From b2a7fc3bc9e14094df5a9113f08a0638a2ca4c91 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Mon, 13 Jul 2020 11:07:10 +0500 Subject: [PATCH 001/825] Link to deployment of PKI page As suggested by user that content is missing in the document, I have linked the page with the deployment of PKI certificate. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/6360 --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 5a7e9bb20a..898d43aaaa 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -76,7 +76,7 @@ The minimum required Enterprise certificate authority that can be used with Wind * The certificate template must have an extension that has the value "DomainController", encoded as a [BMPstring](https://docs.microsoft.com/windows/win32/seccertenroll/about-bmpstring). If you are using Windows Server Enterprise Certificate Authority, this extension is already included in the domain controller certificate template. * The domain controller certificate must be installed in the local computer's certificate store. - +See [Step-by-step example deployment of the PKI certificates](https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/network/example-deployment-of-pki-certificates). > [!IMPORTANT] > For Azure AD joined device to authenticate to and use on-premises resources, ensure you: From efe389ee3bf4f59a53bd47737fa6e2fc6c2ff778 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Mon, 13 Jul 2020 14:45:26 +0500 Subject: [PATCH 002/825] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 898d43aaaa..1772e4de58 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -74,7 +74,7 @@ The minimum required Enterprise certificate authority that can be used with Wind * The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2), Server Authentication (1.3.6.1.5.5.7.3.1), and KDC Authentication (1.3.6.1.5.2.3.5). * The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. * The certificate template must have an extension that has the value "DomainController", encoded as a [BMPstring](https://docs.microsoft.com/windows/win32/seccertenroll/about-bmpstring). If you are using Windows Server Enterprise Certificate Authority, this extension is already included in the domain controller certificate template. -* The domain controller certificate must be installed in the local computer's certificate store. +* The domain controller certificate must be installed in the local computer's certificate store. See [Step-by-step example deployment of the PKI certificates for Configuration Manager: Windows Server 2008 certification authority](https://docs.microsoft.com/mem/configmgr/core/plan-design/network/example-deployment-of-pki-certificates) for details. See [Step-by-step example deployment of the PKI certificates](https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/network/example-deployment-of-pki-certificates). From d46766bceefc57e2f3024b2ba5237f36b127dc10 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Mon, 13 Jul 2020 14:45:51 +0500 Subject: [PATCH 003/825] Update windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index 1772e4de58..d595c23de0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -76,7 +76,6 @@ The minimum required Enterprise certificate authority that can be used with Wind * The certificate template must have an extension that has the value "DomainController", encoded as a [BMPstring](https://docs.microsoft.com/windows/win32/seccertenroll/about-bmpstring). If you are using Windows Server Enterprise Certificate Authority, this extension is already included in the domain controller certificate template. * The domain controller certificate must be installed in the local computer's certificate store. See [Step-by-step example deployment of the PKI certificates for Configuration Manager: Windows Server 2008 certification authority](https://docs.microsoft.com/mem/configmgr/core/plan-design/network/example-deployment-of-pki-certificates) for details. -See [Step-by-step example deployment of the PKI certificates](https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/network/example-deployment-of-pki-certificates). > [!IMPORTANT] > For Azure AD joined device to authenticate to and use on-premises resources, ensure you: From 8efa046a314e4ba3cb053801f1771fdb1ebb2c23 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 30 Jul 2020 08:15:55 +0500 Subject: [PATCH 004/825] Added certificate deployment Updated certificate deployment for WHFB as suggested by @mapalko. --- .../hello-for-business/hello-hybrid-key-trust-prereqs.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md index d595c23de0..1ef40f8957 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md @@ -74,7 +74,7 @@ The minimum required Enterprise certificate authority that can be used with Wind * The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2), Server Authentication (1.3.6.1.5.5.7.3.1), and KDC Authentication (1.3.6.1.5.2.3.5). * The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name. * The certificate template must have an extension that has the value "DomainController", encoded as a [BMPstring](https://docs.microsoft.com/windows/win32/seccertenroll/about-bmpstring). If you are using Windows Server Enterprise Certificate Authority, this extension is already included in the domain controller certificate template. -* The domain controller certificate must be installed in the local computer's certificate store. See [Step-by-step example deployment of the PKI certificates for Configuration Manager: Windows Server 2008 certification authority](https://docs.microsoft.com/mem/configmgr/core/plan-design/network/example-deployment-of-pki-certificates) for details. +* The domain controller certificate must be installed in the local computer's certificate store. See [Configure Hybrid Windows Hello for Business: Public Key Infrastructure](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-pki) for details. > [!IMPORTANT] From 72674159bab321398987df8a7c2addcb43972b43 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Mon, 19 Oct 2020 14:09:51 +0500 Subject: [PATCH 005/825] Updated Instruction and screenshots. As requested by user, I have updated the instruction and added a screenshot. --- .../control-usb-devices-using-intune.md | 13 +++++-------- .../create-device-configuration-profile.png | Bin 44895 -> 51871 bytes .../device-control/images/create-profile.png | Bin 19760 -> 15388 bytes 3 files changed, 5 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md index e8f58439cb..054620ee11 100644 --- a/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md +++ b/windows/security/threat-protection/device-control/control-usb-devices-using-intune.md @@ -197,29 +197,26 @@ For more information about controlling USB devices, see the [Microsoft Secure bl ### Block installation and usage of removable storage -1. Sign in to the [Microsoft Azure portal](https://portal.azure.com/). -2. Click **Intune** > **Device configuration** > **Profiles** > **Create profile**. +1. Sign in to the [Microsoft Endpoint Manager](https://endpoint.microsoft.com/). +2. Click **Devices** > **Windows** > **Configuration Policies** > **Create profile**. ![Create device configuration profile](images/create-device-configuration-profile.png) 3. Use the following settings: - - Name: Type a name for the profile - - Description: Type a description - Platform: Windows 10 and later - - Profile type: Device restrictions + - Profile type: Device restrictions ![Create profile](images/create-profile.png) -4. Click **Configure** > **General**. +4. Click **Create**. 5. For **Removable storage** and **USB connection (mobile only)**, choose **Block**. **Removable storage** includes USB drives, where **USB connection (mobile only)** excludes USB charging but includes other USB connections on mobile devices only. ![General settings](images/general-settings.png) -6. Click **OK** to close **General** settings and **Device restrictions**. +6. Click **OK** to close settings and **Device restrictions**. -7. Click **Create** to save the profile. ### Only allow installation and usage of specifically approved peripherals diff --git a/windows/security/threat-protection/device-control/images/create-device-configuration-profile.png b/windows/security/threat-protection/device-control/images/create-device-configuration-profile.png index 1b6d4aa7086610bd1c0c1b4b63a9a6686e6d4294..4b8c80fdd7f99646bb6e6dde30134bb005cc9104 100644 GIT binary patch literal 51871 zcmcF~WmH^2w`BuC6C}ZsV8Pwp6Wrb1HPEXn znfdXi)?#&Y@9L^kr;gseZ@7|zBs$thGynjAE-fXd0stU10swGFDDbc=F8C>vun$xR zDQ#x}0Hg2a4=$M=g8+6B*+p7j9C-%~8-<=drgEJe0Qdxu7W<;+@#A>SQxAJ_8TpKa z>zA5FJ!|wMe~+d9oChCfz2wg~q%Jokgba555&z5uX|wb;M}3 zUUekXP-;@-GIab=VthYGgO>Lyq1|8Z-8&R4y#C!gzx$tw>FmxE=}~7pJL&9H*aOjU zq(N9BD5PTfvXen^<|FB4+=-h+Ha#$-P_= z2_r^}NBuX=v?wXtf9CU|5u^Ig#F+o5$%^zzAv48uJBcO3)TY9OguzHsQA}GCmlI&& z^YI~sx{Sx`eozt}{HZI2^06aAyD|YsxG@AC@JD0q8*+I{1Y(5{%Xp%?kI_H`xjg>g zH|b-dF@9RL*EHPqSp=hi!K`|*W^vIjV8 zxsR_pByhIhR5#c(VmBMA&#$=+%{gK{=Na^Ruk^w-fmaV^SIVDGe00Pav)<23t2^to zp1qtUWXH-s%%|-Z%|pNv%Jai4uf}n9_2g3rMZ@Wuq$<_%Q6dy$G2sa$1_;pa4yCvB z;=MYsN24i4i-EE;(EYn@&Pz5+n%!7#+ZC17l)TOFf48!|%Bulzc-HXqn%fgBDgf|w zMhgERf4{nj7Vv04;SQ|id9~RefSDQ!Au87@3}`>h*bki)j_hLF9VG#^xg!H^c&Sx4 z-sLd6ee9`&H|o#K$q--|6rf}lBEs6m5bVA?1*}@+S z8Dt&?0G>-u36pkZy)O?cXxaVlx%J_X$Ih7}Qy4tdOYb$Dz78g{?FMHXIGpZo2dM zQ0?OnX@*mA#51`3tEDH%>vzqSHNZVxoicfSzHyHtfw@0X?|E^x*c9ZoT$>wbh<*Cx zVw$J+pmF*H8kEfR)xGii^KD2Ag@+Z z3nu#``+95#rloF6^4<)nI~KNw|22>m&ICW0kRk?0XjK@fI%;`2{>Ovz4hJ%KyhETv%-)K8-4OEhpm4tUIt+k%C8@Q&wZph4EsbtAcl*{QVBjBvT`B2EfT_of8MTnQB2_JZTV zaI8*v&#w5 zbQK=7z5UCii^0|!nq(0X8ui?zj=uK1%Tr{@bX1SV(>(b95Ax;M+Yf3 zz~ZYsn&Igt3Vr znNf<*%hO7x=FEkL)_ge3-l)!${i$PXAOTHIVI&BWPh@}QeU+xf94rnOJ@dL zFh-PcL|TXF|5==dVqA;*zV$b=jDZG&p3`pt3t8oY7mHc19ONc=*>bpt2Jy$@ge$Xj z@m*WbJ-A+i1aTrpi#{{REPig$J!}$w;%8}U7Q+r=I)B0KjL~$70%30H=RY(;NDiP@ zs!f8i19ZIy5^NF#EL|d=L7o?dB*+)V`U!jM)BHPpn;@Ait3^~^wfVyVg{1)O! zUe!9<$77@UHb-2EsTTdJLz!?lSM@va82-bIZByB1x5?G3X5UtXnRnyv7v|oPz>ck7 z{Po(Dj6-V7#B_-v?Ht`BNYz`HNR|3aCA$-N6%w z_CAt*T|2VAh=F&JyvSwkKeQklb=OJ8kqU4{!^X~o9z6V)tfn=vL}s5?-s5%hiqx6v z0vWyfWWq$-3he0}IE!E0S}N~_r{C&jNJRGVrW#Q$%P>}9K3z7b;Awf&t!3*6uos>E z?^i=(1*7D4yny;N=@?-ZKW~h3quUT=QD7O9y8`gDmvxntdjWkBH(;`QC(-zdo{_^^ zeAyyNze67pnO%c~gDY*8AYgGOvE+)~NzGbTV=YC==cQtEDa1gHCl!iwHCGFmm7T>i zLOJ^4w*Z%W=h=W`S4n5N@_6$aFGzuC_q6-Mu-dhFHe+dV*@s0`$Ggp-LWE%4K}%k7 zwTIRB_=3hvGO`lIz@3oIoE1rT=(X5%zyzV&Hdm$L=6u^>>As!}6tQLTJ2z631JA^d z`OzZ2t%-v2*;J;8lR{sf5eIvea#$r(ac!;+jTaoOoC8+2F8c_MbBztvq33ECEcply z%$C$=UoMU#vmF_Z0Cy2Wx_GQrv3h(&z~pXZ$xw9c!9iYa0e$Q0lhW!LM@i_!-8Y@ z_Xr`kf0gb|c;B-ar3uHBVlyILA`+_!LcTR;sylTrI0_+q!$LzLdi6ZBk+HcgauVF8 zoFmNonkWJG8-oDkqJF|+*pHmc0S6}u7{DBt*ydYTYS6h~cUE~K@>SyT#N?jlWhY+1c!_mAv~Fot^V2vg{P05dp~?AsxU16~~YzBD0hNkAZj{ zkkSezpJwKa32bVO8M99$zc@VzA@RJy*d`Sz?@BNguK#3bsasW31~YV{(GPlYl~1Mr z>Tksu47B)fG{(>)1yQYLMkr@Xy2%VUp`UpYbS|>(?zN*=X0n8F;B2R%6}ZxHwjJ*b z4IJd{>U0(cHT^9mo-oKJTpj0i{Dh41@D-$Ft+RZva(u2wPqm+9K^1A3J$a#r(=lI` zOGuc#X!QE7!4TtP)LhkC<@dnkI&j8(yUck;*mg8p+SU2(S#MXF;p*5OS?j?mA&)ML zCknVfAgtoY52uuiQ3DM00Z#d>LI0MHSS>VNcSY)40nm^#K-jFE%dB0syRzd)Ila1u zfcMMvrrrJpP5JJv{+VPYwNtP4 zk}nhlnuGMs*Onp&z@!Q_#<1|e`B*4VGQ`W&IYPo6&}H&$*@Zi57wUnrV4pzz4)=kN z$D1i8`fQA@({z4t+A~1FbNz4+=^*o~R;1;FGS9u}fUW2N|E>SKHQ}Po#`e%U_5@Ic z!leJ~+AOWnqJct)78-rb1xwlA4`A;0h%3(KGX=wpfeSZ3Uy$F#5+Q9lkHV>jW+C@| z=x3Pq#!XB+V&)2YH0GkwObX9DdKfRol1M(%v{Hee@=~jE0>DG1t=73oR!619^?&&b z5d@xIb@uW!r@XE6>W^mw%&efrfOe)ZMG-s%OVJdLSKaENX+KhZe4c!e+{@^AYOZE0 zw2_X4oj9IG^j-X?LxscassW=tql=2U(AW*1>z>#ZH%fz+(Zi>NSnxjSEu-?P(fUd$ zp|K;$^|MiD&_|-mW~m&4=7^17hcYCzM1@_EJ?iYx zcLAXI9I*I=D6mpmb{G4T|HVaEBZh+|935UA_M}Nuty-3KU}Ob zwB-KwufHYwDE|M_mH&71{a;%A9YZPg&d>Y8vD0ro4rU4#78bJBXkG$(TnOv|LM&?k;6Ekl zz?7724%%i`lTmh6$4> z3rC+!j0+c4GDLMP$(8*g(8L?q_$q2U&;Jg#LM%$~&<<-lk0V*YuU{0lwnqiBsrD<4 z(Jj_sPZqaht)EI(Uz4KjL0p*Xtk1#P=7ak7qH>dOn~Q%NY}UJRZ@*t5$}~{5!$}}m zUUZ*z#%aF$q))KCUOpW1VR3J|G38}{2x#%c+ZO_o!|WDgR`N;Z#uvZi$B)rHaTS-t zN*vb?hIfq`w6Hfe%6Xh-T_O~w7{P;k2~=)Ip&|!OsC%Zkt;Ek7h;nE&SvjYo98Vxwj?Olot)!*5o->89)p3QxFXIB*US~?`SQCSW#4Qj=QjNc= z-D&u!rrclqEc{DCIH}p!4Zk?>ZAWX{@FLKSe`tVZB;l;JN;$lU%F} z2|y5CgU+FA-H<__GwGneBE7m*2xsbb#xvhvD0gx$b-=}ee_r@NPHd`qta-$mAW#q9 zWpwSsvahI~_`UqArOo!+Eu?JhBE#{dA0KJEdk}`@Rqcfl_$y-C{OvE4a2Bjg2sI;VGnOYK zNfaEx1^A_got)SjZRyttieG}AGkqLQeH@edqyyzNXz&Zd^WqHgj zmGzKDnJ5U)=VF{Y5DES7#a)F>iCAgc?;5LGl}vmg2lMaV)?Nm_gu`(ui{DKvg*)wT zdC0$qWCzM|f5;bY%_oNM(oU?v2%G;>SKr=f%&`#_0!*7{ z*ot)yx=JZbW2xnTIfRm%ZQce4@FZc}D61e{MH-#@8v@|vnOz|Fk%c^0xB87ZRSVqy zb?}|krVT6Q74&X&$PL_vCWu&>I?F8FEzf?^>{|98HxkVs+VM1>wJja*jbFZ-V>0}Z zz9`Q!HH*>H(_74y$$meveJ+eY}AZO7pohXad1bFl!E&xdzy_PvcpI{+W4rl0Nwu2N)U?u z<%uU@ncIsM!`A>cwM9Er!l}3N|MDN{FZKp{F+bm%f^vF)^kXpK)BWP(W9>*Eq9}i{ z@r%f?#wMmQbSTly@SXnMX!1i|W@4mF!J)nJov!2bk+<3)e*4_Flb0vQuyD+3E6e0` z*Rd?^%@khwcm*+9S2~S!l_^jO{u$%%@5#bkc3TCz=juWKpNI9HU*$$dM|B%S?>cn4 zq^8H)ZlGJgonc}W%NgaVlo*-77ekYvlyq1tm&fsqW3!E+OXM~jo_?1{i&b@*|LRtd z!jVLL!HvxmnKll=z18bCjmk6T1^zb-G{~^)fYDHM+H3XyY~cnnCBR zNRk|ibqK?5zH)D0M`onhP&odTIkr3Jd==+riCEzcG&bv5FBInV3wemn27XjRa>3W~|ap-u_44-riX{xTKsX z-iCJp6nko0rdBtzl`3R1s~t8yy4yZ!>;i|;o0vk+q@pvo^7~rms3h&!#5aZ>3Ypl) zEBLN)AaTSyk0>b3T}fn0&U#9dj;sC7>Rr6_yVE}Hx}tMHu7GE7w`rfQGSQu95*Fmr zwm%Bbd*hnrWckW1xN(=ApjSkFXxMj1(mKF*;kW*o1yuP-SO~8*mbk;(LEEO1r=s<{Cm9Wz|59DSdE80 zBNP~dsuh-uaB%l7%5`?7kY-Fqh56$jI$9hyNe2Qe^zQ5AZd#_i`~oI$w4>*n6TgUI z%J580-*_c8^zID)z5-@Izr3_x28D3N+~XX^Ug}_eiO%~v1uZ*a{=GiR~`19cD00;Qma|oWO@?)@rZP&SJ5+ypmdm6YDI=X&YZ<%h>NJB^Y z8;o6=xze(R)-MfsCB&E0uU+Z=S>LGz_y-D+7sZl%7>9Seux@yf@>nM6CpnScu8aCcsLTD-<-ovgNB&cRW;K zIJw7{#qUeB4-^}n0A>_pyCUl&!z#_s=i_|auie?%?{t}GQ${(1`!9Y3^wNG#Z_XtQ z{Cd<>9B3r#tl=8nE~lo%Wf_;{W?Deegau$g%$~5Tdh}GyX!h}o3gSH6zLlSCNx5H< zt7ysJWAN@nFZQe_oDk5)m&HGug=R#^au0s6J*;Rc9< z7&<;xeCcl)bEm8cTsnd3=U zQPxg+SM#@ml{|x1)le%Xv)OwdelLKy7f}^@HGG;xmX)~{kp~~*`G#cgyehwdugx0x z`HkWtt#10qb)y0XYEq|`Jp;ZR)-SJrZ#yk}Q|ntFeoL}J!5hEg;1jB37!G?dgA%}x zGy1~r`z5O##?rDS`iboUl7neigpJT*vmsy1BE&!%OnYmn;RpeLl=gnH){$_qVt;2~ z*Kqdg80=`H{8{{t_igW$3>z5yHz)*{`0c7?h10f@(w~^k=9VRP`oYQd;r$M{;&dB= zvUbDzFP0PkWCdW|REDl!Qpt~RDbc2VlCQSE zwpwYNH<*B~BYj~G;~id%;3f)I0fz3COwaiUqG5K00+ncYb`YkC^(l?HL=-y1V2-!a zQ}x;vFXZu9Ne!u`_%l2=Rh?Egy$oEUDG7l8g`V4H*=%7@T`k^zgSC-+0<777%}-OS59(=|ZvZ~b z*_;6F`{fq;ca&GiRVldUR5w}G0?qn25yOz6mH^C+-XT(d&uMPwjiqGzP|ij7`>&R^ zYEm<*uq;a@8NKG>kl5uL*z@4s5>HAxSpGz zz-GN))6%M4^V#@eXKA3C;>tklHh&N$Y=Xh)U=C;0Hl8ksUy!a$>*dG0Ne&-Qls0>T?optahW40r;35tW2!oIiF*B_B=H;Z}eLe=o7e3=>QK$B&e|ogq#?gT-Idl!qTxLRni2k(5#J)P@!go|Q?GDF_*J6c2t0*tn5lZ$0`;VVGXCgF{k zJ%B#}E%6Tt&OMpXbrEik5;j-6-k^h<-*n<{e_ojCu2~B@8IPUnvfn`2CL=4*Kg-*} zFZwmP)#&3ZXCkZsm>o@1#DbnIvAMKq?1h0Hg)34L# zv^?pEl~rBnAjz(_QO3Cmu4-q43gVu_FAz% z#|@9EY;5fr+Ag?k`+mWG7O(Y7O5Aftbrd~{_Is<<{$3?Rk^BV;`*|0Kb&=`HIRF0g z$oJcIj^&((pb@E=iR2nNWo?R|={qQ%It_f&B0qlz@`<}<{r!@aC*hCNBJtB~L35E7 z=j5p~BQB=LM@O|ZS0$a}S#^5hG8ah?`W6K+goV%MPxM;6gcERUAE*r&9e0KY;6ywR zMnTxH$-51@w?Dexew?h%%8_%f1Do5~9YOXo z3mxT4F+#7eeQ%WW^`2&aRX9=t#_nvp9=ckD^mJ{H3>L0WXN8xZ=QC3PHY$z&hQAg| zE>}&iI>*q%zQKJ1$S~uTb}2B?<0Qj5oZr+VD|zN8@ghDt3SG+u44F7fj%#!MBp;X; zI6jG{)AaE0t|j!dCEMFapUqrWM0viImzC<2#^OXVrLw=biI}L#Dw<43`t(I_Zkfua z)SxVt#qQ+8^={~R-~7PP2#bF6wqVxn`+%czMfm!2RzUaCpg&3+SqjH$hq<^UxoRn? zRs{^^1RPVBKU#(G%H(~_YUqy6gg+YGmTv)0WMX_GT?{Mf7~Oe{)v)<%3IMEFE``o& z(?s*d7idP)1YWH(t=+y)wnlc7HfnO%roP`m(rOzwXc|N3q;(WNDnxFO-r71Db{ah} zJaC;_W;d$@aMBjlrTGsh?*<2SMAj+5YBgluSu8eE#WIc1q3Z>zd?XiFP#WZG+hr5i za96=lS3$FnY`nkh^ak44y{6&54RCGD1usZIh%SvLNvWip;+aOhlqyyC_PSRqKK2!iK zi*S0lT!>Q&N34y)lP+>!No+7pNnncvqk`_xj*1bo?*Ep9p_2Ij_!sCSV zsANxnG?j92Dw#k$L$8ZzlN;HBGw!;Lift-oy|EeLsXI+rMt{{(XeL3Pvi*VDZyz<{ zo^^9TO($pX9KC2+1eKxwVU>n~O;vVjwQFldmlu^#$PW8ZsGkIA#5XZ$ik& z85Dam0|YelNH&o=uS*RQ(-;cB^!NpSEOO?FN*_aputAp7G4;q4=n-s}Z6A@s!5w-6 zu0r1<~GoK3?6~D}RV4#D*|fx#k6nV$K2)yxyx6%O8)*wZV6bWob@Z zrPD6Km9GijNxc>hWaTTg zLN1TEt#O-!VX?wC(En!vVi!E1+4q49jro4r>6^+YSto>Qgz}C@s!x=N;w}Da6Pr5h z+@BQATuSS-9<>og$vfzd>LsAN%3G&~kmQ-q4k7 zZBan?vL8wuGi_qv%3oks#0;4c*5bO+7w<~yIAu>oj5#3K*7SBxUC7FO-+3ETc~-qC zb}@HAkXcr@%ST;A86A*P@j7+%YUkqqC3o8Pp3}=-d?VH450nQBPhn$e?B{Txq5q4%0<=Plk=udY9w;y*{3KHP{??rLa^20a@vL^Kd@*~s1Y9pH@ z;iY)vL-K2}jn3WjjfQn+2ryLSLy=mE8jCU=95#0HJC<*y;pPRU44t51T@1z~lrWaC*V(lOyzc|Kstu5hiacrR`56MEFuN;s(N$EI^b|k8lCob@ z38)}(vPOG&vtSkmE8~zz^HDwozvGong9VA^nxCG>ZU_A$+Pr<{0QioOeWH=&X=;xS z#WU*Kyd?dy1uCgh=Nli7Zcra#M-gUYZECynw{lTfro45owlwO!qxo39Z;TlhLE-fN z{WxQC7~p|8mMjd>$YugQ=()|r=uKT?{t+D?fiC=mI6Z#U%(!(It*z)sHbAx4AGo~V z?*c7P?n%hHJKYDf8u&SHKIY^@ged?}*6O<`=e_Uv`tjX$j%;1Wu_l0H;*-Zm>*-$N zX5Re|a*rC$zlTNcqsi%#J#!jI451$63byu9FrKph==>xAS)&m*>@I>*f9&v2f0-5^~XY zcsP{08Ncy&@M)V%4jD{Hk%BZv~U|3^-aZ5_t zkvC1{X|H30ehlwRJS~b&r2h)wCj;~_CD{3`8hW)@eL@5mMzMIMscD89ETP^{@rUQS zVOm$0Y{F_At2T1d%zN`8=yD*u53>6FYt&eHY30vqZp!X61D$oVg3~=U>E?jDEp#@& z0Ynd{#f1x8y>~a*aFb7BZyA-ATD4t&LP_6;X1P`+>xN2Q|qoe8s&4TZ9kB zMuwSWC$(Zp_EYo+WqXSj)3jC(`BwmA87EqRBJ&f_s={+!2ykW_f<^SSY8|?0AkhO zKm5)<+xqy0S;|CYfHBO*BQQyi>W-6+O&keO$n*_-R~^^L#6YLXy{?*6_*I8M(_+FO zoP%_Fd5E=8C5Krfd3BQmlv#LcR`GJVEBzH>uD|;DEu;BqV=+}NiK<*b)m~5iYvt?L zScTaY8y#%)Yz(#4)A{PhEkXdN=f&R~n1S$k5XSgU<7ucs2Tcoy`GqBGLAmm4giwwK zTY?=4zrveSwFoi|pZM3K2hLQD9Cp&oUE0nqG%Fo89qZB(=BLnP-Js10jB8uqJM2;V zGkvBJx2oj~(%A|T*i(gOCWWWlgb}iMXrdSnr1T-6pu-pJrlE*(K$v9pCEHOZIpTx3 z2CeaL0j9OSGbhP$D>#5r%Tq6jFaj*xif9Uz$=gP0R`#m2J@kw|5GA@z^?Y3c&(h)hK&C z*~?$VTr+Bay+S7mAWQA5Ko8el$qioJLWbnTMYd<&!^=_`<*h| ztljq7pTf7`x=yj9uC{As#EWK}ZGE^xI$CT3*XM>7zBl3XP=VjtqrQK*2nsj2ropA8 z)QoxZfb$=fmj0 zj(j3j2@9wyYghWF1{THgu+jy#ap;oY9j33TjYHLF)Mb)OtE;PPYiIiV`6qvTz4+w56gN^9c-rE5ECboO;igoKcY&jVPW|5TG~2#wDw1l zzvq~&hl}A?nUrQJD&%q^eF4KPAzO)D-R*Ddq(a|PYC_AVKW(K6hFQi&sc`rJA{ulz zkHaBR&k>O$wo{MsD2P=b3zWY?rR)vy8QR@2EHy^LBzt$ z_G&Z6_nO}Hi@qNzv@drpeDYvG+_0oO_y(xfO&;#}y-)v-aE)?Wb z+f@6RE6WME-=z4HtQ#5x8t6@ilh)ynLpUIOtPMHUwANF7LB*oNsEH=da48j$ll3s# zj(cm3BuidIcST8{>Wz5+ux%lJ2#i!pvQPrpsIpWK&ql7IdOq;u5l!qv3 zPu^YWcxufqzo+H8HkshX>-Ds=gy5>k0vW`;JI{<3hQm}`SIBZksPIm@fJd=I6%SqN zsGy)=M|-0-9{tWvx5%Njp2SGN@L27ES3P6xz-3GM%rp+YPW?i^ z&hP5N_DY+7D)rlBC=zzeu6%F`3JMUAF^=06;)>GsYAt(y33fDR`;c(+UyS^Xs^35} zpEruW_jvF&;FyQKW+PAod&&+|hm2svo8lrtjRS^fTD%l|koD_WuPb$Sc6I=4GD5De zT5fJ!0XsWpFiuL-hTj8g(+>fJKiERhu8cpugSBGPHDrL4<1hA5;A9$q3-rS@4E@U% z!y!ww{2@}HLgOkCf90>Cxi6?bQ7FlMQX3o`?AB6Sd(J*El>he{+W#8t?ncgsHoES- zJeV!7Sbn|gtefKNsBOs&!$v>m>%mlArdpa5AcB}Y(ye$px^4J=&(@|8I`HuO`PVYh zYc#YpM5a`J-}_4iE4~+w4yYY-qf3W7@^DkJcQtIuo#q$ zCX_jj7cSNW+^~q*1c5B=*UzTMUtmkmkOnd_=*1Ux0y>YL-=*l@Z)cPbldf8Z0QJtK zM@$);MbdGXE0k=MGK#*^qr&D_yPM^TvUoTe#xm5BM)NV>d?2jC-^?dHKOl|zDHxm9w_G`^PgCi@uL~bGrMg_-WX*ZPufxG+x9)sipJf3E! zLTWT>#s84iER|sf;d0g8l*K1k&7blY#YpCf9-t4*9ij^MjyR?VrzJr-n z?yZ}V-tpD+c_o^SN=U=f@N-tYKzAuX&wuu+Lza;H-ozjn_czWl84KTTn`{iXPVx% zQE%k+Qq4|ZM?@;L!?E1Gv*E8#NB3--D|3O+kGxAQS!CtsqG=KRYE;l;>cuQ;hC#>w zcCUk;)iJ$MYduE7`|S&^9%pF)JMRJ&Yg79z@TMB6zlWj01*n5R7`Mq@*eBPBCK)Xl z=1wJQN;K+)`f_S?$s#{lPXAPP_JAhLh5_l-W-clgu(8*&JflU;?`iU1ktOxwIhy%_ zJBR9W*&#>tU#@fmZ%Ujq9uR{{O;6hc39vd}02cUc0b>d20UiL9PB8o<29|&SHXEk|)ve*4KPCvy z?W&BZ<*B}GNw3Jcs0!if6AYVn?B%sM8JZ8l*y^*>!vD9lCq_M)Sjy-wgKXm4r#Hf) zTYpFp8yXs5hli+cXIFt%+S=L*!~oG10iZ{j|RIRACAOwEsce+E;GZzrx0( zv7;S8Aaa~V&H!U== zVN=3HtD9=DLslhr;+Fr@p$Y%n^- zzxBsOZlwmW!x+Sc=mAt=Mm`xGQv)F?>fm;M&1>QYyh1FS^><|>`+jYX#6sR1f*3ns z0R&$dQ6-zk9Q?z$z~ORs8EWX)dA>30*d5$}_aAV+vZ(gDN}G6S1++3gTqE`8aH>W8 z(}IBW3!fyK!Rs!ihSC-N#C9d51I74-EwU@}&q|0&ar1|8j$hc9u(V4@N-q!h^#!5EyZXNq$yRxJ zrFF;|hJmoc)u@zkd=Spomj0ld&lH`U|qhDT&_3UIhceJx(3?7OVfqigDZSEm-eHfg3*cG2u8g|9oa;+cOc_$kBm zn7G;5XDffXnEg`?Y_4?nq79F2d4*?a)*2Q>FV3I~x*Z#uvxAl16Gg_25^rm3+Xj=M z!B#UOHrfo9`JdW*ekh($wdmQysyZc_debqOYrKWE@99^$tr>q!A%7h1Z~P%$wNpe= z3(@PXZYMSt76T?Vu&5~~FHalTC_ZLgURG9CQ8E8i4VQb~%tpFnJr{x1^4Rl?cKYMc z^8ALhV^E+K2^PXVf7L73x<$icDy+h3c^SOyDdp(#>{S{FXT(NJymr1S))(q&W7|lX z^?YTXifQyWH0$3+`PWfi4TAxkkG<9zwbu`A1}+<hL zZ8$(z&l&;Aq31vp_UNt?ED_S+AVn%Ct&+{}{e&&s)uH5gW8CY!-?=Tbe`XM$$dfh0 zGDF;&;}iAs;b4DwIs$8{RrVR#{pjnG!dI@9`T6-Y{qpj1o%xST;nm@kKhq=i8eUf{ zuf6wdYX_NZ?MU78?>t3KTJQh5b zONhIzE}(Ynr~mtCqhcq&>&8H{xXpTnVq%$<3;d{bKl!Ijc>Lp(HY0`IY+dF-x@XMk zQ(J=;8|c1w+Avk%91US#K->7v6hZD#g2Qb49I@@fLvOK1+DOP)jLZQmO@P*yY_pPMF8m6)Is2wCyr_@S)xHK4iyWvg{ ziyEISL+QL8)jsZcQbG`ou+QnoH4gL&VH9NY{n@nCG<%G0e=fkc=W%YI8r#wQlSOvIf$UyyPIjEAekxZ2|-UV{H& zP8*b7aCy>c)8({rG&OpJ?O-~8aI+^69f+M1gLysfgSc*ak#ZJAAldoC**YKuyeb*Y zCa8#qWj`%8zQ>V5c~GDbM$Gd(E3L^p0zh0-??XLs@7*yZW}y-Xe3nfTi_`|>K?d|> zm_-dFCs_W5`Od_c^Be|2+YPwUEoyuQdl5V1UIM&OqCRRml4jmBvL8npTa@*YJJugB zg_q1^TPrgp+7WH(_TWALssL2`PmZbye#cy=mwlE_Ly-+ljNZb6IB^HC>xqknrCPJf z02db*6%`fSelcNc9}rHuY-eQ(`TVcZyn>YPA6Ikv-=(#!kwu;CB5W~gdV=eoca!zhcgFKBc z|3G0s_|(glU4H~z$0)imXT<(VR!hL5L+PUQPE|P@3wO4%>>M=#oAq%`>!fTG$i(Cf z{)1+Q8aXIs(R5zDOtWN!_0`9RK~_(|-Y#S>d6IgV9|6J50A+uukgEWf)Tv)k`)X~u zwzTZ#VeR>-sw--#e_^4qMBdYKJJ3KIp7{HoBz5P9w^I=2&~_p?O9^TViA(l+iS}M^ zZ4(tU0H81Hi;0DW@aHH-SZkRG|3^u3M>aswT2{Kv}743YP;kwN+k{e0PnqNz(?r(ckU=yi8G1r#tu7i7cdxfZ%bw|Mi$*IV5OEEPaJM)^R14 zzk0Y!M-fl^?_WpTb7@FFkzAlN8JY9c^xK*IWYz1ltgVhH+7CSSlAGVk#_`VYC_F85 z838-?H(IH;GR`E$w+NXL4LL%jtoZBxPWexTc{>X+Bo~W9A&NsturPj2z|+J$TH>#0 zsjItEqFU5gwoDK{?fB(qB;bX)6*-ZBC}&f1;TA(ak*tTzF|!qq`ON+K)Q$S7`nR~Vd#b-?!oWxzt(+mU)=q|&a&>gT?xT z5uAG``g-3}T_-ty`{@lLUXUCZ5Vg>_VaJ=eGc%kIy!UUX-b;r@XOT$IzW~`~&Xe!d zG08J}_%NHrUiupjqqsgjHYuJ!H@19?RB=x@g(du&!Uz+lUuzvmqLNLzqZ&QY?K57nwq%0U+3ACj}%Y{VIIU<0)Y zIOu@<7kiE2b=LK;nI0a$vpr}?wcoC*ynH}wechnGsFaY!weH1g_Sfd>e%z$%NA4Zc zK%N}ywC9yw-5Yei*?47OPBV;Oyd6UcW0RzUY)P$`lO)CDjHwGu*Q1A9RU%f6*tDYP zuG$<+Q_~H08rXWu*PYw<`Q#P?lkKoHlLONFk@|i9Xy? zNv_*^<(#-#4K2h`d_S=jH2`(TC*|ni;GkJ1y@gD025f65rbH)5vcJAJuqm?gCZYvL zB0hiSMPFiUR3rr}wxpqR)6Gd8O)PP7g4q4yK||(E&f0s5G-cVtfiwBR!W8fO8erIk z5VM-(n409&p7JL1-n888RPcx}2#7G4pqRMj7b1jL){SFxSB#}yYgcLYqVCCL&bzk9 z>zF1#be@23FBWku4TyQy=|N15Ol-Iw0wjy%l}rpKVYtC%Munf=<&1HJa(u#&@V-u| ztYqk!R7CdtwQkDKfcR088nPBfFk$Ab+I@0wz)i+wUYs0JALA1ns@0Qwdmra>B7NEY zDUhqLvU24Ci_Wkq#^%ny<##! zx|7uPy_GBDfz+mG=oH)Xw`ChVk%JQSZ^&^|P0bojCMqt0`WQ}|G`B)U4o-t#4DAkR zw^CX^oiyrI)T_|JugkCc>|DL?dV6s$p-8QT4|;fEM9uHlDBP$$(X(5(lWi^pPdjS- zuFVab%6VfV7vDVc4b_B~KYn5N}3e6X&?NZ}=_kS14)`7M%;twH0L$ zH9BC_cBfK^SNnxQQ)AmgbkJl+79W_2%WcOlC<1mChtF7^e;)4pl{l9#u||8H9&Q^I zO{|hooCz^GpP@epjYf9_=S^rr+G{CB;ajE|A0ucCi*O7Zoa0PSekrW9kG8nad^mZ*SjwaSof!Il1C(U(vM56f8iz%9EFT zq|N?A&iio>4-bIhY$RYdD=l!@NM%ViH>5^Ue5&U-$a9OyTmNY?7Yeh6^6`KAe0G~( z;l^DhE#o5Z$$9UMM@^cF7SbYS&uBcyj&>w!rvCj)@)~VM%|!kzVryQMHD@Tt%a8I! zS0ra&3|9&Kxx-UTFSk5JyYHA0Z>6K-n=cVEGc(m`8!!0x{!p$VNl!epAOdIpc09Wt zi(^KeEJ21YAC6Q)Gu5O;@E;KeDgxL^2S1JVgpdef+N_twj4<-1NG?(fs~Y%3D86kcNXQdvpo{mfW^eZ&dw5P7j2!HGB? zDv@R)KTl9@9irIo`_ztTmz#=ZZ|v-w>Of@wT9ywlT71CE#^SA^qK0N_u~Z*|1tkQj zk_c;Fpl6d}i4KQO*4zn~B*UBa2-z$W>>?Y-*WD@{ry-jm&qkZ+p~JcZ_R{0Gve7@o zHhBihatbTulS<6}WK6n=_Zm3fh&M}N?zE>9!c=cIf4R2q-Wgov;?BiFpnXxoj{F#HOM73uFj2R*+u}mTpR(x}JOw*xsPJ1AA4dt zW%JyYae26{0jlR4>iKJupMIe~o?UCVpg~YkwqUkSi=O4|`sN!8heg8lz`gzFGF$B7 zaQ4>gX8R@QgQQ(qD0;n+%Qa`zGbyH`(zw?}y@Ox+G+uuV4JivvCu9W4 zos2yLz1bA?j-_Z?Lk-UdNrRD1sexb zH`d%6?kCsy3lzv#keB;it=+T=C|EDl>XhxAawpeYAF#?tNN26t7XjSz-5b9M+Ml2S0D zlnLh~vbSy!j#m)wjb)tZ3-DHLYC8ruoN7k9RCBH@p=!IDpCsPR6O`mWOl{~5YWEv( zy8lW3?s@o_Ct`6dPX2|nY{lt~!mMj7a!=jMz05+n?Gh#YKA6jb_~OqtW>-kdog>4` zoDD@*-QQeH&fVr$(VpC2EoGZ#Ps2y(PUVMRmR+P@7PQ**f%k_}z8!=`Tq|wi?%Vgy zek?ssKwg{zm?8hlB!_-?Gsd*79D?h3|1N$wAj{a#y(|+`u z%(dSv%lrk*BkEc&Hgrhr&}w>_A6s(&u00OxUKB=0kMJC^>29tKeEUllsqFefnm#v8 zLy^fNU1^SQ2C`OXnAOwK;uTTymUl5~Oqe9Hv#We#%rjky9j+@XyE6+N2q)hDVJ6~S z|IWzZ$5F!{;T$zn@50%~0$2Fw^lci@YCC>MaPy@bsBP;Ibz1tn!ND%-A#D&ew8Pd* zzXU#!f2c23KkJ&hl)|~3p;5cym}v@~?K#><=8sJ$=NyLrDuRD?=ubI%?iN~WJySZA zE_hTkWAL6OF`j(v09T9|TFMuKZ|0R?UMknw^!p+zx74NV(Vie1 zbUe|vCLvcO6yNesczDUl-(}{W+uvi4EzqzM{<_+&;o@*I1|QvznOk)= z`pnBy%oF#6k0exY5HJ%ou*g-uXPmh-OcK7UcPYywAEzG<^>tE`= z%SSoQ?k^Vp`%d8@YWR|En(?GfSvOm|YU&m~k>f2Bn<`S0BttwlyL^isVN5_Q6S+pN=^3=UZTS_~bY;{TK_Sh07+I;$>$zI6_nUr%_+2C3424yC zD7)s&$UXmdH~*`tT4;b!$lBMSQH^INe2HwSUDvGrGRf2%R{vbI6J1Kz02LfVp{iPJ z!`MZ-9{#l}GbBtF8S0`!h*5++fH&`0(nn9oseP3`eDuN3;Nnvtw1&KL`DpKMXLZ&| z;gbI_eB7>VA(fS&r>Z2!=LU;`U2@X+F*1?4dVzM)U{&@lG+I*FjR^z050*6@?#^zk z%!X2!)MYzMn7f2Q<;d8oO2mn~Q|wis6d0-4 z-yaK!i@W3y@wf&BN44Ij^Kxa46D zshhTso4IHyXim!Rg&&?`Ei@SUi7i~|=DcRe*cm#I>ph-b&+RjG3OxIEpXA)Rr07^k zyuijoJ)ygEwvw`s)dOo+5b%3fzH!~Pcrtt;-MlQ>Tz%yv&%6bF(e^1>5!(s8jdgm2}KpgLDq73RVGm`VK11h&RD>bJO=2FwKk)$O-m8Mm zz;2(lPxLZX`o+x?Gvs; z+3I#oZ^ew&=Kt1iFa)ZoX?}WbQS1tf^Sf%ivRi5rp8Fc3L(L@QvDC2H7iDrs6wD2F z6e80NG&Zxb7%a7Zt;0jji<8@H*7Jo+_t@xMmh)b=*M)yL{Ua7=T5jcU1U63qaPF7X zRZFLqS*iP2dBl)6+(a*t4qbi2#?7TIkP3l~I%4L&^VEmR>?Fky`)dH%fK)jfxgJeh zF~`4jxI75&ej-u_4st+>PWU*R&G<+n<#Sq}ie&OY&5}==Q)6t!1ytr=*%vk=>VZNT zxwwugV8nUOZ+ffcnE`M-NMN&kdDZ%O4?IQ`gt;>~_$D zja3-p=WHlQNO)3J$S|NIBb-!JM#CAx?d|Q(+kI?LyH-%@*xKn_V88-k*vF_Q<-QBY7`y-EeT;JbJ4jEtz@1*Vm> z^nnq`xxfyjJgl=V_g5De7gtx9FJE${sj2N+Kd6 zEG(n+=SJWE{|E`V(f+x(yg#`kCvuQN_UNZ8#M@W1&&h*k{PQv2_5>h2S!MSlj zj8){nwq+M0ivp?ypOOTVa`EwXZ8^<-dj_?OC)}tu2G0#8(NyVF0*wp)rt+aTP{lgo zDR;!SuI;c7*bG3cFvQzRyHw_+C(Vkb42AlXFiA3)H8dhHpSB_qfecZ9v?2o6lRFnD zEFfp0RZ%`f`94g{F3Nmyf7cu}mRXs>?6v{;aAWqx3T~U{I{0g?Bp#3?YivvE`^vK+ z+Eo#kzLa;D5@U6M@w@jZ<6sB$uL9Ll$y;xkM2Z3j(P|s%hH}ePvM(@v=0#n0Stp3x z8h^38Deu=J27wOXxHvdCC{aWpq9{B%I=nxn<<01Y-qy7crv+adwSg)D_=4?5a;>mr zw*<`XQzte!;NUw@;ZDciu9SVjBrGS(2up&SiRGVVz~unvDBwh|j1*N{#$rExoPI6| zx_aS2p~rRGyNk@{$vus%rTKv$G^$x9U=w%zu@oE-7oSZ;m+n#bOTv@H+5qpQ^bZPz z+~90|Z2Ya5o;v;;0fN;}y9^*H`CJCZd57Od8;2}Yrnxu+Kg1MM<(~(z_?h;tE4@|a z1L=*4lHZ0E8o9@ttNcrQO7|qw__6!PU#<86)e;t%HX!@cECgBwqu$}gdG(0ot;NT` zeN!gpzi-Ppr9~I_ZmeO7sX&WVK=HV*kD-`Zug}`A?6;Ncnz}$TdZL+mg4s+Fdb;c| zt=y^1S8i1#@abs<(%U@9-QC^tvH>*d$mhrl^l%&^>EiC5u99>lPKVQ1H6kJU>I9od zQNng6Q_ORHdMG`f9LRC1===H_BRo8Kx?TtV4PV^26IjWxt4Bvqld1}&0?2p zwy#3kRY4)ZMhP*o_~ZdDX30%69DSh#xuxxg@q4T|zLvNj3B#n(_rmRDGJvGsOVH;^ z+|N(5T7Cob28@uTeUFpPo+WxxT&41c<4>uu!{rQ09)A5@n4q6&r0Kws1nil^hVM_u zWexB~z4OkYn^~X=kl<9igZhcNt#kzaUsXAF%dTcMXStOr-ut5Md=81v|2i@EiXY^k zhI=49HkMvF?rxcVCp)DRaE^dO(PoHNXVzCl+xbk~KSF89^!B-8UluKmy%GbNwHPov zh z{5!dYC;E8Q3ki}Sojdl4FAZV0Z4K8J^edisw7PMVYdqc*L?yyZp0B)YhhS8oZxGK? zxl{Est{9E)V41f?`Ot%Pri8eeF!j<7JvA~f^mZ|4fsk=A|E#j=bz-_@y{79rQ9^xv zKgAIo*1x{dugl0m0dyj>FGP>O>>o*tB$|XkMliin6a0&?p3*X zApew27cvR&LUB$85ug(MA+fP!Lv9g$6J%1)!L-k`%POiEiN}N!clqb&y*~URlo$S; zJNkS#v9Om#Q4x3HGph>&?~H4XRr|`r!efK+MeRl#*D4R?#rfTNzNF7qqL%!uaxLc} zy03nH4I1=E|B{2)g?7;7X*$(jA?mI-1CQlVONRyG3#jV0E{AH)=VWoPJ}m)UxvtIiDS) zE(beKhnYbWCg~nq|a~dwg7td(l(*2p* zYiJM&mBk?>L|)ySDtgM}WC%M~R#qNL|=4b!$)0^ z{*ruNDGVX$1KYRclD2zHByX8dQDLY!bdfEV#X>SmW9FVeinPoudPy#l=R$(tLrHJ0 z&Om=JyDMsN8+;r+Su%M9Rf#AWBRGL*;GF4feIxM1u|v;1x%0Te$41S|a!CT*9`HJq z)RMigoIrK9$B}HY|3|;M!oYiB^527%sNgTg@3uuIHG%IsB_jRpUq1*UhByY+D+M@b zKya|VD9cz?dhy)Pw%;ZyT`W3}RNQd;1NUHOb91rIapU@ABc7C$I&hJHW8~A!U3zPB zWS|Nn1JX>S3`gYs@-)4|vE0;!jr5$Z7A@{h*--J#8)T4pKFMTiK}D(PpRGiX3b}+t%HPoqmDRTi^8~ie;g@nv)b?gxB%1X)gke$qwV%?#)gdv7MSP&=3)g?gX|ZoP z1}b9G@V2>BoxiqiwUy+OM&(!L;Qw?=o_E4BFGUN{tsY{ZpPvk_)*$y#gyEKi_^)wZ zXlHK<{j_Cfu(BHysMRc~?Rgahsh3;OOLo%Jo8EI_J8+wk>gCJ*ShTUe{w*Lte?Hq| zJv1*buaTsGs)3xR`%SlUjvG~A%*iiBLmqJ54wNBy_sXpg$4j~Z{zt^L1O(uRFcEV9 z0rJnOv*O}-eOor30YbM0;@pAo9U#C!E_Z*C$FqF5=CqjOdB)b+3d4*FNDgMS*BcWhLxg(JyV_M3#n8 zV-TpbVB?L>Rswalh+VW2RqW}kP&U@=aPWgO0)c$!emu-9xXu-pWcx5Xc6W2eso$_^ z98%;eYL=?A?-y2uOF;?TJ^YPUz37;NksaJzTljQhQ40euNOh71(ha*K0zCzRP*Jq+ zf9qm;{l2~BgNc6ek1mw+o_piP5mC9cEZ-G{VcM?@f*$c&UTh)>=KTE-vK@zJGpc^&S)pcrgwbj*Z`VEtv7~ygqH%V{TzEsp)?EB6cu!Gpjlq+~XwbP=VZi^68s?)NALkcscC^3DW0Gg7H(1_37Yeo{CQFjQ zh;^alTvm5B{tdL-1TMaA3^6Q3@@|c@*udvvN~!3_4`C3}P(-M44-WZod3s# zCHL7kO)vEt(!#ow*RnLR?MCm4rlKMR?U%i;mfTz6OGgctS(NdhZj71Ru%`%&aO8s) zb77GIzEzg_K+s5559)`oJr=oL3nl|eyLw@7_qQ{jJ2xPUhZT^-FGR0-LCnPHL}0NBZo-!d1nsOu1+?9L%FIdE%^#utBuTJ zM5Y_ zvirPulBid;v9wNW9|i}ciR|;zGFH(%)?8K zNew_@@3nDhu5X!f7!rf%m_h!uom9Xg1zs$G`!fYWR4Td#YeL^je!tc|EYERkgrAT> zcb@1X#=%Wz$Sz-6*Oz@RE6=LQlCq8R{a*Y_e-`=)+DuELi~F_p^QkWXI7hRLvbU8 zQQbON%}LNK^i8SaRVp_SRaRkKWj}iDmJvQ)Y$ZdI0O;}7L@ZDRJL-lT6#Is6k0UCu za(syMUdihN83txheNvjy|JbdI`_*&Q9#V;8Ijt)M){bX`g!aBaw7vL|@?(!p?UDAM zPW(8lr+-1!c+XmfX;oIu5ID%C8bpAW`jY`RWBvIHFgJUe@q2HsM*H1um?6vc(mD4< zH(wNVXe6Qnw=Fm`$j2e5S$Ag7=_=^hK>&O(mDRE;q2ZCiv$o_y$vj0#T47qf0&0yhbvRmjof^Qu>0!3FLC`rzczX474<|IWx8bj zBONbNNavb^(0=d%BX!_x1g|90@hUB5Q$p&6^5s`sC0EbkqDt}+T~;iDfy+BRwuEK} z-H$OJ5R5{(%tJ$dZiinrp}-831zK4yN1+Ig&wUf=8$oXLVaT>$OSG>Cnmz2g5Qz_x zcEku%FKo7vK?LDJ;R*-#*exwg`JxjaHE5oO*7n#dsz4RejDciM1g`WUr^`E8e(e=oH#^ysYQAE*nNQ$qzTq604@D$q&)HZI z^_Y>IP2HP)AtoU?1;YE2r(#TGL1Nw)7!!JVI>4#s_R?MZ>g0;k@-F4nRJynBru^n) zb#>KDL7HKDb@fM|nTaI!TQ@df25DS6eGp@QD8zo-ce_w`8jZyRyQ#Q2X>0Q@QPkJm z6dHIl5jhdAjKszQS#}J=BK**t2;Yk|2&`2Y|`|#j##bQc}_l{RL!t zz3AC?7HH-dDnWOsxm)`J7GFm6{QzhD>29juIdjophZ1$4kD&JDuXBrfRV=8 zYB3y(3y#muP|?uPUcNM{G82${I8E}b+S9$B$*|KV-yHEgPk(KQdTs^pxIWoIh*BFu zJ#S97_LU=ZayLLSu3+W?zh67u4ccRUa*w5(%oIJz%lbB)>YqJ(W|K6iO6M$;v1;Tm z>fph;V(w?y_JU6Q`y*`8_m;9&!UoPGB;;Yz$v8aA`65DoV|A4ZY`u2Pw)JnXSL)^C zv(e2Rs72rF*RLUX#2~0-3@Opz@LQ3G^9={0U}7Gc6jX2{C1J~A+m9bV8Xv+e_yMLe zVEU=v`rnN?If3OU3J6jk32>^Kv!{=I}JB0U7pQyWdi!a>N02vhPcTJWF+u0A=N>49j0C+@8#S&T9V4K z(sIm&0bFfF8)f)I;5S+%>z&Kfz*Dy!`Oetq0~9wbkOH4p*Oylk@CE33+<#YM!wbQi zGy9ghhIWQ4V^P(2knfJ5z-Y;rdDjIZ(!7}y`T<1oBvTFXai?xT;NDzdV5{i5ph`CU z#x28EfQ)%oyY=voe9qV>miO%JbAKj*4-bvGUXTtf_(Pn)lxao(ZB|T63jC@YSqPzZ zImh(_?UR2TGl7%ISafS|e?Or7GL4&1%l?bx zAq6k!+*S0%fD=z%FnPc3Kmf_w$AJ#E8rA=poEc>?xeoOyBNa#JIXA?Ue;uR%7P|qZ zQyk_&n+QK_JZb^{0Xsge88Is)1&4Wee%f|u<3d9=Y7?>}eH$@mw%u0Qg9wgA<1$dy zbaxk!V>kh=y7ct~;()zw&8hfAglXZjV1sk%4^!P8x^ic|ie1 zCCmiiK7n=<)5Ox`v*_Ip7yHmtk0_nWpq7m-bxuWoApev3#0Nh&zwV@WpnzGl4U^LHqv(J7GF!k+RSFt5Ms&ZQuH(8+j_UfoBkZ zQhRY_NffM4h2ihIfcnJfc6EfMNLP0on*aVj-+zA~`CTk@lHBf%(?IX3u}bEw#28WL{e?KNe7y38*1gQ@wH_)XRsW-I$tJNqDj@E*KZe=t7Qaqx zT=RHJc5FFX7aSW+KBYap!Y_yAB{y``$nOo~fa)cz+lG1D$3$N;XFVRf|C&9k*i}hR z?Ofxs=xG>74B_T&`{Z6$_lqSaL6%}v7U8?1>PnJ+)+Pi=PsQmLf@^PSv}DTh7$*<( zHuIwoq5X7XKkmP?c*oNT(~5feRqmv11Zg^Qlh)jAq;1IHc4oACFPT|@e!uEyB7R*i z@ZRS*;k8NMX2W^pyA91~O%fzf@W{ol3!d9t8bH0vDq!;J|7PR_5muGR0Bjay zJ1xgU$2e2)XVe7J=v}hHmn7{8`VM3#MH|>KT`s}~(R6Yic;KTBdmglpz7!y!ONb@5 zH~f6R-ScV#ARW0P3qs=kP1i!k-Wgn4b6Z@%4z~*v%R053rNvV`Ej%+kY)0?4w^_W% z{>MFPA|Ps(q$}bS0W4Z|Y6XKeH30G0&~rPN)gs6)(oC!rAJF~!F~qi3%Pdmw=}$H_ z!Od!xuZ*nuC%Z{AuIS^3jP5^#;xdF)U9wyVLd&aED{}WcXv-#j@A~DJry%Y{eqMRj z=b2>HNhli|ACGMLM9_3B9_46&ANw&-4R>Izv|eCTB=%+< z)0va>IUocnDT#{{A9$C=0DDXqY`j-R?6=zp*|y?~BD{&6gZ23DW()Q>zCVB2@~7dS zMN&OI)!Q{+gXQ~sAR7P2j%I+!*)GZq`Q&N;6G|a+0U*|8Xw3qme<@puL@p#(ETZJZ zHjoU2R=8M2iXvGm9#yL6lQWbe9e%BmiD#N&=%JM|<0|L9=JugB-IA-`gOZV2`S z2{FwNN{)D*?Q0R#Pf@Zs3DWhHsIuObHy$<7xXYMiaG8ULbYN!Zx%0{9n833(-8cL0 z6?IqS*-Eo$5{+bhn>cg2vxdOVj-v01&bMI3opQ{h$?L$ymZF)+`+(BqL(fn^%X0bI z36g;Z$v#L^u`$d2KKlFhFy}M2q{(k_Liy0*^v?55g}I#oPjzL0ZjwW1@{8m0`q`lC zDNt+s9aCOam7P?m$v@ebcu4$)@w_>2pg8^7vY}__6g7f1p=`VfP zub~X?T2ja27|{u~uO%ht7UL+x&ro!xTUx5`T^UJz4XgL#^}(CyGak_i-g*x&%GWJJ zNF^RZp=kmW^#MGoJbDkJLxxdzmR*#!_)YG8&A7>r_t^)VT1U4RjHP`xD^ju+-Pt6M zPQ}unJs$I0KmV<&E_xj8d7L})gNIGlxbW7cEHU$Ar zia(oH}Y8l4w<{nzT!uV>T^*GF~H+DS(mIFEVKwAY62rhtH{j^H(w1mYG+q> zXjoADc;mvoeiljoHcWeeJnLl8+w^iQ+V}K$XddW)i!m`VAb(OWKZBPu8(XZFu$8|m zgE92-4)sl&3UNQJCq2{NTt>!7zvJgKx9Mop<25Ow2{8m$3}@T{AZA010{%({z;- z3uk>dt-kz^dHbiPKTs42(D{V{B8^9m;TW_r8}r4!mB-eaXHH0)pXP)2!FDp&CY7Tl<IatbnBCAo+fH%Xg8eLnPAZibiN~vCiEX&z^h19p*O8tKVAc?dc4?6r|L6H+a zo0RINIZuRdciSi-`eJsX@~{UskGQZ?W3RXZ>eZ|mPuky2-zH1$0^rIkxV;k{aMxDP z`_A6{qK_UGpl&Be`MUkcnS?va++bwy+{YY@%4*|QyW=g%k9Sq`L#-YoJjOP4U$C)W zyfFCz+mI~!>TqO$V*jD=%|p21oqRbQzS3m5TBy5JW8zH1{!99$G!J;;O7$!JWc5d)>iG zdll_{XDNJ?cVxK}j<~}9`#cEhQWXfUtDasXA1RF+iCbXs&UK=)~@#NS~;dbx&hB3k1 z$7Ur9oc@%5p;(h_&HrB6D)bZ2lK`ManjcmF9frm0r<|?t!{}(t*r)TervgOj`{PCu z5()BZq&ECP083fvZ*PAcYz!cd=LiTps%|#_;@^oN%8Jc%AmgC&D~LJ8|20H+G8n6T2r!say{D=w51i`4|*IkD=XOy z|HY{CTb9Z{LDz72)dfD}#Q=RW$@#^`H4m8sQ5$F5Ai9}%UCVS(7m?kMId}igwObGX z3TUy&RG3fc9K7MP_OE86rS@kK0VMNuQz8aOW@eI?Oj=_pNk~krW5qAGui@q0{SstR zoXKlQ&mNA~9AagH~bJwd?kkJI|iqtjoS6mPnRgg%cHbZxNIM?fg3WETt1#8^gT}o*y zUErdqq)Vj?kZ>y)uKX2rKzb8<)D96sOOiIl*jbTIDfiSSLwX_u{sE*qzFW2P$GCd7Ke787_&yV z3RAA2ZQVWa@4_DW>m!WikSvB?tMYI-Q zJNq+>C$8v|YxTaq&TQks4HQg^_#e243e|h~>Tj^d~5^&g^Vr{6Y z&e*q`D=(iRv|&8~oe5(G7mOW0wCz?uD@cu5_pKL6&yQ03j@`UK60eB`+c>e>@XH3# zbeeb%soM82e4m}YUI!4!{(XT3E}8<0z~PRy(=X_`?!R-qJo#k9e7gI{?^G;YIo9>! z2F`zfM1^cLQ-&3I<2`MCYkd_{5^ebp;r!{5II;%RkrPcX0~J2dq$VJKCk8&Z-J0Xy zO%%3C&WpR6rxzace_d1i0?@;EB0R%s)XM~^(*F0r_Z|S0#)gjGS~D4saLqNgHS0l33uj(v_=rC?wOqzmnWmr^|<`)}U}p&J3*Y*K``DUa(^R$5vB z1fVm4lQxFw#&i%sXGmD8|GhAGKtc>oOKX}gBNUB*6ZFLKFgMWkQL+u(}O!rf@1#sI_t^Ju7-dP*5Bvt@n{@F4CZ4I5+; zz|kHSF2R!fo>P(AyW{IpraVyfs$CV+UhqkviRVxcTsQeJuHPG)j|YS?l`?hVvg%d4 zQ#d>preH$PUnc^IUvyJwMAY81yvhvp=(RE0FD_H(b3<Oc_2|dD+|C}-OzuC15iAod7~S6ltVN!Wr|)W z4jj@i<|Ft|YZ#Y~Lt5<&^>kR#3iSr6R5!FA)hs2eCwd{YOwRhxtD=o4AquI4hK1Jb zuKNWGgtf1i|0IRa#k#`xIp5Zf5CoJCI_WJ0i#uswY9w_-E6N5SIa}tCB$SD;sXxOe znEkp7bQ-?y^*I!-+$D~?*20X?^ zVfl+?A>*FLFECSpuMlM$jo68pn}A0`>ta7G~C>+cUn z^>G)br1Tz)#rw&)_E!M5edjHFW65AiiL6*@VDT zn8ZB&=G+O={pDTwUU78Ses2uW>_FaCm_ZG%4_2Ktj{y5oxX8vdi>)CUH)VwP*;C;& zP#Nj|fYRkk(cV$^f^pSTo@z#{4|Z{YS6u zJ)+={tMEu!O_$<&ddX>@chULtC$^c@w^q`J3`((mD&6?rqUe^S3v7=T=QUO&U%%oG z0m})H^fzu+6Y!O>;`Ce^e!juu@r+#-XxR^#XdT-0^5&p(wcLP;Ql<@aMyn*vek-K! z?jAntvS}~nFI!gxJo=kn&*zmNDp2LrbVUFc-@FpejQP=0%$(Vdpm<0V)(8Sp_3D19 zOGTyf3~mi7#WlmeKe!6`lEhsg^upm!04_s<;4PHaF##NFR6t)}yJm)k z_Z6F1M|H+&$W9Z9{aZf8$maM8!pajY31*Acv+%+H<~`tQ|CH&cJ>ZqjnC5*_Rh&GV zhsm*k)dkbD$AkgOL^-X7Sso%&O@HV|{ZzO5%?JRGc~G1BTOti#R;$qqkm*7y{b3Kz z|G5B|$+>{A(F(xDY7)!QBz=2&PEiyZK3g#3p*TqR2->{E3Gva~ks-bCQ$ z^%_Xb8<$yfUF_AuJa-lA?H(t>hs2|KPkf+awIMGcrDR`T|dW`*}7+%LGY zYL85^*DQ9QXiCvk;kwJEHnilC>T-8^ff-Cl$*6*7dGKLxiJ=Lw!)y$-Nr#(G7PmtH z=c;JJ_vfK=DcbHt1*fg6?qNGG(tt9l1cmgA1@Q#15dJ<#1dje+hoST&Sx+|O(z(wi z^s~B=sN_geK%%LqJ@zKR?`emVWpjET z;TVayzhhv9d2LD^KpFj54c+pDeBAFH%yE0B$88suiDs(}r;bmK3|29P7$)+Zk+amsTFGukzDwG%dK}?!eHJr=Q~^zFVFT>gPa7RtAcJFZy?EKj>c|N17Kc+d>d6Da zuX;XAc*=j0u2yAo7kK4OYz;~K+06Z6U$&{TT8OV0;U8hTb#d}#zX-l^)Ia=H<~X#& zG%Kk>W5BYZm7}$)zQ0Gwj9IGuYP#HduISXfz%0`YX#@IOmT2VeEoO$jUE6J zMyYrX@A~-4@S=(y_3=C3avIwA)l7l4cd>Zb!|oT)kuJt`H*yefFy#UV!?Dc8>O02O zwfx?+^5w5qY&FGrV*jGN-&{+txv;#&sE(H~K?Kh3)u&!&fL#Bgr@?MgD zZ7DLmp!H{*y{!wGQfU2fJcv8saps{+IpmGj&_jSQJl#50&-R!KO%4tUWK+63i5`!j zoX$SU7`)_f(JD!9I_>}Xx(mRJArxwkDpXG&Pfej#j#zc_?2D$8nfb#TL4iqKf%ri= ztg86z#}ioz8cd@melpUgMIP6mM%-?D9g)AwmHWNQx6Sg=b|SbwK_< zY%_biW!d}fMrwtf7VBi_1NIL84qB$|#a*IW9-Z{PpwCr3@6veUK>J%J4`(k~pS8Rx z82KJk1_tK9nh*P<^=LM)38G)@gk#I8x8u);MW{CQYNJ{t7;3ecXaV2Gn_zyHGdx}{l0zc818SWHoFDsCP9q;!Du<+Q~#(>Zg|qLVZfA$Q7@ z`e{W@SM37^w4S|#s@MMG@s`P@pq`)PNIg9u&MpZ}m*d)$EqJzTIK69~cBAkBR^PC@ z(o%*NnPsV^U5q;2oF1)xi}f%^9OAg%ytvq&mS_;q_1+ErR*rSXi=e|5o1zMHY%Iue^%lDGzf32H-qB*55f z^nVHBYS#!SBdB2`iX^5y=<9x>t8`topd_a;<{v0gO!t?wX@#w)^k8h9DSnl_|5NZp?-Gun$ z_hTV4u`)rL4sqq}r4i)kmwZj9$71;aiK4E;R?}5qTcqi=x2upOxyT|MCa<2(Pyx*0 z#-$QxfC0^|&Bmd?#YGn}@xVW9Ifx$G0MwIor>;9|O#a2j9$Onz|8Vrv(l%fRvAqV| zR~vdP)mUwLhgs_s8PUuaP%beSHxYcSO+l}W`^d_W9cm9yXOp4vxDzbhMl@yudr7qh z_BBI|mYNrHh$fymlC)~w_>Xnr)UQNtYLFNDiq010)U&>mfhJNK8Vhtv`&NUz-94D_ z)pELk!}!%O$!)1?f#3aYNUU0Z$?9_(1K;gt%<}?AZ--Xmvv-}=Wz2G~ zDyaR}It7kZx5p$dsp+?PkAp+xtA#4>+X8BTWMfp4!qBf64SbzZ`|>^z2)G4 z*qf=j+gJDqh&f1{yKAzC@LbNKVd7HabIO*5)obxx0AP9Cla?`$T%BL&!^Z!g^4>bC zt)P1sPF;ZFt_|+))|TK}w0M!?QrrR*DTLxsTvCdAarfZX6!+o|#U1Vm@B3Td_wQZz z{&%z5l@`vKnR8}l?`J<-hSADp9wG6(jDx`~GE+SOi%TDsFjO6d-)pHqr!Ozb8SguZ z(jjgxF7jGzXRgnEq&nFtJ1Kn|Ej!|CesRv|godHms+cE@3DgD&hrZt$C@)I;;Lj%q z;(#}^=(H}ZrpfZ4RX4eHzoAPR?;q&%I>xA2gM&+Z!QG^I)WP(yh{Dvj=9**ZqMIt; z%`pUWYrn#H1X}o{tU=*EeKu!niCKKr+{nD!>PPuf#JmS&zg!r+$}DVfbsO|Od`4_1 zW#4^YzJ%&-f|glqp@nug!zIP^)7s6eK-pSoPN130op=STB*5>dIm0W`&5tQ;tP56vvAUomu_cVVjMKXzaeo=Li7^Lh5L;oU^;r9J;Ws!-CKEwp4fGnL@Q|&;y0@ z?N5}pk(iGjUw+goaCrER_I^|=c0>~2X1%R{orIRo&IpnL5jGqFoB{=plH(i7ZLn;u)1o-+J<|G#`71thY`|g}Zd9<5F z&-CG*)nEah+G zTFO=`Pmo*fnV)byl!sMh^QE{{QT}v(YI?q>=8cNk$%;EUsLPx}>Dbro$W!iH3R`nk zTk(ladc=YL=+!gOGa@c8ZtkWW6%D40s+T>GpZ@Y(o$uQo0p_H(iA?l9#^FWRwIEx# z{>=?rY?o7je>ZmUqD))YP?4Oe`9!OrpB=k$j~F^ {pmAZUz#bR@H`?wlgrgU^g z@)63*?rdgx_!DW6u7dCJajw^vRuRO-#4Csd*bP!Q{s$<&K;RXNa6C`ltJT>hyw`t# z&=i7#m#46V|_&oA#s6PbV;vA@(jnpH@y^vFh7LtiM0dXnJ$3BubzuTdQ_dy0`U{MH{CR1f zdV;jOhaxTDx>uwCbzoQ13Mo7B{L!>Pj$iDgSas0xo#O^`m-GCW5L5`_)GMLaL42+g zyOGFwz-@A6>E(LmKYqu(-|n`4(~&?df+B&r&4q-8gDHWSkC;{_0plh+*36hR#A>l# z&6=}0|Cj0-d6n}={R4K+^M1}(pz)#SKqAt85KU!E6X{p>58QK!lz2;7(3b8txEqK zDQ`*?-_mdf7^I?^r)!6A9~)$rm2|tzKGVs^2v8n zG(ER?;K}&kz!ztQtB~a5l~iFKrhBPDoLRNTw$ZEP_%O?|~ zmCQ&n5@O;PKWb2)GuKCrc{PK_By298JAdY;@akZSS;8l$mL>tWOUXS(hbH@wbxR%+ zMcQiZ@i5(^rT5`!w4L_l1K0BpkdgSV=~mJ+AsxiMJi$PCAHb+EG#V{gCT8%uA`To2TU7@@VVDZ`vzn4dHCEy(FB zA9c|6a8>klME|m}5|$IwG=35^Gtbs0gd}HJuTs|oQr$ZCMA^2PkAR#vwOIWjDR;?i zt4HrHqH|fFPy|tX?O4xvP^(w&ErlGarDc9Mz2ECmAv|lk!BFA$#`TOJzp(h^s|Uan z=ros4h9CU{ax>>nxkW_unBrb>hcyuhzRrN2&-g*s^8q@tY)*+rcnnR-Y^3MTh;(vnW?&9l3Z0f#kz2VzWqnbs5RuEzi4OIHw0CVUhqCx;1{?l7}A#$jTt zl4KAJ`3m~!`wu*6=M|+<>$zfbM5Fr$(_a49ylf!7+^z`pAj0(YKZ_?7NL?0Pp4=Uw zfX`ViC-r+v#d=7dPrTG}O4@6w)q@if6W1AceiO#c;dVvxD-NNjTJZvLUIFCe*$dC# zNo+1ZL@k27YKM8Dl{Su}(vfTV6nBtMrT>eTZs_$+RZovhCUSCauIXc&{}VKVS)_n@ z2#|jzZDt81RHBBEq_Eu5Fh3EHsGlFUy9l^v9sv0^nGFrXe0;8`+;gh>slcX9*~x-)oV#%pcW68;LAke{bbelEH=#;OT zknrcA|FYbzImdlI0RquErZ1csKir3Wx$oPrOFUGeXVlH4^?F6ZiRCQdamRyTBO>q8 z&CtTN-dEwM`Ba-o)T*R1CE0gzbhOu2vD zM5-qNjtU^Gj*1y`4JLsudIWy6a3%FB03o3dI=*!HePT=U3-R+vB`yc(L9?bdV>1mW zzrPWZTXXoJun$~gB?@StX?WpLYlJaLygKc%6>09S-NATG^I|W@8E$jA^ zP9{IIZZI(l5KS!CoDr~*&!6G^F+-S;`-jnKuB&VxKVkh;w$%V*$p;erOO#^zRA)9A zrMz=qp{y4(E|VU_FO42R@AmSTl3cMkTI+{1@G=hEya?dZ%1M|gQ|s4=5;XN0!-%p@ z(T(UWV`eRxtZtgo?9@#=iT*G%`_r~$#^Ws?v@fqPxcv`CXJ@tDJqxwY>GG-CV{aNP zHWQ->SDpE3YlozG7oYpkxT+C{y`22K;m@R=rdGV>K+Qk`iYw49w^c5yBS$VW)<^(s zt#hU$l!yCORnOngzb}SO*6%!K1uT5z&F@whYO}r&Lhl$% zSVIn@M*dULhj#`Sh! z4e4ewczf&W8jw&aR@OGoqV`K|`jk_5+sgDMtMD*6U0hJxkAkA;Pu5cdVw$NLB^4CY zN;C=btmLM`l1rE4{;*-@-Q_PpYij4wY~tf;b5%3gMrpyP?iOt~P_liFH*cnZvreNJ z@8=&QDd{!0z?V(8aO49$BDxwUg*2eRO!}YSNY*eM zjJqr##P98Vk6q}BopLa$!b|JFIs-)HXK&5dxJ)*fI2WQ=?ulsT2S4NA3{!MEq<($> z6QFe5WuiqX9Rek~3CMKe4X>Mte*QGUSC#t?yiEmdAd5fA2JkGVq?ttzzWUU&_`1LO zX#ehFeu_|!-yz^Xfa zCt9&wPtaOJkQErrVsf-x<2-W}T;jzU^H)~THCs^sw`L9(6)=+OiD%oW5+O9D^wNb3 zzjpGNXLQoa#+{lcv+XN~MoE;&?a7P;fOMefcV-Q8%2O{`MhEz){FO^`#e}aEf6Ap9RQbiQy-F zBK6nVU!7XsPo;WW=dt(fQ`iSB$ud=*CA=H~>NZ76N_I23gMhX8q{efVZ+NQV*lU$D>)XFuK^ZVlK&-5aV$ z05a9&mG>xFrdp2b5TeMWKpp@)Kv+G@R1x^{y*7;>8SGOyGwXiYcc3 zN*Ui0EPnn);9+qjn`ywh&^EsG*_NzdT`dowb91x~JO}^t84F$?NZP+h-%s*LUmHvq zzDVzq5_yhBp=V@dbmn;eQ#4_p=t)FoPw;9P_o`%77iSwi1^mPsoJ_=1)#;uF^Z&G5 z9)H3sEX+U>I-+HG+51Bbia@LK`Z=$9iMRa#1d@6(0PcW&sw^LK>i&%2G;ZUvnz z%dT`vdu3ka$okhr7$6V`ol*=>N1?Z_PJwtyZ67{b!*3?Ca+L?#*(>|~5cqv7X0ze} z#hqoX@@}2)U3=~+@G}rdVrW=$L5LWi-`Qu(_~3jGJ|kn_82lFK7-*5)7kqeEt=5Ne zdB$D5a1mLWe%+z5ek+ITZA%Mg%D>I28gcS`in`Rj^#aO1mtf|3#@56UK~S1}J#U&{ ze;nkxH+lSI8J2f0CEY(3Pni2meB9No6CwT7s1iiMu{NWh#X;sk#y=_n0)2UpScmDE z=SY7##(WK->HSb}KH?EjQo`xoR_iP3b(L%Kq=P!6rB)G{7Qei1j~Mo@O%Ow`56jw7 zi_ntil6QLgNq@XvubHY*z2d2LbHp2Cmc0vHDVm671Z?LL7Xw z9jaKX;$o)%2MWg7t0wey35CTo=DHtzVN#RRD)D!w!bZ|nc(B@6TLi|2pJ+@nw zbD)1W($fX|piSKEfD;0Nsw}BQJ_jb13r_6_<-o5&o|@@k$-w8h+&<5;FPUS%pSO?P zJ2#@izS%jESPDu2FU2q`=~1gbId)zM zD9dwyDvr0m6p3Su+Egs+9TdUQa@oKz-(~u+dHgZGZXp7-QXL9{pE-T!4H2`+91hP) z#Ztd0^i3rpc>@vlAtDxcdx?$2q+VWEdI2Zf()WEj*C5$DoQsP+W)U0Fm9WM8@@KuC zfxazlmMH1W0;<{KlO9}L`65nabe+4^4zp6W}H ztZtr&LEPMbgj`G-x9MkO0%u`F_lGRkZ?OSu=V^#|WOE8rCM#}g>5lTjpyL49nSuXK z0a&-w92dLObnAH2Xr-smvuwWI#Y)g@M)NAme&uq2R<_&fPp&>AgIurMivHKF3)5SO zzNhJ9?Du_A%G`*Tt2RPDoo}KU)`?EZ)Oz?rJB_)LQm;<5g^4(a-hcLc&Z{73-IumN z2d`3_UB0gGbVP%8fgtHBbp>r&cWufw2M!_eHNF? zNL9pGI#?X3cU8uStoyK#S(XAD%swENz1}M+KqqP@GT}=ZG%h0v*T=4_D%N0mkMD$k zIKuI%h6$t$2sQqHXxlFKN^0Az!BH@h5 zgW7L%`(wqjkyKpY8Dn;89ixE0WUF=_gpN-DWHq(|kk#igwJ3H>JTUnw20F z0)9;#a^~2^(dnQ!L7v3dW>qD$P@c#-4k{cpqwbEO1J*+T0A5a9zq**v- z%-e7s_XURdq!1PU0Q6VvF9|8>jaco{yCbz0(Ou}py01PSxA~tpVFhRucbt8_v*v-F zOr|M=#Ud@Z ziboq?H)jt|W0R1O02P$X6n+6kUF5PeFPOW2+5^wuH>|zFJean*KcS&#;W~FQYOmZq zkd)=kX55wKBNz2x@2e9y+R5Xi%oh99-ySRX3` z>oLO>;p;Hv0z^5}9U7}oyg)F{v(Gf3GYDP6lc!G~1Am`9>0jl_SGU5hjbYCw!=@&| zr7}W1%yw>wbwDt_3#1J68ZzLhMCiQCSEq}XNu>Hvq`$hB=`lnEL}GG_Qy+%Oww;+5 z2pCrwI8iD+>VN}>7WA0{RchE0dRHAoAmH`dl=vSGZ82qUQ(LjIlLWc6Lts-h1WD+T zyA+OGT=7%L+X0%5|3tFRChxF*)EFH3Ze zwIQV6b98OlPm`2<$X4CNiXijsaPX&ku9~k72s?onVAP|&xL$uI^?c}7-FPVOO=_!v z6po)mm~86IXz|?5(dv9$A&yqb^i^kq*Zmh2d{Cv@c9s1V$b?I%kx7&dk{kpqO!?}ZP|N`;qJp14jfqwqBmHujuQqSiQ< z{VK$;L7V5uXkl2?MpUezgaFV)ukdtQWz29BTLlVRZ5~cN#;JMIbwLq5yq;g07uv@s zx;Dw_F-GSlCI(Nab^LnHe%E+2r~9miZco(BwY1jPS{n^Jt>5rsXFFH9<#zTPqG^2t zYOr+rsAgwycy-3BN7ze@-CFvDsRo8fVfJX?kmW}A-j^mH>n4vxW=v1d< zF;7{Md;#=z+G8Sfr>Rr?i*@oe=kV^{CO>arAL1@#@mV`hIYLW(a`iGo29PMJquTEzx+Rwv26=d00X0Cpi_LcJDk;wc*iECEh%=!_;QZWt@QlIHnu zwFt{(|R`c{m4@rP4sl6 zLy|ajL)z(v5HN2g0JMX>~>72ckQm7S4AzZ?IQ8=|Uw`IQ=>DgmrF8*7k zi#dWrXg?qQ@|at??;1%_w&s4glpP6ghGy3I4Ez2Q%7-Ug@4wy+ce%kZMKUW3=q(%<_r5gEPAn!A>}DbOAnZtxK5_Ox zu>k)NW8$~S;M}3Joi6=;KXGW~UUwlP(s@3HGOZaJV6l|B=zO7b)@uf!x+~18`?;%_ zMtGgTU@|}c9=uE`WBt67HMQV*JX`1V`t|Dvj&)kzywEuXC($g^i4BnpWD*=+`*vmC z2GvqsX^FYWmXXgi^Wdi$xcA&G*12Tq@zm&uz}(BP^x{Gl`$jmTA|p;%Zp^=Y+}D22 zi!r-V7HGLDCW(txB&`j}d-+V^E=a~fPC`>d7uPk_CEh9E!G z_2gWHzGT|_Bds-C@AW}*FJ)26;uRKvx1Tpg-KAeca%Co?$We=n<^pxVaEhxceXZH+4>eb zKNaAult__&aV|}dm{}g$^WJ=fDLr2co#ynOIh@MP6|MYSpWxu5V%oA*;bnOFSK2}J zWhlL5H{0dkPu*!y)@Qf>koB}qSKH3OA~{yQRDkd}bY&h7R?Qf^!UDi_D^LSciYr#} z*NY+i=p-JCok_+;w-SD+-eH?V2m~t-RHv7ZewI@x%j`y;-s~oMD0hX6q#Qn9F2oI? zvlBX&GFWnAHlPRV9QR$7UN)o8HddaE>B4oRWgwMGM_u)pN?6e!MjPI-NV;E!iz@p% zw|Ds24^+ZEk@dOcv{ryHmC(`?w;fezpC7CE;p>!n3*)^$lcd!_XJ3TYgL{0;2y)R3E z)(`eX2Q|gi-K7O^npI2{XizrIaGcufNo|UwsUvokN1aJOd)c!^sM!4G;02z2UEj+_^{VrH%Dl z544Bc4Em$T_ly30!G7$=2?Tiq0iRx8Ue?yk04{}YSEOkJ`vdrxbUl{OR!vgqa>zWJ z@`|Mk#yA0HL5l0%oGe#uXL*5*o%u!(Eow4;IOcTM897u z*=5@mri>V1uMt)4F@k;V;tAZIrdG)iBhO5$t4vrz9~C{~<@(}<$B+r{eq6sFE3`mE z;@k3UG}P&Wxj`-*?z8-BKbr(VXdJ(;BYU#b4)3fmjZZr(^SYRXoun_>Gw3vaxfKpP z1Yu(j$}nun3$!>uo#1HTM+Uq zCmqLItjBLZlF^5)dDR86a}uNZx57g1f;=I>AW1HWqf1F`{gHBr)H~|#u)`Cj7vTw~ z6AxNJpVK~7b~9ehQqxfdGrz@3T((9)P|yJ%Ks1lbr@{y#sOcu}X!@`@>98DdW%eA^ z@LIjgX|@w2L?09B!TLd<&kN_;p^Y?wk7K9CEpZg+QjixTHrym8U8ghVY4KXy$$G9l zo1?@+0lpG`@6mm~Qri9l6nyK=qB$fTpGDC_#>%O`n@%^^()&Yejl{2UE_62YXin)o zJ_`NR1%a1?4}gkS7nJ6N%H$JNJ;w``&P0O<27xzy!->bE16bfigQunp@9B3-sK9c) z6ZR4RYIE5V*q;xhFQn;L(p2zByRarGGt+>-O=%WrXVxZEbOhwgP$N>6C(zLMp4-?b z^sHPO-u?lw`Jh>y9#E#>(Zh#8L4b1$(X6~hnIiFOonp;GjcYSv6Pyql1_q03pwv`X zI4(S61NsFpdI^E0N9PN66khi6;LjUp!64>eQ!dP%Sm4Epc7*;`-c}suuc&H^SInRj z4_3=m6e2M!m|zgu&F^0wqdmpaD{C;yG=M7skC6Mm*?@9!o!F>$k&Ff>~6-!)zF5mqY5nTQG2Pr_b#!8n8>f#H3gF{H{ElS|!nzd#25@`}i!6 zYu|t`k0Y|@Y>XhjcB|7xhgx*!C!py3Mb2E35^O z%MDHBhQ6+~z%^X4`9(APW)HV3dNcdQ7L8a+ylMPe9@ckhK6AbpxopQe5e|;uW)(oa zHQ)p=I;NFe>{j5Yx30v*$N+zTAZw!Y@}&X|u#`R?v4R(V{R*gISwW`^OXEwjS9(G7 zb2xcg?`+?C1xMmjM*5uuA1hQ=vcm;z9=CZC^leIca>UlO9(eP-I${!9$++@(vH2r; zvs>>slfB%&@siw-aDC5!lJv z#RMS#VJKuJg90$w!c3bbS1|2$9#`C8P7T3xG01l{-*V{coh=yceB>@p*(vjtw0Wm+ z+E9OTD!U-G3!I?R=v+g0`VCFP<{@oUPUwlTClNkjW?)61KMWy`&@CSS@&$CDd{i?fP zM|b8!4qQdc2$KFeheS&bv>DUI3sF%5uiCqnmygeLLFg1h-Hpu&jv&hPsZnN2<8qe> zMpCh`3@rPslj{TT$?28|+au6{m5s2Y>;o+9J37jk3)WuQmMZ+nhZ{}wMbg{ekY6YF z>7p!{gCR93Bq~grXX4V)f%F0pkWW)EFI=pmShygnb2gRAcxPu$Qym#S-5fHXb>|rZ z_W{YfN4oHm6|`3||B|)QVaB4c&h9wp)5_?N7jIQtfIL|ch#K9@!wBKIoMp6*Oqs8o zjsB-H?s!)r0Q@S9MH>LP%Bdyq&o#! z$j!z&A490IqZhe4yT%Q1sMqMP)Zz!}3kJ2lk9!}D#c7Pi?f;fCpPY01Uag^}nZF(j zwtKRxGskV5K6}Eqn^#a$G@YQ@d~{~){f}62X)#a&xI<&?$@gjB)iQZ6uZ$jI#bY#e z6%BoD4Q~c(0vF1#l*1zEG+l&Vopn`CJf8JJ5t~f*WD#|o#@0ni0^j$}*TCF90$~$N zaY!jxR3OLc*qj%dbziuD(CPqV~eXC-(W4O+W zm*KP?>WviV#v)cC%c0kbs`cJ%4+?x@`g@fyCufR2h>%5@vBgruHrz5Pzuna1OrWMbTasb=0OG|XVo3%r{7vTp6KR=d{} z0S@>najQfgTc?vZ(hUn;{QAUR<+q;V05=RGA^?^Y#3U@SwV!oe*w$PzH8G4B7jeTj zGk@&jIAK-xjVf+FpCHzu$kB7+3TWM+*7S4ESQjqkuy(Vn!^4mnp8k1f!-C9TudAYV zoCfAtRc3ONL|IKa_3K9K^w0g92BV?@?iF7rc!E!{n2!8S1ABASpJgz%C zu}7{=Y^x_)A!IHc6YO!r+9gy!pY*F42&guMeeWOtgQvPD4E)nVvcSLR4PMIFjaZ9; z)9%BQj3QQHaqc3G3yv%wvlzlW=E6~DDcq*)^WP~B5c=&>+zY7ikNfehd+x#E?={k1 zYjT_s0WzeO!(ZE!sP3^}(Rlr<*SXs7Gz)u;t@&njSp3h2EvjS24wV1Vf!%UHq+&I& zk8zq{&qWyXCBLBp`NuPb*54h@$wzhZ4XT6jWm*uoY#A2*> zsyMJ#r}cM+|8xW5TXObW_E&a+eG-Usz5!~Q=oCejB#g;P znE-;*gshu5Z0BQxcM7LeYJW9vEBrRMXpG{=@z{GL1oC|;ulZN-M8^x^94zcX!yJ|c zY4M~bft56QWMQUj2!?1;smLAtyY5fI>DV%pzNw?pU++%L-g>JqwWp1GgPH^~LwtUV%x zP;X=53j1L4DQ4rvTM1DBu7ZesIGg}%4R~z2?%sv=YxdHn(0n&p!2E@=lL$)P11huv zziSouA<$`@A~>H=s;d>%U}_W@=P``<0VoPUcKeBcCHT7g;8|D%K8Q%aM$X4YxOHWn z8hY=Hp;Yt0&{o4km&g1r4)Tw)v&cg;2O2^yR_2 zazD2c1v~#ln#5G0w!c^70mv0e zdw>7y_2FI51I#C^z5+C@W>u~vwrO30ugk;im1%wsE?}mMY05!jyJbd0yN~DJrfIr} z7@)NG-upbh(8%3_kwYu}koa{Emk>V~I<3{bQn9ro*^u>is`u*QG)Z~QKyhJzRSkh# z{Ylie2%u#^pdVVmqf+wq9Zf%+mU!orATVde^|j}dZ*7NxUDaTN<#m6X?y!{7hqKAr z@;mDp&muvdFS??_zaD%9Z6#ehq?*Li0AP_)DJ)`G8bal;q+K|gd!`Zo zKGBs$xpaYrPjlOuWX#3(5As~K>FLo3s_VbB3ue)nE;6@A1QS-3&*_fnS#yHBA4kN= zE7uS`iM=R-;0U?t^(GX@cFEj1HlIXFciK@;;Inr7ss)xJWBSr<`jQHKkq!w201NlMLV)`_wuEXpAKLelN?RLvdgvx&ZAhzT0OH(@@Np{Wa55y^#yBm8 zIX4-U4lAF|ve7}UCPFP2IWe@*(@9S`SVe+h3<}x3nLIVmU!gksO-KnoY%|-QbM+Fd zb|E3%clDW{_1N(&EFNJHa6HPA&MJj($d%zQd=PQQyMP?#FRv=jr&j!2^qdH_#=u|X zZY)mRup&z;nbJl+$F8TZy#bQR%vBME57;k-0`5F<@$8Mnqc7jxJ;T?PvEM7?DB-?^@ap)) z)}EJ}V50hZ1F!Asl44I0b6HB+CMSqkCZdj@?n><5HDrCROEBL3%|4)0<)@O>By2r0 zjKj#NiOm}|Mh+QhqU5cp_->(amrshMGKD|%UTAQrKw&*5t2hWlRO3VkP=-oS?cH9} z@1>Nrp+eR)$gyID!(|o~_;TaOdV$9c2dSUAIyI_oXHMRF(FH8z5c$dA^m#~J}32NZpsD`l5s?JW@0`0t`e0L4{ z4CQK8&6_WRIu+Moz62hT$O6^_x=CrVk+@haS(h>>7MER>Ru*`ex9I4-^R4z7-SF5N zOW3sR3&xVGAqyN#da?olDG8O|yxWpVY(lXb3MkgJ>AS$p38lC>j<~sMO`5Tvqc{Ny zpR6z#m5A2cOUP~YdR~nnG3Z~x)rZuh`c0j7)AOA5Z2{c3@%23tjaPr9I=pjpNqsNg zc*1{UTJ-%Xqk;4?@GWS*b3n*Un8tHttYDl(Q5Fvd6pKR z&JkSMxS2RyzEj*K4!0hj>;9{{vv^H&U=2*cEE>d=Xixy-JEh;4J<_gc**4lp2ItdkYqrpQ{85BgH&^)R!03JCZiVxv1J$ z{<6^lFYlJODMf)*=rLRy5P!)C7BuB1`$f8bAq7J#K(J8ygh zN`D@bua=A%m+<1*%VxVFD%iy@+kL!7xTSZ5F?W6x6)j2KPpA2#&OHHjjkL1Xn?v%1 z&ApY9%T)lq>S)vuU)+$2Ywt}v*_&`|RNG{E13yj|0(8~C2PiVu>yT+(F0=eFLxhtRqC6~<@e`LsW`6Z+H=&Ia78}NWbt;(^&laT`^ps=;ah$u$05F)hH;vMHcGrS#OR>h<+;(fdpKvd znig;8J7n^AL4``wT{*-{weg=p*N?<}JaH>PA9@AC(Es9hE(K1aC7=%xPoZucH?+!{ zRzB@!$~|*g8Py&_Ov=lz7BT9tC-JVE-ndNMZo~B&`CgCtu&pXQi8kI%x!U-eXJP(8 zLOh3ApWAvl+tdElmJ+9Rgo)D-i!yiRQ)$_*L;Y2Xc{=cP!d4!=ENj-KyjW@P`~nd{ z9%ivXaxKTpLL)$GioSz9{WtWzmVR?1gxfg(5jOBne|N*j4C;R!_jbTdy5k z-N<(5SbuOPkQBJg4XkD4(PvEW*G6)p%)4?c%BH{7Hj?{#W@)8{Op$40=6Pp5**YDc za>hSv56lEDvG#8p;xSW3*qrf%DnQD#r4dZ9d#i|lLg`?3fSID}4Gr7Z_Zr?7ok+x0 z-REb3IuZc(yMgLJvXkQkns9HK`&VO!ho7?d%IVG6BMedabRpe>G<0E_elHy!<>@$K z*Il%pa|HuJgHi)wSIg1kYTDj7vHn=9h_FQ#_^_%*KlOT}GP}ZdexW3J4e$7Qc-|yzj z52P!*Z09=wH-G)HXZ$ zLlA;HX_U+rFjyX+xslatZ0t@ma^z{P+V6lTTmFKlYVJaiveQlsBs&Bj=lxc*|LBc0 zxjn*c@c+ZJ4j+%WU+u^klH;@PLCqx==^;Gg%jDV1fB3Ql%%cgj>~dE_(A;tw)qp*@ zdKkjsvLIUYde;Hn^tY{SW%nuof~{|M0b&0IP)rY!#vTyi0nttpqJhXlSLIRNK5ER{ zKUje1O8b8DHxlJK!N$`8wSFG|(8wLy$o>qN$$w7)QsU#}CKK=LpWodI_BV&bfz~LV z7X4n@QQU3|T?2v}hKT6Nqh39D{uS_20xr~R_R4cov`c2Ri_|9}>}Q%Tw`=NG_DU`= z_R`rZjMfd{B7p4>_I=5kEPJ`oeqNe%GZ`>Tv{+I2j6E5)@mF%>RJpc7ar~P-%YH#u zaXPs`RKR~wEc6z#a`sh)lM;ZhW&L4jiFl6Pqf!tz1si*f+({cK)!q{nQSxQ6dmV44 zt#-uLzpiOya@x*no1@w_aaw4f>7h@98Pudp0%%y2OGysG-6d;65slgYWj{cOwY2!C znzpof^TbvnBzgEZ#(BW!ZATBWiG~L#E&XL5+N{4{{pN0(;nPEEFdc_f*yAqPt+miu zR2XcdPk-iY!H(|d+(E|h02&EpkIVMkgf?@y;|y*^v3iAB>x2#023HJ8`b4hurRT@A zc=6LfF;U|m&sK7z`ddg1l9yLiOMDFbe*xAf(AnSHqq^V5{((7(!YzE9bk89)W~=#* zo-%w=HdI5DT2PZI*GAi!gX*rZ;QEsveaJ#so@}lruMOD_4a!~t{iXKp`wCBK4LQN@ z8h@qc6qkZgB*I1vWl<<0Qw*Z>gU&Ze{&f#vQ zox2)auKXTJ*KD3IF-)Q7R*$DNYUxo`0-335k=mZmQR**rQEZABSNZAML>66-_{i}7 zDCOIRx@*j&My%4HwF|9P^LF<3$9h9~eYR3IPUn{RlE^&NUAz%WDlsS{<}WqeJX#pm zAn5vT)~!pwaeVfV9T_DVmY}z>1%tFH4rywW<;_w~94sP70XonR)B7K)dFNu-!0mlm z1C>GUMDTlkHhBD1ppVnz_j8RQxV=wEZ5_XI;z0|)M&m=;G2AgBI94~m} zeA?%0!T;f>0pNyf_&sKSa{ROi@ei<{CT>GuGMVs2RSUpkmF&(}FVzBKxw2jZy#z)d zLFP(UldWqAx#droo&YgZ7wBo3j+x-AIRO3}pyIU@N%={bc~I~EdToZq@tH%ZF8xLz z=gHfQQdZC7Ir^3(Yl92Pf9DI+T}{@cx(DI3E%isil(Td{iI=nH*G#xJ=2_)@<_+RV zu@m%=A2IznXQ~U@cZ4^MoBUu5;5iCW{IVCELu?{dJBq^;Tk|uDNyC#z)oN=X;z z=}ojUO@l4}D8I{oO(Z9SS>PFe!Af|9l}%@|a~b6~D7Y??8ew$TkeMv#=uJn?ZtsXb z(=5Ief@f9B_16s@wZH+UcM!a9iB@k>!C|&2AVizc85x^qS&=lu8dkPUrgiGJ-CbpC z+|TT0yYFiR-Sc{DaH>}s!tU7o0mqK&jBz@DaY(@C-gALfV^V#x(UbkjUgQL;gsiop z-814fR};_MG=%v`i~_qIvT)?kGD5jS5WX9|{R_Wu3ctGqx6ZJq@>cvFNq=4j0wc|r ztoD;bupJo!x`+HxH`*yqiFKR4sZc&0Y?{&^3q3}M@8U3Tt zp?i#-H(`y~)oP;j78m6i<$oV2@FnN+=|aP9f^oQ1OAtEkR+e72HHH+Xi%v6@9mo{ue^NTxXk(PiUsc|!~wq)ja*5j#6o)J#F zGIR$Y*X=*Kv5}Qo4UKJNt5iYIshnCH6jMTrGr)9E5^QYZzDP}X@pCaRm^(Nde5D+5 zwRQV_SGi?=vt{XLesh~3zn)W3US#~zuQa&spw|>0Whnk1)Job*!mQ{qta45cf5<6C zMt^%fSEsaIeSRdbB)0<8%Ehzhxxj$pz*(CWhPF>m%VC2Ti%^`F6qs?0+9lg-mArK2 zHU0z1y($a}FW97Ba#A$nXld#w7VRp%;Ur1kQrfZE-A(^K0&A%v_UL$1O+PsZ?e@@-JMak_^hwk0613^2l_KVK;|#Zgr)>K>+Q8E@gRUx4t4*RtFHBD zDvxHB6D0wN|K(~Jo{Ng31yx7KNBeTlPtrxLMKsn*%|C{c&q`Vg7cHyo; z`@A!}Msx6{+g_9>ssp9eK(&TI^r9`_>5*=E2YF1R@SnT7{%9(WLYH_2tc4rko(sy$ z(gg$2vxEHQr$%|{W2=W-I1*<~ibA}l#SPs`d$#I80fcqb%zb$Vv#;3}#kabG3m>PX zELE0?65kcQKWxZvPY60S)ZoD@N;=b*lvzmI;5y$?v-2_r94+GvP?Fw&?jQX!R_+FH z3IOetX_r!NJ;0!=2}P-AA|qgY890~2jC>~=TOR>;u0RB5{l`pSYYwf1yC$mqJE#Jr zfUM~oEZNygqeIHuGZ0QqNxM}^e6sDN-f=^SS~6dZ5bHB1X3u`#F>ShyO!{M=^1@5r<20B|DX%G%CTzB1KKYtxv zUq57efh*E3K{MBdkv+eE_mX3b)R%b0IPGijd*5bPWo!KUU}M&Am=e};hfJa{F;8D8PWYed|PFMG9@|+gqL@_H7TM3|| znw)X46Ihz98SX=Wv)%xqzbij+U3}0Z$v>E0(oQD^#a^MUG(tHNsPA*6s8?eQ zFA2b{O{~+i_p*#_pLlu?3zJauC3I0L9)3^1+M4VDoZZ!l|MK-4a=&)FC$*zQjTAbZ z`cOZU_o6AeVnXK$X@#~;2AAb^=5j>~K8Z~QM@6R@UxIHj#EoRl z?{RwNaJ9n|wjJDhYaY+0W}ZcNRk(bG22ZWJf}VX|VzK({$Ul)YKrywiFYn?3o6*3K z#Fs}_cf{8kyyeoWc!D91nB0p$FXdGa9Bys$2gbrte@+m+Pf{#C@4L1$*5I#!#quss zLFaf`2AoVnGw5w&95n_`9Pme~JFX7xIr%7yN{K|PM&Bfx_|yP%{4ElL`lVVBygY%2 zNY21TpRdID%*%L)_j{w2{SH77IvVNNA0SOSB_|p}mrUv-cu_DYB6P#Wy;+6jTO=dP zuZ0&AS7=7P2|Z22HS&83tJ(TD{Yze^^iTuMOq@FE+VhZjvy%q+h+z z-2hsJ3eAuNV8z@LqPVGPX3j;)h$%cGwVQ6;rPu=~()n`isP~$#Sw=*1p@u>mO zC^BZ?+LrT46JNN@@MbY+5|FOtcLh-~rG}YQ;47m4VI4Cq*(m|S(Wxf$8Q}e9%#S4_ zOxyR+5UUC8q~S(wOAb8~lgzVXV4k)Q?@l{U#vR%YF@14vn(|E=c+a=04|3t-HM);@Y zx3ON-P5>P0dl2@5vT@@zB`>{_$$(*Jm>U~)jRl1h-0cOU)#7yLDNmjD0& literal 44895 zcmd42WmH^E8!Z?@aEIW~NP^Q4Ab1182?Tey;O;aUBtUR?ch^AU65Im>cWDR?jr;Wb ze&5`=Ywn*rv*ySA=+&prI;T#ZI#o~Yy`Nn_loX_~(84(#51$(1;}PHVz_Eobe#bX}W7uJYA?WE!A$I zU-Nsgi!+J(vJyxza@bcmQh>&sta4+9$mVw(;@>1=vLpq1RC?B;o<{6&5@?zO zxGZ<_c$}_Ds;J->D`bUBQ~9bD?uOcJPsub*%J<=-c@mu#_sou<_b=m1;KG=Wpx_t+5c!Jb-{&d#U&ux%?BfSZMZVIno@Y(D7#64f( zu7nib)Vpgh`^_CK)FGaB+!*u(PBtNOnEp;!fQlfS4wUxZELd;HNSox`wzZHrux$Y? z8{_V-jC#?EbibvqVc%*No`<(;6flpp%e6U)3Ev6SIk@_<%KG3da(k(ixi-y)muaYRNsP3qC} zHRKwl)>RWkyfgaRDw$e8F~+RPJJ=ZB`SnEJz{SIDyq*z(7}h2qNrR?#|E*@rCRL{S zR@rR-itEeEzP=v>PJ0uSan=a_I4wE9+leq04_{b05xwe6ht@?B&i^Dl`sPuvV9I=I z!4x;s?_ozSf_QXa-QzL(4{3te&yth;fIFu7{_F<}92zq}AIg#r8_mIE9R^2kaq}5z z!)x@QNQ zZ|d6b(`81^%YGTyUUdYbf=~>dd_3h+aG04RNY>yF&c zOlo?~pS=F&dkKJuz2-bP8gbrf%w35za761)bVl-kqFDQqebm~kknxcQlt|OA}GoF@ZZr{(#`sMI#c$sP7 zh=OAZ9(GsUJ_rs{b{LqTRjx#^+O2aPU7g3xtM)h$3hvrc-L;ERs8%;m-c<7PZfpCD zH(3N_>Q`T|xqmWG@|o~>7FJn*xc@j_H@j?GIN$cnzo%mcSympKV0~9?~z6h*OSeXw3uZY=T;S604 zz1XF&mV4*Q0K}bHZa2fr zL!o0M@2c#_x2oib+4LCC%y7M|rkefYp3E}zdrk?Af;sr&DFbNNtPsst) zi4{I1^HDls+P{BKlFp|v4{BNY8c~U@74enZ^xx`UD%bxGcV#6bS8C2%(gv1)S27ryF1|l zsH|hhK4=*WJho`_z`s*(i7`Bx56lu@ORrx%^!1KP+4L;WL0NK6e4BReor4rn;Tu~$ zcj0U>{vbTrI&em6eY-N&VK>+8_td&_F9L>rRjXw5KmIv(Zq`2Z`WGTmpu!s25~Ym< z%U@bO>vI4G4xs|8pTWBl>1`7ioFbdG@JG||R##((=DOq-QSrG-S&gw*==8)ub$uIhz-P0?(SX6`1!i`zY@CmxCgZSOaWjEcQE}|`}Wz9T&^v&2W)dTde&!in;1h|WgWu1Zy zlUhreCp@It-7{IbDtG2N`Tbf9BchHxy$Y)oLM?PK<8_rR#z=yR zCe?bl^8G%qUU5w?Udv8v6rP75H0{srr0`#NTbRReA5VEm?JnU;{x4!dkP(=07MtJcY7?#jGe*AT;`&l|h=#Ny-yJ{*DbE6J*atJ?Nx( zQV*tfa@td^Df8iwBT(pUIFL)j4=_`Ea&Uw$%2#&PX)s0_-Mwk4Nc3)W zR^wp9*NF!KPq@D4Zw%6dS(rne3U3lyesEF}=#^cYBr`Bg^O3H%ul32JRYQ zto=#@)DlB)Q&7oQern<(t?~d|71B77>gwv8<=i@_UwZpXawNE&$O>OTs`lSkd=1ie zRpu+I5(+rHenQ#6>d$w}CL0e2+(iX-!s_n{+P-FV&jePGl9n=ha5JC&Mn4(X_RVCB z*>gaw=VIAr@|fbZbteQj@vHiwI|3pdfA9341ZFoj}qD-hZ z1<3p{vwF;E`2NIkqqFz4M1<*Z%&SM+tvm8j|2WC*o_y`LrJyTVQce@YjI9pmFGc55 zyPHgd|85x3&B&G;?+G^Kb=RZ#6K>OO9x%EnZM$rv>g{$WruD!B#;$}ya7CCv9A zw~QtmP7di#-csf~rgsnD-`&pv0cz^i7^zRw-OO7H5uW8;3+~UB1b1XQ^64$o6lva7 zz>cQxj^5*%={L8Gcf~YF%agt#b}T7(CC~Uo@2o$(&oQ-czmc!KG%$wRe`r4`UfsOg zrm{9^M$r^+tjS}?wRwsP+CBVUrv$+2yRPU;PzM_2<>k%6u|bi#dMCZUKE#7*s@1;z zco(94XHwDb5NT+0Y}2n>`SYsyZtzS`OarPYaR;X8@-7R)aO!k<^kH|DvoN0UXc4Xm z;!K+|@4QUoU&o8|Pd?#nzgdhm6taG9+?f9yu}|%O1bwBg(s>K3ht4lKw+x*6D(?+- z*r_^q%^_9Wj5+8UG}$d{e1m@mUH&dX7%lQXRnbROc7XOfh#Cxh$j-w%MsA0yG+xK- ze?PfUG})W4FvCvPSAFK;$no;ExET%6l@;Ly(@1Yf1 z_d$nRAy7KTL9(5fpp{G53K_gHPHx)OTG1850(>)93r9ZlY&9b#6uzXi^4ZDKp7}Z<;hxJ9NN4GBcbAy*7z;cwFC$3e9#^#2ML4&kd7))VNar4~K09GZ ze_!P;c9b+#pz`V&^Gi`tDDLQ=K{f4V*)OOxO`if7XxwA6@(*}@qdP|kDu&eCIAu|3 z+<);*p1%)XK_mj58L3jD)}eQ3qS9P{e%3kqD}&Qc8%$E6-`4bab9=rGGlVNKI|hX% zC8`k&|Hw6{by(;iw11Aml>cfvm+PVmATr0jp? zoIZNSGgf4?_0#~Y<(Ix3fBRp=b`+6*o*|%>ffy?G0aPXfH5?(n1D{(0zn6rrWH}Cr zi-$eVNnBf9u8}j{-Qb0mEgX<^)qvqqVQJjyXJsO)>PHM4sWQT^h(4W6cwPRh#lcxh zFTMHS1hm%kkkWbmDGMN<=Uzfk1vQp;y;YE4uO8N4o;6u}EE4GD&z^493*fYimJZ?! z9WkEDmvlC0>sxz4c~LNeSB#j9^HAsi;@&4QF~|T&k}S@j-MEmKd3>_@3Eof;nDHtV z@mul0#S@p6dZmMJKs*_1C$m!1srmBtboMFC@PY7t7Pw_+f5uOAEfB*2ytP@Rx_EdA z^F?|05rNTLp6Vxr9h|$E+dqR4Gk+SWxC$#fE02*Po_9_Mp>S+pIH961Y1I2M{cb=y zcx)hFUmG)C1_n;hjN)<4r+=%DB@CN|COqtCd8`@N#05PLGbZ=>YK8GLcD-VJ(YujSitbNO zDPi6jaD?~3hK(@?5G523)1fsH7>Gvy6_0W(BnKel*|+XGGqn0iu@dE9t+jJ)rMux7 zlB%M&Ru4E&Gs%DN{pghFs}@Ndy2X~W(%`Y~OHAc^8JDUOs3fefhOqI|YNpoj$*Z}g z#dx~#bE$eoaw;MmP$D8AAXqN_Wa6=1px#Ro={~~8i1f@Yq~fgefWEo3r3&i>(i;zZ z$Lu{JHRZB7^xUK5#}7{e-`gz(i$nSfg}_H>iNJRQ>U6tq9N-#-;|PbCjz9=9^v=n{ z!Jf`|rda%lkgo7+{pXD|7e?f=D`aC6H;fXKMVxc(!w4Ax`<9H@*m&!W?f?=FlQ-F( zTWE3lBm%CCAvjcQ#V6xa1=7$BP8u47)mArgN5|R~*s!jE#YE;0fRLBb=~_oBpA#)7 zXJpsLqR4fgpUb-tzof8M-@xD9Y`QjRoA$I%zuZ8FN7|8b3^a5ZaQfcbMtI?#EZ(NL z8riCDi#WGUuarSdV{(xED%8~K zi0#PaBKe@kqWnz^+UBiqO8hg!LmSYXiJnBCcVGnYOklDIf~IF3YY9!LH=I0!p*z2bQe3);Lk~umj8j{oT2!)^DSCP616X$;(vVa(b!r`V^7DZ}ycvpAhh3S5zG=btb0sL#vmvV4v>Za75 zIygs4yoqC@@cnV5YKH@1v#Y^HP8er#-Ht;`pa)S(6SAwzkXjL%NUq{Mi)MCce0!5o zC;tcB=H73-e|CRnSTJm{-|8~6Jpii$sFSXChMPd^+zt-;4IG|>Q-L7@f`0p{UB+^k*WJ`59UEwZP5bD%}pZ4S` z$Lc-beZ`{Ze-7U~)*aa&*KLv*j4?S^*&rKJXVHRKrLOM35w>2J)id0U`eDN!W>;Sv zDe_@AipcWh1%<8n<$bm4MKHtUgDM%DJ@I^Xhj8nwc_4po<>BCMp%|)pV)WaC>vv+uB!PMV_U@>!HkRol0Qg``^*6e*8v?ln4^5yP+fGi_nXlRK z@zk-btloKNVF7$U@JG+nJ*uJhYy}YF&SkCt?U`T1-kt${uo>=duMug?U*S%mI6pkQ zwq(i)t<2uP#WOKP?;|TXgj`e*jLnKaafoPUDWMc3`=d>vz%eycsSM40O*$J;DGP9pU9kU|6(;xTzCIA)vq-|ei4fuY)Vfw zbR8^do)ygyfH+cbQ9G2T@Pn4#8s0uf)YY7CSFSmhQ~2kMvHxyNa(=vffDF#_{ytnT zx|Qi9pI3RBz-Vk|xa*Q${b1+Lka=4wq%&Oe*~L>)F9O5F8;!}H2Lt5fPUI&uZ`^G$ z8>R4EPvsXfM?AkB!F8mcGf&>-^-9>v7jx!*qPK_qsLw2kfXY5wC}NZrBip&}-Le$T zLHzCjfJiC2ybTNS=~rZm;9K-Aeo{wrZaf&_D}bBw^9~hXp+O|O*_P5YsX^eZ8RPy4 ztu+9wq;fffq2|6+TxS@F}j81)QxD%__I7r{%HofR>QBR!pWjCAuR56;8;{$iX5{v5?&i|{qJ>P_ zN#`reI)4UB7S4#qe)pesHsfy-EO<$B3Vs-RG)IpAW7-{mdw%NfhV3OE$!p6%&I$R_ zm%Bc)RW-c2v!F6Qxn60V-L8EBxcamTV>lno%ecP>T`1xAl~B_3Pq+s#G`RQhBw9T% ztz53p-G+9nEL}~PG+de7ca^?zu@gA>aDS` zY3CgI%ooarT{&h%n3zc|vygB}#oY1NpgjqUMhF08SA2JZi$>0J7EZ`n#q+MPJeR!* z7?vbh$hz#S<+nZNoeg^;s?)(vmTa*{&Y7DN`9~)Z#w^+S^DS3u%kvx8RbR~0sRP8R z$2xs2Bc2nA;N+O&0iP-KG&w}WcITT{8s@2EDc98dU9z>F%v!2!*d|F9;-#p zq*ru3>$Vyk@%Uk83ES^l8ztu(K&((jf7}M3XW5JWk;a8XR*Zslajt3CsrDI=(=jE6 znyu$H7PjqguKV78_g$-zLLE(qoN@v*?-|(h|aQ4P^Y@j2!>2-A$m#bl_+d1nqPs{9S3&Y56-3rpmH`LmR zF)8-bGQNueknIn{h?+-Cgwk0vP;7QDfmuab4Rzr)L8RddI>*kgh5r_vMI|EWi@UzSm~6M%fWX7`x=wKv{9=}hLX z6^0KXs{Ul1WpMjRZ|j|ikm+HH%!doQcy-QF$72c%CssAiNuhvxbwQ)LG&jGqY14oE z-X3tlzVd2>$O%cc%$5k_cb^0ve-2(wMKtTf07ajK;-`xj9+Q!DqYzUZFO;SXOkegqWf ze6;!Ml z5pEsBX9dh15Gq~IaX+%qWArWElqUWFs(KgrUhtk@MH!&3ek3;NSL4Mq85w{_AD&lT zGIrvl zE`fKIlzBn6o*0CDXYX$#%RD{M=#r?Azil`nufJ*wB65hrD&BqEBAZ{1GqW zQg)o9H2V8#DvHO3CzMD@0g3DI?V|HAWJO+v#lhH5+t9V#8~J>6K|oSPIZVizaH1vy z+~mB7V5yctSH900%k*UXq$g^4#p4$1FaPWHSUs;3hj?IMk)?OR9@ z+KcGkagg545~mw7xAcA=>L_pr%=Ftkv83*ms|kDMgl%y4F~(Ust}~7;mFLz+^Xjf| z^a%n8x~#6?v<7!(jn$*z+VA?x+Ai*Du(MC59QGPVjE|nrSghFGo!Q?-6ikNCtQYbO z43`!V0qG~{;X;Q6u(Ynapq%o#WMi}!FWo${k?>(!i{i&1ya%OLecVb0WZ>MXGgUqbi?Iei0j%Kl0~$NB0iPOWGMDqNVVyz4_$ z)G4p|%6snn0;#<<;SILsV1)Q6i~utJ0yiPo3570*@~+65y-gstGgjJBV|;hdGNy(qzOGHo6n%Qh1B8Z{Nm zCs}q*8-m}w?_=xFEipMiKddpmWao`svw`@LhMy#0Z%4%fWuHYnj0TI@H+{WG&7bmo z4YPYZ1YL3~GL4>#X`>1nymD_mJkA679Cr33tMA?b^5gjhD%g>$$^)kk9`$XrY(h56 z8rS#k2tw|Xye}S}J#EeJUtVEv zf1DG`o4pNQEpRoE_WH>D>JN@NqGtwGj!DWlr&Zx!O~mvh{@ESgzn2>v(`$97M0Z)10=$Lm|H&@^5kI|W-N!F$HD2JZN#_oB?o$WEBHP1> z`ITkk_RO^7k8KL7lFHRB$Ive`<2$C`Gv-Q)2NmKEOwGskniq=51GxjjoP-Uk)2_~4 zIf|0Jwduw!*YBEsDATQuU5{FssP%J_)Xc0nXBJ(0cSHE+?_IW+ZJj#OpETg`lUvwt z_c{vxI)tOShQC~k%>gw1OhQ7dM8ND~hG5#8;r`UlyYVbc(6}Y;e&iyjy3{CRP~GD$ z7yZTf?y#vpkiCFYf6hmHcX~X>j7v zKadD+fw!@|gh>u_zh(`-ZKaz|?o;P9g3%K}DJPUF*@=hApW;)X< zQ&9oWU)@$GGHs-zGTvMwLHhmQ3o;VeUlfkPZzU1R?~-?~;xKQ|1d;1;G?-Rv9Q~19Ai95Tmcuda_^}wAj z`0YD#{cX60+jnAFbFPZQ5rHcfj`2U~wf{BZiNa;%f2Civ|M$}G|7TTEEKoytb{JKI zacTPo21fjagoL17!MOQ^1O)G1u3)hE7yS4fl_FWD0EU7>xJvzria9v8eMOGasjj$y zk=9bn5n$_I?#PS{^8KTK=8nt;a?G( zNBn=QEBd`OA7IeYeiE8O#;fCH%}7Ej-L+W-HzXR#(Y3>{{ML%q#l#Lm577Dfe%Q{nf-wk%(V_N$die}`o{G#>dprIgCd+) z#00-r{R&AyKtQU18}su`*URRl$V*?n*{B4Y*idiu0lFA~4bH{51yk1wI33nN z4R>P^{nJJkV{+Jmnq?{@QS7#7mlr__JIxlh4=0Mh%V@fXrNtg{uDN#nDPo@Qrg_+y@mR+(<{D6t+(FHvFmrHK<8!qgNR z9|Qe`J2u+XC|(w|^M%>fvUaQ;6e=MOET+D#`(ZwM013bqlyZZ2!_KCu-6tzH9ICN3 z3CcF4&CZ%%Gd(_xg|5<}wBI~>Q2NeDRIF$S^| z7QVy~Cy3uGlQDZu>P$ovJc91zgo`V&()L;b_P2Q*TCF<8OIh}byjXd{`W#Q)2wzSQ zDs2f)tu3JGhDEJxz1PIt28u531fKK^45L-V>g8&9Oau3q`#~blx8h$2$6A6dk0c51 z*hGXsP9;gxanxw(bw;xgGUt}3j>#P)^XYjUMNHVUdK?h3#t4R%A158}hDj4$ z7eo6rrNr%Tomg8hG7}@g4*aTozW~z^L*CU zlo5IpgQFVw1#Ix~gSuaP6YzGXq3FPPJpIy!N+r zxNoS@w}g6mD+cTyi|kz$1O^ezYbhj_dCoTROY1KkrjDZ>Sb z^}C73yk|0-e(P^4qPsG+PFjVMjKc}pej<6zS)wOR&+SX7wI+#!nNeC|HD8f#1SIzF z#gEswp_<>(W83cE*HO<&9<4LzST|dol&o*0-Rd-=$qQ|@3Dh=3r@3!zXzu}I0_;JQV zlSO%IFRYVt2&Tn-e{*k(zo%mXhL{>QQS8>ej%D53MyzMs$5l&~(`_%0T z)ti_k{fG{}*1WD2K)%U>5tU8?1 zH%-U(>5A-~SUWw1PoG-c4mEyY3GkP*lvYzqPOcrIy7auK`hqBHgQ%7^ffM8{ZB!bw z6g6H%^YO!5>+O7vae?YEtuw@Fu+oq&o}?VD16q~g4VW*{WM*HmmS#$fngyj5<4jy2 zhH#d%52VUU9j%VIwNQkb+&(3nBFN>?7)3JDHYd6EQ;8MzroZAC{MQ0cbnO6`juMe|l%aYKKyg!um9DK0E7&I>HC;>|C{gni<7J4k%g z6gnR_urw4?(vRbXM=fKJjGKh0CvuTd)(x`j%z7pl_FutQ<|ZJb5-Hk3zgqel=XWs{ zBK~}DJk;$cNK+6}kWCNr+xGoJKTzk<=G*Zp6B&TA13)7e*tMM4&f3)xrG zUcx4{bbe`Xb7<*z9uIyRYfFZ|?PAS-vZ19j&@pHHl+6PH%(!+6NsW?nXx}UfP2XR6 zYn6xFMNIt+XSe9*8DUKlJ(3rlV5uroEs^!Tzl{4QbN2Lb+7%ChKrTnwyTV#p?AF?~ z0k#1L=phH_DiX3{luny>DVMz+zxQ3^3knMShK7gnT+nHy4HPIb7k-k=%h_ImclwBOjC(=A*kbK)XL9 zh!mfx|K45fjZSVp95qb-E>~xv5b}C^goqR)d|#S5K$W3FQl|S+-+WJDGjlipfyGCM zl-pTdk9)GlMz&1_QMM+z1>@Sq(8$57;alUXj`}Kv^7f@cL2`%-nr>fK8T}zo2SG9< zQ)`trJ{;KYp=4LAT$J5At2gf(hl1um#KC7) z|DI^+J9O!pe%n7Pmc^sm35pq-8O8Fvi9mY!xugmoEIVODVW89%=3V3kCsB&ow#k=b zZDCDP$v*q)^FMyE?YCPI&gm5uEM8X!bR~@r>i|L)jl>y@0+qXp5H`-c^LMf-s_MMF zf4gg-_!knulbu4u>8+igZ!{VYPNCbY`rPH=C(ILQ0D0!x$|YzLTVwe_zgF?84%h_B z^yDoIwha^1H1O9a-l-Ob;xRoUGS71x90f7nM4_o~&S@W;s4}hwDM(rQ2x@auTpXRg z!+HJOGhM08#joYPn`W_tlN^MC6W($ib%0JdOIUcDxFZm_03ibE4Eck#Ms+_yf8-Ca zNcaV`(d`P$003nR_`ZY+SrIo*K&jiTrhVwt+SjZ{`{g&yOp_?@-PyY?%1itD`iA^Z zp zhJ*h-L0Z_OVd<5>PbAEeSnP=4pG5*!3_x)MJbS#|j-fih!50g2gMZH8Sd>uxmHz^M zfY1MGQ<10>QTTzYatY`gWWo~*pXi10(V2MP-18NgV8Q(^bSXeYMKPISRkZ*HrWV;h zF8}es4E283fghPG!_6`8*{vy+Nur*RBREvzk1_PA2P$Xs#8LjCOuNc(r_3 zDz5SFh~hup4u zH8H4b_My~dR{Ny>f2)H+*oTCTjm?A^Qj+6Grdh3rr@E`(>4(H!F7Sh?dw9G`E2!gN zV0rf_u4{9#*e1R3;fEoHC@PH(DJdyzz18h-#2<}DVl>%J!o-ADPhY=3(QJ5l7-lFf zEqzzRudJ;6cd4;r<+b%h*2SRHMjs)lpdy+NhP3Lg>khu zC7@{RDXF`5-PoxhmQ0?vfPC41OB6!p^YZ^7eQZNATK$M>>w#k5(KQ{P>W2nik6l&>G`FPvoPybV zB?|^r8Fu>QB4-E`Rendw3X#KD64$JI%{&xw;g%gzZ{^#=Bj1ThgJ7Q@ITMQ$&~Iv* zy^54A_bd<*S4XZ6O*w-tHA9z6Sl5Kcl*SEkpq*CCWfMPW8Ncfy)qFaEf3YHE>YU6Jc3FREh<4&b+; zgNToWqEcrxophh+6u*0{GMuYG>tUWeaxcfXbP{wgEQ$nT0EK@d?AYeyDaieZ#P1GD zd>1GCxR~XAebh6O#KPgcBZEoyk#W-IQxqS+sAe3J4{LD(A}^5yb5)=%ZU7+;8}yaJ zK#-idLGWq!be?3%?(So9Ipap^=r-K^ze@WyeN}_I2=^LjAIy*C1gtw%=-jT0nlwnUxQTUMD~4W4Sl>?{i}eYg%rYT`LXZ z)tPbhM7{^R=KfgBopjY*_=v%9#lf+R3~tbBL9+_knC2_p4JdAPz;pMkH(;dR?OCxZJW4-P^ZW0U)t|2P5064>?|+LRJ>zarz1J@gG`4d_ zS5ZkcKAW<4L<e_95> zy@cBhlfvR~AJ*9))e+*Eb~R@I+23Xq9@y&3-a}Q9?GHLAeyb&^5J@z}tW4L+UttL| z_*x${#TCpvZyK7u$47xbmUY)#rw{|(wqS4{t z;D8yjv$NmTbmX=M;yxIS3Iw8jY$u(%{qhxIAlhU1vtT#)~C-= zo#eMqzXUQ=?zESC5dB4IdJ%20_EuGc5BwIz$MAc}FbWYxrc#9gEvG^e&Ce9B*Cuqn zho}x$XUc8!CWxCytnf`S-^KRPwpUFMP_d5tr@f7Lzg+WD&;6$TCDQHVxu*4|)~D_O zlgo^>YV>DY6!Zp7p2e{Oiw1}6UkEC3n1>@^d>2CNZAKhW(jp5xS*3VP0P6$%^T*z` z=&+zKt;M?2qE)-)@U|JjS)PnA0w&2((Ah0tov779r>Izoh5+B$h)5?eK0c8R!gz|6 zid(Gq82>if@{6Ri?0cygK;+uyc^H9rVv{dop+Z&e_8}a(rZSDzC39ha%~Y9#>s_G- za$#$EKHvK6wbAx;l5;*w4fTp;N=lVh!#fhxzB`t7@f$hoaY|}5WpK0ARM?|$nY0ZR zL|Fl16B#ye+ndnWYjqay)EJFlQWTC}N}?iGy_=aW50z-F=jkm<#y;~Q?0DA~D!Sxu z>qr`jaFjrO+(#p`DZa6_g=t}7;hN?5%HJaMt=XN)&?|<-cwK4G=9J*;kv+VZ56(Rs z2uHnP76h!xvum{{3&783fN9cL2rm{xywADyL!kdRd{}N?D_pe_`)NLrc^BK{3bSDm z98ICxaUp0~t&8YRsL+#IOw6P}d(m%A-a|ptEOF-NFfU4X+bH)_BH2t5&i&{}B8+L` zj~)_HjO;<#hCR$AJ1Q<~&8))U-Sd+n`r`6$6l&3{H*M|V*XF{n$5M)_GkiT|)*Ky9 zqbG)Ky%$4uetvgG1(U!-3Vf=Sw*%fN9worz)YE~`XlI=q-^04u%7lua+s^s4?6Opv zbR=(sc~Sje<(HN~^%?;YO!K5GrJN5=ZCkklEHLtvjkki$8 zFWLiq{!a?6%0B0D5cpTYCNAGD?srSCAV0tTZ)R4%vjS=u$BLHG zmpfck#e+zV`_~^~%%d}iSG4g;kfZ__&F%@-`?-Q@F0qfL)f*T80QJN#?a}oSgG^;x zoNPw=Fp&ipfgAB0a*c{GUj1zG!IZH_So^G2f7Pn~S~#`Tl@>CSX6qgFwr(4UH{fX? ze)z^Ba}vgrnrzYOBNm?1A*}HEUk0)BTz|ElC^LL>z3fnNmDgn6_G15ay}z?T)A9C~ zTV|^d#-t{5gn(kQ_zYQ+l7ed)oCKtFpk!0Pm+uu3y1Z!W>+k;jO`~vIyYtIbC^{Vb zs!7KNZUvOA>iv^KfdgNF?f*(E{%805|DzO0|NW?>_st2RX>e@*pTf@s92!2hcNOp9 zi?7O0z)yid5XoN#E;JgV|EnqaIb;8Q!v98+0z@(`wz+-uhJnHD@Auzoeu!?Yud}ka z_Z9vUrlViY9sE?H;XR`sAQSWbIm!g>N9OBo(PZ?T8mUJJn_4Ng)5&(%uV47Y zcX5mv7SO77;*5F7V;j?C>$c9<`^nd&(%Ltg@wOh z?xwb#F8U3(qu(>|!GuI_qjK4acvOziAEh`x$y^x-&SXNIFRkHyrVUK0{R z0mT>w&j4K!G0(j5DYz1m;OKqWIdeF-9m;eD^Kj7KK8cL!pv$WFjf(OJH{G%a9__#F zv&&CNWQQo0g)Be(JMhRwK}_drQ&@$b$<0M!GFNfL2MDxbiG1k;dq0rS5|tyd2x_k{w)n_z0p4rHAvAB%39|gB`ah4L`+s{ZS;Mmt4l)` zDXCeZADTzper4v$7pILcJUagZG1YftGBQ7{EKg-gzvVx>ykJQ;*1b~`3u}YtjqxDG z{HP_&)72J6ALy=`-!X=|X>>XDVTCkt)t?PkXUs44h6d4tf%U*&%hwEv&13nih_V}j zwhXheegtR{E$-?>z`FioyT)**l=^xEz=E7hd7;yie&&D9B`!f*&(Rj0?1ERn^;JgV zyZa|6O=rCOxa9M!R87Ww{!j<^2POB$lPM}iBF^-4l=q^J+vEtqzrDKnD526_S)S&G68{?o`ijg|u?}h|i|% zAd43J_uaR)sW?aR)3v~DBpyw1#rD{Ho+bMzT67+~7e6#I2jQSB%d*JN)EJQ6xY%25 z%DelHY1$2_liktJ9W0Yfu!9vn#Wj2|J(_P#f1qPy(A@y|Lt991`sjPu;4jBHhO9Eg zKIYoKV7@*WJZ#;pWPDV_*w9UJ%frn$bkJYE+}B{=f3Y@d2W(tQ)tB>3)M{qpTF34fK*FRWEo)=w-OSoVF7V6=nw8+093p}u*ZIjICh;_2Ot)6o4 zA!UQ(%3vqBeQe`-4Q*?yA=hQS=+dh#0epvvd+s-tCjes9B(%nJ+@R4d_%tQPE<8_g zr4}@iljKs#Le>&AYpgIO*1ci}Tz`m)^0t=_#1WYP=XO;xLk>+j&9WXlt+@>~#1$SX zBNXd+n-#AM06L|69~1!mmfQfJy|9#f-BMwCtuP$7TrLP zg2gS(24I6?T*nBm=MxR>vK{fzy!Ut{JUOdm>S` z_i*&LWb04+{w$Z*w9-*O5Q>ir;VMBQwH17XU_zQmdKjF;e-)Qx_t-JZ6~e+7!fsnT z45Xj~lCHY!e~;TX+qu)*aq!zw`)*yss%->U1>c9&Qa23|oAvEUiH4b}*SHiUB(*7|JYBjG&hUCOZ=>RT z+*~Iak%IqAq&%dp_Tliai^+r5YC|caWzlXVL`4%rq?d*K;7m_e^eEO^I8g#^A&!f4 zl{SbMf1-E||4_(PpgG#>?TrSBJ%1O}XL~+-#9ta$cl+Y=E4zKevbxW_;b&k=9@6+n ziSM#qY&V4!(K;+7TG2%Gv(v~qQj@gkZpr4ES6B8HVb!4|X*lk3V?iYP z_t%MO5XM4EN%$fQZ2cZhx+%qN*O0Kt}uY#7~)b3~pctGHe|CrNZ4HN>`5!4tZ zxf@jz7o@-Q(ak;vy$ij%3Y8a;Avn#DmNEpx1oO<$f53r-B1CJeZH=$vUB7`o?z#ju zo-Z*$Xj?7Nz4u)&boTmQF@lPt38X&@7xFz!}0RC_>`BTF~0*%cs$0=dk~&{j9*3qoys5h zRpP^$k8bw((6BUU>=pLt7|T#{4@di!GZ|R!F$%$5Tu|!$l8j?W33!ScM$}nF91ge^Z?*3W z+y7o@8vBJu3{N0CFt=Pj=Mb(W2@@>J&4a?)hS=`Z~`d(WJeBymqc z^-6gt8WCQEM9sX*u-J&tG*9T@suBSM*K)WlOZ0}4rAQHAHu&#R!{>5T!Xf68O2p3) zp9n^7z=-xe#zm$+a=Wk;WXS})l})#bdl4X(qY8IRz$~k$Xl#r!Js#5F6h^Z*Ez7r7 z1kFNtFV^D^9xpYM+j#vTu{l*!)r|~RjE7hmldAfcP@FVD%$az&6q2Bdttpq1g-oP_ zcs05#Hz;YAD=`2&JwJi!OW9X5L=T@ZD$2CiJo~);DhTppg7bE6k20DTzom~5Y0J)c zOVR5K?x3Ct6NS1Ty9hf0Jpe-iwc7_zlhVIkmeY*cP=Wa9>p^xoradUN@*$Ob;z61o znu=(%utws#z`j9mj>ymOm4vgPMD#M*j*oA-Yt+_rC;z&Ka(@3(39?+^|8v4}wJ_cd z^(KbZ(`7<)3BtR%vtsAVQO(IZ1$s=xIrKMH|jCLku z)qSG^L6oV+Mmq51=*W<@1sl7Z75IJdaB&j}aBzVTf*nhvm>yoaDgFqy@A(gRV7Ec3)=Bvj+GXxRt_UZ@9Uu2 z^7gG)5d%}CdjD{%w7&@3GLE%yaA$`?&;X{-d_R#6jUw8E4r0s zCU`XtJwcLlv-@gSygjE4OifFrZdcemEU(bA?yVCN(xR5m|Mj)Bc48Gdo@f`ae%fzo4K3a_?##YFQ78s*8D)VoCm zdK{pMX+8tY8&K60{O7`JhBE>>3Ed=$Z#QWuguQA)HFp%X?v}I}o0fV$B6Ysw5s9USsU~)fP#Cc(OJ02Atgx$+C^WJY-)JCDKbfVET zH7|2}8Bxk_p6k#fq-Xh;0*p)e4##P+)u(shyU3N>$ffq5jRYiy@PA1^8mh{BLhwwN z%KqlX*HwZrTTPDMq?;iTRZP^Cv#YH7kof^|PfbC3_I=3eDHCydH|9mmUn4TUG1yPm znH->;)2EK(bZf;xY%3fF(_CMXe}K$G9c@I-P!J*puIL?W%rv}nP(sBSNfI?exx3{aT#Cl zwPe8YS|7#%w78J(}$k-RA2s7D()7UtM2*mt)ngN%5e{kwJEn${=*n4&H)_t z&<2UZC7Bo^FnmGyTmku8Y&BNqDtbS`sOHNskx2J2lhDV$i4Sql{d-m$$C1jsW`sHj zJ(pR#$H6a@)I1nttzz+i#@*fxKWA>tSVN=Xb2Da2i|xy}S)abArL99P8@&*{H`efg zC>dJ*AR2V&@SI_E#7bRlPuFw3Z~Yhx_3W$mYFL_%Yod;GHd?&}wcV~e!{OAC19h_d zgv6n>XZ*RtKE`}~#YmvpNX7c?VDwp1)x(&TPL>~48eQeN`V-WAxKnkX>g+NXQj|cN z+N%WFB{EpRO}6snbO*Xr$nJ*Y<$0-Y&a0}UQZp5fPjwKEOgc2j(Y_6dNrm_v$-m7T z>LxVLq^b~RsbYBk{-79=RD|Rqw1^roavC%QDE5Cy$H%UF2Xj=3o-z-`H(DP2`-{KR zCh!B^&*>i$Eg$ncfr}Q=RwG!|m9C+*!t-m$SC(iYKBN8Ggx$K7Uh50R$Q;57QgJN~ zppjSV?G5wTIWIKb)US&Eij}V;I83WPAFi5a`uk>Hoo)}AKYJakN>G7t_yc7@0u91< zA%InOH}qW(*TnG?aDH`%3o)DUJI7gb`HHWV@>V1x`Xl9|W?Q-FgLA$f#k%j&z&fMs z{P^Q9JX`KkedzdqU+KIZvqN_65)hJnbf}H3bW>7Ot5;xD!A(k|_t}8hCvp_~(Rvn= zBX}jFBQ)vUm9~3$b@n4>lE1QfpGbRb0T3eqW1o!d?ryg zvDeRga~=a$A@tW9%)q^!oBQ9U6uz73rs`2-8y}d1K39U54E3ZYE~T_ya>)+uIne-j z;|E_IK`*3Rj(`wmD``Jsegi|L~k9_MUjUIoOEds7_!^<9Cx2;qlH4Z#ED%oSOGM5qM zcH*bX!bG@K{k2DAHn+)B{d0raZ#`wZdxB<&3$Xgq{z4}k+iuan>vz;2lT;`Le+M+0 zavAf3bbiQNBh~!xMY<33KES8Ld_@C1__SSa(4X&ZKcV7a{9W>A^}Y^zxG_#^3sqMb zUw2v|f%_7c*zx2ST(e84Yp-2Jp!e{kJVf->5>YVk&e!$a2Ey${1|E(|3Q9~^4+_;w z*vutI-w0|?48n}^ByJxR2p+zzMB9PRuMR9zz+Z*K0(L6|u{Xo|6S-UJq2*v1@#Dj+ z2JBl>y)44@)(ZLghiNG)!oSVRIY+-Mf1i)yg@dK3*cWsIx+6!j5Dy354Wo(9J6rS5 z+Kq)=%g`q&34EnY1(HKLRwE3+0L@PvzE;<0vQjQ`@6{+IQ-#QTSiX22V*=MpL18bg zkv2F(T}uZ9jc}g@0s3V%TE8%~KGCn~B}p4;KRtNQb4j`O`$*w;%{~0Gwl(Jni21$y zBm9gqfVW!MyrnVV!)}aG;7#^{ML9Y(IAmVnOIeYg932`&!;&=}uIHDGA&2756W(w&>CJlE5($Ii!yZ7$W)9zj*Dt zcbZoBpB~SCu$!YMl$%w*f5vq%;B*@vyvAw&K@&1h-CsCF1os1yWpH0qOcJS|A^SrR zfTaF6GK9xu3|ZGU5or$?X^9v+mzo-lNG zZt8A?cwdWFKjG`%T}#|_58=G1#)ons0udLsAQzzV8bLm48$o~c?N~VQ%$uuP*lElC z*TQj}hjb90Xyk{Yl`}mXB zf67qckN@pZn>W#Y0LDmU_dI*p1ND=FhA|lyLDVNpOV}QKk) z)C}B17)x4OzK9&vqn95QzPw}RQ7GS>IdHG`9J?xg=*3e)RmeOPZkFZ{%VSY`Nvof% zNZwwjkYMD?6ENy<9iRej>r55xhYGt%3cGQ(_L?0R?WP&HY11tX zyn5)hSQoLWk=LB=I45G(Z6!V78iFWX$&K>Y_deKM_a2^UG4p(Nej*4z{l(aXA2!Ct z$PC{q$DWd>3n-wN%%t}Z(vRZ-I)dvLa6basz4q>9?4GKy81U|;5lu1IxnR{~-qZL* z81gVdkt(OX?uZZX6nwiCOFdvgl+8k6t+bnMsP%U}E7;Swy zo~G=HBzkDZszJJx2t|t$FBV5pfc$GdpwSAFk75EbtR$s#SyS{yqC*7wBwuvJ^|WUM zVMme>T3m1_W4I^QPvt$gMFjdn>x6W!fhD>f@M+!&i+%ee2R z85Tx%MtryWn+L*Pr%P-AZjofT@B_rFgUEGDzsc7DZ}7}9avm&q&uWGB4?asu4hN{6 zL$|JQ`mK$*YirzixGvy6d9*ejl1QN-FexKoo!*dVVuRW4fau#7f29UjJ1mQ6REhgG z`A<7i_-tFY(O$>WH5W@ko)kPr=fif5!$cR_L;*6>^(GVTXSuc&$h-Nll^n_TNIxz) zJzhP-n1w&Am3rZo>&blDuZj3k%?`sm^jEZS+`>d>Emc*?E>H{>#0tB0r<~rsaV!;0 zc#aB6yA`zX^n*uR=&!Ku(}E2>>!$uJl?%;zeiN>#iaHpM&k0}6Q%J#CjFOH}(kWP! zwZToD{D!E#A!v~9R|PC+A;33gR#e%j(~)vwo*WZd;HG!Ocw6>tn2!oi~}@{kmd_18!vRSu09dkK={N8lBf4(Gn0M0R4Pc zPIv`F+#gIBoS`XAfLn8xxe+lr*GK7VA`S4{z=Lf&h%MK6Rr-k-tsX|8t?HbjrT2rf!6!bChbuXJg8`_I~Cw{f*O)>lD41 zI)zd8DfQS+$ElU00Qsm@n~#4j`)>^Sr_ZMH;K5qO=5+n7{R!9yw=t~w9;k=%C*Zau zjWZ$omAK&qU4H8S=!evrw;FcZ>S&JR8@zjT-Dgp&(kF`S^BxOou?{q4D^RDqW-vHp z(%SKn$ASZAQspsnC8e;F%^(Hl#<>lp7kmD2; zL3Xm+P?~4{RzNmF!GwAW|IsV_iAL@vLeqN33)^=?giRCf0{h$XLtd<(buCV3wO~?S z?uYUD4zTzf(BYxC>*G&}{*q zOV%9kM<%X~_H2e+H2|-$>s~8}oyV`mmZbVN(#t;WxbQmPjA&=_yTU%r!fvdL&*sLw z;$Qz69kQRnE>B(vZA1>}EYd}5aOK9a#VeB{G%V4ub+ZFvEbWzb5oWP2Ht(Vl5pnyW zn)8hIByl4+Zw%q&l`Mn{vGPbQ;jwNNHp-vRB?~$=xDyKQzJxQI5JY8q8#y^5NQ^vU zK2;Ou9N3yy*q@4lT@G=HPxT}Z7r$vSJK{&V+wzFsksGcjo|-#(D+?%vuN3}A$C$ls zP#my1jr7j16-^}~tV5`Ku0yqyjMP?K>(nF@+=}hsot)XS2Y;T#THVb6n>G2nUX&VI zhqRu>grcr>&@LUB40&!%lvNG?1i}2vz$%#&axl|73MMlKr$mYzzq)4(e)SPyq^zqJQ7{00s4mn~sG}8Rpg{pKGirN95n= zANbPaA ztU<~szH)-fN_bn|>0l|&QRQKn><N5ReZV09r+2JYI9lSHS%-ahNnZWu^*oA z)hKTxiw?vvis}Pa;rH8()}zISEnj2M`2E!~`wOWs z0}YpKJU}E~4w3%- z+hI1{D_0D+(%g9wc&pDM=^;+R5+lO|>StAn-bE=8FO;kRGz{UFIUN1?cP(>`Hc=S-z|it%T#Dq28N!@#9*m) zWtOTSTQbhp+3=~h(I|cPf-YqEn~ZRjHjC4W;mwL8Nj`WJmDa?-GeH1dxro5CH(r6V z#+yyCO19&L;U z6R5%5m#YV0h`_0?5>1TqL$QC0?sD_TltH@;dA_@~4G`_PpM#B5Hx~YgG&p>QM=A<_ z0Ef-L${BZSBY+>zC?9h^or&A)WA1!MU3rITTZ|QEYKYM+<=M4pmR}}EfO0H@cQx;U z?Im9`jQ!xhzm69l{ZV;mv9#sfXpxpH`4Co&)Wn0pOJExuEL~RKx5aCbvs`Kg(8=cj zdAlN>Ha%^&!~G|3A1fE${RQ$?}86Rw(|`_DCs zqxmSW)S9fP?k%@vm?mi$+30UH!KmGXOdydFE1X)P8h+rFD{ zIew>knGTV0T1~-xpjY;l+6Lc!Q z=^Gf|)$aX_*Mb#@dX&n1mQV_Qzt)bq;CqvFPX; zhL5e4kx_YpC)c!S1s$?)hzgKRKE3;Pcc^~?$v8mB`eJMG@koi^%@HGp8(~c>O}c!m zJ-|RT?GTgcGt2iV-m{N_(qg*>*%ijOW{r{`14_h>xzT>$LV!+1e+^Z}!PEH-LDC-| zVxTX5H5!}jzDc`aXfa25#bPV$>dQWY{hbhxzB&I0g-|m+m4GWlt*8NLr6Jyc)ps3? zm-lrt?`_6u<8gO`k(dHths#$W=zD*?qL_-$s!d!dTQ-s%9Ok(o4q_qs#yP5LQ{}w? z?o31%L!GZc@pZF;r>Kk^27pA4JS&;mb5s)TYt=)bleQMZ(Y%L1FI)%xDhz$1(8f;! zWy_^C^CsBW-;g0B&UU4URfloqqPVz#%wWif&5GO=8+UEqP3apur2zhuTU0>h9vF zIYh4S+H&7epyagvG>o`uz0QUlKecb0VRXC|Ew^yER7EnAe4c#sv(>=?S6ly0-aTB4G9L5`} z9QQ`_(Lcy0r(7S?Gt06MW;aP3@{@-qV^J#398gK~?Dwqi&x;R|ajH%Y0=;fQQz1Wy zBT~EieOP3Tw|p0n)S?IL&L0G%#eo9S(u2-j7LCL(ZTbaA?nyLu7DsV&&Du@HySxi% z<|~Ix(|*&(IP^ds$5kfu+q_|A zpZU0t=)toza>%a$a#RCPmF(L-bRUR#?IFk9z7lU+@#1IYt)vv^k42l~zDH1uKHrE{ zofmfbGB?Lwu#*lt+9dwFexs}OUUzkHyJgW=)Acm!DmpdCbtZMRpTvi5uVO=wOIW(r zi!{sOSB-W%X3AyytmmSyiJl=XTjL>d?W$T#n9>Yq-gad_!~(@j>bfYY>GKT|v=T2e zw_aH+xMRIKb+C2{1@dhne0t)|i1`Y$G^NI;x2NQbw18`QSM~%s%;%8lM@W2nrre}<@>TL;6aig38XJ7lF2$Y-_>np?6Yz3 zmNS2#@wrHWQ+l?AE9SJ(u2%s)ss6tCpym}@!E1Oj6uad;OY*?q&hXGQmicSHa}t!8 zI4Qbh=6LX2Hj7mv9M`fkx!TH^u(cIeCq&5dC`VcDD#W`(s4k*F)Lo7^r5EK;WIf?2 zobZ<@L2Vv5#lXwT-Tpi@Hm856^$dw3X_UGbE( zJVKxhQ|ny3Nv~)ar>)K9PD13>tOucwa8V)fBq; z9x5Ke92AIFdq_>;m6kair<`V8o9_N~-Pt(QR>m}yLhDkBQD0PkXte41V~+mt=5-)oY2Kz8J4;{ScJz&TF0m5kSH)G5Y7** zL-FfI)CH1v5Yo*%SMMHJo(MOKIY_=w()NuS+e$Jd?!y4fyYWJhx7^FhjWCID*Y{V# zp*gn{7I$OM%Y&=e+McX_q4%Die+(!JJh_*lxTq{y5+KP5Oq$`~B~Qdd1W!)A zmV0I4w;%??qXT~a_ofLbOSbyJvfruf1~cFEwX~0} zV|6xf=-RF28XM_wp?@hkdyu}jHi#n*hqSlsz)W~6r?~m<~6CZAM(DhTC|@~A}ZIls6!buEYbx1swWs?gF|Gpu&f2X8s~>h zr&8Kh0bI(^zh#^VLdt8M+xwiV=N@XkwtO&(h3IFdCpw)uZ#9MZP18#WsLM|fG6Xwm z1s+szxhVWz0EwRTI!Ek%%)9Y0q&L^0*NBBDdK|BGOdK-`M6NuBYhTR@QW6U{r>1zD zwx%Yg5)4I7h5ql>I0WPWIlcS8^UHD-TCkUfoi?Oje<+M@;Y~y8vt{I*$F&AH2h!E> zqG#RQc<`{!_w&br>|R!E(0}@I46o@awpT2O57X&8CGG@AA|9bvPaAx>h7KaTZe~lR zip>ywrP}X-jsa_GP-`T+9jU*n7hs#V0EyWD&e(sukvf6o6-6TWTux|_-JPQCH_??$ zQZ7|)Y9{faYWu(T_90v2Pb_|Z+(B(CMd(g^C$1gi{qQ-ivFzcc_dIQ2el((#SgGfb zcBja1aW=%NxtZya1oLN|Jc~mZ!+1<5f6;+&3`J*iD^{)+VmJ3XF7Ejsh{p_@N<}DWXJL)* z(^J`;yR*ZySFw?xvrR6b%~}2>kLfQm7i$7*ym0*$rb0n~BqYXkVwP6g#O{|n&+SxT zSh){^52}6EwGj~V$d-ea?ENMSYbkAJeh0#5y}RfveqhzaXbQDgW%Qv&axGYY;bx5}S$8iS}3 z&K==ev`{Bm<>ZF+ya))ZdrKC-cWKAO#sV7f`tO2lEOS8en{O|2HdsS?n;92cN!)25 z01n;~rEj1*7o&9muXb8|vRIz0C0C>KtWVF)ixI7LuB5ZWyAh^w_(F6a+(`&n3Lp%U z26kUKvzxwV0#X@&Wc`@*g}Oyw_=+1v3>yuk-sl!i2Hs91Y;67b4r zb0~$lg}F=Kb!$p!eAyV0)>wN+rhTYC^+?J#>WA>|S(Pt$eI|l>pb&*9% zPTOFc=bK38FT57onQ%|Ru*y;~oj9s|yY+0N-}(QvcLC5SS?Dc?OexN+L_?u#!r0=z&#^ zaPnsn*KTS+e&!6dnzBB+wX7W4Fo){Y0gX(C>wJT@wpt&ndLAjNdqSD0ptaRK`2mkI zWHdw2fJrZRoSUhCyu;pcTu=sgVo?2_%#($WY|~v={xpBPd?LikMPt{-d{GP05a|zy zdz*GnezV?yS``IAK&i-AFsiI(KmvBZg?SZlbiv=h_NKw@`4QFhm-+iER^`yCk$i*tia{cv<0E6 zryA{%;O>N*B{9Yh$@E+2*Uv>y{l0pHEmKk)pyYMJ?K$%Y z(xM%m4_ctTIMYUYdesV+xA)HVJkp`lETdU&ZQWpa&sTM&dCa^-M!9MmX*rZEK015$ z)A5N(;!F-|d3mz*^6Z|IoX9%BUedl@)GDosBp_QT2u4u(r+zgJoxVIm{b6bamlI!` zPBU4dBmEAp0?(3p^}-+adHW~GjVmal8_`C1Chwv0*;wbn_rT3tc82BQk6 zJohd^sUYGYSjIf8YEqtcK>go$#dfFaBHUTDH{Kl2b0k%Kh+G!i{&b&A#sklzf_|`{ z^w|1H4v7}KJ5pWc!o}JnCD$p&SSEik<&viH3JVgm9`Tj_SP~2}&)-faees&oS~8KB z2K2J;ZgHj~at=<8J|8l8NIo&gYW}R|ImJHYzLrQ^OWo=}p>^IFVz<+Kfk}|)cs3c1 zaT0nUv0zc^c*x*&ws}I=BE3WLuC<3nND9@RzU6xuW(py_>R^mX-k2FcYVJxg*36i- z`UT&?gzq@zhuC(XCpeV38hnjaz}#3sn4=$y=j?Q$W(NR57xI)zZ8!4lUmQkV>iye? zyZl7Iaw!gb>p%5-Sm$ocq~xWEmh_bx(NCaOyt!V=WTCQOCB9en3#j4iU(+?QW{;Bz zYb`nl_q5>gXDU~% zlGToW*m*CmoqFN1lWHNbW|pp4AxogVwe*L1*lJ0;X;LRC=-S$%@C(hbO&Ux8hv+)l zXL;s-#(>aIdVNY{{J3dNu|An_b%+o@kisK}SEM6#HELdwt`=Geo>JJ$P^fkmE-fI~ z`%-WdETf)Qkd{?fQKC`ykiJv%e@zznpTWWN7|+4|uF0qE_0Hh?om9h~q`)S7VPWCl z>V+`?B}97v|5N!jM^Jlo#gYnP67ZfW~#laY~1;hioc4y2!tpK-hSlZP}}~u z{W%X3^_k-ScyiyD09_W8kY6eD?FNac|&z;SJ~ zGmCijFK7<+KOa+79CdKYzfu-Ul0(GFq3OGuf0apwDKWowVvOPJcpZw16Nmvcne3d9 zXg}J(B=euc@y*+>r)5zNGJ_=LY@lA<2R9MG>KHq%&?}iR80rH9s(W~W+aHx*qGvt~ zofp3YB_?1V>`B-Uzg-MHj|Y+0^(NoDvzs_9E-E=qF)=Q50bOtGVIvRDO37;K$;0_-)x9qq_nb(?A;0F3;n7or%X!)yA?LX@6 z)d*e5j_5Qdq%1#Jm{h)!0vLWDKB;HXQ7^mlYH)e6u|14AQx$#rHVt^&xSOc)c#|K5 z)t(tlscEj{}pfPy1HalrrZmsd#du0H5>=jTsl`;7A29#J>+WoHDVC$=O z{JHB?%}M3DlB`ER+8QKg%n2oKulm!FIU^t;xPyYB$0yGSf?E+^KRmBv%pz~GDW3j{ zF$M0nSK!9ONO*EPif)Tq`sz}_)u!r7O?UaS1@6SM9Zcn%n07R2#?*NS*Iq86rT+sTr{0yEI$g^v>Q zi*#ed8{u_h4C2r-n<+|#-IVgQ7{BODRTn}Uj?xOqMe=zdER(#R>S6yY_6YUKv#hG})qY4}DSH%8W}gw z3nW*eD$LbCl>I1P5H?pUT$2L&Ug?YT`v&;1#NQvH>=3YaUtPO!*tw$HlPYRInsb@k zTs#y!m8VD^ul-k>HAf%_8#|W&q^vj#j(VWVNqrJDoyzXB$8NTVy`m`nul8bK{q&7> zmzKyuSWa=L6lfP(h~O>VLy1;-Pd^V=UWd2v#hNy5TL*7E!@A$~&A$7qC28h!p3<$F z4)=}HrqwTGn}eRb_~jjIg49HWVonYhd0Tj41+^IQnfcW3^<8?}w6PSE`M4t|L1$pI z+-E~cUN+1($dS1j2_SF2B5~Vj+Td}BSe7j#e!GwxS5>|JDG}YWe6=sB!A;>}DhHzA z_Nv{5dQzebZO2->XgVp*IDhX5BAeP-murQV-H7mi84O2{mQDx=sNqFzb2~kkV(SYd z5Q&k|EGGRBoLc!c8Lud%XoT}TMEVR71(gfPq&_O}>6|a*fOQ}m5|xMq@x{QQEmLfo zKA;|R@K4-2z-8r&X<-0=3M2m_k*l;ka{vpA^w3b`LjXl^Ox!vMhaZ;SGT&} z$7j5&H}C4@d1Xe&RlH!mGy9`Yrrs^}i>@#h-YiSU3M1acSu)|g9|snU{|nJs(_e{J z%cLU!@*5CL=m15Sz=Rk<@ig>1oKp}thMCJMy@9l9k)slJqQqD9hM z#%Www%!+XT)xxDY+s0qK$>RsP#?Vuiah#Uge}{A}YeL=>3BNW7s6eCi1^-Ombr zAaiSp(vAM0_Um{1@{K>=m=z0lTgwG!%gEFX?_rkmr~LumiSV_K-9=)3DVF{~A{UL9 z{r7x=&6~NuU$5r~huaHqegY(eL>7Y9MpFMge`9vXXs>Y>CdZ~+v!W_&WTxAT9lLmvM)iJS%x9tmIb;1&9AQ% zS{#gw1IV6gZT;(>yg6g{?(^fjX9kZfq}mhcWRk?1@3iZD{Q`EhTbnKGd&@3FOqz8d zFm{~YTg@?FIk&!d$LhaG2cperfR@j%J6G|S#ghr|`ZW@WFVwvq;7UgUCLeoi)6d0ZQ|@IGfJ`j4!NI8Z79w_wc538=t^-ZUQ(lB>g3< z84zc@RLf&ZG^wwF1k0=&HpJ4tsj_3%gwIHN_q;J-owNU!8s?2!JV_ltKMc`II)k7O zTcGYL1N}I5KDflCmv4%>#BNV(Xf18) z$SrG43{~pCFt7cgs-*jkJyI<(@Qk!xx*lUE9A2XCjaLx4SaOfwk)v}w0l)e}Z1Q0y z=G2BEcJG5U%`Zli)_%^r!w8f{g=F9VZO;hfHPM*ZyMGveb%NPZDV&BKdHF+IO!nqH zBMidr`^e0RY|e0WzOhV)VxO|+a%sn?*Y_Bku~mH}8vazq`)7Fgq(3vp4?|55vAx(j zb#7~GH(NBl5qXVkF$(VJ?C11T`Np>?Kzs7YvFF8LU$SY${L7OKxWb9VZ5r+4z%Vr0 z!d`{>m`pU%QkZ<~tY~4Sp>e3A5TK7i!v-?)Z@yKIWHm(j;Ez|ct1W)7TRxHT`DUY4 zlOBVxvJZBvvp#b;SCqYJ4 zk8KXv>Yvj!_l3xY$yFxW)WOs;r8e7HB)n%l>19rQhV8T#wWgZ7y@_r!Sj)h zTf^B~6~+%%Gs^eKg&#L0diYudkC+5}8wnwkK(#RUL!}+*EP?-f%A5Jardw2GuIOY- z?mfQ~z+Xu?>?+maD0U!%8ydfDms(-@oOZL2S5mB_P|NpI+Hfob1k6x-Cv?sXLV;MF z+P!*@=tsTEvK?`9hem}>lJW_kGnr`jaI6bpbp>-i4_M z7=SPFD&*OGM`-Gw!K<^n`!w02^38n%wEky znQRy|0f4gg_ab6VBYn?5{{?2854LJf{5_wp=PV2bujU3(wi@#RtEpgddj%{+F{JlmU?oVr%;= zAsLr*$BU!%<_g>gFmV0gobvJZ@f|;<7<;{=-}2&}kQBN>$YCc0;!Jj&H0iKbm=_|_ zkE!bLb;Hh!bfh#(CUY1$`TF|27uyP>v_W##>t#O4ia*^%ycD)9Bvu80QNDeDfom=c zG42umGszQx4>}D}#WL&+Et0ReLPJSi|5uqipfnLk{eM&D)_HHv4RsR(MwuYm9N~@J z{}*kpA|(UMz-N@Cmf=gVG-sXBtt{9_qw7Uvc3mxFb$>LQSMUEvX^y4zKOEeDljbHw zgi1k-i%AQyzwfsJjxVl8fx5Qs2l&t4xU*O5BSSl8kaG3hP)L45JZ=GZ$_7=p^XAgO z$9_3*>m)r#);guoK&WP5F@ib1Id0}Brd#qzSXQHc*Z1O%6+yePd<7_0PwCdpg@sm&<&R z{XK&eENmZLljfK^KEpllxs5VLycmcB5nhQhNM1|-kLKRGtBvms`)#q{QYZusTC}(m zq)?nfDHJL04#k5Pr)Vh@C|(+@xVuYmceg-`2X~(E{hep6v(76x`E%CFteM%f_sm@P zb$>2N=}r9gp`U!hm3}X04!)0d_VBF2Rao1+^KdQyQRFz3++QJJexDtn!Bl2iF2O#F z33Ju|p4oaeqh!=L=f5xe#XNA=N+szi`ITKe)@1Vp^o zS$+GA2D%r}Irm-8dUjKmO23(eQq8cvFs6ves}#?>`6dUP{Qp2^-YeDJ5eBwo@$Xj7 zv{V6$+77?M0!#&*?+gt7U6Vq=L=aBj?et!ZLZ%W$j zp8HZyG7;Ygbcjc}5u;Z7`!Ml{yVStK%Y#YCvwFC%Jrv*3x;trHz#fN6SXsrf5kTDhX+0*JznT0*#Mh2}5E1aym#c*N z^!Z@QwO<(fZ4>GMlSDp^FQ(Zx6%&X)ED}7jy1wKXV`Br*po=)}R`U<>pqI zK)7&WhbAv!+E+PtpVJ?n7kZd2GP*hB?yru#l=$n?RvYgG6Q?nI+5uR2U+{QnBz}u@ zl%7eT-A6fru!cdGX4~7LJwhvR&Y&-?$o3KoCi-~cF+($mvR^I(xn!=*S|yMglpuICoFSBefnPnH6U}lah_m*0fjZ6MemL7@%$1cewyc6NVDkX z;gy%3uBjYQj=Tn`>9y*l(e)b~JasU>Df($4QnM(QReHbN5oU32F|bEEXgjE>M_PxG z6O~dnw7EF;aup={KS`U?ddh^7Ze6^}DlJzRV3-FEi-7Y{1$Wj-KS_Vx{)h{fCP?f~4iirN z=0zBIL{E%srI8^{(o>LVbgA(RcCO3k!!yO|CV>4?3oi<5^ECwN!=TI|hf)CU()q+3{`r3!?1klwb{z$QML!`N)Q`4 zh2V9gCxm7B`U3}!L|q@OShw(leUpxHlfh5Vpo7ih;SBDyA9S8Ar*MDc#i6E+N8@X` z@XZ=>Mc}~9C9~KHyPZ5-R5c_M$ttS=oiPwYvzL~Zwnp8XaKL5e%RT4zaD<|JoMW(? zpbX8d?cOq_dpZ(ED{z7Y=h&JgNfLGjizGouen2sR^&BspGJis`vVF@Rt}#Vu#Yzcw zRVyqu$KB)!Q|)e&uJ25$h-=WLy5o3{9XJCC!q-P}JRT%GJHX zEU3yy+{9Dcx!c+`#MB&g4SXZooaQ7NqI z^EgNT_ABhCO3eS(1&{M*ULWysMk7t>G)Qaxl;WopR&M9pIZW$7wyp3xvw8uQvk;&UZlQ{&KJFW)AS!dsuB z&%0@mApC!ynQ?Tj;x=}_BC9kU=yht)oQIc!{z^6n#k19TnT1-!oH2U+lUREGJ%}@z z6Nm}I4%>_DMBe2R@(ygog~HxNaQaO@b^w0pqU+;E9v>~vx8ZF5Hh_OJAIE)pe1;CV zTC7=?t2yQ0N`pVD8zyeA|C-AaGEMWYN!EA(H$k3e+L&k~-C2j(NU|T1tsNxK2a^u7 z9`ME$`cUzVmm|GSdqCr(U6bkL#cGcx)kU#cK(wGj56Ya(Il|Z7B0%-7A@GMeU6I`M zLiLpYt@#gBTjNn%!^#-NFtH-kz6N(o?N^rXWJf* zbffEB@c!ebC-^klg?i_~p>5q-iT=V#JN3d#+s7bTd&_x`X+UV1MW|eueO7G1pxZZ- zVdYK&jceqeW&LwGSHAZL+bexK$=xVz$wO%V4aq;8E^PR)Ty@(;YkvGpi{($fl{YcI z;l8gti4k!J7|%p|>ns@=cwiDz{i<#!{oopKAQ+33P&G>*D#aGg))@habiC5n4{16CuBAZr>UQaRR%h)4t0or(_!*DMtK20`kLp zqR7m8;(lFS9vxh5UNIG6)R2WDJO1u_Brgs&C`O~Ff)&Khgeog5WwAdqoEm{I^*^Tf z^|kn(ULeUw1)(XGFWP!PL=OzrNKwGoOT0}J*J1r**aL{>R9^l;ijxZdVWpVl*|AdX zHUlq?K`Wh9!Bi_RO10v%=~W2h=^poZE@G6XDsh6G7N}m0QV?z^_1j9K-(dQ8 zYc{;K`jJk2e2x9Fc{H@Lgupo}px1J}}v2=$qQZCUZvVHASRKpHsGLYVrg zJ{OB_>rJ=h>OoG=q^OHVDz6fDv}CQ#RXXYo!T4-Y0{2jtBM7cE1ew!A^1>QJZ6@;& zN;t_hKG?UJ4uP>;;xRl9dy!Na3_^^X?ULGXgmeugFEnRXjr=nf!0=rLuG*%Pj#mG& zvZ)cW_{L46LA1VOZZJF$`*jpzY#RbfKhggJSk@a86e)NQi%G#Age$&aF`qV75VZYfD_d~wMI^$Q%I`NSiUs``d_okcAS zgrI!igV!uR$bjj)%A}x*+Ke1w3Vvk6E=ZP!;H9#`a!4ZX9mVL-kcxhj3%SMNO44NM zQe&`&wj((~veWv&fsfbHCyH99&mBbv)N9waPH(Ll)K+$Pp6HDdXtZ+pXBu@uaP82ipXcR#o)N)9pcEjF+GHqImT$ z@3X4Ko~X}qQueqgQwN(CeMRSQX8!>`8+&VO)zY=m7}b3;MD|eRRh~4d!U9nz$A9Dk zy34bttuyG~tsMQ*VGT9I)XQ&Kg?Bt}}CzP&(Zj#BEhcnj1z zMamr%$!}FVz_>a*d;B*|;Qmmfdb&}rL}b#4hu6y!H6X-0+w(1W3Xs{ui5GU-Y|fYu zrDZ}&2m8wUpZ=myQB-L`Wjoc*WcKv#b+V@g=Ez+W66WtnRJt%is=RC?m@14NCGzOM z4o95;f|4t1`uTJ-{|ggBZV3vQ;1-TU&10-MXCWto@tv$WG%M^Z5~ASZkXV!lbcWl% zS%fkQa-p?!kqRAi445bgDDz>{I7 z1}@k^&2wZr)XHX?E;O~`ia1^0UU`{*H~}}q$0+IS0~ln5S}P^lYK=@6mXPurxc*5> zP6Vof5ojwuN8-)fr-Bpgv&4nq=zj5~C?rSn*srFgz7a-@Ovb!Ob=N22nIe;fk~dDc z*X+{q)Kk9dsl?(7)L8f`W4*RYV0f2rKJUxi*70|^@}FyCY)|#`5tg2v2A?j0Yc!mD zv{gbhuO!n`B%?SJZM6e+tvjG`rjYbZer-#=fvGYriZ4B5p4*Md1)qH27!NBbzuA$i zmJ1N?9C?JpE|Y0j3U~{f`4O?^n2^29)MezZ`ybEkN)$dbhMT^{6cxSTo0KAk9A*I7 ze}m1y&W?i&1L#_ZzSV3v&r*18TVd?X+!-Em=pcxz%Ss2%3^nFBnL-w9m@Fu`J9@?h z_Q@IRZoKR*-lWtP=?i=D6LHqy3WfbN6WJP&gd|*#$X71hqo89 z!fVqCJ;FoEAQC@9SePcMrYwuWlnd?OHMF(}^N=%q7-<8Orj5WEu2QdP0J7e_X~gpc z_l>x2ru_7C+u(HFzPV4j7)b^ms67gIqcLM!bQz5acOlQjR5Anv*tg@mZ=O$l-uM>c zU6Y=8-s6BCH9LHi(Cn8w_!44XHrhXH=8b%7Az*uYcVUuiaDk5@Gh^%9X2_Y@T3J3s zB~1(;VgXh%N(eR*Id`o|-}n9zx)ByLE8r)1b3pyAbVay(qEXJrZ1-6Lj2H>neX4nV zO|$OppbT5ZV@LVF*4%Rp<^;+(jUhmqDtg~0YSHTOgN!C)jq zCl<(^f<7hFgNR688;pE^q1XU6De!hBT5RnwO-&}}x~_E4a5>S^nB3GghlPR}yNCUT z=Wm5IP9>6@^!W}0>%AZhc^6JGa(Ci8Q^-#BJKgH-tp98AY?C)g^L*2nHN#<5GN|*& z<5SiKisie3Uzn-N*Dfzq5AGp&7L((0c+T)&8q zNyR({@WQ~?RJB99!K9`85CLy$28Qq7n0B;xF$;xheAL0C2*#~-xlu%OC^BARi!tNbvmOiqe>b^C!6THe6^M zXz67}=bnp>;B{fjKKx4pQSg}8h-*sgod&<^&5Kshk?d*& z9`Hno^{G6NNOhMS#im^v&CK?Zv(|MBXiFrzfj@KFS~`o_(T1DxNNeot z{DOVD$wEC?!USx?&!n~oh_`Kw{#TtUNfz&@Notjt*Ux|wGO}0jfQo)5c!POKv==JRn=J;d#o|O$nOjd6Kv#5NnH?}3Wh7PBt zWu+a$*^bpmU`DmWFCQ-MkT?X1ePl|_w?}N;5nyz@l{}qyJeO_0-KPh~A=&V{|5S6_ z;^f=zCMrOP+ik|;z4BICOl?RRYmn*T~Z3^0EDhNpv2b?8Rt@4XXU&AIfD z3~7=#`C;_&ZNL<+#-DK0%M`5>Ch(JL9w%wZ;rJpwoTd|CMqxUcp7r@m70)e2n84_I zMuz;FH}HSR0*H5;rErZf_3}(q(n`pCl{8@hCEpXrAbT=`6?imD!o1`5Hmk(1T=me) zWO1gGps0zfgR|BV;DHS9;EDba6b8bevZHPxg3}xsJgItg%}wYs_?aQPuwp2R`s@7S>pYeq5=;K!D!s8 z?E6Em3ggLuUL#emOc+-E209s!L(W9e=JDpfVf$!SwrkY|FwZa{Wz+?I6Qgc+z&PN< z#9SFmVNMf&IQ>&60{%(3{@yA5$Ay`ZK6&#@_q(l~j5=DYPY>s$V}uFfH8YIxoN9$?@L2ApHVKt z+JEsn?LSwZ!^H04B9*;`sH6Xh~ynT@9}fE*9qSOIGLG0q&q z2`2`s!I$=1*X;Va>Sb?mXb+tjkEM>}`-t%m<R+D zCN^uIeQP`b+fO(|8JCli`v;j=Z9`Ni-pz5qNvuT_2m1TR2`qCt z*D*aNf89VkiWuj^WiI*iEP+^baN*x|N#?kq-+~Z4~2hG~m zE=mRB9RH-Sy)b2U+rU{h1*{?&DBTJk6yu;Zu{KSN@Wfw4iCD18FZn{Ts)fHSJmru& zX@tS~>k}jcX@ps0ISBHUYl*T;^OyauAf2lUJhL%_4*OF2<&}1{GFW}y9>XtAX+&F` z+rM(UC!+Agv>Hk8h(9PQcT5f;<&3@Nv{G8EGD#|>TbNmh0|hJrX5~aRH|E*y+gfe| zBX=85pFNI6MKrb`bFnQ7*o zEPmv(3h78uj{)%eq0nbC1HekA2D5Zll{0^QMYI(^9u{_fQJj6>q@L;1pqH9)TFs|s zpsmz|FEZLMK5BL&>hR+xk$r*n$?@?d3OnNb&(kd3=gZU5N~{a!KS9B zTU640pMO6V5=!65Tw?O-fRCrTHE+Y4E;oGj)Utl>Wj=F@CXbpd@z4~gtB+Mv6Zl@zFZ-hq~TYy&@?tP&5*B?e~@faz}bmBn497x`Vd?KiecK2 zv+zSA^KyQ^jrpt*8o)xC$QH@dDPfYA@Pi-=W#{der=NT`r?T|J118n=8{M#w2}SXC zcp)z>e^=kO?&(;|ZN9_3_%tjB<)BI2HcR@|X2bYOZnXX-r)=sAUT?{5qIFdin z&>$oeCBL|(=}k*ppH5fe$<&Z**=DBl}F;1-9!4+Zp?TiMd!WGux4cWiY)8NkJlfm#6&FG10(L2w; z>GMzd9qY64YX9v+p^cvsB8v9>;&26BRw+ZgOQ3EzXfy(n-Hf7z_`dt^D%uYPt%zJs z27{wiUEL6d>H3>iwT5yy#${~x*Xz+*^G@TxVl__v{Oz=}27endo~}<{hH_QW!eV3N zxNY03On|`^a5b7IatBQ7aPXH@UfRK@Hs`LbvS)md(kyVjb6QH3N5xy#k5or#o~S^< z8y!+YsNCa%!y8P%P$_|9{AQ!055pYh-7)xa6|F2NR40atB<*Z&ba%^d50!*#I_j~& zmt`snkO8pD;bfPiBCjC@R)kG+MHYOCH`qMS$t9GGoP|4JjuU=D+Rp!t9yH63DZe_z zU0+{czyup{w?sI~grtAhZ(hRi$tQtG>@I$F8u`SSx!6Qq?(Pw_(?tq#%m~@Ar!mS~ zBj6a+Wy7RXcq~WD!}&P|ihe8O!J%4V?79av<-ruU@W99<`&K9!(HCal&30pI0e799 zX5qr56CsG1H{7s#`O4|7j8-}@@kNfnlkw_*_iyUF>c2q5^W(yb`q<2Y<-a%eXcAdT zk$}dgt<;GNrLO+U*JPbr;ah9mSYGEXQE?QMNIG8d)SLn%8Fjb6PPu>(P@Six0@~+I zt$iH{h=7q;14Zue=)d1LF)G9kAt= z8Mw+_GIT~xp+st2B;~d6;@4Roo;5Y*Qd#uIW-@{s;0yIHV>-_^*`;{08ZR|NzY*oY z$D@-j?D`f0Y}+O0R#F_kl*Mg(#xa;{{vuN2)k!5soSmQdgkTYu`dmSjm-ly_>w`vq z6?Qa+te{J=#^M#2JX;Zpm@9MVJy|l~umwG9W6!@4D{)FRhdE zCLeuonoki0U5NF|IB&FbmaL1jSxM|A%m#sK;neZ*@j#@Ki^x2#Ir1y;UQ-+zUyhqr zUrn+*yO|HKDY)6Fgh(Jq))^L6g~^GQLoqF;g$oQA(OV(v8jKqCKL(|7WC4=Pj$co! zOeEPV-MPYFFWw{)<#8qB(z&vM6zs8yrzMlkgp@y`>1DSH{mp**d`itsCMD(!xo+NQaM`IA z10AU7gzxUUD{!-{xOj*U)MX*;*tXZMtu9-i4@cv+oW8arHE$#p__K&yvlO0MsCaFw z>*~yqEF0mh9k4N{fh;7t!Fy>dpK&uSkC6ne9%wC02UtIvbW+wcW10*--)rPW9j797W4t zH>JZh9A~$pfwQG67RFEvn|0>*_|DyqEpHK?a;h@N^e4 z5czji@yg7yP{aX8x0jEy`}wP41vZk~&Ozx3(x!p4yq5}=WSg^-?^1(Om%Jd;oi7Hi z{gBT%lcyC*E~d1UQ}g4;bvFaNUe7y&5o$-$@_OP>R*YGGj{y)G35~hBep|d1U+NX5 zOSsrb(+GOn=nO67yQ*r#*WnlPZx{#w3@Ld?+%JVR(llZ|_4n{lPD6vZ)m{Sd$Z6Aa zQ(i?SZ89OpA2A6(8BYn{i8@g?ehD4#uEZ|a2$RJ5!~pv}(PwQK_)%5QWQ5CnM~2|$ z%IalFV*ZRs5&3nf;)b11kCoaf_Ll!~jxR~2D{H^Jev8hXZrlWac5~-EGx9`q|2q*p zNl8h@SFh+d=662(@Bel=JpP_HZ??{)nk*J4OsbjrmYiVCl#F4RU0WXroh|E~Un6W_ z0$FRe-rEZhW_7!WN9*j;6B7KRxaZ{DaFSFm+4H-dU*hdfwp7#;tEh}w?e775t&iJ! z$nNAfkWyE8U|Ap_em1MK&xl=i-gD+nGMxFiR{SZzH*opa2V9XbxVsY4IWuQz(!#iy zkF5e_EIRMgvlEhmVoP=L{JAFXB#=YDs8)0f(bCk+&TYXt(kokw@&SEUz7Z<$17D+1 z)7TFvl3BDiN5Ev&jl3k`h+lR`sxvv4>CA9DmIYCSa{cbtgDs6PKqu#be>&Tj@tVi{ z%9ss4EONPp26>%tztrBGD<5qfpc9*j-MrF*f_hx_I28Q6qxJL4xbU~>-5rFIs0_RO zhx&hZSz7y@>=WPZ_U8&WR%0IBo3kB?H(;ImS5xz}EyraU^@m90lG=zV%k|Jp`#yb9a4Qg_N?zq z7=s(^mg6gu>p|9>e=;5k6`g)d_>eZUjxpAKosk3EO?u>XcZ1jqVR_e*?T2Wr%PvFF z=`~I!v-2KT;=F)1ovh&F0VV|%6N8-rTkB(=38HG%vpn+z^!=C3Ttg1lsn!f# zO*JqNXP0O+isqqIGJTi%(q;=0U>6HOHpAtdjLU<*0>(MRyM768sYp8#A1pCkVA;8g znsg*#bkJ4f48!e0$QzGvyqM>bH}rp%gE@2|J7o_0VlE$rpNDuziGYt! z2+f1;?F_c)GKz^Zsxr%H*{$afZzwu=8(QdroX@%5`I9zE8Q)UfvAF+&~c@I9)|fd-_{+9}$eKwSx$LmDq}Z&*W|=wCqls z#!r8sEMgsH3y~m;8T0X4?#KMO9xe$l?X*J&j6vWxPKu{f%=uQE+r~j$Z7a@HY}YUN z{A*EMUjf>=Xo06>lst$b3C&OF6#+SvzN2N2o-G1Z3o<>A*bBQv|9vPlpgw;jILSNk Uda-)_?CGZ{tNON7+BoR{08he3;s5{u diff --git a/windows/security/threat-protection/device-control/images/create-profile.png b/windows/security/threat-protection/device-control/images/create-profile.png index ada168228ea08f5eaa533420bcc539f695216f84..b0b7eb7237e00bc620fd3873e34571a0d24026aa 100644 GIT binary patch literal 15388 zcmeIZcUV*1wmus56BGnQ1(d2$K%|NEt^x|uL24)}z4sc5ic+Kr2uMdjkX{pN2uhO@ zKmr5^y|)m0Ac62(eCM9C_u2Q}-@W&_&vX9T>mifLTv=<*HP#qozT+K(2rZ50G*rw~ zAP|T~MOje?1Ujz*d^|6m2Sy?&ZeIm{U3OJA@&JKo+s;1c5_xG^fI&)66?G-b1*+?p z1g>f~LvDaTw?Qh3PhR?_<0hddU#!Td+jL=%+j%@iURJR>8Wg+SyxFeTr<-e$y13Ot1oQKx2hLO_qHMN zpAXvx8c$aahMuR9VUDZujGJ_zScly8QGLuG1ZyhEI}E$_ z{Pn!vk;$}hTW;WmRHdhL*L`T2hkR3Y3}-sjd`fj zJZE4)xh?d2b7@)buBBbOosB~KsOtOaw=B+el?N{^E4|(jHYXc>@Z_)i%BArNc=9}r z_{3-x;)1L8`SazQM3U?2+hP+s|6y&?HK5l(mXo=?wHCT|54**3mF>DN>9Nf&Zx}6` zl&39WAa=wmtN7ttRfESf!x?3bDtY?8rnBqN?`5W11+=D8J{yDe3Z0KLkVtccDniQC zM^|CHLr&$GVsG{O8o4b_VeoEF;m30(Z;r>;q)ZKba=tsUAj=HaL!`Xw*1AD1g5@vb z61aPUJz1r9a_5udtAuU(>KHdYC!>)`S)Q4Eg}Q)5DL(FP9Mu|ChrEB!%(I(_I@r@i zr#5nrd!HJ+CwU=lGSzC?{d0Efsk69qD>XgU9JP|OZ8B2@z`IL=GX8rjBQ^YD*v!b1 zdLH$(FgkH&Qg}ED-r3-0K`p|3+%MaW>x0z=;R_rRuc~pC&J$WMUk**E&p*Nl z9r}1ZbCi>t`e`b4tHEcVAl$|?%5a-BEsCw zgfOVu$gASS*`SlVB`g@I-@XtX#~rYe(sLxyzQ3j*bG+_#h}S$tzo?#pn&ZZYPVUlx z{Y7Ly+?M0iIt8&aoQ#G$+T}A|7_W_uWMR7wP4=1({Ybs+5Zr!87J7i^sGLhow1dcL zXqZ8BYWC9iK}?Se=*o~C-iZR)s>?BDKl8T_wnuyh5;KO9GbQ{Qa(?Z932xDo3UtlL zNU&sK&ONzKR-B-=lMk1#X9d|CqmXw7;f|87 zGc8R=)IOUNW31=S&Nlf`e+uFobgo$PCBM6HL`my7QTKX$uV4uU+1f*+Bg920O_v)^ zHF2Cdcvq`NxYHWb!L|BdnA%pohJ$lX!8|;rB_$BO3`YyW%M)qh!LI?$0Dc_2T5LBg z*yVOs3-WQ}DfKp*X1Ij0o*Jk4Ndxaw$mA0U;+HxD@FvotJAhfEp5=z8-{(j8d^nn- zx5kM>mHXEtKgHP3|E4ZRx}A^+(=Z2{jGvVUnp94o2IuGI*ae7{EBGWM=iGHgyVYs_ zYTzM0MMCQ&jXSN%qRT8!mPebK5LhCKG?G2uiT-XprtD7;&RJcxIPj6o?B^v>4@5i6|6^L4?FPC$Sn-s6VF_h! z3u{R6t#LMycOs%sh|jNZ2?{m7JH^cj;JH#;%|)UcA`e)*)c>5V`$^nyEK7 zBHAec#ZU)wa(Eus(TT-&b~bJX1v5=eO&J_EWI31U-tmZc?YG8SY@qpCKXR>M%1?nu zs>wp0987aK5e*bvu5@!CP)wl=%F z1Ue46x%5KUX6A9>YlGD`9woIYVX-yN6WJ%|*X_K#->ckr@;V**Mpz}ajqNAve#!(a zbQ_o-_;R>P?z;F`orEx)9X1cvV|)4-CFYO!G5Ifl*U>Nu_~B9+NADFH!97(DlFh}; zxB$N^c$gS}N46Y!v?O;9hjrlKmXRwAB)#oQV9%0S-9Er!JEO}|lc{Z|r(lL2)T?7? zK$5HwPUyjg9d=&F=_L4p0moRqaJ3{wOkM9$1GI7^rMp{qu@7CqyOuS0>`&b5(p^+9 z{Orck*9xeuix~4{CbPRiwY<>Dg!$=U0RBa$jN8+Rm9T`7d(+at_`pJym7>yoi~?Uz ze^NN?jEjQfYq%tVm0M5p8{N&b>G#`ZlsOrySsLyBR?25DubCRec)Qd>G=LBNgQY zkDP`D@BVqT@yE?V27&_w0@z50JZnLq8n(*n*N2Em#y+OF%dwh8M%$l)B{sJ^xtou> zi??&op1i2t$D;#*e=$IXOAD7C10; z&x4C3JUU#}lf}qEW@cuIV4J@5qod?_JQbB@rYF&K7NYHzKi8Wgm0SA>U0^C-HAO*) z>X0*S@LV1IKJs=0uuHV2I`qDC4V+gNm>-YSbQ{w#Wn)+?0h`wH5uYe42*SnFLe@7B0?(0Hy`!?3_RcHG&l+~jc1;YPX#q^*2+P-l zxEt1=hTOs}!1%XxelUK9TlIX1NO=0xA8@lJBQ${Rl?3ctVNmY?{j=V^l;)&~B-8hc z?9!%YXA7WY8SEzOf&k+a2h31uA9!!#&W1<_j0XKGVCh@4cfD~FcGbAcfSEY5Z#I0q zwiUipH9xMZ(u6>i55m^n)RVI{*a8BYl=6U0L|!W9#I@$|FrrGB(?)TD%6xhzTjQsx zwCQ*1t8vBq?~s{troKaN6%{{9HilBVUz9$@5WB=gxbEFsu+9~_efxHvjq>-GD3GDJ z^Vh9IMf%H^F8xSJ-zyo4Mcb2I6fVj%Lffse)ebgG?=Dad4#L&a$et%ogr(WL2F*KF z;Tz-ix)E;n+T%(5=zR54l4B1bqfLxFm`m(nJ0d}`%^I7K-sFwxQ=?B2J1MNG5xKa@ zl$@Htd5Wm=@S(Sx4{rCuc&;+%mHU;UIy+UNgj2x4YGf0Dt-ii0P+Cy1@YatbQ@3{5 zq*RuqZc6ZqvR}P!@c=BS*@uN@5H4&I=ry_Q9X7#`s}$LJp`$bp)>X}4t!SBKWXEdBa0(`?daLB_jgOjY_2MW|8On|pVl27PZN2d!kvlbR$;GM(y>rQal6Cy$IfzElPlqt5+iRCoZOw?V&33~{$n_t$O)6+Rt z$k2_#y56z3riQ$l7}Ze96i zBpU$bAFtb9ceNTCh{Jf{-Jks7N(3L^V*}zFW``o?y)?G3fI!(^=~8YJN&90TFQ$e2 zMg*K#Jv(`Iy^01j@QIdT!KM_FR3ppeTP|HPP`Fz27 z5;-PAYTeVhnYE?#ZdkDLNia*0gyDeJxwD&ecWZnJBEfK$Mq_&K*v8>ryA0<sSWyy(3$ny(I_m-Jd&sLVQrcrI)aE*^!^ zjswv`f9*Mtz@4-H%~#Q{1TTXgi(0b$pBpocg5BN}VKSLqI(Z!gl4)(Ms;bJ#$$>SV z1HJ9^&64y8b-V!j(MAHk1h_&woHGbCBQ%wmn0R(K&a)2F)*=wrnNF&k!f4% zD=IqSk74{(Fnfb@Eg=C)ZLRZgs?O$`(h(5{{Y^8H5Iy~6k-fD^Xv@}iY{$)GnXzlk zx?kg6%Q;((cI%(!tyISjzEEt-tntEMe`c}1PXkI#EVl_kRa$8Oih_~4?KxzvrwR3e zS^cGi&YOGejvMJQW7XaPmM})zfY+Nd*-4Iv*R-l|R{W#>Uv1>%Ig8S=kQ&@_7f^To zZJh3J$O<+1IQU!zrN)*o7rAdjWXW-hdI_dMPda|DtTYEgFOnkWwe-nB&}S;D!6$|M zc5U-2;78dm)Zzg=5*0Sp;o*uhkJVn)T!%e8VgA3iTSH?Y*^qUmyU*(=gH2a4YGlqNi;n*&e8+~ znGn2L3K8*XpHmOaQkja&NJz`5?q$8FV+}E3aBOJ4o*ekO;cU(?!~LnyqsT9K$o}X? z%{BTzbeWC7eGX0=&5NyvPVESCKDGtc7%_?_<+D=?qR5@E&r>5q>`>NYINT0aGVL>RTH0ND^a7 zy01e;R(SYk2kCU%>#fFEQ*Fw0}SvkSrTciVNCB^Yo z&v#O$!yRh!$j2E1S_Ra5(&hRSD-T^qkop>I)>lT3BEk<>{Ar*fW#!@F!s`&|b?165 zd18iM!d?FruXj>`vF8$!1f$ovz;Db?;!1P8|2z^x*0>HuH&kPsjlY`Q29xQNe9YP8 zTdwAzFRr~;z-JwGyw}Dl<^}A=6AmK6vox4~piPZLKkPQ@H2P$i>z>-D8>v(a_b84} zB3~UXG*2EYDxQbNR`q_mLEmLaP|s#x=B{Ke2^g$42Z9 zOqHPUh~w@^&34(Xna^<^Rf>uW(;wB1qCN$@`teiLVti7{Q?VjkIYsugK+5X5($wbo zlTL#aG5R>?SdB7a-cjebl5&QM3$7!zVT(C9)C(S_LPG6z+o%;@a20+Rv20d+;jR8+ z+%k4Av>9v!e$y{_%_1QyKIYI=6BA2IGIKh|=l7mx40mz(ZrZP!F-;V_LFP`G@ZLb; z4H3Hn1vJDh*U@EXuahx22!027JES>dQhQ{J6Xvy^Q|yta%N?TpO*!-=JbazQR8d*E zG){lER$5W9ZJ-V+X zUgjL^lW^W_~gte~Q+fw*s2O?f+qR~MWmvJf(x zUTfA@yKclC=528MF5Y_^sTaJfe3FsCzWi+;&VoPPeHBa}R~03xYYkbKzob`%Nv*-L zS~N^gUgZIU*L8%M`>3D4es>U()w6WTW+Y}W-y5b*%n**hg53GfH1;6#?ocMSP&X0b0RAGaRg!9CJN4`!uy)LB#>5ffQ@B^M!Gu^Jb)%9-0 zwujC{S4|oJ{K$Y;o)zI=5aNLo8(w}Nfz{Ewv3rcl*9wq#*8>=6-{zyu3KzXy^V=c9 zh~zd8{0nEB^wg$1zTU^GcAVhFn5LnHrk8{?QRW33R^+R}%;#o(ywkO_?LsVOC0>u@ zj7jC&nS~vBOintPlK6L{e#Ynv)^g(heY+0pFEPBo91WX)3B=cLy&L@qendny=BAE* zVtJx~N8;Oi2|eFu5N*&Ybj+8Ak zROsAa;!h{#cnDJ7W7w%Dc-Gk za4LngGJ~bj!_=Y)4MO%q=1GAM;r_US&J$h?Dw-6c|JdfRb-@55C>&N-T#Cu%HPDDD zS&Qh~3cDHzxP?~1xmERYIia?j3xZ$(%xNe2Os7ApIFWSe)*D@^opN72#wp}CH?3xH zAvN3ZMAC9_-Rsrs3dDm!hvXIiy_l%1ee1Q*6e0Ei({S_hN)^adhVh1#p0dJ{{$p+JfJ~xq$xcI9M_1QFhptrl2qJHNKpn)s@K-B-} zjdEZ9PZ<4=!T;G_0POTbSc-8i2MFZ*LJw}Wya0EW2Z6S3EZsW?D!PLO{SP*F9gfxf zLY(;$sfMF~1lg^rG%LjRfp~;@W&S-{$&}%&xrC~$hnc&~*lXzZ&{EZ~RhXs& z-y>mB4C_L~CI}?plF3|4^ED+k?QaO;wM0J5r^A@se0m9pR=9lwG<00p#ih_@hNNsK zx34@hy*JqNQ94p3m-B^G;_V`6=^&Q8Ra~L%+&$w$dN#$&+^uS}uP=|}tUXBjdQG<^ z66V(fc6c)icF?Q*%Rw8(Y14B7BmiMgNsviyDy@>Spi;JzE~%X z>&epdd5m*Uu@uwm2%kcqz1-G4a1N6H!LR-0-eW0?XP}nF4&8Zpl%#^1hoa&=XD?^H z_>9GdG0T=-kC&n?1N$3cuUbJQ0_|n1dlVqs2bxycw<(1^%%h7d6aTvHsdKZ6HeqEEjn2+SCp z)7S6JbvR*}mZwNN*#hF*)_@UrvYvEo|IEWNB{{K=a{B>SzNZ1r7@0Z`nr}tj?gw(6 zFBRbD{<)dw2X|`f)i`rIs;bSZI;!(+D61%|xrsOgrDl6Uc`527tv$5vp?z${3bnt@<*3y|PKE(oP%V z?q2Ny@0;MzYyjSyP#Vh5&oBDM@17pvG!(lFrV%>Bu+GuYF~6^WIXb4NSFnWm3Y#P% zB_P*oCi=oNASvl}oxY$z$TjRW-8Y|5{~6g!Nozf*;<67Z_{-s&>OPz^zvzjc*K5E) z=ZfT?g^7N%E}5_3x@Q<^vgTIW^vTU$V{`B|jQv_oV1t-*x{)9_M?AJT5v}Jm6tz~w z>zQ}&gJ7kePp{V{Tgb#KG%N#`=PgL<@ZL@>-qJY7)J2z9D=-A!4jAPZC4uLl?0qA? zq-S&L)MAnCbKBkkl1C81)2f3%UMaMVJB_O^I;qFRX8JF$END7`!Ae=*ZDL}mN}*5k ztrBID0VhGSJ_alu{TAM?09VRivR+=Wmgg>qJgSM0`SL-CWaHG;^>@(4Z&9;~N+o_D z5V+80W;mRrNOQ%#kbAj{tM{GM4uS5WXDN9|^xmAKh5^H2Z&~!336wYf1`^i?K*I@s z#+2PAG0OD{uC^Zg($y6w3yj#v8q<+phKa1ynW3zpdfca@k}vh>mtxPRjsNnu_Y!@? z-yqc^yfm6y?cttG+i3ah7f1m5?b|o~;$f#IyPwuDV+DnE&YwySn}PAfcS09xDk=e? zZffLu(nKha+h32ndz7;MXa54%uQx)J5#cxSto)>1HgL=ry{_$fSjaWYOsiYB!C<&3 zW6Du_{Th>>?XlX}fl*v~sk}?EELXSIWK!FeA=QdIIo3m?H$EPyC2Kyp6YB3{6O>bQ zp+ow4mMm+Q$eAw+hP>2cUE)N=839q){;h&CcGFre%!@EtBd_Xjf83n=up@?+OIbDY zk|$|n1#dtgmh!V&fR?Z44)Cyd<8RkO05+^JLcDm`*rUQIMBRAi7U;xDn;uxLs6}@6 zyEyuTWANFt{kl3anrNy3E(&(c&bxDO#ZmeW#%46OZp0D|xJt+?}RQCGVe5fs;?q~{Uu9QLNn%{Ndvp;K41I(fTmliITPmX0X*Er+h(HB1eH z7eUDs{8Q|H3vsnm{;H|+ql!=i_gyOHn>B~qrbl&)URqHlCe z2f?Wm4EbU>w`@Cx{<7{8`AOMW55|)VIOcfo(VGle+KANe>O?)gAIOoYlkQ6P&XGF;FKUFy>S!lafM1xQ*xW{vTfYCxLUpCr&{4p7G%6nDN~Zm#9pF) z$qL5mm)1sXM@)#9XR#HlPb287tc+0O5Kj~9&{>V#a54Md&qX|_)cWR?y|1OZX*-lG zL`$#h&H{hvs(U9m%271V2^~oTicz|{He;Rkr7qF-mI(geGCglNa`$(23yoZa$#zLE z@d+Ywm9YFtDb4wFEda_CsmadHt`AYK!E`no`8*Tqnv?>c$ZQ0eOl*uQq*MqEr_R zd}v4N%IXo!zXq_XFx-s1ZPDtlvi%leV9zkoF?0dw*uOd1|9#U@U!^KD-cTuT+BI8P;P*% zc0_CHRax$8qHciB!SxO z>6?Rc8#y5C<|OTiy~-y#&7z}+En4@UF)p7?_Yw{O%ZA+r@2fDj7vRfScHF57psJ-uJ5N za=L}{m?$!5)_QsjuN`l#jrHvYxYGi7WUf&KfZlc|KF;R=knt}>zZ`Cyh$qkO{{8_J zGF=7=nSTDQq%vCp*tD_EOchzc2# z`pD+T8wF|))yNfx6Bj*}4(gnpop*gMfd<|#O*NVyPc1+)Cp`~#52GnbIAx?R*UcK$q5?{fBzw_1Geg|(FbgOjRM6`EH~;vGpxJ5$0aVyWI8V>kUu%tLuJ69~fM9H1_@yX)M;bGwD`n5ApANH71*_Zx$7i zo5lSO$=}WGEk^bqO>hP>MIH0~GIJehb|}0jN0^H92iyqfhtN>tQvKTP{EKPB_B1p! z`@W5(70G$f*q>l<{b_)HQVeEfs^I{+zFCfx2EX}q6S+!K0BDijvG>~-9F!o$&Yd|A zg6%53*hXeweDwouvnEYmwB%0NPZHhm^qNrM3%#j2-igI=`Iq9Dw?BuI(-Y4wWhrJ{ zkfLiW_<6hgWVyO(@B3N}b)!q+P#av$y!@gehU_zmIBLthPuWJ1QpfU5n@%^=MsqwDLh7_E z+56zU|9KFS#<)p#=l5L~#D0=UaD~b)KA~h8n1M+>EB<~w@6JL8ao6Sbg@V{)KAV8p z*oCrXX$<0U9Ur4?Sn8YBJT;lwK~cx+_@aX8p7Q3S)&)AB^11@ENM|QG*Oz(D-3`@v zt;!F2!+r|`K`l=3V!pjgLZz*}*iZVnvCenLsd9AgOJst!C4%7*<%wsY((<@x{IL=!4c$(|cXd6>62 zz@yxpZi&fA*RXN$0jf@8Uu&GjuhWs`Z-$HXn9KqHy&ugXPd;BZ2L%8@(SMx&mxuWO z@n@r z{PN0GFEgv&UXMt=rny(3LM7gRQ~2)iEL`v)ia`ZS)t&14I?{&)7cx*#uS$ux_9idc3rSg>z&^Qn*|WvlcjWi$$ z?tYXC(Y%m)=;E~R`pjXy3qJ>2(|r2^UqQICQUpKG9q+e5=FfAkXflS1Md~t z-s{xcl^1}h+b8O%U=sIHZ?f!uB|_dpEssZL<6yK>(3k+^iQ3>2yN6z*d^SFNPeL&2{FhUD{-b3sl**kh_uz+l(|_KfQK5`(c%Z%B%J{O_EcV zRbqI!gpW;=U~Z_=s)>N0TFODTl@FeKYBIjrYwV%#SQoC4PT$o>+blE~>JPMj6 z$XXT9S*B?oDJ4Vtx!9O7SJC{rLPH!E5+&%35RWd~&WR%o*ITeyzCNrCZ^zoA(?3H;2i?x;%!-PiFdK;+9vu02BtJd}7dxA4=d5L;D5VHr68?71gq)rFP$ z)*TX6s`Nft>5@l$ zRk04r5*tuj)#+)LK6W>A71N+|#{3_rH?P|0H0eu>#NPq3%|CO^3}2D`+C$=MJIVF_ z`V~K!O^8*&n&0+tR<4jHIFMno8mzVP(l%Yz0CRE|Q&LOyUe*DJf8)11au^tRGRI8I3 zkL(*vb&eC1E1G9%&9#8()o1J7AV=G0d5zO4gx~Oo(Z3wbdnU9emGXRE2DlO(B1=xa zzp(Q1^g!gU`&lW^*@|cjBgOS?5%H zuz8%PEU5ly4=kv2M@`1rY9X!0Jf5cB0J98+NI--n>SA1alGII|FLx)Gx+X7|oLlrx8W@mf!w9xn&N-C|DG=gKGZulQV-g^8|2?jWrp!FIbxHTsVX7_{vHF06 zK2DfndQ;MUzQJ6erp#H=hY~(U!n4S4y`nq^Lf%SNgwr4h#Qj;alSX1eu%7>3O-+3f ziUuc;V{tAh6eI{=yU=2_e(kqdAZA&e>=YzN9$*QZa;wW+IlwbXdGgEcdxVLFqPg?? z1(ai(oKG@vG(lhu8{+cw9354qJs0^gzYkLd(Y4{|qd)KvpRCn`-N|$B!0%?o^+J=8 z+sP-VD`>BiQ*V)rwyi%o@MZ*asKX==C|k+o{JN75#n&cYpT&{O@CWbMn!E$IGB6wO zKh9zTZ=jo7|D4J-tc87)Cn`?;*~d*s{AO^{U=1c`QR1hzA}28}D{sr_f*>-^&&P!5 zNe1#VHJd9`fyw&>@21(I?bTwc`~ZksNMR2)jz2IM^piOO$zI*J;S z!G7GeB80vJuIW!1Sscb+gWo9aM7XrChqALlww6Gk((L`^d-4xTuWqlpC;X-rx6#Zf z8wh%Mkr;j$l@^4qTho2sq_k(ie>mMoXS&R^vOe5lu<&xSr(iWuDFBRbF5KBHy4xAh zlsYc}@VhZ1{bD4azTEtS6PHyn&(7IcW`P4Im5(dIrj;u#HaC%gH+R_ zr#<1?;?d|~g#B!P0h99LbB>Kh=|)K+EvW7WEC{Z$8F#Vv1K*|9ilArMy_3aG#c`A2 zrBL(W=Iv7B?~FmvwffI*!=9OYETFGJA*W%^JEyk8cN8Fk^pcBTTGkt%dta602ZOmE zXhz(8-yrAP+K=DhA&m^(d6eJjewyWzxfi)Hy*czLMAw+ieh$R{V;_T6Os6(j)a;V= z+V~`*+hE@YYwrBCt}bZJnt6Q0^T&Mu_=m$(bE9tXv^kRD=($GWNzHV~DHO$0 z>yLF{59{%Ad{E@*q25``(Y&;er`Z*loT8Kf)7 z2GDXx(bH4?(AA2v(n)Gii=^+&kr+_Fz?0nW3#6ru{$JEyZ1V$$prFft6mtI!6t~F$ zZUp|DDQ#qv0w6nD>;5ZO{tq6(g?@Wy$Nrx#`oEoO`(S5h?iL92_61o!+B!{=K;aY* Q5EUR5B@M;0r?1}sFR>H}q5uE@ literal 19760 zcmcG#1#lcol&)zpGcz+YTC$i~7Pg>;7OMpoSYRYqMA@Pij&cv$cj&GQN`@E3%$ zx{Uaz$_e6Q@Cvl0n3CA1Pc<<}uRs{^I)bCDuJfl)sQv#e5J^m^M4vt>4#-K0X}TMp zWg-}3nLmGY$?3Tm#LT~4loCU#dp7-q3)j&@3=MsT@&q-ALo6cUnBgSOIC*@^b*IqQ zr{|LbsG%~bkCyzrwYTci?VmSTG*z=oH+!EH;*z7a^6Z{L@4bnu`Q>rJcj0v-eDS9} z4~l$xkR5r~^=Q5exsTm2WZeIBt)=d<54;U$@9?k=W{5rVp%)Sy7ymn=iT-7+=}`0z zS|59)wyLh~2rh9S`vwvcI2!)H#WnMRdH1dPn7B3v(R+uiC{hvFCuwP-$;zJlhv)9a zZX>2X_%&Zz07)o>6~R(`6WYteY?%D2wvl&`L3URVz98^v&h{tp=4$jTd-o%ka_Vh6 zrJ4zdaZh3xRpjNJ=rc=XJe9B~P)ynf5OF!4fkDD$?si=?C?YKx<5>g*pozYsyREz8 zxwHnuwf(ruKl{eKo)O)(evPAU>bdoPzCNAVXus}B36#f0O=lT3#TlR2)r|2t^8STj zJ@@(S>Ow-{vaAHxVp^N5Ba8vd(zs+9If5_*$ZARI`wEhjmL8>ad%IgKlR1M2rHlHC zYc@q%O7DIB>QzenrW z2J8D8z;+u|+*L%Otvw^Vd{MA;?}6ac&|I{LU)b{N^ABEL`!#xfCyhcyv6uTZJ1xDj zWEKvq8ETia6`X9}_ZDL9BN>TirLFT+PE@xHxuHPcSE6}ZyyUdi{_*tRB6&Wh_zv5T zSG%c#u8gQ8f`K7qKKNXg6N&3zfh`^PD>k7K5fVUP4zmvq4o+0G?=meqS=s~e#kjq3 z-{2K^65tLLZPAX(OaR|C!afb1d25QSvjxn>*IFVr5l)OYMGL_E9gG+Iof`DIJB|x3 zQt3xR%)n&SK)C5%;mFg*&(M^O!7;SQ?N-s}-jL{5tzTh7GOYb-mfOv)~Bx1jH*|)?8z}LJN)*9 zKKw;Pk)Y=)>o(7Z!V|HXS)Oo`?W=&hf9cnp&QKl$_VF?*3jZ>uP?+p})#+@2!WDfa zZd_D<$)1$1{1CtO;Du|L(-K>ysAIR(gw``EOL#f8ou^CXwC26fQx*2TdU~Y3kUEe!SKZmVwr|M~|_~-%&&}LPn>z7J_*Kfu65pH9mx!T-z)71X73_~;{bZ1Y2vtuz1?)7wxxYxc%Ae9=eZG z>57alg0AF=o||;*DZ6@FyO*x5L$nRa5jGyD_40kxM{kPYqOP35_}xr<^qs+fjWn4CMG6kO`6RmXd;i~g-YoQTP)NQ z;B!#kwcO-ADz#SCc-($e#)Pa$a)Nqyv_qHPKN~c>dlxuuq<*G-G+b1UcD;jg0Nw;^ zJ8n)2q<#j{KTF?BPRcsT*&L^QiQY~ldUs^;m)-|H7!I{Ru!RjObuNmHbcmdQI?%pu zAKJV}eqZqS<&VzHw@0mbmSFJ_+-Bss8lU8Mn{Q|?fB;seq*o2hH%XfIRDND6vYUMO zc3=C5X+B}I77o5*FK_Z+bDsR%D9|*WC$qcN6VSXHEwtAnpxqSP+^YoHM4F9l6w(&I zDn@57X$N_bwmGk&<ng#)T$Zf%Jv{xG*FZ#aW>6H zwdm{N5mJZRI_O~G6y$nW^%y;O(?0h8uB}OC6aq&%@9}w@_L=Dl%4wVE#))8XoPQJ1 zB-0to*(rfeWsol0i*j-#Z1QX+E{ogAuuX1@+Ut5n=CNauxE=d-2r1)b+5dX;_0ky4 zN#E{9HBIUM#eUG$_mSiSLtAs-gEy#=gQB?s1GujKPV`FpS4=BUlh45ewHm_SHsajw zRIezeKXBXjN=7-kn5qo*jfmtKwRhemcRZ{y?>yLH*)vi7`3ARn#+%<`-2mT}E6EOI zk7mbg9|;#9AFqBl!Gf4VZ@le$8E#1JZ{UZ8T__Fqo#8<6 zs6A&hiS(`EZ4O5JMz~bElPB#Ws3>xwEvPf4DX?_Ohptp5e>} zPbCad^-t=4Y6yMVT4QpAENw5&P+Bclm6FQa8x0K^l*0wIs!=;#L+uk%J8d&BB+Lu= z3K$6}JT;=*xE&q+o~H&0U~^+T zcTMnkUQp;ZBEEuKgAkzf<#-9R@vSf7R!zc0@D=Eo81T8ZV z5MjTZ_0pRWGHz0CaIA<2#6#0qI#{};)(NrsP&6wg1dFbV)vh@fn@BsobTClqxcU$rQ>g<1X`TuLQ z$7$ZgWgBupN`b(Q@C*dv7d|;gbkE}^e-U&;P0sf5-yg~*&wN8^Fv1I`d!5Gziyl0( zrgGYA(?7D9^^iv&URe1j*0Q4S$l1yi&BtWACQ4X5xZwT`^x2h#tu=q=um{xPA8>8< zUavnqYCH>}gr;LGC&+BoxVd$kEri>X9;g_GP+3Ie4ucOJwUs5n9{^#w`T9xwF07YF zPQvlN;)(oD9V#=9T-Sb}qG*;wbP~B@P?s6I(8mHl*b2D`KEqML+y52xMr75@>k8>5 z6eM0+q9$Q5`{WmLIo=p!Twgsf$o?m2yA#KIAW5U6v}k40wYa}EWfmxx7TvWM*?Zrm z*jwNH3IDe3@_p<>vg)`7o}IYwd4#L_Dv`i!4#FTI?n)Ee3t48QWBg}x3-Q<|2Oi*7g0p=p~cFO+I+Rb#1n-X9o&OZB-0 zg||x(GYEpr1msB@e<2WRcgke0tsRyr(`CVMYGbEwSs zX@-XZ;nNRKUru#Tz72IMWS_ccQc_{|%4snSqB*WIZU=wqVH9r5p>XAwV8EllP@si|oX@*0syKC^*lD0W7)FNd2Fhh*bqDD5sx zLPq|uGWNM+h~w@#uQ+c+FtTF9_sj@2C&v#UBOTWmeixi0tM-?t8tsjL0SkzOvTY!VkXE z`;WNB3HR`Qk%xWpnlc5skN^5r8-e|iHzsqxF#_570uWX6V<)YG0=W<11K)Sp@^-aB z;W)mG9t>m^P1DDFWCV|CLzMrb<0E7c0O$3N`F2%7%inwEL(6l3vSZW4To%A@I)qNv zF~+}~brOaL>Myx%t8ij`T9DK%=+&D97QWW=aZ|&KiHXUA5bI3-5QbMz84E<$4p4L` z>gM104`&8n_WYvfGRR1ZCpk^=xBIZ^8r^iD_m?s>|Ao)&yLkRuscF0W7c+4jz%4Al zMR`FM`nNsP<+@a2v>7iOCsoy}SC%f%Q&5XUV!QkNDCeQ?vfNAYcps_Hqd{DF$a<_| zSxu4|ZXPXxzGMhm96yU=e6Xi4h<@Xel5uFfAJut1K~6Y;h~J*&8Yw~*08j+I?A|<1 z;F14jj7tEyOJPEKzb_uzCy`}C;K=b`y85X%?PT%SJ=4FZe3fw4{^P%y4p-8lF)hT7 zz;s>oJEf`z1?p?PC46#nnJ6hqFvXaiIoEiQjJI1W?->TbFes0^yC0wHd>wl1w^(fB zc}SdeCVz5z6KVh@B@i8L(Fj(7SV~zW(!ba0XukJTW<{m+-?u-3pn$yT-V|uTEsn^r zk-^GLv#%}aESZM76LK4nNBKq%kc`RYk_G#arp=E4uBOXDLQ; zdh?_N>BxA91tLi?hyJeDW=?gCJ6WObMXBrq;jhQ?2 z5U#V~yWt8Xlucs|3K?zAB(TzwJt=|X(aKczE5h}gGH;tnM>jP#)-}%rwVoO!tTM^K zqu2s^?R6`-6p_y)2mwje@;0m7n@z4pPZ@p;np&aXvWM#?9#~Ge;p-3)F9(0K2P&56 zH~w7-38sI`Kf~hSr8iU_G!7hndlXfsaHr5`GW;?>`EuD;g;RgH5q-t%H|r|7+Kp+u zqAdqy26w#x^IHkdw;qMD=ZaDAj_JXqu7K>E28gaez3dAbI28Y*XFRwk5uzr`n(cFL z?exT4J=INoJ9w7r%}y4yCq2%-XACtG`zk~Ud)OTnYUlwEBh@?Li57enHY{k;TVV&O z_FW!>cz0vc7?FN(0AiR7VzH_4fvcVNO^oQh(-F=VT?4q{yMLzRoZC%Vzeblz&Q0;bn&``&t_!GF% zjFog~rkFqmy!Fm!!Y8d1_Y*`-RihP~qPHA1Gy(GdGlIDZ!O%XZP1`RYle-+dNY84& z*~&XF82!uFJ+3-KeM8DOG)p70PD+!RR-P2EbjqJwRV!^KOPf^9N|St51BuwK8*$GS(o%!JZ~Lt<>k{aRu>E9feR7YNp4VM!vjl^8x>t>PyoeD7AM2^1B51>0YTj7d|1^NkU2Fp{;ngQHWbpA@LIV1!|`&&cp73>g|QM9+!_4p@p?xQdwpY7ir5dnZvEf zB#*%>yn>1z;jWMa^&!s7g9#?c1xtgmskHc9vRnn|!lYJmVslz#&@LAtTi3IVR>@33 zRizt4GZNGMmd|pZA-x_p#cf5dh3_np`hzNZ<~x10B-TPg5QtIgv*KJ#&IiNSvwPMm zc~CrSwdPt{_FcqLBaa}UP-a@;A7pU|;-s1Vjm-_CJq_vh~(T%&BfHF0paZG#Beorz2JrsKWfP7&`4dj z>_DO9$zaiz1X$}bl6gd%UG5l$QtWHUg?*-Ebr1+aUZH3k0`62ZWMNO;@?zpE%osu( zoNIogQP62AZ<6Di!F&uxQN{`5!C~5z2ItC!QFF_UenoeV7ijvx8~I+%_b=fW*|t8k z)HPnEpn*<34v%);1!A_n><^aiFtVF!&W{hXI4u3|SM0BbFJ!`)^`Dvmi$Tv-C7VkF zc{LXcZ$~S?KfmQVtk{Ze{&@RFu2xj+?3_LZIo)X3G|cmvYWP`Sk~LY7!r_lzsB3Q! zhF`@hIK?qS)6m-5q9Y(9zFDbRxk2_2hv8=Om6VwpRnVJF64rJwF^J~KIfg8Z+1udy zHBA&V<Ren znLB1*Z=5-n&r@#s`YU}&`%*}2#=XP7E9z@O+??5=H@^!gZn6TT1U~5^Edo^^NN>Fj zhhsHPOF?f=+7n_N-Z8mmU8|64tsbH+Y2x9LOHD1QopAaQ+_A+eX()Thth0Xbac7iu46u^q`2DK@1IbKuzY!$=oL=-NwwP`u# zcwsk5`IzkP!EAsie0i#-{EkV|;zu&i6mzl$Kv>r7|&74=J79*f03VnVW!QE$GsC84AYN{us?g#9hqTx8vm zD0g8T2){VR4aX*f0E&ySg9g4S^&!a&<|ydE`;$K5PnT(&bkO9ODI@n56MOi-gjxR) zY=#`6VAtf2mJcYmHvNGJX;yK3-L7NK4ncX28&*__iM)E<4QA2Ld*eO0A`?xa9` zZu5}qHPlxi9truBew!b1w*SB;+e=xakLnr|He$^o7_^%E_LtZ~iHR;3mx(oSA}uDB zdf{~isZ8;XcaA+Sinr2xlf$UPTA)R`KWR>Y7N#Kjes6_c2-SR;|30EyAo?>~1G3$^ zBvCP0#S81|)*Rhk(|8REs%sfv%wQLjzNo-$lZNm9_?O4%^G87*LKfL}l3qy>>d(2t zE#4=V1a=)6gZ>q4k_HUjhK;m}0}Df_t}ZpcL27o-FuF#fKaD0bds2VgZ?~4|&8RJY z1`UYVRyF%XL*<`yfH-wkFwZRgc01#>*84NkdC53ZD}ZU-oKC6EfR|3w&XqvdnoM-w zM8Q^O?Enda>w_gW$V2}7_Bqb_U#o%AJ?2Ci&-w3-0*yKLMpnJH9^CH+%X!u>`uYo? za-C*esEekFA;ATSA93RL*&XaWDm<05I@NbUp%<#)o~{EH;~Y1-dYeZNJ*i!u;Uxrp zBW;M#`P_PNd7VAB9LZKbPOdq}!>U*8JKkpinvTICaLyj&q#R7D=XY4ED{48lHlyy0 zSy$`T-5e=!dW-6|dQAzy6Tkn0Af%R_t_Lm-I+gnGqQD{qP!eiBHb_S3_0;7e%?%d! zg9P4OhV)M9|A?4oqL_~96d?YAN%wzSy7K>?0^KQe;cQ0#o2f7RH5~DHTuUL z8vl0u9@Wgwo2Zrr$($90Gm*{Z=)XbUjiUvmD5~HO+4YT!I}CumQDC zLrOzqZ(Re8F_G2WvqBoKg5I-|;r#}4J$ezeMc}sbFf40UnfVoFko#fiaWlS@>O^RB z`VAE#jUD4J*sLv8ju5yrj=}}!nHh{Pg=$zJeXR!zf6WLs2N7x3Ww?aU^47LZHsYY% z^yi&)rF4qB^gxVfW@ZV@!hvVgNq;kJ7#gwB;eKu0(XkUsvJZHM*$=J6=BM2gI_LW zuV?(8Kr3=;2y6e&t)iI)twfg##P?t0OHWVIYZGPnoSesx zWeBy!vbbFLhYI+O-#9F&p<`p?%`I^3F&gvX#S&>VXQ-Q&Bg_9H>a3vk)~Aq(tv1GN z?b96B7N1Z6G-)!?n+6*CsvSYFN!ei|ZrIxmPeMRmjgFC|&kZ0Z=004t4!T{8H(J{< zEUW!|@H1$_`u25B%QuK@V(UeNuI6f94Gb3`sic{EHqsIv7vR^fKlHY{XSieO6j&=w z2ncS_`qrxWa=pB_sQ`wxwf&%)^>sR22$4>9_$!y4a|{)7btSC%BGG(*@p!Gcs(3w> zA(GD;U~th2MU@rl?|@WGYrgmlvF807x@|z1WZ>JnC<4f@^YZRW=5V3{bnuc_`;80P z`M4z?GNtKEL-ykWcOahX!Fey9CR{4H1$(U4aLCxn@@?0GoXQj$c}xblXZjCIh@9R0 znzKLdV=XAt&w&?WZsw=i_jkcmB2;x$1xM8{ql-6lBCV(afXf$rh0Xe_d!%x+q!XX? z6s@C^=6&Uv+(|@4nleY5O_IJh=kE*E_Z7^@zn2L}d{O)zl!78-i2DfE%zyELbsgJ)8CJ+*)^XvaD+ouw9CBsnoKe@NQ6MgSvb zvnoVoPQ(3an`@Yu2U9MsIVx;@T^*yPJBDF@k=Df8_LEnj%E=-^rfc^0SHvFAixR7_3;diA(GSeRz8CzU%i$)#6@Cg0~r2HOrVG%f`ks8gR+p)?CgXg1ygYyfc$2bpu9lOi0 zdSW{FWN8*$%WQ94V+ZcR*rRe%@X8j-nT??n2a7PuYQ^qIFut=ybv?kKLU*7>lw`;p z;Q6aIygtK{UVN`cULPPh%IfIFIUWLskm0^0g1)lE!ohZ;$Y`AH{+||qi*3B zV14NR3AkL?hQyw^dhp*AU%95D4mVu%_~804vg45|p7sm635Zw>oo=iY5+>-z`eN`(8GdRDr|x`{dC3 zaeEPQ#o6J*{V(y_#8(GO$2rx`&WzpTBy49W@69!f zRgAW?|Gp{G(CKM2CNCyfK+s+faJ@-WU-W#go_N?w-ALuZ2Ill!Up3$6S$iBRz`6WT zjcK`>jWbmrjBs7{l8MymEGFK?%r*Y)IHMj$hOoy1|L)X^eJd9C8Pv<}4XW+P@OCs&k3% zt<>xkzRODVs4lwwaTareA@_X91~YRi^v*oK=2PKva0oT$kfuzVR)~ZbJ;j6e(t(&tDN|S1hLsuykp2a_}FYfy9-U=c_#F7pN#ss2Pys2^WL2!Ma67vYc8JMqqPg)!;6NJ5K=B9?x z@DRym%j0lqmy}|3#r0;VjRWvmr?&@Zjd^D0J|p)Y<&z6!^-N(&42Gx^y6rBd7$s|$C>Y? z>=fjhlL6i{twEOSc=*sn55a3&j)N*eX$I|f|MA}~+TjRAMvT&E9IEOHGM-XQbUFYNum_G;887tHXH{hfIAMCBhpmGP&|HC1?WUkjFJ!X`(_{3Lm5 z2C+h6I0k+(XuX{k(-TMHj9mhcp_&&bKdq}dA;1w{E%{ZceKGeDuHm{1N=uz;T+K?M ziZ>HI4v$b!)oa8Z@e7C7ot7%d{auaz`C&aw8K}(Ki6TfY*^?Zt$B1VY_3Z*`Imz{_ z!!AQ2OoIf`Dq7TVpJ80#+}H1ihfTfV5>NEG?iXlSNe`P=QBV?UKqEi}hw?gXVjt?EV;@NGmgoedsf?QSA+K~U~en9tf zW-j$vp^8`w-obc$Sms>&v04Y;Nt4w{I{xK5Rb$Q$hrElh`BPF8Vz5@R||F-g(Z{J%2s^*YQsJ|ba|mzA(z^44En`NeGW zcdqD(_u5ujecwREq%1IBY5&`h%PFy7I#QZf`)Sm*utK?EzB-E`B<{0VOa*V5qQvR< z?hH*clAO-O0H+$K=)g{cW4OTne!u6F^&BG7xygYOlEe^zU7SpfmsDMeD-Lek$OkWU zEY7j%QqcOT+?R|l09`JnNwv>3qGl+b*K8+;4aGtj89$9q0BXf59Mz92Cw%}#@nj`Y z=*u_Z<6CJnCH-K;I?O__m#GA^Mzb^YsDHvhhs=dY4etEz49}-zj{TYcaDE z&c`z}MN|KF=XbVV$FP2-Eg+<}zW@gi9s_GM<`t?#tB8Ch1-65b5q&}CK9CB3GiWDF z?odWVntR|>>I(UDW-oWbdha~EEWpnd&0fmuuxHrOs$ofOw50lQpF3=w-$zzY0L{;N zcZxys*I%Dp3*Ka!IDNVa6Ty-^DyV7^A#@D2IqB))VhVS$58RzT33Os^44kHfmokh5 zd*tdx~%|-;k);GKK0=5`4B4@>(9rR7Jz1_xEyavtqG+5 zwPxkf2aH>2YYR3B%$6Nj=(Dv;U88F%c@WS}5pE4E(6}t3tT_-i{`KvdU;jzJ?vM z2pRrh1U&yy><6BbvM0U11}ig3g7}FZd1r%YCzYg$lkWlrSXO_T;Dj3FbQo8}GgtPB zjlKmsI!h4>7=@d^WN~}&=oGHNrK#^fPIy!I+6`5BjNQ%dnVoVKi8wN9=sOGvy9}pe zM3by{Nn5)hAv&~IMtdZyEsUO!2Z1PFIHv2q3lS@`ZEd}NGngaa#>8UoWodev>gAU*$IWgzI;iqe1EOtu52r% zvA2_4TML3iAl{9le;`48h~^!4fkYE_7~!uYADK`;=4c--0 z-OU5>B(0a;P`LKdzca|56=R8z(f4e6&$CK=UN9p(K}9M+Sj!DZ5Fl|{K2WG*uo_EP zDk5*HFQd5CPMWs9K9@|BTr?qv)VIXbp!0@IqJsY9Fr;~Qy%<&g>%g<4_Ib<_|6qqw znWaR)YNb_0D8B>rZf@hb>=!V=NWw}|5YgE{j;s-ZV5m5DfQq5b3OY_-kdY%Bals& zDRD#(1^KEi(qI=)Yj|RR0#lL1GrnFwS-X|7iYOUAj98tqn}?-8FRsTgUQtFhh6j8% z>THnU>e{cqs2@zRRbzmNHrI_=-HE7Wa5%i%;`Y!z{F~SgsM3}uAmK0}85u zli@G#F#miU^hqbiDu&44W3DZonA7N(VPT!)^25I8 z%FMT2c4TJ`a30kZKe#3IKS$Dk9aaDQ4n=amMnM|)P7l3@83Y@2b{b2rLSXq$?I`Ur z_@}|{1$@hX?}G85Rj`D{A6$3ei0b^uA%ua;9}H~A{qKlPh-(fJDZ5QUW1k|VKKHUC z&w4dWZCN8JkY@_Pjj4$CT<@yHPP_-NR3Qy;_F5wc15+bn^plxCz@!U758~Fh6G7dT zC!fqWSfvPk?KXzFdq^f~0DLX395;ms{#eYBGIsmIQbW>W*#kO1vE*J<$*e^VX9+_Q zsr<@m4=uxa?&8F{f`C1816yEn$(cPVF+~nEFPng8VguDMhNyHbwOzs_NtE{ChkZ$dVfxhZ$EpGJ0aSn^;`NcDEb>o0X&qOo7g z^di~;@O}6pPT`4(Lyo;EOMEj0m&)4$GJ>cNAO=3!K>ZV}y_nNY*}jGntgTfBY;~n5 z!V|*GjW4aT>AsdO)^{kKqKxH=Jk=P?77>j0keG@qaW}I}v|!|+4SNn!gV`A^F`U;p zI~3G3Ssy#DrXK$SHc`2zy&}81(W#Az4hyV!UR~GP9>rY`?A)~NwJ0H@ zjhdpeA(#>pCi|7H+(+5g+_V)jO|ayU>(oX|B{5e(uz5BNHfVwAq96ab+@^34qSaY` z*vtuMg5-HI^_iEEd|Iwav1qmCi=!vHf~EV|ACzB%d+;i1C3uHNT76*Go# zvtFtB)99VHQX%%85&Fl*%Qyq$k7hW>2S3ce$(l{~=OUpfmws%z=1!oB7b*r;^v+I^ zZ*PlQ-|ke&BxfwiBy85!AD5R}JliHuCYW52ebn2-C zb|MG8#XrqgKV$e)OHPX5(HY6p)-=f_ExBo`>(bkWI^I$Bv1dhvAQB&k-cbgOm1QNF zh5d3oHF^bJQe3TS1ViCQ$<9ZR=^DVra)_c?)M2iscHkIo;6%RYHscSTUh4SS;EVR( zcfi4M$p8Z#O>bh0hKRnaCCE{Ruf9(y2i;a*Jq^HmSye;rwY_+6`x0P*Ql8f zHWQ0iUM1gg?`Tc@qfaYX%Xob~jMQ(`dTBheCQfR3RlzrhRp9(bydU@tG~Rq62MZqZ z3ZMR~l}i6$YoS~h3W?2Wggp`q0RdrZ@nz}YBY2gSv)r(Q5Cj5^FZ}Do3f#sbBik&8 zJmejSn@{B1aNkv0UxP^3{C{>?l2SST4{~R*x=#Hs-zGw2aJy-l9T()e$b}?+tFe$ znulNDD1{v8nBzTZ2_JUqAhE(#@CQuKMr%q<>4}#}KHvJ_XC=ijba)Mn?j8C;N3<}E zF&YqKV~mO2_0htK;p|*TTJfTivPxbBsnTr!(##7XdA?{7XuF0230Crg+6KTT6p1amk) z_VY;<_V)Vd=`(^2S&*xZaQOb$+<D(WqtSt6;XlGDIPEM|8 zra*zH9pw9Tz3+ZpkRmL;Cv1s2aUmic$g<>+j}<;qT)K<-j6xFpE_lj8rJM|tV_;Jw z9Oq~hVri^qISJ`bpZ!!!W&I zpdYN>WhYy39~@epXjk0u{CkCWpkVi#MtRkLV92pB2~UDM8=8HtZ@7qv8{J?zuBi4h zn4{e2gtI8h^%){3=Su!r8p)hh1{N9r=fkFNmth>%4zI(8aR1<-XMfaN7L{Xb^fw|M zf29}3Z>jnBl`Pv}O?9k9`TRyXfC&Q5L_;2xEm2K1Ix9^8g>N&zFm2mh;u z6F}-Jn$$uo0zBG>(84|*WknNPbQOO1NTD|NV%kopC4S5=A#CkM6T^^6W(Iy2cN%Hv zXZLp3aR9#C8VFA0aSQ5CwrE%Munl@QwA)-vUQGf#lMltW=}yP9fb1( zbi;ADZ08uFw4NTv?i4y;>yR3^5H47D533^$%$Aj^nWa-j^`uJf?+Y{AZ$zM1fXm$K zqKB;p&a!@-U!@LlewN)TzVVc%w0N^GUwR|>bEY?zX_c9--|5T(D}DRZPr12uYUJC$ zcApD{f9yWAalgFOaP!fw!IQ(c*&Hz8{w_An7y&+`5`_BVd$CszTXDykZA0HSM zzs!KeHhXvpub^mFJ=|e%a|O=dGY)%pDhX-9Y;(QJwnqh z>0WB%v_A-vW{Kx3zZQPz>dIqx$f&^kyjG&BK&vIV+^OJ(h9_)9`D&bORXBsmNgvCoQ@N1k4=LT|95>SNhG2?CG z$_=ZUurK{W1Ke-_@+ayvFxHr(<^5j-qyD>!xtv69d$i6qG!)yUP-1fUli=0aow_{) zf^?|kyrT1^QzHNJz6p_-j_>ScZye|d6W9MYm@nO0JMm>6UJAzkkn4Q{yH3Q#mB;hU zD0tO>R??}LC^_h@a@P<}Lzzi5K;*LT!F=8bM@yMiEN>=(h__aFc9jq%xik6~3+?<1 zZWgi|!P0Fm_R6!IvdMf5HwK%}4}a+T()N5mKCP8G{JIz4^}T4r)I>eKoZ!iPVr6my zxKQszc@@Rqo*|tISozVDm?BXoS`Q8O?@k-ksSB_5-qehR^|OX5HY6lFn4=(!7;DQHAN)elgbW@l zG-$#-V~?>idpAt|A$5n6fv)1dt{Y?|S7tvKr?;K|z0pxJ8>5a09J?j1Oq(bI_P78)YjL5JYEyf@p(o_CiC@o zx#yenF`!Sz&@u(r)BwEJYR#TvIH=^N5PyH%D8-hRQM^5Jc?kw>75bV%h=^D-|0C5x zUN%OIdGqd7A>O&jG1z}O?q0)u!|?X~ykjAGzelj-K8hRxD9}3k7**_t!~ZS1`JjPc z_pegn+zg5v5i~n^g-IwJpfH|3PY@&329D0#C)vUpZE7m>;pojngSK}jXB zyf|@RCPE~YibDJpyOA0fnYAL~!MSCahvs5P(Ei-BzxMx0p8ZX>zV9*$Rg>b&x!_B$ z);$T4;~J*KIzNc_W*<2*b+dHy<;RS8(CkAV-OVyH3rsRmlndQSK7aZo2h$_#%P9X{ zEy%UeEL#q@TITM}5PJmptFHar)O&YQ-3h-F>jAt>D`(u;SZ|n5KbO zj*pFd!r{?y`ZIaJsb4(XMk%n%Ao+yP3UDC^F2Q@~1LQQSi}XcHOiNyW-XW6nbU!O zgy&1}KR*vx`b72^zwdh6#<<3@BPaRPNUosRTnBRBI)|cPR_e{uV3i-Ptb7$4S&ozU z(l+l+A;^mpc7m3UOpW#>7L9i3QVSdlAC^c@sWi28krqLW#8w%VxJq%O@E_Hy#p9vtf(hbJ9QdbHN&=>m=UGLa zjgy%q!jMIlc@90tsrMEe9*FL2b5co2D=D+?fQ_N1p>?3nJT}_9l%<)aAf`F(Dhb%s zqNgYKSkVofMY|J2gF?u_q({n(2h7RrzPr(AyUW2QQLQu}>sFy@v3Y`739)-|cO174 z8z(pUCm+71Ucbnv;W|SgkA>-JiW>#EG+T$Ti0VHpaCT1Tud!_^fb<`vIp1_ufBx-d z3=DD0=U$LB%5hK0Z*BHix-SV-2Kr1jv=UUH9c=BICN8Y-rlWKI(@=Rg4~#*7!vA!a zgzZffl6)Ed*DWGj0wR#I|Wx9u29b4n}fMLB`u zzAQrJu!!~*9R;LD{~wK-u@TgIseUj&hx#` z^98Y|a(R)qu;o;9Edc^I&7sse)NCEaAM3B7ua9S^^Bsd7kv{SB%~aq|qd92Z=K*ix z4>$H_;dPy`HGDJ-8I%=0@T?%+s+Tivf8hP`>9=-AWc6Y|Luxga=43M<_!;QV8`l|q zv0cY1iQUpxvj`O}&JqT{ycE9BJtOPG{wb-jmq}gY1GXqTOsaU9xNhWay;e* zRphp}EHFDB4^G3_Zn$d>#|yD-n})y`w_`Cy z?rhSx<4qxeadIY7j&bhBL`N4MdHT?j6%?AdA$m?2_&84W)Bu5Mrxf=Tl{CY+#igY} z_l4O?T6p-3#}D6S>yix496*J z50{ks7OllYoujwp^ztRRSrschaWu00u;{HSHM6tj5TX}@Wto57-#%0a3UBHMz1rAK zJ$Pz;43%C1!*J*&fTQx1_8`o-r=ajoDjUrqy%LIS8AU)d$xEn7qu>3(UzWS zx|*HTK%;xPwkQsdd`kX&nxyx4FT>|uC6>sC*Z-LkdTshnxPt^N6o;o-Pror7I&{=< z-&Xtgc(%GWCt|)e7MGE+O;Y;CW#kv+xKlms%0KXYAGp~*{e*#I(KSI$FVch#KZVC3 zS#F5?R)~w55PPt>_V`$VW{$3ny@X?4ll!FYb7#@)%5ZA-6*6w10uG&(rIh#RtMor1 zE{-~!lvPFdjv4AkVoIZHEAvMSa!=p6lGg>dAjVgjap-kVgml&FuVlWeNEC=l7VAfR z1w@om+CZ>ndGhDLYrZCwQn+58Ut2UyzMaumdIn`o2Y4kY!cx#UPH8=sha@MR8;#j?6%i}LbL z&H<0njLx&~7e=*Ra902+m);=u$~*Zh?W|WvwbDfDQKlMZPxJ{RRrG3>h;}AVdQRgY z|L#XkahyJtUASO@HU3Kl$v|!(P4|_h2~)sHE=cH7Kb$mSjt2q7hB`ldfuDw92+9Y0 zClY(5AkpG}JMgY*REkc43V!H)kPMtv<>_9wmMqiUyn!PyMM?Ce(Hp*4ja}Z#xy6?; z>769bWhO|nmVyDBpULQ6SUVzr-S3Q(_e0lLj4esg%P~eMBtkZk5-GsnC8q_pHXQR) z>{pk2gNs$tWg|)stSG1)O9I5I^_`EQAN>-UqGw9n^5%Rh(Kv1C&DKAh;(qTGCRrr3 zy&=>iBDY%qklbXh9{+_tZ|1uIIQ);snkr`L1o@<9DTNZ67cyA~f}TQX3KRTcHUK_? zHX1fM1XH^>oO-}W)9ZV(!H|z5JwOQKbhA&KpXJ=83ks7b=8~hQe+Gf=*KEDQ(RL<* z^LuN&l|WlN^sx!89RF?mGE~YMbIU1O%oXW2>6)hL=>$FL8l%j86!G4Md%-(OC&7pm z{wd`|dcODI_!QBV`0Z*Y#nMf08x`QZ(NZth^&2dB=;x4ZCDS|l^H{#YF8~MGh(BZe zV+Tl`uGq8!1ALTPyddySg?aA;nu& zH{j#C3Gd^Z50Lk?gK|0Fst=R7c-fknezc{y*~mzNfyR%bqdqEGw(sOhEk~IGW)bY++dP+NLnR_nPjqh ztnbj)k3Q#?T?QDh9+?t#D<>JY95rFmOCNHU;fedayzM)nhT)DBq@fTu%z|Tlw@;Kh z-sBpo9`Ia`Cj99&$I|WP%xpDMclEZ(`zmHHf-5oARcmrZnt0l|gkF|$-YK;2C~77R zWihcHl8TQ1VOdH0OA(Nm!0OH7iI2B|xWHXgWc<>Ymdv96aJNy-Hch#gi!sRjs>85f zz4tP5E*GWv6TyWS{HpR?ZQVGf3Z7L!bS1T#O|8!<HeP sx;KAd7~{X;)^D}s)4;{DLdSPuLc@j$f#~-Lc;#%L9n8t97V4k)PxRn+l>h($ From 3aef331ebadf79b44fc14ee681e038833b6d0d6f Mon Sep 17 00:00:00 2001 From: Nathaniel Chin <22572406+nathanielcwm@users.noreply.github.com> Date: Wed, 21 Oct 2020 17:16:44 +0800 Subject: [PATCH 006/825] update kms keys link --- windows/deployment/upgrade/windows-10-edition-upgrades.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index e2806e3c0c..ff9c6ae451 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -93,7 +93,7 @@ You can run the changepk.exe command-line tool to upgrade devices to a supported `changepk.exe /ProductKey ` -You can also upgrade using slmgr.vbs and a [KMS client setup key](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/jj612867(v%3dws.11)). For example, the following command will upgrade to Windows 10 Enterprise. +You can also upgrade using slmgr.vbs and a [KMS client setup key](https://docs.microsoft.com/en-us/windows-server/get-started/kmsclientkeys). For example, the following command will upgrade to Windows 10 Enterprise. `Cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43` From 3b8e94507a3d9dc77119d132b3005d2a8f564e08 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Wed, 21 Oct 2020 11:22:36 -0700 Subject: [PATCH 007/825] Added entry point for WDAC Wizard topic in design-guide.md and added topic to TOC. Wrote the sub-topic for building a base policy with the Wizard. Created skeletons for other sub-topics. --- .../TOC.md | 6 + ...wdac-wizard-custom-file-attribute-rule.png | Bin 0 -> 152395 bytes .../wdac-wizard-custom-publisher-rule.png | Bin 0 -> 168464 bytes .../images/wdac-wizard-rule-options-UI.png | Bin 0 -> 113690 bytes .../images/wdac-wizard-template-selection.png | Bin 0 -> 122681 bytes .../wdac-wizard-create-base-policy.md | 136 ++++++++++++++++++ .../wdac-wizard-create-supplemental-policy.md | 21 +++ .../wdac-wizard-editing-policy.md | 21 +++ .../wdac-wizard-merging-policies.md | 21 +++ .../wdac-wizard.md | 53 +++++++ ...fender-application-control-design-guide.md | 1 + 11 files changed, 259 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-custom-file-attribute-rule.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-custom-publisher-rule.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-rule-options-UI.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-template-selection.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md create mode 100644 windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md create mode 100644 windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md create mode 100644 windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md create mode 100644 windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/TOC.md index a8f8114e8a..731cab3d76 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.md +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.md @@ -20,6 +20,12 @@ ##### [Create a WDAC policy for lightly-managed devices](create-wdac-policy-for-lightly-managed-devices.md) ##### [Create a WDAC policy for fully-managed devices](create-wdac-policy-for-fully-managed-devices.md) ##### [Create a WDAC policy for fixed-workload devices](create-initial-default-policy.md) +##### [Microsoft recommended block rules](microsoft-recommended-block-rules.md) +### [Using the WDAC Wizard tool](wdac-wizard.md) +#### [Create a base WDC policy](wdac-wizard-create-base-policy.md) +#### [Create a supplemental WDAC policy](wdac-wizard-create-supplemental-policy.md) +#### [Editing a WDAC policy](wdac-wizard-editing-policy.md) +#### [Merging multiple WDAC policies](wdac-wizard-merging-policies.md) ## [Windows Defender Application Control deployment guide](windows-defender-application-control-deployment-guide.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-custom-file-attribute-rule.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-custom-file-attribute-rule.png new file mode 100644 index 0000000000000000000000000000000000000000..a285f6a6bc494b5321ed123e62e933b83041d884 GIT binary patch literal 152395 zcmd3NWmsEH*KS){TA;<<-5rWci#x@O7k3F3oVK`2C_zJUC=_=s?ogyS0TSGUOMpY) z=Y7t1exB?6IzMtHGkYd`_Uu`5uXV4;4{Gvn&`HssJbCg)Q9(xY$&+XBCr_TXy+VEL z>A>-BfBbstt|>3|q|^>E=NL;I(WXhxW?AlvgA{|>{i7&0Yy6lPEgCIZlV;!*^3_^ zKdXK`>b`^()WXJPBG&i?H2YP|uR`iIle)=;!1rDU3%xNUd}8hQK=zN7ziQ6KipDe7_UCILZF+F7NW}awxe-Q1STAw! zJs!?S3n`lH=r=@tk$F&Ob;=a=>!gKJf^SasUkOq z&fy~Beih+)4qH{`r)pjYOP$pP%0hwXiCY6MXl<3Tr#G$ZqX`4>6V@Kr?cYA*7p2%E zHYgHA5BKi5R3_Glq=J3?7hW6cl5WF?!pGoBxBI0x;}_ZPu-`P0;gaKF|F;J=7l-qs zt=AYn_#1$rFR8yujeKnxj*s0^_S-f9cMh#%)fczOWq<8|-k=DxUip$sV1Y82Q9h2G zlIlS;UC?DLw>Mhc&w1<>4X5NHh|fkXez+6??(q&cl1pMZE$Xg~q<_tAj#=@usb~zj zSoIs1;ly=EDWsml<3L2Qjl3t0&9og)u~3Gv8EYrD6MiB8afI--ZCp zPOX%%SkhDPBmc2b@3^*iDju&%_zI8r+gJ%l81rmyE8Kl%DM^9Fy)(voVw^#E{T%J4 zLBWi%WEyh#bIndrrct)E(~!0z7vK5^a?oIpyD$T~)rrbAvqm*O2N|J7?}9i4Wjv3M z__uHwJ-|CLg!0 znTrR^AlANdlc=83d6bhviJr&}G}p#fg+*^lGaO7!tLQDndCa;#ulvp!iPPJi}A*c!HEM;_>>nmvdFVl%;V4gWFQipu&Sm1*P+CHli=bUz+na zsxH+zvSfH2z-E0;g-)o^56M5>V_u$p$-?Nb*|U$Ct3JKEWTRnC_|}2!x^QBf2X0nv zGI7=m`REl&DXL{P<~wm^OU4_E3Rco_MT zz=~*v<70Qbc+1s&QB&i~K#DTs_GAiCuj+t3YjbwS(YI#{kQIn%5P_lB(4N?M;+|Kv z)o}RQjafWK*{vCG#>GBP{lWSzRgg?y^2`3zvpZhE-Lj*RK=^r4Hq}~3qaRf$Tgv&q zIGxBbsd5VYAIhT<)8lA?I(pd2*cQwj&zb1*sPkr>a53JvlNEMYf7wXbcPQioxN36rHOunczxM0Um!v?pz8_)QP2Tsj|3Zpu7E-tQ<^+7n`&JS5ae8j_>a9r?4$g`AM zHUrvgUJE!`OnIGgMoe|8tads4bqA8k2dD31VqlrtTEDL=6>`a@^Wg+mbke>C6Q7yj zvuPw(*BRn^nP+U)+b`>r3jR}iVWJsTZAGULv8``*`mg|~XfR&j^-+aPg3 z>K-Q5(59Mf9IlSS2G!VCtd+iho{kV=L{4pf_a2<&_vIq+8wcz zw*OG?NHV0u%pp^(eW#nUkLI^##K%&DpKG4>Ed7nTkN4|K$ai;j_M<%ywJj!RYvMcPXG}FnZWQ&z9z4^Ewnt zEuy%E-e;xp!C|{;A~+1>UP>Y8i*LBDK!w4YAjPY%ydD;oQnoZqbCg5 z5YVro2l^ea^7eOg40jGQGgJ{2UC$#OUE*!A-o#RCe6^uvZ;Hnh7N&7{_ZoPV*_m1( zfOvh`*cAm^>s*wy$a`rh!qz)TPB>bu06O#fC}>nz{RlR*2{E35&|72bBIY;<|KNGcqUd(`!nP!maR{VQF$cm zCBT?IM@S`7d~p@T{=$sLjb49yK?nd?uu7kI70woyim1CBbUBf#FuoKtH_9YSU={6+ z0%K>DhIP?A&p59kzPqhOOT`MC(VScv{ea?B_a>oSi{5+Qe1(#&rCtRAXJEWRAA?If zdzn#F7V>)O^yg_lPvv3mmk~GU=U>k57?v%n5iU+_Govc4+owy@{Q1!bx9ZBHiiJp@ zxjL^F5B!A-5k1wC#7Q1?C_lT2XB_R0YCcbR&F+uHvioE1V;p^So$u1it&U=@69JHy z;n-cM04)cW{HxZtp%?l>~0t-PghVovPr+~K4Oz;JF&%)K*7Ogw`)q91-W>A8)P!G zZ$M)z9`q(lbjDNkB!sE?j2{2)GhH}lbpEs?QNId_=|KOA*V})*JtUU5;b~V8)^&AZ zEz99_a$zjl1KoRPVwz(|NqN|FMowr13>wTl!uaxOyMQjm4_W_}SN@}zt1m#Qx_<(TNsF%p(LqM-fhFyb`oDo%;#RIgzlvRDB^%T6dmBU zXwA7Coh#M!EVT`Hm5PhyT1#ZU`SO(>)wZ2>UMgW6OQ5+2Bh@6Mx(u=h?YDl&D&A~_ zk4NlsxVqch0dN>Wc6Pr-eWOso8UJj#2@Ru(?vHO{1x;kIA{w)GSxjS-T zt2}lD?wZR)BA=;1z2m}Q9UE8?BuWPDG6@Fy<6avsZTVe;n5|H&yL_|W(J?N=d2B(jwHu%>vw4lyqCQ~q+tKO}96i3(?NVwN{~4!3DN zZf`e5XR)btEvd{5^)-F`1nw|$yqBhVE?(?PE)`gE11)`M^MKE zy&%H6zY}CRV3>6E6rsR8R0$ouY~_Ce4>D-YB^vNQm}&f~`;YejfSC;G$p3v2#*x$0_`ktb$_I0!e{`Hwj<@o5 zS9kXxjLZiVe~S*+l7CT__wVH#W0*8)6(CW z=)Hzg|98*z|G{lK=!EvY_Pt(WhD#&s{2p<_TKLw7N9Y-!e2zyzcvOvkn(ka}S^O`ew4 zrl!rGe_UN?hY$tOWw1^qnlNUwkW zWufZhjQTBh+eE;Kq_nVRT5GW+B4KNL7$6K$7h3U#2`FH%wBdOr8lkn>N<5_anI2n? z3$eGO&E0<7CpK-ga^BAa=I|5Ch^ffYNnHP^*>HArp^g|QC6p>sJ>ZGbdQ(e$1QQutSgIvt;=YO_m1Tvj2cB$muK@n( zF4d-Lyxq+5U*x2{pWC7!8C<8rigC^QlTf)W`Pog zY-}0Uxe+^8AEbEc;$;^&KC&l$eh4RN+a?B5K`qD2X1pWsWAHbFLgqywHp<7|f-7aU zS|uh7m+jaiP$(@Yqum#>woZ1H6Cbtky$~{^9LF5oeU;g7do=Ht+WgYiWGggEK1kE{ zPMlNCz~LL5DHP4UcP$M~l>o~5OsrS4QvX^9b0o!krjW+8yi!!HHZ@iIWDfNo$b$jx zQc*3@t*zDMwIw$~>+TyKONG>gT7A|k&%N=U{p`+Mwp9vwA^TJ2knhO`{!72dX`ECq zMvs&?rxgd2S@@{@#lJ}DWAN1mkZxk$#>{mhjwB4#O4jHUHs^y9H{lI62a8rJ*ZtvH0zuQ`QPyEmwZ z*d(-UIP>MI*y+{M!nqc~>rlkcbPivV1hp;58(1>koX^KQI2eBjlAfQ&%GX*5QT0>D z0FvFc_$%KypAs+8OR^;8)423vCM$8oA;%nXfFc=l9s4Nu)8&d;zB+@6P5csXcy<7MS$gG{VSUkze$52p+!cQZ0D~iA`0uUb1 z$EFgKjjO^1wt1Q%ssua+J@cq=7mPgZBe^w7n-aX5cG9pDv;G~uo0XOJ;O2Dv0AD`j|3841M1^dSmeV4G;l@JY3FX4k1rFqbe=EA^b z@2T}d%n^!wdw20^p2D53zr?QJm~SEczh+0_uhnrii>^;`L9wXKz^93S0ky6 z{F+Y)6@Z3{iw;e*VMEjVm0-E?#_pd|qZY3$vWD`hmhU(#QdGFtSFFQZ0dkyhD+wwn zM6+N~QgF-o|5Rj-y24Xe4av-=-%=MlDo?-kzsIg~A<;X|QF?D`ZjuRJbHjEz$@3{u z$y_+0`vQ=QKFSj5Yl?RBp2;u?9y)Othn!_qr(IaQv_Gvi9fC`6oZMHI0VFH1Z+0?I9v>8Uk?X)Xv_nw__5Xda`M!Mq#0Fg5 z@6EXN5o&P>Wic|mqN$Us@NDt%TcfMJj770oy8XI(3zS`g<;O*osv=MDIlJI3qOWRS zBnSkc@>&kOyE)rA4j>+}SVR#xT!@qiMBQ!J9>!9>z-!#pqRciOD+q_U{#ORJ9%Ufw zSLmqq-6*pQ`+P=_T$|Blae{!P>3CXqgXwusQO^hT%XF0u87ad4o>#pNAkv98%?RTLgvsRAk1isR4WE^YvgRho!2PRB1s6n0w?aS7g*c1amJ$np0~pu+TVWk< zqL8UFV}R%vJ3hvVIytXEp$+q0b&Jq&h1^iIiHStwQ~n$;ukF+dW_Z!)>J(0!qE?xt zZfSOA7L0IGch8*;uGW(9TQ~mB4bmu04qoKtbh}N{Q$05PIbp7>UQwa!ZtbRQ5R*A@ zRsv_vdMg=ygf7luQ`L%3sM#x);VRSN>4h-+lIFfWv|SS zKeeYdhjzljfa6841r6hOBCQx3eateYoPh>aSucZsSM{)s?*`Z`*wZLgdsE#pYsu#oObm1QiVM4?$nWj z{;i?f!Hs^~uYbT4jHTJ{@~|mWt?1$;4R%gv>Xn?YlBRik%ZU@<#K6KQ0Lw5GSjfK+ zYJXbJai9tv3m2wp1#43_2zDEvY->*VZ&`#T-#_Lh{)>Q)$dzI`%%E00_W`ArwJWnv zX201{f@j}z8?(;R3%OGaZ7IgAAxN4rGZdC9>Z@VhCzO&E;abBlCp<>pE(n&&NOjl} z2Fz!~cE&cIdZQhg*#C02a)K-iDiKS@rjCk_ zLrbyUd{CT9r!9~3-z*f}JYd!rGdn{5c;4fb8>$dX1ouOhZDe?>EZ9ivh<}|&+>Vgn zVrW3FPyWuKo8}@AXHFW#nc2>P?AqMo1*$lmYO))}d*hj^myh zGBBIr<_SD38q)T_F(FvbXWivH4wbZ6p0$_@gzHS5pw&o{jQ{B{yb{keZ3wB8Kk~i! ztJY}#+V!=WI0Eg`V@fAcV2)0~iGLvTr2BdWp4Tb8pStAPW8O*^vwXfcNBU(W*b zI8}|yACbd>@yiZ?`CN#TyG>ox4TB(fbz|LL^ta*EeJyW{w6; z(jM6moAE|Q$DzsC0=~uSt?*vQC66dQ|C5eI6n1(7^Z5Lh#%#)7;0^i^^~8x$gy3to(PWBlHmGfrd!G zW~bKgmdecyPRiNlMk-hB-YZA>&`k)34oYXX670@v{k7mSkJ{#m-tqfgLE^p$C!3G; zpCs5WUGjBM$*_)~TZf@qFZ-MH|=b_K!?ER9%0+!K7$B%fQ+2+wuY& z|K{u>mm865SiH{Tjgwyjc!U8ihu&Zwu5iG%326nnvKaPvn45z!z~z!ehakTOH1wwN zoC7BB<893MIL^YPZd-%`MJQY@TsT@dXTk1{3$@>rf##x=X8Uu^X+K*qkC{(=ln(?2 z+|L8eyACs{W%lKlC5ARRL?iy-8<0~OZ~g8Z=ITM{r*`TxYZqZQfo`OFJnNmIUH5Ps zH1t>+5Qscl3hoLa=HtmCtH$XB&;D|vXlWdqI(IotWs@t~y({W>yPgg~U30)SD zdkY2ccdi{y>ucZEo%E{0%%kb}^b$T;*RoHD2%yCxdA-dMSv*nC zh}L^J5g9Pkn-%Y!&UbobwU4)y~^`JK#fJFhQK<+3|%8GIMrymVRGoM;;+7jZiP zLUM&<(wcgg$+qU}H=d}A(VYUv4$Pt(sT!O`i#>D8ol;dB0!=I7$1j|t{5VS*zTNd> zR$cxQzC`0%ebt^{u+`LZ*uuNL$pPS6+W2(=0-QW&mq0``1;w?A0$q2$h#pA0WMNzR zW)x#x9RGG#p37cx1%rZlf2v;HUb}7~-+DPO-c75smml9|cHpkhgX~SUeAnb`UP3H7U;#yo}t~M3p-KyVSyqD zQ_8J}yZOD30hV#kpO((?*ccN-(XcS%_KlHHjLabNs0uVSj_a>>8EOFFIIXYxGH30+ z*NJucF9Vtz;3)CC%lV>t0Sjh}S(BMAZ#Oqe<8UO>hz81C$e=?Oi$hBnv60t|=za>6 z?r`%aYF~MHWlH5@H0E$dc1s6Dap9{Dl01Ah$lswyXHD)sl6GLIAGCjsGm!A>9c?ac zBfDdp?< zR(*5D)2!n#qLx_5cOz(ijD+taf4r^pRe=x1y8F+4CkdBTr$-+9->9y1-JSYv^L|Pq zgjIBB@T}i@8cFzsIq2S=nlIrDb@%g#wFZRZW!OwM4b!Sb;<;T;DoLbPsfN^Ka0VA* z#814oy^|2-d{J{+^nx76?%_4cMXJNdtq;Y^S=A!1jB)4ozU=cMDakmO`kvI)vC18vi%MCO^?n}*p#~QQj*I}QB^$Bkh+zI7e^Op9K&_hj$p(xw z;xLLZ-EQyc>ea}4m`aaU39#cUK^S(kTQ;LMb0wi3+Z_syFL+r{T*HU@x5YI+9+v}tC{y>;7*x8fpLg{og$*dNu8>B{S~TdyaodqlBxls}RDzBFxMjvV7s=VT?2OvH^X z<7;D9q#p*HyzIe)9!zk}lBaFoBx5ad6 z3!Nuc>&^)-$>w6>1POv0g5v9@nPP0A$?*%b{flPZ_E_J$6L382SAwm5JTqHeqf1Z< zKdGg>9uZJeyNy}qWa}uywC z-KzIx^0RP~j7{V0*YvqsUk1cLQ6(S(VYp~;pJxd|ze%*F0zQh~1PDW(_s>-8opDCZ z9;xDnd{#Jh=be@VHPMT=rOa+Tb(1S>V`ScN;i&mQPZAMba)UUT+ZV(YAp zZ=T9Cc0%TvL-t~_=7sPaW}s(|%dutzxO{$p&|+?6JjicYvP91E%?cGRvg1UhcDqDP zFo*C*RnK(;WNp5a&jKNIjJ(OuVtsiVl>_1>1ue`ecyQ_~)*c5?LWxF9w+K9VesPM~AUb=j1jn?sgW+ z2--+(w&tK(j#s;ElybKb7*TP*`&f{*TnV3L=C8LiuxzzkR*$qR)mo7?6NdSx@}}|K zm#g-eXtSEJzKOrDpXkvBjUk)U_T{OQMCnJ>9gAs(s$4ymV;pDb5pI6zZm*T4z%z}{J^(lWJY#4^7eB<2O% zsY1NJ$fU)HEp^DQ+Y%Q6#eXp$_K(}dG3G(P4ksnXOCBhKX}T4Fr`Sbs%v+{X>EYb? zIsbXZ<6Oi?15BnGg_P!>q!w@9^sE+Hj8}+O?Tx}9{N@*8=%B^+`}<7ew^;!;v^+9$ zI6m$eQ=5mgagPwJH|XhOsQRfU5$mrkCqr?+s_luLbIPZ9QjNlt3`!}C>IiE`k@l1k zU_%0v7RHEhv{t$0Q>3h#LEcZHOy@{K9CDejj-kvZ+>#vO55HQ~?d=b%%BU722|;5T z?FKK4AMykPD<O(zli>xp^nXMS=CERRt2Ia&e8Fv8+ z0~KH6V#1)Gqw!T1zlD#L48odclpO=SBkTGnPXo~!vZ@-5L;$M5AM?GDax|Ru5+>F- zf&i5e;*%?$G<0yT!aZ$_K~?lvK{b!>tsJzaE!j;U3NQWRR>sY#>*$psz`!K*QNBxt zaP+O66iPfwUY-Aq6Zu_QZ4g_iGY5_tp+!12^65QPOf2Y)gQoCPsX2RYALn;~`r#}W z%q$#`c-Sg2Q>d~YwP_A3yJ%asW_-Nc^tTTotTCNgK!9x1ht&(L8gdfij&;TFtDb(Q!9;+tX< z*yH8CeYbd_zOCGo$JAxLHoO7(u!e2bb(|q25)oIAmU93p{&U~2>M;t4x9)YDu}B zPov#)F2SA+kD{94Pc&cFB!c&5tq^(B+GQWUdZ4w*#DbDknQYvBF1UH~D|!)?#O$aj zm+^;+q6%T?pdl|)lp_W5Et z+86svF_STwwKJ?H?0xCZuF%MKw{Hr!(zF3u8ZDMIFnNlX`)qh2aR1}k~U{@6hM-bF{niB@Ru0=&*bRy;XoY2_$!|WPv~$;M8q+(D!!z; z+YiDBvzxQi+*#Le!CUcWvrM@kcKwWeU`4$=yF&!#Dr&iTWrvuN-JBsGYwMT&ycKsD z+2o?ivm!*x*{U#}+SfH{aVVmr6vdkmwuR)yWVJpm(onYy0e#(+SZ;N4<-hrad} zImkdr)hK)EGQ-{ChgwhGTAuarx(K_8)~HISRY`4z(}bq}knd=~2|AqqA%x_5QK)ap zV&Y52S!!cSn(<^Lcg0#nBxAtDv&?09pi-6H25IgH_YjO33o){CDd3RKGCQo@GXYB4$AzjfoIp(1-HIMDg3DHDVVi z-i}X-l^`yk=bgsFMq^(m24L&!c0^obkH!QMns{?aY`Kc%Y`80zlzLY4hT zqi2L_c~qHrdnCSwpD5ND6Dd^#+z{x4bkyPC=*aG8YGks`6IK#sxMr##XEmOKo78` zrx8h%)Xe%f|HbDedIk&GNl6xWRdoAwc5;2jHs^#y|U`{Gsw)AiAFIaB`eo zvHnk1AVyGE|F@)fHz#N1CXi&s(By$z$^f!JnTa#VFEPvFO9l$iQGxv^W-?_}60IVh zR-@M&&5r!!^URJf_{zQ$UdJBxUX&5!bQF!&WHib*wgBXH+>4ISD%0h9(;P4)pQfJU z@Wo2Q2Ryf1@2PeJFQ0Yc>f{o&c5Uc_S6!mJ0$`nu6sSMEdJP}ISyjFtdcmS&&73`h znOm-qAuy$z#H?YB#NsTJI}jOZPE5>}oB2H!B=_ux0CPp#Ra*Jl^96=ER@mG(R*OJ} zpxlsFy%tgy2vzZOWlbbzQ+KAjC`JvcHjO@{RohPdtKG)=w8JE5d-}!Wd!nIr9Q(F( zCqrX6Z*O@rp|vrbHC?Ut-8z=k-=7;hy74BNL2Ld*BLJ1NMYcsZ7BMmAEqC$ANBgEt z49kYN=|pR_e#C@QRejk_Jam;1eoV?Al`UnzO*QbeKm9(!^cv)Ii;qD-TDNi4P-iE0 z$jmkqOXNJCDptn5T>8g)b#k%RZX)4%38*U1CBT06P%g9zgN4;UpxT+OVe10hNAH^~ zRx9F!wJS>Bm{_wygpDq0vc|b{tH%x5%0aR+9nY#$imheGZX88VXFT|$D==*+p~jq} z>LBphT3@u3j`GwI$mP|FND?7M;VW>9N11WP1s`YS#q4-C-mNti5t)s@3J8@0aq#ww zh~3CE@`ed1@TN%iVfpnP!oB+D_Ct9f+eK`t>QrQrex2^v@pv&=`Ge`;B%dUQHKt*mBw7-9VlzTJETvt6LL+5ibn(5vF|N{Vg_@>%+DeO~ z0M?m)wqJwP*eI~q$jbGUvG(pzjBg7Q-}%Lr*9T{jXpehKCuXM%Z3g`$^w$nY@}M6F z^HKM?WE8I)NdQc+(s_$H1x$x#Wmr;p88 zCAGWyE=|$waron)mu)%wK9ox{&zfRpQE4JaiZID?P;Gu!oMcgg^1Sqn+OGSsmNhN? zv!m*@k2WW%Ud8(w4bbll*(ML+`~9cEk7P4s$2;H=R2)3DGflbn$O+>dZ=Ph)DxAJ& zy%+Act}R+A=yQDd(cHgb+5@kN(XY*B{5H(vZX_9X4pDC-Z-)d&&GtfFT2Aqf_}Uuw zSz9@zc618a35Y23pzaM10SoJPvJYArgGYeBWj?(@MBU+3fkIN~a*tj#`~7{D#ZpvI zSakTMqqc)Cc%2LL%>x;?fwu>O`DHwW(Wd+T^mxXA`#XdPA}%|*mShqnGHAHJJ(oxA zE^O~7Hl{@@oEv>E<1t;8_g@6Uo6{BnvOpANA#% zyuWNdZ=KxS+^dS|Vcs~GB6tqoY@n|EUmQV2vxgqtdm`6!ZB(H&+5DEReJk5CQ7dOpdPB*(ZrjAYWmgJ0(@kG&@(J^%Vxf`bkvHmz-Kb^SkV#xiNBso#};e1jT1<99Ws zq^s@C2s+-H_sqlFO24nf{f|#3f*Oro(Cnvjx5?IiW6o|thdQoGAK5DJLpNF#i6!Cc6psEQGydp{ z{)>pvuDeKE#&6V*3v)>d((YHtIoR79zCPVzF>M#y82V;0l+3bFv=ST~+ysD!T{NBp zUo>IEP#s?Nj~RDvPWq5yBWCU3L)Y+-kFiP#f45zkJ2fDpx#=rzB%7P02B#7}$3UK` z{M7X#h4<~%r;8X;vXJ951aD-zPDN9H9IGG3Q%WB<&O1r{s0Qp!2||sPp^mD+*3rY$ zg4K9;NUvpJGlkx}y))mKu@9*HyS<bIKkWizuq&2jUourFak$oL7`OGc6;2ph^wh!qoY}8WF{fwmLl`Wa zxP5v7cxJwG)3Lm5+07l;SdXXI8!e~>l0dhDfc0A3Bd?R0HKg#MESmYBetmxGf86=9 z)@dx*h&a(stZl8^UUp?#`wXuE9?!5?suXZB(G2HdNMnSfP{tH_sUn zO&QG-Q_+0Rum@Hq{?m-wE1M?x*1`)B6dYf#$&Sa!arksSfMvH( z&7ewFw^?+srC*QKJ2blgMtB7Lbn;`^d)}G1(Z(VDt@E#ef}*-p7pJtoUlokp#qL_W zvt$ElEkq>HhPR#$=UbVo;nyY9U@ggYEmfB&ogXr2X5(P3@M_=|))IO+on)NlO#Pxk z>R71*$wjaIemgXsdUhvPsz>B%XIO&YZZh?vJ5YuR*^BCQQtj%CAVQL-XKk#!DbU=( zoj%}C=U6$%&U!4x5m3zu%wy!=M&j5|?)JQuBAE)JmsFu(>~a|RJgx^jj)4E3i#ps9iS2FLu%Frt&g@m9ztL%w;=Y0+04t&y{tCjGPGI}doQM(-R3>Up4vMw?H zV=XssbGHJ%B*f-S=20Wv2MoN&*visk7p0UdWqjePPZt>%N6R}T(^soFU$bqahT3eZ z;_u;$QHmuAo9lx3dy6qdZ;o2Pjs>>KC#FmFqR-|_dDg;r&dRdCcom?pu_I_Oz$%-_ zRo|EeH_-O5;nil5lLv`pe7UfCQiTWC?rTWr@$RMFWv9OeR)^4>`7hXp?!-&*2tz;) zqvd&UbOuq)fk)-$p}%XU&oCwoTgsqlijJRG`R0$AnJoh$mx+|lEiNghVca0!Mj!qC ze62U7{$70_7E|KHgp6EY0*$gY$!L=gN^ zS<>>b>QkKh5A`D}-@@?>*)0G2ISa?G)Z39%vG8Kcv=Tj9CZ8YYpZc&&H5hgHwV3WA zbol9}76>-<^a3_HAgVJz^NNK7U-Dq7^O{}Ro_MD9=imEmFP~VL?U1nkp&Y!$+vGjk z@<~<)W+c3tSDeWG`KbK4Hog&*WM@;&R+tt&RwRvN3WFZmM>WpNB7Jcb%8#WY;eJ#a1tmdl1A> zWcxF2zlAV38+%DF`n6lc4dgqvCOjQBz7fSio{X9OL7%i#WPJsPnZ}e9SFoaLJnpSWtnp+? zy%>T!68B$BX*McZpfj8@>a9tIP<1FokiVNKr{{@i7S5zmHT+QOh$Cmj)(9CFlX#A29*T<0BQUw)A;ehnX$*cBeP;} zq_Eo-t`n$IY%DtcWJA@-Abya3a{M#6LbALiJgsK2Yaqvy8#jI|yY|yoJVqpbeZi0E zFOzn$`D2+_*-YR@GN(SKecT$N^3CnUJbdRX9+Eo?*Wwq3f6f1~lDSb_*u%|U#RBrU zI~~~Re%!cDYoC)kt zEea269JUK(FF4ZQ=2>k$HHu3i$g`z}WajJlHt!#E^ncGmVYXV3`H9Zah|MzXyZt7v z>>6T9xNszDX;yory`n5?5lpev)*+(0`_)9WthC}*LkxVduOi}yzu4nL9>>! zsnAaW?Ycm0oZV3-$q^fMKG3i1$oq$_!$C31jtiE}S;o{7_HdSJ>l3oosS z?qjY=ex>VXfOt!QS3|UnZ4vMQ2hHm7q)%M3x9Bii{-@A? zx=bHr*x>Br-$)|i-zcDC)gMQJ&tZ^E!e?!px6>hN{6aK7IQSL1Zx0;;!Z zzF982AJ0A#_YH4nz7A`pY)K7zyv)7;)bo2kn9wFtQ>gmgfK0EoH#1+9Z4GC;(=5z9PuPETKRt;>EY`IlBdmhE&hlQJO~>db4IDMK$YM7XVEjO9Hpbc_FQQn38*LJ6vV1rgQP_XYvPd* z(8)9|&YR)oLig1t#C*N>n{t{c#Jm%ZZArN7YK%STsK3}!L1dcXmIAvWP8uI43BH^E z$QaT0(sJOzx@*nM-x!8l;G3^(Ua+&U1_L}gC;rc7z0;O+P*IU_dJLYR_hzJ^z=eSmD zBMrEiYQSX{@SF3pmCD4r=t7WjEvA}A(6R&&R|(9N@ir;pcfZVHjb=M@rU+0k!q2Q- zSv#MHMn ze@(~(rI8F;mA>bI{|wf+?5&8W-O_i=gZ`s@rL;*8h*;#d{;2J=&y&cLKa9q>82Tsc zR$kep{El;i$;UA$QFP?RdQzZ>8+ zN7JEHDU^%$dd^rX*Y3y?0ufAj>xWwAMJ0EK#E9RlFZ8+#oBp8_el4H@CCESl?*x-A#)WifggrPH>mv4h2eacP9|siU)U>V1-iLJrs9$ zw?J@recAu>p6};Vt}CDN%w(RKS@-&_6)f=SvwE?yX2K4W)F8ScCsdl++=eSxFE-uh zW}1-$Tlv6F`;5DV=`Og06MJL3KP+;7^R9xbUZ=ryJ`n~R&5&F$qSTF1#H7i{AWIws z857Rhf-Gk5oi29AnBO;I6u@7__wsLMN)5B)-6LGAY;@7yhQms!TBz&4ZfRZmxY91a z(-@6wG0xd2wmSzA)_HxRQ9r0I@nn3vurNG!08T^q>(0S?${PHBPfh)J_DOo)iBB)S zCXzHH!;=LvgK6vq4e0lgdn3?0NJfO=uhT_;2i|mqtOZwTP$!%|y_l>0ww2z$2*-0N zYdgYTaInBWZIqY6cu;xJeBRo(6z5cl)5&lCqnd|q`V=eD@RV=&7?y^U4%rl!f`$$A zO3W>sh;*MO#xN3_OsYfnLRs7dlBhsqli*YWsuF9>Lq0SY}XT>&0%7E721d zqlS&8&^(hh=~^k>haV5|^9e3( zI}NIL^@9uyUO_j`P^BIjz>7fdheD!@ZV~Y*TkG8UslUH^@qogki0xHk4&d!6X`&(_ zxOoE+>?1R47>^CW@?ZYCV#JH(&s$zwI?nPDO0~L6bQjVM{2AA8Cv1I0@cM(Yw(%g= z2|;u^uOr!fg?@qEVhtGq@03U8sIcXk`9Nx%(|~6HtEzGMt7JJ%Z;hQ`nfP=uU^y!5 zDDPYP3$qq97>i}d3EalTkR0*bs`NKKB)UORs@vHAfi_WL!5YVpWaflBX(QQ}ezJz{ z5$Lhsqo{K@xs|6b>&jrR5(e#iCbp=e+To&O5lWgm>1YJa(MU& zWgh+{e7(K+N@Z{WzyHgf6MBlGyFBv}?V{N2atvQF`0Mf{CE5Y>KDoO*seUoh-_9Z6 z%_8WYj`4J(8MhZ*J->_euJ}(Kdsiu>B=wM3u;onDtzN9`sW)k`mo!W&f2-f>=Bc+i zktb280(o(l>E999mL8|-TA0K=RxR%Q0&2!w6lWe*!5Nk*xTtD_lElZyzS~*8y4dmI zr`!~;P+?s^N~OX*$s-L~aBqeohx**llnJYWwxKaTKJ?^FP&pGOGj1iRx1XT#a>0f7 zpZ@fu66bZ2onAy4A1%2*_3KTgL&IbGQTV+??fv`rRso ze-Z~;CX4ifH3)}n#d^Hig~P9yM1kb3-}8=G29kfk_8LI3$K0~F z3s^a?j5cO(Pl|2-=YxKYWeqlPw~oCX(Gl|>8oH&S`ah)g?fXJPP22GQ9~ODjcK)Be z#&@luR2jqsDnQtoF*>QBLS6s8`N|@DI6i{kOoO97RB=XBt8VuQ1=ubT*5t$_yBzD` z5u_`ox^!dMOGY+u-P)Pc-Vrd}S6*7o?{$Y9CiSFZ=(2p_ExEQJzDkP_zux*N7>u;G zrF?eD@N~ATK_=5K)U(&`-UJj~sV%;%+`zt_^)0o88x9@%U|iLAe1AZ1D|~QMn#h|z zd~NvTctB&=sN@JRhSgtRNKh^{+`#KEHM@Kx<#Ny6FE;F#n2&vzt#2IvGuTG`&LpPS zsrpQePHNnXK~?g@jnFv96oCD__Yp~D6zGH(3%(`{ z;pRwi|2}xSwAMz8G(%Ykw&=q7$6RBV#Ak2OJ7=3yN454;XFO-imFkMW6k|KfEHSTF&lII;!3uzlsQ%usZ!_L-U(i$ubqe;w-}{#q;xlZ+8eR37)cv^ z3(>GR3}`>%_mgl*UE!+_sl5$u0q;yI056MuTtUkuVCRCyc7fJ!nZ@fjou^zJ9@X20l z@uDXsVNmLaNGmRr(|ccHd`|s^+LJxsSkx@N`ZOX+dy5gRfor<)QkHguR}hRQB?jWB zuqq^1e~gpkVmYSMl|4a!18Ez2lSl6SPAHXE{P5{|*9(Tl__k4}YdR;WtBwG))|aL= z!Ot#aQW46QXd{^OjwXR7mcmE|f9WFz1Q)CJ(8PngcRdr+gsib$8X>)pAH*tnJ#n0` zECsH013H(7w;u%eqB4HJDivTJR`71y3(IbQ^!2p5nuA6>jZbWD+rtkLvll<(2Hm?O z%xuzBIK~s5XRxRFB8%`vB9g*$FK_&GQlBc%Zq6-s8ud%Q*C3h_kYeA{eB6RiUale) zto>}8AKWMyZDOu0@pyve$w;y<%?P_C4ch0Y&XI zCf`GJcwS>H`2J9A_pzN+-D=Li8hko@iW<}#*1AkPxfMi1_6;$1i?S|KpRFPb+*J!UK=G#5LwBI4^v3Q6siZ?!xPc$!D1sa(8 zJrjI;n}JGPF@}60_$-!7=V?OzZ+E`dBk&V+30o2xIG8q-PbQj;*4wY}eI;Kk)al_Z zNsFI?mCS)qqF01dHj77aklB5)*^^FK5PdfQ-+&s@@EoU$`~f%8kW#$T!E$L#eWi`I z2lz(_S7mp!NUoiT?^H+&Fp+ELOF4!A*JGQ2G37Mk=yOzsK?aZd&9|y=_`9EM2FFv& z-jil2HIAo*7w}sD_{D~E6P!pFiScZ!DRq#=De6{y{@dPcC?}y8L3h%jN7`D9WJUO3 zf%pz~KK&lX9Ib5!*t->}jcrxmc}a1!;MgE98en{z-93Qo}eLlEOh^7nM@9<+IQP((fwZ4koskiZ; z@T0Id*?)Gh98|+s5TRd*T9Y2z$H+u z|KJZs&r44e%q5zR6&TE-3EA5tqgk=S&0l26sh8Gh*vJ>DUd-AOc^jqhdJ5!u73`E` z#?G4~f{4O2mT!_Avr)*qKQy+2F4=9UnxK@c%=y)>7>GjTW09Y#I*(}Vl1)010076y z0Jq1u6Y+=5szph)!;rYMn>Y8)lN>PD^yR0B9n|uMgn$$w7Ad=}VlT3Y!DQ?#6)o?cn+~J8q*Yc%5T9K~ODrj-b7JH#m`Ub+%!C zci6VafQ1%!;^>QhI>ssA%RYnQN1E%(k;nzM`a>^)`05U=0EUnzq1E-_FGDrzk?JeB z5uf@g1KAGr7T6-x4jOoW6!fuRIMBI=skZd)wsw+ao>F4e;Yck#$2@1Gr5rc^Rk&jx z62dW;TVY1zw!=}8@xOJ&DP)``JY z`|Q&jeM&wKp{kW}E*<#tFiS80Y(Rcy5aDrRO%cvHQ9J%m1a66J;+9C+GSJ{Vwyebev~QvJe_+EGkNS{ ziGn*{NqpVx6GOd{d(kBC${l$6xW%Jqt=rI%+#n~V(!K3XNvgm zAEk3(tRNlZD4H;3^>qzi5yu8r!9>nA~bJbnT^?ciACWmi|Kb>@}7Qze{tz+FBa z-s8@`;aDkz(`bIRnN0G5JM^6d%;gTjCA!}FOM!xi+g#gIYaL72!wt=dZhcnlXSA)B z!OYrH>FG94RA~TT=$KoID&z&MdM5}yP)Ny+?vlCv2{dH>_tDb}bn^AkO<&97EC+v_ zSkS`y{PWAT^kljx&w~Sxz=H6$;Fw->XRb&PAC8I9aihM~S`lhwtS~lQy2@w^lrr{` zfn`|MOYy$B(`s^GTXHlwTJd=TkaYDIK6 zV)*AG)xa;z*rv8bZ3Rt^hHe?VcD(5GIedWzN2T!>&MHscrgoP%)1I)A+G$J~AKp;5 zzQd!8PpwoPr^TE~#>kW*oU>{kghfu?Fis?YX+fG^d)%@RZFa7SBc*$dQl8;%a$o&* zl+5K$BlP;P=dnEF@>)9nb&ZEM787Vc7iP~ZejbD8mCtEZXK2}XB%Gx$7{9sh*ByY6 zFLl9TD4B4$Vr?Orw%5IV-@Z)C~`gtzEDVqH^m*Uxav5vPt zrwKwoKu19;=vufQrF4f%@tL5O&(C$3OQ+68;xJ&liOiVVVB=lO?SXu(pCOhRC~}xe zL3*N1N&%|nqlm2B=%jyRE|}529;9IzxH8Y*q7^)yk&=z%@?;#fYdKxknei-o+;TtT zx0tiKbjz8TLNYt{==p$L5sVW5xh^$ay&)ndC1}ymhxVcohe@TSn@6Pi?*{bPYVt^( z>~oe~27hMBI$EAfqv}x$fyC3_XVBqddJcJ%zs+TDw7R5718kZ>Fqn|1#$t;)r97v9 z!><;My>Ep1ujs`l&@Y2MsB?Acax$)YFL+d;AF5K@AgtwkQ@wX2i~~~xlk42Em#;a> zWTxnAx$1l`%9o&p@C{eiM!s}UyUZKLz&1PY6?NV8YIhzPx|{JC1ioOnbDC`7gWg8@ z>@O90IKoohtL0n{-yk;6@XP0bZrqxcojehuK_OR_gd={G77r;{P7}KjcPojio21aD z#qW?Tq7{c~(7|*>@?}cZRev<-Xnkq>AxfNEfbDsHdTIU_W2lc(>v`+>EuI^g_+TyC zyKw9XWrBkB9+V^n`mA@tf1sS54F(gcrooU^kATLRmW8U8br;lZ!QNO_#M zyR?itS`S8(p`a>jp{uXpgzkGIhCOcn zDHIbC8k}<%B8E!N>HqSt+UiTrpe?|rAdIybq1GQU0uLZLZP0yx5Giste9H_a$&Ypz zy905pF(h0L^BOv_O9@Ng4#?f&`-Wp)Pu#sg;wpzF{m9Z1SSd+Om;sPb6ON_Dnq%fs zQBsM3s^&VJYniiO^=PC`AqJ?T{qPNUP_}DqI%*LRs7(F?Qd4WU|2?p}`li^N`NX;lUhgI~$dx1T`5WAWs|s#^$P*64h`;eV{ZLtQa*r2pv|Dk+MgpqB;Cdr_!M2 z^VF-=WjSwoQSPirI-NmbFNn1jh5xT3S1W`3X~hnkDVgW^>43AmYBe{)=SjT~Ap!g~s=WTZ|=-`V0p}|Sh@WT|o2e?A1Pu1dzO&)0_ z-}=??&SO_k$6QqEw$eSZ1%wx22Kd?mC{|@Q5k^RjP!6aPo$R&F7j79lH-uU|*f1eL z_eY}n5$+hu{zcu5w&*>3$-?+#x(Rcv+O_Yki@zp(eL-4EtT6s`XatywwpM>kJnQsL z@fG+9=IGWsbCr<3{X9rDsXcSTpK65=wO^uLPl%U!V`>%|#r$kd&=UNTWyq7|xtZKs zFJihsAwu%eP59W1@92jbzU`}NLE^q9J5!^*+pX&dXL-%Nc!-sN6M_UZTWo%aKO7m|Y&GD~=d8DJM&2W9ZQBjg z!-$cbImTq}$&sIr55^3V_o(FO(Is%*O1mk6PToKM}3_VTu_*x0=vvA>_-&GjKZK z$&7KmB>!>HDsFGm2iuHF^_@gKz6pv0@;4_?XbhhD`EA{xAT~d8W~dsjbzth zf8*td`y>?ri8_on`x-Y)SiMZ8d|f^?K`O+MSh-ktNkk zT4Yo*F;lP`*eg8@RXXcleSAVZwkwlz>eq!ZVy@ zjj#$M&>RA+lvCESzMiOA;(8Zni*K4F$MFo(&oCgta&k9>j~ z+)S_$cSiLf>A=qV(d6gCoP5Zczu3_u7^2Z6SGW+<`fM^bc(I=VN6r)Bq^aWrkn}?9 z#E1bn#-SfYyHGOe9nweH7zoNRf!Yb5up<%Hk(V7%m;Eps?ES=!I<)m9r51k+gRpch zFuFY)Sw2O&Qv}+UX?y+*F@2o!I|68tlfcEActzs-wW_t|Jq2d*0rtyQ4NeZPUSmfF z3jH_7TF_S#UI(xq_W(&Ekrg(n3Fpf@6!!b#japR=Z8lGYxA-k3S+}KRm2j0ny_w3C zbS`t7^BmSF-ARHw*IA0)=o5)BV292A8Jim7{ZrEWa3v6Q_CDlI z{kgRw5sf&W?~+S_vK_Ahh10<2gNM>k+9e; zwc0PfxQHG~^;hy5d3!{C#kySp;Sj=2Q>$uc7qXTYQsp8M8Drkvv1(^d^xp( zejH+Q?G}WaPWy=@Sek6pscP?A9X+_Wn9Y9K!t8#0dEw<5dFj(#=)@yk6aLYlLqOZH zuP@6MRFU4R>AVWuc8hP~b{=@Fx5QX^{q8N&7&gL!ggE}S+<tw`#OT@rtFRocj}UpfpLH?DkE`7y!SNU{0Ztweu>ptGU4T zH@Ba_Ca-c0P#bg9X1ABlz|BTuAlN@f&+MWGn+zCis7Y=%N4L5!V$I|h@28p%@`{XL z4v0l*Z@Oiit5iV*;CM#t;4Se6n=bP@Il$$YB7OAyk2vNX-kY*n=5B|L%F#|eST9bc zSAo5`zNm8ew3}$vQU>E6+r-nGG8_<+)x2pM`*n2f23Elvf@phsiRcn^z}HCxO3EEB zeu}2Kl(hIhrvteUypDamnShO3r!XtC%;`o;j1(c}UQJ=9R)iZP z%=%X-By_6LQANOYuM2}%WytbDJX)7+WkphZyjdY=h)oCli1tY)VQUIgr~VaOUu+27 zirA{801-}eN)%H~JY(01q7qB?HDVq+wobFbJ_}*>cH<+|$9AR(ZV-@vj5sR!@}Tlb z83p)4D1aJr8-He~@FZaV6ShUt+Nx#4F;;sI5_B`9j4ZbEr{0+s%Rwfjuc?pUqpwTm z0mqnv`&A0>uH_J(L$ZY>*X!m#G1%mWR@s;BQ9nkytl=~~1L99pwDiyEwM!B8L!%3- zPWhEXz2mtwETqTNMq^Rusw}se)jsDK&Fab~aZGdGeyWu{bfn@sgQlP_NfZ+jyG`20 zPqKLy1zYoxX0*<|!#+{2c1+x-^-^KwFINUdsqa*FmMzw5*I4i#7J;NJaa zTk)un#&%*`^W!j(sCCb-SrSQ~1SE-dfSHZ*7OfcN*jS8{{&&WSMy~0ph-rw{J_Q|ldM{W2yo+E3?J0O22;b2@_2U1`K2oK z_)9oUXl)4;X&0M`z8^jX-KberhmzZz>vWvr8rHFX{SLBgd%u($`dhHKD3&IJO?yJJ z_K8n`u$2B$$CrM@X<*Haxl3t`YA!(n%30Ws^QD25QnZJ>cu_Hdi~mk-_qxmV$Urc< zu!X){;&WtHaizw%_-K)D<-7IqobCkIN3Cmf1(r`cMv--czg)hx4gNFw@(D?qvqp}r ztH4AOsgD#Xkuw63T*>n0_L9%%SRmS&2wbxSSt=MExH-o`x&77@Ic)7nad3viJMz=f z;_`WXn9swC)6*xv+H(mtd=5RrnRZ%c3!9WMktrcG$Ck9&D;l34Bsm=To7W^pM5Xp2 zs6@o#gXr_qr_)~_|FSMqY5y?)r>1QG(?U173-46BP{*0QYkZmqJSp0N=z>Vx>*bv`RT zd(09C<~a7v8n6N-TnHZupuz};VA|Hcwh^ppmgONVJ?!QwyVAWoFwJGpmL*_V0W0=2 zRHsj`ly$)(zwa2p5d~H}HcVpSUW2U+vHAlW(_gx&Y#M%l4JBCs@&@Wp&6X=z=wUrsR!A@YV}5&q8Ds&Zej{b|DPO=?d6zFzSWWwxQ z(v2R?@PI|BQWG{^Fw{Tm%lcE{P1w%!$8+^Q&$7K_{mbn>nz348;qmBbI+e2b@9(z2 zJ|j4p>A@z;jJT;jnhdmkFI?qi@p-{g;qtQIaZ#{)rtKn;eVG}B=+@q{$1lYbhLpw4 z%nB#IptC@jMc#R2O8zq9vUM?lq@39 z2j@I_GS_@7YGnRUqZ5JqSmW~9kmS}3p|eYgwxeUX4yl+CI` zJV+Vmw`Ktv1#e94u8t7T2+`Q>Dr0qL2X?&+-S(0%LitcX+umd044604wIX3=C^?C# zG24f$@PjX^S^tz9VLFLs6vV|;jbr)tKgkU7yv=Mu+l@_x^P>%$U%LFJ z5NnTZK8DuRU~0-WqI#X9jGm=qLb;#5&F&EWP&;Nueh>_&J>Eph-{L;Rld!>8zP(!0 zqeJ;KR2!%3-cYnqZp`gUxF(tMLDn5fcE(0T#Eq8gcTWYg{hlt(C!7br;hzX^Zz9mI z&sq9JKp=70QmVObgwFTz4B44=^ar$)FFopYO@$b@ygtg2r`y%OasUvP`@RA6^E=YV z1l5YobawL9gQ7gKlp8dG+UPd-#>xD9c+%c9S^wfPuB~pOA#ok`Wvt+S0^lu@FFNlU zZfP}FE}+?{U-%eY(q==`2IwajYmM6Lvk_epzg=!)G`n0;^KZ-4>^U0%4P7@bBCtT( z$?^4&;ykZufYoa0o7F+9)7^G1@#^f`LA1YY>*w(Fs?pAn=F@4@0r9tXmysK7Q`vcc z?qkr9XUO9K1y)E&n(OpXcc&-X)dr#pED7CeAenp|rYG0hI+= zSs&AK4r^;|%syxEK4eX`uhZ>bu?)FZjCOryp|3jn=hV_E!b=ICb#aod2I|NyEyUWt zL0dm)ZXlmoNj_C1??ZbE0^03sHkENeB%e(`=Iib--tiDh89yr{#s~~Gs232b`J>-> z5Z&*YB0Nj47P-!PD6W-nkJJDbg)2V(O2z+M|BC7sU84MpMJjwzD3Ct>R_ENWe-acp zAuN4w_QL&U9UxdNL-i6kvzvzk?Y5{1@OiQAo%J@+=UmyP>xm>IU ztX{V69a7gEsmf-H4a4PZUXoroHnrpT$R25S&Wm(Q;CJNl$?hZ(^@G?+U2Kv2X3l2b z;OuiH6id=@(6Lz+m^sHd50s+{P0>-={`m(@I(2WvaeG7<^|U<|yOhMh5dQKj@ja1R98I#QKw|h~v0E+tNO%gyqEJmDCkZ$~3Bxd?)y<>qnMML0 zX?@|3u%Ls@_}%1mM2mrrhBYeWg(l@9o4m7JTLD%~n#oN13IEj68Hh_}=uwb}63OyR zGF)78IJrGmX8FPLzwQs2DcHe#Iu#0sQjrWP_)U8w^yGr*=C$gNk>%8Pr~^_XXPTXH z49UmR3p8alzKDijW7#d&g#4wOEM(LQ&);2E{rH?ZHnQJMAeSvl{;n%$T1HZv@%ztzWH8@o05~u>k}HJin~?gyF?NRC$w=|} zmuhJ?_fwemiKge28j|TKP+$zE!si;gTHpid3v0G&p{v`!Dt5-}_cB{L+P@7c37m6k z-D2nqRBx4QtY2yVO`xTScju_tQFy}~ZwCz6kk)R##^j(;I-ctV=ZO4`;pCM~=11~d zLm5b6KtUhhtJ3>?cD|E+gt?-n2ro}VT9k>-n(^bkH1xVI2Kcg{l6bcU=sRo3;A zwLt3dSg-mxk(mW8FZi~GCW*AVVG~E-S$hXmORDAiAZdWvw{JQxtIH;ef?__rTmC*o zTTZ?3WA8MoKav#uDl}W@!?ba2FO_8juB1p?U$PPEeaL9ud~6l))f}9f^v66hoWu9u zb&`A8i#j2BiKsh1@@kWARy2e3-#-f2EO`NNJ#hG~WZP8FwCQDGvf|}{Al-t`8OOW9 zg!lzP2JH*#-M&R6zH5v46K#HSZ-?fH!e~cY#=SpHx6!ym*~*1**NP9`@xm^YB(Dka zK$^bS-ZoT|CvqzCwFE-+ zbd(Dy>1TdlnAOT)XqWg|Mp+_0sCvA4*nAa63i6EFfW7AkElJQOiK$4w5;V7f_i0Go9fA&P^-q z`#<-4x?^+%z-pZkmhr%eEwjlVHVK?e;(J;(wA_~Vg$DTKAXbXL$m_h@7j9ghrSO=W zET(C(tO5dSdPApX=30-B9^>*MM^(r}!>?|vRKtlPWJOLcVS@Xy;JTq18j!5cZ_{sfrm}4Vn+Y!g_*L>5w@0uUK z{=lA};h^bvyQP7B#mOJuSuT)8s(-Q0lWsPu`*#?S1j?1Fyn;QLIi7d8uor(23aflE z=X)rg$G&GKFYTq6Q>L(r!=b4!5y~G~f?W&mGdDtZe_?j9^7q0&P*|}=Y&&P9%$xFZeLQgo&@mzU8v|u<| z?bhLG=_pEyoEhG~EA**e*E5YBQpon+Xl@0(_}SZy|Nall4CZC%GbfP#A2W^ulc_Oj z@@B#;CQ*GQ*m6ENKfj#}ZfXDo*DpTC1~>Km8b#q@qIfIkToe0W;Y-BpN9TQxM_>y# zv2t$bA-Rg6x9&jy7SOYy?SOpq#US86Gq>&k>1KIVg9&NhO9|dji-eHf;%wx^4);)Y zXzf#_286?l!=18!KP#z-&Yry3wXl!D%ei?A1lzPGD^ekMKMaT8;$$P{BQiK&LhqSe z`W)BVre}AnOFP8g^ntK%Olr@ zPqkR#I#=)`i{&}6_q)$jo521fbFMyxfBu%=uQ!i4{R`ysM{kpNGwHY;zI_P`}N&ig?=gb zK}~@FeEhJBoa%W6<#4T{yTnmr0$v2~PiD&+lNA4*)5&l$m=pSs@*H}l zeAwT{c#-G@U+dczB!XmB^9ahfNzLk^?{K`5jQWGgn7QlC)sCl=$T0`|7JGlM?Fpt- zW(V|srm{ z!%lxU2K%B!v+HTK72sto2_y`K8mzRsrEK@dx;(9zA0Ngz`%ZNP8T3$`&2e{y^gU;a zwE@i#Z6UdM4MX)>>(_=+PfKuxmGxwZqRilMObO(ny#i8}L}P4hyu?)t27^VP+j-3B z)(Ig=FSkuTDo29ie01-fg;cN1^(j;B{ce;Ct_~H<-eyB)hU=fjnnoko#jrWxfByb4 z{88mM%({za4IaZUac!Vk!X?qgEwq)<9@crdAydxdA&;=-tCkVky2zH%A^z_|kMQp! zpDV;SMD?b1&38C;T=X?UrCM$uCvb^1I;%$RH0>E4Mg>fMAp$wGdy%Hb9&bz23oYD| zjz0K?jg9Lf8;weePE1~4om@l>Uy(tE zoAbYYam6102|(6#7ly~;g=%>oI6ZF2>m|EuYP<%2q?MAfvGO*-*!fArSq28e(?KM70C~Z3TbylWfFv!Pe?+{G*)y zW#4^z?GcKwt{EPsp~^%`HO!V9zxdodi1WWx0uQ_wr;Lcy4vbP!#&O(B%o`;;$(i2f z!ZFbp7EO$}RlgX>kCQ$Jxv#TJu5yq8`PT@kD$r|)SP12!^O$nTlqa}2(qi_&5XA>O zh(c8!mO7KT%PgMp4=1ZG^&>hY|Lb{v8VPz7zTt_(b6|@^Y?bpkV~y9cq#*VP;85io zk3R>iF#C3sZ<5UJ%1lL4bP%zo)2=iaxssVX!t%?}nADu(vP_*sER&yC#w?@C%(eau zvre>75VT0|0`%QlA9X(DxNOap4BNa=d$eZHK9(PJMY)gDy`&%ed-V^c-x5LP3x9Rj zb!<@yY#aj7DE$%7^M)o5w?;;(I61L}zt!Yxjzd^Z}nc9&X-j@Jynr$ zhJB~tU_?A(57zBm@4wJ{`VT;TWvZ$0W}5y^UBm9QR3<6ezmd#=7rH0gb()o{|7@W* zNh3vGmx@^LjbjxzY`9-H-Y&w|0>e)g$9~IYRu2G*!)?=}1@QfObo(StI(AU4$I@!k&S2Mj=dc(9BwiUho3TGEAzxz_&hx!^F!m@ zR;5jq;sXB)b6U?j()RsB*G;Uk+x?+mmSm$q+Ut$yUKfWdU}0l-ZFB~ub6UpSygwO# ze=XYi)8puGRhBJb3O_cwL91qf`X2SWxlCrdN zySpb{#o5eDk7YCEqQk$I*~C-j{aO{4hOR_k z8k5*B%Y9D*Kma;l2Vq_&M>#=T3#SG$|81O=J>-$VyzZU0BU1&L>0Fynp{pbPA$SGI ztzPMc+8o>9m@i#>N-wyB{J!@sR#8Ho;g_(Fv=qFo1qvC_9tP-?R0VYeLD+D56_(db z=B3(1B}?q7h93_3rmz~L{4D}H#5)<_wgaERuI1(5ofQY|`{Cv_zT@|+ZJpO)ns;s9 zI5yuaOrT$ZgnVy<&9gd z#U|D)D?XSg`97M71~92JZ-+HOZ#a@Wbst;w;wjVl>b40*DDAeRU9#MC2I6VM84t)Q zQ!ti^kZn1}e!>ItwT^p%CtQU3_sa*C%l$WoUDOw59UJ~NwS;}z%RE;TesguWoH^$! zvTKo>tQY;5xJ)9QJar!|nhDo2ij1N4ZjZfdv*r=8TTfbh7RgnAys>My=%!~*rs8zY zDVP<-fS}v_ZCX>>TdHR|?O0C%GR02#ZhUc5evZo#_P*SIA{CD!u0r8oE3zcUk2#W0 zt-zsYKN94~%9Kou5&k{7ZJTlR9M~3~4{i`}`h)oPcYRW#q@voNEC`#sPjxk_`#tWw zJ0f?yR9~MO@xNj@4>{y$QtyxZbjO zOIG-*KX_+2o5|nxlUJj(yN03~htnr;HuvvbQ*B??%zk$u75zz}tE%SZP4dDziNWto zn-v(sVWYzRf(|fL>Kz;O?H~MB#`dD~calWZDdb4X<@_}JYpw@@2ar2ibj!7}=szwr z;`LKajz3dr$pGr`4x;ZiGBBJZJErDPE{6k;A(5ts2q$E8vuEqAl6RxaoNb$Ky^bJ| zUX6?KU3dZtdqzYd3IbbZzV_?3{Kp0>IU&m{RB^p6YDUVB>vtDfNz^I{|JZ_(kf$%+ zxLcFpOqH)Dqp^BZ!%;zdgr%69av>fn0g%O?jj^c~L8CF4hYWJb^2oB2%~glKl1P+z z4A>901)3LB&QL$UN_}t#nfShX8+NqxtKYV-(;U)>Xl#RXRHJNxR+j%U>T2aXf=e%M z;~k~(6Vc5RS^?Lrky+Qzi46Hxpu0cLH$gCIq5Y`05@HmRL7EVGH}HN#HbB@XgeLd~+M4h0O>y zF9i1Z8_P+{b~L=d(&8FFhg6{$)keX-f(y2Kv_S2DlPFubqQ1mK@`{Az9& z0i`jo5gHOUH5!Wc9RXd^xNWgh12@*7{3F8H`J}Dwmgu6S7-52RIS$qtLCS1UpXxu=IXm1&57u3wmgy-0yaYP^3_xxTI*HSaFBqMT5J$ zyK9TPyB2qMFYW|)cZZ-s0ypP>@AsRp$+Mp%d+jwd@0xjk=ZG-T!i#ea&OfB5FX@U4 z-qFbA;5sWAB=q7E(GXW1WL<%907%dksT#gY{tFbG(9H;kFlk1k5~z|exbAw~#P@7I zB#aL9-R7Ppl&k0X3%f-UJG%!R+Sb^h$@J+bN~!pNm?97W`3WLw+RCLW@*nhz3}$<^ z`8<%B-rU*jG;q2j(>{Jg+wXctsm9Er9?o%mrlbSsnDzeIxP_V{ZZ9MRBFz;jhdWts z)W##Vmfz^!THxl~LkYeI{2W5C-E1<1?v_IQh(Z{!Qv47PWN5^|0!E>=!x(%)*e9VO zR31_rbcwjnNg1Li42hoASln=_*R3}*u`D)|k6Y28(<6u93!~2QmB#boY$Uo}t=0bi zH_-Y2Jr`<+=b;V*dWH{clExQ&36BZXEN(Ck&EN_nS$ip#wavbN+ow(z7ruL4YK(j0 zU8ByUhmd3_fd)lYqqCjI&MCaW30y9Y6$;b+>V*-XGG0RCU2pHUYr^dLH!Wsxs;tD5#RZg@uM!O-+zAwGFNrr1w?$2R_`7iK&K6q8q7>a>Ek-XCF^frzanquoo5*wX4pYCK-0qF1 zXZ5JM zQ%(q^OLP%0)2`M~bw?kMX!uyx70Sv)KsK>B8c|`-w>#}b`vfW!f?-bG5|%a&m`o^1 z<3p#f)cOYxQrAX{WpgFEQQ=ADb=TsmstjjiXL3=cYgI_Ot&ZkO!Ys<=644#prHXuE zOJn^zIbO(uvTTCe+;x~+If24rbsgXL_g(bKB_MfFFDdU7TEVFTLn-H{_;HK)NKc%y zDW?hU@RZ@-J+bOqF}m@c=43k&-2${M3Cv>eP9oppD)8{+yA*Lu5ycbe<}+YzdH;8- zd)s{3o(T^3lRNvy_GWC+*Bz1+E5We?^zAfM7(6tQChC&z@U{>M+L`#1%<*5&@b)(B z`C3VDQv&5Q@`baq{@XDBdlWqX?}+;U{>A?<1bN`i$=MS|q@Mdf>TmUXI1IUZyuGV8 zpaE0~zX@+K=n*k7O_s6uH!NOjITFQ-n7H_&4bs^V-q7a(I$QPZoPpcmuD^x1~ zk8ymd)~J!seNn8n;S#btL@Af4u7&idBT|&BZMJ6HynA~3Tz$OvpZ6O}GP{*(Je73t zgz2-i%h9QpnKo0P8yesMj4HzMz2V2#JHqCI?L?(pMuJ~s22|e$qo>D^>NiG@EH4wR z2H8%El5%Psv9WQ&`kcH%(?gKls`78@S?j!A;(glECLht%u?ne8$Ty39@2KrMA`M0G zB<6UnMF*Frh$h_A)=w{aDyI9Fbb7_@w42QHtS@!{$62iQpToAZ%z{hvo8SG!A`iz> zVr*8M;=UUQ!>iy4c&=HZUYlojxxV`fdlnTJk7qU#kBJb59JuoWU=9(G9xAC=-vxrU zy+H7(*`Y#;&aE@Ok&ldmCmYS*+I=OiV>SQSW9$(Qn{TxDvSxF=?+awKf?|f6sDAi< z9ite&Lqye0rU_2;j`@NeGhJRou$mCz{Af>|-%TP-9`U>8y&wxDQEN8-Q9oDLTL41LdFDgFjp_AU7LVl5NUW@?~v>k6FICT)sHZ{|S`$S3p9s!aR zMoq+ZM4&MEVl=ZF?}Ea=B}Gf*Fati1e( zg;4#Ah;F8xhG1-Bto`NZXRbv)w&L|Ef()^1hLLt>!RqCBh!ko}?Q!v1nNG z@YWATJw9*{>S3!he8&H-8XNbE=$s%v)X)2&DcKB9G+U?56+ScX<^cJA^xI4;c@-&e z*o2poJm&rToX@yelryX6l*m3`+yvvbG#^_?t;?&Djsv9;7c z!^a^VPwyG5?954NQ*a$o64{|AF$a;ZZ`YUd*#MRD#k%J!T0{=7nAD{=>)fy?4KHuBY=rhJGNPl$bNvmw zS9YGAT5jjmxdP8yiVKZ|_)*SSG=e&2ivg(xyOn_hJ@JGU;-S9w#h}F1>GsaA>-K%0 zIDPSKSzhIO<(h?$OIWu(%#M4mGG={?1t;W7ks+F@>LIPkf(@ivgZjP`+i8oq+C5k%0l(pW+Mit3I=p9jCdXuqH=;y;FY47!t zPfiC+rX&7g&eqom#l4hLx4N3D&r;@3cH7K)$&5oKIchcT+upvf76gmrJ4@^xv__n? zX2|ONkJu|w8nVt%QqB3J9@K=3Y1cA#LTSSU$l40C^NTJ07%o!*Xw|g>d-bSigV`BS zH-aNF{1hEF_hPHlOE6Jac$lD9)i(Ji`H`SmGc+pf1Gq!xrS{XN3N-cbQe_J=2)TVN z!a#M?`%B&Ft?f+7P1g*Rp5j}%J(FyAU0?Qn+_tNz%A090l(nZ!aiT*^=bRi%)Vr81 zbYVoUH;QTRE3tc;zMj?na=aA%rQl$8!Q*JTiel4eHj5N{aob|%Mg*oExj_9_`_Xm)xD|7c#3cfFF*}hO7;(K@n8GDjL>;>4$odaTOGWvVm8Dd zF1N>dKA>c`_|xN-bF>@Rt|&yL@bk6C>kY!_1I|rCKW_J{0Eyb%wkg41dLn&>3+bwB zYPw19-Mv}y%w*nlZ%+jSr&Y$sH=P5Ic=3>@L*4lBK?{w5e4ok$Z7 zEA83G;Xh{grJW8l4Q7CFtYE-?1D+ntMq3mz^`Puz%(%ANo&8-CtMcA#P$!8e4{j6^6y(qAPf> zUC7A80@YoSww~#Ek{@S4dt35E%9y)JoUZRTyH=@kH)%HWwEGjck@SGk4ENP-Q|(px zWZ)uc@2{Tsdz@jI3?0y&v16`|&e}mOzr)8SL%HNM%s#Q#-y-5le zfz7IHPFs)#vkO;}V~51%vJQ|NI>?cG2HQ^dW$tIXL-uVV+iDlkg8FIedimyO zy7z1Z{Yk%RUoJ@MT-DGXJ#F$2x=F)Jxi4=Ra%XpeSUHC`8Dc8?#^jXBBDAVQur|+) zbM1dyBavTtWVtM*VUFOzLX?$ur(+ONt^)MQ{bg{gG}QgeY}Zq8LT+!>PWH`_#w~z+ z&k~{X3dxO~GxU_x7Tfu<=?3RHN~?b_7?c~-c-S8TU6k2i`vQU8;`9p(+8nP zw{(6VWS+)fash5}-G&aN75HK?v`UX%=MPv+{`W}{-yb7CHz(y2v_1JJZ)gQf{-U~O z2HJ*Td0*m6bLtehr_sNxburRilzqfFn%mM6zM?ode(y@cEjAam+wf#f3~~{0_j-1; zm{3O?Uja7>Wf9cV;SbICp^0_(qENSpw@Z#!4Z4Zv-j<3UFjsG=OMZXv@ zAPa1lXwI8&F%lhk;qa)}r2kSfOA21!-KP)NIAnp?z^w5}K=@N742P7?%3}-GD4wH@ zeM$s%yYyau)_p*1x%_5+qZzYL%UF-3RCNQh^#f*nAG;;;sRLR_54X0KB#AM62hZ-K zmIw=X`lstPv?e1ObDMeHNuL7Ex4-gu5hvqmivnF}3-0HPNI$IaUd^;FIn9gv*^#gl z`hn~lkkl4q4#uWKXrK-bwy!L|Ug?+|yn0Xf-cs7c_ud6B!+?o zLzn*%$!Ihk3ng@=GB@t$gB_j5`9NVZ#8X z-4zhj)v-5`jEun?s`oHcC(U~&ojsFOgfeZk$1I()mM3;9wKN}+g-#-=SO}E3klCAz zm*Y3qd>!4VvN_1yn*g4VfGI^c<>C{MArEt8d2QRl@OT5^g<>0PholJ7zqKKg1dp5S z1{dBQT@eUY^2KbdR!kU{7wYkio8GcO)A;B!S85Z0=uC{&M!Gz{n< zOO0J5T7T*paExG(B4P{J7^%}!W44=dQ!ZVNf)`mgr|GhMQJh8`T^(R^c$d+x)e0~Dh4 zjh#M3KpqGxpig~Vx+)#=Jb?I&e#P$VBepc$IT zVxm}gBHJkveNDBl{O#geuMZnVt(hGZwD{wgtq(!{XM>Edo5Dr(VERgRh1^ItftX z)V3o>5TNI)5|yx8c+Ru|8r$eBRjI}Sprq9;SzlYz%#_WrZ6BY8@LTeh=S#EH`S5lf zvBz{Z3X*#r$Rw7_OO7og^Dl%BRcLZ$Alwws<{pZ+MIIsbWGow%i9dUa(NG~O8?19I zFlda;#;=zuw*3?3j>!z62;3V3p7#!h zYlE6fEXK=h*SQNApv35x#$`$y$xUjHvWBzX3!G9vc8muQ3=OgQH2S}UuRllKOgjXG zMS@+PL|!mvOU)qzo>i(Je%hvYMNt^F=pHOP2Tnaw=6gSe7kumht-iRFw(k7{Sc-8x z@sJwD84v9t9k|f(a>vc5P&t4ni$w)Lf{oP!{|0UF2o-=h>L?!;O#LEBb)it`&CyZJ z+yyMP{#pDp3C>7XeTaK9B}QvP`uv!ituBwh+h~KRsQV6{({CfUGw&+}?s%_{I?N|r zKK8tvBK)*ko%H`kyT3+bykH9iKiQo|mN&M~i}NgUpyfTIz_IiTX!-jB6J_^CCqc)z zZ~FgGsIuqVL{QvXf9~beWbJmsB#)LYp6uYFPMVr^>0$AdSsqzd;9hpl`!*&g(|7#O z^`cN?QWme9Vrl$mzUP0-_DCm!%ge={nV9c)iQQ$}#1Gf-Xfh9YoA{T0RKJKl?#($! zW#k>HYN53%tV7Gj9K`){jZPj7BP}zsxnhXj*D`xUqV8+$FGA4tz6{S0gnlOvAThGOF6l2xXE}brc5Ka zD!80U`r>nBKyy~FI|l3-{Z<1^%f)9ZN7WYqIU-onpYgJv9UbIxZjm(k-<9eEbwmyk*)c43%piFD3vfeP7kT-#8u{3M#I-+oONCbLmLN z_e;r#&awL3!IR1uL}P=xkPkkFm8dM)*`0%$*_YKh1y~VAUq(kL5&~C-W{NyNr8kw0 zHkZfS+iH02|05UnO|Z^fo22daB~VtW%bxnMH<9NU`s9GLgO2v=56p1fTR8mzcr(^- znK#5|tm__jaGd4P&7cB&#&VAq#XiBY=!1*SxE-|Up%&f!tC<5?bdwyJ6N0xB+f>8^BO7L^d)&7lL5)*AHlw@*Ci z`2}|h^Ukd2NIWz2Sf{EeWiT_RPH1a!CY3%ADinLWQoES<>ULi%j}wdyF7qzq!Cjs2 zC?re0#xZod^X3X{_P*3%0b$*vz?od&H)`|@hU}7(kA^$v{W_X*tBsFb4K43=F^iAq z9cc7mOQH8JLo+tLKRQIBXH92mo4|nn4M01~y+2@Hk?){fX)%qxg`(}q+(z|Kr}zHT zkonU-i(=t@d_CK(rKRCZq!A@J_FdVIx+r`=T#`Ti@f@S^=XzTz?7javy)$dQaD*3k6+oCGjOK48L@sjUUZL zq$Ot**m1-^C?a5{&f(>2fa)kW*7#de{~ZgEG@6-ivtv?x%>KNy<4vJ||Ea(4NC-~5 zJ?1x|U3X*JDi!#}oMgGRpYzV|=5jG_dKIwwk^eVfk-~mTBm9e0Z>`C{?nHMVDDQ@{ z>2vVk(ONu6vU-OVtvo16rnBMrinE(#{D$zOPIXH%h2!{>w1L$17KAR*H?d_Di5-Mh zi53U(Yf}D|^-{X^L27rdR8RR7{0LODg&6x>icEU*{uXI8mH!qHQ*iv3Q%uUaI;xu| zpL67WR@G;m6=!{&2Va@!lF{GiX2*QaDC|D0)3tumlZD_h{_45Zolf)V2UdaSHb%}3 zaFE?hf$$9~OP#EufDMI-gQ%p2Z=QRpAsYTtN>e#vf>cJ44mD)6LB*V=8#wm7}^=eQe^&P~J4d6;FTBU5k z%$o@62F$uK7Ah`Rx2T&??IN<9{9Tk~UWK_EUmHtpnreQNGybC&Q-@|X9bPz6m~;X= z=Jld~1^H3_y)1Mv<9v)`ER2%XVw~NH_+9Wb|4Ul3?L1Pg`6J2GqMV%ePRzSkL>d-6 z92_w?4+$Q$W9a6h{IGqWj*GkJLKSVuw==#W+$D>iqdhl$YV0N~BR;Y5=*@V4E*t&w zYO`U!Do)_PYNKxm+p8deBCpGJ53SgCH4xlH=C4W^pz+I=J_wqeWqlfF zP)@U?i;lDQK@~^fG;{LPyWYPT+Hpb}KEMeQNga8Z7bIW(qvMU+5){u5uJyV5aR#Q) zjWr2a4vEFaw&2@BmT3M&$wH0}h(S{J=_c(%*P&j|23vHrv(O22O58D3JDFcnzGG-E z)#<=uP`fl#39w|-^v!lgBQ3!0hha38WJXSM$shq#s@vz#4#VoE_==Mr=sDucW zNw~=2M#%DfJ1*D(IP8xbbvPb=&5z*fXrT@qVjLV>wIA{@G1ayl!m`8h(1YrC{IFKW z=O9bfW%+(2=H8Bmk__cCJQI$D&9N1%S-F_o;&LD>=}IYJ8mNHOnaJ*{$~^g_uT?l( zW}>4b`;YbmmXrQWz%e5QYi?LQ21ABQPxk0PqFa!(1#Z4{cW_Hyp3YUXbNHKQ5a{ir zQ-jN;WRI6^Z+nzR3*A~hsTd4#R{V9mc$2rz zi*}C2vo%Qu2Sq;v2irsZ{>erTlKbFgO^NAnedhkWZ4>{2n4`j#i~~8W)JcV-9VdWU zLCZ~@GCMA{MRd^lBDHI2RH(`G!diIj;?c!GUl0V;v zr@oooPU1vvj)#-7rHX}YhULR&fZvvfWu2>gv?@Nunm@KKf5odb!eGx2PP>DjDz(MJ zzf2GQL@?2Zi;IE?ciNpsy!I#G$3$*UV_o5=oe`zER9tPw|4gef?qu*Xxe~lsXG;zz zumqMj6AP1L+hV^X14gf^weA8!n|p*3Khs4}#G2YzIqJ_csxqoe+<^#pNr-L)CpCGA z4H<~)W}4*W?$6f8T8`C@mdhEVOYm<=H&V}PMNh|#Zx=C1zVrqSxe?4alB$%sP*JK- z%Ru7F@GpsVsdiAr$48Mi3Ppj-xT#8UpRyJtf~kk;|(zmfhkL5U$A*)fRfp;$=EQlOwMp$>2l&h&C76;#$>(4F!yr zRrV)*4WPs9xWwxR@+$qSsh=wEFxA}oqnQ;}HoCf) zLR|k|4bP0)FrhrNifkUEvYTH{&Ch((-$G(F7ctgolmg-Ja%z z!r#QkbU^47@5dQ07*YC)3IEbS>7JMWF19@Oz)oIu6(34RiO-EvouYQk4{6Pzu2xF3 z2nsE?o!r}JaD3in@|2V5$B860G>49`w^lVGi2b=^3TyEXPx#{qViK(E@{I_kJL31r zx+|Sgm@4H+pka1l#F(Rl|9Ue=LJ!7(=XDYKMW%H;*5h+Bjy-fY;Q}U?T|fXiA~;9T zZ0e8DTDw~ewQTxSg$C=+&d$+tJrE8_#L;@bbJ(XsW6|~W8cRL))JK~EA?gW?Ocdju z#bIzc+y}GWb!U5bpo2glM!l|aIGU?CYq3H@DdU#gVdn!J^0OG3ym?*ESrU^d_L?Hd zbd2hIXyDct<@P0Ps9*3OBnJqD?SeC<@sy*^TG_0FxR!DxEx`;JWAJd_hky5L7GoBo zi(Xq+iEe`{4a+y>c3Iw}@LHnC9y$*6PWy=JA$7sh_>ub_o33h5q1u_zaK~>I3-ki> z>rg*UBAPec4-{IPP)qxEeA~Z5ykgxP(~J>(g_PNrll@{cbL|@*>CNp*tJP#{wpzx$ zCuu3$&^sU)vw32?AyyJIsH>5?LlQ`s`O5I*+!ysmGFOj3Hf$;w z-iBFgvSnPhPx!P>KE3_&(vpa)HV~8?2|GFj>spT|LZMW|XIb6B90SmB@^^aF zJxd6bOb17RNQ8$!xu-_aAI(Ps-1y0_XB1Bw0i~v4Y`dCX6e&w5zCkyy9`7oQl~}j` zYm(gQ4^ytz&7#++i=~i2=W)BJAiy&kik>&6#y+eLbwBE=h1>4sG?A>_90MnymV1W1 zXVf-X&mUfz)+TELr}|UY?RPH+a~zc*=z)-=2<$aqRwJw8ujHzs^^?DrF?$NCR~*K> z@h!4RfE*ya1B`D{_0|9-vk8m%YOBFeuc#%SQnK!QtD#7%jgB0i$nS5URQ4J^B~3h| zDmA8inG*OJO*!i>Vge^dOjN#5H!yRFJ+S0sV^aNZN&#E}SPhMZSB23}xW$hETiED? zZ=pv>jED37*CubB)JG8#IY#_mw=qU}7CrI2ir>zsH&i2)%yupdKeuJqlu_V^{k^D1$MEet#x54+b1ptU?VBWJTfxgVfpzGEaN`^NlkgsZ^45PlBmqy0 z?WNE-COww2VurDYAtpr*6}~cF)pGG;LyW1816|*Zjj?^ZH?JDjCSOU0lQQCyp zpjK^ofDU6! z8R#cPVdi?#n^^rp%t^WEXW5uGkYT}#+R+$``p_!@h8G3p=j~(Avf!{G9Lxh{Y(1>= zrSCzEO+z@A$`ef-cdMYvj1pn-Is}`S{B6z0!$Cxd-|mUUFIO&WOZ-raNZ+Ynm)q%}+E%oLQY_*9= zLqjkp#ru4JKD(wO9!)Iid^_f2b0-eEjd6=B+xiDrj#0Mx*wprnm{QFetr}?Daf}Eg zcspU?!~pNTP7*W_)_ue<`VtH`5&m98c!#Q*zkVMu_mfoYCXaTQ=Y&i|0A2qAnAD=< zhyLEOh=S*$`=O_dnBVhOe>|1BD)ueVv7La+{%c?GCoctbu|d1>Qt5Ss0q)Ln&R{M& zY7B~iGUKhQ5W)Id5EVzvsZ{m6+ILil?X($+p7KqeXOp;bS$tZ?B0&G)G4)Y!u~7Bc zF4fDroR61BPObtxJUmH%0>gBezTDtC925+2i;kqDp;J7pfgPHn^W61>c=8uCskl}N zmE-yE$rt>rDs{1%cMNhQM{w-om_0@d)YAi%{|0I_T7SJC-qhF^HD((I`Op{YUtR4j zv>Bjrr-cNGoJtlKQQY2I^F(8qtyc4gMMq*eo+b)KFyYpHE9x_N(+X|r&4_ila|nN; zQH+DQk(BYB7%3ehWnNMj$XaE&G+7&lwr&q<1#9NX@#DQw5>zLYeSUmKr;5=dX5Kia z$>0ebaRTeR6vWlkiz=V?rFdK_RgQi&)m;(Vxl@~*ycEAAa#0uj8&Po?wY|2iGHxSJ z@J5zlo;38g|0zk5MJC#5%%Kx&t%M^BnFN(NSAnw^Rn+0cgIzV+rhg7JdR+rSn}NL` z6unwmX#I_dWB(TC^g?{^_7cp|o~-oaI%B#{0HhhU6S4MCqPZ)fngfu4(dRH9-^y(? z3j+D3F#HIxUnk`44!&4ePv-^QleMNB6YzUBhE^{+d zUs1|nd|vmF@cD7beu|!D6@A!9i^c^%ZzTa$%HCIB5sK^msbQ{l^T3{_W{NaJ^!LYnV1w1{Fa0-NYu&lP^fbY(8w!b1 zEOX$+U0CDhuWuom2M#j@l2x&r;=-AWBkoy`V%&}G7@o+SQcFq847A;i`0Yf2Qx39U zk#K$JFy@iV5}$(8ic=IoDM87rOjj-gCmR z5o}rl^j~df@x&3@7!e>CN@FD1eWwnhpYx$BgM7>raIQhpDRO=@b0kC zH%!XddpD9dMDF>ow|3LTM7A%NWCiP-2(qh<@^SeYi00}P)9~+JA@P7r~&E5MTaw?Nlp6zT4_Ia2*LV)?)qnbZ7UuRf?m{qRcPS#+c}B73>Ae}GrAO-I&}%g`O`z&py%`%Oi0 z?`IT+K;*D{=2U_KD zgfW=)r%*1kS10orQnY_FL7+R9gA*&eJkK}o&fa8=-x>~rPl>Ch%j{KL*S*G{!e(2q zlM_9>-mF&|PWsNdkfu)}+VJda42BokY*xd-g3pnzn-5z@vWtbB{dKt_+@GIJtDAPo zvoT?#W*?_z%vZxXa(v_tC$o;`YO#5%1RZsrFYT8MJxJq1@3;*KI9h-)+Pk~eB3j>_ zJIjAOxK4YG3#&$+_w@`-epPuzcpqX9O;ajKuri&hRs!;PFJzC5#qc0?FR`LM+MR?7QiMHiGRnj7ySMCwA3pdZO(CJv1xYM(=bosZ^zn{I;1Y8%`Zs{5-K zQWCMTvS>vt37yY`mlh_J&+m{?J=qH-a)Q`M=duwtIrl?eooY-*e^t{__HgP1U-3yQqLC6DEp7AjsM(B`5FkBT-;285I*!if zJun?j#5@+c(sdnOQ(>Sqt$w%aAvZ`^o)$mJ=v0DJKJUYU*Ac*`R&;F zt=4hH`C6HgNnE>QfoJo>XlIc@U+~Jq&tkbO#~_|u?*X+6^&YRw&f-?mvgXw=13ZEp ze)Jv7E1e5OJ!AVDM>wG|J1&Y!@m_ zHk?5LDH2pmekhX9-+r-Q>%kBcji1nquUMfkBE=|j!t^7cN2~6LhcR%GUphUsGNsMD zbrtEwu-3RJIQn_TlB;zYIsY^=^?v=0TO|-ps7j3|kWe*C1)}d!Q=8c;=RezIrkG|- zLSg=(2X}q}iR%_q`+V~jy~yF5QuO)ppjXr4#cj*JB6K-}tjv(8+FCZ{uqYW$9Y*!K z<~SOWIdm^GKdgNlz{_|4Q+lufIdP&VA>*N@82l5Zex=Ee)W+9$awSZ!tx9AwMv(Gh z?z~|ba|};K(V>^m|NUv3lZB~O@N7IeT^HH>niHE#XYSj5-?ev*DJO!fugDm}zZEZq zNRqeUw3SjEPCD3d;sS^!#SJ%uk!f2{8XBwWVF?-NG5T^J7AN$j!>2?2#)MW*b!GH# z45LzoC6F2IVVd%gbQDML?*S@m)@iq(x@;AX1hzUsa^LrwX1I(fy6-CZ6=x;YeDQuQ0&l>NL=hB!^ znkbxchwODPy7Rnqc}R907{R9+2mG5bAI_S~tw@zHO-NYJuWL+l!! zYL3F)5G3O%!*HuihjBC;Eei<{!psIIvNz72ENEhGnhG?+*jAz!NEJOYiqI&l*3>8k zSyMthw3N87-eE5WUBlF59o7W7PWqr+oG3t|5x|BvdBV*QKD$=r0P`_2eQ=SW1&EGhxZ z<;Uy|-I;8opE@l9Ss6(~ebfgX(=u1Ng^}u>9~w;pxP1tMePNjST^T}IqIO%Tmg2NH(3X+X$oHtL-HFa<1 zyQg`;pOk70&r^QS`LfY3#|`Q8XXE$t^(D)W$*z}+fJ1}QwVT_&lsxxZg+ZPCM-a*Q z%<*2_2~#GNA~wVOrrH7@72HkL#Q+Q4+z9#XAKuQj;};L?03Yp$T&)Wl#Gstd33S53 z&u`9w!%Dp7YUQNt0@i;UaC+PkK43X`0QH)y!pF?KtCJQtxv)L>+)5fritqujjp9=emqk{DLO_gU|GZSm1r9%{RM?;iL zb&{eUvTK~&jTk1XpBZ-st1#y(rz0$Oy9y7A1uZP-&(|ZK=B?!O6`3vuKk{pD=I}I9 zPA=J%t~v-{HZRoa-ys*>W&Le%>Hh9^LNgiEMVth0jwl$T_v7auNo1#^bq2e88)1AR zYRL1+k0$Q+P1J3)VlkTLJAs=;yskQ4*4KM4>=_ZVK@&;bvSY~+#%(mx_BEedL=wVv zf=v6C5ds?Pl*`p3*oQD`OviM^KLPSwbKHbNigN_h1~_i7uPOhSD>!2S@`JP1MKWev zpDD$?XCtfq_{hm>S0p?Fh9(bgf}>K~H%F(VoYXn(uuvz(ElO$Us#DU=y{i9C$g-5c zWGZjHTIqLRC;1;rbt*p~lA!{d00x&;=fq3RK~^#6l+y^T7ehCZn#(Z_uNyN}v)2>; z(`#uQVOv~+9i5q{gl|B!qjQH$0msbuNa!^WO9VDH))+be+%|J4)GC9zwA}rvgF0$g zom1zr{3eMCTM4gje|BugW&Ls?Bo4FF@S6cl$Jj3 zss+BVgdrt=Bn5Q!W7wq2H(FRten4K9U5Yya1U4yWoT>*r#p;GS_KNExf&}BKWuH(m z)#P9QRx@em!Bz4Yy+7jp*wOFbcMO=jVmTl*dS^MB$!Gkak`?X8;iK~X6>B@cfz^N= zOPK~2+0n9J89g$uOV!O* zu#2uuqSg$*4@PX`%5DdD9;}{F zC3Aph^ogvhU#EBroy(bYUvDWDJ8D3%OtIwb2^W1gOn34V=LYVYF&x#050fCt6+UJ& z9^dIHNYkP`+yB;MO6K@{0NQhX{1=U6A!T`U&vd-0-MGH$@TqZk&Er0kA>+dSc1f}> zk@lkPltIYu08*IMaD30M!{av?YUObxPbWy$Y=@b92XiI;5cH=>Il7jsWXXcQy=mgG z_b8eeWnr6a!Nhw{DO)hcbfV%nAN^|j2zGk{RZ#kTJ@$T5a&0~5OuaI(pk2pco~|CI zW*0}+iVKC+68Rv&{pU;l*LPz+eS6F{eohP~?d<5?#7QGZohhrFa`xYhgvtt=3>=m| ze!_hs^bKJ0?dZ>BcvgSAvF~6|&0g=8ok7`Tb-fz$e%v>Gx=b4i1r#gs8RAOc15B2J zDdq^d(tqoW?cg|NfS)c*{xXKKy7B~x0P9BUIczMw|Aszp&Qy9TX*xeezoW$>W#>oC zN@C7xyD?duY&c>GI)N3(_ha>+FDZ||x=>G-7hTt!$RmEb7^|pu{BC-neQ#w8Y%j)sC-6qx`oN!MlcuR$;MX`0>rG zufa4&bF+&A;%$GZpH?+}frp!e*xk_+opB;60t%$$tUfo7qxNcxevqw1H~;z{WI&KKOtDkjss+9&ej)Xwp&JRrmxlq6zD>_5B9s@@dHv;Uzg zkJsp=QYCsVA#iA%33pWS$O;Aiz`VwDEY*|AJSAcQRzM6XJ6agQO_9n9il+hUi{*HOH*!ZAY z!Tlp~K<*%O@)Hf;gh2mb|Mk}Pd%3fxBw8iY&%{sx?u1l_qbTE%GsnwEhL2=U?gfA3 zUK=7a+T&TM$_ztOqIFm}Qzz5`AGu|cV(78v6DvON*B4>sRiy}hO553oA4cZGVYXg4o=z|{t8W{)GMvK{6o?PEmB}i|MMTY7 z!3XK%`ecM*bW4kty_DP`j?;!KayX$7Q10q2f77Gv&7`N`M~pIAYnk>|<_cc=&SY>; zrml2A{v#qG-ugG@T07)(_gPgE>&)KQAf3?avb9AWpyOQO**@({&9_fE$-lHOarTbd z6hsG;lU9;@G;cM^ZLl?cuW2VV8;YH){>k&6k>}|nQPpvv#&mrB7=rOS8W3qRoH-sY z;uCt_aZ70JPAx0(3?{shTt)ZZDEs%M&|6uQ>yuyV0K7pyZMB9RNKxQ)BjrE;xhg#k zTVb2)T_<+o>ECYw-V5JsB%6G`=5rJu+^leiMkKxLmube|4OrV9G25CzWB0&}Sk~~_ zbR9E#?XU{nX0g1@M&gZczA>3CkjuZTC4yq6^YkrGFj6>F{HsBeUefNR#Uc96?n}v9 z3(qU!DV_1gC(c*&7N5aQ7A&54&O3sf)l&N6F<3v;bP~gtdSQ5|4;{Oe*_xC>jWb`P z6E^~eucpn0E&fl4Q4W497|F& zMGSr=rsO|u4_FrkRv?6Gm~+lmAi;aZ*_+~j7A8*r-oI9A#6R45XNQ%15)(Ra^B{i4WpP{w_Z zy}r6v$Ld7itCLkP5yKymY^?@!_TL1>9B>n3-7;|Z&kNYPMT5Y5qGBJBUxQ~AXy3Av z*rYFKgf#wPAX_pMUGJ{M|s6FT46S|4Wr6c3mGv-8{ zTJA&8>=*fp+i6`CRnoCzRwoOXkc(xEt`z1NVtP!=$O`woxx5paQOX27KGS%TjDedr zBp*x0P?DKm(_|#|+W0Dt(xZY81qN!1W7y)ozDVc9_3jF%PE#Vl!cE9e>v$WcN3HU; zYFQFB{6YsYrD90_02K?2VeXOk)XN|;tQwD> z?IAON98ckIH}g%A160gCg0>5PAZ*hhBJ+*mo2Ge)h>CrqKJ>5h8CO2SckkY1>(;H> zt9>{AeNZ1?wrkh!f9*5wh8u4DJy3k^o!j)sjW@#|CF7^}Y$i>Ks-$vp%dqQvI1!N= zpRh>YE0uvm`yNuE(tDiUFr9qg?f05F)%D%Ef1NKL(S@bKmRPPgD^`vaIVw_*Mj^OYZ?pkbAZqkhG`XF{3 z5Ym+!u7{_jSh`5&|GJfEdvfYDt534HOB}iGNtxnV2)S^KJH9z7mMMU<`_{4ld=SYB zmZV9kLfkvCm8a<|@qVh8v%iVS`14z*xe}9(5_x^uzx6C7E0^H@@x55H79!&03DQ<7 zPl{(ZSh#XC@je-7(zG^DPi*6fmZm%t5!YBWV>uz7smW2i8a0Zi=Gy)ZY(0CAlo`v= zsAhgd;Vhc&ic?JDlt|6#y<13Iq6#VP_nEhBCnc&kBzFo`sSYmg*oarj8e~btq2iz2 zg`jMk_Dbg7quzKNg9O(+; z7w^S~)rw+za-Bu1w_x?nNaH58Fa@7r^2XbI(xw52%PKFa%Y?c(s; z$2k2wEoBR;8GRwbo7WRiqAt0TAm!bFPpKLtd~bSs$4-)!E>8weJuyM2S+eCQ4pTY` z=L+QH$-6Y^T!&pV=JP;p3TCxnOp}jRwaaQBm@2={{gVI1h-e|_I;`<=B zHTCh{-!pUQ#$OFpf3N#;yWxf#?=IYA{9lYeO2*%Hyh6s`Q6whgZn*Kb@lWi)>4qC_ zxZ%d%i?>O}Urr~w@sHx)GU)yrb2^@g9oWlp~7$Og!WHE`O@CMe_!*%R4WR&Ujw`GwxFJEPfyQ3 zG>h$?8F#}CH{AGl;%&~1yUF-l#+#7wB1MX5+Zn4$ewWFkY9p#Vw{PFpTtMDM!$Hl8 zt4$)5Y{`-(bCYp5-WpWDnIS_4{QUg1_U0zzZn)uw8~^{pO~(JlcoQ^*he6#&nI&$52zI!;^gTig$O zSzBs*?aMbVz0k>{o9DRm+;vlY7*{Xd-;8PHSbICqXT@>{6}7_Ve*fAi=3iO zxfVjQg1LM9I>W#3!16QUu4{?$jDd|>axL-qo^+*ocTsM7~_Oe{?2a4O-_q z`}4T7Z7fAfWyjT8%LKcXW8soU)WtPvY_Q^&{r?F=qTYfM2#;k{A)p9@n2<6MiLJ?y>6)gr3>LwrzWu zFuX7GHo5BF@|ama_G0{)pP4g#iqV^`%0N^w?gEvr)_#Hj`|nOQLrqX3Cz_E0&Ty zCnV4C6GZ3!l%n_6@>s6yS$~wejcbdz5t#H24lMnZO>2IkSFcfAb=fqJ&a7wXuyHKh za}|GI=N6#5rA>_$lnfmyl;qZCfBebD;X zkTac5(v|#`3?|p__hnJxy8jaA&%hyNQf2$=%JtVHk^Z$7rsPy|zioM)d8qm^zV*D^ zaO0naH1j_PonEi4>8$10^@1S3S=k#4C9v`u*{geji4&7hWE}_qtha zJN;MY_CI4v?_X#!^DA1Ei{R(giU0~x(>iM%W-lME>>Nw~&3Zca{G9xu>-cQ;QkD$v zkHz+cA3C?^r&Dlc&1{w@Fp{?gA%HQDZ?o>eDUKf6%b0~{C|x!u>qqotw>F9Ul+nGX z5P}!aL+*3al7gni)AD)a?gUx9HNt&o{}Se{Kh2^p%~)?LN~^+2m^EP|HZNa}AK6RR zkJ=G;WI8jBKjXyIu569VM#DNaxcbWg)`wU)y>KAIb{hHU!}naY=p13p=`)-=*y-M|3&t{aD46U#!`2<+^x`3m*zHN}k5cn}-4?`G z`IhdjK48%gpK&qx0#)11B2U8>Bt5y6!?*73ye^7|L znRAghe?ii?wt|FliQ(SQR!mFe20 z2@ihxhF?zHU|`FRP+iK{yae;UZNn*DZVF`2O3C~$cR4krD#o{82|32f=&whTznk3i z_%Yro0<`O1$$f|ob-Idp=+oe9G`^r8N9KA94 zjGGv(`TSE>UWF4Y=d*ZLKPr#DO1(x^xwK$D ziRrkPUjQ?^*PvRp$}C*CP+M#KpMe7}Y4rC(4II92;MgNQRv|5aw5L*J-a~$WFGO}3 z4<_&SAVh5P-ycB~5!A8zm?xia@?`Bpoyh9C^uK^2;s%?6A2xXM^$rhCKQ%J?pqV(4 z<@faGZPU|lmzgk$@E3@n!6+p6>=h4Y-_qeF$L}7T`d@ZP^uO7Y4WUl`D^h;@iTrC8 zBk)fVWl7g4L|eNz@o@r#h)W(1pX=Fk(Sx~n^rD~tDIW)(lEzm?hg@L>92`;{D?bu?h+LI zkkHVFTAp`;f{C-~{_w!_TQHhExV~)~lUAMo4MMKNA*AMcc+B5J$fGW?7A>Vr=Wlqja0(mGKA=JM zQm(t+7IavmmEZ1pPM$tTmBA}$mL(}xy(gYpb1>uQ?<mMTQU0Qq0ComWj{N|TcO*^;?Z zbHQ?h0bLq%r_fhSX_5s?Y`iM628aCB84|i2o3>1p*mDrFhdv`#5xiw6{pN3A?d1O4 zaH>Q@VC7ciJiCEetDaJ)T2hMUF2uogb9f$~k(@q(n8c`4Z7fap0yJw-gaS1_B<#Xn zuI$u58q;S`VAu#_5xHDbcJUzGBoilrn}t3*dwIVcF6(RPEe@n~Q&8=jBjZ zf7y%1?>}PH z+%d84v5-2GB2enefwjP+bVxmx|%$%rLX3BV#AEgedu6% zomlFpv1_B2iu;1dsXScyB!#>9nq9p0jkgfb@F`zl__rrL>@=zrU3b*~sXV#{uq1$7GUt64xXI)A(YLRwO})yQ^n13aPugb1gGx|HP!>-KbQf1M_~F%bfYkco40Z zxO!JQMrX$&c^ajsH)>%fc>s0JV@)0{NsZ7dBI3;3AcW9F$i+SEK6M`txyPvF*M1_G z$&2S#meH!~93e{n+ABrHAhdf;fBjU(@n5Htp~a6(@7J5DLJ(?(Y-R70NQ@4<5K9~J zaTZdf@ZshKrvuBQD_5{4%|g`zITxorR0)&8Zh#p9JaH{IH| zqEqKCG$@*03-q%#c*of|bS+O9A8)}Xm6s)RX7W|2NB_b7Y1yzl^-5(RIwt0SbQ7@K zEJRyPG_RGLVdIwYQMD?>L`4fRvtyNfO&PKgc<(5eC2riqJ*+x=TO0i1Ey`8Ghm_IR zIIE>(7qvEOlX4_%vShIek(IcX_;@*1 zx7*~p9lP~q9HldTl9XhRzs*6Vo(Jc-7y4WVu$PF73a5D8&a`gbhMto)lHue;_C1Dd z{*hd|;dE#@cjg|cb7UoH#3e3hA@QOIJDJiNiHVKFnz$S>S7}_S8UAJaFj@Ksg&ZaF zbLIG9?fB~1yQD3cO*>YDqg9hv4pV->ii0~D+Pe=;J}gM7dhN*e%4BmM3R@P^=VDf> z_(J9qCE54u7|g}n%Qexjl+~fqlXf7gQH9s^nJjlso*mh*rEuuTQRP)ds^n&_U%ab@ z1zo(1E`4rlW$~luqq<`IW(Znz3Ow2fD;*rFOd1he3aWl(r7_^yBZ@ZrPXU$BJdk#L)Yox{r zhjamYmY#8@xA?lWQ@Q5sb%X?ojF;{jIsVwduV+mh4Kj+6CF6%Q!gF_w+=&r+Cffd2_a>Y+Fp?(RtW3d3r50(0PeUb_){0ga5 zL{G==%Vs8tu0$1@J~z4a`O|q5k}Tem!G_C{?+G(&gADTgiY{XG%sORe?s+3N(Yc!Q zdGN@{R57MDhKh0V%1|OiS%~MEn<9s#aVkv8Dfu3|C5Ez;X|l+6GD6Kzzm!c8VV%WU z7ZcAKu}FHB7y}38o;eaWM`V-XQgjVrPmD~Ed{;?3(QCvs0m{gL)2@6^i=pJH%6row zeT|+uqW`C&M-^XewB9fvk>xMZC28oTE^Shl1)_5$vxn&K^i3nTq+e5Q z>C9~-XQYiSmomCpsYvnLljJ;11=* z+O^BWVdK=1z3kevj|(?%aN|*!bj*ren|XHsGC|K{H9~HQg<>tcGI7!r`gN;GvJB;! zIB^oA2YyesK=r!Y%BjP<*|YyD27g~1u}`=e6w1vLyV-T{6fr`auOHpXo+D?l8ocBo zbr5{xHqp-?uyeIek)+*+clMZ5^8S zJVd|QVvrq)0lX}Ga|IyGw4VZEa@JwC0%lu>o~QQ~~_Wf$(`=t;AbkStR! zAqql9OV#1}njeMWC4AUwAXDC)_`EU>c#=JLMll%u$&xXU4_fr6y6tCbw(Y^$XipqM zEdA5wBwZ32DFtbB*A1!3lFA3~)Hzo&-i7F%d81C1Y|M zRkB&gB8+X|Nh9f#ImnpA&W9Ooct#o+d%-}BJQl+5o7f`keBDtYvnCtW(pz~Np-*_x zp^-9WOTCvy($8)o>aLKgU@-t(B+)G6#1SE`QzX5@nZ=mBVB)0MczTiXfRL|KitGs) zd=g}0-UFzU-O8pD9$XR!x#z_oDK`f_mopzbnMHSf4m(M2))Y>CrjOM#=8}Q)LT0yyLH(Ta zY>B>N?K(~O`LkF_A8%yx6+O{mMuy1!g+#tgMyWqn7K*qkqu_=R$=SgU%B8h4bdOnk zceYrF^Af%X(_%vk-E}#742uoNp8)Un%P~sjoS%dbTJDrKK9u-#_jnTGW2JIh8=;ZXPF&rx`Xja!?@K$Wk;B5{nBlqf~Y~JCA#?>zR&yLcGrjqgHKc zyO8)>QmN^D9lS4j7fxm8h>-k?1{<~0*_m?Kgu`xN$PoiYvRcS#)AK;; zZuyn)3f(FHbP?U=+~>P4EvZneC=0*)l8E9BiP^J)5Bf}_S-xb%S`vn+SMjDhaPHW# zgXGDRyF%UsafIG_idU92__{*=4yd-GcHpd3sgf(?-9vD2u(pGt+Oq$zfFmY^hv7b? z5yJa>uuGgr|0T|w;?b#1EIg&-^ZNN2@JSQ0_FhZJ60f;~ybVIF)f$uk-U@1r zyv*tClU&#S3v6LLxNjqs7(@w!mObhbkD~lYlk$ZF{2Rj(7KbU|uQgo%JYslsGYtQ% zsd?2q{m&shJY0J&{>~jZm5=R_)1EA`TbWeEO0;4-LX*7hMmlcRGq83%X{6@bF7_m& z5apyoK=y^|7*{P8Td0v=?+Hm1!gRxIrE3ZUTWnT(7qoKryaz+B=qM{B=JrDqfm!4D zAkxHwr(zHZk!h7x=&|%^b};}{e!_(~E97&>GY5|z8A+Nwp1yf(VjO_CkjxodJqauv zOOw<>7B_g}FUL(&!Sv0ZWGEcZl~YC>LaeXGI(W~|!O@#WDt;J4%Tx}H#HyL@$WRkK zFT$KERt7Eipi0#kN|+3EUuWi7osZMIW}64J*kz9Iz4;u>giDRpJp)kym- zdWO}FBW1LSrdte5s1rxD7!xb*s|hLt_r$pUDy@#uXAR^QL#cB?yBHPSOp7@HcTF9_5a+N2=%g3=>NO_~` zG33`9=()yB^XjqWk@jI#vWaotVV#k|^Pg{`V<;J6;`{4TXJsuYuQN5G zd5eCAZ8s4k4WMMvIBLkywRDFETjhFLF-)3fR&R2pojA=Ot(}~_E{0UNgP>p|c?wE@ zaK(dEC1a^A_l}h^=J+s{T5|m3N>8%Oah((}VXYa5{Kelw_xv_?9Q5K$5)0l}&7_ul z>q`7FYeY_ozjwa}&8o$aORSmRD?G8K6$44++!v&0M6Ea`uJOQ>+D6Ow$-l4<5jnX`MMZWH_PmW>UOYi*LW}#Fw3F;)qQ`=dRu8+@dT8Htmr+jTrorQ@431 zx_#N3Zz=~ce)cxa?L;}XI`jqkdO!oD*TmB|meq?6QJ`{Z(q}CtX|~6F7+Km(_>)9j z!Gn_Jv#?|QP{wZ$WyUX~T;Xp3LjY+K5pe~*PpUsf#1-BhBCg;?s=tVcD@>({p=H5%ei90qQ>Cb@Go+d$W^p ztI|QNnwobV+cY9BkUt(VMmp^Nl0X}+ zrF@-B#WAUrmB>hgn1oKK8VXB-7N_gcSb)p7XEl~6)I@LVw z1a>)Ab*$u8$63-?wfg;`QY_s?=9t9uNGeNBBJF@^A=gSz>gP-^QLZn-1fs|WLWq0h zwsHBI7)i&KE2#65S=!0LGoJkX#6j1h7OG1-aY$Wi^H;9&Y3^>WV+HMzlCXr37i&aF zn77o4if@p1gtRAhNyS%T8plwO@alP_PE4qraKuDl^G-(oR3TgvYuw;^ zDAkjqGZ=B)y2MTYWcaGiEHVzeAvrBR{h0k5_po;1S}L|~gnw*|*5~{#RHFB8a_-?J zzG_jAT5YFb&Y2E-d@M$9e+=@ZtB%^+Pw1+4tY%AG#T6qWz{f;HWHbS(Q{Z?OhC?i9 zorIg?PEjTM$K3MCO{EeAB+P+T`S@Bb+R}MXZ{OzJ$(7WtQ=4xlAHXxYr*tgNWdAo% ztHb;opw?7=*Vk26R_nicBNm-^S~~O_$%IK$`K(@1SLmNZxY9*N#V?F@O8V>AaN9^wxSlQ7OxQdf1ehE= z3DVLDiL+QhCaMxG17%^@~kgvFWG3ut9`kW?6dc#MvdL3-}R{b!$* zAe;J@K#djQLMY3obFlHUiCYmmwp}t3A>GJ}63KybQ#p9g$gCqK(r2`h+U!7v5*~}b zls?0SP@cMBW?zJZrdjO7$a#RDjkHllwn-gb3(>Pn;^oa^<%X2`#3KVcMbC+s>$gbd zRm@>$=UFpHZksqH3i!xh$|=Oyri764#fm->b7;&q^84smbIr)I6DBfcwvtlfMoPJq zI#d}WMNiq&S_uy}b4cVpb;rQD2>lDgNab5Or=4xCe2Cj^WBPDncmm(cf;I@l`pcqLRvzGM!z z$nlL39Z{05HV-GiI8{z*QwQ%Dx%SA!&v&7W7@@f&{%$Gj3DMySsb8yEj8n6Y^^(T* zFsaA14%SOMyDjyo^010=Huj={5}B-|5<;$g>>u3pp#DD7OMc>p8~-5wyqijm(%f&m zfiX3c%R?@GpUH!uy`yP7GK}MU$72pTPVx6UF(qg%v)=!hYRiw4d_xOH1vg{!pd`GP z{X6EJJwhJ82tq>R@QS}k{m!FF?W?2vgvI3Yiq$%Y1ibF15-FK_SPoIH=m6%QJ3?N+ zc%our2|6~7#seR7V)tln?i@~|K~EDMhjH=1S2WFCnfl8Q(>T933%{w)wv65R#5#pB zk6N*&&ISBGyFX??o! z?}lny88c?oTu;=q@FsoeU*)Evpa_NX-Q6K%BSg9xHS1h8yN&a~dfv-m(`NpSHX$Ro zjD!l2ORapHQ#pia8MzcGhMJIYwaUqd61GF)+=+rJ`7QW_3jr5`qX=!~tTt@V4eSw; zq!(gZE}MlELSCG+$&$YiXLWCgi~;HW?IiKFlRvNpHif#gXeG+a;0BE4dJ5 z3A-r9iABhGvGfj(-xT5}y6~3r)E7O*Nf}j|9wN_9x%O1ZVx+-NOVPE`{}Czw)fmyI z#P=3*p34Vz+;+}<7ZcK*+eh>fZD8eXz4m=gkqlM}2+2Kl)4=H{9hv+@Z*s5ldAGXs zs#eN5DrEDL+)yyRmBK>C58ly}Rpdz_c^;NBXOrUqIaXy>da}go*(Uiu7yUNMCG9cF zz_AF?TN)cNkz#Dg@rRoxJjP#0@uo2XE6&A98ef$|Yt2e~+JGv+9Q~T+dvAZ1ymce^86I6$=m- z|J%g$O~`n`f(6;QaU&^Gqfu$rDLCs@T~~`rDOZ`7<#b+qz068as@_y8s@_y`s$3Q+gJ!sC$0Do5 zNnF29BA$TP^G$s3Yw;uvRSu;SrDIhW33d2J?Lut~=qQ4(-@`9MHjI%$Jhu3eK9xTnItwRH zo+3O}EaAL`$)Cc?cMV$c{@4{X6zexyJ>`iZBZ58d8TUf1WX+gD9zJ=Z!~pO%T3zYb zNSU=DSps9Z^Uy-pOeu+venL>F?ZxrEP_gz4n`xW73c34DqgY@JDRUPkTQU>R9^K=q zHGoWMlM?yxGN-RSA$`X5@=%+|mMt}rx36&e#&hzNEJhmLWA;fIZ3a)W=gCiU@0U7w z9dAO$|J(9HJX^MeW%S%|YT)&)d%PpMZ57K^0wq7SzPQ$zU?Af9dYb-ln6;~h8=5FXAMQuN@ok@_$OV4_i}n&L*m4au6M>)_j)kLarsqrpjg% zQ{1lPROOKS6T;M5#&(g{td-FrWt8*Z6xNCV-^jRXEC1J4Q*pzM{|Wyb8Fy$ihicYX zAx^s3*Jn9(@}Kgz_Aoh*|7WPa>c5xab*LFe;@Y9m%}ai17E8Md@6v9r#Fe?&E>>{gtZWcL#s8?YZH`yN|a?#??!uKLtgu zf0KkdY|hO{EKVY>U~`djZF7=@nB_KhMo)Cnuezta0v9oU1&PwJ zCL+(yYp)+$hz#?i-{OUoNFGN-bleMh63eE_rlqIIz3cvjFfEFdQMqWuD`Nh;!n)yx z8ws$5%c$(eUkHb`O2wTZBhycrn0C&@!+6!9zuF;r37Ma|+ss3=kYrcbZ^P-f;oKqf zk3jAdqBZS+2Mf-cn0?mBf+J>5i7W|5!hhn==JhVXp}BcPJU7yJw+E}P83>cmKRuBC zDX8fy9TWF?FjwmROoUpO-F4|5g4#EF(q1!9rS1K_`f^``6W7GJgK%l*(peA4_!-W^Zvi!?}|lWO%EP`h?@>VG?u z(BIq{{5b;}Hs^BUYr&gn{mE2roLI|@m1kUmFY(~mOuibh#&!1Rad+n!GWZwdMGm$T z6wsw)`Lzcu9W;XTZ%LWw*7WD2k2-NBBAU>!#08IHXw%AkSiLTFYuBPiokm=G8bXiO z{Rs*^&EP@HG+)WrabQw=CTx7*I&&i8;Vqs^GrqfLAv4!HckKKlI6miVN|mTYy?XVi zS-Cu222Xym+}fKU3hfqi&sAd|aU!8*YSg z=*Lf(y#0w5HnKwgFe$ zihHTa8zE`2R-NWQ{32ZbI=zjZTa>FXwRhQuqaN&uK>G+WF}G8*uv#1~&4hcMQ2D9t z>UTuh=~FR|E_rQOW7XQ%PM=-vKDp+02Tm0!Zv^U6?E>_Y9Fs&4rG`gOw%Hx%S?c~{_Yx`q4=aM)jC5bqkI4s-NEI?gX! z?FxwF&b1&hRHC?X;{hfKu}9qCh{(v_WX69T?9T`{ z=V0lo6|7ymkx!BwXYjJq5*|yuR+SDS!<}^L(T$rteXa;Zh<1)Oj4PM#lA%a#+SDqb z1%*AjPtXG=iLyn95`6zDwwT9+JbStDSKRYwJbC(rs90xPvBpLb6&XfINSNgIpNM%H zf!%h4C0m`kxVvmB=kerOxF=0|btkX3M7)F02SGdxRdZaDcbqHD$HEo_4=x<$@Ug2r zOPJiXM)4phh{xdxl+4b3SDfb>leRKz&abo`GnU9D?dULevlh#VIPP6{FlOUwRuULMSYn8ai{sJ#Ai~rx9xgl!xhHy;x(a`_J%nCAO@*)KvTD^T)^FX-dv`Z7 zdW&N$=LxS$pwinzsAf7&Pe`i`H*uS>Hl@ z-DVh9cl^RZTTK@2o6jd{uQ77Im_@pHE?zsuS@|WNFu$^A8q4=y=W*n#RQHj@tJZh9 z$hn#g8@DobXdTSqkGX#J?tj#|?f!1AJvtHl79jrw^;S;x@lyQjvqQjEp!WIy`KW{t$xhiyp5VnYhQy1Ig$1T``(O&Z+05=a%dHFPQk{ zoS7jKHcND;>c}j4E;u3bNSQ{QH)zJuzROaN`^+r4W6%h_6Hc9Pk$j_~4E!i^1x4za zcf>=}#qn?{n`ruHCBNuR$*%~t`UQy`vu_$SLaxa2?u#ZaNcZySp^0IlhY_L&hsby9 zo{>!t^%{A;A;&vH^&AkHSBcK29WxQ5=}OX&vh9>It(NdPa<5tf^K7)*dS1uYGbS!c z+Ulc8)%NyYbe3h=y~Jg4!wokQAl;f9?-~wG8c%_rj?pIFE*4)_9hVWKN%_UgAmimL z!9m{25-c2Epo5#>?>~<}^w+9_2vssNV8XV7` zk}{na^O{#=kv6#*Op8jLc%l~I5^}k4`f!Hy{ejP??8fflgO9Htmo|;3_w)nYST%

