From cf4f9cfd7d211e600eb9fff7bdd43ace1aeba1f0 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 3 Oct 2024 07:22:46 -0400 Subject: [PATCH] updates --- ...security-application-and-driver-control.md | 13 ++++++------ ...lication-security-application-isolation.md | 16 ++++++-------- ...vices-protect-your-personal-information.md | 4 ++-- ...-services-protect-your-work-information.md | 14 ++++++------ windows/security/book/identity-protection.md | 2 +- .../book/images/device-encryption.png | Bin 66035 -> 0 bytes windows/security/book/index.md | 14 ++++++------ ...security-encryption-and-data-protection.md | 14 ++++++------ ...rating-system-security-network-security.md | 13 +++++------- ...erating-system-security-system-security.md | 20 ++++++++++-------- 10 files changed, 51 insertions(+), 59 deletions(-) delete mode 100644 windows/security/book/images/device-encryption.png diff --git a/windows/security/book/application-security-application-and-driver-control.md b/windows/security/book/application-security-application-and-driver-control.md index 7a3756047f..3592a7649b 100644 --- a/windows/security/book/application-security-application-and-driver-control.md +++ b/windows/security/book/application-security-application-and-driver-control.md @@ -14,16 +14,15 @@ capabilities to build in security from the ground up to protect against breaches ## Smart App Control -Smart App Control prevents users from running malicious applications on Windows devices by blocking untrusted or unsigned applications. Smart App Control goes beyond previous built-in browser protections by adding another layer of security that is woven directly into the core of the OS at the process level. Using AI, our new Smart App Control only allows processes to run if they are predicted to be safe based on existing and new intelligence updated daily. +Smart App Control prevents users from running malicious applications by blocking untrusted or unsigned applications. Smart App Control goes beyond previous built-in browser protections by adding another layer of security that is woven directly into the core of the OS at the process level. Using AI, Smart App Control only allows processes to run if they're predicted to be safe based on existing and new intelligence updated daily. -Smart App Control builds on top of the same cloud-based AI used in App Control for Business to predict the safety of an application so that users can be confident that their applications are safe and reliable on their new Windows devices. Additionally, Smart App Control blocks unknown script files and macros from the web are blocked, greatly improving security for everyday users. -Smart App Control will ship with new devices with Windows 11, version 22H2 installed. +Smart App Control builds on top of the same cloud-based AI used in App Control for Business to predict the safety of an application so that users can be confident that their applications are safe and reliable on their new Windows devices. Additionally, Smart App Control blocks unknown script files and macros from the web, greatly improving security for everyday users. -We have been making significant improvements to Smart App Control to increase the security, usability, and cloud intelligence response for apps in the Windows ecosystem. Users can get the latest and best experience with Smart App Control by keeping their PC up to date via Windows Update every month. +We've been making significant improvements to Smart App Control to increase the security, usability, and cloud intelligence response for apps in the Windows ecosystem. Users can get the latest and best experience with Smart App Control by keeping their PC up to date via Windows Update every month. -Additionally, evaluation mode will start automatically enabling devices that the cloud AI model predicts will have a good experience with Smart App Control in the coming months, first starting with users in North America and eventually expanding to other regions. Note that enterprise-enrolled devices will still have Smart App Control disabled by default, and we recommend enterprises running line-of-business applications continue to leverage App Control for Business. +Additionally, evaluation mode starts automatically enabling devices that the cloud AI model predicts will have a good experience with Smart App Control in the coming months, first starting with users in North America and eventually expanding to other regions. Note that enterprise-enrolled devices have Smart App Control disabled by default, and we recommend enterprises running line-of-business applications continue to leverage App Control for Business. -Devices running previous versions of Windows 11 will have to be reset with a clean installation of Windows 11, version 22H2 to take advantage of this feature. Smart App Control will be disabled on devices enrolled in enterprise management. We suggest enterprises running line-of-business applications continue to leverage App Control for Business. +Devices running previous versions of Windows 11, version 22H2 must be reset with a clean installation of Windows 11 to take advantage of this feature. :::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** @@ -54,7 +53,7 @@ apps and prevent inadvertent changes to system settings. Users with standard accounts, or those using administrative accounts with UAC enabled, run most programs with limited access rights. This includes the Windows shell and any apps started from the shell, such as Windows Explorer, a web browser, productivity suite, graphics programs, or games. -Some apps require additional permissions and will not work properly (or at all) when running with limited permissions. When an app needs to run with more than standard user rights, UAC allows users to run apps with