-pages-gp.md). ### ADMX info and settings diff --git a/browsers/edge/includes/do-not-prompt-client-cert-if-only-one-exists-include.md b/browsers/edge/includes/do-not-prompt-client-cert-if-only-one-exists-include.md index b1fc2dd88c..3d4feeb168 100644 --- a/browsers/edge/includes/do-not-prompt-client-cert-if-only-one-exists-include.md +++ b/browsers/edge/includes/do-not-prompt-client-cert-if-only-one-exists-include.md @@ -24,7 +24,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\ +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\ - **Value name:** - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/do-not-sync-browser-settings-include.md b/browsers/edge/includes/do-not-sync-browser-settings-include.md index 87c355b74f..9673414962 100644 --- a/browsers/edge/includes/do-not-sync-browser-settings-include.md +++ b/browsers/edge/includes/do-not-sync-browser-settings-include.md @@ -1,5 +1,5 @@ ->*Supported versions: Microsoft Edge on Windows 10, next major update to Windows*
+>*Supported versions: Microsoft Edge on Windows 10*
>*Default setting: Disabled or not configured (Allowed/turned on)* [!INCLUDE [do-not-sync-browser-settings-shortdesc](../shortdesc/do-not-sync-browser-settings-shortdesc.md)] @@ -9,7 +9,7 @@ |Group Policy |MDM |Registry |Description | |---|:---:|:---:|---| |Disabled or not configured
**(default)** |0 |0 |Allowed/turned on. The “browser” group syncs automatically between user’s devices and lets users to make changes. | -|Enabled |2 |2 |Prevented/turned off. The “browser” group does not use the Sync your Settings option. | +|Enabled |2 |2 |Prevented/turned off. The “browser” group does not use the _Sync your Settings_ option. | --- ### Configuration options @@ -17,26 +17,23 @@ For more details about configuring the browser syncing options, see [Sync browser settings options](../group-policies/sync-browser-settings-gp.md). - - ### ADMX info and settings #### ADMX info - **GP English name:** Do not sync browser settings -- **GP name:** DoNotSyncBrowserSetting +- **GP name:** DisableWebBrowserSettingSync - **GP path:** Windows Components/Sync your settings - **GP ADMX file name:** SettingSync.admx #### MDM settings -- **MDM name:** [Experience/DoNotSyncBrowserSetting](../available-policies.md#do-not-sync-browser-settings) +- **MDM name:** [Experience/DoNotSyncBrowserSettings](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#experience-donotsyncbrowsersetting) - **Supported devices:** Desktop -- **URI full path:** ./Vendor/MSFT/Policy/Config/Experience/DoNotSyncBrowserSetting +- **URI full path:** ./Vendor/MSFT/Policy/Config/Experience/DoNotSyncBrowserSettings - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\Policies\Microsoft\Windows\SettingSync +- **Path:** HKLM\\Software\Policies\Microsoft\Windows\SettingSync - **Value name:** DisableWebBrowserSettingSyncUserOverride -- **Value type:** REG_DWORD - +- **Value ### Related policies @@ -48,4 +45,4 @@ For more details about configuring the browser syncing options, see [Sync browse [About sync setting on Microsoft Edge on Windows 10 devices](http://windows.microsoft.com/windows-10/about-sync-settings-on-windows-10-devices)

-

\ No newline at end of file +
diff --git a/browsers/edge/includes/do-not-sync-include.md b/browsers/edge/includes/do-not-sync-include.md index 8bd1b9e20f..91cfd76c74 100644 --- a/browsers/edge/includes/do-not-sync-include.md +++ b/browsers/edge/includes/do-not-sync-include.md @@ -1,6 +1,6 @@ >*Supported versions: Microsoft Edge on Windows 10*
->*Default setting: Disabled or not configured (Turned on)* +>*Default setting: Disabled or not configured (Allowed/turned on)* [!INCLUDE [do-not-sync-shortdesc](../shortdesc/do-not-sync-shortdesc.md)] @@ -9,7 +9,7 @@ |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| |Disabled or not configured
**(default)** |0 |0 |Allowed/turned on. Users can choose what to sync to their device. | | -|Enabled |2 |2 |Prevented/turned off. Disables the Sync your Settings toggle and prevents syncing. |![Most restricted value](../images/check-gn.png) | +|Enabled |2 |2 |Prevented/turned off. Disables the _Sync your Settings_ toggle and prevents syncing. |![Most restricted value](../images/check-gn.png) | --- ### ADMX info and settings @@ -17,7 +17,7 @@ - **GP English name:** Do not sync - **GP name:** AllowSyncMySettings - **GP path:** Windows Components/Sync your settings -- **GP ADMX file name:** MicrosoftEdge.admx +- **GP ADMX file name:** SettingSync.admx #### MDM settings - **MDM name:** Experience/[AllowSyncMySettings](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#experience-allowsyncmysettings) diff --git a/browsers/edge/includes/edge-respects-applocker-lists-include.md b/browsers/edge/includes/edge-respects-applocker-lists-include.md index 3f6b0aa3ce..60b8d8f5e0 100644 --- a/browsers/edge/includes/edge-respects-applocker-lists-include.md +++ b/browsers/edge/includes/edge-respects-applocker-lists-include.md @@ -15,7 +15,7 @@ |---|---| |ADMX info |
  • **GP English name:**
  • **GP name:**
  • **GP path:** Windows Components/Microsoft Edge
  • **GP ADMX file name:** MicrosoftEdge.admx
| |MDM settings |
  • **MDM name:** Browser/[]()
  • **Supported devices:** Desktop and Mobile
  • **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/
  • **Data type:** Integer
| -|Registry |
  • **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\
  • **Value name:**
  • **Value type:** REG_DWORD
| +|Registry |
  • **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\
  • **Value name:**
  • **Value type:** REG_DWORD
| --- diff --git a/browsers/edge/includes/keep-fav-sync-ie-edge-include.md b/browsers/edge/includes/keep-fav-sync-ie-edge-include.md index e9e73eb750..b1dda60948 100644 --- a/browsers/edge/includes/keep-fav-sync-ie-edge-include.md +++ b/browsers/edge/includes/keep-fav-sync-ie-edge-include.md @@ -8,8 +8,8 @@ |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Turned off/not syncing. | | -|Enabled |1 |1 |Turned on/syncing. |![Most restricted value](../images/check-gn.png) | +|Disabled or not configured
**(default)** |0 |0 |Turned off/not syncing | | +|Enabled |1 |1 |Turned on/syncing |![Most restricted value](../images/check-gn.png) | --- ### ADMX info and settings diff --git a/browsers/edge/includes/prevent-access-about-flag-include.md b/browsers/edge/includes/prevent-access-about-flag-include.md index a2f7492948..2ec1c055f5 100644 --- a/browsers/edge/includes/prevent-access-about-flag-include.md +++ b/browsers/edge/includes/prevent-access-about-flag-include.md @@ -9,7 +9,7 @@ |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| |Disabled or not configured
**(default)** |0 |0 |Allowed. | | -|Enabled |1 |1 |Prevents users from access the about:flags page. |![Most restricted value](../images/check-gn.png) | +|Enabled |1 |1 |Prevents users from accessing the about:flags page. |![Most restricted value](../images/check-gn.png) | --- ### ADMX info and settings diff --git a/browsers/edge/includes/prevent-first-run-webpage-open-include.md b/browsers/edge/includes/prevent-first-run-webpage-open-include.md index 61192efbcf..21acfb5de4 100644 --- a/browsers/edge/includes/prevent-first-run-webpage-open-include.md +++ b/browsers/edge/includes/prevent-first-run-webpage-open-include.md @@ -8,7 +8,7 @@ |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| -|Disabled or not configured
**(default)** |0 |0 |Allowed. Microsoft Edge loads the welcome page. | | +|Disabled or not configured
**(default)** |0 |0 |Allowed. Load the First Run webpage. | | |Enabled |1 |1 |Prevented. |![Most restricted value](../images/check-gn.png) | --- diff --git a/browsers/edge/includes/prevent-live-tile-pinning-start-include.md b/browsers/edge/includes/prevent-live-tile-pinning-start-include.md index 844e72d227..cfc5af6f08 100644 --- a/browsers/edge/includes/prevent-live-tile-pinning-start-include.md +++ b/browsers/edge/includes/prevent-live-tile-pinning-start-include.md @@ -9,7 +9,7 @@ |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| |Disabled or not configured
**(default)** |0 |0 |Collect and send Live Tile metadata. | | -|Enabled |1 |1 |Do not collect. |![Most restricted value](../images/check-gn.png) | +|Enabled |1 |1 |No data collected. |![Most restricted value](../images/check-gn.png) | --- ### ADMX info and settings diff --git a/browsers/edge/includes/prevent-turning-off-required-extensions-include.md b/browsers/edge/includes/prevent-turning-off-required-extensions-include.md index dad8213fef..67f9bab3e2 100644 --- a/browsers/edge/includes/prevent-turning-off-required-extensions-include.md +++ b/browsers/edge/includes/prevent-turning-off-required-extensions-include.md @@ -10,7 +10,7 @@ |Group Policy |Description | |---|---| |Disabled or not configured
**(default)** |Allowed. Users can uninstall extensions. If you previously enabled this policy and you decide to disable it, the list of extension PFNs defined in this policy get ignored. | -|Enabled |Provide a semi-colon delimited list of extension PFNs. For example, adding the following OneNote Web Clipper and Office Online extension prevents users from turning it off:

_Microsoft.OneNoteWebClipper8wekyb3d8bbwe;Microsoft.OfficeOnline8wekyb3d8bbwe_

After defining the list of extensions, you deploy them through any available enterprise deployment channel, such as Microsoft Intune. Removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. | +|Enabled |Provide a semi-colon delimited list of extension PFNs. For example, adding the following OneNote Web Clipper and Office Online extension prevents users from turning it off:

_Microsoft.OneNoteWebClipper8wekyb3d8bbwe;Microsoft.OfficeOnline8wekyb3d8bbwe_

After defining the list of extensions, you deploy them through any available enterprise deployment channel, such as Microsoft Intune.

Removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the [Allow Developer Tools](../available-policies.md#allow-developer-tools) policy, then this policy does not prevent users from debugging and altering the logic on an extension. | --- ### ADMX info and settings @@ -21,13 +21,13 @@ - **GP ADMX file name:** MicrosoftEdge.admx #### MDM settings -- **MDM name:** Browser/[PreventTurningOffRequiredExtensions](../new-policies.md#prevent-turning-off-required-extensions) +- **MDM name:** Browser/[PreventTurningOffRequiredExtensions](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-preventturningoffrequiredextensions) - **Supported devices:** Desktop - **URI full path:** ./Vendor/MSFT/Policy/Config/Browser/PreventTurningOffRequiredExtensions - **Data type:** String #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\Extensions +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Extensions - **Value name:** PreventTurningOffRequiredExtensions - **Value type:** REG_SZ diff --git a/browsers/edge/includes/prevent-users-to-turn-on-browser-syncing-include.md b/browsers/edge/includes/prevent-users-to-turn-on-browser-syncing-include.md index 7da4682d47..a46095d9bd 100644 --- a/browsers/edge/includes/prevent-users-to-turn-on-browser-syncing-include.md +++ b/browsers/edge/includes/prevent-users-to-turn-on-browser-syncing-include.md @@ -20,11 +20,11 @@ For more details about configuring the browser syncing options, see [Sync browse #### ADMX info - **GP English name:** Prevent users from turning on browser syncing - **GP name:** PreventUsersFromTurningOnBrowserSyncing -- **GP path:** Windows Components/Microsoft Edge -- **GP ADMX file name:** MicrosoftEdge.admx +- **GP path:** Windows Components/Sync your settings +- **GP ADMX file name:** SettingSync.admx #### MDM settings -- **MDM name:** Experience/[PreventUsersFromTurningOnBrowserSyncing](../new-policies.md#prevent-users-from-turning-on-browser-syncing) +- **MDM name:** Experience/[PreventUsersFromTurningOnBrowserSyncing](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#experience-preventusersfromturningonbrowsersyncing) - **Supported devices:** Desktop - **URI full path:** ./Vendor/MSFT/Policy/Config/Experience/PreventUsersFromTurningOnBrowserSyncing - **Data type:** String diff --git a/browsers/edge/includes/provision-favorites-include.md b/browsers/edge/includes/provision-favorites-include.md index 7601beff81..f0398c27c6 100644 --- a/browsers/edge/includes/provision-favorites-include.md +++ b/browsers/edge/includes/provision-favorites-include.md @@ -11,8 +11,8 @@ |Group Policy |Description |Most restricted | |---|---|:---:| -|Disabled or not configured
**(default)** |Default list of favorites not defined in Microsoft Edge. In this case, the Favorites list is customizable, such as adding folders, or adding and removing favorites. | | -|Enabled |Define a default list of favorites in Microsoft Edge. In this case, the Save a Favorite, Import settings, and context menu options (such as Create a new folder) are turned off.

To define a default list of favorites, do the following:

  1. In the upper-right corner of Microsoft Edge, click the ellipses (**...**) and select **Settings**.
  2. Click **Import from another browser**, click **Export to file**, and save the file.
  3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision. Specify the URL as:
    • HTTP location: "SiteList"=http://localhost:8080/URLs.html
    • Local network: "SiteList"="\network\shares\URLs.html"
    • Local file: "SiteList"=file:///c:\Users\\Documents\URLs.html
|![Most restricted value](../images/check-gn.png) | +|Disabled or not configured
**(default)** |Users can customize the favorites list, such as adding folders, or adding and removing favorites. | | +|Enabled |Define a default list of favorites in Microsoft Edge. In this case, the Save a Favorite, Import settings, and context menu options (such as Create a new folder) are turned off.

To define a default list of favorites, do the following:

  1. In the upper-right corner of Microsoft Edge, click the ellipses (**...**) and select **Settings**.
  2. Click **Import from another browser**, click **Export to file**, and save the file.
  3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision. Specify the URL as:
    • HTTP location: "SiteList"=http://localhost:8080/URLs.html
    • Local network: "SiteList"="\network\shares\URLs.html"
    • Local file: "SiteList"=file:///c:/Users/Documents/URLs.html
|![Most restricted value](../images/check-gn.png) | --- ### ADMX info and settings @@ -30,7 +30,7 @@ - **Data type:** String #### Registry settings -- **Path:** HLKM\Software\Policies\Microsoft\MicrosoftEdge\Favorites +- **Path:** HKLM\Software\Policies\Microsoft\MicrosoftEdge\Favorites - **Value name:** ConfiguredFavorites - **Value type:** REG_SZ diff --git a/browsers/edge/includes/send-all-intranet-sites-ie-include.md b/browsers/edge/includes/send-all-intranet-sites-ie-include.md index 1155d908d3..904c78270d 100644 --- a/browsers/edge/includes/send-all-intranet-sites-ie-include.md +++ b/browsers/edge/includes/send-all-intranet-sites-ie-include.md @@ -5,7 +5,7 @@ [!INCLUDE [send-all-intranet-sites-to-ie-shortdesc](../shortdesc/send-all-intranet-sites-to-ie-shortdesc.md)] >[!TIP] ->Microsoft Edge does not support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have websites or web apps that still use this technology and needs IE11 to run, you can add them to the Enterprise Mode site list, using Enterprise Mode Site List Manager. Allowed values. +>Microsoft Edge does not support ActiveX controls, Browser Helper Objects, VBScript, or other legacy technology. If you have websites or web apps that still use this technology and needs IE11 to run, you can add them to the Enterprise Mode site list, using Enterprise Mode Site List Manager. ### Supported values @@ -13,7 +13,7 @@ |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| |Disabled or not configured
**(default)** |0 |0 |All sites, including intranet sites, open in Microsoft Edge automatically. |![Most restricted value](../images/check-gn.png) | -|Enabled |1 |1 |Only intranet sites open in Internet Explorer 11 automatically.

Enabling this policy automatically opens all intranet sites in IE11, even if the users have Microsoft Edge as their default browser.

  1. In Group Policy Editor, navigate to:

    **Computer Configuration\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file**

  2. Click **Enabled**, refresh the policy, and then view the affected sites in Microsoft Edge.

    A message displays saying that the page needs to open in IE. At the same time, the page opens in IE11 automatically; in a new frame if it is not yet running, or in a new tab.

| | +|Enabled |1 |1 |Only intranet sites open in Internet Explorer 11 automatically.

Enabling this policy automatically opens all intranet sites in IE11, even if the users have Microsoft Edge as their default browser.

  1. In Group Policy Editor, navigate to:

    **Computer Configuration\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** and click **Enable**.

  2. Refresh the policy and then view the affected sites in Microsoft Edge.

    A message displays saying that the page needs to open in IE. At the same time, the page opens in IE11 automatically; in a new frame if it is not yet running, or in a new tab.

| | --- @@ -31,7 +31,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\Main - **Value name:** SendIntranetTraffictoInternetExplorer - **Value type:** REG_DWORD diff --git a/browsers/edge/includes/set-default-search-engine-include.md b/browsers/edge/includes/set-default-search-engine-include.md index de82b057b7..4a65053d39 100644 --- a/browsers/edge/includes/set-default-search-engine-include.md +++ b/browsers/edge/includes/set-default-search-engine-include.md @@ -8,25 +8,15 @@ |Group Policy |MDM |Registry |Description |Most restricted | |---|:---:|:---:|---|:---:| -|Not configured
**(default)** |Blank |Blank |Microsoft Edge uses the default search engine specified in App settings. If you don't configure this policy and disable the [Allow search engine customization](#allow-search-engine-customization-include) policy, users cannot make changes. | | +|Not configured
**(default)** |Blank |Blank |Microsoft Edge uses the default search engine specified in App settings. If you don't configure this policy and disable the [Allow search engine customization](../available-policies.md#allow-search-engine-customization) policy, users cannot make changes. | | |Disabled |0 |0 |Microsoft Edge removes the policy-set search engine and uses the Microsoft Edge specified engine for the market. | | |Enabled |1 |1 |Microsoft Edge uses the policy-set search engine specified in the OpenSearch XML file. Users cannot change the default search engine.

Specify a link to the OpenSearch XML file that contains, at a minimum, the short name and the URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://docs.microsoft.com/en-us/microsoft-edge/dev-guide/browser/search-provider-discovery). Use this format to specify the link you want to add.

If you want users to use the default Microsoft Edge settings for each market set the string to **EDGEDEFAULT**.

If you would like users to use Microsoft Bing as the default search engine set the string to **EDGEBING**. |![Most restricted value](../images/check-gn.png) | --- + ### Configuration options -| **Set default search engine** | **Allow search engine customization** | **Configure additional search engines** | **Outcome** | -| --- | --- | --- | --- | -| Not configured (default) | Disabled | Disabled or not configured (default) | Default search engine specified in App settings. Users cannot make changes. | -| Not configured (default) | Enabled or not configured (default) | Disabled or not configured (default) | Default search engine specified in App settings. Users can make changes to the default search engine at any time. | -| Disabled | Disabled | Disabled or not configured (default) | Users cannot add, remove, or change any of the search engines, but they can set a default search engine. | -| Disabled | Enabled or not configured (default) | Disabled or not configured (default) | Users can add new search engines or change the default search engine, in Settings. | -| Enabled | Disabled | Disabled or not configured (default) | Set the default search engine preventing users from making changes. | -| Enabled | Enabled or not configured (default) | Disabled or not configured (default) | Set the default search engine and allow users to add search engines or make changes. | ---- - -![Set default search engine configurations](../images/set-default-search-engine-v4-sm.png) - +For more details about configuring the search engine, see [Search engine customization](../group-policies/search-engine-customization-gp.md). ### ADMX info and settings #### ADMX info @@ -43,7 +33,7 @@ - **Data type:** Integer #### Registry settings -- **Path:** HLKM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\OpenSearch +- **Path:** HKLM\\Software\\Policies\\Microsoft\\MicrosoftEdge\\OpenSearch - **Value name:** SetDefaultSearchEngine - **Value type:** REG_SZ diff --git a/browsers/edge/includes/set-home-button-url-include.md b/browsers/edge/includes/set-home-button-url-include.md index 26f674b19d..7e9b36ea77 100644 --- a/browsers/edge/includes/set-home-button-url-include.md +++ b/browsers/edge/includes/set-home-button-url-include.md @@ -1,4 +1,4 @@ - + >*Supported versions: Microsoft Edge on Windows 10, next major update to Windows*
>*Default setting: Disabled or not configured (Blank)* @@ -9,18 +9,18 @@ |Group Policy |MDM |Registry |Description | |---|:---:|:---:|---| |Disabled or not configured
**(default)** |Blank |Blank |Show the home button and loads the Start page and locks down the home button to prevent users from changing what page loads. | -|Enabled - String |String |String |Load a custom URL for the home button. You must also enable the [Configure Home button](../new-policies.md#configure-home-button) policy and select the _Show home button & set a specific page_ option.

Enter a URL in string format, for example, https://www.msn.com. | +|Enabled - String |String |String |Load a custom URL for the home button. You must also enable the [Configure Home Button](../new-policies.md#configure-home-button) policy and select the _Show home button & set a specific page_ option.

Enter a URL in string format, for example, https://www.msn.com. | --- ### Configuration options -For more details about configuring the different Home button options, see [Home button](../group-policies/home-button-gp.md). +For more details about configuring the different Home button options, see [Home button configuration options](../group-policies/home-button-gp.md). ### ADMX info and settings #### ADMX info -- **GP English name:** Set Home button URL +- **GP English name:** Set Home Button URL - **GP name:** SetHomeButtonURL - **GP element:** SetHomeButtonURLPrompt - **GP path:** Windows Components/Microsoft Edge @@ -39,8 +39,8 @@ For more details about configuring the different Home button options, see [Home ### Related policies -- [Configure Home button](../new-policies.md#configure-home-button): [!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] +- [Configure Home Button](../new-policies.md#configure-home-button): [!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] -- [Unlock Home button](../new-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)] +- [Unlock Home Button](../new-policies.md#unlock-home-button): [!INCLUDE [unlock-home-button-shortdesc](../shortdesc/unlock-home-button-shortdesc.md)]

diff --git a/browsers/edge/includes/show-message-opening-sites-ie-include.md b/browsers/edge/includes/show-message-opening-sites-ie-include.md index d6cdf4b94a..75c8366ae9 100644 --- a/browsers/edge/includes/show-message-opening-sites-ie-include.md +++ b/browsers/edge/includes/show-message-opening-sites-ie-include.md @@ -12,9 +12,12 @@ |---|:---:|:---:|---|:---:| |Disabled or not configured
**(default)** |0 |0 |No additional message displays. |![Most restricted value](../images/check-gn.png) | |Enabled |1 |1 |Show an additional message stating that a site has opened in IE11. | | -|Enabled |2 |2 |Show an additional message with a "Keep going in Microsoft Edge" link to allow users to open the site in Microsoft Edge. | | +|Enabled |2 |2 |Show an additional message with a _Keep going in Microsoft Edge_ link to allow users to open the site in Microsoft Edge. | | --- +### Configuration options +For more details about configuring the search engine, see [Interoperability and enterprise guidance](../group-policies/interoperability-enterprise-guidance-gp.md). + ### ADMX info and settings #### ADMX info - **GP English name:** Show message when opening sites in Internet Explorer diff --git a/browsers/edge/includes/unlock-home-button-include.md b/browsers/edge/includes/unlock-home-button-include.md index 91a7a446e4..e6cb4d2e9f 100644 --- a/browsers/edge/includes/unlock-home-button-include.md +++ b/browsers/edge/includes/unlock-home-button-include.md @@ -8,14 +8,14 @@ |Group Policy |MDM |Registry |Description | |---|:---:|:---:|---| -|Disabled or not configured
**(default)** |0 |0 |Lock down the home button to prevent users from making changes to the home button settings. | +|Disabled or not configured
**(default)** |0 |0 |Lock down and prevent users from making changes to the home button settings. | |Enabled |1 |1 |Let users make changes. | --- ### Configuration options -For more details about configuring the different Home button options, see [Home button](../group-policies/home-button-gp.md). +For more details about configuring the different Home button options, see [Home button configuration options](../group-policies/home-button-gp.md). ### ADMX info and settings #### ADMX info @@ -37,9 +37,9 @@ For more details about configuring the different Home button options, see [Home ### Related policies -- [Configure Home button](../new-policies.md#configure-home-button): [!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] +- [Configure Home Button](../new-policies.md#configure-home-button): [!INCLUDE [configure-home-button-shortdesc](../shortdesc/configure-home-button-shortdesc.md)] -- [Set Home button URL](../new-policies.md#set-home-button-url): [!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)] +- [Set Home Button URL](../new-policies.md#set-home-button-url): [!INCLUDE [set-home-button-url-shortdesc](../shortdesc/set-home-button-url-shortdesc.md)]
\ No newline at end of file diff --git a/browsers/edge/index.yml b/browsers/edge/index.yml new file mode 100644 index 0000000000..f70b140995 --- /dev/null +++ b/browsers/edge/index.yml @@ -0,0 +1,163 @@ +### YamlMime:YamlDocument + +documentType: LandingData + +title: Microsoft Edge Group Policy configuration options + +metadata: + + document_id: + + title: Microsoft Edge Group Policy configuration options + + description: + + text: Learn how to deploy and configure group policies in Microsoft Edge on Windows 10. Some of the features coming to Microsoft Edge gives you the ability to set a custom URL for the New tab page or Home button. Another new feature allows you to hide or show the Favorites bar, giving you more control over the favorites bar. + + keywords: Microsoft Edge, Windows 10 + + ms.localizationpriority: high + + author: shortpatti + + ms.author: pashort + + ms.date: 08/09/2018 + + ms.topic: article + + ms.devlang: na + +sections: + +- title: + +- items: + + - type: markdown + + text: Learn about interoperability goals and enterprise guidance along with system requirements, language support and frequently asked questions. + +- items: + + - type: list + + style: cards + + className: cardsE + + columns: 3 + + items: + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/about-microsoft-edge + + html:

Learn about the system requirements and language support for Microsoft Edge.

+ + image: + + src: https://docs.microsoft.com/media/common/i_overview.svg + + title: System requirements and supported languages + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/new-policies + + html:

Learn more about the latest group policies and features added to Microsoft Edge.

+ + image: + + src: https://docs.microsoft.com/media/common/i_whats-new.svg + + title: What's new + + - href: https://www.microsoft.com/en-us/WindowsForBusiness/Compare + + html:

Learn about the supported features & functionality in each Windows edition.

+ + image: + + src: https://docs.microsoft.com/media/common/i_config-tools.svg + + title: Compare Windows 10 Editions + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/security-privacy-management-gp + + html:

Learn how Microsoft Edge helps to defend from increasingly sophisticated and prevalent web-based attacks against Windows.

+ + image: + + src: https://docs.microsoft.com/media/common/i_security-management.svg + + title: Security & protection + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp + + html:

Learch how you can use the Enterprise Mode site list for websites and apps that have compatibility problems in Microsoft Edge.

+ + image: + + src: https://docs.microsoft.com/media/common/i_management.svg + + title: Interoperability & enterprise guidance + + - href: https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/index + + html:

Learn about the advanced VPN features you can add to improve the security and availability of your VPN connection.

+ + image: + + src: https://docs.microsoft.com/media/common/i_policy.svg + + title: Group policies & configuration options + +- items: + + - type: list + + style: cards + + className: cardsL + + items: + + - title: Microsoft Edge resources + + html:

Minimum system requirements

+ +

Supported languages

+ +

Document change history

+ +

Compare Windows 10 Editions

+ +

Microsoft Edge Dev blog

+ +

Microsoft Edge Dev on Twitter

+ +

Microsoft Edge changelog

+ +

Measuring the impact of Microsoft Edge

+ + - title: Internet Explorer 11 resources + + html:

Deploy Internet Explorer 11 (IE11) - IT Pros

+ +

Internet Explorer Administration Kit 11 (IEAK 11)

+ +

Download Internet Explorer 11

+ + - title: Additional resources + + html:

Group Policy and the Group Policy Management Console (GPMC)

+ +

Group Policy and the Local Group Policy Editor

+ +

Group Policy and the Advanced Group Policy Management (AGPM)

+ +

Group Policy and Windows PowerShell

+ + + + + + diff --git a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md index a3679f369c..5a3b6328ee 100644 --- a/browsers/edge/microsoft-edge-kiosk-mode-deploy.md +++ b/browsers/edge/microsoft-edge-kiosk-mode-deploy.md @@ -6,7 +6,7 @@ ms.author: pashort ms.prod: edge ms.sitesec: library title: Deploy Microsoft Edge kiosk mode -ms.localizationpriority: high +ms.localizationpriority: medium ms.date: 07/25/2018 --- @@ -137,7 +137,7 @@ With this method, you can use Microsoft Intune or other MDM services to configur 1. In Microsoft Intune or other MDM service, configure [AssignedAccess](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) to prevent users from accessing the file system, running executables, or other apps. -2. Configure the following MDM settings to control a web browser app on the kiosk device. +2. Configure the following MDM settings to control a web browser app on the kiosk device and then restart the device. | | | |---|---| @@ -149,7 +149,6 @@ With this method, you can use Microsoft Intune or other MDM services to configur | **[SetHomeButtonURL](new-policies.md#set-home-button-url)**

![](images/icon-thin-line-computer.png) | If you set ConfigureHomeButton to 2, configure the home button URL.

**URI full path:** ./Vendor/MSFT/Policy/Config/Browser/SetHomeButtonURL

**Data type:** String

**Allowed values:** Enter a URL, for example, https://www.bing.com | ---
-3. Restart the device and sign in using the kiosk app user account. **_Congratulations!_** You’ve finished setting up a kiosk or digital signage and configuring policies for Microsoft Edge kiosk mode using Microsoft Intune or other MDM service. @@ -216,7 +215,7 @@ Use any of the Microsoft Edge policies listed below to enhance the kiosk experie | [AllowSideloadingOfExtensions](new-policies.md#allow-sideloading-of-extensions)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | | [AllowSmartScreen](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-allowsmartscreen) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | ![Supported](images/148767.png) | | [AllowSyncMySettings](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#experience-allowsyncmysettings) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | -| [AllowTabPreloading](new-policies.md#allow-microsoft-edge-to-start-and-load-the-start-and-new-tab-page-at-windows-startup-and-each-time-microsoft-edge-is-closed)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | +| [AllowTabPreloading](new-policies.md#allow-microsoft-edge-to-load-the-start-and-new-tab-page-at-windows-startup-and-each-time-microsoft-edge-is-closed)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | | [AllowWebContentOnNewTabPage](available-policies.md#allow-web-content-on-new-tab-page)\* | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | | [AlwaysEnabledBooksLibrary](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-alwaysenablebookslibrary) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | | [ClearBrowsingDataOnExit](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-clearbrowsingdataonexit) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Not supported](images/148766.png) | ![Supported](images/148767.png) | @@ -310,7 +309,7 @@ In the following table, we show you the features available in both Microsoft Edg | Multi-tab support | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | | Allow URL support | ![Supported](images/148767.png)

*\*For Microsoft Edge kiosk mode use* [Windows Defender Firewall](#_*Windows_Defender_Firewall)*. Microsoft kiosk browser has custom policy support.* | ![Supported](images/148767.png) | | Block URL support | ![Supported](images/148767.png)

*\*For Microsoft Edge kiosk mode use* [Windows Defender Firewall](#_*Windows_Defender_Firewall)*. Microsoft kiosk browser has custom policy support.* | ![Supported](images/148767.png) | -| Configure Home button | ![Supported](images/148767.png) | ![Supported](images/148767.png) | +| Configure Home Button | ![Supported](images/148767.png) | ![Supported](images/148767.png) | | Set Start page(s) URL | ![Supported](images/148767.png) | ![Supported](images/148767.png)

*Same as Home button URL* | | Set New Tab page URL | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | | Favorites management | ![Supported](images/148767.png) | ![Not supported](images/148766.png) | diff --git a/browsers/edge/new-policies.md b/browsers/edge/new-policies.md index ac0e768adf..421bd3945c 100644 --- a/browsers/edge/new-policies.md +++ b/browsers/edge/new-policies.md @@ -1,13 +1,13 @@ --- description: Microsoft Edge now has new Group Policies and MDM Settings for IT administrators to configure Microsoft Edge. The new policies allow you to enable/disabled full-screen mode, printing, favorites bar, saving history. You can also prevent certificate error overrides, and configure New tab page, Home button and startup options, as well as manage extensions. ms.assetid: -author: shortpatti -ms.author: pashort ms.prod: edge ms.mktglfcycl: explore ms.sitesec: library title: New Microsoft Edge Group Policies and MDM settings -ms.localizationpriority: +ms.localizationpriority: medium +author: shortpatti +ms.author: pashort ms.date: 07/25/2018 --- @@ -18,40 +18,40 @@ ms.date: 07/25/2018 The Microsoft Edge team introduces new Group Policies and MDM Settings for the Windows 10 Insider Preview Build 17713+. The new policies allow IT administrators to enable/disable full-screen mode, printing, favorites bar, saving history. You can also prevent certificate error overrides, and configure New tab page, Home button and startup options, as well as manage extensions. -We are discontinuing the use of the **Configure Favorites** group policy. Use the **[Provision Favorites](available-policies.md#provision-favorites)** instead. +We are discontinuing the **Configure Favorites** group policy. Use the **[Provision Favorites](available-policies.md#provision-favorites)** instead. ->>You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor: +>>You can find the Microsoft Edge Group Policy settings in the following location of the Group Policy Editor unless otherwise noted in the policy: >> >>      **_Computer Configuration\\Administrative Templates\\Windows Components\\Microsoft Edge\\_**

- + | **Group Policy** | **New/update?** | **MDM Setting** | **New/update?** | | --- | --- | --- | --- | | [Allow fullscreen mode](#allow-fullscreen-mode) | New | [AllowFullscreen](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-allowfullscreenmode) | New | | [Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed](#allow-prelaunch) | New | [AllowPrelaunch](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-allowprelaunch) | New | -| [Allow Microsoft Edge to start and load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed](#allow-microsoft-edge-to-start-and-load-the-start-and-new-tab-page-at-windows-startup-and-each-time-microsoft-edge-is-closed) | New | [AllowTabPreloading](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading) | New | +| [Allow Microsoft Edge to load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed](#allow-microsoft-edge-to-start-and-load-the-start-and-new-tab-page-at-windows-startup-and-each-time-microsoft-edge-is-closed) | New | [AllowTabPreloading](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-allowtabpreloading) | New | | [Allow printing](#allow-printing) | New | [AllowPrinting](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-allowprinting) | New | | [Allow Saving History](#allow-saving-history) | New | [AllowSavingHistory](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-allowsavinghistory) | New | | [Allow sideloading of Extensions](#allow-sideloading-of-extensions) | New | [AllowSideloadingExtensions](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-allowsideloadingofextensions) | New | | [Allow web content on new tab page](available-policies.md#allow-web-content-on-new-tab-page) | -- | [AllowWebContentOnNewTabPage](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-allowwebcontentonnewtabpage) | New | | [Configure collection of browsing data for Microsoft 365 Analytics](#configure-collection-of-browsing-data-for-microsoft-365-analytics) | New | [ConfigureTelemetryForMicrosoft365Analytics](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-configuretelemetryformicrosoft365analytics) | New | | [Configure Favorites Bar](#configure-favorites-bar) | New | [ConfigureFavoritesBar](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-configurefavoritesbar) | New | -| [Configure Home button](#configure-home-button) | New | [ConfigureHomeButton](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) | New | +| [Configure Home Button](#configure-home-button) | New | [ConfigureHomeButton](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-configurehomebutton) | New | | [Configure kiosk mode](#configure-kiosk-mode) | New | [ConfigureKioskMode](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-configurekioskmode) | New | | [Configure kiosk reset after idle timeout](#configure-kiosk-reset-after-idle-timeout) | New | [ConfigureKioskResetAfterIdleTimeout](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-configurekioskresetafteridletimeout) | New | | [Configure Open Microsoft Edge With](#configure-open-microsoft-edge-with) | New | [ConfigureOpenEdgeWith](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-configureopenmicrosoftedgewith) | New | -| [Do not sync browser settings](available-policies.md#do-not-sync-browser-settings) | -- | Experience/DoNotSyncBrowserSetting | New | +| [Do not sync browser settings](available-policies.md#do-not-sync-browser-settings) | -- | [Experience/DoNotSyncBrowserSettings](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#experience-donotsyncbrowsersetting) | New | | [Prevent certificate error overrides](#prevent-certificate-error-overrides) | New | [PreventCertErrorOverrides](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-preventcerterroroverrides) | New | -| [Prevent users from turning on browser syncing](#preventusersfromturningonbrowsersyncing) | New | Experience/PreventUsersFromTurningOnBrowserSyncing | New | -| [Prevent turning off required extensions](#prevent-turning-off-required-extensions) | New | PreventTurningOffRequiredExtensions | New | -| [Set Home button URL](#set-home-button-url) | New | [SetHomeButtonURL](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) | New | +| [Prevent users from turning on browser syncing](#preventusersfromturningonbrowsersyncing) | New | [Experience/PreventUsersFromTurningOnBrowserSyncing](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#experience-preventusersfromturningonbrowsersyncing) | New | +| [Prevent turning off required extensions](#prevent-turning-off-required-extensions) | New | [PreventTurningOffRequiredExtensions](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#experience-preventusersfromturningonbrowsersyncing) | New | +| [Set Home Button URL](#set-home-button-url) | New | [SetHomeButtonURL](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-sethomebuttonurl) | New | | [Set New Tab page URL](#set-new-tab-page-url) | New | [SetNewTabPageURL](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-setnewtabpageurl) | New | | [Show message when opening sites in Internet Explorer](#showmessagewhenopeninginteretexplorersites) | Updated | [ShowMessageWhenOpeningSitesInInternetExplorer](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-showmessagewhenopeningsitesininternetexplorer) | Updated | -| [Unlock Home button](#unlock-home-button) | New | [UnlockHomeButton](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) | New | +| [Unlock Home Button](#unlock-home-button) | New | [UnlockHomeButton](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser#browser-unlockhomebutton) | New | --- @@ -63,7 +63,7 @@ We are discontinuing the use of the **Configure Favorites** group policy. Use th ## Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed [!INCLUDE [allow-prelaunch-include](includes/allow-prelaunch-include.md)] -## Allow Microsoft Edge to start and load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed +## Allow Microsoft Edge to load the Start and New Tab page at Windows startup and each time Microsoft Edge is closed [!INCLUDE [allow-tab-preloading-include](includes/allow-tab-preloading-include.md)] ## Allow printing @@ -75,14 +75,13 @@ We are discontinuing the use of the **Configure Favorites** group policy. Use th ## Allow sideloading of Extensions [!INCLUDE [allow-sideloading-extensions-include.md](includes/allow-sideloading-extensions-include.md)] - ## Configure collection of browsing data for Microsoft 365 Analytics [!INCLUDE [configure-browser-telemetry-for-m365-analytics-include](includes/configure-browser-telemetry-for-m365-analytics-include.md)] ## Configure Favorites Bar [!INCLUDE [configure-favorites-bar-include.md](includes/configure-favorites-bar-include.md)] -## Configure Home button +## Configure Home Button [!INCLUDE [configure-home-button-include.md](includes/configure-home-button-include.md)] ## Configure kiosk mode @@ -103,7 +102,7 @@ We are discontinuing the use of the **Configure Favorites** group policy. Use th ## Prevent users from turning on browser syncing [!INCLUDE [prevent-users-to-turn-on-browser-syncing-include](includes/prevent-users-to-turn-on-browser-syncing-include.md)] -## Set Home button URL +## Set Home Button URL [!INCLUDE [set-home-button-url-include](includes/set-home-button-url-include.md)] ## Set New Tab page URL @@ -112,6 +111,6 @@ We are discontinuing the use of the **Configure Favorites** group policy. Use th ## Show message when opening sites in Internet Explorer [!INCLUDE [show-message-opening-sites-ie-include](includes/show-message-opening-sites-ie-include.md)] -## Unlock Home button +## Unlock Home Button [!INCLUDE [unlock-home-button-include.md](includes/unlock-home-button-include.md)] diff --git a/browsers/edge/security-enhancements-microsoft-edge.md b/browsers/edge/security-enhancements-microsoft-edge.md index 9efd0d49d7..8f16464105 100644 --- a/browsers/edge/security-enhancements-microsoft-edge.md +++ b/browsers/edge/security-enhancements-microsoft-edge.md @@ -15,7 +15,7 @@ author: shortpatti >Applies to: Windows 10, Windows 10 Mobile -Microsoft Edge is designed with significant security improvements, helping to defend people from increasingly sophisticated and prevalent web-based attacks against Windows. +Microsoft Edge is designed with improved security in mind, helping to defend people from increasingly sophisticated and prevalent web-based attacks against Windows. ## Help to protect against web-based security threats While most websites are safe, some sites have been designed to steal personal information or gain access to your system’s resources. Thieves by nature don’t care about rules, and will use any means to take advantage of victims, most often using trickery or hacking: diff --git a/browsers/edge/shortdesc/allow-a-shared-books-folder-shortdesc.md b/browsers/edge/shortdesc/allow-a-shared-books-folder-shortdesc.md index ab30ba7a07..19e8c5a8a4 100644 --- a/browsers/edge/shortdesc/allow-a-shared-books-folder-shortdesc.md +++ b/browsers/edge/shortdesc/allow-a-shared-books-folder-shortdesc.md @@ -1 +1 @@ -You can configure Microsoft Edge to store books from the Books Library to a default, shared folder in Windows, which decreases the amount of storage used by book files. When you enable this policy, Microsoft Edge downloads book files automatically to a common, shared folder, and prevents users from removing the book from the library. When disabled, Microsoft Edge does not use a shared folder but downloads book files to a folder for each user. For this policy to work properly, users must be signed in with a school or work account. \ No newline at end of file +Microsoft Edge does not use a shared folder by default but downloads book files to a per-user folder for each user. With this policy, you can configure Microsoft Edge to store books from the Books Library to a default, shared folder in Windows, which decreases the amount of storage used by book files. When you enable this policy, Microsoft Edge downloads books to a shared folder after user action to download the book to their device, which allows them to remove downloaded books at any time. For this policy to work correctly, you must also enable the Allow a Windows app to share application data between users group policy. Also, the users must be signed in with a school or work account. \ No newline at end of file diff --git a/browsers/edge/shortdesc/allow-prelaunch-shortdesc.md b/browsers/edge/shortdesc/allow-prelaunch-shortdesc.md index 58ab1f00bd..405fca5e9c 100644 --- a/browsers/edge/shortdesc/allow-prelaunch-shortdesc.md +++ b/browsers/edge/shortdesc/allow-prelaunch-shortdesc.md @@ -1 +1 @@ -Microsoft Edge pre-launches as a background process during Windows startup when the system is idle waiting to be launched by the user. Pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start up Microsoft Edge. You can also configure Microsoft Edge to prevent Microsoft Edge from pre-launching. \ No newline at end of file +Microsoft Edge pre-launches as a background process during Windows startup when the system is idle waiting to be launched by the user. Pre-launching helps the performance of Microsoft Edge and minimizes the amount of time required to start Microsoft Edge. You can also configure Microsoft Edge to prevent from pre-launching. \ No newline at end of file diff --git a/browsers/edge/shortdesc/allow-printing-shortdesc.md b/browsers/edge/shortdesc/allow-printing-shortdesc.md index 07e8e98f42..5abb3b7dc7 100644 --- a/browsers/edge/shortdesc/allow-printing-shortdesc.md +++ b/browsers/edge/shortdesc/allow-printing-shortdesc.md @@ -1 +1 @@ -Microsoft Edge allows users to print web content by default. With this policy though, you can configure Microsoft Edge to prevent users from printing web content. \ No newline at end of file +Microsoft Edge allows users to print web content by default. With this policy, you can configure Microsoft Edge to prevent users from printing web content. \ No newline at end of file diff --git a/browsers/edge/shortdesc/allow-tab-preloading-shortdesc.md b/browsers/edge/shortdesc/allow-tab-preloading-shortdesc.md index 5349cf7350..3b245ca258 100644 --- a/browsers/edge/shortdesc/allow-tab-preloading-shortdesc.md +++ b/browsers/edge/shortdesc/allow-tab-preloading-shortdesc.md @@ -1 +1 @@ -Microsoft Edge allows preloading of the Start and New tab pages during Windows sign in, and each time Microsoft Edge closes by default. Preloading minimizes the amount of time required to start Microsoft Edge and load a new tab. With this policy, you can configure Microsoft Edge to prevent preloading of tabs. \ No newline at end of file +Microsoft Edge allows preloading of the Start and New tab pages during Windows sign in, and each time Microsoft Edge closes by default. Preloading minimizes the amount of time required to start Microsoft Edge and load a new tab. With this policy, you can configure Microsoft Edge to prevent preloading of tabs. \ No newline at end of file diff --git a/browsers/edge/shortdesc/allow-web-content-on-new-tab-page-shortdesc.md b/browsers/edge/shortdesc/allow-web-content-on-new-tab-page-shortdesc.md index 911267bdb1..bad40654c0 100644 --- a/browsers/edge/shortdesc/allow-web-content-on-new-tab-page-shortdesc.md +++ b/browsers/edge/shortdesc/allow-web-content-on-new-tab-page-shortdesc.md @@ -1 +1 @@ -Microsoft Edge loads the default New tab page by default. Disabling this policy loads a blank page instead of the New tab page and prevents users from changing it. Not configuring this policy lets users choose how the New tab page appears. \ No newline at end of file +By default, Microsoft Edge loads the default New tab page. Disabling this policy loads a blank page instead of the New tab page and prevents users from changing it. Not configuring this policy lets users choose what loads on the New tab page. \ No newline at end of file diff --git a/browsers/edge/shortdesc/allow-windows-app-to-share-data-users-shortdesc.md b/browsers/edge/shortdesc/allow-windows-app-to-share-data-users-shortdesc.md new file mode 100644 index 0000000000..7ec95879df --- /dev/null +++ b/browsers/edge/shortdesc/allow-windows-app-to-share-data-users-shortdesc.md @@ -0,0 +1 @@ +With this policy, you can configure Windows 10 to share application data among multiple users on the system and with other instances of that app. Data is shared through the SharedLocal folder, which is available through the Windows.Storage API. If you previously enabled this policy and now want to disable it, any shared app data remains in the SharedLocal folder. \ No newline at end of file diff --git a/browsers/edge/shortdesc/configure-favorites-shortdesc.md b/browsers/edge/shortdesc/configure-favorites-shortdesc.md index d61df8e460..c5bfae7541 100644 --- a/browsers/edge/shortdesc/configure-favorites-shortdesc.md +++ b/browsers/edge/shortdesc/configure-favorites-shortdesc.md @@ -1 +1 @@ -Use the **[Provision Favorites](../available-policies.md#provision-favorites)** in place of Configure Favorites. \ No newline at end of file +Discontinued in Windows 10, version 1810. Use the **[Provision Favorites](../available-policies.md#provision-favorites)** policy instead. \ No newline at end of file diff --git a/browsers/edge/shortdesc/configure-home-button-shortdesc.md b/browsers/edge/shortdesc/configure-home-button-shortdesc.md index c1e1a48bab..8f31b8505f 100644 --- a/browsers/edge/shortdesc/configure-home-button-shortdesc.md +++ b/browsers/edge/shortdesc/configure-home-button-shortdesc.md @@ -1 +1 @@ -Microsoft Edge shows the home button and by clicking it the Start page loads by default. With this policy, you can configure the Home button to load the New tab page or a URL defined in the Set Home button URL policy. You can also configure Microsoft Edge to hide the home button. \ No newline at end of file +Microsoft Edge shows the home button and by clicking it the Start page loads by default. With this policy, you can configure the home button to load the New tab page or a URL defined in the Set Home Button URL policy. You can also configure Microsoft Edge to hide the home button. \ No newline at end of file diff --git a/browsers/edge/shortdesc/do-not-sync-shortdesc.md b/browsers/edge/shortdesc/do-not-sync-shortdesc.md index 1e9ac07094..69425a77f3 100644 --- a/browsers/edge/shortdesc/do-not-sync-shortdesc.md +++ b/browsers/edge/shortdesc/do-not-sync-shortdesc.md @@ -1 +1 @@ -By default, Microsoft Edge turns on the Sync your Settings toggle in Settings and let users choose what to sync on their device. Enabling this policy turns off and disables the Sync your Settings toggle in Settings, preventing syncing of user’s settings between their devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable this policy and select the _Allow users to turn syncing on_ option. \ No newline at end of file +By default, Microsoft Edge turns on the Sync your Settings toggle in Settings and let users choose what to sync on their device. Enabling this policy turns off and disables the Sync your Settings toggle in Settings, preventing syncing of user’s settings between their devices. If you want syncing turned off by default in Microsoft Edge but not disabled, enable this policy and select the _Allow users to turn syncing on_ option in this policy. \ No newline at end of file diff --git a/browsers/edge/shortdesc/set-home-button-url-shortdesc.md b/browsers/edge/shortdesc/set-home-button-url-shortdesc.md index 10ad478e1b..80b7cf8040 100644 --- a/browsers/edge/shortdesc/set-home-button-url-shortdesc.md +++ b/browsers/edge/shortdesc/set-home-button-url-shortdesc.md @@ -1 +1 @@ -By default, Microsoft Edge shows the home button and loads the Start page, and locks down the home button to prevent users from changing what page loads. Enabling this policy loads a custom URL for the home button. When you enable this policy, and enable the Configure Home button policy with the _Show home button & set a specific page_ option selected, a custom URL loads when the user clicks the home button. \ No newline at end of file +By default, Microsoft Edge shows the home button and loads the Start page, and locks down the home button to prevent users from changing what page loads. Enabling this policy loads a custom URL for the home button. When you enable this policy, and enable the Configure Home Button policy with the _Show home button & set a specific page_ option selected, a custom URL loads when the user clicks the home button. \ No newline at end of file diff --git a/browsers/edge/shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md b/browsers/edge/shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md index 7601ad77fc..80e4360bb0 100644 --- a/browsers/edge/shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md +++ b/browsers/edge/shortdesc/show-message-when-opening-sites-in-ie-shortdesc.md @@ -1 +1 @@ -Microsoft Edge does not show a notification before opening sites in Internet Explorer 11. However, with this policy, you can configure Microsoft Edge to display a notification before a site opens in IE11 or let users continue in Microsoft Edge. If you want users to continue in Microsoft Edge, enable this policy to show the “Keep going in Microsoft Edge” link in the notification. For this policy to work correctly, you must also enable the Configure the Enterprise Mode Site List or Send all intranet sites to Internet Explorer 11, or both. \ No newline at end of file +Microsoft Edge does not show a notification before opening sites in Internet Explorer 11. However, with this policy, you can configure Microsoft Edge to display a notification before a site opens in IE11 or let users continue in Microsoft Edge. If you want users to continue in Microsoft Edge, enable this policy to show the _Keep going in Microsoft Edge_ link in the notification. For this policy to work correctly, you must also enable the Configure the Enterprise Mode Site List or Send all intranet sites to Internet Explorer 11, or both. \ No newline at end of file diff --git a/browsers/edge/shortdesc/unlock-home-button-shortdesc.md b/browsers/edge/shortdesc/unlock-home-button-shortdesc.md index 62c666c475..aff697e8f0 100644 --- a/browsers/edge/shortdesc/unlock-home-button-shortdesc.md +++ b/browsers/edge/shortdesc/unlock-home-button-shortdesc.md @@ -1 +1 @@ -By default, when you enable the Configure Home button policy or provide a URL in the Set Home button URL policy, Microsoft Edge locks down the home button to prevent users from changing the settings. When you enable this policy, users can make changes to the home button even if you enabled the Configure Home button or Set Home button URL policies. \ No newline at end of file +By default, when you enable the Configure Home Button policy or provide a URL in the Set Home Button URL policy, Microsoft Edge locks down the home button to prevent users from changing the settings. When you enable this policy, users can make changes to the home button even if you enabled the Configure Home Button or Set Home Button URL policies. \ No newline at end of file diff --git a/devices/hololens/hololens-kiosk.md b/devices/hololens/hololens-kiosk.md index 9b54f8a335..5e1218f90c 100644 --- a/devices/hololens/hololens-kiosk.md +++ b/devices/hololens/hololens-kiosk.md @@ -7,7 +7,7 @@ author: jdeckerms ms.author: jdecker ms.topic: article ms.localizationpriority: medium -ms.date: 05/22/2018 +ms.date: 08/14/2018 --- # Set up HoloLens in kiosk mode @@ -145,8 +145,7 @@ Use the following snippet in your kiosk configuration XML to enable the **Guest* ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) -8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. -8. (**Optional**: If you already have a non-admin account on the kiosk device, skip this step.) Create a local standard user account in **Runtime settings** > **Accounts** > **Users**. Make sure the **UserName** is the same as the account that you specify in the configuration XML. Select **UserGroup** as **Standard Users**. + 8. On the **File** menu, select **Save.** 9. On the **Export** menu, select **Provisioning package**. 10. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources, and then select **Next.** diff --git a/devices/hololens/hololens-setup.md b/devices/hololens/hololens-setup.md index 0f62fc2e6e..6912c956f4 100644 --- a/devices/hololens/hololens-setup.md +++ b/devices/hololens/hololens-setup.md @@ -7,7 +7,7 @@ author: jdeckerms ms.author: jdecker ms.topic: article ms.localizationpriority: medium -ms.date: 07/27/2017 +ms.date: 08/02/2018 --- # Set up HoloLens @@ -30,7 +30,12 @@ The HoloLens setup process combines a quick tutorial on using HoloLens with the 2. [Turn on HoloLens](https://support.microsoft.com/help/12642). You will be guided through a calibration procedure and how to perform [the gestures](https://support.microsoft.com/help/12644/hololens-use-gestures) that you will use to operate HoloLens. 3. Next, you'll be guided through connecting to a Wi-Fi network. 4. After HoloLens connects to the Wi-Fi network, you select between **My work or school owns it** and **I own it**. - - When you choose **My work or school owns it**, you sign in with an Azure AD account. If your organization uses Azure AD Premium and has configured automatic MDM enrollment, HoloLens will be enrolled in MDM. If your organization does not use Azure AD Premium, automatic MDM enrollment isn't available, so you will need to [enroll HoloLens in device management manually](hololens-enroll-mdm.md#enroll-through-settings-app). + - When you choose **My work or school owns it**, you sign in with an Azure AD account. + + >[!NOTE] + >[To share your HoloLens device with multiple Azure AD accounts](hololens-multiple-users.md), the HoloLens device must be running Windows 10, version 1803, and be [upgraded to Windows Holographic for Business](hololens-upgrade-enterprise.md). + + If your organization uses Azure AD Premium and has configured automatic MDM enrollment, HoloLens will be enrolled in MDM. If your organization does not use Azure AD Premium, automatic MDM enrollment isn't available, so you will need to [enroll HoloLens in device management manually](hololens-enroll-mdm.md#enroll-through-settings-app). 1. Enter your organizational account. 2. Accept privacy statement. 3. Sign in using your Azure AD credentials. This may redirect to your organization's sign-in page. diff --git a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md index d72676e762..90479cad66 100644 --- a/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md +++ b/devices/surface-hub/hybrid-deployment-surface-hub-device-accounts.md @@ -282,7 +282,7 @@ Use this procedure if you use Exchange online. 5. Add email address for your on-premises domain account. - For this procedure, you'll be using AD admin tools to add an email address for your on-preises domain account. + For this procedure, you'll be using AD admin tools to add an email address for your on-premises domain account. - In **Active Directory Users and Computers** AD tool, right-click on the folder or Organizational Unit that your Surface Hub accounts will be created in, click **New**, and **User**. - Type the display name from the previous cmdlet into the **Full name** box, and the alias into the **User logon name** box. Click **Next**. diff --git a/devices/surface-hub/index.md b/devices/surface-hub/index.md index b819e54b9a..06b5ab6450 100644 --- a/devices/surface-hub/index.md +++ b/devices/surface-hub/index.md @@ -51,3 +51,10 @@ In some ways, adding your new Surface Hub is just like adding any other Microsof +## Additional resources + +- [Surface Hub update history](https://support.microsoft.com/help/4037666/surface-surface-hub-update-history) +- [Surface IT Pro Blog](https://blogs.technet.microsoft.com/surface/) +- [Surface Playlist of videos](https://www.youtube.com/playlist?list=PLXtHYVsvn_b__1Baibdu4elN4SoF3JTBZ) +- [Microsoft Surface on Twitter](https://twitter.com/surface) + diff --git a/devices/surface/surface-dock-updater.md b/devices/surface/surface-dock-updater.md index 6141054da4..445be071c9 100644 --- a/devices/surface/surface-dock-updater.md +++ b/devices/surface/surface-dock-updater.md @@ -121,7 +121,9 @@ Microsoft periodically updates Surface Dock Updater. To learn more about the app *Release Date: 26 July 2018* This version of Surface Dock Updater adds support for the following: -t.b.d. + +- Increase update reliability +- Add support for Surface Go ### Version 2.12.136.0 *Release Date: 29 January 2018* diff --git a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md index c5de082d9e..73c49f7dbc 100644 --- a/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md +++ b/devices/surface/use-system-center-configuration-manager-to-manage-devices-with-semm.md @@ -42,7 +42,7 @@ Management of SEMM with Configuration Manager requires the installation of Micro #### Download SEMM scripts for Configuration Manager -After Microsoft Surface UEFI Manager is installed on the client Surface device, SEMM is deployed and managed with PowerShell scripts. You can download samples of the [SEMM management scripts](https://gallery.technet.microsoft.com/Sample-PowerShell-for-5eb5f03c) from the TechNet Gallery Script Center. +After Microsoft Surface UEFI Manager is installed on the client Surface device, SEMM is deployed and managed with PowerShell scripts. You can download samples of the [SEMM management scripts](https://www.microsoft.com/en-us/download/details.aspx?id=46703) from the Download Center. ## Deploy Microsoft Surface UEFI Manager @@ -269,7 +269,7 @@ The following code fragment, found on lines 352-363, is used to write this regis ### Settings names and IDs -To configure Surface UEFI settings or permissions for Surface UEFI settings, you must refer to each setting by either its setting name or setting ID. With each new update for Surface UEFI, new settings may be added. The best way to get a complete list of the settings available on a Surface device, along with the settings name and settings IDs, is to use the ShowSettingsOptions.ps1 script from [SEMM management scripts for Configuration Manager](https://gallery.technet.microsoft.com/Sample-PowerShell-for-5eb5f03c) in the TechNet Gallery Script Center. +To configure Surface UEFI settings or permissions for Surface UEFI settings, you must refer to each setting by either its setting name or setting ID. With each new update for Surface UEFI, new settings may be added. The best way to get a complete list of the settings available on a Surface device, along with the settings name and settings IDs, is to use the ShowSettingsOptions.ps1 script from SEMM_Powershell.zip in [Surface Tools for IT Downloads](https://www.microsoft.com/en-us/download/details.aspx?id=46703) The computer where ShowSettingsOptions.ps1 is run must have Microsoft Surface UEFI Manager installed, but the script does not require a Surface device. @@ -424,4 +424,4 @@ Removal of SEMM from a device deployed with Configuration Manager using these sc >When you install a reset package, the Lowest Supported Value (LSV) is reset to a value of 1. You can reenroll a device by using an existing configuration package – the device will prompt for the certificate thumbprint before ownership is taken. ->For this reason, the reenrollment of a device in SEMM would require a new package to be created and installed on that device. Because this action is a new enrollment and not a change in configuration on a device already enrolled in SEMM, the device will prompt for the certificate thumbprint before ownership is taken. \ No newline at end of file +>For this reason, the reenrollment of a device in SEMM would require a new package to be created and installed on that device. Because this action is a new enrollment and not a change in configuration on a device already enrolled in SEMM, the device will prompt for the certificate thumbprint before ownership is taken. diff --git a/devices/surface/windows-autopilot-and-surface-devices.md b/devices/surface/windows-autopilot-and-surface-devices.md index 3550f35fd6..cbfbebde41 100644 --- a/devices/surface/windows-autopilot-and-surface-devices.md +++ b/devices/surface/windows-autopilot-and-surface-devices.md @@ -49,4 +49,8 @@ Surface devices with support for out-of-box deployment with Windows Autopilot, e ## Surface partners enabled for Windows Autopilot Enrolling Surface devices in Windows Autopilot at the time of purchase is a capability provided by select Surface partners that are enabled with the capability to identify individual Surface devices during the purchase process and perform enrollment on an organization’s behalf. Devices enrolled by a Surface partner at time of purchase can be shipped directly to users and configured entirely through the zero-touch process of Windows Autopilot, Azure Active Directory, and Mobile Device Management. -You can find a list of Surface partners enabled for Windows Autopilot at the [Windows Autopilot for Surface portal](https://www.microsoft.com/en-us/itpro/surface/windows-autopilot-for-surface). \ No newline at end of file +When you purchase Surface devices from a Surface partner enabled for Windows Autopilot, your new devices can be enrolled in your Windows Autopilot deployment for you by the partner. Surface partners enabled for Windows Autopilot include: + +- [SHI](https://www.shi.com/?reseller=shi) +- [Insight](https://www.insight.com/en_US/buy/partner/microsoft/surface.html) +- [Atea](https://www.atea.com/) \ No newline at end of file diff --git a/education/get-started/inclusive-classroom-it-admin.md b/education/get-started/inclusive-classroom-it-admin.md index d5a982714e..def3d886d3 100644 --- a/education/get-started/inclusive-classroom-it-admin.md +++ b/education/get-started/inclusive-classroom-it-admin.md @@ -26,10 +26,11 @@ You will also learn how to deploy apps using Microsoft Intune, turn on or off Ea ## Inclusive Classroom features |Reading features|Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | |---|---|---|---|---|---|---| -| Read aloud with simultaneous highlighting |

  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

(N/A for Outlook PC)

|

X

(N/A for any OneNote apps or Outlook PC)

| -| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

|

X

(N/A for any OneNote apps)

| +| Read aloud with simultaneous highlighting |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
|

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

(N/A for Outlook PC)

|

X

(N/A for any OneNote apps or Outlook PC)

| +| Adjustable text spacing and font size |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iPad
  • Outlook Web Access
  • Office Lens on iOS, Android
|

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

(N/A for Word for iOS, Word Online, Outlook Web Access, or Office Lens)

|

X

|

X

|

X

(N/A for any OneNote apps)

| | Syllabification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word Online
  • Outlook Web Access
| |

X

(N/A for Word for iOS, Word Online, Outlook Web Access)

|

X

(N/A for Word iOS)

|

X

(N/A for Word iOS)

|

X

(N/A for any OneNote apps or Word iOS)

| -| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

| + +| Parts of speech identification |
  • OneNote 2016 (add-in), OneNote Online, OneNote for Windows 10, OneNote for iPad, OneNote Mac
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
|

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

| | Line focus mode |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

| | Picture Dictionary |
  • Word 2016, Word Online, Word Mac, Word for iOS
  • Outlook 2016, Outlook Web Access
  • Office Lens on iOS, Android
| |

X

(N/A for Word Online, Outlook Web Access)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|

X

(N/A for any OneNote apps)

|
@@ -40,18 +41,19 @@ You will also learn how to deploy apps using Microsoft Intune, turn on or off Ea | Spelling suggestions for phonetic misspellings |
  • Word 2016, Word Online, Word for Mac
  • Outlook 2016
| |

X

|

X

|

X

| | | Synonyms alongside spelling suggestions that can be read aloud |
  • Word 2016
  • Outlook 2016
| |

X

|

X

|

X

| | | Grammar checks |
  • Word 2016, Word Online, Word for Mac
  • Outlook 2016
| |

X

|

X

| | | -| Customizable writing critiques |
  • Word 2016, Word for Mac
  • Outlook 2016
| |

X

|

X

| | | -| Tell me what you want to do |
  • Office 2016
  • Office Online
  • Office on iOS, Android, Windows 10
| |

X

|

X

|

X

| | +| Customizable writing critiques |
  • Word 2016, Word for Mac
  • Outlook 2016
|

X

|

X

|

X

| | | +| Tell me what you want to do |
  • Office 2016
  • Office Online
  • Office on iOS, Android, Windows 10
|

X

|

X

|

X

|

X

| | | Editor |
  • Word 2016
| |

X

|

X

| | |
| Creating accessible content features | Available in which apps|Office 2016 MSI|Office 2019| Office 365 ProPlus Monthly (C2R) | Office 365 ProPlus Semi Annual (C2R) | Office 365 ProPlus Annual (C2R) | |---|---|---|---|---|---|---| -| Accessibility Checker |
  • All Office 365 authoring applications on PC, Mac, Web
| |

X

| | | | -| Accessible Templates |
  • Word for PCs, Mac
  • Excel for PCs, Mac
  • PowerPoint for PCs, Mac
  • Sway on iOS, Web, Windows 10
| |

X

| | | | -| Ability to add alt-text for images |
  • Word for PCs (includes automatic suggestions for image descriptions)
  • SharePoint Online (includes automatic suggestions for image descriptions)
  • PowerPoint for PCs (includes automatic suggestions for image descriptions)
  • OneNote (includes automatic extraction of text in images)
  • All Office 365 authoring applications (include ability to add alt-text manually)
| |

X

| | | | + +| Accessibility Checker |
  • All Office 365 authoring applications on PC, Mac, Web
| |

X

|

X

| | | +| Accessible Templates |
  • Word for PCs, Mac
  • Excel for PCs, Mac
  • PowerPoint for PCs, Mac
  • Sway on iOS, Web, Windows 10
| |

X

|

X

| | | +| Ability to add alt-text for images |
  • Word for PCs (includes automatic suggestions for image descriptions)
  • SharePoint Online (includes automatic suggestions for image descriptions)
  • PowerPoint for PCs (includes automatic suggestions for image descriptions)
  • OneNote (includes automatic extraction of text in images)
  • All Office 365 authoring applications (include ability to add alt-text manually)
|

X

|

X

|

X

| | | | Ability to add captions to videos |
  • PowerPoint for PCs
  • Sway on iOS, Web, Windows 10
  • Microsoft Stream (includes ability to have captions auto-generated for videos in English and Spanish)
| |

X

| | | | -| Export as tagged PDF |
  • Word for PCs, Mac
  • Sway on iOS, Web, Windows 10
| | | | | | +| Export as tagged PDF |
  • Word for PCs, Mac
  • Sway on iOS, Web, Windows 10
| |

X

|

X

| | | | Ability to request accessible content |
  • Outlook Web Access
| | | | | |
@@ -79,4 +81,4 @@ Depending on how you plan to do billing, you can have Office 365 accounts that a 1. Sign-in to your services and subscriptions with your Microsoft account. 2. Find the subscription in the list, then select **Change how you pay**. >**Note:** If you don't see **Change how you pay**, it could be because auto-renew is not turned on. You won't be able to change how you pay if auto-renew is off because the subscription has already been paid and will end when its duration expires. -3. Choose a new way to pay from the list or select **Add a new way to pay** and follow the instructions. \ No newline at end of file +3. Choose a new way to pay from the list or select **Add a new way to pay** and follow the instructions. diff --git a/education/windows/TOC.md b/education/windows/TOC.md index 5cfd544fe5..533981750f 100644 --- a/education/windows/TOC.md +++ b/education/windows/TOC.md @@ -21,6 +21,7 @@ ### [For IT administrators: get Minecraft Education Edition](school-get-minecraft.md) ### [Get Minecraft: Education Edition with Windows 10 device promotion](get-minecraft-device-promotion.md) ## [Test Windows 10 in S mode on existing Windows 10 education devices](test-windows10s-for-edu.md) +## [Enable Windows 10 in S mode on Surface Go devices](enable-s-mode-on-surface-go-devices.md) ## [Deploy Windows 10 in a school](deploy-windows-10-in-a-school.md) ## [Deploy Windows 10 in a school district](deploy-windows-10-in-a-school-district.md) ## [Switch to Windows 10 Pro Education in S mode from Windows 10 Pro in S mode](s-mode-switch-to-edu.md) diff --git a/education/windows/enable-s-mode-on-surface-go-devices.md b/education/windows/enable-s-mode-on-surface-go-devices.md new file mode 100644 index 0000000000..e7a0c40d46 --- /dev/null +++ b/education/windows/enable-s-mode-on-surface-go-devices.md @@ -0,0 +1,145 @@ +--- +title: Enable S mode on Surface Go devices for Education +description: Steps that an education customer can perform to enable S mode on Surface Go devices +keywords: Surface Go for Education, S mode +ms.prod: w10 +ms.technology: Windows +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: edu +ms.localizationpriority: medium +author: kaushika-msft +ms.author: +ms.date: 07/30/2018 +--- + +# Surface Go for Education - Enabling S mode + +Surface Go devices are available with both Windows 10 Home in S mode and Windows 10 Pro configurations. Education customers who purchase Surface Go devices with Windows 10 Pro may wish to take advantage of S mode on their Pro devices. These customers can create their own S mode image for Surface Go or enable S mode on a per-device basis. + +## Prerequisites + +Here are some things you’ll need before attempting any of these procedures: + +- A Surface Go device or Surface Go device image based on Windows 10 Pro + (1803) +- General understanding of [Windows deployment scenarios and related + tools](https://docs.microsoft.com/windows/deployment/windows-deployment-scenarios-and-tools) +- [Windows ADK for Windows 10 + 1803](https://docs.microsoft.com/windows/deployment/windows-adk-scenarios-for-it-pros) +- [Bootable Windows Preinstall Environment + (WinPE)](https://docs.microsoft.com/windows-hardware/manufacture/desktop/winpe-create-usb-bootable-drive) + +## Enabling S Mode – Windows Image (WIM) + +Like enterprise administrators performing large-scale deployment of customized Windows images, education customers can create their own customized Windows images for deployment to multiple classroom devices. An education customer who plans to follow [a traditional image-based deployment +process](https://docs.microsoft.com/windows/deployment/windows-10-deployment-scenarios#traditional-deployment) using a Windows 10 Pro (1803) image for Surface Go devices can enable S mode as follows: + +1. Use DISM to mount your offline Windows 10 Pro (1803) image. + + ``` + dism /Mount-image /imagefile:\ {/Index:\ | /Name:\} /MountDir:\ + ``` + +2. Create an unattend.xml answer file, adding the + amd64_Microsoft_Windows_CodeIntegrity component to Pass 2 offline Servicing + and setting amd64_Microsoft_Windows_CodeIntegrity\\SkuPolicyRequired to “1”. + The resulting xml should look like this… + + Copy + ``` + + + 1 + + + ``` +3. Save the answer file in the **Windows\Panther** folder of your mounted image as unattend.xml. +4. Use DISM to apply the unattend.xml file and enable S Mode: + + Copy + ``` + dism /image:C:\mount\windows /apply-unattend:C:\mount\windows\windows\panther\unattend.xml + ``` + + > Note: in the above example, C:\\mount\\ is the local directory used to mount + > the offline image. +5. Commit the image changes and unmount the image + + Copy + ``` + dism /Unmount-image /MountDir:C:\\mount /Commit + ``` +>Note: don’t forget the /Commit parameter to ensure you don’t lose your + changes. + +Your Windows 10 Pro (1803) image now has S mode enabled and is ready to deploy to Surface Go devices. + +## Enabling S Mode – Per Device + +Education customers who wish to avoid the additional overhead associated with Windows image creation, customization, and deployment can enable S mode on a per-device basis. Performing the following steps on a Surface Go device will enable S mode on an existing installation of Windows 10 Pro (1803). + +1. Create a bootable WinPE media. See [Create a bootable Windows PE USB + drive](http://msdn.microsoft.com/library/windows/hardware/dn938386.aspx) for details. + +2. Create an unattend.xml answer file, adding the + amd64_Microsoft_Windows_CodeIntegrity component to Pass 2 offline Servicing + and setting amd64_Microsoft_Windows_CodeIntegrity\\SkuPolicyRequired to “1”. The resulting xml should look like this… + + Copy + ``` + + + 1 + + + ``` + +3. Attach your bootable WinPE USB drive to a Surface Go device and perform a USB boot (hold the **volume down** button while powering on the device… continue to hold until the Surface logo appears) +4. Wait for WinPE to launch a command window (*X:\\windows\\system32\\cmd.exe*). +5. Apply the unattend.xml created in step 2 using DISM. + + Copy + ``` + dism /image:C:\ /apply-unattend:D:\unattend.xml + ``` + > Note: in the above example, C:\\ is the local OS drive (offline). D:\ is where the S mode unattend.xml file (from Step 2) resides. + +6. Once DISM has successfully applied the unattend.xml, reboot the Surface Go device. +Upon reboot, you should find your Surface Go device now is now in S mode. + +## Troubleshooting + +|ISSUE | RESOLUTION | +|------------------------ |-----------------------| +|DISM fails to apply the unattend.xml because the OS drive is encrypted. | This is one reason why it’s best to enable S mode before setting up and configuring a device. If the OS drive has already been encrypted, you’ll need to fully decrypt the drive before you can enable S mode. | +|Unattend.xml has been applied and dism reports success. However, when I boot the device, it’s not in S mode. This can happen when a device was booted to Windows 10 Pro before S mode was enabled. To resolve this issue, do the following: | 1. **Run** “shutdown.exe -p -f” to force a complete shutdown.
2. Hold the **vol-up** button while pressing the **power** button to power on the device. Continue to hold **vol-up** until you see the Surface UEFI settings.
3. Under **Security** find the **Secure Boot** option and disable it.
4. With SecureBoot disabled choose **exit** -\> **restart now** to exit UEFI settings and reboot the device back to Windows.
5. Confirm that S mode is now properly enabled.
6. Once you’ve confirmed S mode, you should re-enable Secure Boot… repeat the above steps, choosing to **Enable** Secure Boot from the UEFI securitysettings. + +## Additional Info + +[Windows 10 deployment scenarios](https://docs.microsoft.com/en-us/windows/deployment/windows-10-deployment-scenarios) + +[Windows 10 deployment scenarios and tools](https://docs.microsoft.com/en-us/windows/deployment/windows-deployment-scenarios-and-tools) + +[Download and install the Windows ADK](https://docs.microsoft.com/en-us/windows-hardware/get-started/adk-install) + +[Windows ADK for Windows 10 scenarios for IT Pros](https://docs.microsoft.com/en-us/windows/deployment/windows-adk-scenarios-for-it-pros) + +[Modify a Windows Image Using DISM](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/mount-and-modify-a-windows-image-using-dism) + +[Service a Windows Image Using DISM](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/service-a-windows-image-using-dism) + +[DISM Image Management Command-Line Options](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/dism-image-management-command-line-options-s14) + diff --git a/education/windows/images/suspc-add-recommended-apps-1807.png b/education/windows/images/suspc-add-recommended-apps-1807.png index e579c8f99d..61a674e363 100644 Binary files a/education/windows/images/suspc-add-recommended-apps-1807.png and b/education/windows/images/suspc-add-recommended-apps-1807.png differ diff --git a/education/windows/images/suspc-available-student-settings-1807.png b/education/windows/images/suspc-available-student-settings-1807.png new file mode 100644 index 0000000000..d39fc2ceba Binary files /dev/null and b/education/windows/images/suspc-available-student-settings-1807.png differ diff --git a/education/windows/images/suspc-configure-student-settings-1807.png b/education/windows/images/suspc-configure-student-settings-1807.png index 92d6ae184a..553fb4d689 100644 Binary files a/education/windows/images/suspc-configure-student-settings-1807.png and b/education/windows/images/suspc-configure-student-settings-1807.png differ diff --git a/education/windows/images/suspc-createpackage-signin-1807.png b/education/windows/images/suspc-createpackage-signin-1807.png new file mode 100644 index 0000000000..7a80f5c751 Binary files /dev/null and b/education/windows/images/suspc-createpackage-signin-1807.png differ diff --git a/education/windows/images/suspc-createpackage-summary-1807.png b/education/windows/images/suspc-createpackage-summary-1807.png new file mode 100644 index 0000000000..e78ac67856 Binary files /dev/null and b/education/windows/images/suspc-createpackage-summary-1807.png differ diff --git a/education/windows/images/suspc-current-os-version-1807.png b/education/windows/images/suspc-current-os-version-1807.png new file mode 100644 index 0000000000..bc2ba6a08d Binary files /dev/null and b/education/windows/images/suspc-current-os-version-1807.png differ diff --git a/education/windows/images/suspc-current-os-version-next-1807.png b/education/windows/images/suspc-current-os-version-next-1807.png new file mode 100644 index 0000000000..a0b6632bd3 Binary files /dev/null and b/education/windows/images/suspc-current-os-version-next-1807.png differ diff --git a/education/windows/images/suspc-device-names-1807.png b/education/windows/images/suspc-device-names-1807.png index 886ff13413..f3ad674b99 100644 Binary files a/education/windows/images/suspc-device-names-1807.png and b/education/windows/images/suspc-device-names-1807.png differ diff --git a/education/windows/images/suspc-savepackage-insertusb-1807.png b/education/windows/images/suspc-savepackage-insertusb-1807.png new file mode 100644 index 0000000000..cd75795863 Binary files /dev/null and b/education/windows/images/suspc-savepackage-insertusb-1807.png differ diff --git a/education/windows/images/suspc-savepackage-ppkgisready-1807.png b/education/windows/images/suspc-savepackage-ppkgisready-1807.png new file mode 100644 index 0000000000..fd82b1e50b Binary files /dev/null and b/education/windows/images/suspc-savepackage-ppkgisready-1807.png differ diff --git a/education/windows/images/suspc-select-wifi-network-1807.png b/education/windows/images/suspc-select-wifi-network-1807.png index 6c7240db39..5a362daaa0 100644 Binary files a/education/windows/images/suspc-select-wifi-network-1807.png and b/education/windows/images/suspc-select-wifi-network-1807.png differ diff --git a/education/windows/images/suspc-take-a-test-1807.png b/education/windows/images/suspc-take-a-test-1807.png new file mode 100644 index 0000000000..ea6295658f Binary files /dev/null and b/education/windows/images/suspc-take-a-test-1807.png differ diff --git a/education/windows/images/suspc-time-zone-1807.png b/education/windows/images/suspc-time-zone-1807.png new file mode 100644 index 0000000000..274e411a4d Binary files /dev/null and b/education/windows/images/suspc-time-zone-1807.png differ diff --git a/education/windows/images/suspc-wifi-network-1807.png b/education/windows/images/suspc-wifi-network-1807.png new file mode 100644 index 0000000000..6e03d35363 Binary files /dev/null and b/education/windows/images/suspc-wifi-network-1807.png differ diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index ff0db1d6b4..c4b90aee80 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -7,10 +7,10 @@ ms.technology: Windows ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: edu -ms.localizationpriority: high +ms.localizationpriority: medium author: lenewsad ms.author: lanewsad -ms.date: 07/11/2018 +ms.date: 08/03/2018 --- # Use the Set up School PCs app @@ -46,7 +46,7 @@ USB drives are, by default, FAT32-formatted, and are unable to save more than 4 5. Set **File system** to **NTFS**. 6. Click **Start** to format the drive. -### Prepare existing PC account for new setup +### Prepare existing PC account for new setup Apply new packages to factory reset or new PCs. If you apply it to a PC that's already set up, you may lose the accounts and data. If a PC has already been set up, and you want to apply a new package, reset the PC to a clean state. @@ -68,12 +68,12 @@ This section offers recommendations to prepare you for the best possible setup e ### Run the same Windows 10 build on the admin device and the student PCs We recommend you run the IT administrator or technical teacher's device on the same Windows 10 build as the student PCs. -### Student PCs should meet OS requirements for the app -Check the minimum OS requirements in the Set up School PCs app. We recommend using the latest Set up School PCs app along with the latest Windows 10 images on the student PCs. +### Student PCs should meet OS requirements for the app +Check the OS requirements in the Set up School PCs app. We recommend using the latest Set up School PCs app along with the latest Windows 10 images on the student PCs. To check the app's OS requirements, go to the Microsoft Store and locate the Set up School PCs app. In the app's description, go to **System Requirements > OS**. -### Use app on a PC that is connected to your school's network +### Use app on a PC that is connected to your school's network We recommend that you run the Set up School PCs app on a computer that's connected to your school's network. That way the app can gather accurate information about your school's wireless networks and cloud subscriptions. If it's not connected, you'll need to enter the information manually. > [!NOTE] @@ -82,7 +82,7 @@ We recommend that you run the Set up School PCs app on a computer that's connect >* Open Wi-Fi networks that require the user to accept Terms of Use. ### Run app on an open network or network that requires a basic password -Don't use Set up School PCs over a certification-based network, or one where you have to enter credentials in a browser. If you need to set up numerous devices over Wi-Fi, make sure that your network configuration can support it. +Don't use Set up School PCs over a certification-based network, or one where you have to enter credentials in a browser. If you need to set up many devices over Wi-Fi, make sure that your network configuration can support it. We recommend that you: * Configure your DHCP so at least 200 IP addresses are available for your devices. Having available IP addresses will allow you to set up many devices simultaneously. @@ -92,16 +92,17 @@ We recommend that you: > Only use the provisioning package on PCs that you want to configure and lock down for students. After you apply the provisioning package to a student PC, the PC must be reset to remove the settings. ### Use an additional USB drive -You can set up PCs at the same time. Just save the provisioning package to an additional USB drive. Then plug them in at the same time during deployment. +To set up more than one PC at the same time, save the provisioning package to additional USB drives. Then plug the USBs in at the same time during setup. -### Limit changes to school-optimized settings +### Limit changes to school-optimized settings -We strongly recommend that you avoid changing preset policies. Changes can slow down setup, performance, and sign-in time. -## Create the provisioning package +We strongly recommend that you avoid changing preset policies. Changes can slow down setup, performance, and the time it takes to sign in. + +## Create the provisioning package The **Set up School PCs** app guides you through the configuration choices for the student PCs. -### Sign-in +### Sign in 1. Open the Set up School PCs app on your PC and click **Get started**. ![Launch the Set up School PCs app](images/suspc_getstarted_050817.png) @@ -120,10 +121,10 @@ a. Click **Work or school account** > **Continue**. 1. Click **Accept** to allow Set up School PCs to access your account throughout setup. 2. When your account name appears on the page, as shown in the image below, click **Next.** - ![Verify that the account you selected shows up](images/suspc_createpackage_signin.png) + ![Verify that the account you selected shows up](images/suspc-createpackage-signin-1807.png) ### Wireless network -Add and save a wireless network profile to provision on each student PC. Only skip Wi-Fi setup if you have an Ethernet connection. +Add and save the wireless network profile that you want student PCs to connect to. Only skip Wi-Fi setup if you have an Ethernet connection. Select your school's Wi-Fi network from the list of available wireless networks, or click **Add a wireless network** to manually configure it. Then click **Next.** @@ -139,41 +140,54 @@ To make sure all device names are unique, Set up School PCs automatically append ### Settings -Select additional settings to include in the provisioning package. To begin, select the operating system on your student PCs. +Select additional settings to include in the provisioning package. To begin, select the operating system on your student PCs. +![Screenshot of the Current OS version page with the Select OS version menu selected, showing 6 Windows 10 options. All other settings on page are unavailable to select.](images/suspc-current-os-version-1807.png) -![Configure student PC settings page showing 5 settings with checkboxes and 1 setting with browser button](images/suspc-configure-student-settings-1807.png) +Setting selections vary based on the OS version you select. The example screenshot below shows the settings that become available when you select **Windows 10 version 1703**. The option to **Enable Autopilot Reset** is not available for this version of Windows 10. -Setting selections vary based on the OS version you select. The following table lists all possible settings, descriptions, and important notes to consider. After you've made your selections, click **Next**. +![Example screenshot of the Current OS version page, with Windows 10 version 1803 selected. 4 available settings and 1 unavailable setting are shown, and none are selected.](images/suspc-available-student-settings-1807.png) +> [!NOTE] +> The [**Time zone** setting](use-set-up-school-pcs-app.md#time-zone), shown in the sidebar of the screenshot below, is not made available to versions of Windows 10 in S mode. If you select a version in S mode, you will not be asked to configure the time zone. -|Setting |What happens if I select it? |Note| -|---------|---------|---------| -|Remove apps pre-installed by the device manufacturer | Uninstalls apps that came loaded on the computer by the device's manufacturer. |Adds about 30 minutes to the provisioning process.| -|Allow local storage (not recommended for shared devices) | Lets students save files to the Desktop and Documents folder on the Student PC. |Not recommended if the device will be part of a shared cart or lab.| -|Optimize device for a single student, instead of a shared cart or lab |Optimizes the device for use by a single student, rather than many students. |Recommended option only if the device is not shared with other students in the school. Single-optimized accounts are set to expire, and require a signin, 180 days after setup. This setting increases the maximum PC storage to 100% of the available disk space. In this case, student accounts aren't deleted unless the account has been inactive for 180 days. | -|Let guests sign in to these PCs |Allows guests to use student PCs without a school account. |Common to use within a public, shared space, such as a library. Also used when a student loses their password. Adds a **Guest** account to the PC sign-in screen that anyone can sign in to.| -|Enable Windows Autopilot Reset | Lets you remotely reset a student’s PC from the lock screen, apply the device’s original settings, and enroll it in device management (Azure AD and MDM). |Requires Windows 10, version 1709 and WinRE must be enabled on the PC. Setup will fail if both requirements aren't met.| -|Lock screen background|Change the default screen lock background to a custom image.|Click **Browse** to search for an image file on your computer. Accepted image formats are jpg, jpeg, and png.| +The following table describes each setting and lists the applicable Windows 10 versions. To find out if a setting is available in your version of Windows 10, look for an *X* in the setting row and in the version column. +|Setting |1703|1709|1803|What happens if I select it? |Note| +|---------|---------|---------|---------|---------|---------| +|Remove apps pre-installed by the device manufacturer |X|X|X| Uninstalls apps that came loaded on the computer by the device's manufacturer. |Adds about 30 minutes to the provisioning process.| +|Allow local storage (not recommended for shared devices) |X|X|X| Lets students save files to the Desktop and Documents folder on the Student PC. |Not recommended if the device will be part of a shared cart or lab.| +|Optimize device for a single student, instead of a shared cart or lab |X|X|X|Optimizes the device for use by a single student, rather than many students. |Recommended option only if the device is not shared with other students in the school. Single-optimized accounts are set to expire, and require a signin, 180 days after setup. This setting increases the maximum PC storage to 100% of the available disk space. In this case, student accounts aren't deleted unless the account has been inactive for 180 days. | +|Let guests sign in to these PCs |X|X|X|Allows guests to use student PCs without a school account. |Common to use within a public, shared space, such as a library. Also used when a student loses their password. Adds a **Guest** account to the PC sign-in screen that anyone can sign in to.| +|Enable Autopilot Reset |Not available|X|X| Lets you remotely reset a student’s PC from the lock screen, apply the device’s original settings, and enroll it in device management (Azure AD and MDM). |Requires Windows 10, version 1709 and WinRE must be enabled on the PC. Setup will fail if both requirements aren't met.| +|Lock screen background|X|X|X|Change the default screen lock background to a custom image.|Click **Browse** to search for an image file on your computer. Accepted image formats are jpg, jpeg, and png.| -### Take a Test app +After you've made your selections, click **Next**. + +![Configure student PC settings page showing 5 settings, with two settings selected. Lock screen background image is the default image. Cursor is hovering over the blue Next button.](images/suspc-current-os-version-next-1807.png) + +### Time zone + +> [!WARNING] +> If you are using the Autounattend.xml file to reimage your school PCs, do not specify a time zone in the file. If you set the time zone in the file *and* in this app, you will encounter an error. + +Choose the time zone where your school's PCs are used. This setting ensures that all PCs are provisioned in the same time zone. When you're done, click **Next**. + +![Choose PC time zone page with the time zone menu expanded to show all time zone selections.](images/suspc-time-zone-1807.png) + +### Take a Test Set up the Take a Test app to give online quizzes and high-stakes assessments. During assessments, Windows locks down the student PC so that students can't access anything else on the device. 1. Select **Yes** to create a Take a Test button on the sign-in screens of your students' PCs. - ![Set up Take a Test app page with "Yes" selected to create an app button. Page also has two checkboxes for additional settings and one text field for the assessment URL.](images/suspc_createpackage_takeatestpage_073117.png) -2. Select from the advanced settings. The following table lists available settings and their descriptions. - -|Setting |Description | -|---------|---------| -|Allow keyboard auto-suggestions | Allows app to suggest words as the student types on the PC's keyboard. | -|Allow teachers to monitor online tests | Enables screen capture in the Take a Test app. | + ![Set up Take a Test app page with "Yes" selected to create an app button. Page also has two checkboxes for additional settings and one text field for the assessment URL.](images/suspc-take-a-test-1807.png) +2. Select from the advanced settings. Available settings inclue: + * Allow keyboard auto-suggestions: Allows app to suggest words as the student types on the PC's keyboard. + * Allow teachers to monitor online tests: Enables screen capture in the Take a Test app. 3. Enter the URL where the test is hosted. When students log in to the Take a Test account, they'll be able to click or enter the link to view the assessment. - 4. Click **Next**. -### Add recommended apps +### Recommended apps Choose from a list of recommended Microsoft Store apps to install on student PCs. Then click **Next**. After they're assigned, apps are pinned to the student's Start menu. ![Add recommended apps screen with 7 icons of recommended apps and selection boxes. Skip button is enabled and Next button is disabled. ](images/suspc-add-recommended-apps-1807.png) @@ -186,23 +200,25 @@ The following table lists the recommended apps you'll see. |Minecraft: Education Edition | Free trial| |Other apps fit for the classroom |Select from WeDo 2.0 LEGO®, Arduino IDE, Ohbot, Sesavis Visual, and EV3 Programming| +If you receive an error and are unable to add the selected apps, click **Skip**. Contact your IT admin to get these apps later. + ### Summary 1. Review all of the settings for accuracy and completeness. Check carefully. To make changes to a saved package, you have to start over. 2. To make changes now, click any page along the left side of the window. 3. When finished, click **Accept**. - ![Example image of the Summary screen, showing the user's configurations for Sign-in, Wireless network, Device names, Settings, Take a Test, and Recommended apps. Accept button is active and the page contains three links on the right-hand side to help and support.](images/suspc_createpackage_summary_073117.png) + ![Example image of the Summary screen, showing the user's configurations for Sign-in, Wireless network, Device names, Settings, Time zone, Take a Test. Accept button is available and the page contains three links on the right-hand side to help and support.](images/suspc-createpackage-summary-1807.png) ### Insert USB 1. Insert a USB drive. The **Save** button will light up when your computer detects the USB. 2. Choose your USB drive from the list and click **Save**. - ![Insert a USB drive now screen with USB drive selection highlighted. Save button is blue and active.](images/suspc_savepackage_insertusb.png) + ![Insert a USB drive now screen with USB drive selection highlighted. Save button is blue and active.](images/suspc-savepackage-insertusb-1807.png) 3. When the package is ready, you'll see the filename and package expiration date. You can also click **Add a USB** to save the same provisioning package to another USB drive. When you're done, remove the USB drive and click **Next**. - ![Your provisioning package is ready screen with package details, active Next button, and grayed-out Add a USB button.](images/suspc_savepackage_ppkgisready.png) + ![Your provisioning package is ready screen with package filename and expiration date. Shows an active blue, Next button, and a gray Add a USB button.](images/suspc-savepackage-ppkgisready-1807.png) ## Run package - Get PCs ready Complete each step on the **Get PCs ready** page to prepare student PCs for set-up. Then click **Next**. @@ -231,8 +247,8 @@ When used in context of the Set up School PCs app, the word *package* refers to ![Screen with message telling user to remove the USB drive.](images/suspc_setup_removemediamessage.png) -4. If you did not set up the package to do Azure AD Join, go through the rest of the Windows device setup experience. If you did configure the package for Azure AD Join, the computer is ready for use and no further configurations are required. +4. If you didn't set up the package with Azure AD Join, continue the Windows device setup experience. If you did configure the package with Azure AD Join, the computer is ready for use and no further configurations are required. - If successful, you'll see a setup complete message. The PCs start up on the lock screen with your school's custom background. Upon first use, students and teachers will be able to connect to your school's network and resources. + If successful, you'll see a setup complete message. The PCs start up on the lock screen, with your school's custom background. Upon first use, students and teachers can connect to your school's network and resources. diff --git a/mdop/mbam-v25/getting-started-with-mbam-25.md b/mdop/mbam-v25/getting-started-with-mbam-25.md index 3513df82f6..a7ba39d226 100644 --- a/mdop/mbam-v25/getting-started-with-mbam-25.md +++ b/mdop/mbam-v25/getting-started-with-mbam-25.md @@ -20,8 +20,6 @@ See the following resources for additional MBAM documentation: - [Microsoft BitLocker Administration and Monitoring Deployment Guide](https://go.microsoft.com/fwlink/?LinkId=396653) -- [Microsoft Training Overview](https://go.microsoft.com/fwlink/p/?LinkId=80347) - Before you deploy MBAM to a production environment, we recommend that you validate your deployment plan in a test environment. ## Getting started with MBAM 2.5 diff --git a/store-for-business/acquire-apps-microsoft-store-for-business.md b/store-for-business/acquire-apps-microsoft-store-for-business.md index 4815821e0a..0aa8fe3acc 100644 --- a/store-for-business/acquire-apps-microsoft-store-for-business.md +++ b/store-for-business/acquire-apps-microsoft-store-for-business.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: store author: TrudyHa ms.author: TrudyHa -ms.date: 11/01/2017 +ms.date: 08/01/2017 ms.topic: conceptual ms.localizationpriority: medium --- @@ -43,22 +43,31 @@ There are a couple of things we need to know when you pay for apps. You can add **To manage Allow users to shop setting** 1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com) -2. Click **Manage**, and then click **Settings**. -3. On **Shop**, turn on or turn off **Allow users to shop**. +2. Select **Manage**, and then select **Settings**. +3. On **Shop**, , under **Shopping behavior**, turn on or turn off **Allow users to shop**. ![manage settings to control Basic Purchaser role assignment](images/sfb-allow-shop-setting.png) +## Allow app requests + +People in your org can request license for apps that they need, or that others need. When **All app requests** is turned on, app requests are sent to org admins. Admins for your tenant will receive an email with the request, and can decide about making the purchase. + +**To manage All app requests** +1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com) or [Microsoft Store for Education](https://educationstore.microsoft.com) +2. Select **Manage**, and then select **Settings**. +3. On **Shop**, under **Shopping behavior** turn on or turn off **Allow app requests**. + ## Acquire apps **To acquire an app** 1. Sign in to http://businessstore.microsoft.com -2. Click **Shop**, or use Search to find an app. -3. Click the app you want to purchase. +2. Select **Shop for my group**, or use Search to find an app. +3. Select the app you want to purchase. 4. On the product description page, choose your license type - either online or offline. -5. Free apps will be added to **Products & services**. For apps with a price, you can set the quantity you want to buy. Type the quantity and click **Next**. -6. If you don’t have a payment method saved in **Billing - Payment methods**, we will prompt you for one. -7. Add your credit card or debit card info, and click **Next**. Your card info is saved as a payment option on **Billing - Payment methods**. +5. Free apps will be added to **Products & services**. For apps with a price, you can set the quantity you want to buy. Type the quantity and select **Next**. +6. If you don’t have a payment method saved in **Billing & payments**, we will prompt you for one. +7. Add your credit card or debit card info, and select **Next**. Your card info is saved as a payment option on **Billing & payments - Payment methods**. -You’ll also need to have your business address saved on **Billing - Account profile**. The address is used to generate tax rates. For more information on taxes for apps, see [organization tax information](https://docs.microsoft.com/microsoft-store/update-microsoft-store-for-business-account-settings#organization-tax-information). +You’ll also need to have your business address saved on **My organization - Profile**. The address is used to generate tax rates. For more information on taxes for apps, see [organization tax information](https://docs.microsoft.com/microsoft-store/update-microsoft-store-for-business-account-settings#organization-tax-information). Microsoft Store adds the app to your inventory. From **Products & services**, you can: - Distribute the app: add to private store, or assign licenses @@ -67,12 +76,4 @@ Microsoft Store adds the app to your inventory. From **Products & services**, yo For info on distributing apps, see [Distribute apps to your employees from the Microsoft Store for Business](distribute-apps-to-your-employees-microsoft-store-for-business.md). -For info on offline-licensed apps, see [Distribute offline apps](distribute-offline-apps.md). - -## Request apps -People in your org can request additional licenses for apps that are in your organization's private store. When **Allow app requests** is turned on, people in your org can respond to a notification about app license availability. Admins for your tenant will receive an email with the request, and can decide about making the purchase. - -**To manage Allow app requests** -1. Sign in to http://businessstore.microsoft.com -2. Click **Manage**, click **Settings**, and then click **Distribute**. -3. Under **Private store** turn on, or turn off **Allow app requests**. \ No newline at end of file +For info on offline-licensed apps, see [Distribute offline apps](distribute-offline-apps.md). \ No newline at end of file diff --git a/store-for-business/release-history-microsoft-store-business-education.md b/store-for-business/release-history-microsoft-store-business-education.md index f9d2591ffe..aa159ddffe 100644 --- a/store-for-business/release-history-microsoft-store-business-education.md +++ b/store-for-business/release-history-microsoft-store-business-education.md @@ -8,7 +8,7 @@ ms.pagetype: store author: TrudyHa ms.author: TrudyHa ms.topic: conceptual -ms.date: 6/28/2018 +ms.date: 07/31/2018 --- # Microsoft Store for Business and Education release history @@ -17,6 +17,10 @@ Microsoft Store for Business and Education regularly releases new and improved f Looking for info on the latest release? Check out [What's new in Microsoft Store for Business and Education](whats-new-microsoft-store-business-education.md) +## June 2018 +- **Change order within private store collection** - Continuing our focus on improvements for private store, now you can customize the order of products in each private store collection. +- **Performance improvements in private store** - We continue to work on performance improvements in the private store. Now, most products new to your inventory are available in your private store within 15 minutes of adding them. [Get more info](https://docs.microsoft.com/microsoft-store/manage-private-store-settings#private-store-performance) + ## May 2018 - **Immersive Reader app available in Microsoft Store for Education** - This app is a free tool that uses proven techniques to improve reading and writing for people regardless of their age or ability. You can add the app to your private store, so students can easily install and use it. diff --git a/store-for-business/roles-and-permissions-microsoft-store-for-business.md b/store-for-business/roles-and-permissions-microsoft-store-for-business.md index 6dad7ccd03..22e03ceda8 100644 --- a/store-for-business/roles-and-permissions-microsoft-store-for-business.md +++ b/store-for-business/roles-and-permissions-microsoft-store-for-business.md @@ -10,7 +10,7 @@ author: TrudyHa ms.author: TrudyHa ms.topic: conceptual ms.localizationpriority: medium -ms.date: 3/30/2018 +ms.date: 8/7/2018 --- # Roles and permissions in Microsoft Store for Business and Education @@ -31,10 +31,11 @@ This table lists the global user accounts and the permissions they have in Micro | | Global Administrator | Billing Administrator | | ------------------------------ | --------------------- | --------------------- | -| Sign up for Microsoft Store for Business and Education | X | | +| Sign up for Microsoft Store for Business and Education | X | | Modify company profile settings | X | | | Acquire apps | X | X | | Distribute apps | X | X | +| Purchase subscription-based software | X | X |   - **Global Administrator** - IT Pros with this account have full access to Microsoft Store. They can do everything allowed in the Microsoft Store Admin role, plus they can sign up for Microsoft Store. @@ -43,7 +44,7 @@ This table lists the global user accounts and the permissions they have in Micro ## Microsoft Store roles and permissions -Microsoft Store has a set of roles that help IT admins and employees manage access to apps and tasks for Microsoft Store. Employees with these roles will need to use their Azure AD account to access Microsoft Store. +Microsoft Store for Business has a set of roles that help IT admins and employees manage access to apps and tasks for Microsoft Store. Employees with these roles will need to use their Azure AD account to access Microsoft Store. This table lists the roles and their permissions. diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md index ecb95fbfa9..3f6676128a 100644 --- a/store-for-business/whats-new-microsoft-store-business-education.md +++ b/store-for-business/whats-new-microsoft-store-business-education.md @@ -8,7 +8,7 @@ ms.pagetype: store author: TrudyHa ms.author: TrudyHa ms.topic: conceptual -ms.date: 6/28/2018 +ms.date: 07/31/2018 --- # What's new in Microsoft Store for Business and Education @@ -17,14 +17,9 @@ Microsoft Store for Business and Education regularly releases new and improved f ## Latest updates for Store for Business and Education -**June 2018** - -| | | -|--------------------------------------|---------------------------------| -| ![Private store icon](images/private-store-icon.png) |**Change order within private store collection**

Continuing our focus on improvements for private store, now you can customize the order of products in each private store collection.