@L*( zv@g>pjG$$Q?-7-8anVRR^c>8L;onm_Z*!@Umr&n9m^~6|&q>;hQlDYFN7KFMJg(i? zN4x4BxGXlw;R)^OJz*ag4=tc+lTl)1UFZDOYpmFD#C5mapQOu{!pjGP7S2>R3n!y|;t(N$r%*W}!tMn>-(i_6g)4qqm(;-na0%#0wIFxL3%m zT7^QvDiI2&wUa)Hl}~cpxF%#vZ95Ns}Wz%zB~I*y4qFzK9u28H5jnZd64r|&vr zCOnyiuivw>Leh9B^0~6p+E^aZRmVaWI_0o4>xhwiPsJE`V5d`23zd^Ph;(MB&El$6 z&R3i<;+@t;jdTv?A2E?VtA#IeI;4$C-TT>jKhVJkIV@C52E$Jns4r<(^wlx`jDe@& z23B6zQ?G;t4>6eL1?e(^?x)rf<<*X2Bu|0R5G;>mCqf=ok?~DC+ zUg~JS)me`xg}9#(l55gtoki#Jw}|LGLsIAFOnXk4iAXNx%i>^y$f~CASBm_;>1=$I zTupL`4&>IXQqJ9%jHs7UMw`^hZ9PfFs_TE$K*NF-vc?#geoN2uFe9hcyo4z5(Gw#V z!gO2}!|I?^Lf!mUJY8)=xf-3nW8%Pb2aQDU*KQcOrR-=4KPQIW?Re*G`9&e(hwM@o z(e+_zbEjiomc

+;GB8#@{)FGH~h{awLC*!P~;v$-he2%gtI$9v&QAwh&95eti0A zbH?{B&7yseDU#|iXHMQ(T zVZIsNj2309Q=>^cviQ3Ml6)O_Q=rs`d{DYHC3B~fFc~ey(83-sL<4rro=D7x-!W!* zf0|X##?y#6?3OrkmTy7-5tAqoa+pK$NvU0~6m2^;Cy73ah&Y?5;xQRMXwHC|2 zrVE4WMKWvNVumh!&X8H(((a3aR5LGT@w0-|E?bIkT9tF9CNOy5{QHc#ZS`p z^Ky_vh`CN%Aw>S_)CchnR-f=-;9)ao!gbo_Gs24n&dqjwJsjE$Xn@?OWOw zJu)zQpP8LcbUcod*e<21zsiNiU-Al+uI-q}T_UTM*kAG+9R}(@NFx&mP|CBkC%Mb!>etaF)L}uNgh!qdL1CWoC znb$zRgF~*J`A?WT%a8DcF>PzlVQA6BHWbDB^>A@+4Rx1Z&B5qCs7}&wOF8 zQ{|J9y@yourZ$&}87fdBsDG#7MLC~O8keP%C<|Mv*x#g6ePp%tFbsKQo42_xw4NFT zC)cMV=Gz*DMPh}SDRG6eqmx9gvLbNM41bLUyLK2X)#rT-Uy?#U+bD!!e~}<1^};b* z?S8jmqFF39Ro+{VaLfC@jz6grlLf~3mP+2{m`{dmBJy=T`tsff7jV z{p1#o(yC>ZsY4H=G}F#$|F0BB;c0Ad-kfov#hz^g&O0~Cg-PZs{SX_>jfsJS z0W9r^BM=B+pzSE_dQ8jF?5tDK?P_x!hp13hjdl`DiMD~lyKs>3jy%>RoU}|OSCDEo6aPUAFnkpf38M@vuM~#mJR~qO=(_@ zD?+{imt)G^sG%~CN3>wk^?aKyVANy2DU{YbMb`K&e~2gxOQ!&1~h`m$Mx7FS(gi@$YMMCX)9tm8~E3l?+FxIwN>lFD$xiI?v;rth3jI}y1}CRv^?M)B#7-OkK(v=M_8m6wQie&1ol?% z$aoT2Kf4MvQ=8oYY?#r|(GWXA{s?5I@(2xzt|aV9Hc^p=DC<`0zcO^E^X96eaY~@A zg7{*jq;#+J=oNNy!3=)mdgu(x0(z)z%oYHlL@)>V$uA%;<|!xC~QmNqRHwi;=#E6)Pnw ze(EJPwK+LozoeQSrq~#kcB0Fb0nSSPKxFVCqt|Wr9j{?3!xNh|i!D@_YI;sT1^$OP zNCS78YH=9z<9GwJ#hz~8gV7>>>jEQqS5eY%meUQ}nw(=2jGAAqPL&$Y)+T;*mEQlc zF_p!+Fn$Qf@>Sy@`|^p@i9#EYByz1Av?^;?7l%&MFEut?Q~lOBn#z~K=#eE8Qo5ym zPC|2=)wlne(F{4^3@>a%#~>(V#<8x|Uf^$K9YHndw!tw;qxuk-_wN5B{;%d}sbO)f z)fdPhMrF)CrHAY-JG|}B5hIRODjBx^bBs_?JU&4$Qh4`YDrJ08x`H%_>H?QM4uY{z z8=s@lKT<~|nB1|>V|KiTluWEr!N-kgp6_zt?3ayhkF=6MQFXE6g)0W8 zjM*kwFElM?^WT3fJtH*OpMQ7 zr#vJ-DiBTx|#xs3!X~e`UVH555m(cN<6Dd--+VlS{wsPhky(t+9Eg+bt6k zznIJL1bJd3(Xd)P&q;APsPyA3vq(a=D|>IofN2%$lhyjVgozB_AUfqT2X(^SMUm+| zW5k1b2&M$wAegw_ip}QL5GhM{4%cqAe(8l{6rcQd<~;v(nL5YypNg$$`L^C(!W!?< z8T1InZ!FJeq`ieUIM2)w@rbUgn$<%Dw3hBrV^xB?E&ShTB;AROVf*uay2I#m#J(8=W1Tl$0=Szqax>C6|2(HW3?%CwHm<;>uMs>QpM<8u8lf+M1q zkThmwSwC2_oen`;YjnCzhvSS+ZDOE$*!mX2(^_VP1&|HfU^}aVb5X=^{@Ob=U}N-8 z7%Pd=)$@KyhFQEVHD;81fI4cB@3slTHx-?jfjKuV`JIfUG+$4S1>ch*7!hyr@tF5Q zE3@ZEp1aC$V77VjX6tZv#?i^l=s%<1c`p%pLRY^qTJy?zu9VaM-QVld+jFpO2BoA7 zjFq8)4y8C@sDQVwJkOc<1ZU8m3%2a6*eXf)FAN!0fZ~Md{%}(UG|qNZ!eWid?i;z- zf_>@P3%{_W^J5zd1_Ejl^B0nM-9z%ij> z2o6S8K{bSkwD$ZB!XgE?<`jB45H+hTH+jh&N)ER%NJB9sN?2}h%0;jZf<`Juc?8n( z(j%f$0CYFyf26$d!K;T#4ijJY>RI zbIrJTYOH{8xu6Q_&l)3ij;u7#VT`Y zIto%t-Ck>D!C{#w0$cI|gk(J3GA{5PkgSK28K-SEGJ+!pZn5^Vg7YLuENwzcRcjK! z>k30g1@DiM!_93M4y`bA@JIr6W3QLz9slb=%~pBz#{I=r-iUq-m%q*F*!atl2mEN} z7srIQ-+ZTQzM@Ouk1$^bV#%rXnn0i53nI0rO96^R6BgoMSVX_ohyk?=6PKN6SZ6Fx=y*c5%50-$pyqO6xT*5h2kI z7&|H7BPxv|eMevD961UucP}${(wmQDT2%7s1u4H~S2Q zW>qYzR3Yx2JBvc&E67vGaP`PVnwO*4BS|UeaCm%mH!Q`%Ou(+Pp}Ho-Z0OuONdHfJ zkQ4c)GCIV7UV7`T=A>T`VfT3_t+&LQ$2veViwc`QHc3}1T4q(JzL9L#%v$Ei{;OMJ z8LI`KY1Y~Uc_&gOB@C+TQ0+3$pD}COm{F9@EyzjG+khzoo#2KavHp*)*Jzm zA(IWVlvH^{GDTkz4EUJ`xWcez&+J^w8Sa;}MEcx>XWm`aacO z)W%IKc5m}Bs7y#mJc^HR4iO8+o8(I$er3_Ce0VE4rx-d;W$a!ZfITfu(Q*_B{=9Kb z*^ZxrdYO+Y#E47tP;^IcNlj)Bq`9lwqD7fEl&*16aDhW5_eT>C1^b`V=|PiRUxKN8 zB0l=bpQ>`6dBq|k#Ea4Pd05G@WFoljs`F)JOri(w3dgBG{@hmi8Rl`JrdyfiRWvX? z0Q{jQfl0sDBLzz;WBi#qOAl1h*7hr(>CPnKDIw$TC3vzGs^maErR>cTX7|wm)puJk zf6!YDs^<6$ibyc=mEXBvlkv|!d@NEi6-rpikRSWZpD|%t6l@_MfxL8Y=-74L>ukLWRqw$u5UVpkP|*31yi+e4Q+uXeW?N8=S#IB)Hkj)!Ep~uXrdRhc zCuU}Tnk{gU=}wMcVtb_`k{U>G5*repHZJ9tUcA*Zvy9dJY#=*TJ4o3BQ_TH?4OW}E$_dRyt%(?nBPHT!QLMmREa~A!1==rkt=X-gaZNKjbG(rQ) zPij;#nP6Nl?5gjwRoN}lauDq#7)dC@8~4p9A)tP`Q)@6$KV!s&aozw;Q%R1Bp<}XCYUyP)uGt0AuSWPWZR$JTk$h4WOGt^~;@+LP(4UN;p^~;8kz=nMS?jod@y$4)Oe1 z(m0$ct{>MHYIOL&ys(Qm*8gFx@se*1E11t$=u;^?CMHolNBq&VVNfgj$M17@zCT4d zrtsc8#8iRKyW;8N)LQ&Mn6c-#|Lh9-S-MRZid*X(fu-BN^XBTDw{O5Z?Egn5+j=8h zF3f=mbdb4Cf#ER|}p^!F#>3zi~5Vh+3r9*tCr}kLTY4!ay9|OZRJtYn| zA`iiHyauA$Oo}_yg=5=%m$mpkHVX)Ps_5xUl(lZG4rdJ)%k3J2H4?= z`*nZYKWfeW^e~J$U0p7KLW?<>$w}+iLYu|mZft$T`Ef zm#i>EwJ&UYBdF|85!jXM=ER})-GljE-nNgZ4sY3ims^E<9~#>iuGHkD48?b3J8lgV zyc&`3x-(e+HWW4;0av|U74f5`%3faAzZr&})11=hF==_UlRoMVnncn?Pp@8spO3U- zWW9b{*8UiKt%G@nS<>|?OF$d2oEQ=2*6T>Ncm*n#DHJ*O(}q|ZZv1f+lb3v8K0YugHTzwt^7NMNx z9xOC{8ld3V#0v=jxDK4+0ZpA>(;41rKVJU77ytEr)VUW3we+!wxqecgL3>G1B`jsz z*xHMnvg)5-N2`s=N$BY`>itLdP_u4#n!Yx6egNETaaB{qb_{E7j?|7owKaA`K^3B} z*(*E^k)V6{uHB+3I}!P3nK+9xJTRM~o0A45g%PGdnre-v;YBdSLFlpSCW?)p)$#fB z3qq?~Dy1gXW!$p-;fs)=8`0p;5%;#|&+Nhamb?3v2LLM`!r2-TJj_1FN}}KTECZ=R^9DC z`w93K_YrWv#cN?cCAV&3&ja<$`wqk8)49TyS*1%+Sv$?PnYH%csy%Se?YFJS{E3&t zdQcKl*v&2e|6f6!bsCRM&wlcYb$VV^qtEhc<*M!3bKPrS?vxc5VdQndjt3QaTlkHC0_@b_pgmA0 zLFDyx&*I_Nb0N?erEc5E>8#~gP$BF2ooych>$jU_cjy6_ux_}9!-#?hME!+vF4w9$ z7Q0d{`ggOc)8)@B^byu%-aovY1quc0c|wU(MlV-^;8TuodRv|r_TF@A=L&Q7S|j)M zc$-*Q_-=^a$mx=;AnJp;GMZQ33Kxebe~{*(LPMLjl{z=)-d)6#MOyHe5qD^dkpt$M zBQ9Kk(Pfa>jDzmoG-7Jl0-(ht6j77}M>0=GED!iQjzM^?ni4O$!5z+VUZD=Z7|KZ@ z#Mt?^l#4Q+IW(BTTe*{e@EqKJfsKKKD&xd?&)%wQX=ht*EVE~l_(hgDomiMR2Be#w zp*9CQ{XSu8l=*s;`Hd)sB&KXdL2W=nhlvT*Hdmi9EQmVg{-^<*-u`00>ksDJ+s0hL zlb#<6g-xBds1RjG?Rq0vqDp*EPY^HKO@QrUzvFO>Exhy04icIe(?LDCblTDpw#b0(6$bP{bp3tXI?_-yDfR`- z_$C_1{<+)X=jz@JlpgRsHjWRDs}pTTro!a4xVmq-CbH^|#%f;y2o5BZ7_=8Bb2*Kv zTi8MJA}T_Lqfk{3{1tnCuiv8<&wmmHwPw?5cR$4sC#6Z^L{R0?RE#piMIPZbz#pv% zSt_fpuzHzMAtv2Fmb%tRkY()KP%`tgykvgOHeFwl$g>uTWk^Y9AL=mJ8PqVJXl8c7 z7x4dt)gNW?av@bDzP7=viz+$UrfD&X7i{RC>av??l0Ko*(jx{#X z1NZ^8ULZqUQcsCo+>3eBlx3kQCF$+PWsNee_f~;nkAIF4&MA>~$)SR;l;yz7kU=E? zU+*1+!&-YK0Pijug8N-YaJ^Ge?00!PrF+;B+M7*~$i~9-0F(9f?*oC;Dw8oFhSi&O zo?^=@-o*2Hg~4KtewjDIrYMeDWz5gWqedn7Nn&|{0q1`@ALU$rYla=^eAe5S< zHG6|Y`{n|4XQ!cSWxeCTrONIh8Nz(7t<98hLLAN*Dmet%=FZ-`T+-&IXi#v>BuIA& zn4%C4CvYI>#ZRRWri~|+89OVpK}TyjoCk9s;&inn(NIAwvCKoV@TQh`!2lxwM=PsI z_d6{uj#{d-&yM4(hrCqtwL{rTL!92j$cDvac>3}m5J>dxnovB!RC!NNlYp zfP}_kunWogfWi@B>pCtkXkcb6#MI-}!NNX*}&CE(S zMLQx~D;#&AX(6r-%i%=PS?u;N>K8>t;+&>EXFg;ERf>>EKtv&@N0*7l7`_Z4hB673 z#6<;?C#a3&B)qQXd5Js;Oi8q5`B{;rhf289s`R}|<$c8TH+fCOPeQn`4^_n?B<>yf z`%TmYg|A3Bdd*)FbJN)_LpYFj194jtg`M!l5OA$?#Y5ci$Vl^k}09!Zf!IUy6jw*AenvlZ+IFzfp$9&4T}FL9T&Ryrg7%|3k7! z0N##`It2|sVS8674-c++gQ(f7Q|i{o?6#)nO!fIpgpU?f8usXlQYx3{F@gRR1vBr{^29VnpYF#FF1Y8+Q{I!y@vrRauiIxzbsk6cQ1*h2P&uusv(z zg;?w3r5*nr0}ghyNkXDJDWs|?%%)d&LbtCgZ??|GbP>&JB?`kfdIlzhcVYCq1q?Ys zyqU6y6%Q8&#CF=ms%ZiJAbBaf*|A_1!aT9Qqc=F7R;1{356Q# z#oHioG_~=hb!gP%u@M$dd4Cz2@!gA{$VN>Bg2|PXjpi>_4$0JwN%2g6ucBc^HaPS<4w7sw(En=M3 zCvxB_dwh~PMWxGpDlXyt_K2Xt%C89NPq>JYEMeM%n8@aqA*w}L+(zw>#W67#r}TWx zP=@z_kP#Vwll~+bUZ~WYH4loqSABI#&&a^)cwrn#WX`o;Zb-!8J6revwxdBJZB4MR z9!srF*Z5gzFtIzsx32~Zhow*^X%3&Y+-N;4BpuDky!%g7o*ea_y%J{X9E%Ld*&a3c zP>IG;MecDO>wxs(@iCU&RI)msl4??VW4KQw`YU3a-0tq^qxA~dsYgK9U|54b^tDHK zZKbvEHUiCx%Y;9;ea08;nxoYfpRCWRM3W1Vh|mPxR)lrcT0nXz6RlKKs0?-LrZ!?I z@NRTx$u|!_YS^y?cA}?7%I-*!U102$nGYS@Eb>L*n&_t5>gkBfR7UmwOAq@*eU*b0 zqugqsd~HnLv_mJ3DMoxStdXbeFQvhvHF%Tc%w?xSR=A)Ej?U(m?zzu7R5JaW>D}SaVKMI#e}}C_^qE>yu!p{Ff03bv^BS?Kowz z2LiN7wm&>9^bZ{p#HO=%I57k(C!l8K238V>vrdFmkugFm(bEJ4Yj5MD2# zzPQ8=cz{aDpl&-2D=I0Kb_!u#d0Mo-Kw_20I>9d&4ReEumW9`G{2z5orM-=H*$fHc zkwm=E0)@1on02X=&VV@F zl=ZEkw0qHb|C73UbtBy0+aeic@9T7}2LWlMS7}DS0LRyU#B>hgRkP7bjr4y8d)kw9 zIR1qeF|8NIEW!dn*ym=@-WQGpB(Jus&0S3C0l}N1`WM8$dc0=LRPdn$Cpo9Bm+RZd zDSo1rST7^XGg%!ETI8H%Fsgs#63=_haK0vveRX5ILh~r);_V~NV%&c6@>je<(1h7U zjESK4wqnh7adkr9#vYMm|8udnUOCLi3{=iqca=K!?|PkgpWqthw}(@RgTD`KNuh;> z&Tgf!z#RyxBT&2y#8??UFCwNFDrWUhs}}w0{2{Cp2z}sn_#}c~Tp`Wqq*0g^vTQu%7X{5$4K3N^y5tr zP$V9Ki|*<0r$uaEmR(-ucQ}17%sZQy>LmR)#meouv%m7m`av!)dfjZkOOL+7YN%ynPdVV<&tX7*QJjGX2Enw#8ndzuYry zeYG#>1mLH&)Ju08JzM)J_mPJ#pB{y2kZF%oTSJ}8IG#vpf!~xdKsLmN?rY6ZM^mnW@X|eisg25xTneChJx> zkN!!Uk8tjzROMD8CwVWo?un>>CCPhR%9$D963lT4h=R*^H2D+wfZnm#4emLgRr*2} zY1~CQ?9`zE;;P1oN^HdCdp`GJ)}zS5i1NgTFNaRXOo zCw30_*mTs+ObAr97`gkCJBPNT+Iu}g^wR`9o`|)$(X@_((ZTtX*4k= z)@R!_1M{1%BV1*N|9wCTyf{RO^NbTKKjN_!OsS+3Lh@Y-(cj(fftiV0Gi8#4DA}$I z`r(%X6)xq@>LtfbVFMc)qsUf$5REfuYfwzEyW)Wg;4=OS_k7a z(Jl=KkQHbd5qLH{*)wFH zBV4Mgy>~b+a`wM--5J)j$fAGq_#h8U9|2m1hODUeVd+f%kDmBpyO)YKlH#kDB{WU zk&>}?D4#n{*V0_F^9#7eA9ddTW#3b4C@(XZ&tGNi+~O8_X;X2&r8$M$oFtdGf;>8x zp#6F+CNK&^;<8#UA+3#+Bgd&=eNyrm-yJcPs5lX}n7RIDuVUnAIg!SxYAwtgrE6(v zO5_`o<0Zgxc49oYT`7OF+ITKF6HY*u>SCA9*<2fGcGXjA<{U~RC>qVND~$5QM3vB< zN$S!NGc7|)2%3UHVrO{(YYuY6MzU7MQ6C~c$R*^jZsH-A;C_2G6I#4~6ed7{qfa%Z zXkE{+aLo90?;)aSSeQSPQn0f-G=y)G6EpUZIk-O60 zDFNOaNt%EHe7wB;!rwS4W-(-bqzn1XZF0VH?y3)OB?)hdxOnM2+&~VO1G+8sFt=FI zqI1?_;Odx2x>9K$JYB7S#x&m*r|00L2yj#9-x4e<76JSm(UuQ2yUjP*mjGupme~NV zechxcyuv1+7!6)P4~qgb?hWfmdHv^uhE0+i+lXtRU0?2lC@3ovR?Hn*9)mP(lSq40 zm#}gGjpAr!QJ&y1jr)ni%vhVzrZ#%oyMZ%eRkuU%5+RU1N8a1?JG)OV26T$@h+RcK z_vi1BXCyGPfn0G@7F0Q)hc+ReavVjh(*Q15Hk@n>;?!xMQh}Y5T6iBeMLw$tys18b zO6*-U*V{l`@#+^ru|@Y^PbH3s%fm;s2(G(Fe{xpLT-yB zm2110cxBW68mBI48s^ULv7-{j8<*gL@tboX%fNX)KMzq@gnBOSFP#(R9~p8|HC6U5 z?!pSPH;8N=!`O)|3xkZ-_$nVV4Pg#i0^&#Axu&unI6Wb;hx`9{^_T3m7wpXu3<$ zEXhW=G<^k@QW5O!E+%Y79__4Dn1=~Enw2Hmo%gRn^|Xj02@!tQy#J9#_@-I=$+!@ zLYb81;5hUpLZ)CQCoGb}yx72QiR+VMF4(`8SBcw0C!B|5BxUu=33^yWdpTEMCG@Th z$!m24F=)3*XY`~&y=s(mBy~ZBZj`z=nWID+`q#oafiipv32&%nxf>dM2?tVV5Sy2v`&*;kQRJRCdqu;Yy|77NJrhwG+vA!Dr{Zhdl&CwK-0n-P1o$Qv zPrEBuo0?ZRu8tFtmpPL11!s{1U0K5V!(H{j=zCD3Fs_U;=@GLk%5d|fo05kAi4ra6sXtbkISgW z_5umXW#HpuV4Az%qf)i+096}t#;EV`7I*RV)mZw!x~H&MH3g7iDZOidU8mH7BXk%%j?vom97GfS+5F>8+iuR&goN|~JHnwOg!!lMU)hfVl~l{XLxW> zu(%2B;f|x6cx4z41y#6~vITSixZ)95bOmaLgi527tfwSOU>ZQ{vN{`=%ImBm>(J*M zN6shMh;BqjCA9pTV=uFn0Ovw;Lx@NSG~;vw!WY!Se#mE;u(D_$8Fuh!C#~7v%i5#i zlU?`ac?|Unb#f)?%V!wathU&~_b572Q$pj`7%^Z44D)iaHkAdb5SAq=#Ck$;=jjq$ ze3KC(`G6O2JJbjRgZp%lh9(hq=Rt{PX{1Dgyrc;%ASU%;J9HeFzVu^_ZYkf;Ah;WtYB}%fr_s$CZJ6BOF8v>0jMlDc69SxKVC; zwl<3BVnQ>yU9jeoe4gU&4|}Mf8cUJMz^&{$s?=J=%kx{S?v|b|QJ~%2!1a9t(o4x5 zS-XjYhZLy9L0uHR}~_)6LAYhv0^{ zPnr4|#+sIly2Aqoaz%f{WQs2}RtZw{0x6cWpAd0KS!?l7l` zu0+Up8Hb7|RLH92!@7YfPYS>TRc(OA@N#1(H^qum;{N2?iZT+-^wKyq6^}Kh8Ax~4 z({G+@pZ6(TS`~e1c&z(DbfA^bMl;$S%8_iouw1%{q7e5TU!LC? z^(pAUDj1UY3hHpNCKNwt;+w*tg$d(aD&AaGzm6q;Of$vss>5r|cl~c(BY=bZLJy}e zVauhBylfcROT*mC_F9QN5v`+h@`(2x>LN0QlrDm3&EhO`{9@w{?c8$=yNKDEDX+nH zIefMgV8eyWoUU4M-92&qKGH(lyui>6j+ z_pGTy_#!1}xiQ4)I&2;?wI(z82}SWtq~B=od*<=M6jcF1DTS^DFKGsUXfzGrK^BMF z50gADH_-E4BC55dsmYHU*6is~mGaD20KP)0rS~v_%Qat$*|t6&RC1ZsIl8bgSy>Ks znkBokuEZMfM#nOe!;q>Jo--w`>P5@t5z=bH&5&1mJ!>d%@G8by$dB(-s{;}oU{__s z_fHpP_RI&kvQ5b5I{)rASch`M8yBEZOVSR!wX*{0L9r~w?bJ8((T)i3tH|0oq++O- zKjx!Uh~__yAwO`%j>+QMRHN|x$heVvAX8hjTRNQMb{@TQ`ZIlg{lS*!*NTgJ9_lZ{ z*tF#?@R9H5pqragu8bSTfVF=f@k>H1&e#9U;Fn~>_&v0_79t1~U8?NWn3Y9Zsx{UV z&HXN2w&r9K-4DOli}`aY*aOm$1ZX(?9ue9GDokuLCi)j+EfUyKmgFj*yRPk~LjRr* z+X=EqrkUC})ok0vPB_XOj(HR%8J!_B8Ya}hMVq9nM9c!k76fwAsh@{e=D-1lX2!v_ zR|f{@fpx1*b^_4g;HYcn3bp6C;k3nx9PbM?&K`ja^mcr=ROvW)pYPd9gV47`9C%vK z#-g#e)&t6394TLXAJ(aR-&o)ZnX`}Q{9H$Ul2GPNC8WDAUpR>DPDl_g0P=ed5o|4` zd_4Ais!7a${HCWU42Vx;3oQ>!&sRm>YlJFwpijo3&&jUr_mXK-MY+v>6KH3?^jd3e zpLExyF@z^eR6Kq;_o3sAcC701wYj03NZONYoCXEPaYjoB!!ZjEjOA|;RBwO4<0-Rv zKDHgy*Yol}f%l2dFkbq5O6>2rx%IHaq~n7T(22)H!jno%!^fU2?DqR?`;eK;|7^f6 za9loYca{A(i@D*ttm$9Zp!*l4lwSlY`RtA2`z^vGDfK=gx|*ma<2#n=nKQ{PlWVfV8T}8_ zQu}kojWG#M4*ee_D}{RdR*~qE3JG2l1$!wq>4GnIBUo4n738U2Z78*;z0bWzKJ+tn zMz)*co2J$6%6?;d3gNa~^gFL-_)aH-0s*ph_(zw0A_izSv zgn$jX;o}Py1sP6iYUqHXuc~sMl0C?~$q(d$)YS1a5K@mn)rM}7R!P)Cc*E&(Ic&P= za4fFrjWZkGwqfu!-8-jHrx=`wN05Y?^>;y;5?{of4(=>CR{UtBz!X(p5q%Sr`cbj> zWChhgyrc?;r28ya{Aw!XXCN(y%{}^KR9ax?U~XV7V{~IAmF4QmF<(bwe0RLrXhr#dC87_x9acqO_!nEn%Ua`G%eme66wcDf zDlb`bvu7)OoxHBmcWcX$`W~rsD?n`OECaj0mHD{Pq>}KRz<3tmJM`C1bLR{89@(Q( zwMI%%u0J{lwX&lFr}K;vEGjYBabx3}J~oQanw@6kytM8<3VDc8{$L+CVjx7o?nN_n z#<~$+NviAh{7IBYbjDVJENGv7BZiwf;RybFK?J3Ghpg+tN(f7z5TD--f&eb_?oYt4 zztK~@zJk4}VwF|u!}P0VyeGPeJ9l>KwaOt35*Rf!PlFFvQj@z3;{FN1K@fyBn7PJd zUi+1gn~_G|X!w}fl`$nlD&J^bO90wN+$ zg*58Gw_V~!RmyfU zAml0k*;+(u;oP>ZX;36d>y3=BK)xz)+TJuWqkopdX-mA?e@$y&LWN+^b|L+HH3j8e z+O*-yAkz4!QbXg)ygmMFcHUah3nrnI*I3k6s=;w_=u!?SpS}>AI`#zRn)SMcHP6rC z3kYcm#!`{%9nIePoa{awoPfn(l4#KX%GJbZ(_M(Gr5DF_$+%h z`1kipDcaMiJzA-5(tK@Jus6*8j~PhrFiM6j&(kyUa^x8+q=JtI&Odr2ugUet4oGML{-)sxLtupTy8Z#!%hKZ# zhICgJ8|qN@3S7+t5)I6jS0T22k5jecl50Z#lKo3#UYx~DyhnOQvcVGu*M=>{f?6W+ zea3DCNv|;WjhzK@X9R;Dw_n>Hurtv}M7Nl?_E+sb@3D+xbu*_LWrWv$mUZqN;-*RR zVhl25Z4luP+Ky_=@%t|9-Xt9jCPRQn-I`pOvpNFq_1CzSHB~QTT6(qq>P2annMpQ@ zH*^j(3*l#DZV|BcrV5{9Yr(M*9Z4&sdpUskh`+=}B)8`C=(ma#dhBQt-yC;s&NVLx z6anTLrfwRFM^?pH z9vY}74&rV+s1<`5vwm8HI#~%~!x2KTG)Xr!J-f7Z(uBPUavq_z)qBv`itjp$=q>xV2gE^+zTAAHUaK`4*pXkOi!P5k6)PDvQ?mSDqRM$Ti zW2uStl6iZt>&DKi)^4fGSV$Wg&?$=H0BT}8`vnkZ==WCNi!6ILRheFf{s6WBbujCJ z3W3YA{x#Eq&7y~skwnzqexUz4fn<4!+`PNyVoeS9XK$8ll`9&(rN)ppq1~yzEqDUL zvhBwRxfK%KD1W9z4NK~e)qGT+c z>qAw<%~KlofrSqU)dT`ndFouVx*`^`9z=8POyZQ$FHD^diW=(J%BQmjs*6dGwAdxXtQ zgm05|jl&Hz&vw$Yj}2Ubww(^sS0dgPDvm={Hj4e^Zf|R48e188OUaD&v~__Bwqq8Z zqH4oL1CN2#$7`#Rkk#LRWa9!urC6=GO%Zr}e5#fje}v{*taeyM5vNeVI1?~1w|x7F zcSR?3fM7e%^wkkGBnAL?m@iG9&yWvOEurlWa8%vriSJjvC>j1xX zxZk0s2VMndhEn(8w|1U}$%xIlS^;!XJ#e(uEpp1^dHCZ|7dK1;QhKSsbq`Xm$)@n6 zRJkgeOE`+OQTcBUCEOcp1QD=4xgYz67sL~C2yvF+(5{B-aw*iI!t51XZw7gY6wEw6 zn$Ofu+fLqSiy4%i&^7!j&JrQ}vfF7=N7s8W8y;)CqmZh_((@I@MM%~TAWc%Z2R;-I z9-JXye`xr=yuyQjFj6Qm6g9E!VJ z@!}4r#Vxp7ad-C?cS>-F;O;K@a_+tF_a}eyBze}}D{HPj*BoQw_=OVBi=I>M z<5jvQ;$nU9|Naot!J)A2-3#l2#fnH;{d`Gl{>|+&YHIz+j0~FeSca8Ok_dw;eS8@f z3`J5DjL6>JRg!xCbnW_gN@eQ^Q7n9qg^PWH1P50FcQU|FmUq7s%NwYinbg!m>-3p| zP|nVd9EYBS1X>6(nZu>D?weHsS9}St??mqwaGXjz8BU}M#(uP+p5<>5F8@0S&W{6b zuvRg!!)O4YJSUmt_{0g!Z~48P3$0uC{ny+^5l;E^A=(KP?0Ih@Az}SO;rW8}s?Ki* zunB^*^l+(q&^zw@0>2!{JcCt3#$<+RNCFicX9#-+GY5iu>90zGn$KYLTCfr#)RhWhpSGSfc|R{)hi zX<I32v|Vn<%CSQ2XUs#x?zWkfoI*!j^advL7eb^Hb@A_;E# zFd0Jc!C!?n*&!O?X5G*1ICzvlxMguAxx(IUd2StH!GzW5T(%K@c5|l8oc%k0$%C7) z0jxB+l{ z|K?RfyZ`>oj9^PVwHq;A-Ma|4#2JhtE{x)|yUVXnxWc~`qBfIbq>8ojTy!TqyG>M6 z3^uUceaC^duKZqf<;W1U_?2|lA0QVsU!u~>oqp@c)psGLAb(h}?x9%-fN%~-1dSgb zycX6&yG=DiH>(>NlJuU(zN|+ZHLg@V$FFpFO`B>5D08tlbK#Lx6|7Kxa4Fm8w6)Xz zZt$le*=d_V7s_oEa=#xWqf9P3PbL`~EvOk}E7ih#i^I@kPOU&H5|1>Cx9&HOg284l zZ|1McLstpUdkRtUC?|&dRhT{_UsakuBa-YFku%S4WkMtnhsAhJ{$g+6z3YEh_1eHW zRUM)3QlY#vIXU@hAf}RXxHKj2PJOflXpUZ}#_;?$*H5XFc}x4dzwLATTVX)ab+&v% z3JZ4vvH=4+?dsi`Ru@VAEuGrq7{dSyDnD41bZ@1hG&2}Wd9r@b&|P!9Gz0qz>wH=1 zfigzO`}udy(67zUaF%@A3 z$-eM#vp4=lyRnxj=eunvDgJYT*YLaSwAxBWYCnVxI{ePhR0CbwVk2I6X+`s8msXRt z$a7!C>Yx^E((~kVL6V8O<{8!{NUcDQ%D6-f^uS1ZL*S-5B=?DH$%5ccm_0MapK4(d zm>`r=QKJke0V1+>~DSHKQr29gAJ56KdVYnt~tNMx_)x;HTHESB``O~`4HJ( zC|msc5g7F}4_VK1Z^Q270s79gu^7 z4|C_?zF2Xz0}>Jv2<)XmDeJMAU74kuA6mb$yKCvi{)%VX;hq(;V9OE5cEwor!HCu= zS}S}g@~Wf(JUZSefr^{gelYc%nWcs7vOwibv^Zv#Q%S9f|G_!Q_<2EW=L5%lqTW^#5%J2NX+-8O*OFQT z5G&5x77B_K+VrSgR2*tTQf_XiXnhIIn!A4+ko1mo3f!J9Dco{6^b8)69q?IU@q5-A zKY5BdP>uzq6fW>pv8QO=m{sR;)wd;?Pd8NAbrQ?{0l%dEHPoFQ9f6aIt47T)a9H_z zb@nS-Y`qgwBi&D}H=+=aGnQcsz{B!N3;<*Ht&1> zDmzXpOz2R*m6ee8rjS=%#ztb$jrp1h-80of1T}%H6B3fy#9csw4oCU_*FZMYmBXS- zzXwF23BsFup5v@mI{gbZ{o=ZYoFOx?|EYV`bnt?xng! zX}x6KJ1&2b%u1KYZ=7PSARqbLS=#Dpj`D|y2x{rY%D|6d=6p3mOV$)hy(i2mR70^` zJoig^Q$KOdIV$1iDAxXu36iD^U0)z(mggG!CRVAD-u`Mvo40|zv5xw(SQZ+xXdIeXs6C<{h1_vi#b{+~kZ5ou&bP7pDn z({c$f{m)JwRkg~|ckBk~Qpdfaf_uY(k3GKWCkI+%f$YkER(b2SE zv)|x@e={OQADg91|N8T_Paab<0rs{0(FXAEaz}6pn_P+&+T@~IpQ7YOmhmfrp&zaI z1JbM4uAMo&+Q@fL7c~}i2jF&sym_ScG#SqBPEYqTZ(Z)~5BUrxjz#5B)|OI+t8Kr3 zv%wM8uvM<)TGeUZCys1pr8QSlCS)S3D=^bcPbyR1lbA2HOj}qRf#ZsgDbnf7cGh#V z%R4X+5jRc!$SiDJ=_)Fy$DU|S;=f)tk&g7XiC7r2ZW&GX8s}qOb>z4X`vIYgst~js zH7E>M)Notax5)G=GJYhWlhEyRdJKzL;+siyP0XD|#bKXddcx~=`fn=O*_m59P4^L9 z2wa%$Ve*1IMUtez zQ+YM!g{9n!_MY=MovDp_qf-=SDkOG{i#6QPXTIuFF)FR$k>uX8#F6nMpBN!G`hO4Y zZ6mNrbf87jCfu<7?C=p#SR~;OABJ0Kz8=}Yn2!8sbHQ4A5^J6vx?*0rOm2z?9?t{~ z=b?#HMI<#=CzvfYG*7=NO^(Z9{}UKOGTEX@pc3vs0j}y}zvSAh64}`pDMdGO%h1=c ztC2Mbv2kb~&JyBy@=Z)`-4~Ug?b}&($%7@}OG2%mRp^!WO%{ba{0ZM7U0d~B;w7J0 z8-%Jh!4;_b=*$`I2~sZ#?5rJYv(iZyMZAbUz5nSVhSo~b0&ocbW^!=tHM1`ygW`lr z2C5p*Ti#SBzXyfMOFpe_PvtYPk^_Tow0ei))p4~A5$Bajk94*we#f9uk=sG#)s6AS zRdfn23JYds^xC=C`H{OXWwP78!O)0(;^DJ97b(V zJ*rz-<;0}!Kt=P+C=|D627TWG`|?lC2;?Lwhpb*D(x6GV;Bs-|^)5$x8bs6ZD|$om z--0f>ZQgO@jF?VBwyrnr3Q0Ph-*HAYF{E`FWSs@3Z3^OezRPb$b)Nx8J-VBr*9Djh z%l>_PflIiAxTKakC$r|*gW4d&>H2BbHV3iaD_-(U@jaBCoIw~!)=7FlR5+mXarf@w z`-9ye?&D}-HV~O_kLmfxK;5%#sq}5xG)^n}kI5C5vnwW^LWQPFf9my@`5_irWiBc- zm^H%+ZYk|{0ptN4@Xc0{F=$-d!IpF?*>&pB;|*CVu!Y?bg1+HfW~fk>wGX9+o42sA zqUlZ21biq}lXHOyAK&GVF-?8mzO(1u&DahQ@+Jz zR<tQ4JMZTYNOkQWiDvusygP}q8ea#na-cCTqpK3?^7mvsuI(LyzEbPpi4@S3w9#+aYAD*7N z>3flJRJ@8KJ{WBBE|klAh7n1bc)Z{0!kV-benp8S73RUTlc-UIHGy$dAesLFz1JfhJ`#Yn*$T4Aw&@SLWo$PG9{ zk#j<&;8vVz1;uPaWHDnFe#PJ@V)1MoQDE(X68@6B%ejNl!E~g0urA-$a1)zk2E})5 z;j2;7Pk78T{3cy>nT>5*HZn;^i@R4I(?px7skL7$9G^6h*%Mge{6Fw7Z0BoD z{zS*MA4`qvC2rj3%{gauz4My< zrs5;ZWWm7^BYs;ZReR2~_ZsyYn`7_Bh1s`Rf8Mj#tolkskU%9t5NT38#HDGApDC!4 z6Hwk%5x%H26@ZWX{p;`d``qKukq#qXZu1@w`dtoT=CqOdBv~pU<@Iri%six1EBIrK zFbl4)oZ;Vm`o$ViMziD!vSvS%C{xYA1FurxheO`1SUk1`;q(^VQLvbl`ZO-L#y*sz zp%HkF;|&SiJNv?8##Lc3v?!ycxu|f#U+&~tP207AK+%SL2fFH&EF_-)w&%OdW_FG9 zhIk-v#I={uvwY$;`R`|-v`lW8#Yv(=Y8i*6!pZuhO(>K~%i?jhJvRlMJ-5Zm6vW}_<1OOXRAdD&YeJ=3pGdii5?|*_JdU>FJS$D>T9lG-wWfs>7T4Ts z60g<|a|yQk*4|G5j3LylP|7=6IDL_9U-%=rmF2u?OS6zn@VOK#YUSWq(*xTkRNlp) z&dNMX%buE}iU5Op?Az%;>NJ5TQ3G(Z_-cJ`d|2grIW5VLWr;TEnMFm}W6H&hm#mmK zUt<8oyXKKiO)0E&lG;bN{FvAcB!f3)5PyAy3lzV^{V80`a-~ktGY3<6#ZufBa*1&F(r@W(!9p-aRxiQ8naP(O5MORX`QNZSwRu%TF9fx; zUi)(XS$EF1w?GOQE+m>Rbaq(d<13pyNj{p($1}vWL&I|z86RtFho0?gp=uDz8VLMNpD{5ABrS;ecwPGuN<do;EgS`*UlIDCUPZ6q$Qb-pXk+^XC$t$k-Mj&Yr}_Db%5tp4)S#sM`NfsqdR>k<_TBeh!g%Tch=kOFF-Oa3oWd z+g8y9D9BH+J$WG7_HThA&>^V2wW|WKDwR${e?q_g2We^kcsLRD-9GnYEM2tAM=NNX zikWV6wsgri0kf*gU-p%T$%3m4nV*k5g7|<{^*#rfnx{Gg(1&SH+;l;(HLitb&{7&j zD|;&;G36#+dX8KxR5!aD^BoXlN3#H3nS$Z%t7vSRDd=n?_8rDY5Qr*pwnss-#r$Ez%ibZoQX=^FE~A&b#0_o<`iY)aAJ67OPu?fSP~AXC#ZFa!SA+PKU>CH}8=c@5M2e=puNhs_pV~By z_kh(+Zzun=m|k*KD{YUM2bNsYyZI)C9p4d%LKa{4Fot^6N&r?y@zDkRJheV$vTo0n z(PJW~Kk)*&y6Ia!?Q=f?l49z>eQiFm+ZU;F;kAwy=WI_RHMZue6(UuIFA5duc8y3b z-?!dlqC51i8h>za>Zv#nnBZCe#IJbTKT2Jx!&{57^s9N_g8zOnm4wHUXk6{7=DCH# zNBX+2`77Jw^?u}2Bmrv|p4`G!`THW9kuljyT*I~2N!PByUiZc!#Oi zSe|h-1Y~K(s8;RVL|X|m)yFOB3`R|;Np-EEyxV4^X(Bh-90K2Ww@Br-I_+)1nTQ-_Vwu6sFhbHKSsB= z8zB4WxT6P#b<;|vlY0ui-q0Imck}FFofuC)Vkp=f@>5+~Nr2bv7Q1mr1A+}RJidx= zojutWE2O+rmQ~cNy~N8^9s0U3;)JcaQGFeke6HXcS$|1l8~$vb`t0b;z?_`FgK)Ry;;Qsrq5lTMz0MJ3+ zu^1+C$;xZH`Xjk=sm8pYxg+>@^7Ftk>un$fvo)OvRZiw=yvo?}n`54@v{Hh(Q_#sr z=*OP$MC{Kz2`Ik`z&mO#Vdkl{pMm9+&mgH&j*;0)h)Z}Q0&yoZ2QKq z`Hw!IgFV&)%v{4n^5m2n?S{2myaa+jYJm!;(PUYB=hi4Y&(x@P<-f{&6Q3LdN$!pQ zJHg6OeILp6Q{d7LzqtY#rm$Gy?NIX3$y17moh@TDqW8(`Zui}5StjD$ffG;~`T21) zrry;4LIn3$lzfo&-HqxhQYD0yPj~CPGrO9{$o_iOKhVUJO^)jCH2icok2hB8gLOfV zAI$LYfNpc>$tp6|7uo-;$4D+og@F}OruVQ~k9=|t%#e8OkJy~O83rqOXi}6|NAx$h zWnT!hzAfgFs9ACp`}1qfcsuPJ#*la2hV)b}bGm-Fsw+o-A1qE!t7v^0>6&0!D*FN} zZG}B0cSeSCeIKK?<1YTP@F9nDpLe@*A?Vg#7n-~NKKZ&zVVCs)wcDSDDrCDl;D^@K zck5nZ(-RP}h^ZLndv4p8qab3`pp{>akxdH%dJ_%8i)?2UL%|o8Uy6HwxjvSXF(0Ho z&rRNe9$T-apVc3whX~|Uip8UY|0@mzQm2fHw>J3W0OtP`b3jW3X!WM>ksm(y({8m10}%A#)q*Mb@lGxZ*vCy{?!#UW&8J z26xe!?U%@q6m717v>(94V}rFwH5c!Csi`13ud{^OSrPUC&(R%9*|hTpfIksf8+xDZ zyTjwq@p-WUPw0AcyLjfsB!PZM`kHtL9tP3=cf52GtAToZ;G39g1GsnRW zM!?`{;$J7?2ZOC+pV8ArI++;66=o*{w8h1-^5@!X0_+)-Vr&N?cJB_zI}+V6HAt3Q z@THTh=#=N*+(!*fHa^a$sqI|#P#Qf(tsAW7ECP<|OBFvE_R~9EPrWn5ECs7CFN&PZ zXCw>6)Rw8cMX+msChRuItS?ur3e0MyhGuHWO2D}bhq$Xy`}Y@un-*!bJg!^};X2-Y={^Hrqu@A=2g|(}C>skv z+{;@vK_NHX)j50Woyb}Ia{qtt9%-)GH4~gi2@_6lG^>E>pBpVHLpJNbWzCF*1czFS zRpwX-^M?n%L^_r38x{#9>~6`>#;+BQ#&^O&hxlJPJ0?Ecu;%nUVkYQZU7J7GP8AQu znz1*p10Vr76W8&oY4Qp6S7`LEL&{N0A!EbiGY&HmTrPLmE;h9Cz3Fvk>d*1JK0ZXd zy0QlyrEJSkc`vhw-A`8#tp?c?>}#y6=LeTjn}z^>RW?x|3Agz#|Ch&1K^*b%HNeH0 z?|{9%J=>)5=ghoR{9|dZqLQ8wPXU7#3fj?J#3m-Ws#}7 zH8A#(v=VIP1zgYDg;U4J3Vdt));Gw=TvXZlaRSr%`Z3_;K)0%4XSFeFC2U;cN=^rk z^W{~m|GqV=Tvn}-CJlE*^qqsUME|I2XP zNua~{VxZmia4oThti82@MKWJ?-6#uD{xW{H*mjJD(I)V)G|7ERC%;$yJF|!wbBa0L zt$aARKhg`&woj|L(7*W)zLV!fQD?3?`&*A5=vO)e?CBK1XR}L$KGd*4z+i7k)Q434 zZg(|_M#P;BbfaIDx!4I&^H_r!wxGWpX>9IgC8~148zbi62mhGZpRacYbEOg?iyqqhWRay!n6tS%D?4f*{#Tp z(%kWTRf>CUi!E)oAD+%0<3tRk9^IKjSvjd7KHREdf?1N8Jiz(*QcEA`K@OM6<{O*l zGuc;lXk?@lxn6t9%8A~_`98XqX`O0$Doy*GL6K&=uE=6Tke?&I;=+Fu2aD>-KS&c@z2;e;9 z-#j`)qXx1&EQenG3MQc*M^29$e><0ADV*%63BSX@GrnE>h0rNF(X1zTnzXqb3|oN< zRzV242I*9rXH}5;#_XbEhq7U4olw`UJoqJqfNbt!4IsyRs2H61=D01lND9L#pN)8- z!;Wfa`G%p;Ts&CR1o~V#bbQ?JQt@Yw=Ut~yGXrcn?3@y1>W#*)LK?ARx+ z;WuIlZ?Hp85vZh=&0^nvRMdQBI$i608aLIyJaSlSU>b~pKivtvW)Uk(dQXiq_f={m zz|m|M*$uzZtIP%3XXv|87&jYz==~E*qp^4vaf<#s^f!n+nlrVE(t%1E_1}eL3p-_G zX7`SfQI?Nkks359EV#@NlKOpZ1xss87p6C4=CHgddNQhwGd0$$Pn!BbId-hpePc<( zK7Xbz6<<~v0*!3OramX?{0o7p0u|glaF6NOb$VTVqir)+LDi4b7tO5= zJ891iXQd{O|4R2Te!8n9h2ZKlA)h%fISMnZi9`MH<947h;YO zrF?KFaeuAI>O#uOk2iQBRq39Tgq*E|+i%}pObKn|{jD=mWdK(T zj%=P>F{O0l&d(^xcned;0jMez!GVP!pzxw@Ut6ai?^Xuymg>Lc9(Tk8I$fiEPEa~| z4q|2@en)JxlRmYFnGz0I(@sfIf|?00-$zWHw%8WZ8H)8ZEy zmK)gsJTl1oDV#(Mx}UF}3|-IZ6sgQHg438##1V*e_V)uo6f4G` z&u_^yc4c3;-z{FAq9Y&e?tKYlvpY-+tu1uM7CPtdjX%l%3Xc@&sKF2zSCiYRQjFob zD>)^N9$*}t<%yVBWHDLy=A?rTw|MOGOSMJ)l42rZtD7&lO&;atzy@C(yM60`^E*80 zaSN2tg$}f;eH#75|Fl9ceGk5z6&!29lqLR7Pg9MBNhN$Ps>1z&KOXfC{z;|f6)2GO z^TS8(fLGs9WkCGD&pL63VXmV7{{G2CQ?yf0^;9I5Q&UrfT-mg;@&9KAa8qy&MnjFW zgipPcGQ!s!m=Vztu~p2GfQpN+e$15fVbCX6_w{tm#%oWWvd_={XgfOX@{CML?kLg! ztVrwx;f5=Q~E+RAkZl~{=@sj`O)_% zDK>;$*%wFbwoS(BMo<_q+JBIg6+75b2p%4A74*#_l@*J;P!eL^TJ$52z)KLyuz2sW z*C=V`FVT*$%G5tlkD~=mb4yc@p0*Qk3`i_H*CdJadr5z-mQ~yi`6v5No>u{6%IarkZvWt z-{UnZ6=I1Hd{q-mGD*NWQ7t9+UA zlCT)0b0Cv;sF+&6#dzR|nRk^ZUm}@0X4f~M862%Z&fsRJ>Ka$1lNp$3J-nNgHsz9B z@7(XMbdnV`%zo}Fb~K5m6MvGvplxcF7hWej@!ans2yEf|I1!@Sq=eKokuiKIRo=P_=r#>+pw0&q zf}@ zliV$Iur;4#nv|#T(w9X$uxp4oDK5WRA`o_x_4E8+6l=~5{9rP!1|O+ydaKKwNhwt< zhB|z93GPDDKm%RqqW^ZFkBROqs|3U@&B;R*7R!t0&M4P%|dDUhA#Kf=K-J&|SL9*H~^ zp&`_d;RF|5>9bD&DeeMaKfmEruKWdV-0NEkz|TNd|9WpdtIQMsvpq7NxIej!

6h z0rVKTo4WW##6R;D1%-S&Q#)meBqXD7d}fV|Zj>)cQosYNtE*DN2!K&?b02npV6hV0 z45)E(qJDlsHfLvN4Ct!{glHRf`o`23>-Ct5=ct5!xH^6DQL)SoDsA*^d2K|k%a@Sg zDkp!vt>)i+1Mmb8e=c!--4_&D(Z{=e_M0(zz3;e?K0OZi0}-J3`sVCan>s0Pz0Pv) z;QYZUA;%-M=9a$LhSB_tcK2-ctAgWhzMjGPavq5dySx>(B^x+lG^pq(pO(y}aZ5Mr zj5oG2n(vX3@kmK~24kiKeOhxdFa`>o6&QIix&WZ>D#KwBe7SNZ^_KSNR9y7r8UZH^ zL%)B29(B2}Vy9Cj$HKyLKV6YMnybVE1prE4{pHjD-wNog@{nE5#BkZ{H(-z7givr- zTJh)29!l9b$ElE5k^!?%DF(0Q(IPDVp6`c8QK^9w46h60Bg58=d%#tn*;`{!8p|6r zjQ`5YXDn0m9CD$Qf7bmaZOLy^{qXrtg-0eu3FY{_m^fa*!nB&ZWcGrGM268WDfJqZ z$$(-NT*<}{)9&Qtw(A!g)!%|SM?urK_+cHOfulm9J`4VZ@D|koD_)dM`}n3UplK(& zKTa;3Lp7B7Vt$uoeww|K?X1mcckCS3^oc}KZo+b|s;I%KKjL{L%gtbYR$mxyoTQ090{#awt}4XRurT8WZ|PwnUdz zq6gx+mX$H`>%@AYwm}0l)O@ugvL*Hu8dtdH3IS)7(pTbLIWg32D{4D&#IA6#$JO~u zKwtPyZWPH=SA*=kc8KR$u&QU$N)10b70S`nvv|3P*nS+L=fNhvL6=JJ8avTqHG${w zba`vku`f$pxrWPcK65EUDygU)k>z}K8F`}k4?gDE&84|wBF%I)hY$V7W|Gn#!|%QY zBE+gqA-l658G=x@c2D_*5hjqTZSbimPrdQgTf1t7f|GdS!{S+|RenGQebdg%_&d9$ zR*1b;M~lC8Ye}#707fOmP?N}Dfq=UqQ#qzi7EcwUNTZFqMAwx*y7PzNx}GG#K~Max zP@1sII~Blb&4VO*rEbb6#i;?;>bQC5M4?+=sg5=kCr@Pco=*|cvLhRd2HJYH#3cM{ z`LZL7;5%!OaTN}_Vn7Hg!&Qxmro?FNrZl~pwHBd6wYBNut7gUjhMvpyn1Vfj<{T%~ z1ng?kX!=*0pcVv%1WG)*L5gY<nrea zlPsV^g##7ld13S5fNlCEEs@Ia>1!!S=a3IDbY8Xd*B4R9LQ4fNbl{hnhJ^dd^cb;R z7UNOt3y0zlIT8Hrppzjsw!mk5I!D0H=lj{swN=iPC?q1M*AjzMwj zpgpqjGdDu**|YUpHP62l6{yYxU4XxFuNHUI-lJsn;=iP4G_Py-_!HBMR;5L9`y78C zh{_r&KtprSY?t2;Wa&_o$Klln`Y1m)_G+$d5@|Ws`7cvG7aGWsMG87y%gKk##N*^` z^;C^lEW4(1#s%mVlDG0ll@AKk?k(8Mzr>yk1;o|wDLXw4OOM_T7SFdhpWuc<)(E-p zjJWp6nc@TlfOFk7c18xBNewz9zp(dYa%fl_pgaUmKSVRM>h0HM)_Wsqx{0+x2&1Nu$>GcIIph$txIyXxb$saVN0jQ zKY>NnRF@x#+=us1M7(He1|b%k$KfJtd=bA=wNKaDCN}NcQ3=4?S87Mvd{%TUm@8pM zr3&Al#+2MoM26alY20tQ-#Qpud-KRx=jEP2L73fthtmpmM(qo z)v!t*-2o-CKdD@12pu=22cg}7s*jky+2~5}m`-B?(VL4xl3QbrBP$NG*WE3cL(eqc zM-omOG!AOkcD5BDJa%ApfX8daS66s_Ybb4SjMOdZLa%t*=g~Y z+JsGI;U<^JLQgKTMVd&Z08i+=@f9L(UZtVVZYK)maX3U7(7hB2&2SOGE*Tj*pV~?l zuK1wiGG{q*FPnonY#A=;oo;8I24h)eE(o}|1LE@H0S{o zc_rdhooA+UoY@FQ|G&^45OF3x#~!O$tuE*t%VWjvyfY!CicGTf9_Lky3+*C})s5bH zXG99ZdJucSXXLs7&#C~lXX=t!P8BWa&E=pGQlW}R4w)}30WVK?bsxvNWH%2j!iAb* z{YN#qbC+dsIMN;5Sn8j}I#z%&I)g_4G0Q{S`}qkhSb6EO7nFkDDB=dp zZ4=b8>#w;~(M94L3hKchNSqV(Vg)fY+e}(CV*F8_=RUnRVCUEe&+kk+x%}lUHZZFi zlK;xy9PdQYc1d+f5v{AhFg6?=I-2Z!;>Rctxz>=6+;8l{u zd`u@0rcA1wPGq!_(@yo?*K;yy{OGSmY54dP&5WZc&hy0(=aFd(oKY;N8j?A{Zp0tYa6CI;6I5IEqF;eJ zB;|#yzb=>HPVsHA0;lnDG6CeIo}M;c`6lqLt5%F;> zoGsk=PbuK0!b!MC;^Ma`Wog~I*KYq6xu=L72E%jX7gNZZ-)LsPp5(6=hKu~K%q>0# zghESqy+A8|Z>)+@c_Se=mUN*S4~`ERjhiQPY?;2~pL>yZa3POhP`IiveTS28%C(u% z-%j3^@2Bzz(HG`hxT)3j^M%)!m|K#ss-gXukFpdE{mQ%hPqS|$qn$aU9Yv6~MqKH4 zOBl%TyB39X()yvGy*18d7Udcny=@+v=A_Y>FcqbshjdMkT11}gnqG&A5S0}kNbYaE8mr7 zX)aa@g(Na=_D_VClFW9}w#xJ6YB`CUpntA~HLbMxA@9{m4buhfChw7uOm_y+DK%3& z3f)p+1iM)NvWx^Jj_oRTneI5fY(KL1wJ^rG08{Fn7fmsdtt_vWUQ4cR>JnL%>mTVZ zx-ViyD4t?j^xPjYDkryid~~|E2u}tf1(vItiC4E^hU^bOlbXKvndP{?X$rM5Cd`Zx zu6i|}$Eby|Z7{)bB0HbOs64w=_<}Ju(#+a;`9gye$*MF*;o$bvMnJr+(#^g$kRzBB zJvZ@CB(xboUv!MkOfag{yBQd_Y7j0TV!F-x^(U(=ZoK@b-Ptd?yZ}%>#`16)^v`7n zy;wPYLUjK>ahwc6dbidM#I(4?wNDic?yusN~qJ@(uwv&ZB}umA4@&I3bjg|!*) zaNi&l5CP#aiAjQ^D92O`mQQ>_nyv2t*IJ(G`cW{(O&A~awU11YUOzMOy?-otj7s<~ zpi_;z%xlkVH;(|(qc;6m#caWwooS~Iev<-#!l?9*)>(E(7qb^`sa6)RoqUPZ0Uj~YTvf}&7uan8K(T7Wd;;75#2FQWavP2PHd}2 zsL0Yn0P!H*F6qaoz#q|P+WozSEX2nmHod3!!@XWfkSnlaJw0S@kQSm9#?JU zQ8xX9HXviPt*(9sYjH76(>0?=!fY$jF>enf!-)E!NX|@>OJsli6iJ;6le*-=Z6szt zRZe2*0Pa6hST~naCRMDM8OJ6huNg(5+|Ff*lT54``WcEY0(8d-P%c!O7b7y3QnB0` z32!3EUozYEIvG(-~4T=nW1#Lkfsp3tv8)Xrv`?UUD_E`(%3(%BRgzq zAnR^QK3zOne3Y1ReXtTv-mi*HnH-cyf}c2+Ow>HmDCU>#?L}8@$=M z-iWvcw3F-=FtOH$w+J)qtkrU0kTnjLk1IHPeZduA$j!(+moZfy3hcc;Tnvu80ze(E zQR0QlWMH`BTOpMREX;-Rb81$bx1JoG$e5_)0nY6I->EJ4f;x}<) z)*lnrUk}wANS6a8{8+e+q3-%YxuJV5$FgM4A$Pqb9LD5JhUwv|C&V#EEXp9a{TI#b?3$%^;_!GQCE_ zFl1*Hh9URA`I(&@5Fs(PF@G8!VP80w-2LqXGC~)e(=D74!8>AWc6DR!NuQt-)W061 zysntr(FTa}yJanCh>79II+Skj@E6UHd%itWyfXXSZxUZ#lf+;yLmEDJ^f%R9umo1D zE<5IEYCo+5jw4uDmZy1yzWsXfI-6`JB{{02fHXr&(S(V4F})Ms#uA+#;I(KpQAAy6 z#xLLXJGmNlR!`=O(^zr$TWg3^w$V!lui3ktD|TkoG=$^uwHYbD|Kv-lbL^T# zqj5MM8_YaBh9uz&+j6Bb1(#&`kg5WGB<&7|Wi&*na@ zd8RObK-A(Y9#QC|32t|aa>9ZV`h&f2xJf{-9Jd|Z@o|AsN>2SYBw zjZ&Fy+4_A?0L$E>`u`+&yK?|S84*%Z46h>WR0m0({iZuU=ZLe&$q7fq%h0^(3L?`M zsqvpwsDC6tTwFa0S%zk74h#>yKyZC4tu8ICt#m=pD>9}X2yP5jPaFUc_m`~HOrYwW zcS%81tk58!W;k1-T;WZZ_5)Mg68gc87mGL&0xSuBAmlRq_4y4V&+0hCb0 zRqf4|Yne}GQ*<_jL6t+cx$#Iy!j+0?tf2+sZV2OPW8BhsgY~qoe|TJWaE@#g17*s> ztM-GK4Cr}xJR@1dztXQLDF?N*Ggk9H3F!{8>BBbK3_mv2FJnOf z*~JQJ+=PD+8S!u@Yjgd}1f?9YPQ+jzOk^gTA|pS>0K}VI{R8GgUe!$Xg_VR2g;m*w zF-ouQfih=ReNWpN{WmX1F6I||M0<~wEAagDfG?JTS)I6@x=*uF;%Isr&xaG1@4OSn z>X_?K9jnwXI%}JotrqJn8oo{SKnD=`WxcVj?da{v^1)JL`OZW04JTalwzT2)>mT`ftVe-AI9v(^@=w1}97^FpgrZ0D;A%?2U= zlOPwV&~1#sq!8A|=m+#6G*U(i8pb=~vU%U&i*dp?Iil6wAWFnpql(Pss-`P3Cg|(( zPhPyYk@Kj78{2v&1_q!ERdWj?maZ8E2xUg5qU?+P#g5WQe~5N3{+$nQuZ?E1lP z?zF%k;nF)@-MJYg-iBpDYnhWO>Db6x!&ojaLl0OAkCJsR>30@!l}kUH47Z~disT+8 zfcH++smGLb14n+kMm2m&`=1c1rrnRI|3k!5qDv2S)wF2r;lp`Xd#*4fwI)uVL;N}W zRhjFla70fz$ZzR8uY;#pKRu2OjZXr@`dQ)Len0qZ=jx8mt$oExhSfh|)qMs~uC_zif4mbbhO^=$`|!k6XYV}rf3(wXPcH8= z@$Co*nJwqP5>a>5Y5$GTW#c{Z*E-)gnf7}HMgPfidGaE(dsh2Gd4Ek!#&2)(bW3q8 z;{RhP=Zt{#zadj2FmL6NGJlIyuO)Glqj%Gx?6iW*B&T1bQx z*%h@3S@txot+i6uN6X2v{}0|kA-{P%{XvDPj*7JWy|;B78_x$>zH2_5r%m4>1b*jp zhCVw;%gVKBE!~IaP3S#p2GRnk--<3K!cwRFudbp}$rj?SCSZI_!>r{v`yrHFGZ*mU z2fY*Ib7m3EnhfQQPG~Oa9Hysq7xk(|+t##hJ&+~4uE*E;kPB4IR+v`0FCA3XX_D!IXkm&QWxf(c+9@hb6B%}EDgIX!sP70 zo=N>#fBhqRbtDFpObA{LliGFTVYCt3F9fgjO|Or4_c7|jSl(?E*CLHLiL#$FY6^jJ zCwxyXVa8d1ULTuD-A)TJi}ZI*=*Rk-LFi*6Ek5QBat#yO_2OAvD3e+@X5l$MWMPkK zS-Tp`FTRJMyL4(Zj#wea_s^fmd4B`SS9|F{_ZTu;IZKB%W!r-|Y?c3Bj7#(F$Er0b zWg(30F0SW&IPc#0;`jbN0pY({3QZl(D<2=CMAbD#2N4nzUx%YZgOHjk6)XP)Rx$oFqJPM~El=6A`anWJG*?gGB2F8`+0*yqZ<;BL*Y{r#5EtKxCi-&n z#hmfRAN|sk$)AV5W@fKi&*n{=DGc5ardYwf)eAfKZ()9*33CI1GsCO^9 zabp)duElQ$A6&%Fm-l%Uq@Y3n?qrK!_eG?kw{)yu5~q$umv|zxw0yqKa-J_s)nNK` zrKmr>G-F^)>nfZH7835oWu66zIFUE0)M^OTTMr|7!a0q44RM+;6s|s$SNC4>Q5&D; zr)&J;o=OYdNPKy0)Vo{6rme@u_3K%`aU)F}Zqi^}{4(?CLo8_qX+Ec+i}d5g<9D9~ z`{sdFnRZ2l2fXI`m7VOl6(8;|%4*NcJNSm$(x_h-GAFpnX@x-3Xg?K%}EDo=Y$np6z4Bg$ww+i{$-{BV=kcg^in5vv6odHVy2~*>GWu-8@X@##7j^ zehphUuY(hdSa|uP<#1i(J6=5T6HnJ?qWxcdkvA>FnpfkBxQ}PXcjj)gM(p0cjJWNC z+4?MsjYFpJI&%{gre9M+Ndi15D2U+T;LkH73H@mnb=*c}`>Fm(x6aYc1zmU)Hj3o5 z94d^G`c?3>cjD>EEx6Pi%it!B>Cvn@PU3i#5XcG}S88_XO{XR;=uj&w_piOcGiN0- zJB9HfBm#~9W1jkHP<*jimBDC3#!|(|oHifro3tiRI!ELRJ0e~mW9MEU^buibOhFu6 ze-I5G)al%Zjw1c`wX$&kx=24)WimU4@;)>I?fVBjey1U6%2MC1-I^B6XCGXehR=-hP}p^;DN)UZEyeQq#n z;CObd8O_*PmlF=MV#Uh;5>_$(6Y^-yJTfnTL|doB9FX)V3T*9cv5|Zt9i1@7y<}LE zw(L1}jDhX?a%lGo8nszwIktb*+-&oc1`!v~YuXV@*pI^odzU1nu!u_=vN)SjIhoke zr6$|oN@4!Asn(kal3;68vvKx#+O+M=*ga3d-VrAk7harM!KC#!3AucTKArl~t63Ko zY_u!6TuQ%^$9?VEBACZC=K>p-U`c^3>!e)agEvDYN$d?x>Q% zU`K;4y?C)~v1NPB)-bwtXn>O`gqf{-A(;;2Dpz92#EEpMU!NJrd_;(et)tq}s%r;2 z^k~ODp;H!gu1>eXlbA7X7%j(cw50WV&lHC3J=F=E@D` zZ9RvpyBEe6hp1R$2;J6Pr+FcFk*S+B^{&F03BzewrxAOlmE}XOGq71l_MbXR-&XxN zuzd+lI<6Hv^z^Lk&Hf-!nx_^pVA>Qqm8fkwwpHE690(9aX{W?loJT?-#7nk}DF_M_ zr4xHsq}j=mX3u8bIP=ng;lT!av>(giqZ?^db13hE-*fib4b}@G5)@-klWyI4vU-&z zt@S&j>D00g4(4E{wdsZQ`^EKDqiNcy4IMf)WWR4PCnq(dLC=ZIS$c%~d&khd?{fBT zoKCZjD=lfP8Z?SNJ^Rq6_9)&8Tjj;pp>*rF!V;%t_jQE5Il{4X&)BhW6FV=S;NXsR z_yp*2bauu?F0M!EPSvUX3E#dD-zXK8s5rsRYR57 zrOZ#K#vbh3bpv|`2i%gT5aGg-uyrM^n*(8LJ*InW>DGQchYzo#L5*R26bU}tJecnN zSFvZqG+Or9By6MWoVj|PS?f7tVn}T&vPn63|+Z%L(%J!{DB< zTB}^~sY8)GWE2VR>IURE+Z$Qkqalm#Ia04dO$ug8F3u$){dVwK7zGA{9?7gVihCjx z{|vE_*r&@&wTcyJ*lQNM7qrK$)sX1+ZIsftGqR#i z)mrtqvvVYGe$DD+#fp{x2Uaou(-F?NnYSokDjDfB*|KoiVG;IuYBF1uJ(o8w;!Ww1 z3>w;p#r?7|=fpcQ7!L9B`3>HLhH>PGFE?)8CVh!Q2}k`PZ0rbmdWxnUy3($7OQycb zOZOVN33%;8lx1kq$cMLqqBFKZYcf-*>sYpKUB&bH-MI8#>gW~dqC*J_kLB>%iM%b; zfN3*&kt2=5GV_GiIW1$Ruclw2IMyF~&W4dg2r6AeoU1b#qIa_3{0B6lez=wH%Y;!) zh+ky?YfJ_$&RMFE*5LxLMfu!IlaCt7jUrD*g5LUBejt@T=CSsvC%qdMATlBVAV~v5afS;ckgYSh@tKfN;ykgaSW^4 zpIR%{kTr>D{nQb}h&&j>f(g)T3I3?2-k^!(76yo&y(5AC?{IXnAu=S8aBVDsK?=H# z9ZAx^{?4rxD^`AStYZ8pBlhJ50$rWCy>vX+L)>_H^pFU(wTw}$)lnb#fdK@8CCI3*JNk-e1hiU8hfdz}FuzA-7Vnreu zGUt>I5OM4=>2-ufhH~}LT4v6i%M06_Xhr6dQOFnl;WcCiENEiTY)T|f> zmM_AWVw7^S!(^i*SB`j7AV)?AM8AthrxOA}hyl^*HygJ`+>b>ZYE=%Qu|X*(d76y4 zi?0SDFqAqy;c649Q%fP>m^2wG8&@ji&&z@}o2fr(6V7M*a^#Yca{1EXo+ACHV`bu4 ztxkh?-QKKPv5Hko`(X}zVKGd?V~wOr6~C&hbBdJ6V}#*jaw4^7{BUHdv|gygBgFA~ zq-mrjF>6wJ(I~4sQ`YXMVu`Alv{G4tT&YC&(I0*4oLI)-UA!rsJ}Cy7ob)NheK3R& zU+voT$WuU!+kr%9pE6rGoLLnXYIxO6SW+zXkJ% zJ-v+SOEyt$(0uX;0bI3hbzDRVTLiff;%1vPwCGq<)L$b-8`l)+l%sI|(rnx}o%1W_ zFlWt1i;q@F5p$W2OY9%@%4Gji&r7MeRzOLXF@o7asyji)y7!6HwAScdHcZ+ zpVuLl=go>0EB{+q#rRLgj@ff5F>E6f#*Ag`%vFp@cZFel?qf0uQDD#!84*Lik_CCT zaS2ae_^^EbKC+gmNtyi4tXzMRiZx1;%keH}WThzJl#u9;!l)PGNROlF!Bh@TpA3eA zRdR7|;WCbH-oU*V0iu%0`1tNEtCk;U->UK4cWF%F^hP41H1VTaLW~_=GMeWkqkKVc z0$%x8L|II1ybrcsh_om@)Nk36ESb_#uvBrOXI;pU+6{GVG-^$}T>3o>x;P@EjTCHJ zmVFzJQ=&$0Vxl6^>J4Z_`g+mzsbgZqwuo%h5gi#t^5V_N{%|gf_U&Tg=*DdFi4dYU zF8<|0LHT;kxVB~lN!yOIY#W4#-MH}($F?tF{hLCx%qWDRF_Qg9o}m$G>Lqn9%gxqh zjp$jeD{qCM)WpOJF^w=XG(<$lQMhzI9;{o+a~~g;EI34t(lx1&Psxf+7pYpK92w0Q zxZ+TO+#W{4Bcd(G8ifc~YlM*2sf9rkU-~M~QVebAOy}VjDN?1VNOKv_MR_h+aG0EB zYg4C`8{21Z;^oupOkewsN~OGU6dLx#!HWb&tBH<*;;l-vd&4P8R?S6BWPDl0iNCUJ zRjA52#%$Wk(i!cTdgc*IlMvF9@46x*4bu5AWBo0jUERg{2U)0->H%X{9wA4OQY4eB ziBP1cVfvTM+;EGhBF?&d>8Y1XNmNt}(jaG&ByQZle4OCmI6`0EW#fTk?BBbUj)T`x zfAApO^%0h9&swf5w>E4bSJ#>-Vj_r>Zl2l5^`l!ja_Asi)=p&2%dB*&o{^}CFw9B^ zQ8F^za&)7j<5}jO3#4@wPqxh7#>*$yn7ZyG)f?2Nda|d?+IX8Mmv^$^QAX-y7e=r# zoD-)Wv8G3H2A_4HUIABjZQH_|*i`iG?#$M0mo3u>{x=~RWzzc(HM-Aa;r#h5n=z0y z!ZK2;4V3THgQBTy#eS&RwFT(|9&$RuhDv2}@>V>Cl?!L5aMQX}ui2DZ#nW2m`_E9e zA$5u*N0+Pwv**oc+N3G;9N3Z@$~fM;gvI_DpCRW1Z5lRca1w?9yqEsTt(Xa8 z&;ynoc|-Nm8Htgl!aJh_w=O)VU>R@x?p(tra~>k^KOjZv;<&5dvt`RZ^sZTH+qeqv zA6y_dRcW$$h-XgwmaX$Q@WC!M1u8b6LT*>yUOmRaJHDjOUX^+kg_WXv!`8VQ`Jnn7 z=i#;Uq%2St5A#R1>^e{3s-<~*^f<3Ik`s|9#cI{TJB1Q+^gAv+)Ka=c79L-?LHaU9 zFur}nJ6USd8GYG*`X;gBQtdr+)3{*?%gB1*!;3_C6d`-cc)=X|;Tg}=Nhz4ci4&{l z^EAR4_kvYvT|NV7eAzO86CdnTQ&{A!TrO7vAD!gb3wykihw7 zvR7?Kbx~$&VW9uFVqNsd%Fm2-(VriSr00Ih6*v_NrKJ(nY#Ml+*-FR~byNy*4!Jb6h@ zG5)8`R7}mS3AuNec}rKbW%Fh>u2{;h%P$iaaS$&AX{3JAYef2;U^^_4a4gBq)ZBtM z*S4|#_%rP7ZFqfo6Vo#~xs?N?5h+b68UPL}7kGxML|6>39kzC<^ zZ+?VyCSBuX!PK5wt%ot$D8wa9=(h0~^`!|rWMuwp81$&((7X^qIbiZlf1cIGq{#xKOS?4I*nsS4^aZBf>&4vvtDB#*`3g9$SMI zu5J$K;$sL4jg)4W!pzbUcXwN^Y@Wu^@Iv%&QiQnhm%IpbqNG2ONr ziW$-XA2W!LAUHBk2!G3jrJ03rmwL37rWS;~IKYgZT9(gfPkh)z#&#V~{$cZIn9Z7? zpg>|&dTgCsak8`E{-L=X2`|f-Hl7?lbPu00MX|MzX7~suELwx9wY70TkF|}pv1eVO z*AgA8#>Up#7~i+>Ej{A}3KZbbp+m-=ajEw#B_q|9%a<=xzI^$g=O#`;NJ2ayAi&r& zkR?l&WGGM3fHXBhuhWt^<+t%G3!-i$?aTZ(knU|88yoK3yN6b*{oQBizp`iiKSol| zxTB+^EPP~A9MXHQMT-`4&v-JCoIT@zLX0a!V&KSv5j@V^jiL3j5F-StkR;gHD>yi9 z4A;!^lG9O1_A=G5da{p$ege*ij7AObZ>6*SXq!sLt9{` z7Q$UxAmZgAW^9jT_PFLkoNL%Oc?i$E2GGIdAxlm?A&aXiuOgi2+O0Jof11squyTxT zW6R*4+vz!d4EDjdSi0dLsWPSKL$Ct-=vNeNKafIc?09v4BRl=l(Z6kJwDI32M88Fh z`}p{h_xR3EwX@&hk^+Qie$Eots_iJk9@FsWN9 zE^V2_!O${H=-@!F=1b|ka6Sd>@6n~p4n{2-&y%$yxtO{&J0F?&BSX51mEb@iVwTeo;^dSt4P8n{vKg;XAz?bNl!zpbjI%fhp(G=d-2A6)#{Z+pf=4DLB7dz(UXoLc z|4Ey1g>e~UX}R?;A4<|ssVX=*r!p=bu6gIjo9IyXteV5TO&3vEniBQ?4s*s#}A`?Q*R*U9Rl&w+LOuMn#gDkp1IQU?$rllFKQCfZ&Ota&jLfq zkUp&lKL!&^OY#&ehxWNI{vV!jFVc;I>77KnzyFI(dQtxfNH6u2{$iJU?0=NEEIbMRTSxPAe#CkqB3TnF!-+ZEZ+ccpycFLrG3d0|WbmeStCn=^+K;A{vY|G$!9gEGSd`vqUmp4)3-0f39rs0A#9FJ9T4`GJw)v=>3yz#R&%^uoICuUU)|s*r_v#K8 zE}Z1>nFr{EpiY~k0I|<5aq7wgVhlPo8lBMJI#ls0qwqBdH&uK*YJ)Y!%9h~K;k8`6 zdYOHvZ(*DcF)>{d(sIr!tpaOnYpjHD*Q(=DDLtrCEF*{a?cn>L zOL0j{C5!OmbyifWUWI!HR&eh671nP&Ml6;TE|QCj*CVM>$rGLW@9A-UbN4haLXvE< z<9O)%6ty;-JHCEj<@cW@mg|QPv2XuA_Uzrm<)_l}lD~zPXE%L~OGAG~6~vvpZ;AZ) zoIB4xB|83$D&j2-{Vza z(qI}DXU?A?`a4%4P4ov&AK1saO%WWQQMM;nTimvYK0YT227`D8a;uZf`quSpJpSLnyYvF2 zFO`wlcvo6?Z;HKAT2|bHHsZInHja#Cn$f&+RwBZ+*4q|RT1x+T*St4f^^zCIS0!u9D=J1-#t zp=8XT0~_Nk8Rp~@B0arc#qTW2_MM2OPvMHxpLQm3{}qGUj3XfM3LVMOpO`G||o0_2djRww#>#G<% z`B38CpXc?dd7^<;g2SPS4t^UbR<9~M9!8?jszj47dDt;;4F2NpjpaR9cs!v|F?UE! zrXP4Jt%m=<`4iXl-Ie9^9lnY1@DPGNyk*yzR?NDTlwrYdh51E2zOrr%$3KcPKQos~ zRf}^XBEen%WDUjZR$=$^7!;a#biXhO`(CV{){di3qIh?41M4paiHL8|u})uJeu^OE zlRxA8w`c#;KQKE$^c9-6Un-hD-+&>I>67Oef3E7(kWHfg1_yoOH0(N2Sr>lGc+P*)!vk$^}<@3)CtdsnTZ_e$rxN>4b};IU21Q9_igt zCW>L>Z>18$^CK+17)>T;HP`P2Qng_N(%Bf$8DE+Pl;-xNad-HY&9F|dz&&F&5pQ-} zY!t?HSlGFcIx(&^#<+Aw+jV<4k-i++@bqvJ%@q~Lx9%W)>AGZgHWT6eIW=x)XP5Zv z*DPDMjJ9pt8hi64VtrR|R9A<*?@yAYX&q7tF?(S1O{%vjz>)p$>DZwn7uQc_*TGwy zd>BMN=Qwtp51~NL)STWdL`asx*oWTWpb%s^v$`3>{9Z_P<<+ZKczSvY(e#c(yFRdF z&1AfN3R5udG`j=SlP%x^0jcxhW*NnhKP#8@b z<{~i4ii{2_wl7)Afiw4U&0Yw*SYLj+9En-XWlr1(#mgrLX2f%K`$4Y1xR2j^1=&4a z@jJhrV>h31)Au9!@@F=-E~BENjCSMB&dvlqy2Z<21Mfm|Qol?(j!c`xb3<0jRI7<| z*n6CFWaZZ8%{+SZh%K9s;FPB@?lvZTynTelYq#<6eI$kQ=HU9lja<2XpR1RBd8)M` zZ@N^(zq!i(7f~o~pW@a#KlbfDNJMHcve`VRd&@RFPt$-B+8caKRfe$rW7%b>E8=gD zDFGZcJa8n8uDNZGq0NO1Mp>LCXoL)7VeMfvb`QRf3 z3+BW^#JzRqOio<9$3;H_CA}P&)~z1fLJL#bC6YJc3O+^Up>~Nh9GX6bXKGK%)vkkM zus;r>tW4hCV9|=zT)O*;oP`SzaDJz_K9BHy7(-rVAt|cO_`@D@wP5vxSM8Cey;?-LSc=UuTuN>&w zE)V-RULdDeRy41#vGsba@Ry2f2UoFr`yrw%J+S+5h!&kEleI~6wC4{~dHxcb6!W2Q zxf)!VJ`M9m9mp9a(mZ9kF)shu)Z`O!1>f4v!nwP!bg{+K!qQmZe(xD7-8<3@KRb8s zq;>1oiLSqm6yBeCE=&HUnLgCwd{Z+sG-|c+*(2MN%E-vb{B@+kn_rGM{9gRU5DntN zuQpEWC2f*Wl~%j_%9LA(cIky69oHrv&?cTEy>NbZ6E6_8Mw~0TNiPl|x%h+>Mp8NwLzTq$ui_HIU7MIE;iggP zDbb)Kr9ABt?AwzaJqyQdr|FWeG%Fj!nw>9&n>5>b0%n%hJo#x3lTVw{p???hg`c3$ znqBOkHIaCAAd?34VAV}{bZ8w1U&bV!l}sp2i3xbdmZN7me)J$S_V`huLQam%7{Pg? znb- zxfS>C-6BirmZ+|;VbzTgt}pD*X>}&*RIkkI9aA|FpyKYfsm#A*LFwYT_^l3SX;r|? z8;uL-=rek=s17%2(RLpB>ej_9 z=n$KphqH6`Xs*WPrcR~wY#cUDG>>4%^zrzMCc^OAg?U|9n zxie#8Va=hLJ!v!P3L_@AFs2F3Gx~JujXq0N3UZEa^M#;1G@ZFuZRs?i6WKl-V8FUv z?3^_nZTuU?4(QJ2yKraU22T3jVQ}j{kgYmihO=~>{}3w&JN$i5aO%_vjvPA5>O&7` z)1ww|_l{)l4SQplSpxPkY|RCZkM7JhyNYz})_~BR!&!baioDr8$)7(TW_lG_%QwU1 z;Tn;~0JewbqGKs%6ov@ajGe`M(HQF2YB)BfYLMIM2`kS$;O3SoEc11wMsY_5x9EXs z^?vkhR+t?V`ttaVFSUEFBvUmZ<{w|;!H16wZ`W7&=|j(^Mc6T>D_4{`$&t>De1-Cm zJ)LL-=Ms%L(LfJ>bB~?J&v5+kK4u>cqe|KAoL(`86?dFPTn-Fw-V@WBed*bxFx$uX z=Akx>{%t0Zu2dber;ZfQAw4=CFn7{gqz^K24-PYJ>m%M>TExWtFR0g|4mZ!Q;I$zm z*|TKDD^qH5-%AZ|5$CZZoY=I6;M@hMk}8TpE&5|C}H7n_yER8+f$%$UCB$c}><_i61v7W3% zKVkdzN9-8bk0l3gGk@7u;b`@FV5^B}l|Ar%PQj+laI~|bcIzsH2AEK@vJ*SD?4V@# zVT5g-$C115X;7nB;#tXs0<9{BcW+4_vojE5>8~KpCMk!*RyvOhCLBh%nqehbO0 zD^k}hoIMxraqNkjwuQ2Sr9JIB)+L8e89Ekt&*|spWb|+)Z&qtmaZ$Ke=+C2*O=(rS zH%YS-=gd=)hDAh!vP=Q|Za(MMgSQlJ+88?{Xdb+gC#?5;HBCT#@%brGDEe&Q)xe)Ck*6-L$mcpfRODZczab549 ztc*(n!#;b zM>3jz;%sz5I+ae1eWv2H@(JbgTU#=^ry@@wS2DZ0lRk5HkQUyGjl%!UE1vniqs4*) zRCf~%b~77lHmZb+hlUH01?W^##FeQ8ZHh*7aM>0frmsokqB+P{qbZi6UKzyIwNAXo z7S=X6IaqV?*d@xgAA(ob0*oI#ixP#i;pi;#Z)$FA#0R~9!~1~O?A<(*40VTKrGLlS zxI%O^##NHmMIt%4