a "full" administrator token (with administrative groups and privileges) instead of their default user access token. Users continue to operate in the standard user security context while enabling certain executables to run with elevated privileges if needed. +Some apps require more permissions and won't work properly (or at all) when running with limited permissions. When an app needs to run with more than standard user rights, UAC allows users to run apps with a *full* administrator token (with administrative groups and privileges) instead of their default user access token. Users continue to operate in the standard user security context while enabling certain executables to run with elevated privileges if needed. :::image type="content" source="images/uac-settings.png" alt-text="Screenshot of the UAC settings." border="false"::: diff --git a/windows/security/book/application-security-application-isolation.md b/windows/security/book/application-security-application-isolation.md index 31b6e6f27f..114b615745 100644 --- a/windows/security/book/application-security-application-isolation.md +++ b/windows/security/book/application-security-application-isolation.md @@ -55,21 +55,17 @@ Once Windows Sandbox is closed, nothing persists on the device. All the software running applications in isolation](https://techcommunity.microsoft.com/t5/windows-os-platform-blog/windows-sandbox/ba-p/301849) ## Windows Subsystem for Linux (WSL) -Windows Subsystem for Linux (WSL) is a feature of Windows that allows you to run a Linux environment on your Windows machine, without the need for a separate virtual machine or dual booting. WSL is designed to provide a seamless and productive experience for developers who want to use both Windows and Linux at the same time. In Ge, we added 3 networking security features and Intune/MDM integration in WSL on Windows 11 (SV2 and Ge) for Enterprises: -- **Hyper-V Firewall**: This new firewall setting is a network firewall solution that enables filtering of inbound and outbound traffic to/from WSL containers hosted by Windows. -- **DNS Tunneling**: This new networking setting improves compatibility in different networking environments and makes use of virtualization features to obtain DNS information rather than a networking packet. +With Windows Subsystem for Linux (WSL) you can run a Linux environment on your Windows device, without the need for a separate virtual machine or dual booting. WSL is designed to provide a seamless and productive experience for developers who want to use both Windows and Linux at the same time. In Ge, we added 3 networking security features and Intune/MDM integration in WSL on Windows 11 (SV2 and Ge) for Enterprises: -- **Auto proxy**: This new networking setting enforces WSL to use Windows' HTTP proxy information. Turn on when using a proxy on Windows, as it will make that proxy automatically apply to WSL distributions. - -- **Intune/MDM setting in WSL**: Microsoft Defender for Endpoint (MDE) now integrates with WSL, providing the ability to monitor what's running inside of your WSL distros and report them to your online MDE dashboards. +- **Hyper-V Firewall**: This new firewall setting is a network firewall solution that enables filtering of inbound and outbound traffic to/from WSL containers hosted by Windows +- **DNS Tunneling**: This new networking setting improves compatibility in different networking environments and makes use of virtualization features to obtain DNS information rather than a networking packet +- **Auto proxy**: This new networking setting enforces WSL to use Windows' HTTP proxy information. Turn on when using a proxy on Windows, as it will make that proxy automatically apply to WSL distributions +- **Intune/MDM setting in WSL**: Microsoft Defender for Endpoint (MDE) now integrates with WSL, providing the ability to monitor what's running inside of your WSL distros and report them to your online MDE dashboards :::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** + - [Hyper-V Firewall](/windows/security/operating-system-security/network-security/windows-firewall/hyper-v-firewall) - [DNS Tunneling](/windows/wsl/networking#dns-tunneling) - [Auto proxy](/windows/wsl/networking#auto-proxy) - [Intune/MDM setting in WSL](/windows/wsl/intune) - - - - diff --git a/windows/security/book/cloud-services-protect-your-personal-information.md b/windows/security/book/cloud-services-protect-your-personal-information.md index 8438a9fac2..24628c757f 100644 --- a/windows/security/book/cloud-services-protect-your-personal-information.md +++ b/windows/security/book/cloud-services-protect-your-personal-information.md @@ -38,7 +38,7 @@ When location services and Find my device settings are turned on, basic system s ## OneDrive for personal -Microsoft OneDrive [\[17\]](conclusion.md#footnote17) for personal provides more security, backup, and restore options for important personal files. OneDrive stores and protects files in the cloud, allowing users to access them from laptops, desktops, and mobile devices. Plus, OneDrive provides an excellent solution for backing up folders. If a device is lost or stolen, the user can quickly recover all their important files from the cloud. +Microsoft OneDrive[\[17\]](conclusion.md#footnote17) for personal provides more security, backup, and restore options for important personal files. OneDrive stores and protects files in the cloud, allowing users to access them from laptops, desktops, and mobile devices. Plus, OneDrive provides an excellent solution for backing up folders. If a device is lost or stolen, the user can quickly recover all their important files from the cloud. In the event of a ransomware attack, OneDrive can enable recovery. And if backups are configured in OneDrive, users have