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | -| ![performance icon](images/perf-improvement-icon.png) |**Performance improvements in private store**

We continue to work on performance improvements in the private store. Now, most products new to your inventory are available in your private store within 15 minutes of adding them.

[Get more info](https://docs.microsoft.com/microsoft-store/manage-private-store-settings#private-store-performance)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | - +**July 2018** +We’ve been working on bug fixes and performance improvements to provide you a better experience. Stay tuned for new feature + + + + + + + + + + + + + + + + + + + + +``` + +## Conversion template parameter reference +Here is the complete list of parameters that you can use in the Conversion template file. + + +|ConversionSettings entries |Description | +|---------|---------| +|Settings:: AllowTelemetry |[optional] Enables telemetry logging for this invocation of the tool. | +|Settings:: ApplyAllPrepareComputerFixes |[optional] Applies all recommended prepare computer fixes. Cannot be set when other attributes are used. | +|Settings:: GenerateCommandLineFile |[optional] Copies the template file input to the SaveLocation directory for future use. | +|Settings:: AllowPromptForPassword |[optional] Instructs the tool to prompt the user to enter passwords for the Virtual Machine and for the signing certificate if it is required and not specified. | +|ExclusionItems |[optional] 0 or more FileExclusion or RegistryExclusion elements. All FileExclusion elements must appear before any RegistryExclusion elements. | +|ExclusionItems::FileExclusion |[optional] A file to exclude for packaging. | +|ExclusionItems::FileExclusion::ExcludePath |Path to file to exclude for packaging. | +|ExclusionItems::RegistryExclusion |[optional] A registry key to exclude for packaging. | +|ExclusionItems::RegistryExclusion:: ExcludePath |Path to registry to exclude for packaging. | +|PrepareComputer::DisableDefragService |[optional] Disables Windows Defragmenter while the app is being converted. If set to false, overrides ApplyAllPrepareComputerFixes. | +|PrepareComputer:: DisableWindowsSearchService |[optional] Disables Windows Search while the app is being converted. If set to false, overrides ApplyAllPrepareComputerFixes. | +|PrepareComputer:: DisableSmsHostService |[optional] Disables SMS Host while the app is being converted. If set to false, overrides ApplyAllPrepareComputerFixes. | +|PrepareComputer:: DisableWindowsUpdateService |[optional] Disables Windows Update while the app is being converted. If set to false, overrides ApplyAllPrepareComputerFixes. | +|SaveLocation |[optional] An element to specify the save location of the tool. If not specified, the package will be saved under the Desktop folder. | +|SaveLocation::Path |The path to the folder where the resulting MSIX package is saved. | +|Installer::Path |The path to the application installer. | +|Installer::Arguments |The arguments to pass to the installer. You must pass the arguments to force your installer to run unattended/silently. | +|Installer::InstallLocation |[optional] The full path to your application's root folder for the installed files if it were installed (e.g. "C:\Program Files (x86)\MyAppInstalllocation"). | +|VirtualMachine |[optional] An element to specify that the conversion will be run on a local Virtual Machine. | +|VrtualMachine::Name |The name of the Virtual Machine to be used for the conversion environment. | +|VirtualMachine::Username |[optional] The user name for the Virtual Machine to be used for the conversion environment. | +|PackageInformation::PackageName |The Package Name for your MSIX package. | +|PackageInformation::PackageDisplayName |The Package Display Name for your MSIX package. | +|PackageInformation::PublisherName |The Publisher for your MSIX package. | +|PackageInformation::PublisherDisplayName |The Publisher Display Name for your MSIX package. | +|PackageInformation::Version |The version number for your MSIX package. | +|PackageInformation:: MainPackageNameForModificationPackage |[optional] The Package identity name of the main package name. This is used when creating a modification package that takes a dependency on a main (parent) application. | +|Applications |[optional] 0 or more Application elements to configure the Application entries in your MSIX package. | +|Application::Id |The App ID for your MSIX application. This ID will be used for the Application entry detected that matches the specified ExecutableName. You can have multiple Application ID for executables in the package | +|Application::ExecutableName |The executable name for the MSIX application that will be added to the package manifest. The corresponding application entry will be ignored if no application with this name is detected. | +|Application::Description |[optional] The App Description for your MSIX application. If not used, the Application DisplayName will be used. This description will be used for the application entry detected that matches the specified ExecutableName | +|Application::DisplayName |The App Display Name for your MSIX package. This Display Name will be used for the application entry detected that matches the specified ExecutableName | +|Capabilities |[optional] 0 or more Capability elements to add custom capabilities to your MSIX package. “runFullTrust” capability is added by default during conversion. | +|Capability::Name |The capability to add to your MSIX package. | + +## Delete temporary conversion files using Command line interface +To delete all the temporary package files, logs, and artifacts created by the tool, run the MsixPackagingTool.exe cleanup command in the Command line window. + +Example: +- MsixPackagingTool.exe cleanup + +## How to file feedback + +Open Feedback Hub. Alternatively, launch the tool and select the **Settings** gear icon in the top right corner to open the Feedback tab. Here you can file feedback for suggestions, problems, and see other feedback items. + +## Best practices + +- When Packaging ClickOnce installers, it is necessary to send a shortcut to the desktop if the installer is not doing so already. In general, it's a good practice to always send a shortcut to your desktop for the main app executable. +- When creating modification packages, you need to declare the **Package Name** (Identity Name) of the parent application in the tool UI so that the tool sets the correct package dependency in the manifest of the modification package. +- Declaring an installation location field on the Package information page is optional but *recommended*. Make sure that this path matches the installation location of application Installer. +- Performing the preparation steps on the **Prepare Computer** page is optional but *highly recommended*. + +## Known issues +1. MSIX Packaging Tool Driver will fail to install if Windows Insider flight ring settings do no match the OS build of the conversion environment. Navigate to Settings, Updates & Security, Windows Insider Program to make sure your Insider preview build settings do not need attention. If you see this message click on the Fix me button to log in again. You might have to go to Windows Update page and check for update before settings change takes effect. Then try to run the tool again to download the MSIX Packaging Tool driver. If you are still hitting issues, try changing your flight ring to Canary or Insider Fast, install the latest Windows updates and try again. +2. You cannot edit the manifest manually from within the tool. (edit manifest button is disabled). Please use the SDK tools to unpack the MSIX package to edit the manifest manually. +3. Restarting the machine during application installation is not supported. Please ignore the restart request if possible or pass an argument to the installer to not require a restart. + + diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index a4a44b1265..920c37386e 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -9,7 +9,7 @@ ms.pagetype: devices author: jdeckerms ms.localizationpriority: medium ms.author: jdecker -ms.date: 11/28/2017 +ms.date: 08/02/2018 --- # Connect to remote Azure Active Directory-joined PC @@ -45,6 +45,9 @@ From its release, Windows 10 has supported remote connections to PCs that are jo 4. Enter **Authenticated Users**, then click **Check Names**. If the **Name Not Found** window opens, click **Locations** and select this PC. + >[!TIP] + >When you connect to the remote PC, enter your account name in this format: `AzureADName\YourAccountName`. + ## Supported configurations diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 21553dfee9..10bf5bf5c8 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -295,6 +295,8 @@ #### [SUPL DDF file](supl-ddf-file.md) ### [SurfaceHub CSP](surfacehub-csp.md) #### [SurfaceHub DDF file](surfacehub-ddf-file.md) +### [TenantLockdown CSP](tenantlockdown-csp.md) +#### [TenantLockdown DDF file](tenantlockdown-ddf.md) ### [TPMPolicy CSP](tpmpolicy-csp.md) #### [TPMPolicy DDF file](tpmpolicy-ddf-file.md) ### [UEFI CSP](uefi-csp.md) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 9ee6c9171a..c0be644dc5 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -19,6 +19,9 @@ For a step-by-step guide for setting up devices to run in kiosk mode, see [Set u In Windows 10, version 1709, the AssignedAccess configuration service provider (CSP) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. For a step-by-step guide, see [Create a Windows 10 kiosk that runs multiple apps](https://docs.microsoft.com/en-us/windows/configuration/lock-down-windows-10-to-specific-apps). +> [!Warning] +> You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups. + > [!Note] > The AssignedAccess CSP is supported in Windows 10 Enterprise and Windows 10 Education. Starting from Windows 10, version 1709 it is also supported in Windows 10 Pro and Windows 10 S. Starting in Windows 10, version 1803, it is also supported in Windows Holographic for Business edition. diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index cd6b862e43..7128dc2808 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/27/2018 +ms.date: 08/17/2018 --- # Configuration service provider reference @@ -22,7 +22,6 @@ Additional lists: - [List of CSPs supported in Windows Holographic](#hololens) - [List of CSPs supported in Microsoft Surface Hub ](#surfacehubcspsupport) - [List of CSPs supported in Windows 10 IoT Core](#iotcoresupport) -- [List of CSPs supported in Windows 10 S](#windows10s) The following tables show the configuration service providers support in Windows 10. Footnotes: @@ -2165,6 +2164,34 @@ Footnotes: + +[TenantLockdown CSP](tenantlockdown-csp.md) + + + + + + + + + + + + + + + + + + + + + +
HomeProBusinessEnterpriseEducationMobileMobile Enterprise
cross markcheck mark5check mark5check mark5check mark5cross markcross mark
+ + + + [TPMPolicy CSP](tpmpolicy-csp.md) @@ -2724,59 +2751,4 @@ The following list shows the configuration service providers supported in Window - [VPNv2 CSP](vpnv2-csp.md) - [WiFi CSP](wifi-csp.md) -## CSPs supported in Windows 10 S -The CSPs supported in Windows 10 S is the same as in Windows 10 Pro except that Office CSP and EnterpriseDesktop CSP are not available in Windows 10 S. Here is the list: - -- [ActiveSync CSP](activesync-csp.md) -- [APPLICATION CSP](application-csp.md) -- [AppLocker CSP](applocker-csp.md) -- [AssignedAccess CSP](assignedaccess-csp.md) -- [BOOTSTRAP CSP](bootstrap-csp.md) -- [CellularSettings CSP](cellularsettings-csp.md) -- [CertificateStore CSP](certificatestore-csp.md) -- [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) -- [CMPolicy CSP](cmpolicy-csp.md) -- [CM_ProxyEntries CSP](cm-proxyentries-csp.md) -- [CM_CellularEntries CSP](cm-cellularentries-csp.md) -- [Defender CSP](defender-csp.md) -- [DevDetail CSP](devdetail-csp.md) -- [DeviceManageability CSP](devicemanageability-csp.md) -- [DeviceStatus CSP](devicestatus-csp.md) -- [DevInfo CSP](devinfo-csp.md) -- [DiagnosticLog CSP](diagnosticlog-csp.md) -- [DMAcc CSP](dmacc-csp.md) -- [DMClient CSP](dmclient-csp.md) -- [eUICCs CSP](euiccs-csp.md) -- [Firewall CSP](firewall-csp.md) -- [EMAIL2 CSP](email2-csp.md) -- [EnterpriseAPN CSP](enterpriseapn-csp.md) -- [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) -- [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) -- [HealthAttestation CSP](healthattestation-csp.md) -- [NAP CSP](nap-csp.md) -- [NAPDEF CSP](napdef-csp.md) -- [NetworkProxy CSP](networkproxy-csp.md) -- [NodeCache CSP](nodecache-csp.md) -- [PassportForWork CSP](passportforwork-csp.md) -- [Policy CSP](policy-configuration-service-provider.md) -- [Provisioning CSP](provisioning-csp.md) -- [PROXY CSP](proxy-csp.md) -- [PXLOGICAL CSP](pxlogical-csp.md) -- [Reboot CSP](reboot-csp.md) -- [RemoteFind CSP](remotefind-csp.md) -- [RemoteWipe CSP](remotewipe-csp.md) -- [Reporting CSP](reporting-csp.md) -- [RootCATrustedCertificates CSP](rootcacertificates-csp.md) -- [SecureAssessment CSP](secureassessment-csp.md) -- [SecurityPolicy CSP](securitypolicy-csp.md) -- [SharedPC CSP](sharedpc-csp.md) -- [Storage CSP](storage-csp.md) -- [SUPL CSP](supl-csp.md) -- [Update CSP](update-csp.md) -- [VPNv2 CSP](vpnv2-csp.md) -- [WiFi CSP](wifi-csp.md) -- [Win32AppInventory CSP](win32appinventory-csp.md) -- [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) -- [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) -- [WindowsLicensing CSP](windowslicensing-csp.md) diff --git a/windows/client-management/mdm/defender-csp.md b/windows/client-management/mdm/defender-csp.md index eb6af19adc..30c188ac88 100644 --- a/windows/client-management/mdm/defender-csp.md +++ b/windows/client-management/mdm/defender-csp.md @@ -365,7 +365,7 @@ Node that can be used to perform signature updates for Windows Defender. Supported operations are Get and Execute. **OfflineScan** -Added in Windows 10, version 1803. OfflineScan action starts a Windows Defender offline scan on the computer where you run the command. This command causes the computer reboot and start in Windows Defender offline mode to begin the scan. +Added in Windows 10, version 1803. OfflineScan action starts a Windows Defender offline scan on the computer where you run the command. After the next OS reboot, the device will start in Windows Defender offline mode to begin the scan. Supported operations are Get and Execute. @@ -374,12 +374,3 @@ Supported operations are Get and Execute. [Configuration service provider reference](configuration-service-provider-reference.md) -  - -  - - - - - - diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md index e600fe9c9e..65466b03e1 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-csp.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-csp.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/24/2018 +ms.date: 08/21/2018 --- # EnterpriseModernAppManagement CSP @@ -364,9 +364,9 @@ Added in Windows 10, next major version. Specifies if an app is nonremovable by This setting allows the IT admin to set an app to be nonremovable, or unable to be uninstalled by a user. This is useful in enterprise and education scenarios, where the IT admin might want to ensure that everyone always has certain apps and they won't be removed accidentally. This is also useful when there are multiple users per device, and you want to ensure that one user doesn’t remove it for all users. -This setting requires admin permission. This can only be set per device, not per user. You can query the setting using AppInvetoryQuery or AppInventoryResults. +NonRemovable requires admin permission. This can only be set per device, not per user. You can query the setting using AppInventoryQuery or AppInventoryResults. -Value type is integer. Supported operations are Add, Get, Replace, and Delete. +Value type is integer. Supported operations are Add, Get, and Replace. Valid values: - 0 – app is not in the nonremovable app policy list @@ -382,12 +382,12 @@ Add an app to the nonremovable app policy list 1 - ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Test123/NonRemovable + ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/NonRemovable int - 0 + 1 @@ -395,24 +395,7 @@ Add an app to the nonremovable app policy list ``` -Delete an app from the nonremovable app policy list -``` - - - - 1 - - - ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Test123/NonRemovable - - - - - - -``` - -Get list of apps in the nonremovable app policy list +Get the status for a particular app ``` @@ -420,7 +403,7 @@ Get list of apps in the nonremovable app policy list 1 - ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Test123/NonRemovable + ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/NonRemovable @@ -429,9 +412,9 @@ Get list of apps in the nonremovable app policy list ``` -Replace an app in the nonremovable app policy list -Data 0 = app is not in the app policy list -Data 1 = app is in the app policy list +Replace an app in the nonremovable app policy list +Data 0 = app is not in the app policy list +Data 1 = app is in the app policy list ``` @@ -439,7 +422,7 @@ Data 1 = app is in the app policy list 1 - ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/Test123/NonRemovable + ./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/AppStore/PackageFamilyName/NonRemovable int diff --git a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md index 3bbc3d3401..fe58f406bd 100644 --- a/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md +++ b/windows/client-management/mdm/enterprisemodernappmanagement-ddf.md @@ -495,7 +495,6 @@ The XML below is for Windows 10, next major version. - diff --git a/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png b/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png index 95d2fcf840..6c5472995b 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png and b/windows/client-management/mdm/images/provisioning-csp-enterprisemodernappmanagement.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-office.png b/windows/client-management/mdm/images/provisioning-csp-office.png index c361494236..2c8ec1f444 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-office.png and b/windows/client-management/mdm/images/provisioning-csp-office.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-remotewipe-dmandcp.png b/windows/client-management/mdm/images/provisioning-csp-remotewipe-dmandcp.png index 69effac5fd..be91906aa3 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-remotewipe-dmandcp.png and b/windows/client-management/mdm/images/provisioning-csp-remotewipe-dmandcp.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-tenantlockdown.png b/windows/client-management/mdm/images/provisioning-csp-tenantlockdown.png new file mode 100644 index 0000000000..e788aebb52 Binary files /dev/null and b/windows/client-management/mdm/images/provisioning-csp-tenantlockdown.png differ diff --git a/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png b/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png index c8f2721143..0f5e318d8f 100644 Binary files a/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png and b/windows/client-management/mdm/images/provisioning-csp-windowsdefenderapplicationguard.png differ diff --git a/windows/client-management/mdm/networkproxy-csp.md b/windows/client-management/mdm/networkproxy-csp.md index 9b846e226a..fcc6d7386e 100644 --- a/windows/client-management/mdm/networkproxy-csp.md +++ b/windows/client-management/mdm/networkproxy-csp.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 04/12/2018 +ms.date: 08/08/2018 --- # NetworkProxy CSP @@ -34,7 +34,10 @@ The following diagram shows the NetworkProxy configuration service provider in t The root node for the NetworkProxy configuration service provider..

**ProxySettingsPerUser** -Added in Windows 10, version 1803. When set to 0, it enables proxy configuration as global, machine wide; set to 1 for proxy configuratio per user. +Added in Windows 10, version 1803. When set to 0, it enables proxy configuration as global, machine wide. + +> [!Note] +> Per user proxy configuration setting is not supported. **AutoDetect** Automatically detect settings. If enabled, the system tries to find the path to a PAC script.

diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index c92f8d40fc..1234f5199b 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -10,7 +10,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/27/2018 +ms.date: 08/14/2018 --- # What's new in MDM enrollment and management @@ -27,6 +27,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [What's new in Windows 10, version 1703](#whatsnew10) - [What's new in Windows 10, version 1709](#whatsnew1709) - [What's new in Windows 10, version 1803](#whatsnew1803) +- [What's new in Windows 10, next major version](#whatsnewnext) - [Change history in MDM documentation](#change-history-in-mdm-documentation) - [Breaking changes and known issues](#breaking-changes-and-known-issues) - [Get command inside an atomic command is not supported](#getcommand) @@ -1200,6 +1201,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • Search/AllowCortanaInAAD
  • Search/DoNotUseWebResults
  • Security/ConfigureWindowsPasswords
    • +
  • Start/DisableContextMenus
  • System/FeedbackHubAlwaysSaveDiagnosticsLocally
  • SystemServices/ConfigureHomeGroupListenerServiceStartupMode
  • SystemServices/ConfigureHomeGroupProviderServiceStartupMode
    • @@ -1357,6 +1359,134 @@ For details about Microsoft mobile device management protocols for Windows 10 s +## What's new in Windows 10, next major version + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    New or updated topicDescription
    [Policy CSP](policy-configuration-service-provider.md)

    Added the following new policies in Windows 10, next major version:

    +
      +
    • ApplicationManagement/LaunchAppAfterLogOn
      • +
    • ApplicationManagement/ScheduleForceRestartForUpdateFailures
      • +
    • Authentication/EnableFastFirstSignIn
      • +
    • Authentication/EnableWebSignIn
      • +
    • Authentication/PreferredAadTenantDomainName
      • +
    • Browser/AllowFullScreenMode
      • +
    • Browser/AllowPrelaunch
      • +
    • Browser/AllowPrinting
      • +
    • Browser/AllowSavingHistory
      • +
    • Browser/AllowSideloadingOfExtensions
      • +
    • Browser/AllowTabPreloading
      • +
    • Browser/AllowWebContentOnNewTabPage
      • +
    • Browser/ConfigureFavoritesBar
      • +
    • Browser/ConfigureHomeButton
      • +
    • Browser/ConfigureKioskMode
      • +
    • Browser/ConfigureKioskResetAfterIdleTimeout
      • +
    • Browser/ConfigureOpenMicrosoftEdgeWith
      • +
    • Browser/ConfigureTelemetryForMicrosoft365Analytics
      • +
    • Browser/PreventCertErrorOverrides
      • +
    • Browser/SetHomeButtonURL
      • +
    • Browser/SetNewTabPageURL
      • +
    • Browser/UnlockHomeButton
      • +
    • Defender/CheckForSignaturesBeforeRunningScan
      • +
    • Defender/DisableCatchupFullScan
      • +
    • Defender/DisableCatchupQuickScan
      • +
    • Defender/EnableLowCPUPriority
      • +
    • Defender/SignatureUpdateFallbackOrder
      • +
    • Defender/SignatureUpdateFileSharesSources
      • +
    • DeviceGuard/EnableSystemGuard
      • +
    • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
      • +
    • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
      • +
    • DeviceInstallation/PreventDeviceMetadataFromNetwork
      • +
    • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
      • +
    • DmaGuard/DeviceEnumerationPolicy
      • +
    • Experience/AllowClipboardHistory
      • +
    • Experience/DoNotSyncBrowserSettings
      • +
    • Experience/PreventUsersFromTurningOnBrowserSyncing
      • +
    • Kerberos/UPNNameHints
      • +
    • Privacy/AllowCrossDeviceClipboard
      • +
    • Privacy/DisablePrivacyExperience
      • +
    • Privacy/UploadUserActivities
      • +
    • Security/RecoveryEnvironmentAuthentication
      • +
    • TaskManager/AllowEndTask
      • +
    • Update/EngagedRestartDeadlineForFeatureUpdates
      • +
    • Update/EngagedRestartSnoozeScheduleForFeatureUpdates
      • +
    • Update/EngagedRestartTransitionScheduleForFeatureUpdates
      • +
    • Update/SetDisablePauseUXAccess
      • +
    • Update/SetDisableUXWUAccess
      • +
    • WindowsDefenderSecurityCenter/DisableClearTpmButton
      • +
    • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
      • +
    • WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl
      • +
    • WindowsLogon/DontDisplayNetworkSelectionUI
      • +
    +
    [PassportForWork CSP](passportforwork-csp.md)

    Added new settings in Windows 10, next major version.

    +
    [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md)

    Added NonRemovable setting under AppManagement node in Windows 10, next major version.

    +
    [Win32CompatibilityAppraiser CSP](win32compatibilityappraiser-csp.md)

    Added new configuration service provider in Windows 10, next major version.

    +
    [WindowsLicensing CSP](windowslicensing-csp.md)

    Added S mode settings and SyncML examples in Windows 10, next major version.

    +
    [SUPL CSP](supl-csp.md)

    Added 3 new certificate nodes in Windows 10, next major version.

    +
    [Defender CSP](defender-csp.md)

    Added a new node Health/ProductStatus in Windows 10, next major version.

    +
    [BitLocker CSP](bitlocker-csp.md)

    Added a new node AllowStandardUserEncryption in Windows 10, next major version.

    +
    [DevDetail CSP](devdetail-csp.md)

    Added a new node SMBIOSSerialNumber in Windows 10, next major version.

    +
    [Wifi CSP](wifi-csp.md)

    Added a new node WifiCost in Windows 10, next major version.

    +
    [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)

    Added new settings in Windows 10, next major version.

    +
    [RemoteWipe CSP](remotewipe-csp.md)

    Added new settings in Windows 10, next major version.

    +
    [TenantLockdown CSP](\tenantlockdown--csp.md)

    Added new CSP in Windows 10, next major version.

    +
    [Office CSP](office-csp.md)

    Added FinalStatus setting in Windows 10, next major version.

    +
    + + ## Breaking changes and known issues ### Get command inside an atomic command is not supported @@ -1623,6 +1753,75 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware ## Change history in MDM documentation +### August 2018 + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
    New or updated topicDescription
    [Office CSP](office-csp.md)

    Added FinalStatus setting in Windows 10, next major version.

    +
    [RemoteWipe CSP](remotewipe-csp.md)

    Added new settings in Windows 10, next major version.

    +
    [TenantLockdown CSP](\tenantlockdown--csp.md)

    Added new CSP in Windows 10, next major version.

    +
    [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md)

    Added new settings in Windows 10, next major version.

    +
    [Policy DDF file](policy-ddf-file.md)

    Posted an updated version of the Policy DDF for Windows 10, next major version.

    +
    [Policy CSP](policy-configuration-service-provider.md)

    Added the following new policies in Windows 10, next major version:

    +
      +
    • Browser/AllowFullScreenMode
      • +
    • Browser/AllowPrelaunch
      • +
    • Browser/AllowPrinting
      • +
    • Browser/AllowSavingHistory
      • +
    • Browser/AllowSideloadingOfExtensions
      • +
    • Browser/AllowTabPreloading
      • +
    • Browser/AllowWebContentOnNewTabPage
      • +
    • Browser/ConfigureFavoritesBar
      • +
    • Browser/ConfigureHomeButton
      • +
    • Browser/ConfigureKioskMode
      • +
    • Browser/ConfigureKioskResetAfterIdleTimeout
      • +
    • Browser/ConfigureOpenMicrosoftEdgeWith
      • +
    • Browser/ConfigureTelemetryForMicrosoft365Analytics
      • +
    • Browser/PreventCertErrorOverrides
      • +
    • Browser/SetHomeButtonURL
      • +
    • Browser/SetNewTabPageURL
      • +
    • Browser/UnlockHomeButton
      • +
    • Experience/DoNotSyncBrowserSettings
      • +
    • Experience/PreventUsersFromTurningOnBrowserSyncing
      • +
    • Kerberos/UPNNameHints
      • +
    • Privacy/AllowCrossDeviceClipboard
      • +
    • Privacy/DisablePrivacyExperience
      • +
    • Privacy/UploadUserActivities
      • +
    • Update/UpdateNotificationLevel
      • +
    +

    Start/DisableContextMenus - added in Windows 10, version 1803.

    +

    RestrictedGroups/ConfigureGroupMembership - added new schema to apply and retrieve the policy.

    +
    + ### July 2018 @@ -1638,6 +1837,13 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware + + + @@ -1675,18 +1881,23 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
    • ApplicationManagement/LaunchAppAfterLogOn
    • ApplicationManagement/ScheduleForceRestartForUpdateFailures
      • +
    • Authentication/EnableFastFirstSignIn
      • +
    • Authentication/EnableWebSignIn
      • +
    • Authentication/PreferredAadTenantDomainName
    • Defender/CheckForSignaturesBeforeRunningScan
    • Defender/DisableCatchupFullScan
    • Defender/DisableCatchupQuickScan
    • Defender/EnableLowCPUPriority
      • -
    • Defender/SignatureUpdateFallbackOrder
      • -
    • Defender/SignatureUpdateFileSharesSources
      • +
    • Defender/SignatureUpdateFallbackOrder
      • +
    • Defender/SignatureUpdateFileSharesSources
      • +
    • DeviceGuard/EnableSystemGuard
    • DeviceInstallation/AllowInstallationOfMatchingDeviceIDs
    • DeviceInstallation/AllowInstallationOfMatchingDeviceSetupClasses
    • DeviceInstallation/PreventDeviceMetadataFromNetwork
    • DeviceInstallation/PreventInstallationOfDevicesNotDescribedByOtherPolicySettings
    • DmaGuard/DeviceEnumerationPolicy
    • Experience/AllowClipboardHistory
      • +
    • Security/RecoveryEnvironmentAuthentication
    • TaskManager/AllowEndTask
    • WindowsDefenderSecurityCenter/DisableClearTpmButton
    • WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning
      • @@ -1717,7 +1928,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
    - @@ -1729,7 +1940,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware - diff --git a/windows/client-management/mdm/office-csp.md b/windows/client-management/mdm/office-csp.md index 1a415c4fc3..61b8062660 100644 --- a/windows/client-management/mdm/office-csp.md +++ b/windows/client-management/mdm/office-csp.md @@ -6,13 +6,16 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 04/25/2018 +ms.date: 08/15/2018 --- # Office CSP +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. The Office configuration service provider (CSP) enables a Microsoft Office client to be installed on a device via the Office Deployment Tool (ODT). For more information, see [Configuration options for the Office Deployment Tool](https://technet.microsoft.com/en-us/library/jj219426.aspx) and [How to assign Office 365 apps to Windows 10 devices with Microsoft Intune](https://docs.microsoft.com/en-us/intune/apps-add-office365). + This CSP was added in Windows 10, version 1703. For additional information, see [Office DDF](office-ddf.md). @@ -21,39 +24,44 @@ The following diagram shows the Office configuration service provider in tree fo ![Office CSP diagram](images/provisioning-csp-office.png) -**Office** - -

    The root node for the Office configuration service provider.

    +**./Device/Vendor/MSFT/Office/ or ./User/Vendor/MSFT/Office** +The root node for the Office configuration service provider.

    **Installation** +Specifies the options for the Microsoft Office installation. -

    Specifies the options for the Microsoft Office installation. +The supported operations are Add, Delete, Get, and Replace. -

    The supported operations are Add, Delete, Get, and Replace. +**Installation/_id_** +Specifies a unique identifier that represents the ID of the Microsoft Office product to install. -**id** +The supported operations are Add, Delete, Get, and Replace. -

    Specifies a unique identifier that represents the ID of the Microsoft Office product to install. +**Installation/_id_/Install** +Installs Office by using the XML data specified in the configuration.xml file. -

    The supported operations are Add, Delete, Get, and Replace. +The supported operations are Get and Execute. -**Install** +**Installation/_id_/Status** +The Microsoft Office installation status. -

    Installs Office by using the XML data specified in the configuration.xml file. +The only supported operation is Get. -

    The supported operations are Get and Execute. +**Installation/_id_/FinalStatus** +Added in Windows 10, next major version. Indicates the status of the Final Office 365 installation. -**Status** +The only supported operation is Get. -

    The Microsoft Office installation status. +Behavior: +- When Office CSP is triggered to install, it will first check if the FinalStatus node exists or not. If the node exists, delete it. +- When Office installation reaches any terminal states (either success or failure), this node is created that contains the following values: + - When status = 0: 70 (succeeded) + - When status != 0: 60 (failed) -

    The only supported operation is Get. +**Installation/CurrentStatus** +Returns an XML of current Office 365 installation status on the device. -**CurrentStatus** - -

    Returns an XML of current Office 365 installation status on the device. - -

    The only supported operation is Get. +The only supported operation is Get. ## Examples diff --git a/windows/client-management/mdm/office-ddf.md b/windows/client-management/mdm/office-ddf.md index 99b5afb5b6..22e2ece540 100644 --- a/windows/client-management/mdm/office-ddf.md +++ b/windows/client-management/mdm/office-ddf.md @@ -7,17 +7,19 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 12/05/2017 +ms.date: 08/15/2018 --- # Office DDF +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. This topic shows the OMA DM device description framework (DDF) for the **Office** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is for Windows 10, version 1709. +The XML below is for Windows 10, next major version. ``` syntax @@ -33,7 +35,7 @@ The XML below is for Windows 10, version 1709. - Root of the Office CSP. + Root of the office CSP. @@ -44,7 +46,7 @@ The XML below is for Windows 10, version 1709. - com.microsoft/1.3/MDM/Office + com.microsoft/1.5/MDM/Office @@ -53,7 +55,7 @@ The XML below is for Windows 10, version 1709. - Installation options for the Office CSP. + Installation options for the office CSP. @@ -98,7 +100,7 @@ The XML below is for Windows 10, version 1709. - The install action will install Office given the configuration in the data. The string data is the xml configuration to use in order to install Office. + The install action will install office given the configuration in the data. The string data is the xml configuration to use in order to install office. @@ -134,6 +136,27 @@ The XML below is for Windows 10, version 1709. + + FinalStatus + + + + + Final Office 365 installation status. + + + + + + + + + + + text/plain + + + CurrentStatus @@ -175,7 +198,7 @@ The XML below is for Windows 10, version 1709. - com.microsoft/1.3/MDM/Office + com.microsoft/1.5/MDM/Office @@ -261,6 +284,27 @@ The XML below is for Windows 10, version 1709. + + FinalStatus + + + + + Final Office 365 installation status. + + + + + + + + + + + text/plain + + + CurrentStatus @@ -287,13 +331,3 @@ The XML below is for Windows 10, version 1709. ``` - -  - -  - - - - - - diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index e95aba3fb5..1184e33d18 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/23/2018 +ms.date: 08/17/2018 --- # Policy CSP @@ -131,8 +131,6 @@ The following diagram shows the Policy configuration service provider in tree fo

    Supported operations are Add and Get. Does not support Delete. -> [!Note] -> The policies supported in Windows 10 S are the same as those supported in Windows 10 Pro with the exception of the policies under ApplicationDefaults. The ApplicationDefaults policies are not supported in Windows 10 S. ## Policies @@ -365,6 +363,15 @@ The following diagram shows the Policy configuration service provider in tree fo

    Authentication/AllowSecondaryAuthenticationDevice
    +
    + Authentication/EnableFastFirstSignIn +
    +
    + Authentication/EnableWebSignIn +
    +
    + Authentication/PreferredAadTenantDomainName +
    ### Autoplay policies @@ -552,9 +559,6 @@ The following diagram shows the Policy configuration service provider in tree fo
    Browser/FirstRunURL
    -
    - Browser/ForceEnabledExtensions -
    Browser/HomePages
    @@ -900,6 +904,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    DeliveryOptimization/DOAllowVPNPeerCaching
    +
    + DeliveryOptimization/DOCacheHost +
    DeliveryOptimization/DODelayBackgroundDownloadFromHttp
    @@ -979,6 +986,9 @@ The following diagram shows the Policy configuration service provider in tree fo ### DeviceGuard policies
    +
    + DeviceGuard/EnableSystemGuard +
    DeviceGuard/EnableVirtualizationBasedSecurity
    @@ -1247,7 +1257,7 @@ The following diagram shows the Policy configuration service provider in tree fo Experience/DoNotShowFeedbackNotifications
    - Experience/DoNotSyncBrowserSetting + Experience/DoNotSyncBrowserSettings
    Experience/PreventUsersFromTurningOnBrowserSyncing @@ -2050,6 +2060,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Kerberos/SetMaximumContextTokenSize
    +
    + Kerberos/UPNNameHints +
    ### KioskBrowser policies @@ -2455,6 +2468,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Privacy/DisableAdvertisingId
    +
    + Privacy/DisablePrivacyExperience +
    Privacy/EnableActivityFeed
    @@ -2903,6 +2919,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices
    +
    + Security/RecoveryEnvironmentAuthentication +
    Security/RequireDeviceEncryption
    @@ -3016,6 +3035,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Start/AllowPinnedFolderVideos
    +
    + Start/DisableContextMenus +
    Start/ForceStartSize
    @@ -3425,6 +3447,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Update/SetEDURestart
    +
    + Update/UpdateNotificationLevel +
    Update/UpdateServiceUrl
    @@ -4182,7 +4207,6 @@ The following diagram shows the Policy configuration service provider in tree fo - [Browser/DisableLockdownOfStartPages](./policy-csp-browser.md#browser-disablelockdownofstartpages) - [Browser/EnableExtendedBooksTelemetry](./policy-csp-browser.md#browser-enableextendedbookstelemetry) - [Browser/EnterpriseModeSiteList](./policy-csp-browser.md#browser-enterprisemodesitelist) -- [Browser/ForceEnabledExtensions](./policy-csp-browser.md#browser-forceenabledextensions) - [Browser/HomePages](./policy-csp-browser.md#browser-homepages) - [Browser/LockdownFavorites](./policy-csp-browser.md#browser-lockdownfavorites) - [Browser/PreventAccessToAboutFlagsInMicrosoftEdge](./policy-csp-browser.md#browser-preventaccesstoaboutflagsinmicrosoftedge) @@ -4262,6 +4286,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [Defender/ThreatSeverityDefaultAction](./policy-csp-defender.md#defender-threatseveritydefaultaction) - [DeliveryOptimization/DOAbsoluteMaxCacheSize](./policy-csp-deliveryoptimization.md#deliveryoptimization-doabsolutemaxcachesize) - [DeliveryOptimization/DOAllowVPNPeerCaching](./policy-csp-deliveryoptimization.md#deliveryoptimization-doallowvpnpeercaching) +- [DeliveryOptimization/DOCacheHost](./policy-csp-deliveryoptimization.md#deliveryoptimization-docachehost) - [DeliveryOptimization/DODelayBackgroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaybackgrounddownloadfromhttp) - [DeliveryOptimization/DODelayForegroundDownloadFromHttp](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodelayforegrounddownloadfromhttp) - [DeliveryOptimization/DODownloadMode](./policy-csp-deliveryoptimization.md#deliveryoptimization-dodownloadmode) @@ -4284,6 +4309,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [DeliveryOptimization/DOSetHoursToLimitBackgroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitbackgrounddownloadbandwidth) - [DeliveryOptimization/DOSetHoursToLimitForegroundDownloadBandwidth](./policy-csp-deliveryoptimization.md#deliveryoptimization-dosethourstolimitforegrounddownloadbandwidth) - [Desktop/PreventUserRedirectionOfProfileFolders](./policy-csp-desktop.md#desktop-preventuserredirectionofprofilefolders) +- [DeviceGuard/EnableSystemGuard](./policy-csp-deviceguard.md#deviceguard-enablesystemguard) - [DeviceGuard/EnableVirtualizationBasedSecurity](./policy-csp-deviceguard.md#deviceguard-enablevirtualizationbasedsecurity) - [DeviceGuard/LsaCfgFlags](./policy-csp-deviceguard.md#deviceguard-lsacfgflags) - [DeviceGuard/RequirePlatformSecurityFeatures](./policy-csp-deviceguard.md#deviceguard-requireplatformsecurityfeatures) @@ -4325,7 +4351,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [Experience/AllowWindowsTips](./policy-csp-experience.md#experience-allowwindowstips) - [Experience/ConfigureWindowsSpotlightOnLockScreen](./policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen) - [Experience/DoNotShowFeedbackNotifications](./policy-csp-experience.md#experience-donotshowfeedbacknotifications) -- [Experience/DoNotSyncBrowserSetting](./policy-csp-experience.md#experience-donotsyncbrowsersetting) +- [Experience/DoNotSyncBrowserSettings](./policy-csp-experience.md#experience-donotsyncbrowsersetting) - [Experience/PreventUsersFromTurningOnBrowserSyncing](./policy-csp-experience.md#experience-preventusersfromturningonbrowsersyncing) - [ExploitGuard/ExploitProtectionSettings](./policy-csp-exploitguard.md#exploitguard-exploitprotectionsettings) - [FileExplorer/TurnOffDataExecutionPreventionForExplorer](./policy-csp-fileexplorer.md#fileexplorer-turnoffdataexecutionpreventionforexplorer) @@ -4677,6 +4703,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [Privacy/AllowCrossDeviceClipboard](./policy-csp-privacy.md#privacy-allowcrossdeviceclipboard) - [Privacy/AllowInputPersonalization](./policy-csp-privacy.md#privacy-allowinputpersonalization) - [Privacy/DisableAdvertisingId](./policy-csp-privacy.md#privacy-disableadvertisingid) +- [Privacy/DisablePrivacyExperience](./policy-csp-privacy.md#privacy-disableprivacyexperience) - [Privacy/EnableActivityFeed](./policy-csp-privacy.md#privacy-enableactivityfeed) - [Privacy/LetAppsAccessAccountInfo](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo) - [Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps](./policy-csp-privacy.md#privacy-letappsaccessaccountinfo-forceallowtheseapps) @@ -4805,6 +4832,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [SmartScreen/EnableSmartScreenInShell](./policy-csp-smartscreen.md#smartscreen-enablesmartscreeninshell) - [SmartScreen/PreventOverrideForFilesInShell](./policy-csp-smartscreen.md#smartscreen-preventoverrideforfilesinshell) - [Speech/AllowSpeechModelUpdate](./policy-csp-speech.md#speech-allowspeechmodelupdate) +- [Start/DisableContextMenus](./policy-csp-start.md#start-disablecontextmenus) - [Start/HidePeopleBar](./policy-csp-start.md#start-hidepeoplebar) - [Start/HideRecentlyAddedApps](./policy-csp-start.md#start-hiderecentlyaddedapps) - [Start/StartLayout](./policy-csp-start.md#start-startlayout) @@ -4876,6 +4904,7 @@ The following diagram shows the Policy configuration service provider in tree fo - [Update/SetDisablePauseUXAccess](./policy-csp-update.md#update-setdisablepauseuxaccess) - [Update/SetDisableUXWUAccess](./policy-csp-update.md#update-setdisableuxwuaccess) - [Update/SetEDURestart](./policy-csp-update.md#update-setedurestart) +- [Update/UpdateNotificationLevel](./policy-csp-update.md#update-updatenotificationlevel) - [Update/UpdateServiceUrl](./policy-csp-update.md#update-updateserviceurl) - [Update/UpdateServiceUrlAlternate](./policy-csp-update.md#update-updateserviceurlalternate) - [UserRights/AccessCredentialManagerAsTrustedCaller](./policy-csp-userrights.md#userrights-accesscredentialmanagerastrustedcaller) diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 64e6764b0a..7b0ad06974 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 07/30/2018 --- # Policy CSP - Accounts @@ -248,9 +248,4 @@ Footnote: - -## Accounts policies supported by Windows Holographic for Business - -- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) - diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 39cb905194..1c06c38801 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/11/2018 +ms.date: 08/08/2018 --- # Policy CSP - ApplicationManagement @@ -353,9 +353,8 @@ The following list shows the supported values: -Specifies whether multiple users of the same app can share data. -Most restricted value is 0. +[!INCLUDE [allow-windows-app-to-share-data-users-shortdesc](../../../browsers/edge/shortdesc/allow-windows-app-to-share-data-users-shortdesc.md)] @@ -369,9 +368,10 @@ ADMX Info: The following list shows the supported values: -- 0 (default) – Not allowed. -- 1 – Allowed. +- 0 (default) – Prevented/not allowed, but Microsoft Edge downloads book files to a per-user folder for each user. +- 1 – Allowed. Microsoft Edge downloads book files into a shared folder. For this policy to work correctly, you must also enable the Allow a Windows app to share application data between users group policy. Also, the users must be signed in with a school or work account. +Most restricted value: 0 @@ -511,7 +511,7 @@ Value evaluation rule - The information for PolicyManager is opaque. There is no - + @@ -632,7 +632,7 @@ For this policy to work, the Windows apps need to declare in their manifest that - + @@ -695,7 +695,7 @@ This setting supports a range of values between 0 and 1. - + @@ -759,7 +759,7 @@ This setting supports a range of values between 0 and 1. - + @@ -1050,17 +1050,3 @@ Footnote: - -## ApplicationManagement policies supported by Windows Holographic for Business - -- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) - - - -## ApplicationManagement policies supported by IoT Core - -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) - - diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index ed8ae05a5c..d3d1e3c5a4 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 03/12/2018 +ms.date: 08/08/2018 --- # Policy CSP - AppVirtualization @@ -124,8 +124,8 @@ ms.date: 03/12/2018 - - + + @@ -182,8 +182,8 @@ ADMX Info: - - + + @@ -240,8 +240,8 @@ ADMX Info: - - + + @@ -298,8 +298,8 @@ ADMX Info: - - + + @@ -356,8 +356,8 @@ ADMX Info: - - + + @@ -414,8 +414,8 @@ ADMX Info: - - + + @@ -482,8 +482,8 @@ ADMX Info: - - + + @@ -540,8 +540,8 @@ ADMX Info: - - + + @@ -598,8 +598,8 @@ ADMX Info: - - + + @@ -656,8 +656,8 @@ ADMX Info: - - + + @@ -714,8 +714,8 @@ ADMX Info: - - + + @@ -772,8 +772,8 @@ ADMX Info: - - + + @@ -830,8 +830,8 @@ ADMX Info: - - + + @@ -906,8 +906,8 @@ ADMX Info: - - + + @@ -982,8 +982,8 @@ ADMX Info: - - + + @@ -1058,8 +1058,8 @@ ADMX Info: - - + + @@ -1134,8 +1134,8 @@ ADMX Info: - - + + @@ -1210,8 +1210,8 @@ ADMX Info: - - + + @@ -1268,8 +1268,8 @@ ADMX Info: - - + + @@ -1326,8 +1326,8 @@ ADMX Info: - - + + @@ -1384,8 +1384,8 @@ ADMX Info: - - + + @@ -1442,8 +1442,8 @@ ADMX Info: - - + + @@ -1500,8 +1500,8 @@ ADMX Info: - - + + @@ -1558,8 +1558,8 @@ ADMX Info: - - + + @@ -1616,8 +1616,8 @@ ADMX Info: - - + + @@ -1674,8 +1674,8 @@ ADMX Info: - - + + @@ -1732,8 +1732,8 @@ ADMX Info: - - + + @@ -1790,8 +1790,8 @@ ADMX Info: - - + + diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 1b134ed0ff..7578533727 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -6,11 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 07/30/2018 --- # Policy CSP - Authentication +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
    @@ -34,6 +36,15 @@ ms.date: 05/14/2018
    Authentication/AllowSecondaryAuthenticationDevice
    +
    + Authentication/EnableFastFirstSignIn +
    +
    + Authentication/EnableWebSignIn +
    +
    + Authentication/PreferredAadTenantDomainName +
    @@ -302,6 +313,182 @@ The following list shows the supported values: + +
    + + +**Authentication/EnableFastFirstSignIn** + + +
    [AssignedAccess CSP](assignedaccess-csp.md)

    Added the following note:

    +
      +
    • You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
      • +
    +
    [PassportForWork CSP](passportforwork-csp.md)

    Added new settings in Windows 10, next major version.
    [Wifi CSP](wifi-csp.md)

    Added a new node WifiCost.

    +

    Added a new node WifiCost in Windows 10, next major version.

    [Diagnose MDM failures in Windows 10](diagnose-mdm-failures-in-windows-10.md)
    [Bitlocker CSP](bitlocker-csp.md)

    Added new node AllowStandardUserEncryption.

    +

    Added new node AllowStandardUserEncryption in Windows 10, next major version.

    [Policy CSP](policy-configuration-service-provider.md)
    cross mark cross markcheck mark1cross mark check mark1 check mark1 cross mark
    cross mark check mark4check mark4cross mark check mark4 check mark4 cross mark
    cross mark check mark4check mark4cross mark check mark4 check mark4 cross mark
    cross mark cross markcheck markcross mark check mark check mark check mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    cross markcheck markcheck markcross markcross mark check mark check mark cross mark
    + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy is intended for use on Shared PCs to enable a quick first sign-in experience for a user. It works by automatically connecting new non-admin Azure Active Directory (Azure AD) accounts to the pre-configured candidate local accounts. + +Value type is integer. Supported values: + +- 0 - (default) The feature defaults to the existing SKU and device capabilities. +- 1 - Enabled. Auto connect new non-admin AZure AD accounts to pre-configured candidate local accounts +- 2 - Disabled. Do not auto connect new non-admin Azure AD accounts to pre-configured local accounts + + + + + + + + + + + + + +
    + + +**Authentication/EnableWebSignIn** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +"Web Sign-in" is a new way of signing into a Windows PC. It enables Windows logon support for non-ADFS federated providers (e.g. SAML). + +> [!Note] +> Web Sign-in is only supported on Azure AD Joined PCs. + +Value type is integer. Supported values: + +- 0 - (default) The feature defaults to the existing SKU and device capabilities. +- 1 - Enabled. Web Credential Provider will be enabled for Sign In +- 2 - Disabled. Web Credential Provider will not be enabled for Sign In + + + + + + + + + + + + + +
    + + +**Authentication/PreferredAadTenantDomainName** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Specifies the preferred domain among available domains in the Azure AD tenant. + +Example: If your organization is using the "@contoso.com" tenant domain name, the policy value should be "contoso.com". For the user "abby@constoso.com", she would then be able to sign in using "abby" in the username field instead of "abby@contoso.com". + + +Value type is string. + + + + + + + + + + + +
    Footnote: @@ -310,18 +497,6 @@ Footnote: - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in the next major release of Windows 10. - - -## Authentication policies supported by Windows Holographic for Business - -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) - - - -## Authentication policies supported by IoT Core - -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) - - diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index 1fb3b009d6..592beedb9a 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 08/08/2018 --- # Policy CSP - Bluetooth @@ -219,7 +219,7 @@ The following list shows the supported values: check mark4 check mark4 check mark4 - cross mark + check mark4 cross mark cross mark @@ -439,30 +439,4 @@ Footnote: * The Surface pen uses the HID over GATT profile {00001105-0000-1000-8000-00805F9B34FB};{00000008-0000-1000-8000-00805F9B34FB};{0000111E-0000-1000-8000-00805F9B34FB};{00001800-0000-1000-8000-00805F9B34FB};{0000180A-0000-1000-8000-00805F9B34FB};{00001813-0000-1000-8000-00805F9B34FB} - -## Bluetooth policies supported by Windows Holographic for Business - -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) - - - -## Bluetooth policies supported by IoT Core - -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) -- [Bluetooth/ServicesAllowedList](#bluetooth-servicesallowedlist) - - - -## Bluetooth policies supported by Microsoft Surface Hub - -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/AllowPrepairing](#bluetooth-allowprepairing) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) -- [Bluetooth/ServicesAllowedList](#bluetooth-servicesallowedlist) - diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index cbc9d1bf0b..efc80528fb 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.technology: windows author: shortpatti ms.author: pashort -ms.date: 07/18/2018 +ms.date: 08/08/2018 --- # Policy CSP - Browser @@ -135,9 +135,6 @@ ms.date: 07/18/2018
    Browser/FirstRunURL
    -
    - Browser/ForceEnabledExtensions -
    Browser/HomePages
    @@ -428,7 +425,16 @@ Most restricted value: 0 [!INCLUDE [allow-configuration-updates-for-books-library-shortdesc](../../../browsers/edge/shortdesc/allow-configuration-updates-for-books-library-shortdesc.md)] + + +ADMX Info: +- GP English name: *Allow configuration updates for the Books Library* +- GP name: *AllowConfigurationUpdateForBooksLibrary* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + Supported values: @@ -479,9 +485,6 @@ Supported values: [!INCLUDE [configure-cookies-shortdesc](../../../browsers/edge/shortdesc/configure-cookies-shortdesc.md)] - - - ADMX Info: @@ -507,7 +510,7 @@ To verify AllowCookies is set to 0 (not allowed): 1. Open Microsoft Edge or Microsoft Edge for Windows 10 Mobile. 2. In the upper-right corner of the browser, click **…**. 3. Click **Settings** in the drop down list, and select **View Advanced Settings**. -4. Verify the setting **Cookies** is greyed out. +4. Verify the setting **Cookies** is disabled. @@ -700,8 +703,8 @@ ADMX Info: Supported values: -- 0 – Prevented/not allowed. -- 1 (default) – Allowed. +- 0 – Prevented/not allowed +- 1 (default) – Allowed @@ -761,8 +764,8 @@ ADMX Info: Supported values: -- 0 – Prevented/not allowed. -- 1 (default) – Allowed. +- 0 – Prevented/not allowed +- 1 (default) – Allowed @@ -806,7 +809,7 @@ Supported values: ->*Supported versions: Microsoft Edge on Windows 10, version 1703* +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later* [!INCLUDE [configure-adobe-flash-click-to-run-setting-shortdesc](../../../browsers/edge/shortdesc/configure-adobe-flash-click-to-run-setting-shortdesc.md)] @@ -824,9 +827,10 @@ ADMX Info: Supported values: - 0 – Load and run Adobe Flash content automatically. -- 1 (default) – Do not load or run Adobe Flash content automatically. Requires user action. +- 1 (default) – Does not load or run Adobe Flash content automatically. Requires action from the user. Most restricted value: 1 + @@ -885,10 +889,12 @@ ADMX Info: Supported values: + - 0 - Prevented/not allowed - 1 (default) - Allowed Most restricted value: 0 + @@ -915,7 +921,7 @@ Most restricted value: 0 Mobile Enterprise - check mark + cross mark check mark check mark check mark @@ -939,8 +945,6 @@ Most restricted value: 0 [!INCLUDE [allow-inprivate-browsing-shortdesc](../../../browsers/edge/shortdesc/allow-inprivate-browsing-shortdesc.md)] -Most restricted value: 0 - ADMX Info: @@ -956,6 +960,8 @@ Supported values: - 0 – Prevented/not allowed - 1 (default) – Allowed +Most restricted value: 0 + @@ -998,12 +1004,11 @@ Supported values: ->*Supported versions: Microsoft Edge on Windows 10, version 1703* +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later* [!INCLUDE [allow-microsoft-compatibility-list-shortdesc](../../../browsers/edge/shortdesc/allow-microsoft-compatibility-list-shortdesc.md)] -Most restricted value: 0 @@ -1020,6 +1025,8 @@ Supported values: - 0 – Prevented/not allowed - 1 (default) – Allowed +Most restricted value: 0 + @@ -1077,7 +1084,7 @@ ADMX Info: Supported values: -- Blank - Users can shoose to save and manage passwords locally. +- Blank - Users can choose to save and manage passwords locally. - 0 – Not allowed. - 1 (default) – Allowed. @@ -1087,10 +1094,8 @@ Most restricted value: 0 To verify AllowPasswordManager is set to 0 (not allowed): -1. Open Microsoft Edge or Microsoft Edge for Windows 10 Mobile. -2. In the upper-right corner of the browser, click **…**. -3. Click **Settings** in the drop down list, and select **View Advanced Settings**. -4. Verify the settings **Offer to save password** and **Manage my saved passwords** are greyed out. +1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. +2. Verify the settings **Save Password** is disabled. @@ -1154,14 +1159,13 @@ Supported values: - 1 – Turn on Pop-up Blocker stopping pop-up windows from opening. Most restricted value: 1 + To verify AllowPopups is set to 0 (not allowed): -1. Open Microsoft Edge. -2. In the upper-right corner of the browser, click **…**. -3. Click **Settings** in the drop down list, and select **View Advanced Settings**. -4. Verify the setting **Block pop-ups** is greyed out. +1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. +2. Verify the setting **Block pop-ups** is disabled. @@ -1222,10 +1226,12 @@ ADMX Info: Supported values: + - 0 - Prevented/not allowed - 1 (default) - Allowed Most restricted value: 0 + @@ -1290,10 +1296,12 @@ ADMX Info: Supported values: + - 0 - Prevented/not allowed - 1 (default) - Allowed Most restricted value: 0 + @@ -1358,10 +1366,12 @@ ADMX Info: Supported values: + - 0 - Prevented/not allowed - 1 (default) - Allowed Most restricted value: 0 + @@ -1411,7 +1421,7 @@ Most restricted value: 0 ->*Supported versions: Microsoft Edge on Windows 10, version 1703* +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later* [!INCLUDE [allow-search-engine-customization-shortdesc](../../../browsers/edge/shortdesc/allow-search-engine-customization-shortdesc.md)] @@ -1496,6 +1506,7 @@ Supported values: - 1 – Allowed. Show the search suggestions. Most restricted value: 0 + @@ -1546,7 +1557,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Allow Sideloading of extension* +- GP English name: *Allow sideloading of Extensions* - GP name: *AllowSideloadingOfExtensions* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1555,10 +1566,11 @@ ADMX Info: Supported values: -- 0 - Prevented, but does not prevent sideloading of extensions using Add-AppxPackage via PowerShell. To prevent this, set the **ApplicationManagement/AllowDeveloperUnlock** policy to 1 (enabled). +- 0 - Prevented/not allowed. Disabling does not prevent sideloading of extensions using Add-AppxPackage via PowerShell. To prevent this, set the **ApplicationManagement/AllowDeveloperUnlock** policy to 1 (enabled). - 1 (default) - Allowed. Most restricted value: 0 + @@ -1621,19 +1633,18 @@ ADMX Info: Supported values: -- Blank - Users can choose to use Windows Defender SmartScreen or not. +- Blank - Users can choose to use Windows Defender SmartScreen. - 0 – Turned off. Do not protect users from potential threats and prevent users from turning it on. - 1 (default) – Turned on. Protect users from potential threats and prevent users from turning it off. Most restricted value: 1 + To verify AllowSmartScreen is set to 0 (not allowed): -1. Open Microsoft Edge or Microsoft Edge for Windows 10 Mobile. -2. In the upper-right corner of the browser, click **…**. -3. Click **Settings** in the drop down list, and select **View Advanced Settings**. -4. Verify the setting **Help protect me from malicious sites and download with SmartScreen Filter** is greyed out. +1. Click or tap **More** (…) and select **Settings** > **View Advanced settings**. +2. Verify the setting **Help protect me from malicious sites and download with SmartScreen Filter** is disabled. @@ -1694,8 +1705,8 @@ ADMX Info: Supported values: -- 0 (default) - Allowed. Preload Start and New tab pages. -- 1 - Prevented/not allowed. +- 0 - Prevented/not allowed. +- 1 (default) - Allowed. Preload Start and New tab pages. Most restricted value: 1 @@ -1750,6 +1761,7 @@ Most restricted value: 1 [!INCLUDE [allow-web-content-on-new-tab-page-shortdesc](../../../browsers/edge/shortdesc/allow-web-content-on-new-tab-page-shortdesc.md)] + ADMX Info: @@ -1835,6 +1847,7 @@ Supported values: - 1 - Show the Books Library, regardless of the device’s country or region. Most restricted value: 0 + @@ -1877,7 +1890,7 @@ Most restricted value: 0 ->*Supported versions: Microsoft Edge on Windows 10, next major update to Windows* +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later* [!INCLUDE [allow-clearing-browsing-data-on-exit-shortdesc](../../../browsers/edge/shortdesc/allow-clearing-browsing-data-on-exit-shortdesc.md)] @@ -1897,6 +1910,7 @@ Supported values: - 1 – Allowed. Clear the browsing data upon exit automatically. Most restricted value: 1 + To verify that browsing data is cleared on exit (ClearBrowsingDataOnExit is set to 1): @@ -1948,12 +1962,12 @@ To verify that browsing data is cleared on exit (ClearBrowsingDataOnExit is set ->*Supported versions: Microsoft Edge on Windows 10, version 1703* +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later* [!INCLUDE [configure-additional-search-engines-shortdesc](../../../browsers/edge/shortdesc/configure-additional-search-engines-shortdesc.md)] > [!IMPORTANT] -> Due to Protected Settings (aka.ms/browserpolicy), this setting will apply only on domain-joined machines or when the device is MDM-enrolled.  +> Due to Protected Settings (aka.ms/browserpolicy), this setting applies only on domain-joined machines or when the device is MDM-enrolled.  @@ -2109,7 +2123,7 @@ Supported values: - 3 - Hide home button. >[!TIP] ->If you want to make changes to this policy:
    1. Set the **Unlock Home Button** policy to 1 (enabled).
    2. Make changes to the **Configure Home Button** policy or **Set Home Button URL** policy.
    3. Set the **Unlock Home Button** policy to 0 (disabled).
    +>If you want to make changes to this policy:
    1. Set **UnlockHomeButton** to 1 (enabled).
    2. Make changes to **ConfigureHomeButton** or **SetHomeButtonURL** policy.
    3. Set **UnlockHomeButton** 0 (disabled).
    @@ -2182,13 +2196,14 @@ ADMX Info: Supported values: -**0 (Default or not configured)**: +**0 (Default or not configured)**: - If it’s a single app, it runs InPrivate full screen for digital signage or interactive displays. - If it’s one of many apps, Microsoft Edge runs as normal. -**1**: +**1**: - • If it’s a single app, it runs a limited multi-tab version of InPrivate and is the only app available for public browsing. Users can’t minimize, close, or open windows or customize Microsoft Edge, but can clear browsing data and downloads and restart by clicking “End session.” You can configure Microsoft Edge to restart after a period of inactivity by using the “Configure kiosk reset after idle timeout” policy. _**For single-app public browsing:**_ If you do not configure the Configure kiosk reset after idle timeout policy and you enable this policy, Microsoft Edge kiosk resets after 5 minutes of idle time. - If it’s one of many apps, it runs in a limited multi-tab version of InPrivate for public browsing with other apps. Users can minimize, close, and open multiple InPrivate windows, but they can’t customize Microsoft Edge. + @@ -2242,7 +2257,7 @@ Supported values: [!INCLUDE [configure-kiosk-reset-after-idle-timeout-shortdesc](../../../browsers/edge/shortdesc/configure-kiosk-reset-after-idle-timeout-shortdesc.md)] -You must set the Configure kiosk mode policy to enabled (1 - InPrivate public browsing) and configure Microsoft Edge as a single-app in assigned access for this policy to take effect; otherwise, Microsoft Edge ignores this setting. To learn more about assigned access and kiosk configuration, see [Configure kiosk and shared devices running Windows desktop editions](https://docs.microsoft.com/en-us/windows/configuration/kiosk-shared-pc). +You must set ConfigureKioskMode to enabled (1 - InPrivate public browsing) and configure Microsoft Edge as a single-app in assigned access for this policy to take effect; otherwise, Microsoft Edge ignores this setting. To learn more about assigned access and kiosk configuration, see [Configure kiosk and shared devices running Windows desktop editions](https://docs.microsoft.com/en-us/windows/configuration/kiosk-shared-pc). @@ -2256,9 +2271,11 @@ ADMX Info: Supported values: + - **Any integer from 1-1440 (5 minutes is the default)** – The time in minutes from the last user activity before Microsoft Edge kiosk mode resets to the default kiosk configuration. A confirmation dialog displays for the user to cancel or continue and automatically continues after 30 seconds. - **0** – No idle timer. + @@ -2316,8 +2333,8 @@ Supported values: If you don't want to send traffic to Microsoft, use the \ value, which honors both domain and non domain-joined devices when it's the only configured URL. -**Version 1810**:
    -When you enable this policy and select an option, and also enable the Configure Start Pages policy, Microsoft Edge ignores the Configure Start Page policy. +**Next major version**:
    +When you enable this policy and select an option, and also enter the URLs of the pages you want in HomePages, Microsoft Edge ignores HomePages. @@ -2332,14 +2349,14 @@ ADMX Info: Supported values: -- Blank - If you don't configure this policy and you enable the Disable Lockdown of Start Pages policy, users can change or customize the Start page. +- Blank - If you don't configure this policy and you set DisableLockdownOfStartPages to 1 (enabled), users can change or customize the Start page. - 0 - Load the Start page. - 1 - Load the New tab page. - 2 - Load the previous pages. - 3 (default) - Load a specific page or pages. >[!TIP] ->If you want to make changes to this policy:
    1. Set the Disabled Lockdown of Start Pages policy to 0 (not configured).
    2. Make changes to the Configure Open Microsoft With policy.
    3. Set the Disabled Lockdown of Start Pages policy to 1 (enabled).
    +>If you want to make changes to this policy:
    1. Set DisableLockdownOfStartPages to 0 (not configured).
    2. Make changes to ConfigureOpenEdgeWith.
    3. Set DisableLockdownOfStartPages to 1 (enabled).
    @@ -2462,7 +2479,7 @@ Most restricted value: 0 ->*Supported versions: Microsoft Edge on Windows 10, version 1703* +>*Supported versions: Microsoft Edge on Windows 10* [!INCLUDE [disable-lockdown-of-start-pages-shortdesc](../../../browsers/edge/shortdesc/disable-lockdown-of-start-pages-shortdesc.md)]    @@ -2486,8 +2503,8 @@ ADMX Info: Supported values: -- 0 – Locked. Lockdown the Start pages configured in either the Configure Open Microsoft Edge With policy or Configure Start Pages policy.  -- 1 (default) – Unlocked. Users can make changes to all configured start pages.

    When you enable this policy and define a set of URLs in the Configure Start Pages policy, Microsoft Edge uses the URLs defined in the Configure Open Microsoft Edge With policy. +- 0 – Lock down Start pages configured in either the ConfigureOpenEdgeWith policy and HomePages policy. +- 1 (default) – Unlocked. Users can make changes to all configured start pages.

    When you enable this policy and define a set of URLs in the HomePages policy, Microsoft Edge uses the URLs defined in the ConfigureOpenEdgeWith policy. Most restricted value: 0 @@ -2547,8 +2564,8 @@ ADMX Info: Supported values: -- 0 (default) - Gather and send only basic diagnotic data, depending on the device configuration. -- 1 - Gather both basic and additional data, such as usage data. +- 0 (default) - Gather and send only basic diagnostic data, depending on the device configuration. +- 1 - Gather all diagnostic data. Most restricted value: 0 @@ -2601,7 +2618,6 @@ Most restricted value: 0   - ADMX Info: @@ -2616,7 +2632,8 @@ ADMX Info: Supported values: - 0 (default) - Turned off. Microsoft Edge does not check the Enterprise Mode Site List, and in this case, users might experience problems while using legacy apps. -- Turned on. Microsoft Edge checks the Enterprise Mode Site List if configured. If an XML file exists in the cache container, IE11 waits 65 seconds and then checks the local cache for a new version from the server. If the server has a different version, Microsoft Edge uses the server file and stores it in the cache container. If you already use a site list, Enterprise Mode continues to work during the 65 second, but uses the existing file. To add the location to your site list, enter it in the {URI} box. +- Turned on. Microsoft Edge checks the Enterprise Mode Site List if configured. If an XML file exists in the cache container, IE11 waits 65 seconds and then checks the local cache for a new version from the server. If the server has a different version, Microsoft Edge uses the server file and stores it in the cache container. If you already use a site list, Enterprise Mode continues to work during the 65 second, but uses the existing file. To add the location to your site list, enter it in the {URI} box.

    For details on how to configure the Enterprise Mode Site List, see [Interoperability and enterprise guidance](https://docs.microsoft.com/en-us/microsoft-edge/deploy/group-policies/interoperability-enterprise-guidance-gp). + @@ -2638,7 +2655,7 @@ Supported values: Mobile Enterprise - check mark + cross mark check mark check mark check mark @@ -2661,7 +2678,7 @@ Supported values: > [!IMPORTANT] -> We discontinued this policy in Windows 10, version 1511. Use the [Browser/EnterpriseModeSiteList](#browser-enterprisemodesitelist) policy instead. +> Discontinued in Windows 10, version 1511. Use the [Browser/EnterpriseModeSiteList](#browser-enterprisemodesitelist) policy instead. @@ -2710,73 +2727,11 @@ Supported values: Enter a URL in string format for the site you want to load when Microsoft Edge for Windows 10 Mobile opens for the first time, for example, contoso.com. -Data type = String -

    - -**Browser/ForceEnabledExtensions** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark5check mark5check mark5check mark5
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User -> * Device - -
    - - - -This setting lets you decide which extensions should be always enabled. - - - -ADMX Info: -- GP name: *ForceEnabledExtensions* -- GP element: *ForceEnabledExtensions_List* -- GP ADMX file name: *MicrosoftEdge.admx* - - - - - - - - - - - - - -
    - **Browser/HomePages** @@ -2932,7 +2887,7 @@ Most restricted value: 1 Mobile Enterprise - check mark + cross mark check mark check mark check mark @@ -2955,7 +2910,7 @@ Most restricted value: 1 -[!INCLUDE [prevent-changes-to-favorites-shortdesc](../../../browsers/edge/shortdesc/prevent-changes-to-favorites-shortdesc.md)] +[!INCLUDE [prevent-access-to-about-flags-page-shortdesc](../../../browsers/edge/shortdesc/prevent-access-to-about-flags-page-shortdesc.md)] @@ -2970,7 +2925,7 @@ ADMX Info: Supported values: - 0 (default) – Allowed. -- 1 – Prevented/not allowed. Users cannot access the about:flags page. +- 1 – Prevents users from accessing the about:flags page. Most restricted value: 1 @@ -3099,7 +3054,7 @@ ADMX Info: Supported values: -- 0 (default) – Allowed. Microsoft Edge loads the First Run webpage. +- 0 (default) – Allowed. Load the First Run webpage. - 1 – Prevented/not allowed. Most restricted value: 1 @@ -3145,7 +3100,7 @@ Most restricted value: 1 ->*Supported versions: Microsoft Edge on Windows 10, version 1703* +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later* [!INCLUDE [prevent-edge-from-gathering-live-tile-info-shortdesc](../../../browsers/edge/shortdesc/prevent-edge-from-gathering-live-tile-info-shortdesc.md)] @@ -3161,7 +3116,7 @@ ADMX Info: Supported values: -- 0 (default) – Collect and send Live Tile metadata to Microsoft. +- 0 (default) – Collect and send Live Tile metadata. - 1 – No data collected. Most restricted value: 1 @@ -3291,6 +3246,73 @@ Most restricted value: 1
    + +**Browser/PreventTurningOffRequiredExtensions** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
    + + + +[!INCLUDE [prevent-turning-off-required-extensions-shortdesc](../../../browsers/edge/shortdesc/prevent-turning-off-required-extensions-shortdesc.md)] + + + +ADMX Info: +- GP English name: *Prevent turning off required extensions* +- GP name: *PreventTurningOffRequiredExtensions* +- GP element: *PreventTurningOffRequiredExtensions_Prompt* +- GP path: *Windows Components/Microsoft Edge* +- GP ADMX file name: *MicrosoftEdge.admx* + + + +Supported values: + +- Blank (default) - Allowed. Users can uninstall extensions. If you previously enabled this policy and you decide to disable it, the list of extension PFNs defined in this policy get ignored. + +- String - Provide a semi-colon delimited list of extension PFNs. For example, adding the following OneNote Web Clipper and Office Online extension prevents users from turning it off:

          _Microsoft.OneNoteWebClipper8wekyb3d8bbwe;Microsoft.OfficeOnline8wekyb3d8bbwe_

    After defining the list of extensions, you deploy them through any available enterprise deployment channel, such as Microsoft Intune.

    Removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. + + + + + + + + + + +

    + **Browser/PreventUsingLocalHostIPAddressForWebRTC** @@ -3391,9 +3413,9 @@ Most restricted value: 1 ->*Supported versions: Microsoft Edge on Windows 10, version 1709* +>*Supported versions: Microsoft Edge on Windows 10, version 1709 or later* -[!INCLUDE [prevent-using-localhost-ip-address-for-webrtc-shortdesc](../../../browsers/edge/shortdesc/prevent-using-localhost-ip-address-for-webrtc-shortdesc.md)] +[!INCLUDE [provision-favorites-shortdesc](../../../browsers/edge/shortdesc/provision-favorites-shortdesc.md)]   Define a default list of favorites in Microsoft Edge. In this case, the Save a Favorite, Import settings, and context menu options (such as Create a new folder) are turned off. @@ -3401,14 +3423,14 @@ Define a default list of favorites in Microsoft Edge. In this case, the Save a F To define a default list of favorites: 1. In the upper-right corner of Microsoft Edge, click the ellipses (**...**) and select **Settings**. 2. Click **Import from another browser**, click **Export to file** and save the file. -3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision.

    Specify the URL as:

    • HTTP location: "SiteList"="http://localhost:8080/URLs.html"
    • Local network: "SiteList"="\\network\\shares\\URLs.html"
    • Local file: "SiteList"="file:///c:\\Users\\\\Documents\\URLs.html"
    +3. In the **Options** section of the Group Policy Editor, provide the location that points the file with the list of favorites to provision.

    Specify the URL as:

    • HTTP location: "SiteList"=http://localhost:8080/URLs.html
    • Local network: "SiteList"="\network\shares\URLs.html"
    • Local file: "SiteList"=file:///c:/Users/Documents/URLs.html
    -> [!Important] -> Enable only this policy or the Keep favorites in sync between Internet Explorer and Microsoft Edge policy. If you enable both, Microsoft Edge prevents users from syncing their favorites between the two browsers. +>[!IMPORTANT] +>Enable only this policy or the Keep favorites in sync between Internet Explorer and Microsoft Edge policy. If you enable both, Microsoft Edge prevents users from syncing their favorites between the two browsers. + -Data type = string @@ -3420,6 +3442,7 @@ ADMX Info: - GP ADMX file name: *MicrosoftEdge.admx* +
    @@ -3481,9 +3504,10 @@ ADMX Info: Supported values: - 0 (default) - All sites, including intranet sites, open in Microsoft Edge automatically. -- 1 - Only intranet sites open in Internet Explorer 11 automatically. Enabling this policy opens all intranet sites in IE11 automatically, even if the users have Microsoft Edge as their default browser. +- 1 - Only intranet sites open in Internet Explorer 11 automatically.

    Enabling this policy automatically opens all intranet sites in IE11, even if the users have Microsoft Edge as their default browser.

    1. In Group Policy Editor, navigate to:

      **Computer Configuration\\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** and click **Enable**.

    2. Refresh the policy and then view the affected sites in Microsoft Edge.

      A message displays saying that the page needs to open in IE. At the same time, the page opens in IE11 automatically; in a new frame if it is not yet running, or in a new tab.

    Most restricted value: 0 + @@ -3549,7 +3573,7 @@ ADMX Info: Supported values: -- Blank (default) - Microsoft Edge uses the default search engine specified in App settings. If you don't configure this policy and disable the AllowSearchEngineCustomization policy, users cannot make changes. +- Blank (default) - Microsoft Edge uses the default search engine specified in App settings. If you don't configure this policy and disable the [AllowSearchEngineCustomization](https://review.docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-browser?branch=microsoft-edge-preview#browser-allowsearchenginecustomization) policy, users cannot make changes. - 0 - Microsoft Edge removes the policy-set search engine and uses the Microsoft Edge specified engine for the market. - 1 - Microsoft Edge uses the policy-set search engine specified in the OpenSearch XML file. Users cannot change the default search engine.

    Specify a link to the OpenSearch XML file that contains, at a minimum, the short name and the URL template (HTTPS) of the search engine. For more information about creating the OpenSearch XML file, see [Search provider discovery](https://docs.microsoft.com/en-us/microsoft-edge/dev-guide/browser/search-provider-discovery). Use this format to specify the link you want to add.

    If you want users to use the default Microsoft Edge settings for each market, set the string to **EDGEDEFAULT**.

    If you want users to use Microsoft Bing as the default search engine, then set the string to **EDGEBING**. @@ -3711,7 +3735,7 @@ Supported values: Mobile Enterprise - check mark + cross mark check mark check mark check mark @@ -3798,7 +3822,7 @@ Most restricted value: 0 ->*Supported versions: Microsoft Edge on Windows 10, version 1703* +>*Supported versions: Microsoft Edge on Windows 10, version 1703 or later* [!INCLUDE [keep-favorites-in-sync-between-ie-and-edge-shortdesc](../../../browsers/edge/shortdesc/keep-favorites-in-sync-between-ie-and-edge-shortdesc.md)] @@ -3890,7 +3914,7 @@ ADMX Info: Supported values: -- 0 (default) - Lock down the home button to prevent users from making changes to the settings. +- 0 (default) - Lock down and prevent users from making changes to the settings. - 1 - Let users make changes. @@ -3957,7 +3981,7 @@ ADMX Info: Supported values: - 0 - Prevented/not allowed, but Microsoft Edge downloads book files to a per-user folder for each user. -- 1 - Allowed. Microsoft Edge downloads book files into a shared folder. +- 1 - Allowed. Microsoft Edge downloads book files to a shared folder. For this policy to work correctly, you must also enable the Allow a Windows app to share application data between users group policy. Also, the users must be signed in with a school or work account. Most restricted value: 0 @@ -3974,57 +3998,3 @@ Footnote: - -## Browser policies that can be set using Exchange Active Sync (EAS) - -- [Browser/AllowBrowser](#browser-allowbrowser) - - - -## Browser policies supported by Windows Holographic for Business - -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) - - - -## Browser policies supported by IoT Core - -- [Browser/AllowAutofill](#browser-allowautofill) -- [Browser/AllowBrowser](#browser-allowbrowser) -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowInPrivate](#browser-allowinprivate) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/EnterpriseModeSiteList](#browser-enterprisemodesitelist) -- [Browser/EnterpriseSiteListServiceUrl](#browser-enterprisesitelistserviceurl) -- [Browser/SendIntranetTraffictoInternetExplorer](#browser-sendintranettraffictointernetexplorer) - - - -## Browser policies supported by Microsoft Surface Hub - -- [Browser/AllowAddressBarDropdown](#browser-allowaddressbardropdown) -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDeveloperTools](#browser-allowdevelopertools) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowMicrosoftCompatibilityList](#browser-allowmicrosoftcompatibilitylist) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) -- [Browser/ClearBrowsingDataOnExit](#browser-clearbrowsingdataonexit) -- [Browser/ConfigureAdditionalSearchEngines](#browser-configureadditionalsearchengines) -- [Browser/DisableLockdownOfStartPages](#browser-disablelockdownofstartpages) -- [Browser/HomePages](#browser-homepages) -- [Browser/PreventLiveTileDataCollection](#browser-preventlivetiledatacollection) -- [Browser/PreventSmartScreenPromptOverride](#browser-preventsmartscreenpromptoverride) -- [Browser/PreventSmartScreenPromptOverrideForFiles](#browser-preventsmartscreenpromptoverrideforfiles) -- [Browser/SetDefaultSearchEngine](#browser-setdefaultsearchengine) - - diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index b44471df4c..0712d689ac 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 04/16/2018 +ms.date: 08/08/2018 --- # Policy CSP - Cellular @@ -54,7 +54,7 @@ ms.date: 04/16/2018 Mobile Enterprise - check mark3 + cross mark check mark3 check mark3 check mark3 @@ -126,7 +126,7 @@ The following list shows the supported values: Mobile Enterprise - check mark3 + cross mark check mark3 check mark3 check mark3 @@ -178,7 +178,7 @@ ADMX Info: Mobile Enterprise - check mark3 + cross mark check mark3 check mark3 check mark3 @@ -230,7 +230,7 @@ ADMX Info: Mobile Enterprise - check mark3 + cross mark check mark3 check mark3 check mark3 diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 26bd1f5d3e..0806fb596a 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 07/30/2018 --- # Policy CSP - Connectivity @@ -142,11 +142,11 @@ The following list shows the supported values: Mobile Enterprise - cross mark cross mark check mark - cross mark - cross mark + check mark + check mark + check mark check mark check mark @@ -264,7 +264,7 @@ To validate on mobile devices, do the following: Mobile Enterprise - check mark2 + check mark check mark2 check mark2 check mark2 @@ -972,40 +972,5 @@ Footnote: - -## Connectivity policies that can be set using Exchange Active Sync (EAS) -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowCellularDataRoaming](#connectivity-allowcellulardataroaming) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) - - - -## Connectivity policies supported by Windows Holographic for Business - -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) - - - -## Connectivity policies supported by IoT Core - -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowCellularDataRoaming](#connectivity-allowcellulardataroaming) -- [Connectivity/AllowNFC](#connectivity-allownfc) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) -- [Connectivity/AllowVPNOverCellular](#connectivity-allowvpnovercellular) -- [Connectivity/AllowVPNRoamingOverCellular](#connectivity-allowvpnroamingovercellular) -- [Connectivity/DiablePrintingOverHTTP](#connectivity-diableprintingoverhttp) -- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](#connectivity-disabledownloadingofprintdriversoverhttp) -- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) -- [Connectivity/HardenedUNCPaths](#connectivity-hardeneduncpaths) -- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](#connectivity-prohibitinstallationandconfigurationofnetworkbridge) - - - -## Connectivity policies supported by Microsoft Surface Hub - -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowConnectedDevices](#connectivity-allowconnecteddevices) - diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index dd2367d211..78c970b208 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/03/2018 +ms.date: 08/08/2018 --- # Policy CSP - Defender @@ -955,8 +955,8 @@ The following list shows the supported values: Mobile Enterprise - cross mark - cross mark + check mark3 + check mark3 check mark3 check mark3 check mark3 @@ -1013,8 +1013,8 @@ ADMX Info: Mobile Enterprise - cross mark - cross mark + check mark3 + check mark3 check mark3 check mark3 check mark3 @@ -1208,7 +1208,7 @@ ADMX Info: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -1280,7 +1280,7 @@ The following list shows the supported values: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -1342,7 +1342,7 @@ ADMX Info: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -1397,7 +1397,7 @@ ADMX Info: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -1655,7 +1655,7 @@ ADMX Info: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -1788,7 +1788,7 @@ ADMX Info: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 104c932ccf..7c7ed13b63 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -6,11 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 07/06/2018 --- # Policy CSP - DeliveryOptimization +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