|LHlk8qH%!g#Q~c~gGT$HR3xvGMTT0txeq4SqF)m>+nxGiB zziC<%>1F%(!~|EjE+%`YrEHlqn~lfL&@A#NPJRr>M6VO+&>5$HOq<4$XE*K}{rmae zL*br{s`+vw|LPJ8iFBwtCJm6_;c5-I2BrZ;aUR+1DDxQE?bB0fz&%&OC8Q!QJpHxC% z#wPUat5hl>@J+~>GY^GowqVkBktlU);u6i48?^7p znQ7fn6d!{$GraT#<@!^pQ5ekG$2L^*HZjg~9vLl#9ZN26Z_<<;%Al-QXgl^en3Iv73mm-48&rR{Li@?dd5!=@+BkO}X%sd=ScAj%R(a)vlO0s1z z73ar^yol-~T`LhEx_E3e6l6e`4)pHbi<;T(r4!JqRl=|MVd6yE_(xnf4xWhM;!{2O zE0@Iah*)_Suuti5xw#h1UV13^fVY zLi(WAuxC3ubm+m-eVe&4t|QTU7c!|HbKTgA3g^-@1zsidVd{64q~Xf)OYpykWC~>b zvMX=$mO?gpA*vsnKeZgb%(s(dtNDA2{+v2>%D5cUXL;8+=P0vOO4!+AvvvfD;zwj&;CXUqWKAsAxPBHh0Jrf31=g!7iobqVIz*0&U z%$mpLC!a9MT7U)P2Jv7)cb=A*PnSYJoASJW|K7N0inL1T%VW#g8B&a4EuHDzb}hGUwnjGH~3Ui}UYkDfVYq&C5?Yn&T1j5Rck}nB2^p6LUMVu4V zB3=Ktbgw;;c1ydkcjQ6Ft)GDD?JaaT;KqhA*_hsOAn|Dm@aT0kBW6#}l(e%t{_@1T5Tp8O>ToXa;)13@h1Is2AVR|v6~~MCmI>Hf$V3#F0rf*kE9K6KC$|%G1BGB|X}%X6pLM zT$wf$Mg3m9Sh$D^i>707bSc9(p1{n?kzO+v5x;3LZ^|v8t(Pf*r{^<#(PP}RSrKYc zk!2GquwY1EF8Igex;6ADjKgQ@u zO*l078sk?C$M}IIk)yM^5>j;ut@4@h@uzu=Sn^baV?mf@MV3ye&69&un7I8BSqo(6 zwSQ*T&u`7?{=+l9@ovRXCaTGc4ZpFRd zaw;SavsgE*8|iv4#{1bKk>)43iMYb8DzjvKO|CBO&6@KjbnIUjJ6m^A-(r9F87g%k z{Md{BNWE`AKhu661(Io{{%`6u`8$wI>$Ys!VqED^MkXa8-ItOrbAtvAj2&1q-yf-r zQ_u>WGJk|WD#rf^Q6ECF^GN88{=4`}jHgh(6ywRk8{h2=o9)Ne&BMi>j!7l6k!g<~ zt-ixp*~ow}?9+VTl~{irriRc@TAWi`CGLMuq6mw$#mWBvd!9rJKX$+4=UWirM2T?h z{)T6lLBtjPbzFv+FjOW^JbQK*jpp|UaQ-M_T%j<<%IZt8sW*<7F=%3mj5T0mZT<~{ zT%=pCA|@VeZ7lwPfd4fLr3t1cQg8IHO%f9t2mimH?};SF*Q{AXr%s&`U1VfZ4l7r# zq+`d9#;KZRzCXz+#(zLF6`3UdZXqrshD83$1&sMB7f8{4RkUOqqQYv!Y{Be=RcnZP9B>7(=-vjA0SaMA3^F5JTt;trNR+$(- zX)1+191o7&jSEE9O3REbbkF=iI$>eHnTob@V zyf&)}Ot?w@t*tFl3I~O$dE&k`mgdsEst|q> z_Ko41TZq3_#ubxoT{4g_cRH-hB)5d)R#w);KHW#(F$b`;Fvrd%Bl&W=VItC>Kt#mC2o`Sa%+1>_(3ocvGm z?%g{wWy)k6G?LPg8Vb^&LuoLJlatdAQJykCCP`)|K|w*rsZf9K8TuobsVGgX(1h%z zNU_x%xV{NnT{L=22f}Zi<<>J_&b{lvc4O9|)+#95b|_t|lOXr039apz}dl?Pr)(tm_HrW!CRE= zR`;v%HNWKc!G$c?dJ7E^G#tE%`UPzgkNi27R;i5D+(Wd>^X2FZnSU#*R;{8#hYqrt zN-~k0W-786PiDSFj29?SfMdswkveti6e)0%km`seD9)chPn9ZFi~=O3AvI_un{jD2 z6G`}_u zolOx^y+15|a;;|ITPST`$kk zuAyYA@)OsdZy|U?f5tp6%gK3V87mqSbq6dUuR|<eZD->8I4q%*@PK5tGbRe#_54y-8wRDoZJ?DZM=9?Z@7vdqE;e$o^QuG_NYAmyrW8u8nELgIf<%61HWoCkjskr~69&qfWFZ&ixVDQq@*qa6t z5iN;&NywWL@!%|~LTxCW+6w119=Iw^d4BUOkFK9)SdZ?UdJ;rbR6O1lYjbWwb()Xg zPNtmscyjIx1)KIHr;{c53zZ~~rwiV7>*Aft3JbG@XJh6Zh4A)tBuBI6xW0NpjHwM4 zmNulaGR4Zm3d_h_yo~gwYUjYN@a4gq;DULGomK4bk;d~jh}#rgJcGji)yvfGqG7894fX(b#57pZuoO&%~;kv zwxvYsU=}UA!QBmGIrt(Kty`By_x>r#)YP?&2Pzlw@$S2k_=PySXf)2*PBtL zVjc1os!Pi(A9?)27>YoTN^Op{)fXv>f5s7YA=;PBM59JId2#I#N{dXiXBJq;gEW4#|-xoe(m~Syoc` zzeJ}Mf=u@px-P#L$y~Po6jE<<+O%nnV=I1cyc&$+S0ZVW80n8u4C~dzDGJc4VQPl- z9nS0-QyD#d6FSR;*;Vu!HLfL_Q&w}1fs^O3bn_8nm3s14?TEwOMGT!ghhc-pbNa~( zHcuYJ#O23{Q(920LJ7R8w#Dt~a)!@eK(7HqxbQF>b5m*UUMX%#Lz@xt?iLFd&ZkMY zHFO@;k<6a?F?q9x(NkA*!#@c;*L)Nog09e}`7Bb7rS?M_rq4z54xMS&wiS&BP2!!g zTk4mDGp=EC9)D@Z_UHqAZ@j6{u+=aP^5_$^X-&{l0PJ;;g&U*Z#?>Z_JC{Kq@ z9ckOD8ErfE;Q1d|j4kBV1A@d0|LsrHNbgvXgtc7-F&D|MaATj}C-%=@!n0&r;O*MB zA=GO;l4rr6@DEN{tm5LjNi=KInl=r)GGg@^qg&|f2Yg6al=Y9H_or>$A$;zH{05>g zETh?k^8`QIKn3rL31!=|Deb!S;Z^cZW&O7z*^>V(#Kpc&g_%=1_8gjtwO(Zu++<)WwI|0~Rr?Weo~=7p8HG+E@r-D1{(3G3nn*2 zr&i;TuO8zEl@%{52fVyX(0j%zI+jh1#-adgx6h|+;hf|s)s$gfeQ4Tm3Ek_Jqsh>P zjH#6a)9m$GGPN;U5srQSCM=oK01a-e+kTj0&T7@iDdXc^V3<{Ygo*+oqbRqrozNbxt7Bp_yjBCn5 zES*!IaaHTG_C+@OH}b*WGdr%*tfb~HYZqby@#1 zJN+6+{y7;o2W9%XbfhUDGVYFT9Jkrx)-cQn`2kW zW)dRunF`))qiB=cT)sBl_(@kHIwX*2ojLBQop^U{3IjHKuwzkuLgOrPcCa-1(L_ZE zKhh^(C#=m8FY7ooS}ieg;GD|N*hBZ_qCZb}jipliSv1=f!py3cyxG`>Ol{7w;>KM% z7n1t3q+X_Yv_gc0Mr!cza7p}ht>M$hV9ab%;bdo?(8HvTM_PH`+F8VHY{qIux$Ci3 z=+TM)Lc?Nka!ZXladaq|i&~pslX_D%PUhakc<-xZZ9J9Dhb~dnM7?EH8(g@p`?a*t z;_g!1-MzR4cXxMpXp0l15Zo=eyHniVy%5~p<)mldeeU`j8yO>Ochx_COQTm>CQ$+TzFYLw+m*JlGUMFyez#ZxenuW(`_UlrJ>C=EhE+Fi&eiNfF z7=Eu^YcbyLl(}~AjC^HZF>Sv4`%qErf&8hHd!q#Nh#`1B+=Z1q5rjoTV$jXJkk~Gy zU6VW_jWbx3<1}^x#q8o>J8&N^F6gR)v;9J9O^T*wz&6B3m0ppfXEuOHyuNO<#vP~A z$&M*{t?=3t)qGf_MM8+krk;SkbM$9-eP!TFm_%{48z3YITp}$c;G-;RY)q=f+hS^) z<%HEM7F4bJtXkM(*C@OK;8Xhqyg5inY6iy_7IEZg^kd)<1*HZdK&^J4!j8jvd84T; zQZ!M6WADo4`5s}h!Zn4RiOfg8<6 z5b-giTeryK2u-%50Vv^e1XG+zh7SDZOoy?>Pcq7%ez_)!mi73CD~0K7Y-hk1!rB`; zW#3I(zsI$-wCwsmW%o2DIC!l;dcbM~Uk8h9I#b)0vdVvPw})0ZnE}|>IBh|NpT56i z@!ghG$X=N&cmrMFuo4ofgJjqDYb_w!`TmE@(>4iehfB%7qw_wHYXvN2YzfjEfl|v566!1$yOF_Rzo?%7zf7G@3;;c<6-F2#NWH zX{J-w_pJSPe|q&l1)^0sr~0p)d^co9*P>{VG4q2JxN|j8G-dyVYT6hvl=(wir|rjZ zLy>GoR-WGo@zsI&g8Mc0le{s^2YuDvI9_h%#pB;|dL8zF3re*~OpHot3?GL(XTAMPJ5mV0`{Wv^ zkS(Bakx%Y+wi-zbqMB*k=WzgrE`bjji|3sQ5iFyMlvj<#BbOYjG66+D$x{VRDUF^MFx~@8o+#IN0K$A+cs71sb;K zGgLEV5rNT?@Z`!?)LgJpes7Gs=h>{hY&DaT{Ugih_x~t6^xyqnkq`_}@^ie-dpM0h zgKN?Wri1XkLwbb9GFV?%nIr9cmEug?gu-x3&IMdK6op*J|AaH};lAN9 z3pXd)xfG|*;_yhsfmI>Yl6E>@4mtkRj=dJI6LjD zE!37+N~ukwJk70nC)A+l`8^xjpW|EK;K^qi>nc`wPxtM8_lAk! z0T{_@Xu|eHIltsZ?`=79d0%LVoHnN|m-h*xxDDdK%{?A#;>-EH(-|nK!MAFr(t$Q^ zQ#z81U=py^b(0=qhd8XbUfYj1(}-(xIV0?Q%PD`S8)YNBZSrX4NL{>UwY#oYA&Q2;a3Y9vs_USV9){IBP;pld&?OD5Wib}p`0y+)H z-F>jr<(=5_LGa*%IWTX@nA(yVLs0s>*x9Clj8dg2W&>89EFF1V;O?_6fZx8q(41bI zv8OVgl2dtl8qTP%)f)m`5@fDSSY8BNFIbV4@9|6HP{LhyR*Ms}|3sm(UXmDs>|@=?MA4Fh>S`juSdVJ(u{N1obuw`g;Fcvqi8sHL78?xr zK}WLNQ)0rm;S6YptBEnhC_`N|Up)_XzjQm~n}gubhO))#*C{@>fYv{%ht18%Dpf7P zCG`|7R)70|RKN;nS@@_+YX~G9$2yS-)ctK_WGzDDF_=f+`S%F8i~ufD=1D47Ee8nf zHiD!~ai|rNMRV{6(}+vy9g4| zf-Eh_T637HL>%K|d}ej7!4=oOexrt+^p_rPjZSHGLNmQ?H{VY+a?|0=!*@0rC!E9L zV{w=eDDt|+o5oyPRqN@F+?mk8^VA05J-K@=Yov#CzBUkB1@{tpyuiFV?$(@ zmBq{X`})R_tQTL9es5JJ*qsKlyB#zNXbVy0A5xbM$iaRGWJ9PXNw(D$8F}686~g1K@MM zC*7>Ix+FWO?r(E9@+{hBo9lps2O|2Cxgeg4DCTd2I^~CD-+Z&W2?L-QnSpzR17{+2 z5Zv_6w(-IGJ=%xmyfyjy3#IiQ4DtdzUIR7V~f+O2Hz*Mbng1XS%yUoy4B zpQJp%RWof+ykOFgXKukqNV!bD0M0N3=F&v>^ohLJE(r5SX_lATu({Xyl&SBf3K_h6_K4Q; zc%866%O-90=dP=zH6zbIHR?IpDQ4>ROm2sr2zI2%xWlV@t|PhV5sA#Z7oO-({g_6A z1vRP=&47{jdM>30h%!dQBIa?4rc-(QH);>8zL<};);S+B&@r@qKg2lYQFmg;AZVHG zax{gP>658895HN}llPYs8`YR+GxhglO{%=b zn|xk}HQHFunH~OCu4-v4cJvkddoOVm<<{7pSDyYE+OJre`V-3pa$s>i`($Do6or(w z=^OgS!v$e`N3affg!(hk@$hK7*v(Zi2avyNYC`?scgKga=A8&Cc+|<`%?tyeRHy_f z-02^o`oy3`VSsGE!@tq5Ws*A|$5%mgzA^Bd6-1vqIq7off@|>zuQJXL3a5!luId@u zPKA~4gA=`(Xy&K9i40KeM2GZU-bt_=))v0^Q)443Iv7gWr=wA`%gva}%3qA)1cyqY z6{~LR_aW%&V>)h>T{?xLHbg&^4c@O1ZQtBs(q`eXtA9Bcm6zGy`fhgtM>eLiwPmC* zv`Q`DgArxAK)7@5M0o_E-#%djJptA8yD%Z8;fldl_A;Q6c$BK3i=iE=iA$;TgBZRG z@;kg)jJG4sm{fM-+}Li#gsLKG=9-^+xBj6Oz8Y5+w|_zJ^mYPlri4M^!t#+Q#&?Mo z1%u!Eyohm`M*7Yei9bjFbzo9Jxq@uKeST!uK@Fm>ME<&d^ro0?l1$1tP0}NCoQf=A z_l3Do0XtiyI^Q=tm*7TUlm!{!pAM^5LVypL{2R#UU-zFv zbbr$(Mxu~K)t`NZ5dpVej4=Ni(_Z_EZfx+z2I#()gKIu_43&yQ$Gmq#jd<+?!(|U; z&SN$7eBh>b{kZWdjw+u3?ZX?59<=@X%O56H*m6YWf#ZS(m;7)|4>F0zvQu`5$;nyF z&OkSL`$CIqwHj@0YYO_|dqNu-1NFUM9w9j3$ng0qrnzl47rREJmY;w2Z`LaAlCd5y zF9_>aUZ>eLlcde`0$bmwNH41N9}e6ecb#q9Qep^moj$<#5t6R&5!?{m|L1AOJNSCEljB{s8( zAEMS_VfKh5{x({R`akxHxJT6?LCEk}(@hi(gVyiU)h5W_zrXX~jHKPgOX-^&Hw&$%^JuSJ zQz&|Ze*KCH`Z!ypn2oqwf@&gcjl3IdOF!PtAfKMpOn*%x()w1S0^UBHEgBH<@481! z^d0zTzzNWcud~#{{`VQ-&W?_b8kKqxiC*4?ZmdkZ`%ndSXC!fy=DP}hJTA27hkHU3 z%D32P2Mdm9KXVfepq_0}CSl28?wNEin)3EC8ntC8QMGgAvkNs@I>bNzftH! z_iq)rnL)>_|6SK8q|hO6vnx>eVlyF3oWzxp0hi)%IWT|t*^t8`r-{QX)Jw`%=vY1GPCzGT@fmt zdXvGBRGV$-VcYWp{PI@U5p+}eoru$8HUVyNQ!c*eOhTHM;#rx3Lk){)5x!sj+FhT@ z+_IVzm6(~%btl?C1GQ@1Xn{D4M$;?ypQt6EbqP*wJe^8}x_#{}2s}QoFw;NtI`zF1 z56F{Fbr&u~pe1pFa9KrJTv!jWI+Gp-oZ9w%_941BHFv*mhDdF{4VG!#Yjza zLyRHm_{1>4Ic-Q28~Cx;)FN6Zq(~7@Hi2dYJTI2w$@lH@Z?brePoGvN-_;>ozNAAB zo4 z_1jCf->GG9#?L+rCfS=3UckyN%d|RKygK=Q&ZuG5c8EXCj_MZ_RpG)|E%6k4D)^nr zhji}Ubt2HR_p5E3kBJY#g5byGDD9!Nv)EYfi*kT z!M9rN9EschPkabZObwL7z+v?+|HAJ6(3(7t0g-$h{D|t*3-9i^)halNzLt(dvAmjhNNq zPovKx=v%}jl3j!ta&0kqbbUKlZP|k=1TLYOfWr8>qGppjl7FHZ^K$>%-mnImu`g_D zZ0ANh?kD2tldp1Y4CsXqY1W<-rmrlh9g;k^BuC#}=fpjCi?oevq%O^W>Y#br8s ziXG$7vlBN9MMK#a;^D`TJzKDYxOZZ&a2#61<7$k~Kj^uokOKD;+ZuP4fxwnImAz5Z zx)E@sxM$!>i|UiXiDQ4TT$sQ*b{?XpDa8Dg-vt1K)TPV-FF`K7vT0&}T^^m0%>pm8aWw8LMr#CB@zx8;TFLlk>Y=-lC>GumUNrjY1g;agLwmC$@sc4Gj06#Nxhoq(6p|r1Ma#_Ty zp_wg`)%9^-*?kl#dp3elfxj3sr@r*oy&~dyDyf;_sO;JfU%)DRnbXPa8B;HDH`iYJ z*$TJHdnQZ0TE3G zQU9cLkJc=HLe&fSHhZ+o@f61+&`fwwM`G-S1!2q1Ae>M0_YSLW))uP4k%>iTvz8>I&vR~n!6GZ1FXrXAZ#u{{1n zU-gaEs`keohqoXd%;V8{x;JhUBiU=f>^b1SO2plV1(&C*T5ecn+$d)V1Vm=pa=SK( z2#sm97x*r4Crqrx3Rc~*&9T#eUd+k|?n@ncq>N{TFdi)43#qo*XkV7&QfA5TIORGs z(AgR76WJd5KC6JQktWvl2DeC~y)|u_LKIQ{+PqyxIqVFNIE=F#cM%VU>}nm<{1SV; zHa5?!etCzM>vr!cGkAj#%5bD``F+v#r7H6qXKgv$!<>seNpuW0y35hWt=j?-v^P(- zf(t)cH#S&Ux6Wta{!T+SKTN5XIE$~T=)s@GvjH;5i&bAM+$i6N$R&p%?YTKi4M zUpdQi%g?7~Et&6+!@D?;&gSYTQwY-xb3>N#k!LC z30b`v(eqZbZ=?ut=`2qv>~PrimH}dp8y-tiWko@_FL``Y7TkGKr?753PLav4eqL)Y z`1TvfmJVt#e1ib&w>`rTPm^W?T+*~u1>b;2$$mi~@BOHiR1o-cm3Da=xG8M7o76QzdBdPz3eMuT@>V=sLy78^~qW6dpYhdB2^KC zWoGIs5mCN{9+WgJn1-9_Cz}Eh6GXmFNB%6?8zH8~_F^S$8`&WbQ1iDtjs1-3#B9i} zt_NgSAKAA-wm>feT)~(|&3!4S8FF+sVMf0akp*@E?)}E29Krr?mgWo;yK*S;-QuuV zSE)ZW=cPPbC0gDztajr5!^pum;xsR1T^0Mip4g@&UFJESC9UlQ{1b+X8uy2pU~zg` zazPBuG4riRPSJ2pOoy+`?jbXny1MjdhJk=-*oI)>SBc0(EZX^eY-=X<60SXsm;#J9 zAsN9A4KifQLr}}o7$AiCGgj$5MnHzNrN!`|=45m6glL;yV~RPG!a$S?&duaO2#?$S zSafU?%3=B0l^O`7$K|xX`Ri)8_6tejTxDF)pl0ReSS>1NfrH64;@qW*^D!9T*V$e_ zzJ*sWQNY}OC-Fg~+C$Xm8njC8@>wRcF$+yevCj+Lus_sB?Z|Ju9mdxGF~Q^*~yF3LddQg(3c^KtP;C0q-GW(`DJWW)!zgMx&Q z6LwTBfqqY-WX62xG|i}LFKs$>aZw2MeTVEm>k%kRWiUk|e z9)2Iq8yF+PNI9BAEkL0qD@z8u4atjmn1R)QQ0|YYMP20P<3p|@YiViSujWA=e5+fm zM*XN!6oX?edvN;OXU9#YDPKg)C@0dZL8lKa@eC$W_JF?!B(Oq5UM(-h*Z6y{J-bCW z-lOQK;@!OElyh=WINPcQ_vcMK1k_c@I?~wp3q)f0kcs?dE72u}v0a0D8kY*vM2R%g>oLX93Sno>~&iKzrz_`GchfcKz0kQT#u zSFydJ7e^K~XJ3fUVzKyVRK{9E>nm|#;X&#Lq^5#biY7ziWN9b4HMEzj=BTKsG2!Up z9Fd>_8AjU24~gwd%alvIZ`h+rjQRGfjROm(ul$O|8+nvx5hfJ2Pc&zrc;e~xZLV;} zWdH?uNc>H`J0mV0L~XsxC?zRe<$~5Tsh6x|oYAE?gS~UGgC-5MS*qwnn>Zzv?LN2g zii(OgMWkv6W1?8VtKI6jkLDe`9S($=J$kh9U8v@CSmGqOe~t-ov;)tCDyYW0S6M@U zg>2h78}@JgWP1LTaWZi-FGlnRH%I+BpS2)3nak8)kC zaKc1K`sPL>_6tc_yR^KmRYpZdvQ2QFot#8TelhG2vw+8@4`&;TKjK8ljsDWho6J1{ z%ZVqKnD6}+Cuuxo0=(~|(_|g&Zinl!EEhl8AF8t}pv7&&W$7SHp*}2hQ?CCbcE5?$ z`;dx^-NR(&Pud(^B477pg;aCGkzCRC;TMc;W}qTot+^9qr#q-%L^mEWM&-QYXYrJk zOCnSE{)B!=(uER?P`_&=Y&h2KY9rNr*!md%#V7p-DZrIlp$ipzg0=rp;zHU%wGtaP zt;`k&cKM1+WKaL~b_Nw3uO3zkn3>{5>#Hzn0lh}z0+OqXQ8%VTSo+mp4OIIl&Tb)A z9d|d}q*U}5IWG&h0p^~#MnPK_`)S00Ru=@}XMDhcUdR!pYK_O7-^7E^pAI|26)gF% zXrUkSmcq(iqQCwi`}$?MItFhedH?BL_q}}0Dbjeg;0et#+B)#>!z>>NUjPf=^9+Xj znb8OMue*r9CX^LxaWmh9;j&?Z3H(_*esjxDp1B|n9tA}$O zv9Pk^jGLh~qF!2v`lhEGv^4sn+$E-Mffmp!tSDuy<9*^O3pi-SA*#%2AsW~}Zz@(` znhF`E9rL<>C#Y|2&h=q}MIG(j(&U0>3T~i*K1wDQFFj;OZQ*K9JwY>S!Io4r6g_C$ z1~vk?;y)}3W#eEor=GXpSVP}kb>0wF&hyQZC@RuU&V5tnS7V*`8<{nUJIP${)|OHz z&B!+1VXrmLw>Q??^je&8+RE{~$g}(>v}a!}yPAh6ggZMsF&VU`phJ-iaeQZ#zoS|D zr5V*B<%1NgQvm&n7H8qYW-)FjhT-bJ)UkTJccFujW@Y#f@y*Za2f-wu&C6^1_OAL6 zYbjIQIWm;l(5S+Z6PUTlO9{02a%tiZ3p+D&&gb|3Icb}#gJgs+NZ0Q zi`T0M$L&os_DYT#QH=JmJo83p$gYAN;s>wYijnZ26)iU$F1xeIO&d4W^AKWk z&UV~6JbC5nem)PUjQqm+P*t+fB7BbQug7(`u0l% z6C1aKGVi})h^XrRPGB%h=#v_*n-p)fL%LVFoA((+xfYpq^4Qn{983Gl<<@|)>(i+V$j?94;m!U9oS=A6lc;~Njd{I{NJ0ESuK>aiPP?aP30O4SpTyKAF4vBot2S{yv@a>uA ze6bwMnGjCzhbr4wx_k69IY(aaWl?x5KyZ=WqxGN_KwYWbpeN@N2j%6GNxSEv&CHou zNXTof<@i#~Rt3;pT+>k9ulC8-B*_XtkE4HW27Y#k|5Hk0u7nDvANHm2 ziWg~LG$}lyPx&d^cA`XSwd_n`tt4rTV-{=Zo_+dE-~utC1s?~UYCF(}poo2b)kg_z z_NygBBJ{*e!^->hfa#n#BiD2COb^kWqOR`i(q4|@U=mMCUtspKfgAII5QH2wm`HuI zLgjOJHhu#Ri(B~hMTj4Gd*6YpBlRR&)IBqxvNN9WaW{?Kq{n4tW#ezW^M5tazxzO< zWdLRBBQ`q}wIi{Z%(AZ+d(v2)2t-%5lul;KysYz;?R`iU;##m`w{&!T7fUD_i;Ykl zblDja(bB@TX?XI?&ZQj(NVxbuUV*0z^?Zb6o+a56bJj7Lnn2IYje*1nEif>wGD!n(a$nIatR&8e1a6)?R0}1G57~DVscky|O-Wf&B_h^{28xdP^E2&%~pR z{M2U?ZgRHdg7f+31oxn!d(T7lHer3H%)*4kq-HHn*bv%n~TVz~8!L%Irs>B6D^ zB+ri|cU{U_UTxqMj~5x@6x%91I}x$@?Q>SOBtOHYp=-ugxd3CZyj`Hmd@jB=??;Z z+Z1OX``l{@NhU7D;xGY4J2$CKc7D#0#peFFu5;Oh#C$#Ld^6+D!s{r5Q{@)APq$US zWHONHXYbt@*0U9g?o`)iVq?Ittbex^8ae1j$e-hP+`UI52(rpEcl)Ov(M~qj(x zXRBt#(mw-;=n+qQW66jmonC73`fEfxLt~)8nk|H$I}I_~4=!oJ)7XO*>O}a{xA0ll z6)h??35Bt6jh6 z!c(*Gpv(D6l>-2*7{&u-h+5jIrcKiBn9@8yBYQ^(9Zm^$Ym`YgKX(FDTelQ7=uzK2( z=-HQ>^DC#G|NA*5?_ff%>b^@t*B(3UrA~E&Jm$6}oOMm%CsIbB~bN##2bY8(A;(NKM_xI3y7teAM_38xaMV!R zZrC*si|RqY0>aL|h^$1_<4BfrnN0Ph!c)4+RNo*P9-fG}_@~nM{nx^Izf6+D#H#rt z*6?IIyBEi?2s(p|nai%2dY|3Jtz&SAHkL|2;McolN1o$A z&TQUukOXB#)FYN?MxUeNEZY+!H~scqJ2fj#X9b^Ul*& zot5qHJ~v&2>ok}y@m$HjKUL4oR=xKqr=71JP{mL-;|ra?6J~8$2F8PUgu5qkej*?m zo>0GXh1 zwGE-Jfo=q545Gk+_ia5s#I-D_I(Nx0fQ^7)IYEh~)5prd$f$My7sis?uK%1rd~0)i z>?(%im;*HEnB{aWVU=h5@okZ7woqL&6cJx^u(0FtFdr4J#*x?mRVFW1c;Hd{6|ePK zWP79OBIXIqcTMH2xczdXkx;e~vDF*KTA)bHcY_=LPEu^uX&H6< zt%9$~>=^8{g)Kd~5v|SQ`Zd$%4)Svc(>E@ZsIA&>L_7^CMIzYEW=f2!GDEr{Pu=?t z$dQpc6XnvtM_o|oDaCh3+(Vr^6kCBm`1hwEO*|z|#S@C@Qh|57qShbv9CL*Vleq(d zUt3~u(^Zq-xUvJnHe0OS2>icIqXcKB$nT0!Uv#m7&hk<4*9|t8zAsY|c|Gznq`vcI zci}>HQkJ*j(84i8F{r$3@s=>|_1E}lemyusS7YHcJDf<-TFnmD^`5)PyaOYni!G>n z-?G_>7LmP5RBh6Hvd&1gwy2Ks;Fg_%-E2?+XGE7YioM|7Ru%G!UQ+4Th_`5%r*pPU z=vzDJb+T~9#h`g(B=gE4&TH{!7%+OgFJd-gAyy?iU)*NQy}(LBqqRg}`%aW#Hvv;FwBl_mNEfeNeZ?}v&+4FJG0iu_?&_1BG#T?QMddpzyn z4|i~%^%o!qY2e$~z``z+JW}+K&sqLGkD2ZjZO*vf(v|ZSO!drqf5EC_iPcGz$;vJc z@g2vBmavJ$9+Md>;{McM8WCPIKp)G_jdF&Ow;ufhmW^X?;0>Mf)C)WalQ`1D93ri7 z!5@zfg7X497ky84G4uRd=sirPmf`{&TZG<+t79-R96ovPb{y``VsNfz%WULycKl*m zongs~XXcb>t<2UA%YTAtI(y7j;ZyoU&CJzzxuyQ4=91)VRBf(!oZf&F84U3y%lGct zan)vhKc4IKoxMj8fgk+*R#M$J?M%jSct3lF>~Jgk_Nzij+&Se~J!`#vTatZjQ+zir zIw76`@n$?6t~$N(?&$g}fm6*K#~#<%#4PX`%4oz$O`|8=B*5ZHxxD@%H8_UWzFnm= zs(-t^-Y;6~dA><397eTzjh*%S>wb5J%h-48A-mAh{}M1U=B@sNvA5LO-&?V9I*kpb z=(2d&MlwOR|HT4aL+A!Av^QyfJmE0aWim=S$8zy!&3ya$6YQ5VgMi6q&rkT|4f^@aInk$*t8rq`r=5DehIz9!3!MC)1v~D&QJQ>9_6Zl zGnm=}F@~+#nShsOdz0apul{9MdGF4(Rh7f(_^XHNFBtN&3g#0Vd-b*+arUF_R-4X@ znW3KlsD_kNn|>0^>=8aRo6nDO07u zT0pK%{rjdpLFflc<;trf&pS=b%Y)%=6e(QLJcd88vH<=T5@$}^h~if0k?spPBpl2u zqC7lw%Chd{YnSi+I=b{L*PU1yeE4C-gK;=SY~Q-;4Yxmw+4zlAbwpjhf4X7+pxK)= zwr$r~+)4FGgIO|pLOn{g#-Db8#13yX4{iZB%irX&vgF2YE;cHQZiWMYC~+dwI^Z5% zv2AWQT;5_W{~S~}|MAKW=Q7Y{?7~Na#g`?Pyavfyha%zfI?Ls40N|r}6roz87n~U& zcAt6eEnFwW&mnKEK@mI*G^n*!#NkV1klLfN9j+oCf00seuC^7zL)Y{Q^!CD(PZBCH zn_!zeTS^&enQ`{ER<#*>?i;T2<>75aRvbexLc5AM*oIkJk&@DouuoGU87P{4cEQ0h(rBL1ugh<51Cp#nSkw#8B^ z0%-Qp#<$I@nja1+Wbm&a4(KwjG6rwBvT*D9_B?EZ?I$bLd^j>hq*SIG)D;R5m;cPo zK7YwDNcOKUFz!YH7(B(iO8HLBjfMew6>4&QhxtP{?pulo&bE4m7B||Cqk~W_0wddhN9(hg#op@sNFHCoz8z@UPT!bJnkdQ&nCU0`#bvc3yDn<-S=#nXmRpVboJw= zH-=_P^m38~7#HEQefGR4e<-_KV@o@0w z`OFSqQ-KDMh#K;hY`_YxT#c;shuMOyxT8`IOC>sa?pqJ+gXNfnKX0QSqCYHRfkXrP z+SnYIa`=1T0V~b8^@bz5sbs9lOYv61B!dZRG;+xHzEn;`#7v4%9K)GlwE5w}hFunm zc0v~vE0JbbhyD;Zb{Hw`Wo}jW2F0-;pvb!MJxY^obXskEx%|;3J-@Ggs8^2l9BwNWJzl1CJDx|)x+13X5ioxy+5SDeu(j3puTNTRA*I>zWEB2m-Oib&J#g8o0O%Ce$LKotzJdN%+nRzB$l z9TLc5BH!@TrG0fHJ7SgC)G?3Dy4XT3%7B9nkqkM}iX$979Aj~xUKvmNymh^K??7ai zPhPvF9L^Din2JM#-UOrK^Z+u}0$;bUXnb`;JV3kUmM1O`7>_D@DuD$5zzk$$7>|gN zW-&uXjOhF2Rj8OH*Z=hzm)DwWzJpN78Z6?ut(V_9Z(0IWtR7wnM#C!O3I&PlxqXTb ztuWg9)o&-*fU&D+>rF0R8(o5}Od)BKx6N9Iz6*{~pkWqKD<7&V*;vATc(O*Hy!sH$ zi>;NAe{5k)ucs%VdVRRd51Fp!Ce<>RRh$6G8ngpwjJukAW-O#j>$(J|m<$T)hKJM# z+#LApFcd2Hlue%ECmtJuxi|OY+#5o!h~~cX)HE4( zCIn^L+Z~(vg!47L^;}X!eDAA-bA50@9ucrbcBN#7Ru6Elu4Mi;JpV;tUt~F*2TA)9e>*Vdl zPh%^7WmsUs?T=C9JlHPj>y_yZKIBKA44YB~9dg|xa;-=q9;^pNl*K6Jycz+rCd^DW zOU7D@3*~3yIWjhqL3OPx6^p1bylMs7tVMmO1*s76<5Qdwoe^jcO3A=(j-C07q`f4KX9vqWz&I|v?n{~oTpYk*2gP~ zo35LS5inLBa)G@c{0TPP=|nnn1Ud7I>a#=&35k9;GaZ&Uy!oJri>d?$DmpE`v;)sF zrPmXfMBNUtaDhv*n*g6M7%WCtJ|5ukY?CMYB}T>AIvbvP^;7=A!G%%11{0Yf-ACb2 zldZo$LT2~2~15@%i%an|(oa9r|!!}oW_|E!URO7?PowWKKW zl=mo;ZpC`LwPkM5Ur3d$sBt3R4(pEiGfrnsAARAD%W69u^Hv$F3O$;Hs4&T+nQ!@P zAlkz^QV*@CMTR{(IvCr1x1lTa#sIJSX`2<31OxcUyl1K)UDP0LnHQ9xkPE7ax>k6< z<3&$v#_b^^k1k{xsQOGMSR&y=(Lh3YgBD$!9OK|1&AFVTidMym=B@ZeH7%4)!#KL4 zpIJ=)dn4Zekk_CLF37)3qW>S>zWNtIM*Y8JHaW`Q7nGa?$>`Vrqz?gyNZc40Ad*6X z|F5LrZS{XSY+qmBI)`;WJ3G6m4oh0Bk{Ibn@0SNwC@L+LFXMd;kR}sgU_flpiEeB2 zjbu_xB_TL8xVX6ZdwaY%;JbC7mFqJ3f2HhLIhVVrQ4^>^2%FUaIt?{CZpH)!iACZ- zRPYPrvHZ&7nCf6Ua{b-lJ5l#OvvXR;NM(8}e^IyqlP@zQJ5G zn&{QyC7)D-ah_v;m~9%=nDqB`Bn%G5l0-yD_s`C_l{g3#m6 zTw7r19)I^gpo}#|Iz#EadokiawAY?wz{_{!89A*d^#5nym=R>M4j)TpAN?he`tJo% z(1|tx3TFS`C!haJm<+ZwmmQEzIE<&1D^@LvX2;ZAC_6HPzr7juw;Lo zlNh~xG?XkS3=6ybqbtdoB^v}*eXO=+ZsBVfWXGf1807a&sd>T+!bTQrmFqb_Gasr| zUD8R7a8bkEk7u3_5RgY`qt3W^k4s4&THJ?8*5sy@qgzILAn$` zfyib=veQ6@rojKF2X42JLMw~38f>tL_}o}3*%+^1p=C@=lkZ7nm!_BDU_g2xi?eWW zW*G`9+UZ~`CpE@%Y<+M$5@zjR67loFx7Yte)?0?f6*S$VApwHBYjAgWcM0wi+-1dxYat)Q<$&yX0+ZWB zLJRPWpOp~E69|P&6-dU0H`b(7c z*Ivj3cpVNw$*OvIF+AahkY+Syw^g`dzJbp}cF};D45nwOe*1{L3LG3mdn}_OI z;oxNQE{aU#`MxxMtIz5;O_a~?A4|NsaB}Bz9z5f3kFD|;cTTs5s6at&g%PvupQs!n z4uS2A7Csm`pGgH%hRjjNRg@{a4i2W=Z}^HBvi;u*Fe8`lQ?cP3E21fx%-h# z)sk0V*GK1ap~`*o ze{>5QBH;ac>;fNFtlPVo&WSsKR?CT{Z+aOG9i7eg^t883C7ZYttWJMyjeYzsSdX`FxFqb^bSIf64Wk%TDsm+HUb#6-NU}v1HxA zLhS;2)`0~hFDp3Scl>u(LK>d~YeJE&)b#zqfqS0*2MYp0wg1MmW%=Clbd3U^{rHCE z>PFRYOfrLxi35z;QfIZaLZ}CWF0qGS8cVPU|5iXI^rlX+vo{>7Oh{jU{F3R?5NH_wgi zHnX4ke3<2+BlrF~-tg6gdEWh=7EWB6tI`@DyO14#Aj1{(V7jQF&r|5>8cpT@iPUqC z-^0!7gEn?DSFD|&9TWzS<>ZO<2kp%T*EuLP#cQ$of>YPL(&BE5pJH>hzC`(~yFCSY`JZmeK>4eK68JTxlj$Xt5&77FVtW=m`?)srqD)rf5`8GPNJ! zK|WvpG*dk7SDtKIz-q^xZ01!2ECXK6k0a7_cB1Z{Z(FzbFapQ!#$DYqv(|rq4u)}^ z3VKJtsvhKz&d0Vnf88=Ymfmt*@|bZ>Z!Gu!<7KXb%@BT0oT)C2);pg(Jdu&K zNbqY+^y;b7Y`dCCv-Itw%E@W>sfeY#4b2~v1+|~7p{1)!Wxw5M2Fccfv=h}7`sdGB zFemmEB~fE+@|$`p&O_nYboVyM`40;hW+eg1e!{C<26;!JI$(!mdLaxlxDsWenQ4M8 zn-ULBs6{)xm5!OKXv>1j8Ga;aLxWVm|EF&pr+-@T;s;W`(D9C3g?>l)1%u(afM3+{ zijd$xOUFByzF(C&B{8E{6T?dvpvX^8)m4m9iH!CKS6q~VN+y2-KibnM5;EPVrVv7-X^A90* zXo`z`1bLmNP=mi4)sK_#4ampc1HTCmHyp^bA#76JchFHQ?a{Lf=xU4Wp7IlYB`c!_ zSR4qaY42}_K2VGG;3uhTA^wQ;z;C>W!wa=zGbOY=u}2dV_pVOa1Z^%$ghFi*Ec+#f z+uZ<0m@=u{?GuXU5X_mf!#z)Ii9pyF*HHL0h85HkmHOoLHpmSZ%L=or=C&L(3K`3V zX>7T0yd?7TiuhDu0w6{!TXZzDFcg4(;aXi10bX1bQIDddPY?UKR}2_IyPDq8zJHJ` zrW)8B7vo^>{NAsQlpVAE989-(;I{KPHR6JCKt!-FQ|vpy><;!e6Ol|yAzCQqwBN2> zhG5d+Is42zo?{YGbQ27`VrfL`HDycWpE}7ecK4RD9cJEtQ?0~3)av*w7W&XTM^9Aj z%>f7#k}mnsA8+weG#PK-In7*4wwUIf>sM{>5zl0#{E$3&i-nB@tU}_%LT750BZb9AO zl>y-u;&RmBTM_(es`il-O}jlG**qiGYOX@UE=Jh%IJzSJ*h!nw>MH5WNLw;tH<)Q; zvpSa7;jy>ax0BN$qu*JyrK@tSzzA$!Mt`4?Yv|dRsZy{k!3e|!t6dO z$x~Ur%cO^;V8 zrP9#(8_ND1vCMHRx?;3D+G*!m+20hNq={BaI5QOxh z9X8O>GQP|M!euVWv4ou144lRj&0#ijwD7z??K;F=nbg(>0NyZ?%e8uP?Xz%efW#Aw z7e(%&jH7D+bXAhsKk{nj8F8@!EZgqJ#%Pk2F@|OIRleZ2IpOMjFb5gtUTYE?j)f^U#wE;F$8BS2-B>0=7??& zrEwJiHfU_z%GHzA7!6awhh0iO({7nTC96JynRpbexNqe6&_Fz!(63Az5L~Q4n{E?eD^9Itsit8i59);@PqFWJ|O2s(-UR(syCw%v^_TtU2tEFn0 zGF^(7jB=`Rc*7#<-}~i63qE^`N@PmY;g#+qb@P7yL|YGyig-1J%AVfzWdnaE&EPjR zvT+a!J+zz6=@5%;J5M)-qYa|+ z;@z>P%^yhHcBgugdjI16!JCLj#9{F!|I(bYH5Td!xBSyDEM(OKjebwxX}_EOmI1<( z>)KQvg~S66h=z4Jm8wxMU1k8oQqEtJ)|Hlqf3K2fX_gpnW@c_A^EyJ+yH^pWrbc93^|mJOM2wqas5y*7WKfw?Y)NZIhu2Zgq}bU*GbtvenzszT}=qbZ@dxN)l7de zpa_`!y)&fKj7k;~m223D)`}R`JA$?zd_0)N*G0O{pvjmhQt44CFK2LM4ATl{PX4$i zrA(ABkH**P(}-9+^o!0`&;#eYvf-G51i{sGfoe0|j=09VpMQp)bhR}C^gI!=#d=y; zFGHpTwuu%%p(kFBrM$Jm?EJ_vIVUD}IYd~oEfSsd_TzgcL>o$isFrmh^jEzN!HhOv zBKdUopEl^vjuJT#Is8zTYwnO)y4YKXK@j}X3jtPvbgZ=>+-l~^qvw1{kNK{a`rQFT zCMmInI-33UPQ`vFLqR&+Ds6qjlF>v`XaC~2u5sXO;7xqV6GbC!1oaCRf&%Ms*h7}B zvZw4886C$&GwcI#1borPkvXdlAH~kk4JPs$6(ezkQWxZw+0OGZcc||64yzb55f&W1 zkD0SA?EC8c_tKUe5T-*>)U`hOZ~477@0HBP?a5&=S4%L;a%PG2$LiOeOlO2pI4Ro) zNmu@h{pJFjr5OF$9y3?C%^67`>{^!_Wl7#_^W`H8(TCqtN3-IRy|HD&oag7uB0(r6 zU%3eTc?`8_F&s_L2-dstLV}!}ZwH0@=_4u!BSMEk< zzA4(U==j7k6oM<3-a|~a3T4ELYYrTKPwwDaEOI{$P2=DQP_!HhVn;CfFlo>w(@bj< z^^8E`Z}qT47@1R>a8S4e-7hIUHH@qH%W12y$VgI!v}W$CwDGtBWG#V8fifa69lUhT z6nc00dL2Uw)_s4)5%~_{uQ{tF-$PE{#+a&pE;5DS<=HaQzdk~Gi7~g+*x9xtRaULo z3}w;6L6VtaR3x%AK3BUB!@W_2El~k3AN?l3?rG(cy!S^9JYv%o@L~Mw zv$JmL#WiZhQAhD=)S+fp)mKv}RD?v9;E0XjB409Q2WIdkbn{0`b-^W$pT5a;qVSaib3%}F~h|5x5|zH`tef-t=mOA z;PyW5xHHedlMvF0w|Yp*YOfog^`RKQR#qJ))0q+2v%EagJxAe5Dc?}(eQXNzWUS=8 z*|yq$FMQn>moXz@%qtA$smu{z-&YWAb^{#u+Snw7n@ij%RRrbeTeu8K7*})5Rt!|@9Nm;HIQTt|Cua2DE{}Y|tr9}=eVsxdl%bpN=(?ND zPJpg2&`cA0{j;w*wYXe@oeUCCwHO`oobXoY_A-7HTsG*&eXhUjX~IC2Y8@+L?`+Tr zaPD{=QLDGc zks`R0f^zH^I*^kq-zYI^t2qd~cy-M`nm78o*3V9nrK!sKCr3VA4JvJ=MS1%_$^07w zrjxlMJMreeu`+_Er>AIsZ|Px;s>}-<5TaIZ6V2wqFD^Av6Q>Gimm-5;C8h zHZ5}^uJ6+0u4a7a9sZ88y%^II>7nDhyI+Z37X@6V@c1agX_P45*M0Df3xU)$4ca`D zs&b>dG4Q?IuOD~ct=&>G)qiigyO1DbJXtAMLO;QKZrfW(-1gv~dZG1%1s4qcu7 zS2i;{g03p3JH1COOesaejTVl!t#dr*?B<4bpc7B~hib`bk4*D8Gm$@h6KexHV$B%Gg?iK`%7i;)|!|724HeEJG!BG#2T~w$8Z$ zFm;{oYph~el8tUM>P32Ri>Cdg?Y%MFaz-pm6lN%6TY+bk3NY*>ZfZ^?Y>T%^QmBtq z45Fs+`}gwz9u}7R-gyoIOdF2ww=+gg+m>#+lp6X&U8oH9X^y)*?=Avh(U^!o?cC75 zePC49SC2kdPL}#^K?QTTJy}qJ9Ho<~49;$9sWeTUgP=-<)z?+S3)8oIx>h%afz@{P zA%kix;)hX_i8QIyq{F^VJng|)3Notb>|*J@8q={vsEO65A%@}K;(7F1TG|PM?t-jE zZlosfuk4k&v2Su%H=({+ z(+Rng2`4u9p=b<84lIPSs8lFG0_O7#qE#MoEK>H_1_CiY_oBa?nXwnfBW7`H;wb(E z4kqCirqAyl&70W@cw~LHTTv#pv0oJ}ymXKMy)7QXiQzGnm~Aq^s9bK0%UU=h+As+AVO)8O7nN|@`g*xzG?D$lwU27Dht*%A?zM5Lws>pNWLbQ>ANX}$A-qE4fI z*5UJt^xeY)IK?9^Lek;KbLl1I)|*$VG~3Lfwij1=O&a~sv2BP>8CO4997@V(XA;jG zLj9hRy1NoxY7T6!%APtkGPq)nt<|D2ZuRp1vbTZD^VtX&SdODxdslSX!#|ySv&Kc?Yy%#{C2K$==;B!kN&TIBpY_93nSX{pG6PjeofCo+< z>Lfl6UXszBb$ycsGX{nX46^4rOe7(f-mP)dqPDW}r6}~FN?<>F!s;SFPhh^dnD;a_ zPn)lR#$E=FpW$+Alv@2Uy5}p-8Ztq?UoDo)*-{$2`Blk|dcXHa8brx7J>0Zf^7{IE z|67Vwf328$1_1E}@8N*6)W0Xlj(vzxCm5Vqzy{6$>BnqKXty5n_WNb=vu^s~K{9)p z`5#>F&`sor5BUlIPP60uIPu8c<2F6vl)Tdq*`v%~EAN?{A1`Plub`*meO&D2bgd|& zgRRQ0cl@)Q!UN^VY|6gVrFD8tWTF?`tipo?cDo!=s}Ry{h^#WreS_$(Or3=Ub=Tj< zeD9yyB9@q|ohYWqHv;=sHBMd1MN-n|B))i1s4CK0D)CTNX7{mrijr7+Fq!O~-I+%4 zNCd~@YdKSGx$imgY1h;XX7MuQs~>O%8R&HSDp2(wc#XTpKu6kUVkfO<#>zQcaV~V0 z`h0;A6iU&MvrAjJCHvwYGLxr>s>nbXt{;lH-HsnUx7g;wWZbvtgz1>$k$4`=5ZS>- z&-1;DE)dseJpdZB=H^)jGO!3~v$%^w%bYC&yilXyzX*-yzkfAUuq*MAS*fu*0$h_y z{MmZS7D>cC9*7)@Vy+#LsXc}b(3jl55CxB^N8D{D|HLCQI5_vi_w(n^kt17FAe@B| z=lyLTxD+~tZAW=Q{=cDV7QT9sZr7|I9KJX#i~^up=vFpur(dqtndON%7_bG(zv^VD z6DchN4IQuVb?JNIsT`*A^Ic!iB+^fTi)ou5hp6VbH}UhkWL`0b{p$=um?P4L?9tbo zb{L%6aLQyIWbWs_y=;b@<>EVcTLrmHzF!jxelV^-XYa0`z)V|AL=_Z%DJ|a)XLTk0 zQ;W$P_*viO8sE=ITjTZaG^9&L$!OB}*w5xdHHbuO{-#xSPt-0a>X!m!7<9RPtc;9bTyx2!}WWx?rc!=kg44xwTNy6K`h+^=B~ zYOh8lj3i9YWC`)$#FT6BcAGdAoE9J`C^(wIH9>tG$&`u_Z3-PvA{KJNuR@vPX=?}bMsJ)%949b;o-Q4^R}oyLM(Y?*(ON=!-Ki{tv53#`cJZub;zzQH7o;z@F71c@?I`kH*i%F)_$; z$@E>*)6gYWdZ_aSNCq6@sDq)p?fS^S0FDupeZ1(dHrd>?#e?3vbihqww>G=@(=SQtE zl`$VnH^Yb%`rLs*K!aGyD3?LsYZi|#^YdUd4c*<{-DKyxr!Wg^*3ku2E3EZs%? zT}o82u-1i?c>1F9=H(;K@x1ZnW9qT^ID6C&RXg&d(;I}tr2ZQN9*h1PEiEnB`6@|S zNEUuou3fvmy={!K6F+G`l@A4G#OfXy89B6ge|_o?bx&c`kNo`d5&`&PzMb_W`LOTX zayFo!^E%}K=7`E|XB#tB3y1l;qYU@0K64llQyc`;r$;Pth1LXvGs444Tcmgp+#`yoW0_xl??(di%YNI#ia zkV{yd?81Xh{B=rf&c^+X#Ut-3WINJ=cryxV1v9{h@ZI7`jy#L$N?@Au#*l)iugR7z zTT~kD3@nL4l=0k5`pxVGl2P3o8#!Q>Z0G$^+~GtT6O5A$Y?&~+rmNn_w1v?$pSes0 zheR#>4bpBQTy<6_-FE`}TwTj(-oKggT(gl$<`| zXD>xDzrRLbyPm>ga`9ek~M!wY7((73}^* zfpz!nzKtS1#HC+d3XVT>hi%sephv{>uQ9E zn329YEjffq)2a&T(9m9`A}9Y8gwAt_$L+`$8@SW70JS3UL&$gi40MK9RL;s`>94q5 zV*4_%!}2oRGy#nsgD!*>WFq(aP5~3}?G;H@PHqkNlCGlZGcy0>r<$6Y%T?!zzZLZK zvvhcYy_=&+zlK>!oBl=xYs<9)9m=-hoTiV&)#|SG*X5=Vuwv`dT9ubexIyTc(Y6T_ z5)&7GqeqLU>n6*Klm}ZZc9~O?(BGAuwO$EU_V@*=AI)xVmAj2p`L)DeU~NMqQ|enf zlp^3}9z7W0g>JHi?_}9ava7lElJnPSHA=9ukI*~GvdE+B zuG3{i{KY%HpWRYvMDp!t$kzjWW{-xfY08Y3)8j-+*;`FeA)NqDR)J^%>otNqX;MmJ zBYuk2!lbA`)^>k4_l8eE+(_|etpxA55ZzBIudh>$NcAjzbSqe))^zq?xsYqJCn1%EYJD3iYA(Gq>x0p={HjU3JAoSM(qP4O-Pb_Q;CJOPBm1|P6R z0aqJdaq4Jb*xyA zo9|isDBF%u`TSI_1WxfBpvtE$dhG~xmVx=|iD>h78A+p@?aGHFJf0sBH;Unr3kRpQ zv$tCxj+cwl$fDMCD^%XUl@K~R-D3Nso)-%f;=t_l#TW~-Lu1GlJYr(eA~%IZS5+D` zmhB9Sb)3I^jW$)jahD=y1{{XVFQ>?yoi1G=e3(LRZl1NS);*$Ex|PlY8}`iAUP-)g zlHlu=HmQL!cvsVex4Ga>8rPo-HPXO8(_3<6c}a)g(47DLAbA-hWs+o^xw?}jG-rU1 zBEW=ypoW>`KFHk1asdV5;l4Y@g=_P%mk%vexqu?jew&O?V!=5f@YhWC=C8putMIfw z@t&vQ{&9c^-&0i6$Z$!E!Pu=jA~H4C2?GHNuq4WC-ZTgqeg8X8|Q^}9yG1aVnQ%YL4>Uto!QwuMGaZ&rG-U|{+2 zEB?%b$XoR8y%dL=EJ0=Ebrl|kdiL^j{ac7JVuw-|oG2V;$|r%6R}*s&mU|0Ajo(p7 z0KT0Y*7%6m>iJ9W%X!O8xpJ*T0Q$<9fBBY+b#)6KA%M?iW>E4&_UyMYUj0k2EupW<-Tp-NOc)Iu)c&4Pwrc_IS$hu>}FCs1T_!2rL7sr1`m52 zGhd3swjh3>2+;~K`lK&S9jYbb9L=u997qlcQhQbVv>PwHM)b=cx!#HtQDvF4X6mmI zOr=sYkrk3JdHshiu@I3hG=hF^VETMLdNo1j#-k zs5uk#z8JT{FUVOIS1TvqArOSf0zU2GGtONOqK%z}w%~o9V3=ffuJ;#~WZ$qkzNydO zN* z_8-(iYrTl8vY#aR**FpTW0%0%8;@Oa<@Yv|S~kmp4p3l390HSb-5m)r=$wb@r)H_G zUtx_vt&*4n+8nkUnA%7`#(kX{~`g`Ftxdx;{6p_xs@(K zjlV4j+Rzs>!{b#BcXwt(6hh{)_GG0gZTS-S_rk!2cn5&M!>ww*E2n@{Q$yaGxz zDrrBI2nsDuHew}E=qj*UM%={;O@tLT_VbJ+933khs70>Vug1b1H0D9eId#8?fn0-d$9upYNAw&3V>v9XB`&l?p4L+^ti=hDgFMyKx z6%dQdACAo-C4!>Nm0#XC%_86-_VF|cLhnO_RMNpcmPkEPxg-o#_QC?02(6v?L!9q&02vHxYq%SnHRpXV<^E=k0jmFE^cZ1-#E`G z{Ut@?P6YpOFH^2bOOL1S_1vi<0?|&j45nCJ$Lgw$K@p$kUR2OF|-1YskF@+)C!7s6ckyuctA)v=J3O|qeJB9pAn{Aq9wgLYJhSGhHd~_8#&`SYm%-$v#y`*(cL56#-Z0KRlm$I!iI7 zfDLP{l-8sescZUs#qYq&kxAdnVe(t}i~q#H3WM+&*2V#Z>cal&;Ou*1>Q{O~Ho`-- z5VzUysK2QemRwcyJZlYwgnEa4@P4`Nh}XI+r8VFIU1-(Wr$k`q{8ysaG$FUNNQ_(I zx@xU!hA4IKmZCXcZ#=<)24e!B!^&?qL4>s4S#JIjfci0B%BLjKwAXz{Gu| z?0$-_x};u0D}niW`=@#p!tZatj2t&UWeYMz;*n=I0ri-;#vyup9usahn;S_<2r6Ih z5DD0=h`RZ{yf$&F_ZZ5|@~Sa1!ofFU)!UV?6q5LhTaU2AJ1-oTC~VJ(v2Ytk7g#B8 znAqDG@WyJ^0uXyQTRlv+#y`hp#LckiQHHE=7f3=f>Fp0(A|VlFA9uMm5DJ{3fts;> z!)hoI;VRB$&sO<<#tD3}RE(;355~66FveSL8dv6r$*nn3``~2{^DMGJnRvJ}ar8p# zBafBR!|Rl@BLv6n%aTMmD(QtvUOM0X(T=(cpys|bCt_uucmZV9@03MMBf3~A{00C1DqfgZH0H{Lx;Ol zJ}m zLZo@eHX$5FjnxXRpw^G=yfn(?23WE{Tg*gjoSVR}T=75K?q`{&f&1~j-)Z&$R-rKO zY-|uc2OiASpo3cV*Bu)sL4&e9@+Hv&_ItbNeJd+Y&v~fq0+CKBI*i*B(=8!3exOsb z|0ot}9TkKO<(enyRJX?vt)vo<}d~7o*Q`A*Ho$Paw}YHyys$0*voiAUQrs(^m#~)GquUm=qQvW**``- zgELpB^yr`nAVs3j(YBcpu!9ix(aZ+1RrJZ;1=Hv@6F-I1O+deux0!Twbc|MqE2@Eo zVhw)4teUuS;!6p{8AB^u4=ClplR0&{_xtCB_`mmAzhEkI-3WQdKrBnV*VMk&5y9C+ zh!11=yx$+17y71MDGNE6ZRqw^$O9%(UYUf-<1dxTN2Z$OQzGUsK4h#o(owja$W#gV-v4-lCahF86l{lP z@2s2TWDBUbIpWQ0_N}4dZEC7ZI};pXPF^mUI3l4RQS7`iy&&H3tcntUx#u9deK&AF z!Ea=O@guJp2U4Ja)Cf-V?p(QsjtCyQk~dX;_7_g_y^2=4x)dXWg@ql^_yqUT^)NoD z%x{ZZygiQ_vwv`qvnUhh;V~Z@ByNDJPbR~8`ZMB;xn(raWC{s!l@ktrI7+a1z5DKb~%_rInK)$!|6D7S$Xm z86N#|BQ&8{!!28kut;I73Bx=nNj7YP{c;w6D0|CWV#jMLWI**5daunN@=pa%NzV3< z@3sPG&_inG&ymSd7ar`)-$;-{@;W2yCmCyW#pY|+TPLiGV6!TPct6lq7spEYSDQUjR;9!CS;Sek+n<|>(p3qM zr|KmzgB9YqRG$(`8Gr%&QN!In1{fz&iX(U5Dfw(We%}9WYqHnVaEqfY@?BK0%apfL zXioln;g&49@<%y6Dt}S1kwhYtX+C6j7iPu+B8koay7If*U*BL1KQ8^jyQk;kd)b2f z9nY)!wV$WjE`)Y@3VA2ZEK9o(b`W#tgzXa}a(=&Qq{#Zc?oY!@Rf|c5 zax??qTptlrTccSz$fcjpdVf}uVQr74bCe~TT?cIpOuZ9o+{*c_&d?_scZcW;J|_2U z5uoKnnQph7x{qG|1;b*{M{awO3+8PbZr~nnu!SL!;{;-){;+CtPY?0CNAlMn5@VSf z`f$p&O&CF8L(h7PBCH(?+QD@i{?QZ2;0}?Wb7;OD+PY77i;y^ zV_Y}$iaaq#TZ=+M1r}rnsmsQObWPHw1OfcR^A-KplHFDDaGMo^j zAKv@ioi?<@Em))@azv>tb2$k^Cse5zEy#ZYMBP>36u&=XUTh`w&{7)$~a48If z{mWsx%HAfx&Z-$|pM@UEyVjybre7f*n>j){mqRr8JbV#XDlvS(cq`d!o8t~|)wce?%z=OxKUTq@9f7OdF^~T2ifC3iUxdh2x;{8jDLPtg5*RckO0l?7anQauV-xWJ{xM{ur3B!+8E({C5T!(pzD5s~wC z>n!~%^jrExk)px?A}B$>gTt<@N2mUCT@!|b4epSRS`kjlS8lNB10F-jEgTYKz5iT^ z{I5my|Nr;(CkqNPWJkE}E98#cvXYX+st4tEKx5EH}mu>Qx``i%t^4;Jv{)}sYD5(Rkv_rO>xGz99Uc0v%J zkN1BcN}}oi_f8J6MAz_#!Ub8E{6Rl_7gx3$=)XL5A_D$gE9J6lhlXTzdsRm`h8%M z_O~HH`^NulCg-lS#t#uf<0I+Jy&9U}Q;!_yyxJk`qrMwK?f_2&g8#Rt2bMu@65&^6 z(vdlHo!uJ~Fx_xNK77%V8!^tD)=fU~*m4&b;1?^}r;=u@cdh{zjk(CMu@7n(oti!_ zy3av>EMNZ3EGqFxc<>Zg?B1&4OBiE%=b7ziqvc;=Ab@+nQ)=CS65$4*awW-1uBt(T zM;FXqJvclZV1!d0`&La4KbFBYz_Fl*4t^0G`$bNkKJX7&M50zr{10|tX(cQ+tlR10 zJj64v*B^HBpDd?&nClKBk&E*wf4V9)mk13dS6k4+4@}7UR%|> zh}=r^5cn*XrPYx}C;TU-Fa2gX_@}vof@0A|3Sa+;X&x(T4p@F6x3~&ygwNf+aCzGq z7Z>K%3HNmPP8)fCQgxO7ag$jmb|p=Ke;X`jM4!m=D7_@;&dmXRfje^oOU!ucBEMyDBi`H=TJ?RIO@B6r^UhANe)~o?edm z|B2Zhd}d+@B_=2Jgu&1J;V>~3X?^>FNXH2GO=`zj^W{cal#ui8!d zh2Ry8Ve=@_2+&9mRMHapxj;o_#P9Vt9NSk7pqK%3t(gHd0R?36NiqYn!-FZ{(9j9> zmUtt}GPH15mc+mHNbZp13#99Ew!b%Lc`M^_K7eul3Y@S2wD(%+*$H*q)!FWT(2TIqnJ zM7v7^Ye6tAF_-dx<>Wb#Pr(Ki!jEfN#E}M@^U=o`K914#y0OTV5EudZEK55uZTz#Y1w2B4nE$A|9o+dg8Z4aKpB!$Hf84K8JbD#HjI1jNpCtt1c*&rwso1&qp@X(1B?Mx#ZB2k1 zpCt9S2LevMSPHxC$ocU7dRLE$(w+EqTg>}7qWP=)$j`SZOY=KKQebcseoBwaSL8dS zO@(26Mth(xQp)OR9W0tyk~_b}@nwM`>E5 zr?!jqrQ%Y$#WFkvph0el3!l4!mCgVUD!k0$%YaY#yfxEMN3S0fOYOLG8lfU)d3kVk5g=@S_#GZ zG6gUyrzJ2{c8F_rEajRwlpQ29)hxdZQ5XomF5JQ7CFFOOqjtTd1S`qa18fdp7`Z8e zI=BF_wYn0XJut^{4A0;dd#g!m9=FoeGz+W_hULuKZlzQUnBI)Ea$DqlYeBNMf*C2S zE)z3$bc64d7^92~-uOFw+NnYHq5$9>x|=5KOg|&lX+t*?DqOY6vjH_x7Q8Z^q&mT2 zVzlAj#1{SH5+kwm-^T<)wB8E3Uu&qV6Z4g1C;wDh+92-^cv!kG#7Q8==t{-8e4mhr zQ+(+5*Kf#k*VKDykcht?rAlzXJMm#rokr|gauZ)L^`;&E<>p-4HhFj1nGsys^d@D| zrN3W$MXCXN=^S54|L?W-H}2^?1mgJ$n;FO+ul{RG*FR0q)oalj{~!G~JQC;K|H0n{ zqAcxnB^133HKBrBK=!$EL+m-o&~gfW{MXQGwW5ipuq)YrOBT%DUX}6c&SpOo8naIU z9G#~P>ToA=Jf}Rg`MR(%|3B3h6d~68-}Mdru%mJ2IrSy(EeY?<MuYTV)epMQ59jZicIfDZ?ky_o!N{lhK$Vy3l4m0a2st1^`v z$l5i4kZwedNddPzArq|NN<8 z>|yPIEo9)snmb@Z;Niz=6X5*xVa1^%s&<@rB3)|e>yxD*fFig?!;g;dksU1{%`F>nh$qd*QUj^<& zRV>OYD)wLRjR5AeYM6pT$AxeW=R9#h z?e9Y5p<*yt`$jwC{J)A8eh!#)cQ~VKR4fI=9*K=;*eUV#f$laCr5^YU2Vwz+xrGyw zh$dvv2K*>*2I-)8#E7`5azr%Q#&4OkD6a9Y<+=@!Lkzs6ty|c(!!fzaEe$0Zx!+DL zFR3Bu4Xe>4l0%y76RN2U#RldP^Q<{JnRNZ_`g{+Ma4n~rP+Q4oN9YD6{_VlQl9Y&? z{i@&Om{*n)oudA%WrK~0`4@eTL8mS(I9WBaHbQ7GQFS$LIF-d@vcu1>&Ta+kUo45w z!`cDd1UQ3Y4*&j^^I$vuc!$IgTr;(O-WiHpmZZ*E`z7DS> z>q5E_=OFF+L_Y`W#w6a_es47LFkqK3Uyx%l87>C4)&}@hMu$Kg9Ri(*e09+H$nA** zzOE}<7@w)Lv0Sx}<0x%}=A`EYF*s|I2p^nedGPIf3!vS_-~U*Y@VUC=n(F-xyNFmB zT)Qvuda(o#ccd+c55}&r(LC=F5F_{mU%z9zyG7jtQn2B8vU|CaSr_+O zv}?_)C!HQ6Ya!OP!fqnDgqnCfu1#l4l)wB7L~uJ@+_I0tbcs_aA@An($@m= z`ht}~MaGCA!K0i{lk+1;+VGw8xbSiE?z+RM_bYl8+pbsy6EfFb3*wuUX-mL7fd2O3 z^f<17eJM!J}h245Y_|#G`D4OgX!^c#L}783h z|E>J5u7F8WQ2QYCTk$8T$6=CtrTXG4oB+jjF%WgrlU`a{dd`Ei;{!H7l@_;D4jEpI z?zi_+xlYhmr}AJXKF%m_&xLTFc(hZMKSj1TQmMqp$Hr@*7o^xzD0e_@34bCPE-vX5 z^)(=g0D({@~JyMy~p-38G*LGDZ%MEPmGnIkA|+@^52$dWB0wQ$Y(sV;OV`Q z+n*hGoxh?1eT+IuyRsHxd{(Hovb-4kRV&*A?pjnFhj7nOww(W0>4>~iviM&0VVi)@ z1}#}ZvKfwfHc|8()0$DM5+WiLBi;^Sgk8$7(`0LBeH)EY9|%wg0<^wGflJrXu*X zi=OFq{t;e|AP5#+4}us*T%rz?PeN0L`9a{#C#YM8L}N81&EB2L zdL{?i?K)NBMa<4LCK9cU%(dZ}@iKY1x7N~GhR=*ZNI{-^GbkAq=|b))zp&tKA_GH% zi+kyTplK_`qm+8{9rBh5_5msD`#^d)@sGl|$aJgl#abi2LGICff>Ay6PS+Uz$Z+%& z(vzW?%ZsazKoO7s>I|4UD5&gSQ*tWcy|viPL7&Jxr)@!)Rx|)ws@Tx!pHGEvy^d2xS zZNZ{w#n^n{v-*5W&0e|m*+j4v%EaNqKWG<{_dw(=VZ57fMuQ|z+w1l>Vb@Rd(*a*J z%F}sA^%zx_R(Dpyg)VeM#!xhfR}$Zw;xB%v(wn+0`u07BdO-ox-x!H}}*v+GVoRN}D(h(4hHp8&%JJo@+k^Ckqt<$HKj5ClOG1VK1f zDDWmL`1tNiaP6zpk(B5|g3pVO2Hk^yFWm_*zte^UciBZu;(Lm!K?#>&?WWuVo_VZz z%C(vb$Ke89fBp5?xN#%C|NeXT&716!lAfOK`i`?}3eSi)Z{8fAefAk1ee_XGnKH#) zb%p)O_k${$?)72C((f?u=Pj`4bi31fp-cO^B;frd!jrLU-2zOVzZ9VWP_I!3oPB0{ zDu)g;uoho@H4D3)WSrBlA3CJ^@zrNvU_+salY94pv0^HUGP~o9=4qJo)qmhSxj)+0 zqEV3%!u&6@kaFr-=+L-6>^(nY(&TIy4O*e$*6}!VR1!jSh9YAa^p_qq&;Dz~2OzSViXaGrAPBE1QF$#-{5OEZEyk6M61h;OuGu1kM?q2?140wDtzWeXXaDpYj>3uV0 zVI9q@sjy3T+0|6aCB_*Rm&H{Ba5-{e~;t*o>!uK&$<{kY9Ste?>pSn ztqw{-!4H`5+r%s(*v0mj+ zbfnrjxZ>KoF>}E$a8i;m@ZpgdIPDpHKUc}X{zPc6mi zv+u&=JI=vnd0)f6>P}4m+uv~7ORu3vY8d11zXnZ*t-`s>AHn5!et`R?{(>87&%_l^ z%)*!BobZQs-zHSoCpfkrugKm8OYDiL&5qD7`Q+2)mOXjDSYlAAMvUN3vv?T?hA`{?LuK`z;%HU1VIo4K@g4y zYy^vo5D0})5=g{|@h@Y|hFK^|s*eY+KNA}_ZbgAV4_|({7`tb@hCv_H#EPG$VfL+; zU}{bxf;rRiQPx^${IF*w@tfRKgri5?R0Kf~1VIqWN5#0Q@LC}X3bt*AlhzPv9@4u; z0tz<$0%SBnofHG>fB6}k^8%>Tsx9i2?na)Gfrhn{v17v;I7xL8*tr@-o=mi;p91H1 zx=vK6&$w{(h!__HK@bE%C?6Fi#u=5DCbX@+Zpf;x0~WiVDA05bDrsO|*n?jS$qR#6 z6wyuNkUmx^t{rj1elHd3GcE{%AP9mW2-N|bgmzgiZAVy$^PWSRJmR`lM@aBHB-rDk z+f76JRwP^@Li|XG7#9RV5ClOGgkyw=aX}CSK@bF?%E4|Os;VA$+kuGBcqJn~1VIpl^1=FvA9g(6 z^eNXXIXT&VqkWvcVqBA>w8z;7%iEZ1Om=kki+sT&~_x|ob-&$v{v$}il?&|99 z+VxaDJ6us-0v-kj1_%fUUP@9_83+jE4-gP=Hx$HI&6*~%<<}puld^;`Q1ukv@mB%N zTu4p`2&gU=_RSFds|;-~sp$j+gyQ_y1-xlS=ne$*StKPYr0TABmJRBUCxsibbzR9Z z_QOWcX06%w>z9eS)_iW$IJMfbcl=p#v0_pHOW*eAqk@8?Wzp2-QG0Q5v0fUq7<&K4 zJhacEp91-aA~8xJ;fb<`&GX5OgV(U*0^}fmv0UE-dxEjmiX|`ki z?;~4f?N7DP^Kw`p1A7X@uMuE9-xU0Y%*Ux4_Ej5epQX1ooj+<>CpwS_$piS}i71KN zpb3lUk?mf6;q-S0?)dRr21|_1G*h1{YIFBk+TM$W2fdn$razV|yOT%*K88}cHYYxq zyPH`rQw0q5Ho2F>S`w8#QiVI8MLr1=85c$d58rilE>~}9cF7qk{kmylMLRbR=iku? ziz)Wcb*IR>spK)P2B5m*gH59ZzV}e0viqI!CQDJ&4X%aRm_3BX43(y%g3BK5&r8NA zuje!IQ^z9)F;g&owD@UqaslchJR%Ws3F$WpMOfzpl3El{FEO@K$v&0ahI;Y|spO#5 z#K*GJ1tia_q8C2c69xT>K1XH!Y$0ZA+p^%_EaPex*x6&?G0e)fqGCMvP-* zqeZpN$7k)UN5$jU*|W1m<`xb0Gw*r1PSARyp6{!Qrw}+{-u8VkDNGO+F}xUikh(GP zn-PnBBME6}W0EnO+>L)*o-=nCdaVO^m}7iO`jQnuIhpQzX_H@nCh)QJJaT;aBSo`A zVyOP85MiRH9$AA6*VFK@0fwfcy;ZpH`xqLbg78W;7w?p^0nOxtCG`gsbxZqgtuXD1 zNPZNx7DY+hA`wDT7OGB9h#OkxJ{9hrV_%z9i31u^2?g0L2lx$5PPy|*LkD*3Iq?ue z2c8ep>Md~pK+Kz)4Riff@mKwn!jJ(g>4(R^#lLO~HIy-KB|7})p&ff)WE;Lt9i8tV z$vPdl0M6_oS5Yj2HMswDfN<#bRE&Lt%%X2R5^r$a+k#q2yhkKj4SDDGjpx6;-on>n z-_#5;^oEt_S;^{|q5g3NC;okzG}y|XYcle$fIDx3+^%O&WBTJMbPgBmT$wd~A(NRL zYqEq5Mnf=}$GFJdh9RAgXrOv@69DioM8h%mddUR%+nCCriK>V{ed15=8ybFd^R8g) zD-B?e{Wg${2D^hUVXYmgrwlL4XCE*MWXh>c>3(R2Sc^@h+=?R27OQBnJ+)&KFY^0} zwVU=wHX~d8#Ru3-*Sjs3Mte?<_)EFh4fyYJvaz#`mavVs8z4@u>-Cx+?z|jq5-Z`D zwh}0ZZWCgmuIDrPnk=0WTkf~0CbEUdpYpg|V(W>w*3Wf5=eOQ=JdXb?!E4&2S*2dr zO93J3$k!|zo?pxjg8Xg#-VAv>M|OuIk#TXYd0xa#^yx-P4G0^6ii!co>%~iqFLxvz zFpQMtAQ2}Cn7HANZ3ViohRvh~YFjy2^>5A2NX}rl2z&uS*$~u2zsb&lINa1TpCJvs zqf|DzYC~`w$D3`_(xpS_wcl-H2wC=e zUVKUHCWEwZ%9fjLVVCUI1N$%R7EjdciVb1T5SsA4fs?aYbnwXx@uxE!8fM%!xNTP2 z3DWn&f3~dnNuqGLUDqg=y`-q)_}c5g@@}og{IgR&_#K}QFZ;Brmdsub-5>6bz4Eid z9TLZaKi*&0Y`Wo_M}Dc7MNRVPleplh!&R_=C*KGRHl-#b9r?hDolrD9OZs=RN~b>( zOY*h`)pqJ`_xQEDJ3GBgH{vnDQ6GxhJ2(a(FG^*3y@7#dun+g5Q-}({Rg3_$S}ovZ z((8ssX0MvTRucY(``S?>2Qmq@I-Lg9PpOlh(;AH`tbp~+0KQl_!G-Uv)^li+Bh@J9 zTO=xiRo)zk9qf|5%?B$s5@vS=oviq^s=VAyzF?cYJ<-jHOW`Bah;+r?Y{RpdX4md} zA8{&;5K5@Xfu!C^NKha_q--1;N-<2)?ha2Fr*gjW=q1C{iOQu=H6jc(#toII$P<$ zG>Zg(f4OgH^M*WgDk@OFMC%s4UhN3podgY*QZa{3JUBz;hVLRlvwKo)#WuaY0_O2L zKt2#a2m6$h3pO+d%ah7k2#h&{{3AoZUf2V?whFU&D1bp*@(Qh}jyXVU^M_ovM-C!) z5#;6p{T$>W3MsCv%;G|2RZhc$L7w$-64uZW4&m7Jz{-{)?-r6m?@^nKjbuq5!W23PF4Rtw{H^54d$^kjg~5T zU#<$_`^i$3_3i!iOtmgg=CSd|uXFPTr$hNX3nnSM4}9_IRkG1^%1;`MN<@i8Z%n4H z0j;yPMV!!TOu?}`ZKnJog38tF9|z3D@N29i832h|?=p(^WKd5vnONHZh%?y9sK7rz z)GQ23)cOq?^T*z>jnay3Gj>+*4>_4VkkxFmDOSH#aA0w{*qr|$a}}VAl=mnEklrHL zjRXgHF?v4}**x8%tNnl)8a^I#AOhjEa}c7xnJ=s5fMGlGZ;kR8Wb_lGWR(QB!|Ny* ze(M9B@w;bR-{=x@HjX92lA)Lov)YHfyA%M*tI^vnL{>bMjom4%45*|m_Z0PWX+=}T zj8>kzwde9_Wx3%;iv@-fci+m(b>&4dzcJ%!66;>9YV?fsqhORwI-Q|r zp{|oGIqY5Y(Cv-Q^|Q~rlJ*2a7oqFJC4;&lXZz7?$9GItTUG?afRfs-?+O!7s;dd` zXZR~{9zXSDw^VBM_-r=X(NCAEUXNPbF7+~NKIvsr zXaj0;39I$m0tM>LTULAt9TTh_cVHvcLZ;n=Pk}d>yyawQFV|tS%d`92W!@Q`v~4+g zC^Smq<46V!{OsU7#16XZCWGYO9Fpy>jMT>GFzaDC@vKiOq;;b2{u5K~j{G zyIC{v?(ps>QJMKXN5a3+sVBoj}i?2l5e@6O|KDQc!)uyCT2kmAfaa}l`f)}gDh)wIj zMy47yZY8CGk^H1y^Lrqki<$QNS?*Oyn`}HGpx=*H!ho>Ef-3Fyc_`WadXQUfUPi$hONYBwb-nKOkK)}8}{EQ)ng*0*NN`UKGhy{_ex6XvlYZ5Ur-3PNgAfK z1Fo9y6a}#2#~1k0^FpcZuIJ80bqu;#m_*Ms+3{h4@?Oj80-Li-l6>5pty;J-)BXD9 z7pBAJ_EVu?a5TAsmVm!gw3>J{tBA5(y(*A`pE_&31qfR=$sNNIBC!U0^etoJ_wQzr z$>TnY#af~v4rDocSS$^qsD6wOn`L(^3)8fpn2MvWaO)uxrZ`}+;&G-~0eTxUJ3}Au zrL7;_5a@0qr#kdulru2cS#+GvqmT^xg!O<(3N#O9bnzUk#T|n%kuV?MGp!j&wt7?H zgmN}y?^BSIY0jAHZyQ5zUfzl+{#EaB#;ZSq^QQ<$180CY@k4L|W1-a{V1=tXc9plU*M%lyGg@hl)17PLXS6 zb}c@GGEcWP)<3@cCz5m#3ZLg45(SJvaFvNhhildO(P4wtBDJWvnBlfRFngw($*(MI z2K`QfvM08v?1tmpK;E2!LlI;&tNyV_Vkl^q0J&hZX_L@;0BYabBDzoHr(QwIr$i;k zLH=EefW76#E6?hJ+&v`w6CWV*{OL2D_afav;AxGA>tBd+IkC)@+0!{L-NY<4Q|#+# zla>t|`ukv{?*5s{Zi28>pAY-zLG1M>G;N5*Q_r*eXJ2hE2UJV?ryX>6fECwG{^I61 zJM2I6$@(M&+rjN#c&3Ud`4jk-EBM_CPS4KP^vnGQcOsixoA_*L#T=d;d1Nd!QO*Sa zSAtJOn6}+Z=o=EM!qol0J^8<}Q;RWrrJq8a(|>BRdLS|X{0A6KF$DSW=KcqK?YuGn zVaERbf2}pb?Djk2hO*-)VKJ}n4K7o$0k-CQCnqox5)zs4{{?Li#9Ji3{DjO8u|Ca- zpS~xt|LO1<$+8Q^a!3JM^5d0B;6Fg?P=&E<6!ZTi>Vc{NT#8Kn7ho})ICh^C|EKrc z)3~v=|3P~A-eWNT*M{^Yll^~_39cdjKS)TW^FKo%(U1NIPG;#t{f`1_0{zMo|0^%x zN>}Z_iqeP5{h#iLy+gA8dtZ~i(ErIx{gijkaqTps$F%ZK*r# zzZsAt)t*^?{(8$aK^Q7!Uu5*XwH-T#yuIpGzO$M|san13{e#VeY|tRk;|*2rk`(~8 zcI{U1*cYa@$mnp2pE(pOcIk!ev)U*IS$_C%zLx*}7I@itbNt}Nh1NP1*>bI_@jtS7 z3ovt~?)AXG{64Jp81U4&cMteoqqno#Hc6Sv#pGG@fn!+ZpABkIqZGdabZH*DjgLpi z_09-(SM?`k-34MNqlB0 z%mlXH-ye-@e?A1;>3t2upqDFlT7Mj0vca4g%TO@OEtvOxE#}|l`G5e)BtCq@7)^$G z@w2k&a3?rq(CHmo3(#2W!oqMV4|s(bo7N{b{%olKMnhG%lYyxANHcEZi&dlM)*GmT zan`yYj+;8Y`&I;db>$PG^j;xk4qhI;36XmXyKQ#+*)@t+Z*c2ESb3!K>r1qF8V$Lk zp`2S~KK(9FT=SI1fuMW7+MPP3o4ao&%nyYBp24l*U*OM|A=pfTlaj2LYnWPKyEdI9 z9AE~jmzx%g<=={@R*6==iITG&mS1NxJ{Fc(U_iG=Kl^n2G#yXDs&xkKm-U>$)qsSZ z>Z$XHgKBHWU<;u&Uo-R_jCP9kC(~4H_V1Vsk<5TcJ&Y2xl3x1kr(VEs8b0W)HChQ~ zve@jTGpp_hIhWx!KG=lJA0N6WWwIEDC%OO@Z?Xlr>Y8m6WSU_z89Za5e46`=$~r_H zhkb7mMt1!qYUi+w`VquVauo#E&DjQNtJNaoc^;CJMK`@^JF(D5t5Y7BobRwVv_=TEtcr6X<+a=o6^X6zA+SfNz* zs@e8?Bw8Nt5P9BA)W4OL^~vj)9tC@|1&f^oZKlU}sT-VgR&TNtcd{N?=t@<4v~BAC z>TWdD*c@kC83IIeYY9sR;|Sb=Q8WBP)1ALKzA-=~qlT3DxD^r`%Ml}s8#afJNp$kz z5p^tZ$#>1?BxtAOMSx1U=9N^QLkQIspky3NLNaBR?*B8Br_S$#;8^fV%!32GeR>7K zt_O3ur;s$`K?g92nG-qn7+X1bmIoi-BI%RmwI5UwIzpm9jMIF7NPec#h=E&Ew|IhCV;<)3j76$BNZeG&;4&!Cl-3x#{yt@{>GeDPBRTB)M?PV2Og}qdz5X@MJw#XEXnIg(&%g^@SN}+6@lrXe z;sdPS&36_r`uulT4+J2J<*+C{OgY~IeBohs4w?Z5iFFZ(TFQAOLLPRQ%Ovq)zjMQsp@#A|)WuFuC6KvGzc@gr6;e-wE47)tI@LZCS)Hn1rttXMG%>D8h!51RjC;`t!j!ABk| zZrW0xGpqll(afx4J3=-0M;OJ6MHXZG(`<(J^Dhay09a)e(3?`*^yF98P7=HrO%f+%Wf_9>Zgy9mfZH zPoAx#!?x%OQnDqHTT-{Ks2KkH(uE?|ZYBD(H85i3qCcTUnjlY;jel~Q669nlfoguw zgP?!7Nt0=C>;Jo9SJzwG7Z2m(%%9_J6Bz zjN|zjs$UyaFx!r&mNo;np;M$L&XW zFUpgB@GUV6yS)c6;)|dEh{$@I7a<}c|KRy)i@}s4*1im!UO@GxKA^S#sxB%Z%NRYTof{pZdg}?ukW$5>s_~4RwFw0 zB)21hzlGabVAJ*Xc2&mc2~@JkLQY+cAN2H@TKN2)z?^7&g~o(`?TZw1f$n!kD^hp4(pM@ zWH21*XG#izPM3D+o#d&xI@yQi?RLQ8@@~%ioJ%x9`_~17qaXESp(TV7h!@8CJ`E4M z${rMY4*1mzX+7)I0eOOmBLzw$lw~L%wpa+s%qqNC*z1pgzg?7g<`XL?wohLn+Q4k> zp(T74cuBDXk2`81a99D*&=z9?plQYAEdjUClrKlN^z7Ki#iPL;=!AZSXB9aF0P z3mcO>wvR3|-^cM7?4xr`^tr^mw+E6X8nGU;O0@VCtL`G)f+9_r(QF62S?{ob0)p_S zxqWV-H+{0}%EFMxd4=daKY?9c=;hPlthvkU`RK}|vJHH>3{{kxQ78wDFQa5&Fk|20 z&EpM7w0CTXZ?=5^;>q1caOdURJ~^YGO$^6`Aqg`aJ*k;($0G7?H*v}j|4SRFv=GI5 z0|svs5t00vHTgBuDX)}&$ci-cPPLYCDb07`xcAw)qwYFwgL`Y!kcB{a zhI>V;#U}hj1M4OC6AVD38DVf_7ERTE!m7p8gs`1Eg&mJ3VvIO7Bf}gYAm(BX8Z*^7 zm*o_R#Ou&u82zrD(^z5W7(Ra#&#woyjN1upE-QND&_WHINT*T_ZhS9{VK$9P;MZC3 zxkZnnqnBvHqY~{olRN&^wInE+335?wNvyLPvg@kM%dAQLglQdJJu|jW+;ewy2q>va6ApS4@CL;4L#H!>GKe62 zV~*5MPdS_fgg{>aUgcN*Xy$7CM2Uf{64>)x?GSA+7YJg_rilM0Sm<54606fo3u&FX zHP3eJreRp*3M^0N#v!8w#P%#7Vz3773?-VRdM(%-r({Ey!$+*cs!WL1kgawy5uV%B zhFGvHz|mCNP}UIp2Wxj&frvE8_A$D<#(bV^OcHyK*?OBjnmkuIsS^q~fgTUIOoq{D z=A007NwH&5{bB?^T&mrsM6>XI++g$e`{en!I|@dq>N9okxe-U<*&|j?4Fky#h1pnD z-3O=B67EoG&X!#?rw*SZ#8P3KQoe!KP3b_DQz}xCy+qkpVFb|z=o0hybw3XTOdHA=%YjgHWAh07lH_`)4{m%s$k}-!k>7QvzD~*XKZdGj zV7blDQRqYAiY@T%_jc$__O0~ZGd%WsM2uh}F^^v@mN^tBYY|TZdKk#d+ z2P}cnJLD~Q+bx?I(Zd7P%_m#2tdceHeUEYHnH2E}3_QXsgG@RX6r8!U2Yxq}WMKr2=e$t-GQ1e(9SyE+CXp zm887OeTF%&3HBl8cniA0$tS%&R$s4zLWCZvvHB>DL&D;}1z)ujW+Y-I`{jCduW_fU zKI_+Fr-6iwLwC_V_$7Cio4wEn&$Xujcav>E%A~gO$EFwixL-^!jW(m_f`zkX7l?pf zf=^Db%=m2OmfG6v^w8&-6%i1`0pJrGvZZ*HCvt+r6a~_X?Q$uW1ctp zz{~9Zhr}8i2?2;2&18X}B>ilw1=gSDM4 z;wLC8bpkmiUt9*nNzqhj30sM+NJ!6xoG|+}=e%SA z=DG2Lu!9l!vA8-g?s``>iVjn%O8r7b(}HYO?=t8 zj%*Gy)QXM%^`{vt*G!%lc&SaOA0(y(5A{fB$>sO6uI;d78VrMh=AF?}1AUyQW)+=k zMd7OFS)R7FzCQV&*!tJ#*2AhW@^5c5tp}o+lUovHg*R5`wi4_nAj$_7{#vFitF*g$ zw;}}r4PSvOrJ6Y5;#dqiahp!mMbAdxgI%PGK^_OQEAtz1N1+Q`N z29fmrc9lZ&;`cMPdZ2Jx&Ja5cQ+qRY_!hrwp~WXSrT9shy4{QyO6O2AfB5pMwEH+3 zFMR81qGlgNwiB#SiqP*=Eo~$N4`gbz1y`+JL!j_3uy@jPo8ZHj%nO_?*Y;z2|Jh*8 zXmzX0RPElMLm)I__Fb`9&#$u?D5M0E$>szE&UzVNLa$SR;lbunW5ISEYLfiNw>;wT z{8McTC2Z@wkt>0rJzLTcqd%>NrP>wr5Da{wrKzDaKh7{_qaCdG+-do94Nex{fCfBc z`xf{`>W;Tvqi`D0nDXE8qp%tw;;kf5vXaymbe*lYkQRSA56N9S2$GRMT1R`{pXTlR zqr3aL01z=MTf-7%yna6JCWc*c#>7lk{Iq!w_-Q4wUf_ep@cCGufh`j97-EZ&}XXj_gE>55) z?4^+@RVDLr(P8fXQ??oTLhsyI?RW1b;EpJz!~QZ@Gu6;19O*!6I1QKIovk%d;c?kT zN4jB&>0RBMaTl#P1hYNqYIn*PTIg-?WNg(TyTt7p;K}LIHVRO1Tr9#x6i6f$BU0>` zAOwVZ*wK~Ben4hDECDY;Vr|xQtUew|`qV?qyZ7{PlD*CPvQ{s_j!f5xormDpzGooD zFr3C}xtta_&euUTJtsm9PUraTP%Cm9~CcJTptVzopB!r6pTZJU8~zNh3lLd+93>w<-IGFNb^YyqT<&bg2VpJzqzZ}EgX!BK=qQd7ea~=Va$NMF$_K*&xh!zAE}!ejtrf`SghLSY zgr?xPE-5Atr=@cm-w%)<5#I|2<~D=ugZNw`d;r87N1os7;1PHcjsGGZ+!6`_Er$l= z_lto0`T2dkN(t!e>l2fci$BpGqzV^h0fIBh*Xp8SowQ+xtfo*V`%-_yo{PUxWw=FI z(8{hq3bT&Pvne?2$cDwvG?;+ybWi>;er)dNMl|yzR;5{yzCyL#GHli$6WLbF6J2rW zuki8;&I<~K+Tf-~Eq0@#pXd<3$ngs9TpWh(Gk=AB=CMVkeK{4TlHk}eXe2r#RQaCf zNUj_qGDz7-6{pKdNDejY zyj&#!KrnUQ_R@Akz(npw|B56p(O#0KJ)d z2>VT|+JqnQ^VKalxX1`EcR>iN?U*UOQn=!61t9Z>*vOnC&mb05cp*qkI0DTUAUJla z{T3sK6w#vfEhC6P89S;ZSPlLFN<|A3qc}Gv|7`>F*M2D#Smp(k9~l+tI!D|H<~Sg* zXc$JR4ly`HZaCbKuNfXgYpRnPOgD{OwVX$+agDFEo6!V!Tmi%=7B)HJ9y7XN+!ee18? z5ee2x4uP$kAldbgWAK9g1&sbat4r*^(zV~DNGIZJn96~jYm3Z`enEx>j|pG~_k`I^ zmoyy5Af)H*YLy(-vf^w&ZoaQ3YSi(O;N)=1Vs!iiW!RtACtN3tFWRy^5?hLBmA6=eN@tff{>j)y`+DSnjQlVl$vOS9U7flx2bx`9TWbV{7v^7qj;xI3E!$tC{8 zSL7rq{i8*9#<%#x)ueBcwD8Wt5~X7D zO(P-?=3L4_Yqk{Cq5B78l9j52NGEvikQ~%_7OWSsR3a@Dt8Y1R|}8!F3BkI zkughzD;Vv@*A-z%gD1z+c@yct?>r)%if`XB?rbn1Or%2CbS^L{y0D_ zQ2ksir{Vxxj1D;&HB$Z=R@G^0r5?JUOi0V@N)VSSE2hYG%|hlN6M{}Kr)2itX+lSoAwK7Z4T;g*X4d|w!FW-_6N z+!jPQz#trO_HA5QA6@1RArkz!;Q*2*gjScFtbTBAaWE`72)Dqo>jkU!4;Y*{D$J5) zOohk|iOT*aW1DG6U^U{k52;v)v*5yO#SEO^-75NA|b(p3S<6Dc58C%6v|eVnqtlRUb<9Ib*`#SUdYavSe22=^=?E{^#U ztQ>MXE*Y^}q|4-Y(XkII+X1BpOdjN{Uhm`}cs*QD=QBc&C*TG?a8fAp8>T7VB5J4;*w zh-RUvVUtX7A&$UPWM-Aw-mF(cnS#&@md(;O*= zNbt^HnxX`gyAEbD(Y(gprbDM$n?r&qor6aS^iT@_V8|jrIG)FRNf8zm! z@F)|o`dy23XBQ}aA_6O@QI+hfj3TSSw7=T$d|T6-J?3IF-0~c@52;e5Z&T%JlmSXN zF-QDlNfj%{}dY+|q6J^-jLN920lBpAP~ z!4s+KsHQiViDeCGoD9>Tuze|l{UXg{2O>v*GaNMg#(2Ye_J-~ZgrYixPz#!pz8DCiOT-RB|v<*hOzgr@}eB<&(s zk^q|`;CO>nxOC=&!4%uI+Q(i8n_Ld0sT(XDyq?orw!t*I+Ai=`Lm6nNmQHx90Ksid|UgA??fLq=Aplm+lh4!B%kAr z8WcInE4M_F2{)`V7+Zb(I9>3BT?m6>*m&|zUOJXLZh>$PTub_vM_kS3u`+RV7B`&y{*^7am)zWwg+n=5@v9m%5nRKhfO9a1HV@ z{d8^-Pd$6oN@Pu%+b zl}@ih2HRG!f{=9i?=CZ-<#5@AN?dJc%%_lp`PTe@nQ9wtmPgx{FTkt_xK}I|#sP7|UeJo@iwq$SC&p8%BShp5yr>lXrkzEftW6rk4g$Ochs9lp@{(fV zj~ry)A9*59PBz-G7*={^-)d?VW+pZL)9Mw$VyTi(EypM3WMG)s-cY^qd>)r3W-~}> zZu9bIEz>MF6M?QXZ9ZxLc0vOePDi%*B7!pSDZSUuNpYXWOf9aO?P{cORR?JunwF?g z;A4NW($Q=MHcl1dP%u5XV!ajBx*i8ym*?YPf6yb5`iPOxR@w7q?X2Lhn;`(TOvIPgoM=C#)FxZojNN-)spF_uH%CBDjt3*1H6`J1OzU{yHc2VVTFj#dy|xV1Q2?`+GLz5_Bb<9;4u?6)&D87}=(wN9YBZp9 zg)a8?X1L6>8S^yawQ5A!IYhErbe+Uo9DKzVKh>A-LZYgO3Fq@6j3g`VeGzQPC;txA z>#ybsLh9S02%Ssne0o!@|7^Kj|FAu@v zKsL1|4Xw>XQoj~T#xEc{?0i5)FbXD;eN*O?VR5|HfJeUaKm`sRyr@;L#RNhpbC;{t zKuc0*BYERPCgvpap(Y;z?kf$FpHcMvQ}`~q{)7cO9-bSW z_V`Yqy0Bj?66{$eaZau^*C`}tRl+`dg-je~6a$kP?Rz{ zsJojyj5t!w)y7>LTj7ZpjkG^n%VnC{ir7A-Q8?73i%gl#vBjL(X980)KT~V4%pD_C zXpDvB5Q=G^$Cn zDI0a|#esqkJhgc%_iSBIfkvoMM(k>fJ?j=na3+J5RZ0B`}qh7OF7%ww04<-Jbs#W6?^X zRv@-jXQ4(GGzqxfyAqDYQDMBhax83Ed4tKpPX{d8{W1~{?Pte@{))Ua-J7}6;%W|= z{gtxJ`lL2KbP)Q8?fpt)kb*U*JiN2b{gVax@cJT6CjZ5*^M%%l`iDzMygYvKzZ5$t zE-$+=voCA#&m)|lj5hPE|I2?10TK((fFDkt%mx>?4AP!b@b{?{t5_7S`rx>L?%%Qh zupC5GTH(L>J6o|88p|K?0LtmKPrPNipX+~F|8++<_`^5ZZ23nO`nSIZdG_@UNx|i@ z!`1(*k+X;NZ_%dwApaiqkOL5Y^ZA%7eG24Nb&~i);I*X5&0mZ7vk>?5n(*^lzhD22 z?YV^LO;D&>m3rsw4339~=O0$1FFQ;!#KXe_w6E4^&r1$5>VQR(z>go|WpZhl$0bh_ zahQ?^C3@--b`l-JSDfp)5$Z!!`W0hz$o`M@MJ-=;#T641jZup|_taw;4g9 z=AmfiT)mDh`O@l?xuWG_n1=%*-wB%7^NEX6gExQDc?W?S07rVLW4z<7N)rO0OeO!b zHn*z_-xEzT9Ddqp6GkCjhrW%5O!HS>NyKZWK)sS*$_(70nA#)g>Oqz;Ac$Q0Hm5k2LR7)BTO-;Z+mW>Mutzw5RKw7-ZZq4zsiqhQZ?cqhw zg58XiN7A17Z-SIa@y}D!LP(rcy3nL-j_rwfA5P~tD668Fz#2cseo`YbVA@n@C|DTM z`07A4TfmkRqWjD=1rZE}2qmx2R`2QJ7a#EeR>&F=z=SfL%QxWEgJjXDh0-c0YC@JD z^nNw5_l+cq%q)7x{bd0(Z&nQ@`|=0rnO0S-J7^29Zk^vF0Uoyx%nCvDKv!gxB|qE53uW*K7SbP)eV-jfp(^rgTFm*IThA|= zW*4voCS@h_pQ_)GJ|};KP5dc3y?w4Cd^h=pM%PLSJr_si%f|D*V-0rl`JF?i4^BNooJ?Qe zE`-0_pGLC$v0kba`dTR_<6$_~AM03|?6&;}lbN=}{J^?Js*b?1HF$k(=6N%vh1l2t z<)EJ>=Jt21ETc9oa5k>NlkE+;H|Gn`0QGsM4W^_!^@2Ru>LYdH7nO>YsBxaJkLt40G23c!i5Z$oCcMwpHF<%QIF`kOhsP_deez1z> zkBkXlo4&x-gtV2I9C&f5aM*XCJi}LQZ84|EAoPH~9Kl2mggVn|2IE28>YEITti2j_ zYF8RIavX=js&%J1kUs|$^Rdr#jRbZ-JLMZ4<}J4w(`l*MMKutE;d>$Qv}1m;lBW)zr@qnHgiFiHMo|u~z`0+nw>g}zektJ%>+3tZfjDB3?c-yr z7gI0022E#nmTOB%)rQQF3_jr`f@`Yp(xqZNuE>e;%gsT`hp|rP@_Q32PEa!y1_~UQ z;FYa@`;@}Y((Zaa{>GSgBIc=3I5KEcxdIX6Equfj*OT-|Ry;f!`CHq&;i#M*A24sm zrFbW9u_j;ivcoN~j(iAr2vY0KbrTc=L$6eAI>wA+#fOV;WTSuLXjJVRdHa?D9kZTG zj~VvEY(m3WI_CPU;$?y$4%f2dk_P6^=Qn#=WX-tW~J|3Ku8SnNHELn%0< z9T*(TjN_X9p7etWN5!mKRBF%k%nuK0QX5$QnZ&8|H`^J%1KbG5brQd`;( zuT%@jT4a)Avm{^x^lZn=o4L4$HrRN)#PIq=chocJW3x8S!2AP^F$7G|JQv?`9XN69 z7rS-p$1ty8Ze0hH(Xo6xA>BxpmXZaRCoC&9R|1A*SQ)Ch!R?J6XNwtO;1-_X<6@ph zk0IA^G+}JQ@wq`gOs$qI*_F$vZWlhYrHb)jVHws;6Sb<+EK<^gd$Sj<8bEz0z9_NI zYLYpa@FE-^*b#@3^QS{iI@)i%J4)03T*wRK&#ax=q?2GNRC1&Da9k{{Z=}vf1%JJG z4xi10rp&N@thWY8CsXfS?F<|(*O6k-YWV-yXg6G{)U;S_q+&Mx73^}l6wctmY{+l7 z$*UCS=eYvYp-*WL6Dew7&nPS`jD&&~JjxmQq@f~Yr1SVjM2$%o4I!72r@03~`MnV* z#yx$faL&;AHic5NjXi_IHUz_^;-|=K-O*eDI1Yz(IQMsI#KccA=YK*|sylQ~I4l4JXfbgYjb@@i^Az_cjhE5bAg4&4^4?+)&y|-0 z3jS)7&}lQB1KVKKs692V*O}C=cAj#d6&%?PErwJuJZojQ!cM_NL}$9F-Kc6i*yegC z#evl6F8K>f=1Src6mN$+_)TSUoX&s^o#IN_5aaH)znIm+fDIF=Je=6|tburu+RoTL z&!}E?rwNst$WYXn!@+|JWfOwE+fu}mbQ92)zhomWKjMeqgIL!=m147&6K`~}t8{Jm zUt}8oKzh+F=VXJ1jZ}JFlp#)S(y5dJ)lx+v@ATWLY@Ynw)>cl3^QZmsRELuVs<-PA zLM%Q{)|ZEKSPBY?+38RVJl$(&ORqx7OlU60|Hsrj##R1>ecO|5+qP|+lkEwU?RKu6 zt%;LsXWO=GGA2%T-TklY{yfk9a=%+!>s-Hc9mn@P5FKtDo3lJrXyvut%?A#>3BNmw zXjpf~Mv6i7VCvObjx&9p8K1+1O~$C)dnBC6YB^@K zx&~p+e=oBe++k8Ij$kDeez;UL(u#%3=?CQhsydH-!ZkTPRuE72x{!|iRxD)oMB?NF z05l9NgiqOK@oZIk6L!e~OpG{i3Qy9LId6M|FWL+HabOz9YE(|Jp(HT2kuG=lkVu}o zonDXpI;$p?E}1fT$d*iq3C`sKN(~_lZR#!tXXILE%Bt0xHtzRS`~FR^9Ii1vh4M=> z1QKcp`5q~Tw&SQtBs`=qUkaJ3A3lu0LFFcr-LgaPY3iBNmH=+ixPZ7d=u242AJroa zvou-_SeDrw8;WB-*Gt9A3zp{14nb2khfl-Foncrlkwe0>j2mJYo~e1gTUlCz+hqg0 z9{5%!Y|w7QHDK}EH|Zkb3%l2%R7u9{uJxxNJiRQ?O?@)7P9vdav%sjDs{|0yYrz?hLrVG?60WEpTm;mFu z7i5hXj`TMQGX&X37ypiA8D*CRxtB*%3`Zf~Z7teK9da=3`^xX3sf!?_Jztg{e1`=hOg2!+n_K(>zbprcM zU(8o66sfUx3bGj;3~zB1v&+Qf432t+OG&)lvS`We7b!OP0p}bcAB3pr6qy=KdCh8V zG#T#dzF>%zS(7)#r>b+HrEk3XORuRDi@-OkWL;EjVmXL!a$dvIGQBp5gKf#(U}sn@-Ko&06#CFnI_@4?VgpE(s5 z7-cn;Wx7=HJrW4Svc~u$K^@Vs9u3ySzUwl^)GAU=E?#&Ca`hP5EeOnC0Pw@EZNj(R zVo5Ees<0MTQJ6u(Nao>&<@l@You+D>CtTWYWN{6Vrj{K4z`!G2S!xqqE! zTGq4Td?QOk^NPxfau?eY&!wy)8U{)pdQ775OeB7N(*n zh7*1($I_vqTLI@a3i%u|W`k^FYJSXC{rt{LU+DBQNOi!h1}1lY*y?e_ zs*Y0;qB$+UDc}l^>@80Uh{4CM{MM!pjKsll5}<{mPZ|H}-Ga0S%^qt8WOFLXqp9Ni zYu>F*K4o+*8lEI_J9s(s(ytXqqg|dC#PO~PD?M^CJU!5I8VY~B?3r zt^qsWat6%aT6tgDSso%4cc65_6>+p40}-l=^S5y-CFBlfJ0}ZuU$(!I=_^j>WU9X@ z4TY3Q5HSN-|7$wrIPO+LwIQYIy?PweHmIqjb2cC8K{Tl&$E+!)>)|OvQ&`Y*twm`} zAI!*pR2}>dm97p!WK^O!xDJ41K!k><3PH35X1#H6C@4V0$gwwURYNwYVeVhEs?{Xv zo3O6eRJ!G^sCyyY($EfW)k4PTZhp+#ve!c$sKQ#|PN^F;;&1TKLDGqk!0R^uG%(+2 z3T3jKYrvtVV+OWX7a(diz(FTx-V}t$OIw<(cxHxdVzJiqllmfUG|bvUKZm3WwNZ6E z34-1lh~WPL~j>^_uF}WCyQmZW3|hBhL2=-6NMX?Xl6% zuZ`W@5DS6RxSdYW>YJGnh|~5sX%-p2G!#}W=P)o5oU80|xpNPri{dy}Wwh<8@;~Yb zG$@C_CG4X3LyGYG~vqH3{#5x~CUZYz%v%AcV6k3<+X{vSX-jD09Q zmfrBXY7-z_nE8V=ujjF#R*g<9m4f!}Ik2HDTTa2uFlOxRC|{R2)hjVp(E!p;Yet4& z<}Y+|p{!k1_AH`l0hz3JK8^A(zKA7;G?THUlGRRgk)!)^LZy0s!NhQJ&_acIlXjGWt zRnl}HLaaOe=Zob&7yd8B{a*t?aQpeMA2h}xb@Jbf_^Fe@TfYA~WM9Yk|4NkbHq-xS z>=I6IOFr;e{lBjx{$K36FD=+r?1Sa_xoZPOW-C6~{fvHQv9$(#C%onAx4Y80%L?qb`n)*LT|rUWXq0K-PX+z8 zVl?p!K0@-{nc}%v_}MoY$K*U7(;rB~!-FIagl3wpGl$`{`vX1^*V)+Sm(>J;Z*r=} zvN6Ylev3)8jx1Gnk$~nC2(yl&VMBa6hN&idDcHeKLOwZ!jGExT8P50>DicZS4i@iBRG?Wz9y zxcpcW@bo& z=sX3!BBY@0N*f14@xAL7W{#fVH0kdje?5hh+HZTHvNcPDFH>Q`A57bPeK4t55s&BL z(;lPGuXk+_v84}&M@X81KO5e_^AdZTNETrMj$pY)5O%chW+*}VGl=j%=gOEStv;#~ z#;E4ZUj6;{sZC4Rcb-oDVO42+y!z6UNy6UtlZF2nm22(&jWTRKK>INN*-ANl$TkCV zm_Xux{t!>m;7i@6l<&r_ASp>awWct_m3?~OCl7D>1rPHZS!Sfh{NK3!<9F|bF)UU3 zgF+pI059m*>8`inLIY?4U!+Tiy!hp6-`yPTa}nn8LwP1fv`5xLf0)UaTj-Fy&A~Qb z$AElVnz@R_-G3EI{~G<2JBMG_5Nl^%p4&hVNUgr$5zM{;YAFnw=S30fc_?amT|GQA z=LQ-9#>R!t7(YpPLl#Qo_fL~en8$n2jP!fRzFN}Aapx4`E{z#~kXk&?(JoLF9b%G} z&WbdF{HuOh<(h3?;PfX4Uv?f`sbg{lskn-gQ~|vETvY(lfsGI(;4Eo10F|s=N@Oz} z+VFRb6&y$Nc~?*)ltQpS%o4M{J7We9;!kMf^X)+R^Vf=yPxrzY{qKXZkzML>vh zMEAM+0168QeH2e&R8f~yY~^X@!Zl_ItduGAn2AU8a@7dcx?!6+Vpy4lx2Augini@^ zV<+JKydCze@>-QKH>tL!&p&<$-yY1Pl^GU5<8zk9WGTIL@(?J~LwIjwJ54c#H3uM7}4lG0N5qt5+kca!V#KPVwP$;cl9>H&aD!r>$HnG@ms=hONI zLHTR>4~*tqam$Du0fIS?dm==Vd7`z=MpO&9TNQ7!-R)+GEdctmz{D-hDQUOSs%XE} zbs`BI-?x=VaXjMWoNFK9(R^_(Txt>o*H6SO{xcaA#~u-*b9i;de-|A`~$Sh_rAW% z-qaR8+;{nW+nDLZbQkM)QunWaDCvP`5WEtR$_asXvrRib^m|gXeHGcIFd>T3f4NhTW?m0$r>*aH=FmpuKj=Mc`I? z&1pCNMYzwmBC36n&9@Kw%Jk`wxPS684STwrFXCvbijNv;V6Pom%mIC@4&( z*DXvOEuzEoS7Id=K#x=6_q0C9aa(Iq&atnOREV)1)yr$dlICUpWsPzVEHbanS!t-7sFg5|Rm=jKnRLmY}fz{lJs#f6dZj^TZ^Fx$LfU+X? z4&@oSQ4NvPcUaipJrlAgp7&%0%HSOfLMEg`7&2eB(V9l|3)8vujvNJp5S*hiKkcz3 zcsArG`-a<-ZnQODCQ+HOo@^}2EqSoYO~k z;9ErC&Ow0$Z{rWR=wi)2at*Pc(Sw!Rd9c<+aAo<qgW zBiQAUy?+N_869W%f1aQhOv1K^El81K-!WdI9tsL}69o7r7zX=SZn?zGCoxgB4(M2p z%6KqaSP;SC;#xetJmTPI=gQ=8@IvwvXa@%elX}fVW}`DkabYPbFD|%dleQyCNjiOq zL_IX2>3EUmmu7`FVmzv;`vydC9l;?`t*O}L6 z$+?Xos(Vw|AHH+CtZHN)gyVYkJOC0;jY&&Nl7WO@dc3jw>!g218GzA##JPF z5jnFo<_$U3ON-j6l7*4kC@(FBX)9*5|G`D0OGRf%%1P#HGINJLG2<}$5l&xrMTbx+ zkXwekIcezc9KYiSkU4`IG$dH@Z4hn5dlg6qbs_6|DjM-OH@GnX))yr&v7w2Q84QN2 zf1Z5ENjbGJ#at>DS}aRrs@TQWbQey{_DtAi2DVuc;oDa-$lvJ#7d=uaka8m)XL4jJ zs)iED4e^WJnj~z3c#OQEMTenHQ%G{>B4GmqL(i%}E2FdyEMBit;&v)~TNa^eI26l$ zzRzf9hg_ZD1B2#FZeI6ah_uALrpy&|5POA!-Hy`ct&@1LIG+ zj&MraaNfE$JUMwo79Gi=be_79Oo+hR+qn-SCXR}Th^y3ib*!2|zHO>Uh2?*9^DQm(2H1Wq7+SQKM+2;(_nRB^JbW^ZJ z6d?$*(quidjC`I<)XOs!|5e5JkijNB!0bj~p+hMj=MF;Q2jVJSwb`$`Qjhwg+f$-q zp(<(pTm^6Q75pYGg~L*kC5jHc7}J3}x44NRc6hhx@u~I}%S9>4kc#K7<~No88f$Kf zV;=D$&i&Q-L|l$`7<%L$0D{c%?%rh=?RsI?0ht3{ihJDP^-5i{jF(%HB~3?{5HaC8 z;;V~);(+c=7FD%?eACIdtr7?~i@uiuG80{#oFwR<(cAl*))#)uv+RuS_}paSjm#*0D+YD6?DNgg)SuPXRTVf3jy1CQ-(g%*0(%nB&Qv$OFb5$y6bso7JF<%gv z)|R=y85DNC4T^364e6(h^!CR8zkCSUHwfI1gyT7%%Kad8YAD$Xf=uFBXS>PycjG5tD^lUcQ>3Bc^;i+ zVT0W;Eva#{ou?9B|07r*&T|+QzAeyU?QEBaBR(acnB8%t_G7bo?*X5VZ~&(CPkxmU z1-+NwntK19ZiLX;T0nkt^7a|4$W0?j9l1hVPk_0e00zP>ArvYGkN%hYn7LwgiX4PG zal40+)j3TRJFOz?__;3xs$ef=8)lY|MFZ0OJ*O>$yB_EC(NMXN3AP#`eIWlD!TH>l zwdN{2gqUL3%;Ks!!{Y{yS+OdjZ$wTr%vij;6Umh9+Bx8!c5>SlQ(}W_Xfu_7wdxG_ zX|8GPcGCwjhaF~O7}z_?lrGn}o_3cA!YDM}e?xNI}KBbWV@5gLolkO z{?!EYKKRg1t3YOk?H`v0?{zz4>F=n%RlUQx`cHfN4NsJIp5rn)tPPHi zjQ+SVpUE6*Rgwsk+aT8|iycTw0hWujmx0v;2|88KcG zi(*&B_QC~RXkwn)ou*$r9|n9x5?POZyDMr=g<^*#O6F`ouH`3Bwg_T=LMNXjGn4LV z0AP*n^@JfRSE@&Lnu(k;q}NM-H;Nw~Nr2pj#2YI%;8Z3#LG5i|?snXLIap^-z|cCk zu5?wkUp@gQ+^3%Su}c#p1!s{$lsOV?fty~F+5FH<{4-&qX16y-Y9~Tgg5mCVQRO3f z>bbTc4?l(2JOPBkZh&;qSs#s@muL*YZ4NsMVru6pgi{bV+GzUshxxkT8 zq%t2W%VTX3FV?|4`)y1}0(U=AFlvAB_Mll+67o$fi^Uvmf$mR`Q^PCM&-WadvTY_S=))W~Q-nGHmX?@242H2B?*|U?ThB<2%~Y;L*=Uhv%EgUmOz9(JV(}v@Qg%Q%R(sqQI;60 zLK_6|`UrnatFS{K-(0)DEm z=T{2NesHsfOR_C!UT+DfEjGkdi=kHrITbC!?7QOt_w(yAHIhVzIu@itr#v1fWS{fd zPQf?uJ(dR?9tl_HjIndx3(L-qih@O5c}z@=Oeo)pB)!iRx9X4%9Zm??Mn%Gh%4D)! z3|Z^_%-qWKp~762hc0;ee%j{&MuyLAwmR9=p^17cAZB*Y3x|f>Ij#p$9RpFbl|_cv zKOhq7Rg^$-vg+{G+No#6UzP>a)G^eTJDibSMV`lo?@Qx`m?V$F+F%5+R>v2cSfghA>2#Vt zKw%Vb7h+!6Yk@2~RMK&IR9!NTi7f*UqmD0}C(l$^1Q(B9i%n$lhcD=5l%Y(dX<9E| zta**t-4{5ViPB&6W7!ePh~ zVw2YLQ>p z&D~jqF2^fbX%YGl`o`hHu?5z4cWy$VFHme{s^3m3pwadZs+?ep`Gqq}`FZmgddwWM zJB(sK=;J%6c|wOb)iz42ntq?E#FcUxc`8d&ye%BSR^#i=NKyy(T-lQUhBF*Ihw&G` zB3NO*6Su(zyu!*$8PF3`wglqCUv?X+ic3bb(jqe-^3W0V=9g|BjV+4!xjP)a3p*wN znT0{9hKaa{uXp@IwEPf$er$ve*>Ih?qDed1b$GyL32X!={kN9g8DkkpXcA7x@xYfdY z=Mc5Wl?v7x1`T?~?XwlK1s-@{R?dMttmE`vnqpj&D?_YkhOx%2*GVILR=}L#+PwF%sk`=y@m_4Mq&Q|>0v*9Myk~xhK!x`Wm=SZ$= zZ`ENFp*CdPLre<7o|Kl9k|ejjz>ef^!;Tj>yWZIW&w-Ejb@T`^ogY!>E55%3()<#u zjC3!XwZyo)eBL>5hsOyqclI7oHHbvS7N}Lji5NY>UA&ryQNwv8r*_sWR?5b%WpNbS z*~U7sxje0dPoT?Zx-WvSQC#9ub2M&9TUIDj$55AJXXD%rb{ zBq0KG_Ep?CE*goEbE$n zv7fsZEvYwJbX=gE8;^Suqx$~Pnz4hRpLX&4H`hhDY8p{&$sQDpl#wrOVDVR*GBwzM zS&)efKMfS*%S!@r!&(br$Zv1L>)8optO*SXT%=jvxiT3?QVL*F)o=^IDO}8v()Y)1 zXOuMCrChOE*Zdze`uf1XB*@iN=$<4n1-DgEqeV@ovXiBEzV?$GprC<~~9(a5xtg}u$D2pz#IVrXCm zvRxJ0rQDB3Ny>=~EM{nkKTqBoi_-L05(jo1i1#<`8hMzYmKNVne$u?L2U&XIU64!- zWfYoSeed)bR+J7K@DD5oI~gB=YWr`oaa@%$gcS+B9@kdSC7fy+lnqrN3_1?|-|Lv)Ou(v}SInDv%}zLks(~$Mrp8F-F}+DR`c< zTL31qk0ZIu5*Q(T`Q;pPMZbKz+*Nd_pekB44p`Miztf`}ZTl2n#JMKV`8x9h#8W>*(u-sy&ZXCe>0Q+y zS;te-2=o(~1scT`+@bp*APeJGcDML*oafh*|md z4FJAL6zH~~V^7C{a#fDIA1OH43;LFdXd1bhC&UA>n!5Jf%lJpYZw=^uEF=RmYOuG~ zJQ15F*!n7BhYvz6#NP>!2F#6BBxmI+3te>NMmwky(*i4qa`TZ7u*Q zLp#3r!dnYfWvUJEmxOCb4trTn?kN;<=o=J{Kp{@fpu79~qFn$o%9W5rrjfZCUy+bm z*;KJcO0Kzw?BokWtW&Wd1vPFr8}&(ukn_e2l)3d|C`VI~>-fQ z_uFiuv;g}~@iDL@`X!ov4Biy^&2SD?trcnXyEPvgP;E)Le8HwK;LyZ!iU zYeF#5nrE@}S27B#rcbTTu);mi7$YjZr=@GoZ+Du!49OBT1=f5Itz!S>I!&4SbrbER}1opv@4TRu5f$(RKQ-cHF zG1#ovoF4*6jvW)GkXC=8=^Vf*-W6t}|7hr^3$Ad3x{?{`T8l|@(~whojCQUK>Y@}} zPWG5g&4CnlKP_M>KT``NmJ+ueMaZXgZ*g%mWl_2e1a*8dE!3+PtEaKR=7)LK!`|7+*?gbh%3ADU#=PCkDoOgC=LbPP9}h-aZPD zkTR%S%511c=Sn}?M5(2-heR_dCCV3T#XqC+JW+NK$uVeM_IMQs9XJ2+l zXHd{u0zYD-^*w8nSlelaj%}U~OB8w~clD8<>E^f^eC>}|t8Ob~67*Jh(*x}0{e94T z?lUiO8X8{`B$;>Oky#tPg(94;Uz@#7nef#453^HoRTz?QzJSA}zY?%xi3rMC5WvJg zB+~UDc^JGmhpR^ykbO2)kwc;scg0bT&SiL1|6aNC`b4Jq^M@%McY$U0!^wIL(L8kl z7-7?{zRs@#M0Ns(iI_xalChg^rAma7)R9!m*navKHCjtA?`u>|s*WO=+aua6dgM83 z{3q2H>X!)<|0SE_@EkdR&=n$q{mH+@4V}gV?=*Fqi7$_Hm^ZjI_Y;O!U!|Qo=mLUty#xZm}9AP5J7uycv^g?}oqs7;$T*+{S9)ol7Rb~jK?58(5Et;123`qs2i9`Lv{+uYg z8j4b)OZ;C8I#kbTxxUP;;3OZVniLFxp4t81eOwfrH1Fg7OJ*^_8Pay}6V27SkiQ~9E^P&=s)-DQvI_{x%IQ*V8BqV3UgZ>4L} z1zAm(KtLD=PT|r#fL00oFgxmDct=h{tyYfZgyej%P~dWvqbFi2abS1QoQ$e$p1UoGX&%*m;4hA+*8~k~Di8v4GXxKz&R%>qf~)g(Zcv%|CffLjiP^ z()<2G1YuUY1+(3xwb2XQu-)9#Ju!Q;P|EU9I}Z5*<&8wv33&6}U^&@pp5BT@Q6i_W zgST?%d^hH4D$R9D7ZJbKWM~lw%s{ECg*omj zHa}&?g)C(a-a52h4g3jb0RMXWL=dsJI@$9i0j>rYSKcKaa9jwvP$#OG)!HF^OJhTV zb;$Jfu3N`_h=jT#0?Q6tqN|h$zGecxhl65OKbsQ#0JJh__Vc)p*A7-xu^3+oW>PBs zMhnrl0e(wMSqd88>v?NCSZn}?OjI_G>=vhRnMAJ6(+^_v#hjg*dn#^gpTDgyA>pXbNd@jh!3*uzRrS3WkU#1jE+T=RmM2DH^ z=Xq8nT;&Xzd@=%o#|+?kl)TD27bDp>1sevI+=c4gE$?K#8l|(SAzx~r)60Q2x^8QH zZ|(!?X@Q4?`kpp!3Zvb0tLYoQg=KF&l}6&4E?mQR=|f=uqDPUM*@sJt3;8wXMGT&V z@9sDOdR{rh&QraZSEr}&$K8y=b&AAlasw`}DRl_l=NQ97U$hp!8=)V`?aE^WQPc?! z&Pu^!h#}>h1?`$Uc2A)Fb#%vcM@nvqrMQ|8vft@qssXhXXQ8{XjV$_8lHmTD# zB;tAi4E}esyI-tCOZ7D2!Ae*YDT~%dCZg#~xSh`Em&(7wt?{W0>X)UMRw_?;%^8re zF=>|rz@?XF#2~O6S|!Ev`&1vhDbRj8iw-ZACsruxAKb3Pf2u>wHcPskzZg*yt_gW4{6;hZlj`sQU>h*&dT2f9L7%i0TMJxZ%SD zn1)V<+jhNeps9>VuE_cGgPYFgy|J^pxS?DWk@W3#L zpBj#fG{fDfqr6n@geg=oRg8Gk5okyF=p+Kq_1Ci36Cub#xK(pL2V1OKMD-|OQ8Rxb z#B}!p$X!quo<>uRzP#|hC}zaZ%5uyv;)Z&=15en-2oTadi(J3cz?q?kdB_tT-Py(X z#}my4{xK-_?u6avHj>IQ7pvN4CmNg5)HdTNH@)wPt9c(G8@G)|EZ2xqNM-lU89)%g z+jLoxSk7<4?b*e5n}(|UdCOUh2F_ai!!;$tANqd&$yBz%w5-FAB6@u!N<}=tbG6>Y zL&-{i@{5{fUY&w^7U`?SIl$f&c7c?WUlHf$2EGHIw)leHS0M6HHEGpL>269aP#Ah3 zDv3utYJzdL?i!JQ%r;7Wzjnrp81Vj8i*|tM93yzs|A)#n{(jAuNJ|VkRbJT{)IrS` z{gWM(UbpsOo+JeI`z%RxFQOXX)WhCaP|Rc_5sr1Cjuf=r;kMfD(>$GgaZ0H(X@Zfp zm-a&|1~c9uVL4bmYx4bq!iL{Uzq(FW8@ngTK}*qe6*D`eM2cLIk=nN{X&!Ss#?+F% z;r@(UmKK!WUX96efUnc}P@r{XzUpH`w@GXK$c@-n{3->q)1ruupSr{!>if1aBt~CL zh~I>#QF$B@Fp3n*QY4nQ@NnU@A{%D^=;ws=a!_ z5_PHPlEyOf)dl#r)X6Hp6cTKdO1m_a%#f}i=GAej0^J<-adMXu^(u)prDg!MKFUzoT5bD zUv&5dw}C>$9tL~4MF-bvWEz7_knCP96BmU;!(<%F4zawp{%&vtQq!|)Th3!qTDnLF zuah9s}w0kN1aWE&^tYj%Z!iDi@uYPTG}9%Jp`AK+f015r}{Y zysy04+pAqWD8Bt_l6KurPh+f$u}gsO*2n`Ty(ELa7k|F~o6N4T-Deug-ZO#@@#@rt zc`>i>1$CHt;n7m2J1>Dgj$V(2K7vU-Go@4P4=aZ)WG}C*c|FY9;)8w(J+=Ryhj>fa{iX68oc*~CT~cyH zh~{w4ln2wKL*D!hTOXe%SdB-I^}7$Q81|kux1v2P&>Zi}I|EcQMMfgLpIG1HNj=#H zwTq|rq8}gAuLH=YS&sf1Lo!e>px_*Qn*A@L+TQ|ua~14=Ec$b9z(n8p)e*q7qBb!# zzaJ2CF;SJKk-HWr0yNm%*vNm?`A=-0PJe0(@k8;=`(Gm-o*sz5!aX@$b9P>t_c^T} zG*le;#Vl)K_P4)PAb6XEQCxe7f08w31|Ly^o-FlUo*71IajY)JFIh@bjI%SU#8 zmP+s9>-s2o`79lCX1j)OiWKGcw}_A38Q3CEwN|GRFj9*FjHsqlavJ?l#P31cen|LQ zz(>>QcaH>_uHL@)SEoZ=*7J*|$h+Inz(|zo^RCd0C!9Ul2dsXZD*|4ZJxF4x%$;6g zZDwt)pct zRImVC_U`{Ol@;tpueN*Qo%e^ME{$*Nzh(t?_+ujUKv$hK8EV6-vowvX@Lf zn0H$t@nz$s4|x}9mtKwI#1wfp=+kh!=nO!0F>P#yr?)aUAIb zz|3{~`<}Rw_$j>cgu0Jz`|td79HltkMiFRHNM{C?m6i2i&Rl~Ko+mRo)LMQTVlrq= zTD`IvQ;e>q-*l=dOVu((Il1}sZ0fF&xE7ukcptzUjPqkA>mLRSGbfjfs9i^b;Zg9*v$WaARyD3s z&DZT_C)guI?%Z4vRa`vN7r1S-{vY#fymJhHQ@ds<^*gAjA-Oe>3gG|s02mmkPltxS zpVo>h_z0AGIL9+Bo$IZN2P9r3KUb>;f5#VCt&^!hj6s{Ld%60<9U-*bq>T{yPT>4T z)J-|+dA=GPgTrF>@%GG}y`9b5KK2=l{7exA1Ri#*JAI(7J`-VJ++CN4CSTqd*2@W@`iuS+X1ZWPX%OuZk%vm39JPvv#IGMS@G#niw z9;=L6vucDxv>2rux;j*KeuRe9Tw_ZRBKm!V4eY+bJgspY1a^hz47P5*LGQ0GNkuSk z&30?hF#dUjr1!m-VL_;KC?n6ikZ71*C~#jf>+8Mby=I5E9pYiuDDAJ{vK9QpLo&7Q zA-)p#1%;k!IqO%}wr=}FV(jm>ESsDR8iIIjM8+Sl`d5T+K8Q@jcRhdkTX`QieZXaS zS&4Wc2VPvs^a`scu{%0H8Er>v&lRjX?+D(cj6t{>AR;!aY>b%yUTBgX>g4UQWDwsY zciMe}lce4JV)fZK1wZkBxLN?N!+6XZv2phh_hd9kbqZGg_Hnb6&(`oE$DhY`cvlo= z01)BrD2LrD;{kbkHpQND|49M2JWmQujOND591&&{c>*>om)H0F_n)T3lv@$y_gb2EPd_Il|q*Dn4F9yN)~N#5ue|2-F{G^yRP( z6`7SuQ(Qg^N_NiN*rYK{S}q?Fz0&RwG>CAsr3P8bw2lI;>~$wgvFe&KB`a(0u}dvT zshnVGVD=pBprn~0a;c)zkh)Lb~2`ZV;0@Su_e`$t0L9Qht<0$=IGzECZ6&0 z8J0ZgIIlD^kHQjYCd;J#1*9Ja?AXH{F{%YuN`n54*!u+BqBUX)bL6E&X^JOdM4mv| zLf9}qB`{LOa4Le*{_mi@onq|PY*)eX6zZc`ZYc+Ib8f zV;8YWk13BrzvZXY)t|0y-$KkDixRV;=s@4G=ukx4YN8agd99PZJ5`(Wd=T!5&&#f& zAQJldwh&b#?){z%Ms@Box0sn!&a^B991@~4Kfl=r7i%_@~>A)!!!}|IYI}t=m4N<$RZ%vay1S*}0WKHNAK8;~jH=5_`4FrG% z5y{km2{Mhfs0n$@;yYu())?7jtO)9szK4JPtKDC7o@;dDOmp!m<|;9G-xd+Ai(t5k zBgKI9Yo=Vfq}mmz*9Y(+Ik%*C@YPSdFfl`rfIo;bI09ZG-BG=ghfe2%=%dP${rLd! zxL<;?6xreX2PpxqJ1jDQ4~07W54TC(#&2`JGNvmEeCu4b5sG|gW=oe$C&qH3r5;79 zcK=+?*Lq-duV(spraTMc?gyGy_z^R^QMYVAt_KErzY66QD$DRl98t_yIEmTecoJlM6z;wAo-ffkl>+ta6!aF&ATI#!!K=qPiKLnFusYXBa5>6M@J|mib|sYasT(dw zCkLk$;6VCA2bcN30qDmtqBzSe2rg~t57H`=L;~PK9W8xwjs1=I9;^P^VarM}1B5Us zHbw~DG%Dodv_Rt3Dxi8v_&6aDxKW!g7SZgKcxIwWE!8b3HP>#bOt|Kb7e7rbX;FYr zyK50T_OPh|(xEffirxhf;BI~Ux*=2T(qVqEgx?en#4lhA$Y6709cEewbBy=(!o`gC zt+dWpYa!F&4TR`?@82cBreZEds{+T80{qi|y&kN=q{or}n!b*4%1IXpr#G%`Vm~~<0F#@6OJX*;CO2A$*o8=50PPKJN|m#=>61T4AH3!5vNTZ<|ETlvgN4~R$P51dFn?alF2iZSQ##J;U9{9^vwmP)oGC33ga>5+ z?cL*abW*htGUZSzzf%X4OrsJ&A?eGDJL@S@>kPJJe)&ts8>;lFt-g;nt(vw6qlvP) z{9M$E8A0YFaql1;zCbMduJ&sHj@19`_kbsSF=m~qNY1jv9CHT$CB;opbbFhzsG42t>{dDeN zjnjmYTk%PSR&|_L9+0Goj*6Oy6#Q8It=wBqQ!My%Vl%AfPv6cv3C14`Lf7bfEoKYE z8$3Y5ov>s|$X{zEVw;I070m_vkwhIvMvqFY?O{4m;xyg^_k$fPRO%RrGb3dBT*OAt zXE+j_n~sX*j5Dz!EC!Ial--e$P%-;&m}ECh!&$t31TX)z7|Vp;ENm z4!&ii8U%kg-aB}n6y|IUHZio(lpb7ptsl__r|CM~&MaSYJ1_-`zCbn2A~L`UJ#px3 zo?ZaY3A!LO7Xjnw_c}EB->`#)TmnuPH{Vx}9U}AGZ%7#_;R7*g!zFDIayT%hN*JXT zf3;w*u>1;(5Qf0#whK3t8vuC>Xc-`@goIPElWKGqj^@>ZC!NihEG)Z5dQ8WVy=U#r z=W(qD{u5+x$qO=d{}7eb;nf^-El?e%Wc8o<^EVJIdv3+H>6gF#`_r|#m$!Gp|6%GK zxFhYNt?iC&n;qM>opd@$$F`kRY}>YNTOHfB*|ENQ-t(O?PW^$}ReRt2UYKiM64AK8 zC=BoEjp#<0F{hw36$y73zjV?%tZJ9Qzqg>b<75glP;LlwAY>__Du)GaJ6U^3WTLcnJu<^&Q!Iu3DrIb^+ri5=?F6De zOU1`hQlgTOv3oF%x|>W*UL%mE@Qvgu6^qQ9Gk4wO=kg8mo8rHL2orv5j-5yxxQ!Oc z5$OwM)~RQ#{a>9`T|68FS1XzJwi8r$tAKAlIV8H6;cUU)4T#W(p8}gEN3}0^o&OKS zd6K)ka??PnfsFUi1Ek8R!8zA6hsDH5uxXWuT&qRiZ6#o!-pg#$jGJ2{0zQp^P94GF5>+wPAXs^kk>0@E&zj$}D;Jwtr-OT>6r&O?HGk-aBQMtI z%Wx<)p-QeRF%!G>sM2|95(?+o(sU+XFAB{j=uc@<;SnZ)XN<^Qte4L zbQ$F;+Oam|&Zeu|8(~FwXHdn4-9XGk3Qb~A&(TQ~st-T-aAIdIc~dtsOiW6eb*^R^ zN|mkfF%d?>Dbbay;gFyV^KCYROd`+qr3BC1@BVRuAH{n~Mu<1)bw?vq0q1Rv4Z7VW zoTNNn`d7c8UmIOSq;TkU5N&FdCO2h|8 zj)*A@KB&2;rTwl^T0%<(@|Uvf3_ca+#t)rP2sSwS+s+E-49E1dcmTLFgxZ7knVif; z3T9mtf^b?Z0~uto_O8;tO@uC}C8rBi>Fs=`lev+E^cjYu4>NoyuL`SZXvO!RiciBH zIU|$#aKP@SvK$^4B9hc?OYJWrM)|{2Uz8;tIkBW0lS#sn5B&arAcc2Pka|y=(J%k@ zC5;v@=Da>oyEHc8R|Y^R0SHY`G0^SZh*wZYSZQRqBg!c3;(5wRxS|XZ=y>fKw+jB)4d+9;5=gXu$F`e z+P{ZP{IVaFL<-j8ki+N2h~zmMxJNj#q5j}|nn{n@_zQ$oU5kwE+9N$6b`6!y_jMJL zw7Hr8gylSsZHz44H=Tz+EM=PK73k|iDBbaKd6XQ~Rchff>o4)xnr)t9deOWZMyhC| zkOn!CQa>FOxwT*5$$E4LV_h;ecz}lH^7DTOQ_54ZMXy%H zggSN&eJ<7O-Ti;Fwu7&*McF^NdzpDxa)s7l*X$1rz;RVS!DuqUhSN9eYjKYo%#8|Pr)fAtW$hNR^cy!2OE;(%M9) zq66RE3>5xA{(dkP`%*4MZuUgSBvdO@EIbU04im}CJseGFz(2>F_*lb=`W674bf_0f zSx!?LfeWO#&i8a4c}k9qZ~ZC&?pMgSQB7vDq;E7nRS&*1>zvZWoUC z(5b&zv}e9r3imN3t^dduKu=jqO2LCVw)O*~fJ1-eesGno9L-C`RVb#Yr1c_y>J1w; zSJX<3(ZcwNNNG+yZFc{26s0{3Pcgk!p# zpfg^DNJU#iGSVUTD_~+wTClHSE(QT5`cjA!qV7B}n5yf3?SaJzs%r1$Tl_!27=N1c z?g)r5_RYN6G8x7u_#v3h&qD6fvi3tUmrtbSk{jjijqsWeNumYxXZ-RMqHb&rsYoWF zEeqHtYe^u_K1>WzTcF<%j#8=d^U14$Nf9N`jtG5-J|c(H#K zORT99nCU@t1w$#kG26bPlWBohy*So&q*5WR3Z)Zz?4$4u3bA7JKULq_8odG9vUm<< zRC4)LObH^zaZyvQv%o!^e322=>D#AUk^3r~ycUW5^`p)(WpkxGb7u1W!S!!8uhjow z%&*@kC)W)PnQ-^M0ll49dp9GL5U+M4rQqD553IWZ|CPMHzF!~z57#Rz7xMpdy@LMF zfVn!!M+6es|4(KHJ~Alja?=q1fxkZh@xnDqLj69zk1FNbFuVZv*Dtu!5aN-<-Dh^j zivO5lCpRRsfAOVyC}|5Q zQ(7bYH)okt&V=_{Q(a=WP*!TglKQxX{zu?n_{ufVjv>+V=D-0fTFa)#ftm-={GXgp zB#f*&R#hzvqWKMjnX(g1wu3g%$}{%=Jn?ZC>3%fJ5=Nyh!b#KdVACg<1qUFw{$$O} z4%J8L1*apR%?D16v}PD^Xo=_778oU_&maEhA;B!@vN0I!MRe~QRJ#@G1$4v=i%94x zdF?DvDYt(-|9v=-s+bl0MF7EwN2lH44D(YqC1~y?uvcn)&r1mCC?F1m)!m5JC~c6v zJb9@Sp$0&iQ4YKqlU-(9h932Ebh-aSy-uI+N91t_h?6vb%ClXZhU<*JAFM^Q-XbpK zNv#doBg@sDS)(3lnyWen?dV0^dw)7SPm0Y6?7r%Vahr)iV*RXQ`5Ew`E26|J1VY=D z<1Vz9g8=bRTm<5W`sODIeBQCBSuw<7?$@<`Qus%S+FMFJGiURtNTd=M&oE5W87CEV5(x1iPC zSdQNz`5vtW*qyi3A*nhQq!fhUxhAiVXTn7mnul7f@N6 z3%P9IIoc?5ef_>KjGsd)t1>%=XG8L{(&%xkl@4Ch&M(8^#Gl#9Lbc1JW}Sb>&U@jJ z4*cT+;ZS}Xu|;%B$5&c|{X1pGPV77$irEslUF$?`)g>3IS|Pn$MzrR61E<^u?@yh)40>h`rTr>qGFP>yUP8Ti))9MeLSlMW`mvD=)3TxR2G)+s zQXa$*mQ=ZqY||thzCR2kqYzy3v?HdA^VF3;+X1c7`-z`~PI$!a-!3sG^S@3nOOMdY~k=ok|m(S@tgoecf!1H8@&eK`?wdseSKk_RLB%4-r4Cv?)H2d&I19P_5O#f?fd%J z)%~~?ZZn#jeuE8(pVRxpXAfny)tPMDml;sf-|xYC$G7eEo{AERLH2I+)gO8c=rh}b zkIHBy+7oWAGuR<$ym*#?Pl>`0_+6Sapf5*{CjZYn%5nwg6AD3O$KSjDwom6F(Qat8 zGOgn!>-9KR-%qBHT`%)??-~UDbQ27W`qQTyV7MLfnJb6c1HnV;Pi@94T3g*$Yo?oS zE1)ZyiqeQ;z=0*uV@MdY&E?O2!I*}RO;n?QkNV)PP24h-87ABfFq*6yzKvz!*3;#{ zIRTSj$vqg%_CDPyrabZ`2AYlrGyi%@v_e-?`~x}x8`W(!VsO%Z($;Ls!_dXdi&|r? zDSbDRb|dHR0IDF#4i*cXlTT z9Vi?blxE(MV01rV!NpX?dM!z_ON!Y4a8mEy=1Xe}8S+cAR=kUiRpwarAaET6gC;4M zjuh7utyBS`P!}$l$Kxtkvruwty4t~9&TVsC3(Vw*9IV3kw>G@$8`5ge6~(wJV|drk z2eNw;Xh-!bzbaRS*)jMyaD2)4J*T)IT4BB$ZzI5+uiNiMIM`{rBC&I4h}UQbA`8zj z@akQz1YUYr)}El=bA}(yi0q$tZTVu@8cB4}Nx$~k^W5C%gPod{)7YILO&`lcQ22TG z0$=~g1o86+I=P8VxxtgwT&;$@*H4=-_o8+6U{|@cH5kzfe9cTzfS7Sq4F~B^3T`oO zap7dPW`(jC!8luJE?$1UhkYXpCmlb>&nwOkf~{iZf^=IR_17J{prjdwOYD#Gw&7mJ zP_vpEO*h@S*H=KLY$>n_%7eI&llGRxnd|Bg=4>2i3JSf*vt2PSc^M6KZa|@=*DxGU zW=K48U?6g;>kk0c1{!zc2t&?Kd-0p^T`!)2i`$Dq$ z8b`PIvhqG>y$Yj(tfnvV+=ac|gh46|x#DUod0Hy1!;hFSe?RBt=Dr7Mt=Wp?L-f7& zN3T#9s#sQ+%}yf$ogD1)fvqot`KaEdkZ7a|I|}UJefK3Z>U67>+4_)>N{c}-gkb}8 z@TmQCsS@c49B)_RMqS24E^L8bFoTl{B)h*z3fDz5jDI4(C>u9AqZMVd$Pwj3!KQCl zpb%Nd3HdG6NjyXojj1G`FtFoa-zxoRUedagewk{9VDarA1K?fuvC>x(?3;dFCtuK= zh=z}kAC#-|_2`|O9%Z#Jit-{Lv&t~Byp1?7$o-oXRhi3)Cnl++u<&eM;_lnI*5UxF z%InA<4-a5;a10iZsLBwkO%beZ0jI@FEfO;&*1DX?_LdM5w!R=xoNhro zf&p{hT6vGFOL@ybcmYsc(jxVF-(pN=>%0!2Jgv5&3fXEZ*GKks$$PuCy?OGVA!%-h z@yI)g1hmY6aoEXRKG0Gk)QR7M61fcB%uS;|vS4=82WAZX)VI&6@V@YUh8WpuYx}ts zSsT_qo;wR)72J1 zhMrkbG<&3j4rj?s$g6tm_g^w(pl|>-ws#!pTsK_nEI}+Jh1~v(rNsK@Neej*x2Yt8 z04Z{Rr;aH5=2ri}M68M;MIqE~MM_hbLBBmRCZ{8DK5iZ`eqM#qs&H>6;}i>yO}7cT zChIMfUuIW+iIH&o`;3OCWAp=!oRX>f|6B!WCL|}Z=W*pTI0uTRLLFYmAhTB6QDqq@ z8&y!cLoHZML!+z7@O9?%<$CDc-)I6>&vc?J7H}(<8N~`y&`{EZEayHEPUqSLF~4~b zr{1moIj*Un2zev-oaE17$F?9}hez+?HC9r7S=3v5nryZa3GqF_Z%10?E4gx#2frOW z4MN?vI}st-z7EcM|y6(S{8I>ppO7X?lSza?~Oh z?-_i+V!Yj7V+9{>Xdw%ZY@|nI$PPhKk2n}Pu18MU8nYpmMTwQm&vQ@g9$gIIB8+b+3bkXs1DL37ybmjK#MpyJ1^0we@sFi6@&=X z1q+p9X95_~mL;l6$*AV5uKam1ks>gr+Jwe?wjDer(P1{!=4|6RE@}B4d@evR^4)-# z*=jq;xK&9?P5sCqhF@xQoRP+!kHJQhi22v`Jl?HkV5JelGs%tQF$jISjU3&Q1)Wyi zZlu=RN@YD8e;y|)=WJ`1=v6vBw^j?yZXhYtQZhEv5fvX_0+Z7&7a#0`4=c49OO33j zKh74wV0V_}bfpvP4GA{@#2a8RxA*?dDDCmGboD~~H^K`;X8-dpd6)6pG5n8i74$H_ zaBsOfv+<4LI1%+o%r5%k35&x6}Rf1TRrDEf_U$@;jXIEI=A6OkpPh2 zPSxRdjrfe{6fchw^^PR(3VL2A#OH}7{%9i>Fo4#WdLxX~8j9Wh!E|Yz92dUi?s)?t z)?YdY7}aUY;)BShDHey1C*5vf`qk{STJOR3#IPz>za=!|!8zyUZU=v@j0P9-EG!j( znR*Q@^y#JMNpP5vOf51Yuel80KDB57xX^vfo(t?BFyru=l_YzIA9mfd(gg|a99@R{ zy+f54B2k%9h#c7<#33aK19umQsg_#DtfCG$Z>! zVjM=<;0Vb533hKZHk53>T1;Efd>KZ_Pg$rLj*7iqlEp3fp|DDPyU7EO!;KmU88`pa zHo8Xq$lY-Ui;$htz&h3$n{5qh(2c&Y3t|Bo;DKl>$Qwv9v28d!J%zncLHv&g%sHIo z7Jy1Ol#YH63xcAVmCXrB1p9Buzx!Qz^H-=`ab}@c_A<5-bM|g5No)P+EBgVH zHv+zgL-tVvks2?Y+q>UfL%k2;(a#-UxBCJNdhHRF>I?@8KW21jQ5?QeF|$3SjJM56 zXTZtog$x`DalDcg#yxD>-RLhf7w}U#tA%f3bmpAasL#=lm@I$0JD$`2xovlrDQbkLe0;BjMqC8Kd z49yev^YfKO=zjMpP)m66*^LgPSRmgq<8stk%2lp`=ZIZ*q9Y5}+KZdkvV}#4V_0hz z!}3xMdty^{N!4ONdK3B_9PFR9L&IwEu8xrp zTQ25R>O0f%qdM754@apTVy*+X?4vg0jEXp6ks z0vsN9Q8#tx(PZ%a4ysPSMbI(>Un4j$R35NEg`j z*xWjT3g{K~uGi87zLUFY25a?o`X8^%H(R#4Te`U!ra>tbV76n&sg!8YIW#~ zvfY0WIIWR>tZTz_6N?Nz0yJE_d0CX&E)pjU^~$@)+Iu1RMs!6J=}KO(kzD15BO-|m zQVU^@k!oX#vvGIl6UCZ%91#%?mh;!ZF=8$+&F=BrP+p)=^^bV8|Q}1$&QxJ-4R=T<9LKe2O&v{aUf6@OUY{QXH?Z;z<(Ml?+sA_sNKE6P?7cC zlN*4LhFWk7njNCr#_MZ)DdDB)z`&{GyQPdB|{((pj4^5$tg7h}AbG@=$;$Be2^>8Xd^5J?}}{?MBfy zu??Kw_zFX(25%tna)y<#;q#9c?KJ9Ne>`1l$G~;TjF3tvxU@NJ>oP^RD%ou_d+pj9lETgUtx^~Z9hUT_}}hz=DR!EqeDR1(u0xq^zV z^L!`4mcrTB!31{315Rr74EG`?sMIU*_X`T7L5%Qz5$u038f~9(p3eCacNN&}IUpx< zG9wOPxnx5+%rVEAnTIXE@+tR-B01aY!Z1Ww+qZBMb8vjQS*t!uMMaZVB!hT7O73RX zz+1=rrL~bqs70TqkuO$g;fAVD_jgmSFgu?k^C2pWChIpm{?)A_*1i4{n>UM{rP~U2 zJ&d!vSx|JaxGLSwaMYFQFUhXbEU4Z1Yx`pAUX@ZTSl?HxzK-)dmKz2gOSfbSLp#DUMm(wyzP9ewmz|$Z-@;0QOGP)o&uy& z{qO{4rs~s`%0#5`*Xu#nDpIhntyF&--b6Z^=O9X{mZQktd{Qdm#l%GTYvmx8m2-#H zPsHrS%!tcb{y{rKSQh8=bjRYf+xDBu z9zCQ92sux*dEu?$2Y=jG({N|SuYPmu-^2NIIC$dM=4r=x-{vVWRY1cr!$$p_?U9ki z@4O6!>XE#oD+iS^Lsj000%50R-A7K%6JPC2T)i!zo4(d1?aCbGfFC)(TYw-E%s}=< z@RC}I#^a1*HB&GiPdW?z>gt{+sWy94e8!mvkm^JLE^cN%8%(EYs8kvCdV+$k3VX=f z=o=hg6r29uz%UGchdOE)40HNtv=>=-mn70+j0q2&UUV9HAy_vUN_qNE@#^M{?z-Be z4jVnxvKr`BQW~xx4HSYN)LFPPdTsLKWC~zPc%+VUJ&nO^X_*XPf;=d9nCS)CUIri8 zO&Dxcz)Fvj?;g{;Dk%{+%g{-68-QI%6Gp zybq4=o{8oXS&U_R=*y;2sX~)HKsjE!2h^BA!@`PW^SHzzqe0xET|D6DPo%kInd5D(P@%Do|LqXyMHvO!fx8Z08i83AEmhdbt zvIb9eCb*Jvx{r|!q*;?wRDx2=^Eldz`-b0YtC57o{KMgC98I-q1;^yxxadT8ER&Tr2}dTcZXabj%l(IM zXIC0?9n8I{JW{XKiNixVHdu**NWX}ps6TCvha1pAcN@SVC#r@N0V%3@j{9w34v2Yoey<$)Qhn1XsnNJ3)^j=~})8VwCy#4emi&S%&e{K>OToduD7^Lsi>t{PEOM`|EM1Q=n__Y)Y|mhptH%cMF($ zZV;JXW54;IRf6sGuG`%|*fPoE^mGO2yHfY#Szx~_(S!N#-~i86V;W7^5l2%$P?9-q z-m1ou2dz0oVH-l-FwrNk!Y!vVMIJ}6dSbT=ofp2$v$DgQ-2{@x67fjv2uYbv=|S~+ z1Du{z#&)e)6dPR>LW5#KZjpQ z#c%;#CXj@s4dFA`5Zbd7Vd8Y&49&HdVV-NXM;l{loYVLSg6GE!Zq9`rjsgRBf5UU0 z7qWP?6ZOb1c4+u zE(TK;6zTJ+^W+ZpMcvGR8b`iN@-rA%T&w2jfdYD_L--IvSwOW0-g9r3FX0 zW?34#2+bQ`0ccq2`fBMBV{G3vo*2#jqZe?>W~T6_i(b)tp(a4&0as3zPB7H9sDp)t ztk`h*WgkZJ%qoq$(*D{k7nSqO`~{0}zK>5zmxhF1gF#5= zi{+_H!{J^SzIqgV{3syH2D-HSi*dInE&L^gUMr}r?USkgsFz-|30bOF^K-+fON=IT z42YPtBfYlfs7R8{laULUUxt*Z#+5$)TTcXIyYR83|NZqj@IE9%O%*~c_`ldAx>AA zu|XNm6DufHx^}sb>X#353tqX9%sE|JSpx|#JkP3WwO@)yVV(0ede_V>rb*+f&;yjj zwx{w|`^l^sE&w8UEa0 zwDG73o}nPLJqVk`zOhsqcZ{LUmfz?;A=13^Uf6_N-9OWA`H;S)*+XR_js2 zx+3ldTL!*u(&_**GTNFPD48`qoI8K+8UuP&M}~&<`vV{b#H63Ew}SP6jG5Us2P5nC zCTZgDUUq-d_%UE1kmF-8F^C{6EsC;BAh<(5R7l47Bb89T{#vc9?(1AKAiOmSL?1=&eyIb-*?fU3gyf{&6LdE~tq4mEj34FRjpPP}XfKw%GB#hV+mcGVhQhiqVDC>Ci;S@% zQni0laIRADakjY6F;O4}VUEpSdRp!4YpE~%MCnv5f9qFO@6GEwPSUSl9i!QfZ`2q5 zu2AYNOM`B^qE~5|vfG#Ig~cH)EPqNQT@o%Xx}|H@s4(?d6#R!9W|x=R0GQW-U^s~V z@e&%o#7R@RYOPjGxs3lbh|N|jJ{eoGF!34^L+sEtj;X@K)3hMLsHpYeAw^7^|GeQ# zc0r!K%LtTsQ^Sbkse{*qweX7VXA`AJWw-Cs_8XMPr{22K3RJurZD(E$8>U!4L_-n9 zffBq)ML7yO?HmgE4E^mck8%t+lwvY=efK4mm&Y-T&0YW$)XKD2sIKT8nPH!sDKusaoT=zmOtLIwp;|JXlrr(%Bbv#F$=nD_a%Y8JX_n z&1~tZH}+_W=7A}jKRaqTyb04rlojM`qG@EhBLUsj0;6@)W-t;)nzjvqIgcWY^&&*Y z*JVZoNI%55O~)=Rg!VD7LnUu84)~*O?B>aSSYx51B)Mu{=J4P#RF4)~O2jh-GW=dY zI0!C2b(r;otArG$3?E8z{JodhjL8zYJ=iX0C3mH(MZ6OmOW&XMi6o7t7>FnunlC~@ z8F4U*#N}(;(BO8X+Yeu4Hj^U~`o)Yb?e1HFDVfL3h)^58C1yj-c>Y)Tf%?nAx zT668t?@Fil$ooZ^g0_ct-RS9kdR4HRM?^thsM^MLb)y#5Ix60ScI*{p}NnY$RFXysEZlcO*t`UHLdzTPsK@_x`UzvsbGS54cw3dHp~auMVF z5BiED%z1BDTmGlbFv-AcZzZm5#GX_lk*pU?#wPB$77)8&^WoNAKw6c(-l#(spNC2s zMy+;x!z`vpOF9fgYatq?Lf`19J{_=IGg|3e_5hjxU-D|yfQ3K=L#k7r`g2DY%m}f-Rea{ zC2^bXIpQDr6EE~n-{^M3**C(Z+=(u~$P zYOpXcdJ{-?I_7YNJa>uQk=ccytQ$*`8Maoloz^^3mj_H$QV@q4kI?%EoH{7z=1uay4nW_tV4ja**T)WY8q@VT{ z4nEFS9e5Ju{0+u!(Pas&N-M_*i|r9Y9?tM1o8!T2gOvssY1HOzpL8_68j<-c$%`vI z2J19L_-pLoOWHDpr%4{>f7w`>tusk9R5USWF*Jog@aTeW>4&!MqNAn{0?~d(!Q( zvP?7K{u7%&u<(lz4M>M>^pGuxkcWYnlF?^jcp+EG^5eoC+ovMz<{)IbslZ-rfMyHW zsr4TqrzonU#}Y0L7psZ5Qm)P8U0f_LM>Q$qG$)VfASWf|IsQe6t?7~wr|ac4up=?@ zEf~N%(97fZp@VFy2y7Y)f~F5(K0i$kztod4Ta@C;mOK~vi^3=3RAbBVYDtOnaCIDu zhH@;;+1^u)+3EFnf~V^j=wHZ*QAos?m9CKT{1QJ`Y$Rh=2nf*u6j-*?m}~RU2Yl!m zJbcJQdpx6>)oKrBK4>{ygT;}kTl~YB-IN&-6y54@3I3bn=l8>aI9JeDAOeHd)aT8+ z@2)`_>Up&4@-B+I^H1L=@y+SLc(#avKxQ9&y;w+5-v-y~7-Ar9TfV`CrG{XrqQ^02 zBC0iJ!DvYOuei=pKIa;ButBq^!3!g}-Q0H83N8VOB8lK%oLx+wLbmvw;zb|xFm273 z(CYDDNPoEkA0}T9yuJwCFZWo!2;sdzQ{-{mJT^p$c4NiE1(H%|xp#ggMEzGG(d{@eS2m{j2Y8t>A_4iKxLPdPH z3T+f2J1VVPm5>1M&;5jd)~Is3jDafG3?!HnlUl#W^OIIZD~KfvL13h16qpTW_tqi|SZDX4$SBq8sgK;(3__{*yU)kSmVzbLc#0c!3ergWH6 zM}~Z4#pliAIGiiB{ieD0*txZ%b5ugq^2(*o)GViWZ}R93#ScA8*Jt3NLmJ)f;2M4^71c7jval;Xjp zEW&|l&vq!!Xz~h_A-$u4ovrro%k(dNx1x@2xwz+TN?uWNHbg`yADH2b<-H!5KLn5{ z*`uJ5d;*8Q+X)d~ZpVpk3KPt9RTqVOJ@G(n47omb#L{$n1-Au#gHCRG8V-UfJf|B+qb@%@9H&(Fb}M-(;aNM;Ex^lqwi&U zqD=s{SdHq8|BV2>Mid;JkdiUoz94vU1SQ2Ge}U@XdycZgyG!LC2qS;p-(PSFnkC4C zy9YmcTkR*FIS6~;nFWj0S-%QrkL|YZho>?XgK;`{>gis!^5i1|mCrx{l$=~JORV-} z&WKA%hxJ0GrLhQ`yxVguY;<`v3iYjB24V>la@qfgB@)CGXaq)1TgJyELg3VFs|}B^ z9h0~acAReL-Dpy!uDPy^a72G=^a)++$Lj+b2Zx$Q*cpPi#4?g_obl}M*9(3$Gjnkz{!V^dd_g@ zJKskPk({vC>Wtmx(goCSnt{1eIa^ht-U%AgFxqB-&Px-c~F8?WW2CV2dycU7V zoW#$>S*sVCm(8x23oHfw5x*F&@28FCE?VBy-ST!F7I?Rmg1cGo0hjr9hcT^udM^<< zvbCh1Df^d8(|>qf%57M;j!>3vTXfol-^D~F4C|420_qOtYvBLVJ%sFc)+#AD1dthe z{dTtRPWdenyll0Hhv7~f2A|p6A@lUIZNmy^4@POr7FzHKM=R?}6>Y3Nsld_djEwcH zJ#Xi{B**=3a1W{D2mpaoh%l6KB))`IfEN%+NRGbM$J8>LUpyPBMw5qwpm$#Ng-~yd zyup%4wg)tf=IEyDUw49j(}ChiSPM+C617u^^PWasAOPr}Zq}px*x2hW&AAV&cOV`k(h#X=mm82OPU=LbZ7-PX zdr&0Zi2C3F0wx>;o(iWhNd2i8)cqyo@Dy>@50iCm-imed?m)!X-px&{%|=VU)k@7O z5FZ7JL`X;X#OM9iq_34@N#qy~Khm1&Ktc`%`Dhc{fq<89+w6%g*vLzGqa7Vbj$>_e zC;~{OL7%liFz0XpYY@;2hye>JF!;v6=5t|o9QR9TJ|Dap)=8>XP4Mc>H{{0HcftZA zns_o>M9Nt@iAHcop|M-SMnxs9n%Z@|ONsH4LcSq>X#W%0PYimNufgxiBms{XkTSKg zm+Yo>`O*x>KNbF(m}w+2!+_0W%+%p(9-C}N2*YuaQu{-K<1YzB5WS9Z`$mC+D-4Zl znMB6(4AZpc-H!iVE#rC9{ziWzwy&*nDdOP9ldz^D6nV0BXn1wR-hS71TUtHuyfpz# zs`$xV{{!{%)OIjZ%$ahtEh`m}PM(5$w1@f(Yj$0(RA{Kn#}7b%GPxidbkp_K=fN)f zum8!xF%jLyJj0aNcJ}A_ym-#{f_dmY6ga`|CFS*ijP#Ft&)JR5=aD*O-9t2Qd;`=* z)?_5;{z%FG0tfx$7Cjw^zB#`BW6kr8oFkrD=XtbYLnfaw-Xu zgli=n4#Kb0ma4(%SQWOLMU1uZ#+Teb{zfYaad9M!Bd(Rvfd`fbr;k;uysbPuoR?w8 zl{ZF)U<>;-X(xEIo?iG0mpD|LxwvZJsa86D`ZMph04y0AF_fmNy#DoeK)DaUa7q%xA?KPoQc&7S5Im12i^^*6dI-pR5kP}EZK%l(tlAJ;ej61%A zKfI|!0x)ceWorZb#jPu@!yJ$LbeHN%ZNBxU$dHn3qjz%{_9hS7o3JUu8J(z*9JDfu zgY|%GRB+Uzag~~%nn??J9z9h|&VqrTqBO93`JKVIN0@tcGivxZTR%!KorvvTd$2cG z!$QO<^rvHvv3cp?p;{i9Uy-(>y1EnX0ZwX3);&;e3{@e+9WGK^17&shH2aX4l8bF- z*xCah#1LNUE<--U=#$r3_s+|s=9=!L%h@@R%Ql|*qx-*-6k*gBrx2%9ec@SJXOanU zh1vCgLZ<#hzuw8wii#Oj>#sh7yd=~@eLiWDc+WP#t}_I)K3SF+h@w2rmb{JlTWv}5 zT~#R6+K%f=O_>*^4t>-M*06z#f`RcF%K$v&JE1ooOvtVLUn&o~{b2oGKl%9Z85kI- zwA}=J#S~L#9CZws*SS zzYD3=1|9*QLg+bT4g^qlU+ut@&oIR zQw>(%;oTeExGbNJg1K*)%@;jSdwe^kAFTn|joA@-~=4p0N6H+6YHWNY~X1GDKbhe*=c?Quy(yp@|TAlpu6pn6Rvkc9|3 zbuj|*6h-3~m|?vo=}K2gnH%2Wxen=rRT%7M-A-N0nrmlku9${a&4MeV|MGCKo98+F z4e4*!HJJD{K2sfdTeFT+)1nfzwH+N!YfF6k!4kEz7YO>Z!C63I7o2aKj+~(-!Zdf48Mzr08`hm zGL=$$zQ{jPOS7%LZD3(|E{h0Ph+Ji;7ZCBTn0qjnO{?MdE8_eptKP&=u`2HZbo&l_ zu7$B_SgXK?A}<8l^K(|sapVHLVtxf0*2TdHWBHP@pI^w01F zNf&v_bee|cmBi1P3e9yE?o^v%_CoXZs1M!$)KRTm!|#YVfM8(|B3HneIRRI%og@AQ z6zY35z|yD$r3(BL%6(hQn>&T*%|Oq!Jy(^A+)&SrV^lmvXSQ!a5^hy-ISqfzqoe)$ z!?b2fs#T{i{O@c5Dv?571XzQIAhq(y!5w1z30p+6Z$o-O!I`ZKj-_tKF+@>t{i9nA z3XgQ1FSDvRwV%pKY(y?SZf-CfU7}e?X_asBZ~Pl4SiFgXq$%8cFR*K$BA)5h2gH$1 z1Iiw%xHo#8UIi!*;1w2@=LmGSx5wg`$yhwwMH16q{(k&UE($2jEY-Kl{kwt2;u$y$ z3m`pk6lRb(m(9+;BuU1#KN&(XE?WZKM*W`zb5Lf?S7dXi6W8sd#$bK18M>_vhc^HO zuRUEKIh{3#Z!|rP6nmD9(J{%w|1Eu|K)=wl&FvT(QMXli!K?2su{5tr4T|~%*%!Qs z1xI(gJ&d(9=HMTm8=aOQj)gc4m9!XJ z?KzP`l`bowN=@G%Z$wE<`x_hw2+dkRsqSPGslJ}d_x`}Gh%3}Md%!P6svUTH_;UB~ zr3@Gxx@Azo*U?fFhNNtdGquEyPa+p?+yi<#4PxSReW1!`rUvU)2d5>4vrV^fx$g2= zK4%AbE@c`#P8N@)O9VARMC2P4Cd>+ShBi&Tx)yT2H+)RtS0;|XK{bl9vf>`G?v zP@B0vQAEp1JG#2o_3wS2D8){w6hf%U>-fR`gdL>S5=MWN`%<0mr1f%lg)^Jc8|iU5 zsAp`!enW2^4sT>s>UNVf9!~=Udr#@FUXZN6aM1jBrjGOHUVY?t-GS?F$Pbj8rBDXP z(wKU-&dVeVh^0B}Y8WJOGC6GXMUh?3mY7OGAdZZcIIhsCcbL+w+NeXkFnaI&uVY$`Jla>)mw*6J-dIf2{+J(Tn@xa!BYXIXImCrV>iyQo@ zNXKynd5oD${N)u0S%?VfftWOD73&@P)XxF6gvYLPr9Q7Hm&ZYtP;h^!qrqInea=DP zPY4kh<~}><8y2U9;qS}nb8$HN4Z#;Usi*eB2gh;uLXT<%x}o4Jz4*A9M; gQhEs zF5#J*#s=r3Lj0TWFw~~un}(}5%WhimyN%D+7%<~{UE-DQlS_8w!~mB{#vNPIV41i$ zw&RMJf>ae%Bvv`>hvCb)>V96^%c=H(>^0PY(7)}p(1*zb+JX?|+N zaXI<8lfO#VQROirIiv=PUe`hFn*8&fYrB6FQv+^jS7Hxz*xbHKKt{IbAniWoAxA=D zg~L*Lgin%C7EI}e_V3u4OKtGH(7DMDo6m$CpAyUL{e?^4j4#rPmgDb9v|(p05_WZq z1VRw-{glZ<^Mli?9`cNKi!fZ{LSD%x4 z^_dQ@&*CUZkZY$(k`(oZ2ZzO_1G`~!GY3-Wv%xZtXF}bIJ)O-$d5%7r?5kOMQht(F z&d0II%V|JMjQ_Or&8W5{11HJ|(4yms#}x&%3>}IZn6ER{GF6HjzRAu9}PmX#R{am)lUUBN1)Dx1|2Icvf}TDhzL3N2iDg2(;)i( zd1$NkMEwj(;nQLM`kmnzcnBY5Zt!qaAdQzNq;7?_)y1IDx;he@LbBB|gIR4CF2bK51LWruE<>zjlenVjL6rZ(D_c#PIP2jO;^!r2q9b{2_A&}Co?oZfu{ZO4yA)XKqF zFn>12?NeZI=hj&AYb$JS)f;oBkHHarCk!p(fI`J`WAdo^sTSfom#U4t-X5q{DuZyJ zzf65(s#+Lqscj%7#@owTa2G)LS-hC(=ECXK!?0mWceHKa9f1)pa7;*o|Jzu2<}8G5 zBif-$=Zv?u%7j(qPmt z=TL0SK2#B{MZ1pe(X3k+6dke%wK67aM^Zaiq)nrMU9nooY2%I3rEH;e^gtRLDcrN= z!`5N#(Ya$+bQ`rDZ6~inQF?m@Q+ZOvZCOmg&}r0c1qh|wM66Oivmkj<=hvTGBx?C7=8#sGypd0IJj{APUS82i>AVMaG(%aBZF zS$;BwB1LQXnw-sLu`%0?8+6bZ#E_d#i6QWyBTChx`17rpn59u2hFAWHaLt_x)J$^TK38VQI%!SYgG_3=5aAF6#WR;0rR&`1*kB z;FTTO|7J4&1%8tZFj@V~rkniAEo7Ww3HvDy2@zs58E2%3J0WHQcBq{)QrDabhE&yaD(=jBaxFO~^poFQ>c zBam?hFBoQb;eeXY8ad0KpP7E;9ka5OmStBI7a9iWBsmM4(BKuVT z|0JPeLdOb$_4n`mS;@E+R#+i``U0yBxfOpJJS+Dj79@R7e9LU56;@bbg%wshPTWrX$T)Be9 zix&$gll{!#1xc4KT|$WxC4^b>pOKJr9@);lYSpU3!Z$0d_>o|fnt#fM+zKnKu)>PJ z2S1*WTW83BIR4b4&VK=THlG)D{)l6szZX(2>a@a&9|_(wnH6a(A-BQ`E3EkciyunJ zm++!a?(eO3vgqlxTe6VK`HeYy-{o_aAOz_XJP|-v}uFM~dhE3X`Yv;~r z(W@=?T#FLiKS#jX#aOuQp81ZU$A-Z}aqUAGw*RsU@4lFDS7F_t-nbWMzWvLH#)RfI zFktmn^F45Eau+n~y9yz%Z(zj^AG7QC#s`e**bYliJVJD2IF&XTu}}7+L6!RG+_fv( zw`qwPdv4?2uEp4P^(9XJx&XH$%pOxA7*o2Agy~#PGYo2c2#cYMD6F5o67Nl}e*z&G zR;4;xckYVLRDT^ibi&0qUrqe0FsNb>7M*CmGei9fV@LKw%XY0XZR<_JDf-<(bZFca zy;^j`b|2G;rm@8 zIH4~#?cars2U51JuOSX&JCDP2^WFc3w-{8RD%z0T+O%#hm~L4~xfNDeVTBcc6$T@3 zduYW^i9KshA^OEDTz+UGND%>#@G>L@fwz6|F40tNk+1yl=*35Y>>2q46*Ksd7Xf+= zRkG>wN5TKfF%;{*6zex`z|IB3uzFk=w@6 zI*7{;f=mGgL}B&(**J1BAe92+nJW{{FE^!gfBzapg@ohcy->PKz_F7)C|th$f{PJhFZ|#a5GK^OA=SHMxiIBGO>xDmw8C{Vs6D(F zW8ud2*s*h`VDD`;;reS3iHwlY?~h@GTw;WRe&18|5mVXrwiHWRbFt{&|qxNKUEi{r6-?`KD)9Sn)^TNu9rkkc-5Sm=7NL znIW8dXTJVNq4CF-51u%)z9%+s*(W$jq*6#Je^P}4b~Ym1U)}?QCho(rtuxW7-!dX~ zt#B%e$ljG1$lGKVg-~Ny?H0K6gEtuwQ@&i&rJ*YkBzDfiG5T@A=g_+CFT(Sn{j<3ul5xe|HbiP3|4qDj|Dc$TPvot-_Lr0+1Q)j+&6YA~%>q0dIN{&hd**Wu&yoe`fP zhHLy2T=36^s#z!jmqN%Ba~pod$g@>whM~PX!9B&cluO1>MWJ?+Q82S(>W(RM3*=H9 z$9p2iYp-R+$|>bYQGEqOpF*g6OV~W$jDhnn;l+^&XxMB3CXDKjrtOB{0|kw}wiRtU zw8!9KQ{W#N3ny~BG`l0l%sz}G>nEb;u$35GzYT8CnECGTaFpn_hJ3_hX#G}LJbxnw z_8*Qujp;o+ol~eJWOxuSLR7Q_AGACu{&rqC&muuyB7{Ur z@H&zDy+6qN*JW!`F#b$AIG+EV+%a*c{^f%N5uaw{$jvCmeR4~p>u=8!hbRA(ulRTg z9z~14J1H0HC{cnvR7ZDW#E^gI`2QSC_5LATf;Xh&o9aDTo*H`pWOSblBaB)xeCe6- zAI-NF{}%jZLM{?XVdv-odwYA~r<8wwl${ww#&t=Ncpnx=q+ALcJ6qBw|73S6lEBuS zj)S8k92`v7HlLk-_`g6R(IX`I9W>N2eVIEEZ z7;K2ptr^h{y?S&*i`HXMVcc3|x1sbSOvKKpjz?4iF;0UH_F2nf_M%OgQz-${m+ptH zjgmSw1EM42Ap39~i+o?8a_@c^+@~^>By%nCyb7JiW7FaJxVhl~#c>+_Hu$4vr+R4K zrZ%=r>y0e&f30t z(_!0aHg;{IK&+0%Ta7&yteAz&&-dYO!I2m>x*s;oX@V6imf`xTO?cp448te) zL5)gT@$}FtJT5*4qeiixM)+m!Dm3od3$@z!MAvQ;P^(O7jPFp!oF9@24TMsK4IHU0 zJ5pPgn%fm`(h(OK4N>T03}1K;D|YV0FROdQpypX>BQz2_beTL0`!~17!tooBr&&)_ zY0wevOJ~RX_dMHcKv<*-ou|yj{!J~ha_%9#IK2XwojYR7x~1sbG6&vAq%;PRBj)7| zbn4a@J$iIPgXYUHhDa*jtj8|_u1)-f`#)@ zxoHnHYu6ja(pg>%5h-4*oJC=N-_}6?i71vq1Qoqgmf?usGt0-5q$CyP*o2qcC*XK& zHsrPqMR@odJWotHD{X_)MRUN{=LX)TcSq$K4Uur>8g3okgS=h3!bKH|h&T ztbqB;HlvR61QDCkJHy; zaqHwoyzqaEr1v-RJbfWNKD!LYS{*TROgrSrm~vG;kr0Ut_FR8XPXFNSI1vESqgBFw1lyUu5Sa$n*zK!5BZ>L|B zLr=rVji)jkc_G6sBIa^R;A>%+c&bz)#8bbdq%e1%%Wyhe1cf>8CM3&(-6TZdShh^a zO!6`Lk<&Y|?~xRVR98gT%+J2eBgetdBt%R@LZvtpLb9T3i@Pb^&+jex(v9^-IklNR zJ_9uz?iLdABJL{r~x_dU763_o>sh;y(ui zw~4<1CgVm;0Os}`h%w{FVfff_IQB3aHvDFO2C3W@Z!RxKzsZN;kyeex<7eY(gzno( zIgxQgQUK-;8iLW3)~FF9Fq+aEHGC*mp7i@pq+9}f=THo5(iKl*cqTe!-k6N*aC+q; z+zP?pLdp+qK8oCV?6CXj1C%f1iq$*cLaIzYGF_jP2#uX5T+H`rl^PW4Gz5_=r(%_{ zCC+xxV)(pWC{wDW*~gEADlrZ%M=r&xRm-ty({>E4o*o9Rmbw*F(=r+iBu_C6dOgx- z%_+FKXLN-#DR4%i^AVBswTSkrjH{bQBks;6Y+W`T=RQQi*47SLJjshz2Zccdbwn6G z#D2v2WBah{#7op_-4u4(L^yf4;`cTo(y3I))?gHzj}5?@+Xc|Fv2(HVC|nJV8#G3{7ERzuZA!NK&erL&QK_ANKytkIJ?7LXznsdG+JnMYUn5~L532OJe}Oqnf=Hi)#(rw5rcHu zGO+_}9nukz5iZTp!Xa~E%vrh|Yu2nrog#?{drxd5HVX2z8O?q?kxmg$a!7)km%HF1 zck`e!#zIYU)qidirGJC5?b;xw^eF5c(2!m&1ze1gW}9#gB6Vp%I!FqbG88TIKbVQ1I1;K$Hr2|UHJjjH zCbES#F&?4xmSh!n8&yJK>j+&!9Q2M}V6}lqNq2b?N^~EFx3h;}r&AvsZ14^}r|(Cp z%5|}7_a0Q&yuraeOR;{h$sXPWJ#5ouN7v?c(7H|Af5>Eoi7MdpNRDOifl=kv7+YF{ zoHj;kOWc%1NYavQi3CVV#_@Emqbv%ffZnA9y5}G9LMW(l&Lu)0K+36xp3y4-o!%6N zl|&}LOxoFh61k@)4MfZ+4EyEh>_0WhpgYP2$H#H&>4u;4zicTaB|^$`IUG(+1TT?( z{P{m6q~z}`k-eG)bg1a9ha;6Oj+mL2;u8FF0$g5lOP+}|xw8y7Us}3NCPdUbQIMn< z30|lTsF6#Hz9qFtOKwb}_!*Z+&9X=lhKcM2QVe#!6ANZ!QYn#o@}DT=C0Vu>SqQSF za?c{!z9#akp=%*u1RdqOW)8jZ#fHnAKtGm>VYsc8xA$$^v!mbs;Eb6hg2 zMD}BP->4j%hWVW}jf+DIOxN-uHPaT4Qs6^`Qv^0oBLG6|YO}rjp=IX2P zJ+Tryp5;cZqU9jDw-zy(%A#z)M%cV;H!9YyV2<_2f%Bu65FHjPV9V171Y6faNT)u5 zwcB=L@wO9Yf}qFYtsAj_-%gBLb{n-DRYG)F1XMaL5)(8?dVK|>7w>_CyEk-+2@n}% z)EP(9AWISIwTOv`gvh-)`j<`vjiW1(IyEAqxqb|Yii!I))A}X!h>wm$5*(3F@c^&0 z6eqU?3X>oZ=J3dPG;UiTr+*!S_1jjU?XX^W8KFUZylI9%PsPdz-7y=Nd>&xw)YZse zyAv*M8H2qKLy;|gCPapZB5$SY2-!XpmwnmKD&(rt3Nl?RViQb+T&WGlwgcuxi3GhS z3DME1SF37>JhEMUVpJs5nM$E+t^kZ!umKxZY{c6r6}4MEVxyyp(h{^uh>1%gW!Di2 zuP);1!>340N+KUR;?l`}A|qo_s7VXNADo8GyLV&$!7HS|rfjcT#K$H=A-rk|^c^}7 zTPKYL3baJQz%|%*{4P!{9f4QwEzzi1B?NDpg{!w7;Mb|^kgIYtxHvoD$<-qyFUxFp zA_kPng~hKjBfs)3)~sBCU`;Oc>!QQR@tbjQ;VeX!Z;K*49Y@gXREUc=QS}ln24K?I z5$Hdz2hyf3i;iWo3+@)=s#pORj_gC;%B6+-isjvLIm`o9sp%z>f*O~ohE^3%@tN)G zS*fw}!ssTpm@sAmcC1^9bI<%Cb}5G1c2_ZH^9|fQya-3%7ekezRgrXQJ&gIPqguaO z*t+5nYFEyT852gsUuy?<2PdfbQ_3e85%RlDik zXp~Kln~xM2eNB#~J~G6SpZ)jbn0HH#={MwvA%E{b$S~hmjzu@+m~u;oz*sR}MvAf4 zSAkux#fXlP;um`M%M}H-1WTYKBD(IH0<*~PxN~xRB=SN33t-Z8_a*tI_~(=VCC?;~ zn7RRhsK``e^f{`;vfFZ8dnd!#i!!L_xhzSH;pb(bKadk42?~;74#hG1yc}m@MMQW^ zq=bojM3e*%VnjIgK#tu(VjR0G$IM#_45zrr8MhuQFy=ZbCcZL6Qhs<8;p&Ksm0$(M zxtP+Pa8ZsRCedcH!-VMaYbnAK#aMY;f$^v4IT0{h3U`&_n?qq{T#@62j{Ta#Fgd&R zR*Z|!Wte?aig>vQx1Y%{!$(f#Qs4uHeMe>{Og-9{zgc9@a$T5lJcPoj;Kob5=k`w1;I^`vf($&O^G2yfl)5+~2bw8;HIYCQg zde=RYCHdL*UW`{%ucIH)I89xKg4)siv!t{UVdQY!_U=&IxF0OVRLc8nlGEEDDJD~1 zCsG@^ZO+4Xk|XC~2IqmoS!SlW-8_9E#{ddDn|>!k#ZZ!bS5P~fO|lwuQznqvE3YNO z7lwH^6!3|rwoGN5b5(&J^jt~gck?AB4n>eWRT7M*I`Jo2%%eQ~N^O1mT^STqN0Uw} zg*I>?Sd7RhdQSBbsxULc*nA+vSXCwm!5I_pZ zuTRBrQW$Z|pX&KK)!hX-G?Y&z#dCq)vx}7eRC*7VQhIafebJKNcxse$>D`)kR*3^) zBo`9kIX`+%ex_5|c`^P~lKXg)(Tdyj&XT-^W?;pC4wAC_mC}fOdJ3nXr$P5t`EdQX z4+_+%18;i+w$2%d*=u%V>t#PYKf4#wTosYU&6Y^U1&my995w2cqh5jrdyx!j+}+`o z-T^na?t)i~VW^eQ4N8Sv_=L25?f^_%vKJ4+?NPgCW^5Te2#4EUR@Bp?-xv*zZM4%9)@42 zJ+j)r!h%^FaPQR<1buKonPPUBKCCyEuQ`U;bh#+3JG3T^iy0+n4ZM?SXDX z2O)DB84A^?g=!@Wz|B4fnpCZf;zcskU}B2qd*b!$*T|G9qd-Kw3YJ3tJelEalOiFx z2dY)hg;${lG;H4sRf=UpmK+68r9d_!$Kfd2wm<6TOovQ`iy&9_94Jz}Aadp}iBjol zaQPUIN?j+RW-b?GDpDLdvSgqE!4btu=12Mro~YiaB4S>>fyUkoZMrmqi;WYC6)uDf zo~GGb3tqi?g>2b)wp59{#fu`NcRJ)MQ6F_G6hIm~R}?N*fYL00B6%|-dyxt#naLLK zLbPZ_dCQwE1Bw=;^e9fLM}Ab#Z^XTuuVE}y2NOG%M)m@wAdCHgaD7G$9@~%dl@nF- z8FBYUAW*mtCUq(en=~0wD1RQLqk1e-yfAcP2jt0OnrTH zB#R2Aku$S5a_7qpB~_lciwq~OgrZ09)+kcCC^BXAg48ZON)^wGOkO!qB9}YVc3Dxc zK}C`QrCGW-GP56h@>3!ovSi3Y<#7S%-uB~NymqOC=B3h`Q?)~Z(j`s)`8G`sl*^kD z4jFQxY0VsXe&YcGor_`0ur_c{p9hum=y3OXAjHM$VPc0;P^8O^Y_4+HrOgZvd!Al1 z!aY|B)GD4CdOa!9)IQQ@FNBg6s>Alp3q;6sW9ZP?x_bQ+w`bittQG8&Hx%?DUU@^qi#i#feVywnNX-e4&=yN6#4RHgS(Rw-uVh5 zcjl}pSfc?vH9^pMmPEgvZIPYYP>nie5$byt&voh1Zy42|lN3ekR!7xhdEnxd3k|DO zLE!?~QIYcYJ~$8#*=l1{zZxm>L&{x|+(fSQ^bSZ-uwX%`)#`5|<=h8cyLJs(vu1_2 zx3}5#OK_i|)9HRYPI8tJ3E2=JL4$l+%8^)@!DJ%$;*A_{TIISwZnF`}3j zf&L0Sk?BzdZD^orV+IbtXgosbMj7I!= zTY_=b)o7W?AdpI)b!Tv|m&M(HB5ryVbpy5%2`xeG#EJ64UZgq+))A>2RacD?RB@Z1 zi%>6*9!j+YyIzS=HZ2fDMDW}r2^x}OQPEzEDZWxP%1yGRICw(V$-#&~B7cplC8468 zh`T?qs*Vb_p>iBk8<9Ryf?c^&*^n3k)rzg*;k{Jz+q7Zv(UxDbIrH62wTCU5i0Q^mzM9 zifDHorkB+smdM&;nE^GkkZj!y$WQV;N#v?fQ4KC|pGi8dA8$XXMCVfckka5TTZ$JeAFX%FbUij7bu# ze<{K*4OFNom15LG5h^>2a90gfPjA2n(nKFp<}+xeh;`Lq0@b@8$u!1QhlCJ`K)xeL z^LcC3V`_N~%DYiPH4^N611zEXs^K8QjC&H4rg~fbN`x_GHPD60aVpLT?<7(V9krNP zMh9t%Hf+Vu2kw*kl=AP5OShi=Z;BYtCd=ds$PF4i3;Kv0xzb|SxZZf3r90NFS%w_` zn=yRTLnv6q7CP`mTswXqu_6T?tQ&%Df%&j##bS(ZQX4s)6R>vIRX902`~(ZC`?@gQIZlc>)5joxw{*2`pJY3!?K& zu`jF`R&AIE^}bm+Km(W|IsnIyUqpqjbFgYeO)MBc4WUF%*iuEWp-!r5JIwuME@n>| zjO%mzkdAr1O;$ASKM;Mpwm|W$CWDRi`O6@8TI$tF)`cpT5@vgT zG`tFxCuQKvX5^fu0@^okfLwX=pg;zDD4esPWR3D@+`c0zQ^I~A$X22RTop>>DOpIc zVa!~z20FBFgUURz6LOR+0~aQ5B72l9lg~6OXXAy{{05Xn zItzm*fgLlF4BgqN-WkP8w6$SPf09<`=FR3YW~E z(zU=fYkp)Vf}W*VakxrU*t>c)4xhS-L%U9+>8Or^dcRsH{m2q-4~r*9iI2nGJ?Sa+Ii47Y!RVL5r5H(5`(4 zWD(?(2DQ6%M5k``A&B1$nVmN&CMI*5PmnmGROvh>1tAqEZ>7t?-rS~T)SfC7H<_m> zU9+GdDIIp6d5|ZgX&r%g{=&%U!0l3ra&_CGVZ{|E|rbZSwm< zZLe^7QZBfklA~y)5<>c7k6dWowmq6PEcID_Y*4ykW3-|&wr}75pD|hC{(8oAPdzPSt-ao849?n|MiG%Pcn!b~iY`Xvu#xcFYod{)@0#?tk$ zMU#u80WK1w;LZvI(>XSu;69Vh8bJ9EB+}zYr27I9xmLM}0H&NDqHs)zc}+~1(MeXsUDTnTE6ZIK?Fk0;kck|rjnlI$=CMOuBCK&Ly)Z;XWogy-`I3odd#vV z8JkR2lEHFpT~v!lw{6hjtQ=2>K+DLD!6s~_@@U{dgst&G1G zSw^lzj?)uiR*{lZo4Vrrkz(wBB1X$%I*<5(P!pArfvNMULIP#J55={4O%E2Zv+#Xo& z8vYnZ@fWAT?bHhqiV*>q#fxz#N`y+DMqGLQOr*{q$3L_^-P?wH@;6=4ya5Ws;YiGcRD%FP_yGI08M-z}*bhXCBHYo0)LC zVsoI(8MUZDjjzs5TkHrTAyYedGG;GrxZ%*$+v`CAiS6-n>qteg{Z{Kf0L_|W3 zlc&!?BuT{4gNKn6_69fo!l86>MU~2x;o#whylLH0phyuorAY%9dZVJ_lIYDbB3qe; zD3!?`UIoe^SIkZLe2|$sLx~(V>QMYLv33`zMHN1>i{XhmWkrXCWFNi#GZiEk>L}uI_ z3~(Sa(z&<>eGBPO)KP@(_hhJEMvcxyh`gxZVtZyib+rQVB)=Ico`P9)=w4ETwwd*i zYlwIh(BNP*72<;AxJcwj`0_?Sk%q|HYcYCNQlotVouKe=G@n43VIs}5s;tE&srZvU z<@2Ki!ct{&H`*BBLGNpwf?D*XH0u+wV&aohs!TeW2sshC{}4tI(epQ?G{{LQVWR)} z2TC@nxcO8L_v{+k^h{f^9K{-%WK2StWFRM_R$g1BIcMpoKe~MLS&K!rInTx1qU0w zsotqxauH!qL!|sc7!Ua(gi$?Eh*aQp)D#7bQDVH6uzw@!<qbshD1jUq6aahLryuq!>1?tU@P} ze_F~EhvhnAr3j>~q$e2^&#prcYG*Ao8el{6PEoxAv1YeGHfM1$2w(G}xs3GSKF@-4 zKIk?=Xam5_5K`u;oZPlJEmmqcko?0C@OeRFa zKxHwSO95_lV)GmeXTnH5mVJ)OXqG(!s}|41o3t%aA)6gE{B7&^KxuFRq;e&_8#2@$ zw;r9#IUz}-BQno>aO>#>;MsL8U6bC){;5M{81*{Si*95cI6YjQ_4Hy=hb+-xR?kjQ z*O-F++c%(I(R9%A>^!}3yycN8O&XARk)_@ly_ar4Ik!0BW%^&hvf`PxsHmu)`WGJ` z4-LsSGBOg;(a~S^^H2X05)y+pZ`u`;r3jG9pt%aGGTSW}jDL{UZrFl+ohiZHkZLob!zOcOo&1 zPAf3=x(u=mT2yy3n$8NKpMeN`hs;JyKc&QcUl|m(M(T-$N2VW%#)Chg(2dAej}{q3 z7<*EQlSH`E^UNU;TRXWPgNy61=%Ny1&nU6|oyC^g1Rh45IbMp)#Z`woj#OSM&;A4h zhUC%n##3-$V#NuXp{1J|d9`@?T!v{E74W06#D)A>{G`kqFZg4b*%L|1;Gsu{bRzVp z_=k}^@5P!H0t)h`z?E`n@!VfdaS}ncGs20PC`D#Nsr)Qk3(`>7yFv)WaiQiiu|w z2&BTfQJfBx&O>Tf6DXge%vzKoWsmFMnaZz;lVB{pE4((NJSnl6Cp z-RV7Wr8Y)+7)s^$i#NAF$_t5AFj-l8PmVB>X^PjtivQ=}aYQtH`4;2E)^!oD;wJxX z5KENMgdaqO>U(kH#R1sq5};CRAg30!tAA4*&oBh*2NcGVK5YO)ka6$+BX7^4$eW}wOZV`)B|-qnqY>{B^>Bf0-9b2F|}e8%4MvB0e)|w zo?a7AtE|MF_SvwbUkhBxHwH_3l*Ie{H=)g55?(~)`DOYV45XwuJ3GV9PWWK{1@`XU zi;EX8V#tso0^$9c!KV_wc<};RvSblv$^WU@!QTVhcRhXj6nXOGftJ@GSYgEv0=NGH z1qvW8F7BI%Irjl`=gvj7YSmDxR4KFTmtf^wrBeN2oXI;`2wX@wK!taz;PIc0IXF1m zVhhh{bmx7_dG?uih+sdw#h*x+;WYVS|8_(=cqa>XB-8X z(oZ11#vjf2nP7%OZv2erVR>GKi6gu4q(%azqh!+vBEp;=f2!rRKnauv`{kKr6VElp z!Ey2IBIlC{ooOcyN{jp{DNSK^n0^z0bVR`oq_Abbl+@w@U&M)Vkx1==1#&*J{ zx=Li?MSkt*8JiB7U@CnQ<)1I?NM5WsaC}eSOX2LQM|_YRi(+(GT}m&^ZVO)(C_Kl@ zN(3)LWm$i!clyiqN=~2hCPXfzMd9d{XL?x_yfcVUZz>4}Un0_7OAWRr(F^_=rn=xS zA1bPQZWsK7-9FC)mz|j<=OJaCazaV;vy`3FPoy&16S?NLDzqC4&vEeH|KyGCO=)uZ)l^;%Cp@FHS$Q>?lv&!FDWAMk z5Ir`vF}e_ZaCyw}v00Z8sTDsBxWDK2W@~FU)BKK@y!7B-Bjh5n4Ek7KjGc59Q-2)} zg+WajHMz^Q;g~;VG#-V}3tYS<7LI6#z>6!e)+a3%O)iPiZD*m;v^gm30pVoF{dXe} zZ29zB~+|fQD~SyE6$xeCy*X1toYGj zrH>WqZ!zQg-h|u)(;#j^azA8oO@3~=`rLnNx6f(7m-i{}7+;Ief-hrF{WKZB7l#R7 z#$k!wgp^?zUyCKR%jcoLOo{Pj7z>i0TS9(41&iC)t}OUH7tq@ zKSGvP{QL1k3Hjpvf89ihiD+U%YBJ6+8uUcc69oI+L?WvE+@Mnv8Rzd-M9LG0+%kKm z2Wleb>@Pl1MFUVAv<}74uT=@?RQz%DYoIVhjz5uch7gY_y#&e++ps75N$KBookWA2 zd)`{;*svg?Bcmw{Jr`EySn_5R^2_^B^RxK41R=aZr$GV@x=Cs+40EPxl&v1tQ;8vmS1Fd>SJlHgLPnEa-G_9cwM=kz}hp1Boc>rFY9Ka?U$ zEyhuQ35;g*jIZObru8#`92ewMLgB> zkD$D4uJON+@vsO9u0@c1==x^|o7(&+#l{LN{t!g;sXPA}G*=_EDk&;;>W$**c!uT2 zy%J2UU2|1KhlWK2a{bdHF&L*W-}tnSCi1l(UWUXX@U{=$CHy>HM(7h??AW{!n>KF5 z+C6&_^BW?Keg7B_Uq+bkOn7nQ2EtSc@Huq}(O(ovkLTB~2n&J!H)wJD>4)1*Z`coeEXB49QpbVjvx0)UX!K`!^s^-g+)^qB!oP}{w*X2s*{Zy z)?wHFTjZ+79g?{v%WwS7z$fqnKHQ^pW6h5L7)+$_WsnSGE+{bHM}et#WWp(e{ETh3 z1-o17;iIFZxJrbaZKW;l$uQkBS(h2bxJTqt%=X6Qo(#4ZHv6Mr>Jfuy#zi=KQ-Mb| zdQ?dR+<7a-@mEa9O}4Y9Fsb8{7(P$SlxO~Z3AWRB_pXEL| z9n-xfKgsg^JU=Es$@#T_WG)rqFvtsYIX=!LCH*~H{iep958jO6^7@ca2QA+;aj zC-|`-g}eD@ap%)K!y}})!GxUJ!q>}Ug%wr^F!Hj~a}VZ!C1hv=HW>foT{yKE6G6KG4C@-X4{+pH@k<6l?nR#p$<3q)FpI9kto{6I58)w>ustnQ#9xA~B(HT{M`!%Y3iH zls?tasM{i_?cCsK$LsLF0hayEeh(@AygiA5D~=*ZRy(YmHU^<7np>FfPK;Y}5q3@v zP{`%5wX=uM#u-?BCJ?S}X+E7Eml{DB-(eV1@<3zk6O5g+iLUshTRY*?@SnqLAC z(hD=E3Xw?IfBZ!>5nf&#M?{U=l!$tJi#zZB!Q_cIqz#A?BOq2x%F}ZSA4<=JG8#pAPH6=v zh)7vU9fwgb!fT43%kV*EI<8zvX>!@wEuQ3NDzAxrt0+!B(mjyk(^Fgqy619yq_Dg| zG$dSt2$2Ey3L_lpmylp8XFTPBO*~@AUreGHZz(UILK8&-agHT-mL-3i<^{fyQZD7A)4HIfA|Rc8_D}HQhMwjM&SgL7ju$azX4wF%Mqv_u<96Ky2S;%0u+Sv)JVu0oycbU<~uas(B+Zd+!Z; zB84rHcpI4>Z~cRW?)~}Ut(Y`&EEcTd=L$GF*yH}OLl{3|EKWa-lP#k@edI8XGZ8F%$hU|3uY|CufLuq2S+&Dig9T3S_~gD4FM!D|8r~c3+3a`!#4;I z{y;Bt5)Lg{jh$PTVCdj!cy6xy2gg@o)R<{lGix~x+`-9pxR$8hX9!%b?ZkZ=^@}zcgbCyNBYg_e|ML8LT#wFz z+6wBuXOB!i;cAgkkahEZ6|@Kn=e&xgNG2y=`(5 zd!t6Za=38HG#h{R&@&XxQVo(6)9~Dm3s!1?Mva@JZQJ%}(x8Cg?&R)<54X;u+4%EV zyYo0oyEwooR|=%;9|sA^St`QycM>G20QWQoP!kajr#ToT!394#Houh!giuB#?ew6_o3V$M!7A2Xy;o(~;uD_SyJcV8ITq4YDGlnT3ospWOB6q{a1;S(Ukif2+`-)aUE{P(cT*gfK1#6X zjvUuwnHZqt&d zNofcOmSM|FDQ=RCSG}P6&`HqafD-#DKPM>9OJDL4?jmfVy4XarJNR4*-*7Q}s2&do zOK^_zxrOTM(+(|Ep7 z7_Ysgz%6>gZD|Mzru;6aw8KNCn0;H0)0Dqy_obwaiZJJ*0v{gKfsK}5Q_ZE!wB*10pqhCt|>?gH*Qxn7rv0(tQ852dN-e*x=&Mb=bFe57y4=gOJ>vkluI) zE7vfI1S0R9#JbZjNQqFu@0ma9bR7qq3(GNn{|(sN+Q3E}i7kt^AR+h^Dh@r08ohhL z^vQyX-tl@3Gu%|V1znSwj5(m%E`}2v`8O- z*5me|aQSk`TeJjf)T)Dg*>j*q@m%KouyQ5F?S1pmscR=R>(~oE;Uq_?1PZwphZZcx z%h*VaY&!xO8Vy0K@`+eHZv%z0L&)1e$a2<3pW>nDHsUzEOIAeQLS;}puNdp*tV0YE zFmLcUBxP@cz9mA@YtjiM1nfk=Wq}wtq7S4m)?)qnlqMoXQB&)9|{ zog2c|a2>5jokfF@<1nd_JBAFMfG6ixV9GgL^qDjQP0~I``$>n9w|FHKEmA6g){vBQ}aqtUf%XS8Y248u3G$%-BHPcNZP$Kj9_YlV`Q z19X29E}=FW(5D>9*I$N#$89k05ffzz)<2X8CpYGHGh&C2R4`?d>BU&@CqYKD`|evr zx`~7yi8EkMSq+AlP@``V9X#zQ&XQ`Bb1|5=;4{sX*3G9wUJ9Fo!rmYfn@Ep%@ZdE< zj*fa1a5kb|AuSqs8ij4^Y^ZLw6S;GC)+3KQDXc`EUlCE{*;ihtliyp9j1GGAEu}^& z2Ql`(7NK`(HD(pnW6M1m)I{V=sdFOq7Mt}p(`2s*FG4AGsR0#p@iF#VeEcZIv5!DL z7d>1gVr+ga5w^8sa2{P<^=O<~kMvGP*lNYNA0@&~B8Z-(#56CWL31yIu#KGsyvRSN zHy|o|@?Sy+CmnA?NHQeH zj=A;NM@j+jPkA^%f)=?AICfWtVntNcM`{rlBtx)i%NCRD=^x8SF@?f_jwQ4xL+wCV zq)Gqt%(+6z?izA8LM41@F#R|j&yX8Pp;_xEMrLYL*`0w+H)X;prtHTGE37bsG+Zko z{|Vua2PH0CdWd=*dn1EKPD~py8@b&jNMEQhD&%rRTN8ewTz@=bbynFNnxf-@0KQvG`ZG^;U*Wu{lg*0hBDgE?FWAA`0p2?;$ z8kGU1+DyQv^_#G7^D2~bBXY%~mxzd{gCj(*AKFIR-}{ucMHTtlALosr(f4K-@k zC&exW>o9{qAS+~X*mmL^+IOr6+`54H!flYxO#-LlT~Jiyi_4duB5&j7aFmNtws`|2 zKEDDx7f-mSOK*-P8Ta;$MbD+raNzuEs$Lzn4eh7FSFe{6X*6B)?n9Pg`OvayczORC zhWG4`TX%M2=ApZSy9ru2=PHM-o7Z6Tww>g65@=i(h#i|@q{P+T>v8|)P7E8g0Iz)y zU{4T{ZHWP{*-IgPfFHK+y?}}}E5lZ!N@b9vPK-m{p-ZuT{YLEAvmd{7EJ3b`h_%Ux z-51Xw*NstFbkX#chW9K^-E;mE)WWp)vX{FKiyEo0s=5Y`pUB`J3&c|Xc#=}3)MIiv z9Uo9An3Y5kArstf^q5j!2VH^~>4>PZc>$lG$TOL|54Es&w?#M^vMw1M>=KYn`L}HoL^2{k!JHqH^M}A|7EDo!np?8|<%oIXch$@632SXBF%MC(4 zr9^BMlvm!LI$5eF(+57?g=hQuu(t{YHK;^41CA;2tDh8!8uBfpXB5^ey%v3P5or_> zqcT&NyHDkqNW_>e#}wp`^Vz$S3d#?pNS{z*_j@+=VE-miYQkYHd^~y>$w@((OH>h)pXN!v5SutiBZnu|W%A zH%^TPYPwKnD28H00Nah3jIsT?qDk$JNavs>Vy;TX4^o2(c^r*Y6;R;)EF2WqKxRiR z;*+!_Pu`YOhk|*$aP2J5=xeZT-&z{1v^1~_!i7i1ba-{sN4S1}+ZP6p+z5L29xeJz z#O4_-v1af9sM2J_8y~ZuJ3cVD=YmMDg37#GkXDm~=oHp8M!gn^RQ8n6YcU`Np41AMwP4H$u~<-LPU(Bg~(;5y)2T< zYHBCMh7uoO-34bHJG&Ee7p%w0HGQyZ&K4pHMkGknVMx6s3|Mj>^(q%eT)cU=Co_zC zJz^tx!3L#8b)X`piRq)l)eSk*x?}0O=~&agKCV+eR&P`qN7il<7N3Wa^28<`0u%XL zVT3{_#=h4QusC9gh}zm4;pRvRDls8XcLVBX)d>nYzZ*KG0a+=d>DWDs4lYEh+=u`M z2g(sdq6?2Df)-C@P>T`4a;6q%v8gsDi4j1Iy;&X|ic#IMz4hns8 zJhsGbF;;uZ3j1Rs$TPES z!w!uYrvv%;auI@JMW|R%h3#eaI2s^gnb#o_cxToM zGD*Yal$y;G@;{(*5=LbKjs=SaB548Zio#L*6h{^}J*X=}#q4^NN@D<9407CB>XWq; zrZ5SaWm1F6nMXlorXLe!;jkbgt9eNd3L?t&&2kV?c+1v$Ts~GxJX{QT6DY$6y8aj= z!80QNIjA1JsVsFeQGIa_@Y!h1gq(kDsuc230+m4w-}h8bx)<`s`Tq=hV#3wEfDtF; zC|#J}JtGQH{x1ZIkwoeGQNeQCQBstT&_pp_zm?!M5p-_dtl(H=Y60ipQdX{0Es^gy z`kj9z5!So#E-gk|Ju*|<%U~``8uH7V2Jd+w$0L=Mlv`ni0D74uW$QJaTq%DJXt)=( z;)j6uuH=2oc`@48@Z`x81O)}5PMtc4dU_epoXVkN`CQ;*{vEut;=%dD$X*~f9K7K5p%}~=xdG>IT!&Ms0q9sd3*sa1BSYCXC|$BBKHPkPRs-4#$3=f{yng)} znKEU9ghsH4fJac|uZ4W+l8K(wAu~KRCoy)#DR_A2M!GyDQ7WSjkIz5C$pfqL$g3`< zbg6?6kDnrArAp8Re?-aVwQzs^9Q?ZJ2&Bb^VtU6i2zvY&S*zAXI$0u~J&i=AdW}&p zj~4S6EW^HQzQ|v@1xlnRA`zH?npH{(gN6mKUcExLY}x2ajn_}!qez`fa3=!iTCxsG zW)tDXGd0SU&47?t2XyM+5y8h6V&>A#u+LEuHHu}1e{dpdRW1p~oJC+fHy^uC`eFCY zNKBhD9$BR?F=ys4*mXP@9mmf_gNBu$KQkA*PLLm;DDpD~X+^sB3Yn&dkLFw ziO{riULkMV*pGOpNsG!Qi3yky`ymkUE(n)|k4RgqIr`VK#mv!D@E~4-#}8HL*{?o= z9=#^zr#kG^VR-z(0gY>xMZnp$c&N#Y^tN&ouU-Nl9tELPgX*v)KYs7*(7s&`_V~tP%A`@qnZXuEc5H$yS5@RrYeNk^7HgL-LzF~`#}|)a^Oh~} ztlSQ5>$_lX->gT8nTFzC_Co49RT$ocJECf(JVe%{kny%5avh%gt5B~_3E>EK z6ZE)u_z3o0IEy2P4q@-k?J(r7gj}KsY~8&TCyyV&{{06Krjo#|R1-8So>^Ep=$gSB z*GU=4S13CaUPVx*dJepK1hj2Z9>GtZB1_ep$YA=A18sa54sP9wqi2re;QswMe(4s< z)~|(7k|)c@#wj<-c)Y=e>qd0!Hw?CK*J0MLo3QW39kgxSloZBqJH&_kfNR&TkE*TH30ppxg$bXFgAwuJGHiJ+L3$4Z(vs4V z-XOuUyHZ>a7o$~iHHy0$kxwSV+`BSd{2)O_cReyHO>yw4k=dM$IP*-7^Fb2GNlC~{ zWlwx3!!`j?21=o!dMuX4D4gFR$d6?HmSmoh;?Ck| zgkzFasKr!^uZ5h$6W-i3duJ_E_U6uI-Pe_E2>I%<=Sq+qzn4aiS< z){-*VC7S`O?#XeA+N$0`kD|^Z9C|8+OIjVWDny^YoLFJS&kpXBf5aIq7k!`c!9ZJ$ z6I<8$(+2}t@$L9w2Lowi5v_5A^Vg&OVfZf|43roi4Y`}MaHRKd;amKC8)C3(@+#zM z*9q=EzoN%!7hK&u!u;&dA@0R_%-Z__!@5_%+QA)Q?6wo5tFbA~A44A-1C^r_QZ}!| zFe;<__bB84A24y|qx1j%gMmy(&RbIDITbcN5ljZmj>1eY{pI>%(v#9%O+Pm0ARa5s z)|#!R*h;}1mnH4wbl4xes)$JPwFyRHaV>ukVZP1ru^%>JVABP@W@4RsKWkGMOIm!q zyCocd>_|SMosl|yj*HDjOp7q-n$qF41bvQzu^*nzO+JR6!ip#kPRtD9>j*t&vkFFP z|3)D$w(c^?z+@_8@yj#XoCe3o<~@R04_yn{p$BY7&1KWlGfqa>&4%OS$Ml@#o-(ZI z+LV7wU2uLl>D2YbF<4-dpI|y;zNX*;I4=Ggk(_@EOmaNxtAxL^2E#}}$qFm} z4fvr411&l5sV}$U-w4^?PsabNu>A(2{VjgJ4Njz$QKbbB5oEpCUI;wz$Zz5 z?#_Oh_$8X%_#{t_nkNpGN&NsYjgTSx}WDi8JwQPR*wc5 zjDlieaZ8;}vV1M|&9m&5Jf}p;vZRy~*O3s8;^B6cvMiSR;&4_nZiN+Q(7RwItc3jUz@M=p*P3^o_*ua-E&s~zaQK||1&n^R#;($6;}LRuoCkB2l!!&I{zVDxNt#O)X6i^ zKP$fXqE0KU_${!~7at#QCFE9EVTBd{kMW}kxz&c;ia!l*lt1IlxD{4dVTBb|SYgG# z57wjet@sYmY1L5kK{R~c^q+y5(`(fl%Vlc(Xwq*qK*L)b{3z&k(EP?W0tTJdBr}yt zSZHN|PNOmJobV<7kG*pMkQ{mY@H5?G@2t&P+qP}nwr$&*wQXZ&ZEF@YJGR;WD(P7q z|EIm%yRV~t!XN~MxiepPwvtzT{g8BqUH8U8Qyq72l=>!#E5n$Rg_QlwAl zq9Tci_!H(sKRWkczcqfnB&120<- z6is}WB;8nmOOcxRrRbX5>nF1G#1q_lwCB)=@4+tG_$mF=sOD6z*NHy8deNpwBNpy^ zCx`!-S4Sr@ZpE#XH3=Y$o6*S|^eDEgEtwI%V|_6G4w+S!p!$RLVM{ z3@cHz;Y2>{glwZ7|nY+)NjP5%P;xx>KVyjonPbwH%b($M$bOI>C&k^^AA7d z=GqCYJoA!EYgY0o;^%~)7yW8>A|z!^MiaxM7hd8=3_BKYCg^wTMIYMd%txER9BU09kr~5udVd#FO4NJAXO%_{TJBGDV!Vk&Dx6kh%N1lr`AV zwHj_uQ&xV&t0PlH`iiC&xw*lc*&wG?+xa{X zH#aVD>G}(zR1g;)ZR}Y!Boi5B^wg3V9!%0V>;RSs^LjY;h|;B|}R`v>coe;m_+=uZfYBvpywFFL_FAUG!^iow>>_&mcLjM5ONrUU_~*o?%^} zj(TN`^VXQJSBE$7A!}_0)l1Eg_D#9`?#mdBq^Kxdn@wi-j-4Dhe2l4WOA{aFPe`m8 z^@k0iL~5xp^!R*u%}4KG!os9|4MYWn5*i%KyLZNWBHHsfZF`O;ROL+95k1Hxc8iaQ zA|k|>*Pgzg`-yc4p}cwXp5Op+4<&uwm`g-$o15)>wzF&3ZVqi2%EBQlMN>(j3gpqn z%UpWwWn34iBVKaz^i^)ZGfLxECuY)T=GTJSfZM3qlpL~wqX$mmbbJcOd}CNL?kv+z zY-9bgd0byO7r7MGY7&&;1cgZRI;Noez?$`Y_$aRV577`76hX?QnqX%x${{l4{6aZ( z)1J)FZu3@N7q?M}KXE_op#Mx{3 z(6@AcLjAmn{VJXK@KEA@Za#7oCQO(xVd76<66D`2v5z>Nkc&f``f_;J0XayiP#{gE zuQ0d7&N7)(Q@XP5v_GM*j?uUGbf)*{!0`YGKQ{^2)(fOW7}ByIZ@=-FFr~Q#NwKl= zZ$t14l#W?3gr22yx8-t}-|y1(YhiIvRV@>B@N=hUy! ziuGHL^FA_Bj`Krw*kvt6M@vsmg$WV+{5+Y;b|sgK9f9|D(0$4&l0RN$@W@f@-0#NF z*%R^cy+^}ZZP>i?94{Z8reCM=ypM|J#DX!*Kkmc(6Pp=6Z8Im=tzi1>^Qgn_(zioO zocUu}eD(t`L<1n?#S>1SI)QI^1RhU5$wjcRHs|G;^~_s1k4du^@B#$)?wkj4j zYR35}xUy(0GuG_j$m$8ys4`6KG0Lrie~$SPV9)Q;DWh z0#iG5=E|E0ULBZ2uc_zIhTfuYmq~cX#&BfzD3*!i2l~9j`}IRSMShK#(R=GDMwhS> ziFxr_m7YQtA9)m>n}Q+;GLc{RR+JNDE?$Gqt(xGh{nS86WX7b;v>830{26UO&pK$t zlBB>_%$U7|IdkT+c=9sB67*P$EfH6D5!-AM=f>KI@_Hi2Rw~WqSpt6!D_aL{?3}|Q zQTEfPOk(vp>AKk9qzhwUtHyYw9?#moWsQ-gbiS$~6-wnVrfb542@@tv{86OAqJNJd zmuzGH);F1%cq#vT+ZtYHw(#6Pn%i#!@j9`LYso?~e3~a(VU9)EQc4UJP(AL&g^0d-wl?IE1U~Y%JMUmZ=HiMdxQAjeq znI+Bo4Q0lZV=>D|k0P})8I^N3rcE7)%gghG zRv$;#PA!-}r!yz^Y{J*)5uQp*a#tx$iw;$JcWy7ywI>+k%Qt~4mR!_!)6=~D9E$v%0A&0$aHt3C`x3wA_%76#VJ{HZ&rSllMa1i#^ z3dyP&3&)J~9W|6C%i6GS`5|)DZ9~~=O{iZa2eENUB4q;xD;N5X8O~A>=ji5(JUz7? z|Dpq#HF+%kJ69wo{%dba7Q}i#U}*QAbnV)Tid{D|d)qX4<;H$hQ_*m0%g}jCNWQ&{ z1KSUyYA}h;9h$Rnb~_GkTT7{0t*OR|SC zD?uq8^g3~!ga-eNQd}SDI+-wG!h{JEe(h%W>WI{uuAT6Brz_U zK8p^seb-)2>~^Dh9wllaz%?lYJmcey{+SJWA#Q9P5c?M%6&e>7w234z28ieo`X=v2(L`Fvv5^6@r{zFNlNW#KKiuB89 zlM+c+aTGZ`2C&hy3iS#*kgV1jk1ZCx5LwdfqY{!UM`p>$^9^BK9HE2Ts5zUWw(W29ta#N&G z0lBAF5_-ls;^<<3gJ^ikIZD)u(vs5FVQYFDFS8)^#E+=_`grlE}^vJ@ct?%w3)xd$zD+$6+S6wa5L!J4tzpcHbwLmQrI{Trnvf z5iTKB9MaKL$%$yc8jvazcAIWZhf!QK&gR!EDhkwzEXp8^mgeyU=rWMTSzZxH_p;yb=??wmA{UwsE9zfz0H~>q@4g`NZR3A@+{p(i1h6a@i4VQI=+| zDvoKD9HNrP!KiDBJAM+g=FDN*?0H;$7cT_VPyJGx zTiWo^V>SJ!9w&V|HCq<0=0lVaIln`cn_DUIx_XeAQ>Qa$?kpybTZ50r42z%X1y?97 z(L}h@w$)TrO6z~!C+5W02f1WcpQVFZ(XmqpM$8<;t8H`mm>{*DgizD#(55NEfO6qX znZB1JTjy~pwl)oO6~HO+0uH%KlD&Ngo}GO_)q3SqQvH^gp_Y{1SJ-8&K*>}d%viXB zt>>O%W2r=GY0bSOyI8$+0ps@v(WX^()M}0Fquop?1Y^h}rp{f)h2qf0TxGP4WYyLi@^1-AgBqmX`5zz-C{9)i z*JdfpgvL5XjGw{MwR;Im&`4Y5D6*Bj)Jtoo$I?0j=7Co^cKr!TYjbf!n#<3zw)pxP73mmsB&LYs=6y$UZ}So~`MT0XcZii6Pq1m)X!OMf z(7ID|^vCCN@W@#vP2EfFmR-r1Aq(%X@8`bXCsUz#1~#e7nYb(@KHM+LYZ9;Hb24sh zCdTwzz?yN>v1`+xLMe}}LFzd-GafvD)#mi*)|oba+mSs-d72c;B!?T3OH3+JBcg$0 zVQtBsBjZsuUcvBgZRpUxJ#&XtV(aQXD4m@-v}7g=L|rju@?_k-zTBVY)^^<5y?})a z<}!1Js85z`5V^KNVbCI3-W2M;oi^&d^xgW9CR0}seR2@f=gelplpzG%;|ucg|!geQg4(RwZVcn$Hp=8crNZ9ZB5VmV`#l_3FR_cp%7x-QoJ0@ zB#|i#y96{k(Mk}a+Qv#jLZb8{HN)D`l7qdfus6*Jmi8*f%cDzJ;*pL6M`w{n9LP+Y zM3P#Eg^fLyqHd4&J4lU2C%N)yJ2pbdS=-o({D>ENvN4{OSeJYBg&0YQPY}Y-cwXO% z-!n0gHYu8Dtu<*JzV!Nr1P99Y)&>iE%;F+Zq)CUZSv=1#UctvKGi552BE3jDF)9SL zby}Q-NR0{#!6{?uOA`Z0Gh!x$2cmPxgrnRo`vqNm055$L$R_fjx3D9X zRT5!=u|!6PVU;yMIbE!Y2?@bEU0M=DBXLfjhQ#2Hybq1TC1U}yrZpGagT(fXSea=E z35p|KMi+56sCf7KJ&6hnT=V6{7B#_P@nlHrl5%7tUnU095fLoX&yW^FLM+MV4%l01 z2n|UhwTlIj@sKu^EpegVd^TOKoM#b%7Q@^OL&qwX`O9JjPS)L)`|i-)641URdGZlC`s$` zr5iUnHWH1cBg92vlh&EHcOIe4ngeIwQ&b)NfR_)~5gQnaQ>Jt%b@2p7K&Eu|g!#QC z(JDO-W;#-(O+`dt7^za?1V<}LXBEk<7s2E!ke72)T63Y`Ja+b%8YL21aZMs|k>aO> zLvpU+Q%_(&sKhdVAxO zpiPRw=c7MK@u7H}n2oVSZOZ#kAWhL53oa%4({E-8>VAHvaF*^=Ki&*!{< z%|ACWkOEuVufGoIND^iLbJdx`+zMUfTTY(2PsTFUsgO4vTAi`M_;(;3-&!=xzaV|R zF(W?kJ^sn|eFlW#z>W-N}!BlzT=%EVjb%GHz2 z51*nvG=axidoZMFPOhw+!s|Q(=~46n73v=2%HuuQ$9uDM-ZWnLT2p7>FnZQ-<+5t(m@r}DpX8eg@)bw^TnDP;$Xsb|j=4d@$IvLUvG|+>&L> z=91>&IwtOUjg^hmg(X$giCj8(k|?ZrwR0Sso@Hdt;(7F~QGpC*!E8Qs8%Jj+o}N2M zq;(GLd5c%Fe!WSI|96n?Zx#2h+@}7(1#DU|je8pgvF}*| zHddBcC=DbhC8HPjl7*!eS|1PYdSzqS)FIR@l@o(jB?P}lh-C{T4^C#%V$jOtKg=yG zG3YcTtF+>`LYs{E2L+)w&o{@URA3b_R z!GZ37EuRk37Jejf1+m;b66pWp`gfL$- zYEGHQ@RI&Ct+5cxlIcl&0xNIccgEz*Nj|#j6{F2@7|3x zOBYMCa)oK&7D2y4i6s4a$b|_LCQSUzeA6ECm4Bv(TzXMxk_itDB+9x7Cok?IzpaiW zz0@O;l5xqtTmEGFL!?ifTD?wALi%8;)2MLDUz3(O!q~ELAs?JtP(7c+52o@~C&g21 z;1Z4=+Ct{w1Gt@kE-HE}4C2M5ko*OU7nIa1^Mluy5Fa}9#72hT;}u7X=?f{C#g$!$ z*OFiHmQGbGbM~VK>wkEVlXQWl@{(S_-}{o3lq8D3okTOQxz^6CEi=X!BP{hAoT!r}dCQoAvEdat5e2?w6< zp3m9v5^USHft*1*S#>6e79+Y-u0$IStzX2Oc|!;;KAat!Ch~0AcWn|6#X9jgvt$T#qo=33LCWsf43JZG$yZSc6 zqtH~`1{GmV|2Dj>vWCH_x6*HSHXfX4O3n1mnQ-?ZwugE$_DM+&tn9{Xk9*{(Se1n9 zb12AR#m-j(?=T{$wVJR{2F zA#uQcHZ*xf(W-~J@4c6UJ?e75%v@IYEk(%7Cq(OFiLfe0jXVZ=l`cb(^|$F$*qWqo zSnL1SY{=c+-Kkcs+CL~n{x_E|UzU3zO_=!B{4+M>DLv$cYf@+LZ9*4U;%45t?4Q(_ zV-uRQ>~%(}7jYprDw0awX3;v^4XQTr;PSo2OekN1j}==|&?cGKI2C=y4`P1nDNMex zmwblTG;(cE)=sTRt%*ZxlZoM-^V6xzC63)%f}{UoYIc0Yg3*pFzMhx;i&`L6)0UCP z$e(8hO-D3Gkr;zj#$t>Z&=o6v5=u*3g6}P*$&?tLUY?PXe^Kv^8NnkV+U;!N$Xa)5 z_pOg2LF}8U7{dp4BbAjX2UQ}XJz&Cw2^0S~-(?TE^y%A7nVM21^PozICm|^btq`5b z31+mPv!0AEm(sRvSDt0-%+hX!QP^arX#Vs_UKR_MErFFLnG$_h(LUpSx^?WzxLuc| zM9ERS0l5klr>?6r$+CZC`DpS)DydydkT<;zNeQty6z$CNiOtwJb_Ur;EywlgW_k`< zLAF|L$e-2%otX=zOXo!uXAt>WgTvifv}x6b(HpOmIjapjCiJCwn?5L;&7wn52YKQe z6Tcm)fuYrY-`|j>Jen}^-^L*O=C`zUVCc3Js1J>0=PMn#a=VbFP*Y~in!~actEgGn zL3S0X(@Nf~l;p{vCV!o=%$zfy<+G+!AYC#^$!g?DQt-=yFpu6f~l4PL(qY&o7*jLNM3H5TZ&$b{8v#OrOU5g-aRTz6KU%Up&4@?+nS_ zTp}?sQL5GDXH=(Eqj$+kRwoOFO8YL7_N|GXB7u7z=kbZR`0Rqzgb5QS{>%KK9&!mY zh2+!LTplQ@I%k{YFj4Iz)#(PeG~9>=H1g51i+ zl9My0^HkK~c6r)T-Ef3C=e$Cwsu1Mnyt}xc{kPxAlY1nK##V<8qsgBk zCE{0vy}rof=zP?zkS!&|z>U58$<(L;A5LARc!%bs{ekw-a(&MpvbE?+cH^X(zl$$| zJdvYo)}t!goc2|6$=lwX-ocfq>~yTP?Jg@0?Y9kOqB5a9OA0J3T;ZJhv*l~ z-u0N_1G^x(7QcODH@dvJi1e|dX`>YX>fujtyQ-&G8?mm9K>(tn%uFUWOWjW?{o;tl+%g^KWlj})ztxpzD z5ArqYLVSGeuZZU_{B?p{>VJ^tZb(9DWh3_@E5tu>kx^K?q{m7dOGreV)N?^p1Nl2?}as8AA;wOBg1kV;&xc%g`` z#QiGGs+%m*v9Yto+>k_QSS)&l13|je1q_vf$ z{8AGqhF+tQC$W+`aqMg@#l9h*_q8`Sh&&}=Zf%b=<<)=ZZD7L0pFd?$ijLK5Xdd8w2BQ(|1=j|lQRb30LC_Cwq~Ur{Zq zg3EJya4CB~T(*tCWz{u$6_9$TlSxurWAjP5{7rl<$hS1j&AocN8B-?}v0?5Ep8blG zXIJpUX?oz%ww|o~*p+S5tEYtM7*nz|MGxMkwR0R6sZ)y=@7E+SvUn+)-gqO#YD&=W z;ENy+rioKVt~FXp%$^ZqT}6+I_8g7sjqmGqXrmHvN%iyBvfcMOX;VVqwS0)-k;O zGUh$H#MAK&@GZND9%=5;YeOIx_Dtsf{&}p}wT>q?qj_;)Xv*Gjaz;biEJ;OJ?CviO zkNfk;H^~;y3&Zf+-kcocqdDPzibnbD=~Ar-&Byg)lbecjhesLXzgkV!{u=zQ4PjK% z$~ZNeNt;?(2)=fRNk_uDd}<|bH8YbmFMu&WqlxdV>B!=@4Olv&JaGxhC@nLQ-!+iB zS%+}M&mEr=6KK6b2>sI=I9wwOgD&|CK^`N?&i~0@Daa)x4>|@>zkEXKrI*dMB$u?( zG{xctBAK;FNNLGpSpF>BPnpE?1o`JT zLuqMA;qv9loi`sPD)pd%?lC?epR;JuVR?Jl&3!C8>x+HrG$eXmXYROO3|(;)4NB}C z9C0v@;qb=2#E7`p)-Gd6pZ<)QbX2Ta;ox9{`*t__ckRLUn?7=S{+AB2da)a8mdxX! zueev#@0mSy7PH1o#Qmd`%8${Lt!O<8guTT}tZ4)8VwPQMhPNo-v( zjBee#vf}VXk`ug`Gi?^L$4=$WM}LmY?9J?%i|IXhCeH#z^iVIBj~Ypzu0uI+!CwR< zvTte+=FD6o;>_Zm$j0_1^Lh8^75n!tV%L#_%-(%p#51BWx5P;_(43u}aCAvS76%0u z;`%z;8o01=6R(p+if^tkY+!e$44cfb;oHStsc^E;uyw@(y0-1hy*Ti^xRt$I*Rbc_ zYtC#vO1$`Q&9L#TTt1U7ZTfK|OgfsL^P8s8yZ64JyXOv&R$CIA+vcG4IW37H?QL1RBl#mq4bfQ4w8Khk7J8RGCS+%(HK)RaO2v*mjY=KM|5+eu*4Z$ZMgb?3I zQn@%2`f?|?oH{VIUtJ31DM*c;Q|XrJ3ELh7%JUuk(uV-0g|&QroSeks=!A3nR8lA| zX`Hx!cr#tyG`OGIfHY^TnU$!RjjHk=;cGE2A&YSdA+#k?|4EEXd@Z;oAuetI|SrQAq2@rCb5kem2K%)>(jSmdK}+q!t2+Dy0zv-ou9DlD*1 zdQblmyJ@j}ISZ!u<>k@2Jo7xy*@sEIIJlgZ2W~<9bJpFD!}Wi6{{AVfZ0tC`dIrmv zE@9fp-WY0+C#Qucr_Vl;x5s~Y$oa>CSXw9uh}AKCfg6<~&M;>CCG2diu~Niy^@Il+ zzl*e4evRg1#!}fak{}@@HL66EuJu_vtu1S3Z4jwFqwnO?G#J>6LG6k$W9S$nlH=HZ zK5H4fen2oyHTTM3(D1POuG&PC|{%~-RhS~$&V!X6nNb^#mZ&NS-NHuFJeW5OCdzL zg`T^|P7x9v!0^7yX)SW9X#<8wr5t&-9W>ycjEs@JxT;>))SsBowA#bidAo$W@oZEFLleLzhXIELbb{!km zuVwYVE3!+}(AQq%DpNis4I^dBjDO(pZlF)W*Pn(OBm z$?>-itb#>@0k~fZz$P)0JkBvBWzEE!n7nM8(pHZ1SMs&V%C7cBxmRNogR58*hXbVw z<|5f=Cyo32aOv!1f)7onpLZjceM=WpUT!Rs8ZgIbB7AyTyzzk+m*qf){tPHhQ*WH(RKKC zJcMBUnlC0Resrxcj)m7JGquNNoD53FZ|y*jItN&^ARjZ2r>9KBMpBK~M>kR4G7%nB z?sbS8$5wHFWgpf$k7R4t0zx(3rBeH?c&>Q`Za2Fehq0-1K8U+Z zl`ebOGcp&WE@kAv%(nEbU7m5r?~pI$@&{gC!jLn$IlQE~F+gx(c26D`ABKL_IEu~~ z%bXdPxpj7q*z%UD<<{YGcLE&>b!FwtbENZeqfnnDo}4N}?GA_WI6RSV6$UW>_DV(- z>B92oB96Bk#fIxy+3X2>Y=*O;gDd`fr!mC87DvZaH6B!?-7I?-1{^+$Iug=+EzV2o6FcQ4gNhq>`I@`yyK>lk5(|5a>-m`% zG{`!LO@1EiY*B!KmM2-=B@b&FyVCFYyT9FJMS6L^fB#-~x%f+QOqek7??C!emN+jowzb=w{uoL$JCDbol`)}zttWH*y$X|hu&=^m%OwCKa1a_WU0rJHob_P{tE z7i_|?QDvAoek*nAezMp8b|ecSk}+Rt@)j&6i*X61ZD!1(ALAby&cV}{5x20o(ezyQ zxK2z`JiGVYp=|YXB*estR=zkVwT>9?`*=iWWZi}}xccnlLe1S-c*g6g!p)D zvel$ffxPsZvzU3~`%|-IL()1*9xf7orIS)G@)(WUydZ@W+_>UggVYvD#3rcFige@R zRaC89kh6QX5)$dng0-{p4AG!UN|N`^QOK3Ir;ib@g(oM^VwblHw=W$ed!qpyTrq@8 zs~2IDqX_TL7~?!Xbq1?k}a`mbhKKL5blhA9$absgs){JOX$*472RB>_Q zphYOJeZ-Mh;k>(WihzhXQGx~%MH$E`invK?$<#wZQgi^xs%UwlCcV^K@+pownS_L7 z3RJ6v=b>GMM}@KPya!g6Uwg*Upfj_kSn=%S&RvGZ(|fUW+(IZ*6WgZ;cpD7~FZS_7 zUy3S~^Yil5aiq?T`zOwcb1aLMxq*m4pRdYZ&#qB57<48xD`xj4+Q$bhOVFx<4?Eoh zh<$dRH(6^?EX6onuh+<4jwG7R*pK^}{kZL3M8N{BnfjF&mndDi7zf-olCzHSo~~0X zflYTZ(8Cw(~!gHDV8+voD6XWri4eDn>KLdA`(KpF-xVec;Pk8a3;4=NgWsW0sy z)ztF7e;3kA;nb;9@(V%|?xw}Gn3jLHA3WIm#DadUDjGNHqgl3O8x>3CATD)jtR9@gp>=->_#b8dn%ij8Igq(`G6 zkes6y4KuvJZR;D7)gRFnYsBQvwYj`@4Ou&M*UAGl1k!kmU3hEq3tJS%tIV`y(6W3FI-2le?+B}qlU6=!BJX_?T68+OC;NuouK)M?t~m$z=0ddgb5Maw9`mx6}8~Z ziU~XoO-qQvfng&Ck<;=$Q|7u+v&T4UxH^l=p1}H9<9HSCjI)KFIMI0QG-V|vZSFID z%t15?I~tA{L6uxa)1rjnJM1}^OrP#wH5^rbtXO-Wej{3v^1UL3Xf`caN1b64$RTl z`dr<{-r$0a?@(4Wl(oeF&2A5+V@dT!mo8mWLQI%2@o&b>&5a&CddScHukrhO$PKcc zwoY#*n+GZs1}sH2r4j4@B&HtnpECXX^0M;Z<@cJb{C4!{42r*f;*9^7e#oUBY0LlN z!{oQb`AtMKf4~&dHS0+FhnrXvU6nJ7x~FXWeZ;;x&A=rO8Q!ZB`xnol;FKfuC?Ul2 zZ$YmUHTaM08vn9${O|Bj%+x6zYybZJbnDhFCB%dY6aQxZdO>c$#?p)}=dC!HXdtJJ zc(cU9fCg$R*ht=&L=;iIeEPU233utIEZoI!y+QJVB=xFGO5;-)pY?{cpI+W-_#7t9 zFY{Y43G$yZedTxMWyQqr=kFKe64DL%OG4p4%Wn~(f0 z;aIRCBU|R;#@%Ps7`N@Wi*bn`i*X5)82?T&5a{PEo7jX#CZ>cLd3<6md+vN0%$pn& zNy6uMxQ^(EX!%9_XW74M4iAF9bnK{O!wHW1Vyg8|qE{yp?C;0Nj~@w$i2oEybZ`*9 zzCI${8=t^1^m;8}0mgXV{=q5n1bQ_QAtACb`9yp~FtN#B?0xkKA$WU*f%uU3=6St;*TMTeUl*n&X6w3_q=>U z>h+iSxj6sy@-;uV{ok-SWGY3Ukt68WrKxNp@pEy0(}Ec#8+B&*h!Hd_mrY9Or*TZn zpIZL;#%Vn3h74fp;w5Zazm^db=i>KOC!33H5+{ycNm+w!-D@%DvgAZk;w3FhwZQK$ z_(19$^MX^ijqXV$V&C86!ehxT=(i!!=OLHw|F-lW?;1&+mc!VwbrXF%G+_H(Nd$Y+ zFk4CHuHMA@HLKZt)B~T#yJ%9gJ8oOIGI!Q6diC9eBo|{n_mewA2Bx1kibKhVf5kKz z>9OgdycYe|gF(Ifv)av#`P0TQdF6gN{N>)Uq)Sr(**mHr=)ndCPdmoz1LJAkeJb0w zZe-N39?V~9ygsR-o^kr_56|hfTOTr|F3Y2+-y?Qn8C$&y6P9gbi`xR)HW|o0zhCfy zo8-lzLw8eFeo88f7*3wNnX;y5L&usdy7gyo7!|kA-p4HA1!wPlYWT!6IDZBTbXu9R z4(oeVAbq9o^0=5s=kJQM`WD19aoB8{%-Kl2Q~{!aAcZM#4t>Ds2O)9{RqzYkHmqUo z%JG!QU4bR*HnM*GenS5R`cvxJ)<`$8P6+TM1Fq=|_;^{;^{gcaUMUGmRgvTsZ5F%FKom z6|0fO(OecHXYY8Cqi}VK=W)dU%?B*RZf{>}sZuSQh<{m*U#fa7GWqSN#_A-luIP?F zE|6;v-jcgmd9u1#6Zi2hm!E}GpnN^@r89nI@q2QPr=jL#aLPdba)puR|9W=&JYHe8 z)NWb@dtEfI-o#R%P&Ul8QM`GVM2^fBM2bf`?9oeZonOQDcX^pTpdrO-RwAt~fRpF% zV6VG?IPeE8ugmA9c=G;O*vel*urNd%;)aa*+tVvxI?L(s5{` z(Kdg3w~Fk{Kbs>h{HW4-2L&?}XYZ*c+*{F;v8P^&?J&#wpQe zv@VAANDmsm8p)*dI&2)vvEOYVLAMq%d~a697e2*7`+3amB;_-TAyul7X4Yk zDjipsc9heBI7T(-K(tE&cJ)`YvP&T%{XUW;nh7r-y&-e)S`^A|Bd*JP3^ppBKMA5_ z-P&ZZiJ^a~h75anlL8`@z{?w{JnA?PpPWYX+MPQe62v*%QloJV63)%0WUo7{-adg6 zB}$_CaEUizLTp*3rC#ka@&NrR{SR<`-#n3$frT~l5i{)tbEg<7f^i+Bu$P?sDoZ`@qssrG&!k~H!bnvaNd`nk*{?f zQb)bvn7b!gidLm`ZfX7iJ-0nB5gxB4XYm>o&TNAr@-@dj-ikQYL>y<5-yNb-?d43| zw}LxUx)WY&96c(RrF^>EG}vOt=C-#CX)qyzPuRzezy z^77_!yrV6!uuez4TBT7(`QjUqOu%bTwCQqCt6Xj_A3Kj_)?!pCWpsw{ElgHyt<6|= z$cBS@9i<)NU4Vk&ZIj6CW5uEn9oy?@c<*V&G;ck->uWf3)rP0()FeN%qFQYgPlaGl zHki>mr=CUc%&4z3$HP(0q@sG#nHzZLYr&-FW=trr<@#eQo;s^>E2AS(`|EX~$zTLd?(S5rTJ<;C%>GkczI<7>b2nk)TO-+!|06x+ zX2$1l@3uSi-DsSMOTx}Ejrcc;v0ZD^a8Dxri?~uX#Dkr_&{gO^Go=E>=e(MU2CTU} zGwjikt=Q|>nd;WBiMG!`m%?UDT)c}yB?@t3@)#!WSj@(*4e>17mu_{+vU}WUPTI7i zs)!$Dn}M!XYm)wECte!5Q%Iq~ee)z%y3XXtU_1JbTS}!`rC8EsKL^k6K!0&D-4@)Z zb^B6`8oZiy3BF`Fwu~+B%_*u5V3=ntZvCJ~hx2$mTZwh(WqS2^!iHH6H0pbo88e#` z6q$e~F^sqGd~q$2gL#V=<5;XLH`h+b-*zz_3V)d|SfR8aHt;=abqOxr3ZzjjX9!|GAniOqP6=DkMp;mCZ^bVz1W+vyCtHHsPCM^ms#a{{hDCOLZu z<2OVwa!5-u2EAd@u#x0%(1^{0doykCVeAeKWbTtZv@T-HEC0(B?pch!eMeHLQDYIO zCsTGGp+I~L$?9Zr{x1nn)Ds)*!<*OXs9L2SP8WOeZhmWAKb@~85xvN_Wc2juYTw#E zpTl8}6pVe(Fs~Rk4sVFJrzk@USHf?&anffVL!DPsd2%o-CN<&Wns&^|*p436vT$`x zUtZ4HL;terQd0YiF(As+K>PA4hUPF3`reAx=Pj9^57Ih_jpF}^cr(&F8+)}gIE!~@ zq8UxH8MygDLBULVG!aVf1Su$#UPps0D&F6=r13%MS58d{twLNG1Fu6A*k#brDZRLc z{|;^a9U^(7GhyO)B8iXhz32IpNsS2;|7~>mCs~j|(%?TJ6$kEy(z~$qTgl*|rP#Ln zp1ehR3ICw+Al8NU`Cyt_J zvnt}n9EegILRk^NYt=#`g|xJ2Y{MD%a3KP-)4NksoGs0`yL&BJ8qH#G-*I%w7|FR8 z0UTJom(CmZGqCp<8kTSsf-8yDGxwmdv_&bz!R<|}@kwyR!OqI~k`j#u8(Ya`loe&0 zb)b8fuJmnQm133KF>p`^Y~CK@@Fjn2^g8s(ui3G~L)z;z=9boY-#*2V=0#Z<)`(>t zr2Hm|W94V`vUw)Y0-!!S#6-(xM9p2GmL!AI*}?lS+W9v zgaq`q)}MRXC2Z5WpbnGluJt5nT$sFjDl2>U!C!6tWsjcS8+?l5JEV*zy zLJq%wazA-W)qt#Jv3`4!2gzVz?nt99{pr?!5aq3PGcJ^86HlioP<}D)2yURQh zSJdJMZ+8XR9bAZs)lr~sSJEmY!O@yG=iSLvr5gEiS7X$mZj{XKNZqFGQK+M^aJJyV zvD0E-GX@MS#HQ`fjY<88D_d9L+GZg`2Tr1$lRp*|&Z$j;RVz zxqt)lDh=9jPab-T^c6ZG=A39;Tgj!nk|~f9tty`EwT4q6VJfR`=b&Y&%p_@~cZ~u^ zXB*D1oQE?mDTa3MO4E|A)a^W6i1xbTm>FnL+l(vs zqNUUP1p-+y`;dHpnWr(}v34~9BD8T!k)Pyf%$*h7J8_XDLpmCE=tGB2T^QY=A?dS~ zr%U%<3}~F4tM0FiNqr-v!JCO1anEVZ2oNm^X+~(t)LZtnB9@FUdVB(<8bHB)e>2hu zpPL`^=nF&N}QxTCGb6F`h?94qI`& zA3Q)Neh&(1!a7?kX*BMaMPaf5GVv=&g4~1&6aO&sbEu?7ZY7tm1RBG>!rImz^Azou zsqG+K&g_HGuL*L-4Klyb7Wsmwl?wrc4=l*TPLIG zUwonv#6l>`zav9QU9ck6%a@_+R5!LxtS^UuLh6k!(PlIo&Riwq{Y4!2mO_OHv9Kmn zdRtPZPK$%Jke5~G4Rc}0Q?mXxAEJE4QnOBdUR;uF)GfsI6(U{SnuB`HXTa>6r~0&mjHwD^+SH)ygcBrb4LGGXwqBi6I}j5riERxU zt??O1NLI_PPCrpg+>g(%+)i2hIbujKPeskzwJBYrCl_w+A^nFFiql{nfPub-t;TAaV3-jb?_tS+K~`_zj5r>$5R414Qna1@#^s}Sbm z@{&1|mbR(P=ycSICpKD!uK44h)$hAe9{kX-4bJB(He9_ z28aFZ==sE$Xf%KNHZ%|y6-oTp-VhSwh>lG{uSp;*@)rg={RPB_1rrkeGxmUb72zRK zQeF6&_^@#KW%0j|%H+%I;@8n@lL-m%m#>YFzkiBH04=dGf5kZ)hzSkB&rhW7<3m{d zS7T7L(c+jN2@Lx^jOL^FN1~Fx+}yE#Uc7qrksp^}Vsz{edocy^ z@xN|&`QOA?R$W)k=I+>TT=e`%Xplc=&YmVdCWg7g+j8#n7|Rl5N_CGLki&qtg>grEIfuVRSfE+WQ^vX z(d;{amqufEuwiI1?mY98kCHK8abDj$Bj4Lf@rKdp%qUy03?7Ge6P@70?t6ZeC{v6k z)oj_d;|Xzox4HfDEn1tjR4tsu1W9nP|Jw>0BytY`oj@A2ltr;=6t zO;$;hx=3DRTp86f3!_GFA~-sd_xDb)_+l*M`;;X?q@$8Y)IrO+tB5^%ke7Nh6nZV8 z{vXA&7|zY(OPP0A$=tE^^o+*9z>=t6DVevK(xw0 zh4NLf(L@j+%0!ViBl>`QJPAx9F+3a#mkg9HR1jU5CxI%-;6Y$jf;6_bcrAXKX;cLH zd>~4cQ($NU<(ih`(*E5|@;+G|wq$HAsGEP;c1D#5w6)%otk`hE+Eq!T-*HfWMd5$k$ zf`5ECm(E?}ZBPsvd6G2IXed_^FVT<-*Tu5y%zesN&dZZ)$H>%h8W+~I=lb18WGht_ zuj@PIIJ-~Zqg2&`Vo$X=rns-gudLZ@xP9#wk)cuYdFLuzj3+mxuLLQG_f=A2(pU9Q z0V?K+=DBYo*|TLP;JK$bw^%IFWu;_+{Ak185R|MH?;3FoQI--qwd(V4X+pSU_1ABL zzY;T&)CSsBPv&^jWY*SKv8SdQOHuZ@bE+Ah-)QTt5-pxql~n9(DB@JrU@o$jXs%~X zLlrqhn=w(TXK8&ksYEu*7f|EYNX3Rm$uvuCkn8i(g;g97ad$URQ9hMHyt7k!0ZjZZ zq>fHy+S0A2Cm0IiAE_rWT7g%nf|5CPq_H>1eke`+d8C52wzmGoS-4)kdL@gd1`Qgd zgh2SI$)syEjSl_#l3MI`bIn-x2d3lI+#z_EXhV_IUwT*mZY0-g*|X;8(EN)+nUYkPc&?GzV_aZ2q z_ZtjQjeA7P_M=Hxsxo0uu8}Hteymc?FY3`o(&Vj1fu7ST>?DQUBZqxnk}7tmMxI}D zOPI{eM)k33D$2w-ht1FO?D8RWISLYVY$6>->?1P5o9nkualj*y7F7~y(_|fuy496u zo&4i?(Kcr_9;r0Eet4T5M~{%UNMmxEJ!9~&QQUjs$*nVo`Jl~3*#dG`C=)8%GB2bG zJ*yc9F?~W6aEpG^SMl`OHMZ}+LgAYANfW%CrlaRg$>3*V(pp5o5;h zqDh~2l4&e&Zyv#I@fhZvQPZVKNn?V4Gm?3fTCL`{*pN$gz|EUC$(1V?S+ZnF3H>Qj zouSoge=$ud{N>A+6fa&JrDGAA*GR>_t-HB)>kcuBT-2^okjFPKk*Q2mavJAh!Y1%0 zhdySed7DlY*4$>p&SN}FD9XlV{g4bU!mb@>{occP=`u5YLJu?x;eB8N_7hys~zKNj5pw2XJ*pMg3*Ky?JCBo7br&^&hl*|#wCb#qC zs#TvN*~mE z^Wc{I4Xmp5Wz{h0t3fJ?We8`}mV@{tSWvcjMJiUVNq(1)xb3=(OOj)r(^TcFuw~AAGmX0gR_-9uEGph>=D3zCgq?jx{P!#*s7_akSg6Qf zsS>F_S587SCR$Osb~#jWNmOmsn|#SvL^)sKS)`JBl}qBBF*k*CrN%OKehOH=XT_$& zI92S&*p?-T_qxmajk~$=A(3e-=94>PPV!s4ljAs7>d%ChMZ__*LXcZfv|>^6l`g@Z z(|fpfJBkW*N@C@Z3Ey1{@U7I7Vsh0i<;O}K%|*$vLZ#1`g-(n6H_q(q!t1)(uA#bjx=tK)!Lh5K5T30O! zNiPcNw-v65U+4Ev3}j$t=Uzl9%*oz<1j8E^z0|n8$NPUiGYeewrxmYB4)3tpq-bJ?I+|BtUhQ^aIoddz1_jvd& zoWd1qkUg~--XHvl3<@Gk=_=UxUF5=*P_%iA(7r}dIsJFH-FX|MqqW;9GIZv02|ZoZR6Czg>a?mVrV96)K~#Okw45nDfVXY*t(r|!a}7Wu?| z-j<8$MqsyZBH6ZFrE?}2Ual%{zE@m!o0GD|goNMO*{sy|VNsKxb{6dEQ;(p|`xsSC@**M;O`k%I==|~~DRb3+ z6Lg-(7<|={b^U9mg#2}UJUx?D+TJW_CLZ|jj1Q+~u+h+m1x>zf-oDLDo!=)WFDpMq z^0Hzw_xTPngk9$*t}I*ClQX-FcArXxaWWpsTY!TymW{nTaw$AB*)88PwC70X4(Y-H zFCnOoj39rTg<_9z`gR;o&|fUZe~i+?lA!nRh>i@$|Nb7LUCLn>dxq}4jlN|4PA;R* zs@vG7a^!)>2_Aa-uzK7m_CEK;Ufk3UiU3A5A4p(~C(YZ=;iKoSf4jK?!fkLK+$hR?ZxR`rs4H9K(eo;R^6p81nK5%G9GgJ!Mdo!<*4EgaAL5BF$LrxRBn2a9vsO_zQfu+5Vb zze5Wcw&fWQ+-5Rr<2Aw`US|HBlf->IE61_RZHzNw`van)B1sAj;`z(BB#8!DK-ibb zKXhs}1=^1x-JK1xf8Ax5tQgp~6y|0c?yeiiyln??KXH&|T^Goo{)T0s_zBrL6s zb|x0qwpd%5%b$FU3E|wmTVEFT&dtdqm&CpnqEb;{Wn+cX+z$JU34Dx>qhz~UWRnJ5 zncLECKyL=k9!|{dXQ(5Nv(Uqfkg#WX#+q~g>@q%vnUkhaamJ78M&Wcn_XR>vQj#T| zMm6I6w$q$Fai7NRs$&qMSfRAU$;pnR+YeD?@KS~k7|Zr~%gAPDz&T%WMh|I&jpr>a zTTGx~t%{79(VK^7ccXN+L9K`*)Y^i2?W*E+^&AduCelEPGrbpgPaL95od%Su*?>w_ z+EFrZUfS3C@~Inx2DN!1N*7gd^1@jXvKOX=iv=1Xr0pED;9y8Y`gHb$9zBU9fvp{! zY1e-swM&#3B@j#(>@;;;AOxo0SG?>BJjLprLIEJBxN#jp_N{`|ro z7A;!H+)d|czhpa^?PBH8_2%YQqA`?%R8FaIiFwc6C*B<1b%a{OmNR_dcy`ZUM*QXN z?Dh@j~7cy_w3_{C}WK8Q4s8lMs5%EJJSbpF!eiz-i z_$r8HE2YNOkBEK3&^B#I)ps@xi)2QnPO)7T7z|QlG-U;~xS~J&ys6QCiTh6=HI#qP z@>lUayB#gpY8(T*)|Q^)pT#0eX-1A7!`MMR$^0wkS0;W+&T=&2w#*0LNGHXh?_^=3S3Gl9z$?oo2qW4aHT$LRJY z1|(Yf?67Ckt^#>P3g>O2$oT?MFL`5?;| zjn~= zWQ$$QA=-Anz}Uh0*brWilas28IL9bG<}t?xIWqKoCXUSQK$q%enSTBrxl=l|0xm6L z@R@vUZWl(U*#~JgcsKc9Oyp+z_FP#!hS^UZP?ltBWT?x^;A^;dDNEW(_h_F#iP2@N zP<8cUR*hWAz8i-bmah;6*KMa$4riWTyHD}19XZ&wEQOcfBm3E2tc@DX%AsG~1M%mn z*W^0G+K00~p))5&R_4iyzAUmCM6qQFSDy*`U<2A{&#c4c_o>JSUtW(U)&mMKfallN#Wo1(v@sp~M- zzq`bzKC6i58|XMAf%At(riA>xNR1HbE5UCO$kM0IRjXD}vu4ddWwIhoezk7hI@*Xv zjC6bxCQST$k;aysIB|jj0|tR0qH7Q?7+(#mnhnACFP@5GW}36 z`J~AdGBsrGU{{898byHy?M0l66zQ{q)>bG3F@_qg#?igz zrvaIsbSXcP1-B2A>Fa7D){~KA#*<{75oLTlh1<=>(S0ak4Yx6@vT?xbojLVcVm*z6 zqbkVjdxn*!=Q$U~w=G3TNGP=iE~j;tv()Q*n#$=Md7H5;JEnC>`N;X2&gCYv`0ioZ zhFl`@)pq(XO5niOfhi$>FOiXvczSwbZvMZ!D5Z-0)TvWcuU`F63-UX6?)W$I+|Bc7>d_E;)|KBn4?xrCfiV*rqjZQ;Q5( z+E|L{$!L_;qMSt9A;D;^ZLzhm5)ZzW>_gei%1-tvEtQFdC=-Ra{xR`dob0Vgj*B8X zQH_1tbl6MZ0d>iQM5#!V$_A}Yl)dHGO%=&YfL2adC-w_V*5T-2k5W9(R^kAX`@ygn zaoyx{5YY`PA(Ep|*xHlU(dcW~h(UHoW^HHtQ)@s&BB7zN@&L}%jyB>Pl7tQm8C4~nEG%t> z=#a`=VWuY`E(t5~0+)KSl?tU%K#F&m`}{%dvF*r?VKvZ+la)Gsq(O}8qy+hbNmE4I zhypNAF*-76g|L&9l)%E;fmcUH(tCq}t;@R+@c1ONm%qU6?mluGv?!HE!KSnjVn>Kv zOS=y=&en~wS3M}5T7#LTtq?&%h-g%@e_Mq#>4M0!LF77Fh+4_6_s{bCOjf>sz82)) zD_;b;2@~HINszyL_wIiRa;Y-^D+Rd;6DCZU`1|;_g8bkg8`LRzX^6VNlhca&Ozz&8 zG9}B>YyNy{XK^BPp<+aqKV#4p~IBgO*KGrm}g}LI(8e%*Ly} zSXo+-DtiIyl+1@J<}ouTE@1Qgi3}Jpn9JT8v0aFIvqZKn9?yWmLzysg1haSCLiv?X zZ)w)Bbh!&rsX_(X_Ucbg?%?rUPsFoBEOPU}!O@YRM+aH#b`2W~D-mBI3RQ@FYfH{= znoJLo$5n?PVeRBV#Do2G>obtPgC=vwFBS_C*TfHzY-N8-Z{R=4_dMXugb5QSOqeiX z;uDfR$sg+>7h>DscbSrn$I*W9Xu7s-MpkEA98x7PszfC+EPurC3^%FTb3U`y9wJBN zQEE3`#i{tqjIqc;(e)RZRL+MQ?GLm6?g8%gE5+Gjn{eykNA~R9SbX&*MS?fbX@ePe z&d=uF($0*3QeIk>WG7*S6TQnklg_FlP( z`eYvlpUBPqV`I6oxi2G5<>%q?Ce+E&j)}MK;B;mf!`w6DHn$byI<}_ws$FdD--9L_ zE>SY!6=9Cf6v>oPl*6CvCI4SN)C@pvj7axw!=qey@4& z<;9Uhd+~6OX8D8N+-lR9G)o>(_I^*McsAhb%Jvw-o>8IZ7}h-7$;`Yh7=Gy{HFJAW zKXW_A-n~QMl&YL7vW9gny(nG#7}uWe!z^eom1+pF{(3b-s#K!pwhwg7r^ENiWa=JF z%foH`KMV5r=cd!F-wCSJ$i(xH4lLiZg<84oxwmH&W6$N{#{QAq+B#VL&d03-^@SjB z&y3sdobQ>Bm*tl;yk07H4{MA4&@;rW>w;gE(Tr+YmcqGn3N@`37a`@O{~*7`WaZkm zYb;u{h`6{f)8&7UNMctSOjfK|G5PoRD#)eT5Gz%xWD?{iz9~}WED7=7Vnc2cY#926l7qQu0c3=-46u$o8x1daG?O#_jF=N!TGdJ13U@8tV zH5>A)SFcjFYE`+1{CnlnrAySVT{~sXgo$s5$%fp72@@v%`+QqLe&CPUkeeyZN%FqW z{)?~B7<9x(`SJ9*ib|!jkesBJdnGd$C_&&I52DO13GjSOU`T@O2wtnvij$I3F{J!9 zpx0^9>I~wyUhFHxue4qIt=6EmPD|mews>5BghG+PjhoMq-0gjhL9auVoGA8nV9K(k zMDFa%{Nuj3WXMcHbO0(eJidN|SToseggCC6WHT%3R4I>*b8ZHXoxq?rjYzNb=Y=Xe z6UNVCOskUk_=lQok$(pHn*B*Lo^OqmM-wJYm@r|&go*DRNwWMwwP}XAt%1XH`_iRL z7us|jj7{eijH;6phitiVRwR<8>JY}&iKbPPW-Q(Q3@aB0^adq43b`9bJj#saSifpII|g>fKYu$~I6kLN-EIV?DNd2>k{@IRImK}m$;nh0wt-r@ zLo}$@fTlxNqq8>S%#!ictyh<0k!2X&xjc!U>9s}LRyLMs#cwkUE0lT> zt`lKaN>s^e=>YO?slz4N9vsiomPiZ{_JcJ@y+DC{S~ud z{UMVTue0=7|A0jcrr<0tgXe`^ymhIJ?VTgowH`+K4F8I#9^*4O6vr&>@ zV@9X0^Ql@OWlGAg@V~oU>V~m(dZQ zsKMU$i=XzOhliQF>H_92cIZ?|WGPXDQN7##;xy+!Mx7Xs!p2_qi~fngcUM`u?kLd~ zsTn4Ssy3s0w&v!ZS?ss$Ht3&gbnKf-5 zK_z-HwPkK0+P~O!>$U37Vq8L}R*B;XF|Cu*NRp?PPEJY`VqA*z>A2#jK{9ob@~)EO zNbyxtUgY@6e~B3Xqnz2eixc}#bJNr4btT}zRql9(@c6_LUPsG8s3QaL4@oet{6joB zv>vA#BbYgT8Z-OXVd~)C1pZ91g?nD*>Vv?PH6yq8@8fx_6HU9eApK8thmM;E_7P}o zC;kZ%xVn2MbM{|IS&wDIo<;22=Ye(B(zLEyC?#C*imL1dy5!_=fBZueQ`WvB`XxJ$ zKK>12T(pgYuFvgj!quUv#+kV|HBhRXK2VQDW5Z@Vt02l)6V!( zsnt;C&m4~S_I-->n8ftagUIpK{QVCPY$9umnarC#of$J{(YtjClKmfZ{M;*f`)AOt z;G_&;!Qkn#2--7tH0_$Tq)qD;LXKNvZ)48U6|-nsqZYG{JeAXXv28gsC$3=bgrS^% zEM#NybGo+c%7D(jIr}b3j`KtGWGqmVN)c~(q7$dcYqNqZd zKCmfu8`fs{$}Pl3J*Rv7?hNcUfUB=wvAkSiY2}m#?sT#S{)-xXg@g;y5WtKJcA0W|wEabau{6<#e$m znVEBZS_gU$8qCy{mwA443VnMmVCk&E^q+Q4-tX4tsWfiZh6xMy;+QHGv9TBFKg3Pm z=6!TA!?ryU=Mu!!{!OXZpbldw8a z514!W9<1#g*fnDi+)4dNFx-KD)br7EKjs1+8=wQ4;;!v9DNwmwx%57&DoBa)A zRveYhD9jZaKEC%y>35!?C*IL#*)j&!&rFmMODeUByv-(Y;@o0REZZ(pyH5AT_vtic z7!!sxVeyE*1SRUZ?-|3)9h+(3nqsr?1N1`dx-hbb1DlTo^Yr3TO15i>g+YTRE(E`D z6=&yRl}*KT_k$nvYkuFlzjG zMhqRmcFWH6EMdXB*DuN0S~NI@W@X5XC(Jp%ilwVoqPx40yRXhNe0?~Fjvr)R@ABxR zDTk9I@%k7lr>Tw%Bq%}8xjAEqsx*P~XD?DcJLIj=mFg{fGrDGGIi7^2jXhW0rZ9fO zScdoQ!?Nf0EE`gaeUqnR(|b8nr_W+m!)O+5J-_W3wQ(gD zjqRC|nn3A9uH0!*hd-iSi)nP+FqO2r1av7jEe2^KF5Q>U3(1lln!L$?Mq&B6r{BUt zhwiH(8&)=UT-iM7b3RwUab|Yk@+n)j=nV$h%hQihD3!c_bPW%W>tb=|b#SsQ(qHXc z!*PENHWr^;iyBSUzP1W66YKx=`o)9^6DCZ2Ur6tvZzsr2{9!KaI*6rJAk!D^C!=FL z8_z^zX>AlPW(ozG*eGJ1^QG9iT9e;JO|dRR3EH-RjWLZl(pJNyRfi~9;gfjzcBqq+ zsMTdO6UU7f`Q6OI&c#t^RI(=?33GEL=0cF^v|0)jH`>hRE0q%~O`;G!@)==nrX@CO zJ>1uH!F}^8wjSQcySM~wY#k|5Jo)g_8mEdhziq|1?+ zw7+;K3(+SUaYZ_fMR9mETdrrNea&pB)jGMS*ve9gw|^|fOBn6T>(^>cHb(_%vSq=-(rm^y24)Op*5cV*y8RsgpjfgO%4>|1GauIR0irRXL!06Q zT{7YNtU3jHjhghu>oab`M8-~-#^DW9kcJzZSy_`WhbXt`5aLtkC#xLWo+4TFc-?vk zg(`@vEy!3vBqtJ-9$=+~97`JeU@6MlDqly1c;`RWXko``AEdPI7FX8 z^J%g2GJOl!Vi0-J#u?3R^x_(s+1bm#KO<+!f>ahsBz!XSNwCKLt7sZ^G9?=Hkn=fe zPz5=k>1A8*Uq_=-(R$<~fF;Nbq* z9G)^3zc>|Yjh3X?7<6g!P|5rbTipW*dwGWa&(c%1N1b zOk7kHDk0R9lC;FVz0A^cAL!V<7pWs2;u)Ytofs$XN0FdbLtJzW78#q+p-@^%Hg8X> z2BooAX2;P^M@($|uk>mP!4(@#GMOo)JI(zJ<%OtCBsw-p2tE~2F^SY`RGw2C7I6Rh zHTqBN&+}jvNeMQ8M0k&QBTL zb#~qeCgj-(j=af2-QIo3{dyZmZ#-e=#_dGMCt;r^FBV~!dGPo#8~2?-rP0%{Q8|vU zo6o(cSLrLx4$_gh|VI-dP=0VxK_N1VhFAraOk-c7L zqMokh(Gzd>AG%5THqroFBdUZrjLwVf89ycq3uf)*-Mht&>(_Yr#!r-u7QNgRu3+KD8Mrm7 zj=Q+Gnzby+s_Aoh{NyRSmM=kFsv4h$9h)#=!h{JEe+xpyC~GutF}-uuJmkxurf_CG zg|q0%l~#|X+`;*yZZH#n2+3IA+S(dROUsmyA0kaf@9XPJg9Z&q5P~~b&4v`plG?b@ zE(cj$G~_E&nY?*i$(J{~5I?18)1(-;cJAW3uZmU!##1tj9XU$mr$X8CWKUOsa(VJn zwR&-^zri;UZ*On1XU`^23}l}!6S)c&CWGUb1DRQ8rfP8u4qtmu?G{}rTRb26a%acY z)|w}G+)3MP7(L3nVxKl0c?uUMXO@fus7%drGYMmE9D#-0pWbCXA0$2?i> zc^PO%g`&nhDlHtym@TKco>IT`7o5^$5P2+!i?tn%>J;GGuKnEb*U)~@Sc+syOQU*O zICt(QIcj#MX1O91aV<)v!Uhgr^P*wvZj>mLhZ2?RlT-JevsYizxczX-6f8nUMIgTV zEELV*A|J=fAvIZZ<|TUuV|R4kk`*u$dc8`^j@Z3F&3TX4P@*m4T9>9&i~9JT+=0i7 z2ugJxN2|gvWY3+IM=t`YP@xb~|GX|T66?&lvDJj|=Cvmw2?okms6wp*<{aDPfmOL? zjBfSClZ`{V%;LHiA-x@BDA54xR~K-<6-keo6DgePi-#U-hcsl#nU8E4jCNOfOP0ez zZ;5Mm>De$NRmM!@FOr{B#*YM_NtGoBpdN`6f5zU&R-*i0@q0tcJ|DPaT$Hc_M@3QVQ@&6mCKKd5DwNY>~uQ(9nS zWr0?mj9UB82w_R|NR55zt4PU`Uj{0hF!4Pgz4!9x&rj;qsZEW=Z@{+} z(o0^G;$!=J#Z(!Y_`CQXd!nRg)XvEXb4$zL`78)AP7>RfPNZw6&P>~M6{U?d2f`;C z)s$!gf9B+c1uPgN87m*I*7k4aLUV z8fC;Y`t%#fZGSbE=AT|&zrVrqS77?`X5xFqbYK395w8)GAU9#cgo!`H&xz81ny>Qo z`*J7Eo@!6ij^(*~=pMCdmq)2HU}0%43uuMXT<(FF#*Zi@K`nkuy~fhSRPwr5lu8A9 zWg6cd+TmeYv4wCd9kBg*nPE37Gg<5;^I%hFw>_nmgbRk;MJeH~BQrtqBt* z{z61GW)kGzE4o%T#|+T)1iX7oVAPjMgpz`# zvWi3Za8_`f)ABMhNOemUQdSgXjo$&e_D=;R6{ob~sJyHDu_b(^%Np66<-1j?F65tW!%` zHyuNe(iWvugk~0)sUNUrr$2M%3?gT`bfhmM7*a-)@s~|kv6_$V&|oNd78c^kT9{+ek1Wr zsa1p8O`B4yNe`|DNOio5%~N~OuznL7Hm=R#r^c9vr?#d0;#DWN|l?AdmTr)flB%DVf4*3=okm(UNlIdb;THlR%W+Yq(z_xHKggb){d#^PF_ z2G667>$f&cWa+U-Z0^yXLm$2eMQ#)!M+Vhn=<<`?@bKWw(M5C_wdZF=`OBk|n6TQTas^j_K z6Oj`B*An;sGTYC+7QX`MU#p|>1si&e2JO3W)8|j0)Q?DHR>PVsKXMBXcX!Tjn@_8e zOH;P}Zw&DtShf9(_!Ud{V)>{(X}@uUxJHv&6{cj&(n5oC)sLMN)$F)v>KE1XtENz8r{`N$P67E^54*M_O z#^c&WHjN(3j_a`^h8JB+ittOfaQC>zk@*7{vgx96=iflgoAd0vEQxpxQwMcp&8aKw z+BA|;%cPfkC|!s2l6!prjgnjv;}H=N`1tq`6cqH8C>QSpgARj1kL&?A_zX+;B(U}5 zSxzqQgN^nTbLL-T-rloZ+Ow2A&U$>_yd_p{JR1mjD;n5(4gT-^c>DSh>FQ46qQ_oB zHZ9__3$I{to>a^n@>G@>h-MzcA6`V{-t&B8L~BQ^F2z&OQmXhJg#m&5VtrN8#*xHK*hWP8{zMawi z2QX~iX@c&ZW6!QFOdPRM2>dA4P8!G1A=7y!3*BfoE}6#gp#zwA{H3TmpEADhKqk%F zDyO%7@n#-~#_ffJd)T;dIWyK={wyx_{#R)?_8{x8o#E7(s|>7^Q-p@IYT{Ui4V}R& zxiz8V(%OZLnJ}D(qH=c>AwJi3Fsgq)RvvvKMfl9QsZ($qw3?GA&v1F=NUY6t;xbud zV+B#qjxciIPzLlK$=!%}?z?Sa{nnKX8#j}W;yAW;wm3K$xc61~2f2+N%Cd1|7(RR` z^EO=mO0gu6pw7?16DPR5rxPny9p~AGKI}HMD9#<-c_mx)!cJG&(jYf#@@@&ORPO-!=;=1 zc)WP^XCeIqbZ_X{WdnseW-j7gocI?E3REqY!bHSk6Ct1 z>ZI{w+Z{hFyn?}6+yi2f>h_IeM>BBvC{B2O0dTjWy>Y~s5@#fr0fmJM&ok<)kO5OeX;x3sjt!pa&;D@#$kJ!b3dc`RPF z1&=3z+&g>4*mDu}nv<8F$@@Gxa~!{K>_t(p)6#b2Y(|Y8%j_9Dv3a_h*TG?2y<+T| zi1&Vk$J<0~>>W_V`fy_RDt2F&raw0qb&eJ078W?Wq>`tP559eY^($9%;H)HoEU^FfMA$kW2N?U%)xIw|d*mD^PMji2YM1E3xpLtGM|bStMaa+fv+K#0x4h8BZ;T>N zluvltoRmuIgu>E})Ty0_3wSIV6nELXWf^-;-A}3T)tuS4mQ`yv@it0@I{XcnE?#7> z+c6GbIZk9sx7S?{QN|(O+`M#!)BD%5;n+1f{LaDoOq#cxIPo%ba&bZD`<6ys=Q4EZ zWxAHjikHVpZr-_v+uD^}d}{0g)(75Y%bW!)TDgUr&x5#e@+wkaurB-sr`#oR56>^1 z;>LxG+_{&s?=wm2E3tOT$msba7&~qpQ&zbVfAAy^q#c5cX)avp#?`0Bp5=%qN7y)b z8M9XH#9O=v{BG}H(xhoT@CzkhkqYR1-pDUVmdD%N zxOaRXhCHLOvQm5{68=3%w(pLPj`E;S7jcjNoUOUg<&e27UCNtL(=`VR&j(>?o|8^3 zOEIvd6Wv$1i?@iaY{H_H-zG}g?Wn>`AsQ+QQEz3SLYd4W+=8rW?NIr?;&DPDYLymZ z!_Jwkb`D>}ggCxg`iwY41&}O`E7}VJGpt4VzBsy-53yG4+P4$EIt;gs*F}=4=-6)z zCDW?@enD;~b;%2%_oM)$+qlX>woaMImCG5I5=|)>d6xTOTI_6X&}f3#xNrt@=gnvS z{CUioJ6ALl%}G#y|oKwr6UmbPVdaiZ|ysaQtm%=FT5Od6#77bQn#cQ7fq9_?QW9x2aUU z7Ij*5pmWD2l+06=Ze6R3qZ@g3&4VJ1CXhX41Z}Y@g*iF7KOu!XGPy%)26R|S!1H5l z_q1W|oKX~Ub`a;|%jCJ27&><{VOwT%-S{ZV6mQai8!N`JdebIu_$qKzSaWO7F+x;o zrcK>WlL<4ZVi&?I-$-un*@SnFwzPBAvirzWg6?18c~Fc9-^fQ1-Zrn6{l}hhZ|yXE zT$?auRCVrbI43`sMl47c_4(?}yIHX86jjPOvUguH3uiS+*`Ahim9z5h##IW{>rabP zdfZ=p-2-n=^|JZoUk^OPDdCzPPf^Wg%P#7l7_FrRsIX0vwxMUpi( z)EP9MxMQohdG-Q%8gwL|!i+Gl2i$z*$BV6FxM*LInPdBtN#n(qMQ%9N>`c$Cnw0ravPm?ZhB8vcDnbmR7vJdxO`n zUUKKa3_hl*&;PM^7VvQ!X&-*90rG(nVFfHnVFfHnVB4B28WrWhpWzs;~c{QPDnZoh}Ey$#o{Uce)7 zc^ky8BZmNl^nn;%@hA->tRiowCwD*K0OC68iMUetasl!^PT+ z$h*54zw9cXZfvC8z@-EPRpHX=F`NjMbGT14wtTiAcQz9S&0k9Bg9CIMyA%I{K}4Qh z&B7zEMclU-GV&1eq&qaI(+izX2~2P8q2>HbxM#{r#*Dt$V~yFDyHu{$kmR7DG|8WG zL(WX^!=QDyC>ZF=$UY;40FGy1>%N$j68E&M3sZ*-Wc{rE9C!;)xAdpZV5uCuW9W>X zoLN4E!Rv2QFqb&C_YiTcIc8cV*Ur4)!Grrk@a{q#RDdF)IncLNN}R1rJ29^JK%$eM z(6-|uvej)#Gry0t>@*FvTL9h}eeiL#K<}K5-q~NUQM8%f-8g`Mr8YQO%Lu!-=*ZozRbn zvy63%5Ax~eYI-kyDfVef<`4U5Gy61N{+Y;-!2>Um1`qcP_<1^`6Jk;MUHht9Sx;_X ze1TrP;G0&;!Le(i(e`mI4}Ch5&s&B@NMgNClhTlo$Xt#B;pccD1i3aLl(V;=bN|63 zu5CDoZ?)3muH2<*$7STG--?FbZ)nwX7VoaDrvIwf)NJ33OmFwlZq6mV{Q}77?SZXZ zZbnY*Xz={8W5`%sT6MrS_A^#q9zuNn*=q2|A$ebs1oY2l-4$XQ6Dwrm)Ff)<%!;qK{!t!oAxtljXl|0ddGW}*q8{JA~J?N=JgRxf~iiF#yBIK%CekMS&7 z9dpynIEw_wx`>ho=G zT2!WjuQUD`Ghl9_$I>PX^(uIhEoVlOLZc0xO=co#RyJ9wE5ftq^g;RgGr_l_sn?_| zuD<>_nSU=h^~fw8$eJyHqP2Q4s6l0s_i_JX{&;5H0@f}N@0?A0S+wy|YUnqPO=?A0 z{{A${W`kNQ3YGL(NUt&63q!F|DMgTIU`oG50%cM;7F*Qf&)4_z_n1iI8@_X2tX7G~ zLG0&WqAtCA_7r8H8{K>KqE)R@BCcd)P6erzHI8Z9kJ6w)d6Grr#nj9kTMIR(4t=0? zw}!ZRXA^l^h>V#EQ>Bn-;Kse?sdps`x;s#_f(VljNCGV&Khyupk;xsQSjorBo7f~onYBe~MIoadEUt zHKyiPqER43sHj}4H|t7J-aM4f=*){Jk6C<4!-RpIsaT~mhb9cbREWI-l`2s}RE8bf zwc_fTW4u_m5Z|_g$!?<|sAd=HlqyJW<^0n{|i{eG-LvEOqr$c!kybIK)re7E(Th`;_2W>VxkH4`nTos>J98W@{T6;g2cT`$tx#E zD-IpJOyj;|C{?5?YiFz=r>iM`LB(lMK0EOtA!Kgah0NY=H0sexG=2_~t7>Jezg%Yd z`Ri0@QHA$6Zj-%5SFw*fjeE8b`<%uvM7^}k8 z*~Z{TFMsuVgq}UbjwQh~?O6viA?m*NP=7llnK)BN97KpRHjLmCM>%zTD+3pwVC2}A zaP>64c3dfhhTv2F68HwW9 z?k#NJv6G!Ub{PJC67o)+6o;8>aT>NRBpT`g#Kb2GIi*7-#GHA~(s;(6;6-!{H!j~I zPHd4Ur+k*n>u1W*{nwE{I>Bq(@|Z;Ivj?vbXz`r&A<5jka38Bo+0ZDG zP#7ji(-RXN!rO0JkzAGQ5_WD1=U=KwO87|d(QD)gu;l208zkKq=eH_DU{OyZZ{G&R zBW^`SBl9Uh)e1$Kxp+Mr7A+&UM`~n(o0m@zCG#aHs0cyDbD&L9qLwG46oNAA$6y}H z^*nt39EDJ_8bvb6qHL&y;8hEes}agoBYE)p8ZH_N3eo5(=%eG@*%u^)+~=t@h&T0I zlF5n4K+2XYMuo!CR|*Sy^vKN6Zi|VGlM^2HkPF*ZbIE=%w~z1U@THfO3E9BI?<_tK zPH)S+7e$%cr-EVJP2OU5gxq*e)WbKJ7b|9{Ph!Hth>edne1SIe%S{ILMPi~}@y0a= zg@l5-y?qh;?tN>OSmdgV*Ne5Bcq1AIQ8!q9B9Y1^Gw|lt8MbWO#?GBP*|B{qM=sn& zC9XSOZbF@QMRCg8i`?$XBqpiQYSbia%qU+qfMa`4k`VoY`%iA8(nxtC@XSWWm&dsq zmB^WkiTHU-7bT5{GD^C?DpFZ9-o13kXO?b{WW$~{bni8WJ*x%?;jM@BSBgQak zKqq`fn8w5wWkRT7`-4Z1k-Q<8nCN-_;gcckk*M%;)6^Cn_H;QL(XN*3fGwncb*T-8ibG?mTOI^4i35>9u5W7{yK@CN(+} z!wW;gJXcfd#_gy6Dmx~2%PC$g8s2^WVi1L2?%u^SXJJhA3Y3PPCpC6HnJAwxCmWad zXG)7^NCr7(;>DX1o#azli@Ad<4sp+UCj}ADqxV|!bsT_xR!@%S?#k|d_H-DqnVMxw zkd&PK)3MTvOq2@r=Jxa&KY&4lMzdw}c(#oi2lk#g#lIwFNKrf?p=M;x6M*{7Jq(9y zAMsY{fvu$wLWZ=8G$|6X@~cbE$3xgBglC|)4!Kez%AU9vY8_d8oVb5C#T@DMg`<3q z(};VM^4-?S)q&5?UK)PKync?x&J&HJFC#}zW?I+6Ol;Yncx!h;zwYzu1zLxU=)_Cr zYhD>%&eBG4zOPbO9dn!cr{&bBnoE?o1hg6RP}h1dgKh-UG?xR3$!f8$$OVxXUj_N~ zt@C(WxE1~+VCIpF(Ifjac<5AC4ll;S=|>?;R_+@hB!;_S>MZS85 z-qBl#DUmjVJ%pSQEt?Qx)rkG`1{%)ek*@%sA6yn?QS1QQK9Y-ZoIfjkLm#^ z9V@YH$uQb<9mIwe<8ZOb#JFjr>Day#vsbL9te1@JO~$fr{$M%}9>eLoM<`(L!H`vB zn6YXZWgW${ps;1ct__qDEt{Oh>o9!E1Ul9(hFL%^G72#*sx|{!l>*0X)mXEAHGR5t zq5HrQLSS`d-+_f#i~1s2h&zSCksWugkT0V*>rTI*bq-Mn{Jfj`Pou%a&6G|&MZbZA zS+waW4!#AbC>pWS6EVE&V2akrkB!Wg?jxr#Zp>&#j~T=Gaib8Wo+5S1h=vOcoxPRJ zqD1AaUKvjzHw)J;iGyWkW{xh$yaA$4y#Ag%LFLKqYnO7)$@B5Jw}JlipRr``NL=(W zY#h^g0ZXzRq%c?ZAs>bn$V=c>`{ zn$Vj;;@(}0Go{6(1-Rc?&%lK*S+HX;0c9GI+w2NmXC9z>&9XST6=ZS0LQL-2g^9aE z@ci!MiideD^Ck_YSFb_DORf&Z1F6xf)@PrOK3iwX5PSj~8i1)~F)#2W-3oDVWEXs$-`izp#vP#~+cy)Kui$S8OOzx3t0D{wvv9 zFJ)?pI7Sa1$oOe12s5#xe50bNTTQ9hrWhYzeKlK&<7tG9j1KP^JE%9acif=hQM`a$C||oE z&Ys!HpTmoS-N%vr;Xe9}oW?Va4;AW{A*B@LV)2~%EbZ5q*b@EdTwb#MmpY`r)|y8C zYDjnPA3rgWG_WbH{Rm68nZI>npy)fB>AzjY#+e;cHfr8euih})*2_(}Z#}H{&nCn8 z4dlKgUR3Mj@Xe|q+@cN}XE$J3`y#xnyPN3^EvQwfBh!PAlh-jNnjgv8vu7z&rYz>> zX6)@QTf@5P=PpQqkX8DM3f1GhOlvK{&n|1e( zaI;5MV!EEBQ^5qfRu&@s^b(FXYfi}(`zYolrB2E4dd;b~Z6D6N1~6f-7BAm8;+>nb zdQuJc4X?+^@IaE{pA*<<7QhcBb+ zl%rUPMp~5)B;TX;(yu!`Q6V>wGlS16DY4RLC&`-g_hN#XxeTr0SQCTLlX^tI_L}@& zWYPd5>FpsQDr>0+^4E}hZBh?d5Cgvld+6?%({XPNp z|M6>aCVu`%l8X->KfLH@iFow|%d9>IZw$Xq%05HYPk;J%?2iNbAsF6nKE4g{`8qso5UH|@fkr3m0-rl`#5M)xC&OiK!jn%I`!lqc; z#;{`QLOv_Zh#wE-hvs1lFUc>MI z7Bgp`A1cNrel1Qr@3au(5;ENXUokF`vd{loj7!*O{9cSp$jI*#2&4)Jjxp z4QiG6`xg@9-}AlSb|b%yg0=cFecFWICB`KzJPR^(%yh;X#rS{3ST6tC{NWyQNsNcy z+QqVC+YA#PS$Uf;VxhBA#Qoy7sAS`yScR7y263roy|x=yjx)f#%FrF99dT8Fh` z7^B+Gr`6246!84axV|f>-lso#GTMo^ooMArHpt?yQmHcZzDu4)EG<%cqofWbX~1BL z+ba{S?NqEDG!jj@j#LcLa(e4QWJT)Jp;mrObS9V!!7aT&)gm3%c43U|x|G(_ClhmY z4(H7)Gq`>p8&f0y9ckJ_ zKL3xJteD6!*M>7`$apFbUqU%wGsD0q$?i{`^oFA+-s10($m5T8G-_9s*C)4g?Ufwg zJSC}CDkC=!9wQ_w5xv@s{8g&plYEdsOa+RSEkM$X59AYKD*oOHo+R0!4t+_S zeE^NCmB2y>d0FgpHXpl%xw#2yg&9G0>XFUC#4zwq66EVgO~$M3WNPQIA@S2G+Ks%* z+SOx;d2o!QcRpcZ<4DD7bqMebW3&+DEhbM!_T(6!9fK&D(~ZP;x7mB)F?us|yzFey zd*`QWK_7JD`mP_@iBq8(WOKFr&7%B23G&^$cM}{OOz+;kN&3!RQhG!Z9j{)!B2%VJ zh8KT&>>ZTS_~OM2vSrI=d|?_%bEIW$K+OB>8djb-!4leU6<#~%~qCNfJ@?~c=J!Bdva8z98F!eH-hVrqdl@g{vcE~n9$ zF%-?>hWyzv)?A0Kt;(@u!5qr=9)Wv8GFHykXu_VdWW#0p%xcZbo(rkccMyfMB{8-4 za$3!tPQ>=nY!3}!c-LASUp^h@`lDzPXu`Zn6Y#4&m{J+znK^JGWv8y8hL30zX!%Ky zd$tjRJf}7BuaD4W<_i`KE5Xv$!8GmN9rc6V?7Hv5v`M8H*JeJgW=!V&h9TU~)Qf>t zEtoQV9>qEjAhT5@5zn8p`*JLU$MwKl7s99!ducym7+x|Zzt!W}Z|Nbwc<~|&7cL}G zyg<`4QY&2QA(wiG((6MnrBSkTuUN4nDucT(BSz8&N&HG>%-BQz&q2B;>3RH&k$*O7 zwc04g(}*+`s3#n~ok*Q3L6{h(bCW76Q*_EtTzUju z+SkIx&V)1DSD?;Ti~JeQiFj~|4-SsIt>R|RK#JKo&Cj(vd&1USkJ0@>U` z$AjQ=B)ewCRri6d>yMDDPD`9Vo#dr`1)7z~idP0_&K@{~f8{bfI&y_Pl`E3?_#Bb0 zCCF`hgB>9*bZc4$dpj4hE$;7zFfN@M-#Ab0FbQn!#NDrr`L--vV*t*opJLh;uK z2?^oDhY!@KQNyrLdS0Ynq4)3K8+rx5UQ>Eoq%=yOl(T2g{;S)Ki*fl;izLkCayik_ z(FP&>pOE&Kdei;={qgaUCi3`oq&h?Ty7NZ_xpa&)=uq-#q85z>Yw=flCXD%G}WttHdwF=}dpJ2bWx9N#0HLS`BLPGSLZn?d~AeKKOih!G=3j2JQU z`;nyR9~9&oEL`(ZHAgI44_-oLVrl3tihBQ?PjPaCNH+BFn3|C*AOJhp%rtD-n#NVj zk{&^S`9y3?GI|`au~L#CS79o|{a3%WlBtJ5bQ{i@()zQ^;E(L{3!>Cw zTXGohLz4{taDPHNuTDl#mBzGe*@B9Byhun)#ydwYq8{BM!Ni)#*N=!c&x*gR)Ns&B zhor=>QDftm2dD67d`=WCO>Hdi-bUeTz>;|1X&;XK}|?+>B3M{li2vpmGo$76hlR z!@i-7soZ8hpI@G1_UenNp+6R#GM>mdX+FG93~k(#uM;cJ7*?Mt2fxpUAAyQ_O{!D2 zdR^+)twXJ9RakW?Bz4ZhK-G?m`S|P%bJt%<4gJx4 zqe~O0GB%WW(f(F^ zI!^V#AnMewPwkr3Y1FzqZ-0Yj+8;41F=E7s5hF&vVe-e_9vUz)#oSD0=*do57cVAB z<%_?P{i8u+eZP;iSu3_n_KebuZep9{_FJP?V9-COor?QUUXaNzJC@qFESh_YR-=32Efc~!Rn*DM%!MM-{K5;0iDA%{Ub1&Lkr~Wd zqGbs~eNm85O;w(*fDouK&COJ`wsf~qbyrnp= z)~My;IxR(c(j!ldLuF=%li2=z?_hcc=j8OFYBbE*iSjj0Vz4%Y1Io`;j=PqMJ! zVH%B9aCApsLtNpTJ5wdND)-kkHKh5M=TgMH=Gk*4{^I$2_VlT7P^S?iMvVN8k?L@% zPEM;qoqw>0JQX33r4hZ-%fqk;VI=*P?8kqS!r$+s5yD5TOD}MZVO@<%l`NS(B4 zh+$UL)G-7i({Qu5LH_X!E!)gB1ijxsleSCl;o$1R%S*c%KV~RxdXD3v5Z<;nwm6u6 zWLW*~eA3C8(rGATMvb9k-SNZo4F&f><$U+YfS;+&-KxLK)~+rKl5!&-7s664~?9o?$Ya?mU$59>qI z!7B|ZJw3f6;}@Lb?C#lg@4tv)4Vx1zP7``;Bn8_p5ql&tymdz=c40+aa@< zWH@%U2$u%entz)}%i0cG(dd=VbLOWw#eL|xUWDjb(zyw%_grGfv_1@7_JCIpE(j5Q zmOXdg;GMfXHRO-EBp2<_$HDjnwIqkD9q(^!qU*#H5P63_J=!pMWPiF(nMLTQYt*UM zl!+4-aO3WIhBWQOiK{o5-m^O!E=TkE++MN&NG9~`$He(pA^su#8+YWyHEEw7Y`gh| zGy4zn>U=PpH!kJg%NJ}u`A{@oZG^BiT#XRJTHJ+j)`Z`uW|byPnz&G$E11DeyKwT_ zO{R74#)eB#@Z}o)yLV;S(D9sj^c)v=OLny{$Jz%{Br&ur-;rnH*Ui-vXw$zh0|&Hb z>FG<{e)f`+`?v8q5iCU`^DFjF&Z788O8yc38g=5-^&3nP=h}EB2Gyf&^zJl~3pb97 z^8epeqehGvF=E8XU+hhyN2NETe1nek?B0cLox4&bvo)%eS%K07oe=8InM={UdOj3? z(qPU{CpYq5;f&5H1K~#(a7VN)EWdVho0?-CbDvQg;+eK;1pPkld3p)-R9)IjR!RqITt&|xUcc1-8S zhW#So2z@udp-Ss&G-y_fozuJXCeDO#tpn2*PNA&7)RX;7bR>)IeS2nM-OlISICg-N z&Fdr6s?aKv3_ZQ-q$o^%OE7W9G8#C4;KYq5^zXTpHcR%fcGY&;l+24FJ`$~W5R+&1 zWO${5tlNJc?$6+XU1RclY6#b4WBjCrY#mXaiG#;bx?V@>H0wkbnJaJa-{O|e8OyK> zLQDASbHQV2Crb(Ry0~g zUddH@woaRdd-K_>Te*?pEoxz|iYHWD+swJ+aJ#>oCqYB$*S`xZCf8=wie+3owVwOl z1?W4v2eqo^;{M(>ye=_~0+#EY?GPcf+{C`e}G$Ow;RUd}Ok)Eu)U6@8e zE+|xznUXlSSftNT-rgx`GcmCgLR~?$nH|2V8C)nJlfj(I$wg`=K*n0F@p!P0VbenB zJ)#j7q8vJVW-@G(IojjxWQkHCl}$+rs&EV}&9;TJm|yw}6+5gl>}M*j+sE5Y{7Mkl zCb`Z_M(5~mXoyJIo2n?D&;IB@kP46YLBoJrEtQz{Ne~w@ftD zbcxY4oU)tg#a!95Wj52Mtl~qQ7Ps&AF&FnwAyu=yo=g3%5Zw#TpH~-%;m;qDRcM%Rc!7MRAd>KA1z^e zi}u(wY=URfYeK?uFt(c;Wty$x`iV6^Yh8Y`A%91U0=<}a?=TlS2CzQUTF#C)6~cBe zi{|8H)GiMul|04#XAN01rXuS)H6XIvA}U>+$&4r`D*KsoDmEiC3q{iBlsAWFwll>u&yjA|zzP{COwPWzE^xf`?Y@i}(4t_dQ}(k>4e zyZkkWj|`w!#a2`rJR6sHJD7JnfP?ePP_bGMX0MpV;!ZP|c4H4GTl=v)a0kanCR4uT zaTZVYWBef>mNkx{$C_)@tdO4zkDf82O$|B>Kg5-Ti%Gn{mFB}vGHiT*?(Ue!tK9vm zE8EPW&_Jqqe_`Db9rH&Qpy#l?3=#X>*(UbMJCG5X_R-^9ZuU=ULih4n$vy5Umh)?q zIPwJpzcaIzzdcO(z9+eUa3KlzHq&Cn8HSJV%dM^Rd6RztqXI6`Z_`^ES1-)m0b^)? z>K+wu3})T$g6t&0Cfn$#)6O)rIySX3}2V|BdaU={sG`vE2g= z=li_3J57(4=h#p)TJ}FGuB$IMH_zikp+WSr+s3$4j`V6*j68V@^W=%qhWwv^bU&o~ z^7!#%j5Bo_Nl!>+Q>r)e=g)5_n?`;-X=+3MM`!9Z^85Hbf?OHe^0=!as|D+zi zkjIa3b9F*z<%Vg*d(1NDz{Mn#)0+Ie zgZO?dDT2I=p*0@)@*x_JJb2pwTsX+X?sN8GEP1nKMr-YkuWc+ZABXcrq~AJsDT@2M z@cHRe>;ke9^Wq&Da|I9;a)VoMqVURAhCV?G*3gWR$905j%M(uVc*#@JZ<%ez$KtqaK%L^XSSX zyxc^ip7)qIsxAsAU&`mtB5s?4n^$h&o;x4<&k=_68~QGiKXdE7o@|z}$TQ@|(^kie zhcC&PH#;_}kDS_al(&|?RH#yw0CyP?uOFdw&54hrj92%ckvV@(qF;zS_s*Mg?1Pv1 z=F3jhlMo!T2V$RE4~L3%vuuI5={|CD^HJVeXA*H%A;3+BF5(V{_uV7ZJ%Hx5%Hkjj z$+J7>NOH)Ii%vnt>{(EUeIU`sn+*2JJbN0Czps>6GP3$Q^XbV|?!JsBZ>h@oxoCLu zGKyRQDPIVpo*d)!*$A|`3evJ-UQzfHxN`mq(Q;eLRw<2x$b?8~pWp~|IaBu0#DC^( zf;9mdor!pLlP8I8z<1Y-#s#VRUA*>$NhA!$dIEVo=Eh8g=kSBk0I>i*=}eTzjIYVe8sFee&dQCCH^o-oBn% zuh)qs<@e7pHN)CUh9X%hYN@Y57MPprP^l$%vfm$Mf~AcWTDcs}Us%I_opel^%&kzN zLPm2XBk2a|eSGfRIm3I;#l^*-JB<8T(o~QyFbeWNg+JnDB|Y=KAWyG+6XZXhr)O6% zVfA??uG=bvHN?HxM5_@I98T?7HS*6QHa7NeHFdspPH6(RWXU8@3-&HX#B=&MkQc4sV8#y{NQZu7 zc&D@$qWarsaGALUvZQBhSbGM&2)7W6nYkHJ&u(z`%oz^sy$jZsB0R;eRc5Z@laTROogc8sJ)q=vkazbK-fGxm`G z3H+8G@{1QQGJpPjgJ0_OjP!Dqdh?~;p%lOF=}(MEv&KrF?xbEwl}eQw`s0v9f;1VG zTQ`L4Sc7%`dQEQy(;mrsU7(&x5Vg*%(%sNxdp!u8!vZlQ-xroG6^vl|dz%5wvDK zc@z=2Wz9(jYw-e-$$0Z-R?&0N##2 ze%#Slk|LwAbaTN(9!pe`IT_r3{hjz9(I@ce;akJp6FEhm|2rfPT2YCXczUD^msiGq zCdo1bw(@A?RxUW%{QuAF@8S6T9xS?P%9KgdDUju>%Y|+Rbn)Z+zO;-LK{*xfzy?Zyo!NK(H+t=_ZG(97Uju$Up;P3Bmc=4x4 zK`y0H5=hyzXE)k-8cB1qX3fg8XV3mtf_z@J{Cw_romn-VI5w&b%dA@Aa4eW%!8^#y zed-sV&fKG2sgr*wjr!N)-nKmyUa*hmiAPv_`4yor+{x~Hjb|3cun7&N?To%0YTlGP zfz>Ev8O7CS4(vQWoA856nS1Un-igsf=WEK+mP-6Hj;3+1rqt-rg^;O*xKi=}+j{0B zS)Rs|D*Oh1DagaGt)j#9%LL`mL`-4=O*=QBdtg0=zYL{S*84OoxRrHx=ku?x?*y8d zI1o4e6eovOChq<^+zNE(yk3c7^&Sd#ZiF*>;$vem5klYIQYH$Jn%Gz+PR@3ylHy6$ zn&IS-60=&FL{hREOVMDmHZvh9HX6O919sMCoS)Nik^8%=0(VOGp;FNAD7Nnhia>Ua~8mY76roa`~vYlw+Y#?i?!RaA;}#Ux|z z>}YUApx5e9tCCThS|U>`P>OX)gj$;`m{h7hfqRZqS$>@>Z(ONSF#x4Fmt1RZn50V_ zEegLBf0BsL$uRNQzo3m`YKI=Y%#sKDFZZ#`(~p^b%BF7oIhSTNr1GQ~Ud0EKQ8Xl* z_*!B*{3=U|h%omu6w6|VGCmf$i8+q;wuTAblEuB1**Rcosu9Ax&f$AFsm3 zPA1Bu9A{@|PM$nT?%cVJf;^2#OF=$%-gcuP|1-8S8}jq#&r`N+**_!}{w&U% zIYXsNl~UJ?7)d++>Ne!kIleWlQv~_KnuXY(r5l~|=-6@a7LzuNV@B=KjJ&v$+$Ilc zQfd}6_P3=~jh&phzY+%_Is^L0vSWxZd#*eu`i%)+o?WK&kYTi~R~rwTNct76OVG|M zwDwP?Ti$9kzj2T~rE22TYcRzvLl`>l5(mx>p-uH|9D1?_cb$f)uurHhq@GNfVFJ1T zHQxkzk`Uwt7*eYuWtU%|j&I6#wc;ARiqFNfXL}}g^`l+MO)S1LhO-+t6Q#2f!cLD? zXG+74O<7X9Hiuk`aOS{t&Q5Q~!ZnFZf3cHGEyvJu>r_sRYs1NBT4KG+Fri2ki!Q|A zV49gB<8m>f*Cuq@WQq)3LyxRa={$G|R<;V{IlD2tz$4nvxrej072TFi=Ty_&95Sm- zqteMNnSO~DV;3@YXibCIjkvysmPWv4N&G`{_IG zJZ_F&RBhqI&Sf{Swt7oMmagocT#uE#TXQ+W99h;ntesk)F_oJVlP@Q^%hbj>nsthzm3vdi>@-gc_NS`l9-4L7i(?)?y7sQc)~?I356VrgzHNEGbRrkSOfb(; zkJS^Kux)H_4uz_T(7Li^d=qAmm`AiC8UJPzXkfjGip`GDepqvEZ(NL~aCeri8A&cX z={rXPeXG@??)nQ<_A*=oI!!ps`t;*wv<$Nx4MqGl7*U})i3M^~sAeTz&RI%i-b_4w z@R^kdcVKyPI{nwYz|qQvUaJ?u+CeOPCd0)%3$5FEuw>RAMoyW;+c$5>kt2sukf#x8 zDagnF*E4k*`9~s&h4kL@Y^;oo{8@Yxvwtll;T|3y&eNw)4YMQv5*tTnoV{}}Ytu&Z zxv5cTO)!)6g}EhWGU@9W*xIG`9(wuVEd;bQu_<~DNhSfTI5>v~b9+!IZ*9)JiO15+ z8hfb|lw>TeEip-qBTQk2pO-tPP6b)MW44GR5eo+=gSm!6slrLb>*-{XF2wlHFp+vK zU-2%gIOS8txP-Zt$QPFalyQH~_B$W3HkTp88s9A0$rg~6fPer3vS!5=6)ML(jB9Ak zh}kPSW>JZz`J7OTf018ek%ygU-XUu?ZQshF=^cpr{2uorZCJ3hH~R-nqxj@?tl2k^ z9liT=_tsh7m=P;ZN88N11bQ4Rd?=vS{vU8Z>WDukmvjK6)rs3$$crsu-8} z6!MNjqG9kAnWc=CLTHwqvR=gBpKaZG5tgh)+>#Kgq0 zdh`M+%n;|=+ndeeT;WNg4Ea@O`TD(>AKlCQ)O3B%`)MR>x#^sYjA8$gJ9HX8hfQ;a^K{255~~bn_3rhA%ou`2 z)lM`l-ijGxN6|2QWoGUemny~u+UI?-e|iQ&^A?V@kJq zQ|VBp5TT)_jGr}+F@>W!c=!s#CSPOm{xwW*>%!6nN6;n3;a$2jbLMxaV8POOBqgE{ z&v1I~Bs20K5EZI4KZy||MvNHwhaojuGi1nM=u!K*$0R+9|E3qDIy7`vjCBJa? zR=5yCDudS+DSnka8HJrcL0OWBH}|7T)rvUE6=*FrDCA1RF6UStXiS<7g+nxLt8I z3nQ@RF#1(7W5L*d^q;tk7*9X31uUJMvCt) z*FzdN+rrd+yIC=`4!W2ml11J~qk0V2X`(0D^y|6Y$Y2wXN^OC^hcuaj0t+*(*iRtJ z&G%k;ynG#be(^!-S~RyKeaN2yUfjOS=`&{y=AUOypW?xrNK8c|(JEUh>L@R=Pmzs6 z{`Q8My-h@8RHjZMLheU_)DPEowl;Wp`xqK4%9unw zXIEnMxVTDo>2`QIiTsUMqEJbbn?aI1b4IWFkAQfd?GP2b8y*>0KBA{Y8ahIo`VtIM>BJUH^Pj}ImdzaX}VLcl+Y+%jKorEQ( zZukXpAMSDIX+-K;3L)pu6DD5#H%^`>HZ|-US{|J{L&SeQCR4@LBm21cBrJ7Zr1{oa zjs!mNL~9;=y`DR5bMP~*tk(FTXyg<>5o** zDlQ+~$K|Ktsq66R##xS@4$)^1?W$!Dn{ zf1LQ&54ip^Ds}C*AoAkGRisz!!{Y~8FXgLPHf`O>=j6ZlxCBWIXDe5eJg$25YK734 zYE(KuM$c-)ra>Lq`M`nZttw+_=|zMBh#L~o)9GF-ME2m84$(xT-^$PQ9!))5N z>%b$gCJd;PpPc2&;$I_L zB3+$2TXg+~1=%!a5?iOt!?xaVKHb{DqX-uY7b%8wrmXZTA*c7~wJceAjY736q85#x zlrNeY&?FsW&EcmhLRXNnTx)_j#GvUr*|BX2niP{&0{Qj$_!hlDGEnPK~${j5KEQ#?zy z_+^b|;gn!r$IDR)ao@0Ee%6ng%$7-uu&Fx;C-Zm|O6gqES6IDa9*x1ZDseUPoA;3H zRa#>IU?Vek?`6s4kx;!Qfg(Idg@&|k-BRRn3tG2rNBKP7h8d6(k}POGq7yA^b;d#~ ziGGd2q$SD1mmWPF>DP58ixw~C^xY4l(I~cwxGYQ7Am@W6tXa8;W2!nd@_EVhEzc<$ zRG6%OnJ7`EI1g6L;J}LUyvx>(oNl6lnVLtwS)y1l{wR?ttxtg){d)&7vF{jm?byb= z`LlTFSW4vEG79N>~BU=)DzZh-@%I0mXxShnvMmc={bG_OV{3~ zXw5Pxl0-u*wLE0anUkl%+ewU%HGK6l^4CPPPca$1Y_ooBGouZ8TJlG1$R90gP2Rre zxfc3?VjggMQaeujcgJ~ce_WSbqH|zMkCs%i{@EWnzMrXcUEM4kFF1=H<(!BOKg*om zRvh0w=BMe}zjAwBd*;7s%chAHQ$sWiDo~h$yRT9~^#SL=9KRU<ll01*m)J1r<|f zOaEPb^Ftm=HES4g5=g0Gje4j}6EGaz=Ka!}sTUdD4p9vj( zsNvI`^&hWd7qWo@oj0;_^8qSk`8rAdzw-O_x1`Lec~*rKFEAuDz%d-L($bizN%$(~u7?*Bg^ zd7DX@um0a7`Lvd$p8wSziVY6t_|B=U95#~fa~JbsNqffL%geB~g}A$X0uL+9Wo=6f z`pme*q6ys%$Ne6jEbGJI_(mKVRz5Z4KaofUulg+ia*V~sePSM6*+7VX)y%N%pt2 zOTDxfR#s>f$*6TESc~|j-&#|1tSnOF&})$^by!=OAs6CQDxsDlzhqh^$;xkn?0?Cx zd0F}V;0ib2Mq=%lf%4^o`1t4}ne+HzqK@L`^CW_D|C$#N4euVm!!vhQQoX10<;ipG zb7dnYVc#1a(w$!d!5>rJO!6&Z~r?;VW zttz;gDYPThJ(hKvE^62j5R)6Z0mP%z?g!lB);};pEjf$SQsBNaoyu ztMq%2edWjT=Tk?7i?Y352ePBj8-#47RnM~Nbizwa7GoV{-EHsgao$mux%rjJVHg%(BR-SE~==y~TlTOUYTXGlK5~R3szny+0~JP zrRrhw{5HjUwZZ*uFe|TE(x+uf&a7WfoOspgT`~}I{Tx0Ox`<;lGptl;nqR(7%13S$ zm3^x+^}{*xKibc%71uEv+!ppICV`Hv7l+mb4b`Gtb&bg3iiq~&T!y?XX+I)(nh-k`o z>`3&1*<5*JPlUA_gZg(Nqe&Q>7O&)Clqt2__MvP(8%{49&CU0YMB2DBVnk<-^exIb zA--3PDon37gK4|-0YQ74v$gatHnq%bxQF|8f5L|ylxpSy8GCEiYdouOV-fshFuQ^WL8(;NC7~ zF1x|tx#M~A`0?LJkQ@1T{F)&DC-L^&a+Y7q&h+75J66&b?Z<2Eip)v#0$*pY{wMH- zAr+@G`0OG)QbT?#Mz@D)OIizZzLOc>qY8%>j^O0+l^nRM8V>&vUWMT0syfl%`-^l6-ri6fVY*j~}2?|OQLEuGo)-ZYp$qyeR&UAtF^|)9AaObXWfBEM1&k=>Y8&j>otz};H4aT z6V2+@EqRu?DxF)GVaJgpL_9mk>}?Nd)U7?f@2|07-y?COjx%fRdu&Z#GHA$3^41$b zS=m#Xj@d_!pmG!pDvcNRsGeV?Y0uHv6mDV=;}W+v&Sv#Z1>HL}W#y=GL=j4_Zu2SJ zeShLT>Hl)$0%@&fG>& z(;isfT*mnGj`W#0j3z$fUd`UezDd2W<|Mu_6BdxE@a9jXTv^?y#l%7!5$ zI2EPm-HBzazwbo5Hbt4)s43xjTGPHs0f?7OcVy_~v20x-M5asmbZo@P-yPqQZ5h@3>wwC%N9I%fA11~nJQ%ZUGC%&it&#MOQIMxYu5Vw# zwJSSl)^q?*t{-IGW3aJG`6y>%DnlLmnuk^;sh8aXvkZl)nmLX_OOp z^0JlW>)IC|nUcbln^VN!m8xy4iw4z2tew1Z_edGElVIb=wzI(m-5bV)LthMGCNeYX zHg1Glmb_$$mGk!FGoCw^rFvEi%)N?I(IwMy*1Why$MYF2GE-9=oZRs6aOBqItrV}{5#pW`;!uvNS)@3NQ!85}!F!IQDAJNZ zR~hyN+K@+kg*crHPOhGqn_82cB=V|vH=eGV&h{gTG_9K#l~N<}$`X4U3(j14ME$m% z@%7Bfxc=kGF5>aYpO2zhZ3%n&k{op!VrOnjiTX8(dvuN}eMb`T?l7%JPr)`Yr?~G= z39Q>FWuFE$Nql}C#|&OLOL=ALkE5Lfl2uGxa!#f#+r`m?%jjL!gqAhhk!YV47k6*0 z5Dlv^HSPtA(V%uQWbfXIW|t|Ma|cnQh!@#Q<|FFqCvIQ7Lf+a7e z@&&b%KP75Zr?i`rcQMJx%&jO>y*v)~T6Vs)r)TXvxMVGlzfUHSvpVT!rRJ>z*Dmg$ zbi?+dr5VBt*NRlmVvWW)A=E#P|MWHF?~2UA279}&Mm9#$22q#0e)WC+`}n7p%fAQu zpG-`Rq!&~n%->_it(U>%6sw7MR#0y2d~ym=B7MeI$>qpgz3`2>#kC|TZuOCKPfY2% zq&s(g95_4R5LfCyz^3>Lmh3v75@#ABPmCpZxrS5{>HCV(+!amiNtAjxeeo)K-@2l5 z(R20geX+F|ClBAEK*<5f&uvDd)1g*tiTxOYJX;;k44J~zVje8M+6+^jl4NN#q^VMf zY6Z6b#VD7p0Ats0A#2n#_MeF+qoaz%#AJiL>92p>*Bd6$(AX6xe?)b*dTn5wt%`(X z6w86mGw$kExkP~A0#tyiDXCzp=JCtuOTQIA}nYS!gjlMb?J)ZJEu zm$$u9zt!>h#Z#iirjN%?lBq}~EKHx05GT1`P-13hho^%Tv-Yl~V9wfQm9%lM%rf=jt5DvXk+SN)kn0>9lH+g)lFg$Cu5=j?$!e1vc#1PT4#@s1)J^ z0^ckdd3N$5G|$HCYu7OK3gqeYr?econ3B$CC|05y(+J8}2rqLO5$sh`hr7>14X@%5_Y-MF- zaO3rBNDtBb_wT7uqXx0huk+Tu6itG%8@5@vXX5#_Qv~D-#4%$oJoK@+lx<9h!g3al z-9+%s8@LzmMa!a@kS9GObMa;rEmV-0hwo_8tr^Z~U^@Ed%^Upu{E!JD68qsLwt1_N z%i~+`w3&ToeDvp-wB`(+e!0mQScITV@apOdP90j$3!j>dZd;Xzm#@fFrZj}c5Y(Uw zk2lU^{>B5C78%H-HpTh;@+Da+RKvqe!JF5Kl&)5r>bca+oxPY{7q5}6d>sm9H0Ska z6_v{d{Y;QccAku?6GVdgwX@DmNgX8${~8D4oyW5WkD=KHDR6F|1(`lrbUf*l~%l z2NyXR?atUy?eTTATF(@o3!=O4*m zw>}NCM6+<>PJ*vr$ERF>8W;8@G2toM%e16$;R3`w_(Y2?^-;WghC|_6?USq8qq38N}Ok}T_;odzBH~@mOPrXtX+GVou}{7wD(j> z7x3cUrENS`XC{+qI25Q*0yiO4y-U`hU?#oDE79;P=0mj7l~z4kibls0=C9t1Q?7DU z%%6!5;aVz{E`(E#{BU6zdrv>+;C%%X#}2{I^cAyb&SUqnk93|eiyE~{p*y#jy{E)J z55zuW2I5XAktRNr%Ik;z%Vl;va%A4zjy&DIob_9FaQUqT!)H$-i-#?5&TZk5V_o_e z(lKT7LaqxD?&DR6x;66h;bl0*YL>@Z8N;(E2U@gfipz)1Oxbt=`z*N$$Q?wFrd2pI ze;OOFU&GEd3uS9m$35{qI{&g1^s%98t?cZcJ&t2FMQL0rcti@l+_SwjPk91$`L<3v8cP=h2xVgC*7vqvH7O6Z21`3_v=x8XXM$!hU ze*L+d*dN2WYmbbBI{ys*h?kY$hU5jo3hN(VHvV5y26dK6lS28U_%^8X$D@^pvT#T@ zJUecuMImeAp01{D|47asAD+6$e}P`yQ?0nCKl0nvuf?g9qp`G3lTT#o_+-per}X}J z{FZ(G8Yqd4mH*AWtQh%E7~RVmNv{|ObEX|q9iDcBI=BBJGbJPGhCg47OZ*X$@OL64 zcpoOEdl|&IgjI&3bnQ^a@cX~UE|jl{UbZxPym4>2xbY3z;q2O^0c<6>OW z<6`8mi&2mp`Q1o@JiUJcPs>I_-kLq=-@Iz-nvi5J`DoSb&+|NBBz^HuZ=f16V#J7% z{|@OrVl-L#6OdZ1|DVaq?%lf$W+1IwxBh8xVR}Up;-R6TxVyU>3Q&6N9hB1e<;xem zyu6Hqu8gE9Qu&wsQA>8=Mw1mIMvNHw`;wL>E8`a!CkFac_)miTkK2&{ZwL+!HrSA- zXBSJSPoJi8<;tmRMvSB#f4`YJjTkXv#K@`joWjH7Jy6H|@DztwgT+^-=F? zr6MKIk`hszJrTqAH^eB>lJrDmAI*l5+NJnyV67nCF7aE1QE@_IM zZ>S?82oL|)@}d7_p%CbQ#Z$nybS8gGr%p|xG#QXmg+}CcN?!i_SdA(rpQY5dKRZ?;FkVg_l#;Bs9!!+?ZqUBRH^p z6JP#CgC#SgVJ)sm6G;A7MAEUKKQ+c5OkIbS9ZFH4<^;ZcxXZ?UcTz)tFp8(NsNH}~ z7oYLu-c97+iMyzqt0`Kr8h!frqes`y%s=>mOG`#D|HvcGty#%^Y0A%k;WgbVwjwlj z&44AMtEoyovCX(BHv3T4v2d+uj4{+qWNGn$>2_mFKD3{xgcmm)w0Bmb#Wg z(%aLt?$MXdJzCRo>{de~;qC2tH0(5*DSg^Ab@yGvexDv+V)N8)H0ig&u>O_!+iNLR zVgL!L>nXgUdFI@->phS@eft>Fx&GD%_z+C5p1tVMs4|7iG@w`at}HwGH1!w}*Xuo$ z%UO=z1NzguR}Z>&o+olj$&?25xM?_np84aNGi2LULUs&c+?tfMNrY^gM9(!hQrC`v#I|l@SjcQ%032PVTK& zXqj0$RwPmp%lj`eSiAY-Zm(iQiDH!9c8~nB54idIk}@n!O+;u6T2mRG8C=D>mgFQk ziLtR*yL(}8ky0Ujn;0mR4mrxOE3gHL`zC_&Gp*_uGY8M;I^6NXXdVY)3XBV^dY#}b}?3;T0OD1;c%F3&Gc=~i9cB!H8 zi28v;*&1>b!%&*=v@o)v&v9w%uSB39l?d!JqXU!8Rsn{@L6;a+2W=g)z+a*mJjSWry*0+Wy)?k zPsKYu@tIcAvgB#7?3-XOkbMwB#MMl?fLG|Gzjk|AU_QFQ=?0%io zrzZ1e(@=VSY{=5WhiEbB1NEwSarsdq{bo(%MyI9}ShJdaEe12@%n~Nn8;Vl_Z$4a6 zG5^vGmKD#(yUHEO@ct@qGPhv&gvPAz-J9h6HE~Zm!(*G)jBBGMfBrsHt5=7Hefvt$-D;*Cdc*UZ=1d!tk)d0i*)hn8j>8t%BQ(LC@ zYC!$!gQ?!233cjZW%1X$!wNk22lQ(57_>l2kI<4jNAAqE1}T z-5b@czT`h}5u4?GS@Rz9nuM|PkTvf<&ZD+#VR8=aO5%k>xb)paNBwN_wLir6(_7fz zeHN3iEuphRL2?f5Nz$c5ICk60%vuV%HXnvv&O#)g+DvrojqL1K!jKMlMx&g)n11Ip znXQBfyuF?>lRt3dz(9uAsDwk+epr1t%ysh?Y#!)Dn`V=!(WM)=4{Rl4+ePHM-hhtB zd^mr6C%N5z(dtt^qjI4htU5D~wslu?fN zBBT0`r|00Vv}?JNLl_Lyt$ULQ$KM1z&OL!_s6C)@N@vX z=QK8~e60rh_wAQp4y@=|TyQtaeDW{H)=l!-(^!`wf`MGy8_Ci@U$!xI>G*N>pLqhlNL*kq(ZlhTYTS(sw`?orp{86}D?;nL}HWXivug=+`lDu2o7 zNjq7;dnT>gFW~yAb*ZUK;hP};K!>uU891v5GcOjRLBcW|nssJr-;+$69KiSko>W(D z;7gr33@`6PY+MxPNe?OCZWA|8t>MLnz6_3N!GXa-#D<-qWZ#QStC+;-J5KbgoEfj& z^>Ms4j6_S}xbHdR7zU zNh$(z<>2C!j@-`I7wy8K6q+}cncY`#_|htDbhjx{cr91&PM|@S`pkQM3IC6)$=O-S zlcOc6++rtZb_}O&v2M(~zL=g_>ofP2*yqD)^7Mwy?OrkIMJ@IWE6wxOeHa$glzl_K z_WHi2s#Os7t(xN|i{s(-4~#i=o*GdLg{U{->7hPipE#OVZAzUgc{pm*f-Sv@z{kUs z9DI}geOwuM&Y#Vr>ZU~Zm4v(WYBvP;Uh^4WPD`=kt2udV5sqI4`B5RrT_F1LN?MOi zKWEh%(a=duKx5-U9)ElKWzWW!&NFbkvYd(&57IcFBiEL;W~*iZ3;Px} z9Q$a+U?wKlW9L7#hup+ehRpQaxpg}6ayKy**C<1yQl+_ly{S0&&&JTC6U@!cxpU`^ z!PRB8YTv$a88MO`Si5#D<;s=A$H&Jg$kTwd?IGV`v>{J_=-9gM0`0oiM`P;4;Ev^3 zw(1U8N-tEsp+HElDZTz%x3^v)C$Q6CG_yyt)Tsj(d#LF-elrz{r1bWsCCTwIbeg`I z6|2^rkZ*W>h36i2`hD7^r7vo6>uYi5~9^u4pyVU`uf|S`{%ac{sLh zIW@CqAb4^s7T^Djjinj(l899)Fx86}v|fi68DQr>HS;Yym`ax*RP3; zPeu{@kp(@b^U~bHV5XH;n2LK885)c3y9PmeL#Z@&U>Qk&7{A#3g%R(u@85bx(g8`2 zc5ue3E)!amqk8qKv>V=^SDU8rCdnk_B`8Fx#yu~6%S148^k#Oin#9q#YShh?4O{(b zyffz~L*w>@oV-J+YX80m?nhxFGeeR1bB`Lf8A}u7dX{n1=CJh8Eo`mKglM+m%C2=R zoIQ;J8$QsqX$4f0AQwW))Lf|U&)4bPXE?{s-z6$T2});mMI(uDNuNmtRft@zV-qIV zaU%HgH7?vZ&E*G?LV%hZTCBg2h2Nn^Ce*7mHa1@t8!UtJiB!F1P#j&cX#)}2X}Wk^StjlU)A?-dTMo7@2=k6z1Ldzb?fh%QtLg$ zW2n%mvYyTdy^edZn2r5di^drnCRLu8R3eD#IYFr9=S{O|2U}_#;hg-%n^=?uw|@KZ zHD8cz>o-8|t_CGpOuWIzMYpKXX?M>5vaQYuqRxdtxaUc2wiXx{e-KlyA(Z7| z73_9JU3VokT)9F}u_NETf7o9PItKzion2NTxs$7VoZCG`psNk;Ms|4RCMHH|`Qgu4 zgP;P2wrA=v{mL4n6OokUO9Op+9T&g`ep0gk5@sm`_TQDQ@0DZe#R^%RE6q}Rfom<4 zsvtO#fc@7^VD$)Xg`1B9Ttcy|abMtdBo0@4ik3313Hg9zKoG=wZB5Zn)wPPA>P<#R z5j)eF6(%r*DfK?*9b1RPTuS7VQlXrsW(#)Tq?0QE@W~~a z?`KXg(%QH(yIXSoL!Sv{x^PgQ0V6F9`EsrkWx8}hqoJuurd546TT>%7f>By{Z+rr% zWL-ZrCiO>Q$l>@2KarTApNV)v2FOBX>x5!P6&*K~g-Sj}6wN08o|UaYl^~g1uC(kO zEtMU3!{aKYHHsU%tKW$ynVn9`@O#a!9Vc4#z2Zdz`_|~ke3>#Y%IMEhWu!UkePaBw z&97kYLp*&P_jn{ZjnB94VG~i37!o-U*C^LM#~_U@ep6uEUkv z=AJCrUf90*tD7|>HH|u6rA!z?R8Q|bpRAS+6*-M5e2!g0fza%lhtX#Q!)_ahA+ST9 zG$93AE6$bzj!V(-T4Y$n=r{vHfI@nggt+FflQ02Fl<{|U^qosL>}=l%b2;X=(NH*~ ze(C_|P&Z6RD1QdkezJMST z&0JQrO2a}Gwok0Z{^rBj$}N$Kb?i;106gmtdq<^ccF_-|&&O0n`9Nz$3M1JWb*&u; z4qYD4nSdZDE=Ti0Azq2G5on!myoY&y_oNoJR_v;1c2aR4kgz`)*PD{Nj`J8~tt|P} z>v??&Ge1sa5yVTNhV_7(FuiU+sj^w-7D3TT4K!~@TPUZ4JbsbKKUrc{t(cN_{J0!F z;%58dO_7iSPI_`y)RG0SzFm`+3{l6O4{^tXv7xZAO3oZRZYv&43BK~=(iw})ZW;=u z)>^bvvv4FJJR;E;9b8gC9X3wDSZJaZ>ttHU99O4EX!K*XzHwGBk}Hp8&%fv^20}?G zrCbF|_#7E8N6^nlz2Wu@*B|q(3N;!SO2JLA*m;t~%yJ>^<%SZL)PMT=2Hx-NQEyIZ zaD-#ZB1+b$=PXI)sDAQP68mWsB`$AOOd%YhdjjsGA!n}=SUW-Na}10OFBXbbKwkJq zS?;aVW<~JQ6ulb_@NkCzr;{tq5!AE8@u#CZWiC*mf0z~9R zhaY0egVI5J^~#Ps5)0sox*xM5GoOjO%kX1?4%y2J>Rddhf0BkmSS^M`9cbEiuOSo< z^eY}eR9t?w;zBeP%+eF#(oQf*PFl30$mMKL)w{L(#S%Abx6du*VX?~YMY>Mtoo7~Z zyim_0e91Lz?@+h<(0M4M%@cKxUqW=-JXoh7t%hV3i_;v}O)|Ig-7@%3!Kl=l!P747 ziAe#%vwrITPxa{|>mqwTHMb{pmYz0aeZal;GY;olH=!(ugq!11G7#C)C5^hy;9i6D z*b+2+{fGuCrY%zr471Y#vth|L5x8-Xj^#%pHwMj7+)m=$>) zC1g@roN5@t^LVYL0N&sWE>tXyVp=HnO|tDf$|j0~+<*JHOC95VU2$@poX)04WBaVs z-`?9MiY5oHJ$YTS)!=ZL@+a82W0INNBEs1RWz#%*(Adj$f92k|Jl1j@~0>`gi8 znY%NVfh|e`JOCo-x%7jLak*uMa?%@6Uhd+qy z_Qc`G^<}lw-LAOF!LDlla(>;F$4+6_;gnChc0bso>iVLd`mrA2E@GPRTE^_~ma=dQto%Zaym`JNRh@6j%Bc-wMyv21zheJeKHCM9~Hy(f6$sUt4LvE8! z@qKF+&L<;W_F3^V4J(1ysw&n@WkR1U+e*w?%R#en$z(IJk0vlbcpl?FK=xzCi$t#%VFdMI=WYj|95f zKT-VBsFFycZ(Rj;jdrIsPB&jL>EjO7j z?h1Fbdu7%yeW={cB*aq6V{cnX#Gt}Ct?=jL7(aBf1596Tp9fM#B>21JnJco==CgZ4 zgu~jKBa|8LR?^E9xiw%6X-kX~$OHFeiss@nTZ?y}GblT54u9D>P-N@)2!ig1Q&nkW zB=1E3{LP>@nrF`S)KzI5nr-qeMOp|W9ppQ3!qP}xHTYvA8|3b%v+5eJ4((bnram}> z)?L$YPdz1#vUhZ$%w%pw9hoYZYswkc%|EmNuIqdn7cPg^hP=sdUz!Qi-yfvVX|p$q z(|I|*+*u0C`=O9nPU^1)zgfL)!8yWNq0v|BiRjEuElin4DH;1GNkYD|>xx?%Nd?g( zgzd6?{P8s%4g_wj6j7kR0CF?B zlQ5eBFY)JIFYou@OJ6hu#&$4H+#%kd}o}8M&A4`(fa*o`@Pas`RU|AZOTE2Vi zcv7&Q{b*&0^FJ`$(~3VyuVP#Qj1(hhwyx;5oyQ6+NJ_${CIVHG5=MTjl(LkFNc^6} z*$pz?y3(#jBTzCiM6X;5U*&}CknKIFF$>H0bDg zt4I8?UsSaNEN<+0f6f&4@ilQ_NF7bSWl&z;8SQPP1==U4P9v>2?JE8`iXl(Sx;3wR z-z{Ib&p~^Af=45dG~F#^1Ag4-duJ(y)H!T~*==HbL(C%iuR6U8pQMZMW>7?$_kl)b z(plrm>M^esKeod0*gV*2jTW9H@j5Zhe#}w}r}9|y?uAV4=vhdGlL%xPxo^QlX0)YW zso<(xf_)AS5$$i57~oX!aEGH_>9Zo9X(vl=j;X;ZR^z%KDakO#;|5hj_ zaGBD<2C#cWEM|A^4ukIg92JLq@~aHy!{HkPq4hcIEjuMw>dlXJpzWYUaP=4R^VsUY zISe<~{>Vb|DIk`RB;Y4tROjfRL^C$kI-Ta>T6SbNl}3fnxwnjPcn@K(`8Q53-s-FD zw`*!1JZtYy^YhPO^n|3k)QpVUCOtLV#g(bpu_;oK?2_d`k29X8AC~bqm#ytxBygKe zhVM_XWkg!R=+r_Vy33Z^$RS1TuMEX|a%Kj-LJM4viLg``Fy5G3GHOC)duM}#Cr+Uo z>=jTK2lM8Id$0s&^7-c^#iwo$!guaW2Q9uMXtRaElvw!HnDzobpYs>{@*8r;v@hqmUN)Hl6KCl7!ra>efpqhS^c z51`Rgnahqr3&$O%efV1`QH9NRvT*@ILs7pz*7obzH-;u9?<>S&x=p#kitbbZWm0#+ zXn35yIJ0J}>t%MHcbQ5VDs_@WVqx5!AM5z}!}mL3 z7wn{}dbK&RY+kWU#-?c_W1)*2_=$In!y{{cofrG|k4u@x=2U7%nV>a#BHFuFK3_qj%C1`Mg z%z(H~DJ!|^4BxkYIyLJR=@b~NU)N9tV(j_0=iGla|E?Gi+nYJM7EkC375v-BYP$$0 zN-vB>W3AFmzQ8xjt*H@-&mQKu&ofMDTd?Nwm7cr1x<9#1RsD${A? zVnN*KoxFaP8iW*=*OxlHClhb_67G5|_|}L#>*=Q*(Kge$hn&t~J=p{|2l)WIbXVFN zOSD(IZt|;I1e>SHk{g`P0QJ3A+mbgzvJ*@ncqhU9D3v2B*XR?vsK4!C;5!BNwVMb# zcEKIYZgc{}|A}Y)vUB9H3K@;Nm+(5q51BGjs(#=+_U6iJktk6om)e(|fm7VZJue2~i}UWDR$}*|9_KyNeySry9$r07;XT;OG`-*c(5cPr zoD6{@0tVwHvD=@Vz~%=rPV%)NNQZ;^Z6Dag_I-pD_Pl_+^Zqwb2le-xVjTrj3Pt<; zP3I>v*ZIO+Zl|Q0UB}gz?jr(ot-F*btZavMTfA$5G28xD*i-cGBZ&^)k-+oc0-wee zi)!ZmzU~$4b-v7^H%bM)wElzy!Y0#xgwp76DM&= zwU{gsyw$EHvv4NApQ{i}@;?~Sik1%XPI-{9EH(*lAN zw}gkNB8xUOMhEA}5YXFtG&ThO$&nYpwYAaa)BB(QgwTKf6N2sFmFpZ3S4r0xG@MY( z2O9dFb)0aU!GVI~5_G{=QV@=4xJdRhS?%C^xeeNNovLUM>V;P7TX6fK7!%>oAg#ZL zlS|JP&l<_5jf*l`jX6C^WZo@UpJX_V@g1h8O5Jj@=?__hFGQ-f3N*24B>>r)n!3I| z8S)2ZG?lh=q6(9HpapTiNN+NI54uxYv`P0GUY1t&pzv$$^^0!2qOs|z;OZ}P`Jpu8XvWk3*6ruq;?7J=LAZU*dCsJP&|6Wz= zo^a%plrCp0D8An0gdZy02;~{QQtv@lCag`dLD!r3c^;0E)%V_`$?4CfHR_V9c|T1J zGsn+kl)Af3{D!n!r4n6e91MGMX2q|}%G4^fbkR)%ik3nxp?j6uzr!WvD0y#pw~xZ5 z9(}dr)X;5#iGKKFc`y-TWH-y=pqLVgvGR8L5nYyj?)v>7Lgmk0kD4Jx^_YvNti_fI ze?&z2^9?S(U7ZmfJX0GoobM_Gzq#1Cy-`N$kdb}P?Jht?7-2l?=v1c>3HU@uXC-7X zfBGS%EX80v=MD;GFjFd={8qQ1WomBj(Rp^x^@U9eqxGn0jcirEqwVa_F-SoFsB5IiRkOX>r^?!$_{y7~kJxSz-2s-+`t3LzJ5+ z8J61enm~8KJ1h|PzDHPh7!CECE#0We82!;{A@4OeKN7zqUTU#>4Y~wBJdl&O4&#?q zG%xxHz3dOVh5~0X)}7`sNeP473t^#{^l%@o=- z$M7sdoz)s!60R+~ot{d_zyC}?b0N4<>4gI#6<##TTnQYy=5(gLE7_oX`tXQ=13<#61$(LKVg{ z`ia~-L4bgQ(p=cKOInQRb0TE~Ok0t9rGiiJ?)c#rATEf~aR$n4chEkG7p9XZ9*rfP zWkhi^OlBe!-DRkMEXqt7cDcUuf(-23O&UuP(qwTwT!KOc{rSs{5EeEXe0xBxp6QXn zk*_dNZ+7_gF8KSb`oeAwncMA4ESJ-7v&hqdNTP&X3#bWO+x;lkkDF1os!=$le==$p zguJwl7#H~b{$ct|v@(qYVPZ=he=E*Z0`r#P>I`l5(NT!K4xTMF&Y&{r#d6(Tl0C4) z6L@^Q9JSAP`f%9{#a&|+s$dApm@Gv5<%q_Hre{NaFhG+eMfHp!1CI2>$CjWikQ{7l{9V{qd&uG^V6#zHkvfx2v3_q=8^Z8RY^o zgkAp5KJHSSqB?29bEt=pBQ!l!g_Y}umJbB)DFxI@#2BU$Q+RxHV5t62^= zO+-GmQlPPTLVXt8f9%vTx;XG{-e40cZ*T7rlj5U0E#4dS;jR6QmV{L^@{vo3gr&?p zk^NxML`FzQT2?J=)WJ-25+%)@p~a+7=^{=YI+cI@M5Ykisj;&i!@SxBsc@DXd}RVe z(n>a4DJQ)UmZftth(XWaY>~Ov^M%%B!&B_sHf!X7QrLJ`aMr(7X*#o@|#&F6ym?#LrCsm_&Pn zkgkXWL^+`^s7uv&+llzt`3Ef&#{xIT)oL#1l-KAqgrQuencK8${w&LiO{Vsg*xYJ( zpEC`PtCpCI8UZxZ;)(Pn-|&h~{eVSMa~<9;?30-jRwYJ>G+Lp|NjQqLXE5{X)?z93 zjAXFMd4R8W*Qx6fR-<8!t|;MLdgi-paG>h7SbsOCgyF{wreHM^NVm~Gq2vJ3A-t6! zpWbEwK91SPz=|TjNOR2>0VV3oZOVI5#wkC5EJ^{9uo6A1rpB!SyQ08#@ zv~{9t`vw*J9S~DAfq+!7(Y*z*g)xL;a({cDGI)YOSj>ZEEb+nQd}Kc}`pRUq<6^~& zPRbqM1sh_NO83syqEU@FD+vC$;chgj68SZI@HW8+xp=s5Fz0Qxd+Y^$VxazU=YT6( zhjaMZ>5$9og!E$YM5#=Ug_hX07O<+9t@T=Cw)x|F!eZ9q4ifTb|L8;{PL#C60|@P3 z(s&Ba`gEL(bbdhrLNW0t%;>@n7~c2v`ikob^~nP^IjU3tAR(ujV}i+NqV>vBDp%2n z=oY(#`)?-PY$d3XTOC&MF|WmbVi)cY2r5lqUHX`Qy1tQ6e2+iF>5BSzb@m?T_t7l; zxYE~I-+FQP;Ss}i{NL_vlEodREbF^EBar%YJvfE0^6N8H;Ys>dJMeHzEAwNl5qq%Z z|C$d8Gj=J?V=LLYyX$ok-)~D+4(hKT`gD3uSKDyV5ABQ7p?<#N-85#o5EETK2Y!d(oEM7Z7)=jG!=5E4P%KSrR6BINh%SzcZ?2(cQF z&>~9u{00S!b=DU}PV+xQd?b^VRXea_0i!;=5hU>&hyXq1}A#rzxZ*wBQ6Z5-aiSvEGQGW~99oQ5U9f)3mYBx|XqzSzvm$+n0`~m}0 zNU{9+n9)h{RWUs9fVa(Le8JAlZYwP-OH!(DAPj90b-#_Nm`hpV(aVU~{r;q=A-F1o zB1a-X97&Taf=lr?J>1vTexzrGo|xF)cVDEMRr%BMC}Bu91&o7HUjbyHkw1t1`jy8| zm_on1wL0g_CNZ(T<{+uHBdi{4+Rtw7u#mlW>S<7s$`y9%E5u53Vzfg*7nr4c{f0Zk zAY{JvU9oUdo$c#8yjMgH!e!{?HSs_YX_u=Kgaz=8j7^Ctcn4@A4t^BlMGpzAj|pl2 zjIOygHz!^W6{=XTfJ!@l#jgHI54Okx>Oj)EYzo&7t6nC_I$EH)Y2Gkc6NAj~1m$L; zpYorj`--c!VC6lb1~{E+yx+OlgEOxQP+8{b;Uu{-U7nsRo~pZi;-7)d)~oqr#SVKz zJM}n|X@2mF6}s*0yL)>{7c-eUu*$JWI3JA!b&kb#c4vZ|yQjup$!@&2jqTTG%Mn** zCF9qF+)hv<^AXQ2A1}!VEudgOfXmD;ct8Wq1rEDzmO$oDcOm5A$R(UyaI$Oul zdxYj zxsiK}!^#kF5WuMw-;5xJYy^X%V4h6-(9cGGRFh_O;YuGcfICm57nt9Em>F%PFKRr! z{v|COeYprh6KcK1AtE!ROQZrf8rRcc+#3~a(`)0}Xe|U%*zmC10fWJai9jxCv_uBO zXW(cmC(>hD%$nw?)}MIU5@@h z0E1@_ADqr?t-X11-m-J2{d0jbW3H~vnRYk4c9ZSkLfBrdyL$0WK!r`}%{8Ux-J*&0 zT0&5i^s?fg@#hVVTJIRgI;%+~YmL_L>rFO;)nnBaC3Zao+OP~>Oy4eR@Wei@NKiLl z(S5>0@L-%s`!fTb+b74iC3OOG1m4gIKc0Bzo?f#W&a{EI+sZ3($zjxsI7F7~f0hK} zo4#rrN95ZkqRsA~?#36ZCVmF~tiQTlaahTuW%*`G^U9FQk1yFuL|UEcYq$A{T2MmI z*1z3dZuS;lyXPaW#F^od9D~%ZSsYyw;|_tHL@%0g8-G2r@qTrG0}s4j_|fs&yKbRe z%@*wQgt+Pb;Ei5#F}Yc%mh@hil#!&5vPnbs2E$_S>+dz4qra2wH*MfSi91U+wwE+5 zn-TeP&13C-=v3NH<#hX-$8N=#-S*anK3A5%zck0}7t4r!a%3+bl0bwF^n<}{rcB4{ zGc?xws)fn>6Fd8vp1=ICTCaIQ$Zmhkg;0;HJMPFFYcdB8G{?t3OkQ?)xM@Wbr_Upe zZ5N2G+B^q`5WOQGaRH#?sSOsF1N)E{GlqW0I|Ayt%gU1n>0`A+Ab}@J#f=BqGD!*@ z23PVHLpF;%)hyxafUb!EVZGt6;~4uR=P0oPF7@q8U4XpPcND4YAh)hRfa6O3RL%oj z=P7C=uIK3*q9vCvcEANFIN_+7LXaNNYn%^Y*)#d%LK6G52hozdPIDI*$g_WQ9&HS{x?3e)_hy$Aj z4(O{a*j|KbzP>*A^mZHgx6LN~J_Afn-dIH^+u6)k*OTnOOphTGZQO9BhPi88FT`8C zMpUdbnDA_P1OioZ@Gtq?D9nn2YL1?@uRtqM600njS=o5Ox;~!KG#-eeO3`TZTOR0_ zA8i?ic0%3S`a-+e*cRR&NgBzZ{*Jin?Tgt{0|^GBkqBN5l$2VSbB2x|VVGS(Uu`DI zHhc(XuywNu0xA|DfpdpU?DV{Vi{dJci)&C*WVg9G!f!;RJYbv@Pe8UdMrhlB$%s3o1@|{t5`z*y1jIB z2*3;sc6%TIsaXc6dkp6bU&cw4_>`asiOCV*nNAO9U6)@Ytp9CKkr5e`wiOMtfOeVm zBz%O=hz7Y4?oOrf3#XG4x0KATG&6_xR@IN)8qThQzE zJkY13w!S|$1p#h$W>=aowC_4TdG^gdr~B=PO9hZ)cQiCLSL*EqaI;)Y4#jZP(ym^- z%!Ct6>~j3YbDlBi*-@Kh0GQP>8)0b-0+ELl)&W-Ip1j=KxCevZL)ZdoV+fNKzJ#sI zW`HWvV;W%h?fL26RUUC`*A}s&BCLg~FJk)8)`InxH<9%3i%T<~NUA!{l}$7U$i0(Y zsd%|=*cMFQUJtzd8ci95=%#TXcYzOnR{3ucOzWN}4wL?@=Li}a0VpxLwcu;7pF9oZlG;ip@xtOl>HQB~RjQgRU=*WOZ zFc|7wemuB;zwoN5*A$L8$(wog#hDWzz;w*45-8xmvm!_6Qi4`)KH2xPQhV>_;oM>H zv#KXa_toh9qXy!?sflR98HoWh|5fgd6_m8jVZ30TP;373`a}g|&(lXz@hsSIrWxTd zin&|XH930}?%h(hgt*Xt;7FUpf}ddK;h@O|Z8n*Ws2y^uuzsg%!MQP;dUcTixbpM3 z>Ph9p;`-prG@lezso>Jv#Qqu4LJ94et)nBgvr%MB(eWX{B9p^7iMRZxmN?kfMzKgS zZ;XFJuNDK7Zvpe3vI1Tm??nKBYwKCa&@s;5mv9HMspaq`gF|i@NDA#j?+&N^u%g&# zY6aiXiS`fEshksuOyswjaLjPqUW)vXVc!$k(cHTdB(EM8BFAoi)?dTzlMHA^o8?^P z#(a%NPwebZOF}&_uOGIj9FVtq9^b?meT&ugBdW48w)4C@8NE&zRv!0gLeF1FanOIsY*xeXC;Z4b5H8^fe1{1Lear1Uksm#;h$>dc8JWu22$C49yD<6wR1LLEiy2F2 zz1q+Jyq`VD-YJc{x-pxYFWH;btRofK}CE-R>4q!&~ zA?eHYBFJ||>2U!4!brM*pXYz4)?L7H-2x(hERHLD91PnV7I3#*uJY7gKiVlaXi=Hq zX@rpJZ9h=h3iVBBmi}Ge8=HKez8`+s8p``UF0F96EA8OjZ>3NorK;m)=w@2bulahr zoSN8%6oEO>vs8gDgZ;{~YnAwW=)+m#q;V#DIp3vos8sP&Xu)Zagu#n&6LuZ+FN0vv z7ikNE`J*Qh=mID-M`OLX`qHMV8|;wd9Tj*>D7fr$@9^wZoj+C;vqQ70vsx(XcH5;b z;KW(wvFq9)VEJP`i0cPFUXC00KBo^R@Vo5?5tM^G*)NwX#70r1wP2h}4~2()uhIuO z#BijIfR*1cl>FAvX13$PiML1jz@5K_Cn55?jVU2USM>}AYjc`d_WQ~bVGOY5n|d8j zcl}szyAelD>j^7DQMANa0&+6)?B8`aQL`=yBh3j~F|$12MG*&2^Dp%Vat}jxR$pIs zr!dL;chdaYOizqw;QFr>V$>`)%o&5b?@%wg^GLGa%pi2=3HiN`nRut19yj}5$*I1m zAD}K+t^63D)2+!lph%hC`~5D>Fu1VVz3bCU34FX)dAoV1T%em0`&`?)y2<_h)uv*G4Qno9=ZF)Gg>#WHI7QBN7CzW-RisMTt2z<$*tFCAj%t z97*)tUNswRok;jSkJ&xn4yv!l#rHS_&2ej>qA-eG@Z z?}_5cc|uR&=%zf&zZw~p>8BIs@72DH8o=y_&g+7^`hI=|O5HE{ z0y}Mx{whje-FP>hX?25F2v-zX3oYmru1m|Q@1%WI$ zvg`U`?3jAN?Sue~{rsEll&Wr@o}84ZqjWw6yFrL2;(aOBatq;Xj=H&0OJ&KB?OSCa zw+^M<_>h^YfdEF;R<#R~*B*<>`>mV{CW4mtbYX+M&%<}~cPamV{Ak^)E4F5?J;eyYdYx9~7s8NSb{Idpg z$^Q!f(m>}Q!gD`BZpJ?H7gp@ABs|zNz}vVIe(=c`K@ z%NTi=hK42Du_eZV*9YnMu7p5Bvlwxw*~6c>xqp{(6r=&?s|t**B~aM;M$z(d-N1!w z!;Hyqc6!LmUP+N@+EiospP46LaB~-N^n+>Enuqt*b*6^2SjV^ezPCWYbpa5h>rZ#9 zyqohq$2dK?P2uq35FvJvIA;Q)n&i7)P*vIA{55GWXfE6#kRCb-I$xc8)-JpHqIoH# zRIOw3>^cLhyFCeB&20Ju>>_)RE+2c;?V@^a-KeEa|yw?@{Bu9vE(UNv_i1K69&J zSVra<>I`>q@)?4&n+~ZxckSSJM!Gm%M${L$CZ6C?D45Mu)wqjIVu^nD@r-C(wC$^$ zq|R46$7wlB{*d_CSG68%=;@t{Z*JT~jkzIU?=_F+cZ*t+z`=$!t1I@+Yh zV&2vRUIXVfgsy*z7OYq=`J~?a31!=Yu9rY>ZKZQJo)>P0MLEb&!4og2bt6`QeJqTB z89Leyk#B#0Z5}TL_FbZSvil%dBk}{1Zcuk(G7uREzfIm7LNlW z!0W4XO8qj#rMElOV(WES%-ft^$TlthX!Ui9z2d`eah*8MO;59fGx&bA^)LNxP&1F| zA=jXHzM7_$a|_J|yzoIgp>yiSowhc@Z&t4P`-7_6NZ5>t2Zz+9*dI!R$OLN}rbcwk%54ziu*jld_|^p{?59H`fq3*0&gB;jqBct5=q zeAXxEV+qjfb$;(2dPm}q_5v>_^g7!Lwn!3YiZ8v6R@w>2WIU0l;W0S$cQ#+Y*CawT zbeoJsr;DOF940&yCJ|(21ut}7qX6~XSZps{p}%`G!V(3XA_Z!fnUJ{R>K z&~@dD+01$=kZV>~2w|_aefloEi4&Fq-4QteforcmOf!2u)U|>;k17vL3z(ww*!`Cw z)_ahc<|~&&n_@^z?S5PoZGEESCp%T^myw1qxGo=GW6%z58~*p&DthPO{+k3zqfRBc z#Y|yqIzq8^hcw$?6W+&c{B=WT$Qp-xZq{=itc`uWs0KaA2)Jue6ADa4rrFSklI=M9 ztm~JS=aq!`uPFhOicLa$;pmE^h*0o}bed9pkwRe155}O^+6DgA>iJ5o?N6ihyMcse zc4OmJzqLlI-pQ?Rs_)Z3CR%g)ZIlcqtFhQjf9l~eqjy)oqh!SURjvq3&Dhgu!xY#~yS+ewKHmxo){LD4mb_l9!ik@9C=1ruz__E9|Bmirq{#ro$pZP)*KK` zueBobbQCEzYh7QZDfib-3Dff}Hw6$ci3~+)+4x+_ccBWL+&TDt`G$^sW4OBI;CMiU z#LO3Y_+!tuB&G!#Zk#u?q)lCXXh`1Sy@xNA{d)9jkx%TX3!oL4rXQfo<ZZ!x zfLR+F7v))5PYk$_mvL404V)y?_{_70h+OY$L27%FeiEOS=C+B)qL$AP36%fhVUch) zx2V_&_(1oA?vLYute7T-B)Ol@=pgJO9$ZzB6tI~m5Nk#Fi=Plln5-Bi8S!o*@g3xh z#L~Do8*cy15*L?Ld130LXA_JK)v?w@-?YVobg6?GgBRmRIj#kCSkxYgp!TPE;bi<+ z#(AC3gi7!|3njpC0U`nA(-UC+nu{omOk-xmI6eb=#u@p%D$N#J>Nj zed(GMGbqV+Eofj-Pns+f9cJNuDk770 z{WY@E$}sUNpX8Ru^q5k{qmakN*#~CHoIoteK_Gv2_mRm&NwnkL$O_*2`PW4nBUYKF z>1@Xvz0TH!Df~wphniiacuac6Y{enq?cvpfk-b__?mk%KVXZ$kD?8dI+XV~g$dUa~ z5AO}=f_Aaf@H^5%P!yc9`VfAjwu?PkUY;kwK)u1G?;Z_eLwaU<^S7E(F`{1J+BbRw zaOy!7-(h05f1f;4ZRw+LsGtuLfV_`^-zq@kG1PDMEs6tGi6TUn6-by`xO;xK~#K)f(bP-+Ar*k30na;^5a zO(!%WLRdy7(tYJee8$Zohj62jTD>SSm|UqM(Ea`2B5epS3?`F7b_n$?clKyk4lqg?E&Olpd(4 z^5Dn4+1%e;iKX5M!CS5bwnsqh3c=^C|&sp zrV~57Bj_@M+SxcAn`6N1`uSNtP>FBf36X&AL?#znik|ziqQ|8iMV+8fyUTf>IF9U& z1GoAKZxw+f3NRZPN6p1>^W1d1aPvVaQyLG2$=1k^W(=V}Cj{@=TQIARnZEw(p=sM0 z`b}J-+pS~&mh_MBw@3a04A7efCIXnj5j#P;KlG~gCo|(S5&~j(1QSnZywb3T#RTFW zYCO%iVVDuY=f*MzHPGr5ikZu*L9JVqLS2|(e=#(rM)BT0ey?`DKYrqpu6 zvuZ<+G`hX{{;5^|BajQ>ADM-=6 zkZxa_q29~16F;AXTWW%Fm2K&xI7^_izx8*q4F_X@(pj+SM&MHVeuDHZe|uANf^FQu zMZ>-OWqoylJ9B2{rN6!YP!+!^x93)VK5yQd>GFELiW5@? zWKI#$_@}GC#WLLirzdxiVz?Sh$he2jm`c7sy8D~YB>I^XqWsQ|kI%<>)4M#@EmAEA z+y2YVWY`DEY75kWyAjH_hkEAFip_zYV*Bk~QD2cMCpSe)gEKkHwc-DE8Tyn2V55Mp zExU^zzl`YLnQ2;Hx)2zR3#1HQ(}K^Pz$@LKUgdBy)tMdqMl)`AthT`+6$@g01O|NY6D zJ|Fr&Vc@@6aV9NA;2i%a1RQz5nh(_q4u6vd8Rrz({7*a{3O`B1ujT)DAUQOQ{{I_< zYh+}kP_9O&Qmyx1svU*Hb_eVJ-!5E`ZejnRS`S*{+&J&wMsOy>@w{R%WTu#VP^T1h;=y&?46_J1~5EnlElFJQMK!JbYg2l{Yt zroZcUMgQH(iN3=RBPn{`N}fKh`%Ie(TiXYWAE~T-=Ijb&?m3imsS)Edx*xyQrxw86 zTz0)8;<8&SNOyX4ZeD4EuVwMx?ek2NjW*c`J|Z**y-sQJjNNR05bA+A_f&IywVv`d7>ZXSeE%#%Xl$1j?EDWp&j|qCgkEfh0D9PR zL)g5nUIMRnluw51eDEi~of+qpy=E#ELhm*qE=ToC$2MS((&968tDtDPBm43Nu!sIp zDT`R$?wIIvF#vX!M7C!B?mIeBjXV6!xY$X&WlCg@%+zH6z#JPty(zY>xey`S?la*x zsoAam@7-&Bnfa~W@(xdnm&sf5PmubpJbKlyPbqM@Ryo#xDP!}_<-wY`X5S9-IWKuH zPdLPAZzu}%f8Uih^hb*2 zoD9!f%Zi^fy1p3(SyZx*M70~=$cqre)wLaI%y9Jahlq_)O-1H}Yxb5uZ*bmOpS{Rk zc&dtz{4b#A06)fC?PhcuG(4xu1}8h|hhQ{<-G`<4FCDSD-1XM=Xetj8=Fv0>z(mMk zk88yzF4cnk=K0{&ewW!Qr^Xa&0gs8n0xHiOz}{qMDER9onPj)XcrZ!_hyTvqI2)DS zCrnb~!9uRN=6`o|f`7+G8z^4dz8`^OyR0O;uT-&s(Q1jd<93P%I;193Mr5R@WPRqE zh9g)RnU`-eD1}2~=RkPHUBNfCGmsrNhs*;(10V}oV@-U3NLKhJS{3mtUUq5~K%3Em zf`acrVJKa_^F8?8JRbqqk&f4H2*ts!xc6^P4m}D#5y(WdmT}N`-K>~`c*X__xSv2c z)eCrJoO=KM0GKfDwQ1fiPeX+K<9;QQ^+oNHy@pnk7cbit#rL4rIwU>^V>Bj#+Wf&C z_dya1>P>ys`9jHHm$uy`aseg`^0)T5e*Y0NLd@=)x{#~|br#DEc(Q+}!ctqiQ zK9jHzypc5MMkj-}V`(ldM{RW>$V)vPGKY8P)RN+{b2qFdD7&dhgDK||ebln75NS9g zgln-f@m14aT&LP%5KSKy)o_n=wzk|Z4Z+(g?^Xugr;SLuw0luEQt9$vNV(}5$e7Ow zjA|u#(zI>3*U)gdT+M9j`JclFDELw5MqfJ#@46=D^rQED%;qfxdsmOo%E2imGFab!#Hyz{iU7YSo!?kCSE{!S05i zT@48iBND$2Q5j{lF{DB4I|Ew6-a1ns0Bav$NLz!HJcOIL#RpOEYhHYpcBtcExXnOO&&tj$1#cMsQ=nK=XQ4 znBu#lzl~|o(4Rts3D)_V3?t>>^T8xQxbgG5K_+}_(VTB_czw^XfZVy~Oujj+58lfz zQe7qd0Y{u|p@gf$$`xd2;vlnvAr5;j9(ikLGJrY9c*P8FQyJ3LOt`8Fi19l<;v{$p&uEpTb)_LIW{XIAr(+xc0C({ zccrhY;~szv`@fv4^E*|85;Ioz;zR-Msp6**9H>IpLTKkxdQ>9C97(Q8LrX|&OA6~_ zZ*^pw!n5!LbqGuKd9A??c&<0&;*zScDL)Lf?k2dq7$c0*q@3%siD1_akT0vxAZRwf zM;ep?JT{u4(+HP7=s>l*zj{lKq#1o=D4X^LPW@)2Nn~_N@;W7}DkB^!jJAsPN|p#o-D)hhnr3a>@a7Ot ze7x0QJBvg#mQJ-Ima<40j2wiS&5(48xSdpscQ{=@nOc!LX@M z+nvw?4!ed97E*0^vv%^TkKSK1>4yd3yfWEu(gez|Lb28)=n@nNRbx)3o z%zF9le#Akcyh&1NsIx5!E`|}%@7$f*dP|TrWCcc=et}m-$KTiMhzU$)$Gd4qXPFPU zqSQKOCOqZZs+$aOy z|5`H~XoFExzv3T1G%iF50px86bCEdM&8W}P7FJ z&B-C`lVkgIeXJGV4;mL!$z-^5?g)0JaK@I_io!w8tP0U5Dd@gkQP&x$PFYKrd0O-Si;vR7M|& zC7<%^xy>A+tO+CuyYTdD4Kcs@W&`Z%tq(Fj>$hR{yT3krQzXy)8E3C0Ax0#A&Z^le z#`9K~_xpa{bNk@>O8F^E_-T<1qucu0`E4vlKap-Eeh30NGo;aT=o-^cVPpb2P*YG1scaNOIb*j?oc8Q-rK%- zJsxder2CG~y~Yz(fL!CpbPln|gA4}pP9G@uj4gKW=|Q#eXLVqB`^pNj<#6asR~3x< zFD5S%@+7Vd>OxDxssk>$l)HeShlzS~5s*^O> zzu{rW+1nHvsG+Yi>bI}JF4gXhFo4WWOGJaA+{Q7 z)5~fq#X%QUUurG};$po$*iF3Z9f*bR34}P{Hsl1WR5-%|jR7r%Y& zdV}PZp!qcvl6pR%aGQudRDpCH3&NFAu zddJMhuDyB~53Axe#liY>tO)$UV0!dcG~P*xkJ)QL7K@g!l==GC-_n!i~(>?K9kVeeSzMa@4I>g%~I2x;y_Hi|t;- zv$ogsM@@+?9_$&Tpy4FMWhEd(({-?@vF{$k-ts#uH+bgC_7d&d&(j1BawUvbd^8(L zBLa7)V)XfWf3|h&+}0#NDYJO?4&O|G8r;U(pe98hma2=A=Svz2bdad0qe}c37ZBSv zj4XyVuM~m6=<}XDViDXngCp&O-dRFOh?**9lN9^i$6S)$#k#Eo(V8VBJ~Pbrg5r*} zyV@FYnBQWj+C-eX#rRw~>D-s|dg-Wu`WttxB(q(L42^`VwN!Wd4T}nO(+Lf3^{Te+L9Z-y&_%&AYcayF& zwQDBifj71oN2+i~vwJZXn1&Iz7aLej{{t8Z(~>KTvc(Em(1!VN*bQLa}+G$>U7?9`MJ@S1^#F|#ik%T)D|uE8fuo4Qb=5% z9EMuLP*e=5t7STrg6qWKZ*oN15@Kv6)e2eIao3yL(VFAS8d6CI(;=}q-eXKi6Xg7= z`M^tlma2|7wa?N|N(cU!=NjL&A6MePHVJ)R)feFz*@`W8v9NuEEF5&6~ zL&(Magk3cn^wKxn)O71yiZ`U9ZI4l`fqGt!66RQ18h&6u$J>1K52}9lf=9*Lm zK)p;LqYMf{E;Z|z!P-pUk)^w^iQz$XV4OarXo@;|c>AuR9MxBivBr<5`nB>Qi7OP+ zL!GdPJgxWC;14i<4Ndt)Ct`S^G2E?;jHWT{s8K>u)s(;D0V&FYf!f^bOj8VmnAS;* zvK2$9tuj958)0Ro#~1wr2_Q^Pfjy{U3E2Q3NuU%3u}|#t>9Ax! z0K*7IF>Z@e1zH8@WY_7J@TnNsV)A~mB>3DR0(SLjv>jGEB#>r0E#o7#TL*mNZedJ{ z*J_DRhGCXHaJn$RtQOlZXZjZ6-1CA{&jphr?~@$c#B6Lod|+L9;Q^zpR&^Hd_@c$@ z^O;;DopeMtW1Kg}t=I}jya#jjsae4O6zu>n{3j2D%FTlw4C+d~!+_?G!cscy;2`PU zF+3sJP0L)bEQl_RiymnHaG9is{oOUlgWFz)INQ_TnT=xsQdC$Axj3%)LONf~b^=1! zS*ZwwQ6tAB@Icq=uaq6l6v5mM8|6O+xSk zw>XX<4#%FDYFuHfKTL=9%B!i5pX|+C)_ASqQzmEX8ETyQ0RA_A?vX8k`|(_Sieb|D|DF!|Li#7;(6@a}uo=s{?^t}sRlH=zwS z-T!f|I1Y<(jgOO3QL(}4?2QCW*ilJo({-bzr&+k(ry1_F{~`Q*C#wy+H*65Jw@a?3 znxv<}qu5=H{E!-&qqbu2OCYdhUE3!P#h)R(Ay&K89Dxng95N!~p&9=v=jxqf-h)ff z6EE`$a!m$|gFsYjtl?pJEIAFkCUDo3&zHl{LShvGkLHQGl?rs@VTv6Z5NQ!=peK!} zNcf#PG@;kp*?!m9s4csMZ_Nr&su|X(|pVkE^Yq6)gZBqf&Cf`wtOB`GT znEz_cmL*_|QQZSw6IW?6C221E8;e%_^XUq)J=dgRifbKIqYf_%5w%hvk`JI~e@mmR zquGFh#LxA}f@dejEhA^nYK0ccF$AMpa-ZYb#uynzhcfG{2I_BCqaNy&tYLW`*RI(^ z+%|88G|Y1=%0sTXY%+SEPouuGMOuKvad&Ga_)-bLqyae~UyUMjXxfiI`946FXeN_9pq}O6e_hcY2%9<-PL*i? zoO%WCu^To(OdnlqG{6m@qlVrwBWU?~^9up6XA^sZ_OV11WQ7} zd1WT!p`J_E0+|&0VcsLvzKt%Qb}cByyKOBhy1$CMALLg@8eW(Y+_4~R z*;&foahFpm*BKkVIz;`#V0#ZLg99`k&*s})Bz#gmI19f3cYth#x2QHFJuWgs3?WxC zB@oH>iDtwa8zw9>VML$;TS~_!2g8wX2lqf|p zx2rKixGM`AtnKEFBha5xhdR(5On#$?R^f!SB!D|k=j4#_RZHNhn_7h_pam6Q`c||< z;_TM~dTj`o=(obpPb&LaEyXHGT8w%8LlnyBx|pw4OflQ>Y7hoHtc2Wa8H3l-`9CEuQNM@^t}O>vsrXSf;5phVqK z?l#d-;~Wi+vCNJ_XiUhqYYjW-N^n1{M1Bv<- z6h~yZp~Q%AR(LF17R9#?;z*U>SsOoyk&h3Of)+A5WNC(MITjE|mKUz`ID;OD*e(Je zKpLBb3Z9d3cFUx>`J59HRS@T$Wp7k^Rs&m_Vv&9DLH0ru2?LCIC>asRG_ahN=-9(6U3vz$e~ ze7s32@hz>x3p1Mc#)vgNG@8?)p*wANEtdNyEH;cC z`*ukU=5OSFwMBmL`?;0~rt8-Ow8Onm>k3GwctG=ng}l=E0Cf$dQC>G@(SQYf+;kEV z()Thm{Q*0q%WerQRig<81*hHJQ+nAHDmoy-Fe=I}J-bIV`wdaEoJnL)H~PMyWoRCj z5cgufj(E1MRDA2vWRfe}hmghx_?ZC-gv~1}8VLC82!8KR6oj59Bz(3S1zdw8H3{He zo&7bd>cR8s?pTZYVv_IQzk5GS^oadc0-{jbJc__=ev7Tny%g684!-Ux@W^5 zse1+>!i{9%TGy-qWgS^B^(_qQdD1?NnYBRup%iem2~j3o8x>&Y^fP3&*} zAS~hk!ImwMokp)6)yJoWy6A5R_c`D+N|fYAW`O6y9xaG|_*=hbszSn`u`4PL#jw>i z7F4Pu;!}J*&i7lqo8n~Z@{Aypg1=Q%Cq5 zzG;iiF&K)?Rda>G)>bn7Svg#lIbZfymoqP?LMU`wKXfcx-jXm{EdNn1p+orY+dYwN z0G7uQsWBc#>bM!gr&O!NA;PQ^BaH zSZj1`_v{g|GSNu zyOdhXzA&W}$4_ijGY?#~3HiocOQoYIXw8<*P*A?mN*!YKmO;O3al7j&%HMC=wK1f2 zyJ|G$*Pv!OS6YLud0cU>63b!Y?BA(59BVbKlYybmWGXaOdEL0O%SW<+ACWMImc%T! zcCi6B8K>E&Ka0j_n2`I;xN3ry=h7afZ-gGi1+D3uw3-%U^E*q%l z1F6MIKb@-Gwv#736-||t#}f@yyZlxx~xJmzL#3@yGu(ysCmN93V) zWZ%qL^UQbGAL`{P@O@L3c4M+|GHYJGfdnk4dS{|B;A_rzWuNM$TIWK~pB8p@L>nMn zQdfYrcT4C__$+b|jWw~x=MhzZveV!3+a@8(vIkBmI4l+2X_WYFTMyGN?JARtP!3tu zb$qnQsnNL})TtwawYW#rr$4r=X`?)Xl156^@vB zD5AgxD~cQ@t6LJ_{A6!0zb7Ng`nm?OgmC?Jc$ejR#182*r8kYkN7|FCdnxOrFrPlew%3{S8!zEebz z_+7-G^ny+kI0xy?xEaBPp-|>^0ZJn^`V^8v_B|L**69biC}L${sclba|45p=b?!%? zoO}>W%-H9d;Jx<;52V67&f6WwxvOh2Bok&mt762fDkcNNY`wgllsNjkpBEro?7OCp5BDQ>7` zm~|uqc|pWTOWC^+jB*)uPR1b8as;sh4{Ci9I57t?rNMjpk~jW!E1@h(`0TWPEQrfn ztUGRwWem4+#(o^yX-Qvwpl`j#(E17^n$YFueornYJBW%ChR!}0Y229Uj^zPD?2j!E zze28t!FB!eTI~|xVx#Z1q%L};2WODk$TjIwRJKi1A+jx1jh&UchF7@`q3}l7r}*Zu z73qK}CTBKI=61h%?@55_tRIRjuJH3xoI(@eH_hjrJpajCEhhVNfLd}{iiL-1>yM=#3hD+>0{*-!nUa7C2Ye06ojh$=s6OM70E!i}|P)x0}~BFiTFUA0lL zm4dtEA4%2@8})T03);10*ZGe~NX3e#qyWYs>a~ccwZ7ZuB$xSN@xu`tX!)9L$?$m zZf!E5b1{Ix?wYwfQe^hFK8O^p07*}Y)%Q{KVTWCreLrMxF3e-)o~koFd<- zE4@q!<}+!`g?yn&JMG?{ANm*7^ zPW89cve+plzhV#-wJsL=CwlZA263v-1QKy*)+UoWfo&pPm)*MfT4jC^RkNqiR8xRk z@mpirVVGGr6qXqZPz1|c)Q~G|Pa%{6LP$p?$EYZph)xE^!SE1bs)W-h$RaeE13=71vvIkMdsbWREL<2G9HYnV8ZzWvJtKr33tjheAwA!K2 zDEyb5qBEU_=^jqFn$=exaGA2^^K4!KvYZ7)8o+zswOtGG7CJle2`!ozVATofTzMvu z1MjU-zbftkr=ztVhIQ|xc}Vir8qC2$S32e z#-}|XMoLXI<#v}e*;rxC8E@Lfq>Y17ziw;$-XvEd1f{D;4y`Dfy(apv22-3zGP81E zrjbr^w4DaK|1DTKIY013bu;e!;%oSLVxB1bYsX^bYQ}Gz91{c0Kt$XC?^%?(kodOc z;DU(m&ntLW!0n0CL@tLOc_mR0cF{#Jn5`yZmzf{zV2-7OU)F|S^bz5 z6l-f|)yOaTq~mRn%{W8Mt_7GhRF&OEAS=xTVNsB99ODqYwa`Mg^;B33A;rhFq_A`n(sLQk_281bIcRe&VG?kTd?&|GEQ zloKLU9|}9FeB>)+p^0R9}vxo@#D?1MF|@5{#J1;)h8%*^XWme2fAVi4ouBAVCa-f;48!Rrk7JEv+MsT+LA zjn+@gP-!I^{PGA6^-7%9s|N#gGIZ`$x`c$K6!0mjyCWMr%n2=8F-qd6icDh~R+<{( zZ4^ApIK1<7K{w4N`*@LUyr{{0Ox)q(OeE2|c0$^rW{Mhe1(ueWM5<1_<6$nS1FaLk zY0>FrFrY$Wc?a zx61IkcZwj1H(pnGtO4m=PnWt{@?fr5Ds3_dz}4ciEhNcI>*Q2J7NIj^=_eXMTAG@a z)B8zJe7esHUYvxz?{&E2 z#}qw(Up$wurh`c4AUf7-O{7?e{bgr1S&w&}9XpZ7Ly)eb?-!~z=JefeiB;#d3Z>ph z0lpUkd({CqM=SkZxXjldG$6*pMi@KSiC(YCH)(fqwG52)NH2$yGbTVvTqwDfts9D4 zlL0}O=$Sn|b^UB(;_+en+60QMJ4&?CQ++K6b@0Pd8zQEVe~zB+-2Fy}2D$4bJEol) zay4527WX=oaVK4eSC1_G3S79iX2a)d(C0jdlga>N;NykPo?GQRkFZ32lpoLt+My~^ z)h!@Q5(a9TJ)JZE1@f{eM*->7+ge+lm4FpN6duvLu3z21&p_9-^8(Ms)*DJpCQCru zJ$+k|w2F$enzZjgqoU~V4afln-Q|OQuSkSQ|AJSUAbtmz&mKa^hZUq zR?MBO=og*$qy*MFhJFruYN6hi*-$zQ=;f;S)+ zYFLQYtwBa11P@knX*q)Iz(>n*(%0f5_Z6ZpFI1AT}~a z?-W?oF0KIOY1b_KP1RAb+vu!0Q}ZuTG~|IEa))ju0XCJ6%C_qo^nQP8cPGi&Sxe6( zF42SvDOPKPpI%)vpui13MrAWqm3VzSPpj|uhs0xK@JW2=zE})({V2RTW zBb07CnEz~rqRQBqt1rjl$(k9&5vW+i9r9SGW?AQYBtfWE)*2f|22@*|)2$X$rT{@= zCS!qYn$R|?s>ut@hUbugM2)aFpm%AO+2Ft>`^1W+SmcU4JJh_w^hd?jFwFed77e_B zi4UkGfJXCdtbjYwgrU#+h2h(thh~pNR}sj*m4NAn-?>WgW-5{*iXw^ba2T@K1NZJm zHxSBZ3Z66!h-qP6=0##u%1ByCwkYzqQ+_SEDLuuYKNu6KG9?G87WuOLC*8}gm*Op9 znVH}BwfG+4XZL!j-(%3THNp^9sqf^nAJ)ZwH1iBM<9zv8%4_GMVP*19p9L4uCp8hq zRs9w`;5fJ9xZz2M!@5ba9q0|m9ABObraq9sA1ZMhW{w|Ol@9xLrSq>(cZ(AFAAbwv zh4^b|@CZbUNQ*gXanXfi@`YZjtB{jf@A@ZC&>&f3f$j-i8vsXB06VdHYGLFy5eQ7V`3BIFbCwp=1vK14s#KW4%Lz|9*&zGxx%Ydobb% zCg-DIJ<{2VhFHKP;$17ceb56E!*GkXp?@(cFjZ={DdkhCR2qczxI~Gp6R%&OG3Bp! z6ZecKl@~!L25Dx6!Bz8?V!RMie6n{VUxZ3*RS(MXhF?xf9XH8|On;eqB|Qa;O6pBl zA(+kg8&9!VtN)1T>e&stH_snYy^dCCk`{*kmRu~8bojv`ED^#L}ThUvHA1lSnY%bSvp`4H};p? zOS-RhA@MdPQDa@NO32?RS!0~T&+JTDG_eycd8KwFjJwcrJlRK+q`cmKeI?5EMJy5!#G-^JQy3SzG-)89Gh=iNb z>Xdlf08f81^nthx)9+< zNII2WZ?Fi$qSFeVeor#iFH1BE5P&3o7Bw5KaK0hobGMYYCLC#eJsgHg6Gpr)cRK27 zNjYpy@=~K~yeW6SjT}j)`V0Cnd^w`=Nc$pOUT_b>9LV&Xj+XcfwB*1<-i*>u`^1E% z?r&?tWzWJ;mlHQYQGG~`#Kq7r*`f_GpOYEQ3cGOcj-Vf(ZNo+95i#+JtO+&6^3;Ja zO6ByYvdsH@)`3`2S{U=Td+(d~L>>)V1u=z#{JRedM<0R4NO}7FLHaMaT%va4kjC*U7(5lpjol*oMG{B<|bJk zgUY8!hC4c`F2C9cP!h{eziCJw&*@r&2}DB9j^rSjHzH-Ma*EYVOtCro1nKFH7FD4; zjlQ3tIMpyRAcaT5WMw}TQ?-m%(e5`4uzqv?qCL@b)Izi5Taw|oTh1gxPd1xUM~a(t zUs8+l?YIG(P!&emRpgLMGDFxi-@KH-N8MhZ9~38gf$AdK3ypr#0tuY%-sZaV7+AL( zN!tf~8f8v3dfXoi_N+quPDiqAv_;-ew_}&J`DXf0S0oQ2Q8)G27J_!0ZJ6M=O=h`J zipu|@9;+K~#cK8mgBl}(r=G4Hdqs5_Z?Y9kDLICaK>x=pQ9%KBfSM7JEN1u^RkT>L zn(>EFkA(RZZN>hV9r6l)5Trvl#FmcUmtVrS@ITH75y{;P4alu+zk4aj`<( zc)nQfWa+my=wiFzKU|kgO^iPcVa5g{DOvx1|H(}tqk=|D}MN=9e5G1M>0Q5;n0 zf@vr5dZpl|sZ3TluOfN65d}ys@bVn9la2tR-CzD*GP#_oMgsS9Q~$oamFjo%>(FB- z)9XH0e{S7`HIzvYILc|8ZLx-ZPnc1KLDF6;$2srQ`7*JT?9!^H78dV;49~M53Zd+H+ns!d4M~r0+Sw?)6=KIiv?Myu7OaF_ zGhs-J|97FdK8%B)(6}YzfBd2&Ymrm?$jJ>Ic*lEJdy$d+Z9MSO)gzs9&jjlHJHUKG z3M1=qGcg$%8-1=(`PUeKjD+>3bX+Ec3}#JC*|=V=g$M;f=YdrPB``K`(^<&Lp$K?f zMgP&}%s#RU5H&4sTJg&OPVwhSqjj-n8eq-6IECtym99}15EXcIe+G2aQaCEA3`=FQlku7gYUq8 zfWldJm=ZOrWfZr(+z}YEiUfD5;(th^i{(GOlJl!XQ~aqX#laU9lQ_|jaQxR3EoZ3I zQeQdJC-@%&TIS4>Upz@BIw!LkrXGS1Lm8}vDx*^4}@g z7MYH~nVw{cm(R-(SauWQcxt)8l1&Apm0J4yjFY|?76Jowz*7GPHv;^-hVk%*GyLP> zgns`Vcu}2jI~n8uakXILV_p4sV9-<8EQui+8 z6j1;d7xZ2v^vs0qV3K~@%>XOK5V>{@U2nkqyw1s85WGOKrokOP4*O<|m&aRjE&aqO zV~s&c0M$4_i%%T@2K4#Ky$Zfr!6l!l`5=gI=R32gxGBHVUdBf@Hg@0CB+^FbNGK(C zP0|YhOLMm=M73b&QGlQ&#^E7rXF!@Eq!sHBY>5H^e@MWFp6*0Q6LS0a4NEm#U03YWHj5N#Z)(?(}p;XYLyZ zeb0l$pEe+CW%|`Al_gJ6hmt`<1mXO;U&5wB6GbHphs3y! z(>)Q3GD;R1==^tU^}+w4AA(~vKbNxWLJaJ_oECa zNqJ^6|B27n<+gumgQcU`A7(Vle*ZigGyNE~eU`1?m2EHU#Z~*BpRfweLGj zg>-R~-nmIFABwvV9Vs2x!4b@}?iJtK7a~9a$@+KQe*Tf(I(NMeZv#8e3+}2a`Uz4pAVaI5l)Vu5P1ihD?U~{@E(MOXNQ5k-B)BVmAe%IH36BoKkQm6 zjw9}_1B*?)WfD)BC9{+mz&kyOsp+rkS#e64lA-+_`?ywuzvG|_K`gs*dQvBN{sC8HcEfO&4IB0AKp19zpp1A|8+v}fHIGf2jt{` z%l4wNQ@}WN6U-55PXtx{3Z9J&I^>R9bctLg9&{0Ubfo|0+c#Vnu29AB!Koh&k41hj z77b7Gg(mJ8ZU_}=o(#YL;nwb3*FNU{zYV@5TwDDwsQvSB;Jsgh$QSz0pHC^9bVwXj zZ{2eIYjj_q;rmZ~T*?bgUe6se8IPv&WZ}RKC@WT7=mUQ}Q!E&i2=oBG&E^ShR?iW+ zV3C6LD!^CgechDEVkZl>v4Ez3orq~l3JQ~DDou#f3kYdP?D!C1;9i;`aLl`f z7oLX9!66aqpSh;*?_PawHT*&{Z``YZe`%?Ir+y%^(3JFAii0h>6CWr0FD4C8$qKz+ zWc-JB{GYw|6&Y2?_nV1is0;(uN1Xd>7`4 zZ9$U%0Sa7%qVeN)C%gZ7!~(8Pj7ValcZRUa79D!duSox}Ms>$+Bsaxgy<7(S$!tLw zcXC){<_p7r|M`HU|LV~Sj7z{s1?4t_Hfx3=qqkq7CQJwI+um*cG`~vcE)3Gw9vOzt zV4goMfC}~MAuvq2nUx?i+-PyY;dN&OlU|Wi{Q8U<`|x~0!GVyUO*Rkx0R45$dZ!lL zoBuG+|GghBv^f!9;d#Qyn%CF6>6;l5JD(?(o?~`#m2N8}(pb+n6xv*Av8A zgN(d;)u)XQ>@rXf8+y;|jUNLUuJ6OTdyJfJIpG4xukw_FzH1~|hV_^0zx?lJL}`Zw zOvvf!Z>PWWaVrX3$)zP{Zw^qo)f~pQ!)dh#q z0D{})ELgYQHBTXj-;%f0`((At$LnGDnD22TXq>+NBEGBx!3*Pd$tQg5_jVuA>KAjP z15&zmK*eT&f7sqKYRFrL-(W6JPJiWqiK?X=KEKByRf~F8)KM1Uu&*1JYD9B^PKZoG z1~+un@^G%!ASY*}Zdh%OezaG1x_`5HOsGq5z57Xqs?K&fjvoFi|JNAX0ka$gVUK30 zzk<+Rc<-#)FV4`^`VLIeATunoVo_frv-h0gm` z{?FFIi;>0x1BUhL+-EwymW}0CbYesjIIlKF)guDQgS+`iJsS-oh{qg>i z1gcUgLE?732tOQ8skk`+lf8Su+S~D2SuymwZMl*Oq`UF5g(cj@miVlqq}@yr&xOHHKl<9qqYTYo&r>9{?@n0vl-wmhZ(T>%0a(dAXq2p-l4&*v5AsJQq_PP|t2|ZdU4m@Mp`_ zao{E;?TDwq{vW}LGhzPq(BG@mg4Hma_SZSC#0ut^%om<;FaAO^{yj9jZY1z;uWJ1_ zd{^Si>ra5&C5?uyU4&IevT!3i$9^l=x4a?$6>pB3mT;bwVRRp1=}R9J z3~_bO|G0F&IYdouG@zxgDd~S?pz!;zdz&@CWs;YTAD75v*3)U*lu4$I2oC4$&c!E;LC#@e0VfPJy5#w~90OF3;Rr7g2O73;D0;&DbQsp8-LL7G8 z7~nF&zv%cce5NNt50XPY)w(@NBez5Yrbk8u>rE$rjU>l$0XslPlNpOJ+05|cF3Y-M zT8)-@9(PBUlH=eQ5tYs7^$w&mk6MiFAh@fgN*TTOLUm5+fszAHT2JArv6=QAfWEbV zihq(;lxW&`Yj@D>AZp!$_$tqli7_f4Mvx~6!QKu~x(z7y4#$lp`{bkYn&E*64Y2&$ zGJXjCx5QY#3Y%$m)?Q4a*N_D#8Jltq$GExB=&DT&hp7--9Pu*J4g09?a^~m1;14#w zqsm^Rp3{b7D-pu=IOfj3RD)mZ94|hpd~Wn^;c`5XY+RX6XS1?D|J_WjM8DS#7Qm;} zZmN8qxm&mE{_)9owGMc)T%CjGMK9b%9J&cLy(VSupvM~;{feRDmlo(2y5%2W3^?&J zhPn4LA};20VzPBNXY>XA@$%+(M5(e|gL103DOKuZH;u-Pm=%Z{jON0(*V}xS%z0*{~!EJSyOh=1*pot_~0VIh_!}0C@^Eu zZUxRTg*&EMu3ON&POa<{){*wh7t5yQ54eI!-V1PXM0LN0CxavF)lhp;y z3i~0Z^W_#|=Sz2>5#4%zG8^`9TcXIVL$m!Od{2X(kt?P9$d?;s1scNERtitvyYF*U zn32E>e1mQHwpKZf1`LlWAPlZ% zV4oa4F2r=A!Rm(=uuAdR5p~3ug2i*k>}ITc`3PTkYH6yzMT&>1ziu#Mk>fx1ddax% z`T<|<#Rq$K4LUGxxin8l#u8Ww1U%P7{=1F$MUF_Sbz1A@lqezx&x9F`@t*bAKAj#$ z?JwH-iB|lwo6Y^8mQ8yhbsUQ6O&x4E7{Kb!LcSk*v_lZ7&ma;h`lWxpWye!{F+N|M#PS=Sv|eI@(ju`Sub5_L#MY=CDLuz3B$?o z9>+ndLE+4Mcf&0vRU!2KyJ}_$C9ioeaYWdCJ4Um3odjMQ!;_gj>0FuVmjBnonLj0g zKyln`Q?UaT#Us41P1h@r#3Rr=5;XFtEv*c&Y2A%2MRdxmdW+Nbf-Mf3=?IY9qs)AZ{Bz2JMZ)6`@>tT;4w261cS9Jk2L2$N;UH< zv);+?&!Tf?A|a>{UwQooHUcR*&DQ*!w|a{WLOo#X0n69JR<-Wjg6VpS_za>Yj>8Hk zjz#Zpn+BMVEZBjEKGB08xOSyHaq?{JWdbJ0|DkqShI+QC1Q1FQ*kkCS@p6%%vfbXJxyC=cdNcCAU0HNkk;BEp6@NwhdUa5miY7mOhoyGwA@ zVqSJDoRB$Q!?>@oy*q;dp7FeR?bmAi5+8+9L&lq7vM4UW87gnIb>Oxm2QVz}a9;Pz zhPXS0>hU%HF_LzQ6}0g{sD#CykFUdde`FL2oSfZ| zQl%c=hK+&g(?RhiCh#r0&sH9cG>}$NF@Lj{;_Eitvi{Z9#Q1BeEqFYvAp8{*9=6Vnr_8 zf9M{CoS{|^B~;@v#FM5!2z0!#U>ld`Hf4~aoltvF<#Pnoan-|-J2%8_pC&|3yC z?r9c>P0iZ+rhNXAaW-Uc34TY==x5R88@v=>zDQ`^0zeAWCED#x;(>?V7WWO+g#OW$ zWHx8XOLv`xtDSLiCeFCHh_2%lYj@hA_KM2hxq6haHi?$UPe<+vK@?<`kwz~8u4hmg zJng0awp@-*AM$SkKCiQsDq>=BkUkw?coJuY?ARe!`j1{w4UQBtj7NNmh-v^?T(L zEz{F`gD*qdRh2zndD$hs$#pk*`h>%+$S@@&b-NrJ?AqWUC47jxwKos+cse${+YR`m zov}e0M~r%3VqV~o00gjg6S`dlHaEQC1leJP!)!yVN&MGxmi4g!#8|?Mps8pR%SlAC zw}iPcwA#7Ka3f3fjKBKy`3A!+Acf|$@7SQ>GkZ%v{}9A&Cp$2?5f_g)b})9#)##63F61i z@8;Y2GHWuj*X-GA&HvAuP$dN^jMv1kpFMkqA^k;M<=L~pHlICv-u?>tcMenw+v@kv zb7vJPv1jF@q`SX`7Z#u7KRtU^6@_+h^zyfi>i9*=`PnlZm%qQySIj9qo;`cYlNSH< z)kFVa`K2MA6v?->tD{&D$qV;}Rh4uxfV+DEU+u@Nm%fGX^6=dMd@yimP^ClQ7vSZV zkCln_wO`=hhYm-Z{Wy7BN*G{pi+%Ww^Bao~XWHtg6Z6Edyldshg$bqyh`M($Z^S`V z^Ao;9dJ1IsN_}v@`9bykl)P=k+-r*Np>5{WU0v_K615=B@j3}=Aa(v0_n!0o0=Uvx zN_>}IjEZQ-xhQq>^|Xp#DLd_=`9gq$&N$z!WsuS=@4W{yxu#}QJigqh_k2iB&}z78 zGlFemINue#rE0ghyGURIPEw4-sNI7Mwy({%bWZDK&)3iB(~~U74%Vk^RXs%lueX!# z{M0(L^zlWH$NDb4f$cqw5^RHyH{PDM>r*R2%X6NdUiF?p5epta>-52IY*DLuB-<~P_VX(1}-vd+nyu5PM6oOXmy_Ix6~mszP3}f%83)RdRD$x)?+HRP}qto zKCJ#JTgw|tGVMF_Hc#)KfZp}evMR)(Y%;flDp7SezqVuwf1^5TlqY#ouhuHzMy;=~ zmZ57QE#Z`DN+n2**x-w5>deZtOPQvmnU{>at4O?`jG~O6@vXJrU~A~n-gW#7XyMmA zM})mhc5G>Q-)xl6?O@~jT@}`OtJXvHrHRc~2EBwWV7=U)fll+}eW$xO=qJyj;Cp}T z!+j;PB+W<*&Rj$`bCl1=4xZ9Uh$h7# zuDo<0X|R*DgHrmEhP<=e*OH!CXi&V*-I&5Z9T`=KJm7aBAGtc8)kdi+EOLvdk&gZQ z+J&8O1msz6ggd+^O8QS81-``x>?dI4zq0fbN1k;!dOz*IRfLuIx@=~&w;XnNQXI2Q zh7mmPj$+$B{b^4+HW#w4m=KLc>YBEd=5Nb#1vNn>54+se4G}hxjr&gzib^v5FqL1_ zNE$~wH%4K?l+6xZj9RZR^hn9lAf^Uz1S4O(JuYnhU_@xRP+J7cQ$l^2 z&QvYH#J)$=$Y`Lff{m_?kV|56#g^H%5pBQZt>mD=i0fIc$7F>Ixvt zRSr0p(2kDNv8BnA$g4WuyAr7K-*Y4vqFCZ{&ON`du&{D*+~l=2i1w)oC!8cg((CHT zPVvS$-lDWsExyXJM_#4i)coTJ1q1l$FDZva_~~*SUQyieiqv0=D)C%pv`TjT@?TaW zg*17^>;&1}1xAoDe@#rGuwl7}H@H<^O`6?uS$~9CL1%pN5^eU23?QgznB-kU5)O)i zO`l1oa;0(KlGnaW#O-@1_GQXjp{6fYO8cS6VsY8S_exZ3BPha>!!#)MFECaWz zgf0Vot9`vts_R%D|b%gK5Ad9xyZKXmBy!?1lw0zc3I}f`eFGQdV1`IY%Na4UlT0V zg>fQ`DiolIa>g%715yv_;rk28`6JK}9|w^%Hi>!FwYe?3H<0~fBI19xdW7PX>enF0Eyz{qw;kv` z{|CAiupf8pc*$}Ejq2OTpz*BS#Ia~(;{ zAZ*}c#jr6#Of6Xr3Nwc)t7y8S%l7MX1IoP1%veXukh*?e!FalT0)uH~h>1dY)wV7B zXFJwZ_PE=Jln@#}p?ogAy4d<3sk1^+Ij$)JI3;zpJ0gdvmVBa!1S2$%{W*DI1RJ3i zcZ+L_G*_~_c8x~e7(4~l_y$KSLdJR6vqZ!Po4ZNjb*X$W2%jaq?AYkRE!gg%FdU^U zw7Q|Xf#yx^@LtSfrmtVq47)pLUDdcvqM30U*DQwOw4}}V7w30p^~o%gpXXewW=V4* zS5p)MtF_sRP>K>oo^7rR5ut%c{+b zMLK6~uXygX1HqU@4~+S9-D#WUvT*!x_d;H^)T0 zyzw$Om>;qaZPmfH9la(m-^ci(BBhm^_nyINlTc@D76P<3csX6GMKeT$%M+$*E&!x9 zVAK4cJNA?O8`FcPofy`85Qzb1N^C#vA1|G(~>0`P{L=2kC$e)e|2FRzLuy z)QpEhB9bqSmeZC_98GCuE)e*WuhC_?nsv=!2a@7YNnSIW7rOa{f=;Mt(cYBMcB=qu zuq|p*4`P}$XF{&D?W~nY=l*`h*G%XBY*|28*PygK+wm$a4|pEQRV*4G-6yCu+sZ_3 zz-y=Ty8K86^@f_2&&SFj*h}SYN%u1_)6yF|6Jji*^=e<4V2c%N1LtbRwI#xK)VtVs zwB4;Fa`)r4q|422@cakqOw6&w3Gf4(U0-st#n#!MXFpJ)*TN&4$ZRy4&R^j@TdHMp zybrON%#~ikdbQfW)@3>t)0KHUXDQK`U-$SaFTp`le{(*E)tj?~NLA1!$7d^Jn13Fm zENip6oANVLQcMDQ)ywTepD<^%LT%#XElGY7qjYK_Y`&TP4T%Zp8XcJ$6H~xDw$bTO z!8`BzPFEd1h8A%XmYVJ1WlbSH8QRaF!$i({+;Li9&vkso;=I_LsUj6xM5ouEw0PRIqYR@5z4nNVi@J(_|*BKZz?8&9(g@)WDCd zi@PM@%nRGMk0?_O{K3X$y#fupW6ln>bEc(1+1jMlS99aMn82-Lzd6pinHqby) z-dwMN>tgxcc1KT4Nv5k zD0Ld9QFka#1GI*JKVRjC$cTs@z1_kOePa%b8ub#@%tYNM709JAiWx)@LtIvMBhX3!?g zMp)_ONEJnR@3g(^!}S9owPdakRX_PZ{@5=vZmJ~E_joFIATAUH%CU$dx4uglN_tXP zDxa_%_vW<;bk$7rLgd0(bwRn0N$~!Z9t?UZmNhDS9>Ri6yB%VgXQ6Nch9&bvLCoy7mA?wkeSh$mEw*AgLYP1O zOuwcZ`R#Er0Isjir_(=_D)In)_AQGMS`rCtXH`#M2n(WERQm4B7%#0b^0^3PKL+EI-xBi?CD&WyVEs1K~j&pGf5^_LOO5!c9Mu|S7H*! z;tYOOEIN5jD+YiKh*)*`-Zvx1@ef&iE&3WWbVa&QM%s8g9e~qr{$`{>;=F31 ztcZsyWc%`U*eOQA+B+s6w15yJGzehcLoI_F9aN{%zk*pX?(qBsEzkD{Wt@ z(?{SOb*jd0pndI$t^SjrNNB`%$s;PQfp;+&bQK_!@;a`-34dul8`W)OY!Dz^n9711 z%A`iUv+27Rz9dUpAH|J?Ens+Oj1|&^6iH_ zA~-!J4i{BrM0CFRC%Z+?Dd?o=)1CULdQ<4lMwt5_E7g0v=t;BBm-i$X471ZQRHcD@ z1=K|CH;FFJwWB{}a+K737@W-9)*4yWNIG^lpczWKv(yzqHR-eKw#HB?@at*Ej0`!{ zq+W9qqO9LI$DsbRc7=3zbbM!n+^ev>_fAoXGeR6JAnN^A!ihLNh{+XTB0dKUV`hWt zDQUd=%wN4pKKC+vIDaH}7;2|~A;Mn0@$o~)JIVMT+9DE( z8xR$1WjD;n+jU$!>%76y)^AK63s6xr&sfuK-ElB%;GZRii0SV(?>7oczp`c|C%VRR z9utW2jEs)WHr)^j@(H>Y(;&6o6FtEUBSEVjT^e9f!n5mlS%_^#^>F|rd|39JJNN+g z@7Yfy4aO|FRBSCecMZ#ne|`h$sM<8NXS1?*0NO)#8Fmjxz@;>S3r@St4>B}$^k4qe z@ey#*UWTFdgK{gEnd$#-|H_Mc2~z5Msab-ZKdn(vJ$z)#^GT^OG}He#J_do;n8d=2H+^kn}XJQRo};n zs6Tzi(zFe$8%T7ARiIIB!I!=N&D?d3S5j7|{1?#WUUeHMj=lS@B$<;CCHyY{%)OGz zNqFA$pTUk}jrrd~8XW)M@)zXI|7b-%@J;vM^a{aEzQTW0kJ?mK z|Id91$I|{!d7S?a55)Ap!*&cRt)}|7?s3fjq?6G5pSslL$YkPzFbah&6NR^?0Dfb5 z#aQWf4tH3UlAOLuOudKg4vNu#_qJ>D4(SYQ{^+G>EOi-jL@$CtxdoR5OSjtn0cc)3 zs^~vz(&Q}qjk1fH_%_VS^w{Y5_W6gUpN0Yj7DMIU)rqBD+d5eYa$nd6F4F>^mH(np zd1^3W`>W^H(3Ur!uP(~jhM_~?3p3vi&0ckm+a zAHBW6rXL@_YcIA4ZE2%ZIS*Np3c3FH9PAz=e9JsTa@A*f3}*wi4UajGeK4FM!z2^v z?odV|s`8;gN%Ao}UPJm>g@bLJ?;T~8F5sMMBBi0a(3(`7B4X0wSK3y<>pb4_EiG7qf{R+KB)^!NR(c52vMRUQ9&9+}D4Rlm?SJ&m2F;CQxUgn0n#TVxn{TK1RC>FL4H zy%Yd;9)DQM@~zvuZ#^m&{)6Fjulg8`k%?mc9LbNLGJ8$jCvA?*X8mB_*Kg2NN-ed_ z?FBnKwnTFtS|lnKrG(xXY!w3+76Z|5WR-;!wSiESk2xLI6VZ%PMrZI5sWqxPBKK>K zrlwIW=PM}CORzl!O{HB^f%M?;Sgg4<@V#303yIg;c`h-w*4mk|FBz0_-_yz@QaMDr z6Ffqk74&JG0CdXP;)oZ2=EMp?gnG~hMXp*-{x=~0;~Yne@K)1$k5iUvz4o{0DLK$rNx*o<7&FnjX*qdyO3LzBvNbJ!Uk*N0vNeN1U0zO|&j%cHA<3Hg@W^Go^?y~#NcLwo-}Y%H;5h9foyX_Ee@H9m zF;gMDh0l?!6Z=Ql=ym5kHfj1W%kjR$`0fYmB~hE+eCPSDLG-~(I0JsTwfP-iQ!y%c z!99%f~7i8%}OGgfc}Rvbet-w0AxDq?%$ML$lQWOww;!m($ri^(v;=~Ki`G& zd7k0f5}oL>5f!&IgH@DF_Lq31AYGQphwKV0%begdiU#!SKi~ z5x%x)z9$!|w@(}yNOw_y+XIm>?RwQ_Io!@3fs866)^;k*iWLVsdW8@l!zW8!eyKIN zm-DH)?7^ey>*HAwxe%VzA9a!?8-JL%U9b`M^QP^R(DO3?G<8~zZSEf6q@Yoi<_QAP zJ2Enoc?QfJ|KRFH&Xqd!-C%EVO5ept-miK#rMLV?G3Pe&<&b)&GLw|;uQ9U5W;MeJT&B9iy0`faUljU6jw{QpMl6WkjUfxe z3lvOH0UUW$0$wLJbW<5U2kZPf+}kZ>#1&Jv8~5`3m%-MV6sHN9<%@=aqm+nr7`c%e zVD5V+YHp00H;nH;jkN!-v-z3t(N+2Oopi!G> zl*rA+{oXjzerOVsJoTaT?n0(7mpczaP1QPdb=GRpD$%vSpdKQ9y?g3`ztgcu$;9n* z7}_~T8&}hO;2nusVW{{$*m#Mk7);sUoFt6&TGd&az4UQo+CC9DG?8c59~-Pryr7}l zP)dwByYOoldxmh154-L7qTAaeq%3DVrx1RWDXggMVS2O$!uYA}f%X-@fQp?)VA-dQset7mLJLB;JL=$n2=w5z38`{Nf=W7ttvfY^x3RK?;=AzcfMYEeu!Xrdp=ahgOm6X(rsL|zMcNFIMhfKW%xtA zOqj*YyLiQnlmbtj-KSES-l1A!b}@<@=hJ&4)|Va}PTQWSZfq*in8k1-H|FC#DZXTPys8Bja64PVYLd z(_U5%iKd&tG`x*cRMjayle#Ns;^$O_C8SO-&$bx4xP0Ajf*wn#HF<=MWPAE1YcsR0 zOzKd@Q7HbvGJaztp=EHIEyh}X0#}G1jSVs#tW}-alrF`hb9JnG=;7fIF2OW4-A_RY zASb!(Y_;~@3$d?yAyj+$X9+slQh+_@Nfhnp*!uod>-CR0d)%z8{aqIs#~Y^rTNQA7 zHYjSaR9$@dG92ey8-5uMjJt_WCNXeHlVU3>T{V|@G%o^&5&+>iE4-oxBs$nIUf zAaWkgJX`v1LLd#U2)A79T?xRxoAR+GFfe-^s>EjW@>ulqi`r;VI+gc|=Y2Vg{Mu@e z|1Fm=ZOBwnUVTR&IBC_UjGfRp;nz~;35Wdiuu$~wHA9C>1{zw~#9BX@Xd3krPPG~kNv1B+hw$~AzBzKb(mg_m7!gVxX!y1ZtaKA*ycJJ)q2ghwUSjn30BtW(&f&b z6AL{vXLn_oWt@=x2m8d40kIM+_^%#>#DzM}hkT{9_Ifafy!?H(z<@S}tI)%%Xt zcCd2c16C=lDguKPG`iyQk}3kpLO_tL~y-X zDB?x!u6fVPlX{RN3I*RZZvhQFhPZQ7!9feSt=QE-n|$Yj&7FVhd{u6X8~kd4H@?595uO6T9b84lz?-#EFzj zagFoQ+q+=Z#2htl?pHcks!4Guh8s<=B=gnh><|a4oH%fWiKc|D4&XNX@_)B$ajUZR z)|fPR_#Dt9(Zu%k%cl;P3AqQW!uhvp3$5qGYV_qlb$5_;C-F>nZ!c}3?J-pkgFnaA zQh|e%f6VFwr+DMvP~+=94B_bVU@F8Gk*D5cU2D1cHi@Hb!QC-?XK(n&auU%z2Pc`e zdY1aK$n^|KZxaTt_zu&KkmHxM*KI7fDoq{*oq~Z;i?%a-ac?PfaczBgVbi&_a~4M& z8;n!Un;U(SGnVuAlz9R^eHIEb2bO3`X>yArJH7lnT32YuER9{2Ma~0YCe%o43znkE z{I0pK$7!q0yE0&pyI8qF-+&6ux2H3ZY{r_VVlswNPn$iHcS(LnKcvJR zOLcUEQEezb%dUan<;m)u;A6pbu7>(2oG*4IHfuk*3aXavcC~9cpZ96R?LTs)Y7~i= zIq;5KJ$k>+t$MjRATwLwNJVxD^cy%|T!tuatbR}H?{93yg9uubMLiYy*M4zN%8#&C z$}>j76#r^^Gzy+h)4W_^_!83zovjhur>Y+UZJbIobXquA)GZW??-5N_ZZuRB>ee$( zk(--#?e)he=hoDEgbDQM~PkAl@IQ3rd#`LvO~<3rhbG0v7<1 zvwdSNG1fNgr-PMgTlR2n8@EdLed4`qvo+trM6TOze?U*SuU!bk!j?Z;FaFy&Y+2oV zDEObA@!pGu4}H`1lDJ)>eI-;EetXHJTyG?sEsL=|d)egujeV~L-!obI&im%{E)fxc z1qyc1R-si?>iNSC^}i@zsyg7maGs4Q`af(1kOt{Y@kijQ)YU6*94iMuzfOPhlU3!AM$SnL!Tz1Zf*2w?M;tVA&$exsekzvP847` z;M|w|+n(ad#YeJyf~ann&aBb2r>Cb+Xl6Hhp5nMuNWQ;%b#F$m{@B|MFwttc;*&y@ zo9)$RUMCzOfh5V;5^wI8~my6ASj7+nzI6(sur_BqK z$w}^MwgfO6{h@M8@3O995owCm)v{NeaOO&n*3Hl`wG^K(f_O$%?AIyT3-OM&OPK0- z1tBLUN|^7xm2&B`1mLhr@Dw93UeW}uzs#L*zLKiR>26IUn_P!=KJ51Mn0=Oh)6(Wh zQqqBzh{ZynA-CQitMnUyGX6G73B4W45ABW{S+^O&Iasm~W`+G@cyzrt?jD|EcXx%g zYWtP7ql+qUu4E2=8dvnoXv zbLw+Rr`19E*SriR3UCQx(uBq(7Z3=m+r8R0*U7&UO3&wd`bq<7L)@6AB`V!~Kg(wD zS-py98B%Ds2DEhdX15g$hCwQhNRIeAp!eNy>gD~Jnvt60+xEQ~f5w+o3ylxy9RJW$ zlYWsif2$Fza=5WLjG+28J8pdTJeHSuqyoP*T+{2T__m$q`ToZsc|ECw_)3czadL41 zkrJxx`<<-#$`+s(z-U>VRV!;Wc`KZBKFPuSV6A)DfoQy>dB=pJCTiK_aq@F?9ZQCD zb4iydoKgf3KVjW{zq!prKCI1yiulRWa zMy&%ZGoc`1^??TJ{vt~QSrn4WDq2>cI|n0NDGvC56;yuytwXeQce(VCiz#$e*cMus z1eCq~!Gm0*60u}leHqX*%gU1#0yU7$nWgytH8kPFBHidSiN%K~=Iooh#1YK{hpf*} zNA;0xN|HzYZ07{AqIn$TXvjG@U;P(s(@;>_(ysR(7jM^3r$)7b&rqUBx4T2*Y@yYW z>per&cL(f=k4tZ(Ru89{Rb$USs~11W{NuXd{RBup9;I(NC)RbqLW1~%30Yzblh#_? z&803S83g4c1x~@f7q-d?c2PfF{Eu=SL2ALF5u9O_3qNppqyj{HDkL?k!?sabh9OF|3Z^+Xf0+GDm>x&TxG$y~f230wxC4j{Z>kT#6*$`b#JwvdP4q9M9 zHgs(TnzN;gm*}WG!i5wkAyVXiWh0$&*{h*Sw$4&B3d)H}z z>rHjlZAP7mfm5+On@mChR|-c$pM3XL>cQnaUp`6Ty$XBz9Is{ZW9NlP9>B{hDwlSD zs@3J)Ac5N8Qb&axc9{D60G!dWR?@-7S#XW}A%}W}u9*0CdF{buQg8Y9QvJFxTA;%u zVEQd4dQmne)4$4?)P-s8{}-0`s*`>4x?+Bdwz9I)*u zVw&P#^Z1DIxtBGDcJoO(=mSTh<;eIcXHlj+^2VR1Eqxpz@!Lx{Ow#9^kF%ri&i{0&CxiC&q-|l6a#EpN+`mJ+ruA<4EH^&8 zu(#^h?$`2#IMCAz%g{%t7a$7eKt_i?jJ3_zfSsNX6#B^&u2-*W%!duncI-_@RU!vC zE!csNlBJ2SFb_l?uuSEQ`C5)?`VbWK{TKHB@bi{P9NWj*zs~0G=r!9fi+{%`&HuC^ z6(Tcq0BVpnwpw6aJ(+hC`dkq*x#_B=MHq`AQbZJI;5>-6jXPwIOS+RM^2vh@6f!)XkMS$!(@pQL_?l}8nDMRGAe>a z^3+Pyhtv7vmYSSvd>_0JN6WGsy%ExJbQmPO_FwPh)A`ujye>OUIgHfEYm=ixYBR*q z+f5c|$nzaO&Yh)%a%+vZG&=*Y@OWODe*jq0Vxns?8sfqHD$ z@2kjmaLi~=hMz~?p~ML}^DM3Z5QhL!J+g7n*U`*5y$A@xjh>V8JI32Qj{=-YORMmb z_4>WD{F(?|SkN+kbAgDTb3PjxB-k2K&B~=mQI^m-U@rSyd1(@b4>=oyW^0lOlpj517h%jYF zD%)ndhszjnQ^mEQEmrQA>O#`?zh@D4lAByA1h%x%O*C;@02EV6+k`dVkgqC6zx$E1 zuaJFN{|0+MJSmM@@fb#>ZCa|px~x!-aFxdO3e4Mgdt)RmlWJ;j+)r3kiTr$uFeMeYCTP<67IpHvc{Nsuc4f5Qk@f5d6?17aTK6u* z28-KNF71nWa@4%JK_Wde)+F5(j*n!OS(_$esKHSo^*IFrS^h6HW>{s~msnA#Bpo~LPfACo zqtQy$$BVBBbPN<&4IFuW&p=^w+_I+RuP%V^OdnrcAMsCK?*J6jo-2+ZsaLEFKNt$9 zOw!hmMRj%$Z1hQ|b8ur0BG-yLt#|sU(4DWXgu2=a?<4@RH0oTi zN?s_DeT~;CEe`nb&nc%fs;n#YK-%)$MbUDXL55eq(;ql-P^l^o?IHYur`qameY&d5&p2Z1&;_BmdqwHlRa zyZPi^j6IdJnnBxklg=*opyO1o9PvP6F01L}{5rlEPOa)2IabLBDSbWTgbl*FYt36 z*Xh!v-t6uh1vJvE&n8xdFS?G+RxCH=`4`T631N!7t%|g+q1Jp68QkqgT!U}2DPhe; zL3xYQ5moa2v<$M<-{xFvvlIxGq-O;$4F#RTrfdeEyXq!NL3buC=w@F4hf>V^3zY!x zvB~vG)9!>fX7!Y(qDIJAQ!Cbww!>~7J==+@UPa+CXx;38#6<3?+AYy$ZfAD-vDR_G z?4LB&?FMiRq*3W&;4oOAFnr5L4) z*5@waygV_MH%#3(i|`89YR1vqyxI-LJR`r7TIpWQn>y5kxQbBos2_{wnIfjfnS!-;Sr{j{|Dj-B}V1oW)6q``cCFtGj0H#7*d9cmrBI#iA%;l(xt3 zwSC)?EuBf-JG%@t;bCMO0w0XVkbXpt&rSBlUnXB~TA9xyQNl=jd{gTPStKd9%RZ7t zBKJ61TWc(i34;7fIJE)fuU=!~5IH!=!Qtb3ePzi@JynIAxMU{cxDVg59;C402?5Sb zQXH3-oh*mH_SOv8kK@bYANGomiCT_$I_{*-w{nrXk;(G3(=lR zfRAPf4rB@o!hEjCgn@|euCC9Aa5IIY72TAjAUrG17)}cXj(mBAzFpo^C->eF{xF!= z#kOuf<`Oy@J@WOxp?D#WNXxM zPp!*W3$D??95KN3<_Pg8f3^chv5(3*w-qKW4dw&(D$eoG0_$>LRW^DJ;mnXuGyTU4@J; z(wd%$!pg#5iG5Fy8Odp zJ>6wbB{)*lJNWV1?T4HI2Y&g-it>p5#A|_^;L`Qprj2xO$BdbrUZ;n%=Zm%W@^>OR zd@jfDt}wxyD$yyvq8FVh=l4{9t=PbS2N|q!C!&*pq>egG$8<93B1&Q=`W8g=u!l)X z@yf@)2_)>Fob%#qi8zyJS6p}}a@;Re>oz_{w-Eej^fhK`H>k~az4<|E!14Vdm=&N| z3U)?Gs&N@&NQ}@G+o*Cb(rCiYo1%RSoe;rRdo#4Hp98PVG=?229yDKyhdtwVeq_9G zPzNQ7y3v`!BMFYU`<1(+NMR z-)V=n{1!xVe@e^GqVE>X=c1|&!i{I=sG9(Ap5RD|t<4|DTE1N$i>LE;Cu(@=S}t;v zMHslDGdV^Tk(TA;TY&ILW@Dea3WK;~xNlFD70A=r6(q~}#V%M{ zhfSd>&$@!Je?1v;4({BWzr{bUb(l zMWJ2^t|+FRj9dswM*FTzhPfVtY1>f3j?yf1o77mx@-D*1PfVj67s?!IbH@r;3le?s zC6UwqapT%AbfhmjmQ`Z0z=J@sf6)^CP-A`JpbJ7g*$m~d=!DiQs{Qfq4@KW}i`>@X zaH$jyv-wIRq~9(*N2|tMTwHwq&clAO*2=o*CR+kjsMAnR+)aXBQ4ww(f=;c|SG3gR zo5E=^>UeWYMpr-bYl@I_kJdyD!POHVPZvexr>bf9P8So&LrpqtoV@X&76`!{wNzIMP^~7B9 zWAo2);W%s*>}P4+0wge!*OLC z-%3Dn&8iINBn%u%H#YTIQhjc6P}fZM5z(Bk=D7QcR;IQgczzd~;Iz^DA;}Xhw{Mfw z)02tgX=(0Yv-`rfq#G2s-&h~L3Rn|pwig|0$Rpj+ zpN(3n88r+6LjYe|LxR?U^3nQlpIJ^5F2 z;~u^Zo76y|h#d94ik;~y0x2Ya%j5;I(gAA&NR_3_DZZFXu8S*vSLkl&hWyrAAVH)h zX@;X;W9)sC_V0sA?(Mr1;ikrk7*# zz(EV*`~g(HjBfm}Kv@s-9ZJhAl^k7)T;~Q|g7b9E4ZqKzbFSlFgEh zlMzD0H7FsI%aB)i^f$Bz1%B2E389tL!=}I~>G|^Y>+m@l%$iO>hS`77mP*F-TWbwSu0LW#m(vpP zX8-aa5Y4*cRGd_%-ydk4VPLwqCm8=EB&xQbXL1@Z@#6N_OwE=`L=jHIp~@~E@{8YM zfrB&y!8u3OIo|{bEj--uXEC2%k_qRl#F4{z#_mT>pj^d6@91< zvcxWw62+hg?oPfqSQ%DjbI86&YP`A@kku%s(`j29CjXkqsX%n}7S*7L;_EWHpq${VQyPJ9F*&?S)#lRS@38tcm6$Tc7pAgAU5OC|A>lmAHGsEnEXxr*F}w}#Wbaf0f~sUL z$?6Qy*p2V&&1>fUa;id>GT8+JT8zQk^X}-rcG@xXr0;G)Jp)r2wpN^PoF3jcbWxwa zIrlv8);~g#Tusg4YOWz^Dsz^^CGWV|pPQ)?flH>1T3rhPfyGbrTJl9Rltj+GW$=kD zdE1GC?ek6P)7fSCc#)w($b(Ve77APD0W)1y`N6(CS6??_2*^uD2GW{~oe~U8!oszz zJ%k+s@v@zId|k*Er0pt{1%;t+L6_0FiR}@wardbW zRFB!1*!U(RR#oVjdb^@+IKdUoBf8>6%4aP0)5=U#5Ikn=io78^R*BVsOAvGU*A&!W z7Kmx$R*i!T5d}F1sI>bvr=vD9nth|o!@g=)0 zV7R(_DVeO#NK;*Dxn<_dXH}x_xjydN?BHj6jHo8;ErkSoy~LSA&O<&2ZQMGjzGi>A zkk61QO3KNh=5<&xJza;-&{Ug`46b(gGw3#cxI+k6fYbP$&8?>kzfV}Az0jvL|0Qi< zwx11Hl2-#onoZ&o*?inz9lj*PT{z)GGjJ{H8R^*|@}vBH252vKk~1DGFb&TJq9MDo zj;_b#NUK)xf-RhS*$+6nwkdwPrn%*wjAOfa3W5}NcIHa3fxaYzUCc9t3k57MU*l2w z7kp>BD$SLLvmlE6cxe2fX#!yEeTn1P^lb1}<#DC)XMQ>=hYnl5Ffy%@%lwaPf7KSI zfp#|vYObcuoDz%Vy}AJ-VrvS6df7WQP7&kI+B#h?<1LUA?I~iQyJMHrO7xas5*l`%sVp<&!)Z#d`Wh>C zi#7CU@vV6&TD}^j*K{m8qPE?Bvt%Y9b%BbI+wFNDg}73c6L(A~->>PHLye?q;Re2Y zK^8v@=}cmbmxLRCsO>kzw21-32>L%Q=IZB;C4o&@iDL<@KIYHs$z`-ePAz`rVmL}# z{T6B5;}F+$LKD5e)*gPH#YrA%9up%g{`f;{hJ=iXyL@1UR#gk)Nk971M&-)_!VObF zayC5U*R4sC72gR#SpL~h@0`>Ft|hKNO00g6A@YRes{kb?S|TTClHwFz|$C%45G;z_&*L!RZe7X~RFC~va~ zi{*!nTo->L?u|?t?Ep2rSIQSC5&|zr7M-1jn?KTVP6bb^A{|cC66f#>Bm|=P?_8aK z;kap3IRh~>r+q;ET+CLeR`kaA#_8ms&TJ5{86WUhVD(SjzO>$nU>S_mbq^pCNZpPW z@VMx$PZ>3zgu4+Zgdxyy;8LWfRECJnH#JcSEVt5Ue*pZp&w32zj-yzitn^ySYNypu-zBzee@>&rm6xYb|SlY8@p96_K+JH2if3%K>8aJyc`n_K zF(rXNn8Qela-imV)#>W_VbaouO5=CJ8swT!pA$_LN}+BkRRvT7i4(!yk;wI=uT3{* zD7Qg3!|5#S?d!R~vtcsdm4|4gC<)ux(>%jX+^VY`S}p_mbO*AfTE-Z5RQv5)q`@2{ zED901%e|RHhQcVprFy&H+X_pRI`y`QuhV;sgK?V1#`@=~L5+nTVLyw`;YITrPT0JX zYIJ;5Z!NG4W-k?F_oui~mqY`1;-+p|ZRzjj1puFLiBNp#%nuf1bL9Sys%RJ(9N$V_3l~|jIsltS?rKR>4rgjxh-uf+}@-lt^ z?UkUY9r6b6!xeoG^?5LRVT?7ziA|uU2jt(?AK|S;D_Grg=DDzV4W_%<196j&SbKiS zC>+z1a`+M4`V531rSw|@qE@QUuCN$uQv)peo*L6PRyrYRagFzProKfn9ciyoi_4Gf zk}5~R#Ygu72d! zA)w|!%bVULz?5m`ztJ8O<&1ks%ks$gR^x%61g3*V^f}I_M-gN+g<0c#jQO7CB;ViM zfS_>^1o5=aeCB47lWH}j-ifRNIAp7v4>dwNf6rM)M;l)!()8OGm6<6&gJqZV4U;8k zd}_w=?s)upc7O#RGjC9JyPNevWRt?nbt7E~YW`4`gSBa-c{MwK>x9IlQF&BAYK(Hu zD87K}fb{PMG67hKjR>{4um1IHc?_#)r&6II2{v}_ z%2d+W&{OMQYjl2UX504kp~O57#K_8NcHZugC2cTpm~etfZVPkCY0Bbs-$y>3CrT#9 zqGI=!#M;b}rgLo=)v0%kFOrhIvQkJvEl``&k219xG&hH*f@ReKF$(|afg#`YPJh1E zi5ysPh7+iy@3k1r!VgD-vfUFb zDtj8YXc0y-+o933k;)O3f3JC2#1H_Ki54-&q1@!v%bhNPA+M4e18O`RM1HaXSmiy5 z_lY+WeMScLU%sp0$V!u2AUNhZh?)3XZwR?x=Ug1+(bauun&8T&JSp?kuy5_GSVnCi z#_1A|2|_MxElimXcW%Vk#C#3Mk9~*oQRU{R3(l)hX9C|c!y*GK4sV5h`EWYBqyde0 zbcqk3m~pCFB>stpby%`jL97=LL*+zOrHHV(xoM)H0C(PrhLW{%scP>W=t|{%o3pxJcMCv$d)ZYV^JK1sh+ z)h;Bwi&C4%diqC}2xIHlMv8{LqbsPWSX&Y-iZS)#=&+qdzfyKf;p)+ff|SSNQ#`%# z14!YXZ7*6SOa8=S+G2$m;gcF2pz6K4$7`WiL_kMcKoi~C z6af+>`NL3%X%ittMK>YQ@YE9`aBiz^OmjmO>lR^pvLo1SrT{{MCx{dZZw^WC<$+4^ zqqE}2@kxV5r^qG2A?5nkdaJDGt#Fr>tbPp+C-FefjvMM`->l+jwNiJO%P#O-Y^S z&W0|CI2F=5cPlPdL{m5M*q2S@)x0oGN@|ueNBDxZO(UC2Qg>n5WzrV`-0DX+A5AOO zkW;oBR3iz;OBXR8PUIEQr%qFTzjWT=E<{Zi$ti?-68BdRzx{$;$v^M6YG&$fdm{;5Q@dzfv)k5+h`PsG|2LU3>l7Hba? z^X}ezJPXJ&hypvKbLwz zQI+P43O5=^=;KnaM;Y`*9-Wc2{&NoZESQm61u5EHiN~mOe$0XR%_JLt*gyCh{gM~P z9nA7U{pijvPYJxoa+bHxn?4XcYDMpzquvd<8j|oJl}4s`UhrF|2fHr)jTPaylGGq? zqz)~V{@Osh!#untk^0r{vF?b)=6ZEqY%u4RKj~vQC>_8!PC<))PZwfe7Z}Z&O)CO| zIJ`(~@=(Lh6Au0`#tMFoo89eGJ&;KmsVf0HPFl1C?!Ty?X8)7GBPBI)Ms6leEKIz+ zTNI5*N2L-!$?0DDWCTzmN{Vh+Ki>bUXeeEKa12cWs`XnnpHJR$`BNuQp1ZnrYnIaj zaCli(LpoW(v`{>LSK%P1X1gN~iX@ zX>asJ3<}eKo`rMVKmI3BnDY|Ex8Ua&f4z#6Ss*NV?<4!=IpGyGnb56HZnz+O#-Dzn zD2_Ue6g>&cQ?WR+{v+nSF*TaXMyV;`)%xKrm;S|1DKP2W!@u~J9MoTF%EA{ae^+Q) zf4A!d>)q38YqgvRc%^xN#m)^gx=i+a(DtbprKFiLZ6@C?XA?2IRq-RHKkHPn1}1g~y2#Qd}ruZng&MkFeY^2V6YVV8L| z?B9g<%csvGX^Mkhp}C@B@LQxrj25g2PK<*q_w;D|qT6|KyS3{pE9H}lmDEcs7r0tP zsg|lj1ER1?Y$v+Xyrqh`M?ufAXD7pl;)T`lJBzf5eNI*Zznzf;$<}?1;o$fWLX9_5 z-Q&&dSn|hThYg{n|KU=}mFx~4CtqQnXCX7mmn2@76XE+mRKA7%huD6zwMn3277lBB zGU>0}YJ*$7pf29M#_hMSyU|+7cv6*BculHv_$F_s#}AOn#zYEJGxlH$vs;LKeBwJ$ z+A1PCI@*`xc{e_fG^bt?2athphwot;=@xs>!6mI$S-va)a~7eY zXs_`fLL@TVLI(0WE@@H5z7ZnWFxW&&bp%O^)Tu41w$ts~U3r#Rg>thFXrCT(==a+y zL8_6|*pf1x>*J=ctHd`+UL5|(A26MKU$}9C1yqF^)3OoDsxOs^5Ku)-A6gL=mpGK5 zqeCQTI!PQaMBoz%cKZk7I?-`uVK8CTFC%ANhhLyze>U24^7Qf~+rD(ie$nKK#uhxm zm)8OzJiGGyCX2|`K29f<2|gP(A(X7;AT(?6xu^*Thw}-3FVV-17Oi%}oN*3^g%7SF z9{A1AC`K|uXKh!Br>OA2TLUbV2q4oOsY2V7hUX|h>kc`doQnO$y~Mcrl$pj|FuVOB z@rDX5b-FZUZx;im_@VN`n~VG6ZjKc7Dl1%*lAd*@w0RQd4I4qDtle48*Ku{DnU)Q$ z4v5dPN^kX3`4=^m6FHogonZFyuJ8Nlz1-5J!bm5NHlm1QDmS@OftEQ=&2VpQ?>=Aa z4N9iv87iAnxdBe{mdkc0CgUnMwBrD3rB$;tgQU(Q508l|`RC4N2r~TG3I2#cfj>VO zX^14q;V#YgcJ^@|D&huO|1 zN@}08ScxMDkO0}AOIAE1CPntOrrA;DtaEZR(~+tpgq8bh&u_&)-QE?AoX@ZbD%2RV z%(x76oZHsB({a2-4Uo)R12g^Di;eieXdhGdjUzPo%FH*IXliI(-oc#dSf3rW zRF&Q7n3$c0QInDj*@mW0GFWZc&?#8g?Hxb%}u`h>a zsD)9J0Ud^Pu;NS$P~d1;+`m3x`zEiXG-_I$$xT+n3t8a!BHXt)&W~2L=B`9%`6G|T z@&W|kLdL_!-^+OG59DBVg4eh}^_&B-rH5sGs$rBy%jVz^56;{gbuysibPVn9(!fQ= zLPn4RjvazTjBxewxlFp5!}@g>AD0fog@sB`rQ=>%V)~oK$DE;ka5+r}OqIRbchq)) z1qK6h%) zSlIw2gQoQ_L(`6YVGF(#VBZuaFsR!>cmdQoAQ2rb$j=0PkJrstL!eht0So$-my1!{ zl_!57f1X7TY9wM>kpIz;m-`EGEWO(Cvh8=Yc3c9*{@v10cOxy1P*2lf#+1*wGiCjX zf5_;xN3|I_7hi9WBexEKeA^{6EB$Cki=^A?+sWn+UDrxxy?KsmW9l z-pZwKN&>D|XOvQCzT5i4r?xO*ysr*5kLv$M)I~mUkiEPqRM&%S1n7O%Zs9T=O%D1s z&3UfcT7q>Jww`Y*hHQV@_p=CpfNn!-TVIBzdV4;lA&ndSbLLT2g7Ka61EWKn<`Tit z2+nxABo{4UV>sNaF69I3YGikZWPTo@ysRGqhnHBy4=Y=kDlgIp%)-_MJQKWD#zfKu zdRTl~m@$9sxHQ3V-2qK~7or1@T>q2iyVJ$NW71Ho?goL4f=Ub$o0J6D+sZ@FALB`lQ8qf1-2=P_iAZ>({W zBjvZo=IELp9W(tD%Q@H9b**8+#w`8qm1i4V$7jI}RNbCJCN0DVX1@mRp-wGT~e*3RK!Ta}}i% z<|8HS*W6-Y|b?Fz&-+tt_N(^Wg9G&olQmZ8N%Nn7+T2atmtjE<4 zm>U3#2m2C+224#=b11Vo7sQ8ZJ3%Mhd-VxIhoh?lur+sY2{s5?mWe_T zQS#;k!IuV3!Az1Ie_lS<<6tT74`)@cLwwPO&L1ivK3IM9QOf*#qzdkk-x7np|N0m^IJuuJ_m)>9)gHF3EPZr##;T99(Hqcn}$>SQy?>O66*F z6+))Nu}IQ)2#5YXBkiXB_Kc<t(9m*CKR&a+x~coSoaz{@5Fb+!NtcS;LSzHFNCJ-H;B@l-rp)p>oCW z_=6iiU#Cyh6ACtz6fj$)P7KDa|9z~>8vhXK50nf)I;mkjQV`r$?bo%nQyr8053_v< zstDEE=&_WF7WqUVz;(5WWbbuon3e0Zsi!8B%+~NMtcd(0KCb4P=RX*?n;7L+$N$Od zWQ|+?Z|cXfIOTsVj?w?8{gD12id#y=?7z~H6~_O$7A2|IzrBU8YwrKka!faW?&sFI z;@Q{QP^Mi|bY`DTV)D}2$@htCHF{?J!%aIs%D=}#CF6PXTre1l*jt+yjBKk9t|Jzl%=7W0DQgYO zE`E+%)7agUpPR1bI$?XaO9c%(T>O2^+x6nD#NrQZjY*TU@yiAlUprgRM)Qa=ql?wX zOzZs8Dor7vps&s>3Ms$&})C!qQS+BAa|caMfm>ifv_ikKAI zvisd>J&160g{>N#Kv;7}eReO~M&D^ax=)z)qWyXbANz@&ox5k#I$3YA8&I?FkXl4` zpjDs+FTK=Me>kNX3B}Wb>6gV^4eZlNnn;5He+U<@OWWqdI0N+s3yC|}1Lok?Cwci# zL4Z!I4GeCb27NCyLvMdo zEbMk6DMl#bEub~2@x?~+cd~+|PQK7*&(AqxV6kq7X+w!OEq8sr-tGG$in2;&)0?PHyVya;qif1vtE-6H|Tz!+SyEyOM6PUkF z0GpLosWnDnlH$}sknUt5r5WQy)mG)h#I)%A!GnQo)44qKyE#GeY;M=7&MrOB{K2wq z;k(&lgu)Mlv(JLQM?KF7ItSNj!?CMUZ04PO6f@pKgDE;XyoCyRdbNp_*66K6x>l?A zxhvc@e=Tbjpw@LEcU2+mEozI43@XB^%DDyUA-BYQ zwf49G3OKy^7n>kOE$Fh1MI+j6U^S<-O1qP2?+Z_4^V`fN)Q_5SC#5*WT3EDS0cD$2 zaxx59vXahW2;77?+ka=o_lSu5bqcWdy@}YtzW-IlrsoAh{fPd6zswcD^7eMqRdc0q zon^^72#~xE9U}xYGIKmcVfv5QrQ6{KI86WEOPdBJ&UVTO9V7hsp>QdW)`=!lV%fWRJC3A{hD& zr!~1nWdS9UFjyX@^nstCQjpcVH7O%D7|069G=2`x8BjxW8rHYdyXk|pzTFm%V7KiN z>+FKExm=qa%&;=QdqgyrtYH0Thke1x#R)ERuWb?^+JgFbn4*RnW>qGG!u%s|TZv@?W$S5Z-JJffuG9Db{QZ0p8L11w@$^qzw6W51mzeyomnx*S8-gUw{yj0gq3 z4~}X5qU?QXF2w0Ab;krR6_z?uDel#Plk&?moKTg^3bA^Zd0olU_yBwKOP+Un6r~}5 zbl-`2M|7)%`%bQ5c@UAFFxZ9gI;ydU4Ss4^QR^FB#K03>EIYeYb&m+|X^=|R>CsV` zL3w@tw~73HPc@p%#nSdu-(|Rope- z^8uk$i_ttAPedbU9|)YlASMouNnzZX!$V)v85e9`+bYm==S~a*;&qjuOIGHE2|D{P zmBAyIt6`3>?QMlsuef4VC2oX7ux}h4gtGJKFjH&pT|yfK=1JTvv0)jpP(i-tjS~4G zzWK+}idA+u zMzw!sGeuxu$X)$PHL~Gx?6XM7H~5s_xg(&5Brrn~7Pe*A_IHY0U+gO}h_S)ol%d5m zqi1d)yRv2KlEWj{C+in%S()1n1us6gr@SV=V$^e`$PbGFVpEZ&v$HA@pUwETV<=>d z3Dg*fWMt^< z#Df9<<~go%YfgMm8mbUr}a&m zjG>j2ihj7yP)~cNzE|}}-L|+%5FHf9n6hUtQSoee>bIIX<~L=Pd9+yKZ%HN%LNz;c zTV+36%>2=eV{&?N4gHba*LIkBT{nx^IyhH2i5OB<-yVK8q&BQd3am4Fnb3xKQW*zl zR5R%{-Sixet=3qqJ5(NtPaV$veQU^RH2u*l0T*AqjLiosRoiHo`wCJM`Q=7Ef3tL_ zLgG163jl6MuWcO3H^s`({SoHWp2+K6?zxuRPl-U<&L$!pl;$rZfrqdDzKO!J+Ek2k z!|o;OA%Gs+*TVo1iCQt;>=#4cn~LV|Gw{n0v|{eYk6XT5-Q6pp=7C-sqwri15I4Wb zUSCWXsx~vM7kjFjjCp$X)nj?b+uuK4FF?*GZRF_UiwLb4)Uy>wWCP2N#A{c;NBV~1 zm_2_;MNA0~lC-*uq4vVB3``~AoCihpI@&@*aUvHotlDcLezUeI_t zpUNhD)IFwWD*{NvU!C;a{aHmadeOF{K*b<@*mx2UNrJ68J7Qo)@Si0ae)2jXtrij* z{%fCi-fVV^gULR)S+nP3n8nc~|}Ok)+T$>D-Kn7i*%2$Thfb+}It? zC|2~TNhn2q1@TV5ZWrnlQeZQxXIetluI*Sk0#{7ui9;t&Qtb>PLi;Qt+)vxH*%@OFQQE>x8__pz zb}tVr*F9e*+J~HDPI1|p7Esu7xr#D|M^7#Imu24bRPZ&iz_^Mx z&njAn|2~QM{Y{2=bNr+IjIWnph1tQIaR8|lRM0;lW)hs>8jeGoKCH&7ANcrNmZPGT z6!#`wQ?N&0OR^b-*m60S@esNou5NEhTJe*#FRj?0p5JAi@3pb@{0RA-_+DfXV-NNC}lP;}Iwr~kBRyyE)JNeH=}JAjYXQpL}&6H757@-zBdf6-0lq~o``IJkkGarJfudr|;kG~G>q$agK1SR`A zpV!ye&4QrBI_FoH!q&+f!^z`Zwv$n(_kPkZnQ}jA)T%b9et{)6|ufM66s4?9qklG@&ctyUy^-$mrmHG+qRIgdu_4qzH@e@TwsM z5ZVp0RLkV*f$gCE3g-LbOM9k7*Aa{{C*9WzJR83AD~Z+H-IA^A#HLRyf74@gnVGoB zU-p}RvZ~6|ly@Q2NxPUd4L49ogfEz;bYZee*AQhD9e+Or=||IL;Iit&WZ`i=#OwYd z4XYOr12}{2*_9+#4X2r#!3xAm+N_5P;7RrWW`KgHcBB!^CktE<;BSZlh;;`H`%j<# z^b*IjB=!XS^r<-<4>$)y3!X$VeN&7K-BikrRznZtHfF91y*WL3vfHuyyaPmtkUVQI zSH~Ig9&|t1 zVkS1tyF$O1#v{B`sBlSKbh!o0S9&rW3q)v+q9^dk=SZfwavfe0YrdG8@0#QvwfC_a z;69Y&Ytjl&%lb<7WPLbub;IooqO>c6V)aM;-kBa;KitlRKeoq=W$f!c{wWPCa!>5&dZjbAM z$j9@ErZdu)g&KtEpL`NUoM?JK`{1{W{^2ySxmdO%^-U27DryvBYlUE9<9gQbfxQKf zXr)jI`z=HbES4a@Hs1R{TFf5CE}K8f6R0Jm<$iLMg=Ev#(~o>S?KLLY9PnPFJy75q z#C6e$5|Lzqk4*h?gCm)K3i(Al=R7Gp!s>ne@sseewdwciHo3sm<-emaw@J^j_dyz- zUwUXLziDPtCY@)(ZnE*8^?m%^SiTR4_@SGm)12ZyS@AnlV73?bB=jIT7(jL+M+k?) zz@R(Z31r8>;mu}lR6h37&n5vE96p0sQYb${W9TPDYzeE$QC5u=tWvg!Vp#FC+Dvh; zbZ5U3+DH^`^A|fYD?V_U?hMbzhUt6_rq2&)@`D)mL9_Jg@gJw?DTQ^BF@2J?cx~`A zul?6C4-*{k*TIwbf4X&;N{}(Mam?W60U_-Gh|-7#jk#hdSP`uJo{T0crv+Kw>e|KC z)M269T2z+)?wZ!mZ=TtlGNMpqbG8ZPGTkx!i4pfAsXv6KieTz{Z*&tAX8tf*U%xy- zpnU#JAdD~hF^Q{*v<%zVc<|;k-bzEjJ*LNjacLsA6N75rs91FtZVaFg^tA7#^W+$1 zmvF%VcC0~p!my3rFNMbh;iZrh^TWLhRMrQ8oubxk2bHOs>6fojwyO&_h zZumlfYNVv6Cz@b5YmhZNT5XxKi8pfpgLdzBluMgrGp{pjx1WWtp+^+x+QG7CH^Tp zYo%wL*aJpf`xR=Mlk`H*t-TD)*(l{OJnrbzh1gBU)>X@BjlNKWoWd}EGWCd~iZW~~%7A)Xlh~dK9o^d+Xth~cOnn$d3MVh0nIh*^0^Sv`2BS(1VLAh9S0(4^z4o=;M zn@YcF1DTXJsIJzrsH^u-zZyBpqdCOqk=HoSEo-%xuv>3=AQ7L?a?BoHoN#}C%)F%a z)LlR?JQDx>imi?GS`;2-udk^Za5ku}OQboOBxH*t$r_n;*ZIIFvHE>yX?L2#B_d); zv@XpyKbA8H&GUE95Gt56J!+dWsCrpROHaDV$^N+BIq@d&yxM}JNZWXUd!PF2^$SXF z(_mM|_i9Da;dV6TpXRj*&FmGS9I9e-C%S`fVfoksz1Ejgi0x#f%D49+p6Gr$>`0*smL(sTZo7oq>?a=L+U-L9Yt{Z zcsbLDr5pB#Dqj8;3O<(|hNNoGO3#i@zNwypie2}cl-GFeE&M&drBb(?29a`zFjXI6 zjEh7ZzqU?TKnES0Xo(el)>u3p-=)>4R%Ivsg zEVKf$<*nSWp}09-@8~hxbSU74jH(_2<#c~te-KY>y<$+5nHbA@Er|d^w-kB`V>BgS zKn*R9pAI8Zx7%nKYr*EK`45oaiI%83pDhO;%W~)O)fMz&RWM8@GI&?NPt^6ro;%@g z3W#qI?Q4m8{YL!ilEXS1Mg-!{IcE&vIeP~Hc8-i}&kML7EX;p@V8BwsJwg^jnDO-^{?~APr3>pW2FCbyqU|9~Dro}L zXg+KF<$RH=6u0mD<2Fmej`**~qAXCw>-8Vbp0p66V_f>wfW0zYIrH9Re%2=fY^Bjt zq&y}v)$w;rf-cc)tMc7M1|x-ibz;v*8xmtg=)~D+2b(uO)Odhz`*}xuR?(nuYXChH zd2>wiLEz1J)vK#10Mje35yAe!dKZ%APvac`n@sOK)zQUPC6+ulJlbBl3lz_`T;0c}$7(GV7EK3`X5*Fy--+rbJ}QCha8pUvP_(qo&GpE$T!0nh}FT+wWYOpMF>T3+3R z$3f5#0C?m5to8;KS2K&U`-3Fpb|XQO@|}|L23shc>dq<9RvoUI19Z2on|{ocJ69u;U5Kv*Tddb;XFu}h?yFvA9q;GSe|9SsU$XO^nT{* zLm}=?&L^RkPyt!^&+VecJ0k4{{(jP;bZoXz--S|BoTHepY=Vh~k1-n&#{uo5mLmIJPKOm{L zXsI@Fdk$u>3pzMEb}&DGUEd0g;dAQ=*>?1GWtm>fbHnKiQt_pLwv-Qj*COHY8NxR{ zDZ!qtYlHY;47KH66GGxvrZK@PvgPWt!5qH0ZVwWY58#eab@{&QnG?-CDrmU|0&Ojs zRHhTKi|N|S3}T*r+<-yr0X)H;71d2iZ3wawroWb?4~=7zY`oYWh^C8e>Zt=gC7H&Y#xZdIyzgt41VJo3G>WC7$_Ky;)vC(qbj;-@{gtk?TL)lx_TZglk`kHI8kg&8%x@Zfh*~yHIb}QNTJ>Wl`=UJg?pTvB$FJgTthv=vIm`g$X$a z|KNyIgvf`29`^NFJBUJA9`x4W67lJ1FxFvb{IW@M!l#?5=J zaBk=*l8q&k5q;&Q-gQT)wXNe?-;{a*K*JeNcpyLBaxI?R&|lm<{%HC-2ML;XCmfaA zbHY(pfupkKCNE{1*5wIqWorgXTm!J0oIg7PzX@uw`V?{7jQ z{1E(}G9#x)EQz*ZIngE#NE(MIsd*u^N;T4ns1qRZ-BR&Emm6ykgr=9=0q6#7&pk&MSK z9DbiD^4i2C4P5fWEVuiv|Bi7(w>#zfr)uWW0YMa~+2bYi9(kvp`Jerl+*kRbJKQh}_*2QXZ9fbd+`Jx9&$ey-| zl`WCpWIUCxDEc5s;pzuP8_7oGwdNiuue0NKkoo)=iyZ98qFm5d%;$_jD>qyyocgA zX1F*HBW)6!f4nPB@mB0QfqV4{r~jZ|o;Lc#YaLKuMg>P`j$um>Uy{;wVZd!U)r5&# z!%q+4Ec|vu=GG>EAo+ElR?be8$Rz^Vuo5$0AFgmV<0Chr%UT#a0^tn6SSm7z%Wf%z zfxF2;pc^Dc=w^~MmE2@200x@p|4DaT2mBpR!APR8Tx`G}A(+k_;bCR5O;=oiO!ILy z!ZTa*W@tQ>aizG#7SR*m`HsVX#i`E|>mmpXFCDBjJQT~Cc$^yuUYNFKcbJ;Nm1QkL z*6ZD1#T+kCgiGcwQFz#fk03Pw@kIv25K7ZrW%z*MxfY_rT48M%pt9lQ<a!5 zT```@wrKuL8SQ}Vn4+?NXa(fook`nJIVx>aGOGV3yJogb1WNL9VXD~;k&SoL{SD3v4D59Mt(|p;J%Jta+RRN(All$8NJ&W~*>79mH zBi@(ylssigqMP*lU}g`^^BtNQZaL~WhjVefqeS6~Y9c7m?&x zhPSf-0?TqsR|IALblB#h>_@{qBI`l^$_hh`tDP~wuM=U7h)ZlCJ0mHRUm%pQ&!XKG zgWCIiPPo3f532QI#0$iu{m1HXGI!bt8kZyA3X{VN7A`E>^s7j7qrauv(_%DN33C^@ z?3(Vu4E0%v_yHqOVjzZ5aD60#Vj2IP)fW#}yGDhW`Jr$1mE513FUjvL6b7Q@88;5n z_mcLorU|*e|J|Wgqfgas_05IuNMp1jx>nb$AIiQ}D_Z$UYQdmxxZ%O!cl;G4!tTpv zkotT~E-Rw|PRCYSDC8Q(t+;Z#J$yTesl&0|57zCxRZ9P5<^(_1{`E6~+mV7=bjz0P zDQLO_sa>y509shR+o@|qp_+2eHC~?O3FBFkQBJ`4FbT?5l#77yr>ig1i@Fn+`nV|< zMl`hX6!d92m2W(c{uo46F=ho+<<$0|M5YH;?f+FKc`xGOsz*n<{TvdG5CI-O2-wX( zSPfo?-rpD^Uy@$h86xLAO5E^>+R_OYI#vg?UZK*7*3-MlW0Jh7 zOD8szS9N_{WgbCajzc?+Lkh!7aCG$K*QOVf)pE>H+Ua4~*{+2>C!e3*<*~snOFLRB zX?w}OGj76RU)Jos3cB+kHhbt1E!-$qa=bHEeSG#*r90GRy6GeP`dDB&C2LxQuzc`*3agc`@^2`{K~MFmq0<~Izs}LCIMismbs9DX7n@k31lKMZy3AT zwL;+I#Y$+`s8X9qN^5artfE96k5X!L%1~Ed)$;LPlkP5I79h8rZ5!^l=JJr`c@)a! zg3LOyd#W7CdH&>fZM%OZPs14#U%J`f$anxO7g{;yM9*Q2bW(-tqXwiqXgMQ!8+&04 zk$%`3e9npeWT6-nZ5M76MHQ9MIwUH-?AK#(dGUk(Axx#}<(-*m=;}+Fa#5_7;R|@~ z)O|VXOnP^9R=;_p_2m8{;SscXV4GJ6tv(xUdPL>(d*V@zwp zE9ljps`B0MFZcB&$jJH6_z(KWgCF)#{XcQj)f?``VOCC1j=@~F&KCRF+jzs=EVbFanVKa{<#?(nikh*CBuCfX_;@ zT~n~#6hPJn*L`OKK?oQ?1Hh#*lN0Od_G@nnrShSBM}ko8I!ey6bV<8q6-XdKw_eXY zS8;O*e~?N3?9tE^&Fy1t9ZxUCbIvS7Dj3uMokYmz7qRr~-=0xMe+EGsG3G&iYdfzp zN8uplml)~`^bU7L23*#h8Nf^8=cEc9_^lWCR}?b6>H#Q4vy8OuE`j{a4!?1fyJ9a; z$WYlJWzwTwOr2evwqa1_thg<{aVs74nx~ea?-BI6qM1GYfOgHLQ$yIpekM&GjL26b zAhfL4|3~1%U6onq$g?a^=3b5Ns(;j=dEluJ5CRHUFTQ#r2k!9+3Pf{7@$z%zQraxc zwkuqjP!^Xw%DwhVd(uoStrK|m`*xWV8`M%PO(Z+f_r=2lG=JebIz5)zGccgc%pRKq zNQ$;nPrJC}(L@d3ll0JUd&Xq^tNiZbWrg@dG}V(y?3=}PTM?abi_6c z(HXzO!B7?Lr_r{`e~7AR5tqTwOMd*aGnT{-Hy53+ezzySLqosWVvI0C3b=DWGzNc1 z1ij_uDO#pSe1dR1s0cBDT>${ltp>+<+g1LH@_h|1pQ{+SUM9SAq{gf7H8632&0Ov+ zr?7fm8~0Rx(Sr~l`v~PvHap(@#cF!7hm(ovJu`_E(?jHFb5SaLznPb4^ElRqDSUsK z_i8S4KAcZEF?8Licd;;4V)+jsUFX$mr#G_kb3{cEj*fr=H%d{@Ot-nKcYF9))Qgz$dVXxhStR( zu2pL8tY~F9-!2-^c8u8P8q@MsvkiYNGAP$^ZEGVGO0p=(*SOA-cY3h?JEfR0EzS7R zc&YA$0HU{iuCX)Jbv)1Z4=i}O@|Y^HC995w%W5A@3y_6xAH1|o4ZACbuA94mdvUF` zn#G7q;Yse#(%B|GB;8xa(cb^ zU^L<-@tUB17{n%9yA_F$&M|r%{@@ICOtmw)Msv3oq2%dGW+p7ys}3;4g?QUy6aIt8 z-Op;hKowF2q>*nFVT-KU_*2c?gr(tl1|zB4!2woU?GVHn;X?g(u3%n!3TTmL7m%9H zZR!w+^Xo2%d67=7k!D5b^Zci+JlX7fp{2?QT8ZlQHT?q(R)2D60m_x9hOxp)&8haU zRHs?Y%UgkmQv8A>Ms_J_R0eNl9Ng42|6C+YhrKti?O4}<&UmobuC(VVzaRoGn9>NT zKL72_a7pr5+DD?pyr8AuZM=(7~ zw(che&0?`y+3ho~VDyte(M@I(oL;>conN1lS{+EI57ebCLaCr+S6&~t~nY{ zoHB?6I9A#9hdWudZthDG`cFQJ>%)a?IuhpVH=92HeZ122 z>jnQqKi1{8eWs4(l|JXw`hP^7Wl$Vn(C+^cG`I#2?(Px@?hrh9ki}tfmn68mTX2W4 z$l?TNad%%93A(uN<*mB!y-I}28#70YzbOM zzTQO?zC&?mI{Q}WVUH#sEU_7%38^j88@N(V-dNR-f#%1L)R>b_OiUbH`})0lKZ8OG zb2N;Ak-?MO$AfKl{uw%3P7jS-Qvga=6SL&Y8~99clsiNYT*Z={}uD-o1yP zd&S3prHoepW=SB|K++kEh2j$Ps*Yq*G7_Z>4~epu|I_06zWc`8`vrF~?oXMF{7_{R zD>()ER3$dX{oRSMFUhzb{=OlKV2zTcO3vr|6DC3Twl*O=ifePlW=+-pfdN@#McoET zqjKn!kkIz=cY2Y9kmzjQune0qqS%LFsm_aX{3`wTGo+reHUnbDjC;4wG3Dipy0ZQH7G6YL>vH@Acq{YCiHO86TBs}VjG%%%TFHwZ z)r*isrQ68kH^vskHr`7#)!_#;sv2x55C0 z)L(_KmCIc6RwNn9`7vcQeLlO#fH>1OrLANx6&f{=L4Om}3k&1A1$VuPls)g%>9wX> z(n!=bSw!F55SyyL2VWO4fae-2RPix&WQViCK(_5oaLq762nX6 zFeDOdbm=F_=S&}P0I5!X*Un$K0Q%_B?-JFUjMMZL&3}vF%@}~(_p$55;1g4ZWAByf zC%%d1eW|(Uj(V13~H;23pj*Y<2@qcipnycu7a!9HYcW)Gv!1YAhtK}MekX7xYQ#2B5Z_FmQ4;U06dH-<$;r5!sQssR zwnnc=^Xd<8>f@iGjr&Wf-M9(e7DNqUS3Vz-#$?~01v&FtOIao3x1#U&AsPO5;| zMo*Z7(777j;0&Hg}Vvp6;q?^v8ube8NOq`6;KrE0-;im_)O*zi%EXS)Y7JNzSlJvTVMxB%sb; zrVY>EURDBEW7-Jb&HC2WRP&AjqzdBdO&rK;wur_VX9RI1xXnR8u*R5=!-aCyto1S7}vjqXmyiF)@{6WoZQ zs4cBZ53i6GKDj(Jf^;bUcwdcjYAi{A$o- zk8S;L&pQ-h=L04e2zml_qN93Di(AY%qx5hdcjn5Azym*<;8PxC=7 z3gNy3$IL(?&j3MQ;u`4GHZ8fZdqRLURpQJc9>6ZHtB78T zz$4V`$*{!F0h)eM1ZTFEd~S=5u&dN;rn5{JPgk1OI_yI&x}kAd8CRt(_F5{S7{~D; zd@*k79JT2yWAJb_!_7^jIt*I$ewRucw~CwNMjZ(%KtoJUmi>E9>}62h??~S6sJ!lA zsYSp|{r!s8CxHuQ4Y{drJE$MxL1izW4FjDZA;EGNL@YmGYnol;?UNg@GcJ763+>LO zr%RfH=|ZHJS5@mw1{&_=B?z$T1-MuJEE{EQW{7CMGWDL>fB|T}V_*&(m+zl;-H&a! zPUpQ8mWzgG@&U6uPi8&u)&Oco9i?4lf3Fe8xk$eW2Uf%L-PG6I+FKO8yp&!KFR!BV z5T*z|)TFmcEbIScF742M!G?XK7ABS(s;&U%PCo%_FYAq4!G^Pmj}#Rel^>rC`HNpA zo3Cu;_*%@WWP0NSwm7BGtHlI49W_vs^4?+WV;plG4}!(jxjt{boBp?r89M9&;ItnW zW8}5mbyMeJe@jDj+F^#cz7dn)3f?QyTMq2sC@>AS!Z2|eczNWi5e=G{wI;TmJ++{5 zR7TRku%C_6GMmvh{cSr)y2gd9@hRwydHlq0*LK?xUFtHT+3N<`k&cldb!Tt7Y;1D9 zUiuOnrWD=}o!JWoUY8pZbbD z`Fj;@$(fSBwj6NZEbHVuv0POBp}Q@4nH8Jm5~!@A{hpy_`eihXo;xj~-21U^b8knz z@6O*|$mbG9r<}%SIhunNTwWX&D$jZZ=6Faex-Cq(H~n-H=uU^Mk5KIy=g*%8UT8el zrO5CWyCPBgSQUTIb2$FEnyQ06wzkw7L635}3ic8G#pz^qI%08S%EFvTIDaX4%7iIQ z=~O#c_ciH_=jOC&O7zWjWfI3>g zxH>t0>*s(5d&qhbeiDV>>_`LTHXFl^YB3QD zcx$-GUZ^)&>n|Ko272hJ6;?sG@Xiil6i8=J3z${Uvam}v?!U@SRHZIvj#-crcLGJW#LZfAOY z`I|zERZbtKwDnc-d=xq^v%g=&soL{~1Q)pf06CFwj#R_Bl~dwlLj|>FF5TSau%oog zWe=0C@0?uxx+n#7^aHIY#oBHTRMX8YS}9o4mulq)HSYJA6c7Dxh|aCU59Z6Lf*)>* z*YD>QW(-w+Nbrrvl|;n1b&_Xj+(_pu}n>I{x<_&vmErPr;d zzaWt}-o4)|F+1c*soF?86Nd~D^DZvw4RQs|l+mc)Y|WBnACGP=U1+!;t>@$BV*+-U zV$BubZ~6;l;`mu^?2$l)Spthk4a0bRW~Fu<<;3#2=t^zE}Tb!RmXc z%+Df7|C(towuk`YcQa<_3)M<%Rz8%dtF3vz!`30V2d_&zQKu2jNV2>3{e>o^ zddESoN>zLoo!YVAiuS`UkM<8W9nsnCOG7Y^?V^iKmz^E{ys$8(S?RP!$;L{PxMPyp zoqxwMRo-fcZ=Y?c(+EeCpKC_L{b%X=Ot5lWe_zqvsQ-`7!{QXX;>HZAa?uVF|0w8k zU$r+TMigmU`jo<&WxRZPx>17hZ#law;Ncv0Tthd2!h1N&adotqe=05K`Y%!SQEgi*Gb^Y~^88saEbx<&@{T{96G_)4#bA6By0i zM~W0dU{XiPNbaUv60VXSj~%^-;}(DKKTM#@`B8C_G9aT%Y?(OY z8-D=KXTPAaT{twOc_$~}{xKFqRoLe+3vYscvvPsSIOShS)Xx41vwye-nju@BAY+Z4 z_TSZYRc2x!?MRapJ_N|eVbopo6exJl`kYYpWD!DXG)(O#5Ek{8ygq;dd^~D8#K6_A z!z^vy)vS`m6C(ZYAJ5s{yHkhfUjryR{VQJ=*zeNN+_0EdIqqC>HSz?YC0jUO>OaY^ z@c*0al~rz~Jp3~Fg-VLk5dgPp{~6Ib*#TT+X|Nx{-YW|~%n)(J@JjQvemGR~I9*I5H}Hql8BB;TVHVI1H{;`t=f`@=sL^nIo>7^pV~E5HEOvEv59`q&nO0 zX?e24TbQLUF|S6AongJM5RQhXJ2J}Y$#Y()sLa5SZ!!p$ty#Q06mwTB5vt{f=L`MB z8?;nH4*XKnW)tmU`EQQ1MYNkWdQ!~H7n+naJf9b78e5>u@0Ir+0X8!aBC^#6O8C>9 zMj;1LagGo}>QLQCN@)f{9hMV1m5MRXi@w)Z*RjNR2lLg=e9dov5d5eE|I1HG0pSD@ zI|{4Mis+=?`+O#KmNCs#)EdHf_YrwcH=;S7A_!wc-G{<04z;QIKUmk`>~Tj?y-Il2 zIEHVZxzc$H(AG9@-))}Z+N${WhfwDVZ);|52iv(_tYTp-TkS?el5I)cV?=VTmpmJx zc};9T+(MV%(*O zpMTtwam*B3*uuUE@VNu^lVC@l%ycl_3y1Ki6&*g zo@V)rfh6d8y3h?>6!bpUJsusN&ts%Yies`$tIayh|vwi(0Q z3#+EmOoXJna$7kB?O^#&RyP3yj~=>kORxAWtKI`pFZP4|TL~Ick3}tIXDxXW*#k%~ z0F%Wj1)I`)NcYIh;?#=FUS}LTBFAnl2mSaB zD0f|{D6ieSe(S;uW4`%N6t#;^$hD{7Vh!le84+HliwNeDrW3y%4fn(Z!J+CXgk_o? zlEgd@LRt=AIB7iDp${LT72+w24mt1_*9txF9oE{fBgjiGK%NWcJ0a()ruDP~yh6!! z-z8@VpA$q{{UMq=?;00RrFR&JOm2$Zt>kMrqkh}G!A@gejh}{mfyk{7Z=FcpSJJn7 z?Vu7l+U3Z==(u93^29lcu~jA~e5hs{jj42Vx(0KDi9?8IyEQ6pD5}L;T*E|f)n>r^ z=3)M#NwK_T3EfA;yH_)bU=wVR+zCLw*$RWK%!J`&$M}^`@`^E z*LnHJ5?Js0Jc$JLNQq8Hhs1c|yH~!!fS8D|D058? z-f~~^aiPZEn<7cZlxUE9p5E0U#sjl8X0Z9qH&7*+_wIPBNXh&kLHI%iP1+qrDO zd5zd)CY*C^ryPIKeql_Y5@U_nPog)rTYZ{L2wuGRZrg^Ph7D|Ro%;lYObd)@R z&*9hvgtFV{?#MASoOBtH0f9OE;T#tRpHj<69*%3QaEKQ$<*n) zotS|OBWhvanG5r#^2tY?gsUzug9_&;%*btUp4`=X8rhz|m+ll2I~-a`{(8 zf>2Iq`5)@OUdyZ+r8-rJG63n6SkD#|e`6m-&BqY+xQ`9;xkT0l`u6_FG)>wu6bOBY zjRINRSbA=ZE7t#a#}!}x#c5+0Grw0G*F!jZcu{fU(B^9i9>4u!sV1z_@*3}U>OhU? zj7#mMn)+mAK$&17o4AVUb#fOS7L?;bfjAIQakj5N14t5lj068N7>;f_6l}z>QFUvs zz2JH}cFGhyEvL8}gq{qxzAf|Q{IxoiAzm)hN~UhL`J|>z>XIO=yvOTz;mmW`8~QPg zUh$^Qs^QEa_#8`$50co%-y0Z$E(%nP`o0-gQ*GLww`6p3pevdUa^%shE@A$fsgzo& z1rB^ynLZY3vUHN-rA2$JZ0Sxzd3rO*U^v}G>!0?FnSMpwOCD(vg#-jCnrl>IgdT`` z;47kW9;Bb)(OMl7r#c3=Y-07x^rL12gZkJuZRn_^v`csJ9ReYixZ*5|E7GtsOnW@| z%?*0=xds|Hyx$-MSTCRP{O0m*qR4+2cy=v^ZWFyDnv!2fJsNzha}d9l)jjI<Dx-CtSd0|qj9IVA|2+}n593n zk7tFpGwIgYs6QOGxDkI%k64xnuZ-%0DzF0m}?I^7UepGA7*H_d#a>R2O z#))L!oLcVz+8d`jRpmEHbQt+25mvcOQv%slu)&kpt}>3bR|IaybFyYJ09&xf^!;Tu zWqNsm!)4bM$vJMP9ieubPPO4riVs9AmtrD+^PB}okVTm5B48DO#Z0)=@BONcA4kd( zdtJ}J^?(vuGYqrp%~k{+fs*%Fki#=Y+%u+96@xGKF4)Kzk4dM(P<=lcWY!KpAyW4n zj#9o3)ab2|lgD11u8kE=>9k$mHns)GX=R}5YbIhtDL44o>%Q)mz??93h%T9(;jB-5 zlb7kyQAsc7zZb&ttPPbtmfSBrd^+Yh6+s4BdED@QU0!>U_EVuqB9;$h-1K)XUfkXg`7W0BZC=|fvy%2 zm{t0y-|7RDc2`4oInq;|5<-cYbj2`Hu#I)njMu=as2V>k0bjoTO#ijWHd5)IxDQQL z(#{LI*Qhu=cq%!?vv{Cs_)HNd<)P{8#Rc`1|Hl(V`CHXT*=HWLzpQuK_AC?}uNa z@p&&&GNXf(B!M)KXX(#L-I$>1q2IHtu+w!}ffohQbI--<3r=T$1j#?oe<9)1xqrWy zz6H(g%=!j8h~tI@wXwZ#i5xpRkWF(3(fVWSvQzav{lv6gY(w5hkF^RM@;7e{Q);?M zZguj3W!NgGO7BBuj*tbW@A1x#Q)WyGmF7#`Z5DGjs$NmTzNoh1$Et`mz4G}=cCx(p znjOw+0JrpVQ4FWmI5kz)^NtZAagOXLnOIuJeT+iuGTk|SGr%l%-xO+DBD1mxp3F_w zA4`(`GQJYoBLP0!wG>#H$=0hHY^>sh;+|{`lCr?@w{gO9Y%7{;zS@WXkqL zZ|-CmBJXlnJg(yFLV>O(ZmF2Blp!i_HEuUJ+=hAZ+5HtgJOMBRKQtb$ghRO{cgGHB zo4FJC{le0Lcu8=z+&7%YQQnG@1!@gQ#a>82TPzNxMd~6m zzV_1qo3RRDrhWfKE)mkju05VgfyK?o2dYCTt#SEMK30Sew=KtI0m@xy`|F2@dGr468;wACN{-X|)hM zrOhHO@vNUOtNCpB?%K=Q#RVsB?r#o~@jXbN!dG>L{e6JW8adlXtrFVK{05;&{AHdF zbom3svk6bmQ^o`P%2b;yuiUfyJ89QTUmkJ7ij2Xra342j36ECs-w_rDN^{IrPia(z zfbp!2S5p6bz;F~tk4l={?6*f9Ze%`txl0k)@T>#FtiZ{(wCVPZajiAwUi-K04*UH!S_LkiyH}K z16`JyHDf~F#SBx+G7AjJhjv2MOA)x)r&}-%6cU0LetWC6<7?X69~kd_L<(Ktv=(;y zFi$$eQaxK#oWTCAv@Cu5H0NS1Bm?Zb5K->JrEZv)z?q0Rv}EaB5}`<;Dc<;sO#S8KbZofvr=_cIbNGR?1k-dJDg|iK)MSA#d0OQ znbt!|gT_!TFplkx`LdL60+Kmzr$pC7_b7tUN2mc63(K2Ep|%thS`oUea2K?Xvat(c znOR6Yvqxp4+LLrSKNp%|J=-N8i|=EKiYn3G(2~c2v`f|FTCRD1_8t!FI>+Kkl(Q*i zz7VXI=71xPG~0US4xIU(KuFXu?j$^@Y{6VK)SjC$^0}HcCQPqJp{`_~e&@fs^?AMF zTE1x#lfk&|G&yeiGkQZYOFR!``4ma(0nn~T-AtX1K`OngAG|!JOK%h4^x1z*aC8AK zHb=yoO>03KwLkH*4jevnJ$LPgE$n`Zj)sOd67UG?3<~W4yCzvsYd`cS6D2ajew&e^z#We7`|TK}3kS}fd0VS$x6bEfmAbDP62V*_gER_~ zI}XXw;5;z{Q5!b?s^7Y4037%95|dTHk@lXWN9ZboD4wHwNI5$sxyWP*EBRt!n23^k zBnFzTS$zTgw23~B1B2d`94U>q)TN7-pzrF6TPD{*^Fu;h55@qL-KZJ{LqS#k3YL@! zKtf(*q^Wk<&rbmxuQZCyU&c;PZ$4Dy?U@CXfp@B&P1eiU)^atXO%9iwL z+?DNCsp!8g?i7HeeMK?rzLwzR<`Enfy%FIY%?)6W)LP*=TwIusJA;@zZg1VDy# zG#xTr85NVxfxSeiqEBr^X~Afai|mV)fxsQG@G%2f+-8yHp{Cf9U^1mLbgAJkIiF&& z*>R+GailI_^$}&?dA*DtFf+tkWUtd}aBA+}Bq31S(?0T=#m;PUZNO9J@WUEOrq3<^ zYc;ewu0w))G;`vY)8cGwlSSuO=L)&KNgwvBawlVXsnV)_AIq{zCa@tX*Fj#vI~gRw zHT4)X#s?JTnyLeI<#VdGW)4a|rkj^FN*Rqln+k@Kx)%;UptHtPiT$=2Sh;KKSmEK= zrADhz*5C-Q>)a$Jt1}MA`FwH5+(&9+n7cD%e|dBC(1fd~McLt}76;kuqZli%^&9(SCiv;j4Y&x;z-eOrJ#Jz|qh3|xm^ z!N{UMsmHMgU3P-0N5k;K=udOVrMhkBv0Xd@pPR1pVd-V_9sl6;!s?}CjOLl374q?Q zYf=_n_Cjqg7_Xljmj9)23N-3)vF>4UQ6Vs}d&3=()1X%r0Vg+A%^N*bP_HC_&@|&8 zg7ZaN*~*^;6$-ZVN0fcs2uN{DFfxOn8?+qjZIjDKU?H!QW*UW*s50-a?ljsYq;QOI zWqO$aUJY?jY0#y7VGwcM#q^PY_61Asjep*Z!0PB6XDtkKRBM9u#z1%>`?NRvYkMZuQk&I`t z`w1h~@|kDDw-`7PP0+3^^*q0trsc&=*e^CO^UU zn!7kUlMq=Jnx~nX_8hz}=t3VO&7|RmQVe4djscrG7O5`FWu*&@!t#G0VaVfmJt7^g zD^f4&7xD(fI@%kAmXj<)97cfA0;rfTQDFp@89gEGgJBpSiS1XI=SH3r!AM?c8=(?Q z9pCHK#HZrEgDaikEx!9dXLu7|-A@HGfG*VAkN096R|zqesfD7^ZiIGWd5@r7)7~)M z1q=GA=ULyvdBp-L3p;dDIi#5hfrp}&C3?D=(XesF@tN1j!4G^r9|2rImwbuE*<}y? z6t9JJFA>Tztg~Tl5)#VFPIj9w&M3Epo4FaZS!&01;I0JLYvnCt1TMrx{nXL$*;G(a z+8IkFGirZKI6wGi$Vt^5Ja6Zh4Q1%}F6EOPQOKvPtwenF=}rhp$|nLq3kYEFNTty` z!+WewN(t&gH)}}wUHt7E5|H^TXr%!CA_!0CHA4~fr8$EUoP^-$J^0tu7IX~dBTPl` zTh=FVgFsbaaE~PPxBu>wm%n;J;YD|h19$o+-BMT3eE^2<{Ymd5Ow{3*ks~!?NCT-g z>i^nE_DAjjOgnHm%l|V3E|2yQ!|O==KYPKS+u|eqUrR-xE_YVEzKj2Vp4QSU9ufB` z{T=2L2;~JK+-Oik+EY~cf9;~~q7123uBdNd9aB$F55Uu9X5)rLJ*etZAQp&AFVl*} zNW8x&_r;%;&miYy-^I;qXnb7Y%#teZ>Fi4t|K(K=EnW=}y=w8hv#VTOOU?h@x9|dN zcAremsu^R54}^Qfi~B!87%@n1(6T4Op_Wf2UlvGmTERgKpXF;>@l_ zyHXFbyMQy6z!FrEZkQBe8S(x1VOXSpt80i~7&K}J<}Zcc9eHgj^-qSMr<$+z-{@-z z!?ka69ZakL|D*Np8>m@HQ7B3es@RO&LK#llW-ENS8FXrUFRBuS$S7Pq+=kZI-w6^k z(re3FG<^pRf3A5i5uo;~9LjYYkR?Ru{0vTB;4-Yw97$4t8o$c!$5hW2eJd8f5Pq`9d+g2Y8L z4>j|muZX>04bM+;^)qVojBVPfbkf;2KZ96n8?R=s}r}>aP(>fgU6@3!C z)gE!m%5a>OQz=wYGCsD)O3`rxaDfwI+F!g}P@am>oR2iJyFGoQuS>Eh!nH~$6aNqd zptny`x%2VG$>8AC2U*d3uy~Ps{JE-f;&WI_Q@1|r8QAPG$>8jL zNiNdlpwJDea&f=hhS$I56-9EFO|MG=FXO7kZwVMX)hg&d=J1i5isfO|tWMXeqI6}n zhx-v@Id6>w5McoO7?VAt`H*-Ez1&FW?I(W)3%Yn}%Krb)pK53U``+|Rlxt@XZZLgf z)op$vf4c;$_~Bq~Om2p#7qUJuaPqh8zKizzDuUg5@|BKkg;?7Cy<2O@`kKnKCn?o@ zot(hr$GsY%i10GTGH`YOZaNvU{RK|nD{b>N{Q{{q8?##N2rkN-b$hJ8&__#S%T-%i zDR5{b>RXozSWxcrP+WkO(e^9xQ_O*)!oXu!4&Uh44S1c<~~+-$L^Jh<~s zx=6}ZX5gz9*G(nWG5U||6+O7z9hu}@GpU67>)VKYr^&x!9aj%-$JKR49kueXhNerm z5FABK=x%=1_+Rs}KVGMN5vH#QsS)e!Eeze{wzb4g3)ca-Q(&i^1<8yO@pFsZPgiS@ z+&HbNyhVQ05BcHc-mjSaH!L=rNw=N*jhY;K3X5FsUTh0EfN(pDPJpsS^|_5+K}kjP z#+R3rd>|3*v>7T#HaggJ6zS&@Uqt+i+xPBkmyz(=lV;-RW_kzGhn;O$DA+{VTRUg! zR+lH}YxvHgG1|!En`PQK*W*aa&gwiHOd)zP>)szX7?ixRWCiek1{>~()Hn{x7Q?)T z({p+Z4e+-H1YJE?&F!UtB$w2%_J4oP3zS6Cd(Nf=TA5aj2%|-n)a5_6L?p4gV?-aU zNC1V?sOzlOffd>{J7cf0O!9hDhF&|hetvslQY$pGn?~-nOQ2Nd7zbTeptVYnA5O=_ zcbVusyL^B7c1_BD`mB%)bpn1YUWRA~V|BbsA{UeT&SwkFs^#M1Sv&qn(+W78&jPo? zWr2aGS=kVeCEomc25F9s;7gK2t~zL`*D1x#Zi zx9zF9#q+$Qf3A4gyE&X_QVtEcd9PAZ%8F=!WtqiKL?h(_NTC@xh_DoWZu*Ez^hEZ3 z{A%P%y*eo)OB$*LN14#$ifPiO9dfiNob*+?$de%Pv#qVa(SLAu`p>k;(p^M#(9lKb z@yHluI*@Y62X+q??}CfSKf5SL_+Zai3b>wJ@Y9e#RhWthnh|l@2|CDZ|EH&d-09%1 z_rKqr#(l8OR9f}&_uX(GP?F8VJJk+Q$r3?NO?zZY&A0dVn!nhaMHQ7duvuN*pfY7{Sr^ z&?sfC^c4EZYs$dK{Y2pB088Ssvb1?&X5&D}R(D%QUAOUIn8jqdb`^#T_!Q@B2aUcz zn^=o~_;0+_l>0|Lr{rdLOtIkG2B#AZwY;_Qyllmor+>UNe*Lc3YqS^I6>5F1B$=X) zERXSGpHwG|2w1d2?Fe}rtmgJ}yie7^lWndp_rzm{pg7w2n7Inw_ce;TLK`vuTAw6z z`9EUZ(6g|d5yR0ULu6#&2eMp~(!Ji4L>w%g-QuA#GI*>k`ykiqSzFV zhA~U(K?mvw!BQsffp23%qBewHRfQK_c*OY%&ff3U^TN;h=&oX4Xkc^!^8Qk94KxJY zUAcyCi+>yo2O^FC&Xo8TE?6b$?*A(QzDjK|oSSp?8anM<5UIu$RE$z5Au(^t=pR@6 zQsmLEVU2rfm17h`H#lJ4Z0F1;!u*`bx=s_7?fc!1ac>Z82A|UGAM9ZMY))m($cFYx z_VC6BB#On6J1D&T!J$h3p_a4RjLF;#9zT+4n`Arc`&-j0)Y`_Gn8;1X&`(Qt?r4j@ z2>t$dxm+uxQLdPiTDMrQXb58SmxhH3jUoH*LIg|j|9GSly&=;c^ZKpB!^r69=zz$m zkw?iKoSm||wXM6*Dlr0Nen<-4NC;DQRO}PKH1lY!++hG@U|FGyjf6Q#}(_1M|XIQ0|&?1%FZKnePVNYn55{pKJ@?7O_gm)*B)uZus-X-vE z*Eb`LAaxGtlsLeWP~VBOG)VOEb{VGXMh{d+lr7e?6cj)<-8vVaq7cucPw$4BP{~ez zKYRI>c~g>3#J`dZq#|6Br)YT8>C!*gA{>D#K_@%K`(Iy}$gEK>%6wv7cSkZzI0CFm zxC3G_^lk5kq;+53uraV_Mx}fjUcRclex&-#f)NsJs*4W8`1E3m15J`30O3*f)}9;* zc^~jutL5+LrjWJHJT5I{_Aa->Yz)1%(WQ~KiWO7+`NUo^T}6=x z)c8F8F>2h~c-RJRZugVjnRe-4E))k)2sOI_-nfj#v?!-P2qBpMWwp4~((wSd>d8Nfu z^8ARj#H(?m7T%Jup+|cPk<MK@Fi11g)K(-VPyno+W1GjdOuiI(DP&V`5#K+- zON-7{^a(VgxVrh05P>)hMM}zDQpMZ(-p{cKY0DbK`(m>+sLfZA&GKTX|s5A0k53$@vtc zt~#-W6U@E}iBr6jBSJ9ey+@&pzF`BPE-7zzpJN**BmBQbg4=(N3K$k=amnv3732M% z;wMgE{vo1=n$KgmPiSm3lfae6pR|kg`>_H{p6m{1x|QXTreqseWDewPS_ssO96MAjthQ>r(w0hP6zlD6NB8k5M=EH+Jwn zm$fW<)7fA?n=4S&@>OaATT606PBb&z6dxLta_8q~tMB#S zbVY}Yn;_^cdt>fEFpjB}2QHqE@shM3v_(WO+xbaIZsChoQh)N$Bv*H+addlox~F5; zC+<}2!SYp%lZAYg*O_e~mtBjb`?%$KkyDtfhByD&d;R6LkLsk2Rs~5qpIi=xue(St z9^*~49FgcMF&5)(f^l^=cM?V(BHMNG>fk@eEG)$MpHeSOl0sK)l?&DAVsBqdamQ{0TLgVX zm-46qW{VZ#KKtYLz$F*`32+C#r*3--mwT1|?jL~H55+G(n*6LK&zVZU>04Y{d`c?c zD(lbikTF_*)wT*OrN49zT6> z7$sKWnZ1_?bW+~Q*SNvqqU!bL;LllNVYlnj;R_-$BjfT*GZ*AW(0$ws`_XipuB_%` zsV1rK#-P_hsGRo|O~|!hd_uW93d9P&s~qjlD{*R-;HsB^SwDaVw=~BZFM}4f~?hgOt$BW zQcN6_^R7OVYh$Cg`d%Jl+CX=@SEiEJ_;Z5FYe;LjziBhpy62*ayw!29k4FE5xxU`Q z-2SGNWMqzV9%5KXgQ-+ZyRlB?mB$;<`+fnqG8jgy2g&{X<4n&%mdZ6s*#1uf>8OmB~7BarXUP68BU-tJf($A-?q@EwIb3Rm>-8^}*MNrH&eb zt^vkAhhlp9&NYF1=|g#}kI@a{$^VY)T(-imm_O`|Z*Nt6Q%WBxXjEC-Kzz=hG=hw~ zr3-uZ{oGi$1KCe}x2jv4Jk2%q-qw%kkc=B6lL&F#r;Wf0ihu}W>pvA{@ZH!iIIi`6 zR`x{)_;ez{Z)!u0)HY*X*8hENcNFlQBUcKJZ`=0qVw4`7FnjE=xU*!HO=y4Tmp0a4 zpzT*_IfLtT4GsR4843*O4{^a??f{?|PON{rTBH6YD?GBrKBDrZRXT1U*<~JT(#5~Z zjUfA_wND#c6^GB-z4zTn;NpGjxkAcM3a=bUzJa#uY-<0>h}a zdF9K_WcBy^e})8=n(s-P$h`tssp7L4XMD&vkLl6e8zRup*~me}1M=D?wN9oZ^>xV(wl z&+;x~Uo);YkUi^i;^hY&9E`-G`>gSq?j;3aB*vT16c$z-)}s~K1ndR`*2}vjfwA0B zh6a}-PpOWm2>W?%zcu;e4stb>16mAQ&{oyr*J4)^r`n9ZQZn^rurEiI;97}7YVWY; zOa`mroz0WjL|#YlHZ6EqpQR4;H0dhL@Uvhs4;7bP^O^Pjg*f6w0H!P*K4$BdhmqCK@@occ)t<1a<_9}V)vbGDwbhO!X1Defb zB?Apnb0wuRT~}fvZDDA$MD-Sn930})T72zf4P7rG{DxS6U{lPR`%nK#5M!?DjnV3q zvQ?Yhu`_ZQG8v0~z|{jc>=eFI%u~Zc9%CqYf2taKoy(-hK9TH_#p;QPb)@uV5slpy zzwwFI8SwpsZEqt5?NuBjf28#pS-N;0%$%*?;~YLAyj=EtWNr`48hxmVXVR+pM7$U{ zJ~uBP;iWJdHf7!?GsDb_or?DFoF? z768nAZ*9--D(W`7eM$DVWK|)>{+yjQwmp6M=r3x|VO=Nswep)4-YJFEScvWMQfv5i z8P(TXZAlvSpvee*do*>NMQ46I>@vgSRzN=#VztL9u2>49Kj$v4R>{^EIaOX^Gmt&` zE}+^sj+xwrbM;X zChQ|i%5Vj_3*xC_%&0XlH`@#MBsVsv!Zb)182ogH7;^MWjpwBZrL5FxZsBSDVCF>7 zotqomdxL_v1%;FtdO2d2bwfo{x_9y&h86J>qCRbcgMu%+`w`zhv?}q8gcsiUXds{s ziBxXhP=dTj19%8Guk5;DoJkX@S>;mj&*ulNu`?_$^G`apBN(JY3Am>2*81@esGrM2 zu*sL2^I~9z8WQJB*KL6x;%Y~#s1BW*W9%jh+et`x9Jnet0;R$F;SOa@$=qJJo`J#% zva8@fh&xB4kOHNmP>t9T7d6wIu1;S~kupII&Qq>ZWnSHI%Obsf7O@SU>`XF_2-=SC z?&+mD9<_h}VgWubG@_>`X~HGrUX?Ol7SqL79ZcZ@jp2rs7#IX`eETuW=E{z{2_@^%t% zKIfr*w3MGSxtCn^PoBVWE%{>b+MT??w0y=;yJ{*{O7(H3&e1kZuyXu!wZpv~SD!%W zl-t&SWAa^AOU>2<9LBgobuoNr3$X?;Q1`645nejZSAc%hDi#i?th&o@iDY| zgVZ=$nn{ruwr^hnSfhqR=A%&hOx2vu2d_qx=O+&3WOfw%VB<|Jvx6-8D~dU)qixQQ zpID5z8TV%_he-{tC>2_tHt6IAQPYusBH3|!Z+#MfE~eKq)ZSOhN#h9xL9@GrPW;?| z8+l?%S1x{{){_nkn9B?($_5?#x3~_bM;s-=GX-K~80m36phAGkt77fdH|~|Y>U}$@ z-V6(*jilu6zOS1?%aKCk5z1h@)SX0Adf(e)sqL8FWijCqMlCSYYmC!iV&vU+UF4AH zV<{J`tZL+G1TKB=J);Wo*QZgTJ66Y$k(BvA`~U zo8=nb`O%1|{>g;JlJh&%#j*SHB)ze2Avu@`l~%>5{FOsadVwk_E)7xpz~}93_QgYq z7OLs?@Jo29pA1E=TJ-j+&3q7(M`zvFiXQoqZG&`)_`St}XaL!@2o{a$7@k3lINSSYT$VXfl>rVaEm}Q3>F_xE zZ^9S();;)%C@H6&n|KYO&2LV%;T~F2ok{&&peD_i)Un}zoGetDYki^R-n}n9KRL&& zvd{I-nf}USzRhTIrQ#O!NGeJGmFYh=-JD50S5;M+)| z$T$jXyQu7j_27h`KcB;YlY$t4-P55K5t1pP;f@3aa1_4_`+OF4Ko-dJJEp+;%QDzu z$CsiJ;v%R1&1>Mxbs@>X6FWnEhGe57QdOD%IDmR1&i@f9!1|;_aq*|6?+ZmNV;;5M z;mG@s&o)aMf(< zXrgxQCn1CY3GN!)-95NN26xwB!5tFZ-5DS-XmEE3FzDd!gS!qo=*PRh^`3M3U;pdw z>RM}8)xNGf_cPprK$Cf;>~Tq^167l%oPKAQs5#&NII1PG!*72!pl;zn`I&jamgV_j zBH>nrT6OdC%>90^R7LCZaU`vkd4+A|98oo%%k;r&vy}w*(GF*ypR<)T@7&Y+Urqeb z)mcXl~Leo!URdy2qA_xr6u+$;`erp#_0gdNd{E6#MCH%FN(W_6o6yCgz<7S0=$t zk{qSGH>n8a7*QGx#fVg2dofWw3JMy9fk_hnjwq)2E6|G3;g0!h|}4za)epeeptlj%}MjgQeT{EU1`^xnhAeYZ0BO>5$_+YjhR^6IZ`?&aXD zP&*yrQ{t#=GTABa+#Lp1eS7;Yj`;LkOsX*0;YFx$hi@vX=~mYJ4vsd&ggGerpf6LV zv+hpf`xhy?7C>VQHfq|Z#Ps)s=L9z=yz!D}9M#9xID{7hm@6e%+78?|E{};ICAy;$ z(Y^}vOa3MO)=XgODri}dA6tJlmEDdzyohTx|7KOS?oR%TQ$VM)~osWbWbMyr6Q3pAzRsi|aO z*?VLZFOjsFDFOM2d-3bDS>O+UZBE|_Q54i17mu6f)iIse0>?`N_5FhHPvTa2O(r*= zENrS-y}TlcOaU%U`~l{}OAo!`nSdR6o(-{^HQdR+`zL+~KaL z&N;Nt7M||lhsi)z&@x!PRBJ4r_NCU)Rm@X5$O3o1l1?RdczMK8c}mU6pDWN&a3ZW;dv)^5uNVbq)_UQ`qvv6{5Mvq4 zz?`emTG}G_7rO`)yH}`T5#l6@!cY3q8LwZ3H0yjZ&NpNm-)nU}UdEgjdR%{G!S_%p zw4OlIC|i%eg{Vw+{raA|^{%z0tpkT$WxT3)|C8z7iHrkaNns!V+vyLuK&!u4*e|7) z1K`kJ4vLefb)wT3eg&un$2QA|QS#Pr97dy$-G0)C+M>iuBPoO14=j|eqqBxn+@%T8 z5uaFgnJjj~myS=Zm3r97YJ=tCxrU9D)8gxyx@f3nm0?0Mn`y0Imx4VxjBymqvsT^g zWLc|G_8e`5*IJ77Z3tN#OkzNz@0yxJsJ#yP6XH< zI6&6qg|?4bI+WWCfNo)=uFQe$eGXxf#&~rK`4%e%*}FE&)U{W7HE!8{FyqU=1&HLm zylT<=EUbR*h!2(+UD{DM&Ek%!)PCQ8>bRIp3q>#vLBEiZFNU@I0y@@`Qqr2}SK$GD zM0IqzRxb;ZL+UN>`N)xxvzr`7-L5uPXE;5ew)5`*A;jM8=-PphAZ@M#NPluXvG*%VYU>YZ9@{+yIpy(8G;7TUp++LtDzNATm^>;nQ&T^DHzp`6X3?K+GDM=VpDB>Xk;NFSCDk^F z=Z*USfF?NGSb6&c0N@`$=XyG${Ztf1uMbv# z>`r+2^a}d}p{d%I#ZoK2C`-^zO`v{KiVfDs`NVznb4+r-9Ls2Y4$paX{&@nq;HN5T z6zj|k6T4lG;bWDgLtZ9{E5kTP#mJ6+1$2=uQAXzgvxi3QDCDh&Qz*EbhKMHjsTxGV zKpk3xf5_$Q8=;UXS3krhA9ila%#`)g(ZkwyX^1^UYg`!N;g-B;ZJoz5$md|gp z6S9Sbmi-B5#mmbdzsl*@B>HeJU$7GQ?rXlgkp-~jv#^&I*(O!DP}ZbregB*jxK)x?FzI=D${qWdBF3mALP4C%tE0o}htA z0q}aD4VSeExqxkW+m!0iiT$l(nX^6Rs)HyxJ3&(>u(xkCZ0dFvJmIomv z8DYnL_QYG4U3JPnofT|D5z4h8=Fm^MtU>bR=ohgbgOO*5S&O2-Kc4&xJ0>T~0&|UM z)lqR-DS`gHe6nlGZLXY*@MH4Rg}E*WF8X*WWQHdzxfD8bu$|mhFBzAM#OsCz)gHL+b3-)bOI}+z#Z4d_2oa?ek)u$i{^1bO8WIsd8Qi+qplC;~%5> z^ZXHhpRhe%ZX<<=@elS&qh^Zu(%9;w6)OnpZ_5<4&|&2a?W<6xirujFTDQ9^v0!TkD-RMR{|0Xjp=5Ur%9CyqBpW+XfgV%{3 zb7l@xeLzyn7hapPk_A-!?c1_=EWn9r7PbR{zu4s5uR)o8Vj%D4-BpJMs6a`YU3grd>1uPYMYAHYXlU zDC&;mqt1<7AWS52&b58vN*nVS1en277rvy-Zpx)ztp2<<60N2}f`7KMHd!LXM$`1JSTWjW)#wCiP+DK*sLwC;Ip@YT= zQ1F79^xW<@LFa7>rZw_ItlximK;M~}5H+7Y*i3<(R?hB>-J-|rHg@1}n2A!b##I!R zZ=IW1Om4*AE1mE?)O%Q5xv7P8#MGvBtWMZ~slh#VxEY=V!Q%1V%{c5tZ*7DwH*px! zV%Sp(kT9<_?K5Ew(FQnAPcD}CLSd~6`GK|m1^%azwDkL6eYt?&@QaK0WJTp6Ct_e` zU}AE1XXS(nk>>Oi&+-sbCIsoOO&*K)m0vYWL@rl^Xf z-mdi3*+mHa^M{{8h6om^k|<1vpDiu*LH?SCb&Q?Fi-D0>gM)+WH9y>0Bixo- z#$a6evn<()1~Xh$V##;^n5CvgrQJ4mB!c*>p6wDA*ijQfJP|x9hj8aHbbCkjEa~(= zUX4WeLJ#aeF9sC^9{g-vr%}foq9S&jBPu2Q>{kR(w5z33e}pbIc%|0Gv_JBvZK$l> zim>PE|MLb2q*oYtM5vMDfu##+7}r^KLT=cjh3S#1>xb-A0ixLbuA^G)bolY4>S>uy zWZNn=hxoVq@oHnTIu|>>aNY=I?aqiK#D85IxIO@nUTHxpTp?OsoPxfKG?wr{9NRt~ zJINgtjYLH`c9= zb%rx-&y#->YR8nsGr}*XW7*u){*+9NNNzfld3@luB@peKa^i{e$aJ0w5+{-Lz_O9t zbG0Pa_0|~qEya7X_?$jO#~C|bMZ-X7l5ZCN;zv2nw{^u~wX~B9 zsrAR@-oozNEETOz14KSD`KEoPy|Y!gb2Kc2{-oEGnJ9Mqju-Iog55|&u{Zr@ENX6+DMC%YExQr)qc3QPZwVH0xR{Qh zU-5I4G2{p~Z`4D)`PnNYJMupiDWG9rnhZ=M8UWXH4V<)z_?(7cS_&$%7LqqB^=FC{ zt%-PT`f`a)TOK}ao||%|=xK|+_qVSs(UMiAkh!_Ha2&3yDl46?2=-FRDVx8bB8%AC zNvGv;jN?T(Iyj??si8Lum^*+@DuApU;4TA3k31diLsexi)=iBTq0&;dha1S2Au5Ej ztnGHmfkmaOzOeWBPOFJso1U1r8U)6uDl)QBd+?j8j&(eTJsCf-a)CZ#o&v>Y*6XJu zvh3zK?Ri3FOeONwG*MDwcCjuL)CZj6htk%<6|T5>i4B$2N1#&K+QsmE`ou`c^dD(o zK(Wvcrj$yfH@a?ghI8 zu-}W4452&Zl&yAPE9>7D4IETz;7ZI+31MWOa>tQTLPv%!NKW+T^QPAHqUz>Ps$|jDFb31VSS~hkp2&!R1C=M8HGHpD( zocfes8@*}H9ofeN^6kf;b(+tu-X{mdCC6kt5%~cfIJNP0QVqp!i)35T1+uG%ucSCC z7b`&YvN@%5KN?_1BJ}3}4O;mrO|U9w5E?~!uc4?nKs~wLmn5E>a>}NiIFhZ{zBW2J z&X4^Vly%UXDl<1E3%LIRD)&nGJ4MYX;HS8q_PpeCiFsIO0sa~iT^@)LaNC7W3hYF_ zm`$wi(ROnemME`UBW$^+kCO@SJ|Pf7^d25Gfh=~1PdAj9j&J{r3+w-6y7?#KCt(qN zAG?KF*t)m4eG*P$FKs&tAen^inr}OaktcuOdZy9ZQ?S8ld{NS|Vy%M=&H$2L?D|Tc zD9?qv1H1R(KA+4{snlk-+($754Q~7U6wo6W64vZ+FL7FYkHb%x%0s|Ln(BgIL~gqNY?3j6Xga2U-$0kQ zh|E8W+j=9$VQ0daNR~ov?MXel&dRq-51)McUNAa%XX8p-;4Mdi1ytf7p2v#)?yOhF zHb-vTsa#l}G^P;kx;~R}v;MuhFE-oXG}rxD3l(UZ8)jFjZL(E`h?CQ3?e+O zNmuH1y)+iMddOk+h-_9h%Qu%dBUTE{;w%RZ_LMyW0KmcdS}bZ%;)t<|$`dim)|+TWyO+ZT8lV zky#Y}LNE{BIXzr-%>=08;59}*>Efyd64bDKX+wFcS zi1pWL`j~?3WG&mug`tICE=9s&ixamBVv$1;I?mO=evumJooB|IYY{e9cM~ENF_Kb~ zt*Wzgc;=3li?z3aqNt23Bzn7+09XoCG;eLu)bC{ZKB z;Kb4bb=?K`Egr0^kM`C!x=y2U<4w(cSb#IiEi7kDZ&{|13YL#+%p)4yM77=JMq&IB z!Ys`^gIJgjy$4&xU~@XKG^#A+2#}uYjA0}~Dh=@p;&&l91xQp-YHlBbV$pOc42yAE zNH#qzo=LjA%o0iIauIoTU8x^U+-*^Q4Wg~=*)9uQ5f#uEk#MSJxK_3_V7uauoP&F zI#%*V-7*WkcXJUBt7jU-hj9C7I}0Nvl8SQ!%1@P?m{U)LghlM)h4Q1>xCr={109vSs>YgR-R-vg#3xcK?E_I}v4)I`9r zS*DKDuYC8Qpr=ks7*=d}g-L(KL?Fer=DI@@nP5-WT6k)_TcPQkU84e`EDCI~ z#j8J~JC;CuYqB4DLO4BL8{q!lc!2qpi}|TTXkD33o$m3t7j9^F6>+=zS2%LL2>MI` zdbO*_=Q~)c=h|FuknpqE+>WFgdg5BUv2I~w^c09&qg44sn$Nthm!fD9&sdj8sqjgL zAtS|KTEI4KAltIl_}oWzcg=D{){tS<^`qr<7i%%p+QMdXStNYP@1ljWt&s?c=Cj)E zC%Wwcb9L^mr`&TnG*!kFDyGw8%^r0vlXbv}>0|up;_tQ5nD$dM`t!L;*47cI!h)ZaXqA(44%lQ4@R{6T}roCb-BLN z`{EV(O5vv7#q!sO)_MjD&`ZI`7NyLR#K@jV-6T@)3Eg&FoD1Fm&^5mHP+Vzhyr7gPq27vwx)oozeE7%>JM*4 zx%>e6-zSmMAcNgk1eiGq90hjzp*5y`c9Z#$M+*QC{Dnh2B>~J{mvQ}MLFnu@xnUnq zt_AQmj#O1r`vBKJawZ8qPayrTLzOckbd!ywrmi8aIsfH}=m7)>}UcI?TzP+{O|L^q* zd7=@onmS0Kn6R9naB*osw|zkkA!w$S!onhBl4`{R)nhMO%#ssR%|Db57e)SvdsYl%TM!TP57}axlJk5T3aBplK#kIE!RgFtv z2t}ytC{a`Ef#a-La|Bg&3LF;ILG|TzIpO8ei-Ve?El^w8puLDeqdS zsbujuNL*^{AFjd_d);Jq2~_Ir2!5~2j|v_2v*KZGB})nNDCjvHI%BU4qXd7HrNiIt zICErOR4x0zgHTO%bCef%IBC<+a$iiVn!B1p56$|`LYmol{n;@~j@EBB5$$w^-D2S5 zwT!iN%8J<#=@3u=q3f)QAT+{A$REQ&$gL1wa~VVag862jd$TS?2L6o5Hy#a5FCb|U zL@2A@p*7BZ-$1mO6A_*5g;BN(UNs$Ehhw0tQps8eGVhT`DEw9t$iumP0GkX1&gN>3 z`P5wB`*(Bz1v>5(^_tJ6u2k}_zRH85{?E^n`uY)Kd}1l>VNo@AIH{Z5@+chRmZ?_j zW8pdO#cKlF;V2ZmVd+aV>X{mz=loK8@??u(%I^XX&mR>bA49mWv zDk8$)d_yM@OZanlj{k4ntw~fo4J$_)YWYF|gIcV?@3>W=+UVqFDvl^uVd2JXb+h$9 z$>~Ks2WFOYrR%G5E59?hv+7|GRj;3~1btROiwm%B%nwbnavqL;-T%X3YP?9lOv~n= z=_&Oz>vVgtpwfP}dg(OtGn&Yz5ptX7z zlbc0AX!4@=%kC!bAl3V~T%P%=`TU89>K{c)I!ED<6*>V@vIzA>X*|E~7$Guo3lEPp zT6DhkxRv`JDW zB+M^ouJdS)15q=H7NcZC+mD_R5k8|`pb|Np#&_kVAE=|Q!0jIZ?Otf3xl6XtN+uo@ zOS;P*$Fml{Z|Ca>w!pPu*{Mi{{%`+_kxB1D_f+pBSrMycjwLrGbmbx3znZ?2%k>nIg>9gb~}7N_01nmz!+*Ci{hU z#fQKD5zKVK|D&L#x`q3$8mJr*h$^a!nluKDcrD#zeEa?gCD?QxsqxMFWnKCC38 zMsRs)>63F(l2S;BtjpsRb`{ij=%yVV3^mRKw`HS~T^@L|*E(M+Kz>Dyyds&6y(!gn zk#S#6?~2)LbKX!P6|;g!d{fL-gNGNCp(=)t|qNk75t`(lm)#o_X)(Y*6_wc${%>j39?p zJ}Q3DelFrPMj`easP+?P~Dey=|D4o%&$B$b|G0mcMxeiff!{(_D? z2Kvm`@sbZg5b=nRMOAKy`O0*dQoMNa;14?i{6}Jog$T3Af!wY@!LU_I#<$p;+>t*r zZ;TjrWTZT>Js{j1zv|*bmpzg;ISCqgRhi8Ew~ptZcyx9-ws*b7AE_>b4{)CqzV86< zzzF|8$^u9IS2QlOqa!i4p;ser0-(}K1`krn z-!=N2W$}okKpmRb=%?+VRWnL}FjMfEwv3`C0FD$95oy|&3px=EkkN1p<-p}}&E~*O zHN4c0I)h5#IK#h0p5XDs1~O(Xlzv-RBHTH9dsjsCtz;XI%Xi_D<|m3DoRYf(&t4kP zltzyxez}#sITAJ24J9Zkbz8UplN~pt7`9MbPkPaXCJH!Uu>4J@vTNhMO+BZjDz22t zuGIh~iW)8Tf2nO0rpx-{WyQ75s$*-3qkZde_4=9r;hWI(iNlh%aiQ8?!Gzm75<-F zl%8ZFRKXa^%OMylIbFfVKf1eLfr-saG;ukC%3s^WfQZU&4904+-1^BBwz@>rd1B)- z!Dbd?cq{*zxYWf;UxdjM7}@&uQG!}L_TL=_KV96w8uE50k_iIxT+z*tubu1PP$So) zNn7FRqCFOce2K+VE(2s9jDu5qW7r*gm#(|xeua2|7~LZl@kI5R`O5ElgKlrsSNo-( zK9COb$7|00^K4|8dm|g%PD-q8C@py3%j*h@0AwF)@0^aq-w16b-X`fEUP2CXs2$L!+cst)8 zXqsw2y`~C6T{o4k$lLoHhrB3C`w5GNFud2R_yYvwcZ>m!BvRfm_JgD51XM|hY;moA^vjZOwSTl$yUrwVVcYS`coWX6kQ<9+)r z9^1Tewsl)Kc!<8IC6&5(so5}r^=McPts8`pdb6gx+a7c$|WaGWA4=7ZF zLMdNyi&aTw!wF>!=P8vpz)*zRu&ceBnf}8!w z&qlGq?Po3J zP+(SPi{%jhVqtvsxN5kTF5|zj9Qf=`5@9|ULCa0pm~~+6t4QP<{;}xzV)5l_!VFDR zzQhrf0&na)g7xn`jy#=T{)BS>@OX;aXt6&?{j#t`M;{ew={aUkE?M`)2#uTaJ~i+1?C$3V)8= zxP;GXl=5X9>`aUY1cxNhbws4q4tC2@VrOYvuk9j*bb5iotg$+-GkDS$o|iUI`;RKi zg`?>7`f1OvtLD#nTN|0tz&5`xKFPkkTJnSTGt+PbAn$M#friw&DH=s{o`gMakaJ3yq3XHw}BX#?2i!5)ist8lAtA0)d$K~4Y(D3z(0|TgWGh);`zIfN z2zmO`zr>j-zwg4tk@2dv_UG=oxq5>IxUv_+>LLH(i-?V9NOa9V({ETx<0r&R==z6# zZST!Mb`@v{MAr{7Wl0A>PMm1#%_lHDa$Dusdl8+{L`O<5ue`GgH!oXF>Qcsnvt9p_ zMzs((_*`!t@TL|M@;=K7UlnIHSnCLJ;FI8Qyg{0`Z&A)gK}?L5Uua^s9FMv=S#kYU zg7$kyS5v1>%VwlZ;G3w6DGQdY_F{&q$wz~5?0Xo}1+ znpKczvwlb+w1;-af69Arap$`8aEnO7p-~_?HcCy)ul`rc zD6#2-77MT^OSyfK?t{cmry?+3Mf!}pNoO`Ty1OT#>{D)-*git_AT|5O(Tuj)lLN*| z%Er!~Krl zFf{+jhJw$&5K1c)>q{Vm{gP*FIlhWHy+-=qR)23FD}?R+3X_RQ{T)_Td(Wsnc}Qrh z#^VDSQUFk*r?=n62*iv$Zq(a-z~5*~=9=!bF?7Q}f;0YOWpfx=6tim^oZm@;#*xIe zN#aY^lBjuaBEeQ~Gsc6mb7Q`QF1GcRvEDV^u=snbUkmDK>eA*XP;u2)8S9PB!*Y^N zpWmb2C>sU1{VzSHX=HvfFZR98-AL5bw6%W6M!BJ3rjy5|fHrz}NZ_yL@Hg$c?5ZJf zIED9SZL=ruI_v!zjF2)vapWk9QKFQrU21Ga9E#i{w@Fmqo5=nV$(+cEm zv1E>P$H;*CNdm)n!_jIiw`Jxl*M@ej@p6szR2T3JCwFXBQcp}995_e}!wL#-FN<~H zj48wWV>Lwm{KwxD;&K>k|41vRK_lqAUhR+ENh6JWqEeU=qJ|wHH7wjBW7*tTAEzW1 zb07_WC$T2biKYu=R78J#k9Mt|n_UZaWxpE!cSs`W7P3!ky}98(1Y|)sa(vPFyYP#V z+{zrD5H-qwEdQ2r)5=vu7p%2Ld3b5M+-M7-I#-+hn-J?@+`OC3Rn>5~m=$7Z%=z<@ z@KL}B)8oMRmey(;BJS_q@SvZ&l761G9_|6n{UaV-EOkmI4drQ$4D^bq$`O>TdeC?S zyUVqnQyhxWX9?X_mj#1|?Z%^N*laFLy_uJOOf>}1Y#9sFP_KU*j%u`B$>*{(7zeZu zGGDNX)3S*OC~Eu(0Ks&ePPU>Ck5kOi{u;$F4HUSY=)^gNdgd5~I48B?qB@_#0G6+J$Z(GF*vI%(?XUnNBMoK%1_*Sj30g7( z^y(_f)7BL#O7;MC-vDJHamsi)eg1KSR!d`;_B~vnXxQW1!+!ts%FJuYV}s2~kdT-^ z7~E$nQRun9-AOCh=pfy{`msvbYvg7O%I?4Ip3hjV)@5MFsbQ;J#;tlVWlm4A#jl9u zX0b7X)POVC`n)Y0BZl#rZ(*|Z{7%DhE_38Cce3i4Ze+<toY}1k7V$=v@B7B8_-@Cj{dMFc@dHpg*9pVE!6lWrp7KH4(ZA^m* zU{D}gY!P}nzT=bHZS-~hqDD1YIIs1+{V*N&YA9% zFNgelgibr}G3=5sBz77MUs6y%mV5!7miDKVu0{Q8hfZG~n-{WuCm}Z_9+|C@y%~YG z)|q|E**R-0_c;_~oM0+%F>A zN9g*jOMtU=$G%l;EfVO*Rk#Qy?O#*ahRJNbSlLD0{4KG8}!D?zLimA1CZ zsal@CYQisOLd-B4betFXyW_w%gKT> zX)JO+ot6pLjJ;%9Uym~U*vbQrm|X(M^{;j ziO*~t`|$?i{20!b8K|>})iZubB|!G1Hy&7$m>-Fr+lApuG>rs*i;5w0(_<-4@9JaT zQ{EX%``w|-HJmQf9X*{vbz54{zCh5 zAH#tym@MEBFyIG>b{d?Z>ZzczizREQ()smAV}gKZzYwG0=EChZUmQ}$Ovbkm5T{*{ z*%|cLuze$;n6s5+;_B2x*9(!%_F%SAh;YWreB+lMb5@-kKeGs7xku5D-)<>C)(~EO zj|DKo{dcq|MoDunE-rTVMlgY6f>El(yHw^?NlGNkAG?2jU6q{RIJv5Ri}ilb=RvM^ zi|oRYz-moVXLZ%5S>Cs_hMoKRFR7&HzQc~j*$Kkc5sf~xciz9$9|>~^SEJUa)oZL8 zO7#!-x~0z8PoMa?uqAV}S_H4qx7%$w$5!JGmyu#%+08v;eOo~HGk>;KNE!>bKb${y z>xLh3&`i^dq2n?hv6#-vm46l)tc>pppmpG+$V<%cldq>)Q!n-S8l)}R)pd?x{Ds9XL~JvZ9oUrN~~5eP`ui z<^=tjZ^x9Pi)jQ}z40GrTYoMHA(v!^em?vxp~04KG%;R?xnDNdiI~2pWVys=jBR|1 zs)whdSX*q!KzIOJ<%?FulZis{oIkO>aCQMtm1=K2sQb2WrE{PYP9sg#xS|JnGHZ=@ zo2|b3=8DlH>^ost8v^n$xxW?p0TWX=@w$*uDSjdE_h&hS7&a@%s- zG{BQ{N=VpZMdjNa&&fVbKebeA_tdX&BP|+mSV0}}E1TfKzt6Uj^4ydDCaAZ}__!=s z8BKc}ImCGV6+CJs$8~J~wl78Bkta$xz?UxGF?bZ}+2TEQY^jOQZkJtsZeP zs7U+A2X;LN3gJ1d)pCy#OO=HM)7vgW-ewSd)9*j?Fdj;G6Bz|uNYH%NKhN!f#C#Qf z*ggN1c=8_DDSHsJy&UkVbN~)2kJRG@3>(p!rsQ{|OT9q!@-vRT z{4T`G5>osvQ8)%n?eYIn?|x`iD;#C3PjxuYU+t1{_ijnk)Iup{3;n4>|~jescQRERWo30P@lw451_C$Ky_Z~8s`<%Od1Y_y4V z3U#yF@cg@S-+vGX>iDxY+C8|ml}h%IwmB`fQ4P-=tm6eYUi~Pjfs9w*wpRBF!0U5M z7F`;H0&d;SyI?PW0dqv5Za;j*>Y5Jt?*US>4(rLFc zPh;NNx0 zx_culirzza;C|P3Q!Y45+!-G~sIpTZPnT{(5J6e=<@MIq~KFge|v^-9oTLwQ!t50L#~Aas(kddo5ZmruUw!%Nf! zyS`F420?eI%pz&5@GbNg1M`R|U4mhOPb-z!Wr`&&!&F+jQb9*(xUAZb4K*KaSIeH1 z$drlGF>v2R2YQPmc`$xjjyy1E5WOYPhYOol#pHUif9JX9#WeNVmz!#a%lS31*S&l1<_pPX?p$ehKKTHQ?qL3X7e(il|=sv#ft_zKw3w6#uw zQ*#OWyNs;IJfUsucF7kg>6`UCnZ|=%wa2pvdg@C*sW<`IsvhkI#`qPkHalxSiuEx4 z3xF0*`gyPH_}8Zr*Zb!`b=%X_Q>X9$f;Eia18s#o>-eboNFiM>5@t3+|NYngA}=Mb z0ca0aQQbN1^WzE-7F$I#xeIeH2=YfSx1NMJ+4{X#!+sdmQb|r^v5f?5QWJD|cY?UB zA3T^LPv=@3uHli@VvJVCFZ*&2RGI7J)&BpgNE9j_eHHr2_lLUdc7`&DB!|fgyPH!_ zSN5=yDp{7mf&y6{b%trU?v(&YnR_4ov=y(vjIt?s(y@>uoT7Uq5##}R_ef3a9IQm! zeu|SRN2mXaIK3`|YP@-nt_6RleLv&vygmKpv06I>NjAbd_o=oxx8clawafWSeR4dO z0)67$_qem?jbSQBGNV2zfQlIT6*f(q8&%&#m*Kct2dgog810i1zdMQcl;;Vpney8@ z?U@CeF2?)_UE7AQ4(W0tud@!_!+z~C>7#&BTEbOThn(|sQ?$OPG%f}i0;F3M_41M|JbpX3hpqvv~Ghj~>N?cnY6Csct;lue@0 zA{#85=(+y$OTk-_?*S;Agz?%{(-s&K0rwYx7`V&lV_t<4*8+o*c(~c9 zPS=AECj!w57d& z$ckh;j2mQWBqP2bP#D*G)?JP#Osibg zhl0Rj8NJd-d1i_;Cy%SspLdT%B&528ZVI+d{u_ccH@sh!zke}t?=nh2tCXvBD)9nF zrbw|zD)dU{9pGgTzPDFM7Z_*$;(?ej#IoE`mz|E}5G_RRYR*vqp9!g8`oQjirV?cA619EL=cXYeI5+V0@*Wp<6%aZl%V3XE=y>soEk_=#jsRb<#!lc zJ>ytTY#jWOP6i$Z*}zP(Dzp5hPRV|Dr#n(B+5C)IQ79J04p*HzFm&cJDt`R+?)qpc`OHx8^0LFwCdTOA zcjXvPL|S$dTdlJA&QdI$Yhv+rG_( z#^*-d2b0N*tDQQt^N~jmZ8OcPPDisR;3B#9qLlxSs<(`aqwC(h?}Pve?(XjH8r)qP zX&|^;<9_4PxH|!YyE`Pf6WqOVZQL2&ng27-y!EA4ovO80o$@++U)RsGr0;e{eRTdp z@!j9RTJ(&aP#Xo8qLV}T*xG8N88Hb5XuebLxXjy(-u2X2^8V-h-J~6>`@+_4F0kv~ zc&0P55`QJgLD*-y&Oo20QqaHTb8604)~RqCzZsE~`)sPBy5~RAWlkkeVlqLEW{eYK+ zwxa#Wfx&8o&uY3s*%Mo#v!NoKM`!lgpyWkRO&a0(+lHdeJNdfLec{j|AfwBo)Be>b zq_Pn*o~*rsS|qy646ky@M1|C4Sb`_@2xu-R5%9@Cs!O%H}=&|Sih&+{FBRu$_=_asn6#kWlr_HGRIOR(A3X5go+&kF$33U6CS(> zYyp}Q7+jOBM~Siq*N6gyDAUydBe?OU2abg~;gpMt-B$0Nf`&`6o{LhnmS{L)pXm-u z54{^A1;ysUaqFB^<(L(YALB@slVwgR42<|Cnr2`T#iC4myrmv^Ex}6T{lSZbd5oc6 z7`nU_umI_jq5d;|khOkCq`E)u2L0%oF}G9MJ-0d0{&f8-8ILg2aQTSa;X-*5hVpEq z8lwBg*Ma$2Tvl3r!+8O)t$Tytk7{RE$`rt;hXtCi1F|Xa=E2)O`-|r`$;PKoCPp1P zY^^&dF-Kr zai=Ae?PL0j9{Y{sAHP+WIOty;^3Yr;yyMztSIE$i1S1mUxr{g9{lA zt3@>?{8MxV>u_FI-O-vG&~ZUA+Z7C-sE*b{k&|iXc29QY3u-YCabiv8hjDJs*Rwv{ z+(F0Pp5+^R*1(yxEAxt_*n3=6k@n=pXPyirZS5uk3n7$)Y%~{d@=^1ETX@@tkVSrVcPJro?g6|0bsaQS_Z`PrEhJ-kdU~f0+`SwHafGOKZ8^9wkf4yh)?x&DGH$ zk9m=pZrPY3FRfLj>CVr3+Tts>h@o^O(g%jP6)tZM!`xy{hh$K2m+9QGh*dlBU;!)B z6=Sba#$yHPLvk3UUp|!{tdX=b)9&Kv?dmwea?tEMpN}NblQVWkA9J)+$orwRF#COT z3vqbC)~EEWW>ht2ch-%c}1^GZLlSMU)GS+y;a`(-;gkiYF-|>MDDo!~jv&@|4qs)UT42*6h zIEI3UM~(hBM~QXFHPm??Gs|i~H&US?!XCpJ#FL1|iqu-zfKg2s8Tpl(=1+8Z9$FDd zfgeN<7ySfqt7$EDf_5hTCCHZiRCl|IPeM@H&!Fe#@Zeo+#h_Y?fk9Mh<{g}cdhQMr zO&yE-N9{0LJRPAg5sOgS(-lLSJYp~HVF%Jr{jDp3sE?j)Kneqg`6^QyToTu^DtHtbhe9h)^;e4zA%|aWO-6sr)77)KbXZs1hRv>izj_G?~N&^ulOe+(jE75je#<^pF9nsAoo^=%Evn1HbJL zCf&GBU2g5L)qoYwaB7A+ENFZ8NLf5lj=k7NC7Y6iN75IH@0;e6MowKJsyvC#>`dyDx=Cb!jg`ofJv}U{047bJyO1Iuvyu( z-wN6MBHkB=j?-)Sh0%*Q zB?&tTt$_Zzjj9bvfX^G@j~yeYG5nCKWjW<@0Kvmdf(+Pout>I~AA?lc>DM=06-RPc zqGWqWc!qYBS{dC33>$-sqsFE-3Y0)L8mg9xs8GO{8tu`Uh$1_itQtT$2WcgoD}A z+8EzDmSkvnge^QPxj#fJ19Mj{ak09E!JYdNC|8#dGW7Mizy<5b0~f(qFlDuBf9R~i zf12W5CP9fHG;VXpPN$NhIYsqsl2#$Q)*{wCULcZLx{M^p@%cX}aY91pNiZ`>D2 zDX!`AfuA7*)K@!FA+7R^u@1eK%VRSNNQLW~ zpi`eeTT++T+X$msC~UlvgqMOXr;066lHvB-{!kAa9tV5?hNa0v?r zC0Chm(nCkLgyI#mQj@xrl~zN6-$chyL>Z%&*qh_!(3iH+tcSM-9v#BTU-p3j;&=GG zm%v=Y%1XTX!EVXDO|!o4!pcpLkn~p1J?_HO!BGPUG^Ag$Aapn3HB;8~$p=m=%x@Si zY~1?u(M)L=$M^nsEcBM6rDk^YSY393VvFIqNXT<<#=_r| zM#s%WJW~sD@fmir(M8B3i~wk2YjCZUKaG6vjU4*O$pVggT`R%PSZk>C8!_7Tw)@-` zx7HYXHiDD1Ne7SMuEqkLTkTcvRccnHGdEIGwt@Gq6)_T6m3|k1`fk)SW7Agsoby=# zJ@-g4^<}yJT)5f8@)72G?fUND-v%1`^r2rX3i%>GZO?`0ltOOX>(O6)NOS*D>w+Ye z6mV@hCOPCi554o%`sTB!3j5d-^8fL4WX$sFpOtegpA(Ws7tgL>#H2L8Qrh^KUax+Z zYzEu*?>iI#A(Pp;a4GVy7m?1`DLudQBXsnPe1~%mJ+n&RkOQFv^+eQ^mQsN>_>hra zVA*un8M~(Dn@qxHqn)6uJe2g$Hu^A&i+Oc(q*L2~O(DQ&5V_lwD1X)T;!u%($Wmvc3KE* z_I)R*2jbmu^zR*Pws);YXBU4&g#CzE`ae_WH++fnOZ}SE|B5Fx-*n9afd3Ige9Yg` z%gO#9ghO0>9rXX#fch9fKO9ie;PwBMOd~E|&lq7qK*M^$g_N}u*I>hI zj6zdQvNE<;0(E2_B@RIg0722hSw){U3V>12rTA4l{g&LAES`FY2_A=V+MkQvM>;5c zZ6P0?wyq@7wqCn5|LxT~2IzO8D6Jf~9v5^fL*&kOr;{^@5r6_TCB5Y1$n{B^bmrv} zi!g9@%K1b~ODRoDyH^v;mtQzt+GsXr9_vjW)kGkE4urg{vyl(qnzZS#HalaS+?wQ^ z`J&(v*^fcYxDM^cU_bO4`5veZXRdgU*L##X9!Q9TQ`?b)KZ&NMyQ_jrzw;5?@I^4j z#(@EbD8qlTyTnKU*_>X2KAAbuv7_AoIZGb}(JngE{{?4otm3|jpa{sAR99OrNEu1r zS^b-q#fX26O*O0~u{8VRrG9^4(?I3$_I2E-DT^>|(&=T6m;-lg{B5tI)$Ja~$K!%( zDL(hqS||d+Kgvawr0yM4`=vE*Xi=r%`O>-ZQ`@(zzlAM>b(Xsb?!+P!MGYlwB*tWx z(gBq?V2Z}V-0TB+NrKEp7O^MSx9pWS%2X!q%NU{Y{UkNWR6^KCTB7#V6)E((wch9T z8z`;f`@a>zOYZn5?%5FC0>tHpFBo2KqKMiTJL4G@d?m_pHDECmp@+2iLKS=|>b@Ur zOKJb@`R`oQw09t4+q})-h$y^&9YCks0#Su>hdrz65XpjtRQUJ0EOH3YjWHeDROZN({-iuugq``$-W zsjLiKe}wTde3&k^Hs#PcciHNNq1N2fdTvT@NdKtK4H0Rb#I#3yoN32|o(j;i3ajfu zObypm_iyivBi!JGQSV=W?`N@a*{g-?ukO3-y-B1pt%?U`R+Slby6*6 ze=rXdvQI_idwu;_(ltW(1j3+B4hVejorf48%6*>*Q9AHGykhp!($SIEzP(J$!`1y7p;)D)Ubi4 zOh{-Xi8f2NRk2f;{WHGB)lRQ+u`Lb@`v&#=UWJ8CuoGH1&meZEu(E1O_< zMJLwcA6%Br9K_t=kiV!fUGaxPvcs?jpjVX=A7^I3DA_V%Hb_BJF^DsigHbVHrtip8 zI6bQE#JPiZ7?RGT;QSKyfDWer)bn}%5waVIb%SI)lyGeVFViNic78>qR~InKY29zE zxTAy4dhT*I%B+rEqY^m&squ6rbd3ak{P9I&A+v;GQPQ8%8b@3|%FF8t;syRN zR$K*bFu`_eUWm75DT!wjcFGJS2R zcyj^=TmT6T%9PpFXQuO$oP3YZKV9S%B7H@G@ucZE42pN1p%DTtVWcf2TU%xD5XRIL z(~7hP>jRQpotfFvw{W~F8eQQBh2f~MC$*B%=jcjVnZXDU367YRB$jbPf=Sd{3Vl?> zAs$AeVgaa1i{^jcZ~b6;wTF<+ti*mZRi7tyuc-v&2K4E=&aa5HR3D5x8BH#9c6O?a zkc+=Z$%D)Hp~5n(`S@Jd@F$lR+!3+wrlf50dZ_EqZ~vaowJ)^6UFIGigFKkkf> z^POU&CD+!c?ge-7*jmZqwnLOm5~pdsgHamN7p>f^D(h2#!G;&#)lCxle)4svr`?7; z$dt69<>dw)H4*8xM{H#)S?TrW^-Jngi=Wrbeuc59(Hss8GfUg&xRDa!su0Qu4(1Dw z?5C>WtI^Kp{f3CLLty3+-fSCh%z@(WOh!0pfAmrT0)|cMU*3FBc?Jf$B|lW9xJg(@ z7L0moUm>duyN=PQWMgYZ@1_?_|1{FQiM)ALcXYHBZXcebSW6Kg{r=7lW&Ihkq*O}A z5ak*n>)~X{k~tYW6H&8Ddu5PhSb5s{eMsUf(<!#8}2%!W|LF8L%JU10|Ame_oL3F5=^w zU~_fjDWMB?0Eit9puL-MVLbqBY}fW64uML zEY&8@4wn0CO##68cM1Z|%BHr;&DNYCkXn(x;7k=j^o5w)#{At!6^D!gEI61boWQq= zSBq>n(q%w^PzQW0@u_~N|3&uhfrgnQmzjikCd9175&$RcGi8Q0^Edo&M{90pvbM5z zq;l0uO2OahQ6ye{mk)_ywZFtH!jQo(j8>26uhw7D6Ywgv*Gtw~5dh?WwFw%cwzS`# zbuEc5AZ~le&!HX#0=$g8<`Q4g zrs>{(#j?gdb>QbvCw8QF7MOIe`la_-vR1eaO~e`$ZKxV0Y^r*E#WFUerTQ1W;JkGE zps;r6cW2HZq2K-rMQ`m1OlM?ATGs3jR?1Og@%T*a z(%r2n_Ajq-PuW?4<=tW$9Rk+dnWA#f?>pwSrJv50-+!M?xMM5i;k8W_P%zET!}9U})4{A@xIX4HuDXPY z-v!&YT*K-+Lma@yQ+DCf6l0#q7&dQCY;q?ks)9CVc&_YmFF7l*3&?(f9+MRvgis&F zh~9oeV@`o&iHa-D%khmIn)nOsG8^Rpt3zW*K`oR&rI{SqDj!cxy=S)JZXDRE9O*Oz z&`eA;A~$PJDCheX*_xW^Kwa@O`=+=2c^)H0T~bk*pL%bwVN@aIL_2+@PZ}YLQ5Ms| zTP?7^7-w_8=alvZH$^kvD8EG3F|4boY^S2&*T2F?x9H3CfSFEZ^HPf?o=Q@FLV1}iws#>g3Q*4Nievl zsj8zcr`7~tg_Our-Q06zgRauzVd_aKBhBq@;)+QNH}A1!<@?R2AgZk5AHja_ioLU@)UWYUlAI|TTt{mlCy%Jk;j-kp zg-2Z!@Mdc;(;ats-7`=uEVhm8&0{l0J$s&47&4UE^3!2)Bsl{ZMX{jT;IAO<>og3x z8cQ}G#LS}(S#czT4r7Gf=KU_-#clJngXs$w9bd*uc=v||Um;PLHYoY@{3|_Hc6M#O z(245v;X(4gg??keD889{)Lv+P@|`GWp(9mg%W2j0rhe0HjJk?Js9(-8X8w{`*HppC zY5~naAhG$my|GsoZEbv71#G|i4Co}v5WS!%2_+N3&KW33^187)4zu_A_O9<8no~DW z38vfGaKaVI4hY+$PXVGc9~D~eKJrY(ej?`)$H$uSaKMUrxv`7pv{W_F7twReaH}h_ z6Hb-dO(j{Pvb_4+;tW)oz{R!}5hmzJaOO_USI`J`V%h=a!rBKpxDBP^T1?+g$VMS! z+jXT+9_t7PpDbNhNA#7?Axv)2_0tX~*gjWtoQR{RRsV8oT?&k4F(2Q^6%Rto+#|5< z9Y@S)0dxb!>v=XNnrrEz=D5oaDcO zQA^Nq_9J_$!e+y(ujaNtC(a@+;j78MZ;*$WSzP}1aLz{GCS^unL~id&$<0k1=q4hR z4iQB2q7O43!yI9xGo23n0_^Lolb5xetRuQ=^d=I@VUwi2Tzg|eAyuMTA4}P<#>vK5 z^m}q5FWb=-y4^$0yhZpiAJkB(1ej^~Drm`Ep_0n^vpKAd0y!!4a!P)9KSpC9+Sa6T z;th1fU)}0GJw9Jr-(tX8tbwdgRPLrv96`TVhkT^ya56f_;_#(IPi^WX{Bhy;@fp12 zN=Zc*A#o@k>2wL^TP_LT((=~n*7ulyj6Qb>wP9p^ud|A0RF|ax9)Mu_$L3`Z8>d2; zI}ETn5ouS6IX^<=|JZJ zrz;*2ieR+k2f;*NZ$wK@B%;;MT%uJnaiNMUSy)>D)8JTB{8~JDV~z3D3aTNw3RiTM z&E0n3Iro5s=vX$Zwlic6yVI7tPw90_{ZA@(Ufr%NmRg#!8qosy&%`TTl*ss6%>w8K zNW`5Lvg@QD{sV`yzT@kZghYeVF2CnYnC6dAJlxwP#9(#g_$zHL-i8vk(u6?cpqg0%r@n~g z?c^BM2H#LyffGrOX!N|%xW#?`EK#>p&QG`)=NVeggV*~AhUR=O5!k%_7-yE~t@XGx zr=3$Rpe;}D?D^eBP~R9X8s8D2A;Bv6?o9A+odo=gVh$raqb1b9i;@WQZrXSJOS#Cu zhRf}GklXcaKHo(35;Pmnbq8>^)0Iy*uqmaFx87>~SFGm+htA`~CwY$8TASBTAf&fB zl=jyOP;WkUwu^6c%_fmdILUp&>nn_11O8H_5pC|$i-Y0n z0Zv_KGGfLwd64{C8S%>nF<3)QcclF6dEU_89LeP3ZlbNm2j1-^zN=IaNJLzUeHz!1 zLOY^(@N3 z&O05W`B}}1oO9-7Z-&?9*F-Ui-ziefVkCmuUq3%>2Ek=>Fv7PbDIXa3IZ>MutMNCc zLq|^dz4B?NE#&W{oP?b_|DCc!<9)*}Iuw{otR4=Be`GhV#sVB}DaiLQiqX%roiC`= z1D%3d)a-}y>@Nn>iwA3{?|B}eKQeY^KoppX)9Kc8xzUF9S;n+iK{NW*H>y^lY+53M z3*V3nbl3Gn_0!+b_Aq~eHkK=R6Lx!n z4BZ@Pnj=5mT2B_xhS&097WDYURGS*%#1u=<_qPV+)*~dSR}XXzxYuzTLK? z{tVpXmlk~?nC}566QvJ1fJuawM#dmPR^tn_ik-AmQBISGHq#yY|I7+_?Ec`9Wbq1d zCe1C@N^8agVTqN_?a)UbKeM?j`Ak>iM3V|dX_~6?mTC5wFd*yauP32g{{9iF-7Ib^o zF~QdF9%W81H8osTb#}w?yXBUlij4GQ+s{hxs`PTYU@`1jRz^#_HYX4tR7Bj)Gk58GDT^)0f81`WPlv8?`|lkn%ub^MW3^%`+v~<;Ri6>PtPa0ShjbI07hRqV-Gjuq z8c|6_=#E>zqBo1vU-({f+Z#Sa(-K1JtdgLDx}yopNZ!}~1fL&CCH+u9$rCAR2PAks zV4eru5fZqc#0)i2-(+02IVl~~!9UkAtw?q5l6P|0{bLD^d2`H9=GKY{^_?tP{#)5R z^Owoo=3Rt}kGsI~S#^V8K3rjkT|if}9#S#zz-yy0^0tWIb;$+EE;j0sxwK&&g{}DN z?VeK_b~h4Ctc!Uj`TnM)^Rm^&Bx3aaEOSQ~bW>oRr9FrAaJ}yzK+6vsS}vEIDE+5< z!_{HoE910|1`WKb#j*M^O3spl9&dD5lXy8mMHIY}L3x#666s8SH5Kru!!#nRt1FVe zZP$v?ZO$H}AArhbcJvU&6hQVxCCR!^BFA9aT_EcaeB{Y{g{`aCs;{p;yZnG>3#*fq zq&GM+4swtzy1Z+)nvBrn=#b5L9n2PxpQ;H0!{0XX6Jd&*%`W>6Ho8bqGJJ};@){lm z=Q~hG>-eTbW=WOVly2FT@#h4^d@eCJu&f@!i5mU9R&Iyyrl%E88Z)^ElrLkTv&%WX z1QeP}GxEal*54c#sJRJ83maNPANfMsjMp0SyV6oIbqBqU6z0_%Lw3EePx*<4vh+=4 z=d;wX()ze<32o9@D#mXL$1_b&`53lKFMICeM|zYc)Vx`s-h!DK0{V`)y9fl8lGFew zrH8OjBEunYk?t$-#OLSO$blYE#Lzz%4=h9+MGe+c%OIFCfR9;J!c2)RWevdDldqmE zuK7kGj3h4}bwVGU15SBn8QpDc%?~Bq@ibL{gUip`#jJ-ST=wD-?s4YTdCZRYo?3Wo zN1Q})$oDv)ns|$o`B=(~HoS8Iecee(915^s(hBHj-esR~S>*Lkqx3$cy;~LJWp; z0evLG3HS+UZ5Ap=Fdcm*&c^pT-Iqc~D19*WN+@@IR@mPw`j(bfXYZjIH%BX(KjKz< zysa4JOQ-#r?5_dr=Offe>2FkTdjo5ys{3wU|OG$+1qaG8~2UA>?WU#o`#@% zk#xyE0p!E!{BAw#n)gGuQy=AD0exuaUY-;@@I7WNf9bW7aj|z#(eEfbJkByubrPp@ zJV-ATf(QH3`L+A9RkW|~p7k?2w=@Joz;I8(_R~5#E`HZ`%8y9KCPVFwr+%acqwegE z_fuK08IdyP=uh!ht&N4R@#vnvvdP3-7opCBJr0bSO{FSN&2dV`3;E`G`L1P4Lu+o& zy0!XK&lk!co(&E{@3Jy(pLjxPB=XGd@|qtyT7Q^ZGuLo*pu8GIU+*eP^7fU?|;Vel%bdEhtYCZugc&zaHux~`*|myvW)WPJVBc(1sfDWz|*;W#L$FJ-Ld9Lar@&*aM&0;i<%OSSI7k>Z>>6yop&+G=@tnd zl>{T`1x+RvsAeN8D=;2wd;U_B6eecs4SgicD}B2zppcDHk-RWUn z+aZno)bg`SWL9&622D*rzvT_xM1>=us@x-+iX-0+p+mOV+$17F- zRcWnoawX^=LWL*I4u=v_U-m|<$Rb5@9jSTE%;O#!%f02&+q7V0v4w@`BclG9fgDMc7r+)U!>pRW$7*-zn%{jaYQIlX+A$0(@DP|N2Ru>->^s78l#K$LppG%lm%o2&Q zGWv41XB49DyVyFf-s6LzCc7^IYhOy?z!ZcZTd-x(?*dxQDw53W9VsEKVQhJ3th zKJ3>iX-5W&xi1uI%>ZyM1&?cylv(mJhMkQS{oc=%D$2#XPVrrGM~;__MXx(3`-2vw zylZpxWlo@q-GeGZDBItSl~pNcG#Ph8Y<1sX&wDL*5ZgS}mH3(~DbFvrOvA|J7<^yo z>X*IV9rA@!1*KANaz=v!GE8lU%c}VbF9Nw`|1_TSh#{Qyc-_CVitQg&dh^*a6RvHW z@yf-$8+uYpM-Xi#Pfy?0g|?t|TsHk;SlsjQWhFhP-wa=gYSy$`BbRUj-m$YE%&K_s zW#VXIDF;Cc>R1obGzM}DF&P!y`HFW^$DDC?W11!C2u_6;j zfx4eT717~=&TuS-r8k2&P?cOSd&mI`L`f6s#mj|MzWX~uIS?p7I2AdLFqtDqE{^4! z62(@vP%+c2!uH&<@w=t0?oJyaR6S>ST(`{Ei6RaHBtAcneQ4E(s=ClxI7S}WsH4>6 z((PxspNk*bgj#iUk+ny9(u1zR{29RUKuoo4r^{azpVPlY)`*o-6+A?aH zw~&G&YDMRY+F-do0&F&5)Q0zT!0BOLjM8zbQ?*z1TGG08T90iif;Ft3Ja(C!WF%uC z*W#jaV3m&!tqwf-CU?xl)H8240F1y0VAa@v!}Nq(EP(tqOpYr=;0N%aA8ck2P=7m} z3vGDH3iWM&5qzof9b#{wX}obaSy^?wo<5CBe;+UzL=3D--`8{`0?6n#{OoMR2zR(h z^t5S1quwFLxG(FBLl$t`I$m&-jx(!!6Q_`XyZNK;ljEt;cPA~LDxjg1M1ySo*B{BT z=bgO4a>{i36!&YHMWW4yosb{H-SyK>0}U>phY6|k-Go!bvUsu_)7dg8eL=VbV=MK~ zvTUKgU3TJKN(i^TTueMp=k59P_?s0EVo#>TBHQdD2WDzB&klY@VI!>MtkkQoUH?)% zK>g3k2YK;!u=}ZfLLZZ0Cb4CMJ*@4=cKD6GJ}J2Vgep_9nPNbgp@E#v1(DHZ7LcE8 zEuT)Hz&OuU$UyTcCtSVzNJ%8J&O%Z~H0fkr4&X+%uX2!+C+WGK%c!}7x#UZE|s;d>90u(@A*Ip$%F>EuH|2i4G8Mt!h>8XKnH!`<41 zO#985dVleh@o(Rw$kPy;#jd~GtcM32KG;FEujkH+jo4DY6Qc$~;n1T46F`)!aU zIVDvs-S*UcO27+eOxoaZp@iF#$6kG%t-nr~Cj5CwB*JooU2?t{LZiGz8I391j*(;0cdS);Q34l?x{aFldmntlH9IKl9#I0 z5N^>|6CQq7G@~h*9XpyAj;^l8d6>KGuc`d^6om*c->ORpMX|07-5q zQLUX@pTq&=M8bE$bRMq7NqNXhgkA}G*<)qD5NsB&e|&fGs4t9pdv1abX*`IUU2Up8 zT>KqR3R$vKrnSMFA4&@|MESA=sJY>CwZ{K$UTor^A+DL5`^Mb)?bf3x$Awz38h2-% zEd3yh0ge&}$$sZ|_ZUA!bA_Wk3-?xvV6NgQ(kFpE7h8GKwT8#MK%^%gM%RK1$|hs! zC}V(1_*qI|(X~NyR%m!ESI?xwfY_47a7^OBYU*#Sh#57+iKYw>5a5yNx$;+ZEl`6O z;cu31Ql^1?i}EKf_ht&kUnLbEbU=9#Xl-F&4Kng^Ya)J%MEhW-^u|IzaD=Q@LusXB z-SBcA+Ssc;_w%vfvt~JV(W%C<3gfh=cWp+)(|w65LiZ9x6GO^aPftxOU%x!Y{8;0>t|%SFiG?$n|YDH$BWoqSQ^?JTxhlH8EPp4oN6nC*Lk|7XuK8JC22^R zRqn!@-U+{6O}(x{JF6NJR%V7GWn)39BLo|xb{n_r;7NX8A6t$;oC`hkG7U8KF)9+z z20q2gbqc)NQef1$Jf50o>mxy+a)l8F+~ByD?5+NdGbY`ZtUH+JZCB1RJ3PL6QXfkd z(~*R)%Jz>@j(3(E#~BAld%lrnF1#SPmTVFgeKgme&F zc(ji<(r$%2cyC{Bc>cEqT<5@<9m~8L4{{|jy6Bda&c|gYTpXZvryhbS<}9;~KfZU6 zdThV<@kk^{pv*3QU4EN4j?Uy*h~D0+psKN}l+t!miw`!eTTjs~`U$%CS zWWXx}o%|PH3%$KLx9hCeT0sd0LoQxdF&SJ?53W$S?HnJ_UBywQ04RYq?QE+q4QHmw zpFFR#Co58ec8iYWZ*I{w^zivhRYl699PL7_XbnFm+#)V)0xRmxovCWxNJwnf2<4ll z*9#{3Ox)>i#gu4Y-Rt*C)+)=#^RM;Qr#oj8%S?tZI7)hrGA^ztj`rQ-%}tD@i|^8jHG96m&hBq~ zyCVb~11&twB{zHAjmbvr>BM(gb@56&BPK64e(XgTKa@Q-g!s==rVCe4Hw9FJFYu__ z${Jtz@*)7onLw%l1V8H8#UWMN->`nxpJ?leA5Oc=r!soPok{F1X=~5+q+6Eb-gQ}| z2CkMfCys~Ri)!t3dvJ&|d44Nlg<)gseGHN>`Q0#i4Gh>gKGtBDB8+}UKg;5ROy|GO zp+5w`@>@q9V`VSg8G5#7KE=CIQ@x63?icDKp6<4pHZr+&Z{l`b+R|BUy9lBJD%+I_hFT;E~;ZP!U z_kYtW_$+?^nOs6pkyGXH~KfH zp&?T_ba@1Vld+9`T5)GrLKVq|onp1i(%VRRG{b{Hq=yM9+|E&3|LXhrHIAp{S8e~l zh4dumQn0-}lsxh~DF=z^h9OlAs3ep8(KfuefpI=C)*O=?#U17qN3noQgf_i zYbOlkh~7@$Q(&}LDH(T$Pz?5`T$UX_2?(Ns{8hs+3*ErRI=rAC{{jliF*jnpq(381 z9{|G3m@t)yku>*!drk!Ngp3Upy#;wSyHxOwrjvhy>d0^$l+rNrvs zt&~WeR!NigajIVltGXtzAoHKMc054$&e73yJ3cDPvAF=~p55h~fPVP>+Z%&e^`e#& z<=A)Pi}DqD6<=@sja>Jo7ah(ub|i0RHC+K4ul2pA;~qGeNbAsk+#@#5mY-V4Lz|tg zG1c`!rNGkb!ZO5np_6+ei|hQPf*;HPL}gnA1@axDet&9M@d(Bj9QNv^M1~95+Bn`g zloQtewY;n=RnUPBZy_gX?p42nhTMUS;m$I7m78UIo2tYOWq4lr+-6$N8K-q8Yd zQQIW1SjFju?mrUc)utsQ%yjA{)#}~~QtUPiib^B_a9TcJ-|w26=a9c`b>|Y#m(@}w zz9aa6z<56Vk#mU%g{9g7#lfQCM_p`hT?1&OmfBoMnxXBIAYKhk^}&TcT7KX2L_H6> zUZ5ANzt1}PG5)q(nIOR;in-JM-GkRlhh_RBx5Z>a&oLrY;b9K(2`p_&&2f z6QnArKyvB4ZQRr0@&_{#au5-%1UU?4q_VWA0K>g5wDPQg&I2h{j3U8vSdWOnsa&2^)w>?XJ`B-hE#*7LI*{5f7pS39-YcvXGlQhaSa9cNtB7u@wvQ zKU-sr5R2p2KD`^pkKvR2Cxi!r6!^_r%)!DTG9@MDNn=0g#q>(MkR{(n2te6er-{q+ zT$m2NuGlfVMO1LI<$_~K_DUMyo?v3CV@o4N`cIg5rU3asJ)PzFJg2}jLHByw0~D0J zPWhtc3+%lpJl2Dq$ObIyiO>j^gSq?<5g)-@JRNTf7n;ZUmk#$c^fcLp%CW>i=|?EpN*VNv=EXoD3&fe5CIHf)FgN;$_w`XbX5Se4jo|Rfj32+QglHd<-zMyQ-2`_4j z`PzqIJ5ckWUo^!negnvHw6zT$nCSTX!@O#5YbB-ssPilGEo3FE=F#rjYg`J*#8g$Q z)mN_#_+NB=WmH_vwrvs;2<~pd-Q9yb1b26LZ6v|n-QA&am*DR1p>cN_=aKWyJ?Fb` zjQ6j9^r&67Yp*ruT(h8ASy+B3D*K6jj&VFh3I-M#ku|ar%c*Q>L3gPpHF+*4J~1at zV@m&fdR}4R^f#(DJAkgX>ftbz6FZN%Qz=HesRJ2c%xSOnc>zKeJI)Pc zB+?i+Jpr$nJ{Z}#1XHS)8`9LbHTxq(TfDagW_c4n=<1fU-S7Ah5zeP4_Us~q#j_=~ zy=}Z7(I4cYM&c%FEN5*e^jd^Wwc)1wUFV?fyT@kYP_-6+fD|DR0pXkV&ozFvcoo!V zl{+(k{=I~8S|2;G*Y89Q_ti23^Q+qN zoV3KH;-cyf+OC~XdkE zN}6|@UQDhf{o;=9vzHo9P97YFZ-3v?zc1o5_Ul28oahsdb7ELGI}VYIoupC?-5tJA z`fP)SO*`KSr_;{2GXwYuyOC+aU;R*m?iBpietfv5`@NzERfTgGOQ zflKU4^u({g#WJ1-A@9;{GigOfG)JUaiKYl z&d0|Oe8Gs{NI;CLx2>~Fn}K_$twu>+VF!lNL_3jYso_?dni>iT_Hmp~1NA`6pL*ZD zSKi&<@Wacs!x%^(hTc8c-6)oHqvehq{^#`3`%Q?l1KB|!ZANGvrZ~KqZeUPb%FfaB z15gIfO_!)i=UEvA)A8#jMH-LK5$2lP+ng|EvYmtfck8%t`^}v2=T@!US=g?gY~sB{ zJr`%qLaYjT<3eNd-BW<)es`gMF^2L)?NUMr1ljuLo z@$SF=2=%1}g9a>iQx-oM78zVRrCxqFy$ro5Il-VJT1#BfV2UwUu7L^###!UBgcAn1 z3~UZ(2+@`(@kHdU8DBX{GyVz4l;sL6L{EWs0DkomH9hXvQ*ka|oGUe4S)uuSoq%hs z7G^|tNLql73z#kcQB}@SY%-Y}fx{MO3-3)uOWh5WK@A6i zTV=L<%ZjE3);2_1jFd{0dm3kmgr7eBPY~S@e@CD*aA3}<4rS{t2l>Cd>m%Cu^B|-P z3>=OVPUD%-W&gQG%kEb*d4k=ZNbMt5X!1QvdK(^gF_O>qdYPs>S(?Kml~BvRv~g*t z+_Q63!GW7z;$B|dyQX)nHk;{;#jFcnb)hJj@=~*oC9AFIyO;Y^_O=qUj1+Oe%;Kp+ z{_*2^vL))+-Ay|(kRf^C?(*k`Gx7-zwQ-3tx_Xi9wg}s*#r1y-Do*V*}09NVfo8ARK ze);>xIVR^H2mV zCfVuG>%i85u^g2z)v0m!pk^_>?!a=6uP{}S4fIjb0xSIo$=SarwcTc`v}&Nlfue3& z@{N$N$U)uTa0v34a#I>8w=_!}W2=*{%|J^ z@O`_Jwv>Qf%LpLvUp+ z)A7f+J^oV!mz4B3PVmhdk)lh^-{!(cmXtC@*cF1J);v_RM3}EvXNtbFcR+Fxr+i;i z)#KQ<%v7hvXGy`===^S}e3Q4Nc@a~XEo*}uhhl^J3IpjtL*rMDoC=XNR6u~Y0z$;e zYDlesz5xA~mYpt%P)Zh8JihTpVG1fL2F!=Gxepj*mWkM@%;D4WxsS@N^IxR$Ia#NY z-xcZTzVSUEl+I1J2#8{aud*t?Hk2{3%Hb8PLL#$K_eNNW!`%9TGo?yh zri>(y&O}qIvpd^oBFHQK1L$y&e2un5tW~G7 z9{q&4V-Els)iCDmP^k%W4!TenD-JvxAHzdm9jaj}E>3Q)XX~Qzmgcyvx7D5@BK#EY z8v<&r4QaY#?KoIC&gB=6+0?Z;5$a03n#TK3EM;S-tr>V`X69<=%K=pl#3Ke$0lrWa zCn)RjQAx>(?(X4Nv)L_iESMJiE$US4L$n0V?K49w?hA1VQ}^KD5|#s>_ER4xxK~ul zFCaGnLY-*Hyta>uiu&b5j@hsbcASgkllpUs*Ve`Cc6&F)_2XV{YTf6o=;>xYUPsCGFzg%$-X!Oiose zLIH&vk2ow4sHj)5)R^r}F&S=Fg66n^9-W_~ZL3f!@xCfBy#j_K1t#vRZV!1LysJ!A zQ?%`hnQbZXaia@{>fe;iVU;+Yn8enjcmY9Pw9PmDBygEEf-X;W?JG194`zV9Zg5oUK(zM@7X}~O&nDL*p&8c|4%~2NjR`v<8berlc%0F-dEDh{ z3p#nk=3qpyE(iV#NrJ=cJ=ciH$IG`!r&xt|1N>hjBT@}WHj5=6n;#?v{juY_Mx-B`2h*X>v?N*QGNN#95Z>9x_jzB+sIH7=++TP>$h zh-UsR_8^bO>g!lv-QEM0_&B`WwhHIp#fg&@RA2rH)zY&#S3GMaxN3{toE1JhSwvcI zIj_dO{SwdP;b?Gf8+Sdk)aFf-Y^yv|BKR%2aeTkdW#6G{Tg)`Y5=-wha<%Jc;b7^AXmjuDad=I1M)Lki4tOhxgw|{1PFh4OA#R6;y&EjY+=IY7c1>9u&zXxg6-JqLV3Hq|ygq(l< zY8BMAY!2ObL(MgGyFefsJRgVQd=NKRSI1m6cK&^sl#@`8n;~hO)CC8Q+m<39HL8M5u?zQ8hqbwnr;<_XB1! zJFiS%<#m*Swr_DX^Jm-hb-svWQ|;rr25y5RMXGkf_IeJFJjWc)KJKUe0 zBx~ukHAFx(B=ulAO#dm3qox|H20DVceJIUzW&{O^ZXiLD#% zQ?&S6(0^X(G^A6K0* z%p`qifkEA4#-lZ}-HAl^%0O8fb}*z94Xmy8>(9kbE~2||tm#(xX?C{D=`6#kKL#Su zi=%pcqt~PPbM|udDPueUmLc9QzmGak$Tk{?;5`4ex8Lc1kV4`kzsO~Eeun;Nt#Yd4 z;Ot`Z)-&0h5icm_O7+VIpty?CnZ=tjznCK${$o$RHQEN68_ujV2W(`wjWiXra+Z3+ zi{8CBDQ76}$5b&|z5$wVSfmPF76TISab=v!jN?pLr-D(WqYJn8wn8K05W3k)P8G)9 zMEc(^+$=RY+nz+JEWazgoon+_Tgn&~K2E{=Y)f=wt()#Ay*ZN)V2Ik~Mm;$eu{346 z#SNIvleJlp!5(cQb{MI$D|q9331tCB0$zQB_&KGaKdiQ2S8yhX%oYi@KV2ZXl5WBq zF}>oE6`F_)P?QGd7MHVhtg;PmY^c&%Cr+P_DCdos4PI!nnX5JxQP=yzhCN6HQvRG2 zSz~OGAdU0I+jXh*G(pX;zAlMQp7BNLNX?C&7^v)Y-$Y$tc`OYqOEwG4X*Jyv@2LL3 zkGCFA5=ds9@=B?f&Eaz>wF-tt)!UTz=+?;ccE~!qn~(1}yqMumV=eQyk^77Ym+@UR za_@7BIMY?d;=?Rw`)$UC5~5sd zNnJfxTF!7QPS}{VSl_-<5ObO_gztup!M9cC_DZJs5s&7ss7M$Md~-UOI^xLQ$(d9o zKQ>Tq3PG&KKS?rL1G zg0@X!y9c}nnk6H4(9lq_({dM}1^IQI-{pyOTS;XXRb@QRpv62ve4GWiJxuN)ySzE! zFsgUJj%y!CCACK{+U}$n^Hz?GJw6{zq3adtTFK3F+39Kh`bzmRauu|9FwR%WGgV;w zE-YFaxvndktuhfWk|pfPOBTpOvx-%a?JhB|u5NrkG6ECuflizU9=e3ffoI!A)3Y33 z+iE`-z0)R`rm}2-EFqJ6X~L-kX}~Hk^-Vam;4X z(KH2We+IG~v9xD#Y~;#%+?|g9s0qeScNudxg&R);gIWyuX)~JQiU~bJkqNDhZ}@Bu zSZ_==uoe(11K}6Q)19QXpyv61kl>IvK=Sr0^?E9COyS}>S<#NceP%WPRi4k_tyN!O zaSr8?XMs?TkSMeU>B_Y}I>czi2?MPrZ?LZlo8PZbTvse_GEx_xT1WNCN!scN!6$7P z3`RaY6g;N)A8vO28L2h#BhD>xox+Hzj+LTf(^%}zdicTus1Mk(lCvD0=AJisOps)? z*$DQzrCxI5*XZc+#oo0_WA4bk+7&;9N4&dMfSo>4_O^tBzv&+7dBzmrQx#9eredR6 zt*3~Uc(o9z8N~$3Y|mRvUSF6Yd$rh7`Sf^imCs&aKYr@vZqz@Ko}IFN%b+{nuhr#= zSrkLeksZvcw@_DVIBjro?wJ^&WSH|D?8b3&qQMjC)#)!Lu-OsOVSs&|(qj%qY`c3GCqn4Q>1(dm^wF4usx#3tP} z*E>bAj=?^Gr=4mS2p7e@F~wXd>O`QepYe4xg~_JZE@$8N_!qM8z;auc1KpJIBB@-> z%qOXChck^N@r0JWueXDobs*uYdAwewjebl*_CfzKtwy3QG5_yzt zjR5)U1vs2HVmnzp^RQqM!3WJWJ>`l8D1L%>(>>330~79%5Ased@N5t-b8=~$ejsUR z3ce>Gd&~2it={cka(1(3M?$BS62|po0`hK6EH4}%g7!c0T*BF6byPi z)Uh~s0r^Zd9d0OCV^UMOQlW?4gBBQD4yHmDOe9?)hdr<>+$XUnA_C109rU!=GSX)? zlPp9h7)1KMf2F`*8Og4`ZLl|4n*}=2SH-M_!!Cml<7xF=!u&v_8@>-*St+ccWc#!h zn{)BF7M_-nYJ|%9YFd3N=Q+&w!lEsRy_GeeIP9bg!kJA>RA|Kn-mq4atMs?a=-_;e z>xbtheq7rs8|yJGuLD>>!}|yO$wTGRcj-mL6)&otsIx<*i~f&tP062j3zKeA88Z)A zba&qsDqG`=gx_QD2mvzi zrjlq1BAoq_1_=R@(Xz&HG`$x3HRJ8kBkoS08jF;IbT|Ojy#0of2Rh3{f zM7m@$^)xA{>#i92agL#OSFz=1UZAff^}b0Q$!I#`%cS-D=J zN@qI-lT|koD$#Q@B=`jJzqssYo|s{IK9wZSxHhQWE} zHD%ic^Qo9eS*WY6HF@=m!%s<-x?VcOtB5DL!V9vwH;HjhFy>3mNYg)~f0WK5G6)Xk|h<9;=l!Tr#Ct9e}wBYY>CDk*G?mFkc1X^0Bj zTyL|J>Ybj@r~S7h2?)%y9i$nY69@9i*SEz^>il&y=N)z0F3DImbu~Tn-GY^finWds z!$S&-rKM4ZK6!BW?F8ARGaD&YT|sfr7)coSo~`NHXJT;gAKBFqflj|&ia5^aU1vFC zGteJ>@%b@799SCK!0&x+6!`#E#>>M}uTJtnaF=`P7t{f!+g)rKk4I?TdoLCo8ZGO} z$XP*+<)xBvY6IKAmMS=~E$|{{nTWiD)8C?QFIHV!tT2#*a6G+d5S2jxNSej{^-!|C z*_;Q*3SeDkEg=H&9*t^d&hO-wGSu$pOSWH}P>`ws%uYu0u|3Yc+u4s*$oVfQeR_2b z^slSNe2TD92{XpV)J!jygpKY`^gjWsG@}h>QDxj;*>tm<5#O{D2Vu_z1{RXVnYSa= zxUgUm7V;E`Vcf0CwHPW}64^{W6|6qrnTaG5lk>79K1idly36Yl?gjE+5DD3h2blDv z0i#dEoA$mCxEqkO=z64bELwP+w!9uRa3gmf5_of8tfV|f_+ET5ZGXkVWx)7jZuDzl zCary&#$*4qsRg{H0q5mHaF$?54pN+#wl*;FHaXLryT3 zTPciqEb)`-^rjhb<4;cm*5$KLEp-Px*_T9^sg;qiJ$RofBeM5zE)%UyfV--4OU`lt zn@p)wrYcybczYGsfsZlql3`4LKzi2W;Kg96f#y%QB*Vo(ga)2GP(;miwArmF z_H~-FsN(@AogQP`+KNb|9Gjhez;C%{1=1<9X3d)U4qt55#`Izq$mldM8iCE85iY<; z+~mY$1jYnjuZ&^KWV1)U$z~43l5W=!MDq@J7V1s8jGgLX2iU#tDqhor(;6BHJ#l$XC6BO z1o5&7NA4eNk<8VojRe3G_bUTU$?{&0xl%OhOfR>BVE8kQ>RFPp9GqNMExJDz^v5V|e*e0QUenmn}A z!75>8h`bRZ5^N~sybsdXNek}oh6hN)ugrK|(NsFP)&9D|%LB30xZV&=EvCk0peZ^^ zF`AFf3q~QNDb`*!xHogfWhVwkwm~JCcygBpLhgKm^8?6cxAT2zlVlOeYe{d$|*b8n@-^-rQimM`RGal0Vu6Q5H6=~nc0sHdNiQP5?b^uSnW zdWmE@KY2_1`JEb0yWA|D8ND_$(zh0R*Q^!*0JAYe(y^L-0-Gx*~ok*cn7q9#ElFA(&G2mFmOBQq9-3Rbn`xRtWwD@ z3l>kObGDwN+P;0g+n3~dW+GY8to1!JBF7v)%7j|-xlf=Jp_!kIXjD~g=Hw}(0q$aA zlzNMGiAK-}?4lNC7ehrO9s}ic-p`pce$$&Xk?p`$EF8zC3aQH7LtT0ib#Q;@C$TOt zb}!E6xGCbBPXgJMn)PyTrxK>hEKy-pbzM#O@O0M94D(fZWVX1E^m=Xz%%KQLrE82p zG~zjsp5D3X>L_DgD24&a&+DDO_oaB_7Nn1T{z5rRc*f}()Il)`{ZZFXH8tydiM5-qh~<~UGsdtB zy;7b4B(>+|CG}}W)&Ky&^&XKnli|yQfFIgU+#5ZlOJcph8GUR_Qtq8k350`B6)RgV zT9Xv8wa%RaXAv>q+i06Y`d<$KD|j}OxDkp@;X*-VjuV6x3Q!MtLstzTkb=Vi9kg>6*wr6=7fo1&7KeqZWhx#Cy@GFx{ z$p1B|RrnBJEon_nM%$;8@a4>?=shKP{|x^Rx9$TY8Z%l&^|vd3+1DKe;x8@#{w?A- z7y}C-`EL@Q)D4Yl=zpXHaXcaa)J6PPWbywr5d1@xAkk0z|F$hc+~P0sz7qdtdDn;% z=F1De{a0=A?Z3Sub%U`G{_j5p3x>n~(A9MUht0=@F4%$#o%`a>^~0^+{uyq z&mbpqW7&89MK%BBR5E+N+5B^4_5V3dTRj^1r5Am_C!?KLbG2li$y&+@Nk262X2I8LF>Wp-;Cjn}(b37$r$RC^^V_36!XoW}OSgfCU^HzV`F+T( z_UikJRy|cknZSjVR!g6f=cnyB!Wy~A-nUMsqV37tMJkW#49Cl-eMO1C`{a#qN&@%F zmoRa96}qOTdt?R1$_m%orow{z-XV(oB{;B!Ke{}M+-$#+9`(k-l+EzeIH$GAk zx^L`ofdia)kz=ea&sg4jOh+1&9#fFGmvwNbJy9i!vkL#(X|H&YEsFbHh>@u+kNTe; zyF?sai5A(te?P!yPq$p_=gAz2WD`#Q(rH_+Gvg?xr@+Q9S4ctYo;U?aQZwG|CYttF zn;p{=qeNUW-mN*fp0D?w=|D*`1(wpt?O&W_YDbKs10adz@l98|!<83*2i4+5ovn@> z;vOFPy!+``ue%00niLa3GPl;2VaE;DV4m1HFqRkPk7~YCFv>d z&W-n{CFc2fKxoS#p}pOflNFDkl6tMUsUInF%8jl4)A(l1NU>$D`yx8}=UIFw%N@}} ztZa}?`Qy6>cQ)D~BNPmWpJK5^MY5L%J9{zb2qr-F$0r*t(S4sfByyY)PB&zg<**&h zz;#aN1~XyhkKM9ZQlTNEY8*g<<;h(usy}~n&Q>*4ki0D!co4I4)lUl%K)1WF_l^^s z*2;v18NBV`9e}`WeDPt*who#$30{U>jRFib$E_&@wu~c3hQ~3cyOb=oRw}0PF}fNw z-*I?uKOX*}MZ!rl=eFIK&}iqNukA-% zf7H5J$S|eqi;BbPy)8mEh65_N#%vLx%7lstvqr1$da0B%pW=%Rd$23jVP`N21uzva zQY4FIV5|Kwv$~O0?JcYgln@8J3j-hb!Os_#tu+L2q&y8IS&EyA7`-HuT1)(`S@2ow| zZ8O+TvZ7^X0&TUv1mm{L7%aHkcQSoLwGiLKK9Lzr$Swr;2Ca`0s5S}Xaxi^$sIZNG z-bp!n^WiY*Y7h*af71-u;FW*id%pFUmq!mabx~RGIAUc~PkFA-yovO*9()3Cx>iZM z+X=tBgZ{8L{pC3>c#hA4rh6~Lw{V-d4(U%n&Dbh_du#!xl!aev%i;bCU>gGxASi+{ zGbok8k>>Ei8E9{(a1Vy(KH?^;JwF7-bZ*04@Y%AJDLmeuAc>432NSd1XnMDtW8b1W zfoE=>7Qq*ZW(Nl4c<0uX$bjkNqRkt-t%Hi!(}yD>|JF9!ysv!k)v*br@S#hucV*;5<&oQD#jWMnSS#K3 zLsj%(f;xl{67Jq|Biwb~qGtjRt76ZIcP~b)j6i_Id6P)kze0nn{nX2882=NZx8%IV z&01v}B!axxdCdLVKdFOU>Bik4r~a?V{T;86d(ngwWSK{z{e|E*-UBEHJ+HhwU52+u zYF3|6Nm=59>jMt+9*Po(ueAtcMU;*L(e01;I6Q7AfqG_uLixo{6dXhXbQ%4sY|lK5 zE&e=s{1TQ1pI2vK=3=|s?)sb##}sPNhvHxSuo~_m0gFBZgLP)pW3v%sY}t-FcrLE4 z$Zwj=;3<`x;{6aC^_yLv0s0mp4*6<}scdazAo^szQZ!Y)j{ytt77f>wKzj-&WQ{*& z5K=&tNHzr72VNuiqEcpmS)6>+^vuxIAToq%fnWC|dZET%MysMC(7!U=Q(o0oXa*Lq zg08x{Rsm4k#?PAWEX?2G$J$4)Bkn>1dF~po@uZ0A@)S-3Nj-zHm6q!z`;+PXyr9P( zORJ{CXP13`To-y{89w;LyWNc&@|qlc)!#HYB+1n_eQzepRhdgWN3+!!m z+&^Ah9P#}tT)Q%3LbcR>hdrrq#w*30Zl(Ml7d1)-tRxLr8;CNGVY_Kb1>g8LKz6*) zV$xCRytjM8IXnYA=k0w(#8_{6OY;2DhRzCI^1k!YfcUC8G=q(hNTFgi?$4q@jB3U~ zsm-0OPY|?N;Gu7qV9rh3717e(?|bs6gMlV>8f_Gq>AKNVV~T@gy0QnZZ^oUv4GLe~ zL~S*&`|}^81z++VSi=-qoJ{1Sby+Flh!FA)&U9QO%Z~7 zguN~%(C)(Ovp7u>JfAU{)=T{34>eNPefpisi;%T}6z5*GArQ%NDjd@D(T6@FUJ1Nq z27DF~kfS%17~hDtAU-|vK=7lf}Z2qB{}<)UD!FL0F(nrm(-f_3XsA*AD0SI8a}9%F?MwV z;1x`SJ}lS;1g7dXRLV&!c?!Z(EmDU`yp!Q89p}BW_Ze3gPU^SbDT87z`)hYCUJk^e z2L4dr?+o@%T0h_yJMP_Ekh7^4CVN&1s`LqY(fG=M)yRG)K&y_x!Vam9Mfv_zWitkn zYP6W(65@Ek-Zt1VQ3Py`;NmWm*C&_zqOK((ET>~B3s%jq*ZQf65bQEhVq650i2=-Z zucYASQm{$LClt%wWhe4MtCz2?ptsx^CW34`8wB6i&|sO7 zcuXZ=(pFm=_wJ_>TIr?g<16-zo}0PacLY&dk1de+qs_5M_DSOKY`;a&Wqx~JVcQy| z`>63={2{+6xVHQi5Uz5)K_nmY29G&eXZM<4mVTrZkozp#lA0_+NepK-`2DCw=E1T=fIH51(OTV-!gay~ntbL^n+q=WC*J5p z+(c)}{c@Awem$#|TXPv%@#&wa4nJ0^``_bya~hhjw#Fx+z*##;3i<4lE*Iy1@DWh?JsmIXS`%IGFh}b!8y5ieP+Pv;G;z zfbnp97w%ly|LyiG(%=hc1?<+#DQ>9^_Z#`$Ry%ileCx91f$~vlK5Tl;ahuwO>}p8( z*R~07JB6-IkTgXsczaeHmnyj~p$iAnUc-rb{!n;VYOu7;ybUXP(9=C1Uo~Ntw z*lGzb2_Sn#?wQ(H%v$a}%Bz9STO}a`sn-!|ZQv9?wgf7~_&WPmyBBq5%q(BtmDyFZ zmk(F5DP2ZrMEbky!i#x}^KYAS+!GQWrtryA4We;Ryr%3UEiT$gKxq?n_k>YR^~VN zj`NkZ6=_ zq#ZobBno`Of79f+uCGKxY$G`nYC+(_k`oHkvY2NwN}+-N{x5(h>g`ay?`mR-hA4?g z_FP29@TT{{fh9s0HZ^ zFA+0c)yN!;>!6{|#RW2)ir38{sc`*Zk}65MtBj&u49UJiY?v2ca|zcoDckp5Pr_O| zi28G82gHSQSrrz10jY?Rror!(?%)rE;`I-QeP-yP!Z_Lx!VXWlzvq%sd`Uh!VG4X| z$Cr(YLGjHbW?`^=N=L=d{3ZSaYhq8dufHg)`7>zSP}tOvmP=F1;hbNf6@0RTyOWq| zV7u#=4Mj@27s@E)P%|Beg&sVy5ssv1R*RBHImLs710tEB&>T{|tQO(7zXOI2+90CJ zwF~@Ye_I`crHNuJRQf<>dPfY`|7kxOG$ z-vGH0&5UAbm(WZkZbEu`E>ly1n0*ZO!)7N#$l)e>4INJ~zinC5>X1ycVD82=mRU`v z-O4-Piju7PQ|-ss3HEsz$Iqq2l~V7Qvv>d$Qj&gk=pmimB@u@gp(JWX6uYzUc?=gM zYAEoCFaiDQ-5oNeXr4du4ok@ltgxu}tw!`6m{(sDPc5pnLp}8MnL*c7b@y|8K!l>X z)eeM1ZX)&%(W*u)Y@s4GRzt#~o+;!_UJ9_*{^U2$84@9}7U}N1heKPT4UN$3GCRPj z9?t2W0@C-ogGnVO_#zZRQ%Oyco#q}U_G@O8z)dH>WLH8W1Xxe_7r-0V8yMrFDg5?E zaj)a|%#cTW#p8FhA#OT4d>}u;a@#HS8kuo#|JA0*Yto7*K4rR2bM%m*;N}X(t4CaE z&4OEVR$uD>qH}Hp@5O@ejL8fZg?mb-n_3$qRHLDLDQ@_9tgZgUw0RQB zcKY%{Nh6}@92ITmJ#oUJS`tqAGMivVV5%OT#LH{LG(Z;dYDul}+!KyB&V2eBn4x(` zwn|@wHG7GexA^Xw5}}qmHmQeyig@>iTX6MyeO?NSu`b6&DBvZ4&lCM;Y4f7phvsp_ zafJG{%30p`q2l`D5=l$He$wu+Nw9uRe*gxi*$+ zl5cz`^u^x3VpM5TU^1M+Td3&p{+wuUN=~lKYV2)XeaFdoQ?xc7Sm*mD*l5RPz$HuBiTe5rz@&iZ7PStDb~w8imBSDH-ORs#PLw#lx!&14eV!j@VMM|7CtbpkgDw?z?GhrcbQ@*16ZzSY5MbG zG=fte)9iwwlciZ;`_@#l)0c&6x!uT(i79Uwf6j?;>g!*A9G#-=3j;COwJI^PIZID| zJ)+>6rL3y=!b7?9+^uA--5SUmKWevobw{T?M)|%LpB^wvjSK{%H3nr6x@0s~*d}!4 zDO@)R5b)P0w_v+CO#cEMT1@XXVsHPh5i==u9^Uk;B`u4LgjZEOo z3BEGieS~qfee!$t=Fw-ME-z13w7+&mrz;Vv5-r$1D4`(Z$X?3Fq^w~pW+ll~+Mhs5 z*OrOYx5Lw3cc?D=CO{|a5{-IB)T5Ic-A;P@sSP2Mgsm8h27rlYLl=RJq--o&yFVpa zwHYFM{KvmIpNuKF%INg;S0NIdLULZUN|Q8~!=Dch4#;>sKYkyWi5uX)(IG~>eVP z7LL&EL53WstKMEgjh~S8p~qRBvEue60*}|DSd5PR{IZsY7N-$UHsN@QPM|*o^ddV- zbxDLlc`|V*aa=BYtk4!F0iQh#BzS&n*_{{p?Av?2K-7%!4&FhSl~yDE9vzO`DPN?T z#-H*G3gCA)0j9>rp-PxE~aypq4K$cw1NVxrc_htHI$tfX1 zisBO=eh7DU_|-ti!Dbozf~uz+!OCcVxdNIc%`g?ypIz&W*E&kRus%iHwK-8Q+d=xJ zRJ)BwKL8Wy&(QJbSOIki0&p2$4gpNUynoF3T{vuCfnz=wP zm>Hv%v;vCXi=i|Wu1+8!W?h4BtPa%>Ga?X%14N}2QkLtUHfMV(3&#~S%H*_AyH#v5 ziDX0==y@L39Wofj*HM6iL=n0SJ4C|(h680bgx5Q0sGe8IpO>@N8;VIoQ|J@#ym~^R zXtm8Il@wdnee-G@agXGrwDL7#)yL*l+|3SHaW_X2_BawA+bQsLZgW``jEUFn5l_N> z5GwhVPr5ZvLw&kw4Mh5L+#{x}9&>Y;i$!KH)!?>y=o ziZ_4qB!!YfQgCW`n*;>JC8(qR!WlKPgwha&gbQ#7Nl(O9&A~vr=ZL3Pr3V^maQ5qY zza7K5e;vCPMKLs_y`&Wi#_bm2%C6db6B?xswwlqcPeW&8PC{3aHr0bGgWoHI7}l;` zCvp&F!e&24vFghgBeSg0A`>+%ekV9K>k2CQt`T~oDI=$_k|Ei_wSFigCY9m-Q4V`> zSu2OVJ@~hrl8}!WwYYrNH#RMK`=7yw2Xs}oS|SxTNW;O1jL)$KO9zgj&2gc{$t*aP z4y)4ExK~x-%zG%w6WQO^^N_a(8n*sCW4G7wCo#I=o;*KSHv_gCErS=$XVXhEu^W#Vt6lW5^rc{pV_<1=2{8{@(A67I?st!%u%kAuM&SHj z!(w)!w>#8AmMpQ!B4EyZI$Cx=K4kL>qqo=^iGVtVQ6|)vx-Oew*sTU~h_AQ0bGs!a zT~t}-({3X|Omiv)|B8%-5AQaG%+qwTzi_s|08P1^qs6NBneQoJ%P|mPOGlj~!1sBt z3F~srGhZCtNp&1&gg7@`ik`ku`bo0vI1e$)>;d$p{pym4_QYrD=gj5h5SIMDVGb!&&O_si3pk+2BlVVl`?U+pNG zj*is$qtUy*doT%{1xl=>Dmzs42u!LkaF1g+GdS61kzj~2>j_aX4q@CAn2YR=W*{z9 zmKS{n-(bI@OfO4%T`h2+?P%{Gs$qVmq5?f$Dd9;0UA=Xr@f-wIMKIk@#%RP?$W!7UK(<)v;+XZBd&Kvq(0{21VFvCCo4kRMaK1FYv zjU@0o^iGA}nKT}ws0hclRur}ulRFkk4p$00f2dofvf4ovE^}bL-O~`0&r5FQs-C9S z+%WcQI?>xchAi^{72HjrP|fI-yem9xzrAN%uO5Pjd$o`9rQTgFa?U`;)6r!C=IUx`Crd2@h%^}c!5`p z+BXrBp#&Vz+4}Y33&YGqg#c#`v2h^Ssd! z-)b0h=oZmLP)kv~*Mn9TKA4-N&2@V|aj+CEa;a1bhy1vu)|)5T$cXV>A56g&)t9hl zS!8R{&eIMH7HIQ(o^jqFV2bLnG*Il(>LuKf@gYa$cHZm7SCinWONvDt$2>owN(*)~ zJ!T{7RGTzDSse`FZubKVcqX&o0@j=f*{r(0QUo*MpKY1zLLZw(8a%f{Nd4hh=6E9V zjCcz;d6p1!I~^yZD>(J^cd)Y|-8?j%alwHdAz3YP2PT zEtcP#zg3&B4y&r#i{0;JV*ey#?S0L*Hat&h&Wx!7EaaZ6YW>9wd<`)ovhgrK`~wNGBk`6 z@p*)j`ACK`{Kix8tqYg2u5Wm`TU{YtW9z^=dO%+mJS~4UCj0^ocFdn$Dt7movp1E& zm+D&}F+a(ysi`i0@|WLqj$ZQ)a@u4d*FP!dar-!MjzFr+`ad4of!JQ}+m) znww8nE6V5*wKwHr3%9-&&bTK)f%oB+6a|6s+u0+SbR`Ppizv5Kx9@o|4)V{~tWQBA zg3D@i3qcB(bzo&MK1_)IJ&a%388^cRtKr+?x%Lii^^+A%ruWYwZhUVtKrK{9+3=*a zlfxM;c$lTy=!(~lw+s9QalWQz5uk+;*hGEhp(Soo;@G_0=Aib$rPJ)I!nozWjdmeB^e=+alKcP;E`n(glP8Y1i{(1%V_%X)EsN&r}#j0A83r(3(z%jzZLJE8%Rfk zAZlo*7QVmV*b>TY z4pJ`V`(|e*;|}NLjTQ?QhXV}XiDC%tm{GUYvAvU%5Cx8EY@UK!O{--16wwwP)b*Nw z{=M_IRmQy+8xv+1#i|wWWMt;=!Du)AX;80u1zka4cJ!i!I`bQuSY&E{kBi>5 z_Wc)r9uiI3%T0%ZfnMIFi~aDNv&bW-n;o)F0UW7K0QVH#EhSScUR@gd|@^!u&vt!v6-U@0Tdf7cDa_m-BN2rHIhS;IDb9%{Yvy`aND}J#CQOV_Vz`UQt@QrB_M@JHwl+a|piV`p5_-Y1f78|^z z%&kT4*g~6qzEI5MHVg&l{l@@@dnM$lGzwQ|HE7mhNaPHAO>jKuuusVh@h?hUh0Nl_bTdx_)d)+0kTjVxb)vUh!&AIKjOy3~3G)t_i zOWV~#J#>Vx2{!?UTuhvuXdSzeyHb1cs#FpS;Gy^!hrAo=n)d_nM~Dbz2ZQdu5#rw6vTDsVR^bX&)u0~ zwQJMB%rP{v7OZo(HQ+XHt&1-ZvU1fql*zEUe;)y6sm`NnYdSxUF@Hf_DGEA0+7~V; z_Z~ZR*`7lc>$3Nr?NnSqE;&_yme0axxi(w%8#Jc|FZtg*A6 zvZrOWA8i+-8BRFk9B2mKtc1_cSkf%?X1;i6&U|5cB<5*TmrvCp?#M7G=C{M+B76My zvc)V#MKug)HlWeuuo+;1=`uU4^(-cV-dza`Nru$SRlAF;YuAhvTaVNb#R8ZvHd=3m z4_1XWGu`d8oL%PGv9KtBFKuvgRfyH#T2aa_x*w;0ky}@m06C=h&o6V0 z6hz<~xUuWrYcE=B1+IT4oXO2ueAkk-Tlp^5LI6TMPTtA4!g$5!s3r4#1WN;qjMaQD zxOjs5?qS3T7Md~J4aJBU3YwC+x#+i}p3SAv$IkC>Ddc%>&@C1bh5M7t(G?b3@MgmF zFS|38SF!0iW7PBB735h}FoMJkC!$}|(+12eir}qi_8!J@H*Q$x`q4#i72lcu+Gj#v@35Gt(8^ID=Mf`6DwNq7I%D}A~B#7 zX!--SBVjv3(mAZBm7g@IqNq zxU)}F6;%VQ?Ez@#&nn zX`~`1nZm4gGz$*)e3u~?pytoQv`iX);-Ig+sU$#XjmC1p)y;xdE=*#o7pX67$?kz#0I^-1B2Ol z>w{Qo$Ss(lb!+JLHv=x$m$FrT8|NL>WOkoV+H~lnMT*)}GoU_)V7A7m(`q>e{ka8= zh2y0k_p6p`NvLS(I~v_2BNP}Uq?~7}zH;hE=#7`Nae-sWG+msHPIwyF9N@6m2g6Mj z^A^jPV>orj8mcvf9~LOt;}KOB`#Gz_U|Vg^nn_B^+O{3Zy{WnjhQT)SYS3~WJxps| ztdMqqNjKf#ULSiJDs&5VS&g#W3dZaj!(5@PnchYnMUk>-#|=_dYdMOm0dV@)rNO1e zgot@35wjCJIfw??`DSjZfXys&8SDhlOWLACZls!WGi4&@97j3N(XmlwqUAy-7I^P& zN$V5!`lEbAH^E&l^vIA{#}KYS2p%T0*P~G^?`Crv{tHbMx9xAf4}CW?SU;#nRe95E ziKp383Wk!VUWmONVh2M){T&ZI8qW6H2X4G^PU~Q0g49$B8b1qzy;GOZ4LPy zGoG?qNX+K}DAitEFVIijto#KF^*k()4zhJ_#xwxsENQ#R#Ok*PRJ`f%Lyzkf?{-o| z!aU$*y|$mnf~Hj**rF;Fx&2?@>3n0EQwC3c?;h#W9@pC&31-zcuGWU41GVhr89JB_ z;}wjzObtjCMfO>Y;Gqh2s;p%Jrweb?9rpNHz(v_bXw{r4rL}epliJPi#7K)X*e^*JxUS7ZSDVZz5*NN_lQeY4bi1v5X*8W20%c#HHSP4@MHd^bV zkmSuj;y)fLU9ED+;KVm$o7bYm1Ci8FBgdwNZp*luq2u@SBV(}T9Gw-_Yw&zx!alGu z7A|awY`iOsyhERQ4#N?04*hM_zi<`Bf`hmAf|s^yVGd|FKQj>D=Q0^Y3pAfD6$C~C zjOaxG!yyr_wIEzJMf3y}f?2Y7IM`Jt@trMgC#~iVx0kF?Z7f4)3N0YPVHh;op;%XO zwO*j=Ojpr~>m2Af&Ut;V5h_I+uD>jFj;|-+gNh@gc1F9U;PuXpp+~M}ov3z~bBspu zKe6sMaOj$ZBD&bL#TID1Jw{J}%n2tW0O&gOF! zB3C&e0+S=aMaFM7RbP=Jk+Qn)@pRFMSVbJ~=K^ zr{lRdh1JWQes48cJ~c&7J;PP#Inwk;sDu09_+Ay*meb^TCw66ub76}X1 z@*BQ(rCpKYnJ=Bj?T!^LkCsqm_0GJ_CNcpICDK#T=GZVqOOqw|U6;0CrJNUdxVI~c zF!9x&D-!wv-R-C+ebvroP+IR3q|E-tGy=uVXQ)k_waofm!}AZ&8yNEe7>3QU`X^n( zlTpwXx9-?QHf=`S*UZdIC#87I{1_o=^R?mxfly3$c0f>2AM}=-mB{s;f(XsPCm_*MR6&E*#Wmb!ljw5IeRg zX3%E9H4TMM^P7?Fk@%b^|7qe+@FBwVv?iCPuEq=gIM-}7ch5oXCXpjYy{k=gNhwIH zHE=tcz+nMEP@~1zb+65f>!36IQR+;Qj9t8Vf5pRkWRtB0)1-k+>46D7_E*=S1(-aG z3bADk9>Eh;+NJk$23-8Sr1gtO6* zl$^aEo{&aYS3)1AGPTrmNSoDVKWO4@gY$`&oBR>mcKK}drrfU%CL7K11Cj!He7lGm zt(C-E)Z+9E<)%P{&COc+#=$Zi?i|Rch%$-rgk;pv;a>V_UW^auW%2k$pE$Y-?c(?Z zb;RPEAHn#Se+^f*<{+OIBf-gl_WlMv@!fJ?RlhQOZQruz1oU)%@EBa}j9r4ArLkYR zbol8r<$D)7KtYicmeNOCdPM9tphjC!%A6{vO`zFR=LIndd+zGLG9w!12vpip3Q+s`=7(k0227y6JTVEl ziz^VzT&l!k(#zaW)BhF$eJD<_Oy-B=*@=&VfpLCO;n&eEOp3P`O~YwsKECflU0|r(R7xKm%QNceflE8kY;o{1N~TC?>E5M zyq`HzKQ>mhJ*ui4zR3DEgGZeg8%yGr#DE%#`{}9vW5?&1sVs08#gT*A=@A;Z$SHT- z?lt@=YmGY`-33IHs2%g)=x~F7!t9c^^3>WFyKbaEFI~UHYXIzu@>z3o#WpNd_hKVi zM!I2Xv__Sxole(HPT{i$eWLA}Z(L!Z$!JLtp9GjNnR(WteEZ+_3~*ciiS?#}&rAe@ z8X!N*@g4t*&L8OxNpn*DvlBxP+`)-C8;V6v@v=$}>S&S5?0DVda`6*6upo!^N)l+! zF3L`AP#bQaD@Y!VVQI5b6O(b5$#T>BcMEX8I|_(&pk@w6w2=!$a*}y7>6q?BstTQC zzWDr_%)M)*D8oYbt}sqHIa;(X?^C+ZaJOOA!0GZ9LF<<;cSRu7v*x9Kb3mhp?cUZ9(LE2(ijS+@2Fd1Q&*HCnNRD1} zOLh&H-(h>4J@^|Ik;=zdQYPT4EnYC&=Z!${-vV>+ryo~zfOOiOvP-#&+Xton>Gy78F5 zXRS5g6sk7WnrX59na-~E=-ZD$^OW~gEgsg6HN<|tKagZ({pu?K|Da{)b54Wr>5C+~ zxSNazTDD`7Ii&NSFsF!9CO?<*N-77!nWhkoXEJgc%pd3nV=yH>Jc3_y*{85a2RrOn zJqMV*>m7Zk@Zl+X2WH^w5@?r*`tNv`(1n z5v=sECqkaJU42>8FphL{FZdpwFN@?>+;+9_z05E^#O_T2QK4K}YLkx$*{HsgbA?*Z z6I5SjTDGsQ#6J!%j;G6@;!m#2E^g9zo^ESt|od`gVLqtgWgb$!D0_>x|Zev_VO47G%I<;{F- z)JZN6ee4P3`^JKNQ^!Cea7Y_b>M8`}#=Dc&m@H1R=DX2thr2z^nk+LStMW_KP~jYN zIbxa#_$E)$qsrHt;S=CC8}4^rxL=hWjS$7Uwx)&nE2%Oh~#R%k+R*_m}@ce z!#`aOTHF&iLi2#fga78$in5sp=Nmj!3X3g%H7Jwzs_xfRvkr6#F^u#)liA?{INLp$ z@(Og#^dmi^e2x`PQwdDw+}=_J&d9np+Y)SW9usA8Zl;-qZGR-bYsLSM@=)gy>Co2siZoqJkTJ^R>Ra#`(4XI z`$4vXF27M)<3U!g47qL%2)eI|DbY76%Uf^MGN3H1ymzgz(lQg+e72+-TeK$O;`yZs zzj6xwvuLz;lv(=Bqv9!-_Opt%zY3U?XII;vN(3r!(rSBGM;vLC$RiH1%i_+jGzQD!!Hp*0UrY%BF7bFO#ibw0-ys zJ(>CCoC-0(41U?+^@*LVCqSI$-;MkyLSO(LG*MKfRM7Uf5_V9FLsAhZ4=ysHL>ehw z1kByOb&kban;Gx=47b6l22h=K;?xFXf}v#kLrYtFe3#cfjP8)BCjyht#S8EDrxqr2 z6!c_p!%2c8$pKIPO^xx=%^lQzGbK_Uf#r~`K#g$@YfgtKx31;>I0!EzN^~JTNW0*}k4rMkku&Rd z`?8irf1PAThN)b2<;# z4;Y25!T!T)u@tz;HnH5Yhx?J^oiWLld0mPmmgO0db1E#7r@G~jDvnP?uOVE66pLaT zw%r5ASJUwT?!U0~i9UbIjGNP!fXnBD*M7)nj*Kg9UX?x%`v6#9kFQ<*4TZMW#b%}0 zE=xJNI0<{E5ZlQEkFx%xLEiY(J1JZ!e39xW(AM1QH zFqlP(nmE&CC1(i^Cf~omH9`@l=~CVV3RQ(95}o{Ug8K_F$#+Cmwi0mpaEh$X6IDC? zy%KN-iF^be8ZuMjMJW!S-Opdk|Iq&q1#R^s>C5J! zhOtksO}wR^{eNdLAox*fJe>vu{MApqU3_!9)!(3)@Bd7mERm8WDZxLVa6E2$3&#J% z_x&}-jufK&{})Jzh#j5wzwka`dRWr`j{{^%bTR&4C?Fzst76GNdggCY5HrJqS^sKy zptqYPoL>2F?*P8;h8WGN@qfkqxTO5w@G8i_|GkB4I%_NnOwX&5czlog8KM`jDi^G4 z$1U}@hQB_KFu(twA*-mYYU`NvzHl7;Z13REyScduY=w7@A2rjrCX)0#^^rg5<|2?q z6RAhvWx9XfT1+mkM-|63MLoC_mt+KSJd^ zxv*=!#hqq(*0+gn@HS8GI&R)Ca#Ao08vpVkH=fxblwSF6MK!iR`(RF8F)(IF^ak7i z*8M$iSvtB))?alvE1xxguOVv4@4M!_2{B8AjF*^V{v=X{Z~NMm!_HZm^y_($h1~6D zxSA1jDr$UXO{W66VHM600BsOvshFoVpOPRh>o z`)6OfGA;1O<4py5v9~RG=?A>61+fZZ*je(HsbRKNDS z*ns*ed+-P1`pV5nm0!mqWsVaEg$=T>1& zs#)EHF%^Y!uhuZy{wR%2pAUhlyDkP6>~YHIgEuU*%)87Z-lLAOjys;I_em%8%ASl0Ubj65q<6V_F_j^U+Jn)5H=M1;EAZF zBiOWQJNCDgmiB_R1m426bg3s=;7%rBo!F0vg z)h+c*mSm${ccqBD^q}Cp?6^4{jKZ{^QDAz?fYd)SJ5M7I;xh#hu!31YT65{LUCPKghtu{Z?Q)H5${pk(wXyVzH}u^0O~_3LkuS)oXZk)b~X*^$vJc z$|W>T9;)Ex5i0$5tIIeJW zuN=usiFD;U(h8K0d=qM`zFQck*xM(G5`!U$H!vbo2n*JesiuF2#8tUQ zflB-Mu7cDNOmB zB7Irtr|lMeED=c3{SNa=e;Eg6t=$&Awe}xa@XZARpI7*v8C9J)Mdrs6n4s=?j#;X( zSN1e3-&uro#HiI9Uw{2Df*(L`x^fD`IcUJ1{k z)7iTm8K^fpVCQ=1M5G!0V`EYsyUTQ&O1}Sv-&Ih{g}me7*Xi;jp`Zr4{<7 z-l03E9McpY7DkT)>yk?ZDp%;@?sck!6b z9g=?wEodz}c5+Wwv`;`R-%1nva>^aW)$RL3h*u|m3m&|ByK%0IJ^bp{I)u~WJMLyU zGOA0*b>vS?F<}?_nqtWheum7)uglm7z4@11=9^^{wyi~cjnz_2r9LPfiM|~8wzJTk z1m531$2Z|}8X(IMXhljoG|WB5vVOGR!8e|HbHFE}d(U_l&kVp8HC<|Lv(~&D;8>4CvFf1k7?+xz&n+|ouo*?-V4c}zI zK&?yx3NFQ48Q-gR+{f~{RDjv`fPtkz;CCY@+9mN-Fsh9f3Sm*Qhs+f8+|WZR9^&bb zH=%c^+|6W}3ER$+>&T7`aMaTy-^yljqY2J%?KStdpu!K5b#keK?frrtT!=!t0R%Xd ziR4zLAz=`x5o4zKqC`op-so%B4-O% zbV$a8Z;})5k{HN11@N_+cX@DN+pPvyuwV5~Y+V3AQsjQ;VO#+g)E2_6zXQAc4PDe%M6|zDegul)ciDf6GZ0E2B}(a!2Ywj|NkJ45q_rcE|1XX7apG=7 z`0vvLxQ_o2&;$7Y5h&0O|MwqB&7tvsg$V-lAA)fGeOW;i>O+BRA3PA`=H_OIykY@c zL--#KDIUB+`5M(}slRMB+Yx{x;8zyEUA7~Pr7(y~OGl+UbG!Ea!%EU6Y$)G6D_mV& z-SGJMK!?ZO^&pO&{=sNcsdg(fJU(yO{k=0V#MJ0~xvsqHTu=Z{rbg{yzi{aTgo6fo zs1(Bn`7a+??US{k+K=80x*eDW;<1B?R7!F2@%~3Se)z!CI0vn2I>Afk!W$b|X|y-c|qruXHfdLWT_v?O4Zs$_y9te2c zu*^){j*rK+Yj655!r#&qcjP9^-uGcD}z=^*SG zXy92Pxmz%yb6{2nr|NOZVM!xt&$lbp*O5)^a#s;&TaqCkcNj>{XuY;iLMSCT{y)_# zSR#9L5d0XwHLL{5_dtYh76N&R?T- zz81YFuIGBo@C^zI>XZTIZ&jT=v-CD19|TatTVYC#RCp7gIr*T;*&+8mCpOHKg>gosWoC*3V{;iuF=hoHxClrG8AP~*D zJ&SV%=(E_<-{8h6+ZZCA(u8>^$5g10^=ffUF_@F9E7jw`FCM^G?`)w9iS~kEpc@Y2 z_d*t9m;&HkAT#;w(lD}J1&YE@Y$I2I8|5O_m_-fkFYynWWUb||<_S6D-a+Gcu;W{$ zNDl>#qz%i20ir*|j7G0nQ+4RSkqqgn{;L*7DO?`$NwL>4lPm-JF{pTB)0}$_13{$! z48%^~C;ljd95(CF?fR+x7$fj{T%g`!p9ejB;Jwylv%u=}>Wr3|F=3iiKU*k)vfy<2 z^ma2XjIeW7)2(Vj6AF(P(MT?f>@0@)(Qa>ap^Piri6;!c9=JAVD+lqsXwnwxc*eTDaXaNR|4#j(QOG_)9?* z7Pw9~hT6SW)cI9csLO_Y;eAG|Wtk4+`(v^?6Bk~L7rOpYN3S|7FV@qfqv0}2Akq={ z&sK)+kUYDq9-nNrIPW1~g1C2eWv8ot3Igk)pr=LRg;WGRuJ#eExWD=&Ne%}ojzj8x z_h8Z#HIXiUFVmFi3yv#O=g*|Hd2{Rq=RKls1oalLWB80rs5b*AYA3?Wbvsp?HRDv;71-d z3j}{`eo++=KCx{Y5+5bt``x8S2=ds7^YzxprQKJ92^=dc;p$D>Q9hLe3GrLsT zKTfsB^bkzp;L}f$s(M)DNZFm~>-W_>C7 z%{_h_eDkt%$GL+<@dZ8<#x@oMBu6|GaT(w^qHX6f&fV!=OT-X!xMm<*=`XpveCPLy z9-MTRs}rb6IV=F(%xS7e2w5}cj}ub7=elQRzEF>Kx?mN6q{LCG{Rl%D`R^o{4oNTi zT^D#}-wG)GT@MTl%uKNi4w~^;B$r9oa||BOJXp3PYBD~bCm|OXR#{n@rTKtF0(qX_ z=O41$Au<`eptqEoYrPas*lr9#DP+yY%P4$~wA!=p_`6?i*YC&GsB>dvt2;i9*)tRcaODetk39*H(g(_@f=QOCqo zJFu+Jd@Q1+OPEKddNmH{CEzeTWC5)u?8Gqjy9ihqi2FNBA9v)P=(FR*4uu%5xTo*@ z{!}Jn`{A|%Dvc#S2E%bQl~Z%s^U{wXunjzCNkOm`w##avJUE@rs$BaPjYhTf%byIp zE(N#iOdhvt=>5n!EV^rJKLoX<>HxFD?hu!&8o=0zo8kQF7x0IZh+esvzSok~-N_l0 zy4xHLbzZ-(ZH<@V47lK|)^P!`DHGy{85K7-M*;<|d&QK?*W`z$bVKQETH7o*h^T^X zVLK+1&|m$x>y%>S+_!z3Q9{Hv9JHk2!TDYxRjc(vgHb+1-2C`|wmgei54S+@iOUYG z%60pf*b9u;=DNBRKpv7r1C1x7nO2!^TbhIzX9BO_+zF7QCXAOOf{(>nkV!<8DZ(}x zaAw^sP3u%N%ooNNtG}t2tM$6O+RUB$f}p6cb!+wgAw!n7@1_LA6%~I;8d=QbgVop9 zE64d7j!I6S2^BRV7;HX=);hmJ-pfk$r zONee(V}2~QPhb9VhV9sAS$8oLh|0_f4w~%0(e~rRZ?6z|KIN%A<T$3V+01Ose)`DpqDq0E|JHc9eK5&<`@Bk_5yC0hg zZ8m3|Mc*6ROgp;%dYQM}NT~r(5^&-(K$*GI5=zVc@LTHLj;?pZJ(Ty7J9Aem7i5S$ z>D?}@#(j@?_w$TfQW(W&n1ZVDPbxcj@j?I>|4f3WzQ3zg0W&ZX@Ht#!1#|*jz+QnM5JCoW*Xa$RB-8o-P`gFGa8-K zt+J1#p=tL|U2K7#5(jvUWzk_gf5>K;UZy;NffI)dZxl> zyR=fgFh0FzvFi&EKva9q( zsi?2No=nNOzTD^M)U>z7X8;NcDJf@4C2Wj4O5}5_fywX@gK-G3JABAcXRs#jUh5}^ zl-eDfsn?wEvPGfr(t~TvaT)!#sskRl8TR}vX@<_2(vQ{50P47+MQ<1C2kej)CS2&P zxE=>rexL2wvD%xY$HshnM_VJb}H>@L3l+X(_LJ8OdGt?ydlIGm#Wt-jOg|B-1A$GbSKQHp;klAINd64-wBr zZ82$8nd}mKv9)be)SG&aoC$MT`c0vGQ5XpqVNuZ|>bF*`-a`L#0G+!a!F=pR0vxEe zUGjgxAtMJ&T_~sFfr*M+aV8i8GoDk96bVh;7TFc(^-8z&NoOcnmy8I}2MbT^|(L~Wg` zYC_itfaWBYb5Hd<;^GA)A?ruP4-3vvZ5$S@Z~H!2Ko9so3)F1Bo$J{+MF|eZJ#QLO z=$A|^!es>t6%xn`ELPkU5{L%@_`Vqm=s&(Bbu_k#sO~Hlo?PbKO4eV8HB54PpnK@3 z6W`PHyBlijZw^DtFz<({w5}VZQ$kb!fIr% z@kMIOvjBBpw_Qo1i2$I&;^%ai4o8AVY+dTnj~x+uGWDhj5X>aYQj?13zT3dbcqcJz zh|Wjj+iC>K>T2k^6DFBmnK-Ue2rDC<$>|Xh)3@ah~^7n1A*2#9cDWhq)Vq316H&}Mf50UAqouJyaE8+=cqp&BM z#P9vee~Zsw!xgZ7Y4GWL1SGDjcD+S5lV%xz{#p)Q{R5kwVPum?yl(2wFHLJsCP0%v zb#gLn2_R704_ok_x6^fE5|zr2?J$mpY}L705~M}nl4bMqet?p!4zty&Y()thBJ>lN z0K{^%k<9#DWnGmmROhnD2ryUt7{}$gtydb-epi2r}(jqpuQlD*_) z_JS@_iLVMFu)5De%#Nl0gDqC(8E;8;2#|KR(kMRZ%i$~H&QrHhvfgs+E{b=N^``Gz z!z)>Zj$md|syAJhNQbwhFxxLS6yyuph0ClpxUWlULXfDYn<;*FeRujHz57uyceW7F zF(}QiXD~#NM~$%-^n}WV-&$pTrcNiZ2>B^(-gfV6Waj%#RbP!=qYD#* zY3xGE)_~A`7SX5L#TffOQ}}4PZ(VGD?z49^zu1c(BW9e_w8gGNgkfuEIrfWcN457v zA3*T<0bGTH(v@&&#L`hOVqIijWhzA*3DIU$<2SLi?_}r`0kWLnv!9Blx3zDD6{___4LQW^VKOB@9??~(NSu61o*?iV-^zc1i{y0}u$9*S283;Knktpq;L q9tk)idI&1w=UbL_`ofRw?*ff|SG*xwAfaD?mxQRSNVSlD!2bhA!Y@An literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-template-selection.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-template-selection.png new file mode 100644 index 0000000000000000000000000000000000000000..d523a7f6b0c0ebaaf8b5c66c59144d3a955195e7 GIT binary patch literal 122681 zcmZsCV|-rC)_0oZifyy88(WQy#{+vB z&0d`UgvrZ_!NcIdfPjF&ONf701OWlv1p)ce0R{2-WJMj>{PX9FqoSA)NX0nb(PsnP zR8U3`1f)6!_EjJ7*@m_gS9b&fL2>%~_hsFL&y}7FXx|TVy1AFVRkRS1+-uPsiEnY(;k;0erq{Lv_!xI0#r^CL+ zexE0PNUGoFg_wN#mgt3Z71{iN^L-?RZ9;qt_b)!Z7WPd75!U ziRy6}`;WMNiC7GB^~%iin;V)aiFn4h{F69O_jbuX7k3PBHr+67HSYAr{4*d2o%@Ge z#fu|~$>|T@gw0aott!dW(RUd&e(2smzI}#~h@^#I5f}>WCLSmns!hx@3v9yP91Pf# z?+5ncB@7e4Mlu{#DdG@T&eH$BadEM6o41|rgnqN5rK`?x-Ptj=_HuI%^uns95Iv@M z_O#bhtX=$JCD%1$<;7vIQ6@tmpaC)8^Dc*_+mmh38Xv{4kDX8Kj#&&zuJ19eJ1^G5 z;fBjiA^CQrvQ8g!pw2JxJ8g2*$ADQ%Dm7k_Ao#;A*FR(9v5hiGvKn%oHcAZVCn9Nd z9K|KZeT+~}VAKR6VM-H^gYR|Io?yQd-)${RGGzr=vo;RlNAF;_Qoj3^TPq7(7U6mj zYppNJepU>RecLO8ZMPDRy-Z4+*S(dIws*d zIRdE+=~1j=Eemil>8@0%)c*Dqp7LF-UK?ww!EX_kI1ot)ig@=Xjq!z$GHTy-6r19o zCxKpQr!6#t|5F@#*VppX1-ivFv?azKk9> z!rr{=Ll-+34rK1hH!UQ3#ENKb_@hIiXBAbPqi3JtseZa=@7a{#xf@Xnkki`Gr1qwOB-64Lom64(&{yS<7H#0&2?h~%d7*)Pv}%{wFHTJxLJ z4gC5Hjh(O*jmmbj?MlT&Qw%o;JC#28dkqhm&gKxSGw)%(@9GigrSrM@gSBRN<+RrE z2%0^+$?TJhtzBaZFlDH;_{;#XWQM`zJDOPGG*Af6H<991-o8$Y`u%2@+l}3wbIZ#6 zj+MB--v^=WE7lav;?mL|nXHM7mBuXCVRuFwwsa=5Ng~cYZK@4=BHh|QnAptCTMH1V z^6iH*z?<^u!7nNDB?>srF<%qW6}oHi<@%Copcq#1ySd53tua+!qu4s%V4|d8nz*>T zy*`Md-8XtRF~%5;roL1Yj_=~XnkyXdoztNy1f?0M`(CP2UbUZyrZ%3zs{K0R z*iJFF^p!10XFarBN0jK9R)fvfPbCjC;%I_Wd9nocMn8oY`BJWQ)gc`Kw$xUK#iMJ* zUAN87)8dJZ|E@;gu(8IPGN#IW+HQ)xqFSyMWa){KZ9jwIMno270&f=WqCH45+Kq4V z-cPaLufI^H5#*Z^*)_f6XYj%-*GNRWl7*$shqEG7@Rj(Hr$HNG;FY+1s_h4ELtXsX zjSA`EyG@G_y=~F&-3Et>yKb3KiK62@N4)8Nz_4qraiCi-yY~GQ6lS#Ahp5gvdeg`@ z9#P>SWf0nCi_4V#+K3PRS8d(obt=5vt=1agF-p+ zsJ}n%OceJJ&NRSk`*M;dT03YqVbMKY`pbC3Kr`FI3SA!W_f(33=eXxY`ezm((#NYb z4ZR1y&IlGU&uCT=5Kszeis6~KD7ory8_!?bh5hUS>#K_`?}WazB4&H2Jfwg1rqi(^ zkjLtIwi8U1rwXXzjVIH>=_P5oHfZcDK|{8w>P!O;ho14VSA_XyF=b%*6!ELu#IcMd zYCswJrejDk@a#etioq5H6Yk0g)mudMbv{ST1bUreM2s2Nc!v8*)rvdxxUV~j3GCw- zXsig~=m&712tN8b>+bgA*o?ZFFUFUx4C_^2aV8w^BO|D(1>D8P7FO_NsUB4ANl~S` z*S-g5k7-Cs+aw|gl`dI{Ff;$+f+a)f~4 zWG(-eNe`Sh&Ud>Jj{Mc4;bw^NRECaR^kercxr!jl1ImNT!9WjlHVJNdpA z`CPs?4Q)m{B<#UUj;V3B+*#SQpW}F+@#IopNHL zcf4>oELi#v-u9E=W;dq&b{Ohl&GH&M{qM*2#}dLUBSSMkHy~8eU;%F#qg5_Xwb|NS z#hv*kXB|;doe15rx@_C`Hk_DCRzg97C)xXBE`Z6dOYo^Og`A;~C+~vQw=af;1}E2a z2DRd6aF{D2%`K%bF+GXGiqZVvSVT16;O(`JS0z$JN>~T28hVH@GgbFxQ#T+PtRsp) zR=#+K97L4b$yPwzTCU*J{fZWR+!0=!Y(OL@W4ERPAjtBB@PM;Bx9>R@i9FZTUs{H* zGz~8QuE&dN#tptgm}r~p_?=K_=ZzCAc0X`ccYATRpb z!VQJUUH3f2>R@%$!DG0bL{!ux>OU3xrM^zY*x5@c%90i&xSJ6+7Qx`e>UcQs#M?#ee~cMs23K6nIn4t z?w=V(?<)c<+e$t2Fox@b`zo=#IA4S3Tk}g~aOH)X%M~*Z6|bHW`D))YWK<7TNxgG$ zo=wXq^xj{n5jsOcuD8M+VXD=3*UHivJcQiOCOxqMRs^T4p^>t*AKoKoey}ezls!l^ zWW>uCxroaN@?t3Y7GPy+!|d>7E=|Q{#O9W3EwKb7~roZe6l>(3bXM>C>GqOUc)8X_w~ee}6Ybd-Fe{`%jn zXxRsc-y10`w(nk8QKE2%8@g7V-Y4^rfIZ0|6c`<&y$4yD-Td$D-Ud^356-(IM^G7} zVP+WY>7!ivcHx3RL0CH4qIo(7Hn~XU==cC=RuSzHeJTh=;u$DG%p2KCCpt*Wf1nv5__wR#2tE0 z#Ee`j54cC@-$?wcQ!4#&Ns36m9>+0HN=OqIfl(24(zoJk zu?cE(1AN$_D2W@vQgZCxVEyHkC~M?|HgwSKYzGmPHSG!bQ=G+GK`TOO=P{PF$`aQTTQ+~!>Bi z-hstkRJL-sSz&5;TG*4$esz(v(d5xuLn*&_KyNhmPhQfRTA+YI&!o!_li{|lnc1JY zG4l0Z+Hk~u&K;xlRi?rWa43JsR&w@K)?aB@JXe!0-=U15nM%K}U!U^Lo}LG$TAhS9 zG?xkZ4Ls&$V>;aPMJLbkG8)d)L-i=xKR50<+a+5M5+>LTCRlNk+hF|@uaaBTU>dl8S0`2wPldF(AN<9*v!XTGHtwv)Nm(l$vhX**Zk|jpoO{)`LpH6w zds}tl7`&$U+cj5*zthK7Vj~W1JmPiSBNk6~C}@-cH9%TZ(EB^kMVJhg30O)JASR~` zUnjaPA_Xt=Qceird|#oE9d6i9jsUacs#w;I8Of-hbdZEP$if>-?=OE0|1SLb>Nu&4 z6$E**GHe|ttCk!4!{*(@J+V*c!V*h`uO2Aycfd8gLa6i4wob*P{FJ?aC_oWk2)adR zsQjmq6)be+C-UDGp})h>KVcBmlRug~H5yt1>R-fePg(MC9*#!}EUz zyH)Gb({VqO`dzetUK08_HM1a4tOpPCp5^b8^(^+!6hn^SI%hd(aTK@$(-%9h|4u7G zP-)yx&i*fPAwHS{{}SG>|KwJ?5!EnkF#lyj(QV7*{~AR@Fn?tLMXZZZsUHOTk7z$d zf`pqy{BOFqJEA~I74qK%Pm~x#Jty|RtsZip;)K70KUX6nUmx-hp+GM|e6RqIIBp1}g>vhk~M zDSxu#1wiAU&?bwt(8jFx$OC@oV@n@{U}tCN;Nlvlvekp`E@9fSrz8S}NuoGzFpnai zbL@ONKl-E2VM-a1^U}*yA_>EJb%K1-j@nLc?Jrww>N5DPn!j_8`$Z52! zSZBRoDu*Y@^>6tR@4r&Z8azBYp$vJoG`w67uX8z?bbL~HdgSqvZ$5XN=Em}7z)i~q!~oQGv+rt$!}*R{D7vy&&K-Z3 zPe-g9l=VG9b0Z-jI;yM8KjL#Wl&m~BBjGYu&CyvrVTNMko6F-Zq=I% zm(v`Z-1b?b3Az36c79cZ<-j2j@JFIj$n9L;C15=p5;Sj299pvjX*Muv?d;yG3W*BY zG6a?#)-IK(-giZz=OEA7Cl)z-O&SDtVw)hT-04c&Gzu&CB70Mk-lVM>M`m28&$SmL zQ3y1OasR4Dnu5Ul59n?YhHT}#=Lu`9hj6+p&(3ED+?&TQ7`GR}Y}U(qmu={wu?Y!= ztv*X%z5*1qajsY@@)Cdf!eLN zUHh1W*bd0d&(2~i2xpU)L&|ua58~%tsXL!_4cj`~6@;~q)Idmb&Np~Bdpg|FKm5pg z$Sc1C?W41RMnH@*APZLQ!-nwXUB=;38FsMrGQIOR{_e<)}YGP^@CjsD>(=3 z$QIm-mOItPuZ(pzOJFx_8%ZJJP96ic*RP1Z#Uap+iEx^<`;o_fL1M30m)mT&R#PbL zK2P{t4hP`to^09Ltu9s{r$MMXUp}{~Ao%S@4^ac**Uv!-f^e<1Z?N7^_EW7CY+BIY z`{s4$MGHG^f`&Os48DGq*R{z?^HbR)8PHJ<74i-C~QSn#Lt1#d_&)djMdzncVjJ<&@`MT4Y;2SNU#|1 zSaCZbUJT_9$%rRae0^W_2E0EIZeE{rnkgAG;*z3zq3z-0O&QK`@?1U)ra7a=X{VrK z8uSzEUi@IV2jB~;i;3OF54wAtWewS+z^3$djRmir>}UIq;1n$yP@V@v7_2k!=a|I! z6)9Iys$^acF11Ixq|D~2F9y>WoA97Kv(EG#1luLqu*lQHzZ zLV+!MEVf)U)e%$>iscP2O}ekz3s7vXds9_;-EPv`c(`|eAZO(i9wrL<5e``Ooq_nS za&}daQcT`yRJ*>-|7M21`m`_Ue@2~aaIR9f3R!@dt*PDBPl zpo#^Na@}gR0WTD-AOy0Gd^d_x) zSy}&p_IAAsGm0uCZORq<-+CA?n>)9d=_q&vKh)(-OXY}AmjvsfkD6A9M1hbD-n(k*Cb!>Dex&Q}zgO|ue0=br2Pp(-dI zSKk=hlqjJl9E6ibylcj(w93x0a)$4ZpWfM>4hDWQ*4gil|8W7V(XE2{7TI%-^hJU$G*s~`?I#sL5K5r`rN6-K>6&g@E z0YE8pJblJzAkBUhUQAdn1Y~~p!qj+25$m`R( zv~r*B#;HPH^BC{zT*%)>Ft0T>`S372v&TK{naK6c%Cu5%&6)Vw!LeuB*UOE$QH58z z9dt+W$RWqiKMq0)dai}^Ql%a_bZrQ4G#^$z6x#>|lt-zTDojEF-VhZ+FycHp(CF2I z7T4~}(WYnRebX?i>-}@1surO!T#x=35k$Q^lnkx%k*7vp8M0>zs>k%5BsdD}ibre} z#@k9LE>XNp+Z*x7Ss!b;vyr2+{rPsV#;`lo%MDrr=8lJA-N>)s=%=6!e~lq}wq+N2urdJVhOW3JQxpw_qjraxcuHYD%P*pehw1~WjW#8$2LBkKz6 z((L8C7OLa4@Z~{?-tA*EzU|+1fe#9>t4kULV_fRecd4Ie|EPiWuF61~ER7FQDb-C2 z2X?O8>R-BGySYDx+hn&7u{x3@cy)SDyPjkbCSP;7CD8>2MT>UV;s(87yKeNR)0>9+ zAYZ4&X;h7R$w3cMQSnE$fbz1fpB?6VVM&F&QH38rW<}2cX`%fHgEB2xwlpPTEG>rk zunbV?kIf@zCG7iBOG156o+G*{CG$d$F088I%oKCe4k393A}VgtWmQJ%yCp7gnUz2$ zd>7Q$uYUfrmp0QA)Q9_e@qoNSt9?BAj+{QL6I^LNzDR|tylH%0ebM`|il3NIXCi7Q zz8tOOEmrh6r24b0bfZRRvbZ>#nN-rCu4kP7_2_u>?dx=p3@H)GuMHbXfcN&u6BFFtoAyUIvqa+3@v7@fGL1$ z2VVwvAK}4)ny1NpBgZ6VlU?Hv(eE|sEcU%HjI~{N^*Z%nOID0z>Rzyw;9C8{YlW8$ zeWb@Zi1ZX`A4HBCvo`S|8@L_uW6!V8(%ti>%2sd&hKpm8-$r_L=ip-uZn8#U>!>3D zF;O1*4pMFA;?%Bh2ty@af#rj}`W+0K8(LFj2->7~Kg?w+v3|?`q*q+`)ZK|r` zO^4*Qstg^}5wT?<_MW%8T)%`&#+Ql8=*Y1Gs@h#m+XFQxMe!(N@XKlI@E;E>z^l@u zUfx}+?2S}UKTgE7eqaiivt=eT-*5F5&s^7Jb{8iUR@sl6HAyD8vlqkog=kotkTZ{~ zld56XVp(;b-oaMx-ktKIMzu0w7>)F0DXR4o*Wcr;s&m3v${F`$zT{kXkd=qbIBI~9 zo4;Hi)49{P1lv-`CJ~U;bD^CxAr8s`J=iJ>1GR)KJJCamtS4_@39()3qw5>83y={xM8 z)@smig>o@Y*vw$|t~zdiZd&SSu``xx+Nv@Z!&xoy$RQp-)pRHX2^{xRQ_*KQXQ`A46Ba!GK#%6NW3k*&*03Iic`cP> zqeqOLq*#5qxD0e4-cp)GXCi~G**+qp`IH{;RJle+_9G#VQRki^Vt$4kKrO4YOwC6_xg6iePDHJdjC zoam)!?Hi&TACxHZ@U^p>tg>et_dZWjx~mic(rTr4SOEBQ%2KQOhE zt^5VILL<{0bDXeU=T&)bFTb3IT4R15KXViEz@Q@?Wi(ko#GC}3<*3}A^x6C#m8kLSM<1FOW-H#u zHth1LJ8aAZv~W?ny&lIA$XXSTuS*u?^%H3Oln3PXS{feH7jwWLc)C&JqYYgORJpF07!K&%GX|Mh6@r)ZJYE z;@~JFH#u$p+TiGlC@Yi@-uYDtH7bxF8sPg`ddDJVwC)w#I%eKouY(()KhmEd~24yx^+hSVU9FTd(q_~uYVNeXlC8~ z^R*bb>!X-6_)03CL{*M88zcr38Wsb28otvLW-RV%#RfzfD4_hAhUp(WEeoIc3}~fj z94PrxpBZI36ped1WEJun1(7W|4mm{kn}+GZAeO~f0?p=@1}7!zJF@#KJ?j98YCn&F zH05X|C8+_^WiEox5HVt}ZxRH9$OE({Q@w)5ZW%Lp)No)<>?)l|x&6?KFugqx;>%D9 z6)W4V4TNX2=l*l;q~$7GqH)BG&k|K+dA4XfDE6*BjY9i`;$lrcW)^i@w8TUf>i3RB znq|j3>`1CY!Hn0Vtf*SijRK?^BcxU_F%4v@WWVH8c>B|PB5Hdc6<9Tf&?G`nvqhQy zHB{ej^~?{AyoT(Jjl#)D%%$iBQj+1wA}mse##ea$WGGReX8woggxJbl3M6!h;y`J4 z>GLE2?5};a))Wgq#DW*wu7Pv@%?Fc$K9=_pg)>a>d~pCfpZGVpskqS4NEzDcgklVO zYwVx|X3al4^7@nEVrmZCU#~AC&A=*Y*1_LO*)Exn7#)V?n)vF&I0$0eypfMfjAf5~(U z)0G7HDiVQ)qDw7h)Nfr`3kAa@R9G+eyGfs3)#q_tKnI(WNEKw1AVNl1b+co&*8;=#mA_i*lzm+^3wemn+z zY#PDVt~&!(8IBRd6Bw)$sNJmxfIkZZQf7d+uApIsfD*&zTS&qS{>MaC`pTL z*Wlg$BNPwa<$AnEt`UN3W%O>#X83F_BhVY0P)#N@ktmthHR*Zw&#$aTG+G2lz{O!^ zh}yeN_yCyzyaHDt4PySid=1 zBIg0Gp)Bq-N8`l=4~G*JFL)~X-)8p*&tYD>F(c~_*~-;tzdBjIc@7ziO3T@84&kGf zs3Dl+Wp0q_k`rwXQ#}SAZ)L8d2JxKPZ5l9AC)4=_3JPCj1f}rtQlsxO>`V3pwAsC_ z8|u6gn19<7?$9z%$nw?1Dlv5y^C}%vo8f~!=MNWvnJ}PCmRZJtCh>o>+e>Cp-mXa$ zB!AlB7fR&6*YypTM3?NMCkJ_{;O|DXT0h-$kATs;*+K=)la0XZA0aIj?m@u!BV^7G zbohj95z4E{{>2%sZyaKuP!WB8T&zSC8@Xn)f40LX$y@F8HMBXS+SoB-RYy({gj>Nl z?o6FIuVz|5E(F}z7Q;Myc-@B0|M7QNyx#ce>cqRXRqDv-U%vNU8W8RVEYXI-n4T~{ zJ624%MILga+R#BLFn$(zc1ck_i`Tog@-2E>?*WUKmOnWCypWu!X?eYnEJKtNQTf11 z(Roww`;*+Y_rU)aJPor`xS*e;l_}MJFV|l0?+O7Q;B11)-76vs?142}vYUt1W^I?p_* z-yzPtKm$Ys1Ofquh#}j)kUe(%ubs8FSGJM=miS{Q&X0pUv0S;DCuZJUkD@S&;)@ec zWk9__t1q8NF8X-9M4mmBK&~JxzY)IA81|5V^fAczf|DnpQTR;1oMF7mkm zxs|L!CT7BTt(25})lztlD*FXPb^1g6q|84+^iQYULslNOYUNd`B*3x9=;^}f>|+7y zbbfGr96`g{A?XJTV=)0P8&9C8f~y;kyMM#UMK8Bj zkmOQ9Og$MRPgvK4rgwGP*a~k1hVjga-Rm~$AuA}x1+>4V3cFFYXiN0krJ14jvnOa~s|HqQgZo|$Ok<@3b;9Ch0oYTVcDIPpBkAq_K9kn3++L+57rI&cFsHQ%nfEG8Nf5Eg8Bg1W~LqVHYA z3z_t=G$&3ff_jMyzX$@c9Pm2}7UVn@Qqc$CuuPlSfX5;eQUOhA=OM28vm~ zq43`K>zSwcQ(8fF=i^>Yws0CMC$v4bdK2^kn*+R&A@F$aL1^CU9}A+n@9}Q?sWc@= zZGm5;lGg%bc<95RnOz}zh~>COi!)KYO?3s`?%~wrm!R9C3(Dn+uIZ#i;XNskyTW;e~Yh-}Dz6C^W?4`cNhkD5aZ< zjGI;#Qz~QvTG7>>BUP5-m`Ff*5o$Km$K*0o^=L1rdLQOV%dV6*D;t{iI_yxjCo~w_ zh3VbSn!~`RL{ItlLr_)NBP;jAI~;AQ>`SuimNtP?_%|ziz1!s2Rc>kQaGa|OJnb~W zY{Ov{BETwxUb=jSG}O{#j@*lHoqdQy_V!GN&E!aT#~!)7sNWYk`z3yqfW_CcyQBjOXbMQyd%Tt?+0u*6OC{JI1FOj* zXEViNX!CEad2Q_g9a@1-WaAJ*$0btR;yOE+NP*ZN0E%)nAF4!{#o{Ep22*nv4SS%* zdvMmMgskf%)zu_FTFPr4W9-<32OEDQA@0&8P90?m1Xn#o|8(=_XF+VzypA$MAz%=h z_R{2}#9e}oUwutsU_9~!0>C2qMb_$9?R#_h`O4cCuDL+j4=}NEn4^p&TBDf3V9TjR zhegbGL>@skHx~bdz5x|ndHPQ7>!s4E8V8*3&mud|Z+5%GSqSvcMF@f8q?GUjorY4Iy;?n6rKF7*U7iu;i zjLFWZv-Rp!I~F_|b;fZF*mb#rjGw;NPo07Po+NuAAAb$$?QE!#I9=7=7Xa<2Ja>b?H3rk#`QC(#iG5w;E(7}$Rc$~`PHZO!<-R-w`7El zLzZZQq3u9B49BY8?^DLJy(@95S|_ez?gNq1ZNSDaF{a~0aInT~fSukbNDEc3zSL#) zOp9O)-lw5#XNa6TY=V9eRTxx@&0cF<^`|>G-uXZVgG~m|+U*vXnpqXS_)MjvtihkY z^g3E}7;KgoMc2vFiP2D|!iN~CQtq#I93+8dStbI_&J6(4Lev2r(3dRG2XY&p6qw5) z$k`A&sPnfkVDjx;y6PI-87qbLfjEj#Y4Lpn+h{2M+7a+BmwBi_vsn(3{tI-?IccU5&x` z8uimlxe+JIv?&Cg7#XN-IqG-I#p|}VyMN#Xd`!5opzY^;{T;Y+R}(>ui^h_W88L+W z9zpthaYT4f;bO!XM!X1N{m2)EYTlf9SG0H$>}q-_c|u?8|FDgyF=AO(4foT5_kA^w zj%F7=iACwp=wZ5BHH2Gx#xX?&e`6a|U%VWLMTc z^t-j2(2q8BJoyg*lb*LPnnoW=|BI)8SsKuOYg_o$lMZxzXvE6(6;$5} z+E8K-!4dB%^4nJoD(03h8RAc197Hj5=OS%X)_g&`Pp*ZJ|Kl3_8u4J-EBugarIpv7v8kC91ZE7okbpy}-Fe6}v3-YAG4 z9AG507RnP@pt5bQ^BeXTc7arNMY>%wqe0Oy5d#Xo%rM5TdV+1BfNzUi&u@&6fnfY- z5>%bDf1nNQV_Rw4CBu}(u?Z*kL)NekXN!8~W0+WQOjJ#cs#G_p^2`=jclTqlI0~or zM^7y;i%!G*U0{?)6F|o$VQnBa<46nOTbDdsoMyYU3yn|ukxPoyPVb|{25xOA(^Mj0 zU4@X*Y=wWpQOUD88_Y57$LcAo;RS!N$|7=`iYZU@1?UsK+OtFhuw&^nXomA=s@+2a z{OCgFyAiNiOinw|0lbNnz%{^cGa842#zF5+`PI-W!IU2C`r754<#Kr*#^ufPbAK3v z*tc&w>mFNAl;BmHnp#q?gf4_VS*S)*#ey-4HavIy#-q1)XtBNsXt95xH@i3Aat0qQ z4=*((5~UmnuX1kv5EUE~uqhx+Qj~^5aJUV@KGTQ4@%hue8Ka@NLgIU9H-~8!G3ov7 zD0O38j9=%8z`u~0A$GAZp4_Z_9$^+ipt3G#d_K~knuW?nd(3X>Bs3 zzp6sl`XBUh7o2A8+-le0(u8(3cG7<-Z2U$XB|h+DLu^7MT(v&WH_+- z{`PV>l?OQxh5Jypky5RvMXGmoX@b>szg(LQgxpC{y%iZzD0PDc?ERCr?WW(Yf8k`v zjsIpWDV@oK9fiY+;y9E-uN`hNSE4_iFJU%chOJVm6UAydKP3D$0C0p;0CK_XX?H4% z<%E-zTBdk%xqFX%%IgXV!-h{VLX&90w2<*JI~<6V0bgl+Mol(*S}9uyxX70;>3gr! zU@KdtC{!kk6dnoAVa)oQI0kx|U#O43Fyx}(;?h8D^FX%gb^CL;p5wK(w=>yo3c%sA z!TI?37<6istBi`MQtPr(VJM%R>J`p~3U)ls6y>1L%o@1X&l6a9Ge+ZcMv{uf5cg&K z1;~P-TQ&KZFbLgQJZA9wc~dY5+h&1sS$;xsHX>$H-m;Cl*%908@9(PyczXVTLE2qD zVuKIX>`h9tgZv|!KriTvy8>BmZf>n6yDxL4s)Ofity2Y3n4`Z~VR=38`x2>?CUZq# z-8?)Dp04+{r80RKvzQEnv0^(*XgMdQ8v4Yxu4W3M;Ne9M6DUH%8-@CV6+Sn_*OkH| zu_AO}Of%QGcA!YUh3)=PbF*w}$G3br+bfE2szgMp&PEM2gF8y}VZD5+%ovxYNF9v% zVI!c_5+-ncF_4_KG}nA2*=(u~*<#irFhW0ivV^MeU!0s5_OPpWal(O17MHUm+<-f_ zy$)W%=U#4)097lrkYB=LVlYRdv-rGmLJ;tUGI`uDJ3rnK|7u)qZSCSjgp;gI6K^N# zwDJA-4zH(JUPle5j}^=cSr@yyh~Cln0K2tXTrbi*WbCZ~wj+9j%dY0oMn{O4LRgm5 z2xh^pOPw`Lv4-*Q@AHmG1PppIzH-v3jqvvfT}2fE@(x2Lso*Yz227g^JrK79wNU=i z!$to<2xA$9-4-km=`dhn&?tXOCQ<7jjAu0Yym2kpnFpk%Vl~Hn|GadC;yAWYp&jx0 zZAS>U{V|Gf<(ojm4O?Bq?D;sS(`xrXZ#;iCv^lT}oz~3pIu7xDGq^gb;uEJh)R#Bv z$<~D=*Y`?0Z^-yK$s@|YzvYUh@*$JNEwAp>JGilbl=KW29rZHOpv3+fUAIy z(twYeM;2z&6_LLLQ!7`t`WG?iMI7!*D{ND{w7I$Yvs|+=+?PTYNa-rEULcjyhspCP z<}i=D<8D31A?-|4LxuVQGS*KO{ds#dLu&YY)XsIj#{xBblXDqHpg>WmTWYC_h0Jn) z&l)_42w?)uJ7NxI9-6l2^WuTY8OCCB!B1XX0&*}bgd;|efp4_hZBVfL6aDdIQq?BX z++Ag+h9v*$@y!ky>v}U>a}uDfjn+*|3kW3nlSG4QG7hA|kdp|9+%l^;Kpdf3WhzL z7r#RagqzLN9vnAlei%r)79{KsR#oKq7kJqLM-bNGC@_At`P`4m!fZSo*x~(>YrWFo z5dJmC1zm@aT%DGePc#OL7Z#Yncw~r#iW-5H02@4>8R(>HLX-|$8AJyETlY_NaV=!e z6jlHwST_3~h2}YMVlEsErc%7BRJc%s9gu0g<(7@D_9|RuE*ZcQMc}T;0I|qpntt%>CWR}(!UFygE2^~^k=Jmj z>oFe2RVZ`QezcSI^a{lls1f4vIlxI_jP-tAN2oU0K^Q&M1!K!o0FwV}tFv$?c6}~> z0x@YM!aEoL1lSU!QuLqD_-f1BG{8`*hT<70n;lguff!(;qWQl@>jm z-W8cKp_^<|N8Obu_v<$DN2gXcn}lvwqUt}waXPwGI-|CmSJOA{<@`Mo!i9bvYCJ3h zK?;D{$%YO3!^3{yX7c+Im`-H&*BFmvFP!wJ zd~=@*g+7}3E#vuVwV_98H)Wv)P%pDr%_QN@-Sx%?Cw%u!-(YAb=lN-JLAzlBrfzA6 z_V=a}q5~k0cn*Luq~^Z=F`LL2>B8fVZBG=3j{BowR!cQugrJh?Y-hDKd#`|rz}wkk zrOvA$*}t~`6Z|VhTk)R#ZMSVvvL|MtBYyM8(Z6J3587S-gX@KQ5+J-*r1)2!yTS_p zh5KTP{LgPA{m)ZVf&M4tA^rpt%Om`E?a}{V3)2OsnzV}#7wK;_jgHyfZ4FCaFR zf|#!k_H&$$rYV)mkjT$u+T7l`Ygi?d435Z#4L88PKxE;YDb}-4zqP5I@4$LEfE1h{ z_OFHdr?y(rJ)=d4bVkEZ>CNIahosP9KZ0>1EMBEof|2a9U_|E`BlzGY3KhF3?bbD7 zVz}WZ|KtvJzmYg^MR_wL)L5YX*%K6=%hF1aNdE&(y(V!WM@(f^iy3rpI9c#x?_jrs zpUINe=0%KDzJuNi#$N7CFWkdltePPtRSrSUWYC=ojX?+0csL35p?lTcG501_#(^;F zCoy=QC#z_^4l2?M21WEBq7CtWH9tv0^AUR>WS12iF~{+m4Hu%cWxzKp^^yJ3=o=;n z5^%Uut-uUh$sDVCf>6o$FPCfvnS4K~NT6bNIw!~0d?5h48>|J2@a5sGi*w(z`yniE zjb|Ol_gN!`@Ykb+iv5G%=8B#oL6Wl_Ih-CD zqxq!Y`P!s2$mMH0Jts2JSF&`t!vc{UKd`Avi53T?URRz6f7#i|_<@Q@=Bk}X8Z5Wk z)h$%}{*b3qi@oE#I_ser)6(JlaG6hqc} zAwHI@spfi`IXhZ3>&0N=o8+adAe3k9%Yx%oqAgY|xf<;YpFz&rx6#!ED9kqrQUPLS zBtXJo(u9#@9u?d&4A~hnJUV8SK z!HWi$0Ke(I_g(KFvsTt36Ec%C=j{EQ{e1QdTgi_0)kDH@T^6N;^-HK5GK|x-kP0Da zed0l1Y!hPci9GyH@-c@&tASQ{u6^t|z!>H`^lH5U6~4pFp%`TRT;uH}D#PE+MMMD? zvWz}3;3h*>H{1ZybAp{xz3(9t`fzIxjvhG18aQGl)cKHS3O2ljyUcj-iy ztB((p`9ga(@1nme4VxQA)q&q0HnG?zW^XF@d#6ps?E>X|51Rt+zA{3A;^@xXIml#7 zGLq8juP}OJuMjA;`L$If3ue6ISPIUm|A7Dkr)749@Y$8nmE6az0=XE*SN-88d!DTm z2+~rDl~TRp$7--gY69E_Gct8eHjVaoQQ8&_dm+&cxxokcNHjl)pGNKtnD&>s%fa+F*MCM!?-Aj$( zvTk|iegHmPcJ7%>?D*e zz0MGXt?6#3tiY>zf0w$jV9UHRxVpc0&+%d^kR6~J+A(`B8Z0NOqpdq1m$N8RPn&mi zbr(w$p9Gx*;_J%WXJWc*$r=vpbrTJmSf&;^%Bdkpzt^f_ML1-FKU40< z-1-^vaBExr775le-T%S;n_%>kaW@|H6@%Z|@T2dW;-QTPP>0PZF+S@ds>QJCh(R-b zE$BZJwS20?_ur*rb=ycq)u$pv0duSgJvy4;b7bt4t%2KAw4fe+zlJbl{l)1FLG0Pu z8%AB-El3jT1L%QOl{I4mr_dE)v(zDbJ{WYaIr4cVC88_mu{UZ22_i}P1+YEiV^d)JsH zia@+O+-SEt3jc@WiRp1v#&SEbgmD3(W?ct7P zddeYp!ds<>(q=Ic1d>}ScIvW~$uA@)Jduq&L?F+3LK`cULzL#@!?*f~z(*zb)N*l+ zB)Bj(Ic0M8bHlyTRX>IA+@%P9ro%`8+-UQ|X6ze-UJHDSf#DOgi>WblTU)945;TUh z-Ui3re>%?SBWCn^o674q@t_IYfGK^{#@oh_eFFT;?n1@NAwPw55NU(pRSHAsFtq3M zee?REt_YTL!}IShRjr8!4W{>AE@m41pqp8*30qf|_CL;#=AcNOi$bf5Z+n5- zugT6USn@WbixNn&8!kj2b<}&kx{oC(#iH@$Wm3CoC?)kI<9;A6Lk|Yic(DHRQ3fAV zE2nw(gSNYTI4e`+qMDAzOdym;-Ve$rWcy)Btp1+`ky}m#8cYs5X`Ca7Mh2j;JPGFC z+nhG~TsBO$CxQ&Q>R{C&xx_$~kHbaA;XpCKKEncK_7rXHbg>Ox!DlIY{sWenun4^9 z?5{Kd-bV(m49PKiG|O&H-w;{ASH94Ub3&a~K%$e9VIfj4!XNBx8Zp_5Sh|QV<+R-J zN7wDbn9F_%Tqw>iT&+Al+?1!RlwtsQ3J!9(x`ICd>W<5@Xhd zXn+sj3CBkdhtSVvvT%(chu1%OPN4OSwXX73p-c%>7U(n@8~b$Ah1B1llUVADG=g7Z zrA1W7cKgjA-ur?XeWs^`K0hmE{1Kr+KWGKbedv(pACvcs4^!mivx)MLbx9X@goL~P zkw)5(bTwrt!#E7((Q%*=hS2$+u8|UH7Hog4BlADuLBaZzZ8SP4CR342c~{YV`}vQ3 zN}VcM43*hXiJ9C??H|@}e^n@Q%W|Y|xy%eB69%>?JBD8P&Q?Q5?hRSM6IAEg^-i~1 zhcr2g9f6c?F{(qs0e&3r%ShEZH$-djwbaXVI6b7PN8w^&T3dYGLQ=Q6$fm3zQ)({J zxv5Nf;|CFsW|v0SXNK2V4cK^smi5-+7W0-YsU0WkCD`T;?a?bell{F&l12pZ&PTz& znywNoZ+brbygYbcO};@wBxoCxBZ2 z^nGoU`|VH%dZ@t^o#rod!pkoXUkS}l)gh4cmHItln%HX-y zQi!e%@`A*3tqD$Q1^YgG#+w8kW)7oaJz{ZRoCn&sJ3cJ~Qzlqi`9{QQ^z`1Wn-Sr~ z`^HlaW*~>rItKOXa?e^~%{mr;gBHYfi`w5=LoQ0Rx0IeE%}z3`^RIp)T+I{_h;zT* zU2oZ{j%ZO@5DZc%};O0R;}DJXL|g2 z2KBXq3h{m$_ILoSnsbW@Ph8I8&NizO4a-Ds88}*n|Q92)&1;hpm^)!;X)C{J*B6suh9IV5DJM;>~CK8kQ>ueZdL2iO`E8G z1>3CgJLJNL468#Wo(LHC#n1@u$^JWZr(g3Kt^Rm~7*8m7Q?-K%%_}i|#nkguoJ!l8 zTn%LVHQl3A=OP)xKM7hIlWlhkqkjImB=Qu{7%0*zPFlE`EGhPAX~U+>8roiU7sO+^s<)JF%Kw|mDW)bQm%n3&HC(_H=-^D39jkzE}_ zZmD*7o>vQGbIh%3C8|ZvOMNIpL>w)$9zG!Qm)pN)6@O_NRF~}Xn?Tn83t~~B1zfD? z1@_L8!|#kD63$Wuwb*CAZ8}C2v9U?3l}6-w1qGAAdz6fx4{uYw(Lb|^FlE0HmUvlP zyZy=Gh>mX7v2)%t{I2wziJMsiZWZ?J?Xw4ZWfKKlooX}m?mB7Y@O_O%^I}jg_g#T) z6cX6}YOr$h7-}+TcU`H2i%iv>xP77b2$oa_6TB-tgnKy0#lmQznAAwvszXaCm{28k zccPB;a7Dm^Cz@W4kFFt&YM+%!qS6y;{ah%#%;|I0!?1G{sF^A>Yi1^0$4FXuLR*$b zRr3MAQPHYo*y<~l(Q-A*8#TdVqh@hqpG7L|0<~dxhWzZ@=e(WZ{J*;<0Rv9v(`Gro zwqF*0NGg{4qqT@`_DSZW@ee>O_1b@r^glMB%0l1QrN&s(0+B@PCEK?$L+-HwZ5AnF zntl$eJ?q6ExN_-J(v6QdiXRM67wyC1bA#NcNNA9zLM&LN66hv5y>4Bd^r{W%Y3vGX z83yD_u+H+n$oxSh?}6h!(M5whPU|=P^(N0DzrsqiL}`7%D^H2>erK>$&eK}auy^x{ zItd7R&a`T>sw+a`tV{eko&Vv|b=9@eA^_z_&On=KUhckobEW zQ;S8)Xp}47V)v&Ph`;N87EvDgI*QmqJnm5A&Tb{aMZ2$3XCDkCC&~}%8FiXe$An)^ z?Vp^y0*%sBnuOm4>(jd?Ma$j8=mF_Szi5c}%%G@zZ)WHh>w9n(`RR%gYTi}Dy9FiNYKba{VZ7bSf5#UfgB=4?2 zt?Gu5hG~^xPC?qx$d&BquOWA^;)Gme#HA}Ksjtl;KRpFX;P4vK28LuNdCFT;W)X^2 z(7?29|Ct+FeMsC#xf>--uE@AXJ->>PX!3V-rIV_}%r6gQ0-x|X1j{0jMZF|LqZM?x zFCV&=4ThJS;)s>v&JE26hlUKF8xGK`O1gjnt?Fc?T z-RGbihPvWVn?ggS_j1kqBNG}WCg!fkD>!yKX%hR&r}gH}25kaA3uJZ}DaW_5O3L9- zj?4U74Q86=6l3jmQ<^{ZW`%fzk9MI~J1;P%6GQqR^UHF*xHkwbP0FC+3g%aWR}lqL z`T*yd;B_!NiNKpXMRYuGHS;C8MX}QG-}l5l@_S2T4eQ<$Qh-M@(W4@CHL5hC9Qx z-#Z^^fMpeb8WQeIpkuTt0XsQFWY4o`mh~7x3iB;zAxQk1HuElS`nJ01dc3m9 zj`>Be&64yD_-mKcp7MxRC29u)F=vm1DCnD4NI1`+{||xum=l$&Mo+;K`D5x2VB0@r z4>UT`Z9-r9uzAH+Oz!<8xY5Avs*FQ&SSgewV6(8eO=65N38to+d@^-*16zZS@Cg*8 z#=7}*jxBlpn<_*h!&`bnmk*5L9odB25k-W|&fSkRJI% zk(NZg^%VX${dy$IFjN|i_VM?w}N;k#BqTbBfoSV0)KedIhu30`k(7m|Hv=G$?+^Nv!V(V03uW$eu1s#sZ`FN0+^ z+(R~38)g%2?%^Ff^~q?{SxV5~$%2x2cIR+({T}41b?=awAfo3}U|)Lz_GS@hvQF*S z^Y;E-;Szm8 zr+|3L&Nkhsx$oy=3G#%Up`fD%yWWFMz361H0JW3O&~KRpezp_s7$;!!H(US>+Wd?%du8^O2|rvIl_g|Bc<_P{pGlWVs%>V!Ot3%d4$oF1#C ze?ed?O%`?E&KwWI>Z>zs_|(vz!C@u%Z8^HYu-Um@Qf`T~Lv_~O$GuxtYU}1GbWQhJkV3sG=vfeO{`5 zWIX1txUPeeD{I@>CQR7$YfRM6Z{sCDX?(^+tW1@kh6EngEwx~tFc*173W+36knLvj zFOuEk?AvymLQ06yNPI--9bJOMVf?(+Ws%dgYur2 z;c&zU?O*M&odK91Ut#b8=Xa7b!H9|+Rh_lTI8`H2g+1H^*)DFRfw&c?;DuC`-rw^@?dgyol}7QaNIL!Y@cO_T*xDY%c&zp0pmefg^e1U0QAZs!c(0$0 zuRhp-mc@Ag=5GrLOW9qXFv8zhvv>Pe6>~-#dD(3TE@V$Hdcji*s10Zp?+`mKwXR;` z7uv`TC0~9gLwk?8NC_dxG-y@JeHnB$_lBfI>X;T!N;a{Z*ICH@5CRHM?`x(BTf=0n zywA97?KTA&NNp{4@b7sje=6s!n^~}gHjtcx9{yvegT&_#UNU{{#Lir0nPr@|-m&;d zhJPE+kQ5TZhy}7no}MFgWDGorsv67*Vv1V@nHvtRd@zn*$;7xC>=l*XAT>68Q3;tn z**v~CJJB|ESpE+&Mpa6X9{%NSiOYR&EKcx)<~)HrZg#)2;p<*Z+p!N$^Sv9>1shCX z%~TDYmdo%a93!K{UbM2Iqm2InVqru-G|{XblK@kA6(ZVT5xAUXA-6cSzPtRn_>&85 z4@^64*NaH#68fn#mVpu(y5}|$Vx8#;)Zm63Q2t);5aIW^G(fl3M!HoF$MEVK>v`xv z{T#DdX7rek2XZ|_C^74}pRx03dnqZ zW-0~u+*+y%F?Te)hHN)>DOFkFsn+U{wRNDWEPBEtW)&5Y%g_y5n`-<{nFLvE``WH? zC+i{AaEuf6mLTZsj~4z{X=*O!HYkX$doVOR0TyVbc&u&5u+VP_2aPI4w}{K(n|}?G zPT!V^#Yo#?<=>iikadAbPjgiB-w{_S>ke3b7RM zt@XCV%*M&B%L*8Be+VVvqGY+~NwDIo59`oVmaVviWfuH1A?*Ms506xoRbZ7tHJkl_aw+hn!s zDVJNYb?qye{dx!TIT;a$i>VNAEV->edr@tH?J_R$!#N`qR<=m8RhsT>oUO);8q#@M zP1w?ncHu&yQ(XQM#J9@U_mVz%=cP}Zr@d^K+@!EvU@WF{>I);ck;;Cp8PaR%uG1F; zupeq--CU`j(`_!k6rOr;zBv#-GcKa%ahr6=lnGkpjZWN?KC)ss(Tq2>Z)?=v6?ld& z?_jxEw&F|Ddzfd;?<`grKLXohSG(-z<`s+wIgh>y0oG+1sse*kS^jazs&g}0^t#>^ zUtiR!htu$}p!x)9EUFh*zhzQ9wI4c`2o1dVsIzXp)g|A!E4+?Pit8JpnaYf za*I+bo7SISf&opwIB0`h$A#dAWYGu1VXw)Ck@WI+HmJi{HOc}va{kK8-i@QN@74ZB zPBO+c^;ZaaIISL&rpZ%9UbdG)ls9?0t6qgYQn4v;=n#;Rd#-)(ahZhu9c5&y+=*Vg zNZ#FVE;FZ?Oa@S15E{Ry3C(EZr;dMym=uTAM_TsToEwNgc20)ArPkNHesbu~W4;Uf zQ?3vid8kP(!loV>7efRwE(+sc42TqttN*D<&2u`c8A8GhZJ25?ckBEd6eRVBZ zSXkH(fFpNXrUyJNI(p@?VBaoI(wSVGwp*Kr_e2o3XQJH1PhnR1$K|@`3&9V4B0*t& zZ`QISpEG@1&`uJ6JUUIjt2YeeIS!5U_+EYNS15%fRH3uNC0_AOIY7c40ZqJDK4^U! zje%2<94os(@l)}9?yEM7$cIwVVFp*`${&wk*Tp!-D^zSse#|Np5WTrKB?-Bs1KgW$ zWHInoE#}i7kJ^toZ5mN0(Jqe;L+$(t#oqS3QTOkNd1F z?>>>RAX^*s%t~hzC5mprnIPiX=+O-HJh%oDhbt8pxpld&{&13F@prdVA5ovY$$EvLnux8bh|b6GQIKb(P=Zd&mbES?>MlRE+Gb=;h=6QLc zE?mHBFXe`&YiAr#uz#zeV;yII!Xx_gx~04wf&cY(DP<`1A%Y6Th81evzJ@oqKw2o< zBN|2wnAv?aEi>n6KxDHh@a0s5!v~-00Ip}l6)GrqGLEC!B+BBs63x}GMIJY{^1Yjm zS6s~!EzD#5n8kn{^y%eHtWYwZ_G++9$Z}r^l)bkhQkc<|Qu|F!b0k;WTK{xt$*q&4 zT*szwfzycp)ihWHEZPIyHZvUWgk^g7ZsD4u40VgY z0wBLRhh{H*OgRYj7*G@nX0j(zX&tCN8Z`&z^T^@P)SZ@o9vJPz$KC1ngmb_&D zUWnB1*TRS?Z~M$rqZq}d>;mocrJY6* z+{Kc;H-#qdOTZYL`a>n4!PA>JL$~P5Dx$~gg?C);rp^grX^4BS9We3s96?a~SqYl) zQjJNrFd0(3S{TnOX24<|kB3Oba&a8k;T6D*Py1^dZRsBUaxP;&Azo+;q2VYzxTWu`s`r}zk6NWNbQ`QtLGb(3*Ne;-)n>68=l%P^5BGm# zvl_J&F9Lm4kAFoj^ynIV2%!FK))tS8C}h-prbKw4_aZvC#Fy^Gzg5)=^RqPwlY3XCwZN{CCfo-R?IFlMNOJ+0(s8ZUmdBn31 z#t?e7jH`MWHulu>x2OoN+D4U4ISoa5awzgf!h=krx_4{TlQmk#9?y`-OOEf%cS~n9 zLD>gw^CGu(I+ttT6}TrP5zm+46Jk^)01(o86{*jutu%y~H6e@?E+!BhkNHY<;#8fu zFUjaj99z>oicA=a`<4+O@K$Kjh8n0zox(yPA9GVLdczUeP2 zbQ%xTB`KA52$u<1^CN~Avf$et$x`wr?LQXi@gY(__%<>y^+u_$+m_NKNkm%Alb;C( zavm}aLfw@S%nwQ^{F;ezl>6R^j{{T7Wk0A&UYkCtyA|grpG1YT#A0V=BKOs0QY)W$ z;g{bh?MeOeLBw8uZ6#yjEJt2i0&q$S!8qiEa8+Ts2`c5%@!X@kgUjd_H|-IcHA1Ks z>0_H8BGE4;KYI!*n~%lC+AGhH?i3@pQ4yk{WoKUt2q!U({`K}f$D};|K9a-AS46of zk@Efn>L;>t6fDYmJL2*E3H=BbtA@TItue-DQgQ)j1d@;DU#4tJPJ8_T&+iyy>4I$O| zk?vk!%UpUYCp;}J-!2MJd(_%)b!d+~XM2*Ciy=+t$S@MQdBuyM^PM5}i+p!)!HRk? zpGMg13Mx0J5O&!M#shPw-c;nm55ZQc&pYZnfkj*Lvfnm6y@?ykN-$dkAt&|*s0F^!J3;qQRc z(j7I+)R9u4q-0Ua-1pJ4Z2c@Y3qR7x)r9`7t!)&nQFFQDAwKL>9b(afIJF3tI7i-5R5)zjKX<5Q6km~HSOe%ia~b!cBDMLLIX z(LU)4&q~s~i5EB?Qj+>~D#9f3-#acMl@y zixFFHblc9{fY&fz5(B;X%=m98eXB|*6oZoPjwb7|ys}1P4za#s^OuZ=O<-=@3K}_1 z57xRsd|3jW9HXprj2|M*Z>;Git z{nQrs!`_KlS%BybDT~+!jRdx)1o%DeYCB?{4wVk)eVVMlv7cBAl zD{rt|_y^xxoXn;MuOGHBrQlUO+7GR<5jgqnFt{4n^d+sU7~LK6`vX{ro);fNFM<~q z$EMyg&H{_LUzQD*s7&i*(T^Whwhxa`E+Q|)CucGK7(<<0t9FC87sjcZ7Pwp!G6Inz zoFOL-IF9N%`Kj(4ZK9W%hdZOxQA7pwVJo)8xx`L^W^#63_no{JM}~0 z^$(Sw!?Z!&5(j0f;+ciRGq&5`Z4cSH?ml;88n}HH@mM7rOLURtA^+x|A@ay~eY8M{ zJVO|;&^(-0McQPelxERTq+9j)R@f7J=7deYvM2e#+NKaRXt)sm(Q>UFUN_Y{W4=PE zMA53rCYj2IH$Qx7CO48viD)n9y9@&pi>BSyYuELUlwM^$t^)bYH(L&m`Xc_sMj)|_ z>v6@{%tjnIktN5guf(;inW1H$B8+Y)Qs2If{%q*kq$$wd`^L6ZJ0em}$Z@>;jdjXM z@0n}vOo10k&YA})Qygi#tm>CE{Hz4h*nhR;n?I~6B8tT9vEDLa{Nm5Ym-ow+21Nbp*eDnc0C zMWM>>+yAvtv0uL`bi>f>nXyo{(vXKlvD1nD{xma4a#f*NEjyfJr2UFFhJ+C{J?JU< zxQ&3EeetkJ*`}~j1@x5|e19+JPxv-C@E)vb%BqR!X0!Bp$l0y_;!qNX-+{zhM%9~- zwrH|4&uFRoWq4l++eUCJLF#_Z>g1$=gUqmz5iDF`7#kBFf1umwq&;b_S%d#Sms$6t z#+NMCpc}tRqk6D<8BdX|PS-Z_olB{{W~)8xO6v2a!SILI4-PnqXuN1evD)~oIyk9g z>EYSfXeyP#mIgzVD)g+wI}8CVxh({HI?aK_vyp9{@MJZ;!6*EK%zA&ieC(?8@0r;i zhTip`Go+pWLOF;X`olJCVhfdx^ETrG6=-=gXKEB$$SNWAxUmLtp87y^7153J*7{1e zLqJE?#GW;HgxUW!DkW613iZ2R(T09|NMtwAAKX|D!M5WymCYsneK>p}&`4sVAX)#w zN0V&fq2I_oNvT_YgV@xq*#=nna@u3BhboJ|OmRoHJ7FuCbrgSB@;FSMH?ii_ zRw~d|Nl~~Xc1g1zY@f5(R%}Cg4K7|1mqN_hLJHQeQi0v z8B&(ON`Lwg=H!OH;Qu)UwqknT*ftX5)bR~W^}(4-bY{p+RW!Lf{`p!rdL`)Qbte28 zTu70hHu=N?@Lf2OiqX2Ax{7fU z0b#G4z~q~6ERlpyF;U@ph@Es|asDQBH0dGV(ZL3Eh*Ps1oRM=^TwAamY^Uj9r}%Vf zg+qGv9Jawgy>BsdF++-;98)9^uK*B7MzyVo*2UDXs2%e@eyS;JRD$QE6%4UYz-2#@#{>IvyZZ}?v-pcdtzJjCh~Hx* zk6#lYq3w;QO9#C{@=@85~A$R+?=hfU5g# zATxJ12!-)oxQO&%Hd)OfJwM(^Kp{gQ(^1@ZX6o}}IRLx8%lx~lAm@`0FOynjXpv-$ z@kXbY=k;L{c+!%)e|#J*nO;HaXtq?T=nD#Gn`WaqhPZ^pkpJ6<4NVq8Xq$k?S&k=5 zEQJsu(1+s-U>+OvZbTzsqJ04x-bCZjNEzPzT`>N1<;ySr!hHYz16J>JjsQ*he}J73 z;MooVMzuYB@eM4Xc7Me4(?zbJoA_e2)=W=80J*5Yt}pk4pvU z`xBYh#L2$Np7MNHQj2v42|X{5a_C=}G-_G)-OIlwBbfmup9x`r56*BXnt>olN z_V{eN#GYXF5TZl+t8Q~?;6u0D6Ma7SbazfPeE`_4u&1GQE?d2D z&`!Yciin6fS`pfb!PFq$EditLFd4?=cGw{Iy4=MH*-ywVt^o`hPM3zFM?2reyOCg{ zSXgYZ=jWm95kxdXL!cds`A!VK>Ty9ceMChjucpT_|X2&!0-+*h}Y+gn1a<}2Nc z=?AXmsazqYI{i=Waht}hWEiP7J_eT#kPLFs!neAJndT31&GCMO}uv;|cI<_AMy zfH{*nUhRM9JUIU@*|tHzE}i#5ju1E<#ZT~c2eO2aS2YQ5{^E176_k;53Cg#&Zq|kh zr|~)Hn~o&HRVbH=1IDvIZB8Z(o{00ijrWzJxuOe~=$w3=D2#y54dI&Q4BZkJm?gyyD&RE(cQtA!z>FJq^bJcd?DBhR zx$pmg)#(+-3@hc)XBnEBlBa}tQ9Xt60%2D^QQhBLi3r(0o@`P7g#s~nPL~6T zi#q|&J*?fQ(gJI&(bnJt^zI``?w3o5PX$y(@H8_G{1}Oe3Jp?N~iD zG&HjP1Qy~rp2j+Gd%8L_L7~se5U}zn!sB^?{$cEb8b2}l{P$B{Bw)GqCEIAGdMFKkMmcoJWOL zSio9D0PW#0RRI2~*9@+{)_-;CDFL7s--pYeO2y&#*EfK1&sY@j8V^;fRdF~$zJQ+X zE+9-P5-)yFw$0TH__9A$@t^+3jy>+R+OR@NNy+behz(f&Xj`tZ%=Si-B&y}pHJH6` zPqaYZdM~9q`mOv}Q(l;Yb*C|8ytWzlLsP9{Z~{g_mruyMsHLRxwY84!?t}sEE4$<8 zmxgQjPYC{fI4ler1AU`7)_WbP>uL;O$4ggTFt?s=iMbDjUuW>Y%W*icgWp{5@Q5*( z-wj763ASJVMJ+6>Ya2kIpO+Kx6dZt{_B-C^JM6|M0qIciT!we z64VWkRA_KcnbE$(^uLy3FJ^};f))8(!6*aw{jzVF!N8r1nsf+Rg7n8U0*iL!=|3mu zYd7Yr|9@&+pEW?8Wln13*s58(ozY8JokY;}CwM}XWjH3U6XT`9qMwgBI5;>jjz*`&c6zL! zCz_ZD;O?*cyuN2f{cxhUp2%xwZOW`j_AFG^SIN4xZRs6q@Cz2YKj|-C&N)tP>D8Nq zov33N8y!A1g@Q>+mIkYXC*^Sn((aOiw2J6C3HQGB5%L*)I+I8jo1=~t6X@t=Xu23l zqy%IP2~-REl5feFBwXe}5p-`Sb#5fv#D|0Jq=nZ62zyvIL-s;Cj8`C~hZ`V7Qg;9$ zPfGdI#tC+ApxEf-;(EeEk)$nzI)*~MiT^^-pRhdy)vQ@mz&*Kw;$8{}0Np9Rk1{J3 z{CBxO$;^9|18rSC_nJw&I+%_zaN9TV+E=gDWmHcZxj9)@fju!{Vq#uzx1W=5PXGVi zE*@L!aOEo+LIh3>RI6Gs=sWoaBuIh^c`moCB2IrgI}_jTk;F-ULNio4FKbh`rb8+< z2-!I1+Md|={+ZQ+<1gfa^UIBb1L7_K``Cp+soNgoBYj|8+)dY_a2Ci~ti5IM)RM8< zL2eBBj-nFgA`35-QWtfNmr!7V<1SqRg49X58J;%d;*pv5_WtEjGMpm4cm0W37yhx{ z+R=?Xa}DRpE*Dh40^dXtfGmVHIgs{3;3P0?`OVrOl=W`4$LYEI9*wNies(GMZGV6N zAlBkVYwKvo&T)c<(9mXZ0D*(Uxdr{oUEgu8-BNAt+U@QAaKt^4*l5SLLEU%;XK|a} z=<0H-L%!x|meiFqw6E2SD^syrlT)=)^{af4rn@^3he6s;O!jt%hK33?>hvK`pLb8c z<%>{+AYuGi9eLV1*jd`syxQ`5fjt<1tmE8+?hG4WRb5!)V3G5`^Vf{up+eIJ8Ha&8 zjRugQSuYpc5}f5QHNFC1sVA~=q0V0fLO`Wf`}Mm@<`)&RPZr0(#F94B^)vC6uZePw zO#A}HwkrwoiPv4aZftVKEuF}^gm(+tC#vXE_(|O@eqigy%F)}!Z+>iz{8h*a;njTv z)n$5|*kBkD8jRUe5b|@*o#$3pE39y#vT!EW?q`Nn;7pdI$D{G*+F+&aKyY$T@x!J) z_+uTZb!%SmC+UNo=?2kvC`!ZzS8)Ctg<`M!AGZ7)scXH^e}e=j zad2oBXdW4XXXywyP78rx`2cva&8FKHs9Y*LYR3++67oEYM{MLq6R8Jmj^7>#toj0T z^&Z~p!9*sFKaL<=07*)^SVCN!B(UfW7O{+Ov-@8b+s^@I@AQSWEh!0u?N76d9vPFo(wi@eMLbI!i0RGw zYJ!tf!82yo7;&V?>Fj{LcE6`vXR<^9 z$e;`KAJyXMcHHhi2zFxQ=2nG`kJlW#vV8VN%o~^QcIii+2W;rXM(*DtR&M;ibZM(? z8^?WV68uD}F&1qWvqZzyk2StXF5N|UQ`j)rZwc|pT0gxR+YSIQpP44HP75^7$m^c`b)#Vz4%l@Y#dsanaE2;m3)c%Xb#-cR@srJ#ZPf4;$u25bAPcm8 z*OS<=C!;!9jqUPh!Cl_d*A(-YUE}shKV1FKe$EzOwVZK%G%bQYM?gvH@u*=%+SKnb zH-V%bpV;#tu3%6GM{DUW^KYEdz)=Btgs(S%PFaaZ2 zo&FcjTjW%{evjA2S3rl>nN|k_(1Rqfmn8;3RiKA6G@OU~=N7c|g`$^Mev^{wzbE$0 zMh@x&J1093cggEw*822A?tx071}{z={pW-qxlM>wC{Wu@)MiX~Yd9zp+6f>J%r+XX zmSI=1%wJZ@BQQ@?zYgFD8J1Qet79<6wYBZ;M`-9B{?|wRTFoC*9D|9sGA|v?7Eo-_ z-lQlnWGFKeJ<@(bhm<~BzsD7M)%&z~cw$tp1Tq(!sNf3-H_Ryxgv|lRss!9a$BqH& zE*1TQB5cODKgMdU*=8wE?dX;hh+nYs^75R?yzo#*MB}C6NP#9|cFwC;_h^%y45&*0 ze}hHum#Xc4AOAFg!rQU-p4S&L;H31`yy2LN`^U%V0}he3V-f7#ogImT_UWx-Hi>RT zS3S{AKQLzyZlAfCm^X{Di3v76a(}0%TxZZG$x1=OPG1|C9xZwY8;>l8 zn3u9jfG{gojkCZ@DPzz-c_2J0K~A|v7cPd8ygk4&#yd>dkUQHba;ab=(1;<8i_$1b zX?j2CBiRk)+Sp`AMCTusGaqew^oiKBOjbGn@4yGDAISz17j?emVkY}6>p!iWv`|}VOWW~v**lb|3)SCBQ zu5M7*|F^ys8lJ07-8_X_)jOV11@>GiDiAU(%*e*Rq$o^?!M-%#8%s^j*8gpzmI^7@8I*@=sDzipf_Q>5?70QS} z4~BK zfBd8lPaYM5j1?`g4P(x=n99L%`Ge>D z%d7S=5DxxNu{0Lw+0Fm?MgzE{yMO6i@>1#!Kz+UR+wQx`zQ}Q=>}<7OKn3#sfLlgC zeRW~AN>yVJUi?ybe@yemeR5|V}=*}EO z0jUk`R{j9HVnN{Atv4`Oq-(UB2P@IN^cFiu(56uwR$FR_Ll4GM(RyH)eyr&j;qJ1*X=o`JZZ4D}HFkCoD1h!0w$qJv~SC{-KHt7b?}9=T^5D zh%f6FFQ@meavWb$C#y8-x-Xe?My+N`qBJpc6D{zC-<4b2jPeB%NpA~m1EL5)Pu}mI zF|X@GCD-Fc3<2le#HW7{5?m;$(ni_g*l@q->a-}+ml2l|a_8ug(Ex+76viQic_4OC zggtHoWRQA~bA8T(_q4RT?Q1UL-D*xwPQcgRwS#7ww4+li7 zez_C|>TcSBafI;jaLC5Bjdv+Cyxb~O2p_$ zUbdquOh=B?27E7!=YTE|sSxeyW(|{4E1w$$uD-6nr)+dQI6$_OT(Acd=Mr~FXF}1!&0$@@9HDGNH`5V5+|V>H%EB;c6?pKMX33&!qYm(CP4xf9#1(D2P7O z`r`ukV#fI43edEo+E1WR==4S{khKqqnm2etjmZUFWqjLX&pV{!$@>5~g2U~vs#DJa z)tBvj1P@o&ln8HsD} zGESu89CYG|lTh2@A{Ht%_RW+1{o55ZfH8ay2u?%fx|dc6h=@kOf&fVfSOMFb3q9&= ziHV46xu6)>`w+q8>;R1p2r*Y7L9}%x(kW6(iglvh+#6j-(-?P(mi{2pC_&a^W2H2J|ZmS2E}4di~REwDFmar_cb zAvB0ib!i5*8;hZX{?8`d883qa5)-Fc9cCkz<6EWs0p&bD0RO}G@03Ib0(QudjXW^n{YE}N2cA0|2UkX7dWXUB zL}?QIHoT(V^b3U{eLM1Sj~K+**0JW;lc|CPro`WfbHSC+xX?@5&-64+^+kwBgx{a#c{d)b7U+4J|K9I>M9~4B1X~x zH@fG7>!dRr5Wy&;dUm^0p0@hnq0g9??!Y_K`)p1~h1{#}DQAx_vbFRV&LVMWy2p%h zHaqG%M#j{E1r`}~AD_mKlJ;`#8W^Y14trPbmrx-3-W+zY^oo;) z!ESd)@j$-b;+by#1LHBnrc*guXW5-7Ku-qD*L(6;SCLm@?0|=lRs_YsWJ&}N1(c?_ z7Z|})CH$p;4g)Ysf#bZx>#9t%b7*c358&ApG&JSI0YnB~{bV%ueaQ_<;IkqC%_%CA z2avZJH0$44&;Nu27+mel588gG0=xO;D-wtSU$2j`&K`z>?8N|4Y<<5|@QXjB)G#Lz zOS+H$p$@XyvPFP!k)H2$(~cjTjCBWhlgNy3&HsykV082=Y}v}d$=R&0O_C~ptDN(n zuCg%$_tyhsihzlKWX{RmDX6h=-nLF{{F5(#>R5DQgct|Pm}#&xV$&_=pFcMt|Fo7+ zU)A%6QhCZ)G&+NCf7hu7q+@%hd*XU)kCWWM<;3o{FMI%WhMN5e&bw9ng(9g?7kt)@;C{rt&ug-j?2;v5F*8N7vu+&f}tUT zsrXxCC4#Wt@!~6L#L#fzpc%S)CkCVQLv#%yqBbZwu%%?FHhaRbpv@05lC;$W8vT;tBS8idB|`8P&nulo~|*0*9LS)q$U~yHm2yQ2B`H4^PPdA5-TT z9a+?^>yB;Pwr!{5q+?fXJL%ZAZQHhOJL%ZQ&3ACe**|Nnsy%D%r9JVygC?dDJWS78 zMRg$!4J5dS|2E9o_9r~pBa%M<2-7^xr1-@w;78L-XKM7|y6$K09UDQAY58$w1|q@0_XA*)sUlnk)uDU~@4!#p zDDO~lc6lQGC<6NXEwl)pWJ33yBm;IC8tQIpfXo)lVVbpJ{JO;Hwn@z{(KvfNn7Lcd zL!&Qw4q|#@dcTLEeqi3d#s%wu!NvirY+)x1i(0J8! zSb=OluS||#v>)rG><(>12DbtfduPYN6Q1mS@!SHqU=^Hr`~|8JVwKm+B$RjdP~l*#vM>Oky0l=QTn>7vVn9CC+t%YGJ0 zV0QS+u+aR0S{osT3tRzM-CH>Y3c92J%$T3Qto0h3!tGv{6sx6P=S5W<^)KoXsfn@L zk7k(wK{#XiQQtHNn=V6ja4xIEAW#){#67rEydN6_kDhBHd>H|FdJAj@!6$udPEX7QPQPoQjLoLnb#ib4i;^tOWO{Y?@$Rxj()###>kzQn#P zMyGz-O*jt1?Na|_=S8me{vYJWhPIya^ z{@NuMY&X}{V524!y%r69c7?1m=rK7$vKZIBgwh?Ywean zUrNlQ!?U9qHQWel`ilE71gn|?ps^S6>rn9~I)rWOYxTE5GxURoh8i!{mTCfPi;%~C@)gXYw^bqhiU z<5h6AIgW;KzZJUjO}Qw$~w0HR?2?YTHeO8dR-k+yBYisfiM4X28RZ7Z02zZREvx z2C{wQiadfl=hY4OnH~Gpz>x<4foGr#uzw((G*^k$Zu>60M-x)6cy(-wW{eNPw(QfRIo`|3{iRrARDs7B1w{@YWLhLhG9D~5JBXq)F z5;U`Aj<%qv7k**Z4kDNFAV=XQhJIDxWEFpW1BQHovx@V6Z@-_eRAG=`wL`MOEVCR} zgl`5-7TUUCudtj{@=ln>@W}DB&gJQP8K+p&HdYR@Z{dSmHxoo zJf3y@4t1KMLBJFyE<-!PPwJn)-3Ldc?(ccoBLn!X#Q7#WJHt{3M+OAg2enpZfnesB ztlpFaB*eUH^0b&X)LzK^}g3PvuM#+!N(YpZJ-1 zZQl2BQmj_eO2&w2Yvb-~)a^cKF;50>B^M$9_XCb+DDP71KW1}a?#9)iuX9iaj^0SJ!=BTt z#%D9y`g8Ww)p>c{hDL>ObW|Hd-ulz(#{%har4DXFlo|w{0 z{na28C5`8iFRB?z@cyderk_Ra%GPM9paNU{U+X;NtI~_BU3a{1=7ErVd_H9kBEmS_ zf9LQ7#xg`=#C?VTf3Pe=r>ZsC-!-P~(qDf=l-_Q!We)jApNXF6m+ABZ;Yz#?136g4 z-u70p7}_pb!dfE^POc{C^nQ4zB{zh`Z7FdA=r}gnobcb2xsP?Anr- z`z1WhAT|L6Gk7c%^>^@g7oq1ybaT~TbIH=6B}PaN2>${zs{ar7F8lBH_CkTTNdY?7 z*T6tCC);IcU2=@meFA-jhHS`K9x`X|M?2K&1u!5fmx8UoY!bI7C^xE>B!{HyuBn0Q zZI6I8zB(Keg2d)OjWZ^T=1f9XK58%!Ed%2)F-OhUnPkW?;!dI+^jovdQaV;QhAodo zBXf;YHyqj++d89u=4OxQa&4C&e7u41IwoT$U7`yeDMAfTTdR*%FlQW>(F@&k4k-wz z_Aq=I&mmq-(yA9--e$aJ>6^)B(k;d6f7xVgJhK=-G$|O`rv=Db8mw<0xHVU(g9Kb( z{?m1)`+}345B4lYfwefNYYvS4L+m)o4^~0965F5L=$^I=>8@{|3EQQAH$W+sIiV>t z$AUkwD)(#b$Z2pJfzKb#s1e3i&imE^7*8yMUL(*Azb1F`)&yXWxIcqdO~vlPP7e+Y zBu9syFYM3cbmSVO{ZKz2X3y6cq+~gOzcrPB+cfc-hT-Mp;0^DGKDF#gV!;ko zX>dG=If@9-KOI%AqPx9eDO|3Gk5T5sDE9Y(wB0O%EX!pm6FDkU$?J%-r*`gzTF}Ik z^%YN7SueAb8kn)Nb7l$~#!~LFwD!HQUhDrI5UExsBvPTi%Wd|hQ<3a3#5g>sr>#1l zVs_$_1>=KvU+I>T>{uiNGgTEdyc}tUUA{hk04LnSooi$R0INC|+s?p>h8b}1KQYV2 zS{wGCH@R}X%xo@uT&Rgk4(Qo-W6?ccjY5~@99>)AF~cC)?d;6kpvN%{H|&g=!J1=e zD?SSNdo~#UX9W11?ijI!W0Jinq$EuU2?(CLwYf2a!7o^Fl1eM=u!O|s zrrWk4z(_@_PgIyGd@}-R+R=AmkEiNL(L+F;)fll1)-sYQ2ZKbUH#jO?DvU)NLEqiq zr)gmN2;~tX(Sa#91{`fwGCLo&KV!4;}h;v%e8=epeAW3(4E$s|*k6q-()dY+`ayxHQZ1R%0h> zVj>ZRwriSLYRKPW0gK)9cQk|;D^ZmsM$+9|CSJF9EI%n>$5cOaK707g>~ob1)X%>3|&nt_X-=~V`m z9=+cFhP+kew|iW^v`84X_2hH=xW${g7Z)n|c1GB2p@|1Jm|UvEj3@>trS$K|%@qKs-y|11?ZA!c~-~l+_(19~(k~ytv|lax&XE z*U_dy2tfZIq;SK2GMQ1kuSQ$}-+96EsN4wD_^7?eh2b2E;&djHv|q_8YUZ zUOCfXD~SnRdh}YuaNhUslK%T?CT(TfEW*IZOn>l#twzx(qLUN&TXb5mJqmB_Atl?} zIq_V_hFP9Nb-1tu4WQE$qPe2ZAQl3+tn22kS1A&UABe?NE@Wg>Lm)aB5ufzo-JsJM zjJ|6sABd{;iY~-mB&$r=;0&a1C`p9LZJxH(9lkF}ZS2DQUkyUP^{J#xRyVHgJ`Ev5 zji3lko#hv1WVZN3+X!N(6q>mn(nq?mRXPi1!|~+E;MhRjnIR_JkwJo%E$?rX;adS# zi2E9ff#)N(LsT(?uS6+MuLTU|@Od|H8!(gk`tuEE;(U#*(Z1Iskv+M4cHiU6JDfer zgGk-WI+J&kNP-TOFtRZ>fdvQvKylcg%$WT)GSK0QZ(SFH;tenCxIEK#0L~ zpW4N%qCCPt!?)yQIv+~FJ1i*6+`;)L*{m`F!x`a69asG)vI*~Vu;PbKARD~CV$sOt zlBKAUc=Wg&b#nAszz^%ZzitQBs|XC)!vbBL;K}$vG!xrT6(zdi>h84SCY9ESL%7t> zX3Z4(LD;4*XZ)|uDqdo`e6PMT8R9xO+OXH)2fb#{r0oTgkzK5@Y($2}@o9wOHnULk9H&j~eIUJN? z`QQcLf0D(-$FA434g&%PcZpS;ZWaU%Wr4QYyg(7lJ8uSu8SGi7{LcLI4B5sKZ2>dc zzK?-LjDIj{!4>`-inzHkx?=|E9yAyDTjQMDMVFrjqUYCH z3x_&bCTa|X8S2Nh(&Ix1Z1OPzu9ew6GzR(HeiC=qSS0dSUUU`*^Y9{{-)D_aohnO= z-D0t=nDz+bRENc0wsbHB%&CtVvf)@Xq-a|QDC@i`v)F+TisePF`2mQ%)P7!-Sp2{& zCR6=xF+!={4{UIjy@AIb>P{5tVK)>-so0)KjLmg2U165B9Ie{VxrE*i4gjZt|qGSOW^ z!wVQKB@rUC84=!X!0J4mS&OO}fhmC3V<3e@R;nkWhT@3pu9b2 zg6t++u-{K${oh;7)w?6&G|F-?50PW@#wskCv$UjAJ>kW?#b_Ng9><4*9+h{w+`+-y z+YU4t7m!i=3KGEBt+#xsP=W!yr=K#SnfRCCAbr9C-1mK&4_bHdegrmz5h+1`7RU_; zfEYmecl@N3O_bWQfLHc@$Nhe+?99X^bs)Ce-vy7v+zkdB@m^)cbS5UE68Szk*j%T= z96vPh<*5$&a9YQtW2$mVT~>xFu@zJJ%Qd}2-&bE&ec=QaJfby{``oI5$vzL_X)9W9 z5CoLMG`fJ2P(nBSnX9ciJn8HI%XCG~q~=Jx#`&P(bm^X>b+xCK!DLd`_a95J!5uvV z`@^c88ZH6~_F|c0O*Uh2zpfrO^NLA6UxjlG_b(!t!S`@;R4r^yc;w&J%pA> zA%b;y1iU@J&z8W2v1K^t!TqWYMxRM;(c|L%EP{j+FWM}Q09{Xdas(IuWOIVTxp$g7 ze*dq668*D6Ma-@1pz%rKLkXMQv@FtL-kDyH5{%+FCLY_8yGaz)dY9De$X%k{UH93X&%X zD3FM2I-c3>~4`NCsjI9>HquxG7AiaSx!7_JH2JdM6{XKJRr<_fIyj z90Nr|mh33NqwY?AC3M7>-e@U};X!F{aLole>O>yZNLC8k6TWMtQD12a#T`>x0EzC> zhLrAz>)*B`6%;Q=1Z^vlY_#mDq-qy6d0k5JPbt!6e=Ao_Xr4VqyjFrdu9Fr@j<&%K zH3W+Tb9wA$#*yGKZUiFuu`UTa-bnZzbs)o=mWqNTGszVS*B=T^;y~IuYY7_)=$Nhz z-bgomcoNcUtU5+~@m4F!m`Sz;5)=mU`fiHfp7Bhk2a*p*=7j?{I#!rtK0*(07m`5E z@J!0&JUd49eXrNeC;{{^8ZC(UX{%CcmE8$KX9qS&pHC>Fdx0|b%M=Vf#j(>>tYai| zUG{eaQczQ(&T^#gPn@aQpBo21L2_giF|fO9rH`;i^D_C=5yP)p%oeRbO2#_ zt55=pTvK9AbkO70_x1Bvys2@-v6VuLWHM~;wi8b#vVKCJ1Y-e5_(q=rg7uRCOsGhA z*`s0szVRaWS&|arv(;7vjMn(8jGfq86hP?x;ei#VRJ#x@?FkdSp{bF?eqg_poNObJ zKDS&cT8#`ZioLFJG;9C&J(O z6bY>j2ca&{##WelGkt>wT+X6Mzr8)0>xuBsu#JXD_S`8(T!<&|i{g8?Yzj9vX{<2A_(j&6^dtk7 zUa}0<2|c~@rF323-CI3@vFdJtaIRWRG5@vPA)S+V{@R~6K(xl94(lprb&nr~Cek=9 zlzs|1jz9388uJi<$4T~ZMrXpY&oE(1RxexsaVuDbL6%DyXdrQMk4HXiV#w0Gk<8C; z1{E@nYsQLlV>grMlsQUa034`0{R1xutW^y%`YP*@Qm;1G5oX2I<^~dw>o69eE zN*AnPi*GJ>=?_Q-Fxcm>jKAz@3Xg}wNcpT&80Hp=q|R^4ZY*5_^`B(9*>l&Wy~J)? zk=7MHRz$*)8A)LLh^kCjF5~%_QPyRACmVHc$*emWubWF7Lo!*L3z~(+zGgLzYOl*N ztNd+~)J%mhk$>mG0dFE*h*rob7))toI-5RI2$ua^kB#uD8*GSTUZb#@Hp_&Jm!)AU zVfEu}JNg~i^wBf%69<>n&^XBYs#|q?0D7$h`8g>_Sy!=YQr_R*45%#{clK3VZ`3{K z3s6JH$0;jFd7kh>LTE17J1N=9Y}z5W;J*shw_|EFQqa@TMGbSj$15$;k=+jPpqiY4 z+=rhLC|rehlPA5zW=B0h@^d%0h)Z}>l_r`Ej;-cpp!20L2rU4RDG0~k?952Knrf=Z zqACwjH@_94nG)I?48qUSW0Mm^Dp!;-VbegI*&D&gUFQb*zBOeq4WnZ6z}zqp!{=a< ziB`|Kr493QXSe)@8wN1XJtFbzerc`L3^u6HQL;_bBlXGf&9UM`x<0_j9|d$sqdgz`r z6Bg8CjK23*iq>e9BiR+OEHoO#SRJUbWAW3KIyM~I*w{d)1Y6K6I!tK20NGVGB?75# z1_giYi>)pgo@W~gpecEUc3hJ-Erab^rqyP5Joui9fMC|#!Ug;QUfk7{_`gPmx;kQF zzY$iITB0l&UUImH##^0G`ix!B$dkBQ2^2!45-wL6lky63k?)aauOX`L)E8O3{9-O3 zaS4(m2D+OhMr>!L`0p@gk0si3rPKg z1|RIc{vGP^Rq19FCR9_ZU?IkQ`y@t}eoYNX%v!I^={ppt^B>=n{(o-GjR?$D7=2|; zxUCOm%Sm9wozuwpS%C{4?NNBXpw|d)_spQ)!|;Fs!U|vwV=)!dZXxwH(5tJR0K5(t zBGL|MCcVFzP1!FuxZ-el!5|dXB%Ce4j}LBLk+4b5aiCI?g6U@%;Nmfi3+|Y$xbV3v zNZgSjHK1@oN`u3oyD&50S1yyQytCdie+RoCLGsK`*PZ-o7tP|8lrH4vXpe+Wmy8*f zJ0JYBouGbzPX$-!Iv0h`jw1n*iN-^M6T=`LbEb^;TlAG%wJ1mRbgRld?y#bsd}zy` zrbG5uREJ_)Lf_juinoSrk#AOFRgJ_+5@3+j{6ymVF+lA7cP+J6WSRZsh`Gi*agj7; z!tq+ZhcW!2RmuHPeEp_)iYhUZfAu<}l1Cn>$gNb2;i7V6ItpeQDWQ2r9)}dtB8`Xt@I2Jv!q81>SrDN`TtnC)VhL|)5PeK7j zLcO71TgF?R$rHj#hVjsVxQyX^c^sSX{&)u^EW1r{u`O5Qe26t3F&}q7K(phO`IEH@ zP$lSp+|X4K_(PJhY*!p*-sx)6;{3GDHQ9B)+9EqS%7Za)X1d|`SjK7_JsxlM!vE~| zX{NZHzGj%)4VoRKCM2zc0fI}ns&De_Y_9o?eY?R1Mgb$fe<3W9_$DC2T(y4kd^H@s z#dF)#icB$Px5@YIA|p+Jk~TnTQsrHK_+FKIT<| zh=FfhV5{c1sHQStJ}WAd!Hho;OfRhPA<N*N;h5ha#8>Lp8 zZ(7vzz=u%3>3x4ME9_(=4sqW_<2bmGbo6n2FikmSUirg&VVHlp605R;=!mX&tZbBB zPpC93_HG!vdl{$43V{x{Yf&9!w3pma0{~}tI}d%KG%oh$KnD5gEmA4H+Xdp70TYhw z>=@Ea!q24ahXtad!aALBlplzFy#*R`m{1ColRY-Mg4!)pcw@N+JwAzt4oON#tD||v%EFt? zsCwWfXt0f)febHQIDEQ%C=$4HSLi>7+ws&)(5D ziX69Q!NMQMCLk#RPHK!(vNrGqx+~(ed!Sl>_!s7PUqWnnV!<0@8-m~b%_*OJlcu&S ztzPd$cB}~SOWVI4u$mHY`*g{>hAdT_7B*H7*7~&efa54#&Kw3tvNqX6MrUu9k~K)UHGsDGcaAOnf{eN^#CD09gHeXlzI)_2t| z^Y|+PLU*dAjN&8QaJ0N^J~%l7JbQG!Xc%Onctv^5s(K3?Kt9vkI#*EpPx_Zl)jzVx zf!?XUNOP7s;{%!tjUGsx;f;U+NYW}(<0fLM5_I%En3~~&tQm1W;<3?gK^6MQ%!M4- zsSKxtyFJxJLCrrw7FZ?}M>&w~fwPS20`91=96SBOEbE;K;1=4@vw%SvnKV{(z;KO( z5$)w>1}9M=A=*3ol<;}JrCkIAC|O$Lt(;{@BJV z#^SrLb!h4hj%W`_mSxoiF(KpF&l>qhxFnmEp73eBMx_i;~5;3pt%0aL?-(fZZ6q z3?J!-pwg^DNVK>3LbEk+FhWMab6sBTg2}Pq!be1WC1sU=c{=ggdD$M_ctb58z$j`N z1ABPcN)EbsMk}!IT~B{xT}+*;AG+y6+XK5sYC~-z39Jg+3W>?Jx1u6IM^6zyc)BlS z710U(>9SkoC{<(1rhnKwm9>;%eU=bDC(ag_49#67nS&nzDBP?@qos}ftaOsY0@ zLeKOU>ZLJnN>*Ob#0Gu8=fzMC!Lw1*9jt&>%aDl;75HjXtWFT!p`O{z^O{o{+h`TR zGL^b$qZ(z=Tsbpc3-r5#2T>SDo1bmzGOO|C@YuWX?`NQO34R?oR}S?l_FM?FOBN3i z`6|IbskLv$kVO-HTi!MgnBai7TAvah`c{`+NN(rrzPHy!H`HR0s6A|PbI1y35ojkvqB#%# zU4$N-*^jS!+>x}msRO6!-ek7Ja*252<0%#b~w9+j#PNu>4*_DeDn)FtgvQW)T!cvvvD5 zjF*V4IlU<9;rPrcjf3+mygLXa{k9@5O$~G>qXSXS?cs`St}X!^f6LuJvK3*~{tC-7 zP;doUb4vP#i3@>k({P>3kiQnyLgg4F&7quBf=)9$mBkVT5T+!a>j%@!@H_(Q1dVK_~Y&h4FlxGe(1{@=Lc1@MwUYQgRtIbEyATqr=zzW2q20PL)h<$8cR9#XPj3%~o?>bnPz1x@^=>o5w zx(6yAIjye`3q5tYSeE!wvY9C{OwSFgQ89*(B`ucQV^b;Gk?UUC{i&SiFdQ7N%AZ6L z>1}wHtcp7O8D-R@LBI&UfJ`bIa<+1C-^m4)5gNw+ZBvBgD5X$@O9Yb=31&_HT^WCz zh~k5#n;6TEUTCbMUqTWTv+}-TEK&e^aQOJ`#jXP=MoI&ohL!}z zkG{C5iyRi)!&xsHAI0!~Sv4hy47WkM2pIdNXS88@OO~gA!Q1BE?xKRu+~L3sc=?PV z-22blb{$U@%W@R6=-rCj;Yw5Q@axvi;XdD@T-9$-}2SkrbVvV@5Tj z)sQ+n=!RLz*XUn&v4|ZsCBLkD-r8p=RtJZ9d(#8O)u=24JT{>5iE;DqI+`~e^xgdc zNu!b1{g(rV3yFV|Bfe~lX2yA0`Q!D-r>*n@3PsOuC|Z;J=N~r`FABMlYa(#=W)qgE z$K;0JM=9U6+*&x66p}0RCmNdmrX$b9?b0tn>9sbHB#x!_YDf!arh1(=Uysxs|_TyJUG4QlUzoHV)_Gn6OGXG>qIpO2g{(>C@_kuy#WETJcVS% zL;`Hk9W`%t;4Jr4ipIOYy{0K8ULq18|2z*4CJSO!Z7gYHO=`CxLdn~DPYi^FjKq;3 z8xS={RaBdR7XozwwK{o$oK>P^>?*m!;zG!o;c3|&M zwf!EIgc>L&SutD6f3CKI6v4yarZ_Cful7Cjf3uAMVI;6hNlq@fo;0THXu#)ZwcVSE zAyLVPAXgMqS5^GHQYQ4S&X6S>R zF-b#LH{0dy+uo=O>6qrAv5{3>Q|aJVKu}c(o6J2eG$vZuO$NMuM!^4(B&dc!YYibN z$_u!f??zZfozZ9mR+K{vPg1HPKSIQl634lCSR6OI=Si$CnM8b5y}#Jg)ahygL#*2s zQJXYo>|jK=$C^hSt5is?h%NJSN`IjUM(LAa|Fguf@p=P_TDGw?vYZ{2CSsT0gZSZ( z*|o+BCi9~vCjU0vdbm=heNCU~WrFgka}6vY^GyPoym{um zQu}h*e;lj)#DtaLS`68~8V%%FMX#~R3xX{+PXe9P35BnWwT%HmO)PJz_x4A_%3f8r zeghCKg0i~s-W`oW&s`8VwzDI+t`L|SE`lT31qM`T0p~H>MDfWD`D^;EsS(Fb3Mv~e z!8RhSx^A!eoyMlHMMqW}TUhko?}X2vc!7zOfbrJ2S=$BpWN_;}Gwq*3l1{~8Yp4x) zYkl+UUwmlhlG0K_vOCCGIvxdTTJ+VMUcoh)s+`jI#ncS?dQ$5y4*t|#M8%m&jT`+^ zIWdjYVx@~G`}Ze|futC{c_}<5uuXkSzd4Z5kiu6jykQBpF`B8-T0c+OgoRlcZ6*vJ z7S)7hHR##K6KAVjJ)f$^ZKXUsxK&hCW;@*vNMrQCIe5T;3$ig+%Pw2Mw>GQs#%T)Y ziUObx*dvHk77*C-CLIu4$W>n^y~i%oXfIC?{Mn=iW9SCsvg zzvF7>t?$|c`mNk6D~%_M*HF#Pxt#3m{emk|S!K9;r~9Fm`LgWamvy{ekwL;#lTXJE zOWKHVCm&ZGGa+IGH3k8lx9~y9Bg|G0jloD$5~a^1UJnStkxQUf8OOjnAxMnX&m#dR zUzAn{emLhLLQ1_MiTUW-7qn)@iL(_A=-E5o(T!eQoSe{V0{Z%g;v0=97c$)`G$aJf z(wcS`^FTVA61l9A$9p=Iny?yvkND`bjMq?8m4v)^F#gR03QjH75l@ZN@c5U}@-enV zgp{ChYsjYpxfJO%th!S0pIf-MPhWVVg~`25dVke5Hu|=ULEf5E`l2%A^ZxN7*)*%x zx-F_Y1CoZsD4nN(uujF^AV)$~^YP?oqzU+#jPrXBkw~+Su{9 zG+~Q3^Q6_GXcJP=iRHMOvZ9iU{P_d&&)xtM<~`Di3M4XvLCM5K7bpsO1)s^7AXcy2@# z)dhF@2crcg*_6n8b=RzLcCfTrf$6jAjXO?Ix1(CFd*md5kD6ON=ue72Ob#aBPL|pDa1?c@K9iwa-OMCxE%WM>6{`Gf(@S-`_kVZ@$jLD ziWS5pogn_txBmJrl8cQdU+v${DsP&bB^97J`)PPNSNkmGdC}=C^!Q^Nx*ie3$e#w}(xLv?*@= z-~_Nqy!QUQ8XQD>1fMkE$Q(wjD%th^>CM!2Acu!-J;EMgG?(a0{q=5?$)>}=_NpW* z52s5Y1PL~F+gs!CRd+W5%{kAKv=A`~3NtF^nSkb_v$s>Ls>niOphih3Vg8W)`xTi~ z?#F=#Dev3;Ww`ZhFLBh%NjO|K$Sr45yZbAYz+kex?|KkS4><$!o(7O4FkWhEuxAMQ*f zCX+BKvH0Xp#`E=#h`fBvpIpPiP#}0b?m)8N$)R4~TrKQRV%0;Mt5k&tcUv*)o>#y! zK^1FXuS8>v^Uh-WHt5~1NP{0)ZSMEvo12^Jo)sv6U$_6S zhOaqyJXnXwi!a~aC*>@b6WAWE3EhtWq#U>^O zMrQKj$Sdkb<5}CX)~4ZsA02gHTTqeF1TE&8N?Mr((d%Ry{z=)5WquDJe%m<&+Vh#AtYLHZP>OUL<%+WrwRsWszXJv~` zTb*Za3WbFggNqYNzW&oWr7(~Rbuc?I4tq9F=7tw52xm!FDDjdn+zrNd)ni*Xg!$k_ z4}q%-67SD1vfRq2X*rtD_zDw$e@;k46Sbdcc2*tKhzcno*%wZ5fs82`F?5o^vu0LQs%>S z?PTc!X~D>WgQh|{y1t42hOzOiq${N&)!ZNiAN=`}iYVL;4ziOz|2u7e`q@V!kihwC zeb2xG6o#|3oKh^R5@^{*!+*IR*ba1Y-1O;J(LZK!9-_s~Pl^=8SvwbO7{1{X`@BNa zFgd#N-Ny@}yQE8lypqvr9^1f?vJm5(TlFp{de#ZxU9>nMYkMq2AV)kZ7rFMv#TbGl z<~99lWj!6ge18uod?qCD^>+1oLv$yyJA1b+Y%lslA#tPGi2vK4!k0^We8O^|+K`D( zyXzGUZ%-HSaAlf{qh`I+tymwQB&BgWQSw5!wHNv@RQ-9wY%K7yW}FDxqq%?(cu6=I zK{U2fWx#=gCI!L?J$bAB2NW*&lP_+{eE=TA?tQO$sYpO3KKe9HRBT1a4OJ8PIvtyW zVrEQwI`SY{p&vtLB|JXc9oHSJfVESvvIW#ixA$D1AkJpK+2L4PpLH)GXR~VV%29;) z_5WSxyonG$qysV$B_*i}qNIM`V4uy+_WJn-+hdc?SzlPO&iDk2K*SL1OrR-iM-h^3 z;0Cv!v1YSAY+wqf&-h90V4ap{N1{kX?+=HVNh*+NZVbZHMZ(T0N&WMT%~eP!t1VF=MU|UnI%2qQ_Kj21UIofEEbk2Zbu%=LTqwFrRQKN$h60R zyd&(Uuc(=sNgoVUv8+1YuomJD=XS&acd05b=>4CSdk4aWDE^3|CN8RAOF?Ic5c(^K zv7&NR+HYX5enAe~K$Sf%&V+y8NI#k2aGudz^0!hz)^9=*2{;pYw%xQCdSj#RM@UfC zu0S=4oBDQ`KO9u$7Xo zEU3M>{Dm$s_3!^|p9t0)&1gX%Ttt}`iObS?ZR!4$qLHb3BR}=-wLcWUxa%2kf+Ddb zg$1SW$C~4z&{u@k|Fdr%AH;kGcnE=-<$~KP12X*}Ult{85kCV**8Y)eAA`tRuH3>=*|M|`>$Ls^xv^PYYG6VEi0?P9-a(3`> zn3tgsjBeIO%qa2PFR&WSlIcw0;8JY6-v#!&n_7z|VEc=31O~g`BCqdRr(C!7qt6?N zFT0rRwi|xdS{wr$Q6$hsDyF+Het4_h)->=s9=<)2Y`qZ+?}$2Y2f0zH-}LT8u6BD; zm7@@We0+ZIJ5KT-_*reCh4V_#w+T!DR8Foy6|eUmA0@ddbNO<>9d-Bh))Yxz~z) zv0!l7j4|EHtYN4#n%3qGr#Af*6KbiwwD=|IjQ%kYzgqi^K&Fvf{Y3zQ^~G~z-&?=~ z?-M^9%T&Nv9s`y9bQw$&C&Q5%^7;ubsK15*kcbgp$^dYFmI=D8=VV%*s}kpz-^x~| z?f@^HQOf8wLPc$5J4T!UzL*5!7*Mp>FGYy-kPQgP+?yZ%aG^gur^mOoINUK$a#fiw!!(EWE^7z#RS z5y{mPb;g-w&C}XJc_RpY(#bKOFd>4r(G;s&*NCR5p21oHMX0r;QDHY+e zrq8*L99=oU5ISlXQInzwbczZ?rlsuHF|i+#GOl)m)v4O8l+XxhiOGUm1+NHM0jMW*~C>Ge&!uBrYk_a1v+eM4?YYEceO?nQ|nB@#%u8Ux>j*-usIp81VAiDoJ_7SYkI#e#-%?lgD{=7AoTESg1^Ix zIG^i&4I1KBTR9B`{OQ_V`eK!Hk{URcfLm=|1*;&x7RBMg3KTsOYKWp}u5k%LwZ5{w z(g&tJla$ zd^PkbGz<8}Z@T8cz>QV`JEf1+@e_f@$XE6kgi?>*P0ZQsGtoMi4fbv~Nm z>Tv!t*26bE7*KC4ofP(J#vQInjSNglK|-DyNd)nn8xe%&QL71%;sNP=gbQh2lf2Mm zi!I*qwdBD#@TP`n(#*00tXSPRYy+mN?OL(P`)Ppf(i$;Y-kU+r9P2FKZ3@v;gtlu5 zqN{PDCJ{{QWRi*!|qnX_~tPiJ|TH{-ayF}%1G~q5Kpuk(YGN_ zBreyQUJ8uJ*U?eype+s#k(A<`yEn|`?Jr;rF*2F79ymTaBYXWlaLQB; z5hEjN)Wr_KN%ok2Wnio)gx$p--k11v^#)grO15}L+Yho;=lyWLY92FDQlH=sl)}vsR1wZs{k< z0GI2rEPa2h)K4Q44lT*fjgUaC$jZ?N%%U^;Nk}&QtnTTELL^*Bk3UUgt1?`Xb_yNl zZm$pDaLKYf;3$}ac$Kssl6XH5<-M98$hV4f2#duLv1`|hl(PZHG+}T}zN*{Md8SLTP?uAqRfpKfE_Sg0T27(!#KhzAYsjksPjPphC7@>F_!1Zi z>lZPFQL3i#VljG|MsmC^okVb6!u6jnNMspn7w&9eV~1bou8WT=el7}9hKBj0&pYCR zoVdmKvjj2dCd%_U$c`-X!ej}!>RfTW_ugXK;tWOzQ&$E;_@*dIr%l<7SM9;UhlqeT z84iKS{3~SUP93c~))W!l>N9ce6CKhdU}1j*II?7X3@M#C9z*keL4J%|DUE#?!}alG zQq`l_Z0n8qUz#Hp{tPG)F64)!8^q~dkn>v>xK!qlq}-ZMq`}!FyNmH^2-ES<_!(%) zE9dQTPcZ)v!$3U0f1)>PB8Z_;8xoaYNcw2063<0zX+1bb(wm&u$m`7>#Cg^MQc&4I zO4I$xo6qTFle-03aygV9EhjsMIFqTDqDaZREkw<_A4#EADe~G{7qlFDF1$vnsg%CiFoM`jIYmknuT$C9A@7o_ zNk!r-(nh}@VQTrFG2O|!yD?0*$mQkkWYLuf^7ZmmB4_MQQY!=`^~H8#(|bL8d_+r- zqd^%&K=0|vrkALCzsZF{| ztgU*HINJPGBs?c=6}z%Jdub07vhFrhXUfRhzMaU@dokqRJS#H!Ts#fqlLdAl_7kpA zH`T9$9LS}J6tdjah%9+r$cDwfK0yM7P9e$nNGp>rBtztFWUsp_nSLXVJY3>Rnp=$| zTej~aFCy|pN54}Md7Icfb|(Q@0#a9+O73_^kc68Hh@T}C(sR;2Qb9xW15c73gO=0!6G^BE zNlt!9CH(4S(p|@d1kkp{dxJBv9(9o(C!{X%DpAsQC0W$NsVXK<9$q1|DHqd(8#iu{ zva%nohCd3Mjy@#f&ePuwZay|GnTFxRhhhBUt;nqtg|nz($^dP={*Z<64^eRFU<5}C zGsMMZ;%T@f2KQ=B&lf;mUS8PiR@TJOVMC}}8g@3V5Fek3M;EW6^4DYA`6+LUH znOk8(Hv`D%SU|U^0I4)BiDoS@+{2A62amD6;s3-7x6fUJ)2ubnl?4oXPJ~5$D7;IG zA*XJI(E~csvlL-%03^gF;>e{BFt=%m;CDVK)-*u+%Ueh*=0Q?-Fg&c9LqXRHt@ufZ z<tU}c3AMIv7-^i1GoQ6FePBz3#?`_1!&fX? zJqI5iJ%k`G91Y#OK|@v<3PqtfaOp1m{6E98&kU$E*=~VLWkR``=rvFyQqtfF>QE}F zg}1pWm}OdxQ|FJMyPhS^g*BP7!pp&yr&XfWq^(-)|cRN5*la_}Op51zY z)Auv5blZ3+K@NS_%|zbQo5(8TLb06(dYULf#l#v~+%zQS$KgsqIohaH;Qf0)$Z9L& z>CM-WpcT4}>qr=>NWjRZBkD4vP)T#9BqM=l8d~%?&_Y8SpRXUr?RS2NYiNVM);jF% ziTMSP3LIQN3&VyD$JklRktm#*^^K9^dcg0)X9THT z_>fajfE4q7MphBshKz@zlmt3;GDUiHG+tl34BgS|(M}0aF)&4QZ8cQa`r%oQ85WLW z>Wms@&F_jkSKeayj9Ezd5&;ywL}iy#=u&zU@eRP|>N51RG=i3@46g0nf;S&NpweIr zoEqPZGVr)m>{Wjl@n(>rbu_<(2hW4=5P5MFUfjKk<-?uPcm8!z3?Z-2ABL9uHaP1^ zKwjMlBYWB6_`b{VShfn<(h@KqIU8z8-U!XEgp7$TCiF9cl(G%zHD+dvBTp z8Q8W}!q?a|+`D!k+UENB^8P(isTp1t@EFnA4OEBNV@!7=NGh4Yym=|2vzRtO9@26u z?5MiDk|tye-{au*C-4vd3P-nz-`=E&`Qt-va`D@Yza26yvE$fPJbwHHcaCp`&QBJ8 z7(BW+LM|P_gER|tZvoi1Z-an0cM+>#fj+Hh1YVOFfK-5(4{8~Bd_HZI3A?I}tenV9 zmXL%b)zgF?V^+Iqgjpe{uBsYJo?{{D^AuMfy@kV&5$N7g8rQF1hGE-&G?omGz4gQ5 zp4y22cn94b+9R+;cs_%SWhY2w1tahKX0DVH#3TYPR?O=tIp}qpiG<_?L_VB_D?3jL zqlgd)0BPx_;xAxV{%PFkmF5ysG!mcrDw!wxNRBFf<^yHn{CVo8k=eUq%7L+rD9jR_ zGSnbq{z@@7&mu`13Mtx`p_!#WQIWBmRy9yhOCSw~@BzzKnH}Q>(Xb2?qV5~vi(#_Ft?h)i>CE?sm73@FxRv3qY=8-UR-o(HM z%_Gw+G*$x%X&HKZ%=~u(K37!NxjcF=A~~dP33?x_q%*5viGm4V0!;PdlO}bFrX@-1 z6thGw_>FanrY$KzWoZRXw+00{nMg^DL#0X&oH;ZVocekiRaCgl&drjv9qw-?3Leq&&TdGvPWI zN$t+ImNrNZxQkCYQncfvOk*^y2vq+!2(=@ReOAmO4!j@Q17@2LR{1t*4LmlmLUi8C0v{ zkn)q&27*2p!^MV~Fd_lHPD2qK6^FRM-S9fG8~NW=DVrrJnWhzi38S^6i4JG>8|Se) zoQrx^e0ktgMbID;Ww!kgRs?pyh=pwrWNBJ_TF<`KDz@&kZHA}~VBoX+r|?l;R)pHJ zLfRfABPy~2E3aHadkrqFAN0DS;^s5|zO@IUJn9TU#Fuxll&!$?!xPb_&kCADF@GNZ zgRS$${58=SJQ5{$4$gVVXi_m7K=iRGCJ*wzdII zy`2#HM)(0`YLGV)v&+%kXd2qryugES=F@f_u3QX;+h9kk^P} zy6IT8Z6^{%27K^`SXlLN5qd-n95(_V&u>97)vwG-8i8L*v3Pdo9vZ)|pbGQ*$~;WtLydCklA!9(9<(Q zQBg4)n)~J$9+wzn>f{O7vuO@8zQnQNV*Ycw_3w(yYqmjav^(qX-p>S^7pzCuZmz6f zK#gz?^FWwqLygPEXUZ5PL{S@k9Od!!X*wJB__aT+8};ZkbUgAN9zZ4|DkVX<86%6) zJ(SVfxd)Oj%|ddsanMju#ljACn13`J-MU!=@%OOlZ7HTtn}p3rcR(ub3(A|k)v_3| z99@#`V)MNKVdKlqz|5I@(SO}h=%+u%xZO8U&598pL4l>{)yA(p z-FwH$=$vu0z~ zBo9_Xg>1=qZD+3?%v-obT959%_9gX}#ly`zoArhr5LVesF(7WFO@A&XLM+jkm0 zC(ppl<(uKzMjByFR})g`h?OI(uyNW(2%8Bm-X56)Kix%GJgOVQ$#8z&v3_+Q)k(_QS$BvvRm21PG1GJbq$QzQka$E z=)H@KWTri2nnPwiX~I~`lonD(hV}u#KfsH*!I9tryg9|v27sCYIJN=VOi5l=<2sYS*frb8v-w4?`KI& zn=%pmX}ML$h11TAm_HL@gIvr{aKtcIL%7*7uM;Wy9pP@)8Lp$4QEQ4+GdOp#gA`Rp zCU%`*peh_yXr^ZYD;;@soOA-iIo=pJ#1j`1R4}-=C2FaXdHD1kUhbNRVMF?%de}+q zA1?e*Z_wC*=rLZHc1veh7}~VM!~sK(c5R)v}Xx~_V*ALT7 zk}zcOaE$Qqz&p9YRH-he%GnUZjO#FAq&r59aL0j|cKCQ}f#@tD?MCjwm1zbTGH@7% zdyc~8PZ=0`b5jeJFy1_MJOHMMkJqTU&R6j%zsQv`(AJ`(SS!MeWAbCMA(};qfZZJ+7%$LZU6^n&JmSuhc2C< zBpL)Xv~qx!YICf-{|vQ9C&7KnJXFx<kr8qi*ARs1FRAzSWX7!{e_Xq2#w0 z9z#cB=+Mc~oqYorraJ&8{oq{wjD}GeAL@aeuDfx35;M)x zSk@AUA3i|Nt@#-0IRM_RXXC*FX9yH^U}ws_BBLrmMF;kl!g7FIb9QIddHTyT)NSt;cQp^uYP$%smdn3o-!@ zwu^L?nEwLC7(Unx1MO{v-sUD4Vde~*NmE36P!1hkoS{f9MZNZ&V5u#fBq68W7WQVE zFzdSkD-BZNHe?8Pe5}WaL3UtrJD zgvaS*JbQQ%O4QJ|?PL#Gc2HUZ)}1<|nW*lYc5*}uS}4q$p*IKSV$!I=I8)mPA9weI zro&9!T-+8OZbRX={4#djc?*5oGMYMef~JDd3~OQ90Vd7mVNL7rbp25D8BFh$-p7t7 z*-%z$jxJ7i>;eD`ruJRXLb?IE|3z0{Rn7<{8m^6JBm;rw= zV*bup_n!iHGx6t?V*Y)^2Dun9{~>)Qtw2v>@#wgizcWf$xM~eriATr9{LQf+u@sZ+ zm@lxzi23C(-v@{daxr4Wh!G=3j2JOu{#Q_oTx^hw`9ne~(s1U$Mr^w5B?|d@_LK7vCp{LVg}TpIK5+K^L;9~l?0?SW|NlRqe5eQx2=XYp!4VwxZ!Hps;^r7i*eT1miTpPwiI zsEL1!wyiXAz_%1tQ5WFgwo-KDx8?MTF^G`tfT^CY*y+&$7a~hVN17tQqa8ERclam_ z?dyc`Tkf-=I|sMNg{Yq_Nc%tL+0k{l`=t`q;iuv3v0fDV%Xqqe5EfqfBJ>moz@nWS z@`OGyzX3(T=V8!72bV&bWjcj?IX4LsExRC`8k7FJJTP#Ra4Emv6n+uLPgsW5y~m)3 zUKIvg_Ck{A&=1t*VAIq=@EA1)13Q~x$ID`Xn~nkIJ&`Pm^2eYGyA~}*G6(S8=8i$z zd_>{DjOATT@i1Mu&UNOS?Qj{pk9CXrttiFhHWF}Nc2DG|BAFWq2R&KLx|9e(-Yc|s zn!v7_@>}zG_f$MBG{V%8Zn!$LJ9fSnE-Cs`J{((u9>YdrxLXgnFFwJBU7XSNXXF2` z2)Mij2i|0ZJB9oqzk&%V+T9FzO)Uxq1^BaxsN<5D#M89rbV4y0Eq_43^Oi4je zP7#`{Jd4Q7vvD-h4(}e_$7Anz=r5Ou6dImP<0pyYvn$V%pQcYugX$Xgep8ZjM9Q#% z#z{j4J?EcMRh)(Nj7%CQ1J$Cz7hYWz>Nq?UyRienqxZ!Hx2gbX>Dg!yjpoQJ zDnnixP&RPHl+oXJ)GRB^5tdEh_^RfF*EaYo4=(7dd_85aPuHRRF$;qP6kCtn0DU~UH18O;ZDla+6D-x~(TqSx& zCH3Ej_8LkHs65fe(I0B)mdiejefz;*nBZLgNd!65?0?m_7)Xt+N7p-OOxJ z-KZ~R<7A8S{sV-E!W@x&=6v52pthzOd`=B}USX*)ZNjZXbpsC-g|yyKITRuZrDn|_ zNi%QiO3Sdji6|V%&J>j))iWRsv`lGzrT)yq#%++Q5FeL>?1t(})HXCAKbzi5UXwRdHDzoa$jHn_Wxc52#rzChWYRuq#Z>nPDV+7A?ljE5=wu)4NIRX z!te0|Jbe8gQ(ERBfIi}k#5fv1g^e$i&Yz}F#iF{JD$jb_9%PB)@M&IYdqDN@KO1YW zEu(c>)E<!?mCq3uB?szg;!RzVqxvJ#Ncw!+NG z?%#Htt}6LnhKzJp6bj2GBQxh)+n1FbOY3$r^2*Cl&r!wX`Lm%b`hLX4R}220B(8+ZKPaI$guQX*!$tHZCb9R_sB$ND|-=x;9rp2Y}s zll8;=10k3>z7JBK?ZAW`_feD{j|&f;qpeAE4DT}lxf~86zciqebuAW7o{yl^Ok6l| z7P1CiVP#N(*&eeIK^xV;chB)Cwi=#Y4Y6~^DBO+A!@I{95mVM0b}EtByyGfL>t!LR zOUL5}kC5LWh1Bpo*bH!jifCi9u={)QFvA@4$2d}-ENoo5LNUz?+YVesAzupVk;Q1= zy){nE9*?_GdGLO89#Mt5aJ4tUOc!Ik%;6)@ z1%^9^7UD%@8OKVJ10@wX$ras-eK{vD9jks6G@LYW73`{C`yaN*?Ui5W?_$KXE)$eWClKc zxPzNva`5b|f@8b4(|i+@r{_b{P#T+7oyUZE<51#r8k07hp~g%kjvRXdhd~2T?Y#+h z!w*o~DHD&*U4T!C7Tg?6aA^Ky-2V`TxR@~9xbp-(h7M-8TmB=HP8${#6%{mZ-dq&& z`%szu0k856;ZPg^36H605qb`<8XVC&HyDmH7NO?BS{zR?!?+&Cc)oKaR@_cPX}mYK zJj;S-^UrXeyce~lS;($4gj&Hp%-C?AKBF)kKK=#{Zf;O1euME7_8_A$4KJ^pKx&Kb z=pqx2iPM%NDl;8tj$J`3``)MwIEQ1m1F3Z>hk}BSc<>?+0%;!Ypz-0<#ay^cEUIyQ z+a^fa&%$8lLo&sd=;GWSXT!QJCk&q48kIvH%(N1|GZXZ1gf1WY=+P22!{YTJe=?awGT8lGTmKfX3 z0FSnh!0NlyV2XWRy=lH z%f{4Uo#At68rIwlMrPbg9J-K#k;A*-#`qqXa4QV_{4Y4W`4DP44?#zb6io44im$X& z@!{!Ryv>opASZLt-TgTT3JQX=GqW!D??ENi-A^%UydB;|DPdSQMQq&o79RatAXTXs zCbY}KwB@%kcg9c@`klte)n`$VnT%TxAE0?#3#{zh9-&o|hzKl%Lr+a?oH!A0<8$%& z##t0fS;Nsn5u3(OgjYl&B18Oe>-k3vcJGa|^E_}eC=a1tSK%Gk41KN3v2DXKWLHUm zLyb`H*SC;TCV{-zOc=R1K}$|p6H>iTVU zx}g^3#kn9GYCZ(x+azQ9nkSeu%>#Kp$1rOBB@|{P;rfGn&@gpHz{N%I3d=!g z@I#z!w$sNgp2RWoB{1`ECT1X?tlJ*AHB%nxm z8WC_wLw*3!Hf&G6RtbZ)_0%Gh&&3Hn(I<(T%?J|td>euOcwrbtK!5M|3?&Xz&je0c{Iax_v{ z-XC_k6UXW2SU0KpOiWw1CCSt|ynRb@F|?cw4n8uDbYFCbbrVuTJS{EB$1;((3F%)W zNlaWQ>7uJn9%d8rd0Tg4yY!y$VDf3AYUxP|i=v5^u|3IW1G!|Nu@pIADG*9zco+$OeSyd-*^&zCe>ATH8GGuB@L;JQ zQCD{+)ufyZwJ;#p;)TJHhei?O=~qeW;}t~PWtlLr@HH_tn?MNf4S|FSq1g~pmrppN zYyFY&@$n&viHRcLf0^1mwhp|0^^*8TrHKNCWWC-*EC%l&m4RD{^Qiq~&-9VxT}cHQ zWTZp9=>zdy+nID(`+*dH+Cy}lXNu0E;#E)2eYKGo4qhn=$s_$u4avPEp)YXv5Ms07 z4tcoPhBz#IA`D~@RFai0+GPIS9HIZ?P9kqJo>UZtlGfd)3d4A*#7d^gGi*Z6oBhPP zofXkgQ6&Qw9w*twG*FOEgM9z8~DarOHEi7G0p-2`s^lC#^ zy{Qp;DjpK^HXcMIo=xD9(9kdv@Z<W>D8(Q`9v@Ac7+q^y2+p9`)nin-RBGAQOe63>vCjr6gfMlIvbLuxS?^O!o-TGG{q{!@l6i-;G#f>aqRpzc;p@t zPg(i9LAXdw{)*U`7{n!|q2VX*;{?10$ZI=eYWpAzKL~8&R8~QnkAeN&rNX8p|CojbGNfYrb zS%8S3FK}|}EsUpVjxK7F2u!aAwJ1z~iC5<{w|HN$PdR^Pn)?I(G)khBSw} zqXVL8xCA}7zE&9jlW!!Pzop*}omGL*%t}ZqYraaVy%4*Gx?<+Oy9f)71GlOHg;jOzoUi6Ot%XrcY@uD6hmuMfu3-S-vgFcm)>o(H zTnK4q`!))*t+I@qJor(sP}-^&+KX1ll9W*fDG9;C?v~hoI{;r2G9X`5jBI+0%jJPn zFPcKYCy_W%v>oinC`=peOGE zjJixlWeuO!AwJmeCpnpT_f-a-14TPtcBSd3B_OY&8q%7E&|+kPpN9`gMfm!3E0!%@ zf~A}8K_JINU6VOtRhhn++oJ>aJP1W}QVwK`i@Co1v+yDkJs7MU3h_7`J^Q@in&+$P`X_ z;PUvW6X^i~ql;waQ5N(DJPQvPh~&9v|1Jm*jAHAEmX019CMl$ep4`B&jF zdpRagoC=@xe`n_IUll&GsVv0A#3C*s1&y-^8)4*6Qri+MhnB&8#z!ofdN)7LVW{a>o$;eGwJs;R>zx=GDs_`!NNeB4gC@lg5s1&h^oFwt4~<4m6&J;2v`wMqq0%VxswU9qRv@p0%Diez=rUV6 zQ*14ak(!hRDJhZZB_RoE8QP{61|vhK}S#1MkwM24JlQOo;(-JmM_PmDI=l&(^)i(Ax!^_UV9e%_fBJ9 zi}RYy(<6L7B=k%mQ=UQ1?j|r%1Om|PU^EIji?$KO=MFs z@Pp1^%V%laIlluFCrp5|kt7;tcrnHqOAgJ8ax17PNj8~t$VXBh4~DH(zg>%gDMKk* zhEk=eXu9r7=!H$Vr#T(>_RPohh4X21(ZCifp?RfNk1!H7Xb3GEIdv^)NR%K?G-1{( zP89eZA`nXQ$~~vBcl}`MsuLO^A{d#}rsbWV^5bWdOoxkoUJM%AP!*IQUu4u)(r2XD zN*jFI;SEbm#HGXg(Z2i=rXP3@OI=AMWeDS;Fde0;s!&moXQ#Wd(7$~8+#9#f{sy-e z$?SIzau_yh9G0Kh1+~mb6jg8`py#mhWz}Gy#`&Ipei};E)S$w2uBj}tNXeo(?KJkE zz6E=BZNrwWXAu#4A39B{-KR6_;BB}NcX!Uj%q26RBO@}*D3bJihQjnrXtdT7=9|hM z3#SkzL=D>NazClpe6(z>i@X%(%a89|*f0~y6VBt{ipf|ubs!XFgq;#*;S4Eiyf82+ zGv%z>+8Ba@BnUtC1hUdnphKSv^L&`}8JN7#r-FKkmUx_+gU6@#V~BAQhR-_49{+oz zfI(wsVfpf9SUhXuKUqg!fLf|!dapcz9jm5Noy2sEzH2x_ABv=UD=2gFQP`+3 z@7HAXn}kT-no^aW#I{MsP9B)ObQ>mil*h+#Dl?Mw`HSM~80sK5rLiK^A+f9+ruypa zN?kmWyvWnG%G_}XcJ19m+k>5W85NHO_DxKslvh~)G8GrDAE6z)3Fu>`1g=P~B_u`h zs&i2;se$IIGVIDnjm=kDdI|JeH>a}sy&f7Hp&Fl8 zkBYJqK*a-#I!0l}s&fbl{DebC58_K|HC5cTB4bnz+xE`EgEh18IwTNVCv8W!85_|u z`xbhRUW$OwNZNDPf}^7aMlIWn@;j?=!!Huo_HIVK*%WkD0!qs(z!fPi*MWWE|Kv7& zy~BPmVB;TegX{EN2nhK0t`atJCz3}PrEqwBeL*HdvQFeP3ZqoFx?%srk zc2m%qHaewc-_swybPF2Z9>$H2QHY8Dg7f>9A+E`Qyp&BJbX2LrlUIRw|M)mAL@@^m zYlIZW`XeUn1E!4Ij()2)Lq}BtQe~NV7Z8RgCzs)o%2+J0kfYZtM{NTSe6FYrn~%f- zn-EN2bCH(eM;ttH6au5(P|lCS$KWtrKe!gLw0pytB2Ilgk?3~^A87t^%WF_wQ3k$@ zDOQit#j3^o5fc6ei?)2i+O<=`uPaAIwa7f-b5K>?0J+L240ZRw(@&Ae%aMeIixZlQ z_c8iem}gW~E$r!74VjH09hf=n98_0UQe%X=>Z;i1X)$gCEaR4A<;713dH)de_ui!^ z^HE(V`f^Lv0joUKuzKlXghsr=(w(8$v}p$XPR_)Xt=AA05ek8-H5|J1#>Nf9ac;p3 zy!-qKYi1mU`{MOztyG87O3_H5iat8qE8^Az9|Q#@vLAf0Nb_)cwL2#6d5n;dkJvYB z6P%~5fQhaN96BiA=EDz&jIP0!onvrj-Yho#RWpynW9bIyHccPRv327p+}*JWKH<@b z3=6@*{aexW^E>Nq10hKNjL%`=IKOKn;%H$onp8%>LHI{6M18u08OOh3>*@)tF#u!u-hlh)|g)s{Uj=I5Z#u%Z$i=F4;yJFHzblnt$~t)encH4~3R zbs6(9ur*cv-4sJ`EX6JC*cbZ!fxl}2KwAy86U0gk96;L?8(BH!G`N1qTB zbG{quIeur*dBkeAJ$QCwH~gxcvD5{ybM24tx3}Q`@e8abtb^Kz%{b*9iHB#mAg2&EpWa-@u@~8_Q7kDf zgNo!(dS5F3uGl$a1wMwo$NVKXF=Nwus7O?ytWq>EM%(x5sv5|1GBIuBAl&kaLPkmzj2)aH zdRZ*ye+v1}KI&v&-O9>BT3VX^q}ZODl#C3u^2xuo9xfxu%p3h*yOuPQ54k4!V5Thm zTv8Gegc_K2kfiziz07i^vi>PP>XcG|iD^4@Y;XSU%XtQM9Ya{z*ub!*7EH`6VQJc$ zD!v7f%@0LXTqv*$2Or0Kt<=~ruZ!ts6cX!-=Y z21c;5vVgJ-AggJHk$ueY^2K{hH)3F}TB zQ1$5=uEhezid-o7oQFN*?Saa496WLjCME_bK}#Gxyn%fSp{_&kr@amITWGUoXwg;= zE~6GgDklVA;?p3bVS?dfr@*mgCHzCaK(WIJ%rGPbRn&zMUUCQl6gfTtqh~Krm%K$MK65<|IjZ;Ez!cE z)0?36C+Ld*uRiLORn~;5g*7bNG?4*FL(jM^+S^*8MGJkjv$lb$ZflI3Ivz28Z;_Ex zg0>wy!>NN6j7`j7uCK+OWz}~gG%Ldp6qW_YxtlT7Ne4y_JyD-RpF5RXeb8SE+LU?aEQbO8tP%Aw5M_00u(dT5e$*);ho1d= zA}!n>S(!PIFdL4eYdq)yN%Ze$g-E{u6jdo>;P^Q-{Zg8KJXHG9^e5BwCFQ7`Hl`1> zupNXR1{LuB^aZ(jxv=Up^M{W*RoZlgje0Sa&uFMSj>Bv>7qquB!-pG(kU*&H)mEeT z{H+*ft%8ySADnrSh_;$?s5k0Mjj*9?yU?0mk10cKT80+Z)-csGz^KWi5&8Z#GIPsd z(xD3mkDCVhq9{ZqWT4})B^cGmmev`4bm-j+<#GN<$PmE6%@yrUEnsfa5`8C5L1Dyu z#HG|>#^KX&RF{Sd)mgT79bnvC4${rE(YBox?bwe%tD0zpL?uAVzzs*1HcpNB^YHtA z)F}glHs-MHU<2jGWk4t@EexnGvqjt1+Awb04we?iXzw-)x^=M#j!p(q)J4ypUD2*h z8>(a5L6+(o1)UBUWTy(B_ra()?1NM5MngiQ9lB~)!9P3>`MkC`eRwgHl{7JSh$DPn zd7(_!1P70;gEAF#Ej=Sx(6&)SK@$3%T%l4Nim>=fm^s)|{VG&un$|sGf((47c_?aV zj`b(^z(5YrW#Siwvij3{pgZOabHck9UMQvMA3C-cN;G|Kn!crlCDdv9QqA-*Vt5yL zKY4}x+$;zT24b`m?G-d4p@Bg?&1nbFA2~8@v1*nFI@mivD)lwayvv4(h7|biJaJ-S ze;TJ+f<&>@)6Dy6KgPwPQ@w9#t;leQMHvM@r2!E>Nh9mD3ID7M1D z(G%d&K?%P8Vc?j!VZ*TQXw%LH>V^(*P)|W%L@~6@ZPCr4BP?j%+cHE(qKk(!iUNZmFtmq7OZgwBI{X}x)Dq8& z2|}i%5jtD6_~CWfFM%<}YfDlQ9Q+krniiiU4GWhpFj1EWmwCVQ1CmfwF2e357cgYi z8W^eY*;hcnHOz80YHDgwQu_IIElNsC;N#bdH?=B^z`&t1uEu`%kn{1u-qMqDOTUDw$#VV;pt_Gs1s8}A!7a; z9HIu@k|j$-J~4kJ;;u}?ROJ9AHbOpHO}Cs$(rcig;r6K-y9tUdNe zW7E<5zjDfogcKy|3vq1MUesxr(B7Fjlxwq)TUn2c*eIlzHb6>Jf}O{!pdb%<1qJr6 zBqSh5dnR&na%`BKj1;7#Bv6tTgD>f2kdc<5;q*9-qdhMWxp$a zX4*h$dH~*pm!Z9l4fHi?aB1IJB))WO41I5oU9C(DPHw;^~{6=cIt|ZER!z1 zW@9{2o)zTf*n1Eo=I3x)dIy&${rE;hQp*uxj~myo79-}b&#KeU;MrF6ErkgE-mCCr zV-v$fjF`VTZ9I42-m>rebg)Po;??VC_~V&>V*Y5b)1IicEAsww7~{4k*$2TAb{O8X z6HJWTp!fL6=%A?x&DMr6YN1MPc4<^3`Qhm4i@1K}0?u7{h-w8s-rT;8H_xBo{HbGj z8(l<=W@$9j)`PW)9yqnBxOM#z-rm1~v**s^OFo}HE{A%&e{z+kaS>N9Ucf!ycxpH| zG0G*SprYLxW~Qca>De1vNJezJ0F{{mc<3F+8u6uR{;ZoZyd@c{oEqb@GSZ0fx`C6Y zF5*RCGGr7LP?hu%C(c~Jne(@hP+TK6%EkOF3Yz+8t?`prUy=%FYp5&oh!OMGhnY^G zCikPBlvdV)A#Df5i21u9tI`q%TFpehMr2@UZ1ip8A2DKn4rYM(SB;P}Uj-|)Fo$++ zJZ?XFh5U+ob`=R}Sw7-|J|ex6D(8||9J}p{o`c7tpQAA%Kl!6pMu5=QuTi3EjY&i7 z;6sh`e4aG&V*?PCQ3YvIhIjX$LfLi@+-#L__1X&%YD|CizJ~Wj+891+1Ple4_!ynV zPF4Bd1W=cN`AS-V(yT<}N$J3*wF)W<5)m4k!;Z+;6eY248EN52jhFQkq8!QN0Adio~N z)>5IhRRCEHeK=aTg=!mPsMeOCs)i3~8Cgg((^H55%7*snWZD9nZH>Xt%Y`Jj6z_wQ zFks+dXsW8g%F2`(+-84`Fw;zmqP=nCz&5Nu^$Am#u7;r^vrL)vHv?Q!^1GWc;H4!v z2nh*+YAbzIm6bqEq8!l~TqsM`BhWtp6|#yj(A4_XADaG|sm_jqx3>@dy+c8hb%+ZB zZ(=|%2e_@fioBq^aO>>|w>77c93PMJpDt+rZ%_~$4li$S_(vv*LPRv=(VuXbR!uP{__`LH*P(;f2)h2$1%B)CuzZ2d|p=e3xe-A!VVuRrK!51Iizr(wb zAD3ur3b#5RF<-MpzF$vmaVmVhyz!o1lUdOs;G-YCUxk~~i~s=N9Z5t%R4;_ah}Wk2 zJxPxEgm+YSJ_LmSU~+#tIu(wteX;yT2)>-3P2K&l;Pi8(C8htr^7ya#>i2=l>N`Yb zHeE{ysL73G>p_HQO|#mfGz5I|!v|Uq-g)^TF8hZCNdGB`jrS7tbyeThX;%}*9I|2HU4j%M3~kD)Q5kVeYc zdf*oriaJJ!c~yuC4`$ng_df679~>`iC;kNugd^L2zgo0%_g%@uBTsSh{#9;I9OIn7_&(XJF>LsJAqP zxvdjsFJ6H@rWJVgE(J0&jL|CrW;JOH z`OI3Q%qY0VPZeREFGk6I{@p}EJFvi5_koEp(ilw)zTAb`ph+?nAKN= z(OD#DGCZ1AMNuXa;!~jM=m}esmKZl{CM;DeaCYl@JdMm_=ehr#2)VcmQ|BE-P<$K` zg709c+bjfR3zvX9xNkGY9Sy?kofC0%-v*355{%coXJhMxp?H(pWSzi&gQ|>|n6_j$ zl9E$!Zv99sxbT?`ugeO-%9*S2Aug60xyeF9C-emD`^eaZ$beZ0W_DKicc{<7Kr3h5_#DMj3H zi+sPH`tm$PhJ@j3LJ)>K+u`^#e|(7u$JZ2Qy=gJOJsez|I~(iHKS4}f9NypEg!h9pqm_^pka%zwZ%Jqx~^$L~q=W z7S_4+x5qJe-8p=YjznUPaJMSoLz6LZ**V0=#ULy+9BBpr%Ccy{d8*SkTztyji_gs+ z=reBr56g%C5~`wap-0yV_?Y+=adF|;J$oqT9e*S``Xhm-=40U*VLkp&C`wB}XhakO zU!8%S!w`I=`40<;KyKN;S%<~^YErz;V$%4{@Q;tj*RYqEJajx>eicgjwWDj{xb7WZ zA76>rXII01&3n8)u>rSNjl=cuU#F`$B|(@tdmR#KdvJH}Obp-snhocdBw*9Txp+<6 zrRbQi;4qDO`YUvE9gTNi64~~ES*_|{8RSWCPGRz-t)hE*jtQO<@j9{T!k)hbKIU|C z#*w!nh@N%)*z3mvUy;B(6H?tvE!`t$`SItVhBJ<(RN1U?_r z(4~(9s?);p;(a2zdbl9snIFu%^+YSxDtJE$hIQ{=sEYAMuCg6E=~v^0S0;K7=nRRv zbiDD&M&BW>DE#~$S@LaRXDElTcW;ouYlYtSZG@ZDNXeigI|88@3h3c%g|=<<@c!Bn zlxn-cSh0{AZx!g-(;DF~?;@UK1ov**cy-?&R(<+GyE+MpytbG$#tp`*%&IW8DB`K2 zd)Kaz$qhz|R9iT<(PTRn{|SGVWe-V#KV02+;_yc=jPB|Hhi-$>f$xRko8DrETXU@5 zcm^_x>fl$z;MB#(kd#z{wuuo8wN=s1&IwuylE@5sg3~u&AlTm*h05(<-ck`C9$&=0 zr(TH3mx8^8aQD1M%BuP3J8TmA^l(Ox)+Ly;-482f4#ej1p3t3p25ZOkgS|~Vb`Bmd z;{(oyXyVa@P3YXk1s$yngiF8u69jo5&|}CUoD6)85nY&jafeOAYYf}qjipoE@Z{PP zloo~K*8P{rDpQA*sc@IJ^x(%hbMq-aMVG?C-V9Qt5+}A@$L_cH;qK@J_mN{!^>#fL zU97~MQO@vs@&E#EF;1TkgoSHIv}~adWty&k1+z|w8UEq7=JSLrfgo*uKU}G-aY0>-sc|3UGh1eoF*qQ4> zP?mxV=g;DUe+YbIGGJ+A1qCSrujluW{N*zqy?BfKS{*d!hvC@SJIJlpgjHK+S-v_v zK70%>f`ahzeH8RM*+cCQG}-Zgwd`T)i_KVaUx1en4x)>r16=!$MCqOB*b#36yULf? zaX$(Gd_aT0t($2eF5ot+Hu{#64xpy8Gu{F-`w;XUybp(8--4%$3#<%< z>og>KT|=tHLL6T)8eO_}hN;fa&(%(Ox)IBsNaN+beZqSgFbah?r(kPzTTFJ5!KH^W zs84!`>yJVqrE7}T>dZG0e7wGUfy#|H63Ud(!L%i~`C+*6P6l@_ZG)p@7mOJ0io46) z@S`h&CuH1421#j(9p`9-n%5VD#~#4>;o8gvH>U27YEMY zg?~gE+A>S({Y)ipVQLMR&dzYLQO4Ojsd#+j2wb{3!Js))uS#+G%z1cy_=Hk96PW2J zqa@}9j$L_*&>(*VP+jBPP7kCi1Gl^bkstIN_g_aq(ZB*l!Pju%jz47d+CfiU4!nva zTsV9IzMq2-`Lz@l9ZY{%_Vtg%@4D52iia+p5jdC{Uy6*6uBscJD35cXvX6_u)|bdI6)? zhhXXSz6f~r2zA^loI3LshK{z-(Qb`aa@ly3AOQ<{?+lSIt{_#G)-|57ilt=SRPD6i|d`rtJ})46c6F$8M! zasB);cz^s1zsN)wTG&E`3bg;*2Z*N~`^V2;BCSvrhAL?|c>F3-^A%ug$t>|Iz}vGY z@z~Fwwg;h5Z)XQ>#a}&U`-kKYz3gF7?5`UkmtdxR$PxtIKZj$-kK^Fs^H6Y^h9MnV zLaBL6C`xjmX*m$XZ0fOp&t5!xp8^>rIq-=TTIjWcEHxH*JZZF~ZfOYt6g66+xw14B z2LRhve%X1a?x(!Y}k?@?A);vd(OXv zfC_Ecv+LNtbqhY%w1sDPQ*fA_K>j9tp$14kUHxFu=4-w8aK})q}Fth21 zjvcL`p`;A+4)(A#kjLpwYY<*4K>epfa9?!^R$T_5R|jQ$`C5d~({r)QrvU>!2O#(1 zI;^?(<14K035#&g(aJp(avfEU5WI6F)$c$?+~i{Ohx-9I87EJ7e&Wp)jxefFX-7)0h%CFnJV?he=Z7sXg}eHOItjX&61M z8_uqsil|zGoAdhOVxa*%2D-tp{v86-{?oCXzXo?t9)|VQSrG0CDP+mUS@6Ac27GNZ zC^yrBgL5ZXnVUdfNfXXp9idX6fR$?wv2SwT?i_*5uS?OpcOMw4*C8vr7>C9WLbPN% z3>oBviwlO}Me>iYSUNg6K&CnmLGPa6ews1%uIi1F54TXPs*KYU$D&uiKG=LMoQb2m=UxI7m%J3jHx4g;Iot?dRP)naG%YN zFuvG49%rLuF=SYO#9my410M>ZC@%vd;C|n_UqK(oH%!6RGrLiemx|dQJ#alk3%$FV zA?D5=9C?+8glAi^>rNyay)5b$rtSBJOb+ef&p(Hb{XNlME(+tPZ5QqC`|~u^GT$ii zzF(W>a_i6m_$qG+_W>PodgdU!&jl)Y^61lN06azvLiyE2SoAm-5;bv{N%cjv5;bV_ zi{NJ37Pm`G;A+Ojgqa&@S{%%9ACF4oZWz$7Ke#Cmk@o9e_Wk83dVLiB8htUqGeSJV+@+J6UGj-J#f%P zY+?bjXd5u~WFqyTa>a8bxlLGGg3uDm_Lr3dxtsOm}iuahXE-l^0|y* zLwcg$#DhY8tW5KuoQ?^eL(t7*9K!N{UXt=(9YJslH}o_7KH^|JXezAg-{1uYI5}}B zRzAwY@L_%7wQnXa#87FAyNyxHZoy%ICoBXXF?RM5dX@y3UGM8@$Dt9og}b2tn0m|~90_?CS=eK+`%u`cBw^r$U2NRT zONV2_%R-DC>4IxhyQ1eVe~cN~A1@Bi!;5SI0*;Kq&QNK1403~oVlo1girMqT{EjR? zd7V_2mXO@s+<)trmtR1Ni;GE7Q4#wqroX(rJW^OxObQC(7(iiZXgm5y_|Va&z-Yk;q+8SVRg7^6B|Znlv3IeUUrApopZ0zah^8zLM;mBywlp zdUE3V7kaGVdtM3(Nm1cgsCpuVC_d_wHSh?>B^7NDgjYN#@R-OO|XsLJI0c;grC=Lx}b4 znxa(5tY9PHWtjU)K zLh7H-Ce~ALkQ}egL}$QOQd8eRIJ`2l-cFG$dQ>7j@n>lu0}We}dr6{#;KmULV;k}+ zjVaFtlJs^n(Q{bA9?JQ6oy=OihAf-Zn`oI&XT#j=El8N?60>`@Bo9-0tb0d4J90WK zgKX-hNjlHEL`vxW)^gcHe<*x>d`MzqqR97OrYMxH1M}z3A{#DyivoqLcWp^lKhG5T zL?m4z(CJRH(gKKXmkGkKd@rKyG+yL>OSE0oG2VuVF4B>f6eF&IQr${I*L zheIB&?n>O&z7ZY#PF3b-a_rDvvTgNp@;Z%>w969+IqWkXT_Xx@g|b3O9&ysPATiac#G$Pn@yVzsb#)vP z{b)Hc?Z1x*60Z?c)A6KA6q_aHB$2inPKq)=5#8=nMS+AoU*<%*Zu~?9X*Y>+&n0Zw zokd;Avd5X^-h3xA>fi^$tFI&chB(qs&w#xB;hz4H`t+wnTd()`YsZ}-O8Oooy@Dyv z26A_)Bk|nvi9O_fbq86pdNY~e(t>oF^_&Pw-VmMcGuUIKB8r&V_9m=`5@Zqw?H(kb z6cA@ERkG^V7h0#P$se#9{J_D32Su*`5`s!{e*ZeQE-YNPgQQi6!YNs|W)qEW8%4fG ziixY4JUJ3i$Og|2QMaEPmLu9+i+mW(MSVL=9=6 zI;TA4I%%csNK^bN)#Tyvtz_4(9c0%vs(E=~q*)6i@}WR@^u#E8;=bp{IvaLs3~ANl zr+NKO+O_FK!*!d;*GK{B)>fIEPAMfLO)SWx6k-1F%WO#FsyE#oIrGRv&ZQrXJLKeGOlLv{yGO3QcL3GSUu(8QcD_Y>qv3j z1=32hH(^?fnyANQ+Jcp2^_*cuS))H2duC57@+6sclI^40k|Tj-to!PWo@DjYL~>`Y z6|wNxN%CvzNi}V|{)*hVaf6hV3Ge%l#>OLe$*+DNK?Jm?#^Hd=<+48x{n0eR<8s)! z-V&0MC`}H-g9rEE6;q3GliVO(S5MF3f{Hzp0=ObKpT`x=HD}VK=`cr|y15Mq|L_d= z?>s`eVK0nyY(>xgKE;OcdEhpgawDMWvDXm@gn6WXE~kO!k%=P^U6(oub<_Md-UFY; z|8_s3y#3{n*1&{WOR#R;I;@yA4$Yekoi*3hM8?-xkxxWTDfk?D7^u?TIW1#aTon4u z=<^b~g)q-3w_FnXI!#_0mK33|ya^R_tgz`}UmDx1Rx`qL}gM?+hC;0u^6F@NL>3cVTfxgO0VhsGVAis+C`*Vzd1eTn0&8ge=D9nG0)^CV5KxIWXPVU=+b*oq7U1=K(aM2eX z{f=^Ld(2m2naGGnvP)|5b3Gx=`Y*dNh#P52J8LgYx%L<`Ui6Z|$qN5{? z#6;o8pp9^HlAxevgl0;z5Qy%DDm_TZ)S)0PA0?HAxP5X5HmqBX^WGI0F}e$TuRkR@ z$RFC;ouI71VZZrlgsBF6ZapLn-O;JQAGEgMvA-f_c(g`RaxxM>-NA+p>#=;z85j>A z4}*Vmm%#G0B-B)9;rJe=JlDXt#u}b3%Glb!E%ryKW7Yaim@>cu^+grnOG>ccC9yP6 z`KPka)&j;YDL^%}@#x+WWO<#!@~MN-w)Yy?s{KvJ%c-2(*0hVoO5psFobqZ}e8{KU2QGafJHFR|~*f5s*a^zK(;p6qaSifN% zwj2w@(B+fykB?sop7W@loYoB|r%yzwls5F0mC#)D=GK)y+n9(1p+`hVw~>&`iNKGw z_B(3yUMkYVeta9ltwwdF1T2l!!Q)XIg0^7{e8NR-O&zlGauNIPI@Z(nVENh$upB!c zdbCYq^?XxGQ;?gf19N&KJRVaH!n(rR57drf81G?=H!s8R>XsMW={+?hMxm}O1qXL- z!rIjv5GLh_-W~qUsd@B4FUy?zBOTWjKKB(tTznBNU5F2C9!|Cdlh zpg~FDHlMmCMqNb=81))dfHEfLW8-k+%vm@!Y7MrI zmdCw^UqIoi*roe;Sd&KfOkjSca(w9`h#O5t3CJNQoinxr$-??yYiN!pWlT`L>m00F zw;t=)Z^70%{a~U;I*ufy9~%vI8m9g-0S%@sAL9IeY^#fsHfPu$;iU=v!EHzil*z~`}df!Fbc(Q+MC{sA`5sAF%09y6Bc z;&baREFanc?)M&`=D1a;QcMV`CKK5z-Srw$)8^gErdM7Ell`lg9gizdV{q`$er(u! z0OK9Pu<7z23%ef|jcb*PaIHT8 zE7q*ThV`4UWA!g^BAtCrb^?68!gU{Se+tR3dGX9*UbQJ)EDSL>FFtqeMgJ;Bxb`{* zlU9y{HAzlcRwi+aRBmjU%)6I&M^_3+9mWVDQbfW{SQE$h@4&W`=V0Z132s68&-(EZ z!lH<-J+QMW2E77`z@*U#v`Bl5?RWB5zk0BJDZ-q`qlK8{0cC+Yg>4V=>Kc+4)B-&; zZ(b2M&tKJ960(&>Xj0k~bq6iN8d864*tiWFr*d;sz>U4lC|}X^9ECt zSUqJFN{m_xc5{6NX%F(^gmo{kJ!m~-6rS#!f#u$57~9SkrWNX`?-_Zn(hVk*aX*<^a+7a)cK7_--z0@4mzmQkFJu*n;J4#MpYugF8?8N(cmBa=m&Y%9a1l*YK<; zm&-pNp`rZC7*>Ou`w`5VJplJgSA&(@4}R(vczTlEs#yagQ!|L!RPMnT`<7%R)!X1)!hp_v=atxe25ch1Yq0UZ+aqTWxGpaLpAB&w-iD9F< zqgfqS_`JS{^}C-CTYa3pwFuqkjYeP@C8Db?#Nn=G;IVuV76qB0q6q`P#Hu)SuqWrn ztPbT7(Dpj+tYE8S9^+bg_-a39&FG8UBrKM4UlNvfcyeqaIT;00b5qh8Vf` zfgvUxyNYR3Mqv2$;xHGfkRi3jj^z_bLzRi;Q)Zx~o*I5$!Km4PC)N&QI~GbV9`f7~ zi1lG+qLc2T3a#OkItltimUHG}O{QU8^I_;PVhUU>LjQDm1K2av1zOT6G&9kq6zSH$+%)f4Opf(Q_sSG|_Rhh8`F-K*ToQ@N(HOGeG)^vk zjNyaFqI@wU#D9oJ>#1uosE#9dFNoxDOumW69dDvTNhO{q*1^$jjUki(H#b~C=f1z9 zn)wHGUU41`N%q<@r!Srrt%G7I?~&Pb2G+D^KR^pbt6KFj>RuQo70J&@b`59X@B#)? zy7z)h>5@o~@quBVL)bZ>6test!or;IYBBLQl!y(IE+73Sf|(g9>nuc!o0u6xqVEX* z-3`$FNCTACCZOi*jp$PT%ZyWff7s!I?>)?#G!X-@R)L*165bi*@%GkY?yS_<^kbc3 zU`*;Mp{_kJG%;mg9isJ;(|A5%2zrcq3nxJkva2t|?vsZxVtP-EwQ+=0C5OC7S?pLm z<>Sa;F++Xy9o-FX^{XS;{WcaK*3B{Bb!7uO%$|hbZW|)fcp!F9sDrR`%Q5j(04f$Q zg2130>^bl&ckQ7m4Y5TzAMZ{K>TwB7@FnR zvl0ViQnH0;v*I*fkDrDC6C7Y8Q6pJpfF0Xb!MZrGW9k$>Z4#lf-D^Z+%PU*flJoPcU51j~?B2q+$hhxCnGw6f^aA~v# ze)3R|X5uppP0b|ab1^WR% zn=Y*1xI^e0nGtt%0hSn=kn}TwQQ{M{>v9*3OPk;W(+OKAx8%-Kz7A|^2-rE~3;MQ0 zwxZCBDayYHJ9WmK^oEU$@*AyBNl8h8o0}VY_3Fjjd_!_G5Sv5_H#xMnxBJ*@%gN5- z#4B5lW#m|&KhDX@gr1S9uCQxz5F4LH?iIk&#tsIg@=#`{AUT6{&IBS9v9W>lllCqv zJqekzTv=|wg!ojbwL)0f*us#ln9^ROjN?dL&-CU- z;66i{ff#<&Fh48|vNEzsN5X__2$ZrcFj8aai%DQq*@#JGm%<`q*vbKB#5*~}|5;hN z&@fsEq!zH{R(a4N%OdeWDl@Kb(NBn%&GyIZRD;!cmz;@_eR(w8{FgE@s8$v-IS6 z-AJ6s5O&rUTm@W^#Q0c}w*k{)cKA2|M@WeK0Ii7lfw;q>QKln-Scdr$I(qDstqysfh*_cCawypG4w;Ex)E*JP<9W$mUkuFxJ;)C|SA;M&JhPl30J2SIwp0EkaWs)!Z8=IF-hFL=EZDa z#8p7)e4Q+SSy7VL^S>G8$jMAWT9$$cMKct&$nS{duz8Y{DJxPZkYptgk(`hSr5dEJ zw&Ut*QWDVAv=Zirr=i8~%>dDmu*82J78%L=Qc{nLiT70UY^X?iGn9}3kTxeKHkHe( z`sQ}9G!jA~OGO6T9*}k&dd9G0_gLYPlXg)|>Q=5T)T&6iP{EWRq*3R{pq3heFBTjr ziE+gLS}cb2l}q^ z%kWV3XbG0tL#rBsYl{so#(UHpBDaTfDt*hR%STJA!9|!*PGoD<8_=kaC#q*1xmL(xH>d&`TPYe%3TJF!Z z(h22T!q)wnh1Np^k|RSA^Qq;(iVE+8f}!}6vZl(2Ls(2EZ=(F@ux|*dAg6r9`|K)g zxfaNqwAjC7B#yeL@#a*loVFC9@$WHj#tNkHw(NC#7R|=%INgdmxl!I&JZB1~Oqqho z^Hv~~zc4HG9_Ft(sWbdVZfu>4qp#w5)4xRudRA$N*M;iZ9L#Rp47=TR>vw+%v?(u9 ztx6}v^5);;`Q~vLv-=fq%IE6lIXLNFcr9tlm*e=NU+^G`Up`P7jo)U^L;zn56md`S z%fb`L4!es*TQ2D=37T|&{Px=hZoOZYgy&~4e)44eI%xuCY&lO#i4MPu>#+8M4{!P_ zKtYvyg2MregAM^YJ!Dmww6w56oJy^G^pTKIP@%MOb<9-(Q+_4ypSuMHgHy zREw>>n`6SI54`ycz(k^L#TxMZld=|mZZ6tPyvUpKd3JCi)?E+fO_U!6b{R@4$SEH& z7er(B+M_yy@&hhx+mCfed4VYR!1hxQNjEMFJGLG|esjs-^8Q^2$`k{#8)#8$GRpND zkA({sVNi7~y0z|$5TZuZ37*(r#=pFb zOI}G(e0YWZXV@h=b!f9Auzlw#PIw1inu89b?qJlSg_u8o7Ahy5MfL70xa*>xoW$`5 zVchXwgQPpVma*VpPJgi;3=Q=^X#hkpApeQ}ER+5}5s4+xmwvLW#wQpU89^fc)DuE( zbr<26^co#Ha-p8B?+V|LX>>7lI0vy}A4KW2??A<@P7w&QF zh=&il)E)w}79&V|un=Qf+hB0Z_ION0s9shucJ90M$s3wKhuzrbOT0H>^P6754LQh@ zB>MW$*ZYEbO(254p#eV2<^>Q-Noh1Fu+bh5>r*P-emv+1Ii(OKn)iqC+v|uS$60<4 zVAo|d?7VMsqiCr&PNHas;V5G*fz-eR`3pUXU}|ClGyPm_?LQb!OLn1ewX(3VG)K+u z^Dw)XFNQ5}mFYd*c|?Z_^n= zdiF%~_DhM43`6R5#N64#(Wz4_^ccE{-?fv$k;Nm?qJ0O{YCZ&>sk-~aFDyc%wjD8S z;0(Oak$zSYvL954_1QIwgV3*O3#_~x0>r&QpI%+jxnoQ8pM8wG&TH2w44A(O69*5& z@i&h!v`JUYn>7rbI<`X3VVn64el$3=Xarhz=zuychQd3WSV=_ey8oY{P4L2q-Yw9n z`*7^O7fRyN3^{=((QV9Zte7zrbGF<=nk)@!aV!QmYzOxwU6Um9KZmv*XLHAg7Y;`& z_E{~5!-suV)?2jhHWUXoPDj5{yGeuUhoSXbpc{$XhL!5z`kxKcQ_!+!Uj*H{!5zPP z;Eg_m2g3h>Zo{j`51ydk=)TY+9V8=my=5LfGgGb{7?NE0+w8-bd2Ju6Sy;lNXmJc$ zdJ1LV&c%i|*)TIPhJo~VI$bmcJqDI+PxD}y9`lB7F*Qz7hwC#jd{OJC+$=$Jf$5ym!Jq9-( zA3>9rxIt5^3o4rsQAz4eQ`7u3Wy^typ%{1Pj)ZC;5#o(2aqU5c789^*fD*k2 zZ%3|yIgCk%@OP?2o-j;l*AZQMbVJh`^>HF78%$Or;xlw_irf!QL(Nv5FsMf#G;A=1 z>om+H?Zb@OW6`-Y$#2~kA#Y;TjV)8rl+^tVTlU7?P~DJp;*;HI-Ju=&_ZtiMR57WZ z3;Tr4qarn54TsN_ta&WJ$@+GoxOu! zyY<3M)(@SCA9^f7GUpm_ZPOIa4-JSP?uWCvQ%u7CJE50FVfNtWXxnuNR-bvx#icss zAvzA2h<&RjV8X(4NL8dmAxOo{&K+?rRM!(y$38`?hQqiw4%atMM$>j3$g}$3K_q)V z4t+az!0xRJ(7F3cWFr<+TDK>0+Z|1+*TvCyU+|R}<*!4s0~O>y9U7!2Cn6ys0STmm zE3_e)WfjykN`wbd;2#1!VK-tUY?0xZy4bD?JL+iy$SqZ>bCdyeR&IpO&8+o)w^&A+=i3hsdzBACC+F`rFY{x z-fXRjF}-IXKJ*UiPq=|&x31yfv4yZuq~Oy{V+CS87-YZ0*v{inYTRbb?qZ3KZO3BB z`b)TS?H(G&Z^fc(kr1T6#|_V9tUq!P18S9q=i{p|YOxeouib@>-&UORO~<`it#Dq@ z5BIKL$E!_MF|6~iL=YK6^qCM*U`o$Uuo-v+S1%kuHy2|lwE}3eSGw096jG41AZTdRI3Cu_*(i?tCThu7YIrWi_ zt(Hz|ejl**HQh0Lf z0=CZS1d&{~*FZi3=ouIw@x?{d9e5aP-0q^a;v(uyeTs*7ui^Hs{dhj7Cti|PKP~7b zZl{&S%{#l%s7Njz-@lEvi>~565h!PgAK2YRXY?HimoX%76F>aw?2e(UAHsl$u+PZx zL9>q2Fn#weoIbS!rPZm>ibTlz;D;-uhq>?6A@r(gk7sx9LF`Z$j-f|zfqO+K!{(hY z(SA@B%<0k>uH%k!&ze;F6-KOi0zGvK?!OMexOGRcbWBln?=%||F5V?^dj$uU_k>=7 zQQe;x2I;9uy7nL`nOg@xpAu+QNgr>*HITo13U%LAXjjP}9+9M6Jh%uP7JfoXZ^!D08WY=hmND|%+?`z`W&Fgq}tS@Hw z8$-JBQUpD{f!wMSapl5n9O+vJp{KOgEe9NMu4ixw@y zitR^`QfT>kV+`-)fSdRH@cMoj>Q}ZzJ=ZGm_6owSP*ZemT7+mwB@|L8jF>tN(|(;o z#K=mtt|~&ViXj#3=b}4rJL0^*zmE{@yLQ0E`9rXI-+pX+CPgU;$(}+Yl1T%8`|Ncz z9zKq{($u*c>}=RZT?@vzELzvn?RMy7FF{mjI1XL+g@rf*hxYEnaj!IFg?Zt|(Zg`) z^BZ(m8pFcMc(&PtO8?H9&Ku}TOJcX*y$lEa?yYCBs@BCfwMb(BNQ|G*TA;3p0E^! z!lH@Skq#UG+!)Uya-DcF2LsV&v{E8 z>qcl?EEdmV;}GdBN3EK5Q7T7{xI}LRimRg@R}7ReDb)zS&LW+~slQ^zFTbF4ksN49 zhl(u+pQ6kEe^v%qiV*>1j_ISPVE>+-c$`{}+p1n9(T6ZI3PbU+Usy##?g3imt}5SrOyaObAnUFnzdV&~@+x5^{5}%6L(RB+4%otZ4+qQZF>2L5#QVXNY#p9G$CbIo5a?g58p7rLr zJ9k%^dYxd)z4b4KmKBUJb<8wUR(9Y;mJ4ik`*;1^Fxfb_e_F&nDU5IAiuoa+3 z|K@md{}CQu^G55&rBSb19e8^NJ+!K@bzyQxKokzt%Q@G9IgbtNasyM07 z$+6bFINH^##NA)Q-UQL%vAB8d9;DI~9NE7QM{fl{5gUj*M|LB<`Y))%?IooLYX>Xh zt%4;%0I5WP6I0saSaM73pV$ycyiYnBDx`XxC3)-+{L+DH{UA8n8zCw@1~;y`L0>-whgm<|4T3DBKi38+BgkMbXY&LRH^5f{O)3)W%h&Yjr2a0-fjGGNtd zKnHkiUx#Cfu4rry)Tmw-&+i^ZkhCnCu$vW@sj(EM64H3;o1(Fc zAs#&{JU{l~y@#k*w*kaLQf2mp35Hv!vxsYy8y8Ct-`$PBi&#b8sy4q`?L z1FP~Vsg1(BNS#Z0+v$^IzQy( ziQfuJ9~L2Lh;lher6YgpE(29=;SKAQGEyf^TL{VJ z^|*ZMI_eIYOoU7_iBkhzc-d$5UWEHcryxfrC*I=yNaA+gy*D^IZvdQ(VlkvcQ#_-^ zfaE6=jGVCoyGVPmb>%#i%%6qDQM*+KM4jD>O##KxqYO~GN;QPJAH~yf0b07SJsJ)9 zPY-q_98lE84i+W`+zzg4(wVATw=7;hc&BrS=jHwDC|0Qj%nTTkx&m$@*6-mucq2TX z96*bz<#26w2Mj+M08>N$+XGVPviEYZ`B-;E(pXE%mo6V_$u;bTd|4S8DDGT^G>e zk48pTfjq`izz^)s&N@G2qD0v$s8*#S@k0ZgczPc-t<@k^!DpzL+>dcm@H+~Ibb1S- zQ7MRGZ;Sq>-ni)g6wjCr=uy@H$;qiGQH~8S`>cjI`HVcPn40sGg7;>%Q9I%OU=NyA zDTDLV+F{gw-S;w-ZwpaOLmD&L045&{vNa?;oq zsDhx#$wpSL6f+L)Mev+~IP@|Ea-{}gZd*_Kx8sE9>O*58eVAU z%4Nur6vOn@KiFXUsD|)) z9tbDS4^ENV4sgbsCWASZP> z<h7)I~c z;`rf7kSa4F%SuBmqeePM0{lHOg0QGq`goMt0D~)M!#`1inj}A$E&}+5gpf?a)ASMHK1`kJ72V+v_X}Uqg9PajS{Qj0y6@!^h9@ z!0j$xy_KVJiz?h}M+hXSQY06fckai%>-S;XZ4nlBserVkcvzONkESiU!#v<7_FcIJ zjfEXT!!j{$Ob;Z*CZR$5max(nAUlOzTcHWs^&SnIglky4=M3C#UqgmveROQo0ks6d z*na3F0`S`AR4T4OXe@WRpuA{^f`2^aQl#HFh@ar;#i z>bGeJYbFgEhuUc9Y(?%nC4RVpOzS3SUDFQn z3At$9p()qV(IG|47FBU+?OI$8PDji7)nH$t7OL3^i7>K3iyFEuv#HV)mF$dA z%+UrRVa2fQxAvSnWttB`k=RSzv+m!yfo$$swunsu+Bd6B;#P`EmNIPIwjcLzK0t{+ zOR=P<3+L{Cors7Cn3|fx%8HHauZw|&B@&5%>@{*6H)?2LZ;$W*0ftQI0~S}Q z3GL9T0bgE8!<>+&M3WYcQL1`dv@e^94SUaE*KhrBMmPXL7iMvnsbm=l@_&n$PoCi3 z-Mfg&wnM$Dx+zaEv_X-SSJ=4sH16K;M4uHq(6*EX5@O;}rBx?%=-mZDdp6>7KrBic zr@>QE72|q3BPPWVUE0(j*;s?*gfvuZ-4eLkdEra58a3#JXt?nVEyn8WgE0dd2O9zMsz2lw#k zaU!WlYa#E2ZJFX0IJA2wZeG6)Rr$f#Fs>=GNP8eIQ46hFbbxc}8|*lH1sO*6i1rW1 z$jJkc6`z1AEn2|dM1-7-B+{|1g_a%r!i90ivMtB(kkpSKL>1AgbxX7=&0yE|19+|| zj(*h~Nx!2R><#iqq_dI}U|y*nYE`X`ZYAQe;6gNZY+8s{XSd?i#T&Tw)E^a_v`1+p z(n&COM$?LH8D>cNOGP!_5AyUR=sVR$t4{q;Uh^8uw;scTyVnsTt&R@$$|5l?m4vw+ zEIuxzB0}>{P4IZ_3S97yLH&AlVeM1}jVhZXDaROX>g%TC$kG#GSf&B$m$ig(DJMjE zsxWK8P*{?JY*W1x%Bo&r`L^SDaOXPW3~Hc#eP<*jWN?ECY!IF8jj?~%F5J3t2g2&3 zv35e!0(HQTjgOBHoSmIHJ@#MY;cI^grtdh$Ea=+~*#&xFlz$iYwUxQKIgE_*B<$y; zq@=*j%?-VJ_2O;5bK)+-uIVal+qW0ac2=lVS~pMnpOEE$1)HB`V_1h4czt9RZW|23 zuF2o)cKMXQ%7X_F;NalERiNK1;m60J`T;4PZW;z@(NZX5!%lelX9S)Yi)$9sG00Vg z?Nf)qcGfeDtM&P^Xp|q9jT<*&>eQ*c={rKv zR$h3C5xx2#=-OKBiL8#(%lq?ZDU?6v#EBDV-@ZMk$Np<9+Z=;{{-vG?IC-8 z6g&2wL+yE2sTikxKj>G*vkRLL_TV(GJ@JC_|1nEKV&#P5+C=QzvlBkT<~T{kIOPX{ zj*x!^e##MY3g!RFk1#?`q5PYCw`zaxz!F4%3jxF*?-dYt^!{|yfd7Sv+@I&C&$nRCM<8I3tIXw=P!fvuApU|| zr&B1D?+q2Q^HvYxxv^_GZU)Pc6Lts7cUFWkZHn5dTLK=rq# zK`@Y$w8&cZfn1C=5Nxp`}PFlxwh=rUa2ivO1a6-)Gy5%mtYZr{P(JGb%lbpTYt zzbndFF|LI7D^FyrMMOj^@#e`(q{`WiX823~1|mHM5pQ4N?%lhbpC0*qfT8~Ht!^TO zfl(TEuh@cEg%~Lz?(hstp`x5Zp>TL?=m!&%>UfouY`t|<+fCOsjJpLZ?(Xgyg1c)A zL5h^(?(XgmL0Yu9)8g(FC=~Zn+#TLr_jBFv`>geS|7ER7CX<=W`JJ=RKKpdTE$nD_ zo->6+wU%2id2hoy=0?Jmux1sx-7R!w^CeOi6cuNq`qTy@T1v>=kceNrtgG)=@4vGP-wDB;Ox5igsY+*g?4px<2N_%=S zNdc9ugCDbXCO*`o@&8PO zfU6$vKOK$A7ORF=dZoT{Dqr$R9*cW*YaHxvY!3CF(0yx;YQHBnieKqpdF5}xtPW52 zbkE;Yd21|R^IJ8IqaEu;?IhWd)GMqeO7xVBRULNdt1G8HCXb<|J;wCgaWS(j#TJjo z*Q%gkoEqHCGQLe*5y(MtTAz5mUShXXwQTd*6`N~{;NsWY9<4!ENU<$qTwruipt7o^ z54^e-?zGTfe?dZeL~JP{kfPDuxmZq(n!%T;(2@msJy3bPzY2-Em#tw2x#*3%?9ahBnYFnQ3Yv>8yRc z@St)}rYZ8PMwAi%@G+c8wS}DRKFL;^lp5Y zS`4?fbqb4p2D58JL`O#l%qLIG7FGF zrgmIf2jg_No?oNM*_*(%Vh6D?6Gk5rqg)5Ta~2Y<$&x8`S-ouTC6cX2&@)VsN(3h> z=%(JM1T?he@Q_P5ZuF%32Wap)R>+$8(O5ETdcFLHr%Z95qi5vDsxah1c=Yk}`xZ6- zQ!e5$ukG;S$lR@ZfTLf2M3w$RX*+7*| z0dkhA;lF7zas0(t4{Kz|*b|qquqctXG@AQjL?wEEj+Txmv=vdSAMXDCN>Aq>nq?#woLF>@gbOl8Y4bVfz+f;)iU#fpKp37FaMVtA>_b`c^!5?L}zNr z@sX#=9qgGy%akJdMITg|XBmrN$?CFoaD(M+*g;1A=Y{aJ;4DdxDuz~URJ_1G!0T<+ zbe4ME>*_bTCLL#^*bg5hv=tt%i4A*VWGGdIbN*3j)qvN>*^V>-d11||h zseKseOaIK$ChryjIp{Jsl2L5khc*+~@&_ubop|d&? zZ@Rsy^V#~7n2RTic(lzcVthv>Yb1sm$guu|_vZ8C?LGqal1>Y`{^E{s>!Q&9PU%6p zuJP+zHkEa&g8qQn#+Im!pdXUaJX_@D-gpVL8F9H?b{y~5we!gO@ zRk5rl5o9VjCn_FCYt2DR9qERlKu<#_DaRU=Uc&mfLr6-w01|W4ms}$6bib>(+UbGl z`Q4llCjLXO~zBQ4d=mjNfJ3e*K(CC{*M&osEjtt=q zkcEr?lFbsYBqqYF;A{}%@|%ZKtCRa+8jof1Zs&HbbE(;%{uD9H!tygI#)kkH&(khh zr5sMVyT9@Mf|TY@DfL-Re;L|Y(eXs@h9EzGIX~^Yvt`|p^32<@oi1ZkO|K7U!^h5g z{}C9mq{N{}4iUVo-DYT)n#Nb`C3pxzrM>|_isr8cx(Hf8d81dH(eV@FlI)WlcPzu4zhwCT_xqedm zEM_sQ7G!N8DDBdfvb#ckzbSOaFx^`-T=zU7lO7w@gE<~f}#LCHXi&N-829$9r z&VX?o^VxdU>8?*eW#fh@nWB`u-5-0pU}LzN+TTeaN!pGMAVDWV`9UZ#vNq)6`i~f! z&|m_LwRylDp@Hu!tlG(Yscl!$`k&@n3zs&M?gSK)?a}r5ojX{w_7w%bGoN;q#Qgq5 z&{hQwev3RCZI&dlHR!q#7&?^*CeeI%!L(I^@T5J@f}}b;6*3ziYG$!_Kh#fjek6py zGaPX@of|X`3u+sc;j)twJQh-(J9^fe5PyWj&Tt1tb7(sqR+1KLH9Gsb@IJR(kvW*I zMJ%d*2}-}l_E70NN0h%f4<>C|qDUhxIoDHs}X`-;)%@=TD3z=1)BjAE-XYVcoo z_ScTGR=;tGsCI|$ZuT?TY7=x$Z}cp`SDvvN@R_17OjYKxyKoQ-aKqer!XD5T__198 z)~J;h^0^`8FbPEPkW-|-=_z;K+4X1>_lkLH^(awo4bQttH>}a9II~~%_d-U0a_{XB zJRFH{OJGT_-0EqT7izQsbi~bxXQoS<&ndi7nA}mGTYkk8Zh(6Wob54D{3q z_tXiB<8hV(uRJlr4+ zO06seiHX3yyRCj?22s)62i}y_)NEessdEOj@a_HmAp~UPt1p4saX24`6HX?kPFAu? z?z+6j{ia^Daw{ZuScGH1EWZh?)sSt4o)ABe@t~i6<*G=`FC$`#sRb|*mO zX9a3=wwm(k9}Fe+p)wWSq3Ht_+A!K3`k#i4_vD2WLe0i~xeZxrWf)ogvlxvXfvWpO zwHb}#LUm%imkLy#CP_s*B}CGPy~QmgPSUm$gV>LflH1zgAZ9Ih)#d)jcAF z?vYDgy}-g_^6!`sUycl$OSaq;)&%-%Zzoc^xf}(yImNW&1fSuRiS=Q3{w(LOSj8y6 zk)=$Val=Ww{fTP-j4=}^Qh3<%m&1Cvcw%8t+NDQkf44n$A}=99rH0wQ>xVVV-%c*g zRm1J>(dO)r;~#jb4;Xl@I=}6H*3NFBSIyQ|Y@bNtDa)GVr*O$+CSo+O%jq$CUjFl>+!tUo^Qtp-+G$)Ugus;} zPLS8`@~KCMzZLAqo0<*LJ=QAu?Vh6ZdJ-HV$abB8BC8vu(KlJh~Q_Kag@kWq3F- zV5Bmf|6|o~a-1M8U{6y;tA`$nxKZbk_tSB+=f`sCEAFb;ZVnuKF zUht*WpzVRJV&kn>ic_>{%0@v@y%ZTX`R2j@ql?PKP?=qk;Y~vwhdD~3bs|`|gXWru zz#fxli(sq=QjXKAe%70vo0y!H0b8?#uT@XM7E2gf0l_zSVY8$JzIs-y!A+IfYfeqU zP?|STC%Vc9RpS0$;6NqqoMSq&AAg{xgl*T4EzLp!h5Kyx^vc^Te8oGYmkb{$L#$lN zEs=X6#2M<6&Qigqk$9%LR1uFxSk|lsfOQZtO~}j+G+=K!Ze@j?Vf<(sajuT3LHtHN zvkK?|o+i-PM!eWMZmw*+$Sr%$iS70f*C2W+KmrAGJcn9>1M^#omjmgigf~r79wUC8 zA^JM=2Fx$7KA5ym3m}Je`IOxc5CaTZEtI~6LCrNa>lzuD_$8FZ=lx`g0&w|kdCn9S zbLbdQ`1#s+Yvz9L&(C6hqXqZDEdLKt7${Q95%F%ndWqQcPA<+>h4ismUEFFD2w1im zWqYIPM8--sj-U$qjntwWV z1Zq}+RrBeki;>AFe!|25`Zs3mo!;m0QF;YMUIk8v==4&&BniYXOw9X>sV z4wXOQX|)tpSW;TLpktp#Ep=!ACkc`om<+v+IK0<=VbGp2m7^&8?QiRKVxg`;OlEY< z*$RJGokJdU;nA~Xa|75tH$yxtl6l#tC*zbMqw@5Q3nSr&@l&FgL}fN-IybWbkC(OE5@60FrxhQ&KdOATK8zxShUw8v|3f zqeb$cw_PCvpx9Q&9Su=OYa=<(WkXTWM;g6l&Y7t(5`CIdCl*7JmcRCNDb)i*$rafg zQou+aE-Kq1jf%@cblNofy-WYNjNFi_&@}jzM2oHuu097l0+v8=Q1_Cmo2oWQdAxUY z6u>a5I70JPr!+u=#m#iD;jo{>2@-z;m4#s)BXM0URhgGAJrFHU4NJ;7zbTVb`P*Wn zFdo;_-~eoL{0%z^mESKd2|V#7Py!RlDcg1Tx$l~W%-TV$Kf=Ep3t8HPQywHngGzZA z320?lMAD5gYm7ooQhHF&{Li14Nu$P^Wka`#mm2KJOWh;Er=?&f2YPD6B$IL7Td2So zUnxvQw5T2X(GMIWT@FFy{O<)X^@t@n1FUdzq2)!bUa!9?_d4PRvljQLr&DCA)eFjI zrIcAbqYdIsS}ZRKM9_^Zc+u!bt?7(}?)XbJEoQ1^$?sEQw*JO~+-wZ9@y`RFQZb-+ zT9>;{`e+ff)Z!2;mrmxbOul@YiDRyX+Ct1(ch_p?ClrE>Qnp~JMANweqZ#L;CmE<78jxCCs?somqUd}-f)BlTB z!+HkPXG#llHWag~?N01@=jn8}3py?oA!#tTy67F(_9Wl+!leimNmp{YaV)r7+Bao= ze(t}m{$pwHM-cT+ki+Z^Bp+8;m(jF>YZJ{lVNaHnPI7s%(>Ouad`j!P&D2>7hfW%B zyVSQx!Ec-}RMB|ge6cFqb&c7xi&a*XBv0*_;j5RBQe}$nV*Zn5-q?kJ_P37Q&m60^ zV0h4#(k+=G(}rD5G- zXOz^y?G)knFHhMUo(xK4ZNA<0E&~9LsE4TMFxr&YS@yfaY%jS1-|sP2!m}xq4s(RI zuF1*Zm|xP;ZT=6qU)sFP`u-ZPKAfSWR?a(Av!bj1?XT7l80`ygl=$Wg*r zLhIYppSx|quaf$`QkO|7du^QPS-xo&F_Pk+l#UZsCCE`S(YcWIHV=cPB1Cgfp+~1E zv!X=McA25CW;j~OVE)#q`cs?MjMolZ;$CcU!B=#%^+2#qcC<*|A&G>je}IaZ@}Bv? za9Oy+_8a1}0#Jqz8~!_u0F(7uT#dEb*7hKJ+sz2xyG+cW0j_tN&LX|zI9uZ}>ml^i z+kG6X%>1~%U)+Eh#apTgUL&d6WR-pcRn$;D9*{Y121vEH1PWjyc| z%yo%t#>;jF(!Y)nD74cfX%~k8QmGGcW7rYwv^Gt~(t_)C72VDxam0-UgTGfq;k$B= zrL)H$HxZS7-AiJ#M3eESZ`f^r&U4T*7CfT;35}!;u;*K_KgEI0Z{n9)57^eNcN4ci zMy$&Ze=CVH{_1>{k6cwPl-sdVrfW;-2r6RDe)L>z#Bk#)7twjw6$$v#3fpY zwmx`u)r6+$A#S`s12#PdMH#pgux6(Ex}V}T-MBLs8}%JB-a`Ad&1ukfLziHmA8$Ck z3NB*2&l--iQymI<1Q4~_ASWCbCeof6n~l!I2uXCZMzBjpH$Gv(EObCj?-sKJXHc)c zObjpc=5oDZgt|9&Q1i0pe%djdsJxT%=2d6g@W=NoIH;+WnbEg+sLL>Dd%>Tw?+#Y_ z9#I@qL*04|S*=FMm_AHsehKK`!b7fqz1F6&l%+dMt=qlaD`fw5+>n$pWgs>J;Qhij zd{H7_=RGK9|Kl_vn^b>ud9FeT6!tg<|1Mctqa6 zUAP%oO~ZN2u?l_;1I4V523MaLEiFH$cEp`UB{@|oX3tn6KumKzmfY_#)Hb5zBP;sB zdTr&}uQYF7U)632iYZEZzBhJWu%!e?hebJwe{ws~CjNTcHJAqN?6r}LViQcFkNvrC z1)rO!8Gxipj97mlZ2to<*hOF{N^#L_;2BZl`+8)5CUBnbm+rXo z@KN|H1t=3JRF9nlChbdqWyb|KvqA3LYz|CAPv;dO&;CCa)beLvKg_sRW000SUqE@@ zj!d!bz#K9J)%r`28C{>GT4>DF?K1(J5rXei&rlhf3i`2KAu(Q`u$_8-KO)4#_T>IESwW*~3YgVS-X?<&w#~96j{yNEAgqtyt~~sg8TX^n`Br z#G*@mA{ZiT%U5}V;jYIPvW@8E-XiOf#|hWxYNpW#`^k4+_DvaJlSCTkRg%J_4Wi7M zz&?-1D^d~`z-n+lyXAHG8`)EhVYJAsdhBxk_m;LaN2KUmDl-rL;HJ$Ww*QsacfYWE zj5*l~161>D600$i65B(bKdq-2d6O^)K9d@Gt1j+F;%pii{oj6A6*2vdVc3fv(6-uq zFGW+S;~{5X$BEFgXZ8t5Bk=_9AZaBzgWppj$D77lITYHNn9SNNl|Cn%RPZU`lD;M? z26cGN8kVbxB@!(G16OyE$=VS(Z;pGq?i#t+gR7c5AB>OD=l2XgHG$Q8gtPQR0j7L# zPOHz@yh)W;pnc^q>L9EXJy4~;ck!Fd7jaG9=$BkW&>hF$`>dcht{8NNjFf&%gg_Ui z0ddnr@bND3Dr4bd;aZ~?7lDc1#%21HyRpwb#&;i9TI@17caO7+F7B(95U2QIBChY` z9qcY#k;=)JIz14Tv=MGu&1J+9zt_bGCb1HLh5s{_@1hY!q-f$sazYRV%e-SS?z0YO z;9X>ticSyYqpJ=JLog3J+L_gmlk-fO>c=$Ef(M5F4oi0(&(Yi@SrN($Sg&i2n6|Hp z5ubB=5bO}V9(pV62#9QUwjTImuIoSJxZ7}f5Y_bO3zuyXP|4`NL&jxBL%5HCfUNZE zAefhaF;R5HMD^Tu0yZ#OIyeve%+GT!nh-nPa$W+a_d{xeJd>#py`-Fe=0#^Zh&H1!i_sDXn}B_nYj%NDO8#@@H<`LTKcpwRt6hmp;;rD$Th`kc?XY zgWqU(^6UZo(sZNZ>aErNhZKr9_aXcK_dYZEN@9-}C)m5kL{fDoFHGMY6iY~yCG~AO zf$%WLQw_uSj~*4$u=N(mh07Jp$DiIsDX1rFx_*Zi0+%J_y|Zyuq$dl(O|YU~0GS;{ zbP{nn!X1N3JS*8ZB5@xGVqS=J28ew6y0>qJ z8Wp(QxtxGJ2Vdt>MLNWh11-K0xN~_plR|_hSneRk2Z6@>w{B8$?WP(aLZr{_-wgP^ zy-50&J+>+U8%b*F?xNp~5nbwqRq^I-I)%Ro2{vIkUbzBWr`{gBmS&J#;YlE6?u6z% zH(ahSJVJzjoC28>RP9h&84jF_ke>pin0(Sjh zAyjXFQK$gr7w3<*2=st0wvQTR&W`gewm~MZ1i!j5JMnDo?s>&f_~p7i(joWASHnO?L2&)zGXn4#D6d|3uY0Ve3#^!gb{?IRc;A5DKKpPNRY zUDhTV6(nTc>)12_@!efQ6no<6DFs{Tu|cQmfW4yMbH+T zRBU>{Sp<4h2Kp&3(Nm;*Q#$>ZC&KiGdkkc98wvi8CIgf@@}TEe2<4RgSEKq7f^FUkdngvY%nnV z`KcR)t^n_+>zkh=-fd3Y^CuU}c7=?<_(3+lDAivl)sO0CF1jcxBhqdzSTsED(O-0# z064kvFezVM(9k|M$L!YIBczzBEWWLKU6krG=t(N|l3W_g2ILl$1+SraJ@n&ah`)1Gd_3gWh4u?gFXwH{Y*j zrc|O`o1S7(7LPwuJ{F%;Amleog$hCp%`OFVUK(r`&R?nCR!CuA*?D+p?2?gFymrn~ zl7kn~#gZmSYfbzjFA{mZe`eCsasW2~H%q%ed@`v*VkD3ApR|4ICQs@S%jA5@>azI~1Cq5ZaT5MoN0qQF>VEvxP3!7Z(S zd89FgB8N*&B1-H+s_o*dOSp=5BPy-aZE+{7$|6Fm|8mz7`t{j;Y0v)p=7u_X_cP+N z@G)+}*4CDjyZhc}rnJJ`|8gP6Vp^dghr@>-e$h~Ypo=e@QNZX>370$~BZ~MjBWN!G z^fd0-&>tX-cZ|G$%1XCakpXfGEmZHSoELZjwX}^zGrU2e+@e!od)MAwcoFAfZWtgQ zpTwCZF(yT2d7@|bk18qgwV<_z@|YRV!{E|Pi^0u-ZNMm`c&L^5foIBfy*xtc}~BnyDi z4pCsI_@UgBdY7$0sHhoZYAMDnfOzoSn3R+iKU~VmRs8|5D=8Z)4@;b6m)5pPD>Jwq zk;G`dx!bAJ6{}xd{hj)Hgg+6U7c!c>)nJNb31q(bib4%xR>&YKiUPqHDlvTciVjgy z8FIMe%UU6(;?EBzP7QTEo7<#J4X0|yA*iN9L5&&yFzuF={E4T5D2)>wr?oi5B-2+$ zy(Kaht{lBRhykXuJdYUwe^E)ug|&^M-}2X?vM8V*OVXk?k} zWI{K68#5}GA{W;%cnt;@C$i9~)J7R+FAq%i^f@pLm2Os>GT`#2M~%((jcTRThDPsK zu%&I)SE95uHTA9IIVS0qp)K+;hkVpM(NL_6SW*ar9Bn{kx=FG$SI{uW42r*2p=$BL zrSZMIoM_Y{kIuAI1I7r`i=vXFo(zd&>P}=uI3BGmoX2TU)TW>UgO}RtQi->X>*F+sEmd0tSJ;>M(`Tqnc{cau@&9abmGU(MN_C>mUxA1l!?r zFNRVC#$y6*ISV4dRfTXGV{J~O3T@Yosk7e7TnD#fJhArZQW=h5tXNtfB*}jt=j@#%j-fbw@D%c`;eV8U zrX!VtCtEixX7@Czy@;^AgN45ze+z~ygFArMf2aA1sdXjD2c-lj>mV?T8fH@A19S@r zW6Lxjvo_j@{$@1yF2xuf`(z;{ma8bJVruk{V(dKW%1+a)vWuwH%#4$u&>KC-Mqym7 zEN?;_MQ}2MReY6&a1ZD~7s@w?A^K*oux*+2V>}Yat8lR z7_4h(msng=AGk24F8|#H=abGad%&W{g~J>EwVDgWN5DV)+vB#}^f$^dCvyL{kIZhK z0{xq6^vS1BuxAZKe~gXIJ!n&IfTf$06rr>;uni1s3mrlj*ZIIFM(SG|S)^8l_D8NyqFL2hi0CCbZ{Di<#~RB{ z<|Ro}-W>{ozL!~~HDQQ$T3zd0ydJNxp@Ba){uL+Ej+X{l@{QQn^sB|MD!x2Q8*J_i zV1^dDD?C8Zea|-(&E-E%Lx8{lu3Hs2RQl#*rnLbP;L{}@Jj-Ji7gt}}j0fe##M9?1 z_oka98B67(g~OFH?o!E656_|ZX8DMqwDMqREUu%FBI!#R+0cCck%rnZUp`p9nx2k^%lEEQ3X+O($$RtF)?05b5auMwvN|6l{a!73%HHUi9Z>zrg@*zs&w-h$G!sXQD zLtec^a&m%>^wQExx$bCloSZVKi(JjEsi)vm@1M?7M4$KSNVK>Cexf}cMbx&v#ROaf zrbYue7iT(Qg%dK{p>36-ue8^g+$}P~UBm|qaTYgk?7;#BCm3SL){_q%fAK7D|6IzlQ6R~AFFqnujF zP)QOGz8dD~x>5Dkmr0K-<*mH}W&f6e$+|R=Uwq8mqR?eYyc%~X9e?}d7kvF;-JyNy z^cj*vgBQKg&Y}_}dUOOaYX=Fi`{P`Ud-7?yM};Gl^6j&whLZ@HQch1V zFl-Z)FQzx*3ZeUbs+~Rh82qb~$EN|>*dl$Hy;^BbQ1$PGVO<|4#aWI zs#5BCJEXG*U1dLo16oIf%>3D2ci4HQ)tEF3wXL-m3B@o#Bgnr}niMWE*H^Fh{gi$_|1D{m!6$2!b6?T_#7ZdLKH@~G* zUtkWTRc#r#?}#(xp~xZ)aA}U!Kl{*S6nG=6=V}q{P|3CmV0pa-wfT#}36?B~^m1_b z&Q#()`$&+c^R3=jfT266kw&m)9Z{Q;A-@Bdlhv%wg^vEg(2W=IH6 zH%g?`$A4pq!ZOd6IOJnwqwpK$UI8}+W$vj|ezsg%aY-&&h~ByB;60(BxPm%MPt5yT z?l+{1s|9=&N)tlak$7{C5aK_{TnBqddT~|JZe)@(1YpmX`r{AydOsBQ^(>h0nHXrv zSwC3OoXXH7gpZhI=f_NS!qvU1A;_Iz$wqpVX-=-9SO-*v{1WuLIBG_z?jTM;A4MY4 z{~6}F=jx-w(>qB;42@<6DH7*Edbesbe?$Bq*%og`iAIw63==S+FK4zh}N3^q0l@E|h3sCKXruD~Z= zX2JaaIFwC4g)Ykqs4JW)nNy)j%SWGim0BMSTaAfdE;^1!%J3`bdl+W7#AQKNfn0%n z2M@jKpaSi5Gaprfeib025?VkWgZq&NL^leder*!Om7YQYL(~ffOli}VGzO$#=88htf7TaRvf$>V2+G;#|2asK>fZWX!@3#@AX*lBBQE?QN7S{mnu4tC-2XtZJ}> zXD7+3kY|Jum*(?0%}oz3X1vmTC-hWmF6K;0WyrHD0^C2-i(zG!JghV6tlm?^3r3XC zJ~T59yN{acUy}L=U~y+35B1=WC1Q6T-M$JEmrIRF4XU2arlbX{?Y8kh=+X{zkgi*d zzR->6>SSpLU^PVJ6uPrUv*Ph9WZNjeHdqxSGGp5lS9H*mF?R7hR57P@V;i4oNvl2B zj%wJ<+*z{aB*okWn-Z4#0Gn#TG0C4}%xsid`Pi((2JHEOydtkxmMPgfcP4X{c z+L}4X34Mo*%yq5l=65inpb56{BbgWrM^9t2W7|mi5@o8qB~@GFI9B$b(}UpWGOu++ zw7ubNZ%Zu3q3=Mea;W!lHzeBUsl=Q|ZkD*VX75~FOTNk|()-EB)~(7Sn2ttFW@WhIKht&1X%H?p7uX1bA`Sz;G<_WEfoqLZo%%;zXckm5$}0>BoSW|jcHT`87#J={rtho8uftwP4 zz!fr}hrA5gATmtCb$SO4CP^5_;=Q(mTvS$LW@u%>-sd+GyuXG;wupFiLo9VKvLcSk z5WkIT-xM^f6x_ASY%tEl3pv(pLuf%6#gx}a8meThRgG5?H!R`3uR9;IFoZAAnySs> zNIV|%)*>+ojLu@^5Jb-s^P7v+W5RXx`M&vlEIJ9cInA>2J}M5XC(3-`O)i;3bw}It z-5*&|nH!xqH~ciW{ES>}uRMmZm4r;Nn?@OG;m8Y94^wsD_2S7jk7oue>XceB#C*oK zo&kK=fEu5NinhOnsvX5rg-Q%vn031WXqLwf5x6cPCtvnomfAy*fMQppyNmggC92-E zv7_c!MifVoE)oGbMkozTWj<1mZ)4MV4EVtZ^AOzP1d}ao7 zP>j2Ndp0{dNW?|B6(b25gZ!3InSTpyJ=^IOj-*1Jh#$C zR47ofpBb~-E#&#bd&HN0A%cu|0N(}yjVa^ZMmV}(3kg8UrQRTv9b7*V({UiIaskBB|)#K zJe-2XNLg4E`uF?dNFZ?bss7hXVNHrl!h1y;?RYtmAJN69N9dQc>P67ZH~flZkPRP) zUG6&Bu(&(YnG3L)P5i9Sl-3O+BZyS|Y~O~TUL=Qz7beeA_h3lkh`vf>M0O=&0BuW| zKSBtY{ZN%gJ%!=k6Xx?!vO_yP?Ck1bEzq(J#cI!TUqMNvNiNRkwj_RU`%J=}a&KLo zqpSGegePsXi=K%l?0}aILA?{XiW-&f@PdKqUjf2x&n)n=QRQdHm(zM2#m|0qqM^`0 z@8NK1c_G61li%0^NDSi_yY&dimxd;H&92GCX7nRu;{5USicR#%Snm-Fl^DbV^tH=XP|VDr2WeBk9ES+8keT5>NJ4o;m`S; zI6$5FOpmFmfM{pU5>XRP(RvA@=!ZUV5CP}M5z?8+qEeVtZ zjkItd>H~ia1z-S9ZahHSKYWptL`XKhD1Bcspf=peHc32YNx}Kmnz|jM(w3xhG4+Z6@OK7ub4KOIP}V8T>Vm?c`&>DlMf46A7kAeV-Wl`i0Wz zk&j2(xp0M>k)SfilefWb1iw43Zms{-N?qFXkX66 zpheg}v6j&~f?hI#RSSKqt7LL=fntSh^z?`h4i0}7s@^%uJdmuSWq?I0EMNLug`7Ef z0R0N;JvVxdP~si-198+$dkU(6dy|~vcwmb++TPjK|0vz}EH7ubLi{inCDiD<@#zLr z1f)$-Dw0vOXxem3HAa?IwJnW^3=Y8{cGqf0Qw&^gf*sS?|CV4!U-FM=*>Ud~!6o>7 zlp5sl{zMl+&HV0IWas$Vg&wef3p9Q##O{=an z$erhF;kGi0fE6sz9a@3mM&mUh1`AU#uA;{MzD9};IcNksX@$YW@$3Me@AwJvEWru7 zDqyvNNVZJsVw0$$si7sY87%3a$`-85q)-j>05_FV;4!oTR*`L4eM_zQ-%Os}b(B3E zfCHEb*h;c5#NUAcRLm|i&%0Cy>l=Qd-8F?3`KJ`yAF7QUu0`~p*RHSQw7ao_h0xJ| z-B$duR-jDl)c(eA!6gJ=MOAc)3*IrsJTwHF?A($5Itm(u{Wx6Ty(aht=%2h-5*2KN9x zJ;MFT+(;g)F{zT-e|(8)RAXlbMn)M^(?V9k<7W}HJ?n^*qKNQth)#u8Q+$!eD}%kY zfRGSTm0r!GHv4UjLE9l6!7g+*nvtubzEI#SwV9_9)eMg`H}wk z(-kwzNHh)6@P{=d0JrVWhXp#NeS_-K2^)KqVp|0`0UUE-Aa-@yU_ zDEVKc>Yq5nj}_s62M<{P9LfKUG5#z*{NMc(4Eq#cj@*`%f?@g=?&TeGGOE_E(C%%gW1^FX2&8 z6X#Wz`=~AbN-0;c885z)KpiW1q%im+-WMk;XFNC1l8DU_9Li8-n!ICUpY;R&BF`V` zV^dv-0$YUbMor%2#@0(R1=EH-ee#}ZqHc{+$(aE5h()2rQv~ZhvDO)O@>-~l5tgI2 z*Ok1b4P&zT$^qjmfgcBDU+>k2uEP~q3pxM!e2;WN|MxuN9uSjd*pc1IH%F~nX*LgO zGbG1X_}heXEQkVz^WN@ON#Z`B_G{Duwm>*3$;psvk z=xpmEtKo>7jg7u*GBFN@hI+KrTwIDcA@oR{I(~`4^nHYT@ZJ^$AiC$I-#zn{Soloi zR})s3cS%wkGY(3(-Tu3jK8D3qD)DE2H8Pjbl-4(9Ky2GsN; z-}us9!hhCf^SXDYbAO0;)CJU-WW`fY?Kz)*SDR{hxG?<;GcZ8E_+3&NYRicH*^n~3 zWTM(W3>d$Pd&3}jcwgGEMiiM} z5bL_v{Qv{kkAz4V+V}jYUu$2Q-*$8_zuvhT%G?FQqGdG&ezrF>{?pu)Ar>jg)^jku zm~34&9OKNMTst>(4yNc2UqXCDEOu!fE#ESL8;q@+bOq~F_H9|~@Pt{01BY_MX#jLu z@cCQVeZ?=aV9T%M&mT}EFf*l?!bJ43R*?mv`h@##C30v!;2o#{9xd=D}2-3F=zZ2`v zfM2`uwn;NYQN(%@D*o+yWM#6lRw!8i=agBY*X!}Ak>$0g7D4XiL5B=>Wtj~J*`+;1 za_%D1`99h|farB%x;+X56PN?MbBJJv_rdiisz*wR3^)_`47q=yOyVQJ5p2KvCT4Gh zAGZ-EQoXC+r)-$@8(zv4*n1XVgmJ!0`M`10>NpnlALCYhS6(&2l{2#&sma#ju zBL(Gf!=pW$!xe05rpfR_g+&oX1H6TjV!NxSXMBhbOIT7A(b4ZUz{vMNH7WjjVhTU9 zka!?wql?$M^knXpqOUK7yV7shyG9zDC27gcJsu)}pm04EZqdpdeBMZus34i_IA8y{ zKzdt*zS(Ao>yKkEcQCH$=g9ab{D{O)$|UO4m7ZCMiKN3CCM-15-2Dx%9e}apBI9!7 zXt7ZL7DZ(etxZGkZY6fRP;=%z zfrr$-Zg;pD{G1^YxnkaUvAEp}XAwG=rvBSs3U0hCmyKxYw~^$UJQl(S>)<#ZkJg(R z+Y99;w_8m5Ik_r>Xlu=dpF)`6rXgWv!gAM+=rYu(nLTig4;46uu)j2`Xec@U4^`hB zUrEz-`^2_w+fF9tgfp>in-kl%GqG*kHcsrE*tvP$@4nyf-oHlu3CGoy;sBh zswZ1ogBe_=x@AyQOQwO{T<|%55pZUHsE2UaPQbt9$j}-%En8t$%jMb^DYiX&_i0Xq zPO||is?~b(ZubjCEzlV)v-vUc1Q63oQ>jicqDN)_*cAai>v>PDp1_V0R6HG-{C z6UG?LI~8bKspS6=DdFTHEOkNmlpTD(GiQvXwn(*7>k;&RaZz{E$=IzBRq@YCHQC(K zTwKRaktJ5pttI#Kq9ZzqugQmM!GZaK)Pr#S$~EcY0+lX|=nkiNTPq68B(ueU_?Gk( zl-&7(W~z|%X6jiTvPBupiCQ)TRJ%LVdN~rQRM-*wX`r$950_iHg?Tgw10%22#^$UCaJ%QG;DxZjuqI-9EAv6^FJQ6i!b#Q#ZiW5~wviixkh?2Hi zg_DYD{f@Zl2o~}Dw{*n^PC3U8Q2li&LOoVN-nIHR=HmJLe7B!(>sRsTqv6FN=tzQp zPVodliddf-Wnfk=`e&gQfQ5&xGYiL|f>Oi@#nEvj5@Z1kK_2hutL6xBD=~$VqiqzM2hN!9MDZy&96- z=_cll8D z;p(3fEg?p;zH>CA7&7hzCs7(;zI!EO=s_3(ZT0Z#%^9J+NDi$o?%b*m)`7$>l*7)K zQ2Xl}$fEs+&Bbt(O?J`$IL0QGDkQ*X{Xl^(W){KJTsni>_isSKM2q~R=4D``iM{~! zdno?$xa~OTdi$S`Wuw_VY_s>U9I2=zW+raL^{ByvU-VXqVSP?9j>jRk2*VR2u?}|t z6FH{zaF_+>Y>Zp=BGcqRH8I-9Ps2Ys0wD#<>!D#VZK2O*nGON>L!?Yoef?l{H<9uo z`~r}dtTRTNkExp<5M^Hz6rDaV_*~W6BQc-9>xy>pYmG8qzil6S;D6)>GNBM%1$zS3 zm>;N7Jb+kx>vn`8IqiW@N<=rWXY9mWPfwCg5Z{z@LtUAk6Ti%9WbYFTw0kolR>{K% zuvShRe+Ldvcg%i62%U(OpSd{)87HG))l&c)>3VadiY-)e=o(&v@oBLC{7oN%Pn*(% zX3~d2Zovc@CyjW{jIaGWWxe6aCmhfBq`WnPQ4|pb@(9`D_swKwP-Z?0bSEp6B&9+i z7gN|*7?jnU(F=`H=VPpx*dM&bV=N;;_|q&Gr-)$y)Gvw=Qf_K^pDc!FKKIpHnMQ8r z20TX0Y=5duDp5jvXdOtR0qGg&1LG0{*?skU0zd4vIkP#VQJ5^xOf#ZD-NHwdWJ_2O zrLT2Bw!KhR(N^LXw?H8lqB~a3q`<)q%OVNKz-{JLSWJ72M+@>!<$)!1^ zIb}{&ygXo_JQT5#DT$9Gfr+PJ4?N+E+ZcAd#z2vZRQHDWB>Wo%S5wapIpvFGNiU<3 zv$m%H@X6l^MIuVOxUilFc|E>3tD0Gj<{8SwJ{pdqjT+bu>dS;oL_ zMp)+VMVV1%pq%1?UAQ;Je}#vQUNb-r9Okd*Z((tvwrpHc3l@3rvq- z;JQ&`kz1T-4bdDW6=7oZ}T;=a7hMms20K8LlfuLn~@H z#8!luyw_PtgQZ|d4?XRqF!)J_S2D(ni;ZT6 zg(erUc@qq_719?t4|I^f>B`MZ>F(Q;%(NxJ9BJZEj4URRd~Erh46-w~`bUECEFHY5 zCa>3zCiR`o%rVV@=~*{AfPG;jr$nn?4oiwo;fXf4Lwnu+6~y}78wDg;sTM8?=O7r^}6GqjrN z^XETX;z5aBv}_1wLWbLySCe@Q65AC@BtDP4OEce6n(DzB=hlVe@&{BR{h{Zt2oc*B@6Q9W0*N84E;au0%k z)6p7eS$>!39NEC+dr4<;>7%L`rO6b`PkL=<7(?Tbu9y=`Dl zwjOqnLxOcJcKzhV$U^7gX_62TPYEUZo|pIgKRt}u7)VSJgU|XCF54m<9B}#w8mI?i zS(OdEB*>nOE2oC!3S9-#Tx~X(b=J{@5}vcZ6sPpc25bz#Bzm40x5eVN4D!^{!)2un zHIpD!@->i3j5;{wLSwSim0$J0NvN_LV?m=Wdqls$gf)RG5|zo#TceCMm*piUuuF)^ z&%Dl8*2L4_<@8SMX$A>fM{E>X5)RD_#D+2A)NMxJ5b$MNqZSChQKH-pg)P9A77;!P zAVJ_sT7y`YiW?(FKXD+dg=g(mz@R|pYd(IUL50avCheG&!{m@aOoO)BXbYQBb*NE% zZI6f>P*|FrO7_Vjt5Brw4O@H3$}L=?6`EdAJu1)pbs}f!7z;^y5>A24YB?$>mY2+q%)U+At|4{e3ZN2^1?R?iA`6QVLrANv58HUwtq;{O~|O-^D}X(C3~~j5fVO zk?9dMTP2=X3Y@%{ixaL1$erkfIqViAU7t*RuC=7I??{yA|++ieI}& zwCB?Ll;e>$IXhzsyy`u*9^lkzT~1O(G7rW2g{*81H@F;v9cBiJk|>+E;Rm-D3*tYe zauOSe(7aQwD&J6*UC}ilmKn!MfTYA836}=UZAJG7@nEQ+jJBWfWl7rU>DM`ODR4BI zsnEDhfW+Skw@Qh($D5|G?Z4mtaKbS;xuSCFg&}-r#)HNnx>9TA}}&g$tE6m+PQ#M>7MB7W<0h+K4YyN>s>UVY{;ZRZuxMcTc@3 za{@Oa^EhO@T%w{Ca#1G@=)NGr+&v!b)gc{*iZ(DPA7c0klJ$n#qJss4uK#3E_DK8% z%C3R^i$yM$J^;h7$_uV z6#BCGJqqqgxIknJDPwRLrDMd$b9G*idV@^ak2Xr3cn1qXR~>h7y_ywnZZ`(>gP5K3 zX$z@iY3sc|2H85yh5N*vH}^w#R#q%eQjj6BCx7N_wDf=WXmUSH5_H>L8_u0!+(an# z&NgD79u)WOAO5!95)~ulyB3}S!R-I8JaisBJBn^DEvP(xXfCLaAMhA8lmn*_=9gn| z@+ZA?#g)HuvQhCEMuL!YrjCfd-YNZ!2ghh`3VJIX^qyc1D|7^YFx%|<=JCZND#rto7xFv^o&A&t^6qGAXjN&8B%UhI zJG8GhQb8h7_vKMy-MJJ8CM;w)dqQFN_&7L{PSW5qGXZytZ)gaCYg4nT`^zUPY z!AvJYdmE)`3ie#3pz;Ddi^Z_@WI7*Il@*qM!U0b6eq8GH!37+59SuB!qx8oEwpB{D zc!|stJeC@atKCL`+h=!cot>ckP?1P3T|N1ZBY^|RDLu2h{XOHhM<>;h@x2pGB=BwR zQ0ZHYaQGHjweu~r&_%9gqq)OV6kQR%Y3D|32yG6qI$Y; zF?qO^#!=V-4UCjs5XY4g^}%#jWtE>dAOk~3sbz`PTy|wR2JU!IsDny-{P*DUigHp5 z7ddG-G+M~VKam*Jyx7z4;mQ=XmsPe&x=>F*BBpug=sL`FVuY(~t=cG^pz&(P6Tx$q zn4WedsuP2erHb0t2I${(Y7)o6GfHKhC_xwHaANHB4bp4JR?>3lzRthz?GP97c?fdl zT9!#@VxlKHjIQ!{?N7OJ(oIYB^*9e+l&~J>7%#(gF%-hIrB2(u)c**$*!DW2CcrQ z0Qlph${7yUQX9(L))X1}^?JEHFk1$H?48XBrf*Xc8(t`#=L_XJsU`*fGv{mVS$~nI zNR$PeDrBud?-G_;&kQ=r^|ygR9@^r?C3(km*Mbm3-}wR($Y(3X=`o^LU$ zy|bg(h#;Q6PBp$CK`al-Kt+hY?Zz4Pu`=G3BNaLwXf2acn!+vhc{QgRq(K>od$$kv z@Pm1T%+mUP@HixBS=b{Gtz_AFOfibS(eY$-_B06k`)N4 zwe1~juN;-ZGD}+f2Ydqen%>}vQH=SnYpmvMK;npwlwidH-z9DQiX+#-`|Tyg<`MdT z?S_L!LxS&^`T2OkjXc>YKP|$J<&7My6cm1>hBP)g%PrObHLNWKv*HRz!P~dA>0)qb{~fpKQw- z_EIIR3^#ASX?FK0EdVt1mf&XhQ7+0l!;Yz?3Ir{o`+}=hjp{*sC}L^WXA2GA^9CQG zN~mVttnvc^3d>cbc$@&G!0sO!7`2?8)iYr+UgwLj7tas32{1bZ5M%R`qmRU-;aks zM?N~bETvpfp>I;NRhk~H&1ujMWw^}AXSZjS0%``H9+>6rs{O;nY>Tx`2iyPHyTJK< zRW`BJ+UY|5sv7gHtqMKqMHZtv?%^o-4q9I$fbfNS3+K9ys=hDMk@+dDDj7OCIbq{` zY`aq(ekm}n^YZHNMl-`ZQxu%T6~gle!cM6HlrFTmZ(P49S=>_cw=b~8JT4AwsCP2d z=rRrMe+YpS%(-~>fN$RV7XAHITJzE~iYNvV3A>t7Ebc@)`L7h|_M^^z0mk(?ROF>w znx6|}X38^fLk)SKUb6{SBRyTu+9}tip`~CTO1d-r_EM>jZXD-a)t855x}Sk;jOfc` z(bBjA=KwuNRpFbONVhznJ z`mf-sYSs}>?SC1gB)g#hk7fCPrCC*ZcwkEZZD$7=B>R7){r_P~_*S#SUjA3o6@1%- zGV3zh1M5t1OO&ftqf0_e{10h-*f+aQy#t3E4S6`8Ec#vS*&XlSGqz`~*6}wxf{_>S zK62da4|cNCBlOKo^)kbM>qQhl&!NFVt78Nm51=KYu=_UtjdQIS?Un3*C*vV>2NSOx zkdtvsfMA(HZHL@a@OVEnLn7dU=f_QhetQHoEcy#N+u)ttf<$jQ zgSV72!Y8BL!M8pl6O7*tmO!6KX76B)b6@a$5mroV_dgV})fIQsA%-5@P{EOXm&YiOHb-bgLpUe!R!r^s#KA&*M&8TKmgzcLqLh|vz`Ob}U!8|k0+H{4b z;YF(-*tDPF!e*-O>A(J~Nf?i<{TB<=eL;wX?1r-}aX z-=`5NbKEmY7}tkDlDor1;QK`3&we3uOo~qXQ>ZOMuXyal0CCWVz0tza?raf>S-2uB%7_suseW1 zb`OGeO#A?3fmbZ%$(kF%G`?O;41s3B#%#1c2c}XPcc(GBrprYTF9YQM?*REWP6gNbUrZl2L23ubW>G^tM35L2ss8!XXGqMX!HEWZlV8{k z)<|+`u78S%WuZfma3Thn47n3`id|N{=R?1zlw7Rs{OVI{G;z<>5a$&^2Uxe@VCkyI z|EoQ(V3eTCcdKu$cqCYVtTsm7k1vYtc(2)%-t&ntz^!No>*^dLKOIh!ohc^$vb|S9 z_(DEvuzo~@of_#LmlVLb_*6)em5tGFW`VX4LBr ze!+B8G63L&-6Kc?&d9T`&#^`qEgimELRPcaL6K~;MqbWa>W)_O<2w4r#3A zFx^iaGTIw%Vi_Y0SKNaGcxV#M0|;EMMVi5xpE20m3y4oMo8K|fjXINk&_>(2?-g=a zxU>#GiMNff0~sq}UapxsEo~ z5GplVyra2_#d*&o?}+=CimoKN*FptbDYqvqDOhLgxzCo$Y_*rl)$?;ejQM&u)AXAO zstV;}&3cs4d8+3gpjZc-pfK8W96@{KC7TnsDVUz9eB#Yg>=^kMce-IkPv zw5QiaER<;9eb*ow+~V=iQteU-5z2%rR3ecCgt48k8}?=4>BC16qoSb{hYhCG*(m*8 zu#eL41s(6@zVZ}~pEn0+Ch;|wpM=FU$vTa2mK=@B#17PXq12`X>3>}baNm++)-xlC zAv36V8kpUi>&16GdWp*p)-2YMAiqOi(7zq03hBSzu7&kD;weh@wG?q!o{s@<##Q*+ z>+lE@5L=zTkaK>1^gK?3GDqxR4$SCmO53j>Z*Fbnw=T?!)G1RVGN98buZuX)4Fy2D zrILaK$lieVp+P&eO&oTocfofuZG~%NQN3ZgDp=@Qz`DwHxjGX%~fbwJ<9GwU&s9t{&!Xsab2O6bf8-Mh)2M zZO{Gd_*YRf1hG2SsDQavzOrbpmn>O>be+wiml)i7s>L@CWGV(kiG3g-Z4aptTB%$iw>#*$TQSyCc$ z?CE#t#qM|~beMTt}o0J3(Yy!q3pZ~mP%O*1X6o4Ej!>t6)QMvvt^gqIb552fGj$16+jg?2!u(<0j3Nj{H@ja_(r^ zQ|W@~x#sE5Hs=aKtQg3zFbi+Z$*g}UPXye{MW|Xx7*ETrXNFi}cyl*9Af1yrsW7V9 zmKX7l)ZtNin3sx^NUqk>L~veC_)EfMa0k^3vB$u-$;_3QVmdUE&BeMYH4N%^tFy#5 z%1@&+sRg&$)X!P0gTNloFwMWi)YWA;Bm_Bk*PU3Q!59uK)0P@l8EQMa?y&YV;_vS( zWYoVdYIMI?0G)~Db+uIMY|&RztFnuUbpMr-L?B@TJ4(P`LW8~& zHRsanF=SP`tzoL5Fj@fKnzUJV!&fT_-{|~L1i=QNG!hN4!CJ{EAGXW=#t#2d4{zk< z6+0`F`?WoqH#s|AkHiM ztZ*qATeG6+lOyztzUg|cfwI9=j>2q6M3Y-G{$5UtITa9X85t*>IoD^+iBjVuAW{@D zV2z6Ej_$Q_=4KNpo#oU}MfJ$?L@)S>5(^U%O=>h}nbzN8|4|;uJbq?xG5?S4?^1=M z#=}))_xQ1Fnb~f2rRhk~a!woh-aU-fgmuvA* zXi=F);yLq&iI|b?3i1wD-=8(G(eA|E^OQo<$8x>4olIX+!81n|Wx5f}&^FfA4hb8! zr(<)j|-!IkD&9MUuaSue^2llJSdre^*8HG8{NY6A2-rMm-4YB!>?miNb@H8ys zsdDSZzQ$kW%H=<#2^JymSOH=*vS!xe8gaUKIt`$T@qSU99ncG2v!#bB#T!@8#lf?l zZ<>VNYsokd!?Fe`q?6L?IK)vt7|-xK6Yhi;`v@7$BZ0MQmI!bxtfS%(*m2OIh9NYN zm_<(mJRJ*{M)c+@o`_9r_yeZLqUV$8Jvzg94)DKgK>>!R3g4OC;OYt}1-#G=jav+& zE*=sE4^{PCCm zd+^!oiQ-+nY^QG^o7J0#Hci9 zwQgYZbbS%S=$1+EXJp*3Ef|``96k3Higg?mIo4HbYQ)-Vi{z3Z=^`RKl0mOrXavP$ zj*Wecz@TxuZYw8C+hq?^JfC5V#wD^d7LXpfGv;>59Q8xwOy4?QZ;~(y)D^q8&AYE= zwEA2!S~!`Y45uqu@3h!v!gSiBV&P#05DNAVGjJS69PUT;2(c9K^Qa29ldbWVl*F~* zNh;`#OfBWyC~C?4rYlc&*&Edjm?|s%)tq-E?{t03;_Fv1q9o<2zF~(Bod{7Tjt)J-Z7eJ|b^MCKN(%Ues-kp5fD;(HU z5{tV3FThmnWDU1W!3YLS5qqtE?%c=Fp?|SBOFIqHqQegH{Sfqb{xEyV=&>o&R{i|B zZAIibgl908K!F`CadCOc;ZUteEr>5inMgU#=X|0c{f%NHT1IYiQ)z`iITZumzn~xk z``U}YFJdoZsrvq!UxRX#-ZA8ZxBXv~3^0)ruJ#_q_|H(j|LhhlU$t2FU)0>m<_r*` z_1_<&L(%U+{?FduDLUy$ zcsq1tr?sSV7xxue>hW*efB~}wjFSce?TbMt9S^T=R!&cMR5+^kA2McEMI!mN)r)1| zFFi4+2j7DP?vX)w#7^yALdc6GWhPU9jjWy!b3+F7?|CELIM!c%_Z0Pg-deIVrx&0FS4(=AZoG-7gtyvTnW55oD`pf@a0DqY;mOWi8OXPSwB!_YA z!Bphv;7|s}zF6|n3sij1E|7Gup=kr>VvSY~Ir7f zT39hhDgU*7l*s zcsR$#-B4HS@eZBdxzWc5oWyl(cIT2~e5uj5EZpWWob;S=w!s}x)m*{vbL!3kIFytB z>XtX)Bi4Zr%sjIg--5{Q{v^Jw*>?#c!{iIz?SjL8uIOnd@bRLH=4Idg^EMD(xegSrRf=^KohR28pv>$OOCrw0r8rNQM3 z^?A1$|0-K9$sGfL>TDTP$<_x^lL@XzFt>I$C_YOt-M&$*3sU|h+F|vWQF05N3Z}NZ zq^(6Zsbf~z_8@wS-C8eJR28GO^U18T8+WoF#K)a{U8_}!SJm0(iM{LKCTZIl^HPT( z&A6H0Kp%nRT~vE4m5Hd1%eC%PB%#t<;`!mh`OOpKB{GHF_!!y}Udv?bjvodH(^@?9 z=WoN|ws(XIY`rlMU}s{mPP^y~x9eU?;cm9UipS4aWnkm|4 zqmiHX_O&Qw3_>P_d~W(rHo&4-e)&t>5}0Q(bYy90v+5XgQY_(u}JwZs4vTX6Cukb z^L_vW-l=X6?EX8W1@Nxppm6Kt@M5zzj(2O=@pxTal}W2NX6r4Dw;nB<5(Wg%HKZaR zCTpW7ym$i1{$Y|<@SN`_pYOs-lR1YwZikzEvG*S0CYr;!P|deo*hRhB7i<7et>9_A zK~r-_6#`hzoFkM0TNAS_5lZ9E_2Dggllj81G@e{2^8}Q$&B#RldhzC&B1JC$Jv~#8 zaNKmcB=pm0Jc!9+y_FA&ki7pxr_p>pZpLe7o39nc|{Ze}5v%AV1+(sAw1vfN*wqvWjT)_8Jc7e5ROf<8>Vw=Wl~m ze=A+(z1mt*q}i2_#Q1?C8&j=+_s6m_mFlOq1zK}Qt+g)`=9_IQ%6qpjKA$x$Th$ZQ zuS)fJd9acBl0OyAOgzE3ixlL&%2!Q^SWS*C7ciLl?ylOC@~NEZJe|H+WD?E=9+Au5 z^Z5)@k~O{fjv0gmxbuw`Dv+Oz(tN&&=KCd8k*D9jAeg#*%@9*UHX~P7D5Eh`GKY7y z-m-bkHBukELHKAZCA;HgkkcpHo0fL!M%pkFy?iU1p6-N=EYiPXjf9l zSRWxlM1;ApAO~+QaEnH1MIY4hd|jpLkp)dm{oouBW&oh&!kjlXCd0 zDeW#D-$Vy#f}<0-SN%4>7=8Xl*|@pfp`0qnIdkgE3kJ>Mi8D4eHf@~!pdeCg{p z%>)WENhgg}t)o1jC@mkU$PFPs&XMcTdVOyur5eclj8^eTzj#9gtH}1trRJKfuIeS5 zOL>cA@vv(~u57%&m^eZP#x1;y7DC`JVWdZ(4W>*cme=|88*X5dl9E-rP?QJ;tCeW{ z-K{cwSP1J#yE20l(P2OburFX*p z@IrUhZl=vn$mG_7J@$y{Cb7)_GuHON{KE0YDsKua3M|i zj<|cM1u-7a3YLMWuk-LnuAq@o66nB-?#7=AQ?ePeG>dHrO>HfCT5wW=_pLCS^PA-# zUg`W1YXJqkcP<1R8x8T`PJ8YkR%Rdk4Zo@G2ncWImtdp)R698JbvIB8KTx_;#ESF7w?NV>|q&&oDoUc4KHLY43HSBdK7Qb7oWv|YST_t8~cd(pD<1LR_*87dQ(m|kzoEAO-GXIRHIMv%tXKhk_JB-o0rmRqs(^iM2rlOXJzGQdrqZbkip0 zY=Jli90+9DkIT!>Z9{2cT2?b2i+N43+nGzha*?+Q@bfmKb!;ZX2=He6Zgj4;uVH<$ z*l>T6qkgkt)fXEhWq%NU)o>&TIxREXsCz~EhX&6%1PmGV^fw){H-D~Y`RB%9K2CrL z65;lCBH&@`@!`$qmr5R)nnZ z?Owozm-;nmprgZCO*m6N!|Nzql)K$Y>aavr4+yPc=9O^*5iDDXP!+2BtJglop5={b zw5qzC4SW1rTv&<2B1~uY(EYHv`iv%Phi>{2^3(ewyEOY6OPb~k)8(r6$Pu;nQt%_> z;qaE$z*t=GSmsI&fcuAN8lll4#4FVBP0>`gEJEcsPVYW$ymEvb?^*7 z!Kh*Jt#B^E8Q8PDJ0=kGzS;b1`wO$%oxhkgX!GyQ^A zvE#v+fRv_nYT^DPc~1unN_mw(98>P4Vgb09yQCg`H9f$=QF3T+7^OV03Ucty-mPEbbOQNCql}v8K(pgB#-TL+q&&03#L5;S0 z7f=(}m7{ng*ZC5K=nt@o8rcAIBkw5jgN&lDMsbxV1s}dVN)0&{ar-b#n>q|o@ zUXp6~HbFm~O}Iv$E(^TQRikbNdbjY@g5Bk0D-fd__hAn!L?$Sk8ZQ$l?vNjd@$ojY z8m+V-JARp1WDJF{2^UDOl>;m~BahOIa?{r>t{ToqX%N>^Db$WE4`MeZdVT$F53Gn$ z)4rJV7#RB?pU@ezG}@xzd2Ug0aTFp(Ml}3>L))l%p~8Rd`UC`0b3F*S5;mn|il=lW z7rw>Daq0OmgjW>?#(mklSO}%er!@HlgZ2%!=L-I{O*DNbY?l{P=jVKEJ7F#IkDG^i zehI!Ea$^wZWpXUG$8tfroKhli6GcWcE{V}7OFl#71D&>Ct;26?_)VgBU^=&5ctA%y z!J!eP!3u~f=*syfHoLRrcsgMs*>^GVdnrlWH?{FUmAq{5v!K_65@Rzsj`rtPR@)5N zK{AmP+Z?{r%Ci+{J)BPNZ7!@IxLaEt`ShVIaN+X}aRoHGCKS6(3A4~_>nsliRinQG zQUoZGah-#-9^1w+d{WL1t?a4nz*r+Uv+kC9DJVy8O(%HxmIUk?_7^o`c#}sYu|+)k zxx(+fqd*}{ywK{L8qrp|xpJMU8NuyTBTQ?LrB`(jcgB7`9kun55v<|sgvIiY3Y;mi zbb(>CyOMfeLc*??4-RFAwxy=!|Zm`gYJ{&OX{s@$$jcV_I0 z>f%CfKV!~&&pWV=@ge@Y_}oe{-!5glJbYBFU!J7N!bBz`SeVdl4t!d3W9*g%@-J$T zZBwx@#&haqA@8gV8D09f=A}knHm?mf*A5Eaq5%tDw*kg)m;UJhU8V#?-!0JdVD%>< z2%$)?U#zl&J_Zki>pt+0a8{mMg6j9!w~?VnmF~~@7@Q~mWXuB@GbKCvV{oGXhM_iu z1rz>V;Zp3VSDHb;@s?|?HVB7Z=!wC@pe*kD-fb`GBRU*0eX6rWcGpH(Kyi--#hgW$ zpNqJhbi4iJC5Fq1?(`SzC2aX7j;mdv79Ion@2q@23SF-S_b=$GI