additional options to mitigate and recover from a ransomware attack. @@ -50,7 +50,7 @@ In the event of a ransomware attack, OneDrive can enable recovery. And if backup ## OneDrive Personal Vault -OneDrive Personal Vault[\[9\]](conclusion.md#footnote9) also provides protection for the most important or sensitive files and photos without sacrificing the convenience of anywhere access. Protect digital copies of important documents in OneDrive Personal Vault. Files will be secured by identity verification yet are still easily accessible across devices. +OneDrive Personal Vault also provides protection for the most important or sensitive files and photos without sacrificing the convenience of anywhere access. Protect digital copies of important documents in OneDrive Personal Vault. Files will be secured by identity verification yet are still easily accessible across devices. Learn how to [set up a Personal Vault][LINK-4] with a strong authentication method or a second step of identity verification, such as fingerprint, face, PIN, or a code sent via email or SMS. diff --git a/windows/security/book/cloud-services-protect-your-work-information.md b/windows/security/book/cloud-services-protect-your-work-information.md index 38d4ae8c25..7ded054b97 100644 --- a/windows/security/book/cloud-services-protect-your-work-information.md +++ b/windows/security/book/cloud-services-protect-your-work-information.md @@ -72,7 +72,7 @@ Windows 11 built-in management features include: ## Microsoft security baselines -Every organization faces security threats. However, different organizations can be concerned with different types of security threats. For example, an e-commerce company may focus on protecting its internet-facing web apps, while a hospital may focus on protecting confidential patient information. The one thing that all organizations have in common is a need to keep their apps and devices secure. These devices must be compliant with the security standards (or security baselines) defined by the organization. +Every organization faces security threats. However, different organizations can be concerned with different types of security threats. For example, an e-commerce company might focus on protecting its internet-facing web apps, while a hospital on confidential patient information. The one thing that all organizations have in common is a need to keep their apps and devices secure. These devices must be compliant with the security standards (or security baselines) defined by the organization. A security baseline is a group of Microsoft-recommended configuration settings that explains their security implications. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers. @@ -80,7 +80,7 @@ A security baseline is a group of Microsoft-recommended configuration settings t - [Windows security baselines you can deploy with Microsoft Intune](/mem/intune/protect/security-baselines) -## MDM security baseline +### MDM security baseline Windows 11 can be configured with Microsoft's MDM security baseline backed by ADMX policies, which functions like the Microsoft GP-based security baseline. The security baseline enables IT administrators to easily address security concerns and compliance needs for modern cloud-managed devices. @@ -91,7 +91,7 @@ The security baseline includes policies for: - Setting credential requirements for passwords and PINs - Restricting use of legacy technology -The MDM security baseline has been enhanced with over 70 new settings which enable local user rights assignment, services management, and local security policies which were previously only available through Group Policy. This enable adoption of pure MDM management and closer adherence to industry standard benchmarks for security. +The MDM security baseline has been enhanced with over 70 new settings which enable local user rights assignment, services management, and local security policies which were previously only available through Group Policy. This enables the adoption of cloud-based device management solutions and closer adherence to industry standard benchmarks for security. :::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** @@ -107,13 +107,13 @@ When a device is enrolled into device management, the administrator assumes that ## Microsoft Intune -Microsoft Intune [\[15\]](conclusion.md#footnote15) is a comprehensive endpoint management solution that helps secure, deploy, and manage users, apps, and devices. Intune brings together technologies like Microsoft Configuration Manager and Windows Autopilot to simplify provisioning, configuration management, and software updates across the organization. +Microsoft Intune[\[15\]](conclusion.md#footnote15) is a comprehensive endpoint management solution that helps secure, deploy, and manage users, apps, and devices. Intune brings together technologies like Microsoft Configuration Manager and Windows Autopilot to simplify provisioning, configuration management, and software updates across the organization. -Intune works with Microsoft Entra ID to manage security features and processes, including multifactor authentication. +Intune works with Microsoft Entra ID to manage security features and processes, including multifactor authentication and conditional access. -Organizations can cut costs while securing and managing remote PCs through the cloud in compliance with company policies [\[15\]](conclusion.md#footnote16). For example, organizations save time and money by provisioning preconfigured devices to remote employees using Windows Autopilot for zerotouch deployment. +Organizations can cut costs while securing and managing remote devices through the cloud in compliance with company policies[\[15\]](conclusion.md#footnote16). For example, organizations can save time and money by