    @@ -25,6 +27,9 @@ ms.date: 05/14/2018
    DeliveryOptimization/DOAllowVPNPeerCaching
    +
    + DeliveryOptimization/DOCacheHost +
    DeliveryOptimization/DODelayBackgroundDownloadFromHttp
    @@ -217,6 +222,67 @@ The following list shows the supported values:
    + +**DeliveryOptimization/DOCacheHost** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +[Reserved for future use] + + + +ADMX Info: +- GP English name: *[Reserved for future use] Cache Server Hostname* +- GP name: *CacheHost* +- GP element: *CacheHost* +- GP path: *Windows Components/Delivery Optimization* +- GP ADMX file name: *DeliveryOptimization.admx* + + + + + + + + + + + + + +
    + **DeliveryOptimization/DODelayBackgroundDownloadFromHttp** @@ -1231,7 +1297,6 @@ ADMX Info: **DeliveryOptimization/DOPercentageMaxDownloadBandwidth** - [Scope](./policy-configuration-service-provider.md#policy-scope): @@ -1501,6 +1566,7 @@ Footnote: - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in the next major release of Windows 10. diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index 8e395ec5f7..ac8fca65ac 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 03/12/2018 +ms.date: 08/08/2018 --- # Policy CSP - Desktop @@ -44,7 +44,7 @@ ms.date: 03/12/2018 cross mark check mark - check mark + cross mark check mark check mark cross mark diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index 345a36f617..cacbb2acc6 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -6,11 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 03/12/2018 +ms.date: 07/30/2018 --- # Policy CSP - DeviceGuard +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
    @@ -19,6 +21,9 @@ ms.date: 03/12/2018 ## DeviceGuard policies
    +
    + DeviceGuard/EnableSystemGuard +
    DeviceGuard/EnableVirtualizationBasedSecurity
    @@ -31,6 +36,75 @@ ms.date: 03/12/2018
    +
    + + +**DeviceGuard/EnableSystemGuard** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcross markcross markcheck mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy allows the IT admin to configure the launch of System Guard. + +Secure Launch configuration: + +- 0 - Unmanaged, configurable by Administrative user +- 1 - Enables Secure Launch if supported by hardware +- 2 - Disables Secure Launch. + +For more information about System Guard, see [Introducing Windows Defender System Guard runtime attestation](https://cloudblogs.microsoft.com/microsoftsecure/2018/04/19/introducing-windows-defender-system-guard-runtime-attestation/) and [How hardware-based containers help protect Windows 10](https://docs.microsoft.com/en-us/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows). + + + +ADMX Info: +- GP English name: *Turn On Virtualization Based Security* +- GP name: *VirtualizationBasedSecurity* +- GP element: *SystemGuardDrop* +- GP path: *System/Device Guard* +- GP ADMX file name: *DeviceGuard.admx* + + + + + + + + + + + + +
    @@ -215,6 +289,7 @@ Footnote: - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in the next major release of Windows 10. diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 46a6862046..94e15bf96e 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 08/08/2018 --- # Policy CSP - DeviceLock @@ -150,11 +150,11 @@ The following list shows the supported values: Mobile Enterprise - cross mark - cross mark check mark - cross mark - cross mark + check mark + check mark + check mark + check mark check mark check mark @@ -180,8 +180,6 @@ Specifies whether to show a user-configurable setting to control the screen time > [!NOTE] > This policy must be wrapped in an Atomic command. - - > [!IMPORTANT] > If this policy is set to 1 (Allowed), the value set by **DeviceLock/ScreenTimeOutWhileLocked** is ignored. To ensure enterprise control over the screen timeout, set this policy to 0 (Not allowed) and use **DeviceLock/ScreenTimeOutWhileLocked** to set the screen timeout period. @@ -508,8 +506,6 @@ Specifies how many passwords can be stored in the history that can’t be used. > [!NOTE] > This policy must be wrapped in an Atomic command. - - The value includes the user's current password. This means that with a setting of 1 the user cannot reuse their current password when choosing a new password, while a setting of 5 means that a user cannot set their new password to their current password or any of their previous four passwords. Max policy value is the most restricted. @@ -543,8 +539,8 @@ The following list shows the supported values: Mobile Enterprise - cross mark - cross mark + check mark1 + check mark1 check mark1 check mark1 check mark1 @@ -993,7 +989,7 @@ The following list shows the supported values: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -1046,7 +1042,7 @@ GP Info: Mobile Enterprise - cross mark + check mark check mark check mark check mark @@ -1108,7 +1104,7 @@ ADMX Info: Mobile Enterprise - cross mark + check mark check mark check mark check mark @@ -1217,32 +1213,3 @@ Footnote: - -## DeviceLock policies that can be set using Exchange Active Sync (EAS) - -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordExpiration](#devicelock-devicepasswordexpiration) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) -- [DeviceLock/PreventLockScreenSlideShow](#devicelock-preventlockscreenslideshow) - - - -## DeviceLock policies supported by Windows Holographic for Business - -- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/AllowSimpleDevicePassword](#devicelock-allowsimpledevicepassword) -- [DeviceLock/AlphanumericDevicePasswordRequired](#devicelock-alphanumericdevicepasswordrequired) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [DeviceLock/DevicePasswordHistory](#devicelock-devicepasswordhistory) -- [DeviceLock/MaxDevicePasswordFailedAttempts](#devicelock-maxdevicepasswordfailedattempts) -- [DeviceLock/MaxInactivityTimeDeviceLock](#devicelock-maxinactivitytimedevicelock) -- [DeviceLock/MinDevicePasswordComplexCharacters](#devicelock-mindevicepasswordcomplexcharacters) -- [DeviceLock/MinDevicePasswordLength](#devicelock-mindevicepasswordlength) - - diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index 060689251b..7e1be2a448 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 03/12/2018 +ms.date: 08/08/2018 --- # Policy CSP - Display @@ -53,7 +53,7 @@ ms.date: 03/12/2018 Mobile Enterprise - check mark4 + cross mark check mark4 check mark4 check mark4 @@ -105,7 +105,7 @@ ADMX Info: Mobile Enterprise - check mark4 + cross mark check mark4 check mark4 check mark4 @@ -177,7 +177,7 @@ The following list shows the supported values: Mobile Enterprise - check mark4 + cross mark check mark4 check mark4 check mark4 diff --git a/windows/client-management/mdm/policy-csp-dmaguard.md b/windows/client-management/mdm/policy-csp-dmaguard.md index 0d4c0d64c5..2960d7874f 100644 --- a/windows/client-management/mdm/policy-csp-dmaguard.md +++ b/windows/client-management/mdm/policy-csp-dmaguard.md @@ -44,7 +44,7 @@ ms.date: 06/29/2018 Mobile Enterprise - check mark5 + cross mark check mark5 check mark5 check mark5 diff --git a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md index e8f2b997fc..472aa8161b 100644 --- a/windows/client-management/mdm/policy-csp-enterprisecloudprint.md +++ b/windows/client-management/mdm/policy-csp-enterprisecloudprint.md @@ -246,10 +246,10 @@ The default value is an empty string. Otherwise, the value should contain the UR cross mark - cross mark - cross mark - cross mark - cross mark + check mark2 + check mark2 + check mark2 + check mark2 check mark2 check mark2 diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index a0a6355c06..c3369e756d 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/13/2018 +ms.date: 07/30/2018 --- # Policy CSP - Experience @@ -91,7 +91,7 @@ ms.date: 07/13/2018 Experience/DoNotShowFeedbackNotifications
    - Experience/DoNotSyncBrowserSetting + Experience/DoNotSyncBrowserSettings
    Experience/PreventUsersFromTurningOnBrowserSyncing @@ -358,7 +358,7 @@ The following list shows the supported values: cross mark check mark2 - check mark2 + cross mark check mark2 check mark2 check mark2 @@ -676,9 +676,9 @@ The following list shows the supported values: cross mark check mark2 - check mark2 - check mark2 cross mark + check mark2 + check mark2 cross mark cross mark @@ -799,7 +799,7 @@ The following list shows the supported values: check mark1 check mark1 check mark1 - cross mark + check mark1 cross mark cross mark @@ -915,9 +915,9 @@ The following list shows the supported values: cross mark cross mark - check mark - check mark cross mark + check mark + check mark cross mark cross mark @@ -979,9 +979,9 @@ The following list shows the supported values: cross mark cross mark - check mark1 - check mark1 cross mark + check mark1 + check mark1 cross mark cross mark @@ -1043,9 +1043,9 @@ The following list shows the supported values: cross mark cross mark - check mark2 - check mark2 cross mark + check mark2 + check mark2 cross mark cross mark @@ -1106,9 +1106,9 @@ The following list shows the supported values: cross mark cross mark - check mark4 - check mark4 cross mark + check mark4 + check mark4 @@ -1168,9 +1168,9 @@ The following list shows the supported values: cross mark cross mark - check mark2 - check mark2 cross mark + check mark2 + check mark2 cross mark cross mark @@ -1232,9 +1232,9 @@ The following list shows the supported values: cross mark cross mark - check mark - check mark cross mark + check mark + check mark cross mark cross mark @@ -1290,9 +1290,9 @@ The following list shows the supported values: cross mark cross mark - check mark1 - check mark1 cross mark + check mark1 + check mark1 cross mark cross mark @@ -1351,7 +1351,7 @@ The following list shows the supported values: Mobile Enterprise - check mark1 + cross mark check mark1 check mark1 check mark1 @@ -1396,11 +1396,10 @@ The following list shows the supported values: -<<<<<<< HEAD
    -**Experience/DoNotSyncBrowserSetting** +**Experience/DoNotSyncBrowserSettings** @@ -1435,14 +1434,10 @@ The following list shows the supported values: -By default, the "browser" group syncs automatically between user’s devices and allowing users to choose to make changes. The "browser" group uses the **Sync your Settings** option in Settings to sync information like history and favorites. Enabling this policy prevents the "browser" group from using the **Sync your Settings** option. If you want syncing turned off by default but not disabled, select the Allow users to turn "browser" syncing option. +[!INCLUDE [do-not-sync-browser-settings-shortdesc](../../../browsers/edge/shortdesc/do-not-sync-browser-settings-shortdesc.md)] -Related policy: PreventUsersFromTurningOnBrowserSyncing. - -Value type is integer. Supported values: - -- 0 (default) - Allowed/turned on. The "browser" group syncs automatically between user’s devices and lets users to make changes. -- 2 - Prevented/turned off. The "browser" group does not use the **Sync your Settings** option. +Related policy: + [PreventUsersFromTurningOnBrowserSyncing](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#experience-preventusersfromturningonbrowsersyncing) @@ -1454,6 +1449,29 @@ ADMX Info: +Supported values: + +- 0 (default) - Allowed/turned on. The "browser" group syncs automatically between user’s devices and lets users to make changes. +- 2 - Prevented/turned off. The "browser" group does not use the _Sync your Settings_ option. + + +_**Sync the browser settings automatically**_ + + Set both **DoNotSyncBrowserSettings** and **PreventUsersFromTurningOnBrowserSyncing** to 0 (Allowed/turned on). + +_**Prevent syncing of browser settings and prevent users from turning it on**_ + +1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off). +2. Set **PreventUsersFromTurningOnBrowserSyncing** to 1 (Prevented/turned off). + +_**Prevent syncing of browser settings and let users turn on syncing**_ + +1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off). +2. Set **PreventUsersFromTurningOnBrowserSyncing** to 0 (Allowed/turned on). + +_**Turn syncing off by default but don’t disable**_ + + Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off) and select the _Allow users to turn “browser” syncing_ option. @@ -1502,52 +1520,55 @@ ADMX Info: -By default, the "browser" group syncs automatically between the user’s devices, letting users make changes. With this policy, though, you can prevent the "browser" group from syncing and prevent users from turning on the Sync your Settings toggle in Settings. If you want syncing turned off by default but not disabled, select the Allow users to turn "browser" syncing option in the Do not sync browser policy. For this policy to work correctly, you must enable the Do not sync browser policy. +[!INCLUDE [prevent-users-to-turn-on-browser-syncing-shortdesc](../../../browsers/edge/shortdesc/prevent-users-to-turn-on-browser-syncing-shortdesc.md)] -Related policy: DoNotSyncBrowserSetting +Related policy: + [DoNotSyncBrowserSettings](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-experience#experience-donotsyncbrowsersetting) -Value type is integer. Supported values: - -- 0 - Allowed/turned on. Users can sync the browser settings. -- 1 (default) - Prevented/turned off. - -This policy only works with the Experience/DoNotSyncBrowserSetting policy, and for this policy to work correctly, you must set Experience/DoNotSynBrowserSettings to 2 (enabled). By default, when you set this policy and the Experience/DoNotSyncBrowserSetting policy to 0 (disabled or not configured), the browser settings sync automatically. However, with this policy, you can prevent the syncing of browser settings and prevent users from turning on the Sync your Settings option. Additionally, you can prevent syncing the browser settings but give users a choice to turn on syncing. - -If you want to prevent syncing of browser settings and prevent users from turning it on: -1. Set Experience/DoNotSyncBrowserSetting to 2 (enabled). -1. Set this policy (Experience/PreventUsersFromTurningOnBrowserSyncing) to 1 (enabled or not configured). - -If you want to prevent syncing of browser settings but give users a choice to turn on syncing: -1. Set Experience/DoNotSyncBrowserSetting to 2 (enabled). -1. Set this policy (Experience/PreventUsersFromTurningOnBrowserSyncing) to 0 (disabled). ADMX Info: -- GP English name: *Do not sync browser settings* -- GP name: *DisableWebBrowserSettingSync* -- GP element: *CheckBox_UserOverride* +- GP English name: *Prevent users from turning on browser syncing* +- GP name: *PreventUsersFromTurningOnBrowserSyncing* - GP path: *Windows Components/Sync your settings* - GP ADMX file name: *SettingSync.admx* +Supported values: + +- 0 - Allowed/turned on. Users can sync the browser settings. +- 1 (default) - Prevented/turned off. + + +_**Sync the browser settings automatically**_ + + Set both **DoNotSyncBrowserSettings** and **PreventUsersFromTurningOnBrowserSyncing** to 0 (Allowed/turned on). + +_**Prevent syncing of browser settings and prevent users from turning it on**_ + +1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off). +2. Set **PreventUsersFromTurningOnBrowserSyncing** to 1 (Prevented/turned off). + +_**Prevent syncing of browser settings and let users turn on syncing**_ + +1. Set **DoNotSyncBrowserSettings** to 2 (Prevented/turned off). +2. Set **PreventUsersFromTurningOnBrowserSyncing** to 0 (Allowed/turned on). -**Validation procedure:** +Validation procedure: -Microsoft Edge on your PC: -1. Select More > Settings. -1. See if the setting is enabled or disabled based on your setting. +1. Select **More > Settings**. +1. See if the setting is enabled or disabled based on your selection. -======= ->>>>>>> 785954ffa54220bce4c3bdaef580253b43197a5a +
    Footnote: @@ -1560,10 +1581,4 @@ Footnote: - -## Experience policies supported by Windows Holographic for Business - -- [Experience/AllowCortana](#experience-allowcortana) -- [Experience/AllowManualMDMUnenrollment](#experience-allowmanualmdmunenrollment) - diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md index 07582f80bf..a74fbeccf3 100644 --- a/windows/client-management/mdm/policy-csp-handwriting.md +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 03/12/2018 +ms.date: 08/09/2018 --- # Policy CSP - Handwriting @@ -44,7 +44,7 @@ ms.date: 03/12/2018 - + diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index 2c1b567f4b..846fbce380 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -1,366 +1,426 @@ ---- -title: Policy CSP - Kerberos -description: Policy CSP - Kerberos -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 03/12/2018 ---- - -# Policy CSP - Kerberos - - - -
    - - -## Kerberos policies - -
    -
    - Kerberos/AllowForestSearchOrder -
    -
    - Kerberos/KerberosClientSupportsClaimsCompoundArmor -
    -
    - Kerberos/RequireKerberosArmoring -
    -
    - Kerberos/RequireStrictKDCValidation -
    -
    - Kerberos/SetMaximumContextTokenSize -
    -
    - - -
    - - -**Kerberos/AllowForestSearchOrder** - - -
    cross mark check mark3check mark3cross mark check mark3 check mark3 cross mark
    - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -This policy setting defines the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs). - -If you enable this policy setting, the Kerberos client searches the forests in this list, if it is unable to resolve a two-part SPN. If a match is found, the Kerberos client requests a referral ticket to the appropriate domain. - -If you disable or do not configure this policy setting, the Kerberos client does not search the listed forests to resolve the SPN. If the Kerberos client is unable to resolve the SPN because the name is not found, NTLM authentication might be used. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Use forest search order* -- GP name: *ForestSearch* -- GP path: *System/Kerberos* -- GP ADMX file name: *Kerberos.admx* - - - - -
    - - -**Kerberos/KerberosClientSupportsClaimsCompoundArmor** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -This policy setting controls whether a device will request claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication with domains that support these features. -If you enable this policy setting, the client computers will request claims, provide information required to create compounded authentication and armor Kerberos messages in domains which support claims and compound authentication for Dynamic Access Control and Kerberos armoring. - -If you disable or do not configure this policy setting, the client devices will not request claims, provide information required to create compounded authentication and armor Kerberos messages. Services hosted on the device will not be able to retrieve claims for clients using Kerberos protocol transition. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Kerberos client support for claims, compound authentication and Kerberos armoring* -- GP name: *EnableCbacAndArmor* -- GP path: *System/Kerberos* -- GP ADMX file name: *Kerberos.admx* - - - - -
    - - -**Kerberos/RequireKerberosArmoring** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -This policy setting controls whether a computer requires that Kerberos message exchanges be armored when communicating with a domain controller. - -Warning: When a domain does not support Kerberos armoring by enabling "Support Dynamic Access Control and Kerberos armoring", then all authentication for all its users will fail from computers with this policy setting enabled. - -If you enable this policy setting, the client computers in the domain enforce the use of Kerberos armoring in only authentication service (AS) and ticket-granting service (TGS) message exchanges with the domain controllers. - -Note: The Kerberos Group Policy "Kerberos client support for claims, compound authentication and Kerberos armoring" must also be enabled to support Kerberos armoring. - -If you disable or do not configure this policy setting, the client computers in the domain enforce the use of Kerberos armoring when possible as supported by the target domain. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Fail authentication requests when Kerberos armoring is not available* -- GP name: *ClientRequireFast* -- GP path: *System/Kerberos* -- GP ADMX file name: *Kerberos.admx* - - - - -
    - - -**Kerberos/RequireStrictKDCValidation** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -This policy setting controls the Kerberos client's behavior in validating the KDC certificate for smart card and system certificate logon. - -If you enable this policy setting, the Kerberos client requires that the KDC's X.509 certificate contains the KDC key purpose object identifier in the Extended Key Usage (EKU) extensions, and that the KDC's X.509 certificate contains a dNSName subjectAltName (SAN) extension that matches the DNS name of the domain. If the computer is joined to a domain, the Kerberos client requires that the KDC's X.509 certificate must be signed by a Certificate Authority (CA) in the NTAuth store. If the computer is not joined to a domain, the Kerberos client allows the root CA certificate on the smart card to be used in the path validation of the KDC's X.509 certificate. - -If you disable or do not configure this policy setting, the Kerberos client requires only that the KDC certificate contain the Server Authentication purpose object identifier in the EKU extensions which can be issued to any server. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Require strict KDC validation* -- GP name: *ValidateKDC* -- GP path: *System/Kerberos* -- GP ADMX file name: *Kerberos.admx* - - - - -
    - - -**Kerberos/SetMaximumContextTokenSize** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcross markcross mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -This policy setting allows you to set the value returned to applications which request the maximum size of the SSPI context token buffer size. - -The size of the context token buffer determines the maximum size of SSPI context tokens an application expects and allocates. Depending upon authentication request processing and group memberships, the buffer might be smaller than the actual size of the SSPI context token. - -If you enable this policy setting, the Kerberos client or server uses the configured value, or the locally allowed maximum value, whichever is smaller. - -If you disable or do not configure this policy setting, the Kerberos client or server uses the locally configured value or the default value. - -Note: This policy setting configures the existing MaxTokenSize registry value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters, which was added in Windows XP and Windows Server 2003, with a default value of 12,000 bytes. Beginning with Windows 8 the default is 48,000 bytes. Due to HTTP's base64 encoding of authentication context tokens, it is not advised to set this value more than 48,000 bytes. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). - -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). - -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Set maximum Kerberos SSPI context token buffer size* -- GP name: *MaxTokenSize* -- GP path: *System/Kerberos* -- GP ADMX file name: *Kerberos.admx* - - - -
    - -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. - - - +--- +title: Policy CSP - Kerberos +description: Policy CSP - Kerberos +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: MariciaAlforque +ms.date: 08/08/2018 +--- + +# Policy CSP - Kerberos + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + + +
    + + +## Kerberos policies + +
    +
    + Kerberos/AllowForestSearchOrder +
    +
    + Kerberos/KerberosClientSupportsClaimsCompoundArmor +
    +
    + Kerberos/RequireKerberosArmoring +
    +
    + Kerberos/RequireStrictKDCValidation +
    +
    + Kerberos/SetMaximumContextTokenSize +
    +
    + Kerberos/UPNNameHints +
    +
    + + +
    + + +**Kerberos/AllowForestSearchOrder** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcross markcross mark
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting defines the list of trusting forests that the Kerberos client searches when attempting to resolve two-part service principal names (SPNs). + +If you enable this policy setting, the Kerberos client searches the forests in this list, if it is unable to resolve a two-part SPN. If a match is found, the Kerberos client requests a referral ticket to the appropriate domain. + +If you disable or do not configure this policy setting, the Kerberos client does not search the listed forests to resolve the SPN. If the Kerberos client is unable to resolve the SPN because the name is not found, NTLM authentication might be used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Use forest search order* +- GP name: *ForestSearch* +- GP path: *System/Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + + +
    + + +**Kerberos/KerberosClientSupportsClaimsCompoundArmor** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcross markcross mark
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting controls whether a device will request claims and compound authentication for Dynamic Access Control and Kerberos armoring using Kerberos authentication with domains that support these features. +If you enable this policy setting, the client computers will request claims, provide information required to create compounded authentication and armor Kerberos messages in domains which support claims and compound authentication for Dynamic Access Control and Kerberos armoring. + +If you disable or do not configure this policy setting, the client devices will not request claims, provide information required to create compounded authentication and armor Kerberos messages. Services hosted on the device will not be able to retrieve claims for clients using Kerberos protocol transition. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Kerberos client support for claims, compound authentication and Kerberos armoring* +- GP name: *EnableCbacAndArmor* +- GP path: *System/Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + + +
    + + +**Kerberos/RequireKerberosArmoring** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcross markcross mark
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting controls whether a computer requires that Kerberos message exchanges be armored when communicating with a domain controller. + +Warning: When a domain does not support Kerberos armoring by enabling "Support Dynamic Access Control and Kerberos armoring", then all authentication for all its users will fail from computers with this policy setting enabled. + +If you enable this policy setting, the client computers in the domain enforce the use of Kerberos armoring in only authentication service (AS) and ticket-granting service (TGS) message exchanges with the domain controllers. + +Note: The Kerberos Group Policy "Kerberos client support for claims, compound authentication and Kerberos armoring" must also be enabled to support Kerberos armoring. + +If you disable or do not configure this policy setting, the client computers in the domain enforce the use of Kerberos armoring when possible as supported by the target domain. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Fail authentication requests when Kerberos armoring is not available* +- GP name: *ClientRequireFast* +- GP path: *System/Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + + +
    + + +**Kerberos/RequireStrictKDCValidation** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcross markcross mark
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting controls the Kerberos client's behavior in validating the KDC certificate for smart card and system certificate logon. + +If you enable this policy setting, the Kerberos client requires that the KDC's X.509 certificate contains the KDC key purpose object identifier in the Extended Key Usage (EKU) extensions, and that the KDC's X.509 certificate contains a dNSName subjectAltName (SAN) extension that matches the DNS name of the domain. If the computer is joined to a domain, the Kerberos client requires that the KDC's X.509 certificate must be signed by a Certificate Authority (CA) in the NTAuth store. If the computer is not joined to a domain, the Kerberos client allows the root CA certificate on the smart card to be used in the path validation of the KDC's X.509 certificate. + +If you disable or do not configure this policy setting, the Kerberos client requires only that the KDC certificate contain the Server Authentication purpose object identifier in the EKU extensions which can be issued to any server. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Require strict KDC validation* +- GP name: *ValidateKDC* +- GP path: *System/Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + + +
    + + +**Kerberos/SetMaximumContextTokenSize** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcross markcross mark
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting allows you to set the value returned to applications which request the maximum size of the SSPI context token buffer size. + +The size of the context token buffer determines the maximum size of SSPI context tokens an application expects and allocates. Depending upon authentication request processing and group memberships, the buffer might be smaller than the actual size of the SSPI context token. + +If you enable this policy setting, the Kerberos client or server uses the configured value, or the locally allowed maximum value, whichever is smaller. + +If you disable or do not configure this policy setting, the Kerberos client or server uses the locally configured value or the default value. + +Note: This policy setting configures the existing MaxTokenSize registry value in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters, which was added in Windows XP and Windows Server 2003, with a default value of 12,000 bytes. Beginning with Windows 8 the default is 48,000 bytes. Due to HTTP's base64 encoding of authentication context tokens, it is not advised to set this value more than 48,000 bytes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). + +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). + +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set maximum Kerberos SSPI context token buffer size* +- GP name: *MaxTokenSize* +- GP path: *System/Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + + +
    + + +**Kerberos/UPNNameHints** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Adds a list of domains that an Azure Active Directory joined device can attempt to contact when it cannot resolve a UPN to a principal. + +Devices joined to Azure Active Directory in a hybrid environment need to interact with Active Directory Domain Controllers, but they lack the built-in ability to find a Domain Controller that a domain-joined device has. This can cause failures when such a device needs to resolve an Azure Active Directory UPN into an Active Directory Principal. You can use this policy to avoid those failures. + + + + + + + + + + + + +
    + +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in the next major release of Windows 10. + + + diff --git a/windows/client-management/mdm/policy-csp-location.md b/windows/client-management/mdm/policy-csp-location.md index 10663ef1ad..8745836c59 100644 --- a/windows/client-management/mdm/policy-csp-location.md +++ b/windows/client-management/mdm/policy-csp-location.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 03/12/2018 +ms.date: 08/09/2018 --- # Policy CSP - Location @@ -42,7 +42,7 @@ ms.date: 03/12/2018 Mobile Enterprise - check mark2 + cross mark check mark2 check mark2 check mark2 diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md index e5f9888352..9e96723b2f 100644 --- a/windows/client-management/mdm/policy-csp-messaging.md +++ b/windows/client-management/mdm/policy-csp-messaging.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 03/12/2018 +ms.date: 08/09/2018 --- # Policy CSP - Messaging @@ -102,10 +102,10 @@ The following list shows the supported values: cross mark + check mark1 cross mark - - cross mark - cross mark + check mark1 + check mark1 check mark1 check mark1 diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index 23a98eaa7b..f45615badd 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -1,4886 +1,4865 @@ ---- -title: Policy CSP - Privacy -description: Policy CSP - Privacy -ms.author: maricia -ms.topic: article -ms.prod: w10 -ms.technology: windows -author: MariciaAlforque -ms.date: 06/05/2018 ---- - -# Policy CSP - Privacy - -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. - - -
    - - -## Privacy policies - -
    -
    - Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts -
    -
    - Privacy/AllowCrossDeviceClipboard -
    -
    - Privacy/AllowInputPersonalization -
    -
    - Privacy/DisableAdvertisingId -
    -
    - Privacy/EnableActivityFeed -
    -
    - Privacy/LetAppsAccessAccountInfo -
    -
    - Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessCalendar -
    -
    - Privacy/LetAppsAccessCalendar_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessCalendar_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessCallHistory -
    -
    - Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessCamera -
    -
    - Privacy/LetAppsAccessCamera_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessCamera_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessCamera_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessContacts -
    -
    - Privacy/LetAppsAccessContacts_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessContacts_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessContacts_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessEmail -
    -
    - Privacy/LetAppsAccessEmail_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessEmail_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessEmail_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessGazeInput -
    -
    - Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessLocation -
    -
    - Privacy/LetAppsAccessLocation_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessLocation_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessLocation_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessMessaging -
    -
    - Privacy/LetAppsAccessMessaging_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessMessaging_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessMicrophone -
    -
    - Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessMotion -
    -
    - Privacy/LetAppsAccessMotion_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessMotion_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessMotion_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessNotifications -
    -
    - Privacy/LetAppsAccessNotifications_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessNotifications_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessPhone -
    -
    - Privacy/LetAppsAccessPhone_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessPhone_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessPhone_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessRadios -
    -
    - Privacy/LetAppsAccessRadios_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessRadios_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessRadios_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessTasks -
    -
    - Privacy/LetAppsAccessTasks_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessTasks_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessTasks_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsAccessTrustedDevices -
    -
    - Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps -
    -
    - Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps -
    -
    - Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsGetDiagnosticInfo -
    -
    - Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps -
    -
    - Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps -
    -
    - Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsRunInBackground -
    -
    - Privacy/LetAppsRunInBackground_ForceAllowTheseApps -
    -
    - Privacy/LetAppsRunInBackground_ForceDenyTheseApps -
    -
    - Privacy/LetAppsRunInBackground_UserInControlOfTheseApps -
    -
    - Privacy/LetAppsSyncWithDevices -
    -
    - Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps -
    -
    - Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps -
    -
    - Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps -
    -
    - Privacy/PublishUserActivities -
    -
    - Privacy/UploadUserActivities -
    -
    - - -
    - - -**Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark3check mark3check mark3check mark3check mark3check mark3check mark3
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Allows or disallows the automatic acceptance of the pairing and privacy user consent dialog when launching apps. - -> [!Note] -> There were issues reported with the previous release of this policy and a fix was added in Windows 10, version 1709. - - -Most restricted value is 0. - - - -The following list shows the supported values: - -- 0 (default)– Not allowed. -- 1 – Allowed. - - - - -
    - - -**Privacy/AllowCrossDeviceClipboard** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark5check mark5check mark5check mark5check mark5
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, next major version. Specifies whether clipboard items roam across devices. When this is allowed, an item copied to the clipboard is uploaded to the cloud so that other devices can access. Also, when this is allowed, a new clipboard item on the cloud is downloaded to a device so that user can paste on the device. - -Most restricted value is 0. - - - -ADMX Info: -- GP English name: *Allow Clipboard synchronization across devices* -- GP name: *AllowCrossDeviceClipboard* -- GP path: *System/OS Policies* -- GP ADMX file name: *OSPolicy.admx* - - - -The following list shows the supported values: - -0 – Not allowed. -1 (default) – Allowed. - - - - - - - - - - -
    - - -**Privacy/AllowInputPersonalization** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcheck markcheck mark
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Updated in Windows 10, version 1709. Allows the usage of cloud based speech services for Cortana, dictation, or Store applications. Setting this policy to 1, lets Microsoft use the user's voice data to improve cloud speech services for all users. - -Most restricted value is 0. - - - -ADMX Info: -- GP English name: *Allow input personalization* -- GP name: *AllowInputPersonalization* -- GP path: *Control Panel/Regional and Language Options* -- GP ADMX file name: *Globalization.admx* - - - -The following list shows the supported values: - -- 0 – Not allowed. -- 1 (default) – Allowed. - - - - -
    - - -**Privacy/DisableAdvertisingId** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Enables or disables the Advertising ID. - -Most restricted value is 0. - - - -ADMX Info: -- GP English name: *Turn off the advertising ID* -- GP name: *DisableAdvertisingId* -- GP path: *System/User Profiles* -- GP ADMX file name: *UserProfiles.admx* - - - -The following list shows the supported values: - -- 0 – Disabled. -- 1 – Enabled. -- 65535 (default)- Not configured. - - - - -
    - - -**Privacy/EnableActivityFeed** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark3check mark3check mark3check mark3check mark3check mark3check mark3
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1709. Allows IT Admins to allow Apps/OS to publish to the activity feed. - - - -ADMX Info: -- GP English name: *Enables Activity Feed* -- GP name: *EnableActivityFeed* -- GP path: *System/OS Policies* -- GP ADMX file name: *OSPolicy.admx* - - - -The following list shows the supported values: - -- 0 – Disabled. Apps/OS can't publish the activities and roaming is disabled. (not published to the cloud). -- 1 – (default) Enabled. Apps/OS can publish the activities and will be roamed across device graph. - - - - -
    - - -**Privacy/LetAppsAccessAccountInfo** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can access account information. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps access account information* -- GP name: *LetAppsAccessAccountInfo* -- GP element: *LetAppsAccessAccountInfo_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access account information* -- GP name: *LetAppsAccessAccountInfo* -- GP element: *LetAppsAccessAccountInfo_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access account information* -- GP name: *LetAppsAccessAccountInfo* -- GP element: *LetAppsAccessAccountInfo_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access account information* -- GP name: *LetAppsAccessAccountInfo* -- GP element: *LetAppsAccessAccountInfo_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessCalendar** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can access the calendar. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps access the calendar* -- GP name: *LetAppsAccessCalendar* -- GP element: *LetAppsAccessCalendar_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessCalendar_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access the calendar* -- GP name: *LetAppsAccessCalendar* -- GP element: *LetAppsAccessCalendar_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessCalendar_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access the calendar* -- GP name: *LetAppsAccessCalendar* -- GP element: *LetAppsAccessCalendar_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access the calendar* -- GP name: *LetAppsAccessCalendar* -- GP element: *LetAppsAccessCalendar_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessCallHistory** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can access call history. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps access call history* -- GP name: *LetAppsAccessCallHistory* -- GP element: *LetAppsAccessCallHistory_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access call history* -- GP name: *LetAppsAccessCallHistory* -- GP element: *LetAppsAccessCallHistory_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access call history* -- GP name: *LetAppsAccessCallHistory* -- GP element: *LetAppsAccessCallHistory_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access call history* -- GP name: *LetAppsAccessCallHistory* -- GP element: *LetAppsAccessCallHistory_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessCamera** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can access the camera. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps access the camera* -- GP name: *LetAppsAccessCamera* -- GP element: *LetAppsAccessCamera_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessCamera_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access the camera* -- GP name: *LetAppsAccessCamera* -- GP element: *LetAppsAccessCamera_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessCamera_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access the camera* -- GP name: *LetAppsAccessCamera* -- GP element: *LetAppsAccessCamera_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessCamera_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access the camera* -- GP name: *LetAppsAccessCamera* -- GP element: *LetAppsAccessCamera_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessContacts** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can access contacts. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps access contacts* -- GP name: *LetAppsAccessContacts* -- GP element: *LetAppsAccessContacts_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessContacts_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access contacts* -- GP name: *LetAppsAccessContacts* -- GP element: *LetAppsAccessContacts_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessContacts_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access contacts* -- GP name: *LetAppsAccessContacts* -- GP element: *LetAppsAccessContacts_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessContacts_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access contacts* -- GP name: *LetAppsAccessContacts* -- GP element: *LetAppsAccessContacts_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessEmail** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can access email. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps access email* -- GP name: *LetAppsAccessEmail* -- GP element: *LetAppsAccessEmail_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessEmail_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access email* -- GP name: *LetAppsAccessEmail* -- GP element: *LetAppsAccessEmail_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessEmail_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access email* -- GP name: *LetAppsAccessEmail* -- GP element: *LetAppsAccessEmail_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessEmail_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access email* -- GP name: *LetAppsAccessEmail* -- GP element: *LetAppsAccessEmail_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessGazeInput** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark5check mark5check mark5check mark5check mark5
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -This policy setting specifies whether Windows apps can access the eye tracker. - - - - - - - - - - - - - -
    - - -**Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark5check mark5check mark5check mark5check mark5
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. - - - - - - - - - - - - - -
    - - -**Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark5check mark5check mark5check mark5check mark5
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. - - - - - - - - - - - - - -
    - - -**Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark5check mark5check mark5check mark5check mark5
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the eye tracker privacy setting for the listed apps. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. - - - - - - - - - - - - - -
    - - -**Privacy/LetAppsAccessLocation** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can access location. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps access location* -- GP name: *LetAppsAccessLocation* -- GP element: *LetAppsAccessLocation_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessLocation_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access location* -- GP name: *LetAppsAccessLocation* -- GP element: *LetAppsAccessLocation_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessLocation_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access location* -- GP name: *LetAppsAccessLocation* -- GP element: *LetAppsAccessLocation_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessLocation_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access location* -- GP name: *LetAppsAccessLocation* -- GP element: *LetAppsAccessLocation_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessMessaging** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can read or send messages (text or MMS). - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps access messaging* -- GP name: *LetAppsAccessMessaging* -- GP element: *LetAppsAccessMessaging_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessMessaging_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access messaging* -- GP name: *LetAppsAccessMessaging* -- GP element: *LetAppsAccessMessaging_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessMessaging_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access messaging* -- GP name: *LetAppsAccessMessaging* -- GP element: *LetAppsAccessMessaging_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access messaging* -- GP name: *LetAppsAccessMessaging* -- GP element: *LetAppsAccessMessaging_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessMicrophone** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can access the microphone. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps access the microphone* -- GP name: *LetAppsAccessMicrophone* -- GP element: *LetAppsAccessMicrophone_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access the microphone* -- GP name: *LetAppsAccessMicrophone* -- GP element: *LetAppsAccessMicrophone_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access the microphone* -- GP name: *LetAppsAccessMicrophone* -- GP element: *LetAppsAccessMicrophone_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access the microphone* -- GP name: *LetAppsAccessMicrophone* -- GP element: *LetAppsAccessMicrophone_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessMotion** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can access motion data. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps access motion* -- GP name: *LetAppsAccessMotion* -- GP element: *LetAppsAccessMotion_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessMotion_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access motion* -- GP name: *LetAppsAccessMotion* -- GP element: *LetAppsAccessMotion_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessMotion_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access motion* -- GP name: *LetAppsAccessMotion* -- GP element: *LetAppsAccessMotion_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessMotion_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access motion* -- GP name: *LetAppsAccessMotion* -- GP element: *LetAppsAccessMotion_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessNotifications** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can access notifications. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps access notifications* -- GP name: *LetAppsAccessNotifications* -- GP element: *LetAppsAccessNotifications_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessNotifications_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access notifications* -- GP name: *LetAppsAccessNotifications* -- GP element: *LetAppsAccessNotifications_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessNotifications_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access notifications* -- GP name: *LetAppsAccessNotifications* -- GP element: *LetAppsAccessNotifications_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access notifications* -- GP name: *LetAppsAccessNotifications* -- GP element: *LetAppsAccessNotifications_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessPhone** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can make phone calls. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps make phone calls* -- GP name: *LetAppsAccessPhone* -- GP element: *LetAppsAccessPhone_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessPhone_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps make phone calls* -- GP name: *LetAppsAccessPhone* -- GP element: *LetAppsAccessPhone_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessPhone_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps make phone calls* -- GP name: *LetAppsAccessPhone* -- GP element: *LetAppsAccessPhone_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessPhone_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps make phone calls* -- GP name: *LetAppsAccessPhone* -- GP element: *LetAppsAccessPhone_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessRadios** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps have access to control radios. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps control radios* -- GP name: *LetAppsAccessRadios* -- GP element: *LetAppsAccessRadios_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessRadios_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps control radios* -- GP name: *LetAppsAccessRadios* -- GP element: *LetAppsAccessRadios_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessRadios_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps control radios* -- GP name: *LetAppsAccessRadios* -- GP element: *LetAppsAccessRadios_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessRadios_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps control radios* -- GP name: *LetAppsAccessRadios* -- GP element: *LetAppsAccessRadios_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessTasks** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1703. Specifies whether Windows apps can access tasks. - - - -ADMX Info: -- GP English name: *Let Windows apps access Tasks* -- GP name: *LetAppsAccessTasks* -- GP element: *LetAppsAccessTasks_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessTasks_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access Tasks* -- GP name: *LetAppsAccessTasks* -- GP element: *LetAppsAccessTasks_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessTasks_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access Tasks* -- GP name: *LetAppsAccessTasks* -- GP element: *LetAppsAccessTasks_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessTasks_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access Tasks* -- GP name: *LetAppsAccessTasks* -- GP element: *LetAppsAccessTasks_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessTrustedDevices** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can access trusted devices. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps access trusted devices* -- GP name: *LetAppsAccessTrustedDevices* -- GP element: *LetAppsAccessTrustedDevices_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access trusted devices* -- GP name: *LetAppsAccessTrustedDevices* -- GP element: *LetAppsAccessTrustedDevices_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access trusted devices* -- GP name: *LetAppsAccessTrustedDevices* -- GP element: *LetAppsAccessTrustedDevices_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access trusted devices* -- GP name: *LetAppsAccessTrustedDevices* -- GP element: *LetAppsAccessTrustedDevices_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsGetDiagnosticInfo** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1703. Force allow, force deny or give user control of apps that can get diagnostic information about other running apps. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps access diagnostic information about other apps* -- GP name: *LetAppsGetDiagnosticInfo* -- GP element: *LetAppsGetDiagnosticInfo_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access diagnostic information about other apps* -- GP name: *LetAppsGetDiagnosticInfo* -- GP element: *LetAppsGetDiagnosticInfo_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access diagnostic information about other apps* -- GP name: *LetAppsGetDiagnosticInfo* -- GP element: *LetAppsGetDiagnosticInfo_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'get diagnostic info' privacy setting for the listed apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps access diagnostic information about other apps* -- GP name: *LetAppsGetDiagnosticInfo* -- GP element: *LetAppsGetDiagnosticInfo_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsRunInBackground** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1703. Specifies whether Windows apps can run in the background. - - -Most restricted value is 2. -> [!WARNING] -> Be careful when determining which apps should have their background activity disabled. Communication apps normally update tiles and notifications through background processes. Turning off background activity for these types of apps could cause text message, email, and voicemail notifications to not function. This could also cause background email syncing to not function properly. - - - -ADMX Info: -- GP English name: *Let Windows apps run in the background* -- GP name: *LetAppsRunInBackground* -- GP element: *LetAppsRunInBackground_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control (default). -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsRunInBackground_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are able to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps run in the background* -- GP name: *LetAppsRunInBackground* -- GP element: *LetAppsRunInBackground_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsRunInBackground_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied the ability to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps run in the background* -- GP name: *LetAppsRunInBackground* -- GP element: *LetAppsRunInBackground_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsRunInBackground_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the background apps privacy setting for the listed apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps run in the background* -- GP name: *LetAppsRunInBackground* -- GP element: *LetAppsRunInBackground_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsSyncWithDevices** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. Specifies whether Windows apps can sync with devices. - - -Most restricted value is 2. - - - -ADMX Info: -- GP English name: *Let Windows apps communicate with unpaired devices* -- GP name: *LetAppsSyncWithDevices* -- GP element: *LetAppsSyncWithDevices_Enum* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - -The following list shows the supported values: - -- 0 – User in control. -- 1 – Force allow. -- 2 - Force deny. - - - - -
    - - -**Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps communicate with unpaired devices* -- GP name: *LetAppsSyncWithDevices* -- GP element: *LetAppsSyncWithDevices_ForceAllowTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps communicate with unpaired devices* -- GP name: *LetAppsSyncWithDevices* -- GP element: *LetAppsSyncWithDevices_ForceDenyTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'sync with devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. - - - -ADMX Info: -- GP English name: *Let Windows apps communicate with unpaired devices* -- GP name: *LetAppsSyncWithDevices* -- GP element: *LetAppsSyncWithDevices_UserInControlOfTheseApps_List* -- GP path: *Windows Components/App Privacy* -- GP ADMX file name: *AppPrivacy.admx* - - - - -
    - - -**Privacy/PublishUserActivities** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark3check mark3check mark3check mark3check mark3check mark3check mark3
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Added in Windows 10, version 1709. Allows It Admins to enable publishing of user activities to the activity feed. - - - -ADMX Info: -- GP English name: *Allow publishing of User Activities* -- GP name: *PublishUserActivities* -- GP path: *System/OS Policies* -- GP ADMX file name: *OSPolicy.admx* - - - -The following list shows the supported values: - -- 0 – Disabled. Apps/OS can't publish the *user activities*. -- 1 – (default) Enabled. Apps/OS can publish the *user activities*. - - - - -
    - - -**Privacy/UploadUserActivities** - - - - - - - - - - - - - - - - - - - - - -
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark5check mark5check mark5check mark5check mark5
    - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Allows ActivityFeed to upload published 'User Activities'. - - - -ADMX Info: -- GP English name: *Allow upload of User Activities* -- GP name: *UploadUserActivities* -- GP path: *System/OS Policies* -- GP ADMX file name: *OSPolicy.admx* - - - - - - - - - - - - -
    - -Footnote: - -- 1 - Added in Windows 10, version 1607. -- 2 - Added in Windows 10, version 1703. -- 3 - Added in Windows 10, version 1709. -- 4 - Added in Windows 10, version 1803. -- 5 - Added in the next major release of Windows 10. - - - - -## Privacy policies supported by Windows Holographic for Business - -- [Privacy/AllowCrossDeviceClipboard](#privacy-allowcrossdeviceclipboard) -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) -- [Privacy/LetAppsAccessGazeInput](#privacy-letappsaccessgazeinput) -- [Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps](#privacy-letappsaccessgazeinput-forceallowtheseapps) -- [Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps](#privacy-letappsaccessgazeinput-forcedenytheseapps) -- [Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps](#privacy-letappsaccessgazeinput-userincontroloftheseapps) -- [Privacy/UploadUserActivities](#privacy-uploaduseractivities) - - - -## Privacy policies supported by IoT Core - -- [Privacy/LetAppsGetDiagnosticInfo](#privacy-letappsgetdiagnosticinfo) -- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) -- [Privacy/LetAppsRunInBackground](#privacy-letappsruninbackground) -- [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](#privacy-letappsruninbackground-forceallowtheseapps) -- [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](#privacy-letappsruninbackground-forcedenytheseapps) -- [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](#privacy-letappsruninbackground-userincontroloftheseapps) - - - -## Privacy policies supported by Microsoft Surface Hub - -- [Privacy/EnableActivityFeed](#privacy-enableactivityfeed) -- [Privacy/LetAppsGetDiagnosticInfo](#privacy-letappsgetdiagnosticinfo) -- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) -- [Privacy/LetAppsRunInBackground](#privacy-letappsruninbackground) -- [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](#privacy-letappsruninbackground-forceallowtheseapps) -- [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](#privacy-letappsruninbackground-forcedenytheseapps) -- [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](#privacy-letappsruninbackground-userincontroloftheseapps) -- [Privacy/PublishUserActivities](#privacy-publishuseractivities) - - +--- +title: Policy CSP - Privacy +description: Policy CSP - Privacy +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: MariciaAlforque +ms.date: 08/14/2018 +--- + +# Policy CSP - Privacy + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + + +
    + + +## Privacy policies + +
    +
    + Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts +
    +
    + Privacy/AllowCrossDeviceClipboard +
    +
    + Privacy/AllowInputPersonalization +
    +
    + Privacy/DisableAdvertisingId +
    +
    + Privacy/DisablePrivacyExperience +
    +
    + Privacy/EnableActivityFeed +
    +
    + Privacy/LetAppsAccessAccountInfo +
    +
    + Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessCalendar +
    +
    + Privacy/LetAppsAccessCalendar_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessCalendar_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessCallHistory +
    +
    + Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessCamera +
    +
    + Privacy/LetAppsAccessCamera_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessCamera_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessCamera_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessContacts +
    +
    + Privacy/LetAppsAccessContacts_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessContacts_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessContacts_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessEmail +
    +
    + Privacy/LetAppsAccessEmail_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessEmail_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessEmail_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessGazeInput +
    +
    + Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessLocation +
    +
    + Privacy/LetAppsAccessLocation_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessLocation_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessLocation_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessMessaging +
    +
    + Privacy/LetAppsAccessMessaging_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessMessaging_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessMicrophone +
    +
    + Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessMotion +
    +
    + Privacy/LetAppsAccessMotion_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessMotion_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessMotion_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessNotifications +
    +
    + Privacy/LetAppsAccessNotifications_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessNotifications_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessPhone +
    +
    + Privacy/LetAppsAccessPhone_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessPhone_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessPhone_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessRadios +
    +
    + Privacy/LetAppsAccessRadios_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessRadios_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessRadios_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessTasks +
    +
    + Privacy/LetAppsAccessTasks_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessTasks_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessTasks_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsAccessTrustedDevices +
    +
    + Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps +
    +
    + Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps +
    +
    + Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsGetDiagnosticInfo +
    +
    + Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps +
    +
    + Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps +
    +
    + Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsRunInBackground +
    +
    + Privacy/LetAppsRunInBackground_ForceAllowTheseApps +
    +
    + Privacy/LetAppsRunInBackground_ForceDenyTheseApps +
    +
    + Privacy/LetAppsRunInBackground_UserInControlOfTheseApps +
    +
    + Privacy/LetAppsSyncWithDevices +
    +
    + Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps +
    +
    + Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps +
    +
    + Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps +
    +
    + Privacy/PublishUserActivities +
    +
    + Privacy/UploadUserActivities +
    +
    + + +
    + + +**Privacy/AllowAutoAcceptPairingAndPrivacyConsentPrompts** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark3check mark3check mark3check mark3check mark3check mark3check mark3
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Allows or disallows the automatic acceptance of the pairing and privacy user consent dialog when launching apps. + +> [!Note] +> There were issues reported with the previous release of this policy and a fix was added in Windows 10, version 1709. + + +Most restricted value is 0. + + + +The following list shows the supported values: + +- 0 (default)– Not allowed. +- 1 – Allowed. + + + + +
    + + +**Privacy/AllowCrossDeviceClipboard** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark5check mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, next major version. Specifies whether clipboard items roam across devices. When this is allowed, an item copied to the clipboard is uploaded to the cloud so that other devices can access. Also, when this is allowed, a new clipboard item on the cloud is downloaded to a device so that user can paste on the device. + +Most restricted value is 0. + + + +ADMX Info: +- GP English name: *Allow Clipboard synchronization across devices* +- GP name: *AllowCrossDeviceClipboard* +- GP path: *System/OS Policies* +- GP ADMX file name: *OSPolicy.admx* + + + +The following list shows the supported values: + +0 – Not allowed. +1 (default) – Allowed. + + + + +
    + + +**Privacy/AllowInputPersonalization** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check markcheck markcheck markcheck markcheck markcheck markcheck mark
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Updated in Windows 10, next major version. This policy specifies whether users on the device have the option to enable online speech recognition. When enabled, users can use their voice for dictation and to talk to Cortana and other apps that use Microsoft cloud-based speech recognition. Microsoft will use voice input to help improve our speech services. If the policy value is set to 0, online speech recognition will be disabled and users cannot enable online speech recognition via settings. If policy value is set to 1 or is not configured, control is deferred to users. + +Most restricted value is 0. + + + +ADMX Info: +- GP English name: *Allow input personalization* +- GP name: *AllowInputPersonalization* +- GP path: *Control Panel/Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +The following list shows the supported values: + +- 0 – Not allowed. +- 1 (default) – Choice deferred to user's preference. + + + + +
    + + +**Privacy/DisableAdvertisingId** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Enables or disables the Advertising ID. + +Most restricted value is 0. + + + +ADMX Info: +- GP English name: *Turn off the advertising ID* +- GP name: *DisableAdvertisingId* +- GP path: *System/User Profiles* +- GP ADMX file name: *UserProfiles.admx* + + + +The following list shows the supported values: + +- 0 – Disabled. +- 1 – Enabled. +- 65535 (default)- Not configured. + + + + +
    + + +**Privacy/DisablePrivacyExperience** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark5check mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
    + + + +Enabling this policy prevents the privacy experience from launching during user logon for new and upgraded users. + +Value type is integer. +- 0 (default) - Allow the "choose privacy settings for your device" screen for a new user during their first logon or when an existing user logs in for the first time after an upgrade. +- 1 - Do not allow the "choose privacy settings for your device" screen when a new user logs in or an existing user logs in for the first time after an upgrade. + +In some enterprise managed environments, the privacy settings may be set by policies. In these cases, you can use this policy if you do not want to show a screen that would prompt your users to change these privacy settings. + + + +ADMX Info: +- GP English name: *Don't launch privacy settings experience on user logon* +- GP name: *DisablePrivacyExperience* +- GP path: *Windows Components/OOBE* +- GP ADMX file name: *OOBE.admx* + + + + + + + + + + + + + +
    + + +**Privacy/EnableActivityFeed** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark3check mark3check mark3check mark3check mark3check mark3check mark3
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1709. Allows IT Admins to allow Apps/OS to publish to the activity feed. + + + +ADMX Info: +- GP English name: *Enables Activity Feed* +- GP name: *EnableActivityFeed* +- GP path: *System/OS Policies* +- GP ADMX file name: *OSPolicy.admx* + + + +The following list shows the supported values: + +- 0 – Disabled. Apps/OS can't publish the activities and roaming is disabled. (not published to the cloud). +- 1 – (default) Enabled. Apps/OS can publish the activities and will be roamed across device graph. + + + + +
    + + +**Privacy/LetAppsAccessAccountInfo** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can access account information. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps access account information* +- GP name: *LetAppsAccessAccountInfo* +- GP element: *LetAppsAccessAccountInfo_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessAccountInfo_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access account information* +- GP name: *LetAppsAccessAccountInfo* +- GP element: *LetAppsAccessAccountInfo_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessAccountInfo_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to account information. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access account information* +- GP name: *LetAppsAccessAccountInfo* +- GP element: *LetAppsAccessAccountInfo_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessAccountInfo_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the account information privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessAccountInfo policy setting for the specified Windows apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access account information* +- GP name: *LetAppsAccessAccountInfo* +- GP element: *LetAppsAccessAccountInfo_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessCalendar** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can access the calendar. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps access the calendar* +- GP name: *LetAppsAccessCalendar* +- GP element: *LetAppsAccessCalendar_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessCalendar_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access the calendar* +- GP name: *LetAppsAccessCalendar* +- GP element: *LetAppsAccessCalendar_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessCalendar_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to the calendar. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access the calendar* +- GP name: *LetAppsAccessCalendar* +- GP element: *LetAppsAccessCalendar_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessCalendar_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the calendar privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCalendar policy setting for the specified Windows apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access the calendar* +- GP name: *LetAppsAccessCalendar* +- GP element: *LetAppsAccessCalendar_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessCallHistory** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can access call history. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps access call history* +- GP name: *LetAppsAccessCallHistory* +- GP element: *LetAppsAccessCallHistory_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessCallHistory_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are allowed access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access call history* +- GP name: *LetAppsAccessCallHistory* +- GP element: *LetAppsAccessCallHistory_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessCallHistory_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. Listed Windows apps are denied access to call history. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access call history* +- GP name: *LetAppsAccessCallHistory* +- GP element: *LetAppsAccessCallHistory_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessCallHistory_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Windows apps. The user is able to control the call history privacy setting for the listed Windows apps. This setting overrides the default LetAppsAccessCallHistory policy setting for the specified Windows apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access call history* +- GP name: *LetAppsAccessCallHistory* +- GP element: *LetAppsAccessCallHistory_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessCamera** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can access the camera. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps access the camera* +- GP name: *LetAppsAccessCamera* +- GP element: *LetAppsAccessCamera_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessCamera_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access the camera* +- GP name: *LetAppsAccessCamera* +- GP element: *LetAppsAccessCamera_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessCamera_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the camera. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access the camera* +- GP name: *LetAppsAccessCamera* +- GP element: *LetAppsAccessCamera_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessCamera_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the camera privacy setting for the listed apps. This setting overrides the default LetAppsAccessCamera policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access the camera* +- GP name: *LetAppsAccessCamera* +- GP element: *LetAppsAccessCamera_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessContacts** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can access contacts. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps access contacts* +- GP name: *LetAppsAccessContacts* +- GP element: *LetAppsAccessContacts_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessContacts_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access contacts* +- GP name: *LetAppsAccessContacts* +- GP element: *LetAppsAccessContacts_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessContacts_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to contacts. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access contacts* +- GP name: *LetAppsAccessContacts* +- GP element: *LetAppsAccessContacts_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessContacts_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the contacts privacy setting for the listed apps. This setting overrides the default LetAppsAccessContacts policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access contacts* +- GP name: *LetAppsAccessContacts* +- GP element: *LetAppsAccessContacts_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessEmail** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can access email. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps access email* +- GP name: *LetAppsAccessEmail* +- GP element: *LetAppsAccessEmail_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessEmail_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access email* +- GP name: *LetAppsAccessEmail* +- GP element: *LetAppsAccessEmail_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessEmail_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to email. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access email* +- GP name: *LetAppsAccessEmail* +- GP element: *LetAppsAccessEmail_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessEmail_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the email privacy setting for the listed apps. This setting overrides the default LetAppsAccessEmail policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access email* +- GP name: *LetAppsAccessEmail* +- GP element: *LetAppsAccessEmail_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessGazeInput** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark5check mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +This policy setting specifies whether Windows apps can access the eye tracker. + + + + +
    + + +**Privacy/LetAppsAccessGazeInput_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark5check mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are allowed access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. + + + + +
    + + +**Privacy/LetAppsAccessGazeInput_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark5check mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +List of semi-colon delimited Package Family Names of Windows Store Apps. Listed apps are denied access to the eye tracker. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. + + + + +
    + + +**Privacy/LetAppsAccessGazeInput_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark5check mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +List of semi-colon delimited Package Family Names of Windows Store Apps. The user is able to control the eye tracker privacy setting for the listed apps. This setting overrides the default LetAppsAccessGazeInput policy setting for the specified apps. + + + + +
    + + +**Privacy/LetAppsAccessLocation** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can access location. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps access location* +- GP name: *LetAppsAccessLocation* +- GP element: *LetAppsAccessLocation_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessLocation_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access location* +- GP name: *LetAppsAccessLocation* +- GP element: *LetAppsAccessLocation_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessLocation_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to location. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access location* +- GP name: *LetAppsAccessLocation* +- GP element: *LetAppsAccessLocation_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessLocation_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the location privacy setting for the listed apps. This setting overrides the default LetAppsAccessLocation policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access location* +- GP name: *LetAppsAccessLocation* +- GP element: *LetAppsAccessLocation_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessMessaging** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can read or send messages (text or MMS). + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps access messaging* +- GP name: *LetAppsAccessMessaging* +- GP element: *LetAppsAccessMessaging_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessMessaging_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access messaging* +- GP name: *LetAppsAccessMessaging* +- GP element: *LetAppsAccessMessaging_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessMessaging_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to read or send messages (text or MMS). This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access messaging* +- GP name: *LetAppsAccessMessaging* +- GP element: *LetAppsAccessMessaging_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessMessaging_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the messaging privacy setting for the listed apps. This setting overrides the default LetAppsAccessMessaging policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access messaging* +- GP name: *LetAppsAccessMessaging* +- GP element: *LetAppsAccessMessaging_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessMicrophone** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can access the microphone. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps access the microphone* +- GP name: *LetAppsAccessMicrophone* +- GP element: *LetAppsAccessMicrophone_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessMicrophone_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access the microphone* +- GP name: *LetAppsAccessMicrophone* +- GP element: *LetAppsAccessMicrophone_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to the microphone. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access the microphone* +- GP name: *LetAppsAccessMicrophone* +- GP element: *LetAppsAccessMicrophone_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessMicrophone_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the microphone privacy setting for the listed apps. This setting overrides the default LetAppsAccessMicrophone policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access the microphone* +- GP name: *LetAppsAccessMicrophone* +- GP element: *LetAppsAccessMicrophone_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessMotion** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can access motion data. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps access motion* +- GP name: *LetAppsAccessMotion* +- GP element: *LetAppsAccessMotion_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessMotion_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access motion* +- GP name: *LetAppsAccessMotion* +- GP element: *LetAppsAccessMotion_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessMotion_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to motion data. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access motion* +- GP name: *LetAppsAccessMotion* +- GP element: *LetAppsAccessMotion_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessMotion_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the motion privacy setting for the listed apps. This setting overrides the default LetAppsAccessMotion policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access motion* +- GP name: *LetAppsAccessMotion* +- GP element: *LetAppsAccessMotion_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessNotifications** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can access notifications. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps access notifications* +- GP name: *LetAppsAccessNotifications* +- GP element: *LetAppsAccessNotifications_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessNotifications_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access notifications* +- GP name: *LetAppsAccessNotifications* +- GP element: *LetAppsAccessNotifications_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessNotifications_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to notifications. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access notifications* +- GP name: *LetAppsAccessNotifications* +- GP element: *LetAppsAccessNotifications_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessNotifications_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the notifications privacy setting for the listed apps. This setting overrides the default LetAppsAccessNotifications policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access notifications* +- GP name: *LetAppsAccessNotifications* +- GP element: *LetAppsAccessNotifications_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessPhone** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can make phone calls. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps make phone calls* +- GP name: *LetAppsAccessPhone* +- GP element: *LetAppsAccessPhone_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessPhone_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps make phone calls* +- GP name: *LetAppsAccessPhone* +- GP element: *LetAppsAccessPhone_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessPhone_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are not allowed to make phone calls. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps make phone calls* +- GP name: *LetAppsAccessPhone* +- GP element: *LetAppsAccessPhone_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessPhone_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the phone call privacy setting for the listed apps. This setting overrides the default LetAppsAccessPhone policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps make phone calls* +- GP name: *LetAppsAccessPhone* +- GP element: *LetAppsAccessPhone_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessRadios** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps have access to control radios. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps control radios* +- GP name: *LetAppsAccessRadios* +- GP element: *LetAppsAccessRadios_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessRadios_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps control radios* +- GP name: *LetAppsAccessRadios* +- GP element: *LetAppsAccessRadios_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessRadios_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to control radios. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps control radios* +- GP name: *LetAppsAccessRadios* +- GP element: *LetAppsAccessRadios_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessRadios_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the radios privacy setting for the listed apps. This setting overrides the default LetAppsAccessRadios policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps control radios* +- GP name: *LetAppsAccessRadios* +- GP element: *LetAppsAccessRadios_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessTasks** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1703. Specifies whether Windows apps can access tasks. + + + +ADMX Info: +- GP English name: *Let Windows apps access Tasks* +- GP name: *LetAppsAccessTasks* +- GP element: *LetAppsAccessTasks_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessTasks_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are allowed access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access Tasks* +- GP name: *LetAppsAccessTasks* +- GP element: *LetAppsAccessTasks_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessTasks_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied access to tasks. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access Tasks* +- GP name: *LetAppsAccessTasks* +- GP element: *LetAppsAccessTasks_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessTasks_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the tasks privacy setting for the listed apps. This setting overrides the default LetAppsAccessTasks policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access Tasks* +- GP name: *LetAppsAccessTasks* +- GP element: *LetAppsAccessTasks_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessTrustedDevices** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can access trusted devices. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps access trusted devices* +- GP name: *LetAppsAccessTrustedDevices* +- GP element: *LetAppsAccessTrustedDevices_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsAccessTrustedDevices_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access trusted devices* +- GP name: *LetAppsAccessTrustedDevices* +- GP element: *LetAppsAccessTrustedDevices_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessTrustedDevices_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to trusted devices. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access trusted devices* +- GP name: *LetAppsAccessTrustedDevices* +- GP element: *LetAppsAccessTrustedDevices_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsAccessTrustedDevices_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'trusted devices' privacy setting for the listed apps. This setting overrides the default LetAppsAccessTrustedDevices policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access trusted devices* +- GP name: *LetAppsAccessTrustedDevices* +- GP element: *LetAppsAccessTrustedDevices_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsGetDiagnosticInfo** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1703. Force allow, force deny or give user control of apps that can get diagnostic information about other running apps. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps access diagnostic information about other apps* +- GP name: *LetAppsGetDiagnosticInfo* +- GP element: *LetAppsGetDiagnosticInfo_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access diagnostic information about other apps* +- GP name: *LetAppsGetDiagnosticInfo* +- GP element: *LetAppsGetDiagnosticInfo_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to diagnostic information about other running apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access diagnostic information about other apps* +- GP name: *LetAppsGetDiagnosticInfo* +- GP element: *LetAppsGetDiagnosticInfo_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'get diagnostic info' privacy setting for the listed apps. This setting overrides the default LetAppsGetDiagnosticInfo policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps access diagnostic information about other apps* +- GP name: *LetAppsGetDiagnosticInfo* +- GP element: *LetAppsGetDiagnosticInfo_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsRunInBackground** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1703. Specifies whether Windows apps can run in the background. + + +Most restricted value is 2. +> [!WARNING] +> Be careful when determining which apps should have their background activity disabled. Communication apps normally update tiles and notifications through background processes. Turning off background activity for these types of apps could cause text message, email, and voicemail notifications to not function. This could also cause background email syncing to not function properly. + + + +ADMX Info: +- GP English name: *Let Windows apps run in the background* +- GP name: *LetAppsRunInBackground* +- GP element: *LetAppsRunInBackground_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control (default). +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsRunInBackground_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are able to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps run in the background* +- GP name: *LetAppsRunInBackground* +- GP element: *LetAppsRunInBackground_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsRunInBackground_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps are denied the ability to run in the background. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps run in the background* +- GP name: *LetAppsRunInBackground* +- GP element: *LetAppsRunInBackground_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsRunInBackground_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark2check mark2check mark2check mark2check mark2check mark2check mark2
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1703. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the background apps privacy setting for the listed apps. This setting overrides the default LetAppsRunInBackground policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps run in the background* +- GP name: *LetAppsRunInBackground* +- GP element: *LetAppsRunInBackground_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsSyncWithDevices** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. Specifies whether Windows apps can sync with devices. + + +Most restricted value is 2. + + + +ADMX Info: +- GP English name: *Let Windows apps communicate with unpaired devices* +- GP name: *LetAppsSyncWithDevices* +- GP element: *LetAppsSyncWithDevices_Enum* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + +The following list shows the supported values: + +- 0 – User in control. +- 1 – Force allow. +- 2 - Force deny. + + + + +
    + + +**Privacy/LetAppsSyncWithDevices_ForceAllowTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps communicate with unpaired devices* +- GP name: *LetAppsSyncWithDevices* +- GP element: *LetAppsSyncWithDevices_ForceAllowTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsSyncWithDevices_ForceDenyTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. Listed apps will not have access to sync with devices. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps communicate with unpaired devices* +- GP name: *LetAppsSyncWithDevices* +- GP element: *LetAppsSyncWithDevices_ForceDenyTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/LetAppsSyncWithDevices_UserInControlOfTheseApps** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark1check mark1check mark1check mark1check mark1check mark1check mark1
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1607. List of semi-colon delimited Package Family Names of Microsoft Store Apps. The user is able to control the 'sync with devices' privacy setting for the listed apps. This setting overrides the default LetAppsSyncWithDevices policy setting for the specified apps. + + + +ADMX Info: +- GP English name: *Let Windows apps communicate with unpaired devices* +- GP name: *LetAppsSyncWithDevices* +- GP element: *LetAppsSyncWithDevices_UserInControlOfTheseApps_List* +- GP path: *Windows Components/App Privacy* +- GP ADMX file name: *AppPrivacy.admx* + + + + +
    + + +**Privacy/PublishUserActivities** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark3check mark3check mark3check mark3check mark3check mark3check mark3
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1709. Allows It Admins to enable publishing of user activities to the activity feed. + + + +ADMX Info: +- GP English name: *Allow publishing of User Activities* +- GP name: *PublishUserActivities* +- GP path: *System/OS Policies* +- GP ADMX file name: *OSPolicy.admx* + + + +The following list shows the supported values: + +- 0 – Disabled. Apps/OS can't publish the *user activities*. +- 1 – (default) Enabled. Apps/OS can publish the *user activities*. + + + + +
    + + +**Privacy/UploadUserActivities** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    check mark5check mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Allows ActivityFeed to upload published 'User Activities'. + + + +ADMX Info: +- GP English name: *Allow upload of User Activities* +- GP name: *UploadUserActivities* +- GP path: *System/OS Policies* +- GP ADMX file name: *OSPolicy.admx* + + + +
    + +Footnote: + +- 1 - Added in Windows 10, version 1607. +- 2 - Added in Windows 10, version 1703. +- 3 - Added in Windows 10, version 1709. +- 4 - Added in Windows 10, version 1803. +- 5 - Added in the next major release of Windows 10. + + + diff --git a/windows/client-management/mdm/policy-csp-restrictedgroups.md b/windows/client-management/mdm/policy-csp-restrictedgroups.md index 78ef27da14..1d41637f5b 100644 --- a/windows/client-management/mdm/policy-csp-restrictedgroups.md +++ b/windows/client-management/mdm/policy-csp-restrictedgroups.md @@ -66,12 +66,59 @@ This security setting allows an administrator to define the members of a securit Caution: If a Restricted Groups policy is applied, any current member not on the Restricted Groups policy members list is removed. This can include default members, such as administrators. Restricted Groups should be used primarily to configure membership of local groups on workstation or member servers. An empty Members list means that the restricted group has no members. +Starting in Windows 10, next major version, you can use this schema for retrieval and application of the RestrictedGroups/ConfigureGroupMembership policy. A minimum occurrence of 0 members when applying the policy implies clearing the access group and should be used with caution. + +``` syntax + + + + + + + + + + + + Restricted Group Member + + + + + + + + + + + + + + + Restricted Group + + + + + + +``` + +Here is an example: +``` + + + + + + +``` diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 90d61b4f33..f51a32f819 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 07/30/2018 --- # Policy CSP - Search @@ -860,15 +860,5 @@ Footnote: - -## Search policies that can be set using Exchange Active Sync (EAS) -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) - - - -## Search policies supported by Windows Holographic for Business - -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) - diff --git a/windows/client-management/mdm/policy-csp-security.md b/windows/client-management/mdm/policy-csp-security.md index 923b4a3d8a..e6171c839d 100644 --- a/windows/client-management/mdm/policy-csp-security.md +++ b/windows/client-management/mdm/policy-csp-security.md @@ -6,11 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 06/26/2018 +ms.date: 08/09/2018 --- # Policy CSP - Security +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
    @@ -43,6 +45,9 @@ ms.date: 06/26/2018
    Security/PreventAutomaticDeviceEncryptionForAzureADJoinedDevices
    +
    + Security/RecoveryEnvironmentAuthentication +
    Security/RequireDeviceEncryption
    @@ -393,7 +398,7 @@ The following list shows the supported values: Mobile Enterprise - check mark4 + cross mark check mark4 check mark4 check mark4 @@ -488,6 +493,87 @@ The following list shows the supported values:
    + +**Security/RecoveryEnvironmentAuthentication** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
    + + + +Added in Windows 10, next major version. This policy controls the Admin Authentication requirement in RecoveryEnvironment. + +Supported values: +- 0 - Default: Keep using default(current) behavior +- 1 - RequireAuthentication: Admin Authentication is always required for components in RecoveryEnvironment +- 2 - NoRequireAuthentication: Admin Authentication is not required for components in RecoveryEnvironment + + + + + + + + + +**Validation procedure** + +The validation requires a check whether Refresh ("Keep my files") and Reset ("Remove everything") requires admin authentication in WinRE. +The process of starting Push Button Reset (PBR) in WinRE: + +1. Open a cmd as Administrator, run command "reagentc /boottore" and restart the OS to boot to WinRE. +1. OS should boot to the blue screen of WinRE UI, go through TroubleShoot -> Reset this PC, it should show two options: "Keep my files" and "Remove everything". + +If the MDM policy is set to "Default" (0) or does not exist, the admin authentication flow should work as default behavior: + +1. Start PBR in WinRE, choose "Keep my files", it should pop up admin authentication. +1. Click "<-" (right arrow) button and choose "Remove everything", it should not pop up admin authentication and just go to PBR options. + +If the MDM policy is set to "RequireAuthentication" (1) + +1. Start PBR in WinRE, choose "Keep my files", it should pop up admin authentication. +1. Click "<-" (right arrow) button and choose "Remove everything", it should also pop up admin authentication. + +If the MDM policy is set to "NoRequireAuthentication" (2) + +1. Start PBR in WinRE, choose "Keep my files", it should not pop up admin authentication. +1. Go through PBR options and click "cancel" at final confirmation page, wait unit the UI is back. +1. Click "TroubleShoot" -> "Reset this PC" again, choose "Remove everything", it should not pop up admin authentication neither. + + + + +
    + **Security/RequireDeviceEncryption** @@ -661,34 +747,9 @@ Footnote: - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in the next major release of Windows 10. - -## Security policies that can be set using Exchange Active Sync (EAS) -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) - - - -## Security policies supported by Windows Holographic for Business - -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) - - - -## Security policies supported by IoT Core - -- [Security/AllowAddProvisioningPackage](#security-allowaddprovisioningpackage) -- [Security/AllowRemoveProvisioningPackage](#security-allowremoveprovisioningpackage) -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) -- [Security/RequireProvisioningPackageSignature](#security-requireprovisioningpackagesignature) - - - -## Security policies supported by Microsoft Surface Hub - -- [Security/RequireProvisioningPackageSignature](#security-requireprovisioningpackagesignature) -- [Security/RequireRetrieveHealthCertificateOnBoot](#security-requireretrievehealthcertificateonboot) - diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index ba5cc1e9ef..a88b2464f6 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 08/09/2018 --- # Policy CSP - Settings @@ -239,10 +239,10 @@ The following list shows the supported values: cross mark - cross mark - cross mark - cross mark - cross mark + check mark1 + check mark1 + check mark1 + check mark1 check mark1 check mark1 @@ -849,10 +849,5 @@ Footnote: - -## Settings policies supported by Windows Holographic for Business -- [Settings/AllowDateTime](#settings-allowdatetime) -- [Settings/AllowVPN](#settings-allowvpn) - diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index f499ec5037..43023aecdc 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 08/09/2018 --- # Policy CSP - Speech @@ -42,7 +42,7 @@ ms.date: 05/14/2018 Mobile Enterprise - check mark1 + cross mark check mark1 check mark1 check mark1 diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 080a8fa8c1..5c8db780af 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -6,11 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 06/26/2018 +ms.date: 08/14/2018 --- # Policy CSP - Start +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
    @@ -49,6 +51,9 @@ ms.date: 06/26/2018
    Start/AllowPinnedFolderVideos
    +
    + Start/DisableContextMenus +
    Start/ForceStartSize
    @@ -621,6 +626,67 @@ The following list shows the supported values:
    + +**Start/DisableContextMenus** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User +> * Device + +
    + + + +Enabling this policy prevents context menus from being invoked in the Start Menu. + + + +ADMX Info: +- GP English name: *Disable context menus in the Start Menu* +- GP name: *DisableContextMenusInStart* +- GP path: *Start Menu and Taskbar* +- GP ADMX file name: *StartMenu.admx* + + + + + + + + + + + + + +
    + **Start/ForceStartSize** @@ -637,7 +703,7 @@ The following list shows the supported values: cross mark - cross mark + check mark check mark check mark check mark @@ -1726,7 +1792,7 @@ To validate on Desktop, do the following: cross mark - cross mark + check mark check mark check mark check mark @@ -1780,6 +1846,7 @@ Footnote: - 2 - Added in Windows 10, version 1703. - 3 - Added in Windows 10, version 1709. - 4 - Added in Windows 10, version 1803. +- 5 - Added in the next major release of Windows 10. diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index b7f8fb114a..63649af40c 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 06/05/2018 +ms.date: 07/30/2018 --- # Policy CSP - System @@ -1194,34 +1194,5 @@ Footnote: - -## System policies that can be set using Exchange Active Sync (EAS) -- [System/AllowStorageCard](#system-allowstoragecard) -- [System/TelemetryProxy](#system-telemetryproxy) - - - -## System policies supported by Windows Holographic for Business - -- [System/AllowLocation](#system-allowlocation) -- [System/AllowTelemetry](#system-allowtelemetry) - - - -## System policies supported by IoT Core - -- [System/AllowEmbeddedMode](#system-allowembeddedmode) -- [System/AllowFontProviders](#system-allowfontproviders) -- [System/AllowStorageCard](#system-allowstoragecard) -- [System/TelemetryProxy](#system-telemetryproxy) - - - -## System policies supported by Microsoft Surface Hub - -- [System/AllowFontProviders](#system-allowfontproviders) -- [System/AllowLocation](#system-allowlocation) -- [System/AllowTelemetry](#system-allowtelemetry) - diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 2b295a2044..e96eb5340c 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 06/05/2018 +ms.date: 08/09/2018 --- # Policy CSP - TextInput @@ -650,6 +650,30 @@ The following list shows the supported values: **TextInput/AllowLinguisticDataCollection** + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck markcheck markcheck markcheck markcross markcross mark
    + + + [Scope](./policy-configuration-service-provider.md#policy-scope): diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 7f6dde9d31..df68eeee47 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/18/2018 +ms.date: 08/10/2018 --- # Policy CSP - Update @@ -177,6 +177,9 @@ ms.date: 07/18/2018
    Update/SetEDURestart
    +
    + Update/UpdateNotificationLevel +
    Update/UpdateServiceUrl
    @@ -802,15 +805,6 @@ ADMX Info: - GP ADMX file name: *WindowsUpdate.admx* - - - - - - - - -
    @@ -1597,15 +1591,6 @@ ADMX Info: - GP ADMX file name: *WindowsUpdate.admx* - - - - - - - - -
    @@ -1732,15 +1717,6 @@ ADMX Info: - GP ADMX file name: *WindowsUpdate.admx* - - - - - - - - -
    @@ -1867,15 +1843,6 @@ ADMX Info: - GP ADMX file name: *WindowsUpdate.admx* - - - - - - - - -
    @@ -3264,15 +3231,6 @@ ADMX Info: - GP ADMX file name: *WindowsUpdate.admx* - - - - - - - - -
    @@ -3324,15 +3282,6 @@ ADMX Info: - GP ADMX file name: *WindowsUpdate.admx* - - - - - - - - -
    @@ -3395,6 +3344,75 @@ The following list shows the supported values:
    + +**Update/UpdateNotificationLevel** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark5check mark5check mark5check mark5
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Display options for update notifications. This policy allows you to define what Windows Update notifications users see. This policy doesn’t control how and when updates are downloaded and installed. + +Options: + +- 0 (default) – Use the default Windows Update notifications +- 1 – Turn off all notifications, excluding restart warnings +- 2 – Turn off all notifications, including restart warnings + +> [!Important] +> If you choose not to get update notifications and also define other Group policies so that devices aren’t automatically getting updates, neither you nor device users will be aware of critical security, quality, or feature updates, and your devices may be at risk. + + + +ADMX Info: +- GP English name: *Display options for update notifications* +- GP name: *UpdateNotificationLevel* +- GP path: *Windows Components/Windows Update* +- GP ADMX file name: *WindowsUpdate.admx* + + + + + + + + + + + + + +
    + **Update/UpdateServiceUrl** @@ -3550,53 +3568,3 @@ Footnote: - 5 - Added in the next major release of Windows 10. - - -## Update policies supported by Windows Holographic for Business - -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) -- [Update/RequireUpdateApproval](#update-requireupdateapproval) -- [Update/UpdateServiceUrl](#update-updateserviceurl) - - - -## Update policies supported by IoT Core - -- [Update/AllowNonMicrosoftSignedUpdate](#update-allownonmicrosoftsignedupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates](#update-autorestartdeadlineperiodindaysforfeatureupdates) -- [Update/EngagedRestartDeadlineForFeatureUpdates](#update-engagedrestartdeadlineforfeatureupdates) -- [Update/EngagedRestartSnoozeScheduleForFeatureUpdates](#update-engagedrestartsnoozescheduleforfeatureupdates) -- [Update/EngagedRestartTransitionScheduleForFeatureUpdates](#update-engagedrestarttransitionscheduleforfeatureupdates) -- [Update/PauseDeferrals](#update-pausedeferrals) -- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) -- [Update/RequireUpdateApproval](#update-requireupdateapproval) -- [Update/ScheduledInstallDay](#update-scheduledinstallday) -- [Update/ScheduledInstallTime](#update-scheduledinstalltime) -- [Update/SetDisablePauseUXAccess](#update-setdisablepauseuxaccess) -- [Update/SetDisableUXWUAccess](#update-setdisableuxwuaccess) -- [Update/UpdateServiceUrl](#update-updateserviceurl) - - - -## Update policies supported by Microsoft Surface Hub - -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/AutoRestartNotificationSchedule](#update-autorestartnotificationschedule) -- [Update/AutoRestartRequiredNotificationDismissal](#update-autorestartrequirednotificationdismissal) -- [Update/BranchReadinessLevel](#update-branchreadinesslevel) -- [Update/DeferFeatureUpdatesPeriodInDays](#update-deferfeatureupdatesperiodindays) -- [Update/DeferQualityUpdatesPeriodInDays](#update-deferqualityupdatesperiodindays) -- [Update/DetectionFrequency](#update-detectionfrequency) -- [Update/PauseFeatureUpdates](#update-pausefeatureupdates) -- [Update/PauseQualityUpdates](#update-pausequalityupdates) -- [Update/ScheduleImminentRestartWarning](#update-scheduleimminentrestartwarning) -- [Update/ScheduleRestartWarning](#update-schedulerestartwarning) -- [Update/SetAutoRestartNotificationDisable](#update-setautorestartnotificationdisable) -- [Update/UpdateServiceUrl](#update-updateserviceurl) -- [Update/UpdateServiceUrlAlternate](#update-updateserviceurlalternate) - - diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 2f545af87b..25ff1652b7 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/12/2018 +ms.date: 08/09/2018 --- # Policy CSP - WindowsDefenderSecurityCenter @@ -107,7 +107,7 @@ ms.date: 07/12/2018 Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -161,7 +161,7 @@ ADMX Info: Mobile Enterprise - cross mark + check mark4 check mark4 check mark4 check mark4 @@ -219,7 +219,7 @@ Valid values: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -353,7 +353,7 @@ ADMX Info: Mobile Enterprise - cross mark + check mark4 check mark4 check mark4 check mark4 @@ -411,7 +411,7 @@ Valid values: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -474,7 +474,7 @@ The following list shows the supported values: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -534,7 +534,7 @@ The following list shows the supported values: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -594,7 +594,7 @@ The following list shows the supported values: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -654,7 +654,7 @@ The following list shows the supported values: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -788,7 +788,7 @@ ADMX Info: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -848,7 +848,7 @@ The following list shows the supported values: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -908,7 +908,7 @@ The following list shows the supported values: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -962,7 +962,7 @@ ADMX Info: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -1022,7 +1022,7 @@ The following list shows the supported values: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -1082,7 +1082,7 @@ The following list shows the supported values: Mobile Enterprise - cross mark + check mark4 check mark4 check mark4 check mark4 @@ -1140,7 +1140,7 @@ Valid values: Mobile Enterprise - cross mark + check mark4 check mark4 check mark4 check mark4 @@ -1198,7 +1198,7 @@ Valid values: Mobile Enterprise - cross mark + check mark4 check mark4 check mark4 check mark4 @@ -1332,7 +1332,7 @@ ADMX Info: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 @@ -1386,7 +1386,7 @@ ADMX Info: Mobile Enterprise - cross mark + check mark3 check mark3 check mark3 check mark3 diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 6c1ca5bd2d..96beff9c33 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2018 +ms.date: 08/09/2018 --- # Policy CSP - WirelessDisplay @@ -363,6 +363,29 @@ The following list shows the supported values: **WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver** + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark2check mark2check mark2check mark2cross markcross mark
    + + [Scope](./policy-configuration-service-provider.md#policy-scope): diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index 624c67cddb..d841e29aa4 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/03/2018 +ms.date: 08/09/2018 --- # Policy DDF file @@ -1406,30 +1406,6 @@ Related policy: - - ForceEnabledExtensions - - - - - - - - This setting lets you decide which extensions should be always enabled. - - - - - - - - - - - text/plain - - - HomePages @@ -1654,6 +1630,47 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + PreventTurningOffRequiredExtensions + + + + + + + + You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. + +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. + +When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. + +If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. + +If disabled or not configured, extensions defined as part of this policy get ignored. + +Default setting: Disabled or not configured +Related policies: Allow Developer Tools +Related Documents: +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) + + + + + + + + + + + text/plain + + + PreventUsingLocalHostIPAddressForWebRTC @@ -8614,6 +8631,52 @@ Related policy: + + Privacy + + + + + + + + + + + + + + + + + + + + + DisablePrivacyExperience + + + + + + + + Enabling this policy prevents the privacy experience from launching during user logon for new and upgraded users. + + + + + + + + + + + text/plain + + + + Security @@ -10528,34 +10591,6 @@ Related policy: LastWrite - - ForceEnabledExtensions - - - - - - This setting lets you decide which extensions should be always enabled. - - - - - - - - - - - text/plain - - phone - MicrosoftEdge.admx - ForceEnabledExtensions_List - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ForceEnabledExtensions - LastWrite - - HomePages @@ -10806,6 +10841,51 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on HighestValueMostSecure + + PreventTurningOffRequiredExtensions + + + + + + You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. + +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. + +When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. + +If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. + +If disabled or not configured, extensions defined as part of this policy get ignored. + +Default setting: Disabled or not configured +Related policies: Allow Developer Tools +Related Documents: +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) + + + + + + + + + + + text/plain + + phone + MicrosoftEdge.admx + PreventTurningOffRequiredExtensions_Prompt + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventTurningOffRequiredExtensions + LastWrite + + PreventUsingLocalHostIPAddressForWebRTC @@ -18546,6 +18626,54 @@ Related policy: + + Privacy + + + + + + + + + + + + + + + + + + + DisablePrivacyExperience + + + + + 0 + Enabling this policy prevents the privacy experience from launching during user logon for new and upgraded users. + + + + + + + + + + + text/plain + + + phone + OOBE.admx + OOBE~AT~WindowsComponents~OOBE + DisablePrivacyExperience + LowestValueMostSecure + + + Security @@ -22272,30 +22400,6 @@ Related policy: - - ForceEnabledExtensions - - - - - - - - This setting lets you decide which extensions should be always enabled. - - - - - - - - - - - text/plain - - - HomePages @@ -22520,6 +22624,47 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on + + PreventTurningOffRequiredExtensions + + + + + + + + You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. + +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. + +When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. + +If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. + +If disabled or not configured, extensions defined as part of this policy get ignored. + +Default setting: Disabled or not configured +Related policies: Allow Developer Tools +Related Documents: +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) + + + + + + + + + + + text/plain + + + PreventUsingLocalHostIPAddressForWebRTC @@ -27063,7 +27208,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - DoNotSyncBrowserSetting + DoNotSyncBrowserSettings @@ -27098,7 +27243,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor You can configure Microsoft Edge to allow users to turn on the Sync your Settings option to sync information, such as history and favorites, between user's devices. When enabled and you enable the Do not sync browser setting policy, browser settings sync automatically. If disabled, users have the option to sync the browser settings. - Related policy: DoNotSyncBrowserSetting + Related policy: DoNotSyncBrowserSettings 1 (default) = Do not allow users to turn on syncing, 0 = Allows users to turn on syncing @@ -34352,38 +34497,6 @@ Default: Disabled. - - MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession - - - - - - - - Microsoft network server: Amount of idle time required before suspending a session - -This security setting determines the amount of continuous idle time that must pass in a Server Message Block (SMB) session before the session is suspended due to inactivity. - -Administrators can use this policy to control when a computer suspends an inactive SMB session. If client activity resumes, the session is automatically reestablished. - -For this policy setting, a value of 0 means to disconnect an idle session as quickly as is reasonably possible. The maximum value is 99999, which is 208 days; in effect, this value disables the policy. - -Default:This policy is not defined, which means that the system treats it as 15 minutes for servers and undefined for workstations. - - - - - - - - - - - text/plain - - - MicrosoftNetworkServer_DigitallySignCommunicationsAlways @@ -36623,6 +36736,30 @@ The options are: + + DisablePrivacyExperience + + + + + + + + Enabling this policy prevents the privacy experience from launching during user logon for new and upgraded users. + + + + + + + + + + + text/plain + + + EnableActivityFeed @@ -41468,6 +41605,30 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + AllowDeviceNameInDiagnosticData + + + + + + + + This policy allows the device name to be sent to Microsoft as part of Windows diagnostic data. If you disable or do not configure this policy setting, then device name will not be sent to Microsoft as part of Windows diagnostic data. + + + + + + + + + + + text/plain + + + AllowEmbeddedMode @@ -44073,7 +44234,7 @@ Caution: If a Restricted Groups policy is applied, any current member not on the - UpdateNotificationKioskMode + UpdateNotificationLevel @@ -49551,34 +49712,6 @@ Related policy: LastWrite - - ForceEnabledExtensions - - - - - - This setting lets you decide which extensions should be always enabled. - - - - - - - - - - - text/plain - - phone - MicrosoftEdge.admx - ForceEnabledExtensions_List - MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge - ForceEnabledExtensions - LastWrite - - HomePages @@ -49829,6 +49962,51 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on HighestValueMostSecure + + PreventTurningOffRequiredExtensions + + + + + + You can define a list of extensions in Microsoft Edge that users cannot turn off. You must deploy extensions through any available enterprise deployment channel, such as Microsoft Intune. When you enable this policy, users cannot uninstall extensions from their computer, but they can configure options for extensions defined in this policy, such as allow for InPrivate browsing. Any additional permissions requested by future updates of the extension gets granted automatically. + +When you enable this policy, you must provide a semi-colon delimited list of extension package family names (PFNs). For example, adding Microsoft.OneNoteWebClipper_8wekyb3d8bbwe;Microsoft.OfficeOnline_8wekyb3d8bbwe prevents a user from turning off the OneNote Web Clipper and Office Online extension. + +When enabled, removing extensions from the list does not uninstall the extension from the user’s computer automatically. To uninstall the extension, use any available enterprise deployment channel. + +If you enable the Allow Developer Tools policy, then this policy does not prevent users from debugging and altering the logic on an extension. + +If disabled or not configured, extensions defined as part of this policy get ignored. + +Default setting: Disabled or not configured +Related policies: Allow Developer Tools +Related Documents: +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) + + + + + + + + + + + text/plain + + phone + MicrosoftEdge.admx + PreventTurningOffRequiredExtensions_Prompt + MicrosoftEdge~AT~WindowsComponents~MicrosoftEdge + PreventTurningOffRequiredExtensions + LastWrite + + PreventUsingLocalHostIPAddressForWebRTC @@ -53218,7 +53396,7 @@ Related policy: - EnableSystemGuard + ConfigureSystemGuardLaunch @@ -54899,7 +55077,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor - DoNotSyncBrowserSetting + DoNotSyncBrowserSettings @@ -54935,7 +55113,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor 1 You can configure Microsoft Edge to allow users to turn on the Sync your Settings option to sync information, such as history and favorites, between user's devices. When enabled and you enable the Do not sync browser setting policy, browser settings sync automatically. If disabled, users have the option to sync the browser settings. - Related policy: DoNotSyncBrowserSetting + Related policy: DoNotSyncBrowserSettings 1 (default) = Do not allow users to turn on syncing, 0 = Allows users to turn on syncing @@ -63004,41 +63182,6 @@ Default: Disabled. LastWrite - - MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession - - - - - 15 - Microsoft network server: Amount of idle time required before suspending a session - -This security setting determines the amount of continuous idle time that must pass in a Server Message Block (SMB) session before the session is suspended due to inactivity. - -Administrators can use this policy to control when a computer suspends an inactive SMB session. If client activity resumes, the session is automatically reestablished. - -For this policy setting, a value of 0 means to disconnect an idle session as quickly as is reasonably possible. The maximum value is 99999, which is 208 days; in effect, this value disables the policy. - -Default:This policy is not defined, which means that the system treats it as 15 minutes for servers and undefined for workstations. - - - - - - - - - - - text/plain - - - phone - Windows Settings~Security Settings~Local Policies~Security Options - Microsoft network server: Amount of idle time required before suspending session - LowestValueMostSecure - - MicrosoftNetworkServer_DigitallySignCommunicationsAlways @@ -63402,7 +63545,7 @@ This setting can affect the ability of computers running Windows 2000 Server, Wi - 0 + 3 Network security LAN Manager authentication level This security setting determines which challenge/response authentication protocol is used for network logons. This choice affects the level of authentication protocol used by clients, the level of session security negotiated, and the level of authentication accepted by servers as follows: @@ -63455,7 +63598,7 @@ Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send - 0 + 536870912 Network security: Minimum session security for NTLM SSP based (including secure RPC) clients This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: @@ -63493,7 +63636,7 @@ Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - 0 + 536870912 Network security: Minimum session security for NTLM SSP based (including secure RPC) servers This security setting allows a server to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: @@ -65452,6 +65595,34 @@ The options are: LowestValueMostSecureZeroHasNoLimits + + DisablePrivacyExperience + + + + + 0 + Enabling this policy prevents the privacy experience from launching during user logon for new and upgraded users. + + + + + + + + + + + text/plain + + + phone + OOBE.admx + OOBE~AT~WindowsComponents~OOBE + DisablePrivacyExperience + LowestValueMostSecure + + EnableActivityFeed @@ -69810,12 +69981,12 @@ Caution: If a Restricted Groups policy is applied, any current member not on the text/plain - + phone SmartScreen.admx SmartScreen~AT~WindowsComponents~SmartScreen~Shell ConfigureAppInstallControl - HighestValueMostSecure + LastWrite @@ -70823,6 +70994,34 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LowestValueMostSecure + + AllowDeviceNameInDiagnosticData + + + + + 0 + This policy allows the device name to be sent to Microsoft as part of Windows diagnostic data. If you disable or do not configure this policy setting, then device name will not be sent to Microsoft as part of Windows diagnostic data. + + + + + + + + + + + text/plain + + + DataCollection.admx + AllowDeviceNameInDiagnosticData + DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds + AllowDeviceNameInDiagnosticData + LowestValueMostSecure + + AllowEmbeddedMode @@ -72934,7 +73133,7 @@ Caution: If a Restricted Groups policy is applied, any current member not on the text/plain - + WindowsUpdate.admx EngagedRestartTransitionSchedule WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat @@ -72962,7 +73161,7 @@ Caution: If a Restricted Groups policy is applied, any current member not on the text/plain - + WindowsUpdate.admx EngagedRestartTransitionScheduleForFeatureUpdates WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat @@ -73677,7 +73876,7 @@ Caution: If a Restricted Groups policy is applied, any current member not on the - UpdateNotificationKioskMode + UpdateNotificationLevel @@ -73699,7 +73898,7 @@ Caution: If a Restricted Groups policy is applied, any current member not on the WindowsUpdate.admx WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat - UpdateNotificationKioskMode + UpdateNotificationLevel LastWrite @@ -75931,4 +76130,4 @@ Because of these factors, users do not usually need this user right. Warning: If -``` +``` \ No newline at end of file diff --git a/windows/client-management/mdm/reboot-csp.md b/windows/client-management/mdm/reboot-csp.md index b5bccdbf85..bfb5dfd307 100644 --- a/windows/client-management/mdm/reboot-csp.md +++ b/windows/client-management/mdm/reboot-csp.md @@ -41,7 +41,7 @@ The following diagram shows the Reboot configuration service provider management

    The supported operations are Get, Add, Replace, and Delete.

    **Schedule/DailyRecurrent** -

    This node will execute a reboot each day at a scheduled time starting at the configured starting time and date. Setting a null (empty) date will delete the existing schedule. The date and time value is ISO8601, and both the date and time are required. For example: 2015-12-15T07:36:25Z

    +

    This node will execute a reboot each day at a scheduled time starting at the configured starting time and date. Setting a null (empty) date will delete the existing schedule. The date and time value is ISO8601, and both the date and time are required. The CSP will return the date time in the following format: 2018-06-29T10:00:00+01:00.

    The supported operations are Get, Add, Replace, and Delete.

    diff --git a/windows/client-management/mdm/remotewipe-csp.md b/windows/client-management/mdm/remotewipe-csp.md index 366bb79824..82818fd8da 100644 --- a/windows/client-management/mdm/remotewipe-csp.md +++ b/windows/client-management/mdm/remotewipe-csp.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 03/23/2018 +ms.date: 08/13/2018 --- # RemoteWipe CSP @@ -44,7 +44,28 @@ Supported operation is Exec. **doWipePersistUserData** Added in Windows 10, version 1709. Exec on this node will perform a remote reset on the device and persist user accounts and data. The return status code shows whether the device accepted the Exec command. -  + +**AutomaticRedeployment** +Added in Windows 10, next major update. Node for the Autopilot Reset operation. + +**AutomaticRedeployment/doAutomaticRedeployment** +Added in Windows 10, next major update. Exec on this node triggers Autopilot Reset operation. This works like PC Reset, similar to other existing nodes in this RemoteWipe CSP, except that it keeps the device enrolled in Azure AD and MDM, keeps Wi-Fi profiles, and a few other settings like region, language, keyboard. + +**AutomaticRedeployment/LastError** +Added in Windows 10, next major update. Error value, if any, associated with Autopilot Reset operation (typically an HRESULT). + +**AutomaticRedeployment/Status** +Added in Windows 10, next major update. Status value indicating current state of an Autopilot Reset operation. + +Supported values: + +- 0: Never run (not started). The default state. +- 1: Complete. +- 10: Reset has been scheduled. +- 20: Reset is scheduled and waiting for a reboot. +- 30: Failed during CSP Execute ("Exec" in SyncML). +- 40: Failed: power requirements not met. +- 50: Failed: reset internals failed during reset attempt. ## Related topics diff --git a/windows/client-management/mdm/remotewipe-ddf-file.md b/windows/client-management/mdm/remotewipe-ddf-file.md index 0f0de9b725..b2adadcfd1 100644 --- a/windows/client-management/mdm/remotewipe-ddf-file.md +++ b/windows/client-management/mdm/remotewipe-ddf-file.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 03/23/2018 +ms.date: 08/13/2018 --- # RemoteWipe DDF file @@ -17,7 +17,7 @@ This topic shows the OMA DM device description framework (DDF) for the **RemoteW Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is the DDF for Windows 10, version 1709. +The XML below is the DDF for Windows 10, next major version. ``` syntax @@ -43,7 +43,7 @@ The XML below is the DDF for Windows 10, version 1709. - + com.microsoft/1.1/MDM/RemoteWipe The root node for remote wipe function. @@ -131,21 +131,91 @@ The XML below is the DDF for Windows 10, version 1709. Exec on this node will perform a remote reset on the device and persist user accounts and data. The return status code shows whether the device accepted the Exec command. + + AutomaticRedeployment + + + + + + + + + + + + + + + + + + + doAutomaticRedeployment + + + + + + + + + + + + + + + + text/plain + + + + + LastError + + + + + 0 + Error value, if any, associated with Automatic Redeployment operation (typically an HRESULT). + + + + + + + + + + + text/plain + + + + + Status + + + + + 0 + Status value indicating current state of an Automatic Redeployment operation. 0: Never run (not started). The default state. 1: Complete. 10: Reset has been scheduled. 20: Reset is scheduled and waiting for a reboot. 30: Failed during CSP Execute ("Exec" in SyncML). 40: Failed: power requirements not met. 50: Failed: reset internals failed during reset attempt. + + + + + + + + + + + text/plain + + + + -``` - -## Related topics - - -[RemoteWipe configuration service provider](remotewipe-csp.md) - -  - -  - - - - - - +``` \ No newline at end of file diff --git a/windows/client-management/mdm/tenantlockdown-csp.md b/windows/client-management/mdm/tenantlockdown-csp.md new file mode 100644 index 0000000000..43449f403a --- /dev/null +++ b/windows/client-management/mdm/tenantlockdown-csp.md @@ -0,0 +1,39 @@ +--- +title: TenantLockdown CSP +description: +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: MariciaAlforque +ms.date: 08/13/2018 +--- + +# TenantLockdown CSP + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. This CSP was added in Windows 10, next major version. + +The TenantLockdown configuration service provider is used by the IT admin to lock a device to a tenant, which ensures that the device remains bound to the tenant in case of accidental or intentional resets or wipes. + +> [!Note] +> The forced network connection is only applicable to devices after reset (not new). + +The following diagram shows the TenantLockdown configuration service provider in tree format. + +![TenantLockdown CSP diagram](images/provisioning-csp-tenantlockdown.png) + +**./Vendor/MSFT/TenantLockdown** +The root node. + +**RequireNetworkInOOBE** +Specifies whether to require a network connection during the out-of-box experience (OOBE) at first logon. + +When RequireNetworkInOOBE is true, when the device goes through OOBE at first logon or after a reset, the user is required to choose a network before proceeding. There is no "skip for now" option. + +Value type is bool. Supported operations are Get and Replace. + +- true - Require network in OOBE +- false - No network connection requirement in OOBE + +Example scenario: Henry is the IT admin at Contoso. He deploys 1000 devices successfully with RequireNetworkInOOBE set to true. When users accidentally or intentionally reset their device, they are required to connect to a network before they can proceed. Upon successful connection, users see the Contoso branded sign-in experience where they must use their Azure AD credentials. There is no option to skip the network connection and create a local account. \ No newline at end of file diff --git a/windows/client-management/mdm/tenantlockdown-ddf.md b/windows/client-management/mdm/tenantlockdown-ddf.md new file mode 100644 index 0000000000..4c75123a3f --- /dev/null +++ b/windows/client-management/mdm/tenantlockdown-ddf.md @@ -0,0 +1,75 @@ +--- +title: TenantLockdown DDF file +description: XML file containing the device description framework +ms.author: maricia +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: MariciaAlforque +ms.date: 08/13/2018 +--- + +# TenantLockdown DDF file + +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + +This topic shows the OMA DM device description framework (DDF) for the **TenantLockdown** configuration service provider. + +Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). + +The XML below is for Windows 10, next major version. + +``` syntax + +]> + + 1.2 + + TenantLockdown + ./Vendor/MSFT + + + + + + + + + + + + + + + com.microsoft/1.0/MDM/TenantLockdown + + + + RequireNetworkInOOBE + + + + + + false + true - Require network in OOBE, false - no network connection requirement in OOBE + + + + + + + + + + + text/plain + + + + + +``` \ No newline at end of file diff --git a/windows/client-management/mdm/win32compatibilityappraiser-csp.md b/windows/client-management/mdm/win32compatibilityappraiser-csp.md index 5efc199b30..5718fd4b66 100644 --- a/windows/client-management/mdm/win32compatibilityappraiser-csp.md +++ b/windows/client-management/mdm/win32compatibilityappraiser-csp.md @@ -16,7 +16,7 @@ ms.date: 07/19/2018 The Win32CompatibilityAppraiser configuration service provider enables the IT admin to query the current status of the Appraiser and UTC telementry health. This CSP was added in Windows 10, next major version. -The following diagram shows the Storage configuration service provider in tree format. +The following diagram shows the Win32CompatibilityAppraiser configuration service provider in tree format. ![Win32CompatibilityAppraiser CSP diagram](images/provisioning-csp-win32compatibilityappraiser.png) diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md index de75c4898d..6f359562af 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md @@ -6,11 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 03/22/2018 +ms.date: 08/02/2018 --- # WindowsDefenderApplicationGuard CSP +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. The WindowsDefenderApplicationGuard configuration service provider (CSP) is used by the enterprise to configure the settings in the Application Guard. This CSP was added in Windows 10, version 1709. @@ -19,20 +21,19 @@ The following diagram shows the WindowsDefenderApplicationGuard configuration se ![windowsdefenderapplicationguard csp](images/provisioning-csp-windowsdefenderapplicationguard.png) **./Device/Vendor/MSFT/WindowsDefenderApplicationGuard** -

    Root node. Supported operation is Get.

    -

    +Root node. Supported operation is Get. **Settings** -

    Interior node. Supported operation is Get.

    +Interior node. Supported operation is Get. **Settings/AllowWindowsDefenderApplicationGuard** -

    Turn on Windows Defender Application Guard in Enterprise Mode. Value type is integer. Supported operations are Add, Get, Replace, and Delete.

    +Turn on Windows Defender Application Guard in Enterprise Mode. Value type is integer. Supported operations are Add, Get, Replace, and Delete. - 0 - Stops Application Guard in Enterprise Mode. Trying to access non-enterprise domains on the host will not automatically get transferred into the insolated environment. - 1 - Enables Application Guard in Enterprise Mode. Trying to access non-enterprise websites on the host will automatically get transferred into the container. **Settings/ClipboardFileType** -

    Determines the type of content that can be copied from the host to Application Guard environment and vice versa. Value type is integer. Supported operations are Add, Get, Replace, and Delete.

    +Determines the type of content that can be copied from the host to Application Guard environment and vice versa. Value type is integer. Supported operations are Add, Get, Replace, and Delete. - 0 - Disables content copying. - 1 - Allow text copying. @@ -40,7 +41,7 @@ The following diagram shows the WindowsDefenderApplicationGuard configuration se - 3 - Allow text and image copying. **Settings/ClipboardSettings** -

    This policy setting allows you to decide how the clipboard behaves while in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete

    +This policy setting allows you to decide how the clipboard behaves while in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete - 0 (default) - Completely turns Off the clipboard functionality for the Application Guard. - 1 - Turns On clipboard operation from an isolated session to the host @@ -51,7 +52,7 @@ The following diagram shows the WindowsDefenderApplicationGuard configuration se > Allowing copied content to go from Microsoft Edge into Application Guard can cause potential security risks and isn't recommended. **Settings/PrintingSettings** -

    This policy setting allows you to decide how the print functionality behaves while in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete.

    +This policy setting allows you to decide how the print functionality behaves while in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete. - 0 - Disables all print functionality (default) - 1 - Enables only XPS printing @@ -70,13 +71,13 @@ The following diagram shows the WindowsDefenderApplicationGuard configuration se - 15 - Enables all printing **Settings/BlockNonEnterpriseContent** -

    This policy setting allows you to decide whether websites can load non-enterprise content in Microsoft Edge and Internet Explorer. Value type is integer. Supported operations are Add, Get, Replace, and Delete.

    +This policy setting allows you to decide whether websites can load non-enterprise content in Microsoft Edge and Internet Explorer. Value type is integer. Supported operations are Add, Get, Replace, and Delete. -- 0 - Non-enterprise content embedded on enterprise sites are stopped from opening in Internet Explorer or Microsoft Edge outside of Windows Defender Application Guard. -- 1 (default) - Non-enterprise sites can open outside of the Windows Defender Application Guard container, directly in Internet Explorer and Microsoft Edge. +- 0 (default) - Non-enterprise content embedded in enterprise sites is allowed to open outside of the Windows Defender Application Guard container, directly in Internet Explorer and Microsoft Edge.. +- 1 - Non-enterprise content embedded on enterprise sites are stopped from opening in Internet Explorer or Microsoft Edge outside of Windows Defender Application Guard. **Settings/AllowPersistence** -

    This policy setting allows you to decide whether data should persist across different sessions in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete.

    +This policy setting allows you to decide whether data should persist across different sessions in Application Guard. Value type is integer. Supported operations are Add, Get, Replace, and Delete. - 0 - Application Guard discards user-downloaded files and other items (such as, cookies, Favorites, and so on) during machine restart or user log-off. - 1 - Application Guard saves user-downloaded files and other items (such as, cookies, Favorites, and so on) for use in future Application Guard sessions. @@ -93,29 +94,62 @@ Added in Windows 10, version 1803. This policy setting allows you to determine w - 0 (default) - The user cannot download files from Edge in the container to the host file system. When the policy is not configured, it is the same as disabled (0). - 1 - Turns on the functionality to allow users to download files from Edge in the container to the host file system. -**Status** -

    Returns bitmask that indicates status of Application Guard installation and pre-requisites on the device. Value type is integer. Supported operation is Get. +**Settings/FileTrustCriteria** +Placeholder for future use. Do not use in production code. -Bit 0 - Set to 1 when WDAG is enabled into enterprise manage mode +**Settings/FileTrustOriginRemovableMedia** +Placeholder for future use. Do not use in production code. + +**Settings/FileTrustOriginNetworkShare** +Placeholder for future use. Do not use in production code. + +**Settings/FileTrustOriginMarkOfTheWeb** +Placeholder for future use. Do not use in production code. + +**Settings/CertificateThumbprints** +Added in Windows 10, next major version. This policy setting allows certain Root Certificates to be shared with the Windows Defender Application Guard container. + +Value type is string. Supported operations are Add, Get, Replace, and Delete. + +If you enable this setting, certificates with a thumbprint matching the ones specified will be transferred into the container. You can specify multiple certificates using a comma to separate the thumbprints for each certificate you want to transfer. + +Example: b4e72779a8a362c860c36a6461f31e3aa7e58c14,1b1d49f06d2a697a544a1059bd59a7b058cda924 + +If you disable or don’t configure this setting, certificates are not shared with the Windows Defender Application Guard container. + +**Settings/AllowCameraMicrophoneRedirection** +Added in Windows 10, next major version. The policy allows you to determine whether applications inside Windows Defender Application Guard can access the device’s camera and microphone when these settings are enabled on the user’s device. + +Value type is integer. Supported operations are Add, Get, Replace, and Delete. + +If you enable this policy, applications inside Windows Defender Application Guard will be able to access the camera and microphone on the user’s device. + +If you disable or don't configure this policy, applications inside Windows Defender Application Guard will be unable to access the camera and microphone on the user’s device. + +> [!Important] +> If you turn on this policy, a compromised container could bypass camera and microphone permissions and access the camera and microphone without the user's knowledge. To prevent unauthorized access, we recommend that camera and microphone privacy settings be turned off on the user's device when they are not needed. + +**Status** +Returns bitmask that indicates status of Application Guard installation and pre-requisites on the device. Value type is integer. Supported operation is Get. + +Bit 0 - Set to 1 when WDAG is enabled into enterprise manage mode Bit 1 - Set to 1 when the client machine is Hyper-V capable Bit 2 - Set to 1 when the client machine has a valid OS license and SKU Bit 3 - Set to 1 when WDAG installed on the client machine Bit 4 - Set to 1 when required Network Isolation Policies are configured Bit 5 - Set to 1 when the client machine meets minimum hardware requirements -

    - **InstallWindowsDefenderApplicationGuard** -

    Initiates remote installation of Application Guard feature. Supported operations are Get and Execute.

    +Initiates remote installation of Application Guard feature. Supported operations are Get and Execute. - Install - Will initiate feature install - Uninstall - Will initiate feature uninstall **Audit** -

    Interior node. Supported operation is Get

    +Interior node. Supported operation is Get **Audit/AuditApplicationGuard** -

    This policy setting allows you to decide whether auditing events can be collected from Application Guard. Value type in integer. Supported operations are Add, Get, Replace, and Delete.

    +This policy setting allows you to decide whether auditing events can be collected from Application Guard. Value type in integer. Supported operations are Add, Get, Replace, and Delete. - 0 (default) - - Audit event logs aren't collected for Application Guard. - 1 - Application Guard inherits its auditing policies from Microsoft Edge and starts to audit system events specifically for Application Guard. diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md index 33e53da2a3..dfda523b86 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-ddf-file.md @@ -6,17 +6,19 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 03/22/2018 +ms.date: 08/02/2018 --- # WindowsDefenderApplicationGuard DDF file +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. This topic shows the OMA DM device description framework (DDF) for the **WindowsDefenderApplicationGuard** configuration service provider. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -This XML is for Windows 10, version 1803. +This XML is for Windows 10, next major version. ``` syntax @@ -42,7 +44,7 @@ This XML is for Windows 10, version 1803. - com.microsoft/1.2/MDM/WindowsDefenderApplicationGuard + com.microsoft/1.3/MDM/WindowsDefenderApplicationGuard @@ -248,6 +250,147 @@ This XML is for Windows 10, version 1803. + + FileTrustCriteria + + + + + + + + + + + + + + + + + + text/plain + + + + + FileTrustOriginRemovableMedia + + + + + + + + + + + + + + + + + + text/plain + + + + + FileTrustOriginNetworkShare + + + + + + + + + + + + + + + + + + text/plain + + + + + FileTrustOriginMarkOfTheWeb + + + + + + + + + + + + + + + + + + text/plain + + + + + CertificateThumbprints + + + + + + + + + + + + + + + + + + + + + text/plain + + + + + AllowCameraMicrophoneRedirection + + + + + + + + + + + + + + + + + + text/plain + + + Status diff --git a/windows/client-management/mdm/windowslicensing-csp.md b/windows/client-management/mdm/windowslicensing-csp.md index 1e61634c31..5957967b3e 100644 --- a/windows/client-management/mdm/windowslicensing-csp.md +++ b/windows/client-management/mdm/windowslicensing-csp.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 07/25/2018 +ms.date: 08/15/2018 --- # WindowsLicensing CSP @@ -182,6 +182,13 @@ Added in Windows 10, next major version. Returns the status of the latest Switch Value type is integer. Supported operation is Get. +Values: +- Request fails with error code 404 - no SwitchFromSMode request has been made. +- 0 - The device successfully switched out of S mode +- 1 - The device is processing the request to switch out of S mode +- 3 - The device was already switched out of S mode +- 4 - The device failed to switch out of S mode + ## SyncML examples diff --git a/windows/configuration/TOC.md b/windows/configuration/TOC.md index 6480fcac26..dad54fdffa 100644 --- a/windows/configuration/TOC.md +++ b/windows/configuration/TOC.md @@ -1,13 +1,20 @@ # [Configure Windows 10](index.md) ## [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) -## [Configure kiosk and shared devices running Windows 10 desktop editions](kiosk-shared-pc.md) -### [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) -### [Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education](setup-kiosk-digital-signage.md) -### [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) -### [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) +## [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) +## [Configure kiosks and digital signs on Windows desktop editions](kiosk-methods.md) +### [Prepare a device for kiosk configuration](kiosk-prepare.md) +### [Set up digital signs on Windows 10](setup-digital-signage.md) +### [Set up a single-app kiosk](kiosk-single-app.md) +### [Set up a multi-app kiosk](lock-down-windows-10-to-specific-apps.md) +### [More kiosk methods and reference information](kiosk-additional-reference.md) +#### [Validate your kiosk configuration](kiosk-validate.md) +#### [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) +#### [Policies enforced on kiosk devices](kiosk-policies.md) +#### [Assigned access XML reference](kiosk-xml.md) +#### [Use AppLocker to create a Windows 10 kiosk](lock-down-windows-10-applocker.md) +#### [Use Shell Launcher to create a Windows 10 kiosk](kiosk-shelllauncher.md) +#### [Use MDM Bridge WMI Provider to create a Windows 10 kiosk](kiosk-mdm-bridge.md) #### [Troubleshoot multi-app kiosk](multi-app-kiosk-troubleshoot.md) -#### [Use AppLocker to create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-applocker.md) -### [Assigned Access configuration (kiosk) XML reference](kiosk-xml.md) ## [Configure Windows 10 Mobile devices](mobile-devices/configure-mobile.md) ### [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md) ### [Use Windows Configuration Designer to configure Windows 10 Mobile devices](mobile-devices/provisioning-configure-mobile.md) diff --git a/windows/configuration/change-history-for-configure-windows-10.md b/windows/configuration/change-history-for-configure-windows-10.md index 8fac2d4142..6ec85f01c1 100644 --- a/windows/configuration/change-history-for-configure-windows-10.md +++ b/windows/configuration/change-history-for-configure-windows-10.md @@ -10,14 +10,24 @@ ms.localizationpriority: medium author: jdeckerms ms.author: jdecker ms.topic: article -ms.date: 06/27/2018 +ms.date: 08/03/2018 --- # Change history for Configure Windows 10 This topic lists new and updated topics in the [Configure Windows 10](index.md) documentation for Windows 10 and Windows 10 Mobile. +## August 2018 +New or changed topic | Description +--- | --- +[Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) | Added instructions for specifying multiple URLs in configuration settings for Kiosk Browser. + +## July 2018 + +New or changed topic | Description +--- | --- +[Configure kiosks and child topics](kiosk-methods.md) | Reorganized the information for configuring kiosks into new topics, and moved [Set up shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md). ## June 2018 @@ -70,7 +80,7 @@ New or changed topic | Description New or changed topic | Description --- | --- [Windows 10, version 1709 basic diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) and [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) | Added events and fields that were added in the March update. -Set up a kiosk on Windows 10 Pro, Enterprise, or Education | Renamed it [Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education](setup-kiosk-digital-signage.md) and reorganized the information to make the choices clearer. +Set up a kiosk on Windows 10 Pro, Enterprise, or Education | Renamed it **Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education** and reorganized the information to make the choices clearer. ## February 2018 diff --git a/windows/configuration/guidelines-for-assigned-access-app.md b/windows/configuration/guidelines-for-assigned-access-app.md index 844295ad38..a032dc458d 100644 --- a/windows/configuration/guidelines-for-assigned-access-app.md +++ b/windows/configuration/guidelines-for-assigned-access-app.md @@ -1,6 +1,6 @@ --- title: Guidelines for choosing an app for assigned access (Windows 10) -description: You can configure Windows 10 as a kiosk device, so that users can only interact with a single app. +description: The following guidelines may help you choose an appropriate Windows app for your assigned access experience. keywords: ["kiosk", "lockdown", "assigned access"] ms.prod: w10 ms.mktglfcycl: manage @@ -9,7 +9,7 @@ author: jdeckerms ms.localizationpriority: medium ms.author: jdecker ms.topic: article -ms.date: 05/31/2018 +ms.date: 08/15/2018 --- # Guidelines for choosing an app for assigned access (kiosk mode) @@ -45,6 +45,9 @@ Avoid selecting Windows apps that are designed to launch other apps as part of t In Windows 10, version 1803, you can install the **Kiosk Browser** app from Microsoft to use as your kiosk app. For digital signage scenarios, you can configure **Kiosk Browser** to navigate to a URL and show only that content -- no navigation buttons, no address bar, etc. For kiosk scenarios, you can configure additional settings, such as allowed and blocked URLs, navigation buttons, and end session buttons. For example, you could configure your kiosk to show the online catalog for your store, where customers can navigate between departments and items, but aren’t allowed to go to a competitor's website. +>[!NOTE] +>Kiosk Browser supports a single tab. If a website has links that open a new tab, those links will not work with Kiosk Browser. + **Kiosk Browser** must be downloaded for offline licensing using Microsoft Store For Business. You can deploy **Kiosk Browser** to devices running Windows 10, version 1803 (Pro, Business, Enterprise, and Education). @@ -55,18 +58,29 @@ In Windows 10, version 1803, you can install the **Kiosk Browser** app from Micr >[!NOTE] >If you configure the kiosk using a provisioning package, you must apply the provisioning package after the device completes the out-of-box experience (OOBE). -#### Kiosk Browser settings +### Kiosk Browser settings Kiosk Browser settings | Use this setting to --- | --- -Blocked URL Exceptions | Specify URLs that people can navigate to, even though the URL is in your blocked URL list. You can use wildcards.