#64ZeU)VI-_eW}qA z${nT}+7}F4KO{)JZNxjs=Y^?QNI-n9-qWt3ECoCg@_HAHM-#O!&_v|2pb#7ki{fvO zj9Vc*+80tvMNit>GBPJ~_obg2Th!6@hjnwQV;b&f&M&R0Z|3w>8TI;>1I^UgDhY>I zsR4!zTWu2gg8NlE9iCcV7vf++SRY$VkNThP*I5^Vr^Tr ztl!w*Q4J0BSJnnSgbJ(G8fwH!4M~5$I%@d{%c;2HJC85#m6)0V9KEg&xZM+T$<(&! zTmc}BqJu`K1u+zhzM1mVNe)<7RK1?~P_a^H^7gA!JS#ddyc9YTh>L+Em-Ou(VW@@s z1bZgChjR`ELw^LRG?Bd{_r62#WxX&?@LnwDL)1 zJ}rjm?I8r6Niq*{m?6x*trO__WOYJnCfKUwFcmXql$4}qr&*ZJr zQ=JIoLh^*YA1%`+Y0nGBx64T`P9&nbZosUYLgQ>&Qu?UGLB(@o4KO4Glz#PP7%=K> zRI@NL$-^tTlMAU}#0K#oxP2si(~(W0)f;I}$QlgHkKEk@eX6M6ks$Ih7sfCRh^pNV zId~R6H;tdSYvISn3HhIb#1I~htu`xA{W3}>W)419D^bsX(~uf5u~a#gp2oQJ8=pPl ziu_rM2b+<1s)h~;$@PL^tmomtK4I43)uF_+$xyZ_W9r=e`}<)(8+jKUg7UHUI>uAH zC4L30&4k4M8wL*Z9w`5&?Zga0mG%sRG=rN%Y-}kJtETcEbu^kSIj10B+3t@0Ponq4 zB(w%?<$i(h!4SURoQpleR}8PNRorARCNr7lp!S5Pr!DeBte|En_shzD;ybV?VWZ|; zi_3(?l4zd$%MdFsQcW|`3Bi|3ji~yhU!PB0NbjFK6n+;lgLw)3dL9QkdaK%9@o>^; zenj8@@HKtPqnuRl4njnb1WJF^{j%bUifM;o$GN4e!2FqSkc-29y&jtgCt+a=?*oN! zoPbQBEY*0j=+EFZT<;!_3@=hSEEWWdF#8AiK>Bh&0TeliKFs7eeJ*qREkYEEie`6u zDkm34M$4;v_w&K#O7v*n$OBDu9W}U=RNNvZicTTYQ%Akl8t0Dc-l%^WnUMZEN^9V{ zie?DuAQeGF$cCkwV#3kvTF&&dKBab&XwSz6R`iHLe|WI0lG{-Otq>?t0fI^-nbp@$ zfF+y7g5ouz&iQpV5e1{;p$~RyW@D@TO0*-eIxaeH@^3(!S_yPHU~2WRr&#ps5J3x7np>jdz@ zH{})E?>1&g>CKfyfW?q-CSK2OK4=%|N1=rx+s1LX&gS=ta+Z?%QAUYM=KEJV7_gdR zH(pi@_w4fYZNf||GZ~x>=+GT160ZoyL@Iku!#0Q-#m{;+HHP!GTnJ32`&;+9ic`Tt zy8b3Euq@xu$YnJUf{%V^%0!ADm1j!m^}Vw%GE!9~gBud=jJTB)cP&Nwj?KDgNx6BT zWTIv=`(+h(EgVM!TCODks?9>VCT&s`f`uA@jx=ClX#LwQ(ME+VJ2LR##eXcB&wKiG z2u!`zkvEa4eW9zFOQF9YEC!xTC%pNfl{eWAi^1gmNmQf#h`%meu+b(lop39(!FWtW zA}T{tWR-H=IenC@0Rd-RjVyIZr$@L&vogof!fx90;d$yw%@HHn^bfM8AZI}rRhh=P zP7t7pg_z|Q-?GJl6bSG@K21(!bm2c)u>q|xRREk^5?kK~mnq${iu&bHM75?j5`1Cg zSiqq+8-V)1tj8}=VezHdxM&9rXsBs8gTv93uXqhK&u(jY%M8;7yw`t(GZ?g`zzq=h@5 z3ZyLLQ?kAuP$+Qblj`*kOoXOgx&6U2Ft4kJY_9<#Fj`){45= zxtQpVT;XnhIRvxcfvBJ9rNg*qfaw}Ei$LDErMgNh3Qb~`A3FRoKZ+pfKwCH< z#vSO+7-6>0LQ;>C>U+6ZD;#zs70=nl{KJd`4O9SHP!DR`Y1b`(*(fNU(;Chh%>K#Ngz$al3q%UxdYS9ZZP0saBHN3&VM+`Uo@EA9} z>qW!1E}E^;FL3EMPwmT#s!LCcM}CH5rZho6Pz z`~uIYF<2)*W8HG{rUuPgLSlz0DWBUZFKFds3q^SJUS&V&=>?lyB|+)7)?(C${+7n} zcN!Jd;uP5EGAb8c4iOH^JLd27G-pCDl})OVpxj{h#Q4*@-Go8x#XG&#{+-KKFp6B( zAC+5NGM-FNK7R-R{cMAT)UTqPujzWV9aH#&P?nGi@e;4O+DM7-b)Giu>teMrE51Em<}zmcoj==x65#|(xs^D6$Z!X5 z@7^0xMR@&Pc%1OJsiIpnSd1BH-4PhB>y?sOE@$-R&aJh|6asR}Csk|z#&=6(eseay zcO(aFBajj-SZ(Y**%>6VQV1=Vhwn9@ERF(X#%K>cj;PTkCT?9`Tq}eiHm9@&T~qFd zVE1k5mo&hP>$JRtw^zAbI4R+l&a11XpTsZYl7nSpqg@Mm)vl-LqXhRdRQ9asHaLb2AN`7;A?%iGC z;haTNaRDQ-at9A}uQ3`hU7k?`sYH7^<(z^R)~#NLn7nFu+RA4A1L%V>0>@JJ_eIvH z??GE!2?A=gj1U)luLIbfx8YtINiL=%oL6B^8CB*Kw|^BpLpF~KS*M;Yt_>V{(#5=H z5;YptjH78Z8=ow>AtDYickK9EY9g*xH|cVCI)Sw;k#F~~gdRTjD?__IE=(otI8xUc z63|ystCai(Uss}oe@7*&=6MxhNANd2g6x$7CAIKM(}$}i7CJp*zodVWS#w!V^&$&|Q~vgPPh}*r4;?x0DGb?VH}X90Bq5l&ig!Oi6*hGTD0^LH69$_%NKgYZuMzzE}_T z+7X};mO53IxwHrQ5-Wn!gMZ}6gqr>g<|4hbQGU)8`;V7U~v=8Rew?FfWaW!^9?$QLWy$SDlZ%J+oNs9!?@ZzZ)R?#2@c(h zO@iscLvMxW>A8fN;-~6F^~rq_76hXn{T6KMVONCOsdHd3g$Ia3h+H^q+_o}p0{PYH z$79Y>ic@eLi>%6}up=US+*!hbTcL4?wNM817EzCNk+m|#Cf>l~-Y0gM7;k{jIaH|i zg4AAGr|4jh?vhCF(Z}|B?OYOlo1EVMFYIE2{}<$d&AXQ+_!0h{zo+~LCFRs=m+Jfd zDudtVIF^UtGo#CN2;m-~kOfUS^YC;^7X26PfJtJX_f7{dQ$kkSn8?Vl0#De&S;V@| z6kiLPO9B)3gdhfzTEAcf0S!PzsN+>h5VBGSKgeCd#({eB%ZMrSn$lXQPktGcf=q-K z2=08M%UX?m&%gVH^>Q5MGnOL&7`^CYdB#6i_$z78F4i^6`V0A>U;%@Zuy4-!_iUtY zpZ-vaArM75$`4*W0+doyfDpyiDhCh~)oAy$X8D`t-jH2ATF^Qe^i0f}%;k z330Lu8cknx?y5iImAGQ^p!!l`V&XUs=eyid00F73-k4QB&H3jX?opbDnZ=Ib*w?@)})}5J- zW^=16u|wTS{V;fO3u9j5jswv3U#vqw#Ayda=QHtL+FX2d?1R8;*a070+-Tu=2jg<| zbG;9(iO$I2vZ{4&PZcw8#pXdr?~+&ZY@#FK^g2-d?rGR|bQCkvuI^?ld39X*)10XJ zg9-=7)fgDO*;(jnMxc(Nj^sb7MMOcjcmF3@upy*MQ= zb=jh~%=s5xk9|y^%e2*>4Vm^$_+NIRwf5LV)~{k>a;rb)R{JyCyBK!5JSceJJ)mCq zb!O%A&-#D28}s6+J{$?_nx3AnMeWQqhp=&R=}p$SDTDV!PmT}9zMxR3pPLi#@~4gN zR5sU28!Cj|`Btr)z%%)IP^N_xA@%s3+Q+Qi znSsoDSatUkw@aOQUJq>q3@rTA?gS7s7NDfsK=GfG0WDj1QcnUSyRA;l!jZd|ja`b( z-eK*uk+R9^g?!wy=Hf&=rGB{~RSu>~L>XB$R`A+}R;OI^4XeZpXknI<+@7?;1)>Mr zTJ%614a0Xch3tz&ew5S=+>+jc53Q*0Z zd6xtqgHFz_{T`}+?7+w?XkKn}_O@GViPS+@9RwXI#hUXEUn{`WTdXz*Pf zC3l7F|0s;zX#x|5-e^%9qczG7;kGTIncZ*+HaT!Zbw;2c ziY5AoY7-RzG-9P}68qlUl9!*>dyVAAPzA*vOf-4$L~`;Md(M_;FdF8s2W|k;q^^KE zhYLFoXkAa;6yF6Gu6*8}4YKo_8zrLMh8#J>GduN3O5+__gp_#Vv2{O*5A_A`wt zMaxfWXJZ;Ni)mq9g}nfZmR)t89mX%IE@Y_q zzY|}9H&^rQ#!uZyWFZI9(!|@hTS`OwcLgH@E0G3 zM0I!WyfH3qHJ{b3%d(bQ1aq7S3{x4ZveB~fF?S-Zc{6Z-V=uN42?!u|(OI(^(L4;H zL_f%E(zC8W!?U*u%u~^=b0#})wc;nLBD-fVJ5Mp)Em=b9`#Ls&h5nK?chMUg5HW@RgSx%;LX6j;M@oW-Q1^s{M9 ziHSQ?4Q2!cIFsptg9BCKdQau&F?9YZtrB+yayT0Dj5O6eb&+XxW&jPH^ZGmg)xO*4 zzO_Tn&_eQG_>S}O_}gvt)PgE1>GeU>;*L$XF6QZwz_wnNF3k!2%@d#D6_UJa-{*yX z@CU5Rvj8*SCQDP#+ndC&`QOQ6z1^m3R=dH)gFDg1J3zZp>YB}+Tce>9k7@sf^Nj2{ z&YDvN5$bb8Olrcy5tQlHUD%p&<@M>pSozcMG(kO<7FqIc5lKl*h5BhjHdd5EGOfmd zEfhfjvF5QEL$A^|Vquzao;o)1t)x{RhmrfF?_#**^CBhpM2+`!KMG7d*3{n>7z&Qs zeVJ*cqZLZ!+uXX9Z8$zTv3Q-d{`8c^iL;50t*!FH9;14Jm$3%nVr=@LlnS2nnb^0uL z>tnw(ozJzB<Scpx;u1J_e?yMMiLRHt}!e_gFWMm0JuAB>rQZ?)d}MS1q& zM;$XpUEBgvnkfX)*BUr&MdYtHEDF7Fake?pGQ4-9YFSj5)|wTn$H@acdT%Eyrm>}< zn9T-=fwkTV6w&aZD>6gNSl0T|Vi?b2jSxGFE8E@M0Q9$?rSl%skT_CIh|-*1QB8n$ zpS9fo9It8iBEC#c{n;wYY;6lFiEvQU;5z$fBjfC)B*M&7b^Np!S*iWzk``*JVR45t z=URV!KGGI2kfRLH)0@M2VMd}3rW$;qTr+tIacR`zg;xzILI_VFeAhXG-IR`fWuexy zZ%6#bfBm#l@rHG6-kBsM99W4Myh0Y}Q+ThzQ$jj6!HThc=Xgbb3l>|hwqz=2&j=sK$qEUvy?VB!vfaP_= zj0qUv_{oE{1)9mQ;f%*jj*_YBH(n`;KtYe@2e!TCy@)Jjv?Q$W-V+}1MyyFtEr9}> z{$6K-6xV(dnIR~X$x)XMFZ=pW4Raj9uV*3=4ln$_49uL9aFNK#;lwL+O%4ng`)Z}MEQ0rzupCsW)QT`p znexM=-fPT-egca|lE*8%>s}vitB7yQl6WlHm-c%lbStejVr}MWfY3!xeqMR4r zH^9eXY(njRHin`sDV27PNsZC8#>6{Z_om=oK{?avFT88Mdc=4ARQ*&e4u$!*5B7opPdDYB@nY_7`OzsUH9C07^jy)_5SPj+ z;j%0?zi$*$@<-mdcY(XAoqLPcOUCX|!efUvW0eu4VUVs&xJ6~wrKBehN;Z`1_<0Tb zj>N9h)kn_s!=E>+E+~5Qim5UPZ{&OSjr(Vt!Dzk3XZ0A3x1-7?et_|sf}OU&rXc*G z8xthF-Hl0XD9IYd)u8l%xH(aa@=~s-ruf$R^XG3lb}(?59E8K z;v?$0wC|QJ(?l~LW;y)Q)xYKH_ALo6fT4N(`s}0Po#K2wKZBP@q{!{DCxqqU>QId! zK~MTNY~_ydC8s;Lg1;rjb19`=PvbEy)H`P-?-@~A#@p-KziTA2H-g!dQlwfh5-wJ= zp#a=U0i;emE!wQ{y)8o12blKLbTx^J0m?W-+JjogN^Ptgk$6B<&Ri+CS zZcZRn6b8Nj_`i<(ph=};{9@JP!?*xt^1AwoAmj6LHI?v~=~d#l=BH*tePe8)2iL_W z8Co|^8OVg%rRqx)6}6RLr>7T3LMm*}A^lRo(_nIeAfkEMN1067Vb;}NnX@4Wyo|67 z$F7J3zIZ|Uj=~?DTaQ~n7qi^F^^MmdWHcd(re2PlI(+E4n`*F)b zvkBtf%g^QC?r{nS4pfnzPjtk+g|E$2@kww(21g9Hy8MGLNmKLZDqf|8c_*dxclDEU z#yFNz3*KHVl!TCWg<4x%CneO>Y+z^1=_+Y?Hlw!3Tx_qo{`a&Gc6V~C4FK4OU@W&| zjB(!=QoCb`<@F2Y8f6(cIW{9{^St>IKtb<%8$i9@$CefS z*N3)j%RU2eihOz-5uDkZ){Ach~0{&bF{20KN6 zpI*LXJ)%*?x_fOjsNxSe=}(XK+0xWgv4!M;iRFI zR{xPdUd)s~#ZscdKi4xt|4Ks18P$TFdf^3 z!{l!%4pSo|S19BbDE<$MuWg?hZKL=cD@B-N?0;|ir@<6F-V=ZFvv5s+K-H<-N{|ze z_pXvQw|;xEnykl3Uz!ai!}vMS+~6p4_uHY_dB{PSxgR2;A&@ic9hXn^hzv8ZABsI_IHdH3SF=SP)M6E z-l|De!xe0qU)Nups2uhB@mP)|4Sb(GW$fNo%IJ=5@z@BEMR5oP!qgN3-#M)V-)j$* zFL|3__n09|14|M({h_~e5T87nEt2QNOl8E@QOOqN9}BEbS#Fq^o>qS%@1Nu}F{W>6 ze!#*4OO24RM}kD}$i%?-Qz~FwbrGg2g<0 z9k0jO=tOa#B?+kwRxO+c*{J2RLU6#iS!!OY2xbsdYVMP|n&KA@eDx%nGeA?7Q%2$t zd`j(5oNiksuY$KT{-l_?>Ur(h@(ZH&_(M>d$|+bsc3k@O(@Hlko3tcAntHa#5o&2kW0>1GsdxYYJ|;L0(!22%ew3;FA#@((hTJm=vNbnuk@ZwW&0Q}^{FjYF2!P6V_#fR$VZ~pGEUaYBtr@5wA!@D*N zbS!%+MUCAt=@^9soyMdZDks%@JSoQFBR(}wcFMY^E(r+mMy;B2Q{iP5@0Vg(Mpikz z^(D(92eFQ9?Zofog1%v*gxd*(dQTMW%nE& z66KTh`lq0RTzbN5F@QA8b(YW+P9|Fcq@=-_Ru=Bh8az+TN6o$RKlU+-3}R|gvID6u odE
  • Windows operating components - any binary installed by a fresh install of Windows
  • Apps installed from the Microsoft Store
  • Microsoft Office365 apps, OneDrive and Microsoft Teams
  • Third party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
| +| **Allow Microsoft Mode** | Allow mode will authorize the following components:
  • Windows operating components - any binary installed by a fresh install of Windows
  • Apps installed from the Microsoft Store
  • Microsoft Office365 apps, OneDrive and Microsoft Teams
  • Third party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
  • *All Microsoft-signed software*
| +| **Signed and Reputable Mode** | Signed and Reputable mode will authorize the following components:
  • Windows operating components - any binary installed by a fresh install of Windows
  • Apps installed from the Microsoft Store
  • Microsoft Office365 apps, OneDrive and Microsoft Teams
  • Third party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
  • All Microsoft-signed software
  • *Files with good reputation per [Microsoft Defender's Intelligent Security Graph techology](use-windows-defender-application-control-with-intelligent-security-graph)*
| + +*Italized content denotes the changes in the current policy with respect to the policy prior.* + + +![Selecting a base template for the policy](images/wdac-wizard-template-selection.png) + +Once the base template is selected, give the policy a name and choose where to save the application control policy on disk. + +## Configuring Policy Rules + +Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. Hovering the mouse over the policy rule title will display a short description of the rule at the bottom of the page. + +**Policy Rules Description** + +A description of the policy rules, beginning with the left-most column are provided below. + +| Rule option | Description | +|------------ | ----------- | +| **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | +| **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | +| **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | +|**[Hypervisor-protected code integrity](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. This provides stronger protections against kernel malware.| +| **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | +| **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | +| **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | +| **Update Policy without Rebooting** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. | +| **Unsigned System Integrity Policy** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | +| **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | + +**Advanced Policy Rules Description** + +Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of the policy rules are provided below. + +| Rule option | Description | +|------------ | ----------- | +| **Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | +| **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. | +| **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | +| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. | +| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.| +| **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | + + +![Rule options UI for Windows Allowed mode](images/wdac-wizard-rule-options-UI.png) + + +> [!NOTE] +> We recommend that you **enable Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. For this reason, all templates have Audit Mode enabled by default. + +## Creating custom file rules + +File rules in an application control policy will specify the level at which appiations will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports 4 types of file rules: + +**Publisher** + +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specifity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. + +| Rule Condition | WDAC Rule Level | Description | +|------------ | ----------- | ----------- | +| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate will be affected. | +| **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example a device driver corp, is affected. | +| **File version** | SignedVersion | This rule is a combination of PCACertificate, Publisher and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | +| **File name** | FilePublisher | Most specific. Combination of the file name, publisher and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | + + +![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) + +**Path** + +Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a fileopath rule, simply select the file using the *Browse* button. + +**File Attributes** + +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (eg. DLLs) may all share the same product name, for instance. This allows users to easily create targeted policies based on the Product Name filename rule level. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. + +| Rule level | Description | +|------------ | ----------- | +| **Original Filename** | Specifies the original file name, or the name with which the file was first created, of the binary. | +| **File description** | Specifies the file description provided by the developer of the binary. | +| **Product name** | Specifies the name of the product with which the binary ships. | +| **Internal name** | Specifies the internal name of the binary. | + + +![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) + +**File Hash** + +Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule cannot be created using the specified file rule level. + + +#### Deleting Signing Rules #### + +The policy signing rules list table on the left of the page will document the allow and deny rules in the template, as well as any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you will be prompted for additional confirmation. Select `Yes` to remove the rule from the policy and the rules table. + +## Up next + +- [Editing a WDAC policy using the Wizard](wdac-wizard-editing-policy.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md new file mode 100644 index 0000000000..b94efa4c7c --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -0,0 +1,21 @@ +--- +title: Windows Defender Application Control Wizard Supplemental Policy Creation +description: Creating supplemental application control policies with the WDAC Wizard. +keywords: allowlisting, blocklisting, security, malware, supplemental policy +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: jgeurten +ms.reviewer: isbrahm +ms.author: dansimp +manager: dansimp +ms.topic: conceptual +ms.date: 10/14/2020 +--- + +# Creating a new Supplemental Policy with the Wizard \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md new file mode 100644 index 0000000000..cd11f70511 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md @@ -0,0 +1,21 @@ +--- +title: Windows Defender Application Control Wizard Base Policy Creation +description: Editing existing base and supplemental policies with the Microsoft WDAC Wizard. +keywords: allowlisting, blocklisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: jgeurten +ms.reviewer: isbrahm +ms.author: dansimp +manager: dansimp +ms.topic: conceptual +ms.date: 10/14/2020 +--- + +# Editing exisiting base and supplemental WDAC policies with the Wizard \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md new file mode 100644 index 0000000000..7653a2e3f0 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md @@ -0,0 +1,21 @@ +--- +title: Windows Defender Application Control Wizard Policy Merging Operation +description: Merging multiple policies into a single application control policy with the Microsoft WDAC Wizard. +keywords: allowlisting, blocklisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: jgeurten +ms.reviewer: isbrahm +ms.author: dansimp +manager: dansimp +ms.topic: conceptual +ms.date: 10/14/2020 +--- + +# Merging existing policies with the WDAC Wizard \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md new file mode 100644 index 0000000000..c21368ab72 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md @@ -0,0 +1,53 @@ +--- +title: Windows Defender Application Control Wizard +description: Microsoft WDAC Wizard allows users to create, edit and merge application control policies in a simple to use Windows application. +keywords: allowlisting, blocklisting, security, malware +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: jgeurten +ms.reviewer: isbrahm +ms.author: dansimp +manager: dansimp +ms.topic: conceptual +ms.date: 10/14/2020 +--- + +# Windows Defender Application Control Wizard + +**Applies to:** + +- Windows 10 +- Windows Server 2016 and above + +This topic describes the supported scenarios for the Windows Defender Application Control (WDAC) policy Wizard. The Wizard was built to provide security architects, security administrators, and system administrators with a more user-friendly means to create, edit and merge application control policies using a GUI desktop application. The Wizard uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/en-us/powershell/module/configci/?view=win10-ps) in the background so the output policy of the Wizard and PowerShell cmdlets are identical. + +## Downloading the application + +The latest version of the application is available for download from the official [Microsoft WDAC Wizard installer website](https://bit.ly/3koHwYs) as an MSIX packaged application. Additionally, the source code for the Wizard is also available as part of Microsoft's Open Source Software offerings on Github at the [WDAC Wizard Repo](https://github.com/MicrosoftDocs/WDAC-Toolkit). + +**Supported Clients** + +As the WDAC Wizard uses the cmdlets in the background, the Wizard is functional on clients only where the cmdlets are supported as outlined in [WDAC feature availability](feature-availability.md). Specifically, the tool will verify that the client meets one of the following requirements: + +- Windows builds 1909+ +- For pre-1909 builds, the Enterprise SKU of Windows is installed + +If neither requirement is satisfied, the Wizard will not allow for creating, editing or merging policies. + +## In this section + +| Topic | Description | +| - | - | +| [Creating a new base policy](wdac-wizard-create-base-policy.md) | This topic describes the how to create a new base policy using one of the supplied policy templates. | +| [Creating a new supplemental policy](wdac-wizard-create-supplemental-policy.md) | This topic describes the steps necessary to create a supplemental policy, from one of the supplied templates, for an existing base policy. | +| [Editing a base or supplemental policy](wdac-wizard-edit-policy.md) | This topic demonstrates how to modify an existing policy and the Wizard's editing capabilities. | +| [Merging policies](wdac-wizard-merging-policies.md) | This topic describes how to merge policies into a single application control policy. | +| [Deploying policies from the Wizard](wdac-wizard-deploying-policies.md) | This topic describes how to deploy application control policies onto target devices. | + + diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md index 1d18afd93e..bcddc618db 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md @@ -45,5 +45,6 @@ Once these business factors are in place, you are ready to begin planning your W | [Understand WDAC policy design decisions](understand-windows-defender-application-control-policy-design-decisions.md) | This topic lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies. | | [Understand WDAC policy rules and file rules](select-types-of-rules-to-create.md) | This topic lists resources you can use when selecting your application control policy rules by using WDAC. | | [Policy creation for common WDAC usage scenarios](types-of-devices.md) | This set of topics outlines common use case scenarios and helps you begin to develop a plan for deploying WDAC in your organization. | +| [Policy creation using the WDAC Wizard tool](wdac-wizard.md) | This set of topics describes how to use the WDAC Wizard desktop app to easily create, edit and merge WDAC policies. | After planning is complete, the next step is to deploy WDAC. The [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies. From 8e585bb9451accb7410be18e05b9a8e0933f05ca Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 22 Oct 2020 10:38:27 +0500 Subject: [PATCH 008/825] Create pin-reset-option.png --- .../images/pinreset/pin-reset-option.png | Bin 0 -> 83633 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-option.png diff --git a/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-option.png b/windows/security/identity-protection/hello-for-business/images/pinreset/pin-reset-option.png new file mode 100644 index 0000000000000000000000000000000000000000..7415de9616afe073ff1ed7380086dbec46a5630b GIT binary patch literal 83633 zcmcG$WmH^C&^C%BI01rtfZ*;9!9(z%!QI`04;Ea4%isiecXxLNcXxOBhMaTW@5-OM z?z*?vVrI?E-o2~4tE!)>dYWK)SqWqWJOl^`2xQ5xqTeAP-Yq~tKpVipfWPtB|LF>T zgLL>VAq-JEO0W<9@Xka?MhF6;A`+c4yzSQ?4iFF@y5IgF<7hwNLqNRdNQw$6 zxo96PBYsgbS`j>BOwOk&W$?wWG^+MAqL+7I$0+m0GNZF0PYRV%-?1(rpQ%kMt;d_G zH7lq&G{=*ScfPMG&L#iN89O8Wi^YSJa8O=BGDcL4;q@}*G9`(%3u(ALpUX?IsgL`X z+rjwL?%}B`Q97@9&$M^Ye+@4u$>THWzb#8#cU)Zb-?jybwD8|mL44jq_-OyODA>E$ z*jQVpcUiP_R8(I_|NFX5SM2|A4U;L^f8Aa{z*zm)t0+->M)-f-_Cw=T|JN&;D}*1% ze|M0g{67-}{1Eeu>qAg>aj|qNcBFpNzde`gfMv(~f->{;{5u!AH-agr$N!V+@4ZXyzyJH3q6fZ~{6jIrmv5uE4TjeuqmZIy z0u%|!@iIV;_5LU_`vGLi(BBu9kXhkVzNAl|IGcv1Zof8T%Uq{%2D!DNe0uz&d6NMH zfI*smTn@Tz8@NBfUmUAtX}OGBntkWGyqo$abv_z+E*gZCD&ey#Wt1v{%{dfia#2FQ zoZxcXf3|mUz{jbs?%lxd{9Ph9KyufxWM6ZQSEf03$6#L|(04X!giygp!Ss%r@k-b+ zqjqmVx6&>hvS)y_n12N?Mn0lN=AKBs{>}^bVbgQSWRdt)#zu2)r{T8v=DO+DmGW)g zFRa0Hw$xodQq>!d530}jRq7gkkMtxj|KVysXinhE0R>}8Ap%mzRn*A&YV-nT(cj6O zu6|R7>3&yIdq22^?yuPo{n;9I);0dN*YF4k(GF>3$u=d&OUTp;$J=<}`G&ae&3>61 zTS%4I1VV*5q&eKi6pJdf!Oz&67`d21>{<3l#*SEroXQ1{NVsN?dSFoZiWZ5|6_INXC#}c_p22b%jUr`c?)+f~FTinW_9zHm`WsT0 zji31{@8VdH$1|B{RHG!f3P0r*|NbuqAi~zJFe`NhJ`ceDUEitvsAs4qb(w`m`a*hN zWBoO*eDE$eg0%bze~Jgi(MiR56|I+XaaoV8&hZIw#M9|)-ofSd<8wK^7C_t88hh2| znbly)`1wA-%_j2pybr)hy<3?g!dLd0HE+SdnuC|(rQupNj0gWdF!dJ})Mx0uJRa>UuZOF5>yI57Lwmdp@+=>;ih*N6Ba z#G9g=Kj2+jpSHo}H}*N2K2$rKna6Q7ku3^#QQvER55N}k0?c)*vgv7HqfAp-#Dk!t zYy%)2V(NM`?(jQ+LesU4P(izI!FLDeqj5_*?aja?zHsep#Izvd#jgB~hUz0fy2*Hi zP*!bQJ!jjJGfy3{fEO=tmP2L!!ghX)3#U1MV7$Lo9XT~_GX0lhX#dUJP(yz zOO;-{*Pw*{-P3!v6(3=as*5g9rPF_X@JG8vgBE}%9HX&7rBh97EB!3&1>=6JtT#zG z%eW*MdEhPiem5mh)`^OdvG3=qCuPC`S)pNZ*;KAQ%{cMY^>#bzXaA1Lqm%ZR%R$cr z(-ODnkqgV-DsKZ~nM-FAexs zzz~FWD}`KYx!RR3@hcxxxDRmG|SEN`?o+VZGqB{keKr`iM5!GxL@q zdBl*>n-|Km!1d$EIvfc8W{KF`QCeBR-$+H90wXBIsr$9Wz;V}3^ZuflbXoleRtX0# z>pKw!^$Pv>ZZ}5-9E8mtqicy5Rxb&u#U$Pq)$V`H`}r-A6vSeW0<93MA1w;h&_Q~t zGkF|8m7odFTiGN`#_Hsqvk)Hwl+8%O@mf1eGGupGOxAF2u;x_k3TJ@v?PU?S3+wJw zT-@SMNSgbfsK%LaeDyvdNO(~dK=9O67cp3bkNPNcc?mNtC`2*`xL&+i@s@f7q^zVr zuy3iq=|)g9{M&dW34MGX*JD1lei<@03^=HK@P%~GvMFu#eAM3gEn`a%L?~#z>NuT- z)t=Aig`)MTljFKI#H++`E*B=Fmq}dK+@Y10*fMBPqUK;|E@cYY8USOs9s7KUJ%U;T zmhx_ zp81~F$hnx+;yMXHOuXP7H&dn8Z*H)6q=pS2d45`3PxYnDO3RLFD9wlI-iwSX{1N7; zy1e5r4z#zH!UW=F4E(Sor0OCK^b8y@j@=LN+KdGy(T}3feQfj3Oe(7MQYaBP!280M zF2;>jLes?F(h$_j(|=#mhoI`&Vh!D%Ve_J{V7!Y1?UMTL?tlD@#<6 z)6j^02Ex61I{&Xt^BKM4TiYW6Q%sARhzerzM(nxPF%yH5xAkVAyE~`zgJIO zhs#I=mqKw6lE2v^7!wE-|NjKz+Bbz32jxP}XY+dOgZ~-|_+{^5Z6d=;K^$%6(NJ(@ zxt=(bwKdM-e|~OGmy?u~3{SC%rPLnl0|mB9Brq&bZyWSQWPnDN%g-j5oRWfyeSLkm z2>wNtu85IJ)%zsCfh)m1Cn@5mLRI3###fXN9uDtVSEzow|9csDM$5$CTjiKAt_O2g z|2|f2I|xUedd+BTgkfiAhl9T-c1nd?>=yWE_Q09%jcELU8I9%Lmxjd|ga3vX)U4p=%fWB>xUb3WHP1@mlj>Vzi_AV~ zP=i;wKjb6SaUh_tV<-Krr$NnP@|oN+`I#UUuWE$$ zI&}5#67eG4Dt}AoA;LIMYxp)TesO}KK`@jyU!eKjb_9vkT*3$=5aqK$)6iHzJ<#sB zjhANd zYl0V+;fm#-q0rDC4D+3Nqk;{MxE-`AmvWW+;}+;Og3Y;~`63GUgZdq4${)+n_I_&U zSh*QP4{l*K@?Ge}+&0d#Vce1n{Q8x2Pi0joG^wl@bkv4TldiIj-o%dIBxhz(=9$x< zxU*M<>Z5>iRwbVojqJix2o}Da;C{nT=uO})??s`-sF@vaimkbB zULZcSW)&P5>K5?H?bupI7@#X>4dv=%+pjcHVPgPSx&p}T(^874dON}`&L(4S*G4?; zwX)+nJU-#?Q%mBoJ2Tiv49=(uE58pxv20(!PV4j>DxLJ^c3PQ|U%K9cxXUJoI%!6H z<{g~T7ID?$7n!I^NO7wbn-_YnDu=k=wy!&s?wQc)cd^1t(-=b#db2oloI1bSMG-*2 z3+H18Mn1Bet)#yh`>cFPsgYtvq+2nU#IkdKM`De-jC4$ex-}-I>FF@6u>gJ`L<39< zAT((%OjC+|!9|)N+X@+niNNnD;U|{RvuwjF;U5}_m)g2Uc({=6GaoUgs>1N*b~$W< zgj~(S!YGGp2j_?YnxTPqb?&l(zJO+ZZn@D|YY((dlh&Y`^dvi#QioLtzRMF8%h7>O zSlajv;(~$tDibLyMFp6&v_=BhG9~t@g2?ml8`8~JUL3=!)YAozX%AVuHVOKd*sgbM z>{uNm+va5x#F4EJ3@Uj;`^$7k!y18No6>_OdYHMxW33FdGD8A7zg*206?XP^GZg8x zN9RLRPX)qkbs8exY^Yz>4@LylJoa=yfkrG*<@mxNoU5PQkBL=LCGkhD5e{RWxv(xm zbX6flqTA7z3Fd~qh|~fcEBGsMGA9%0F_Gza#f#U_S?Tohd8@HtD*DJ#*t7_4lb&Ndl20?+HH!ythDvRUz5+ z=8#fVyVPA`Kk;g?MQeaHhb?m?G_w|V`IB$I6j3(+2l#hFt&mX`VhbuOzadX_Z;m~g z+nUTF*RyISZEcRJTj-@U>cr)nPDNNXGlhL!(%UnU$>e|}jQ9$q;l#co@;Tp+sW5HR zqyXCt*QtSNi=Ei!OBBUbvjbG;%(ng$ZJm6oLt!D(PD#<(QZ|b2wC=pm;~GvFz#h_G zYD++z{J!7im^!S@BtNI?cKuem!{O9|aA}c>mF)Hz`}_);`G6`$f7Pb~Wo;jOR=3X2 zA;DO-D#anw?`1N@dbO^-Qk#&xvJj(b%2;2&n1idkeeQE}><`l^OBq2>e(bS5@^1l2 zUWvBFT#~K{i=Qzz_!hkN8!XQ!TLziUvtCmy@-(GR^K8c}C|(Ho;WM&>wNJyKxZ52f zBv52C+%#v6?f1{ zf!(JdeOshF+vK?~rWFwB9QnX2%YyoJ}vKdY?QmzwdBSCrKj zM0dk5hk(HMc5<;}SEt9Po(s;2gslv&a$C<-y!DWX>C=J|XgKU<6qA=n0_ft-f+7d} zDJ_Mg=^7Gc>-bG$qSoKSoCS<3y(p~8YOwBqv@m|-m3>0udtQLaJI%XMM{XONPETUz z>d*QP_A6Ny>YFqRg|U(WruvntMsr>Tg@fU_+1H4`+{u~O63W_Z@!y*F(6 zFk!O+R$TvS75~Pq`gRABk8(xAHS+5A3H&Xuht87gDSj7vI2_D&WAaedPH6}MgK#N_FMw3-DQuxhDTp&By4<$Nc?5INM98Fpa?qp^75X>Ry&fOi zz1LMAXzp%-ZRr-6S6&eT$@ziyba@%2*;~`qa$_&8{ne_yQ^LS@)#8JI$VJudBgkHU zi5ww#BN45GsZ7Uvb@dTqh0fLP{ud&uY7q-P($r-xEkHfEd}MNI3a9dY zkDia6PC|TYN@x(@X1nu~)N}OmNBCEKWctx_2}9{(p1=#FEsyoJP`fx>i`U=&oG9ix zdopCv6?@rqmZS3_BlrTHf@$Fr8JXD+AxqeHtCsUoO*&j36(@gF-zet}Un%jqRUJL) za3%ZX5xHvN>rF6XoR1wm8n64Q5{m%XO{qjikIV)yLtV$_TXcD}d3ZZ6)LC>=z0bhFL6i(n)sx&u5C9 zzNWM0`kSAx{x1u7x=Z@^ZnYctyxTUb(a7<)y>(+3~9JDqqHjt*j6+T znx3clo^t%>4fBtrxv$rB6wME40+@X-7R(>%p%v-+3JK)Ie64vNm}i^I_yT&!SVT39 z9IyPg=THS;i|T^Ld|2osKrimD6!;E3{6btrGK$(`5`ZpNfD2OO%etJ)J=yk4UT@c* zqsx>kNX}uK%^XL-)4qrT$P;&$t2Dv+KmFj%>FXIuG~i{kT9((igl zbOEiX5ZsHzk=JCuuNWKQ+%~)(3}Byv?Rlb_ez{I{d`bL~{f8EoqA;<+14N9+N z*R|lKIhKGHkC5lGgAOYagF*%2KJ}u)#I;`WQf$C(dhD$v($|W0=BxNN*f)LKTbRxd z;Xq3Z4q-o6Q&xVoshY`}l(EK+Oan(0Sr$?+x!dxG?oS_47gyCuHU#O2;195eLe+o` zBM(MOG>ca}+BD-kGLmL$&x7wo1KzdkI3BDH_`ewJeo~MdiDO(X(pJk>ZoQ+{aRcS* ziEDEC&Okyup)Jv3q3{#Y`duL$$pX+C%$-s$j65arj3Z}mk-g3Kz)KY(IFMUn+#Izt zuYg0lK&d+s-A7kO?qbT4_9~LUlpOx7GcZ1(+H@1)HS4~!D62t9u__)G@Iyg8C@l6f zUyFhYxtM?@ZboN-edLCY+k5yHOX$Fj>#|Q;$n)x?EZbU71{b=CJOl2_yI#Xymp1XY z&YKn%8OE|Bp4&Bb{@a)}mL{(JF9+YYTO@%+Eu3Drn>OHN&Z_dsvH%7=wF7DngQcnj zl5)f43glpe@(Zyo4 zx1C1rboz-fthSywF~-IsB;=Zo_SYm3D-;?i6{_ObGRqe_l+IGeHj?bFl<@xPV3x^0H=GmkqrgBsSB=&}W zR3-fUY9n4o#&@wf*8n`6eT=;95*d|G%LOz*$)jwW)5}n-0~R!`KpJPgu1EDm^b|+z z&Tt(DPuNe|9@JPI)?Z3TAo6nhm0L3kpHBK%0dREztPuqLz4r5L^iSu4B&|gpr)nh5 zCWGE)e=dybBmGzd)qu77n_d_^h23TuYwjn)fTlsrDf)OkMvMeEmf0z*zGk&~;#d}B zf_sP^qrnWC&qR!Zv_&!Il3$ekpP#A4gi0+Dmag^qI2MHHHaX`WR*06v%MMLBOoz@^ zo@_8kk7+#?0?EFw6#8XRS0vgUw%8z{cv?61ZZe3h6*o52)eN5QQAffw)y#WgJ&1L$ zwNh&LorK7LX3!46jnGcWG7)BTn?)cUnM)_j%6>#6-likJ5PMaCA56!NssITA!n`Vi zoG(&ZpR;4-GA=AWuNJ>o%K!4Riyzz9aW?`7iblx-`#&Xaz>wVcVsKpl50&8#`I zyE&^?223_}OWHZVw5?li!`BPO!s|`!Zw^d@z0)%H=B0oSk!jwz=8B6ynaL*YmT0a{ z*Qw@cL@G>Y=ZD_4oQ-EPEYEzZ*chH)m~r#;BUBkLNUobCLcth1t3aZhk)L6pW0Qu? zD^a+0>^`?JrMh1jQq|K3^nvVGb&h>|b}|#sK!PNNEx5SUD7ts$IMM)m==%?_68~qx3)2u3YG(kFXDTrv8n7ET#l^ z$jKDgYDy@F#S!oKzT%5GtTo;}G}fl`3(g0oigBI9LSu0O2|gIggDgz*OZ~RjP)74s z0-h#scOK6#a!c;kW(=3+v!NQy97x1vQ|miB^85d;t;}1wN{oh<_Izk`CecpEn-1_L0P)M6j}vDxJP1)qwDHq(HIKj0R>?_2$`z+rYyndU6W_NtR+B zw@u^J(|~QmVY9_!LRRVQm_bxQtIa%uFn~%F>1141gM-Ht&1Bn>o;)zqE5vJAOQnT+ zEbj%bw(Ivht9B?8#TIB>wq%cE6JfN&wfk_z*yr8020>{N%C-CIlDP(1qz7BHdnuxB zsdTO0F~+xqkCrpI(A69SH_&*enysTsY;~~Vmr<)+?>HcYx8*-qXTiJZ@UGU5v6z)+ z<%-CDx*;Bi+16X8-yr1yB{V@N>oTfU(#G6K_*9SO3wI+ySy@@r?8t5WN@a}4r``0S zY6X&1vlrT{R>e^p^?;gQG-M|+VuKlRt69!c!K+M!Ctg?$8he376A)c-Au6{8;g!&~ zlka)aV#(>qBGCNy*RPA?el?QSs`3svhZWL^_=}aNZ>O6_&ym~h&`u6uKNBYIVco1s z1@kKIfi?T7Yu~g0vwt-@`w2H}Rg|lq3|64m+DSKjVL1I+aEm5#J!-uYMQGwQ3CCKW zx00R=Nt1pVjX}JFe${(9LI9EB;+O|#jE`3+sVOMTgFl7huTGSRzf%Bigdc@7C($z5}Ixu z&+SH{*{cMQ9-P22xXTqCd6g8Ydk_CeVI6K#ob_laQtOtQ^T_e(mgeSg`jY6-y~=LK zkT12CaOdN*c3DSrU|O{2WzyNWqI0&|!@b5M=i(K!eYd-MbYytL#QSr!niaZyLN81k z4@iI{ZNTYxA3>yL(Ne`PfWnGglgN-WWBU|9`6PGs*=3GtP5i8XwIIDE<({?TCd041 z#1MO>+PzH+%{Jy{^n`(LOCMcU=jwH&Yj8Ic$7a}VV%;R~NEc?O#o+!A)Zl6GvV=u? z%SQ7JPiIqO@>g`Qek&+;gUeAvPqqaO7u%EAdFJXFN=aVDj%`+J`%;{05!jI?u?`&l z9mun&mRAt|vrfr7>p?`c(1qDU=N069p}i>pfdE_Fy{$G@Y;*uCMpt$$^$n4xig>VR9JTeN<{to=L>PvfKv+&FWkw#?Pgj9S#c0&Lx8=eh z%Xs*;IRR+(3q(N1QA=?Yvfb!HHhZx)QCIo(!S>`w(N+@anCUI#=(;qk5eY<0e5;BM5)HMmI~xX@ z5;bgyZNv^u_9KdCOSBuwH6Wg&V5ComP{v$%9SMJ3yx)^S|2VIS4wJmKg{XHBnYbYJ<`$(wh2%aEsXaAD z5$#pb{?|Akjsi9D`V^+aZ!S^{$cF@nHi#<%JHfR3WmF*J1LPp~(+qL0p7VD$H}z3^ zaYLoi=R0uFM1qWRUFf-;TM=5p;{=s;We|HA7@6ufV>W=J-y%AuAX38pbr1d1X_S4q zr!bl&5^*V1jp8j};5IkU%W9(qUQB6{;Mx<&KdE557McI!RR3nqcF28ek(wY==mFPb z!r?offF~y=N;nZj4Big>f@zY1!K=R*u}pyJ7t{3}_tixAh4Ha)&dcM=#O*Xk{x(93 z1o}SUsii~`H3CXbYpC4Rb^8(;04XUsU+6y`mdQe$c=&}N@isungmJB7Wp*ns zs}iQ7sx4OPOI>@s3+;TO66DZLde=OJ;N9I_Ms6;QkjWtPx(W!G{&52Hd$iAfg@aEl z9bHHh7LZ`aVBJdcYh;R_+;%(G8%PiZv4AN9uDEDn!6CH=h2|xdB|ex|0vls6gi?Qh z7yXAJVRbpYWW|n2LvYHT(Gduu;-Uf(=2owh|n$+1O6#G zp+(Vx%Z#qLEmk~{N)Uj$-)6P?r)9TV(gvhMR) zY!a$dpU+|W&{s!UWbjt-1fS0QmI@92w?Ov1ro7rO=n?5QPokm;lE~E*+4@%#2j)@D z1IWqoC5u_*x#30+2l}+tW>ezUGZm5lJ?iH@m>yGqEyHvCdQ+g&DwY#U8+okpxITP; zp?*kwG_RT#wfBIIf$@2l@3h9MPhqKe^5W9?!puhy>ELr6)Gp)9+9~DMSazjHW-$~i zVCMTG75yUMg9-Fgb-7HE?`W(+XUUD;fAuch2CWH-))d;+m2HFLZ4JN14HW2r_1%)^ z>200&&b^*>H$^pqXj()YCel|E6yR0Mt`xSe_zw8clg)A;L_Dlsy!damt)KnmcET8L zrn}Bop(58yCSfRbq1F#Dq++^K-0&2C;+Mhk5`P@OSyt{#j`mesl_tS5u2f3AI~uCN z@z=4A<8>OaIr{E?^1*aUoY?8=GFQUF{8zz^pSi@Mh~;0t5qQ-=^~BZGItw$y()ZRY znNIk87l$PEn>*SEm8f&M^xBI_;nC@%=CoT0E<-;(U7Hd|~I70?yfD~ZI8US?L7~yZY1A!jT<=Z-N%pb@Rj$4k|w zNSW}Bw)&3Nmz3^?CPu+O3QR5hq9c1B;HHKeOj>Y~R%&nU%q9@c^9DGG9=hBHm*+H~YM?xfU0bgcgO&JfkZvbAhjvp+ zo1rG?oLS11(kN}-2>>hAPrm-^J;448TqP?!ph@BTiDh#-@8hI%s+v$_QF#8^`UC|S zTMP@0OPDs|w?w~uup_lEihtx31^pJXXMnI%+>8}u*AwX-;x>}1LtXnl|6SRb&2-iw z2yt>}#vtsGoT2M##a@8w13G=CHsneY%CN`mgU8;p#&EasR-uq4POcoXqH5@2NZ4$d z!nYJtSJ@)~Y{6hu+f2FyLDRI`@qZ#Z9^1ENl@#I;s^4c;79v=w-(^`W-t0}@nCu-e z5-t9SU#zkGRXF&qCR%2kxG1hKK)D)HBGmcQA7EHhw`r;yy0n3^+UdR;aSLwtakAa) zB>6k%s6=Fod`kcJKY>R7)VQK%zs=_29`4=qR>zHAG5vt%eRGCy?E=pl)(R67vmR0a z?vNntY?PD76XQ{<(NPj{#@u|`^<3@8kAjh=Ls1Hq+{ivS1!M~0+B#t*8E&hhPN-fw zc~Fs$1~jaEIsCQ!yDAxgbq*6Tp8szK^?r^<(=1DbLcZPN#tq(IS~XhxQKZ}w|Bd?Z z!hAzZQ&!n%Bkzmd&!6hsIrEWoVrNj+7EZfw+q7vOlz;v|j9FLWy2t-b&d6H$pC7<%hW~d|+J7_$ ztULcFzV6#Jeka=v-b46H=mblHtPm1rM%`ZA6Lk7n75)(`V->i3zQ5t}u3wpIp#AE; zouFd0oG@wXj3Y~L<&TwOf{l6@uIEL?S*;P1Re4&I64+}|t6`{WT4=mjct-JCmf5G& z9wn~3WopVD>G3^@v2<>$Sh*t&qu`E`l{!fw-SAm2OBvL+8r+nDZd!vZG^_`|mujpa zH$9SRgQzYIyBvZXOi0ulYIPs2HUwrHt=(&HOIvq2D_0DxLb;qtC#!es8n8!ovcc6- z^OL29L{^gs%}GOJ4T$#4UH)srO3QKL25{Q5E#~v z5P?qyOpS8xDNA*bO-$n~Z8dZlw;z}XHZgWe?#>>q7kHR;_98PYJkh8)HRc5Z<8Xn3 zbpATAb}e?R3ya~Pz$y0%0Ti51=~Io!gWQ$!L~g_Z8Vq$ehkRbydQIy!({3d-+Q4hg zTpNp3>`hNHQWhSE9VF+IC7+d+#|#TlseOslbGwhP4x0k7dDW!92JS~#?{o)_PFYbWqhkYd3L9ty~+S?N3 zg?Yl#3Y}G=t?93B%SZQEQZfA4_V-X_&trAoe8pNU>Av)(~WaS3+EOf`~giyyPQUu#7mI*Bj`Ot|=$@gKBK+rKa2WUgMKNr3)43lCQn4bBofCv>G-LJTquHg?n z9GpBQS;bg}kl$7`CyU;lm6h#h8=I2b2jL{G2j^TQ?1kE&@*O+<+$m0|D>K>v7!$yS z=vQOn+2C@yQ4Udg!6o-oPmUOEWD|hSx1rGiZqlp;(L@f%J*K18HewxsXFIJhhtFSv zepH=2?d*=ebuK$rKfs28$v%j@9DxHl;C{r2321o5Vd-0IIWK{@NzuCVZA1kkAdDdF zN^%yVY;qXMs1;{NQzS=YfMaV9(@H$6Q>vsKeb)yMs{vCx7zB*>|Mj?4352qagu(lc zY}{}{ktN5XvciXru2?&Si7>HL?W3n_X!!Z&WI2>fBBGxiY!v(592Jpvsj4iqR27?Nn#jsS^j?M3x*wm|6FR>+tWEOs!bo(O7%%rdW=DQ__sJQzfcH1}^GLYWONu_?Ejp>wU_%3Y6D7Cfn|RUpz?ukG-iFdKO_hfwuCnRI4=RKu6)V|%T1oJ9M& zF2@+B^s~Myrbm2(m_akyu6*zMo;$W4I-t@`Prl5Ta&4m=oz^1$J_e4=g((e(I_U%F`hdWQ15xzvhjM{gB06Ca2R;ru zYCyS#D<5M72~N`yTEh3=Geu4myLemfw^fbQ$y1))cAuLYD9h!FM_hlBU@RlqXy~TP zv-3@951~1>mXx;o%ivgFF2tGnA)R-7qG5V-+j|m?X9pIIXaw)MQFPYK%{4WX8lrRI zKusvOcc8vOUPqMr^*B%35Tsrk3JZg=?ztLc9{;hi)w zLZ&wDwaB7J6-5y92A~M2g%(T^C0KyDL5t;C;X(aP>^T|Xek7=_kO~96zr*wOy2m~g z3H^;}`q9A~=(iyhz1v$_+q=LKd*r|SuENyz<|f(hTMukCtLN67gv)o^h+K~Lyw;|( zAMIW*dF<`&x3ECVE}P*v9F~ciq>V2wjr)5#I&P2vkDVV4qM|1oW2k6RKbsu)KhiL0 zf003UA0Z*VpddB8w3{h+871Y$I>gr3a7Hjub zTADQNb@m$#!x)l-nhW$eE>*vGM8iqX8 z!SOzyWZ?;wZV33nAY}%_mm{mUK3QmyvyWlzxcK9fW9v7qlP3oqKAv2}gg*;(Rqov+s{isOMiXp zJKjGmYl}B2>UtR~=dpX2i-H?Dvxu9iRdorztgwo;!M-GJy0l9gv~ zG~DMh+Bl70P;}9cp}E-{i#LqXyAHOpp3fh<4sD&SL=zO$Rp4K^Zp0l=)@VTxoIlNe z{YjK{F<549$o*ix#s-OUptu0pkXgVT40ttyGPdTSPQbhYy(G{PD07-VGQ51(I^#QU z1`M?G-hf234@>G+I+IvUz^Iri{_l9eL{#VTo6UJ*+mk*70>N{_(Nx~R)3(=@Rsj=<&4QR+0FM zj)?^g`J4@R)$0b%%2ddd(JEyi;|s=O0$g7P5Wj5v_!EJogdJ&}9143} z`ds23a;|64#cn5e0FNJeGV&fqe4`HFg{3tqXsn!)FeOrRbG!&XBZ4l+=W}=G;zan@ z2wVlh`su?-Nz%y%U!gaashB5Q4?b|SoCbqJL^rn69V}feO&p2V(j)wD+;<)5P}@jq zxb^{K9&Ec}9d){MlGUqgMet9U=~T-f#lxCB4zJpB>!q z!!A)<)z70lcMCxbb+sjU)9Oow5}zM%8%>TlS;X(z4nOEtqRXLJ$P?F3o zNpGN*;vKDAaUp8@R>e3~ylaPNo7&wbI4Ioa)l%J~_(Lt4$k)uw!M3i#Vn8E?=~(4l zbKvgmw>>?hMp?(X6MHwLM?T+ei}@M|(J!m=jHGCxIi9GJ|8C7M{_p89Wf9K5*3~Fb z|6J1K31q;*aT9cN#Qg+v(cUi|nbXTBK$J>^$Dtk4{0QdC40%(lUk;1)daX=SY5*O? zrF+dWI*!WqW&J%WBe~FC2$O?X3)j;X{$ul1SE&oM@yPr@CSakJn6?8euw-Ou$#fxy zgyundiGdB0XmSh!!^G3Y`!%y4^f%u=I|~%tnmI%8o)s5=*6?)q$5M4ModA$nXORp!7S9-O)t4V zm*|V&dCCF1sbyJ_PwP@Rf57euh!I92lEw5=9O<7-z}L6%L;Hrj7VwDID$t;^G0TOkiKZWsgB?+41X>=7Itf3tgRh0R>u8nJ5kf|9-N}%jluALbFxo9ZX;R@fSDh1>y(>#RdThK9G zm1xW@hjcQ#i)O$d>GonH@2II!oFl;$Hvbb;s*e8s=bUB&q13OH7&ES9veQ78`I}1$ zn!^y=Q`6@fS{~T!!#bJj2Kv9+kH(%1W)-*Ey#DeG6zG_Rw#m9PWuBaxT22#qJYsd_ zfW2w+QyQ+mvdEP?G(k4M%YX~WO@@RHfWA!s$v^k~G3XKL6a%sgmMdf)3Kh3Ra}i?` z0xoH=Sq)dqgq3DHY76LH85IU7f(AJhdMFC#MU{a9RA9z7xM>lC_rHajyZ56B z${V|_nR}BBh}Lb-&UJY@FBb_HmNmgIqcGh01n7|SpXy-5P|5rUL+XPj<_KDdro^ho zGPvl}@O-DaJb^5@63``L76OeA1Kxs*I#=~pIu`m zEhrAQz-Eq)R{4B?O!~C_lf-;`!B?U&yRHCP{QA%vAp1&A>RuD$-dL&=Z3>ed%I|h5 zBeG_QlqTBGak-~9)Hp4=7{cKm{-H;7CNTxG@g`gpl(MYqfeK}X>c4_)0{+(ZpG^j)n7^?EXXdH4EmiN5>yU& zT5t*Mo|yySl3}*aD5A3rC3|0lmqGq_-e7*-RMl#;%*1uRyvj2h*xh1K zroLK;C~xoD3Kes?&x%Qk;j0_pAQzmkPk!yAm}-EHwlvD3Xnk&=6)rCB0ncAgbm0Zg z-}s&)d)Y?>C9_D7X!tF=VG9dP0t0BKVj6JnLIk2s7^U6G;rqJ#Qy-k?i>q}etM;PP z=s;~gSvu3;#0WD?LGLBin9ry^u*mWua4IM_tsq#8BRff;KCjL405_=VG`IrSY1(MR zjsAHIcMjP%W3h^|Na(p|qDIW$>fsaIh62j!-*ig<<69Pcnw!svz%% z$={&`WjzcQ&I{$F_7xsCVt0a*dyWQ-%G3(tR9 zm#m^l@Nt=cx(WKf9FYbWN5D5l&z5S@g0UsIE%p6>d+zz4F~22iB4Mqzu`Q2BP%P#&IX^}J@ z!xXr6$+&Q;OYA8~3Ch=sY+Z5rhxZQ77j2E;VOC?N7I%YIRr6!=_1)d2l9r&Hw2PUbFaCOp zDhA`l*9)#JCQz3W_?;YL8!S$X4?q08ui~6L)F3vnLM+rGlc3|o8f;dknXIZhcktqN z-MwBu9D;MrUo?L&Mg1K(_@z1d?Ld*A1OuwF1z?CTTcu)VJGUMGOi9!IU9ANJXjYGEeYWqh3uZK6?M2*#{isgn+dq z)ZhOdSTk2PCUd0n>s=t(*$Jw_@eB}L-D|HiqOCTa5H4+aNM^Tzsb}FP^{qi11g;7?j^EtqITV-h9s!!u%HzNcd#@U_JQk1pO>-a`S?N zV8?Wm4%Rpt)k!$~;Rte9i?z}UwA z9Xw1(1FZZZbH!<%(fvIlhej_78`WAH}5io+L z)825--+o&4en9FRmd3TDCoC)00*5l8C3-kfa7T&hg~hm$XqD6^bErn?sRb?)%My0N zhnq6TZ8D|b!5rr-x2H=Y{N^u*yb*hYG|MdrZ>9bA#fPj_D-pZZ7{u~(AT9CF)P**f zqLt-v{RZiOQnHTxXJ5xvyeeSaKWHiKQX<`|QVJELFXEL!oDPG4{)5WqmkPSq912qu zBJ4tJ^fNoLp1DOnDLJktnlwxn{8(WH%kJuP(?;qJ)7UATVD6dyNst&7s%Le<<$^q45tnWkuhh}{lbSkeX0@G|A5jSXFo;ED@Y#V+faW+zv(f~`>(hvKBf-2KVB#4VP8 zoa@AOhJqi-UM&GvWMmsvAMwc@t}v91JSbQ}{PkrZvff5l1(<5;`Y=4)fT+FA>ym+mGSGZ6bXNC?zX&z8^#jT^ zoru?iG+&J+?>Dj4K*@qcRx=2wWa#^{>z-~K3SIHMWtZpd2$!Af6}59U7%#Gj!<^K? zrxoaWMt;1a*J~yQ2DHbqj=a##nS+Uqa7O)E9nh!OFu~3~ip{aezAi^$f!n5yhPc!Z z3=&JwWd_}oEr}C4KUV4>pedEtY+M1tf41L)F^x6>l21SHvy!t4_}@@Oahe~l%8qJz z5*3(E!HSKGa0r2ODpu+b{p_NS^8|AdHQUg?xn@x-;Ya-JK=qG4zQO6SSu?YL^2tk_bhr$@>NFkzY*;b|wISR>OY^>sc25627(CoII}-njj9+i?GSl;lXtN ziDj0-z&IQHW0N!CoJxu5cUOF1va*=I470NhmFS%fOqaihVHp$IMaMwU(E;MB>_iYD z{MPP{2JriBBk}q3b%%^FS{zQuM#?klSQuGT`T7^G4YFhW(0J0H&oH`2hM%u4{ugV1 z85Y(1#*d;P2q+!WA)p}LUD8ql(jnd5-Hnupgfv5Ur<8Pu#J~(8-5{LVJY=d-#I$)u)UFzwO!5E8p*PI95R$5|i zj}s*o^-cClcQJr?Tn_bj0rr|)U~^^z;j}JWUpwtUlGD{f+e!DKmNBgnxd@j8hcCzaLy#&3|qYvaVJsQS|p6%koD;u$6N%?}3 z_5FzQ^YcA!b_&_d$4Fbxe#-5(qRdPDqPaLGH?OkpM!s_B)=U3t?PB*-YO@?;+)*n7 zfHP@>9ERI2SC%MgLNF%DBO|tli~(%~x|lchl0Css@SXx+euqdTABS;at=SFD^$i&>9_x{p@DyNwC9ac9mp_^!!qd`XmZ}>=;NGF>iXkQFUH#yIksSa$LhAAV3xoIc9Mq zW@DLE$l!m$pkDUbx=oU#u8VTN1;4cF?k?k@EheHUa<17Kc`V)Wz`blvao@lEcmQ}X z*2#fwDjO>|b}6}rB&P$0OCG!bTz{i-fak>9_yW=!0ZvOK*9wm8xF$pymhMMx zSltkie4-I}2R{7K!vtgVzE_oSKkuCfq2Y061qgK4S;4LSLTXvPOu%ZyKw&}Yf${lw zXB^a@_rY>>!9^XJz2g3Iy&)5BMZC3S&~}o5tDIGNvoeKNWFnMMx}7W!zdVtX2lBw3 zqubS0`y>N%gc5iF_rwH&Y>DJazAhhStka9CT8|=c7Ijo^2s416jVls%_V z>uHyHmuy|Wr4(TulL$7Q?}$C;w(7WtfS;SlNBs~yka)hK%McKmWX-7?m#{T`sLW~R z&!NE=*C4D}hC4Ga_93-z&s=#wZa5>xC`i zP-iKs*5$+1(sYwrdsEnqQO0`KdY3==eHY^-c#&vBr8E`kDrRDmck>3|&!}F$>@@qR zvJNpo0lqmc7WSu;bg?VRUZc0jwoyeE(9l4_Md^Fftuwu{alQ~#2#)r7gmPmftbv@L z7W@RhaWQ-a+w6ZFzJ|{9?9O{<+PY+u}!EePluWT_uS9HqxOKwVog3iEIy9@H(O+% zyc24VRcK+J3fp8aqJxq7LHc#*|h&AqN{ zYu}O|Mly@E)t=+BQsER<%aZ=4dxxB}@YVE$bk$4U5Y&HTkNTJKI=bHM0%10!q!2de z?abE}@)Je+y6rbzl%VgLb^V4ye!a`A-OMtx8RHA#23Fl$Qf1WJ7|VkZHEr~*L6+u% zciIWT8|+LvXnL4UKYuB-_qfrey5eD%_JH@iwGm!_o>NpPoI11<&edB4F?}vqm{xvh zxf0}+omjiYXO-h#8e&X=%;q;^*?>M=6@*6Dpct*Dti@=0 z_H`I0RDqIVtJd<$<@;PxxT410GvyP_`br|{2jZmzzXQ1$xoYlU{JH(*1&S3J|88Wy z)mHE7>)Z~?>O$AgUo#VC>GsMWaE?f>X zOE;?hW0sB_lh#&x%wNJJA+Av+V1DiFB^{i&6h_#!fY6xonDu=|^?L&hiFl>Dz?a-i-*Mbra5EOuLu6mR|D3KwDg- zP1?XJIwrE8fFr(}25yE*MY7V4C`;r5tl=9!~(H$|=$XQG{KCz3pO`zB`pT{!q?$-0K>^i%B>ZejZE;s~t!oQHvq%|k2CQ5myy3?%0MR4yyET3fcgJE1p zngX5dC#EgNK@YRsgz3zXzG6b&#l6M(6cGW^Ti)`8N^T2t_ohBSU++3=Z;XxiHFa?Q z8scT#zfafQXHLZD=%skn3K>c18ug6JZ^b0mL&zKc$6Sw*{Kw)>a`ih(62_8A9gZ$$ zXs{-dhVj*W5B_1z*}Hkbx|l~%&Q+<>49|5lV#JY-`(zOv%!CZl8VMK8|#B*e5 zD`xc|tpBD~Zh7qMiWu}_)~b%*@`XYDe5FWmt%xVpt6I!Gi8)$x60tLM+O(YA1ii&S zg!G)t*NAjnL&!uj8UqLF>C)6*g={>V ze+55I{p$!h9kcQvNFyBX6wOO*+g+kqi{x9J1Tg!c_KI5Sx114z?sV%S7l!#TQaQ=A zcrH$~CLzc~Tw3Wu^DKn;BK;E*H+7qh3GUCxo44pe+X9t=hS}TR3TIPhuaJbW65{8~ zC$dGI22lrT^7M&rh*9q(&Fg;NN~;WRe&d-{V=2K^5FVdDd-zK{S8`45qp9S6>VYtb z1luZUTL@J`dQ`?xLF{9Y{h8>|u)r5qY_7Ez=;qSjSwd%@cTRab7R9PyV?XnnQ&&}8 ze?gh{H{foY7!RvalVqWDVtq3Giz$ay5hOX4PR=gwM{C*?8nrh47f|5!$(4-R$dbW< zIbdRA9J%kC%loPAYNn_=Tu5g&pI5^oWs7tCt*qu}n#-67T0%ZZA-bSAiwB91dc(C; zfdjoiVlWi0yu$hg?5C)0EM4&1dX^To-TLTmY3U4PQn?cxWuj0;P#N4Lb1PT?FYkAk)&>TO0OXNRGX z74FK9-_GDk{tx3E>|2K&k1ElGPvV`d5n>bcH_U|=#PI4(QRa#ufL{?SglG*LKz=n5 zri|bxNh5e8py#T}3yK-&Z zz*PQEZvZOR;%^@aSWO?{FOarGz{S~=;v{v{=3`vg zHSy(Lw%$s_(=n7J*psGRpSVG#0RTuT;c{IKih1WQq*0dv$bWRueMf#&hD)dB;b3#U zRwxF=03k$b|CW5na0*Z(AN3XF{sjntPra}|x(ooX;G&?QcofPl6%@l_&8L(>rJYj> z(wF=50QtOawGFP!N~fj*6>R?x0J_^12lARE1~#EJFSP3{D8ahE04BV}teUI9&>!ls z`gHb^qSDILnd3ef=i}C#^uO@M_)A9y3jrOynBrkY$|7;pjd!M@ydQ)cPR@S}EZti` zTZl05^?L}y$DuX^arfnExf%9cW($jYTB0s6KzIH3KL^xi6&AOPtGJps(+@=}-z<=< z`82;-9;yV>Uu8GfD5ZqhaO-`51XLQ8<4o|)0couEH1QXD$T zx1w;>6U_Xs1pEZot;C~e?#~4%n*lBCWV+Diep^7Jh)}p|^9Jwl<U}8 z-214D;n5f@ZZ1qf0J#27&kkSzp(c$bQluHwp*G z>F4A^MSvJAllt4o1CL$7FrfC8Fqs{yzaj74&ZW{Vg>7fD%8%=W9q%y2dx}+v!Q*Su zFMVO!lRTYRcg=?c$?iA4yRN-x_~|-0ThdJQZKAPAL4L!l@RsB3zu!s~jC3)%DLYVb zK+Dc09e0S@9nnKJ*D8mo5AxgrqHM}MhDl>b9ko;Nx&JcGVjTMqXr;K)Z=|6(IrH25 zE1E2&n@N&7V8uRmEty90?pkTF`$!?9pycMzL4 zFYS$<4pEJsmhdM@YzFKvmY1Yf{&rc0As!gbeUy&(jbc@PIrUVr17xD27%EFrTCgnk zeRln-`}7~k-Chl14!0!Jwnkb9rpoi=3+;TF?YY6c`>86aeCWB{l511F$9LC%pDYkf zZ}}(ghuP7p?VMPTwfIi2LYe@#LUj+kjJ?s9SOKgGk2dB z50nOlsKDzS02P(C!+qg!8pvn$B9&Jf=jRN1Fq@7@@*M32E9k>WN^%WZz|j)P|BhCn@ksup#G25*Id+X2Ot~hRg`TeDOWAB6Yt_dWO<<&dCN+_L<0h=Kv+jTL3D14bKpr=zwal z=={RzGsrHDOg+BT`mNj`g{rDr0{=QbI&1DR0seiMjkA_53_`1 zQ)~BX*Fz`(xiCp1=FYs-;wC#F+Gw`P<7SxYW|;I*EhR6Vk>H>k<&OwTXY_5J#~n{j z3iaV4bpC0ghW+h}sr&o+qcp#}>TcFZ>+NYWn&vVt)Bhp_8375VUN$(UoUP7WM=qs6 zBvp=iwexbzy1e6fi;1;WL%_4HwCnggo`K#zrwL&$huL@yhVIMMI3pF}nivJn znO_WpF_SWqr;};}e&e331;UE5pAOD7BR0#-82zWvR0ygW#|oKB6}0}bpn}n&B=N~9 zyi`~n+uKnkR+A=mQU`GdqvP*an=fNElO$Dssx$epp2xnonEDB$cmTAXbG2O|p4DC| z3Z@^VPwPk`Rc(b^p6~FG+^PW>2fDLCrU|b)n(oU+eh@c>LMb)j9$uW}1^6^oxHU*! zE7`gz43)x6tYWDr@h`hL(Cs5DD?8^&Joy6uuf1zD9rx;Tt8irvVehJaC|a{UKaHZG z-%V;_oOnV6s5xB?4j}dK-o5+$*MoQXhi%p!%U0lZuO{|<&EL z5~MvS1gI9V|0-Ok2?6P4MbI!A5U8!({g-_P^%?xn!6xzl_u%dS%CZxSp+%=^}mh4;mVfcQ}t}!+2U#{rmliz*GyLV{bngW&M2}FF#Uc%&xQuwzUlkK z4OC~5Ky|;g^S9g%W@-{gx0@~uAV$0aXMeQTOgcX}&<4LO z%5c?Me*dR#ami-|cB>OTg#&k=;GhP5L^z(O)4vGF>ige|Ao$HfT1crV{AY<#tdNIm z+85RG_r73bSED?2`u5+KEh@HBqOcvWXv@2(r}-d0Nj^J`y-hxirlqe|JUoQt>g`f# z#+p_3V+D7H`?iDi0?D(W1xfk<&@{xm-xTkc0j&p> z{q$@{M*8;~V%14?t&hR7lLTo#c)5{Q)KONzH?OX!fwYv_yAS@~b(}WVkZIY**H7PQ z;sCxpTkSf1J5_`h6O+SniJAp`wnzOysevG~XNDu{pBwggkau%3TBwNETBZG#S1lz< z?!B-w)sw%t{SGpKT18XfApJ>}dn}LbCh`^g%*9WD!dm_thcf5u`Kob@y!NMpv<-Aq zHRQ#FZ4#(^67P73hU?b8TK-6Za~1mEA2H^%nVu}MQdJ-NT~;Got_yUA?Pc}^D}bbR z|FRPNPtR!OJo%Vx7dZNTpMD%CSt~682_S<5z2RiJv30;&JM~$air}O2WA(zM6npkzchC7Wlhd)exj99^y@Frp zbcAEqSX~`|Xn1&o+@=1}PeS2WBo7^dw4Qj>KQ@(nml^TEOAii5dTQ$)vKS!HmAIpR z;Q02^tf^Ur19%SF!fWi_UT)T3R4P8o5#xEE7&>VonhuPWbCB*4v%eeT!!i+zNSFNQ z7bD}Od)$3n%!(+1?0~64ui&aMRDU0q3qf+`Z{J%Dm^`$H==`#IpEJwa^AhWccec@*j z4uc)8wMC`*z5K@h|{8Dk>`D0u7V8e^) zkrUzGOUDt_$q@b7rtg7d@d>5qYX|D6*8UsKgh22oi*@a)Ez*G=>2$qs;A?#Z$cV(-w*jLq1zj20=-4@L#_2-zRT+_7CK{%n zM@v*CI-?NOy{_BMdFpJ`Q64@vSpT-u_R_E^xQjgvcITxj#y7cs${^P<1roD;BR1p7 z!R=q9J7t^Uc!GM}DhjJB;lkecH9VNm7Bt^F66vJ$x7M`qX;&Azq5Q3xbHZN_rp-LP ziV54p+q!K}^Rhc{su|n9n4%=516NAx4wG-Fysi`F>GrK@W*ORR$scwkeMD!Fs048h z(@@5DpF;tj%6&AB--_sW_7Fc@5JWo7P)l%j;C>$1;i3o;4V7F>$~!ob&oCdL0Mm*!o7)YNqjzM5@|ybDdUXY&&83gdW7!kqtzfw#4%EKxwL1i9(l1dFkr z_D`JK0fW>~-HBOu`z^k~bb*CWiM{xjd@T@h4N+r^ssU?y+R&BUiO4IAU8ew+ZZyP@O4}8%@=qD*Ja6bzV&fz)zDfMwz;!l0+Khv3;BsCmF zac(TZNROiu!G*eCPzEjr-paM!N4`tAHKnvtiB?D$S@_x=fe*#+N8r9aEGMhsGx5>? z`8g$NJ$ul+8?h(f;DRSpAS-@5n2Cl)irMlp75=@HQ5Kni+d#hcw`bk<*1^=CW2yeB z)qGo6kOeo2!xsu%0Qvo^n$dr&+gHhZ~IxBi_o3hZv(7bbMBSdf+4sSI=;NxxvFNQ>fvE%?v z*MLyKJtUWZ&16h{BRZ&wr5~H{b)zI)I9d)hcKk~*4j>;7OCiKEwuz*Miwm99weI4x?w3N=EW8Vn5lVD&dY=w@Pn zJ@~;8-yz}I)n--Mu4Ce{?=xu^9GkHtRT-pBdN980_uRc%x~xboXM=`k)UJ@Ne99Rc zei0F9g}y|#8AVB?Z>yOSA`qzj^8(9_Z#(&5y$dgW(@BFXjh#m4V1gxm<5dEAp%)O{a0F2C4z zD_m`+5SMI4c44w_G0H~EEr-5jK?=be>C~mH%Kk!buw%X%I&x=VYxN*P?kkGpi4i8| z&!d2lLLxsVWe=Amc4X4X9Ka@b3ptq40vxoPrEMq14jp1(Hy0M*3(}zs6HEB}iZD&v zUt5DmB^%*YYSDHj@3nY8*tPX(Uxr2uJQK3Hy*pjJx`0x-X7GgAhykVSMh9lkZhtW2 z)V?=#Z7G7Ad#~r!>}Y#s@Mz11f7KnyAHS97+p9ILlo%Tu=h=|jb=Hyi#T?0x0AgWp zRIHeE4;|svHRn*W*4Kwr51qEmktI)c4$)z!M+z^WZOPV_T5yz@>nAgeOX%C)@U5>` zVR9+FT`+Q`;Bq+iXfkcZ2P3C6=_PhJfjkj&ovl3( zmY$#vubu|G;o!YZpcP}kt$H8g>(oFgvFuPoR3f}H<9l(LUl$Dsdk6Ti3((2<(QYq~ zG?0aUhkaJCP?~V7FCG=ih{Yog+lfv6@(2%mM){)J1mjH#{w%1m5!h@iL>2*3%tZ(Y z`4HiU9>Ss#H%Hx717D}I)AtiKM8?b8UgE0R2OECzm7Vd^>j(UlQhC)PHDAz7rU?)u z9k9Zl3ryarj?I1mw}Xf*4|PWpVH1%`%-!tvuk;>Dkko>?%7}J0Ks=OO>Tp(S5$Nd4 z63f=0EN*JH?ZA}i9^qi584>mcE=g`m*w6%6^A`($ZsL+isx0?->!c>nZnVXT=UBl* zW0$W{`-NBeH#74TVzpPZde@$|!9T_JJZES!o%FC09cRrd&1|^Q%9Nst)9USc1^(X* zmLb;ce@K>=igTHu9fkR_3B#$bA1Ss&U!caUN1L2-<}lE6IWkgF5%q6pa8jI-Ty|*| z4fak%u|y2=vzv*hnBD8Lk~)C-81k}nP5Y z4@Pyijjw85YmS>VIX+K90EC;#Gj*8MIWyNJ0WKD8eqKt z#=5Xs&yXN&5ZuH9dcrDQF^=F>1%$vj1)_kBjE_zLMZ#}7I=bTcQwf()#HXGu>mRI# zsBZ?J`MZ&+$JQSp7g8NbqItWZ(^GBznkqPx1SWJbBeW6a?~S5I?o$7MW5BHbKQLe? z?AMkg4pp+uMMIxYA7)=xl`>=~Jpw^9G*9XZv;2t5bsGDISvsOcU^|LH$HJ`V4|A=5 zwgZ%%sWt;r4bK}7L@kwg!fb%x8(@|Rl|B1~-z(COv2m#DH4f{>W%GD3nT>=3ITf8h zF3pXMY(gOGrUv_*c@#wx+=(UzEj4y4((@j4mPIu}Pu8}~b2TxKWE+fE5-tsZqTK8a zO}oLIx>|HP!Ix=U1Y>imwKjr8U$jxXp_BM~2{fdkEgxt1sqN7)p#9yYEt!*wB`prK zVrjnu-Ms1IvA1E~Rd|00HL%?*me+?(BZ!AL{mcT=aJUd3|I<|-Lglr9`mDpC=uv~Q z(YGs2h&}F!463HQd+r4HceCpI3-{P&3$0|R4_Dk6L*-qN@qNuMR32SMciy-D(`H5aM0a zTMB*!w>}swQUo7Y(hX`_9~_1P?f|hfnLe{zi9BrIy7_3F-9SIUS~0-)h>hiw-Nbnk z1|F45#uE0m0g-?^rXC(6a97p>@8GvZyjbNkd{*|%#m)wPbWYYby=i>@tfP%WNZ^{< zqvs=G4r7|!x~3YBGmAGo8;dB{jzNG$tm#n>n!7a(2s@t#_!lZ|kUra`EJ2vp z)Z-+KlnKV(FC{I_RI|8=uyCycgd&sz{Fs7v$^!d{ZYl zInxJjjUwVl3XrW{E{b~n=0KPVp}I!Q=I&PhPWTvpfgmx&#kSn3%Lp$C0p?AZN<}!P zY{e|`v_VI@s2T^Nz6fP-ZI3(12W>Eg`f*~ENtix>e=>R z^kX~dnt=gnJ+l^qS+xY-?N#riR(X*C2^Am{ZfDYA1Cpyw#8%zEUy&_;{cmVli`e71 zko3Z@RL0t9n~UjTLUG{;rt= z$i`zuw6%^4NDp`?)kKI!>BcP2aA71x;dto7h&N*{v%1hp5}Z(V>`!34A>QUl`QR#e z-$U%8FxUm+)nCtx?wQJxUb)uDk~A5Hd8{2B#73%P-;$${*L*7ygko;d4g%Z|??tXRNAh|wNs9ASPjq0ht}FBcXq zz#Sb6AF>?o%*J3SSfYz5(p9TQZ_3u9uc>$A><#-yzq4wjyU#MC`I!VQ6#Pc-kM1Z0 zJ-EyLHrQ7}qeut|mG;GE%axyeg)n+wy zb?dmHJQfXblN#s$l5$)|k1ZzLic4hC=a?e{%C!ZphG%9p=q#WeDA;n(*TtyQAN|qn z?1}>$)=Gf)Mq*?@qWF*h;m;o!KXH)Mi6O4hVu03}UeZHk}RGLO2J<1)*wP1x^_Sfv-#?C?Nz~7rcGlK23`m^zPfFre zqb0EMeJsNcOn2;f!uTmAdS>^|gHh+X{1W$LoDL~z>3%gQ=9IVfsTg2yALc&4YTZG> ztp)8^=wj2946pL3Q<>~I*kpeBL}ui@%D(43q5&@2AFuo{{yMJooD^fWG`dnQvoWgX z0kzYaTg~dmHv!DcfLMI0@#qNhz!)#B6tSnb84C^MIF^l5^&zYwNA25oED&7UT>3)m z=`}qm8RPpY1Ne(4BZlKSlI<+G!tO<- zB08j}X0ffN!>pPSLAFIO)w?d~E0FK_R(d?__|Kxbm^Q&&JKTA)L+v@rwTcLTXMYf; zAC?kFxTJ1{Q7-(v7r2_%?K)iiK2uy&^zKkOne1Im?ZsqL>)6Da)+#$u9-Y1f5?X)u zqwxp-kFB-GeuMiZ+Ej9E^68fq&B-H3&mTEK`gg#@0t}Y1M(Ou@Q0If1t@D$@8Gbfg z1^`pUPq9ru8FVy4&=vwgkAlOGjX0&awA$T`OVq4OCoRG%2pns!{aSj)AHQ15JFvas z5YGCG?moihf3E>DK+DpIq(NQvQEr|T zyVf4$jzaP#-+z8a>7+i>ZGt|eI|0ZJ(s9KMYUo~~1QbgjD2-r4Pp4nQIie=RtJJ|w znz06*4bJ|ckl-TzWFQRxm7K0C`*Vd;;jm;#XzB4cFQKPbjJ|?WO?aDs_b*@vs}Mz> z>%;gh3TGZ%7`bQP+h`?r`B-3ywG2qcJ?nPidW#pR!_L0p{K;>cF<7K1q26;Rma1)b|Kyom zN+ihkX-$w_h*RQ!@8Wta&{Hn@=>;!iSjBML0_lE;wyVnS=35_8Y&@khj+PsfZ{|vq zFW!hXjHdCFo|5Nt`#zMK{=fI zq{cPD*j9=@wbSVSbk>?fDXqUiu|d5fQW(Ue#hmU^v&mf*%Z`V7&wWTe!|K}FjOUik ztwmIXX2_G~-ey4Qk{(Gl&&WZw$`M^OBMo)<^|aYn7Te5BTlxa+&)ks@Y})?s3lWH? z#Sfqg0&xmcN{NJdZ!<-VIJu=O!8dxSpSpwcDH|$1BYk>}(vDqwZIPzwzq8)C;WPFN z#zm&^DG7Bwg^%!d5LAzH9-HXyg_DpXFg(v0CSv|ix#P(KY+v=43XzygV{H*fu^E!4 zYUqBG=jI*;1`O#UHx%Ir6cIFeu-nUIz@2tbl(r7oJI2@ewtQFP`yHm0sY+0#{~k3h z+*~(%_oEqBzfEl9&`=H{L>m!TkCmBbtQr9YSy4`Ekpb=#1caH*Tt7d*U3M-mP_Zov z4f}uGG?f)r-1N*{nJYSZOc?*u`l;vZkHsu7<6~z^`Xhc^Gp4#o4wryVrYnBd zp-9{ zpJRR>S;Qk}D{8Zt)R>sU|Jlo40BW~^VNUB!>Mg+oPHtg$WT_Z-`Qi2?Xazf$<}EG8 zfTT++?x{#dxPZXWzvB?Z0Gz(@$riI+$d*$G)%%$6O`01X(YV#Zw%XY(6vTJ~=xfZ_0jfk6$NMjsv+Ay0sdAzg^9zmzvN#Kr&Kc`LNXVqI*y zN=;2I2N;>8vl61cx4D)pvHh~E{20{{2t#2{asidhTuhXltAEgWoaCVozMi7?$a;^3Wnqma`j^=>tS1B;$o($?~%=wYt2A2ara zP@qQrIY!(+8r_NP@g7hH)ylm{R`M+Vprag~O03vpqra9lNU_=;*zsk!Gk~@ql$fSOa!3Io>?A&VCYnBbn>Lm6ZJ!#`4X1k`HR8807nDg1ES)3i=_uaPxg z%s)1>66?8JL)^rbsI2<;sohR}OuM$8E*h0$V9{cLcp*0SL%<73qu>zXepRAZ_)!;&U>A$^^ii%~bDEr`) z-9W|>{pUqy@6o+>gh<7`p4}vAJ6!sgYv^p7w8Np#;{O73u_x(_c|B)Fqbp>vx*dTwqRPEIIea{=u?-qeSLm*06#2%C(`Dg3&j9*yL9mx>T z$jJ2EBsynfU_jm2*l@z60`Kdb5^mblB?6?bY8Dc*?ea%B{sy?4`lo)gB}9j03)ndY z_;X46AiD?ed&@IxH~4s-o3&ty)Rn^1e|l8H0-|q25Qa(v8N@H(V-fnt z6FEi=VBKH^rXIhJT&^`ebRP9*1eGt3i3`lR4?0N5`J510I_}tI<>Zb5)wA(fI-kc* ze)6;@c1>ib!oGOy*VP0K^6u&4u$@FEhYb?6?xL`ths_&HiFQAHhGF_qH~u4-M$N~t zpR_RFTE1mtO}!#=6UrqX-?RAfP~QHZr0>;}*j zSvyS3%JQA)zEENc|4>v`(g*gw%yC9G%?GXS^Z7Jv3G73R`yM(MbJUUlHXC)8T5+m^ zP$C;hC*1^StjbGhF5A7G=z;C4p_gvbZh;7%O?U_anp4FJ&|CgT5=g z&6iHiqT6kES@(5}(2FGAHjqwjI8IGo!$hoe)GdN;7WQDMg>?Le_MyK@u2$QriAKB1%{|g%=dw0xS17DURzxt+e^- zjE?)L+QlPFlpE5QnSHHOx|oDFQ1A6rJ1~ce83(e{g%4zbqXrW6 z&`PNnb6lqS#E+tpQQ*L50e%b2kk`w&V zJJRQrc5BtvFo3r~{${VYo{`7$l-Lt})yt4KYlYu77W-%|Z7~tN<9D8Aflr?rLCi4! zK7&7B7|0`3_QjLH{R!6h|G0SRb*wV4#iv1lEme+4?lXjQu`N-=_2A2KBk%hW-ErDf zdGHm(l7vNd#i_oDY0`qZ;PQ-NyTOO9{sL%g|M58FnzEJ$xyvWv=M)Qh$x}cPPS!iXu}OUEBT?-=_H3$G?#4JB;p+K74JMV z1T!sQK>=DeUb&x~$w_pau|H=13}J(9)2Mlxx9_vUT(xodqYah!O%R9Kop)@mEJZJt zc>Z)bY;s^jNBU_Ftvy~9W5&7GPuW_=x=jXX=2Q*&ew}d5b7)m6 z`eNK}92qp}Zg|lWSI`l=r#1X?u7A!<@*wr3Z(CHevwYj0om>FTm^AbqzX~l8;*6P|*2=2iBhUf0RIMxe5UhO(k>M){d*wuQ; z{`t6osMegQyYiW)WidYL+dFZ$oP>B{;X%*pqqW)7h+l(T*B$~-8^9B^&uZgiY#~>= zpMHcLtVFzjGP2Bf?X7F#jyOF3bHtSWWdg%=wo{d^(wR(ydVBGu^w?#jsL`R}cD2?$ zKFs%77@gCj+~AxWu&S=}gxBBZr8gS-&NqjPrg1d**72c>?xLu2x&^ zHvHl?va!oDo(QL~Z>)bUl}VEtri~!r>QqdZi86m5W0zEA@3r{CRwERpQ+^x&4S^(w z_;>K`2NlJ%=j<`IbJX;GXyYn{!B;*|*1ML9Ep&y>Zt-Z!Y}=Wo<1a@6B#Y<_2V#=g zvqU9l(Gt!ILUZizD=va(J?A7`t3n~Zi+m4d=Q~332kwVg$=?I@m#vyA!u*6I2VMZT z+P^86>|U@TxV!jf;qvOFv~pTzL;xZ!-$8Q7GQRnVRbC%Rqa$EX)Zc-Rhz?74x9Pug zU+;W6J_N2!#f3UYfnBHKZvYUeje(u-Z2cmc3m_12SmhLq`ncYf{Hg)=p2y|&6 z>!_uWY5sr!vdOziEqya94mA$5IJv%~4*{M>LKHymRr#|gXWzFlM&OmAY57Yss*QxPljV$A)Zzbc7S?8L8fD{ ztBYw>n9mF5Hu^3mFb{>y_9o^3qV2t-n&{fMQ7nLph!q5+*eKFeI!IFi=^dm7rI!Fo zlNtrVLhnMP_Yyh@Jt7LydrKe@fk0@Xg_?2(pXYtQ-&yBd=bUxcI{P1zFlEo|nc4ST z*L7dFr{(|Fo|=PoN}^aa`j%OW{DZS^UyKgP?@^Uu^3@rg!Fk%eJ3JwWue$fX0_7RH zxYb&d7wXx4(UP8CPZq1vHyWA?4hUG=>$cgvoEZXue4*v#Yq9u}+jWPY2L0kho*wbi zQ?g4&#yPjCG9fpITx&fYR^D=@(Rj(YyBFpU7JxygHN`JDZ`}2P+WqFI zlk(V2dzv&I^Sv$hO35|4+Gk;hsMMc= ztmu8|)94*Nl`&73B+Cvx)m%U`#7oaOsQTxsbBs($pG)obQlH3`1Rib<)R~fdm*hX; z^2#G+O4f7tUh!Bpt+m4UI)1gujb)ltashfY^yxd_&nL`2CyKj$hBqanaud(}Ih1>_ zT*UqVAYnjS)k`e%S-uL7yT5WP&9Z!DXLNzF>imywQx!#{@>juXwd_d_Prby&^7T~N zIck$g9-NQ>5fCHl#w8`R!QA&D{32{2t>*)P9vs&m0tiXH(1!Lmlk$U2$sc1iBGa7D z(y;gYWjPF}T|}L^W!Tf#XQaw52cbMNL%6}{+;SS0h-O_KS+L@JKY1%0ldStg1*>!< zWaLsk><&w>%wjM9p1q6OUNhg8O#E@ZWaeX$+E!y0Z2m)|tmWE{rviWt(gASM$6qUN zo($TT4VFrBmqwJ%rWR(zEFZhk|7!9x0x*qrz`X}Z3hopLfp?5Rt9Tm4&IwxbAFtR9 zfSfrifKm4GT_OM+2av|>qOJs0{TF>chBz9nfWk$`A8u9P{-~G%t z4+wnexPsDUK<5Mq;oVjuJ`q@Yyp6BZ+YNNc)zaW#+u4%; zDo=v{QJ(M}&M?2*+^*3RJk?B^*jbj+Q)2;29&~rt-l@xRo0SJ={(&*vmy>vGDM`vG z+`zfH2&MawPUa0jXim99!y_*@{HGIaxT-AJ(o0Vgas*bHmlq`ywDUyZOOp3fFWLh} zl~F0{;}UD+!c zELDNsw#|OJvg%1q9K3{mUZ3Eq>znEG{}_h?kJvAOff#9veWOAYwlVV)cac`aNc>xz zMqiv?>s^S04l71fFRo5>@ZaoO@4`* z3C|OnMWA+nU-EtNzS>n-x)^+agUIy0qT=C5H3tcO)Q<4ue?8%@_;b>>_c~iy8H3`$ ztC-o@a(j{hLRa?LlDER2Becb}e<-&haoCWOxoHxUynxHu(U19TqlN+oTH+<8KMcdZ zj`VHVUGiJ>ku^;ub`L7Bz+T$qSYd*IV@-Nf`q z`9Pt~Zx>Ln+iB-ap1hl(?@Pv&ep5?K%Qo)(=g2Pkm8#H#3q=gGw_eiT6L!o_W3HZ( z&uG=<-{Z*|}SyKd*8{%WITqKedOO>%oLq0Rr#&H)oV zufcIPqj24|khM9#%{P}|qZ#OrOP@EnLiS$?&B_X&&|6!O$;D;Aah%eBG#$uT@Z-YI z4SIdu8%2nQsoA!ic!Do**6MuB=e9(~wl_GK zi3cye+`rlUBDmu!c11qvcNa@HI#TS4iifmw74C^TBf;X`R8B_sm~yb&;P^x-O~ftZ zTX#H9{0W)AcZ_6#Xfn*Nf1qjjykvImsx8UmU%^S7q@x!g3LNiyAhkrNA*u(9??btI zdGLZHAOA}V9fuMIxuFuXCYHhBm^OuW#-ijGXl1d|^2Y?XwFgTq3JC#z#>cver%xS6 z04IR)gTud-%2GZlza&R$eyqCkQzi&I?_C~Q@ZYjh^Urfb;1Of;`x{;Yf%{JczU~q} zD#TpqoVy*sKO*$((@H28n)by4zk;ifCvu`tW)1ZI*f&#Ngvsw^8XL}o{7@5qcF?C+ z)!?hBe_x`Jv`v1yl_)8pV^W+e35jQhgtPV6614o9-&~^CNpFu~xi^OY-IeJK#`=>k3mbMNNR3^) zdCE6y>5IiEhrst}PM(#Ixh;h*ee%k`?ay`tqLYI0tD_Ic9;iEg`$D@c@BG_-Y2ZIX zfsel|fi!=gO(h0*Nvh18Gb zI!a1PfV1<*w99%!$+5BA|M>Av&-o~$@!Lrk`xNWmT`22&JY&kd_+P_}Egr@aNAv2r zfE$OiC!G_i2Ygh|#Rp}c=8tw(gts)GPVnlO)UHj{sP|=?!5%S(%1NhQvh;WV8>VSopyco->Kow@fwonJ68YZ_Xnw; z;;CW-F2yCYr2oCImC+0HtHM?39{PNxeI-@6<9K3wM z1JiHS>ix-Qmu?*9(5$_3aAQqieCiQMjjn*bya(scDs%bLSPmtlnFpfqnQHu;YHm+3 zTR;5$EAIBO%Z;9y+2><}v^Lf81C@%%x(IG0dSuq0J81EY2Zw-0JK195IoHP&Q z#BZ{&3^j`#Ly4GUDAAZ<e!5{xi`QXfvoIx{A`)sB@IcpVJp11 zw2X)U<^Z+Zm%@+Me&*EEocGptr}yal4k~(h2p85vZ|+~FYE@F6d?L{^)3<#&)5|t|EkwYQ>!arcG3JR$PXM9i z!>hTDo5I2u013xyp;5mox8>2|=T$GmECS>n%&s?7*mPZ%mXki8zQEjg{#?x_fxXaX zypqOlmOFW1DvGj28DKl&NN&3B^*!;e>0tnTo`3qLcHzYnQ?E5sRtj^sk09fZVY+sZ z1rop(ss6(jEgVoonvkIRDcv#K@0)kek9}-b1LmRTOtY-tfec_iBd#pKHzLMJet+MK z!Q#&u)YFM5>k(_PJ;2?(xDZ_U!5}@H``&P5d(P!7o%5GHnR1__Lr6lUu~KEmz2RW! z+o_sAH>ttzH>4h9#vrH)0n}3u#TPNz`kdHgx(uc9$ddI5#Smj)tpDyd? z&g9LZcPhH504@dUqn%o$^hn$jDXIQcwAG`>0|a?9L9y>U{zX>&p$k^$ukxNAVx?SH z*?9fF?-K3Ff_tYg9_*QC*0s72>U?*#ec~CXZdN#Om6}qiYe{#H5(XBJU^_U4tL31g z>LVV$-4`Q}`K!UOXNSKPdq5JZ3h8HZ4i@np<}SZ=lT^wX6c-Wx#N`Vd)hQPJ$UpEf zvo9Y`r1yyUbCrlwLqFS}G{0iFEHt2el#`yC6oCmoT4Q@?`w@Djx8|m850HQ#kMp(* zRvCd%A-AXWUW^;Y#t~meA^Iz*36ctz?yEu77S2{Na@;C6*go$ps}_AE(XE2?#S z*LsWWTUWX&@<*xq#2zI~rIVse;NcL6nj^}{yirVh>llh5o8U#dXDHrH1wl>EnlOwH zhv`V0nd(T)TdR191_vKLjBoR!_d2x=v#89}W2|WZSKrSvYPxccOj^ zbU4u}z`Qsqc0QhuxxsX&0A z_7Fdif-5V7JgN6y-%U}nS88A$bJJV>C{)>tNJ2SM?-hY^Srk5=p8q3nTn2ykUrA6_)=lrY-?1Tv>0^eQeQ~rwpWdLDfPUNsc_%s-W6NIiKS-y z{;yNBPs|Te+vE0fK;?K$>X2YLce}GzP9O%v%wMR}wckA!90|U%E+9R5O=vMD(b=rH zbRHlE6*Eo_ z*uLBuiTN;3^_i4!22Tj@rpQ$}Cqc+VobS)J3}$*O|sK zEhTY{oeJOZDdS-U^6*L1u)}TY26o3WRqQvKI%O_lusZ;q*DRryDUeN4)D~`#y;~?h zlJmR1$R4^AH_OU1<$WrA#8cK1cfVF&8d2bA5q%v=jo}QClt~Zl%|%jp@v|FWTMHm& z7ljctn9KMF2-n%nWze6VUg#l9-)4%O{|D$b=Y2`C#;O(h6BJTQdBS+z!}I=Zlj)Ps zFJ-)@wIn*5m|k4G_bO9iD0^~ZRDrYtb5NvKsBv*HuItTmt>{F^C+?M^BI(8;hIu!G zX7cc8(5aV1CxWN`CnsA+{!?z>T0BXb4Fzq#-clb0UF|{zXihmCov8nVy5U&!zAik$ zA>=oTm9WU76uYJ&8T4n>PpDKr8*=cwj15^|)Ch>9g5k4ID<8Zq{XpASV(;?$x>)J6 zL~!_%FVgm)lO`>uh2aQE^}QrNs+d-%-8bYV;R(Y%o3w;oBop3s zC7b#DYdcIERLK`;m`=O|kDl^HhG)7^b<9jJr(YxgdWgjdx?ho4WRF z+KBL`>NR94-qb+6c$6I1z4#D0$BF^72(gGW>uNBTOvzYQ7`*>NaZ(DWQJcE5X&qocChpRlMV!9MRwC1oB%8nN#cOtOLu#9KQAz11Uu5{CnzOGa-?q z_<5Sqx9$UcI%+Jl6R`y4QpBu3oprxBW3jNXWG(1ZT zE)87AAJ(QvXpLsJcRcR!xn#bp{z2UvsFdwiO}Qpr zClg=0JQ@$Xr=mdu`3~O|6B!!iF7vnRbomIt%FbZWlp~->t8Q9mDOu{8QCvKk)nCjN zThm}qA6P?N+DUHB3t!$LO?zowxg+q^3ZL=?{`IB<&(k!qXP%a=j~QEpW=MwR{O_M# zIm>35eSj)T+b8;W_KX^akoVLRjOk|(+ zuS|!j6gmQAo9Zsk{g1@^EE%J}f=ElH{fB zT135@v)`39lfEA;x^ptc@Q;{@*`?sKo5)}96LPHW$=ZkV(#8ORSQa0Dc?=FhiNVB znp{mqhDc{TwnQM=_2IKM@# z^0rH#__kn7%1d$LDTSbx*itU3tMX$YCcu&O4Z!Y~Z~wotM00f2Hi4 zjKU<*f08q8<=ah+^y6xHN_6=5%fpU5xpF#H^SgVbc*{LjnqRWu3$<&~BTodPiKD6$ z*s?-uU?QbGQDIngWPNnwlJX&Ov4vO~I4Z*KeF#2`-FxwW5^}J2TfNFC&&&n zoDbjZ`5unRT`@upXgSmx4RDYeGuPm6()Pmrd_S#2c8!G?M1PNKkK*uMZFTmrv_foB z7@G2o9!WUq4aY`ZA^O*2J5^{`PSMcJGo}=;q+rY&vg5lq&^#tbuX5gfvy2eu1)f#; z_VmKJl>o0L_$wXP{YTy=8s?-I@u4uyLBek_+(a_4k`_t=|?jSe4 zm3r=kreqc(%VEUmY#8wP84ID}$)JR^uR*gTyUYQ^z<@ zUvThYgeLwZxUyFo(kgBc%M*%9S(m>v`HH1vI6Z;5f_fK1!RrOBegOJm7hDp^7x@g?d379iGom4wY5au2B=QX7CAl9Pc7Nt|S-$^lC% znYTnF#f_@+q@*ar(3HK(n&Wa zj~hC5r1#oAPi>vl*t$J#Kh}XZ=@~cX&~$pbyU_+~^nQlMB&(q@2Tye+4n>_X1}-fo zax^qROd?ihS@67Bbz-_I3l+3CQ%K9eyo4mBQ2$U#vrLdl+8*VhSLcX})a-nTUf1*+ zbW^X(#WjwU#;1emduSCHOYz^oTokK!>PA{sk;g=bJx6lWS!?rj^AkE(Ot3MvT|TZbR_cxK zCmihcT(*(G<<9Mt4``M1%|>%rnWA>L%RsN|UCUOzG(QzIKQLvmP!p!1`Q;81=73GV zHUxb|E)`U7w+u!ZI=_U*U~v+v%BM;L7~uXgbp6L5FrB{q9F|3z-?F zJ++!ji}as{hdvz+Q5JWm&EenQkol&4y_%K+vpD!TXo3B`2L8M)H7|6_U7M0*!tWIh z9Dr*YR8SUB*VMwr#GMhYJ;K6nEM&NDh|WU$Gz#cr`Hhoc8V~Q4(RXmsMd78~fq};2 zRZkZrTaVALX-4d z#%Vq3_Q|o3#g5~SyszLqxhj+YuXj_81DemmCJtt@*Jnh!|a_k`0d%?_50G7r+#pBd+Sq|A_ zUjUkjW)<}H5sLnr0KA1SzJe9|*8Dw8M=ya4@d%{nr#R}c9jOWlZ#bd^tgSO`5d8AtH0iBs5wUrr)&m-7N z0z_x6Xq=?)G`{sig3+DpSs5Y_ZroRwWpU^&TJvz^T-P`;CPklz;rMhbiUMJqtT&#G zyi3w5k;bYLtd$ejY;;qCq`xg zid;=yilO7Am-+T`@n>FN!^)c1RsAr_PrCN{X2VrPQIS`~OVw#x(Q}0W!t^;xctTJT zB@@Qx550O+sbCks-%+u53Cn!P?4@G8098|GaSTQDb&4b|{mgL|O3mP(0C?PNBg_}O zd|D2+yp`YFRaV>w`$OI^FR!_lIPlt6te`LJn@`(9FxT~Fn)w>9^qUsz;qJg_#DZl0 zVBdrL9gnv3C4)S+Li#ggaz%M{@DUv&GINX|v5cXE3air2f|(-fb}{9UX~ccBFR1Yd zy+aK4>ElMb39%x698t%s*E*cKn%t^c8CNpK>kG%1)p4`Ofos%}(@Mp;bffUq>f7{& z0qDV}YPh9B%YykwLek2q#fKT z7J{&o>iu#&`8sh@0vzC)2>m`*p=-CNHCO_ADl1qtvh8W&Jl^7TPGQb251wATG$qEt zQL8R$mq(<(Y7iG5p6b(7ayu2QHKRXo*$Iv7XCj?%HcX5=c|7oDg?;bfRx|k_p3K&= zb0IEDDp1-PfB)^H9S;G2!36O89@_w?Z8f+l|u_W3d|(HS59mSB6^ROeZV1(X-)P1)nV zH$P+^ZQ#tuEvT$!x~wB#J!T}YbvbI7PT({%3r&r#xgp2Wnge|*OAuatb8cLi`>IBX z(SN&JJzg$>+70s27NN#miN`)N&xwMkw!07h`u>zD52sM>JV<>MjNziTx618+?CUlb zh?D=sM6LmkU-Ty?sbZ+BZ)dRn(@?1uLsg%zE9EsqiMo~0Q95>nrNgW*~_j-NV$ z6dtZQR5f@{2#@as1951RB>m!@nS_n~xlBJxNGVcdS~dm}`L0baW4~94U;$Ub$rXC^ z{k9m!#iq5X z%QMJVIaa=`Zarcm#b3QvY6S9-uX^ms>f3+7AJ)bR&2?nK25`lSs=qd5;*XDUH69kA zbJ0;96rbvcWZp?*0l~FE6`xKQ2bvS7+bZaLAiEso<)b;VavquV2029UL~5*mAjA8E z{CrF+nLAZdL@)YK06dO8T$ySP_r2i!2W8##qoFoXfn>AJw9DZt(5G?FfLMNzGK@X! zNx{pO;=Daffhiqmif(oMgZ4^rMi3^;a&t?#;KgS9?VUFwn;bfBH(*fy z<%$9Fhr{j(YYNoEJ&KR`&;HNqc%PBYtkn(CX-4bNv8Jaco>_FhCI^j%)`*iJ-pCoQ{{J4_X0{kmp`?$ zF4%6_KHDPiSF?`rbn#xKH^$-DU)5UFDi=>!6y>}y_r7o0PRvk3z;W7tLk608q%l28 zUS5EMMAATZ>LC$&?vt-}5``_Bi_(cvN*ilCER?N^X^eTO`+7FjPMu3msyxMQeZ&&6 z+cdsbT-ULp`a;b{Do+TnY2S7qx%Lpzw=yu#^KFC_Z18Y6`e(DWNiyi3^P(Mqi7w>h z!@%Fe_N2tGR7e+_zG3{l##LcX->CM_$tkrcJq7kgDsY{ivbevtiWilknC4=R=4<7h zrSLkcDLUzs=6e)9ouHMBlR`oBIEmzFGpB-`X)HoQRzoJxqqGAn^Gi#-$j3&M6%32@ zLmD$T7!AO*Pa}LPw7rBq^6N?>N14v3JRHH0Et6Tn>uI@}15MPTMKQg6lUp@Re|y2r zR4X&MJLHhuwHwyz=*0@A42bOL5IEG*E~G#Lab@W0Ai*atQyCxFI^46c*Owcya0K-#^FyO}q8K;==q~ zMfxnSt2DwQ>Z&Ki3bV770(MvR1er&wY&yM`NBNOYBxw{oE2G5&h|3EQ6XARJh5<6x z==t-dWVoejV)SLlQ!>ZFWqmUcS3c`J=?ax}AE%Iy#GOa^7}+H>Ptl#%RZ@Ca-Vpwh zi)M+BMa0U`#wItKQ*IfV>r23_A#-`PzfP9FWd{P^h~s!Qg$3AJG29(n4wN==8qQO@ zCnR*Yl8(l&_oRDWT^*{{DWO0MS^#vf@h%K_M_alD?D*RP5FRTUYH39+FE8(WJH_M( z)W@MTGb|3QkPbXC9vRhod3O1(a{fCT;Vxq{M^ik&8Dvm7QOn&&=$UQ*Km?-i;`;jM zc6N4dZo4wK20Joe9iJ(SI>Cg#5Z4-qf!$D77GaCQ)R97OT(48QtZy_o`@?F7_KZsb z#;d7S4uxZ9s!vR5Y#+TOfCC`tfN9KP`iZ|mch;4f;j}OYmcw=sl?XagC@n4ZKHPCa zs7%;_t4)vJj)83X&ViS*o`;FT7E*+9nrfSYNb2gFfs1bidN9~sPQ+eA%fvRvzgv^> zT8a%O&2b%pWP zpnhWJcI6R!{;jwF4!+l8AfK|D(|_rvR;IiqkbBeu6@X0R70NMAjH zy*@<3=PBy=qQb zydWPEJ#Fg0vW?4^^Sf(~hv$p_fJnS6&;RG9MnzewLGZzJ_Wix;6c}hozW!?t@5^zu>88=T-m&r$QY{PvOG7EEbfvZ z@CL0Nvq^H;;%pOUlR!2M|&sQ(guFhy>hXXtOz_ zq~p6x)H))DA*~e1L!poYS<>bg31p+CQm~!~W2%^u@65c8m(wxaQW1h_doO23lKW=E z3O*8lgNpKp%s4d8%@$*t9$A|@bIqjvx-7f3TT%Cd&}IF&McfO8F!HHMQm3fUv(30N z8mifHo$Xp7-q_UYYerM*+&i)HXYQDXqptdX)4>co%NA}9_rp|4rn5diZn8{AHIICH zUmPx_5K0gb?Y8M9nV?RcSh)WLJ`>u6J3rw(N5I~HOdGJb{HE=U*1@Hr7{XA@MSDNP&U#nMYu`us%3@v-Fz%;rxgxa;?bYs5!y%|@N3g@ zm_19_cbOIsTSQMcD2txR?TLR#XkL2)4;~KMSYNn;X{PhV=Ae}cp2L1*)Di1c$D}lB zvpqA#z+^3GXSCSh9v|OE=h^D898<6`bS;Mb5h~#>Q_`BynorNQ6aHX0AXvJX76;d` znI_Q#i^XRY_Z$gKA4~_vbgPItJEUFK$F>qtl?cVVOanv>ae)HH@i_057Aohpl2vn0 zqlbKFLX5<&*vdZqk&NEGB6eRM62V4Z3n3>vYN(%GzO?oTC?X>deqZaGfTfsjCN`u! z%<=88G23t{1c)1UIkl{~1J^q$pCl4;^w zNP^74k@drxAXI}1n+(s8wfSb^S=hb0b?HCl&pOiTXnh@SJpu3ECxS_uo$W{Zu5I;i zAxxpjYgq|SzFBKYSjbPV-LLprob7H$fNGu3gsR&)#YN*H)|g&n@amj(HGt}TbZ8RV zZFM|d7U;Rk;LW zi;P(U5f0XVPxOrqm37mc&JmJ9(X45k^LGi1oPq+a6V$kiQ`%$^yq>#%0&TK>vmt*U zC5F}5MI{hue(vqLn?z){I3BJhT znIs8bsQQUn974UeumM+?%7XR6!onzk^dgc=0i)$D)Z$Onx3P)6@X{{$OhXymrqfVr zvU=*P4Vt)IT2bGouB?OqQ8>(Dx3C&_YX7;21} zw;-2Q(px2WjOPkXNhhd#nRw02?{DtkQ(GoM8H|3@R}J%zG6qdMMx66{BCH|FqVG!LCPJF`)7&Pm@E9G>4J&w)w1p^r9cW-KH{ zLe1kPG~tfUud^!PsXm|PR{YSKW(0eQPT9rrhkg)vaPZ8@;X zp)Q_Uc!wd&Pl4nr#?bAz(!YT_X!b6MRJ+kb`FNSBAipxp{tK(gBKd0)+q`T3@UZ^c zbc4Z%3mmUKL;NJ(yQadfq)#M0ht{jca1uKMb{wVovoxwA#fc+te-ZXg!jqb|21g$b z0fB%a^ukFuEq|f4ocIj>KlOM!!JFVTH6PM;!oB+91IV?`bjOdj#mag8)I6mqT1i}1 zZp{6QxXIudNAuHnOUk`QxxPzG>Jv0Vwe@Aveg_Y%wqy{%83@@ypBeEKFL#0ndFhWi zum95O&jR;UNy^$sjKb^3Of%#UjSatLBw2tvwQvyt=vw)%mcCef2rK!La)t)L{mM|M z+E}h$v9w43tf~241~WG_Y|QUUNnqYXn_V;V@3!N-ijgzTpKbLqa*AWVQ+-+RIy?~0 zu9HNufZiL8SJN+j3BGM9{NO!f&UqA4NRH7m-ioN^=E(iXvKZJo;s4 z_AXuM^UAqsDZ-iOtYohK>_R6v$ymLM!kY3lG{%V zQxH4-g>EWliE%2Mns&T`H?_PZbc@j8JL8*<1!!J(Jh}apxRhRcYAVRN!9;u$KCw$X zr-ch3pg98aZ?=y(Anm~QbWAeEr(`d;Jx03^#=YY=B!oPhT4^Q5xqzL2SGH}!XX6`= z^cPVs+xvC}Za2>U6F9mUWPw#}d^r?S_B(%N*GvHA3xVozoBG3n21g3fD^YvVOCJnW zOLnkveRN)K$7-_ccNnV6zJE)yiwJ8IHHWKLy4({`U>uOM3AgC^oLM%WCs}q!qM?SK#!<)xDVWw`_b&Gi zWn#bKM*fx@JmJaF=|9B^_?%o+(2+dNH9|qpFQes4koxa+u^&l zfnc3UNB14_5nszAyuu6GTQ^ zz%9r!qA>s9r!3r9M@OMZ8l5r7Cs`_PmP#{LfMz7}xj(rS%QpOs)q zbOo23&&YP=oS{o~Qm~ogD$A3)oBAE8Gk(1N-YV3@ZMB&~Eu`uCZi@eUoM)99bj~s& zsR4ktS_>x5bGJk&h zD`FDW`~|tMCKnZODtOQ6?o1ZDa*el|^AVe)Xz5`j(Pp^ec++BhqFrA)G+pO`tR?Uo-RLnJ(*L!ekg+@{z0=&9(&$TAFBn`1+)6ffPwpmJJ$-d|Y;<%9a5V7W zXrrI`n(X}pc@~{GBmv)3wv>WcAz>+$g^>su&-EPP3}jXWi}3Qo?KaT7ysK0`2rM_b z%#HqENc*opl_FCJE2uYKe$KxI+0LuW1vhd-yRO=b4sk=(MFkgF!Tdj@+ z*V;)!QehRFFD0k)`dNX;~1@}{+^t6QsNuU^t#SmfSK8ZQ-Z5e?;- zNeJzkGE08r$Fg9QSj#TTMdsC?_n>ta+uM4(AI7U3Iv_rLtZT2AC7yOaf*i1OEQ#La zy<7Y%qXoGp=SJ8b#nf%U`4P2!Ob`b) z2iHnGAFuWDLL^5*3qc2Sal}VMb1@JeJ{GVKwgXG`L@o2QuRX?B@cUoL2nf!bXmOEU zvJ9`?bPRp2(mqmS?Ne(vQ`yo%VB=Dm+z~U-zNa%VnXvqSh3$;!tmz)p1g2dzT83DP;(-LISSt z){*mH+Tkps#b`halr!UI8bZ5-Q&aF)n}r?a2F%m5BJ9pxg{3XhSG%GoGUGCijy8fPUrDDBFU|7hq6_B7)hQ7}lL@!=5mX$X%mB`G+suS5=4V1A#H ziqty&-W44XoR7_i&l1-amZjY*Al`-0b(4}$dp8VwWmRTl&GX4sweMP%T2+&Rcw4R7 z8?POXmDvSn-PZ*$YKSVbr0SyHQH5Gu5DP|J50F;ytyoG)t$+PN+=Z4SgY283j@>7N zm5$zQ@021kM#z2eBolx_7;bwq6)trpje5R=cP2tl6q2`D8oW4@PX{9}RP3Z@-hH^R z3dmm6DWndCZIe$6iZwY4S%9oE`*X77+73YKdRf_YMvvLV$l)aO$j7kL%0$IPYtRuX z{?5^3dYUDvT~7F3RZGem*_GfF073_#G1zpqCUsSvbh!#DX{+fohitK%@Xo%ZC}A{t zApdZLg?!aj10jSzqCebgH=7axJ0IAiUiZ&eKfNNNbz=#JeTfIsAN%&pUxj^=8dos#)%Q3U`}@=tujE&1DdhgByOSBfS2Yc{%r?)>uh=A$lU~LRJiOYH zQE=quPmsBspG)K6rzdkROPZ095mn<5^Rns-Re2qNXA)yhD$-X^>H&Z~iO{XAtjs3; z+EyE7v+@yg1ui}4vmCKqLK+kPxvbMDtzWU?U$l&W7W~0x?Ay@_TK$ISpGm(bdj>2~8j}@Fvt7~=#AeTX- zzw!~qLZ@5+t6(s3Y136LfgAnAeq$xpdA*#;-Y;2=H^R6k?z%XdslE?HIJD zSxQ4)bqsh#rj|0v%goYG3DmLNu#?9iXbyDqN<@tRr-{Guz&fm&UOTWK6|kc-Rqf_Yt_t3WCeR zHGn(s+Q}A-LDPl&4?SI}-4Wd(QY z@K4~NJ(>&|1!1qNOez|Xw;}Nle%aGu_pizM5n#)~vtP?w-YDhL!K)2UTW|)m^5!T1?Fdc7aDgHeKelZ~ zcBl4OvdI+1Koh27q2&_{5Yrs$VM;Ffl^4y*Gj73}+Swy|Vs2eulG$I%pC(HjHNC?3 z7M}Yb`iX{S&b-aD$Peck&7 zQBV=F0ZS0Dfzm{!Ne5|4?=3W?mjKdhP*|d%fPe%c(tGcr21KP3LPrt^2vS0o-r@cN zuD$j?=iIaRefK(d-1m;xKO8!SGtPvWIiKhIe7@i3-OoO$gD)Y5OlJQoUG==<-1D;% zmM2NxC1@8I<;Cz=RN^}Lf^wB5q*D+l#pe3sN(MW1=?QkGL^4zD`Yt07zQLsme zbow+sJw3=pWNLVN53Cha%utR4`$K(Xjy(_U&VvZ7&GfY$;0-i2Q^Cra?83rMF0|iq zEI4z(jxApVL%Z2R65J#jQRa653!&$e{}M>m^PH4SQ&lz5Hb3bn1&L5=!yCH3Z{IRg z^9;Pq}D}gKTL#}gin9p{lyb>_TS-@lXi{x@3cTXptu!b3*WfsdF zF!EMvXlP*P;BaheeSECVn2=Hw-Egc`{UH+hcl!+!wA$@|&4q0!44E z=YHcc#VF^THzO;Kp4@1_HgLL>?$GI|pE!XSk=?u*nmA`lM#D?YGj#GK2_s?REuT;PyF&qTF2>@FAKBb~QS zk34O&f@l7Wk66sUcLU(k_lB|EvwwGFe!2xk!!|ANo*~{T!I!zQxstsS9*FwI3S))40 zfV{5xquU?poW0#iI_-LiWI1w82-{UWyViS*H>#VblG07r#6sRK9x1LjH+d5b)#%=2 zgWfy|5lJPCacW>1%*v3h){Bce5eK`c$pG(AwOx={!Fu}5eZ+IB?8FRCRjNiUVcHIS zMn23X)ah^Lj&~cBh*B^t&if=x5zWWIRcl?bk+wBQXSpjoUoAqJjT(XY@s~;a?p>z! z@m8Q0Adb&467YP~y1wB?RJ{FZQp!?PPNRP$`)%d3ntDIyQXnOiMuSz0BR|1VOxWE4 z55MBMGmzbt%Hh=x*OSGuT8|NjXowT@xN;R7658Wlw__-9OB{S>4u|d%J7#A~Uy_#4 zWOsgKNAO6l4BYBpiPo_{#mWoea1-I8Eax3ojx7^8ulks(bkL>3$lAP$TA!UGH(O@p1>IJcvs?*?$6{gavx01r8KW>xRkewSdCLXROe1=Yyp{!6 zZ0bsRL|Yc6)+~3?j!}My^`eUN6tk$M19MxNpdLBa9~!Vy%>t^BeX*P3x7Il|bEfGg z^e-7mjQK?7b8Pt_hEgn3UusZWshcal+4ZHsSPbI67eyrW8Em(xz>*hz7rkLOuo?6! z-PM_xW43)@=vU5L)Ql+ogp-q6HHi^eA}FJ3t?O!k4$NkVd;P??yb@>XnbaxwcDUN3 zAjNwAJth0CCit%!OD4&In466 zd#?y7#kQNa=*Vc5DKgJAaQe%v9vn8D`9*{^{w-b$1F zWM9oJT}<-i<YpZs-pfO@;c$h&p>Wt=!i{Cyn_+0_mYMM~JbrmD8hm(hT5 z6C>J=xjn@ID1@?D&%}OMj{X7HH=UO!_KiH-gn7b-qoo4)8W=Ma7iIlJPx=8J-+pn! z=g={bsDT}$VEfEp5#g^zqqW3Y___L4PU-q{v9syC<1NyvnVa}Q`}QEajD4O}s|H%A zO*g-CoKg0BU>}F={j5DREFf7#U2-yPF1!0WSEs)RJj(qnHP<_QrnReM+D}`VZVC#p zoVKAd1SaH^XC8a0G<<{|5W&{9n`zE(g5}F^)816(O^I1?-&m;rE(l5NIQ9grjZ1o% z!`_MjTQ3)+zF^JqVmB~vMUBJS`?Ccu*5lGQtdLBu33Uf{>B>zBS_bE38t9Yvyb98l zU!7j~NoLvPjw%R*)q4PXjV4}k>q{7jA|oG z;m`Zg8`GhZa;s|m&+=HIeyM@08g$2^i&Nwem|!j;2`=0Y2L6It*?1MVxS* z9*G#ssR8(C>yh(2_UY8SUK2m$l*Q$z-@U>kn%h1X*Jr0z)-S~_?k2{psG!`rGV?gY z7Mm~;3Xo)6?T)Ix%Nqt~^0Qjjkt9}4vwbe=x>x$$e9&Tv>K7|ML>_(0jQmG%O?d1#SWpu-mNH(rnw^K0(x(7%`^`C*$ZIO?pH zd<829%rnK^PJEP>`vrP(h_m97%foZI7vDP?8ELcIG!;LGY)1@9@JuB*Ez*lA&fmWu zQx@HC#{3xT#~ge7Uf2~?CN60>Yt6z!sZh$ z5)0<(>${&6Z=O`&u#lI9^c72!SPeWyXT|2VEERuJEn>|;&cpM%CStX!RVi7Z=lzQKumy}fAD9QSKIVZ8+Tbm)T{j7#=8)7ou9qP zV`uYJ^vAktckYIg@44-~U3!wZ(nYb&w0JF=@G~g#ysZX#bd^9`;w+6OD44 zFN4_wX)oUc$LFO7T&R^SL^!Q^s+x$#;3n#wkgP#&q%9@rI zlhOJMT1quR0lxJfkz05M=O!cT=AWyB4tfmv^#RH=pF*VzJJ%Up%uG)ARbN$KuX6DH zp^u<{VCPr^tuR}t?X6tLiojyB807p9C&CVg6{d@P3rnDB6Q{C9L}ad`SK6eX>iH3i z6m^^xf>U&MT|gjxYxbh3l`M_8UR-HHk?DPNt4jXrT(fTO#nRk-b{ZLZ`V`TaboP&8 zDka&U!OX(xCK*PE>NT@pe(7gEWWsQz-j0P#(9XsjDNUJh3YSwJ5+l&I7fN=lza#@8 zo=y~(-R5J{@ClP0Bf^$-0l|*2V!%cP7>~@ZE=v_{N$2E&+0!%ae7^L7ta($5~QEhu>fJ*eK^~xIg@Px#c~R{2sDz zeZLU`&!2Ots9pMboMy8vpt~&+#%eI*Gds^S7gFjQoZ-_$O&hoa+HfldD1MEGx_2pW zLI3R86=CP*=}B*1XCDw_;s3w;^O;;6^@dY%2UQFuG2nVMk5NK9dg&0b`k?MhJb=Oj61m^ z0yH!(bKmZXZjJ`nEAJm!WPTCc%#kzyO;uld^<>IK;FPbJ@^ z$unPk=AD4^7G(z5rwhsbL(@_XC>?D<=@={Ojoe-(j9VgoJ=b$LR%#$*Rv=wuzutA= zyxFY(3_quey*sq?xRzo|x}@NbR?wl9I!(xjFbF6Eeb3c-h4OFCr0L(Z?f-1KPEg(c zv*oIC2`Z4Y%7&EN!xoeKmn0E5vl6*CMvq_2rEd8aDI$NhTreJzt>9m698eIiwAq0p z;#iepQ^9QB(3y&BhD4&aIF#DP)^^XS%ep6h0?G<`{pSI>fq~>ue2pGhV>^(kmcncI z?Jm`CcO^i1aU4&QNTz3!S5%}%9OjR7^;c)2Qu36LpFgi}FnL#=|5Z7YJl{1TEeEU9 zZqvTm68#2>li+1Fl4%L;?BN_8?gMXUFp>tVj0V|`*hIs265>by+`Z#aX81+}*d6%R>X|;zUfFpVhfr3llU4bB zXQ?R#ha5?gdbK*veDDqPdK-B8GKtnc=Kb%?yU!>qxC|;fje$7i!g%Qa5=uM8-uDn? zCYgGP$~M|MiU9+u&MuusvU9~4rDwR!^|~>@F>s=}2LZDwg_I|=>n;>%q{?W}ah%s* zS@=TH)=l0CI=M`Jf&6`*(yvHgK`GUIDkIpIx#()ARIHe8v2 zNhEX*9c77;u`VNad0sqxj+z~DDMocs}P25veZF2iHzEm#u2-xnw2>?m$bevxM~ z{KNGEz$2MPR2mg|+AMa6chK^*&%L~|I#w`iMT)T(W!D$Q9wG3`E%=rEjRtC3E7(f} ze+tN!F(}$vdWvL8|hMKvS z)7_sFFS~us>1Wc(8e$EKWQuOs7c=H6A(xk(1ZWCBA*j@l9sPNb;Y*;e$AXIvJfKQX zYq=#{pLj==?I{&|pz4&ad(J0E{{2%g9NOb%dtk|#iXTwG0CaN-#EV9!tv8=>SbQ<& zZJEQrUWAZW6VfcN=<2u9g=ERZ<`(bUgVb~@jA zjI6ldZ#lq=Hc`k}e}4Z`6f!0%J3kiky<9Dt4KY9djh4oj>*VLM44&h*-e|1#8+K04 z)mOJ6mb;rv_JG+pm_K@Yy1~&}NvZ2y5gu*PxyFgQHMu1QMRIP9I6DqlvHptqqxY8f zH3C>!ge`_^XdUg8_j>)uWi`+%X%8V)HHKhzk8r})2ltiaX9RiWc9|aEGHaiq#M&bg zlV5;q=fAYjGl8q8ipVqky?96BqE=12BUwGKVpI?Bb@EZ9Oyx4JHDF<3fdxWzuiH!{ z!&`vIrqX%Jrup49;3gz-TmxFF3kmVFvOh>u!KB%2kJl60>9Avh4#t$eXk;3_!$_5T%R_J2U^{a=2`PkJb? zG6rz5lIVy1^`6{+{j{q31_q3s#!2$u!S=Q*?~zD|5l;*xSrO7nTu%Hsxe5jSibjSq z@S)URCzX&RfLSpJC!6qd_`+)9cs=2wV49ynr0resN#a(16gp-!%7l(}#<8{MRw5}h>`)ZbL`+UY&zt>@i zy0jkjsFb)T{=w;lKR*;uAfRy2NE!Y?(*;yv0p=l&kF}b(=nmB+L~X7cSM7aC)cf($ z9eNGm!#cw?SVT066O_#`@uKv6Htzv~5VfOrXFCS3cM#0qG-P&r9pmM?r_AUcX%!=? z@cv!;xW5)dtZe2CzZr8yv8zs7n&`e zGuRgV>^cl1Fg!CmOVFpN_zYI-5{>Lu6m1W@N(^v|d1ql_dULeLW9&7auIzetJxhop zQ8vuPn#hA>F8%w%JL=~bFnLoB8;xdAM?E!ulxkFc)p>29?Wbx{tSGf4nSJG3R{Ps` zS6bxdqO)#WS3S(J>($gu`#3OFPZGzT8wlJZ%9JTUVv56-;BHt9LJqN1JtQ~H{ z(YOOul-ZQ3-j8|rG(Qw&&FrJ9TWmPAempBB_e3pAe-Si?Z%`ceX`!Xj+kK{*IdF>U zXZhvd45m_mNb9UaPMN%MjbH#4x-F=J zESk=`tJh^BSG!v;N!PqgcwJfiT;xzKP9CbBR%a)bRK1rJJgO)2eYG*c`{Pdo0NY=a0-o>yNoD1)=zt59}kE8puE4iZQ zwkHtyDi}!{?#}rdNR}XNuS*k0h##z8RQ_X|8C1S1x&@b2+&yw<<=MlS{32xrEt>X{ zoyp<(mw<_1-Y?$d%wgX(N#Ro1pUbZS&ylRe#81q(nrVYA$|~)Uf0eGA{?ByX#X8a! zmQ1|12;N!}t`NqQs_1Ds0I@znKS?dPsXM`{-_NU@L6T(mhBavFP7LjSU^Kuo< zVngyfcQ;|z4`FO8$(x;8yPd}fA+e80EPxE#M!6WD+ucjRUj0dD&{WfWuZ^#bOToc^ zQoMK7Hr7GMby<`kF2xgj9M1V+&1HFM$O_lqAAGkb*Dr=O%3iI#*09ohb$GM#Tk(gp zUjs5PBW)iy+Jce5(p!PWH}k$1hdd~Yw>WP!y@9z&LL7ANAgIu{+56AU4|wyr3TZmN zVtyc8JL}80O4%6T8kqTW_3@%JO3n9lsz!p}BrVAx5L9kbDM21$6Jx7x%m|BJ=&age z8ooFETC6pFXf@JTDEU15n*&lSkGr*tjEs+B7f}g~Z{M9A+)jGIeu`(vo+TB5yJAXA?vZccMSM!7?@%wz(=7*(^fA?iWnizbldsRPj zy7ScG-G2IadOSW88@#+J{tZE%d!K`=sv$)1sC~gBB@TA(` zZgU?_Q^<)W{S)s;@b4|WH3vw=D@l!c@GN+CxtCubSi9gbo!6*RvRN>=DBcqz_HxNY zGop7(fG+zJ_0u$sOor`>E?S!DKm)iv6Mk&Np8gD+aUc`37cYar(@9s1@EpR=BS#;Q zOYU1|1*gOo?AaU;AXz+pDTyC`;k2NWMA;pyr!jK0g*iK&Q9);~%%q!2#@J}nyNm{$ zVwc~TZ=#-->19^Ub;&F~<(yW$-txJ)!Q^%6NWZ+&!sCmyW+lkU&!$>sJSlmX`}_5} zUDG&*?NBZQzai6TnJlHufeD-SRl>xC#r!yvs8=uZA{f0NTnshO%}OAb9R0z?)e# z+IYof^*s6KE4Ts%=$l08zNpY`sc+l$o z#Br9ym@O6`EgDILT`kaOU)s*1H}xJftc@{rt5WLgc_!OcHAiKo>p=8qFq)vdCd3)X z-q)zB;jtp))ZAEpNT@CT(VoeJFf5)PeHMCJK@OGFs6LR(^ZVDD4PNbyu-bdy(kV+UTjJTwZrr{$ zPe^b7R9%fz@#ID_O0yg5C1&Cl#iF!>c4DA zul^(_VQfBT8xj&CH)yd_H4mM ziAQ4?^I{m8Va$mkBEh1|Ik{ot4iXVsG9R{;cMcDhus?igRLGlOlqhjk z=NSS2pp*Zw^UHtOzaCrGLraW%pazQO=F&J((ImkJ9R07ErKOs}?hCy@mLB?O5>Isv zVlgW{1x6l;^Z!wPAi2Z*PjxDiQtCg337`2lgJ zVPCHxeTI>?2Y@`5?P;r~8Iq&8_lEs+dhh9p03 z&AOJRm=DZmohW2avxM8o`U&L3acWrqNf|zGdm{q`AQay<+P{YkYF4`eDro;P(Azi`1AEr!&|BM9l8D_wtyyX)^bRCEsV^^2 zeWu|$ptOI+i~w?K`dp0(g!FTT61Zv`&IeikV?QLKPGH2U_^L;v@^<#AMta+;3x+*^b!<<$lwZ2#+6j8e~yjUf;_2Q4AD)yFhBG;J@d8#ib zH3vVQimekXim$72Qn;HmsQ>+#tWtTT1((Y4W_7YV{EYcJ`Z0ITX=F?_X&!-u(4Ra> z>XSN}d<;W44~LtN%594pYxS6n#d`!xee7SPdY=~z8`aO@C4`*j$}STO+POqs3QXti zhStszNVJPz4>a1xUQ+e`10xr`RTzsOyk3m1b>wSx9mfJLlaA*&R^QJ^UMRs40U2_R zAn>&5h;Oy1tfCfuF%Hr@n&XeX=+?l@S089Oa8_E+NLr5_tJh4NE39I}Spx#|19bad zd#iHP`!NeYn@q90Gj5C4d?;SC3zC98M8cVUno;pvip*j%6XicDP>lxF2UJNH55=diHAHiHv{NroI?i zV@>)OnczbK!7Vv-*zl#Mg_yt-SOgS*Zk(> zhDtqq)YjrwxkNV;1>T0^SK1zP-7PnyAD&o@#ZQvbWvhVa8M4dV9Z$g7UJ{WqYXac!+oa!xRBw5z4+N6#J z8=>y+B`r*SmJ+VQaBY70N4cN2h1wIbV2*Lrco)mtQcsVY$n(T2mKJFFEZPZx{AZ1W%U-2V-|+KUGh`@pYss%L zpRR*>7zZvOz~oo&c-tS6(s=e}(ur;cKKwv(KijT;_-g%&_w&V~IB+`T?bjNp%Fz~-++}yw=Y}&83y-_+3F?CS7Z=D z0_A=J@B~^7HPUW~4NtDjkE5*WWlJ^sCX(n~`y1!D*#CPmY2`nONuot8O4W8$*;&HL zwc|HP^AL+&i~*t3DRx-L9kYZ`tKVD4SmM6~Ecq@@OLY4zq692{cWLgY28lu+zPqhB zQh|G5WF0jt4=y9lJ1xod0$)Lc25Uw4?A+>=XF9w30m#t>MYBvQ=JeW-1cHZ$aWL0! zbUzoL{477_a_nfn!NPIFWl$0SE=xpx?^Ual=2-6T{WGDzr-fY}Qh(3p7>fB>6u+M@Kn~$&B3|L)cVlG#?@~m5 zU+_DK=~!iZOOXJ^XPV8#! z)z5qXaAoQ|sfQb%35h;uZyX;x_rEaNaHQ~ z>v}flvsT2dRZZ(d@><0dxX=79h%^?!(n{YJ=sZkCM;q6&f0vh)bW6%&!z*ws1&% zSd$sR)yikkKOeYyiAk|)C%@&zIhRCqTj5+QyTMxDP7|{wWDM zd-SMjq34hKCReJ0FVWCgAMEe#dxS9!Y>S5*jfh{lI`5~j=rd!HDs$QT5=PSvWIIS( zlD({gK5}3Tv#9c2hU3LWR0A&d#l&o-!M(LEI*geZ-^H8NZs2i6I`sENeAglUfwn&r zBZUfYoaZdvBWJw);o;hy*Y8ma5a!DMbn>$dR~#7b#8h*;=A-z-j4fsw!%Ys8%8pRc zICZC>AK&ghxv>>Pqg>FtOU*upv(uEf&}c9t=#|%1-a{KF)ROLw-O7nv=W$cqR=zmb z_W7-x1qDki%rnFFooZTg>+&YDD_&6pz$H@@vHq?(e1Z`{QN3c{46I+a$+oQzaWdF9 zK)Z_DBUa;BOCP@35J>6WQBV4i@OT=%A)NN;qiKyI^3ad|-h(_oiV58*3&CO9gvo5B zFyaO9gaRM_|APV^HoE@@1^lZ~z)n3qZAn+xGI1D)Wi<5LTZ3tT14_r z74Je}*O^NbDI}dQay6@g?7zP;3FO?6D}ule`R#8~ROe;BTwenX_VPz*l&d3)xXd~q z(_((kxTMhCi~>L9B2VnTSrH;~k(i`@+ImY_ln>h&on^JBj-Fnm&Cmd(pW;!U;G*N1 zwop&R{g&IfXV-BKI-Z`MBAFKT{FF6%Bnw4NOg-XoG)TL;TP za>pg%(z)0C+~VuFr`|jjE&JkcXJ34==qgT%S~Qi=lX1&Df3N~wauv5c(Kc*ALQ=(g zs1r4-hX?XUd%nzpo9F1ULU3pu_EOtAZL(tPdy!(#xENp&_OCa|-~3{Zzvm8u z!4N_79M2YrROAnzUBVAjvzp0NTX_SAwy7&Lq6c3+zafL1?<3=dWm{2-A0zX?3iiw8 z&*o}hwjrwhF6UPgwk$CJh3e%Zdh}37fJG(^SUFsg1`hffiPq9e3fZXII#jpM_ZE$I zf25|piG3VoA(_q)cF<9_7H$-*bHkKyckS!^ zsuWSsC$s~NSe|gVK0s8~@@J>x{TgdA~)G_yO|VBL%zD2J#ceWTDibT^%ewAP5ZXFbY#hjGgfAp z$7;?rYOL#QOcEjZlU}sSenMLn_N9Vo2ObE=7-`>V$>Y<@f@nkMrO3yq9lr4Pcg}BX^)LD@rPi2d7}>^< zNkNIa$ld4KiWDD0+`!_HCN)(^5;tr)aw;9noC=wdBKO=`EYKDU@nwWtNyTh!4s z?X9eMoR;-yQxR8qqNdHKG)W4v4*=S$*M#cEUKRpFHR!2`H2G8gd_KQ9o1)n?2YtKK z%V%9aMFrv2f250l03L+r+AH!LIfj+y4>*;~yv;$Py3}# zaVOg0S+_YyR@>|$-L25rEjz3qT1gLQ+pi4KeDWko97wz4O=0dp+Wq4qFX_GCooyZz zxb9A@T<+dBAJl@6n6U)9DkCbKfyD@WUBTmY0&wr5-?kkTIQ8JyEA_?+@w# zP-xCIV&-h;ptN_wDnqTG(0PyS55RH&M~7I$%wo#A%D@uL*bDYMZ<4Tuy=8+I6Pd87 zQ}%-&uD;>uvVcHnX0uZFv~8VIL-;B8c?pI*KPU*u%-d&f>j`EdA7!!R$8547W%POZ zM34fdoj7Za{&WK~X5vaP^($<*nGM$@Q=Q2dE5LTW{L%piyk^^FD3?7Cu6kYGosk%7 zpK)O42>{=C}S{RjpM$CsYQ4pe!1wR)Ol03QpeyPd->^mhAW89U` zNOT_6!S+Bfz}195)BUUbfop-d%eqKcu_=_XCrcy4g>b<*oFp;DWwu`lzKVFFQ6Vh|V0!)yNf!5hw_~Z+($tMz;OP8i&ZEx?AJ`Z&Q zvGaWV{4>*CDf_}+U`h&p2d!aXSdpKx1#3!o)iIxyBl8fcFjsV#4sa#SCrjkz( z!2a?>v8ljqVLkV)$o?_WUVk`dd6xj5{5o~9vGjd?eS{YjOdwl3VAqqbBVk}`Wvb@8 zhk41KHIZB}#K$Gqi7ySxLr@M1OfjJzF+lr19)oQEO}K(9rIe1bgE3 z;d1JbQXVX^+>u05(%qSEC-ew8PnLGX3Cq2sx;$9&1oK*yW4--bNsrC(!RK>nz(2Bq z{1pb}bF>WSlNJVRR^p`AW;WZC5th*4Ho3|M3^w>YQnRM`%Lju?@z+Rn;77;&X`m;` z_v&AIQPx6>F%x#i9=d3f_|1`|R&;+GmmVUWy~K4izDXTQd|De1gTPLh1V2IGVigrn zm&PnQMKV<*i|``VFu$6Z9Y;OlSJ{oplnKad0@Q*}^r-ut<6M1AYDK*J4^EZRVY>UQ z5@0)R6WPmwBMX#`e$^PRnY+LVFfow5^;PM!-=S@%1bb9s5uG9xlxJUl8Mm#e++uxz zu~MB4UJ1~76Lm5U+zT0n*Ltl42wZ+eHb`xc6<~1B9lI5f0PTx^ZZ_OTnbr!n)E}ak zG0j21;bPUBsRrCQ+6!`()0SSAdmPv+&XGyq#Ao}~gk6V}lFipS)gH!%Qffo3=##Q> z?|esF`wjQjqxK4L;pHQJOOh8gmwp=fnr=G!emNk}UU&FLoGBCe$W@`!E+k%HklvCPb33P*8}?utW{ki6JszHDHos$kVcq*vr2+t*F?K@H#pmZ zr#YfSpf*ggsoa+v7)ZitwemFyLk>A^TLl48BK2O(6tmw%1&eh}r}AAC0%qfOE#wpJ zbX?+o!dQ%@3XQiU8)VAtEoM+u1=r@+$Vpp3_>t?jcn9!lA(UsWTEoRPDq{0;r z_N@|S*jax}iF_nJ)3HgZE-a@(1-5(+LL>IwXR z9|k_`{Zt8rflI4)9Nwl*dr@3mx9Y0SY&!OjIp9kh3O0%8V-SY*_%p1%5UC8kyDi5Q z>cG-%0SKAag+aN8%U+^#ze@@V@580t(#A=n;L1Zf({s-cd3{ZwvA3K;t`v&5 znKoTX4})#xd+khJY7fcpao;^|o#P(2Us-9};g~1c>G=EU^@YAA|MRiSdEUI8;?XFf z@q##?kglC>=dZ`9L{{&-K)%}%6$Sxwu>F;USqkw@$-CkzszOBgqAV->Cr=7;@mm&E zRCluFmtyrr%Exxa{JJq9d^1xwOR#Ib`8p12TqjXfNx+>hA?diHbz&Cmd`cB)?Ro!7 zKgfbeSCZz=!=ASvlLzI4zGtd1g_ap-*(#ZggLKD6?bqG*rjcZs!&SUZuph>9SAtr4Q{LRRA>f)A>{`K-Cr%Z$~*C5}ZkAt_Cw%10MDi0hhN_Ffh?n`1+ zd049LBX3j?^x{S~(8@uF^78>TSMMJI3Vh6NV zOXAg&+Fgq8=9|w!>~SicpEh^7Y*x!D*CAtj<<}~Yuf29-x(OeU zbh%4-{2te4nTDiZ7F7VXtiPw;gOUv%DkPMv+2Tc|E3@@zsfjTS?WXqx*J8VfoAFty z{!8v3@1qz_30>b6EjjdAQXN7J%GPgamAHb+yWp2AK-%eA*r-x;T3nzxjxkEx=W{T`a>?ewB5)l1;F{B>XA zm-d#rROA*kVpvbi&t?E9zV7Gx(xYY3f{+slvd;AVcY3m?r@qfWX}nQVHiLe2H}|Pg zVD}UEq2@}8geiIG+v77t2_CnD`Ak8vi>W^rvo*ZV?3A9VD^+T|*w;%?t!IRd&TZyz z^mTIoM%{lo`E$=L)YPc#8rwT%-~AW}iJ9f-a3t^QS2*u{vFGB}e?l^;%2n10uVphi zjm88;ejC{cJ$n8icHKOZFr>~~ACe}2c3IE! zDS!Qq5vbI-21?r zFXcFwD8gUz<9VjI+2tCW3nC(*?aX@7`ZhM+dlIuUWBG3@=~{n*k}eSvCCi$n54Vbh z{xaWZ&BL>FBXQXHfoUf+AZlNR-yf)orURSS(@rrBK0``_h1&gww&U{;U^&NGvT`O_ zv3#~aLye~_u`|hY}mVadxZ+9$M2{Y`a<9ly@YLM?Q zmDESV{>}L4+M`~VjU`$olreIs(^u$a4+q~tK=39%LljmP_ji&yUF$zc>i#47AEK1E zp}u+)r?l9!Il~+fyy=kB=V5?7=_lCV;jfdK>_p0i~f?1ili$>4_bC1F+{+DSfcvaIZ z+y2WBpW?mgb9UrLezWU&Iap$bxm0}q{kwG+4U5s?k^W0VK<1iTzgAb&C8#A4Lb^TF+S2 z_6!L5tOuBIar}Q9$h@(M()kEGLR1K_uDzK_l;ZJ{mf@9W==gjz7G6B%RMV zOQ3&tey(V~(o8avtyUqiOu*W;$z&)Y;N>xYI^Ib-i-_TH|7F*C&V%gvS+f^qjg7L5 z0QUBigDfVmha$m_bxPcb_uRxEJtqmta=`ynf-e`S~?mbu3 z#B0`k&QA;+!2IU{%fLymOD(#p+9(lwVhql0oDcl;6@mbeGwy7?MI6f$5f_nszUuzz zpnELzwxA#D9ffD(C%OA$%ffcr;zwxOk;N*0h7KN2p%qBn0JdSte1E%IJ)IFJ=L0!- z@Li0~+uP|rTIKwlZHT*%1M254kG<{G<&F&yc#c+%U8Lfc4z<_`#?v|2p~t@?TLu{G z(wkl7!bV0H%(14a`3^gegzVQjA?W*q$&&mCOQ~jf)cf~0(Lf3!qC3CP0oXOJZ$Rco zJt5vESm;T*4=qA-SzVHe%?=Q>aUBuu2s_?c^VzUMIvqJ_ab@@E@&c+TserzkEe-sKTq>o|Z~{|lTvVWbrPccrc)Qodu1Ndg znRIZ{wMQm#Hl@y8OU?&0w_#Q<=z0vjJ2+VA!mGO(4V_EfO%Z{(>p zzF>?PZL1wg0In9E=7)bQKTYi^bc@l}YIlBdHw zl#1e)H_YqPrK_#e!qq!WPAZ5(;GPgln?V=(!5rqF!B$IRytkCxVu5+6sZDD597b2c zj~aV}xVa`Wb_*!7#C5|!JS3LTs4KL={8s1^%Cw!HNBNoZs^}XV^%#3xCVhEbU|E#DCc|3+n)f}jxD;F6>P9dG z2MrcvX6UNAEEa5u&z{2J2$IPQ^i;aZ8_(s|G`1ZjvC}+f_6yS6$QCX~O-Gd+B;`B2pf;{`Pq#X0$ zO4?u$otWAiNQd%{sGx4xwoe<|fn<8d8qd(C5uNz_nvJ|o^R}%Fv|^N#J8?=CTl~i_ zyIx+96n+nf+e~%D5qGO0F1D9kGi$Spn-&45$NZl_X6)x>o9RX?C#{tD|mXH|{WQ_Vvn`xl|B?J+zvgC!ZvjzGY= zKM3wj#(&(II>inrI?KTOdno@A<+9NkDG(KU`0Iao>+}DtKzjJjz}xuWTCo04mjsDR z>i?>?3kIvYv?jP3&l0c!r2xca68Fy0-!*v-z&95(-=%#L3Asw(cA;lra0TgF2aG6C zq#ZDdJ{$Y0eBSYIxeg?ZmOJb7`hTYA9J3{P*Tne~?5)pHLhxII=pdqP0}?^ha{sVx zWM*akSzYipC%FHuy3pVcF3o+P2O@Ovj(Jty;<&F&dG__UpVNXEA3;zT{i-f;5p$u*>_aU zMzJGw-VV4O9C0xr2G~D{S2r-kEAeyCl_?^{e786C>@1ZNx?fTf%_(kkF-r-IiwWDH+OgwBEFMhk}LZbigc*1tup{?Pr;*{L*0 zjVvO$3?B2qDX#=_O{+J$$oDIwt>(;yk%l@!@gozg&h37U%*H7kYnLE5z5%g%^;O;e zY~8w_wvNv1Dq+sw{NKu0ogSkvoqR^=Asxu^n?$pbV|+A+V>jCxaRN7kwrul=*^3bQPg(qBBWqdnwFs&M*8wMgtY=eM0wJ|2w-D z_vyBpaf>sXiKntXJo0Pr`Bcq|e3c=0%?tl&r;?}e?*yPTpD(C#teq(yj%eH6omf(= zXprZkRk9oKN!M~gt+J$Plk4WolyzrU;=PvMRws(w9YUr#^`$z0D|=wQr#RKQTp2U% zDZQwczQwvVwC7yn)S7Dd5ah($Sxzl~#q!m=A>)l<)*GVey`ou#7R572j0@F^QLl>$ z=G~T8@CBRCE+$WWMvs(SU9nfzYPGz~%>u15EL`Nfvr5!oq9rO$B%fd@XX)PF?`Fx zx@_KIWSbSIM?MU)Qg1Ys?%j;G!wP+OleD(>u|Av!C&v(Y<1vHVDI9SzwC+xbQeMsVa{*S1l<=}0qdzq5TJ7_CIb zdxG=PJvpsAi2Oqu`QrPM`=4yk+))->8~y)RdFLI~)S9kwjumMhj$)x&K}tZnf`EW@ zq)I5EO0NN_(jp>KEvWP+(yP=^Ll>mi07)P;0Wm;`Kmr7kyYZYkb7qz^>)yHl-TU{q zlC`q4_qX5o{hsIdY>KW6Sn6jcS_B`mOhG49N7Q7)(@aEUb~J*0md~YzuQu*)f5=IV z-No@ZkB;4(eJG#)wc%l+6h!IU*9wKCs_js zsZV&TWE8lq^BnoNQ`)rSsdNU!k~+SN*AA06p{TKUz8QcJ2wh@o03*){uc5GAadJjQvZ%d{dPC2nf}5* z-V0c{mh<;PY8n0dx-8J;!j1KAz7m=DuR?kI{Y02od7FIUY@Syz#*l}vz%IkN+_2cv zQH?nHC)~3^<+aeK54r4^KTQ5!&&S@?A}G>lOFEfw%-+~fCN1uT9_7W@2DpW>`lpbP zcf6aVoAI6akmGp|r7T-h%#bE=k6?B-sCXksTcuSjInwG6P2gwU{K)w=Zse?ZhF;@;a>}- z-%Tk)Mg^|rQHQ?t6{!|XPuB5I_iX{#vDr?&>nC?}AGmq6rV30+h;bhKj@tcnG^FI_ zo}+6mG%I)V_O&>Oov$0v1YIhLw#BT=E;;u+q#?s;P|w9D*@nt%W~Y zGelCG4AvX$-qhm-FkMFN{wPf=3i&!QQ zC_KC)L&ef&v`>9A=XuUFvtimTO+EEs+NDq8kGTFVr*Wi&jaTKAVA0y7FbmVmK&LKv z!*?Avc);M?zY$oA#J?tj@gM7T^YDxa4K+1vSWq^J{Dea9qJMS#RwKz zWQj|x+kd%^HgELc+DQBU;*I6cFPo3Od!Pi6X~4eXs-d< z3$j-+;L@v_GIbhC-|Ql8eZrhOsYf+b1g#{*BdZYrMteI~B7fS~7HmaDMO6Wb2!}9S z=YtH@k9aPo*TiO|g38H1^9-w*n2!7#k@pHsD;HE`CSZAOlArNnx-1#w+%E1nq{cBB zOM4C-JXq_|kpAEI`CrPpClWOHvYRf?(1~)Ah2Sc|SN#IsJyPig^Rx!cUO|9Whj@Nk zdlY+Hv2?oBPdje>m%DLMe4%gT*?^$B0V5*dw@c^Rp&Kt5|Dt*#UHl!F9L4k#hPQWp zs#uuf{y1`GHrSmByStlq_gefX4c?OJ(ytYVzJGT3d!w1^=UdbEisZqf10xm#0G^`=S&{03)FMcCFS^s6JdtPdmeVh<)7 zHA!;D-|XuM*f9z8ckQ2w%{1%*^$Z#jP$OvGn7=OLpC8~`fflJRxJP=mlB1Z?Hlhp7 zFCP=fFt z_JIsP=ri{$(rG-vshYbctDMT@X^hucH@f7y`+bp*mzN+q)%Kh2VY?(jUvVg3Q+&=q zSe9Hy8d_{q8Npz1?(fQ)eOv)kn)V?nY-e02FxJb_IQSrL%^5_wT z`@!_!79jEh(qj|t0SEn9(MS@w`6$XM38E<_usKf!GU zoGX70*ZY%YK&2Abg_H~V29NH%I%)s<#L3ajRtJ1`M+fXoTSiA@mB=xF&B^<;k+K_? zG&%_Va>E@p!eSm4F_FqaUZ2YLW<#$%vr+h6{a$p7(>7dh`#m9-58{5>EK) z=M;)2x3rrmY5rqGLUaA_KLVySr;Y)laT*$(BSkOUSS*pcH1DnOSVTE6vUH&WK5Aj> z&X}(&E0H-G33g=DM$tUjXA(_fl-)qR;7r5!2f%mSj0%|qFc#${a&iJ1RJdOtVRDdT zl42zActs~zEXj0#`4MnB<44(DwzjmqlpegdGFj_keTOvVi3+Bh0`B>D)9pxHL#Xsa zTsU(7YoLm3pfu&t#)IGoxlWDE+iQNX>>3K??!GN<{ni^UEywFy-o<$4_o~3p*ngT+ zW}_=$97rMV5JUFUi@Gus(BzHz*8Mgc_l+>4?~`yePkKrNw>g%oUYwM|W$`TYz`SB7 zEHP$yN(YMA1{a$(NC0t5)8M*z;%J=;SCE(l6q}l{I3mrGvF;}gcLTXdGj;gxB8xPx z$Inpj3Vi$$j+{;?5y}b==cSoq&Ir!nlE}VUjB4^%og~VLDU^=Ax;*jC>Y;zX(6w8~ zxMhHAzd=8K(b@d=uVmr`oP#ZkXZ#b+u^EnNtQT!wc5=UAZrXT*GYYibWP=&V57eQB z=Vtrspt1O)1TBk>@(TV9_4wz}Sbto}@bq+AMnQ%KM6n+3F#G}TY3jr=jF=CprBVVR z)i;*D7}loN&kuC^zJ>>|MOxjTcr(6>9%nccQqukZ*l(lECl5{Tk=puy;E0bL{rn;GC^ubVQRwA5j?bp zDHri6aXKAFBqCS|%X`}s6BFsutERT$^9T^BBWmWAdB_BIK#?$CNP4KW*5yIOrd;K8 zdIl*l!-yxfHbgrV~{oH%^R!x?_89L$1 z1wYtZ6Q_92FV#pQ_jLT0M9X<4UflNb4LsmPwx%(s;12Fk8w$5`OsJfd-#Ue56X=D# zGDFYiGcqDaWE`6$xI^BO=R59i^A*}|UVRB0x$w=8uP|@*+XU%=7 zQM@S>3u!);%16B%kDBZeDAH3o2=`p-BHGP;ll=}HqQJ3}mB5AiG zF54vmQx=lYdf~LBoU?V&k>c@zW?xB+_`#RhMl;@uTCJ2{>NOv-8#O9YJ2SAIzqRt?pxNy+X^0jKo`PP2zYIAAd`}>Xu zYy@*F^Xl}brX_YedPWq~^s$R13L!n8qMcJWvwHTuXGn_7^K(Tx(x#|bu- zd?l1Vf+OCyoX^d4a}*R<$g*cUW6+dQu$_Y%ESF8t&=~T$&DcpWD{;z$yB9dCiDoBn zVjc@0tgh@+yHFkzh?2{>HPd1?-n(tM`8_4!X6G`Ncj5*M8^aOnGvaQVAtsma@+WSl zyu3wn6{p{AB7eKr!MJ&awTpToW+0_gI=+H`-G!mMvFSHYJBCiwmJd?VHEZ`sd%P%xULTVXH^i`Hkr zH0>^>?7K`OIV-LM@9HNSxuR}O*Joq~WsGgrhhM}!bP(@glL^CfL@CP(uaDn++dN}kI7k4) zX0XD1W1YZu;CAO1lX`oHMYaSzGP~R=PffjD^6CwjAFt`8d#{Mu_I`jll0W{Gx!?6OyW^QS z1vt6zl~@KzYsT+LJw47>gAV1NwdbD2CEb;;!-n%rN)#iRB|+D={OTZ~>3Q~O-pQ;5$@YUM>=iV3(NWPfVg?V*C%SLx9>@+1Xtv+eSB>ZD zYRuOZ^J5)I(qBV5&tyckUaU-JNjty3mpGiC$}i zMql@MGl&w@TW|CjyKid^DU;|I8iyqI$z61)#aCMe4H)DW@ zBoYTyCPz;)bpVIQo1)vEj?StRBQl>nHDw)Z?aI~p80B0>Q_01-_0mikt5J`a7wxw< zie24mbh8UKH%jHK^ST`}(k$y00_bG9OC??^U8q>T zMJGP`57N(#y}gX$jDo3ezJ3NXmDDVLEyj-DM7LGK-41HUH+F>)!PnpRKbGhz%yRU2 zUMwO2BaWA}_Xmv2s$j-l3`Rv_ur*_F+s%_Hcmx@fv{QCXYV?jrPW36(Idq`` z_0Dw#xQz)6MjhOhbx-p0ej%GpL$hP6nu*3D0xFTpuzf;TEkKv6v;;ApH|PeZ|5GJ< z%+>w);ax4rCC}C}CXw`1Lh(oP=+9e^T%hRAT@0Yn6o0!0Z9HsB5=Vl!aVu>SPk3+q zQFZ^Vo(9(Z59{Q=*4l>^IStLbyZ@pT|39;wI6ebJr8k{6%GHuH6^Wkr3#i${|oW`tpWf5 literal 0 HcmV?d00001 From 2854c31f490d6b9a4ce88579bb07ef21e0c7cc1a Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Tue, 27 Oct 2020 09:20:07 +0200 Subject: [PATCH 009/825] add info about setting for Edge > 77 https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8409 --- ...rosoft-defender-smartscreen-available-settings.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md index 263e076dda..e0ab6e4909 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md @@ -45,17 +45,17 @@ SmartScreen uses registry-based Administrative Template policy settings. For mor This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.