provisioning preconfigured devices to remote employees using Windows Autopilot. -Windows 11 enables IT professionals to move to the cloud while consistently enforcing security policies. Windows 11 provides expanded support for Group Policy administrative templates (ADMX-backed policies) in MDM solutions like Microsoft Intune, enabling IT professionals to easily apply the same security policies to both on-premises and remote devices. +Windows 11 enables IT professionals to move to the cloud while consistently enforcing security policies. Windows 11 provides expanded support for group policy administrative templates (ADMX-backed policies) in cloud-native device management solutions like Microsoft Intune, enabling IT professionals to easily apply the same security policies to both on-premises and remote devices. :::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** diff --git a/windows/security/book/identity-protection.md b/windows/security/book/identity-protection.md index dee9621971..24fae8b0de 100644 --- a/windows/security/book/identity-protection.md +++ b/windows/security/book/identity-protection.md @@ -11,6 +11,6 @@ ms.date: 09/06/2024 :::image type="content" source="images/identity-protection-on.png" alt-text="Diagram containing a list of security features." lightbox="images/identity-protection.png" border="false"::: -Today's flexible workstyles and the security of your organization depend on secure access to corporate resources, including strong identity protection. Weak or reused passwords, password spraying, social engineering, and phishing are some of the top attack vectors. In the last 12 months, we saw an average of more than 4,000 password attacks per second [\[11\]](conclusion.md#footnote11). And phishing threats have increased, making identity a continuous battleground. As Bret Arsenault, Chief Information Security Officer at Microsoft says, *Hackers don't break in, they log in.* +Today's flexible workstyles and the security of your organization depend on secure access to corporate resources, including strong identity protection. Weak or reused passwords, password spraying, social engineering, and phishing are some of the top attack vectors. In the last 12 months, we saw an average of more than 4,000 password attacks per second[\[11\]](conclusion.md#footnote11). And phishing threats have increased, making identity a continuous battleground. As Bret Arsenault, Chief Information Security Officer at Microsoft says, *Hackers don't break in, they log in.* Because threats are constantly evolving and often difficult for employees to detect, organizations need proactive protection, including effortlessly secure authentication and features that defend users in real time while they work. Windows 11 is designed with powerful identity protection from chip to cloud, keeping identities and personal and business data safe anywhere people work. diff --git a/windows/security/book/images/device-encryption.png b/windows/security/book/images/device-encryption.png deleted file mode 100644 index b6feadbbf762a4ed137970469ada65dadac24838..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 66035 zcmeFYkUkf50}n{~Nwp-D7%wgd50BH&-k61#95c*1#u|`e+7VcO{^crv>W}}j?_}PW z+TGfB4p-MHWMo#-HQYUsAB-cB5#`L}6o+{Pg^VEhC2#8495c|2vO-T(XUf7;p<`x}E5 z(|2>(eg!u1F@K^>)S;N%+9gxk( zsy2m_zu)z8|1;Hxe=75G2t>tKz0xc^MmPWkUf$kI%?s~9#&6wK^VWCgt0BBHf2Wmw zcCsCF{%xd!m!tT66*G8qQu?6D?3GB^&L~e^6E0KGbZy7J6rJ8n$?d18y}hO=LaOC2 zZ>smIDhg=b3k5rxi9GJ>Di5%l2R;O9FWA=;R974jndZrO2=Cx1(w|*0nQuVU7j< zL!*jP^s!pAxFpGh>i&){?k*nbp$!t!!&C+i9!*|E|a@x@jir>k|C8 zK}Ul}>t+cef}CMHjfJ=1JsYpHCCA|-tI@D|{O}PI<|J)_E>TJgAT#Y&1k;UGXEKfw zd!Gfqc7}nTtk}DlZ5^Oue*iD=M!Z-DPicHYe4RdlFIH^ft*34f^TlNM+_Tu`2x=_x zHNO&zkjrhD)z;X52N7HKK89Triw!rCM#X=c8OYUFn-_X_DMsaJrSpi`MR#M}V{TM{ zFg2327_S&V9B=fQ5+QLk2O;w;Gn_fc5G()tYG$(JPS&Cn4q0*iD1M8lJ1z?zieZ3m zG{Y;D{J%oyBz%l5XY=>7tW{}WOshm$UvXlT5Wc8MhLvW6!$c0g{9@&s1WGIC8FS-~DnS?eg+h zzVExekVyN7!Sy`xc;Ov({Pzf{{NY#_V_&xjPo@3ezNu;Yq6F9Yn_Yz4ZqJYgSdTh1 zBDi#+oVs5|M3E$z-Y{XB1Jgt!sM)jo!NKPci@?BZAAU7n(iXkDT29y5o{eZan+1N- z@<;{cy!@Hc=l{y!kFG8@Ep>{5qygscwgG6%EDD>1QmPg3KckQsmD4H_wU@X_#5^ik zLgDgeF7;10$K<~@pqO%QCH#LTLCJ79%hCPcHH##(ReqH8??xYBXZ!z{k5q+!mjh2| zMC0?5e`lO!$3Fej|6lhYZlRI6C6aF$ z`x9_jV?O}0-_(7lIJQk&W5R19lm=7k1v3}6M7K*-yH>W)=uRM>-sUeYJ3}WXIRBNh z(EPVUJ!50znR1C-ao@$EFl@KURf0VIa$feNxmMWRPIr=rH(p^7t~GSdHn$ zQz%>qMtwUmj07O&k$c%9kQx3C6Z3?D|1FRXae1dgqyGtK;CAyiyvkFVy-($Z4yUbu zb;{$MVqy}?5_@9A;J!X!is%`=;^UhsoG2hb?}DmVE8s+lu6Tw8gc>%f~lVP zHm~kX3jJ^KN9;xkM9tf!!Sgv(kgf8hj5x3C-bYar11{RBytbyIRJ``Wrw-mpMllK$ zP^QGES&ETazg@wywy<)F1hI^%;ZT$J`V^Yth?PZP43pb?F;&)-|LLxs;P&GjB^FoI zLS4hc0<>YmJfNmUp6Qb?Ri@X_4>e@4PshZlw|Q+{fBX^-$R*ne(VhT-15i_<%R_u! z@HXFRDV%s1h6p=~C{CzNqkcrKFz7E0ufwK&6x4jL?b-$Y%caAVzq)ngU**m+DNk1r z5uA49F_N>t4C*;0B{G@Hm~e>b0+jfch!K046jdxR25n+j)9tlkI5z>ubXkX* z*Z=B9Nch6+=^RX9-6QdQ9gFP~*yix7XDB-Q*wuXDrNsGXC#f2?Fm8%J;;?4ob$9O>w^v%g@gROaygM85O_iR@o}kP-83 z{>O@ffYJTdEfVu4U~2GT1d}L>8Y?Z;Vv_h8Fh4)vXW6M@sV|D~A&was5VUu2-$k$5 zj2X*VM=AAswB=c!%uZi6G}nao?u@U`2MAAOxaPX9t_qmyEuhY3m*1iOn7d5X1Pz|8 zU#kWl#0{H{<;n7PjFFEyBmhG9!P2GOy&>0|35ZMqlX5{jp0u&2wwVgi|bcL|9#28ez|KCkU<(gi;o;*(4k`BgL^bsXl`mEA~pIoPGcVQ;<)X>^GAn< z?iv(+)G&ztRSXia={=c}XS!G8wNmh3aUUKGRYhN3E%dlN=s-%(ckw?ZHs&tvf66c3 zzO>yL&j#2I5t+ApRWbPe2s7{?>j*e?mOdF5*}@cOrVf3GI7C@S-AA8S3*^AI{K!T!V5W&?8W0T(J8q9$*-kX#FE#ijRGd? zUq1`A7|4-3x!Lrk;e&E?N)dM77VzZgp-j~E>naf~SX2V=%SOjsGMitI+{@?Qk6j+6 zgwm6m&@3hzRcgj7;E|C7XWLE@=39E?IBBr}u6(c8H&2?etcM0^zUGwE%gV}rpY4kV zVYBLTFi$gw=y32nt8sjrhlzt!!nl1DCPYl-s1W?%BseoPsetVr(&)iV#uSy0Z+SE9 z*l6t0AfCM)*Wh7-hYi&Yo6LZkIOGPL!02WbLZ&@Vy%FmoR$amVblgw(qMC1g{*teS zv@Bim`7SE*bnGP^NUzp-8-qZgmfM{vc!hC~%jM#{lSWq67>VikAG_%SYO}g5BBEj~ z#Mo3JKHCH!C+7yE>>xrRK1KcBK8)({nOITRkdxe)C}te^FuiAD99oeYZ}4GXQmQ}l z=Prf4bFpd0))wMTBkRSehOsx@+os4;k|KWhkdKTiOI!GDMEMLpGajJCHRvtg`CXEd zJhp-5(k7wn`WtuQT_A+F{YSUgf`xCHi+Yc{wc3BA@C+Cb0AJinS!WuKQOp^kJVuBw z+TNc*tI^G$P*5&%`*$enrm(OenUmShi~#ewH6VnK7$F#{27dPa`?