    For example, if you want people to be limited to `contoso.com` only, you would add `contoso.com` to blocked URL exception list and then block all other URLs. -Blocked URLs | Specify URLs that people can't navigate to. You can use wildcards.

    If you want to limit people to a specific site, add `https://*` to the blocked URL list, and then specify the site to be allowed in the blocked URL exceptions list. +Blocked URL Exceptions | Specify URLs that people can navigate to, even though the URL is in your blocked URL list. You can use wildcards.

    For example, if you want people to be limited to `contoso.com` only, you would add `contoso.com` to blocked URL exception list and then block all other URLs. +Blocked URLs | Specify URLs that people can't navigate to. You can use wildcards.

    If you want to limit people to a specific site, add `https://*` to the blocked URL list, and then specify the site to be allowed in the blocked URL exceptions list. Default URL | Specify the URL that Kiosk Browser will open with. **Tip!** Make sure your blocked URLs don't include your default URL. Enable End Session Button | Show a button in Kiosk Browser that people can use to reset the browser. End Session will clear all browsing data and navigate back to the default URL. Enable Home Button | Show a Home button in Kiosk Browser. Home will return the browser to the default URL. Enable Navigation Buttons | Show forward and back buttons in Kiosk Browser. Restart on Idle Time | Specify when Kiosk Browser should restart in a fresh state after an amount of idle time since the last user interaction. +>[!IMPORTANT] +>To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in Windows Configuration Designer: +> +> 1. Create the provisioning package. When ready to export, close the project in Windows Configuration Designer. +>2. Open the customizations.xml file in the project folder (e.g C:\Users\name\Documents\Windows Imaging and Configuration Designer (WICD)\Project_18). +>3. Insert the null character string in between each URL (e.g www.bing.comwww.contoso.com). +>4. Save the XML file. +>5. Open the project again in Windows Configuration Designer. +>6. Export the package. Ensure you do not revisit the created policies under Kiosk Browser or else the null character will be removed. + + >[!TIP] >To enable the **End Session** button for Kiosk Browser in Intune, you must [create a custom OMA-URI policy](https://docs.microsoft.com/intune/custom-settings-windows-10) with the following information: >- OMA-URI: ./Vendor/MSFT/Policy/Config/KioskBrowser/EnableEndSessionButton diff --git a/windows/configuration/images/kiosk-desktop.PNG b/windows/configuration/images/kiosk-desktop.PNG new file mode 100644 index 0000000000..cf74c646c7 Binary files /dev/null and b/windows/configuration/images/kiosk-desktop.PNG differ diff --git a/windows/configuration/images/kiosk-fullscreen-sm.png b/windows/configuration/images/kiosk-fullscreen-sm.png new file mode 100644 index 0000000000..b096d6837d Binary files /dev/null and b/windows/configuration/images/kiosk-fullscreen-sm.png differ diff --git a/windows/configuration/images/kiosk-fullscreen.PNG b/windows/configuration/images/kiosk-fullscreen.PNG new file mode 100644 index 0000000000..37ccd4f8a4 Binary files /dev/null and b/windows/configuration/images/kiosk-fullscreen.PNG differ diff --git a/windows/configuration/images/kiosk-intune.PNG b/windows/configuration/images/kiosk-intune.PNG new file mode 100644 index 0000000000..2cbe25c6a5 Binary files /dev/null and b/windows/configuration/images/kiosk-intune.PNG differ diff --git a/windows/configuration/images/kiosk-settings.PNG b/windows/configuration/images/kiosk-settings.PNG new file mode 100644 index 0000000000..51a4338371 Binary files /dev/null and b/windows/configuration/images/kiosk-settings.PNG differ diff --git a/windows/configuration/images/kiosk-wizard.png b/windows/configuration/images/kiosk-wizard.png new file mode 100644 index 0000000000..160e170e5c Binary files /dev/null and b/windows/configuration/images/kiosk-wizard.png differ diff --git a/windows/configuration/images/kiosk.png b/windows/configuration/images/kiosk.png new file mode 100644 index 0000000000..868ea31bb1 Binary files /dev/null and b/windows/configuration/images/kiosk.png differ diff --git a/windows/configuration/images/office-logo.png b/windows/configuration/images/office-logo.png new file mode 100644 index 0000000000..cd6d504301 Binary files /dev/null and b/windows/configuration/images/office-logo.png differ diff --git a/windows/configuration/images/set-assignedaccess.png b/windows/configuration/images/set-assignedaccess.png new file mode 100644 index 0000000000..c2899361eb Binary files /dev/null and b/windows/configuration/images/set-assignedaccess.png differ diff --git a/windows/configuration/images/user.PNG b/windows/configuration/images/user.PNG new file mode 100644 index 0000000000..d1386d4a0d Binary files /dev/null and b/windows/configuration/images/user.PNG differ diff --git a/windows/configuration/images/windows.png b/windows/configuration/images/windows.png new file mode 100644 index 0000000000..e3889eff6a Binary files /dev/null and b/windows/configuration/images/windows.png differ diff --git a/windows/configuration/index.md b/windows/configuration/index.md index 5ed671a894..11ec530a2c 100644 --- a/windows/configuration/index.md +++ b/windows/configuration/index.md @@ -22,7 +22,8 @@ Enterprises often need to apply custom configurations to devices for their users | Topic | Description | | --- | --- | | [Manage Wi-Fi Sense in your company](manage-wifi-sense-in-enterprise.md) | Wi-Fi Sense automatically connects you to Wi-Fi, so you can get online quickly in more places. It can connect you to open Wi-Fi hotspots it knows about through crowdsourcing, or to Wi-Fi networks your contacts have shared with you by using Wi-Fi Sense. The initial settings for Wi-Fi Sense are determined by the options you chose when you first set up your PC with Windows 10. | -| [Configure kiosk and shared devices running Windows 10 desktop editions](kiosk-shared-pc.md) | These topics help you configure Windows 10 devices to be shared by multiple users or to run as a kiosk device that runs a single app. | +| [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) | Windows 10, version 1607, introduced *shared PC mode*, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. | +| [Configure kiosk and digital signage devices running Windows 10 desktop editions](kiosk-methods.md) | These topics help you configure Windows 10 devices to run as a kiosk device. | | [Configure Windows 10 Mobile devices](mobile-devices/configure-mobile.md) | These topics help you configure the features and apps and Start screen for a device running Windows 10 Mobile, as well as how to configure a kiosk device that runs a single app. | | [Configure cellular settings for tablets and PCs](provisioning-apn.md) | Enterprises can provision cellular settings for tablets and PC with built-in cellular modems or plug-in USB modem dongles. | | [Configure Start, taskbar, and lock screen](start-taskbar-lockscreen.md) | A standard, customized Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes. Configuring the taskbar allows the organization to pin useful apps for their employees and to remove apps that are pinned by default. | diff --git a/windows/configuration/kiosk-additional-reference.md b/windows/configuration/kiosk-additional-reference.md new file mode 100644 index 0000000000..8260c569cf --- /dev/null +++ b/windows/configuration/kiosk-additional-reference.md @@ -0,0 +1,37 @@ +--- +title: More kiosk methods and reference information (Windows 10) +description: Find more information for configuring, validating, and troubleshooting kiosk configuration. +ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerms +ms.localizationpriority: medium +ms.date: 07/30/2018 +--- + +# More kiosk methods and reference information + + +**Applies to** + +- Windows 10 Pro, Enterprise, and Education + + +## In this section + +Topic | Description +--- | --- +[Validate your kiosk configuration](kiosk-validate.md) | This topic explain what to expect on a multi-app kiosk. +[Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) | These guidelines will help you choose an appropriate Windows app for your assigned access experience. +[Policies enforced on kiosk devices](kiosk-policies.md) | Learn about the policies enforced on a device when you configure it as a kiosk. +[Assigned access XML reference](kiosk-xml.md) | The XML and XSD for kiosk device configuration. +[Use AppLocker to create a Windows 10 kiosk](lock-down-windows-10-applocker.md) | Learn how to use AppLocker to configure a kiosk device running Windows 10 Enterprise or Windows 10 Education, version 1703 and earlier, so that users can only run a few specific apps. +[Use Shell Launcher to create a Windows 10 kiosk](kiosk-shelllauncher.md) | Using Shell Launcher, you can configure a kiosk device that runs a Windows desktop application as the user interface. +[Use MDM Bridge WMI Provider to create a Windows 10 kiosk](kiosk-mdm-bridge.md) | Environments that use Windows Management Instrumentation (WMI) can use the MDM Bridge WMI Provider to configure the MDM_AssignedAccess class. +[Troubleshoot multi-app kiosk](multi-app-kiosk-troubleshoot.md) | Tips for troubleshooting multi-app kiosk configuration. + + + + diff --git a/windows/configuration/kiosk-mdm-bridge.md b/windows/configuration/kiosk-mdm-bridge.md new file mode 100644 index 0000000000..d2c46dcb4c --- /dev/null +++ b/windows/configuration/kiosk-mdm-bridge.md @@ -0,0 +1,86 @@ +--- +title: Use MDM Bridge WMI Provider to create a Windows 10 kiosk (Windows 10) +description: Environments that use Windows Management Instrumentation (WMI)can use the MDM Bridge WMI Provider to configure the MDM_AssignedAccess class. +ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerms +ms.localizationpriority: medium +ms.date: 07/30/2018 +--- + +# Use MDM Bridge WMI Provider to create a Windows 10 kiosk + + +**Applies to** + +- Windows 10 Pro, Enterprise, and Education + +Environments that use [Windows Management Instrumentation (WMI)](https://msdn.microsoft.com/library/aa394582.aspx) can use the [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224.aspx) to configure the MDM_AssignedAccess class. See [PowerShell Scripting with WMI Bridge Provider](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/using-powershell-scripting-with-the-wmi-bridge-provider) for more details about using a PowerShell script to configure AssignedAccess. + +Here’s an example to set AssignedAccess configuration: + +1. Download the [psexec tool](https://technet.microsoft.com/sysinternals/bb897553.aspx). +2. Run `psexec.exe -i -s cmd.exe`. +3. In the command prompt launched by psexec.exe, enter `powershell.exe` to open PowerShell. +4. Execute the following script: + +```ps +$nameSpaceName="root\cimv2\mdm\dmmap" +$className="MDM_AssignedAccess" +$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className +$obj.Configuration = @" +<?xml version="1.0" encoding="utf-8" ?> +<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"> + <Profiles> + <Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"> + <AllAppsList> + <AllowedApps> + <App AppUserModelId="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> + <App AppUserModelId="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" /> + <App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" /> + <App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" /> + <App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> + <App DesktopAppPath="%windir%\system32\mspaint.exe" /> + <App DesktopAppPath="C:\Windows\System32\notepad.exe" /> + </AllowedApps> + </AllAppsList> + <StartLayout> + <![CDATA[<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"> + <LayoutOptions StartTileGroupCellWidth="6" /> + <DefaultLayoutOverride> + <StartLayoutCollection> + <defaultlayout:StartLayout GroupCellWidth="6"> + <start:Group Name="Group1"> + <start:Tile Size="4x4" Column="0" Row="0" AppUserModelID="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> + <start:Tile Size="2x2" Column="4" Row="2" AppUserModelID="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" /> + <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" /> + <start:Tile Size="2x2" Column="4" Row="4" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App" /> + <start:Tile Size="4x2" Column="0" Row="4" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> + </start:Group> + <start:Group Name="Group2"> + <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk" /> + <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk" /> + </start:Group> + </defaultlayout:StartLayout> + </StartLayoutCollection> + </DefaultLayoutOverride> + </LayoutModificationTemplate> + ]]> + </StartLayout> + <Taskbar ShowTaskbar="true"/> + </Profile> + </Profiles> + <Configs> + <Config> + <Account>MultiAppKioskUser</Account> + <DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/> + </Config> + </Configs> +</AssignedAccessConfiguration> +"@ + +Set-CimInstance -CimInstance $obj +``` diff --git a/windows/configuration/kiosk-methods.md b/windows/configuration/kiosk-methods.md new file mode 100644 index 0000000000..a142517a28 --- /dev/null +++ b/windows/configuration/kiosk-methods.md @@ -0,0 +1,77 @@ +--- +title: Configure kiosks and digital signs on Windows desktop editions (Windows 10) +description: Learn about the methods for configuring kiosks. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +author: jdeckerms +ms.date: 07/30/2018 +--- + +# Configure kiosks and digital signs on Windows desktop editions + +Some desktop devices in an enterprise serve a special purpose, such as a PC in the lobby that customers can use to view your product catalog or a PC displaying visual content as a digital sign. Windows 10 offers two different locked-down experiences for public or specialized use: + +| | | +--- | --- + | **A single-app kiosk**, which runs a single Universal Windows Platform (UWP) app in fullscreen above the lockscreen. People using the kiosk can see only that app.

    When the kiosk account (a local standard user account) signs in, the kiosk app will launch automatically, and you can configure the kiosk account to sign in automatically as well. If the kiosk app is closed, it will automatically restart.

    A single-app kiosk is ideal for public use.

    (Using [ShellLauncher WMI](kiosk-shelllauncher.md), you can configure a kiosk device that runs a Windows desktop application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on. This type of single-app kiosk does not run above the lockscreen.) | ![Illustration of a full-screen kiosk experience](images/kiosk-fullscreen.png) + | **A multi-app kiosk**, which runs one or more apps from the desktop. People using the kiosk see a customized Start that shows only the tiles for the apps that are allowed. With this approach, you can configure a locked-down experience for different account types.

    A multi-app kiosk is appropriate for devices that are shared by multiple people.

    When you configure a multi-app kiosk, [specific policies are enforced](kiosk-policies.md) that will affect **all** non-administrator users on the device. | ![Illustration of a kiosk Start screen](images/kiosk-desktop.png) + +Kiosk configurations are based on **Assigned Access**, a feature in Windows 10 that allows an administrator to manage the user's experience by limiting the application entry points exposed to the user. + +There are several kiosk configuration methods that you can choose from, depending on your answers to the following questions. + +| | | +--- | --- +![icon that represents apps](images/office-logo.png) | **Which type of app will your kiosk run?** Your kiosk can run a Universal Windows Platform (UWP) app or a Windows desktop application. For [digital signage](setup-digital-signage.md), simply select a digital sign player as your kiosk app. [Check out the guidelines for kiosk apps.](guidelines-for-assigned-access-app.md) +![icon that represents a kiosk](images/kiosk.png) | **Which type of kiosk do you need?** If you want your kiosk to run a single app for anyone to see or use, consider a single-app kiosk that runs either a [Universal Windows Platform (UWP) app](#uwp) or a [Windows desktop application](#classic). For a kiosk that people can sign in to with their accounts or that runs more than one app, choose [a multi-app kiosk](#desktop). +![icon that represents Windows](images/windows.png) | **Which edition of Windows 10 will the kiosk run?** All of the configuration methods work for Windows 10 Enterprise and Education; some of the methods work for Windows 10 Pro. Kiosk mode is not available on Windows 10 Home. +![icon that represents a user account](images/user.png) | **Which type of user account will be the kiosk account?** The kiosk account can be a local standard user account, a local administrator account, a domain account, or an Azure Active Directory (Azure AD) account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use a multi-app kiosk configuration. The single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method. + + + +## Methods for a single-app kiosk running a UWP app + +You can use this method | For this edition | For this kiosk account type +--- | --- | --- +[Assigned access in Settings](kiosk-single-app.md#local) | Pro, Ent, Edu | Local standard user +[Assigned access cmdlets](kiosk-single-app.md#powershell) | Pro, Ent, Edu | Local standard user +[The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | Pro (version 1709), Ent, Edu | Local standard user, Active Directory, Azure AD +[Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md#mdm) | Pro (version 1709), Ent, Edu | Local standard user, Azure AD + + +## Methods for a single-app kiosk running a Windows desktop application + +You can use this method | For this edition | For this kiosk account type +--- | --- | --- +[The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | Ent, Edu | Local standard user, Active Directory, Azure AD +[ShellLauncher WMI](kiosk-shelllauncher.md) | Ent, Edu | Local standard user, Active Directory, Azure AD +[Microsoft Intune or other mobile device management (MDM)](kiosk-single-app.md#mdm) | Pro (version 1709), Ent, Edu | Local standard user, Azure AD + + +## Methods for a multi-app kiosk + +You can use this method | For this edition | For this kiosk account type +--- | --- | --- +[XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) | Pro, Ent, Edu | Local standard user, Active Directory, Azure AD +[Microsoft Intune or other MDM](lock-down-windows-10-to-specific-apps.md) | Pro, Ent, Edu | Local standard user, Azure AD +[MDM WMI Bridge Provider](kiosk-mdm-bridge.md) | Pro, Ent, Edu | Local standard user, Active Directory, Azure AD + +## Summary of kiosk configuration methods + +Method | App type | Account type | Single-app kiosk | Multi-app kiosk +--- | --- | --- | :---: | :---: +[Assigned access in Settings](kiosk-single-app.md#local) | UWP | Local account | X | +[Assigned access cmdlets](kiosk-single-app.md#powershell) | UWP | Local account | X | +[The kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) | UWP, Windows desktop app | Local standard user, Active Directory, Azure AD | X | +[XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) | UWP, Windows desktop app | Local standard user, Active Directory, Azure AD | X | X +Microsoft Intune or other MDM [for full-screen single-app kiosk](kiosk-single-app.md#mdm) or [for multi-app kiosk with desktop](lock-down-windows-10-to-specific-apps.md) | UWP, Windows desktop app | Local standard user, Azure AD | X | X +[ShellLauncher WMI](kiosk-shelllauncher.md) |Windows desktop app | Local standard user, Active Directory, Azure AD | X | +[MDM Bridge WMI Provider](kiosk-mdm-bridge.md) | UWP, Windows desktop app | Local standard user, Active Directory, Azure AD | | X + + +>[!NOTE] +>For devices running Windows 10 Enterprise and Education, version 1703 and earlier, you can use [AppLocker](lock-down-windows-10-applocker.md) to lock down a device to specific apps. + diff --git a/windows/configuration/kiosk-policies.md b/windows/configuration/kiosk-policies.md new file mode 100644 index 0000000000..18b9247b19 --- /dev/null +++ b/windows/configuration/kiosk-policies.md @@ -0,0 +1,82 @@ +--- +title: Policies enforced on kiosk devices (Windows 10) +description: Learn about the policies enforced on a device when you configure it as a kiosk. +ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 +keywords: ["lockdown", "app restrictions", "applocker"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: edu, security +author: jdeckerms +ms.localizationpriority: medium +ms.date: 07/30/2018 +ms.author: jdecker +--- + +# Policies enforced on kiosk devices + + +**Applies to** + +- Windows 10 Pro, Enterprise, and Education + + + +It is not recommended to set policies enforced in assigned access kiosk mode to different values using other channels, as the kiosk mode has been optimized to provide a locked-down experience. + +When the assigned access kiosk configuration is applied on the device, certain policies are enforced system-wide, and will impact other users on the device. + + +## Group Policy + +The following local policies affect all **non-administrator** users on the system, regardless whether the user is configured as an assigned access user or not. This includes local users, domain users, and Azure Active Directory users. + +| Setting | Value | +| --- | --- | +Remove access to the context menus for the task bar | Enabled +Clear history of recently opened documents on exit | Enabled +Prevent users from customizing their Start Screen | Enabled +Prevent users from uninstalling applications from Start | Enabled +Remove All Programs list from the Start menu | Enabled +Remove Run menu from Start Menu | Enabled +Disable showing balloon notifications as toast | Enabled +Do not allow pinning items in Jump Lists | Enabled +Do not allow pinning programs to the Taskbar | Enabled +Do not display or track items in Jump Lists from remote locations | Enabled +Remove Notifications and Action Center | Enabled +Lock all taskbar settings | Enabled +Lock the Taskbar | Enabled +Prevent users from adding or removing toolbars | Enabled +Prevent users from resizing the taskbar | Enabled +Remove frequent programs list from the Start Menu | Enabled +Remove Pinned programs from the taskbar | Enabled +Remove the Security and Maintenance icon | Enabled +Turn off all balloon notifications | Enabled +Turn off feature advertisement balloon notifications | Enabled +Turn off toast notifications | Enabled +Remove Task Manager | Enabled +Remove Change Password option in Security Options UI | Enabled +Remove Sign Out option in Security Options UI | Enabled +Remove All Programs list from the Start Menu | Enabled – Remove and disable setting +Prevent access to drives from My Computer | Enabled - Restrict all drivers + +>[!NOTE] +>When **Prevent access to drives from My Computer** is enabled, users can browse the directory structure in File Explorer, but they cannot open folders and access the contents. Also, they cannot use the **Run** dialog box or the **Map Network Drive** dialog box to view the directories on these drives. The icons representing the specified drives still appear in File Explorer, but if users double-click the icons, a message appears expalining that a setting prevents the action. This setting does not prevent users from using programs to access local and network drives. It does not prevent users from using the Disk Management snap-in to view and change drive characteristics. + + + +## MDM policy + + +Some of the MDM policies based on the [Policy configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider) affect all users on the system (i.e. system-wide). + +Setting | Value | System-wide + --- | --- | --- +[Experience/AllowCortana](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-experience#experience-allowcortana) | 0 - Not allowed | Yes +[Start/AllowPinnedFolderSettings](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-allowpinnedfoldersettings) | 0 - Shortcut is hidden and disables the setting in the Settings app | Yes +Start/HidePeopleBar | 1 - True (hide) | No +[Start/HideChangeAccountSettings](https://docs.microsoft.com/en-us/windows/client-management/mdm/policy-csp-start#start-hidechangeaccountsettings) | 1 - True (hide) | Yes +[WindowsInkWorkspace/AllowWindowsInkWorkspace](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowsinkworkspace#windowsinkworkspace-allowwindowsinkworkspace) | 0 - Access to ink workspace is disabled and the feature is turned off | Yes +[Start/StartLayout](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start#start-startlayout) | Configuration dependent | No +[WindowsLogon/DontDisplayNetworkSelectionUI](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowslogon#windowslogon-dontdisplaynetworkselectionui) | <Enabled/> | Yes + diff --git a/windows/configuration/kiosk-prepare.md b/windows/configuration/kiosk-prepare.md new file mode 100644 index 0000000000..1a38681d7c --- /dev/null +++ b/windows/configuration/kiosk-prepare.md @@ -0,0 +1,81 @@ +--- +title: Prepare a device for kiosk configuration (Windows 10) +description: Some tips for device settings on kiosks. +ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerms +ms.localizationpriority: medium +ms.date: 07/30/2018 +--- + +# Prepare a device for kiosk configuration + + +**Applies to** + +- Windows 10 Pro, Enterprise, and Education + +>[!WARNING] +>For kiosks in public-facing environments with auto sign-in enabled, you should use a user account with least privilege, such as a local standard user account. +> +>Assigned access can be configured via Windows Management Instrumentation (WMI) or configuration service provider (CSP) to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. + + +For a more secure kiosk experience, we recommend that you make the following configuration changes to the device before you configure it as a kiosk: + +Recommendation | How to +--- | --- +Replace "blue screen" with blank screen for OS errors | Add the following registry key as DWORD (32-bit) type with a value of `1`:

    `HKLM\SYSTEM\CurrentControlSet\Control\CrashControl\DisplayDisabled`

    [Learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002)

    You must restart the device after changing the registry. +Put device in **Tablet mode**. | If you want users to be able to use the touch (on screen) keyboard, go to **Settings** > **System** > **Tablet mode** and choose **On.** Do not turn on this setting if users will not interact with the kiosk, such as for a digital sign. +Hide **Ease of access** feature on the sign-in screen. | Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools. +Disable the hardware power button. | Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**. +Remove the power button from the sign-in screen. | Go to **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** >**Security Options** > **Shutdown: Allow system to be shut down without having to log on** and select **Disabled.** +Disable the camera. | Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**. +Turn off app notifications on the lock screen. | Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**. +Disable removable media. | Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation.

    **NOTE**: To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**. + +In addition to the settings in the table, you may want to set up **automatic logon** for your kiosk device. When your kiosk device restarts, whether from an update or power outage, you can sign in the assigned access account manually or you can configure the device to sign in to the assigned access account automatically. Make sure that Group Policy settings applied to the device do not prevent automatic sign in. + +>[!TIP] +>If you use the [kiosk wizard in Windows Configuration Designer](kiosk-single-app.md#wizard) or [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) to configure your kiosk, you can set an account to sign in automatically in the wizard or XML. + + +**How to edit the registry to have an account sign in automatically** + +1. Open Registry Editor (regedit.exe). + + >[!NOTE]   + >If you are not familiar with Registry Editor, [learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002). +   + +2. Go to + + **HKEY\_LOCAL\_MACHINE\SOFTWARE\\Microsoft\WindowsNT\CurrentVersion\Winlogon** + +3. Set the values for the following keys. + + - *AutoAdminLogon*: set value as **1**. + + - *DefaultUserName*: set value as the account that you want signed in. + + - *DefaultPassword*: set value as the password for the account. + + > [!NOTE] + > If *DefaultUserName* and *DefaultPassword* aren't there, add them as **New** > **String Value**. + + - *DefaultDomainName*: set value for domain, only for domain accounts. For local accounts, do not add this key. + +4. Close Registry Editor. The next time the computer restarts, the account will sign in automatically. + +>[!TIP] +>You can also configure automatic sign-in [using the Autologon tool from Sysinternals](https://docs.microsoft.com/sysinternals/downloads/autologon). + + + + + + + diff --git a/windows/configuration/kiosk-shared-pc.md b/windows/configuration/kiosk-shared-pc.md deleted file mode 100644 index 4627f16d24..0000000000 --- a/windows/configuration/kiosk-shared-pc.md +++ /dev/null @@ -1,26 +0,0 @@ ---- -title: Configure kiosk and shared devices running Windows desktop editions (Windows 10) -description: -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: medium -author: jdeckerms -ms.author: jdecker -ms.topic: article -ms.date: 08/08/2017 ---- - -# Configure kiosk and shared devices running Windows desktop editions - -Some desktop devices in an enterprise serve a special purpose, such as a common PC in a touchdown space that any employee can sign in to, or a PC in the lobby that customers can use to view your product catalog. Windows 10 is easy to configure for shared use or for use as a kiosk (single app). - -## In this section - -| Topic | Description | -| --- | --- | -| [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) | Windows 10, version 1607, introduced *shared PC mode*, which optimizes Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. | -| [Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education](setup-kiosk-digital-signage.md) | You can configure a device running Windows 10 Pro, Windows 10 Enterprise, or Windows 10 Education as a kiosk device, so that users can only interact with a single application that you select. | -| [Guidelines for choosing an app for assigned access (kiosk mode)](guidelines-for-assigned-access-app.md) | You can choose almost any Windows app for assigned access; however, some apps may not provide a good user experience. This topic provides guidelines to help you choose an approprate app for a kiosk device. | -| [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md) | Learn how to configure a device running Windows 10 Enterprise or Windows 10 Education so that users can only run a few specific apps. The result is similar to a kiosk device, but with multiple apps available. For example, you might set up a library computer so that users can search the catalog and browse the Internet, but can't run any other apps or change computer settings. | \ No newline at end of file diff --git a/windows/configuration/kiosk-shelllauncher.md b/windows/configuration/kiosk-shelllauncher.md new file mode 100644 index 0000000000..30bb50f7de --- /dev/null +++ b/windows/configuration/kiosk-shelllauncher.md @@ -0,0 +1,201 @@ +--- +title: Use Shell Launcher to create a Windows 10 kiosk (Windows 10) +description: A single-use device such as a digital sign is easy to set up in Windows 10 for desktop editions (Pro, Enterprise, and Education). +ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerms +ms.localizationpriority: medium +ms.date: 07/30/2018 +--- + +# Use Shell Launcher to create a Windows 10 kiosk + + +**Applies to** +>App type: Windows desktop application +> +>OS edition: Windows 10 Ent, Edu +> +>Account type: Local standard user or administrator, Active Directory, Azure AD + + +Using Shell Launcher, you can configure a kiosk device that runs a Windows desktop application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on. + +>[!NOTE] +>You can also configure a kiosk device that runs a Windows desktop application by using the [Provision kiosk devices wizard](#wizard). + +>[!WARNING] +>- Windows 10 doesn’t support setting a custom shell prior to OOBE. If you do, you won’t be able to deploy the resulting image. +>- Shell Launcher doesn't support a custom shell with an application that launches a different process and exits. For example, you cannot specify **write.exe** in Shell Launcher. Shell Launcher launches a custom shell and monitors the process to identify when the custom shell exits. **Write.exe** creates a 32-bit wordpad.exe process and exits. Because Shell Launcher is not aware of the newly created wordpad.exe process, Shell Launcher will take action based on the exit code of **Write.exe**, such as restarting the custom shell. + +### Requirements + +- A domain or local user account. + +- A Windows desktop application that is installed for that account. The app can be your own company application or a common app like Internet Explorer. + +[See the technical reference for the shell launcher component.](https://go.microsoft.com/fwlink/p/?LinkId=618603) + + +### Configure Shell Launcher + +To set a Windows desktop application as the shell, you first turn on the Shell Launcher feature, and then you can set your custom shell as the default using PowerShell. + +**To turn on Shell Launcher in Windows features** + +1. Go to Control Panel > **Programs and features** > **Turn Windows features on or off**. + +2. Expand **Device Lockdown**. + +2. Select **Shell Launcher** and **OK**. + +Alternatively, you can turn on Shell Launcher using Windows Configuration Designer in a provisioning package, using `SMISettings > ShellLauncher`, or the Deployment Image Servicing and Management (DISM.exe) tool. + +**To turn on Shell Launcher using DISM** + +1. Open a command prompt as an administrator. +2. Enter the following command. + + ``` + Dism /online /Enable-Feature /all /FeatureName:Client-EmbeddedShellLauncher + ``` + +**To set your custom shell** + +Modify the following PowerShell script as appropriate. The comments in the sample script explain the purpose of each section and tell you where you will want to change the script for your purposes. Save your script with the extension .ps1, open Windows PowerShell as administrator, and run the script on the kiosk device. + +``` +# Check if shell launcher license is enabled +function Check-ShellLauncherLicenseEnabled +{ + [string]$source = @" +using System; +using System.Runtime.InteropServices; + +static class CheckShellLauncherLicense +{ + const int S_OK = 0; + + public static bool IsShellLauncherLicenseEnabled() + { + int enabled = 0; + + if (NativeMethods.SLGetWindowsInformationDWORD("EmbeddedFeature-ShellLauncher-Enabled", out enabled) != S_OK) { + enabled = 0; + } + + return (enabled != 0); + } + + static class NativeMethods + { + [DllImport("Slc.dll")] + internal static extern int SLGetWindowsInformationDWORD([MarshalAs(UnmanagedType.LPWStr)]string valueName, out int value); + } + +} +"@ + + $type = Add-Type -TypeDefinition $source -PassThru + + return $type[0]::IsShellLauncherLicenseEnabled() +} + +[bool]$result = $false + +$result = Check-ShellLauncherLicenseEnabled +"`nShell Launcher license enabled is set to " + $result +if (-not($result)) +{ + "`nThis device doesn't have required license to use Shell Launcher" + exit +} + +$COMPUTER = "localhost" +$NAMESPACE = "root\standardcimv2\embedded" + +# Create a handle to the class instance so we can call the static methods. +try { + $ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting" + } catch [Exception] { + write-host $_.Exception.Message; + write-host "Make sure Shell Launcher feature is enabled" + exit + } + + +# This well-known security identifier (SID) corresponds to the BUILTIN\Administrators group. + +$Admins_SID = "S-1-5-32-544" + +# Create a function to retrieve the SID for a user account on a machine. + +function Get-UsernameSID($AccountName) { + + $NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName) + $NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier]) + + return $NTUserSID.Value + +} + +# Get the SID for a user account named "Cashier". Rename "Cashier" to an existing account on your system to test this script. + +$Cashier_SID = Get-UsernameSID("Cashier") + +# Define actions to take when the shell program exits. + +$restart_shell = 0 +$restart_device = 1 +$shutdown_device = 2 + +# Examples. You can change these examples to use the program that you want to use as the shell. + +# This example sets the command prompt as the default shell, and restarts the device if the command prompt is closed. + +$ShellLauncherClass.SetDefaultShell("cmd.exe", $restart_device) + +# Display the default shell to verify that it was added correctly. + +$DefaultShellObject = $ShellLauncherClass.GetDefaultShell() + +"`nDefault Shell is set to " + $DefaultShellObject.Shell + " and the default action is set to " + $DefaultShellObject.defaultaction + +# Set Internet Explorer as the shell for "Cashier", and restart the machine if Internet Explorer is closed. + +$ShellLauncherClass.SetCustomShell($Cashier_SID, "c:\program files\internet explorer\iexplore.exe www.microsoft.com", ($null), ($null), $restart_shell) + +# Set Explorer as the shell for administrators. + +$ShellLauncherClass.SetCustomShell($Admins_SID, "explorer.exe") + +# View all the custom shells defined. + +"`nCurrent settings for custom shells:" +Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | Select Sid, Shell, DefaultAction + +# Enable Shell Launcher + +$ShellLauncherClass.SetEnabled($TRUE) + +$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled() + +"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled + +# Remove the new custom shells. + +$ShellLauncherClass.RemoveCustomShell($Admins_SID) + +$ShellLauncherClass.RemoveCustomShell($Cashier_SID) + +# Disable Shell Launcher + +$ShellLauncherClass.SetEnabled($FALSE) + +$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled() + +"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled +``` diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md new file mode 100644 index 0000000000..dc55bd5004 --- /dev/null +++ b/windows/configuration/kiosk-single-app.md @@ -0,0 +1,244 @@ +--- +title: Set up a single-app kiosk (Windows 10) +description: A single-use device is easy to set up in Windows 10 for desktop editions (Pro, Enterprise, and Education). +ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerms +ms.localizationpriority: medium +ms.date: 07/30/2018 +--- + +# Set up a single-app kiosk + + +**Applies to** + +- Windows 10 Pro, Enterprise, and Education + + + +| | | +--- | --- +A single-app kiosk uses the Assigned Access feature to run a single app above the lockscreen.

    When the kiosk account signs in, the app is launched automatically. The person using the kiosk cannot do anything on the device outside of the kiosk app. | ![Illustration of a single-app kiosk experience](images/kiosk-fullscreen-sm.png) + +You have several options for configuring your single-app kiosk. + +Method | Description +--- | --- +[Assigned access in Settings](#local) | The **Assigned Access** option in **Settings** is a quick and easy method to set up a single device as a kiosk for a local standard user account. First, you need to [create the user account](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) on the device and install the kiosk app for that account.

    This method is supported on Windows 10 Pro, Enterprise, and Education. +[PowerShell](#powershell) | You can use Windows PowerShell cmdlets to set up a single-app kiosk. First, you need to [create the user account](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) on the device and install the kiosk app for that account.

    This method is supported on Windows 10 Pro, Enterprise, and Education. +[The kiosk wizard in Windows Configuration Designer](#wizard) | Windows Configuration Designer is a tool that produces a *provisioning package*, which is a package of configuration settings that can be applied to one or more devices during the first-run experience (OOBE) or after OOBE is done (runtime). You can also create the kiosk user account and install the kiosk app, as well as other useful settings, using the kiosk wizard.

    This method is supported on Windows 10 Pro (version 1709 and later), Enterprise, and Education. +[Microsoft Intune or other mobile device management (MDM) provider](#mdm) | For managed devices, you can use MDM to set up a kiosk configuration.

    This method is supported on Windows 10 Pro (version 1709 and later), Enterprise, and Education. + + +>[!TIP] +>You can also configure a kiosk account and app for single-app kiosk within [XML in a provisioning package](lock-down-windows-10-to-specific-apps.md) by using a [kiosk profile](lock-down-windows-10-to-specific-apps.md#profile). + + + + +## Set up a kiosk in local Settings + +>App type: UWP +> +>OS edition: Windows 10 Pro, Ent, Edu +> +>Account type: Local standard user + +You can use **Settings** to quickly configure one or a few devices as a kiosk. When you set up a kiosk (also known as *assigned access*) in **Settings**, you must select a local standard user account. [Learn how to create a local standard user account.](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) + +![The Set up assigned access page in Settings](images/kiosk-settings.png) + +**To set up assigned access in PC settings** + +1. Go to **Start** > **Settings** > **Accounts** > **Other people**. + +2. Choose **Set up assigned access**. + +3. Choose an account. + +4. Choose an app. Only apps that can run above the lock screen will be available in the list of apps to choose from. For more information, see [Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md). + +5. Close **Settings** – your choices are saved automatically, and will be applied the next time that user account logs on. + +To remove assigned access, choose **Turn off assigned access and sign out of the selected account**. + +When your kiosk is a local device that is not managed by Active Directory or Azure Active Directory, there is a default setting that enables automatic sign-in after a restart. That means that when the device restarts, the last signed-in user will be signed in automatically. If the last signed-in user is the kiosk account, the kiosk app will be launched automatically after the device restarts. + +- If you want the kiosk account signed in automatically and the kiosk app launched when the device restarts, there is nothing you need to do. + +- If you do not want the kiosk account signed in automatically when the device restarts, you must change the default setting before you configure the device as a kiosk. Sign in with the account that you will assign as the kiosk account, go to **Settings** > **Accounts** > **Sign-in options**, and toggle the **Use my sign-in info to automatically finish setting up my device after an update or restart** setting to **Off**. After you change the setting, you can apply the kiosk configuration to the device. + +![Screenshot of automatic sign-in setting](images/auto-signin.png) + + + + + + +## Set up a kiosk using Windows PowerShell + + +>App type: UWP +> +>OS edition: Windows 10 Pro, Ent, Edu +> +>Account type: Local standard user + +![PowerShell windows displaying Set-AssignedAccess cmdlet](images/set-assignedaccess.png) + +You can use any of the following PowerShell cmdlets to set up assigned access on multiple devices. + +Before you run the cmdlet: + +1. Log in as administrator. +2. [Create the user account](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) for Assigned Access. +3. Log in as the Assigned Access user account. +4. Install the Universal Windows app that follows the assigned access/above the lock guidelines. +5. Log out as the Assigned Access user account. +6. Log in as administrator. + +To open PowerShell on Windows 10, search for PowerShell and find **Windows PowerShell Desktop app** in the results. Run PowerShell as administrator. + +**Configure assigned access by AppUserModelID and user name** + +``` +Set-AssignedAccess -AppUserModelId -UserName +``` +**Configure assigned access by AppUserModelID and user SID** + +``` +Set-AssignedAccess -AppUserModelId -UserSID +``` +**Configure assigned access by app name and user name** + +``` +Set-AssignedAccess -AppName -UserName +``` +**Configure assigned access by app name and user SID** + +``` +Set-AssignedAccess -AppName -UserSID +``` + +> [!NOTE] +> To set up assigned access using `-AppName`, the user account that you specify for assigned access must have logged on at least once. + +[Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867). + +[Learn how to get the AppName](https://msdn.microsoft.com/library/windows/hardware/mt620046%28v=vs.85%29.aspx) (see **Parameters**). + +[Learn how to get the SID](https://go.microsoft.com/fwlink/p/?LinkId=615517). + +To remove assigned access, using PowerShell, run the following cmdlet. + +``` +Clear-AssignedAccess +``` + + + +## Set up a kiosk using the kiosk wizard in Windows Configuration Designer + +>App type: UWP or Windows desktop application +> +>OS edition: Windows 10 Pro (version 1709 and later) for UWP only; Ent, Edu for both app types +> +>Account type: Local standard user, Active Directory + +![Kiosk wizard option in Windows Configuration Designer](images/kiosk-wizard.png) + + +>[!IMPORTANT] +>When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows}(https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows). + +When you use the **Provision kiosk devices** wizard in Windows Configuration Designer, you can configure the kiosk to run either a Universal Windows app or a Windows desktop application. + + +[Install Windows Configuration Designer](provisioning-packages/provisioning-install-icd.md), then open Windows Configuration Designer and select **Provision kiosk devices**. After you name your project, and click **Next**, configure the settings as shown in the following table. + + + + + + + + + + + + +
    ![step one](images/one.png)![set up device](images/set-up-device.png)

    Enable device setup if you want to configure settings on this page.

    **If enabled:**

    Enter a name for the device.

    (Optional) Select a license file to upgrade Windows 10 to a different edition. [See the permitted upgrades.](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades)

    Toggle **Configure devices for shared use** off. This setting optimizes Windows 10 for shared use scenarios and isn't necessary for a kiosk scenario.

    You can also select to remove pre-installed software from the device.     		![device name, upgrade to enterprise, shared use, remove pre-installed software](images/set-up-device-details.png)
    ![step two](images/two.png) ![set up network](images/set-up-network.png)

    Enable network setup if you want to configure settings on this page.

    **If enabled:**

    Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, the network type (**Open** or **WPA2-Personal**), and (if **WPA2-Personal**) the password for the wireless network.    		![Enter network SSID and type](images/set-up-network-details.png)
    ![step three](images/three.png) ![account management](images/account-management.png)

    Enable account management if you want to configure settings on this page.

    **If enabled:**

    You can enroll the device in Active Directory, enroll in Azure Active Directory, or create a local administrator account on the device

    To enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain.

    Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup). The **maximum number of devices per user** setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click **Get bulk token**. In the **Let's get you signed in** window, enter an account that has permissions to join a device to Azure AD, and then the password. Click **Accept** to give Windows Configuration Designer the necessary permissions.

    **Warning:** You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards.

    To create a local administrator account, select that option and enter a user name and password.

    **Important:** If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.     		![join Active Directory, Azure AD, or create a local admin account](images/account-management-details.png)
    ![step four](images/four.png) ![add applications](images/add-applications.png)

    You can provision the kiosk app in the **Add applications** step. You can install multiple applications, both Windows desktop applications (Win32) and Universal Windows Platform (UWP) apps, in a provisioning package. The settings in this step vary according to the application that you select. For help with the settings, see [Provision PCs with apps](provisioning-packages/provision-pcs-with-apps.md)

    **Warning:** If you click the plus button to add an application, you must specify an application for the provisioning package to validate. If you click the plus button in error, select any executable file in **Installer Path**, and then a **Cancel** button becomes available, allowing you to complete the provisioning package without an application.     		![add an application](images/add-applications-details.png)
    ![step five](images/five.png) ![add certificates](images/add-certificates.png)

    To provision the device with a certificate for the kiosk app, click **Add a certificate**. Enter a name for the certificate, and then browse to and select the certificate to be used.    		![add a certificate](images/add-certificates-details.png)
    ![step six](images/six.png) ![Configure kiosk account and app](images/kiosk-account.png)

    You can create a local standard user account that will be used to run the kiosk app. If you toggle **No**, make sure that you have an existing user account to run the kiosk app.

    If you want to create an account, enter the user name and password, and then toggle **Yes** or **No** to automatically sign in the account when the device starts.

    In **Configure the kiosk mode app**, enter the name of the user account that will run the kiosk mode app. Select the type of app to run in kiosk mode, and then enter the path or filename (for a Windows desktop application) or the AUMID (for a Universal Windows app). For a Windows desktop application, you can use the filename if the path to the file is in the PATH environment variable, otherwise the full path is required.    		![Configure kiosk account and app](images/kiosk-account-details.png)
    ![step seven](images/seven.png) ![configure kiosk common settings](images/kiosk-common.png)

    On this step, select your options for tablet mode, the user experience on the Welcome and shutdown screens, and the timeout settings.    		![set tablet mode and configure welcome and shutdown and turn off timeout settings](images/kiosk-common-details.png)
    ![finish](images/finish.png)

    You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.    		![Protect your package](images/finish-details.png)
    + + +>[!NOTE] +>If you want to use [the advanced editor in Windows Configuration Designer](provisioning-packages/provisioning-create-package.md#configure-settings), specify the user account and app (by AUMID) in **Runtime settings** > **AssignedAccess** > **AssignedAccessSettings** + +>[!IMPORTANT] +>When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. + + + + +[Learn how to apply a provisioning package.](provisioning-packages/provisioning-apply-package.md) + + + + + +  + + + +## Set up a kiosk or digital sign using Microsoft Intune or other MDM service + +>App type: UWP +> +>OS edition: Windows 10 Pro (version 1709), Ent, Edu +> +>Account type: Local standard user, Azure AD + +![The configuration settings for single-app kiosk in Microsoft Intune](images/kiosk-intune.png) + +Microsoft Intune and other MDM services enable kiosk configuration through the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Assigned Access has a `KioskModeApp` setting. In the `KioskModeApp` setting, you enter the user account name and the [AUMID](https://docs.microsoft.com/windows-hardware/customize/enterprise/find-the-application-user-model-id-of-an-installed-app) for the app to run in kiosk mode. + +>[!TIP] +>Starting in Windows 10, version 1803, a ShellLauncher node has been added to the [AssignedAccess CSP](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). + +The following steps explain how to configure a kiosk in Microsoft Intune. For other MDM services, see the documentation for your provider. + +**To configure kiosk in Microsoft Intune** + +2. In the Microsoft Azure portal, search for **Intune** or go to **More services** > **Intune**. +3. Select **Device configuration**. +4. Select **Profiles**. +5. Select **Create profile**. +6. Enter a friendly name for the profile. +7. Select **Windows 10 and later** for the platform. +8. Select **Device restrictions** for the profile type. +9. Select **Kiosk**. +10. In **Kiosk Mode**, select **Single app kiosk**. +1. Enter the user account (Azure AD or a local standard user account). +11. Enter the Application User Model ID for an installed app. +14. Select **OK**, and then select **Create**. +18. Assign the profile to a device group to configure the devices in that group as kiosks. + + + +## Sign out of assigned access + +To exit the assigned access (kiosk) app, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the login screen timeout, the kiosk app will be re-launched. The assigned access user will remain signed in until an admin account opens **Task Manager** > **Users** and signs out the user account. + +If you press **Ctrl + Alt + Del** and do not sign in to another account, after a set time, assigned access will resume. The default time is 30 seconds, but you can change that in the following registry key: + +**HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI** + +To change the default time for assigned access to resume, add *IdleTimeOut* (DWORD) and enter the value data as milliseconds in hexadecimal. + +  + + + diff --git a/windows/configuration/kiosk-validate.md b/windows/configuration/kiosk-validate.md new file mode 100644 index 0000000000..9281f546da --- /dev/null +++ b/windows/configuration/kiosk-validate.md @@ -0,0 +1,94 @@ +--- +title: Validate kiosk configuration (Windows 10) +description: This topic explains what to expect on a multi-app kiosk. +ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerms +ms.localizationpriority: medium +ms.date: 07/30/2018 +--- + +# Validate kiosk configuration + + +**Applies to** + +- Windows 10 Pro, Enterprise, and Education + +To identify the provisioning packages applied to a device, go to **Settings** > **Accounts** > **Access work or school**, and then click **Add or remove a provisioning package**. You should see a list of packages that were applied to the device. + +Optionally, run Event Viewer (eventvwr.exe) and look through logs under **Applications and Services Logs** > **Microsoft** > **Windows** > **Provisioning-Diagnostics-Provider** > **Admin**. + +To test the kiosk, sign in with the assigned access user account you specified in the configuration to check out the multi-app experience. + +>[!NOTE] +>The kiosk configuration setting will take effect the next time the assigned access user signs in. If that user account is signed in when you apply the configuration, make sure the user signs out and signs back in to validate the experience. + +The following sections explain what to expect on a multi-app kiosk. + +### App launching and switching experience + +In the multi-app mode, to maximize the user productivity and streamline the experience, an app will be always launched in full screen when the users click the tile on the Start. The users can minimize and close the app, but cannot resize the app window. + +The users can switch apps just as they do today in Windows. They can use the Task View button, Alt + Tab hotkey, and the swipe in from the left gesture to view all the open apps in task view. They can click the Windows button to show Start, from which they can open apps, and they can switch to an opened app by clicking it on the taskbar. + +### Start changes + +When the assigned access user signs in, you should see a restricted Start experience: +- Start gets launched in full screen and prevents the end user from accessing the desktop. +- Start shows the layout aligned with what you defined in the multi-app configuration XML. +- Start prevents the end user from changing the tile layout. + - The user cannot resize, reposition, and unpin the tiles. + - The user cannot pin additional tiles on the start. +- Start hides **All Apps** list. +- Start hides all the folders on Start (including File Explorer, Settings, Documents, Downloads, Music, Pictures, Videos, HomeGroup, Network, and Personal folders). +- Only **User** and **Power** buttons are available. (You can control whether to show the **User/Power** buttons using [existing policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start).) +- Start hides **Change account settings** option under **User** button. + +### Taskbar changes + +If the applied multi-app configuration enables taskbar, when the assigned access user signs in, you should see a restricted Taskbar experience: +- Disables context menu of Start button (Quick Link) +- Disables context menu of taskbar +- Prevents the end user from changing the taskbar +- Disables Cortana and Search Windows +- Hides notification icons and system icons, e.g. Action Center, People, Windows Ink Workspace +- Allows the end user to view the status of the network connection and power state, but disables the flyout of **Network/Power** to prevent end user from changing the settings + +### Blocked hotkeys + +The multi-app mode blocks the following hotkeys, which are not relevant for the lockdown experience. + +| Hotkey | Action | +| --- | --- | +| Windows logo key + A | Open Action center | +| Windows logo key + Shift + C | Open Cortana in listening mode | +| Windows logo key + D | Display and hide the desktop | +| Windows logo key + Alt + D | Display and hide the date and time on the desktop | +| Windows logo key + E | Open File Explorer | +| Windows logo key + F | Open Feedback Hub | +| Windows logo key + G | Open Game bar when a game is open | +| Windows logo key + I | Open Settings | +| Windows logo key + J | Set focus to a Windows tip when one is available. | +| Windows logo key + O | Lock device orientation | +| Windows logo key + Q | Open search | +| Windows logo key + R | Open the Run dialog box | +| Windows logo key + S | Open search | +| Windows logo key + X | Open the Quick Link menu | +| Windows logo key + comma (,) | Temporarily peek at the desktop | +| Windows logo key + Ctrl + F | Search for PCs (if you're on a network) | + + + +### Locked-down Ctrl+Alt+Del screen + +The multi-app mode removes options (e.g. **Change a password**, **Task Manager**, **Network**) in the Ctrl+Alt+Del screen to ensure the users cannot access the functionalities that are not allowed in the lockdown experience. + +### Auto-trigger touch keyboard + +In the multi-app mode, the touch keyboard will be automatically triggered when there is an input needed and no physical keyboard is attached on touch-enabled devices. You don’t need to configure any other setting to enforce this behavior. + + diff --git a/windows/configuration/kiosk-xml.md b/windows/configuration/kiosk-xml.md index 74cdfe88e1..9be99277a6 100644 --- a/windows/configuration/kiosk-xml.md +++ b/windows/configuration/kiosk-xml.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: edu, security author: jdeckerms ms.localizationpriority: medium -ms.date: 04/30/2018 +ms.date: 07/30/2018 ms.author: jdecker ms.topic: article --- diff --git a/windows/configuration/lock-down-windows-10-applocker.md b/windows/configuration/lock-down-windows-10-applocker.md index de93d13008..876d2a663d 100644 --- a/windows/configuration/lock-down-windows-10-applocker.md +++ b/windows/configuration/lock-down-windows-10-applocker.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: edu, security author: jdeckerms ms.localizationpriority: medium -ms.date: 08/14/2017 +ms.date: 07/30/2018 ms.author: jdecker ms.topic: article --- @@ -37,7 +37,7 @@ This topic describes how to lock down apps on a local device. You can also use A ## Install apps -First, install the desired apps on the device for the target user account(s). This works for both Store and Win32. For Store apps, you must log on as that user for the app to install. For Win32 you can install an app for all users without logging on to the particular account. +First, install the desired apps on the device for the target user account(s). This works for both Unified Windows Platform (UWP) apps and Windows desktop apps. For UWP apps, you must log on as that user for the app to install. For desktop apps, you can install an app for all users without logging on to the particular account. ## Use AppLocker to set rules for apps diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 8e3162d8d0..7793d23b83 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -1,5 +1,5 @@ --- -title: Create a Windows 10 kiosk that runs multiple apps (Windows 10) +title: Set up a multi-app kiosk (Windows 10) description: Learn how to configure a kiosk device running Windows 10 so that users can only run a few specific apps. ms.assetid: 14DDDC96-88C7-4181-8415-B371F25726C8 keywords: ["lockdown", "app restrictions", "applocker"] @@ -9,29 +9,29 @@ ms.sitesec: library ms.pagetype: edu, security author: jdeckerms ms.localizationpriority: medium -ms.date: 06/21/2018 +ms.date: 07/30/2018 ms.author: jdecker ms.topic: article --- -# Create a Windows 10 kiosk that runs multiple apps +# Set up a multi-app kiosk **Applies to** - Windows 10 Pro, Enterprise, and Education -A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) has been expanded to make it easy for administrators to create kiosks that run more than one app. In Windows 10, version 1803, you can also: + +A [kiosk device](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) typically runs a single app, and users are prevented from accessing any features or functions on the device outside of the kiosk app. In Windows 10, version 1709, the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp) was expanded to make it easy for administrators to create kiosks that run more than one app. In Windows 10, version 1803, you can also: - Configure [a single-app kiosk profile](#profile) in your XML file. - Assign [group accounts to a config profile](#config-for-group-accounts). - Configure [an account to sign in automatically](#config-for-autologon-account). - -The benefit of a multi-app kiosk, or fixed-purpose device, is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. +The benefit of a kiosk with desktop that runs only one or more specified apps is to provide an easy-to-understand experience for individuals by putting in front of them only the things they need to use, and removing from their view the things they don’t need to access. >[!WARNING] ->The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](#policies-set-by-multi-app-kiosk-configuration) are enforced system-wide, and will impact other users on the device. Deleting the multi-app configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access. +>The assigned access feature is intended for corporate-owned fixed-purpose devices, like kiosks. When the multi-app assigned access configuration is applied on the device, [certain policies](kiosk-policies.md) are enforced system-wide, and will impact other users on the device. Deleting the kiosk configuration will remove the assigned access lockdown profiles associated with the users, but it cannot revert all the enforced policies (such as Start layout). A factory reset is needed to clear all the policies enforced via assigned access. You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provisioning package](#provision). @@ -65,7 +65,6 @@ You can configure multi-app kiosks using [Microsoft Intune](#intune) or a [provi >Managed apps are apps that are in the Microsoft Store for Business that is synced with your Intune subscription. - ## Configure a kiosk using a provisioning package Process: @@ -77,12 +76,12 @@ Watch how to use a provisioning package to configure a multi-app kiosk. >[!VIDEO https://www.microsoft.com/videoplayer/embed/fa125d0f-77e4-4f64-b03e-d634a4926884?autoplay=false] -If you don't want to use a provisioning package, you can deploy the configuration XML file using [mobile device management (MDM)](#alternate-methods) or you can configure assigned access using the [MDM Bridge WMI Provider](#bridge). +If you don't want to use a provisioning package, you can deploy the configuration XML file using [mobile device management (MDM)](#alternate-methods) or you can configure assigned access using the [MDM Bridge WMI Provider](kiosk-mdm-bridge.md). ### Prerequisites -- Windows Configuration Designer (Windows 10, version 1709) -- The kiosk device must be running Windows 10 (S, Pro, Enterprise, or Education), version 1709 +- Windows Configuration Designer (Windows 10, version 1709 or later) +- The kiosk device must be running Windows 10 (S, Pro, Enterprise, or Education), version 1709 or later >[!NOTE] >For devices running versions of Windows 10 earlier than version 1709, you can [create AppLocker rules](lock-down-windows-10-applocker.md) to configure a multi-app kiosk. @@ -161,7 +160,7 @@ The profile **Id** is a GUID attribute to uniquely identify the profile. You can ##### AllowedApps -**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Classic Windows desktop apps. +**AllowedApps** is a list of applications that are allowed to run. Apps can be Universal Windows Platform (UWP) apps or Windows desktop applications. Based on the purpose of the kiosk device, define the list of applications that are allowed to run. This list can contain both UWP apps and desktop apps. When the mult-app kiosk configuration is applied to a device, AppLocker rules will be generated to allow the apps that are listed in the configuration. @@ -479,10 +478,7 @@ Provisioning packages can be applied to a device during the first-run experience -### Validate provisioning -- Go to **Settings** > **Accounts** > **Access work or school**, and then click **Add or remove a provisioning package**. You should see a list of packages that were applied to the device, including the one you applied for the multi-app configuration. -- Optionally, run Event Viewer (eventvwr.exe) and look through logs under **Applications and Services Logs** > **Microsoft** > **Windows** > **Provisioning-Diagnostics-Provider** > **Admin**. @@ -496,147 +492,9 @@ If your device is enrolled with a MDM server which supports applying the assigne The OMA-URI for multi-app policy is `./Device/Vendor/MSFT/AssignedAccess/Configuration`. - -## Use MDM Bridge WMI Provider to configure assigned access - -Environments that use WMI can use the [MDM Bridge WMI Provider](https://msdn.microsoft.com/library/windows/desktop/dn905224.aspx) to configure the MDM_AssignedAccess class. See [PowerShell Scripting with WMI Bridge Provider](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/using-powershell-scripting-with-the-wmi-bridge-provider) for more details about using a PowerShell script to configure AssignedAccess. - -Here’s an example to set AssignedAccess configuration: - -1. Download the [psexec tool](https://technet.microsoft.com/sysinternals/bb897553.aspx). -2. Run `psexec.exe -i -s cmd.exe`. -3. In the command prompt launched by psexec.exe, enter `powershell.exe` to open PowerShell. -4. Execute the following script: - -```ps -$nameSpaceName="root\cimv2\mdm\dmmap" -$className="MDM_AssignedAccess" -$obj = Get-CimInstance -Namespace $namespaceName -ClassName $className -$obj.Configuration = @" -<?xml version="1.0" encoding="utf-8" ?> -<AssignedAccessConfiguration xmlns="http://schemas.microsoft.com/AssignedAccess/2017/config"> - <Profiles> - <Profile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"> - <AllAppsList> - <AllowedApps> - <App AppUserModelId="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> - <App AppUserModelId="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" /> - <App AppUserModelId="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" /> - <App AppUserModelId="Microsoft.BingWeather_8wekyb3d8bbwe!App" /> - <App AppUserModelId="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> - <App DesktopAppPath="%windir%\system32\mspaint.exe" /> - <App DesktopAppPath="C:\Windows\System32\notepad.exe" /> - </AllowedApps> - </AllAppsList> - <StartLayout> - <![CDATA[<LayoutModificationTemplate xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" Version="1" xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification"> - <LayoutOptions StartTileGroupCellWidth="6" /> - <DefaultLayoutOverride> - <StartLayoutCollection> - <defaultlayout:StartLayout GroupCellWidth="6"> - <start:Group Name="Group1"> - <start:Tile Size="4x4" Column="0" Row="0" AppUserModelID="Microsoft.ZuneMusic_8wekyb3d8bbwe!Microsoft.ZuneMusic" /> - <start:Tile Size="2x2" Column="4" Row="2" AppUserModelID="Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo" /> - <start:Tile Size="2x2" Column="4" Row="0" AppUserModelID="Microsoft.Windows.Photos_8wekyb3d8bbwe!App" /> - <start:Tile Size="2x2" Column="4" Row="4" AppUserModelID="Microsoft.BingWeather_8wekyb3d8bbwe!App" /> - <start:Tile Size="4x2" Column="0" Row="4" AppUserModelID="Microsoft.WindowsCalculator_8wekyb3d8bbwe!App" /> - </start:Group> - <start:Group Name="Group2"> - <start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk" /> - <start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk" /> - </start:Group> - </defaultlayout:StartLayout> - </StartLayoutCollection> - </DefaultLayoutOverride> - </LayoutModificationTemplate> - ]]> - </StartLayout> - <Taskbar ShowTaskbar="true"/> - </Profile> - </Profiles> - <Configs> - <Config> - <Account>MultiAppKioskUser</Account> - <DefaultProfile Id="{9A2A490F-10F6-4764-974A-43B19E722C23}"/> - </Config> - </Configs> -</AssignedAccessConfiguration> -"@ - -Set-CimInstance -CimInstance $obj -``` - - -## Validate multi-app kiosk configuration - -Sign in with the assigned access user account you specified in the configuration to check out the multi-app experience. - ->[!NOTE] ->The setting will take effect the next time the assigned access user signs in. If that user account is signed in when you apply the configuration, make sure the user signs out and signs back in to validate the experience. - -The following sections explain what to expect on a multi-app kiosk. - -### App launching and switching experience - -In the multi-app mode, to maximize the user productivity and streamline the experience, an app will be always launched in full screen when the users click the tile on the Start. The users can minimize and close the app, but cannot resize the app window. - -The users can switch apps just as they do today in Windows. They can use the Task View button, Alt + Tab hotkey, and the swipe in from the left gesture to view all the open apps in task view. They can click the Windows button to show Start, from which they can open apps, and they can switch to an opened app by clicking it on the taskbar. - -### Start changes - -When the assigned access user signs in, you should see a restricted Start experience: -- Start gets launched in full screen and prevents the end user from accessing the desktop. -- Start shows the layout aligned with what you defined in the multi-app configuration XML. -- Start prevents the end user from changing the tile layout. - - The user cannot resize, reposition, and unpin the tiles. - - The user cannot pin additional tiles on the start. -- Start hides **All Apps** list. -- Start hides all the folders on Start (including File Explorer, Settings, Documents, Downloads, Music, Pictures, Videos, HomeGroup, Network, and Personal folders). -- Only **User** and **Power** buttons are available. (You can control whether to show the **User/Power** buttons using [existing policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-start).) -- Start hides **Change account settings** option under **User** button. - -### Taskbar changes - -If the applied multi-app configuration enables taskbar, when the assigned access user signs in, you should see a restricted Taskbar experience: -- Disables context menu of Start button (Quick Link) -- Disables context menu of taskbar -- Prevents the end user from changing the taskbar -- Disables Cortana and Search Windows -- Hides notification icons and system icons, e.g. Action Center, People, Windows Ink Workspace -- Allows the end user to view the status of the network connection and power state, but disables the flyout of **Network/Power** to prevent end user from changing the settings - -### Blocked hotkeys - -The multi-app mode blocks the following hotkeys, which are not relevant for the lockdown experience. - -| Hotkey | Action | -| --- | --- | -| Windows logo key + A | Open Action center | -| Windows logo key + Shift + C | Open Cortana in listening mode | -| Windows logo key + D | Display and hide the desktop | -| Windows logo key + Alt + D | Display and hide the date and time on the desktop | -| Windows logo key + E | Open File Explorer | -| Windows logo key + F | Open Feedback Hub | -| Windows logo key + G | Open Game bar when a game is open | -| Windows logo key + I | Open Settings | -| Windows logo key + J | Set focus to a Windows tip when one is available. | -| Windows logo key + O | Lock device orientation | -| Windows logo key + Q | Open search | -| Windows logo key + R | Open the Run dialog box | -| Windows logo key + S | Open search | -| Windows logo key + X | Open the Quick Link menu | -| Windows logo key + comma (,) | Temporarily peek at the desktop | -| Windows logo key + Ctrl + F | Search for PCs (if you're on a network) | -### Locked-down Ctrl+Alt+Del screen - -The multi-app mode removes options (e.g. **Change a password**, **Task Manager**, **Network**) in the Ctrl+Alt+Del screen to ensure the users cannot access the functionalities that are not allowed in the lockdown experience. - -### Auto-trigger touch keyboard - -In the multi-app mode, the touch keyboard will be automatically triggered when there is an input needed and no physical keyboard is attached on touch-enabled devices. You don’t need to configure any other setting to enforce this behavior. @@ -756,3 +614,6 @@ In Windows Configuration Designer, under **ProvisioningCommands** > **DeviceCont - Under **CommandLine**, enter `cmd /c *FileName*.bat`. +## Other methods + +Environments that use WMI can use the [MDM Bridge WMI Provider to configure a kiosk](kiosk-mdm-bridge.md). \ No newline at end of file diff --git a/windows/configuration/lockdown-features-windows-10.md b/windows/configuration/lockdown-features-windows-10.md index d77388e0cb..1628b1c866 100644 --- a/windows/configuration/lockdown-features-windows-10.md +++ b/windows/configuration/lockdown-features-windows-10.md @@ -52,10 +52,10 @@ Many of the lockdown features available in Windows Embedded 8.1 Industry have be

    Keyboard filter is added in Windows 10, version 1511. As in Windows Embedded Industry 8.1, Keyboard Filter is an optional component that can be turned on via Turn Windows Features On/Off. Keyboard Filter (in addition to the WMI configuration previously available) will be configurable through Windows Imaging and Configuration Designer (ICD) in the SMISettings path.

    -

    [Shell Launcher](https://go.microsoft.com/fwlink/p/?LinkId=626676): launch a Classic Windows application on sign-on

    +

    [Shell Launcher](https://go.microsoft.com/fwlink/p/?LinkId=626676): launch a Windows desktop application on sign-on

    [Shell Launcher](https://go.microsoft.com/fwlink/p/?LinkId=618603)

    Shell Launcher continues in Windows 10. It is now configurable in Windows ICD under the SMISettings category.

    -

    Learn [how to use Shell Launcher to create a kiosk device](https://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Classic Windows application.

    +

    Learn [how to use Shell Launcher to create a kiosk device](https://go.microsoft.com/fwlink/p/?LinkId=626922) that runs a Windows desktop application.

    [Application Launcher]( https://go.microsoft.com/fwlink/p/?LinkId=626675): launch a Universal Windows Platform (UWP) app on sign-on

    diff --git a/windows/configuration/multi-app-kiosk-troubleshoot.md b/windows/configuration/multi-app-kiosk-troubleshoot.md index 0ee82de1b3..6857cf8aac 100644 --- a/windows/configuration/multi-app-kiosk-troubleshoot.md +++ b/windows/configuration/multi-app-kiosk-troubleshoot.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: edu, security author: jdeckerms ms.localizationpriority: medium -ms.date: 09/27/2017 +ms.date: 07/30/2018 ms.author: jdecker ms.topic: article --- @@ -31,7 +31,7 @@ For example: **Troubleshooting steps** -1. [Verify that the provisioning package is applied successfully](lock-down-windows-10-to-specific-apps.md#validate-provisioning). +1. [Verify that the provisioning package is applied successfully](kiosk-validate.md). 2. Verify that the account (config) is mapped to a profile in the configuration XML file. 3. Verify that the configuration XML file is authored and formatted correctly. Correct any configuration errors, then create and apply a new provisioning package. Sign out and sign in again to check the new configuration. diff --git a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md index 17162822c3..9979020ba7 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md +++ b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md @@ -82,7 +82,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L ![step one](../images/one.png)![set up device](../images/set-up-device.png)

    Enter a name for the device.

    (Optional) Select a license file to upgrade Windows 10 to a different edition. [See the permitted upgrades.](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades)

    Toggle **Yes** or **No** to **Configure devices for shared use**. This setting optimizes Windows 10 for shared use scenarios. [Learn more about shared PC configuration.](../set-up-shared-or-guest-pc.md)

    You can also select to remove pre-installed software from the device. ![device name, upgrade to enterprise, shared use, remove pre-installed software](../images/set-up-device-details-desktop.png) ![step two](../images/two.png) ![set up network](../images/set-up-network.png)

    Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, the network type (**Open** or **WPA2-Personal**), and (if **WPA2-Personal**) the password for the wireless network.![Enter network SSID and type](../images/set-up-network-details-desktop.png) ![step three](../images/three.png) ![account management](../images/account-management.png)

    Enable account management if you want to configure settings on this page.

    You can enroll the device in Active Directory, enroll in Azure Active Directory, or create a local administrator account on the device

    To enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain.

    Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup). The **maximum number of devices per user** setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click **Get bulk token**. In the **Let's get you signed in** window, enter an account that has permissions to join a device to Azure AD, and then the password. Click **Accept** to give Windows Configuration Designer the necessary permissions.

    To create a local administrator account, select that option and enter a user name and password.

    **Important:** If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in. ![join Active Directory, Azure AD, or create a local admin account](../images/account-management-details.png) -![step four](../images/four.png) ![add applications](../images/add-applications.png)

    You can install multiple applications, both Classic Windows (Win32) apps and Universal Windows Platform (UWP) apps, in a provisioning package. The settings in this step vary according to the application that you select. For help with the settings, see [Provision PCs with apps](provision-pcs-with-apps.md). ![add an application](../images/add-applications-details.png) +![step four](../images/four.png) ![add applications](../images/add-applications.png)

    You can install multiple applications, both Windows desktop applications (Win32) and Universal Windows Platform (UWP) apps, in a provisioning package. The settings in this step vary according to the application that you select. For help with the settings, see [Provision PCs with apps](provision-pcs-with-apps.md). ![add an application](../images/add-applications-details.png) ![step five](../images/five.png) ![add certificates](../images/add-certificates.png)

    To provision the device with a certificate, click **Add a certificate**. Enter a name for the certificate, and then browse to and select the certificate to be used.![add a certificate](../images/add-certificates-details.png) ![finish](../images/finish.png)

    You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.![Protect your package](../images/finish-details.png) diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index bacec7e70a..9f7712c5d3 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -20,7 +20,7 @@ ms.date: 09/06/2017 - Windows 10 -In Windows 10, version 1703, you can install multiple Universal Windows Platform (UWP) apps and Classic Windows (Win32) applications in a provisioning package. This topic explains the various settings in [Windows Configuration Designer](provisioning-install-icd.md) for app install. +In Windows 10, version 1703, you can install multiple Universal Windows Platform (UWP) apps and Windows desktop applications (Win32) in a provisioning package. This topic explains the various settings in [Windows Configuration Designer](provisioning-install-icd.md) for app install. When you add an app in a Windows Configuration Designer wizard, the appropriate settings are displayed based on the app that you select. For instructions on adding an app using the advanced editor in Windows Configuration Designer, see [Add an app using advanced editor](#adv). @@ -35,7 +35,7 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate - **Required appx dependencies**: Specify the appx dependency packages that are required for the installation of the app -## Settings for Classic Windows apps +## Settings for Windows desktop applications ### MSI installer @@ -61,7 +61,7 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate -## Add a Classic Windows app using advanced editor in Windows Configuration Designer +## Add a Windows desktop application using advanced editor in Windows Configuration Designer 1. In the **Available customizations** pane, go to **Runtime settings** > **ProvisioningCommands** > **PrimaryContext** > **Command**. diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index b05f6637ed..c0cbd3ed3f 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -43,7 +43,7 @@ You use Windows Configuration Designer to create a provisioning package (.ppkg) - [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) - [Instructions for the mobile wizard](../mobile-devices/provisioning-configure-mobile.md) - - [Instructions for the kiosk wizard](../setup-kiosk-digital-signage.md#wizard) + - [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) - [Instructions for HoloLens wizard](https://technet.microsoft.com/itpro/hololens/hololens-provisioning) - [Instructions for Surface Hub wizard](https://technet.microsoft.com/itpro/surface-hub/provisioning-packages-for-certificates-surface-hub) diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index 4bbbf8ad10..2a331f5839 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -86,7 +86,7 @@ The following table describes settings that you can configure using the wizards - [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) - [Instructions for the mobile wizard](../mobile-devices/provisioning-configure-mobile.md) -- [Instructions for the kiosk wizard](../setup-kiosk-digital-signage.md#wizard) +- [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) - [Instructions for the HoloLens wizard](https://docs.microsoft.com/hololens/hololens-provisioning#wizard) diff --git a/windows/configuration/setup-digital-signage.md b/windows/configuration/setup-digital-signage.md new file mode 100644 index 0000000000..d5ea73a4a8 --- /dev/null +++ b/windows/configuration/setup-digital-signage.md @@ -0,0 +1,91 @@ +--- +title: Set up digital signs on Windows 10 (Windows 10) +description: A single-use device such as a digital sign is easy to set up in Windows 10 (Pro, Enterprise, and Education). +ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC +keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage", "kiosk browser", "browser"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerms +ms.localizationpriority: medium +ms.date: 08/03/2018 +--- + +# Set up digital signs on Windows 10 + + +**Applies to** + +- Windows 10 Pro, Enterprise, and Education + +Digital signage can be a useful and exciting business tool. Use digital signs to showcase your products and services, to display testimonials, or to advertise promotions and campaigns. A digital sign can be a static display, such as a building directory or menu, or it can be dynamic, such as repeating videos or a social media feed. + +For digital signage, simply select a digital sign player as your kiosk app. You can also use the Kiosk Browser app (a new Microsoft app for Windows 10, version 1803) and configure it to show your online content. + +>[!TIP] +>Kiosk Browser can also be used in [single-app kiosks](kiosk-single-app.md) and [multi-app kiosk](lock-down-windows-10-to-specific-apps.md) as a web browser. For more information, see [Guidelines for web browsers](guidelines-for-assigned-access-app.md#guidelines-for-web-browsers). + +Kiosk Browser must be downloaded for offline licensing using Microsoft Store for Business. You can deploy Kiosk Browser to devices running Windows 10, version 1803. + +>[!NOTE] +>If you haven't set up your Microsoft Store for Business yet, check out [the prerequisites](https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business) and then [sign up](https://docs.microsoft.com/microsoft-store/sign-up-microsoft-store-for-business). + + +This procedure explains how to configure digital signage using Kiosk Browser on a device running Windows 10, version 1803, that has already been set up (completed the first-run experience). + +1. [Get **Kiosk Browser** in Microsoft Store for Business with offline, unencoded license type.](https://docs.microsoft.com/microsoft-store/acquire-apps-microsoft-store-for-business#acquire-apps) +2. [Download the **Kiosk Browser** package, license file, and all required frameworks.](https://docs.microsoft.com/microsoft-store/distribute-offline-apps#download-an-offline-licensed-app) +2. [Install Windows Configuration Designer.](~/provisioning-packages/provisioning-install-icd.md) +3. Open Windows Configuration Designer and select **Provision kiosk devices**. +4. Enter a friendly name for the project, and select **Finish**. +5. On **Set up device**, select **Disabled**, and select **Next**. +6. On **Set up network**, enable network setup. + - Toggle **On** wireless network connectivity. + - Enter the SSID, the network type (**Open** or **WPA2-Personal**), and (if **WPA2-Personal**) the password for the wireless network. +7. On **Account management**, select **Disabled**, and select **Next**. +8. On **Add applications**, select **Add an application**. + - For **Application name**, enter `Kiosk Browser`. + - For **Installer path**, browse to and select the AppxBundle that you downloaded from Microsoft Store for Business. After you select the package, additional fields are displayed. + - For **License file path**, browse to and select the XML license file that you downloaded from Microsoft Store for Business. + - The **Package family name** is populated automatically. + - Select **Next**. +9. On **Add certificates**, select **Next**. +10. On **Configure kiosk account and app**, toggle **Yes** to create a local user account for your digital signage. + - Enter a user name and password, and toggle **Auto sign-in** to **Yes**. + - Under **Configure the kiosk mode app**, enter the user name for the account that you're creating. + - For **App type**, select **Universal Windows App**. + - In **Enter the AUMID for the app**, enter `Microsoft.KioskBrowser_8wekyb3d8bbwe`. +11. In the bottom left corner of Windows Configuration Designer, select **Switch to advanced editor**. +12. Go to **Runtime settings** > **Policies** > **KioskBrowser**. Let's assume that the URL for your digital signage content is contoso.com/menu. + - In **BlockedUrlExceptions**, enter `https://www.contoso.com/menu`. + - In **BlockedUrl**, enter `*`. + - In **DefaultUrl**, enter `https://www.contoso.com/menu`. + - Set **EnableEndSessionButton**, **EnableHomeButton**, and **EnableNavigationButtons** to **No**. + + >[!TIP] + >For more information on kiosk browser settings, see [Guidelines for web browsers](guidelines-for-assigned-access-app.md#guidelines-for-web-browsers). + +13. On the **File** menu, select **Save**, and select **OK** in the **Keep your info secure** dialog box. +14. On the **Export** menu, select **Provisioning package**. +15. Change the **Owner** to **IT Admin**, and select **Next**. +16. On **Select security details for the provisioning package**, select **Next**. +17. On **Select where to save the provisioning package**, select **Next**. +18. On **Build the provisioning package**, select **Build**. +19. On the **All done!** screen, click the **Output location**. +20. Copy the .ppkg file to a USB drive. +21. Attach the USB drive to the device that you want to use for your digital sign. +22. Go to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package on the USB drive. + + + + + + + + + + + + + + \ No newline at end of file diff --git a/windows/configuration/setup-kiosk-digital-signage.md b/windows/configuration/setup-kiosk-digital-signage.md deleted file mode 100644 index f2f227fd8c..0000000000 --- a/windows/configuration/setup-kiosk-digital-signage.md +++ /dev/null @@ -1,487 +0,0 @@ ---- -title: Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education (Windows 10) -description: A single-use device such as a digital sign is easy to set up in Windows 10 for desktop editions (Pro, Enterprise, and Education). -ms.assetid: 428680AE-A05F-43ED-BD59-088024D1BFCC -keywords: ["assigned access", "kiosk", "lockdown", "digital sign", "digital signage"] -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -author: jdeckerms -ms.author: jdecker -ms.topic: article -ms.localizationpriority: medium -ms.date: 06/05/2018 ---- - -# Set up a kiosk or digital signage on Windows 10 Pro, Enterprise, or Education - - -**Applies to** - -- Windows 10 Pro, Enterprise, and Education - - - -Some desktop devices in an enterprise serve a special purpose, such as a PC in the lobby that customers can use to view your product catalog or a PC displaying visual content as a digital sign. A single-use, kiosk device is easy to set up in Windows 10. (For kiosks that run more than one more app, see [Create a Windows 10 kiosk that runs multiple apps](lock-down-windows-10-to-specific-apps.md).) - - - -## Choose a method for configuring your kiosks and digitals signs - -**Which type of app will your kiosk run?** Your kiosk can run a Universal Windows Platform (UWP) app or a Classic Windows desktop application. When the kiosk account signs in, the kiosk app will launch automatically. If the kiosk app is closed, it will automatically restart. - ->[!TIP] ->For **digital signage**, simply select a digital sign player as your kiosk app. You can also use the **Kiosk Browser** app ([new in Windows 10, version 1803)](guidelines-for-assigned-access-app.md#guidelines-for-web-browsers) and configure it to show your online content. - -**Which type of user account will be the kiosk account?** The kiosk account can be a local standard user account, a local administrator account, a domain account, or an Azure Active Directory (Azure AD) account, depending on the method that you use to configure the kiosk. - ->[!WARNING] ->For kiosks in public-facing environments with auto sign-in enabled, you should use a user account with least privilege, such as a local standard user account. -> ->Assigned access can be configured via Windows Management Instrumentation (WMI) or configuration service provider (CSP) to run its applications under a domain user or service account, rather than a local account. However, use of domain user or service accounts introduces risks that an attacker subverting the assigned access application might gain access to sensitive domain resources that have been inadvertently left accessible to any domain account. We recommend that customers proceed with caution when using domain accounts with assigned access, and consider the domain resources potentially exposed by the decision to do so. - -**Which edition of Windows 10 will the kiosk run?** All of the configuration methods work for Windows 10 Enterprise and Education; some of the methods work for Windows 10 Pro. Kiosk mode is not available on Windows 10 Home. - -### Methods for kiosks and digital signs running a UWP app - -Choose this method | For this edition | For this kiosk account type ---- | --- | --- -[Local settings](#local) (for 1 or a few devices) | Pro, Ent, Edu | Local standard user -[PowerShell](#powershell) | Pro, Ent, Edu | Local standard user -[Provisioning](#wizard) | Pro (version 1709), Ent, Edu | Local standard user, Active Directory -[Intune or other mobile device management (MDM)](#set-up-assigned-access-in-mdm) | Pro (version 1709), Ent, Edu | Local standard user, Azure AD - -### Methods for kiosks and digital signs running a Classic Windows app - -Choose this method | For this edition | For this kiosk account type ---- | --- | --- -[Provisioning](#wizard) | Ent, Edu | Local standard user, Active Directory -[ShellLauncher](#shelllauncher) | Ent, Edu | Local standard user or administrator, Active Directory, Azure AD - - - - - -### Other settings to lock down - -For a more secure kiosk experience, we recommend that you make the following configuration changes to the device before you configure it as a kiosk: - -Recommendation | How to ---- | --- -Replace "blue screen" with blank screen for OS errors | Add the following registry key as DWORD (32-bit) type with a value of `1`:

    `HKLM\SYSTEM\CurrentControlSet\Control\CrashControl\DisplayDisabled`

    [Learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002)

    You must restart the device after changing the registry. -Put device in **Tablet mode**. | If you want users to be able to use the touch (on screen) keyboard, go to **Settings** > **System** > **Tablet mode** and choose **On.** Do not turn on this setting if users will not interact with the kiosk, such as for a digital sign. -Hide **Ease of access** feature on the logon screen. | Go to **Control Panel** > **Ease of Access** > **Ease of Access Center**, and turn off all accessibility tools. -Disable the hardware power button. | Go to **Power Options** > **Choose what the power button does**, change the setting to **Do nothing**, and then **Save changes**. -Remove the power button from the sign-in screen. | Go to **Computer Configuration** > **Windows Settings** > **Security Settings** > **Local Policies** >**Security Options** > **Shutdown: Allow system to be shut down without having to log on** and select **Disabled.** -Disable the camera. | Go to **Settings** > **Privacy** > **Camera**, and turn off **Let apps use my camera**. -Turn off app notifications on the lock screen. | Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Logon\\Turn off app notifications on the lock screen**. -Disable removable media. | Go to **Group Policy Editor** > **Computer Configuration** > **Administrative Templates\\System\\Device Installation\\Device Installation Restrictions**. Review the policy settings available in **Device Installation Restrictions** for the settings applicable to your situation.

    **NOTE**: To prevent this policy from affecting a member of the Administrators group, in **Device Installation Restrictions**, enable **Allow administrators to override Device Installation Restriction policies**. - -In addition to the settings in the table, you may want to set up **automatic logon** for your kiosk device. When your kiosk device restarts, whether from an update or power outage, you can log on the assigned access account manually or you can configure the device to log on to the assigned access account automatically. Make sure that Group Policy settings applied to the device do not prevent automatic logon. - - -**How to edit the registry to have an account automatically logged on** - -1. Open Registry Editor (regedit.exe). - - >[!NOTE]   - >If you are not familiar with Registry Editor, [learn how to modify the Windows registry](https://go.microsoft.com/fwlink/p/?LinkId=615002). -   - -2. Go to - - **HKEY\_LOCAL\_MACHINE\SOFTWARE\\Microsoft\WindowsNT\CurrentVersion\Winlogon** - -3. Set the values for the following keys. - - - *AutoAdminLogon*: set value as **1**. - - - *DefaultUserName*: set value as the account that you want logged in. - - - *DefaultPassword*: set value as the password for the account. - - > [!NOTE] - > If *DefaultUserName* and *DefaultPassword* aren't there, add them as **New** > **String Value**. - - - *DefaultDomainName*: set value for domain, only for domain accounts. For local accounts, do not add this key. - -4. Close Registry Editor. The next time the computer restarts, the account will be logged on automatically. - ->[!TIP] ->You can also configure automatic logon [using the Autologon tool from Sysinternals](https://docs.microsoft.com/sysinternals/downloads/autologon). - - - -## Set up a kiosk or digital sign in local Settings - ->App type: UWP -> ->OS edition: Windows 10 Pro, Ent, Edu -> ->Account type: Local standard user - -You can use **Settings** to quickly configure one or a few devices as a kiosk. (Using **Settings** isn't practical for configuring a lot of devices, but it would work.) When you set up a kiosk (also known as *assigned access*) in **Settings**, you must select a local standard user account. [Learn how to create a local standard user account.](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) - -When your kiosk is a local device that is not managed by Active Directory or Azure Active Directory, there is a default setting that enables automatic sign-in after a restart. That means that when the device restarts, the last signed-in user will be signed in automatically. If the last signed-in user is the kiosk account, the kiosk app will be launched automatically after the device restarts. - -If you want the kiosk account signed in automatically and the kiosk app launched when the device restarts, there is nothing you need to do. - -If you do not want the kiosk account signed in automatically when the device restarts, you must change the default setting before you configure the device as a kiosk. Sign in with the account that you will assign as the kiosk account, go to **Settings** > **Accounts** > **Sign-in options**, and toggle the **Use my sign-in info to automatically finish setting up my device after an update or restart** setting to **Off**. After you change the setting, you can apply the kiosk configuration to the device. - -![Screenshot of automatic sign-in setting](images/auto-signin.png) - -**To set up assigned access in PC settings** - -1. Go to **Start** > **Settings** > **Accounts** > **Other people**. - -2. Choose **Set up assigned access**. - -3. Choose an account. - -4. Choose an app. Only apps that can run above the lock screen will be available in the list of apps to choose from. For more information, see [Guidelines for choosing an app for assigned access](guidelines-for-assigned-access-app.md). - -5. Close **Settings** – your choices are saved automatically, and will be applied the next time that user account logs on. - -To remove assigned access, choose **Turn off assigned access and sign out of the selected account**. - - - - - -## Set up a kiosk or digital sign using Windows PowerShell - - ->App type: UWP -> ->OS edition: Windows 10 Pro, Ent, Edu -> ->Account type: Local standard user - -You can use any of the following PowerShell cmdlets to set up assigned access on multiple devices. - -To open PowerShell on Windows 10, search for PowerShell and find **Windows PowerShell Desktop app** in the results. Run PowerShell as administrator. - -``` -Set-AssignedAccess -AppUserModelId -UserName -``` - -``` -Set-AssignedAccess -AppUserModelId -UserSID -``` - -``` -Set-AssignedAccess -AppName -UserName -``` - -``` -Set-AssignedAccess -AppName -UserSID -``` - -> [!NOTE] -> To set up assigned access using `-AppName`, the user account that you specify for assigned access must have logged on at least once. - -[Learn how to get the AUMID](https://go.microsoft.com/fwlink/p/?LinkId=614867). - -[Learn how to get the AppName](https://msdn.microsoft.com/library/windows/hardware/mt620046%28v=vs.85%29.aspx) (see **Parameters**). - -[Learn how to get the SID](https://go.microsoft.com/fwlink/p/?LinkId=615517). - -To remove assigned access, using PowerShell, run the following cmdlet. - -``` -Clear-AssignedAccess -``` - - - -## Set up a kiosk or digital sign using a provisioning package - ->App type: UWP or Classic Windows -> ->OS edition: Windows 10 Pro (version 1709) for UWP only; Ent, Edu for both app types -> ->Account type: Local standard user, Active Directory - ->[!IMPORTANT] ->When Exchange Active Sync (EAS) password restrictions are active on the device, the autologon feature does not work. This behavior is by design. For more informations, see [How to turn on automatic logon in Windows](https://support.microsoft.com/help/324737/how-to-turn-on-automatic-logon-in-windows). - - -When you use the **Provision kiosk devices** wizard in Windows Configuration Designer, you can configure the kiosk to run either a Universal Windows app or a Classic Windows application. - - - - -[Install Windows Configuration Designer](provisioning-packages/provisioning-install-icd.md), then open Windows Configuration Designer and select **Provision kiosk devices**. After you name your project, and click **Next**, configure the settings as shown in the following table. - - - - - - - - - - - - -
    ![step one](images/one.png)![set up device](images/set-up-device.png)

    Enable device setup if you want to configure settings on this page.

    **If enabled:**

    Enter a name for the device.

    (Optional) Select a license file to upgrade Windows 10 to a different edition. [See the permitted upgrades.](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades)

    Toggle **Configure devices for shared use** off. This setting optimizes Windows 10 for shared use scenarios and isn't necessary for a kiosk scenario.

    You can also select to remove pre-installed software from the device.     		![device name, upgrade to enterprise, shared use, remove pre-installed software](images/set-up-device-details.png)
    ![step two](images/two.png) ![set up network](images/set-up-network.png)

    Enable network setup if you want to configure settings on this page.

    **If enabled:**

    Toggle **On** or **Off** for wireless network connectivity. If you select **On**, enter the SSID, the network type (**Open** or **WPA2-Personal**), and (if **WPA2-Personal**) the password for the wireless network.    		![Enter network SSID and type](images/set-up-network-details.png)
    ![step three](images/three.png) ![account management](images/account-management.png)

    Enable account management if you want to configure settings on this page.

    **If enabled:**

    You can enroll the device in Active Directory, enroll in Azure Active Directory, or create a local administrator account on the device

    To enroll the device in Active Directory, enter the credentials for a least-privileged user account to join the device to the domain.

    Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, [set up Azure AD join in your organization](https://docs.microsoft.com/azure/active-directory/active-directory-azureadjoin-setup). The **maximum number of devices per user** setting in your Azure AD tenant determines how many times the bulk token that you get in the wizard can be used. To enroll the device in Azure AD, select that option and enter a friendly name for the bulk token you will get using the wizard. Set an expiration date for the token (maximum is 30 days from the date you get the token). Click **Get bulk token**. In the **Let's get you signed in** window, enter an account that has permissions to join a device to Azure AD, and then the password. Click **Accept** to give Windows Configuration Designer the necessary permissions.

    **Warning:** You must run Windows Configuration Designer on Windows 10 to configure Azure Active Directory enrollment using any of the wizards.

    To create a local administrator account, select that option and enter a user name and password.

    **Important:** If you create a local account in the provisioning package, you must change the password using the **Settings** app every 42 days. If the password is not changed during that period, the account might be locked out and unable to sign in.     		![join Active Directory, Azure AD, or create a local admin account](images/account-management-details.png)
    ![step four](images/four.png) ![add applications](images/add-applications.png)

    You can provision the kiosk app in the **Add applications** step. You can install multiple applications, both Classic Windows (Win32) apps and Universal Windows Platform (UWP) apps, in a provisioning package. The settings in this step vary according to the application that you select. For help with the settings, see [Provision PCs with apps](provisioning-packages/provision-pcs-with-apps.md)

    **Warning:** If you click the plus button to add an application, you must specify an application for the provisioning package to validate. If you click the plus button in error, select any executable file in **Installer Path**, and then a **Cancel** button becomes available, allowing you to complete the provisioning package without an application.     		![add an application](images/add-applications-details.png)
    ![step five](images/five.png) ![add certificates](images/add-certificates.png)

    To provision the device with a certificate for the kiosk app, click **Add a certificate**. Enter a name for the certificate, and then browse to and select the certificate to be used.    		![add a certificate](images/add-certificates-details.png)
    ![step six](images/six.png) ![Configure kiosk account and app](images/kiosk-account.png)

    You can create a local standard user account that will be used to run the kiosk app. If you toggle **No**, make sure that you have an existing user account to run the kiosk app.

    If you want to create an account, enter the user name and password, and then toggle **Yes** or **No** to automatically sign in the account when the device starts.

    In **Configure the kiosk mode app**, enter the name of the user account that will run the kiosk mode app. Select the type of app to run in kiosk mode, and then enter the path or filename (for a Classic Windows app) or the AUMID (for a Universal Windows app). For a Classic Windows app, you can use the filename if the path to the file is in the PATH environment variable, otherwise the full path is required.    		![Configure kiosk account and app](images/kiosk-account-details.png)
    ![step seven](images/seven.png) ![configure kiosk common settings](images/kiosk-common.png)

    On this step, select your options for tablet mode, the user experience on the Welcome and shutdown screens, and the timeout settings.    		![set tablet mode and configure welcome and shutdown and turn off timeout settings](images/kiosk-common-details.png)
    ![finish](images/finish.png)

    You can set a password to protect your provisioning package. You must enter this password when you apply the provisioning package to a device.    		![Protect your package](images/finish-details.png)
    - - ->[!NOTE] ->If you want to use [the advanced editor in Windows Configuration Designer](provisioning-packages/provisioning-create-package.md#configure-settings), specify the user account and app (by AUMID) in **Runtime settings** > **AssignedAccess** > **AssignedAccessSettings** - ->[!TIP] ->You can also use [an XML file to configure both multi-app and single-app kiosks.](lock-down-windows-10-to-specific-apps.md) - ->[!IMPORTANT] ->When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - - - -[Learn how to apply a provisioning package.](provisioning-packages/provisioning-apply-package.md) - - - - - -  - - - -## Set up a kiosk or digital sign in Intune or other MDM service - ->App type: UWP -> ->OS edition: Windows 10 Pro (version 1709), Ent, Edu -> ->Account type: Local standard user, Azure AD - -Microsoft Intune and other MDM services enable kiosk configuration through the [AssignedAccess configuration service provider (CSP)](https://docs.microsoft.com/windows/client-management/mdm/assignedaccess-csp). Assigned Access has a KioskModeApp setting. In the KioskModeApp setting, you enter the user account name and [AUMID](https://docs.microsoft.com/windows-hardware/customize/enterprise/find-the-application-user-model-id-of-an-installed-app) for the app to run in kiosk mode. - -The following steps explain how to configure a kiosk in Microsoft Intune. For other MDM services, see the documentation for your provider. - -**To configure kiosk in Microsoft Intune** - -2. In the Microsoft Azure portal, search for **Intune** or go to **More services** > **Intune**. -3. Select **Device configuration**. -4. Select **Profiles**. -5. Select **Create profile**. -6. Enter a friendly name for the profile. -7. Select **Windows 10 and later** for the platform. -8. Select **Kiosk (Preview)** for the profile type. -9. Enter a friendly name for the kiosk configuration. -10. Select **Kiosk - 1 setting available**. -10. Select **Add** to add a kiosk configuration. -10. Enter a friendly name for the kiosk configuration, and then in **Kiosk Mode**, select **Single full-screen app kiosk**. -10. Select either **Select a managed app** to choose a kiosk app that is managed by Intune, or **Enter UWP app AUMID** to specify the kiosk app by AUMID, and then select the app or enter the AUMID as appropriate. -1. For the user account, select either **Autologon** to create a user account for the kiosk that will sign in automatically, or **Local user account** to configure an existing user account to run the kiosk. **Local user account** can be a local standard user account on the device or an Azure Active Directory account. -14. Select **OK**, and then select **Create**. -18. Assign the profile to a device group to configure the devices in that group as kiosks. - - - -## Set up a kiosk or digital sign using Shell Launcher - ->App type: Classic Windows -> ->OS edition: Windows 10 Ent, Edu -> ->Account type: Local standard user or administrator, Active Directory, Azure AD - -Using Shell Launcher, you can configure a kiosk device that runs a Classic Windows application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on. - ->[!NOTE] ->In Windows 10, version 1803, you can configure Shell Launcher using the **ShellLauncher** node of the [Assigned Access CSP](https://docs.microsoft.com/en-us/windows/client-management/mdm/assignedaccess-csp). -> ->You can also configure a kiosk device that runs a Classic Windows application by using the [Provision kiosk devices wizard](#wizard). - ->[!WARNING] ->- Windows 10 doesn’t support setting a custom shell prior to OOBE. If you do, you won’t be able to deploy the resulting image. ->- Shell Launcher doesn't support a custom shell with an application that launches a different process and exits. For example, you cannot specify **write.exe** in Shell Launcher. Shell Launcher launches a custom shell and monitors the process to identify when the custom shell exits. **Write.exe** creates a 32-bit wordpad.exe process and exits. Because Shell Launcher is not aware of the newly created wordpad.exe process, Shell Launcher will take action based on the exit code of **Write.exe**, such as restarting the custom shell. - -### Requirements - -- A domain or local user account. - -- A Classic Windows application that is installed for that account. The app can be your own company application or a common app like Internet Explorer. - -[See the technical reference for the shell launcher component.](https://go.microsoft.com/fwlink/p/?LinkId=618603) - - -### Configure Shell Launcher - -To set a Classic Windows application as the shell, you first turn on the Shell Launcher feature, and then you can set your custom shell as the default using PowerShell. - -**To turn on Shell Launcher in Windows features** - -1. Go to Control Panel > **Programs and features** > **Turn Windows features on or off**. - -2. Expand **Device Lockdown**. - -2. Select **Shell Launcher** and **OK**. - -Alternatively, you can turn on Shell Launcher using Windows Configuration Designer in a provisioning package, using `SMISettings > ShellLauncher`, or the Deployment Image Servicing and Management (DISM.exe) tool. - -**To turn on Shell Launcher using DISM** - -1. Open a command prompt as an administrator. -2. Enter the following command. - - ``` - Dism /online /Enable-Feature /all /FeatureName:Client-EmbeddedShellLauncher - ``` - -**To set your custom shell** - -Modify the following PowerShell script as appropriate. The comments in the sample script explain the purpose of each section and tell you where you will want to change the script for your purposes. Save your script with the extension .ps1, open Windows PowerShell as administrator, and run the script on the kiosk device. - -``` -# Check if shell launcher license is enabled -function Check-ShellLauncherLicenseEnabled -{ - [string]$source = @" -using System; -using System.Runtime.InteropServices; - -static class CheckShellLauncherLicense -{ - const int S_OK = 0; - - public static bool IsShellLauncherLicenseEnabled() - { - int enabled = 0; - - if (NativeMethods.SLGetWindowsInformationDWORD("EmbeddedFeature-ShellLauncher-Enabled", out enabled) != S_OK) { - enabled = 0; - } - - return (enabled != 0); - } - - static class NativeMethods - { - [DllImport("Slc.dll")] - internal static extern int SLGetWindowsInformationDWORD([MarshalAs(UnmanagedType.LPWStr)]string valueName, out int value); - } - -} -"@ - - $type = Add-Type -TypeDefinition $source -PassThru - - return $type[0]::IsShellLauncherLicenseEnabled() -} - -[bool]$result = $false - -$result = Check-ShellLauncherLicenseEnabled -"`nShell Launcher license enabled is set to " + $result -if (-not($result)) -{ - "`nThis device doesn't have required license to use Shell Launcher" - exit -} - -$COMPUTER = "localhost" -$NAMESPACE = "root\standardcimv2\embedded" - -# Create a handle to the class instance so we can call the static methods. -try { - $ShellLauncherClass = [wmiclass]"\\$COMPUTER\${NAMESPACE}:WESL_UserSetting" - } catch [Exception] { - write-host $_.Exception.Message; - write-host "Make sure Shell Launcher feature is enabled" - exit - } - - -# This well-known security identifier (SID) corresponds to the BUILTIN\Administrators group. - -$Admins_SID = "S-1-5-32-544" - -# Create a function to retrieve the SID for a user account on a machine. - -function Get-UsernameSID($AccountName) { - - $NTUserObject = New-Object System.Security.Principal.NTAccount($AccountName) - $NTUserSID = $NTUserObject.Translate([System.Security.Principal.SecurityIdentifier]) - - return $NTUserSID.Value - -} - -# Get the SID for a user account named "Cashier". Rename "Cashier" to an existing account on your system to test this script. - -$Cashier_SID = Get-UsernameSID("Cashier") - -# Define actions to take when the shell program exits. - -$restart_shell = 0 -$restart_device = 1 -$shutdown_device = 2 - -# Examples. You can change these examples to use the program that you want to use as the shell. - -# This example sets the command prompt as the default shell, and restarts the device if the command prompt is closed. - -$ShellLauncherClass.SetDefaultShell("cmd.exe", $restart_device) - -# Display the default shell to verify that it was added correctly. - -$DefaultShellObject = $ShellLauncherClass.GetDefaultShell() - -"`nDefault Shell is set to " + $DefaultShellObject.Shell + " and the default action is set to " + $DefaultShellObject.defaultaction - -# Set Internet Explorer as the shell for "Cashier", and restart the machine if Internet Explorer is closed. - -$ShellLauncherClass.SetCustomShell($Cashier_SID, "c:\program files\internet explorer\iexplore.exe www.microsoft.com", ($null), ($null), $restart_shell) - -# Set Explorer as the shell for administrators. - -$ShellLauncherClass.SetCustomShell($Admins_SID, "explorer.exe") - -# View all the custom shells defined. - -"`nCurrent settings for custom shells:" -Get-WmiObject -namespace $NAMESPACE -computer $COMPUTER -class WESL_UserSetting | Select Sid, Shell, DefaultAction - -# Enable Shell Launcher - -$ShellLauncherClass.SetEnabled($TRUE) - -$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled() - -"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled - -# Remove the new custom shells. - -$ShellLauncherClass.RemoveCustomShell($Admins_SID) - -$ShellLauncherClass.RemoveCustomShell($Cashier_SID) - -# Disable Shell Launcher - -$ShellLauncherClass.SetEnabled($FALSE) - -$IsShellLauncherEnabled = $ShellLauncherClass.IsEnabled() - -"`nEnabled is set to " + $IsShellLauncherEnabled.Enabled -``` - -## Sign out of assigned access - -To exit the assigned access (kiosk) app, press **Ctrl + Alt + Del**, and then sign in using another account. When you press **Ctrl + Alt + Del** to sign out of assigned access, the kiosk app will exit automatically. If you sign in again as the assigned access account or wait for the login screen timeout, the kiosk app will be re-launched. The assigned access user will remain signed in until an admin account opens **Task Manager** > **Users** and signs out the user account. - -If you press **Ctrl + Alt + Del** and do not sign in to another account, after a set time, assigned access will resume. The default time is 30 seconds, but you can change that in the following registry key: - -**HKEY\_LOCAL\_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI** - -To change the default time for assigned access to resume, add *IdleTimeOut* (DWORD) and enter the value data as milliseconds in hexadecimal. - -  -## Related topics - -- [Set up a kiosk on Windows 10 Mobile or Windows 10 Mobile Enterprise](mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md) - - - diff --git a/windows/configuration/wcd/wcd-accounts.md b/windows/configuration/wcd/wcd-accounts.md index b1547d99cd..db8812512d 100644 --- a/windows/configuration/wcd/wcd-accounts.md +++ b/windows/configuration/wcd/wcd-accounts.md @@ -30,7 +30,7 @@ The **Azure > Authority** and **Azure > BPRT** settings for bulk Azure Active Di - [Instructions for desktop wizard](../provisioning-packages/provision-pcs-for-initial-deployment.md) - [Instructions for the mobile wizard](../mobile-devices/provisioning-configure-mobile.md) -- [Instructions for the kiosk wizard](../setup-kiosk-digital-signage.md#wizard) +- [Instructions for the kiosk wizard](../kiosk-single-app.md#wizard) ## ComputerAccount diff --git a/windows/configuration/wcd/wcd-firstexperience.md b/windows/configuration/wcd/wcd-firstexperience.md index 3c2044f533..cb1554991e 100644 --- a/windows/configuration/wcd/wcd-firstexperience.md +++ b/windows/configuration/wcd/wcd-firstexperience.md @@ -8,7 +8,7 @@ author: jdeckerMS ms.localizationpriority: medium ms.author: jdecker ms.topic: article -ms.date: 04/30/2018 +ms.date: 08/08/2018 --- # FirstExperience (Windows Configuration Designer reference) @@ -27,5 +27,5 @@ PreferredRegion | Enter the [geographical location identifier](https://msdn.micr PreferredTimezone | Enter the timezone. [Microsoft Time Zone Index Values](https://msdn.microsoft.com/library/ms912391.aspx) SkipCalibration | Initial setup of HoloLens includes a calibration step. Set to **True** to skip calibration. SkipTraining | Initial setup of HoloLens includes training on how to perform the gestures to operate HoloLens. Set to **True** to skip training. -SkipWifi | Set to **True** to skip connecting to a Wi-fi network. +SkipWifi | Set to **True** to skip connecting to a Wi-Fi network.