This setting does not protect against malicious content from USB devices, network shares or other non-internet sources.

Important: Using a trustworthy browser helps ensure that these protections work as expected.

-Windows 10, version 2004:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen

Windows 10, version 1703:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen

Windows 10, Version 1607 and earlier:
Administrative Templates\Windows Components\Microsoft Edge\Configure Windows SmartScreen +Windows 10, version 2004:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)

Windows 10, version 1703:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)

Windows 10, Version 1607 and earlier:
Administrative Templates\Windows Components\Microsoft Edge\Configure Windows SmartScreen Microsoft Edge on Windows 10 or later This policy setting turns on Microsoft Defender SmartScreen.

If you enable this setting, it turns on Microsoft Defender SmartScreen and your employees are unable to turn it off.

If you disable this setting, it turns off Microsoft Defender SmartScreen and your employees are unable to turn it on.

If you don't configure this setting, your employees can decide whether to use Microsoft Defender SmartScreen. -Windows 10, version 2004:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files

Windows 10, version 1703:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files

Windows 10, Version 1511 and 1607:
Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for files +Windows 10, version 2004:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads (Microsoft Edge version 77 or later)

Windows 10, version 1703:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads (Microsoft Edge version 77 or later)

Windows 10, Version 1511 and 1607:
Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for files Microsoft Edge on Windows 10, version 1511 or later This policy setting stops employees from bypassing the Microsoft Defender SmartScreen warnings about potentially malicious files.

If you enable this setting, it stops employees from bypassing the warning, stopping the file download.

If you disable or don't configure this setting, your employees can bypass the warnings and continue to download potentially malicious files. -Windows 10, version 2004:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites

Windows 10, version 1703:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites

Windows 10, Version 1511 and 1607:
Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for sites +Windows 10, version 2004:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing Microsoft Defender SmartScreen prompts for sites (Microsoft Edge version 77 or later)

Windows 10, version 1703:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing Microsoft Defender SmartScreen prompts for sites (Microsoft Edge version 77 or later)

Windows 10, Version 1511 and 1607:
Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows SmartScreen prompts for sites Microsoft Edge on Windows 10, version 1511 or later This policy setting stops employees from bypassing the Microsoft Defender SmartScreen warnings about potentially malicious sites.

If you enable this setting, it stops employees from bypassing the warning, stopping them from going to the site.

If you disable or don't configure this setting, your employees can bypass the warnings and continue to visit a potentially malicious site. @@ -169,15 +169,15 @@ To better help you protect your organization, we recommend turning on and using Recommendation -Administrative Templates\Windows Components\Microsoft Edge\Configure Windows Defender SmartScreen +Administrative Templates\Windows Components\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later) Enable. Turns on Microsoft Defender SmartScreen. -Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites +Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing Windows Defender SmartScreen prompts for sites (Microsoft Edge version 77 or later) Enable. Stops employees from ignoring warning messages and continuing to a potentially malicious website. -Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files +Administrative Templates\Windows Components\Microsoft Edge\Prevent bypassing Windows Defender SmartScreen prompts for files (Microsoft Edge version 45 and earlier)

d^+$+@B z2)uz-?F5v{f=|00)Ds+kK9n9iv7N)Rr~%nO(pDcgy3A)utupRzUW$_{6r zr=tCtv$qg%(TVnwCk@)Qq$De!xch;#b1zXLYQ zg5rK~)5Xmx@Gwr1@;N^)*VByKb2%73%Bf0G(Wh9oJfP&a|A!jFeoS7zzEH%Kd_r=& zjx*fQC3qp)O6$Cti1ydq^@Bx_p!Hf@j6;q0@17$&0WOStPt0p%b+Cg}mtFMF-j5a9 zV$|uRzq`p8YZILI7d>Nln8aAc!s4bpFP{qEc-ffmJgy5mF!$MRx#bKO4`-|1ad^kx zokRq)j68NPV*_Ij?WY3-c3Dwe5Pa6(`FXk71@Tb0C!EWA4?&B-?b!6Q0+`kuu|YY{ z4+0LorfyGXi-8{9vQxF1l=AXn`CJIxd8wA-xizfDT0hEJL~h)}OS~En`-LVhGck)K zztg1$@qvfj%)#L7MvYqM!8(c6e&QyV|`)H zZKN0TBVm8h3%;tXQ2zcfrJyA651)Q4t6&b}M}!E-)5LoN3sA_MsN^d&#rXEmmc$H% zb0q|6BF43Oj>AZmKI&k_G0IkpOeK=n%48b#CYMKG3{M#i4M)r>tkjm87Q0ZE@?k7w z)bw2#-<&#)(X#n)P&%8PZww{@Q`!LLBP2viqgRd58Ix8hLjJS$b>Vw6v*f)-?Zf8s3?Q&eFJS?lBI*d{xvr@Pu5EK%W`)u_RlF(7@4uv>Y9r`z? z(C3DKQPo?r{GzG8jNu*I^O`6lqprhVu$!KopA@kK{)4_xGM0RUV&5vc56+!EXXl$T zJ-AiUHU!YUUK(*-ihM)^iK(Ykv=9g9apn5PTJO619@z-4eYaF-KscnrBl{X^hm0mK zlB!FG%>69H!A@EkYPQCauvznFCIkIsv;b3bdezOv@nJP)+kgZ6TBTd?K7iyyu+9UU zDewHHX@quj>9AoP!s!A!;c9siyA%DYy=7q*J!UtXB!fChd$OCWLoxcB7ObJ*aC#%` zp8fcKekp_XR@Wf=2Pz5*%Ja*v#Y80`=iest@wA5D-}|1xYoV77>*_|~qoO|JVFT$^ zM=Kqnn{|C9&mQ-P&&CodmG`~HovqjiS!|x`{cxR0@Ya$aX^zZx(?ahugr*Zl3^3pH zU<1HyMOh46F~5m}JC-ef;+rtxrt^xJ(Sd1cHV)P)HYe!A^A#joYZ(7y!FQ+OO}G{1 z_0M#h-6xz5`=jkFoYacv!%G5x+`0M}*X1W|SIQu8hCNbn_sFcDj-YEChXJfD0q8ob zfzM$W;f8FO?$v#hGB-WC0~!^EspmVf)Cl6XD1=p~oj}!cJ^oEPLn3cKLW6gwI$}nN zo?$Mz?{H{RQ1*W^dQvmOSHeb$dIm3+(-AZyJM~1~d(d(dv3@P~_n-UYm-E6jTli~Z zi+s*Ktf0TJmdypLM{x#tgG)=dw6M~y#9{3)oJUGDk<4rXrl&U+PsZF`=`g(q$*6__ z_Qw+`^VU-redXOe*qv8eg%V1PMh)d>$8_MgdEZIt!~ zY07R{K79_(*bmx2$f0fMOy!!d<^PbQTEh4-M;6yK)~O{`1`Q}b$~!p7+Bp9 z7lNiVWxI`rw5aVu7&V|No5~$4TU&)BR?IQgfwTD7wgNd+sSmV_Vn#R-h8UGSvSsx9 zg(&)a_p6ZAte10Bgx_lVilb+oy!mn2+{r&rM+#a<`gqnN(eA=T9l!-4WKI};ZyY9H zha;df6!SH}*zhtcbDN{%k`wb>tsf2c2zCmJ_EQqp%6+}~DkThCVT$eEU!QWjyDD5D4{%b}`9hII$h%tcuiM=x;5WE36>8sj zL^fQ$QHEnNL4c4hPz=px%vCQgEesiz=r}0M6b99cT$#UgY6q&&PMreHRz$+EEW$XNu~;2XavSJ6|o|Tsu&??Z3Maw!1nQgqs`EDH#?H- z$(u(pJvMf>RG##IS6J+d;k=B9X0~NY6yFC8EiElM%^}PHeP~I`PjRJNu=iWNk_0CE zvhz8ytdhKfk_Z{eke2UVF#@%9adR+Qi-dVV)p-pC6&)=Fazq}w%r*}4va8bNhgUuS zw}Q=#Ama1--MC7e;$!i`q_WeNB9p~MW>%e_qXQ#%sS=U+!iad`NF9aU&{L;->E(OmIL;i zeF;;1Bj1Wrbho&OYIT1cxR6vqo%vE37^59}84W9-JpreL|H*Nn-l;76{d^mfF!Z~q z0-ScPrB`4e(06!}b*Yv=MnDQv@&NQ_Nf;L;G+N#DoJ)W-5}#vtggpnXTXgYPN|849 z=4>RLOU_!g^z4yNuXX&loQs3=?BU=9=4*oZEwTyJnwjI5D`_U9?qeQb?AUQ5kd>SE z*gBnei@E8WzxiIqzcMzaW&~A^6pU6~Og49dDKpIJqaf!&IJ<&9Ll7;V-b6Q9V&E{V zCJIasVSj{%H1=qG3-)c(_CF=>q~-yye1O?7hfB1dtY(`E?%1&!9mxTZ0$FYR#Y$X- zcY+z}pl>hO=j`5wE_)=|?w>_;K$o|%DvZwf8=YL7sL)IV#7TZ+Z;!q^z@Nj#dU{RF1Hnz3;Ah|E3Th+$Y+BZv{ zVh*(46WjmI#^_(gG2-==%2C1GS!KoUEZXepa#Rc^MkLWtke?j!d#lH< zN~-=L=;7+6g1vBm$Xw5x!@V;30v@E=ri#?G!?ZW>-XMpW5}q$BstI;Gk00E*C*qboikgf2@gm7U%dTebfjU! zwhIOwyJOqxj&0kvZQHhO8y(xWZFFp7s-NebnQvxmt^H&FOjRXWb>qT`<1V{-#jefn zLgSpZJ@pW!Z`~(HR#h}sC>BX!X}(OQ54&^fuc7b1ilVJnI)uZWsx zH^%3Y=vL;Dku((yDN61_I2fHg3T4|mj907x5mD!U(()kEdnjYMd}Eu9o$U9>Wi1Khk&NbPZL#K57L=4d z$(2m#B^I37 za=?t{?G4L(!g)0U%r!V|Hu)+IoK|ALQDXq1B>l&D;6>-X*lM|G8p8J` zcl(g%i=Az4eq(cXyC(%ADLrH z?A`OzJ@(m^4|gg|W$zZ!MQ4Rb6P%>aMc6apmVVgh)p^_Ow0pxwVYcW+G>(~I4uB-l zgMl3wB}In1wdQaLJXy6CzarN{ORm$+)>Q3LrZ(2E>DXd;Epe9J z%Z~2N*^B!MwNrtS$>znbT z;IH^nor!Mx7kSTiL7K-=XBMt@2MRQE_Zlq8Xf}QhUruEb?>+fjS6al2Ai&)? zIRlK{g0iX_dG~?#XN9Zc=*u_u&_^o+T$lA$@x-w5y%?1#R_c z=J@Hn{;WUm&-D1-3jFa<>|BcaeVA%I)T#O}R~TK%=zlJ0#7*%*-{&I9)}0Y=e&6Px zpJCgda>2d3ObDroKJ0Ub69g==_-f1hqR8W$ieK3KLI998f3uP!G*c8z5amVl$@q+sfkAt@v)Q>7bqEM0FeKv{-QJck$ zQtt~IO;S@u0i)TrH(FjiX9>^7(JqB^AZpMc#<$o|IMV*e*{<5{{`Tw5ea4xS#TH|` z4I+u5{)f-3gAG|MEYx3fDa<-@+)WML(C_3mcLw!BBE^!nBH3MWzuiZo)57y_Iz|gM%KTHwSA^lRk4BE{ z^8XBsqaGDA7P?-oCfYeYvaK#Ya$bLn>n=`!Mo=I^3*BG9!^swltmix zMxM5!%oa#!sq%{smm11Y7_3}DpisFSq5+f8?>$2fH9Sc>W7jlC(HhZsJwaVdQ`At> zBB7Y_YhHoy(lHkQy_s|55VT}+F``}G$3aK;`w$V+4}^UwpD7C-|zAMdxnzF)l6M@)b`VnKM& zr&HPmNv)6S&`Dxo%B%#XZPQEU0CNkEP*F$pj~P@=Nu~j^6byQ=oaJl??}k3-#^HsQlc}VDkY(V z%i#G)7ui>sQFdq>A%@GlrmDL!`KP!X`Xs;Ox)qrodYfnLVrwZwNO85@CO_C3KSHg4 z5W6i6k)hD`IfZ{B1zxj@rrfk=`Wt8cL!^oLd;JP}V()X~l(ZH;r|s!@cCKc2@)b*poG`m`E5m z5sxLMQpF1QbX9Tk2>554{5_ggI*^B@pHKh`^6YSJIy!IPJE`!!e2qtMoJzzSng&yR zQvMZF(MZM7??CN076u0Sl37j7%y3eo<MG>Krg@Hu~4N74k*d`i7rxktCP{ll^fM zsm%+-sVz4Sr8pUlcR-~BL1Q|BoOcM*n$CWPjPB!kDStjD&?DhCSQV*f+VB71Y;vTx zT8_9J@Zxi~I5 z1PzB;aTu-n>=>@n$;wLdx>|!c2c8a`jFO;wspe$qepH%YUd&6}0@7|0vCc3PAC;h$ za{d8=q$$trGSCnh8Z&skZM?pr8453@iG=_OFS%AX$JPzC9BugebZ^^xMY=NItY5FJqIhI zi#2W6p|$w_#XZrhq)PMkmyzIxI>unh2f{5W>U-W;A)ZgbWWH|Jo6~hLtVk&#jXX&n zRXyp>0e;hTR-J}27eZSW(ga2bnks^v82u#uLAfhe$~BF>S4h3L8iijp2Hwpefgy4j zU6RxbI9m9`{#6Q0nB!S^wMvk1+uBfZrzYc2Hy|65v~hJ+p+K4^c2c2V=1?*S6$d!` zbIyd40vPE5cZh^aTiu^6x38K4REb5>AKE#ax;LiAOp4`!wjL%Gk%8qW9X{_F5p@N{ zo<0;Qkw2e=31eMmNs&Rk8dab{NOIn9Oe0K!2{$jwNO3YA_f>3ty+${8$d-bD@xc)( z6(u7T6$eZyVX{D?!}~}HiSDKyBZhQN*DD-O7n;=f$ZHP457ylRNdFN&Kw7YspDd9Q z1=`0DchW!CO}rC&pZ<8Hzq~lpRI2$euf^&R<4NI+Dc++E$1iqMzZxeQUc-$b>csV6 zBNI`UIsET4o4kUp_=pF%A+CgnJ&%>vW5%SG9s5=0WgI(UBX?r$3ogx}BF%9fQ5a#@ zNm!H4accK?;gle1!~_9i*cMqcU1JEMxFsCQt-lEEPOG3t>gOWu)h zZMN^EQGUQ09DtUA4mO?1advbhMgzpAuyEMy@(f2}V8H`rN(GC9`ojY)$!Yv1$oH>H z;PFcN2!M>vINn7fB=3fsA*Q1r(Ys|`m$2_I1dWip>QwR3{$kOLd%Mc@o+OwR^?7?H zqB_Cj%23c##4ni{txybzHH~gmW}I6}kJGUs@m36Yeox4;?L>DDYitYIOULw3UMTga z%BPX+7Ku4@Qra($B7a!vWz|9hl!VAY-DLmVI--xk;KZ2|M>ZT=TiZ@pKowA2K|!Iz zLwaPA93;&4J3>=2>{3-L#~IdJoc)DM6(4_j|k;?ek9I zFdNr`>nL~Y+)!AkrRHzSALGh}5|MNd^%!|=0pG}E3+KJJ#+Kdn|!WbUZ7b&@y#znIfi%(7ACAeb}WZ#O*&UO zrKuDmS#(9_$6ZF0lWALy8ix}vg)pYp>*eyV2y=N^?p>eLNBAQ&DaFxvVz7><$cSc3 z-IvmMtu52j!`2EtB^8;ufr^!?I-HFkB2adAe}au6T9h8_bQ0ZJs)Tpsd9)unV>Q?) zXWQhT?d|5?>{@Q@d@Xm50FI&4I#|mQ1ayMeafvw4sKvrKhg*?khrFf!Z%gN)@RQnh`d{Nk(c$C)!tSyT8+|0SV(@Ud#_OtvUDvze4_G$x-^nC@X0i!D7l znzCK@L<$NM6?>mDM^-Z45HwGYApVG2X|$Z)hqX8h(o!tu`~tR%YJDQ=|67;${eye~ z4R3+T@PsoImlu_>IXg0yMcXq-wuLZT6W|<~v~9yPDcr&h;gvffz{G(xPQLKd#mI;% zHJJhZh{X(Vc|wv%B&dbYJAY^`CI*_t`fF~;xTu=R~K>)##S;r`4N2h_Y3 z+`GTKSE%cE$w#r%-MZO2zi+sbI!>*zj#KVjzX*}-q69`PALgN=@((kn0V zUlYfRQKCq_wPpdFQK{m1chsZQS}l9$PZFR2RYgJmT;RpcP4XKj%Wj zL@U5g5Hk4Kv(3@sJ74vjbSh{&5w{oZQ&t!Dk;vH2E;F{Sh1Mtbm(|!%neM|=co8kX zdL%1z(D9!JnNa-8MDe)XszYv;hK@~-ym+z4B3^*>8OVhYf6llzBGr;H_ zc0K0@N}vaDPf$3rr%f7@Q88gjnYmPG14DSr|22}sY5`rmf6BHpz-aoH)Z1l6m7xk0 zE?j(P7X&DSEcF)u8V&M^8c^h#>e|x6fKH^aaQKjtimHjv?Rq)ZM;#yPf5K2@86hDc z2Z?ub%=o2)TAuXPx|jbv3-n4fz`caX{913-1$zYLzZ?YB-2dQ=&93txnq*%qr;)O%K0ELK3h=(HI8EkAQ-}#8#F#qSK#QzPSNucZ9P-K&r9f>FuXWZ1TvU}>-BzKoLPqf%D$rUNKdX27^ z_{3|Y_>#w((Xj*x8`^82uO0}#7fypEK(7P`AiM&<#*a{#1H}Hn)>V>r+>yIObZjs?sP7uYrJ|iB?D{ex*C;DuR1UX9SFQHPyVE z8O~TS{k=xVWyyOF3M79Hg&W_4`Oc#!`=CWq@xEK=>eX$RB0~-rB4Oa7AcAt|!qdHJ zf=~tooMbgprf$dd|63j^cQj%aaSnle0% zZ5VQXtRKg;FB_?@v;hAN;cV}`{swl zvB~+}7MX2YndT(9c5aq`8k61^rP@|%=(Ua(JMFjR2vUnavm~kPWSReD;+t`HG^SLE z`3!0z6%K`)pgK)F{6yS+W?!Jz#3si;2#~BnGAK661RPrl9OkF8AcEL0nM_(%Zev0(}Uxz5X z3bcPhKVsOrf@Z8D$xp>HCE!x6ak&ym>Y=vhT#CoDbv1*+g;%{NW!&`Eyt<_FDw(}h ziL{EPTpU7mLB)E&b$u|W*ny|r=n|C?$LO`gHsMeM2}GquqNI4#z^v0tXzspT%+VCAP8`WDUuZN0r`1SUHg75#w%?6m*rxFYp52%JXI3a9R-Oj^? z5e#N1E5gi{pa9ns`QIr7EGWcigYG4Z_8o$c-wEE4HGf5bCE#bRA>XjM_`~Smj@peN z1otSju>wB*-$U7ctN5=QPAU38yfo;)4h5s?@GA873hS3w;7t;v+|OpD1N@=}3$jvH#j@lIyElQE2jRdLarZ3X_f?9A!h z$X~S<`FgvHk%{StpAaGAx<=++`f;EL$&CF3t5Z``^PgrWk2ZSqqq#}LIYy(O<^IN+ z!XXWss&ME#a_!#zgWb`_cYs#>*lPQAkPZp!_ZX@6`;)beQ2tz170oSpr3azn=(viD z3|V_fHSI&05^AMNG!udF0{3=_UGIN$7AEV{Fz$`k)QiRK-?%!TI zM#Fpep4uM}HI7f~PRzEud0%L>b)lw!BAh9g`<)N~QQfCEYsM6T;{Ye-5LOV@gRUSW z0}n7t^G4*mWx0ncxSfgb_c8+*;B|%l*T%&x^+X*FfI)6U1Mx)p`Fx&^34|{FdPw^# zWPRGvUnEmM+tr#3@_VhvfD;5a^QPJqYs%<-^k8}O;T-jNv?P)M5ZV~1PaR#Ctm-}M#Au%d;J2CGtr}9kg1H;wXLaS5zo=%5pwVFbQ*kuYUqXZjAL&1 zP-EfKR2R91`&vB^Vy6sT2JY0J<%Q(-OSEW;PsocgFy;5nAC9(XQf^Cpp1ra7Qg2*M z`WJ1`hyaSRkcL`|NmYN0WOMSc%Oai+EMNRuRC#|P9>U!dM@M3Nj zB5ELbMWb%PXXxPJ;IFQDaLGKeFl1rzmNw0~;&^!LeZM!Y$?KtkNUYa<4B};xfRMGT z4hx5t;Y}N|m&$hYTF>e8EvD`N0;@V2D%7-xL{I_UAB~NE2AA&d-<;iV)n%Qz$FZJk zgJamv@9XuH08-Y+H15@B3@(;WuC!b)vFc1p(rG~z>~mVrD(~!VCun^n>BB~RvWh7y z1#ZRo=&aI5=pDt)!lrj$-g~%JM2;VDBCSYc9|s+3c>N*rcsh16f&&s~Cq#v>s)* z!7oQoJcL0NP}r0}#kiv?i2|ZcHu$5bzfL~UQ4wr2*oR9Y%9)>-SbpRNl??_c183*U z{z8nQFCn3+Kjwq{T^<{0H%sWH1+E#U>{+t!}e7i+ls-I5waoj?B zpO@qB`FYFNDyTHKG@GSF#KmnsHtn8O&sNi(M|^yRLFL#%9y+E4O*aiMmnU+E-b)DF zteclxVPK%(=8~1!yK^I3ry~@TTE#d}nCF|c4sz4w;ouz{Lf^x2!VDEhw7P}0*>nfK z|55iw?95?Q@s*;B7R&|DsnTWuL9X#CPz4Js$nCZHX@9uE(()m>!4h8A8zMypXnLHO z>OcWo?d02`5-mJUxmnE8TUONy8DV(k%GM#z2A2tCaDimNhOqL&5%dZ1{!taW(DgdFcvAf>CGHsDK6Oyzv+JDqAa?}7#Q7H{`xoul2zt3FvQ zs6+v7u;o!On1t)_lScv+d*M`(%PyH}s9$D6KJA?Ne&dTEpx9t4$BMrZx!Ncbka&?h z(gn3VZFF$z+1DGizncQJXspnzw&!<(U{!MzW2}c9+^wn#8nC*hg(*cTKqN}a2hAKe z_-XyjER1ouVZTL2t{|vFj_;NxJDm1EH=aR^xw+JR-eKL6hmgYj+OJIS{g|l}`qxO_ zs&_$>D>Rmj2{`C3kZVqO^o|S3pKC9+-z1=|Qh!usddO2zA*g3|y7C@tLH`&hDHE|G zHi(nuRbyT7O7joS-E8{C_!vB~&Ql+WJ=gSq)Rgb*<8jB|p{2K6c6`2Cy?sh4CPh^s zII;r+hnBKxzJ~0d+MZ$es9JE3m7X~?gd9-uy}R|&eNA6Ukui+L<33wZ{(fvms!-(7 zli>y;>h^;+3!Tw7T=gKSEM+%io%wEzP@hx0+bY<5p}X2t$zNOS7vq6?R*1Z|W@0t3 zzXmodsd-uZHyV(_X#uh%>%Q2PE(htQe3IV>)qG1yVMg`Vd*ty|;3#DMd$?*ect>I_ouZ!*8iSPNP#jBHAGdF;nU+tGT{9W;_|7Emui1 zJ*LX|wkWBYOUN|)L{q;k>+kN@2R|dFo+`P(n+>sQRdvnydtgm@yH?N_(=3uz!Lf$G z^ZIy4_u}~YETM2Q1B6@7N^lM97Jh!i({-7s+kNVdZPc`b_II&iA!SmtsR=V4Zo}v% zDkmqm8jmeR%;dY3clJg0F1gnES!QO4C!+4Piy#Cwa4{ZehRnJfZTp-_Qz>;;1Fy@BRy}dy^UI`3zi3#|0Ic4cFJksc60r010A>KV5#?)$19@?#gp_ zvu!En^8%Sg2FKkzbwhh+kPNU@J~mU=Z7*?p7lKJ}iK^0zx8JC)y{;b8EaO&|RqMW7 zFkgC&66@`-IqMJRypLDvzOOswRt=p;{X*T}4GEIG~T79ax z*otQ@XMd;tTN2n0QM8%D-CgG#oG6RT8(PSDeZ}6s7*)MFMeG&Gb%r+=`BIW8+Zkf9 za5@F*)k*B{(E?w~;>7D>ZHlmvRbstU@h6PYciy(=IHL_Xbl4p}r^U?Ubh_mg%DXy% zHbY$4dN_Jv2gzf#HCiAe}MOJY#tE6Pxb2Etl@Z<5YWW=Q9#!}bY;N7wc{@Ig~ zPU%-xyM+b<(RnJ!$j$U(?Le&UJea(ko}8~*FreoL^gXK{LE~Xv zlOms_tgN?D2gA{1;$D`KWhh$v3quMuS(d9(S7152e@k5PsAR~>R+w>yPrJRjRB^){ z-G+pNgB{GO$K9*C{JYLs$A`~zu*5l%C)Q1qbumET5(*h;B+QbYC<`9uP1cUVdhfS1 zqf58r>aF5$!;LmK^MxkS7boobw&2J}!<6$&K4R1zxeJXLPc=W3G~;0e2YV-uf(o!$ zvVf7OLCtr_V(~ath*@WkO$E208s_u#pE^v++j^+6hy193yd_80nYyTsCT7Urf!uWd2 zEb}v1q|)uTkB?I2a<%YvE+s+^S3@G2tQ3*BkN~CL@6(%FIU3`-G&y-vqVNERE4gP} z(U=960r>Gi7ReF;qtvY@0H_7RD?3Nz|t`n*kzZ@W)8h?8@p9qM&9Wh%j zA3?67Kr2TowA*a8Z+Y&|Y-MV?J*PmSAE? z@5_rAqPjl@y9-tz)qi?xvSh{QaNk$TAWD)e>0cWd`#EguZ4LdE0$IuP`d4R{9v5#Q z>E6##mn#MeK?Q6Z#05>$+Q(>|-1!>2|o+bq=Ea zM!#w%wz4!wGUHT_ZEyF^kUPbBfQF~R(a^br)kV#yfMJ8gGcKcVig2BUv%kkgcpTJ! zDZN*kUf-BC&Te3Q^pUqa*vbtvR?PYy#e;TP-AY+Hu^unIg>y1oG70~**=@Q5$(nk4 z7}yAUAxbA9L*;4rKDk|%azOmva22KI=DYB726~z`d%E^Nfm-Us5Qk@rReP%(Zq{n+{<6W6zVbA9<+<^9lb=wj3=4 z&CI9P(l`AZ|FKK*xb(W~-eJS*-bw%YM0yQu8cmy2v(2j8U?~zid{;tHfCj!SyZzZX z!uaQ)yX<(z1&j;t)Ptu&@(>dJyAZwJhg(KV=3-^+*=pFP0DNB-9H2PBw$6Ow;oq@e zE4(A*lJ6#sEx0EqBXow$?A^L=o|JlWz6e{X@vaw}&L<{lBZKy*R6W+adaJ!IuULl2 z5wUkN7|m4AD_V|R$jqQa;d{bm(o(naI8Ack#SVBoS*=Fl0wVlsft%zx-df95n&;;S znYRs03|?kun*7G3uIDJVl54gfAu}msIv#MjHfnIvLCzl&7tz3(PgM&eJXSslm)IZhS*2BLa>M>#B2tY_eLqqHK`Q%_{Pghgn zyfWzq4n*#)O4WNyjQt+Kzv@(m=H(p=G6pB_y%U;}#XLR_!j>WKG;R>^&Ha5q4vUMF z1LA1%@|4kb`;;A4{`Y6Pl$-J9K8)K~>N^O_W}o!hEA4~;S1ETsWj5Wqu3ak4HG46426oCQfUi^ z1Zlumff?1A`QBcCPacAC*X3FUeMoQ&8-Cq zV@8aa%mQv=LnPXfxB7;xBGy*r(u&F?s7VqiC~Ei)LKzxr-0ql^vx|AjD!^@ZKb)_qYc0h;OFF#%}YD|^UlhcW0A?$#4lKc4L-4c6bCN9ppqbee}YpX|%hbNLc_=a|+! z5jc(;*I!CZ!5r+k>Y%L_&#oE2=O1AIJOSTQVOpT``U+YiwU|eIEni0%;Bp}$p`)Td z0b&TIorKHnS}q9h=R|!EyA^p7G>E~)H{@lz(;E+AJRgurI!iS{7q!-TGn$DCR5)Ru zCd27_-j^-N4D1F)5&Phx%_1#JojtyPy;*(zkE-9)#a@=7d#6#aJK+aRER(w}OageY z6fmH*=C?@YfEX^ItoQqOONdkobPy~HE;9RtKQb7WI29-faO{kNlAjGlH2*_|8VGW;;VKoD?En=XQyip^G z0;W3I{td~UuvaJ0HtvUx1hDbJgI%gIHgjw7j%$+-MV2^rKSxybuM$0bgQ?9684}*d z$B$$VRZ{bSWPd`09|qk8ciYmronJR|b7r%|s{&tjFf8DyJoX!S%VF)R&D0#$LUo|= zZ{W&ZC{lNt%;YY`|AHkEdD`a)rq13yn9kQL(BwiiD6pEz4!a!aW*9)mw0y+_G;%sX z5!-F+b;u>K`Sag}oNX!K>^l?$*6dDlsiOcV0uG>K#eFj!;%(Y)b9Y>8m;iT_OQ%_$ z>^tm}XyOw7#yEmNFm2~_-h=MO?bn))4QiYWDOxuO?|jN^P(V|eVtumY^+mj zV(|8E?i}qYl$h6XHSZ$%^nnGU$97Ijb!3cDgXQatZR>xNB7eoENqMMm=60-nCwCp~ zzA|WI`viV6sJfP0n(+QvJ~dq0Fndfen&PDBy0BG*STN|iclW~zEs!3Jgr_BIpv~c^ zp|KIB{-Tua|6i3K`F>CyfE4-!v_^o-9~FP}fSkswJ>J9O^ZG2t!Sez(3+a4$7YZ;- zAB5@h`FlqV1%j)Y9~d+&!BX-|i*#&kCUM`}T?<)cG+LWJv)}}rg7Xfc#?c!xgO;Bt zMrfK}FChO5ngezC{~FD~|2SXk=3#S|w42gZzagi}_DX^$ap#f-WzE=pH;UxQ6Rt^% z)(Q{P(?bX1SISj5tKwmS^rVds+zl+=)E#Y~}tkn$ith3O*&rlTYZpcBmzu*NMlSajX_ zPVYhC-q;g|sO3rt_0Bs`U1Bz0iIVM4mm8a50)>D?!#*Y`JzfJUdo zv$hwqKVrC0QN;Do5LlqtZe)Xg9$5|C{znH0jGds|N4lxi~Y0*f;;98l!|df z{V}XPc|{$}%7KMo%9FM8Hng!^RonOMAN!~lVhbn8@4tnsn--ye&ckzona_#4j;ZnQ z*b!{+(`?(sf}b&nFv|Zj7Gbuth}?i&6`Cj+gl`hE=!+u2B@7Dz1yGw1ohq7r#zsd^ z7t4|3%UHjp>E*}(!Ic{zNWg5|VzcGo{P~fs3pix~fV+sl)Z!fdbok#Q#j%TTEC{t; ztm&H$V2%6pF;V<)*hmt|ZzB1*S) zhoMo)J4Z>0m6J>TEYU+i8uNNt|4ilmXFIbIOm9j-{LJ#`*^QWvd}V$0u{ zi8=)(nr*7O?0nQZJe5BfCpG@xu%ex)8+ZV26VM5lDFp@4W`%=`3rgU>%gW>^PPzVb zwI_miMFK>JbISjG*^i)K zQvcQ4?Bsxg-i~4;mCvnj_6FA$^9Q(Iy_|}X{a=2NCH@1=12_wS|BM2ZPZ$`~==1tX z452?d$kiRzXK*_n5i!n|N~i7M=qLyveS3kUOoKwer)2_4MpnCk2+t$r2jQm{${NS* zLf7b_7g}Y?#E}CVj;^jQASC|JUv$W`BO@m#27pFm0e||yU`b#p2(PrGgA;HCgv|gF z1ik#R?JM-N(Zp46hbJEX2~gDkqlu9Juc!6DulbiD|5x6u9jqu;pb&x@#E*myeCYTj z7f}J-U*Em{@tfhteh1TOW*|dh=k?1K`|jp*Z<}K!?)w_KRTkUbJY7piceu2NrS{ZZ zL${Ok-=}ail1mKrKB9wWP2C;M$QC)zikv#HjnajRd(3!0*RA2_MV!Z?0(FE>zN%NE zDYZapMcuT&hupt18)o!6bYrb2KDK7)&eiKLmDf6mZ514!H0Pxuf)T{pXg$63&jA!9 zG9P$R*X=Dwr*cfqwoK6%aQ8*-0`yyH)?7EZrINW!h!;0ekVhL_9pNW-7as!g6~{Zd zPQZw}AduK>tE_SH+jssu&!$Y1Kwm0SvGH~Po2M71~-`Ce)^jAWbm;8S=vFIGAyg2|; z)JwzY6Bk*yfTT=|1q2{4?N@sT&6A8)f}V14+x&$D`Xl18zUl^U1}dW0%BcmZ3DkRW z#iIER5V67ESgww@7BC#CH=+>cm*zvk!~5Rs^qQW}Dyu!65`5mRQ1@l|seT;wjQFzs z1i;`x!1&5^zk1c0+C*gmDfQ>wLLf+A8Y(K3glB5;qOC~_j+K7unzz1V;B>s8?nC~y7U5J;)sRI@I=<|$du1=M)Y-M| zGm2-pHjy^J=saNKB6ed-Skh3&rzJo3$xe^`6$6MTm685WotEg!^J}VH!`L|+s^(J_ zPy7zI{?Mp@zWx)ZH*Xj2Kx{HKi2<-ZvqHFuTrVa(6<)tPPxe57UFKnqZ9b`w=GT z&vXI8LS$(;yz;ubva$f;G?uxe*C{QYojh9Oo|(II9Lf{Ros4e;0U65F5#!8|GKOhL z=-_zlOO8`l%-OBtg`~d*PRYRXGl15tRcpP)4v!a1g~3w8nw7CIxS)9S^wjj;Y?_l( ztU+K&LxY3m;c`L&*B0F#`OM`y3hHq2bC(;@*~Qo*+2qe#*-hMsN+btK&nf9gYaNZa zTyE?4jpFHy{b8SUSy@s%PMaOb8{beuqAv?ToZCbsI3#r<0zQ~Ov(G?r6h&G3G9b_p z{PlW^bIQEGf9Mjz8mNJhgw|DUx%E=0b6J+(r2c3{+YJnSn2fTo8c^oDj9^CKvN2e< z+6oHC1AUufS1l{9E*$9D8M2XHAAjW`MD}2D0Osr2|Jzos7@+wCAJFu_S)fwYi&P@Q zXoUvv=%NGnD(1+WQFAvzzE3{`L0;>hU0vHS`dl^AUWs%GB+zf;Y>yv~Csu~6e*#ln zSsvkC9b>gK9ZcEiw%iDgNqS$ICM!~&8mR_?TabUCz_1mQ8Xq0ulncpeXy_=sX_k?} zFUoX(ge5A#eR}(cSz|8#ui%S-Z z_Kp3vBN&L^daAM3yUX2+$rAU8A*4x(KPRnzg()%T0L!&eu&b9JIisnDZZAw zr;O>IVU}tUt)1W9)bY(=@-gd}I!6{9_8hfbiLTIdGwvu@5c$E0*v9wE^Fc0=hd7O6 znY(P|3D?ajotmT0eQYXdYf9@<2G{-4n%W*peZAzn-@S0kRX8^UHCE*M43{h5asSVI z(Nr}EIW3MshvSKkuP=Qkdja}bM|L>-SI)8L&sVPdBJfI|)f z@o%K|0T5e$hNFC~=Jy>X!3-KvMNigNu{l0fWnx47-I#(lCD!?1TU3z2qvY(Id1mLbW4gK$Du{{&eI15kl- z&%q?fs?>1H&{*>VzQ|ZD0Z-E=m&2-DLc+R3W<8~Q2m$*!9RmL`H85c0R20Rx`14~V zAds9;j1wCL01?1;tJ2V74krm0Dgl6pP;3$WU+`Wi)y0}z1oVEIn-1jr>mJZF5|%fw zy_i{=O^|+eaNtKkIq^6>PSVh*R7>gR($e2umwCt?I;Sp6&R>rJ-89IDy0fz$gbe`= zzNb-F%{a~XUXXfMSZ&aI|wFZ}68Q=_ksJr)1)S%@v|aiKkG47N-K_ z4=$Joi71mrAnVjf^5?^x<06WU&Q$Lzk;Zns#R}*Alt>bQpy8T9o_Tiey>F@50MDMo zw_K?^BCUjrn&IeIiH3y`u9!1%PPAJh^%LrwSeXo2#1UjxI%ADxzX46ET^9J@@4cP@ zXf@SURcbWLrmp|5=Dsqht|eL%NpK791b24{9$bPu1lQmi+#x{&1cF0wcMk6Et_OGb zgERZy_hxFQ=Fikjy{b7s`*iQ_-Mf4Bl3w2j*L8|4Vk<|##abYSY-y1QAzA+fpZ-M3 z=V4!OD)JN(jU{ckyz9QeTP^EQUdpdKpIku?7M=>qBcWu}Hd}Q+KK8b~#I;dQ%4_@o zGoD%j#8Y3E-`CsFU^S4CtPOd{^}IZP{s4O-RJJ1gA zar&p){Bn<)=oDTsz4gkcpK5^qHNhJl*$(C`Ykb~@zUBKL-mfvSNf?ur=P5m|2J3Cr zOpu+D@>Q|%X^F#{cFib3JWvMQjB>vGcZny8O8KYh)5Bp2T6F6noUgh{T3_~8!PO7e z$US8)U`s__7zfQtP#LoGw?f6RyIlT43l^jhX#{z8%7Bs0nG_^$!5<7~?BI6($R{(| z(GeZ2Q;XSQCoiKD+SunWWKkPF zqI=hiP)7>8c!B?(X&_qq$^QyHwJJ2JF;t!H-VtS7+G;sV>;Y>QF~PWm)K;Q=fqr=u z_)f^tBE_7}aWvi9rTlW&3Lz1&C^0Ja%h<~tTg12FbnKcEEx%LY^szf5)fL`qW#Z}F z?L7?6x}lJ3B)cu+ep(Bdr+CfYDF11XPLokZ%x~8J@Y~YTBcN|uYiXUtnJKZMX<*IW z+T~kjFDRW?*U4v2Ce<+E09^fdW$CQlMd$s+_uCuolTqPy=bvM9ImNgiy1tnc=ctPr z=qZkV@_4nfx^K-3M=xl4%J|e|9-^0RQEMUHV8B2AlWfI!Zb@(Dr5qlvvL?;9?6N5d zEzsb!hxJ5zAGhd7Qj=@CH%ng2df&*v>9V_?|EIZoKcD^EbWU4huK+iTisSioi*IfW z=$Wkd7vy6@xyL1S*uFYTY!IgsilKDM%Sm@0pkh*M$v4Y(-roz;qmk^hA_Hk7jdqcoXNZ9!RGP)?q1?O)4@80-#a z63%j=fOU;$#PH>(bcKMQD})%?fR^!gs|6Fv6TOBCjzcW}3z8%Z zTIf)i^n8i#@=x#jbl>u6H_1s+ZVUdTQM`m=baXQ=!gep)JS4gt4l5tDEQK5dPoL-p z&B_TQliI$8vroyNigd!d_OJ4&O7cw}!1{aF-pSMf~ukNbgM+;dg3d3VPcB3N_9Hvp~@wcmbckdIgGhn{*{va1e~L zv@Q3a3r&yaEyZVCetUA=Ou~U2@Lzl#z6&h38+sH_XjR2=tbEkC$ah@-K@=f^>_gdI z3H#jp9@9b-$gRYaN4Ue1Oy(zoOO#EZ`LMT+Ahf8ZqC$?T@xKC0;f_vfegN|vt`-)1 z$%jRKXt(MAK9G|(-Y&b;SWq1r#?bPOHcd>RL;x(HvoUwv+v0JKf{MDy&bS)hSkKeL zIrd-b<0~h$*1kikXSqd4Jr*>su4a(XSzrA!V~6lEc=9i(lj8M(C$r7-b2I@h>%bB` zUu7fYhrpY#(}GlURB4gr+DO6N<8AdFkZq{nKC(Co@x~pGT|ES`SXbo`{ymTjTTA&k zG*p!l{)py&x;pfW#-h%CL7xGa=TyKhWytp}-%=>d+trcG_S$SB1RP$?!Bb9vS<}?C z6bIF~IJCyE80P8#?w*!J9!CvTn6|RXL19q*_S7!p4-zs_4T(MPXKZ38n!ks;`FV34 zem7opTds>QEp_JPcsfxqU188BmyB}~33hvFvl~whr7ZxiS&*NDIo6ybz<&r#vok=Z zB`E{JXHb!Oiv=XT`u;I$YpL`gl zk3{_b2=m%s-Oxq$+>iAvCp(9xDl*Sklu~a;W#875;*y=H=zZJ5#;PuvXlt z&{R{qKAI~97zr^W-?7Ht2M7FmSfZ`A-W@bh99`%YaeDvx8JrD;a4SDoy!^OZ=p8sP z&^w_|gBvk~@_@=FWS{?TG6295_=SU?SaT&uuNgCH!Z=AsMIPIOC!1nN{c&%&Na0{k zjFn)IU7L$kx$|qaq!8(!E{hpilSu656fPb+Sk@lXDtzq|Pt4C^Dq=LaLwOXL&og2*e4VpR73Gz zhJle!m7pmMH90}&Do_mh%1hd3Q#u%`GKSnir!zp9C4=Gv5}%Klo14`aDj2b7EfMjd zR`*lFe-Ackhl?tU%dI|uQjn4HX-f!tOBrgR?>s=BCZs6fzErGRr{noGKG=pL0k(|- zR2dHU8Yz(|>H~Y=rQh!JP}+^SUkmIw01tn?$%PhkTm)MmyYxM#2Un@f2CZS)vgk9I zOY$GEr_y50UK_VwR0Q?0R9P?j-i1IHa}$$a85yXJ@8dOKL9>gCo@c8~03qh??jnwD zZ`S+gS1ox9Zf=*a1S!2gH#IQ)dH>a|nPO`Rn>0<-S3HHc^hAeR0TNITq4A|!%k$;> zpCh}NO%WpS_b-*2lKQN+gdl@j6u@zfX!&xLX0#nLXs!b10ew*`5J@zb6+s3=eXUn$ z;}q*MU#27IeuCi#af^*uC)TGg6)8o%=PXvDAcQ%>2iCZ<6g}dI%TNv8+nHYR>xf7RdSnclBEG@v0qFMadA8x5V;F z{;Tkf^d>En1OT96R^m^2&lB1~B82!&5;i9X*%I&-=wUseK|gV9bohh*h70l4?27Tb z3;Kzh-DhBmzDNQ=6kn`6tpIr=1BHv*yQ^DLVT&~>Z9?4NBF$pzB@NXb>PO|U$GoJi zw7gxa9Yf|HJx=@8*aGn?WXGgzM5EySgoQxv^YilBS1%ftTCvqwwC^81;aDO=`6ZW> z1C}s0f2csO`T0qJ!45muyVQ|zyXq_2DiI&gQ+ogeOQMI#abLoHd+wY27l<8=L_6yX zu@`c03{K+*f4Vun+Q($o3`s6J!h0H4y-&i*VOu7<`$;a?UTgY4ddS%TQ%PbT0?wM8snnJQ$T)?>$CTbJkl8 zYmCIIpO6|o8-R~qw$*lb@GJXFQ?pHUyCNKoif3dLA#w$ebL70VT+DK1xP%O9i;|bl z+r$(?OC4I**dKK6+Z?3PFj_*wq+ev#v|%+|y|OJJ4D~hcEhn$#2|hs?$(+jvrUR+L zMuRizUZSfVDU0yl;xpGjx%2-w&XzxmMuvfb)v|JqrHhS|j8Xq(&X$T;sP%w6U9fmW zd2vfe%h-L>L<5NTP{eo)1wvjs0~ObBAaJvlNJ`Qs^&RCv1mfe>9~~8~@>Gwi5EJd> z(ZWydX6OJ_Q-A6H7!`KPmxgaJ-fA+n>gx)*n}DL94N267hNz41T)a>@M4Zkqn+Ha47t48P3w36ZCe7jSO_@o)N>>258(S@Sj*f=%0x+)LQ z0<@3OtE;JWB0+cNP8~pjhP5WYAP-YbfvVTOD#<>!wcw4nPGRq51wBlNu%+&06f|~G z5!4+~V*R|#IJE2x%_4{p!M2m2!~lXCmP|3qIzro157#YMfiSRXNbhmYop+8C5Y-AK zN&TEo#T-htEb+)rm;Mf&ZddncGIs)@;Qt+SAFAsA9dn;0_Tu%!9~n`HQba?;W#Y|R zzKDTM`Vw2!e*sU|#P3QM3t#SNP8FKl{fv#@`%jm+CH$sNGSJuba(*Y3Trs5*H{^V?Qi`r`Sj)Us7uIkmw4Pl}F7b!*EIn)f`_8l_?MAOu#-Je2H(gg~ zd&~Y<7k3h2-|nj1?yc-T;rKMxHmKBZhcF)^jqS2GIq5Hl4moKj+RiHbRUOuCU1obj zf07jpGPWzEmrSc8Sz2El9nSKuAo*5Zrl-pbG9B<1od;xRUp9P#hw#4c9DgGB@e+O* z&wv?TZZfSKGpjo53?*-F{`7d~WK;R|=19&*#?y1XAh8SnJcu?8X_wLSe}?}j{ZIJ+ zm*}c_V&;0{3ZXA?i9aS!)et0M|3V{M!bWH??l@74>eBlkkTzt`=c#E%gX+!A7fCXw zdZK0}7SeW-S5UKoD}Bjg9D>DuuY?PjJGro}JAX7@8EHTG;46Ql|yOSgRT zKJwcqxMoGOT4#8K0j(*k40Pn?f>2@_^VE@K@*ntXJ-&fKUj9-kX7lEgVK00Br(k$b zwOvB^3y4`PkM&I32un*MMbO8OA0tk3v@y&Og0iE2>i>?Q<6zOcSC&9DT~IKFbEGIZ)w3MqGzU~>vhlR@@)WHaPX%uY4QpQS>LUCy=gyRhIp`C zX&6X*dJ$?f^A!^Ki^}6N$uxCW98MzG(B=tvuu<=do3!*^d#hGOBUfTlw-oc5wxs%R zJkNOb{58jTZQb1=G(PM&Gd|<)79`KR%Bi-g{(A+S%OVV|?y%A7^HtSVAtjNgVKlgH zT+j2MdKI_7^|{#v9~j$5Nv?H|f6^1hyrwp8idZ(VWMPwP`QJs&wLQ5ZMOk6wA^5h1 zdS-pfb8?kwlj5c}DbO`ZKC7uL7+tflD$+(x&O>7b41Kw9%RFV_WNgk z$z*?h5VuNn5Dvz2&GBxVNJs63??NEB-R}%J_{ndY8F8iM*V_lR%C!>$#wV&ae4SeR zwn@TohE~~TlAgratv9#mYs#cczQ+$6)om-0y<7KEw?>|(0Z)->BKAe}XAjF(OFxeX zT4$fVs$Fitzd5DqBcQ7BV->0{FT`wvL$pyzixwZF>nN;lmm@L~q(;Hd>tfq*+zYAR zXoSqiSA8INW4|y7+TOWTE#%S#8T{r3ox1e$gLwyCOa3v zo6i02(UqaU7!2>7<@4Pv>3v`x@E66QB~Oatg|mDrJj$zEg?Ha%rc%ab^lBRJ^EWC- z+|nbP^T8apWX{93uvc9l)PfyP<3~~wXAp7tq*1yj77bB;?0*^#d1`qaxziN3&C#Rh z-H#2x*dl3tB`j1&t>6`x!|sd_y$TUl=?vJJH`3IfdWmo%S{;+_z5Ht2<@|*F+p9`& z#nZteH0=~}ZpZ@b!GgO2a$h()+uLx|3n9?I-X6Op_~7bI?rHi~6{45WpvU>#ZkxH~ zzYbAF3#!69D_A)lV_cDtMkuao739m;<>MmI_K#!OxasIpfhzRJt-->oV}eKQ65{Ec z0*kww*pR+#tt~|sd-wJED4OaHT;>nK3(Wmn{6X^ctCUXrYuYgzfcv^z)+Q~YEML1 ze>68}F8kr7WF+LI&Sl~gN&2(yPKn=#tajo|42G=Bvh#B4)n&iGf1g}7jW&cTrF_;H zzdX_bgQ6!`k)sUBiauVI!*ia%u5*bdIv{*njn8mDYY&gX*eY-3=j;187Ls`Dc!f{L zeId`mXWz{#ElL8U7*!34ZXzS$L||u6Ls8-^$I85$HsPyA_kr!=MNqPX`9p{;5Vw6* zy_SSvt7Rpcj}w%D43i`hLAJTy9UM56qGqn|{1}&|{rXpi&Z5iad_fzYroq5uGVpvF zo=IVbN;0;1STqN$)5b4KUs{OGGKEN;@xcKtCz_kFfn7I5){=;FX#*-j!fLy1?hl!J z#X>E#{DM9Kh|l*KLcQ*voH5K`!PS@E^EldskyiW6UHzr|wR`w2^CNs)@xYaB@b3bL z>IlHazDXUVUI)2|ZZEAs)%ErLD&gjCF?3UTEAGW$hXPNte+OIZ>u|@&H*vL!YwRq@ zg4I|u$dXuCK{D{iDdA%6Ouv4KT=M)>2`|l4PM(ad3Pfq33n!^g$Z_SceDGr@~KP6*`}yhP>)s_)u! z2<@3jMl3LgZrWVx2kR|lb@5e}Tue4_fBHy)$_~*m$am&MCng}B&ek*>1EYn~u$!4< zA8*vcMyGBv_e{&#-0LR&SIgUkC-_eg*PHnER2Bo%Mv+SO1%zfU;qP;T^{kM2s)p!l z<>>GEndikFePbu2sq6yph;95-R&zJ!IM-sdFEz_6my7h5biRzfm^z*;t5i>fve&*E zLUckYTS7GE&|h=2-Y!VlXKW$`Z=>!R=x=6&2!(0wL;4<&KjdQss#dpUT6r}~3|cUe z<)b7cFFoHZfrE^W8K@`lyQA&*z50|Cll3Zf6b%`Qk>8X!GX_%>`WgyXLy<{Z|;igE#?zJH8Xo4w*&QD zdFosv8vd+XO}ZUN!NPd}8Y$gKUxY4M-e)&;HiiD z4P(II`E)Psr%R_j$(57EOtWx>jdFPaJy8X!Ho#L#Xj@xjQMOvPD&qbAs&ATZoIPJp zMu}yeLgBJ6hKQQyPAl%gBt&OPm{nR)HyLdzm099%<1J!<-N>>|J?+@1WK@o?AR-zx zH5)r;n@Ve~7D&`$N3G*mc#-|v&r3%~G0LphMpQ$S1Nh?L#{F7-UK= z7wQ?Bc%o7DM)qPki)i5FtJHS4dD{bJJT=HIP!>=rwJc(^y-wGg%7XTlb(kvJkn5`5 zHJ1nXQb2`#ozfhpYPyhJFNw7K=8Eprvei?GM#k_aGptPW;)3G!j~@?4qgAr3N5%c-Tdx<=49XXr_^Fnm>E}bWxf}Dy=;N&L!uK#wPP#Fi(?Gi zx9!|>$WcP6iq%)W_)71-Zs!haAoVc{OWqF#y}LP_bmzYzdjEC;jfto&AL2#2xldud zVb)%u2$C8W4~X&SC1wkhM8TKyf#q&z7@}R_3@dBp*$*PwiHa3RkyA<4SQZKhhth}w zzq&xrkn0kwt9{$|EY{9TVxRn&t!Oy4u4yUA=7KNvGbvZ@gc9rQa{Mz3&I5gQ5O%P( zmFeLDEnWtr39%u<+H}~C zo+g{XtjdfwFqQV$rM>F(N3|`D{Fogn(N)$$)ci9_^SAc;DLvX++-7V3am#SqkWP}2 z083XIlJ0VD_pt=`V@4x$+ssvW9lA-h`x+TUhPwGvZb;VSe9qGt+~t{RH~ZF!tBbfV zS)6RM)JW}gh?e>;`|Nx29o9~wff9p8yQ!p93Gx?s8Dbba=!lYlQ$9&yRA}yic(Fp` zs!MK}v7j@Tk1}Xm%NPqtDWVZYFzMlxC>Oc!6uS^5pm0^87!aayes>CHudO(mk`ON; z)i;Y~;B8#AT+Gnp*CFx29vlVrLQjiM9tQY>(%ai`-#G?~L@{kKR%EQ%y)r3tyVM9q1@-VZ7=)v$twm($N-z6JxDRLMR)8tCdVO5Dd5@#| z)J>FI@MNDOmZhTgNA{F?uw!`+{UYY{A?h4!0#M=uK)b+3 z6MDKhhR_5*rdJIdWLk1_xl#Qpf=lR4)*RRb1vvLo7ft1=t(^Ge-q3*nY}t{|ak^2=rMm?ByIag3>@zwP4QB1{=KH9ty8Bq=_}BLzS;ll$jQ3By zi(Pa;W}_nem?1pE?_){FH@-tKDqvz6Dv*(lR!KJzw!1w$vvGcn_BEkaWWjXPaaWtJ z7nwfno&2&jDYFj^-Tvj|1~RHpUD#S?*uM%T`z=GKaXMauY1!|#*+bmmK_N`M%h^AZCd%pmw>1?@jC0vPb?!*UooT)>Y*{T)l7IT^AxSp&k0Rb0$P2g68GT&($OKh-@hMq3F$1d}g-JN>oDt{Ks_cTa zs<172KASGFgNI@fbBEW2T0M69Kc5djefOc>q%ejgQrYe()6?W19pCk)-Xz2`awXY* z5X-pk_kblfP#S_Ej`5zBJOpD48t4y!ycZUD0ET!3JRKh*P>TM=5fdmS&EB8_N`*wb zWM!5d`H1hlyZn^!U*j-TWq}H+JX_n_$6)zjI8+!|Sb9OkVlFzqET(FZkd!`iR(;&G zvALIs&^aM~CWb13=XRVoKy9^FZ7L094SPREb_vPL%m0jyHeaIU8}xoC3r&QH^-)lW zlFRQ7NR*+v*V{kp0MA=-Nra;rRGWmB0`$E(UZ#!>-&Wl3PL`;tsm~5+5!K3xugZMp z#n0gV$86?GcF)gQF(Z{Sg_d$ZBexk=sxwTa^JC%Rg~zG_!~NsAU920keSxn3(23a# z{{HJ<3n=R1v;?5ZU}rM&e{n0z@`3zPo7r;%upWF;q7DJPdwA6Ca3NGh=_=l1wlmeBsgGx%~5Jy`hMV~ zq-qB=w;+%wA^cNT2?C|qD2g*MI{0XPE7dID8_&=aJ};qOgYq8(a9~{pz%Nq#*&cKM zjM&r>cv+X-;Uu`=u1~&rk&;{X@!@-8?{W9?HA`_K&%9s5f)e6}dx?TM>FKSv`=k5% z`pypD!i&9*X6c8OVmF*(Vq+m!C$5cWq5n~_(y6&$q^HA`MVk&lsfC1K-9<#wUPLs- zX5fLI@Zg&K>JiA-I#&w@iM@~M%Mq;EOqnvAl@3K1y37h z4kX@X3Hu7TpI9}nfZIY=vwAkIrgHltv1p}Yh-H^#BRsCwHhQNwNB?l9q&`8;D-GM4 zd5y9tNvDo)M}9K{M9skJxw^e|gJ6ochC$$HY0QC_NaJ;QeSJC~G2`%HB}dOyX8@W# zj`6PllL-;V_puk*>$X^ziA4D2MonSz_2o(JP?R+6Sn_i?8VQfX8Zi-(JS_vlrTE(G z-pA4LP-MIcgO)qLEG6Rv3vTQ8JR zC7-s>^)%#$BSi3`2P=&Z&dxQ*GwB|t_%y7nm5C}}2f=K7!9hW19x{lps<+1r4n1M0 zXV&5}pZB7>_^l>CE-av}qv!8YW{W||8CPqEp%TqEyV*jx$nz+!`~Tffqy$Nt|8BOT zEvg--Xnx%jTE^3z4*B@#w>(7OqsTaqe6Zx_6T}VhV!MvBVkP1M*;aG^2j+8{`D&P#<_` zB0;>28Bba)kPbAANW>?*ZH=KiH0f_Go|!#8P(%@;F8ObznC(Qlf4<&!MioFsZN(-o z&Oq?b!=fZ9oEpy@CzQlx`aY9MlkYesy*ee5`9C`WOs*&QM28c#zA)v<>lmRw3&cyR6+1sV>S2*5QFB&T{xE7+KauBSo>pX zyq*^u+O&2XRPI|6XMfIm*_`XqaRF+P&m7{pB`z%zNt4 z6_}TmHg69gcsme7vOkfvUZ9vZIyxE*58wiLad30j>owY2)GmGEHIXET&RHKzWAgz2 z&bm4&$J*}fx;`6NeTM1j)ZE$-rBZ{pO_Hj`QF8%HJ77z@MckT#L`Gjc`C?{l>dz2? zZg;Aa+)Fem;=da5*e%9+SY!>ErSiMb@Blp)s3NW}jj)Zfc032U752O&L85pT{biyk z{v2Q2$#bhgeE!7qJzNyNpjc?;YyRMyx8kr4mJod82v)j)wW$hgtF5CPzsBR$X8K)! z-7o3xdwxjQl(MNEug+quKrIDdKu6i_CW~L?B4o*_N7AaF|4Y8NY|N%cn+(6kwd6No zf7i9PwnjyvRBNAPz9xJn_#GFwVUvuTu39{6#id!QiFzy#z#fp1i5PdkJIMlWoC6Z~ z#NB(QK(SK4DOasqbTExbSM_?i61zIwDfmGdk-`K|QbxtXyaT&le2Tmap5kDa+s$Pwb7ag{S ziOf$c?Y`a%X4VUQu&}TOT3qZO*|}NuK>;|l-Ec}YG&E=g9PcbUmsXWGh#NL6ZN%Nh zli7*<6cUEaiDmM5Ayz$@ef2h>N$F@RB9v&5jwkbA)m`ACd3r6iD$8*pV5a}^qBBZu z&(o~s4F>K`*3ZT~Jd4xyw7<>Q!Se1rtshUGg3l=_gLtCJyhP6_^Oa{X#AWisazcwA z3b7*nCeo%E#wRDgq~G4TTnN+B!ao7oWB6fR%{b=<(W|Ta3u^fBOrjcGhc81S_N%T` zM4Bh8OuCa+fBvdfF55_LJ}pIgh)nEu*md13jzNmMe?Nmd-!kOyB;+q5S*18+pY99& zNLMdQduJ6Xp~pED;MW>r;&1mKP|`QI4Xd@_h>`SE{r`U7X?Md4R=4prj2UtZyMF~F zUq~F%>1?qYG&D56=-HtNY#8L>dLIbrAEz>voArF@eKPI|Ya#?>^(?<}&n=y>t2YlG zinbx9u<7Gbu#V5=nYF|kVU{I(c+u|nHeudl-Sc=#qQ{^q7#^$xRH?s1@5(Y73CG5< z+E_GATTvy_d-z9g`9T=0m@bA)`|*QkWTXMN?ml<+8$PDN2v5%YA#O6Lw{ZKN%rDYY2$&)%;FT6U3QuVdD@ zpEQneAr1A7=*Wc%nLkzhNqfym>**j&<38^wMmo&$0Vqbq2aO`B_?UV%)T~|oFfA7h zQU-|o3+sSG6`%2Q%yuf5^>mf7#NVliT?Syi@qAlOG}lSrgdnB5I8K#k4!>yr_)OQM zutHGfKejTVuqMQ^C1?qsFzHQmHZdDZqo|BcQ`v|=r&ohYq^!73-2gM6;a*GLF?gW= zJ2;r>6W5|Zp{;Eb+ciO{0+UJ#YuPVEwNdxm10d;2QFET36VMfdivRpgq(@1$GRQW1 zOI0?QdKfZy&R3;RmhDvy)u+HT4lGQdrgfNkM94z*;zGygmnoc4Okp$LAI~s0HU=)2 z88o}nyQ7f_Kd&~q-1jPF2mms+GCRAIyH=Fy@_J^A$0VU%?~)vz_G<3&sVIarrhac9 z@Q1bs`U&$TC8wPeVdTYe%x{S+Z932oJIQeQA`;FzQvP5P5ty!?{{6xdHBkWw~{KgsOD^W?q#@PXL2E!( zWeO2^Ta2Z0yX*lXe)RKC+@>{_n~-}eSXy^H0CK~{4e0is zMBYwfHvzlsg5IaYiI>(|Vy^#ZHxe6;*3 z+;(DUNLEhHSrM=ifF`70IXF4NW5W^VO9uy5kaxfezgol(?s|aBll!sFSFU-S`4Lba mNQtf|$zp&%#al@`-=MV7y +
  • [Configuring policy rules](#Configuring-Policy-Rules)
    • +
  • [Adding new allow or block file rules to existing policies](#Adding-File-Rules)
    • +
  • [Removing allow or block file rules on existing policies](#Removing-File-Rules)
    • +
  • + + +# Configuring Policy Rules + +The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains additional policy rule options which are less common to the majority of users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#Adding-File-Rules). + +![Configuring the policy rules](images/wdac-wizard-edit-policy-rules.png) + +Hovering the mouse over the policy rule names will display a short description of the ruleat the bottom of the page.For a complete list of the policy rules and their capabilities see the [Windows Defender Application Control policy rules table](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules). + +## Adding File Rules + +Previously, to add rules to an existing policy, users would be required to create a new policy and merge it with their existing policy, or edit the policy by hand. The WDAC Wizard allows users to add rules to their exising policy seamlessly. + +Selecting the `+ Custom Rules` button will open the Custom Rules panel. For more information on creating new policy file rules, see the guidelines provided in the [creating policy file rules section](wdac-wizard-create-base-policy.md#Creating-custom-file-rules). + +## Removing File Rules + +The WDAC Wizard makes deleting file rules from an existing policy quick and easy. To remove any type of file rule: publisher rule, path rule, filename rule or a hash rule, simply click on the rule in the `Policy Signing Rules List` table on the lefthand side of the page. Selecting the rule will highlight the entire row. Once the row is highlighted, select the remove icon underneath the table. The Wizard will prompt for user confirmation before removing the file rule. Once removed, the rule will no longer appear in the policy or the table. + +![Removing file rule from policy during edit](image/wdac-wizard-edit-remove-file-rule.png) + +**Note:** removing a publisher rule will also remove the associated File Attribute rules. For instance, in the xml block below, removing ID_SIGNER_CONTOSO_PUBLISHER would also remove the rules ID_FILEATTRIB_LOB_APP_1 and ID_FILEATTRIB_LOB_APP_2. + +```xml + + + + + +``` + +[comment]: <> (## Editing File Rules Coming soon!) + +### Policy Creation + +Once the WDAC Wizard finalizes creation of your edited policy, the new policy will be written to the same file path and name as the in-edit policy with the new version appended to the end of the file name. For instance, if the in-edit policy is saved at MyDocuments\BasePolicy.xml, after edit, the new policy will be saved at MyDocuments\BasePolicy_v10.0.0.1.xml. + +## Up next + +- [Merging WDAC policies using the Wizard](wdac-wizard-merging-policies.md) \ No newline at end of file From 8830749a15bd2b3f035caffb45a97d4dad5ef36d Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 2 Nov 2020 15:46:27 -0800 Subject: [PATCH 020/825] Created the merging workflow documentation --- .../images/wdac-wizard-merge.png | Bin 0 -> 26245 bytes .../wdac-wizard-merging-policies.md | 13 ++++++++++++- 2 files changed, 12 insertions(+), 1 deletion(-) create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-merge.png diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-merge.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-merge.png new file mode 100644 index 0000000000000000000000000000000000000000..13d3a31cec43e8608133e6265cf991db5f661cd7 GIT binary patch literal 26245 zcmd42g;Sed^e#$;Qd*n>#fujS6n7|4+=@FCcXuzv-Q9{?aYC8|DemqP+yVrL;9S1* zyLaZCKj7ZEGw+_v-aC`5*?Y;e*0bKo?@H2`??~REprByN%6wBrL3wF~g7U)U?aSwt z(a-e(&mS*bRi(vIYDUT6&y&}dVv1rYDE0C0?~PHP=jcu{I<6=vcy9lV7b_N&UMMIQ zB(mSc)V&N5FjRfDrB`Stu0(cUe*Ap-%f!>zq`fQ<`a%p>Qu6D!4=OAd3ornaM>P37 z3*I_x)L@>n?vDKBC%q-@G5^EO9t+Rw;@c_1Mj>oA7ZrICbi2WJY1i! z5WDbib|~IDSW*%(4Wzh9rpXm-MqV72a80lN_E+k|8vt_W3ueCQ6?sj0M}++j<)8BU z!NJnDe^aQzm48l7&V14e+RWHwz~W)p%3U0Ww$i7b#`v+Z)U+$4%8+w)`zSYLjMo!L^$S5?s8_qYEf3)g@ z*z|6)(8-w<7KkL?Yt`g%Hu)uazUOVeNJL|9ktR=U11PtOx95+jUADgJU)+5k@OIZuJgZ%m{Uo5H@Ey8^}+Ns+S*{36cTblt`^{$O^ap1S>^Xy6^-A*^D`lkXKnio9@j?KJb?1;v+t;O_;&nY6}@ zM(be)KG#r!%a5f-G7)Fm(+5|^nB-Oy3t%P{m?x_q-S}8*(i7LBs${#Tbh-!a=5kw6 z_@dH^3qxn@k!{auaqg>SOwr2)3=<0*`ZbQ*5nL?ga?vtYU`~G!Zf@fhuFhLiEnh6b zO8PD5(6bo&7v<<(FpewEZ%*~XN zTGob(%SAofnP)a7EYHgHm1hy+UX`An9-vSzG4!8GRr#E4$@&ZH{>W~N!W?I*S)Osw z*6-eaA6%`49AirnY^jF<)2@o@xfOO$f zatDZqA$YKClg9t}&Cv*4^XW>zvR3%arrktYdox)ValJ+_5k{W7Kc`Ws$VS6jJk7>q zwGT@JSW^Ps^GO#5N_5u#i9I~LpS>smhzKJm4KkeN?>X(XAMVX8E1Ro*r5D{jhIrzE z@q#|AMdsV}>jihT?-$c}|7aJAA$_A;(uJoTRUNgScA(q3)qbAmk5DUMkgdP}c_Te$ zS;^6X@L_~QLhE4FdWVAlc`yM%u;-q^>&{nA>SO^*vk%{i#bNM$xwwe3!$+-mPtrjN>=r-N>-ML-X(7zh5X#5EA&TMO=mt^LDoNo z+e*oVZE1#tsndTGLzCeO5&NThFVa3Tw8{2oGw*ZQ- zIPhre2_s5Nv*^B;8Z4SMsj_#>PuXfPT~3ddO8Gdwxo&Wjb%Wol9OdWdf|}T#GQ=6V z;Z2;6UL-x)QP~VG$r&RWALUTW+US{r`cVL;XpBFOOj+)P5gZ@Jd!=Ul5#^aZ^tbd3 zdxIK!Bm{M2t>(B8&83Z;51X(dj;kR_{sZKh;U%iLyZy)EFU!C$JTk6VqGJ0NHye&r zQsvk~SJ}%07F%k{1TJq~gG9MY*y=c@)O<&@TajD*$iYIQcM#0|RuM8RSvk(3ky)7% z{RWj*EzFN9!PS9BRO7jzi^50Vbj)&@ehtB@p!1y(d!3G?njhvhg8kWJc@5Z6kIX3l zC~JOn{6f353bMb=!VaDiypZxKT{g_AP#xsSv617#6RcmJRa#rx6CSRDT)o|Qz!a2E3o9TN+9zmR-A5#Be)xJ5SEe%!%K9D>w}7+8LC$F$O}J@3YZ zMb>rP!#N?`Yg#fQcf&kC&5qn^W@M*}n;T`?-Nm^;9`2ZLFYIBge5LE{3T2fPsOe){@$Y7j_q9OgZ>fH5(Hd-7w8RbcBSG0Nf3pLz^Hr**CW}q6 z$2k7*IXb>n&SX{j$fI0rDb-rj;56D25#jAhsL{%E_0Cy=4+m#luswOH5;IqWxGVN~c9{3a&TB?X|;9dGED-6;W6Yi>v zOdKdiDp1pPFCq}i!q&--`&AikU@DqO)vPlCu|U(sh8{HkJ!^GYwGBgC2C^&z!N7vJ zkppri>fqiPQs-GQ&)~aQWs%opxD3VRC6Tdpjh@iWcvt8LDDHCYQAKyQFO_>^AiOtZ4-p*;tx5J8jfx6RjY z(!11|OjRHm38J%1^ z3`Y~O&2I!I>Q;~Di;Diwnu3A?hTc7!YK8i$z>@HP*yW#V&NCE|`rjeU|NWCV|DSDK zPX(XrUTmzb<<%}^jV{=``d*Rc_0KjKY@Fl?KLf6zSvNx@29_b2e{8k?+J<@<<4D?S z#&VY{0{kcZUJ3twuj6?cQ7gW0sq6L2W`+Jlpjw$Exg~SRw-C>^BsnGfoCT2MYC=N7 zxJW^60*M0_>TyHbF*YHtbI z=#?6yNM0yqG0fMy8}LB+NqMM@JsM4FIg-uG>(&8Xc5y}Udmfe7hK{vg`Ajc^g$qP^V)7oHb1@yLS?TnS$#Fgx&5k{c(LtYZ{BloTo~Ntd#kCi7m!|^5c=vi z6iC{sDPtFp&dkzdw%ZbP?zvo#lSx+wtI3TYF!IEK>Pzoz3)-aAf?}%oxjt}kXOH3S z;FXp131o5x$G3PsdVIr}v>#cfMrZ!JX^`08{Tm0u z3@~Sw&KDPe?>X4jT|%-FHeMJeU7a73?pH%L@m zYzLN@2*1z)i%J*;G+${{aBN*;`iJHiNGa?SmX?J&J)V(pc-)8RaPry!btfhwQ*Rx< zxFsHv=jvB!G4yq_qj6vY)b#Wye+V@#_Hp*cW%IjMXl5@g-?kn^bxkz62RA*L38MVNzA8g2)6C4&Ve$GF+b2A?_eNHvLq%{l zR_kLLE?&ENSOR+;--lXT^gsR6`+NlfA{1SFy;545p~QqltY(8-u5*{4&J4}TF=Dr& zqcb4CPsSaK)d#Cv>xnEylUSFvCBYO%l)RK7-;s>8jWko%Df_&PwL-#i2O;XF z;sL#;2cAVQ%bLJwJUS~QpLsHTT-mtW>;A?w`1DmrVrvr)0r5ljw-JL)pD zE}xexxDRa!ubB9i(08j+Vb-bQ-rh#Q9CD>bnOiP;w8XWqH@yar%C~ed|41zgn6wYQ zyY}8XT9y-;GTg&<%FHjxmE?rPOdvmT2`akf>g_f}H}6#)7v>t$U{i^A8604bI`!|w zFmIAd4fvzjupt#}Wd;<)9>ha~_S?%I`!?GZno$z7NO0Iured@5XDO=F( zhn3ap#6cduOS;8xDOUSQXnboxPh#tB>Z#FsG21RcJ);~xpb-66R{xMKG&BtBEhRmE z<}nPc)-J@XC_uGz6$97%wUE``n9Z2@nd>lVOn%_IS#ir#H?yLHYOhh?So61dS*~OU zT$4_kQtD(FCHaj;7n5TK?~%+#^OPt~A@-_+%F<+oec6GY*3=aywrn3gSG=fVdMuGe zg}uhI_k zhe7K@MS&d4u)J@1l%y6`Rtp8F11Y#zu==fF&KAo%tZ=`$t*gn*XzVE!`%KLmFvbB2 z$`;0JhLWLbg2avxwN=n3y%Ot_6L%JAKsuwfM)Jo#bW$8Sno!Lx)d~kXaXj;+`zr{+ zXP}(o-wU(J6zV92iX+W3uIlf}4#tSVj{;^Tg-cJiGPvUOHM+e#aBE=5kfm#c_fz7; zxOx89#;LEgvuGmWRQg8@ar(m)XL=?3@A|`}(U%Oj9IX{2%wJV)S%u!lWFhAmu+k~! ztx29x;eXv{k`T1k!6Gj+&qG);TcQ$@xFDW+rJ_@o6aBmx=@tD{xmNPxrQORZkIp8a zSWkA=bT9yP_(=y{3@-c^TYg?)zC4~yNF54pQLmoA9y^dto6`YKRFnh*oE#RYhilXR zE4$D~Rr=z95>@BUhD~~fyaG=9!IMNTlZLj4GR;KQaJHN;Db@BPkx^mN#IEAHm=ydY zb)!uchO8wR24|y?UhFq3!htz`qQFSr4-GWFxTIqgOApieCJQvVkDX4!4PCv zsd+-mR*LEa($8;;a&Nxpd~ie_vH1F9<%=T(7P-J|Lt|}0<%CsSHK`!2-}f;bY=MX& zJI<56y0ERmEwtjV=|W+wAzN@W2?_ZXirqZ@LW z#K=+*uyJu#4e|*nk_us0z>McV>^KNuP5sqBX>~cg?2&uM5#TQ!=FW7W-N0VYK@;V+ z_}D@0@a1wAT-Qz7lK+dZN|2xvW9--nH ziue;H8My|xy?gO0?t=Ey;NI6jzp2$f^_uSOZ<1{ci%YI%?UD+j%a#H3R-A?c+A_)b z=4yqGFg**e3WOfk10;sSbm-4M`5Uam@41Bfx6-S+BKt=Y108*gqztzjbyVHWKItmL zdxa#y9{GkVysWa+Jj&-3eB~OlFA`m<@H9BZZ1zx{^GP&T87opnj%{6 zEClfiW$Oby{muxY?uj~8ZhOnj>qZIdyRd=px2ZNUD&0f<81Mn)Zg`76j83!@A*ldo z)J2dtKf`U&*Lj=wSVGA^!$RF_rHwP>d!(Pnr;E3UL%QqDpHa5TmyOpbC|_Pm{l5y9 zX?`UeeY$2!_M*}J0J&za&aF7Hb! zFG2iVViaA={x#LvDPHj13B0W4la`id+8a}_IZ7iP=a-Pn#SKkc_kf)wSuiM$q?1Bi zhTI-X8rA$)yNUppN!9Ho?8XXQb~pHw$KRx-R*jh{Z>->2%~wJFxHOXs)VAN2n(Y^x z;l|jUFeS1$HvRRuX7fhI%@#w0K+liOdwC z3pgzEL1aFEaN(nL=$H(%w7#|Iwze6VDx+VW7Q%)l1P2?ivZqhPej`7$cRk2v`Bn-> zxY5aT;x8r-@y^VVoy~7=5IfV{tje-kP55p0mY4SgONd)G+Ox#9jz7M?(-Mk^iwJlw zg`Q1J*4iOn;nGOkEEJB`EELd%*DQYEp6;!Dw{#)-(luLu=jH88??$Vr?Q25HX1~ew zKrWP@qRUzVnNuhSlO@sN;nKUKxorA>zkfZxzd3J8WHqQa2~AB+EwI$wSjM8Z)zh<0 zlyG3Lc6nX+H`tZWEn@J?Mik7;n`{Gw%HBd%M~!}$ZE-=p-h2G_}$zZi2J>QNZGZTYgg&i5*u#s84>iz*t8Uc3W%0u zYG95T!i33~Ur+AKwKvSP{E8xE^$2ikE!Z zXIH!GnA`FTfPRa>Yp|Pn<8zYhFI5HflqX~)o^EwMg+SVqF<6xx2l&+Yr=S{CcRmKc zpc(_)b^M_`qC*fxy)gJ4Mg)jy3S+4woc(FE%S3up{p)8h|8C9xn*_m5L(vCPlHMJfn8`W`Y0@6fSl^hd5G$js-NI zNr8@p{hxNH?KTJy11H#NJDhA;?zWnQm~c>)UfC6#_a{}HE<#fL-5wEqddG!xenT+4 zZ+hSuno?~A+${yZTS%3AZ%U$9v)DLQX_L`*!^H@Ha*1_>_QX>F9Ok?)qk}X;9OG{~ zG3J!2@?sy146phQ)x91PB`z%I=2pD#irm?HU?oPL-wZ4|00u#YcbKp$L4ouQZ?{V* z?u_p-AckxVZmjnG)PH=>R|`FC#*vNEoE7IMYUAA~~v-JUj z>QP4OEf%3!{kXeYCG1>=+5=!C5y4lxxI zd&ndv;D_iH`{Xbimx%|k;qfD77o=M53R|pF$Z)R>P%_K6)e3nQ>nHd`{+CVWp*HoNjeV!fc zT796~=knR|8KzXJB08p$qd=gPsm0maO%mlxt@-w+32u(JD6) za=SvCw|}Uo!KYnPJ{>?Yt1259)$O%0UGV+3EAyPNMjPBxsUhBeq|y53@b`mqZhI1M zU;z<&#clN-UH2&y=5I!PVz77#)h{9MRXw>Tcm=u+NR!ubf0Hj@RfOA0h+LDM&^o-! zL6A-VOQ4wT(4}WYEHIMQdqt+TzC~tpO1Ii!P6vIY8m_fUQ2&JSk)%-}y@Ihyda?PK zMOis*aK;AA#jYVxoF2WNF=o`-L$}{OJ!~ifoTqe6Vc6Z(l$yUkk z$JdxTOxec8S3~D~xEd$eXqmw3rPG(gDP~r1?9wC#TFa2@=~18kNlx0PSD@0R#=V=S zI)?#jV3rx8sQ>l@>vKVEn^~D^(2RroAs5-Z*%#l~OKb2=ur8H%OEp!0pzWu6QA!oZ zWQ3%IW1nS==@iwgVEtQ%kNn2prED7HDp%vAWH~PN#w&sQW+p3jMi0RXH4Uv2KAu*F z%~r|vvuUM}68_>QWYO}q7s#d z(V>R+KE~IVFo*8xnj6HmIZTEeTM(>W!pxXyDTYtUFS#Qg0U2|1x7BU@bkp)fEfm}~ zOLfLCEYb)kn5FE6PUaUYzphgGk3=XaqLn_S$(6XcxR@|M0T`rabkseTI6OT*UEA7x z&vJIa4LCl#q`UK+Z?JzRR6w<8mNqsvryD((GmVyGn&scu5x%^~Fen3IbmJQa$;RZ* zB`&EB;{)sH3OC=x(b6&chKFPNw);!)z^V^5xm}z@XB=+9N^vr@2{OeO39rRDgV42# zROC51+Znhko}8Xp=6}kkscXen9*c_&MWNl@-$*1qJUn6oW?QeXud!9nwSw1Pqx?L) zyj;7lrs8{n^2yhKyXToAM@b;~h5uabefw7Fc|!B)c?%`x=ks?_zI0MPR4)Ge_pd7) zyD{~+clSJ1j!y5zwaT=Odx3c9Ap*gjr5w0brCG(z$*I?1hOUS9^Y~mE%@TP8ySqHl zYT8?ZZ?z50RB7er<}SSZ7cZ%HzKPxEKQuPx_h?`2kftbdpFh$^~kg&0y@+ zVV!{i2&2sl3{}ziIKBlXlmzk<{yH3_sFf}mylbx{jG(fU9_==Jbfs&*rUs>KCCP*a5S0bK=8)P({9z{>Je%; z<=e3Rb{!2jx+fqYfX%3li+f~1negRxFcqI`_vWjieg4N1W;&zHw)LnsgliJf=*^>c z6wD_L>e3U1d45Y+zF%aU(B@b1^a()|Z2{ZZM&K`NYu&^oM~6el^c!vLQ`}^;&9N7x zf};pXaXW|NXhJB1N-g3kgwJ+H4iE^%M*K~spE*C*hH>%uE$>1*G+NVf`j)}xd{SsB z`j0UQmP7KMtH9|hzvO=}dInR8$yeAsMY1e!RFBC%j*HgGR3EwZ3^<6W=<&GOac88- zXXxCz6W`h^=eQ`0gg}lby~0~iH+j)`FAW+?1E(mWDHpZ}Oxd72lU5B^`eqfqv01## z1YoWfoogy_F4UoW<#yKf_mX}Op}!TCSS^%wxtaKW8)?tfG|KLGFl)sbs1(amQWQ#S z-v&P39-TxNN(@Itye(1Xw;0aAB<109Sk|V+s~?*9LYqRY6eBax+PxkjhM{f+8#rGPsY=g z>q|D-L;*}fHd6ahhqIxOddoS~H>h4$(QSX-o1V%KpmUeUqMpc2%!j`(ao69z6WBh3 z6S?~yx9u5#UitNvQD&z&dwmTqu*G1GX6fk?M0Gp8;v#h~N&`<$v?TQ_T-(5ffPVv$ zZ)*q?{@4xj7D;RK-W-{By*rUFOw_5-2lw~)Pfx20?CC>2s=rYir@#1mCFZpAwnQQ6 zBJ1xMe`9HE{4eGYQ6FWgW%+^11;!s#Wtpfdh>0(>bZx>?l>0+TL2#ynIhYH!gW-J5 z;osBEzWc@jVK!O0Lh^Q%QVsq&RNO?;ow&l(ms=Cw2AjFkIn*7Q+_5NtORX2?3bb>H-G1Hq)^o()T`q^0GLr6}d0 zk@Td6tA-wRZLMjQs8%p({*h5jPAgHh9!R3IjyA?cF{62H8CSlxQ1%O0<3zhtr^S7s zTNEdpu?^8!`P`(zo{se*E@b)?b2bp+Ag{m>%7tNl;J|G%fI5T z3(pTQUG0SEImtK6^#5VjD%6ESJPiB-=CGA zh}G8CR0?}`Ry}$Rv>LX6!6MJ{vEoy=1hOLotIL}{f3)T@d7-=4@Id-&cXLI#V*0OG zH&YB>Pmsu3)slC5Pa+J;d4Dvj2=xZM2L=XaXP=n*i;>LfwT*k4`jRB0Cq{{Rd5>Up zoNv^)^j}f>r2=mw&fh0je~cdT7qq# z73GUZ_drIZLP^r_syTfUTRfld#ok1d^)oZEblhGcsm964SmTDv0Ms4f*`^IM#^d|| zmwS`kiPE|ym-6}aaG_DT?Iwg3pjzDjFX$Bw4b1{Q%C$&7hLVzluV4vR^3d)Ohbrf` zqeN(FsmJX+YLG;yon&YC9D079>MbUIq6Vvc@|<(+j4t&TP;>oSThzlK)51{|$Oh_u zpjn|x*Zk;TiM`;#Q-ZPnn81)W-BOu0Hx}z@T6NMV=zrVv_0tb#ooCMwa4l2 z(zz@0eZ#2k3)Qz`I_ld?wEJ3u_s-{-C~FMY(`-i7Qa|>a%+@;@tfhT;uJD%Tk8)s3 zT}6n~*J>i^w)9^{Xj{D1c2CT0e2rVu)3wT!+Rh0_7rbdQd&>?dj_ATEh#S%o4#xJna#&2pU}qBfgd`1*`*b8c|gP$TJ>Ve5FMH)Tz5SIq(yLhve^-BvQJ z1lUz}TfD37VIf+b_Br5WoaC7*O<)U4JJpGO$WlYE92?^Y}ru{{9}~_WQvC&@RH$Qm>m_ zWmrHx3DwK@pO#L_Ntt5g@;=)V^gOCd4UCQB1}N-;oU>F7zI_ngGZ&lzFpp~2c?UQO zE=~GhV0KDQFvCG=rU#0AMUK~RdH{~G^K?Ka3xQ8|1l3a2ANifP9CR~20vW6?|ITvG z)x>615l^)|i5YktQHWZb?J2-)^5+E)j;1BC(Ia78UPt9K@DTl&!}F$}me_$FN$s`Y zVfpO1m@}8H-RdbXKM$6kSFW-I59$sa+xqwC0xB%=h#V_)jL^Q^1V_i$nWJ1U zhBdSOs;^xJLu0-o-HKJ| zbHDtxuDB-#QGgf9IIJ{m$k(>=Qq(nAWtZ1YlQG3$fr(+ z2Y@osXNX-ox1IP&V&(pM-mB;5&=W>yb6LA=bfY&v9)H0YNboQs!|!@faXr+}qT7Qi zA+r*MR!%{s3^_)`?$X3*dfu6jZ$ty^IwrR(r_S#%wLu<*f!&N6A$k?avVqiHW4>3n zo^y)H2OQsHY9ngWb2;Dd(Sf^fsmM@y&b>={yJ7FsKjfnF_ib;_r5XG;sYFs8;AXAq5HkdW zsh*jMIURG^Z=~TY&IXDd?o4o78!KiNuKU)e-ps=NvU!-AclY!56-x)lSij^z`1?4J zu^347eYLp>4JGC2tBR0_HcOWuX_Arrjm;l4nCF?O2oP>dO@IX}P3iPfN6Lzqijk46 z;LOMZY?OPq{1%NW*@WJb@>E$_*+}#OPS7!#ZoAB`k~^<0+I1TB80QA}H+(kln$g|* z@~gJ{K=(6O0A<^bN+ed}!1;7QH96<@A%HWKmX3}_jR|ymR$iz+w8yk~Z{L?Xuhp#M z>o~>(xK-dV|6t9Lsz9yN;%hv&vEBMofYLu}n0fwaQzQ&?=kslqJ}q7>NlA9Y5!C4; z^}V%Y){wzWnZ0b=&4@|Dwh;Q2~5pwsU%xx621 zu-NGHXqsQbA}UNH8xD3HY*)a3_~?y4#LUviZyOXcjW;i7onKpQT}BC`DPhG43D#PA zngA@){fgDUUKb&%=t#tZ!i?t_hP|x~|D`x7C~%EHlx-_T2qA#xu%CQUOi{xj=*&b@ zd;LbOkM|KTTJO_ymY~M_h45M-_jmEvR)TWd*&RZ{V}zx&ei!?>rk#!y zLVpE2N%muCYT+IvDI9WZVA&=IdeJ;t9 zUs)zz?YwCm-JYwz5QqUc#>?_%XKyD$7^%W^u3xNaot%nFD|XuEeWP24ui6)?45Whf z9af>-Y$iyA#JY2RCUND(*8G-R>Ni}{C7XT3oi7ccV=GUyeb6qN6d{~riiKvzNjbID zqM9lk3$r3Mi7ItqE6jdUW4V;Fz0O%>tAXG^`c2w#qpf0}ctz&fv{^?1(cG-05~x3W z$dJnQp?nOxe>5g0ronvZXbBWw9Y~4$Bpu7g9NJ&z4G-ILwmlqd0qYD_&?qdXDuu=5aVK{-%nItX;{cPj@|7r&$!X*=&Wd7MpU9Bv}?~ktSaS=QnXNtgO>P zkpA%PuX`Q}7n~!?i22He9A}BF5F=$lPKTpWM!K5(y5oPtc2Daom>-FB%=)G+9^N{u z!;Z`!k)m9*>iR0fEj*icy~>WM;riaZjI6B|wAR*cbVS+HuXK}I92><8Xp5u17z3zA zDeV~~Kna6FiwKjR#jXBJJp4HYvOsBHnwFcBh&q!a3FV1U@^1R$)yjt*xF4k?f}fx$ zVL)E6uFS#b=>@VW)bUVv_iyFnv|jPZMS z%YE6l1EWc0HIEQbyLI^S4n>rRmxUz;&{i}u%+V91S@d6?4_06*dUC^zp2uPeRcA_` zk|YW9edrE_AOv?dn7JKi)tSvXwwKz=R%^sf)s-uX$+ws=yVk8$DK3u%%`OLv^hS?N z@iyUaMEANJy1YnYrC1&h%dMW-gH$FB7dN+J^TkHT)wZy!K+Ek3Xnaa@h(vsv3eHF- z(Yqv9UOQk;C;e&eep<2QlT*H7kjMnD3nh$;`lfR*mhD_%m%Fi;YU_yIXDug_bWSoH zO>wbqh^@OXs>_{8Pi%NoFtzIQ4ti8NGsJRYGJ6-fixqE^tZW89yg&5wgG(urp9yGI zsK?9`5@_#MsI|s`V-YRRrbV;lHKIb5wmOfmlKn=Q(n{{CRm;W`t1LKok^2Pm9d(`$ ziLGkCf4jd2h0O{j%}qk&s!HQ5y7g0bjh8Vm8*Q1>0QFXajd~mV6wDwVwyoac|I*T~WIPGBCH z&^TXldeISQHe#5L!S+@Wz!HDB;Mn|>HWX|3Y>l*QE?xwcDPPpHJdU}FfXJ2yWlw3v z9c%8JL3JFPn-`{1)d%a4n;L_B)@qG+N+5O`kA3A_N2Ap&lM1LKTXLFhSGGV#I`h++ zi^2f)1q&6@^ZgwRoLwB;$Xw0_u{IX1_wiYOLBBMSgP)RfTEL|{JUFmL z(H3sKhja>lqTAj5&G=)=M?vCO`hq>WIxdm)G#Y%aL!B*lcgn7|2RZ8pN|7P-Ox_l7 z3;#EF(?5vre;hv}II^`x_Hd>DGNWtbF9W{KsFtvG!8o}=9Hm)?YL}R>JJ8-vV&bs~ zF6yJxTcw|rJI_qB0}MjIW~g6rzc%6})yTn%nboorC&X*yS;f=G$erV|Q(uAh2OZ@^?f)q= z4F@!aySZYL^=byZ9@e;nj%wUhr@z~&M7>V^#MiiRuNjIj2v~;v)~z6cEWiU$hBf4q zuRL?AW+UWLU1wh2%i-iK{JFc5rjf%z^eksYCnf?ez<9?T(L~a1D zp&^@v?p%~0N7UtINHT-+Y^6qY^;XN_Jo!%L1Cce5%exv!Or?2^O-)Ui`foki6-TD|r)D#=GMAQ? z>g;{Q{Q1)g$Q|3K$!BfMF#^zr`EAxV25D3p6U#>;j`0(J9(pKXQzlE(~16$4zX1kweu4G@Hu9#V(kgMrBR0Q!)edPEmyFGg>_?@ zV-sGV3;4#$gF|1$9^~ny4Tn!#^w4DG9`lT@Pe`WiSUgog2T)K>^lo&WTu^u7(=G+{ zE`2U4L*<((v}dGg>K6H->DjxV@e}`j`yr(^MV;PS5PJNBc@$CS>T!HU?nkenpU2t` zpP*+k$oD2mrFUE*l&2;V^=&JX$7f?E)myAq%x?B104umHSc^v>I>D}!oHO7Lo~=T{ zix^o`e~*VdV&9$iG?f`|Vqx9SkuQ2TA-F^DY%O<(Pk#O@aGf8F|M{%4b6}hHOVtj2 zAWC~uEh>YeP+5C-ye8x-AApycnW<-xx8Iz$>bja!$SokH9XWDMeVS@*j{ykul@y9Q z#L1knxSQnKvgHPFg4M% z|3&-2EwX#}S$UrgkvF&MN{@};KSgGKK3$s`biDJ|u^#qF7l)ZMJz$30;bG5oWAuHW zgRkG?>-aIEcdtp2WZX^N`p`OyrM#ouY=%Bp+gXpn;S{D6RS6pxFZ#3eaLAi$0;U=3 zW4K}?A%b+iDpS>*=)0ilF*BACQp7zjGZfXk_1OGo7VDjCy)HL^&(D=}eJOTT*t@vO zs1b5C+KMg2WZ4_Y786JZ1BsFpE~s&QvayiSXl9f)u3235u35xp{a-TcUF$ljVn`RI z*q+b8T&}G43#`!IyFNvp69HCoeLOD@Lezm$$krQcfOu~ zrd$O!HQ={KBNCkRM3@zZeXXUh#*2%Kx3;!c5(P_vj2lyx;(pPm+cLU#e(w+oIF!my zI}~&G?xAUj_Zmn|*VITI9tt7%q3h8=;Q3XX-gv7ud*+#zzpS-P#d6;sZ(OxP1xM2s z%m3*ou^(OWF`q!0DH)k(96P4Yr!HU?8X5_vIhC2>6XbYxJ2K08_DoH9Jm;bk#uFi@n?$S}DXybSFl%5f)YJ7q#7h7`mupnNp)Ul; zS@xC5_67lu-|FVEmqYbHM{K~wM%(mWYoO&U%S50-Vuhmh_rlSiN(jpw?~ah@c^u|osVakJGhj`XCgIVXi^X(W zs_*gSVC0^#4a8>_(Nem)jsM`^D%gxo((+4_f-<5dpuAQB+a3$p??&3rK!A?z>OQ)Kn%&GB>9xX=df^_nF#8i0AH1}h35~J?Wtf_-kI(W* z^-M&BJVXQNe5aIS)Y$Emh9S}p6q~vrXC*AJ@?{Y@xl)yd{I%K4gsL&Xm99(SQ=nRH z<-qS(iMmjIPzSdo<&m2jAoFr$hm+~1;R@laT@ zFP@T@{igf;H%V-%cD>2^`g#V+i%-x`eC)0`_e8~IWv+br0XvekcsDmU0K=Ay>R11e z&))AjCI>i%$zHMm0Ki3MasCH)$oo(IPo$^Ih^M_P(a$_u@pXywYuhXPQKOsH)V`??oCX>GFUX+v zYi-!!jPoJx(NX`LNz_W|>;Gv3@86Ev6+`D9(#ylXI6rj0x(j22Sz0|L{s#oOv=Dv& z18@Lq`KCOR4+5g4lcU7kHDaexUH+uRx~_!J=5N1S`Eadz^9Z(4R8;g9$}6xlHa7l@ z^7U#XEHt#f=ZQL2ie}bdeW(nv3~p2{k&BCqvwOG`3VeKi?(IUm7*$JtJsKJ+c|!&N zf0Zye|9_e=Fv1FQ!CPjE?G>ThiNbdySF0}IMElvh?U$_KS_N|G5+&A1B~D%6v85+B z&uOzf&E#4I)Pgk1FBa1fikj@>#Y_04ZpoS(DW^%<D!N)c=@n_~ZJgNa>ts zB=amALccf3zj$x%ok>urE0|YnuB_jTgOjt7-*snxadB~JDf$~VB_$;r8(XM270%mc z$JG^xyKOTwiXSCCJ$)G9k?1*&u|30B(QfR_Djt6Rh3@Vx_*7Y5UY>M31v$6Pht_NB zxYDvR)0eM*9)_-U4~v}`{m9^dX0$H0htjzOZD;@RKaXdE3-Y!DJ)!lvTen*ucmloq zPt|khYK?03!3|X0jISBKUUf#`(;IW+r2z zj0n5ADa{>dApAFfY?KYHEI;4K%*-t7u^LHP0Kh}Ss(uM$Nm7kj}&b1L17hy>aQlZNOh(GT0eLeBmUt5@@Ssc@jDVdxGxS0G+6_F za9B#f?Fx_Q6RwArD$#^5)1hG=-ny)2F`p_dr#|@R>%~xvn{=OmJv=rHJD!{F;x0aS zEjV4L{R_$6_!j=ym~Q4&?J7FYZ=K(?n1LH)8tlWUI6@4=Ew0wBpX-f6hqJT(=r5lg zrNd`E6w0Nq(=>p&>sY6nlRmwCa6cy`@6yrHnW(kPHMTOFtmnX9Gb$j$ZVj1_X3X~U zOC_lz;zHSKaU_*Df6%I!&?c-^nT=Bsg4}*BTeH=EN!;h2oWa{0PW z7>yO^uuq++!^;Y2{m?Zb3Ln7D$V{9cibS>DRxO<;WL<2Nco5E3&R=PPst|dGviRl| zb8&O~Kis-M_fi}$gCzpD>#I@P@qElD50VW_E_6$@SeBk^S+jG$)T&f>EB8LMAIEi0 zieK#Xh}jT4D4PPB>sc3=i;>HU;Y**94xF|^u1@(jk}P{1C0RpbE`e$#suO=_Vi_eZ zDlae!#uYyICn=B+B$p{z$&B&4?xr+v>Sc1CGTJ2ebMZ)JE@^`D+Tz2uMthWHiLxR? zgiH(}sK*0W2<2;lT;|Zs!pR}-ga5_W0KT&F*z;?3Y0O$mp8rtVDgJkPA3I-NGq#Cr zq!csLk7SF0)5n%k6J5i?sv%@->2l~QLtfhuzP{I(*?h&G*ZyS?Zwkju5!a2HWMvJ7 z0+KlFFa_;I@sxKZQdA=e6;{m^Q>tnj_YFs=`Jswg0@fXxFP;$Zt!AtTDpV`DBx=on zT#qt}B}>0%P(RX*Vvtoz{Wz;}Hh8NUg-yX3@HH zs+h&as9ugEjMq%CHYZW5?2|fan`&79(e35^hgGf@FT1uQ6+$6MQ71kUu=o#)q_onz zucr8FxcL)S=rrkr3L}zk9|ws}IMvi{EC^$y3h4a`Q><>Nr5F>d_|nqEBfoh(!OwLy zm__6AAhZ=q?K`NP|5tnG8P-Jmt$Wlzf>aR!0YO2EfPm7aDu{HH4hc=1c?qf3EHX(aP`VvzQH%`s`j=SD|r{?Bs6p?>H zeY%B^DbjrZ{yklRezqwpBqRg~@2>SrhXr&&uQ0 z@9i$UF$$$2xMf!6=o760)kc&*z0%O(%%=F|NAE%e8cDFQuqduhi#&2G65!`%O(f&Z zk2_K>(&ria0j+ZDRA||LA7%Z3t~D;q@_qE9@>k_YQkbseA_X)xn%IY~+QBIGK?KG% zfdr`VLy_jAB3fNDI@Y_tlFZh`XwiF5FVcSjMGd=ZMk~Y1GeHDbykXW6=heyIDJHjY zVJ(&LOg~yXH?FT`QzAU_O>2B$2X(W5r?s(-jUqv2=%&c4)sVdeAaA8*y46`vP!c_I zzHL?}ix%P_jO|8nZwe(HsjRIRzj`W>qi1Ua4ps-@{t1AahGwa+L*mnyGv#wZ|G z>0Ecd2lViO)Xb`s^xGX6=m)y}&GR7c;P_v~Qn&vz71h5TNWo*Wd__X}=+X0mf*7d* zYw2vKwlDY~dm+D0>ze)J<12SE6g@)D4?UI-D5I{w12QMB=g*%rGk<|yk_8mqDQG*N z|2n$oHHc^YaG`ieuVp|N3tPej0S?ZW|M-0W-IRN6RwP{O*mAxocdnG<%Xj(SPIjc> z2liP_O7&yYk^Ke&f`(cc9ekg0zCbvq23tRP)TI>j`}ig&DqurNn3(X-6ikf+*Hkv! zy=OLK@iE8|Aqq*gONU&_=U-5kIqDs}JH54uw_hmZbZxec6Z2TmsibP!udbLx{yE)| zT9I05=i3{;W0*3d`ylSHz^-`jeR#2S=IFWWrbD!7pszbGJpUSIV9;=qOkrYg%e8#Z zWg~|x_S5H5iBMU2M%lf9JRIyvxm8*KatRXJkyXp@($@YJ=TL^-DZu6Ru?DlNrtl?F z^VrWfTBCkkE5#TYO0swjlg+s}s}okz{l(u zPeYFzuWm;fJ-h8(s!xp)s(&XQ=jUubKn>$<(jGQoRM1hAn5#aK{_+X9*D_B<0tii#E~79kPc1X33?rx)~miS0<6eZsh{U1L+K5wzl;{m7XTuK`1Q8Pd4F1LIYT!J zwBpfnu8WJ(FwM851+THmk@sR_nhD4SL_Qv;#OD74pTU)*? zU#5caqd^a}3sq<0)IP&VxTh_nHLwn0AtkSnD)_e!;_nw@mW6VaqLp{I^ZFg;)O|4_ne^ERhqlLp%~*hZc!GdbJ928RXF=EW#sH z#f3&YfwE7;RZ%XqpX+5WHY#N$;E3+GnOF0Jbj<~)XLWusqU~w?ASr?`SoVS4a+my` z1}3HXPt&}18GqHzloEVbs#>0}7mIvvZt=%J9?<;Jv@!ApLEJC+Vs@cE43s_8_fqF7 z-|(09#RsQT9i^nv;gm}gq`V<@F5fKw65t8;ww%18m1u5T_RqL$VRy5XDZnbpq@bf) zb(m$d2u`R})j9n@T7AthO>@txa>4aDw3;-`>|e?3ckaST zzImyo{!kbXYc`N=>GPbQD0h56+_!P#Y-(vLEVIPFfpnI9K1Z}o zhDBQ7?zBF+L-};QGrXc>7sl6q|wJXiJUwJj0!uXg@*0n~rN)8+9XHTV$v4&9BM7 z!Wj$UuvBo}_LN{IBdbY@3|{>(xH*CAuxu!`XI)ne|JsZ#cKBL2^&bcb0x?VqnZ;J)KH(he&`d+bjclXt@X#aPwGcs%NRKE@U|{j+KQfk z?7|{C8h{k7q@whqK(V4%%W2b2s@7wTpuI&S zrXIz9?A+4HHW_vlb-Mf=X1n8Fc-$~pAqR;lx~G=lAZDRFKUU@A*F{+7VQ9eqelT^A z%!Wpp9>$lj=zzVtGgUTLdeuv{zVWu>R)z{Y3ufP6`ttUr_T$C|?@1pF&K5ae>!ReA zP}s0@!5?t}2&3^nnV2*m-(B952c)F0UzaDwSdAz@h#AYrhfU7Op4xdd z4?I@WO)=TNX3`?!8&rW!MSO~@noF4ctTimW>s^?8K1LEq;Bqk$fav-vBbZxz%!3BC z`dyAk0^&M@7^{Z5(J@+;cS4Z{aVLTdg8-SQrY&}=kX`Vn)|}knNOG}X?9v1}^{768 z)y3Ioz=9^N1%zy>V0C@20^S;89LTbBs<=40E><&L&;B%+kebnEk8y7l$v-|8JFPvn z`pCC!oxVV$sJY~GI{2u=BV&+Aa>UQ1@1^y{WabAU5jFGgJ1`HoM1D)vWRFrC>;7D1 zr(c++`5z3LCs4ccA&QPXK7ZZXFZdMKlB<*%VC6#@X@V|nBR*dEcM znkavMbh4#k>lAnF%cD7EJ z6gf!X_-y6(+a{ggMGDT!%9G?Y^HoOD18(kpHPtKeC-mAyhE1WUlV)LpAKBSrT2OZa z#qh5po>SF^Wd_|T-{xvu3n%$hXQNoIV-JkZg*M;Hi~tUD>&PIJ}!e6sYCny#{aIO??q_2l3l~lFnX@ z0CVT+Gx{O9B52xKGg2mI)$UIIq*Wb0aSsxnT_&MaKAm$pKTX?#GXJs7=95lH^G#nHUA8HB&W;f`UgEHTM1rH+$Vhkfi zorOB<%|4!XLm$e_3EK%l7a%r7g>_i%0mnnV5_*JS zUef?y;j1C2aFziCxmH9OTV^P(pqM;9B zS+9;gp>$}HO+2O3mTGie3`gQfp%1MYD?A5Ug$ds9-J_jt`7~s)2p&c%D+R{7!zz1d zIwk!Rm?y7TV~-TsdcrC3-t5H$L}PVaeWY_Y%yUq+RVF)2-A$U;__bNH6@qwpy?S-G zPKo<&Y8}5bcS|xWRQnY^6$GlAL{}YO)bzTk6Wufbl%l2yu zv&@vUQx=`rG}XL{XJGs@exPCHvhb(U?DAe*Y5M8usRh&1m1>1D8#}7yks~>R%_w@| z6AaSU#H4-dRC?%dSzuHy)%oOV^=TyVqg!>ov~~-*qxJifB2OiDP=v==cQ9|6L3J7o)ff*IR+w4U zdE{HVl@vd_n(T+W<(ITQ8)_dqB7=|TMgB#jP{-Z!H0VthXn1YOFNbY&Yr!84Z~v-d ztA512gxQ5BmK<(LNq~l44pJI?e)t@;w)N8|KOO&s&~91tcVTl>FWHglqmD3z_;qZ0 zCRCf`2+NHqj>+y?UQ^i^GQxD%NTgmI>Nu@E(}qxGejhx^om=0_XfZ52;bFZ@&NNLw zQY~FbJF`yb#M*_{&U9=4*{E9`v{tLP90CmBZrfW(N2d9I;Ym?_iO-;)eww{AH55y%4QZq^oOBx>{7tXE zDkfmuK8STgzlkA(&AA)ize@Sx%MBJVa%Yac<^-1u@Kt46o)v3+$h8#moMau^fTh=z zKvw1~{>6?0Z(Fi0T+%>NC@{yOzDrJ&rc;fRm>2eKG zV?ST-Yt<5BPe6X+IG0{pXYsB3j-0F)Tks}K*B66Xc{^lnzcD%m3*H?4 z(yD1?ZK|T-dHToD0b@_Tr12WnHw0;2E3*!Z-|2?e*OxZLp~Wg1R(@?2bi?!-ocj8Y z`Eej{_{biTiuP6iB&_h;{d1%}24XKUA3A1eVNtMWP_g8M2iX-J)_b|r>w3lR%xvZ<}{c;HStjg7YNWppNj zoj_>#Y2S4l*s^5lX}YFwl+50iw-%9`VW9n0FV0-L_C)RBiO~l|gge2gy9CfT1^KQF z=9qr3m4)b4;3kv0+#BjS^IR0t0)*WOK)cAdVM6pq-(=XL>7*>k5RVZ;XsFRic8u_3 zooCN+2YVHo-*&Q}6^wE$PKt43sC>oAxqba+T8E{{J~)tV5900oXDRF(kN&HM)7^Cz zlO?A4m~SR-D=sJQ0V8r)kUnmy#vU?~K3s3^$SzssHV$z|TI9JcRJ`V#M&|D1lDk{I z((t@ZAgDBHc$~_%RAFvQb?vX-x#Xm2fm%IiW@vCn&p5AcEA4oefM2~pn$Jv8k@nZ7 zJbRAt!G``Kg{Es`^{ma!3zl}pj3k0ccXR}M_eQy%XPnSe+}Awb%egoX*YOAk;$32+<3nqqE zA6QFC!!A~*v(mg+Wv^)C$n*Jpg0ph|t(=eBj$x2`w<{Z`kHYR< zpl!{Kn>4{3m2={&GBsA|#{(j^taS0WkGbxvH<&K=oRaJ`=Pl{`JtUxU&`G1AdAQl{ zQ4)>{f!{CEhs{HV2O@8q_ik{EJdvUkFnfEMG#jD;@x38y*uV3{v6x8B_3TLASCmg9 zeodAo*S2YU*Z1xdA0CZg3jQA);bVvP99N=aJZ#Y*q-y2WFRQtsEyQ92vh>ImJ7uT5 zs~&@LU`K7e?GADL#5#AMs?zuuh9PhRtoGYJDVw)Qo+!h2JS9+3 zw@$(=Rnl%4_vz7F%atj4 z4AMIp+^nZKa#d2`66=-YjaWuO?qKikh48P$9Ua_VMI3!_U%#*lm300iT zEY@9`VmiVd@MpOu*1xD<#WY`lP6JYG(l&z`3+M00aU`asjNe`DhVq@BtwVO%7UV@= zfBI9b$8B1$RC~auC$Uq?(-F-mR=jgG9G0Hr{R@@mkg*f{@=yUxEFDMwN6@;(V|bx> ziq~9G3-k?>+5sAl+vp+m_E{;H_RQs*kKq(#60*9O6Woy-JG|MBqmmdcV~C%z5nTO@*9O*)!dHCg8Lr+7{jDw;ytyzywS>{ z+#mgU>JirqoD=%j35Hj>s#)p$+4lM-aDC44B^Pu5`CC@ePoh#Q`eQm?8YHRaOSpTk z@e}rmNDf#mtVb55=YS^E`)NQ(nE-r4m1jF1_xVuuT#8vD%^$zqq+v7oN#rbC~o*AEy+Ikqq9 zT2NRI$!4DUot14ABgN2<)z1O$)?x4f38GPK565Wk&Q0BA)z2COAMv7wA|1UB_$K=n zCL)T65&63A8MhaKdm3Xg?#gh$aUHd|Xb6Ec87UxTJDI!`Y3CHNz9-a+leTM)MSXT< z9=mgpn92#^7VJR*-C1o+;@qqe-R1_mS$N#teV&GKw{e?f*2>X@atkWf?h#8KQn?Vi zH=%mZ<_&ZO?SEqW4u3s>W!E2%#d$4CG0a=G59M?ZZ)A!5aP6(HwmFrJ^i#iu*IfRimCO zf=k7nJ@dtC1N3cOeJNA2;&RuSq;<#(wIhb76ED!t`VQz- z3HH2=fpJ^j@9DMAVK`!o%|C|U$-9rh@S-F^rvAcbI!H#$e8}@BF(7xx6i3rIXQ=)3 z3Y`ihir#X3ST2b)v*on8zuSCmVMNmON(+!u1W7vuaERP$rm!Hpedcm)BwwOAKB~%P3l=gG`e|sOl?>4^7Fg?Wkr4Iw)GJhP=Smep@7M|+X67e zbmO}J-p+DY=S`jJc%A3`Dml4>pSJmasvg5wo(+F2hg@!wnZ>u=LxFN*KVEAwDvd%0 zI(9O6Zc{CYEgqKgIIV0ld|UN4PcBfq-DZqWWl}>tG#7C*5)XYY2#S*C)Un35u(-{r z1N&jwzivdTw@{3acLwX~>5=k1i5%FdIL-)_NXHhUh(A#(25{EnGJJ&%yVi0ErO z5f$gr-cnW#K%zSDPvla}uK-os0QUC>5$~!>z@JT5TQe;F+^L>Re#en){Rk! z&@(JVRpB?6sB62`aBwDT23Q;YNWJ%k<1Iu%+rU_`1T@*2E^X&LP1+%M7b0sP!KHcG zwP;>A-u*7JTH9>>0kLHaZc`fGXY{q?1(&by#2}4?solhR*jIY^*Sbj!^8i*cKuLzz zQVrm50htYbx1$ts)NZ=4qmbRq=*O!u*9>45DkPq(a3`(+1>A6Sczg~%2&SI@Ei3EE z?wf{kE-Ou<22huRa(+@a^n>^-iWDotm@Kc4e?EQ%=Y+^~3;L>Ym*yV#1PZ03>6JVZ zKCrlJggw;E5~_ZmrMfH?^<3@Q%+xSXW3-4{8&W*dN3(ZytqfmIPQXFpk9>1ujoK%P z=)yGYfdd_0(2W2cNI)=9lx)*r(a*XwmHh+b-0`mHk*%HG3wuu|C*wz<(O|TW3=Q7 zeOmoD(1dUktY75mC)hxJsY;EO_oK<+A7Uiqx=`J|6t@YRECkv3{6oJ9bd}7zdchpV zFdecgLCXB@9t%3m{XoXQz-BGgTso!e{fXc2-Ur{%T6rziyA}pqU4(8YhuR4|L{9?_ z0$L&f2vLd1#qUsuZ`ljqq5BPjto5!8s5Va&>@jT9JfP-{pZor=qM{;a-Ymd%y<+#4 zg)gUmOY#JPzAO)MTWeIYy z(_Rvn$?(hb)jDr4VBU+@8grb#t{^Y(1+a=%yS|TPNqyjNc^C0O2B2+g11P5kK*BTk z*~3(4`JO$7mv{N~M`MS6RTyM>S~s0ek-}1u^q88V}oKttXB<95ZKac;AnsO@9b3vNX&jvkJ*Rc7^c`~M=>JwH1T2O6w504~y7PmS@AU6V^t5fkKu!8gqI_7D$aqt#yRyAhe7o zG3d5=X=0v^+HrjmoSW!XNCkbbjvm8920W+{^b&PTR5>)K)7i zV!)dBPhJcIu~II;bJ*LhXw3XlP>?ERzs@f^sApyL79^?A6P1Ai!a6}gEAXriRgG&`IdXm()pKW)GRi89dw0tL93y8bDl#*8kCFW__#7s1`&&mz8+HI z!*#dF6H-a9XzY##2GL7GMmC(xyEK|DLqN``4DJTngg!@GK-eG56r0|6$$o6YGb}MW z$zu{o#I3ViyS}g`RNfbQuvIG!Xap{&B8gPF(k;2^No^3?M&226j5x^Vy#fjj%7l}S#+TJgu{W_+pH2Q*-w?@D?v3X>( z77i@)&%eH>`pu$HPf?w2W&h8v{R30V5EG?R?T(cn%K6&z>*^+)qZTe-P4s*Yg$vls zkNz6#1ucarCZ{F5Kju8C{$|CeuAx3Y7N;?`9(SY}A [!NOTE] +> The policy type and ID of the final output policy will be determined based on the type and ID of the **first policy** in the policy list table. For instance, if a legacy policy format policy and a multi-policy format policy are merged together, the output format of the policy will be whichever policy is specified first in the table. For more information on policy formats, visit the [Multiple WDAC Policies page](deploy-multiple-windows-defender-application-control-policies). + +Lastly, select a filepath save location for the final merged policy on disk using the Browse button. Once at least two policies to merge are specified, and the output file location is set, click Next to build the policy. + +![Merging WDAC policies into a final WDAC policy](images/wdac-wizard-merge.png) \ No newline at end of file From c9c6672bc3c1ab923aaf98951317500241de05f7 Mon Sep 17 00:00:00 2001 From: Shannon Leavitt Date: Tue, 3 Nov 2020 12:19:21 -0700 Subject: [PATCH 021/825] Update bitlocker-how-to-enable-network-unlock.md Added commas --- .../bitlocker-how-to-enable-network-unlock.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index 092a234e68..b69e88d45f 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -124,7 +124,7 @@ Install-WindowsFeature BitLocker-NetworkUnlock A properly configured Active Directory Services Certification Authority can use the certificate template to create and issue Network Unlock certificates. To create a certificate template: 1. Open the certificate template snap-in (`certtmpl.msc`). -2. Locate the user template. Right-click the template name and then select **Duplicate Template**. +2. Locate the user template. Right-click the template name, and then select **Duplicate Template**. 3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to **Windows Server 2012** and **Windows 8**, respectively. Ensure **Show resulting changes** is selected. 4. Select the **General** tab of the template. The **Template display name** and **Template name** should clearly identify that the template will be used for Network Unlock. Clear the check box for **Publish certificate in Active Directory**. 5. Select the **Request Handling** tab. In the **Purpose** drop-down menu, select **Encryption**. Ensure the **Allow private key to be exported** option is selected. @@ -135,17 +135,17 @@ A properly configured Active Directory Services Certification Authority can use 10. Select the **Extensions** tab. Then select **Application Policies** > **Edit**. 11. In the **Edit Application Policies Extension** dialog box, select **Client Authentication**, **Encrypting File System**, and **Secure Email**. Then choose **Remove**. 12. In the **Edit Application Policies Extension** dialog box, select **Add**. -13. In the **Add Application Policy** dialog box, select **New**. In the **New Application Policy** dialog box, enter the following information in the space provided and then select **OK** to create the BitLocker Network Unlock application policy. +13. In the **Add Application Policy** dialog box, select **New**. In the **New Application Policy** dialog box, enter the following information in the space provided, and then select **OK** to create the BitLocker Network Unlock application policy. - **Name**: **BitLocker Network Unlock** - **Object Identifier**: **1.3.6.1.4.1.311.67.1.1** -14. Select the newly created **BitLocker Network Unlock** application policy and then select **OK**. +14. Select the newly created **BitLocker Network Unlock** application policy, and then select **OK**. 15. With the **Extensions** tab still open, select **Edit Key Usage Extension**, and then select **Allow key exchange only with key encryption (key encipherment)**. Then select **Make this extension critical**. 16. Select the **Security** tab. Confirm that the **Domain Admins** group has been granted **Enroll** permission. 17. Select **OK** to complete configuration of the template. -To add the Network Unlock template to the certificate authority, open the certificate authority snap-in (`certsrv.msc`). Right-click **Certificate Templates** and then choose **New, Certificate Template to issue**. Select the previously created BitLocker Network Unlock certificate. +To add the Network Unlock template to the certificate authority, open the certificate authority snap-in (`certsrv.msc`). Right-click **Certificate Templates**, and then choose **New, Certificate Template to issue**. Select the previously created BitLocker Network Unlock certificate. After you add the Network Unlock template to the certificate authority, you can use this certificate to configure BitLocker Network Unlock. @@ -167,7 +167,7 @@ To enroll a certificate from an existing certificate authority: 1. Create a *.cer* file by right-clicking the previously created certificate and choosing **All Tasks** > **Export**. 2. Select **No, do not export the private key**. - 3. Select **DER encoded binary X.509** and then finish exporting the certificate to a file. + 3. Select **DER encoded binary X.509**, and then finish exporting the certificate to a file. 4. Give the file a name, such as *BitLocker-NetworkUnlock.cer*. 9. Export the public key with a private key for Network Unlock: 1. Create a *.pfx* file by right-clicking the previously created certificate. Then choose **All Tasks** > **Export**. @@ -220,8 +220,8 @@ Here's a `certreq` example: Now that you've created the certificate and key, deploy them to the infrastructure to properly unlock systems. To deploy the certificates: -1. On the WDS server, open a new Microsoft Management Console (MMC) and then add the certificates snap-in. When you're prompted, select the computer account and local computer. -2. Right-click **Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock** and then choose **All Tasks** > **Import**. +1. On the WDS server, open a new Microsoft Management Console (MMC), and then add the certificates snap-in. When you're prompted, select the computer account and local computer. +2. Right-click **Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock**, and then choose **All Tasks** > **Import**. 3. In the **File to Import** dialog box, choose the *.pfx* file that you created previously. 4. Enter the password that you used to create the *.pfx* file, and finish the steps. @@ -246,7 +246,7 @@ To deploy the required Group Policy setting: 4. Deploy the public certificate to clients: 1. In Group Policy Management Console, go to *Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate*. - 2. Right-click the folder and then choose **Add Network Unlock Certificate**. + 2. Right-click the folder, and then choose **Add Network Unlock Certificate**. 3. Follow the steps and import the *.cer* file that you copied earlier. > [!NOTE] @@ -336,7 +336,7 @@ Gather the following files to troubleshoot BitLocker Network Unlock. Debug logging is turned off by default for the WDS server role, so you need to enable it before you can retrieve it. Use either of the following two methods to turn on WDS debug logging. - - Start an elevated command prompt and then run the following command: + - Start an elevated command prompt, and then run the following command: ```cmd wevtutil sl Microsoft-Windows-Deployment-Services-Diagnostics/Debug /e:true From 1f6e2b45bb0ffb7bccd709a236208985eb82d073 Mon Sep 17 00:00:00 2001 From: denrea Date: Thu, 5 Nov 2020 10:37:50 -0800 Subject: [PATCH 022/825] edit pass: mac-sysext-preview --- .../images/mac-system-extension-filter.png | Bin 25122 -> 15868 bytes .../mac-sysext-preview.md | 109 +++++++++--------- 2 files changed, 54 insertions(+), 55 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/mac-system-extension-filter.png b/windows/security/threat-protection/microsoft-defender-atp/images/mac-system-extension-filter.png index d2f1c35a83dcd3f85e43e6e9e24417da30ad7c51..db725b26fa5ae952cec16d6d6d26abe4627b9ecf 100644 GIT binary patch literal 15868 zcmcJ0gL_=jyLD{aoUlp5#x@(Yv2EM7-86O^+cp~8W@9_|^nUldf5Gpb=b6czXC^cI zoW1vY-*>I`Mks!jL`EP$00RR*J}zl|1wKj2Qvk|JQ06GX?r z36zep(yVdOmmaOEpIL2q7ZUdd;=9 zto+h>inJC8ga{$Gpb(L~Lb}X%zyE&o*NhTv@@*JBG4M&h|Ln<9gVo}R^uJ&EwzROI z`aeU6(WS$Zc@|BH1x6wG{h0PYe&Ph0P-rr98&73iZM551Uz(abzk-2Guvg#W4jMNY znQ%JXGfTVwl*MciIA-9$bM`ENg%DC}7fV*O+B$x-9On1tdmO6Mma#(6QQlh@9l(Z% zAKRcVKY;yIX&puznaxqPxf?}i=+M6_ zrp`ypi4*F|#Bw#NvCMK;z02@Hyw|(gD*2vgbhE=Oq$R)<9t@7Dxk&J9K;Q0b7F#CrYB1v0@{Xda|-LbW-ry^r@?>;b+T; znOxg>@fghQd{ytD!hjLEXs}&N#m7VYf}6 zhZ$KW?yL#Hw_^p4jI*CsmD5ecno~ung0GkS4{J^f8fIsI=V&du4PL|ypK4P$|FrHd z)98&eF$y}I2E&rJz5PDCXuFNP2}LF}X4MoSXJMd47=w93&lw`U3oH5s5-YM-M+(W` z))z}$Y7gv9`by+7&Hatk^Kqi>ysMzzdTEi=*X5zYjql-m^x z4hwR&L?MUE!H^a!lI9j!6LKnB%dR7(yz_p=O5Nw=cggTcAT(litNAoV?TXXR+4SN= zt;H<$UX^x>vfiS9<~A+ontf1bXId7on@Dqqt{n)YN7wJ;W%CZ1zqqjx2P0ze=r8}) zUXp@@5yor4yfrRC-Lh)UCVRo@VlM;jCsCNMq)=91BZlR(5QuiKSEEfWe`2c zb->m0uF?F(>HijRVQy#Vw;RJLg#toNZLh7x@Qj3d#rlK33?&gq5<>+grGy1it6cL=akZ6ylW1-J}*am)#Hh zdnO;o&&gwEIfACI5%LY&9!-4r4~v3RaX)43Z^B@(v9K8QI{A2cc_}F&)8n!6aEA39 z99UEjC$e~*4&=CMWtlo|PwOUq@0ZOYo&qOD-d`@ds#N=#)3hDoRi#^Hzw+OGXXtv| zL9A`{daz{x_D7e^DhFswqux4eW@aWopMnT(5K8#=WWFo`{$^%wE?BOazHXV%aZk$F zP-^n$7pu`^I$&?zbbY+p+1MSVYS{`KZMDaT+KE4>n`M({>6h{p3CSW>b4 zvHPv$X~u_jH`2^&U?35TYU}BaVvbTNwnO*p4{NVe3k`QZGV~K2x3|B|a{kbU=At4D z4S>ET&?d3S0J({xrddE^o3&c;vvaU3NrCLu_p+YFh&B72wqMjRu972dfM&vIe0E8r7UNow<}Hdz${V6Ns!IPdOjtLG6{5D0i}n!R&mLGtzd) zuFlS{uZMzRa0h#PWMIK;Gn}_z=1}xvNw+Sc!u#>E=4)RTwZADT)!1+Mrs;Z)*fvf6 zU@_Vqi~+FG&2Tbz86^x7KKx5;tkcJK80o=y1^}cyM*_ygP4Pn{UeQ=zA4(gL_q~3dHIGdS@6vX{2tu#W3b62$@X@e|3gu|g zBpOuuv?8jNUGJWS20~H?z5(QCuDeio&nzeQid;jVDw`qThkvP_2u2h0;>bq(Vbu3Z z;3L5l<~gfV@q{ZyQfaE`p+zqjRIyJ-?DMYp}qTVNw>SNa^*%Bnh_dl8ws&l8A7(TB;ETYs)M zbY;Fc_YbAqeai8E{&AW~v2n_7uf2q8I{&bxu4JIC@i~2al~;^oZ~(1l6i#zqJ;gko z-mLUw!0_bdrJUk70gdo6h?W9j$XIw}q8=C5n4Wcv{#@&! z(HuV$T4qb-2+S*~u2eN+AeoZ~SIDbR~Vn=GZ zAN~Yr-3JE;B2Ia592v+WqH+`oFi?i-A`~?s8!Jo8URL;PmFP$Ri#!2Wcw2a8jqv1) zt`A?Rlq3GAfxu9o_oqWW-zTcIWmr;ge}5&WEHL;=VG9eo)GuGYsP8!Qk)W<@7J=yi zNwnbX(L19OghR-BQ&@X=GG(Ud6$PXB$=Sh*qOEO@gONmQrbgtwL+QM2OsE)z3QQ6m z=j5{X1@ktg%6888>#7PuRBzgICMqf__4gwhw>_T@AbCPdpcIi! zTt)^Cyg}8nhAODPm@LMVK^S#UOU?-MU_gd+iHp6tbhKELIER1fCyv z_tACR2^hV_&eMiRIg{Czw}kdz{1 zLFC%^u1t^ITI>&(&$Dyzp{E6Mex21~r4JDG^49le@#>wX^Tm&(X|cYdT^FYCqlL?K zUJVl3b=;{ctcY^=O1I4TykDhRr7^g*%D^BKChofqJ^Bf6 zrfJO)F_h(c+Y>FVXVwSEbZ3j@DMN(Y`7eXe%xQZ8Ko7Hje7%`eSo;YlBA84bufWKQ z+n4tbirTa*6$Ia~V&P{ZvW0Wsfb33$wyNV^^ZH$fD0uZS%Z;QGl@|R(a6kFm!9*6~ z>K%}RQlN#Zix%AFf5@jXp03Tanf}4!b7z+O{3O;eb{~JOqbkKcBXwp6BGBTC+q|)! zGW$$-v0CMqH=@ssKMqsSV_t_uprNXE7E&?BG)_!#)-1X0XxIhs;k5MjP83#u#yH7`D>jy?#Y}{gWk%Piiq8E7=g#3( z)V@5gK%Qma+hp9=dlAsQ7GD3%V45RLGd%Bj*Z{B;p#aw*J-Y!FBEX+vY>%z;yk$F- zFqdvp@PjX*LKmtDjf)b)nI>?I@?ChZ(|@Y)$ZZJjD|*<$zRN=aZn#eV0vVE|!u{*l zDSqjcheG~j%A`5^b-VY+hg4F_ym)#}Juyi--MXpoXgfr;LIm4qUZxG}Clv%lY;L z9f_@hmr#X`cBu9yD=6&XaG%@t!cymE9Yw*XjTRxFVs5d1?#u!${r=@}bE#xA&;6sh zrR6E|Q>Fiv$63Ro=YC_C^>QtcAM|LDP0iK;)$F8H-i%Gf%3GVHE-8;`^Hk50yhPH7 zVX)RNGLcpF;mW5_Y`gWDnG(C=S%c-8nvs4M)e>>j$1_69jKAI?Mfc>CH>0ozrl#B# zu9UXZ%*1fAke$^`Xc}Fu27M#=6lx+yt1l>?lG+xH*8K@!t(2&aVd2WU|)g>y0$3G*ClM ziXQ7vacv}A(358BEu!Hq3AR~&tHVOGb~P$f+i0%oD34>`{{#L8i!F?Q7uhOw@9x9v zR`2`V^O-y!iBxH8bbMlRSBt>A0$D&K-Z4^pU|)k!O|@y>GX;+l4qYR%v9Z31y*{|V zF-Oo*UIY3~6D-6LDWOyWMDSOO(Dg~Kef}G6J#V?F0&QFk%voEfcJ%%p-cYr*Qr_$$ zI`Wfv!F08S)mZD@omq~a_ghv{D9QzFdQikFZVg^qN;3V!-p>RAPJ$U!R3 z@4V4Zk76t!j?-I?g=f}Uo7!g^-gG06&~4(c8ROe~8ZWq{jI&w*BNB^@6Rti*K!b99A3{1+?9qi-$*SCXtpyLRoQMK?|k*n>-B?@q${aQ6dO^cL7szY2TT|&0AU;zUk!U z45lo_h+D!yBQyp^QQ^-)b-%Gh7P?SGO?1!sL~ZMu$dBb}nKxgp>k#SY_%C+1=V0=4#A@!Hvk zT&WG3F_m(wCTibN@YF>>U)ii)0%&D$qR!S3R-s*gM5m&s36?SYs*ZxVW&3Mh_l2t|j5V#kfPOBOp7 z09^E|=a7fMiIKDO^+^+p>{hxe#pgN7A#r>vmKv4Dbfgc%l|2!oE)~O%Iiabbw=~rA zGj4kh!45B=jdX2$dreRA%^BKFi>3~GW~2>;Z;*_^!5rJtCnE6QWf7U{uQe@bs2L=T z0r{0Y_y@H9iy6kYNDv@(1(yNv$qLs?p+#R{+>H$lS>RMK;YkqiinxqZs@4X;1&Fx6uWgHnw-LpfRhzAsW+f#3w zv}+J)_=CofYBHk0>i4)EHeaSzr3v5p_qEA#-qGge1pAXJ07xNRypKJJiLWEy92;#P zMAp%2YRiS;WZFlD@wtA;d^Vl3)`>R5OX{H&PjBS8OUv#McX7FUeY&|zf$DrZ$k4KF zF#+mMHEjoIBwRQF zcvo`r%g$~BR1pdMX*dVp^HITGnTJEsU&lz!aLN(~4~-pq1*?iKu=zs<>+7MwhtW67Kx`4k12Hq^t!5HX~qb67sCz!WTh zckm{+f3uqQ(1OvUKa&o2SUkHXG2!bKl#!ZQop63}fWAKdQ3H^wQe$tcTnt z`1RFl?dIw}hLlOG5kn>nJSZ=O7<>>!w0h*=qpo`?seeaiS&o;$Xc`o7Xs8Kh72dOq zkIYxU*xirx<;!?sPlt$s!FEZG@AHP&#qnQ)_*1>t9o#n8Gm0)P&3g0czg1nfC+tm{ zwzi*xfnr>qD@&zJm0aHU4mzd0s*03Zzq_;e-`z4Oo3~`7r&mV(J^j4t)N$Oha-m?b zqy2d?8lO!Hr4W_?!9&DT?_0ZYphGf1wV=OQ*DVhlw+~D1&eP)!p1Br)hiBy_DjGBo zZ1;uv0eOg+w^uW-^fy|%{D+j!M9~t^%le9b%iSz662`9O<%rM0d6>^w-;GBQ2rr|~ zHZDW&7+V5GSWCI^%5T!+qYNGK6QD&UD)-7 z3TX_(O}pXlmopr0K26h*y6}b& zS#JSk3cJ|^QSFLHWfPb2MnWOJK&}i}#CeH(&~Wd5Le8^jcnx+8%{M9j_s3meDtJ~< z#Rz5ugYtXR%z#}8KGMCXOTTv{^_aw_6J|J; z(i$~yw@?-&g3Rq>ID2Z$K$9<_CU_hDqIdSiQgzYKSK;@?ag}+p`U&~zEWQ!3;izcIFqd=%BD??}mOT_E-8qLOiC71N=BZaMGbf|0+ zd%i!5qB^HCPT9J0A5NBESGba(UJP;x;Ug!l!WxMS3NnN@`X&GFN|i1|w=qGwo+Tnp z*HPs>9i9t^VCU}=*!oN8uRSU%M+hgA-4>VY(xtXqaZv*!k&#%E^jmtGE{5W}K zrR_vf!#qTflXDv#z0kPY{`zQF#hsmQ=f#qwKDV+lr~;2$XHA>b8A7jF?$Lg~@RV9v zj0U@Jg;_?79C8g6iI#Yd)DG$P;ErJVi@>eYxfV0B%fMR#5N+-3J^=KWLWy+;7~%2k zig&)s!*A_W!rr9I#Gey08MJ98nrPV2`)w#g5_vrJj>UwPyV@iK&ZBEi!s69qen002 z8?%584pyRMGL43C9_SimXZ(QG-NJ0kqI$-WF=CAhbGB{YtJjZ%uq-xxZojOL%#7mD zELJ3HW6Ea7K~G`D{9}B@da$%)*3`E*2V8S#6rnwTId1}AoM0_VNPF0yCjR&4zc>l- zdxAHA*Z>-srml`^ydsnx3waQk9^Qg1&TXmH#mdx_nnK%o7})E76AN25ZncrWyWEU( zQi5M)aoUkk*j}p=q}v~Z6}waNgq!1{IQNI6?#_h32_!q@ffVlvYS5YZGG4K@=fD`J1o zQ?`RqEOjx#`@s|r=Nws{?fZNTXMtYM|8_e|>if9;c(p5yl)>Ia;3x$a)sgGW<;MDr zJDmaZ)C!@+CxA8LABqtGSak)=K1$Bx-J+fmW~|GqO_PqxyvkC272U>gOS}mNbI>o# ztDOO>h4O$ujM~j;jaNl!x`C=9#iV|(4#xNPZv0Uq(#Rbjh#&kacYeB;!l`US5N;;* zm*MQl)Fjii5HgT}U8Gg{G zucU$4HNMjrUmP8E({=#VPbdm;WXDdQv}!&R!nH8|4L_kTHcu-Gg<|33hpmBSB93%p_yZd> zu2Q=MPf0iEbS`4HFCDT>h2OBMxgTy^TT1#$Ot7WRGe&gO@(0{~W+RbXQBiTK=npti z(IG2rqBFv_)1(QCVtN4)1h8|;IWVCRt_wPaOW=uP!PSa=7{KOt=Jd8CvDzYT+; z&OmTV?G;*-TUGYjyhgqoMK6I3?X%4|W|@D6&IM`<@(qg;;Z_CUxQ@Hr6tPOcUhhRb z+4Okpc&_TY6q5sdSnj){rrdap0UoPPQT@fNa3i%s_Un>SoPl&FHWIgJGJ+1|NroF= z+!mb6nh%ilt-Gk1nihB7=u#Na^(E-2pEHn{S7oYyXQ8#SH_^?Bl*^G^YA&@IdT0=l z#1dwS)^qKA-ujLZ;>a-dB4gJ0!y4zSsqvj#ab*5GR@8K7A56!$kMCwQ5-FK-R(NndQ4-B87cY zadO(N6AxQVI=5=u*l_=kR31MooncFkJuIy{86BJw>1{*k6SitPtWg%>i%-O~^i1)f zy9eDVt~0GRG_Jz!<6N&3O}X#ds&#mK1b-nF1(HEfLBe0OZEQ&deP1)Vo%A;?EiF&J zoSd9gmzS0ju$dw~@q@`UHa3bJ40kHZ&DC3505Vy&{N@*1-Q`v@ElCjVb31zWp$v>k z8|z%v5?tTydau)yw6r`Tg zBTgU);=IH2x3Uzc)judv%f=!?Rva1bNdaGeWFB1EZV7z_7U_ZSp_JgV!V zO*RVuPPbk?{br*fAsj80$k4s~n>15ocg}1vTxt1)RdkHZ6}>7s&B|(>;#~8u_~Quv ztv{A5mcQFy3}ydhb}f0uxrUquQ!_IxCXbvEv?_SR zO&t42V4?NSW}2hM!|J8cjzF{N8RS>rTvgZ3I+SRH4&lo#6dw8R?{}Nrqw3{${& zHf4wmtZ+J)kvrKQX1rn*4beYr~aUiXZ{Fn+=-2riUr zgZlWfIs~p|)~H2fo7zy5UoMt!;FQYh@J!p`^V@j2*2K6s-+iZgDoPR+CI|@8A)VKo z-__KT!gPorC=!Neie&FnI*3MLZa-&m+I{_rcPA-~%Anhh=QS|-3`YN?G&QnEh+-jX zxmn3$adPGHMwBPT1<{ZshHgkBBf`8gP2{?-)xf!@o^2#A0XccyQ~Ya^Fwsa(U!nY+ zx8)v|F&HwS>_aVvZmFCU{5FGz1ltg@* z4S!qr=i?Hl<}C;xaijTC6`E{!igfxX`vB8j+rp~b=vCXcGl0~*dGfxhi&dM6dh@$f zn@EsANI^-Up1k>1MTD#3y{*rMfld+MLffle## zbLYNLWUgi5AQ%^czjJqf1o8Aml$H>PQ+|qF@N8kwlmYf+c=HFE7zN6?bVm;otdTY+ zhfvB4)OB!1$S@0q@2S0HAu0Dfe%*xiOItI>brEN5e~8EQf409DtLn*$N?KJ2PGQuv z{5cnqe2E2{#8)R$^6&r6N)uK4?8SCx5N-2*aBt6rf%JS9a$3}Mg4z$!@yQiP2(JK1 zy^cfx`y)~Ivj-s80NS7D+udT7R#U9;`};#zj)2ee(_xMRiPU2^Bh#R z>!7u6lDBTv%_w=MqROdMkooHLW&%Slatfdqg|Kj=b`K0E+2^t z9iTWkss}{Nus<=afbK$Q*N(1AY!*|HWC+E60cbV70gCTces7;0a*jV{7~?>h-*yOY z{>q~UX5uqx)d7?572+)hfoQR_MBQ`}AYRj1h|W;KPI+-5W+Fn>%ij2YPZCj(6c9`S z9oHXYKFbfo1;6I$(_%!F8W=17+T5u*{J|Xs-iswF4Bt9j6U{?R{7P)c4j0bfuSK*V z^Kz}DGky9ZRLjKQPO9&9+I688Ic@9E;Gz+vva{Rl(6Fi*qR8Cq9i@>01DE95`w{TXx6lp6me(z3E-A_9i*H2UXRd(Zw(v4``u)0ZrugW3fnX< z34#DgeN%#j!p*V=@>|h02Z};wDQg(j)zwviATeNOV`T+a5%FF;3|YW5un-P= zwRexCR}dxyUQPkVFTSo@7?Anol2Ob$j7KnN=~$JpuMVbuOD9op7YVb_hPQs`D#AR+ zPDnES^IZYfiGZUeYYqlpwJ(-)wC4C8Jh11aMuXAhDg6Pa|3tsY2pG(ah($!pkPSjE zdoo>BWh8r|Fj|r-E>FBF&DU~x>9@Gm(7tUUNI;wCsfT@wxCT63kfXUYyn2qmwgHMP zWNU|DVseru>AeIKNO#&d#16nD;20kMWK2xp4?exU>ytqxVMj>td+}&mc`swT-i^6V zk=jVQaJ1p|(VvJ8?D>DMYi;nfl3c%!mEUBaE4QmN`SB7x&Pb4LGs@id%#{yLH;1+D z{*}!!nqfrwJ67+>Trb5K$C-IVut;~Sj1Y_!J=J%y{3`4FGFz4(r1n6JSy zW)b8+OBxF^8T%eW-(_EX&^8YdiZNPo7oP;z@3b#(U5x(arNpM z-q+^-k(XI$Xy|5LrLIO!$e{pqN5JBiFweC#z39^Lz>fc#}CqvgyHsWWpX)C5JXEQ z8N0$9BGL_Elt`0+lfV|d{iD7CYApCYAZyy`A@G|hH3-Av*7enf*Bo{aoBBM4bHkrv ztEhiEuf*QwXt1oZHPU@Vj7;5}FV=7-TOrt#61L5`5&_y?@fN!k;`4Ph+r(7a5~62r zeLXu96RJG;p*XV2@%cEH9qRSfxF2wg?piVhL^LIFeeGgyutPmS*9+*6{c7zPrI zgNk~EY9{Mwyyr~lhFYr_Gf?-7X!pJ(_nNwd5g@o@B@N*3vh3p))WC^h#(c|G@1*Ok8 zeZk0xSuji~Wc13Jz`RKR+_O+9mYMT*Y6iD_>A2=N#;DVY9Hx&f6Q(NMJN(TSJQE$l zRm`t?q<=q8dWxa8L3SrA+OTj|>S;m+JX3%NoHdNnHTw(CF?K&=zdmz(6gY7>T$c5^ zo;?Edbs>r2NdmqdM-h0z3!l=KLzP%K%U-XB(+Rge`3Lnbx!-<%AK@z^O!$)Kca?8^&>+=@~~WWtFUD^ z!8ck^$6~1<>rLIx0m(!@m%s^w_f!yU4;q#pCYfMP{`dnU_S>eRbLDQ_MQepm{#{5C zL=Sh4VWlgmHjKMeQ>p3fRjkcl@2yDZjYChy*dw0%MMgeJB5{F)xmiwudq25(eyAv@ zjdQ}k{GE1hB0>pZn**aTwh0H>wDDM3=np1yP>X~JWWu=2UmvfeM0ZEW#v4;@DFNE}3QH=!!T#*d(8AZZ)D9?mB^QLiJN#HwN9xd4;mEi!z6oVe6!Org9G zZ|Bbl+kWW;h41!(#-GS_VLD=%k!ikOgO_7U2=tx-=sOsLhw^Ye#+2iE@*A)Zcq^+& z$6Lbds6tP{AFYn)@V8;?MB&1|Z}*0nZ;PVx&yCv%@#cM;ME1Yuu$iHV zc){V@Y96INw&4d)q!GD_XQRx#etPOe}{SN)Jq))`jdY#nn}QD{E zpxn+vt9|Cc&mu+`Mhdqij#9jB;2i{UFZYPiuh{Nk3jfnylKPIW zh$=56YKYD)b_^shd-#K(knGk0hTgaskDen~8)(GP(_ShimLY;Av_$J=fMe2hfTC?2 zr)}QWb&m@#Ap-uy?j=v6xm4*-qQNNfkLl)~PmU_uz2Z{zJ2}rv z!Emd%DR0_eb1!~mb_UJ;mLaorPghBpU{Qc(yuZvZ&?R+u~ zj$~@T6nVxkDhS7-C&myv4qxhF5ZZ<7U&~WB(z&Trk?-N>BXwD3;E0m-p+@;68a%i8 zQKo=ZXMfIWR!zqMGgm@DpJ-Tr!@_}cD~5H~!|A!-BL$m5I7(`G?59mv1B&MW<=Q&b zi2fWVvTdaGhe~Ogn=UfoyRx?MhT4tqw2*l6l0HF;@LTk55>y2x2h|# zmCf*r>#tvpi5|CZB#4I7Q;`?(F%3h{E5i$QW<@BdMkre)|0$`$vmr1fj3s{#UmIa(e#qI5%RnN0F^sXc8@MFcPce z95Pw}CA{I$jx9dIc59ro|F`Iq4Rd%~g!WQOQHk=88BeRu+lTpvJ12oz#*#Ju+buq4&X z)<91KoU!NrXbPLzM6}=WEx-+Eb$Gg{sHph(yfrN9w)wo=1FrSj_V(8Zn(X1RF~krN zz;kzWy+4)^>YD{rpS*78-ay^J#>SQaf58D%p{J*(PdA5g_-rst`1SBKA-`^Zmt>1b z?-ld{w)-`&i;lPFyS^ILa`k`2Mqpr|S+)lZBcKv}9Nl@A$fXB*Rs&vQLZzolowf8^dKn(Bi7cm z8I-_sLHCYr>wpaPISrBCXr3ff>JKqlm~7S`0ObV%rPb-+Pe8Mf@Nhq`Ku%R&9{9D} z2vu6VAzAwcJacu!n1*z2G%&COAcKM=206jzn$AIj^8tAWJEi_&pp3fb(%FYm}Qb~F;gJu=#b*9KD z^?-4rX~Pq-3B0`ctsEOm#tbEBrU=ts7fm%WbeLj?`WO^L+0T~O%j^#lcC4m!rLh1h zGGd@HB|@@@z$wf~lkL%{pvOy~U|bpH(a%9nL;YhH{*c9DZ$d|iI?3iLqA-0wMu|kH zlpy;GsuOMpic|jd)B;&g)=$zDXjOo&1R5P3C9^a}KwwCah*cGXRRMev-Sl5`1c)iZ zAKmooRLNpvC#`_aDg1w51RMYra0P^H5q3=#l`nvH?$Z~Suvh5otcsybBAY10*XDk; z^DnhM2H35ge_H%m{j9G0b_g^g&aWa&Ar+tj;9v6!K(8R^1YHUr@Jwo=BZT}@0Od0{ z5;|y;*>|UW?tgBGp*V{qh~1ZATqij5xuS&iEqr7LF`#2f1Qc@9Cz@6W;ZqaVzqJsaclc{trx()>foFo&CIWmP0X|`d=vuY@ba&LpK@Y^Bj*7gnXGj#6e`y6g1Q z)6&u^ckvHH>O=!GEl~gWec&o?1p>*s8;?F6BTk^3l~&#Q8x?9P_rKq}VgTUYf!bSN zco<(q#WnO;_s6T3WrmT?(9eq(zSKE+g9az+`1b}G8XSn)p2Z@@ngxVa)Op*w_v$Iz%mo{5_-OnX{qN3QUU4Qnj!W zmX8i$0N#^Sc>YqKa0UfR`pg#&j(pNayUk9QzYG7o&QI6-x>ahMjX8jTH#a|@a0>uM zQawY$1V8D;W#7yVFk}l^Ny#uWIEFF6o^-4+L~q;VwbtxF12~lc{zB(7uJQ22!{60= z*fknQM@K0F)~2ear`hsDU@WobTPC%2bxuxB|Cq;eAOC7wpqWHAm7ymQY2xI>l8dYs z+m@EZ<_zdTT&&aq`LG+-EyJLaSU0WiE|lN2KxV#V^Ls4-3X=1&@-PJyN;*}0N?yYPylSxjx*0l_0TU{3k%_&(flAX%oShB zPt}_7L?0q2yMIxNP+XxWEKq9!IqJ^HkajKs|P{+bpL z{1+bI;qv-x?31sr9glX;*W0E$xF{@OP9nr8KntNK#FchSz$zhX(T~>`GBq`&P-n{+ z2ae~^uR`s)RzP$Zs4Xu?+D{1TiF1G>2cu3J*|zWgravcMpfvaU!eh>`MtxWkQzx63 zE{GOeImDOt^XJgfTuw3@4Gj(BPwnKbxOZTQm?ek&q;q%xDI+7|Jq@<@eYkTkhR>X6 z4o6aw0R3wF!~EM~-ZGgd-i=anK z6zJamqQXKzH(S|nNn#hH&z5@C-nN$xaqy5Wnc(K1QQn*zeL#^FP`X5$!+h;nZH?rswpci4IC6+DJ?5=_$Dl1NtTn|uLoC% zYBc!`n72Ir_Wgr{lTQR59v;lB&!f6%LmymyDw;oQz{5c*4Sl=pLWF=8B0mFW{OoHnNmvjES=4QONcGGbJADx1iY#M%i z1$|&D;R%}!2M~^!o*VP?1F^_jB?uskg0k=+l$4tdfL!6N<3+Y8os)jo1pEBD zqyAy6>YYpC1L=v29$3=l zHXz?r4wRrK6578lh{h%W!1%JdD*fNUXIiI`x({e4&JE05Oqs+J4qcsW3HR%X6e#7u z@8?Jz#Is5(Vc){&?DwaccM;4R{k4$N| zlqwb#;}F~6D!AXokHLT6RNS=tKcT`W=ReaNtnK5|kzEL=aqJ6-e+&bI zj%_I+p#qkWpj2_RGqbcdg@KU`Pf9`3QXj<`Dvy8#M|y%@lT4=*rWNM zB_}&G7z4(&VUst-7%;(Vg@SB=R1R*TKnV{7)>}i^_XZblP>Fbig^4@P%bq;l-N-2S zuOkvZABa@E%;quR(Idc6oHQRU88=>`okp@E9tC zhmT*vhgPk7t?%skQk3?jn=m%^G#Y3%f#+B(NyV_1@|d%JyINQ&dS!!7qGf61Zj#p& z?9iO1k5_2+eoJQZaIS&sfgxOFv!c!y=LbNYk^@H6!5;uL4!a6^94{85NTg;8`><-x zZ4ycf=CxBndK*vYKDhcQ6;TNsV09X|a97W_#3>&dgP}#|A5GR)kmAFPvV}JHUzqmEtK-vsJ5kp*q ze?tc&CF+3~hJmup58(aj9vsR0?{`*+L_2&lvWCTr zq2%wh253M$_G2E0*Ynd$MS4OGfMW4?Nk(Bg^$R{UeVNfLU;v|7&gW`_Z^m*b% zR8DbnCVXmv*5braeQ4l-!xp+DN@K7y^%ztnPMI!bQU(7@#6oVqid|x)^w+^%2q!^S zP;#E>u2BtfnS@)O;;zFbsmI$Ras6EH(+X)cV`KbO+&|I51`b+?$$^7aL|Sh?2G1Bq zYcc%x*X?YoOqr9(4C8RXI7YZ&!cp#ga|`rBY(uW-tY24z2>84?>GM3RK;Z8TT9Z8m zogy2fGzJX@If}nCL|cbh2d)!;4LyyK1y&nkcw$qB@AU|7XlwvB_&01f*fu~L5=Io^ zlI#G!_(!kp|t~lOf(&N`2rb1V^o@P^$D?1mV_MW13f>U zRRjwt22hZwlB}{%UzUiLNG>PxA?1tw)i)aTi{hUpGt<)h;CD%IX;4YCf$eXRz-zUH)=h?s0 zB+BHJP`pn;nkhfrA?-{qBhRL6WF|XT_q%RktMWs@wLDowOtexMhQ4`-QrW0j774$1 zlY%b6GVikZvQ*Qe%h;~)4E5gpZtxz;)zBsPLDsnEKu>D&FRUUzzLZa6f`f;K*q`bc z$r)ll3@-HYkL}OQPPxr0&*bFk|M1mnkBqLenGgj5IID3MV&_{6LFC&bM!@%Md3!#l2q^rTRu7xTBWYCc2-6h zdWJ4@iz$*S;3yWQTXXMm?s0H&M6)KPm9q&M-cLr^;F~0y*G(RV&2u;vx%)Ntcop8M zUhI&1W2C5el>Di2@?cV61TbmfXE2UxUt-piWwU#Yo-TKvd{Sd-WpZNF{9O0x`g59g zua@G^1w)s`bfY61raC>FWy7bHzTY$>W^IZ;N7S_?w6kqWjxZLRU7edno58Lwu9`>T z*DKd|*9V6z{J9w97)GI=L(yW2^S|ZyIAm=WVh3RhQx{P0OE1~y@i}BgWV!OX#G1rL zk@K0GTnuRDmr9#PedhjdJgsStxdXT3u_M6j!ECJar=h0lac_U^y?vQW>%O!bnp?)+ z?~Ut)H2!( zxrqHgtr6POb+kW^-x8pA zrT?B-r*Sm>YdU25#`3G>@KjS@46%UsVWab=GuT5Ok)E2%SYCRyq0-?;-<65St5fJv z*a`Ry-EzG86rKXFpsFXpccYC_{Nv}}*QH~Rygp>@EEy@S+|8O;04*j66*^8io-poR zWO8Ko*6j}Cn0xv`PBY*pjaNkn zTI?c@@%9o&aYEyRLCSL7^1j&-%I_3xGR)X)u4|6>mi98tC^@RlYes4^KXLyw|JYM% z^RwjVh4~A2zx(JppWRN;hz%15Q^tpDd%d0(vh65G_q*sjp9>zw4gy*HO#R(D`;o4S zcU=)blSY$1B;^pG;AcGzZhza)LB!u-6mIWv8oV#;DV!{vO?kt-Sf}IWzIPtVVDyo* zY^$_X>&|ti=Y#q8r61g-MdcsMj=#s0+kP^xHQP%c+ZMc5oUvC;d z2>i`s%et)6xIQI4*q4z3;O3f{pZ;J&W6Qkq*dScnwrPHnLsCa*SF&_&`or03wywwK z=&jz{w~LB(Ec5=yDo2ny4yT=7-LK7`iL;1#j?7NVm*B69uLWN~2Pp@h`PX$v7b~+3 zs~#^4@W0^SDaxvY)$M*ZH2wg!ZclcyAuWD>`i%L=e?D6l%7`&T{#&GF3;9ZRKF&YC zQ05_KFs4;7+w;+Iv8PUewlBM3A$#2C*<^Zf>RXp`*6x}ssnC({{W#Go2hx~Fj*ak+ zdwI!J{zZo!c{>^JiF?~#z-(}Gq%eUtOLUv_mgCy?rlxpBX46o!$MNUGTKQS^^3|3& z_xyvR(?3(%Z|e0{ncJ3q&4255Ek}6r-+VvLSgLqPd1`lcb9W^>#yC3mf?lqTN_2J; z#Nx#Y-y{kZiIjU7Jr}H(985`!b>--K2_L(Uq0L7=r);+$JhxpZE&q7(MR=N+7pSY> zseQca$cbDbY@NUV{bZx9@3s2m7JPEQs_DggUwM>&(;uU3nUj5~{H$=V^VIt+e=u8I z;f92YglOW$r~mU^hk=xnBh0N6gP>gjd`Am%ec~qK7-xC_dUiJ_!gDy%m{9r#N(W5? zg;LAH?|d^1X#z%eA&g3ADDpj_pD*1D;`D}wNPbAo=<6Ecqp23yOi>Z${c9N+ z1~$|Z2H~{?`+5<-UNA85@gXosuXmi+OEMSkzqPRWx$yrj!{ol!!HB6#fWfbKbz?_U zQ(GqsJLk|0CqTawJWi zj2$iQoh|KbDgTjcXk_Q&ECc}jqv-#B{$r;p#PWYM**g7g)@uV<{;6SMV`gRfzp`Ih z1^;==uVM)?wbqifw0VW+RfjMq8=v66^#8A#|Izp#&JRwejuLh@uZ+&Z|AX&e=Ko#! z|784E<){Bq$;Qq4zg7OPn!lWaEdR9peza=17<%K~w*Q-)2G%`q}Aj<{pl=B*lpI5~lu z?bmWB!EhTFjUcQ`Fn89woPLnMpG*sRy~!kzL!%Jjm@&q)H_H`_`d~Cs0937G9O|=@ zc=iLTp_G&}#(j{t0v#yHdjV;VmIEh$bJ1? zg3{=Km3kZKqazYzOum(tBuN7r)R1n8#|JkR(5WZ@{g_TiHiQQ_NzubsPuRv1q>3gW z;zo36V<;gJpe#kOU;MxfZu!R9~u9EsH^FonRVWJ2_q{`(2(ILXbB(v&gcTy}}T9 zR+^Y1c`8V>cN{*%oOqWvG7Q|38#aE3k^NvPi=UJPXy;ss%+=8NI3W7shd>QWACb7` zjWYQ4sjPbQRLt@SzPzN=eRMQi4@@2F3}C2&NWUMB1Zm*m5v=4xR~aU>;D2T_Yg=2sU5k6?GHpuFrObh8Hfg%qODuQlrkKN&L z$fD$VapKour}J50qC5-k>?3aE)S2qc$k7rW4gGle*)^8Fp4+E!-qpyf zAKVqoE^k~nvrq@8JTZ`ML6IcH1@+A&yrtpk2|LVcI~ohpsVr!Uot?D1KGq7N?-N5O;e~KMyqPei{D~Rt#S@yoSWxtRsD&EE z>!w7K)a5VNSMn6K*ZNQEYw&Ict6Ja|qV>FuVS6y}5jlnBL^E)U0rQBm$&{DnrtG z4k$$1ApH`Bw|gOngdI0HP*}l8k}>iQ4$mcMFa$qG6R4Bk=?b?dF5NFt`~q0RPZ?b) zhB%PUL_XkyfuwjWth>8M-4Ff?qRaUPYO17(lJO@L$483!-kS{0t0YMa7x2yo^^@Gu1WUwUU`W1=|&9WG~eze*UaYdD8-&ARlOga@LY} zy6vW*dbuGjcog#D#fM0}yHzrpocN8|M%U*V;YM_Gxeki$I~`pYViA9S#E=jkplZn} zUteFh79{5}VPj_xK#hpOPDoHVbX8W4#e4UTOiKEiF#9>xB$n+2(`PLUi%zU%O;|_d z{o#|S;4llZh!9rsARdgoiivseffJE`dT*nYp;y5znxQTN0PW#vgTYar81AQ=0bzh& zkl#>`%*T)v1~hT|Ks<@tx1Ztnz6PkniNz8SCyhQhON9bM2r_$2kS7k{F;v01;_oD6=wO^6s6+m>x2;GJv2eKwsa1C5`K3$XqZ|;0eiKlIC@nIF z9?V$|4)DUcB^08w1H^TPrUe+F$yy`BA+vm-R6ziQt)~V436#xSo47^J?q}#V6eh`r zeU~jZFVSg)?2n*l5R3g8YCd<;7mC{*+J#BZ!gfwU7~y|7g=I+Twl!iUbi4K>W{;y6 z#T#Ue%Hl;#(a53|EXoq1%`TDKUN9R2a?w6KLN?katdx<)eRbSfqyj;7o&V3LOuAd}td<2wFe)9IXhLSQBDmHPb9^vOao!p*B=y+JRK+l9%bMY zS+(7XPdMI(H63K=caPWXEIQkn3NdZII z*W+F$DwhGVTn|e_USIrvg149+GeA@#L?cu*KFJieq}U)ZU-SOnQ!H1C9VXtSn+t2L z9<{3@2k9-a&D@gtRxbd;!&9Mc8f1h?>|oasR(aw9fj1?QB+ zZpAPn`(y2h->O{HZbFDp==Eqb(Y{&}_wdroQ-$5&zC>BWoKi!Ho~R+xUQU{VFL*7@ zZ1c6>bakLqg%%c&@din4I9^&sp}tcah!++=)mcAlvt$BFBUjj)q zIg!HR5yM%mk4byFkwMJwR{MCIu)yw>1Ht!WVQ#TI>bBgI zmPm;Hc+r}NohYeC1T`ZfuCYpCNpc!p1UAz0dAb)0nFUtDgl z!d_+iJ77`L6Ma^*u^7R7M<87rIcpJzXSiY$W8sbipL2+e=EV5M^H zk)y83-yJ`DnE&^cLCu(~!(TI15KzPYzDNg4>YtST#~1@F74}I2vH!FqcMX}2=v@nH z4a~o0(!t3|-(&o>8IKeelpmn!kN>ZIuWcTbUHzx!{}>xUook|T`hFblFD)I>p1{8* zznW-|kQjxk_vZ6!ru<(eAZl-Hj;XYfKOnvs{=^4Dz@v0k`37GNi(?THSjO z4^s#o&4h(`i*0OBWT4t7b(#;gN!5^EqsFxWG+=-?2qeW}?=~X-pFUla#Da%=eHfzdchi4>-=y1k{C_z=()8ccM?m6!6lzkZjs~XU2 zK&IQ@3mpd|N0Ua(Z9A@U=))7kX5oKO|8i{0U0sV)C;+~V4kI(Rof7yHufWZ4rlrB( z>`_?TDucmUKa|z}lpuH+`T)eUAC^jK*LuDWu`;>(p1x=Fx$>YIQfKG;uqch@)i1C@ z#hh{wG*s>V;Ci=7@j{ouZ4)2K+$8Jse32tBFCW>m|DhuO_}JFz@E6Be;>D=INzgHe zCV{}PzNV(zFPnPX<@dh#Q#o6gQ_3kjLMQJ1q&XJ-B9Gl71352`=6A<#?PwQv;a&&Y ztMT@{jCStB+B8k2YyDd7Id{LzwI^j<< z8BZ2hpRbK$9QvQ19^Q)GTwlvE;&a?RZqbSidLC=Ia&vJJ85z%i%gBCt+{vi^`8aC2 z+UDK$7#bS7J^odK=0PV)b`N_=Gr3*z)Fwsrwksx_G`t;xy{{OtS?JRs&YA` zSAP4Pp3+{UKus(x~g2XgnVxGME}n?h= z!D+l^sz{vNP)nVwX6M99(O^e|WsDzaT4T}#GNvp& z0vVmun@bvu!7Xa+2u$C9)b?Abec(!RoF8V6vs%4>&-dWI1NKzc5WYVi>y*4bNb9%{ zx-ei!0*ZE?j!R&IO-&0ElatfE=m+T0!5VMhzBOBw5kALmyx;#3jd*cC+pbsMuz}im z_a`H|uM4+0{PecM=Ze8e_@(vOrGn$3&sCw)VXrVHJ^yuXo1OcFgh|f1h?m{$cEY`A zowifd8%ZGV?cGX`roHUU>b?<9`^(b0u)e-N!+4q(&fkxUhrGa`?YQY+D_)*C&aLet z>pWEC(U9@Lt^HxS=#Z0&T{U6r!uxJmpIo57Q4G*>)ej^73@TL!5JQt5H`% z#m@4>khfx6I62Kl)F$X{-pk|IOQKbIqqN>>0KtIg>cdKvxtrci2Rvp}($gSqPGWuA zRoUdi!WX4=wl7I7*>^tM4Ek(uadxg67kzKse9h0P$#rBi+i!bWf=*CK-Zh4w40+!y zo4cwD+)sZKHm#$5FH&n}^n4cUt5dw*wgqBgJJGjYx!1-XkTO__n`je4+LkzJ0lNy# z1LTP{hZyu;#N8*}VVM!dqGS45Oxg|>EyaW5qL%Dc{E`u>_d-80quIPi`#l&CUTukm zIa(zj(%wkHbc+6)9$Dm1=M%8*Ya8}fpfP2=)Y~h^y+VS4MuKdRm~x@lX7Wo&@^!1u z;h#&MHv-yA-!dH|4(ER&1qnK9$j^MiI$W&^4~Psn)qlCtFRZKkts}t{Ql?Aur++gr zFz_1ZLLf(!OrW!>%66Im?9NLZuDXa{Z`gY$$G45`$lmicE{pk*y)5_|e~n;XD>{62 zw|ct2GNVuoT#|_n^5(UkQ0G;nJD*S6i6Il%vU|C<>qjtia{5W{`#y=?eOzboTt#45 z@#*R5d>zww4(sEG4@qnvo^Ja^Mulu9+v$VcS%d>Q&Q^f@@mLSBAIo*<>z5oOy$HPJ zrKF@Bx05u7)Rl!m6pw32BUhtVcfWdjd(8+?(zb!wu_Dh6UYGe4@6s*6_drK(M&X;r zF+LU%vy6tS^2YI?p&k$8#tTcQOV-+Syx}h-!njEyak8n8$BjGWcSm-<4ATveG8(Bh z2=Xrmj^&kQq%B;E#};(gLX*4iNsbd}V~O{@(e@KDqE191cW*I}r^A+rz#X3qRZUR@ zweJNa9cg~NRk0dU z#M9wCQ!%J|GxCv3yOcJaj&OKwWNv=m@?M^FXDi zz=bzlo2ay@|r0;qY&_Y)$C4k!?bAqGG^e#K=s=Z>3yP$lL^0Sn<{Bys?)OvU52#AEo77qs-_e4=9I8DwOJr{rY z(Vc?kfpm#xf)`gYJ^}nYtwUIZi-wug=De}kds|*p*JVa)l}xc^3f#}o4x&ysND3MaWMH6r(f+8S*j) z736c!=%xSeU;`Hmk?)E!r_LL+!c!U2HX;pLNH=5$up}vTw|546lN-ayO)lO160bk8 z=cVj5%whaq2L01Y*7CKqkGF`E(Eb6J{O(HmBthzG#&P?HjCNzb8{MNXgU)%HcAwLk z*+EjcWQXM2&?i`R@ZmS3@5RNbL#BUp(sM16^TXp7x*7D&P=DrNv%h*pJ0VNk{{ENz z)^VMF3^!EB7fvrddAhobtgGRkov)wbyWCq$mXos(Sjp5#SbUGoyZxR_FI661LlgSf z3H(N(G0%I2AO-^tEW@g?xF3e|u)YPbmLeBl^ znKkg@d6()qro%*u*DLkETgesV7i!|L6>|!!KrPUhTgN2P7kYDKZ!JOn4 zD)f*A)kqvWLSj{P3=GSyjCj1!^0G+69b`RC9F%aRvS&O}fEqZ3QForwAr<-N#BtDO z^-ko|Pus%MWoY}GeFR8(9SI4^NZD?T(7Z`&zR#=ugf^D%XV1wG6Y?mxC^z?@*cZ9K zCD;M;b5%k>>Ly1g3PpDXJX>p*m*<;yo+pNuQGPvpbUfUgP|3^rF`thX8|edN>7TJ` z8Btx*cXkOKce32ly=d&UCpy zxJC>PUp7vLS=t|qOBpRE{r$bo>^!D2&^sqM@2)C*mn}X6ZR6iO?8)MBq%k&DRmA;~ z^!TEr;q#+x#Ds{mA_3liqR0U@=W29ynMrx&1uMvxI_QC3O%*?m@pCxyqx+KHR8y3U zdPvk-B~$I&ZT4}3gy&JJ!8}abcgndev^Jb6cmqSc%zj?7GG;YD+_^12U|Ht^FWJ_K zEd;<&1^$CxAB&HaO;XXE+K{ciBb#b(s|2D94L#lW!ZjZcl4k}Zt{7M;uNC-qa8fa? z4z{g$RwIsCzwUGFvAS_BqJqrigFi+FMm?@sh{)f~ROT_%*11n)M}8^domB9qzd-cWWJn z?8ZTTZkkt#Sol1dW=GGbN_#uA@#;87CNu^*TN-!L$YOjs$rx;_IcfRO3SKBE1LJyZ9nwyJFxWMnZMIqwM z(Xs_M+2EB{s`UX$1_2YX3USTCPZrglT&vl=gp=Z!YeDsB1GU61Y`{M&Ya{r+OBRis zm*aLkWvjnS_$vfGQ2#3!w2}WL{zxY%oPuC*ym^HJRUtiI0;et)TY_|jOG>UJByjjz z+DZDS;{7!BHYeFFb#xGCPp}d6$l|&^7exak=8hAVmAfB`zbP^|Sm(EFXK5a^=!y zV>_5NI80G?ie$u!i;JsKYUm+@W?F|zIRSKF(-iIB!ZY-fW3~0$=V!tBeP$^GbpL?# zJ)hf15lSB&q5)b!qVcs<9lfy4u4Dz7GHz-`Ps3KBvs2Zh6fV z1JP^7YuarzhQ(LaTx`M__4VFRsWKvA78G1{U=vwWgh(eP`pqKIhN|&?j-nJ^`RLxc zy)zvDE`QUbPlah5aXD~a?S*+MME|ynfSkIak0Du|g!m+L>4~&k;wO3k?k^B_6{&S^ ztc;|fQknVt5-iD{^Ego&c}YQ$l&}Un04c<)NUhCNx%QFc1OAA)AwY$deWCUym$c2U zqEy5)0eC+#kM_sjw5mhHEXtY^m=apGwKfrLNPQKJZ6Rm@uESW@$%OOAi!?P^yr$W+ zAcr>fN;%#q6Mt$eBF=UN?OL6u#b%XRguolsgup5=R2_wXM3A#d3fWF_Tp)UD_C4IS zr%C=B(a~a{1GXupY?JGa#Nv4v(gc|ip~bLREi*we=95~|hw;?4-q}T@lqHH~W}fE} z?Va95u};^Aqxv!MCkx@9n@NARLOgI^b5~m9$aqmvJ}!$#<9=|25_r;HjneZ^TDVQl zx!4Y{uxTp7<59BGhP=2M8hC>%-}aW1v01{3YC$2L0p8WlV7YSl9n0!3HbMiNbEDd~ zTw!A*tXVU)#X~bc4z@Oi5lvp&nD3q{asqHArMa`3WC1ftYTBDgqrYMKTE3}I?rQJb zlE7Jh$W@=C?WU9@Q1G~fzcGx6V7HJN)DpiIo&khjbCDp0zIiIz?WX@Hfyo+)tkR!) zG5ve;&D1Q+#!zsd{wRz+$8?{}J_X1E@VP?%z zx30V7G2_TBP_36&8Eh2c)jku2Jn-~W7aDQ{eLV{akGI#2BvIYo4eGXg+mEtMlf3`O z#!4s_9Ws&7Z9gp#kGYQ!fWQ+>Q**T5J?<0WcrV3Ji15S-{E8kV44?B+^WESEqU(6m zy7(bHwu`K%U3<&XGRf9mN;xb_a6hsI`@8O#In^$l)UEw(n-hLzW^cp%$9?m~H9FV; zbkXKK{=PFg!kuXk3oMiHXHfeXWWSM>jiR63y~HL-8c6y+X<2*X+jJ~4cKYA+Wl?ZP zW&(C=U7b)9(i8tXwZ>v}AxU!ZW$*Uj1BR^rO<3vT5*^9tCq@^B_a;Y8Up6IGKD<-}<|SGVfIfqKJk zJ0e0|gZ#_kh1gK=?>Z&@&`h~}RkFS8A;=+-Ds?!L=5rhecBnEJPJ-dlAtNM?QCL|h zgstxEmai+kv|rwtJJ2Xzax|IUO zoqcdLwj2BLf-BCM&@$85g7AZ%)4zTpkxE%$dia+_tzswQ- zEM*)I#B>w-5%)mIAmwDcan(No)kf-BoI=5T7L=RIgcOOSV0p~GE5?uvuI|Ti_gp&z zEMnwvpaF7_u_EtjT>dQhJt>ly(V&@(vBft0@|z11p$+@*R2(?ax8!n)KdP!eGB*{- z9k+ke9GwqqOvnpE@NdDjFGNe~^a`!Ee@s|x$TiQMFcr(Smk)I#gY%bnbE==NC>?e? zAX@I9IOVQUXp176$XM6r)yM2cVEfFOZ_e?Vhgy$g{?38-OOC@7-64@)2s|Cpj32xV z-=t4>$lE`9r0tjC%3k710!N(G9eck=WRXa-l#hD9m_;cm{v^&PV#VR2CY^J)xBldw zd1De7Fy$fu?-{Sb7nU6EK99VXSsykFje>~K2xD@+p3?rREzph3w!yQCghR}>hTxZZ z5I)6eFNjC2%A(()iLe`f!qxe$f&<7@)d?eLj7Po*n9Lt2W&c7SwxBMTnlRHz9s?H3G0$md&(OV4sjAKL-!C$P1&N@tFVnt#Juqj#b z!SUpYg~mz)VP`{xpF=p@{wTfaY_ydn#>+;h?uH5-R($<4Ku>lEqq+0Qi!Lp)Q80Po5pn$R-C{@h!IqYTiITO5ZbY&i4)L!dMm{5Q;OV-RxS1GRA?($}Q`dxf&{_ zKomIwmK2PQM#IU^is{mmuXe(~s&%@r#1_8*p@gfORQh+FpJq|+#ToEX;7II1MZtcV zH~oC9$x{ZbZR8{2nUyiKY&}@3EFtdzduoB{O4)UfO&?#kjl!{0)!8F3`a!Sj%Q4)( z)DP(F+c27R><{EN$@eoe)z1N-N!XLxm}Kmrb+DX13yqAx9E+*~W}5}u$d?ti3sQ3$+eNC=hUi1)38Y`(SAh$VZzogunjeRzR^{F;WZm8;kxg7J%&x7lw~lbab7dK`}uW8herC3>A`d!W-l^8kcYv;8|63c&>sb}=wojfW0 z`JZh_2W;NYMzNj?zeo*`d=YWyCLZ4~WP}Tt8|h6fy;)~nB2Oa2tR)Uus4O8~aT43x zj}d>SWy=o3u9HCt>k2~iz3@ms^g10f_M1_NkjGlFhlLL88eJDkP{w18o~2#5zkQ?K zCP-lT9wo<3(g+!QYdy$o>-{NZH#`weudf=m#G8pM{~)=a#&|tkntL-9KDB$_))g{G zO}@n&=#MYEt=iyAM?CK-`|bQ4sYCtsl&HSc;ZIEbIU$V#5tBS6rfzFzP6+kN&vu zEhIf}Y@#_P5F?)KA*p->>w{~G{R(O6^Je(L#3 z{je?RPWhjt4yLTrj*_Lh`EV$Gf5vi4^`G`Nqi0DjYMoFWJX=h5ZoW1~1H~^sz5WPW z1egH6I+jzWgWN@E1V-Q=!c*sHd(5|;w}CLDzMS)X-lg&+1w5vjshe_p0Fp!*^4P zU*J*M(|>zYzkr1j6ghbE+Ej$iw?T#GK)R>1N_2xgWx=04kp%=nc!91Oq!^tFJ3j3i=H>9W4 z=qka)t`zw$Q$aEW_Sf_d8-k-eJwDV$UKgA8?OZc#6!F++1@>muxJwQX5GT~L%y1kM z*v5;8t?aSq^qbZbZ)x28DOfJt#mRt zAg`XP_U8%UoDUo$`AZl?{?mQ_%H;f)TgLss+QcC4#6)eoMJi2QO;eGa%e%$hJ1o-s zxCB4BM`$8bTz$l@<${llZ^YyGW9mr@Zq`)jNytp1&GS^&=Ad2tV1GGi$i*J2T|xa zCOIfu)_0Cc;n9p%2y#I#-gDf3i!|=gtZTZCvLW8 znWXc!7sTX6g%hTh;`PNcYgWZ2uHfgN*y_WuD}o4`Sw9G-bWNgaKmX}!Lpa_^FJiLQ zE*s1q_IALM2V`UM@SozQrY{Amh)NZTDR5wO{_MMlw>RtXn=en+n}4~*4mT!t_TXi` zZ}@uz#lM7_^_vM^NF|0r$Zu=B0`WRAc4D00QOfZ2qlCdNidzOb@piHX1w2^znZxGSNUU{8)RFZeD9l)<>}kYF}M?!&=B z>5+a%=?~SBl}y$_4g?W>k>cEBBPT-%3zDp0KQ?Yhs-TcheGp8rA5NA}Huh47c~WDh z?{A{p2n>V+NN{4xXca zbD_WKege{F$a0g`JC1P8rmEfo=`muqe12f32?$GsVG57?`}_dV-%#VJ{HBc_j>Jyu zv?~(YX_1SzVp!LSgTi8|z}fDG6Vg68NhAay1^%}a>8V+FOlqu`apqlDsRj|IDsBDI zb87_;dSLL4coCrp-dIsGq{t;jrCP3nE7Z~Q)I}#dbc%?v3QnW~RgF1Q7+M#ZxNpCR zktRqG=;9C(&|;tIi1ZOm0OxA#w0@VpPbMsiISri%4H7MRLRJjQldBO4fl9I7)w;=9 z=j!9whlTa!scF1stl!IL)=%5~J!S+3{A1OZZk#A2oCXhJasIB`ar{uV<@2yK`S2Kms7~m{+DBfV@tOfgS~Z7XRnyQE1e@o7!q$Hd zJrPp)PmsUvkdEEPZA?~burLKO%2-gMRYdFn(HQov^t|{X60ikV$_SDcGMYkS*B%evgtL3yRw^nBn}T zGY+jBSH~a)e!9d3ZCav8VG&>uW1`Ui&WKOnuXH|A81kp}TnCH}yv^SX(qfJ$7z52K z)XX`#3#(IZr4V*u2)WA;+-J$LB}oNq7>HV#+6*+frf495P=4y{e1+Y!i8h8ZC`6^Y zQU+HSO}tL0n1g@Nlm>s4rIGB4{B@;GfC?6SUgQlCK}BHmH5M{mFbGXeyqLVyG9x4q`*C?PvA5Jys{rHKn0`qp;yT%MmF?kDN+>;FT;>U)^X zb(_u_L=RB@o*~<$el^L+A=~Y4Z-XATvxjnN{gThZU>3S8+pndCG8>Xno!Vf$02Z}Aq({&z0NgwXg6 zBYJ(D_&+wwI44SS{pG^*Pv1W7EpSnmbT)7@GQ@4~%AkIHV^~eXX{y+R-SckIT(=tI z29w=N@vm`HlDP&ZlCVDONf{;2o)BS*x7%A;T24lm828~;$~^Kx^ll*X#xNzbUMc33uBiGCJvHl^e3&6^osiB3 z!%M?XNrFfjkV;$}n!alv=hvM1VREn2&MG#|(WA81;a`8a3ARl{Hgw&VxePn`Xr~gC zh56R`oZO*RxD=2z|CahpJJS*EflqUTmfIJK4ZKO(*qYK7=E6#(=75uu#6XwfY72g1 z|A08`NQdW0rIhq{z3c%F{8b1=KxL4aC?yb548k(|)=vE%`*JyTg)9i=T>Rq9_};Dp zEv{y9lYLwOu!cs&pO};^@~v>s;nxa3%r_(+qj9jxq=Ui%>sGRb%*Xp1VBwvZg0atR zn6ohKMqrKv-b9l(b}Tw&p7?i)@+C@Ep0wD`Fjh1hRBz3R^`I!q&u&vOQU=lu;=*EV2Dh#rFI zy^9`okRf^dWas;NifmAlRWRc*0TVB5bZZw;khuRxASq6rip z+4r+*o5bUgPWskZ8s^rkw;#G`k(Km~1jebV^%UX{601cu{7fN9B*Vy2y*jZwzc|2}P-#S>QPAk}ca)IQWn2 z6+b>FGMOj8+ve8x(HxooBf?b5tSw&6_N9jcb?$yveKX2FFM3RA3)ZUcvVrl<6-(>f zl&D7hGW7z#lW?9+(ixK4kwQf>NDreyh%kWEfn@J6EFH$xuDOUV2X5usAO4&j1kOOZc=GV+MbDXgeK5QP05lpyO7wcbl!?NHm-ZCU02M$*AYE=kA2%^ zFRO|hHA9ynBKK?PM`E%2GPyY42epWpm(=Uhv*OpqqRF_j<g2xg&^dbi1WEp<- ztIl_4x_0;mNMZD#35F5RKs|hvJd+D;{?!QAH)8o-b*=dTi?>M&RSNx6!*0UvqH|7o zo_ep5G@#Z~SF(6#5vK>s!heX%jXNyo5oST##rFAE1K4-q%N4R=0BaI#b9NcI_z19p z=~_aq%Df4#T1$Z}@Z&%DVb!3Zm}t<#!jgSTt=+DRdA-~exjODtp7h>tDENfVrmpRH zh+oH&yV?_pmL}dSN(IXpg4>>429VOYEdWLS`9Xe5tfrWjpy_5SUo%>6Gz=pgvO;X{ z6bQ*wXB)H~9@;C-3(~A=+m{Ih9(EUx4LNhHzOV1Er}NBfqQ?l@q6zM448!uds(}>C z@A3Gg(=HqQdyHxR?Q2Y`3_K|nsf)eP4*>M2ZEVym4@_vpeYAhrzxST_m_OMx{?1H^ z{MEMZrtz*jAlQ%QdhIpNAj@_>0?cPJQ{n0GhxHB+;EiiR*)yl^Ve>3}zdYY$@>q2k z8+maPG6p_^>1GG9f>HOgVPoi^;Hw==dBdfUW%4n*$M^A9pHwDz>0)XLsA7_gNIF?V zK;K&qqq59d`Gt5@ZYBzn6iyQQL@@klU(f8%CVr>tPoFC+K5Quh$PFF1t|YJj<)24%4vNbd zk%5P|?#e*)M1%V6a-zLLi`qrb)G%;#sZIpDHeF21eO6RU_^Xl89VA9Y)89(`?U&uk;mm&_nVUzx&I5q4UikI-^4#zuciU8#Q0Rgc1| z!?(;m`yL#B=15Ii>8cZ*@8IGHi$7Zq|LEv*NPEyNhfvoxZF0Ha${!5c|0#@``%JQn7t-G}{0iS2>^1GV6(~r~{`Rntw&Cr!I z(Iu(gcKOrVRJz+6XC|hm&PxWty5{n){?xQAHMNu%OKJ*;LVuCIQ2%llZ7wd&+oQyx zN({3KA7gV6Q@i`l%PyU6q31om;bji+iAGNI+rQ;qyuQ~uObA4x=(L0p*6rcgCy-nJ zRD8?W3(`2{{tuOW6NiUp!rEf`X|^X*{6kw5r?hJTk%bqG_ipQ|Ff6M%l*M}dt*>}Y z%3*-Lo>1HMv!aow3G-VuF}+)ek>1o~7LZ2lP8t0E@ac>2UoY%Gco79q+@r*MfJdp3 zXx{~g!;2cYy(z9ee|y5&c9MF%etmht;I*pesG~ro>C!=M)yV@ik#gH%?1CK&we3Fg z4$t8+ouZ;MJ?!GSX(2?_-ZSFwZ3W*;41AC4~v9GvE9&; z@!~UX30bEE@dvuEcO|Bl5=a?tbMiq~#VB8ZS!jq<_v>LuV!U|(gm%b#V_(0uEROA z7(0pRIu@Ct0wl|LUl^HMuWEhXKr&RnhWqk0a9`Nbnh@ZHk(AUbg?B$&W{rmjwHOwC zzPv}m$FzzT;|;WPY+rdyml_Nqvd%?_Ce&@j zM)Pp(_~<2b)2KtD)y``{qp8QS6A{mcq^2w()I=dj?-sptm!)=WwoBmXWU-dc zj@MkBUBAyMzz)-4`mkI1?xRo($gMHga>8{YPYZ>SSH1Ql?yXWC0I8d7s1T`X1*K%b zp`tL*pt9Zpy3#G^&Ll7Q!W76X53v>ts_;W);Btf3d7sr)>c{-!6 zZK=*kXGg_V*&_h`57svD$g^p74CA6Z0;vlCZb2Qefv6hrj69oitL*QEvcj~vK|7f< zvma__43yCRWSctLFhN+t2EF^{Qpmvr25M9ry0fij*mo@97=pIG>o*hxFE z3!Iq>1duiha$i<%8{?LoO2`L)C3H7tgS`Dj#Br3CW^u7UTzvdf0GwvwpfR3C9t3T1 zS3i}Xez>IHBJ~p1jS;#>${icVMS+=(FczVVMwD2eClr8N;R!<#Vcb#){BaJ8S88$J z^7a4&fvav4W#TB^Xy!Dd^3K{fol3&GuH!>Q48tA$=2mTbsZ7{Hsv~>QUC#ZTj8{wT zs*p^HY9t~|h)7aN0*Bn&fCSsG>hqeG4({f1L$i2@XJn^%8gM$T| zaQ~mt6QjFM*6yJ@raIxoct{=2;r#2Lr6s6#vWp6b5}P5x`i?kfB5-E@Z2?OjNm%rz zUT22n5&bGezgQBUa~|TtJMPmHyU<$FzUb@~uKNsV>9*&Nyi{l8bUBTcZWIkpG0%wM zd*=Ab%SlBJa(V7TwK{cqE+isoT-V#+D1o%c!J!QK(+gm;axfi<^})LeIQtfwz~Wgn z{U&uc@E)b$tp=2yA-PRwvjE57o8&iH9lLh@6LIsCJ_c@AC(OH2)=N`e*s6uQxhKqP zp-NNh>IxqLQha3Fg4>BJJ|~h}^I9l6%RHR$mE&HT!r1Yg7iOSA5{EZ=Xs_NJ=8fQnVYay(0T{l;gA8&M;JTT8c3ShZOzJicFN7q{fFWDOvzIZF6a zm=*=H>Z9|{tSqTUo^bLLy*l<%HdXV=M2tD)XAC5;;T0M1d*vy?*Fs^HeQ#zM9^%9kd)-*_voJzwjVqk7xr175TfkpmSa_CH`~rqDSfR~!D6B> zD^pqP;U#zafJ?!)Gr^SFT}Vo~*?Ga@=(XC$VwRhTFpK5GCW}4AHsLQm$a?{3p^)80 zvh<5QV%V>)I@u920jV9>1vV)|r$VbV(5Y@_LpJrD0(=bW480R~HrN*;W9PS&bJifO zXHZDK9zcbx?bpg|-}PO~m0G&qevN2JdpRrbT?nJcS#}Q#ZiSt_y!iqvIodx0k`aQ+*6>ZS z{m*stwqmH7YSi{4Wn*5&^V|rk7b|PgifKAYch&7$SZU-ovZJ!E-v;TFHMk!1b-h3* ziHS10M<2I zSdUEqk}^BQMK~AxuGdD}b%e?5Tdf}*IEH}uC?O`=iqN`(9QFxM%Kcij;2~3|c{YBT ziz8v7xH1=EH7H2RRza?lz1mjP&w*B~#lAo>J!H2d-sWocALjIVgQ&V64ShD1t`uaZ zOPnk`Y)8#s5@+EJ$etq;$k<@>I;YT2Ws^A#lHnwgv0@hNTQa`JU1l~gp zu;fw8gL6*KCjH@u?E0te3Cg;upN?KC1l{x3XrGDYUH0IE#PwzT>WRMhZc53TKKCFY zg(NA0s2N|QW%WC;re*X`p1sM%;M_s{eA@tIfCWmGuR1QjzLdfB90U5{KTZ^mXWYZ&W zEWxq&CbecRE}Uew_hw4gP-C~MGeK}M!V9_B%9%VzPAcMhU9~a|`RlLdC}{n)wbj1gNe#=_n|e@C8JT z^;bcDEX{lFRT|2ED~|)@wHQyC&Ae+lfq5uER#zlbJzY;~oO7gRcx-+H%)8v_Y|?}N z$oP5&kL2MRC%_El^cZ))41l?_CGyHV$_+eyJZq+ zxv6{Gw)a+lL%p4K1C)Ze2WX(StSz@px0gME3?v;m7715XdszeFPWE$oIUb(ar4gyn zEm3r&=SLJu(LI<)3(J11IU70F%iBdYEh$M za;-VN7nF>H0niOO$02xkB60gxQ@6RRK#ft!boNC|C$x7u>LR;w^2}z*zk%ao zR}zB2Jd{OD3w*-pdsn4^&P_}d8K|X7Ote84K#N>Ky#v-j$0qCLnSjB-Bu?GR#6gX7 z^sB)6Ue~3J!R-#!M@57_h02uwbi_YS{n(m6Xw1A6ja>*Z&$0+An=mqFhB7buWzKAt zJO6p&X#ZMHpCWwx@}km{9hVB}UR~Mj79q41J`ZNbVRgCY{oFb^UpF;L*5_cf(>z?> zSyy3mF1#rZhP%qA`o9aReJaEr1WcrWta8K>{oOhN(M=CG&lE7>AFKU%m0k_H663JK zpjG2>Pg!($HZUS36s`*vV~t-+u=`8F2ND>%8g100iyh0G4+!aG(E(`&`_A62!g^dL zep^DHaH#vM>LH2K~%RjNMXVNqOEjQu)8Aw#Mb*RGMSex=dtdox^ z4KaVK1p)zp@=qP|VCT-?SRyw-EaZ*vJFb6+*$oV{;aj;8%fGSy@1(ej@GSd&NBoV2 z4hLdwhBG-5{vD>#AwdAmCFKtwGDbO~ey{}NsKK3KuTiXzK|8KkZvG1D+d4tSid{kc zsV(|K!ankgJs-p7=@0UpqENJwML{k;3HxZhMLk=|B(%087G}69xYgJ{jB!}u`n_a4TCfDKd7JnuD>3@Pc zcoD_-B=%8}vs#EZ>PYczVpQDRs%0mFMqik46@|S24pzY-s1XYlnj9ZbBOxJS^e!(c z;dXR&mAD8D8AxFoK#8&VqX^u1yj;Noaq;oRrKM08Sf4c(BKtOUS8aP|C&!CHE*0!?uq~-3um$&7Tmh|sS&)xria3B>b@N;%& ze;+)zlKp0jM*|hS-|BUZ-5NHA=Gv)8DJvX&M5w!nKYRW>*-pi^U&cCV4?Q;?G9(P+naKEV>_dACup0YN0xr??Zqvf6o)-0*%Y2kfB9l( zR=7R1xUeA0rz=jR+_Vci-JUYgmH3n%l_2O91TrRl^{KYL9&_0Q!ILw5_RMF}YA@ua z(_5-lLop1japXGoe>nuN0Va|R&|5C{Fq45W19+RcDM?hV=hxIHa< z(CE4#X~3Kr&8e&}8*o@qX5eHKf}eeEQ5&9gKt(wSbDKK>@zITJ%}>+`I^gn(@OI7m zcVFY3+WGkSFrFbacsXM%SNaigU30@G+P&*a)6>&MNj=%+1R*ZGv%RiP zQWzZ`{eucEsIh~eE!LQMTB1YPv2HC`WzPl3;gl@3j%gq_o{m4miikY`!ZcI^5;B=tJ`=9I@3u7K1A67bP3~WkvnUI2qiE`Fb zS>Jm3!SXHcrL3z+A9T$<{t(G)`yyy353oyED4BHP!GI?9;4#ptR+`2B2n+Y9$;e`aHXgc)+ck^Thrr)?FOEDLdhURR66rcwXlJUIM0MMa z7B{J37F{;v5sy&nkGF;`CH}jPQXMPhyWpXv*sWW2ahoYy{pzxHe3rCVKnr8(&eu8L z5%xQ?+VVv*B4|S$$Ih`p-1F}G>L-}>`>YnDX{s3?y?$!NbioaS;B)8n5WRsi9ego*xP#~|JglW@`!(hg7)K?HFp=Am@q`+^#nBs z5ut)VSBox0@xMTt<(~kzn87wlWc=@2;NPZ7V=O9EUdQ2rW<)u0ceGKRFh*<*jv=a` zTQ+4VLIz>7;`Xl`1zlvHeF_Hz(>Rj^_|fF zxGMcXqo4m@zkhRcbVQT~Z~u3MRFUljEoXZRS!WUZf4?yPG~U@Hx+SHw=B)oOuJfnu cQP&NA;_b1%)iJ! [!IMPORTANT] -> Between subsequent approvals, you must close and re-open the **System Preferences** > **Security & Privacy** window, otherwise macOS will not display the next approval. + > [!IMPORTANT] + > You must close and reopen the **System Preferences** > **Security & Privacy** window between subsequent approvals. Otherwise, macOS will not display the next approval. -> [!IMPORTANT] -> There is a one minute timeout before the product falls back to the kernel extension (to ensure that the device is protected). -> -> If more than one minute has elapsed, restart the daemon (by rebooting the device or using `sudo killall -9 wdavdaemon`) in order to trigger the approval flow again. + > [!IMPORTANT] + > There is a one-minute timeout before the product falls back to the kernel extension. This ensures that the device is protected. + > + > If more than one minute elapses, restart the daemon by rebooting the device or by using `sudo killall -9 wdavdaemon` to trigger the approval flow again. -![System extension approval pop-up](images/mac-system-extension-approval.png) + ![System extension approval pop-up](images/mac-system-extension-approval.png) -![System extension approval window](images/mac-system-extension-pref.png) + ![System extension approval window](images/mac-system-extension-pref.png) -Following the approval of the system extensions, macOS will prompt for an approval to allow network traffic to be filtered. Click **Allow**. +1. After the system extensions are approved, macOS prompts for an approval to allow network traffic to be filtered. Click **Allow**. -![Network extension approval pop-up](images/mac-system-extension-filter.png) + ![Network extension approval pop-up](images/mac-system-extension-filter.png) #### Grant Full Disk Access to the Endpoint Security system extension -Open **System Preferences** > **Security & Privacy** > **Privacy** tab and grant **Full Disk Access** to the **Microsoft Defender Endpoint Security Extension**. +Open the **System Preferences** > **Security & Privacy** > **Privacy** tab and grant **Full Disk Access** to the **Microsoft Defender Endpoint Security Extension**. ![Full disk access for Endpoint Security system extension](images/mac-system-extension-fda.png) @@ -107,46 +106,46 @@ Terminal output `endpoint_security_extension` indicates the product is using the ### Managed deployment -Refer to [this page](mac-sysext-policies.md#jamf) for the new configuration profiles that must be deployed for this new feature. +Refer to [New configuration profiles for macOS Catalina and newer versions of macOS: JAMF](mac-sysext-policies.md#jamf) for the new configuration profiles you must deploy for this new feature. -In addition to those profiles, make sure the target devices are also configured to be in the Insider Fast update channel, as described in [this section](#deployment-prerequisites). +In addition to those profiles, make sure to configure the target devices to be in the Insider Fast update channel, as described in [Deployment prerequisites](#deployment-prerequisites). -On a device where all prerequisites are met and the new configuration profiles have been deployed, run: +On a device where all prerequisites are met and the new configuration profiles have been deployed, run the following command: ```bash $ mdatp health --field real_time_protection_subsystem ``` -If this command prints `endpoint_security_extension`, then the product is using the system extensions functionality. +If this command prints `endpoint_security_extension`, the product is using the system extensions functionality. ## Validate basic scenarios -1. Test EICAR detection. From a Terminal window, run: +1. Test European Institute for Computer Antivirus Research (EICAR) detection. From a Terminal window, run the following command: -```bash -curl -o eicar.txt https://secure.eicar.org/eicar.com.txt -``` + ```bash + curl -o eicar.txt https://secure.eicar.org/eicar.com.txt + ``` - Verify that the EICAR file is quarantined. This verification can be done from the user interface (from the Protection History page) or command line using the following command: + Verify that the EICAR file is quarantined. You can verify the file's status on the Protection History page in the user interface, or from a command line by using the following command: -```bash -mdatp threat list -``` + ```bash + mdatp threat list + ``` -2. Test EDR DIY scenario. From a terminal window, run: +2. Test the Endpoint Detection and Response (EDR) DIY scenario. From a terminal window, run the following command: -```bash -curl -o "MDATP MacOS DIY.zip" https://aka.ms/mdatpmacosdiy -``` + ```bash + curl -o "MDATP MacOS DIY.zip" https://aka.ms/mdatpmacosdiy + ``` - Validate that two alerts have popped up in the portal in the machine page for EICAR and EDR DIY scenarios. + Validate that two alerts popped up in the portal on the machine page for EICAR and EDR DIY scenarios. ## Frequently asked questions - Q: Why am I still seeing `kernel_extension` when I run `mdatp health --field real_time_protection_subsystem`? - - A: Refer back to the [Deployment prerequisites](#deployment-prerequisites) section and double-check all of them are met. If all prerequisites are met, restart your device and check again. -- Q: When is macOS 11 Big Sur going to be supported? + A: Refer back to the [Deployment prerequisites](#deployment-prerequisites) section and double-check that all prerequisites are met. If all prerequisites are met, restart your device and check again. - A: We are actively working on adding support for macOS 11. We will post more information to the [What's new](mac-whatsnew.md). +- Q: When will macOS 11 Big Sur be supported? + + A: We are actively working on adding support for macOS 11. We will post more information to the [What's new](mac-whatsnew.md) page. From 059f8a3903ed77043d2b97a99c890bc18443a81a Mon Sep 17 00:00:00 2001 From: Dennis Rea Date: Wed, 11 Nov 2020 11:30:25 -0800 Subject: [PATCH 023/825] Update mac-sysext-preview.md --- .../microsoft-defender-atp/mac-sysext-preview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-preview.md b/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-preview.md index edac918fc2..79da63c6c7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-preview.md @@ -1,5 +1,5 @@ --- -title: Microsoft Defender ATP for Mac: system extensions (Preview) +title: Microsoft Defender ATP for Mac - system extensions (Preview) description: This article contains instructions for trying out the system extensions functionality of Microsoft Defender ATP for Mac. This functionality is currently in public preview. keywords: microsoft, defender, atp, mac, kernel, system, extensions, catalina search.product: eADQiWindows 10XVcnh From 9ee17c956a4d55a88f76bebb5863138b47e53bef Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Fri, 13 Nov 2020 20:42:08 +0100 Subject: [PATCH 024/825] Microsoft Defender SmartScreen: Column corrections There are 2 cells divided from column 2, which makes them create a third column without a correct description, whereas column 3 has been moved to column 4 for row 1 and 2. This commit aims to rectify this by moving the content of column 3 back to column 2 and column 4 back to column 3. --- .../microsoft-defender-smartscreen-available-settings.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md index e0ab6e4909..a25aed7eab 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md @@ -34,14 +34,13 @@ SmartScreen uses registry-based Administrative Template policy settings. For mor Windows 10, version 2004:
    Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure Windows Defender SmartScreen