_m>*R9XgmVg?H z4zlD4ISZuoJp1Me+S|K739Sh^j{u*qQZ5hGzBF&H8YW03Gbn82Zn2R;Q53wq406}V ziqrlSckh@{vEF^r+2wxEaU{B?6q`?qlW#JDfq2ZA)*pqLAv8^!gu=Dyqw2XBT(o!W zxjjq39k2=9@4nvOIAFS(j@h#~2r$0Mw^hz<^V@<2sh~ewvZ*NLDD=1eKt(P66O$L- z?m2E9m@o-`wf{P%0BCA(Zz;}o?QScL>Qf1$qg)WIb;1)PkFOBtpH`5>OqKJzMz;*# z=28FS+c}dpDS$Y*xagh2bs%wDadR`=EZ9Pso?>SW=>p%Ls)ZMXFXbe40jA}Fo@^WT zQx{ui_Q)=A(7o56PiNV6 z7EY(Sd~o2xD%AIfy?F}^SwUfc(JywzG$`((o8Ho~@?mj4IWVUBANH2=FUDt^&W}hlnf7k5l*a<$-z#M4-E2 zc?T|LYF)p+%NkZ*(KEc?aoq!To!*z=US8^TqhnRd|4M%ri4_6N@R@j$6wfd#<|;Q-JSU(3t7kRc2j7 zZOG;fQJd(q1ZBkt!tvjcgz3apVlZjLrooH?mq4cpXJqIRBWGk5qacu&Pnyh0jrN<( zMp*1u43}aX?+;9uHkT1}ls5We`zGB2`a2`_`iexJ+}hm0DEC)Gv`vzcKAvM_q-t+R zg!+p|EmXfi>R^o3u+7WBU{#3XuNb|i6~$nT#q|6Esf@MaCAtx})lOS5MkZJ7nk+n4*>{nrbO)WYhd#$4 z^2=L~OJt3d@L(cB&mT=>6!4vm6Y4G9?BIZ^rv{VNB2qO@`o8NeTlv;OS63WYQziQM zv>MInz-k616V6Tzh>U0;4ZoHosB+9qSvf+?5e2P+jqH}JdwYAs)!~x`=1AL!OFnoN zo2%tD!WX>0>aet?PH!vXC;*ROb$6I(Cq_tSwM?Xv4fLr+}QL${pTNOfazP=yEDFM56VD3laDl?HU^BN24@3EO!RG5JyTG zzw@`hSy(0hyfQASGo#!7RpCzC@@n=_Y5@Cf=g`Dyc27G{I3*hLt9)v@eJ|>C zumAoBbq9)WtgicN*Do|fnm(c4@`GA~r9@Lj$M`FwWyTC%Q{hfxm~AD`@XB@cmW{Pv zXP+p;8R_@ZiIv$GD+TbExt9suV?xCRBOyA-P4aIcPPgSo!&-POK57jB{FM{bb#bBy z;we5a6bePG%-JO+5ug3t(lcGR>IIyWP?M;hw$+Fs9HElr4z#&+e3{iP?N?IODH$wl zWNkPLB|AHmAlE`jBhq1MX7TLuA~DXhj@tmLPE}EfDv>?$gkz6MhlD1f&A~R zAjG-|L#mkEIMqU4%y>`b9+B)#guduf5zY&Ty+JV^h}2hN{}<|ezk1_@Ihk-GD>*jy z0Q%0;BR(63gMuGFkP%Sr%YDLmq-&N#^szt8dpV>=Pn#+%JSKQnBVObk6T%|&_O#!g z7{y3(tjwLzf@z~%wwbsvfl`HbE8lKcbq4lGRQhJ>d!F|n){|KjD^u*kmcaSYk`P` zL%DH6)j$YyQ6u&z&E2uu{G%e|>(}B#h~;Ec2q7>D(D%9N43F!}EsGmqA&9 z8@E`sN|c*wA6Pc}wwA9_1T{9Xw_O|+p`h4=t_oHbYuAhU(PhW-_Hcuud!X#1~^DQ%A>`(_d_u*fg9Jx900)#FXve z`4fSq@`(te*nuaHbILWWoNC6F#&_B!N(CCl#Smgd_#)YFWvUJM&8hfY6F)lDxBpIy zgDRXl{CQh_2=9kqQ2EW>?1B{%|_F93Czp-^Tes3 z)oDWG_1*uP=-`1uT#CloZM=}!0CqU zxZi_?S9%KL?MZ8$0V%wQzBN*sU-a@vo^XLT!gOY=!N(j9HhnAL8@Q3pHSws#&>zT# ziy|IXZhs6dW6(%L|NdU~m}vQ4sxSP{vmI2^EKAq~xsH2n8&y%IjAiA@n5R%(^ za*c>zUDIXHO-TyoS5BQu-!F~W4$6h(g*DAybw21_jZUk=$=;a2vO+g77-s&e_bMJ6 zlsJ%TY}{j$+i?Y{C(~q|xzgdMGjASu88NlxCwDAfKTW+*a}V*TRLNvl(8 zO8PT63E96Lq@RAm0nwIU55;o6u%XwWPAWGUU)HXxfw4L8!eH+uTYESbv&R9e_bcn< zm&zDpTDn`@1BQ{9kl%>@_YLW%I9L#0;wl^*n4F&;-CV;sHa$+h+@YOY3L)9`M@JL> z?i1!jJS?L4evhaK2y?!h0_u@+gG>?O>#Fx7MNt~fklyBSOrP1!;Z@IBJPW@U`PMv5 z8a6LnU8PBhbdl^So{OY?H02nuD0ElX6Q{mjL+;6X$m^RUAN#^om9&}7BNt$a7T*U6 zcnFd57}YX2dU2L>4PJJo&J92WeA%z!o)y&aRtk#_D<@5+;kERhf78Dyz>2|IMtXRe zz}(AR__xm~MKUujVt(3YYxN++cW{cbh`KMN^;abGU%|s2S8l@?N(Idpo-5H`mF81F zjJzi$e;FE<*UM;%GcSj4p;&Rf`5m7}a+76bdsyTD+*X?-KngW|+3?eksUI&}W*x9S zFV$__N4zNr&AB%BqgQVTXC)n_L8PQ4=oDqeDD-pXxhFOlzQ~JmOH_LD+|+nf0ckV1 zwN0&Asx56)bo%Dl1fOMKay+tK!W+EbG|9)13jf%6_ZzLOZdvDj_Se+){(aZs_(`gp zLH$JVZ3Z6+HX53u)dB)p?Cq+suM;z@!fnu;f$kFlfxFwy@F0kBI!>`x*St8u967!O zM;70LXBe-S`z}ww%Dz3&VEZU^hg;a~-rX>|iYsHu>K84~nG2i}Y17e+Fjp=eV16w2 zb9YmmbxGrc(^oStKm|<`Yxt8RVDUY|*Jm;MH*^5F!8u4reg0-A`VB$o$%h+@(e$Rd zcEN+!D4r!>c8WJKbll?BjH3Rn+|8~Yrfo7GAuKA;&zAmRVw|mgv#ou3BGEJ~6d6uW z35{E{5x~jirKS+eKvY%}rmuvAZo5;IVv7HTF5S0}4zGE&%wDpun)E5kI2mol|J*mR zzF|xm-rRqw*$4kJbj7{`nAqkv-7htNnPVSou6%j+4zT;o>_uDiOY&KI0rw$I0{>=C zFqXzyiawZ^%O^QXzcgEG|0P+x*v1b!P*{^@kIU@L zOJD6SDw$M>idP(FW#;-Pco#`*vGaW%YkQp({Szke#(0#{>{q&HzMizv4ZnBIL(Rs~ zQHc+jQ5P`NAQ^t+u*uw$%Z6E2QDMc9tr+;{k_w`2xh9;-JZl-N@=*ujlWXeg=^$9< z(?z@^0w`(j^>OW2a){pMbIg@$2cxf&5cJO_`E*5~RlPOA`!XQQ)OU8xxzVZ_`!HeI{$NFC18Ks=94{Ir;)g9;cd3WF&$o za>+8onMRj`e!jf($r}ZJdHD4WaY)1_nvm2Ws85`LF+Iutj&cNR_Q)Xy_X(q*pPL)c zCp$Me#`>G`Z@H}NlP&n`UL5Coazq?h+ihd7%Sb~v#&O>2k;eF)Z;U;PagA}89>BK}RCp7Qj%G{=O8g@~J`rd^+`U6Nxp zXtXU--)GYHOp#0@UO0K`hsd%ATb`e38YQ6UTI;pW3tR*Po*;j8l%n$!h>~xuK0D#y zC+8J=peI!~*%sbMovydbRqN#2OL73b@{wr@B%B7jAt zleyHpmU7@_qNykNvq^n>ZxVt$P61ab@c(q0huN460zq-qYDgql?rB(k3Ci%Ko=Rc`__qK6}WX+L@j#vhKp_`e@b2sf2 z(!7sKl<1uxp22(-P1l1<Oce{?%4&3(iqtl=-MAUR5Xm`Nu&gr?cK@G*Fe1(JR@0pYEU=ojwmuc^}Lj z2;|hca&onetbAISjSI78M@7SkIjq(Mn;QUY-PlL(UQEDbb6vl4-CJPWpjpfoDpf6c0s*?`|m4bpbC=Ewdd%EeXH6 zodTNp%#{`kw@T4EE%=cHJKN06jCC`!48ZmYj+*muX@}Xx4Y^rI;$PO96>pBFpGLP`1|GyK<~kj!0k`O zh~~B_g49RC`mqDKyp1CEP-u}Hr85y#1<>Eu)ir(SJ#^`5nb-%|s*femH3Vf2`7xgf ztvj)&qtAkzLLq0%V^fPIdN)G_Yx<5cU@&~}#0>r8mI~==**SHGZU;e5!xF%Ss%U`k zITpCZb{#ZTgQPb{|9ldy4~);2V4RpXe5t&ztL&*}4;3I!mud%?Unj!9>>gm=+-%^d zKDLgc^LYKaS1Stlv5wOd=GIr&bV4qE8@a;pZR^8@o;&Z(#9Se!(63g3q5Zvf_J~Y8(V(*zvz?LGA0q4^e+GA7DSys)~e~(Fefl|`vc80lfC}~TS z%otk9V3Bd1Xg1>Uh*2#0{eUIj{nWd&d#ws9wbyx$!XT|QOa6(G8Q4lF>HLMS>cz7=@yloq*^to1zhj_;VNvj>8=;s*8xyEy16@7)}^TA;q*LCOx~;vyqP|tV)<&w;9w(?}a|svlemxmJ96-i|J;Y9Z-xc8LX?Z zFmG0fc!S5xAL%-I!@|>9WqfruRI=qs@e}j;1eJ6UHvyB>4YB2g)u$kCMQ)bYJrya< zV;WX8Pvt~kcOMeJI%b)$$Xa<8{}4#~f(SG-QpMw4&UEGGvwR7Azj_F->V1qbizHy0 zE1%Gh6x{4nGdnbn4AXi{8yV}2$|u4h+`#BGL&c`5B#NeTdfn1O>P>fhhgXsHD#rkh z;LX7gzKe2r{&JtcL{2MJr6ZRnafbV`I6G8LmUZm5dJUgAGD{NbQ>(KPk&Oilzct3U z{;)Ldy@Xxl3{~%UOmco}-FIEz!Lbltzt=ROGU+9`45ucJ^$el6m?qr%lPE^*LS0ve zcx05drt!UkYhkRx6p!VFZD06f*FS6I=9A1{=N9Zs4k!~?qbl(%EMzJjYxvE?JKB0F zAM$*j7ES!g_ck#7k9=8Z;lPZ1w*m6&uR_<$!+KK7YjQo`*E-LG8rMibKydxtUBPb@ z3XTd_^_h&(Yy7_6FyP=Q1zu?5gS$<2p_O}l^U#2f83HWXj6bVZ#5#D-wuST;%`{dj zHVFdX3WbNxMCTHge*VwmiaEyd9ow4m2 z-+&!OJQ0zzI=M_A=E3#){T*5*?J9?Ml;}qUZ*qdDW@e4q z<8FIqJvx!kBx83sCsU-q(2>JsvrYZM>Y!H!qfrpiVb@O0Gt%U$7IO&-Q)u>!O``MX zg=Wi|YbiO;6;H3&Ea}}J>D%pweV0vv+P(Ue0tP>{aEoTvR>j4)r!T^ zZ@B-YZXXmh6mEQ7^`qw@BeXX!LuI7I&3Hs)%n#RD6c@uvBU3V*jKmiOvArs(u3Lcr zB{sWPkRw;rm)+$}1J%o(o7oYkn$1$|b}-k7HZG-E1-Z`rp+)tz+% z4HEd)?8DHsvh@OaGgghB!A6$6D&cxV#}QbF^DCYiWt(br+ms?aRzf7V1oxh##%X6U zb(qnWPnQ@DTq8n4jtY#Z;uLb*0mGca*_$5>D855F==%qdG$D@hGn}a=>5YCkUuyYs ztE&RQ99#RkollNQ-R(brRPb|h^Ze29r{yJxlPXV^#!heeI6 z6}y2&Xsd1EVQ(KcZw=Ul@g?b>R{0jaYi<+`jIH z{Lk2_LD1J&>-v$_xq`8w&5ww;2`x*>GWm)3dq@1ltSz+A>Pvnkm2<37$1&T_pG8D( ze;TN$!fA1KCv*88Sz%|Mm~nW;$T+MOA(r_<-NPSR7+)9EKN)H-d~J_dQp<*a)P~<=V}ysW*xJJ3kYRZ)o0vIA7+P=C$1%kF}U5&qwyuE52vu z+ut%Nbt4^q(TBTOvqi5<0$xHC(kVT06s05xA?0Lbydb0-{d2UxBK66`dV5!dGs@j? zF~yPkZ0p8ezK&4Pgw)ZI*SNqfgKhu%uYV-_*|zFG8EcWZuE!T6dLcH=%uAH%G&6iq zK5nL|hj5MI#-Gcdo=5llb!