    **Note:** HoloLens [requires a Wi-Fi connection during setup to verify the account](https://docs.microsoft.com/hololens/hololens-setup). To skip the Wi-Fi connection page during setup, your provisioning package must provide the network configuration. You can configure the network configuration [in the HoloLens wizard](https://docs.microsoft.com/hololens/hololens-provisioning#create-a-provisioning-package-for-hololens-using-the-hololens-wizard) and then switch to the advanced editor to configure **FirstExperience** settings, or in advanced settings, configure a WLAN [connectivity profile](wcd-connectivityprofiles.md). diff --git a/windows/configuration/wcd/wcd-policies.md b/windows/configuration/wcd/wcd-policies.md index 1ba48ada16..e533cd7b14 100644 --- a/windows/configuration/wcd/wcd-policies.md +++ b/windows/configuration/wcd/wcd-policies.md @@ -8,7 +8,7 @@ author: jdeckerMS ms.localizationpriority: medium ms.author: jdecker ms.topic: article -ms.date: 04/30/2018 +ms.date: 08/03/2018 --- # Policies (Windows Configuration Designer reference) @@ -297,6 +297,14 @@ These settings apply to the **Kiosk Browser** app available in Microsoft Store. [EnableNavigationButtons](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-enablenavigationbuttons) | Enable/disable kiosk browser's navigation buttons (forward/back). | X | | | | | [RestartOnIdleTime](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-kioskbrowser#kioskbrowser-restartonidletime) | Amount of time in minutes the session is idle until the kiosk browser restarts in a fresh state. The value is an int 1-1440 that specifies the amount of minutes the session is idle until the kiosk browser restarts in a fresh state. The default value is empty which means there is no idle timeout within the kiosk browser. | X | | | | | +To configure multiple URLs for **Blocked URL Exceptions** or **Blocked URLs** in Windows Configuration Designer: + +1. Create the provisioning package. When ready to export, close the project in Windows Configuration Designer. +2. Open the customizations.xml file in the project folder (e.g C:\Users\name\Documents\Windows Imaging and Configuration Designer (WICD)\Project_18). +3. Insert the null character string in between each URL (e.g www.bing.comwww.contoso.com). +4. Save the XML file. +5. Open the project again in Windows Configuration Designer. +6. Export the package. Ensure you do not revisit the created policies under Kiosk Browser or else the null character will be removed. ## Location @@ -439,7 +447,7 @@ ConfigureTelemetryOptInSettingsUx | This policy setting determines whether peopl | [ActiveHoursEnd](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-activehoursend) | Use with **Update/ActiveHoursStart** to manage the range of active hours where update rboots are not scheduled. | X | X | X | | X | | [ActiveHoursMaxRange](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-activehoursmaxrange) | Specify the maximum active hours range. | X | X | X | | X | | [ActiveHoursStart](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-activehoursstart) | Use with **Update/ActiveHoursEnd** to manage the range of active hours where update reboots are not scheduled. | X | X | X | | X | -| [AllowautoUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-allowautoupdate) | Configure automatic update behavior to scan, download, and install updates. | X | X | X | X | X | +| [AllowAutoUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-allowautoupdate) | Configure automatic update behavior to scan, download, and install updates. | X | X | X | X | X | | [AllowAutoWindowsUpdateDownloadOverMeteredNetwork](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautowindowsupdatedownloadovermeterednetwork)| Option to download updates automatically over metered connections (off by default). Enter `0` for not allowed, or `1` for allowed. | X | X | X | | X | | [AllowMUUpdateService](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-allowmuupdateservice) | Manage whether to scan for app updates from Microsoft Update. | X | X | X | X | X | | [AllowNonMicrosoftSignedUpdate](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-configuration-service-provider#update-allownonmicrosoftsignedupdate) | Manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. | X | X | X | | X | diff --git a/windows/configuration/wcd/wcd-provisioningcommands.md b/windows/configuration/wcd/wcd-provisioningcommands.md index 744ae6a3b6..0f63fc68e7 100644 --- a/windows/configuration/wcd/wcd-provisioningcommands.md +++ b/windows/configuration/wcd/wcd-provisioningcommands.md @@ -13,7 +13,7 @@ ms.date: 09/06/2017 # ProvisioningCommands (Windows Configuration Designer reference) -Use ProvisioningCommands settings to install Classic Windows apps using a provisioning package. +Use ProvisioningCommands settings to install Windows desktop applications using a provisioning package. ## Applies to diff --git a/windows/configuration/wcd/wcd-sharedpc.md b/windows/configuration/wcd/wcd-sharedpc.md index 09c6c4a000..8cc91e3ca4 100644 --- a/windows/configuration/wcd/wcd-sharedpc.md +++ b/windows/configuration/wcd/wcd-sharedpc.md @@ -15,8 +15,7 @@ ms.date: 10/16/2017 Use SharedPC settings to optimize Windows 10 for shared use scenarios, such as touchdown spaces in an enterprise and temporary customer use in retail. ->[!TIP] ->You can use the [ApplicationManagement](wcd-applicationmanagement.md) settings node to configure only the account management settings without enabling shared PC mode. + ## Applies to diff --git a/windows/configuration/wcd/wcd-smisettings.md b/windows/configuration/wcd/wcd-smisettings.md index 2f7f8216e2..a9e588a6f8 100644 --- a/windows/configuration/wcd/wcd-smisettings.md +++ b/windows/configuration/wcd/wcd-smisettings.md @@ -93,7 +93,7 @@ When you **enable** KeyboardFilter, a number of other settings become available ## ShellLauncher settings -Use ShellLauncher to specify the application or executable to use as the default custom shell. One use of ShellLauncher is to [create a kiosk (fixed-purpose) device running a Classic Windows application](https://docs.microsoft.com/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions#shell-launcher-for-classic-windows-applications). +Use ShellLauncher to specify the application or executable to use as the default custom shell. One use of ShellLauncher is to [create a kiosk (fixed-purpose) device running a Windows desktop application](https://docs.microsoft.com/windows/configuration/set-up-a-kiosk-for-windows-10-for-desktop-editions#shell-launcher-for-classic-windows-applications). >[!WARNING] >Windows 10 doesn’t support setting a custom shell prior to OOBE. If you do, you won’t be able to deploy the resulting image. diff --git a/windows/configuration/wcd/wcd-universalappinstall.md b/windows/configuration/wcd/wcd-universalappinstall.md index 9a9127182d..96e4967e7a 100644 --- a/windows/configuration/wcd/wcd-universalappinstall.md +++ b/windows/configuration/wcd/wcd-universalappinstall.md @@ -25,9 +25,9 @@ Use UniversalAppInstall settings to install Windows apps from the Microsoft Stor | --- | :---: | :---: | :---: | :---: | :---: | | [DeviceContextApp](#devicecontextapp) | X | | X | | | | [DeviceContextAppLicense](#devicecontextapplicense) | X | | X | | | -| [StoreInstall](#storeinstall) | X | X | X | X | X | -| [UserContextApp](#usercontextapp) | X | X | X | X | X | -| [UserContextAppLicense](#usercontextapplicense) | X | X | X | X | X | +| [StoreInstall](#storeinstall) | X | X | X | | X | +| [UserContextApp](#usercontextapp) | X | X | X | | X | +| [UserContextAppLicense](#usercontextapplicense) | X | X | X | | X | ## DeviceContextApp diff --git a/windows/configuration/windows-10-start-layout-options-and-policies.md b/windows/configuration/windows-10-start-layout-options-and-policies.md index a1482a0a62..54b19bb5d6 100644 --- a/windows/configuration/windows-10-start-layout-options-and-policies.md +++ b/windows/configuration/windows-10-start-layout-options-and-policies.md @@ -29,7 +29,7 @@ Organizations might want to deploy a customized Start and taskbar configuration > >Start and taskbar configuration can be applied to devices running Windows 10 Pro, version 1703. > ->Using the layout modification XML to configure Start is not supported with roaming user profiles. For more information, see [Deploy Roaming User Profiles](https://technet.microsoft.com/library/jj649079.aspx). +>For information on using the layout modification XML to configure Start with roaming user profiles, see [Deploy Roaming User Profiles](https://docs.microsoft.com/windows-server/storage/folder-redirection/deploy-roaming-user-profiles#step-7-optionally-specify-a-start-layout-for-windows-10-pcs). > >Using CopyProfile for Start menu customization in Windows 10 isn't supported. For more information [Customize the Default User Profile by Using CopyProfile](https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/customize-the-default-user-profile-by-using-copyprofile) diff --git a/windows/deployment/update/waas-optimize-windows-10-updates.md b/windows/deployment/update/waas-optimize-windows-10-updates.md index d36e9fcaab..831d0da5ff 100644 --- a/windows/deployment/update/waas-optimize-windows-10-updates.md +++ b/windows/deployment/update/waas-optimize-windows-10-updates.md @@ -27,7 +27,7 @@ Two methods of peer-to-peer content distribution are available in Windows 10. Windows Update, Windows Update for Business, and Windows Server Update Services (WSUS) can use Delivery Optimization. Delivery Optimization can significantly reduce the amount of network traffic to external Windows Update sources as well as the time it takes for clients to retrieve the updates. -- [BranchCache](waas-branchcache.md) is a bandwidth optimization technology that is included in some editions of the Windows Server 2016 Technical Preview and Windows 10 operating systems, as well as in some editions of Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, and Windows 7. +- [BranchCache](waas-branchcache.md) is a bandwidth optimization technology that is included in some editions of Windows Server 2016 and Windows 10 operating systems, as well as in some editions of Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, and Windows 7. >[!NOTE] >Full BranchCache functionality is supported in Windows 10 Enterprise and Education; Windows 10 Pro supports some BranchCache functionality, including BITS transfers used for servicing operations. diff --git a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md index d17beb7903..3b90be8d08 100644 --- a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md +++ b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md @@ -9,7 +9,7 @@ ms.pagetype: deploy author: jaimeo ms.author: jaimeo ms.date: 07/20/2018 -ms.localizationpriority: high +ms.localizationpriority: medium --- # Frequently asked questions and troubleshooting Windows Analytics diff --git a/windows/deployment/update/windows-analytics-get-started.md b/windows/deployment/update/windows-analytics-get-started.md index 610f176f33..0cf9e39727 100644 --- a/windows/deployment/update/windows-analytics-get-started.md +++ b/windows/deployment/update/windows-analytics-get-started.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: deploy author: jaimeo ms.author: jaimeo -ms.date: 07/18/2018 +ms.date: 08/01/2018 ms.localizationpriority: medium --- @@ -52,9 +52,9 @@ To enable data sharing, configure your proxy sever to whitelist the following en | `http://adl.windows.com` | Allows the compatibility update to receive the latest compatibility data from Microsoft. | | `https://watson.telemetry.microsoft.com` | Windows Error Reporting (WER); required for Device Health and Update Compliance AV reports. Not used by Upgrade Readiness. | | `https://oca.telemetry.microsoft.com` | Online Crash Analysis; required for Device Health and Update Compliance AV reports. Not used by Upgrade Readiness. | -| `https://login.live.com` | Windows Error Reporting (WER); required by Device Health for device tickets. | +| `https://login.live.com` | Windows Error Reporting (WER); required by Device Health. **Note:** WER does *not* use login.live.com to access Microsoft Account consumer services such as Xbox Live. WER uses an anti-spoofing API at that address to enhance the integrity of error reports. | | `https://www.msftncsi.com` | Windows Error Reporting (WER); required for Device Health to check connectivity. | -| `https://www.msftconnecttest.com` | Windows Error Reporting (WER); required for Device Health to check connectivity. **Note:** In this context login.live.com is *not* used for access to Microsoft Account consumer services. The endpoint is used only as part of the WIndows Error Reporting protocol to enhance the integrity of error reports. | +| `https://www.msftconnecttest.com` | Windows Error Reporting (WER); required for Device Health to check connectivity. | >[!NOTE] diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md index 90965a2bd0..65b4e8d268 100644 --- a/windows/deployment/upgrade/setupdiag.md +++ b/windows/deployment/upgrade/setupdiag.md @@ -7,8 +7,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy author: greg-lindsay -ms.date: 07/18/2018 -ms.localizationpriority: high +ms.date: 08/16/2018 +ms.localizationpriority: medium --- # SetupDiag @@ -125,8 +125,7 @@ SetupDiag.exe /Output:C:\SetupDiag\Dumpdebug.log /Mode:Offline /LogsPath:D:\Dump ## Known issues 1. Some rules can take a long time to process if the log files involved are large. -2. SetupDiag only outputs data in a text format. -3. If the failing computer is opted into the Insider program and getting regular pre-release updates, or an update is already pending on the computer when SetupDiag is run, it can encounter problems trying to open these log files. This will likely cause a failure to determine a root cause. In this case, try gathering the log files and running SetupDiag in offline mode. +2. If the failing computer is opted into the Insider program and getting regular pre-release updates, or an update is already pending on the computer when SetupDiag is run, it can encounter problems trying to open these log files. This will likely cause a failure to determine a root cause. In this case, try gathering the log files and running SetupDiag in offline mode. ## Sample output diff --git a/windows/deployment/upgrade/upgrade-error-codes.md b/windows/deployment/upgrade/upgrade-error-codes.md index 84185caa92..57d117aeb9 100644 --- a/windows/deployment/upgrade/upgrade-error-codes.md +++ b/windows/deployment/upgrade/upgrade-error-codes.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy author: greg-lindsay -ms.date: 03/30/2018 +ms.date: 08/18/2018 ms.localizationpriority: medium --- @@ -47,7 +47,7 @@ The following set of result codes are associated with [Windows Setup](https://do | 0xC1900200 | MOSETUP_E_COMPAT_SYSREQ_BLOCK | The computer is not eligible for Windows 10 | | 0xC190020E | MOSETUP_E_INSTALLDISKSPACE_BLOCK | The computer does not have enough free space to install | -A list of modern setup (mosetup) errors with descriptions in the range is available in the [Resolution procudures](resolution-procedures.md#modern-setup-errors) topic in this article. +A list of modern setup (mosetup) errors with descriptions in the range is available in the [Resolution procedures](resolution-procedures.md#modern-setup-errors) topic in this article. Other result codes can be matched to the specific type of error encountered. To match a result code to an error: diff --git a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md b/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md index badacb456b..97bc60f3d0 100644 --- a/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md +++ b/windows/deployment/upgrade/use-upgrade-readiness-to-manage-windows-upgrades.md @@ -6,7 +6,7 @@ ms.localizationpriority: medium ms.prod: w10 author: jaimeo ms.author: jaimeo -ms.date: 08/30/2017 +ms.date: 07/31/2018 --- # Use Upgrade Readiness to manage Windows upgrades @@ -22,7 +22,7 @@ When you are ready to begin the upgrade process, a workflow is provided to guide Each step in the workflow is enumerated using blue tiles. Helpful data is provided on white tiles to help you get started, to monitor your progress, and to complete each step. ->**Important**: You can use the [Target version](#target-version) setting to evaluate computers that are runnign a specified version of Windows before starting the Upgrade Readiness workflow. By default, the Target version is configured to the released version of Windows 10 for the Current Branch for Business (CBB). +>**Important**: You can use the [Target version](#target-version) setting to evaluate computers that are running a specified version of Windows before starting the Upgrade Readiness workflow. By default, the Target version is configured to the released version of Windows 10 for the Current Branch for Business (CBB). The following information and workflow is provided: @@ -41,11 +41,11 @@ The target version setting is used to evaluate the number of computers that are ![Upgrade overview showing target version](../images/ur-target-version.png) -As mentioned previously, the default target version in Upgrade Readiness is set to the released version of the Current Branch for Business (CBB). CBB can be determined by reviewing [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). The target version setting is used to evaluate the number of computers that are already running this version of Windows, or a later version. +The default target version in Upgrade Readiness is set to the released version of the Current Branch for Business (CBB). CBB can be determined by reviewing [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). The target version setting is used to evaluate the number of computers that are already running this version of Windows, or a later version. The number displayed under **Computers upgraded** in the Upgrade Overview blade is the total number of computers that are already running the same or a later version of Windows compared to the target version. It also is used in the evaluation of apps and drivers: Known issues and guidance for the apps and drivers in Upgrade Readiness is based on the target operating system version. -You now have the ability to change the Windows 10 version you wish to target. The available options currently are: Windows 10 version 1507, Windows 10 version 1511, Windows 10 version 1607, and Windows 10 version 1703. +You now have the ability to change the Windows 10 version you wish to target. The available options currently are: Windows 10 version 1507, Windows 10 version 1511, Windows 10 version 1607, Windows 10 version 1703, Windows 10 version 1709 and Windows 10 version 1803. To change the target version setting, click on **Solutions Settings**, which appears at the top when you open you Upgrade Readiness solution: diff --git a/windows/deployment/windows-autopilot/add-devices.md b/windows/deployment/windows-autopilot/add-devices.md index f01143dd4c..d494ef7054 100644 --- a/windows/deployment/windows-autopilot/add-devices.md +++ b/windows/deployment/windows-autopilot/add-devices.md @@ -4,7 +4,7 @@ description: How to add devices to Windows Autopilot keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune ms.prod: w10 ms.mktglfcycl: deploy -ms.localizationpriority: high +ms.localizationpriority: medium ms.sitesec: library ms.pagetype: deploy author: coreyp-at-msft @@ -44,7 +44,10 @@ To use this script, you can download it from the PowerShell Gallery and run it o *Get-WindowsAutoPilotInfo.ps1 -OutputFile AutoPilotHWID.csv* -Note that you must run this PowerShell script with administrator privileges (elevated). It can also be run remotely, as long as WMI permissions are in place and WMI is accessible through the Windows Firewall on that remote computer. See the Get-WindowsAutoPilotInfo script’s help (using “Get-Help Get-WindowsAutoPilotInfo.ps1”) for more information. +You must run this PowerShell script with administrator privileges (elevated). It can also be run remotely, as long as WMI permissions are in place and WMI is accessible through the Windows Firewall on that remote computer. See the Get-WindowsAutoPilotInfo script’s help (using “Get-Help Get-WindowsAutoPilotInfo.ps1”) for more information. + +>[!NOTE] +>With Windows 10 version 1803 and above, devices will download an Autopilot profile as soon as they connect to the internet. For devices that are not yet registered with the Autopilot deployment service, a profile will be downloaded that indicates the device should not be deployed using Autopilot. If the device connects to the internet as part of the collection process, you will need to reset the PC, reimage the PC, or re-generalize the OS (using sysprep /generalize /oobe). ## Collecting the hardware ID from existing devices using System Center Configuration Manager diff --git a/windows/deployment/windows-autopilot/configure-autopilot.md b/windows/deployment/windows-autopilot/configure-autopilot.md index c5856a1af6..320afb60dd 100644 --- a/windows/deployment/windows-autopilot/configure-autopilot.md +++ b/windows/deployment/windows-autopilot/configure-autopilot.md @@ -4,7 +4,7 @@ description: How to configure Windows Autopilot deployment keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune ms.prod: w10 ms.mktglfcycl: deploy -ms.localizationpriority: high +ms.localizationpriority: medium ms.sitesec: library ms.pagetype: deploy author: coreyp-at-msft diff --git a/windows/deployment/windows-autopilot/enrollment-status.md b/windows/deployment/windows-autopilot/enrollment-status.md index a63c814e8c..2f7e82b15e 100644 --- a/windows/deployment/windows-autopilot/enrollment-status.md +++ b/windows/deployment/windows-autopilot/enrollment-status.md @@ -7,7 +7,7 @@ ms.technology: Windows ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: -ms.localizationpriority: high +ms.localizationpriority: medium author: coreyp-at-msft ms.author: coreyp ms.date: 06/01/2018 diff --git a/windows/deployment/windows-autopilot/profiles.md b/windows/deployment/windows-autopilot/profiles.md index fc61dba235..4868e24cd2 100644 --- a/windows/deployment/windows-autopilot/profiles.md +++ b/windows/deployment/windows-autopilot/profiles.md @@ -4,7 +4,7 @@ description: How to configure Windows Autopilot deployment keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune ms.prod: w10 ms.mktglfcycl: deploy -ms.localizationpriority: high +ms.localizationpriority: medium ms.sitesec: library ms.pagetype: deploy author: coreyp-at-msft diff --git a/windows/deployment/windows-autopilot/rip-and-replace.md b/windows/deployment/windows-autopilot/rip-and-replace.md index b75fced878..0f85771ec9 100644 --- a/windows/deployment/windows-autopilot/rip-and-replace.md +++ b/windows/deployment/windows-autopilot/rip-and-replace.md @@ -4,7 +4,7 @@ description: Listing of Autopilot scenarios keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune ms.prod: w10 ms.mktglfcycl: deploy -ms.localizationpriority: high +ms.localizationpriority: low ms.sitesec: library ms.pagetype: deploy author: coreyp-at-msft diff --git a/windows/deployment/windows-autopilot/self-deploying.md b/windows/deployment/windows-autopilot/self-deploying.md index 278068cc1c..deba1e8e5e 100644 --- a/windows/deployment/windows-autopilot/self-deploying.md +++ b/windows/deployment/windows-autopilot/self-deploying.md @@ -7,7 +7,7 @@ ms.technology: Windows ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: -ms.localizationpriority: high +ms.localizationpriority: medium author: coreyp-at-msft ms.author: coreyp ms.date: 06/01/2018 diff --git a/windows/deployment/windows-autopilot/troubleshooting.md b/windows/deployment/windows-autopilot/troubleshooting.md index 6a9b183060..2ea0af92da 100644 --- a/windows/deployment/windows-autopilot/troubleshooting.md +++ b/windows/deployment/windows-autopilot/troubleshooting.md @@ -4,7 +4,7 @@ description: This topic goes over Windows Autopilot and how it helps setup OOBE keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune ms.prod: w10 ms.mktglfcycl: deploy -ms.localizationpriority: high +ms.localizationpriority: medium ms.sitesec: library ms.pagetype: deploy author: coreyp-at-msft diff --git a/windows/deployment/windows-autopilot/user-driven-aad.md b/windows/deployment/windows-autopilot/user-driven-aad.md index 9d2d62ae45..91d9bbf472 100644 --- a/windows/deployment/windows-autopilot/user-driven-aad.md +++ b/windows/deployment/windows-autopilot/user-driven-aad.md @@ -4,7 +4,7 @@ description: Listing of Autopilot scenarios keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune ms.prod: w10 ms.mktglfcycl: deploy -ms.localizationpriority: high +ms.localizationpriority: low ms.sitesec: library ms.pagetype: deploy author: coreyp-at-msft diff --git a/windows/deployment/windows-autopilot/user-driven-hybrid.md b/windows/deployment/windows-autopilot/user-driven-hybrid.md index 3f65705d3f..091783afa4 100644 --- a/windows/deployment/windows-autopilot/user-driven-hybrid.md +++ b/windows/deployment/windows-autopilot/user-driven-hybrid.md @@ -4,7 +4,7 @@ description: Listing of Autopilot scenarios keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune ms.prod: w10 ms.mktglfcycl: deploy -ms.localizationpriority: high +ms.localizationpriority: low ms.sitesec: library ms.pagetype: deploy author: coreyp-at-msft diff --git a/windows/deployment/windows-autopilot/user-driven.md b/windows/deployment/windows-autopilot/user-driven.md index 761a0c5fe2..bb9b722bb6 100644 --- a/windows/deployment/windows-autopilot/user-driven.md +++ b/windows/deployment/windows-autopilot/user-driven.md @@ -4,7 +4,7 @@ description: Canonical Autopilot scenario keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune ms.prod: w10 ms.mktglfcycl: deploy -ms.localizationpriority: high +ms.localizationpriority: medium ms.sitesec: library ms.pagetype: deploy author: coreyp-at-msft diff --git a/windows/deployment/windows-autopilot/windows-autopilot-requirements-configuration.md b/windows/deployment/windows-autopilot/windows-autopilot-requirements-configuration.md index ffc0f40009..919b0f5efa 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-requirements-configuration.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-requirements-configuration.md @@ -4,7 +4,7 @@ description: This topic goes over Windows Autopilot and how it helps setup OOBE keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune ms.prod: w10 ms.mktglfcycl: deploy -ms.localizationpriority: high +ms.localizationpriority: medium ms.sitesec: library ms.pagetype: deploy author: coreyp-at-msft diff --git a/windows/deployment/windows-autopilot/windows-autopilot-reset-local.md b/windows/deployment/windows-autopilot/windows-autopilot-reset-local.md index 408201cc01..b8259e9016 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-reset-local.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-reset-local.md @@ -7,7 +7,7 @@ ms.technology: Windows ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: -ms.localizationpriority: high +ms.localizationpriority: medium author: coreyp-at-msft ms.author: coreyp ms.date: 06/01/2018 diff --git a/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md b/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md index fe614b16a0..7efd53c9f0 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md @@ -7,7 +7,7 @@ ms.technology: Windows ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: -ms.localizationpriority: high +ms.localizationpriority: medium author: coreyp-at-msft ms.author: coreyp ms.date: 06/01/2018 diff --git a/windows/deployment/windows-autopilot/windows-autopilot-reset.md b/windows/deployment/windows-autopilot/windows-autopilot-reset.md index 6093540d82..4417198067 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-reset.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-reset.md @@ -7,7 +7,7 @@ ms.technology: Windows ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: -ms.localizationpriority: high +ms.localizationpriority: medium author: coreyp-at-msft ms.author: coreyp ms.date: 06/01/2018 diff --git a/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md b/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md index 2618056f2d..b832512df1 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-scenarios.md @@ -4,7 +4,7 @@ description: Listing of Autopilot scenarios keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune ms.prod: w10 ms.mktglfcycl: deploy -ms.localizationpriority: high +ms.localizationpriority: medium ms.sitesec: library ms.pagetype: deploy author: coreyp-at-msft diff --git a/windows/privacy/TOC.md b/windows/privacy/TOC.md index 05709993b8..085675fdde 100644 --- a/windows/privacy/TOC.md +++ b/windows/privacy/TOC.md @@ -5,7 +5,7 @@ ## [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) ## [Diagnostic Data Viewer Overview](diagnostic-data-viewer-overview.md) ## Basic level Windows diagnostic data events and fields -### [Windows 10, version 1803 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields.md) +### [Windows 10, version 1803 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1803.md) ### [Windows 10, version 1709 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1709.md) ### [Windows 10, version 1703 basic level Windows diagnostic events and fields](basic-level-windows-diagnostic-events-and-fields-1703.md) ## Enhanced level Windows diagnostic data events and fields diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index 2d9a36b358..d75aa0580e 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -23,6 +23,8 @@ The Basic level gathers a limited set of information that is critical for unders Use this article to learn about diagnostic events, grouped by event area, and the fields within each event. A brief description is provided for each field. Every event generated includes common data, which collects device data. You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 1803 basic diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1803) +- [Windows 10, version 1709 basic diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1709) - [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) - [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md) @@ -2746,6 +2748,381 @@ The following fields are available: - **winInetError** The HResult of the operation. +## Remediation events + +>[!NOTE] +>Events from this provider are sent with the installation of KB4023057 and any subsequent Windows update. For details, see [this support article](https://support.microsoft.com/help/4023057). + +### Microsoft.Windows.Remediation.Applicable + +Reports whether a specific remediation to issues preventing security and quality updates is applicable based on detection. + +The following fields are available: + +- **CV** Correlation vector. +- **DetectedCondition** Boolean true if detect condition is true and perform action will be run. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system. +- **PackageVersion** Current package version of Remediation. +- **PluginName** Name of the remediation plugin specified for each generic plugin event. +- **Result** Result for detection or perform action phases of the remediation system. +- **RunAppraiserFailed** Rerun if the appraiser command line tool failed. + +### Microsoft.Windows.Remediation.Completed + +Enables tracking the completion of a process that remediates issues preventing security and quality updates. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system. +- **HResult** Result of execution of the event. +- **LatestState** Final state of the plugin component. +- **PackageVersion** Current package version of Remediation. +- **PluginName** Name of the specific remediation for each generic plugin event. +- **RemediationNoisyHammerTaskKickOffIsSuccess** Event that indicates the Update Assistant task has been started successfully. +- **Result** This is the HRESULT for detection or perform action phases of the plugin. + +### Microsoft.Windows.Remediation.DiskCleanUnExpectedErrorEvent + +Event that indicates whether an error condition occurred while trying to clean up disk space. + +The following fields are available: + +- **CV** Correlation vector. +- **ErrorMessage** Description of any error that was encountered. +- **GlobalEventCounter** Client side counter which indicates ordering of events. +- **HResult** Result of execution of the event. +- **PackageVersion** Current Remediation package version. + +### Microsoft.Windows.Remediation.Error + +Event for general errors in the Remediation shell. + +The following fields are available: + +- **HResult** Return value. +- **Message** Contains information about any error that occurred. +- **PackageVersion** Current Remediation package version. + +### Microsoft.Windows.Remediation.FallbackError + +Indicates whether an error occurs for a fallback in the plugin. + +The following fields are available: + +- **S0** Fallback error level. +- **wilResult** Result for Windows Installer Logging function. + +### Microsoft.Windows.Remediation.RemediationShellFailedAutomaticAppUpdateModifyEventId + +Event indicates that there was a failure modifying the wsautoupdate task. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events. +- **hResult** Result of the failed call. +- **PackageVersion** Current Remediation package version. + +### Microsoft.Windows.Remediation.RemediationShellUnexpectedExceptionId + +Event fires when an unexpected error occurs in the shell routine. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events. +- **PackageVersion** Current package version of Remediation. +- **RemediationShellUnexpectedExceptionId** Identifier of the remediation plugin. + +### Microsoft.Windows.Remediation.RemediationUHEnableServiceFailed + +Event indicates that enabling a service failed. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events. +- **hResult** Result associated with the given failure. +- **PackageVersion** Current package version of Remediation. +- **serviceName** ServiceName associated with the given operation. + +### Microsoft.Windows.Remediation.RemediationUpgradeSucceededDataEventId + +Event containing data about the upgrade process. + +The following fields are available: + +- **AppraiserPlugin** True or False depending on whether the Appraiser Plugin task fix was successful. +- **ClearAUOptionsPlugin** True or False depending on whether the AU Options regkeys were successfully deleted. +- **CV** Correlation vector. +- **DatetimeSyncPlugin** True or False depending on whether the datetime sync plugin ran. +- **DiskCleanupPlugin** Disk space free by disk cleanup plugin. +- **GlobalEventCounter** Client side counter which indicates ordering of events. +- **NoisyHammerPlugin** True or False depending on whether the Noisy Hammer plugin was successful. +- **PackageVersion** Current package version of Remediation. +- **RebootRequiredPlugin** True or False depending on whether the reboot required plugin ran. +- **RemediationNotifyUserFixIssuesPlugin** True or False depending on whether notify user fix issues plugin was successful. +- **RemediationPostUpgradeDiskSpace** Disk space available after the upgrade. +- **RemediationPostUpgradeHibernationSize** Size of the hibernation file after upgrade. +- **ServiceHealthPlugin** List of services updated by the plugin. +- **SIHHealthPlugin** True or False depending on whether the service health plugin completed successfully. +- **StackDataResetPlugin** True or False depending on whether resetting the update stack completed successfully. +- **TaskHealthPlugin** List of tasks updated by the plugin. +- **UpdateApplicabilityFixerPlugin** True or False depending on whether the update applicability fixer plugin completed successfully. +- **WindowsUpdateEndpointPlugin** True or False depending on whether the windows update endpoint was successful. + +### Microsoft.Windows.Remediation.RemediationNotifyUserFixIssuesInvokeUIEvent + +Event occurs when notify users task executes. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events. +- **PackageVersion** Current Remediation package version. +- **RemediationNotifyUserFixIssuesCallResult** Result of calling the USO sequence of steps. +- **RemediationNotifyUserFixIssuesUsoDownloadCalledHr** Error code from USO start download call. +- **RemediationNotifyUserFixIssuesUsoInitializedHr** Error code from USO initialize call. +- **RemediationNotifyUserFixIssuesUsoProxyBlanketHr** Error code from USO proxy blanket call. +- **RemediationNotifyUserFixIssuesUsoSetSessionHr** Error code from USO set session call. + +### Microsoft.Windows.Remediation.Started + +Enables tracking the start of a process that remediates issues preventing security and quality updates. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events sent by the remediation system. +- **PackageVersion** Current package version of Remediation. +- **PluginName** Name of the specific remediation for each generic plugin event. +- **Result** Results of the detection or perform action phases of the remediation system. + +### Microsoft.Windows.Remediation.wilResult + +Event containing self-update information. + +The following fields are available: + +- **callContext** List of telemetry activities containing this error. +- **currentContextId** Identifier for the newest telemetry activity containing this error. +- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any). +- **currentContextName** Name of the newest telemetry activity containing this error. +- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast). +- **failureId** Identifier assigned to this failure +- **filename** The name of the source file where the error occurred. +- **hresult** Failure error code. +- **lineNumber** Line number within the source file where the error occurred. +- **message** Custom message associated with the failure (if any). +- **module** Name of the binary where the error occurred. +- **originatingContextId** Identifier for the oldest telemetry activity containing this error. +- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any). +- **originatingContextName** Name of the oldest telemetry activity containing this error. +- **threadId** Identifier of the thread the error occurred on. + +## Sediment Service events + +>[!NOTE] +>Events from this provider are sent with the installation of KB4023057 and any subsequent Windows update. For details, see [this support article](https://support.microsoft.com/help/4023057). + +### Microsoft.Windows.SedimentService.Applicable + +Indicates whether a given plugin is applicable. + +The following fields are available: + +- **CV** Correlation vector. +- **DetectedCondition** Boolean true if detect condition is true and perform action will be run. +- **GlobalEventCounter** Client side counter which indicates ordering of events. +- **IsSelfUpdateEnabledInOneSettings** True/False based on whether self update is enabled. +- **IsSelfUpdateNeeded** True/False based on whether a newer version is available. +- **PackageVersion** Version of the package. +- **PluginName** Name of the plugin specified for each generic plugin event. +- **Result** This is the HRESULT for detection or perform action phases of the plugin. + +### Microsoft.Windows.SedimentService.Completed + +Indicates whether a given plugin has completed its work. + +The following fields are available: + +- **CV** Correlation vector. +- **FailedReasons** String reason for any plugin failures. +- **GlobalEventCounter** Client side counter which indicates ordering of events. +- **PackageVersion** Current package version of Remediation. +- **PluginName** Name of the plugin specified for each generic plugin event. +- **Result** Result of the service execution. +- **SedimentServiceCheckTaskFunctional** Result of checking if the scheduled task is functional. +- **SedimentServiceCurrentBytes** Current number of bytes the service is consuming. +- **SedimentServiceKillService** True/False based on whether the service should be stopped. +- **SedimentServiceMaximumBytes** Maximum bytes the service can consume. +- **SedimentServiceRetrievedKillService** True/False whether the kill service information was retrieved. +- **SedimentServiceStopping** True/False indicating whether the service was found to be stopping. +- **SedimentServiceTaskFunctional** True/False if scheduled task is functional. If task is not functional this indicates plugins will be run. +- **SedimentServiceTotalIterations** Number of iterations service will wait before running again. + +### Microsoft.Windows.SedimentService.Error + +Indicates whether an error condition occurs in the plugin. + +The following fields are available: + +- **Message** String message containing information from the service. +- **PackageVersion** Version of the package. +- **HResult** Return value from the plugin result. + +### Microsoft.Windows.SedimentService.FallbackError + +Indicates whether an error occurs for a fallback in the plugin. + +The following fields are available: + +- **s0** Fallback error level. +- **wilResult** Result for Windows Installer Logging function. + +### Microsoft.Windows.SedimentService.Information + +General information returned from the plugin. + +The following fields are available: + +- **HResult** Result of the plugin execution. +- **Message** Information collected from the plugin based on the purpose of the plugin. +- **PackageVersion** Version of the package. + +### Microsoft.Windows.SedimentService.Started + +Indicates that a given plugin has started. + +The following fields are available: + +- **CV** Correlation vector +- **GlobalEventCounter** Client side counter which indicates ordering of events. +- **PackageVersion** Version of the package. +- **PluginName** Name of the plugin running. +- **Result** Return code from the plugin result. + +### Microsoft.Windows.SedimentService.wilResult + +Result from the windows internal library. + +The following fields are available: + +- **callContext** List of telemetry activities containing this error. +- **currentContextId** Identifier for the newest telemetry activity containing this error. +- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any). +- **currentContextName** Name of the newest telemetry activity containing this error. +- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast. +- **failureId** Identifier assigned to this failure. +- **filename** The name of the source file where the error occurred. +- **hresult** Failure error code. +- **lineNumber** Line number within the source file where the error occurred. +- **message** Custom message associated with the failure (if any). +- **module** Name of the binary where the error occurred. +- **originatingContextId** Identifier for the oldest telemetry activity containing this error. +- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any). +- **originatingContextName** Name of the oldest telemetry activity containing this error. +- **threadId** Identifier of the thread the error occurred on. + +## Sediment Launcher events + +>[!NOTE] +>Events from this provider are sent with the installation of KB4023057 and any subsequent Windows update. For details, see [this support article](https://support.microsoft.com/help/4023057). + +### Microsoft.Windows.SedimentLauncher.Applicable + +Indicates whether a given plugin is applicable. + +The following fields are available: + +- **CV** Correlation vector. +- **DetectedCondition** Boolean true if detect condition is true and action will be run. +- **GlobalEventCounter** Client side counter which indicates ordering of events. +- **IsSelfUpdateEnabledInOneSettings** True/False based on whether self update is enabled. +- **IsSelfUpdateNeeded** True/False based on whether a newer version is available. +- **PackageVersion** Version of the package. +- **PluginName** Name of the plugin specified for each generic plugin event. +- **Result** This is the HRESULT for detection or perform action phases of the plugin. + +### Microsoft.Windows.SedimentLauncher.Completed + +Indicates whether a given plugin has completed its work. + +The following fields are available: + +- **CV** Correlation vector. +- **FailedReasons** String reason for any plugin failures. +- **GlobalEventCounter** Client side counter which indicates ordering of events. +- **PackageVersion** Current package version of Remediation. +- **PluginName** Name of the plugin specified for each generic plugin event. +- **Result** Result of the service execution. +- **SedLauncherExecutionResult** Final result of launcher running the plugins from the dll. + +### Microsoft.Windows.SedimentLauncher.Error + +Error occurred during execution of the plugin. + +The following fields are available: + +- **Message** Information message returned from a plugin containing only information internal to plugin execution. +- **PackageVersion** Version of the package. +- **HResult** Return value from the plugin result. + +### Microsoft.Windows.SedimentLauncher.FallbackError + +Error occurred during execution of the plugin fallback. + +The following fields are available: + +- **s0** Fallback error level for plugin. +- **wilResult** Result from executing Windows Installer Logging based function. + +### Microsoft.Windows.SedimentLauncher.Information + +General information returned from the plugin. + +The following fields are available: + +- **HResult** Result of the plugin execution. +- **Message** Information collected from the plugin based on the purpose of the plugin. +- **PackageVersion** Version of the package. + +### Microsoft.Windows.SedimentLauncher.Started + +Indicates that a given plugin has started. + +The following fields are available: + +- **CV** Correlation vector. +- **GlobalEventCounter** Client side counter which indicates ordering of events. +- **PackageVersion** Version of the package. +- **PluginName** Name of the plugin running. +- **Result** Return code from the plugin result. + +### Microsoft.Windows.SedimentLauncher.wilResult + +Result from the windows internal library. + +The following fields are available: + +- **callContext** List of telemetry activities containing this error. +- **currentContextId** Identifier for the newest telemetry activity containing this error. +- **currentContextMessage** Custom message associated with the newest telemetry activity containing this error (if any). +- **currentContextName** Name of the newest telemetry activity containing this error. +- **failurecount** Number of failures seen. +- **failureType** Indicates what type of failure was observed (exception, returned error, logged error or fail fast. +- **failureId** Identifier assigned to this failure. +- **filename** The name of the source file where the error occurred. +- **function** Name of the function where the error occurred. +- **hresult** Failure error code. +- **lineNumber** Line number within the source file where the error occurred. +- **message** Custom message associated with the failure (if any). +- **module** Name of the binary where the error occurred. +- **originatingContextId** Identifier for the oldest telemetry activity containing this error. +- **originatingContextMessage** Custom message associated with the oldest telemetry activity containing this error (if any). +- **originatingContextName** Name of the oldest telemetry activity containing this error. +- **threadId** Identifier of the thread the error occurred on. ## Setup events @@ -3182,6 +3559,71 @@ The following fields are available: - **EndpointUrl** The endpoint URL where the device obtains update metadata. This is used to distinguish between test, staging, and production environments. - **SLSPrograms** A test program to which a device may have opted in. Example: Insider Fast +## Update Assistant Orchestrator events + +>[!NOTE] +>Events from this provider are sent with the installation of KB4023814. For details, see [this support article](https://support.microsoft.com/help/4023814). + +### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId + +Event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies.. + +The following fields are available: + +- **ApplicabilityBlockedReason** Blocked due to an applicability issue. +- **ClientId** Identification of the current installed version of Update Assistant. +- **TriggerTaskSource** Describes which task launched this instance of Update Assistant. + +### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId + +Event sends basic info on the reason the Windows 10 update was blocked or prevented. + +The following fields are available: + +- **ClientId** Identification of the current installed version of Update Assistant. +- **DenyReason** Reasons why Update Assistant was prevented from launching. +- **TriggerTaskSource** Describes which task launched this instance of Update Assistant. + +### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId + +Event sends basic info when the Windows 10 Update Assistant tool could not be launched due to an error.. + +The following fields are available: + +- **ClientId** Identification of the current installed version of Update Assistant. +- **HResult** Error code of the Update Assistant Orchestrator error. +- **TriggerTaskSource** Describes which task launched this instance of Update Assistant. + +### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId + +Event sends basic info to signal when the settings related to the Windows 10 update could not be downloaded. + +The following fields are available: + +- **ClientId** Identification of the current installed version of Update Assistant. +- **HResult** Error code of the attempted query for the settings. + +### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId + +Event sends basic info on whether the device should or should not be updated to the latest Windows 10 version. + +The following fields are available: + +- **ClientId** Identification of the current installed version of Update Assistant. +- **LaunchMode** Type of launch performed. +- **LaunchTypeReason** All of the reasons for the type of launch performed. +- **TriggerTaskSource** Describes which task launched this instance of Update Assistant. +- **UALaunchRunCount** Total number of times Update Assistant was launched. + +### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId + +Event sends basic info on whether the Windows 10 update notification had launched previously. + +The following fields are available: + +- **ClientId** Identification of the current installed version of Update Assistant. +- **RestoreReason** All of the reasons for being restored. +- **TriggerTaskSource** Describes which task launched this instance of Update Assistant. ## Update events diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index bb8dd0082b..d9719bbdd6 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -30,6 +30,7 @@ Use this article to learn about diagnostic events, grouped by event area, and th You can learn more about Windows functional and diagnostic data through these articles: +- [Windows 10, version 1803 basic diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1803) - [Windows 10, version 1703 basic diagnostic events and fields](https://docs.microsoft.com/windows/configuration/basic-level-windows-diagnostic-events-and-fields-1703) - [Manage connections from Windows operating system components to Microsoft services](https://docs.microsoft.com/windows/configuration/manage-connections-from-windows-operating-system-components-to-microsoft-services) - [Configure Windows diagnostic data in your organization](https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization) @@ -3507,6 +3508,71 @@ The following fields are available: - **UpdateId** "Identifier associated with the specific piece of content " - **WUDeviceID** "Unique device id controlled by the software distribution client " +## Update Assistant Orchestrator events + +>[!NOTE] +>Events from this provider are sent with the installation of KB4023814. For details, see [this support article](https://support.microsoft.com/help/4023814). + +### Microsoft.Windows.UpdateAssistant.Orchestrator.BlockingEventId + +Event sends basic info on the reason that Windows 10 was not updated due to compatibility issues, previous rollbacks, or admin policies.. + +The following fields are available: + +- **ApplicabilityBlockedReason** Blocked due to an applicability issue. +- **ClientId** Identification of the current installed version of Update Assistant. +- **TriggerTaskSource** Describes which task launched this instance of Update Assistant. + +### Microsoft.Windows.UpdateAssistant.Orchestrator.DeniedLaunchEventId + +Event sends basic info on the reason the Windows 10 update was blocked or prevented. + +The following fields are available: + +- **ClientId** Identification of the current installed version of Update Assistant. +- **DenyReason** Reasons why Update Assistant was prevented from launching. +- **TriggerTaskSource** Describes which task launched this instance of Update Assistant. + +### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedLaunchEventId + +Event sends basic info when the Windows 10 Update Assistant tool could not be launched due to an error.. + +The following fields are available: + +- **ClientId** Identification of the current installed version of Update Assistant. +- **HResult** Error code of the Update Assistant Orchestrator error. +- **TriggerTaskSource** Describes which task launched this instance of Update Assistant. + +### Microsoft.Windows.UpdateAssistant.Orchestrator.FailedOneSettingsQueryEventId + +Event sends basic info to signal when the settings related to the Windows 10 update could not be downloaded. + +The following fields are available: + +- **ClientId** Identification of the current installed version of Update Assistant. +- **HResult** Error code of the attempted query for the settings. + +### Microsoft.Windows.UpdateAssistant.Orchestrator.LaunchEventId + +Event sends basic info on whether the device should or should not be updated to the latest Windows 10 version. + +The following fields are available: + +- **ClientId** Identification of the current installed version of Update Assistant. +- **LaunchMode** Type of launch performed. +- **LaunchTypeReason** All of the reasons for the type of launch performed. +- **TriggerTaskSource** Describes which task launched this instance of Update Assistant. +- **UALaunchRunCount** Total number of times Update Assistant was launched. + +### Microsoft.Windows.UpdateAssistant.Orchestrator.RestoreEventId + +Event sends basic info on whether the Windows 10 update notification had launched previously. + +The following fields are available: + +- **ClientId** Identification of the current installed version of Update Assistant. +- **RestoreReason** All of the reasons for being restored. +- **TriggerTaskSource** Describes which task launched this instance of Update Assistant. ## Update events diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md similarity index 100% rename from windows/privacy/basic-level-windows-diagnostic-events-and-fields.md rename to windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index 17d45d542b..80ab6e72d3 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -1,445 +1,445 @@ ---- -description: Use this article to make informed decisions about how you can configure diagnostic data in your organization. -title: Configure Windows diagnostic data in your organization (Windows 10) -keywords: privacy -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: security -ms.localizationpriority: high -author: brianlic-msft -ms.date: 04/04/2018 ---- - -# Configure Windows diagnostic data in your organization - -**Applies to** - -- Windows 10 Enterprise -- Windows 10 Mobile -- Windows Server - -At Microsoft, we use Windows diagnostic data to inform our decisions and focus our efforts in providing the most robust, most valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Diagnostic data gives users a voice in the operating system’s development. This guide describes the importance of Windows diagnostic data and how we protect that data. Additionally, it differentiates between diagnostic data and functional data. It also describes the diagnostic data levels that Windows supports. Of course, you can choose how much diagnostic data is shared with Microsoft, and this guide demonstrates how. - -To frame a discussion about diagnostic data, it is important to understand Microsoft’s privacy principles. We earn customer trust every day by focusing on six key privacy principles as described at [privacy.microsoft.com](https://privacy.microsoft.com/). These principles guided the implementation of the Windows diagnostic data system in the following ways: - -- **Control.** We offer customers control of the diagnostic data they share with us by providing easy-to-use management tools. -- **Transparency.** We provide information about the diagnostic data that Windows and Windows Server collects so our customers can make informed decisions. -- **Security.** We encrypt diagnostic data in transit from your device via TLS 1.2, and additionally use certificate pinning to secure the connection. -- **Strong legal protections.** We respect customers’ local privacy laws and fight for legal protection of their privacy as a fundamental human right. -- **No content-based targeting.** We take steps to avoid and minimize the collection of customer content, such as the content of files, chats, or emails, through the Windows diagnostic data system. Customer content inadvertently collected is kept confidential and not used for user targeting. -- **Benefits to you.** We collect Windows diagnostic data to help provide you with an up-to-date, more secure, reliable and performant product, and to improve Windows for all our customers. - -This article applies to Windows and Windows Server diagnostic data only. Other Microsoft or third-party apps, such as System Center Configuration Manager, System Center Endpoint Protection, or System Center Data Protection Manager, might send data to their cloud services in ways that are inconsistent with this guide. Their publishers are responsible for notifying users of their privacy policies, diagnostic data controls, and so on. This article describes the types of diagnostic data we may gather, the ways you might manage it in your organization, and some examples of how diagnostic data can provide you with valuable insights into your enterprise deployments. Microsoft uses the data to quickly identify and address issues affecting its customers. - -Use this article to make informed decisions about how you might configure diagnostic data in your organization. Diagnostic data is a term that means different things to different people and organizations. For this article, we discuss diagnostic data as system data that is uploaded by the Connected User Experiences and Telemetry component. The diagnostic data is used to help keep Windows devices secure by identifying malware trends and other threats and to help Microsoft improve the quality of Windows and Microsoft services. - -We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. - -## Overview - -In previous versions of Windows and Windows Server, Microsoft used diagnostic data to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC), and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server 2016, you can control diagnostic data streams by using the Privacy option in Settings, Group Policy, or MDM. - -For Windows 10, we invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows work better for your organization. - -## Understanding Windows diagnostic data - -Windows as a Service is a fundamental change in how Microsoft plans, builds, and delivers the operating system. Historically, we released a major Windows version every few years. The effort required to deploy large and infrequent Windows versions was substantial. That effort included updating the infrastructure to support the upgrade. Windows as a Service accelerates the cadence to provide rich updates more frequently, and these updates require substantially less effort to roll out than earlier versions of Windows. Since it provides more value to organizations in a shorter timeframe, delivering Windows as a Service is a top priority for us. - -The release cadence of Windows may be fast, so feedback is critical to its success. We rely on diagnostic data at each stage of the process to inform our decisions and prioritize our efforts. - -### What is Windows diagnostic data? -Windows diagnostic data is vital technical data from Windows devices about the device and how Windows and related software are performing. It's used in the following ways: - -- Keep Windows up to date -- Keep Windows secure, reliable, and performant -- Improve Windows – through the aggregate analysis of the use of Windows -- Personalize Windows engagement surfaces - -Here are some specific examples of Windows diagnostic data: - -- Type of hardware being used -- Applications installed and usage details -- Reliability information on device drivers - -### What is NOT diagnostic data? - -Diagnostic data can sometimes be confused with functional data. Some Windows components and apps connect to Microsoft services directly, but the data they exchange is not diagnostic data. For example, exchanging a user’s location for local weather or news is not an example of diagnostic data—it is functional data that the app or service requires to satisfy the user’s request. - -There are subtle differences between diagnostic data and functional data. Windows collects and sends diagnostic data in the background automatically. You can control how much information is gathered by setting the diagnostic data level. Microsoft tries to avoid collecting personal information wherever possible (for example, if a crash dump is collected and a document was in memory at the time of the crash). On the other hand, functional data can contain personal information. However, a user action, such as requesting news or asking Cortana a question, usually triggers collection and transmission of functional data. - -If you’re an IT pro that wants to manage Windows functional data sent from your organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services). - -The following are specific examples of functional data: - -- Current location for weather -- Bing searches -- Wallpaper and desktop settings synced across multiple devices - -### Diagnostic data gives users a voice - -Windows and Windows Server diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server 2016 behaves in the real world, focus on user priorities, and make informed decisions that benefit them. For our enterprise customers, representation in the dataset on which we will make future design decisions is a real benefit. The following sections offer real examples of these benefits. - -### Drive higher app and driver quality - -Our ability to collect diagnostic data that drives improvements to Windows and Windows Server helps raise the bar for app and device driver quality. Diagnostic data helps us to quickly identify and fix critical reliability and security issues with apps and device drivers on given configurations. For example, we can identify an app that hangs on devices using a specific version of a video driver, allowing us to work with the app and device driver vendor to quickly fix the issue. The result is less downtime and reduced costs and increased productivity associated with troubleshooting these issues. - -#### Real-world example of how Windows diagnostic data helps -There was a version of a video driver that was crashing on some devices running Windows 10, causing the device to reboot. We detected the problem in our diagnostic data, and immediately contacted the third-party developer who builds the video driver. Working with the developer, we provided an updated driver to Windows Insiders within 24 hours. Based on diagnostic data from the Windows Insiders’ devices, we were able to validate the new version of the video driver, and rolled it out to the broad public as an update the next day. Diagnostic data helped us find, fix, and resolve this problem in just 48 hours, providing a better user experience and reducing costly support calls. - -### Improve end-user productivity - -Windows diagnostic data also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. Examples are: - -- **Start menu.** How do people change the Start menu layout? Do they pin other apps to it? Are there any apps that they frequently unpin? We use this dataset to adjust the default Start menu layout to better reflect people’s expectations when they turn on their device for the first time. -- **Cortana.** We use diagnostic data to monitor the scalability of our cloud service, improving search performance. -- **Application switching.** Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between applications. After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later diagnostic data showed significantly higher usage of this feature. - -**These examples show how the use of diagnostic data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls.** - - -### Insights into your own organization - -Sharing information with Microsoft helps make Windows and other products better, but it can also help make your internal processes and user experiences better, as well. Microsoft is in the process of developing a set of analytics customized for your internal use. The first of these, called [Upgrade Readiness](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness). - -#### Upgrade Readiness - -Upgrading to new operating system versions has traditionally been a challenging, complex, and slow process for many enterprises. Discovering applications and drivers and then testing them for potential compatibility issues have been among the biggest pain points. - -To better help customers through this difficult process, Microsoft developed Upgrade Readiness to give enterprises the tools to plan and manage the upgrade process end to end and allowing them to adopt new Windows releases more quickly and on an ongoing basis. - -With Windows diagnostic data enabled, Microsoft collects computer, application, and driver compatibility-related information for analysis. We then identify compatibility issues that can block your upgrade and suggest fixes when they are known to Microsoft. - -Use Upgrade Readiness to get: - -- A visual workflow that guides you from pilot to production -- Detailed computer, driver, and application inventory -- Powerful computer level search and drill-downs -- Guidance and insights into application and driver compatibility issues with suggested fixes -- Data driven application rationalization tools -- Application usage information, allowing targeted validation; workflow to track validation progress and decisions -- Data export to commonly used software deployment tools - -The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. - -## How is diagnostic data handled by Microsoft? - -### Data collection - -Windows 10 and Windows Server 2016 includes the Connected User Experiences and Telemetry component, which uses Event Tracing for Windows (ETW) tracelogging technology that gathers and stores diagnostic data events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology. - -1. Operating system features and some management applications are instrumented to publish events and data. Examples of management applications include Virtual Machine Manager (VMM), Server Manager, and Storage Spaces. -2. Events are gathered using public operating system event logging and tracing APIs. -3. You can configure the diagnostic data level by using MDM policy, Group Policy, or registry settings. -4. The Connected User Experiences and Telemetry component transmits the diagnostic data. - -Info collected at the Enhanced and Full levels of diagnostic data is typically gathered at a fractional sampling rate, which can be as low as 1% of devices reporting data at those levels. - -### Data transmission - -All diagnostic data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10, data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection, are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks. - -The data transmitted at the Basic and Enhanced data diagnostic levels is quite small; typically less than 1 MB per device per day, but occasionally up to 2 MB per device per day). - - -### Endpoints - -The Microsoft Data Management Service routes data back to our secure cloud storage. Only Microsoft personnel with a valid business justification are permitted access. - -The following table defines the endpoints for Connected User Experiences and Telemetry component: - -Windows release | Endpoint ---- | --- -Windows 10, versions 1703 and 1709 | Diagnostics data: v10.vortex-win.data.microsoft.com/collect/v1

    Functional: v20.vortex-win.data.microsoft.com/collect/v1
    Windows Advanced Threat Protection is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com/collect/v1
    settings-win.data.microsoft.com -Windows 10, version 1607 | v10.vortex-win.data.microsoft.com

    settings-win.data.microsoft.com - -The following table defines the endpoints for other diagnostic data services: - -| Service | Endpoint | -| - | - | -| [Windows Error Reporting](http://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com | -| [Online Crash Analysis](http://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com | -| OneDrive app for Windows 10 | vortex.data.microsoft.com/collect/v1 | - -### Data use and access - -The principle of least privileged access guides access to diagnostic data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft may share business reports with OEMs and third-party partners that include aggregated and anonymized diagnostic data information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. - -### Retention - -Microsoft believes in and practices information minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Microsoft Store purchase history. - -## Diagnostic data levels -This section explains the different diagnostic data levels in Windows 10, Windows Server 2016, and System Center. These levels are available on all desktop and mobile editions of Windows 10, except for the **Security** level, which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016. - -The diagnostic data is categorized into four levels: - -- **Security**. Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. - -- **Basic**. Basic device info, including: quality-related data, app compatibility, and data from the **Security** level. - -- **Enhanced**. Additional insights, including: how Windows, Windows Server, System Center, and apps are used, how they perform, advanced reliability data, and data from both the **Basic** and the **Security** levels. - -- **Full**. All data necessary to identify and help to fix problems, plus data from the **Security**, **Basic**, and **Enhanced** levels. - -The levels are cumulative and are illustrated in the following diagram. Also, these levels apply to all editions of Windows Server 2016. - -![breakdown of diagnostic data levels and types of administrative controls](images/priv-telemetry-levels.png) - -### Security level - -The Security level gathers only the diagnostic data info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server 2016, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windows IoT Core editions. - -> [!NOTE] -> If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. - -Windows Server Update Services (WSUS) and System Center Configuration Manager functionality is not affected at this level, nor is diagnostic data about Windows Server features or System Center gathered. - -The data gathered at this level includes: - -- **Connected User Experiences and Telemetry component settings**. If general diagnostic data has been gathered and is queued, it is sent to Microsoft. Along with this diagnostic data, the Connected User Experiences and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experiences and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop). - -- **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address. - - > [!NOTE] - > You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716). - -- **Windows Defender/Endpoint Protection**. Windows Defender and System Center Endpoint Protection requires some information to function, including: anti-malware signatures, diagnostic information, User Account Control settings, Unified Extensible Firmware Interface (UEFI) settings, and IP address. - - > [!NOTE] - > This reporting can be turned off and no information is included if a customer is using third-party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender). - - Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, System Center Configuration Manager, or a third-party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates. - -For servers with default diagnostic data settings and no Internet connectivity, you should set the diagnostic data level to **Security**. This stops data gathering for events that would not be uploaded due to the lack of Internet connectivity. - -No user content, such as user files or communications, is gathered at the **Security** diagnostic data level, and we take steps to avoid gathering any information that directly identifies a company or user, such as name, email address, or account ID. However, in rare circumstances, MSRT information may unintentionally contain personal information. For instance, some malware may create entries in a computer’s registry that include information such as a username, causing it to be gathered. MSRT reporting is optional and can be turned off at any time. - -### Basic level - -The Basic level gathers a limited set of data that’s critical for understanding the device and its configuration. This level also includes the **Security** level data. This level helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version. The Connected User Experiences and Telemetry component does not gather diagnostic data about System Center, but it can transmit diagnostic data for other non-Windows applications if they have user consent. - -The normal upload range for the Basic diagnostic data level is between 109 KB - 159 KB per day, per device. - -The data gathered at this level includes: - -- **Basic device data**. Helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Server 2016 in the ecosystem. Examples include: - - - Device attributes, such as camera resolution and display type - - - Internet Explorer version - - - Battery attributes, such as capacity and type - - - Networking attributes, such as number of network adapters, speed of network adapters, mobile operator network, and IMEI number - - - Processor and memory attributes, such as number of cores, architecture, speed, memory size, and firmware - - - Virtualization attribute, such as Second Level Address Translation (SLAT) support and guest operating system - - - Operating system attributes, such as Windows edition and virtualization state - - - Storage attributes, such as number of drives, type, and size - -- **Connected User Experiences and Telemetry component quality metrics**. Helps provide an understanding about how the Connected User Experiences and Telemetry component is functioning, including % of uploaded events, dropped events, and the last upload time. - -- **Quality-related information**. Helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the device characteristics of a Connected Standby device, the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app. - -- **Compatibility data**. Helps provide an understanding about which apps are installed on a device or virtual machine and identifies potential compatibility problems. - - - **General app data and app data for Internet Explorer add-ons**. Includes a list of apps that are installed on a native or virtualized instance of the OS and whether these apps function correctly after an upgrade. This app data includes the app name, publisher, version, and basic details about which files have been blocked from usage. - - - **Internet Explorer add-ons**. Includes a list of Internet Explorer add-ons that are installed on a device and whether these apps will work after an upgrade. - - - **System data**. Helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS. - - - **Accessory device data**. Includes a list of accessory devices, such as printers or external storage devices, that are connected to Windows PCs and whether these devices will function after upgrading to a new version of the operating system. - - - **Driver data**. Includes specific driver usage that’s meant to help figure out whether apps and devices will function after upgrading to a new version of the operating system. This can help to determine blocking issues and then help Microsoft and our partners apply fixes and improvements. - -- **Microsoft Store**. Provides information about how the Microsoft Store performs, including app downloads, installations, and updates. It also includes Microsoft Store launches, page views, suspend and resumes, and obtaining licenses. - - -### Enhanced level - -The Enhanced level gathers data about how Windows and apps are used and how they perform. This level also includes data from both the **Basic** and **Security** levels. This level helps to improve the user experience with the operating system and apps. Data from this level can be abstracted into patterns and trends that can help Microsoft determine future improvements. - -This is the default level for Windows 10 Enterprise and Windows 10 Education editions, and the minimum level needed to quickly identify and address Windows, Windows Server, and System Center quality issues. - -The normal upload range for the Enhanced diagnostic data level is between 239 KB - 348 KB per day, per device. - -The data gathered at this level includes: - -- **Operating system events**. Helps to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components. - -- **Operating system app events**. A set of events resulting from Microsoft applications and management tools that were downloaded from the Store or pre-installed with Windows or Windows Server, including Server Manager, Photos, Mail, and Microsoft Edge. - -- **Device-specific events**. Contains data about events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events. - -- **Some crash dump types**. All crash dump types, except for heap dumps and full dumps. - -If the Connected User Experiences and Telemetry component detects a problem on Windows 10 that requires gathering more detailed instrumentation, the Connected User Experiences and Telemetry component at the **Enhanced** diagnostic data level will only gather data about the events associated with the specific issue. - -#### Limit Enhanced diagnostic data to the minimum required by Windows Analytics -Windows Analytics Device Health reports are powered by diagnostic data not included in the **Basic** level, such as crash reports and certain operating system events. In the past, organizations sending **Enhanced** or **Full** level diagnostic data were able to participate in Device Health. However, organizations that required detailed event and field level documentation were unable to move from **Basic** to **Enhanced**. - -In Windows 10, version 1709, we introduce the **Limit Enhanced diagnostic data to the minimum required by Windows Analytics** feature. When enabled, this feature lets you send only the following subset of **Enhanced** level diagnostic data. For more info about Device Health, see the [Monitor the health of devices with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor) topic. - -- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) topic. - -- **Some crash dump types.** All crash dump types, except for heap and full dumps. - -**To turn on this behavior for devices** - -1. Set the diagnostic data level to **Enhanced**, using either Group Policy or MDM. - - a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds/Allow telemetry** setting to **2**. - - -OR- - - b. Using MDM, use the Policy CSP to set the **System/AllowTelemetry** value to **2**. - - -AND- - -2. Enable the **LimitEnhancedDiagnosticDataWindowsAnalytics** setting, using either Group Policy or MDM. - - a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data collection and Preview builds/Limit Enhanced diagnostic data to the minimum required by Windows Analytics** setting to **Enabled**. - - -OR- - - b. Using MDM, use the Policy CSP to set the **System/LimitEnhancedDiagnosticDataWindowsAnalytics** value to **1**. - -### Full level - -The **Full** level gathers data necessary to identify and to help fix problems, following the approval process described below. This level also includes data from the **Basic**, **Enhanced**, and **Security** levels. This is the default level for Windows 10 Pro. - -Additionally, at this level, devices opted in to the [Windows Insider Program](http://insider.windows.com) will send events, such as reliability and app responsiveness. that can show Microsoft how pre-release binaries and features are performing. These events help us make decisions on which builds are flighted. All devices in the [Windows Insider Program](http://insider.windows.com) are automatically set to this level. - -If a device experiences problems that are difficult to identify or repeat using Microsoft’s internal testing, additional data becomes necessary. This data can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the **Full** diagnostic data level and have exhibited the problem. - -However, before more data is gathered, Microsoft’s privacy governance team, including privacy and other subject matter experts, must approve the diagnostics request made by a Microsoft engineer. If the request is approved, Microsoft engineers can use the following capabilities to get the information: - -- Ability to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as msinfo32.exe, powercfg.exe, and dxdiag.exe. - -- Ability to get registry keys. - -- All crash dump types, including heap dumps and full dumps. - -## Enterprise management - -Sharing diagnostic data with Microsoft provides many benefits to enterprises, so we do not recommend turning it off. For most enterprise customers, simply adjusting the diagnostic data level and managing specific components is the best option. - -Customers can set the diagnostic data level in both the user interface and with existing management tools. Users can change the diagnostic data level in the **Diagnostic data** setting. In the **Settings** app, it is in **Privacy\Feedback & diagnostics**. They can choose between Basic and Full. The Enhanced level will only be displayed as an option when Group Policy or Mobile Device Management (MDM) are invoked with this level. The Security level is not available. - -IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a diagnostic data level. If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016, the Security diagnostic data level is available when managing the policy. Setting the diagnostic data level through policy sets the upper boundary for the users’ choices. To disable user choice after setting the level with the policy, you will need to use the "Configure telemetry opt-in setting user interface" group policy. The remainder of this section describes how to use group policy to configure levels and settings interface. - - -### Manage your diagnostic data settings - -We do not recommend that you turn off diagnostic data in your organization as valuable functionality may be impacted, but we recognize that in some scenarios this may be required. Use the steps in this section to do so for Windows, Windows Server, and System Center. - -> [!IMPORTANT] -> These diagnostic data levels only apply to Windows, Windows Server, and System Center components and apps that use the Connected User Experiences and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these diagnostic data levels. You should work with your app vendors to understand their diagnostic data policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of Office Telemetry](http://technet.microsoft.com/library/jj863580.aspx). - -You can turn on or turn off System Center diagnostic data gathering. The default is on and the data gathered at this level represents what is gathered by default when System Center diagnostic data is turned on. However, setting the operating system diagnostic data level to **Basic** will turn off System Center diagnostic data, even if the System Center diagnostic data switch is turned on. - -The lowest diagnostic data setting level supported through management policies is **Security**. The lowest diagnostic data setting supported through the Settings UI is **Basic**. The default diagnostic data setting for Windows Server 2016 is **Enhanced**. - -### Configure the operating system diagnostic data level - -You can configure your operating system diagnostic data settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy sets the upper level for diagnostic data on the device. - -Use the appropriate value in the table below when you configure the management policy. - -| Level | Data gathered | Value | -| - | - | - | -| Security | Security data only. | **0** | -| Basic | Security data, and basic system and quality data. | **1** | -| Enhanced | Security data, basic system and quality data, and enhanced insights and advanced reliability data. | **2** | -| Full | Security data, basic system and quality data, enhanced insights and advanced reliability data, and full diagnostics data. | **3** | - - > [!NOTE] - > When the User Configuration policy is set for Diagnostic Data, this will override the Computer Configuration setting. - -### Use Group Policy to set the diagnostic data level - -Use a Group Policy object to set your organization’s diagnostic data level. - -1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**. - -2. Double-click **Allow Telemetry**. - -3. In the **Options** box, select the level that you want to configure, and then click **OK**. - -### Use MDM to set the diagnostic data level - -Use the [Policy Configuration Service Provider (CSP)](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to apply the System/AllowTelemetry MDM policy. - -### Use Registry Editor to set the diagnostic data level - -Use Registry Editor to manually set the registry level on each device in your organization or you can write a script to edit the registry. If a management policy already exists, such as Group Policy or MDM, it will override this registry setting. - -1. Open Registry Editor, and go to **HKEY\_LOCAL\_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\DataCollection**. - -2. Right-click **DataCollection**, click New, and then click **DWORD (32-bit) Value**. - -3. Type **AllowTelemetry**, and then press ENTER. - -4. Double-click **AllowTelemetry**, set the desired value from the table above, and then click **OK.** - -5. Click **File** > **Export**, and then save the file as a .reg file, such as **C:\\AllowTelemetry.reg**. You can run this file from a script on each device in your organization. - -### Configure System Center 2016 diagnostic data - -For System Center 2016 Technical Preview, you can turn off System Center diagnostic data by following these steps: - -- Turn off diagnostic data by using the System Center UI Console settings workspace. - -- For information about turning off diagnostic data for Service Management Automation and Service Provider Foundation, see [How to disable telemetry for Service Management Automation and Service Provider Foundation](https://support.microsoft.com/kb/3096505). - -### Additional diagnostic data controls - -There are a few more settings that you can turn off that may send diagnostic data information: - -- To turn off Windows Update diagnostic data, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](http://technet.microsoft.com/library/hh852345.aspx) or [System Center Configuration Manager](http://www.microsoft.com/server-cloud/products/system-center-2012-r2-configuration-manager/). - -- Turn off **Windows Defender Cloud-based Protection** and **Automatic sample submission** in **Settings** > **Update & security** > **Windows Defender**. - -- Manage the Malicious Software Removal Tool in your organization. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716). - -- Turn off **Linguistic Data Collection** in **Settings** > **Privacy**. At diagnostic data levels **Enhanced** and **Full**, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary. - - > [!NOTE] - > Microsoft does not intend to gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information. - -## Additional resources - -FAQs - -- [Cortana, Search, and privacy](https://privacy.microsoft.com/windows-10-cortana-and-privacy) -- [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy) -- [Windows 10 camera and privacy](https://privacy.microsoft.com/windows-10-camera-and-privacy) -- [Windows 10 location service and privacy](https://privacy.microsoft.com/windows-10-location-and-privacy) -- [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy) -- [Windows 10 speech, inking, typing, and privacy](https://privacy.microsoft.com/windows-10-speech-inking-typing-and-privacy-faq) -- [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy) -- [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense) -- [Windows Update Delivery Optimization](https://privacy.microsoft.com/windows-10-windows-update-delivery-optimization) - -Blogs - -- [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10) - -Privacy Statement - -- [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) - -TechNet - -- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) - -Web Pages - -- [Privacy at Microsoft](http://privacy.microsoft.com) - - +--- +description: Use this article to make informed decisions about how you can configure diagnostic data in your organization. +title: Configure Windows diagnostic data in your organization (Windows 10) +keywords: privacy +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: high +author: brianlic-msft +ms.date: 04/04/2018 +--- + +# Configure Windows diagnostic data in your organization + +**Applies to** + +- Windows 10 Enterprise +- Windows 10 Mobile +- Windows Server + +At Microsoft, we use Windows diagnostic data to inform our decisions and focus our efforts in providing the most robust, most valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Diagnostic data gives users a voice in the operating system’s development. This guide describes the importance of Windows diagnostic data and how we protect that data. Additionally, it differentiates between diagnostic data and functional data. It also describes the diagnostic data levels that Windows supports. Of course, you can choose how much diagnostic data is shared with Microsoft, and this guide demonstrates how. + +To frame a discussion about diagnostic data, it is important to understand Microsoft’s privacy principles. We earn customer trust every day by focusing on six key privacy principles as described at [privacy.microsoft.com](https://privacy.microsoft.com/). These principles guided the implementation of the Windows diagnostic data system in the following ways: + +- **Control.** We offer customers control of the diagnostic data they share with us by providing easy-to-use management tools. +- **Transparency.** We provide information about the diagnostic data that Windows and Windows Server collects so our customers can make informed decisions. +- **Security.** We encrypt diagnostic data in transit from your device via TLS 1.2, and additionally use certificate pinning to secure the connection. +- **Strong legal protections.** We respect customers’ local privacy laws and fight for legal protection of their privacy as a fundamental human right. +- **No content-based targeting.** We take steps to avoid and minimize the collection of customer content, such as the content of files, chats, or emails, through the Windows diagnostic data system. Customer content inadvertently collected is kept confidential and not used for user targeting. +- **Benefits to you.** We collect Windows diagnostic data to help provide you with an up-to-date, more secure, reliable and performant product, and to improve Windows for all our customers. + +This article applies to Windows and Windows Server diagnostic data only. Other Microsoft or third-party apps, such as System Center Configuration Manager, System Center Endpoint Protection, or System Center Data Protection Manager, might send data to their cloud services in ways that are inconsistent with this guide. Their publishers are responsible for notifying users of their privacy policies, diagnostic data controls, and so on. This article describes the types of diagnostic data we may gather, the ways you might manage it in your organization, and some examples of how diagnostic data can provide you with valuable insights into your enterprise deployments. Microsoft uses the data to quickly identify and address issues affecting its customers. + +Use this article to make informed decisions about how you might configure diagnostic data in your organization. Diagnostic data is a term that means different things to different people and organizations. For this article, we discuss diagnostic data as system data that is uploaded by the Connected User Experiences and Telemetry component. The diagnostic data is used to help keep Windows devices secure by identifying malware trends and other threats and to help Microsoft improve the quality of Windows and Microsoft services. + +We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. + +## Overview + +In previous versions of Windows and Windows Server, Microsoft used diagnostic data to check for updated or new Windows Defender signatures, check whether Windows Update installations were successful, gather reliability information through the Reliability Analysis Component (RAC), and gather reliability information through the Windows Customer Experience Improvement Program (CEIP) on Windows. In Windows 10 and Windows Server 2016, you can control diagnostic data streams by using the Privacy option in Settings, Group Policy, or MDM. + +For Windows 10, we invite IT pros to join the [Windows Insider Program](http://insider.windows.com) to give us feedback on what we can do to make Windows work better for your organization. + +## Understanding Windows diagnostic data + +Windows as a Service is a fundamental change in how Microsoft plans, builds, and delivers the operating system. Historically, we released a major Windows version every few years. The effort required to deploy large and infrequent Windows versions was substantial. That effort included updating the infrastructure to support the upgrade. Windows as a Service accelerates the cadence to provide rich updates more frequently, and these updates require substantially less effort to roll out than earlier versions of Windows. Since it provides more value to organizations in a shorter timeframe, delivering Windows as a Service is a top priority for us. + +The release cadence of Windows may be fast, so feedback is critical to its success. We rely on diagnostic data at each stage of the process to inform our decisions and prioritize our efforts. + +### What is Windows diagnostic data? +Windows diagnostic data is vital technical data from Windows devices about the device and how Windows and related software are performing. It's used in the following ways: + +- Keep Windows up to date +- Keep Windows secure, reliable, and performant +- Improve Windows – through the aggregate analysis of the use of Windows +- Personalize Windows engagement surfaces + +Here are some specific examples of Windows diagnostic data: + +- Type of hardware being used +- Applications installed and usage details +- Reliability information on device drivers + +### What is NOT diagnostic data? + +Diagnostic data can sometimes be confused with functional data. Some Windows components and apps connect to Microsoft services directly, but the data they exchange is not diagnostic data. For example, exchanging a user’s location for local weather or news is not an example of diagnostic data—it is functional data that the app or service requires to satisfy the user’s request. + +There are subtle differences between diagnostic data and functional data. Windows collects and sends diagnostic data in the background automatically. You can control how much information is gathered by setting the diagnostic data level. Microsoft tries to avoid collecting personal information wherever possible (for example, if a crash dump is collected and a document was in memory at the time of the crash). On the other hand, functional data can contain personal information. However, a user action, such as requesting news or asking Cortana a question, usually triggers collection and transmission of functional data. + +If you’re an IT pro that wants to manage Windows functional data sent from your organization to Microsoft, see [Manage connections from Windows operating system components to Microsoft services](https://technet.microsoft.com/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services). + +The following are specific examples of functional data: + +- Current location for weather +- Bing searches +- Wallpaper and desktop settings synced across multiple devices + +### Diagnostic data gives users a voice + +Windows and Windows Server diagnostic data gives every user a voice in the operating system’s development and ongoing improvement. It helps us understand how Windows 10 and Windows Server 2016 behaves in the real world, focus on user priorities, and make informed decisions that benefit them. For our enterprise customers, representation in the dataset on which we will make future design decisions is a real benefit. The following sections offer real examples of these benefits. + +### Drive higher app and driver quality + +Our ability to collect diagnostic data that drives improvements to Windows and Windows Server helps raise the bar for app and device driver quality. Diagnostic data helps us to quickly identify and fix critical reliability and security issues with apps and device drivers on given configurations. For example, we can identify an app that hangs on devices using a specific version of a video driver, allowing us to work with the app and device driver vendor to quickly fix the issue. The result is less downtime and reduced costs and increased productivity associated with troubleshooting these issues. + +#### Real-world example of how Windows diagnostic data helps +There was a version of a video driver that was crashing on some devices running Windows 10, causing the device to reboot. We detected the problem in our diagnostic data, and immediately contacted the third-party developer who builds the video driver. Working with the developer, we provided an updated driver to Windows Insiders within 24 hours. Based on diagnostic data from the Windows Insiders’ devices, we were able to validate the new version of the video driver, and rolled it out to the broad public as an update the next day. Diagnostic data helped us find, fix, and resolve this problem in just 48 hours, providing a better user experience and reducing costly support calls. + +### Improve end-user productivity + +Windows diagnostic data also helps Microsoft better understand how customers use (or do not use) the operating system’s features and related services. The insights we gain from this data helps us prioritize our engineering effort to directly impact our customers’ experiences. Examples are: + +- **Start menu.** How do people change the Start menu layout? Do they pin other apps to it? Are there any apps that they frequently unpin? We use this dataset to adjust the default Start menu layout to better reflect people’s expectations when they turn on their device for the first time. +- **Cortana.** We use diagnostic data to monitor the scalability of our cloud service, improving search performance. +- **Application switching.** Research and observations from earlier Windows versions showed that people rarely used Alt+Tab to switch between applications. After discussing this with some users, we learned they loved the feature, saying that it would be highly productive, but they did not know about it previously. Based on this, we created the Task View button in Windows 10 to make this feature more discoverable. Later diagnostic data showed significantly higher usage of this feature. + +**These examples show how the use of diagnostic data enables Microsoft to build or enhance features which can help organizations increase employee productivity while lowering help desk calls.** + + +### Insights into your own organization + +Sharing information with Microsoft helps make Windows and other products better, but it can also help make your internal processes and user experiences better, as well. Microsoft is in the process of developing a set of analytics customized for your internal use. The first of these, called [Upgrade Readiness](/windows/deployment/upgrade/manage-windows-upgrades-with-upgrade-readiness). + +#### Upgrade Readiness + +Upgrading to new operating system versions has traditionally been a challenging, complex, and slow process for many enterprises. Discovering applications and drivers and then testing them for potential compatibility issues have been among the biggest pain points. + +To better help customers through this difficult process, Microsoft developed Upgrade Readiness to give enterprises the tools to plan and manage the upgrade process end to end and allowing them to adopt new Windows releases more quickly and on an ongoing basis. + +With Windows diagnostic data enabled, Microsoft collects computer, application, and driver compatibility-related information for analysis. We then identify compatibility issues that can block your upgrade and suggest fixes when they are known to Microsoft. + +Use Upgrade Readiness to get: + +- A visual workflow that guides you from pilot to production +- Detailed computer, driver, and application inventory +- Powerful computer level search and drill-downs +- Guidance and insights into application and driver compatibility issues with suggested fixes +- Data driven application rationalization tools +- Application usage information, allowing targeted validation; workflow to track validation progress and decisions +- Data export to commonly used software deployment tools + +The Upgrade Readiness workflow steps you through the discovery and rationalization process until you have a list of computers that are ready to be upgraded. + +## How is diagnostic data handled by Microsoft? + +### Data collection + +Windows 10 and Windows Server 2016 includes the Connected User Experiences and Telemetry component, which uses Event Tracing for Windows (ETW) tracelogging technology that gathers and stores diagnostic data events and data. The operating system and some Microsoft management solutions, such as System Center, use the same logging technology. + +1. Operating system features and some management applications are instrumented to publish events and data. Examples of management applications include Virtual Machine Manager (VMM), Server Manager, and Storage Spaces. +2. Events are gathered using public operating system event logging and tracing APIs. +3. You can configure the diagnostic data level by using MDM policy, Group Policy, or registry settings. +4. The Connected User Experiences and Telemetry component transmits the diagnostic data. + +Info collected at the Enhanced and Full levels of diagnostic data is typically gathered at a fractional sampling rate, which can be as low as 1% of devices reporting data at those levels. + +### Data transmission + +All diagnostic data is encrypted using SSL and uses certificate pinning during transfer from the device to the Microsoft Data Management Service. With Windows 10, data is uploaded on a schedule that is sensitive to event priority, battery use, and network cost. Real-time events, such as Windows Defender Advanced Threat Protection, are always sent immediately. Normal events are not uploaded on metered networks, unless you are on a metered server connection. On a free network, normal events can be uploaded every 4 hours if on battery, or every 15 minutes if on A/C power. Diagnostic and crash data are only uploaded on A/C power and free networks. + +The data transmitted at the Basic and Enhanced data diagnostic levels is quite small; typically less than 1 MB per device per day, but occasionally up to 2 MB per device per day). + + +### Endpoints + +The Microsoft Data Management Service routes data back to our secure cloud storage. Only Microsoft personnel with a valid business justification are permitted access. + +The following table defines the endpoints for Connected User Experiences and Telemetry component: + +Windows release | Endpoint +--- | --- +Windows 10, versions 1703 and 1709 | Diagnostics data: v10.vortex-win.data.microsoft.com/collect/v1