    -Windows 10, version 1703:
    Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure Windows Defender SmartScreen

    Windows 10, Version 1607 and earlier:
    Administrative Templates\Windows Components\File Explorer\Configure Windows SmartScreen -At least Windows Server 2012, Windows 8 or Windows RT +Windows 10, version 1703:
    Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure Windows Defender SmartScreen

    Windows 10, Version 1607 and earlier:
    Administrative Templates\Windows Components\File Explorer\Configure Windows SmartScreen

    +At least Windows Server 2012, Windows 8 or Windows RT This policy setting turns on Microsoft Defender SmartScreen.

    If you enable this setting, it turns on Microsoft Defender SmartScreen and your employees are unable to turn it off. Additionally, when enabling this feature, you must also pick whether Microsoft Defender SmartScreen should Warn your employees or Warn and prevent bypassing the message (effectively blocking the employee from the site).

    If you disable this setting, it turns off Microsoft Defender SmartScreen and your employees are unable to turn it on.

    If you don't configure this setting, your employees can decide whether to use Microsoft Defender SmartScreen. Windows 10, version 2004:
    Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control Windows 10, version 1703:
    Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control -Windows 10, version 1703 This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.

    This setting does not protect against malicious content from USB devices, network shares or other non-internet sources.

    Important: Using a trustworthy browser helps ensure that these protections work as expected.

    From 6b778b47406acb2ea456b663a467ea87853275fe Mon Sep 17 00:00:00 2001 From: Graham Williams Date: Mon, 16 Nov 2020 10:05:45 +0000 Subject: [PATCH 025/825] Updates Jamf Signing Step 4 for Clarity Changes for #8631 as suggested. --- .../microsoft-defender-atp/mac-sysext-policies.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-policies.md b/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-policies.md index 9b20ff2260..73bb94faf9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-policies.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-policies.md @@ -150,13 +150,13 @@ As part of the Endpoint Detection and Response capabilities, Microsoft Defender 4. After the certificate is created and installed to your device, run the following command from the Terminal to sign the file: ```bash - $ security cms -S -N "" -i /com.apple.webcontent-filter.mobileconfig -o /com.microsoft.network-extension.signed.mobileconfig + $ security cms -S -N "" -i /com.microsoft.network-extension.mobileconfig -o /com.microsoft.network-extension.signed.mobileconfig ``` For example, if the certificate name is **SigningCertificate** and the signed file is going to be stored in Documents: ```bash - $ security cms -S -N "SigningCertificate" -i ~/Documents/com.apple.webcontent-filter.mobileconfig -o ~/Documents/com.microsoft.network-extension.signed.mobileconfig + $ security cms -S -N "SigningCertificate" -i ~/Documents/com.microsoft.network-extension.mobileconfig -o ~/Documents/com.microsoft.network-extension.signed.mobileconfig ``` 5. From the JAMF portal, navigate to **Configuration Profiles** and click the **Upload** button. Select `com.microsoft.network-extension.signed.mobileconfig` when prompted for the file. From 6368d5c46113b1277856224fa84ae57d235b6d59 Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Wed, 18 Nov 2020 14:43:47 +0100 Subject: [PATCH 026/825] Update: merge public branch into patch-107 See commit https://github.com/MicrosoftDocs/windows-itpro-docs/commit/f248872c9b4861a1d92ea8a945899fe6280fcab2 (`microsoft-defender-smartscreen-available-settings.md` file link https://github.com/MicrosoftDocs/windows-itpro-docs/commit/f248872c9b4861a1d92ea8a945899fe6280fcab2#diff-12e67b38e445922ed975beb4b144adf92ff9d4bd71fa12a0626dfe435bb0cb59) for the details. --- .../microsoft-defender-smartscreen-available-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md index a25aed7eab..39288a73aa 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md @@ -41,7 +41,7 @@ SmartScreen uses registry-based Administrative Template policy settings. For mor Windows 10, version 2004:
    Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control Windows 10, version 1703:
    Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control -This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.

    This setting does not protect against malicious content from USB devices, network shares or other non-internet sources.

    Important: Using a trustworthy browser helps ensure that these protections work as expected.

    +This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.

    This setting does not protect against malicious content from USB devices, network shares, or other non-internet sources.

    Important: Using a trustworthy browser helps ensure that these protections work as expected.

    Windows 10, version 2004:
    Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

    Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)

    Windows 10, version 1703:
    Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

    Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)

    Windows 10, Version 1607 and earlier:
    Administrative Templates\Windows Components\Microsoft Edge\Configure Windows SmartScreen @@ -159,7 +159,7 @@ For Microsoft Defender SmartScreen Edge MDM policies, see [Policy CSP - Browser] ## Recommended Group Policy and MDM settings for your organization -By default, Microsoft Defender SmartScreen lets employees bypass warnings. Unfortunately, this can let employees continue to an unsafe site or to continue to download an unsafe file, even after being warned. Because of this possibility, we strongly recommend that you set up Microsoft Defender SmartScreen to block high-risk interactions instead of providing just a warning. +By default, Microsoft Defender SmartScreen lets employees bypass warnings. Unfortunately, this feature can let employees continue to an unsafe site or to continue to download an unsafe file, even after being warned. Because of this possibility, we strongly recommend that you set up Microsoft Defender SmartScreen to block high-risk interactions instead of providing just a warning. To better help you protect your organization, we recommend turning on and using these specific Microsoft Defender SmartScreen Group Policy and MDM settings. From 915542fb1350de920c3e95e94817b8c4fff80f76 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Mon, 23 Nov 2020 09:57:16 +0530 Subject: [PATCH 027/825] updated-per-4650392 Rebranding update --- .../deploy-windows-10-in-a-school-district.md | 2 +- .../hello-feature-conditional-access.md | 2 +- .../hello-hybrid-cert-new-install.md | 22 +++++++++---------- .../hello-hybrid-key-new-install.md | 22 +++++++++---------- .../hello-identity-verification.md | 2 +- .../hello-key-trust-validate-deploy-mfa.md | 2 +- .../hello-planning-guide.md | 6 ++--- 7 files changed, 29 insertions(+), 29 deletions(-) diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index 280778ccb4..3a2d13b9b9 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -678,7 +678,7 @@ The following Azure AD Premium features are not in Azure AD Basic: * Allow designated users to manage group membership * Dynamic group membership based on user metadata -* Azure multifactor authentication (MFA; see [What is Azure Multi-Factor Authentication](https://azure.microsoft.com/documentation/articles/multi-factor-authentication/)) +* Azure AD Multi-Factor Authentication (MFA; see [What is Azure AD Multi-Factor Authentication](https://azure.microsoft.com/documentation/articles/multi-factor-authentication/)) * Identify cloud apps that your users run * Self-service recovery of BitLocker * Add local administrator accounts to Windows 10 devices diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md index 73e734e99b..470d856d45 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-conditional-access.md @@ -32,7 +32,7 @@ In a mobile-first, cloud-first world, Azure Active Directory enables single sign To improve productivity, Azure Active Directory provides your users with a broad range of options to access your corporate assets. With application access management, Azure Active Directory enables you to ensure that only the right people can access your applications. What if you want to have more control over how the right people are accessing your resources under certain conditions? What if you even have conditions under which you want to block access to certain applications even for the right people? For example, it might be OK for you if the right people are accessing certain applications from a trusted network; however, you might not want them to access these applications from a network you don't trust. You can address these questions using conditional access. > [!NOTE] -> For more details about the way Windows Hello for Business interacts with Azure Multi Factor Authentication and Conditional Access, see [this article](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/why-are-my-users-not-prompted-for-mfa-as-expected/ba-p/1449032). +> For more details about the way Windows Hello for Business interacts with Azure AD Multi-Factor Authentication and Conditional Access, see [this article](https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/why-are-my-users-not-prompted-for-mfa-as-expected/ba-p/1449032). Read [Conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal) to learn more about Conditional Access. Afterwards, read [Getting started with conditional access in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access-azure-portal-get-started) to start deploying Conditional access. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md index e5664fdeb0..ffbe59648f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-new-install.md @@ -100,12 +100,12 @@ The next step of the deployment is to follow the [Creating an Azure AD tenant](h ## Multifactor Authentication Services Windows Hello for Business uses multi-factor authentication during provisioning and during user initiated PIN reset scenarios, such as when a user forgets their PIN. There are two preferred multi-factor authentication configurations with hybrid deployments—Azure MFA and AD FS using Azure MFA -Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. +Review the [What is Azure AD Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. -### Azure Multi-Factor Authentication (MFA) Cloud ### +### Azure AD Multi-Factor Authentication (MFA) Cloud ### > [!IMPORTANT] -> As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: -> * Azure Multi-Factor Authentication +> As long as your users have licenses that include Azure AD Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: +> * Azure AD Multi-Factor Authentication > * Azure Active Directory Premium > * Enterprise Mobility + Security > @@ -115,7 +115,7 @@ Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.co If your organization uses Azure MFA on a per-consumption model (no licenses), then review the [Create a Multifactor Authentication Provider](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-auth-provider) section to create an Azure MFA Authentication provider and associate it with your Azure tenant. #### Configure Azure MFA Settings #### -Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. +Once you have created your Azure MFA authentication provider and associated it with an Azure tenant, you need to configure the multi-factor authentication settings. Review the [Configure Azure AD Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. #### Azure MFA User States #### After you have completed configuring your Azure MFA settings, you want to review configure [User States](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users. @@ -126,12 +126,12 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation ### Section Review > [!div class="checklist"] -> * Review the overview and uses of Azure Multifactor Authentication. -> * Review your Azure Active Directory subscription for Azure Multifactor Authentication. -> * Create an Azure Multifactor Authentication Provider, if necessary. -> * Configure Azure Multifactor Authentication features and settings. -> * Understand the different User States and their effect on Azure Multifactor Authentication. -> * Consider using Azure Multifactor Authentication or a third-party multifactor authentication provider with Windows Server 2016 Active Directory Federation Services, if necessary. +> * Review the overview and uses of Azure AD Multi-Factor Authentication Authentication. +> * Review your Azure Active Directory subscription for Azure AD Multi-Factor Authentication. +> * Create an Azure AD Multi-Factor Authentication Provider, if necessary. +> * Configure Azure AD Multi-Factor Authentication features and settings. +> * Understand the different User States and their effect on Azure AD Multi-Factor Authentication. +> * Consider using Azure AD Multi-Factor Authentication or a third-party multifactor authentication provider with Windows Server 2016 Active Directory Federation Services, if necessary. > [!div class="nextstepaction"] > [Configure Azure Device Registration](hello-hybrid-cert-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md index 51e6922080..958991988c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-new-install.md @@ -110,13 +110,13 @@ The next step of the deployment is to follow the [Creating an Azure AD tenant](h ## Multifactor Authentication Services Windows Hello for Business uses multifactor authentication during provisioning and during user initiated PIN reset scenarios, such as when a user forgets their PIN. There are two preferred multifactor authentication configurations with hybrid deployments—Azure MFA and AD FS using Azure MFA or a third-party MFA adapter -Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. +Review the [What is Azure AD Multi-Factor Authentication](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication) topic to familiarize yourself its purpose and how it works. -### Azure Multi-Factor Authentication (MFA) Cloud +### Azure AD Multi-Factor Authentication (MFA) Cloud > [!IMPORTANT] -> As long as your users have licenses that include Azure Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: -> * Azure Multi-Factor Authentication +> As long as your users have licenses that include Azure AD Multi-Factor Authentication, there's nothing that you need to do to turn on Azure MFA. You can start requiring two-step verification on an individual user basis. The licenses that enable Azure MFA are: +> * Azure AD Multi-Factor Authentication > * Azure Active Directory Premium > * Enterprise Mobility + Security > @@ -124,7 +124,7 @@ Review the [What is Azure Multi-Factor Authentication](https://docs.microsoft.co #### Configure Azure MFA Settings -Review the [Configure Azure Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. +Review the [Configure Azure AD Multi-Factor Authentication settings](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-whats-next) section to configure your settings. #### Azure MFA User States After you have completed configuring your Azure MFA settings, you want to review [How to require two-step verification for a user](https://docs.microsoft.com/azure/multi-factor-authentication/multi-factor-authentication-get-started-user-states) to understand user states. User states determine how you enable Azure MFA for your users. @@ -135,12 +135,12 @@ Alternatively, you can configure Windows Server 2016 Active Directory Federation ### Section Review > [!div class="checklist"] -> * Review the overview and uses of Azure Multifactor Authentication. -> * Review your Azure Active Directory subscription for Azure Multifactor Authentication. -> * Create an Azure Multifactor Authentication Provider, if necessary. -> * Configure Azure Multifactor Authentication features and settings. -> * Understand the different User States and their effect on Azure Multifactor Authentication. -> * Consider using Azure Multifactor Authentication or a third-party multifactor authentication provider with Windows Server Active Directory Federation Services, if necessary. +> * Review the overview and uses of Azure AD Multi-Factor Authentication. +> * Review your Azure Active Directory subscription for Azure AD Multi-Factor Authentication. +> * Create an Azure AD Multi-Factor Authentication Provider, if necessary. +> * Configure Azure AD Multi-Factor Authentication features and settings. +> * Understand the different User States and their effect on Azure AD Multi-Factor Authentication. +> * Consider using Azure AD Multi-Factor Authentication or a third-party multifactor authentication provider with Windows Server Active Directory Federation Services, if necessary. > [!div class="nextstepaction"] > [Configure Azure Device Registration](hello-hybrid-key-trust-devreg.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index a5a6d5a9a2..97593c468b 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -41,7 +41,7 @@ Windows Hello addresses the following problems with passwords: * Windows 10, version 1511 or later * Microsoft Azure Account * Azure Active Directory -* Azure Multi-factor authentication +* Azure AD Multi-Factor Authentication * Modern Management (Intune or supported third-party MDM), *optional* * Azure AD Premium subscription - *optional*, needed for automatic MDM enrollment when the device joins Azure Active Directory diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md index 6377afa5a8..ce54bf0ffb 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-validate-deploy-mfa.md @@ -19,7 +19,7 @@ ms.reviewer: # Validate and Deploy Multi-factor Authentication (MFA) > [!IMPORTANT] -> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who would like to require multi-factor authentication from their users should use cloud-based Azure Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1 will be able to download the latest version, future updates and generate activation credentials as usual. +> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who would like to require multi-factor authentication from their users should use cloud-based Azure AD Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1 will be able to download the latest version, future updates and generate activation credentials as usual. **Applies to** diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index 3fff407e34..9f8e5333ee 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -104,13 +104,13 @@ The built-in Windows Hello for Business provisioning experience creates a hardwa #### Multifactor authentication > [!IMPORTANT] -> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who require multi-factor authentication for their users should use cloud-based Azure Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1, 2019 will be able to download the latest version, future updates and generate activation credentials as usual. See [Getting started with the Azure Multi-Factor Authentication Server](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfaserver-deploy) for more details. +> As of July 1, 2019, Microsoft will no longer offer MFA Server for new deployments. New customers who require multi-factor authentication for their users should use cloud-based Azure AD Multi-Factor Authentication. Existing customers who have activated MFA Server prior to July 1, 2019 will be able to download the latest version, future updates and generate activation credentials as usual. See [Getting started with the Azure AD Multi-Factor Authentication Server](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfaserver-deploy) for more details. The goal of Windows Hello for Business is to move organizations away from passwords by providing them a strong credential that provides easy two-factor authentication. The built-in provisioning experience accepts the user's weak credentials (username and password) as the first factor authentication; however, the user must provide a second factor of authentication before Windows provisions a strong credential. -Cloud only and hybrid deployments provide many choices for multi-factor authentication. On-premises deployments must use a multi-factor authentication that provides an AD FS multi-factor adapter to be used in conjunction with the on-premises Windows Server 2016 AD FS server role. Organizations can use the on-premises Azure Multi-factor Authentication server, or choose from several third parties (Read [Microsoft and third-party additional authentication methods](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods) for more information). +Cloud only and hybrid deployments provide many choices for multi-factor authentication. On-premises deployments must use a multi-factor authentication that provides an AD FS multi-factor adapter to be used in conjunction with the on-premises Windows Server 2016 AD FS server role. Organizations can use the on-premises Azure AD Multi-Factor Authentication server, or choose from several third parties (Read [Microsoft and third-party additional authentication methods](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods) for more information). > [!NOTE] -> Azure Multi-Factor Authentication is available through: +> Azure AD Multi-Factor Authentication is available through: > * Microsoft Enterprise Agreement > * Open Volume License Program > * Cloud Solution Providers program From 3b423db0a6c6b3b3c88080d68d5bbc4ab03a1b90 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Mon, 23 Nov 2020 11:14:35 +0200 Subject: [PATCH 028/825] Update windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../microsoft-defender-smartscreen-available-settings.md | 5 ----- 1 file changed, 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md index b7b275e78a..ef53ba233b 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md @@ -41,10 +41,6 @@ SmartScreen uses registry-based Administrative Template policy settings. For mor -patch-107 -======= - -public @@ -222,4 +218,3 @@ To better help you protect your organization, we recommend turning on and using - [Microsoft Defender SmartScreen overview](microsoft-defender-smartscreen-overview.md) - [Available Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](/microsoft-edge/deploy/available-policies) - From 0b4d83779cabda4f371efca225c1fb9a465bb00a Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Thu, 3 Dec 2020 07:05:08 +0530 Subject: [PATCH 029/825] Update policy-csp-defender.md as per the user report #8740 , so i added admx missing information after clearly cross with on my laptop runs with windows 10 20h2 64bit build no 19042.662 . From this editing , i struggled few minutes for formatting the line in correct and where to add those missing lines. This editing of this article is too complicated , editing needs too much concentration with dedicated experienced skills, I knew all the contributors and all Authors , how are spent time to edit this article to make perfect. --- windows/client-management/mdm/policy-csp-defender.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index dcea40a888..6387efccc5 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -2317,6 +2317,15 @@ Added in Windows 10, version 1607. Specifies the level of detection for potenti > Potentially unwanted applications (PUA) are a category of software that can cause your machine to run slowly, display unexpected ads, or at worst, install other software which might be unexpected or unwanted. By default in Windows 10 (version 2004 and later), Microsoft Defender Antivirus blocks apps that are considered PUA, for Enterprise (E5) devices. For more information about PUA, see [Detect and block potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus). + +ADMX Info: +- GP English name: *Configure detection for potentially unwanted applications* +- GP name: *Root_PUAProtection* +- GP element: *Root_PUAProtection* +- GP path: *Windows Components/Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + The following list shows the supported values: @@ -3112,6 +3121,7 @@ Footnotes: - 6 - Available in Windows 10, version 1903. - 7 - Available in Windows 10, version 1909. - 8 - Available in Windows 10, version 2004. +- 9 - Available in Windows 10, version 20H2. From c0b156672b92c55252aa453bb4ea52acf135b384 Mon Sep 17 00:00:00 2001 From: chblac Date: Mon, 7 Dec 2020 11:37:15 -0800 Subject: [PATCH 030/825] Update bitlocker-csp.md --- windows/client-management/mdm/bitlocker-csp.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/bitlocker-csp.md b/windows/client-management/mdm/bitlocker-csp.md index 07f3aa7f0f..652a24f8e4 100644 --- a/windows/client-management/mdm/bitlocker-csp.md +++ b/windows/client-management/mdm/bitlocker-csp.md @@ -1126,12 +1126,12 @@ Supported values: |-----|------------| | 0 |The BitLocker policy requires user consent to launch the BitLocker Drive Encryption Wizard to start encryption of the OS volume but the user didn't consent.| | 1 |The encryption method of the OS volume doesn't match the BitLocker policy.| -| 2 |The BitLocker policy requires a TPM protector to protect the OS volume, but a TPM isn't used.| +| 2 |The OS volume is unprotected.| | 3 |The BitLocker policy requires a TPM-only protector for the OS volume, but TPM protection isn't used.| | 4 |The BitLocker policy requires TPM+PIN protection for the OS volume, but a TPM+PIN protector isn't used.| | 5 |The BitLocker policy requires TPM+startup key protection for the OS volume, but a TPM+startup key protector isn't used.| | 6 |The BitLocker policy requires TPM+PIN+startup key protection for the OS volume, but a TPM+PIN+startup key protector isn't used.| -| 7 |The OS volume is unprotected.| +| 7 |The BitLocker policy requires a TPM protector to protect the OS volume, but a TPM isn't used.| | 8 |Recovery key backup failed.| | 9 |A fixed drive is unprotected.| | 10 |The encryption method of the fixed drive doesn't match the BitLocker policy.| From c65538b1cc6fdddb94903fe04e7a95d05f00e095 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 8 Dec 2020 11:29:25 -0800 Subject: [PATCH 031/825] Added SkyDrive and Explorer policies --- windows/client-management/mdm/TOC.md | 2 + .../mdm/policies-in-policy-csp-admx-backed.md | 6 + .../policy-configuration-service-provider.md | 28 ++ .../mdm/policy-csp-admx-explorer.md | 400 ++++++++++++++++++ .../mdm/policy-csp-admx-skydrive.md | 116 +++++ 5 files changed, 552 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-explorer.md create mode 100644 windows/client-management/mdm/policy-csp-admx-skydrive.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 19328d6086..86bd94db0c 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -193,6 +193,7 @@ #### [ADMX_DWM](policy-csp-admx-dwm.md) #### [ADMX_EncryptFilesonMove](policy-csp-admx-encryptfilesonmove.md) #### [ADMX_EventForwarding](policy-csp-admx-eventforwarding.md) +#### [ADMX_Explorer](policy-csp-admx-explorer.md) #### [ADMX_FileServerVSSProvider](policy-csp-admx-fileservervssprovider.md) #### [ADMX_FileSys](policy-csp-admx-filesys.md) #### [ADMX_FolderRedirection](policy-csp-admx-folderredirection.md) @@ -221,6 +222,7 @@ #### [ADMX_SharedFolders](policy-csp-admx-sharedfolders.md) #### [ADMX_Sharing](policy-csp-admx-sharing.md) #### [ADMX_ShellCommandPromptRegEditTools](policy-csp-admx-shellcommandpromptregedittools.md) +#### [ADMX_SkyDrive](policy-csp-admx-skydrive.md) #### [ADMX_Smartcard](policy-csp-admx-smartcard.md) #### [ADMX_Snmp](policy-csp-admx-snmp.md) #### [ADMX_StartMenu](policy-csp-admx-startmenu.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 1f50c812bc..862afe663b 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -142,6 +142,11 @@ ms.date: 10/08/2020 - [ADMX_EncryptFilesonMove/NoEncryptOnMove](./policy-csp-admx-encryptfilesonmove.md#admx-encryptfilesonmove-noencryptonmove) - [ADMX_EventForwarding/ForwarderResourceUsage](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-forwarderresourceusage) - [ADMX_EventForwarding/SubscriptionManager](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-subscriptionmanager) +- [ADMX_Explorer/AdminInfoUrl](./policy-csp-admx-explorer.md#admx-explorer-admininfourl) +- [ADMX_Explorer/AlwaysShowClassicMenu](./policy-csp-admx-explorer.md#admx-explorer-alwaysshowclassicmenu) +- [ADMX_Explorer/DisableRoamedProfileInit](./policy-csp-admx-explorer.md#admx-explorer-disableroamedprofileinit) +- [ADMX_Explorer/PreventItemCreationInUsersFilesFolder](./policy-csp-admx-explorer.md#admx-explorer-preventitemcreationinusersfilesfolder) +- [ADMX_Explorer/TurnOffSPIAnimations](./policy-csp-admx-explorer.md#admx-explorer-turnoffspianimations) - [ADMX_FileServerVSSProvider/Pol_EncryptProtocol](./policy-csp-admx-fileservervssprovider.md#admx-fileservervssprovider-pol-encryptprotocol) - [ADMX_FileSys/DisableCompression](./policy-csp-admx-filesys.md#admx-filesys-disablecompression) - [ADMX_FileSys/DisableDeleteNotification](./policy-csp-admx-filesys.md#admx-filesys-disabledeletenotification) @@ -461,6 +466,7 @@ ms.date: 10/08/2020 - [ADMX_ShellCommandPromptRegEditTools/DisableRegedit](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disableregedit) - [ADMX_ShellCommandPromptRegEditTools/DisallowApps](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disallowapps) - [ADMX_ShellCommandPromptRegEditTools/RestrictApps](./policy-csp-admx-shellcommandpromptregedittools.md#admx-shellcommandpromptregedittools-disablecmd) +- [ADMX_SkyDrive/PreventNetworkTrafficPreUserSignIn](./policy-csp-admx-skydrive.md#admx-skydrive-preventnetworktrafficpreusersignin) - [ADMX_Smartcard/AllowCertificatesWithNoEKU](./policy-csp-admx-smartcard.md#admx-smartcard-allowcertificateswithnoeku) - [ADMX_Smartcard/AllowIntegratedUnblock](./policy-csp-admx-smartcard.md#admx-smartcard-allowintegratedunblock) - [ADMX_Smartcard/AllowSignatureOnlyKeys](./policy-csp-admx-smartcard.md#admx-smartcard-allowsignatureonlykeys) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 99fad505b6..9c50187fd7 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -633,6 +633,26 @@ The following diagram shows the Policy configuration service provider in tree fo +### ADMX_Explorer policies + +
    +
    + ADMX_Explorer/AdminInfoUrl +
    +
    + ADMX_Explorer/AlwaysShowClassicMenu +
    +
    + ADMX_Explorer/DisableRoamedProfileInit +
    +
    + ADMX_Explorer/PreventItemCreationInUsersFilesFolder +
    +
    + ADMX_Explorer/TurnOffSPIAnimations +
    +
    + ### ADMX_FileServerVSSProvider policies
    @@ -1717,6 +1737,14 @@ The following diagram shows the Policy configuration service provider in tree fo
    +### ADMX_SkyDrive policies + +
    +
    + ADMX_SkyDrive/PreventNetworkTrafficPreUserSignIn +
    +
    + ### ADMX_Smartcard policies
    diff --git a/windows/client-management/mdm/policy-csp-admx-explorer.md b/windows/client-management/mdm/policy-csp-admx-explorer.md new file mode 100644 index 0000000000..31c5d764fb --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-explorer.md @@ -0,0 +1,400 @@ +--- +title: Policy CSP - ADMX_Explorer +description: Policy CSP - ADMX_Explorer +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/08/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Explorer +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Explorer policies + +
    +
    + ADMX_Explorer/AdminInfoUrl +
    +
    + ADMX_Explorer/AlwaysShowClassicMenu +
    +
    + ADMX_Explorer/DisableRoamedProfileInit +
    +
    + ADMX_Explorer/PreventItemCreationInUsersFilesFolder +
    +
    + ADMX_Explorer/TurnOffSPIAnimations +
    +
    + + +
    + + +**ADMX_Explorer/AdminInfoUrl** + + +
    Windows 10, version 2004:
    Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control    		 Windows 10, version 1703:
    Administrative Templates\Windows Components\Windows Defender SmartScreen\Explorer\Configure App Install Control    		Windows 10, version 1703This policy setting is intended to prevent malicious content from affecting your user's devices when downloading executable content from the internet.

    This setting does not protect against malicious content from USB devices, network shares, or other non-internet sources.

    Important: Using a trustworthy browser helps ensure that these protections work as expected.
    + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +

    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Sets the target of the More Information link that will be displayed when the user attempts to run a program that is blocked by policy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set a support web page link* +- GP name: *AdminInfoUrl* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Explorer.admx* + + + +
    + + +**ADMX_Explorer/AlwaysShowClassicMenu** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures File Explorer to always display the menu bar. + +> [!NOTE] +> By default, the menu bar is not displayed in File Explorer. + +If you enable this policy setting, the menu bar will be displayed in File Explorer. + +If you disable or do not configure this policy setting, the menu bar will not be displayed in File Explorer. + +> [!NOTE] +> When the menu bar is not displayed, users can access the menu bar by pressing the 'ALT' key. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display the menu bar in File Explorer* +- GP name: *AlwaysShowClassicMenu* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Explorer.admx* + + + +
    + + +**ADMX_Explorer/DisableRoamedProfileInit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows administrators who have configured roaming profile in conjunction with Delete Cached Roaming Profile Group Policy setting to ensure that Explorer will not reinitialize default program associations and other settings to default values. + +If you enable this policy setting on a machine that does not contain all programs installed in the same manner as it was on the machine on which the user had last logged on, unexpected behavior could occur. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not reinitialize a pre-existing roamed user profile when it is loaded on a machine for the first time* +- GP name: *DisableRoamedProfileInit* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Explorer.admx* + + + +
    + + +**ADMX_Explorer/PreventItemCreationInUsersFilesFolder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows administrators to prevent users from adding new items such as files or folders to the root of their Users Files folder in File Explorer. + +If you enable this policy setting, users will no longer be able to add new items such as files or folders to the root of their Users Files folder in File Explorer. + +If you disable or do not configure this policy setting, users will be able to add new items such as files or folders to the root of their Users Files folder in File Explorer. + +> [!NOTE] +> Enabling this policy setting does not prevent the user from being able to add new items such as files and folders to their actual file system profile folder at %userprofile%. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from adding files to the root of their Users Files folder.* +- GP name: *PreventItemCreationInUsersFilesFolder* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Explorer.admx* + + + +
    + + +**ADMX_Explorer/TurnOffSPIAnimations** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy is similar to settings directly available to computer users. Disabling animations can improve usability for users with some visual disabilities as well as improving performance and battery life in some scenarios. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off common control and window animations* +- GP name: *TurnOffSPIAnimations* +- GP path: *Windows Components\File Explorer* +- GP ADMX file name: *Explorer.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-skydrive.md b/windows/client-management/mdm/policy-csp-admx-skydrive.md new file mode 100644 index 0000000000..5580f6e4e4 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-skydrive.md @@ -0,0 +1,116 @@ +--- +title: Policy CSP - ADMX_SkyDrive +description: Policy CSP - ADMX_SkyDrive +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/08/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_SkyDrive +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_SkyDrive policies + +
    +
    + ADMX_SkyDrive/PreventNetworkTrafficPreUserSignIn +
    +
    + + +
    + + +**ADMX_SkyDrive/PreventNetworkTrafficPreUserSignIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Enable this setting to prevent the OneDrive sync client (OneDrive.exe) from generating network traffic (checking for updates, etc.) until the user signs in to OneDrive or starts syncing files to the local computer. + +If you enable this setting, users must sign in to the OneDrive sync client on the local computer, or select to sync OneDrive or SharePoint files on the computer, for the sync client to start automatically. + +If this setting is not enabled, the OneDrive sync client will start automatically when users sign in to Windows. + +If you enable or disable this setting, do not return the setting to Not Configured. Doing so will not change the configuration and the last configured setting will remain in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent OneDrive from generating network traffic until the user signs in to OneDrive* +- GP name: *PreventNetworkTrafficPreUserSignIn* +- GP path: *Windows Components\OneDrive* +- GP ADMX file name: *SkyDrive.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From 2c7249b47e5711800c79f1a88b12498c33af251a Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 8 Dec 2020 14:02:31 -0800 Subject: [PATCH 032/825] Added LanmanWorkstation policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 3 + .../policy-configuration-service-provider.md | 14 + .../mdm/policy-csp-admx-lanmanworkstation.md | 279 ++++++++++++++++++ 4 files changed, 297 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 86bd94db0c..631c73eec2 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -201,6 +201,7 @@ #### [ADMX_HelpAndSupport](policy-csp-admx-helpandsupport.md) #### [ADMX_kdc](policy-csp-admx-kdc.md) #### [ADMX_LanmanServer](policy-csp-admx-lanmanserver.md) +#### [ADMX_LanmanWorkstation](policy-csp-admx-lanmanworkstation.md) #### [ADMX_LinkLayerTopologyDiscovery](policy-csp-admx-linklayertopologydiscovery.md) #### [ADMX_MMC](policy-csp-admx-mmc.md) #### [ADMX_MMCSnapins](policy-csp-admx-mmcsnapins.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 862afe663b..b834641841 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -181,6 +181,9 @@ ms.date: 10/08/2020 - [ADMX_LanmanServer/Pol_HashPublication](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashpublication) - [ADMX_LanmanServer/Pol_HashSupportVersion](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashsupportversion) - [ADMX_LanmanServer/Pol_HonorCipherSuiteOrder](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-honorciphersuiteorder) +- [ADMX_LanmanWorkstation/Pol_CipherSuiteOrder](./policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-ciphersuiteorder) +- [ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles](./policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-enablehandlecachingforcafiles) +- [ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares](./policy-csp-admx-lanmanworkstation.md#admx-lanmanworkstation-pol-enableofflinefilesforcashares) - [ADMX_LinkLayerTopologyDiscovery/LLTD_EnableLLTDIO](./policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablelltdio) - [ADMX_LinkLayerTopologyDiscovery/LLTD_EnableRspndr](./policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablerspndr) - [ADMX_MMC/MMC_ActiveXControl](./policy-csp-admx-mmc.md#admx-mmc-mmc-activexcontrol) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 9c50187fd7..1bec41f8c4 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -783,6 +783,20 @@ The following diagram shows the Policy configuration service provider in tree fo +### ADMX_LanmanWorkstation policies + +
    +
    + ADMX_LanmanWorkstation/Pol_CipherSuiteOrder +
    +
    + ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles +
    +
    + ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares +
    +
    + ### ADMX_LinkLayerTopologyDiscovery policies
    diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md new file mode 100644 index 0000000000..5a9ce576f9 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md @@ -0,0 +1,279 @@ +--- +title: Policy CSP - ADMX_LanmanWorkstation +description: Policy CSP - ADMX_LanmanWorkstation +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/08/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_LanmanWorkstation +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_LanmanWorkstation policies + +
    +
    + ADMX_LanmanWorkstation/Pol_CipherSuiteOrder +
    +
    + ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles +
    +
    + ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares +
    +
    + + +
    + + +**ADMX_LanmanWorkstation/Pol_CipherSuiteOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the cipher suites used by the SMB client. + +If you enable this policy setting, cipher suites are prioritized in the order specified. + +If you enable this policy setting and do not specify at least one supported cipher suite, or if you disable or do not configure this policy setting, the default cipher suite order is used. + +SMB 3.11 cipher suites: + +- AES_128_GCM +- AES_128_CCM + +SMB 3.0 and 3.02 cipher suites: + +- AES_128_CCM + +How to modify this setting: + +Arrange the desired cipher suites in the edit box, one cipher suite per line, in order from most to least preferred, with the most preferred cipher suite at the top. Remove any cipher suites you don't want to use. + +> [!NOTE] +> When configuring this security setting, changes will not take effect until you restart Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Cipher suite order* +- GP name: *Pol_CipherSuiteOrder* +- GP path: *Network\Lanman Workstation* +- GP ADMX file name: *LanmanWorkstation.admx* + + + +
    + + +**ADMX_LanmanWorkstation/Pol_EnableHandleCachingForCAFiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of SMB handle caching for clients connecting to an SMB share where the Continuous Availability (CA) flag is enabled. + +If you enable this policy setting, the SMB client will allow cached handles to files on CA shares. This may lead to better performance when repeatedly accessing a large number of unstructured data files on CA shares running in Microsoft Azure Files. + +If you disable or do not configure this policy setting, Windows will prevent use of cached handles to files opened through CA shares. + +> [!NOTE] +> This policy has no effect when connecting Scale-out File Server shares provided by a Windows Server. Microsoft does not recommend enabling this policy for clients that routinely connect to files hosted on a Windows Failover Cluster with the File Server for General Use role, as it can lead to adverse failover times and increased memory and CPU usage. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Handle Caching on Continuous Availability Shares* +- GP name: *Pol_EnableHandleCachingForCAFiles* +- GP path: *Network\Lanman Workstation* +- GP ADMX file name: *LanmanWorkstation.admx* + + + +
    + + +**ADMX_LanmanWorkstation/Pol_EnableOfflineFilesforCAShares** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of Offline Files on clients connecting to an SMB share where the Continuous Availability (CA) flag is enabled. + +If you enable this policy setting, the "Always Available offline" option will appear in the File Explorer menu on a Windows computer when connecting to a CA-enabled share. Pinning of files on CA-enabled shares using client-side caching will also be possible. + +If you disable or do not configure this policy setting, Windows will prevent use of Offline Files with CA-enabled shares. + +> [!NOTE] +> Microsoft does not recommend enabling this group policy. Use of CA with Offline Files will lead to very long transition times between the online and offline states. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Offline Files Availability on Continuous Availability Shares* +- GP name: *Pol_EnableOfflineFilesforCAShares* +- GP path: *Network\Lanman Workstation* +- GP ADMX file name: *LanmanWorkstation.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file From 7b364be416e98bdbd2a7aa13f46c92289cfb9511 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 8 Dec 2020 15:52:16 -0800 Subject: [PATCH 033/825] Added msched policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 2 + .../policy-configuration-service-provider.md | 11 + .../mdm/policy-csp-admx-lanmanworkstation.md | 5 + .../mdm/policy-csp-admx-msched.md | 191 ++++++++++++++++++ 5 files changed, 210 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-msched.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 631c73eec2..a12ec58d25 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -206,6 +206,7 @@ #### [ADMX_MMC](policy-csp-admx-mmc.md) #### [ADMX_MMCSnapins](policy-csp-admx-mmcsnapins.md) #### [ADMX_MSAPolicy](policy-csp-admx-msapolicy.md) +#### [ADMX_msched](policy-csp-admx-msched.md) #### [ADMX_nca](policy-csp-admx-nca.md) #### [ADMX_NCSI](policy-csp-admx-ncsi.md) #### [ADMX_Netlogon](policy-csp-admx-netlogon.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index b834641841..5fb786235b 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -296,6 +296,8 @@ ms.date: 10/08/2020 - [ADMX_MMCSnapins/MMC_WirelessMon](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirelessmon) - [ADMX_MMCSnapins/MMC_WirelessNetworkPolicy](./policy-csp-admx-mmcsnapins.md#admx-mmcsnapins-mmc-wirelessnetworkpolicy) - [ADMX_MSAPolicy/IncludeMicrosoftAccount_DisableUserAuthCmdLine](./policy-csp-admx-msapolicy.md#admx-msapolicy-microsoftaccount-disableuserauth) +- [ADMX_msched/ActivationBoundaryPolicy](./policy-csp-admx-msched.md#admx-msched-activationboundarypolicy) +- [ADMX_msched/RandomDelayPolicy](./policy-csp-admx-msched.md#admx-msched-randomdelaypolicy) - [ADMX_nca/CorporateResources](./policy-csp-admx-nca.md#admx-nca-corporateresources) - [ADMX_nca/CustomCommands](./policy-csp-admx-nca.md#admx-nca-customcommands) - [ADMX_nca/DTEs](./policy-csp-admx-nca.md#admx-nca-dtes) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 1bec41f8c4..7c2741bcb5 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1150,6 +1150,17 @@ The following diagram shows the Policy configuration service provider in tree fo
    +### ADMX_msched policies + +
    +
    + ADMX_msched/ActivationBoundaryPolicy +
    +
    + ADMX_msched/RandomDelayPolicy +
    +
    + ### ADMX_nca policies
    diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md index 5a9ce576f9..a17e77a476 100644 --- a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md @@ -90,6 +90,11 @@ SMB 3.11 cipher suites: - AES_128_GCM - AES_128_CCM +- AES_256_GCM +- AES_256_CCM + +> [!NOTE] +> AES_256 is not supported on Windows 10 version 20H2 and lower. Additionally, if you enter only AES_256 crypto lines, the older clients will no longer be able to connect. SMB 3.0 and 3.02 cipher suites: diff --git a/windows/client-management/mdm/policy-csp-admx-msched.md b/windows/client-management/mdm/policy-csp-admx-msched.md new file mode 100644 index 0000000000..fc45989368 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-msched.md @@ -0,0 +1,191 @@ +--- +title: Policy CSP - ADMX_msched +description: Policy CSP - ADMX_msched +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/08/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_msched +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_msched policies + +
    +
    + ADMX_msched/ActivationBoundaryPolicy +
    +
    + ADMX_msched/RandomDelayPolicy +
    +
    + + +
    + + +**ADMX_msched/ActivationBoundaryPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure Automatic Maintenance activation boundary. The maintenance activation boundary is the daily scheduled time at which Automatic Maintenance starts. + +If you enable this policy setting, this will override the default daily scheduled time as specified in Security and Maintenance/Automatic Maintenance Control Panel. + +If you disable or do not configure this policy setting, the daily scheduled time as specified in Security and Maintenance/Automatic Maintenance Control Panel will apply. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Automatic Maintenance Activation Boundary* +- GP name: *ActivationBoundaryPolicy* +- GP path: *Windows Components\Maintenance Scheduler* +- GP ADMX file name: *msched.admx* + + + +
    + + +**ADMX_msched/RandomDelayPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure Automatic Maintenance activation random delay. + +The maintenance random delay is the amount of time up to which Automatic Maintenance will delay starting from its Activation Boundary. + +If you enable this policy setting, Automatic Maintenance will delay starting from its Activation Boundary, by up to this time. + +If you do not configure this policy setting, 4 hour random delay will be applied to Automatic Maintenance. + +If you disable this policy setting, no random delay will be applied to Automatic Maintenance. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Automatic Maintenance Random Delay* +- GP name: *RandomDelayPolicy* +- GP path: *Windows Components\Maintenance Scheduler* +- GP ADMX file name: *msched.admx* + + + +
    + + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From a3c8fe9118ab0835248a404d15cc86cfee3b1e95 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 8 Dec 2020 16:07:36 -0800 Subject: [PATCH 034/825] Minor text update --- .../client-management/mdm/policy-csp-admx-lanmanworkstation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md index a17e77a476..d3c1dfcd54 100644 --- a/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-admx-lanmanworkstation.md @@ -94,7 +94,7 @@ SMB 3.11 cipher suites: - AES_256_CCM > [!NOTE] -> AES_256 is not supported on Windows 10 version 20H2 and lower. Additionally, if you enter only AES_256 crypto lines, the older clients will no longer be able to connect. +> AES_256 is not supported on Windows 10 version 20H2 and lower. If you enter only AES_256 crypto lines, the older clients will not be able to connect anymore. SMB 3.0 and 3.02 cipher suites: From eab2698824cdcb936d383e05679727d741fd9e21 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 8 Dec 2020 16:40:40 -0800 Subject: [PATCH 035/825] Added RPC policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 4 + .../policy-configuration-service-provider.md | 17 + .../mdm/policy-csp-admx-rpc.md | 394 ++++++++++++++++++ 4 files changed, 416 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-rpc.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index a12ec58d25..2e828a600c 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -216,6 +216,7 @@ #### [ADMX_PerformanceDiagnostics](policy-csp-admx-performancediagnostics.md) #### [ADMX_PowerShellExecutionPolicy](policy-csp-admx-powershellexecutionpolicy.md) #### [ADMX_Reliability](policy-csp-admx-reliability.md) +#### [ADMX_RPC](policy-csp-admx-rpc.md) #### [ADMX_Scripts](policy-csp-admx-scripts.md) #### [ADMX_sdiageng](policy-csp-admx-sdiageng.md) #### [ADMX_Securitycenter](policy-csp-admx-securitycenter.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 5fb786235b..80ac1e00c1 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -442,6 +442,10 @@ ms.date: 10/08/2020 - [ADMX_Reliability/PCH_ReportShutdownEvents](./policy-csp-admx-reliability.md#admx-reliability-pch-reportshutdownevents) - [ADMX_Reliability/ShutdownEventTrackerStateFile](./policy-csp-admx-reliability.md#admx-reliability-shutdowneventtrackerstatefile) - [ADMX_Reliability/ShutdownReason](./policy-csp-admx-reliability.md#admx-reliability-shutdownreason) +- [ADMX_RPC/RpcExtendedErrorInformation](./policy-csp-admx-rpc.md#admx-rpc-rpcextendederrorinformation) +- [ADMX_RPC/RpcIgnoreDelegationFailure](./policy-csp-admx-rpc.md#admx-rpc-rpcignoredelegationfailure) +- [ADMX_RPC/RpcMinimumHttpConnectionTimeout](./policy-csp-admx-rpc.md#admx-rpc-rpcminimumhttpconnectiontimeout) +- [ADMX_RPC/RpcStateInformation](./policy-csp-admx-rpc.md#admx-rpc-rpcstateinformation) - [ADMX_Scripts/Allow_Logon_Script_NetbiosDisabled](./policy-csp-admx-scripts.md#admx-scripts-allow-logon-script-netbiosdisabled) - [ADMX_Scripts/MaxGPOScriptWaitPolicy](./policy-csp-admx-scripts.md#admx-scripts-maxgposcriptwaitpolicy) - [ADMX_Scripts/Run_Computer_PS_Scripts_First](./policy-csp-admx-scripts.md#admx-scripts-run-computer-ps-scripts-first) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 7c2741bcb5..b43c6f5515 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1635,6 +1635,23 @@ The following diagram shows the Policy configuration service provider in tree fo
    +### ADMX_RPC policies + +
    +
    + ADMX_RPC/RpcExtendedErrorInformation +
    +
    + ADMX_RPC/RpcIgnoreDelegationFailure +
    +
    + ADMX_RPC/RpcMinimumHttpConnectionTimeout +
    +
    + ADMX_RPC/RpcStateInformation +
    +
    + ### ADMX_Scripts policies
    diff --git a/windows/client-management/mdm/policy-csp-admx-rpc.md b/windows/client-management/mdm/policy-csp-admx-rpc.md new file mode 100644 index 0000000000..2845ab5077 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-rpc.md @@ -0,0 +1,394 @@ +--- +title: Policy CSP - ADMX_RPC +description: Policy CSP - ADMX_RPC +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/08/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_RPC +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_RPC policies + +
    +
    + ADMX_RPC/RpcExtendedErrorInformation +
    +
    + ADMX_RPC/RpcIgnoreDelegationFailure +
    +
    + ADMX_RPC/RpcMinimumHttpConnectionTimeout +
    +
    + ADMX_RPC/RpcStateInformation +
    +
    + + +
    + + +**ADMX_RPC/RpcExtendedErrorInformation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the RPC runtime generates extended error information when an error occurs. + +Extended error information includes the local time that the error occurred, the RPC version, and the name of the computer on which the error occurred, or from which it was propagated. Programs can retrieve the extended error information by using standard Windows application programming interfaces (APIs). + +If you disable this policy setting, the RPC Runtime only generates a status code to indicate an error condition. + +If you do not configure this policy setting, it remains disabled. It will only generate a status code to indicate an error condition. + +If you enable this policy setting, the RPC runtime will generate extended error information. + +You must select an error response type in the drop-down box. + +- "Off" disables all extended error information for all processes. RPC only generates an error code. +- "On with Exceptions" enables extended error information, but lets you disable it for selected processes. To disable extended error information for a process while this policy setting is in effect, the command that starts the process must begin with one of the strings in the Extended Error Information Exception field. +- "Off with Exceptions" disables extended error information, but lets you enable it for selected processes. To enable extended error information for a process while this policy setting is in effect, the command that starts the process must begin with one of the strings in the Extended Error Information Exception field. +- "On" enables extended error information for all processes. + +> [!NOTE] +> For information about the Extended Error Information Exception field, see the Windows Software Development Kit (SDK). +> +> Extended error information is formatted to be compatible with other operating systems and older Microsoft operating systems, but only newer Microsoft operating systems can read and respond to the information. +> +> The default policy setting, "Off," is designed for systems where extended error information is considered to be sensitive, and it should not be made available remotely. +> +> This policy setting will not be applied until the system is rebooted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Propagate extended error information* +- GP name: *RpcExtendedErrorInformation* +- GP path: *System\Remote Procedure Call* +- GP ADMX file name: *RPC.admx* + + + +
    + +
    + + +**ADMX_RPC/RpcIgnoreDelegationFailure** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the RPC Runtime ignores delegation failures when delegation is requested. + +The constrained delegation model, introduced in Windows Server 2003, does not report that delegation was enabled on a security context when a client connects to a server. Callers of RPC and COM are encouraged to use the RPC_C_QOS_CAPABILITIES_IGNORE_DELEGATE_FAILURE flag, but some applications written for the traditional delegation model prior to Windows Server 2003 may not use this flag and will encounter RPC_S_SEC_PKG_ERROR when connecting to a server that uses constrained delegation. + +If you disable this policy setting, the RPC Runtime will generate RPC_S_SEC_PKG_ERROR errors to applications that ask for delegation and connect to servers using constrained delegation. + +If you do not configure this policy setting, it remains disabled and will generate RPC_S_SEC_PKG_ERROR errors to applications that ask for delegation and connect to servers using constrained delegation. + +If you enable this policy setting, then: + +- "Off" directs the RPC Runtime to generate RPC_S_SEC_PKG_ERROR if the client asks for delegation, but the created security context does not support delegation. + +- "On" directs the RPC Runtime to accept security contexts that do not support delegation even if delegation was asked for. + +> [!NOTE] +> This policy setting will not be applied until the system is rebooted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ignore Delegation Failure* +- GP name: *RpcIgnoreDelegationFailure* +- GP path: *System\Remote Procedure Call* +- GP ADMX file name: *RPC.admx* + + + + +
    + + +**ADMX_RPC/RpcMinimumHttpConnectionTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the idle connection timeout for RPC/HTTP connections. + +This policy setting is useful in cases where a network agent like an HTTP proxy or a router uses a lower idle connection timeout than the IIS server running the RPC/HTTP proxy. In such cases, RPC/HTTP clients may encounter errors because connections will be timed out faster than expected. Using this policy setting you can force the RPC Runtime and the RPC/HTTP Proxy to use a lower connection timeout. + +This policy setting is only applicable when the RPC Client, the RPC Server and the RPC HTTP Proxy are all running Windows Server 2003 family/Windows XP SP1 or higher versions. If either the RPC Client or the RPC Server or the RPC HTTP Proxy run on an older version of Windows, this policy setting will be ignored. + +The minimum allowed value for this policy setting is 90 seconds. The maximum is 7200 seconds (2 hours). + +If you disable this policy setting, the idle connection timeout on the IIS server running the RPC HTTP proxy will be used. + +If you do not configure this policy setting, it will remain disabled. The idle connection timeout on the IIS server running the RPC HTTP proxy will be used. + +If you enable this policy setting, and the IIS server running the RPC HTTP proxy is configured with a lower idle connection timeout, the timeout on the IIS server is used. Otherwise, the provided timeout value is used. The timeout is given in seconds. + +> [!NOTE] +> This policy setting will not be applied until the system is rebooted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set Minimum Idle Connection Timeout for RPC/HTTP connections* +- GP name: *RpcMinimumHttpConnectionTimeout* +- GP path: *System\Remote Procedure Call* +- GP ADMX file name: *RPC.admx* + + + +
    + +
    + + +**ADMX_RPC/RpcStateInformation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the RPC Runtime maintains RPC state information for the system, and how much information it maintains. Basic state information, which consists only of the most commonly needed state data, is required for troubleshooting RPC problems. + +If you disable this policy setting, the RPC runtime defaults to "Auto2" level. + +If you do not configure this policy setting, the RPC defaults to "Auto2" level. + +If you enable this policy setting, you can use the drop-down box to determine which systems maintain RPC state information. + +- "None" indicates that the system does not maintain any RPC state information. Note: Because the basic state information required for troubleshooting has a negligible effect on performance and uses only about 4K of memory, this setting is not recommended for most installations. + +- "Auto1" directs RPC to maintain basic state information only if the computer has at least 64 MB of memory. + +- "Auto2" directs RPC to maintain basic state information only if the computer has at least 128 MB of memory and is running Windows 2000 Server, Windows 2000 Advanced Server, or Windows 2000 Datacenter Server. + +- "Server" directs RPC to maintain basic state information on the computer, regardless of its capacity. + +- "Full" directs RPC to maintain complete RPC state information on the system, regardless of its capacity. Because this level can degrade performance, it is recommended for use only while you are investigating an RPC problem. + +> [!NOTE] +> To retrieve the RPC state information from a system that maintains it, you must use a debugging tool. +> +> This policy setting will not be applied until the system is rebooted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Maintain RPC Troubleshooting State Information* +- GP name: *RpcStateInformation* +- GP path: *System\Remote Procedure Call* +- GP ADMX file name: *RPC.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From 3ea6c40928d08f57ed58463ac810a14a4603503d Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 9 Dec 2020 09:25:36 -0800 Subject: [PATCH 036/825] Added MSDT policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 3 + .../policy-configuration-service-provider.md | 14 + .../mdm/policy-csp-admx-msdt.md | 288 ++++++++++++++++++ 4 files changed, 306 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-msdt.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 2e828a600c..2a7a434c65 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -207,6 +207,7 @@ #### [ADMX_MMCSnapins](policy-csp-admx-mmcsnapins.md) #### [ADMX_MSAPolicy](policy-csp-admx-msapolicy.md) #### [ADMX_msched](policy-csp-admx-msched.md) +#### [ADMX_MSDT](policy-csp-admx-msdt.md) #### [ADMX_nca](policy-csp-admx-nca.md) #### [ADMX_NCSI](policy-csp-admx-ncsi.md) #### [ADMX_Netlogon](policy-csp-admx-netlogon.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 80ac1e00c1..40e0c3cfd3 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -298,6 +298,9 @@ ms.date: 10/08/2020 - [ADMX_MSAPolicy/IncludeMicrosoftAccount_DisableUserAuthCmdLine](./policy-csp-admx-msapolicy.md#admx-msapolicy-microsoftaccount-disableuserauth) - [ADMX_msched/ActivationBoundaryPolicy](./policy-csp-admx-msched.md#admx-msched-activationboundarypolicy) - [ADMX_msched/RandomDelayPolicy](./policy-csp-admx-msched.md#admx-msched-randomdelaypolicy) +- [ADMX_MSDT/MsdtSupportProvider](./policy-csp-admx-msdt.md#admx-msdt-msdtsupportprovider) +- [ADMX_MSDT/MsdtToolDownloadPolicy](./policy-csp-admx-msdt.md#admx-msdt-msdttooldownloadpolicy) +- [ADMX_MSDT/WdiScenarioExecutionPolicy](./policy-csp-admx-msdt.md#admx-msdt-wdiscenarioexecutionpolicy) - [ADMX_nca/CorporateResources](./policy-csp-admx-nca.md#admx-nca-corporateresources) - [ADMX_nca/CustomCommands](./policy-csp-admx-nca.md#admx-nca-customcommands) - [ADMX_nca/DTEs](./policy-csp-admx-nca.md#admx-nca-dtes) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index b43c6f5515..5ea40c5c67 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1161,6 +1161,20 @@ The following diagram shows the Policy configuration service provider in tree fo
    +### ADMX_MSDT policies + +
    +
    + ADMX_MSDT/MsdtSupportProvider +
    +
    + ADMX_MSDT/MsdtToolDownloadPolicy +
    +
    + ADMX_MSDT/WdiScenarioExecutionPolicy +
    +
    + ### ADMX_nca policies
    diff --git a/windows/client-management/mdm/policy-csp-admx-msdt.md b/windows/client-management/mdm/policy-csp-admx-msdt.md new file mode 100644 index 0000000000..c22b9c6437 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-msdt.md @@ -0,0 +1,288 @@ +--- +title: Policy CSP - ADMX_MSDT +description: Policy CSP - ADMX_MSDT +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/09/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_MSDT +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_MSDT policies + +
    +
    + ADMX_MSDT/MsdtSupportProvider +
    +
    + ADMX_MSDT/MsdtToolDownloadPolicy +
    +
    + ADMX_MSDT/WdiScenarioExecutionPolicy +
    +
    + + +
    + + +**ADMX_MSDT/MsdtSupportProvider** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures Microsoft Support Diagnostic Tool (MSDT) interactive communication with the support provider. MSDT gathers diagnostic data for analysis by support professionals. + +If you enable this policy setting, users can use MSDT to collect and send diagnostic data to a support professional to resolve a problem. + +By default, the support provider is set to Microsoft Corporation. + +If you disable this policy setting, MSDT cannot run in support mode, and no data can be collected or sent to the support provider. + +If you do not configure this policy setting, MSDT support mode is enabled by default. + +No reboots or service restarts are required for this policy setting to take effect. Changes take effect immediately. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider* +- GP name: *MsdtSupportProvider* +- GP path: *System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool* +- GP ADMX file name: *MSDT.admx* + + + +
    + + +**ADMX_MSDT/MsdtToolDownloadPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts the tool download policy for Microsoft Support Diagnostic Tool. + +Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals. + +For some problems, MSDT may prompt the user to download additional tools for troubleshooting. These tools are required to completely troubleshoot the problem. + +If tool download is restricted, it may not be possible to find the root cause of the problem. + +If you enable this policy setting for remote troubleshooting, MSDT prompts the user to download additional tools to diagnose problems on remote computers only. + +If you enable this policy setting for local and remote troubleshooting, MSDT always prompts for additional tool downloading. + +If you disable this policy setting, MSDT never downloads tools, and is unable to diagnose problems on remote computers. + +If you do not configure this policy setting, MSDT prompts the user before downloading any additional tools. No reboots or service restarts are required for this policy setting to take effect. Changes take effect immediately. + +This policy setting will take effect only when MSDT is enabled. + +This policy setting will only take effect when the Diagnostic Policy Service (DPS) is in the running state. + +When the service is stopped or disabled, diagnostic scenarios are not executed. + +The DPS can be configured with the Services snap-in to the Microsoft Management Console. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Support Diagnostic Tool: Restrict tool download* +- GP name: *MsdtToolDownloadPolicy* +- GP path: *System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool* +- GP ADMX file name: *MSDT.admx* + + + +
    + + +**ADMX_MSDT/WdiScenarioExecutionPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the execution level for Microsoft Support Diagnostic Tool. + +Microsoft Support Diagnostic Tool (MSDT) gathers diagnostic data for analysis by support professionals. If you enable this policy setting, administrators can use MSDT to collect and send diagnostic data to a support professional to resolve a problem. + +If you disable this policy setting, MSDT cannot gather diagnostic data. If you do not configure this policy setting, MSDT is turned on by default. + +This policy setting takes effect only if the diagnostics-wide scenario execution policy is not configured. + +No reboots or service restarts are required for this policy setting to take effect. Changes take effect immediately. + +This policy setting will only take effect when the Diagnostic Policy Service (DPS) is in the running state. When the service is stopped or disabled, diagnostic scenarios will not be executed. The DPS can be configured with the Services snap-in to the Microsoft Management Console. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Microsoft Support Diagnostic Tool: Configure execution level* +- GP name: *WdiScenarioExecutionPolicy* +- GP path: *System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool* +- GP ADMX file name: *MSDT.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From a25ade57d6338eada08b865841c9e7fac3928edb Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Thu, 10 Dec 2020 01:21:18 +0100 Subject: [PATCH 037/825] Update respond-file-alerts.md Changes proposed: - Whitespace standardization and normalization - MarkDown table extended to simplify future editing - Use MD H4 instead of **bold** style paragraph headings Whitespace changes: - remove redundant end-of-line whitespace - whitespace indents: use 3 instead of 4 blank spaces - add MD indent marker (`> `) compatibility spacing Ref. my own comment in PR #8726 --- .../respond-file-alerts.md | 92 +++++++++---------- 1 file changed, 46 insertions(+), 46 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md index 354a099a61..bccc623abc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md @@ -13,7 +13,7 @@ author: mjcaparas ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: M365-security-compliance +ms.collection: M365-security-compliance ms.topic: article --- @@ -25,10 +25,10 @@ ms.topic: article **Applies to:** - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) - + [!include[Prerelease information](../../includes/prerelease.md)] ->Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-responddile-abovefoldlink) +> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-responddile-abovefoldlink) Quickly respond to detected attacks by stopping and quarantining files or blocking a file. After taking action on files, you can check activity details in the Action center. @@ -46,12 +46,12 @@ You can also submit files for deep analysis, to run the file in a secure cloud s Some actions require certain permissions. The following table describes what action certain permissions can take on portable executable (PE) and non-PE files: -Permission | PE files | Non-PE files -:---|:---|:--- -View data | X | X -Alerts investigation | ☑ | X -Live response basic | X | X -Live response advanced | ☑ |☑ +| Permission | PE files | Non-PE files | +| :--------------------- | :------: | :----------: | +| View data | X | X | +| Alerts investigation | ☑ | X | +| Live response basic | X | X | +| Live response advanced | ☑ | ☑ | For more information on roles, see [Create and manage roles for role-based access control](user-roles.md). @@ -60,8 +60,8 @@ For more information on roles, see [Create and manage roles for role-based acces You can contain an attack in your organization by stopping the malicious process and quarantining the file where it was observed. ->[!IMPORTANT] ->You can only take this action if: +> [!IMPORTANT] +> You can only take this action if: > > - The device you're taking the action on is running Windows 10, version 1703 or later > - The file does not belong to trusted third-party publishers or not signed by Microsoft @@ -71,35 +71,35 @@ The **Stop and Quarantine File** action includes stopping running processes, qua This action takes effect on devices with Windows 10, version 1703 or later, where the file was observed in the last 30 days. ->[!NOTE] ->You’ll be able to restore the file from quarantine at any time. +> [!NOTE] +> You’ll be able to restore the file from quarantine at any time. ### Stop and quarantine files 1. Select the file you want to stop and quarantine. You can select a file from any of the following views or use the Search box: - - **Alerts** - click the corresponding links from the Description or Details in the Artifact timeline - - **Search box** - select **File** from the drop–down menu and enter the file name + - **Alerts** - click the corresponding links from the Description or Details in the Artifact timeline + - **Search box** - select **File** from the drop–down menu and enter the file name - >[!NOTE] - >The stop and quarantine file action is limited to a maximum of 1000 devices. To stop a file on a larger number of devices, see [Add indicator to block or allow file](#add-indicator-to-block-or-allow-a-file). + > [!NOTE] + > The stop and quarantine file action is limited to a maximum of 1000 devices. To stop a file on a larger number of devices, see [Add indicator to block or allow file](#add-indicator-to-block-or-allow-a-file). 2. Go to the top bar and select **Stop and Quarantine File**. - ![Image of stop and quarantine file action](images/atp-stop-quarantine-file.png) + ![Image of stop and quarantine file action](images/atp-stop-quarantine-file.png) 3. Specify a reason, then click **Confirm**. - ![Image of stop and quarantine file modal window](images/atp-stop-quarantine.png) + ![Image of stop and quarantine file modal window](images/atp-stop-quarantine.png) - The Action center shows the submission information: - ![Image of stop and quarantine file action center](images/atp-stopnquarantine-file.png) + The Action center shows the submission information: + ![Image of stop and quarantine file action center](images/atp-stopnquarantine-file.png) - - **Submission time** - Shows when the action was submitted. - - **Success** - Shows the number of devices where the file has been stopped and quarantined. - - **Failed** - Shows the number of devices where the action failed and details about the failure. - - **Pending** - Shows the number of devices where the file is yet to be stopped and quarantined from. This can take time for cases when the device is offline or not connected to the network. + - **Submission time** - Shows when the action was submitted. + - **Success** - Shows the number of devices where the file has been stopped and quarantined. + - **Failed** - Shows the number of devices where the action failed and details about the failure. + - **Pending** - Shows the number of devices where the file is yet to be stopped and quarantined from. This can take time for cases when the device is offline or not connected to the network. 4. Select any of the status indicators to view more information about the action. For example, select **Failed** to see where the action failed. @@ -118,9 +118,9 @@ You can roll back and remove a file from quarantine if you’ve determined that 1. Open an elevated command–line prompt on the device: - a. Go to **Start** and type _cmd_. + a. Go to **Start** and type _cmd_. - b. Right–click **Command prompt** and select **Run as administrator**. + b. Right–click **Command prompt** and select **Run as administrator**. 2. Enter the following command, and press **Enter**: @@ -130,26 +130,26 @@ You can roll back and remove a file from quarantine if you’ve determined that > [!NOTE] > In some scenarios, the **ThreatName** may appear as: EUS:Win32/CustomEnterpriseBlock!cl. -> +> > Defender for Endpoint will restore all custom blocked files that were quarantined on this device in the last 30 days. > [!Important] -> A file that was quarantined as a potential network threat might not be recoverable. If a user attempts to restore the file after quarantine, that file might not be accessible. This can be due to the system no longer having network credentials to access the file. Typically, this is a result of a temporary log on to a system or shared folder and the access tokens expired. +> A file that was quarantined as a potential network threat might not be recoverable. If a user attempts to restore the file after quarantine, that file might not be accessible. This can be due to the system no longer having network credentials to access the file. Typically, this is a result of a temporary log on to a system or shared folder and the access tokens expired. ## Add indicator to block or allow a file You can prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file, you can block it. This operation will prevent it from being read, written, or executed on devices in your organization. ->[!IMPORTANT] +> [!IMPORTANT] > ->- This feature is available if your organization uses Microsoft Defender Antivirus and Cloud–delivered protection is enabled. For more information, see [Manage cloud–delivered protection](../microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md). +> - This feature is available if your organization uses Microsoft Defender Antivirus and Cloud–delivered protection is enabled. For more information, see [Manage cloud–delivered protection](../microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus.md). > ->- The Antimalware client version must be 4.18.1901.x or later. ->- This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time. ->- This response action is available for devices on Windows 10, version 1703 or later. ->- The allow or block function cannot be done on files if the file's classification exists on the device's cache prior to the allow or block action. +> - The Antimalware client version must be 4.18.1901.x or later. +> - This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time. +> - This response action is available for devices on Windows 10, version 1703 or later. +> - The allow or block function cannot be done on files if the file's classification exists on the device's cache prior to the allow or block action. ->[!NOTE] +> [!NOTE] > The PE file needs to be in the device timeline for you to be able to take this action. > > There may be a couple of minutes of latency between the time the action is taken and the actual file being blocked. @@ -157,14 +157,14 @@ You can prevent further propagation of an attack in your organization by banning ### Enable the block file feature To start blocking files, you first need to [turn the **Block or allow** feature on](advanced-features.md) in Settings. - + ### Allow or block file When you add an indicator hash for a file, you can choose to raise an alert and block the file whenever a device in your organization attempts to run it. Files automatically blocked by an indicator won't show up in the files's Action center, but the alerts will still be visible in the Alerts queue. - See [manage indicators](manage-indicators.md) for more details on blocking and raising alerts on files. +See [manage indicators](manage-indicators.md) for more details on blocking and raising alerts on files. To stop blocking a file, remove the indicator. You can do so via the **Edit Indicator** action on the file's profile page. This action will be visible in the same position that the **Add Indicator** action was, before you added the indicator. @@ -215,10 +215,10 @@ The Deep analysis summary includes a list of observed *behaviors*, some of which Results of deep analysis are matched against threat intelligence and any matches will generate appropriate alerts. -Use the deep analysis feature to investigate the details of any file, usually during an investigation of an alert or for any other reason where you suspect malicious behavior. This feature is available within the **Deep analysis** tab, on the file's profile page. +Use the deep analysis feature to investigate the details of any file, usually during an investigation of an alert or for any other reason where you suspect malicious behavior. This feature is available within the **Deep analysis** tab, on the file's profile page.