=wJnK~YcW$EP+o@Tqp(YQwFDL&mhtJclZ5oH%Dw|sOR)x?5H0(~}Z57D5KBJsc`X;s?>Zsk*3~+@b zGL+aGp4x&k?(RD0Rc&;w-M+>XQ^xT-wAoC0Txv)-0Ta*uG*9a0)&x5wh>3_8)~+?^ zq8;cKmUrd_%(SnA8qX9(sUQ3X{0-_MtGUcC{kf=D3Q-GR5I-ly&RLR50`Qwiyi4^B z=BG;#ZqvxCN|B?!ZBiLq6Rc}zE|!@~XZ^eCGe#RjhZ32RG4KdAsnr)Jq5^(>?3zVs?skr+5PF3qWlsLk|-mzqNpM>6VLE(4c| zcs~&wb6idB8aoNCitiZH%4t)heNN#Vg|CG~zOm^ftXqHBe2pHI+c5m0u-a#usI`r< zC*<=5(zUp0wRgi->DCUT8!}!tKeFb2nsBqM9jr{q#sv*Eq#JLe?ei0$P<*a9bQB2u z-Ax{j_d`HU2Kw6jM~KBJ>k#f7%cs`C(hUKnn{ASHciETWpCh&XOyoj)AH{N%t+;%N zOH!8QR;DJBL=Tcd&^B7o&wOOmoi9JZ2Z5T5>Q}gp21elt(oWl01qXfjG=1Cr#h3^^ z7fjXFY#~o}jR;WK`RZ%*Qx~2{vSJU;@xkYo+$I2uIHpvLkArW!1c4DVw@}x5tKiGT z31A__Rpyu*^tP$+nXqJaf=kFlJqlJ&9;#8Am1L1jrcb+@Q`6nu+Yab-NXTtOtW7%y z({+Fy(h(Hrw|&CFT}BHChugZkh9EsJ5eDj}2Ox_qmMJJ#WWhtSaqUhH#V|e$bNN=p zNX4l_x$-`F-ubF)5GYZIK@vzDEDl@J}~8 zIC5HPS91jpBx}r?m9KaWl-V@2zE5>HCGYbexGQ_iJj;?)x=8lX%aL|$Zp7pPtC(QP z>twCyPgX{aR}X2pOhAED$716_%LZs-FnN?Lo`bMw?W`sMW&2}J zwFb5@#%)!+ZGlfXe<-;4C9BD82(H`S=q`ug$v6Rj59q@znnK35Y;fdvn z0~Qt*Ku`jhEA9$^R@dW_pW9+$z#dLU)>_rGa8=UsfDeYiB~gXVx}XKK?y4mRfVi0_ z97sHqgw^p$64D4+7HR65r^FZo)4!_XTAg9sbTYwr>3q7^FP&SL=i@wk-ostbM7HY(^O! ztS3d}LK(p;9x=gWa?Y4ochgcuvsDkVFmRU`PicR%|8qnz59EAiFJYb-d9p#Rhe)*D zfYJPEO*Fn=q}jmkZ?GSW#`?o1p>xJ-Nbh*{BJ@wi<0+_$C^b5SEv$nGt=zsQ*R0V( z-Y1pHWn&9H8H!q&;v1;(5VHNJE_cJ=9_e!?Cz^9s1gT=mkhYb4_fUkR8B&&^P>TK2 z7uhBur0dO#Yad->z1tv}JEKpfS7wnZR?S7`raTD{YhK=oUP8QXnK@2M%CL3b*XSG} zIy2=b*W85&-g(uSJE5c&RF$-Po|QZ{D{eA#R0-Glr3NZM+Uh1`JlN#)!;k&E_q!(! zShBD;ItJEh6M6ICh}4UQu^S7>;Epj^dtCuMACdOmDg<;x6OKa_Z}e@rC>%eAf>2WS z)*rbzW8df_CNy$^Y%`O^BY?5JN@!&)(PZ<2R@sA}48$MBzxim_beU*>D3cSM_B~jS za-N>fcOl{^&n(dK{WZdn5PU#^r!yDACX|hJd-Nr3>nK*HZsu@UkQoDwbl>>Bn^ zN%*FdrC?yZZq;==5J*GNi=@UE(H%4bL7eNs0CJ@UEQE+489s|7DzA%sxn?N`(BlGa z(;P76PbdN{f=vR5 zcKDD|!vx-^h*cyAm$5#S{dbeeeMT+!)H~4VQ>e62QatQ>PGQZa2uFKLhke?Pt(Oz| zAr6~!fL2H0|^RBO|nPoy(8&60@0%h#+5$6HL_dOFo zK{29?s85|GE$(sV+rL$fay*MxO-=kFqRpoY?C+lvq~Zyi)E8*b`}>?qjj8pKgoU|_ z^sQEAjj1W=%>W#C(PhRhi{HnLOn;5?qe38!roN@MDw`uaRF(}%@*QIcxx-kfMcYb4 zcAnUH9!Q}3Zzp7}bq&13IyNVkbLxw{iS86zSo&bE2a^z;2QWRN-P%?8yjdx8sZlwi z4!SCi%EjS$z@?VsGOlw-TKok@U?t=y)Q6J2U#6M*@l|Or_6NaFN|DE`Bo!K&*zph8 zLB~E`phMGSJuw5_k#IxwTlU#G`!MUjSDavSq3zUL6NFU}5a52#+) ziHJ3&sK~NIu^aW-^GN>@s$(@Ps>i9xy+9fv;4WL3JwgXmAk@Dc09a+@&RJ$Dh%&?8l(Ywsgzx86<`RQ9I+cwW&x z!KtJpUqL|Ep`G;VS>QHFb(DrvY7HIf+b)_w1!5UVH&u$cee!60GSCd=O(4EU{&P$ zj&L9(2`UlWjz8-P%QJNu=&zIuBbzS{>2>OqI0A!Vw=8r zseeyaEL{Jg7y9Q;dtV_K<>FMmm@oD5sqYvKhE= z>mPo#>apLX7V$^%k)?1tVqGRS^M}sj0MxOLAMj_rd?I_>mbbGxp8k*eRKi~lU9q`y zT4pA}lb@!8g|5t-u2w$e8m=p_Pd?qv5|Lh`TqqyD`xSECnRF9hph3i`0 zC!^sg`oPU9W3=+Yx8?5Kcg@7I5wDg!V01>-)e>oOvsQ|n5xH-A9h%@vd1nkKLyHRw zRG}}hL;oCcD|0Y=-Rv6oH29zF5EE*l5YR@XYmY3Y!i#6wqn{$4b6V*9L8F^P!c9^z zXDiEtqq25&KAA=i%&FWe$Brs~*bp(Zb9%t2e~)-LFov)CEKNlBVY2zDY^tZrrkVJX zKCO|qbi9pHLxluGC(Jw60^nZe>&M1mhihKsFFx1Cf*~WGogAoOEWvljrL~ailx~E& zlO1bV%u?ZTwnoi!N?!BKrJR_h=mjI>`fb1Q*7HVpg8-*hhg`A1T6-K^h)Zx+{@;vS z^ymIHpv6qPaeDyoniHyfoHj~`*ud?iYHWUK|6~UVR6OJsd#_ikO`&dLsU`Zn#YOa* zy@khkUu#T1$?wSW{?rmCM(Aq$7-+yU%UG<78%SbR!@ z{QGSS?sne=8Orm|ko~I>h@QEJ$(lKuS%^wZJiTJ;ZkD-_NX zpPBmz(%zi8z{c*6n7|Xe##@j@#<1V>V%6vm%I7fUWSLQtfU%Amp6@oY!T!}_X9N32 zu|g(WKb8mXT~zxg1Nj$MzhHwtJn&*{FT`D>TtlysTL=G8jcypy7Mei|L*bDftSm}- z4;W;aHtAUXg_Y!=BT5_;xedl49cDi+n(6YJdJPOF^e%b2SFXl3J9khx5X0dQFX4&i zCK4w9C@z!kyyAh9vrH(^X~mW2rUZtM`HXlN;FNzP8hfuPa9Xwp{`G+~OkFdkbCHQB zCptRX@Ae;n=rG`O(gQsNu$MdlC=mB=jUqTZDIjVEnk}5OpI7OZ z=TH>2JPSVb0;8zmK6f5w0UqxnS)k*xuqp0xT(|O70n_mN?jLhf2w{!7e)*@_fB zn&@2e1h3Wj!#T(`8d5PLG}4&HuR9T`zdyqKyYk^>DbJxIaQi_mx}e|)v3=q79sZSd zGg{={rwp5k&Xzb%v~QuM zu}&2!fzCT5_O%o!inE3#u*qNal5Q&YknWmJzNb$h!MPs@wq|&QQ~W66B7#H;xX2LG z8_KQU`W|CXPYRrZr`R3K@YOY@S6(Tq;`|$1O6icLBK=X*Qeo3-SFATb3A0U`-^l~$ zOPG?5TVOLhQ=S*AIFe9n?pbfID$M}pnQFZao!$c9ySG`7&XgY?dmP@z$lny@2cIn& z?fdC-jqZ4t$TEyFy$p=g2(Rpe<2^4!NTyS`N81-kVBKF9-qR%L7kyS{s05kdhT}(f z|H1RvQ+_wM+EOL}6DThH&lZVg$i#mJwEFV^l|Oz~4b7SwFaT5G7Wd4AE-4{)8&eh1 zP%V6^erY0)jwzvAsa%jL(tJwu1yMeiMuf%>)9WATnXfIA4pXMo36D<)13=Es4MPY3 zDsCXFQ2wg)_9Ay-siwSm!U@tuoEvB}Z?C4^C8iQECKSU2eyG?rPA1ivYYGHx%0e$FYF}pmKG;tc6f`4aB~!W>t0*b4_4}|Nj@yS7;bA#x z$ty?ii&lJ!hkLN$J8ShmrGCRjaYJet>M=V@h>x}Q`sDzIKwScV0pljNe;|g;k3jBs zk(aHX2yJkShpb~5C|na+QR&J>6g?az_|EBBm9)dzF$MD=1ymd6MFmjom&M?o8bvonzmI{7u3P*JlJ zfh2Rc-|=y6=r@+JBaUHk@kT>afv=mc5|^&H3hOnD;s!El5OY#fJG@fg&MvwdA=(DH zr{XPUu(AnSALRV*gWbBKI&cz~?HZT6cWqhBNuq=JfEvZ@2@vUHLooXc{ya#>!K_P9 zz=eC@_oBe%(DhqFbDw)i#?s#gu{m*-V*QZTyfz&Gym({)AZiM70XAHs8^NN2z+tlp zMTv-O{}Qr*`gDw%cga$_l}}oHeTzN*uskx%DX5?!FV_oroWL$i<*4@P$|c<~2SoUU=Q32%Y@Hfv>A8MuB=4EA-8f#G z-g1V0jod%D`Cz{@(b6k<0?`)DLUS^^ty2bWZoe_2!WTv-d1qADwQzJy#h>&Ml!H7S z*$K8G2EQDx7jh4pEoJT+y1HTOySoX9r*X0!Q`yftgtzg<(-_EsWIpjT2NA58z$Pme z*!f!E@T12O`!goKR&T;Thn+^6d#3l>W?#Uq_1_*3OT|(PkNo{utk6ng%|0<3{g>?N z*{bjQ2DRi%VDP4s#NJkh_`VBvdO|~kKrzlH<+jp~zNm!17N3iB`$bJ-DkH{7AL*H7 z*mZm&SNJwufu)DY4eIxP_cG>cD_KR-;_Y#e$*{W)&N<(knCUCc|M12JCMP00BzpHd z_HESZJwB{@uVWd}^Dfd^hAax3OF=#hxVCld!`e&MY!c+IV&MDg^6+wRIxt$`pot^& zFeW2gXpA8B+pPSwEjo}MoDDpDx6(R`gL?&GPHRk_BnjLdH0Gtl7tNQ&I-54&+51^S z+7!J_m+g%Nc;`;If)b;09gS-mZP&djPkl&D)`xU6vgaWnaql63XyoT!ju!=H(gsaY zsbq7l^TIZwt@S@P`+#3xVDmilb*&oEid^Iy;5mBVEBAwo_%YjNubt{p7nvzNb}0 zNPINXqpIij{5|>8Ug;@;?b*d#7Naqjj))|Llk&BR7L2&||tU*@RzSSGRt5gj{conp$_gmO1}?`j^CPcqfQ`F{}Bf zhtWC0*X#s#P(N>ZuZ~)qvpn}M&tq5!4c%KlqV)GwrqXP7uTJ#x`>y`p2+k%IG5Pe#t_wK@WQes z2>-jbXOb4O)=;ht&hrL`SG^vLztt`gtIgOlIJTptPF^@uIUA5{SerV_+rke)YArYA zi2fT8z17K4z{;l+U(^l_`Qlw?4q~vlMJ#~c4#HuKm}K#e z(6=SpW^F&zy?Mg9rcwEPW!1qB2ihY}%RIHVN+Pu>D1G3{4@=4wN4mayM=|x|=ObO) z^kM63CP7XV%`4g#m)`i&Jn59khhxqE>!hTm)5s%+vLyqP84jZk7OmtQ+b|nxPH8|R z4mJE&Pp___XewXRyKF~D@6s=m`{-u)ro1bBhem`CIY<6U#t|!c74Sh|F|U8!{!%F) z@@EqH)oSgE(7$?WZpo??