    Functional: v20.vortex-win.data.microsoft.com/collect/v1
    Windows Advanced Threat Protection is country specific and the prefix changes by country for example: **de**.vortex-win.data.microsoft.com/collect/v1
    settings-win.data.microsoft.com +Windows 10, version 1607 | v10.vortex-win.data.microsoft.com

    settings-win.data.microsoft.com + +The following table defines the endpoints for other diagnostic data services: + +| Service | Endpoint | +| - | - | +| [Windows Error Reporting](http://msdn.microsoft.com/library/windows/desktop/bb513641.aspx) | watson.telemetry.microsoft.com | +| [Online Crash Analysis](http://msdn.microsoft.com/library/windows/desktop/ee416349.aspx) | oca.telemetry.microsoft.com | +| OneDrive app for Windows 10 | vortex.data.microsoft.com/collect/v1 | + +### Data use and access + +The principle of least privileged access guides access to diagnostic data. Microsoft does not share personal data of our customers with third parties, except at the customer’s discretion or for the limited purposes described in the [Privacy Statement](https://privacy.microsoft.com/privacystatement). Microsoft may share business reports with OEMs and third-party partners that include aggregated and anonymized diagnostic data information. Data-sharing decisions are made by an internal team including privacy, legal, and data management. + +### Retention + +Microsoft believes in and practices information minimization. We strive to gather only the info we need and to store it only for as long as it’s needed to provide a service or for analysis. Much of the info about how Windows and apps are functioning is deleted within 30 days. Other info may be retained longer, such as error reporting data or Microsoft Store purchase history. + +## Diagnostic data levels +This section explains the different diagnostic data levels in Windows 10, Windows Server 2016, and System Center. These levels are available on all desktop and mobile editions of Windows 10, except for the **Security** level, which is limited to Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, Windows 10 IoT Core (IoT Core), and Windows Server 2016. + +The diagnostic data is categorized into four levels: + +- **Security**. Information that’s required to help keep Windows, Windows Server, and System Center secure, including data about the Connected User Experiences and Telemetry component settings, the Malicious Software Removal Tool, and Windows Defender. + +- **Basic**. Basic device info, including: quality-related data, app compatibility, and data from the **Security** level. + +- **Enhanced**. Additional insights, including: how Windows, Windows Server, System Center, and apps are used, how they perform, advanced reliability data, and data from both the **Basic** and the **Security** levels. + +- **Full**. All data necessary to identify and help to fix problems, plus data from the **Security**, **Basic**, and **Enhanced** levels. + +The levels are cumulative and are illustrated in the following diagram. Also, these levels apply to all editions of Windows Server 2016. + +![breakdown of diagnostic data levels and types of administrative controls](images/priv-telemetry-levels.png) + +### Security level + +The Security level gathers only the diagnostic data info that is required to keep Windows devices, Windows Server, and guests protected with the latest security updates. This level is only available on Windows Server 2016, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile Enterprise, and Windows IoT Core editions. + +> [!NOTE] +> If your organization relies on Windows Update for updates, you shouldn’t use the **Security** level. Because no Windows Update information is gathered at this level, important information about update failures is not sent. Microsoft uses this information to fix the causes of those failures and improve the quality of our updates. + +Windows Server Update Services (WSUS) and System Center Configuration Manager functionality is not affected at this level, nor is diagnostic data about Windows Server features or System Center gathered. + +The data gathered at this level includes: + +- **Connected User Experiences and Telemetry component settings**. If general diagnostic data has been gathered and is queued, it is sent to Microsoft. Along with this diagnostic data, the Connected User Experiences and Telemetry component may download a configuration settings file from Microsoft’s servers. This file is used to configure the Connected User Experiences and Telemetry component itself. The data gathered by the client for this request includes OS information, device id (used to identify what specific device is requesting settings) and device class (for example, whether the device is server or desktop). + +- **Malicious Software Removal Tool (MSRT)** The MSRT infection report contains information, including device info and IP address. + + > [!NOTE] + > You can turn off the MSRT infection report. No MSRT information is included if MSRT is not used. If Windows Update is turned off, MSRT will not be offered to users. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716). + +- **Windows Defender/Endpoint Protection**. Windows Defender and System Center Endpoint Protection requires some information to function, including: anti-malware signatures, diagnostic information, User Account Control settings, Unified Extensible Firmware Interface (UEFI) settings, and IP address. + + > [!NOTE] + > This reporting can be turned off and no information is included if a customer is using third-party antimalware software, or if Windows Defender is turned off. For more info, see [Windows Defender](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender). + + Microsoft recommends that Windows Update, Windows Defender, and MSRT remain enabled unless the enterprise uses alternative solutions such as Windows Server Update Services, System Center Configuration Manager, or a third-party antimalware solution. Windows Update, Windows Defender, and MSRT provide core Windows functionality such as driver and OS updates, including security updates. + +For servers with default diagnostic data settings and no Internet connectivity, you should set the diagnostic data level to **Security**. This stops data gathering for events that would not be uploaded due to the lack of Internet connectivity. + +No user content, such as user files or communications, is gathered at the **Security** diagnostic data level, and we take steps to avoid gathering any information that directly identifies a company or user, such as name, email address, or account ID. However, in rare circumstances, MSRT information may unintentionally contain personal information. For instance, some malware may create entries in a computer’s registry that include information such as a username, causing it to be gathered. MSRT reporting is optional and can be turned off at any time. + +### Basic level + +The Basic level gathers a limited set of data that’s critical for understanding the device and its configuration. This level also includes the **Security** level data. This level helps to identify problems that can occur on a specific hardware or software configuration. For example, it can help determine if crashes are more frequent on devices with a specific amount of memory or that are running a specific driver version. The Connected User Experiences and Telemetry component does not gather diagnostic data about System Center, but it can transmit diagnostic data for other non-Windows applications if they have user consent. + +The normal upload range for the Basic diagnostic data level is between 109 KB - 159 KB per day, per device. + +The data gathered at this level includes: + +- **Basic device data**. Helps provide an understanding about the types of Windows devices and the configurations and types of native and virtualized Windows Server 2016 in the ecosystem. Examples include: + + - Device attributes, such as camera resolution and display type + + - Internet Explorer version + + - Battery attributes, such as capacity and type + + - Networking attributes, such as number of network adapters, speed of network adapters, mobile operator network, and IMEI number + + - Processor and memory attributes, such as number of cores, architecture, speed, memory size, and firmware + + - Virtualization attribute, such as Second Level Address Translation (SLAT) support and guest operating system + + - Operating system attributes, such as Windows edition and virtualization state + + - Storage attributes, such as number of drives, type, and size + +- **Connected User Experiences and Telemetry component quality metrics**. Helps provide an understanding about how the Connected User Experiences and Telemetry component is functioning, including % of uploaded events, dropped events, and the last upload time. + +- **Quality-related information**. Helps Microsoft develop a basic understanding of how a device and its operating system are performing. Some examples are the device characteristics of a Connected Standby device, the number of crashes or hangs, and application state change details, such as how much processor time and memory were used, and the total uptime for an app. + +- **Compatibility data**. Helps provide an understanding about which apps are installed on a device or virtual machine and identifies potential compatibility problems. + + - **General app data and app data for Internet Explorer add-ons**. Includes a list of apps that are installed on a native or virtualized instance of the OS and whether these apps function correctly after an upgrade. This app data includes the app name, publisher, version, and basic details about which files have been blocked from usage. + + - **Internet Explorer add-ons**. Includes a list of Internet Explorer add-ons that are installed on a device and whether these apps will work after an upgrade. + + - **System data**. Helps provide an understanding about whether a device meets the minimum requirements to upgrade to the next version of the operating system. System information includes the amount of memory, as well as information about the processor and BIOS. + + - **Accessory device data**. Includes a list of accessory devices, such as printers or external storage devices, that are connected to Windows PCs and whether these devices will function after upgrading to a new version of the operating system. + + - **Driver data**. Includes specific driver usage that’s meant to help figure out whether apps and devices will function after upgrading to a new version of the operating system. This can help to determine blocking issues and then help Microsoft and our partners apply fixes and improvements. + +- **Microsoft Store**. Provides information about how the Microsoft Store performs, including app downloads, installations, and updates. It also includes Microsoft Store launches, page views, suspend and resumes, and obtaining licenses. + + +### Enhanced level + +The Enhanced level gathers data about how Windows and apps are used and how they perform. This level also includes data from both the **Basic** and **Security** levels. This level helps to improve the user experience with the operating system and apps. Data from this level can be abstracted into patterns and trends that can help Microsoft determine future improvements. + +This is the default level for Windows 10 Enterprise and Windows 10 Education editions, and the minimum level needed to quickly identify and address Windows, Windows Server, and System Center quality issues. + +The normal upload range for the Enhanced diagnostic data level is between 239 KB - 348 KB per day, per device. + +The data gathered at this level includes: + +- **Operating system events**. Helps to gain insights into different areas of the operating system, including networking, Hyper-V, Cortana, storage, file system, and other components. + +- **Operating system app events**. A set of events resulting from Microsoft applications and management tools that were downloaded from the Store or pre-installed with Windows or Windows Server, including Server Manager, Photos, Mail, and Microsoft Edge. + +- **Device-specific events**. Contains data about events that are specific to certain devices, such as Surface Hub and Microsoft HoloLens. For example, Microsoft HoloLens sends Holographic Processing Unit (HPU)-related events. + +- **Some crash dump types**. All crash dump types, except for heap dumps and full dumps. + +If the Connected User Experiences and Telemetry component detects a problem on Windows 10 that requires gathering more detailed instrumentation, the Connected User Experiences and Telemetry component at the **Enhanced** diagnostic data level will only gather data about the events associated with the specific issue. + +#### Limit Enhanced diagnostic data to the minimum required by Windows Analytics +Windows Analytics Device Health reports are powered by diagnostic data not included in the **Basic** level, such as crash reports and certain operating system events. In the past, organizations sending **Enhanced** or **Full** level diagnostic data were able to participate in Device Health. However, organizations that required detailed event and field level documentation were unable to move from **Basic** to **Enhanced**. + +In Windows 10, version 1709, we introduce the **Limit Enhanced diagnostic data to the minimum required by Windows Analytics** feature. When enabled, this feature lets you send only the following subset of **Enhanced** level diagnostic data. For more info about Device Health, see the [Monitor the health of devices with Device Health](https://docs.microsoft.com/windows/deployment/update/device-health-monitor) topic. + +- **Operating system events.** Limited to a small set required for analytics reports and documented in the [Windows 10, version 1709 enhanced diagnostic data events and fields used by Windows Analytics](enhanced-diagnostic-data-windows-analytics-events-and-fields.md) topic. + +- **Some crash dump types.** All crash dump types, except for heap and full dumps. + +**To turn on this behavior for devices** + +1. Set the diagnostic data level to **Enhanced**, using either Group Policy or MDM. + + a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data Collection and Preview Builds/Allow telemetry** setting to **2**. + + -OR- + + b. Using MDM, use the Policy CSP to set the **System/AllowTelemetry** value to **2**. + + -AND- + +2. Enable the **LimitEnhancedDiagnosticDataWindowsAnalytics** setting, using either Group Policy or MDM. + + a. Using Group Policy, set the **Computer Configuration/Administrative Templates/Windows Components/Data collection and Preview builds/Limit Enhanced diagnostic data to the minimum required by Windows Analytics** setting to **Enabled**. + + -OR- + + b. Using MDM, use the Policy CSP to set the **System/LimitEnhancedDiagnosticDataWindowsAnalytics** value to **1**. + +### Full level + +The **Full** level gathers data necessary to identify and to help fix problems, following the approval process described below. This level also includes data from the **Basic**, **Enhanced**, and **Security** levels. This is the default level for Windows 10 Pro. + +Additionally, at this level, devices opted in to the [Windows Insider Program](http://insider.windows.com) will send events, such as reliability and app responsiveness. that can show Microsoft how pre-release binaries and features are performing. These events help us make decisions on which builds are flighted. All devices in the [Windows Insider Program](http://insider.windows.com) are automatically set to this level. + +If a device experiences problems that are difficult to identify or repeat using Microsoft’s internal testing, additional data becomes necessary. This data can include any user content that might have triggered the problem and is gathered from a small sample of devices that have both opted into the **Full** diagnostic data level and have exhibited the problem. + +However, before more data is gathered, Microsoft’s privacy governance team, including privacy and other subject matter experts, must approve the diagnostics request made by a Microsoft engineer. If the request is approved, Microsoft engineers can use the following capabilities to get the information: + +- Ability to run a limited, pre-approved list of Microsoft certified diagnostic tools, such as msinfo32.exe, powercfg.exe, and dxdiag.exe. + +- Ability to get registry keys. + +- All crash dump types, including heap dumps and full dumps. + +## Enterprise management + +Sharing diagnostic data with Microsoft provides many benefits to enterprises, so we do not recommend turning it off. For most enterprise customers, simply adjusting the diagnostic data level and managing specific components is the best option. + +Customers can set the diagnostic data level in both the user interface and with existing management tools. Users can change the diagnostic data level in the **Diagnostic data** setting. In the **Settings** app, it is in **Privacy\Feedback & diagnostics**. They can choose between Basic and Full. The Enhanced level will only be displayed as an option when Group Policy or Mobile Device Management (MDM) are invoked with this level. The Security level is not available. + +IT pros can use various methods, including Group Policy and Mobile Device Management (MDM), to choose a diagnostic data level. If you’re using Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016, the Security diagnostic data level is available when managing the policy. Setting the diagnostic data level through policy sets the upper boundary for the users’ choices. To disable user choice after setting the level with the policy, you will need to use the "Configure telemetry opt-in setting user interface" group policy. The remainder of this section describes how to use group policy to configure levels and settings interface. + + +### Manage your diagnostic data settings + +We do not recommend that you turn off diagnostic data in your organization as valuable functionality may be impacted, but we recognize that in some scenarios this may be required. Use the steps in this section to do so for Windows, Windows Server, and System Center. + +> [!IMPORTANT] +> These diagnostic data levels only apply to Windows, Windows Server, and System Center components and apps that use the Connected User Experiences and Telemetry component. Non-Windows components, such as Microsoft Office or other 3rd-party apps, may communicate with their cloud services outside of these diagnostic data levels. You should work with your app vendors to understand their diagnostic data policy, and how you can to opt in or opt out. For more information on how Microsoft Office uses diagnostic data, see [Overview of Office Telemetry](http://technet.microsoft.com/library/jj863580.aspx). + +You can turn on or turn off System Center diagnostic data gathering. The default is on and the data gathered at this level represents what is gathered by default when System Center diagnostic data is turned on. However, setting the operating system diagnostic data level to **Basic** will turn off System Center diagnostic data, even if the System Center diagnostic data switch is turned on. + +The lowest diagnostic data setting level supported through management policies is **Security**. The lowest diagnostic data setting supported through the Settings UI is **Basic**. The default diagnostic data setting for Windows Server 2016 is **Enhanced**. + +### Configure the operating system diagnostic data level + +You can configure your operating system diagnostic data settings using the management tools you’re already using, such as Group Policy, MDM, or Windows Provisioning. You can also manually change your settings using Registry Editor. Setting your diagnostic data levels through a management policy sets the upper level for diagnostic data on the device. + +Use the appropriate value in the table below when you configure the management policy. + +| Level | Data gathered | Value | +| - | - | - | +| Security | Security data only. | **0** | +| Basic | Security data, and basic system and quality data. | **1** | +| Enhanced | Security data, basic system and quality data, and enhanced insights and advanced reliability data. | **2** | +| Full | Security data, basic system and quality data, enhanced insights and advanced reliability data, and full diagnostics data. | **3** | + + > [!NOTE] + > When the User Configuration policy is set for Diagnostic Data, this will override the Computer Configuration setting. + +### Use Group Policy to set the diagnostic data level + +Use a Group Policy object to set your organization’s diagnostic data level. + +1. From the Group Policy Management Console, go to **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Data Collection and Preview Builds**. + +2. Double-click **Allow Telemetry**. + +3. In the **Options** box, select the level that you want to configure, and then click **OK**. + +### Use MDM to set the diagnostic data level + +Use the [Policy Configuration Service Provider (CSP)](http://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) to apply the System/AllowTelemetry MDM policy. + +### Use Registry Editor to set the diagnostic data level + +Use Registry Editor to manually set the registry level on each device in your organization or you can write a script to edit the registry. If a management policy already exists, such as Group Policy or MDM, it will override this registry setting. + +1. Open Registry Editor, and go to **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\Windows\\DataCollection**. + +2. Right-click **DataCollection**, click New, and then click **DWORD (32-bit) Value**. + +3. Type **AllowTelemetry**, and then press ENTER. + +4. Double-click **AllowTelemetry**, set the desired value from the table above, and then click **OK.** + +5. Click **File** > **Export**, and then save the file as a .reg file, such as **C:\\AllowTelemetry.reg**. You can run this file from a script on each device in your organization. + +### Configure System Center 2016 diagnostic data + +For System Center 2016 Technical Preview, you can turn off System Center diagnostic data by following these steps: + +- Turn off diagnostic data by using the System Center UI Console settings workspace. + +- For information about turning off diagnostic data for Service Management Automation and Service Provider Foundation, see [How to disable telemetry for Service Management Automation and Service Provider Foundation](https://support.microsoft.com/kb/3096505). + +### Additional diagnostic data controls + +There are a few more settings that you can turn off that may send diagnostic data information: + +- To turn off Windows Update diagnostic data, you have two choices. Either turn off Windows Update, or set your devices to be managed by an on premises update server, such as [Windows Server Update Services (WSUS)](http://technet.microsoft.com/library/hh852345.aspx) or [System Center Configuration Manager](http://www.microsoft.com/server-cloud/products/system-center-2012-r2-configuration-manager/). + +- Turn off **Windows Defender Cloud-based Protection** and **Automatic sample submission** in **Settings** > **Update & security** > **Windows Defender**. + +- Manage the Malicious Software Removal Tool in your organization. For more info, see Microsoft KB article [891716](http://support.microsoft.com/kb/891716). + +- Turn off **Linguistic Data Collection** in **Settings** > **Privacy**. At diagnostic data levels **Enhanced** and **Full**, Microsoft uses Linguistic Data Collection info to improve language model features such as autocomplete, spellcheck, suggestions, input pattern recognition, and dictionary. + + > [!NOTE] + > Microsoft does not intend to gather sensitive information, such as credit card numbers, usernames and passwords, email addresses, or other similarly sensitive information for Linguistic Data Collection. We guard against such events by using technologies to identify and remove sensitive information before linguistic data is sent from the user's device. If we determine that sensitive information has been inadvertently received, we delete the information. + +## Additional resources + +FAQs + +- [Cortana, Search, and privacy](https://privacy.microsoft.com/windows-10-cortana-and-privacy) +- [Windows 10 feedback, diagnostics, and privacy](https://privacy.microsoft.com/windows-10-feedback-diagnostics-and-privacy) +- [Windows 10 camera and privacy](https://privacy.microsoft.com/windows-10-camera-and-privacy) +- [Windows 10 location service and privacy](https://privacy.microsoft.com/windows-10-location-and-privacy) +- [Microsoft Edge and privacy](https://privacy.microsoft.com/windows-10-microsoft-edge-and-privacy) +- [Windows 10 speech, inking, typing, and privacy](https://privacy.microsoft.com/windows-10-speech-inking-typing-and-privacy-faq) +- [Windows Hello and privacy](https://privacy.microsoft.com/windows-10-windows-hello-and-privacy) +- [Wi-Fi Sense](https://privacy.microsoft.com/windows-10-about-wifi-sense) +- [Windows Update Delivery Optimization](https://privacy.microsoft.com/windows-10-windows-update-delivery-optimization) + +Blogs + +- [Privacy and Windows 10](https://blogs.windows.com/windowsexperience/2015/09/28/privacy-and-windows-10) + +Privacy Statement + +- [Microsoft Privacy Statement](https://privacy.microsoft.com/privacystatement) + +TechNet + +- [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md) + +Web Pages + +- [Privacy at Microsoft](http://privacy.microsoft.com) + + diff --git a/windows/security/TOC.md b/windows/security/TOC.md index ad302db477..6ac5b43506 100644 --- a/windows/security/TOC.md +++ b/windows/security/TOC.md @@ -1,7 +1,6 @@ # [Security](index.yml) ## [Identity and access management](identity-protection/index.md) ## [Information protection](information-protection/index.md) -## [Hardware-based protection](hardware-protection/index.md) ## [Threat protection](threat-protection/index.md) diff --git a/windows/security/hardware-protection/TOC.md b/windows/security/hardware-protection/TOC.md deleted file mode 100644 index 3dac21b0fa..0000000000 --- a/windows/security/hardware-protection/TOC.md +++ /dev/null @@ -1,21 +0,0 @@ -# [Hardware-based protection](index.md) - -## [Encrypted Hard Drive](encrypted-hard-drive.md) - -## [Windows Defender System Guard](how-hardware-based-containers-help-protect-windows.md) - -## [Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md) - -## [Trusted Platform Module](tpm/trusted-platform-module-top-node.md) -### [Trusted Platform Module Overview](tpm/trusted-platform-module-overview.md) -### [TPM fundamentals](tpm/tpm-fundamentals.md) -### [How Windows 10 uses the TPM](tpm/how-windows-uses-the-tpm.md) -### [TPM Group Policy settings](tpm/trusted-platform-module-services-group-policy-settings.md) -### [Back up the TPM recovery information to AD DS](tpm/backup-tpm-recovery-information-to-ad-ds.md) -### [Manage TPM commands](tpm/manage-tpm-commands.md) -### [Manage TPM lockout](tpm/manage-tpm-lockout.md) -### [Change the TPM owner password](tpm/change-the-tpm-owner-password.md) -### [View status, clear, or troubleshoot the TPM](tpm/initialize-and-configure-ownership-of-the-tpm.md) -### [Understanding PCR banks on TPM 2.0 devices](tpm/switch-pcr-banks-on-tpm-2-0-devices.md) -### [TPM recommendations](tpm/tpm-recommendations.md) - diff --git a/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows.md b/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows.md deleted file mode 100644 index c26efe3d4f..0000000000 --- a/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows.md +++ /dev/null @@ -1,51 +0,0 @@ ---- -title: How hardware-based containers help protect Windows 10 (Windows 10) -description: Windows 10 uses containers to isolate sensitive system services and data, enabling them to remain secure even when the operating system has been compromised. -ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -author: justinha -ms.date: 06/29/2017 ---- - -# How hardware-based containers help protect Windows 10 - -Windows 10 uses containers to isolate sensitive system services and data, enabling them to remain secure even when the operating system has been compromised. -Windows 10 protects critical resources, such as the Windows authentication stack, single sign-on tokens, Windows Hello biometric stack, and Virtual Trusted Platform Module, by using a container type called Windows Defender System Guard. - -Windows Defender System Guard reorganizes the existing Windows 10 system integrity features under one roof and sets up the next set of investments in Windows security. It's designed to make the these security guarantees: - -- Protect and maintain the integrity of the system as it starts up -- Protect and maintain the integrity of the system after it's running -- Validate that system integrity has truly been maintained through local and remote attestation - -## Maintaining the integrity of the system as it starts - -With Windows 7, one of the means attackers would use to persist and evade detection was to install what is often referred to as a bootkit or rootkit on the system. This malicious software would start before Windows started, or during the boot process itself, enabling it to start with the highest level of privilege. - -With Windows 10 running on modern hardware (that is, Windows 8-certified or greater) we have a hardware-based root of trust that helps us ensure that no unauthorized firmware or software (such as a bootkit) can start before the Windows bootloader. This hardware-based root of trust comes from the device’s [Secure Boot feature](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-8.1-and-8/hh824987), which is part of the Unified Extensible Firmware Interface (UEFI). - -After successful verification and startup of the device’s firmware and Windows bootloader, the next opportunity for attackers to tamper with the system’s integrity is while the rest of the Windows operating system and defenses are starting. As an attacker, embedding your malicious code using a rootkit within the boot process enables you to gain the maximum level of privilege and gives you the ability to more easily persist and evade detection. - -This is where Windows Defender System Guard protection begins with its ability to ensure that only properly signed and secure Windows files and drivers, including third party, can start on the device. At the end of the Windows boot process, System Guard will start the system’s antimalware solution, which scans all third party drivers, at which point the system boot process is completed. In the end, Windows Defender System Guard helps ensure that the system securely boots with integrity and that it hasn’t been compromised before the remainder of your system defenses start. - -![Boot time integrity](images/windows-defender-system-guard-boot-time-integrity.png) - -## Maintaining integrity of the system after it’s running (run time) - -Prior to Windows 10, if an attacker exploited the system and gained SYSTEM level privilege or they compromised the kernel itself, it was game over. The level of control that an attacker would acquire in this condition would enable them to tamper with and bypass many, if not all, of your system defenses. While we have a number of development practices and technologies (such as Windows Defender Exploit Guard) that have made it difficult to gain this level of privilege in Windows 10, the reality is that we needed a way to maintain the integrity of the most sensitive Windows services and data, even when the highest level of privilege has been secured by an adversary. - -With Windows 10, we introduced the concept of virtualization-based security (VBS), which enables us to contain the most sensitive Windows services and data in hardware-based isolation, which is the Windows Defender System Guard container. This secure environment provides us with the hardware-based security boundary we need to be able to secure and maintain the integrity of critical system services at run time like Credential Guard, Device Guard, Virtual TPM and parts of Windows Defender Exploit Guard, just to name a few. - -![Windows Defender System Guard](images/windows-defender-system-guard.png) - -## Validating platform integrity after Windows is running (run time) - -While Windows Defender System Guard provides advanced protection that will help protect and maintain the integrity of the platform during boot and at run time, the reality is that we must apply an "assume breach" mentality to even our most sophisticated security technologies. We should be able to trust that the technologies are successfully doing their jobs, but we also need the ability to verify that they were successful in achieving their goals. When it comes to platform integrity, we can’t just trust the platform, which potentially could be compromised, to self-attest to its security state. So Windows Defender System Guard includes a series of technologies that enable remote analysis of the device’s integrity. - -As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device’s Trusted Platform Module 2.0 (TPM 2.0). This process and data are hardware-isolated away from Windows to help ensure that the measurement data is not subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device’s firmware, hardware configuration state, and Windows boot-related components, just to name a few. After the system boots, Windows Defender System Guard signs and seals these measurements using the TPM. Upon request, a management system like Intune or System Center Configuration Manager can acquire them for remote analysis. If Windows Defender System Guard indicates that the device lacks integrity, the management system can take a series of actions, such as denying the device access to resources. - -![Windows Defender System Guard](images/windows-defender-system-guard-validate-system-integrity.png) - diff --git a/windows/security/hardware-protection/images/application-guard-and-system-guard.png b/windows/security/hardware-protection/images/application-guard-and-system-guard.png deleted file mode 100644 index b4b883db90..0000000000 Binary files a/windows/security/hardware-protection/images/application-guard-and-system-guard.png and /dev/null differ diff --git a/windows/security/hardware-protection/images/traditional-windows-software-stack.png b/windows/security/hardware-protection/images/traditional-windows-software-stack.png deleted file mode 100644 index 0da610c368..0000000000 Binary files a/windows/security/hardware-protection/images/traditional-windows-software-stack.png and /dev/null differ diff --git a/windows/security/hardware-protection/images/windows-defender-system-guard.png b/windows/security/hardware-protection/images/windows-defender-system-guard.png deleted file mode 100644 index 865af86b19..0000000000 Binary files a/windows/security/hardware-protection/images/windows-defender-system-guard.png and /dev/null differ diff --git a/windows/security/hardware-protection/index.md b/windows/security/hardware-protection/index.md deleted file mode 100644 index 454b0ec4e1..0000000000 --- a/windows/security/hardware-protection/index.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -title: Hardware-based Protection (Windows 10) -description: Learn more about how to help protect against threats in Windows 10 and Windows 10 Mobile. -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -author: brianlic-msft -ms.date: 02/05/2018 ---- - -# Hardware-based protection - -Windows 10 leverages these hardware-based security features to protect and maintain system integrity. - -| Section | Description | -|-|-| -| [Encrypted Hard Drive](encrypted-hard-drive.md) | Provides information about Encrypted Hard Drive, which uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management.| -|[How hardware-based containers help protect Windows 10](how-hardware-based-containers-help-protect-windows.md) |Learn about how hardware-based containers can isolate sensitive system services and data, enabling them to remain secure even when the operating system has been compromised.| -|[Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md) |Learn about the Windows 10 security features that help to protect your PC from malware, including rootkits and other applications.| -| [Trusted Platform Module](tpm/trusted-platform-module-top-node.md)| Provides links to information about the Trusted Platform Module (TPM), which is a secure crypto-processor that helps you with actions such as generating, storing, and limiting the use of cryptographic keys. | diff --git a/windows/security/identity-protection/TOC.md b/windows/security/identity-protection/TOC.md index 7fde2f9d2f..91f27e52b9 100644 --- a/windows/security/identity-protection/TOC.md +++ b/windows/security/identity-protection/TOC.md @@ -17,7 +17,7 @@ ## [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) -## [How hardware-based containers help protect Windows 10](how-hardware-based-containers-help-protect-windows.md) +## [Windows Defender System Guard](how-hardware-based-containers-help-protect-windows.md) ## [Protect derived domain credentials with Credential Guard](credential-guard/credential-guard.md) ### [How Credential Guard works](credential-guard/credential-guard-how-it-works.md) @@ -28,7 +28,6 @@ ### [Credential Guard: Additional mitigations](credential-guard/additional-mitigations.md) ### [Credential Guard: Known issues](credential-guard/credential-guard-known-issues.md) - ## [Protect Remote Desktop credentials with Remote Credential Guard](remote-credential-guard.md) ## [Smart Cards](smart-cards/smart-card-windows-smart-card-technical-reference.md) diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index cdfbc8c21a..2cc7a62ad3 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -5,7 +5,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.date: 04/19/2017 +ms.date: 07/30/2018 --- # Local Accounts @@ -114,11 +114,11 @@ Even when the Administrator account has been disabled, it can still be used to g ### Guest account -The Guest account (SID S-1-5-32-546) is disabled by default on installation. The Guest account lets occasional or one-time users, who do not have an account on the computer, temporarily sign in to the local server or client computer with limited user rights. By default, the Guest account has a blank password. Because the Guest account can provide anonymous access, it is a security risk. For this reason, it is a best practice to leave the Guest account disabled, unless its use is entirely necessary. +The Guest account is disabled by default on installation. The Guest account lets occasional or one-time users, who do not have an account on the computer, temporarily sign in to the local server or client computer with limited user rights. By default, the Guest account has a blank password. Because the Guest account can provide anonymous access, it is a security risk. For this reason, it is a best practice to leave the Guest account disabled, unless its use is entirely necessary. **Account group membership** -By default, the Guest account is the only member of the default Guests group, which lets a user sign in to a server. On occasion, an administrator who is a member of the Administrators group can set up a user with a Guest account on one or more computers. +By default, the Guest account is the only member of the default Guests group (SID S-1-5-32-546), which lets a user sign in to a server. On occasion, an administrator who is a member of the Administrators group can set up a user with a Guest account on one or more computers. **Security considerations** diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index f1093f35c9..59977cb224 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -23,16 +23,16 @@ Hybrid environments are distributed systems that enable organizations to use on- The distributed systems on which these technologies were built involved several pieces of on-premises and cloud infrastructure. High-level pieces of the infrastructure include: * [Directories](#directories) -* [Public Key Infrastucture](#public-key-infastructure) +* [Public Key Infrastructure](#public-key-infrastructure) * [Directory Synchronization](#directory-synchronization) * [Federation](#federation) * [MultiFactor Authetication](#multifactor-authentication) * [Device Registration](#device-registration) ## Directories ## -Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. The +Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. -A hybrid Windows Hello for Busines deployment needs an Azure Active Directory subscription. The hybrid key trust deployment, does not need a premium Azure Active Directory subscription. +A hybrid Windows Hello for Business deployment needs an Azure Active Directory subscription. The hybrid key trust deployment, does not need a premium Azure Active Directory subscription. You can deploy Windows Hello for Business in any environment with Windows Server 2008 R2 or later domain controllers. However, the key trust deployment needs an ***adequate*** number of Windows Server 2016 domain controllers at each site where users authenticate using Windows Hello for Business. Read the [Planning an adequate number of Windows Server 2016 Domain Controllers for Windows Hello for Business deployments](hello-adequate-domain-controllers.md) to learn more. @@ -52,13 +52,13 @@ Review these requirements and those from the Windows Hello for Business planning ## Public Key Infrastructure ## The Windows Hello for Business deployment depends on an enterprise public key infrastructure as trust anchor for authentication. Domain controllers for hybrid deployments need a certificate in order for Windows 10 devices to trust the domain controller. -Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Diretory object. +Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object. The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012. > [!IMPORTANT] > For Azure AD joined device to authenticate to and use on-premises resources, ensure you: -> * Install the root certificate authority certificate for your organization in the user's trusted root certifcate store. +> * Install the root certificate authority certificate for your organization in the user's trusted root certificate store. > * Publish your certificate revocation list to a location that is available to Azure AD joined devices, such as a web-based url. ### Section Review @@ -99,12 +99,12 @@ Hybrid Windows Hello for Business deployments can use Azure’s Multifactor Auth > [!div class="checklist"] > * Azure MFA Service > * Windows Server 2016 AD FS and Azure (optional, if federated) -> * Windows Server 2016 AD FS and third party MFA Adapter (optional, if federated) +> * Windows Server 2016 AD FS and third-party MFA Adapter (optional, if federated)
    ## Device Registration ## -Organizations wanting to deploy hybrid key trust need thier domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory. +Organizations wanting to deploy hybrid key trust need their domain joined devices to register to Azure Active Directory. Just as a computer has an identity in Active Directory, that same computer has an identity in the cloud. This ensures that only approved computers are used with that Azure Active Directory. Each computer registers its identity in Azure Active Directory. ### Section Checklist ### @@ -114,11 +114,11 @@ Organizations wanting to deploy hybrid key trust need thier domain joined device
    ### Next Steps ### -Follow the Windows Hello for Business hybrid key trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Basline**. +Follow the Windows Hello for Business hybrid key trust deployment guide. For proof-of-concepts, labs, and new installations, choose the **New Installation Baseline**. -For environments transitioning from on-premises to hybrid, start with **Configure Azure Directory Syncrhonization**. +For environments transitioning from on-premises to hybrid, start with **Configure Azure Directory Synchronization**. -For federerated and non-federated environments, start with **Configure Windows Hello for Business settings**. +For federated and non-federated environments, start with **Configure Windows Hello for Business settings**. > [!div class="op_single_selector"] > - [New Installation Baseline](hello-hybrid-key-new-install.md) @@ -131,7 +131,7 @@ For federerated and non-federated environments, start with **Configure Windows H ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-key-trust.md) -2. Prerequistes (*You are here*) +2. Prerequisites (*You are here*) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md index c4889c081a..ce0710525a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md @@ -45,11 +45,11 @@ The provisioning flow has all the information it needs to complete the Windows H * A fresh, successful multi-factor authentication * A validated PIN that meets the PIN complexity requirements -The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Azure Active Directory to register the public key. When key registration completes, Windows Hello for Business provisioning informs the user they can use their PIN to sign-in. The user may close the provisiong application and see their desktop. While the user has completed provisioning, Azure AD Connect syncrhonizes the user's key to Active Directory. +The remainder of the provisioning includes Windows Hello for Business requesting an asymmetric key pair for the user, preferably from the TPM (or required if explicitly set through policy). Once the key pair is acquired, Windows communicates with Azure Active Directory to register the public key. When key registration completes, Windows Hello for Business provisioning informs the user they can use their PIN to sign-in. The user may close the provisioning application and see their desktop. While the user has completed provisioning, Azure AD Connect synchronizes the user's key to Active Directory. > [!IMPORTANT] -> The minimum time needed to syncrhonize the user's public key from Azure Active Directory to the on-premises Active Directory is 30 minutes. The Azure AD Connect scheduler controls the synchronization interval. -> **This synchronization latency delays the user's ability to authenticate and use on-premises resouces until the user's public key has synchronized to Active Directory.** Once synchronized, the user can authenticate and use on-premises resources. +> The minimum time needed to synchronize the user's public key from Azure Active Directory to the on-premises Active Directory is 30 minutes. The Azure AD Connect scheduler controls the synchronization interval. +> **This synchronization latency delays the user's ability to authenticate and use on-premises resources until the user's public key has synchronized to Active Directory.** Once synchronized, the user can authenticate and use on-premises resources. > Read [Azure AD Connect sync: Scheduler](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-feature-scheduler) to view and adjust the **synchronization cycle** for your organization. > [!NOTE] diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md index be72d0be4e..8b9848f45c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-ad.md @@ -18,7 +18,7 @@ ms.date: 10/23/2017 >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. -Configure the appropriate security groups to effeiciently deploy Windows Hello for Business to users. +Configure the appropriate security groups to efficiently deploy Windows Hello for Business to users. ### Creating Security Groups @@ -58,4 +58,4 @@ Sign-in a domain controller or management workstation with *Domain Admin* equiva 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) 6. Configure Windows Hello for Business settings: Active Directory (*You are here*) -7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md index c52c1c6950..7fa866d652 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-pki.md @@ -19,13 +19,13 @@ ms.date: 10/23/2017 >This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher. -Windows Hello for Business deployments rely on certificates. Hybrid deployments uses publicly issued server authentication certifcates to validate the name of the server to which they are connecting and to encyrpt the data that flows them and the client computer. +Windows Hello for Business deployments rely on certificates. Hybrid deployments uses publicly issued server authentication certificates to validate the name of the server to which they are connecting and to encrypt the data that flows them and the client computer. All deployments use enterprise issued certificates for domain controllers as a root of trust. -## Certifcate Templates +## Certificate Templates -This section has you configure certificate templates on your Windows Server 2012 or later issuing certificate authtority. +This section has you configure certificate templates on your Windows Server 2012 or later issuing certificate authority. ### Domain Controller certificate template @@ -49,7 +49,7 @@ Sign-in a certificate authority or management workstations with _Domain Admin_ e 7. On the **Cryptography** tab, select **Key Storage Provider** from the **Provider Category** list. Select **RSA** from the **Algorithm name** list. Type **2048** in the **Minimum key size** text box. Select **SHA256** from the **Request hash** list. Click **OK**. 8. Close the console. -#### Configure Certificate Suspeding for the Domain Controller Authentication (Kerberos) Certificate Template +#### Configure Certificate Superseding for the Domain Controller Authentication (Kerberos) Certificate Template Many domain controllers may have an existing domain controller certificate. The Active Directory Certificate Services provides a default certificate template for domain controllers--the domain controller certificate template. Later releases provided a new certificate template--the domain controller authentication certificate template. These certificate templates were provided prior to update of the Kerberos specification that stated Key Distribution Centers (KDCs) performing certificate authentication needed to include the **KDC Authentication** extension. @@ -108,7 +108,7 @@ Sign-in to the certificate authority or management workstation with _Enterprise ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md index 65a1b8fd53..4ddb7eed9d 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings-policy.md @@ -67,7 +67,7 @@ The Windows Hello for Business Group Policy object delivers the correct Group Po #### Enable Windows Hello for Business -The Enable Windows Hello for Business Group Policy setting is the configuration needed for Windows to determine if a user should be attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to enabled. +The Enable Windows Hello for Business Group Policy setting is the configuration needed for Windows to determine if a user should attempt to enroll for Windows Hello for Business. A user will only attempt enrollment if this policy setting is configured to enabled. You can configure the Enable Windows Hello for Business Group Policy setting for computer or users. Deploying this policy setting to computers results in ALL users that sign-in that computer to attempt a Windows Hello for Business enrollment. Deploying this policy setting to a user results in only that user attempting a Windows Hello for Business enrollment. Additionally, you can deploy the policy setting to a group of users so only those users attempt a Windows Hello for Business enrollment. If both user and computer policy settings are deployed, the user policy setting has precedence. @@ -163,7 +163,7 @@ Users must receive the Windows Hello for Business group policy settings and have ## Follow the Windows Hello for Business hybrid key trust deployment guide 1. [Overview](hello-hybrid-cert-trust.md) -2. [Prerequistes](hello-hybrid-key-trust-prereqs.md) +2. [Prerequisites](hello-hybrid-key-trust-prereqs.md) 3. [New Installation Baseline](hello-hybrid-key-new-install.md) 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md index 98ea8551bf..05697bb83f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-settings.md @@ -21,7 +21,7 @@ ms.date: 10/23/2017 You are ready to configure your hybrid key trust environment for Windows Hello for Business. > [!IMPORTANT] -> Ensure your environment meets all the [prerequistes](hello-hybrid-key-trust-prereqs.md) before proceeding. Review the [New Installation baseline](hello-hybrid-key-new-install.md) section of this deployment document to learn how to prepare your environment for your Windows Hello for Business deployment. +> Ensure your environment meets all the [prerequisites](hello-hybrid-key-trust-prereqs.md) before proceeding. Review the [New Installation baseline](hello-hybrid-key-new-install.md) section of this deployment document to learn how to prepare your environment for your Windows Hello for Business deployment. The configuration for Windows Hello for Business is grouped in four categories. These categories are: * [Active Directory](hello-hybrid-key-whfb-settings-ad.md) @@ -45,4 +45,4 @@ For the most efficent deployment, configure these technologies in order beginnin 4. [Configure Directory Synchronization](hello-hybrid-key-trust-dirsync.md) 5. [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) 6. Configure Windows Hello for Business settings (*You are here*) -7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) \ No newline at end of file +7. [Sign-in and Provision](hello-hybrid-key-whfb-provision.md) diff --git a/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows.md b/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows.md index 8b6124f000..04430822f3 100644 --- a/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows.md +++ b/windows/security/identity-protection/how-hardware-based-containers-help-protect-windows.md @@ -7,54 +7,46 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: justinha -ms.date: 06/29/2017 +ms.date: 08/01/2018 --- -# How hardware-based containers help protect Windows 10 + +# Windows Defender System Guard: How hardware-based containers help protect Windows 10 Windows 10 uses containers to isolate sensitive system services and data, enabling them to remain secure even when the operating system has been compromised. Windows 10 protects critical resources, such as the Windows authentication stack, single sign-on tokens, Windows Hello biometric stack, and Virtual Trusted Platform Module, by using a container type called Windows Defender System Guard. -Protecting system services and data with Windows Defender System Guard is an important first step, but is just the beginning of what we need to do as it doesn’t protect the rest of the operating system, information on the device, other apps, or the network. -Since systems are generally compromised through the application layer, and often though browsers, Windows 10 includes Windows Defender Application Guard to isolate Microsoft Edge from the operating system, information on the device, and the network. -With this, Windows can start to protect the broader range of resources. +Windows Defender System Guard reorganizes the existing Windows 10 system integrity features under one roof and sets up the next set of investments in Windows security. It's designed to make the these security guarantees: -The following diagram shows Windows Defender System Guard and Windows Defender Application Guard in relation to the Windows 10 operating system. +- Protect and maintain the integrity of the system as it starts up +- Protect and maintain the integrity of the system after it's running +- Validate that system integrity has truly been maintained through local and remote attestation -![Application Guard and System Guard](images/application-guard-and-system-guard.png) +## Maintaining the integrity of the system as it starts -## What security threats do containers protect against +With Windows 7, one of the means attackers would use to persist and evade detection was to install what is often referred to as a bootkit or rootkit on the system. This malicious software would start before Windows started, or during the boot process itself, enabling it to start with the highest level of privilege. -Exploiting zero days and vulnerabilities are an increasing threat that attackers are attempting to take advantage of. -The following diagram shows the traditional Windows software stack: a kernel with an app platform, and an app running on top of it. -Let’s look at how an attacker might elevate privileges and move down the stack. +With Windows 10 running on modern hardware (that is, Windows 8-certified or greater) we have a hardware-based root of trust that helps us ensure that no unauthorized firmware or software (such as a bootkit) can start before the Windows bootloader. This hardware-based root of trust comes from the device’s Secure Boot feature, which is part of the Unified Extensible Firmware Interface (UEFI). -![Traditional Windows software stack](images/traditional-windows-software-stack.png) +After successful verification and startup of the device’s firmware and Windows bootloader, the next opportunity for attackers to tamper with the system’s integrity is while the rest of the Windows operating system and defenses are starting. As an attacker, embedding your malicious code using a rootkit within the boot process enables you to gain the maximum level of privilege and gives you the ability to more easily persist and evade detection. -In desktop operating systems, those apps typically run under the context of the user’s privileges. -If the app was malicious, it would have access to all the files in the file system, all the settings that you as a user Standard user have access to, and so on. +This is where Windows Defender System Guard protection begins with its ability to ensure that only properly signed and secure Windows files and drivers, including third party, can start on the device. At the end of the Windows boot process, System Guard will start the system’s antimalware solution, which scans all third party drivers, at which point the system boot process is completed. In the end, Windows Defender System Guard helps ensure that the system securely boots with integrity and that it hasn’t been compromised before the remainder of your system defenses start. -A different type of app may run under the context of an Administrator. -If attackers exploit a vulnerability in that app, they could gain Administrator privileges. -Then they can start turning off defenses. +![Boot time integrity](images/windows-defender-system-guard-boot-time-integrity.png) -They can poke down a little bit lower in the stack and maybe elevate to System, which is greater than Administrator. -Or if they can exploit the kernel mode, they can turn on and turn off all defenses, while at the same time making the computer look healthy. -SecOps tools could report the computer as healthy when in fact it’s completely under the control of someone else. +## Maintaining integrity of the system after it’s running (run time) -One way to address this threat is to use a sandbox, as smartphones do. -That puts a layer between the app layer and the Windows platform services. -Universal Windows Platform (UWP) applications work this way. -But what if a vulnerability in the sandbox exists? -The attacker can escape and take control of the system. +Prior to Windows 10, if an attacker exploited the system and gained SYSTEM level privilege or they compromised the kernel itself, it was game over. The level of control that an attacker would acquire in this condition would enable them to tamper with and bypass many, if not all, of your system defenses. While we have a number of development practices and technologies (such as Windows Defender Exploit Guard) that have made it difficult to gain this level of privilege in Windows 10, the reality is that we needed a way to maintain the integrity of the most sensitive Windows services and data, even when the highest level of privilege has been secured by an adversary. -## How containers help protect Windows 10 +With Windows 10, we introduced the concept of virtualization-based security (VBS), which enables us to contain the most sensitive Windows services and data in hardware-based isolation, which is the Windows Defender System Guard container. This secure environment provides us with the hardware-based security boundary we need to be able to secure and maintain the integrity of critical system services at run time like Credential Guard, Device Guard, Virtual TPM and parts of Windows Defender Exploit Guard, just to name a few. -Windows 10 addresses this by using virtualization based security to isolate more and more components out of Windows (left side) over time and moving those components into a separate, isolated hardware container. -The container helps prevent zero days and vulnerabilities from allowing an attacker to take control of a device. +![Windows Defender System Guard](images/windows-defender-system-guard.png) -Anything that's running in that container on the right side will be safe, even from Windows, even if the kernel's compromised. -Anything that's running in that container will also be secure against a compromised app. -Initially, Windows Defender System Guard will protect things like authentication and other system services and data that needs to resist malware, and more things will be protected over time. +## Validating platform integrity after Windows is running (run time) -![Windows Defender System Guard](images/windows-defender-system-guard.png) +While Windows Defender System Guard provides advanced protection that will help protect and maintain the integrity of the platform during boot and at run time, the reality is that we must apply an "assume breach" mentality to even our most sophisticated security technologies. We should be able to trust that the technologies are successfully doing their jobs, but we also need the ability to verify that they were successful in achieving their goals. When it comes to platform integrity, we can’t just trust the platform, which potentially could be compromised, to self-attest to its security state. So Windows Defender System Guard includes a series of technologies that enable remote analysis of the device’s integrity. + +As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device’s Trusted Platform Module 2.0 (TPM 2.0). This process and data are hardware-isolated away from Windows to help ensure that the measurement data is not subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device’s firmware, hardware configuration state, and Windows boot-related components, just to name a few. After the system boots, Windows Defender System Guard signs and seals these measurements using the TPM. Upon request, a management system like Intune or System Center Configuration Manager can acquire them for remote analysis. If Windows Defender System Guard indicates that the device lacks integrity, the management system can take a series of actions, such as denying the device access to resources. + + +![Windows Defender System Guard](images/windows-defender-system-guard-validate-system-integrity.png) \ No newline at end of file diff --git a/windows/security/hardware-protection/images/windows-defender-system-guard-boot-time-integrity.png b/windows/security/identity-protection/images/windows-defender-system-guard-boot-time-integrity.png similarity index 100% rename from windows/security/hardware-protection/images/windows-defender-system-guard-boot-time-integrity.png rename to windows/security/identity-protection/images/windows-defender-system-guard-boot-time-integrity.png diff --git a/windows/security/hardware-protection/images/windows-defender-system-guard-validate-system-integrity.png b/windows/security/identity-protection/images/windows-defender-system-guard-validate-system-integrity.png similarity index 100% rename from windows/security/hardware-protection/images/windows-defender-system-guard-validate-system-integrity.png rename to windows/security/identity-protection/images/windows-defender-system-guard-validate-system-integrity.png diff --git a/windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md b/windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md index 4aeab49c4b..840bf5b9b7 100644 --- a/windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md +++ b/windows/security/identity-protection/windows-firewall/configure-the-workstation-authentication-certificate-template.md @@ -6,8 +6,8 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -author: brianlic-msft -ms.date: 04/19/2017 +author: Justinha +ms.date: 07/30/2018 --- # Configure the Workstation Authentication Certificate Template @@ -36,7 +36,7 @@ To complete these procedures, you must be a member of both the Domain Admins gro 6. Click the **Subject Name** tab. Make sure that **Build from this Active Directory information** is selected. In **Subject name format**, select **Fully distinguished name**. -7. Click the **Request Handling** tab. You must determine the best minimum key size for your environment. Large key sizes provide better security, but they can affect server performance. We recommended that you use the default setting of 2048. +7. Click the **Cryptography** tab. You must determine the best minimum key size for your environment. Large key sizes provide better security, but they can affect server performance. We recommended that you use the default setting of 2048. 8. Click the **Security** tab. In **Group or user names**, click **Domain Computers**, under **Allow**, select **Enroll** and **Autoenroll**, and then click **OK**. diff --git a/windows/security/index.yml b/windows/security/index.yml index 05c303413e..019ee50e72 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -85,10 +85,10 @@ sections: Prevent, detect, investigate, and respond to advanced threats. The following capabilities are available across multiple products that make up the Windows Defender ATP platform.
     
    - - - - + + + +
    Attack surface reductionNext generation protectionEndpoint detection and responseAuto investigation and remediationSecurity posture
    [Hardware based isolation](https://docs.microsoft.com/en-us/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows)

    [Application control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)

    [Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard)

    [Network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard)

    [Device restrictions](https://docs.microsoft.com/en-us/intune/device-restrictions-configure)

    [Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard)

    [Network firewall](https://docs.microsoft.com/en-us/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security)

    [Attack surface reduction controls](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)    		[Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)

    [Machine learning](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus)

    [Automated sandbox service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus)    		[Alerts queue](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection)

    [Historical endpoint data](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection#machine-timeline)

    [Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)

    [API and SIEM integration](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)

    [Response orchestration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection)

    [Forensic collection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection#collect-investigation-package-from-machines)

    [Threat intelligence](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection)

    [Advanced detonation and analysis service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection#deep-analysis)    		[Automated investigation and remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)

    [Threat remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#how-threats-are-remediated)

    [Manage automated investigations](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#manage-automated-investigations)

    [Analyze automated investigation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#analyze-automated-investigations)
    [Hardware based isolation](https://docs.microsoft.com/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows)

    [Application control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)

    [Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard)

    [Network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard)

    [Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard)

    [Network firewall](https://docs.microsoft.com/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security)

    [Attack surface reduction controls](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)    		[Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)

    [Machine learning](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus)

    [Automated sandbox service](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus)    		[Alerts queue](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection)

    [Historical endpoint data](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection#machine-timeline)

    [Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)

    [API and SIEM integration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)

    [Response orchestration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection)

    [Forensic collection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection#collect-investigation-package-from-machines)

    [Threat intelligence](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection)

    [Advanced detonation and analysis service](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection#deep-analysis)    		[Automated investigation and remediation](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)

    [Threat remediation](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#how-threats-are-remediated)

    [Manage automated investigations](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#manage-automated-investigations)

    [Analyze automated investigation](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#analyze-automated-investigations)    		 [Asset inventory](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

    [Operating system baseline compliance](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

    [Recommended improvement actions](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

    [Secure score](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection)

    [Threat analytics](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection)

    [Reporting and trends](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection)
    " \ No newline at end of file diff --git a/windows/security/information-protection/TOC.md b/windows/security/information-protection/TOC.md index 636404ef31..b9c98da745 100644 --- a/windows/security/information-protection/TOC.md +++ b/windows/security/information-protection/TOC.md @@ -28,6 +28,7 @@ #### [Choose the Right BitLocker Countermeasure](bitlocker\choose-the-right-bitlocker-countermeasure.md) ### [Protecting cluster shared volumes and storage area networks with BitLocker](bitlocker\protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md) +## [Encrypted Hard Drive](encrypted-hard-drive.md) ## [Protect your enterprise data using Windows Information Protection (WIP)](windows-information-protection\protect-enterprise-data-using-wip.md) ### [Create a Windows Information Protection (WIP) policy using Microsoft Intune](windows-information-protection\overview-create-wip-policy.md) @@ -53,3 +54,20 @@ #### [Using Outlook Web Access with Windows Information Protection (WIP)](windows-information-protection\using-owa-with-wip.md) ### [Fine-tune Windows Information Protection (WIP) with WIP Learning](windows-information-protection\wip-learning.md) +## [Secure the Windows 10 boot process](secure-the-windows-10-boot-process.md) + +## [Trusted Platform Module](tpm/trusted-platform-module-top-node.md) +### [Trusted Platform Module Overview](tpm/trusted-platform-module-overview.md) +### [TPM fundamentals](tpm/tpm-fundamentals.md) +### [How Windows 10 uses the TPM](tpm/how-windows-uses-the-tpm.md) +### [TPM Group Policy settings](tpm/trusted-platform-module-services-group-policy-settings.md) +### [Back up the TPM recovery information to AD DS](tpm/backup-tpm-recovery-information-to-ad-ds.md) +### [Manage TPM commands](tpm/manage-tpm-commands.md) +### [Manage TPM lockout](tpm/manage-tpm-lockout.md) +### [Change the TPM owner password](tpm/change-the-tpm-owner-password.md) +### [View status, clear, or troubleshoot the TPM](tpm/initialize-and-configure-ownership-of-the-tpm.md) +### [Understanding PCR banks on TPM 2.0 devices](tpm/switch-pcr-banks-on-tpm-2-0-devices.md) +### [TPM recommendations](tpm/tpm-recommendations.md) + + + diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index 0b99703f80..4643595543 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -351,6 +351,7 @@ The following steps can be used to configure Network Unlock on these older syste 6. [Step Six: Configure registry settings for Network Unlock](#bkmk-stepsix) Apply the registry settings by running the following certutil script on each computer running any of the client operating systems designated in the **Applies To** list at the beginning of this topic. + certutil -f -grouppolicy -addstore FVE_NKP BitLocker-NetworkUnlock.cer reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v OSManageNKP /t REG_DWORD /d 1 /f reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f diff --git a/windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys.md b/windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys.md index d7abb90fbd..d96b30a8c5 100644 --- a/windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys.md +++ b/windows/security/information-protection/bitlocker/types-of-attacks-for-volume-encryption-keys.md @@ -85,13 +85,13 @@ DMA-based expansion slots are another avenue of attack, but these slots generall To mitigate a port-based DMA attack an administrator can configure policy settings to disable FireWire and other device types that have DMA. Also, many PCs allow those devices to be disabled by using firmware settings. Although the need for pre-boot authentication can be eliminated at the device level or through Windows configuration, the BitLocker pre-boot authentication feature is still available when needed. When used, it successfully mitigates all types of DMA port and expansion slot attacks on any type of device. -### Hyberfil.sys Attacks +### Hiberfil.sys Attacks -The hyberfil.sys file is the Windows hibernation file. It contains a snapshot of system memory that is generated when a device goes into hibernation and includes the encryption key for BitLocker and other encryption technologies. Attackers have claimed that they have successfully extracted encryption keys from the hyberfil.sys file. +The hiberfil.sys file is the Windows hibernation file. It contains a snapshot of system memory that is generated when a device goes into hibernation and includes the encryption key for BitLocker and other encryption technologies. Attackers have claimed that they have successfully extracted encryption keys from the hiberfil.sys file. -Like the DMA port attack discussed in the previous section, tools are available that can scan the hyberfile.sys file and locate the encryption key, including a tool made by [Passware](http://www.lostpassword.com/). Microsoft does not consider Windows to be vulnerable to this type of attack, because Windows stores the hyberfil.sys file within the encrypted system volume. As a result, the file would be accessible only if the attacker had both physical and sign-in access to the PC. When an attacker has sign-in access to the PC, there are few reasons for the attacker to decrypt the drive, because they would already have full access to the data within it. +Like the DMA port attack discussed in the previous section, tools are available that can scan the hiberfile.sys file and locate the encryption key, including a tool made by [Passware](http://www.lostpassword.com/). Microsoft does not consider Windows to be vulnerable to this type of attack, because Windows stores the hiberfil.sys file within the encrypted system volume. As a result, the file would be accessible only if the attacker had both physical and sign-in access to the PC. When an attacker has sign-in access to the PC, there are few reasons for the attacker to decrypt the drive, because they would already have full access to the data within it. -In practice, the only reason an attack on hyberfil.sys would grant an attacker additional access is if an administrator had changed the default Windows configuration and stored the hyberfil.sys file on an unencrypted drive. By default, Windows 10 is designed to be secure against this type of attack. +In practice, the only reason an attack on hiberfil.sys would grant an attacker additional access is if an administrator had changed the default Windows configuration and stored the hiberfil.sys file on an unencrypted drive. By default, Windows 10 is designed to be secure against this type of attack. ### Memory Remanence Attacks diff --git a/windows/security/hardware-protection/encrypted-hard-drive.md b/windows/security/information-protection/encrypted-hard-drive.md similarity index 100% rename from windows/security/hardware-protection/encrypted-hard-drive.md rename to windows/security/information-protection/encrypted-hard-drive.md diff --git a/windows/security/hardware-protection/images/dn168167.boot_process(en-us,MSDN.10).png b/windows/security/information-protection/images/dn168167.boot_process(en-us,MSDN.10).png similarity index 100% rename from windows/security/hardware-protection/images/dn168167.boot_process(en-us,MSDN.10).png rename to windows/security/information-protection/images/dn168167.boot_process(en-us,MSDN.10).png diff --git a/windows/security/hardware-protection/images/dn168167.measure_boot(en-us,MSDN.10).png b/windows/security/information-protection/images/dn168167.measure_boot(en-us,MSDN.10).png similarity index 100% rename from windows/security/hardware-protection/images/dn168167.measure_boot(en-us,MSDN.10).png rename to windows/security/information-protection/images/dn168167.measure_boot(en-us,MSDN.10).png diff --git a/windows/security/hardware-protection/secure-the-windows-10-boot-process.md b/windows/security/information-protection/secure-the-windows-10-boot-process.md similarity index 100% rename from windows/security/hardware-protection/secure-the-windows-10-boot-process.md rename to windows/security/information-protection/secure-the-windows-10-boot-process.md diff --git a/windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md b/windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md similarity index 100% rename from windows/security/hardware-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md rename to windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md diff --git a/windows/security/hardware-protection/tpm/change-the-tpm-owner-password.md b/windows/security/information-protection/tpm/change-the-tpm-owner-password.md similarity index 100% rename from windows/security/hardware-protection/tpm/change-the-tpm-owner-password.md rename to windows/security/information-protection/tpm/change-the-tpm-owner-password.md diff --git a/windows/security/hardware-protection/tpm/how-windows-uses-the-tpm.md b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md similarity index 100% rename from windows/security/hardware-protection/tpm/how-windows-uses-the-tpm.md rename to windows/security/information-protection/tpm/how-windows-uses-the-tpm.md diff --git a/windows/security/hardware-protection/tpm/images/process-to-create-evidence-of-boot-software-and-configuration-using-tpm.png b/windows/security/information-protection/tpm/images/process-to-create-evidence-of-boot-software-and-configuration-using-tpm.png similarity index 100% rename from windows/security/hardware-protection/tpm/images/process-to-create-evidence-of-boot-software-and-configuration-using-tpm.png rename to windows/security/information-protection/tpm/images/process-to-create-evidence-of-boot-software-and-configuration-using-tpm.png diff --git a/windows/security/hardware-protection/tpm/images/tpm-capabilities.png b/windows/security/information-protection/tpm/images/tpm-capabilities.png similarity index 100% rename from windows/security/hardware-protection/tpm/images/tpm-capabilities.png rename to windows/security/information-protection/tpm/images/tpm-capabilities.png diff --git a/windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md b/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md similarity index 100% rename from windows/security/hardware-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md rename to windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md diff --git a/windows/security/hardware-protection/tpm/manage-tpm-commands.md b/windows/security/information-protection/tpm/manage-tpm-commands.md similarity index 100% rename from windows/security/hardware-protection/tpm/manage-tpm-commands.md rename to windows/security/information-protection/tpm/manage-tpm-commands.md diff --git a/windows/security/hardware-protection/tpm/manage-tpm-lockout.md b/windows/security/information-protection/tpm/manage-tpm-lockout.md similarity index 100% rename from windows/security/hardware-protection/tpm/manage-tpm-lockout.md rename to windows/security/information-protection/tpm/manage-tpm-lockout.md diff --git a/windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md b/windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md similarity index 100% rename from windows/security/hardware-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md rename to windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md diff --git a/windows/security/hardware-protection/tpm/tpm-fundamentals.md b/windows/security/information-protection/tpm/tpm-fundamentals.md similarity index 100% rename from windows/security/hardware-protection/tpm/tpm-fundamentals.md rename to windows/security/information-protection/tpm/tpm-fundamentals.md diff --git a/windows/security/hardware-protection/tpm/tpm-recommendations.md b/windows/security/information-protection/tpm/tpm-recommendations.md similarity index 100% rename from windows/security/hardware-protection/tpm/tpm-recommendations.md rename to windows/security/information-protection/tpm/tpm-recommendations.md diff --git a/windows/security/hardware-protection/tpm/trusted-platform-module-overview.md b/windows/security/information-protection/tpm/trusted-platform-module-overview.md similarity index 93% rename from windows/security/hardware-protection/tpm/trusted-platform-module-overview.md rename to windows/security/information-protection/tpm/trusted-platform-module-overview.md index 43699df08e..8b4a54d9f3 100644 --- a/windows/security/hardware-protection/tpm/trusted-platform-module-overview.md +++ b/windows/security/information-protection/tpm/trusted-platform-module-overview.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security ms.localizationpriority: medium author: brianlic-msft -ms.date: 06/18/2018 +ms.date: 08/21/2018 --- # Trusted Platform Module Technology Overview @@ -68,14 +68,15 @@ Some things that you can check on the device are: - Is SecureBoot supported and enabled? > [!NOTE] -> The device must be running Windows 10 and it must support at least TPM 2.0 in order to utilize Device Health Attestation. +> Windows 10 and Windows Server 2016 support Device Health Attestation with TPM 2.0. Support for TPM 1.2 was added beginning with Windows version 1607 (RS1). ## Supported versions -| TPM version | Windows 10 | Windows Server 2016 | -|-------------|------------|---------------------| -| TPM 1.2 | X | X | -| TPM 2.0 | X | X | +| TPM version | Windows 10 | Windows Server 2016 | +|-------------|-------------|---------------------| +| TPM 1.2 | >= ver 1607 | >= ver 1607 | +| TPM 2.0 | X | X | + ## Related topics diff --git a/windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md b/windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md similarity index 100% rename from windows/security/hardware-protection/tpm/trusted-platform-module-services-group-policy-settings.md rename to windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md diff --git a/windows/security/hardware-protection/tpm/trusted-platform-module-top-node.md b/windows/security/information-protection/tpm/trusted-platform-module-top-node.md similarity index 100% rename from windows/security/hardware-protection/tpm/trusted-platform-module-top-node.md rename to windows/security/information-protection/tpm/trusted-platform-module-top-node.md diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 2a988c9641..7adccd0ac3 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -8,7 +8,7 @@ ms.pagetype: security author: justinha ms.author: justinha ms.localizationpriority: medium -ms.date: 07/10/2018 +ms.date: 08/08/2018 --- # Create a Windows Information Protection (WIP) policy with MDM using the Azure portal for Microsoft Intune @@ -348,14 +348,14 @@ If you're running into compatibility issues where your app is incompatible with ## Manage the WIP protection mode for your enterprise data After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode. -We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, **Hide Overrides**. +We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, **Block**. >[!NOTE] >For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). **To add your protection mode** -1. From the **App policy** blade, click the name of your policy, and then click **Required settings** from the menu that appears. +1. From the **App protection policy** blade, click the name of your policy, and then click **Required settings** from the menu that appears. The **Required settings** blade appears. @@ -363,7 +363,7 @@ We recommend that you start with **Silent** or **Allow Overrides** while verifyi |Mode |Description | |-----|------------| - |Hide Overrides |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| + |Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| |Allow Overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).| |Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.| |Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

    After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.| diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune.md index 1b084c9605..d75ea228ef 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune.md @@ -7,7 +7,7 @@ ms.mktglfcycl: explore ms.sitesec: library ms.pagetype: security ms.author: justinha -ms.date: 05/30/2018 +ms.date: 08/08/2018 ms.localizationpriority: medium --- @@ -308,11 +308,11 @@ If you're running into compatibility issues where your app is incompatible with ## Manage the WIP protection mode for your enterprise data After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode. -We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Allow Overrides** or **Hide Overrides**. +We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Allow Overrides** or **Block**. |Mode |Description | |-----|------------| -|Hide Overrides|WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| +|Block|WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| |Allow Overrides|WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](https://go.microsoft.com/fwlink/p/?LinkID=746459). | |Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Overrides mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.| |Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

    After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.| diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md index e5590cd3ed..5d23640044 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-mam-intune-azure.md @@ -7,7 +7,7 @@ ms.sitesec: library ms.pagetype: security author: justinha ms.author: justinha -ms.date: 05/30/2018 +ms.date: 08/08/2018 localizationpriority: medium --- @@ -377,7 +377,7 @@ In the **Required settings** blade you must pick your Windows Information Protec ### Manage the WIP protection mode for your enterprise data After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode. -We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your allowed apps list. After you're done, you can change to your final enforcement policy, **Hide Overrides**. +We recommend that you start with **Silent** or **Allow Overrides** while verifying with a small group that you have the right apps on your allowed apps list. After you're done, you can change to your final enforcement policy, **Block**. >[!NOTE] >For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). @@ -392,7 +392,7 @@ We recommend that you start with **Silent** or **Allow Overrides** while verifyi |Mode |Description | |-----|------------| - |Hide Overrides |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| + |Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| |Allow Overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).| |Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Allow Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.| |Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

    After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.| @@ -420,7 +420,7 @@ In the **Advanced settings** blade you must specify where apps can access your c ### Choose where apps can access enterprise data After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. -There are no default locations included with WIP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). +Intune will add SharePoint sites that are discovered through the Graph API. You must add other network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). >[!Important] >Every WIP policy should include policy that defines your enterprise network locations.
    Classless Inter-Domain Routing (CIDR) notation isn’t supported for WIP configurations. diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md index 1c8de7d581..e766991a5a 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-sccm.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security author: justinha ms.localizationpriority: medium -ms.date: 10/16/2017 +ms.date: 08/08/2018 --- # Create and deploy a Windows Information Protection (WIP) policy using System Center Configuration Manager @@ -340,14 +340,14 @@ If you're running into compatibility issues where your app is incompatible with ## Manage the WIP-protection level for your enterprise data After you've added the apps you want to protect with WIP, you'll need to apply a management and protection mode. -We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Override** or **Hide Overrides**. +We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**. >[!NOTE] >For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). |Mode |Description | |-----|------------| -|Hide Overrides |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| +|Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| |Override |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log. | |Silent |WIP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still blocked.| |Off (not recommended) |WIP is turned off and doesn't help to protect or audit your data.

    After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.| diff --git a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune.md b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune.md index fa52656359..26b5ff9472 100644 --- a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune.md +++ b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security author: justinha ms.localizationpriority: medium -ms.date: 09/11/2017 +ms.date: 08/08/2018 --- # Deploy your Windows Information Protection (WIP) policy using the classic console for Microsoft Intune diff --git a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md index 1ad43ba3f3..6ebcf8b468 100644 --- a/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md +++ b/windows/security/information-protection/windows-information-protection/protect-enterprise-data-using-wip.md @@ -77,13 +77,13 @@ WIP gives you a new way to manage data policy enforcement for apps and documents - **Copying or downloading enterprise data.** When an employee or an app downloads content from a location like SharePoint, a network share, or an enterprise web location, while using a WIP-protected device, WIP encrypts the data on the device. - - **Using allowed apps.** Managed apps (apps that you've included on the **Allowed apps** list in your WIP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if WIP management is set to **Hide overrides**, your employees can copy and paste from one protected app to another allowed app, but not to personal apps. Imagine an HR person wants to copy a job description from an allowed app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. + - **Using allowed apps.** Managed apps (apps that you've included on the **Allowed apps** list in your WIP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if WIP management is set to **Block**, your employees can copy and paste from one protected app to another allowed app, but not to personal apps. Imagine an HR person wants to copy a job description from an allowed app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. - **Managed apps and restrictions.** With WIP you can control which apps can access and use your enterprise data. After adding an app to your allowed apps list, the app is trusted with enterprise data. All apps not on this list are stopped from accessing your enterprise data, depending on your WIP management-mode. You don’t have to modify line-of-business apps that never touch personal data to list them as allowed apps; just include them in the allowed apps list. - - **Deciding your level of data access.** WIP lets you hide overrides, allow overrides, or audit employees' data sharing actions. Hiding overrides stops the action immediately. Allowing overrides lets the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without stopping anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your allowed apps list. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). + - **Deciding your level of data access.** WIP lets you block, allow overrides, or audit employees' data sharing actions. Hiding overrides stops the action immediately. Allowing overrides lets the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without stopping anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your allowed apps list. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md). - **Data encryption at rest.** WIP helps protect enterprise data on local files and on removable media. @@ -132,7 +132,7 @@ You can set your WIP policy to use 1 of 4 protection and management modes: |Mode|Description| |----|-----------| -|Hide overrides |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing enterprise data to non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.| +|Block |WIP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing enterprise data to non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.| |Allow overrides |WIP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log.| |Silent |WIP runs silently, logging inappropriate data sharing, without stopping anything that would’ve been prompted for employee interaction while in Allow overrides mode. Unallowed actions, like apps inappropriately trying to access a network resource or WIP-protected data, are still stopped.| |Off |WIP is turned off and doesn't help to protect or audit your data.

    After you turn off WIP, an attempt is made to decrypt any WIP-tagged files on the locally attached drives. Be aware that your previous decryption and policy info isn’t automatically reapplied if you turn WIP protection back on.