    ->[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4aAYy?rel=0] +> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4aAYy?rel=0] **Submit for deep analysis** is enabled when the file is available in the Defender for Endpoint backend sample collection, or if it was observed on a Windows 10 device that supports submitting to deep analysis. @@ -232,7 +232,7 @@ You can also manually submit a sample through the [Microsoft Security Center Por When the sample is collected, Defender for Endpoint runs the file in is a secure environment and creates a detailed report of observed behaviors and associated artifacts, such as files dropped on devices, communication to IPs, and registry modifications. -**Submit files for deep analysis:** +#### Submit files for deep analysis: 1. Select the file that you want to submit for deep analysis. You can select or search a file from any of the following views: @@ -242,17 +242,17 @@ When the sample is collected, Defender for Endpoint runs the file in is a secure 2. In the **Deep analysis** tab of the file view, click **Submit**. - ![You can only submit PE files in the file details section](images/submit-file.png) + ![You can only submit PE files in the file details section](images/submit-file.png) - > [!NOTE] - > Only PE files are supported, including _.exe_ and _.dll_ files. + > [!NOTE] + > Only PE files are supported, including _.exe_ and _.dll_ files. A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done. > [!NOTE] > Depending on device availability, sample collection time can vary. There is a 3–hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 device reporting at that time. You can re–submit files for deep analysis to get fresh data on the file. -**View deep analysis reports** +#### View deep analysis reports View the deep analysis report that Defender for Endpoint provides to see the details of the deep analysis that was conducted on the file you submitted. This feature is available in the file view context. @@ -268,7 +268,7 @@ The details provided can help you investigate if there are indications of a pote ![The deep analysis report shows detailed information across a number of categories](images/analysis-results-nothing.png) -**Troubleshoot deep analysis** +#### Troubleshoot deep analysis If you encounter a problem when trying to submit a file, try each of the following troubleshooting steps. From 09d352cf07be43b378d26bba38139a0c84c40d12 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 9 Dec 2020 16:36:13 -0800 Subject: [PATCH 038/825] Removed extra
    tags --- windows/client-management/mdm/policy-csp-admx-rpc.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-rpc.md b/windows/client-management/mdm/policy-csp-admx-rpc.md index 2845ab5077..2421a28191 100644 --- a/windows/client-management/mdm/policy-csp-admx-rpc.md +++ b/windows/client-management/mdm/policy-csp-admx-rpc.md @@ -128,8 +128,6 @@ ADMX Info:
    -
    - **ADMX_RPC/RpcIgnoreDelegationFailure** @@ -291,8 +289,6 @@ ADMX Info:
    -
    - **ADMX_RPC/RpcStateInformation** From 429f29a6d0e7fbff0c19d41c046781583c39ca92 Mon Sep 17 00:00:00 2001 From: Sunny Zankharia <67922512+sazankha@users.noreply.github.com> Date: Wed, 9 Dec 2020 18:36:42 -0800 Subject: [PATCH 039/825] Update windowsdefenderapplicationguard-csp.md --- .../mdm/windowsdefenderapplicationguard-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md index 377215d1a7..6699a32617 100644 --- a/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md +++ b/windows/client-management/mdm/windowsdefenderapplicationguard-csp.md @@ -125,7 +125,7 @@ The following list shows the supported values: - 1 - Non-enterprise content embedded on enterprise sites are stopped from opening in Internet Explorer or Microsoft Edge outside of Microsoft Defender Application Guard. > [!NOTE] -> This policy setting is no longer supported in the new Microsoft Edge browser. The policy will be deprecated and removed in a future release. +> This policy setting is no longer supported in the new Microsoft Edge browser. The policy will be deprecated and removed in a future release. Webpages that contain mixed content, both enterprise and non-enterprise, may load incorrectly or fail completely if this feature is enabled. ADMX Info: From 80871aac40a1f430974a6c33eae3ed5a8b310281 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 09:58:06 -0800 Subject: [PATCH 040/825] Update respond-file-alerts.md --- .../microsoft-defender-atp/respond-file-alerts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md index bccc623abc..766691ac1e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md @@ -232,7 +232,7 @@ You can also manually submit a sample through the [Microsoft Security Center Por When the sample is collected, Defender for Endpoint runs the file in is a secure environment and creates a detailed report of observed behaviors and associated artifacts, such as files dropped on devices, communication to IPs, and registry modifications. -#### Submit files for deep analysis: +#### Submit files for deep analysis 1. Select the file that you want to submit for deep analysis. You can select or search a file from any of the following views: From 1ddf6337cb3bb2cc5385ecbd625d35c72b02229d Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 10 Dec 2020 16:40:03 -0800 Subject: [PATCH 041/825] Added RemovableStrorage policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 32 + .../policy-configuration-service-provider.md | 101 + .../mdm/policy-csp-admx-removablestorage.md | 2328 +++++++++++++++++ 4 files changed, 2462 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-removablestorage.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 2a7a434c65..22dc4936a7 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -217,6 +217,7 @@ #### [ADMX_PerformanceDiagnostics](policy-csp-admx-performancediagnostics.md) #### [ADMX_PowerShellExecutionPolicy](policy-csp-admx-powershellexecutionpolicy.md) #### [ADMX_Reliability](policy-csp-admx-reliability.md) +#### [ADMX_RemovableStorage](policy-csp-admx-removablestorage.md) #### [ADMX_RPC](policy-csp-admx-rpc.md) #### [ADMX_Scripts](policy-csp-admx-scripts.md) #### [ADMX_sdiageng](policy-csp-admx-sdiageng.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 40e0c3cfd3..850cba7f7b 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -445,6 +445,38 @@ ms.date: 10/08/2020 - [ADMX_Reliability/PCH_ReportShutdownEvents](./policy-csp-admx-reliability.md#admx-reliability-pch-reportshutdownevents) - [ADMX_Reliability/ShutdownEventTrackerStateFile](./policy-csp-admx-reliability.md#admx-reliability-shutdowneventtrackerstatefile) - [ADMX_Reliability/ShutdownReason](./policy-csp-admx-reliability.md#admx-reliability-shutdownreason) +- [ADMX_RemovableStorage/AccessRights_RebootTime_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-accessrights-reboottime-1) +- [ADMX_RemovableStorage/AccessRights_RebootTime_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-accessrights-reboottime-2) +- [ADMX_RemovableStorage/CDandDVD_DenyExecute_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyexecute-access-2) +- [ADMX_RemovableStorage/CDandDVD_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyread-access-1) +- [ADMX_RemovableStorage/CDandDVD_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyread-access-2) +- [ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denywrite-access-1) +- [ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denywrite-access-2) +- [ADMX_RemovableStorage/CustomClasses_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denyread-access-1) +- [ADMX_RemovableStorage/CustomClasses_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denyread-access-2) +- [ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denywrite-access-1) +- [ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-customclasses-denywrite-access-2) +- [ADMX_RemovableStorage/FloppyDrives_DenyExecute_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyexecute-access-2) +- [ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyread-access-1) +- [ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denyread-access-2) +- [ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denywrite-access-1) +- [ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-floppydrives-denywrite-access-2) +- [ADMX_RemovableStorage/RemovableDisks_DenyExecute_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyexecute-access-2) +- [ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyread-access-1) +- [ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denyread-access-2) +- [ADMX_RemovableStorage/RemovableDisks_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-removabledisks-denywrite-access-1) +- [ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-removablestorageclasses-denyall-access-1) +- [ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-removablestorageclasses-denyall-access-2) +- [ADMX_RemovableStorage/Removable_Remote_Allow_Access](./policy-csp-admx-removablestorage.md#admx-removablestorage-removable-remote-allow-access) +- [ADMX_RemovableStorage/TapeDrives_DenyExecute_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyexecute-access-2) +- [ADMX_RemovableStorage/TapeDrives_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyread-access-1) +- [ADMX_RemovableStorage/TapeDrives_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denyread-access-2) +- [ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denywrite-access-1) +- [ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-tapedrives-denywrite-access-2) +- [ADMX_RemovableStorage/WPDDevices_DenyRead_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denyread-access-1) +- [ADMX_RemovableStorage/WPDDevices_DenyRead_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denyread-access-2) +- [ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denywrite-access-1) +- [ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-wpddevices-denywrite-access-2) - [ADMX_RPC/RpcExtendedErrorInformation](./policy-csp-admx-rpc.md#admx-rpc-rpcextendederrorinformation) - [ADMX_RPC/RpcIgnoreDelegationFailure](./policy-csp-admx-rpc.md#admx-rpc-rpcignoredelegationfailure) - [ADMX_RPC/RpcMinimumHttpConnectionTimeout](./policy-csp-admx-rpc.md#admx-rpc-rpcminimumhttpconnectiontimeout) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 5ea40c5c67..e446aa1591 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1649,6 +1649,107 @@ The following diagram shows the Policy configuration service provider in tree fo
    +### ADMX_RemovableStorage policies + +
    +
    + ADMX_RemovableStorage/AccessRights_RebootTime_1 +
    +
    + ADMX_RemovableStorage/AccessRights_RebootTime_2 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_1 +
    +
    + ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_2 +
    +
    + ADMX_RemovableStorage/Removable_Remote_Allow_Access +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_2 +
    +
    + ### ADMX_RPC policies
    diff --git a/windows/client-management/mdm/policy-csp-admx-removablestorage.md b/windows/client-management/mdm/policy-csp-admx-removablestorage.md new file mode 100644 index 0000000000..eaa2b417ff --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-removablestorage.md @@ -0,0 +1,2328 @@ +--- +title: Policy CSP - ADMX_RemovableStorage +description: Policy CSP - ADMX_RemovableStorage +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/10/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_RemovableStorage +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_RemovableStorage policies + +
    +
    + ADMX_RemovableStorage/AccessRights_RebootTime_1 +
    +
    + ADMX_RemovableStorage/AccessRights_RebootTime_2 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/RemovableDisks_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_1 +
    +
    + ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_2 +
    +
    + ADMX_RemovableStorage/Removable_Remote_Allow_Access +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyExecute_Access_2 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_2 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyRead_Access_1 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyRead_Access_2 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_1 +
    +
    + ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_2 +
    +
    + + +
    + + +**ADMX_RemovableStorage/AccessRights_RebootTime_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the amount of time (in seconds) that the operating system waits to reboot in order to enforce a change in access rights to removable storage devices. + +If you enable this policy setting, you can set the number of seconds you want the system to wait until a reboot. + +If you disable or do not configure this setting, the operating system does not force a reboot. + +> [!NOTE] +> If no reboot is forced, the access right does not take effect until the operating system is restarted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set time (in seconds) to force reboot* +- GP name: *AccessRights_RebootTime_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/AccessRights_RebootTime_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the amount of time (in seconds) that the operating system waits to reboot in order to enforce a change in access rights to removable storage devices. + +If you enable this policy setting, you can set the number of seconds you want the system to wait until a reboot. + +If you disable or do not configure this setting, the operating system does not force a reboot + +> [!NOTE] +> If no reboot is forced, the access right does not take effect until the operating system is restarted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set time (in seconds) to force reboot* +- GP name: *AccessRights_RebootTime_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CDandDVD_DenyExecute_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies execute access to the CD and DVD removable storage class. + +If you enable this policy setting, execute access is denied to this removable storage class. + +If you disable or do not configure this policy setting, execute access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *CD and DVD: Deny execute access* +- GP name: *CDandDVD_DenyExecute_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CDandDVD_DenyRead_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to the CD and DVD removable storage class. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *CD and DVD: Deny read access* +- GP name: *CDandDVD_DenyRead_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CDandDVD_DenyRead_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to the CD and DVD removable storage class. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *CD and DVD: Deny read access* +- GP name: *CDandDVD_DenyRead_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to the CD and DVD removable storage class. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *CD and DVD: Deny write access* +- GP name: *CDandDVD_DenyWrite_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CDandDVD_DenyWrite_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to the CD and DVD removable storage class. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *CD and DVD: Deny write access* +- GP name: *CDandDVD_DenyWrite_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CustomClasses_DenyRead_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to custom removable storage classes. + +If you enable this policy setting, read access is denied to these removable storage classes. + +If you disable or do not configure this policy setting, read access is allowed to these removable storage classes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom Classes: Deny read access* +- GP name: *CustomClasses_DenyRead_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CustomClasses_DenyRead_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to custom removable storage classes. + +If you enable this policy setting, read access is denied to these removable storage classes. + +If you disable or do not configure this policy setting, read access is allowed to these removable storage classes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom Classes: Deny read access* +- GP name: *CustomClasses_DenyRead_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + + +
    + + +**ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to custom removable storage classes. + +If you enable this policy setting, write access is denied to these removable storage classes. + +If you disable or do not configure this policy setting, write access is allowed to these removable storage classes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom Classes: Deny write access* +- GP name: *CustomClasses_DenyWrite_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/CustomClasses_DenyWrite_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to custom removable storage classes. + +If you enable this policy setting, write access is denied to these removable storage classes. + +If you disable or do not configure this policy setting, write access is allowed to these removable storage classes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom Classes: Deny write access* +- GP name: *CustomClasses_DenyWrite_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/FloppyDrives_DenyExecute_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies execute access to the Floppy Drives removable storage class, including USB Floppy Drives. + +If you enable this policy setting, execute access is denied to this removable storage class. + +If you disable or do not configure this policy setting, execute access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Floppy Drives: Deny execute access* +- GP name: *FloppyDrives_DenyExecute_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to the Floppy Drives removable storage class, including USB Floppy Drives. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Floppy Drives: Deny read access* +- GP name: *FloppyDrives_DenyRead_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/FloppyDrives_DenyRead_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to the Floppy Drives removable storage class, including USB Floppy Drives. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Floppy Drives: Deny read access* +- GP name: *FloppyDrives_DenyRead_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to the Floppy Drives removable storage class, including USB Floppy Drives. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Floppy Drives: Deny write access* +- GP name: *FloppyDrives_DenyWrite_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/FloppyDrives_DenyWrite_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to the Floppy Drives removable storage class, including USB Floppy Drives. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Floppy Drives: Deny write access* +- GP name: *FloppyDrives_DenyWrite_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/RemovableDisks_DenyExecute_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies execute access to removable disks. + +If you enable this policy setting, execute access is denied to this removable storage class. + +If you disable or do not configure this policy setting, execute access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Removable Disks: Deny execute access* +- GP name: *RemovableDisks_DenyExecute_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to removable disks. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Removable Disks: Deny read access* +- GP name: *RemovableDisks_DenyRead_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/RemovableDisks_DenyRead_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to removable disks. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Removable Disks: Deny read access* +- GP name: *RemovableDisks_DenyRead_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/RemovableDisks_DenyWrite_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to removable disks. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + +> [!NOTE] +> To require that users write data to BitLocker-protected storage, enable the policy setting "Deny write access to drives not protected by BitLocker," which is located in "Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Removable Disks: Deny write access* +- GP name: *RemovableDisks_DenyWrite_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Configure access to all removable storage classes. + +This policy setting takes precedence over any individual removable storage policy settings. To manage individual classes, use the policy settings available for each class. + +If you enable this policy setting, no access is allowed to any removable storage class. + +If you disable or do not configure this policy setting, write and read accesses are allowed to all removable storage classes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *All Removable Storage classes: Deny all access* +- GP name: *RemovableStorageClasses_DenyAll_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/RemovableStorageClasses_DenyAll_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Configure access to all removable storage classes. + +This policy setting takes precedence over any individual removable storage policy settings. To manage individual classes, use the policy settings available for each class. + +If you enable this policy setting, no access is allowed to any removable storage class. + +If you disable or do not configure this policy setting, write and read accesses are allowed to all removable storage classes. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *All Removable Storage classes: Deny all access* +- GP name: *RemovableStorageClasses_DenyAll_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/Removable_Remote_Allow_Access** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting grants normal users direct access to removable storage devices in remote sessions. + +If you enable this policy setting, remote users can open direct handles to removable storage devices in remote sessions. + +If you disable or do not configure this policy setting, remote users cannot open direct handles to removable storage devices in remote sessions. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *All Removable Storage: Allow direct access in remote sessions* +- GP name: *Removable_Remote_Allow_Access* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/TapeDrives_DenyExecute_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies execute access to the Tape Drive removable storage class. + +If you enable this policy setting, execute access is denied to this removable storage class. + +If you disable or do not configure this policy setting, execute access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Tape Drives: Deny execute access* +- GP name: *TapeDrives_DenyExecute_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/TapeDrives_DenyRead_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to the Tape Drive removable storage class. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Tape Drives: Deny read access* +- GP name: *TapeDrives_DenyRead_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/TapeDrives_DenyRead_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to the Tape Drive removable storage class. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Tape Drives: Deny read access* +- GP name: *TapeDrives_DenyRead_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to the Tape Drive removable storage class. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Tape Drives: Deny write access* +- GP name: *TapeDrives_DenyWrite_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/TapeDrives_DenyWrite_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to the Tape Drive removable storage class. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Tape Drives: Deny write access* +- GP name: *TapeDrives_DenyWrite_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/WPDDevices_DenyRead_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *WPD Devices: Deny read access* +- GP name: *WPDDevices_DenyRead_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/WPDDevices_DenyRead_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies read access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices. + +If you enable this policy setting, read access is denied to this removable storage class. + +If you disable or do not configure this policy setting, read access is allowed to this removable storage class. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *WPD Devices: Deny read access* +- GP name: *WPDDevices_DenyRead_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *WPD Devices: Deny write access* +- GP name: *WPDDevices_DenyWrite_Access_1* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + + +**ADMX_RemovableStorage/WPDDevices_DenyWrite_Access_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting denies write access to removable disks, which may include media players, cellular phones, auxiliary displays, and CE devices. + +If you enable this policy setting, write access is denied to this removable storage class. + +If you disable or do not configure this policy setting, write access is allowed to this removable storage class. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *WPD Devices: Deny write access* +- GP name: *WPDDevices_DenyWrite_Access_2* +- GP path: *System\Removable Storage Access* +- GP ADMX file name: *RemovableStorage.admx* + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file From 7b738c749ef6904d5120a5e674826fbb1a7a3dd2 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Fri, 11 Dec 2020 17:44:34 +0500 Subject: [PATCH 042/825] Command Update There was an issue with the command arguments. Made adjustments in the command. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8721 --- .../threat-protection/microsoft-defender-atp/linux-resources.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md index 3b12f36855..7a265a8e8c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md @@ -97,7 +97,7 @@ The following table lists commands for some of the most common scenarios. Run `m |Configuration |Turn on/off cloud protection |`mdatp config cloud --value [enabled|disabled]` | |Configuration |Turn on/off product diagnostics |`mdatp config cloud-diagnostic --value [enabled|disabled]` | |Configuration |Turn on/off automatic sample submission |`mdatp config cloud-automatic-sample-submission [enabled|disabled]` | -|Configuration |Turn on/off AV passive mode |`mdatp config passive-mode [enabled|disabled]` | +|Configuration |Turn on/off AV passive mode |`mdatp config passive-mode --value [enabled|disabled]` | |Configuration |Add/remove an antivirus exclusion for a file extension |`mdatp exclusion extension [add|remove] --name [extension]` | |Configuration |Add/remove an antivirus exclusion for a file |`mdatp exclusion file [add|remove] --path [path-to-file]` | |Configuration |Add/remove an antivirus exclusion for a directory |`mdatp exclusion folder [add|remove] --path [path-to-directory]` | From 0afc459ed3c77cf47406db586ee904dd5746d1eb Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Fri, 11 Dec 2020 16:08:04 +0100 Subject: [PATCH 043/825] Use escape character before meta characters (pipe) Had to suggest this additional change, seeing that the vertical pipe divider characters (logic 'or' in parameter examples) becomes interpreted as cell dividers by GitHub Flavored MarkDown. - Add the backslash escape character in front of all pipe characters used as logic 'or' between parameter choices. - Remove redundant (and unneeded) excessive backtick characters from inline encapsulations, only 1 (not 3) is needed. --- .../microsoft-defender-atp/linux-resources.md | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md index 7a265a8e8c..969ca9675a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md @@ -75,9 +75,9 @@ There are several ways to uninstall Defender for Endpoint for Linux. If you are ### Manual uninstallation -- ```sudo yum remove mdatp``` for RHEL and variants(CentOS and Oracle Linux). -- ```sudo zypper remove mdatp``` for SLES and variants. -- ```sudo apt-get purge mdatp``` for Ubuntu and Debian systems. +- `sudo yum remove mdatp` for RHEL and variants(CentOS and Oracle Linux). +- `sudo zypper remove mdatp` for SLES and variants. +- `sudo apt-get purge mdatp` for Ubuntu and Debian systems. ## Configure from the command line @@ -93,15 +93,15 @@ The following table lists commands for some of the most common scenarios. Run `m |Group |Scenario |Command | |----------------------|--------------------------------------------------------|-----------------------------------------------------------------------| -|Configuration |Turn on/off real-time protection |`mdatp config real-time-protection --value [enabled|disabled]` | -|Configuration |Turn on/off cloud protection |`mdatp config cloud --value [enabled|disabled]` | -|Configuration |Turn on/off product diagnostics |`mdatp config cloud-diagnostic --value [enabled|disabled]` | -|Configuration |Turn on/off automatic sample submission |`mdatp config cloud-automatic-sample-submission [enabled|disabled]` | -|Configuration |Turn on/off AV passive mode |`mdatp config passive-mode --value [enabled|disabled]` | -|Configuration |Add/remove an antivirus exclusion for a file extension |`mdatp exclusion extension [add|remove] --name [extension]` | -|Configuration |Add/remove an antivirus exclusion for a file |`mdatp exclusion file [add|remove] --path [path-to-file]` | -|Configuration |Add/remove an antivirus exclusion for a directory |`mdatp exclusion folder [add|remove] --path [path-to-directory]` | -|Configuration |Add/remove an antivirus exclusion for a process |`mdatp exclusion process [add|remove] --path [path-to-process]`
    `mdatp exclusion process [add|remove] --name [process-name]` | +|Configuration |Turn on/off real-time protection |`mdatp config real-time-protection --value [enabled\|disabled]` | +|Configuration |Turn on/off cloud protection |`mdatp config cloud --value [enabled\|disabled]` | +|Configuration |Turn on/off product diagnostics |`mdatp config cloud-diagnostic --value [enabled\|disabled]` | +|Configuration |Turn on/off automatic sample submission |`mdatp config cloud-automatic-sample-submission [enabled\|disabled]` | +|Configuration |Turn on/off AV passive mode |`mdatp config passive-mode --value [enabled\|disabled]` | +|Configuration |Add/remove an antivirus exclusion for a file extension |`mdatp exclusion extension [add\|remove] --name [extension]` | +|Configuration |Add/remove an antivirus exclusion for a file |`mdatp exclusion file [add\|remove] --path [path-to-file]` | +|Configuration |Add/remove an antivirus exclusion for a directory |`mdatp exclusion folder [add\|remove] --path [path-to-directory]` | +|Configuration |Add/remove an antivirus exclusion for a process |`mdatp exclusion process [add\|remove] --path [path-to-process]`
    `mdatp exclusion process [add\|remove] --name [process-name]` | |Configuration |List all antivirus exclusions |`mdatp exclusion list` | |Configuration |Add a threat name to the allowed list |`mdatp threat allowed add --name [threat-name]` | |Configuration |Remove a threat name from the allowed list |`mdatp threat allowed remove --name [threat-name]` | @@ -109,7 +109,7 @@ The following table lists commands for some of the most common scenarios. Run `m |Configuration |Turn on PUA protection |`mdatp threat policy set --type potentially_unwanted_application --action block` | |Configuration |Turn off PUA protection |`mdatp threat policy set --type potentially_unwanted_application --action off` | |Configuration |Turn on audit mode for PUA protection |`mdatp threat policy set --type potentially_unwanted_application --action audit` | -|Diagnostics |Change the log level |`mdatp log level set --level verbose [error|warning|info|verbose]` | +|Diagnostics |Change the log level |`mdatp log level set --level verbose [error\|warning\|info\|verbose]` | |Diagnostics |Generate diagnostic logs |`mdatp diagnostic create` | |Health |Check the product's health |`mdatp health` | |Protection |Scan a path |`mdatp scan custom --path [path]` | @@ -152,6 +152,6 @@ In the Defender for Endpoint portal, you'll see two categories of information: - Logged on users do not appear in the Microsoft Defender Security Center portal. - In SUSE distributions, if the installation of *libatomic1* fails, you should validate that your OS is registered: - ```bash + ```bash sudo SUSEConnect --status-text - ``` + ``` From 95f1084e6f521b245cb378ed09cadfbc05aadc24 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Mon, 14 Dec 2020 18:20:45 +0500 Subject: [PATCH 044/825] Link update As suggested I have updated the correct link. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/7896 --- .../microsoft-defender-atp/basic-permissions.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md b/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md index fed2ad3911..af97cb1355 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md +++ b/windows/security/threat-protection/microsoft-defender-atp/basic-permissions.md @@ -47,7 +47,7 @@ You can assign users with one of the following levels of permissions: > [!NOTE] > You need to run the PowerShell cmdlets in an elevated command-line. -- Connect to your Azure Active Directory. For more information, see, [Connect-MsolService](https://msdn.microsoft.com/library/dn194123.aspx). +- Connect to your Azure Active Directory. For more information, see, [Connect-MsolService](https://docs.microsoft.com/powershell/module/msonline/connect-msolservice?view=azureadps-1.0). **Full access**
    Users with full access can log in, view all system information and resolve alerts, submit files for deep analysis, and download the onboarding package. From d8ee7f5e43c8023078e163c1a0df8b4fd7444973 Mon Sep 17 00:00:00 2001 From: Crimsonfox89 <40465227+Crimsonfox89@users.noreply.github.com> Date: Mon, 14 Dec 2020 14:36:40 +0000 Subject: [PATCH 045/825] Update related topic links to docs.microsoft.com links Updated related topic "TPM WMI providers" and "Prepare your organization for BitLocker: Planning and Policies - TPM configurations" links from MSDN/Technet links to Microsoft Docs. --- .../security/information-protection/tpm/tpm-fundamentals.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/information-protection/tpm/tpm-fundamentals.md b/windows/security/information-protection/tpm/tpm-fundamentals.md index e2ae8c85e5..93210372ea 100644 --- a/windows/security/information-protection/tpm/tpm-fundamentals.md +++ b/windows/security/information-protection/tpm/tpm-fundamentals.md @@ -151,5 +151,5 @@ The Windows TPM-based smart card, which is a virtual smart card, can be configur - [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) - [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/trustedplatformmodule/) -- [TPM WMI providers](https://msdn.microsoft.com/library/aa376476.aspx) -- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://technet.microsoft.com/itpro/windows/keep-secure/prepare-your-organization-for-bitlocker-planning-and-policies#bkmk-tpmconfigurations) +- [TPM WMI providers](https://docs.microsoft.com/en-gb/windows/win32/secprov/security-wmi-providers-reference) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://docs.microsoft.com/en-gb/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#tpm-hardware-configurations) From bb7869b07535f9201647ead2e0c07eccfefb26c9 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 15:04:37 -0500 Subject: [PATCH 046/825] Updated create-base-policy sub-topic with spelling/grammar suggestions from acrolinx --- .../wdac-wizard-create-base-policy.md | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index 0d1d32ff12..f532ee4e59 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -1,7 +1,7 @@ --- title: Windows Defender Application Control Wizard Base Policy Creation -description: Creating new base appliation control policies with the Microsoft WDAC Wizard. -keywords: allowlisting, blocklisting, security, malware +description: Creating new base application control policies with the Microsoft Windows Defender Application (WDAC) Wizard. +keywords: allow listing, block listing, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 ms.mktglfcycl: deploy @@ -24,19 +24,19 @@ ms.date: 10/14/2020 - Windows 10 - Windows Server 2016 and above -When creating policies for use with Windows Defender Application Control (WDAC), it is recommended to start from an existing base policy and then add or remove rules to build your own custom policy XML files. For this reason, the WDAC Wizard offers three template policies to start from and customize during the base policy creation workflow. Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a new application control policy from a template, configure the policy options, and the signer and file rules. +When creating policies for use with Windows Defender Application Control (WDAC), it is recommended to start with a template policy and then add or remove rules to suit your application control scenario. For this reason, the WDAC Wizard offers three template policies to start from and customize during the base policy creation workflow. Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a new application control policy from a template, configure the policy options, and the signer and file rules. ## Template Base Policies -Each of the template policies has a unique set of policy allowlist rules which will affect the circle-of-trust and security model of the policy. The following table lists the policies in increasing order of trust and freedom. For instance, the Default Windows mode policy has fewer allowed signer rules, compared to the Signed and Reputable mode, and will offer a more selective circle-of-trust, less flexibility and subquently higher security. +Each of the template policies has a unique set of policy allow list rules that will affect the circle-of-trust and security model of the policy. The following table lists the policies in increasing order of trust and freedom. For instance, the Default Windows mode policy trusts fewer application publishers and signers than the Signed and Reputable mode policy. The Default Windows policy will have a smaller circle-of-trust with better security than the Signed and Reputable policy, but at the expense of compatibility. | **Template Base Policy** | **Description** | |---------------------------------|-------------------------------------------------------------------| -| **Default Windows Mode** | Default Windows mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive and Microsoft Teams
    • Third party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    | -| **Allow Microsoft Mode** | Allow mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive and Microsoft Teams
    • Third party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    • *All Microsoft-signed software*
    | -| **Signed and Reputable Mode** | Signed and Reputable mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive and Microsoft Teams
    • Third party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    • All Microsoft-signed software
    • *Files with good reputation per [Microsoft Defender's Intelligent Security Graph techology](use-windows-defender-application-control-with-intelligent-security-graph)*
    | +| **Default Windows Mode** | Default Windows mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    | +| **Allow Microsoft Mode** | Allow mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    • *All Microsoft-signed software*
    | +| **Signed and Reputable Mode** | Signed and Reputable mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    • All Microsoft-signed software
    • *Files with good reputation per [Microsoft Defender's Intelligent Security Graph technology](use-windows-defender-application-control-with-intelligent-security-graph)*
    | *Italized content denotes the changes in the current policy with respect to the policy prior.* @@ -47,18 +47,18 @@ Once the base template is selected, give the policy a name and choose where to s ## Configuring Policy Rules -Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. Hovering the mouse over the policy rule title will display a short description of the rule at the bottom of the page. +Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. A short description of each rule will appear at the bottom of the page when the mouse hovers over the rule title. ### Policy Rules Description -A description of the policy rules, beginning with the left-most column are provided below. +A description of each policy rule, beginning with the left-most column, is provided below. | Rule option | Description | |------------ | ----------- | | **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | | **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | | **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | -|**[Hypervisor-protected code integrity](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. This provides stronger protections against kernel malware.| +|**[Hypervisor-protected code integrity (HVCI)](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| | **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | | **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | @@ -68,15 +68,15 @@ A description of the policy rules, beginning with the left-most column are provi ### Advanced Policy Rules Description -Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of the policy rules are provided below. +Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of each policy rule is provided below. | Rule option | Description | |------------ | ----------- | | **Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | -| **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. | +| **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flight/preview-signed builds. | | **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | -| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. | -| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.| +| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically loaded libraries (DLLs). | +| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.| | **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | @@ -88,29 +88,29 @@ Selecting the **+ Advanced Options** label will show another column of policy ru ## Creating custom file rules -File rules in an application control policy will specify the level at which appiations will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports 4 types of file rules: +File rules in an application control policy will specify the level at which applications will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create custom file rules for your policy. The Wizard supports four types of file rules: ### Publisher Rules -The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specifity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. | Rule Condition | WDAC Rule Level | Description | |------------ | ----------- | ----------- | | **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate will be affected. | | **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example a device driver corp, is affected. | -| **File version** | SignedVersion | This rule is a combination of PCACertificate, Publisher and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | -| **File name** | FilePublisher | Most specific. Combination of the file name, publisher and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | +| **File version** | SignedVersion | This rule is a combination of PCACertificate, publisher, and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | +| **File name** | FilePublisher | Most specific. Combination of the file name, publisher, and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | ![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) ### Filepath Rules -Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a filepath rule, simply select the file using the *Browse* button. +Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a filepath rule, select the file using the *Browse* button. ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (eg. DLLs) may all share the same product name, for instance. This allows users to easily create targeted policies based on the Product Name filename rule level. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name parameter. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | From f039be808ff15bafce5f18b910d642bc1c21fae8 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 15:17:46 -0500 Subject: [PATCH 047/825] Updated wdac-wizard.md to fix spelling and grammar per Acrolinx scorecard --- .../wdac-wizard.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md index c21368ab72..89403445f6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md @@ -1,6 +1,6 @@ --- title: Windows Defender Application Control Wizard -description: Microsoft WDAC Wizard allows users to create, edit and merge application control policies in a simple to use Windows application. +description: Microsoft Defender Application Control Wizard (WDAC) Wizard allows users to create, edit, and merge application control policies in a simple to use Windows application. keywords: allowlisting, blocklisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: w10 @@ -25,11 +25,11 @@ ms.date: 10/14/2020 - Windows 10 - Windows Server 2016 and above -This topic describes the supported scenarios for the Windows Defender Application Control (WDAC) policy Wizard. The Wizard was built to provide security architects, security administrators, and system administrators with a more user-friendly means to create, edit and merge application control policies using a GUI desktop application. The Wizard uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/en-us/powershell/module/configci/?view=win10-ps) in the background so the output policy of the Wizard and PowerShell cmdlets are identical. +This article describes the supported scenarios for the Windows Defender Application Control (WDAC) policy Wizard. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/en-us/powershell/module/configci/?view=win10-ps) in the background so the output policy of the Wizard and PowerShell cmdlets is identical. ## Downloading the application -The latest version of the application is available for download from the official [Microsoft WDAC Wizard installer website](https://bit.ly/3koHwYs) as an MSIX packaged application. Additionally, the source code for the Wizard is also available as part of Microsoft's Open Source Software offerings on Github at the [WDAC Wizard Repo](https://github.com/MicrosoftDocs/WDAC-Toolkit). +The WDAC Wizard can be downloaded from the official [Wizard installer website](https://bit.ly/3koHwYs) as an MSIX packaged application. The Wizard's source code is available as part of Microsoft's Open Source Software offerings on GitHub at the [WDAC Wizard Repo](https://github.com/MicrosoftDocs/WDAC-Toolkit). **Supported Clients** @@ -38,16 +38,16 @@ As the WDAC Wizard uses the cmdlets in the background, the Wizard is functional - Windows builds 1909+ - For pre-1909 builds, the Enterprise SKU of Windows is installed -If neither requirement is satisfied, the Wizard will not allow for creating, editing or merging policies. +If neither requirement is satisfied, the Wizard will throw an error as the cmdlets are not available. ## In this section | Topic | Description | | - | - | -| [Creating a new base policy](wdac-wizard-create-base-policy.md) | This topic describes the how to create a new base policy using one of the supplied policy templates. | -| [Creating a new supplemental policy](wdac-wizard-create-supplemental-policy.md) | This topic describes the steps necessary to create a supplemental policy, from one of the supplied templates, for an existing base policy. | -| [Editing a base or supplemental policy](wdac-wizard-edit-policy.md) | This topic demonstrates how to modify an existing policy and the Wizard's editing capabilities. | -| [Merging policies](wdac-wizard-merging-policies.md) | This topic describes how to merge policies into a single application control policy. | -| [Deploying policies from the Wizard](wdac-wizard-deploying-policies.md) | This topic describes how to deploy application control policies onto target devices. | +| [Creating a new base policy](wdac-wizard-create-base-policy.md) | This article describes how to create a new base policy using one of the supplied policy templates. | +| [Creating a new supplemental policy](wdac-wizard-create-supplemental-policy.md) | This article describes the steps necessary to create a supplemental policy, from one of the supplied templates, for an existing base policy. | +| [Editing a base or supplemental policy](wdac-wizard-edit-policy.md) | This article demonstrates how to modify an existing policy and the Wizard's editing capabilities. | +| [Merging policies](wdac-wizard-merging-policies.md) | This article describes how to merge policies into a single application control policy. | +| [Deploying policies from the Wizard](wdac-wizard-deploying-policies.md) | This article describes how to deploy application control policies onto target devices. | From c96a8ddee724d98fb665ca7ca9c8e62994dca78b Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 15:35:18 -0500 Subject: [PATCH 048/825] updated wdac-wizard-create-supplemental-policy.md for grammar/spelling --- .../wdac-wizard-create-supplemental-policy.md | 35 +++++++++---------- 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index 77ebccf335..6dc20f1ffe 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -30,27 +30,26 @@ Prerequisite information about application control can be accessed through the [ ## Expanding a Base Policy -Once the Policy Creator > Supplemental Policy type is chosen, a policy name and file location dialog will appear to name and save the supplemental policy. The next step requires selecting a base policy to expand. To expand a base policy, the base must allow supplemental policies. The WDAC Wizard will verify whether the base poliy allows supplementals and will show either of the following confirmations. +Once the Supplemental Policy type is chosen on the New Policy page, policy name and file dialog fields can be used to name and save the supplemental policy. The next step requires selecting a base policy to expand. To expand a base policy, the base must allow supplemental policies. The WDAC Wizard will verify if the base policy allows supplementals and will show the following confirmation. ![Base policy allows supplemental policies](images/wdac-wizard-supplemental-expandable.png) -![Base policy does not allow supplemental policies](images/wdac-wizard-supplemental-not-expandable.png) If the base policy is not configured for supplemental policies, first edit the base policy to allow supplementals using the [WDAC Wizard edit workflow](edac-wizard-editing-policy.md). ## Configuring Policy Rules -Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. Hovering the mouse over the policy rule title will display a short description of the rule at the bottom of the page. +Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. A short description of the rule will be shown at the bottom of the page when the cursor is placed on the rule title. ### Policy Rules Description -A description of the policy rules, beginning with the left-most column are provided below. +A description of each policy rule, beginning with the left-most column, is provided below. | Rule option | Description | |------------ | ----------- | | **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | | **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | | **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | -|**[Hypervisor-protected code integrity](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. This provides stronger protections against kernel malware.| +|**[Hypervisor-protected code integrity (HVCI)](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| | **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | | **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | @@ -60,15 +59,15 @@ A description of the policy rules, beginning with the left-most column are provi ### Advanced Policy Rules Description -Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of the policy rules are provided below. +Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of each policy rule is provided below. | Rule option | Description | |------------ | ----------- | | **Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | -| **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. | +| **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This setting should be used in scenarios where organizations only want to run production binaries, not flight/preivew-signed builds. | | **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | -| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. | -| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.| +| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically loaded libraries. | +| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.| | **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | @@ -80,17 +79,17 @@ Selecting the **+ Advanced Options** label will show another column of policy ru ## Creating custom file rules -File rules in an application control policy will specify the level at which appiations will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports 4 types of file rules: +File rules in an application control policy will specify the level at which applications will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports four types of file rules: ### Publisher Rules -The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specifity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specificity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level, and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. | Rule Condition | WDAC Rule Level | Description | |------------ | ----------- | ----------- | -| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate will be affected. | -| **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example a device driver corp, is affected. | -| **File version** | SignedVersion | This rule is a combination of PCACertificate, Publisher and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | +| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This certificate is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate will be affected. | +| **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example a device driver publisher, is affected. | +| **File version** | SignedVersion | This rule is a combination of the PCACertificate and Publisher rule, and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | | **File name** | FilePublisher | Most specific. Combination of the file name, publisher and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | @@ -98,11 +97,11 @@ The Publisher file rule type uses properties in the code signing certificate cha ### Filepath Rules -Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a filepath rule, simply select the file using the *Browse* button. +Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a filepath rule, select the file using the *Browse* button. ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (eg. DLLs) may all share the same product name, for instance. This allows users to easily create targeted policies based on the Product Name filename rule level. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | @@ -121,8 +120,8 @@ Lastly, the Wizard supports creating file rules using the hash of the file. Alth #### Deleting Signing Rules -The policy signing rules list table on the left of the page will document the allow and deny rules in the template, as well as any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you will be prompted for additional confirmation. Select `Yes` to remove the rule from the policy and the rules table. +The table on the left of the page will document the allow and deny rules in the template, as well as any custom rules you create. Rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you will be prompted for additional confirmation. Select `Yes` to remove the rule from the policy and the rules table. ## Up next -- [Editing a WDAC policy using the Wizard](wdac-wizard-editing-policy.md) \ No newline at end of file +- [Editing a WDAC policy using the Wizard](wdac-wizard-editing-policy.md) From c70c8ee8812de16b0c4c8b9f52202ebfad5083d2 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 15:49:59 -0500 Subject: [PATCH 049/825] fixed grammar/spelling in wdac-wizard-editing-policy.md --- .../wdac-wizard-editing-policy.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md index d3ef342f31..ec71f80aba 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md @@ -18,13 +18,13 @@ ms.topic: conceptual ms.date: 10/14/2020 --- -# Editing exisiting base and supplemental WDAC policies with the Wizard +# Editing existing base and supplemental WDAC policies with the Wizard **Applies to** - Windows 10 - Windows Server 2016 and above -The WDAC Wizard makes editing and viewing base and supplemental WDAC policies much easier than by hand or using the PowerShell Cmdlets. The Wizard currently supports the following editing capbilities: +The WDAC Wizard makes editing and viewing WDAC policies easier than the PowerShell cmdlets or manually. The Wizard currently supports the following editing capabilities:
    • [Configuring policy rules](#Configuring-Policy-Rules)
    • [Adding new allow or block file rules to existing policies](#Adding-File-Rules)
      • @@ -34,21 +34,21 @@ The WDAC Wizard makes editing and viewing base and supplemental WDAC policies mu # Configuring Policy Rules -The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains additional policy rule options which are less common to the majority of users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#Adding-File-Rules). +The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains additional policy rule options that are less common to the majority of users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#Adding-File-Rules). ![Configuring the policy rules](images/wdac-wizard-edit-policy-rules.png) -Hovering the mouse over the policy rule names will display a short description of the ruleat the bottom of the page.For a complete list of the policy rules and their capabilities see the [Windows Defender Application Control policy rules table](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules). +A description of the policy rule is shown at the bottom of the page when the cursor is placed over the rule title. For a complete list of the policy rules and their capabilities, see the [Windows Defender Application Control policy rules table](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules). ## Adding File Rules -Previously, to add rules to an existing policy, users would be required to create a new policy and merge it with their existing policy, or edit the policy by hand. The WDAC Wizard allows users to add rules to their exising policy seamlessly. +The WDAC Wizard allows users to add rules to their existing policy seamlessly. Previously, this would have involved creating a new policy with the new rules and merging it with the existing policy. Selecting the `+ Custom Rules` button will open the Custom Rules panel. For more information on creating new policy file rules, see the guidelines provided in the [creating policy file rules section](wdac-wizard-create-base-policy.md#Creating-custom-file-rules). ## Removing File Rules -The WDAC Wizard makes deleting file rules from an existing policy quick and easy. To remove any type of file rule: publisher rule, path rule, filename rule or a hash rule, simply click on the rule in the `Policy Signing Rules List` table on the lefthand side of the page. Selecting the rule will highlight the entire row. Once the row is highlighted, select the remove icon underneath the table. The Wizard will prompt for user confirmation before removing the file rule. Once removed, the rule will no longer appear in the policy or the table. +The WDAC Wizard makes deleting file rules from an existing policy quick and easy. To remove any type of file rule: publisher rule, path rule, filename rule, or a hash rule, select the rule in the `Policy Signing Rules List` table on the left-hand side of the page. Selecting the rule will highlight the entire row. Once the row is highlighted, select the remove icon underneath the table. The Wizard will prompt for user confirmation before removing the file rule. Once removed, the rule will no longer appear in the policy or the table. ![Removing file rule from policy during edit](image/wdac-wizard-edit-remove-file-rule.png) @@ -66,8 +66,8 @@ The WDAC Wizard makes deleting file rules from an existing policy quick and easy ### Policy Creation -Once the WDAC Wizard finalizes creation of your edited policy, the new policy will be written to the same file path and name as the in-edit policy with the new version appended to the end of the file name. For instance, if the in-edit policy is saved at MyDocuments\BasePolicy.xml, after edit, the new policy will be saved at MyDocuments\BasePolicy_v10.0.0.1.xml. +Once the policy is created, the new policy will be written to the same path as the in-edit policy. The new policy file name will have the policy version appended to the end of the file name. For instance, if the in-edit policy is saved at MyDocuments\BasePolicy.xml, after edit, the new policy will be saved at MyDocuments\BasePolicy_v10.0.0.1.xml. ## Up next -- [Merging WDAC policies using the Wizard](wdac-wizard-merging-policies.md) \ No newline at end of file +- [Merging WDAC policies using the Wizard](wdac-wizard-merging-policies.md) From 15ef5a5dcb2e6dafff3de6cb9a0624fe81d356e1 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 15:56:08 -0500 Subject: [PATCH 050/825] fixed grammar/spelling in merging policies article --- .../wdac-wizard-merging-policies.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md index 53f2c6162d..eca772e093 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md @@ -20,13 +20,13 @@ ms.date: 10/14/2020 # Merging existing policies with the WDAC Wizard -Beginning in Windows 10 version 1903, WDAC supports multiple policies. Before version 1903, however, Windows 10 could only have one WDAC policy. Consquently, users were required to merge multiple WDAC policies into one. The WDAC Wizard has a simple to use user interface to allow users to merge multiple WDAC policies. The Wizard can support up to 15 policy files as input during the merge workflow. +Beginning in Windows 10 version 1903, WDAC supports multiple policies. Before version 1903, however, Windows 10 could only have one WDAC policy. Consequently, users were required to merge multiple WDAC policies into one. The WDAC Wizard has a simple to use user interface to allow users to merge multiple WDAC policies. The Wizard can support up to 15 policy files as input during the merge workflow. -Simply select the policies you wish to merge into one policy using the `+ Add Policy` button under the table. Once added, policies will be enumerated within the table. To remove a policy from the table, in the case of accidental addition, highlight the policy row and click the `- Remove Policy` button. Confirmation will be required before the policy is withdrawn from the table. +Select the policies you wish to merge into one policy using the `+ Add Policy` button under the table. Once added, policies will be enumerated within the table. To remove a policy from the table, if accidentally added, highlight the policy row and select the `- Remove Policy` button. Confirmation will be required before the policy is withdrawn from the table. > [!NOTE] > The policy type and ID of the final output policy will be determined based on the type and ID of the **first policy** in the policy list table. For instance, if a legacy policy format policy and a multi-policy format policy are merged together, the output format of the policy will be whichever policy is specified first in the table. For more information on policy formats, visit the [Multiple WDAC Policies page](deploy-multiple-windows-defender-application-control-policies). -Lastly, select a filepath save location for the final merged policy on disk using the Browse button. Once at least two policies to merge are specified, and the output file location is set, click Next to build the policy. +Lastly, select a filepath save location for the final merged policy using the `Browse` button. If a minimum of two policies are selected, and the save location is specified, select the `Next` button to build the policy. -![Merging WDAC policies into a final WDAC policy](images/wdac-wizard-merge.png) \ No newline at end of file +![Merging WDAC policies into a final WDAC policy](images/wdac-wizard-merge.png) From cb480eefb414fd2b68e0478d268aa73e21770c97 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 17:40:26 -0500 Subject: [PATCH 051/825] Fixed broken links for edit policy article and deploying policy articles. --- .../windows-defender-application-control/wdac-wizard.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md index 89403445f6..4e765e5339 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md @@ -25,7 +25,7 @@ ms.date: 10/14/2020 - Windows 10 - Windows Server 2016 and above -This article describes the supported scenarios for the Windows Defender Application Control (WDAC) policy Wizard. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/en-us/powershell/module/configci/?view=win10-ps) in the background so the output policy of the Wizard and PowerShell cmdlets is identical. +This article describes the supported scenarios for the Windows Defender Application Control (WDAC) policy Wizard. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](https://docs.microsoft.com/powershell/module/configci/?view=win10-ps) in the background so the output policy of the Wizard and PowerShell cmdlets is identical. ## Downloading the application @@ -46,8 +46,5 @@ If neither requirement is satisfied, the Wizard will throw an error as the cmdle | - | - | | [Creating a new base policy](wdac-wizard-create-base-policy.md) | This article describes how to create a new base policy using one of the supplied policy templates. | | [Creating a new supplemental policy](wdac-wizard-create-supplemental-policy.md) | This article describes the steps necessary to create a supplemental policy, from one of the supplied templates, for an existing base policy. | -| [Editing a base or supplemental policy](wdac-wizard-edit-policy.md) | This article demonstrates how to modify an existing policy and the Wizard's editing capabilities. | +| [Editing a base or supplemental policy](wdac-wizard-editing-policy.md) | This article demonstrates how to modify an existing policy and the Wizard's editing capabilities. | | [Merging policies](wdac-wizard-merging-policies.md) | This article describes how to merge policies into a single application control policy. | -| [Deploying policies from the Wizard](wdac-wizard-deploying-policies.md) | This article describes how to deploy application control policies onto target devices. | - - From bbb3142a8b02f6e0e02df4dc8573202e581bb2d9 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 17:43:08 -0500 Subject: [PATCH 052/825] Fixed broken Multiple WDAC Policies page link in WDAC Wizard merge policy article --- .../wdac-wizard-merging-policies.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md index eca772e093..1b7d604a49 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md @@ -25,7 +25,7 @@ Beginning in Windows 10 version 1903, WDAC supports multiple policies. Before ve Select the policies you wish to merge into one policy using the `+ Add Policy` button under the table. Once added, policies will be enumerated within the table. To remove a policy from the table, if accidentally added, highlight the policy row and select the `- Remove Policy` button. Confirmation will be required before the policy is withdrawn from the table. > [!NOTE] -> The policy type and ID of the final output policy will be determined based on the type and ID of the **first policy** in the policy list table. For instance, if a legacy policy format policy and a multi-policy format policy are merged together, the output format of the policy will be whichever policy is specified first in the table. For more information on policy formats, visit the [Multiple WDAC Policies page](deploy-multiple-windows-defender-application-control-policies). +> The policy type and ID of the final output policy will be determined based on the type and ID of the **first policy** in the policy list table. For instance, if a legacy policy format policy and a multi-policy format policy are merged together, the output format of the policy will be whichever policy is specified first in the table. For more information on policy formats, visit the [Multiple WDAC Policies page](deploy-multiple-windows-defender-application-control-policies.md). Lastly, select a filepath save location for the final merged policy using the `Browse` button. If a minimum of two policies are selected, and the save location is specified, select the `Next` button to build the policy. From 4dad3db2b6a37a505eb22ddb2d77aac2bceb63ac Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 17:51:25 -0500 Subject: [PATCH 053/825] Fixed broken image link and page header references --- .../wdac-wizard-editing-policy.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md index ec71f80aba..a239d415ec 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md @@ -1,5 +1,5 @@ --- -title: Windows Defender Application Control Wizard Base Policy Creation +title: Editing Windows Defender Application Control Policies with the Wizard description: Editing existing base and supplemental policies with the Microsoft WDAC Wizard. keywords: allowlisting, blocklisting, security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -32,9 +32,9 @@ The WDAC Wizard makes editing and viewing WDAC policies easier than the PowerShe
    -# Configuring Policy Rules +## Configuring Policy Rules -The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains additional policy rule options that are less common to the majority of users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#Adding-File-Rules). +The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains additional policy rule options that are less common to the majority of users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#adding-file-rules). ![Configuring the policy rules](images/wdac-wizard-edit-policy-rules.png) @@ -44,13 +44,13 @@ A description of the policy rule is shown at the bottom of the page when the cur The WDAC Wizard allows users to add rules to their existing policy seamlessly. Previously, this would have involved creating a new policy with the new rules and merging it with the existing policy. -Selecting the `+ Custom Rules` button will open the Custom Rules panel. For more information on creating new policy file rules, see the guidelines provided in the [creating policy file rules section](wdac-wizard-create-base-policy.md#Creating-custom-file-rules). +Selecting the `+ Custom Rules` button will open the Custom Rules panel. For more information on creating new policy file rules, see the guidelines provided in the [creating policy file rules section](wdac-wizard-create-base-policy.md#creating-custom-file-rules). ## Removing File Rules The WDAC Wizard makes deleting file rules from an existing policy quick and easy. To remove any type of file rule: publisher rule, path rule, filename rule, or a hash rule, select the rule in the `Policy Signing Rules List` table on the left-hand side of the page. Selecting the rule will highlight the entire row. Once the row is highlighted, select the remove icon underneath the table. The Wizard will prompt for user confirmation before removing the file rule. Once removed, the rule will no longer appear in the policy or the table. -![Removing file rule from policy during edit](image/wdac-wizard-edit-remove-file-rule.png) +![Removing file rule from policy during edit](images/wdac-wizard-edit-remove-file-rule.png) **Note:** removing a publisher rule will also remove the associated File Attribute rules. For instance, in the xml block below, removing ID_SIGNER_CONTOSO_PUBLISHER would also remove the rules ID_FILEATTRIB_LOB_APP_1 and ID_FILEATTRIB_LOB_APP_2. From 70d27f25c9e3799da866eb66563bb3ce73a6ebf9 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 17:55:11 -0500 Subject: [PATCH 054/825] Fixed broken link to select-types-of-rules-to-create.md#windows-defender-application-control-filename-rules and hardcoded locale (en-us) link in HVCI article --- .../wdac-wizard-create-supplemental-policy.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index 6dc20f1ffe..4383ca390b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -34,7 +34,7 @@ Once the Supplemental Policy type is chosen on the New Policy page, policy name ![Base policy allows supplemental policies](images/wdac-wizard-supplemental-expandable.png) -If the base policy is not configured for supplemental policies, first edit the base policy to allow supplementals using the [WDAC Wizard edit workflow](edac-wizard-editing-policy.md). +If the base policy is not configured for supplemental policies, first edit the base policy to allow supplementals using the [WDAC Wizard edit workflow](wdac-wizard-editing-policy.md). ## Configuring Policy Rules @@ -49,7 +49,7 @@ A description of each policy rule, beginning with the left-most column, is provi | **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | | **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | | **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | -|**[Hypervisor-protected code integrity (HVCI)](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| +|**[Hypervisor-protected code integrity (HVCI)](https://docs.microsoft.com/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| | **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | | **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | @@ -101,7 +101,7 @@ Filepath rules do not provide the same security guarantees that explicit signer ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | From 1a31685da0367b6b2f3866ecebfb5b17f321ea47 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 14 Dec 2020 18:00:10 -0500 Subject: [PATCH 055/825] Fixed more hardcoded locales by removing "en-us" from article links. Also fixed references to the wdac official docs (use-windows-defender-application-control-with-intelligent-security-graph missing .md file ext) --- .../wdac-wizard-create-base-policy.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index f532ee4e59..d9afb2c2a1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -34,9 +34,9 @@ Each of the template policies has a unique set of policy allow list rules that w | **Template Base Policy** | **Description** | |---------------------------------|-------------------------------------------------------------------| -| **Default Windows Mode** | Default Windows mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    | -| **Allow Microsoft Mode** | Allow mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    • *All Microsoft-signed software*
    | -| **Signed and Reputable Mode** | Signed and Reputable mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/en-us/windows-hardware/drivers/install/whql-release-signature)
    • All Microsoft-signed software
    • *Files with good reputation per [Microsoft Defender's Intelligent Security Graph technology](use-windows-defender-application-control-with-intelligent-security-graph)*
    | +| **Default Windows Mode** | Default Windows mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/windows-hardware/drivers/install/whql-release-signature)
    | +| **Allow Microsoft Mode** | Allow mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/windows-hardware/drivers/install/whql-release-signature)
    • *All Microsoft-signed software*
    | +| **Signed and Reputable Mode** | Signed and Reputable mode will authorize the following components:
    • Windows operating components - any binary installed by a fresh install of Windows
    • Apps installed from the Microsoft Store
    • Microsoft Office365 apps, OneDrive, and Microsoft Teams
    • Third-party [Windows Hardware Compatible drivers](https://docs.microsoft.com/windows-hardware/drivers/install/whql-release-signature)
    • All Microsoft-signed software
    • *Files with good reputation per [Microsoft Defender's Intelligent Security Graph technology](use-windows-defender-application-control-with-intelligent-security-graph.md)*
    | *Italized content denotes the changes in the current policy with respect to the policy prior.* @@ -58,7 +58,7 @@ A description of each policy rule, beginning with the left-most column, is provi | **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | | **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | | **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | -|**[Hypervisor-protected code integrity (HVCI)](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| +|**[Hypervisor-protected code integrity (HVCI)](https://docs.microsoft.com/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| | **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | | **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | @@ -110,7 +110,7 @@ Filepath rules do not provide the same security guarantees that explicit signer ### File Attribute Rules -The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name parameter. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create.md#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (for example, DLLs) may all share the same product name, for instance. This rule level allows users to easily create targeted policies based on the Product Name file name parameter. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. | Rule level | Description | |------------ | ----------- | From 669d17a35bfaa6589494600b796412c82770d98b Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 14 Dec 2020 15:44:37 -0800 Subject: [PATCH 056/825] Added Globalization policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 26 + .../policy-configuration-service-provider.md | 83 + .../mdm/policy-csp-admx-globalization.md | 2040 +++++++++++++++++ 4 files changed, 2150 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-globalization.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 22dc4936a7..ace9da625a 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -197,6 +197,7 @@ #### [ADMX_FileServerVSSProvider](policy-csp-admx-fileservervssprovider.md) #### [ADMX_FileSys](policy-csp-admx-filesys.md) #### [ADMX_FolderRedirection](policy-csp-admx-folderredirection.md) +#### [ADMX_Globalization](policy-csp-admx-globalization.md) #### [ADMX_Help](policy-csp-admx-help.md) #### [ADMX_HelpAndSupport](policy-csp-admx-helpandsupport.md) #### [ADMX_kdc](policy-csp-admx-kdc.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 850cba7f7b..eb920b0fb5 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -163,6 +163,32 @@ ms.date: 10/08/2020 - [ADMX_FolderRedirection/LocalizeXPRelativePaths_2](./policy-csp-admx-folderredirection.md#admx-folderredirection-localizexprelativepaths-2) - [ADMX_FolderRedirection/PrimaryComputer_FR_1](./policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-1) - [ADMX_FolderRedirection/PrimaryComputer_FR_2](./policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-2) +- [ADMX_Globalization/BlockCleanupOfUnusedPreinstalledLangPacks](./policy-csp-admx-globalization.md#admx-globalization-blockcleanupofunusedpreinstalledlangpacks) +- [ADMX_Globalization/BlockUserInputMethodsForSignIn](./policy-csp-admx-globalization.md#admx-globalization-blockuserinputmethodsforsignin) +- [ADMX_Globalization/CustomLocalesNoSelect_1](./policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-1) +- [ADMX_Globalization/CustomLocalesNoSelect_2](./policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-2) +- [ADMX_Globalization/HideAdminOptions](./policy-csp-admx-globalization.md#admx-globalization-hideadminoptions) +- [ADMX_Globalization/HideCurrentLocation](./policy-csp-admx-globalization.md#admx-globalization-hidecurrentlocation) +- [ADMX_Globalization/HideLanguageSelection](./policy-csp-admx-globalization.md#admx-globalization-hidelanguageselection) +- [ADMX_Globalization/HideLocaleSelectAndCustomize](./policy-csp-admx-globalization.md#admx-globalization-hidelocaleselectandcustomize) +- [ADMX_Globalization/ImplicitDataCollectionOff_1](./policy-csp-admx-globalization.md#admx-globalization-implicitdatacollectionoff-1) +- [ADMX_Globalization/ImplicitDataCollectionOff_2](./policy-csp-admx-globalization.md#admx-globalization-implicitdatacollectionoff-2) +- [ADMX_Globalization/LocaleSystemRestrict](./policy-csp-admx-globalization.md#admx-globalization-localesystemrestrict) +- [ADMX_Globalization/LocaleUserRestrict_1](./policy-csp-admx-globalization.md#admx-globalization-localeuserrestrict-1) +- [ADMX_Globalization/LocaleUserRestrict_2](./policy-csp-admx-globalization.md#admx-globalization-localeuserrestrict-2) +- [ADMX_Globalization/LockMachineUILanguage](./policy-csp-admx-globalization.md#admx-globalization-lockmachineuilanguage) +- [ADMX_Globalization/LockUserUILanguage](./policy-csp-admx-globalization.md#admx-globalization-lockuseruilanguage) +- [ADMX_Globalization/MachineUILanguageOverwrite](./policy-csp-admx-globalization.md#admx-globalization-machineuilanguageoverwrite) +- [ADMX_Globalization/PreventGeoIdChange_1](./policy-csp-admx-globalization.md#admx-globalization-preventgeoidchange-1) +- [ADMX_Globalization/PreventGeoIdChange_2](./policy-csp-admx-globalization.md#admx-globalization-preventgeoidchange-2) +- [ADMX_Globalization/PreventUserOverrides_1](./policy-csp-admx-globalization.md#admx-globalization-preventuseroverrides-1) +- [ADMX_Globalization/PreventUserOverrides_2](./policy-csp-admx-globalization.md#admx-globalization-preventuseroverrides-2) +- [ADMX_Globalization/RestrictUILangSelect](./policy-csp-admx-globalization.md#admx-globalization-restrictuilangselect) +- [ADMX_Globalization/TurnOffAutocorrectMisspelledWords](./policy-csp-admx-globalization.md#admx-globalization-turnoffautocorrectmisspelledwords) +- [ADMX_Globalization/TurnOffHighlightMisspelledWords](./policy-csp-admx-globalization.md#admx-globalization-turnoffhighlightmisspelledwords) +- [ADMX_Globalization/TurnOffInsertSpace](./policy-csp-admx-globalization.md#admx-globalization-turnoffinsertspace) +- [ADMX_Globalization/TurnOffOfferTextPredictions](./policy-csp-admx-globalization.md#admx-globalization-turnoffoffertextpredictions) +- [ADMX_Globalization/Y2K](./policy-csp-admx-globalization.md#admx-globalization-y2k) - [ADMX_Help/DisableHHDEP](./policy-csp-admx-help.md#admx-help-disablehhdep) - [ADMX_Help/HelpQualifiedRootDir_Comp](./policy-csp-admx-help.md#admx-help-helpqualifiedrootdir-comp) - [ADMX_Help/RestrictRunFromHelp](./policy-csp-admx-help.md#admx-help-restrictrunfromhelp) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index e446aa1591..58bfd3a1a2 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -713,6 +713,89 @@ The following diagram shows the Policy configuration service provider in tree fo
    +### ADMX_Globalization policies + +
    +
    + ADMX_Globalization/BlockCleanupOfUnusedPreinstalledLangPacks +
    +
    + ADMX_Globalization/BlockUserInputMethodsForSignIn +
    +
    + ADMX_Globalization/CustomLocalesNoSelect_1 +
    +
    + ADMX_Globalization/CustomLocalesNoSelect_2 +
    +
    + ADMX_Globalization/HideAdminOptions +
    +
    + ADMX_Globalization/HideCurrentLocation +
    +
    + ADMX_Globalization/HideLanguageSelection +
    +
    + ADMX_Globalization/HideLocaleSelectAndCustomize +
    +
    + ADMX_Globalization/ImplicitDataCollectionOff_1 +
    +
    + ADMX_Globalization/ImplicitDataCollectionOff_2 +
    +
    + ADMX_Globalization/LocaleSystemRestrict +
    +
    + ADMX_Globalization/LocaleUserRestrict_1 +
    +
    + ADMX_Globalization/LocaleUserRestrict_2 +
    +
    + ADMX_Globalization/LockMachineUILanguage +
    +
    + ADMX_Globalization/LockUserUILanguage +
    +
    + ADMX_Globalization/MachineUILanguageOverwrite +
    +
    + ADMX_Globalization/PreventGeoIdChange_1 +
    +
    + ADMX_Globalization/PreventGeoIdChange_2 +
    +
    + ADMX_Globalization/PreventUserOverrides_1 +
    +
    + ADMX_Globalization/PreventUserOverrides_2 +
    +
    + ADMX_Globalization/RestrictUILangSelect +
    +
    + ADMX_Globalization/TurnOffAutocorrectMisspelledWords +
    +
    + ADMX_Globalization/TurnOffHighlightMisspelledWords +
    +
    + ADMX_Globalization/TurnOffInsertSpace +
    +
    + ADMX_Globalization/TurnOffOfferTextPredictions +
    +
    + ADMX_Globalization/Y2K +
    +
    + ### ADMX_Help policies
    diff --git a/windows/client-management/mdm/policy-csp-admx-globalization.md b/windows/client-management/mdm/policy-csp-admx-globalization.md new file mode 100644 index 0000000000..e471cdf6e7 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-globalization.md @@ -0,0 +1,2040 @@ +--- +title: Policy CSP - ADMX_Globalization +description: Policy CSP - ADMX_Globalization +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/14/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Globalization +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Globalization policies + +
    +
    + ADMX_Globalization/BlockCleanupOfUnusedPreinstalledLangPacks +
    +
    + ADMX_Globalization/BlockUserInputMethodsForSignIn +
    +
    + ADMX_Globalization/CustomLocalesNoSelect_1 +
    +
    + ADMX_Globalization/CustomLocalesNoSelect_2 +
    +
    + ADMX_Globalization/HideAdminOptions +
    +
    + ADMX_Globalization/HideCurrentLocation +
    +
    + ADMX_Globalization/HideLanguageSelection +
    +
    + ADMX_Globalization/HideLocaleSelectAndCustomize +
    +
    + ADMX_Globalization/ImplicitDataCollectionOff_1 +
    +
    + ADMX_Globalization/ImplicitDataCollectionOff_2 +
    +
    + ADMX_Globalization/LocaleSystemRestrict +
    +
    + ADMX_Globalization/LocaleUserRestrict_1 +
    +
    + ADMX_Globalization/LocaleUserRestrict_2 +
    +
    + ADMX_Globalization/LockMachineUILanguage +
    +
    + ADMX_Globalization/LockUserUILanguage +
    +
    + ADMX_Globalization/MachineUILanguageOverwrite +
    +
    + ADMX_Globalization/PreventGeoIdChange_1 +
    +
    + ADMX_Globalization/PreventGeoIdChange_2 +
    +
    + ADMX_Globalization/PreventUserOverrides_1 +
    +
    + ADMX_Globalization/PreventUserOverrides_2 +
    +
    + ADMX_Globalization/RestrictUILangSelect +
    +
    + ADMX_Globalization/TurnOffAutocorrectMisspelledWords +
    +
    + ADMX_Globalization/TurnOffHighlightMisspelledWords +
    +
    + ADMX_Globalization/TurnOffInsertSpace +
    +
    + ADMX_Globalization/TurnOffOfferTextPredictions +
    +
    + ADMX_Globalization/Y2K +
    +
    + + +
    + + +**ADMX_Globalization/BlockCleanupOfUnusedPreinstalledLangPacks** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the LPRemove task will run to clean up language packs installed on a machine but are not used by any users on that machine. + +If you enable this policy setting, language packs that are installed as part of the system image will remain installed even if they are not used by any user on that system. + +If you disable or do not configure this policy setting, language packs that are installed as part of the system image but are not used by any user on that system will be removed as part of a scheduled clean up task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Block clean-up of unused language packs* +- GP name: *BlockCleanupOfUnusedPreinstalledLangPacks* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/BlockUserInputMethodsForSignIn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy prevents automatic copying of user input methods to the system account for use on the sign-in screen. The user is restricted to the set of input methods that are enabled in the system account. + +Note this does not affect the availability of user input methods on the lock screen or with the UAC prompt. + +If the policy is Enabled, then the user will get input methods enabled for the system account on the sign-in page. + +If the policy is Disabled or Not Configured, then the user will be able to use input methods enabled for their user account on the sign-in page. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow copying of user input methods to the system account for sign-in* +- GP name: *BlockUserInputMethodsForSignIn* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/CustomLocalesNoSelect_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents a user from selecting a supplemental custom locale as their user locale. The user is restricted to the set of locales that are installed with the operating system. + +This does not affect the selection of replacement locales. To prevent the selection of replacement locales, adjust the permissions of the %windir%\Globalization directory to prevent the installation of locales by unauthorized users. + +The policy setting "Restrict user locales" can also be enabled to disallow selection of a custom locale, even if this policy setting is not configured. + +If you enable this policy setting, the user cannot select a custom locale as their user locale, but they can still select a replacement locale if one is installed. + +If you disable or do not configure this policy setting, the user can select a custom locale as their user locale. + +If this policy setting is enabled at the machine level, it cannot be disabled by a per-user policy setting. If this policy setting is disabled at the machine level, the per-user policy setting will be ignored. If this policy setting is not configured at the machine level, restrictions will be based on per-user policy settings. + +To set this policy setting on a per-user basis, make sure that you do not configure the per-machine policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow selection of Custom Locales* +- GP name: *CustomLocalesNoSelect_1* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/CustomLocalesNoSelect_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents a user from selecting a supplemental custom locale as their user locale. The user is restricted to the set of locales that are installed with the operating system. + +This does not affect the selection of replacement locales. To prevent the selection of replacement locales, adjust the permissions of the %windir%\Globalization directory to prevent the installation of locales by unauthorized users. + +The policy setting "Restrict user locales" can also be enabled to disallow selection of a custom locale, even if this policy setting is not configured. + +If you enable this policy setting, the user cannot select a custom locale as their user locale, but they can still select a replacement locale if one is installed. + +If you disable or do not configure this policy setting, the user can select a custom locale as their user locale. + +If this policy setting is enabled at the machine level, it cannot be disabled by a per-user policy setting. If this policy setting is disabled at the machine level, the per-user policy setting will be ignored. If this policy setting is not configured at the machine level, restrictions will be based on per-user policy settings. + +To set this policy setting on a per-user basis, make sure that you do not configure the per-machine policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow selection of Custom Locales* +- GP name: *CustomLocalesNoSelect_2* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/HideAdminOptions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the Administrative options from the Region settings control panel. + +Administrative options include interfaces for setting system locale and copying settings to the default user. This policy setting does not, however, prevent an administrator or another application from changing these values programmatically. + +This policy setting is used only to simplify the Regional Options control panel. + +If you enable this policy setting, the user cannot see the Administrative options. + +If you disable or do not configure this policy setting, the user can see the Administrative options. + +> [!NOTE] +> Even if a user can see the Administrative options, other policies may prevent them from modifying the values. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Regional and Language Options administrative options* +- GP name: *HideAdminOptions* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/HideCurrentLocation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the option to change the user's geographical location (GeoID) from the Region settings control panel. + +This policy setting is used only to simplify the Regional Options control panel. + +If you enable this policy setting, the user does not see the option to change the GeoID. This does not prevent the user or an application from changing the GeoID programmatically. + +If you disable or do not configure this policy setting, the user sees the option for changing the user location (GeoID). + +> [!NOTE] +> Even if a user can see the GeoID option, the "Disallow changing of geographical location" option can prevent them from actually changing their current geographical location. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the geographic location option* +- GP name: *HideCurrentLocation* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/HideLanguageSelection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the option to change the user's menus and dialogs (UI) language from the Language and Regional Options control panel. + +This policy setting is used only to simplify the Regional Options control panel. + +If you enable this policy setting, the user does not see the option for changing the UI language. This does not prevent the user or an application from changing the UI language programmatically. If you disable or do not configure this policy setting, the user sees the option for changing the UI language. + +> [!NOTE] +> Even if a user can see the option to change the UI language, other policy settings can prevent them from changing their UI language. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the select language group options* +- GP name: *HideLanguageSelection* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/HideLocaleSelectAndCustomize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting removes the regional formats interface from the Region settings control panel. + +This policy setting is used only to simplify the Regional and Language Options control panel. + +If you enable this policy setting, the user does not see the regional formats options. This does not prevent the user or an application from changing their user locale or user overrides programmatically. + +If you disable or do not configure this policy setting, the user sees the regional formats options for changing and customizing the user locale. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide user locale selection and customization options* +- GP name: *HideLocaleSelectAndCustomize* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/ImplicitDataCollectionOff_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off the automatic learning component of handwriting recognition personalization. + +Automatic learning enables the collection and storage of text and ink written by the user in order to help adapt handwriting recognition to the vocabulary and handwriting style of the user. Text that is collected includes all outgoing messages in Windows Mail, and MAPI enabled email clients, as well as URLs from the Internet Explorer browser history. The information that is stored includes word frequency and new words not already known to the handwriting recognition engines (for example, proper names and acronyms). Deleting email content or the browser history does not delete the stored personalization data. Ink entered through Input Panel is collected and stored. + +> [!NOTE] +> Automatic learning of both text and ink might not be available for all languages, even when handwriting personalization is available. See Tablet PC Help for more information. + +If you enable this policy setting, automatic learning stops and any stored data is deleted. Users cannot configure this setting in Control Panel. + +If you disable this policy setting, automatic learning is turned on. Users cannot configure this policy setting in Control Panel. Collected data is only used for handwriting recognition, if handwriting personalization is turned on. + +If you do not configure this policy, users can choose to enable or disable automatic learning either from the Handwriting tab in the Tablet Settings in Control Panel or from the opt-in dialog. + +This policy setting is related to the "Turn off handwriting personalization" policy setting. + +> [!NOTE] +> The amount of stored ink is limited to 50 MB and the amount of text information to approximately 5 MB. When these limits are reached and new data is collected, old data is deleted to make room for more recent data. +> +> Handwriting personalization works only for Microsoft handwriting recognizers, and not with third-party recognizers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off automatic learning* +- GP name: *ImplicitDataCollectionOff_1* +- GP path: *Control Panel\Regional and Language Options\Handwriting personalization* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/ImplicitDataCollectionOff_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off the automatic learning component of handwriting recognition personalization. + +Automatic learning enables the collection and storage of text and ink written by the user in order to help adapt handwriting recognition to the vocabulary and handwriting style of the user. Text that is collected includes all outgoing messages in Windows Mail, and MAPI enabled email clients, as well as URLs from the Internet Explorer browser history. The information that is stored includes word frequency and new words not already known to the handwriting recognition engines (for example, proper names and acronyms). Deleting email content or the browser history does not delete the stored personalization data. Ink entered through Input Panel is collected and stored. + +> [!NOTE] +> Automatic learning of both text and ink might not be available for all languages, even when handwriting personalization is available. See Tablet PC Help for more information. + +If you enable this policy setting, automatic learning stops and any stored data is deleted. Users cannot configure this setting in Control Panel. + +If you disable this policy setting, automatic learning is turned on. Users cannot configure this policy setting in Control Panel. Collected data is only used for handwriting recognition, if handwriting personalization is turned on. + +If you do not configure this policy, users can choose to enable or disable automatic learning either from the Handwriting tab in the Tablet Settings in Control Panel or from the opt-in dialog. + +This policy setting is related to the "Turn off handwriting personalization" policy setting. + +> [!NOTE] +> The amount of stored ink is limited to 50 MB and the amount of text information to approximately 5 MB. When these limits are reached and new data is collected, old data is deleted to make room for more recent data. +> +> Handwriting personalization works only for Microsoft handwriting recognizers, and not with third-party recognizers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off automatic learning* +- GP name: *ImplicitDataCollectionOff_2* +- GP path: *Control Panel\Regional and Language Options\Handwriting personalization* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/LocaleSystemRestrict** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts the permitted system locales to the specified list. If the list is empty, it locks the system locale to its current value. This policy setting does not change the existing system locale; however, the next time that an administrator attempts to change the computer's system locale, they will be restricted to the specified list. + +The locale list is specified using language names, separated by a semicolon (;). For example, en-US is English (United States). Specifying "en-US;en-CA" would restrict the system locale to English (United States) and English (Canada). + +If you enable this policy setting, administrators can select a system locale only from the specified system locale list. + +If you disable or do not configure this policy setting, administrators can select any system locale shipped with the operating system. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict system locales* +- GP name: *LocaleSystemRestrict* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/LocaleUserRestrict_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts users on a computer to the specified list of user locales. If the list is empty, it locks all user locales to their current values. This policy setting does not change existing user locale settings; however, the next time a user attempts to change their user locale, their choices will be restricted to locales in this list. + +To set this policy setting on a per-user basis, make sure that you do not configure the per-computer policy setting. + +The locale list is specified using language tags, separated by a semicolon (;). For example, en-US is English (United States). Specifying "en-CA;fr-CA" would restrict the user locale to English (Canada) and French (Canada). + +If you enable this policy setting, only locales in the specified locale list can be selected by users. + +If you disable or do not configure this policy setting, users can select any locale installed on the computer, unless restricted by the "Disallow selection of Custom Locales" policy setting. If this policy setting is enabled at the computer level, it cannot be disabled by a per-user policy. If this policy setting is disabled at the computer level, the per-user policy is ignored. If this policy setting is not configured at the computer level, restrictions are based on per-user policies. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict user locales* +- GP name: *LocaleUserRestrict_1* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/LocaleUserRestrict_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts users on a computer to the specified list of user locales. If the list is empty, it locks all user locales to their current values. This policy setting does not change existing user locale settings; however, the next time a user attempts to change their user locale, their choices will be restricted to locales in this list. + +To set this policy setting on a per-user basis, make sure that you do not configure the per-computer policy setting. + +The locale list is specified using language tags, separated by a semicolon (;). For example, en-US is English (United States). Specifying "en-CA;fr-CA" would restrict the user locale to English (Canada) and French (Canada). + +If you enable this policy setting, only locales in the specified locale list can be selected by users. + +If you disable or do not configure this policy setting, users can select any locale installed on the computer, unless restricted by the "Disallow selection of Custom Locales" policy setting. + +If this policy setting is enabled at the computer level, it cannot be disabled by a per-user policy. If this policy setting is disabled at the computer level, the per-user policy is ignored. If this policy setting is not configured at the computer level, restrictions are based on per-user policies. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict user locales* +- GP name: *LocaleUserRestrict_2* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/LockMachineUILanguage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts the Windows UI language for all users. + +This is a policy setting for computers with more than one UI language installed. + +If you enable this policy setting, the UI language of Windows menus and dialogs for systems with more than one language will follow the language specified by the administrator as the system UI languages. The UI language selected by the user will be ignored if it is different than any of the system UI languages. + +If you disable or do not configure this policy setting, the user can specify which UI language is used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restricts the UI language Windows uses for all logged users* +- GP name: *LockMachineUILanguage* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/LockUserUILanguage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts the Windows UI language for specific users. + +This policy setting applies to computers with more than one UI language installed. + +If you enable this policy setting, the UI language of Windows menus and dialogs for systems with more than one language is restricted to a specified language for the selected user. If the specified language is not installed on the target computer or you disable this policy setting, the language selection defaults to the language selected by the user. + +If you disable or do not configure this policy setting, there is no restriction on which language users should use. + +To enable this policy setting in Windows Server 2003, Windows XP, or Windows 2000, to use the "Restrict selection of Windows menus and dialogs language" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restricts the UI languages Windows should use for the selected user* +- GP name: *LockUserUILanguage* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/MachineUILanguageOverwrite** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls which UI language is used for computers with more than one UI language installed. + +If you enable this policy setting, the UI language of Windows menus and dialogs for systems with more than one language is restricted to a specified language. If the specified language is not installed on the target computer or you disable this policy setting, the language selection defaults to the language selected by the local administrator. + +If you disable or do not configure this policy setting, there is no restriction of a specific language used for the Windows menus and dialogs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Force selected system UI language to overwrite the user UI language* +- GP name: *MachineUILanguageOverwrite* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/PreventGeoIdChange_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from changing their user geographical location (GeoID). + +If you enable this policy setting, users cannot change their GeoID. + +If you disable or do not configure this policy setting, users may select any GeoID. + +If you enable this policy setting at the computer level, it cannot be disabled by a per-user policy setting. If you disable this policy setting at the computer level, the per-user policy is ignored. If you do not configure this policy setting at the computer level, restrictions are based on per-user policy settings. + +To set this policy setting on a per-user basis, make sure that the per-computer policy setting is not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow changing of geographic location* +- GP name: *PreventGeoIdChange_1* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/PreventGeoIdChange_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from changing their user geographical location (GeoID). + +If you enable this policy setting, users cannot change their GeoID. + +If you disable or do not configure this policy setting, users may select any GeoID. + +If you enable this policy setting at the computer level, it cannot be disabled by a per-user policy setting. If you disable this policy setting at the computer level, the per-user policy is ignored. If you do not configure this policy setting at the computer level, restrictions are based on per-user policy settings. + +To set this policy setting on a per-user basis, make sure that the per-computer policy setting is not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow changing of geographic location* +- GP name: *PreventGeoIdChange_2* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/PreventUserOverrides_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents the user from customizing their locale by changing their user overrides. + +Any existing overrides in place when this policy is enabled will be frozen. To remove existing user overrides, first reset the user(s) values to the defaults and then apply this policy. + +When this policy setting is enabled, users can still choose alternate locales installed on the system unless prevented by other policies, however, they will be unable to customize those choices. + +The user cannot customize their user locale with user overrides. + +If this policy setting is disabled or not configured, then the user can customize their user locale overrides. + +If this policy is set to Enabled at the computer level, then it cannot be disabled by a per-User policy. If this policy is set to Disabled at the computer level, then the per-User policy will be ignored. If this policy is set to Not Configured at the computer level, then restrictions will be based on per-User policies. + +To set this policy on a per-user basis, make sure that the per-computer policy is set to Not Configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow user override of locale settings* +- GP name: *PreventUserOverrides_1* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/PreventUserOverrides_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents the user from customizing their locale by changing their user overrides. + +Any existing overrides in place when this policy is enabled will be frozen. To remove existing user overrides, first reset the user(s) values to the defaults and then apply this policy. + +When this policy setting is enabled, users can still choose alternate locales installed on the system unless prevented by other policies, however, they will be unable to customize those choices. + +The user cannot customize their user locale with user overrides. + +If this policy setting is disabled or not configured, then the user can customize their user locale overrides. + +If this policy is set to Enabled at the computer level, then it cannot be disabled by a per-User policy. If this policy is set to Disabled at the computer level, then the per-User policy will be ignored. If this policy is set to Not Configured at the computer level, then restrictions will be based on per-User policies. + +To set this policy on a per-user basis, make sure that the per-computer policy is set to Not Configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow user override of locale settings* +- GP name: *PreventUserOverrides_2* +- GP path: *System\Locale Services* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/RestrictUILangSelect** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts users to the specified language by disabling the menus and dialog box controls in the Region settings control panel. If the specified language is not installed on the target computer, the language selection defaults to English. + +If you enable this policy setting, the dialog box controls in the Regional and Language Options control panel are not accessible to the logged on user. This prevents users from specifying a language different than the one used. + +To enable this policy setting in Windows Vista, use the "Restricts the UI languages Windows should use for the selected user" policy setting. + +If you disable or do not configure this policy setting, the logged-on user can access the dialog box controls in the Regional and Language Options control panel to select any available UI language. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict selection of Windows menus and dialogs language* +- GP name: *RestrictUILangSelect* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/TurnOffAutocorrectMisspelledWords** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy turns off the autocorrect misspelled words option. This does not, however, prevent the user or an application from changing the setting programmatically. + +The autocorrect misspelled words option controls whether or not errors in typed text will be automatically corrected. + +If the policy is Enabled, then the option will be locked to not autocorrect misspelled words. + +If the policy is Disabled or Not Configured, then the user will be free to change the setting according to their preference. + +Note that the availability and function of this setting is dependent on supported languages being enabled. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off autocorrect misspelled words* +- GP name: *TurnOffAutocorrectMisspelledWords* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/TurnOffHighlightMisspelledWords** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy turns off the highlight misspelled words option. This does not, however, prevent the user or an application from changing the setting programmatically. + +The highlight misspelled words option controls whether or next spelling errors in typed text will be highlighted. + +If the policy is Enabled, then the option will be locked to not highlight misspelled words. + +If the policy is Disabled or Not Configured, then the user will be free to change the setting according to their preference. + +Note that the availability and function of this setting is dependent on supported languages being enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off highlight misspelled words* +- GP name: *TurnOffHighlightMisspelledWords* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/TurnOffInsertSpace** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy turns off the insert a space after selecting a text prediction option. This does not, however, prevent the user or an application from changing the setting programmatically. + +The insert a space after selecting a text prediction option controls whether or not a space will be inserted after the user selects a text prediction candidate when using the on-screen keyboard. + +If the policy is Enabled, then the option will be locked to not insert a space after selecting a text prediction. + +If the policy is Disabled or Not Configured, then the user will be free to change the setting according to their preference. + +Note that the availability and function of this setting is dependent on supported languages being enabled. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off insert a space after selecting a text prediction* +- GP name: *TurnOffInsertSpace* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/TurnOffOfferTextPredictions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy turns off the offer text predictions as I type option. This does not, however, prevent the user or an application from changing the setting programmatically. + +The offer text predictions as I type option controls whether or not text prediction suggestions will be presented to the user on the on-screen keyboard. + +If the policy is Enabled, then the option will be locked to not offer text predictions. + +If the policy is Disabled or Not Configured, then the user will be free to change the setting according to their preference. + +Note that the availability and function of this setting is dependent on supported languages being enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off offer text predictions as I type* +- GP name: *TurnOffOfferTextPredictions* +- GP path: *Control Panel\Regional and Language Options* +- GP ADMX file name: *Globalization.admx* + + + +
    + + +**ADMX_Globalization/Y2K** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines how programs interpret two-digit years. + +This policy setting affects only the programs that use this Windows feature to interpret two-digit years. If a program does not interpret two-digit years correctly, consult the documentation or manufacturer of the program. + +If you enable this policy setting, the system specifies the largest two-digit year interpreted as being preceded by 20. All numbers less than or equal to the specified value are interpreted as being preceded by 20. All numbers greater than the specified value are interpreted as being preceded by 19. + +For example, the default value, 2029, specifies that all two-digit years less than or equal to 29 (00 to 29) are interpreted as being preceded by 20, that is 2000 to 2029. Conversely, all two-digit years greater than 29 (30 to 99) are interpreted as being preceded by 19, that is, 1930 to 1999. + +If you disable or do not configure this policy setting, Windows does not interpret two-digit year formats using this scheme for the program. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Century interpretation for Year 2000* +- GP name: *Y2K* +- GP path: *System* +- GP ADMX file name: *Globalization.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file From 6c088caa45a70bb004c68ec7af18508b1391d04d Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 14 Dec 2020 16:12:44 -0800 Subject: [PATCH 057/825] Added RemoteAssistance policeis --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 2 + .../policy-configuration-service-provider.md | 11 + .../mdm/policy-csp-admx-remoteassistance.md | 205 ++++++++++++++++++ 4 files changed, 219 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-remoteassistance.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index ace9da625a..7068f51134 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -218,6 +218,7 @@ #### [ADMX_PerformanceDiagnostics](policy-csp-admx-performancediagnostics.md) #### [ADMX_PowerShellExecutionPolicy](policy-csp-admx-powershellexecutionpolicy.md) #### [ADMX_Reliability](policy-csp-admx-reliability.md) +#### [ADMX_RemoteAssistance](policy-csp-admx-remoteassistance.md) #### [ADMX_RemovableStorage](policy-csp-admx-removablestorage.md) #### [ADMX_RPC](policy-csp-admx-rpc.md) #### [ADMX_Scripts](policy-csp-admx-scripts.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index eb920b0fb5..2480c5ab09 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -471,6 +471,8 @@ ms.date: 10/08/2020 - [ADMX_Reliability/PCH_ReportShutdownEvents](./policy-csp-admx-reliability.md#admx-reliability-pch-reportshutdownevents) - [ADMX_Reliability/ShutdownEventTrackerStateFile](./policy-csp-admx-reliability.md#admx-reliability-shutdowneventtrackerstatefile) - [ADMX_Reliability/ShutdownReason](./policy-csp-admx-reliability.md#admx-reliability-shutdownreason) +- [ADMX_RemoteAssistance/RA_EncryptedTicketOnly](./policy-csp-admx-remoteassistance.md#admx-remoteassistance-ra-encryptedticketonly) +- [ADMX_RemoteAssistance/RA_Optimize_Bandwidth](./policy-csp-admx-remoteassistance.md#admx-remoteassistance-ra-optimize-bandwidth) - [ADMX_RemovableStorage/AccessRights_RebootTime_1](./policy-csp-admx-removablestorage.md#admx-removablestorage-accessrights-reboottime-1) - [ADMX_RemovableStorage/AccessRights_RebootTime_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-accessrights-reboottime-2) - [ADMX_RemovableStorage/CDandDVD_DenyExecute_Access_2](./policy-csp-admx-removablestorage.md#admx-removablestorage-cdanddvd-denyexecute-access-2) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 58bfd3a1a2..de3ab67cea 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1732,6 +1732,17 @@ The following diagram shows the Policy configuration service provider in tree fo
    +### ADMX_RemoteAssistance policies + +
    +
    + ADMX_RemoteAssistance/RA_EncryptedTicketOnly +
    +
    + ADMX_RemoteAssistance/RA_Optimize_Bandwidth +
    +
    + ### ADMX_RemovableStorage policies
    diff --git a/windows/client-management/mdm/policy-csp-admx-remoteassistance.md b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md new file mode 100644 index 0000000000..6d1135eab4 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md @@ -0,0 +1,205 @@ +--- +title: Policy CSP - ADMX_RemoteAssistance +description: Policy CSP - ADMX_RemoteAssistance +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/14/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_RemoteAssistance +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_RemoteAssistance policies + +
    +
    + ADMX_RemoteAssistance/RA_EncryptedTicketOnly +
    +
    + ADMX_RemoteAssistance/RA_Optimize_Bandwidth +
    +
    + + +
    + + +**ADMX_RemoteAssistance/RA_EncryptedTicketOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting enables Remote Assistance invitations to be generated with improved encryption so that only computers running this version (or later versions) of the operating system can connect. This policy setting does not affect Remote Assistance connections that are initiated by instant messaging contacts or the unsolicited Offer Remote Assistance. + +If you enable this policy setting, only computers running this version (or later versions) of the operating system can connect to this computer. + +If you disable this policy setting, computers running this version and a previous version of the operating system can connect to this computer. + +If you do not configure this policy setting, users can configure the setting in System Properties in the Control Panel. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow only Windows Vista or later connections* +- GP name: *RA_EncryptedTicketOnly* +- GP path: *System\Remote Assistance* +- GP ADMX file name: *RemoteAssistance.admx* + + + +
    + + +**ADMX_RemoteAssistance/RA_Optimize_Bandwidth** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to improve performance in low bandwidth scenarios. + +This setting is incrementally scaled from "No optimization" to "Full optimization". Each incremental setting includes the previous optimization setting. + +For example: + +"Turn off background" will include the following optimizations: + +- No full window drag +- Turn off background + +"Full optimization" will include the following optimizations: + +- Use 16-bit color (8-bit color in Windows Vista) +- Turn off font smoothing (not supported in Windows Vista) +- No full window drag +- Turn off background + +If you enable this policy setting, bandwidth optimization occurs at the level specified. + +If you disable this policy setting, application-based settings are used. + +If you do not configure this policy setting, application-based settings are used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on bandwidth optimization* +- GP name: *RA_Optimize_Bandwidth* +- GP path: *System\Remote Assistance* +- GP ADMX file name: *RemoteAssistance.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file From 8c6f6eb20929200bcc2c06bae033bd8374e5044a Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Tue, 15 Dec 2020 14:00:38 +0100 Subject: [PATCH 058/825] Important -> IMPORTANT (consistency) - Add uppercase for the Important blob. Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../microsoft-defender-atp/respond-file-alerts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md index 766691ac1e..ef8a82a89f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md @@ -133,7 +133,7 @@ You can roll back and remove a file from quarantine if you’ve determined that > > Defender for Endpoint will restore all custom blocked files that were quarantined on this device in the last 30 days. -> [!Important] +> [!IMPORTANT] > A file that was quarantined as a potential network threat might not be recoverable. If a user attempts to restore the file after quarantine, that file might not be accessible. This can be due to the system no longer having network credentials to access the file. Typically, this is a result of a temporary log on to a system or shared folder and the access tokens expired. ## Add indicator to block or allow a file From 32274198ec5a3a29ac03277f0a01d9bc3d9285f1 Mon Sep 17 00:00:00 2001 From: Crimsonfox89 <40465227+Crimsonfox89@users.noreply.github.com> Date: Tue, 15 Dec 2020 14:21:33 +0000 Subject: [PATCH 059/825] Update windows/security/information-protection/tpm/tpm-fundamentals.md Language agnostic Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../security/information-protection/tpm/tpm-fundamentals.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/information-protection/tpm/tpm-fundamentals.md b/windows/security/information-protection/tpm/tpm-fundamentals.md index 93210372ea..462656a2ad 100644 --- a/windows/security/information-protection/tpm/tpm-fundamentals.md +++ b/windows/security/information-protection/tpm/tpm-fundamentals.md @@ -151,5 +151,5 @@ The Windows TPM-based smart card, which is a virtual smart card, can be configur - [Trusted Platform Module](trusted-platform-module-top-node.md) (list of topics) - [TPM Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/trustedplatformmodule/) -- [TPM WMI providers](https://docs.microsoft.com/en-gb/windows/win32/secprov/security-wmi-providers-reference) -- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://docs.microsoft.com/en-gb/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#tpm-hardware-configurations) +- [TPM WMI providers](https://docs.microsoft.com/windows/win32/secprov/security-wmi-providers-reference) +- [Prepare your organization for BitLocker: Planning and Policies - TPM configurations](https://docs.microsoft.com/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies#tpm-hardware-configurations) From ac09e26c58d592e3d9b93acfe91f5246b3813d31 Mon Sep 17 00:00:00 2001 From: pianofab Date: Tue, 15 Dec 2020 14:00:55 -0800 Subject: [PATCH 060/825] Update whats-new-windows-10-version-20H2.md --- windows/whats-new/whats-new-windows-10-version-20H2.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-20H2.md b/windows/whats-new/whats-new-windows-10-version-20H2.md index f1046db593..ec7ffb671e 100644 --- a/windows/whats-new/whats-new-windows-10-version-20H2.md +++ b/windows/whats-new/whats-new-windows-10-version-20H2.md @@ -104,7 +104,7 @@ With specialized hardware and software components available on devices shipping ### Windows Sandbox -New polices for [Windows Sandbox](https://docs.microsoft.com/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview) are available in this release. For more information, see [Policy CSP - WindowsSandbox](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowssandbox). +New policies for [Windows Sandbox](https://docs.microsoft.com/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview) are available in this release. For more information, see [Policy CSP - WindowsSandbox](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-windowssandbox). ### Windows Virtual Desktop (WVD) From fa7ff33a3ae22711e9040bfc9958ce7299d727f3 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Dec 2020 14:54:58 -0800 Subject: [PATCH 061/825] Create defender-endpoint-false-positives-negatives.md --- ...nder-endpoint-false-positives-negatives.md | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md new file mode 100644 index 0000000000..6ea027c1ee --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -0,0 +1,33 @@ +--- +title: Address false positives/negatives in Microsoft Defender for Endpoint +description: Learn how to handle false positives or false negatives in Microsoft Defender for Endpoint. +keywords: alert, exclusion, defender atp, false positive, false negative +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.technology: windows +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: deniseb +author: denisebmsft +ms.date: 12/15/2020 +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: +- m365-security-compliance +- m365initiative-defender-endpoint +ms.topic: conceptual +ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs, yonghree +ms.custom: AIR +--- + +# Address false positives/negatives in Microsoft Defender for Endpoint + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + +**Applies to** + +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146806) + From 6ce84f2c4dbacc71486731a580b322af7bd12486 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Dec 2020 14:57:19 -0800 Subject: [PATCH 062/825] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 6ea027c1ee..b3098ec0dd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -20,7 +20,7 @@ ms.collection: - m365initiative-defender-endpoint ms.topic: conceptual ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs, yonghree -ms.custom: AIR +ms.custom: FPFN --- # Address false positives/negatives in Microsoft Defender for Endpoint @@ -31,3 +31,5 @@ ms.custom: AIR - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146806) +Did Microsoft Defender for Endpoint identify an artifact as malicious, even though it wasn't? Are files or processes that are not a threat being stopped in their tracks by Defender for Endpoint? Or, did Defender for Endpoint miss something? Use this article as a guide for addressing false positives or false negatives in Defender for Endpoint. + From fda53f2bd94c7d4e2691922fad5982a7c5b08a0e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Dec 2020 15:10:19 -0800 Subject: [PATCH 063/825] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index b3098ec0dd..72ede58c51 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -33,3 +33,6 @@ ms.custom: FPFN Did Microsoft Defender for Endpoint identify an artifact as malicious, even though it wasn't? Are files or processes that are not a threat being stopped in their tracks by Defender for Endpoint? Or, did Defender for Endpoint miss something? Use this article as a guide for addressing false positives or false negatives in Defender for Endpoint. +| Step | Description | +|:---|:---| +| 1. Identify a false positive/negative | | \ No newline at end of file From db4a4458509396d7319faee1d787ed2ec8b7f626 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 15 Dec 2020 15:12:33 -0800 Subject: [PATCH 064/825] Added Printer ADMX-backed policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 27 + .../policy-configuration-service-provider.md | 84 + .../mdm/policy-csp-admx-printing.md | 2027 +++++++++++++++++ 4 files changed, 2139 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-printing.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 555d34e037..5082f05ed7 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -228,6 +228,7 @@ #### [ADMX_PeerToPeerCaching](policy-csp-admx-peertopeercaching.md) #### [ADMX_PerformanceDiagnostics](policy-csp-admx-performancediagnostics.md) #### [ADMX_PowerShellExecutionPolicy](policy-csp-admx-powershellexecutionpolicy.md) +#### [ADMX_Printing](policy-csp-admx-printing.md) #### [ADMX_Programs](policy-csp-admx-programs.md) #### [ADMX_Reliability](policy-csp-admx-reliability.md) #### [ADMX_RemoteAssistance](policy-csp-admx-remoteassistance.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 8acefc3442..ec137198dc 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -687,6 +687,33 @@ ms.date: 10/08/2020 - [ADMX_PowerShellExecutionPolicy/EnableScripts](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablescripts) - [ADMX_PowerShellExecutionPolicy/EnableTranscripting](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enabletranscripting) - [ADMX_PowerShellExecutionPolicy/EnableUpdateHelpDefaultSourcePath](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enableupdatehelpdefaultsourcepath) +- [ADMX_Printing/AllowWebPrinting](./policy-csp-admx-printing.md#admx-printing-allowwebprinting) +- [ADMX_Printing/ApplicationDriverIsolation](./policy-csp-admx-printing.md#admx-printing-applicationdriverisolation) +- [ADMX_Printing/CustomizedSupportUrl](./policy-csp-admx-printing.md#admx-printing-customizedsupporturl) +- [ADMX_Printing/DoNotInstallCompatibleDriverFromWindowsUpdate](./policy-csp-admx-printing.md#admx-printing-donotinstallcompatibledriverfromwindowsupdate) +- [ADMX_Printing/DomainPrinters](./policy-csp-admx-printing.md#admx-printing-domainprinters) +- [ADMX_Printing/DownlevelBrowse](./policy-csp-admx-printing.md#admx-printing-downlevelbrowse) +- [ADMX_Printing/EMFDespooling](./policy-csp-admx-printing.md#admx-printing-emfdespooling) +- [ADMX_Printing/ForceSoftwareRasterization](./policy-csp-admx-printing.md#admx-printing-forcesoftwarerasterization) +- [ADMX_Printing/IntranetPrintersUrl](./policy-csp-admx-printing.md#admx-printing-intranetprintersurl) +- [ADMX_Printing/KMPrintersAreBlocked](./policy-csp-admx-printing.md#admx-printing-kmprintersareblocked) +- [ADMX_Printing/LegacyDefaultPrinterMode](./policy-csp-admx-printing.md#admx-printing-legacydefaultprintermode) +- [ADMX_Printing/MXDWUseLegacyOutputFormatMSXPS](./policy-csp-admx-printing.md#admx-printing-mxdwuselegacyoutputformatmsxps) +- [ADMX_Printing/NoDeletePrinter](./policy-csp-admx-printing.md#admx-printing-nodeleteprinter) +- [ADMX_Printing/NonDomainPrinters](./policy-csp-admx-printing.md#admx-printing-nondomainprinters) +- [ADMX_Printing/PackagePointAndPrintOnly](./policy-csp-admx-printing.md#admx-printing-packagepointandprintonly) +- [ADMX_Printing/PackagePointAndPrintOnly_Win7](./policy-csp-admx-printing.md#admx-printing-packagepointandprintonly-win7) +- [ADMX_Printing/PackagePointAndPrintServerList](./policy-csp-admx-printing.md#admx-printing-packagepointandprintserverlist) +- [ADMX_Printing/PackagePointAndPrintServerList_Win7](./policy-csp-admx-printing.md#admx-printing-packagepointandprintserverlist-win7) +- [ADMX_Printing/PhysicalLocation](./policy-csp-admx-printing.md#admx-printing-physicallocation) +- [ADMX_Printing/PhysicalLocationSupport](./policy-csp-admx-printing.md#admx-printing-physicallocationsupport) +- [ADMX_Printing/PrintDriverIsolationExecutionPolicy](./policy-csp-admx-printing.md#admx-printing-printdriverisolationexecutionpolicy +) +- [ADMX_Printing/PrintDriverIsolationOverrideCompat](./policy-csp-admx-printing.md#admx-printing-printdriverisolationoverridecompat) +- [ADMX_Printing/PrinterDirectorySearchScope](./policy-csp-admx-printing.md#admx-printing-printerdirectorysearchscope) +- [ADMX_Printing/PrinterServerThread](./policy-csp-admx-printing.md#admx-printing-printerserverthread) +- [ADMX_Printing/ShowJobTitleInEventLogs](./policy-csp-admx-printing.md#admx-printing-showjobtitleineventlogs) +- [ADMX_Printing/V4DriverDisallowPrinterExtension](./policy-csp-admx-printing.md#admx-printing-v4driverdisallowprinterextension) - [ADMX_Programs/NoDefaultPrograms](./policy-csp-admx-programs.md#admx-programs-nodefaultprograms) - [ADMX_Programs/NoGetPrograms](./policy-csp-admx-programs.md#admx-programs-nogetprograms) - [ADMX_Programs/NoInstalledUpdates](./policy-csp-admx-programs.md#admx-programs-noinstalledupdates) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 9b53413efa..a1a5453c94 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -2428,6 +2428,90 @@ The following diagram shows the Policy configuration service provider in tree fo
    +### ADMX_Printing policies + +
    +
    + ADMX_Printing/AllowWebPrinting +
    +
    + ADMX_Printing/ApplicationDriverIsolation +
    +
    + ADMX_Printing/CustomizedSupportUrl +
    +
    + ADMX_Printing/DoNotInstallCompatibleDriverFromWindowsUpdate +
    +
    + ADMX_Printing/DomainPrinters +
    +
    + ADMX_Printing/DownlevelBrowse +
    +
    + ADMX_Printing/EMFDespooling +
    +
    + ADMX_Printing/ForceSoftwareRasterization +
    +
    + ADMX_Printing/IntranetPrintersUrl +
    +
    + ADMX_Printing/KMPrintersAreBlocked +
    +
    + ADMX_Printing/LegacyDefaultPrinterMode +
    +
    + ADMX_Printing/MXDWUseLegacyOutputFormatMSXPS +
    +
    + ADMX_Printing/NoDeletePrinter +
    +
    + ADMX_Printing/NonDomainPrinters +
    +
    + ADMX_Printing/PackagePointAndPrintOnly +
    +
    + ADMX_Printing/PackagePointAndPrintOnly_Win7 +
    +
    + ADMX_Printing/PackagePointAndPrintServerList +
    +
    + ADMX_Printing/PackagePointAndPrintServerList_Win7 +
    +
    + ADMX_Printing/PhysicalLocation +
    +
    + ADMX_Printing/PhysicalLocationSupport +
    +
    + ADMX_Printing/PrintDriverIsolationExecutionPolicy +
    +
    + ADMX_Printing/PrintDriverIsolationOverrideCompat +
    +
    + ADMX_Printing/PrinterDirectorySearchScope +
    +
    + ADMX_Printing/PrinterServerThread +
    +
    + ADMX_Printing/ShowJobTitleInEventLogs +
    +
    + ADMX_Printing/V4DriverDisallowPrinterExtension +
    +
    + ### ADMX_Programs policies
    diff --git a/windows/client-management/mdm/policy-csp-admx-printing.md b/windows/client-management/mdm/policy-csp-admx-printing.md new file mode 100644 index 0000000000..628d572650 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-printing.md @@ -0,0 +1,2027 @@ +--- +title: Policy CSP - ADMX_Printing +description: Policy CSP - ADMX_Printing +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/15/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Printing +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Printing policies + +
    +
    + ADMX_Printing/AllowWebPrinting +
    +
    + ADMX_Printing/ApplicationDriverIsolation +
    +
    + ADMX_Printing/CustomizedSupportUrl +
    +
    + ADMX_Printing/DoNotInstallCompatibleDriverFromWindowsUpdate +
    +
    + ADMX_Printing/DomainPrinters +
    +
    + ADMX_Printing/DownlevelBrowse +
    +
    + ADMX_Printing/EMFDespooling +
    +
    + ADMX_Printing/ForceSoftwareRasterization +
    +
    + ADMX_Printing/IntranetPrintersUrl +
    +
    + ADMX_Printing/KMPrintersAreBlocked +
    +
    + ADMX_Printing/LegacyDefaultPrinterMode +
    +
    + ADMX_Printing/MXDWUseLegacyOutputFormatMSXPS +
    +
    + ADMX_Printing/NoDeletePrinter +
    +
    + ADMX_Printing/NonDomainPrinters +
    +
    + ADMX_Printing/PackagePointAndPrintOnly +
    +
    + ADMX_Printing/PackagePointAndPrintOnly_Win7 +
    +
    + ADMX_Printing/PackagePointAndPrintServerList +
    +
    + ADMX_Printing/PackagePointAndPrintServerList_Win7 +
    +
    + ADMX_Printing/PhysicalLocation +
    +
    + ADMX_Printing/PhysicalLocationSupport +
    +
    + ADMX_Printing/PrintDriverIsolationExecutionPolicy +
    +
    + ADMX_Printing/PrintDriverIsolationOverrideCompat +
    +
    + ADMX_Printing/PrinterDirectorySearchScope +
    +
    + ADMX_Printing/PrinterServerThread +
    +
    + ADMX_Printing/ShowJobTitleInEventLogs +
    +
    + ADMX_Printing/V4DriverDisallowPrinterExtension +
    +
    + + +
    + + +**ADMX_Printing/AllowWebPrinting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Internet printing lets you display printers on Web pages so that printers can be viewed, managed, and used across the Internet or an intranet. + +If you enable this policy setting, Internet printing is activated on this server. + +If you disable this policy setting or do not configure it, Internet printing is not activated. + +Internet printing is an extension of Internet Information Services (IIS). To use Internet printing, IIS must be installed, and printing support and this setting must be enabled. + +> [!NOTE] +> This setting affects the server side of Internet printing only. It does not prevent the print client on the computer from printing across the Internet. + +Also, see the "Custom support URL in the Printers folder's left pane" setting in this folder and the "Browse a common Web site to find printers" setting in User Configuration\Administrative Templates\Control Panel\Printers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Activate Internet printing* +- GP name: *AllowWebPrinting* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/ApplicationDriverIsolation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines if print driver components are isolated from applications instead of normally loading them into applications. Isolating print drivers greatly reduces the risk of a print driver failure causing an application crash. + +Not all applications support driver isolation. By default, Microsoft Excel 2007, Excel 2010, Word 2007, Word 2010 and certain other applications are configured to support it. Other applications may also be capable of isolating print drivers, depending on whether they are configured for it. + +If you enable or do not configure this policy setting, then applications that are configured to support driver isolation will be isolated. + +If you disable this policy setting, then print drivers will be loaded within all associated application processes. + +> [!NOTE] +> - This policy setting applies only to applications opted into isolation. +> - This policy setting applies only to print drivers loaded by applications. Print drivers loaded by the print spooler are not affected. +> - This policy setting is only checked once during the lifetime of a process. After changing the policy, a running application must be relaunched before settings take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Isolate print drivers from applications* +- GP name: *ApplicationDriverIsolation* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/CustomizedSupportUrl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. By default, the Printers folder includes a link to the Microsoft Support Web page called "Get help with printing". It can also include a link to a Web page supplied by the vendor of the currently selected printer. + +If you enable this policy setting, you replace the "Get help with printing" default link with a link to a Web page customized for your enterprise. + +If you disable this setting or do not configure it, or if you do not enter an alternate Internet address, the default link will appear in the Printers folder. + +> [!NOTE] +> Web pages links only appear in the Printers folder when Web view is enabled. If Web view is disabled, the setting has no effect. (To enable Web view, open the Printers folder, and, on the Tools menu, click Folder Options, click the General tab, and then click "Enable Web content in folders.") + +Also, see the "Activate Internet printing" setting in this setting folder and the "Browse a common web site to find printers" setting in User Configuration\Administrative Templates\Control Panel\Printers. + +Web view is affected by the "Turn on Classic Shell" and "Do not allow Folder Options to be opened from the Options button on the View tab of the ribbon" settings in User Configuration\Administrative Templates\Windows Components\Windows Explorer, and by the "Enable Active Desktop" setting in User Configuration\Administrative Templates\Desktop\Active Desktop. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Custom support URL in the Printers folder's left pane* +- GP name: *CustomizedSupportUrl* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/DoNotInstallCompatibleDriverFromWindowsUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage where client computers search for Point and Printer drivers. + +If you enable this policy setting, the client computer will continue to search for compatible Point and Print drivers from Windows Update after it fails to find the compatible driver from the local driver store and the server driver cache. + +If you disable this policy setting, the client computer will only search the local driver store and server driver cache for compatible Point and Print drivers. If it is unable to find a compatible driver, then the Point and Print connection will fail. + +This policy setting is not configured by default, and the behavior depends on the version of Windows that you are using. + +By default, Windows Ultimate, Professional and Home SKUs will continue to search for compatible Point and Print drivers from Windows Update, if needed. However, you must explicitly enable this policy setting for other versions of Windows (for example Windows Enterprise, and all versions of Windows Server 2008 R2 and later) to have the same behavior. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Extend Point and Print connection to search Windows Update* +- GP name: *DoNotInstallCompatibleDriverFromWindowsUpdate* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/DomainPrinters** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If you enable this policy setting, it sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on a managed network (when the computer is able to reach a domain controller, e.g. a domain-joined laptop on a corporate network.) + +If this policy setting is disabled, the network scan page will not be displayed. + +If this policy setting is not configured, the Add Printer wizard will display the default number of printers of each type: + +- Directory printers: 20 +- TCP/IP printers: 0 +- Web Services printers: 0 +- Bluetooth printers: 10 +- Shared printers: 0 + +In order to view available Web Services printers on your network, ensure that network discovery is turned on. To turn on network discovery, click "Start", click "Control Panel", and then click "Network and Internet". On the "Network and Internet" page, click "Network and Sharing Center". On the Network and Sharing Center page, click "Change advanced sharing settings". On the Advanced sharing settings page, click the arrow next to "Domain" arrow, click "turn on network discovery", and then click "Save changes". + +If you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0. + +In Windows 10 and later, only TCP/IP printers can be shown in the wizard. If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied. + +In Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add Printer wizard - Network scan page (Managed network)* +- GP name: *DomainPrinters* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/DownlevelBrowse** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Allows users to use the Add Printer Wizard to search the network for shared printers. + +If you enable this setting or do not configure it, when users choose to add a network printer by selecting the "A network printer, or a printer attached to another computer" radio button on Add Printer Wizard's page 2, and also check the "Connect to this printer (or to browse for a printer, select this option and click Next)" radio button on Add Printer Wizard's page 3, and do not specify a printer name in the adjacent "Name" edit box, then Add Printer Wizard displays the list of shared printers on the network and invites to choose a printer from the shown list. + +If you disable this setting, the network printer browse page is removed from within the Add Printer Wizard, and users cannot search the network but must type a printer name. + +> [!NOTE] +> This setting affects the Add Printer Wizard only. It does not prevent users from using other programs to search for shared printers or to connect to network printers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Browse the network to find printers* +- GP name: *DownlevelBrowse* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/EMFDespooling** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. When printing through a print server, determines whether the print spooler on the client will process print jobs itself, or pass them on to the server to do the work. + +This policy setting only effects printing to a Windows print server. + +If you enable this policy setting on a client machine, the client spooler will not process print jobs before sending them to the print server. This decreases the workload on the client at the expense of increasing the load on the server. + +If you disable this policy setting on a client machine, the client itself will process print jobs into printer device commands. These commands will then be sent to the print server, and the server will simply pass the commands to the printer. This increases the workload of the client while decreasing the load on the server. + +If you do not enable this policy setting, the behavior is the same as disabling it. + +> [!NOTE] +> This policy does not determine whether offline printing will be available to the client. The client print spooler can always queue print jobs when not connected to the print server. Upon reconnecting to the server, the client will submit any pending print jobs. +> +> Some printer drivers require a custom print processor. In some cases the custom print processor may not be installed on the client machine, such as when the print server does not support transferring print processors during point-and-print. In the case of a print processor mismatch, the client spooler will always send jobs to the print server for rendering. Disabling the above policy setting does not override this behavior. +> +> In cases where the client print driver does not match the server print driver (mismatched connection), the client will always process the print job, regardless of the setting of this policy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Always render print jobs on the server* +- GP name: *EMFDespooling* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/ForceSoftwareRasterization** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines whether the XPS Rasterization Service or the XPS-to-GDI conversion (XGC) is forced to use a software rasterizer instead of a Graphics Processing Unit (GPU) to rasterize pages. + +This setting may improve the performance of the XPS Rasterization Service or the XPS-to-GDI conversion (XGC) on machines that have a relatively powerful CPU as compared to the machine’s GPU. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Always rasterize content to be printed using a software rasterizer* +- GP name: *ForceSoftwareRasterization* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/IntranetPrintersUrl** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Adds a link to an Internet or intranet Web page to the Add Printer Wizard. + +You can use this setting to direct users to a Web page from which they can install printers. + +If you enable this setting and type an Internet or intranet address in the text box, the system adds a Browse button to the "Specify a Printer" page in the Add Printer Wizard. The Browse button appears beside the "Connect to a printer on the Internet or on a home or office network" option. When users click Browse, the system opens an Internet browser and navigates to the specified URL address to display the available printers. + +This setting makes it easy for users to find the printers you want them to add. + +Also, see the "Custom support URL in the Printers folder's left pane" and "Activate Internet printing" settings in "Computer Configuration\Administrative Templates\Printers." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Browse a common web site to find printers* +- GP name: *IntranetPrintersUrl* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/KMPrintersAreBlocked** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines whether printers using kernel-mode drivers may be installed on the local computer. Kernel-mode drivers have access to system-wide memory, and therefore poorly-written kernel-mode drivers can cause stop errors. + +If you disable this setting, or do not configure it, then printers using a kernel-mode drivers may be installed on the local computer running Windows XP Home Edition and Windows XP Professional. + +If you do not configure this setting on Windows Server 2003 family products, the installation of kernel-mode printer drivers will be blocked. + +If you enable this setting, installation of a printer using a kernel-mode driver will not be allowed. + +> [!NOTE] +> By applying this policy, existing kernel-mode drivers will be disabled upon installation of service packs or reinstallation of the Windows XP operating system. This policy does not apply to 64-bit kernel-mode printer drivers as they cannot be installed and associated with a print queue. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow installation of printers using kernel-mode drivers* +- GP name: *KMPrintersAreBlocked* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/LegacyDefaultPrinterMode** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This preference allows you to change default printer management. + +If you enable this setting, Windows will not manage the default printer. + +If you disable this setting, Windows will manage the default printer. + +If you do not configure this setting, default printer management will not change. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows default printer management* +- GP name: *LegacyDefaultPrinterMode* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/MXDWUseLegacyOutputFormatMSXPS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Microsoft XPS Document Writer (MXDW) generates OpenXPS (*.oxps) files by default in Windows 10, Windows 10 and Windows Server 2019. + +If you enable this group policy setting, the default MXDW output format is the legacy Microsoft XPS (*.xps). + +If you disable or do not configure this policy setting, the default MXDW output format is OpenXPS (*.oxps). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Change Microsoft XPS Document Writer (MXDW) default output format to the legacy Microsoft XPS format (*.xps)* +- GP name: *MXDWUseLegacyOutputFormatMSXPS* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/NoDeletePrinter** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If this policy setting is enabled, it prevents users from deleting local and network printers. + +If a user tries to delete a printer, such as by using the Delete option in Printers in Control Panel, a message appears explaining that a setting prevents the action. + +This setting does not prevent users from running other programs to delete a printer. + +If this policy is disabled, or not configured, users can delete printers using the methods described above. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent deletion of printers* +- GP name: *NoDeletePrinter* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/NonDomainPrinters** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy sets the maximum number of printers (of each type) that the Add Printer wizard will display on a computer on an unmanaged network (when the computer is not able to reach a domain controller, e.g. a domain-joined laptop on a home network.) + +If this setting is disabled, the network scan page will not be displayed. + +If this setting is not configured, the Add Printer wizard will display the default number of printers of each type: + +- TCP/IP printers: 50 +- Web Services printers: 50 +- Bluetooth printers: 10 +- Shared printers: 50 + +If you would like to not display printers of a certain type, enable this policy and set the number of printers to display to 0. + +In Windows 10 and later, only TCP/IP printers can be shown in the wizard. If you enable this policy setting, only TCP/IP printer limits are applicable. On Windows 10 only, if you disable or do not configure this policy setting, the default limit is applied. + +In Windows 8 and later, Bluetooth printers are not shown so its limit does not apply to those versions of Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add Printer wizard - Network scan page (Unmanaged network)* +- GP name: *NonDomainPrinters* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PackagePointAndPrintOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy restricts clients computers to use package point and print only. + +If this setting is enabled, users will only be able to point and print to printers that use package-aware drivers. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers. + +If this setting is disabled, or not configured, users will not be restricted to package-aware point and print only. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Only use Package Point and print* +- GP name: *PackagePointAndPrintOnly* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PackagePointAndPrintOnly_Win7** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy restricts clients computers to use package point and print only. + +If this setting is enabled, users will only be able to point and print to printers that use package-aware drivers. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers. + +If this setting is disabled, or not configured, users will not be restricted to package-aware point and print only. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Only use Package Point and print* +- GP name: *PackagePointAndPrintOnly_Win7* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PackagePointAndPrintServerList** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Restricts package point and print to approved servers. + +This policy setting restricts package point and print connections to approved servers. This setting only applies to Package Point and Print connections, and is completely independent from the "Point and Print Restrictions" policy that governs the behavior of non-package point and print connections. + +Windows Vista and later clients will attempt to make a non-package point and print connection anytime a package point and print connection fails, including attempts that are blocked by this policy. Administrators may need to set both policies to block all print connections to a specific print server. + +If this setting is enabled, users will only be able to package point and print to print servers approved by the network administrator. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers. + +If this setting is disabled, or not configured, package point and print will not be restricted to specific print servers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Package Point and print - Approved servers* +- GP name: *PackagePointAndPrintServerList* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PackagePointAndPrintServerList_Win7** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Restricts package point and print to approved servers. + +This policy setting restricts package point and print connections to approved servers. This setting only applies to Package Point and Print connections, and is completely independent from the "Point and Print Restrictions" policy that governs the behavior of non-package point and print connections. + +Windows Vista and later clients will attempt to make a non-package point and print connection anytime a package point and print connection fails, including attempts that are blocked by this policy. Administrators may need to set both policies to block all print connections to a specific print server. + +If this setting is enabled, users will only be able to package point and print to print servers approved by the network administrator. When using package point and print, client computers will check the driver signature of all drivers that are downloaded from print servers. + +If this setting is disabled, or not configured, package point and print will not be restricted to specific print servers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Package Point and print - Approved servers* +- GP name: *PackagePointAndPrintServerList_Win7* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PhysicalLocation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. If this policy setting is enabled, it specifies the default location criteria used when searching for printers. + +This setting is a component of the Location Tracking feature of Windows printers. To use this setting, enable Location Tracking by enabling the "Pre-populate printer search location text" setting. + +When Location Tracking is enabled, the system uses the specified location as a criterion when users search for printers. The value you type here overrides the actual location of the computer conducting the search. + +Type the location of the user's computer. When users search for printers, the system uses the specified location (and other search criteria) to find a printer nearby. You can also use this setting to direct users to a particular printer or group of printers that you want them to use. + +If you disable this setting or do not configure it, and the user does not type a location as a search criterion, the system searches for a nearby printer based on the IP address and subnet mask of the user's computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Computer location* +- GP name: *PhysicalLocation* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PhysicalLocationSupport** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Enables the physical Location Tracking setting for Windows printers. + +Use Location Tracking to design a location scheme for your enterprise and assign computers and printers to locations in the scheme. Location Tracking overrides the standard method used to locate and associate computers and printers. The standard method uses a printer's IP address and subnet mask to estimate its physical location and proximity to computers. + +If you enable this setting, users can browse for printers by location without knowing the printer's location or location naming scheme. Enabling Location Tracking adds a Browse button in the Add Printer wizard's Printer Name and Sharing Location screen and to the General tab in the Printer Properties dialog box. If you enable the Group Policy Computer location setting, the default location you entered appears in the Location field by default. + +If you disable this setting or do not configure it, Location Tracking is disabled. Printer proximity is estimated using the standard method (that is, based on IP address and subnet mask). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Pre-populate printer search location text* +- GP name: *PhysicalLocationSupport* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PrintDriverIsolationExecutionPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the print spooler will execute print drivers in an isolated or separate process. When print drivers are loaded in an isolated process (or isolated processes), a print driver failure will not cause the print spooler service to fail. + +If you enable or do not configure this policy setting, the print spooler will execute print drivers in an isolated process by default. + +If you disable this policy setting, the print spooler will execute print drivers in the print spooler process. + +> [!NOTE] +> - Other system or driver policy settings may alter the process in which a print driver is executed. +> - This policy setting applies only to print drivers loaded by the print spooler. Print drivers loaded by applications are not affected. +> - This policy setting takes effect without restarting the print spooler service. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Execute print drivers in isolated processes* +- GP name: *PrintDriverIsolationExecutionPolicy* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PrintDriverIsolationOverrideCompat** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether the print spooler will override the Driver Isolation compatibility reported by the print driver. This enables executing print drivers in an isolated process, even if the driver does not report compatibility. + +If you enable this policy setting, the print spooler isolates all print drivers that do not explicitly opt out of Driver Isolation. + +If you disable or do not configure this policy setting, the print spooler uses the Driver Isolation compatibility flag value reported by the print driver. + +> [!NOTE] +> - Other system or driver policy settings may alter the process in which a print driver is executed. +> - This policy setting applies only to print drivers loaded by the print spooler. Print drivers loaded by applications are not affected. +> - This policy setting takes effect without restarting the print spooler service. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Override print driver execution compatibility setting reported by print driver* +- GP name: *PrintDriverIsolationOverrideCompat* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PrinterDirectorySearchScope** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies the Active Directory location where searches for printers begin. + +The Add Printer Wizard gives users the option of searching Active Directory for a shared printer. + +If you enable this policy setting, these searches begin at the location you specify in the "Default Active Directory path" box. Otherwise, searches begin at the root of Active Directory. + +This setting only provides a starting point for Active Directory searches for printers. It does not restrict user searches through Active Directory. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Default Active Directory path when searching for printers* +- GP name: *PrinterDirectorySearchScope* +- GP path: *Control Panel\Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/PrinterServerThread** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Announces the presence of shared printers to print browse master servers for the domain. + +On domains with Active Directory, shared printer resources are available in Active Directory and are not announced. + +If you enable this setting, the print spooler announces shared printers to the print browse master servers. + +If you disable this setting, shared printers are not announced to print browse master servers, even if Active Directory is not available. + +If you do not configure this setting, shared printers are announced to browse master servers only when Active Directory is not available. + +> [!NOTE] +> A client license is used each time a client computer announces a printer to a print browse master on the domain. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Printer browsing* +- GP name: *PrinterServerThread* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/ShowJobTitleInEventLogs** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy controls whether the print job name will be included in print event logs. + +If you disable or do not configure this policy setting, the print job name will not be included. + +If you enable this policy setting, the print job name will be included in new log entries. + +> [!NOTE] +> This setting does not apply to Branch Office Direct Printing jobs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow job name in event logs* +- GP name: *ShowJobTitleInEventLogs* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + + +**ADMX_Printing/V4DriverDisallowPrinterExtension** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy determines if v4 printer drivers are allowed to run printer extensions. + +V4 printer drivers may include an optional, customized user interface known as a printer extension. These extensions may provide access to more device features, but this may not be appropriate for all enterprises. + +If you enable this policy setting, then all printer extensions will not be allowed to run. + +If you disable this policy setting or do not configure it, then all printer extensions that have been installed will be allowed to run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow v4 printer drivers to show printer extensions* +- GP name: *V4DriverDisallowPrinterExtension* +- GP path: *Printers* +- GP ADMX file name: *Printing.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file From 131da8346ac47dac17b151b7ed07ff7c81cfd056 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Dec 2020 15:56:57 -0800 Subject: [PATCH 065/825] Update defender-endpoint-false-positives-negatives.md --- ...nder-endpoint-false-positives-negatives.md | 23 ++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 72ede58c51..7a8b28a303 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -35,4 +35,25 @@ Did Microsoft Defender for Endpoint identify an artifact as malicious, even thou | Step | Description | |:---|:---| -| 1. Identify a false positive/negative | | \ No newline at end of file +| 1. Identify a false positive/negative | | +| 2. Review/define exclusions for Defender for Endpoint | | +| 3. Review/define indicators for Defender for Endpoint | | +| 4. Classify a false positive/negative in Defender for Endpoint | | +| 5. Submit a file for analysis | | +| 6. Confirm your software uses EV code signing | | + +## Identify a false positive/negative + +*How do we know something is a false positive or negative? What do we want customers to look for?* + +## Review or define exclusions + +*Exclusions are defined for AutoIR and for MDAV, yes?* + +## Review or define indicators + +## Classify a false positive or false negative + +## Submit a file for analysis + +## Confirm your software uses EV code signing \ No newline at end of file From f23271508637a8da03b89b90f47391a2b144ac0f Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 15 Dec 2020 16:01:44 -0800 Subject: [PATCH 066/825] Added Printing2 policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 9 + .../policy-configuration-service-provider.md | 32 + .../mdm/policy-csp-admx-printing2.md | 740 ++++++++++++++++++ 4 files changed, 782 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-printing2.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 5082f05ed7..a37aa5159e 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -229,6 +229,7 @@ #### [ADMX_PerformanceDiagnostics](policy-csp-admx-performancediagnostics.md) #### [ADMX_PowerShellExecutionPolicy](policy-csp-admx-powershellexecutionpolicy.md) #### [ADMX_Printing](policy-csp-admx-printing.md) +#### [ADMX_Printing2](policy-csp-admx-printing2.md) #### [ADMX_Programs](policy-csp-admx-programs.md) #### [ADMX_Reliability](policy-csp-admx-reliability.md) #### [ADMX_RemoteAssistance](policy-csp-admx-remoteassistance.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index ec137198dc..1e240e7969 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -714,6 +714,15 @@ ms.date: 10/08/2020 - [ADMX_Printing/PrinterServerThread](./policy-csp-admx-printing.md#admx-printing-printerserverthread) - [ADMX_Printing/ShowJobTitleInEventLogs](./policy-csp-admx-printing.md#admx-printing-showjobtitleineventlogs) - [ADMX_Printing/V4DriverDisallowPrinterExtension](./policy-csp-admx-printing.md#admx-printing-v4driverdisallowprinterextension) +- [ADMX_Printing2/AutoPublishing](./policy-csp-admx-printing2.md#admx-printing2-autopublishing) +- [ADMX_Printing2/ImmortalPrintQueue](./policy-csp-admx-printing2.md#admx-printing2-immortalprintqueue) +- [ADMX_Printing2/PruneDownlevel](./policy-csp-admx-printing2.md#admx-printing2-prunedownlevel) +- [ADMX_Printing2/PruningInterval](./policy-csp-admx-printing2.md#admx-printing2-pruninginterval) +- [ADMX_Printing2/PruningPriority](./policy-csp-admx-printing2.md#admx-printing2-pruningpriority) +- [ADMX_Printing2/PruningRetries](./policy-csp-admx-printing2.md#admx-printing2-pruningretries) +- [ADMX_Printing2/PruningRetryLog](./policy-csp-admx-printing2.md#admx-printing2-pruningretrylog) +- [ADMX_Printing2/RegisterSpoolerRemoteRpcEndPoint](./policy-csp-admx-printing2.md#admx-printing2-registerspoolerremoterpcendpoint) +- [ADMX_Printing2/VerifyPublishedState](./policy-csp-admx-printing2.md#admx-printing2-verifypublishedstate) - [ADMX_Programs/NoDefaultPrograms](./policy-csp-admx-programs.md#admx-programs-nodefaultprograms) - [ADMX_Programs/NoGetPrograms](./policy-csp-admx-programs.md#admx-programs-nogetprograms) - [ADMX_Programs/NoInstalledUpdates](./policy-csp-admx-programs.md#admx-programs-noinstalledupdates) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index a1a5453c94..c27861fc1e 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -2512,6 +2512,38 @@ The following diagram shows the Policy configuration service provider in tree fo
    +### ADMX_Printing2 policies + +
    +
    + ADMX_Printing2/AutoPublishing +
    +
    + ADMX_Printing2/ImmortalPrintQueue +
    +
    + ADMX_Printing2/PruneDownlevel +
    +
    + ADMX_Printing2/PruningInterval +
    +
    + ADMX_Printing2/PruningPriority +
    +
    + ADMX_Printing2/PruningRetries +
    +
    + ADMX_Printing2/PruningRetryLog +
    +
    + ADMX_Printing2/RegisterSpoolerRemoteRpcEndPoint +
    +
    + ADMX_Printing2/VerifyPublishedState +
    +
    + ### ADMX_Programs policies
    diff --git a/windows/client-management/mdm/policy-csp-admx-printing2.md b/windows/client-management/mdm/policy-csp-admx-printing2.md new file mode 100644 index 0000000000..6da824049f --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-printing2.md @@ -0,0 +1,740 @@ +--- +title: Policy CSP - ADMX_Printing2 +description: Policy CSP - ADMX_Printing2 +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/15/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Printing2 +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_Printing2 policies + +
    +
    + ADMX_Printing2/AutoPublishing +
    +
    + ADMX_Printing2/ImmortalPrintQueue +
    +
    + ADMX_Printing2/PruneDownlevel +
    +
    + ADMX_Printing2/PruningInterval +
    +
    + ADMX_Printing2/PruningPriority +
    +
    + ADMX_Printing2/PruningRetries +
    +
    + ADMX_Printing2/PruningRetryLog +
    +
    + ADMX_Printing2/RegisterSpoolerRemoteRpcEndPoint +
    +
    + ADMX_Printing2/VerifyPublishedState +
    +
    + + +
    + + +**ADMX_Printing2/AutoPublishing** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines whether the Add Printer Wizard automatically publishes the computer's shared printers in Active Directory. + +If you enable this setting or do not configure it, the Add Printer Wizard automatically publishes all shared printers. + +If you disable this setting, the Add Printer Wizard does not automatically publish printers. However, you can publish shared printers manually. + +The default behavior is to automatically publish shared printers in Active Directory. + +> [!NOTE] +> This setting is ignored if the "Allow printers to be published" setting is disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Automatically publish new printers in Active Directory* +- GP name: *AutoPublishing* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/ImmortalPrintQueue** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines whether the domain controller can prune (delete from Active Directory) the printers published by this computer. + +By default, the pruning service on the domain controller prunes printer objects from Active Directory if the computer that published them does not respond to contact requests. When the computer that published the printers restarts, it republishes any deleted printer objects. + +If you enable this setting or do not configure it, the domain controller prunes this computer's printers when the computer does not respond. + +If you disable this setting, the domain controller does not prune this computer's printers. This setting is designed to prevent printers from being pruned when the computer is temporarily disconnected from the network. + +> [!NOTE] You can use the "Directory Pruning Interval" and "Directory Pruning Retry" settings to adjust the contact interval and number of contact attempts. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow pruning of published printers* +- GP name: *ImmortalPrintQueue* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/PruneDownlevel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Determines whether the pruning service on a domain controller prunes printer objects that are not automatically republished whenever the host computer does not respond,just as it does with Windows 2000 printers. This setting applies to printers running operating systems other than Windows 2000 and to Windows 2000 printers published outside their forest. + +The Windows pruning service prunes printer objects from Active Directory when the computer that published them does not respond to contact requests. Computers running Windows 2000 Professional detect and republish deleted printer objects when they rejoin the network. However, because non-Windows 2000 computers and computers in other domains cannot republish printers in Active Directory automatically, by default, the system never prunes their printer objects. + +You can enable this setting to change the default behavior. To use this setting, select one of the following options from the "Prune non-republishing printers" box: + +- "Never" specifies that printer objects that are not automatically republished are never pruned. "Never" is the default. + +- "Only if Print Server is found" prunes printer objects that are not automatically republished only when the print server responds, but the printer is unavailable. + +- "Whenever printer is not found" prunes printer objects that are not automatically republished whenever the host computer does not respond, just as it does with Windows 2000 printers. + +> [!NOTE] +> This setting applies to printers published by using Active Directory Users and Computers or Pubprn.vbs. It does not apply to printers published by using Printers in Control Panel. + +> [!TIP] +> If you disable automatic pruning, remember to delete printer objects manually whenever you remove a printer or print server. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prune printers that are not automatically republished* +- GP name: *PruneDownlevel* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/PruningInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies how often the pruning service on a domain controller contacts computers to verify that their printers are operational. + +The pruning service periodically contacts computers that have published printers. If a computer does not respond to the contact message (optionally, after repeated attempts), the pruning service "prunes" (deletes from Active Directory) printer objects the computer has published. + +By default, the pruning service contacts computers every eight hours and allows two repeated contact attempts before deleting printers from Active Directory. + +If you enable this setting, you can change the interval between contact attempts. + +If you do not configure or disable this setting the default values will be used. + +> [!NOTE] +> This setting is used only on domain controllers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Directory pruning interval* +- GP name: *PruningInterval* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/PruningPriority** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Sets the priority of the pruning thread. + +The pruning thread, which runs only on domain controllers, deletes printer objects from Active Directory if the printer that published the object does not respond to contact attempts. This process keeps printer information in Active Directory current. + +The thread priority influences the order in which the thread receives processor time and determines how likely it is to be preempted by higher priority threads. + +By default, the pruning thread runs at normal priority. However, you can adjust the priority to improve the performance of this service. + +> [!NOTE] +> This setting is used only on domain controllers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Directory pruning priority* +- GP name: *PruningPriority* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/PruningRetries** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies how many times the pruning service on a domain controller repeats its attempt to contact a computer before pruning the computer's printers. + +The pruning service periodically contacts computers that have published printers to verify that the printers are still available for use. If a computer does not respond to the contact message, the message is repeated for the specified number of times. If the computer still fails to respond, then the pruning service "prunes" (deletes from Active Directory) printer objects the computer has published. + +By default, the pruning service contacts computers every eight hours and allows two retries before deleting printers from Active Directory. You can use this setting to change the number of retries. + +If you enable this setting, you can change the interval between attempts. + +If you do not configure or disable this setting, the default values are used. + +> [!NOTE] +> This setting is used only on domain controllers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Directory pruning retry* +- GP name: *PruningRetries* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/PruningRetryLog** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies whether or not to log events when the pruning service on a domain controller attempts to contact a computer before pruning the computer's printers. + +The pruning service periodically contacts computers that have published printers to verify that the printers are still available for use. If a computer does not respond to the contact attempt, the attempt is retried a specified number of times, at a specified interval. The "Directory pruning retry" setting determines the number of times the attempt is retried; the default value is two retries. The "Directory Pruning Interval" setting determines the time interval between retries; the default value is every eight hours. If the computer has not responded by the last contact attempt, its printers are pruned from the directory. + +If you enable this policy setting, the contact events are recorded in the event log. + +If you disable or do not configure this policy setting, the contact events are not recorded in the event log. + +Note: This setting does not affect the logging of pruning events; the actual pruning of a printer is always logged. + +> [!NOTE] +> This setting is used only on domain controllers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Log directory pruning retry events* +- GP name: *PruningRetryLog* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/RegisterSpoolerRemoteRpcEndPoint** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy controls whether the print spooler will accept client connections. + +When the policy is not configured or enabled, the spooler will always accept client connections. + +When the policy is disabled, the spooler will not accept client connections nor allow users to share printers. All printers currently shared will continue to be shared. + +The spooler must be restarted for changes to this policy to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow Print Spooler to accept client connections* +- GP name: *RegisterSpoolerRemoteRpcEndPoint* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + + +**ADMX_Printing2/VerifyPublishedState** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Directs the system to periodically verify that the printers published by this computer still appear in Active Directory. This setting also specifies how often the system repeats the verification. + +By default, the system only verifies published printers at startup. This setting allows for periodic verification while the computer is operating. + +To enable this additional verification, enable this setting, and then select a verification interval. + +To disable verification, disable this setting, or enable this setting and select "Never" for the verification interval. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Check published state* +- GP name: *VerifyPublishedState* +- GP path: *Printers* +- GP ADMX file name: *Printing2.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file From ae764c12b4d5421861690c50422d036e3e37cc7b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Dec 2020 16:02:50 -0800 Subject: [PATCH 067/825] Update defender-endpoint-false-positives-negatives.md --- ...nder-endpoint-false-positives-negatives.md | 22 +++++++++++++------ 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 7a8b28a303..40bb2b65ea 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -35,12 +35,12 @@ Did Microsoft Defender for Endpoint identify an artifact as malicious, even thou | Step | Description | |:---|:---| -| 1. Identify a false positive/negative | | -| 2. Review/define exclusions for Defender for Endpoint | | -| 3. Review/define indicators for Defender for Endpoint | | -| 4. Classify a false positive/negative in Defender for Endpoint | | -| 5. Submit a file for analysis | | -| 6. Confirm your software uses EV code signing | | +| 1. [Identify a false positive/negative](#identify-a-false-positivenegative) | | +| 2. [Review/define exclusions for Defender for Endpoint](#review-or-define-exclusions) | | +| 3. [Review/define indicators for Defender for Endpoint](#review-or-define-indicators) | | +| 4. [Classify a false positive/negative in Defender for Endpoint](#classify-a-false-positive-or-false-negative) | | +| 5. [Submit a file for analysis](#submit-a-file-for-analysis) | | +| 6. [Confirm your software uses EV code signing](#confirm-your-software-uses-ev-code-signing) | | ## Identify a false positive/negative @@ -52,8 +52,16 @@ Did Microsoft Defender for Endpoint identify an artifact as malicious, even thou ## Review or define indicators +*Allow indicators for false positives; block indicators for false negatives. https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators* + ## Classify a false positive or false negative +*Need to figure out where/how this is done* + ## Submit a file for analysis -## Confirm your software uses EV code signing \ No newline at end of file +*https://www.microsoft.com/wdsi/filesubmission/* + +## Confirm your software uses EV code signing + +*Some info is available here: https://docs.microsoft.com/windows-hardware/drivers/dashboard/get-a-code-signing-certificate* \ No newline at end of file From 6f0d2743d8f9af3db4ecf0c3660c6dc8de24ea32 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 15 Dec 2020 16:06:40 -0800 Subject: [PATCH 068/825] Fixed warning --- windows/client-management/mdm/policy-csp-admx-printing2.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-admx-printing2.md b/windows/client-management/mdm/policy-csp-admx-printing2.md index 6da824049f..817a528bac 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing2.md +++ b/windows/client-management/mdm/policy-csp-admx-printing2.md @@ -180,7 +180,8 @@ If you enable this setting or do not configure it, the domain controller prunes If you disable this setting, the domain controller does not prune this computer's printers. This setting is designed to prevent printers from being pruned when the computer is temporarily disconnected from the network. -> [!NOTE] You can use the "Directory Pruning Interval" and "Directory Pruning Retry" settings to adjust the contact interval and number of contact attempts. +> [!NOTE] +> You can use the "Directory Pruning Interval" and "Directory Pruning Retry" settings to adjust the contact interval and number of contact attempts. > [!TIP] From fe4c83039bc4c7431f25a5f3f975109743b011ce Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Dec 2020 16:08:27 -0800 Subject: [PATCH 069/825] Update defender-endpoint-false-positives-negatives.md --- .../defender-endpoint-false-positives-negatives.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md index 40bb2b65ea..2d4e5efdb5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md +++ b/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md @@ -35,7 +35,7 @@ Did Microsoft Defender for Endpoint identify an artifact as malicious, even thou | Step | Description | |:---|:---| -| 1. [Identify a false positive/negative](#identify-a-false-positivenegative) | | +| 1. [Identify a false positive/negative](#identify-a-false-positivenegative) | A false positive is something that was detected and identified as malicious, when in fact it does not pose a threat.
    A false negative is something that was not detected as a threat even though it is, in fact, malicious.
    Both false positives and false negatives can be problematic for your organization. | | 2. [Review/define exclusions for Defender for Endpoint](#review-or-define-exclusions) | | | 3. [Review/define indicators for Defender for Endpoint](#review-or-define-indicators) | | | 4. [Classify a false positive/negative in Defender for Endpoint](#classify-a-false-positive-or-false-negative) | | From b440abef57809fa00c9823bcd14a4de7ef330e5d Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 15 Dec 2020 16:22:26 -0800 Subject: [PATCH 070/825] Removed two Globalization policies per owner --- .../mdm/policies-in-policy-csp-admx-backed.md | 2 - .../policy-configuration-service-provider.md | 6 - .../mdm/policy-csp-admx-globalization.md | 144 ------------------ 3 files changed, 152 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 1e240e7969..26da44ce91 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -282,7 +282,6 @@ ms.date: 10/08/2020 - [ADMX_FolderRedirection/LocalizeXPRelativePaths_2](./policy-csp-admx-folderredirection.md#admx-folderredirection-localizexprelativepaths-2) - [ADMX_FolderRedirection/PrimaryComputer_FR_1](./policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-1) - [ADMX_FolderRedirection/PrimaryComputer_FR_2](./policy-csp-admx-folderredirection.md#admx-folderredirection-primarycomputer-fr-2) -- [ADMX_Globalization/BlockCleanupOfUnusedPreinstalledLangPacks](./policy-csp-admx-globalization.md#admx-globalization-blockcleanupofunusedpreinstalledlangpacks) - [ADMX_Globalization/BlockUserInputMethodsForSignIn](./policy-csp-admx-globalization.md#admx-globalization-blockuserinputmethodsforsignin) - [ADMX_Globalization/CustomLocalesNoSelect_1](./policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-1) - [ADMX_Globalization/CustomLocalesNoSelect_2](./policy-csp-admx-globalization.md#admx-globalization-customlocalesnoselect-2) @@ -297,7 +296,6 @@ ms.date: 10/08/2020 - [ADMX_Globalization/LocaleUserRestrict_2](./policy-csp-admx-globalization.md#admx-globalization-localeuserrestrict-2) - [ADMX_Globalization/LockMachineUILanguage](./policy-csp-admx-globalization.md#admx-globalization-lockmachineuilanguage) - [ADMX_Globalization/LockUserUILanguage](./policy-csp-admx-globalization.md#admx-globalization-lockuseruilanguage) -- [ADMX_Globalization/MachineUILanguageOverwrite](./policy-csp-admx-globalization.md#admx-globalization-machineuilanguageoverwrite) - [ADMX_Globalization/PreventGeoIdChange_1](./policy-csp-admx-globalization.md#admx-globalization-preventgeoidchange-1) - [ADMX_Globalization/PreventGeoIdChange_2](./policy-csp-admx-globalization.md#admx-globalization-preventgeoidchange-2) - [ADMX_Globalization/PreventUserOverrides_1](./policy-csp-admx-globalization.md#admx-globalization-preventuseroverrides-1) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index c27861fc1e..205815ffba 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1148,9 +1148,6 @@ The following diagram shows the Policy configuration service provider in tree fo ### ADMX_Globalization policies
    -
    - ADMX_Globalization/BlockCleanupOfUnusedPreinstalledLangPacks -
    ADMX_Globalization/BlockUserInputMethodsForSignIn
    @@ -1193,9 +1190,6 @@ The following diagram shows the Policy configuration service provider in tree fo
    ADMX_Globalization/LockUserUILanguage
    -
    - ADMX_Globalization/MachineUILanguageOverwrite -
    ADMX_Globalization/PreventGeoIdChange_1
    diff --git a/windows/client-management/mdm/policy-csp-admx-globalization.md b/windows/client-management/mdm/policy-csp-admx-globalization.md index e471cdf6e7..ad421c4633 100644 --- a/windows/client-management/mdm/policy-csp-admx-globalization.md +++ b/windows/client-management/mdm/policy-csp-admx-globalization.md @@ -22,9 +22,6 @@ manager: dansimp ## ADMX_Globalization policies
    -
    - ADMX_Globalization/BlockCleanupOfUnusedPreinstalledLangPacks -
    ADMX_Globalization/BlockUserInputMethodsForSignIn
    @@ -67,9 +64,6 @@ manager: dansimp
    ADMX_Globalization/LockUserUILanguage
    -
    - ADMX_Globalization/MachineUILanguageOverwrite -
    ADMX_Globalization/PreventGeoIdChange_1
    @@ -105,75 +99,6 @@ manager: dansimp
    - -**ADMX_Globalization/BlockCleanupOfUnusedPreinstalledLangPacks** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    - - -
    - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether the LPRemove task will run to clean up language packs installed on a machine but are not used by any users on that machine. - -If you enable this policy setting, language packs that are installed as part of the system image will remain installed even if they are not used by any user on that system. - -If you disable or do not configure this policy setting, language packs that are installed as part of the system image but are not used by any user on that system will be removed as part of a scheduled clean up task. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Block clean-up of unused language packs* -- GP name: *BlockCleanupOfUnusedPreinstalledLangPacks* -- GP path: *Control Panel\Regional and Language Options* -- GP ADMX file name: *Globalization.admx* - - - -
    - **ADMX_Globalization/BlockUserInputMethodsForSignIn** @@ -1223,75 +1148,6 @@ ADMX Info:
    - -**ADMX_Globalization/MachineUILanguageOverwrite** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    - - -
    - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
    - - - -Available in the latest Windows 10 Insider Preview Build. This policy setting controls which UI language is used for computers with more than one UI language installed. - -If you enable this policy setting, the UI language of Windows menus and dialogs for systems with more than one language is restricted to a specified language. If the specified language is not installed on the target computer or you disable this policy setting, the language selection defaults to the language selected by the local administrator. - -If you disable or do not configure this policy setting, there is no restriction of a specific language used for the Windows menus and dialogs. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Force selected system UI language to overwrite the user UI language* -- GP name: *MachineUILanguageOverwrite* -- GP path: *Control Panel\Regional and Language Options* -- GP ADMX file name: *Globalization.admx* - - - -
    - **ADMX_Globalization/PreventGeoIdChange_1** From 443c53cbfd1a94240e6568ae4dfe09e5be9299b6 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Wed, 16 Dec 2020 23:21:11 +0530 Subject: [PATCH 071/825] updated-4620497 updated --- windows/security/threat-protection/index.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 88ac6667fb..f9594c5218 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -19,6 +19,9 @@ ms.topic: conceptual # Threat Protection [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Defender for Endpoint protects endpoints from cyber threats, detects advanced attacks and data breaches, automates security incidents, and improves security posture. +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + > [!TIP] > Enable your users to access cloud services and on-premises applications with ease and enable modern management capabilities for all devices. For more information, see [Secure your remote workforce](https://docs.microsoft.com/enterprise-mobility-security/remote-work/). From e453d38f46297766d53bdbc6418d7dde2dd24bfd Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 16 Dec 2020 13:53:19 -0800 Subject: [PATCH 072/825] Added MSI policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 24 + .../policy-configuration-service-provider.md | 77 + .../mdm/policy-csp-admx-msi.md | 1835 +++++++++++++++++ 4 files changed, 1937 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-msi.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index a37aa5159e..423a233fbb 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -220,6 +220,7 @@ #### [ADMX_MSAPolicy](policy-csp-admx-msapolicy.md) #### [ADMX_msched](policy-csp-admx-msched.md) #### [ADMX_MSDT](policy-csp-admx-msdt.md) +#### [ADMX_MSI](policy-csp-admx-msi.md) #### [ADMX_nca](policy-csp-admx-nca.md) #### [ADMX_NCSI](policy-csp-admx-ncsi.md) #### [ADMX_Netlogon](policy-csp-admx-netlogon.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 26da44ce91..5cbf915a49 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -545,6 +545,30 @@ ms.date: 10/08/2020 - [ADMX_MSDT/MsdtSupportProvider](./policy-csp-admx-msdt.md#admx-msdt-msdtsupportprovider) - [ADMX_MSDT/MsdtToolDownloadPolicy](./policy-csp-admx-msdt.md#admx-msdt-msdttooldownloadpolicy) - [ADMX_MSDT/WdiScenarioExecutionPolicy](./policy-csp-admx-msdt.md#admx-msdt-wdiscenarioexecutionpolicy) +- [ADMX_MSI/AllowLockdownBrowse](./policy-csp-admx-msi.md#admx-msi-allowlockdownbrowse) +- [ADMX_MSI/AllowLockdownMedia](./policy-csp-admx-msi.md#admx-msi-allowlockdownmedia) +- [ADMX_MSI/AllowLockdownPatch](./policy-csp-admx-msi.md#admx-msi-allowlockdownpatch) +- [ADMX_MSI/DisableAutomaticApplicationShutdown](./policy-csp-admx-msi.md#admx-msi-disableautomaticapplicationshutdown) +- [ADMX_MSI/DisableBrowse](./policy-csp-admx-msi.md#admx-msi-disablebrowse) +- [ADMX_MSI/DisableFlyweightPatching](./policy-csp-admx-msi.md#admx-msi-disableflyweightpatching) +- [ADMX_MSI/DisableLoggingFromPackage](./policy-csp-admx-msi.md#admx-msi-disableloggingfrompackage) +- [ADMX_MSI/DisableMSI](./policy-csp-admx-msi.md#admx-msi-disablemsi) +- [ADMX_MSI/DisableMedia](./policy-csp-admx-msi.md#admx-msi-disablemedia) +- [ADMX_MSI/DisablePatch](./policy-csp-admx-msi.md#admx-msi-disablepatch) +- [ADMX_MSI/DisableRollback_1](./policy-csp-admx-msi.md#admx-msi-disablerollback-1) +- [ADMX_MSI/DisableRollback_2](./policy-csp-admx-msi.md#admx-msi-disablerollback-2) +- [ADMX_MSI/DisableSharedComponent](./policy-csp-admx-msi.md#admx-msi-disablesharedcomponent) +- [ADMX_MSI/MSILogging](./policy-csp-admx-msi.md#admx-msi-msilogging) +- [ADMX_MSI/MSI_DisableLUAPatching](./policy-csp-admx-msi.md#admx-msi-msi-disableluapatching) +- [ADMX_MSI/MSI_DisablePatchUninstall](./policy-csp-admx-msi.md#admx-msi-msi-disablepatchuninstall) +- [ADMX_MSI/MSI_DisableSRCheckPoints](./policy-csp-admx-msi.md#admx-msi-msi-disablesrcheckpoints) +- [ADMX_MSI/MSI_DisableUserInstalls](./policy-csp-admx-msi.md#admx-msi-msi-disableuserinstalls) +- [ADMX_MSI/MSI_EnforceUpgradeComponentRules](./policy-csp-admx-msi.md#admx-msi-msi-enforceupgradecomponentrules) +- [ADMX_MSI/MSI_MaxPatchCacheSize](./policy-csp-admx-msi.md#admx-msi-msi-maxpatchcachesize) +- [ADMX_MSI/MsiDisableEmbeddedUI](./policy-csp-admx-msi.md#admx-msi-msidisableembeddedui) +- [ADMX_MSI/SafeForScripting](./policy-csp-admx-msi.md#admx-msi-safeforscripting) +- [ADMX_MSI/SearchOrder](./policy-csp-admx-msi.md#admx-msi-searchorder) +- [ADMX_MSI/TransformsSecure](./policy-csp-admx-msi.md#admx-msi-transformssecure) - [ADMX_nca/CorporateResources](./policy-csp-admx-nca.md#admx-nca-corporateresources) - [ADMX_nca/CustomCommands](./policy-csp-admx-nca.md#admx-nca-customcommands) - [ADMX_nca/DTEs](./policy-csp-admx-nca.md#admx-nca-dtes) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 205815ffba..50e56bd34b 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1965,6 +1965,83 @@ The following diagram shows the Policy configuration service provider in tree fo
    +### ADMX_MSI policies + +
    +
    + ADMX_MSI/AllowLockdownBrowse +
    +
    + ADMX_MSI/AllowLockdownMedia +
    +
    + ADMX_MSI/AllowLockdownPatch +
    +
    + ADMX_MSI/DisableAutomaticApplicationShutdown +
    +
    + ADMX_MSI/DisableBrowse +
    +
    + ADMX_MSI/DisableFlyweightPatching +
    +
    + ADMX_MSI/DisableLoggingFromPackage +
    +
    + ADMX_MSI/DisableMSI +
    +
    + ADMX_MSI/DisableMedia +
    +
    + ADMX_MSI/DisablePatch +
    +
    + ADMX_MSI/DisableRollback_1 +
    +
    + ADMX_MSI/DisableRollback_2 +
    +
    + ADMX_MSI/DisableSharedComponent +
    +
    + ADMX_MSI/MSILogging +
    +
    + ADMX_MSI/MSI_DisableLUAPatching +
    +
    + ADMX_MSI/MSI_DisablePatchUninstall +
    +
    + ADMX_MSI/MSI_DisableSRCheckPoints +
    +
    + ADMX_MSI/MSI_DisableUserInstalls +
    +
    + ADMX_MSI/MSI_EnforceUpgradeComponentRules +
    +
    + ADMX_MSI/MSI_MaxPatchCacheSize +
    +
    + ADMX_MSI/MsiDisableEmbeddedUI +
    +
    + ADMX_MSI/SafeForScripting +
    +
    + ADMX_MSI/SearchOrder +
    +
    + ADMX_MSI/TransformsSecure +
    +
    + ### ADMX_nca policies
    diff --git a/windows/client-management/mdm/policy-csp-admx-msi.md b/windows/client-management/mdm/policy-csp-admx-msi.md new file mode 100644 index 0000000000..0336f0e890 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-msi.md @@ -0,0 +1,1835 @@ +--- +title: Policy CSP - ADMX_MSI +description: Policy CSP - ADMX_MSI +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/16/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_MSI +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_MSI policies + +
    +
    + ADMX_MSI/AllowLockdownBrowse +
    +
    + ADMX_MSI/AllowLockdownMedia +
    +
    + ADMX_MSI/AllowLockdownPatch +
    +
    + ADMX_MSI/DisableAutomaticApplicationShutdown +
    +
    + ADMX_MSI/DisableBrowse +
    +
    + ADMX_MSI/DisableFlyweightPatching +
    +
    + ADMX_MSI/DisableLoggingFromPackage +
    +
    + ADMX_MSI/DisableMSI +
    +
    + ADMX_MSI/DisableMedia +
    +
    + ADMX_MSI/DisablePatch +
    +
    + ADMX_MSI/DisableRollback_1 +
    +
    + ADMX_MSI/DisableRollback_2 +
    +
    + ADMX_MSI/DisableSharedComponent +
    +
    + ADMX_MSI/MSILogging +
    +
    + ADMX_MSI/MSI_DisableLUAPatching +
    +
    + ADMX_MSI/MSI_DisablePatchUninstall +
    +
    + ADMX_MSI/MSI_DisableSRCheckPoints +
    +
    + ADMX_MSI/MSI_DisableUserInstalls +
    +
    + ADMX_MSI/MSI_EnforceUpgradeComponentRules +
    +
    + ADMX_MSI/MSI_MaxPatchCacheSize +
    +
    + ADMX_MSI/MsiDisableEmbeddedUI +
    +
    + ADMX_MSI/SafeForScripting +
    +
    + ADMX_MSI/SearchOrder +
    +
    + ADMX_MSI/TransformsSecure +
    +
    + +
    + + +**ADMX_MSI/AllowLockdownBrowse** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows users to search for installation files during privileged installations. + +If you enable this policy setting, the Browse button in the "Use feature from" dialog box is enabled. As a result, users can search for installation files even when the installation program is running with elevated system privileges. + +Because the installation is running with elevated system privileges, users can browse through directories that their own permissions would not allow. + +This policy setting does not affect installations that run in the user's security context. Also, see the "Remove browse dialog box for new source" policy setting. + +If you disable or do not configure this policy setting, by default, only system administrators can browse during installations with elevated privileges, such as installations offered on the desktop or displayed in Add or Remove Programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow users to browse for source while elevated* +- GP name: *AllowLockdownBrowse* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +**ADMX_MSI/AllowLockdownMedia** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows users to install programs from removable media during privileged installations. + +If you enable this policy setting, all users are permitted to install programs from removable media, such as floppy disks and CD-ROMs, even when the installation program is running with elevated system privileges. + +This policy setting does not affect installations that run in the user's security context. By default, users can install from removable media when the installation runs in their own security context. + +If you disable or do not configure this policy setting, by default, users can install programs from removable media only when the installation runs in the user's security context. During privileged installations, such as those offered on the desktop or displayed in Add or Remove Programs, only system administrators can install from removable media. + +Also, see the "Prevent removable media source for any install" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow users to use media source while elevated* +- GP name: *AllowLockdownMedia* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +**ADMX_MSI/AllowLockdownPatch** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows users to patch elevated products. + +If you enable this policy setting, all users are permitted to install patches, even when the installation program is running with elevated system privileges. Patches are updates or upgrades that replace only those program files that have changed. Because patches can easily be vehicles for malicious programs, some installations prohibit their use. + +If you disable or do not configure this policy setting, by default, only system administrators can apply patches during installations with elevated privileges, such as installations offered on the desktop or displayed in Add or Remove Programs. + +This policy setting does not affect installations that run in the user's security context. By default, users can install patches to programs that run in their own security context. Also, see the "Prohibit patching" policy setting. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow users to patch elevated products* +- GP name: *AllowLockdownPatch* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +**ADMX_MSI/DisableAutomaticApplicationShutdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Windows Installer's interaction with the Restart Manager. The Restart Manager API can eliminate or reduce the number of system restarts that are required to complete an installation or update. + +If you enable this policy setting, you can use the options in the Prohibit Use of Restart Manager box to control file in use detection behavior. + +- The "Restart Manager On" option instructs Windows Installer to use Restart Manager to detect files in use and mitigate a system restart, when possible. + +- The "Restart Manager Off" option turns off Restart Manager for file in use detection and the legacy file in use behavior is used. + +- The "Restart Manager Off for Legacy App Setup" option applies to packages that were created for Windows Installer versions lesser than 4.0. This option lets those packages display the legacy files in use UI while still using Restart Manager for detection. + +If you disable or do not configure this policy setting, Windows Installer will use Restart Manager to detect files in use and mitigate a system restart, when possible. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit use of Restart Manager* +- GP name: *DisableAutomaticApplicationShutdown* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +**ADMX_MSI/DisableBrowse** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from searching for installation files when they add features or components to an installed program. + +If you enable this policy setting, the Browse button beside the "Use feature from" list in the Windows Installer dialog box is disabled. As a result, users must select an installation file source from the "Use features from" list that the system administrator configures. + +This policy setting applies even when the installation is running in the user's security context. + +If you disable or do not configure this policy setting, the Browse button is enabled when an installation is running in the user's security context. But only system administrators can browse when an installation is running with elevated system privileges, such as installations offered on the desktop or in Add or Remove Programs. + +This policy setting affects Windows Installer only. It does not prevent users from selecting other browsers, such as File Explorer or Network Locations, to search for installation files. + +Also, see the "Enable user to browse for source while elevated" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove browse dialog box for new source* +- GP name: *DisableBrowse* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +**ADMX_MSI/DisableFlyweightPatching** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability to turn off all patch optimizations. + +If you enable this policy setting, all Patch Optimization options are turned off during the installation. + +If you disable or do not configure this policy setting, it enables faster application of patches by removing execution of unnecessary actions. The flyweight patching mode is primarily designed for patches that just update a few files or registry values. The Installer will analyze the patch for specific changes to determine if optimization is possible. If so, the patch will be applied using a minimal set of processing. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit flyweight patching* +- GP name: *DisableFlyweightPatching* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +**ADMX_MSI/DisableLoggingFromPackage** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Windows Installer's processing of the MsiLogging property. The MsiLogging property in an installation package can be used to enable automatic logging of all install operations for the package. + +If you enable this policy setting, you can use the options in the Disable logging via package settings box to control automatic logging via package settings behavior. + +- The "Logging via package settings on" option instructs Windows Installer to automatically generate log files for packages that include the MsiLogging property. + +- The "Logging via package settings off" option turns off the automatic logging behavior when specified via the MsiLogging policy. Log files can still be generated using the logging command line switch or the Logging policy. + +If you disable or do not configure this policy setting, Windows Installer will automatically generate log files for those packages that include the MsiLogging property. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off logging via package settings* +- GP name: *DisableLoggingFromPackage* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +**ADMX_MSI/DisableMSI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting restricts the use of Windows Installer. + +If you enable this policy setting, you can prevent users from installing software on their systems or permit users to install only those programs offered by a system administrator. You can use the options in the Disable Windows Installer box to establish an installation setting. + +- The "Never" option indicates Windows Installer is fully enabled. Users can install and upgrade software. This is the default behavior for Windows Installer on Windows 2000 Professional, Windows XP Professional and Windows Vista when the policy is not configured. + +- The "For non-managed applications only" option permits users to install only those programs that a system administrator assigns (offers on the desktop) or publishes (adds them to Add or Remove Programs). This is the default behavior of Windows Installer on Windows Server 2003 family when the policy is not configured. + +- The "Always" option indicates that Windows Installer is disabled. + +This policy setting affects Windows Installer only. It does not prevent users from using other methods to install and upgrade programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Installer* +- GP name: *DisableMSI* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +**ADMX_MSI/DisableMedia** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from installing any programs from removable media. + +If you enable this policy setting, if a user tries to install a program from removable media, such as CD-ROMs, floppy disks, and DVDs, a message appears stating that the feature cannot be found. + +This policy setting applies even when the installation is running in the user's security context. + +If you disable or do not configure this policy setting, users can install from removable media when the installation is running in their own security context, but only system administrators can use removable media when an installation is running with elevated system privileges, such as installations offered on the desktop or in Add or Remove Programs. + +Also, see the "Enable user to use media source while elevated" and "Hide the 'Add a program from CD-ROM or floppy disk' option" policy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent removable media source for any installation* +- GP name: *DisableMedia* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +**ADMX_MSI/DisablePatch** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from using Windows Installer to install patches. + +If you enable this policy setting, users are prevented from using Windows Installer to install patches. Patches are updates or upgrades that replace only those program files that have changed. Because patches can be easy vehicles for malicious programs, some installations prohibit their use. + +> [!NOTE] +> This policy setting applies only to installations that run in the user's security context. + +If you disable or do not configure this policy setting, by default, users who are not system administrators cannot apply patches to installations that run with elevated system privileges, such as those offered on the desktop or in Add or Remove Programs. + +Also, see the "Enable user to patch elevated products" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users from using Windows Installer to install updates and upgrades* +- GP name: *DisablePatch* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +**ADMX_MSI/DisableRollback_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation. + +If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete. + +This policy setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy setting unless it is essential. + +This policy setting appears in the Computer Configuration and User Configuration folders. If the policy setting is enabled in either folder, it is considered be enabled, even if it is explicitly disabled in the other folder. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit rollback* +- GP name: *DisableRollback_1* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +**ADMX_MSI/DisableRollback_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prohibits Windows Installer from generating and saving the files it needs to reverse an interrupted or unsuccessful installation. + +If you enable this policy setting, Windows Installer is prevented from recording the original state of the system and sequence of changes it makes during installation. It also prevents Windows Installer from retaining files it intends to delete later. As a result, Windows Installer cannot restore the computer to its original state if the installation does not complete. + +This policy setting is designed to reduce the amount of temporary disk space required to install programs. Also, it prevents malicious users from interrupting an installation to gather data about the internal state of the computer or to search secure system files. However, because an incomplete installation can render the system or a program inoperable, do not use this policy setting unless it is essential. + +This policy setting appears in the Computer Configuration and User Configuration folders. If the policy setting is enabled in either folder, it is considered be enabled, even if it is explicitly disabled in the other folder. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit rollback* +- GP name: *DisableRollback_2* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +**ADMX_MSI/DisableSharedComponent** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability to turn off shared components. + +If you enable this policy setting, no packages on the system get the shared component functionality enabled by the msidbComponentAttributesShared attribute in the Component Table. + +If you disable or do not configure this policy setting, by default, the shared component functionality is allowed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off shared components* +- GP name: *DisableSharedComponent* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + +**ADMX_MSI/MSILogging** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. Specifies the types of events that Windows Installer records in its transaction log for each installation. The log, Msi.log, appears in the Temp directory of the system volume. + +When you enable this policy setting, you can specify the types of events you want Windows Installer to record. To indicate that an event type is recorded, type the letter representing the event type. You can type the letters in any order and list as many or as few event types as you want. + +To disable logging, delete all of the letters from the box. + +If you disable or do not configure this policy setting, Windows Installer logs the default event types, represented by the letters "iweap." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the types of events Windows Installer records in its transaction log* +- GP name: *MSILogging* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + +**ADMX_MSI/MSI_DisableLUAPatching** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability of non-administrators to install updates that have been digitally signed by the application vendor. + +Non-administrator updates provide a mechanism for the author of an application to create digitally signed updates that can be applied by non-privileged users. + +If you enable this policy setting, only administrators or users with administrative privileges can apply updates to Windows Installer based applications. + +If you disable or do not configure this policy setting, users without administrative privileges can install non-administrator updates. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit non-administrators from applying vendor signed updates* +- GP name: *MSI_DisableLUAPatching* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + +**ADMX_MSI/MSI_DisablePatchUninstall** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability for users or administrators to remove Windows Installer based updates. + +This policy setting should be used if you need to maintain a tight control over updates. One example is a lockdown environment where you want to ensure that updates once installed cannot be removed by users or administrators. + +If you enable this policy setting, updates cannot be removed from the computer by a user or an administrator. The Windows Installer can still remove an update that is no longer applicable to the product. + +If you disable or do not configure this policy setting, a user can remove an update from the computer only if the user has been granted privileges to remove the update. This can depend on whether the user is an administrator, whether "Disable Windows Installer" and "Always install with elevated privileges" policy settings are set, and whether the update was installed in a per-user managed, per-user unmanaged, or per-machine context." + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit removal of updates* +- GP name: *MSI_DisablePatchUninstall* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + +**ADMX_MSI/MSI_DisableSRCheckPoints** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting prevents Windows Installer from creating a System Restore checkpoint each time an application is installed. System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. + +If you enable this policy setting, the Windows Installer does not generate System Restore checkpoints when installing applications. + +If you disable or do not configure this policy setting, by default, the Windows Installer automatically creates a System Restore checkpoint each time an application is installed, so that users can restore their computer to the state it was in before installing the application. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off creation of System Restore checkpoints* +- GP name: *MSI_DisableSRCheckPoints* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + +**ADMX_MSI/MSI_DisableUserInstalls** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure user installs. To configure this policy setting, set it to enabled and use the drop-down list to select the behavior you want. + +If you do not configure this policy setting, or if the policy setting is enabled and "Allow User Installs" is selected, the installer allows and makes use of products that are installed per user, and products that are installed per computer. If the installer finds a per-user install of an application, this hides a per-computer installation of that same product. + +If you enable this policy setting and "Hide User Installs" is selected, the installer ignores per-user applications. This causes a per-computer installed application to be visible to users, even if those users have a per-user install of the product registered in their user profile. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit User Installs* +- GP name: *MSI_DisableUserInstalls* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + +**ADMX_MSI/MSI_EnforceUpgradeComponentRules** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting causes the Windows Installer to enforce strict rules for component upgrades. + +If you enable this policy setting, strict upgrade rules will be enforced by the Windows Installer which may cause some upgrades to fail. Upgrades can fail if they attempt to do one of the following: + +(1) Remove a component from a feature. +This can also occur if you change the GUID of a component. The component identified by the original GUID appears to be removed and the component as identified by the new GUID appears as a new component. + +(2) Add a new feature to the top or middle of an existing feature tree. +The new feature must be added as a new leaf feature to an existing feature tree. + +If you disable or do not configure this policy setting, the Windows Installer will use less restrictive rules for component upgrades. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enforce upgrade component rules* +- GP name: *MSI_EnforceUpgradeComponentRules* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + +**ADMX_MSI/MSI_MaxPatchCacheSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy controls the percentage of disk space available to the Windows Installer baseline file cache. + +The Windows Installer uses the baseline file cache to save baseline files modified by binary delta difference updates. The cache is used to retrieve the baseline file for future updates. The cache eliminates user prompts for source media when new updates are applied. + +If you enable this policy setting you can modify the maximum size of the Windows Installer baseline file cache. + +If you set the baseline cache size to 0, the Windows Installer will stop populating the baseline cache for new updates. The existing cached files will remain on disk and will be deleted when the product is removed. + +If you set the baseline cache to 100, the Windows Installer will use available free space for the baseline file cache. + +If you disable or do not configure this policy setting, the Windows Installer will uses a default value of 10 percent for the baseline file cache maximum size. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control maximum size of baseline file cache* +- GP name: *MSI_MaxPatchCacheSize* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + +**ADMX_MSI/MsiDisableEmbeddedUI** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the ability to prevent embedded UI. + +If you enable this policy setting, no packages on the system can run embedded UI. + +If you disable or do not configure this policy setting, embedded UI is allowed to run. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent embedded UI* +- GP name: *MsiDisableEmbeddedUI* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + +**ADMX_MSI/SafeForScripting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows Web-based programs to install software on the computer without notifying the user. + +If you disable or do not configure this policy setting, by default, when a script hosted by an Internet browser tries to install a program on the system, the system warns users and allows them to select or refuse the installation. + +If you enable this policy setting, the warning is suppressed and allows the installation to proceed. + +This policy setting is designed for enterprises that use Web-based tools to distribute programs to their employees. However, because this policy setting can pose a security risk, it should be applied cautiously. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Internet Explorer security prompt for Windows Installer scripts* +- GP name: *SafeForScripting* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + +**ADMX_MSI/SearchOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the order in which Windows Installer searches for installation files. + +If you disable or do not configure this policy setting, by default, the Windows Installer searches the network first, then removable media (floppy drive, CD-ROM, or DVD), and finally, the Internet (URL). + +If you enable this policy setting, you can change the search order by specifying the letters representing each file source in the order that you want Windows Installer to search: + +- "n" represents the network +- "m" represents media +- "u" represents URL, or the Internet + +To exclude a file source, omit or delete the letter representing that source type. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the order in which Windows Installer searches for installation files* +- GP name: *SearchOrder* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + +**ADMX_MSI/TransformsSecure** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting saves copies of transform files in a secure location on the local computer. + +Transform files consist of instructions to modify or customize a program during installation. + +If you enable this policy setting, the transform file is saved in a secure location on the user's computer. + +If you do not configure this policy setting on Windows Server 2003, Windows Installer requires the transform file in order to repeat an installation in which the transform file was used, therefore, the user must be using the same computer or be connected to the original or identical media to reinstall, remove, or repair the installation. + +This policy setting is designed for enterprises to prevent unauthorized or malicious editing of transform files. + +If you disable this policy setting, Windows Installer stores transform files in the Application Data directory in the user's profile. + +If you do not configure this policy setting on Windows 2000 Professional, Windows XP Professional and Windows Vista, when a user reinstalls, removes, or repairs an installation, the transform file is available, even if the user is on a different computer or is not connected to the network. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Save copies of transform files in a secure location on workstation* +- GP name: *TransformsSecure* +- GP path: *Windows Components\Windows Installer* +- GP ADMX file name: *MSI.admx* + + + +
    + + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file From 120a72cfe44e802e9dffc5f3320f978046c4b893 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 16 Dec 2020 14:20:33 -0800 Subject: [PATCH 073/825] Fixed build warning --- windows/client-management/mdm/policy-csp-admx-msi.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-msi.md b/windows/client-management/mdm/policy-csp-admx-msi.md index 0336f0e890..92fe153f4b 100644 --- a/windows/client-management/mdm/policy-csp-admx-msi.md +++ b/windows/client-management/mdm/policy-csp-admx-msi.md @@ -1178,7 +1178,7 @@ ADMX Info:
    -**ADMX_MSI/MSI_DisablePatchUninstall** +**ADMX_MSI/MSI_DisablePatchUninstall** @@ -1248,7 +1248,7 @@ ADMX Info:
    -**ADMX_MSI/MSI_DisableSRCheckPoints** +**ADMX_MSI/MSI_DisableSRCheckPoints**
    @@ -1316,7 +1316,7 @@ ADMX Info:
    -**ADMX_MSI/MSI_DisableUserInstalls** +**ADMX_MSI/MSI_DisableUserInstalls**
    @@ -1384,7 +1384,7 @@ ADMX Info:
    -**ADMX_MSI/MSI_EnforceUpgradeComponentRules** +**ADMX_MSI/MSI_EnforceUpgradeComponentRules**
    @@ -1458,7 +1458,7 @@ ADMX Info:
    -**ADMX_MSI/MSI_MaxPatchCacheSize** +**ADMX_MSI/MSI_MaxPatchCacheSize**
    From 47104dd15056ee0239198349225a48a6f3c3f311 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 16 Dec 2020 14:27:19 -0800 Subject: [PATCH 074/825] Fixed build warning --- windows/client-management/mdm/policy-csp-admx-msi.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-admx-msi.md b/windows/client-management/mdm/policy-csp-admx-msi.md index 92fe153f4b..cd3f93abd4 100644 --- a/windows/client-management/mdm/policy-csp-admx-msi.md +++ b/windows/client-management/mdm/policy-csp-admx-msi.md @@ -1108,7 +1108,7 @@ ADMX Info:
    -**ADMX_MSI/MSI_DisableLUAPatching** +**ADMX_MSI/MSI_DisableLUAPatching**
    From 25f3caf7efddc153c635b5494b174d0f1d4e2f0a Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 16 Dec 2020 14:50:47 -0800 Subject: [PATCH 075/825] Fixed formatting issue --- .../mdm/policy-csp-admx-msi.md | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-admx-msi.md b/windows/client-management/mdm/policy-csp-admx-msi.md index cd3f93abd4..948a93babd 100644 --- a/windows/client-management/mdm/policy-csp-admx-msi.md +++ b/windows/client-management/mdm/policy-csp-admx-msi.md @@ -169,6 +169,7 @@ ADMX Info: +
    @@ -242,6 +243,7 @@ ADMX Info: +
    @@ -312,6 +314,7 @@ ADMX Info: +
    @@ -387,6 +390,7 @@ ADMX Info: +
    @@ -462,6 +466,7 @@ ADMX Info: +
    @@ -531,6 +536,7 @@ ADMX Info: +
    @@ -604,6 +610,7 @@ ADMX Info: +
    @@ -679,6 +686,7 @@ ADMX Info: +
    @@ -752,6 +760,7 @@ ADMX Info: +
    @@ -826,6 +835,7 @@ ADMX Info: +
    @@ -896,6 +906,7 @@ ADMX Info: +
    @@ -967,6 +978,7 @@ ADMX Info: +
    @@ -1036,7 +1048,9 @@ ADMX Info: +
    + **ADMX_MSI/MSILogging** @@ -1106,8 +1120,11 @@ ADMX Info: +
    + + **ADMX_MSI/MSI_DisableLUAPatching** @@ -1176,8 +1193,11 @@ ADMX Info: +
    + + **ADMX_MSI/MSI_DisablePatchUninstall** @@ -1246,8 +1266,11 @@ ADMX Info: +
    + + **ADMX_MSI/MSI_DisableSRCheckPoints** @@ -1314,8 +1337,11 @@ ADMX Info: +
    + + **ADMX_MSI/MSI_DisableUserInstalls** @@ -1382,8 +1408,11 @@ ADMX Info: +
    + + **ADMX_MSI/MSI_EnforceUpgradeComponentRules** @@ -1456,7 +1485,9 @@ ADMX Info: +
    + **ADMX_MSI/MSI_MaxPatchCacheSize** @@ -1530,7 +1561,9 @@ ADMX Info: +
    + **ADMX_MSI/MsiDisableEmbeddedUI** @@ -1598,7 +1631,9 @@ ADMX Info: +
    + **ADMX_MSI/SafeForScripting** @@ -1668,7 +1703,9 @@ ADMX Info: +
    + **ADMX_MSI/SearchOrder** @@ -1742,7 +1779,9 @@ ADMX Info: +
    + **ADMX_MSI/TransformsSecure** From 1b998847b42004a68d934432d6e1772f9e7cfa23 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 16 Dec 2020 16:26:33 -0800 Subject: [PATCH 076/825] Added WindowsRemoteManagement policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 2 + .../policy-configuration-service-provider.md | 11 ++ ...policy-csp-admx-windowsremotemanagement.md | 184 ++++++++++++++++++ 4 files changed, 198 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 423a233fbb..6e91df97ec 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -264,6 +264,7 @@ #### [ADMX_WindowsExplorer](policy-csp-admx-windowsexplorer.md) #### [ADMX_WindowsMediaDRM](policy-csp-admx-windowsmediadrm.md) #### [ADMX_WindowsMediaPlayer](policy-csp-admx-windowsmediaplayer.md) +#### [ADMX_WindowsRemoteManagement](policy-csp-admx-windowsremotemanagement.md) #### [ADMX_WindowsStore](policy-csp-admx-windowsstore.md) #### [ADMX_WinInit](policy-csp-admx-wininit.md) #### [ADMX_WinLogon](policy-csp-admx-winlogon.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 5cbf915a49..8c03c186f3 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -1208,6 +1208,8 @@ ms.date: 10/08/2020 - [ADMX_WindowsMediaPlayer/PreventWMPDeskTopShortcut](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-preventwmpdesktopshortcut) - [ADMX_WindowsMediaPlayer/SkinLockDown](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-skinlockdown) - [ADMX_WindowsMediaPlayer/WindowsStreamingMediaProtocols](./policy-csp-admx-windowsmediaplayer.md#admx-windowsmediaplayer-windowsstreamingmediaprotocols) +- [ADMX_WindowsRemoteManagement/DisallowKerberos_1](./policy-csp-admx-windowsremotemanagement.md#admx-windowsremotemanagement-disallowkerberos-1) +- [ADMX_WindowsRemoteManagement/DisallowKerberos_2](./policy-csp-admx-windowsremotemanagement.md#admx-windowsremotemanagement-disallowkerberos-2) - [ADMX_WindowsStore/DisableAutoDownloadWin8](./policy-csp-admx-windowsstore.md#admx-windowsstore-disableautodownloadwin8) - [ADMX_WindowsStore/DisableOSUpgrade_1](./policy-csp-admx-windowsstore.md#admx-windowsstore-disableosupgrade-1) - [ADMX_WindowsStore/DisableOSUpgrade_2](./policy-csp-admx-windowsstore.md#admx-windowsstore-disableosupgrade-2) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 50e56bd34b..810eacc415 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4170,6 +4170,17 @@ The following diagram shows the Policy configuration service provider in tree fo +### ADMX_WindowsRemoteManagement policies + +
    +
    + ADMX_WindowsRemoteManagement/DisallowKerberos_1 +
    +
    + ADMX_WindowsRemoteManagement/DisallowKerberos_2 +
    +
    + ### ADMX_WindowsStore policies
    diff --git a/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md new file mode 100644 index 0000000000..317228c066 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md @@ -0,0 +1,184 @@ +--- +title: Policy CSP - ADMX_WindowsRemoteManagement +description: Policy CSP - ADMX_WindowsRemoteManagement +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/16/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsRemoteManagement +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_WindowsRemoteManagement policies + +
    +
    + ADMX_WindowsRemoteManagement/DisallowKerberos_1 +
    +
    + ADMX_WindowsRemoteManagement/DisallowKerberos_2 +
    +
    + + +
    + + +**ADMX_WindowsRemoteManagement/DisallowKerberos_1** + + +
    + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether the Windows Remote Management (WinRM) service accepts Kerberos credentials over the network. + +If you enable this policy setting, the WinRM service does not accept Kerberos credentials over the network. If you disable or do not configure this policy setting, the WinRM service accepts Kerberos authentication from a remote client. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow Kerberos authentication* +- GP name: *DisallowKerberos_1* +- GP path: *Windows Components\Windows Remote Management (WinRM)\WinRM Service* +- GP ADMX file name: *WindowsRemoteManagement.admx* + + + + +
    + + +**ADMX_WindowsRemoteManagement/DisallowKerberos_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether the Windows Remote Management (WinRM) client uses Kerberos authentication directly. + +If you enable this policy setting, the Windows Remote Management (WinRM) client does not use Kerberos authentication directly. Kerberos can still be used if the WinRM client is using the Negotiate authentication and Kerberos is selected. + +If you disable or do not configure this policy setting, the WinRM client uses the Kerberos authentication directly. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disallow Kerberos authentication* +- GP name: *DisallowKerberos_2* +- GP path: *Windows Components\Windows Remote Management (WinRM)\WinRM Client* +- GP ADMX file name: *WindowsRemoteManagement.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file From 8c90da743de4cb4e34dbc49b9f0f5294f0b8ed7b Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 17 Dec 2020 11:46:07 +0500 Subject: [PATCH 077/825] minor calrification Added a minor clarification. Prbolem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8803 --- .../windows-sandbox/windows-sandbox-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md index e7b8a53f7a..f9ff3618d5 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -55,7 +55,7 @@ The following video provides an overview of Windows Sandbox. 1. Locate and select **Windows Sandbox** on the Start menu to run it for the first time. ## Usage -1. Copy an executable file (and any other files needed to run the application) from the host into the Windows Sandbox window. +1. Copy an executable file (and any other files needed to run the application) from the host and paste into the **Windows Sandbox** window. 2. Run the executable file or installer inside the sandbox. 3. When you're finished experimenting, close the sandbox. A dialog box will state that all sandbox content will be discarded and permanently deleted. Select **ok**. 4. Confirm that your host machine doesn't exhibit any of the modifications that you made in Windows Sandbox. From 9405730c99068e667dfedb15035f90f7247e1d4d Mon Sep 17 00:00:00 2001 From: Harun Kimani <52551080+Gental-Giant@users.noreply.github.com> Date: Thu, 17 Dec 2020 08:53:20 -0800 Subject: [PATCH 078/825] Windows 10 20H2 Connection endpoints --- .../privacy/manage-windows-20H2-endpoints.md | 158 +++++++++++ windows/privacy/toc.yml | 4 + ...-endpoints-20H2-non-enterprise-editions.md | 264 ++++++++++++++++++ 3 files changed, 426 insertions(+) create mode 100644 windows/privacy/manage-windows-20H2-endpoints.md create mode 100644 windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md diff --git a/windows/privacy/manage-windows-20H2-endpoints.md b/windows/privacy/manage-windows-20H2-endpoints.md new file mode 100644 index 0000000000..a2c7dbbed9 --- /dev/null +++ b/windows/privacy/manage-windows-20H2-endpoints.md @@ -0,0 +1,158 @@ +--- +title: Connection endpoints for Windows 10 Enterprise, version 20H2 +description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 20H2. +keywords: privacy, manage connections to Microsoft, Windows 10 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: gental-giant +ms.author: v-hakima +manager: robsize +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 12/17/2020 +--- +# Manage connection endpoints for Windows 10 Enterprise, version 20H2 + +**Applies to** + +- Windows 10 Enterprise, version 20H2 + +Some Windows components, app, and related services transfer data to Microsoft network endpoints. Some examples include: + +- Connecting to Microsoft Office and Windows sites to download the latest app and security updates. +- Connecting to email servers to send and receive email. +- Connecting to the web for every day web browsing. +- Connecting to the cloud to store and access backups. +- Using your location to show a weather forecast. + +Details about the different ways to control traffic to these endpoints are covered in [Manage connections from Windows operating system components to Microsoft services](manage-connections-from-windows-operating-system-components-to-microsoft-services.md). +Where applicable, each endpoint covered in this topic includes a link to the specific details on how to control that traffic. + +The following methodology was used to derive these network endpoints: + +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week, but if you capture traffic for longer you may have different results. + +> [!NOTE] +> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. + +## Windows 10 20H2 Enterprise connection endpoints + +|Area|Description|Protocol|Destination| +|----------------|----------|----------|------------| +|Apps|||[Learn how to turn off traffic to the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +||The following endpoint is used for the Weather app. To turn off traffic for this endpoint, either uninstall the Weather app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|HTTP|tile-service.weather.microsoft.com| +||The following endpoint is used for OneNote Live Tile. To turn off traffic for this endpoint, either uninstall OneNote or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS/HTTP|cdn.onenote.net| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser. To turn off traffic for this endpoint, either uninstall the Photos app or disable the Microsoft Store. If you disable the Microsoft store, other Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious Store apps and users will still be able to open them.|TLSv1.2/HTTPS|evoke-windowsservices-tas.msedge.net +|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to turn off traffic to this endpoint, but it is not recommended because as root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update)| +|||TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com| +|Cortana and Live Tiles|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-cortana)| +||The following endpoints are related to Cortana and Live Tiles. If you turn off traffic for this endpoint, you will block updates to Cortana greetings, tips, and Live Tiles.|TLSv1.2/HTTPS/HTTP|www.bing.com*| +|||TLSv1.2/HTTPS/HTTP|fp.msedge.net| +|||TLSv1.2|I-ring.msedge.net| +|||HTTPS|s-ring.msedge.net| +|Device authentication|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +||The following endpoint is used to authenticate a device. If you turn off traffic for this endpoint, the device will not be authenticated.|HTTPS|login.live.com*| +|Device metadata|The following endpoint is used to retrieve device metadata. If you turn off traffic for this endpoint, metadata will not be updated for the device.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services#4-device-metadata-retrieval)| +|||HTTP|dmd.metaservices.microsoft.com| +|Diagnostic Data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service. If you turn off traffic for this endpoint, diagnostic and usage information, which helps Microsoft find and fix problems and improve our products and services, will not be sent back to Microsoft. ||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||TLSv1.2/HTTPS/HTTP|v10.events.data.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|v20.events.data.microsoft.com| +|||HTTP|www.microsoft.com| +||The following endpoints are used by Windows Error Reporting. To turn off traffic for these endpoints, enable the following Group Policy: Administrative Templates > Windows Components > Windows Error Reporting > Disable Windows Error Reporting. This means error reporting information will not be sent back to Microsoft.|TLSv1.2|telecommand.telemetry.microsoft.com| +|||TLS v1.2/HTTPS/HTTP|watson.*.microsoft.com| +|Font Streaming|The following endpoints are used to download fonts on demand. If you turn off traffic for these endpoints, you will not be able to download fonts on demand.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services#6-font-streaming)| +|||HTTPS|fs.microsoft.com| +|Licensing|The following endpoint is used for online activation and some app licensing. To turn off traffic for this endpoint, disable the Windows License Manager Service. This will also block online activation and app licensing may not work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#9-license-manager)| +|||TLSv1.2/HTTPS/HTTP|licensing.mp.microsoft.com| +|Maps|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-offlinemaps)| +||The following endpoints are used to check for updates to maps that have been downloaded for offline use. If you turn off traffic for this endpoint, offline maps will not be updated.|TLSv1.2/HTTPS/HTTP|maps.windows.com| +|Microsoft Account|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-microsoft-account)| +||The following endpoints are used for Microsoft accounts to sign in. If you turn off traffic for these endpoints, users cannot sign in with Microsoft accounts. |TLSv1.2/HTTPS|login.live.com| +|Microsoft Edge|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#13-microsoft-edge)| +||This traffic is related to the Microsoft Edge browser.|HTTPS|iecvlist.microsoft.com| +||The following endpoint is used by Microsoft Edge Update service to check for new updates. If you disable this endpoint, Microsoft Edge won’t be able to check for and apply new edge updates.|TLSv1.2/HTTPS/HTTP|msedge.api.cdp.microsoft.com| +|Microsoft forward link redirection service (FWLink)|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer. If you disable this endpoint, Windows Defender won't be able to update its malware definitions; links from Windows and other Microsoft products to the Web won't work; and PowerShell updateable Help won't update. To disable the traffic, instead disable the traffic that's getting forwarded.|HTTP|go.microsoft.com| +|Microsoft Store|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +||The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps). If you turn off traffic for these endpoints, the image files won't be downloaded, and apps cannot be installed or updated from the Microsoft Store. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.|HTTPS|img-prod-cms-rt-microsoft-com.akamaized.net| +||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way. If you turn off traffic for this endpoint, push notifications will no longer work, including MDM device management, mail synchronization, settings synchronization.|TLSv1.2/HTTPS|*.wns.windows.com| +||The following endpoints are used to revoke licenses for malicious apps in the Microsoft Store. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft Store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them|TLSv1.2|1storecatalogrevocation.storequality.microsoft.com| +|||HTTPS/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|HTTPS|manage.devcenter.microsoft.com| +||The following endpoints are used to communicate with Microsoft Store. If you turn off traffic for these endpoints, apps cannot be installed or updated from the Microsoft Store.|TLSv1.2/HTTPS/HTTP|displaycatalog.mp.microsoft.com| +|||HTTPS|pti.store.microsoft.com| +|||HTTP|share.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com| +|Network Connection Status Indicator (NCSI)|||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-ncsi)| +||Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet. If you turn off traffic for this endpoint, NCSI won't be able to determine if the device is connected to the Internet and the network status tray icon will show a warning.|HTTPS|www.msftconnecttest.com*| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser. For more info, see Office 365 URLs and IP address ranges. You can turn this off by removing all Microsoft Office apps and the Mail and Calendar apps. If you turn off traffic for these endpoints, users won't be able to save documents to the cloud or see their recently used documents.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||HTTPS|www.office.com| +|||HTTPS|blobs.officehome.msocdn.com| +|||HTTPS|officehomeblobs.blob.core.windows.net| +|||HTTPS|self.events.data.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|outlookmobile-office365-tas.msedge.net| +|OneDrive|The following endpoints are related to OneDrive. If you turn off traffic for these endpoints, anything that relies on g.live.com to get updated URL information will no longer work.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-onedrive)| +|||TLSv1.2/HTTPS/HTTP|g.live.com| +|||TLSv1.2/HTTPS/HTTP|oneclient.sfx.ms| +|||HTTPS| logincdn.msauth.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it. If you turn off traffic for this endpoint, an app that uses this endpoint may stop working.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-priv-feedback)| +|||TLSv1.2/HTTPS/HTTP|settings-win.data.microsoft.com| +|||HTTPS|settings.data.microsoft.com| +|Skype|The following endpoint is used to retrieve Skype configuration values. To turn off traffic for this endpoint, either uninstall the app or disable the Microsoft Store. If you disable the Microsoft store, other Microsoft Store apps cannot be installed or updated. Additionally, the Microsoft Store won't be able to revoke malicious apps and users will still be able to open them.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore)| +|||HTTPS/HTTP|*.pipe.aria.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|config.edge.skype.com| +|Teams|The following endpoint is used for Microsoft Teams application.||[Learn how to turn off traffic to all of the following endpoint(s).]( manage-connections-from-windows-operating-system-components-to-microsoft-services.md#26-microsoft-store)| +|||TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled. If you turn off traffic for this endpoint, the device will not use Cloud-based Protection.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-defender)| +|||HTTPS/TLSv1.2|wdcp.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications. If you turn off traffic for these endpoints, SmartScreen notifications will not appear.|HTTPS|*smartscreen-prod.microsoft.com| +|||HTTPS/HTTP|checkappexec.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. If you turn off traffic for these endpoints, Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see Windows Spotlight.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight)| +|||TLSv1.2/HTTPS/HTTP|arc.msn.com| +|||HTTPS|ris.api.iris.microsoft.com| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. If you turn off traffic for this endpoint, Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates)| +|||TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| +|||HTTP|emdl.ws.microsoft.com| +||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store. If you turn off traffic for these endpoints, the device will not be able to download updates for the operating system.|TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| +|||HTTP|*.windowsupdate.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store. If you turn off traffic for these endpoints, the device will not be able to connect to Windows Update and Microsoft Update to help keep the device secure. Also, the device will not be able to acquire and update apps from the Store. These are dependent on also enabling "Device authentication" and "Microsoft Account" endpoints.|TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTPS|adl.windows.com| +||The following endpoint is used for content regulation. If you turn off traffic for this endpoint, the Windows Update Agent will be unable to contact the endpoint and fallback behavior will be used. This may result in content being either incorrectly downloaded or not downloaded at all.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| +|Xbox Live|The following endpoint is used for Xbox Live.||[Learn how to turn off traffic to all of the following endpoint(s).](manage-connections-from-windows-operating-system-components-to-microsoft-services#26-microsoft-store)| +|||HTTPS|dlassets-ssl.xboxlive.com| +| + +## Other Windows 10 editions + +To view endpoints for other versions of Windows 10 Enterprise, see: + +- [Manage connection endpoints for Windows 10, version 2004](manage-windows-2004-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1909](manage-windows-1909-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1903](manage-windows-1903-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1809](manage-windows-1809-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1803](manage-windows-1803-endpoints.md) +- [Manage connection endpoints for Windows 10, version 1709](manage-windows-1709-endpoints.md) + +To view endpoints for non-Enterprise Windows 10 editions, see: + +- [Windows 10, version 2004, connection endpoints for non-Enterprise editions](windows-endpoints-2004-non-enterprise-editions.md) +- [Windows 10, version 1909, connection endpoints for non-Enterprise editions](windows-endpoints-1909-non-enterprise-editions.md) +- [Windows 10, version 1903, connection endpoints for non-Enterprise editions](windows-endpoints-1903-non-enterprise-editions.md) +- [Windows 10, version 1809, connection endpoints for non-Enterprise editions](windows-endpoints-1809-non-enterprise-editions.md) +- [Windows 10, version 1803, connection endpoints for non-Enterprise editions](windows-endpoints-1803-non-enterprise-editions.md) +- [Windows 10, version 1709, connection endpoints for non-Enterprise editions](windows-endpoints-1709-non-enterprise-editions.md) + +## Related links + +- [Office 365 URLs and IP address ranges](https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2?ui=en-US&rs=en-US&ad=US) +- [Network infrastructure requirements for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/intune-endpoints) diff --git a/windows/privacy/toc.yml b/windows/privacy/toc.yml index 60bf83c118..52a6ddd6da 100644 --- a/windows/privacy/toc.yml +++ b/windows/privacy/toc.yml @@ -41,6 +41,8 @@ href: manage-connections-from-windows-operating-system-components-to-microsoft-services.md - name: Manage connections from Windows operating system components to Microsoft services using MDM href: manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md + - name: Connection endpoints for Windows 10, version 20H2 + href: manage-windows-20H2-endpoints.md - name: Connection endpoints for Windows 10, version 2004 href: manage-windows-2004-endpoints.md - name: Connection endpoints for Windows 10, version 1909 @@ -53,6 +55,8 @@ href: manage-windows-1803-endpoints.md - name: Connection endpoints for Windows 10, version 1709 href: manage-windows-1709-endpoints.md + - name: Connection endpoints for non-Enterprise editions of Windows 10, version 20H2 + href: windows-endpoints-20H2-non-enterprise-editions.md - name: Connection endpoints for non-Enterprise editions of Windows 10, version 2004 href: windows-endpoints-2004-non-enterprise-editions.md - name: Connection endpoints for non-Enterprise editions of Windows 10, version 1909 diff --git a/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md b/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md new file mode 100644 index 0000000000..6f82f0ddf4 --- /dev/null +++ b/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md @@ -0,0 +1,264 @@ +--- +title: Windows 10, version 20H2, connection endpoints for non-Enterprise editions +description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 20H2. +keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.localizationpriority: high +audience: ITPro +author: gental-giant +ms.author: v-hakima +manager: robsize +ms.collection: M365-security-compliance +ms.topic: article +ms.date: 12/17/2020 +--- +# Windows 10, version 20H2, connection endpoints for non-Enterprise editions + + **Applies to** + +- Windows 10 Home, version 20H2 +- Windows 10 Professional, version 20H2 +- Windows 10 Education, version 20H2 + +In addition to the endpoints listed for [Windows 10 Enterprise](manage-windows-2004-endpoints.md), the following endpoints are available on other non-Enterprise editions of Windows 10, version 20H2. + +The following methodology was used to derive the network endpoints: + +1. Set up the latest version of Windows 10 on a test virtual machine using the default settings. +2. Leave the device(s) running idle for a week ("idle" means a user is not interacting with the system/device). +3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. +4. Compile reports on traffic going to public IP addresses. +5. The test virtual machine(s) was logged into using a local account, and was not joined to a domain or Azure Active Directory. +6. All traffic was captured in our lab using a IPV4 network. Therefore, no IPV6 traffic is reported here. +7. These tests were conducted in an approved Microsoft lab. It's possible your results may be different. +8. These tests were conducted for one week. If you capture traffic for longer you may have different results. + +> [!NOTE] +> Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. + +## Windows 10 Family + +| **Area** | **Description** | **Protocol** | **Destination** | +|-----------|--------------- |------------- |-----------------| +| Activity Feed Service |The following endpoints are used by Activity Feed Service which enables multiple cross-device data roaming scenarios on Windows|TLSv1.2/HTTPS/HTTP|activity.windows.com| +|Apps|The following endpoints are used for the Weather app.|TLSv1.2/HTTPS/HTTP|tile-service.weather.microsoft.com| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS/HTTP|evoke-windowsservices-tas.msedge.net| +||The following endpoint is used for OneNote Live Tile.|HTTPS/HTTP|cdn.onenote.net| +||Used for Spotify Live Tile|HTTPS/HTTP|spclient.wg.spotify.com| +|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available.|TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com/*| +|Cortana and Live Tiles|The following endpoints are related to Cortana and Live Tiles|TLSv1.2/HTTPS/HTTP|www.bing.com*| +|||HTTPS/HTTP|fp.msedge.net| +|||HTTPS/HTTP|k-ring.msedge.net| +|||TLSv1.2|b-ring.msedge.net| +|Device authentication|The following endpoint is used to authenticate a device.|HTTPS|login.live.com*| +|Device Directory Service|Used by Device Directory Service to keep track of user-device associations and storing metadata about the devices.|HTTPS/HTTP|cs.dds.microsoft.com| +|Device metadata|The following endpoint is used to retrieve device metadata.|TLSv1.2/HTTP|dmd.metaservices.microsoft.com| +|Diagnostic data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.|TLSv1.2/HTTP|v10.events.data.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|v20.events.data.microsoft.com| +|||TLSv1.2/HTTP|www.microsoft.com| +||The following endpoints are used by Windows Error Reporting.|TLSv1.2/HTTPS/HTTP|watson.telemetry.microsoft.com| +|Font Streaming|The following endpoints are used to download fonts on demand.|TLSv1.2/HTTPS|fs.microsoft.com*| +|Licensing|The following endpoint is used for online activation and some app licensing.|HTTPS/HTTP|*licensing.mp.microsoft.com| +|||HTTPS|licensing.mp.microsoft.com/v7.0/licenses/content| +|Location|The following endpoints are used for location data.|TLSV1.2|inference.location.live.net| +|Maps|The following endpoints are used to check for updates to maps that have been downloaded for offline use.|HTTPS/HTTP|maps.windows.com| +|||HTTPS/HTTP|*.ssl.ak.dynamic.tiles.virtualearth.net| +|||HTTPS/HTTP|*.ssl.ak.tiles.virtualearth.net| +|||HTTPS/HTTP|dev.virtualearth.net| +|||HTTPS/HTTP|ecn.dev.virtualearth.net| +|||HTTPS/HTTP|ssl.bing.com| +|Microsoft Account|The following endpoints are used for Microsoft accounts to sign in|TLSv1.2/HTTPS/HTTP|*login.live.com| +|Microsoft Edge|The following endpoints are used for Microsoft Edge Browser Services.|HTTPS/HTTP|edge.activity.windows.com| +|||HTTPS/HTTP|edge.microsoft.com| +||The following endpoint is used by Microsoft Edge Update service to check for new updates.|HTTPS/HTTP|msedge.api.cdp.microsoft.com| +|Microsoft forward link redirection|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer|HTTP|go.microsoft.com/fwlink/| +|||TLSv1.2/HTTPS/HTTP|go.microsoft.com| +|Microsoft Store|The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps)|TLSv1.2/HTTPS/HTTP|img-prod-cms-rt-microsoft-com.akamaized.net| +||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way.|TLSv1.2/HTTPS|*.wns.windows.com| +||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store.|TLSv1.2/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com| +||The following endpoints are used to communicate with Microsoft Store.|TLSv1.2/HTTPS/HTTP|*displaycatalog.mp.microsoft.com| +|||HTTPS|pti.store.microsoft.com| +|||HTTPS|storesdk.dsx.mp.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com| +||The following endpoints are used get images that are used for Microsoft Store suggestions|TLSv1.2|store-images.s-microsoft.com| +|Network Connection Status Indicator (NCSI)|Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet.|TLSv1.2/HTTP|www.msftconnecttest.com*| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS/HTTP|outlook.office365.com| +|||TLSv1.2/HTTPS|office.com| +|||TLSv1.2/HTTPS|blobs.officehome.msocdn.com| +|||HTTPS/HTTP|officehomeblobs.blob.core.windows.net| +|||HTTP/HTTPS|*.blob.core.windows.net| +|||TLSv1.2|self.events.data.microsoft.com| +|||HTTPS/HTTP|outlookmobile-office365-tas.msedge.net| +|||HTTP|roaming.officeapps.live.com| +|||HTTPS/HTTP|substrate.office.com| +|OneDrive|The following endpoints are related to OneDrive.|HTTPS|g.live.com| +|||TLSv1.2/HTTPS|oneclient.sfx.ms| +|||HTTPS/TLSv1.2|logincdn.msauth.net| +|||HTTPS/HTTP|windows.policies.live.net| +|||HTTPS/HTTP|api.onedrive.com| +|||HTTPS/HTTP|skydrivesync.policies.live.net| +|||HTTPS/HTTP|*storage.live.com| +|||HTTPS/HTTP|*settings.live.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it.|TLSv1.2/HTTPS/HTTP|settings.data.microsoft.com*| +|||TLSv1.2/HTTPS/HTTP|settings-win.data.microsoft.com*| +|Skype|The following endpoint is used to retrieve Skype configuration values.|TLSv1.2/HTTPS/HTTP|*.pipe.aria.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|config.edge.skype.com| +|Teams|The following endpoint is used for Microsoft Teams application.|TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled|TLSv1.2/HTTPS|wdcp.microsoft.com| +|||HTTPS/HTTP|*smartscreen-prod.microsoft.com| +|||TLSv1.2|definitionupdates.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications.|TLSv1.2|*smartscreen.microsoft.com| +|||TLSv1.2/HTTP|checkappexec.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTPS/HTTP|arc.msn.com*| +|||TLSv1.2/HTTPS/HTTP|ris.api.iris.microsoft.com| +|||HTTPS|mucp.api.account.microsoft.com| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| +|||TLSv1.2/HTTP|emdl.ws.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| +||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com| +|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store to help keep the device secure.|TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTP/HTTPS|adl.windows.com| +||The following endpoint is used for content regulation.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| +|Xbox Live|The following endpoints are used for Xbox Live.| +|||TLSv1.2/HTTPS/HTTP|dlassets-ssl.xboxlive.com| +|||TLSv1.2/HTTPS|da.xboxservices.com| +|||HTTPS|www.xboxab.com| +| + +## Windows 10 Pro + +| **Area** | **Description** | **Protocol** | **Destination** | +| --- | --- | --- | ---| +| Activity Feed Service |The following endpoints are used by Activity Feed Service which enables multiple cross-device data roaming scenarios on Windows|TLSv1.2/HTTPS/HTTP|activity.windows.com| +|Apps|The following endpoints are used for the Weather app.|TLSv1.2/HTTPS/HTTP|tile-service.weather.microsoft.com| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS/HTTP|evoke-windowsservices-tas.msedge.net| +||The following endpoint is used for OneNote Live Tile.|HTTPS/HTTP|cdn.onenote.net| +||Used for Spotify Live Tile|HTTPS/HTTP|spclient.wg.spotify.com| +|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available.|TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com/*| +|Cortana and Live Tiles|The following endpoints are related to Cortana and Live Tiles|TLSv1.2/HTTPS/HTTP|www.bing.com*| +|Device authentication|The following endpoint is used to authenticate a device.|HTTPS|login.live.com*| +|Device metadata|The following endpoint is used to retrieve device metadata.|TLSv1.2/HTTP|dmd.metaservices.microsoft.com| +|Diagnostic data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.|TLSv1.2/HTTP|v10.events.data.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|v20.events.data.microsoft.com| +|||TLSv1.2/HTTP|www.microsoft.com| +||The following endpoints are used by Windows Error Reporting.|TLSv1.2/HTTPS/HTTP|watson.telemetry.microsoft.com| +|Font Streaming|The following endpoints are used to download fonts on demand.|TLSv1.2/HTTPS|fs.microsoft.com*| +|Licensing|The following endpoint is used for online activation and some app licensing.|HTTPS/HTTP|*licensing.mp.microsoft.com| +|Maps|The following endpoints are used to check for updates to maps that have been downloaded for offline use.|HTTPS/HTTP|maps.windows.com| +|Microsoft Account|The following endpoints are used for Microsoft accounts to sign in|TLSv1.2/HTTPS/HTTP|*login.live.com| +|Microsoft Edge|The following endpoint is used by Microsoft Edge Update service to check for new updates.|HTTPS/HTTP|msedge.api.cdp.microsoft.com| +|Microsoft forward link redirection|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer|TLSv1.2/HTTPS/HTTP|go.microsoft.com| +|Microsoft Store|The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps)|TLSv1.2/HTTPS/HTTP|img-prod-cms-rt-microsoft-com.akamaized.net| +||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way.|TLSv1.2/HTTPS|*.wns.windows.com| +||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store.|TLSv1.2/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com| +||The following endpoints are used to communicate with Microsoft Store.|TLSv1.2/HTTPS/HTTP|*displaycatalog.mp.microsoft.com| +|||HTTPS|pti.store.microsoft.com| +|||HTTPS|storesdk.dsx.mp.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com| +|Network Connection Status Indicator (NCSI)|Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet.|TLSv1.2/HTTP|www.msftconnecttest.com*| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS/HTTP|outlook.office365.com| +|||TLSv1.2/HTTPS|office.com| +|||TLSv1.2/HTTPS|blobs.officehome.msocdn.com| +|||HTTPS/HTTP|officehomeblobs.blob.core.windows.net| +|||HTTP/HTTPS|*.blob.core.windows.net| +|||TLSv1.2|self.events.data.microsoft.com| +|||HTTPS/HTTP|outlookmobile-office365-tas.msedge.net| +|||TLSv1.2/HTTPS/HTTP|officeclient.microsoft.com| +|||HTTPS/HTTP|substrate.office.com| +|OneDrive|The following endpoints are related to OneDrive.|HTTPS|g.live.com| +|||TLSv1.2/HTTPS|oneclient.sfx.ms| +|||HTTPS/TLSv1.2|logincdn.msauth.net| +|||HTTPS/HTTP|windows.policies.live.net| +|||HTTPS/HTTP|*storage.live.com| +|||HTTPS/HTTP|*settings.live.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it.|TLSv1.2/HTTPS/HTTP|settings.data.microsoft.com*| +|||TLSv1.2/HTTPS/HTTP|settings-win.data.microsoft.com*| +|Skype|The following endpoint is used to retrieve Skype configuration values.|TLSv1.2/HTTPS/HTTP|*.pipe.aria.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|config.edge.skype.com| +|Teams|The following endpoint is used for Microsoft Teams application.|TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled|TLSv1.2/HTTPS|wdcp.microsoft.com| +|||HTTPS/HTTP|*smartscreen-prod.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications.|TLSv1.2|*smartscreen.microsoft.com| +|||TLSv1.2/HTTP|checkappexec.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTPS/HTTP|arc.msn.com*| +|||TLSv1.2/HTTPS/HTTP|ris.api.iris.microsoft.com| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| +|||TLSv1.2/HTTP|emdl.ws.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| +||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com| +|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store to help keep the device secure.|TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTP/HTTPS|adl.windows.com| +||The following endpoint is used for content regulation.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| +|Xbox Live|The following endpoints are used for Xbox Live.| +|||TLSv1.2/HTTPS/HTTP|dlassets-ssl.xboxlive.com| +|||TLSv1.2/HTTPS|da.xboxservices.com| +| + +## Windows 10 Education + +| **Area** | **Description** | **Protocol** | **Destination** | +| --- | --- | --- | ---| +| Activity Feed Service |The following endpoints are used by Activity Feed Service which enables multiple cross-device data roaming scenarios on Windows|TLSv1.2/HTTPS/HTTP|activity.windows.com| +|Apps|The following endpoints are used for the Weather app.|TLSv1.2/HTTPS/HTTP|tile-service.weather.microsoft.com| +||The following endpoint is used by the Photos app to download configuration files, and to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS/HTTP|evoke-windowsservices-tas.msedge.net| +||The following endpoint is used for OneNote Live Tile.|HTTPS/HTTP|cdn.onenote.net| +|Bing Search|The following endpoint is used by Microsoft Search in Bing enabling users to search across files, SharePoint sites, OneDrive content, Teams and Yammer conversations, and other shared data sources in an organization, as well as the web.|HTTPS|business.bing.com| +|Certificates|The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available.|TLSv1.2/HTTPS/HTTP|ctldl.windowsupdate.com/*| +|Cortana and Live Tiles|The following endpoints are related to Cortana and Live Tiles|TLSv1.2/HTTPS/HTTP|www.bing.com*| +|||HTTPS/HTTP|fp.msedge.net| +|||TLSv1.2|odinvzc.azureedge.net| +|||TLSv1.2|b-ring.msedge.net| +|Device metadata|The following endpoint is used to retrieve device metadata.|TLSv1.2/HTTP|dmd.metaservices.microsoft.com| +|Diagnostic data|The following endpoints are used by the Connected User Experiences and Telemetry component and connects to the Microsoft Data Management service.|TLSv1.2/HTTP|v10.events.data.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|v20.events.data.microsoft.com| +|||TLSv1.2/HTTP|www.microsoft.com| +||The following endpoints are used by Windows Error Reporting.|TLSv1.2/HTTPS/HTTP|watson.telemetry.microsoft.com| +|Font Streaming|The following endpoints are used to download fonts on demand.|TLSv1.2/HTTPS|fs.microsoft.com*| +|Licensing|The following endpoint is used for online activation and some app licensing.|HTTPS/HTTP|*licensing.mp.microsoft.com| +|Location|The following endpoints are used for location data.|TLSV1.2|inference.location.live.net| +|Maps|The following endpoints are used to check for updates to maps that have been downloaded for offline use.|HTTPS/HTTP|maps.windows.com| +|Microsoft Account|The following endpoints are used for Microsoft accounts to sign in|TLSv1.2/HTTPS/HTTP|*login.live.com| +|Microsoft Edge|The following endpoint is used by Microsoft Edge Update service to check for new updates.|HTTPS/HTTP|msedge.api.cdp.microsoft.com| +|Microsoft forward link redirection|The following endpoint is used by the Microsoft forward link redirection service (FWLink) to redirect permanent web links to their actual, sometimes transitory, URL. FWlinks are similar to URL shorteners, just longer|TLSv1.2/HTTPS/HTTP|go.microsoft.com| +|Microsoft Store|The following endpoint is used to download image files that are called when applications run (Microsoft Store or Inbox MSN Apps)|TLSv1.2/HTTPS/HTTP|img-prod-cms-rt-microsoft-com.akamaized.net| +||The following endpoint is used for the Windows Push Notification Services (WNS). WNS enables third-party developers to send toast, tile, badge, and raw updates from their own cloud service. This provides a mechanism to deliver new updates to your users in a power-efficient and dependable way.|TLSv1.2/HTTPS|*.wns.windows.com| +||The following endpoint is used to revoke licenses for malicious apps in the Microsoft Store.|TLSv1.2/HTTPS/HTTP|storecatalogrevocation.storequality.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|1storecatalogrevocation.storequality.microsoft.com| +||The following endpoints are used to communicate with Microsoft Store.|TLSv1.2/HTTPS/HTTP|*displaycatalog.mp.microsoft.com| +|||HTTPS|pti.store.microsoft.com| +|||HTTPS|storesdk.dsx.mp.microsoft.com| +||The following endpoint is used to get Microsoft Store analytics.|TLSv1.2/HTTPS/HTTP|manage.devcenter.microsoft.com| +|Network Connection Status Indicator (NCSI)|Network Connection Status Indicator (NCSI) detects Internet connectivity and corporate network connectivity status. NCSI sends a DNS request and HTTP query to this endpoint to determine if the device can communicate with the Internet.|TLSv1.2/HTTP|www.msftconnecttest.com*| +|Office|The following endpoints are used to connect to the Office 365 portal's shared infrastructure, including Office in a browser.|TLSv1.2/HTTPS|office.com| +|||HTTPS/HTTP|officehomeblobs.blob.core.windows.net| +|||TLSv1.2|self.events.data.microsoft.com| +|OneDrive|The following endpoints are related to OneDrive.|HTTPS|g.live.com| +|||TLSv1.2/HTTPS|oneclient.sfx.ms| +|||HTTPS/TLSv1.2|logincdn.msauth.net| +|Settings|The following endpoint is used as a way for apps to dynamically update their configuration. Apps such as System Initiated User Feedback and the Xbox app use it.|TLSv1.2/HTTPS/HTTP|settings.data.microsoft.com*| +|||TLSv1.2/HTTPS/HTTP|settings-win.data.microsoft.com*| +|Skype|The following endpoint is used to retrieve Skype configuration values.|TLSv1.2/HTTPS/HTTP|*.pipe.aria.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|config.edge.skype.com| +|Teams|The following endpoint is used for Microsoft Teams application.|TLSv1.2/HTTPS/HTTP|config.teams.microsoft.com| +|Windows Defender|The following endpoint is used for Windows Defender when Cloud-based Protection is enabled|TLSv1.2/HTTPS|wdcp.microsoft.com| +|||HTTPS/HTTP|*smartscreen-prod.microsoft.com| +||The following endpoints are used for Windows Defender SmartScreen reporting and notifications.|TLSv1.2|*smartscreen.microsoft.com| +|||TLSv1.2/HTTP|checkappexec.microsoft.com| +|Windows Spotlight|The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips.|TLSv1.2/HTTPS/HTTP|arc.msn.com*| +|||TLSv1.2/HTTPS/HTTP|ris.api.iris.microsoft.com| +|Windows Update|The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers.|TLSv1.2/HTTPS/HTTP|*.prod.do.dsp.mp.microsoft.com| +|||TLSv1.2/HTTP|emdl.ws.microsoft.com| +|||TLSv1.2/HTTPS/HTTP|*.dl.delivery.mp.microsoft.com| +||The following endpoints are used to download operating system patches, updates, and apps from Microsoft Store.|TLSv1.2/HTTP|*.windowsupdate.com| +|||TLSv1.2/HTTPS/HTTP|*.delivery.mp.microsoft.com| +||The following endpoints enable connections to Windows Update, Microsoft Update, and the online services of the Store to help keep the device secure.|TLSv1.2/HTTPS/HTTP|*.update.microsoft.com| +||The following endpoint is used for compatibility database updates for Windows.|HTTP/HTTPS|adl.windows.com| +||The following endpoint is used for content regulation.|TLSv1.2/HTTPS/HTTP|tsfe.trafficshaping.dsp.mp.microsoft.com| +|Xbox Live|The following endpoints are used for Xbox Live.| +|||TLSv1.2/HTTPS/HTTP|dlassets-ssl.xboxlive.com| +|||TLSv1.2/HTTPS|da.xboxservices.com| +| \ No newline at end of file From 193579e579888db25219475966dc8ccda084eaa4 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 17 Dec 2020 14:50:01 -0800 Subject: [PATCH 079/825] Added icm policies --- .../mdm/policy-csp-admx-icm.md | 1557 +++++++++++++++++ 1 file changed, 1557 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-icm.md diff --git a/windows/client-management/mdm/policy-csp-admx-icm.md b/windows/client-management/mdm/policy-csp-admx-icm.md new file mode 100644 index 0000000000..82dfc6c182 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-icm.md @@ -0,0 +1,1557 @@ +--- +title: Policy CSP - ADMX_ICM +description: Policy CSP - ADMX_ICM +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/17/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ICM +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
    + + +## ADMX_ICM policies + +
    +
    + ADMX_ICM/CEIPEnable +
    +
    + ADMX_ICM/CertMgr_DisableAutoRootUpdates +
    +
    + ADMX_ICM/DisableHTTPPrinting_1 +
    +
    + ADMX_ICM/DisableWebPnPDownload_1 +
    +
    + ADMX_ICM/DriverSearchPlaces_DontSearchWindowsUpdate +
    +
    + ADMX_ICM/EventViewer_DisableLinks +
    +
    + ADMX_ICM/HSS_HeadlinesPolicy +
    +
    + ADMX_ICM/HSS_KBSearchPolicy +
    +
    + ADMX_ICM/InternetManagement_RestrictCommunication_1 +
    +
    + ADMX_ICM/InternetManagement_RestrictCommunication_2 +
    +
    + ADMX_ICM/NC_ExitOnISP +
    +
    + ADMX_ICM/NC_NoRegistration +
    +
    + ADMX_ICM/PCH_DoNotReport +
    +
    + ADMX_ICM/RemoveWindowsUpdate_ICM +
    +
    + ADMX_ICM/SearchCompanion_DisableFileUpdates +
    +
    + ADMX_ICM/ShellNoUseInternetOpenWith_1 +
    +
    + ADMX_ICM/ShellNoUseInternetOpenWith_2 +
    +
    + ADMX_ICM/ShellNoUseStoreOpenWith_1 +
    +
    + ADMX_ICM/ShellNoUseStoreOpenWith_2 +
    +
    + ADMX_ICM/ShellPreventWPWDownload_1 +
    +
    + ADMX_ICM/ShellRemoveOrderPrints_1 +
    +
    + ADMX_ICM/ShellRemoveOrderPrints_2 +
    +
    + ADMX_ICM/ShellRemovePublishToWeb_1 +
    +
    + ADMX_ICM/ShellRemovePublishToWeb_2 +
    +
    + ADMX_ICM/WinMSG_NoInstrumentation_1 +
    +
    + ADMX_ICM/WinMSG_NoInstrumentation_2 +
    +
    + + +
    + + +**ADMX_ICM/CEIPEnable** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off the Windows Customer Experience Improvement Program. The Windows Customer Experience Improvement Program collects information about your hardware configuration and how you use our software and services to identify trends and usage patterns. Microsoft will not collect your name, address, or any other personally identifiable information. There are no surveys to complete, no salesperson will call, and you can continue working without interruption. It is simple and user-friendly. + +If you enable this policy setting, all users are opted out of the Windows Customer Experience Improvement Program. + +If you disable this policy setting, all users are opted into the Windows Customer Experience Improvement Program. + +If you do not configure this policy setting, the administrator can use the Problem Reports and Solutions component in Control Panel to enable Windows Customer Experience Improvement Program for all users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Customer Experience Improvement Program* +- GP name: *CEIPEnable* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/CertMgr_DisableAutoRootUpdates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to automatically update root certificates using the Windows Update website. + +Typically, a certificate is used when you use a secure website or when you send and receive secure email. Anyone can issue certificates, but to have transactions that are as secure as possible, certificates must be issued by a trusted certificate authority (CA). Microsoft has included a list in Windows XP and other products of companies and organizations that it considers trusted authorities. + +If you enable this policy setting, when you are presented with a certificate issued by an untrusted root authority, your computer will not contact the Windows Update website to see if Microsoft has added the CA to its list of trusted authorities. + +If you disable or do not configure this policy setting, your computer will contact the Windows Update website. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Automatic Root Certificates Update* +- GP name: *CertMgr_DisableAutoRootUpdates* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/DisableHTTPPrinting_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to allow printing over HTTP from this client. + +Printing over HTTP allows a client to print to printers on the intranet as well as the Internet. + +> [!NOTE] +> This policy setting affects the client side of Internet printing only. It does not prevent this computer from acting as an Internet Printing server and making its shared printers available via HTTP. + +If you enable this policy setting, it prevents this client from printing to Internet printers over HTTP. + +If you disable or do not configure this policy setting, users can choose to print to Internet printers over HTTP. Also, see the "Web-based printing" policy setting in Computer Configuration/Administrative Templates/Printers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off printing over HTTP* +- GP name: *DisableHTTPPrinting_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/DisableWebPnPDownload_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to allow this client to download print driver packages over HTTP. + +To set up HTTP printing, non-inbox drivers need to be downloaded over HTTP. + +> [!NOTE] +> This policy setting does not prevent the client from printing to printers on the Intranet or the Internet over HTTP. + +It only prohibits downloading drivers that are not already installed locally. + +If you enable this policy setting, print drivers cannot be downloaded over HTTP. + +If you disable or do not configure this policy setting, users can download print drivers over HTTP. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off downloading of print drivers over HTTP* +- GP name: *DisableWebPnPDownload_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/DriverSearchPlaces_DontSearchWindowsUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows searches Windows Update for device drivers when no local drivers for a device are present. + +If you enable this policy setting, Windows Update is not searched when a new device is installed. + +If you disable this policy setting, Windows Update is always searched for drivers when no local drivers are present. + +If you do not configure this policy setting, searching Windows Update is optional when installing a device. + +Also see "Turn off Windows Update device driver search prompt" in "Administrative Templates/System," which governs whether an administrator is prompted before searching Windows Update for device drivers if a driver is not found locally. + +> [!NOTE] +> This policy setting is replaced by "Specify Driver Source Search Order" in "Administrative Templates/System/Device Installation" on newer versions of Windows. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Update device driver searching* +- GP name: *DriverSearchPlaces_DontSearchWindowsUpdate* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/EventViewer_DisableLinks** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether "Events.asp" hyperlinks are available for events within the Event Viewer application. + +The Event Viewer normally makes all HTTP(S) URLs into hyperlinks that activate the Internet browser when clicked. In addition, "More Information" is placed at the end of the description text if the event is created by a Microsoft component. This text contains a link (URL) that, if clicked, sends information about the event to Microsoft, and allows users to learn more about why that event occurred. + +If you enable this policy setting, event description hyperlinks are not activated and the text "More Information" is not displayed at the end of the description. + +If you disable or do not configure this policy setting, the user can click the hyperlink, which prompts the user and then sends information about the event over the Internet to Microsoft. + +Also, see "Events.asp URL", "Events.asp program", and "Events.asp Program Command Line Parameters" settings in "Administrative Templates/Windows Components/Event Viewer". + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Event Viewer "Events.asp" links* +- GP name: *EventViewer_DisableLinks* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/HSS_HeadlinesPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to show the "Did you know?" section of Help and Support Center. + +This content is dynamically updated when users who are connected to the Internet open Help and Support Center, and provides up-to-date information about Windows and the computer. + +If you enable this policy setting, the Help and Support Center no longer retrieves nor displays "Did you know?" content. + +If you disable or do not configure this policy setting, the Help and Support Center retrieves and displays "Did you know?" content. + +You might want to enable this policy setting for users who do not have Internet access, because the content in the "Did you know?" section will remain static indefinitely without an Internet connection. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Help and Support Center "Did you know?" content* +- GP name: *HSS_HeadlinesPolicy* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/HSS_KBSearchPolicy** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether users can perform a Microsoft Knowledge Base search from the Help and Support Center. + +The Knowledge Base is an online source of technical support information and self-help tools for Microsoft products, and is searched as part of all Help and Support Center searches with the default search options. + +If you enable this policy setting, it removes the Knowledge Base section from the Help and Support Center "Set search options" page, and only Help content on the local computer is searched. + +If you disable or do not configure this policy setting, the Knowledge Base is searched if the user has a connection to the Internet and has not disabled the Knowledge Base search from the Search Options page. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Help and Support Center Microsoft Knowledge Base search* +- GP name: *HSS_KBSearchPolicy* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/InternetManagement_RestrictCommunication_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. + +If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. + +If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. + +If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict Internet communication* +- GP name: *InternetManagement_RestrictCommunication_1* +- GP path: *System\Internet Communication Management* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/InternetManagement_RestrictCommunication_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. + +If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. + +If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. + +If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict Internet communication* +- GP name: *InternetManagement_RestrictCommunication_2* +- GP path: *System\Internet Communication Management* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/NC_ExitOnISP** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the Internet Connection Wizard can connect to Microsoft to download a list of Internet Service Providers (ISPs). + +If you enable this policy setting, the "Choose a list of Internet Service Providers" path in the Internet Connection Wizard causes the wizard to exit. This prevents users from retrieving the list of ISPs, which resides on Microsoft servers. + +If you disable or do not configure this policy setting, users can connect to Microsoft to download a list of ISPs for their area. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Internet Connection Wizard if URL connection is referring to Microsoft.com* +- GP name: *NC_ExitOnISP* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/NC_NoRegistration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the Windows Registration Wizard connects to Microsoft.com for online registration. + +If you enable this policy setting, it blocks users from connecting to Microsoft.com for online registration and users cannot register their copy of Windows online. + +If you disable or do not configure this policy setting, users can connect to Microsoft.com to complete the online Windows Registration. + +Note that registration is optional and involves submitting some personal information to Microsoft. However, Windows Product Activation is required but does not involve submitting any personal information (except the country/region you live in). + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Registration if URL connection is referring to Microsoft.com* +- GP name: *NC_NoRegistration* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/PCH_DoNotReport** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not errors are reported to Microsoft. + +Error Reporting is used to report information about a system or application that has failed or has stopped responding and is used to improve the quality of the product. + +If you enable this policy setting, users are not given the option to report errors. + +If you disable or do not configure this policy setting, the errors may be reported to Microsoft via the Internet or to a corporate file share. + +This policy setting overrides any user setting made from the Control Panel for error reporting. + +Also see the "Configure Error Reporting", "Display Error Notification" and "Disable Windows Error Reporting" policy settings under Computer Configuration/Administrative Templates/Windows Components/Windows Error Reporting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Error Reporting* +- GP name: *PCH_DoNotReport* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/RemoveWindowsUpdate_ICM** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove access to Windows Update. + +If you enable this policy setting, all Windows Update features are removed. This includes blocking access to the Windows Update website at http://windowsupdate.microsoft.com, from the Windows Update hyperlink on the Start menu, and also on the Tools menu in Internet Explorer. Windows automatic updating is also disabled; you will neither be notified about nor will you receive critical updates from Windows Update. This policy setting also prevents Device Manager from automatically installing driver updates from the Windows Update website. + +If you disable or do not configure this policy setting, users can access the Windows Update website and enable automatic updating to receive notifications and critical updates from Windows Update. + +> [!NOTE] +> This policy applies only when this PC is configured to connect to an intranet update service using the "Specify intranet Microsoft update service location" policy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off access to all Windows Update features* +- GP name: *RemoveWindowsUpdate_ICM* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/SearchCompanion_DisableFileUpdates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Search Companion should automatically download content updates during local and Internet searches. + +When users search the local computer or the Internet, Search Companion occasionally connects to Microsoft to download an updated privacy policy and additional content files used to format and display results. + +If you enable this policy setting, Search Companion does not download content updates during searches. + +If you disable or do not configure this policy setting, Search Companion downloads content updates unless the user is using Classic Search. + +> [!NOTE] +> Internet searches still send the search text and information about the search to Microsoft and the chosen search provider. Choosing Classic Search turns off the Search Companion feature completely. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Search Companion content file updates* +- GP name: *SearchCompanion_DisableFileUpdates* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/InternetManagement_RestrictCommunication_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. + +If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. + +If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. + +If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict Internet communication* +- GP name: *InternetManagement_RestrictCommunication_2* +- GP path: *System\Internet Communication Management* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/InternetManagement_RestrictCommunication_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. + +If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. + +If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. + +If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict Internet communication* +- GP name: *InternetManagement_RestrictCommunication_2* +- GP path: *System\Internet Communication Management* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/InternetManagement_RestrictCommunication_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. + +If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. + +If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. + +If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict Internet communication* +- GP name: *InternetManagement_RestrictCommunication_2* +- GP path: *System\Internet Communication Management* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/InternetManagement_RestrictCommunication_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. + +If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. + +If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. + +If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict Internet communication* +- GP name: *InternetManagement_RestrictCommunication_2* +- GP path: *System\Internet Communication Management* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/InternetManagement_RestrictCommunication_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. + +If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. + +If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. + +If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict Internet communication* +- GP name: *InternetManagement_RestrictCommunication_2* +- GP path: *System\Internet Communication Management* +- GP ADMX file name: *ICM.admx* + + + +
    + +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From d6680ea186ced63062cada328413d599fc6c9565 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 17 Dec 2020 15:49:32 -0800 Subject: [PATCH 080/825] Added ICM policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 26 + .../policy-configuration-service-provider.md | 115 +++- .../mdm/policy-csp-admx-icm.md | 517 ++++++++++++++++-- 4 files changed, 601 insertions(+), 58 deletions(-) diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 6e91df97ec..a4329d7e1b 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -209,6 +209,7 @@ #### [ADMX_Globalization](policy-csp-admx-globalization.md) #### [ADMX_Help](policy-csp-admx-help.md) #### [ADMX_HelpAndSupport](policy-csp-admx-helpandsupport.md) +#### [ADMX_ICM](policy-csp-admx-icm.md) #### [ADMX_kdc](policy-csp-admx-kdc.md) #### [ADMX_Kerberos](policy-csp-admx-kerberos.md) #### [ADMX_LanmanServer](policy-csp-admx-lanmanserver.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 8c03c186f3..fc369bf835 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -314,6 +314,32 @@ ms.date: 10/08/2020 - [ADMX_HelpAndSupport/HPExplicitFeedback](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-hpexplicitfeedback) - [ADMX_HelpAndSupport/HPImplicitFeedback](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-hpimplicitfeedback) - [ADMX_HelpAndSupport/HPOnlineAssistance](./policy-csp-admx-helpandsupport.md#admx-helpandsupport-hponlineassistance) +- [ADMX_ICM/CEIPEnable](./policy-csp-admx-icm.md#admx-icm-ceipenable) +- [ADMX_ICM/CertMgr_DisableAutoRootUpdates](./policy-csp-admx-icm.md#admx-icm-certmgr-disableautorootupdates) +- [ADMX_ICM/DisableHTTPPrinting_1](./policy-csp-admx-icm.md#admx-icm-disablehttpprinting-1) +- [ADMX_ICM/DisableWebPnPDownload_1](./policy-csp-admx-icm.md#admx-icm-disablewebpnpdownload-1) +- [ADMX_ICM/DriverSearchPlaces_DontSearchWindowsUpdate](./policy-csp-admx-icm.md#admx-icm-driversearchplaces-dontsearchwindowsupdate) +- [ADMX_ICM/EventViewer_DisableLinks](./policy-csp-admx-icm.md#admx-icm-eventviewer-disablelinks) +- [ADMX_ICM/HSS_HeadlinesPolicy](./policy-csp-admx-icm.md#admx-icm-hss-headlinespolicy) +- [ADMX_ICM/HSS_KBSearchPolicy](./policy-csp-admx-icm.md#admx-icm-hss-kbsearchpolicy) +- [ADMX_ICM/InternetManagement_RestrictCommunication_1](./policy-csp-admx-icm.md#admx-icm-internetmanagement_restrictcommunication_1) +- [ADMX_ICM/InternetManagement_RestrictCommunication_2](./policy-csp-admx-icm.md#admx-icm-internetmanagement-restrictcommunication-2) +- [ADMX_ICM/NC_ExitOnISP](./policy-csp-admx-icm.md#admx-icm-nc-exitonisp) +- [ADMX_ICM/NC_NoRegistration](./policy-csp-admx-icm.md#admx-icm-nc-noregistration) +- [ADMX_ICM/PCH_DoNotReport](./policy-csp-admx-icm.md#admx-icm-pch-donotreport) +- [ADMX_ICM/RemoveWindowsUpdate_ICM](./policy-csp-admx-icm.md#admx-icm-removewindowsupdate-icm) +- [ADMX_ICM/SearchCompanion_DisableFileUpdates](./policy-csp-admx-icm.md#admx-icm-searchcompanion-disablefileupdates) +- [ADMX_ICM/ShellNoUseInternetOpenWith_1](./policy-csp-admx-icm.md#admx-icm-shellnouseinternetopenwith-1) +- [ADMX_ICM/ShellNoUseInternetOpenWith_2](./policy-csp-admx-icm.md#admx-icm-shellnouseinternetopenwith-2) +- [ADMX_ICM/ShellNoUseStoreOpenWith_1](./policy-csp-admx-icm.md#admx-icm-shellnousestoreopenwith-1) +- [ADMX_ICM/ShellNoUseStoreOpenWith_2](./policy-csp-admx-icm.md#admx-icm-shellnousestoreopenwith-2) +- [ADMX_ICM/ShellPreventWPWDownload_1](./policy-csp-admx-icm.md#admx-icm-shellpreventwpwdownload-1) +- [ADMX_ICM/ShellRemoveOrderPrints_1](./policy-csp-admx-icm.md#admx-icm-shellremoveorderprints-1) +- [ADMX_ICM/ShellRemoveOrderPrints_2](./policy-csp-admx-icm.md#admx-icm-shellremoveorderprints-2) +- [ADMX_ICM/ShellRemovePublishToWeb_1](./policy-csp-admx-icm.md#admx-icm-shellremovepublishtoweb-1) +- [ADMX_ICM/ShellRemovePublishToWeb_2](./policy-csp-admx-icm.md#admx-icm-shellremovepublishtoweb-2) +- [ADMX_ICM/WinMSG_NoInstrumentation_1](./policy-csp-admx-icm.md#admx-icm-winmsg_noinstrumentation-1) +- [ADMX_ICM/WinMSG_NoInstrumentation_2](./policy-csp-admx-icm.md#admx-icm-winmsg_noinstrumentation-2) - [ADMX_kdc/CbacAndArmor](./policy-csp-admx-kdc.md#admx-kdc-cbacandarmor) - [ADMX_kdc/ForestSearch](./policy-csp-admx-kdc.md#admx-kdc-forestsearch) - [ADMX_kdc/PKINITFreshness](./policy-csp-admx-kdc.md#admx-kdc-pkinitfreshness) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 810eacc415..13cc28a89d 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1129,22 +1129,6 @@ The following diagram shows the Policy configuration service provider in tree fo
    -### ADMX_HelpAndSupport policies -
    -
    - ADMX_HelpAndSupport/ActiveHelp -
    -
    - ADMX_HelpAndSupport/HPExplicitFeedback -
    -
    - ADMX_HelpAndSupport/HPImplicitFeedback -
    -
    - ADMX_HelpAndSupport/HPOnlineAssistance -
    -
    - ### ADMX_Globalization policies
    @@ -1222,6 +1206,105 @@ The following diagram shows the Policy configuration service provider in tree fo
    +### ADMX_HelpAndSupport policies +
    +
    + ADMX_HelpAndSupport/ActiveHelp +
    +
    + ADMX_HelpAndSupport/HPExplicitFeedback +
    +
    + ADMX_HelpAndSupport/HPImplicitFeedback +
    +
    + ADMX_HelpAndSupport/HPOnlineAssistance +
    +
    + +## ADMX_ICM policies + +
    +
    + ADMX_ICM/CEIPEnable +
    +
    + ADMX_ICM/CertMgr_DisableAutoRootUpdates +
    +
    + ADMX_ICM/DisableHTTPPrinting_1 +
    +
    + ADMX_ICM/DisableWebPnPDownload_1 +
    +
    + ADMX_ICM/DriverSearchPlaces_DontSearchWindowsUpdate +
    +
    + ADMX_ICM/EventViewer_DisableLinks +
    +
    + ADMX_ICM/HSS_HeadlinesPolicy +
    +
    + ADMX_ICM/HSS_KBSearchPolicy +
    +
    + ADMX_ICM/InternetManagement_RestrictCommunication_1 +
    +
    + ADMX_ICM/InternetManagement_RestrictCommunication_2 +
    +
    + ADMX_ICM/NC_ExitOnISP +
    +
    + ADMX_ICM/NC_NoRegistration +
    +
    + ADMX_ICM/PCH_DoNotReport +
    +
    + ADMX_ICM/RemoveWindowsUpdate_ICM +
    +
    + ADMX_ICM/SearchCompanion_DisableFileUpdates +
    +
    + ADMX_ICM/ShellNoUseInternetOpenWith_1 +
    +
    + ADMX_ICM/ShellNoUseInternetOpenWith_2 +
    +
    + ADMX_ICM/ShellNoUseStoreOpenWith_1 +
    +
    + ADMX_ICM/ShellNoUseStoreOpenWith_2 +
    +
    + ADMX_ICM/ShellPreventWPWDownload_1 +
    +
    + ADMX_ICM/ShellRemoveOrderPrints_1 +
    +
    + ADMX_ICM/ShellRemoveOrderPrints_2 +
    +
    + ADMX_ICM/ShellRemovePublishToWeb_1 +
    +
    + ADMX_ICM/ShellRemovePublishToWeb_2 +
    +
    + ADMX_ICM/WinMSG_NoInstrumentation_1 +
    +
    + ADMX_ICM/WinMSG_NoInstrumentation_2 +
    +
    + ### ADMX_kdc policies
    diff --git a/windows/client-management/mdm/policy-csp-admx-icm.md b/windows/client-management/mdm/policy-csp-admx-icm.md index 82dfc6c182..fa79b7acc9 100644 --- a/windows/client-management/mdm/policy-csp-admx-icm.md +++ b/windows/client-management/mdm/policy-csp-admx-icm.md @@ -1193,7 +1193,7 @@ ADMX Info:
    -**ADMX_ICM/InternetManagement_RestrictCommunication_2** +**ADMX_ICM/ShellNoUseInternetOpenWith_1** @@ -1230,19 +1230,20 @@ ADMX Info: [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] -> * Device +> * User
    -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to use the Microsoft Web service for finding an application to open a file with an unhandled file association. -If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. +When a user opens a file that has an extension that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Web service to find an application. -If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. +If you enable this policy setting, the link and the dialog for using the Web service to open an unhandled file association are removed. + +If you disable or do not configure this policy setting, the user is allowed to use the Web service. -If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). @@ -1253,9 +1254,9 @@ If you do not configure this policy setting, all of the the policy settings in t ADMX Info: -- GP English name: *Restrict Internet communication* -- GP name: *InternetManagement_RestrictCommunication_2* -- GP path: *System\Internet Communication Management* +- GP English name: *Turn off Internet File Association service* +- GP name: *ShellNoUseInternetOpenWith_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* - GP ADMX file name: *ICM.admx* @@ -1263,7 +1264,7 @@ ADMX Info:
    -**ADMX_ICM/InternetManagement_RestrictCommunication_2** +**ADMX_ICM/ShellNoUseInternetOpenWith_2**
    @@ -1306,13 +1307,14 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to use the Microsoft Web service for finding an application to open a file with an unhandled file association. -If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. +When a user opens a file that has an extension that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Web service to find an application. -If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. +If you enable this policy setting, the link and the dialog for using the Web service to open an unhandled file association are removed. + +If you disable or do not configure this policy setting, the user is allowed to use the Web service. -If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). @@ -1323,9 +1325,9 @@ If you do not configure this policy setting, all of the the policy settings in t ADMX Info: -- GP English name: *Restrict Internet communication* -- GP name: *InternetManagement_RestrictCommunication_2* -- GP path: *System\Internet Communication Management* +- GP English name: *Turn off Internet File Association service* +- GP name: *ShellNoUseInternetOpenWith_2* +- GP path: *System\Internet Communication Management\Internet Communication settings* - GP ADMX file name: *ICM.admx* @@ -1333,7 +1335,7 @@ ADMX Info:
    -**ADMX_ICM/InternetManagement_RestrictCommunication_2** +**ADMX_ICM/ShellNoUseStoreOpenWith_1**
    @@ -1370,19 +1372,20 @@ ADMX Info: [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] -> * Device +> * User
    -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to use the Store service for finding an application to open a file with an unhandled file type or protocol association. -If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. +When a user opens a file type or protocol that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Store service to find an application. -If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. +If you enable this policy setting, the "Look for an app in the Store" item in the Open With dialog is removed. + +If you disable or do not configure this policy setting, the user is allowed to use the Store service and the Store item is available in the Open With dialog. -If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). @@ -1393,9 +1396,9 @@ If you do not configure this policy setting, all of the the policy settings in t ADMX Info: -- GP English name: *Restrict Internet communication* -- GP name: *InternetManagement_RestrictCommunication_2* -- GP path: *System\Internet Communication Management* +- GP English name: *Turn off access to the Store* +- GP name: *ShellNoUseStoreOpenWith_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* - GP ADMX file name: *ICM.admx* @@ -1403,7 +1406,7 @@ ADMX Info:
    -**ADMX_ICM/InternetManagement_RestrictCommunication_2** +**ADMX_ICM/ShellNoUseStoreOpenWith_2**
    @@ -1446,13 +1449,14 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether to use the Store service for finding an application to open a file with an unhandled file type or protocol association. -If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. +When a user opens a file type or protocol that is not associated with any applications on the computer, the user is given the choice to select a local application or use the Store service to find an application. -If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. +If you enable this policy setting, the "Look for an app in the Store" item in the Open With dialog is removed. + +If you disable or do not configure this policy setting, the user is allowed to use the Store service and the Store item is available in the Open With dialog. -If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). @@ -1463,9 +1467,9 @@ If you do not configure this policy setting, all of the the policy settings in t ADMX Info: -- GP English name: *Restrict Internet communication* -- GP name: *InternetManagement_RestrictCommunication_2* -- GP path: *System\Internet Communication Management* +- GP English name: *Turn off access to the Store* +- GP name: *ShellNoUseStoreOpenWith_2* +- GP path: *System\Internet Communication Management\Internet Communication settings* - GP ADMX file name: *ICM.admx* @@ -1473,7 +1477,147 @@ ADMX Info:
    -**ADMX_ICM/InternetManagement_RestrictCommunication_2** +**ADMX_ICM/ShellPreventWPWDownload_1** + + +
    + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows should download a list of providers for the web publishing and online ordering wizards. These wizards allow users to select from a list of companies that provide services such as online storage and photographic printing. By default, Windows displays providers downloaded from a Windows website in addition to providers specified in the registry. + +If you enable this policy setting, Windows does not download providers, and only the service providers that are cached in the local registry are displayed. + +If you disable or do not configure this policy setting, a list of providers are downloaded when the user uses the web publishing or online ordering wizards. + +See the documentation for the web publishing and online ordering wizards for more information, including details on specifying service providers in the registry. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Internet download for Web publishing and online ordering wizards* +- GP name: *ShellPreventWPWDownload_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/ShellRemoveOrderPrints_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the "Order Prints Online" task is available from Picture Tasks in Windows folders. + +The Order Prints Online Wizard is used to download a list of providers and allow users to order prints online. If you enable this policy setting, the task "Order Prints Online" is removed from Picture Tasks in File Explorer folders. + +If you disable or do not configure this policy setting, the task is displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the "Order Prints" picture task* +- GP name: *ShellRemoveOrderPrints_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/ShellRemoveOrderPrints_2** @@ -1516,13 +1660,14 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows can access the Internet to accomplish tasks that require Internet resources. +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the "Order Prints Online" task is available from Picture Tasks in Windows folders. -If you enable this setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features cannot access the Internet. +The Order Prints Online Wizard is used to download a list of providers and allow users to order prints online. -If you disable this policy setting, all of the the policy settings listed in the "Internet Communication settings" section are set such that their respective features can access the Internet. +If you enable this policy setting, the task "Order Prints Online" is removed from Picture Tasks in File Explorer folders. + +If you disable or do not configure this policy setting, the task is displayed. -If you do not configure this policy setting, all of the the policy settings in the "Internet Communication settings" section are set to not configured. > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). @@ -1533,9 +1678,297 @@ If you do not configure this policy setting, all of the the policy settings in t ADMX Info: -- GP English name: *Restrict Internet communication* -- GP name: *InternetManagement_RestrictCommunication_2* -- GP path: *System\Internet Communication Management* +- GP English name: *Turn off the "Order Prints" picture task* +- GP name: *ShellRemoveOrderPrints_2* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/ShellRemovePublishToWeb_1** + + +
    + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the tasks "Publish this file to the Web," "Publish this folder to the Web," and "Publish the selected items to the Web" are available from File and Folder Tasks in Windows folders. + +The Web Publishing Wizard is used to download a list of providers and allow users to publish content to the web. + +If you enable this policy setting, these tasks are removed from the File and Folder tasks in Windows folders. If you disable or do not configure this policy setting, the tasks are shown. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the "Publish to Web" task for files and folders* +- GP name: *ShellRemovePublishToWeb_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/ShellRemovePublishToWeb_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the tasks "Publish this file to the Web," "Publish this folder to the Web," and "Publish the selected items to the Web" are available from File and Folder Tasks in Windows folders. + +The Web Publishing Wizard is used to download a list of providers and allow users to publish content to the web. + +If you enable this policy setting, these tasks are removed from the File and Folder tasks in Windows folders. + +If you disable or do not configure this policy setting, the tasks are shown. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the "Publish to Web" task for files and folders* +- GP name: *ShellRemovePublishToWeb_2* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/WinMSG_NoInstrumentation_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows Messenger collects anonymous information about how Windows Messenger software and service is used. + +With the Customer Experience Improvement program, users can allow Microsoft to collect anonymous information about how the product is used. + +This information is used to improve the product in future releases. + +If you enable this policy setting, Windows Messenger does not collect usage information, and the user settings to enable the collection of usage information are not shown. + +If you disable this policy setting, Windows Messenger collects anonymous usage information, and the setting is not shown. If you do not configure this policy setting, users have the choice to opt in and allow information to be collected. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the Windows Messenger Customer Experience Improvement Program* +- GP name: *WinMSG_NoInstrumentation_1* +- GP path: *System\Internet Communication Management\Internet Communication settings* +- GP ADMX file name: *ICM.admx* + + + +
    + + +**ADMX_ICM/WinMSG_NoInstrumentation_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Windows EditionSupported?
    Homecross mark
    Procross mark
    Businesscross mark
    Enterprisecheck mark
    Educationcross mark
    + + +
    + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Windows Messenger collects anonymous information about how Windows Messenger software and service is used. + +With the Customer Experience Improvement program, users can allow Microsoft to collect anonymous information about how the product is used. + +This information is used to improve the product in future releases. + +If you enable this policy setting, Windows Messenger does not collect usage information, and the user settings to enable the collection of usage information are not shown. + +If you disable this policy setting, Windows Messenger collects anonymous usage information, and the setting is not shown. + +If you do not configure this policy setting, users have the choice to opt in and allow information to be collected. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off the Windows Messenger Customer Experience Improvement Program* +- GP name: *WinMSG_NoInstrumentation_2* +- GP path: *System\Internet Communication Management\Internet Communication settings* - GP ADMX file name: *ICM.admx* From fcbe8c29cad3bb7dcb615c3313ba6ca0c0b8a194 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 17 Dec 2020 16:03:13 -0800 Subject: [PATCH 081/825] Fixed build warnings --- .../mdm/policies-in-policy-csp-admx-backed.md | 2 +- .../mdm/policy-configuration-service-provider.md | 2 +- windows/client-management/mdm/policy-csp-admx-icm.md | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index fc369bf835..0d38a8664a 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -322,7 +322,7 @@ ms.date: 10/08/2020 - [ADMX_ICM/EventViewer_DisableLinks](./policy-csp-admx-icm.md#admx-icm-eventviewer-disablelinks) - [ADMX_ICM/HSS_HeadlinesPolicy](./policy-csp-admx-icm.md#admx-icm-hss-headlinespolicy) - [ADMX_ICM/HSS_KBSearchPolicy](./policy-csp-admx-icm.md#admx-icm-hss-kbsearchpolicy) -- [ADMX_ICM/InternetManagement_RestrictCommunication_1](./policy-csp-admx-icm.md#admx-icm-internetmanagement_restrictcommunication_1) +- [ADMX_ICM/InternetManagement_RestrictCommunication_1](./policy-csp-admx-icm.md#admx-icm-internetmanagement-restrictcommunication-1) - [ADMX_ICM/InternetManagement_RestrictCommunication_2](./policy-csp-admx-icm.md#admx-icm-internetmanagement-restrictcommunication-2) - [ADMX_ICM/NC_ExitOnISP](./policy-csp-admx-icm.md#admx-icm-nc-exitonisp) - [ADMX_ICM/NC_NoRegistration](./policy-csp-admx-icm.md#admx-icm-nc-noregistration) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 13cc28a89d..addca8a9df 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1250,7 +1250,7 @@ The following diagram shows the Policy configuration service provider in tree fo ADMX_ICM/HSS_KBSearchPolicy
    - ADMX_ICM/InternetManagement_RestrictCommunication_1 + ADMX_ICM/InternetManagement_RestrictCommunication_1
    ADMX_ICM/InternetManagement_RestrictCommunication_2 diff --git a/windows/client-management/mdm/policy-csp-admx-icm.md b/windows/client-management/mdm/policy-csp-admx-icm.md index fa79b7acc9..9c053a6a02 100644 --- a/windows/client-management/mdm/policy-csp-admx-icm.md +++ b/windows/client-management/mdm/policy-csp-admx-icm.md @@ -47,7 +47,7 @@ manager: dansimp ADMX_ICM/HSS_KBSearchPolicy
    - ADMX_ICM/InternetManagement_RestrictCommunication_1 + ADMX_ICM/InternetManagement_RestrictCommunication_1
    ADMX_ICM/InternetManagement_RestrictCommunication_2 @@ -762,7 +762,7 @@ ADMX Info:
    -**ADMX_ICM/InternetManagement_RestrictCommunication_2** +**ADMX_ICM/InternetManagement_RestrictCommunication_2** @@ -1092,7 +1092,7 @@ ADMX Info: Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to remove access to Windows Update. -If you enable this policy setting, all Windows Update features are removed. This includes blocking access to the Windows Update website at http://windowsupdate.microsoft.com, from the Windows Update hyperlink on the Start menu, and also on the Tools menu in Internet Explorer. Windows automatic updating is also disabled; you will neither be notified about nor will you receive critical updates from Windows Update. This policy setting also prevents Device Manager from automatically installing driver updates from the Windows Update website. +If you enable this policy setting, all Windows Update features are removed. This includes blocking access to the Windows Update website at https://windowsupdate.microsoft.com, from the Windows Update hyperlink on the Start menu, and also on the Tools menu in Internet Explorer. Windows automatic updating is also disabled; you will neither be notified about nor will you receive critical updates from Windows Update. This policy setting also prevents Device Manager from automatically installing driver updates from the Windows Update website. If you disable or do not configure this policy setting, users can access the Windows Update website and enable automatic updating to receive notifications and critical updates from Windows Update. From f50c27aad401fbce2471f2a965f73867bab99253 Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Thu, 17 Dec 2020 17:28:47 -0800 Subject: [PATCH 082/825] added pic --- .../images/tvm-exception-cancel-global-400.png | Bin 12719 -> 0 bytes .../images/tvm-exception-cancel.png | Bin 0 -> 8640 bytes .../images/tvm-exception-cancellation.png | Bin 24105 -> 0 bytes 3 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancel-global-400.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancel.png delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancellation.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancel-global-400.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-exception-cancel-global-400.png deleted file mode 100644 index 31e2ed052f1f255195283b75a1611f115981af4a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 12719 zcmd73Ra9F~*f)w6x8hE5m*Nnt#oda#Q`}vP6$?^*C;_e|!QHP8HHzG|u~;9ycn!< zATRa+Z*t69YN;hzj3pH@GhK`&nf!xG7zSJG^Xw%bVG5R~C zeS`Lxx~Fw%!x9TBP9`e6@N_*thx@zf$`Pf9zbDg@OcakWg$f;)G&afNjwy1>#ckxK zG7cqkZ)aZo?A*;Q(B#j3IU!!_8R|eexlq_z1ajYd*LJ>D-T_`u8fJK-RCT1N#ED%& ze|@3rTphlrb7x$cORf_x8y$Z2G{^a&0JO8kF7y)xq9-2%`6-~hi1Y37LoU>h9C_|^no%p%9adT5syFb z-1pXHz9a{UjPJwLU%Gb3v-DwmlN_PJC}dyIu@q0Xs`Qq1Nr>iaBoN|OxrPjTGs<}d^700K0levOYE-THc zc8g{Vc#`MRAMOo1d}}-J`myHPKXEvQn(_ziY{lC4MWQalOrPs*C=r(-dEiX0+-s(@ zwFZW>0d+NS=_8-fmM9|T#!wQaEj%bkia^weaFnS++s*X+tqBGalGNVRa?xXH&Pb1V zi)Z%>O}_I(kU(duS-VeIqBu>%oYRre&87I#9uTWO=w09YFOP#toTlx%`SbM|NT^uK z4OW8!pE-=0E96}yBgL0BUG-{>N|Wk3pzSJ>FLw;Jbc4kI>ZIv_p5`8sHa_?uuKKo0D~}Ethsyas0DK5b+kNG zdi*#!IxJ=Kd+IAzbOzq%szAD@8Xgd7EdVTVIfwD*Sk@ zQ=a>2JPf{?!j7uzM?NgJ^O$wEJzW69(#i`1^rl2_P4w$-$9oZxcgD4fy|)$Y++S39 zx+^~Tt~l=Q_MyG910`PCbnCR`ph;)WD9qJQ69s}Q1+T+WHZ6p6${FnA3_t*V*yHL) z?#X!*vBw>--@1nu1X!+nFNi3byvbP}`dI5L;k^2r%l&3J$|Oy^gq~=m7k5m?-i+*^ z2&Uo|m$(58u)NShBauaaN8m9e)=xkTjGM7A^G3qDA>?|qH^|64hsCKD9%uJHGI+8; z!njPMklRVG-Z$Xo8n=zVJ1Wk^W02VMX4(E2dV-Mb)8ODtgxyFlS`$AiCm+fDq+$I&rIFv%^$@yYRO?HzdD*N2p6`Jq3 zj0suP-IEG+C75Y;{9x&$jaGx0&+1hH345N_tH0+OZ8<%Ow@3!8_w$j*pIGHD^ z)9n+T42fVu%>ZbR^gC~Ko8~hTCtQVk-j8x#Eyx^9*Dh-@S)sA?$uPYviTDh{VA#_FW--WdB}@;wnUHNyb(9qe(a4jIV)GgUE_^voNS% z0s$;W{U^n_G3Y$l$-ymz%TTslZl3f*S`!dG3}*xHe9ao_2pPhGf&W$po?SW4+lVI> zFff|02d^Bt!pF%Z0cpcvQY+6sRMMj~0AYUgxQ055hRyflpKf`GJQbg+ zGo9p`Q{EMZR@Gv%vuwGXuC(m-^}H13g+3exQqhrw1oo6oeUUW4^lDmW9;newbo2Y5VmX8``~3BMR+o4>aisb#t)2x{HwWe<|cq)LCTzX+clr*14{a zw(Jfl(Jzu!sx)e;TDu&U8Ut}t*&CCE>d1&n3Da+L;(rs6xfqVd!EN`7WVP+-7?!qZ z)5nyge@m@mIg{_xniPU&ZS-RFY-+?AvXWXGn<@_b)IM!|R$@^Z;QLrnbCG>D$#}mn zRS0~-%)1tMdsSG>6?S_U7ItUpLjmXr>$%Q+db*rGLh;ZpF>LpCtlTcJz7=mD2c12a z?_Roh-#<8=zQ!!n?cUFP4AWQW=O5~mT!vtDy<{X&9E$fX(`i0GTzf4(E1^d0|5=jF zVE?qUuo_xlYgMNd`p`A2QKtT^he^U&VakP$ko>Zpz>~^S7&s?L?|Z;VKqYA#?d2|J zpXX6_Q8~?=-`9OZ}khN8S-I5r<7_;w1PkqoU2-C6C;c^>n2* z3!ZYSo8IJIGT^Ga-iN^BN~LGN-Pd%s25MT{sZss@9(EJ< z@@=cBO!CbAdI%DY!iskfLv0#ElEI4NF*A~_1)y1km5yZ;4|_~Uo4i;aFK|6LPt|C? za}^V?>(sn(_SY+Dv>lhX2h|$)sBfsS>6dLc{QG)p=STfRHIvg&d2wrke>ySqf|x_U zYUw;!163WwT@z5J&HpX(JHD>885Qb5u3LBN?Rt=K)r+n_J3}q+jTa|R=ogM=S<(xX zsQw;{zF@inxBT#gb(RVT_Es3kiUs%=;T^R0H~&O{Bu7Bv2uYeYzH> z{hnp~mH2O+{cOk^L#QCCS+l2Sc_TkSD|NliSe$QvR+PT&l5HPZ^L~$1o-iE>0TE;9RE@y*o5P}B%~VLxIfdMG zl`{@bUdw|I;5I(@rJZH*!1HUwY>$zS@i@~n>N~&5!i~}6v832rH5)vEvO5xX27#h= za@o1RGCX9P44gmAJlx7L%k#n!YJc*?08<(uLryAbdhaqeAEDjzGX{%2ujTgx8=ODUtHD|6&8y(g3r4YW>BSfF;N)TGKk64RVIn=4%(Z}`DU#J zJ(YMw*zpNw&p#CP5ReS%8w7gwKxTith~GaYY{Ec1e8NeBr0T6T@lb+ z>9~U*N&vZ_XNf#rN!U17&$lfG`Og8?=NT~hR*VhjbCZ6$-|2+iU7u$gOY@*c_aeOX zcAQG!g-fS@Qh@H!GD)UFX)d%C!ehQdsMzt&S%d=1= zkn(6NBoo@kZ-D*4mHdVWJuE9Q%|?2Lz{rK?F_R1~HiUD_n=J}0YKPNKj`;O?xNyCd1jAaz{R zbVWmOrdMn1s8SI8atEPu`DBk0vKNOuodAgw5Oo8$w|v$tmiOVJMJE7fuOXX8ns;PM zH2pa{35~sa-9!#4%p33ZtZ}%Y$r0?BlH-|fW8G!DpL7eYP6hf^pidmv-)2~ox0}o(CVtbt#NBnJ-Gw*j{O=(!gt-^{2U7y+abR{MH~o(ZQjh-O%c7tZ^fzQ^ zqpJRdTd;AS#R%I1)c%{m4M|vf!csQQr|#exQ+ewoz#Z(fjYeZq_$C5if~cP@s&Dob z6NiF?l}xwIph{0dg(EUnSr#ifGFyn_@JEeVi&4GIyE@IEk$NH;N-XLZnA}*TZ;#=l*Y#001YsYu7>OQUCTWQ=y)#uvC^C9twUbYTS6 z)C^;qUblaqcSb4sTI;Nt2qG?0T+fH`=DUShUd43AzsJivFzdSq2VzY@$o{aHBiOUp`(PTV1K;&Tt#e#CNtuk5`~&aZm5-FYsXyzrsF49`9B}*ihs_ z?o^^t%hYTg=MT4n2JWFEe1DYqI<>IrfP7x$0Ed;UoHl5kNAZx6UcY;fh*Kub!fJ~X zk3=A#vMD<|rBBGN{`%}W2b=o6?4U41e`KFR@s|Ch*f-|htgj~s>d!Hht~0J??YV`4 z59Dk{HQDNs;hwhRhjhO3bcx;eh-i}vK{OO3-K#jUYVG8Gq3z5O_NrNp3M@8lo~Q!s z&%MEbcv2qb!FW__hjh}R4-$!!_qX~}Uzup53fLL-ynx6PVldRmth<$-z{)sHM6wc_ z@RbDR!T5~kw81YgM>wf6t_B^xNxr0rTLE9U2mc|avr~IVTv+Y%WYhXcKG|uC|Nf*J zVG+o5U#YpJdTPF3%wROn#wH`l&rmVqI84N4#JHj+ZF}H*IVomF=;U3$Rf3C*wu7zk z#Y1EL=l0s%9|lflby*Q+tB4fYJP;<*ah#J;`&P5h4Usihst1WwF6QMhjrxj&lhK*c zgK!i5K5Bpn%!({@3Z3UmtF(Xu(f;k_OJ+wV2>8Zb9Y+q)`qQ0`9gHc1p9%GL7B3)anUk%cX2ql5|Ty zXB;%yD}NTTvZU{WjW{zE$lP-d>8O)*3Nw@5iA}X~hiVVpoUZQt(>F^EI_p*`Q!S{0 zW;Uu`^@n(!)fhH4<2Fs5a7q<7G&^`jfLAzF>CmYhg!h!H%1K`*^6r*h0 z6XzumMW;GoSg>kQ^A&OD;$oO)9)nkvnkBzT?)xc;D((-?_XFPq&RL|M@4gASSLFJ9 zUYxBv*NJv!pqrR*m@9Go3kO-KrPi@Gb3a~e=Njd_$c0Y$L&!y_$`oSkJ)@R){_I@~ zo9UzVssuM}fJ0+3IFS1&FUXyMEq(c7LRq_My1 zk}*X-BebmvXk2P}2z2pJAzWqH+t~2lbA75p(SkD&_ptFC+~aD!I$eUtgJR(OlkQD` z>adjipE~#V&^!-3c2Zmn20YGB0Q%vIhJu~w7}vVa2a~0Oo!@95{&dHo?_$j*5;MKV zlJgaoL6xz}h#$FIEW+HA$BjcdVQ4hp_;C+KTP^-z%vag`^52aoUKuN)7jj!SnTI@| zqw>#t1jI~u2EKOrT~n=leTm6Z*pQPyr>bv*DHFfVBiQ(O-rW`o8Pa!ri8wa(){=Oh z^ay#p%DAXoL)qZ2S-@Lc4}Fvpt3FV)=zVDkdsgYF^X44r(y2r2ggl)|hIGZDZD{kV z5wm7}jK%%e2y)*-dd~F_QJ-=f~F$+QxeIo^Ajxc)Wx=Rxi|E zgON7|uxS8_QhPzW83lp3)4T8YDanqD%#z6^jC!!PC=2kUsA_hRR{ie%mi_ShFo*83py042{I_~M}XcPwI+JrvS73{j8hjRG0r>5J)bF{R* zdx7|%N9ro2*?GCYg_GuAziep#3`P4<)h03<<~jr@#awIL;;sHNFz~Q0(HzX}wYWuf z7CV+m_Ff__^N_1`tq8f5*XKwV^nA0SlCZa^bi7bo@<<()0xb)z-XHw1&I_kVA?lvn zThszYsmxRjDx7MHodJF5iPlOVse?xjbjpmGCnHZ~RvZrrOC3W0D#Bqc(9e;Ph15NR z%P`F}I^lE=<72e*%n!@ve=&q@TQSEzm_o!^{OA<$ zAo!E2Yf^+w^`7@S*P|W_EWZ6nk2g)V1uN>0EyV-4_hc4kav2?L=u&J^Ff}BlByNhF z9sBik$QiZ4WIzvD3B4exF%m7-X)Xo_TbPkw|spO>lU+idnm9PJ#7qCMUb0?Ts)emgC?UL#6FunH0O^StUz!ah=l2u(CY zpypcpm9KxjPUW4~3^qu4L#QH()cGU_#lSr{dEvYa$$q0mXB(iv0I$|MF=Jfw-jX~l z9&EdfLy)+RV13Q}42&J^FwqClD8k~PFb$2=TCo-H%|n~{>;yh-uW_D zLC_BUj;#gkf=v+}tiHO(?hR`&Bhu%; z`zZOZb5`W@GJAHz8`<%J9ylWBu$DS0?xw;>S7RoeD3DMIo0ql<6b!i1G!b@LFM*~7 zZ9UIZU&q4v6t}RT1YfP#aR&9^^``(Mg%0o&U^;Y%-R2SHJ^c{am(;M)+x{J zdNr;31GnrPhe=xsoSQMp8b%hguJ_Fs3j{3gKQGi6s$90LOGp(^^RJwB+)C;v*Ck={ zEHcr{nVe(XVXYG%o?!KMpeIdk{kP8Y9IYS{}I6Y4k znUZ5%%XwJ{R)B@iGvTRD+KzH^+%RaHP!22YT7H)b`&CjsvCmg6g;k{cxQ9@ZS2V1D!C}@8;1P&~Ps{=WTU~^u3h019)?kah1TCCSEg|HYh6DFMQmn)rbRlrfUZ z{PTQH?CN!gv&ZAAAv&`^>D~u3um$!G5{-0N8UfT%t?R(IE*#t$++7iqH35Dq=}FJ7X!( zT_lFgdNF{NqK;Js8K30ix-N`c$K z4)_p9Bk)o0ek~=03;*fGQZQhBx{$=|d-4rarDOEwL!~eJpiMVPc7C(^uX9N@w3<#f z>Sqe!*MVpTHD2C2$RuxK-Z0y2^k6vg>jcZW7XB+U!qmC$;BDW-8GB}^gsK5&=l$sm zm7C11{!A$`+3I}zA0!isvsY(~!g5oGsbGDwV`seNiQPZgsVWIEWWg++mF1EH~lhlVqO1E z`!xU&U4b|>cp#T{;_60Y<_{yX~#Pp+E4>N;1<8Sw`gt%kO<{c^t{87yQCH=?9+3ynou9MnZ|1TG}|9?^2Q=Ntq$zwnNt>6aHQ^KtP z*bv1L!FdctxS~Zbh4Wu|WJECN=H%mkzMt7n`Tv*%$c5hgzu5w)viMTq8^2OxilGZS z{W^=YALbM>9#*1dNRbx)-?Gf!Dk*(E;Y)->aoB@kJ6Z&M@Awi4$N7j;;9`B%=|+z^ z?CE|w&1tKDgl0fQ@`O@MHx0I*1y}6}2?j*^sQ3}z9Z3V=5P~J>_AFxujV7f;F2P2> zR5{J4H2#w_B#dQ_DJN)}hE38ozRrzSKoLgD&KPjHmlO{-FR;W|v(usBQl)@9{Knzx zZt2p-D|bK^cgDXYiqUwddbLHdW@T3@uI>n=``^x~?L3`7j-A#+jWJ0%m{Bo_QUC!k z#j`abolvZ4jZ)ul9j=fyu2DD zD=_xZ>}E%OoTRpn&Tj9~KW%7+zV}9OE2majBBml-Wmc2MhM;(=qDC!jB~y#fVT|Mq zCE4oa3Td~wTM`o#;Zq{>C6l!OI%qG7X!IMzth{`>Y!5M;E?}pVOCS+MgokRvgEZw@ zEobBgm%2IHfc3pGb2Yln^vlOaXzx2E&se7Y(Nh$b#(}#}+rtaKrz=dWzg@olEmbKk z<1mNQD0G7=8QO^N`v2!u!|+$(ESfNgi~FWq4aVED(NSvSjYtjGXYuTvrgRY?ioQ16 z9D1l3R+@?RV2sui@z8mjyTJ8()Dj~gP5U$oJPtI&A-qV1K#M!a&Wn>2@y|Co5_1h< z@ii(Etgnt?WvZa+Dr^uaP1mP?*5#c2{%ZepTR=`{t?}_k&9VpG=Z@QsT93KOvltzd z2CHaHx6bEfu=`21e!ZmSeL2>xV6i4|RnP3r#5%h*$yvIDy4-_0n6WjqS=;sNQtP-51Dh>eO!O+TpU&DXB{kQ4 z)UP*dgwM#4bwaGg=bj!(Ru$6(F_vGS|0$CTelD4cK`NTGHz@(xjJ|z#Asebs_{L4= z{RyX_Nv*C{&%jlrJg)Ns%={h1p1t4W05JpIUJ7bg%1VN|^#~3H1B#QA);yGy0-8<_ zVS0bKeImaRdpBG|H_RpP?-(3cf7h=41tl0A&Xu;9gGX|ru}H>Bl)edgA~DPVr|yXU z$4|CelJ#(_w}+ps1!?NJtd=9C<*{TDX{e`l#MY&0gsm{+B^hzZ!S*wYrs~A1Q)-q& zrAfrJ*bI4bI<4Jw+9R#MCi|x;W3f9`Mji&XFzbX68P*J6^0FHeCR2oXH=*u^rEpE5@)B zDJ|h#Z2lUz)Z;K)>_DeH{2ou1O$j|Y;X(((A=cHiIjjpu8}L`qU_fV&l|BN z;?T~^ub#VOa-qz)>If{+^MjQ{-$k@wA_@)TE$X-b>S}d3?`Jq}pu{fV5KU%or3^j6 z1Vt?tn*H=iXc2a*6rM4Iz8)JR(8N?8a|dTgQ!=ONQ%B1bcZP=9_hv1#r@-RiD~M2~ zE}&l5S4&xbMq}gnpZ+e~o}o1xhc@MMzA1B5A}n4m6gc6q+#M2|7jm=Aj?fj@Rh8@k zT@RVUC>voZ3@*AgX*n{?X%&@vqJtYL(z}9g#^Cy#EnEp@*99cty*!#5wghH4gB#_B zfRy`G&z~!`ip$O@MXjO)T!S;@KQwIij_Pc#>DV01ywip&oG$mbr>hEjbw*68;TE5d z`8A}N1`|lL#xgjnr8^(b!~@rv{iLeF*HeI|$UVQA-U#+ck&9989D_62V!KJBM*j=? zfW7bbHsgDfIqPCsuLKM+)ruF`2d=pShm^#{Z<&-8`#zvDiGsqPAfWw{`3b^~C{g@GC(RV;(M#%tQo`#j`T_&1~oOQ z(AiS~Z9FlK(;^^13AA&gC`{t36g|=L%l&Q?HLVoB3Z-(zerbbC(q>{lM~rZ+|EyuGE1E=hcd|KEkaJyW4@JDsrT?;F+?dzjdbjy!H}PUm23( zHr7283c_;7t-AuR|Fe^55yZfgqEgF|;LZ@`s&ZDHDY%Ph769L^U5XqcX|tNUjzUo^ zhpND7?a&`rkD*Pz_BdzSGNJnQQ2;^Tu9}Si=}@y)<8tp$)?)SI^#-18MzH#~$QAP4zEBXEOoFuTo-s9NNtl|9NGKBj8I+ zh2k~zHDV%1RL8aJT8Nmls04>nSh3cqr3iOj!$oc)j*6r$Qz~GKA^_ZNzBl#n+18XX z5Kg|!y{=(TV{h#m+Mt3BWr_670!sIg+gt}?vW_Jfs5Hk)4S#+>4N>m|vVUUlxY9o~ z=i`NM96jbxOTxWgxIU9)E;75N59Z#CK4)d6^#~TNvS)c$8mk7jvO$x@7~NFCoTkSl zS&izvWQtIJ+i%{~%^$d`4GrKKHFbA9v-}tcj6TaUtM8`&7=t~_o&AYJe{4OZj|}}B zN2M>)F%{QJ2QYW~K5QM3?(+zy`F!b62HzxbNJiVp!$4cob)Dmacx^Jp``yiu|SWd0FQC&*qLdEAU%Tw z%CAqy3!bj0Uf0?5+!S#Vc$Ommykt_N*mD}-jH3drpA~UP(`-P(d5NG%`@@d+h!Grm zHU8}ooPiP1Ja5E4KLOF|U-H!8JhBpJFw4D(EK&ft(S4l}^qSD3T_f#!7%0PM*_kJE zDYQ?Np-|6VJk+LSr(3ND7H#WlbT%BCw`Eb!{xQ`JSMcT@9*#?u=F7Be92!Q}Cw{Kl zKmILkwP)3Qw0RS}}n% zt7%zcJdjr47M~!4`;*bb_ zJy7G+2j2#iPC1T#9>lVFAq{oR=MR6Gjiq(Ok~rBsDELVkpBdVRgnAA2*$VE-75kLQ zV@@N=?lmR#inK4%I-W?*uPduat1toUygVAqo-HoMEqHcX6SN*=CV7(qx2<@87jSG8 z^R%Gqn>NY;1T-c-c&4vCtjKQ-+V7ym;Jr>*?h&tP1D&fa_O6BZQsC6h9E0jZvX?f)*sN>N*=Ua?pq<8VsR*l zlf@noX%RVW`UP;VI{x#+rkb6yvp1*DZTe<(y3!{(&tvaA7UrPG-3^yY!=|$2SU53c%&uQm1NH|L zM`MvHE!LTuN>2TKO6N4xF2}=z)678|^yP)2?W*2TQ0Vgm1)s;-ilEbO*X?@71!VY8 zuq})k4?lv}m)~XOcCJFJ*g>|R$hQ5OyXOgZu%rTDH5bAf=WQe%es;5T>D;4G>N;dT zZIzmnD)aB`#UOCGBazr7BOrnON#wX`Nb2;I5)ljKN6(WA^Av!t@mLd~f<2rQ)F@;3 zrfn%7MczDl(c#n?&WQFV=CRO2&|n~3u7D})pgX`E8a-8;3?V%ER zN=`W0kkTgnQDQ2@Eo+``=RJrJJ0N3)@=FVxtC-y!hEE6qZQgFStw(}x;Vq5Yb5raj zB0~HD5f3=Tz2K7VCfS<~o=F-c9er_fkR3>f#eg^EkN7h+@`AEqvsjiM51VhR_|LgQ z65OwEo?IEO3HmA$2f)XBaYjYz_dV~2oA#-2%%q>*;$yv;Bp~?n<&2}~?f=sNVpRXD zjNEgvpR1DYws8_O)lfsYXOsaQJvy4oF^ym%;WQsHzAVy5*-m%=3*JO)46BGZ|BoV^ z54`__)$z~i-wO4Bd0+H{qx#-2z$4YLlLJrlKfR_USYVe+gaY@43&pYn^qUz1I`3tF2B(%tQbF9E^VOVc9T$RQ?I0$)D@-)XbJfvWxb?b&TV2 zAO$r-mQ4+^15)DLA$E>}+1-85)8e%pc^wp#MC0fE(>2KPsRJ{MB1wgOmT!@Adn;9Y znSIJaJFDvD+D1mpt>@Kd2CH|=tH*}%9^=x45$wWV`8Lc7l(=HRv^gqVJ?j5U>`QR% z+8TFnr3m*TPxS(ir;luAaJx4Sa#9M~n>VbZR$_14qXD)31HRuP>Dj zsov9jQM>jj`3weou)5*&@_K0B1VEBy4E3^{LR&=O@!t{A`&XxmvI8lMUY4_uJlxXe zEbRU)>y`mbCFKZ!a4W>8Fu+MyX>N4%_#@V5^yf~bDBv0p*zxP{#-_<>ArGO$*!x0f zDlGbe#2RLw7pA?O5 zv7%n*NHN%6u{tOz0ywn5QaFylLikTV0tQQqU$r<&32-hq?l;g^sNhLX9^f6W zE37=amvS`!a`dH6YEXzYxEDnC=rR5P^bx3&XZk3r2|u+L#}DYg)Ub~wv7koO+)~TY zvvjBUCl7J+)}u>066JB*Yj^(`HxvjINt;kRzB|r)K<_IN28w0W~Ur$9f&-^Y1 z>6Uqo*?nj?2zlq!U#QBZ8WBTbwF44z2{A%I(e{ohUSZO#Yw>jjJ?p@H>DK@T5aOuN zWO)v|j>X8bfWtHMR}RKRQnb_vXa2KSQt;qWAu0&$;3riMYnTi=`@k_FKI|ekp~Tbv zRGonWOs*bKZu)e~Z(z*>U1FWc64m^e3%K-~8i7^RVn_&{0 zQLIytD4fc5O$rPmhoe<$GzSJj1AQP{>+tLX41)m`dtZiWvg{936PY)j_a^3&If9}2lk; zYC7t2$=eYSL`(!w;4?Ikw9aUG7bxvkYe^2MSpAjKZ{Qh#xV}WkoEvur5VUGzGi3El z=iWyIkZjxRU4F;=>Rc{oU^JtF4JJoW^GZ|p5_ZG~jJ#0RNQt3tNX$MUErnPObghL+ zD-p5)NXenL`0KYEOv7f6So47)A0=#kw;|VR;;(Ko=OV@b<+T)vV4B#($=kI0i zX!|z6w+V-%cQ>$j*fQ5dQ^32)$ z$GexMY`v$X^@cyA14c*Je_RV=-z#>Xx}u}C=bZ+&INPO#0)4smeJO|w&X?(xe{Ya# z@_{}X@%4=>3p%7u;LzmQ(Tdn5wf^Y0!HrvXz8t4<491$uSG|HUL#{EgV$ZPFBM*j zkNHA%BH=|x+c3LcyL>p;(9Ggq+kx|>vFgI$V1dtpqNAOv;QilhQ_$HT*?(w|Z%0zB z+so}r81;E7LUpY1^-f^WFE0!YwAl3J9Qn;3qsWFIsPg)?Xg4vdi4(2SoHzIY4Rcu% zzYltJ3!OADc~ZA`so@ebc~oHMmC=o=A>cr|z6m0X-d<}dAIc_idV>bf=+lI|)I5_@ zVI`cB6q^b)wCURW@5;p1VXQZM6b<%m88qA=jL+DSQzuP&F0sZ>QYf(~>ge6l{;O?H zjn{Z{S_GMT+XB4uy8Sct#mHpm2)$=@nX!rVn6(|hO`O1tXGk&V1v!K=TVCD0n!CvmK2xcoKc@h7mG09o zp53G$2b1Y{&>QT%@V=$%Vxy~i$;%35JjA{UuZY74a>6^%)?-b6aAW_ScrcH$hs=6o z#Ubbd`9SRq7Xcw~Co?et}1o*~0)qqwr3i&Qo@D1BG@OhAq zQYkxRm;d;BSB~-rgPu5vd+j5ZM?I&7brAmD@a<7S=nY9*=!&~T&OWt#7q?1KZ z%MJ!g(?@pXAeEA+&erf>*r!Iy0;wpVRK0!Di57pKJpue7N;nffkTZ#0gfrrK9+#Z* z-OaxF3oj9PFCWDv?SvrTQ8I#cwz_y@6RPaVfo5>JC=sJX-m&~4Y_6*rN|M{;HOm;$ z_nW)~k_Uax$E4selQqpk1KQA2@utzvkT7E0l>K3;RH#W*MBJ;wCpsJqskT+s+i`q+ zo3^^5Zn=*k5)IHY-5hXg(+xY_F(BpNz!1||up?CVD@weQK_ z3f=&B$OYX)XbE(N>*u*Nn1dOiJZHVf+7iQDb@~s1#yaMsj_2r&Fx%pc_Qqk>Dsv+EcyQjSnvxm$G1>R|NG!-$rJpKNQHyp+ z#R;}^7{9);1cStzP77(QH#)Wg0P}u@eFam6NrI*mqHGPE14TsRoVUyM>t3tL#s*#l zWmY5rBF)Iz~3U0yz#i$jLRNd8j6^hpyqW*&f*CJfIVKNL-HW0 zx{JHw=tTGfY9s^AGU(ykJiU$)gPkBP0qq6;>m4HN(Oui;%$ZSD(}e|m;@MwC_WyQb zs;W!dTCGRp#1sOQG=1K#!?U@I*XaURnqp;B;^w78n&-s!Ho}A`>je52=zu)@{EYk` zA4zZC;Fj9w{dqKoifYuNDlA~5I7@|(zR4rcd_mF~+EnhKT zUSe_I?=P2&-`7<5hp&+gA>#s;GL>&xGPlN}h^Y-$`|h)?oCM8SwmB~= zaf$i371lTtpR$@HRd)Bg(Uu`}qW|M_d)K3EHDo*7*jRDxUFd@>Lw1zOL^%s4VYD~7 zak+RwW!aaH?9HKK5Y3vb!enNNHsCH%zs)2Uu_jTdTzZ@_+vBV>eNegrXQ2W}Sg!wr zzwFfFBx_a^;$%C?l^QKY9UoQraR`?>p8MkvH}z0yz7G4lPeeK%((%W8m(yZZ;%Jbs z078uJR6cU0tZ~!;)sJzxy+A#wpFbJ5*ln-Am}5Lu)X9BJj>;+m3+P^)Ekd6x$DG%< zg)bKzb4`(0YfAGPgwQo~$go+}y(}ITdh?ReLGIEIN|d@W#OCwWQB#^x@r3Bq?`sx{*uW}kXp2{Pc=*nL=W|MGoO0!iE&C2k(?|Z@WKd>w-vs(X6`}=`)CXO< zy@nbDIFn-4A(kIFS?OWsR(IZ;lCigF&(}*4$PJ}lg)_2Ukp`9FB`jqHpk{F*Wt)-> zL1Xe4?l@`?6;dLDP^r3)hEe*~yoM>yfz=Dl-Y`hBy^!VMmfrfSL1mq;MBtoF2zZtKGt0WKsYi!p4x^G#zB`X)2wwSc-Xh|? zEie=e@si4NcY4@6f#)Al0e_^vrBxtFpJ(!b?-=B~MhCkh9LZU*C@Db=EL(p6_5p`?T9!*kd10zao_)0M71Ajz9~w*BIt~sbL$+Hh$?7BCea;$@I{X zlGe{lmgP;vax6vLy{yZ>`n3amXN;TUiiJ5I=G^`19aTwB5Qp~fb}4`IeH(4f4v~PZ z1g@OzeSIN4;{1F(dbK_Co>_U|uM(<%oik4;c1c?Bms-`~nP*P4&%vn@sXVuDZ#b3T zWF+|fB;iECAXpj9$^>7hNFhrsU@K3glWi0b67{U8F=>&f6GWU4y;_Tqbf0F{kFo$g zl7C9Tek~Ca>>xR_l0blJbQ}UasmY(Ww74^kaL&dEmc;fBBG)`SN1a4)M;J$nar67? zj34nSDn9rzqrZySBG~`Krk4GG5+jVKmB#;q7ZoY{>~U>t=6IvxusWby*W82=41!5w zLcZMyn;sAX`QJ1Mfde~i;>=T_?Aro_o@$8>tVwa28oG2RdW^3Ju!0cE!dc2+E4C?d zJz9Rv&JxV}V9l*qLcjp0;{E-7fhsXvMRU2c^K*`@k?vCvcs!AnE-^>RZ+nz6>6zi3 z=NJ=sTu4>8NrnbjOkC9V`agO%KsV2>dWsVP73K?s450l11uDxaLlHU)D$U^X=RZcd-X;WlCqbpSUt z(L;pRk-$AF1YS|{BuT%~ithR`@1k*__MeSXF#)YWw?sS~$?ziZ>BC>-Vc0+z;#m|a zO+~J*t{y%HJ>!OWv>P{}<>*t+$2JdH4B1hasHYB8=#@|=_OG=HKaf9(mN}M#WVW{O zMv|ov!fa@N;6IjHa?j30iI0(Cq6LD;B?P&O?hN_dD{mi;CbHfxAN~%W!8NzqCXcpgc5z{5ua>L-M)$ycR#lL03L>k2Fn;sJZS-%qI`q!#OJC~t4b}jU zIeQQ>3oJAiJ_8&;9ba(?-eriPT-WY=zI3-`CE@vX#$7PU2d|tL(p(!N8<=0uHEoYP z7D>TF_5Y)Q%=<919gG*D@9;umm_V3R=aVfoy`y9V>2r}*vgM0A0lMWVjxTwm@`631 zNACHKW(V-xN-KhySIqz6ZdFRB;EYReprJ?S$##Me5`GAi+eT~MGl;(W$;rqqv>J`S zB)uZlHNn>V$xJS$HiNw6Zr;}a)a*-7O?ArpVyeS;O?sy2Gh}Ge{nMg%1;)>|SZ~&j z3=ihbc10|vB0{~Ybxo{C5@UM1-UL0ey;uH9Q(ac0zL(rsk?~dECsY<={`1!U7iRN6 z&81%{J_huzeE7n^*l=lKb9!Yt$vR}17z*V6i(hblF@$x|s`YWV{>zaM%2R3|{fvG! z=tssM4k^Pitobd6OiMmKA}g179{FuT(XxDfVI{HXt~?JA7}4mDX^PBly7jx__6XQ!sMX!|ZPz{qCCmB=Od=zb&iFxF$%%Msj* z8d!f1K)Nv{-rp#Sw2t>zA&+ew1BE-pVBlEphHq5*RebyJ3}Q{E;thT$JMBC5Dz$gu z6<}tZoX?sICg)-_?b^E!i6`O>VqTCm+ud9xT}@0xJb9qX)}_q;oLUvOLo%&?9L-eI zG?{w0ST)1u-rKW>@6sb&lfBE9x4`?Q9RndRBh$L>y(XD=XKiRI*UE&xLC$PoT(IgfJ})neoWedf4}N%rogZAfox{T|KJEOqSPHgn0&?Km?Nr(BZdW+Y&B=Q2OP#re4h;ySJV z!zIq0#L=l9y#A7mf^F?|k}vt2da|eb-{DvaFz7=V*LPR$L!Hw-y!ulbJd%R7`g+Vr z{#;wvoCBMCj=B8@`EDyK-TrE$!7)2lTVHN>8rne@eZl4UEWD{imcVM zWvm)j-^K^;d%`VI$!gN$7wFk!&yHk_FW+;Kwci=N`?trKJ7qZM;j=|+Csziao9#Q! z;b!@NPH-g@?{}+-ZG+;bI61!wIM1-!9OWEh{}AUl z8~4V7xrKeBK6Dx1&H4T+v8njv{E?J)N2=e!xxbYan|$!qQ-qy(8w{3ryxO@snL0kM zy|TPKCXqw>4>~?RM*aEhsk#mX!KCUshI{Y#)2&ij2ioondMBlg)=FIACrWuQz@*=RKs%-oW(G9iB|xesO1jc=XbqFSkyiqVpPCivitFLYgb^ z`A$#qV~X#90{P{*+->~MLbQ+5`?_#N~3!AQ>G^SLJ0IIOzzI;-lI|K5lX_!yVOFzr8#J0r z*DHU|ohY($0f%}ik@{H%Gf=bzP{WTHBlWJek&d&$q=@`P0~+4<>-=-+hfdv}f+U$p zwl|m~E96f1h1XgcseITJjhN;>6((uT{4p&}DY1Ud{eZByQ#BikG#fn~EMc&UE!$RG zTFCE7lv)4ST}%-+ZKVR-no!oT<(mA>e7NaZys*#5 zoDwkd%fIABEz%pLKt-cgy2`k{o&O>dUQ%3P@7Tclf`4C4^cS zmr_xox~1a^5{Imy)HH=MF>EXTEJtmp`W@xZ*X1`Vg8)GJB-o1g_dnq}!?f^|Lv?ZS zmtw^7%!4rIP>HhNg7B0Sp1+}r55DzQbiBW_I}B=`()@OPR5?;6;*ay|uEp3iMf<)n z%S8KEv#LSN>I4-HZ{;w8!+h}t{*}_vS24-Po!=DiBIuy(e3~j+S~R&czg3AtO8tD! zC?~VCR|kvQ(_M8Fr=t`N^s=$#jVqmFIK5*}k{^6c5{15;Lbk6Q6Rsaho$15=e(h60 zxjnd!F%E4(Hx6sA)(ex5uTSrFNk6#a5;iTOm3OeyhK=r&e)>F`Ie(MV>T_5T8FwG- zFm{1H#gi-yT2@_Kvb6R59onUTPIR-D6X|b_ItGgisB1gw6bGZ~MQ?LbbuFyIO^hnZ zViuA=TQmjrhA)jjEdj>d&t2aAA`p;*R{AFg1F zM(cuFvHv4p7!2%pPo2zmng0 zY`<0%nC+UL+TxWVw@Jk0{;kijfyzoUa*0LgGSK-Ay(q<`ZRM{;cMAWd$P!M2L~pNZ zwgjn_nDbh-@CX!nSevkK$7Di5z+(ABCdG7lN3Iae)Qnj66;6{i*G%5*w!jF9)ncU6 ze!`pD-#mxrQ1q}mUq9MK{B*sR-^5Ls zSl{6}_To%&-FqU8%fm*@$$%)i8FVTpEmxV%Ce(GIXWgA<(Q;2U2@JIdKK-0{9uECg zE5T>0sztM6Y9t9}9`vMl==wQvUTHY8z0u$P3SVCBM-|qHXsA7zB4N5!Uax3&Xi<4!_bPT5LkY<76J;cRqxoGb~&;IuGb!Rc{ zd2KXkA$+m*gRewp`(d-aT|q#7IdQ3+=w98so;+uP@Gj(AE|!_a#gU+(AdjoFcV}m3 zYgf@E=ffAXb*d&Ni~}hwiDI?`QEc>F32F|nxZDnzlxE|g-V@7zIc{`G(~B*2%;khL z#~eH!O6P}%i^|L4f%<3>!}@{GMwanEeuyVAJtH2n`%xi6UEJ(J-519j+4OlN-7Q-$ zzdS~mYrKW|6=h#Pdt}o9qw!n(U3^+K4tyI88@T#lwJ9MLTdO~!g}T2N5lFso84G@a zraD_FE7sLLkfONPPkx1FCyIccfRVvISrNj8m{v5zf&x#Z&t_@lboyk4tN+zr4*7I}d&T&q<1px>E;n6{|DYChgvHW@>PY z2A(+uQ|`$J<|!GuL=r_jmP--?k2j`O9#vntN9~!+rJsS?>0th#6ulC)_~_S{pXRW* zJ#iJI#4;$$kah_LjQb*GDSe+vs&s{&LPI-wd~p>i6(h#e_6Dl%C0=ZRWc5#ga77TS zx^NcEjunT4@T-4?F1_`A{X1GXGZ9(_VEw1_);Kk6GiW6_DwRF%@o09)G$BQUCgcG~ z!urm3BPmZ5!H%yinr?C+Rq&FOP~b>IEQLMpRbF~2&rBjf?c>{rSJG1lQUMexd9eNo e9G>obf^nB$2yPk#f=5Am z1+=*HPJaRZAv;OyxPn0Feb0YziHzvPKqI1?jDiH>1`6q`x1^FkjEnwhlF)V&ad)$F zbODuCjz|MduibzqadTI&i?x%RwW9+F8<~O%Xh(T&7jty-cCog!as!oPjPL=i=>N33 zn43Ized}gzZw}(T!axR&AU_{bbF^^tG;uKp88|&XcSrr_;?}NUI}@O*3#hTHE)Hl$ zdT!P-adEJAump7xZ-oJEi2pj@-34q8x_AnP{aZINM|*p72RG2=NKz-z_UgHty0x2~ zIjH3DHysG{79=AsqVAQkzZBp_V&2aE=$YU%rh+*E^)nH3sq7j1b4F6#8pUPbAgxnF zhIH`iy+SRr-F%OVGI3W!7v{GmVT?IEYiKxJHaBtcU;y~DdLz*BckK+ zU%KGl`B%^jsybx}S$J4lcyj%r_MESSbXGFXCXOt-jtgAfUylf||51Vi;fjlkbC?%{ z0-{>Rq>n@1Y;|^tKw}slgZSYTU-;n+$)ASdyJG(j_Uj3y zc%E+;-I&w?w+NT9@@=xu-;ieEBmD4-m*+_BDKOxA$~)yOm+*}?D&*Q|M49U6JhiFD$8Nse#5S%RiO%I z0G=#ei1glFQdof%9)^ne3^|4>?V#)wW&6}|W%lf9MSVC> z;tepgJ0%1+xc)KC*NfE4<(zlDk5b2fSNX3yk4Afh{Qnx!Vk*P6oxaYJ&IqN^8CQ;b zdozjNwxt`1IzHCf5)=ggJc4|Y2ro52*S(KnC&%5cP8S;SNF|ej|IFbRpo^f|^PGnM z7v}Uoob3P81ApmXO;fK=Q}p4AO#f8z%CE^8l188*6IJ+F`b3jIf!%M`_=Uv17v|in zM;csWuw|vXPEql&D=1BASW$(2rI&}D^gYKWLp(ZrfY9Yoc|Dheu125Ee*<1PB8=A0 zR0$Cwj@U46G&BTDET*}NR<)C)zG|}4FukSXljCPqQ!B-p+`<45gx`jO6n0rKci|ZO z0IiVe`TPiXe!<;^0diq%;Ni}#0=l3*${c8kbDSZQmbUE8*TqXdfo^qSU-TKB%=lia z%77~WN?#(&A4($5PsDp0s$YVYM1#cO3!H`#l=j&qqedUzbY(HP3jMGuCmM*H+J1Op zh3rO|u)QO3=nyvia({Oelfb~|1KTX5EwfE3?5h*rScWmm!#Wg-ZC)X{a(RJa{9-0W zGQYHkO1dR-^@9?T#wr7|{FA`RLu7a?;-u%D7PSAs9h`9=M_c-4Oq|Y#oiYk9M}KFh z;T1<=BX&fN60wPV3i;ai$+~^rawOUhA8q^$vx(XZB15z&<|Z-+D^v*uNO84Q$U$kk zXD#&%p;X#2`|jC46D9~}w0R?y<3rFMn2;>RMFM(3x_da~>_#{-=u}@-`gfGKa47jO z6=3Ys6S)W(=$41@I*pV24*f$`B#p1n7xJ1Nc<)q*U3+ktn()jfunyM+bC6aJr zjon=s*CRWO%Iy)c6p*|Zk2P05JNhhY&%#lsF|1uQ)h`@z9U+(rin6X0H43T{w6@PP zJ*FrG=rxLLfk7~~8liFT_j|B!4go&xY{TQx{959Z3b-a8Gz&EcaloQl;uj%l)7|F? z5;39BDQ%k`<67MVu7}LD!Au>CN}_`r9b=%2c#HfdCDfog<3MISdxE)ME+!4e#v-LL zUHLkWOf)(zsR6@3yN_qeubcE=KqEHyiqaF8(O&Iw_g}d;!|70d&vbj(~PuZKgbc=cJ zSU#H1Td^p1-+c$5eZQikFV4A*gIzQ9Zo3t9?n;*G{#vm;c=F`4jCy(w2;gC3$ts*N zo>WL%BqiHaL%q@~>s!}5~fF%oY4U8sJw><7;P zI-vfF0+NZQRe)n?mwyQT))mBR^!8_4Aro(TVWCsh1V+bUMq~Tm65?eCBSV&QE4q3H zu)u|7z0P>KS|jO2_SSksb#O~R(r1NF{8DoAjpq#2G*wce{!@+#-wTHhlT5Sp;Sy5# z-ktSl*OhN?&!burhT0X8iskn!IN>m?JUwWIog1r>I1?oK*z?i|-2 zeYx#-zCjLit$aIuP-;ERJC9p5Xdm(^C!;f zxgwSoqamj$^Z_q!xn$=~OPasx8t^-*cC~Wiua*+BtXD^uYR?%mTG1U8*Y&_@s#v|Mlpj zK{9PA@pT%^s^!SM8RQI{O$RqK1i1rC>>w^jP9;N%NPU!jqmF529?izIBNS>@zV1)O zI1Uq!OEwErkE2q+^u3NT3ot%Adat&5rI7=UzO-TavgsSO^f~{>qfy7eo&4Ja^Y<|O zfQ^{Vh|c{jdae~+uGCLY%o5bU>t1Q_w!D%#W0J#ua!G#zPd~YvgbKFQFvT0FJ$};A z4P@gmF;Kg-nmQ^Iu3=}NQ_R4M(_JX*Q?3Qxq^UFEW?a1tY+g9nIIq_H66Ixn4LV`| zYN-=tn`%!IRNpaKSE<~EV`ZU}ZGCH@gX_tK&E%1xT(R8IA0TKfG}v!_UJKPzuECXKW*yEsI0a*kaXUMV)sFayq<9bDke9>E`9Ja zF^z${ty=-Ss0zH$t37zF6D9db(sjMfE;fyFh2JO_O?2q+H5)D3t|x&PA$H$8nAl#j z>K0X&(WU&GI#ys=DX~j%z_%x@^zN0wj+pt*N&>XWTMqrItLoBr;#JAVh zJn?NY(RBvWk<|-m#a)IyIm+8myws_QwO+LJ$%%Y#)dhJCpFM*ZZp6M>dT4E>@;dzLi1hH2t7H(u6=hs!6Y92!~K zmPc$eM}?$})yI|XgLMMHEzTfFL60^<4aDYH9#B2TGGE?ryw3>2*obx=>+`#5YG-1$9@we_p6#LmrHy79T{-A zUCV<`PrR@bWp@u@&N#!W38`e31MP@b&;2e=!pZv84Bp>MQLSqED;oSCE?2p0%QaV) ze7_nx*ywC|SZAjvL-4bvExI^84>%L2=g;>I3Y+X3gYL9;>{ooXdOL$YMb44w$XYVw=0JU+916!IeoJdcRxss%Hxv;|y)D*tDjwEYAl+8sT+~y}a*GuiB7`wJEWFTAYlRB~=d z0mSD=UieOS*TTXvvsU>8@37n5;rbQ5$VeZ>_^Q!qRS`mZxf~kmdDPWVA<%@)c(V7~ z9w`&m*b$o4-sBq^9hK&L{Hs~=X529oarNE(>sx96BLnU0Yr_x+&LkyqarWW9puK$^ z`ul}DFXE$(fGpCUI3e#>T=xeUb2R~6l&It4*3Ukl=Z z0z+Vi@M8$d{u-QPFG2d@H=Br{{r*o&$!iQ}2OG)$pR(U6iJSebvyrFc#MpSGLO*MROA9|Y5WuM)ybTk zH{fte}Rz#zaOPBF7Yy-w!AG?J#l&+R!kH1D-j>&6dhk7Udeo12D;&g4u z9S?VL*Q)(=Cqst_{w__R+E`H6dt)~wT%iYkho)=!4EWXf%G%?^D3p`Lo9rGs*C{uL zi)o(i$L}Zlm|b%GhoVvU42DT#1F4|8iB;``<~L`<**#QSjXvW7sN3`_gV?^VV;uf} zl08-zgwDWvwd6vrzKDiByw~>j0e7z(ARCj{b&plh z;*49&4Cg&BT!V1EmRVaCjP4Ae<2a>JcIc zd6v_$muYl%BMn!webe)DHL2F6j-t$t#8T)KlHsa>F(!cDw3ngk=R5fEqxwU3lY<5U zDx`=HxB}y@IqcvGKG0<~unMOU?pFF*w4&l{yuSyx@cNIt^GCO&QZ!Gpt{&Xdg&)r& zZ<7&~d~)w)APuZsSvb%IOTf)=wZmYg_)=BO08zXuk-j@3Pr6OOO#Q`F0M9&`ESSYe|ORUQq=#y=ZtVp8e78}Ac2g@bYSosn@ zJbtmMZvQ9$2LJko`I>HkaYNi|5OjM>?DSq&TATyY7?2tI1w@b^7L8eM?p78@%O=@Y zS|j@rp^7df%_iRu%mH4Wa)F9Tl1|VQO?DD*;PTqMr{X-FC`wKGN|dQH-}#EPNP}ZG zo`FS*v6==h2OPttU{pNiQs@4&_`qX>@sBpS5|Xq1rvV?cXlkZmBG0t?0CUJ~3pyx* zHsqtqkJ3%c=pLp6!djM5m#ebE>l&OC%zee-PA)@z4p- zYNZ@Fg60i~mYSyqG};DhR&jM+wrUQvwe7E{!K@91&TjSQzv^VxQ@$-Q=@<`aK29PHaUY5^C?2oD8rNM-o7t%2yFmo77G|S)YT#ZoX5H-*uuPz zO~FMv(A;lB^y`Z+=O>O|Uw|T4hwMVikkEPHiZ7dik1?vH3#oe0#ko8sVzN+8bSx6A zw=qP+GecTk6mY^68K62=6|55*h@0L~q(L@L)-;a}BxR=|A_GpAHTo}WyG=y6xzno;K zLi;acaOc?-Dw=Rv>$Y%7GV0jJ~5W{^H$iTwyQBiUjQ~>_fDh4x{W&} zdbf|pBNG+T$!HU8;d#$%CrQ4;`G0H0mORxf5rN) ze*(Yoe*cbcG~W2 z-ZMA@Y$kYZ=`KWFPW&AkkpM+sV(Iknv!%D1f~Ulwz|+6F`iHK)#EG8{k8({nsk}^3 z+{yj!Y2UZkVmr!LM2HV^QpgNp2wf=XPch`)hU7UZW(cv_kMLqPNn18^!>TU zs>98j<5R`Oxoe(fAJ)(5cq>s5Lahy#sTfH@5PEL$t_{KvbN{#g#Op^_N?irF3{}&T z6LE?cpl{(?u)&dB2Mz-WEBt0uwb>2iT4LrTQM^r;zv$Bb@l^vlyf3%mCt^>s5G)L9 zDov2o=Pc2`L#V7P8w2;Yy3TL9&V;lhPfz=iu4SEXme|nO-g+z(^kX}=htDZQReNW9 zw9WLz>ykzcem^`_^%8IxF*?_{KfVzI)v;+bt^~Vl8HV4`B%8MT?P#CBov6daQn$Qu z5Iswq{C<`OVsMCFOAZU<9p>8DVl!4eu(-ee910SQI_^~hUsW>STPa|Y`JNKCd5p0w z`pSV))S`~|TQE^wnb&5&Y!sVLH=y5pX%SaG1%+#3XBzu6ZLFzP_0L=yT%Y6{^|rCb zR)uogNgj~o>?avCdHx}pr0WzpQ}A3JEo8lK3jiUKL3>C*Pk88CIpoyMHZ{H+Q}zN^8$W<7o?qTSZZ-^Wt%j!mg98eA z_tPI&{K^{_8feF=kIlP&@J_41GiCw%B#d)s!pnPq9Bd z&#B;Yx;lS^1#PwC(-_~2?T2*i;XYNM5lza>yi_(V`B^4p#-TZw6K!-{Kp}O3a78`x zny8d^V&R>M*b`{)A@KJC^7a7SIp_6R73EQI)Q%Tr{)Ae@S|YGv&j!%C=#L;IfhXf` zA76#*z9{r0FdwGVPA8F2@Vix&W;pr6#lvF*1S8ZoJ*}w*eoY%3 zo0j#Yd|;ci8st+#I+4ml;-mr4M#aH3*Crg;tc*!Y60CuZ1?*3_-njB^(eD7Fc&0vg znb{#F4lRy#PkEh!Lo$DWl?v9G9*YLZTHwW$6&}sa^Angt+=@Smd_#wZh{!RK;YJL(a+7WVvD3W>Yp<=fvz1Yc8BTG_`I z4;8{VRz!Z?8F7sn4csvK5^vg7DG2E%CoiFI+?Up`%zLCXbf#|)<_l-GFmn>^{tk#K zA@dYJPz7XzXT4x_FQ>2^0F}4fP$>EUrH$P$2cJZu1EPFCK&~iAN@WAUs-+?o-x%Sb zH0`st5j`$HxL{n)0P%B^*eVL(j%93@zrEg9&A)YCz-68OgF7+oS*miSKgp_-D2QGL zmW@sFES*q)04Bgqew)YW^#C;5XVkm~4^yT}iFx2QWghI{X|X{02U1e+?ckGD`D1Z^ zGi{IKszMwU6{syo4NwuKZS8vZ`T{BLHN`i8#M4W~rEGS?0=6~mvl>874Vo;kbd`U0H zC<(^{LV(Qwno-#o{gwN`%u7uz6%Wb)0k}f9T~|mpSdSG-{mBgeAK0n|gO(XXHgR7IhXnl{aE=B5}0P^kpgfvTXpTX0{7rVW5cgTNV z1d{~2L=W{l=xu(nSdf@Y&zhTwdzo{aJqG_^dGE@Hz>Y_xUj(7A31gN7A+Y0r+L;GSp#?b zIdo$Vol^2-<|chCSvY%~OhK-)0i(@h1|EUioiUA1IirE{{&mHMV(4V=A?6ZS2UYQDEU z9su75LLz(c9)YR%|&mZ3B8dwFCq z{|}V=WeZM0V+TgjDDRNsKIJnjiUx8=N0CY7ikzHP?P$P4Fks@% z4C~pO`5diRR6jSS#bEVnUHaL<5f~H{lzP620npBa-2bVY`#*P#{BOS_)mh}? z$J*@4z#5eY`DzR|dhb^J{lf)Q+wF`|u_}P@RTSZaq0y2+nr?1Wf9}T}o)~xk3Y7D) z887*6@mSJ4=gzl8`v%D{MRW;~yc1dOXupqG&6aXPB|*Gx9?%bNC+W#y9++P<;XzO+ z6dwBR-vDzV@<_vxA;Nm`Mk~g258r}_U6la}%{j>-(ny+F`lX4h&g!rh@_Z!)d1u@!iB!oUFUm02Y{Njkus;v7(K;uuw?}mo)sa6^LH$8`WLW1YK z!8l577nG*lOaohxKoa+S+N`NP>5re?laqUZeB?2&YCUY696l$pwB>=Uy!BLcgryk= zwkh@p=DFj2e+ZtMBe=hK=9hEhE*S@E3GB-J9d%Ab%x@Dxs88r zK_+W%thRjDJ`GpzEG*4$eCbs(QTWN^b^G1pezD^MQ@_)Stc@mly=V|iH!CUEvUFmY*Ywsrz`bYIpUeF`cJ(9=Ka_HD)J^lO*LYB8Z zdeV|F6mSRwm_xF&ytyyBI zugBbFiDTfce?FQrMTc+lp0#+-zx^R=*^6B=Ng#Tu^~x9=5$&6Gjb?%9(8c}K{8CSk zOk%$~pl7tv@bg)+{lKVsSH}G4b+vop4zor?=^yAHtL6xIxp_aAL{r(ABRnq4mth!Lt1S4bHC} zxqG!tB7pkjFZ0e~TZdfmisg6&-U6}@zMgA6T6-wJZ2QD5wIa6i!1&$l1lMZuMcdV^ z5PV9^uuZR5{_cX8i8T{*dL}1TX1Sm*a#H3U_W9!}=lT8v>0`T_;jLH7U8i7N0Q`sH z2bPq(%AkoSK!b-MIW};w4oBgGH)oy(ikBbGsN;kviK4#e_>`OxesoR4S48eY6bje5 zez7cwu=?xh!-B>(|4Q+g$j<`P2CaXEm?;Gx~+_jw09@`!? zv79n@w6&vEVEB<5%H3R@Jg%_At~ti&5Bnb>^VXZcI><=q1z%(j+1`-%m)08fk7L}w z8u0CluQ)yASAY_cC6-nTi>p=aIjUT1xj|CCQ{&4S%b`6|j^7mj=bBwf(uexI-dhD|UT>BSnc=7~Og&Zv>A= z(~mc6T@c*_?PFz|!Myqx0A|;@%;IE6ilA>VnyAx$T=bM5b z6K<#HKjkP5GiCRfXZ|*dsIF9k>*OMGC5=3RG+_fr(|BlMEhM>)%rbs?+l<2pa4Ze} z^2WLIyKSh79@rzWxVHYRNLd_SLfr-inE-UNLnv74h3d+t0I7&5$GgR#1MCc`*v}tY z+FqI<2X?|i*msAA6A5g{nEEb1zvGhq6DKgHu(ROors=@8u=bZCf1>u)9M6Xfh{B;{ zO(hz{gf37QL7anSHcx&KxsfIFebLjUqoaCf3s;QSU#r{5g~vUO&a|0;-&AjTBh##K zI7_X8t*n&I89ZfHDFl(I>Qly!DXhAj98S!iKPqa89v{trVc%EWC#F67wJV9Cku}?! zkTBm}n7qGVEqjxUH+Dd5zO9JSkvDA#Ll&y9X~0HQmi7fOcpV%eJHAj8@X;GNAaG1D zs~gwGKa&QW4ho$x*q3?q+Y$kXNqoun`E4~qLUN^qYfWm{{671*yjeEj4AWVN6;~^4 zK%0c1Pd>g8{phfS$0qMSB(3BaUDObF<25~GNlMo+Tyq%jqORvL(~)KiQMfa4G&)y6>u&CCs#`Q`vopEuCnPvb#L2D-B$VGVd$W4C8Ozkt>^rU%0TBp1u=cv zroAG#njwG5;48^NhAniZ?a^cS=V9%>%by3fulB~JboryZm#IU~$&+f+&K!#D3~a-m^!CW!ln>?%z){5T^E+3pS4j z$Aq6eigwB7_UR8DHc70GKJ)r&tpt%Xgn<4{s)3YWr_& zL1qB4`>^L|5Ei5|Y{eKcVfIpXQft#c;Z+Pys{OPN}kMZ4EGApV9=Fd@hOdOx7Sc)|;rgyBiHiV{%)W-;O2=+B*^raI`n`Yz zkiuQRkXEm{|1^_FE}~sSl@ss|NLFPg~HO;jOb@lJB426PQUqLn(w%pdLGn`wJj$)|o>-@u=-QEv@@ zH-iv|O}VPw_P~hSvkRDE0QcuD;;-2%p>%oIo;5qEIOl9E0aC1*xaxl;RSO2~nSeq4 zTeuL);<6BsK5><2bv0{6g#FrJ&q5Z9%^NIkblvcxBeM0)*&igs>Hhk(Zcl_GMoc+> zs;7XD2IMeT7&+s!0?m4=8xFzI>*&a&OOl}E)`c~WF+Ycf|6Txc^xu2*?t@*&dJ)Bh7CYi1P5a#4LPYIw-=3 z5oY5vTiKRv!!4P;EKE9K_FzkT*-T72CYp{~_Hm1}H)KA+b|r1qSrh>Y;0{giON>ed zib2oHMNR&Ui}DRISMK1(XD!CS=?bPlTE)+6<}hdnW(7fWl)uq%0p)JnO2ss7rJ!Y;D}q6j(t@7fyc@Q z_ZR3ck|FIrU{sJ3*KyrKux9LEFu+OENJw*`<#T9Z+wU2yxfM6se(=JIQ7_cBa}2d! z30ki57rDzIPjuJA{CyQ>{J|YA)j7IZ{}%?F?HP&i4|Up$%lJ(m87Uv3J#G)neczi7 zNFu8vkkPs93pLN18S%_^aCUEmAkis*bK%{Sbaf_f2s_y1kHDZBX8*{Vh1VlzWg>qs* zO3=U|NK_xMiR80OXiyb!<#!f+0g^bJ|2T1*e!a!wo9##1+{qCDefL}Oqep4$Gsz`Q zY^CVoRF~Q*yv*hu{Q%Q$NDdD%Rv!J)x8|6#C)7T?(+zEVboTQ(8&x!loyiD!`I4@O zUvVU$Bm4GILYzGnFk35LnHPi&$rrwQ=p&wl5ltE z+<9W5KHnn>uKbWU{l4Gax)`NfqLrPiW~P?95iZh)Eqn z2YnZ^)qA&5giB25YY<^IknYn#obF~ZGo?_JApdNk`C`I4d@mxB5~(vg7!o^vsvv0Xc>;!QHx&95U<6fTV$fk! z6ap1`QVgSs21E2hds^sJX3gu|k`ypLEZ*PNsR|!nrY=Sb6scSMv0iW?CY8+rSMVEj zP-R+-WtgHmO=}Q7n7{YRxR5pFD2<6!v)*T$bX9O8o^PazpSVOWj2ljn8tQQKWxJ|R zI4^NRRm^A5tR_i_D2*Ri09IH)y+mxZBPu{=+jZaZ^l7 z%v`)U-K7iuq3!`xp}aYhp9XjzZLl{PT__bjtXw{hAxum0ygy!X@hcI;B>vJROg(BL zs&VT^e~h3#lj9 zk@h^4RLjM-CDRxFYqSSm9(}6rrDj3Pj~0L3?77Q$lKLew|Ll-h>eaxkp~@Fr-T|&( zY@B^_*fT-t<4O^Vui4K~Fa8HALyn$_MWa$k*qC@DnVg;CSU%?Eg2S1wF`0C!6f61Z zv-4r(n+chtCZz`tyT8)d)4yEa6H83~Soz{e>rTn{XLRIQ+?;U!T)GktROOiduT?q! z#<8SUi)ciI?LSdGS``m|%ir+7Y3)v^**8<%pmAEFOZ!Q8G5tlpN=kgNC;CB1;~7W} zwqOQcYJ_<|&2}c$yavTy9c8PnQ`GV5#@2F}14}}7?$=5Wi_P0Su;_?1rzMn&FlJhX zL$kQ(Pa#(Pgw?HX>p9YN#@{~)^W|F;CNLNF&YEBPTvFe5syk4AaT#P7Hj<#_vJ%P8 zR?HQI))MRdDI$%}FNu&;0nehV$$qe9Xq`H(?R@oN>2Qx=T}6$EUG8b2kdxgJd&Bld zRN)r?zIayPjuCy(M(NN#;cMWc8(o(J;pM*CZ^GTfB6cMv%!#?8tRq@2C>P+kZ>iWF z-B*p!nXDkRUV}~obh^8js&&KrcMFt+?wb=^tiOZ)B*G#`IO~6A;ElB%-V~CmwNgR{ zxi}3Zhgj5xIKVflwJE=$=7kuw*6D(A2Dgm>yY0`RFsqswGnsYXvfxPN3fbk_)c;&M zy6fXoP%x}bhB+~Tpi;U5nk%+>0n!4|+@9-~_C4>(OKi`3e=*C(%o5UPlPQWsg!5nwIL*XKRd8t`o&BGg?#00$jCNf!LT zC0ncz9Gz7#)3G@GgUdo!gfb5-t*=}!H=RUb$-w%&%$LHi(DUuQw;18RIWWgY3T zN_Q(!>~^?+yIGGv0rp%1VWUnAfue<)`4R5|@US#KxBI2_pvyOuwf!9~W~9FkZak>9 z!ByUPa=M&Afr&?tTdDYM`tOVc&N7 zcld*V?|w}FB9u>f2JV8x4P z#DXO|`2I-hVE|y59S)SVNOe7;&*oz~QOX(%lTwo+I z-TMC`pg?Di-UuFQ*R1WVOr+mz;<88Fw5GLZV(Zs(+w?AOe1#Y+3|0*yz#GR-C8zL@uvMOF!d5%}mMTid@-?UJLj6%x zMXZPj*2&(K^t5191Reo+SDvXeME=)^{I00|`E&|=aF85r9K@0I~? z`^1R7Wjr$CjrqgRdX}!kvnfBqyL|73wAwcp(e(`C;_)08Ra@DnNkq1i$%}t1YuNI% z+0qHlHuV*s^((fn*Ffskpkq2RJ0Q^&vLjPZt+g3r+o2I4~qw8{xiO9aB%DWsv9*rOnXiRewYL>Q^J?pBvr> zG;LP(R8~rN6L$u}K%l^hV8E(!9`IUT@ID^IdIUVSVdFF&DeTJkqpdX2@{jS(pGfGun*qf$PlK*kH*M zlN8;o6Nv5JWL*=VveO6+}qyJzg*mHwlSA7 zAnMkU52{QK7$JZYjL<#d@17Q&Y$O#DT7_t~!iO`!+oaU;sQ&a)Ip6X^Mj`$S|5_{! z)#z#U-t4^4T5`9GSr4Jn;d|~~XcTV9d9)yNGAdXz(~^svGVdp_enkFSA>|M2{ch~) zpE;0>WAROp1ni`Uop+u^lPh)xVG6HHfL9gHqLcz4f&%|xg+Bd<)dI1G%A<*!{Rz2} zvGV~YzLmT2j*$vOEOLAGB&tTsf~nDbYAzYY^;DF6G9x8lp`8>LFA=w**|&BlTb!sa zbkTtzn?Z~?z(g1Fy$;|cs44Syspw16CWBKISBuUqVwQ^5i`)!2ag_A zSyUYpD&CF%-tB(>uBWaGb6l3xBHLvo$-K`_aigdz?w!PZ%DV{wW#_3(c`aHc)O&DB z#<00)>TZ0r0&E^R#gg{56^^n`lVQCKb$wL4}$d3|_-vuj`qzuggjh6o=! z!VJ?vsj;2(xNxZHf+fkZch9WRoO&5Bxpd6%QMZ~4|6>|+`a{j2wT`)uT(>)HFQ#Kj z4XOTOMKsf)-%*eL)4nL9p!8q^HbzAU;39>joE)3zEWqo=)Se138hoKCN$84T1qIqf z1efBs!wFy66c~^}yBwyt+L(%k=EF!v6Reo!bQ{%qnKopt`IypF z1O;v@0Vi9+!C(XGXWG;m#n_%Qqrbq9uD=G=#`#2Ooh=1IJXT z<+K4}m_)59k{5f{8v#XeaVFDksQLt1CgK%Hl|s3&xYV_I^*0~Jn}iu=Mtf3VaESeL z1)m+!_o5JBi}{Zi_J6qI|F1b9uCFX`{&5|aWU3MYsPn|ARSOZpJq+XVB%zIbuV`#* zo~_Cg4rpI_*srfCDSO|E+VHx7u0kBTqPmZAZiCzPKIHkhB(O zBv4i-`S1`+|F;^|_igvgKf(fo|Gnh(FMC`*ucq*olrniGj++`i<9;Nf;3VZ9r0XdJl5E01gDGRjm;aovOV?`t2PC0Q8 z8E_{PR_r`esks$3(uMJmR=+3HQ3XlPtH-skz)!;TZ~f~4zGA$|`k zOYMiKHWy-@YR@Mut=ManZ9~K$>%biV@Z2(MIg2}>V5YfBlib@{w5&X!=3~+nf>2#(xGqszh1U`+v0;_~Ez z&~NC3K{rdzxZl!1c-{N{e!3Qu??qS155u>7g5lnGo|ooL8{M#D=Nmn3&ArdF>=;oU z4rduX{Tsz{X^yO%T0xW==+X; zSL&H~qs%z}XW#$&-wAdmA{wzRYZq2RK-ejGwu5=)pAx(@Eg^)trgL$|s_93B{XS?& zNX);SG%=Vhzevna>SUjli3qD32WSB(n1JdP;T_)FeAaq<`%4;LsQr=tLeE@W{*QSa!eQBI^T&*ZuRoTj;(xeH{Prd+ zR*oP-lbEui&-2)1c=mQlx%l(_G~c_ScordASD5PV6H{S)1ZAoMr5@%Z3%I4KWmGer z;6J$A&t(fzl#={(`f+&!1ACJs?=LX8$|jKQS0XN99B*orw#q-+`pUD|cb+v>+${qN zNz5K`10x&vgKtaBS7!TV?POM_X$RLQH;L#6ZVk4)Blc%v&bM;UIsJhzN0YaOr!qTk$I&|Y2C@ackt}s8vqI{NHOW# zGo5aUl=tjJ)9uPWxX}w z4%8RK4#=C!=d**Sa7EkLKd03nNONfHnb&p1N(~ZD_t#$K?mx;>8n(Y81*%DC`A@Sy z0E{b;FjV(&Faagk$c6p~EKjEZ>KPrJ)9l)w-9o#owNaPEKLWY1 zoO7cGJV4ApqiDf)L!sqOhnMCwiqbT2YJrNB%X1Mmnicy8{U}&P{T^Lm9glE!T|{23 z^(%UNIOlWAu{MKb;&rD*AahH%64IZh6?Q9<$a-XnO!n&QOY}CR|5W!NMy-NYrRkhJ z0Pd|(1W*^7-T;)CK>N?=_^%pLbWXklrz8JQHP_kI)Yf%_h++X7C@P>_;38e6BTZBw zL3;0(CM9&~RqmxIoj^cC2@q-s)r2ZUP(V5a5+HQxgwP2!;mLh|!TaqQ@7KNd7-#J= z&YEYQHK%|!w(0`c3DDqb{a>$!=$s(qI5$B%;Zw0~ItA=5L`qncotX5zL$|RQNF<`k zwk7V=#%^cS^YsnzFQv%jv8pv#0hGhKY;0r}piJkvJ@Kc(|26dxJgw^^!(d_$+? zvy^PEwMUw}&6+a&E1cTApm;g7(e^pv&_}MWUE8Jp(VY8^oYkP~{U^VES>U5y{~=ZTu7 zE8iXI1a&fE97?nD(dg`MFSsDQ514=AKN0HT#n$X&*`evB@qP8?T*^LWE&c)5^McRx zF1}g|?aQ`DVP33>s|fAWG$XH~@Y?rm_eoFc?KF`$#_AZkrY8nleJh)U+#ML``i<|^ z?teRW=FqGQ zCMR|}Y8FnZm_Z33ra>{KX`z}On0c`);akIF`IDbmYL=4O-GX06kt}7m5|o6Xoch5( zp?2JYMQYDNg3|zWDyG#B3DtBE_udt$uSm4`njzgYy*i{Ln`GyHasBY6@~}VS09}9O zA$dzU(~YowQR8!EW; z3jfY2I-CM{}33mD*`J8~e|Tk>e(gD0tP-Lus98qUYm^rS+?g z&HIXh{a`}~GAT<@Ct6auc@m$l+XmLfC>q7BO=_`w@qc`(A1^Qq0|Ftx_eaS5aZt8q zJM?l#Gx{||(h7{+ONT&8q}avye_9kt5H^Qaai)#+(W9A=!p}$KU56z>a5(DraswKu zZ`tX4pwOkDSux4vNLY@2$+`X3cZai!N`hSKrz;&$6*ZMs&eTu(R`VkKY{-_rxDuETUtb47ABcU|mWb=MxWfUVKqvL`_tLtHO0 zGY736_n4L-MKH=YrXPqbmK&OpJ@B2e$%7*7F4n6-eUL(Vc5L2u&3J`8`(RFy76#&{ zUCZ+5zSr9CQ^P^?)rWEXVovIhauuyrazp#Uun}xnLunA&XEPRtsW`kpUNn#fFDsr{ z;n+XpW?1Q%_u_z+S?i%3zoKZHmxdD4zd`mU8tr4Q&1F9|U;=yx#Qtc53tj|#XH#Vd z0A4X0(T&k~3>g4Vqjc%foBxBs#*eB8h2}J3K^k?MW$r405Nz0GJ{c_XzILg~^_i0H z{qqKe&sU6WQt7ua{pOkY?0bseQNY@KGq=fF&E8g$z-&=ahu@0LEw5+H4{bb(l#Wm{ z9<5Kcg5Z5aXPGl=`LA27k0-8EohAg{J(QNEMbZ{i*qAR~STTvO(%4)6_uLeUIMxWq zJB!Wxzdv&kVeBJe4CmU4zO$EM*0lKe0<221YM05R9y$1kmE7!-X?>RZ6&vDj&3bpL zSoBry@Uldr!QAZyFIlmvT~7=0HCX16L<>O#)6!^NKNx6^cc+N>7^LPlj8sGg)<3@{ zJSqar4dw3>h3NQyIm0)JcNal(jmZ%X1)JyY2qW+Q5t#IX8C4F2dDlYSU<7IVt}UaZ ziFcj@!$@Pwy5{Ch`e{>5dsmWSe!5I@gR5i$^~5N+(*J~C%A|CAvkau!{HFU0)2?-% z8NiFCgkR}rlnix77fQDr?%MUg%|ebYmYMJSR1o=&<0POdd&2DRnxHANM)B6+Ru&PV z@g7O=QnbK~ZaH7rJ~BM@9d$rQJ6y#AJjsVI3#`->R;+dEk~=Y)Zvkofxa|I&xo@4t z7leMUWY9rSF>2pX$Aov^NY9qlb4dY1-*% zgjBCZU_B03EF>3{bXAxG-5|?x9Y1YuC$85oTxsAim5g3hj~GsSBTgzR5t4L2rp6_s zK?IplgNYX{NFl3YQk^m)thEw@C$QjOIZBzQ-sV5V3XpObp|0us#Vd}9pMzpOm_^S9 zgin?{5tt3kgO3e9GICC7=qYOh$u}t^~86|Is4)xVk5V4e7 zVY2VzDP-Xh;_GAr7B{kcZ|Kp+j?^=C+7}C`j1(w%g-Nj~EFoiarV5w2H8wkTuN;LJ zqh&_=+zUB4!Fiuh*R62BpSLtpyB^f;9R^!KVv5#>r%y4SHeaM?j!hJ?TVxNS+o;s+ zDF)OVfq29n0y;Ms)=K3SU~hKF?6I*Z_C9ZUgWW6d+TmEtHp^2l))?5hK<>_&!l;N- zJ*TnSnh%|jfwSSz%0{zXmMY(-;Y%m#QH{uAuvW>^?9uU|a2xf#V%Vv;(R`fS?B=)m z$p^Ot1?AOdy$Q(tGO+uzdTjy=V+9;h9BMN%ma%%{QKIoet9KJ7&@gabCke?jT+uxY zVJjIXmjm5TW^3_8-HnlZu6k)SVC9`03;E&&trDXHn?q;fS4wgE-~gEoaIep|qRhI$ zc2GGFo=(&2lIV096;Q`-cfVAWUI;KwwbiDQ8?4TXcbWwC^|Lj-y>U?ypVEC>>*j=8Rt|bWy&Wd?9w?O3wd-o;6T)*u<*$ns}K;J+LGlVhedb~LnKYlOQpjO zps1bCl4jjjoeO5GMd!T9GV8tv5->P7C%PVqiCzCt72l>yMrq;2&(yY@R-Bi?;w~X% zci1B*CNLFF8bxuup)TFnCCs1%y&Tf|0(#Fq16-X--s16N ztHf89CIQ8a(eftvM%z)Ue%YKXD%*LLK;lA z;$;(@vy;-5naV*-oQ9*cs`$avLttNWO4&)rz#EusH6nd*GDOSst|GGbA$+v*6kAj; z(?1ju>RO#;VuJt+vm(D8Q?_@;6RWf%{Is>Mx1MCl`~A31eK&mr_0V_j5AT;55qFmF zu5D*!q20y;4$@F=)2Aa5gypV(1|15YnVbWKaUR1JUnc$fYhxv;O*3HZe8zQ5Mhj2C zI@=q+@SSB5#o*IsbLcv55jEzgK%5DmP6WXMHL%&R%I0|5sGgEP1oyia<7SspcTzR7 ze>tL(!D0(nVStkoRkUKd%#zJIr}{Br>>K>85&q-?G^rQ2P*2skiAv z^-#=Y61(tDi5hY@nCh^3AB|V2FpH-Z!=Xxl$OIIBFPdMpAW8<*Xp0Gr@B*(}TF!8? zc12s#q`K0!a0t&(^{*!Gk98yCXI@rlS|h`5rJn3MM0K8Tdn>-o`+ao>Ge|Fb4V+d( z5hYgv-=Q)8=j!*Ce{>Kr7 zE$!B z(~2(}NxWQ>ipQ1PP)>S9jz%#vIbrfo52f#18uA=8B>AptAm0`3TMEf;w*cn@=38H} zz@9f}=8%-ovyT;a{a+Yd5(~pbe;qjc_|v4&sHlt**Khy8%4CwJ56Z<{HN+^Y`>}Hi zN?RQMOkYpYS?7TJ$s0Z>m+Fg(R3gE358O;9J_Fa?6E0nDZEk1Z73oHB71339BLn}! zOmk#kVCL=La1$#_l-h30hh8mEZp;28mG`!kltx*b_g%!#(FRH;(JAl!RU`21hhn}C zaNWmoO0$u6==aKXc@6 zG%>2tAM+kPd}uodI>1B#8wHdNw7w4R9483a?7^0uNoIXM4Es3(v;3a=iN@7v#%!tB zA3F!JLLcH&{)I$rNNM{VA<(WNns&*hJ;oR>4AKTJ&D?=K_5a2PzH6~n_ctcA*LK<*EY%$J5_Pv! z4>-esYzT=mG!u`FNVz~61d0wLHImnz5w+I9a3IFURrMs$opYwNa7FuhMk^9_R~}z&mCNz3Q_u6AI|wplqQSX zh_s7%TtEIu_9pYivyd}_QvNsE2O^0oQXSM{Bz@C-X7;Any@)B7t`u5S%M87Ls%~~` zwFJvEXH6U)FgxfV-6%D%XThCi`X1`Pl$a^Q{0*y`@SBsnLD`Q zKjSVw5}tF$!Vob2?Av6GXC5Mnvd8XEl}~EyvcHs_&s;Dn-SZ;LvA zSblxyn}9FV`14rbj;e}51Lux`S z)2+6ETuQW}O$+}9DrPDl5);eD`Xw4<;sTTJmnG?}RV)Zd*0m%tyH{rJm!*^IoPG^F zal8TEqy&bLG{bsbmXcWDiZU^TiYNTZFOVfken?N}s3}T<%@1Dwb0APJOlah2&4t~N z+qliT`BMV}u{07=i4zJTD7$_P>rTc1$z$E?n%m5(PU8=xO%HMgt!$EA^wF5t8=QGp zLy;qB82KV}_J9BJtX!6-OK2ky!@VQ@83ka?ub)XeKQKJBDN$ zctV=k_IANH?iW2*WuhU7vSqxc>MU2vEGmS~RUVwX1G|FV@&?sdKIwV{yOlT+2%Fb# zB&V}7Wo}p)(b`EeCsNSo*p$e zV7$eTjeh#R%hZoAsXN=-Wp!R6jSo5Z|H2_8^KqLiBNosQ!QbbZ?ET`vG*v^9If{WkCfA Wc<%MgL%Jh60Qg4xb*1WGfBy#nM?aSU From 8c71abf5f459a3083cb42d4e91f32514de32a7ac Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Thu, 17 Dec 2020 17:37:51 -0800 Subject: [PATCH 083/825] new info --- .../microsoft-defender-atp/tvm-exception.md | 15 +++++-------- .../tvm-security-recommendation.md | 22 ++----------------- 2 files changed, 7 insertions(+), 30 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-exception.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-exception.md index 3af172dba7..9bb2ff23bb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-exception.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-exception.md @@ -103,13 +103,15 @@ Navigate to the **Exceptions** tab in the **Remediation** page. You can filter b Select an exception to open a flyout with more details. Exceptions per devices group will have a list of every device group the exception covers, which you can export. You can also view the related recommendation or cancel the exception. - ![Showing the "Exceptions" tab in the Remediation page.](images/tvm-exception-view.png) - ## How to cancel an exception -To cancel an exception, navigate to the **Exceptions** tab in the **Remediation** page. Select the exception. To cancel the exception for all device groups, select the **Cancel exception** button. You can also cancel the exception for a specific device group. +To cancel an exception, navigate to the **Exceptions** tab in the **Remediation** page. Select the exception. + +To cancel the exception for all device groups or for a global exception, select the **Cancel exception for all device groups** button. You will only be able to cancel exceptions for device groups you have permissions for. + +![The cancel button.](images/tvm-exception-cancel.png) ### Cancel the exception for a specific device group @@ -117,13 +119,6 @@ Select the specific device group to cancel the exception for it. A flyout will a ![Showing how to select a specific device group.](images/tvm-exception-device-group-hover.png) - -### Cancel a global exception - -If it is a global exception, select an exception from the list and then select **Cancel exception** from the flyout. - -![Showing how to cancel the exception for a global exception.](images/tvm-exception-cancel-global-400.png) - ## View impact after exceptions are applied In the Security Recommendations page, select **Customize columns** and check the boxes for **Exposed devices (after exceptions)** and **Impact (after exceptions)**. diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md index 032da734d3..552d3f6e0d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md @@ -205,32 +205,14 @@ The following list details the justifications behind the exception options: - **Risk accepted** - Poses low risk and/or implementing the recommendation is too expensive - **Planned remediation (grace)** - Already planned but is awaiting execution or authorization -### View all exceptions +### View and cancel exceptions -Navigate to the **Exceptions** tab in the **Remediation** page. +Navigate to the **[Exceptions](tvm-exception)** tab in the **Remediation** page. ![Showing the "Exceptions" tab in the Remediation page.](images/tvm-exception-tab400.png) Select an exception to open a flyout with more details. Exceptions per devices group will have a list of every device group the exception covers, which you can Export. You can also view the related recommendation or cancel the exception. -### How to cancel an exception - -To cancel an exception, navigate to the **Exceptions** tab in the **Remediation** page. Select the exception. - -#### Cancel the exception for a specific device group - -If the exception is per device group, then you will need to select the specific device group to cancel the exception for it. - -![Showing how to select a specific device group.](images/tvm-exception-device-group-hover.png) - -A flyout will appear for the device group, and you can select **Cancel exception**. - -#### Cancel a global exception - -If it is a global exception, select an exception from the list and then select **Cancel exception** from the flyout. - -![Showing how to cancel the exception for a global exception.](images/tvm-exception-cancel-global-400.png) - ### View impact after exceptions are applied In the Security Recommendations page, select **Customize columns** and check the boxes for **Exposed devices (after exceptions)** and **Impact (after exceptions)**. From f9a21f66db306575815db5abd9caaee84b123533 Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Thu, 17 Dec 2020 17:41:18 -0800 Subject: [PATCH 084/825] added md --- .../microsoft-defender-atp/tvm-security-recommendation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md index 552d3f6e0d..d28ecadea4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md @@ -207,7 +207,7 @@ The following list details the justifications behind the exception options: ### View and cancel exceptions -Navigate to the **[Exceptions](tvm-exception)** tab in the **Remediation** page. +Navigate to the **[Exceptions](tvm-exception.md)** tab in the **Remediation** page. ![Showing the "Exceptions" tab in the Remediation page.](images/tvm-exception-tab400.png) From c1c986e8bd02f979f83d8191d563aa51d44e7911 Mon Sep 17 00:00:00 2001 From: Beth Levin Date: Thu, 17 Dec 2020 17:46:19 -0800 Subject: [PATCH 085/825] remove duplicate content --- .../tvm-security-recommendation.md | 81 +------------------ 1 file changed, 1 insertion(+), 80 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md index d28ecadea4..3db95062b4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation.md @@ -149,86 +149,7 @@ Select a security recommendation you would like create an exception for, and the Choose the scope and justification, set a date for the exception duration, and submit. To view all your exceptions (current and past), navigate to the [Remediation](tvm-remediation.md) page under the **Threat & Vulnerability Management** menu and select the **Exceptions** tab. -### Exception scope - -Exceptions can either be created for selected device groups, or for all device groups past and present. - -#### Exception by device group - -Apply the exception to all device groups or choose specific device groups. Device groups that already have an exception will not be displayed in the list. If you only select certain device groups, the recommendation state will change from “active” to “partial exception.” The state will change to “full exception” if you select all the device groups. - -![Showing device group dropdown.](images/tvm-exception-device-group-500.png) - -##### Filtered - -If you have filtered by device group on any of the threat and vulnerability management pages, only your filtered device groups will appear as options. - -Button to filter by device group on any of the threat and vulnerability management pages: - -![Showing selected device groups filter.](images/tvm-selected-device-groups.png) - -Exception view with filtered device groups: - -![Showing filtered device group dropdown.](images/tvm-exception-device-filter500.png) - -##### Large number of device groups - -If your organization has more than 20 device groups, select **Edit** next to the filtered device group option. - -![Showing how to edit large numbers of groups.](images/tvm-exception-edit-groups.png) - -A flyout will appear where you can search and choose device groups you want included. Select the check mark icon below Search to check/uncheck all. - -![Showing large device group flyout.](images/tvm-exception-device-group-flyout-400.png) - -#### Global exceptions - -If you have global administrator permissions (called Microsoft Defender ATP administrator), you will be able to create and cancel a global exception. It affects **all** current and future device groups in your organization, and only a user with similar permission would be able to change it. The recommendation state will change from “active” to “full exception.” - -![Showing global exception option.](images/tvm-exception-global.png) - -Some things to keep in mind: - -- If a recommendation is under global exception, then newly created exceptions for device groups will be suspended until the global exception has expired or been cancelled. After that point, the new device group exceptions will go into effect until they expire. -- If a recommendation already has exceptions for specific device groups and a global exception is created, then the device group exception will be suspended until it expires or the global exception is cancelled before it expires. - -### Justification - -Select your justification for the exception you need to file instead of remediating the security recommendation in question. Fill out the justification context, then set the exception duration. - -The following list details the justifications behind the exception options: - -- **Third party control** - A third party product or software already addresses this recommendation - - Choosing this justification type will lower your exposure score and increase your secure score because your risk is reduced -- **Alternate mitigation** - An internal tool already addresses this recommendation - - Choosing this justification type will lower your exposure score and increase your secure score because your risk is reduced -- **Risk accepted** - Poses low risk and/or implementing the recommendation is too expensive -- **Planned remediation (grace)** - Already planned but is awaiting execution or authorization - -### View and cancel exceptions - -Navigate to the **[Exceptions](tvm-exception.md)** tab in the **Remediation** page. - -![Showing the "Exceptions" tab in the Remediation page.](images/tvm-exception-tab400.png) - -Select an exception to open a flyout with more details. Exceptions per devices group will have a list of every device group the exception covers, which you can Export. You can also view the related recommendation or cancel the exception. - -### View impact after exceptions are applied - -In the Security Recommendations page, select **Customize columns** and check the boxes for **Exposed devices (after exceptions)** and **Impact (after exceptions)**. - -![Showing customize columns options.](images/tvm-after-exceptions.png) - -The exposed devices (after exceptions) column shows the remaining devices that are still exposed to vulnerabilities after exceptions are applied. Exception justifications that affect the exposure include ‘third party control’ and ‘alternate mitigation’. Other justifications do not reduce the exposure of a device, and they are still considered exposed. - -The impact (after exceptions) shows remaining impact to exposure score or secure score after exceptions are applied. Exception justifications that affect the scores include ‘third party control’ and ‘alternate mitigation.’ Other justifications do not reduce the exposure of a device, and so the exposure score and secure score do not change. - -![Showing the columns in the table.](images/tvm-after-exceptions-table.png) -If there is a large jump in the number of exposed devices, or a sharp increase in the impact on your organization exposure score and Microsoft Secure Score for Devices, then that security recommendation is worth investigating. - -1. Select the recommendation and **Open software page** -2. Select the **Event timeline** tab to view all the impactful events related to that software, such as new vulnerabilities or new public exploits. [Learn more about event timeline](threat-and-vuln-mgt-event-timeline.md) -3. Decide how to address the increase or your organization's exposure, such as submitting a remediation request. +[Learn more about exceptions](tvm-exception.md) ## Report inaccuracy From 3795ef248c633ef86caac72b27adc2245d848c2f Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Fri, 18 Dec 2020 10:37:47 +0500 Subject: [PATCH 086/825] Update windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../windows-sandbox/windows-sandbox-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md index f9ff3618d5..ce384ca8d4 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -55,7 +55,7 @@ The following video provides an overview of Windows Sandbox. 1. Locate and select **Windows Sandbox** on the Start menu to run it for the first time. ## Usage -1. Copy an executable file (and any other files needed to run the application) from the host and paste into the **Windows Sandbox** window. +1. Copy an executable file (and any other files needed to run the application) from the host and paste them into the **Windows Sandbox** window. 2. Run the executable file or installer inside the sandbox. 3. When you're finished experimenting, close the sandbox. A dialog box will state that all sandbox content will be discarded and permanently deleted. Select **ok**. 4. Confirm that your host machine doesn't exhibit any of the modifications that you made in Windows Sandbox. From 83d9bd9b7adc67699c85fb3d590e9d85f421cdc7 Mon Sep 17 00:00:00 2001 From: adirdidi <68847945+adirdidi@users.noreply.github.com> Date: Fri, 18 Dec 2020 20:53:34 +0200 Subject: [PATCH 087/825] API pages update 1. Adding US Gov reference to all pages with URIs. 2. Adding geo reference to all pages with URIs. 3. Replace MDE URLs ending with "windows.com" with "microsoft.com". 4. Replace the login endpoint from "login.windows.net" to "login.microsoftonline.com". --- .../includes/improve-request-performance.md | 2 +- .../includes/microsoft-defender-api-usgov.md | 20 ++++++++++++++ .../microsoft-defender-atp/api-hello-world.md | 10 ++++--- .../microsoft-defender-atp/api-power-bi.md | 8 ++++-- .../exposed-apis-create-app-nativeapp.md | 10 ++++--- .../exposed-apis-create-app-partners.md | 14 ++++++---- .../exposed-apis-create-app-webapp.md | 14 ++++++---- .../exposed-apis-list.md | 13 +++++++--- .../exposed-apis-odata-samples.md | 26 +++++++++++-------- .../run-advanced-query-api.md | 6 +++-- .../run-advanced-query-sample-powershell.md | 10 ++++--- .../run-advanced-query-sample-python.md | 10 ++++--- 12 files changed, 101 insertions(+), 42 deletions(-) create mode 100644 windows/security/includes/microsoft-defender-api-usgov.md diff --git a/windows/security/includes/improve-request-performance.md b/windows/security/includes/improve-request-performance.md index c2499cf092..efaf6664a9 100644 --- a/windows/security/includes/improve-request-performance.md +++ b/windows/security/includes/improve-request-performance.md @@ -16,7 +16,7 @@ ms.collection: M365-security-compliance ms.topic: article --- ->[!NOTE] +>[!TIP] >For better performance, you can use server closer to your geo location: > - api-us.securitycenter.microsoft.com > - api-eu.securitycenter.microsoft.com diff --git a/windows/security/includes/microsoft-defender-api-usgov.md b/windows/security/includes/microsoft-defender-api-usgov.md new file mode 100644 index 0000000000..6f525901c4 --- /dev/null +++ b/windows/security/includes/microsoft-defender-api-usgov.md @@ -0,0 +1,20 @@ +--- +title: Microsoft Defender for Endpoint API URIs for US Government +description: Microsoft Defender for Endpoint API URIs for US Government +keywords: defender, endpoint, api, government, gov +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: article +--- + +>[!NOTE] +>If you are a US Government customer, please use the URIs listed in [here](gov.md#api). diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md b/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md index 0dfd7bfce2..f9c9891569 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-hello-world.md @@ -26,6 +26,8 @@ ms.topic: article - Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + ## Get Alerts using a simple PowerShell script @@ -95,6 +97,8 @@ Done! You have successfully registered an application! - Copy the script below to PowerShell ISE or to a text editor, and save it as "**Get-Token.ps1**" - Running this script will generate a token and will save it in the working folder under the name "**Latest-token.txt**". +[!include[Improve request performance](../../includes/improve-request-performance.md)] + ``` # That code gets the App Context Token and save it to a file named "Latest-token.txt" under the current directory # Paste below your Tenant ID, App ID and App Secret (App key). @@ -103,8 +107,8 @@ $tenantId = '' ### Paste your tenant ID here $appId = '' ### Paste your Application ID here $appSecret = '' ### Paste your Application secret here -$resourceAppIdUri = 'https://api.securitycenter.windows.com' -$oAuthUri = "https://login.windows.net/$TenantId/oauth2/token" +$resourceAppIdUri = 'https://api.securitycenter.microsoft.com' +$oAuthUri = "https://login.microsoftonline.com/$TenantId/oauth2/token" $authBody = [Ordered] @{ resource = "$resourceAppIdUri" client_id = "$appId" @@ -142,7 +146,7 @@ $dateTime = (Get-Date).ToUniversalTime().AddHours(-48).ToString("o") # The URL contains the type of query and the time filter we create above # Read more about other query options and filters at Https://TBD- add the documentation link -$url = "https://api.securitycenter.windows.com/api/alerts?`$filter=alertCreationTime ge $dateTime" +$url = "https://api.securitycenter.microsoft.com/api/alerts?`$filter=alertCreationTime ge $dateTime" # Set the WebRequest headers $headers = @{ diff --git a/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md b/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md index 605b0f511a..39d611f4ca 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md +++ b/windows/security/threat-protection/microsoft-defender-atp/api-power-bi.md @@ -26,6 +26,8 @@ ms.topic: article - Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + In this section you will learn create a Power BI report on top of Defender for Endpoint APIs. The first example demonstrates how to connect Power BI to Advanced Hunting API and the second example demonstrates a connection to our OData APIs, such as Machine Actions or Alerts. @@ -44,11 +46,13 @@ The first example demonstrates how to connect Power BI to Advanced Hunting API a - Copy the below and paste it in the editor: +[!include[Improve request performance](../../includes/improve-request-performance.md)] + ``` let AdvancedHuntingQuery = "DeviceEvents | where ActionType contains 'Anti'", - HuntingUrl = "https://api.securitycenter.windows.com/api/advancedqueries", + HuntingUrl = "https://api.securitycenter.microsoft.com/api/advancedqueries", Response = Json.Document(Web.Contents(HuntingUrl, [Query=[key=AdvancedHuntingQuery]])), @@ -114,7 +118,7 @@ The first example demonstrates how to connect Power BI to Advanced Hunting API a Query = "MachineActions", - Source = OData.Feed("https://api.securitycenter.windows.com/api/" & Query, null, [Implementation="2.0", MoreColumns=true]) + Source = OData.Feed("https://api.securitycenter.microsoft.com/api/" & Query, null, [Implementation="2.0", MoreColumns=true]) in Source diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md index fb00021426..6f75ba2ca8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-nativeapp.md @@ -112,6 +112,10 @@ This page explains how to create an AAD application, get an access token to Micr For more information on AAD tokens, see [Azure AD tutorial](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds) +[!include[Improve request performance](../../includes/improve-request-performance.md)] + +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + ### Using C# - Copy/Paste the below class in your application. @@ -127,9 +131,9 @@ For more information on AAD tokens, see [Azure AD tutorial](https://docs.microso public static class WindowsDefenderATPUtils { - private const string Authority = "https://login.windows.net"; + private const string Authority = "https://login.microsoftonline.com"; - private const string WdatpResourceId = "https://api.securitycenter.windows.com"; + private const string WdatpResourceId = "https://api.securitycenter.microsoft.com"; public static async Task AcquireUserTokenAsync(string username, string password, string appId, string tenantId) { @@ -175,7 +179,7 @@ Verify to make sure you got a correct token: ```csharp var httpClient = new HttpClient(); - var request = new HttpRequestMessage(HttpMethod.Get, "https://api.securitycenter.windows.com/api/alerts"); + var request = new HttpRequestMessage(HttpMethod.Get, "https://api.securitycenter.microsoft.com/api/alerts"); request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token); diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-partners.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-partners.md index e2de608fbd..06af8266e6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-partners.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-partners.md @@ -129,6 +129,10 @@ The following steps will guide you how to create an Azure AD application, get an
    For more information on AAD token, see [AAD tutorial](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds) +[!include[Improve request performance](../../includes/improve-request-performance.md)] + +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + ### Using PowerShell ``` @@ -139,8 +143,8 @@ $tenantId = '' ### Paste your tenant ID here $appId = '' ### Paste your Application ID here $appSecret = '' ### Paste your Application key here -$resourceAppIdUri = 'https://api.securitycenter.windows.com' -$oAuthUri = "https://login.windows.net/$TenantId/oauth2/token" +$resourceAppIdUri = 'https://api.securitycenter.microsoft.com' +$oAuthUri = "https://login.microsoftonline.com/$TenantId/oauth2/token" $authBody = [Ordered] @{ resource = "$resourceAppIdUri" client_id = "$appId" @@ -172,8 +176,8 @@ return $token string appId = "11111111-1111-1111-1111-111111111111"; // Paste your own app ID here string appSecret = "22222222-2222-2222-2222-222222222222"; // Paste your own app secret here for a test, and then store it in a safe place! - const string authority = "https://login.windows.net"; - const string wdatpResourceId = "https://api.securitycenter.windows.com"; + const string authority = "https://login.microsoftonline.com"; + const string wdatpResourceId = "https://api.securitycenter.microsoft.com"; AuthenticationContext auth = new AuthenticationContext($"{authority}/{tenantId}/"); ClientCredential clientCredential = new ClientCredential(appId, appSecret); @@ -227,7 +231,7 @@ Sanity check to make sure you got a correct token: ``` var httpClient = new HttpClient(); - var request = new HttpRequestMessage(HttpMethod.Get, "https://api.securitycenter.windows.com/api/alerts"); + var request = new HttpRequestMessage(HttpMethod.Get, "https://api.securitycenter.microsoft.com/api/alerts"); request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token); diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp.md index a7584847f9..3e602760b0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-create-app-webapp.md @@ -107,6 +107,10 @@ This article explains how to create an Azure AD application, get an access token For more information on Azure AD tokens, see the [Azure AD tutorial](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds). +[!include[Improve request performance](../../includes/improve-request-performance.md)] + +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + ### Use PowerShell ``` @@ -117,8 +121,8 @@ $tenantId = '' ### Paste your tenant ID here $appId = '' ### Paste your Application ID here $appSecret = '' ### Paste your Application key here -$resourceAppIdUri = 'https://api.securitycenter.windows.com' -$oAuthUri = "https://login.windows.net/$TenantId/oauth2/token" +$resourceAppIdUri = 'https://api.securitycenter.microsoft.com' +$oAuthUri = "https://login.microsoftonline.com/$TenantId/oauth2/token" $authBody = [Ordered] @{ resource = "$resourceAppIdUri" client_id = "$appId" @@ -150,8 +154,8 @@ The following code was tested with NuGet Microsoft.IdentityModel.Clients.ActiveD string appId = "11111111-1111-1111-1111-111111111111"; // Paste your own app ID here string appSecret = "22222222-2222-2222-2222-222222222222"; // Paste your own app secret here for a test, and then store it in a safe place! - const string authority = "https://login.windows.net"; - const string wdatpResourceId = "https://api.securitycenter.windows.com"; + const string authority = "https://login.microsoftonline.com"; + const string wdatpResourceId = "https://api.securitycenter.microsoft.com"; AuthenticationContext auth = new AuthenticationContext($"{authority}/{tenantId}/"); ClientCredential clientCredential = new ClientCredential(appId, appSecret); @@ -204,7 +208,7 @@ The following is an example of sending a request to get a list of alerts **using ``` var httpClient = new HttpClient(); - var request = new HttpRequestMessage(HttpMethod.Get, "https://api.securitycenter.windows.com/api/alerts"); + var request = new HttpRequestMessage(HttpMethod.Get, "https://api.securitycenter.microsoft.com/api/alerts"); request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token); diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list.md index 785ac39e0d..4a8aac1dc4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list.md @@ -30,9 +30,9 @@ ms.topic: article ### Endpoint URI: -> The service base URI is: https://api.securitycenter.windows.com +> The service base URI is: https://api.securitycenter.microsoft.com > -> The queries based OData have the '/api' prefix. For example, to get Alerts you can send GET request to https://api.securitycenter.windows.com/api/alerts +> The queries based OData have the '/api' prefix. For example, to get Alerts you can send GET request to https://api.securitycenter.microsoft.com/api/alerts ### Versioning: @@ -40,9 +40,14 @@ ms.topic: article > > The current version is **V1.0**. > -> To use a specific version, use this format: `https://api.securitycenter.windows.com/api/{Version}`. For example: `https://api.securitycenter.windows.com/api/v1.0/alerts` +> To use a specific version, use this format: `https://api.securitycenter.microsoft.com/api/{Version}`. For example: `https://api.securitycenter.microsoft.com/api/v1.0/alerts` > -> If you don't specify any version (e.g. https://api.securitycenter.windows.com/api/alerts ) you will get to the latest version. +> If you don't specify any version (e.g. https://api.securitycenter.microsoft.com/api/alerts ) you will get to the latest version. + + +[!include[Improve request performance](../../includes/improve-request-performance.md)] + +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] Learn more about the individual supported entities where you can run API calls to and details such as HTTP request values, request headers and expected responses. diff --git a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md index b4a487ffbe..ef758bf348 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-odata-samples.md @@ -26,6 +26,10 @@ ms.topic: article - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +[!include[Improve request performance](../../includes/improve-request-performance.md)] + +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + If you are not familiar with OData queries, see: [OData V4 queries](https://www.odata.org/documentation/) Not all properties are filterable. @@ -150,14 +154,14 @@ HTTP GET https://api.securitycenter.microsoft.com/api/alerts?$top=10&$expand=ev Get all the alerts last updated after 2019-11-22 00:00:00 ```http -HTTP GET https://api.securitycenter.windows.com/api/alerts?$filter=lastUpdateTime+ge+2019-11-22T00:00:00Z +HTTP GET https://api.securitycenter.microsoft.com/api/alerts?$filter=lastUpdateTime+ge+2019-11-22T00:00:00Z ``` **Response:** ```json { - "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Alerts", + "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Alerts", "value": [ { "id": "da637308392288907382_-880718168", @@ -206,14 +210,14 @@ HTTP GET https://api.securitycenter.windows.com/api/alerts?$filter=lastUpdateTi Get all the devices with 'High' 'RiskScore' ```http -HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=riskScore+eq+'High' +HTTP GET https://api.securitycenter.microsoft.com/api/machines?$filter=riskScore+eq+'High' ``` **Response:** ```json { - "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", + "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines", "value": [ { "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", @@ -245,14 +249,14 @@ HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=riskScore+ Get top 100 devices with 'HealthStatus' not equals to 'Active' ```http -HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=healthStatus+ne+'Active'&$top=100 +HTTP GET https://api.securitycenter.microsoft.com/api/machines?$filter=healthStatus+ne+'Active'&$top=100 ``` **Response:** ```json { - "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", + "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines", "value": [ { "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", @@ -284,14 +288,14 @@ HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=healthStat Get all the devices that last seen after 2018-10-20 ```http -HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=lastSeen gt 2018-08-01Z +HTTP GET https://api.securitycenter.microsoft.com/api/machines?$filter=lastSeen gt 2018-08-01Z ``` **Response:** ```json { - "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#Machines", + "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines", "value": [ { "id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07", @@ -323,14 +327,14 @@ HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=lastSeen g Get all the Anti-Virus scans that the user Analyst@examples.onmicrosoft.com created using Microsoft Defender for Endpoint ```http -HTTP GET https://api.securitycenter.windows.com/api/machineactions?$filter=requestor eq 'Analyst@contoso.com' and type eq 'RunAntiVirusScan' +HTTP GET https://api.securitycenter.microsoft.com/api/machineactions?$filter=requestor eq 'Analyst@contoso.com' and type eq 'RunAntiVirusScan' ``` **Response:** ```json json{ - "@odata.context": "https://api.securitycenter.windows.com/api/$metadata#MachineActions", + "@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#MachineActions", "value": [ { "id": "2e9da30d-27f6-4208-81f2-9cd3d67893ba", @@ -355,7 +359,7 @@ json{ Get the count of open alerts for a specific device: ```http -HTTP GET https://api.securitycenter.windows.com/api/machines/123321d0c675eaa415b8e5f383c6388bff446c62/alerts/$count?$filter=status ne 'Resolved' +HTTP GET https://api.securitycenter.microsoft.com/api/machines/123321d0c675eaa415b8e5f383c6388bff446c62/alerts/$count?$filter=status ne 'Resolved' ``` **Response:** diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md index ce6887fc58..ddf250a58f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md @@ -26,6 +26,8 @@ ms.topic: article - Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + ## Limitations 1. You can only run a query on data from the last 30 days. 2. The results will include a maximum of 100,000 rows. @@ -50,7 +52,7 @@ Delegated (work or school account) | AdvancedQuery.Read | 'Run advanced queries' ## HTTP request ``` -POST https://api.securitycenter.windows.com/api/advancedqueries/run +POST https://api.securitycenter.microsoft.com/api/advancedqueries/run ``` ## Request headers @@ -81,7 +83,7 @@ Here is an example of the request. ``` -POST https://api.securitycenter.windows.com/api/advancedqueries/run +POST https://api.securitycenter.microsoft.com/api/advancedqueries/run Content-type: application/json { "Query":"DeviceProcessEvents diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md index cc1e69bc35..ea7771fd0a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-powershell.md @@ -24,6 +24,8 @@ ms.topic: article **Applies to:** - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + Run advanced queries using PowerShell, see [Advanced Hunting API](run-advanced-query-api.md). @@ -51,8 +53,8 @@ $tenantId = '00000000-0000-0000-0000-000000000000' # Paste your own tenant ID he $appId = '11111111-1111-1111-1111-111111111111' # Paste your own app ID here $appSecret = '22222222-2222-2222-2222-222222222222' # Paste your own app secret here -$resourceAppIdUri = 'https://api.securitycenter.windows.com' -$oAuthUri = "https://login.windows.net/$TenantId/oauth2/token" +$resourceAppIdUri = 'https://api.securitycenter.microsoft.com' +$oAuthUri = "https://login.microsoftonline.com/$TenantId/oauth2/token" $body = [Ordered] @{ resource = "$resourceAppIdUri" client_id = "$appId" @@ -72,10 +74,12 @@ where Run the following query: +[!include[Improve request performance](../../includes/improve-request-performance.md)] + ``` $query = 'RegistryEvents | limit 10' # Paste your own query here -$url = "https://api.securitycenter.windows.com/api/advancedqueries/run" +$url = "https://api.securitycenter.microsoft.com/api/advancedqueries/run" $headers = @{ 'Content-Type' = 'application/json' Accept = 'application/json' diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md index c7d5c9e145..ed35434cfc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-sample-python.md @@ -26,6 +26,8 @@ ms.topic: article - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) +[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] + Run advanced queries using Python, see [Advanced Hunting API](run-advanced-query-api.md). In this section, we share Python samples to retrieve a token and use it to run a query. @@ -36,6 +38,8 @@ In this section, we share Python samples to retrieve a token and use it to run a - Run the following commands: +[!include[Improve request performance](../../includes/improve-request-performance.md)] + ``` import json @@ -46,9 +50,9 @@ tenantId = '00000000-0000-0000-0000-000000000000' # Paste your own tenant ID her appId = '11111111-1111-1111-1111-111111111111' # Paste your own app ID here appSecret = '22222222-2222-2222-2222-222222222222' # Paste your own app secret here -url = "https://login.windows.net/%s/oauth2/token" % (tenantId) +url = "https://login.microsoftonline.com/%s/oauth2/token" % (tenantId) -resourceAppIdUri = 'https://api.securitycenter.windows.com' +resourceAppIdUri = 'https://api.securitycenter.microsoft.com' body = { 'resource' : resourceAppIdUri, @@ -78,7 +82,7 @@ where ``` query = 'RegistryEvents | limit 10' # Paste your own query here -url = "https://api.securitycenter.windows.com/api/advancedqueries/run" +url = "https://api.securitycenter.microsoft.com/api/advancedqueries/run" headers = { 'Content-Type' : 'application/json', 'Accept' : 'application/json', From 8dcc5e7537ad168e43797de95dc95dc8fc2f9378 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 18 Dec 2020 15:18:24 -0800 Subject: [PATCH 088/825] fix link --- windows/security/includes/microsoft-defender-api-usgov.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/includes/microsoft-defender-api-usgov.md b/windows/security/includes/microsoft-defender-api-usgov.md index 6f525901c4..ff93c71ecd 100644 --- a/windows/security/includes/microsoft-defender-api-usgov.md +++ b/windows/security/includes/microsoft-defender-api-usgov.md @@ -17,4 +17,4 @@ ms.topic: article --- >[!NOTE] ->If you are a US Government customer, please use the URIs listed in [here](gov.md#api). +>If you are a US Government customer, please use the URIs listed in [here](../threat-protection/microsoft-defender-atp/gov.md#api). From e2f3abd0d5bd9277f9c2d9afaa27da70b2f7ee6a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 18 Dec 2020 15:36:45 -0800 Subject: [PATCH 089/825] fix formatting --- .../security/threat-protection/microsoft-defender-atp/gov.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md index ddff7ba6a2..1c89d002cb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md @@ -109,7 +109,8 @@ Defender for Endpoint GCC High specific | ```us4-v20.events.data.microsoft.com`` ## API -Login endpoint: ```https://login.microsoftonline.us``` -Microsoft Defender for Endpoint API endpoint: ```https://api-gov.securitycenter.microsoft.us``` +- Login endpoint: ```https://login.microsoftonline.us``` + +- Microsoft Defender for Endpoint API endpoint: ```https://api-gov.securitycenter.microsoft.us``` From c43cdca4ea258efbfc26a9bc7807b0b43c8c5766 Mon Sep 17 00:00:00 2001 From: Peter Smith Date: Fri, 18 Dec 2020 16:22:38 -0800 Subject: [PATCH 090/825] Move "lockdown" security info to the bottom Per discussion with the VPN field team, lockdown is actually often a poor choice for customer -- it's more restrictive than many customer expect, leading to wasted time. It's still supported, but it should be at the bottom of the security list so that customer aren't instantly drawn to it. --- .../vpn/vpn-security-features.md | 35 ++++++++++--------- 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md index d8f4768540..19a298bef8 100644 --- a/windows/security/identity-protection/vpn/vpn-security-features.md +++ b/windows/security/identity-protection/vpn/vpn-security-features.md @@ -20,23 +20,6 @@ ms.author: dansimp - Windows 10 Mobile -## LockDown VPN - -A VPN profile configured with LockDown secures the device to only allow network traffic over the VPN interface. It has the following features: - -- The system attempts to keep the VPN connected at all times. -- The user cannot disconnect the VPN connection. -- The user cannot delete or modify the VPN profile. -- The VPN LockDown profile uses forced tunnel connection. -- If the VPN connection is not available, outbound network traffic is blocked. -- Only one VPN LockDown profile is allowed on a device. - -> [!NOTE] -> For built-in VPN, LockDown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type. - -Deploy this feature with caution, as the resultant connection will not be able to send or receive any network traffic without the VPN being connected. - - ## Windows Information Protection (WIP) integration with VPN Windows Information Protection provides capabilities allowing the separation and protection of enterprise data against disclosure across both company and personally owned devices, without requiring additional changes to the environments or the apps themselves. Additionally, when used with Rights Management Services (RMS), WIP can help to protect enterprise data locally. @@ -78,6 +61,24 @@ The following image shows the interface to configure traffic rules in a VPN Prof ![Add a traffic rule](images/vpn-traffic-rules.png) + +## LockDown VPN + +A VPN profile configured with LockDown secures the device to only allow network traffic over the VPN interface. It has the following features: + +- The system attempts to keep the VPN connected at all times. +- The user cannot disconnect the VPN connection. +- The user cannot delete or modify the VPN profile. +- The VPN LockDown profile uses forced tunnel connection. +- If the VPN connection is not available, outbound network traffic is blocked. +- Only one VPN LockDown profile is allowed on a device. + +> [!NOTE] +> For built-in VPN, LockDown VPN is only available for the Internet Key Exchange version 2 (IKEv2) connection type. + +Deploy this feature with caution, as the resultant connection will not be able to send or receive any network traffic without the VPN being connected. + + ## Related topics - [VPN technical guide](vpn-guide.md) From d8aee78ad6a711b7f5e55740d446a4bfe070a308 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Mon, 21 Dec 2020 15:25:26 +0530 Subject: [PATCH 091/825] updated-4715491 updated product name Microsoft Endpoint Manager --- ...ie11-delivery-through-automatic-updates.md | 2 +- .../windows/chromebook-migration-guide.md | 2 +- .../deploy-windows-10-in-a-school-district.md | 42 +++++++++---------- ...d-unsigned-app-to-code-integrity-policy.md | 4 +- ...plications-inside-a-virtual-environment.md | 2 +- .../mdm/appv-deploy-and-config.md | 4 +- ...ollment-using-windows-provisioning-tool.md | 2 +- ...dded-8-1-handheld-devices-to-windows-10.md | 6 +-- .../cortana-at-work/cortana-at-work-o365.md | 2 +- .../cortana-at-work-voice-commands.md | 2 +- .../provisioning-packages.md | 2 +- ...ith-system-center-configuration-manager.md | 4 +- .../ue-v/uev-deploy-required-features.md | 2 +- .../ue-v/uev-prepare-for-deployment.md | 2 +- windows/deployment/deploy-whats-new.md | 2 +- ...-windows-10-using-configuration-manager.md | 4 +- ...-10-using-pxe-and-configuration-manager.md | 4 +- ...f-windows-10-with-configuration-manager.md | 2 +- ...to-windows-10-with-configuraton-manager.md | 4 +- windows/deployment/deploy.md | 2 +- windows/deployment/mbr-to-gpt.md | 2 +- ...are-your-organization-for-windows-to-go.md | 2 +- .../windows-10-deployment-posters.md | 2 +- .../windows-10-deployment-scenarios.md | 2 +- .../windows-10-poc-sc-config-mgr.md | 10 ++--- windows/deployment/windows-10-poc.md | 2 +- 26 files changed, 58 insertions(+), 58 deletions(-) diff --git a/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md b/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md index edcb50cb9e..bd0befaee9 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md +++ b/browsers/internet-explorer/ie11-deploy-guide/ie11-delivery-through-automatic-updates.md @@ -68,7 +68,7 @@ Additional information on Internet Explorer 11, including a Readiness Toolkit, t ## Availability of Internet Explorer 11 -Automatic Updates will start to distribute Internet Explorer 11 shortly after the final release of the product and will distribute it through the Microsoft Endpoint Configuration Manager and WSUS. +Automatic Updates will start to distribute Internet Explorer 11 shortly after the final release of the product and will distribute it through the Microsoft Endpoint Manager and WSUS. ## Prevent automatic installation of Internet Explorer 11 with WSUS diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md index cbbdb3502b..3cd18bebdd 100644 --- a/education/windows/chromebook-migration-guide.md +++ b/education/windows/chromebook-migration-guide.md @@ -457,7 +457,7 @@ Table 5. Select on-premises AD DS, Azure AD, or hybrid     - + diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index 2d08a4c82d..7dd7bebd5a 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -202,7 +202,7 @@ Before you select the deployment and management methods, you need to review the |Scenario feature |Cloud-centric|On-premises and cloud| |---|---|---| |Identity management | Azure AD (stand-alone or integrated with on-premises AD DS) | AD DS integrated with Azure AD | -|Windows 10 deployment | MDT only | Microsoft Endpoint Configuration Manager with MDT | +|Windows 10 deployment | MDT only | Microsoft Endpoint Manager with MDT | |Configuration setting management | Intune | Group Policy

    Intune| |App and update management | Intune |Microsoft Endpoint Configuration Manager

    Intune| @@ -216,14 +216,14 @@ These scenarios assume the need to support: Some constraints exist in these scenarios. As you select the deployment and management methods for your device, keep the following constraints in mind: * You can use Group Policy or Intune to manage configuration settings on a device but not both. -* You can use Microsoft Endpoint Configuration Manager or Intune to manage apps and updates on a device but not both. +* You can use Microsoft Endpoint Manager or Intune to manage apps and updates on a device but not both. * You cannot manage multiple users on a device with Intune if the device is AD DS domain joined. Use the cloud-centric scenario and on-premises and cloud scenario as a guide for your district. You may need to customize these scenarios, however, based on your district. As you go through the [Select the deployment methods](#select-the-deployment-methods), [Select the configuration setting management methods](#select-the-configuration-setting-management-methods), and the [Select the app and update management products](#select-the-app-and-update-management-products) sections, remember these scenarios and use them as the basis for your district. ### Select the deployment methods -To deploy Windows 10 and your apps, you can use MDT by itself or Microsoft Endpoint Configuration Manager and MDT together. For a district, there are a few ways to deploy Windows 10 to devices. Table 2 lists the methods that this guide describes and recommends. Use this information to determine which combination of deployment methods is right for your institution. +To deploy Windows 10 and your apps, you can use MDT by itself or Microsoft Endpoint Manager and MDT together. For a district, there are a few ways to deploy Windows 10 to devices. Table 2 lists the methods that this guide describes and recommends. Use this information to determine which combination of deployment methods is right for your institution.
    X
    Use Microsoft Endpoint Configuration Manager for managementUse Microsoft Endpoint Manager for management X X
    @@ -291,7 +291,7 @@ Select this method when you:

    The disadvantages of this method are that it:

      -
    • Carries an additional cost for Microsoft Endpoint Configuration Manager server licenses (if the institution does not have Configuration Manager already).
      • +
    • Carries an additional cost for Microsoft Endpoint Manager server licenses (if the institution does not have Configuration Manager already).
    • Can deploy Windows 10 only to domain-joined (institution-owned devices).
    • Requires an AD DS infrastructure (if the institution does not have AD DS already).
    @@ -307,7 +307,7 @@ Record the deployment methods you selected in Table 3. |Selection | Deployment method| |--------- | -----------------| | |MDT by itself | -| |Microsoft Endpoint Configuration Manager and MDT| +| |Microsoft Endpoint Manager and MDT| *Table 3. Deployment methods selected* @@ -483,12 +483,12 @@ Select this method when you:

    - +
    Microsoft Endpoint Configuration Manager and Intune (hybrid)Microsoft Endpoint Manager and Intune (hybrid)

    Configuration Manager and Intune together extend Configuration Manager from an on-premises management system for domain-joined devices to a solution that can manage devices regardless of their location and connectivity options. This hybrid option provides the benefits of both Configuration Manager and Intune.

    Configuration Manager and Intune in the hybrid configuration allow you to support application management throughout the entire application life cycle. You can deploy, upgrade, manage multiple versions, and retire applications by using Configuration Manager, and you can manage Windows desktop and Microsoft Store applications for both institution-owned and personal devices.

    Select this method when you:

    Administrative Templates\Microsoft Edge\SmartScreen settings\Prevent bypassing of Microsoft Defender SmartScreen warnings about downloads (Microsoft Edge version 77 or later) Enable. Stops employees from ignoring warning messages and continuing to download potentially malicious files. From b69035ebc4644ab790b7a6d124c2cf99704fe61f Mon Sep 17 00:00:00 2001 From: ShannonLeavitt Date: Tue, 27 Oct 2020 13:58:45 -0600 Subject: [PATCH 010/825] edit pass: enable-network-unlock --- .../bitlocker-how-to-enable-network-unlock.md | 44 ++++++++----------- 1 file changed, 18 insertions(+), 26 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index 5c7b1190b1..7ba0b08f43 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -1,5 +1,5 @@ --- -title: BitLocker How to enable Network Unlock (Windows 10) +title: BitLocker - How to enable Network Unlock (Windows 10) description: This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. ms.assetid: be45bc28-47db-4931-bfec-3c348151d2e9 ms.reviewer: @@ -23,45 +23,37 @@ ms.custom: bitlocker **Applies to** - Windows 10 -This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. +This article for IT professionals describes how BitLocker Network Unlock works and how to configure it. -Network Unlock was introduced in Windows 8 and Windows Server 2012 as a BitLocker protector option for operating system volumes. Network Unlock enables easier management for BitLocker enabled desktops and servers in a domain environment by providing automatic unlock of operating system volumes at system reboot when connected to a wired corporate network. This feature requires the client hardware to have a DHCP driver implemented in its UEFI firmware. -Without Network Unlock, operating system volumes protected by TPM+PIN protectors require a PIN to be entered when a computer reboots or resumes from hibernation (for example, by Wake on LAN). This can make it difficult to enterprises to roll out software patches to unattended desktops and remotely administered servers. +Network Unlock was introduced in Windows 8 and Windows Server 2012 as a BitLocker protector option for operating system volumes. Network Unlock helps you manage BitLocker-enabled desktops and servers in a domain environment by automatically unlocking operating system volumes when the system is rebooted and is connected to a wired corporate network. This feature requires the client hardware to have a DHCP driver implemented in its UEFI firmware. -Network Unlock allows BitLocker-enabled systems with TPM+PIN and that meet the hardware requirements to boot into Windows without user intervention. Network Unlock works in a similar fashion to the TPM+StartupKey at boot. Rather than needing to read the StartupKey from USB media, however, the key for Network Unlock is composed from a key stored in the TPM and an encrypted network key that is sent to the server, decrypted and returned to the client in a secure session. +Without Network Unlock, operating system volumes that are protected by TPM+PIN protectors require a PIN when a computer reboots or resumes after hibernation (for example, by Wake on LAN). For enterprises, this setup can make software patches difficult to roll out to unattended desktops and remotely administered servers. -This topic contains: - -- [Network Unlock core requirements](#bkmk-nunlockcorereqs) -- [Network Unlock sequence](#bkmk-networkunlockseq) -- [Configure Network Unlock](#bkmk-configuringnetworkunlock) -- [Create the certificate template for Network Unlock](#bkmk-createcerttmpl) -- [Turning off Network Unlock](#bkmk-turnoffnetworkunlock) -- [Update Network Unlock certificates](#bkmk-updatecerts) -- [Troubleshoot Network Unlock](#bkmk-troubleshoot) -- [Configure Network Unlock on unsupported systems](#bkmk-unsupportedsystems) +Network Unlock allows BitLocker-enabled systems that use TPM+PIN and that meet the hardware requirements to boot into Windows without user intervention. Network Unlock works like the TPM+StartupKey at boot. But the StartupKey doesn't need to be read from USB media. Instead, the key for Network Unlock is composed from a key that's stored in the TPM and an encrypted network key that's sent to the server. It's decrypted and returned to the client in a secure session. ## Network Unlock core requirements -Network Unlock must meet mandatory hardware and software requirements before the feature can automatically unlock domain joined systems. These requirements include: +Network Unlock must meet mandatory hardware and software requirements before the feature can automatically unlock domain-joined systems: - You must be running at least Windows 8 or Windows Server 2012. -- Any supported operating system with UEFI DHCP drivers can be Network Unlock clients. +- Any supported operating system that uses UEFI DHCP drivers can be Network Unlock clients. - Network Unlock clients must have a TPM chip and at least one TPM protector. -- A server running the Windows Deployment Services (WDS) role on any supported server operating system. -- BitLocker Network Unlock optional feature installed on any supported server operating system. -- A DHCP server, separate from the WDS server. -- Properly configured public/private key pairing. -- Network Unlock Group Policy settings configured. +- You must have a server running the Windows Deployment Services (WDS) role on any supported server operating system. +- The BitLocker Network Unlock optional feature can be installed on any supported server operating system. +- You must have a DHCP server, separate from the WDS server. +- You must have a properly configured public/private key pairing. +- Network Unlock Group Policy settings must be configured. -The network stack must be enabled to use the Network Unlock feature. Equipment manufacturers deliver their products in various states and with different BIOS menus, so you need to confirm that the network stack has been enabled in the BIOS before starting the computer. +The network stack must be enabled to use the Network Unlock feature. Equipment manufacturers deliver their products in various states and with different BIOS menus, so you need to confirm that the network stack has been enabled in the BIOS before you start the computer. > [!NOTE] -> To properly support DHCP within UEFI, the UEFI-based system should be in native mode without a compatibility support module (CSM) enabled. +> To properly support DHCP within UEFI, the UEFI-based system should be in native mode and shouldn't have a compatibility support module (CSM) enabled. -For Network Unlock to work reliably on computers running Windows 8 and later, the first network adapter on the computer, usually the onboard adapter, must be configured to support DHCP and used for Network Unlock. This is especially worth noting when you have multiple adapters, and you wish to configure one without DHCP, such as for a lights-out management protocol. This configuration is necessary because Network Unlock will stop enumerating adapters when it reaches one with a DHCP port failure for any reason. Thus, if the first enumerated adapter does not support DHCP, is not plugged into the network, or fails to report availability of the DHCP port for any reason, then Network Unlock will fail. +On computers running Windows 8 and later, the first network adapter on the computer, usually the onboard adapter, must be configured to support DHCP. This adapter must be used for Network Unlock. + +Use this configuration especially when you have multiple adapters and you want to configure one without DHCP, such as for a lights-out management protocol. The configuration is necessary because Network Unlock stops enumerating adapters when it reaches an adapter that has a DHCP port that has failed for any reason. So if the first enumerated adapter doesn't support DHCP, isn't plugged into the network, or fails to report availability of the DHCP port for any reason, then Network Unlock will fail. -The Network Unlock server component installs on supported versions of Windows Server 2012 and later as a Windows feature using Server Manager or Windows PowerShell cmdlets. The feature name is BitLocker Network Unlock in Server Manager and BitLocker-NetworkUnlock in Windows PowerShell. This feature is a core requirement. +On supported versions of Windows Server 2012 and later, the Network Unlock server component installs as a Windows feature. It uses Server Manager or Windows PowerShell cmdlets. In Server Manager, the feature name is BitLocker Network Unlock. In Windows PowerShell, the feature name is BitLocker-NetworkUnlock. This feature is a core requirement. Network Unlock requires Windows Deployment Services (WDS) in the environment where the feature will be utilized. Configuration of the WDS installation is not required; however, the WDS service needs to be running on the server. From 5c9fae720f702d3253bc77c2f786571e0ed47a31 Mon Sep 17 00:00:00 2001 From: ShannonLeavitt Date: Tue, 27 Oct 2020 17:55:11 -0600 Subject: [PATCH 011/825] more edits --- .../bitlocker-how-to-enable-network-unlock.md | 174 +++++++++--------- 1 file changed, 85 insertions(+), 89 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index 7ba0b08f43..a514c327a4 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -55,138 +55,134 @@ Use this configuration especially when you have multiple adapters and you want t On supported versions of Windows Server 2012 and later, the Network Unlock server component installs as a Windows feature. It uses Server Manager or Windows PowerShell cmdlets. In Server Manager, the feature name is BitLocker Network Unlock. In Windows PowerShell, the feature name is BitLocker-NetworkUnlock. This feature is a core requirement. -Network Unlock requires Windows Deployment Services (WDS) in the environment where the feature will be utilized. Configuration of the WDS installation is not required; however, the WDS service needs to be running on the server. +Network Unlock requires WDS in the environment where the feature will be used. Configuration of the WDS installation is not required. But the WDS service needs to be running on the server. -The network key is stored on the system drive along with an AES 256 session key, and encrypted with the 2048-bit RSA public key of the unlock server's certificate. The network key is decrypted with the help of a provider on a supported version of Windows Server running WDS, and returned encrypted with its corresponding session key. +The network key is stored on the system drive along with an AES 256 session key. It's encrypted with the 2048-bit RSA public key of the unlock server's certificate. The network key is decrypted with the help of a provider on a supported version of Windows Server that's running WDS. It's returned encrypted with its corresponding session key. ## Network Unlock sequence -The unlock sequence starts on the client side, when the Windows boot manager detects the existence of Network Unlock protector. It leverages the DHCP driver in UEFI to obtain an IP address for IPv4 and then broadcasts a vendor-specific DHCP request that contains the network key and a session key for the reply, all encrypted by the server's Network Unlock certificate, as described above. The Network Unlock provider on the supported WDS server recognizes the vendor-specific request, decrypts it with the RSA private key, and returns the network key encrypted with the session key via its own vendor-specific DHCP reply. +The unlock sequence starts on the client side, when the Windows boot manager detects the existence of the Network Unlock protector. It uses the DHCP driver in UEFI to get an IP address for IPv4. Then it broadcasts a vendor-specific DHCP request that contains the network key and a session key for the reply, all encrypted by the server's Network Unlock certificate, as described earlier. The Network Unlock provider on the supported WDS server recognizes the vendor-specific request, decrypts it with the RSA private key, and returns the network key encrypted with the session key via its own vendor-specific DHCP reply. -On the server side, the WDS server role has an optional plugin component, like a PXE provider, which is what handles the incoming Network Unlock requests. The provider can also be configured with subnet restrictions, which would require that the IP address provided by the client in the Network Unlock request belong to a permitted subnet in order to release the network key to the client. In instances where the Network Unlock provider is unavailable, BitLocker fails over to the next available protector to unlock the drive. In a typical configuration, this means the standard TPM+PIN unlock screen is presented to unlock the drive. +On the server side, the WDS server role has an optional plug-in component, like a PXE (preboot execution environment) provider, which is what handles the incoming Network Unlock requests. The provider can also be configured with subnet restrictions. These restrictions would require that the IP address provided by the client in the Network Unlock request belong to a permitted subnet in order to release the network key to the client. If the Network Unlock provider is unavailable, then BitLocker fails over to the next available protector to unlock the drive. So in a typical configuration, the standard TPM+PIN unlock screen is presented to unlock the drive. -The server side configuration to enable Network Unlock also requires provisioning a 2048-bit RSA public/private key pair in the form of an X.509 certificate, and for the public key certificate to be distributed to the clients. This certificate must be managed and deployed through the Group Policy editor directly on a domain controller with at least a Domain Functional Level of Windows Server 2012. This certificate is the public key that encrypts the intermediate network key (which is one of the two secrets required to unlock the drive; the other secret is stored in the TPM). +The server-side configuration to enable Network Unlock also requires provisioning a 2048-bit RSA public/private key pair in the form of an X.509 certificate. The configuration also requires the public key certificate to be distributed to the clients. This certificate must be managed and deployed through the Group Policy editor directly on a domain controller that has a domain functional level of at least Windows Server 2012. This certificate is the public key that encrypts the intermediate network key. The intermediate network key is one of the two secrets required to unlock the drive; the other secret is stored in the TPM. -![bitlocker network unlock sequence](images/bitlockernetworkunlocksequence.png) +![Diagram showing the BitLocker network unlock sequence.](images/bitlockernetworkunlocksequence.png) -**Phases in the Network Unlock process** +The Network Unlock process follows these phases: -1. The Windows boot manager detects that a Network Unlock protector exists in the BitLocker configuration. -2. The client computer uses its DHCP driver in the UEFI to obtain a valid IPv4 IP address. +1. The Windows boot manager detects a Network Unlock protector in the BitLocker configuration. +2. The client computer uses its DHCP driver in the UEFI to get a valid IPv4 IP address. 3. The client computer broadcasts a vendor-specific DHCP request that contains: - 1. A Network Key (a 256-bit intermediate key) encrypted using the 2048-bit RSA Public Key of the Network Unlock certificate from the WDS server. - 2. An AES-256 session key for the reply. + - A network key (a 256-bit intermediate key) that's encrypted by the 2048-bit RSA public key of the Network Unlock certificate from the WDS server. + - An AES-256 session key for the reply. 4. The Network Unlock provider on the WDS server recognizes the vendor-specific request. -5. The provider decrypts it with the WDS server’s BitLocker Network Unlock certificate RSA private key. -6. The WDS provider then returns the network key encrypted with the session key using its own vendor-specific DHCP reply to the client computer. This forms an intermediate key. -7. The returned intermediate key is then combined with another local 256-bit intermediate key that can only be decrypted by the TPM. +5. The provider decrypts it with the WDS server's BitLocker Network Unlock certificate RSA private key. +6. The WDS provider then returns the network key encrypted with the session key by using its own vendor-specific DHCP reply to the client computer. This key is an intermediate key. +7. The returned intermediate key is then combined with another local 256-bit intermediate key. This key can be decrypted only by the TPM. 8. This combined key is used to create an AES-256 key that unlocks the volume. 9. Windows continues the boot sequence. ## Configure Network Unlock -The following steps allow an administrator to configure Network Unlock in a domain where the Domain Functional Level is at least Windows Server 2012. +The following steps allow an administrator to configure Network Unlock in a domain where the domain functional level is at least Windows Server 2012. ### Install the WDS Server role -The BitLocker Network Unlock feature will install the WDS role if it is not already installed. If you want to install it separately before you install BitLocker Network Unlock you can use Server Manager or Windows PowerShell. To install the role using Server Manager, select the **Windows Deployment Services** role in Server Manager. +The BitLocker Network Unlock feature installs the WDS role if it's not already installed. If you want to install it separately before you install BitLocker Network Unlock, use Server Manager or Windows PowerShell. To install the role by using Server Manager, select the **Windows Deployment Services** role in Server Manager. -To install the role using Windows PowerShell, use the following command: +To install the role by using Windows PowerShell, use the following command: ```powershell Install-WindowsFeature WDS-Deployment ``` -You must configure the WDS server so that it can communicate with DHCP (and optionally Active Directory Domain Services) and the client computer. You can do using the WDS management tool, wdsmgmt.msc, which starts the Windows Deployment Services Configuration Wizard. +Configure the WDS server so that it can communicate with DHCP (and optionally Active Directory Domain Services) and the client computer. You can do so by using the WDS management tool, `wdsmgmt.msc`. This tool starts the Windows Deployment Services Configuration Wizard. -### Confirm the WDS Service is running +### Confirm the WDS service is running -To confirm the WDS service is running, use the Services Management Console or Windows PowerShell. To confirm the service is running in Services Management Console, open the console using **services.msc** and check the status of the Windows Deployment Services service. +To confirm the WDS service is running, use the Services Management console or Windows PowerShell. To confirm the service is running in the Services Management console, open the console by using `services.msc`. Then check the status of the WDS service. -To confirm the service is running using Windows PowerShell, use the following command: +To confirm the service is running by using Windows PowerShell, use the following command: ```powershell Get-Service WDSServer ``` ### Install the Network Unlock feature -To install the Network Unlock feature, use Server Manager or Windows PowerShell. To install the feature using Server Manager, select the **BitLocker Network Unlock** feature in the Server Manager console. +To install the Network Unlock feature, use Server Manager or Windows PowerShell. To install the feature by using Server Manager, in the Server Manager console, select **BitLocker Network Unlock**. -To install the feature using Windows PowerShell, use the following command: +To install the feature by using Windows PowerShell, use the following command: ```powershell Install-WindowsFeature BitLocker-NetworkUnlock ``` ### Create the certificate template for Network Unlock -A properly configured Active Directory Services Certification Authority can use this certificate template to create and issue Network Unlock certificates. +A properly configured Active Directory Services Certification Authority can use the certificate template to create and issue Network Unlock certificates. -1. Open the Certificates Template snap-in (certtmpl.msc). -2. Locate the User template. Right-click the template name and select **Duplicate Template**. -3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8 respectively. Ensure the **Show resulting changes** dialog box is selected. -4. Select the **General** tab of the template. The **Template display name** and **Template name** should clearly identify that the template will be used for Network Unlock. Clear the checkbox for the **Publish certificate in Active Directory** option. -5. Select the **Request Handling** tab. Select **Encryption** from the **Purpose** drop down menu. Ensure the **Allow private key to be exported** option is selected. -6. Select the **Cryptography** tab. Set the **Minimum key size** to 2048. (Any Microsoft cryptographic provider that supports RSA can be used for this template, but for simplicity and forward compatibility we recommend using the **Microsoft Software Key Storage Provider**.) -7. Select the **Requests must use one of the following providers** option and clear all options except for the cryptography provider you selected, such as the **Microsoft Software Key Storage Provider**. -8. Select the **Subject Name** tab. Select **Supply in the request**. Select **OK** if the certificate templates pop-up dialog appears. -9. Select the **Issuance Requirements** tab. Select both **CA certificate manager approval** and **Valid existing certificate** options. -10. Select the **Extensions** tab. Select **Application Policies** and choose **Edit…**. -11. In the **Edit Application Policies Extension** options dialog box, select **Client Authentication**, **Encrypting File System**, **and Secure Email** and choose **Remove**. -12. On the **Edit Application Policies Extension** dialog box, select **Add**. -13. On the **Add Application Policy** dialog box, select **New**. In the **New Application Policy** dialog box enter the following information in the space provided and then click **OK** to create the BitLocker Network Unlock application policy: +1. Open the certificate template snap-in (`certtmpl.msc`). +2. Locate the user template. Right-click the template name and then select **Duplicate Template**. +3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8, respectively. Ensure the **Show resulting changes** dialog box is selected. +4. Select the **General** tab of the template. The **Template display name** and **Template name** should clearly identify that the template will be used for Network Unlock. Clear the check box for **Publish certificate in Active Directory**. +5. Select the **Request Handling** tab. In the **Purpose** drop-down menu, select **Encryption**. Ensure the **Allow private key to be exported** option is selected. +6. Select the **Cryptography** tab. Set the **Minimum key size** to *2048*. (For this template, you can use any Microsoft cryptographic provider that supports RSA. But for simplicity and forward compatibility, we recommend using **Microsoft Software Key Storage Provider**.) +7. Select **Requests must use one of the following providers**. Then clear all options except for your selected cryptography provider, such as the **Microsoft Software Key Storage Provider**. +8. Select the **Subject Name** tab. Select **Supply in the request**. If the certificate templates dialog box appears, select **OK**. +9. Select the **Issuance Requirements** tab. Then select both **CA certificate manager approval** and **Valid existing certificate**. +10. Select the **Extensions** tab. Then select **Application Policies** > **Edit**. +11. In the **Edit Application Policies Extension** dialog box, select **Client Authentication**, **Encrypting File System**, and **Secure Email**. Then choose **Remove**. +12. In the **Edit Application Policies Extension** dialog box, select **Add**. +13. In the **Add Application Policy** dialog box, select **New**. In the **New Application Policy** dialog box, enter the following information in the space provided and then click **OK** to create the BitLocker Network Unlock application policy: - - **Name:** **BitLocker Network Unlock** - - **Object Identifier:** **1.3.6.1.4.1.311.67.1.1** + - **Name**: **BitLocker Network Unlock** + - **Object Identifier**: **1.3.6.1.4.1.311.67.1.1** -14. Select the newly created **BitLocker Network Unlock** application policy and select **OK**. -15. With the **Extensions** tab still open, select the **Edit Key Usage Extension** dialog, select the **Allow key exchange only with key encryption (key encipherment)** option. Select the **Make this extension critical** option. +14. Select the newly created **BitLocker Network Unlock** application policy and then select **OK**. +15. With the **Extensions** tab still open, select **Edit Key Usage Extension**, and then select **Allow key exchange only with key encryption (key encipherment)**. Then select **Make this extension critical**. 16. Select the **Security** tab. Confirm that the **Domain Admins** group has been granted **Enroll** permission. 17. Select **OK** to complete configuration of the template. -To add the Network Unlock template to the Certification Authority, open the Certification Authority snap-in (certsrv.msc). Right-click the **Certificate Templates** item and choose **New, Certificate Template to issue**. Select the previously created BitLocker Network Unlock certificate. +To add the Network Unlock template to the certificate authority, open the certificate authority snap-in (`certsrv.msc`). Right-click **Certificate Templates** and then choose **New, Certificate Template to issue**. Select the previously created BitLocker Network Unlock certificate. -After adding the Network Unlock template to the Certification Authority, this certificate can be used to configure BitLocker Network Unlock. +After you add the Network Unlock template to the certificate authority, you can use this certificate to configure BitLocker Network Unlock. ### Create the Network Unlock certificate -Network Unlock can use imported certificates from an existing PKI infrastructure, or you can use a self-signed certificate. +Network Unlock can use imported certificates from an existing public key infrastructure (PKI), or you can use a self-signed certificate. -To enroll a certificate from an existing certification authority (CA), do the following: +To enroll a certificate from an existing certificate authority: -1. Open Certificate Manager on the WDS server using **certmgr.msc** -2. Under the Certificates - Current User item, right-click Personal -3. Select All Tasks, then **Request New Certificate** -4. Select **Next** when the Certificate Enrollment wizard opens -5. Select Active Directory Enrollment Policy -6. Choose the certificate template created for Network Unlock on the Domain controller and select **Enroll**. When prompted for more information, add the following attribute to the certificate: +1. On the WDS server, open Certificate Manager by using `certmgr.msc`. +2. Under **Certificates - Current User**, right-click **Personal**. +3. Select **All Tasks** > **Request New Certificate**. +4. When the Certificate Enrollment wizard opens, select **Next**. +5. Select **Active Directory Enrollment Policy**. +6. Choose the certificate template that was created for Network Unlock on the domain controller. Then select **Enroll**. +1. When you're prompted for more information, select **Subject Name** and provide a friendly name value. Your friendly name should include information for the domain or organizational unit for the certificate. Here's an example: *BitLocker Network Unlock Certificate for Contoso domain*. +7. Create the certificate. Ensure the certificate appears in the **Personal** folder. +8. Export the public key certificate for Network Unlock: - - Select the **Subject Name** pane and provide a friendly name value. It is suggested that this friendly name include information for the domain or organizational unit for the certificate. For example "BitLocker Network Unlock Certificate for Contoso domain" - -7. Create the certificate. Ensure the certificate appears in the Personal folder. -8. Export the public key certificate for Network Unlock - - 1. Create a .cer file by right-clicking the previously created certificate, choosing **All Tasks**, then **Export**. + 1. Create a *.cer* file by right-clicking the previously created certificate and choosing **All Tasks** > **Export**. 2. Select **No, do not export the private key**. - 3. Select **DER encoded binary X.509** and complete exporting the certificate to a file. - 4. Give the file a name such as BitLocker-NetworkUnlock.cer. - -9. Export the public key with a private key for Network Unlock - - 1. Create a .pfx file by right-clicking the previously created certificate, choosing **All Tasks**, then **Export**. + 3. Select **DER encoded binary X.509** and then finish exporting the certificate to a file. + 4. Give the file a name, such as *BitLocker-NetworkUnlock.cer*. +9. Export the public key with a private key for Network Unlock: + 1. Create a *.pfx* file by right-clicking the previously created certificate. Then choose **All Tasks** > **Export**. 2. Select **Yes, export the private key**. - 3. Complete the wizard to create the .pfx file. + 3. Complete the steps to create the *.pfx* file. To create a self-signed certificate, you can either use the New-SelfSignedCertificate cmdlet in Windows PowerShell or use Certreq. -Windows PowerShell example: +Here's a Windows PowerShell example: ```powershell New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -Subject "CN=BitLocker Network Unlock certificate" -Provider "Microsoft Software Key Storage Provider" -KeyUsage KeyEncipherment -KeyUsageProperty Decrypt,Sign -KeyLength 2048 -HashAlgorithm sha512 -TextExtension @("1.3.6.1.4.1.311.21.10={text}OID=1.3.6.1.4.1.311.67.1.1","2.5.29.37={text}1.3.6.1.4.1.311.67.1.1") ``` -Certreq example: +Here's a Certreq example: -1. Create a text file with an .inf extension. For example, notepad.exe BitLocker-NetworkUnlock.inf. +1. Create a text file with an *.inf* extension. For example, *notepad.exe* *BitLocker-NetworkUnlock.inf*. 2. Add the following contents to the previously created file: ```ini @@ -208,53 +204,53 @@ Certreq example: _continue_ = "1.3.6.1.4.1.311.67.1.1" ``` -3. Open an elevated command prompt and use the certreq tool to create a new certificate using the following command, specifying the full path to the file created previously, along with the file name: +3. Open an elevated command prompt and use the `certreq` tool to create a new certificate. Use the following command, specifying the full path to the file that you created previously. Also specify the file name: ```cmd certreq -new BitLocker-NetworkUnlock.inf BitLocker-NetworkUnlock.cer ``` -4. Verify the previous command properly created the certificate by confirming the .cer file exists. -5. Launch Certificates - Local Machine by running **certlm.msc**. -6. Create a .pfx file by opening the **Certificates – Local Computer\\Personal\\Certificates** path in the navigation pane, right-clicking the previously imported certificate, selecting **All Tasks**, then **Export**. Follow through the wizard to create the .pfx file. +4. Verify the previous command properly created the certificate by confirming the *.cer* file exists. +5. Launch **Certificates - Local Machine** by running `certlm.msc`. +6. Create a *.pfx* file by opening the *Certificates – Local Computer\\Personal\\Certificates* path in the navigation pane. Right-click the previously imported certificate, and then select **All Tasks** > **Export**. Follow through the steps to create the *.pfx* file. ### Deploy the private key and certificate to the WDS server -With the certificate and key created, deploy them to the infrastructure to properly unlock systems. To deploy the certificates, do the following: +Now that the certificate and key are created, deploy them to the infrastructure to properly unlock systems. To deploy the certificates: -1. On the WDS server, open a new MMC and add the certificates snap-in. Select the computer account and local computer when given the options. -2. Right-click the Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock item, choose All Tasks, then **Import**. -3. In the **File to Import** dialog, choose the .pfx file created previously. -4. Enter the password used to create the .pfx and complete the wizard. +1. On the WDS server, open a new Microsoft Management Console (MMC) and then add the certificates snap-in. Select the computer account and local computer when these options appear. +2. Right-click **Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock** and then choose **All Tasks** > **Import**. +3. In the **File to Import** dialog box, choose the *.pfx* file that you created previously. +4. Enter the password that you used to create the *.pfx*, and finish the steps. ### Configure Group Policy settings for Network Unlock -With certificate and key deployed to the WDS server for Network Unlock, the final step is to use Group Policy settings to deploy the public key certificate to computers that you want to be able to unlock using the Network Unlock key. Group Policy settings for BitLocker can be found under **\\Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption** using the Local Group Policy Editor or the Microsoft Management Console. +Now that you've deployed the certificate and key to the WDS server for Network Unlock, the final step is to use Group Policy settings to deploy the public key certificate to computers that you want to be able to unlock by using the Network Unlock key. You can find Group Policy settings for BitLocker in *\\Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption* by using the Local Group Policy Editor or the MMC. -The following steps describe how to enable the Group Policy setting that is a requirement for configuring Network Unlock. +To enable the Group Policy setting that's required to configure Network Unlock: -1. Open Group Policy Management Console (gpmc.msc). -2. Enable the policy **Require additional authentication at startup** and select the **Require startup PIN with TPM** or **Allow startup PIN with TPM** option. +1. Open Group Policy Management Console (`gpmc.msc`). +2. Enable the policy **Require additional authentication at startup**, and then select **Require startup PIN with TPM** or **Allow startup PIN with TPM**. 3. Turn on BitLocker with TPM+PIN protectors on all domain-joined computers. -The following steps describe how to deploy the required Group Policy setting: +To deploy the required Group Policy setting: > [!NOTE] > The Group Policy settings **Allow network unlock at startup** and **Add Network Unlock Certificate** were introduced in Windows Server 2012. -1. Copy the .cer file created for Network Unlock to the domain controller. -2. On the domain controller, launch Group Policy Management Console (gpmc.msc). +1. Copy the *.cer* file that you created for Network Unlock to the domain controller. +2. On the domain controller, launch Group Policy Management Console (`gpmc.msc`). 3. Create a new Group Policy Object or modify an existing object to enable the **Allow network unlock at startup** setting. 4. Deploy the public certificate to clients: - 1. Within Group Policy Management Console, navigate to the following location: **Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate**. - 2. Right-click the folder and choose **Add Network Unlock Certificate**. - 3. Follow the wizard steps and import the .cer file that was copied earlier. + 1. In Group Policy Management Console, go to the following location: *Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate*. + 2. Right-click the folder and then choose **Add Network Unlock Certificate**. + 3. Follow the steps and import the *.cer* file that you copied earlier. -> [!NOTE] -> Only one network unlock certificate can be available at a time. If a new certificate is required, delete the current certificate before deploying a new one. The Network Unlock certificate is located in the **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** key on the client computer. + > [!NOTE] + > Only one network unlock certificate can be available at a time. If a new certificate is required, delete the current certificate before you deploy a new one. The Network Unlock certificate is located in the *HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP* key on the client computer. -5. Reboot the clients after deploying the group policy. +5. Reboot the clients after you deploy the group policy. > [!NOTE] > The **Network (Certificate Based)** protector will be added only after a reboot with the policy enabled and a valid certificate present in the FVE_NKP store. From 373561d1e82e0e6908a478803e5cac7f5212c19e Mon Sep 17 00:00:00 2001 From: ShannonLeavitt Date: Wed, 28 Oct 2020 07:57:44 -0600 Subject: [PATCH 012/825] more edits --- .../bitlocker-how-to-enable-network-unlock.md | 118 +++++++++--------- 1 file changed, 60 insertions(+), 58 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index a514c327a4..4a7d9d600f 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -252,15 +252,15 @@ To deploy the required Group Policy setting: 5. Reboot the clients after you deploy the group policy. > [!NOTE] - > The **Network (Certificate Based)** protector will be added only after a reboot with the policy enabled and a valid certificate present in the FVE_NKP store. + > The **Network (Certificate Based)** protector is added only after a reboot. The policy must be enabled, and a valid certificate must be present in the FVE_NKP store. -### Subnet policy configuration files on WDS Server (Optional) +### Subnet policy configuration files on the WDS server (Optional) -By default, all clients with the correct Network Unlock Certificate and valid Network Unlock protectors that have wired access to a Network Unlock-enabled WDS server via DHCP are unlocked by the server. A subnet policy configuration file on the WDS server can be created to limit which subnet(s) Network Unlock clients can use to unlock. +By default, clients are unlocked by the server if they have the correct Network Unlock certificate and valid Network Unlock protectors that have wired access to a Network Unlock-enabled WDS server via DHCP. You can create a subnet policy configuration file on the WDS server to limit the subnets that Network Unlock clients can use to unlock. -The configuration file, called bde-network-unlock.ini, must be located in the same directory as the Network Unlock provider DLL (%windir%\System32\Nkpprov.dll) and it applies to both IPv6 and IPv4 DHCP implementations. If the subnet configuration policy becomes corrupted, the provider will fail and stop responding to requests. +The configuration file, called *bde-network-unlock.ini*, must be located in the same directory as the Network Unlock provider DLL (*%windir%\System32\Nkpprov.dll*). It applies to both IPv6 and IPv4 DHCP implementations. If the subnet configuration policy becomes corrupted, then the provider fails and stops responding to requests. -The subnet policy configuration file must use a “\[SUBNETS\]” section to identify the specific subnets. The named subnets may then be used to specify restrictions in certificate subsections. Subnets are defined as simple name-value pairs, in the common INI format, where each subnet has its own line, with the name on the left of the equals sign, and the subnet identified on the right of the equal sign as a Classless Inter-Domain Routing (CIDR) address or range. The key word “ENABLED” is disallowed for subnet names. +The subnet policy configuration file must use a `[SUBNETS]` section to identify the specific subnets. The named subnets can then be used to specify restrictions in certificate subsections. Subnets are defined as simple name-value pairs, in the common INI format. In this format, each subnet has its own line. The name is on the left of the equals sign. The subnet that's identified on the right of the equals sign is a Classless Interdomain Routing (CIDR) address or range. The keyword `ENABLED` is disallowed for subnet names. ```ini [SUBNETS] @@ -270,110 +270,112 @@ SUBNET3= 2001:4898:a:2::/64 ; an IPv6 subnet SUBNET4=2001:4898:a:3::/64; in production, the admin would likely give more useful names, like BUILDING9-EXCEPT-RECEP. ``` -Following the \[SUBNETS\] section, there can be sections for each Network Unlock certificate, identified by the certificate thumbprint formatted without any spaces, which define subnets clients can be unlocked from with that certificate. +Following the `[SUBNETS]` section are sections for each Network Unlock certificate. A certificate is identified by the certificate thumbprint, which is formatted without any spaces. These sections define subnet clients that can be unlocked by using that certificate. > [!NOTE] -> When specifying the certificate thumbprint, do not include any spaces. If spaces are included in the thumbprint the subnet configuration will fail because the thumbprint will not be recognized as valid. +> When you specify the certificate thumbprint, don't include spaces. Thumbprints that include spaces aren't recognized as valid. These will cause the subnet configuration to fail. -Subnet restrictions are defined within each certificate section by denoting the allowed list of permitted subnets. If any subnet is listed in a certificate section, then only those subnets listed are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate does not have a section in the subnet policy configuration file, then no subnet restrictions are applied for unlocking with that certificate. This means for restrictions to apply to every certificate, there must be a certificate section for every Network Unlock certificate on the server, and an explicit allowed list set for each certificate section. -Subnet lists are created by putting the name of a subnet from the \[SUBNETS\] section on its own line below the certificate section header. Then, the server will only unlock clients with this certificate on the subnet(s) specified as in the list. For troubleshooting, a subnet can be quickly excluded without deleting it from the section by simply commenting it out with a prepended semi-colon. +Each certificate section defines subnet restrictions by denoting the allowed list of permitted subnets. If any subnets are listed in a certificate section, then only those subnets are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate has no section in the subnet policy configuration file, then no subnet unlocking restrictions are applied for that certificate. So to apply restrictions to every certificate, you must add a certificate section for every Network Unlock certificate on the server. And you must add an explicit allow list set for each certificate section. + +Create subnet lists by putting the name of a subnet from the `[SUBNETS]` section on its own line below the certificate section header. Then, the server will unlock clients that have this certificate only on the subnets that the list specifies. To troubleshoot, you can quickly exclude a subnet without deleting it from the section by simply commenting it out with a prepended semicolon. ```ini [2158a767e1c14e88e27a4c0aee111d2de2eafe60] ;Comments could be added here to indicate when the cert was issued, which Group Policy should get it, and so on. -;This list shows this cert is only allowed to unlock clients on SUBNET1 and SUBNET3 subnets. In this example, SUBNET2 is commented out. +;This list shows this cert is allowed to unlock clients only on the SUBNET1 and SUBNET3 subnets. In this example, SUBNET2 is commented out. SUBNET1 ;SUBNET2 SUBNET3 ``` -To disallow the use of a certificate altogether, its subnet list may contain the line “DISABLED". +To disallow the use of a certificate altogether, you can add a `DISABLED` line to its subnet list. -## Turning off Network Unlock +## Turn off Network Unlock -To turn off the unlock server, the PXE provider can be unregistered from the WDS server or uninstalled altogether. However, to stop clients from creating Network Unlock protectors the **Allow Network Unlock at startup** Group Policy setting should be disabled. When this policy setting is updated to disabled on client computers any Network Unlock key protectors on the computer will be deleted. Alternatively, the BitLocker Network Unlock certificate policy can be deleted on the domain controller to accomplish the same task for an entire domain. +To turn off the unlock server, you can unregister the PXE provider from the WDS server or uninstall it altogether. However, to stop clients from creating Network Unlock protectors, you should disable the **Allow Network Unlock at startup** Group Policy setting. When you disable this policy setting on client computers, any Network Unlock key protectors on the computer are deleted. Alternatively, you can delete the BitLocker Network Unlock certificate policy on the domain controller to accomplish the same task for an entire domain. > [!NOTE] -> Removing the FVE_NKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server’s ability to respond to unlock requests for that certificate. However, this is seen as an error condition and is not a supported or recommended method for turning off the Network Unlock server. +> Removing the FVE_NKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server's ability to respond to unlock requests for that certificate. However, this is seen as an error condition. It's not a supported or recommended method for turning off the Network Unlock server. ## Update Network Unlock certificates -To update the certificates used by Network Unlock, administrators need to import or generate the new certificate for the server and then update the Network Unlock certificate Group Policy setting on the domain controller. +To update the certificates that Network Unlock uses, administrators need to import or generate the new certificate for the server. Then they must update the Network Unlock certificate Group Policy setting on the domain controller. > [!NOTE] -> Servers that do not receive the Group Policy Object (GPO) will require a PIN when booting. In such cases, the reason why the server did not receive the GPO to update the certificate needs to be investigated. +> Servers that don't receive the Group Policy Object (GPO) will require a PIN when they boot. In such cases, find out why the server didn't receive the GPO to update the certificate. ## Troubleshoot Network Unlock -Troubleshooting Network Unlock issues begins by verifying the environment. Many times, a small configuration issue will be the root cause of the failure. Items to verify include: +To troubleshoot Network Unlock issues, begin by verifying the environment. Many times, a small configuration issue is the root cause of the failure. Verify these items: -- Verify client hardware is UEFI-based and is on firmware version is 2.3.1 and that the UEFI firmware is in native mode without a Compatibility Support Module (CSM) for BIOS mode enabled. Do this by checking that the firmware does not have an option enabled such as "Legacy mode" or "Compatibility mode" or that the firmware does not appear to be in a BIOS-like mode. -- All required roles and services are installed and started -- Public and private certificates have been published and are in the proper certificate containers. The presence of the Network Unlock certificate can be verified in the Microsoft Management Console (MMC.exe) on the WDS server with the certificate snap-ins for the local computer enabled. The client certificate can be verified by checking the registry key **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP** on the client computer. -- Group policy for Network Unlock is enabled and linked to the appropriate domains. -- Verify group policy is reaching the clients properly. This can be done using the GPRESULT.exe or RSOP.msc utilities. -- Verify the clients were rebooted after applying the policy. -- Verify the **Network (Certificate Based)** protector is listed on the client. This can be done using either manage-bde or Windows PowerShell cmdlets. For example the following command will list the key protectors currently configured on the C: drive of the local computer: +- Client hardware is UEFI-based and is using firmware version 2.3.1, and the UEFI firmware is in native mode doesn't have a Compatibility Support Module (CSM) for BIOS mode enabled. Verify this configuration by checking that the firmware has no enabled option such as **Legacy mode** or **Compatibility mode** or that the firmware doesn't appear to be in a BIOS-like mode. +- All required roles and services are installed and started. +- Public and private certificates have been published and are in the proper certificate containers. Verify the presence of the Network Unlock certificate by using Microsoft Management Console (*MMC.exe*) on the WDS server. The certificate snap-ins for the local computer should be enabled. Verify the client certificate by checking the registry key *HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP* on the client computer. +- Group Policy for Network Unlock is enabled and linked to the appropriate domains. +- Group Policy is reaching the clients properly. Verify this functionality by using the *GPRESULT.exe* utility or *RSOP.msc* utility. +- The clients were rebooted after the policy was applied. +- The **Network (Certificate Based)** protector is listed on the client. Check for this protector by using either `manage-bde` or Windows PowerShell cmdlets. For example, the following command lists the key protectors that are currently configured on drive C on the local computer. ```powershell manage-bde -protectors -get C: ``` > [!NOTE] - > Use the output of manage-bde along with the WDS debug log to determine if the proper certificate thumbprint is being used for Network Unlock + > Use the output of `manage-bde` along with the WDS debug log to determine whether the proper certificate thumbprint is being used for Network Unlock. -Files to gather when troubleshooting BitLocker Network Unlock include: +Gather the following files to troubleshoot BitLocker Network Unlock. -1. The Windows event logs. Specifically the BitLocker event logs and the Microsoft-Windows-Deployment-Services-Diagnostics-Debug log +- The Windows event logs. Specifically, get the BitLocker event logs and the Microsoft-Windows-Deployment-Services-Diagnostics-Debug log. - Debug logging is turned off by default for the WDS server role, so you will need to enable it first. You can use either of the following two methods to turn on WDS debug logging. + Debug logging is turned off by default for the WDS server role, so you need to enable it before you can retrieve it. Use either of the following two methods to turn on WDS debug logging. - 1. Start an elevated command prompt and run the following command: + - Start an elevated command prompt and then run the following command: ```cmd wevtutil sl Microsoft-Windows-Deployment-Services-Diagnostics/Debug /e:true ``` - 2. Open Event Viewer on the WDS server. + - Open Event Viewer on the WDS server. - In the left pane, click **Applications and Services Logs**, click **Microsoft**, click **Windows**, click **Deployment-Services-Diagnostics**, and then click **Debug**. + In the left pane, select **Applications and Services Logs** > **Microsoft** > **Windows** > **Deployment-Services-Diagnostics** > **Debug**. - In the right pane, click **Enable Log**. + In the right pane, selet **Enable Log**. -2. The DHCP subnet configuration file (if one exists). -3. The output of the BitLocker status on the volume, this can be gathered into a text file using **manage-bde -status** or **Get-BitLockerVolume** in Windows PowerShell. -4. Network Monitor capture on the server hosting the WDS role, filtered by client IP address. +- The DHCP subnet configuration file (if one exists). +- The output of the BitLocker status on the volume. Gather this output into a text file by using `manage-bde -status`. Or in Windows PowerShell, use `Get-BitLockerVolume`. +- The Network Monitor capture on the server that hosts the WDS role, filtered by client IP address. ## Configure Network Unlock Group Policy settings on earlier versions -Network Unlock and the accompanying Group Policy settings were introduced in Windows Server 2012 but can be deployed using operating systems running Windows Server 2008 R2 and Windows Server 2008. +Network Unlock and the accompanying Group Policy settings were introduced in Windows Server 2012. But you can deploy them by using operating systems that run Windows Server 2008 R2 and Windows Server 2008. -**Requirements** +Requirements: -- The server hosting WDS must be running any of the server operating systems designated in the **Applies To** list at the beginning of this topic. -- Client computers must be running any of the client operating systems designated in the **Applies To** list at the beginning of this topic. +- The server that hosts WDS must be running a server operating system that's designated in the **Applies to** list at the beginning of this article. +- Client computers must be running a client operating system that's designated in the **Applies to** list at the beginning of this article. -The following steps can be used to configure Network Unlock on these older systems. +Follow these steps to configure Network Unlock on these older systems. -1. [Install the WDS Server role](#bkmk-installwdsrole) -2. [Confirm the WDS Service is running](#bkmk-confirmwdsrunning) -3. [Install the Network Unlock feature](#bkmk-installnufeature) -4. [Create the Network Unlock certificate](#bkmk-createcert) -5. [Deploy the private key and certificate to the WDS server](#bkmk-deploycert) +1. [Install the WDS Server role.](#bkmk-installwdsrole) +2. [Confirm the WDS service is running.](#bkmk-confirmwdsrunning) +3. [Install the Network Unlock feature.](#bkmk-installnufeature) +4. [Create the Network Unlock certificate.](#bkmk-createcert) +5. [Deploy the private key and certificate to the WDS server.](#bkmk-deploycert) 6. Configure registry settings for Network Unlock: - Apply the registry settings by running the following certutil script (assuming your network unlock certificate file is called **BitLocker-NetworkUnlock.cer**) on each computer running any of the client operating systems designated in the **Applies To** list at the beginning of this topic. -```console - certutil -f -grouppolicy -addstore FVE_NKP BitLocker-NetworkUnlock.cer - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v OSManageNKP /t REG_DWORD /d 1 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePIN /t REG_DWORD /d 2 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMPIN /t REG_DWORD /d 2 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPM /t REG_DWORD /d 2 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f - reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f -``` + Apply the registry settings by running the following `certutil` script (assuming your Network Unlock certificate file is called *BitLocker-NetworkUnlock.cer*) on each computer that runs a client operating system that's designated in the **Applies to** list at the beginning of this article. -7. Set up a TPM protector on the clients -8. Reboot the clients to add the Network (Certificate Based) protector + ```console + certutil -f -grouppolicy -addstore FVE_NKP BitLocker-NetworkUnlock.cer + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v OSManageNKP /t REG_DWORD /d 1 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseAdvancedStartup /t REG_DWORD /d 1 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UsePIN /t REG_DWORD /d 2 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMPIN /t REG_DWORD /d 2 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPM /t REG_DWORD /d 2 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKey /t REG_DWORD /d 2 /f + reg add "HKLM\SOFTWARE\Policies\Microsoft\FVE" /v UseTPMKeyPIN /t REG_DWORD /d 2 /f + ``` + +7. Set up a TPM protector on the clients. +8. Reboot the clients to add the **Network (Certificate Based)** protector. ## See also From 0683698c0e40089c58ede8850fd50ffa8a381ae0 Mon Sep 17 00:00:00 2001 From: ShannonLeavitt Date: Wed, 28 Oct 2020 09:52:27 -0600 Subject: [PATCH 013/825] more edits --- .../bitlocker-how-to-enable-network-unlock.md | 121 +++++++++--------- 1 file changed, 64 insertions(+), 57 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index 4a7d9d600f..68ca0dcc0c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -1,6 +1,6 @@ --- title: BitLocker - How to enable Network Unlock (Windows 10) -description: This topic for the IT professional describes how BitLocker Network Unlock works and how to configure it. +description: This article for the IT professional describes how BitLocker Network Unlock works and how to configure it. ms.assetid: be45bc28-47db-4931-bfec-3c348151d2e9 ms.reviewer: ms.prod: w10 @@ -27,16 +27,16 @@ This article for IT professionals describes how BitLocker Network Unlock works a Network Unlock was introduced in Windows 8 and Windows Server 2012 as a BitLocker protector option for operating system volumes. Network Unlock helps you manage BitLocker-enabled desktops and servers in a domain environment by automatically unlocking operating system volumes when the system is rebooted and is connected to a wired corporate network. This feature requires the client hardware to have a DHCP driver implemented in its UEFI firmware. -Without Network Unlock, operating system volumes that are protected by TPM+PIN protectors require a PIN when a computer reboots or resumes after hibernation (for example, by Wake on LAN). For enterprises, this setup can make software patches difficult to roll out to unattended desktops and remotely administered servers. +Without Network Unlock, operating system volumes that use TPM+PIN protectors require a PIN when a computer reboots or resumes after hibernation (for example, by Wake on LAN). For enterprises, this setup can make software patches difficult to roll out to unattended desktops and remotely administered servers. Network Unlock allows BitLocker-enabled systems that use TPM+PIN and that meet the hardware requirements to boot into Windows without user intervention. Network Unlock works like the TPM+StartupKey at boot. But the StartupKey doesn't need to be read from USB media. Instead, the key for Network Unlock is composed from a key that's stored in the TPM and an encrypted network key that's sent to the server. It's decrypted and returned to the client in a secure session. ## Network Unlock core requirements -Network Unlock must meet mandatory hardware and software requirements before the feature can automatically unlock domain-joined systems: +Network Unlock requires the following mandatory hardware and software configurations before it can automatically unlock domain-joined systems: - You must be running at least Windows 8 or Windows Server 2012. -- Any supported operating system that uses UEFI DHCP drivers can be Network Unlock clients. +- Any supported operating system that uses UEFI DHCP drivers can be a Network Unlock client. - Network Unlock clients must have a TPM chip and at least one TPM protector. - You must have a server running the Windows Deployment Services (WDS) role on any supported server operating system. - The BitLocker Network Unlock optional feature can be installed on any supported server operating system. @@ -44,28 +44,30 @@ Network Unlock must meet mandatory hardware and software requirements before the - You must have a properly configured public/private key pairing. - Network Unlock Group Policy settings must be configured. -The network stack must be enabled to use the Network Unlock feature. Equipment manufacturers deliver their products in various states and with different BIOS menus, so you need to confirm that the network stack has been enabled in the BIOS before you start the computer. +The network stack must be enabled to use the Network Unlock feature. Equipment manufacturers deliver their products in various states and with different BIOS menus. So confirm that the network stack has been enabled in the BIOS before you start the computer. > [!NOTE] > To properly support DHCP within UEFI, the UEFI-based system should be in native mode and shouldn't have a compatibility support module (CSM) enabled. -On computers running Windows 8 and later, the first network adapter on the computer, usually the onboard adapter, must be configured to support DHCP. This adapter must be used for Network Unlock. +On computers that run Windows 8 and later, the first network adapter on the computer, usually the onboard adapter, must be configured to support DHCP. This adapter must be used for Network Unlock. Use this configuration especially when you have multiple adapters and you want to configure one without DHCP, such as for a lights-out management protocol. The configuration is necessary because Network Unlock stops enumerating adapters when it reaches an adapter that has a DHCP port that has failed for any reason. So if the first enumerated adapter doesn't support DHCP, isn't plugged into the network, or fails to report availability of the DHCP port for any reason, then Network Unlock will fail. On supported versions of Windows Server 2012 and later, the Network Unlock server component installs as a Windows feature. It uses Server Manager or Windows PowerShell cmdlets. In Server Manager, the feature name is BitLocker Network Unlock. In Windows PowerShell, the feature name is BitLocker-NetworkUnlock. This feature is a core requirement. -Network Unlock requires WDS in the environment where the feature will be used. Configuration of the WDS installation is not required. But the WDS service needs to be running on the server. +Network Unlock requires WDS in the environment where the feature will be used. Configuration of the WDS installation isn't required. But the WDS service must be running on the server. -The network key is stored on the system drive along with an AES 256 session key. It's encrypted with the 2048-bit RSA public key of the unlock server's certificate. The network key is decrypted with the help of a provider on a supported version of Windows Server that's running WDS. It's returned encrypted with its corresponding session key. +The network key is stored on the system drive along with an AES 256 session key. It's encrypted with the 2048-bit RSA public key of the unlock server's certificate. The network key is decrypted with the help of a provider on a supported version of Windows Server that's running WDS. The network key is returned encrypted with its corresponding session key. ## Network Unlock sequence The unlock sequence starts on the client side, when the Windows boot manager detects the existence of the Network Unlock protector. It uses the DHCP driver in UEFI to get an IP address for IPv4. Then it broadcasts a vendor-specific DHCP request that contains the network key and a session key for the reply, all encrypted by the server's Network Unlock certificate, as described earlier. The Network Unlock provider on the supported WDS server recognizes the vendor-specific request, decrypts it with the RSA private key, and returns the network key encrypted with the session key via its own vendor-specific DHCP reply. -On the server side, the WDS server role has an optional plug-in component, like a PXE (preboot execution environment) provider, which is what handles the incoming Network Unlock requests. The provider can also be configured with subnet restrictions. These restrictions would require that the IP address provided by the client in the Network Unlock request belong to a permitted subnet in order to release the network key to the client. If the Network Unlock provider is unavailable, then BitLocker fails over to the next available protector to unlock the drive. So in a typical configuration, the standard TPM+PIN unlock screen is presented to unlock the drive. +On the server side, the WDS server role has an optional plug-in component, like a PXE (preboot execution environment) provider. The plug-in component handles the incoming Network Unlock requests. The provider can also be configured with subnet restrictions. These restrictions require the IP address that's provided by the client in the Network Unlock request to belong to a permitted subnet in order to release the network key to the client. If the Network Unlock provider is unavailable, then BitLocker fails over to the next available protector to unlock the drive. So in a typical configuration, the standard TPM+PIN unlock screen is presented to unlock the drive. -The server-side configuration to enable Network Unlock also requires provisioning a 2048-bit RSA public/private key pair in the form of an X.509 certificate. The configuration also requires the public key certificate to be distributed to the clients. This certificate must be managed and deployed through the Group Policy editor directly on a domain controller that has a domain functional level of at least Windows Server 2012. This certificate is the public key that encrypts the intermediate network key. The intermediate network key is one of the two secrets required to unlock the drive; the other secret is stored in the TPM. +The server-side configuration to enable Network Unlock requires provisioning a 2048-bit RSA public/private key pair in the form of an X.509 certificate. The configuration also requires the public key certificate to be distributed to the clients. + +Manage and deploy this certificate through the Group Policy editor directly on a domain controller that has a domain functional level of at least Windows Server 2012. This certificate is the public key that encrypts the intermediate network key. The intermediate network key is one of the two secrets that are required to unlock the drive; the other secret is stored in the TPM. ![Diagram showing the BitLocker network unlock sequence.](images/bitlockernetworkunlocksequence.png) @@ -77,19 +79,19 @@ The Network Unlock process follows these phases: - A network key (a 256-bit intermediate key) that's encrypted by the 2048-bit RSA public key of the Network Unlock certificate from the WDS server. - An AES-256 session key for the reply. 4. The Network Unlock provider on the WDS server recognizes the vendor-specific request. -5. The provider decrypts it with the WDS server's BitLocker Network Unlock certificate RSA private key. -6. The WDS provider then returns the network key encrypted with the session key by using its own vendor-specific DHCP reply to the client computer. This key is an intermediate key. -7. The returned intermediate key is then combined with another local 256-bit intermediate key. This key can be decrypted only by the TPM. +5. The provider decrypts the request by using the WDS server's BitLocker Network Unlock certificate RSA private key. +6. The WDS provider returns the network key encrypted with the session key by using its own vendor-specific DHCP reply to the client computer. This key is an intermediate key. +7. The returned intermediate key is combined with another local 256-bit intermediate key. This key can be decrypted only by the TPM. 8. This combined key is used to create an AES-256 key that unlocks the volume. 9. Windows continues the boot sequence. ## Configure Network Unlock -The following steps allow an administrator to configure Network Unlock in a domain where the domain functional level is at least Windows Server 2012. +The following steps allow an administrator to configure Network Unlock in a domain where the functional level is at least Windows Server 2012. -### Install the WDS Server role +### Install the WDS server role -The BitLocker Network Unlock feature installs the WDS role if it's not already installed. If you want to install it separately before you install BitLocker Network Unlock, use Server Manager or Windows PowerShell. To install the role by using Server Manager, select the **Windows Deployment Services** role in Server Manager. +The BitLocker Network Unlock feature installs the WDS role if it's not already installed. If you want to install it separately before you install BitLocker Network Unlock, use Server Manager or Windows PowerShell. To install the role in Server Manager, select the **Windows Deployment Services** role. To install the role by using Windows PowerShell, use the following command: @@ -97,7 +99,7 @@ To install the role by using Windows PowerShell, use the following command: Install-WindowsFeature WDS-Deployment ``` -Configure the WDS server so that it can communicate with DHCP (and optionally Active Directory Domain Services) and the client computer. You can do so by using the WDS management tool, `wdsmgmt.msc`. This tool starts the Windows Deployment Services Configuration Wizard. +Configure the WDS server so that it can communicate with DHCP (and optionally Active Directory Domain Services) and the client computer. Use the WDS management tool, `wdsmgmt.msc`. This tool starts the Windows Deployment Services Configuration Wizard. ### Confirm the WDS service is running @@ -110,7 +112,7 @@ Get-Service WDSServer ``` ### Install the Network Unlock feature -To install the Network Unlock feature, use Server Manager or Windows PowerShell. To install the feature by using Server Manager, in the Server Manager console, select **BitLocker Network Unlock**. +To install the Network Unlock feature, use Server Manager or Windows PowerShell. To install the feature in the Server Manager console, select **BitLocker Network Unlock**. To install the feature by using Windows PowerShell, use the following command: @@ -119,21 +121,21 @@ Install-WindowsFeature BitLocker-NetworkUnlock ``` ### Create the certificate template for Network Unlock -A properly configured Active Directory Services Certification Authority can use the certificate template to create and issue Network Unlock certificates. +A properly configured Active Directory Services Certification Authority can use the certificate template to create and issue Network Unlock certificates. To create a certificate template: 1. Open the certificate template snap-in (`certtmpl.msc`). 2. Locate the user template. Right-click the template name and then select **Duplicate Template**. -3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to Windows Server 2012 and Windows 8, respectively. Ensure the **Show resulting changes** dialog box is selected. +3. On the **Compatibility** tab, change the **Certification Authority** and **Certificate recipient** fields to **Windows Server 2012** and **Windows 8**, respectively. Ensure **Show resulting changes** is selected. 4. Select the **General** tab of the template. The **Template display name** and **Template name** should clearly identify that the template will be used for Network Unlock. Clear the check box for **Publish certificate in Active Directory**. 5. Select the **Request Handling** tab. In the **Purpose** drop-down menu, select **Encryption**. Ensure the **Allow private key to be exported** option is selected. -6. Select the **Cryptography** tab. Set the **Minimum key size** to *2048*. (For this template, you can use any Microsoft cryptographic provider that supports RSA. But for simplicity and forward compatibility, we recommend using **Microsoft Software Key Storage Provider**.) +6. Select the **Cryptography** tab. Set the **Minimum key size** to **2048**. (For this template, you can use any Microsoft cryptographic provider that supports RSA. But for simplicity and forward compatibility, we recommend using **Microsoft Software Key Storage Provider**.) 7. Select **Requests must use one of the following providers**. Then clear all options except for your selected cryptography provider, such as the **Microsoft Software Key Storage Provider**. 8. Select the **Subject Name** tab. Select **Supply in the request**. If the certificate templates dialog box appears, select **OK**. 9. Select the **Issuance Requirements** tab. Then select both **CA certificate manager approval** and **Valid existing certificate**. 10. Select the **Extensions** tab. Then select **Application Policies** > **Edit**. 11. In the **Edit Application Policies Extension** dialog box, select **Client Authentication**, **Encrypting File System**, and **Secure Email**. Then choose **Remove**. 12. In the **Edit Application Policies Extension** dialog box, select **Add**. -13. In the **Add Application Policy** dialog box, select **New**. In the **New Application Policy** dialog box, enter the following information in the space provided and then click **OK** to create the BitLocker Network Unlock application policy: +13. In the **Add Application Policy** dialog box, select **New**. In the **New Application Policy** dialog box, enter the following information in the space provided and then select **OK** to create the BitLocker Network Unlock application policy. - **Name**: **BitLocker Network Unlock** - **Object Identifier**: **1.3.6.1.4.1.311.67.1.1** @@ -149,7 +151,7 @@ After you add the Network Unlock template to the certificate authority, you can ### Create the Network Unlock certificate -Network Unlock can use imported certificates from an existing public key infrastructure (PKI), or you can use a self-signed certificate. +Network Unlock can use imported certificates from an existing public key infrastructure (PKI). Or it can use a self-signed certificate. To enroll a certificate from an existing certificate authority: @@ -172,7 +174,7 @@ To enroll a certificate from an existing certificate authority: 2. Select **Yes, export the private key**. 3. Complete the steps to create the *.pfx* file. -To create a self-signed certificate, you can either use the New-SelfSignedCertificate cmdlet in Windows PowerShell or use Certreq. +To create a self-signed certificate, either use the `New-SelfSignedCertificate` cmdlet in Windows PowerShell or use `certreq`. Here's a Windows PowerShell example: @@ -180,9 +182,9 @@ Here's a Windows PowerShell example: New-SelfSignedCertificate -CertStoreLocation Cert:\LocalMachine\My -Subject "CN=BitLocker Network Unlock certificate" -Provider "Microsoft Software Key Storage Provider" -KeyUsage KeyEncipherment -KeyUsageProperty Decrypt,Sign -KeyLength 2048 -HashAlgorithm sha512 -TextExtension @("1.3.6.1.4.1.311.21.10={text}OID=1.3.6.1.4.1.311.67.1.1","2.5.29.37={text}1.3.6.1.4.1.311.67.1.1") ``` -Here's a Certreq example: +Here's a `certreq` example: -1. Create a text file with an *.inf* extension. For example, *notepad.exe* *BitLocker-NetworkUnlock.inf*. +1. Create a text file that has an *.inf* extension. For example, *notepad.exe* *BitLocker-NetworkUnlock.inf*. 2. Add the following contents to the previously created file: ```ini @@ -204,7 +206,7 @@ Here's a Certreq example: _continue_ = "1.3.6.1.4.1.311.67.1.1" ``` -3. Open an elevated command prompt and use the `certreq` tool to create a new certificate. Use the following command, specifying the full path to the file that you created previously. Also specify the file name: +3. Open an elevated command prompt and use the `certreq` tool to create a new certificate. Use the following command, specifying the full path to the file that you created previously. Also specify the file name. ```cmd certreq -new BitLocker-NetworkUnlock.inf BitLocker-NetworkUnlock.cer @@ -216,16 +218,16 @@ Here's a Certreq example: ### Deploy the private key and certificate to the WDS server -Now that the certificate and key are created, deploy them to the infrastructure to properly unlock systems. To deploy the certificates: +Now that you've created the certificate and key, deploy them to the infrastructure to properly unlock systems. To deploy the certificates: -1. On the WDS server, open a new Microsoft Management Console (MMC) and then add the certificates snap-in. Select the computer account and local computer when these options appear. +1. On the WDS server, open a new Microsoft Management Console (MMC) and then add the certificates snap-in. When you're prompted, select the computer account and local computer. 2. Right-click **Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock** and then choose **All Tasks** > **Import**. 3. In the **File to Import** dialog box, choose the *.pfx* file that you created previously. 4. Enter the password that you used to create the *.pfx*, and finish the steps. ### Configure Group Policy settings for Network Unlock -Now that you've deployed the certificate and key to the WDS server for Network Unlock, the final step is to use Group Policy settings to deploy the public key certificate to computers that you want to be able to unlock by using the Network Unlock key. You can find Group Policy settings for BitLocker in *\\Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption* by using the Local Group Policy Editor or the MMC. +You've now deployed the certificate and key to the WDS server for Network Unlock. In the final step, you'll use Group Policy settings to deploy the public key certificate to computers that you want to be able to unlock by using the Network Unlock key. Find Group Policy settings for BitLocker in *\\Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption* by using the Local Group Policy Editor or the MMC. To enable the Group Policy setting that's required to configure Network Unlock: @@ -239,45 +241,51 @@ To deploy the required Group Policy setting: > The Group Policy settings **Allow network unlock at startup** and **Add Network Unlock Certificate** were introduced in Windows Server 2012. 1. Copy the *.cer* file that you created for Network Unlock to the domain controller. -2. On the domain controller, launch Group Policy Management Console (`gpmc.msc`). +2. On the domain controller, open Group Policy Management Console (`gpmc.msc`). 3. Create a new Group Policy Object or modify an existing object to enable the **Allow network unlock at startup** setting. 4. Deploy the public certificate to clients: - 1. In Group Policy Management Console, go to the following location: *Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate*. + 1. In Group Policy Management Console, go to *Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Public Key Policies\\BitLocker Drive Encryption Network Unlock Certificate*. 2. Right-click the folder and then choose **Add Network Unlock Certificate**. 3. Follow the steps and import the *.cer* file that you copied earlier. > [!NOTE] - > Only one network unlock certificate can be available at a time. If a new certificate is required, delete the current certificate before you deploy a new one. The Network Unlock certificate is located in the *HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP* key on the client computer. + > Only one network unlock certificate can be available at a time. If you need a new certificate, delete the current certificate before you deploy a new one. The Network Unlock certificate is located in the *HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP* key on the client computer. -5. Reboot the clients after you deploy the group policy. +5. Reboot the clients after you deploy the Group Policy. > [!NOTE] - > The **Network (Certificate Based)** protector is added only after a reboot. The policy must be enabled, and a valid certificate must be present in the FVE_NKP store. + > The **Network (Certificate Based)** protector is added only after a reboot where the policy is enabled and a valid certificate is present in the FVE_NKP store. -### Subnet policy configuration files on the WDS server (Optional) +### Subnet policy configuration files on the WDS server (optional) -By default, clients are unlocked by the server if they have the correct Network Unlock certificate and valid Network Unlock protectors that have wired access to a Network Unlock-enabled WDS server via DHCP. You can create a subnet policy configuration file on the WDS server to limit the subnets that Network Unlock clients can use to unlock. +By default, the server unlocks clients that have the correct Network Unlock certificate and valid Network Unlock protectors that have wired access to a Network Unlock-enabled WDS server via DHCP. You can create a subnet policy configuration file on the WDS server to limit the subnets that Network Unlock clients can use for unlocking. -The configuration file, called *bde-network-unlock.ini*, must be located in the same directory as the Network Unlock provider DLL (*%windir%\System32\Nkpprov.dll*). It applies to both IPv6 and IPv4 DHCP implementations. If the subnet configuration policy becomes corrupted, then the provider fails and stops responding to requests. +The configuration file, called *bde-network-unlock.ini*, must be located in the same directory as the Network Unlock provider dynamic-link library (*%windir%\System32\Nkpprov.dll*). The configuration file applies to both IPv6 and IPv4 DHCP implementations. If the subnet configuration policy becomes corrupted, then the provider fails and stops responding to requests. -The subnet policy configuration file must use a `[SUBNETS]` section to identify the specific subnets. The named subnets can then be used to specify restrictions in certificate subsections. Subnets are defined as simple name-value pairs, in the common INI format. In this format, each subnet has its own line. The name is on the left of the equals sign. The subnet that's identified on the right of the equals sign is a Classless Interdomain Routing (CIDR) address or range. The keyword `ENABLED` is disallowed for subnet names. +The subnet policy configuration file must use a `[SUBNETS]` section to identify the specific subnets. You can then use the named subnets to specify restrictions in certificate subsections. + +Subnets are defined as simple name-value pairs, in the common INI format. In this format, each subnet has its own line. The name is on the left of the equals sign. The subnet on the right of the equals sign is a Classless Interdomain Routing (CIDR) address or range. The keyword `ENABLED` is disallowed for subnet names. ```ini [SUBNETS] -SUBNET1=10.185.250.0/24 ; comment about this subrange could be here, after the semi-colon +SUBNET1=10.185.250.0/24 ; a comment about this subrange could be here, after the semicolon SUBNET2=10.185.252.200/28 SUBNET3= 2001:4898:a:2::/64 ; an IPv6 subnet SUBNET4=2001:4898:a:3::/64; in production, the admin would likely give more useful names, like BUILDING9-EXCEPT-RECEP. ``` -Following the `[SUBNETS]` section are sections for each Network Unlock certificate. A certificate is identified by the certificate thumbprint, which is formatted without any spaces. These sections define subnet clients that can be unlocked by using that certificate. +Following the `[SUBNETS]` section are sections for each Network Unlock certificate. A certificate is identified by the certificate thumbprint, which is formatted without any spaces. These sections define subnet clients that you can unlock by using that certificate. > [!NOTE] -> When you specify the certificate thumbprint, don't include spaces. Thumbprints that include spaces aren't recognized as valid. These will cause the subnet configuration to fail. +> When you specify the certificate thumbprint, don't include spaces. Thumbprints that include spaces aren't recognized as valid. The spaces will cause the subnet configuration to fail. -Each certificate section defines subnet restrictions by denoting the allowed list of permitted subnets. If any subnets are listed in a certificate section, then only those subnets are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate has no section in the subnet policy configuration file, then no subnet unlocking restrictions are applied for that certificate. So to apply restrictions to every certificate, you must add a certificate section for every Network Unlock certificate on the server. And you must add an explicit allow list set for each certificate section. +Each certificate section defines subnet restrictions by denoting the allowed list of permitted subnets. If any subnets are listed in a certificate section, then only those subnets are permitted for that certificate. If no subnet is listed in a certificate section, then all subnets are permitted for that certificate. If a certificate has no section in the subnet policy configuration file, then no subnet unlocking restrictions are applied for that certificate. -Create subnet lists by putting the name of a subnet from the `[SUBNETS]` section on its own line below the certificate section header. Then, the server will unlock clients that have this certificate only on the subnets that the list specifies. To troubleshoot, you can quickly exclude a subnet without deleting it from the section by simply commenting it out with a prepended semicolon. +So to apply restrictions to every certificate, you must add a certificate section for every Network Unlock certificate on the server. And you must add an explicit allow list set for each certificate section. + +Create subnet lists by putting the name of a subnet from the `[SUBNETS]` section on its own line below the certificate section header. Then, the server will unlock clients that have this certificate only on the subnets that the list specifies. + +To troubleshoot, you can quickly exclude a subnet without deleting it from the section. Just comment it out by using a prepended semicolon. ```ini [2158a767e1c14e88e27a4c0aee111d2de2eafe60] @@ -288,14 +296,14 @@ SUBNET1 SUBNET3 ``` -To disallow the use of a certificate altogether, you can add a `DISABLED` line to its subnet list. +To disallow the use of a certificate altogether, add a `DISABLED` line to its subnet list. ## Turn off Network Unlock To turn off the unlock server, you can unregister the PXE provider from the WDS server or uninstall it altogether. However, to stop clients from creating Network Unlock protectors, you should disable the **Allow Network Unlock at startup** Group Policy setting. When you disable this policy setting on client computers, any Network Unlock key protectors on the computer are deleted. Alternatively, you can delete the BitLocker Network Unlock certificate policy on the domain controller to accomplish the same task for an entire domain. > [!NOTE] -> Removing the FVE_NKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server's ability to respond to unlock requests for that certificate. However, this is seen as an error condition. It's not a supported or recommended method for turning off the Network Unlock server. +> Removing the FVE_NKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server's ability to respond to unlock requests for that certificate. However, this condition is seen as an error. It's not a supported or recommended method for turning off the Network Unlock server. ## Update Network Unlock certificates @@ -306,13 +314,13 @@ To update the certificates that Network Unlock uses, administrators need to impo ## Troubleshoot Network Unlock -To troubleshoot Network Unlock issues, begin by verifying the environment. Many times, a small configuration issue is the root cause of the failure. Verify these items: +To troubleshoot Network Unlock problems, begin by verifying the environment. Often, a small configuration issue is the root cause of the failure. Verify these items: -- Client hardware is UEFI-based and is using firmware version 2.3.1, and the UEFI firmware is in native mode doesn't have a Compatibility Support Module (CSM) for BIOS mode enabled. Verify this configuration by checking that the firmware has no enabled option such as **Legacy mode** or **Compatibility mode** or that the firmware doesn't appear to be in a BIOS-like mode. +- Client hardware is based on UEFI and uses firmware version 2.3.1, and the UEFI firmware is in native mode and has no compatibility support module (CSM) for BIOS mode enabled. Verify this configuration by ensuring that the firmware has no enabled option such as **Legacy mode** or **Compatibility mode** and that the firmware doesn't appear to be in a BIOS-like mode. - All required roles and services are installed and started. - Public and private certificates have been published and are in the proper certificate containers. Verify the presence of the Network Unlock certificate by using Microsoft Management Console (*MMC.exe*) on the WDS server. The certificate snap-ins for the local computer should be enabled. Verify the client certificate by checking the registry key *HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\SystemCertificates\\FVE\_NKP* on the client computer. - Group Policy for Network Unlock is enabled and linked to the appropriate domains. -- Group Policy is reaching the clients properly. Verify this functionality by using the *GPRESULT.exe* utility or *RSOP.msc* utility. +- Group Policy is reaching the clients properly. Verify this functionality by using the *GPRESULT.exe* utility or the *RSOP.msc* utility. - The clients were rebooted after the policy was applied. - The **Network (Certificate Based)** protector is listed on the client. Check for this protector by using either `manage-bde` or Windows PowerShell cmdlets. For example, the following command lists the key protectors that are currently configured on drive C on the local computer. @@ -335,9 +343,8 @@ Gather the following files to troubleshoot BitLocker Network Unlock. ``` - Open Event Viewer on the WDS server. - In the left pane, select **Applications and Services Logs** > **Microsoft** > **Windows** > **Deployment-Services-Diagnostics** > **Debug**. - - In the right pane, selet **Enable Log**. + 1. In the left pane, select **Applications and Services Logs** > **Microsoft** > **Windows** > **Deployment-Services-Diagnostics** > **Debug**. + 1. In the right pane, select **Enable Log**. - The DHCP subnet configuration file (if one exists). - The output of the BitLocker status on the volume. Gather this output into a text file by using `manage-bde -status`. Or in Windows PowerShell, use `Get-BitLockerVolume`. @@ -347,21 +354,21 @@ Gather the following files to troubleshoot BitLocker Network Unlock. Network Unlock and the accompanying Group Policy settings were introduced in Windows Server 2012. But you can deploy them by using operating systems that run Windows Server 2008 R2 and Windows Server 2008. -Requirements: +Your system must meet these requirements: -- The server that hosts WDS must be running a server operating system that's designated in the **Applies to** list at the beginning of this article. -- Client computers must be running a client operating system that's designated in the **Applies to** list at the beginning of this article. +- The server that hosts WDS must be running a server operating system that's designated in the "Applies to" list at the beginning of this article. +- Client computers must be running a client operating system that's designated in the "Applies to" list at the beginning of this article. Follow these steps to configure Network Unlock on these older systems. -1. [Install the WDS Server role.](#bkmk-installwdsrole) +1. [Install the WDS server role.](#bkmk-installwdsrole) 2. [Confirm the WDS service is running.](#bkmk-confirmwdsrunning) 3. [Install the Network Unlock feature.](#bkmk-installnufeature) 4. [Create the Network Unlock certificate.](#bkmk-createcert) 5. [Deploy the private key and certificate to the WDS server.](#bkmk-deploycert) 6. Configure registry settings for Network Unlock: - Apply the registry settings by running the following `certutil` script (assuming your Network Unlock certificate file is called *BitLocker-NetworkUnlock.cer*) on each computer that runs a client operating system that's designated in the **Applies to** list at the beginning of this article. + Apply the registry settings by running the following `certutil` script (assuming your Network Unlock certificate file is called *BitLocker-NetworkUnlock.cer*) on each computer that runs a client operating system that's designated in the "Applies to" list at the beginning of this article. ```console certutil -f -grouppolicy -addstore FVE_NKP BitLocker-NetworkUnlock.cer From f62824ae2a7b3cdc5adabf2333477400e624b707 Mon Sep 17 00:00:00 2001 From: ShannonLeavitt Date: Wed, 28 Oct 2020 10:10:37 -0600 Subject: [PATCH 014/825] small fixes --- .../bitlocker-how-to-enable-network-unlock.md | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index 68ca0dcc0c..092a234e68 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -37,7 +37,7 @@ Network Unlock requires the following mandatory hardware and software configurat - You must be running at least Windows 8 or Windows Server 2012. - Any supported operating system that uses UEFI DHCP drivers can be a Network Unlock client. -- Network Unlock clients must have a TPM chip and at least one TPM protector. +- Network Unlock clients must have a TPM (trusted platform module) chip and at least one TPM protector. - You must have a server running the Windows Deployment Services (WDS) role on any supported server operating system. - The BitLocker Network Unlock optional feature can be installed on any supported server operating system. - You must have a DHCP server, separate from the WDS server. @@ -89,7 +89,7 @@ The Network Unlock process follows these phases: The following steps allow an administrator to configure Network Unlock in a domain where the functional level is at least Windows Server 2012. -### Install the WDS server role +### Install the WDS server role The BitLocker Network Unlock feature installs the WDS role if it's not already installed. If you want to install it separately before you install BitLocker Network Unlock, use Server Manager or Windows PowerShell. To install the role in Server Manager, select the **Windows Deployment Services** role. @@ -101,7 +101,7 @@ Install-WindowsFeature WDS-Deployment Configure the WDS server so that it can communicate with DHCP (and optionally Active Directory Domain Services) and the client computer. Use the WDS management tool, `wdsmgmt.msc`. This tool starts the Windows Deployment Services Configuration Wizard. -### Confirm the WDS service is running +### Confirm the WDS service is running To confirm the WDS service is running, use the Services Management console or Windows PowerShell. To confirm the service is running in the Services Management console, open the console by using `services.msc`. Then check the status of the WDS service. @@ -110,7 +110,7 @@ To confirm the service is running by using Windows PowerShell, use the following ```powershell Get-Service WDSServer ``` -### Install the Network Unlock feature +### Install the Network Unlock feature To install the Network Unlock feature, use Server Manager or Windows PowerShell. To install the feature in the Server Manager console, select **BitLocker Network Unlock**. @@ -119,7 +119,7 @@ To install the feature by using Windows PowerShell, use the following command: ```powershell Install-WindowsFeature BitLocker-NetworkUnlock ``` -### Create the certificate template for Network Unlock +### Create the certificate template for Network Unlock A properly configured Active Directory Services Certification Authority can use the certificate template to create and issue Network Unlock certificates. To create a certificate template: @@ -149,7 +149,7 @@ To add the Network Unlock template to the certificate authority, open the certif After you add the Network Unlock template to the certificate authority, you can use this certificate to configure BitLocker Network Unlock. -### Create the Network Unlock certificate +### Create the Network Unlock certificate Network Unlock can use imported certificates from an existing public key infrastructure (PKI). Or it can use a self-signed certificate. @@ -216,14 +216,14 @@ Here's a `certreq` example: 5. Launch **Certificates - Local Machine** by running `certlm.msc`. 6. Create a *.pfx* file by opening the *Certificates – Local Computer\\Personal\\Certificates* path in the navigation pane. Right-click the previously imported certificate, and then select **All Tasks** > **Export**. Follow through the steps to create the *.pfx* file. -### Deploy the private key and certificate to the WDS server +### Deploy the private key and certificate to the WDS server Now that you've created the certificate and key, deploy them to the infrastructure to properly unlock systems. To deploy the certificates: 1. On the WDS server, open a new Microsoft Management Console (MMC) and then add the certificates snap-in. When you're prompted, select the computer account and local computer. 2. Right-click **Certificates (Local Computer) - BitLocker Drive Encryption Network Unlock** and then choose **All Tasks** > **Import**. 3. In the **File to Import** dialog box, choose the *.pfx* file that you created previously. -4. Enter the password that you used to create the *.pfx*, and finish the steps. +4. Enter the password that you used to create the *.pfx* file, and finish the steps. ### Configure Group Policy settings for Network Unlock @@ -298,14 +298,14 @@ SUBNET3 To disallow the use of a certificate altogether, add a `DISABLED` line to its subnet list. -## Turn off Network Unlock +## Turn off Network Unlock To turn off the unlock server, you can unregister the PXE provider from the WDS server or uninstall it altogether. However, to stop clients from creating Network Unlock protectors, you should disable the **Allow Network Unlock at startup** Group Policy setting. When you disable this policy setting on client computers, any Network Unlock key protectors on the computer are deleted. Alternatively, you can delete the BitLocker Network Unlock certificate policy on the domain controller to accomplish the same task for an entire domain. > [!NOTE] > Removing the FVE_NKP certificate store that contains the Network Unlock certificate and key on the WDS server will also effectively disable the server's ability to respond to unlock requests for that certificate. However, this condition is seen as an error. It's not a supported or recommended method for turning off the Network Unlock server. -## Update Network Unlock certificates +## Update Network Unlock certificates To update the certificates that Network Unlock uses, administrators need to import or generate the new certificate for the server. Then they must update the Network Unlock certificate Group Policy setting on the domain controller. @@ -341,7 +341,7 @@ Gather the following files to troubleshoot BitLocker Network Unlock. ```cmd wevtutil sl Microsoft-Windows-Deployment-Services-Diagnostics/Debug /e:true ``` - - Open Event Viewer on the WDS server. + - Open Event Viewer on the WDS server: 1. In the left pane, select **Applications and Services Logs** > **Microsoft** > **Windows** > **Deployment-Services-Diagnostics** > **Debug**. 1. In the right pane, select **Enable Log**. From bbf1bff0771821a4d0ab178a6d454a0e91ebe9d5 Mon Sep 17 00:00:00 2001 From: Nathaniel Chin <22572406+nathanielcwm@users.noreply.github.com> Date: Thu, 29 Oct 2020 08:04:13 +0800 Subject: [PATCH 015/825] Update windows/deployment/upgrade/windows-10-edition-upgrades.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- windows/deployment/upgrade/windows-10-edition-upgrades.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index ff9c6ae451..033f0e0e0d 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -93,7 +93,7 @@ You can run the changepk.exe command-line tool to upgrade devices to a supported `changepk.exe /ProductKey ` -You can also upgrade using slmgr.vbs and a [KMS client setup key](https://docs.microsoft.com/en-us/windows-server/get-started/kmsclientkeys). For example, the following command will upgrade to Windows 10 Enterprise. +You can also upgrade using slmgr.vbs and a [KMS client setup key](https://docs.microsoft.com/windows-server/get-started/kmsclientkeys). For example, the following command will upgrade to Windows 10 Enterprise. `Cscript.exe c:\windows\system32\slmgr.vbs /ipk NPPR9-FWDCX-D2C8J-H872K-2YT43` From 97929f6f9264c183dc7978818a1965a1883767bf Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 2 Nov 2020 11:20:46 -0800 Subject: [PATCH 016/825] Fixed WDAC typo in TOC.md --- .../windows-defender-application-control/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/TOC.md b/windows/security/threat-protection/windows-defender-application-control/TOC.md index 731cab3d76..b29a8d0e37 100644 --- a/windows/security/threat-protection/windows-defender-application-control/TOC.md +++ b/windows/security/threat-protection/windows-defender-application-control/TOC.md @@ -22,7 +22,7 @@ ##### [Create a WDAC policy for fixed-workload devices](create-initial-default-policy.md) ##### [Microsoft recommended block rules](microsoft-recommended-block-rules.md) ### [Using the WDAC Wizard tool](wdac-wizard.md) -#### [Create a base WDC policy](wdac-wizard-create-base-policy.md) +#### [Create a base WDAC policy](wdac-wizard-create-base-policy.md) #### [Create a supplemental WDAC policy](wdac-wizard-create-supplemental-policy.md) #### [Editing a WDAC policy](wdac-wizard-editing-policy.md) #### [Merging multiple WDAC policies](wdac-wizard-merging-policies.md) From 1539eeb41ff9599f311409cecabc6d3d74473165 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 2 Nov 2020 11:23:10 -0800 Subject: [PATCH 017/825] Converted **Headers** to ### Headers to align with style guide. --- .../wdac-wizard-create-base-policy.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index 269ee7607e..0d1d32ff12 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -49,7 +49,7 @@ Once the base template is selected, give the policy a name and choose where to s Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. Hovering the mouse over the policy rule title will display a short description of the rule at the bottom of the page. -**Policy Rules Description** +### Policy Rules Description A description of the policy rules, beginning with the left-most column are provided below. @@ -66,7 +66,7 @@ A description of the policy rules, beginning with the left-most column are provi | **Unsigned System Integrity Policy** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | | **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | -**Advanced Policy Rules Description** +### Advanced Policy Rules Description Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of the policy rules are provided below. @@ -90,7 +90,7 @@ Selecting the **+ Advanced Options** label will show another column of policy ru File rules in an application control policy will specify the level at which appiations will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports 4 types of file rules: -**Publisher** +### Publisher Rules The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specifity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. @@ -104,11 +104,11 @@ The Publisher file rule type uses properties in the code signing certificate cha ![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) -**Path** +### Filepath Rules -Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a fileopath rule, simply select the file using the *Browse* button. +Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a filepath rule, simply select the file using the *Browse* button. -**File Attributes** +### File Attribute Rules The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (eg. DLLs) may all share the same product name, for instance. This allows users to easily create targeted policies based on the Product Name filename rule level. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. @@ -122,12 +122,12 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c ![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) -**File Hash** +### File Hash Rules Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule cannot be created using the specified file rule level. -#### Deleting Signing Rules #### +#### Deleting Signing Rules The policy signing rules list table on the left of the page will document the allow and deny rules in the template, as well as any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you will be prompted for additional confirmation. Select `Yes` to remove the rule from the policy and the rules table. From 9b7fd06c9c07e178ae7b604d10f5ac2d14307390 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 2 Nov 2020 12:13:27 -0800 Subject: [PATCH 018/825] Wrote the documentation for the supplemental policy workflow. Added two pictures - allows and disallows supplemental policies. --- .../wdac-wizard-supplemental-expandable.png | Bin 0 -> 43188 bytes ...dac-wizard-supplemental-not-expandable.png | Bin 0 -> 50493 bytes .../wdac-wizard-create-supplemental-policy.md | 109 +++++++++++++++++- 3 files changed, 108 insertions(+), 1 deletion(-) create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-expandable.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-not-expandable.png diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-expandable.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-supplemental-expandable.png new file mode 100644 index 0000000000000000000000000000000000000000..d59559152524da6425262187a27702c8c075aa19 GIT binary patch literal 43188 zcmbSyWmFwO(@=`>Cp@gMZ11!^2?1KtMpiOG=0+LO^^rgMj!1fd2eZa#a6)_v7#hpeQZ` zQ9h1)_;K;oL{L@`0-`Ds_T>-c$Mttx2@L=Q1d7AI{nMH;feQpgp`@gUpt6hZ$tt8a z+6V!}#p3bb98m$rO0APKI#MeUMYLa4ooA|@sz^v^$d%iRtE;palxg$N8Era9RU5n> zUh8fh=i=wa#wH(I1%Kb`KT0$#Vubal3&9||pVZKl zYvv)J{@tmy=^qEn7{kCgBr)6^Qv_ zO^98I!(P82AU571`PBmB|JIE9bQtdpMyr&l8Zkj{ve5luTE87zcpSKdEvj~6PoM8_ z+N~^yt~(_9jX_9y!Wzth8i0y39zx2wY)5?a(?rP4a4jbkU#MU_U7gkG*W{nEYx|=| z!8u`KYs{1b#gcO^X6wrM+ddiP2g0)p0PZtdOFe$~?(%*ACIg#`K*uh3g@VNWOxT*+`w+JtmyBJo*qmA}+)4(28p=+WD*Mur0Z{ap|QRyDaevdOV(% z;E$a7vM#prR$a6jcQTDDCJGe84-OBNoUzGIOWADHogJ$00s;@f-zpRx&2NuGpin6@ zG~jU?8D4Jc3z5t%;f_RXW7+SANw5{6oI{xk>iXQgXyk0}(eMjhEW#EI zTdq?e3zw+EeK8nsU2)pU`MEoS_Q&tzbyQqG)7?;uia$E{H5@j}VAa=DBa9c;9PvnF zMeMw4FT98VnPNEGm6xYhz*7ifyn`OT7t;-R^&5N%Ps^h^)r)(`)_Pza2~hk`hh)w- zXm+vl+Jo&#Sbrhp_EVl|`1SfyqpOEgjaN@k4qp8iQjDzBwx>7!XDJTuI*U9|p@HM= zTifzvdtSi)L|@dahsjC$Vx7||s!gq(zal_D$Av@;m&t5)=zq@6F8Xir;Aq@LRPo|b7V**bqzyfI1Y{mw634hx^=CjtCK^{ zAMq%l6Dl+0VwsV1+=rT%y? zl+SqM^EPqdFlP-l;H^ZEij2Q8MhL0B2rOv(1d-`}ce*@~sy5rHVccZ{H^E^il53J- zq|D{C22A31+Cv@rw&LqtDqgF}Yw~bb7kEOgOlZS9==DIFSmY<16L=p)MA90NVt(s* zhsU%sRKZP0LzC+xZH?h5S4+qaDx7{?z1-z!^BB`F3OUxNNWlX6)hw6iv4|Ho5Sr+Q zI7GE*6^xf}mxiYssx&{JEDl$Fv4ad#9zxO!L%nx)(`Cn{VmO;qCr4bWbxeDQBWcaz zF_%VIwNO58e}Sm7!p(wO?SIrS)Cp{jW}^?%z*^* zVDQ^m@WldTyM|tvOX{pFcbhbB=JH@z6^9i06&We{1D6s?${I~8lrDAm_q>3B*xCc! zCX(!$Pu0g0@6~dDblI4&X%O@3uQp|Q%-PxJmjxCazSZUTvmG`ey@IS3 zAz?@GmcLb1^bI*G^L9boMEGwb^90;~f^fQJ&5loDlRl;yI_qOmLDZ$KALoqC`D2ye zF#)8n%dCa~&iwGB*<;47)w?Xf7bjK%uHq03amA*rswe?-1+NLp`$RZh*EGx>6Qwru za1?5`?C1Q&PYzEidk5ty&Wew9yG4jcQhfQS=st;K$$%{fbmZpSw?Avi!qnHz=b$-Z zB|N(uko*Z99+Q(Q*#EQqv77;ga~1xHd-A+VPopXftMo)G@)}nnnb}fxfkWi{K=Uij z7-`)RxOmDyd8o};Nf;bt9W_RLaHDo?%VFuxJ)W07i&R0AW_*gR+U)w&U;Foa2Kk;I z_g9`QRV&@CQ=UifgTYB0tge;1SnGFHue9u>(Xt#f7HM2r=3W7HPK2*35AoT*+TzI^lfQeTW4TSVY{V2(dr*!%UH#2|q%KbaItJ8e$ zruaDfh0vQ%+r{P!h4CicK`tMYTV7r+qPVrp`f;yQPrySph)~^W8db3VN>i+M2TWQKJS7AiF<17v|S|nPWL!@ zS}}$$aBQtJ*K5b+A^T#xB1vY^2saP-t1DtCTRF9*FZVq+81GRTge|**!JMZTq+NZr z0M%8JN!N(2q^wHmu$`C7ApHqqWBrhyfV+auYP0c4kWEt3<0pT;d_TPi7pMteQ0sE)_EBvEziZiiA6G7@zI_j*1m(D#lo>b{Hepiyqt2<$szfxYDLz2 z&BQymRap3`+^M7Fw{q)pOak&Ljj+yW?)$ZZ>uJeElji1@r{_E(G%lOo$1P(30b+7f zw4_&nd2wUYSWQ5@w$Z{05~;@#7YUqvenB`sGqWvs4fOLk$Hy>te$;`_4HaG`s`e$n zyrX-ERq;-qd=z^Zq>8rB$3g;qbVD7;nXF+RP0ltf`gMx_AlMGFhrj>!N8Mig9Xoj; zthfeV+nr2lUaT$UUqZNcw!V?VIenmS_x6->>$8LD5~|;-cW#JS|K|AVsJ1iV40g0M zFTMrFm_5PXA6|{vQS3v^F4h@R>5cEb4#dD`>ud#!Vn4#q^m)o`@eZb@<_&LLZE?S^ ze@&x5wcd<{3q#L14K1O6#UcoodA8rGh)k;XFR!0jKa0d!ba>*nx5lGy8m?MajC167 zsX{FQIt$iODWKv8(_LR?SHP2hDD?{xsKL6XrYc4%Po}FQRI_YuYHDhFTK`J#+Q}^{ zuS7lo7fQl+ka{A3oxM;3DN<5VujXdFl}>ma$gA^9KpBz9$V7@3JB^8~RO;`pl+~3% zYJM0~NyA+@hSy6~CSL4&%Gp=OBXrJUuGqXCTndNMTtmStjFw^xs#tl|>+f4clEq)3 z92;3_99zEVgc1f>#yGH$YvPl>YI;sahnaVAGw<>)Qd0yl=tvij&&--KKVe&Wt~-^g z^dPDc_sF$*2*eyRFFEnedAByn)Vxp$))LuSum;0`cBzZSkZzr${0lg~R-G{(DyS(z zN(YluA&gL{Jdg<*`9RZ>w!kKlk?{}(0bLA};`#K*v}K(<(1pNoq(jdsePAaeQVn0i zvxFZqf%|e3&SBF#AAZ(-9kV&RyDGE_)^1uv#-QZYMk_vv<`0ZaL`rC^Ndh1d^hlG* z4D%WxoA|Zo&b4Cbl|5>NcKf0iF7LI0#4c46OU6)KRIL3I5RmnxS==ZR6%;sBT zA9O}}QxFougS%gZw(AR{K6D#Kz;Ua{;8gKY`=G%=_g+AIXoBofwPD|^$&`XhsnwyF zl)~`U=n_pg_X0%L0$~36=4^mQpsa+@;X4ss;1CHLCKMYwlPxtuYEqRjRIY9W_l@;2 z)Srq9$Z>l2b}6+L3&?b1%#QdKWvDEZ;P2-hxF#P?H^twDM@g^upQwHa7Hh6K`exCQ z&*WLPxVfrChMMM6CD3YlaqghMJ&P1nbs;^J2;zOyj#PKkSoI)XyGlN)2hEdQ9Zk+m z;dLT(78`F>l&j{kHpvRn8j-=_f!!wpJBvixdt2+7QIo5tB)o!&G`n<$2#pSCgw3(C zd^!#MO4}~m=3W8PacY`3E~z^$KZnbc)`uI$TMZ)Km087ez5q*XHk-5R+wC^q25W;5 z&mD`B%4E0PK`{x-5UA&xE*X9dfAec^y^Lv)lAYIe$x?@uDJ z({ySLuD1u!YGZoj*7;(3qtx4#HENx5U(_@v->XzY5@)E_1chFB9M0le zHT!IPiX3l?cC>u|$~D33I({1BJ42CY+zG%OYp!f&f8|VX?^Wtq zdUg24J^&%hSLLcC?yffDfzQS2@gmqY{DGDNtADn^z}}zw8h>9pTYx*fsfbX|;U^fK z@_asE`RL7iZ^uK1H1Z}T6r5EVnaLgnaO5l+U{%3SXG+1 z=mDDFKQA3BD>*{&G;P8|VQh;do(C3KRcCKmN>cbN7rK2k>C9|=WKP-&Nrhqu>V$mC z^#bZjYrAVpC%kSl`*r}xu?MIF^(6qlJ^U`CL&~49HW~@y=i6DO;1uV5)8eF|r`yR= zRg%HAPW=a|Eb?ns@Z-Wn$C{EkIxaWhkhwPES@ci?%1+^6-*?gIw{$brzjklb2xZF9 zeD7wD#+6Gmp)HwEbw!Z@!;%g`rF>Yzi*J{Szd*9#*?qI`QXI8yg03jpfRPL~1jO4W zp_2~*Hz>31xf`Eci7ii!(fX9d2s`#0#9uEC4ingaaNup(4cI0-ZF}!F|y|{C#R!>fPQ$v>%YiE4n&> zm1h+^HC3eB)|{A#+0M$wwpMSooX+be6)2C(ah)Ei(HM@9!C`By#j)p#?ppk+2x?W-oL6zP=@guvYlBC4=fxoNjYHe$G6<}>~Ea~V5R2CgnKBR0oU->Qs z8{`HD4;8DFq_A4dwYpx%#l=nKh;M79_DhQrBZJ2J9S?@#FfcF4f<#57_+TX;f<}aR zXg#)GAu%!Mu}XwQzman&2GH3_OU6ENM!>nHYAHywI$jOV+98IKen!yKD)c-)KiOh3 z@YgIH@W1%Le;e%AZ41G^#EBzTv&Hcp9sCFxBMG$3Y;66pa_*rsjiii>RaVROjpHVp zv16juZm|?V`6Pxex2+vFCQ>A#+0{C9nlc9}6*)d8Nqs&UEv;5|Qxji|wmNf_)XAyt zLRrMRgg(VYI-GP{N5I5E5{t=vxmAqwx<~=uvikWs&nh<)S8&op(htwTAAkw>!x7#{ z`{aKHB!G;YBtiZNi4X|bA5S};ui$sN*m%6&Uu||Yz##OSY5ba~*JKYl-^H2?sYim6 zLpHO&P}bgV*0;6FuDmy-V3G@6H0f;;nLxL;vG8MT1?YTTj4u5R#P6Ee_9w^g5rbNn@gKg1fXC(T zz~V!P5uM4Gm5kA@{N1%T21=eL{`i>fyheobp*Vdi$Sro=Ci0(zgoLJJ!~O2L#8aRh zpMF`39h3YKSOH7;X*zrl+fRUe@o11g9t*qd~ z!*b6{F?*PIeN$L-e3~&j+gk)!aI()^SrQ*;>!4ZcM2A^EacSsob8j-gwns)HrvGt^ zaOAfq^QU}KLI@lkkll1b(3LR^;hR?xIFS?kc^h+_eJX?e&kG48NJaXvN2cV`%F3wm zxpEzDDyrg-|LlPApLV3ZehrkbqoJS>&liJ1j~R;Ap&v<>i|qrVyHIK&l4pC?MQaa% z`=%1*3TMq%<}xG3=vx&^R~ucA=V+~Yn^AE!rmpk~@1_%btf=HpO*?m_3Dssj9O?H# z6gH^zP>`Y$wIa;{ny*W$+74N!6~i{qTbzlgi{HeA5)q8+0TB#&WCu7T$e2WI@>(}_ z72iJmfrpm3!?E7224-0qnE*H}#R^?sF0CgeAr>PdMPmjtKc={!%%~brczASc;m4@x zs~7`(4BaynkW}EWDX9*Qd=XU~DEqkuo-*fL?+2tcsLHZFm9;vVWwiNJuTsvac|RpF zID6xUyt-T~hkAvJWb)B)7mhV1^cr0*eN^1EX{`DBn8BrHGq3%T*B5%ONkzUWCR{Cz zPtP5Lc_x$Rul*d{&lQuo(u7kFMkSb|h!P5Ep&c1ZqtQD9Ho;~o+4K?NSar4ra|5AkwVHWCK;~?7#Anx zKM@v}D^4{%&O%9vW!04CUywvvguh;D@u8Bj;OKWAib3K?99~)!8 z=eIr&CRM4X=7Pj3*5f(nx#H1l*}EscftDU>F>(E9A_4&~AD7!)m|40ox!#Y;`8qZ! zk2^*ZtqP&tm6@L4`nSdqwm)~(LXOr~BoymNerHI2oF$&GQcVre*|e)-jL~e4EpFxf zQ)}3H14zbr4kgNxE5}00_FcOVjxb$f2dBxB(%H6iv#AFSPj)H>a`TKmQ?ZTFf|0g= z#-|{=CcIubtv^(2L&9bQUsr?mGk!S9haTF$Tc^cowZn@*{;LJJaP#mG3l$Y`xh0Ab zI$Nkf!UIpsm-CFHSTf7S#igmKDf4EL{~C=A;J?3Bh9!UZcaxkZkIjhUPGNeC!M7nf znn+>oQ4quEr9-F<@vI%jmmjV{6v21BdjW$x5e@IY`BXN(64#l*n^*rZRbov#X2{M; zLOLqHyIqWu&;(7w6HPd+geMjyH!jp#nRn;S^499Xx&1g(hD=nZ2=X9pTJiY-3_ZF3 z!#i-DcIB?;V@p1in4*FV#FVS$ksu#HU?MC%kBZonVf^TK8P+D?GlB_jJJa4z_I)Af zBZ>3`%*HZeVqzVhuc~F5{?eY;of=~BR2SRp7!1i3P056!=no%?%7dFd;quztG79~y zYjmc=>-gu)d+2Kx4sa_;v0T8C2eLHXi52L*5AiZ=@D!1FIE|}BD`>2$y4CW4tdw8> z^YWVoFvi}QigkHhx{*}qU~0J)qpYwqn6)BI*NE6@s)|^h=H`x-si0kdgu&S|9pzp< z-JY<4`RhmQ;bC^zVH^W$5I5ZCGgZIDhlM`VL#HlCNaMw2HNI_vo|z79kAm2mW%i`C z$xE$445I1{hu!fdtvSkWJw5px^+HT2S$;SHulKkeQdA^~O<{nlBhRZm_rs9cPoFHv z;ZMZf-)=#*q~zY5nsry$J7tpneXZiYw^5}BHKXQvxGGhG=h;1LN{fJoi0$PxqVd~D zbaAVnuXd&%BQn2Evi^R@+Rx*VvINi9(4Qj{1^YY`k(KZL6u}p07j{8=zOsJzWp|w7 z1vH_YSS)c*WqE?2@*E#rKan2u;G(`%WbW}3X6IGjhG9V}X(Z#cf}^+}Z#QUhYFoXo z=eugFwcV`fR`VHId_{37VK8yfLswu*4r)p6nzf-+&6U1$DqT&$sJna1Vje~v(}$Av z0)O^Ar@fmRxpu_n^S`?q7r!jsVAE22JbfDsI_Sk?94bhhJ=7=C5AjrM8h8m)HJ6kh z{eAV(7SHgs7AN78mtID4J2!16rVZ5+VyO|e-S$Co@)r|NR&y*Se#Lig3qd5^^Ff99 zWSW1{zUuF*iL8u!CQ;2GS3b|7urvDWeFPvNF0gR9H($r6#Was-j&-^^YCio_CWId3 zf5mtHA0gNHd%3Wd4~pljW8Vk~g(G7PX220Qrz_jIe`2kOX&2b;?_o6?C5-JYganc zl}!0mpEOmcx@I)}?i|Qg>QbOTO=i_l&cVTxKEx0M54oDWgGh=bLguGzRIaBuH~sjK z%os=*mh59wqGbWzYRaBlmSgJ0672ndJ@5t7wOyrlV;DGQ2r)ICEJG?SR(nzfK@l!HXHh* zCkpX-AVO_=C@MXIWi8Iu@BK>Xf_q#b7FQqN!vT)p8XWed%|M@nwu{kxc9(BiwzYe& zS-23tg+(BdlY&~|ao|ikK_rL6@5K1{G3h6Bs$xu++d_-Sqy1+C>w-<6$uaK-wp(L| zlT~>OJk4X)h2elDY@n3^>!8IcQS*ypZ|hXK_4ApL1ptY-DE}aRl1px-vAcZDN^PdjqJ1m}7oq4t| zJ595)SLh1pfZ}3MQS7fKmoC5X`X2C{?GRFfFqP5vgX$ijCH0-oGBFBu7c{gYb({aJ z&Ph;dWk;X5;iMZIa>;4?&IIz8rH5**)eJj2(l}z-wi;A{O%d0fxBuK~ie)j20c~D{ zl_DA*%rH$;gnxTn*j)|Z5;+X*b>=->Ak@@hZ?!O9KCRI^zvt}*EvPT+jfi*~KtPql1!si9oNtYoTGL7N?7AEEOF^@c~eExZH(hoEGJ0%tJYG|RgP zcq|omG8Z>Pp;TwUG}creL1po$jp!*X!q*ZtEm7%=i2Tz<>4uwAu<*+b;{)|B3#<$1 zRLL3N(-gD6EW zoLMoXct8~55w&jdl&}>DED|nCM&5d^z%A0+C&4Z3IDm9vd}a7~8#rXCd7IssL8h6r zSK$D4*Fi{z65JkPKlb#y_|3$Ne50Yk)xuOv47k++4n!od2LOsn^xv?hf!LO=y}4Cw zXR^mY>w(~XoB&N5cj>)za}Gn^wjlSm`r)7j3qXsFyUZ?j@Yv;P62`Zpp~P@*`rbnm zXPaNJKZnf6biBR;GbMk!t)$d~98*a%B+Q$)EH97D4%x#rCrBl6Hzqw|!Ya)g>1As^ zOY*HU)IN8Ya9mz&j`U}TaM)S>Y1mvw8Kee`_4{p=%7dCKB&+@F^C_h-zo54lh;Yuq zy361bte2XGo{<(6T382SqMxhfDE!$O6E!yIw*ABHw-%F2=jronOFJew7g4hK@CmR4 z<|OaApSP$>@jhpXv14%wIG2|*<2*ka7@S(g(Cy(AmLrLYn`5dYAL2okq}Nu=(E1c9 zJe^|_%gxH8&>XGY{Az*|5T~v~Y5dg5u`?sayu|qpdN+1wI9)}5dayw&V5a5QI$uz^ zSpM16u>_uv-@VPAqp5&%qicu2yOS7riC`_tQ1x}fxueMf{8)6#y6tO1%hPJwk~XC2 z4#C&pX4!(uKB4}caeIdia92H-ofz`9hELG$m*z7SE6V&<*Da)(YUiYg+OicElb#DTKu*iT6 z$KRuvyfkYXX)&}XL*(*umg4WH;N2fvS}(tymXe)}6-%}{8n?vV0BuJcjQxtR_mwJS zaX!qh;<8ZX{r7R%J+EhDAoYDQGW??q1fxOjtH08(Hh4v&+LZ0HFQVdlNpok^UP%c{ zE;He-8Bea@8pfHFH;5P>trc&N?IlZBNxEa@^H6@&3$0~jbolG>4!^#qlh$OIsy3cN zfYhd2q>(Q4O)~!LQ$N|wo%@*PZCk-PTNGiFjHJ%BveRCB*u`y{!@k{k}t2AoI}_ONSLdZ1u;Q;#!$j9#b0K<*4QoE7wq9icd}Z) zsp678mzjNRX0wEUdb|ijair#%zV?Slt~Ry(LR02pj&)f`HN0P=C}nH{XzOczWcJoa z0oMGXM!01cmC|QipA;JwC6txxdD-aF!MDD#ff4 zGkv=s;97RU4*+!OS6ujWlw_4!T8ryYmMs@{$4+Twm(!)Lq3n}8j5GzP^AtlSsEb2& zuy`$7{={Dixiv3a*s3aZAhB6PzVJx*Zc2kDf`!cqlc~M# zv;$)5YIDh|35$6QUW17wrplPO-Emj{+|#b*h&z>-Os*UwrLz|sWt_i_NEduh|HaJL z-MshZg1AbM49hXNaUu$aa;mY$#m2;FChx>YTamfm{V2PP##l)5Pk%@mmJ_h7A4n!&b=<$+m)f*SQpn3%t-?MQe~lpX2#Q zF`E)6(&Fz@gQ#a-(T=eh%D!Lf6l@`Ee9?^x%n$H-H2Li5jKuwpLctF8?mw!*2gkoE zk!PODfco8?tqcZkDfZqzPM#43d|?%2Bv?^83C?8iC<6e@jc8M$ojIxSnU@i_W% zGo_pfW-3n-)G5X#3idw=-eWPIrk-w0NDs;=cO~BhK>L^5g`3ML;olZ@$0X5KUjmAS z@^jNQs4-8~o?d0IK4YySs9isKEB}(G7EO98OeomcTzR~Q+_ta?!AfCwsow6xI5o$n z)HN%Acs&R%#`aXrzLyWzV^)qQRoKs_)U)wZY$2v5p; zOb(Ji_c`g&m8F%5D&qW#w-hEk%X47Wl$4!vreOFqR!hlSLC7fRS^u0IS)c1ZnmZt# zl{-GSnV3y8m*^#HDECbh8*S^{FiuV2Rxm*=^Dw5~*uivE9lb(E5BYUU$v0m=UNItY z>%+`k!_>8p?xv(?>Nx{3aLn-;PQ%wp;$+UH2bvtIvE8c*)H$ID2DEMq1V>!4^|vY| znQ30{FxxmU4x;lJ)m-TNorozU$j2=R=Mu zt_Vxk$s-!aa^-4@zV~??`F8r55hd1|bq`5^Q~74;T;T=xY@N?o#It*}$+E#&r0VP3 ziuh~>A@A9CcOSzYXRc!b4Cg(8qEU*c6abJkCvkLZJA_cUOIqB`bJXtc=es_)f1OWk zSuT)Gw2|PlV|vls+^mmZezBWfff7_(7|`2SvFa)C6XV@?t7&S(Q40=pCIh`1mqAu= z@Y)c(-oLOQ9SZ{g*ygaGo>Rh6gR@!y2ANHV2kz_4nKa=MdejX_Xv9rFoV<}02EOWi<;ZR2$6gHZe1R|a>2X! zZa0v;FToc_Y}WDf-MrjL!mI>x;#qJ;p0RL>SUew$V%(k8aZm8#nH#hi@3$hT^glm{ zY6GJJslLJ)rgYCxW3Q>E!=W4JF=~Oe&6n#pXYmoPSMOId@)zmP9RqoD*}tR!_BZ z7s@LBGNH!Uk&N<{*T|Zi?Q0iJ5w?!|Oowlj{Q}|Oxb23{@?+H-cZHF|->){OC8qh- zxO6D;XGc$sW?^-ZN0bNX`mvk|5cn)|uy>eh0mK|_?d@Dm8C&7E;EV4U&*Z=JPDJlx zgd^4|thjtafMwr9_9GjghN6G-IZ@Z?uSRBKN`UX+|C1 z0YOGo5m)yzLwW=4zRD>95lCD5w;DBuk9(zWAm|shF((|B#rlch{h}E9Ge|E7pP^)& zZ?~Oqy82@}*9Ev+3dtp`&DbM&jz!Q()f1QXX3DNR8OMtw0@c5vw|NipOs6)F@%^@b zG%erDa*O;4lrY6_1{3&ydwvD|xDQ?v#pAdXMZ`fnEp@~|G0J74Wk8fLpFApWkj^3) zRqM8lU2Dt3p?@@8XQT1PFBbv-4%oe=qcbRg15v9?Zl2C;rZ?L=iEXt^5FCx}wF7dW zA~ZRvZIuni^lG&wG0-ZW9|`uLlx=EwXC`X?)bs8=GnN%`{4}u{Lf9EDlytq!LC{H6 zx+41OsnwfMmQ|mj=L$nL%#PcTfg-C=qePou`(r=Osjyr;B~1A0l*RN|u3%r&mY=4} zr*4%z2wd3>tNE8Ru-q@$AKv+n1YA8{u?;QL3ExiYBjE?mc`Mx5;W2EJC4#(!tPEN66PJFKNVUf-6^gvlBW|=v$BtOIt=N@(O3d5y z_Xp;{rRC)%YmfJ_&fs5SZG!C?{3Hi*w*=#)BS#}*o@pHbExoD1xdQ*Uis$L>j356R zz|ViwnQ;;CN`auv{<-u^^u*L++x>HGgcqMEuzM_ki<`+Rt*3*3UX}!W~SWyBeY0HVI3gVcU>Bi4i!n{R% zf50HxJ^CC zYZS`b=GyKqo|09y@Y~e63viVblbkhNN?(tWY3KwujyEeJo=ksYgd`O#2VDb}G%Gq;4- z(m&6^d}kcE6>fff5PqZ6w%>VW5BV=ZvZ3|>JlTQmEAV{{R7cc!S6uvgA1rsPX|6%U z#IjxBDI!WhZdeuMOb~32u3)U{qzP25(7-9TO5*qGNgD$I_b>(}>!kEm4_|Y%w25vh ziOK~=^Z5SCw{fT3TvQQnR*xJYJJr{a+oW*kd~rKGHU_bmT8s=0i%68KViLw(U8(q| z)bU%zjm4nv?3)O0{0j}g-`_51M8&Sn*{zlHGM+jx_2I2n-^oht!e&@&Tm3eom>5YI zR{6-5Gm9TF=MOCuZGP(~Poztazr)2E0C%`e0K#vWssZ#0Y+66qR~ikPVLe3yKcZzR-+Q!x&qCGFuMtyS{m zLkC+vS_1Ie==6TJCaaME7hAznu+Oi2J|d+RGIX-vyJM+-9-#I82EX(;Wgj36a8@hu zdEr^vc#ga7d4~VNQ~54kt=n7n%+33>P})SmWs~13P=CJH-qhws7c4XQ?$YLx^8)C0m ztVcv0MHL)_vm15AkIcPUBlItPS8n5}Dv=kJ@Ulf7{N+c2ygx5c!46X651(#~+OMc| z^3j-qM3~g1T0(gx!4S}&&lLHpitu|ozrrUEU%G|HoVjMDu*T7c`Q~y64t2fmDPS^Ush4VBtdrwQvymIOIVm;|4htWPVDiCCq z9F~fmqMzy7$v8{jZ)|YFf~Cm=*6`7d!GM0*(Az|9)Oi#jd_ifwe1_^SPTtT!rbxO6kq>}QH@8zaCf0UV<1 zyxk&o8K?5#&AEQ2itx#g*xVxZC8qPDobDK5HG1`0Yi3D|6cRKZ8x);eF`3^htCo&0 z!54su3jYdwhpUPCxIns;|Dvg}BeRHHLG2+CR(2hr$wWpfmlrL_d`)w#MpXXCL?Ye?>kIhVKXX!|Iv3DRa$ z(nV@k4+^xDG#Z~C`X0-!fC6h>QjSc=1oXjY4Y$YhdP`YXtx6I}K+mnteoss#Lz4t# zzwrwz`EUT@A=vRbCoWUwFTZ!{6)4Kk zS+7lc9K4OBgKFdH5C|l!1wCw{SYc%6z{}^7?byXJnOO}CdMv9}gt<<_tn$W1f~9Ww z-q%W#nP(8?p_7=gf_sC)bJSjPeV3HJDNhW=M%bS+Io}!j3}D_SHJKcT9P|(s_Wy;7 zwop4;4Nc#2T?@eWmRr@uFcs>|metC?{CextKx6htVYRi1 z7U-fgQ!(+K?7$9Mu!zlWppEU|skvcRIkDS#O!wA!x$wI|A_*;{l0w*x!&F$-cuvoH zU}*{}kkC_84=Pe~2uGLbhWJ3vabDGd_ha5h{Hb)ZbK#Ey&sX5!;Vq&!YOo2TNB4v) zEyJFbMTWxA*YOGO6Ls0&W{jdHIz&oocjXXL>aFiTg_8Zvam5d->1QpN`8b|S0a5E*VUHrtNZU6ujUrJd<8m(LB= zipuhev{Kd&_FB%#EMm?hsTE-HdjI5XpBKGshSJ+U^rAMqKS|S_H}sKbzG+Gn38h2@ zwL-ZyU~zmN%9S7!K9T!;dn}fI{rO}2lAt`ps#qA8qRHWe5eTTmo)4jM@66(Eb@)3Hjuk;N5hvef z@%RVDW8Lh}9P^zrc5fr)>qEE3PcF8hP(J?5zijndh^~&8*n_DgNMJh8q8SS6jFBkXSv0Efl{3W)0TNrXzi1ervTFTVDI>Qn5&~ajww>Mhji-@ zwXL13iL?kGU0i&Oo35Xji(JsHNWi+GRM7MGEv=cnQqP5QdF?AP(bWU}QB)MrZazt|Ld6d>#+yS%rQ#)iS%I%^DX*K$ zT*LMSW2=m?dMe{>US{WQ^Um%msL&pv+|tLUzHxM_x+`$5|VM( zE{WMlws9oalcR)cTROMCCD#8MD_#f>S|}r?W^VFot^Zo3EnENYrn~n+T(|kXU%qO@ zJ4+6p+qR1d_@<*}T9JfQ;CwI8Thb``MY}ujetJmNC*Uj2>6^rP+cAp2fDcXZx5_sp>m9$`}|B$8`@8`v3t3T{h z`mZf@Ogq!vrA7#-J4v}t>W>-NrEs?$y}Svo5j9g`K;jAu(vH^G1zT3(K2i9 z?TzgEyHc@gbPXnf;;`S}d_rdmnKj#REKCXqI}U@J3|Nt|7QxNly+$TNu|x9BH12j! zj&JQ)tQn802Ieo6#t6vMGZ`M7JCKs~#xd{iX$eumME~LMF%P401DF-X#+ET~P<2A% zsY({5kGJNO5$*?eBi3x?nj^P2+l@ykVJbz7YP6 zl@{mH`enL_C1V{ttshbrcXnp^AT2MU)Dl(g48HQmc(`bdz`eB6Wx&;LhH)B)tyC*H zLRL?KHqo(x8Ry`b3c1>aU-n2ApbV;+!2Ozmp7(sb<^cKi=`O>$v-|J!eZYUby#db` z4Wh6fOcbdip}t;5pRrjC*jXu8UGF$u5&N$WklqrZ1AmH;k6%*pqgmOl>nf6{X&TmkIxKq zI$P4oUwEXj6-DuG-uNJTz#wGAjNZ`T;z6Q#)U%ZApxv7MXHCY&KGnd!<%qOG)b(m- za1k?$H)`yj;Yzx5g~FdbC?S*h`^N>k)BNJYqWjoePF%#inS58?qsH6vhnHQgWC zdOFF@e=dQ4e{B3c367h)1zGr1ZD7S1rv3CXi&hQAb4WZeP)ox24{C9W>>Lc1JEdSE}5@_&j^mxR=)A^Yy-mg}Y}qeL%`$MFpNuMK{Tu zx8xfsvT!k7Q}7mI8Lbu+1cZ_31b2}n#T%4&&5Ql_?%zr>GKSzYD#bma$@R;Z$pD<> z4#Ozwl$5xK_&0fxW--k?`p+afb%qqNFQ5KE8j$!Ie&qR48honw+H-6=N={xMuiIJq z_@^+1$4(OG)DXJV?5I-|=J6kbS#+L`3_kpX#7;f1UiC=ZY@7k)jm^eV7;e)*lfqbg zgz%{eQJijtQyM-7t8;E9wU!BIByL|1s9pmxB=o;;5>amkk5A|KW zC4=$J;AP1c%h>M;v3e{%*QMM&S-hmrGLQNBqO|){Y2<;V>8UdX{%vlj*sSZnGAf44 z|NJ@I-EKRU%I1T`OJ52%ua9MJLvbR}pMtHsySz*ww}NuJDLt&bH9DI;a6ZJu!^6aM zwqMrLW^4!$Mb8K}fcB9PkO(B~m;KT3e06w=bC1r~c}p*w+9)u;5@TJHpG%b{@KaI% zDb_^RO1o!^#qsgnnbiX9)L=7ZbtU-HTITAoTcLvzjCqn4#=SS)2+}zM3nc)D=-^FUmPIv_!bF5-4>IX~2?U$*{9Ce@^kx;nDdvU!~_08X{)NA!JXx z@_4xx5D&5_Z%R?&;q%FcdJewzOd*+eIE^RGFYJxbR?X?bmzBmFu(~88FIzvDZXpqr z-&y(|Z4Lj_bdLM2%Ecg-Dw^|n~1N?p1^VC^L15rIHM2vWzz zDsnR-X5PVcLb3w|`+6ez$wjA?lPM1&X4V(5gr`%GL6JBfFB+^Z1|sY0g@je!{kC9LTLw zzu&_lPzaXwmAO{{jTKuPho6sIWpLZM6g11VSdShzU4Ex?(QW$XI6JyZLi^U}ihjto zakH=3@8$*~+N33yw*Fz*y!|E3-B_P5uGxz~!%BJdl2TTUKhvJ?6uX^B$s9b#!ad4z zgRT;!paYb9+g!Crty}e>;%bvn)R|vFFbUya%uIi-I;1^xBCj1d9mG-2p^7rJhgVwh z%70t!(^)}8i$Y9r&~y>5L3{osT@yq~4|3G{!JV(V<3_~{ZncM@tdKr+6NG2RiIHI` zW71X%Z+(pyn+|zWsxoy%mDT&{GLRfyY8ZKbq-F_jS8_{TIPQYGO+^q3w7=lx)sMN) zEf!=g-XqusZSpShm(wxxS()ppDSXHF5GjU3FuWpj>dig&xqj36&@Ye`kN!;4(7*uC z_M-2ONTp*oZ$oVdycbh8y21QhR{$oO>>LYfhtnz|`wsne{>4h%FHZ8}U#lIJUegz8FB0-KMGX-iDbD#nf(TwHpK#-hHRINLRgDK4=mOQLCLw<^z!+ zQ5{2Brr9>uSLW&Ue!Kt~4JYZ;$y*)tXg=AvdtrJqT!qRX!kZhoEgc1^; zoga8joR@E|>yL6;>tn5(N2jGJ8}G&e%1*i`V0LVB`s&3=&FTQw11b3*M%_4dxkklA z^rS?+T%LYP${~DN;f@TalwchDhLZPF?N(~pG@m?2_wAeK4^hCN=w46(vv2es`gaNe zZ*HtI0(p3u>(-ia(wyVx^>uSWP2c1cD+dEcdR~xfF=rKx4@qwHtr5xD@IR02CZzEc z5kZY9)9b5v>s<1uZ!;exh$;1AA2uJJtSRxN1_#Ykddo59oj0Z)^xqTBt@m9OaV=xG z*}&?wf6OuiM10nB44X~SL5n;ZjSXduU&0%{Ru?*2&d$^cim_9Eu2sB$XDvscAPXlkok=gfC5|_f*>AN$1 zz)$KdKaIx7S?@v(e>}7gTheSL2+xI@7`BIz+8Bcp<=r1P$%Tljszv_E)))54g4`?U z+d6*$S-w;Fos|#DQmt8NI89VoAM5bUt5|YTdtwny0SDUvI#D2Z+rHlusn-3WnMsLK zlsK75XaXd;o`u&8H$9c^i@SqUWk$40JR{8@nopLtxKPlO>1J9+S!^Tar)qWSqjb>h z=b>ToQsZ?kxaM_zfM1KD@G3XeGZe$$%OTjyNG2XDdf1&FLUXr83@tttEr&^{-ecFJ zgb@E~2}$$NM~~B>4?gQHnAxkn)7!r+uD^((l-RoCqO80SvYUd@mNi zk<4ET{%8-dn9RHN^VvPLudJd!uAKin&S_vr`q1(Ekn^%7@87cB?Jq2;WZ-so+;Zl& zh*QdKeP_=0GK*=uOSi9lFC|MC7W<`KWIbMdU*m|3kZp;St#2YjkG{-`UP`BTh9XwF zNz{S)kD&G{aLh%SGoXpOv(3%h^JEpz?l*M5dVgyXtKDiQt~Dv9-M_cZ(~kDriVYW# z+wLH(GJf|5Zk3+g|)m^aW-X&NFK^{5D>Y% zY{J+QYJP!a)#tfKJ%_KfdluI`M@_0I`bwIxk_vV`0(##^vA7nAqE?>S$n->zWZaw` zUf#L1CmAJHM+P)1O!V?`QwTO{@bm=)Ak6cbxHf*4(7^&zeCH|nH9B@}LKcDrSBO(~ zEK4f3*LFFa#lQq`yF@*CLZc0it_ThN2i&I%kbOO~9P4pJ`!b8LI8;jeKZO4#Sw)^6 zz3es5wvyQ^fJx_alj7z1pe*iaaY(O#9sJ@-m1?lwFo>Cr&Z!z?2dmqZxyiiXo@V=7 zUNLDp-4Zu9W!A_IX7DsAn%acZ`5q;6I&lb$kdi-V*e}}9>Cl<*o?AQw76eWZ{x8{( zXV>YC{p$$wXAtxM)E1X0)+Udyqw??{PIu7{;@O@Fy!#I~pTO}4p<*C(wdcltSD-PY z8~${=?fC9dp-*%O>cNiuV*bjnJ-xYiIqY-cxSQ&aC7nZh|4w*#=T}Rvc6acF`ycB= z4XXX?sRO6;PI6I~HI^vDM&GB1@x;XSgLx!}I3b;!)9AO>)7TGsv_15gfIDO?!^f`3 ziM6MiJuE$7Ct*a)7 z_))J2q{QqtTDXn^r>kmPET+AMahvh_(yw7 zUaG4wf+j`nUvjHN>Hln4m)n)wrbJ&R5z8FY*l=r4 z7}t%7JT_9mci}5(Y*oEDcvS?Q z2B{X)i}I$|Xyb2fqaQ_bw>*71uhWw@;O-?a!_N&1@E<@+X#4W*h{f;Tv8ETys*A5f69B!hX(Td?%3UqV*^skN6CD zm}U`1DGFT9l7bFP!apbvN>4{dx6ts0FQ*P}?`|nZ1upsAheL@idS>3;04J#I<@Z3=2qp?7$kP!bKLi^|0;1u^!@t zO@#u#L7Q3uvY#Cled8mo4&eQKxbqjnw>((1k+dANLgA$ZEq*ULG9(!Z`m4f7tL*vd zMr7Cv&r(K42P9gJrtym11=ZBOC(Zd<**}W1^wd|~;d-IfaphKG4_FBrPJ1hXz?1vW zO(Rd%{rkl!{- z)R`32nBr(R*_vpLL%0ij$IzB*YX_OIe+k2b(?r11P1lzSd`=!ObXC)AB@2z&gimiT z0H)HAT(zicZKsOzqjdvqZ#5t!ZTd1q9<~Y$v}U%h6FYSnVJv-A(w9|jW7XXs<)(w} z3w0L1pZy^r(&i@V+$n2HsG{AfH1soHpVh7)CmG|Fk5!ftv>Gr~_K1tCl>L}hMKV3f z$)gofcSK>6>sB7%8R!;I8{g1psFE$Ma74llR=gdWcVx~79jPXZc}ULW8*fLoYB$>jQ(`2uU|JB|iv-S&mw@57HA@Hu*(ZQm;e%;AL(zSJ zeE_rn;ZQ09QI8@?8^H@;nuyFiDaV>YxlL0Uti@Y?>qY7KzZ@>kZ+p0=4hY#6Iqe2N zUo`B7Ma!86iWN7y*(mo|gzSF5}U!L*3+e5|E zhsd zzMRbT{N^7CQhuUW=m)L@!-@hiTZBwjx7P_`0Y`sN?XT9n6m3ieInKur+w>27Nvw(R zkJ4LuDr{2eCB>*CD3l~wd~?P(IJ$0Fd*4Q?O0foN2Pgdz`nh1%iaT-7Z%-v^&}2EG zZ~{~TqcD5&eIj5gmuS*dQZI;-#S~)Y5o4#f^Bt?N#i{W>9Jh3B#IK3*iYOW&PpcUA z2QV&H_|pdOCezwv^^iie%U8D&AlzNT#)G;KmZ0BNK7h6Rkp>B_85PP0{gtfd3)3X! zWZNtN_gaMpiZT?P(k)Sz@^Op%%Qu3296AS9YMe3E7sP3VXp{1S{Uw39$O#| zw@T|79OOjWIFNZITQ93=C)8*rGljRS7Vk|K_ea<3TwQ53*9_h?oCr<0^`kUDhpXS8 z<8wDEN*n1( z8AzTvt&p=FM^zb#?AvEddh<%Z0YzidxJ=_sJL~-mPLC3#jk%rm8!Mc*yko$N(^RT* zJ=lvOJQ_zwC&&zEnkT$pN@YUAs34t%ehrQi7H(-NVDiY@xtY8`$B!UTwA&$KYpm#S zv4DE&GZ~84Opa>3;55m8L)U4WslMFP|J8kw>O06m2L6tx0< zMF}F@F17)`QaRa0C&vnktYJ*ZOYM|3(wGr~lMW@y#SXn-I#u=jy*|*+ZO)#5$vh-?Ph6AVvBdU*={+J37tAbyh7lXZyWQkgI7Z0nN8xf) zQbG~C`e}poTnQUS|K?wz*`&48nw^W1#W~%N&wHv&*5ahV5s14?6VK)9GfOPJqm|+n zn#xM!RRdY}K^*ki{{+~+%tgZKqFxC#%HTTEHJhPJWgYLs_`uWlX=?6QP}`n;olV6( z1>vKM18uKYC&^TeG0)pzm%zEP`Z5*c;;PKa>EH1^SfT*{*0z6qOVH&vkzXC6OYLGt zd{Lctf%3onVx)N|*Z)SPL1?`X%*fS5L@;wQw5zH&XO{b1mXmvL)RpWqd8f@uKiU}l zsOPuW9*6rXJ79D)iH%l#7cI~aK1qDHQc;{`Y_o5>4&f1@qms9uUFdn|X zdx{;S)KFQ}YmUciyMK$xee)rp?!{4BX7m@G|7sD-U7z+PRs|EL82CiJe((Mht$W4i zr9h#ZeVMyZi^ZyUHoLa@bab=X1^;!wey68unSm2&iWb zeJ0ch9wl0%w@msjvcPkbUt3{~94av$-ADBx`{N~}^i})Ji zY-qq$6x}1B{c%Ie8#P_26haf%`7UyB6L(sIxTKW4zl4qRS*Xj}?`*OPNI>fNL%B;{ z_29v99L2su?#1DGOj@Pi2xd@p2HH6V)4o}w{B~h*+MU-lC-&03w&;%&pAta9KN?9t zOND<&TmARe`kzzx>&m`u4P1BXuCPD~qIEVq?`iM)_=>{3>fqLO`v3m}eHhyRr||$f z!vB@-?Y~p~@&BJ38)V%7b!N7A&pK%bUUg*^iuEoMpVOJNa*c?7ca9X}x}d77*{U)2 z$Cl!|w${yV4=>rBp6eKjB4iseYOmI%7kxmm6|CxA=$7s1e3@x`mmVsd8Jv7pz zq9U7}`9HG)I*eLalif{7E`{jJXf2nZ;8J&Y@bDW|D;F0RUS3|s_is*-$b^FY!D-{$ z9qs=A8Y*@Ht)gv)WYxPDeP*n+vQckwBc)Cymk`;yiEJ)hBKo_-CGvC&i)eQ=X2>y3 zSk~0D8Eh>MD+Ok1ST8_;e!`eDChv`yw5T91NAjAHs2rql*;Yu}-S;JPX(Npf;CsR` zz>al)X|>xew^EI!5IB!sX6usmysxyFCh0ysR&6dVp&eq0tSgUuF$_MAXI0I|Nwcez z*4!dKk z>F^i95igDh$}js})gP*imT+z^RQ6tNkaD%=CeY5_nXwv6Pae~I9;Ig2z^ihFEH}5F z6`IKY;eBhzS78pPnhG9QKvrDjU+oQYIUV71$@Zq2>Z}j|2aH>0xwQ*-o+@4r@Ytno z@n&pIzDX2j?Jn`5k5eS8J~v$unYp?s#`qHGc@Do2vZ0%Kvbx1QqDo~hMGK-7rYGDG z(wSGg$)Sx@ws$(PFz^~O>*Jdq6?5h+2{!5;@eoqw`?9qzv-78)4a`R=2dVsX*1<{p@sV|GWfKPj15eXR8 zD~M>SJi_$^vgH{q)mrc7^jZQ2uy{EA#%aWgb{FRxNzHZU196nG>~&#~ zMj4}J587#QS~$xe?bqsdV%9jE4eRhgPq)u(+)VIUa_i|U{34cHWmh=%DErs>vEVNX z6|0cJ*d{*ymgO#Lgy*DK;B!>n^;g!ilt6S%Hs(W)k>=*iLr-~xm~rh22n%7%c-{tm zc)vuZ0CA?uTkR_E5huf1{fcnv@c{w%+`6Y?-BZ2^p}T1>nSnd+Yh5bnQ7LBYA`dV3 zoao(_LEpA(jb49mpBubdnna!HmSM9^ zk4w6AJ-3`1SIwIB#rB7eQK#7zsOmDQbS-wQ0(UWU=n{dWyIY0LUZ(sePl$c9Zd46t zf26Y4?>fG|X~~CRu&v>3OBa6tD;DZIs#;!&v$yv*G3`+%2!&2qP{HnQF#GxWa&Pcc z}2!XfF@x48LcA-d|172icK#k9g$kR?*GJBb1;=-qs z3~mW^rmA-AR13;_)&X9QwRn5?weEr{0~Kz;<~;%?c@te=Xih(;M~E}|>t{ZWvme~k zUWwUcPXD0HX>N_5rH4jIIf@@uLkTshagfmy?^IVR$3K_I%>R~6NDnrK%PScN0^$4d$297c?CPUvXsY4wwNUR+ zV2rER9R#T9G!D@DnllCO%dmd7gRNWoMAWf|YOEFKT`PPEMqBvIP}C>R`U}0wgLj^4 zK_47K@tSUZS=yS%^Qep@)Ha_WUEePn2GhKFxTX7*2l(xCPyWxU*8(kvYc+(dlQJC74qyzcx zqW&SH0wA(O6ecAE;(oaTU5F`ryZV`&?E>+agsSPKet9eO0ORSz3)%%c4#@S0k7eEi zV8%X}ryG2oi^|v=I^Ll(Hh*&NXstFka4*l(i#I(Ww{T!97Q4G<1ZJc-{E0j<;H_=B zi33S+IY$dgmEu_TCQ`P||D-x~)}M$(cIjb~q#RF@@gDWN_N~pXiEe?< zH=SY^=nP4CNf|V@OEVVD(2s3D%p;{Y09&&uG*UXvwvoOdP!OR98+>-;po{nDK{hm*1BWR(tUxv9U^C1#2` z^3I_vEQva(U%)`Jd|E3+3S&0y!g_ma3xA6$eh4QrQ4qQulozZ*M5}M@+pu$ zN4e}*ZlbRJ=UkccRQ1dd|MllcwxjV)&@4E;$d)TrQ~%cYC2 z1A`}CoEct8nw01$QH}Di5>R>8_en59_~j7hV7M}PqpL?#vNY& zuv*yHUYg6{Er}nT+K**Rb`ps<^bx(Ike8(!Uv1d;yoWQs^h5RCg*^*IKntta>rFYx z^E$sV8VHN&f>1~uVAqqDhO0h9=6o)HKdpfp*ZyQe4#Lbu!Gs%SSdJ6!T@-j6xL)sW zzIdEdJB{zwvQ3=)?b-~ttlU3h!@Tsa-9%)BFTw9bx8X*{5H^6qvFeTRsP~UsKUWLd za#y*xA1WjZJ0MTO(8-43(7rY$#qkrm&I7GhIQ+&5t}zOMGHYQyel3YP&;+I2ieJz@ z2I2e5ApJaHp7GNBl3FLZ);C+;(<4E~?~-J!X(;|VSv>~r{9s|6k(j?0H@37$Q?k#c zR<&4F^)p@xPt_FbW-*UP>8uGVpvzb~Jnp&6dW~i7RhE)0aCNtnWHYaAb)7sn6OO+r zePb2(x4GFPDv(OLIC5^5*h0v9bf4d?Y2$evQXqqY7ODD+C_-A%q( z)W>LA_0IU(xB?W~v=S8Z)9%J%&?c~ckZu&l^77;J`3qU|8jDS*{;pvF zSDPOm9a0n*Hj__A$}eMfrbSQ~>PtWbh+a%E0dIcRG0e1IR$Pjaxtw8 z;hE)CD03QMd2f^##2p1xeE*X(R0i`6OlQumX)RZ_tgwseRY$W%AL_H)MfgZ4d^@w& zyoPX#`M*uru>P-1*kEc1Z~SMfB;BtulAlWs3<-F+ET`W*5}c9~y!m&t_AmP7ETaPT zQDgmiMhNlW1mXoasH&xfKgpt64)H6oOY6$3I~TitLln3gq=-bp4lgfzvA3)F+=_PB zllpr6n=a-{r}tfZ7|(#GhZ`&sNuwq5-del|qA)pqlw=hfyUS598&&CcB_|fbPpc0AZnR- z3iukf+d4dNlHhHm%ohcDZ~q^osbQ{Qlx_B=Fca(7yODP$KzI{as#vR0XzqP++Vscc z01?rPI>55;ni>`t$M3x3@M4Vg9uqJe&*r%D*U{nozq?&Mv%um12lsg?InBhyPH$(n z^;!k#$5eAl;fJtRE(|!TzJ0w4#^47os-B+w{DLFFhU1f21BTlXm0DOlhVaetj8=D- zlMB(P!EKz*%y=!W(fNFb0O`>d|McqWItBz?fc)gh!GRK=0Z|wr6GvvnC#0yM*7SY0 z^qmsZO}99#(T`gWpLcX_Zou;d4^DgyIXjgS0^9zo_X^9E@8}Gg9WwoPcnB`mkea)K zPgZQQrm?(0el^EbT{QJ}h&)P+Y<1abA9PM+ZmFo2^Njz+YOcRv@{qbgGO7&q?6c%- zt!e4Hkv*HT41W8b!bjYQJ8+c6z|O91Gz*D#hV~#uZoSN>*UNVQR|dOa1TPwopsXPgiNcL%5bSZuQe`h`ttf=6qMoE9isgy+4DF{w< z*wT{zEH6q^T3VVa!}Qe5HnwKHJ=@9l_S<5kL2wq=(-LRRsGfbTZng?5v%V1?zmG)i zE2f3JDQ1kxtS{vBk-Ou+tJ!!w>b4*7ehR3de_+EJXvcHEj2chhEWPWlVi%fw1b@^EE= z)j)k2iE`@-2WRFan@L z+?J+`e7r({hxdc!_hVEOD;&4n=gEc9LfOSfH`9bK1?S>CKdjMBaC$k`y-wCGs=K2q zeanzi@93YQ*VGKW^GPhRQK$!fiesSZ*!=6HkEOD4Lv-r*Woh5(8k4% zp1bK-My4xi-wODMMJBuk8w2dzuw$7-?|)H)GyvpirTFd=Bd+h)gS6AF>g-hF`JQx>L928Ho$JT zg)`jzoVlU4j>~Bh_71)||5kHJGff>?b8uiSBY1&Vyn>ngtWKfJ_?D<&`MPNzUnmtifzj; z5ai*=H|9^U4tN4*lkRoJ=y@~5lxg+=Gh{k=j&c>gp6uq>yNb|l9gQ|-YE!kAW4+#rgd;X3-N{m7rC5gCFCme5UT62E=Ljf7uE$R~Z%BJf=WM=a^ z`9hXw&AQBOr(JT5YU_JhEZwLNHunYVx0gF$!KsfmuXf2v zO%1Txjyo)`v0w`Qs;@$>#3Em9C^@(!^o^+1`?2{)u-}F?Q8i?`@>f&c@W`K5;LA{4 z>cOJYxrbNz@?`K*c&d5X8Cl435Zz>Zh|O%z_IRqD%1K1Lr{UwqqA@+(LnQ_>U$oRS z0Tx{Ao)UJ>p8v{z`nx05>K$7}Vq)!cOR(}HL%n08z9Yrk%4|M({k>@Q4fo`TjdfD2 z&d&hIl6(7ON?`qkxgDRsSW(;eA*V6nB;EB<%hfU<%Hmp2JIf~}+D5_tpwo%SC z9Na8#Mf8jpP3>;K%uHNYpE2~!KSbx22Kd-J{Mw%Vdz859E5t%iW+{(wtMgh7DTF(1 zw>AEL+|KL2QV-_)%lh;YJAc;rHXgpK4d~yxONK7AU=S{k*onp3SdAPh_>8wUi^k6VCXA7FV#g|7FRTSR#qu={@)UXIeAQ}U%X0rXL0 zhyH{yn0K?78vk=Y8&Z}kl?zf=t!GX(w4F1(eOz=iNwx?w@3z7 zU{Rj3n61x|dmb9M%~v*jFzn%@r(2B3f(E9N!>hf6j`Y`*GN(Q54cFt6)8f zuM<+5dgD#MDx=g6BWv?|OKHg*vl>}t(4j1?ZRM%G6Y+!6;bQ+H@_LBvHSwmGYu42E zuM(|X&1@l6mqc&4$A+0}>XN22tCc#d*xNio-$xDp0%CzIIU~&4(SC=kRD0+D@-<}FIhqB9Wlb)V*In7PMH*D#Nv;`L z=$BDZdL{JpO%i=pF48hcUmX(WhWUibHe0Fr0`sEJMqJ_~r?e$OG zw^HELC=r9h{cpEfZ|RB7EV?~Mm5vaXic9HLf9H9M&EB3TyEzKsC|{_#>vx5QuMCri zoNuxGCM9JetyqPx#n76YO^S$v8O^Es^(8i$cF@U@->(LBTF!Kf@SRx8fHv=q{R;DX z6`duRUbr=^r&%!b(l-5~CB=jy zw}zh5R*pzURUs0OgOB@MoUVGN@oJqN;}*>tXu9@I`c+o7y7rhNjQvLDd1HXzV)w)%Xo1$l-8O7LW|cN-ErgYagkq z=;+i(%p&8I7_5p~bHr7b=gBH{BYgYDI;yB3m*nNbDK_memeE8WLG&7Lr9MIg!tx+7 z?RxUJtg!Vfy=K;(m$8b|!rVx!Xm&ZzShb!Ss?{(gGu~o^uIM+|a(|-RaiwU}!AkxC z;=4bQR8(%L#42FqhpmXM1+VBA&gZ7DOp<-5cFqxMqaIr_Xsv@3J#SFDELAd^% zfcIM8rSHaDB-tTa`Lty9%pC^2#YJL!?X&tuiShgYK#O7OD1ob6MmkaB^zhAoVvbfDxRt#1&$I0Oh zppwYoZgW7nz1ISI@LOmxw8v zi$E)hR9r&7j;Q+$T0M=i^PEX7$-Hgvcva1kZwq>SNhoWjaBG&5949yFdd~7w;d2z^ z)m(2gIb7m@pm|RI!83Ps9rE4XO(#arZ8we#5^z>MZt%_N$VjMF3;45*kJlku&kVP5 zhi!)Q%}bC$$Tu#|X}m609##if)2Y`TlDyV)%5z6`p$MrNS1L_CIcUi$VXLYX$(-;+ z0B5ar+df3%{-4z;cap!JyO3VBdOs@(o-fZPoEMgv=q0PQF;v~bM!Qo&M_X*UvnFK# z?o6&2!pJ$&A$xKTSl%L#*$`Weft&GttG~x@Pvr=W2&5T)Y>uxs5xM%5N`t4o6l;>5 z{nUY(e!1Qoxw2yTxOE$Idu?+GkbCwtGdDjw%6h8t0(rsVTeHPaUjRonv7W`rwY?Q% zZJ!1gwK`(y4q;Be6CU`ngh<oUoXdb;2T>G8RYjoi*MOqDbH)$)O}lcC4b*n_e5ssqMUti?X0qGP2y=N!F0ms zFuUT?H!0=kRI_I#m(I7}sqf+%q1}s6%VB50+noD-dDiB@+_$ZRp4?z((Jv)gVQ@$3 zI^a{i@_5b6*nrPhh0*o(+Re6`j{;5QJ|2%5OT6VuF1~8?2k9g9tX&K8PrQoOjtN`W z91dk?hg*_K&7_>$7$?aV6HF1*0BztRZ=ErF{4m%d>jMVnp%8a89L;6A;=79mfxME4NhSk_rmMOO<;~lzvh0k?&cy`E$JKlDsrM<7Q9xFP4Z>- z0#}xKHeEZN=X|jttw82OdU>tNu&Oh?~J>#S-1X6cLSn4{a9+oYqHSCPo))?yIG-RhxJu67!pwK$p}H0A>G7e5!dB&^PY&V)9jbJO zbw)OMDw&%f|8R8D)AI^&*_Jge!c1!%ua;zQ%XR$h=ht2VgWIABXRmj(1t7AQJM^WZ zSc)q&3yob1c6x{ZQKB~nwRdTKYrlU}!PdSq&m4MF-pEqy?Y`9RYQUCvAZ)`TCRQ=a zeD8GE4?7vt?Y!)p-JkXQ-jxU2eE_Ca8NfRAa)l27ctT$;55RE+G-rS7enFUf>C zRbM*^|l=)h3+$J`sOYl#2(E;{a9-T3*kLv>8qXHL9&y` z5*ugUiN38g{IgT|w7~Y!gVnyDHtp?e55P5grUNJHwNp7@NfDT51fMBsVi((fHO+G7 z9o?0Qs2`lu!<3e_QU0?=8EU&Mokm)V)?Wc($xp9Nmj&NUyvj0P#HXx^6_x>ra43;& zqJFi{O)@R^`Bpe*wd&6l`96vMicJUfJ7LLk^ddBbt0Q%FZ3b5JwZ64xoQw~*E8D=l zRB`~59hfj(@rBM&ri#u_#rC=?e)ZW*jM?+Q4Ia@)>eOKx*2t<0iUem`c${+A^Hr(a zP2`+!I6xjiMlz3iQm}Eq<+eSCTCgV*Ler4Ryh^ZAVt>s~7d!E1>! z7^mkGjZ$yW`#$AUyr&`<0d7>^JGqW;jI3kq_m>mRwLVLTaq3FgvTCYB{`TumZ)%hO z1F}!sB;NQ_KGMOuh~t1Xk2$OiCG0^Hgs-VYU*-NwD1yDl7X4&T-TaR<{Gzlp>*e@z z_Dt@F5J>suyP5B;sc8sIe!;Ek%NGnnx8mx1qpa*Y3Pa*`;? zgiz`J)8+l-WVmQg{*KObyFzI~oiV;%TNZ&Tnk$p;Pg$+P2R2Q|+!D?s^eA$`JQAmBUH*O2al4JaByH9H%!r& zV!+?u+jr&8OZflf3#046>k(mnu2HzaLAudS!M^=3ak7flxz7Q|^}q_MwCDH}BI zY7Y{-GdsNB^rFZS3^XtiTh4RKRm$!KKm&@XM5sNR=DjB-PcfeKJp+^pBUL)})e_R# z8z`sOu0t!caq6Gu?5{{pQfY|RqoUJ0J6-o2f@KX7!_b@Gvl|IcSr6yUg9HU9%&eXG za}m~GqptqJ_6OBoGa2gY&N192(NamQQ(Xnj+FJx9ETYC<}Y{^OGP%k3TY$kN-!!f6$ZC(AlM>yC~NdT+nB z2>@^+CDp+FXY-BsO3xTg@fsIm$dLFD%+{7dT7;NbeY3DUXau1Lg7y z3j9BoNj(nRjnx3_c!TXqftQmhpK=0m7GiNCLlboKeQugR%z=%P|Iv)fWPfrk^K)Em ze&wqFVHr6sEZ5$?P{NXOTxoS&9U)*&S|ot;9B3~m(6Wxzm~PKU^Yi&#AJXsJ=OT@= zJ7xy3)|~%L+rfx@fUlq|2QWbfioXSlI{o|SiR9z6Gw!SVgMj;EYaO0olP~mDKQOjv z$RoFr!890CZa3=s>KbM1VT|c@G(eoa3vQ=76sU5t?0s+aI%reM_N>V>()IXhg0+6N zc+tdgMN8IuKkn=4_-|b2xlfNC^VHVEA-n8?hy`Wwh9r-fpT#6D2Y$@43Yjp$i^P`y zFTh}{`H=-^aLo6*;jvkCFOHIrO{>c6;IuF~b*>l4J42CsdIA8Sv^isNR&6xPA_$*) zOdGqpDq=>f;-`5;llMGVfoNDF58BCvQM#pDgIScuhDV26WUd^E;2p8{y^W2HX5o(| z>_=80{V3J@#v||QeJ%*!wX50qd*7^HfI%JUGGUcAqlu!MyJ5!(s?jU<@#psl?`O4P zjT8_bo#MxnqnR3?Z8VIwwS{PENmFI%i$HTarL5V`2pTE2%r7qLC&nVajg>h$`G0e{ zTMY_89rq0*!|RwI7dk(Q!B*;I9Ly1X#B67@Xeps!4)V#L%o^)Wsjjw(#p1v86GyqS z_k?^DyLKqK>dx{>1kq;bpf2GnmG12VCa`GM@_oZNUB|g8W2R)AxjUN{|EYRvgnH`< zlIdytb4qq^lny0T&1&tAaO2{zAMtKsdXXbnq@rSb&U)d3czs8RfuZuPAW0FcC#t2a zWnv**`+MyQaTH3L1G%JY?5t=OQXI3e;_Ow^(-%^b*DfEeoLrp0sC%isKDSCBxcprDwT-`W1L3jk(?}V?^iCI!^b~BF+w%Nk) zlkj?<=@G>!`JchWAF6EI>7%xHNAGDBUSH{47_tlzZ`OP9^x`scbuOF?`0JS!= z=WD(m&GVJVkRFN07xoU7vZVF*f!O>n@4_qpc*0Q83E44qTSsSb9nhh3<^xs2>Pkr# zZ=v(v=h8_&oSe{lzFB&NcDyA4c#L9=+h=31iS(q2xHNVe`zkfdFlBTOzRVcd zw)m+;V8&3_1GG6Z8bH#*4(hDS&9TyYpB-N8JCP$iH9BJ#@GtJ{2sIfghLB|cI=h+M zdAu&XfC(?zYQlp=6LM0Dwk^y6XCgp9fHS;bzN7HFln<_Bf!}`&f=e?q8>Li#+IQPR z+h_M7c&+spGi)KT0;8b6>E>;REA|dEINpeZR4jEAVa39JBBFQsI(~IZ7I))j4%leyslXjkOOnmXHnnNHo(gAlG9F;>Nchr* zE&;UK5@|_DzO6QE`$J1%?n?Qd$OD30Pv9;cAK1y`i))osgMe~e*@(sKYkZ8z&wqKo5$fi%+`rL%`(GAl zU=X%Y5G81IPUU;jYbOwB{(s8vd?r4>HP5r&$W&Z>jMn<~6zviEmWVOaA~U5qQ16j) z`H{Imsh2g(L{S2j{zX!#%WM$gO&38F5SG_;vI-vV4^Sk!NOJ>oS&~#hS6Uzy9GTM; zKeW6|lkn-0)IXl6H}skqgYODQymb8qP5h` z1nI`(a9pz-o3W&EFMqAGH6ba0Cica>eDrsM822`VRc6dl-?+Q}H=It(d0)ylQ-#ev z|1q?9@uqJx-23CreQza8$A5ogBfN~LEOGd~1d6@e?`({*nyd%h>~0q4_y_&ijFVYL zH1Mk2ZgCiqoK#`XP`9FwUAru)wBbocE3@gf>8}Bbu4dsuCHVdx4Ge4YF;3Ofv z>tFMKto<&`tkC(Fnawe>u@S1p^rk}LxCdw%NUg&@7`-8)#NW*9-Fu(c3#4GSbgO)? zgvBO;?;ifSm)vATb!1zl#R-|uzRkxO7#i9eWiuOYc1+k$%Ph;*0fP6*Wv1>(14LI3 z)qc_=*E0`V!86(#sH4?X)iEcl?E&dNlWowk3w~%-9YZ7y^1L)UR>$XIAxQ^%PR0gr zB20y0I%zEzUx}%lY9B>G?yuQSLj?342}6YJ<;GLkFhVROBhyhOBuFd<`_S!`J4|yH z>oVy*mF^DHF!JpmCQ(2z z*Riu&VJ#Q9oB|(kJRXacOMgZgxU(AOmGpPBFme2K881oKZq9W1H6n~+EAVs);7v72 z*y?*PeOm_Vs5YL87$Ou|TK^7p9kZpYv9Xwt@eeZS0`vRtLMLw#NG97Ry8Fo~F?o64u&z49l zvCK5Ylg$yuPMPGO#*6basTH)s4cjVXDR#@i=_n+u8jm}py!j=gnc_AvjB}J<^iNqN zU4?TzlMP=_SXe{%QAxY*<-SzEjFZ&%(&lAlmV`5z~+@;b8L94z^~|s%Yw4?8v#A z>!54a&m=1;389_kuv3N>h4HwcKzZtRfBcJA{VDhpqRaYN+Rlk=T_8dE|F5#Ij%w@sx1>s23PlPO zFII}TxKp4&@#4k5xCajoZL#9THBj84xCSdy+=7J!_W%I`1R4mF{@$B6^WK^@Gw+|Q zb=S%{_pZCnxo3YqpS|}-Hevc)Fw4itqDzXu{E1j*vSAg~>=*nI|H=SaDI>TG)ZRfu zL2$Y!R=9flYk3;!+yc+paAm4YjnvW%0so2K@yFM@c`e|=!A*XvZ)!yooOW&IQ#7`F zouUT2eU21{M1<{p?OTbYc?Y&JFIrtc!@H*-37}nQ{!KUgN?CojMAgBhOfCNV*GJG3D0 zG>`~cxM(Lg79Ku9IAG67;2C1rx*&cpw0A(TCtUea=J<#+8 zN-JTWC@L#1l{kA}=fS`P)m!(^B!+oZ&xB+nFCS?B4#IsoJsx>Tr!JR1V}0ZgyO_6w`Q??lxl(clb?rDhT2!x zJi=s_!Z+A9Z)T*YoWg?in&KMy&R|Kn zG+UF+W3d2uyHc`!IX}EwwXC{5anNgaa!Xr#$#%+cczJufi^CX#|MF?Z+rmTrO9=z} z&q|p8={DPK8-|Cs(y-5$>7S}}J2Q3|6R^Z*kB5ya-No%K9Bm)!9vubZ^v{b1W$W{6jC-idDVHRq=moI7?uGOU~hXEM@ioyHw_CaenLm z?VYBkCeObO$<4klT)9xt(H*X?c3a`SuE(*^XlQ7}2>&MkdR&;VvwC9w0w$7gAT#u~ zQ$y0mUuIN(wbdJWYbK+;BQdMe8>n1O`rXVkSofEpx0o`7%{9?iOUn!$(VIQ;VEogx z5+Vs+E56|9Iw!YaRa)HfhU$q^L8hNI2YQ^ZbXN)9L~?)vI|iv9d!fO9j1=iVn-N;< z%$pEqt#~T;jhnn(YNvu(4i7W^Z?Y0i{TLqEpJC)n3xt1Yf_ZO}M)hK;McdorclBM= zoj6STqLzH9R?2wyb?9WbR^Gdcjh2u~%T|5RirmOUkP1Xf_e|FjB>gewreE9JGHC|< zYJLPK+;xP`_4K=?>rbwgWL2sy5mD`!>-XnBt8Q8;YWlhJB>U5%qEYbbLy2u}8ew;D zZ_xfo- z17Nh0We2tH9`}(O7GewTyptIgbAyQkEjfYrd1OU}g%16PlPxm5Lo_xL{`nXPknSx| z6wLbUsG2a)1IBz64txHl)g>_}9p*FrI9p`bp#H1ceRX3q=+ex5J!qvYF-(8EG0QCn zvVB`v@_@n{vJUzpgOD~oP8UFYzg}F+Lc5$F%HJenry5N|s+@RsUM73K-CS@qc4zSc zblhE`e8{yJholf$SeyS*0bCi_L#@^0KWmaYlMS1}IVHaY2GQYqwA7Y`HYfzrp6Fej zWvz-2)m^13hwa#<_M~^XJX#V@WY@eP(&O{HV0S za_)LM=RtpU4Oe7^ozYX|48bb(o z`+rTjZ8LK8YZi&lJy{N&ca!w-)5;xhGDYpEMaBoO3fOER1{vi_t2_tpXvk@{A|?qP zL*mrR#kgN3O>FTlQ_<0OdQ^FLjY{;7a<|X9MEUx=yK-j{l2;fumVXb`|E|0bDK&J9 zZk$atLJPYrU$6Geg{RICme0}JB>T`Y7CiZLiI?fsu-wA4yNwbSrd7>l^bkUmm}a<_3<-zU2w3lt`)9BGXiBqPOeD8aZq%f#(^KxC%B>$ zDRGEdNK;jEP;eEzywcnsef0RK8Wjql{JetKH(o<#zjxm+{>9E3(>&r^?$I_+ma@od%dHRU1i|u zQ1iEuEr+bf<9~9U0wiBuE|;ZqR&c{FD1Ug&aHkEv9QucE=gmy_1n@|xra&rbfN1Bt zddl&0m&)Twj?mEli3C~-1O#McNG?vdvMxPf8L255X}&BtQ9$WWnAHhPLRQV}yeAh2 z5oJVj#I7D1g>rbB2z1QD(?xxgh(eu+L`Bpjt&a{A)#hE`KZn{ttxV3hr{0ALKrrha z%h<8<e?ZAs{^06%MCvYL(IE=-;F}(n$y+!io)nzI4$ua>w5N2Ic zvK~btPDsZ;Z9cnPV!>GRGA%Rlhl8Atum(AY?ubo;vst^gewX!!)L;ec$yi^@W~D3+ zB+C7X1n@q7>)6yx$|{pqPXPCnuhr5`^HlagWs4KbCUHL@wG@9 z4dxjk;S!C`$k={*wHDbs)%lKA-Lm`PRpC{S7RLG2%<9}xFrlyF-sl?ayTgss&$Y7L zU|+_O4Zxr?Ls!r2*nsVgdPQ7D^UA476CCGG@(RL&-ePW))q~j<1?XzdT>X`iTA6(QB@{gg*{hrW; z9M;&U!V9LtEn?2!BNqg*#$D_Si+1P)gnlH)zr<4KF2{GMSQ3#l%#w)3%K7z#|By+^ zj5>UH^#<84<@yVhrTM6+l;lhFBPM?F-2VK;Z(}wOVUt24=Fv5Sb^c4V9Mh~_AJ|l` zu4+0gRUnksDhW+Z%KWW!BsR9&JkZ<8ifsb2kuQ9Jkn`wmMffNjQle*Q!(-ZcwNBIV z;h$xqnuT}SSz)XtZo*W2+ zGC7cF?P%t1r>c-chMKdv$j0=Zc*mCJ8M|fQ8}|ouUrf+sRUAlBv!R#3tpi zJk+>+cm&kjITr;}1+_ILJ}h=daDJ<(QR|j)Yt{=Jj zp4F{dHvcioSHMb%+t6=BKjTm3BrTlQCtl)cl-}avd>b{cIpn;f7MtysJg7^FZha?1u|1;llprH5 ztHQT%vNTz_3X-(@`w2>nXx?cH9-CHUs`e-b7H|qZl@Wx{`t{ckG|U>d`bR`szD(lf zE3S#lz3o*lz+AXFbxyhX*%+m{kYhd9)o+$TQllI0MOy6RhB_>!Tbf(Xa->Tw!n3pX zpE1x%nLCNo(Ded!>l}>=ciWO#l7#TZA@fJ(<=pAb_G87d2*74ykh2sa8Q!fKv3QpZ zJDNcVHZ$vYZ=~5}WUeagUrMW(Rx6#$pT3reQE&9W)4a+r#Wv?b^&qc(?D}|Ywuwmu z`jFO-W|4}75z?+=H*HrCHm?RoWbf?>H5uN^)vn#xj@|1xG2nJrCE`ob zgsjx#hm3*!h^_lmLh_~jjv}a_k{k-}ysVItc8_0-7=ROP&gDg*ETb4HWf&=$=^$I% z;o{DGWkN)R;ugm}dbnxk^IH!7dyUy7z{3H(j@nR^zr=vAm-FJ!tIU#fSNcY6asZ{9 zl%S9K&E)qX(4O`Wy=bCv#a1D}+^m}q<~u5tTL%FL7b}>y$M1ml7)}Ttp1r+c?i^FY zc00dSB~?Bw_%-^Wv+W15hJ|ija&k-?+;5C_LC|R#l1dbG)e8+-qG5t)al@;JIbR>4 zve0_~&cmqi2Sp{tLI+Ssh1_blHT{(PyeFqT8ZPlNjx16_*Ofw+dkGC7dLEX-GW$`= zp$o2EMQ@)?Xc9Zaa%W&x!%p|+E1l-0DrnLa47vLpCr2%AF65+ieCuo8o#>oI%?$C; z+MTwZDgH>_X?QtPNv86H|w5<>bF z|DCC4jl`$v@Uy;I*=yzf1DKw!e@iRcR0OzG*E*;X=P=znHU>7?fC{go6jqz>;Ig}2 z8L;MBOoG2)25dtA)X2{am8Xa%XH!qj0VVfDXj-mw6dzIf?-~mh-%pYbO4P2YUi(ZR zNR;zqSrp@Z_+qMGIv7EhmEP`@@p=OTT!ngX-22u) zGsnvZ#A)e$tU=ztO|ZV<*1rs5!&||}J%jXc>EzVy{Dbk^M(-UrO1-`)wp<5acl~X?v6%oqOeb1pD%&)Szs&&>>tvydcn}hptCyNO&Up z$sr9j=0;jfq)bLbScKiLFX{nXQQV7Jqt|+K2`PIXq|EktH>>gbHJ4I?g6A0W3QqcL zypJTm$8GxquS0jv)3Bi((!mEbcVxFxpY2qewga4Z9AwEk`n^6_G30$R;3cF*CuV)D zroGl9{5;qzxD;IFg_v`@@b|^zP=A#~C*k7?ZLp8ys9wAad)75Ufk)4}hnLZrmMnSe z@=W)+m4zZHT(9)5#A7QqJc;21N2^w73cIK8yVR8#TLq2jPC#U*hN~czrVeX@CLa3~wB% zGOni7D+iPsu8g)cJhChXF)%VFUJ@|V9GUBxs*qktPM4`gPkYc~n)y}8b}EUZf)k?X z(59Y{H756D`gL_)(cT_3$gQjj=O+nG<*Sz2R2HHZHZP@a zc*TPHMW`M;F~ZWt*=O zHT+H1fNkO|A+oLZMZMQ_Jk4#W(4q2@>A{8}ZuK8jdHc{ol@serCt9JS+E zEZ90=&>#Q27??ynGYugeVhAO~TD4xCPJsO$j^#&Lf8R9sP3#k+sym56I^Q?l%_H>b^85$en~ z)e9NF(_VF!ps!=I&cO5PsuRrNEK4co;Ha8as4C{LTH%JjORpjSa7$`0M=W<`1 zbxAMjpy6RqtmUgppkAG(ri;L-9XXiQNO_unIKyp2N(89Tg>JBXUQ42M_O038+=}gV z@>frkq$}4x%%cYu!p1-%|PM)3~{}ZD_SEXg{Bnuf=deg!9CvALc#-jDhZ#7#nC?9ldD$IS^Oeb`3QnRa3Vxy6!&aE!n(-as%b`#^^6NXQQ2J8A&hP6GK%pMyU z;NBd&KwOvS0r8YD%&mnKUZsAai8XX*Oyjl9X_{jx^lv>&ac=t_*ONG6N!{jEaM+I? z$C)5kj97(1l(v+O%3(xyLE7#^{WZ*v^^a<zgyhv z>Lyye!Xrbl8i``LJHSS0wW_#A6@75ZiLI*^N2J1QczbN{GNgP8+GtIg`vOy2FIarj!$%QBl*l}Y>!H*I?x}7MX{r%?CxGOBX8476ITZIO)8B>U1_6td`JB4BJwS!cM$AJnL<}5 zo(0=%uN32BGr<@UxrHURTvFetuTmJSzBUyd5ADhM4{RDwmE&wi?tEXN!RBwB@W;<{ zsPR5ykpU-(kWQBip^QuK%3y|6YZDU_5C|0J7j}g-uM;CMSJKZFcu!}IKgJt_ZM40R zj7X8A-iaTHvFFg?+&o2_*p$y~gV}X*!#M>d^Q$RNns+{?_>O6;vNI6jnZD-Kt4cWA zBZIx}UU2}U6X(0`4Z7iWAkPkOchovJdYIp=tOD?Uq*3RbE|%zVn)IJanGU@*PDrj8 zTiIv<;2-WZOcw|0qhj+>fU}Q}SL4S(ju&M*i%no+vlO2(jrD)KOP6g+>gEUaHM z&;N8|bMt+3gQ}5T`y|f0Y&GoU@}RI{bYWp(dn{|d$_NccFK>v%0T8nlibi(gaL%*# z*n}1zpK0Lm(yw#uy*H#83PrBTDGs(};D{vSg7ZoTm%kopivFrVy)rFpNU5gu?KOYw z=skQQE}R0NVi)Iq4Q}}9i?V4;yCCt?jw#G!6X%&st5##TzPZ!XzLE5hZAel?(3(G1 zgF3sS3;U*G)Sw#T+NEx@=}er91Edp!T-aBQF0L*~WyW?bS!rqWl?L@f&d>&zmClX9 z_-4DQ-l?2~1etjdNX%=0v7XH&kmC7s5on4o>=q+~$m;@bsb#DRm zx~xyvoVM4sl05Xv`Thua+esZV7=x(XlL;=&U6S1Zx-8dTs}6?Muu7ew$ByF@ymfBs zp5zq?Dvw4;EXKj6m2M}lQ@{5<$=SO_VtaToLjSQfaXumvE~&g`)w2$JnAVTM6uVQB z5)yas-Lv=IDsPM*Rxi?Ob=w%olZzmt5#nNG#1YkOt*x)Fu0WFhb1N$=|GbHz69=BG z_p7Aw9Ky4tLL!MYTm1^3+8qaiG~!r0^#OcPCyJ1S@31PU%}v!cpi4_m4?kSgJ~${= zp4p(e!3z413tkS%)D8INd2{}byGSpo2aoDnMkbta*!^Aa>mM2 z>lNKJW=5BD@PVY5R03{mO|+Y|10USKzu+X4hvj$S1sMWaBaxhLQ z=@qwOgWYg4yJz4Y0-=%??x`};VBPcefhX^woWEFjx@S=V<#low%UAkh%iZ>N-gHUH z*6^`Exz?f_9(rsmM<;CKffc&~;d)+TCbxgAw57T#6gtO;euYVeRAl;iUq>~)zfT*f zG^U(2&1S$bfc`D5x~Z(yWbK)lQ{%pU+(fT{s+UN?Esf`sy2OOzw(35D!1${UZLV<} zcI~-V)tRa@RUcdDnr%~qop^E*t+X!DG1r5FEVR| zzbN!lh|_pfCPS3NPa^+4u;@2GQf+vIHzCk=k~bHRpp+#!)6D|R_hC2V{QdHju7Z_Tv{v;7wzH2Z%4~sV#AYD51fO+iq<7V zR@5S{tB^8nja;cJtuj77zU!MC`<$u24>dYEimOmU2T#n|ihypp!n?Wy6(@sauR_7w zC`)xjv%e?9iZA}gl$Gjex(qlIf)pGn2^2?RH}jYyN}QzTizAmlV;O&itIykSRwmqT zPX8w59F$Hef_*a9x>#%}WevGe=o<(ZB4Eu~X2IYO)KB5(2DM5%x3}4gXB}Snk>lZ+ zdJ2ftHwDyVs7n$@bXiMMuLJhKoUrTb>yG5^)*&n(&U_pl8fpa|QghS9Dzv#;8DI-k z24(q$h0*)770n?@9N>hm^+K;-X*W@T=a|d**Ot#Hwzt%lY?h97?M}wB=+Bp7Cu9Eo zs%akWokGu3Q&K5Z_7@!z7?a=u4?OP=!CDKS135kHIe0dTQ5_WcW zf%gRk1!QDo_Ftcv(7jN|`^dRTn%YQp=7+6d4b^-dMp4l7kELjtah0Ajw?fF&u)P5F zNMBS4MA0ZC@b^*rQ{MgdM^{HTK{_%|CS(bl>9g5TAEIr3c0|v+Dd; z=+nzoVd%3(-=i9C$|D+ad&)_b?ThbGKAVV6-rRhLa%E z`1z!f4n4WAxU%1JO93rTe|{k$V-8m=d{Y@2{)#!KG$zXQu+gxJBAQiLSeTbL9$=r* z^az916TrC+PETtEwz_ii;*=TprdFLGjy}x#fu^Qc`*NKALS7kXGZ!fB2=Dj|+J!mp zK}=QH2?4&3X*oIH)@ogbLTlahi9w!Y(*&<^{R2FoW!>vcZdTpWZ~b=Gkx4pv-xp$R z^s4kwE7=0n)=x5~{?RJerKr~}NKV;%8sBcat&!4dgQI628~;$josQ2{RJQbbYafEE zbxP`?P68tK?L+@G7;qO^d_@KQuME#|{6HNS>Y3|~yk)>L4n^GB;p}L<-2DbPC8@I; z9p^7jPxH5;g1S&wVYqbB=Prui8sfn^p^C9Tyz;jt?>4m4aa`+evo8kC*b-qmKLSDA zN5-en3voN5ik0Y8O2UhN5d0nY$0k-QB&oySsaFcPZ|!gS)#s6!*a&+W+r<-w$(5a&pd| zeX^6Cm6bK&^0HzGusELP2!z= zRv=6TWCTD!YGdJE4In@3Fm~b^jvydko&J76H-8ekfq?YSN(c)myXl^7KzhxK<3ewL zNVacyL?#Q`ySk?IH3qaxeHN&y1}a+!>{{B}wIKhrEl#k-H))yqJM`Rlc@p}Nri~ag z#&3AL{*p0ngqqkcL!Uybl#Q*9ujP})d!qn8^J1#`t~cbgcG#jU#?r_Sib{uqu@bQH z#Kd8UL0;d&g!h|#V001W&C;b%#1%`4?5@#9MFs|$&t8?pC%^GXN0PFwAvIoFT8Cu} zhHTA^6KcM@eog*}hI}18_+b29I5UDTXaD5eoVKMR7lC28YB-mC!~TGiJfKFNP;5`e zVQ*sWFo*YG%3Svd!bCl5$LBk9rpZer5?Ya@yACsNg` z+am95+5KDiIRM4aHfGjI>=hy#P%qwYQ{bC%U0fj!Ife}Pg!1cy!Tr!wBDc@S%?odD zGX}C4_pczu*Di6x?l00M*T9BMe6!bSCr!oM+X8?fkabk!7azd@b*+~+C@KtOzx_L% zjk{n|s_p#g&aPERZi;_cLyee+7&`K9sGMDpcAl{ayLy>P&0O$q;361omuygo?=u?8GZiLfFo<^iEoJPZLSj3`I?5s*yj@xUhu+fG^#- zLH02Vz18jF+?>F#4#}97QRpFFHu*;6Rmic?w_}Q0seAJWo^diOEwQ*8O|{HP$bw&p zgI?!~X*Xb6lSO_7{jGn$pRNT`SINcvYb?ZJ98PFs-Ema236(PXdTwO?@1~$vt5+4v zt%U?umoC0VAVfs?(t^J{9sh@@H0ocQaXHdZ9GH)h0mfeNpqa{C_UC`>8H7IYG7q8j zlU4qAPoW?_my7hxrP^wXeF1Z_y2I1Rj_=#kM0P`g*i_HT2-G4gE4$+br(o8W!NI`X ztg^!ROm8Xs^)LE&3v1N^p2;prTN~N+H!OIf&_f-N_agtBI4lNStbfX zzS-*cC8*YFrkx?od8BHzTtZx_Gf7bV#yfFTGS3#+z!#gw}g}Uaw=h{)>c4|`Jz!?e8|0_1@aYIZ*XLxyykwCV_vmh`i-Q8 z)f#Ha{xq18u!^)Hp}EV~yM@Kvub$A*?j3-b$I}5m>%#q_AP(s5Rltj9SFwsfm%`i| zM#iP?oLV$7@BTh^WG*kX>`KoqFgF;@VDctWvC$@)8q#B_e!t{saF;REL)f^D{DLEs z(Viz(y=lhggPwsCtUHmO8+>G#SMd?evt0X=1LMpcDoF2n_ir2p-w|}XeWEit9AWof z5f|8vf|WOY)u|M zu&WfO!0{d}h@oGS1%0+;`&ubfEbRrXxW_*lKLePVG2*;=qbO;=Ud$TZs%5p@p$JXf zIa|r>nuegpeAypdyMtQ2xn9Bbil$eUdCGioLaBBUi_OMy(I;88lX|;e@IgL$ z<0tgI>m^Vn5Zux>>QM1rjlr6eR&rQkx~a0A-pO`N70c)91hCRZi#BMvKSBc!w;Jea zw%@WWmC*7haQRt6v(6bYaZp6`B6hqnh+!hlK65P-dVS9%dT&j`^9m*=l6R2hzKtr8 z;vh9U2`?D9`MG%z!;CV znU!9C=i*#Elr;;s>RpQUw*bUFn)#61>^_Od+1 zhjEQ>s8+1fZr6nvZSomniO?cfHs8odnTLbbb}K3sDsZ|h9%rn{R$$VjAjsUJv53B6 zv8tV(I$;O~X)80tC@@~I&3a29ZVVoa?UJ^*)fD3m4Ck$h9Q~PlBC_%vRC<}0@NJy|2>p83E zsdTr4uwH8r+UT^kcYlJ3a+PW8SRDifHbAFO-Uc;PR)QD9(*#fq3DvH}L9vYgiy~;3 zRvd%2K;*3kLsdSy*NRJ(S~c-A9XBLb5sGN**9qJs@BkM;lMSFYFI-||#QbyR_&u}P z>DkSGKYaAoz3VxxUV*+B~yXj)}~=NF3U%3d!7W6XxP_=v6G6GE0932q0p$wc4wZA7%RxM_mDuI zI!Co50i#`!EW)S?0B+!S+Ot?wsT-Gu=WF73Bv%7=6$;{GWFo_(P{4>|HCy94FQ_ZF zS_oudjm3v4WVIru{+y*IJG2tx`B zkBmBlbj2-XX?Gd|J5s82t3L-oZws3Sx>($a`c*y-$r&P}qSH2&WRxe3xV-+b8VW1z zSIf5NC^wipj4n-vva>9eZ1R%+zGixoE^tKCwD)$Z#y#xCk!V#-{h|EY z&1)~)^+jL^XSUI;lt}(d%`>u*FC~gX<%T`yZl1;YGmaPUFB$ z)NCyp)Z%QeNpUPoxi0QumG(ExH3j0cz;Cm^)HP`%<$NnUew|bKESFej z=5t5r!-VJ0?;5Yh13$E|+-G?lm=MQ*u-$^VwCq*yG=k7%HC*eu=0_XLKzPcs)<4${ ztIU9Gt2Zi0bFxC4JPFV?KWStBj5tN#7Lfj2|d?&}+U( zq$J0d%i$mJVW8zKnX?74iT7Hg9G+Do<34H?8TrxL_OSI(Q>p}iH|!T7xnws zn=P}GY070Iv(UZUb_tHZ0Q4zskZwKshUi=-6~%%HdsgdxHK*q9cnf+}let=bIM=fC zqAkzL1pDhzP@G=ahq+lq;J*s;jpg-*0a_u--6fYAJ!1-686#lPZ(f5rRcJ^PZA}$H!f4_-z|DP{{uM<{93V*F2|B4t6 z4i)<6Vw`f&MS|$Ri_dm=|Mw8e{}rO60{-`o^J1b){~6+Sfh0G38i1n=FfO|-nRajx(mVX@7aFB zV;`?{{FEY}ul{O-_hz?^*~$%G#5La6NiVxRygu|YjlTg`$;=@Ei>_}&L8^ENOlMGc ze9cOH#!Wmt<3q0qa50>rVSu9#OntefNP=ZfcaT~a)rN2?7cEf#sGOZI{9Or>Mux`0 zBL{Q)#)DmGa_dVhC@b!jZlv_t3vs?7(y}F7zTw`dk01w7xp9?=@l`}sygb>+$H2|L z;i`=p>v=4oq=p_)GOh1+C|4|&AocM`1p`F4-~Xj&EI}8GGncL7!;36QvPXocZ@G4F zy4jX63Y$xBR7R5eMJm=arKGQZm(Wo4>*P3gxQ*45Ba${6lNVjy#xVLW`|bOkY6Uxx zUlKIqXTwktlHx8?d>&yDgQfQJ5|V4jlDN74W~##RVkhq8)?SQs{x;p-gvBYJ#wf&+~8Vb^k!#E>FJeoarv6Lo5(>*G(BrQ<&aM{hMkNf>u> z!R{T_^?-mK!0U4%_L1}oQ#KrPUAqj8I$_lJPKmI)Xu=*&jD$4gxt6D7Y7(=&v*Hz& z46XyQAsNps+BY4isVHR7e+j{lL#H5*%BVk}?m+gVPP0;IwIgexX{Fr1HHO6~eA0>F z1jpY?Hpv^KwSF4y{5fzHN$f=*w9G6wW`wblaara>i`V*Qm5b zF3fQXWEWsi*O?A1g5ndE^Gf_kc(M1UZ$9EqHF5w z0~;F~6K|buS>5u4o8P}I)&?;mu z*e#h#lG4>5Bx1@6xD3+>J)?7uPd1^{1!VLNWa?j6!bcK19H;3~PQooCY78!h?HcwD z)o7?=Ut%FPQumMOdGseM@GoCnFML-R@*oMtpZFbPq4B!h@DX16@8wCSj}7zYge88{1w-QndIpbQ-)HH&J9M(s zPg7 zFwCbnnECfiuJ}!`7$Wujo6E0s--gt{8jQayh#~kS-FxvBo}{Gj));;8UB7|6kM?|j zr2Cuf!9<^(k1l8I=2h8icZg5Gidx|2_TG8V@gX2W>UjWqsL2!~jC8CnfdYLy6VSZh zC8?7qN|e(@>52pNQ?8Mg8#ht()R@GGo~Z;hGvOR@@*Lih#is_Jl1)@I3J!x#!&e7B zlJw`&A1))xeJ=p{Y4y|fQtpXod=REytb6-uO2>@3NO~KXz@9qgIfGPQOVDCz8A8 zaV4fS5EYEqo=;=mm`=u-adLm7OZOhh3u)f%r*^b@%%j&K+(`bl%QOGGhYJ^NWUzrd?5`4PW@ z&6dN1&eV-e`O4Q~3uyqn+g3h&B-YV>M*-BiM3zJ;ZajKS+`NU9uvf zdwi2e$~uo60dlqXWQEd=U^KERO=Go;_fNN0)Mh)$Oi{i$e}cLqj~{Ar%s{KVGm7iP zd(}0<%Fo}S0an^$w)yN(U2IfzILn|cT-3<7>Mg2eZqNqQuCd`g;V8$RJz$QjVZFAJ zq#B`_dO44~?Dcs<54fo=?GC%TSp4cI3q(QyFq@76asTUz7?-}XLiQ7duQNpMxCB8@Sp z6mL5q68Mre{N^=up{%=U!-O{?__3-&s(v3kJv<0|A14~EF#bcYgl}1YsC7f}&(L=bu@Hx2W~Y|Kzbuar?|V47 zQ`;@q%!%wj&_=s=!uuZ@i}Hs)FW2Ly?+|G#Gx)d?M~qUjZAaQgsk=%s>Wot+q;7dLto6OR?e2ETN^U4SJ6%HtIQcnBLUKyNfSh z=Jkz3UDO}x!LTch7_7v(#@C#YPONBhl~?$!y#f_<+VW42SLn;|)xFV5|MvC%mQ>a2 zWHvMJHX{?0&?kq>U@`xLSU!WpvDhvm;ZkHT)GK}J@%~;U7#2O~Mi0W`6Ka@W>JRhF z!DG>bWP^up$6(adKp5K62|j<7F-YNndqqMDsFbo?URF1VUBW=4)WKYIXEfwb$`n`Y zVvSnlU?{M3ruH_5dI?jiaioM4+3c{3=zt?{kB~RE171g-`^3Afy%FI8k?UBSiB7$s zX_>N(9s|FaQ~vEW@qkO8o;Jnb{gqnHcK3f&*4tf?moQryQrCQpfRCp(q2Wh>8L4gzMzq#5bf&=( zbRzW43Solv-e{_j_IF#rL!}+hgi=n7*kfGX4jl?P$ITXke zST>}-<8hdF$4UO%i-oc8xk8zHbP^0iVq)gEjUNCiVlpd^q)D=%%Jp#Hppq zBMc|K=&03eKy+`9a!Vsj9D6K3%+P4E;S`7krUgRs)BM(ij>V7UB`vZgwoUIa8IX zl#?Csr%tBqjgf~V%|~elg@y`^fl+u<=bDIYy#MfL$O`EhCFU6iSKR@LM8VlN8DkN@ zW$?Pf95Q3BdvY>UEJB;?Tr`@gLsxIKAZ=T!f=p8!!`KbXX-`15mNLzNj`D@`HBRi*<=+C1_>+95nkfk+XKceRFjAd zS`fc9BcLacut=E^SX$5TD4ouTFh@2ua8bo! z|HiNdjv28-BARcTla0l46sNAb9m()HOV>&j+%Qm>4#nuOhEm?kave0pyf$$k5FlI{*xP#$ry%$|5N^31$d*?^^W4 z-fuzIOUtRw9{eoF`N|B-+S*O0Zlwjlu+0&c{B8V0rKgVsi_L{OUv1j}PloLU>&%vgaXc6)z05YCq7YetUDDfq; zD4Knp!2r!TDIHvZH;zLs#Cx&gYGV$)Zd@n$#OnvGQq9L^CLs4jE4agkmXSI25qX92 zheClP?)D6A!>tFAG#nozc6m;5faCPPWDNR}n}nd-;E%i21p3XWLDA+0=viRB)`Z}C zxry#k>2NR_{7KXH4GlpbP32%_bIKQrqvW|x+%+73fWO~S`hx3OT3S*ZorZioq42tr zTsf%Ae&PVvSLPqA`zS3F14WtNxwYXmdTX(`+Q1vMnO$VH!iv`j^{cqHBC$i>G7$Gh z=1{Sku6SB%imX2N`zK5Z6}VHD#~N!ySSwg>`PTrdalg+QZ0&rh?+>QeB~q!6b!Onl zXd^a~RnsW9_d?-P)z+Yc;NaY`V;QCgctT8kh`@L)G^L2b|AxEzW{h-* zkP#5}CZuj>jC8ptW-xsM3c00~1n!^GY~*k$DoD>`czPg1ceT9}=q-WBdhamP~!wn<1V^O9f@tp{UW5Jb_{4us;mcbM0`4X$gBAjXatK zEdq1d$)g2%At_Vv`%Ch8kx!aQKb^?(g6z>fAARH(3=jqJ4Pd8;fu@)0z;F?%$Ch7q zck)2tKZi9PoEOcjrIJE8SVF@GbNbp#r!iq>YZ=v=zH!2z%VSL69J%vtYp#YYd!I3~ z_mPdCtwQT$ECTeVoKqP*2{5QrV+Epd`IGytCBfbbQ6xf(O=haYOA=Qhb6okEpqsD~ z2rqCDIEgIbw$EKEjON@;ZSYV-v=*HN1XM&D^wRI>0{-$(zaUnSxG^HUx*sN(^3S5G zw{(pbS3aGN28ce|zV`TCR(iCE9%Ju)aN8;i0^{>iPi`?gG{fcG%<5h#k?|*Cwep<_ zsA?o_s$*!d}lRTsJgQW;Q%JnRBR;Gr#(7U(Mvu zMDQ_{MF%nXP1TER|0X@&|F)>-y>F7IeKDC3v=dR~9z^_i+3k{PdEg>lDtt>Rx=U|h zk4eb>wqJm#Cb}<}HXd%PGUL)t$NB=?+aLET%}(HJ1%8n49*Y-d7$Hnt&nP1PvtR-k z?L;f|t|mm7b;I}asx?UAiyMSrsn`5QPl|6}}!|NIALgG>J-{1)OzD8&BQ7ozT+=z)omh25Cw-Mzp5`V=ukP8lv{bY(S<>uwpy?4%Q?MuD4 zXM16PNoQy6iap|Dv^Dv`tIQx~>b|$Aq}Rz%(_G5X#AOemp6RAyoTv{}8`-&@kfQ^9 zn>S9lnr|iGX5sW2xQ@fkTZia+p(FCf#~sWlhH)>tcZeEvZTgbZTUi9X&Rq<9vH_jb z=UK|7O6WeJSUppy0B*%g_+7fa!J0Ci#WJFDi5JFP0bZ2V7BM#2X4!*6eH4|4rwIl6 z(N<`#nC42G&Sa1m_0PHoDePd$%eEtv{P2Trtvr@bM;AVqEqT?^cD|3<;2-4lpcJ#2 z2AF3W&L7fyI?L=R`0dU^n_LDp3U%q|J=we>>XIH!sx|)-R-Ql`CqJ~$iG_%@0 z5$*}Sd|J9_F)WtvhNrWb(Vm_X?z?R)2Ip>M5Gj)C8s*E=7`$4nx7dIO2cxy-y{IDf z4vU1;q0~iu7gGuX=+NB0o+rU)`Fu{2po5F-HH2FiUgY9iO!_ml2S?nqP8ULso5H}y zW0x!KhZ5#2TeV&5PoWM}`d*Ka@3=;t=%~rL27BOJwSeVPu^EROwpaCqgi8i*N=zii z#D+a7g!*zh!!xaf`oqyU9^<#}9mwpuYoybX0i?F^ap!@hrlj<$W_0ay&P-JTo&sjiq zUx5Y*Yi#_%aTog{pRdgK&W-oUF58erCAPegmiyF2_V&0eH*5j3k)~G5oE1e*e_)$^ zUu&+u^qpP8D*kA(*>dfYPQApQYvOkPx8hrDL-Iux}ugyz{nW zzic0v^G-Qq`8b1lDHX1F6#giI>=|njO@L2M;^-kpA&1tC2c)+#K6o8=fsbO>yHel+)4HdgR&r-2K6cae*JwY0yaT zk@`##eTM`N2?mEk*mrex-909CKVEJ*qM)Fx^O<;LF|Ut8D+<5#A_g|L zx$?qSsg2ExiDLlZ+sjmIelm9OHIOvsGy|xb~TVB-31I4Tl{*X@2=pR#|;%}BD8Gx1g9U<_X zy&;a3MI#}j*VnzVqrDi5r`mGu?7D(r?s&c-L9h!LzUL+Rs`37@^%5EU)^w$+FG_Qi zku@JI+S$?*EA+n>UP9yarl~t?yx$18cS4kD#_{FqE@H38eCrwxOr3Gq%YhGM?91I9 z4LNN)8>ZIl`-G(n4+CS=hC&IP*2|*;5XUf01zCKe_J(bR7 zns!gF*Va0>9>{TA@IMN!-$i@Pbr?U)F=#7rBmR(=#3pX z+fWwn#g0tHqy)ZE*^9hbV+=rv}{K|IIKOt^^sWvnj~H}X5nh^RyIuJ)D|%KpPU|^=^X_TSLan?KZYY%%RD^& ze9w(}43~Nl(c&Vn*DYR~yomI04XvewQjPNE8>yD2f`3}FDWUOS|1DsG+DVtzH7Uih zk37hgQiHKrZuQd+)Jt?9g;r_L{WW!XKh^8ynWed2Dt=0LFFdxE#g@aycPU_t+eYvk zGeF);Z+$WgSC`@GvFw(R_3r}wBMRgUBOcp2m`_bHRF3^saUG=p0KWsjPL~9Uz!P^b~^I76HA7ADn03f+7rM2`D)U0Ckd(0T0m|iwo+?C zN&X9X)^)U_Dwu^7U^lA{D>A1S`VQ1R<86kvOzG-*7Pn+JP!P&Iz-=;CLV)4tY-Rk>XIzR zeEy5->ni%iREWnh!Y-4!O!L%>R!WV>g@vjww1MV~17vS)U0QuRad*H}c#?+^^YyKq z`VvyTSQg-ZWNzB_4UJgNm>&a^ZGT71vPo=QZ>`qh)I=IvK{S;!_a}Q5KcZuvE=R@L z+49xb%|t6mpV*(&anSW@5B=lcPZtO1d{3U|au&>mC-LmhWpZbZQBX%>MZO_erjX)} zr7__L2>H>x#17a7nqtb{1Ph=1@#mr<00({0V6gGd0Xm=8&Z6S4EeQKF7foLhZ5^2e zv4&eeXD*O4sY$KrMZeNU2QjLeGYa8mIT3=DEb*&0;8Z*)2j&6cf8>(@37KGClm;F% zZ`P=))THBT_|Rr~V@*t+@2#lz?Hq9{1}(c^xs^3>a4ud%6KUrI^I=pAuv?Rf}Ss9(;BYqxmgDri6x z@$fM)Oa4He+E0xd{)PUjyUOVtZuG_hd@INcj|f=}L02{rO}1*JcfH_V zkJ_Ie$99{tzrxn|x=?n9@#kyD)!=xPkiAV7=Blzwh^)3WcUH^?A1#xSV3q>j`m)+X z*$k{QA4d4kq;$dSV!oTA-{eW?2P1JPy=T!X`WdLTv4u)5K6E`M!{E?T=mCX~)=7#` zo!(IUquDi4*^mR~Igz$00UyTm^?rg;hIOe{Il1j)d6A2QOSWVK-I=;xByw@|d^dL? z18*>?PD^0kw-FjJg{N`=-Cjylk$u^cAvivU)7}F0EAo27J=UanB-i@hMLBMKYM{kN ze#cqD^DXE7>eSj8Z$v?U?x7KAYA@DfZ-4Sc^K_c^T#I$Ccehw7Ssj0v6TC9*7WD8Y zQx}g86KJca6(pt;zQ53E4RRkWtLuNauvz7t@?b zrjA8@Eo7=r$Z&o-0 z?x`Ty9cTucN~a37Q9oDeEj}AhX0_zOpbV_+ZtM(z%;3ic+)JTE^ZMrr1@Ftze1_i4vvmgn>PCzN} zrgnE%-e@OT$`-JoB^|D>caoToKnRvD$xc?Tf{&!dWl6!e!(!tR zHL~31J!L;vFLES&8QEdHH3r~du1+V|alMR8D7>E&4kD)xMeXkL*;Flv!N=4<)fF4* ztb%!Jv*otuH~2}Msdw~2J^q#O!5(IL zvI&c7PB!vmhd*4jFE8Z;`8WF3caQT9KjHz0JjYNMtcE`j$rCogfCJ5Z*ZZn3NRfh- zkO}l{X1rEisi5WDn+3v=v}WpK;MKb4g1;%xcV-6R`i`P7|9suQ4J}Y7|n6hBfo|m^zs~1 z8wsSvFE<>`qckl#vfj<+g)%q{jH9@W~X7>bHxX<);GJ~xr z*CdB-2lDB;0v(qvj=#NGwh?3t1^uXQll5%~ZR1OK#*;3t0BtBm33| z2P7a#v1MdhwSFV-i<2RGPj@VnvWT^UE#SLZ?O}Cc^V-(>V{5rnut1*Jw&}~y z{#B*awR)FVR$D`d->R>t#Y!?!YnK6Ek;ufWXSmL!v;Yj$U7`bzQ1M`wx-Ypy{Bj9R z1adz+VbiSI55EMH2Jn&1<9=wOKFIh`+rx$Vp6hBJ!FD&>?xwswoqAcHB3-}qr_h)> zg_oCZHe!Y}WrIZX(#ji3$BY=9rNTdWXY^Zg=gDk2uFu=@K^tKaNN>0L2)KChV7pn_epP}sgQtH34% zWNZ?=-`Bugsw>2okk)6S{CvY{!#hUiDWe$rXt%3tAjmmj9w*g=7v+?SZ^*xt@mPK( zxN}*03-4FT1}j>C z;^N{`(j>Au*@=+@ z`#6yO#zkMP{Syyfsjrt90q@Le=lJ-?U1m6sc^NQI+Tc?%={YpJyw*!>t@$H(PQrn` z&>mTK=GtnGE6-LIJEr6$hR5>}z_i2!ukDR0OKn%*SnID@6co&okwY`)zfkgXOfkK@ zD4WNVeO043BHA{U3lk4lv-T#rDMqh>CMyu1>SOEJnuJ0>50I*QVdv^RQ0BUYIPIs8 zX2!@K&ZgxFkGmj>^Pw=Z@Fpi=eJ-Jkvh@Dr{706<>$%Th7x_o`J5M#qFAvhSgh6Qb zB@E^v!MmY&d*|9}Uk+g6M)0cdLT^B>;+IxujL6va;0b@#R8wAzKIc7pQ6>m-=%0R4 zJ07JPjhu+xk^F~Rm^Hja$idWL@f*eLRggSFR_gH7TbF*7rxbQ{tbi#x9O~ zJ$`Zp^Rks~FLvF#d0V64u$+TxX)&1Xcy7)XNdj(-h+zp}~&s~4Mu7|RcN%?hQn5=t!*B15q zApw4c>65uN_yP|*KxmY*J31?o+Hi-V8dV(_W|nnzN~m=-?)JD1H9o(K1T{`wp-=W& ztV_3k(R=wWbj+tMycA=-bI6Gylq}bCJPJGRrty_3nN}3iMAEO)184=3Ppo^Cbx0L zzj2-74L%hzDCKiR-?anZvm*1BYVO4odSNgpb3zt7kTuou2IB90bBQovz@hD+XwU{Y zbDfV}8gyKAS`g0{7vodg-az%|drR4fbQ)uZ@t&X@m#hP(Ch<$-i1BRs((^nYMSDu% zTJ({96>N%B`TPEiFSl%^SVw*dO#blZ`pbF_cMq!()=Wa{q>XyyYM^KZL4@#^FYPH6 z(g3#fgqxr5>F=Dez0|kx51(*)8-qyjq+0UL1>lr(ykJmoH$?UZqiY{S`1Yy&D7EsK zIh`*S?Jz#}?~>zq;+o z6DifT%5s-Pg^c37XIM!~UMK``-t7GT629GI%9qva0fCt1OJ4R1ZIGL$mUBxAq9IbktLlP4}sM;K6?DKq4hf%l-cy;-XjhFR|!V0+oE zJA@Ranyf4ML!sf%y|Cb>a^x@lC8F~%=pE}|@ zI*RA)vGDi54dQ>kL730~CwD0GI{!~Vv7aMU@*ky)o#xi|@2oVakjx7c=TrYPGnkQw z^?oEK&4nJs`Hy?<`o2ys^BaVE9LOgNRJuW0`_89wr1Kuv*cSd^x!HGQ1MxEx zMzFRQi5T|=c`DFJk>VeD9dDP@pyuy@*HYOZ-!6I9UDRJ63ky5%lkb#})BCbduAQy| zvi?iZjf0vTK)w&!Tm+$+Tqkys{b=`~(xCi|`+8xd+CrEjjDP&7K7%7m=XIEz*KJOnOh>8~iY(1Tjsa{}6&nw@Jr zfSFg_6N3nPt6lWHYm(~?87tSMSHmE2%n($FI+Uil&;FtjE796I4Mxe+RA`}AF6d5; zM*~5l7;sfT;@3c&BTuUJvm=S@jfT>4cy9HRv#ZXIhKD986lTO@0!fynKpFbq8E@|< z3QAW-kj=JnIfDjyVzXAV~@Oh z*l}2o+-?)v3;e^rnByKnb$XO9RH6{}tJqTxKTzKYS=7la)ZLR%qBT5Ag9T2f-K97E z_A=P%ZjP^ZyGMsxgAe*#Y!c<>B3nDa+}>kf9gJuDO#J$Nx*HF zAR`K#6mFqo+*cn=hB8aFsPt}_JULnYr#$Fci0$`xQgzqElAzANvsg~R8@_wESc^Ky zo>`0olLcNB5kI91bhhrtvL?)O1~KJ4$Ro|JdkZAOtWn?oa;vE zh?(L^9I(cV0*iv$)|tnT!e@dK2!+z`b;DrS(5!_8ZXcmT;n(y|i*g_n{1$kzSzs_& zM;;zmsj1+BYFC>Wd=Rqq(~h>Yo%=SvQV;Dm{wUlj=fE2*7_yGvw0)PJrtZ9o)Y1qk ze>gQ^?ALr#Pag}wTsDoG3(BS|@TMhV zz_yO$0l*oB&z3S^aL$msM2+EA=lrX5r4&38L9F>tK+Nfu!NmIY)#e9m->GM=DS`wDXQ6v=}zgp6!KwR$K>afjK;y=GEBrKQtkc$>SB6=b8t_=OCdcWKJPdL6v?pdUd2xrbhIn z9B_9$^z3uAq<*N-3(dnHt>Zt#Z6*nSIx7Kt(yY0^?bS4Y8*(}eb&%lEkE702O zXqvCG6cvs(OU0~FrX!ul!H}RO$uTG`4PIk5b?-P#yEJP}G4-%>jSvpE1amN9uBMEt z4bAZ@7=79}WWpm4=oVeW&&#jyP6qA|E7zOj@CGOh^6JaGb9tbK8Y#5u4u1;dLuEK~ zf3fg&!=F~R@9pkO@^6!4@kKP>enDK0#xNf^VN8P^(hU-F zH)YFZ7#mxXoD0|eUJ(=ge9^)zqDlUH!b>Ly%pXG+X=cMBYkm;yYALdt3~QktWYm)u zW$@o14*cjSqql=o`>tn%1+SS$Qs6VAK2KE1bbL_57&B&?CV}5Wv8JEF}0pDaJXh0Rv5%bFFO>zI!Bsrr5&tg zP|?U$B*3k!21p{23tK#8W0KAmdWUvsi0+QGd(%6_4`&rK+lX}-6Atqp{_XBfYBwaBZ~0G+Tv)&*~tOydHz4v-YP22uIthc?iQeM2qCz; zOV9*&x5C{mxVt8}yCgV8;jY2m-Q8XPdfxYY`akIIvp%bn8sol4?b>_IwdTCGoiCtZ z5)tD0)YS278yKF6`XuOd+e*J;7W9s5u51EB_F2IUMSvhvZ0PYB8vRDBh{W{L##o0| zN;Mm9g5QYOBw-4+v{N6pE}EFGDES~8vLu1UmCG5m*&rS(B7{`>*NLHHKq+ zyYuyMycYO8rG}*HdVqpbdKm-I*g8sLmC*PiJ7uBq2@`$2En3RCS(Hh`@F)P$&<kS}(5 z)|2AyfX4CpEhRUYm;GZ(CZEbbn(m95v}1fRxVGzP@^oVfgb@4eIQV#n9L;;(Z7~5u zPzyz7AY$gU2^M7lU9cU+^}eFeyUl=3;|paQpU?i4VGdfN@}% z5rxHJh@hNU4-)F+J23i;WxW$Gqz9k+=+pbheSe}}#VfP6GAf^|D|}aZyu>c)Bzc1i zSL#|6e9*iL6N&aC_(&ytb7z?5gd{5i&SJ6Xr*K@|fTV@I?+^YcbK)?kDIVZ&d4&BI zN$G#e@-msoAW-=XzU{_jegURm^%Zu8D$Owwh z+Ck`cF*V+=10(A?fas!jwlFI;i z?Z>8W0gQCX>?ilON*YVDfIt|xyo_6>nLqPrN@>&3V@XQCt(;YrCBLSW5sRiZA2hG!I9bI#sfj9QKI|KfcbkY0-OjP1#p3F(31s^V~0Z|D{lXP z1=KHZ65j|%#JjrJ*2V9L%746=X`f5;Ulk!+M3-4HL zRg7Fy3NXn_Qrtr5ogjzUO2)Yt@oPG9tYv-zr5<)GQX9N2M|F)W6YNb>6zwcyp-4hS zFv$DOt^zAzQutL0rj_h*^TU5cZ(Qn88~^UtrEx&>m4UOH=yceo}L>PDp57$M=g9?|n%B@#c{EzK`qcnAP<>R>8jAyD|1wdLdy1DPaEB)su+Wv(Xi`FmVxd z?RUm`lBgC^(-nk=+;e_iaQfcVUjOPBR(S8&efRwh|AElALp8bIuPuhL4*2A{G20~} zJfRLLEO}#vSO4A@N{9~!>vO!tL4#)KpxLwt8SXE;iYxfz)viT`-h~t}nELAD*E{Ul z&78W;$2Syur-Vq#)xKxB&KsWHFiv?$mnH~_@o~+(ZM@{L8{hIG8$14QPf;U(2YC#3 z6BoCi{eFUuB<*gkA4LbpDS!PvOb7Wz*$NIB9ZXvE3POP-THF>^ix8dW&;8ZUjJ4!3 zk#|PJmUx|woj*8O&T6_GvVRzjO6e`u@a1v1AXi6q8Q8ndMPzeEEzgf*)lL!(JT^P8NuOn7qc0Zq=k5*YVWrMx>IWUeu~_6?|% zG&y{*4L*2$A(waNvKzM7QaxR!kPd9%TNp{yLkT7#u(5c=Fp^Zl*(5<`)u#Sn@d=#^1ce|I1y zIx#kCOVj1A!q6_|8USz6S74^je?CkAa)t%^__#a*SNJm3jIKD z)pBGDq4&ayil+W~Gl{H7~TLku;_j~Ag>{^G@9q&;MU5r*FFTf0WI zVc-Cg7n;lYBI2kFu0&7BeaK^_LS;15@=J&#q(tNAi8Zz_jpB0HB>$RORmJ@3vwQyf ze6K4m4!dmj9=&+W?jUpi4e9R~X%WQF(tEip$L8o2vKQjSo0);~!<|{w9+rHduYJc8CLZqFU;jS=pWKhF$pFaDGz6vxlm&S9B*Ig>28CF7kUt&&R*EG>? z!SrX9%*JBps-^LgAY!gUF@SVs63cY!m`pLE%3uI@h$(rO$B#*a%J&s}uS2kcZ{FCC zV_-F7OfAbvZV}oFVAynM zNiub;CCz3vfa-MILb(K+np3aSe)!=vc~NhWKD7o>qs)pD=&djw>?6?b#CK-MBMfLT zuxWDFWzcbVY!`k`#sLqv3q4|k{T^FaW;GoJK8?6!%{qScxF>avPje@{%-#f zIYVE0v{h*WFs3`BpbKnsfky5|T{TDV9;=nXE59Fna;kmYs9jNcE(Szk&2tKba=Ikr zoYDx#u?OHHmaPrCRq&&98oF1(j@ZA=IJDNlK9we-2@L49A!(*3>qDcJZ?{F&3 zrQ4VDd``^;<4?^l7vfcv1sk(G%xmv%7GLR9UFAR9RR@AN4|I)p4T$OybK{i&)l9^S?@<-W+!LQ$04Ba|aC+iQR{g z`bx|_o`rB8*&?*yn~2Twpgi8BwTtE06G6BoK1}K7XCgEs<>e1JE}k_5{VuCZ3dgbL z3f|ktaY=;zhkZg{-n2QCx?d!u?0SZ0Ram_jluq#Vqz9u0z%hdWUIrYG9gLmCv3%T- zs!n3IelF1zFq=ae*&g zEdt-1?P^$jUHkD>ZB}uUhIRt(=kP?=4EE1N%nk61wv&1N@XH_TBtEu00L&a)}q6A~i>(6Y_i~ z$nO{MnnPOjvz*`g&U`vtZW|wNR6Pod5-XZBS?xuSXavh9 zpAtp?Nt6WbK%8Rlc?!R1E@{Kr3sqpN;Zq zuht{-@$cFy3;XuH3o(IyTN_oh9`JN@J&$_r`DvgkBVqgE;QPweOk-3ajcvjWD~-8* z@a3|H2FK72JwlZ6R+-vcYUNT5Uj70&+}aqQzxAU&4DndDXWZVkWUl^UsAltsT&jJ~ zj9p`AP8fA?JXznQ&(xb>BGX3Wr<+9I)ko+>rPT^Dx|Zafh12v*A`*&ry5V|(dnTS8pcA!cA>@F9jKdU{RyjJ^?SrwVzg6|) zCl6P5NP?S#E17@ZG54pa#L?}P*>yMUbWYoV26bLX{v&8@4%@&OFidr&E#D5w1$8_kVeDf&|EiMLc_VYs!Qs^O$udvSK@QTP6WQEwx9H%KR}KhJJ8 zV6ZQFUQD}T`g~N$=|Rb5yEuP+3q0|Z5G$$vZs z4Q=bb_%5PKfiv@_ny;5@GhxC+#onYruUT?NH4+W_ePnnlEfF2sxRCPUSi2}drftn8 z$NPu39`Z2FPT%7apMYKmj)V@H*zAe_;;?h~3)3`n0ZYdDRe+<#j0;Dt8%dD#Ut*Z^ z7`%x*6?bnCBYMaR$G5tHqmUq$>LPxw>bpuO_s*Sbg^zO;=C**vtY`y$EUtms_`CUpBf zhB%#_I3@hKso4+xZ4Se?N8ebp+n&rfA*Y7Xw_U$-*D#?1xiW`82yMUWQ;TKh-LIEu zTkjvra^*uExYjEl?@J*2SzJ2Uml@7-J?dX+u~oMTtnJzv!lJG_#rp~2u6!Jk3{ z$+r#1R6FxaKbWDH&w^3>AS&?9OBtu|@@vX_(6uJmg%!Z0=`RH|tLBi=g(J(&(p@0p zCmY^yzecQVkA3-17cjrZ@=Sn1s~I|jt7711pT1_z@yI&j%)^IK493*~UqI<4lr|3f ziST*1 zMnY3`dU|V3t=}OALUg-qsX9xY-O+GjHl@l#i_kjr7gnd4Z#Nc7xP)y=sq>MqWjIdch@g6KU^?UUSSZ@;meV6oe2$s1 z>E9~`psi(BgC_C>PI>DBKlO}hQBR(jhM~PZN|SCv>D$av-*n1F0%?7t(KX3PJ1%Xs zJ>LuJCLJf+LdMDiErIpD(DUcg4H&gBzlVUyj#{+u70#JtdUkyL*AJTw&k-@DYP5KB zE;QlC8RJG$E34tc*Bpvr5;1IsUwdve=f1!k?bY=5FK^Q9=ZCroYe6LEJ2~4O)UPcC znvgVPNgs~S1v3uzT8P}|AzM%Vj`+NOxKFpI2*O#AIPvAKzCK?#_hfSQo9gemfS^=-l95CHfZV$2XgY$Sl;_Iy7(l zLQ9j|nPv$!J0xc9&xGH`CqOCB=G0KvfuJMnTzMwUc-pcS3l+ST)t?4U7Ee|#JMHnn z4mb~|bEeOq4GjCEZ*81t;J@9z@0Q5b2WY1tk1cr82m9+VH z)jW9MZTzCGD8_(NEMXXN!np&<)c6hiq`y7=J{Wa7uG5I+*v8fDW#eyL>I*;l-;TRZ zJo||>(KfI;EK{gze{?VLo$PhxX7OA{QO$P5ofj*T{XRgT!7{N=dlVxS6qO0J_!M=I zGA-;IFtseSx!dG5$hOTC`n)35US`y`*h1V_>NBqN<3Q^KC|6_jtV6Zm&;qYkY|xc^ zdavYtrjlnfW*0Uw`OHd(Asna9PYS#Md(l*jWV+pLFoNwA6m3@|UU1=F>W}G&sn>cD z!R4RpvOg>#3dGO-cxGobvu!5mAid}C@52*pC9X{ajfNR$$bE^7>j>}Sw=39boo5KD zS3@49viZS;%1qoE+Z~l{*x7t+A$ZP5clt!Lv;J~T^`y(1@6Gha1Dknbf+$zaep-ia zd9!dDx7@Bxd)=i2Db$sPAjJk2xi0m*R2-&q@~d!e}O zua(wP+w8u$K?vz^ zI9wu{3Zq}aDP*ma{AJda21O%8Wyu?#^Ec6(HVf3~)=^I1k%nK3)KO0SpL}+GLFCZ4 z@0ij!<4`CB@0MhtsnG-r6aJX=L<|>$Vbj@*EI-D*c=nw`&B;-EhZr5tKcZ00fN84K z4Yh{750rT}_3e?1h|!a!N0weN)rbI{FUgON?Fzn@zb(86K8DZr<%g>=6zj7bB1b-j z-^LlUt}|l9%2q@ov%%O@^y({zq(NKGoLm?|c`ZLZvQAfE@-06B{qQ&9Dbb2K|Asi% zMdgmZ3{(S8Yt`vl%_li!3Dg1C0?0t!=D3A1fa!iF)G^;~Pl6i(xy*5N6C+AN??Bu{ zt*g72VGw)P)z(d+@&WHFRC&e7M2iI0h~Y3D;T2SlDp#o?ZDpO59d2knqg^fOW;Mri zEtzZ*ZJw=QvS8QE?mVlp2i%A&Gd%Y$3UTxY%_L}RdbdoXz=?}W#WD>@Z@Kw`85Z;bAVD2!$)jUY)4=Pz<4d>>3QVDB!w`hdvusqPnAEub=Z-g{m zn}c8mQ?i&SnRZ|}zMv#VCEDtC%0;RZA+LHzQZWnb*Z6w=kiQI=I=a*_-T89hI5p2! z{A@TFuy8>6EY?G94{as2vR(Fth!tZ;P-^rXU2yHAsiSQOwE7DS)}rrTm5w)Vao^DD z_-4~CmV6m|zB(a9MVC0U18v%Pz~dg7$^o5mO5vy&eTX^K2lbb5Pc3zZ2Ij$`RdK9C zG2P8a(ZmnbKYVLQmC8xH4X*YJO)qTgSbMiPpFhXzdB(f7qjGtW7KVuOwLd2#Y+Gn=q}$f|dO+vy^XyIf_4G;2>-G{wo=zZ3dn3_jvz0K^r<<%>n^sbL;K zhoXe;jY&3TRbdA8OOfs?gN^|&N_q0bN`G+jW3`X0R%`R?_w*rgE1&@j%0qj@ZOZGy zPucv4`*wUR!zeh?A2r}&%DZP;tQ&I0RFL7jGoUOYEJeBzK0&M_iVx(jT+5?ezTKZ- zPNVlX{BrR-3EmT2{>?XxtzVPEs1PAgO5!+y%ZF+wHnIz~ zp;dE^NtjN10NJ!?^pk*UHpaXSL!ql#m&exa#=Ia``S)E`z{lc+vO(>#ggk zbHNyRkSQ1P39xbbIp0OmY$Q7V`o0ih-P++P1}bLNId8NxBlVOV&NLIXM~5eB`>zL) znFx=yw@5HlUzTe41R;b5$Kh0nJ^`W(>TrxC=;SB_f_>(<~Vce%XEVU#t^csDA!jo5&EC zsl~Q6mhlPnNA2UJa&A&8GOshQSk>%ju}MBfp}Ve7JwMT`dXCy+wJs_j^*p;+<6S2{ ziew-ElE0Y5l#bZCtCMaBfumVt zo1!QcH2lJFZrkVC{$^7Y&lv+3eJLo2#FK0e1VTAOI^bfz4DLaPCradXgica22cs2} zm7mDMq4uQV==N)Hq16hcLpCd$SWI7Gh+j&3cdpz9f3A|A(iMj6hf*VQG>HC1-SWI> z%jQC#J5U@VZQ~N?%hpL~Z{ESuERwxN&*K|pp_f6bRz>MtTAx0yIaUM4UnAZr20d&))f`0Vb|-;rYjM@*ZY;kO2N9{0 zc$tEaSgLJSoQZFFZdj0KotM8IGS7~fMxb$1Ts-_jzkjK3y!;wuwaBP6^1U@1lExqO z8(v(F`$W`g0>j;YdoSGbs{;)onh)^ujX|I+wl@bqC3GR29&Tz(oCP zdku`llaoi}sUaVPf2gVn{RSWydeCRnUulKU0!R`(i{Ku~(hM*w^g;hJzV;$7pA!Hv z7K?hAsOGatJL8Tlg#Au{OZL8?Hoi{H_?rtnuHYy$$g$}AH~~>oBacDc)s)6S21ZIa zHUfoOmOB z0}!+M;DB;+x}T6}{u8wxJnu%Zq;01>z%~@FUL}u`d^L_`M)0s(*A``s)lt?$#Hr7g}3uQh7XUPlwLF_ zQB3byktL5lb|u6&(qhbE)zA?ujthh`i+6nbGW?|vbf(#c&L>vRlAQ`skN`xCxSvxU zVUrfYSy?3I6%|FqSMIG4=#WOGZh&%Gq7&kyy@RW3Qa|L4eyGf!$!W#+BPhLLjBQW! zc}*OmmaY|(Me^ZeR&YyG_I^0s>0U!DV?{76h}&)x<4yc)_Btvu3bG4Y^B1kxE->@; z61SB5hkkS|CUalE05-m|N1K7zo|?e+>*yF57_<_Dem#|XEfe_?D6|ld-{0*Z5Kh*a zYHHf{W8dqbY5{k@!aCFIYCK zUTq>qpS0kWuc}q!WQ6_k=q#jWTWVuy#J3Uux1sB`>xDbYCJYDtFLE+W?TF#}S`%8{ z@?g_aAkdCVR>239I$c1d4R#vH4`MD9z)okkSn>GceYcvz)-DnC{dB2ILt1d50~({d zP@GOm@Sic~;C#_TI>-Mb1y&rW%(HA6K-{#87*XAIDA88)+KzQd{5m=1!+^3>_+fMk zkkU3_xYLS@&tir&RkX|Ec<_nA01QiipRG_7p#1@Gay0<1;Kyv@!6?>GuH7EQQ8Z`3 zXrKxyjJ8MWfiSElipBxtuFK{^c43GGUwA_s7!cd3DSh*BnD)E(^d8!%FCgbgp_}kc z57hsN2I~Qe#{Yw8V8I)@Y%{i!kvTD7g^3Ae5?jwMV6nX=Ze6R-gwsl1@Zu%bJ8BW3 z&tl@#D08%WW*f;7Ccz4U?+WUp%WUFg_;_2$%0@YYdS7!UPsNbNLma~<&}ER4v!$Mk zEg4N5(^c_XtYA9IR0X%)T#+%_^>~idJ^P`@%aF3s%}L@ddHRDIACLH%R7qEfqmwdB zqT_L7KIdxua#1h~Mpddatz~q{*DiP!#oI|9T_7!ywe`X>OcXq4r+-(FV!jJ?@-s18 znxG{5jkq?Rc{Dy3w4BUd&rV0+0%+diU@tay)~e?jO{U!dBh40u>*|^KL@l$vDl&1Z z){&s~O!}`0>SMu&m1Z}Ix1rObOdOWh?tYSnqTY3PpLsyA^mc?dI8#qAs=LV33qK2$HgADuGAGtMD6DJZEe{IsB4n@9!YfCynm$QKuXpA0R7gDH4+SOFthF$2Hz z2UFV^ib2kjWO3T~&6|AX49dm|>B#8~VUs0(_A}X)U9sqrttMAOM0R$r> zHXAmMgavPOk$;5#IPM2yFpbg&oIU3Uuu~`+t$i(HQu^l4EScFFNk{2L5v4-dTfG2U zU$LC1>72i~fz?06wbcJo;dx8`CH*@Cww&U_B0TWP_%dp#v0C+n0&RpQV9KsBfq_*gYj3WTxY8%Ox_ zbz!3o8Af1*#c5iil^2AGmVOr!P?fmI-oQ`DNkSdHzScrSpDZUjZT1>+Lo?51aWV-- zB>!Zz3hNHJ%EkDv65vw1bTI|@mrAp=bF_9dlungUR~eSkr&dQBY>q<;cp18SI2#fY z!-4)dh9d;-IIw1GH%iI+_jxaPy@8>Q?5J%jH_sp4)Qa%Sg;Sx<3rG9tIrTygw|f4< zTCk1pYcS>7uEY{!vT%Ogf-VDZ5ctleoqjh0g*Ry+}DX9oeNxFZ$p#YI)6$Za+6<& z6K)rZ9?kP1Z#{4e>IVUo*HT+OK~fBz&w29Q2C^t9DNmZU4zzZ9>qApeHnzPJDpV+6 zH4`)8>P0^y|GF!2)r-NPM=01I;nzG)P#Q|Ye>~j}cV;9lxEpF1B=Lr;mDSfgs{ar~ zh#R(+Yu;7m@tJYR&_DE@1inNBfZ{AJ5o&xjb(q?`qY%7~<)!S)ZL12q0Ct+iQ&N+f_SYKJ`hzl;{np8qNS0j5%P7lt+6LX# zFT!Ep@=?a^yl;h%SIYq}0N{AIq=gj$`j$dPY)d%S6%Z8W0DK^0V20IuKIscQ6`C0N z9n2{I>S$p}Yhu}i<$D~qVY-^cQ(Zz#cPr$dvD{Aq8sRxvRU|1|wiO#-lB;%k_5@WW zAdyg?bjFhKU)X3;w3==vYjwNh2FQjlR&EqT5$QA8hPQCu0dto5XLMdL38t1e3-6g; znkx7K!QhbbJGs)`tzh3aN#tw!gE^Flcsa`rVWc!VvEniwLzNX0hT^a=T1eOibK)8K~wA?n;6M_@Dp9XoGwyO0b`;iO1?>! z6^%)MAa5BFW96B*Wy0PMfB9@O}R@TMz(zOAv=m06~z*>v7gGaKmoMrMg2kUEBf@s=c?k9`KSb`vU`}K!{+ohxfWe^7+*g7VGi0Q*yhVS#Cyh9CQ zWPRt1sAOU)2Viq^Gd%W#r(I68T7mpVRRBAy?Y=`A(? zCft%)_DMQpVC&%Un5U(hjL&^3;%>B7blg<3;-^is9FBT3M$u~`o-dA6t3|w z^7YQ2{ZL^S?vP7oEHy=ev@u`>`R4p=>jP-=gFKVICnhN=D!-0nYrGagD|!o6^mVYy z1i=RO^HjX}Kda^a!`gKuZ4dkV^`s0z+=;$Rm5&x#Aef^f$8jE zD@C&a)Q&b9x}F5h=uH778G9S$?>~j}d{{8IzpQ)%M5hpwx zO=X9V>IrLPU2v|NV%|TCY*SV)BgSCbTz=I+1$nmNr(RlG@;VO3OkO}y8Dz)22Yxus z!Hd38lYCu=wJ45kypvMHyM*r-n09HX9djT9iQ~tmSQ~vTtG#giMCF+yHxmf9=8)AA*tvhO((jS@eheHzGsJz=J#&;KZekF zN$V|zJb*^MiV5I$jOxzKy@G)#8X|ey3$kX{MS?xkOJzzHzK(>3M7|!S{wlBix-*dA zu6u22UoF6dp$?5zYc(3PDqI42R-{>RFC-K|#u$k)6FKrmx+Q>D5M01q^jma)E z6fTUcTe&FsD^U#eErOwH3$pU}D|-<^%i#F)q%CUnmlUP=JLkzT+(+j8?QG1ew&J3j z2*|w;4DfG+5aSGa@Rx`Vkx8m_X3^|6G*dn^I=& zyD^{jA0fMg_Y29L^q(jm!~z=;{rbP5bdxq0g#T5h|Gz|Cj1w???TEDN`il6tX!ihJ zVjzPQXtn77Gp!Jo{N3@zIPX8<)HiZ(|Ni$h`oidU8sFD#FdVt~m+g0mx93?=VQIWi zxF>%5Axs}K^)oax3;m-}Wpp%Cri{*VpO2q=Lr-t|62{mJeP9&Og5U{weRY&f5>p?i)?ZgUY89U6FgI8ZYAJY)!JHk)fUz5Rv|kG+|Lx;{Z*!h;P( zJm2a-GEv82bKTaLMhu#bFb*7s+o3({Sl*Bc>lZF>jYU{*|GoDOfn-L#XbBX&jgx6b z%`zd3e@C&!S0aobP~0Akm*+^rbu$rEm}M3nO^{33lf!g=i9((V)^M}k&_=fbU8li5 zOlQ~0Vxf#_2JlxH^l~;9!gI}~E?qPNI-+z4B4ZtoIU^ZD{LwLWJiRx>O&!-00dZ;Jv}uIpF6LeOJEPRfzU{`|9EK$A_{`4H=w|&7Jki3N`IS{?9wpvs(Agr8 z!)^vYEax!fM%qo6!~QHZN;zPBIwwV;CKWq%!3?GRl(7gE@(%;!z*(9B)EjHfKFJ>q z0dKYoarwJltI5+{S2S-H5bJs#20a@UkH z8WE9o4HkpQrUK>f+2m^H>ad?3MzKo&s||tIA4?WM&;Gn=R0^%G&ZUSHB72kw&EZ^+ zTduh}r~X2ePpmH5W~G^WZTmodd8&?LyxLqpkVXA=L8^&VnWdZ1vCAQngpQu@JZX7h znVC8B!E~iL-$IUi$BmYJq=$Y_SDJ8JOO(_BNAUShR3=WH$N8Ctk3$F1JjI5m$rF?B z?p~Y|(3s9vS8cM)2y7TXR+7|he}*M*vvzO=uP_a2|Hci>Arl!m%RbO-V*spQ_GR(M zv4ULPZPvl~r%!Ki=fK&IOR)orf2Rt9%oTQ+cbH~o2h~G4nL{SYoPMl+!69qM;&&U7 za`W#D*6Kr{w zHp!Z@q7QKNL411t)o|jOVhd(>oPp4QvfU?xZ&y4wEUr2`O>8|fjn;7cz(4WcoqGSH zv}z7*40S*A{dMZfB-CqLlWu6=MMpWQ$F zsU`({4|v5_4Dp&yu}N7%~4LgGVJ z)xQEfoiy(HzOu>zPZBoXee^dw)%607*oKqG`+$y^q-R5^f;72GGmJ?PUd;H=-zAde z=6IQC?Kma>YZ{@)P#U}yUAQ?f^o%J8t0>iG zAerIfs@{_~z8I`?_`V(9Af)0D4>$F_1uh4{wP-h|3!$|qxFfP=x3VkaSZ6c!4_5l# zbT_#I{E4m$;i&F$xAm~J2dEs8Xq)vxAUflonX81DQUY{tU?i;zUF$YOi- z4>pp7bMH^~wP=(hk3BCiceH%De!ew$Zd+ySsf*_DQHKl;d$Ul9Oswg<#XtjMhTz?! z&ml$&#*GoNlmdq9<-%?;nG8FZ2I{gU_oXYLF@j&yt|*n*4D^ZdJPq_IH0}frrkc?E z-(bms8yLFsGC#b|DLcqI^BDJ5V_9gkkx{+(xevEVigCNUl&cd7m1pD1 zq2z|^U^FJtAyzetG^v?C5VuA5CrS6zxpUuS`C*Qcwrwv%?vdC$b7eK6*XF~ZQl$x= z_IAk^j&X`f?rf2BoH^uzE+UySqUPsH=KPyNV>{ZuvG5sFPHw5D)sisLi73QPtv1(x z`4j5dB+?^_7vk^&dr3;;yY|(vA2bTBCbM!gy}m(n;6THCfpM6n$DIiVAJSJp%aNAf z0WnX*qz1mrQB@PlgCXWN574GXr=F9Dg~J=+LNWa0(Qq@5i+87Mby(>sbb+4NXUNWi z`U^N&;DTWz|X%^9?mA@#Ut54lu_>Fb3=pxI+Ri)1H(N>0`VSZ+;!fDhGB2ddH$Dsjda`^^NUYhL8= zcVrR8v(8=k84k5Qx<&nEr^76MZ!Y3Egs^d<<)?c#O%a|`_-P-_LZ3C=sj-t~iDM-R zvNx)R6&&d&kSHW$`#02Q^CtV+Y~QhabFKb%7d7?;etL5$QhG>Wv~FgA1u8iWZbPd8 zVIrrREBnKef+n5!NXl;qX?7!{;eU~NAM}xCX=cHXF*u}h*g@;pX01%<55|^&WB)8i zGiqqJ3*hISI4Gvy)ZQ{}1edzev-tIWTsW*pM2nJk>Fgb+uNPDwfc`FNoY*r0+R#9? zLBApN`25#@3L^aI!`zH-_rLD+Ffve!AWLf)?q?SI~vhAsf1(<%3kF~s7~`fLo{-4_@sI7Yl9Cl6M}YbatnUB z`}hlCv+}57ftx|Ojxci5HJ2DR`GI@)ThcNRVwG94j$Ge|^gTNZOe}9!?mrx_uCi(@ zRf_T32PV}M64W*uN{2zvZs7BwU4-iAC%s@>qve>x1|695Ir;9!(D$<3hzF1^QkoKV z^wJXFX9iv34#7Gq913uc(zox2o68T}LioRE#;qH+cp2uBqz)6hJQ~`Fpee5WnzE*Z zdQTCHZX~YfAsC#zUG8Gr8~`>SC>1=w+WI4xJ*NV6&?zWKg5&3o+RkKNqzSIn5Jy<9!K!kv{3! z;}@2u?AOG%smrrp_r+&7`>30b0UTb8W4JI{4=)JHbsO|QIIys|MZz06;+SNyC|JxG zFsD{Dx}6}3nW)XDV}}bA`y9WvMmWj(LS(dsvh2EqKVv71@0wNLNPszNBph;KEz_in z9`dtoQ+ihu9`obak!LiVv-x(-ZyGi;<|x|J%*lZQK&V|KI(?L1EwvoRJBIHRPZiG* z&#AwTIk(ODM!;wF&5L*Z55hiZF5|wKuFbAN&cMqQLkj7Y-n2}g;7eFfZ`2JK#0aIR zcoD9SN+Y;&e9b~^~&*?oY8vNwOP(8Xb z^5!M)PDQ3DDHWPG->SBe%_zPk45-d*j2q{%dC#Eqp1{y^B-3+hseb&tP@-nM($NyN z>nqB@Kc|U^uu3V!lDx8n{9|=)14JlZEw=z1Hjbvvf|B%-+LQpA(gU{T^>RLH#E&){d|0{m7h zwB_t}%~kU+Ja@Z&q4u%eRBv$1V9sPXiM#F!#g9{N3=W*Nw)nB%BbKnD5%WlZ<%thZ z;D+xo=#vq522C98;fCi>0z!~_2bqud=UE2Lf%&rdpj`C&e)jde@pFtdzV1{q+`^Oi zvKp07RK#;2=D;u`^PXK+l&oKPTZBN;6e`yg53^9#UnIA$TYY94_8lUBmG@ZI^!x!D zD-M>Tw&cQ3#fhXU5f!Ck`BxGsRKCo^8-{Tc=5Zm81j}6CZK*?E?pN$2O)Y~cPy{v? zOQ7^;JcV=njrf|Jt_Z?Y*7Z z&Rbg=K{seBkae8)G#J=NXTP#ghbT6**AuurU+rClQOs}K=Y0p~k9l=G$fGp`fs#x# zSG$vSkEkgQ6*%sz(;!1`WU?$laM`U%}5r-abfS zlNHg^0j0g>g-tW-B~0u|bdYK~?{p*Y!ler3H4LS?Vgg2HFRnKXAx_gjC136BZ!P(V zgFGRg+`=WIkhRZ+#WG?tUEpb0gW+g7-9hyoS8RoL2*&*#((c{rgyH+=_JQ6R^V>2y zr0c3I6*NWw@jyhqwd3WAS-3`5gm!s*(7ky>x7Rc}sLCh|NOTr4yw0khDr9)C0&HSt z{!#Glx!&VppKV0n2Mfd9HK=tDM|?%_19yYaLUkz>e0i(o)ZNEMKc&`6+wQ(+n*LBP z(GH(x=PqCRn^9*0q1>Iz`C8juFFm*{De)$({Z=Q+RYI_!rrfao%M#mc3dTfcr=_T_ev(I$*I1{0xxcyGhcXjGxdQm zcY7=f*XT@wMRfl4hn^LS&WSm}i54lwMwiI$I@7HR(IZsLxV~-q&MDC}i>FgdwMnb4 zFD_#Sghkixf%Bnj7n+TjuTeYVDY2X^p1%mL;LF9wW7}BA_KCet@v(3+F(<4ZE&6i1 zbigNb)*AUTlT!x^m7K+=ZE(Hfk<(fq&W?#9D@Aix@LSxNBp0Vh5fL#YW9GIv{k@;( zMg>E)e2((O_U%fwn}v!`Qe%?^>AEWt>6^LEy7lS3$LrvOmhR1#%LUQP%>#ZjEPPo- zXFeB}=&1iQ!I|a;3m0LF@xBw~(3q>Deu(n5e(XfA51M@HW>Dd6LL1lrWDgc}EPzod zW^J5~bJGDCmi4u#rjcd{=q*qKFeA^=1QgDBFPB|s?Gzq5?n2I&-9?|_5tkbXJ;z(3 zlqu$c-;T*O1%88A*5#`LE`B^CGA>0zo!Cu-YT1^g4PxE+FeDkT-4$_2!remjyH-bG z?DI(>H>V`J*@iwhOCQ89N-^a8#dbaQhd;qz1;CbDo_;`W2{dP~>#V(%*2L#Duq(+G zxg#x+Fe$}veUn}~K%61kfUBY$c6Ww^#(M52Y6DQH^mZ_vEm#Nvs-NxOSHmYH41rZ&50=U(Viy{>FfN@0 zMF*LC+C@rsge;vx2)gz4`;!Z}7sK+fOw(PY>UH^S)_)MiWX$?&^~!kI^2J6zP8qKH z5Ji{%?v)yFqS+!2YV$hpnXTY)ds_J!$~^)4fhN%6g3p>pUm&h;4naU-y9YUmKJVdM zMQ4Vcc(zOR65HF8;tlP{nZxVU1N7OsI*oOOi8Hu}0K0#>1-^xa%AugRa#?AU?3I%^ ztDgr<@==H0l}F+_&wUm(i(?A%{ECa4zQg@s|7d>x3lOcv9&5aScuAQ1j_^MBT$n_o zfzHkB_g1$uv+cFSU16p*BkU-FSoll&U5NEywVdSh=>r)C0TzK-z^s@0R$bloI`s|a zZ!h1@GPJFFR2^*BJ-zNA6BaRFO;{$c>b0OBxg&EEk6<>B8Aw_I?dp3wW=t&cuF6kp%2(S7W zF*-^~pvT(|YcqOA;K-b09v;Ko;JU9EQpMcGq9XH(QIK#B@bM0x&$C1Pc16jfiaCx| zkN%T@_Q@9J5WZ_UsSssY$PzK%oId+oI^eBc%;^qos!;w-n}^dc17j>4KPEeA|9rpy zD^bB?-iH{ef10xgX5jbCD4o`Xz5?vpZ{{Y#3hzX#D|{Hbt6ymzD{_3^dVF2u``??L zcSOl7K-vq*mN9+VF&CRt>MOO@{-JQa&Nm2nw>|0D?f6@5D7cTOMSejM8Kgk(l4hG1 zTq;}7NXM+V51+}p+pazC)>5$e-I+e_3AWiWB$N5T2N@Hb=(2qqeAa>(lfKkgTKipL z|9_2rV{~O(6K&A3(=j`?I=1bkW2@7#*|BZgwr$(CZS$S(d++zgc)wnLos5mO*4}5; zshU+aCj>Qh`8NY^B+qh;Pa@D*v(L_OFc%gy2@F*}GGDxDo5L&xs6Wsr^vsYa61UAa zmpU3qar2uItvl7COJP6gdPRv>@rwdBbRKvGDyIu5Gxu}QsKjlwv<|s+T zSr+_a`d`s5cPbA66gxMv)ks#^kC~#Y-cfx|cG7dP59xn!+nd_!c2U6yaVQ^l2f+VP zY`bXZS>Mio|5ND{wQ00dlWzYH`51A%yc+p`LKYVK1^{Wezp`q1BL98({#^|kze?tB zQ;Y|~e^4^!M={rbXK?&?ulxTi+s3gj{^yDq=wXk$K+x}CfBR*=D~cs=ie@tf3aFOA zQpPt&B_hAQ*^DYvE@2UOYg)j?E0D%XSHS))u`&hd7fb6!z>diM(Y^|8N7MhzN8iLP zy5^rj{7hR75GdzJ29oi!_o%Hz3gX$fajgO(D?+j zK+<%_75DyICiY>Z;3}OWfBmzOB zz9*$Wj)YzO)MQXVzwbb zqgfjuES7^kx(ptE=dvMH4S*PI)PGKKNMg3fi0E*OXmxtG@i;`rX?4ISi&*!|HNfC1 zneV+pJ)O!Q)cr+`8zqAj;Nkwe_xHO36S*R&Ec+~Z5>-`z~8p zT4%`kEP@AzB!Dnzw7tz9(JF^VFZc0lLAg3NC?oj8;GHj>o|SPR8Rwwh@v<)T+}{^J zl2=70O`1r=!~|_}Mx7nW4DAA*9>I$c%**wnJJy8vWY+zK341?$`BX&zb&sTIp$1{Z zsFu&wm>C}5IiN)8CM!jhcaAPKTxm#DTV!d!B4E20JWG*+M20(}JM;8smg}WI#*!y- zit;2_Ze1DM0h)3Z3qrtRgs63?VOPi~yy|y7@&q`Opkt~>K?{Nmf&Jeba|sDco%-Nd za9RN!+@g9bC+yDcX6$2X9~-0FM+%!@>h3!)e;@vb2?g{FTP_kj`~oC&Xh5>_J#XB> z!5ac%*6aXZ?lgf^Y40!%41>Xn%$$WHI<{#2pwjKg)!7;(xB)d)p|N*58n}BIedjl2 z1nyD|GcRj*4QsJ4Gpiaz9HihPL}aMQ$)$5__3jJ>QaZuasR%tJR}_XaGC{#1K0Q3R zumqW^^vTw6DQRFn-gPVadR_x zz29Rn!pkdsOjfyjlX1P?+(&q4#wDV_G|==cTLV-}gHUP}4Db8+b;>^nh4hyY8Ug_c zqi4?qfZ!rRpJ~HIWbSQi&twuj{DWhY>k07_Jy`;nB0!qXC*T7?5upp1}tiY&GV_UP9_4SLOYRNxdF)8}T z;QvQ)`!_?2nN!5xlM2larijcASkXb%wYC>%hqY4!{mbQFtL+5(s=CjdLR?F}!l!gy z3ls1Guc^8;rQf8VU(w*S{1ASc=+3)6RTu635Cj&YOxuN6Ag4;~?0l*f4 z%4~EIC8w{=?!dNu6v#W-WY2T_t~JSb7_4|3{%satJtqrX$F!#)G#W}G$`PD!EEOSp zLt;&d1reFkUnr)m5K1;Ew`e+iANsU%Ntn;STcG&Sbw~rl(YB-Isp**rzpufDCWH@! zKp9vIYeDp$8uPCR%tx6iSD5N~$`DPYO{ceAFrffVVzy=D zaKekAr?3d&#pbg6U>j4bMK4`tGiZCHN+|6viq@Jk+QX@i^7`ru$9PzS=F01Gt4hCK zZl<#Kl-K?C;k$F{`CFg6O|~;yfl$&B!05uc@p^a&;4-6CwF5{20_R+0imE6d0_t=8 z@BDG0PB8!?i7G6R+{W*La03&e9Yb0}{2Yix9lvf@if<9koCCITIdnHRL=|WOChx{G z!kxaL4U|YZ5XhGs92Uc?BjbHK>jzpMou(G#%#$twDHldQmi<5$zporcA`OUr0|vb{ z;>m|RwrAY1cNP%$8U!5wIN|fPXnPH$F~4%|Ks+KYDp(?NeKe~tSW~M;^;-=v<(iOl zfe3Zdj1Mn6mYFU;mX3&eLRXQfUo#^(Jf6=4oW!=Gb&?!uVme-O$UO3hh#xqV1s0d{ zHwoj$-v02~EzN#hta9a&y+uYvwVmN@FluMq&;+A2hP_GSt;)3DxBQXR%XV3Hf{^A$ z@lQBIX;eg#-965(U7+a8Au6%M){N@@0?9WVUPn+;9ZZk@c! zH!X+qv^l|G#-BE4;qiG@RatZ{*C0HG;zS}&q+5D8bRkG_p^-)&OjnSeON>wlVsC%l zf3CE`cu~gi!f$PgvQiT2di!gotsAG?fI~Xw_yL1AWT-BIg@_+5pQmSJtQ)_wPFM;H zqeNe@elEL6x`0!jD0*go;yeCyblf;Q%eWl;DH~VG`IV(VRM&7FB*{4n9q++g{<(#I zSO-xSA+mRhrt*q1Ex$6?TNxBXeNTzG>(#(8r*8-;V`{hA2Rc^Dy@J5BEcFD8X7_=f zQXYipe6;JbhMW|z={l^!JSAP9KPTEa8-=9a5@A#~Bo!eBT-C+oDW4XdzwhkWJ;dda zA|%xG zb+GBgyLz6BkK)VcbH@=&*Vlo`MFDv?tb>TturK-WKB92lS5&a=k|itgY)j--N<2sN z9t#9zR&KB%-4a!xoxwF8@uk|;*T7r%B%3sE}-Q_o0!l;Ht4!0 z>H-NDF{)HJ_b@4$nNd}fMc7N?bTT?qv(D84p-4Jl}45Zi`mm4;o14x#MXlw8|7 z%4mqFf8xLkEEj-4chR|X5oZv#JZt8_%YP9iU{}mc#WTDbEev!QhuWzOCd$RqOXz2M zV=pQx`m6k1=?2o^-WOd*N5Bjw)eP>)o+f!;;;iWkTzG~~*YNA~)GT9HM!dmQ=UwRH zkDWMx{E9q->37^`_z1yLZ9#@6V;brfxv%9e_V*yeQ4`3bx1T0h^?dKYJ9GI`wXg7| zA+YkXLXC`JsUcW1XOre*9`~7N;M#k+2lbA05$o2#mV;m1f3qA-^9j^_OB^kG=_8B|C@Vhk@8~j5DJ7-y|Rf z)!1%j-ba#SGdue%ZRJ8lqN88o@0`2F*Z0L*+u^*O%E}iymj0|V-KCkSyiGdx_5sw? zX%Gu_`lau>X|i*`K3Z+|GHoo{@ZL(?4}Lqikr(22fgD}&NIJO)JMskmUcSpWy>RjS zvqyjqHoB#235h3Y*N8yv#Z3Va(VxS8jRqN6`JE+tzPK3o$7z7SrZc~9BbA18KVdf6 zghtl@GriEWZit5Yh{G&O*efoEEFL>pYGh9oH%^4NlvTaGIBoS< z#>^Ekurno#Z!sEI|faF=vnL%q1)Od{3d$XDwZQpJ;>LMudA6@WUwKfWVdw?y7 z0)@V|cGu;gzG=P~8tAy;o2*-UUN!uo#y|x#(HZW`4DIshwfO=;%|F#0$i|(G7iA4a zqh2>~!8x2W5o7mqMA^Q})voE9jQsfa4QGWze=J1l%47;;c*Uvu*gVM;Pk}z?WU}py zCxR!mZvwrgiKh)=;L8WiBm|4hCFo$cXvubMcT_uHE_klco1{Zrn#(>M;ez>8^yAn}!rgODI zbjHS-U#%*keN)?sIP8!7-U+%wV^@XN$7>HljYzDtcoZtGUY_!P!$Z6_{NmMxmnGBB z*c6d>wQ>T=^A*e%UDUfhn76jJ?h!`l{&~)ZaGNHZOw_~{4j}D&9jOQzJ2xp=C;n6bs7XD|0qx}src-+N^*Ax zUdB=2s^Xt{sn6hE#R}Al$1Qp*-a1XdO8=M#yn+RKD|1r(AiO+0KRd;v*olv;nHpY= z1NTTWi-?FweG|iaPL^s+gZM06Sq@OyeiQ3^b!>Z6sVNGwe%KrS`r* zC-;il4P;^HTw1+lD>TMuUg&1qPJtAU@cQuq_Wd7uFIVi7Djc7(39=p3g90G%~bV*EJHXs<*%mf<5yh zWqHcg^-GY4%ittK=iVU@)cPD{m4BZhMO*zC@)Eu-b{DT2=DfI_`%KC)r0dA&RvXx& z;{lH!vk>x-E3irZ9bXN<-<6Oiu0Q6>_@S=LK3PT?BG{xAn7D+bv(K-E^H zq3xFPfN$LJn+w+f7zg=0o-pkmR|CghPcBu2IF3PV!r7t8QnvE?V=90jxUn36A*&UHDL|8lwoK z}Os}x1(+YeqAyLy)#%i5YVk_<20!gI8ni;5oHxrT5sc54 zLmC(2U)+3T59`TkD`mfwt`@P}VjT5nrAI>SktLtgC4)F!*jXle(KeiA240UDd~mSn z=V7;A98SDlFtC)=fVGYvBG4L>Hm0&TnrQ#L(@=!|z-J7txx^ohxoK%P<9&{eGy-_% zWhX~r4t3}43h|@>D>$_0HI9;J^mthN#bhmor+?|JS5(!7Q?^+Md2lS`bENPw+2MGM zf5{@Dluwj>d}$ggeEG=t+Ezw54p-u!80DvdqI8_axk>=d7Sd)-gR;5oig)Q^9HpFa zymLdE(h1_&f&*3ehg&h_OMMV{Y(%r#a>HI{?0yIL*bMsc!2gWuR7bSeWHWr@G`E@Mw#aVjg zJu)R7y2)QXKecuVdeRci`+(SxRqYlbrVagz+S3k?n9 z!Zdi86$s#0dRvSitG$&m)%IdNT_TBsX?v;>U!h`M#C%Y1X=?#v-!3($#eg#pYhf@c z1!BwA7!f|AB27D^NG~v65qAqw?k zfH!{8`?YKp>{mKK8pe|mc3-eOUv3M@Kn&VmAoHj=r#)hFVDudR;QWJ_4$PjW%)iMI zRJgNHi2lr?04xqSs=PX`&5ZYY!v=eT8j-YjBGloG-IA4Kz6rrUC#?xL9e^96DEc%^ z!z|RE{`Tm0ee40p_@Ia1-+LQ$#+U-zy?;lX>zAUHH$YI%k-Ic@uCprAjAAs1n(YWa zM{dFLZ{Zn#Q1wuJ1)yMV!T^N;c}BC3Zp42@!cY1GBmTjZi|~*0)BgpHi!hIs z0T|m~RCx{&VI~jM6c9i_5(uSFg@Y~&u>$CpY*)@ay{-fIV7s5dy;Nw}1&0u1T5P-^ zOsHI<7JPi_9<#oMBgV`oWGI4})TV$ih}&)>42eNtw1}eSHUH#dO^(6`sA}MQ0oa|y zWMX}oD%bh$el>4F{Nw^ldWQis@yol0T9M#aca)DxsJ&Qk4OA?Y;g^(@q$SuJ+yW>f z6_SgM{^{hcxq&JmGFcYkSD#St^xy_KLEjD`pBcxOFo<KbxDg3<@8TI(H*96U2M;>MXgT zu|J?*$A4-SlrMb9oH+hCf>1dJqK&Ner9 z3h1o^fpWk0YVx8ttjl+v%RmnE{24NKlq~0_DqgkLlE}l#Fd)?SIq-LYOR8YC`GNh|g! zMopc_>JDTjGx&UUB-|azt6$rIBKPfOs%l@=WZILxUAVTMVQ$sGd6vT; z&E_(4y?ylD_rr5-BE7Gt>uQxXs~$x1kYsP#7l=)oT843zqu-?$vS>Y}p`j6q$kW9va#oBvJ^gNV}XO1&!`@z@i?yEw}Dw1MWxgPIBQOV$*8{`6ebk-eXMu53U30cda<- zlP%&8$h7wDwjq2q2Ka{u_$3=Er9CKuOmsjT;N6e`Y|o^0?6+e?;4fDT(a`s;lAx+| zMk|iBTmduVU2}`UigVI`OQrDPXgLeYr}oXL3`$VYJ=)ghI3ko)0Ew#!9_KfEj{P8o zR|UK6;9Ib^cA&MczT^+P6W@^VG`XCrbX5_B;TBrNdQ|Ax1l!?6=3;rUFdlm-@6iO^ zc^wsoZU%hy6mmoy5H{IgffSNY=p_M2H_3+zG+7p2gu>9fT~Bz{7*hz+T7}=9C4g2| z5d>nv!?T6HOHh<;Z}VVF4&HkaRnAsD8nR8E1s?-DIWt)UrKgL2^Y?6htWfv zugU51yDR%-&w8o%5&6qB-xoQ`Ve+}EuV@pGy%z*57}X3QEh{ZaH9xsQl*_u^CKG~! z#0Qr0Pq#XqiSW*911(zptLjWbPo6VE(2%7hvYWz55;*Gm=j;-z42O|5JKA9P&qaF1 z3chfp@^+hOPjcztb%+9iov`apgYc%cyWksh>6oYvV4$U7c zmwGQq*_ zDA+3&qMC^wV{mbzdtvsldb*T$(>R~Se47dv7Jj+sbsn)|0&bhl5TPtob@#e{|0apm zug)ceNjdz!zqp>>_R$@-TuZnr zLRX1BUhhZY+7h|&VxrGfe>)XO_i1T&G30?S+l}A`V*w$BT#F?adMcnI8z|>kXLc(x^f8Bat5N zA|Xa9(wSbxz-~r_kNWG(++!w|kfkoz{rKMX&;h$MZe(K~^Ozcqmi&AMike>~kpy@E ztO^|N06_TyOpHX!V^Nw5V zB9IAzj#sT#0@TWkPBq2b~keVX%1MRQz}ttnm-smTRSt(RuU6M8F&i zAJsi+>!>2vh0`(-G&v=*qU9z>RZeO&;Tdq56pE+3N5Wx3*|1d9C4Ds5qC8I3$O&%> zUEKm8pRph1fetdw(IcSa6zv?{%^DD68?LwkFC0OkXo2+3annc~#*aiiB&f54a{}ox z_tVyM_TL!LAQZ=^$lnz@B#KPlAsOUttaWgKcvYM?Vt$I>nT-sq9lxll?JiWI6EJ zEtlhVKas?K>2$P*FgT|sN#9X`_u;gSFa{+bz6i^s{UXxLKwu5dlDQeS2|?`_YQ_nB zr{mjjPiXz&P5bgi%S%vRR}Lz`fh%X-^&RIe6(vwW9;B77Qvgqqh#sIG9!~T0dq?2z zY%dbV7(w^AtQ+$1RL?XovYY6j(CU@{RUpg89pdEy-z&hbm!8;zMBvp5Y4vH6VERhi z8ds#*mcQAGa3U@}(g=9;%J35WENvaq*OB-t-R4V3m@35rGh?AmY_-j{W!b(bJGEBb z7X+VoYlHF4Bkno^EO=bN@5X!k>Zl|rUTTg_wG-YKnvc{^`FyO=NfHKHtZ|5Ey$d(b zKJ!~Yhgx>}?+o2t9~Jr^#GkcS_=>`LhfT^}m(4l9VlqFkV_bon18{oV0j|Qy6+Dxp z6@syfO4DAWk47dBefi24n1oC3gL)F{OHQCjodNyTU>q(SX-F4P5&o4$MD(x0^4+Cd zooqnu=T(HmeIG-Auu(B8k^UC*v$&MfNGkQsN)|75 zw6C6HNCq!LIb8kCZqq>aVRNrT3S*FCbxl(sBnn<)rsc@5PWC1DXupYua%ILL`nIH# z?KX-lc3EZ)r2i&pLr<&rE+WK@4M7UjiHV9T!iVP2B2iOCd(D}=$$ve=;VyrXUXlrG8Zb=W=8Bd_jxfgUUg#P`~`qVzZ zz`^8<#ZLqxcR{6(aO7xcCEe`O@)hvn;gVe$YNdL+{%fAP3!f{^(kr6HUct$ zH!lKGN<6Djux_+7Mh3Zf4?-Ct``-q@qUGwK(4OhKl5;ubIGm7U6gKe1k~nX&?A6J_ zRIvia@$&a(q{>zZKI{=?j)Z%?K4mptJuzB&vCe6p+S=f)(iXG5OsAO&1`5t zPaFGsK|T3JHL#(exFGjK)F`b*9X!wyt+W&1X>*+RxsLQZL402pL^u_}aEt?c^3gW! zuw`~vcPSFS*z>9Fk`7sw1ww@$>R%J`bWFqMnvQ%nAqwyy_@m@a;|uC&OCXClUHEv= z!mAc-`=ia9W(9oE-aX#+?S&8O;eFDT{IKt;ElMm}Zvo?=O^MtXE$W%VaBBbe`xherzZh=oWg`|Z!!(keF#iu2L_^)IIJrsYbV8%j-QbapHpn6gF?ZI_{w@e z_~j5Bk^?88=Ke&tH)o-$!Nkw9lcn1mJvb;**&QbQL|bL9cq1oz2;m|gzgEWEGoG|3 z=a?^P%z{Y9zdo(N+sFeZinWSrjjOHdHgk1IsR|~{7iW8|72>QN(H^4DD z$S@zorjjst~6dWzIn0RfUANwD4mUT@ z^SW8JptoG-)8#7ocW=$$;ANX(Q=$k+uP4H;*pK+_eG4Wu^7Y<~BCcb8-W4o(+^zvx zK!JA*yeJtVN9dSjDaC*MCfemX=7Hp$RwiYy zMJ<0vd&KI%;0>Ptn9qk?w+r00GGd5MXtUVpmfx2*crkivtQJ}?f1DaD=g{Bfxitfe z8&>6AhRb+g*V7mSF3dPTe4Wv13sJ=7*1DM#cUGqM@3`pHWljyFeY0YE1s<>ZsRC*K z?Dl9AU;SvvmB-5fA6^NcN?KuU#)9eYTVU{(;eMoDOsT20F4w9ro|gR^8S=R;2?V;* zpDNjD5G_bN>oBi<^zk9BE}Mq3$Kp^pF6vfi<#aOCwH1-cgzM|?$LEn}StOr}iBvtz z1~7Lg91*1EA0$vJmBQIl$8Epn^Vl0M*GUpRd6k{sG0{rlbE?x+&=oqNuRZ2tZ>?^( zp1@QWE56{o!?oi*h*+azyG#_OE>-hzRB(=gqT<1>{wD066Z?|K5bb)k+Jf@D@0uBs z5&PhHm-aUV-VhL-@sOg6uG~1PM9Xqd@?l5G5{K^T=y6bOruLxWi#^f>l=reV*!5K@ zZR&WD9_IuArwE-azJf3XcU-{L9j*@A=mg`yP33*!*;75BipF&HR_AN5Za?miR=Yi4 zF2(u&Nfx;w`U}9%9L@OPOX0!dKO69zZ+c7-!dfb-PZ%-VcY~X+v_akHnS}?f46EdW zvRs|ln)sZ|=}!#%BIWLhwz>VhLo^l`3e1{KUlywLA5ohz!6(&ek{ycV)6l>!l+6r? zjEvM2DCA_!olW;M+^=;500GOwfbgBTaGV!RihID9>E#f8prxyb!%Nhm*((Y^Z4#P7 zELOW}BNzZVWdDU6Cb)q=T)rI5sL2r*0M$bS^G*wU`9UfwTki6&fZ*jhZ1bygftg$i z0B-vyD;hVvb0O1W@>i@>sGa_}Ue5lU<_vE-LZQf^)91J^U)9DF>Ej26Uer%(~?uHr=9A3TVEa}q@UG_Flm z$lHl7-szBgOMdJ);lsp@g}0g!9m zWE3gn?2IU~NbQO%CU0^hs)Ip^lT@m^LFe11X^nn+LPD<8Ops(`>hczCd=ei*ZhR+$#+@bR~ycg9eE zy!}eT`lDE-VT490hJhn+tv*HRamj`qYPS+Q=AS|>T@r?IY+oInc^UU_9N-+|1@gDB=?j+1H zejWdHYPKJBl~$xjH59$7%tF#}>@sixes_P(>^)(9trnT{Lo=|!Vs+S{FaOalamaGT z2D`g=#b7z&l#s6ZdZp>;#$kHb!KMuN8|pz`Qa2^ zAtBIaM>#{+Cm>04Q_wP#1i*%-d`posoZ%XHd zOuTxv-s|5kCs>RW+XIEsW0bN~JluV@i>cH~daSf*NQ&`?)N}|=mSV&1y-Tu0k3kCC z7jDXJgCZ;i37D;v`+^r$hCIcFs;VOl#+-tV>`KJ`<(Bbk#~xI|E&3ix={GAb{daSF zB4vvy=;oVI>gLnZ0}ZVS2DNn8q@b-e1F^Cp9IPMky8fk+NXO#$619R9gcN<}xZ}`l z5TSQnDf!D>69#Ff2^`&N^t<{zjgS{$_^v9iIG zE)M5UmtU!!>Z{#e_&8XHo=$4w&qr!4=<={AY4h**cs7iS&!DJuXN2M^&*cN2Z!mvz zml|RzVt;VPV;Zk$*B7K2K?E*D^LCoOyr|fyjYhy$5>*~@e>`){AfGvrQ8oA>Y~*^; zS{0`@Y!cVb_^0=MN3v4AWG`g2a7G)sW4te3@rylsF3G?&$X4?Hl+kT?#(iQ6P)mLz z92qq|G?3tdYj#TqYyM$qxA#uKxf=Bc+KvTfVFdU@sO0tzvyoXOo9*G&o0!f=b2xN~ zFThwO(m6&-K+qP)kU|f{BqTlA<@PC*tT)2`H^nTl_xZgt_uUa;{;_5{LZ}slO7SFw zvU+4o62l_vNX^Ee)}QneO9}pmLvZvnia9!+EaV2tV0f(;f-q#(1oFUil>|?l_o_Ip zq*zD_*-!|N6@=@Jv{kQjCd5p*#5eOIG6UQDp;@_wWH&R@WQu~i*O#Z;^OY^+weR_? zrv0T6#1;w(g6`7MC_iO2g1VNug*o_(p~8&|5!cCc&tp%0tG6$EgV;_&y@?igH$hvs z8LHAtHaRVO6y|=&Q`SutYkkewF+d^1o#)8NFYg_F&)z#l#?R#_Nes~X$Eg{ajQq8;q@CPDh+56SX(sv;bKv=|dY&DPmmICh`& z!n+H1Zt4}^CBn^@+|NHYP-lc{HHaryr#AR4Y_0<(t<{0^`4+F?R9N|Wz6+5xHJ!Mq zh@TJB7?a?Yt;T<>)vj7^F{yDdM(%mz;I+>dSWaK_FCP+8Dc)>a-b{8V8Ey6N^ue5Wl9n8MRKwLA>(Ww5tG&g34-yo=U{X!0FalhcCIpVuTMf8YO(dzwy=D;v;nn(OCcTTm_L zZ%@d`Y|+%uqYD~aSfU6(Ms)%oE&k{^$pbnN{4rTApp5i=(sqG=Y!MQ#H$ms>s1w@m zVhLHQl1y&LnQU5G#e`KEV{U5ORAvyV;{b_M$qw9JIe#;yqFgwSfY*AX*H38t!Cw$8 z`pDX2QAHM_f)&O*x}q1hNJp-dOZ4)-2C)**Tx~69cXu)i@ricslfvObU%St}RDT+t zaIdjluolwSHT0#UcWr8M7(OxeBfzbyi)+xhXk`PA1Uqanct67Vm!H7*tem|9UiNyZn{YsIHy2 z2zLeSynjlfe|s$#TLc`p&-{_J!~^}*hs9+tpo!W5)GreNic+jjT>%F#VAyml^n9=dFf7aEHCu6(TdY-e=%dp{%yt!Hi2|&@%QhS z7Y?(ps$V&NDIUP4y@dDWp^^zfCL2k4CXX$0fK4O7>vw%asBUk#?g+SHkj5UZyT?a! z`=TyBU3m^u;^67IPS3;aZSWlXYuX*nP>nuxIiCouf(vuwE9rM$Z=b6p4aW?Qt z`8*}2wE4$CNEH+m(0~6PBgvC-mjriAD|1Zh?H77TpoLSUlKnlW!2(4wJ*PkV<_-#v zgGF$9H*qh2Zm}i92SBo>Uj|_0SJ2O~9dBFS_SkvpRY?IQ4NSno$a&wRK z))MT(>Vv{xS;@C801Ix2{iw3n`F$a|&2xwIDqpZCe$LXhNip~>+$O8I~NbiMy_qPYG(7Z=2T@}TmZVV{wJ+~c48DD(ey z=vz7ewkOO*#r%8hzL$vUzcCO2Da}8QzG={Z7v^RKE+hZBM-c%aDf{P`&^x^dLhYaB z1BQTxlm72oID@+jnZKje$3`XnZ@_7}|3wwOasSN{+dlyO-=R(drhCo*nbOz)Mi0dM zDfwsGfR+AxOJc;O{$0RH0E6onh`#|6R*oou4(-nh za4Goy<+c(UCqE7c{pZXe8K-|2$Poh&u?378@Ly>3lKtPM{~HxP{oki6_;1IO5Y7K0 zDxMqr!h{60y83!OBO@?C8kiyeMuGj$Bp{#d@p1C@hhrgRGkJu~&8bnK@%BxA1r^67 zj^sc8oyXo+w<999Jffey0dRu-A*k|ozvP>mnyy%qlF+D>rQ#%S^Ifg-ru>4{v>9|> zhK+x|EWnd9)$0{iQXK+ugA)B3j%T)q)r)6Mr2JF#i+HpC>@}M{Ffeem*~$Cya!QAk zl+NJ*EtyD*YGUGgw!{#<(QH>(L^eO^1Mv&ZCH|_W7EN>`55Ii}H~J-jPa1ma>W+yN z>;lC*1trTOi4}!4Cp;_H7}9YL8#>+epKx=pHUE!0?c!wao#ZFfd^A2bKF(lwAa%A> z4LTT!KiD6NE?=xb;zDb^-2-MrTyDAE@@qQBpDpL%?b*(SHp@5-!V|VQL|gRKOG^Wi zoc`d29C2Higx7TV{?u&~xZ}@g)eZ{}FxL#@UuMNZLQH~| z2GaA#N-$JaeZ&9)MW7L4KYxFsc#|L^#{iC$wy^8`*sHr`NsN@F?!KtS-JKk5!tW33 zr)kLw#eT)b6k%aud;h%pQf9M-pjyY7$Hzv#lfvX=%(JsIp^a5fg9jfbZfjrQ%+Qy5TC(6uHT(1wPFCYM`Mi3IB4rY1I6JT8pU1R6nWYkKv1Q-43dFVg`X z#h4(R30;(_)lZq3FvwqbqEk}Bnw)uVk2kAIrhqAOa%ggPEVCK}yhjx>7@3$*7TfZh z?Yq%YSMY#a8=>}HxKAUPuNGTk-6mw66Wq|A>-48P%fQgI_eYPecfN4aJHmft?9=Oh zpiYaF+MHHTl-e|aGXLF>QC5T9z7T+vx(S|H-U!KwG)FH68d`z}(AcV{;)9IS$Q#CqhC7JI zW={s?a{E1Q2Y5xA2O+kLGlyHvZ{YB<=HdR;=fapUoTDmUqNdZW&R%Gxlm_C~6_x={c~%C!e~^s5 zUNH!jJfL%pmtmhls$~FSyJGd6q0s5_7C$vYOio2_a|WuqGSguA>Zc%Erp^yRhjjI2 zU~ew+-_SxLgzU7?BYmoUWVaYpc+LbNxj#hL3}?JswAW3)vG72_ohY}@4VE<#F-;Mw;e4yeRj%!a=WiIIZP$}fo=?Nz&Gp?^D z{nYSwY%G_=sAH%?*ZtGA0hh~-(BAIuZofR;aatwY3kg1RY=t}w6x1+smUs?fPt}7h zbi=rffODUuYJ$CJ-3^nrUqFwsEM>#EL*J-MrLOWA@T-sJm4ZBeBm9KmTIeq!llH#8 z^+kr37Cikh=T@|N`n6{EnAq4Yt~u0awYnyx>>qZMFp_E15^LKu1$4y37O%QwY&;lE*B3ie6d?V zLIg1EU0oCoe&7=d>BY^QP)XB=R3w6sxf>xqH4$-t|F`%?BDgZNxT)YK=tglWIr>f# zc$!pL_r>!i<{B3LSmx})QC=cu;kDqBm$S3%zy1Tjx_rF9%9s2o{?v~8#B(Kesp`Kq z{?&MREyagHJ5j@zPa$D$`3}kGcqsC$If$g3Xa6nu_;nIjb*ainzsqHGE`P~O!6 z85t6*@j^e7JbZO^71qj$UiMn`O`5R%LEQB&0HtbaX=y0G3!wjtgo#NZ+*S0clYTetntIhCmMIPkQs=Jz z{7ImCj_;MEULMU#g0(6my1fkMiKnWz%VFTmR17Ag4CVFPh-4>*=c3u%3VMd=3RpCj zSOJI>S3Wkv)QD%DVn6?;5-Uqwl~O;6q(C;+2P`yE_m^)-CQjC0do>sxgAqA&#nx28 z7G`nb8&xzFV8H`ZhkF=GGV4xnv_wvQwvJhmt2sT$j0kN6lD8z)vcx-h^&}%{3t27r=Nr zmD2__@YampNOsT9C~LK(G#Nhl%%L|NM{<<(hzGqa+jor0h*+7MXy=V(CAM9E<#e!K zZPXy^^ilMW48_g))6#4@@-dbZ@gR{f1-G{#dP_=ikgP&TBTcYqaQ~p7h6?tz4b&9l zl&GyjNK^7R4$=!Ec=zJA=YM1@AjQdWrDFm3{C5(h>tKqg4R$o)T;BJnv za#CuozTqcJf13gUrbTBpu0J*V7nd7{nOrpra;)7Ge;vC!z9~F6o{XvRd_B&kt}-V6 z-MKz~4G4R!JCF3iM@KPlW)pwM&cj>MGyvD0U3tw?8u_8tjs29hzKe^ZAlSw~ohBB# zL;d}c_4bT)f0OcdYz)qJ=0%LhKD~w$KKb>DcKQ8{wf^x#m~nAv%}4X20(=HSjM*i# ztei1pl05q6GFF*075`B?`Sn&g^GR=JXXdc25wjyYAErWsqiIHnCLuU6Q7WyST7kWKXU!ddN@DYJU7b)}rZOGPxM$Mc3$O`gqWEZg ltR{cP(aEpfsbkM;&uh3=LMBaUYaqa%xUh^+g@CTl{{dHF_W=L^ literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index b94efa4c7c..77ebccf335 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -18,4 +18,111 @@ ms.topic: conceptual ms.date: 10/14/2020 --- -# Creating a new Supplemental Policy with the Wizard \ No newline at end of file +# Creating a new Supplemental Policy with the Wizard + +**Applies to** +- Windows 10 +- Windows Server 2016 and above + +Beginning in Windows 10 version 1903, WDAC supports the creation of multiple active policies on a device. One or more supplemental policies allow customers to expand a [WDAC base policy](wdac-wizard-create-base-policy.md) to increase the circle of trust of the policy. A supplemental policy can expand only one base policy, but multiple supplementals can expand the same base policy. When using supplemental policies, applications allowed by the base or its supplemental policy/policies will be allowed to execute. + +Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a supplemental application control policy, configure the policy options, and the signer and file rules. + +## Expanding a Base Policy + +Once the Policy Creator > Supplemental Policy type is chosen, a policy name and file location dialog will appear to name and save the supplemental policy. The next step requires selecting a base policy to expand. To expand a base policy, the base must allow supplemental policies. The WDAC Wizard will verify whether the base poliy allows supplementals and will show either of the following confirmations. + +![Base policy allows supplemental policies](images/wdac-wizard-supplemental-expandable.png) +![Base policy does not allow supplemental policies](images/wdac-wizard-supplemental-not-expandable.png) + +If the base policy is not configured for supplemental policies, first edit the base policy to allow supplementals using the [WDAC Wizard edit workflow](edac-wizard-editing-policy.md). + +## Configuring Policy Rules + +Upon page launch, policy rules will be automatically enabled/disabled depending on the chosen template from the previous page. Choose to enable or disable the desired policy rule options by pressing the slider button next to the policy rule titles. Hovering the mouse over the policy rule title will display a short description of the rule at the bottom of the page. + +### Policy Rules Description + +A description of the policy rules, beginning with the left-most column are provided below. + +| Rule option | Description | +|------------ | ----------- | +| **Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | +| **Allow Supplemental Policies** | Use this option on a base policy to allow supplemental policies to expand it. | +| **Disable Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](https://docs.microsoft.com/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is only supported with the Windows 10 May 2019 Update (1903) and higher. Using it on earlier versions of Windows 10 is not supported and may have unintended results. | +|**[Hypervisor-protected code integrity](https://docs.microsoft.com/en-us/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. This provides stronger protections against kernel malware.| +| **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | +| **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | +| **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | +| **Update Policy without Rebooting** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. | +| **Unsigned System Integrity Policy** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | +| **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | + +### Advanced Policy Rules Description + +Selecting the **+ Advanced Options** label will show another column of policy rules; advanced policy rules. A description of the policy rules are provided below. + +| Rule option | Description | +|------------ | ----------- | +| **Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | +| **Disable Flight Signing** | If enabled, WDAC policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. | +| **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | +| **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically-loaded libraries. | +| **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically re-validate the reputation for files that were authorized by the ISG.| +| **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | + + +![Rule options UI for Windows Allowed mode](images/wdac-wizard-rule-options-UI.png) + + +> [!NOTE] +> We recommend that you **enable Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. For this reason, all templates have Audit Mode enabled by default. + +## Creating custom file rules + +File rules in an application control policy will specify the level at which appiations will be identified and trusted. File rules are the main mechanism for defining trust in the application control policy. Selecting the **+ Custom Rules** will open the custom file rule conditions panel to create and customize targeted file rules for your policy. The Wizard supports 4 types of file rules: + +### Publisher Rules + +The Publisher file rule type uses properties in the code signing certificate chain to base file rules. Once the file to base the rule off of, called the *reference file*, is selected, use the slider to indicate the specifity of the rule. The table below shows the relationship between the slider placement, the corresponding WDAC rule level and its description. The lower the placement on the table and the UI slider, the greater the specificity of the rule. + +| Rule Condition | WDAC Rule Level | Description | +|------------ | ----------- | ----------- | +| **Issuing CA** | PCACertificate | Highest available certificate is added to the signers. This is typically the PCA certificate, one level below the root certificate. Any file signed by this certificate will be affected. | +| **Publisher** | Publisher | This rule is a combination of the PCACertificate rule and the common name (CN) of the leaf certificate. Any file signed by a major CA but with a leaf from a specific company, for example a device driver corp, is affected. | +| **File version** | SignedVersion | This rule is a combination of PCACertificate, Publisher and a version number. Anything from the specified publisher with a version at or above the one specified is affected. | +| **File name** | FilePublisher | Most specific. Combination of the file name, publisher and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | + + +![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) + +### Filepath Rules + +Filepath rules do not provide the same security guarantees that explicit signer rules do, as they are based on mutable access permissions. To create a filepath rule, simply select the file using the *Browse* button. + +### File Attribute Rules + +The Wizard supports the creation of [file name rules](select-types-of-rules-to-create#windows-defender-application-control-filename-rules) based on authenticated file attributes. File name rules are useful when an application and its dependencies (eg. DLLs) may all share the same product name, for instance. This allows users to easily create targeted policies based on the Product Name filename rule level. To select the file attribute to create the rule, move the slider on the Wizard to the desired attribute. The table below describes each of the supported file attributes off which to create a rule. + +| Rule level | Description | +|------------ | ----------- | +| **Original Filename** | Specifies the original file name, or the name with which the file was first created, of the binary. | +| **File description** | Specifies the file description provided by the developer of the binary. | +| **Product name** | Specifies the name of the product with which the binary ships. | +| **Internal name** | Specifies the internal name of the binary. | + + +![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) + +### File Hash Rules + +Lastly, the Wizard supports creating file rules using the hash of the file. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. By default, the Wizard will use file hash as the fallback in case a file rule cannot be created using the specified file rule level. + + +#### Deleting Signing Rules + +The policy signing rules list table on the left of the page will document the allow and deny rules in the template, as well as any custom rules you create. Template signing rules and custom rules can be deleted from the policy by selecting the rule from the rules list table. Once the rule is highlighted, press the delete button underneath the table. you will be prompted for additional confirmation. Select `Yes` to remove the rule from the policy and the rules table. + +## Up next + +- [Editing a WDAC policy using the Wizard](wdac-wizard-editing-policy.md) \ No newline at end of file From ad081c331b090d9a1c16c49ae8b6824a124cac81 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 2 Nov 2020 14:47:40 -0800 Subject: [PATCH 019/825] Added the edit policy content - how to edit policy rules, add file rules and remove file rules. --- .../images/wdac-wizard-edit-policy-rules.png | Bin 0 -> 57280 bytes .../wdac-wizard-edit-remove-file-rule.png | Bin 0 -> 46086 bytes .../wdac-wizard-editing-policy.md | 54 +++++++++++++++++- 3 files changed, 53 insertions(+), 1 deletion(-) create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-edit-policy-rules.png create mode 100644 windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-edit-remove-file-rule.png diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-edit-policy-rules.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-edit-policy-rules.png new file mode 100644 index 0000000000000000000000000000000000000000..fbbad28cf2cefe4e97f2058a019238189e0816ff GIT binary patch literal 57280 zcmb5VV{~Or@GpFlOsq*Vu`{u4+n(6AZA~z-ZQHh!iS3-&wsSMj|K9iGyYBsP*4bUX zc2)PTy{mqO4wIJ^gNMO_0RRB-65_&&005{t0080$1^PufX@cJW`U7!P6cYqgP2wDX z4ZfKQ$Or%cwb8I|`ruzE91z(*)lQ0091y5Ef8&(>coo*Fu#-?=iJS zPo^zALu-Fs2@_xWU9j;?ofYX%)I>z7PqiHRr!q7kFVu;x*|2-19TwDJ>oJSt6aOre zgNdu1%hY5tL&jf6_ZSJIXt znfb`BFu~V&=hWXNUKAYZe`avA>oXs-Q56Y8&rngnIDE}d9XK{Qjuzc@iq(frzg`dk zA<2=M4gT>V_%P!&=VH3`qj+8JhfEF&-JzlNhD%9G`|;mw7u7CrfaKFB6ckjBAc+@s zX@cD9WH`F53fls*nfV5sZ-Oq5`O*fqGAJM}yq=Rb+Ry*VTgak4Bf$UY+#4MT;dwAQ zK4(-ia=zdHFsQg)4c6VArPJM9oGzt#S|oOPs5pz9W$S3oVb_}Q$2;!f-BT%7PSHLiKM{SW5Wl>DMw5I5iJe+jGoCC(^OYiKmzDtNS2J4J{O#K*impREne$e z<-a27b8=62p@&EU{MJlKUETq3R^7cQXm~;X?}wOkTp-~(8_pmt9=mnTuivxjCt5Px zEki4ndQiej5o%vbWwL~xz4oVNgT&Ez+@^CX4|n}{275~VRXR`lk>xzv;jwmdzY*-tgr%#>AvRqT zz?XgQ5E>p_liaojyds{WW{Cc$`TKbY zTuUNRt2fy<8(7Ini>MbBQiaf}D!l9b-iG{%$@8_zsm0X~P^}H#Lcy#yFpr+U-~KMK z210s1>#m`=!J=7ILt}b}}?Oa)fWtlz&31)RbH0jZVYM`rH0+GTz7^ zs=PSyV5d{W5VEr^zdbRUU?I@g=| zEn?|=E+@0+w)+{P2j~7U%)2e`TlYO7VxBF2OPFuP`xbBwjqe@rcz6+Ogkal9#9NC7I#v3rH{_*XG%yWjLfzEGo&L$CGVF#UOS7( z-pX{bYyWz*-_#ch)tmc|8uUWodBizBLxm_|5=tAS8%vftD1HX5(%?P8VCcHvq_Md? zK1Qy=1{4!dTMlwG9G&0Be&*_#kdXpJ`_EVX^1}5c_Wsc1plCD$=?%~&U?y=n@63kA zF{2T1+bW20>@N3}a@}k$S))PBF4;RkAk5B-(s(_@P1w*z292PQo9V2VwVuW<7&ATZ zE<7o(H>1j>&M6PJ zEsg^!;%A|;_0`Dd@6+byPaQs>3w;pLVquvX&Q=bE&Z zOiC7*gU`2K2o6(f=n8+7?u8e3erYDpB7@WU4`+4RKiid!abzzTF7A=7D{3H_l zx|4zynQEH78fDRLe>@UXnTsGQ`m{?v6P`juiNYLdqa?-=na0?Wmh(BFF8gzs?g;uf zGPJ(dpPMkpyq!GI@jA_<7p}yE)3zKgU*6nqJiKqK_L>X5jp~vfDRs$KO?xt2Rj8 zSFwin(s?}JJpy0#Qa}RAjr=A;{0|B75aEIyBR=brM!j9mHk<5X3D@NrYDtE(8ZGa% z5AnD73iKm)cJd6!`wB&f7X0wyXpp9xOupeEKx%kb?C<@7b@s0#`0Q6=gCwKlNyKk9 z-z{nhV44%XoMD?@tGTC7m_l^hKwj)0?V$$LAxfjHti(SrK}6cl*l{8ucY9fKgYwZs zLWnG}S-{uFqwmLSCR5JylZ=fMS;dvaEH4ss`HU)<_T|$ed$+WNEuFX=+3~Y^>+!|B z+v7>tgV5tp0_Chop1rw`S}M%Sc$=Sz3}oQ5<^ADkH8CPQ-K{9#o}@SJ-n>f0AUnBh z1xb=aw`5Nqr8}f4!09E==)e5sTdA75`rzPTFF-4)^WoY3sHy)foz+};5Kv+=Fgc=t zhB^ux{wIsHq4l;d39Wp2T2ilI>|{kz+&G}d^4R{)imMU4XZlYR{LupZiy9n6y+S`J z97Mi;{)-dDMuWtyy7yg(bP90ASq6-$-^K-{5dCmUv;Hs}_7Dy;M;13rzrQ!KToW1| z9-`U&`eRn7`S+<8oerxXcyC^Vlbp2>Lr^y$HBC*WYq_hpK`H7j@vD+;goG^=?(x1x3^nha%|u|* zvUfk|DV}Z_Ls87;`TfN zx1-#@7lz<_H|?~GichsXICZ1>h#k>C{3dYos|n@b9F#D{h|7N@1r{@AxKz3SP*)kC z$#5x4UkFmlXKr}U9%pH01_@@2TRZUI9Rr^r_SN5mXO5hPE@3idi)UgCBfsdOz9>ej z|6#)ttpAT?%=v%#FwcTu?duVINn7CmAGx7r{#IoFt?n1titPUu8vK7qp#O&iSC{!8 zrc{PE;`$F={$KJwU+0SSrzpF`x#HIuaNN#pZj4*<9zVijPlRdw!3-7 zK!rY>y6d+lHQ>r!2qTNDi`!Qk(SsL?k-Gve;34Vw!h~caS;x?+D2}@))VrU#Cc9>l z%}|Rn*!pYcY$@Eq?;`vWq9sJSK+M=NkExQYr9-+gNM6zPEJ2b8QLFeb%;EYSN}>MQ z2g$c>pTnPUmYwe$7n?zU#De&&fvp^<&&XPEV?*}5sIS#2bAjj!*EhctarK}2;-cPV z=X-VW2;%=T=CPWzu`IP`)1rQ&#W9R?Lk~}s9Ci1GYpad*x15op(hM`fod)kdE5m)g zIzC8WJG%WSGv+V1E!_@^3BEnfRi7pafGX28HQx(_s{uJxIkgOO=8ooJxB2}9@C`~Kr%GVQ)882Nbj{hJmEJZ~Z!_GR&8K?1pjtL?dDa&ATbOL9B z6QjsEa$U!LPZ0^T#8v^Dn5@5N*b^$Z7Mx(H*vL^`DD5=HU4w?##x!*0Spl#7?#2u5 zls|Y(N%%cE=6)usm9?MKotAz+^dQUEeaSU|G*nxPOfdvQUuJzHf;mpZmxf4~L<_i= zgM`vj@#U&$;8dJJC@8)WTuLSSed&%5(YN8;>tUzSxSLnGARz=>BVsc}IwO1#QThj# z`F#lE?g;@mHBU%P*rp9WW*RIl>b3@ezZ+$Ej=u<_CPJ?X8g0mYgB6L9JC_%Lg9ez+ zO3Y|5a&Y#m#e>68S!(xu=#4cZiK62Fiv+f|LXqZt^2Ftb1seLdv4F4BGmbhUHxF^)UJbaeaid4%hw_G~*kGVibmVgQ2L2 zhwI~DfneC%^2p z-yPheks#jZFrHKU^7{U_nS-_(u1+i|3pyr~Y(}SBII#E?iG$>L4&%*)1WU z`?`5x_|Ct%LNyTfyc{E3V-f_NdWXroS^Ev3oVR1|$%Zn?SkH&=SNX}_yA{Lh3(|@M zVWdd!v~FZz40tnf>cH}VtD#t1X|0Z|B0uS21x89eVgtUv!yHTo zpYp9u>xb@bB_g#zroLxw!lQ=x0AjXUq zEc)ZL?>%}HBqPMgj908okwtM5sPxU8WSOj%7f#lczw_An9AlQ0W=YmM&EOJ@d<_sO zLU~5P_`99tm}{0E&^>HDKPGLnO5a)WNZxSpFH^n;17gt7EoTd1T5OHPNtdh=_(=;N zbb3$@&`r$tglFG;Fi6cj4puiF2Q5$=E~jUA*;7$&2LDH2fB05inzUQserR8X=jFw? zUZRA!oZ5W|VxU4k=F~4B0S3`8^M3W>$mGs=NDhJ|SJom3(hztENvcsgW1@&%tA;}y zXAG4uRsf}I?E7c;Iq`Y0KqtshXX$f<%BRkAVXzuqFh)4yB%u}acD5WYlJ3zDA~0(A z=6m0>3f^wLIt<%ttQ-Wd%-sZW8Na)1dzB-ALHQ<3f^NO9!q%`}p^zcGy3v_`^Fv;h zLvYecoyHUL@D?HY=U%4z@qH$nep$t|iz!u13}A+%(^{!#YL^dP;psH1MK7tlWVaZs zP{Uc;HlOp3tE#~jNdC16-RFl0@ySUN(iHro%t%1vci`|FtU;qurRu3Y)%ZMI#19_6 zaMVsaX1!1UqG2X5=ph{tc_mP25SC)M2DM7pIm=_fVY2Bk(>FLr%G&?5I$))^caf`zP%z*=?b#J&SZ0V~N}J76RI9GE13@CcR*3HAo_)G}8}AB%A|`}8L*^n) znd|LlMCJ5E{<$jVgYR#UzvAUF^fQbT_^b3Q-II>%@}U?uQW$&`~vCE`>M#;@; z96{FY)J%B6hL-lEJW-)?4b*sXmjh2I$0(*f`85ZzxnHaQ+O8XErL|RXu6C4N=R?bK za2#tn@nSoN6HaeAX+545Pr&Uj?p)ryV0~^W`~K4dZeM+N_ZM;szRtLI94W6MMsb0xj57l zH+zARv}+ocX1V=shIi+|)fX5fK+OrC67&}ixK{Gtq`I?pc%3ah=(L9Frgi31@fO63 zQZl9Yg~8KP(}a$4{Bl@RB_0^wADW-njV0{=JYrPNBh35Q-a1E~`wmKfnH&e^&*xM) zvSov{^hL)BUsHC%R!oBOoHMYze=w$()=!m=bPG@3 z)>l=9JCtDjLpwe^A7*PSzh$~c0DZ0Zac|_}9386XH|+^_wgOx!yHu6h)^*(QT=+>H zQJrw9(Lyfg8ow^~FaBYmr@}9@R4flw#__bp&YMDV`m$t4E&SMW%Ly!f%1M^GEJ; zhmVBFF^erfEp%;3;)jJ9t+xI+-vJGWC8Mc$!mKrBOV*=|`p*X>@O@-d9^~s`S^%WS z2M-TaFB#j!r%s;3j4@OY{~k||)V8#$Hq&XbV?yR21+u`Hp7Bh-`vk(;}xFJd))9D6HR*68wum8qRL*E?4H8r?U#0?@BW5zqpV)MQS8I61i*kHKZP76XNK#0iKnMm9 zzle1Mb$eQA8a=i@oZWVvk%Z&Z1+U2DE8V7GT5VO2getUzV16lwauFfVm8UXmY_+3r zHD~8kTq2iF^Vai7MF;3(f0LSGTA-l~a&@CM5&MH8A+)4G1s;W1NC^MscFDlK#rD^r z(-thAhEyFoQaU1`{;9|p^oWb{6aCn2*Z8A2X8S7+2<7`i@!grn*of4)fmJeJQO5v2 zG-K-H=6Oz3=@NL3*|b87k4zw2Xjf>1AeR2@9r#HwbM1$JN1wFm$%Qy zTRwKhFYCc{^@~+TSNC(H-F4b)Xm}Xd;f_Mf0GH0;cyP8-|67nSF)V0kD_kd}0yu?k zW>xIh?dv^aiG;r@%NY;P1pCB2q1p{q|JR7|n;>EIV2_!TKR`nhEfz4A!<36-QW&rP ziQP2On7PLa*Uw%RKlBpR>4VY27Wl-jhN?h<$AyFJagB=lZc%m4A>Fa~02%MT_rydA zr9ff@#FzcujpwoW(8*SEmF(v9CeHhoTWrN=7m}b1lUPaF^FrPJmn}gax<-(FzV>3;+5^cIk2DMl!Ro+&?_ntkfBot5h;FG7d#zLnhP1DY~qvuV?2*{GHDzMy%G zAibMK0N!mib+?$u+B!;j@B7TzS|9`*Cpsh`ePSE>4(<-%W@~H7Wi#V*0LbL{cIE5?q3oJ*L(}hq&OimNsZyHf^)TOSz_ExJJ8YNUWv#HUw#x(_@ zUrrXU)5~jkXtx?96qnhqC-+L45pi#3be9a#wh2?z>+I}0OwNQ#wTl|72!bbWPkWiy zpZTJ3<{pSjQNF0fo{8T+Qhg-|oOnfc;GW6~cyP`zeJ4JnSnpKpcYw(~F zqyzSa++^>2dokB49lH}7q16~5eUu(Jr-UDsNjHyVyy-w}VMQ82TOr>U(w9ip;Tl6& zLeK)I#%L6J$cholUdJbqpNW`76lmz*O|v0aC-_E7<~P39PS+DB@X-Hr30W_e0e^uN zYJ=1Gs0Qf~Sa!;|!-qqm&S4u$s$!nV%jIlP41`I~RsQ+)Y4g!>xn7PZGyUzvzg6~7#~=%0yOc^MuFM>abGcfCW8+>fX30@ zob%URb4*5tma?+2&rvyJoTVzZbZ`@#b;mYC6nd7`i5mgDZ{pGecmZ)w={B2&x{o1A%6AK)5ioeAeMnhz$=Cs zr0?Q`8ERFJy@;EuCor(8UJg&IMx;J5>cVvKu>=j;(Wql=x&jaz%Xb57Eed{tKjU;U z%8YTkWRIiO)@c2v5)Y-mRD7^n%#PQUbDS{-nUUs2xz?A|mUaUiv-bj|uI3sud~{`J zR+DD#5vmSDd^Bv`#*2eQ$yu%vgGX1actFFE4Rm|ATEnO_Rc6W!*_<;m5a17AF5)-% zkHevyU?wk)Yhs0zFf4JhWSP$r@HX+}hXPHtv<-x+oGnOpp0;FBADf6ZNBy15)PuV9 z9l~ad*m_k2SPIXYF;KomH}5S^onvpmY1G508-|b}P^b!~_AMb=x$ETTG$FL>SReDe zVnyj@ueqL5bra%BoHv|YBc{fee7E4U{N7lsuMrPX^JgO6DR4W?yPe$LYfJ1E|J)L2 z2!8F}s+t^ShK(2q;#M%qzPTqWxI_Q^`4buWep=mK^6g*sEQgzj2=u_8qcrI6)^+d6v(z~o?{clr zuMwd{5sxirio2nn)Fry5idEi4Eb7g7tK!F(1tA&(WZ0&u3=Q9!5Ps4F%?3t5bTpr# zQg--9bSxEITO)wKJdFdp+i7>El17O%f{%5vXm2b-@?Q7dvtM@!1b6d5MCEi3x*zXc zCJPmWG`wG;Q{8*nab4D z>S5m!(Z-@_XL`--B`RkVW6|n{<);HGV22LZY@=(!XsNPol{rFx+sqKOr;|(}HtT}6 z3=P*m+p&4&d9f3d>CuHgdpn8S*O^W3O(BfiNlz4PsQey+Fv^ITu*7I@-nM?Rx& zf&AZ+00I~hvdBLh5KbcyJ)NfQ+wnZrBtOCg=8Pw7^f8k9Dx7Z@!Rk!3a4d1zlh`~H zSOFClZW1VQT5QMS3*)y$zp_DuBNr_72r2FJ3lza?cPZ^dY&N!RJ4G9R%(BVps&JE2 zY99MDUzSkH-%ZbVi$vme=BAag)D4MTxk*L6(*zcyJ{~E*#$m;eCGJa-D?OcUCAPD` zXy9`n->HwbTmYP~12;PUBA>*pB3+eOLe>bDyj!WE6v?B;kq6kk{K(%iig{Ds%tp}R z_R_IO=_RD#N^1D+@6mbEcru*|#a#AF>$|xmYkCtzwBP;T1JrV-ad|0lo5gyP8K}tK z%V+JM1J(W-$X7?YEl2j33X*kcFrPmBYtIt5rSjxyY_fLWmvSqL1q1}#B@lBVMjx~h?fa^|QYzF2!Ho_MB9k=4-nG|INt;|9N9bXpV@($Z4K{kp`ePiFsxf$al%^^)3= ze)gi#jqg+;VfRbG2kC9!F9MDs6mdN>V2&6(uc;E8g;}%Knz%!?A~R~2H7tuva`MeO zg^`SSr?-g(;h1C4AxvC4CEF#q&OosnwAFV*dm<@w^5(wENkI6*q7DTDk=0FNKoPZh>d(2cnaA?wLsrHj4ebpn^n{CY zg{S5@HQgoweFn0)76Nkuu^f(sH?~u?4u#KTg+Y8_z{oid0=gC zHDq;b_x-O?=6FH0w~Fr{K|q-WE#z00r@njHRxR52QDWr3J@e(NboBH!=_ZT_{thWH zw=pw_{I{h^sAy<^=ckWB898b$=M1i&R=l)-stjG!m+JBJ5QG>8L6~`u`e{@K8^a&Z zQoeN>lmjQfFlFoANf?7sq0WS_-{f2OaD1)}3J-NySkS(3NRcy7--l!d&%DVIm5Dba zD!n`1lr0XM$=-q5j=^$#dN~9l*4xy*8{nIe*z%njkhJZnp|kQlPl`^z%yI1mfytYt z+&o9qL;4FgNUH5UZwK}@;wB^5ZaCRR&)^lenKvO%n9Kis&8@7YaeQ%JLmqZ?o!@8` zvR1`G^^CLxT099$O?XQyBqz1r0R+lXL_E4XAkmWxJV*9_>==+)^=h)N5E1R;2;pp{lNH60Hq@tO@Pr7ofAWV+H%SRi$xK|B4?D!gDgwAFWlb-e`Wj z4=t}}W@&OVq9Xg0`e(t|jTFNIINxw>eAb5!N>(;Rti`@-f6`LgA%sFpsoqMx zd<5Q3-EgryxK_BD_^ge6Al?9cuGNPsIu(i)=iM1bCn0rZIgq1I9q&M(pd+!6GQO#X zQ8yDl54{O9J`LU&;{_ZQr@L>J< zNh}9Qr@NIubN-&j3ENfSX{K)EU7K_B>}hhgm{s1~ADE9vYHQ#g66)LT)1u*L6^tN( zkAo~YkV_+!PRsk8B#N*7YWdb5XV{SoPrS?XA@|V}hfeYoJ4Mzw(b$D6#lsG`5qWK) zm9XifD|rxz4kmc3_xE;yNX*tiFT3f5HNrK;3p-f#b-lBgcrnoGs?)v84<-bs)t8YM zXm+54alv>V42QmUChNC7!Ig)g9j%2Hxyw-N@|EvCYZbC7IqjXN;bjZ+M7R-26$atM zyYVZGJ31Q(vsB`al~XS(T8DawDYG9jyi5BUc}mGn=WZWUcNu z(DjCn5ap|G)0K@wn$j)&;by#7*I(a3uN?^~@LI_%=3^g~e*l1|?&!8dJhY0J?nGRl z8V6qi2Y@u8Y!$J>_d@dTM@|rn?9iodv9s=@-Nm)CHLGZTeVdxT-xzD*?(ok+Y{;V? z!L*ceysvm6r~|?|!aS8Dhs54RbVNTPi{(e1*&vDP!=}mTgcD{a7V_g^wE16O8pTrk zopst|q3(N??RkLT%h2BzEv$GMn@~C>Xc2`?fRaJ8To7uTme7^%FLw1Rr=LAZYN8Cf%RUxfaDCB|+@tzP{@(hyNKg_(+ky&`y5#0ux_?51>~O{XS< zZ`}|Cnh6EUAOvR7#a0PWl^|CLKApBUr_S#Yj3Sb)f+YT77S8_48}+oF`|wCOzWxb0nXZu6x z4aEe3Q5b5T8z1DxG8>|8eS|W}3SRb}1sdapK~@!m&zG_o;Lcnf#a`;ONd^`PT9 zH2`vQ9x9GDCmO{NZI*SQF8F+!S&;FUMB7ab19=D)*!(65A#Y!!70a3{5ZHeFC_Va% zKGB)D(U7{Ik+csSx(#GU#`r2a-!6gwSKEC$mfvew({Z!a7!~sC#+r8VS-6)S@Ez`c zf>Ivnzhi7p_2ny&e7mae>lx|uD+a%GK%E?(v#j5h~ zehhtk0jj^B=rU>nCEbJ#PLdO@_S8?7I*zz^6huersdqR^%arP%CAQ`$(dmiE8#BR+ zQz?pDDTYJkfZQYGniWLV`ai$&QMRM_)?BSxMSkiIj5-h7+XXzuc|(`Jty~&#es5=| z8K|DXO|STK-Gf+CP%Rf?BI6H#^fCNBvJPp7_1iQrG|G~_?E&PDLQFD=2)2`jEtNX`G&&_x5COz*FP|s8>&e^OCV@2O0|; ztg1PCQ=&$Q@9p5Gm6%Iv4*N3-{_a=u0!p6^&1^)vixv(88Wz4ncRLbqGHw3FEWpKA zTy=+I3F)L#fu5%!NYN7)MDaP3^7(}_{Ie1pN9NOsd(*;lF&+t0ozYx0TUhj!#(7P) zuHGQh`Cn_AuA5yKN%T%7+-d3>Dv5_KO2alq)T&ahdiXW!fXu2 z9ZlJqgrsuAY~__2QkXy~O6CYS!AeJ!s2-${QZ=>5pf17T%$yo9l58v($CQV=hybsZ zZ0vI=pT6XSc1@YpHSL7CGj^DrO(DY(?2cRtlgy7&GQ{rg z{^Bg7KMC!OIW_1OJv6|u$ZB$^*GF>TzFcw|b|=S~5Qs?1mt{brT3S8$%k2>DUw%~O zZKg>nSAGsN&9TWz`)BGOH}+#XSRVBQk)&(9_BNVj##AgiqAYsQ!f58O#6rZ3o!^Q? z5|m5aK?RD3QVScFOk=zm#43V9#X^be{aR`_saKVRg@{t636$z(-+u5)_f}rrUwQBk2*dzJB%rjyLuUU;ue(-(5KzvO%A$wFZ zZ{!ODDBi7;@Xjb1W~y}W0|TkyLkDMU;2JAyCEbLU4^OAmS{e<_lNUt31Pel@Y<&ss z4+B35Q+3sRD}s1|AgOqI{>z!(lZnO>8O(rq)*%?2`Vxr!6i2yEhF6{J5%ByI1v%1t zTU++sp3^0mCLtbNOIZEo^C$jP9XovQz%68+WD6w9SCgZtd%6=@$S z!ySH|4)JSu4Y%Z?_U4c({nTGSEaWFr*b1!Se>t60=G@d_oQ#Za{)P<2C5wY`3}-Rm&6JEpoG{j-smBJ<(NN6(YG(Y_s*cbN;< zmO5gO1ZUR*@k47G$hv;dDb;k4|0)25IM9NZqF)zZJ%yC~Yhf3tg8yCrUo`_k{QndN z%t*4gC?PXPku0|8j}uD1q3Mc+Oa)-_%D!OGW>W|INffh+7+&88;naP@3Y;)b?kL9j zx1La4f5|slvxT~!LfV;R5m>z3)Uvq~&w6V)+a0%Z(K@I2=seJOh;nZoUxffBv-;tu zS`>nQ-1Cbfy=gDOehNfgb=xxr1tU9t;UeyfzN{M65wCx(Q#HgmJaHk+B`TlZl1~^tBH?}j_EP1WE40(+Cbr^;UXe_ zYiNvorOo~oU)8aR@CSKt$&Ggc84J|ArZF6)(6byLX{Z#5eP{q~;fUV|IYxYVic(aQ$5-@z< z?+9+Ck6N4Ayl~IZMt{sip0M88T`uJeTc9Y>pg?%<%#W_gbqXK+*H6ZWo!y}tI*1BN zkh$XsoH%Ja+@+P1d+qjZagK>Bmly9)#Z8kF5_%uiUaROzs&k#Hioh;bm9c5LRuh~o zMJ>u|2UmQPt_pg)^MGY@-LPJ-g%EUQKyUWCL zu-eG8*+|ljyybK2N7HQnEEH__InD8gf(~9`{u6)QzpRQV4F zOva4=YPZm(>n?v_9XTVk@tk(d#Ll^W(39Vkn3z`9ReiAUtWAKx+&& zS{ySN!xXBGKBlo66~vDjn>360;HkHYaGJoMq{Fbkpt;zDmk)xEzYnt^vEi;aCQ{RO zr1dLW;uZ?ZV9B-lrFXbmPM6jf2O_*$x@Ohpky#GR7cRQYVJ*_zDhoxMs^uGB#;($- z(5QKOE^ae%KB`P;c3xgGMX$l!kVuM_AIPBo{am^nu+QkkC@ulQ!7MVC-h;sfeqh{n=?d-N10=! zJmO@aL1Bf66&~8IQ6I-&nfrHc#pQg{_Hm}U`dAtPg}eafZ;pXe5n48^@*lz2AZbMa zX{!IketoJ_qvGhn{&5ZG-VXG$`3i{**>#HKu^~0G0@CEx)v|P}bTCMw)&zmn^qvAL z`X4oJkZ^(cuyA9^jN$!Il7ZIsPn5g!Qy@gD#{1G-5Z5vI*6q&%tm;a#mihHM2y~eg zANLEMXy`6Cl&D;GSuNtSdCszJXi0V;Zb%z*{@M>WQzE$Q@HaSY4{>|1-` zduj*L7zcV5aFiC*3PO*G>Nzl89t-{j-%r9d!2W#96Fuk7b(jA{WD=Sl|c+NQp^vHbrn3*^E=a&802Q)Z04IVltNqF-`wA%-r z@{R96_W}g3$Vq2Tj%TUz9{RV{F^+T>V5Ap?Dml1TlzdOfA_`?^z)&taBz&=CVVB+E zwgC|A@8|3K9^38ct5tavCmC0B#r7LXD3AxPAFfm!8nSaSv}CIrKwatd!?(knz+}aG zRas7`YO=ItY67uNRb>F>9yzbdO=E zRt-NjLZ5LCfA1|2?2CM|89`X_Gf-A-I9j1>yk$J6=-_c}A;U@^pe@&<&&d-y6{ni3 z`(DiAXAE3(IO9N7=&;qq?H^y`nJD^(e_Q*&vZW*S;m`L;ef_e}sqxD_I}Ow88X{0& z4h5z-5@%VckXfU1iocp`f^;{3wwnV}a`T!j< zGYJ!RS)FEi5f#rcf8-Pni}J`J#V`47R2BqN1#X1bUtT-C^{V7Eu7|n}ncc)$oAyjN z_svOgmbscd!<=-K^cA<<+(#Y(pprkJlOMFiuXHci4F;fw6aD3pJt?+~)IvKeWv)7L zCL~)Q9v);75Ds^8102t-tj~(A7Dh^E>l({^**(P#qtu;^!lP|fTGr;>#c~OpP7`uj z`!Dv)6&LIunuN}iA$zuZx9TO>I>fkWC>IO(o7c-4J&pF>ak*RuhPp5HWm96bA?1Qz zWN{6eL4y&^Z=$hxjSuRK8-;|(DU|BmHV)?e%QJ&Hs{)WlB*i?7w-Gi87KMVipYv61dpSivint=b2cw)S? zKfh~AD_|Xk+sR0^%W0)Wg5CFollQ%4eqO}I+)%31_iW~N`2AIy#+;^`ySVDN&}X1P zF^wbsLajQA64-m132BuJ*sH4*P5dYyp7eIgSk9b?!SM<zoGVT^`Iulp zCYr>WKU>an>ni#&rHBhLvrJ7e^@a~iA8Ou@!D0caTiX*ttiwoObIy-S+Rh ztLe&c4n>}>d% zA{0#3>1)Yg)&WM{Za?eH7w)ZlJ+CY*(`7_GPtP+b)M2G81HW1qZ)I4py=pzBhbJ&m zJmxpOj)=38Jxtx(jp14bRa7t@kcTH2sL_XS5!+e27Jj<-jZOAy_pv?9S3q8Qo;IkK zz)aB)h3K=7J!Q=wZ4^7kBQrkGF@2&DDj69|amQB5$S`A>ET-X~Yhbd}=$m#B!rfEJg-- z4_CJMQ9F;U9~nuA?dY5B&?N83s1{q<%FP6>U#FjzOIYXf_+z17Db>MvY~jMxmQX~) zh?Cs?xg}ux|Jc194-wjo&IMv$q>yUJ&Zj3n_&>qhmB(H5JYmnRCajbz^Fg5e%6;F_`4lq;66KmShppZZ(ahHF)_N3~1_EbQ& zva0NWmviB?Mq2+tXO7nmVwhZ!EN&dw-iXbTQ!FSjZb0aSMN?hkHpA*$s|?d$P(w|b zm^P|+rp+7wNA4RTvD-z=M@#EpJJ{};EuD1uO8 z1@0c69XDhXy{tASbUMVITzN}}ctg;G!eKGl3^BkJySK=#_%NNEtiXHf#1;NxV=BS| zy;B_!c`tgkT0PP9vasma?^;9be9)eU`O07%*Vt`WSnMM9)l7~Qruu)-6C@{PE*YqS zYg2%fOALF^PdhtJ7Ao1L@gEGUX?a^;Py)q_MzOUuUU)ny_FOBW{c=3sT@|8vOeZsx zC*~JcQWruQGrqT$h>Hscp>N%51%Nyomig`OA zQRVk0_A4&D-$w*}0~(=)ZqF#iM(Z=FNt={z6U&#MUb9sB{F+=*DFNx(o8GBfs!}ps zjleV@+2*D{${fKG_x?naf+CAAfHAg+>yF*kNy&AO)>-vxist)eYd-jUjkSUivmT$+ zJYB7H0pEszTmW41FLgP($?m3nVgW1FMW6{w#3+c!AqqRGk)bD!3#g%8k$amNvM`Rk=Ct zP}Us98Fek%aKd=Wv80@~dI8%fUX1AkU%>9oC{j^uD|wO8Sxi{?tK6->kLd_QpPdaI z6H)E6h8F7rQYwzmN|!|SQdc|Soe?5wVnY&oF4;&1AF7A}!=0lUMo}dRIZFodf#^%( zOD3^oW0@Lt5fL!?tAV?U_f8n2b8^sI!x*swLiZZ45BN4H)@^iFC*5^%LrG;!W!^|*H8D1GxFudi<+VV;(K zbJdOz+KQ|J%)l)^7MRlIv0QquPC$=M8xZ~-7N)2bTHC;^09vupl2Gms7OmfM2RXdf$6Qf?Y26}6O}ps_sNKz zp$-y{r_Q88z^7I^au=u7=s8M;>#d20x^GxxHhfSS8V*8;77e`&+K`lD@~uJUb*ZO? z`f9Wb3=)-Ht#oXG0e*}CSk_ze$CyqROk}JTPF?8hM3|dF%6R{7NlQSPbw z3Vg~p%Enc3-Q+)BRKL#CW9oj6u0r}1CMn?-&nCIZFRA|4#Q8AkfP4}XY4#gK(CC{Hf zlk-yNaFZJ0fSBDOBT;>a0|p&FIsG9Jt>ER5?c=-iusL&mrP*zs3{0|oe3-&zJm%j^ z{aBqSrb%^Wj%}G=F&jF8*V*jCYZM5_tkm&rcb7fCs8gvL7<^WLM$YRzAU>2Vcjb9l zO2z72A40TfIY`X+Ew4FfLdhJC!s47dG@2iso#mac(?B}g=UkYpw4qt!s-C2S?xbI6 z>uT4`7P=AX_q=~JcgU@b_dHL_x7FGhKI)==Pw9;BM=omz^al)cRaneBy1G_t_Md1V z>q|E%5*10OR~a%KOhz_V;Em~j)S|E&GyE7G#Vo(v{3*p7;R!#l@CQ|$zFR{jgRBs! zy|Pl49B!#gw*;!7$gp0wE*|!OQFhirarF(BMgk;g(BK3J z65QQ_TX1)GcX!v|?$WrsLnFc6-QC@{Uz_>n+ufPnf4i!yy6>&J)%`r@oS(s?-cj$~ z`H$m%$L!O#s|`~PJBk@Nns^&Royz2_eeKzd*rYdV?CTx}UlgIGcNSJi;(zh?flBC@5B4Rd`!HWia zzCmxoRJ`EmBCwRLOM*EwKGBty0b97pW7oHWB6`60Snl$CILovBdS1BLa;@ZRXbbZV zYaw6p6gz>KF15fnn8%_tEhI=*Z?yue7ZpV=J&<-J%il{o+`7Z`UYkUuJs=RM{FI0l zvS%w@mf`6CN#F_d$V^_Ym-b^iWJZ(Q^GIaKORgSABx3910CwCwHq>#l*xgIi+U1TM6*FQ&11LHoNdQ?*EUj#M{mOU;T*(=>Mh$dRgBP2Sok& z>0wt{=K$wGraM}vs#)?Wc$rXFLEi6|<{h&i4`i#AwOlR-igW8a9Grz1Fq`t|GQGJ?^j_+VaImiqZNf^dX~6pi zT~CB8l@d&>2R>zn42k@WE!nkM6fAttQVvIvMDe8Xc`wKFF-%inGi5}S)r$a>y*qHAdE8GR2>qhLI@UQlIx=YkbuJx07+O&O#pDucm!(MKY!8=ewO(5w3-YB1V9be6 z^J?Ad?H#OER#OJQMUaFKa?_{9Vy2~Le(Rw@Xu0EZX5GD*noN^!+o=g{L}pmvO30U~ zK%>f9y4x8YsS5O5W^ZOLoBt}+@3$8>xW~=eK++;AqI_BLV->pM%>Q($4zrGZYGL8P zS6Mk}gUNvBk815@+=b!tcZ!j9Cz`F$#%(Y%K=n3@jmvnF7K67Fi%ryFq)#IiB5F&5 zbkeU_GiO9@@9M4G$=cdreJd@jsrE6KN`Yxh9I@X>{Kz!LG~qEUEBhTu{(4WgtH#C< zTT$b-czsnXOrHplthwNf2$3#d+KkL}3_V@%kuS+znuXOX=%(Y)Rvf8J-L zjo}7V@{O#X~X_TH+Cv+^R~pPQ!{JN zNcdWNgQz+}P=S1n=8za)ze$kVs@*esI#ERSd3zo=G!$rQh-YT+gjWhRW9cWJb2>3K z(NN1P0irkV&Lp9)SLW(Z@%qEyu6HRk2vNU;7U-YCoL?YKGb?CvpdPlZ*ekr#m%eC( z33bjod;WQYB(8Vw7pGFv(*Xl}mfRvR;>%E+C)lR+uz41m@3L5R>`q;-(>1km`w_dl zytATe&?hSS8P_gF;a`fDuTPBb7hi)-mT5B?@^c{Q@&uf}u;4GQMHI?xVrG=nMpxTv znXZ`bbo3Eh;jfUJ?v}keSUdS6d!{PFX)$m9&WMPSconYKZ9Ln&+}P^AS>ZRcF8Sz| zb$TvRCtBEh8NCiAJtb)WMsT^DtxzIYYtLYJWq36-Ku!~^Z&qZT3y{e3ERp@{MFQfr z@-=qXVPRlzlZ(Q*69-J(ITItjGF`7R+^^>AP)MU>+S@!sBt*shfs-j}9yBtP;b8^1 z_!2~ki7_F%RzziTXki8(IegTpaR5s!3!1_Jb9wD?GG$rH-9EkVDFKXZ2GEGoU3wEU zK2GMQl>&}0pd1jISTSm+BGls8zW`e82eqt!0Il%gC#2rW;r4y{?l0D)g@zk86ZyIX z-p#1FO50UpGxc;h#?!5t1z4a*xL=oRto1~S2z|8>(I>p4)|$$(?!;_`VuwJ#G3r#w zszU+LBXz=Q3I?IUbfF4=#Z+7gt4Zzqbaud~0xB7i9Tfa`bnMc*A95(9J53N3{2npM zeC4@wg%bvG=1OF7;*8|zc0^*N^#_L*%fDVngHZjp*@A(()g5M-Kij`J(3iHDx-A@j z$mlnEKb?PPb+fcsFW^RhRDK+a-Ruq`IewiFezd+6ref{5A`&YBljOKGJ&t}C=lwOD zy-T5>zGlEQvCFbYOmOpM?_|`SGb$*w0L4d_A3TdGoeME-RIetP;EhRESWEYEH)LRs zG-$6sXy@piyLVupv#x-L@bMP!NS^yfapCOwsKpWCZ6dn(hkLWlamRu4Cko~e|U{7gF*WHNk@u+r13 ze!)=0Fua+WSEuIaAO`fr?FZb#Y5xZ*S9EM?MtGbP_Emis^^O!6k|zoU8_D+<>W!ge zI2G>s&pG7Q@aBM+_U@{?OLxoGH+yAN#acQ&H|3lE!j(}!$-Eh_k=*kzGd^q~K>M@( zV71)&Ogm0bxia8jZCNhUgXPp$0jbz!Fu`sy_aC%ZjQ7y*GF3X`WUbJPx{-T6dq=|a zN4?%CC{c1KlZDMX6~(D<*+Z_+m7Bvw!Vp%!0Do?Ed{g+_ov7eD4%z|mBJ%Er+5zn4B zwZXWh;JMsbq>Mjky_R1dJNE%NufU7EmXC+h`SmDqMpFL;rU zI2}V)Vadh3U0%c=968ene;`*`>w6$->wl>EiyH^#j0^w}Kb$yWvQSY$r!ODr>Yoec zL)r|#pMzR60_$CRB*!dSh#IF%Gq&jQ1h7154nX&lg9KHq`P0*k^pjI!yPT#v0|chR zZM{zF<*{dkHuhtNlf+MdlV&uRDypy62OGP)6Q6~FNHq3#4!G4s*}#CG`S}K|f-ob| zAM2d`@Vw11B0QW~NQ_WB1zIW<-4^VxyjQsY^&>U=M1&d`w_ihDh z;HN{eb1Wh657X4E+dw%Wn5<+$=4Sy7de5kSNPGqv3`p_vqnabcJa?i4y#eH+VtQvp)70M^OeOHOsjf{F%X=1SIv%7lQ zhP%!FLGT@J4y1=?3Nj>0%j~pnZ`mjhOrOCEfbjnZH(!xY-tUe#fJpN`9FE0}Dw968 z?wa@}>@D%U)1n;P-A?f~aUFe(DKpakql}lyDd^`o3Sal`s&m-ybiU5YxmQP)>B2LP z`?-nVH)2)yqk_5PC)(8**o)}fL9>@P?A$_ThuCEDTI=dCQe>(Vfe>9` z>n{tT@*>fMFH0a%^P`|(30`i_~D=1##(cgpViXF%X=6}E_U`ikar zL*Rfcu_kyrNpHsT0Z!(#SJLav{;0p7zwu&S7)L#ZIFChRv}^~3k~81$$?UFQ)R3r* z#Sooj<|uYufVCM>jaM0wx~i@O*g#n2BHIUffiB0gLbz%Cz0e{HMZUVTm`618iy8ON zijeI$8!`$&gNMs)!ei*EIsC{dxLfMdUDGjn-39YDJQjmdi)A&8m;QXIH2C$3@1ON% z0w1w4P=3ju4q?1{-goVG0f8b;eWoMVX@Hhi${y20CXQ z`tGlDg=-7d&syCh>w~MizAG_9F9E8dbFU<#vO=keQ z@zT{9^c+<04j!K>)Wb*va4)qOMt5;MuiqoS*oMj!NRmz$OS5VqIF^57s*o}H^pK&> z5<|(X49V*!4E)C6decfF8S^d#>h)qZ*d2y=vq0ocmf%Pf*kG$NNOphP0kPVSaJB9W z;iN)!{P`0_YQ&<7!;v;TZ#S>a(Ft(*ff#n(&fndai>K7*Wv3OEt-!XHPr+iCLYave zFS>K)+DO7JQDe<6*i}tYQb3&%OP|?67xc7Y$UkxEG}j8iqVtjMYZeIo$`mZ|Mof{;Z$VtQPBh zVJB|uA9-LZ<(EgtxZete!`tLDL|R%-hAd45(VjB~sXhb6NYNiLS^WD9D2Ag7%pAE# zmvMi9P%>=2VnywqZt_ALDiz9i%-|7qr=10IKTjmhGVW@Lt2TW{0Zx%UCMoJw&1<*~ou>Jbz! zpKowOX%^c=Xi4#shIjleEp_T*nmR{{!5&!NPx5eev7 zU06 zNM6ve-jR7fJi`k%)puGutZ0`w`zY!ihrmY$P<>-v$IxO!Bohxb(~D0+Gxowf5ejXJ zAxW3)uK1{5U45v80ZLmSER-GngQnr75yXZ^5{5%d@yxF7DC@EFCKv1mukg~G9xUBe z0;22lzl1Z7H>oK0siRb1!R%pct)H*P<^R{6ZP^Y{n`I2&l z{-!=Dhf6Joi>Z(X^2E^^!d&OsJ)uc`A+vmG@n$Yb>4@fi;{*GCB6+`Hn&CO_4rdPu zup`Co!4(T~C$T)N2u&lrdwysulV?ww$at!-50MGPUBIbUh(|CgE)6OQa?3UoRVhU!b0?$$bcz znMFp{Ppx;dwLLXiC5PgZ5Yu>+9}bI?XIyA!DI};RU|e$_2xZq?f=^@X+igk5oMg=J zJ^EI&wNf{NOQE+{2iWavkUFb3kLqxDcNV^SW`J>DpI#bT?Q5RvI#iQHk1vaC60vL) z+WwH5*+H|uy84=0b-(3n*m~`(mstRgi&iWOwSg%PXdcL)N|7Xm=hx1X@&`_h#d{L+s$aTba^knI**hMXP2Ndt1g=?LeV#|qfIn}xl~APy!Ui83 z8kki;sYfg*JO2Z(TLim#+5yNq!?o($w*@YJy18W%MHflC55lgXe zxd7v*OD&7_-}E}ZqVz>yrE?7pdZ`aOR`LeSMIQ4lyY6;RH|;1Csk3GFK;2MEYekZy zh3cXtRKibSB@Ci#s-YyjAm}t*-9@qQwDVs&DbL*j42_J?ikqDi8|#mDx0dG3#k&eM z)eD^|rssDm&s(CitW24Ye)OhB>;%~14YaHYd{V68Pe*#jMh7>m>CXSs580k$CG>o< zTF5rC&|}E(r=8FnOG+agh16MW)53e=JZ1ZN_I@j@<=tiW(B zJR%60LfbXFbZFalqebE6`ATuz`K{$;VxKc%X|EhMwkXY-c<$!T8m&fuf{fQW>;Vl* zJYnon6s&z*I-@z^JE_fFSu| zIopMkQTvq-Tw6C?wA~pZ&YTTLHqNHY(|8qSr}Dcn{Uvp7YvD2zE?;kksHxSzedEf> z=S5idlUjFqz;(MS$C*1^FJ?~b3zPnd#NjQUBd2sBD3;y7Ni~$?tPJQ_1tooU%(Kp4 z9DQ$}Z$aOBS%(U`{pOMuJA;s^TzUQi$qC>xS$xHu7?j za?S7wuve=49!E(w!;onvwbu7k=}S2y$vvFt_`Xf{@h8Xqy!%0iO}pXz=AI(HlsD=J zjf#$jIbc#XMLoyWZENeeeot1L==j)nRdNEh)Pe1kXtJ)8{up-W=d$rR z637so@>20xC0dvLlWID)i=}dRV{evD)TuhD(fRW~z!Bp$?3u9ex+}&j`4d8<@Cwh* zU2@2DvO$BehREaQh5G@DPTs3dlA}I}9cLmh1blRHHIX)OapudaApi%QR74(M3&7;vAd7j(rg+Mm#i4Ci}X0X63`>vX8~SwXj0< zjaZICnDUgQEH7MI zLTFwWBguua&UrkO8LuKa8pR?$Jk++Rm?LL~tiO2s);iRZl$r;N(;e3KiaoSO$6&VN zZiUyM5c5sY1Ri^XF4P@!Q|`Kp^-t~`GJYx2i39#;EZQ3EpSeX4SeJrMqnzn_J4jf; z&B4zS@&~1=OZZF)=_pB_zy#L8+L^%qcuyy^Hb}ed^=TuevU#0|k^$7&H3*-9Lb4`o zNRdVDPvEbbMdzVKFXPGMQ~biwxL!L}4T#Zh;Cav{Y}>cZtG^!q*oEw+?N(kK8|cQt zX+Gz5WU+CDJgwr-jEbtLXpoVXjuskVknKbOADGzks(JrGC4jvGT|}k-a7us z)X7bhW&mkBM zk3}bbOp8o$IdWy#L}^R+D73?|l&t&>Pt_KaSGx3&DH1qRHUFNf`AeHaC zoh;ShmvBujEN;3=OC@a7LLYaknP|*w=e}}lKmRUTq6E$s7Ji!8HlY6m9MrRu9yyyG zn{2j4Qbt9cXiQ+fkq20D`HuX#cIidYG33PGq}Djp?$gy2_`T+G^JUHm^e=nEicS2a zG$;}SOGs;*1cl~BEe@npuFd;JZ~97)&1m6FS?17u-%*VLBXyNM|Q!&(H4b}H{Dv(?V?RudG@Un!n#+tBa8|I8fEx7>rS*-R4Z*lZ+BHYZU^!Z|^ z7?#K6=v2pZKLJulJ8Ubb6aHK5nXhk7xXqkQ*CTzWLoZxglwIq+NUzXXTiVbKlRG0P z3jy&D@iVbi*Dx4*BqL z#s40nhf1di@SyokLaAwp#U$sEbnP;v2Z{CC(L|FVOAN;Ps;Pd9y{vy=%EmxPPqMgE z=R5a%w`{uSB7NBUxsYLlJ7F@xrlf~AYqrqBrwLbU%hG8uZ~y!{Bm+6vAQQ`sA>fQmRhP6BP!lOwxY~ z1iXP*bY&b0GA6dBs1Vq~L46GD>*pFGXru#giqs~Tmu36AJ??Y=f$3WN1BaF<88EU8 z2ad?`-H$FSHQxN-(%}Pv*VBFK_aa=;g-UPtUGhXufp6x0Z>6UIlf{}?@P`_47tU}@kBBjRt_`#4pZxXG2-i|_sX&I;sW zviz-A3#?5g-o5pM?(D`2SDlHqhtS2rlZeqSa&7~-+xc08$IzM5DH5J~GJ?ZBk;oGW zBuAY0N-g$Tvp;`HWKQQL8>O?T8cbnO&kqoWpnUyK7C$LYZ+{IK1rQ5?}g+7ds@(Y zxkQGe9slbm37lJ=9)&-7aw8|AkBUaW&>#& zj~|-L+91TA4AI~%DH-C?*mCDW_!u<6sh-yo^~XW!ZuB}OZ~=H6UVULpygZ;Z<&NK} zG5X7+N8B@$pn4!LLUFl7BJDk)S7+}4EQy=%zC-k;<)aaP`~hSMx_N_4_qd#zMFGO| za*;b@P*oH>hb|tka52L+gMVu3y0x->O(3`fH+b;j%~u|Yw@4u3;%cFkleK(j;&P_B z49Z)e{&!_|u}v7n0MIVW)i09qWER!vJ|wqv2{GOuruHRfz^Xkx;3{b}0ppPAUKHor zYHOMIcQ5RRV$G8H*q_R4i9E|vJgk^rBwmC$-%}PZidyTw|{2}IDo+tL7Zj;ak5DUI@!(h zFC!BRvsHY9mWNh03GBqvW&K7DfjESj1)RS*wBS_7dH${*`c-V~P;3&f;`Ea9Dc@w7 zuBRc8Kx1#`fK5-xhx}KqM-dSX-a(Y}nA?v$U>EagTU-9PxEo1?vKP^gyGu_$+r?y=Gu5SMTlz zGRqUJbhQTmWV%s6a})n$!=HT5PC?MyhGHmtI|kHrbCM;6}LOFABrbdOLYt(mY$7cMC1)x^}g8b2O$$PB|O#$V#>skx19Ud3qV-c+1#LI`#4J{Oy!mt{`oHMuSwk(4%*;;I@1DTdVGsN zr9f;+^j9jK<{{ncCXG?U`PijrormACtd@(3l${)H<0jW#tZ2bi4ha=%);^q`5Mi1aNK_=EiI9n`xU&u@dH$r=U zDRVF(hbg;i738|CT74HRI-enQqSR5jdm0g;ZjNmblxxU%Xovpv#aSf(vnK6?JC4PO zS^`3lLAz@(7hzu3--=*iptZ5u$r)22uf>#E;MM6TPI(H4@3=1NydDpPlRbW#Ju3qT zaj-?yI*!FdnSa=kQ%$~H4c-s^|)|f*%Db<0bsvwrl$g9le)faD{M{ua&$dBwyU)K zXX11o#2~0iO0eya$x+~)RZR10&b!FwB6rj~fD^>!g%50QZ?ZL^d|B}mIexA{vsms) zp1%{Wi~w3ybx{g6;f31@SL~RF`Rr&U>oaXe9d8IfK0b1EFhB+Dnwxe`RjEn@^_))d?VEPCVs;e z3)kAFLhCX2G$O~bzDoATa|h3wQ%WT5w{=ECEdXG)v3iF6*RRTOU0XIQG?r%P-hwC2(QDf5;q`{&QBVpVvtX@&|&T;$e6>zd5!jlQG+L6o0EoSfAWa@RM@E% z?z&e=uBgQ5Yp7xC2X2%cX`I4X4G8GC(&lcPvt5}@PwFUbVLowTZYk}rpgA2Xu@~go zSd(nGt-Q>oi*7+k?Coa)Eeu?&RKWMM>m3JLNOB72)xRMPSZe!<{NG<6qW`FlVFs(YwJUBaWKohNRZ7QfUg`&45}C~JH~o1)L)k4529*0A)Y~m2O_v9jNPSF=i%0nezr_7!ps|+ z@(+loIK=vs``AUU4>6$)-Rm<^hROwS~P0_+0m z(a%={VwIqZoYN%Q&#fCL1*Pyp(GGN>n_U_{1qpR+-{PoU>kxDGly-E?mZpmj z;7&}VFdpuU(T*WEVC@dBFd~($k7%`ll~L461n{TnEHL9%I@{~kb0-#qSM0Rxs$T^+ z%)B0D2jdi*hoLVGPF_ZCX%Ou<8sE&ZaH{`W@iD%YdeI%=uqZeB!m8BNi8;4?D?zyG z&iO0QBg`C$$Qd7Qw@Q`Ael^g8=7w2}J#LT-&58MDj+>@6mJEHfO*Kb>efjQqZ7CJS zlQ!fycg;TVfEX}H4StS4Wz`PI{2J~jUx$mEwYqjSwsh7Hyti2K zVsrt1CbtAh4VA+5y+a5fW_m%*AqAha15pr4BRB?G_PXCDK}8`ys{qB(MjgachKOI3 z)Pa!-6%Y^CGN&!3`GDJkm7*uC?8bAawFn*F!ojrRRkoq4g^?+}gtN3t_ZdEf;qQXL zAh!puli%3Z(lRQie5bm zW?aE6D-CPI1|wdWb1c<82a*?OZl@f~g`>%YN*Ji)%EbycbBKCKWQtQLJ`GG>TXl!b zWzd4VnOW^uM=*xmqq`%)a#4}Du@@L zqfyK#HIJnR>-yn-->kOevT4t!N6QG4FUD~=qWX|M{L%EGnYlIhx8DDuAi;+r!DNAf z2cZAmu#}(pbao0EM10p{bB*8L@dnqO0;OjHRs4IP3X6)gcE$#!X!e%r92{!hZL9&e zNln5;P`}2MZYp0Mwzs=7+RJ0wKd5RGuWVw948Uc=*5#|LtJ4OGC1R7I!#-fYG91@ef`bjr%y`9f zN3hIH(U7w#FD666vS9=}SzPm?H8~!E#o%^rLctE7qvXi^n3lTL;h&#;oTv4RcSl#V z3vBox0>+=6!_S#ht!qAI!7l;#rXwk}*iE-3xDn4@JLsm*{N%S8fEL;}F`lEF+>n?( zV-uT zQMiw{vOkh6Z6ArS>Sl0@Nxw*jCHO8m{7XG`dRCknl&xoNT&`KQE*+U?COJyEfQJ6mS(Pf!r&z7U6aCe!HeFH~3c1I75#;=Lf6BV0B_0;eU;$0`i{ z`b=S?!y-$xfneC6gCW%CMnYW0Lg%1M4vLk%`ZddSzgqs25s$?VP#!v{CO^58RZTXz_i;%UP!8 z3y8FXez<#P!5en|tg={@DUgXRalNG|SDnWGj`dv-JE@?coU!R=w7vCKqs7upicka_ zk;zxxSj2My?xcnfdV;0Z&ck~T_trSIKE;_w{xxMc3T9h%__z!QO3c#|w@^OkM>+k> zRGLosIa@X^Pv(9%6KzyVuTd4pw9&YHtk?M{U_QX0!cjWkFd0hQwOC==X^KqNGE@Ad z94wTCzA9{V23e>;42%h9_sTvJR!6!m1nngXQ&at9nQ$#CVwf7D=1ifV#LTKE*UIBd zj_;JafqU?@q6*2$;<^IFoS z#eob421u`F&o9VSh>m_{rytz!i|tADLeuqBSly9 zGYW$rPK;T_7?{OPbTy<#_`EGEL~#-;oRb#YVY%to6Q7ZQj}W*dFs9I~Qq7o*|TZG(GCou~3+{ z@zNi=!gcpxog!jI;7|1>e8#6_1bsqnrYh^fe{>WQLO-h3+SKG!XB7{z@ljMmUiM$a zm$RKp?%^?S5J&)Z{dgbp2iOi4OMdhR|1wd@<;t8Z^DRhBp@ZS?!hvd_z4PY0M{51y z<{pb_mGzGe8-4ajfs#F+lzAT>;*2TJQw?sBv6b{RT8=hr;lFDXG-Q(VSM2Re_s*~` z)7IXl*XZgHGR7fs5+ZeWLsL+ffrm25T4+cIs}i^M4}wuro%IXPZI5`vOFm1n?gM76 z($LvPZ+Z5wMjSt6gP0&`l8`NpW)6d+!M~ne`>44;)42AXK9k_6v8X6JJGClvYXac2 zcBwH!n>^bn$(eA9K6=`>hyv5;%VvWB)u^d)kvZTuv={Tvs{_)Fb=Z!#FJZg;6~FrM zV`;J1N;{?F;4Cv%%;#}Ew~u&)?+vRK{%WZ__SxBbVJs@y$J!|%1UI3d);gzc(don8 zmu3y78JmIucop&?WVRhr-6bjT8Xz$P{JArr%X`PrwgSo%FfJ1(tbI;JRhB=TB6rC+aZr!BypUJeQcUTj5Lhs95h-e-L|z2 z+MDqg#1b#C{;dkq>MEzU*Z$iCGv_J+W{lI73sEB}%v-xk)BSFF5iwExQ{Ri%%g(s7 zaM|JMI=R8X*HIi#FWlt$DS;L@WRA4<~utM?cCKN>dXZUj3 zCabNKGp5|3KcmZ-r8QEBmb~n}6AU+GPqX6l1ZR322RS}Dn~fS(Z^=*lkF6^d#iMh{ zqAZMV&Mf|?NfVureah};LBN?IUZc3-ggCx8_Nx3GIrcequGBn4YvGyw|5<>QqwvZw z$28*KWztn(+X|hqZcat9o4@c^@u(-k7YT=UdO;{a^0ugSC zM4s>Q;+NuDbqFGI&_T=_wVWpJ!d_2V2GfiR<#pocYydo)%h~iCGWOV(f7UP`ID+xh@Uqu(qvdMN zqml)W_VwNtO7^Cty`75R-{yxOw0M|;`}W$-STVRvoyt2<-Kwa?GciXh3EC(^y=dkF zXR@)tQ2rW#+~FhAc9!CRb;yrri632BK=QT0cM=K$JZX4(ZdTVMb1Iin)%rZMcn;_} zIQ4ixFV&nTy?Fouv1ZV$z%G{cf50eoSg&5>tp!* z+-NGfVa*YB%gpDUpdjIk`rGZXiaU+w0rxY^`O*1I0yQqHwH9tlKm}anG`jeBAos*H zrOnBl^}rY;s;04+YfI3L-}gA~yJu^Hi9!)7Ei<0Q)VTWeR7Vq6AvM+pw-22%I7bBn z(Q)JRm{OS+Yj1sUENAH*3-c3T+C0X4h`j5X04w6_KL#5^2!1D70u+esw3-MvUoa|f zaXcFFlrN!hS%S;M)ZMW-o4oGA7HJ$*pd+mqy~a*%y*s%*arJE$0xadt=MPz|&u%Wu zG3T|#XmC}gSM`S@OyMkA=9Q8>@O}ICw2r5SGw^O1b!N*W+cpfq)6bIwTiG8bnJt0hRSzT#-R>J%>tRCSq2gv#=~Y;Az==PYC*X>%0j!8{P|>6 z&(h&cgAh}P7Pa!iNfQU?!}uP}Jm0pSl{V$H_W4dd^|Tq2W9F6?fc`i;48bM)@AE(H zDAG2l|B?#i1W0|UT7XYwyE65P6L#Cuqn{|QjOrlXzSQDz2fMF$Q;TwOU`Eho!X!;DxKi>6;zM)?VfKoP zIx`EfanY&F#w7yULPL1EFv{yc;pDXXCq62F`BM-R0OvjYBMSR|v%6e8oT@i+HdmS$ ze=ra)G>pU+cxJs^#n-XWdtvft&-S#e=xE0O07Ur_$!sTW*j&PKv zzTV6$ZIiSwkp`ljd);ZQS{`zA-qqo1-<~$wy%Muta127Mzp8zch@)iWy)+(qTB@WZ z_9FZ>^^W_m(?BTGjKi-5hA5SxNx#{81G@=|Z@y?hA~0ZQh@}Id_`V18d>b=jq~kE3 zUvkBr7Pi*zw97m;B$W{$lPl=giIps*s#Tc4qB0?N4NdAl^`38!B3GUCsQwWRsCD+glU~PFLTIt?*OOczgA3q z-^ZO5*tmFtP?gCGP-F*Jd9#AXrnczf%~Za?RtM0fuLr*mI6+erV8|?RkGM0SzlSa! z)Z6ZDr6}w;??kF--3v2iPlt4hcdi!qgIfev=_3=k_4-I+%`^n%#ULg;p?*F%Wz?Bd zAVhz*eEgEOWu1Lvy@zB%Ut zzQt%}olB&>p9V4hXN{p;r;I*mH|~leH&_?3bzL?_+RvR@70O!&?s+8T{;whkB;?h2kC;^+S!&DoQ zBcp%2O1qB?pUXWE#nbuiAkAvQ$I<9{&J!f5a5)!q)Gk{_0g%d^2#y*EaeL#-H*Y<> z&om?uzf7z-XS`g&&Aa(R)w zv}BC_$_{~Gle=W^4fc*cVb6DEm#=7VZ;$f_jyhC%hrWg&6XPnQByQ+jEau~^ZTGvR zG+U^iPJ9;U|HmG|henDg&%63`B!4HSpw7{o7y$q=Nz%mX|)P5Bv7Kgz)7G;}(X3 zbDLBaX3qYz*z;!*L1u9T%wTzOX+e6i%plw!&g*r}h_ zj-GdyHl+@@OCx$UT9zZF)LFMWk7UFFhKd$IGe4%|Lq(Frk$7!wOzl){BYZhOtQLpf zG*`^E*H57Wp&Wfa`aDe0gUfZ)$D50OU3^>k@c;>Z0y;erC3Le=1V4{GoL&VTTiC33iv38_3c3c zF5{ig)aNi&=HqWGE9o=q@jE*^xw%Aamc{XzOI>rGR}a;BL5Qj$+j=TEwrpBxM~j!| z!QX?0rCY!Hxjt0AZn~@yezCv*wF4=Yy-tDYdBk1RS0+z)L4LJcOWoklI?#3T8P1F8 zW%9ye*@n-Wsn3#--mvFV%E68Pvb3bGPUINIO9R5dNTP}sk3bP`Md7n7B$!rr77iSh zh9Am3J9gxSe>Dcgui$OwM+~|$B>0V~2=JN>q)ew*F`CQp?ehjiTqip8PUgz#h+(=X z8_g_2&NUwO>1M#Z0A~FMuru|;YUg{mmYgr{&J@*K_2J#U`hm>v7N)R zUr$mbX_P5<3O1US=o!E@LOy)Sk{9y8QmkJp|1EPQc5ek|wVtv*=x}0%SuV}meTkWE znJ3no9NYo3bQOBP;Z$qw^*aJtOo@xJsaM}at@Q)<{n^^|F?d8h^irxg3Hdsg z)%9^xcb2ysQ+Prjn5Lb;m(8FS`avUNR@(1X1@;@yo>8QEp_Yf>HnIWX{M@b7aAb1K zTuT=EwU1a)s8Vpn6L;Zfo6Z=&O5P`?r~<1N4-#?tkFn-s?>K*zBeO*NE^BQz?#Go< z9h=xim`EcXH)wwF79DY6X6md2>pVZUd=2tNjUB?8ElWU7XHt z|5v?j=cO3Pz6{PrX7i1skb1ROr8r%LuqpcPsqKYuq;etcz-?yno3(|(q>rCPHsKxjYUX!>SoR%1;ScO(_FR6V(q*?DxdS(CvP(wUADaR5Y>x| zeNT{~#Q*HpXInAfL~_jghSTb@8uD0L$?b#i=5GIuZYTPV6AtbG=2Iu*MsKlqwmJAg zh8e`yA}wBa7V%<*L3G#)gN(HcPdWf-fk)N%jV+vWbQ((7xSS2AP4^>woyC$3@GSf$ zIm7BKPTo!k#DpJX>i3Z~Ts6C?a&=YUH&;u;b8f~`#U++cykECbzm z-uZ>ojg`!I;J+MlaO`iHc5QKRAo$Zaf-8}2EA9;61TI0BG_}|1K4&LDb>*wuub%p2 z&*8BdPF5QS(%XtJ5Eb-l=}=X4usA226R!)E>p0{|NOT(02EJ76RCk8Eoq!H2`wL{3 z2_p)M@urSI*zOviiY~xo#1&I<(kuS4-&1=>k=`M{?GOnNTorEdAMKpdDRlDmA%#7)~s zZH5q6l7^L}wL-qkmFXW9rPhnp!<~X~RCP2zO3WG$$NEjSD1@=4IyjC^!8aNxHKD5E z?w)%(`%gm!Hg-tc`m2nm$%wU9ks^iMZ2>iPd6Ug@kRoWwSAdY~0|o;54CW%X?)63u zCPQ(&hT&mH=e5&L`n$HF4{&U#DjJwwc;xYc}0 z#Zm2zR`S>B4Kvc88x79%t|#(HQeQ$16x`{OzWtDP5H%fl3#L~=XOc@!AKHP1cX+T@ zl7kcqM#Kx%`$SiElI?CSaF{IPadgqrK51Z1UusH2!}dix_a4+pVQMC{Fd;T>Y;3D- zXpNc9%+rmQKyUGU<;4X+rozr!TWDpBZgzdn7~Hf^{^P-$BT7Y@c|JgAN$p$nqR3}Y z{3`w`g;JoVNJYAmd5+{JQ-cOy#5Av`NO85rSRn^qs&+U@`;kyIJ~bI4L5(7zNA%R} z=6^BwR#9*+=eu zzE3qqRgHeBRb6Y&wdOY)M3zZ62J=T;td=$#P7P4nfAh^Puag&k{Bf|q?a-AgI4JyE zWwY1h&HaX&u520=j{eWKCdZwl9T!!D=Rq5^RMDq*I*@T_sVXZ4UcaHyOc`wmNUD=j zXSxhfFwi=?^Krv3sc?mh-SIef&ZyTuUx=bxV^WhurTp(`39(2Ye+AG4>XaJAFZfR! z^J6y^;NK{r)Gysci2WugStC#AsllNmbw;>}#4`xL6Fjr_l^M+|&f~LB8a^jl;|g6- zC82Ok3eu>=5c{>uye~}j7vih&)1y~fI9jh>TSfMf=xxY+H&HX z10rK!nqmT&8AnbG7x${(ssVSIeWWHa9fj%yjfKTs4Y;odVLguw%}ol)&nl8kifT^l zyYAh}Z$%m-A;1pY}&dA+?2s;!W9K%LF?HeFd<8EfDlFo$(6w zb@aL@x{JPNKnl9wGa$OFynbsEmkR@UAF6a@OR&u>FxHk16${J+4MZc&_Y5kN=Gb2t z6=Hsz_G1OV$cjP?#@SaJZl2)AX_zZTP7D`n!3WWB(q1XGVI}CyN&i=5XD^GVze|+} zojZGc*-TM|{kL~k{$gcya_yXc#R`%Czif3CfRmaWf6a5708n}Qu-3kW9{#_;M6aKW zzq6$`s}B+rBE|VO#$_jBnC)PWgxO!g!TYUM^3gHWJK0z0I$WpVYuS?d3e}%p<$?{L@DE*Ywx^xNMLc!p!!-n7D;#t(z+c^FWKI&-% zeJ9A*h=r2&9mxEjl%l80fRuMLcz~E%>BB+lq{SIiaj&%-BP}eGmpgt%zU2pc^FZ7K=&bF9+sx`A zuJ%yIC^lp}UdqPfp_UjHhoG3N7mZC!JEh)N2C6Tm_g2I1j1r+>DzMW&q&Z6($;plV zxLbl%6)@ZpXlG*RSEeiT)`^r<7R?XtjKSEC>+Amh7iI`zN-G^d@%vOL`6-U<$QpO) z_!r8gBO|kvAXX8qUM%lfbQm@rPZIIMb*(LI9`7=PCw?i0_mTMTg%5O~i%CrYKRO`| zm$RZbd-2vu9_HPikpVdQs#Ml-HUOTcY- zO)!3)L+!abc699CaeByYa!(6Px$GhI4z%|{h_uvZI$+ILa=PzU#othxB6!i18X&2U1obbsQ2TVy(LX(V_HNB^eEy-)hVQH0+K zRsMfLkQ9pi{)Ql>x{$uX{7(o{s^)V;j_2MBC{v50VNn5m-ltCJZ~ZYmgDG@2LuFk` zH5yE*_}F28BETXr@xkW*8-2tXg%#F|)Yig%bNX&AlfHpis6)=-Z}0GtsbPIZLEw*; zFI3GlrjyZiWr)4@3%cJFp%zA0CEezLz0C9-Ctyas>|Q?|uIvKvU&YBxW}f)?_-75A z_dd9C5-PMt+n49o??vh^uuTL5!27p>`4YnIiR^2i{RJOG@0^d0gi95QbTqyJg%#^% zi$s?bnZI8O8A@%P^8ZS}NakJM%Hnd~o=Szb^Sqm2&$ztQziOjgKmG!Y1zh~9B(Y5n z6fVPE2Tj|z788<-JXe3se^dOfe)$ix*|7*5?SxcUrcx4db93VEbT*SsPX2QCtbdO2 zNdCS4ii5O7<1tTxx^FJQnfh;687&%{#2fG3GWs^lDc4%7rel9B?)Luqo8L;qecq5n z{SU(!(Xs7cyVygh1FZhFo&P-}{U6bZ|K!z2R@7%;XO#MlJzu5?9w1<5e8V=X={QoZ zWfail4A2A1abv1~_q0gsdgT24Z+ER5v?#|tk{sLNcC}~CuRSi(>$T=7#FKQtb9rpl zxgUx|$b0wRQhQa{(R$k8wVXJXW(1eq%6$IvGw5mwGuo)4vX*k6sFgwNZ{=WjF|roKj2pMLc@$_NN9T_eKymT#f2q3n{6I@+ zYBb4+DIea`yTD7w9x;iX>h!?dsK^ek{tTTqLG=`6{qF>dN4u4)2L9P1U+Lrcilx-Z z@Cd`ftk0lV7S-8EgViePr-O%?LRnodlcO=6lil4;0uSUrX)JeJEe#V{h3ou#9*2kF zrAe6whZvmB#|=jNexcQS(80$>m=ZD~h)Vhsa=II|!vAL%G@%F=| zd>f7ds+VOgi?!`P^W`(vYb%G_+DzpgaXOrp1uX-KI5U_FjumC}R~er$gBgD8KK|@o za8WvIEj(^{-;Q|VSL%|nX&<88KFP6r>1yU&j>9?ttX}R`^!>c}+y`yr$67x#nj7bVw#}HW36iEoN=7eToQm0@mOTD9TE+=1Ai`9{Le8 z%B}N=*Qxt!z7}~B3Xy;cbqK=)N)b9-omRmoD+)f2ia`nSuZa@F-s8Xivdq`^>fAwb zJ=vIxRmsK0B4jzo*wk0mjJQsb@j(WQP*9$j!nE}C-}VsB|F|5^bD6YtK^9*N3;qSV z|NeaUSHgzn0Tg0^#lclrjOgT4OQh350o5oKNrN87K89OU#yzgzSm{N#dg8x@Nr&6V z=k`aTq^{2Gut^kwUAN#tq|Ed);>+gye{yL;sEESrVwa2Z;q61xN;`dBLN2B6nNKOZ08Ts#c8jo^{tPD5bWLdY;vwM_q*-yt@ovt^) z@S{g#{oL0`3+hMaQ>FTfR7;zs^5>b0OjmoNUZ>w? z#|(9CoXg7FoK)<)Eqi?v4V>tLP*aVY(k*5tmIjtNmh+xy(+UC&o1#J!2(i$xRV*jV zk*~&v0w~W?8?5w4R>+u%%^W8Z4I>R+(K(|WIPo!$O9>MMpLaUdQqxli(qd4v;!=|{ zAHe!*-o%}Z{J{ZUN4e1<`tjzmw6f)+&%IeprI$cbQg6|J`ry=#7rnJITWnxdoZuc) zudRTE^ms$`1WtmY-JL!uinN~J22xEj+5JDD>$DIZI$_gB{4%M; z28@}>)5d)1DKonK+2fL2EmmG#R*ysCFix>}Tzm^qFonnx&?Ua-IxN!al>LgcEZ+4M zGx^F9Y*btH+oU0q(#>%`X;8rWW~ybwhb>AJgNlvvD&tRJUfwT{2_t`owV$h>2R=kX zM;ejO$2NZP^=rm7-L`TE)v)H~h3I4cCtg3nGopkR&|06lq2w@vtHUb&8t4~qwEmkV z+R!ju1eN<_r!q~MipY0WzgX!I4k|;NHRZ=laGbXbWI&X6;JTzA4cm9n7xhx94)Ibo z6rpdVEJa^atB}J~0c;Up494O#q|4%tXPr)F%I#*xGqhD05)}%yM=&LPE$daAF<*&4 zHgV+(8O+wI^T5yVBU0|vco$Be15A%oe`*D9GAX_ey5Fo_escw=YOUi>v)h`+Z^nc2KE*jh2gNKrm*)AGv25;g1gTiRge(P zfNRTktTMC--y4*^ZNvw~4;b_eQHDQkzVCL~!NAmya<#HCG`D$n@M_?kTpp+vULHoj zP<_rSeY1b>0f?+#!{@F7e$hqgiVxi!#_d z%`{bpjQbCoReNtnzV+V=3^%3Ep#OwcxkKyyza&=l+)lk>XY}+lm`-l02=3RXB zlkZ~yx!AmCc2HFdawjZ_U-IDlEzdUDEk=tr=}RFcvI&E@PQ1l~IwDQ6*%us|2QKP8 zS&*f!Kg@-(X%}sn6)QbGyn*3A%MOhOQ6J2g97;_vRi^#BK)_<9E^IYjuCS~4s`S1$ zz^p~$A*E%LA`K~u@*Mq2DAoX*6rj9H3i=K2w;ffFC} zC^NW#O?6Y~ffILP5-G|Up`n}^Aor`+ogbkv>yGcQ-d`-*2VjWE-)3CCQuC*;L?gPId7IuE~vWX>=_g?@nF)b7q|h`7T{k zDR+AjZS*sWza*VtS6#_h@L9Ir+@yDYA|Q-k;MP=`50(tY|3Pg?8;29s$jNdbJ0^N( zuw$Heu#tjAe2%Uz&o{3k&5F+7a{H$kc+$wmf%jCn#&rctIJMLH6OSQoT|%{xR5X~O z_0eqoV@s(hQPfy! zGVTG0mBp?OZ=u7;GDYUquH#YP!{q~(=q(Jy^Vn^*V=hT@h(GoZ7c9cBCN$L9B+i*` z^*K4dIYkG>3)l;*?i84YSR@kk%WQ8PEgy3Z4&B#^eZ1GB>Cf9z+*o*S(m3i|uZ);d z3`4En4y7HZl9;Uj9EwrDGd(S&2)A?HrQX3lNFG;CO2FOmhaRltZ zQ9LT^uoj#Jh`6BZNH^aZAAEyZ+uFHAe()9eHcj#zFr&{}ZlDQTk~vYPoiQ?vUIdU?5tz zI`s%GyOG?-(}?!bEU|r-5Egya^o^;mAhUQwm8B3uI~ThD8DqR&K222=z!p`ftE@Nu za!{=M29xYjgI-VTT-(12bm;XmhYY;{t?hQ~o(p1FdR^lg098lA~* zVkNYh@REUC$uj#57VxG-<|f+MpdJnH#z{rh)EjPx!op;#X|h_{x zQ7;;|aCevO8l&wB`#{=&2m2 zj7XH>oGDw{{VuKGeJK%oefpTI{LxaTc9f5nxJ0Ev^FZ19@hdXeg!<2TGljm|gpzCq z$KYy`$(PlZy{+4M%dNLm#@3-}Kf+y`^%0>_DOKylPn zG;vnVBYh8bS2`ZQAsAhCKK}Ooy%<4RaP5ulkCE_H8{p63F!H5dOLmb$R1}W}oviFKfHyh@G`~n=(1RrNAEet|YxJ)P7{bb*mKNh& z$mDlj5*zvcxOazW(fYenVEg1AWFqZRM+%K0Tr=V>)b;=R4SjdJ-sd#dOdW1<4-Tz+ zOH-XTi&15v%V{cuO>Nx_%pK}V(`Wb21x>JHLdRO(PXd1XnX!?oP0S zbUgZx0ACpxlwDqhllrN-;1EKG^#wR7;s$q7@$Jab#N61@Yi}mJfvL~lCbJ>LH?0M) zO-|!CeVO5oGwW;k4Pm1xsxIeibFpqD%!k?cdzjIo;&-R|7d9iKi;@$oHdDQvR)b19jgAtP3v1bL*VfwgRw=;xJ|F3V6yKhm z%Pf2yR1bau6T$EtlWPh8$r!g5r?!XJ6eiP!-_c1zJZPQ>h z=A5RJsl4O&puV}J=g%M4m}WF6TNQL$PQ5jU((+C!-Fp9hIIGtXQfhS@?{(CpN7)!fKxB-F^yJ1iA9bofABI=Qw~j)JVe1j@9Bm#T|oV8MEgZicS{6v zv-=Xi8)ZcaLF-P_$tA@}QsB8Zl6<(h!GLEbX&ob$0uK3*@fYAOuC8iZi}%(a(&FrP ze~Ca>S~5lRA~Yj796s%Pb|;DKs?c(3Zu8^zSbE``im`FaZoW%SY2C8w`eY?fcAM{B z@yY?G6CE*m#*?zshHl+LD~+`ceSX_~I)#5XgAQW1TLx+Md1~P!V!!XIHo7ZEUb)TK7&?UM#S<#D~ixqlye6f-epE zU>FL-MonG!a1$%Qk5jsyuGuk))*d;^nm0rO`OLH< z$dX?_@N+8m?CEBT0(vtgmp-b2AZbkCdylT;>9r`@zr{c?FLeoBtcb|^aX}ciYb)SM-$w4#-wSoo#S`itp z=-HTa@VBhz1gNdt4c=4K9F%)nqv$T_8mKxxyJa5z{)v6kI-rlHRyjyGEPh`R9E??T zG~*O_0RX6ZP7X_(h~qPI9v9o!BcA4^#6XS|UN@O0KRi3!3RlfgJX;}--8Vm>P?6jz zM%eD&K?RpWX(kWLaQS*3Cl%Z}34dgDZ(n8t9#JKC7Mhq6bQPc-V=A(feph~>_BF2_DDj7wy7BS4j8Tt@^4)*Vq1_r(Zhv%b1hyB zX11hPi{kJX-*Sj5alaV1UkB8E7)ex0(BZlmT+B^ZDN!+3kNOR5Dk{u`_eJLOT-^6I zKpNiCa{0mON-iW%Wv0`p+mXA}ktIfU-hA>_x%VwTGE5I0N0Ff1Dkj!>xYx@{;y~uK z?kJxpX{n2HcvG|DiWzGqBkH>Rz^-PrL!iBrFO9A$!@%7bKN3mGl5?=ea-1qP8#6{V zi=n`<>er}1p6PMSiA(6cy=s+`l3e&?3fILR;BSD){v}8b zk#^MZSh0+#{%WF*q76Xw(gfvDMB}}$me}bC4%oC@s~KQ&JtxFm1gA{)z}YMf?@)py zyHp(j;MwZ=R$#Q-aOcERog}nu4=LA9A5`;MX=r-^bQ2k-+hq74R~^%?BFu{Wjhj(6 zsef(A^_=iXi$b4`)6~3k7k6VW@jKwu`V)XHyiaLZb+E1hIMjW-x^*ugO8{4YUaz6gIU0`HqJp>Zv^3`-r z{nzZm34@vgx11Q|34$U?$l$2589;Oz_q_EjzoXHbLf=O45KaB)F(nmBHn=Ozmtl&I zlz#o|o#06&Y8%z=H7%VUoGV@G?EMUlb=PJfw2f0R6bvO5e!1BA08FU`nVXG6`dDUW zPyAu{ovKwR4eMK7IsTSjtS-XBjy^n| z4648$5m3w=&D_8BHbf9;l+qCuE*NnylKB02Xy$oAwYNcZV05YA8r`ryzxNnO zV(-QS9ps>35SPSEhm;lbKq1laao&z&I2u)~b=R4H1LT>Bsa)zlR7$~vzKXf8*SXMR zeo081hub#04efZE@4V;^)@9g1yWyTar1ob2y16(zRlXa3$3yEaXf?ugd=3q4yi49_ zVlBr|Geo~jnmxqu*=IFiZ*Pw+ZgKFjRs|W0PSJ2MNLst^&l;iH4On(SW-1Z}6*&ht z&vOv-cG#!0m7-xT-!bO zttWAy%$WCr5$%v@qkBHD<4uCc#BI0|47@| zbRVu+Y)cUGrEn`}RT-}a5IrBY0h7G(BNW-^U{w49)r`4YX`K=5?i>Fu<(OlFBBUn< zGVmkY!TihHcoe*7e0WV@d}Z=+5TWY6>9DPcBOwzId@`7vt*Y3jcxDls-6K|ur1x7P z4i3;XvK!bmq2HnHVb@}VW9{)vExUhmYps_ArGu1BT0jR*PQCc*5#3)UL!V8~rDC#? zO?&_`t>a~-J$bGaYixO8;!)+&C?zrwMUO@f*X6zq&kN6IrEi3E1@JS_c|~UY%rq=| zskjb>0X({LXWeU+S1{gqr8S6zKmmK#$3X-==hXojZ-LbV9pz|y;;=ROCj}<@7_gj| zJYD0Jv|D~1=JMFft#*vloUkci?$NB`WXyy^o#1}8iAF{e&T*xVqnV_9wvDj59&D>T z*XbJ^oPYIJR^i=#1?E$1)DA&^?J-L$?c$X(0Qd2Y{hCRJid+}1sPi&nH# zzpqaO5$%@aZYmybUx+^)Z`>fN(K8V~uJ&Z5q;as@M{1Szrzw9Qz?`E_Od8w?X3%Si zeN3L%{S}qLY5P9UCroOw(kaUR;AH+$s@e9`Q2CAmtB_-5dFS3gD$82qo>M(S+Up@V z^O8!TSQa_|>&oNvN{V)qeMs&uf;c=L`>~Z@?RJK`R6aD7YGIlh(4wTx6T+KnO8YLe z-5n2QFxRw>evG#ff4qhR*g(jgt5V7j2tC>u!zbc?axuqQD8|seCX!ld{%A;f50&2J z?6DhVOf4FxLk~lgwMF-r_seX%g-IDcgwN4g;e6wBys)2yDL{8|@KJVq%_rhe8)jI{cye`WF#GEeTK)ZoMz%r|=nuQ|Zz6CYmf17SS7(3y{uvMs-Yt==q(>0P zFZp)cPcv%{(yaClNRMT?35$1Ls!;bI%0K55CJ`z!#epCA$n^GHn=A*NZU~^465Kmr z?wvM1uCG##pYwQ8btv>2GlEeW+D5_C{lVkxn0xJ~X)acmJ!=;bRcOzKaJ^fjC%kpH z1?$nVutfPwn%da5BjYVD!#{aQ77?>$!~pzFlqM)YYkZe`dwuC4J2*W*$+Xp~DLKmC z3v*_sVt+oN^|=s4?UjRofcP%J>72OxWc2|8!Wa0V3hn*WB=Ub=@jkm{dp`r=30ceY zeh0+M_mfZWhwG33{l+i<=fx^+{w~k}+L{@>xA!~AN7h-+RIXhId^nddvAw9NxsaO1 zgnco~4AGJ2nf>iW*GA8Pm_+(z=VK_gOi)vm9h5eW@GHmb;DbxH2NrLy+y#82Cy&!| zEDHk*vt;WFW5{&JN~i@Z8HvJ87zVVfldXNx_asONZ>akXPSfLd%VOkrCKAQkpumlC zfa{fd@tkRY(AaSkw3}0&^qa#4y(=GWN*lTleMXx|(u=^=MrZ0rWVpl83A4A9kyt#J zwy|*o=9Gf|AYS_5A!FEkUg3}4Lq7dM&|=WfNx&L!{i@gL)2HiB2;VHisHE-0@}^{a z`D~R<_WY`B2yyw=e4pABywCUVZ_iw64_5grVf=5U;)BgM2NOMRag`7gJTHl{OB z+~;xrfKR8nEa$N`h2vd5domf}0(QCLWpppN`7|qEW?RQL7(3j>_@#kUqWY)Z*U++i z>uN;sPqQM^mlfnqbJp0*tfM`%j@RR9j)&{bEtU_NFmT*g@oujamdmj-w3tri6ghXm zn&6u>jQNVX;54QD>DPrDn2Q{Pnq=2_?Y85MmR87Sbl(bv;IGZdcwDt+!h(U>j#KK2 zK4VCJC7$N4lfECkU=T8wCvtC#J~m%!hjY&o`6wlcaj74Jz_9S}Ow7d*4(_LB-cB?P zl!ay{+Z8LrZMQ@{kDFtjjzmBsKR>C+hRbLU2hRhm&TW3zTl?+TZO18}a)bf7`t5$4 z42n#9fC_ATuG7U|nbBPi#WhdwYFYq;QoyR=M%Jo;Q*yS=d!#FWFnSWn3jXU1o$2uT#r66^< zxwPh#FVNR=xz^MhUbAedaJfrYAm#*EbS&AW-L`VKky%~bS4pc`1`F9qzkcI}P*%OX zkZ*D$r+40+dw#Z){lij0xoN=H66urV1_vTI*mt2yI%05sFM>@*>3A6LwrG##a<6Ux zevh_JawxJ9i07l6*c4X8jAtVKBR|7k?wp93K(i2Z?|eKxD@?EcYpwiZZ@`eb4|VZ% zCh33#q8$>83C$?6k3uihR;P(1kovvWeY9yZH~4J<9Pg~>`Sg7MD1A5^mW16T6p*aF z#j#BwWYt|B4@Sc}_x`EiR}r10e-8&JBGKtx#A-3r73$9V436g@ln>ANLzBh4zpxZ& z?Rc17hS$5++-z^6V=%6N2y3nT)a7kD5EyY?qaBZAb$11(UXrT`7r)*cmTOIMIpjnw z-2ZeBb$cDX;w`*9!SI!a^1MGF*cA`B+DSLMUZdpJVy}i72>_)EkVtfHD}fB9y3(3H zB)Kr{dYj4->RzwEqf~h+#N8&uSmH?VKX+e$meeA`UfWb!57)hAUtio?iE{>Fd5jw} zEa55kjC8rK!e<9(_n=L|!?gFnAHqv_Q>S^F$$SxtYi-(Tm;{kF%;{hdXBM9>vTlmD z;|TsLk0GRq)Be)BN7~)uh>x<8e>B&ZS>t46$EtbP`kOzgk(!cDaeP&MqIvG+#qHK$ zF8_fr?fBG1-?F0($<21UPBg<5SLC!Je$rE2TW5dN)S2Fc*bMdTFKOu{j0C z$f1QtiU36-v^4$kXv>WRS2jT@IiT^=Ga0CVQ)sUz4yhqKbTqZ!wRUP){&VGXdgmw` z!(!kaILbDU_~39L;1sJualTffm{orIODexSX6VNbMp%IeFlNx0vy6sTvTVLm^G_X% z_>3DwdmeEYw`9pDiP0^tQey_7nEUvTga!6Rj4UdBz_^@6@~ksI*DIiNH#Aa{K!*B+ z!PQz`!!&kr7uL`Lb8$&ZS#je+=^2hsW0O1HjWX7zyPkvmy_t?9c4vQo`E;$u_7`5m zE>%;~gKRf{m}kQ8V@mP@^^B0^O=0hFEw142gXxvSbX8e6sZ11cY<(QLZ)rcf#t}+Y z##-LN24+hrP2yVQY|Gkq+SaWpZ)+j8G9)m|*~;P#4QCq_r4N)YmleMnGlqES%^vO< zjXn@HusQ8ov3tz;p$(ZaTs7(FN=n{0Y8ERY-yW_k^+eJ?R*=~Q9A}`j8M2o~#27r_ zRuHYu70ton%!%mKZ=$oX(X(2)y4!4K?vn+J5Y z8s$b+0`7lzIJgV{;cygp7KZDL|#Uxc`^JO!Y zjVPZBP1e(MJ-~KOE<_CJr6vq=bWSeI(Fv5ay?CK*Wo#LsZgObe^3cxTjxEZ;U0?0t ze>y_@R{Z!cOM=19SrW2Maod{3bPE4C#-uTZv2x2Hg*Nj;wCw2@goua>BH>d>ssiQh zc{NzRmHRL=JSJ9J-rLdDoz+GiagELui8`LQUOzN5$_WI$_RHI=1)Lsr+UXnLCd6f- z5;>~HKm>mY;lZWuk{$1$F)~U2U80SE8v2AeWI}v5`rqP?FP%32eKXd3U8H}TP|3>2 zAlP(`Y!Uxuu6yk?Y#dA&If8#!A0*i0qQM$SU z2fq`iH31Gw5~kGQhrWsnk@@%>3JS-`pw%=i0*ermB5QO4Ya91pkz`^;#GD>0g_f4Z z7h&1p@oP3mx1R%e-14+IHvUrGzX8#})oc&p)cx~X6m@bESOC+I@e+5P3Nw?g*-hn2 znU`r>6`q#v@(1EvB($GH9or)DYul(%e}n)>D&;l{k;)Y@j~n>W4{eM=Bw zJ)h3^cATi2Mu`HLU(_u5^5}t?G1`Bn~K_*W}bXc_M0TnRP8#;QTBM6ev&1f{go9+LzL_Q&ty05>k z*AzAr6SMJpiYc4I{*~c4(q>`oSSXF{fax3W{V)HeGud?=xM*w(t*Ui>EHg7+pG1cI z94ngwnb-I_9zLCt%>}pTiZpq>4g(`v%-7D-;XJgYpN5~$MDElfZ6by-hB0q^QoLa9 zag0gX>Q*oRDbD7s)7Uaqa8Xkmh8Z01fyChtpB8N-XOHOTg2WIwwSM;=XW2Bwq})W6 z37l}XH zEou3DpjRc(lnIi`U-P{G6gs#y_N*#4zx(TnQ~2(VctwScabwfq@Yx4G^ZeNvt6bOW zXl-ZfI>;jpUw^VnWaP4AcUy;v{$}^d2vm{JT;;;xntvDB{?<0S(pnX3ISXK0ONZpH zFH);&6`>ID1TRI-4tUZRI-d0UDd($QHLjR!3n3yFsX;=lkF8?VVQQ~R!{*hzwPzU% zTmi$^n(waXmP5W1vXwen>~-zhX12Mt+)U!+YuzYHtH1#F?k5*Jghx8%$_{eg6t?OK zWG2q^*fKI~I}1l%J2oChw!xhENEvVCQRTQCKD*92+hN7JBU7RR-_I;1=bU9Nr?~jO z;A7TE_B=YCQJN0!YbRstw%sX|P37hBwYl=#tVFf|Ypz`JZz(@g+SoDUL`->k@i&XW zbqa`6vspO=KhE6x!Q-|w<-2&Hq52ZeQgdbd@z;2g2nkY}iJ7&*Me*|D2Z)YOo}Zq% zX|!o$ryr0vT>*w1!HzB2zN#?Zgy{N?TnHCiYrh^y8vf+|7tCdQ6cDURx6c!T78Yy;k^Z#~^ zS4daD%Z*R;g;Q2)|2oLh;pD3DqM}S+H`Gz<$M@$=amTaeRdU#z{h&gweU2@~?dN$P z-t{fdVmDzkDbCi{yUI<{py1$+YvNQ?3z|brR5zrkb5&2iMDs9N`!)%JmEP z-6{3Po9n0!DLgMA{dNDU%%87(|0SL3(oC^KZ~sU8e|&e*`olf+L3I}bJv@&Jjj8(~EER`xH2E0!sn6WrUk zZJPV>v?AR*p`78A@Gb3)!gim>*`H?7332B_zFGw#Zp?-+?5Y_Wx&ythOda&oC+E)b zgGMaoZz#9qR~$-#CwPFr}4!w_~b7#I)IcWWSpy;F5p z0^?62MIY{IK*;flepKT%(l$6evRwX%G_EDN0F`Te@=1W|*!X5C8NbO+V zH~_b*@Y>odH{ETm*2HYenDXDSYFo^>RK|U9%Jo5O#R9iQK8ljYE@|*tsY2~kXB?KE z{##-y$flv8*|-Kl1)SNXZ(Su&OKVh`4N035Ph@V7(c?IQgW0>TaicxtK2~Fl%*@@N zkGm~Vg0t#BXHb$2UBw?O_n2#b-Pz>AkQau5dy@3ltp!3Qr@4a$a$V&YPSw zmt9_rR(c*Hjo7X5^>`@**!8AwC73$Ba5p6L{q+we`y4iUxJ-lL!5|jafpuJ>;S~V; zZKrQ!g+!cIDsHP*P0{%okEgEw6Y?He5M_Jzxn~@26uL!f?7$h_t;%a1Qg)Kl$6OdI zPrs)>zZ~){Ci}7V3-MJj%Nmr;C}7&3EN@30T-&keGjI&|+DIIa zZ<-xfA$+TI{tU=bh&N>N+o0_$K4#G8*ej{ zO__XA8WOp`|3G=~8C6cUJoo~RElN73#MxHc7;J0qCQ+Gmb`(UFT)T?6j^2YtS`)?2 zQGe&2K0c~-WyxxDR2+5Wxyp^7ha+?GXJ6;hp8@pjqbz1;7r=I*AF#yPD28*zre+Eu zg&vmHEL^=qjfo~CWr*n}`xWwHza~I~eD^VIdUKr1XtpMzY!1eju^5=wvlIC_X;kBu z6czY19ER|Fmf$gI50nsn`qXpH{$zSZ>)oND2s+W)c!e|?^km`$Fd{BQB;o7~z^ctYe5ZvzUx)6ifrfNARmjteb@C?MKN`E>wiHHkH|)5{~dk)xH=tm_9|R?Dtt=SI;0> zperzX27zLD0gn%GzqN&D?MRMBSq}f=HA`8jK;9$BNTeQ;V!tjQp_8qYP@+HZj^jDK zAQX-kkQlILi&gRaqUu*`9~gVk0~WrGdhH_NEyip0x_(s6OuUV8r9PcYjc zz+Xy6$%&W4zP8SSW-3|jR0%B`DFJUhm49fdoGLS(CVVdsLzf6jUTx}YR`P7P%VpSp zvIK2SWwzGQ3+W!+f)fVO$FDW(7Y6<=d=rak{Tr8Y`YGSoD4j^B3CIUkIHR^8@dvbL zzZXS&usr9h<^L882)?;I@*k(gum5pYO~xDMX}qUOklm|0(5Pc`)Xqg&Bmw9!pU%6S zIB=MS@MR8MY->@MHKR-jsZd~x)=Qvvbv)cUGJllYoLsFb z`w*U6GTU2I<}uN=3ZGXENnBW}E`6kgC)8F;-n4iWBk3T#tk$LjfWx7!|E1pH(NMry ziAc-DR8|zaX+}dJJzs(M(_(#Pm0O=oX+Z@z-Kn@cH9ynV9LY>txD8yb3s5=4VqPNI z6#>X4s$N}`@)R5db#IxD8@I4J*VZ4fdTu^Lm9ImT-tz29WaBo`_uB@g%>%B9xfr42G&T`jBDFGlM_tT$xWDUQ(VI_WnBm@U7$woCFS$GeKia=UM$w2ggnd)YfQAEq}39Zr^6 z^hV(H&R8BQ+4RP>p>b<2vmfea#J@a~GZt3v>GlVO>c1b<4IoumR z?@cS0DyMyIH6)rziGHp@{NS4U z-8SG{5xVNVvy({o>b=GkoJCTv$rZn{-F!lPI^ngWb1>BdoIW3^JLk`rAUwGNU)^01 zh0ds>9xgcsFZhhZ9$>Xsw$_<64Nr#(|}USt0# za7sw|)M}OJXgJ#T9b}A&cYU7I1j?Dq?I*rZ)Ei{s4`j z;hB}K1>D+P|9B76Vx{*qwbL}mS(Wt8K2Fubl!QsyezA(#+P2eOZQEWbSCw|oC%(S$ zqP!s$AOdz2t049nb%3Wxcpee5TO*G_5eOG)wTD~b9~E`mf{xds6x|CB_iAjsihc;U z`6|%(yf*I-DF?_Kr>*ijZ}gU{GQsGtuheudw+u{yQdr!*D`|@kduhxJFK<`X?QRXX zvbbU1F8q|}-Im-INYgng~2GQIVd@%y$#vJ`(;UE9Jh zg}4lZ;yv!jY;~uCCZ(!wvT;tyx14;fiDRO?zY=xs#O)ddv&QWBw2lClkITd2Rl3kG zDe`exe2*2Ytga^^#NNft{B@Ylf4JXpC5Mqn)nL+Z>Z?43m3w8Yu$^k!qf1-vu`rE^#lcn!Suxin ztJV4v1eQB(rX5+z{J0tUS=W#l&wE|0#N}r+w(i4VCU0v~-GZPtxATVi0Nb1$V}?76 z!m>Ba^-=h@u9|CdNoU|KxS=P$VS_?4Gfjnb%XX>yRy5v)fyq(Dwqq(7HP~@7isWX) zIjMZx&ak=R2{F)l5S3dc+jP58a3secCR}nlS5r9sbme;6j_ypy#8U}c4&A9FGD(vz zF))Zsf2G;SQ}5XBeBYrA88aor8uQ`TNTFInYF6Q6sO%GayBoVoU=y^$E= z0)DaDiAU!=ugVP)37$Cdd#73KDBOotx)`mMdIy-5p`oT6jc((b6l)$uptX~IF@>bS z#C84>nj9N|G!7Tv!zD_8|81A}1wM~b5AzQiV>rps znu<>?LM@N?oa=uw%&^j}7khOzVhll6*mB6$YT&cdt90K(PHP*}kwk%JZw?a;jml=d znXQINLLONJ^GJnK@7@%npMn@A)VcQTOIYIudzl8qUXsjDK?J3C&Nc}MH!gxp`i4|u zl{81t#htN40zKc#rOE}#DK8g_JI2KVVGvgqCzb^z0hGzO;VMtBJmf+?i|li9wnod# zfh9=ZZMN=Lx7Vu5cv~W;+|?r>peO4hb4r|43AwCRUAIpLKvi*=aJBXBuQ39uM-m!) zRFU$rKf$jtzm)reUmsiiW8jv` zorv35`OW30lFiD4s}9)=f9D8h_J||po!Ym3F|H0#S8r8EhjvGm#kUvF^6M@VOBG7> z9IKf?EmdkYz)Uuw&@RBuc2-He?k)@s0$WBSOoGl2iMDgl!fdjNWtjS`XJ~VVvsAnNU;i!1J^Rd>x7GqW zyOp9eN^$%0t&iM5aFk2I-kyHb`}nY=+OATj!<=H^-pwAB`Rtz9NReS&lxG+Ucb-2B z1vQI^rc|XNTau?#tRT^5psJI|8mQ7qYFW@CXesU!k5`YG1(l{?gglqE!zcJ^m*v*1T*`4>8?P zGsy-vu6M&>=2ign%!;GKbETBB%vA1ax=(86+ZI2^Uo{mPGKDmLmrBvjw1F@kFheNz z)7+746%aiy%JG$8$(f%;^F;YtiCPq<%8N>#xo_M`B0%I6)uF-JMumaLsPk@3saWXf z(NJ%S(ju8I8 z=Vhi(`;q@;7`_u#$neLvja{ct~>->G%Z zS!b`c*V@ms_9nI_Z4En0_D{0Vwb@RE>#a(;%EOvaEHj##(hBlO?{$VDViqyp(~hNI zHS+Q~0nUnkSx?4V3uhZzb>VAmy(8_9#6#1w`VSvdP&umB>YSr2p{nC*xxA?&d!(tk z4tE~g4WImpJmxD)mzQrNi=q^Kw1v#@>6O`jrZ&4iFEco#YT#+AGyFb-QDb)>*N09t zu){$#KEFeNx-st)%*>(6Ewe=u3FQaT#u*`KAVX5huDN2@=0+PEyHC9E290le84&vL z+!@;9nvnmR!Z_P;LP{Jxt}*-!{>6z3yz2Qo+X+GnuL!U(4&sR4ng?}cIxTO4TG|lO zDQ*AwxIC$;u~_SI!N2`uvgy?r28oRECpaewV6Ir3`yM`51l2|5!t3frdA;eM{`vKA zM<2~|iFpRon-qF8v<#JbD|G5ZKaxKil>ot~viO5yqJcQ9g8aNs;$B^LXsZ6y>5ULB zs#V+36-MF8wlLqzQ?C-SQ|yz>41vHr_X&7dJl9Rb-K#EWelDQdAymN z9-BlVlOYxHk05sD!?n>VUbP#B&^dE%MyVHc-|3%K!Fk3RXZ3^5z*H}b-o}TcSy?&z z5@8eE6K!!8-_q$tsOxAM2_Y^Yk zrR7eyA~@1>9aL=wYz{XUkD3wqM>dXaHe&WwJjk)Hx-D&;osZk)o&>I*rl=SP`1=SV z_~J^2>oi6=U!;)q#WSwY>pX&Gk4$K2b&XekpA(Jo$#hP~%LRdHzK~Z;*FeT0hqUIS zAKoVw+bnG5c8kJxj|@WFqH&r8Z_k3yxA1*^g?u)=^Nja8gE#7>ni^j#r(kkv+{R12 zLRa^D>h@~uJA(8Z`S4{+57i019)`Ik!CeUcYy9`Yt^ii>bg!p1BXELj@&~-{MM3jN|6enm;Vf&eo&D^(!mf)Xt=Iyv#PCyi@AI!nUJ7vcF z9Z?qTgaL1{))&7a7(fv-=U;C`3MQ@XpPw*No|3pRiYMav^^MCEXcNmKMy76FFu1rn zsKLwFg!O1*xI)<%<~sf}?`YDjAyH&%e6b%NOhZP2nRy8RBw-!imVlK#nF*Ygn*P0z z9!S_RBE2?t;DR1wcC^~R-<+p}CK(Z{gY*4lVZKGRTwFXu0P*vO81V)OJS{kwX}((h z$#^JT*A(yi?AzKP>gbz|z}?Y*e1djGi?tA0Vsq2uGEM6rsUqg-FNv-4D(sGqW!67r%#&lo`)%o%UV>W*A<*xxx=2}iyhy<>U)4n@q8%x$o1 zD+#C^0wjTHLTWD(%J+UQHP>-ja*?a)?sell&u=jM;gI%$8I#ZUT(=L{(vzgslM8;G+P)DX}#QN%2_ zQ;|DB1EA%HZ}K#+*IwQvvZ%666n%KJ_0*Vqy;w;fWbwOU@!56`!A35zob22W&yE7* zDm+NU%MIh_JgBf;Fv|bk&Gz+*)js^(of)0O&;s55U@trj1C&adGl{A|~zu*R2u! zAKCf8Phz1|l$4Yq6w=HVcK|JeZ{w}cLhm?u#cY>xtX1TOPZU z-oXhArK+;GkbfZPpU00?YY09ade?&1Pq`9QG>*bBm7GEb%3h=qnVRv?A@@vnmeFxk zyhFcnaCR@*T&M1B^$9W$3s!2Ow85xRKWLG&kQJ$)?S{Ia7c4F^{p5gr-_~B!q#hUNI=vbd8c3TK zM#XQSnkDu)-few|C}KAOQK1of+nBueKr{z8&@neXG4nPRvs}P=qPj(R|14p#Odz*FtH--={E2#VEZq`VO*zhL%PsiJpjSBwoAlyJibq=9mWY)vaOP}(1WS=ajA*;FV`$FL$J0|49e1__ zHE4{j?KqkcHS{F`LFa685i@7wap-j2P+7m>uOR(?gWdAa`eBv2cs5t}!BeHZ<%@6P z=)b(R)RV&_!NIwXu6`tSK*B&SDQGHdXVA)*{i8v6qep|Myz<(H446aGe$+yWyhSQq zpSf>1Qe%aqn3$MRr{8HK&uo>_QkI{zT8rO7B-n2(_1)LCq;khPHFN~^|5R=5_D%gP zBPZ^_1_VF14S^LE&FpPy0`>n*G>WU8Wy-6Z$!vNK0;3hG<*Di-(2*ppHoHQ|a|z)h zmL2s}Z#UrgHl(dj1k5L{H>~iz7<)TfTDtUzKhLenM%V*U5arXJQoDld!i64P%rzYGo7C5PkWTwExhE=rZskbeoJdf z9e`l>iAyt~9tE#khHt8LbcxM(l}`1ja?aQU;#=%1)cZ6(wyQNYdr-v~A_2=n@dk@q z0(jrgmtr4w1c^xE-&o-CV+lQ;-7koCTvUzvY;R9Z3lKwcvHmKW`dzKJJ7W9Rk_@Co zJUY@(FZmCYJZq!BI%`M|MvqT9)YFebPb3dS(iXg)v2_`$g8y9+;;FaP|Gl_LMSNti z2i&#yG;t*|E%Svfx^{tjo9Y(Mg%f)B>US50utdRF0E7&*8|mu)Q+kH)lMrt?Q;Zpi z#f_;UoLG5>O|`CP3zjr2I!a)?bTdUDeC zrze0$Fwwn&j2h#S66~qnm>ce9?VYx4yW0E18*2F|aeh9j#8u0<*qds8Co1b8X+_w@ zJE93!i0_CvrPqFmP2QP7P{h_eP}cg%Cj17oy{7g@QCy5{H~6o63Nm>Bv*cT-eq&gC zBhfPWE4o+GjCsp{HBGPh1<&`&>ZUoU&+2@%llNyGtKucM$P%C^cR_!g~DYz_J7BdEGo$XR8u z=DYH}Oc$a_csQtx1z0BhXUYSdUAGCO%MB2&KisBek)^;ax;HsKx#$axQ@sC4-Rkex zlEY{3g|LeY#EGaLeh!6GxPA&*DdYk^N&7zlwwy>UsPgPTUNZ3S;3xrb=Z!Z8+$gZg z|6gOJ|MtfJ-;<}9i7xA^3Fo?;oSe!^{;SsYMN2k(Kngk)7MHWKvO-Hs3oI(cd>0_& z$a&CZ%zGkly6^lRtmkHHWsk>FI|6|){AM1|nZ&}Tw%E^OSUyi~p73Mnl8QC6ojM)P zP*eAWTjo|o7xgXz`K-Swsdy{0nQX!|%ds1f6PAaeu`W$c9{lHZ3kidGn8HdLudxyA z)kg~K!Nuu;xX14Ni)pG8g_DnDn)DjInSms5m$JaPBJ4~E#dAg?Cix_Ig$Xux88NZ7ksb+ zwA=Lvv%H4?QOd#}EC#(SD|jSMALk?4CJ4tkbTnPgdj(fKA= z!di~J>pugOi_{~D&GY%mF}9j`!<_;~;_)`Cb2&A?-Nic+nev3}(7?o@;NGmLsSFYl z61YR`O%wVGs=e>mb~!KW6WOWwYoX%Uu8n}=_Fzx_^*ZN$4UKB$t*{t6@*nkO2!&Ea zJ(J6_XkwFTvMQwx6+2ir2MvDzkh&d?Pl0DUvolOXnEpSr`Q&S zsF-LNslKTm*~ox=xz3+b2F^P)`1$4fxh2@6W*!lR<(VweAD&SzLC&y6m*|IVPofKbem;Mj#Nod+c1 z)}zxUwkdtuan`mN5zN-D#KSJMF`agvJwJ7Jt}^1~Ry_E(nqb%R{Ko`ThYM5dBnIxw zPD)C07%t%leP3&fr}6dm#Zr`dsJXj8*^WDJe!GGHx@zKt@fDa%^_M3RJ=1Rs#>*qs zX!zE5ex*$GTLLK7%;H4068mXsvHV2urF83-xDV$n|J8vMV+k>TErF;Ad z6x0G_td9fze4rSgWS11>xcDl(7JQftwk$l})GF*GKm0)PR)Vs+1tQfkNqtJl2wjZ0 z6D8bE^l`^b#(P?P4uk3(qLZ1^G#O)%ap`Ik?jSO!hmN*w83ONX_lP9hA!aNmL}6co zA*A^di+3VND=UFtf}b7gjX5I3TguPO&AnRbrO!@RFNQCa4eDeF_z?Gg`0!yIW=TV! zrJ0$L=C4uRYA$n}QYCX1&`ggW-{hZG7hGBCvvVwPUPqa*2|Q0|NNhVr zbq6|O9LFFwUeyOmhp_;IDK$Xc7bV@uI?$5gAMADP;6;w$q=+mVC9;r zAbH`Az&9t+|DvnWYP~T?uIL`%{odfQu9GTtM^jjbo;tf86*uYKOjZ7L9)E^t6P{H< zA}aFatRj0{LI?4H6NRe@or3JGb&;CW=JN+Hoq3Fe0?bR4D?h2SVbIqk(_p|}8YK(; z;v_K_N5<3OZeh_mnL?2%x!{0cBeXR{(o5tAvJvFp+B13>QM6EG(L%qY9RRA)ozKsz zzq0)p_+6Awg{vUu!mOR)+1b0Eo}SH$?V8c%0*}E$C2nqR?ObWo8hhdwq}YS?;ZpeR zj8F#gr=L>0TjdLM*oN+Cm6yS96KG`{bF%@se>o|XI^Lb23RDSDe*HehL7UW$SToR+ zJRb|Hs=_i(H%w#T6s7jx`zX37JzWeJ1qp6ye(XLfv)dW|5$mx%h@e1>*(=xBx7t(q zZ7-813v*Zoyq#+wTKV-QWow3>_>r_KXt4;2LY22=K_KyFdGK(P;6Cb7k9z{8=h%!S zM>2;WR#($&h8{L%2s>NCbx%P4yuSO73T74Zp9?*?1IeBd7BiT3Cy>E(goIbe%eY4) zy#9K-^YgXuluHJfBN!LWg107LrKuMi@ObbZY)#eQSp2=2Ez78u(!2GVQPvV~c?AKf zyK3U@W1EujlJ~%(9jC_?W{+>&;G^-jYwGI?E5Nsa8YXcv)JZE&(Drfc^fOM=Q0x9Y1Ig4sA9YDJTDaw zZlVR(r{Lekjc$m)VZ{ZH`!EGyDv|o0RF6f-t5mtjp(BnA;vNXi$A%TDzhETUdADyW zqMG^>nhWScj%d3O^B0%YVg|%c8f}nW5UKS z`=K~DLCeL4G6z^FmMJ(rm91;ek*==XIc)g9!ycWJ`^j`4LB&Rwd3qJ2;=x0fG=M&^ zjIkC!PEP%Uh9rPJoQq0ek9-*1=i}jF#Ir!41{@0$w5l=n+bOwvppf!l`@o+ASPU8m OM@>mf@teF=#J>PSpdu0g literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-edit-remove-file-rule.png b/windows/security/threat-protection/windows-defender-application-control/images/wdac-wizard-edit-remove-file-rule.png new file mode 100644 index 0000000000000000000000000000000000000000..74cf1a5f45a32b658a2301c6bc313636ff5bfea2 GIT binary patch literal 46086 zcmd42W0WON^etF+m(k^}>N2}*cG*%je3qh3y z8yPFkIdS&cJ2F&8O85s177P#&&<{}&0XZNb5ECFEU^^&~?<-SewO-#}!1i*&{6JMx zI49pHV8(osd_X|8(Xj8j;NR!aHX^F_KtRY2|31K*M))p3K=tXO0(=TCTIZSI8fcOj z!ADLrKL~UEazeuLR8~Uga(@w!{mRpEc7_ZIQwbphVRrKMUFjl$U>140cs07B3Hi}= z>qT*Qd}U|kWM+J|@s$->Pn0SFfd~Z#;>)`LPk)2q%liuvN`RWTFZ90#?*DE)XW2B> zwufTZA^5iZ&rP65>3yx9-k0tC56!JW*HSSqkcKbuq2T{@#;DUpp24tW8)lsnK#KyB zG(k;xClvwb7nRFR<>)}^8Od{8_6phe&~Cg59?TKPKXGqvZUTsp>i3(U zlWeRk0OyK#1pEwvXh1Pp@`oTZ2`V7GqxtT3i^v+BE@Y4>eqj^FfeMa$PDN`fj~JZp zj|nwqlRVX8ulJXW&Dz}&mg?HqArlmKU*t2E^9ueVo}lzBR|nAoHm&GYl21JNz^ zZr-g%?Oq?RrgVVdY4e~|n<^>b`R*lK+@!aM4W`m9OCls(1Oz-{a(O1D|?CgoD$mHnz zw!Tk{kTv7pTKcm-R1nco&6Z?Zr2CdedND_)#EQ!OCd)8a+3p~#gnVx>bnod_dy92= z-ZEdDT7=ytkCErfG_}G%a5Q{;xTixXMr)OxTrnr(rU;xO=RoW|2Z}>0Eog^RpxtWilyo z5vqZ)ofw;Qcq++S#b0PqYBklK)2(%|zM^fWdw*&1GKvjXUomjTV8LE)QrDWRaFh>RTUKzRo?4+iXtK- zLjy8s?Y*$X#mD!Cqj|hP*9Qj!M_!S%Z&<%vA&P$Bm5-o4q-7iEyY<&P4%9mj5aJNa z&z}!R<8x7-S(sD0zMa4HXDm@C6!?hc17U_Pl-V!$YDHb)bB}kpHFpQQFKc!FNYMj= zxx7nXeLB88oc&TejdzMnWs`|eczCICT+lJ|Dax4M4`Uuh%uRr;? zj_gC+mi%YOYLGD1Y;I4e>KbEdlP?O_x60=*n<=duoBlvWemYmcaSbV(<>8?F9a#3I zfoP-x(e$R+vCJV^-@C9!9J~S_Cr~V$jL5Y-S*++dC1p-1A0cokFBA`*fnMxN$=~!N zQ`37Af74&(0ewZFZN@&!rMMh*Wz&^$A-;;7t%a*?j;^Hz$(F-W%o`sX?!a`)gh-%t z!jlVFdRMq>0puj|e>!7qLB`J9Fh#xYmH zt?~N|7LmIWrh1hAa;tG`kM%TaNOs>o42S#i=fyrB_893Rj5#Ohe00!NBIqx zYn@FKGKLEFC1t+CIXRk^jc$vCww9|xEcwe1m5DLw-7r*fo6qOUIu0$f05ebCyU#e3N8xqeW#&-ceo23w#6e0?~$Xv6Q)mHaOIr*KD6*> z(G!24g#1dvnK`3p>0eg-y{2Wq$ny1${!rf&6&jrT@Kd0N5b+Z3hUeIf5GA6mNBy;k z9wgTM9)6Pm7+EC1M|gOS2A3;it+JXp2a{WByyj0qN%-AMm=W(Y{m!*uSyvUh;wHOA z&bj7V;dp7WwD#dohXv3~h(~tBX3~eJK)6<9_NasphH;3(I!L#zpGROa#<{ zD_Sjyt@62zkol8w0)L@)dA*@|JMd86{kUq2f;q)tVG}3FP zBH8)wyR;dc?@^Ey77VTZ;y+M%N84}v4icHverycZ}swTD@7P81$dj> z?k&A+V5w9M@nQA*U;z#fx52f}I*q5@PNJJNDs=3hKM|q->*|x~7>o43-yMOV|9{drY98&r=r$qM{iq$*?%d_|QwW?KpTU%wsY0#3hng$ilG~e%uPtMel6OvPP z86|C?PYnq6OQAa^_*TnyM1Id2aaG%|a*w3%pDhHaO=9{)3xRS7(?1gesd6gH;Bz*y?pQu_pY=WS6W>~oD%Y+h*` zSfYGojeOu(;I0Nleot|T+Ki6$BFy-KH{83P1<*>uSTOU^Y@#fmFN1MaJnhSfZwPsD z_MOe!K-+3>Z?CzO7NjeNaK&1*F~5|6G~0WPpNI}>77Zxn@8KP2fZ&^6zxx6wEzBDh z+Z+%5=jG-IopU%4SsR1d0Wi>QQPg#M`wo^C#H0IRB3Q!uhaFOZ5v=oV=mZv&*uFRF z!$(F#&uVyeuBN@96U}Y6Iz%*qnM)5Ff|1S{4@aro#)Xv{1yt+~?AgCY%+pfxZ_%I9F|YJ!T*Pl4A~KWZeyoYB~&^ z^;FiP3D0Dw3MY%>aJe_jR}vF|`D3X1g+F#77|$!?Tn0=UI8}PCY|>P_She zEOFKI=A)@qndECtdP)W6)}R-flO5Wl`+4ing!j9HylJ%-c^{@P@`cmc0#qL-rJq*msa+w>MYymgu`mDhiEXPTu8KuHQ@W#te7~0@( zll;JwlbRBS+`IbwKVBbdHZ~ov@ESCgov)UJJY=)DSwe6n&^d(LvmJ9+GcAiTAQc>Lde z*MIfOFOweU#W5mcy@NgFt?o@m7*u>nUPB)ZCW6N(tL8arAoffV(4HLMgmKKj{G=$R zY~spO9Ss&pjEA)18cnwhivfR>vfINoji@}IcSb1Ww>Eeskz`DO41jVD$(K2y@b4^h zStvmzg4RI@kum?&n3sdqNn?=nDzkl1QhNX=PI zIFTX=wZD|IS>rou*EgQ`{5MpAtA!mZ@cJ9=i~H z#pKN&2PlB&1pK7}Wu(y6@f?X&#KbRc6(RXBg2nfx9MR&jH`>*#q9l#mZA%?V1R=;) z5qBZu{S_EUhm^D>E+AuL0RxmY^L+h0hKOAl!}m%)=wkXkvnI!kD$(+OTQ~x|^|%!v zYj3;GmmSz01fEN~qdxMLk~0Ybw5bm|=~sVU8{cO0i?3YZBUAI&9?fSrtZY$})KPTR z?uxRcVQvHp?-KS2bQyr7VFzTICnABbx9(AC$UM9#6JbphG33p`m-xrk8h#B~D~h2f ziy=hW0&Wo+s3jBkoQU~VeB9AK53kYsF-BWmQ8!f!!I^AN@9qEx(6J{Az_T(+2% zc5ye4gJVR5>ncLzJ(^U;x1m-(7`B|-tLCBmoei0O$gzgUi@0IO#Usb>4QI6|iWzwM z7j~{~kW5_VmQX zG4Czj>wZC)be_)D*Y({nji?4&{D4Z$EiV>aX$;QIEtEw|{}P77VX?EnXgU-wVGljJlJ!-f> zuh5F>M#Ytso?7#=tx%=3j7K-WwL|^I%;q|kCJZxs%7YEey2n19)~;=YxBC-x zXXQq~c9if;sph98L|{;9%*a&_hvAEhTEnf+Abe#~v^+QUS^3a(6^y9?+#;mY<+JV{giW1y3_>!|HnH1M@ohzIsySFG=? zI?0gaFxccar8nvnmVNqY37tsBkEtfgY{Th$I1%>Dotesh($4X!c@ZO(tBau?S@p3@ zHrDvmxuNO#{d~U{I9$i68@gQe^;ZX9$KtDwf~^onJ(HUD#uq<(L7!PWYR%~m3=Vcike{<4`<0VCf)=VHEZx+Mk9&X1%av^wG3FKRUGT9z z@G2KQq2JrR0~RlF5ZP>@l*;{ibdJq#qyTHWuRlH(uyan&l=lEpyuZp!L;7AAmCZCR z03ich8YIHQlN%=|6pLm>)_l;o$VC{Enaomv06`}BQ+rcGsBcsJ++w@95lKHhI zH2;B45}l3s_IglMIi7N`2#LpZl(Y_zUn)V*t77i=EcgEq-7pQ0K(lShpdR| zZAG9W4?0bz;HO%?`Rygc(Q9i3CHpNQo%LH{l}h8IdI31B$lTnh&NmHNdFlMu|C=M7 zm~Ii;Et?ba{SFUUNvsYVyA@1Nq7G$O{FD|D5$B4MzHd7wLyOI6i1?lTyQ}NsI?(>8 zJ7F|PA#=V=R)UE5b|0SP*TKP2k>oOR4 zb@u2MB1!)y%wui46c!tr#)S5PxF`+~A=kvxx%#{b&?DXqML{C6g){}Re&1+PHc}!K zPt%NVUKX{xa)WV%?G^a#?N5(fM3^WUkZa)NM6`I3x-qQkM>sZ*r|p$X2%=m4TJE=x zbYoNttb$wR%24oUmyv?By?w2A>7ij-Yh>X8486eG#rK^UAm}Up;RN@<0*qR6y^jHc z%1zKn9M{pLD%mgx%&ti8f+_L#ClRm1W+CnDX=*x=wc)Flf{KXW-mwyQd9?1yEX3&K zJJ~IU97a-B@KrX zOT3$b3TJyTYwEUah5U4%YpkY@=C?#c-^+oG*-a&{9?MuazuEnZgC{d*2aJJz$zn(1 zT>_3V=q!00HyuQ*3S0ppd7#Q!ns)c8HOF_}Kircl+?laGWLrzytm5PAhkWAkXbn;K zz3}OC`Yz*&`l0Zv!9$z-``u|Cp;PJ2j_<^5Wn>_+!-3tanehPc7TG>NG)?{GPg=mf znKydYf<#ubrc;3PnoM({rsJ91KyQV2mA{bDnH7GXSn0iEyXhrCd#WrXpYyJ~xL-XJikfa4BSsCqh<_eq*t|8|o4 z2(Xn@rk5DligRJLk;s!>mDXQA`^yBcL3gJiFf^VTcydWdREu&4M0JQ(?v&TVJ8n9h z$7*S(Caja*^i90u8*udS5^e|>47d=!n3FLxUc04CE)BK}+e1nc{KWEq3UK}2RzSNiqq@x7cIoPJz-dM^= z0`yRiHG?^V%>{eQ6N8^nm&wf_H;+0l zGBugbqD!LD=Kf@*xLDocBqAs;%_k`?F3Be?4^A=)7r1_hJvt*u9IH^_SJLJNF3c~o zU_^bO${}U+lTvSK!avoF!fYSGIOW!(E{<5355e@m+4iFBDi%*mOJiqeudS_}*=uNO zVrF6*yvv>K@^nvW_5SkG)YMdgn;w>(UC`7o4i&`@Eii2sQWgjGK}fP>Op92JwAg2F%a%p#3P!wH3gGO9~GtPJLk*CWQStg}4(Bd)0GYx18W8M5Vb z1#K)SI9R4wj>qlMVlta&yElZ?YNvy2)F()(Too`FqQPbu*cvZ|syFxDT~Ka3D;UqHOeGRhNePtkQ*wE`5eA%k+Ia3O*#-k}O(da*j9B;YY`+j+1^ zTPs=08d8j5-<}OMVBLd2LvZ`z5h}n>1myB?swkNn5UvAEC>!WQimqc_HyjfNwmW8* zvoKvgt1g$%S6>w9kde}$^Kw5{hfF8E8KnT$a*J+&oLT@z_L#nY#3`Du=%Vs`-CHRE zK_e?~q$~c<8GWC*N&uZK;Nakdu^}QJKY*+4a=sFLjbK2IrNh8sj6jQ@5y)sM!@V`T zxLaNT&4s~N`_YXtBN1hHYg^Zh4ohiHp$RN4M#=-HnCxdbKffAntNz8A+O8ZB{^Zelh}XlP9DyTN~S#jIdNO9cUj9 zhOoAhBp_O`n38CnhQzMi#o2YaYWyl>pjlLVE`K=AVZDp9T7TFz*%rHaTgJz=N0#tr zxt0>vg%ia5E_A zjMz>|RVj<-h|1~I?PPZX9!LHjptrZTySu*$3JT+SD?rTmDHk_odWTX2>qt~brC)BW zcd)hP9Sbo7K?4pH3sh-ns>YQCi8McAJjr)vZUme$ia#)AzR290E((EG%N~Rusj&|^ zQR9t8#0*M;mkS<{+FM<)#8^VtEbq%4v6<0fr`_SNec6!AA9Y_=m-XcB6B83v9nLo_ zll6|+Iob<2hZ|b%*SMc_v+(eA!T%5hf0xl!BAgC@IsF^GXr&nyMpVki2a74+eB;f+ zsvAt^a%9?@VY^?+f66eOe-AUebvd7k~$bECW(lrZl09)aJonf*%7Ftpz%&ixvY2tcGv=6DNQtf08~@FAdhNnv z(48{-3N7NI`$9&>IbRK3qo6WKiYO~Z;2jaE2%{g|-|htkB|BQi^ZGnAP%x2mo$Kwt za2WLOvx4ZIvWWP6`|mf>MjfFM6rrJ~>kjNTS!q;t%gLM$x5AHX{I z73^ECz3#tRkVNJdBsC6NN|r9?{)KG*F+-EcDUY3zl2Aiy+aJ@cZC|gIp@JPR+tfz; z*P2VIjQB3My4sqfn9UYi95s~Cn*#C{DnIQvP{6o$`CbwD;TA;cjAVkJ(-W^2x5*bG zTno5Wf^TtR&lB{vIB&6fjwggjvY#Y^&jaYTJ!C@%0tpu=b=5c^?(c8VAPs-ClojK0 zz{=4($2LBlOujGdRZj>;&Jie8{gou*BV2@M9=duq=NzA$KhP&Z} zYT&5?ZZJMgK}q|I@DI6w9m4X>4--_(dt9!dww{7OV8}};MbsQA(a{7e85gvN$?z>6 z^~Q(Kq0|dqU*I62MN*Ixi9qwwaN&mqM{ky$nF3~@kc5Okq$&LR6n{)-bm~)(+G*vo z1ft_5U;@o6tk@``c?@fLI@?RT#0hTAx#H)Q(>gk{iDiq!m(C1KrFn$l$s%% zIef{bfzv^pRQ+0g;Y-X2|eG)(@ICQZpd@X_V3vI)d@q%ej3zr&`pm0cx*z4sv}&`yS#3n(G=vCQTz^=Ul0|Ccv*k(? z^wt@lMt@uQW|SCCu}eny(kgY%l(3k;Ofp@*`Bm7*dG3Q{-Acpbt2?eY$E zw{tb{2#vVCsmKDm+}J4&kjSN|8M{&LSy=zc&s|&(IJYcqMag!H2%!b>d1&M1=C&mc z4M0m6Gms##?oD!3XSVK8rNLe$J8F_}V&hgjsySLoh>oK4mwb+|iAvDs!)*{Fc|+{9 zG$D0VCuU9*Q0`0q%$;C_1WfR18`k85Uzd6nvg5{>J+FI^%f!KwO2ctZ^!5t%Y;%sF z_QQd=qEg8~*o)-w2W1Wp((;$f@jh@|v>+qS!Hu|qPP(rsh#e@d+)9U{9#i@U4s9D+ z&-jAWz4_#E>S!e2^?du}bRGe0F=O;w*IIwL)HIa2J|4XrZ-+%~K9-AOlqSn~r3*M& zXWSc(<(zdxx99jOWVixk<*!bf)Xj%Ib$)G&J2}%UJoYu}bGc+T+(qsEZlKetd`hR5 zXuKmjUC?l$y(IL6K2K(#L06oTY}X9VV{S1%f{9od3hj=GRlB>Ec%e6+8~v${1Eprl z!^FdVJq*gDg7GRh^C?NRYP{<*>uc6&QFAc8)S9~I$+r%)WqObA^Z)~MxmLA^UDp2~=wGwYwdYgOs&N2~$ECmEh>;8)@5}v+W!1zqcgkMl~VngnvkP zB;7rfO34FNI?9vjbHjvqk9zM0Qp5;++1yj|mXiSDWbA9|$}5kVBJbOP1LqDWr0UZH zH$wnApyH#!jW`lmFY-y~Zx_o+9!v?rX0un@D*?oR=i3St;RSMds6Y0~2l0NABTaHl z$m0z-gcw2b-(|J;BR}1r`rrA&tZ~yYeo2doipS^onoC7}O@Fy8rJ%<=zfFb1{O4{*W#y0t1YDJebe0Ok#Q${jV81q3Y@n_zm;YbN7ozJiiZHG3S zuaI{~qnn;zK2<7zPH-*FfFAAe?+O)jd=Pjifjnjlup+~e4x(VGr-{f6l=fB3fjjD| z#7b0JnAzMbSsP5ISYi3;iK-l#pqrZ*97QO9KbD+MZyPFBJYRADfVK^=5)m?Vpf*_3 z%VLif6zq*VZ(*Ku(Jw@AYVCQF)P!F8m0HKMv)hGQ(4f*1^Fo23_EuL78iQFfRA&D{ z@C8Y8=DBBNT%+C^-F^?x4;IUfl-nAxG19MtQCtkI-8J&x^6d~bfJP4Plb+la*WYAe zX5_KDcv?GyVeEvwfHs06B8CHEAe3N)aQ08JZQBdAwL>HIh#l40#ajN` zg4Fg3LT(BhJ!TRryF!<{05lZ`Df^FQOP8P0a0&{kGUnFI696U)zga!biQBPUjtx?? zsc1{)4)nknFN~wK{ z(@1BNNK{tzqrY*|puG`2;#MQe?Z`LZO^z1L&(Cx4kcJ&3SL0Fur0QE^)okC}-9;g3 zQ?H8Xsy8_N6)I2w5Rr#5uz*kx0_RA!10LZ*FFkEgQtx3vNL6uQ6%{g$!lBEMmy1w9 zxiRJ|l+*sMYYj$X}HR{9P}WiO-g1(1)FOlZvV*y1sI?} z{`@5uWU#U#LLhdM$=hrmVg{9*Kk7M^;6!r3`0fZ8Am0PYpUp8KAtvs{7ZeZ>V7uvJ z{q}t2n??D?IesmxQUL`G4GjgAx*e0T4DQKy4|lu-$p>rTO+|DO-v*yMsks$P^=5{k z4NqbA#;n?>!qsb$>ne*n{ohqU-suFtLXBIZX>lKT zk7{IO6<|7cBF=BzQL?I?%<9@rcJ~aIe=b*cj{Oj>#$O(si>X0mwXa<|YW0V)FfsY^ zD=I9WE;rE7&<5zghuM4`IV{_-7+#*m{2g;;V=#KP31Ude2{ueMf`g~GAaKNv=z>&9 zvIfYuqYsLgH$tYdQ-f$L`lK<_c)~lOBV}W7u`&}1I_O8}rO4DJbfd`J*|1#75TX)! zGOcKaa&5@>Qr@9XOOLh*aqV{qN7GOEyhP?UZhK`$z48(vEON`Kb8~V+R9Itj5w#(J{u+vpx*`U!oorbSV>Cz{&Ambf372=n{xCv(lI;08`KR4+}Grn zNB>^MO+=9bl~0witE;K4Xkmnk0P40PDn@cra&qFez%Hrk0=PU5MGL-kZP?3!D|ii| z5OFdsl5KdH*cc_ntv&1jzB<`AwHdrSMok+8aUMb&2gO$SRXglzw>k#C$ATD2F_(O= zmIVwEL9B4M(eHeF?mgI9;P@m4^%h)U740VIa^=Y1VB7RGu(uKO9^2zpsX^>F#BWR?Qlu(N?uFw%LUIXf4wyEgy^Rj6^X}!apmYIOSOytNL z=;zw{@mxG*P}ⅅ%Tfxu@tn`synJyv(!uqOhXy@G+V3N?LvSjrO;qOI8LRcPE_lI z&Q9co%i*CzY+I1n;o6ES7`qR*EE$3;|8I1nZZ^P%Dj>Oja!;g`s2k zgoDu8c|Snsa1NJFjzF6XoL{Oiu68sW_DJ{eC7f0wjUpLcznF*8r7!y$LeK-gQ|t#d z7SpX-m)+v2BxQf!$cK_<^St^@uw_YEq;XXycX>$(?>j>m6iAvr<%%vGFk=veJFq9a3R3t5V?z-Hm%yf&X|o4-BG=JSBNTwb4pjb@XnR z&Hc}*tjE7N?N9idx)Ws#Btq%Ka_ z?RtA{Xtk}Ua}00n<*$sVplqS>0Hdv38jM^Q^()!Ad(F+RZR*c1*=XXJyygwv)IgE^2iaXymi!1s%8|LCTK^GqTg3!jO6T2h zx1Xz;jSmCG&WnVfJUQ)VNFfj){~O+j{4bpI|I|3cz={+qo(~o11a>E&`p2j&F#Ncw zQiFvJe|~m>5B?p$XgvUd97+@`qC=}d(fIk==bkG=_Rz^5Vhw!Mty*t1Ha51k26kMf z_Kn^02w;j!OHb~Orb7j|;r4v4nD`_I6xe^lXO}3~YbWOf>$o1ET~5_3-fA7>+-N-Km5aP){kOnMyWIK&6MK)qgA(%T?hb2RzXmDEF?Y zz8FZ7p!Cf6BAYm7`70h!Kn2uiar@!rFE-~@Am`53{Bqa4`S&e})+yVkX<6yv8IwQ# zLYUre_?b5KUq=%zx!#{IHw$U7A1}ls;%M+V&#+v)Y4m1JJ)xmR;o%S8zaEL}zRQI# z!ODR6%8II@yo!p7yu1Ozy8W^jR^r1o_Y;O?gpK?6FVUv6yIBS~QgGs1TMA;gSUM3QUc#@KKoi-Og8x#n7-A&G-$#BU3RA z>$<9YO(-{NJc5h8z|}oHD@4RCis$ObeFJHbcr0|5O;&vZ(ZC;v8I%iiOS3y$S9;AP zmIof$G06{Dt?`7(2 zZ=khk+4L^wQ>1T?*{eK`{g3I*%)){@mdf3t3Q8IVRv=V~iGTT*Hzlwbz{=^#bo7gk z%@p2%FXQ=*nHZS3@Jynrbr`llf9Z>d1Ajmw(1&wmJ|Ax;GF0Cv7kG23>5XMC+cL#= z-zb#hPuMaHTIg@|X2g|0U1}1RnXt}@?*Tob>aXxP^y>C-as4VT)c-Y`P4*=b(FN9$4%oY#YfQ5;Ny?5!RFLvsoejHJU zS{78$L+JH0TdEZ4FTZYG;H{|hdi~kjIXJj0TC9HY<4Hl&n*d#UAg2^q9^bd{VNiZD z2;OwDjfaD}y|C<#yC6lPE~~2Q8wG3Jlpsa0!{(xHr>-eYtE^nwot2fviBe|NM3~BM z<&jbvx*D4vD8q3um|%(uldg%^N~5ZH02(;=(~LBf-~VL{#)3H<(G)%W5drn*iU^uY!f0%@G>Jqivg`9;BV=c#R;H#$gK;!TbM!F0I`P);FQN&A zWfZ@^ARDCk-C2y$w1u^pHb#n!imU5kb*ZuDDAL)JD%^2na$p8QMQL?