{#WHslW6nuL6@~Wazz{{(0$x4dma$e+%y4Cxt$3_cO6Lg zhIk@%jWQ2f@=RsS4RFpmd6s*x_jueL^1g;Yb}vsy8sZsok~{vFe7HBR^F;w`B9ISu zD{#d%=ID{Z_w#`UF_|Mm1B#XNj?x&ooR>B7^X@{Q%-q|j++Q~vG2sh}EIXRRyC)ln zbpaBBR&6^z$kT5v$R9u6i>ZwfUKXFKuU}sg!fUIM?N?W53-#`$my){*s9iplNBYW5 z7G0}e3$DEDu)(#%A-0r{nCyQ4M4@(S1{NWty$x4L}0#m#>$GntLl z1Apj&yRB+juUQJ23Wj916k72dbWRYMw?p}7HOwCRkI|>V2SDq393ndSn&1(c%jJ%i z4XVSPO9a@7Ko6q(W&53U#7+_1f7Fg$fPHI-mZ#&^loWbHfzbWaeBAAIkRs zs(3beux^z^NU6T56%5{ZomritnmH7vXnrx!53toP+-7_5K4sg8Sp+4tIsp!CwBff6 zmX-CHi(_gcyt{fNZTE*9wa-}3cN>hz6)-Umo+Od>3mt2kf-lX$UFCN$#)!@q2~a>d2k{ z+Omf-3~RP9rRYmrP%gvaeaH0KserhcP1gr+Qy$9r2gan3U45tj*n^ep>Dlc#J4)bhh|Zuy&aQ%D&;VqP87+A0cpG6z z-PCoyGPWZST(W&0(sLxJ6iJay$AVM$8GWed>xX&;?`0mCMO1>rw2lyi0*;^~z z9<&?Mv!@?CB}-*$?AyX{+H*Hf>$AQte46xsaeGa5B&jO?AMV~W8qThbA5Dmos3FlA zqDA!RJxbIFL73-~ z5w14(cp=^ygcW8ZTWMK6aMgv{pkkjDK8>&zaL=~zZrKpsoUL9+o3%>)?E%L>b55l1pZa*?DT&)MI7uwojl`|O=gEm#vpo_4HmObSG;R!g!T((uU z0W_jukmBDN3>&uyz4t%VZ+Er=!;hx_1~woO9P)og{uVNy`1X=58J0SkE~#6fxgs8Bk3R7{`l4SB@HheT*1Bpb$)>Ifg0`@g zc~wvCA;Bu!@CI>j-X!X|A61NZuflQcp5n>mY*Y}yiC-)5#l3+?`t8^&mdQp1czq>?9`kO_=xDraa%s$}O^*Hi{5)F$ zMTQKgUTO8(+S+MHI)cuw9=+Z4C=?=Xa9jkd7jK?Wn zU8ijCM^N%cgX+(AO)v6!p&S%e<=>P$-&fGME>`0yAA4}VuU<_okQuFAolJft&$>|n z$xhN8l}rtdN=i!la8j06JmFvh(a)bXmyCXyzY$aG(02%MUHBknwQZ3)r7n?zj73k| z7}WfV3;Ze|X{KUYmlG=@qkCpv^`&XeN~%SphjE*|v)OT$-zI9>sqGLC^+X)y&z}k{ z%Qv_)3<{N{ZGKliODH-~MkjpMLF;%MJs*ay(aP8UW_uT|ZN>JCb#@d;vV3xhh^SMu@NkSV`iA8J1OWsJlJ#Mi(JuNR zmjkviw>&&aPe#dD5zECBYU>PsLx%V*zDtyuK*5?`v=KmNq!a}h;t zI|gcwIhCeUbJUm(frwEgkZU{D9{Ez#GP_;Q4EqYt4dKx_J-L`y&)xV;=OM%Mgoe&; zC!6?el$eXz$o%UFah{r&h79IV6w=>cK~!R5qt~zGefDn0ah$iB$~2WA&sh2x4KPG1 z)YF*Ento<2=$$@q@)F~~M#Tpq6|%-N4@9&>#~7+#%-vy?H@RqdY3H+&_r zq}pgrk~G1bD;by?B^er*lAPA$k3)G&O1GtvsGf>Li>0X#yQ1gPw(HugClvdqKdhw% zE+lU(Nllbtj6+|`s2n>lN}|W$KjGiA zk<*A6i`f`6zo2#vq zO6%I4ElzFWD}4NR2ygb=`o6#Y$=;{`zhXP;xjO? z=eQm~PB~+eSwB+1`6rw+_?a%Q^{8jk@{@eHB#pU}AbB+B*>Kkd`vmV5gS2P4dM8m5 zo{2-fq(UsQhyeqkr;T$wiVw5$DFV_LgLixKMeVgH4^OD$CW%nqAT~Q34PfyE;Aiq# zGC}9D2mM?#IAlmnB%K~lAER0jdn(eq5_w9##V3_N ztqx5I*)^Ly)tRDI&BX;;FOfMow_%vZG7yJ z1B=1Iuno=*;!uO0i5hz#LLr7a*fNOD#vt^Fb=yJa4h-Ai_m13cgwiI3O8U85iaX3L zQM%o^AhS8!MLM~uG*ZW}G;lmdu&Y%z{k&bwtMnu8Kr=LMU5*Nmn~u@Nup50f9dL%tCDYpQQGQFFVMa`_}{*YE&n z9bXAiSXErDM*ay!E4oHNk{7I)YHQ->&Pd-Mx5du9)R}M+!!pj)e5Jk3_mu||Zh>+$ zlUiqO+c>b_gdh>|%c*sa54F4uVx1$DT)^Kb_K}Q}&y)bpoPX`J(omH__B53NBIBau%U0|# zgLJczlHxi$tPni_{-5oQnV)ENLBDCbIDQGdXbl@EV0Hmye!^}r zq+JYtmPyz*C6hKhgX22{%$1KVoH}={Tm2TXLxdb+a)eTS$^10;MB*;l1bn_PD{k6q zQ}{8fQ_slw*bsr}rg@rYs*F;2NIonX$l|svrI)Q7uYTf|dvW`F`gzbzg09L+NW&|7 zL!I57yq&eC6{VRLZW|fD5tTqZT1WZIbH?tm0`3d$*9|vsSt=KhGw7YaoW@Nc=S(P% zi5xFI1pQvq6<^u#+CAnuBQ+{CX)+M?qz%C)096Os?v=k%A6a3aLPaOAs&uj^Rfve8TYrL`JKn^*az%*G+R>aC9CADa5m zX*-*kL9{=jEN+04sd?vYAfkFx;wQq`;o8Eot`RZ%olO4F zQVjwRG4V|QW3e9os_V~@+i*fKXp(iypjzGYGQ^T(@0h4e$(ViA)sMdj+SIMM-gIv7mtsC2 zkj^UnDv}!+?_R1Spn^rgSO1u)+4RLhiAf7hlSnYX?TrB%5;mWKUXl;orVeK?*}Yay z^P+SFkQE-{m4+%;`xdq^sa_eJv{LXYji*j%S@&*>u=HO{k<&sN9}v(m!Ky>k*+j(r zKCXy3K9jqEV3Y7L=%jSG%*sa~s>g7pCF%0=v#or$NYwfu@*-iovdlira#CQu-`pzu zH-l+K9E0XGW*iS~ZNFf6LS-^o_e4T%BNKcZ@aSe!LMwOu3k+}kdTnghFn2$&gKS`+ z!H5+u_^RzSH8|N&ahC9-YKL?JJD02I6BSqFw_AQGZcK5lQTXJOtT4Zr!*Z0)!4pX` zY0bRI=(?NO6qk**9;b>zEP@0|qMzGBtL{aOx5Yu*2M0Ji%0yJ;e%7X47=Gk-8w@DN z*mB~|5K7v7(XztivIt<_IA2?8}RjTCfH%g{o z$OVXERjT-VzDrZ+*J5f%eJ+@`aW~l5qx*h&DmF?-y`=}z`E@@^3d$Oa?89VuL(Y=Cd!9J$&6L&SCRPfER13R# z46^WeCVDHThU&6a)lz13Bc)}XmwY(bbMG`)K?CGmV4F#g(aPA7# z2C%N2KEMe6tWtJwsir!uuIo+xOPAKYf z3Fm_)F)KnYf|K_7yO&9lx=Rg6{!Ue*H7Q(5+eGo?ftnrVjbvso=z}O1h<2ab_w4-U zvX{S~>;8VKCFcC7#AhM#b(9t7*+7`6Om!-?~TdxQYu#Z=BzUZ7YNq(v?iqqa$4DflVblT&VC(A-2 zOGqqv`3&Fk7&HGNP{e>KA9pp&0jyDnMIBS9ZR@R2SKf;MCg17BoznqFzpsRFc!{9u z-L*cG+2Xk_4w4;)hxbp_X!>eN4)R*$1Ux6bvJNS6Ma^2|<1w+(Z8D_n^YE|ol~NmU zALbf?u=Z5_S<&y8n=q4^>#EKn-0)0UrLmYU0H1tb?;Z06S zy2d1>^bFZ9tGD6b5eYH6nyw!CyW+@#s~R#J(U2ShRWX7pLAjz-CzIc(Qm(~y-^V*| zZZVy+LGB)_?-!3(Mq%dU1Z>?DyhBiQS?G!5zpFM+hq~Q}r3>1*37tlC`da~bbsX=u zP&T6xTww_<;k74p=g&qr3jkooB5?Sg|(Xn5s4 zjc%8HUUcr0^O$1UHm5xXY4CDmRJRG1jyUe&47})bdszL*<)ra-s@eplm3h#~YKXl$o&=G(q-sttK1P}T z4S}b-PtJiWS?$Vk!XPLveq)U1R`F{wl2GJ*e0N%q_$Q^ET54^!P`0$fFj2DF$+*Abi>xQ`Nvb;X7b zy|QaQybIaOztA`S1}e|ERG3%Au^?I!Wf@M?a&Wh;PcIza#*%I#n9?l8DL&YY&Hg*9 z5Znr*rOdV`LZv4Qco>Ge$Fif=UY;m+5|RKqp0fOj`=?R~m)jK%KF1Zi)AF8!`!moB zn$6y_S#Pz6%B)B-*0G%IdP`!<<@)ozx6T0HCu?(Ah3XJAx-DamJPYF0RLvaV`m$YJ zM(~6ouSMs4yp9g0v6R8=INQAgS*6+#U+IX%h{d>FUdWoTd=-T<4T|^gB=@zV1f+Da zu7h@i*F?;G%QjiljsW+&WU=|aM_d|AHip9c(w$!Fbi4i zxOI+GYwabL(zlUoU>tqYbozytWJix{wwl$qWMpDOC@TF4KGW#!c~QlPChEj}c$pxk zA|XEw>h)0h`3dcFsm*N}Ti=z{$zZsSeo_Tlqi5nHZBhESh5LGO&qd*CtSC+ObK8w5 zt8AA6`s_PWkSAhVS*z#go|>hSiFAP#Np%!QC2KxkS=!#58J2?_5YdSmrxNRC&%s&#Ec#^)N;s|ZrGTrx5Mg&>UoVepJzvy`uLSe;7AObX)t&uv zPIMb5Ei+2<6E%VD*xenQ)ATE+ehnZI`njtlDDFguDd=ISVaD~-a^1jD*1_*k$?vuK z`H}-&A4dRCzS4==E|d%Vd3}-!N?AJ{Up@^Ll=K&&I&+Rp|8sR6Vg<-+#x_!CmGM6X0oSVkkGfQ(-C zeOk1Aj9Aq5#bj0oIms>pR?=8_F78=dBNBreou84gIZ-^4+E^508_j7!lz*C_7Vy)7M^aW3ZfePb`?Bk4 zU2)jJ$tmZ&u&(b_y2ecEl(cm+qIDKVs&NaY3iSYcXcnioadFxy(!AZK?V@OjYUvvrxP9%-|}~Lbc#UsUcs|<==iN z;C<(EPwp9k_&Z$Gj~y9GgJ+_lTs9R3(!L|Y{6@O=TXpeQXN5~BY3HqN_r5-F7=k*( z;*6}I!}RhS$qqTmG;bR;5xROjvG;g1xQiDmxUjRPL3eNGB(cQdsZTaqk7PFSXDdj` zQ*G~1yf(8>5;6yy*DgBraQNb`$ZOP%*>$wW{ja{edg5;?=+Ox zooHR%HyKeo+v>Jc)U|On5gxGx0fp`KtA*9c-mjr zw7rG7zp3g$*%FEvp)$Jny*M9?PT=bE5=2CPhab9 zYjfM->~gk!emVKkDKMqIo$f^lBC(OPg=uyeo0K;i@AP2#6HJ9vO__2tA_mk{^y+7A zRpVYI<8#JGj87P!bTAQw%stnRkyHq5?y=Mo6LKsEK8F-4B_w7XMc4lTdYPNlnibi{}Mu1`|l(>@ z+a9A&Oo=&`p~vLSy(gFC0C#P8{feD}kHJL1W!Lyt@N`_@;hJf9rQ>h+I*0potv>q< z6^Xd!VFumpyOG*2QWyNbfBYC=qtFOW(B!!!4#y)v?