    **Note**
    For more info about setting your WIP-protection modes, see either [Create a Windows Information Protection (WIP) policy using Intune](create-wip-policy-using-intune.md) or [Create and deploy a Windows Information Protection (WIP) policy using Configuration Manager](create-wip-policy-using-sccm.md), depending on your management solution. | diff --git a/windows/security/information-protection/windows-information-protection/wip-learning.md b/windows/security/information-protection/windows-information-protection/wip-learning.md index 87c74dd9a0..7225edb78c 100644 --- a/windows/security/information-protection/windows-information-protection/wip-learning.md +++ b/windows/security/information-protection/windows-information-protection/wip-learning.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.pagetype: security author: coreyp-at-msft ms.localizationpriority: medium -ms.date: 04/18/2018 +ms.date: 08/08/2018 --- # Fine-tune Windows Information Protection (WIP) with WIP Learning @@ -21,16 +21,16 @@ ms.date: 04/18/2018 With WIP Learning, you can intelligently tune which apps and websites are included in your WIP policy to help reduce disruptive prompts and keep it accurate and relevant. WIP Learning generates two reports: The **App learning report** and the **Website learning report**. Both reports are accessed from Microsoft Azure Intune, and you can alternately access the App learning report from Microsoft Operations Management Suite (OMS). -The **App learning report** monitors your apps, not in policy, that attempt to access work data. You can identify these apps using the report and add them to your WIP policies to avoid productivity disruption before fully enforcing WIP with [“Hide overrides”](protect-enterprise-data-using-wip.md#bkmk-modes) mode. Frequent monitoring of the report will help you continuously identify access attempts so you can update your policy accordingly. +The **App learning report** monitors your apps, not in policy, that attempt to access work data. You can identify these apps using the report and add them to your WIP policies to avoid productivity disruption before fully enforcing WIP with [“Block”](protect-enterprise-data-using-wip.md#bkmk-modes) mode. Frequent monitoring of the report will help you continuously identify access attempts so you can update your policy accordingly. In the **Website learning report**, you can view a summary of the devices that have shared work data with websites. You can use this information to determine which websites should be added to group and user WIP policies. The summary shows which website URLs are accessed by WIP-enabled apps so you can decide which ones are cloud or personal, and add them to the resource list. -## Access the WIP Learning reports - -1. Open the [Azure portal](http://portal.azure.com/). Choose **All services**. Type **Intune** in the text box filter. - +## Access the WIP Learning reports + +1. Open the [Azure portal](http://portal.azure.com/). Choose **All services**. Type **Intune** in the text box filter. + 2. Choose **Intune** > **Mobile Apps**. - + 3. Choose **App protection status**. 4. Choose **Reports**. @@ -95,7 +95,7 @@ Here, you can copy the **WipAppid** and use it to adjust your WIP protection pol 9. Go back to OMS one more time and note the version number of the app and type it in **MIN VERSION** in Intune (alternately, you can specify the max version, but one or the other is required), and then select the **ACTION**: **Allow** or **Deny** -When working with WIP-enabled apps and WIP-unknown apps, it is recommended that you start with **Silent** or **Allow overrides** while verifying with a small group that you have the right apps on your allowed apps list. After you're done, you can change to your final enforcement policy, **Hide overrides**. For more information about WIP modes, see: [Protect enterprise data using WIP: WIP-modes](protect-enterprise-data-using-wip.md#bkmk-modes) +When working with WIP-enabled apps and WIP-unknown apps, it is recommended that you start with **Silent** or **Allow overrides** while verifying with a small group that you have the right apps on your allowed apps list. After you're done, you can change to your final enforcement policy, **Block**. For more information about WIP modes, see: [Protect enterprise data using WIP: WIP-modes](protect-enterprise-data-using-wip.md#bkmk-modes) >[!NOTE] >Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Contributing to TechNet content](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 9467fc2e6d..efc971485b 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -306,18 +306,18 @@ ###### [Requirements for virtualization-based protection of code integrity](windows-defender-exploit-guard\requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) ###### [Enable virtualization-based protection of code integrity](windows-defender-exploit-guard\enable-virtualization-based-protection-of-code-integrity.md) #### [Attack surface reduction](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) -#### [Evaluate Attack surface reduction](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) -#### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) -#### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) -#### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) +##### [Evaluate Attack surface reduction](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) +##### [Enable Attack surface reduction](windows-defender-exploit-guard\enable-attack-surface-reduction.md) +##### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) +##### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) #### [Network Protection](windows-defender-exploit-guard\network-protection-exploit-guard.md) -#### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) -#### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) -#### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) +##### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) +##### [Enable Network Protection](windows-defender-exploit-guard\enable-network-protection.md) +##### [Troubleshoot Network protection](windows-defender-exploit-guard\troubleshoot-np.md) #### [Controlled folder access](windows-defender-exploit-guard\controlled-folders-exploit-guard.md) -#### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) -#### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) -#### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) +##### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) +##### [Enable Controlled folder access](windows-defender-exploit-guard\enable-controlled-folders-exploit-guard.md) +##### [Customize Controlled folder access](windows-defender-exploit-guard\customize-controlled-folders-exploit-guard.md) @@ -336,6 +336,7 @@ #### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) #### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) +## [Security intelligence](intelligence/index.md) ## Other security features ### [The Windows Security app](windows-defender-security-center/windows-defender-security-center.md) @@ -387,10 +388,10 @@ ###### [Audit process tracking](auditing/basic-audit-process-tracking.md) ###### [Audit system events](auditing/basic-audit-system-events.md) -##### [Advanced security audit policies](auditing/advanced-security-auditing.md) -###### [Planning and deploying advanced security audit policies](auditing/planning-and-deploying-advanced-security-audit-policies.md) -###### [Advanced security auditing FAQ](auditing/advanced-security-auditing-faq.md) -####### [Which editions of Windows support advanced audit policy configuration](auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md) +#### [Advanced security audit policies](auditing/advanced-security-auditing.md) +##### [Planning and deploying advanced security audit policies](auditing/planning-and-deploying-advanced-security-audit-policies.md) +##### [Advanced security auditing FAQ](auditing/advanced-security-auditing-faq.md) +###### [Which editions of Windows support advanced audit policy configuration](auditing/which-editions-of-windows-support-advanced-audit-policy-configuration.md) ###### [Using advanced security auditing options to monitor dynamic access control objects](auditing/using-advanced-security-auditing-options-to-monitor-dynamic-access-control-objects.md) ####### [Monitor the central access policies that apply on a file server](auditing/monitor-the-central-access-policies-that-apply-on-a-file-server.md) @@ -731,7 +732,7 @@ -#### [Security policy settings](security-policy-settings/security-policy-settings.md) +### [Security policy settings](security-policy-settings/security-policy-settings.md) #### [Administer security policy settings](security-policy-settings/administer-security-policy-settings.md) ##### [Network List Manager policies](security-policy-settings/network-list-manager-policies.md) #### [Configure security policy settings](security-policy-settings/how-to-configure-security-policy-settings.md) @@ -908,8 +909,8 @@ ### [Windows security baselines](windows-security-baselines.md) -### [Security Compliance Toolkit](security-compliance-toolkit-10.md) -### [Get support](get-support-for-security-baselines.md) +#### [Security Compliance Toolkit](security-compliance-toolkit-10.md) +#### [Get support](get-support-for-security-baselines.md) ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) diff --git a/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md b/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md index 31e6351c21..8a5fc0d12d 100644 --- a/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md +++ b/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md @@ -1,6 +1,6 @@ --- -title: Windows Defender Device Guard - virtualization-based security and code integrity policies (Windows 10) -description: Microsoft Windows Defender Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security. +title: Windows Defender Application Control Configurable Code Integrity and Virtualization-based security (Windows 10) +description: Microsoft Windows 10 has a feature set that consists of both hardware and software system integrity hardening capabilites that revolutionize the Windows operating system’s security. keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy @@ -9,36 +9,37 @@ author: mdsakibMSFT ms.date: 04/19/2018 --- -# Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control +# Windows Defender Application Control Configurable Code Integrity and Virtualization-based security (aka Windows Defender Device Guard) **Applies to** - Windows 10 - Windows Server 2016 -With Windows 10, we introduced Windows Defender Device Guard, a set of hardware and OS technologies that, when configured together, allow enterprises to lock down Windows systems so they operate with many of the properties of mobile devices. -In this configuration, Device Guard restricts devices to only run authorized apps by using a feature called configurable code integrity (CI), while simultaneously hardening the OS against kernel memory attacks through the use of virtualization-based protection of code integrity (more specifically, HVCI). +Windows 10 includes a set of hardware and OS technologies that, when configured together, allow enterprises to "lock down" Windows systems so they operate with many of the properties of mobile devices. In this configuration, specific technologies work together to restrict devices to only run authorized apps by using a feature called configurable code integrity (CI), while simultaneously hardening the OS against kernel memory attacks through the use of virtualization-based protection of code integrity (more specifically, HVCI). -Configurable CI has these advantages over other solutions: +Configurable CI and HVCI are very powerful protections that can be used separately. However, when these two technologies are configured to work together, they present a very strong protection capability for Windows 10 devices. Starting with the Windows 10 Anniversary Update (1607), this combined "configuration state" of Configurable CI and HVCI has been referred to as Windows Defender Device Guard. + +Using Configurable CI to restrict devices to only autherized apps has these advantages over other solutions: 1. Configurable CI policy is enforced by the Windows kernel itself. As such, the policy takes effect early in the boot sequence before nearly all other OS code and before traditional antivirus solutions run. 2. Configurable CI allows customers to set application control policy not only over code running in user mode, but also kernel mode hardware and software drivers and even code that runs as part of Windows. -3. Customers can protect the configurable CI policy even from local administrator tampering by digitally signing the policy. Then changing the policy requires administrative privilege and access to the organization’s digital signing process, making it extremely difficult for an attacker or malware that managed to gain administrative privilege to alter the application control policy. +3. Customers can protect the configurable CI policy even from local administrator tampering by digitally signing the policy. This would mean that changing the policy would require both administrative privilege and access to the organization’s digital signing process, making it extremely difficult for an attacker with administrative privledge, or malicious software that managed to gain administrative privilege, to alter the application control policy. 4. The entire configurable CI enforcement mechanism can be protected by HVCI, where even if a vulnerability exists in kernel mode code, the likelihood that an attacker could successfully exploit it is significantly diminished. Why is this relevant? That’s because an attacker that compromises the kernel would otherwise have enough privilege to disable most system defenses and override the application control policies enforced by configurable CI or any other application control solution. ## (Re-)Introducing Windows Defender Application Control -When we originally designed Device Guard it was built with a specific security promise in mind. Although there were no direct dependencies between its two main OS features, configurable CI and HVCI, we intentionally focused our marketing story around the Device Guard lockdown state you achieve when deploying them together. +When we originally designed the configuration state that we have referred to as Windows Defender Device Guard, we did so with a specific security promise in mind. Although there were no direct dependencies between the two main OS features of the Device Guard configuration, configurable CI and HVCI, we intentionally focused our discussion around the Device Guard lockdown state you achieve when deploying them together. -However, this unintentionally left an impression for many customers that the two features were inexorably linked and could not be deployed separately. -And given that HVCI relies on the Windows virtualization-based security, it comes with additional hardware, firmware, and kernel driver compatibility requirements that some older systems can’t meet. +However, the use of the term Device Guard to describe this configuration state has unintentionally left an impression for many IT professionals that the two features were inexorably linked and could not be deployed separately. +Additionally, given that HVCI relies on Windows virtualization-based security, it comes with additional hardware, firmware, and kernel driver compatibility requirements that some older systems can’t meet. -As a result, many customers assumed that they couldn’t use configurable CI either. -But configurable CI carries no specific hardware or software requirements other than running Windows 10, which means many customers were wrongly denied the benefits of this powerful application control capability. +As a result, many IT Professionals assumed that because some systems couldn't use HVCI, they couldn’t use configurable CI either. +But configurable CI carries no specific hardware or software requirements other than running Windows 10, which means many IT professionals were wrongly denied the benefits of this powerful application control capability. -Since the initial release of Windows 10, the world has witnessed numerous hacking and malware attacks where application control alone could have prevented the attack altogether. So we are promoting configurable CI within our security stack and giving it a name of its own: [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control). -We hope this branding change will help us better communicate options for adopting application control within an organization. +Since the initial release of Windows 10, the world has witnessed numerous hacking and malware attacks where application control alone could have prevented the attack altogether. With this in mind, we are discussing and documenting configurable CI as a independent technology within our security stack and giving it a name of its own: [Windows Defender Application Control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control). +We hope this change will help us better communicate options for adopting application control within an organization. -Does this mean Windows Defender Device Guard is going away? Not at all. Device Guard will continue to exist as a way to describe the fully locked down state achieved through the use of Windows Defender Application Control (WDAC), HVCI, and hardware and firmware security features. It also allows us to work with our OEM partners to identify specifications for devices that are “Device Guard capable” so that our joint customers can easily purchase devices that meet all of the hardware and firmware requirements of the original Device Guard scenario. +Does this mean Windows Defender Device Guard configuration state is going away? Not at all. The term Device Guard will continue to be used as a way to describe the fully locked down state achieved through the use of Windows Defender Application Control (WDAC), HVCI, and hardware and firmware security features. It also allows us to work with our OEM partners to identify specifications for devices that are “Device Guard capable” so that our joint customers can easily purchase devices that meet all of the hardware and firmware requirements of the original "Device Guard" locked down scenario for Windows 10 based devices. ## Related topics diff --git a/windows/security/threat-protection/intelligence/TOC.md b/windows/security/threat-protection/intelligence/TOC.md new file mode 100644 index 0000000000..73449a6a2c --- /dev/null +++ b/windows/security/threat-protection/intelligence/TOC.md @@ -0,0 +1,49 @@ +# [Security intelligence](index.md) + +## [Understand malware & other threats](understanding-malware.md) + +### [Prevent malware infection](prevent-malware-infection.md) + +### [Malware names](malware-naming.md) + +### [Coin miners](coinminer-malware.md) + +### [Exploits and exploit kits](exploits-malware.md) + +### [Macro malware](macro-malware.md) + +### [Phishing](phishing.md) + +### [Ransomware](ransomware-malware.md) + +### [Rootkits](rootkits-malware.md) + +### [Supply chain attacks](supply-chain-malware.md) + +### [Tech support scams](support-scams.md) + +### [Trojans](trojans-malware.md) + +### [Unwanted software](unwanted-software.md) + +### [Worms](worms-malware.md) + +## [How Microsoft identifies malware and PUA](criteria.md) + +## [Submit files for analysis](submission-guide.md) + +## [Safety Scanner download](safety-scanner-download.md) + +## [Industry collaboration programs](cybersecurity-industry-partners.md) + +### [Virus information alliance](virus-information-alliance-criteria.md) + +### [Microsoft virus initiative](virus-initiative-criteria.md) + +### [Coordinated malware eradication](coordinated-malware-eradication.md) + +## [Information for developers](developer-info.md) + +### [Software developer FAQ](developer-faq.md) + +### [Software developer resources](developer-resources.md) diff --git a/windows/security/threat-protection/intelligence/coinminer-malware.md b/windows/security/threat-protection/intelligence/coinminer-malware.md new file mode 100644 index 0000000000..e74b6ea5f4 --- /dev/null +++ b/windows/security/threat-protection/intelligence/coinminer-malware.md @@ -0,0 +1,47 @@ +--- +title: Coin miners +description: Learn about coin miners, how they can infect devices, and what you can do to protect yourself. +keywords: security, malware, coin miners, protection, cryptocurrencies +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- +# Coin miners + +Cybercriminals are always looking for new ways to make money. With the rise of digital currencies, also known as cryptocurrencies, criminals see a unique opportunity to infiltrate an organization and secretly mine for coins by reconfiguring malware. + +## How coin miners work + +Many infections start with: + +- Email messages with attachments that try to install malware. + +- Websites hosting exploit kits that attempt to use vulnerabilities in web browsers and other software to install coin miners. + +- Websites taking advantage of computer processing power by running scripts while users browse the website. + +Mining is the process of running complex mathematical calculations necessary to maintain the blockchain ledger. This process generates coins but requires significant computing resources. + +Coin miners are not inherently malicious. Some individuals and organizations invest in hardware and electric power for legitimate coin mining operations. However, others look for alternative sources of computing power and try to find their way into corporate networks. These coin miners are not wanted in enterprise environments because they eat up precious computing resources. + +Cybercriminals see an opportunity to make money by running malware campaigns that distribute, install, and run trojanized miners at the expense of other people’s computing resources. + +### Examples + +DDE exploits, which have been known to distribute ransomware, are now delivering miners. + +For example, a sample of the malware detected as Trojan:Win32/Coinminer (SHA-256: 7213cbbb1a634d780f9bb861418eb262f58954e6e5dca09ca50c1e1324451293) is installed by Exploit:O97M/DDEDownloader.PA, a Word document that contains the DDE exploit. + +The exploit launches a cmdlet that executes a malicious PowerShell script (Trojan:PowerShell/Maponeir.A), which then downloads the trojanized miner: a modified version of the miner XMRig, which mines Monero cryptocurrency. + +## How to protect against coin miners + +**Enable PUA detection**: Some coin mining tools are not considered malware but are detected as potentially unwanted applications (PUA). Many applications detected as PUA can negatively impact machine performance and employee productivity. In enterprise environments, you can stop adware, torrent downloaders, and coin mining by enabling PUA detection. + +Since coin miners is becoming a popular payload in many different kinds of attacks, see general tips on how to [prevent malware infection](prevent-malware-infection.md). + +For more information on coin miners, see the blog post [Invisible resource thieves: The increasing threat of cryptocurrency miners](https://cloudblogs.microsoft.com/microsoftsecure/2018/03/13/invisible-resource-thieves-the-increasing-threat-of-cryptocurrency-miners/). \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md new file mode 100644 index 0000000000..95f08cac80 --- /dev/null +++ b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md @@ -0,0 +1,35 @@ +--- +title: Coordinated Malware Eradication +description: Information and criteria regarding CME +keywords: security, malware +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 07/12/2018 +--- +# Coordinated Malware Eradication + +![coordinated-malware-eradication](images/CoordinatedMalware.png) + +Coordinated Malware Eradication (CME) aims to bring organizations in cybersecurity and in other industries together to change the game against malware. While the cybersecurity industry today is effective at disrupting malware families through individual efforts, those disruptions rarely lead to eradication since malware authors quickly adapt their tactics to survive. + +CME calls for organizations to pool their tools, information and actions to drive coordinated campaigns against malware. The ultimate goal is to drive efficient and long lasting results for better protection of our collective communities, customers, and businesses. + +## Combining our tools, information, and actions + +Diversity of participation across industries and disciplines, extending beyond cybersecurity, makes eradication campaigns even stronger across the malware lifecycle. For instance, while security vendors, computer emergency response/readiness teams (CERTs), and Internet service providers (ISPs) can contribute with malware telemetry, online businesses can identify fraudulent behavior and law enforcement agencies can drive legal action. + +In addition to telemetry and analysis data, Microsoft is planning to contribute cloud-based scalable storage and computing horsepower with the necessary big data analysis tools built-in to these campaigns. + +## Coordinated campaigns for lasting results + +Organizations participating in the CME effort work together to help eradicate selected malware families by contributing their own telemetry data, expertise, tools, and other resources. These organizations operate under a campaign umbrella with clearly defined end goals and metrics. Any organization or member can initiate a campaign and invite others to join it. The members then have the option to accept or decline the invitations they receive. + +## Join the effort + +Any organization that is involved in cybersecurity and antimalware or interested in fighting cybercrime can participate in CME campaigns by enrolling in the [Virus Information Alliance (VIA) program](virus-information-alliance-criteria.md). It ensures that everyone agrees to use the information and tools available for campaigns for their intended purpose (that is, the eradication of malware). + +Please apply using our [membership application form](http://www.microsoft.com/security/portal/partnerships/apply.aspx) to get started. \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/criteria.md b/windows/security/threat-protection/intelligence/criteria.md new file mode 100644 index 0000000000..908368bb4b --- /dev/null +++ b/windows/security/threat-protection/intelligence/criteria.md @@ -0,0 +1,170 @@ +--- +title: How Microsoft identifies malware and potentially unwanted applications +description: criteria +keywords: security, malware +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/01/2018 +--- + +# How Microsoft identifies malware and potentially unwanted applications + +Microsoft aims to provide customers with the most delightful and productive Windows experience possible. To help achieve that, we try our best to ensure our customers are safe and in control of their devices. + +Microsoft gives you the information and tools you need when downloading, installing, and running software, as well as tools that protect you when we know that something unsafe is happening. Microsoft does this by identifying and analyzing software and online content against criteria described in this article. + +You can participate in this process by submitting software for analysis. Our analysts and intelligent systems can then help identify undesirable software and ensure they are covered by our security solutions. + +Because new forms of malware and potentially unwanted applications are being developed and distributed rapidly, Microsoft reserves the right to adjust, expand, and update these criteria without prior notice or announcements. + +## Malware + +Malware is the overarching name for applications and other code, i.e. software, that Microsoft classifies more granularly as *malicious software* or *unwanted software*. + +### Malicious software + +Malicious software is an application or code that compromises user security. Malicious software might steal your personal information, lock your PC until you pay a ransom, use your PC to send spam, or download other malicious software. In general, malicious software tricks, cheats, or defrauds users, places users in vulnerable states, or performs other malicious activities. + +Microsoft classifies most malicious software into one of the following categories: + +* **Backdoor:** A type of malware that gives malicious hackers remote access to and control of your PC. + +* **Downloader:** A type of malware that downloads other malware onto your PC. It needs to connect to the internet to download files. + +* **Dropper:** A type of malware that installs other malware files onto your PC. Unlike a downloader, a dropper doesn’t need to connect to the internet to drop malicious files. The dropped files are typically embedded in the dropper itself. + +* **Exploit:** A piece of code that uses software vulnerabilities to gain access to your PC and perform other tasks, such as installing malware. [See more information about exploits](exploits-malware.md). + +* **Hacktool:** A type of tool that can be used to gain unauthorized access to your PC. + +* **Macro virus:** A type of malware that spreads through infected documents, such as Microsoft Word or Excel documents. The virus is run when you open an infected document. + +* **Obfuscator:** A type of malware that hides its code and purpose, making it more difficult for security software to detect or remove. + +* **Password stealer:** A type of malware that gathers your personal information, such as user names and passwords. It often works along with a keylogger, which collects and sends information about the keys you press and websites you visit. + +* **Ransomware:** A type of malware that encrypts your files or makes other modifications that can prevent you from using your PC. It then displays a ransom note stating you must pay money, complete surveys, or perform other actions before you can use your PC again. [See more information about ransomware](ransomware-malware.md). + +* **Rogue security software:** Malware that pretends to be security software but doesn't provide any protection. This type of malware usually displays alerts about nonexistent threats on your PC. It also tries to convince you to pay for its services. + +* **Trojan:** A type of malware that attempts to appear harmless. Unlike a virus or a worm, a trojan doesn't spread by itself. Instead it tries to look legitimate, tricking users into downloading and installing it. Once installed, trojans perform a variety of malicious activities, such as stealing personal information, downloading other malware, or giving attackers access to your PC. + +* **Trojan clicker:** A type of trojan that automatically clicks buttons or similar controls on websites or applications. Attackers can use this trojan to click on online advertisements. These clicks can skew online polls or other tracking systems and can even install applications on your PC. + +* **Worm:** A type of malware that spreads to other PCs. Worms can spread through email, instant messaging, file sharing platforms, social networks, network shares, and removable drives. Sophisticated worms take advantage of software vulnerabilities to propagate. + +### Unwanted software + +Microsoft believes that you should have control over your Windows experience. Software running on Windows should keep you in control of your PC through informed choices and accessible controls. Microsoft identifies software behaviors that ensure you stay in control. We classify software that does not fully demonstrate these behaviors as "unwanted software". + +#### Lack of choice + +You must be notified about what is happening on your PC, including what software does and whether it is active. + +Software that exhibits lack of choice might: + +* Fail to provide prominent notice about the behavior of the software and its purpose and intent. + +* Fail to clearly indicate when the software is active and might also attempt to hide or disguise its presence. + +* Install, reinstall, or remove software without your permission, interaction, or consent. + +* Install other software without a clear indication of its relationship to the primary software. + +* Circumvent user consent dialogs from the browser or operating system. + +* Falsely claim to be software from Microsoft. + +Software must not mislead or coerce you into making decisions about your PC. This is considered behavior that limits your choices. In addition to the previous list, software that exhibits lack of choice might: + +* Display exaggerated claims about your PC’s health. + +* Make misleading or inaccurate claims about files, registry entries, or other items on your PC. + +* Display claims in an alarming manner about your PC's health and require payment or certain actions in exchange for fixing the purported issues. + +Software that stores or transmits your activities or data must: + +* Give you notice and get consent to do so. Software should not include an option that configures it to hide activities associated with storing or transmitting your data. + +#### Lack of control + +You must be able to control software on your computer. You must be able to start, stop, or otherwise revoke authorization to software. + +Software that exhibits lack of control might: + +* Prevent or limit you from viewing or modifying browser features or settings. + +* Open browser windows without authorization. + +* Redirect web traffic without giving notice and getting consent. + +* Modify or manipulate webpage content without your consent. + +Software that changes your browsing experience must only use the browser's supported extensibility model for installation, execution, disabling, or removal. Browsers that do not provide supported extensibility models will be considered non-extensible and should not be modified. + +#### Installation and removal + +You must be able to start, stop, or otherwise revoke authorization given to software. Software should obtain your consent before installing, and it must provide a clear and straightforward way for you to install, uninstall, or disable it. + +Software that delivers *poor installation experience* might bundle or download other "unwanted software" as classified by Microsoft. + +Software that delivers *poor removal experience* might: + +* Present confusing or misleading prompts or pop-ups while being uninstalled. + +* Fail to use standard install/uninstall features, such as Add/Remove Programs. + +#### Advertising and advertisements + +Software that promotes a product or service outside of the software itself can interfere with your computing experience. You should have clear choice and control when installing software that presents advertisements. + +The advertisements that are presented by software must: + +* Include an obvious way for users to close the advertisement. The act of closing the advertisement must not open another advertisement. + +* Include the name of the software that presented the advertisement. + +The software that presents these advertisements must: + +* Provide a standard uninstall method for the software using the same name as shown in the advertisement it presents. + +Advertisements shown to you must: + +* Be distinguishable from website content. + +* Not mislead, deceive, or confuse. + +* Not contain malicious code. + +* Not invoke a file download. + +#### Consumer opinion + +Microsoft maintains a worldwide network of analysts and intelligence systems where you can [submit software for analysis](https://www.microsoft.com/wdsi/filesubmission). Your participation helps us identify new malware quickly. After analysis, Microsoft creates definitions for software that meets the described criteria. These definitions identify the software as malware and are available to all users through Windows Defender Antivirus and other Microsoft antimalware solutions. + +## Potentially unwanted application (PUA) + +Our PUA protection aims to safeguard user productivity and ensure enjoyable Windows experiences. This optional protection, available to enterprises, helps deliver more productive, performant, and delightful Windows experiences. + +*PUAs are not considered malware.* + +Microsoft uses specific categories and the category definitions to classify software as a PUA. + +* **Browser advertising software:** Software that displays advertisements or promotions, or prompts the user to complete surveys for other products or services in software other than itself. This includes software that inserts advertisements to webpages. + +* **Torrent software:** Software that is used to create or download torrents or other files specifically used with peer-to-peer file-sharing technologies. + +* **Cryptomining software:** Software that uses your computer resources to mine cryptocurrencies. + +* **Bundling software:** Software that offers to install other software that is not digitally signed by the same entity. Also, software that offers to install other software that qualify as PUA based on the criteria outlined in this document. + +* **Marketing software:** Software that monitors and transmits the activities of the user to applications or services other than itself for marketing research. + +* **Evasion software:** Software that actively tries to evade detection by security products, including software that behaves differently in the presence of security products. + +* **Poor industry reputation:** Software that trusted security providers detect with their security products. The security industry is dedicated to protecting customers and improving their experiences. Microsoft and other organizations in the security industry continuously exchange knowledge about files we have analyzed to provide users with the best possible protection. \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md b/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md new file mode 100644 index 0000000000..52a769a8b5 --- /dev/null +++ b/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md @@ -0,0 +1,39 @@ +--- +title: Industry collaboration programs +description: Describing the 3 industry collaboration programs +keywords: security, malware +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 07/12/2018 +--- +# Industry collaboration programs + +Microsoft has several industry-wide collaboration programs with different objectives and requirements. Enrolling in the right program can help you protect your customers, gain more insight into the current threat landscape, or assist in disrupting the malware ecosystem. + +## Virus Information Alliance (VIA) + +The VIA program gives members access to information that will help improve protection for Microsoft customers. Malware telemetry and samples can be provided to security teams to help identify gaps in their protection, prioritize new threat coverage, or better respond to threats. + +**You must be a member of VIA if you want to apply for membership to the other programs.** + +Go to the [VIA program page](virus-information-alliance-criteria.md) for more information. + +## Microsoft Virus Initiative (MVI) + +MVI is open to organizations who build and own a Real Time Protection (RTP) antimalware product of their own design, or one developed using a third-party antivirus SDK. + +Members get access to Microsoft client APIs for the Windows Defender Security Center, IOAV, AMSI, and Cloud Files, along with health data and other telemetry to help their customers stay protected. Antimalware products are submitted to Microsoft for performance testing on a regular basis. + +Go to the [MVI program page](virus-initiative-criteria.md) for more information. + +## Coordinated Malware Eradication (CME) + +CME is open to organizations who are involved in cybersecurity and antimalware or interested in fighting cybercrime. + +The program aims to bring organizations in cybersecurity and other industries together to pool tools, information and actions to drive coordinated campaigns against malware. The ultimate goal is to create efficient and long-lasting results for better protection of our collective communities, customers, and businesses. + +Go to the [CME program page](coordinated-malware-eradication.md) for more information. \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/developer-faq.md b/windows/security/threat-protection/intelligence/developer-faq.md new file mode 100644 index 0000000000..e6979a1851 --- /dev/null +++ b/windows/security/threat-protection/intelligence/developer-faq.md @@ -0,0 +1,41 @@ +--- +title: Software developer FAQ +description: This page provides answers to common questions we receive from software developers +keywords: wdsi, software, developer, faq, dispute, false-positive, classify, installer, software, bundler, blocking +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 07/01/2018 +--- + +# Software developer FAQ + +This page provides answers to common questions we receive from software developers. For general guidance about submitting malware or incorrectly detected files, read the submission guide. + +## Does Microsoft accept files for a known list or false-positive prevention program? +No. We do not accept these requests from software developers. Signing your program's files in a consistent manner, with a digital certificate issued by a trusted root authority, helps our research team quickly identify the source of a program and apply previously gained knowledge. In some cases, this might result in your program being quickly added to the known list or, far less frequently, in adding your digital certificate to a list of trusted publishers. + +## How do I dispute the detection of my program? +Submit the file in question as a software developer. Wait until your submission has a final determination. + +If you're not satisfied with our determination of the submission, use the developer contact form provided with the submission results to reach Microsoft. We will use the information you provide to investigate further if necessary. + +We encourage all software vendors and developers to read about how Microsoft identifies malware and unwanted software. + +## Why is Microsoft asking for a copy of my program? +This can help us with our analysis. Participants of the Microsoft Active Protection Service (MAPS) may occasionally receive these requests. The requests will stop once our systems have received and processed the file. + +## Why does Microsoft classify my installer as a software bundler? +It contains instructions to offer a program classified as unwanted software. You can review the criteria we use to check applications for behaviors that are considered unwanted. + +## Why is the Windows Firewall blocking my program? +This is not related to Windows Defender Antivirus and other Microsoft antimalware. You can find out more about Windows Firewall from the Microsoft Developer Network. + +## Why does the Windows Defender SmartScreen say my program is not commonly downloaded? +This is not related to Windows Defender Antivirus and other Microsoft antimalware. You can find out more from the SmartScreen website. + diff --git a/windows/security/threat-protection/intelligence/developer-info.md b/windows/security/threat-protection/intelligence/developer-info.md new file mode 100644 index 0000000000..43c679345e --- /dev/null +++ b/windows/security/threat-protection/intelligence/developer-info.md @@ -0,0 +1,25 @@ +--- +title: Information for developers +description: This page provides answers to common questions we receive from software developers and other useful resources +keywords: software, developer, faq, dispute, false-positive, classify, installer, software, bundler, blocking +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 07/13/2018 +--- + +# Information for developers +Learn about the common questions we receive from software developers and get other developer resources such as detection criteria and file submissions. + +## In this section +Topic | Description +:---|:--- +[Software developer FAQ](developer-faq.md) | Provides answers to common questions we receive from software developers. +[Developer resources](developer-resources.md) | Provides information about how to submit files, detection criteria, and how to check your software against the latest definitions and cloud protection from Microsoft. + + diff --git a/windows/security/threat-protection/intelligence/developer-resources.md b/windows/security/threat-protection/intelligence/developer-resources.md new file mode 100644 index 0000000000..612338fcad --- /dev/null +++ b/windows/security/threat-protection/intelligence/developer-resources.md @@ -0,0 +1,43 @@ +--- +title: Software developer resources +description: This page provides information for developers such as detection criteria, developer questions, and how to check your software against definitions. +keywords: wdsi, software, developer, resources, detection, criteria, questions, scan, software, definitions, cloud, protection +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 07/13/2018 +--- + +# Software developer resources + +Concerned about the detection of your software? +If you believe that your application or program has been incorrectly detected by Microsoft security software, submit the relevant files for analysis. + +Check out the following resources for information on how to submit and view submissions: +- [Submit files](https://www.microsoft.com/en-us/wdsi/filesubmission) +- [View your submissions](https://www.microsoft.com/en-us/wdsi/submissionhistory) + +## Additional resources + +### Detection criteria + +To objectively identify malware and unidentified software, Microsoft applies a set of criteria for evaluating malicious or potentially harmful code. + +For more information, see + +### Developer questions + +Find more guidance about the file submission and detection dispute process in our FAQ for software developers. + +For more information, see + +### Scan your software + +Use Windows Defender Antivirus to check your software against the latest definitions and cloud protection from Microsoft. + +For more information, see \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/exploits-malware.md b/windows/security/threat-protection/intelligence/exploits-malware.md new file mode 100644 index 0000000000..252dc72d31 --- /dev/null +++ b/windows/security/threat-protection/intelligence/exploits-malware.md @@ -0,0 +1,56 @@ +--- +title: Exploits and exploit kits +description: Learn about exploits, how they can infect devices, and what you can do to protect yourself. +keywords: security, malware, exploits, exploit kits, prevention, vulnerabilities +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- +# Exploits and exploit kits + +Exploits take advantage of vulnerabilities in software. A vulnerability is like a hole in your software that malware can use to get onto your device. Malware exploits these vulnerabilities to bypass your computer's security safeguards to infect your device. + +## How exploits and exploit kits work + +Exploits are often the first part of a larger attack. Hackers scan for outdated systems that contain critical vulnerabilities, which they then exploit by deploying targeted malware. Exploits often include what's called "shellcode". This is a small malware payload that's used to download additional malware from attacker-controlled networks. This allows hackers to infect devices and infiltrate organizations. + +Exploit kits are more comprehensive tools that contain a collection of exploits. These kits scan devices for different kinds of software vulnerabilities and, if any are detected, deploys additional malware to further infect a device. Kits can use exploits targeting a variety of software, including Adobe Flash Player, Adobe Reader, Internet Explorer, Oracle Java and Sun Java. + +The most common method used by attackers to distribute exploits and exploit kits is through webpages, but exploits can also arrive in emails. Some websites unknowingly and unwillingly host malicious code and exploits in their ads. + +The infographic below shows how an exploit kit might attempt to exploit a device when a compromised webpage is visited. + +![example of how exploit kits work](./images/ExploitKit.png) + +*Example of how exploit kits work* + +Several notable threats, including Wannacry, exploit the Server Message Block (SMB) vulnerability CVE-2017-0144 to launch malware. + +Examples of exploit kits: + +- Angler / [Axpergle](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=JS%2fAxpergle) + +- [Neutrino](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=JS%2fNeutrino) + +- [Nuclear](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Exploit:JS/Neclu) + +To learn more about exploits, read this blog post on [taking apart a double zero-day sample discovered in joint hunt with ESET.](https://cloudblogs.microsoft.com/microsoftsecure/2018/07/02/taking-apart-a-double-zero-day-sample-discovered-in-joint-hunt-with-eset/) + +## How we name exploits + +We categorize exploits in our Malware encyclopedia by the "platform" they target. For example, Exploit:Java/CVE-2013-1489.A is an exploit that targets a vulnerability in Java. + +A project called "Common Vulnerabilities and Exposures (CVE)" is used by many security software vendors. The project gives each vulnerability a unique number, for example, CVE-2016-0778. +The portion "2016" refers to the year the vulnerability was discovered. The "0778" is a unique ID for this specific vulnerability. + +You can read more on the [CVE website](https://cve.mitre.org/). + +## How to protect against exploits + +The best prevention for exploits is to keep your organization's [software up to date](https://portal.msrc.microsoft.com/). Software vendors provide updates for many known vulnerabilities and making sure these updates are applied to all devices is an important step to prevent malware. + +For more general tips, see [prevent malware infection](prevent-malware-infection.md). diff --git a/windows/security/threat-protection/intelligence/images/CoordinatedMalware.png b/windows/security/threat-protection/intelligence/images/CoordinatedMalware.png new file mode 100644 index 0000000000..fb4ba80cec Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/CoordinatedMalware.png differ diff --git a/windows/security/threat-protection/intelligence/images/ExploitKit.png b/windows/security/threat-protection/intelligence/images/ExploitKit.png new file mode 100644 index 0000000000..9d0bb2f96a Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/ExploitKit.png differ diff --git a/windows/security/threat-protection/intelligence/images/NamingMalware1.png b/windows/security/threat-protection/intelligence/images/NamingMalware1.png new file mode 100644 index 0000000000..8d1e936879 Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/NamingMalware1.png differ diff --git a/windows/security/threat-protection/intelligence/images/PrevalentMalware-67-percent.png b/windows/security/threat-protection/intelligence/images/PrevalentMalware-67-percent.png new file mode 100644 index 0000000000..8e2221a40b Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/PrevalentMalware-67-percent.png differ diff --git a/windows/security/threat-protection/intelligence/images/PrevalentMalware0818.png b/windows/security/threat-protection/intelligence/images/PrevalentMalware0818.png new file mode 100644 index 0000000000..8e3fb0cfde Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/PrevalentMalware0818.png differ diff --git a/windows/security/threat-protection/intelligence/images/RealWorld-67-percent.png b/windows/security/threat-protection/intelligence/images/RealWorld-67-percent.png new file mode 100644 index 0000000000..9e011c0e6a Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/RealWorld-67-percent.png differ diff --git a/windows/security/threat-protection/intelligence/images/RealWorld0818.png b/windows/security/threat-protection/intelligence/images/RealWorld0818.png new file mode 100644 index 0000000000..f1768f8187 Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/RealWorld0818.png differ diff --git a/windows/security/threat-protection/intelligence/images/SupplyChain.png b/windows/security/threat-protection/intelligence/images/SupplyChain.png new file mode 100644 index 0000000000..491b55a690 Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/SupplyChain.png differ diff --git a/windows/security/threat-protection/intelligence/images/URLhover.png b/windows/security/threat-protection/intelligence/images/URLhover.png new file mode 100644 index 0000000000..d307a154e0 Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/URLhover.png differ diff --git a/windows/security/threat-protection/intelligence/images/WormUSB_flight.png b/windows/security/threat-protection/intelligence/images/WormUSB_flight.png new file mode 100644 index 0000000000..b1ad7c994f Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/WormUSB_flight.png differ diff --git a/windows/security/threat-protection/intelligence/images/av-comparatives-logo-3.png b/windows/security/threat-protection/intelligence/images/av-comparatives-logo-3.png new file mode 100644 index 0000000000..d7d3835e87 Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/av-comparatives-logo-3.png differ diff --git a/windows/security/threat-protection/intelligence/images/av-test-logo.png b/windows/security/threat-protection/intelligence/images/av-test-logo.png new file mode 100644 index 0000000000..cc8704dc7f Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/av-test-logo.png differ diff --git a/windows/security/threat-protection/intelligence/images/netflix.png b/windows/security/threat-protection/intelligence/images/netflix.png new file mode 100644 index 0000000000..446542e62a Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/netflix.png differ diff --git a/windows/security/threat-protection/intelligence/images/wdatp-pillars2.png b/windows/security/threat-protection/intelligence/images/wdatp-pillars2.png new file mode 100644 index 0000000000..8a67d190b7 Binary files /dev/null and b/windows/security/threat-protection/intelligence/images/wdatp-pillars2.png differ diff --git a/windows/security/threat-protection/intelligence/index.md b/windows/security/threat-protection/intelligence/index.md new file mode 100644 index 0000000000..07161132ac --- /dev/null +++ b/windows/security/threat-protection/intelligence/index.md @@ -0,0 +1,24 @@ +--- +title: Security intelligence +description: Safety tips about malware and how you can protect your organization +keywords: security, malware +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- +# Security intelligence + +Here you will find information about different types of malware, safety tips on how you can protect your organization, and resources for industry collaboration programs + +* [Understand malware & other threats](understanding-malware.md) +* [How Microsoft identifies malware and PUA](criteria.md) +* [Submit files for analysis](submission-guide.md) +* [Safety Scanner download](safety-scanner-download.md) + +Keep up with the latest malware news and research. Check out our [Windows security blogs](http://aka.ms/wdsecurityblog) and follow us on [Twitter](https://twitter.com/wdsecurity) for the latest news, discoveries, and protections. + +Learn more about [Windows security](https://docs.microsoft.com/windows/security/index). \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/macro-malware.md b/windows/security/threat-protection/intelligence/macro-malware.md new file mode 100644 index 0000000000..27bccb2f06 --- /dev/null +++ b/windows/security/threat-protection/intelligence/macro-malware.md @@ -0,0 +1,43 @@ +--- +title: Macro malware +description: Learn about how macro malware works, how it can infect devices, and what you can do to protect yourself. +keywords: security, malware, macro, protection +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- +# Macro malware + +Macros are a powerful way to automate common tasks in Microsoft Office and can make people more productive. However, macro malware uses this functionality to infect your device. + +## How macro malware works + +Macro malware hides in Microsoft Office files and are delivered as email attachments or inside ZIP files. These files use names that are intended to entice or scare people into opening them. They often look like invoices, receipts, legal documents, and more. + +Macro malware was fairly common several years ago because macros ran automatically whenever a document was opened. However, in recent versions of Microsoft Office, macros are disabled by default. This means malware authors need to convince users to turn on macros so that their malware can run. They do this by showing fake warnings when a malicious document is opened. + +We've seen macro malware download threats from the following families: + +* [Ransom:MSIL/Swappa](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:MSIL/Swappa.A) +* [Ransom:Win32/Teerac](Ransom:Win32/Teerac) +* [TrojanDownloader:Win32/Chanitor](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=TrojanDownloader:Win32/Chanitor.A) +* [TrojanSpy:Win32/Ursnif](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=TrojanSpy:Win32/Ursnif) +* [Win32/Fynloski](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32/Fynloski) +* [Worm:Win32/Gamarue](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Win32/Gamarue) + +## How to protect against macro malware + +* Make sure macros are disabled in your Microsoft Office applications. In enterprises, IT admins set the default setting for macros: + * [Enable or disable macros](https://support.office.com/article/Enable-or-disable-macros-in-Office-documents-7b4fdd2e-174f-47e2-9611-9efe4f860b12) in Office documents + +* Don’t open suspicious emails or suspicious attachments. + +* Delete any emails from unknown people or with suspicious content. Spam emails are the main way macro malware spreads. + +* Enterprises can prevent macro malware from running executable content using [ASR rules](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction#enable-and-audit-attack-surface-reduction-rules) + +For more general tips, see [prevent malware infection](prevent-malware-infection.md). \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/malware-naming.md b/windows/security/threat-protection/intelligence/malware-naming.md new file mode 100644 index 0000000000..35db2cac2b --- /dev/null +++ b/windows/security/threat-protection/intelligence/malware-naming.md @@ -0,0 +1,176 @@ +--- +title: Malware names +description: Identifying malware vocabulary +keywords: security, malware, names +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- +# Malware names + +We name the malware and unwanted software that we detect according to the Computer Antivirus Research Organization (CARO) malware naming scheme. The scheme uses the following format: + +![coordinated-malware-eradication](images/NamingMalware1.png) + +When our analysts research a particular threat, they will determine what each of the components of the name will be. + +## Type + +Describes what the malware does on your computer. Worms, viruses, trojans, backdoors, and ransomware are some of the most common types of malware. + +* Adware +* Backdoor +* Behavior +* BrowserModifier +* Constructor +* DDoS +* Exploit +* Hacktool +* Joke +* Misleading +* MonitoringTool +* Program +* PWS +* Ransom +* RemoteAccess +* Rogue +* SettingsModifier +* SoftwareBundler +* Spammer +* Spoofer +* Spyware +* Tool +* Trojan +* TrojanClicker +* TrojanDownloader +* TrojanNotifier +* TrojanProxy +* TrojanSpy +* VirTool +* Virus +* Worm + +## Platforms + +Indicates the operating system (such as Windows, Mac OS X, and Android) that the malware is designed to work on. The platform is also used to indicate programming languages and file formats. + +### Operating systems + +* AndroidOS: Android operating system +* DOS: MS-DOS platform +* EPOC: Psion devices +* FreeBSD: FreeBSD platform +* iPhoneOS: iPhone operating system +* Linux: Linux platform +* MacOS: MAC 9.x platform or earlier +* MacOS_X: MacOS X or later +* OS2: OS2 platform +* Palm: Palm operating system +* Solaris: System V-based Unix platforms +* SunOS: Unix platforms 4.1.3 or lower +* SymbOS: Symbian operating system +* Unix: general Unix platforms +* Win16: Win16 (3.1) platform +* Win2K: Windows 2000 platform +* Win32: Windows 32-bit platform +* Win64: Windows 64-bit platform +* Win95: Windows 95, 98 and ME platforms +* Win98: Windows 98 platform only +* WinCE: Windows CE platform +* WinNT: WinNT + +### Scripting languages + +* ABAP: Advanced Business Application Programming scripts +* ALisp: ALisp scripts +* AmiPro: AmiPro script +* ANSI: American National Standards Institute scripts +* AppleScript: compiled Apple scripts +* ASP: Active Server Pages scripts +* AutoIt: AutoIT scripts +* BAS: Basic scripts +* BAT: Basic scripts +* CorelScript: Corelscript scripts +* HTA: HTML Application scripts +* HTML: HTML Application scripts +* INF: Install scripts +* IRC: mIRC/pIRC scripts +* Java: Java binaries (classes) +* JS: Javascript scripts +* LOGO: LOGO scripts +* MPB: MapBasic scripts +* MSH: Monad shell scripts +* MSIL: .Net intermediate language scripts +* Perl: Perl scripts +* PHP: Hypertext Preprocessor scripts +* Python: Python scripts +* SAP: SAP platform scripts +* SH: Shell scripts +* VBA: Visual Basic for Applications scripts +* VBS: Visual Basic scripts +* WinBAT: Winbatch scripts +* WinHlp: Windows Help scripts +* WinREG: Windows registry scripts + +### Macros + +* A97M: Access 97, 2000, XP, 2003, 2007, and 2010 macros +* HE: macro scripting +* O97M: Office 97, 2000, XP, 2003, 2007, and 2010 macros - those that affect Word, Excel, and Powerpoint +* PP97M: PowerPoint 97, 2000, XP, 2003, 2007, and 2010 macros +* V5M: Visio5 macros +* W1M: Word1Macro +* W2M: Word2Macro +* W97M: Word 97, 2000, XP, 2003, 2007, and 2010 macros +* WM: Word 95 macros +* X97M: Excel 97, 2000, XP, 2003, 2007, and 2010 macros +* XF: Excel formulas +* XM: Excel 95 macros + +### Other file types + +* ASX: XML metafile of Windows Media .asf files +* HC: HyperCard Apple scripts +* MIME: MIME packets +* Netware: Novell Netware files +* QT: Quicktime files +* SB: StarBasic (Staroffice XML) files +* SWF: Shockwave Flash files +* TSQL: MS SQL server files +* XML: XML files + +## Family + +Grouping of malware based on common characteristics, including attribution to the same authors. Security software providers sometimes use different names for the same malware family. + +## Variant letter + +Used sequentially for every distinct version of a malware family. For example, the detection for the variant ".AF" would have been created after the detection for the variant ".AE". + +## Suffixes + +Provides extra detail about the malware, including how it is used as part of a multicomponent threat. In the example above, "!lnk" indicates that the threat component is a shortcut file used by Trojan:Win32/Reveton.T. + +* .dam: damaged malware +* .dll: Dynamic Link Library component of a malware +* .dr: dropper component of a malware +* .gen: malware that is detected using a generic signature +* .kit: virus constructor +* .ldr: loader component of a malware +* .pak: compressed malware +* .plugin: plug-in component +* .remnants: remnants of a virus +* .worm: worm component of that malware +* !bit: an internal category used to refer to some threats +* !cl: an internal category used to refer to some threats +* !dha: an internal category used to refer to some threats +* !pfn: an internal category used to refer to some threats +* !plock: an internal category used to refer to some threats +* !rfn: an internal category used to refer to some threats +* !rootkit: rootkit component of that malware +* @m: worm mailers +* @mm: mass mailer worm \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/phishing.md b/windows/security/threat-protection/intelligence/phishing.md new file mode 100644 index 0000000000..7449644117 --- /dev/null +++ b/windows/security/threat-protection/intelligence/phishing.md @@ -0,0 +1,139 @@ +--- +title: Phishing +description: Learn about how phishing work, deliver malware do your devices, and what you can do to protect yourself +keywords: security, malware, phishing, information, scam, social engineering, bait, lure, protection, trends, targeted attack +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- + +# Phishing + +Phishing attacks attempt to steal sensitive information through emails, websites, text messages, or other forms of electronic communication that often look to be official communication from legitimate companies or individuals. + +The information that phishers (as the cybercriminals behind phishing attacks are called) attempt to steal can be user names and passwords, credit card details, bank account information, or other credentials. Attackers can then use stolen information for malicious purposes, such as hacking, identity theft, or stealing money directly from bank accounts and credit cards. Phishers can also sell the information in cybercriminal underground marketplaces. + +## How phishing works + +Phishing attacks are scams that often use social engineering bait or lure content. For example, during tax season, bait content involves tax-filing announcements that attempt to lure you into providing your personal information such as your Social Security number or bank account information. + +Legitimate-looking communication, usually email, that links to a phishing site is one of the most common methods used in phishing attacks. The phishing site typically mimics sign-in pages that require users to input login credentials and account information. The phishing site then captures the sensitive information as soon as the user provides it, giving attackers access to the information. + +Another common phishing technique is the use of emails that direct you to open a malicious attachment, for example a PDF file. The attachment often contains a message asking you to provide login credentials to another site such as email or file sharing websites to open the document. When you access these phishing sites using your login credentials, the attacker now has access to your information and can gain additional personal information about you. + +## Phishing trends and techniques + +### Invoice phishing + +In this scam, the attacker attempts to lure you with an email stating that you have an outstanding invoice from a known vendor or company and provides a link for you to access and pay your invoice. When you access the site, the attacker is poised to steal your personal information and funds. + +### Payment/delivery scam + +You are asked to provide a credit card or other personal information so that your payment information can be updated with a commonly known vendor or supplier. The update is requested so that you can take delivery of your ordered goods. Generally, you may be familiar with the company and have likely done business with them in the past, but you are not aware of any items you have recently purchased from them. + +### Tax-themed phishing scams + +A common IRS phishing scams is one in which an urgent email letter is sent indicating that you owe money to the IRS. Often the email threatens legal action if you do not access the site in a timely manner and pay your taxes. When you access the site, the attackers can steal your personal credit card or bank information and drain your accounts. + +### Downloads + +Another frequently-used phishing scam is one in which an attacker sends a fraudulent email requesting you to open or download a document, often one requiring you to sign in. + +### Phishing emails that deliver other threats + +Phishing emails can be very effective, and so attackers can using them to distribute [ransomware](ransomware-malware.md) through links or attachments in emails. When run, the ransomware encrypts files and displays a ransom note, which asks you to pay a sum of money to access to your files. + +We have also seen phishing emails that have links to [tech support scam](support-scams.md) websites, which use various scare tactics to trick you into calling hotlines and paying for unnecessary "technical support services" that supposedly fix contrived device, platform, or software problems. + +## Targeted attacks against enterprises + +### Spear phishing + +Spear phishing is a targeted phishing attack that involves highly customized lure content. To perform spear phishing, attackers will typically do reconnaissance work, surveying social media and other information sources about their intended target. + +Spear phishing may involve tricking you into logging into fake sites and divulging credentials. Spear phishing may also be designed to lure you into opening documents by clicking on links that automatically install malware. With this malware in place, attackers can remotely manipulate the infected computer. + +The implanted malware serves as the point of entry for a more sophisticated attack known as an advanced persistent threat (APT). APTs are generally designed to establish control and steal data over extended periods. As part of the attack, attackers often try to deploy more covert hacking tools, move laterally to other computers, compromise or create privileged accounts, and regularly exfiltrate information from compromised networks. + +### Whaling + +Whaling is a form of phishing in which the attack is directed at high-level or senior executives within specific companies with the direct goal of gaining access to their credentials and/or bank information. The content of the email may be written as a legal subpoena, customer complaint, or other executive issue. This type of attack can also lead to an APT attack within an organization. When the links or attachment are opened, it can assist the attacker in accessing credentials and other personal information, or launch a malware that will lead to an APT. + +### Business email compromise + +Business email compromise (BEC) is a sophisticated scam that targets businesses often working with foreign suppliers and businesses that regularly perform wire transfer payments. One of the most common schemes used by BEC attackers involves gaining access to a company’s network through a spear phishing attack, where the attacker creates a domain similar to the company they are targeting or spoofs their email to scam users into releasing personal account information for money transfers. + +## How to protect against phishing attacks + +Social engineering attacks are designed to take advantage of a user's possible lapse in decision-making. Be aware and never provide sensitive or personal information through email or unknown websites, or over the phone. Remember, phishing emails are designed to appear legitimate. + +### Awareness + +The best protection is awareness and education. Don’t open attachments or click links in unsolicited emails, even if the emails came from a recognized source. If the email is unexpected, be wary about opening the attachment and verify the URL. + +Enterprises should educate and train their employees to be wary of any communication that requests personal or financial information, and instruct them to report the threat to the company’s security operations team immediately. + +Here are several telltale signs of a phishing scam: + +* The links or URLs provided in emails are **not pointing to the correct location** or are attempting to have you access a third-party site that is not affiliated with the sender of the email. For example, in the image below the URL provided does not match the URL that you will be taken to. + ![example of how exploit kits work](./images/URLhover.png) + +* There is a **request for personal information** such as social security numbers or bank or financial information. Official communications won't generally request personal information from you in the form of an email. + +* **Items in the email address will be changed** so that it is similar enough to a legitimate email address but has added numbers or changed letters. + +* The message is **unexpected and unsolicited**. If you suddenly receive an email from an entity or a person you rarely deal with, consider this email suspect. + +* The message or the attachment asks you to **enable macros, adjust security settings, or install applications**. Normal emails will not ask you to do this. + +* The message contains **errors**. Legitimate corporate messages are less likely to have typographic or grammatical errors or contain wrong information. + +* The **sender address does not match** the signature on the message itself. For example, an email is purported to be from Mary of Contoso Corp, but the sender address is john@example.com. + +* There are **multiple recipients** in the “To” field and they appear to be random addresses. Corporate messages are normally sent directly to individual recipients. + +* The greeting on the message itself **does not personally address you**. Apart from messages that mistakenly address a different person, those that misuse your name or pull your name directly from your email address tend to be malicious. + +* The website looks familiar but there are **inconsistencies or things that are not quite right** such as outdated logos, typos, or ask users to give additional information that is not asked by legitimate sign-in websites. + +* The page that opens is **not a live page** but rather an image that is designed to look like the site you are familiar with. A pop-up may appear that requests credentials. + +If in doubt, contact the business by known channels to verify if any suspicious emails are in fact legitimate. + +For more information, download and read this Microsoft [e-book on preventing social engineering attacks](https://info.microsoft.com/Protectyourweakestlink.html?ls=social), especially in enterprise environments. + +### Software solutions for organizations + +* [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/index) and [Windows Defender Application Guard](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview) offer protection from the increasing threat of targeted attacks using Microsoft's industry leading Hyper-V virtualization technology. If a browsed website is deemed untrusted, the Hyper-V container will isolate that device from the rest of your network thereby preventing access to your enterprise data. + +* [Microsoft Exchange Online Protection (EOP)](https://products.office.com/exchange/exchange-email-security-spam-protection) offers enterprise-class reliability and protection against spam and malware, while maintaining access to email during and after emergencies. Using various layers of filtering, EOP can provide different controls for spam filtering, such as bulk mail controls and international spam, that will further enhance your protection services. + +* Use [Office 365 Advanced Threat Protection (ATP)](https://products.office.com/exchange/online-email-threat-protection?ocid=cx-blog-mmpc) to help protect your email, files, and online storage against malware. It offers holistic protection in Microsoft Teams, Word, Excel, PowerPoint, Visio, SharePoint Online, and OneDrive for Business. By protecting against unsafe attachments and expanding protection against malicious links, it complements the security features of Exchange Online Protection to provide better zero-day protection. + +For more tips and software solutions, see [prevent malware infection](prevent-malware-infection.md). + +## What do I do if I've already been a victim of a phishing scam? + +If you feel that you have been a victim of a phishing attack, contact your IT Admin. You should also immediately change all passwords associated with the accounts, and report any fraudulent activity to your bank, credit card company, etc. + +### Reporting spam + +Submit phishing scam emails to **Microsoft** by sending an email with the scam as an attachment to: phish@office365.microsoft.com. For more information on submitting messages to Microsoft, see [Submit spam, non-spam, and phishing scam messages to Microsoft for analysis](https://docs.microsoft.com/en-us/office365/SecurityCompliance/submit-spam-non-spam-and-phishing-scam-messages-to-microsoft-for-analysis). + +For Outlook and Outlook on the web users, use the **Report Message Add-in** for Microsoft Outlook. For information about how to install and use this tool, see [Enable the Report Message add-in](https://support.office.com/article/4250c4bc-6102-420b-9e0a-a95064837676). + +Send an email with the phishing scam to **The Anti-Phishing Working Group**: reportphishing@apwg.org. The group uses reports generated from emails sent to fight phishing scams and hackers. ISPs, security vendors, financial institutions and law enforcement agencies are involved. + +## Where to find more information about phishing attacks + +For information on the latest Phishing attacks, techniques, and trends, you can read these entries on the [Windows Security blog](https://cloudblogs.microsoft.com/microsoftsecure/?product=windows,windows-defender-advanced-threat-protection): + +* [Phishers unleash simple but effective social engineering techniques using PDF attachments](https://cloudblogs.microsoft.com/microsoftsecure/2017/01/26/phishers-unleash-simple-but-effective-social-engineering-techniques-using-pdf-attachments/?source=mmpc) + +* [Tax themed phishing and malware attacks proliferate during the tax filing season](https://cloudblogs.microsoft.com/microsoftsecure/2017/03/20/tax-themed-phishing-and-malware-attacks-proliferate-during-the-tax-filing-season/?source=mmpc) + +* [Phishing like emails lead to tech support scam](https://cloudblogs.microsoft.com/microsoftsecure/2017/08/07/links-in-phishing-like-emails-lead-to-tech-support-scam/?source=mmpc) diff --git a/windows/security/threat-protection/intelligence/prevent-malware-infection.md b/windows/security/threat-protection/intelligence/prevent-malware-infection.md new file mode 100644 index 0000000000..012725bac4 --- /dev/null +++ b/windows/security/threat-protection/intelligence/prevent-malware-infection.md @@ -0,0 +1,117 @@ +--- +title: Prevent malware infection +description: Malware prevention best practices +keywords: security, malware, prevention, infection, tips +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- +# Prevent malware infection + +Malware authors are always looking for new ways to infect computers. Follow the simple tips below to stay protected and minimize threats to your data and accounts. + +You can also browse the many [software and application solutions](https://review.docs.microsoft.com/en-us/windows/security/intelligence/prevent-malware-infection?branch=wdsi-migration-stuff#software-solutions) available to you. + +## Keep software up-to-date + +[Exploits](exploits-malware.md) typically use vulnerabilities in popular software such as web browsers, Java, Adobe Flash Player, and Microsoft Office to infect devices. Software updates patch vulnerabilities so they aren't available to exploits anymore. + +To keep Microsoft software up to date, ensure that [automatic Microsoft Updates](https://support.microsoft.com/help/12373/windows-update-faq) are enabled. Also, upgrade to the latest version of Windows to benefit from a host of built-in security enhancements. + +## Be wary of links and attachments + +Email and other messaging tools are a few of the most common ways your device can get infected. Attachments or links in messages can open malware directly or can stealthily trigger a download. Some emails will give instructions to allow macros or other executable content designed to make it easier for malware to infect your devices. + +* Use an email service that provides protection against malicious attachments, links, and abusive senders. [Microsoft Office 365](https://support.office.com/article/Anti-spam-and-anti-malware-protection-in-Office-365-5ce5cf47-2120-4e51-a403-426a13358b7e) has built-in antimalware, link protection, and spam filtering. + +For more information, see [Phishing](phishing.md). + +## Watch out for malicious or compromised websites + +By visiting malicious or compromised sites, your device can get infected with malware automatically or you can get tricked into downloading and installing malware. See [exploits and exploit kits](exploits-malware.md) as an example of how some of these sites can automatically install malware to visiting computers. + +To identify potentially harmful websites, keep the following in mind: + +* The initial part (domain) of a website address should represent the company that owns the site you are visiting. Check the domain for misspellings. For example, malicious sites commonly use domain names that swap the letter O with a zero (0) or the letters L and I with a one (1). If example.com is spelled examp1e.com, the site you are visiting is suspect. + +* Sites that aggressively open popups and display misleading buttons often trick users into accepting content through constant popups or mislabeled buttons. + +To block malicious websites, use a modern web browser like [Microsoft Edge](http://www.microsoft.com/windows/microsoft-edge?ocid=cx-wdsi-articles) which identifies phishing and malware websites and checks downloads for malware. + +If you encounter an unsafe site, click **More […] > Send feedback** on Microsoft Edge. You can also [report unsafe sites directly to Microsoft](https://www.microsoft.com/wdsi/support/report-unsafe-site). + +### Pirated material on compromised websites + +Using pirated content is not only illegal, it can also expose your device to malware. Sites that offer pirated software and media are also often used to distribute malware when the site is visited. Sometimes pirated software is bundled with malware and other unwanted software when downloaded, including intrusive browser plugins and adware. + +Users do not openly discuss visits to these sites, so any untoward experience are more likely to stay unreported. + +To stay safe, download movies, music, and apps from official publisher websites or stores. Consider running a streamlined OS such as [Windows 10 Pro SKU S Mode](https://www.microsoft.com/windows/windows-10-s?ocid=cx-wdsi-articles), which ensures that only vetted apps from the Windows Store are installed. + +## Don't attach unfamiliar removable drives + +Some types of malware can spread by copying themselves to USB flash drives or other removable drives. There are malicious individuals that intentionally prepare and distribute infected drives—leaving these drives in public places to victimize unsuspecting individuals. + +Only use removable drives that you are familiar with or that come from a trusted source. If a drive has been used in publicly accessible devices, like computers in a café or a library, make sure you have antimalware running on your computer before you use the drive. Avoid opening unfamiliar files you find on suspect drives, including Office and PDF documents and executable files. + +## Use a non-administrator account + +At the time they are launched, whether inadvertently by a user or automatically, most malware run under the same privileges as the active user. This means that by limiting account privileges, you can prevent malware from making consequential changes any devices. + +By default, Windows uses [User Account Control (UAC)](https://docs.microsoft.com/windows/access-protection/user-account-control/user-account-control-overview) to provide automatic, granular control of privileges—it temporarily restricts privileges and prompts the active user every time an application attempts to make potentially consequential changes to the system. Although UAC helps limit the privileges of admin users, users can simply override this restriction when prompted. As a result, it is quite easy for an admin user to inadvertently allow malware to run. + +To help ensure that everyday activities do not result in malware infection and other potentially catastrophic changes, it is recommended that you use a non-administrator account for regular use. By using a non-administrator account, you can prevent installation of unauthorized apps and prevent inadvertent changes to system settings. Avoid browsing the web or checking email using an account with administrator privileges. + +Whenever necessary, log in as an administrator to install apps or make configuration changes that require admin privileges. + +[Read about creating user accounts and giving administrator privileges](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) + +## Other safety tips + +To further ensure that data is protected from malware as well as other threats: + +* Backup files. Follow the 3-2-1 rule: make **3 copies**, store in at least **2 locations**, with at least **1 offline copy**. Use [OneDrive](https://onedrive.live.com/about/?ocid=cx-wdsi-articles) for reliable cloud-based copies that allows access to files from multiple devices and helps recover damaged or lost files, including files locked by ransomware. + +* Be wary when connecting to public hotspots, particularly those that do not require authentication. + +* Use [strong passwords](https://support.microsoft.com/help/12410/microsoft-account-help-protect-account) and enable multi-factor authentication. + +* Do not use untrusted devices to log on to email, social media, and corporate accounts. + +## Software solutions + +Microsoft provides comprehensive security capabilities that help protect against threats. We recommend: + +* [Automatic Microsoft updates](https://support.microsoft.com/help/12373/windows-update-faq) keeps software up-to-date to get the latest protections. + +* [Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard) stops ransomware in its tracks by preventing unauthorized access to your important files. Controlled folder access locks down folders, allowing only authorized apps to access files. Unauthorized apps, including ransomware and other malicious executable files, DLLs, and scripts are denied access. + +* [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/index) browser protects against threats such as ransomware by preventing exploit kits from running. By using Microsoft [SmartScreen](https://docs.microsoft.com/en-us/microsoft-edge/deploy/index), Microsoft Edge blocks access to malicious websites. + +* [Microsoft Exchange Online Protection (EOP)](https://products.office.com/exchange/exchange-email-security-spam-protection) offers enterprise-class reliability and protection against spam and malware, while maintaining access to email during and after emergencies. + +* [Microsoft Safety Scanner](https://www.microsoft.com/wdsi/products/scanner) helps remove malicious software from computers. NOTE: This tool does not replace your antimalware product. + +* [Microsoft 365](https://docs.microsoft.com/microsoft-365/enterprise/#pivot=itadmin&panel=it-security) includes Office 365, Windows 10, and Enterprise Mobility + Security. These resources power productivity while providing intelligent security across users, devices, and data. + +* [Office 365 Advanced Threat Protection](https://technet.microsoft.com/library/exchange-online-advanced-threat-protection-service-description.aspx) includes machine learning capabilities that block dangerous emails, including millions of emails carrying ransomware downloaders. + +* [OneDrive for Business](https://support.office.com/article/restore-a-previous-version-of-a-file-in-onedrive-159cad6d-d76e-4981-88ef-de6e96c93893?ui=en-US&rs=en-US&ad=US) can back up files, which you would then use to restore files in the event of an infection. + +* [Windows Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection) provides comprehensive endpoint protection, detection, and response capabilities to help prevent ransomware. In the event of a breach, Windows Defender ATP alerts security operations teams about suspicious activities and automatically attempts to resolve the problem. This includes alerts for suspicious PowerShell commands, connecting to a TOR website, launching self-replicated copies, and deletion of volume shadow copies. Try Windows Defender ATP free of charge. + +* [Windows Hello for Business](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-identity-verification) replaces passwords with strong two-factor authentication on your devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN. It lets user authenticate to an Active Directory or Azure Active Directory account. + +### Earlier than Windows 10 (not recommended) + +* [Microsoft Security Essentials](https://www.microsoft.com/download/details.aspx?id=5201) provides real-time protection for your home or small business device that guards against viruses, spyware, and other malicious software. + +## What to do with a malware infection + +Windows Defender ATP antivirus capabilities helps reduce the chances of infection and will automatically remove threats that it detects. + +In case threat removal is unsuccessful, read about [troubleshooting malware detection and removal problems](https://www.microsoft.com/wdsi/help/troubleshooting-infection). \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/ransomware-malware.md b/windows/security/threat-protection/intelligence/ransomware-malware.md new file mode 100644 index 0000000000..484ae796f1 --- /dev/null +++ b/windows/security/threat-protection/intelligence/ransomware-malware.md @@ -0,0 +1,61 @@ +--- +title: Ransomware +description: Learn about ransomware, how it works, and what you can do to protect yourself. +keywords: security, malware, ransomware, encryption, extortion, money, key, infection, prevention, tips +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- +# Ransomware + +Ransomware is a type of malware that encrypts files and folders, preventing access to important files. Ransomware attempts to extort money from victims by asking for money, usually in form of cryptocurrencies, in exchange for the decryption key. But cybercriminals won't always follow through and unlock the files they encrypted. + +The trend towards increasingly sophisticated malware behavior, highlighted by the use of exploits and other attack vectors, makes older platforms especially susceptible to ransomware attacks. + +## How ransomware works + +Most ransomware infections start with: + +* Email messages with attachments that try to install ransomware. + +* Websites hosting [exploit kits](exploits-malware.md) that attempt to use vulnerabilities in web browsers and other software to install ransomware. + +Once ransomware infects a device, it starts encrypting files, folders, entire hard drive partitions using encryption algorithms like RSA or RC4. + +Ransomware is one of the most lucrative revenue channels for cybercriminals, so malware authors continually improve their malware code to better target enterprise environments. Ransomware-as-a-service is a cybercriminal business model in which malware creators sell their ransomware and other services to cybercriminals, who then operate the ransomware attacks. The business model also defines profit sharing between the malware creators, ransomware operators, and other parties that may be involved. For cybercriminals, ransomware is a big business, at the expense of individuals and businesses. + +### Examples + +Sophisticated ransomware like **Spora**, **WannaCrypt** (also known as WannaCry), and **Petya** (also known as NotPetya) spread to other computers via network shares or exploits. + +* Spora drops ransomware copies in network shares. + +* WannaCrypt exploits the Server Message Block (SMB) vulnerability CVE-2017-0144 (also called EternalBlue) to infect other computers. + +* A Petya variant exploits the same vulnerability, in addition to CVE-2017-0145 (also known as EternalRomance), and uses stolen credentials to move laterally across networks. + +Older ransomware like **Reveton** locks screens instead of encrypting files. They display a full screen image and then disable Task Manager. The files are safe, but they are effectively inaccessible. The image usually contains a message claiming to be from law enforcement that says the computer has been used in illegal cybercriminal activities and fine needs to be paid. Because of this, Reveton is nicknamed "Police Trojan" or "Police ransomware". + +Ransomware like **Cerber** and **Locky** search for and encrypt specific file types, typically document and media files. When the encryption is complete, the malware leaves a ransom note using text, image, or an HTML file with instructions to pay a ransom to recover files. + +**Bad Rabbit** ransomware was discovered attempting to spread across networks using hardcoded usernames and passwords in brute force attacks. + +## How to protect against ransomware + + Organizations can be targeted specifically by attackers, or they can be caught in the wide net cast by cybercriminal operations. Large organizations are high value targets and attackers can demand bigger ransoms. + +We recommend: + +* Back up important files regularly. Use the 3-2-1 rule. Keep three backups of your data, on two different storage types, and at least one backup offsite. + +* Apply the latest updates to your operating systems and apps. + +* Educate your employees so they can identify social engineering and spear-phishing attacks. + +* [Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard). It can stop ransomware from encrypting files and holding the files for ransom. + +For more general tips, see [prevent malware infection](prevent-malware-infection.md). \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/rootkits-malware.md b/windows/security/threat-protection/intelligence/rootkits-malware.md new file mode 100644 index 0000000000..9ceee1ebb4 --- /dev/null +++ b/windows/security/threat-protection/intelligence/rootkits-malware.md @@ -0,0 +1,59 @@ +--- +title: Rootkits +description: Learn about rootkits, how they hide malware on your device, and what you can do to protect yourself. +keywords: security, malware, rootkit, hide, protection, hiding +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- +# Rootkits + +Malware authors use rootkits to hide malware on your device, allowing malware to persist as long as possible. A successful rootkit can potentially remain in place for years if it is undetected. During this time it will steal information and resources. + +## How rootkits work + +Rootkits intercept and change standard operating system processes. After a rootkit infects a device, you can’t trust any information that device reports about itself. + +For example, if you were to ask a device to list all of the programs that are running, the rootkit might stealthily remove any programs it doesn’t want you to know about. Rootkits are all about hiding things. They want to hide both themselves and their malicious activity on a device. + +Many modern malware families use rootkits to try and avoid detection and removal, including: + +* [Alureon](http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fAlureon) + +* [Cutwail](http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fCutwail) + +* [Datrahere](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win64/Detrahere) (Zacinlo) + +* [Rustock](http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Win32%2fRustock) + +* [Sinowal](http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fSinowal) + +* [Sirefef](http://www.microsoft.com/security/portal/threat/encyclopedia/Entry.aspx?Name=Win32%2fSirefef) + +## How to protect against rootkits + +Like any other type of malware, the best way to avoid rootkits is to prevent it from being installed in the first place. + +* Apply the latest updates to operating systems and apps. + +* Educate your employees so they can be wary of suspicious websites and emails. + +* Back up important files regularly. Use the 3-2-1 rule. Keep three backups of your data, on two different storage types, and at least one backup offsite. + +For more general tips, see [prevent malware infection](prevent-malware-infection.md). + +### What if I think I have a rootkit on my device? + +Microsoft security software includes a number of technologies designed specifically to remove rootkits. If you think you might have a rootkit on your device and your antimalware software isn’t detecting it, you might need an extra tool that lets you boot to a known trusted environment. + +[Windows Defender Offline](http://windows.microsoft.com/windows/what-is-windows-defender-offline) can be launched from Windows Security Center and has the latest anti-malware updates from Microsoft. It’s designed to be used on devices that aren't working correctly due to a possible malware infection. + +[System Guard](https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/hardening-the-system-and-maintaining-integrity-with-windows-defender-system-guard/) in Windows 10 protects against rootkits and threats that impact system integrity. + +### What if I can’t remove a rootkit? + +If the problem persists, we strongly recommend reinstalling the operating system and security software. You should then restore your data from a backup. diff --git a/windows/security/threat-protection/intelligence/safety-scanner-download.md b/windows/security/threat-protection/intelligence/safety-scanner-download.md new file mode 100644 index 0000000000..46d99ff069 --- /dev/null +++ b/windows/security/threat-protection/intelligence/safety-scanner-download.md @@ -0,0 +1,43 @@ +--- +title: Microsoft Safety Scanner Download +description: Get the Microsoft Safety Scanner tool to find and remove malware from Windows computers. +keywords: security, malware +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: high +ms.author: dansimp +author: dansimp +ms.date: 08/01/2018 +--- +# Microsoft Safety Scanner +Microsoft Safety Scanner is a scan tool designed to find and remove malware from Windows computers. Simply download it and run a scan to find malware and try to reverse changes made by identified threats. + +- [Download 32-bit](https://go.microsoft.com/fwlink/?LinkId=212733) + +- [Download 64-bit](https://go.microsoft.com/fwlink/?LinkId=212732) + +Safety Scanner only scans when manually triggered and is available for use 10 days after being downloaded. We recommend that you always download the latest version of this tool before each scan. + +> **NOTE:** This tool does not replace your antimalware product. For real-time protection with automatic updates, use [Windows Defender Antivirus on Windows 10 and Windows 8](https://www.microsoft.com/en-us/windows/windows-defender) or [Microsoft Security Essentials on Windows 7](https://support.microsoft.com/en-us/help/14210/security-essentials-download). These antimalware products also provide powerful malware removal capabilities. If you are having difficulties removing malware with these products, you can refer to our help on [removing difficult threats](https://www.microsoft.com/en-us/wdsi/help/troubleshooting-infection). + +## System requirements +Safety Scanner helps remove malicious software from computers running Windows 10, Windows 10 Tech Preview, Windows 8.1, Windows 8, Windows 7, Windows Server 2016, Windows Server Tech Preview, Windows Server 2012 R2, Windows Server 2012, Windows Server 2008 R2, or Windows Server 2008. Please refer to the [Microsoft Lifecycle Policy](https://support.microsoft.com/en-us/lifecycle). + +## How to run a scan +1. Download this tool and open it. +2. Select the type of scan you want run and start the scan. +3. Review the scan results displayed on screen. The tool lists all identified malware. + +To remove this tool, delete the executable file (msert.exe by default). + +For more information about the Safety Scanner, see the support article on [how to troubleshoot problems using Safety Scanner](https://support.microsoft.com/en-us/kb/2520970). + +## Related resources + +- [Troubleshooting Safety Scanner](https://support.microsoft.com/en-us/kb/2520970) +- [Windows Defender Antivirus](https://www.microsoft.com/en-us/windows/windows-defender) +- [Microsoft Security Essentials](https://support.microsoft.com/en-us/help/14210/security-essentials-download) +- [Removing difficult threats](https://www.microsoft.com/en-us/wdsi/help/troubleshooting-infection) +- [Submit file for malware analysis](https://www.microsoft.com/en-us/wdsi/filesubmission) +- [Microsoft antimalware and threat protection solutions](https://www.microsoft.com/en-us/wdsi/products) \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/submission-guide.md b/windows/security/threat-protection/intelligence/submission-guide.md new file mode 100644 index 0000000000..b72568d223 --- /dev/null +++ b/windows/security/threat-protection/intelligence/submission-guide.md @@ -0,0 +1,76 @@ +--- +title: How Microsoft identifies malware and potentially unwanted applications +description: criteria +keywords: security, malware +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/01/2018 +--- + +# Submit files for analysis + +If you have a file that you suspect might be malware or is being incorrectly detected, you can submit it to us for analysis. This page has answers to some common questions about submitting a file for analysis. + +## How do I send a malware file to Microsoft? + +You can send us files that you think might be malware or files that have been incorrectly detected through the [sample submission portal](https://www.microsoft.com/wdsi/filesubmission). + +We receive a large number of samples from many sources. Our analysis is prioritized by the number of file detections and the type of submission. You can help us complete a quick analysis by providing detailed information about the product you were using and what you were doing when you found the file. + +If you sign in before you submit a sample, you will be able to track your submissions. + +## Can I send a sample by email? + +No, we only accept submissions through our [sample submission portal](https://www.microsoft.com/wdsi/filesubmission). + +## Can I submit a sample without signing in? + +Yes, you many submit a file as an anonymous home customer. You will get a link to a webpage where you can view the status of the submission. + +If you're an enterprise customer, you need to sign in so that we can prioritize your submission appropriately. If you are currently experiencing a virus outbreak or security-related incident, you should contact your designated Microsoft support professional or go to [Microsoft Support](https://support.microsoft.com/) for immediate assistance. + +## What is the Software Assurance ID (SAID)? + +The [Software Assurance ID (SAID)](https://www.microsoft.com/licensing/licensing-programs/software-assurance-default.aspx) is for enterprise customers to track support entitlements. The submission portal accepts and retains SAID information and allows customers with valid SAIDs to make higher priority submissions. + +### How do I dispute the detection of my program? + +[Submit the file](https://www.microsoft.com/wdsi/filesubmission) in question as a software developer. Wait until your submission has a final determination. + +If you’re not satisfied with our determination of the submission, use the developer contact form provided with the submission results to reach Microsoft. We will use the information you provide to investigate further if necessary. + +We encourage all software vendors and developers to read about [how Microsoft identifies malware and unwanted software](criteria.md). + +## How do I track or view past sample submissions? + +You can track your submissions through the [submission history page](https://www.microsoft.com/en-us/wdsi/submissionhistory). Your submission will only appear on this page if you were signed in when you submitted it. + +If you’re not signed in when you submit a sample, you will be redirected to a tracking page. Bookmark this page if you want to come back and check on the status of your submission. + +## What does the submission status mean? + +Each submission is shown to be in one of the following status types: + +* Submitted—the file has been received + +* In progress—an analyst has started checking the file + +* Closed—a final determination has been given by an analyst + +If you are signed in, you can see the status of any files you submit to us on the [submission history page](https://www.microsoft.com/en-us/wdsi/submissionhistory). + +## How does Microsoft prioritize submissions + +Processing submissions take dedicated analyst resource. Because we regularly receive a large number of submissions, we handle them based on a priority. The following factors affect how we prioritize submissions: + +* Prevalent files with the potential to impact large numbers of computers are prioritized. + +* Authenticated customers, especially enterprise customers with valid [Software Assurance IDs (SAIDs)](https://www.microsoft.com/licensing/licensing-programs/software-assurance-default.aspx), are given priority. + +* Submissions flagged as high priority by SAID holders are given immediate attention. + +Your submission is immediately scanned by our systems to give you the latest determination even before an analyst starts handling your case. Note that the same file may have already been processed by an analyst. To check for updates to the determination, select rescan on the submission details page. diff --git a/windows/security/threat-protection/intelligence/supply-chain-malware.md b/windows/security/threat-protection/intelligence/supply-chain-malware.md new file mode 100644 index 0000000000..ce1112d198 --- /dev/null +++ b/windows/security/threat-protection/intelligence/supply-chain-malware.md @@ -0,0 +1,57 @@ +--- +title: Supply chain attacks +description: Learn about how supply chain attacks work, deliver malware do your devices, and what you can do to protect yourself +keywords: security, malware, protection, supply chain, hide, distribute, trust, compromised +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- + +# Supply chain attacks + +Supply chain attacks are an emerging kind of threat that target software developers and suppliers. The goal is to access source codes, build processes, or update mechanisms by infecting legitimate apps to distribute malware. + +## How supply chain attacks work + +Attackers hunt for unsecure network protocols, unprotected server infrastructures, and unsafe coding practices. They break in, change source codes, and hide malware in build and update processes. + +Because software is built and released by trusted vendors, these apps and updates are signed and certified. In software supply chain attacks, vendors are likely unaware that their apps or updates are infected with malicious code when they’re released to the public. The malicious code then runs with the same trust and permissions as the app. + +The number of potential victims is significant, given the popularity of some apps. A case occurred where a free file compression app was poisoned and deployed to customers in a country where it was the top utility app. + +### Types of supply chain attacks + +* Compromised software building tools or updated infrastructure + +* Stolen code-sign certificates or signed malicious apps using the identity of dev company + +* Compromised specialized code shipped into hardware or firmware components + +* Pre-installed malware on devices (cameras, USB, phones, etc.) + +To learn more about supply chain attacks, read this blog post called [attack inception: compromised supply chain within a supply chain poses new risks](https://cloudblogs.microsoft.com/microsoftsecure/2018/07/26/attack-inception-compromised-supply-chain-within-a-supply-chain-poses-new-risks/). + +## How to protect against supply chain attacks + +* Deploy strong code integrity policies to allow only authorized apps to run. + +* Use endpoint detection and response solutions that can automatically detect and remediate suspicious activities. + +### For software vendors and developers + +* Take steps to ensure your apps are not compromised. + +* Maintain a secure and up-to-date infrastructure. Restrict access to critical build systems. + * Immediately apply security patches for OS and software. + + * Require multi-factor authentication for admins. + +* Build secure software update processes as part of the software development lifecycle. + +* Develop an incident response process for supply chain attacks. + +For more general tips on protecting your systems and devices, see [prevent malware infection](prevent-malware-infection.md). \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/support-scams.md b/windows/security/threat-protection/intelligence/support-scams.md new file mode 100644 index 0000000000..821900539a --- /dev/null +++ b/windows/security/threat-protection/intelligence/support-scams.md @@ -0,0 +1,63 @@ +--- +title: Tech Support Scams +description: Learn about how supply chain attacks work, deliver malware do your devices, and what you can do to protect yourself +keywords: security, malware, tech support, scam, protection, trick, spoof, fake, error messages, report +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- +# Tech support scams + +Tech support scams are an industry-wide issue where scammers use scare tactics to trick users into paying for unnecessary technical support services that supposedly fix contrived device, platform, or software problems. + +## How tech support scams work + +Scammers may call you directly on your phone and pretend to be representatives of a software company. They might even spoof the caller ID so that it displays a legitimate support phone number from a trusted company. They can then ask you to install applications that give them remote access to your device. Using remote access, these experienced scammers can misrepresent normal system output as signs of problems. + +Scammers might also initiate contact by displaying fake error messages on websites you visit, displaying support numbers and enticing you to call. They can also put your browser on full screen and display pop-up messages that won't go away, essentially locking your browser. These fake error messages aim to trick you into calling an indicated technical support hotline. Note that Microsoft error and warning messages never include phone numbers. + +When you engage with the scammers, they can offer fake solutions for your “problems” and ask for payment in the form of a one-time fee or subscription to a purported support service. + +**For more information, view [known tech support scam numbers and popular web scams](https://support.microsoft.com/en-us/help/4013405/windows-protect-from-tech-support-scams).** + +## How to protect against tech support scams + +Share and implement the general tips on how to [prevent malware infection](prevent-malware-infection.md). + +It is also important to keep the following in mind: + +* Microsoft does not send unsolicited email messages or make unsolicited phone calls to request personal or financial information, or to fix your computer. + +* Any communication with Microsoft has to be initiated by you. + +* Don’t call the number in the pop-ups. Microsoft’s error and warning messages never include a phone number. + +* Download software only from official vendor websites or the Microsoft Store. Be wary of downloading software from third-party sites, as some of them might have been modified without the author’s knowledge to bundle support scam malware and other threats. + +* Use [Microsoft Edge](https://www.microsoft.com/windows/microsoft-edge) when browsing the internet. It blocks known support scam sites using Windows Defender SmartScreen (which is also used by Internet Explorer). Furthermore, Microsoft Edge can stop pop-up dialogue loops used by these sites. + +* Enable Enable [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) in Windows 10. It detects and removes known support scam malware. + +## What to do if information has been given to a tech support person + +* Uninstall applications that scammers asked to be install. If access has been granted, consider resetting the device + +* Run a full scan with Windows Defender Antivirus to remove any malware. Apply all security updates as soon as they are available. + +* Change passwords. + +* Call your credit card provider to reverse the charges, if you have already paid. + +* Monitor anomalous logon activity. Use Windows Defender Firewall to block traffic to services that you would not normally access. + +### Reporting tech support scams + +Help Microsoft stop scammers, whether they claim to be from Microsoft or from another tech company, by reporting tech support scams: + +**www.microsoft.com/reportascam** + +You can also report any **unsafe website** that you suspect is a phishing website or contains malicious content directly to Microsoft by filling out a [Report an unsafe site form](https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site) or using built in web browser functionality. \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/trojans-malware.md b/windows/security/threat-protection/intelligence/trojans-malware.md new file mode 100644 index 0000000000..f3974e7341 --- /dev/null +++ b/windows/security/threat-protection/intelligence/trojans-malware.md @@ -0,0 +1,42 @@ +--- +title: Trojan malware +description: Learn about how trojans work, deliver malware do your devices, and what you can do to protect yourself. +keywords: security, malware, protection, trojan, download, file, infection +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- + +# Trojans + +Trojans are a common type of malware which, unlike viruses, can’t spread on their own. This means they either have to be downloaded manually or another malware needs to download and install them. + +Trojans often use the same file names as real and legitimate apps. It is easy to accidentally download a trojan thinking that it is a legitimate app. + +## How trojans work + +Trojans can come in many different varieties, but generally they do the following: + +- Download and install other malware, such as viruses or [worms](worms-malware.md). + +- Use the infected device for click fraud. + +- Record keystrokes and websites visited. + +- Send information about the infected device to a malicious hacker including passwords, login details for websites, and browsing history. + +- Give a malicious hacker control over the infected device. + +## How to protect against trojans + +Use the following free Microsoft software to detect and remove it: + +- [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) for Windows 10 and Windows 8.1, or [Microsoft Security Essentials](https://www.microsoft.com/download/details.aspx?id=5201) for previous versions of Windows. + +- [Microsoft Safety Scanner](https://www.microsoft.com/wdsi/products/scanner) + +For more general tips, see [prevent malware infection](prevent-malware-infection.md). \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/understanding-malware.md b/windows/security/threat-protection/intelligence/understanding-malware.md new file mode 100644 index 0000000000..a96d24adc6 --- /dev/null +++ b/windows/security/threat-protection/intelligence/understanding-malware.md @@ -0,0 +1,39 @@ +--- +title: Understanding malware & other threats +description: Learn about the different types of malware, how they work, and what you can do to protect yourself. +keywords: security, malware +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- +# Understanding malware & other threats + +Malware is a term used to describe malicious applications and code that can cause damage and disrupt normal use of devices. Malware can allow unauthorized access, use system resources, steal passwords, lock you out of your computer and ask for ransom, and more. + +Cybercriminals that distribute malware are often motivated by money and will use infected computers to launch attacks, obtain banking credentials, collect information that can be sold, sell access to computing resources, or extort payment from victims. + +As criminals become more sophisticated with their attacks, Microsoft is here to help. Windows 10 is the most secure version of Windows yet and includes many features to help protect you whether you're at home, at work, or on the go. With Windows Defender Advanced Threat Protection (Windows Defender ATP), businesses can stay protected with next-generation protection and other security capabilities. + +For good general tips, check out the [prevent malware infection](prevent-malware-infection.md) topic. + +There are many types of malware, including: + +- [Coin miners](coinminer-malware.md) +- [Exploits and exploit kits](exploits-malware.md) +- [Macro malware](macro-malware.md) +- [Phishing](phishing.md) +- [Ransomware](ransomware-malware.md) +- [Rootkits](rootkits-malware.md) +- [Supply chain attacks](supply-chain-malware.md) +- [Tech support scams](support-scams.md) +- [Trojans](trojans-malware.md) +- [Unwanted software](unwanted-software.md) +- [Worms](worms-malware.md) + +Keep up with the latest malware news and research. Check out our [Windows security blogs](http://aka.ms/wdsecurityblog) and follow us on [Twitter](https://twitter.com/wdsecurity) for the latest news, discoveries, and protections. + +Learn more about [Windows security](https://docs.microsoft.com/en-us/windows/security/index). \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/unwanted-software.md b/windows/security/threat-protection/intelligence/unwanted-software.md new file mode 100644 index 0000000000..bff16819a8 --- /dev/null +++ b/windows/security/threat-protection/intelligence/unwanted-software.md @@ -0,0 +1,60 @@ +--- +title: Unwanted software +description: Learn about how unwanted software changes your default settings without your consent and what you can do to protect yourself. +keywords: security, malware, protection, unwanted, software, alter, infect +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- +# Unwanted software + +Unwanted software are programs that alter the Windows experience without your consent or control. This can take the form of modified browsing experience, lack of control over downloads and installation, misleading messages, or unauthorized changes to Windows settings. + +## How unwanted software works + +Unwanted software can be introduced when a user searches for and downloads applications from the internet. Some applications are software bundlers, which means that they are packed with other applications. As a result, other programs can be inadvertently installed when the original application is downloaded. + +Here are some indications of unwanted software: + +- There are programs that you did not install and that may be difficult to uninstall + +- Browser features or settings have changed, and you can’t view or modify them + +- There are excessive messages about your device's health or about files and programs + +- There are ads that cannot be easily closed + +Some indicators are harder to recognize because they are less disruptive, but are still unwanted. For example, unwanted software can modify web pages to display specific ads, monitor browsing activities, or remove control of the browser. + +Microsoft uses an extensive [evaluation criteria](https://www.microsoft.com/wdsi/antimalware-support/malware-and-unwanted-software-evaluation-criteria) to identify unwanted software. + +## How to protect against unwanted software + +To prevent unwanted software infection, download software only from official websites, or from the Microsoft Store. Be wary of downloading software from third-party sites. + +Use [Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/index) when browsing the internet. Microsoft Edge includes additional protections that effectively block browser modifiers that can change your browser settings. Microsoft Edge also blocks known websites hosting unwanted software using [SmartScreen](https://docs.microsoft.com/en-us/microsoft-edge/deploy/index) (also used by Internet Explorer). + +Enable [Windows Defender AV](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) in Windows 10. It provides real-time protection against threats and detects and removes known unwanted software. + +Download [Microsoft Security Essentials](https://www.microsoft.com/download/details.aspx?id=5201) for real-time protection in Windows 7 or Windows Vista. + +For more general tips, see [prevent malware infection](prevent-malware-infection.md). + +### What should I do if my device is infected? + +If you suspect that you have unwanted software, you can [submit files for analysis](https://www.microsoft.com/wdsi/filesubmission). + +Some unwanted software adds uninstallation entries, which means that you can **remove them using Settings**. +1. Select the Start button +2. Go to **Settings > Apps > Apps & features**. +3. Select the app you want to uninstall, then click **Uninstall**. + +If you only recently noticed symptoms of unwanted software infection, consider sorting the apps by install date, and then uninstall the most recent apps that you did not install. + +You may also need to **remove browser add-ons** in your browsers, such as Internet Explorer, Firefox, or Chrome. + +In case threat removal is unsuccessful, read about [troubleshooting malware detection and removal problems](https://www.microsoft.com/wdsi/help/troubleshooting-infection). diff --git a/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md b/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md new file mode 100644 index 0000000000..fdf32ac7d8 --- /dev/null +++ b/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md @@ -0,0 +1,51 @@ +--- +title: Virus Information Alliance +description: Information and criteria regarding VIA +keywords: security, malware +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 07/12/2018 +--- +# Virus Information Alliance + +The Virus Information Alliance (VIA) is a public antimalware collaboration program for security software providers, security service providers, antimalware testing organizations, and other organizations involved in fighting cybercrime. + +Members of the VIA program collaborate by exchanging technical information on malicious software with Microsoft, with the goal of improving protection for Microsoft customers. + +## Better protection for customers against malware + +The VIA program gives members access to information that will help improve protection for Microsoft customers. For example, the program provides malware telemetry and samples to security product teams to identify gaps in their protection and prioritize new threat coverage. + +Malware prevalence data is provided to antimalware testers to assist them in selecting sample sets and setting scoring criteria that represent the real-world threat landscape. Service organizations, such as a CERT, can leverage our data to help assess the impact of policy changes or to help shut down malicious activity. + +Microsoft is committed to continuous improvement to help reduce the impact of malware on customers. By sharing malware-related information, Microsoft enables members of this community to work towards better protection for customers. + +## Becoming a member of VIA + +Microsoft has well-defined, objective, measurable, and tailored membership criteria for prospective members of the Virus Information Alliance (VIA). The criteria is designed to ensure that Microsoft is able to work with security software providers, security service providers, antimalware testing organizations, and other organizations involved in the fight against cybercrime to protect a broad range of customers. + +Members will receive information to facilitate effective malware detection, deterrence, and eradication. This includes technical information on malware as well as metadata on malicious activity. Information shared through VIA is governed by the VIA membership agreement and a Microsoft non-disclosure agreement, where applicable. + +VIA has an open enrollment for potential members. + +### Initial selection criteria + +To be eligible for VIA your organization must: + +1. Be willing to sign a non-disclosure agreement with Microsoft. + +2. Fit into one of the following categories: + * Your organization develops antimalware technology that can run on Windows and your organization’s product is commercially available. + * Your organization provides security services to Microsoft customers or for Microsoft products. + * Your organization publishes antimalware testing reports on a regular basis. + * Your organization has a research or response team dedicated to fighting malware to protect your organization, your customers, or the general public. + +3. Be willing to sign and adhere to the VIA membership agreement. + +If your organization wants to apply and meets this criteria, you can apply using our [membership application form](http://www.microsoft.com/security/portal/partnerships/apply.aspx). + +If you have any questions, you can also contact us using our [partnerships contact form](http://www.microsoft.com/security/portal/partnerships/contactus.aspx). \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/virus-initiative-criteria.md b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md new file mode 100644 index 0000000000..d61818ec93 --- /dev/null +++ b/windows/security/threat-protection/intelligence/virus-initiative-criteria.md @@ -0,0 +1,57 @@ +--- +title: Microsoft Virus Initiative +description: Information and criteria regarding MVI +keywords: security, malware +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 07/12/2018 +--- + +# Microsoft Virus Initiative + +The Microsoft Virus Initiative (MVI) helps organizations to get their products working and integrated with Windows. + +Like the [Virus Information Alliance (VIA)](virus-information-alliance-criteria.md) and the [Coordinated Malware Eradication (CME) program](coordinated-malware-eradication.md), MVI aims to share information about the threat landscape that can help your organization protect its customers. + +MVI members will receive access to Windows APIs (such as those used by Windows Defender Security Center, IOAV, AMSI and Cloud Files), malware telemetry and samples, and invitations to security related events and conferences. + +MVI adds to VIA by requiring members to develop and own antimalware technology, and to be present in the antimalware industry community. + +## Join MVI + +A request for membership is made by an individual as a representative of an organization that develops and produces antimalware or antivirus technology. + +The base criteria for MVI membership are the same as for VIA, but your organization must also offer an antimalware or antivirus product. + +### Initial selection criteria + +Your organization must meet the following eligibility requirements to participate in the MVI program: + +1. Offer an antimalware or antivirus product that is one of the following: + + * Your organization's own creation. + * Licensed from another organization, but your organization adds value such as additional definitions to its signatures. + * Developed by using an SDK (engine and other components) from another MVI Partner AM company and your organization adds a custom UI and/or other functionality (white box versions). + +2. Have your own malware research team unless you distribute a Whitebox product. + +3. Be active and have a positive reputation in the antimalware industry. Your organization is: + + * Certified through independent testing by an industry standard organization such as [ICSA Labs](https://www.icsalabs.com/), [West Coast Labs](http://www.westcoastlabs.com/), [PCSL IT Consulting Institute](https://www.pitci.net/), or [SKD Labs](http://www.skdlabs.com/html/english/). + * Be active in the antimalware industry. For example, participate in industry conferences, be reviewed in an industry standard report such as AV Comparatives, OPSWAT or Gartner. + +4. Be willing to sign a non-disclosure agreement (NDA) with Microsoft. + +5. Be willing to sign a program license agreement. + +6. Be willing to adhere to program requirements for AM apps. These requirements define the behavior of AM apps necessary to ensure proper interaction with Windows. + +7. Submit your AM app to Microsoft for periodic performance testing. + +### Apply to MVI + +If your organization wants to apply and meets this criteria, you can apply using our [membership application form](http://www.microsoft.com/security/portal/partnerships/apply.aspx). \ No newline at end of file diff --git a/windows/security/threat-protection/intelligence/worms-malware.md b/windows/security/threat-protection/intelligence/worms-malware.md new file mode 100644 index 0000000000..f1e88eb03c --- /dev/null +++ b/windows/security/threat-protection/intelligence/worms-malware.md @@ -0,0 +1,48 @@ +--- +title: Worms +description: Learn about worms, how they infect devices, and what you can do to protect yourself. +keywords: security, malware, protection, worm, vulnerabilities, infect, steal, Jenxcus, Gamarue, Bondat, WannaCrypt +ms.prod: w10 +ms.mktglfcycl: secure +ms.sitesec: library +ms.localizationpriority: medium +ms.author: ellevin +author: levinec +ms.date: 08/17/2018 +--- + +# Worms + +A worm is a type of malware that can copy itself and often spreads through a network by exploiting security vulnerabilities. It can spread through email attachments, text messages, file-sharing programs, social networking sites, network shares, removable drives, and software vulnerabilities. + +## How worms work + +Worms represent a large category of malware. Different worms use different methods to infect devices. Depending on the variant, they can steal sensitive information, change security settings, send information to malicious hackers, stop users from accessing files, and other malicious activities. + +Jenxcus (also known as Dunihi), Gamarue (also known as Androm), and Bondat have consistently remained at the top of the list of malware that infect users running Microsoft security software. Although these worms share some commonalities, it is interesting to note that they also have distinct characteristics. + +* **Jenxcus** has capabilities of not only infecting removable drives but can also act as a backdoor that connects back to its server. This threat typically gets into a device from a drive-by download attack, meaning it's installed when users just visit a compromised web page. + +* **Gamarue** typically arrives through spam campaigns, exploits, downloaders, social networking sites, and removable drives. When Gamarue infects a device, it becomes a distribution channel for other malware. We’ve seen it distribute other malware such as infostealers, spammers, clickers, downloaders, and rogues. + +* **Bondat** typically arrives through fictitious Nullsoft Sciptable Install System (NSIS) Java installers and removable drives. When Bondat infects a system, it gathers information about the machine such as device name, Globally Unique Identifier (GUID), and OS build. It then sends that information to a remote server. + +Both Bondat and Gamarue have clever ways of obscuring themselves to evade detection. By hiding what they are doing, they try to avoid detection by security software. + +* [**WannaCrypt**](https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/WannaCrypt) also deserves a mention here. Unlike older worms that often spread just because they could, modern worms often spread to drop a payload (e.g. ransomware). + +This image shows how a worm can quickly spread through a shared USB drive. + +![Worm example](./images/WormUSB_flight.png) + +### *Figure worm spreading from a shared USB drive* + +## How to protect against worms + +Enable [Windows Defender AV](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) in Windows 10. It provides real-time protection against threats and detects and removes known unwanted software. + +Download [Microsoft Security Essentials](https://www.microsoft.com/download/details.aspx?id=5201) for real-time protection in Windows 7 or Windows Vista. + +In case threat removal is unsuccessful, read about [troubleshooting malware detection and removal problems](https://www.microsoft.com/wdsi/help/troubleshooting-infection). + +For more general tips, see [prevent malware infection](prevent-malware-infection.md). \ No newline at end of file diff --git a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index f9f2c541a5..6c5e5a372b 100644 --- a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -366,7 +366,7 @@ The following table details the hardware requirements for both virtualization-ba

    Trusted Platform Module (TPM)

    -

    Required to support health attestation and necessary for additional key protections for virtualization-based security. TPM 2.0 is supported; TPM 1.2 is also supported beginnning with Windows 10, version 1703.

    +

    Required to support health attestation and necessary for additional key protections for virtualization-based security. TPM 2.0 is supported. Support for TPM 1.2 was added beginning in Windows 10, version 1607 (RS1)

    diff --git a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md index c0380358d5..16a6c63d06 100644 --- a/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md +++ b/windows/security/threat-protection/security-policy-settings/account-lockout-policy.md @@ -25,8 +25,8 @@ The following topics provide a discussion of each policy setting's implementatio | Topic | Description | | - | - | -| [Account lockout duration](account-lockout-duration.md) | Describes the best practices, location, values, and security considerations for the **Account lockout duration** security policy setting. | | [Account lockout threshold](account-lockout-threshold.md) | Describes the best practices, location, values, and security considerations for the **Account lockout threshold** security policy setting. | +| [Account lockout duration](account-lockout-duration.md) | Describes the best practices, location, values, and security considerations for the **Account lockout duration** security policy setting. | | [Reset account lockout counter after](reset-account-lockout-counter-after.md) | Describes the best practices, location, values, and security considerations for the **Reset account lockout counter after** security policy setting. |   ## Related topics diff --git a/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md b/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md index 7dc894bdc7..bb487621e3 100644 --- a/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md +++ b/windows/security/threat-protection/security-policy-settings/allow-log-on-locally.md @@ -50,7 +50,7 @@ By default, the members of the following groups have this right on domain contro ### Location -Computer Configuration\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment +Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Local Policies\\User Rights Assignment ### Default values diff --git a/windows/security/threat-protection/security-policy-settings/minimum-password-age.md b/windows/security/threat-protection/security-policy-settings/minimum-password-age.md index a21530fb60..5aa52eaa25 100644 --- a/windows/security/threat-protection/security-policy-settings/minimum-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/minimum-password-age.md @@ -19,7 +19,7 @@ Describes the best practices, location, values, policy management, and security ## Reference -The **Minimum password age** policy setting determines the period of time (in days) that a password can be used before the system requires the user to change it. You can set passwords to expire after a number of days between 1 and 999, or you can specify that passwords never expire by setting the number of days to 0. If [Maximum password age](maximum-password-age.md) is between 1 and 999 days, the minimum password age must be less than the maximum password age. If Maximum password age is set to 0, **Minimum password age** can be any value between 0 and 998 days. +The **Minimum password age** policy setting determines the period of time (in days) that a password must be used before the user can change it. You can set a value between 1 and 998 days, or you can allow changes immediately by setting the number of days to 0. The minimum password age must be less than the Maximum password age, unless the maximum password age is set to 0, indicating that passwords will never expire. If the maximum password age is set to 0, the minimum password age can be set to any value between 0 and 998. ### Possible values diff --git a/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md b/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md index a962ec3cc3..51b259cf4e 100644 --- a/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md +++ b/windows/security/threat-protection/security-policy-settings/network-security-allow-local-system-to-use-computer-identity-for-ntlm.md @@ -26,7 +26,7 @@ When a service connects with the device identity, signing and encryption are sup ### Possible values | Setting | Windows Server 2008 and Windows Vista | At least Windows Server 2008 R2 and Windows 7 | -| - | - | +| - | - | - | | Enabled | Services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error.| Services running as Local System that use Negotiate will use the computer identity. This is the default behavior. | | Disabled| Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. This is the default behavior.| Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously.| |Neither|Services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. | Services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error.| diff --git a/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md index 4aa2447988..cfa4f029ba 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/run-scan-windows-defender-antivirus.md @@ -40,16 +40,17 @@ ms.date: 07/10/2018 You can run an on-demand scan on individual endpoints. These scans will start immediately, and you can define parameters for the scan, such as the location or type. -## Quick scan versus full scan +## Quick scan versus full scan and custom scan Quick scan looks at all the locations where there could be malware registered to start with the system, such as registry keys and known Windows startup folders. -Combined with [always-on real-time protection capability](configure-real-time-protection-windows-defender-antivirus.md) - which reviews files when they are opened and closed, and whenever a user navigates to a folder - a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware. +Combined with [always-on real-time protection capability](configure-real-time-protection-windows-defender-antivirus.md), which reviews files when they are opened and closed, and whenever a user navigates to a folder, a quick scan helps provide strong coverage both for malware that starts with the system and kernel-level malware. In most instances, this means a quick scan is adequate to find malware that wasn't picked up by real-time protection. -A full scan can be useful on endpoints that have encountered a malware threat to identify if there are any inactive components that require a more thorough clean-up, and can be ideal when running on-demand scans. +A full scan can be useful on endpoints that have encountered a malware threat to identify if there are any inactive components that require a more thorough clean-up, and can be ideal when running on-demand scans. +A custom scan allows you to specify files or folders to scan, such as a USB drive. **Use the mpcmdrum.exe command-line utility to run a scan:** diff --git a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md index 8e4b44e881..20c62b31b9 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md +++ b/windows/security/threat-protection/windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md @@ -60,7 +60,7 @@ To configure the Group Policy settings described in this topic: Also see the [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) and [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) topics. -## Quick scan versus full scan +## Quick scan versus full scan and custom scan When you set up scheduled scans, you can set up whether the scan should be a full or quick scan. @@ -72,6 +72,8 @@ In most instances, this means a quick scan is adequate to find malware that wasn A full scan can be useful on endpoints that have encountered a malware threat to identify if there are any inactive components that require a more thorough clean-up. In this instance, you may want to use a full scan when running an [on-demand scan](run-scan-windows-defender-antivirus.md). +A custom scan allows you to specify the files and folders to scan, such as a USB drive. + ## Set up scheduled scans Scheduled scans will run at the day and time you specify. You can use Group Policy, PowerShell, and WMI to configure scheduled scans. diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/TOC.md index 1d9c033045..123f439d6f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.md +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.md @@ -21,6 +21,7 @@ ### [Deploy WDAC with Intelligent Security Graph (ISG)](use-windows-defender-application-control-with-intelligent-security-graph.md) ### [Deploy WDAC policies using Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md) ### [Deploy WDAC policies using Intune](deploy-windows-defender-application-control-policies-using-intune.md) +### [Use WDAC with .NET hardening](use-windows-defender-application-control-with-dynamic-code-security.md) ### [Use code signing to simplify application control for classic Windows applications](use-code-signing-to-simplify-application-control-for-classic-windows-applications.md) #### [Optional: Use the Device Guard Signing Portal in the Microsoft Store for Business](use-device-guard-signing-portal-in-microsoft-store-for-business.md) #### [Optional: Create a code signing cert for WDAC](create-code-signing-cert-for-windows-defender-application-control.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md index ffbec0bb55..5ee0ccdb96 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: brianlic-msft -ms.date: 09/21/2017 +ms.date: 08/02/2018 --- # Delete an AppLocker rule @@ -16,7 +16,7 @@ ms.date: 09/21/2017 - Windows 10 - Windows Server -This topic for IT professionals describes the steps to delete an AppLocker rule. +This topic for IT professionals describes the steps to delete an AppLocker rule. As older apps are retired and new apps are deployed in your organization, it will be necessary to modify the application control policies. If an app becomes unsupported by the IT department or is no longer allowed due to the organization's security policy, then deleting the rule or rules associated with that app will prevent the app from running. @@ -25,6 +25,8 @@ For info about testing an AppLocker policy to see what rules affect which files You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins). +These steps apply only for locally managed devices. If the device has AppLocker policies applied by using MDM or a GPO, the local policy will not override those settings. + **To delete a rule in an AppLocker policy** 1. Open the AppLocker console. @@ -43,6 +45,7 @@ Use the Set-AppLockerPolicy cmdlet with the -XMLPolicy parameter, using an .XML       + To use the Set-AppLockerPolicy cmdlet, first import the Applocker modules: diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 1aec53e4ed..b5fdd41d57 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium author: jsuther1974 -ms.date: 07/16/2018 +ms.date: 08/16/2018 --- # Microsoft recommended block rules @@ -134,7 +134,9 @@ Microsoft recommends that you block the following Microsoft-signed applications - + + + @@ -681,7 +683,29 @@ Microsoft recommends that you block the following Microsoft-signed applications - + + + + + + + + + + + + + + + + + + + + + + + - + @@ -814,7 +838,9 @@ Microsoft recommends that you block the following Microsoft-signed applications - + + + @@ -1399,6 +1425,28 @@ Microsoft recommends that you block the following Microsoft-signed applications + + + + + + + + + + + + + + + + + + + + + + diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md new file mode 100644 index 0000000000..3804a87f11 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md @@ -0,0 +1,32 @@ +--- +title: Windows Defender Application Control and .NET Hardening (Windows 10) +description: Dynamic Code Security is an application control feature that can verify code loaded by .NET at runtime. +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: morganbr +ms.date: 08/20/2018 +--- + +# Windows Defender Application Control and .NET hardening + +Historically, Windows Defender Application Control (WDAC) has restricted the set of applications, libraries, and scripts that are allowed to run to those approved by an organization. +Security researchers have found that some .NET applications may be used to circumvent those controls by using .NET’s capabilities to load libraries from external sources or generate new code on the fly. +Beginning with Windows 10, version 1803, WDAC features a new capability, called *Dynamic Code Security* to verify code loaded by .NET at runtime. + +When the Dynamic Code Security option is enabled, WDAC policy is applied to libraries that .NET loads from external sources. +Additionally, it detects tampering in code generated to disk by .NET and blocks loading code that has been tampered with. + +Dynamic Code Security is not enabled by default because existing policies may not account for externally loaded libraries. +Additionally, a small number of .NET loading features, including loading unsigned assemblies built with System.Reflection.Emit, are not currently supported with Dynamic Code Security enabled. +Microsoft recommends testing Dynamic Code Security in audit mode before enforcing it to discover whether any new libraries should be included in the policy. + +To enable Dynamic Code Security, add the following option to the section of your policy: + +```xml + + + +``` diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index 1b26c144a4..37387715ac 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -12,7 +12,7 @@ #### [Onboard machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) #### [Onboard machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) #### [Onboard machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) -##### [Onboard machines using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-windows-10-machines-using-microsoft-intune) +##### [Onboard machines using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) #### [Onboard machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) #### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) ### [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md) @@ -39,11 +39,9 @@ #### [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md) - - ###Machines list #### [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) -#### [Manage machine group and tags](investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) +#### [Manage machine group and tags](investigate-machines-windows-defender-advanced-threat-protection.md) #### [Alerts related to this machine](investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) #### [Machine timeline](investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) ##### [Search for specific events](investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) @@ -103,11 +101,64 @@ ##### [Get access without a user](exposed-apis-create-app-webapp.md) #### [Supported Windows Defender ATP APIs](exposed-apis-list.md) ##### [Advanced Hunting](run-advanced-query-api.md) + +##### [Alert](alerts-windows-defender-advanced-threat-protection-new.md) +###### [List alerts](get-alerts-windows-defender-advanced-threat-protection-new.md) +###### [Create alert](create-alert-by-reference-windows-defender-advanced-threat-protection-new.md) +###### [Update Alert](update-alert-windows-defender-advanced-threat-protection-new.md) +###### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md) +###### [Get alert related domains information](get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md) +###### [Get alert related file information](get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md) +###### [Get alert related IPs information](get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md) +###### [Get alert related machine information](get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md) +###### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md) + +##### Domain +###### [Get domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md) +###### [Get domain related machines](get-domain-related-machines-windows-defender-advanced-threat-protection-new.md) +###### [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection-new.md) +###### [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md) + +##### [File](files-windows-defender-advanced-threat-protection-new.md) +###### [Get file information](get-file-information-windows-defender-advanced-threat-protection-new.md) +###### [Get file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection-new.md) +###### [Get file related machines](get-file-related-machines-windows-defender-advanced-threat-protection-new.md) +###### [Get file statistics](get-file-statistics-windows-defender-advanced-threat-protection-new.md) + +##### IP +###### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md) +###### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection-new.md) +###### [Get IP statistics](get-ip-statistics-windows-defender-advanced-threat-protection-new.md) +###### [Is IP seen in organization](is-ip-seen-org-windows-defender-advanced-threat-protection-new.md) + +##### [Machine](machine-windows-defender-advanced-threat-protection-new.md) +###### [Get machines](get-machines-windows-defender-advanced-threat-protection-new.md) +###### [Get machine by ID](get-machine-by-id-windows-defender-advanced-threat-protection-new.md) +###### [Get machine log on users](get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md) +###### [Get machine related alerts](get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md) + +##### [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) +###### [List MachineActions](get-machineactions-collection-windows-defender-advanced-threat-protection-new.md) +###### [Get MachineAction](get-machineaction-object-windows-defender-advanced-threat-protection-new.md) +###### [Collect investigation package](collect-investigation-package-windows-defender-advanced-threat-protection-new.md) +###### [Get investigation package SAS URI](get-package-sas-uri-windows-defender-advanced-threat-protection-new.md) +###### [Isolate machine](isolate-machine-windows-defender-advanced-threat-protection-new.md) +###### [Release machine from isolation](unisolate-machine-windows-defender-advanced-threat-protection-new.md) +###### [Restrict app execution](restrict-code-execution-windows-defender-advanced-threat-protection-new.md) +###### [Remove app restriction](unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md) +###### [Run antivirus scan](run-av-scan-windows-defender-advanced-threat-protection-new.md) +###### [Offboard machine](offboard-machine-api-windows-defender-advanced-threat-protection-new.md) + +##### [User](user-windows-defender-advanced-threat-protection-new.md) +###### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection-new.md) +###### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection-new.md) + #### How to use APIs - Samples ##### Advanced Hunting API ###### [Schedule advanced Hunting using Microsoft Flow](run-advanced-query-sample-ms-flow.md) ###### [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) ###### [Advanced Hunting using Python](run-advanced-query-sample-python.md) +###### [Create custom Power BI reports](run-advanced-query-sample-power-bi.md) ##### Multiple APIs ###### [PowerShell](exposed-apis-full-sample-powershell.md) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md index 4fbd212e29..c556130f3a 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: medium -ms.date: 06/13/2018 +ms.date: 08/15/2018 --- # Query data using Advanced hunting in Windows Defender ATP @@ -51,7 +51,8 @@ First, we define a time filter to review only records from the previous seven da We then add a filter on the _FileName_ to contain only instances of _powershell.exe_. -Afterwards, we add a filter on the _ProcessCommandLine_ +Afterwards, we add a filter on the _ProcessCommandLine_. + Finally, we project only the columns we're interested in exploring and limit the results to 100 and click **Run query**. You have the option of expanding the screen view so you can focus on your hunting query and related results. diff --git a/windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..2e9a1b2edf --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/alerts-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,79 @@ +--- +title: Get alerts API +description: Retrieves top recent alerts. +keywords: apis, graph api, supported apis, get, alerts, recent +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Alert resource type + +[!include[Prereleaseinformation](prerelease.md)] + +Represents an alert entity in WDATP. + +# Methods +Method|Return Type |Description +:---|:---|:--- +[Get alert](get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md) | [alert](alerts-windows-defender-advanced-threat-protection-new.md) | Get a single [alert](alerts-windows-defender-advanced-threat-protection-new.md) object. +[List alerts](get-alerts-windows-defender-advanced-threat-protection-new.md) | [alert](alerts-windows-defender-advanced-threat-protection-new.md) collection | List [alert](alerts-windows-defender-advanced-threat-protection-new.md) collection. +[Create alert](create-alert-by-reference-windows-defender-advanced-threat-protection-new.md)|[alert](alerts-windows-defender-advanced-threat-protection-new.md)|Create an alert based on event data obtained from [Advanced Hunting](run-advanced-query-api.md) +[List related domains](get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md)|Domain collection|List Urls associated with the alert. +[List related files](get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md) | [file](files-windows-defender-advanced-threat-protection-new.md) collection | List the [file](files-windows-defender-advanced-threat-protection-new.md) entities that are associated with the [alert](alerts-windows-defender-advanced-threat-protection-new.md). +[List related IPs](get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md) | IP collection | List IPs that are associated witht the alert. +[Get related machines](get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md) | [machine](machine-windows-defender-advanced-threat-protection-new.md) | The [machine](machine-windows-defender-advanced-threat-protection-new.md) that is associated with the [alert](alerts-windows-defender-advanced-threat-protection-new.md). +[Get related users](get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md) | [user](user-windows-defender-advanced-threat-protection-new.md) | The [user](user-windows-defender-advanced-threat-protection-new.md) that is associated with the [alert](alerts-windows-defender-advanced-threat-protection-new.md). + + +# Properties +Property | Type | Description +:---|:---|:--- +id | String | alert id. +severity | String | severity of the alert. Allowed values are: 'Low', 'Medium' and 'High'. +status | String | Specifies the current status of the alert. The property values are: 'New', 'InProgress' and 'Resolved'. +description | String | Description of the threat, identified by the alert. +recommendedAction | String | Action recommended for handling the suspected threat. +alertCreationTime | DateTimeOffset | The date and time (in UTC) the alert was created. +category| String | Category of the alert. The property values are: 'None', 'SuspiciousActivity', 'Malware', 'CredentialTheft', 'Exploit', 'WebExploit', 'DocumentExploit', 'PrivilegeEscalation', 'Persistence', 'RemoteAccessTool', 'CommandAndControl', 'SuspiciousNetworkTraffic', 'Ransomware', 'MalwareDownload', 'Reconnaissance', 'WebFingerprinting', 'Weaponization', 'Delivery', 'SocialEngineering', 'CredentialStealing', 'Installation', 'Backdoor', 'Trojan', 'TrojanDownloader', 'LateralMovement', 'ExplorationEnumeration', 'NetworkPropagation', 'Exfiltration', 'NotApplicable', 'EnterprisePolicy' and 'General'. +title | string | Alert title. +threatFamilyName | string | Threat family. +detectionSource | string | detection source +assignedTo | String | Owner of the alert +classification | String | Speficies the specification of the alert. The property values are: 'Unknown', 'FalsePositive', 'TruePositive'. +determination | String | Specifies the determination of the alert. The property values are: 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other' +resolvedTime | DateTimeOffset | The date and time in which the status of the alert was changed to 'Resolved'. +lastEventTime | DateTimeOffset | The last occurance of the event that triggered the alert on the same machine. +firstEventTime | DateTimeOffset | The first occurance of the event that triggered the alert on that machine. +machineId | String | id of a [machine](machine-windows-defender-advanced-threat-protection-new.md) entity that is associated with the alert. + +# JSON representation +``` +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts", + "id": "636688558380765161_2136280442", + "severity": "Informational", + "status": "InProgress", + "description": "Some alert description 1", + "recommendedAction": "Some recommended action 1", + "alertCreationTime": "2018-08-03T01:17:17.9516179Z", + "category": "General", + "title": "Some alert title 1", + "threatFamilyName": null, + "detectionSource": "WindowsDefenderAtp", + "classification": "TruePositive", + "determination": null, + "assignedTo": "best secop ever", + "resolvedTime": null, + "lastEventTime": "2018-08-02T07:02:52.0894451Z", + "firstEventTime": "2018-08-02T07:02:52.0894451Z", + "actorName": null, + "machineId": "ff0c3800ed8d66738a514971cd6867166809369f" +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..6c1b1ccd6d --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/collect-investigation-package-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,95 @@ +--- +title: Collect investigation package API +description: Use this API to create calls related to the collecting an investigation package from a machine. +keywords: apis, graph api, supported apis, collect investigation package +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Collect investigation package API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + +Collect investigation package from a machine. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.CollectForensics | 'Collect forensics' +Delegated (work or school account) | Machine.CollectForensics | 'Collect forensics' + +## HTTP request +``` +POST /api/machines/{id}/collectInvestigationPackage +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. +Content-Type | string | application/json. **Required**. + +## Request body +In the request body, supply a JSON object with the following parameters: + +Parameter | Type | Description +:---|:---|:--- +Comment | String | Comment to associate with the action. **Required**. + +## Response +If successful, this method returns 201 - Created response code and [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) in the response body. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +POST https://api.securitycenter.windows.com/api/machines/fb9ab6be3965095a09c057be7c90f0a2/collectInvestigationPackage +Content-type: application/json +{ + "Comment": "Collect forensics due to alert 1234" +} +``` + +**Response** + +Here is an example of the response. + +``` +HTTP/1.1 201 Created +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions/$entity", + "id": "c9042f9b-8483-4526-87b5-35e4c2532223", + "type": "CollectInvestigationPackage", + "requestor": "Analyst@contoso.com", + "requestorComment": " Collect forensics due to alert 1234", + "status": "InProgress", + "error": "None", + "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f", + "creationDateTimeUtc": "2017-12-04T12:09:24.1785079Z", + "lastUpdateTimeUtc": "2017-12-04T12:09:24.1785079Z" +} + +``` diff --git a/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md index 1ebb14a664..24160d9cd2 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.author: macapara author: mjcaparas -ms.localizationpriority: high +ms.localizationpriority: medium ms.date: 07/16/2018 --- diff --git a/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 22fd6a1f44..23f06ea316 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -127,14 +127,14 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover 6. Open *WDATPConnectivityAnalyzer.txt* and verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs.

    The tool checks the connectivity of Windows Defender ATP service URLs that Windows Defender ATP client is configured to interact with. It then prints the results into the *WDATPConnectivityAnalyzer.txt* file for each URL that can potentially be used to communicate with the Windows Defender ATP services. For example: - ```text - Testing URL : https://xxx.microsoft.com/xxx - 1 - Default proxy: Succeeded (200) - 2 - Proxy auto discovery (WPAD): Succeeded (200) - 3 - Proxy disabled: Succeeded (200) - 4 - Named proxy: Doesn't exist - 5 - Command line proxy: Doesn't exist - ``` + ```text + Testing URL : https://xxx.microsoft.com/xxx + 1 - Default proxy: Succeeded (200) + 2 - Proxy auto discovery (WPAD): Succeeded (200) + 3 - Proxy disabled: Succeeded (200) + 4 - Named proxy: Doesn't exist + 5 - Command line proxy: Doesn't exist + ``` If at least one of the connectivity options returns a (200) status, then the Windows Defender ATP client can communicate with the tested URL properly using this connectivity method.

    diff --git a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md index 5947c3167a..cf4dafd48d 100644 --- a/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md @@ -8,8 +8,8 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security author: mjcaparas -ms.localizationpriority: medium -ms.date: 05/08/2018 +ms.localizationpriority: high +ms.date: 08/08/2018 --- # Onboard servers to the Windows Defender ATP service @@ -36,12 +36,23 @@ The service supports the onboarding of the following servers: To onboard your servers to Windows Defender ATP, you’ll need to: +- For Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients. - Turn on server monitoring from the Windows Defender Security Center portal. - If you're already leveraging System Center Operations Manager (SCOM) or Operations Management Suite (OMS), simply attach the Microsoft Monitoring Agent (MMA) to report to your Windows Defender ATP workspace through [Multi Homing support](https://blogs.technet.microsoft.com/msoms/2016/05/26/oms-log-analytics-agent-multi-homing-support/). Otherwise, install and configure MMA to report sensor data to Windows Defender ATP as instructed below. >[!TIP] > After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md). +### Configure and update System Center Endpoint Protection clients +>[!IMPORTANT] +>This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2. + +Windows Defender ATP integrates with System Center Endpoint Protection to provide visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware. + +The following steps are required to enable this integration: +- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/en-us/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie) +- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting + ### Turn on Server monitoring from the Windows Defender Security Center portal @@ -89,11 +100,9 @@ Agent Resource | Ports ## Onboard Windows Server, version 1803 You’ll be able to onboard in the same method available for Windows 10 client machines. For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). Support for Windows Server, version 1803 provides deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well. -1. Install the latest Windows Server Insider build on a machine. For more information, see [Windows Server Insider Preview](https://www.microsoft.com/en-us/software-download/windowsinsiderpreviewserver). +1. Configure Windows Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). -2. Configure Windows Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). - -3. If you’re running a third party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings and verify it was configured correctly: +2. If you’re running a third party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings and verify it was configured correctly: a. Set the following registry entry: - Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection` @@ -108,12 +117,31 @@ You’ll be able to onboard in the same method available for Windows 10 client m ![Image of passive mode verification result](images/atp-verify-passive-mode.png) -4. Run the following command to check if Windows Defender AV is installed: +3. Run the following command to check if Windows Defender AV is installed: ```sc query Windefend``` If the result is ‘The specified service does not exist as an installed service’, then you'll need to install Windows Defender AV. For more information, see [Windows Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10). + +## Integration with Azure Security Center +Windows Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Windows Defender ATP to provide improved threat detection for Windows Servers. + +The following capabilities are included in this integration: +- Automated onboarding - Windows Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/en-us/azure/security-center/security-center-onboarding). + + >[!NOTE] + > Automated onboarding is only applicable for Windows Server 2012 R2 and Windows Server 2016. + +- Servers monitored by Azure Security Center will also be available in Windows Defender ATP - Azure Security Center seamlessly connects to the Windows Defender ATP tenant, providing a single view across clients and servers. In addition, Windows Defender ATP alerts will be available in the Azure Security Center console. +- Server investigation - Azure Security Center customers can access the Windows Defender ATP portal to perform detailed investigation to uncover the scope of a potential breach + +>[!IMPORTANT] +>- When you use Azure Security Center to monitor servers, a Windows Defender ATP tenant is automatically created. The Windows Defender ATP data is stored in Europe by default. +>- If you use Windows Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time. + + + ## Offboard servers You can offboard Windows Server, version 1803 in the same method available for Windows 10 client machines. diff --git a/windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..f5d19d8b8c --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/create-alert-by-reference-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,88 @@ +--- +title: Create alert from event API +description: Creates an alert using event details +keywords: apis, graph api, supported apis, get, alert, information, id +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Create alert from event API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + +Enables using event data, as obtained from the [Advanced Hunting](run-advanced-query-api.md) for creating a new alert entity. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Alerts.ReadWrite.All | 'Read and write all alerts' +Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' + +## HTTP request +``` +POST /api/CreateAlertByReference +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. +Content-Type | String | application/json. **Required**. + +## Request body +In the request body, supply the following values (all are required): + +Property | Type | Description +:---|:---|:--- +machineId | String | Id of the machine on which the event was identified. **Required**. +severity | String | Severity of the alert. The property values are: 'Low', 'Medium' and 'High'. **Required**. +title | String | Title for the alert. **Required**. +description | String | Description of the alert. **Required**. +recommendedAction| String | Action that is recommended to be taken by security officer when analyzing the alert. +eventTime | DateTime(UTC) | The time of the event, as obtained from the advanced query. **Required**. +reportId | String | The reportId, as obtained from the advanced query. **Required**. +category| String | Category of the alert. The property values are: 'None', 'SuspiciousActivity', 'Malware', 'CredentialTheft', 'Exploit', 'WebExploit', 'DocumentExploit', 'PrivilegeEscalation', 'Persistence', 'RemoteAccessTool', 'CommandAndControl', 'SuspiciousNetworkTraffic', 'Ransomware', 'MalwareDownload', 'Reconnaissance', 'WebFingerprinting', 'Weaponization', 'Delivery', 'SocialEngineering', 'CredentialStealing', 'Installation', 'Backdoor', 'Trojan', 'TrojanDownloader', 'LateralMovement', 'ExplorationEnumeration', 'NetworkPropagation', 'Exfiltration', 'NotApplicable', 'EnterprisePolicy' and 'General'. + + +## Response +If successful, this method returns 200 OK, and a new [alert](alerts-windows-defender-advanced-threat-protection-new.md) object in the response body. If event with the specified properties (_reportId_, _eventTime_ and _machineId_) was not found - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +POST https://api.securitycenter.windows.com/api/CreateAlertByReference +Content-Length: application/json + +{ + "machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", + "severity": "Low", + "title": "test alert", + "description": "redalert", + "recommendedAction": "white alert", + "eventTime": "2018-08-03T16:45:21.7115183Z", + "reportId": "20776", + "category": "None" +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md b/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md index 71b50119af..f3d72bd653 100644 --- a/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md +++ b/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-nativeapp.md @@ -41,6 +41,11 @@ In general, you’ll need to take the following steps to use the APIs: This page explains how to create an app, get an access token to Windows Defender ATP and validate the token includes the required permission. +**Note**: When accessing WDATP API on behalf of a user, you will need the correct app permission and user permission. +If you are not familiar with user permissions on WDATP, please refer to [Manage portal access using role-based access control](rbac-windows-defender-advanced-threat-protection.md) + +**Rule of thumb for user permissions:** If you have the permission to perform an action in the portal, you have the permission to perform the action in the API. + ## Create an app 1. Log on to [Azure](https://portal.azure.com). @@ -51,16 +56,16 @@ This page explains how to create an app, get an access token to Windows Defender 3. In the Create window, enter the following information then click **Create**. - ![Image of Create application window](images/webapp-create.png) + ![Image of Create application window](images/nativeapp-create.png) - - **Name:** WdatpEcosystemPartner - - **Application type:** Web app / API - - **Redirect URI:** `https://WdatpEcosystemPartner.com` (The URL where user can sign in and use your app. You can change this URL later.) + - **Name:** -Your app name- + - **Application type:** Native + - **Redirect URI:** `https://127.0.0.1` 4. Click **Settings** > **Required permissions** > **Add**. - ![Image of new app in Azure](images/webapp-add-permission.png) + ![Image of new app in Azure](images/nativeapp-add-permission.png) 5. Click **Select an API** > **WindowsDefenderATP**, then click **Select**. @@ -68,54 +73,35 @@ This page explains how to create an app, get an access token to Windows Defender ![Image of API access and API selection](images/webapp-add-permission-2.png) -6. Click **Select permissions** > **Run advanced queries** > **Select**. +6. Click **Select permissions** > check **Read alerts** & **Collect forensics** > **Select**. - **Important note**: You need to select the relevant permission. 'Run advanced queries' is only an example! + **Important note**: You need to select the relevant permissions. 'Read alerts' and 'Collect forensics' are only an example! - ![Image of select permissions](images/webapp-select-permission.png) + ![Image of select permissions](images/nativeapp-select-permissions.png) + + For instance, + + - In order to [run advanced queries](run-advanced-query-api.md), check 'Run advanced queries' permission + - In order to [isolate a machine](isolate-machine-windows-defender-advanced-threat-protection-new.md), check 'Isolate machine' permission + + To determine which permission you need, please look at the **Permissions** section in the API you are interested to call. - - In order to send telemetry events to WDATP, check 'Write timeline events' permission - - In order to send TI events to WDATP, check 'Read and write IOCs belonging to the app' permission - - In order to run advanced queries in WDATP, check 'Run advanced queries' permission 7. Click **Done** - ![Image of add permissions completion](images/webapp-add-permission-end.png) + ![Image of add permissions completion](images/nativeapp-add-permissions-end.png) -8. Click **Keys** and type a key name and click **Save**. +8. Click **Grant permissions** - **Important**: After you save, **copy the key value**. You won't be able to retrieve after you leave! + In order to add the new selected permissions to the app, the Admin's tenant must press on the **Grant permissions** button. - ![Image of create app key](images/webapp-create-key.png) + If in the future you will want to add more permission to the app, you will need to press on the **Grant permissions** button again so the changes will take effect. + + ![Image of Grant permissions](images/webapp-grant-permissions.png) 9. Write down your application ID. - ![Image of app ID](images/webapp-get-appid.png) - -9. Set your application to be multi-tenanted - - This is **required** for 3rd party apps (i.e., if you create an application that is intended to run in multiple customers tenant). - - This is **not required** if you create a service that you want to run in your tenant only (i.e., if you create an application for your own usage that will only interact with your own data)​ - - Click **Properties** > **Yes** > **Save**. - - ![Image of multi tenant](images/webapp-edit-multitenant.png) - - -## Application consent - -You need your application to be approved in each tenant where you intend to use it. This is because your application interacts with WDATP application on behalf of your customer. - -You (or your customer if you are writing a 3rd party application) need to click the consent link and approve your application. The consent should be done with a user who has admin privileges in the active directory. - -Consent link is of the form: - -``` -https://login.microsoftonline.com/common/oauth2/authorize?prompt=consent&client_id=00000000-0000-0000-0000-000000000000&response_type=code&sso_reload=true​ -``` - -where 00000000-0000-0000-0000-000000000000​ should be replaced with your Azure application ID + ![Image of app ID](images/nativeapp-get-appid.png) ## Get an access token @@ -124,7 +110,7 @@ For more details on AAD token, refer to [AAD tutorial](https://docs.microsoft.co ### Using C# ->The below code was tested with nuget Microsoft.IdentityModel.Clients.ActiveDirectory 3.19.8 +The code was below tested with nuget Microsoft.IdentityModel.Clients.ActiveDirectory 3.19.8 - Create a new Console Application - Install Nuget [Microsoft.IdentityModel.Clients.ActiveDirectory](https://www.nuget.org/packages/Microsoft.IdentityModel.Clients.ActiveDirectory/) @@ -134,57 +120,52 @@ For more details on AAD token, refer to [AAD tutorial](https://docs.microsoft.co using Microsoft.IdentityModel.Clients.ActiveDirectory; ``` -- Copy/Paste the below code in your application (do not forget to update the 3 variables: ```tenantId, appId, appSecret```) +- Copy/Paste the below code in your application (pay attention to the comments in the code) ``` + const string authority = "https://login.windows.net"; + const string wdatpResourceId = "https://api.securitycenter.windows.com/"; + string tenantId = "00000000-0000-0000-0000-000000000000"; // Paste your own tenant ID here string appId = "11111111-1111-1111-1111-111111111111"; // Paste your own app ID here - string appSecret = "22222222-2222-2222-2222-222222222222"; // Paste your own app secret here - const string aadUri = "https://login.windows.net"; - const string wdatpResourceId = "https://securitycenter.onmicrosoft.com/windowsatpservice"; + string username = "SecurityAdmin123@microsoft.com"; // Paste your username here + string password = GetPasswordFromSafePlace(); // Paste your own password here for a test, and then store it in a safe place! - AuthenticationContext auth = new AuthenticationContext($"{aadUri}/{tenantId}/"); - ClientCredential clientCredential = new ClientCredential(appId, appSecret); - AuthenticationResult authenticationResult = auth.AcquireTokenAsync(wdatpResourceId, clientCredential).GetAwaiter().GetResult(); + UserPasswordCredential userCreds = new UserPasswordCredential(username, password); + + AuthenticationContext auth = new AuthenticationContext($"{authority}/{tenantId}"); + AuthenticationResult authenticationResult = auth.AcquireTokenAsync(wdatpResourceId, appId, userCreds).GetAwaiter().GetResult(); string token = authenticationResult.AccessToken; ``` -### Using PowerShell - -Refer to [Get token using PowerShell](run-advanced-query-sample-powershell.md#get-token) - -### Using Python - -Refer to [Get token using Python](run-advanced-query-sample-python.md#get-token) - -### Using Curl - -> [!NOTE] -> The below procedure supposed Curl for Windows is already installed on your computer - -- Open a command window -- ​Set CLIENT_ID to your Azure application ID -- Set CLIENT_SECRET to your Azure application secret -- Set TENANT_ID to the Azure tenant ID of the customer that wants to use your application to access WDATP application -- Run the below command: - -``` -curl -i -X POST -H "Content-Type:application/x-www-form-urlencoded" -d "grant_type=client_credentials" -d "client_id=%CLIENT_ID%" -d "scope=https://securitycenter.onmicrosoft.com/windowsatpservice​/.default" -d "client_secret=%CLIENT_SECRET%" "https://login.microsoftonline.com/%TENANT_ID​%/oauth2/v2.0/token" -k​ -``` - -You will get an answer of the form: - -``` -{"token_type":"Bearer","expires_in":3599,"ext_expires_in":0,"access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIn aWReH7P0s0tjTBX8wGWqJUdDA"} -``` - ## Validate the token -- Copy/paste into [JWT](https://jwt.io/) the token you get in the previous step -- Validate you get a 'roles' claim with the desired permission, as shown in the below screenshot +Sanity check to make sure you got a correct token: +- Copy/paste into [JWT](https://jwt.ms) the token you get in the previous step in order to decode it +- Validate you get a 'scp' claim with the desired app permissions +- In the screenshot below you can see a decoded token acquired from the app in the tutorial: -![Image of token validation](images/webapp-validate-token.png) +![Image of token validation](images/nativeapp-decoded-token.png) + +## Use the token to access Windows Defender ATP API + +- Choose the API you want to use - [Supported Windows Defender ATP APIs](exposed-apis-list.md) +- Set the Authorization header in the HTTP request you send to "Bearer {token}" (Bearer is the Authorization scheme) +- The Expiration time of the token is 1 hour (you can send more then one request with the same token) + +- Example of sending a request to get a list of alerts **using C#** + ``` + var httpClient = new HttpClient(); + + var request = new HttpRequestMessage(HttpMethod.Get, "https://api.securitycenter.windows.com/api/alerts"); + + request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token); + + var response = await httpClient.SendAsync(request).ConfigureAwait(false); + + // Do something useful with the response + ``` ## Related topics - [Windows Defender ATP APIs](exposed-apis-intro.md) diff --git a/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md b/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md index 838ffc6489..20e0d808b8 100644 --- a/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md +++ b/windows/security/threat-protection/windows-defender-atp/exposed-apis-create-app-webapp.md @@ -74,25 +74,36 @@ This page explains how to create an app, get an access token to Windows Defender ![Image of select permissions](images/webapp-select-permission.png) - - In order to send telemetry events to WDATP, check 'Write timeline events' permission - - In order to send TI events to WDATP, check 'Read and write IOCs belonging to the app' permission - - In order to run advanced queries in WDATP, check 'Run advanced queries' permission + For instance, + + - In order to [run advanced queries](run-advanced-query-api.md), check 'Run advanced queries' permission + - In order to [isolate a machine](isolate-machine-windows-defender-advanced-threat-protection-new.md), check 'Isolate machine' permission + + To determine which permission you need, please look at the **Permissions** section in the API you are interested to call. 7. Click **Done** ![Image of add permissions completion](images/webapp-add-permission-end.png) -8. Click **Keys** and type a key name and click **Save**. +8. Click **Grant permissions** + + In order to add the new selected permissions to the app, the Admin's tenant must press on the **Grant permissions** button. + + If in the future you will want to add more permission to the app, you will need to press on the **Grant permissions** button again so the changes will take effect. + + ![Image of Grant permissions](images/webapp-grant-permissions.png) + +9. Click **Keys** and type a key name and click **Save**. **Important**: After you save, **copy the key value**. You won't be able to retrieve after you leave! ![Image of create app key](images/webapp-create-key.png) -9. Write down your application ID. +10. Write down your application ID. ![Image of app ID](images/webapp-get-appid.png) -9. Set your application to be multi-tenanted +11. Set your application to be multi-tenanted This is **required** for 3rd party apps (i.e., if you create an application that is intended to run in multiple customers tenant). @@ -104,7 +115,6 @@ This page explains how to create an app, get an access token to Windows Defender ## Application consent - You need your application to be approved in each tenant where you intend to use it. This is because your application interacts with WDATP application on behalf of your customer. You (or your customer if you are writing a 3rd party application) need to click the consent link and approve your application. The consent should be done with a user who has admin privileges in the active directory. @@ -139,12 +149,12 @@ For more details on AAD token, refer to [AAD tutorial](https://docs.microsoft.co ``` string tenantId = "00000000-0000-0000-0000-000000000000"; // Paste your own tenant ID here string appId = "11111111-1111-1111-1111-111111111111"; // Paste your own app ID here - string appSecret = "22222222-2222-2222-2222-222222222222"; // Paste your own app secret here + string appSecret = "22222222-2222-2222-2222-222222222222"; // Paste your own app secret here for a test, and then store it in a safe place! - const string aadUri = "https://login.windows.net"; - const string wdatpResourceId = "https://securitycenter.onmicrosoft.com/windowsatpservice"; + const string authority = "https://login.windows.net"; + const string wdatpResourceId = "https://api.securitycenter.windows.com/"; - AuthenticationContext auth = new AuthenticationContext($"{aadUri}/{tenantId}/"); + AuthenticationContext auth = new AuthenticationContext($"{authority}/{tenantId}/"); ClientCredential clientCredential = new ClientCredential(appId, appSecret); AuthenticationResult authenticationResult = auth.AcquireTokenAsync(wdatpResourceId, clientCredential).GetAwaiter().GetResult(); string token = authenticationResult.AccessToken; @@ -181,10 +191,31 @@ You will get an answer of the form: ## Validate the token -- Copy/paste into [JWT](https://jwt.io/) the token you get in the previous step -- Validate you get a 'roles' claim with the desired permission, as shown in the below screenshot +Sanity check to make sure you got a correct token: +- Copy/paste into [JWT](https://jwt.ms) the token you get in the previous step in order to decode it +- Validate you get a 'roles' claim with the desired permissions +- In the screenshot below you can see a decoded token acquired from an app with permissions to all of Wdatp's roles: -![Image of token validation](images/webapp-validate-token.png) +![Image of token validation](images/webapp-decoded-token.png) + +## Use the token to access Windows Defender ATP API + +- Choose the API you want to use - [Supported Windows Defender ATP APIs](exposed-apis-list.md) +- Set the Authorization header in the Http request you send to "Bearer {token}" (Bearer is the Authorization scheme) +- The Expiration time of the token is 1 hour (you can send more then one request with the same token) + +- Example of sending a request to get a list of alerts **using C#** + ``` + var httpClient = new HttpClient(); + + var request = new HttpRequestMessage(HttpMethod.Get, "https://api.securitycenter.windows.com/api/alerts"); + + request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token); + + var response = await httpClient.SendAsync(request).ConfigureAwait(false); + + // Do something useful with the response + ``` ## Related topics - [Windows Defender ATP APIs](exposed-apis-intro.md) diff --git a/windows/security/threat-protection/windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..076ab10d21 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/files-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,49 @@ +--- +title: File resource type +description: Retrieves top recent alerts. +keywords: apis, graph api, supported apis, get, alerts, recent +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# File resource type + +[!include[Prereleaseinformation](prerelease.md)] + +Represent a file entity in WDATP. + +# Methods +Method|Return Type |Description +:---|:---|:--- +[Get file](get-file-information-windows-defender-advanced-threat-protection-new.md) | [file](files-windows-defender-advanced-threat-protection-new.md) | Get a single file +[List file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection-new.md) | [alert](alerts-windows-defender-advanced-threat-protection-new.md) collection | Get the [alert](alerts-windows-defender-advanced-threat-protection-new.md) entities that are associated with the file. +[List file related machines](get-file-related-machines-windows-defender-advanced-threat-protection-new.md) | [machine](machine-windows-defender-advanced-threat-protection-new.md) collection | Get the [machine](machine-windows-defender-advanced-threat-protection-new.md) entities associated with the alert. +[file statistics](get-file-statistics-windows-defender-advanced-threat-protection-new.md) | Statistics summary | Retrieves the prevalence for the given file. + + +# Properties +Property | Type | Description +:---|:---|:--- +sha1 | String | Sha1 hash of the file content +sha256 | String | Sha256 hash of the file content +md5 | String | md5 hash of the file content +globalPrevalence | Integer | File prevalence accross organization +globalFirstObserved | DateTimeOffset | First time the file was observed. +globalLastObserved | DateTimeOffset | Last time the file was observed. +size | Integer | Size of the file. +fileType | String | Type of the file. +isPeFile | Boolean | true if the file is portable executable (e.g. "DLL", "EXE", etc.) +filePublisher | String | File publisher. +fileProductName | String | Product name. +signer | String | File signer. +issuer | String | File issuer. +signerHash | String | Hash of the signing certificate. +isValidCertificate | Boolean | Was signing certificate successfully verified by WDATP agent. + diff --git a/windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..443b86b728 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,88 @@ +--- +title: Find machine information by internal IP API +description: Use this API to create calls related to finding a machine entry around a specific timestamp by internal IP. +keywords: ip, apis, graph api, supported apis, find machine, machine information +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/25/2018 +--- + +# Find machine information by internal IP API + +[!include[Prerelease information](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + +Find a machine by internal IP. + +>[!NOTE] +>The timestamp must be within the last 30 days. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Read.All | 'Read all machine profiles' +Application | Machine.ReadWrite.All | 'Read and write all machine information' + +## HTTP request +``` +GET /api/machines/find(timestamp={time},key={IP}) +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and machine exists - 200 OK. +If no machine found - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +``` +GET https://graph.microsoft.com/testwdatppreview/machines/find(timestamp=2018-06-19T10:00:00Z,key='10.166.93.61') +Content-type: application/json +``` + +**Response** + +Here is an example of the response. + +The response will return a list of all machines that reported this IP address within sixteen minutes prior and after the timestamp. + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Machines", + "value": [ + { + "id": "04c99d46599f078f1c3da3783cf5b95f01ac61bb", + "computerDnsName": "", + "firstSeen": "2017-07-06T01:25:04.9480498Z", + "osPlatform": "Windows10", +… +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md index fec2f15177..94cb8338ce 100644 --- a/windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/find-machine-info-by-ip-windows-defender-advanced-threat-protection.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.author: macapara author: mjcaparas -ms.localizationpriority: high +ms.localizationpriority: medium ms.date: 07/25/2018 --- diff --git a/windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..d92068a830 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,96 @@ +--- +title: Get alert information by ID API +description: Retrieves an alert by its ID. +keywords: apis, graph api, supported apis, get, alert, information, id +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get alert information by ID API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + +Retrieves an alert by its ID. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Alert.Read.All | 'Read all alerts' +Application | Alert.ReadWrite.All | 'Read and write all alerts' +Delegated (work or school account) | Alert.Read | 'Read alerts' +Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' + +## HTTP request +``` +GET /api/alerts/{id} +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful, this method returns 200 OK, and the [alert](alerts-windows-defender-advanced-threat-protection-new.md) entity in the response body. If alert with the specified id was not found - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/alerts/636688558380765161_2136280442 +``` + +**Response** + +Here is an example of the response. + + +``` +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts", + "id": "636688558380765161_2136280442", + "severity": "Informational", + "status": "InProgress", + "description": "Some alert description 1", + "recommendedAction": "Some recommended action 1", + "alertCreationTime": "2018-08-03T01:17:17.9516179Z", + "category": "General", + "title": "Some alert title 1", + "threatFamilyName": null, + "detectionSource": "WindowsDefenderAtp", + "classification": "TruePositive", + "determination": null, + "assignedTo": "best secop ever", + "resolvedTime": null, + "lastEventTime": "2018-08-02T07:02:52.0894451Z", + "firstEventTime": "2018-08-02T07:02:52.0894451Z", + "actorName": null, + "machineId": "ff0c3800ed8d66738a514971cd6867166809369f" +} + +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..bf4cd3243e --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,85 @@ +--- +title: Get alert related domains information +description: Retrieves all domains related to a specific alert. +keywords: apis, graph api, supported apis, get alert information, alert information, related domain +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get alert related domain information API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + +Retrieves all domains related to a specific alert. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | URL.Read.All | 'Read URLs' +Delegated (work or school account) | URL.Read.All | 'Read URLs' + +## HTTP request +``` +GET /api/alerts/{id}/domains +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and alert and domain exist - 200 OK. +If alert not found or domain not found - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + + +``` +GET https://api.securitycenter.windows.com/alerts/636688558380765161_2136280442/domains +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/$metadata#Domains", + "value": [ + { + "host": "www.example.com" + } + ] +} + +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..56d4524ea3 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,98 @@ +--- +title: Get alert related files information +description: Retrieves all files related to a specific alert. +keywords: apis, graph api, supported apis, get alert information, alert information, related files +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get alert related files information API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + +Retrieves all files related to a specific alert. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | File.Read.All | 'Read file profiles' +Delegated (work or school account) | File.Read.All | 'Read file profiles' + +## HTTP request +``` +GET /api/alerts/{id}/files +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and alert and files exist - 200 OK. +If alert not found or files not found - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/alerts/636688558380765161_2136280442/files +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Files", + "value": [ + { + "sha1": "654f19c41d9662cf86be21bf0af5a88c38c56a9d", + "sha256": "2f905feec2798cee6f63da2c26758d86bfeaab954c01e20ac7085bf55fedde87", + "md5": "82849dc81d94056224445ea73dc6153a", + "globalPrevalence": 33, + "globalFirstObserved": "2018-07-17T18:17:27.5909748Z", + "globalLastObserved": "2018-08-06T16:07:12.9414137Z", + "windowsDefenderAVThreatName": null, + "size": 801112, + "fileType": "PortableExecutable", + "isPeFile": true, + "filePublisher": null, + "fileProductName": null, + "signer": "Microsoft Windows", + "issuer": "Microsoft Development PCA 2014", + "signerHash": "9e284231a4d1c53fc8d4492b09f65116bf97447f", + "isValidCertificate": true + } + ] +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..4e60b78b74 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,87 @@ +--- +title: Get alert related IPs information +description: Retrieves all IPs related to a specific alert. +keywords: apis, graph api, supported apis, get alert information, alert information, related ip +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get alert related IP information API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + +Retrieves all IPs related to a specific alert. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Ip.Read.All | 'Read IP address profiles' +Delegated (work or school account) | Ip.Read.All | 'Read IP address profiles' + +## HTTP request +``` +GET /api/alerts/{id}/ips +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and alert and an IP exist - 200 OK. If alert not found or IPs not found - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/alerts/636688558380765161_2136280442/ips +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/$metadata#Ips", + "value": [ + { + "id": "104.80.104.128" + }, + { + "id": "23.203.232.228 + } + ] +} + +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..9632c79913 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,98 @@ +--- +title: Get alert related machine information +description: Retrieves all machines related to a specific alert. +keywords: apis, graph api, supported apis, get alert information, alert information, related machine +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get alert related machine information API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + +Retrieves machine that is related to a specific alert. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Read.All | 'Read all machine information' +Application | Machine.ReadWrite.All | 'Read and write all machine information' +Delegated (work or school account) | Machine.Read | 'Read machine information' +Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information' + +## HTTP request +``` +GET /api/alerts/{id}/machine +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and alert and machine exist - 200 OK. +If alert not found or machine not found - 404 Not Found. + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + + +``` +GET https://api.securitycenter.windows.com/api/alerts/636688558380765161_2136280442/machine +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines/$entity", + "id": "ff0c3800ed8d66738a514971cd6867166809369f", + "computerDnsName": "amazingmachine.contoso.com", + "firstSeen": "2017-12-10T07:47:34.4269783Z", + "osPlatform": "Windows10", + "osVersion": "10.0.0.0", + "systemProductName": null, + "lastIpAddress": "172.17.0.0", + "lastExternalIpAddress": "167.220.0.0", + "agentVersion": "10.5830.17732.1001", + "groupName": "ContosoGroup", + "osBuild": 17732, + "healthStatus": "Active", + "isAadJoined": true, + "machineTags": [], + "rbacGroupId": 75, + "riskScore": "Low", + "aadDeviceId": "80fe8ff8-0000-0000-9591-41f0491218f9" +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..ea99a3b8d1 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,89 @@ +--- +title: Get alert related user information +description: Retrieves the user associated to a specific alert. +keywords: apis, graph api, supported apis, get, alert, information, related, user +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get alert related user information API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + +Retrieves the user associated to a specific alert. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | User.Read.All | 'Read user profiles' +Delegated (work or school account) | User.Read.All | 'Read user profiles' + +## HTTP request +``` +GET /api/alerts/{id}/user +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and alert and a user exists - 200 OK with user in the body. +If alert not found or user not found - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + + +``` +GET https://api.securitycenter.windows.com/api/alerts/636688558380765161_2136280442/user +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Users/$entity", + "id": "contoso\\user1", + "firstSeen": "2018-08-02T00:00:00Z", + "lastSeen": "2018-08-04T00:00:00Z", + "mostPrevalentMachineId": null, + "leastPrevalentMachineId": null, + "logonTypes": "Network", + "logOnMachinesCount": 3, + "isDomainAdmin": false, + "isOnlyNetworkUser": null +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..15875f3291 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-alerts-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,127 @@ +--- +title: List alerts API +description: Retrieves top recent alerts. +keywords: apis, graph api, supported apis, get, alerts, recent +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# List alerts API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + +Retrieves top recent alerts. + + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Alert.Read.All | 'Read all alerts' +Application | Alert.ReadWrite.All | 'Read and write all alerts' +Delegated (work or school account) | Alert.Read | 'Read alerts' +Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' + +## HTTP request +``` +GET /api/alerts +``` + +## Optional query parameters +Method supports $skip and $top query parameters. + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful, this method returns 200 OK, and a list of [alert](alerts-windows-defender-advanced-threat-protection-new.md) objects in the response body. If no recent alerts found - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/alerts +``` + +**Response** + +Here is an example of the response. + +>[!NOTE] +>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call. + + +``` +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts", + "value": [ + { + "id": "636688558380765161_2136280442", + "severity": "Informational", + "status": "InProgress", + "description": "Some alert description 1", + "recommendedAction": "Some recommended action 1", + "alertCreationTime": "2018-08-03T01:17:17.9516179Z", + "category": "General", + "title": "Some alert title 1", + "threatFamilyName": null, + "detectionSource": "WindowsDefenderAtp", + "classification": "TruePositive", + "determination": null, + "assignedTo": "best secop ever", + "resolvedTime": null, + "lastEventTime": "2018-08-02T07:02:52.0894451Z", + "firstEventTime": "2018-08-02T07:02:52.0894451Z", + "actorName": null, + "machineId": "ff0c3800ed8d66738a514971cd6867166809369f" + }, + { + "id": "636688558380765161_2136280442", + "severity": "Informational", + "status": "InProgress", + "description": "Some alert description 2", + "recommendedAction": "Some recommended action 2", + "alertCreationTime": "2018-08-04T01:17:17.9516179Z", + "category": "General", + "title": "Some alert title 2", + "threatFamilyName": null, + "detectionSource": "WindowsDefenderAtp", + "classification": "TruePositive", + "determination": null, + "assignedTo": "best secop ever", + "resolvedTime": null, + "lastEventTime": "2018-08-03T07:02:52.0894451Z", + "firstEventTime": "2018-08-03T07:02:52.0894451Z", + "actorName": null, + "machineId": "ff0c3800ed8d66738a514971cd6867166809369d" + } + ] +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..b693400163 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,123 @@ +--- +title: Get domain related alerts API +description: Retrieves a collection of alerts related to a given domain address. +keywords: apis, graph api, supported apis, get, domain, related, alerts +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get domain related alerts API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + +Retrieves a collection of alerts related to a given domain address. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Alert.Read.All | 'Read all alerts' +Application | Alert.ReadWrite.All | 'Read and write all alerts' +Delegated (work or school account) | Alert.Read | 'Read alerts' +Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' + +## HTTP request +``` +GET /api/domains/{domain}/alerts +``` + +## Request headers + +Header | Value +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and domain and alert exists - 200 OK with list of [alert](alerts-windows-defender-advanced-threat-protection-new.md) entities. If domain or alert does not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/domains/client.wns.windows.com/alerts +``` + +**Response** + +Here is an example of the response. + +``` +HTTP/1.1 200 OK +Content-type: application/json + +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", + "value": [ + { + "id": "636688558380765161_2136280442", + "severity": "Informational", + "status": "InProgress", + "description": "Some alert description 1", + "recommendedAction": "Some recommended action 1", + "alertCreationTime": "2018-08-03T01:17:17.9516179Z", + "category": "General", + "title": "Some alert title 1", + "threatFamilyName": null, + "detectionSource": "WindowsDefenderAtp", + "classification": "TruePositive", + "determination": null, + "assignedTo": "best secop ever", + "resolvedTime": null, + "lastEventTime": "2018-08-02T07:02:52.0894451Z", + "firstEventTime": "2018-08-02T07:02:52.0894451Z", + "actorName": null, + "machineId": "ff0c3800ed8d66738a514971cd6867166809369f" + }, + { + "id": "636688558380765161_2136280442", + "severity": "Informational", + "status": "InProgress", + "description": "Some alert description 2", + "recommendedAction": "Some recommended action 2", + "alertCreationTime": "2018-08-04T01:17:17.9516179Z", + "category": "General", + "title": "Some alert title 2", + "threatFamilyName": null, + "detectionSource": "WindowsDefenderAtp", + "classification": "TruePositive", + "determination": null, + "assignedTo": "best secop ever", + "resolvedTime": null, + "lastEventTime": "2018-08-03T07:02:52.0894451Z", + "firstEventTime": "2018-08-03T07:02:52.0894451Z", + "actorName": null, + "machineId": "ff0c3800ed8d66738a514971cd6867166809369d" + } + ] +} +``` + diff --git a/windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..f9af7b8a81 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-domain-related-machines-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,121 @@ +--- +title: Get domain related machines API +description: Retrieves a collection of machines related to a given domain address. +keywords: apis, graph api, supported apis, get, domain, related, machines +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get domain related machines API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + +Retrieves a collection of machines that have communicated to or from a given domain address. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Read.All | 'Read all machine profiles' +Application | Machine.ReadWrite.All | 'Read and write all machine information' +Delegated (work or school account) | Machine.Read | 'Read machine information' +Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information' + +## HTTP request +``` +GET /api/domains/{domain}/machines +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and domain and machine exists - 200 OK with list of [machine](machine-windows-defender-advanced-threat-protection-new.md) entities. If domain or machines do not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + + +``` +GET https://api.securitycenter.windows.com/api/domains/api.securitycenter.windows.com/machines +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", + "value": [ + { + "id": "02ea9a24e8bd39c247ed7ca0edae879c321684e5", + "computerDnsName": "testMachine1", + "firstSeen": "2018-07-30T20:12:00.3708661Z", + "osPlatform": "Windows10", + "osVersion": null, + "systemProductName": null, + "lastIpAddress": "10.209.67.177", + "lastExternalIpAddress": "167.220.1.210", + "agentVersion": "10.5830.18208.1000", + "groupName": null, + "osBuild": 18208, + "healthStatus": "Inactive", + "isAadJoined": false, + "machineTags": [], + "rbacGroupId": 75, + "riskScore": "Low", + "aadDeviceId": null + }, + { + "id": "02efb9a9b85f07749a018fbf3f962b4700b3b949", + "computerDnsName": "testMachine2", + "firstSeen": "2018-07-30T19:50:47.3618349Z", + "osPlatform": "Windows10", + "osVersion": null, + "systemProductName": null, + "lastIpAddress": "10.209.70.231", + "lastExternalIpAddress": "167.220.0.28", + "agentVersion": "10.5830.18208.1000", + "groupName": null, + "osBuild": 18208, + "healthStatus": "Inactive", + "isAadJoined": false, + "machineTags": [], + "rbacGroupId": 75, + "riskScore": "None", + "aadDeviceId": null + } + ] +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..8ad81fef65 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-domain-statistics-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,83 @@ +--- +title: Get domain statistics API +description: Retrieves the prevalence for the given domain. +keywords: apis, graph api, supported apis, get, domain, domain related machines +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get domain statistics API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + +Retrieves the prevalence for the given domain. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | URL.Read.All | 'Read URLs' +Delegated (work or school account) | URL.Read.All | 'Read URLs' + +## HTTP request +``` +GET /api/domains/{domain}/stats +``` + +## Request headers + +Header | Value +:---|:--- +Authorization | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and domain exists - 200 OK, with statistics object in the response body. +If domain does not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/domains/example.com/stats +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgDomainStats", + "host": "example.com", + "orgPrevalence": "4070", + "orgFirstSeen": "2017-07-30T13:23:48Z", + "orgLastSeen": "2017-08-29T13:09:05Z" +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..2c7d7416cb --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-file-information-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,96 @@ +--- +title: Get file information API +description: Retrieves a file by identifier Sha1, Sha256, or MD5. +keywords: apis, graph api, supported apis, get, file, information, sha1, sha256, md5 +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get file information API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + + +Retrieves a file by identifier Sha1, Sha256, or MD5. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | File.Read.All | 'Read all file profiles' +Delegated (work or school account) | File.Read.All | 'Read all file profiles' + +## HTTP request +``` +GET /api/files/{id} +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and file exists - 200 OK with the [file](files-windows-defender-advanced-threat-protection-new.md) entity in the body. +If file does not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/files/6532ec91d513acc05f43ee0aa3002599729fd3e1 +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Files/$entity", + "sha1": "6532ec91d513acc05f43ee0aa3002599729fd3e1", + "sha256": "d4447dffdbb2889b4b4e746b0bc882df1b854101614b0aa83953ef3cb66904cf", + "md5": "7f05a371d2beffb3784fd2199f81d730", + "globalPrevalence": 7329, + "globalFirstObserved": "2018-04-08T05:50:29.4459725Z", + "globalLastObserved": "2018-08-07T23:35:11.1361328Z", + "windowsDefenderAVThreatName": null, + "size": 391680, + "fileType": "PortableExecutable", + "isPeFile": true, + "filePublisher": null, + "fileProductName": null, + "signer": null, + "issuer": null, + "signerHash": null, + "isValidCertificate": null +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..9a48a46092 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-file-related-alerts-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,103 @@ +--- +title: Get file related alerts API +description: Retrieves a collection of alerts related to a given file hash. +keywords: apis, graph api, supported apis, get, file, hash +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get file related alerts API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + +Retrieves a collection of alerts related to a given file hash. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Alert.Read.All | 'Read all alerts' +Application | Alert.ReadWrite.All | 'Read and write all alerts' +Delegated (work or school account) | Alert.Read | 'Read alerts' +Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' + +## HTTP request +``` +GET /api/files/{id}/alerts +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and file and alert exists - 200 OK with list of [alert](alerts-windows-defender-advanced-threat-protection-new.md) entities in the body. +If file or alerts do not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/files/6532ec91d513acc05f43ee0aa3002599729fd3e1/alerts +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts", + "value": [ + { + "id": "636692391408655573_2010598859", + "severity": "Low", + "status": "New", + "description": "test alert", + "recommendedAction": "do this and that", + "alertCreationTime": "2018-08-07T11:45:40.0199932Z", + "category": "None", + "title": "test alert", + "threatFamilyName": null, + "detectionSource": "CustomerTI", + "classification": null, + "determination": null, + "assignedTo": null, + "resolvedTime": null, + "lastEventTime": "2018-08-03T16:45:21.7115182Z", + "firstEventTime": "2018-08-03T16:45:21.7115182Z", + "actorName": null, + "machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07" + } + ] +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..da84931205 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-file-related-machines-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,121 @@ +--- +title: Get file related machines API +description: Retrieves a collection of machines related to a given file hash. +keywords: apis, graph api, supported apis, get, machines, hash +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get file related machines API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + +Retrieves a collection of machines related to a given file hash. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Read.All | 'Read all machine profiles' +Application | Machine.ReadWrite.All | 'Read and write all machine information' +Delegated (work or school account) | Machine.Read | 'Read machine information' +Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information' + +## HTTP request +``` +GET /api/files/{id}/machines +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and file and machines exists - 200 OK with list of [machine](machine-windows-defender-advanced-threat-protection-new.md) entities in the body. +If file or machines do not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/files/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/machines +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", + "value": [ + { + "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", + "computerDnsName": "mymachine1.contoso.com", + "firstSeen": "2018-08-02T14:55:03.7791856Z", + "osPlatform": "Windows10", + "osVersion": null, + "systemProductName": null, + "lastIpAddress": "172.17.230.209", + "lastExternalIpAddress": "167.220.196.71", + "agentVersion": "10.5830.18209.1001", + "groupName": null, + "osBuild": 18209, + "healthStatus": "Active", + "isAadJoined": true, + "machineTags": [], + "rbacGroupId": 140, + "riskScore": "Low", + "aadDeviceId": null + }, + { + "id": "7292e4b8cb74ff1cc3d8a495eb29dc8858b732f7", + "computerDnsName": "mymachine2.contoso.com", + "firstSeen": "2018-07-09T13:22:45.1250071Z", + "osPlatform": "Windows10", + "osVersion": null, + "systemProductName": null, + "lastIpAddress": "192.168.12.225", + "lastExternalIpAddress": "79.183.65.82", + "agentVersion": "10.5820.17724.1000", + "groupName": "WDATPClientTeam", + "osBuild": 17724, + "healthStatus": "Inactive", + "isAadJoined": true, + "machineTags": [], + "rbacGroupId": 140, + "riskScore": "Low", + "aadDeviceId": null + } + ] +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..8146e74ee5 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-file-statistics-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,88 @@ +--- +title: Get file statistics API +description: Retrieves the prevalence for the given file. +keywords: apis, graph api, supported apis, get, file, statistics +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get file statistics API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + +Retrieves the prevalence for the given file. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | File.Read.All | 'Read file profiles' +Delegated (work or school account) | File.Read.All | 'Read file profiles' + +## HTTP request +``` +GET /api/files/{id}/stats +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and file exists - 200 OK with statistical data in the body. +If file do not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/files/6532ec91d513acc05f43ee0aa3002599729fd3e1/stats +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgFileStats", + "sha1": "6532ec91d513acc05f43ee0aa3002599729fd3e1", + "orgPrevalence": "3", + "orgFirstSeen": "2018-07-15T06:13:59Z", + "orgLastSeen": "2018-08-03T16:45:21Z", + "topFileNames": [ + "chrome_1.exe", + "chrome_2.exe" + ] +} + +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..130c22ad36 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,104 @@ +--- +title: Get IP related alerts API +description: Retrieves a collection of alerts related to a given IP address. +keywords: apis, graph api, supported apis, get, ip, related, alerts +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get IP related alerts API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + +Retrieves a collection of alerts related to a given IP address. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Alert.Read.All | 'Read all alerts' +Application | Alert.ReadWrite.All | 'Read and write all alerts' +Delegated (work or school account) | Alert.Read | 'Read alerts' +Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' + +## HTTP request +``` +GET /api/ips/{ip}/alerts +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and IP and alert exists - 200 OK with list of [alert](alerts-windows-defender-advanced-threat-protection-new.md) entities in the body. +If IP and alerts do not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + + +``` +GET https://api.securitycenter.windows.com/api/ips/10.209.67.177/alerts +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts", + "value": [ + { + "id": "636692391408655573_2010598859", + "severity": "Low", + "status": "New", + "description": "test alert", + "recommendedAction": "do this and that", + "alertCreationTime": "2018-08-07T11:45:40.0199932Z", + "category": "None", + "title": "test alert", + "threatFamilyName": null, + "detectionSource": "CustomerTI", + "classification": null, + "determination": null, + "assignedTo": null, + "resolvedTime": null, + "lastEventTime": "2018-08-03T16:45:21.7115182Z", + "firstEventTime": "2018-08-03T16:45:21.7115182Z", + "actorName": null, + "machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07" + } + ] +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..91b327d71b --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,118 @@ +--- +title: Get IP related machines API +description: Retrieves a collection of machines related to a given IP address. +keywords: apis, graph api, supported apis, get, ip, related, machines +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get IP related machines API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Retrieves a collection of machines that communicated with or from a particular IP. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Read.All | 'Read all machine profiles' +Application | Machine.ReadWrite.All | 'Read and write all machine information' +Delegated (work or school account) | Machine.Read | 'Read machine information' +Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information' + +## HTTP request +``` +GET /api/ips/{ip}/machines +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and IP and machines exists - 200 OK with list of [machine](machine-windows-defender-advanced-threat-protection-new.md) entities in the body. +If IP or machines do not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/ips/10.209.67.177/machines +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", + "value": [ + { + "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", + "computerDnsName": "mymachine1.contoso.com", + "firstSeen": "2018-08-02T14:55:03.7791856Z", + "osPlatform": "Windows10", + "osVersion": null, + "systemProductName": null, + "lastIpAddress": "172.17.230.209", + "lastExternalIpAddress": "167.220.196.71", + "agentVersion": "10.5830.18209.1001", + "groupName": null, + "osBuild": 18209, + "healthStatus": "Active", + "isAadJoined": true, + "machineTags": [], + "rbacGroupId": 140, + "riskScore": "Low", + "aadDeviceId": null + }, + { + "id": "7292e4b8cb74ff1cc3d8a495eb29dc8858b732f7", + "computerDnsName": "mymachine2.contoso.com", + "firstSeen": "2018-07-09T13:22:45.1250071Z", + "osPlatform": "Windows10", + "osVersion": null, + "systemProductName": null, + "lastIpAddress": "192.168.12.225", + "lastExternalIpAddress": "79.183.65.82", + "agentVersion": "10.5820.17724.1000", + "groupName": "WDATPClientTeam", + "osBuild": 17724, + "healthStatus": "Inactive", + "isAadJoined": true, + "machineTags": [], + "rbacGroupId": 140, + "riskScore": "Low", + "aadDeviceId": null + } + ] +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md index 1796c563b1..9e0adbf0ee 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/get-ip-related-machines-windows-defender-advanced-threat-protection.md @@ -36,8 +36,7 @@ Content type | application/json Empty ## Response -If successful and IP and machines exists - 200 OK. -If IP or machines do not exist - 404 Not Found. +If successful and IP and machines exists - 200 OK. If IP or machines do not exist - 404 Not Found. ## Example diff --git a/windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..a33784bce5 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-ip-statistics-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,80 @@ +--- +title: Get IP statistics API +description: Retrieves the prevalence for the given IP. +keywords: apis, graph api, supported apis, get, ip, statistics, prevalence +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get IP statistics API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Retrieves the prevalence for the given IP. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Ip.Read.All | 'Read IP address profiles' +Delegated (work or school account) | Ip.Read.All | 'Read IP address profiles' + +## HTTP request +``` +GET /api/ips/{ip}/stats +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and ip exists - 200 OK with statistical data in the body. IP do not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/ips/10.209.67.177/stats +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgIPStats", + "ipAddress": "10.209.67.177", + "orgPrevalence": "63515", + "orgFirstSeen": "2017-07-30T13:36:06Z", + "orgLastSeen": "2017-08-29T13:32:59Z" +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..ef0c177338 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-machine-by-id-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,97 @@ +--- +title: Get machine by ID API +description: Retrieves a machine entity by ID. +keywords: apis, graph api, supported apis, get, machines, entity, id +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get machine by ID API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Retrieves a machine entity by ID. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Read.All | 'Read all machine profiles' +Application | Machine.ReadWrite.All | 'Read and write all machine information' +Delegated (work or school account) | Machine.Read | 'Read machine information' +Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information' + +## HTTP request +``` +GET /api/machines/{id} +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and machine exists - 200 OK with the [machine](machine-windows-defender-advanced-threat-protection-new.md) entity in the body. +If machine with the specified id was not found - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07 +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machine", + "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", + "computerDnsName": "mymachine1.contoso.com", + "firstSeen": "2018-08-02T14:55:03.7791856Z", + "osPlatform": "Windows10", + "osVersion": null, + "systemProductName": null, + "lastIpAddress": "172.17.230.209", + "lastExternalIpAddress": "167.220.196.71", + "agentVersion": "10.5830.18209.1001", + "groupName": null, + "osBuild": 18209, + "healthStatus": "Active", + "isAadJoined": true, + "machineTags": [], + "rbacGroupId": 140, + "riskScore": "Low", + "aadDeviceId": null +} + +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..3811fc208f --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,101 @@ +--- +title: Get machine log on users API +description: Retrieves a collection of logged on users. +keywords: apis, graph api, supported apis, get, machine, log on, users +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get machine log on users API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Retrieves a collection of logged on users. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | User.Read.All | 'Read user profiles' +Delegated (work or school account) | User.Read.All | 'Read user profiles' + +## HTTP request +``` +GET /api/machines/{id}/logonusers +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and machine and user exist - 200 OK with list of [user](user-windows-defender-advanced-threat-protection-new.md) entities in the body +If no machine found or no users found - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/logonusers +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Users", + "value": [ + { + "id": "contoso\\user1", + "firstSeen": "2018-08-02T00:00:00Z", + "lastSeen": "2018-08-04T00:00:00Z", + "mostPrevalentMachineId": null, + "leastPrevalentMachineId": null, + "logonTypes": "Network", + "logOnMachinesCount": 3, + "isDomainAdmin": false, + "isOnlyNetworkUser": null + }, + { + "id": "contoso\\user2", + "firstSeen": "2018-08-02T00:00:00Z", + "lastSeen": "2018-08-05T00:00:00Z", + "mostPrevalentMachineId": null, + "leastPrevalentMachineId": null, + "logonTypes": "Network", + "logOnMachinesCount": 3, + "isDomainAdmin": false, + "isOnlyNetworkUser": null + } + ] +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..1af227a95a --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,101 @@ +--- +title: Get machine related alerts API +description: Retrieves a collection of alerts related to a given machine ID. +keywords: apis, graph api, supported apis, get, machines, related, alerts +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get machine related alerts API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Retrieves a collection of alerts related to a given machine ID. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Alert.Read.All | 'Read all alerts' +Application | Alert.ReadWrite.All | 'Read and write all alerts' +Delegated (work or school account) | Alert.Read | 'Read alerts' +Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' + +## HTTP request +``` +GET /api/machines/{id}/alerts +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and machine and alert exists - 200 OK with list of [alert](alerts-windows-defender-advanced-threat-protection-new.md) entities in the body. If no machine or no alerts found - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + + +``` +GET https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/alerts +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts", + "value": [ + { + "id": "636692391408655573_2010598859", + "severity": "Low", + "status": "New", + "description": "test alert", + "recommendedAction": "do this and that", + "alertCreationTime": "2018-08-07T11:45:40.0199932Z", + "category": "None", + "title": "test alert", + "threatFamilyName": null, + "detectionSource": "CustomerTI", + "classification": null, + "determination": null, + "assignedTo": null, + "resolvedTime": null, + "lastEventTime": "2018-08-03T16:45:21.7115182Z", + "firstEventTime": "2018-08-03T16:45:21.7115182Z", + "actorName": null, + "machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07" + } + ] +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..8a2fe385ab --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-machineaction-object-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,88 @@ +--- +title: Get MachineAction object API +description: Use this API to create calls related to get machineaction object +keywords: apis, graph api, supported apis, machineaction object +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get machineAction API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Get action performed on a machine. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Read.All | 'Read all machine profiles' +Application | Machine.ReadWrite.All | 'Read and write all machine information' +Delegated (work or school account) | Machine.Read | 'Read machine information' +Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information' + +## HTTP request +``` +GET /api/machineactions/{id} +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful, this method returns 200, Ok response code with a [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) entity. If machine action entity with the specified id was not found - 404 Not Found. + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/machineactions/2e9da30d-27f6-4208-81f2-9cd3d67893ba +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 Ok +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions/$entity", + "id": "2e9da30d-27f6-4208-81f2-9cd3d67893ba", + "type": "RunAntiVirusScan", + "requestor": "Analyst@contoso.com", + "requestorComment": "Check machine for viruses due to alert 3212", + "status": "Succeeded", + "error": "None", + "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f", + "creationDateTimeUtc": "2017-12-04T12:18:27.1293487Z", + "lastUpdateTimeUtc": "2017-12-04T12:18:57.5511934Z" +} + + +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..0e8e2ed4a8 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-machineactions-collection-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,161 @@ +--- +title: List machineActions API +description: Use this API to create calls related to get machineactions collection +keywords: apis, graph api, supported apis, machineaction collection +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# List machineActions API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + Gets collection of actions done on machines. Get MachineAction collection API supports [OData V4 queries](https://www.odata.org/documentation/odata-version-2-0/uri-conventions/#FilterSystemQueryOption). + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Read.All | 'Read all machine profiles' +Application | Machine.ReadWrite.All | 'Read and write all machine information' +Delegated (work or school account) | Machine.Read | 'Read machine information' +Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information' + +## HTTP request +``` +GET /api/machineactions +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful, this method returns 200, Ok response code with a collection of [machineAction](machineaction-windows-defender-advanced-threat-protection-new.md) entities. + + +## Example 1 + +**Request** + +Here is an example of the request on an organization that has three MachineActions. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/machineactions +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 Ok +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions", + "value": [ + { + "id": "69dc3630-1ccc-4342-acf3-35286eec741d", + "type": "CollectInvestigationPackage", + "requestor": "Analyst@contoso.com", + "requestorComment": "test", + "status": "Succeeded", + "error": "None", + "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f", + "creationDateTimeUtc": "2017-12-04T12:43:57.2011911Z", + "lastUpdateTimeUtc": "2017-12-04T12:45:25.4049122Z" + }, + { + "id": "2e9da30d-27f6-4208-81f2-9cd3d67893ba", + "type": "RunAntiVirusScan", + "requestor": "Analyst@contoso.com", + "requestorComment": "Check machine for viruses due to alert 3212", + "status": "Succeeded", + "error": "None", + "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f", + "creationDateTimeUtc": "2017-12-04T12:18:27.1293487Z", + "lastUpdateTimeUtc": "2017-12-04T12:18:57.5511934Z" + }, + { + "id": "44cffc15-0e3d-4cbf-96aa-bf76f9b27f5e", + "type": "UnrestrictCodeExecution", + "requestor": "Analyst@contoso.com", + "requestorComment": "test", + "status": "Succeeded", + "error": "None", + "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f", + "creationDateTimeUtc": "2017-12-04T12:15:40.6052029Z", + "lastUpdateTimeUtc": "2017-12-04T12:16:14.2899973Z" + } + ] +} +``` + +## Example 2 + +**Request** + +Here is an example of a request that filters the MachineActions by machine ID and shows the latest two MachineActions. + +``` +GET https://api.securitycenter.windows.com/api/machineactions?$filter=machineId eq 'f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f'&$top=2 +``` + +**Response** + +Here is an example of the response. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +HTTP/1.1 200 Ok +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/testwdatppreview/$metadata#MachineActions", + "value": [ + { + "id": "69dc3630-1ccc-4342-acf3-35286eec741d", + "type": "CollectInvestigationPackage", + "requestor": "Analyst@contoso.com", + "requestorComment": "test", + "status": "Succeeded", + "error": "None", + "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f", + "creationDateTimeUtc": "2017-12-04T12:43:57.2011911Z", + "lastUpdateTimeUtc": "2017-12-04T12:45:25.4049122Z" + }, + { + "id": "2e9da30d-27f6-4208-81f2-9cd3d67893ba", + "type": "RunAntiVirusScan", + "requestor": "Analyst@contoso.com", + "requestorComment": "Check machine for viruses due to alert 3212", + "status": "Succeeded", + "error": "None", + "machineId": "f46b9bb259ed4a7fb9981b73510e3cc7aa81ec1f", + "creationDateTimeUtc": "2017-12-04T12:18:27.1293487Z", + "lastUpdateTimeUtc": "2017-12-04T12:18:57.5511934Z" + } + ] +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..7c13dee9ec --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-machines-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,117 @@ +--- +title: List machines API +description: Retrieves a collection of recently seen machines. +keywords: apis, graph api, supported apis, get, machines +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# List machines API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Retrieves a collection of machines that have communicated with WDATP cloud on the last 30 days. + +## Permissions + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Read.All | 'Read all machine profiles' +Application | Machine.ReadWrite.All | 'Read and write all machine information' +Delegated (work or school account) | Machine.Read | 'Read machine information' +Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information' + +## HTTP request +``` +GET /api/machines +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and machines exists - 200 OK with list of [machine](machine-windows-defender-advanced-threat-protection-new.md) entities in the body. If no recent machines - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/machines +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", + "value": [ + { + "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", + "computerDnsName": "mymachine1.contoso.com", + "firstSeen": "2018-08-02T14:55:03.7791856Z", + "osPlatform": "Windows10", + "osVersion": null, + "systemProductName": null, + "lastIpAddress": "172.17.230.209", + "lastExternalIpAddress": "167.220.196.71", + "agentVersion": "10.5830.18209.1001", + "groupName": null, + "osBuild": 18209, + "healthStatus": "Active", + "isAadJoined": true, + "machineTags": [], + "rbacGroupId": 140, + "riskScore": "Low", + "aadDeviceId": null + }, + { + "id": "7292e4b8cb74ff1cc3d8a495eb29dc8858b732f7", + "computerDnsName": "mymachine2.contoso.com", + "firstSeen": "2018-07-09T13:22:45.1250071Z", + "osPlatform": "Windows10", + "osVersion": null, + "systemProductName": null, + "lastIpAddress": "192.168.12.225", + "lastExternalIpAddress": "79.183.65.82", + "agentVersion": "10.5820.17724.1000", + "groupName": "WDATPClientTeam", + "osBuild": 17724, + "healthStatus": "Inactive", + "isAadJoined": true, + "machineTags": [], + "rbacGroupId": 140, + "riskScore": "Low", + "aadDeviceId": null + } + ] +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..c854d33b50 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,81 @@ +--- +title: Get package SAS URI API +description: Use this API to get a URI that allows downloading an investigation package. +keywords: apis, graph api, supported apis, get package, sas, uri +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get package SAS URI API + +[!include[Prerelease information](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Get a URI that allows downloading of an [investigation package](collect-investigation-package-windows-defender-advanced-threat-protection-new.md). + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.CollectForensics | 'Collect forensics' +Delegated (work or school account) | Machine.CollectForensics | 'Collect forensics' + +## HTTP request +``` +GET /api/machineactions/{machine action id}/getPackageUri +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful, this method returns 200, Ok response code with object that holds the link to the package in the “value” parameter. This link is valid for a very short time and should be used immediately for downloading the package to a local storage. + + +## Example + +**Request** + +Here is an example of the request. + +``` +GET https://api.securitycenter.windows.com/api/machineactions/7327b54fd718525cbca07dacde913b5ac3c85673/GetPackageUri + +``` + +**Response** + +Here is an example of the response. + +[!include[Improve request performance](improverequestperformance-new.md)] + + +``` +HTTP/1.1 200 Ok +Content-type: application/json + +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Edm.String", + "value": "\"https://userrequests-us.securitycenter.windows.com:443/safedownload/WDATP_Investigation_Package.zip?token=gbDyj7y%2fbWGAZjn2sFiZXlliBTXOCVG7yiJ6mXNaQ9pLByC2Wxeno9mENsPFP3xMk5l%2bZiJXjLvqAyNEzUNROxoM2I1er9dxzfVeBsxSmclJjPsAx%2btiNyxSz1Ax%2b5jaT5cL5bZg%2b8wgbwY9urXbTpGjAKh6FB1e%2b0ypcWkPm8UkfOwsmtC%2biZJ2%2bPqnkkeQk7SKMNoAvmh9%2fcqDIPKXGIBjMa0D9auzypOqd8bQXp7p2BnLSH136BxST8n9IHR4PILvRjAYW9kvtHkBpBitfydAsUW4g2oDZSPN3kCLBOoo1C4w4Lkc9Bc3GNU2IW6dfB7SHcp7G9p4BDkeJl3VuDs6esCaeBorpn9FKJ%2fXo7o9pdcI0hUPZ6Ds9hiPpwPUtz5J29CBE3QAopCK%2fsWlf6OW2WyXsrNRSnF1tVE5H3wXpREzuhD7S4AIA3OIEZKzC4jIPLeMu%2bazZU9xGwuc3gICOaokbwMJiZTqcUuK%2fV9YdBdjdg8wJ16NDU96Pl6%2fgew2KYuk6Wo7ZuHotgHI1abcsvdlpe4AvixDbqcRJthsg2PpLRaFLm5av44UGkeK6TJpFvxUn%2f9fg6Zk5yM1KUTHb8XGmutoCM8U9er6AzXZlY0gGc3D3bQOg41EJZkEZLyUEbk1hXJB36ku2%2bW01cG71t7MxMBYz7%2bdXobxpdo%3d%3bRWS%2bCeoDfTyDcfH5pkCg6hYDmCOPr%2fHYQuaUWUBNVnXURYkdyOzVHqp%2fe%2f1BNyPdVoVkpQHpz1pPS3b5g9h7IMmNKCk5gFq5m2nPx6kk9EYtzx8Ndoa2m9Yj%2bSaf8zIFke86YnfQL4AYewsnQNJJh4wc%2bXxGlBq7axDcoiOdX91rKzVicH3GSBkFoLFAKoegWWsF%2fEDZcVpF%2fXUA1K8HvB6dwyfy4y0sAqnNPxYTQ97mG7yHhxPt4Pe9YF2UPPAJVuEf8LNlQ%2bWHC9%2f7msF6UUI4%2fca%2ftpjFs%2fSNeRE8%2fyQj21TI8YTF1SowvaJuDc1ivEoeopNNGG%2bGI%2fX0SckaVxU9Hdkh0zbydSlT5SZwbSwescs0IpzECitBbaLUz4aT8KTs8T0lvx8D7Te3wVsKAJ1r3iFMQZrlk%2bS1WW8rvac7oHRx2HKURn1v7fDIQWgJr9aNsNlFz4fLJ50T2qSHuuepkLVbe93Va072aMGhvr09WVKoTpAf1j2bcFZZU6Za5PxI32mr0k90FgiYFJ1F%2f1vRDrGwvWVWUkR3Z33m4g0gHa52W1FMxQY0TJIwbovD6FaSNDx7xhKZSd5IJ7r6P91Gez49PaZRcAZPjd%2bfbul3JNm1VqQPTLohT7wa0ymRiXpSST74xtFzuEBzNSNATdbngj3%2fwV4JesTjZjIj5Dc%3d%3blumqauVlFuuO8MQffZgs0tLJ4Fq6fpeozPTdDf8Ll6XLegi079%2b4mSPFjTK0y6eohstxdoOdom2wAHiZwk0u4KLKmRkfYOdT1wHY79qKoBQ3ZDHFTys9V%2fcwKGl%2bl8IenWDutHygn5IcA1y7GTZj4g%3d%3d\"" +} + + +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md index ade4afd10e..b000396208 100644 --- a/windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/get-package-sas-uri-windows-defender-advanced-threat-protection.md @@ -28,7 +28,7 @@ Users need to have Security administrator or Global admin directory roles. ## HTTP request ``` -POST /testwdatppreview/machineactions/{id}/getPackageUri +GET /testwdatppreview/machineactions/{id}/getPackageUri ``` ## Request headers diff --git a/windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..b0c31a0088 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,85 @@ +--- +title: Get user information API +description: Retrieve a User entity by key such as user name or domain. +keywords: apis, graph api, supported apis, get, user, user information +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get user information API + +[!include[Prerelease information](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Retrieve a User entity by key (user name or domain\user). + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | User.Read.All | 'Read all user profiles' + +## HTTP request +``` +GET /api/users/{id}/ +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and user exists - 200 OK with [user](user-windows-defender-advanced-threat-protection-new.md) entity in the body. If user does not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/users/user1@contoso.com +Content-type: application/json +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Users/$entity", + "id": "user1@contoso.com", + "firstSeen": "2018-08-02T00:00:00Z", + "lastSeen": "2018-08-04T00:00:00Z", + "mostPrevalentMachineId": null, + "leastPrevalentMachineId": null, + "logonTypes": "Network", + "logOnMachinesCount": 3, + "isDomainAdmin": false, + "isOnlyNetworkUser": null +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..418ad94328 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-user-related-alerts-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,120 @@ +--- +title: Get user related alerts API +description: Retrieves a collection of alerts related to a given user ID. +keywords: apis, graph api, supported apis, get, user, related, alerts +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get user related alerts API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Retrieves a collection of alerts related to a given user ID. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Alert.Read.All | 'Read all alerts' +Application | Alert.ReadWrite.All | 'Read and write all alerts' +Delegated (work or school account) | Alert.Read | 'Read alerts' +Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' + +## HTTP request +``` +GET /api/users/{id}/alerts +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and user and alert exists - 200 OK. If user or alerts does not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/users/user1@contoso.com/alerts +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts", + "value": [ + { + "id": "636688558380765161_2136280442", + "severity": "Informational", + "status": "InProgress", + "description": "Some alert description 1", + "recommendedAction": "Some recommended action 1", + "alertCreationTime": "2018-08-03T01:17:17.9516179Z", + "category": "General", + "title": "Some alert title 1", + "threatFamilyName": null, + "detectionSource": "WindowsDefenderAtp", + "classification": "TruePositive", + "determination": null, + "assignedTo": "best secop ever", + "resolvedTime": null, + "lastEventTime": "2018-08-02T07:02:52.0894451Z", + "firstEventTime": "2018-08-02T07:02:52.0894451Z", + "actorName": null, + "machineId": "ff0c3800ed8d66738a514971cd6867166809369f" + }, + { + "id": "636688558380765161_2136280442", + "severity": "Informational", + "status": "InProgress", + "description": "Some alert description 2", + "recommendedAction": "Some recommended action 2", + "alertCreationTime": "2018-08-04T01:17:17.9516179Z", + "category": "General", + "title": "Some alert title 2", + "threatFamilyName": null, + "detectionSource": "WindowsDefenderAtp", + "classification": "TruePositive", + "determination": null, + "assignedTo": "best secop ever", + "resolvedTime": null, + "lastEventTime": "2018-08-03T07:02:52.0894451Z", + "firstEventTime": "2018-08-03T07:02:52.0894451Z", + "actorName": null, + "machineId": "ff0c3800ed8d66738a514971cd6867166809369d" + } + ] +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..4039343929 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,118 @@ +--- +title: Get user related machines API +description: Retrieves a collection of machines related to a given user ID. +keywords: apis, graph api, supported apis, get, user, user related alerts +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Get user related machines API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Retrieves a collection of machines related to a given user ID. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Read.All | 'Read all machine profiles' +Application | Machine.ReadWrite.All | 'Read and write all machine information' +Delegated (work or school account) | Machine.Read | 'Read machine information' +Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information' + +## HTTP request +``` +GET /api/users/{id}/machines +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and machines exists - 200 OK with list of [machine](machine-windows-defender-advanced-threat-protection-new.md) entities in the body. If user or machines does not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/users/user1@contoso.com/machines +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", + "value": [ + { + "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", + "computerDnsName": "mymachine1.contoso.com", + "firstSeen": "2018-08-02T14:55:03.7791856Z", + "osPlatform": "Windows10", + "osVersion": null, + "systemProductName": null, + "lastIpAddress": "172.17.230.209", + "lastExternalIpAddress": "167.220.196.71", + "agentVersion": "10.5830.18209.1001", + "groupName": null, + "osBuild": 18209, + "healthStatus": "Active", + "isAadJoined": true, + "machineTags": [], + "rbacGroupId": 140, + "riskScore": "Low", + "aadDeviceId": null + }, + { + "id": "7292e4b8cb74ff1cc3d8a495eb29dc8858b732f7", + "computerDnsName": "mymachine2.contoso.com", + "firstSeen": "2018-07-09T13:22:45.1250071Z", + "osPlatform": "Windows10", + "osVersion": null, + "systemProductName": null, + "lastIpAddress": "192.168.12.225", + "lastExternalIpAddress": "79.183.65.82", + "agentVersion": "10.5820.17724.1000", + "groupName": "WDATPClientTeam", + "osBuild": 17724, + "healthStatus": "Inactive", + "isAadJoined": true, + "machineTags": [], + "rbacGroupId": 140, + "riskScore": "Low", + "aadDeviceId": null + } + ] +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-query-example.PNG b/windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-query-example.PNG index dda65b5342..d7e7d092eb 100644 Binary files a/windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-query-example.PNG and b/windows/security/threat-protection/windows-defender-atp/images/advanced-hunting-query-example.PNG differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/nativeapp-add-permission.png b/windows/security/threat-protection/windows-defender-atp/images/nativeapp-add-permission.png new file mode 100644 index 0000000000..32860c3359 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/nativeapp-add-permission.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/nativeapp-add-permissions-end.png b/windows/security/threat-protection/windows-defender-atp/images/nativeapp-add-permissions-end.png new file mode 100644 index 0000000000..eb866e3cce Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/nativeapp-add-permissions-end.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/nativeapp-create.png b/windows/security/threat-protection/windows-defender-atp/images/nativeapp-create.png new file mode 100644 index 0000000000..05d76ec807 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/nativeapp-create.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/nativeapp-decoded-token.png b/windows/security/threat-protection/windows-defender-atp/images/nativeapp-decoded-token.png new file mode 100644 index 0000000000..92f46bf116 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/nativeapp-decoded-token.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/nativeapp-get-appid.png b/windows/security/threat-protection/windows-defender-atp/images/nativeapp-get-appid.png new file mode 100644 index 0000000000..dd7551d5a5 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/nativeapp-get-appid.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/nativeapp-select-permissions.png b/windows/security/threat-protection/windows-defender-atp/images/nativeapp-select-permissions.png new file mode 100644 index 0000000000..5b17f2dc02 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/nativeapp-select-permissions.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-create-advanced-query.png b/windows/security/threat-protection/windows-defender-atp/images/power-bi-create-advanced-query.png new file mode 100644 index 0000000000..d5fdf37ac2 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/power-bi-create-advanced-query.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-create-blank-query.png b/windows/security/threat-protection/windows-defender-atp/images/power-bi-create-blank-query.png new file mode 100644 index 0000000000..d060becd5b Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/power-bi-create-blank-query.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-edit-credentials.png b/windows/security/threat-protection/windows-defender-atp/images/power-bi-edit-credentials.png new file mode 100644 index 0000000000..62c96acf75 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/power-bi-edit-credentials.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-edit-data-privacy.png b/windows/security/threat-protection/windows-defender-atp/images/power-bi-edit-data-privacy.png new file mode 100644 index 0000000000..7098c8a543 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/power-bi-edit-data-privacy.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-open-advanced-editor.png b/windows/security/threat-protection/windows-defender-atp/images/power-bi-open-advanced-editor.png new file mode 100644 index 0000000000..5c340e3138 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/power-bi-open-advanced-editor.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-query-results.png b/windows/security/threat-protection/windows-defender-atp/images/power-bi-query-results.png new file mode 100644 index 0000000000..25392791c0 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/power-bi-query-results.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials.png b/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials.png new file mode 100644 index 0000000000..dce1698521 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-credentials.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-data-privacy.png b/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-data-privacy.png new file mode 100644 index 0000000000..00a8756c43 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/power-bi-set-data-privacy.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-decoded-token.png b/windows/security/threat-protection/windows-defender-atp/images/webapp-decoded-token.png new file mode 100644 index 0000000000..be98e49216 Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/webapp-decoded-token.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/images/webapp-grant-permissions.png b/windows/security/threat-protection/windows-defender-atp/images/webapp-grant-permissions.png new file mode 100644 index 0000000000..363bb4a32a Binary files /dev/null and b/windows/security/threat-protection/windows-defender-atp/images/webapp-grant-permissions.png differ diff --git a/windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md b/windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md new file mode 100644 index 0000000000..169b2ffb46 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/improverequestperformance-new.md @@ -0,0 +1,9 @@ +--- +ms.date: 08/28/2017 +author: zavidor +--- +>[!NOTE] +>For better performance, you can use server closer to your geo location: +> - api-us.securitycenter.windows.com +> - api-eu.securitycenter.windows.com +> - api-uk.securitycenter.windows.com \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md index d90a76d961..c6beecee0e 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: medium -ms.date: 05/30/2018 +ms.date: 08/01/2018 --- # Investigate machines in the Windows Defender ATP Machines list @@ -178,6 +178,9 @@ Use the following registry key entry to add a tag on a machine: - Registry key: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection\DeviceTagging\` - Registry key value (string): Group +>[!NOTE] +>The device tag is part of the machine information report that’s generated once a day. As an alternative, you may choose to restart the endpoint that would transfer a new machine information report. + ### Add machine tags using the portal Dynamic context capturing is achieved using tags. By tagging machines, you can keep track of individual machines in your organization. After adding tags on machines, you can apply the Tags filter on the Machines list to get a narrowed list of machines with the tag. diff --git a/windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..5823c0d793 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,77 @@ +--- +title: Is domain seen in org API +description: Use this API to create calls related to checking whether a domain was seen in the organization. +keywords: apis, graph api, supported apis, domain, domain seen +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 04/24/2018 +--- + +# Was domain seen in org + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Answers whether a domain was seen in the organization. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Url.Read.All | 'Read URLs' +Delegated (work or school account) | URL.Read.All | 'Read URLs' + +## HTTP request +``` +GET /api/domains/{domain} +``` + +## Request headers + +Header | Value +:---|:--- +Authorization | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and domain exists - 200 OK. If domain does not exist - 404 Not Found. + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +GET https://api.securitycenter.windows.com/api/domains/example.com +Content-type: application/json +``` + +**Response** + +Here is an example of the response. + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Domains/$entity", + "host": "example.com" +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..b015a3afe9 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/is-ip-seen-org-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,77 @@ +--- +title: Is IP seen in org API +description: Answers whether an IP was seen in the organization. +keywords: apis, graph api, supported apis, is, ip, seen, org, organization +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Was IP seen in org + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Answers whether an IP was seen in the organization. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Ip.Read.All | 'Read IP address profiles' +Delegated (work or school account) | Ip.Read.All | 'Read IP address profiles' + +## HTTP request +``` +GET /api/ips/{ip} +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. + + +## Request body +Empty + +## Response +If successful and IP exists - 200 OK. If IP do not exist - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +``` +GET https://api.securitycenter.windows.com/api/ips/10.209.67.177 +``` + +**Response** + +Here is an example of the response. + +[!include[Improve request performance](improverequestperformance-new.md)] + + +``` +HTTP/1.1 200 OK +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Ips/$entity", + "id": "10.209.67.177" +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..45a75dc778 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/isolate-machine-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,102 @@ +--- +title: Isolate machine API +description: Use this API to create calls related isolating a machine. +keywords: apis, graph api, supported apis, isolate machine +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Isolate machine API + +[!include[Prerelease information](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Isolates a machine from accessing external network. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Isolate | 'Isolate machine' +Delegated (work or school account) | Machine.Isolate | 'Isolate machine' + +## HTTP request +``` +POST /api/machines/{id}/isolate +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. +Content-Type | string | application/json. **Required**. + +## Request body +In the request body, supply a JSON object with the following parameters: + +Parameter | Type | Description +:---|:---|:--- +Comment | String | Comment to associate with the action. **Required**. +IsolationType | String | Type of the isolation. Allowed values are: 'Full' or 'Selective'. + +**IsolationType** controls the type of isolation to perform and can be one of the following: +- Full – Full isolation +- Selective – Restrict only limited set of applications from accessing the network + + +## Response +If successful, this method returns 201 - Created response code and [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) in the response body. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/isolate +Content-type: application/json +{ + "Comment": "Isolate machine due to alert 1234", + “IsolationType”: “Full” +} + +``` +**Response** + +Here is an example of the response. + +``` +HTTP/1.1 201 Created +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions/$entity", + "id": "b89eb834-4578-496c-8be0-03f004061435", + "type": "Isolate", + "requestor": "Analyst@contoso.com ", + "requestorComment": "Isolate machine due to alert 1234", + "status": "InProgress", + "error": "None", + "machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", + "creationDateTimeUtc": "2017-12-04T12:12:18.9725659Z", + "lastUpdateTimeUtc": "2017-12-04T12:12:18.9725659Z" +} + +``` + +To unisolate a machine, see [Release machine from isolation](unisolate-machine-windows-defender-advanced-threat-protection-new.md). diff --git a/windows/security/threat-protection/windows-defender-atp/machine-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/machine-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..093e47ba79 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/machine-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,45 @@ +--- +title: machine resource type +description: Retrieves top machines. +keywords: apis, supported apis, get, machines +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# machine resource type + + +# Methods +Method|Return Type |Description +:---|:---|:--- +[List machines](get-machines-windows-defender-advanced-threat-protection-new.md) | [machine](machine-windows-defender-advanced-threat-protection-new.md) collection | List set of [machine](machine-windows-defender-advanced-threat-protection-new.md) entities in the org. +[Get machine](get-machine-by-id-windows-defender-advanced-threat-protection.md) | [machine](machine-windows-defender-advanced-threat-protection-new.md) | Get a [machine](machine-windows-defender-advanced-threat-protection-new.md) by its identity. +[Get logged on users](get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md) | [user](user-windows-defender-advanced-threat-protection-new.md) collection | Get the set of [User](user-windows-defender-advanced-threat-protection-new.md) that logged on to the [machine](machine-windows-defender-advanced-threat-protection-new.md). +[Get related alerts](get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md) | [alert](alerts-windows-defender-advanced-threat-protection-new.md) collection | Get the set of [alert](alerts-windows-defender-advanced-threat-protection-new.md) entities that were raised on the [machine](machine-windows-defender-advanced-threat-protection-new.md). + +# Properties +Property | Type | Description +:---|:---|:--- +id | String | [machine](machine-windows-defender-advanced-threat-protection-new.md) identity. +computerDnsName | String | [machine](machine-windows-defender-advanced-threat-protection-new.md) fully qualified name. +firstSeen | DateTimeOffset | First date and time where the [machine](machine-windows-defender-advanced-threat-protection-new.md) was observed by WDATP. +osPlatform | String | OS platform. +osVersion | String | OS Version. +lastIpAddress | Ip | Last IP on local NIC on the [machine](machine-windows-defender-advanced-threat-protection-new.md). +lastExternalIpAddress | Ip | Last IP through which the [machine](machine-windows-defender-advanced-threat-protection-new.md) accessed the internet. +agentVersion | String | Version of WDATP agent. +groupName | String | [machine](machine-windows-defender-advanced-threat-protection-new.md) group name (when defined). +osBuild | Int | OS build number. +healthStatus | String | [machine](machine-windows-defender-advanced-threat-protection-new.md) health status. +isAadJoined | Boolean | Is [machine](machine-windows-defender-advanced-threat-protection-new.md) AAD joined. +machineTags | String collection | Set of [machine](machine-windows-defender-advanced-threat-protection-new.md) tags. +rbacGroupId | Int | Group ID. +riskScore | String | Risk score as evaludated by WDATP. Possible values are: 'None', 'Low', 'Medium' and 'High'. +aadDeviceId | String | AAD Device ID (when [machine](machine-windows-defender-advanced-threat-protection-new.md) is Aad Joined). \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..3166f0526d --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/machineaction-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,42 @@ +--- +title: machineAction resource type +description: Retrieves top recent machineActions. +keywords: apis, supported apis, get, machineaction, recent +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# MachineAction resource type + +Method|Return Type |Description +:---|:---|:--- +[List MachineActions](get-machineactions-collection-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | List [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) entities. +[Get MachineAction](get-machineaction-object-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Get a single [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) entity. +[Collect investigation package](collect-investigation-package-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Collect investigation package from a [machine](machine-windows-defender-advanced-threat-protection-new.md). +[Get investigation package SAS URI](get-package-sas-uri-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Get URI for downloading the investigation package. +[Isolate machine](isolate-machine-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Isolate [machine](machine-windows-defender-advanced-threat-protection-new.md) from network. +[Release machine from isolation](unisolate-machine-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Release [machine](machine-windows-defender-advanced-threat-protection-new.md) from Isolation. +[Restrict app execution](restrict-code-execution-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Restrict application execution. +[Remove app restriction](unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Remove application execution restriction. +[Run antivirus scan](run-av-scan-windows-defender-advanced-threat-protection-new.md) | [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Run an AV scan using Windows Defender (when applicable). +[Offboard machine](offboard-machine-api-windows-defender-advanced-threat-protection-new.md)|[Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) | Offboard [machine](machine-windows-defender-advanced-threat-protection-new.md) from WDATP. + +# Properties +Property | Type | Description +:---|:---|:--- +id | Guid | Identity of the [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) entity. +type | String | Type of the action. +requestor | String | Identity of the person that executed the action. +requestorComment | String | Comment that was written when issuing the action. +status | String | Current status of the command. Possible values are: "InProgress", "Succeeded", "Failed" and "Cancelled". +error | String | Error code providing more insight as to what have caused the command to fail. +machineId | String | Id of the machine on which the action was executed. +creationDateTimeUtc | DateTimeOffset | The date and time when the action was created. +lastUpdateTimeUtc | DateTimeOffset | The last date and time when the action status was updated. diff --git a/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md index e1ce6b8173..89eeee2c0e 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md @@ -41,9 +41,7 @@ For example, if you add *exe* and *bat* as file or attachment extension names, t 3. Configure the following extension names and separate extension names with a comma: - **File extension names** - Suspicious files except email attachments will be submitted for additional inspection - - **Attachment extension names** - Suspicious email attachments with these extension names will be submitted for additional inspection - - + ## Related topics - [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md index 2c3da444dd..aee31bf368 100644 --- a/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.author: macapara author: mjcaparas -ms.localizationpriority: high +ms.localizationpriority: medium ms.date: 07/01/2018 --- diff --git a/windows/security/threat-protection/windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..001aac7db4 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/offboard-machine-api-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,93 @@ +--- +title: Offboard machine API +description: Use this API to offboard a machine from WDATP. +keywords: apis, graph api, supported apis, collect investigation package +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Offboard machine API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Offboard machine from WDATP. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Offboard | 'Offboard machine' +Delegated (work or school account) | Machine.Offboard | 'Offboard machine' + +## HTTP request +``` +POST /api/machines/{id}/offboard +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. +Content-Type | string | application/json. **Required**. + +## Request body +In the request body, supply a JSON object with the following parameters: + +Parameter | Type | Description +:---|:---|:--- +Comment | String | Comment to associate with the action. **Required**. + +## Response +If successful, this method returns 201 - Created response code and [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) in the response body. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/offboard +Content-type: application/json +{ + "Comment": "Offboard machine by automation" +} +``` + +**Response** + +Here is an example of the response. + +``` +HTTP/1.1 201 Created +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions/$entity", + "id": "c9042f9b-8483-4526-87b5-35e4c2532223", + "type": "OffboardMachine", + "requestor": "Analyst@contoso.com", + "requestorComment": "offboard machine by automation", + "status": "InProgress", + "error": "None", + "machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", + "creationDateTimeUtc": "2017-12-04T12:09:24.1785079Z", + "lastUpdateTimeUtc": "2017-12-04T12:09:24.1785079Z" +} + +``` diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md index 97d408e645..5f44382d18 100644 --- a/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md @@ -9,7 +9,7 @@ ms.sitesec: library ms.pagetype: security ms.author: macapara author: mjcaparas -ms.localizationpriority: high +ms.localizationpriority: medium ms.date: 07/01/2018 --- diff --git a/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md index ee949dfc75..05a565f9f6 100644 --- a/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md @@ -200,5 +200,10 @@ There are a couple of tabs on the report that's generated: In general, if you know of a specific threat name, CVE, or KB, you can identify machines with unpatched vulnerabilities that might be leveraged by threats. This report also helps you determine whether machine-level mitigations are configured correctly on the machines and prioritize those that might need attention. +## Related topic +- [**Beta** Create custom Power BI reports](run-advanced-query-sample-power-bi.md) + + + diff --git a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md index 16ca374715..8675655043 100644 --- a/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/preview-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: medium -ms.date: 06/21/2018 +ms.date: 07/30/2018 --- # Windows Defender ATP preview features @@ -49,6 +49,10 @@ Onboard supported versions of Windows machines so that they can send sensor data - Windows 8.1 Enterprise - Windows 8.1 Pro +- [Integration with Azure Security Center](configure-server-endpoints-windows-defender-advanced-threat-protection.md#integration-with-azure-security-center)
    +Windows Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Windows Defender ATP to provide improved threat detection for Windows Servers. + + >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-preview-belowfoldlink) diff --git a/windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..0ecc9cd09c --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/restrict-code-execution-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,96 @@ +--- +title: Restrict app execution API +description: Use this API to create calls related to restricting an application from executing. +keywords: apis, graph api, supported apis, collect investigation package +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Restrict app execution API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Restrict execution of all applications on the machine except a predefined set (see [Response machine alerts](respond-machine-alerts-windows-defender-advanced-threat-protection.md) for more information) + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.RestrictExecution | 'Restrict code execution' +Delegated (work or school account) | Machine.RestrictExecution | 'Restrict code execution' + +## HTTP request +``` +POST /api/machines/{id}/restrictCodeExecution +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. +Content-Type | string | application/json. **Required**. + +## Request body +In the request body, supply a JSON object with the following parameters: + +Parameter | Type | Description +:---|:---|:--- +Comment | String | Comment to associate with the action. **Required**. + +## Response +If successful, this method returns 201 - Created response code and [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) in the response body. + + +## Example + +**Request** + +Here is an example of the request. + +``` +POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/restrictCodeExecution +Content-type: application/json +{ + "Comment": "Restrict code execution due to alert 1234" +} + +``` +**Response** + +Here is an example of the response. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +HTTP/1.1 201 Created +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions/$entity", + "id": "78d408d1-384c-4c19-8b57-ba39e378011a", + "type": "RestrictCodeExecution", + "requestor": "Analyst@contoso.com ", + "requestorComment": "Restrict code execution due to alert 1234", + "status": "InProgress", + "error": "None", + "machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", + "creationDateTimeUtc": "2017-12-04T12:15:04.3825985Z", + "lastUpdateTimeUtc": "2017-12-04T12:15:04.3825985Z" +} + +``` + +To remove code execution restriction from a machine, see [Remove app restriction](unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md). + diff --git a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md index 8a6c8b5831..b53851bf20 100644 --- a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md +++ b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-api.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: medium -ms.date: 30/07/2018 +ms.date: 09/03/2018 --- # Advanced hunting API @@ -36,6 +36,7 @@ One of the following permissions is required to call this API. To learn more, in Permission type | Permission | Permission display name :---|:---|:--- Application | AdvancedQuery.Read.All | 'Run advanced queries' +Delegated (work or school account) | AdvancedQuery.Read | 'Run advanced queries' ## HTTP request ``` @@ -124,13 +125,17 @@ Content-Type: application/json​ ## T​roubl​eshooting: -- (403) Forbidden. +- Error: (403) Forbidden - If you get this error when calling WDATP API, your token probably does not include the necessary permission, + + If you get this error when calling WDATP API, your token probably does not include the necessary permission. + Check [app permissions](exposed-apis-create-app-webapp.md#validate-the-token) or [delegated permissions](exposed-apis-create-app-nativeapp.md#validate-the-token) included in your token. - If the 'roles' section in the token does not include the necessary permission, - - either you did not add the necessary permission to your app (refer to [Access Windows Defender ATP without a user](exposed-apis-create-app-webapp.md#create-an-app) or [Access Windows Defender ATP on behalf of a user](exposed-apis-create-app-nativeapp.md#create-an-app)) - - or you did not authorized your app in the tenant (refer to [Application consent](exposed-apis-create-app-webapp.md#application-consent)) + + If the 'roles' section in the token does not include the necessary permission: + + - The necessary permission to your app might not have been granted. For more information, see [Access Windows Defender ATP without a user](exposed-apis-create-app-webapp.md#create-an-app) or [Access Windows Defender ATP on behalf of a user](exposed-apis-create-app-nativeapp.md#create-an-app) or, + - The app was not authorized in the tenant, see [Application consent](exposed-apis-create-app-webapp.md#application-consent). ## Related topic diff --git a/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi.md b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi.md new file mode 100644 index 0000000000..d3abe10318 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/run-advanced-query-sample-power-bi.md @@ -0,0 +1,131 @@ +--- +title: Advanced Hunting API +description: Use this API to run advanced queries +keywords: apis, supported apis, advanced hunting, query +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 30/07/2018 +--- + +# Create custom reports using Power BI + +Run advanced queries and show results in Microsoft Power BI. Please read about [Advanced Hunting API](run-advanced-query-api.md) before. + +In this section we share Power BI query sample to run a query using application token. + +>**Prerequisite**: You first need to [create an app](exposed-apis-intro.md). + +## Run a query + +- Open Microsoft Power BI + +- Click **Get Data** > **Blank Query** + + ![Image of create blank query](images/power-bi-create-blank-query.png) + +- Click **Advanced Editor** + + ![Image of open advanced editor](images/power-bi-open-advanced-editor.png) + +- Copy the below and paste it in the editor, after you update the values of _TenantId, _AppId, _AppSecret, _Query + + ``` + let + + TenantId = "00000000-0000-0000-0000-000000000000", // Paste your own tenant ID here + AppId = "11111111-1111-1111-1111-111111111111", // Paste your own app ID here + AppSecret = "22222222-2222-2222-2222-222222222222", // Paste your own app secret here + Query = "MachineInfo | where EventTime > ago(7d) | summarize EventCount=count(), LastSeen=max(EventTime) by MachineId", // Paste your own query here + + ResourceAppIdUrl = "https://securitycenter.onmicrosoft.com/windowsatpservice", + OAuthUrl = Text.Combine({"https://login.windows.net/", TenantId, "/oauth2/token"}, ""), + + Resource = Text.Combine({"resource", Uri.EscapeDataString(ResourceAppIdUrl)}, "="), + ClientId = Text.Combine({"client_id", AppId}, "="), + ClientSecret = Text.Combine({"client_secret", Uri.EscapeDataString(AppSecret)}, "="), + GrantType = Text.Combine({"grant_type", "client_credentials"}, "="), + + Body = Text.Combine({Resource, ClientId, ClientSecret, GrantType}, "&"), + + AuthResponse= Json.Document(Web.Contents(OAuthUrl, [Content=Text.ToBinary(Body)])), + AccessToken= AuthResponse[access_token], + Bearer = Text.Combine({"Bearer", AccessToken}, " "), + + AdvancedHuntingUrl = "https://api.securitycenter.windows.com/advancedqueries/query", + + Response = Json.Document(Web.Contents( + AdvancedHuntingUrl, + [ + Headers = [#"Content-Type"="application/json", #"Accept"="application/json", #"Authorization"=Bearer], + Content=Json.FromValue(Query) + ] + )), + + TypeMap = #table( + { "Type", "PowerBiType" }, + { + { "Double", Double.Type }, + { "Int64", Int64.Type }, + { "Int32", Int32.Type }, + { "Int16", Int16.Type }, + { "UInt64", Number.Type }, + { "UInt32", Number.Type }, + { "UInt16", Number.Type }, + { "Byte", Byte.Type }, + { "Single", Single.Type }, + { "Decimal", Decimal.Type }, + { "TimeSpan", Duration.Type }, + { "DateTime", DateTimeZone.Type }, + { "String", Text.Type }, + { "Boolean", Logical.Type }, + { "SByte", Logical.Type }, + { "Guid", Text.Type } + }), + + Schema = Table.FromRecords(Response[Schema]), + TypedSchema = Table.Join(Table.SelectColumns(Schema, {"Name", "Type"}), {"Type"}, TypeMap , {"Type"}), + Results = Response[Results], + Rows = Table.FromRecords(Results, Schema[Name]), + Table = Table.TransformColumnTypes(Rows, Table.ToList(TypedSchema, (c) => {c{0}, c{2}})) + + in Table + + ``` + +- Click **Done** + + ![Image of create advanced query](images/power-bi-create-advanced-query.png) + +- Click **Edit Credentials** + + ![Image of edit credentials](images/power-bi-edit-credentials.png) + +- Select **Anonymous** and click **Connect** + + ![Image of set credentials](images/power-bi-set-credentials.png) + +- Repeat the previous step for the second URL + +- Click **Continue** + + ![Image of edit data privacy](images/power-bi-edit-data-privacy.png) + +- Select the privacy level you want and click **Save** + + ![Image of set data privacy](images/power-bi-set-data-privacy.png) + +- View the results of your query + + ![Image of query results](images/power-bi-query-results.png) + +## Related topic +- [Windows Defender ATP APIs](exposed-apis-intro.md) +- [Advanced Hunting API](run-advanced-query-api.md) +- [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md) +- [Schedule Advanced Hunting](run-advanced-query-sample-ms-flow.md) diff --git a/windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..d9adb2e60f --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,102 @@ +--- +title: Run antivirus scan API +description: Use this API to create calls related to running an antivirus scan on a machine. +keywords: apis, graph api, supported apis, remove machine from isolation +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Run antivirus scan API + +[!include[Prerelease information](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Initiate Windows Defender Antivirus scan on a machine. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Scan | 'Scan machine' +Delegated (work or school account) | Machine.Scan | 'Scan machine' + +## HTTP request +``` +POST /api/machines/{id}/runAntiVirusScan +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. +Content-Type | string | application/json + +## Request body +In the request body, supply a JSON object with the following parameters: + +Parameter | Type | Description +:---|:---|:--- +Comment | String | Comment to associate with the action. **Required**. +ScanType| String | Defines the type of the Scan. **Required**. + +**ScanType** controls the type of scan to perform and can be one of the following: + +- **Quick** – Perform quick scan on the machine +- **Full** – Perform full scan on the machine + + + +## Response +If successful, this method returns 201, Created response code and _MachineAction_ object in the response body. + + +## Example + +**Request** + +Here is an example of the request. + +``` +POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/runAntiVirusScan +Content-type: application/json +{ + "Comment": "Check machine for viruses due to alert 3212", + “ScanType”: “Full” +} +``` + +**Response** + +Here is an example of the response. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +HTTP/1.1 201 Created +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions/$entity", + "id": "2e9da30d-27f6-4208-81f2-9cd3d67893ba", + "type": "RunAntiVirusScan", + "requestor": "Analyst@contoso.com", + "requestorComment": "Check machine for viruses due to alert 3212", + "status": "InProgress", + "error": "None", + "machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", + "creationDateTimeUtc": "2017-12-04T12:18:27.1293487Z", + "lastUpdateTimeUtc": "2017-12-04T12:18:27.1293487Z" +} + +``` diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md index ef5f861a65..eee538a7aa 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md @@ -1,76 +1,85 @@ ---- -title: Troubleshoot onboarding issues and error messages -description: Troubleshoot onboarding issues and error message while completing setup of Windows Defender Advanced Threat Protection. -keywords: troubleshoot, troubleshooting, Azure Active Directory, onboarding, error message, error messages, windows defender atp -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: v-tanewt -author: tbit0001 -ms.localizationpriority: medium -ms.date: 11/28/2017 ---- - -# Troubleshoot subscription and portal access issues - -**Applies to:** - -- Windows 10 Enterprise -- Windows 10 Education -- Windows 10 Pro -- Windows 10 Pro Education -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - - ->Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troublshootonboarding-abovefoldlink) - - -This page provides detailed steps to troubleshoot issues that might occur when setting up your Windows Defender ATP service. - -If you receive an error message, Windows Defender Security Center will provide a detailed explanation on what the issue is and relevant links will be supplied. - -## No subscriptions found - -If while accessing Windows Defender Security Center you get a **No subscriptions found** message, it means the Azure Active Directory (AAD) used to login the user to the portal, does not have a Windows Defender ATP license. - -Potential reasons: -- The Windows E5 and Office E5 licenses are separate licenses. -- The license was purchased but not provisioned to this AAD instance. - - It could be a license provisioning issue. - - It could be you inadvertently provisioned the license to a different Microsoft AAD than the one used for authentication into the service. - -For both cases you should contact Microsoft support at [General Windows Defender ATP Support](https://support.microsoft.com/en-us/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636419533611396913) or -[Volume license support](https://www.microsoft.com/licensing/servicecenter/Help/Contact.aspx). - -![Image of no subscriptions found](images\atp-no-subscriptions-found.png) - -## Your subscription has expired - -If while accessing Windows Defender Security Center you get a **Your subscription has expired** message, your online service subscription has expired. Windows Defender ATP subscription, like any other online service subscription, has an expiration date. - -You can choose to renew or extend the license at any point in time. When accessing the portal after the expiration date a **Your subscription has expired** message will be presented with an option to download the machine offboarding package, should you choose to not renew the license. - -> [!NOTE] -> For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. - -![Image of subscription expired](images\atp-subscription-expired.png) - -## You are not authorized to access the portal - -If you receive a **You are not authorized to access the portal**, be aware that Windows Defender ATP is a security monitoring, incident investigation and response product, and as such, access to it is restricted and controlled by the user. -For more information see, [**Assign user access to the portal**](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection). - -![Image of not authorized to access portal](images\atp-not-authorized-to-access-portal.png) - -## Data currently isn't available on some sections of the portal -If the portal dashboard, and other sections show an error message such as "Data currently isn't available": - -![Image of data currently isn't available](images/atp-data-not-available.png) - -You'll need to whitelist the `securitycenter.windows.com` and all sub-domains under it. For example `*.securitycenter.windows.com`. - - -## Related topics +--- +title: Troubleshoot onboarding issues and error messages +description: Troubleshoot onboarding issues and error message while completing setup of Windows Defender Advanced Threat Protection. +keywords: troubleshoot, troubleshooting, Azure Active Directory, onboarding, error message, error messages, windows defender atp +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: v-tanewt +author: tbit0001 +ms.localizationpriority: medium +ms.date: 08/01/2018 +--- + +# Troubleshoot subscription and portal access issues + +**Applies to:** + +- Windows 10 Enterprise +- Windows 10 Education +- Windows 10 Pro +- Windows 10 Pro Education +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + +>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troublshootonboarding-abovefoldlink) + + +This page provides detailed steps to troubleshoot issues that might occur when setting up your Windows Defender ATP service. + +If you receive an error message, Windows Defender Security Center will provide a detailed explanation on what the issue is and relevant links will be supplied. + +## No subscriptions found + +If while accessing Windows Defender Security Center you get a **No subscriptions found** message, it means the Azure Active Directory (AAD) used to login the user to the portal, does not have a Windows Defender ATP license. + +Potential reasons: +- The Windows E5 and Office E5 licenses are separate licenses. +- The license was purchased but not provisioned to this AAD instance. + - It could be a license provisioning issue. + - It could be you inadvertently provisioned the license to a different Microsoft AAD than the one used for authentication into the service. + +For both cases you should contact Microsoft support at [General Windows Defender ATP Support](https://support.microsoft.com/en-us/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636419533611396913) or +[Volume license support](https://www.microsoft.com/licensing/servicecenter/Help/Contact.aspx). + +![Image of no subscriptions found](images\atp-no-subscriptions-found.png) + +## Your subscription has expired + +If while accessing Windows Defender Security Center you get a **Your subscription has expired** message, your online service subscription has expired. Windows Defender ATP subscription, like any other online service subscription, has an expiration date. + +You can choose to renew or extend the license at any point in time. When accessing the portal after the expiration date a **Your subscription has expired** message will be presented with an option to download the machine offboarding package, should you choose to not renew the license. + +> [!NOTE] +> For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. + +![Image of subscription expired](images\atp-subscription-expired.png) + +## You are not authorized to access the portal + +If you receive a **You are not authorized to access the portal**, be aware that Windows Defender ATP is a security monitoring, incident investigation and response product, and as such, access to it is restricted and controlled by the user. +For more information see, [**Assign user access to the portal**](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection). + +![Image of not authorized to access portal](images\atp-not-authorized-to-access-portal.png) + +## Data currently isn't available on some sections of the portal +If the portal dashboard, and other sections show an error message such as "Data currently isn't available": + +![Image of data currently isn't available](images/atp-data-not-available.png) + +You'll need to whitelist the `securitycenter.windows.com` and all sub-domains under it. For example `*.securitycenter.windows.com`. + + +## Portal communication issues +If you encounter issues with accessing the portal, missing data, or restricted access to portions of the portal, you'll need to verify that the following URLs are whitelisted and open for communciation. + +- `*.blob.core.windows.net +crl.microsoft.com` +- `https://*.microsoftonline-p.com` - `https://*.securitycenter.windows.com` - `https://automatediracs-eus-prd.securitycenter.windows.com` - `https://login.microsoftonline.com` - `https://login.windows.net` - `https://onboardingpackagescusprd.blob.core.windows.net` +- `https://secure.aadcdn.microsoftonline-p.com` +- `https://securitycenter.windows.com` - `https://static2.sharepointonline.com` + +## Related topics - [Validate licensing provisioning and complete setup for Windows Defender ATP](licensing-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md index 37aca9ce88..c6e68b56e5 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: medium -ms.date: 07/12/2017 +ms.date: 07/30/2018 --- # Troubleshoot service issues @@ -22,11 +22,11 @@ ms.date: 07/12/2017 This section addresses issues that might arise as you use the Windows Defender Advanced Threat service. -### Server error - Access is denied due to invalid credentials +## Server error - Access is denied due to invalid credentials If you encounter a server error when trying to access the service, you’ll need to change your browser cookie settings. Configure your browser to allow cookies. -### Elements or data missing on the portal +## Elements or data missing on the portal If some UI elements or data is missing on Windows Defender Security Center it’s possible that proxy settings are blocking it. Make sure that `*.securitycenter.windows.com` is included the proxy whitelist. @@ -35,17 +35,17 @@ Make sure that `*.securitycenter.windows.com` is included the proxy whitelist. > [!NOTE] > You must use the HTTPS protocol when adding the following endpoints. -### Windows Defender ATP service shows event or error logs in the Event Viewer +## Windows Defender ATP service shows event or error logs in the Event Viewer See the topic [Review events and errors using Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md) for a list of event IDs that are reported by the Windows Defender ATP service. The topic also contains troubleshooting steps for event errors. -### Windows Defender ATP service fails to start after a reboot and shows error 577 +## Windows Defender ATP service fails to start after a reboot and shows error 577 If onboarding machines successfully completes but Windows Defender ATP does not start after a reboot and shows error 577, check that Windows Defender is not disabled by a policy. For more information, see [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy). -#### Known issues with regional formats +## Known issues with regional formats **Date and time formats**
    There are some known issues with the time and date formats. @@ -65,6 +65,20 @@ Support of use of comma as a separator in numbers are not supported. Regions whe >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshoot-belowfoldlink) +## Windows Defender ATP tenant was automatically created in Europe +When you use Azure Security Center to monitor servers, a Windows Defender ATP tenant is automatically created. The Windows Defender ATP data is stored in Europe by default. + + + + + + + + + + + + ## Related topics - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..aafaac2b2f --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/unisolate-machine-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,100 @@ +--- +title: Release machine from isolation API +description: Use this API to create calls related to release a machine from isolation. +keywords: apis, graph api, supported apis, remove machine from isolation +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Release machine from isolation API + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Undo isolation of a machine. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.Isolate | 'Isolate machine' +Delegated (work or school account) | Machine.Isolate | 'Isolate machine' + +## HTTP request +``` +POST /api/machines/{id}/unisolate +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. +Content-Type | string | application/json. **Required**. + + +## Request body +In the request body, supply a JSON object with the following parameters: + +Parameter | Type | Description +:---|:---|:--- +Comment | String | Comment to associate with the action. **Required**. + +## Response +If successful, this method returns 201 - Created response code and [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) in the response body. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/unisolate +Content-type: application/json +{ + "Comment": "Unisolate machine since it was clean and validated" +} + +``` +**Response** + +Here is an example of the response. + +>[!NOTE] +>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call. + +``` +HTTP/1.1 201 Created +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions/$entity", + "id": "09a0f91e-a2eb-409d-af33-5577fe9bd558", + "type": "Unisolate", + "requestor": "Analyst@contoso.com ", + "requestorComment": "Unisolate machine since it was clean and validated ", + "status": "InProgress", + "error": "None", + "machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", + "creationDateTimeUtc": "2017-12-04T12:13:15.0104931Z", + "lastUpdateTimeUtc": "2017-12-04T12:13:15.0104931Z" +} + +``` + +To isolate a machine, see [Isolate machine](isolate-machine-windows-defender-advanced-threat-protection-new.md). + diff --git a/windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..6d624f7855 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,95 @@ +--- +title: Remove app restriction API +description: Use this API to create calls related to removing a restriction from applications from executing. +keywords: apis, graph api, supported apis, remove machine from isolation +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Remove app restriction API + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + + + +Enable execution of any application on the machine. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Machine.RestrictExecution | 'Restrict code execution' +Delegated (work or school account) | Machine.RestrictExecution | 'Restrict code execution' + +## HTTP request +``` +POST /api/machines/{id}/unrestrictCodeExecution +``` + +## Request headers +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. +Content-Type | string | application/json. **Required**. + +## Request body +In the request body, supply a JSON object with the following parameters: + +Parameter | Type | Description +:---|:---|:--- +Comment | String | Comment to associate with the action. **Required**. + +## Response +If successful, this method returns 201 - Created response code and [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md) in the response body. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +POST https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/unrestrictCodeExecution +Content-type: application/json +{ + "Comment": "Unrestrict code execution since machine was cleaned and validated" +} + +``` + +**Response** + +Here is an example of the response. + +``` +HTTP/1.1 201 Created +Content-type: application/json +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions/$entity", + "id": "44cffc15-0e3d-4cbf-96aa-bf76f9b27f5e", + "type": "UnrestrictCodeExecution", + "requestor": "Analyst@contoso.com", + "requestorComment": "Unrestrict code execution since machine was cleaned and validated ", + "status": "InProgress", + "error": "None", + "machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", + "creationDateTimeUtc": "2017-12-04T12:15:40.6052029Z", + "lastUpdateTimeUtc": "2017-12-04T12:15:40.6052029Z" +} + +``` + +To restrict code execution on a machine, see [Restrict app execution](restrict-code-execution-windows-defender-advanced-threat-protection-new.md). \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..40f47a0edc --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/update-alert-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,104 @@ +--- +title: Get alert information by ID API +description: Retrieves an alert by its ID. +keywords: apis, graph api, supported apis, get, alert, information, id +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# Update alert + +[!include[Prereleaseinformation](prerelease.md)] + +**Applies to:** + +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +Update the properties of an alert entity. + +## Permissions +One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](exposed-apis-intro.md) + +Permission type | Permission | Permission display name +:---|:---|:--- +Application | Alerts.ReadWrite.All | 'Read and write all alerts' +Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts' + +## HTTP request +``` +PATCH /api/alerts/{id} +``` + +## Request headers + +Name | Type | Description +:---|:---|:--- +Authorization | String | Bearer {token}. **Required**. +Content-Type | String | application/json. **Required**. + + +## Request body +In the request body, supply the values for the relevant fields that should be updated.Existing properties that are not included in the request body will maintain their previous values or be recalculated based on tchanges to other property values. For best performance you shouldn't include existing values that haven't change. + +Property | Type | Description +:---|:---|:--- +status | String | Specifies the current status of the alert. The property values are: 'New', 'InProgress' and 'Resolved'. +assignedTo | String | Owner of the alert +classification | String | Speficies the specification of the alert. The property values are: 'Unknown', 'FalsePositive', 'TruePositive'. +determination | String | Specifies the determination of the alert. The property values are: 'NotAvailable', 'Apt', 'Malware', 'SecurityPersonnel', 'SecurityTesting', 'UnwantedSoftware', 'Other' + + +## Response +If successful, this method returns 200 OK, and the [alert](alerts-windows-defender-advanced-threat-protection-new.md) entity in the response body with the updated properties. If alert with the specified id was not found - 404 Not Found. + + +## Example + +**Request** + +Here is an example of the request. + +[!include[Improve request performance](improverequestperformance-new.md)] + +``` +PATCH https://api.securitycenter.windows.com/api/alerts/636688558380765161_2136280442 +Content-Type: application/json +{ + "assignedTo": "Our designated secop" +} +``` + +**Response** + +Here is an example of the response. + +``` +{ + "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts/$entity", + "id": "636688558380765161_2136280442", + "severity": "Medium", + "status": "InProgress", + "description": "An anomalous memory operation appears to be tampering with a process associated with the Windows Defender EDR sensor.", + "recommendedAction": "A. Validate the alert.\n1. Examine the process involved in the memory operation to determine whether the process and the observed activities are normal. \n2. Check for other suspicious activities in the machine timeline.\n3. Locate unfamiliar processes in the process tree. Check files for prevalence, their locations, and digital signatures.\n4. Submit relevant files for deep analysis and review file behaviors. \n5. Identify unusual system activity with system owners. \n\nB. Scope the incident. Find related machines, network addresses, and files in the incident graph. \n\nC. Contain and mitigate the breach. Stop suspicious processes, isolate affected machines, decommission compromised accounts or reset passwords, block IP addresses and URLs, and install security updates.\n\nD. Contact your incident response team, or contact Microsoft support for investigation and remediation services.", + "alertCreationTime": "2018-08-07T10:18:04.2665329Z", + "category": "Installation", + "title": "Possible sensor tampering in memory", + "threatFamilyName": null, + "detectionSource": "WindowsDefenderAtp", + "classification": null, + "determination": null, + "assignedTo": "Our designated secop", + "resolvedTime": null, + "lastEventTime": "2018-08-07T10:14:35.470671Z", + "firstEventTime": "2018-08-07T10:14:35.470671Z", + "actorName": null, + "machineId": "a2250e1cd215af1ea2818ef8d01a564f67542857" +} +``` diff --git a/windows/security/threat-protection/windows-defender-atp/user-windows-defender-advanced-threat-protection-new.md b/windows/security/threat-protection/windows-defender-atp/user-windows-defender-advanced-threat-protection-new.md new file mode 100644 index 0000000000..509ded9db9 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/user-windows-defender-advanced-threat-protection-new.md @@ -0,0 +1,23 @@ +--- +title: File resource type +description: Retrieves top recent alerts. +keywords: apis, graph api, supported apis, get, alerts, recent +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +ms.date: 12/08/2017 +--- + +# User resource type + +Method|Return Type |Description +:---|:---|:--- +[List User related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection-new.md) | [alert](alerts-windows-defender-advanced-threat-protection-new.md) collection | List all the alerts that are associated with a [user](user-windows-defender-advanced-threat-protection-new.md). +[List User related machines](get-user-related-machines-windows-defender-advanced-threat-protection-new.md) | [machine](machine-windows-defender-advanced-threat-protection-new.md) collection | List all the machines that were logged on by a [user](user-windows-defender-advanced-threat-protection-new.md). + + diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 8cecfe7be5..9f78476437 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 06/29/2018 +ms.date: 07/30/2018 --- @@ -103,6 +103,7 @@ Block credential stealing from the Windows local security authority subsystem (l Block process creations originating from PSExec and WMI commands | d1e49aac-8f56-4280-b9ba-993a6d77406c Block untrusted and unsigned processes that run from USB | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 Block Office communication applications from creating child processes (available for beta testing) | 26190899-1602-49e8-8b27-eb1d0a1ce869 +Block Adobe Reader from creating child processes (available for beta testing) | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c The rules apply to the following Office apps running on Windows 10, version 1709. See the **Applies to** section at the start of this topic for a list of supported Office version. @@ -214,12 +215,16 @@ With this rule, admins can prevent unsigned or untrusted executable files from r - Executable files (such as .exe, .dll, or .scr) - Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file) -### Rule: Block Office communication applications from creating child processes +### Rule: Block Office communication applications from creating child processes (available for beta testing) Office communication apps will not be allowed to create child processes. This includes Outlook. This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables. +### Rule: Block Adobe Reader from creating child processes (available for beta testing) + +This rule blocks Adobe Reader from creating child processes. + ## Review Attack surface reduction events in Windows Event Viewer You can review the Windows event log to see events that are created when an Attack surface reduction rule is triggered (or audited): diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md index 0732ac1826..d3fdfd801d 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/customize-attack-surface-reduction.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 06/29/2018 +ms.date: 07/30/2018 --- # Customize Attack surface reduction @@ -76,7 +76,8 @@ Use advanced protection against ransomware | [!include[Check mark yes](images/sv Block credential stealing from the Windows local security authority subsystem (lsass.exe) | [!include[Check mark no](images/svg/check-no.svg)] | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 Block process creations originating from PSExec and WMI commands | [!include[Check mark yes](images/svg/check-yes.svg)] | d1e49aac-8f56-4280-b9ba-993a6d77406c Block untrusted and unsigned processes that run from USB | [!include[Check mark yes](images/svg/check-yes.svg)] | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 -Block Office communication applications from creating child processes (available for beta testing) | [!include[Check mark no](images/svg/check-yes.svg)] | 26190899-1602-49e8-8b27-eb1d0a1ce869 +Block Office communication applications from creating child processes (available for beta testing) | [!include[Check mark yes](images/svg/check-yes.svg)] | 26190899-1602-49e8-8b27-eb1d0a1ce869 +Block Adobe Reader from creating child processes (available for beta testing) | [!include[Check mark yes](images/svg/check-yes.svg)] | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c See the [Attack surface reduction](attack-surface-reduction-exploit-guard.md) topic for details on each rule. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md index de3f852b51..59f434e325 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.localizationpriority: medium author: andreabichsel ms.author: v-anbic -ms.date: 06/29/2018 +ms.date: 07/30/2018 --- @@ -65,6 +65,7 @@ Block credential stealing from the Windows local security authority subsystem (l Block process creations originating from PSExec and WMI commands | d1e49aac-8f56-4280-b9ba-993a6d77406c Block untrusted and unsigned processes that run from USB | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4 Block Office communication applications from creating child processes (available for beta testing) | 26190899-1602-49e8-8b27-eb1d0a1ce869 +Block Adobe Reader from creating child processes (available for beta testing) | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c See the [Attack surface reduction](attack-surface-reduction-exploit-guard.md) topic for details on each rule. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md index 8f8c0175e4..24a17e6b60 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -24,11 +24,16 @@ If this happens, see [Troubleshooting](#troubleshooting) for remediation steps. ## How to turn on HVCI in Windows 10 To enable HVCI on Windows 10 devices with supporting hardware throughout an enterprise, use any of these options: +- [Windows Security app](#windows-security-app) - [Microsoft Intune (or another MDM provider)](#enable-hvci-using-intune) - [Group Policy](#enable-hvci-using-group-policy) - [System Center Configuration Manager](https://cloudblogs.microsoft.com/enterprisemobility/2015/10/30/managing-windows-10-device-guard-with-configuration-manager/) - [Registry](#use-registry-keys-to-enable-virtualization-based-protection-of-code-integrity) +### Windows Security app + +HVCI is labeled **Memory integrity** in the Windows Security app and it can be accessed via **Settings** > **Update & Security** > **Windows Security** > **Device security** > **Core isolation details** > **Memory integrity**. For more information, see [KB4096339](https://support.microsoft.com/help/4096339/windows-10-device-protection-in-windows-defender-security-center). + ### Enable HVCI using Intune Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/applocker-csp). diff --git a/windows/whats-new/whats-new-windows-10-version-1803.md b/windows/whats-new/whats-new-windows-10-version-1803.md index 7db90dbaca..df2abc4ea4 100644 --- a/windows/whats-new/whats-new-windows-10-version-1803.md +++ b/windows/whats-new/whats-new-windows-10-version-1803.md @@ -234,3 +234,4 @@ Support in [Windows Defender Application Guard](#windows-defender-application-gu [What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.
    [What's new in Windows 10, version 1709](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-windows): See what’s new in Windows 10 hardware.
    [Windows 10 Fall Creators Update Next Generation Security](https://www.youtube.com/watch?v=JDGMNFwyUg8): YouTube video about Windows Defender ATP in Windows 10, version 1709. +[How to take a screenshot on pc without any app](https://rahulit.com/how-to-take-a-screenshot-on-a-dell-laptop/)