(F_7$<@ZUZF(QTIzU^iU#SyE z0=d5*7&_JM*XO6JmPt>0TTUMC?qI?C7MRGh6|sB)U>9c=AJdv!;EAB4=Z;-7&SEWF z;C4+#X$^(mL}9rnw}X?W`)xP*TYe=aqq3R#KOm!nKZ0V8l@Irj73N*D<4D;?U=Ed? zN(2yZXs&4zHZDpLAkRTf!y(}B@5~3M1I7Oo+`~5ffsz!g`o;-)v8=9rlu_qx#WhNCh&zTYgvOY*W z(%ZUo57T3QD=y$p5SHA-A)UBkcUws2?Tw3|r?CWl(RfQl$krezvK z7%zn?X{e<14>UW zb2Zi{tNYk9lHgBoz;MmsL0Cej@p01Ff(-I1gl67eW#jQ6Y)rN_9N0MR{*V{|Z9q z(v9hU@&fc)OY-x(DY*4t%RLhWYGbu#T_LACH}U99&6iDguL5W6LIbzDQRVe6X#eCCU^+h}C{3^UgWl zhYm&pBP9tyU#Gt;SqHs=#6)ux0cD+Z1;-`k=jTzQ5K@zAnIADb^;f1P%g*MitK@P% zNo8{t;tR*f*s!sg^q5W0c`-Cegw$#~j-Acb%Ps+)7aAn6bX>^YWIwx%%$U4-=Za{g z?7Quu)d$aQULbp!Z}X^)ryu7%x83*)T;kVdd-~~Bn{SJe>!48Wn~86yA`kj@t}b^p zemyyAyF#}?w&xniY+ymIfPQ!n)>4L;yaSaCWpZpm0lr-(Sz&+7A2U_Qjr*yX->~mVj%K1`a-g>dz zg3y#s)up*OL(5{MSNCTMq7bbHhE~hRnj((bsZojZZ+JY1bEnULW$$>qfp3^yiE6q~ zhoO)Z++ZbECL)=FcEXnnYt``tj`EX=XAr|&AKC!5E5>ih$pdJ`La^B1h@+zx;@8;N z_(51zTtWhpY~)_}COd+s@jJ1^7N5jY5cx8KQ@6NW>Uf%&;u+f=pn>vKWahc2!&es? zoD>o8Ly2OWYfuz8kGe$p?0mBf{v&mwDdCwCDXEj1it94Adkm~Pk#xzqV^5>4k(kQV2vIja17W%fn6A5a6_wqL>P6RZ?)~6Rs zpv$G*N8KJJuf^?J4SS(d2i&?#nZs&`2f8}#wOCq@ zme?+@YhLB9NW^l`(KCU%W$=DHF}dhAfgxtD(h(O{l1@FVK`5DBf07hZk&N z7!C8NC!^VZ{Ay&%vvPa_B%2u6uYom6A#GNh>z@6mI`;GQm@nf0%%d%zmEXThN(=iQ zrxv4Zo_%=I#idp+xa1q8M!tNT;?@%%Vuge@bW>YIGIJ^4r*2I6`_5bYtMcOD1y8Ot z!D$jbvh42g=4tkfWrMIntX#rn!UsecBRO-_lZ=g>1^cK$?#by<8lz%?e{d+%4U13h z{SLKiJqE1oY#{I@g*4BEQQ$iFd#VqR4X*_}HNZ8Dos21`)$oa8r3{W56As0y7}EF- zoAckB0K-zidPp$#x!*8_o&B3=oPQ+dVM9b%>V78KLJGXr9xQC!xI}@&F4!Y3n@Y$_ zrsTU7pFg$gd*2BRoE#aq|2qa@nb|$cYQHu&YU!ishdF??tmr?N_P38y7#3%%nR_x5 z{y+N^SWwuwE41-t63{%O|dPc6-)4>{`yPrb$ z?%g}{*nh!6u;>BceP;*j@cu+jNLL6^W!_zLtd4gOWKY!b{s1q0uEF(RXBb$tT4q%2 z`T0A8X3q*ByxCP~0=E&W%9&yzVd0*2(0a~4z#IUq4&1id7oC3QKK(Bmi0PZsnEiji zg8z?R3;Zf`?r;cO2%u|@XMc^L`O`hHxB0;3J1rjiJ-fdF|CUq%YvQZR*{N15wPc=}Vd%E&zaPZXB?H*bq=5|ZE5=6Q z6J}LwJ8vdjwkmpOug+wE)8cE=d!%-xWT%&1pi8G8ovK=SDLf<5fDU;a=D4nn-dNZO z{!cU{NuO-BQWuzoD9Q0W2QIL<0Ii&=Sc3G8L(9?R>B&j!NeiS_-c-49V>ffP59Ra9 zh2Hd4{MvSWk}rpk!RVd6{m2B}NLSIN4(8ZxOdU+yOjPK9m+d9iHX-Of&;+#Kuw zi&uw52VLK|b5+Z~oei{I448S)!DzVb762$jZvYH{dpl%b9)1aZnlS>wt7Dt2;-(NE zNal@6W)}R&CWnnhx>27ZM=8jy#b}ygJ-dn zJYf41BGdM|n*6dSJsv?)PUICw zi4N6OONg)iOk~(>_KLgs-}%gS?W&=W$oQzf8xI7#Q&+qsvV0Q@XBjIXl7PhlwRhro zbpp>1XN;u?#EA_c>BM^w+JwjSjm0Pcy#7E1Owlh3kosTkAULuK1o7E&PRaH2%eme1 zBA;ZwTHAQg6O?<`(#pGESv+s>@%{s%{?%3GPWQZZx8q}3KqJW6@NlnEo2|S2@2O7W z(RF$wSJklo31fR>cZv8M3il>f5ecQV;rB&etT0DV!FqrKSyIz#q@2nByoZ_W=hH2)tvWHW|Hwv!i8Gn$8xvoz z#js3&_4&YK%$2c4n~znzRAcUdu`$99*^%X%zO^f5HQlH5qpoV9u_?Uo>9v7~&TaFM zi2Dvt1HUdZ`qUSxKYX1~x$9)cG$_T+4IO<{Qxd^y_Dar-^`2CxpyHj;bi?(4@ZNCe zrNZ&!EG5rKhrdVNi4a`p<7Y+0c!u)uh+%QW29vdW51k3UJ$6bQd|JPCWW zo0>7Fe~annO_o8(ZNu-oPXKHY8K7^J#<#R*`p9{H?|n~x|KrhC9^99Y)8nSn-?5fh zGjikw{>0hM_sV`Y62>7J3K)dzB44<_b&ZgBt-U?#?5MoYzWH>`b&{{gtZKq3BY-|kIs4RusKH?Bc$vG{yd(5Xp zTnY@Z$r3QB1KlmWN%p6aBdp)Y+Gl%=^6=jeNN>gPtxR&~FV~kx@5d4cgd}%kZ#3el z7Ct_0^+wf930sqwjZ}f~yanWu(xC}y9K_5D?8a1mX zzW6gXN{h2-Dfyb!d03dmGWdA zBHLiw9q?oLb20PQ@Nnio5eqQN3d>AbC?!r8^3x-)>HgAm{OU7ZHjyd?@1J;-Sb@N~ zg7B8@R5&xqn0gOG%A0tkCy&z*agBZZHS@=%ZRmV%L<)$))~aTF#x=Qx`%;2NQt-y) zxX-#JJMX&ctHh}^bvu))0%}w(GZRo>0WyAAb@{KI{(>N1(1V8~(?tU}wVXc{i((fy zq00~q1~c_d@xv@aG^DSei*MvjcTz{#8~-wUF?jIVKqUh8$8;z6ktbk^B*HCP{%3Fa z8g0N}WQSC2MGT3#$5bvyR!v>#q7Tu>5yxlqTQ8m+NYTvY&d$%BE%x|smelp|laHA{ zdbicP5or#LV$jz+F-_Y2E+KAzesu2R6d~I=z^*}i2VS>4i0~RQtfI{l9+>ED0~yU& zP6XTt9Eqb4`Dt;tkyY65Y}c^QH%!osuzMqf>pI`5qb^p*hO_l2L-;kLSCJ_|N0m*x zy6Yt4<=$~Gy&&RoN96O*cVkGc=iaapng0w*dJML%BHW}2q7F)P(jDIj`Y$HboINjv z7hH2MVq%9p;QlkQINp8WZL>Yr@=x-AUw}9!W8&yG3GRZUhHR(!o36RnTv{%(R zBK$Esh<{iSyGn!!7E~qVjJUYo$xfSYrM>;zUMgkJc6gs~i$d|&w|t{hQ`RjltJsas zfpjIO{JKpnUgE~v(5acG?Oixj=oltBQ&V^h-8#d83zyC zW|yP(8rw6I6Uy+Wm%-cq;%30jh`&FHnppaDaVaK3P+HThJW1HbjM{Moy1NM96@h5p zEj?*lGEGJh-lC>TqWM^!0Ue!WpE`3~_z=3vo2>Y_rQEmmhhMT<;Du+zHso&HTvgXy46hXGb()XHX7=j2c8W=Z^pabj0!gyj)vC4%f@pZ+^%W@mb-HI(U)y1FwZ+nM zZgQQWcY;I~lPwB>aF)#F|0V}cEg>3i;-g;rJeczBKGy*Y@>BL1kI|u6)fl6EsAC># zELyG5^;4YP7gD(dEa$bWtG49X`WFa$UdUrOnp~#x3fj%PRgpYNQg+@QUp7tYcStL- z%OG$l8|h7R1q?qSA+*d+8}1cREHdLJk*BT174gA0#cZnJOcm&C5GgIoVxxd&h4k=54cji_}a^GY82?Ykf*Z zH00D19bE4n?ijD@0D5Mz*Zz3)_?-*gMH7J6;Hf(`Gg06^2Bf8_Es-ffZmcooQHZl4 zkDlJK&0*gaC5ArXeN5jJ92OJ$WgXSi+IRUL+_^Xl_s57mSE6%<po$Qw_}5$%KgWo!>qsv`__l*(Jkj!^*f(&u2w_yP)3@(!Nq)_xP!aNd zWi$?MQ@3(jG{3X!K7;peW$^ubSyp%`b`>cuea5A=6RNhVpO)|4Q8K*?(?Nw+n$+4p{E^LL=|??um7-#LGXJd0>-5={<5s=rbW zeXIrQSCOu+18GOQaoFAF%?5p`_LtfG-Sb$7i1>;Xh9|(B`?(i zG`6zkgxXXF)>rMm>*_B#GgJ~odbiWX%eb1>wt0A#0rR(i&a98~UcCw8x9zMaC%n~J_lt?}M+ai=ynO_(_PMB&rDjL^snaVmk1Bke zs9o>VNkj>QYCaO)V5vxktI@}C7g~PH;pHuS^_-Cx#G|_yWoGVner!hEq?{Tpe6QdE zFC=QCe281{y*r}@?weaaZXO@XFQN@@vnKoZs;e}@6CR{eKpzlhP|Ce(jtPd)>3_R{ z*kJCXQlVoni>Pz7=~!h!a_-TqCBEKbt^1B&#~SlGdl$mtI4#{8`8Z*7IB{{Az{y@^ zc=PwVo<2QTuP-5s=Yx1gwgr)9#*e9a4@1HOSJt;UG(<~oJ?N;2uwT46LjL0=J89|J-=~>oEvo)BH<35^YF1q8RL8eZ;iRgD*8=G?d z&h}9MN`p0)67D$c;@4cXxTQIKi`z0hN&JjzxP5lf(XV? zeQlFJ_^XG0Ib2Yb#{omOjf9|j1#S0qH@wm$mFi1hnzKHoWe?Uq4;|*A)Q@(SoW~m2 ze4%R3~-5a|D_HJ@nMI6uz=kYHlC%ek(~;;+)V}F03$+K*;?3 z&ookP5A=M9OX?SZcO@utcQGf^p95X*rdTMlEX}9(0ju6>*D6UCHy~hV09z)I0QUyq zbbx!ex#38*K7Fg{3<}P2YDZS6c%nCX6tS*?doIj zs%#Qn?y#}V79`+~ZtJC|>9gdN6kd|%3ERzdKS3tEH7h!lRNtIhK*XVtn?{QVqQ;AR zsiKrpR23i-%BMbFRMu=Ng?6v@>)$fp>>iOxUy@Oa*?CN6pYA%S10L*u~CA6wMw9H&U zOh-A03kW;QMMnMicJ~LH@kG+}&ExA^nds+m$LlA;=t0+eC%?bvNWb7_$QxuVer!mS zd!)jz?FR)E$omI>Qij^;X-%T@*}T)(fjFFs925snIVnyR5Cp*`ei1;{)=i4Mf-(Tn zJ7`;tToVEaUE=|Tzm~5*9=N?x$*e5j+bc6T-wIyv2itS3geoL=E>5<^dXh)*1$H!= zrso`4X_VN7-AbGPAO57crmO$jnFB0UjrjP98+!h~nMeM_uMJPMfAPW`RJ#HOOwGJwan(}qai)2`GW)dy z76YskQ9RU&)M>q*XGdX6*k!yEA0QKK!H3`(zxNLK9YO2`rXsz zPvRX^swU<+W`~Tj<%-fP+P5BpM;Hr!r0_Ev>#Da)9R~we(!{(L{iC~eV-pki*OfFC zhdCk8dftuXS>x;Mz@LlkSj?=!2;n`l2az~D>IOJzj0?{?=5y}AdkUyI!$8+2*O`FX z44kWNB~FbizHj;|rIBDWq29y#t;zxO0oq&lj+G4mt;>KYAmw>ymnUtG*CvBTK+0k- z6q4NPF(0a2{v;{_OTn>&Y03x^2+CWS`L-0+VkDLhF6t;7U0u#{^9 zYU3VXKv5_7-=sA#bqqgo*x!F;?rc@0iR@G}E7BzQ>(ytYu>8=Ky#&SWVH>#-aOVMj z?j5->gAO|A;ZJuUYfOwsqL^`0ff7cYgz#F=>>5yYMn;MB*!mkxk%pZf!yOR?gv9WD zXFc}I2aEq10J-sn0IN@Y7qVd-4)=}a_E@vaQ#eck9Ha=wg3{*3-9MxUZg5IV-+aXB z_9Q1h_jXdy`_7Z=JAwO3tWwYRv;1}~T<1_h4ALt}j{iRlbNtwzQvjg!;NkABy*fvQ zwU0rJy0%?;$k|buAHAPaHB&TU5^udkuz)~CG|495Kb{~O4Jh#1mh(hf{;O63tVx=l zi2$qbkUnmUxi~h~<7cGF1tTVr^SM0%1iZwPJmCKNkpNC|M8&%fqP`O2XJg1IaHo2L#mqdPW>t2c{ zl(M)tdn{T=L2Ez-0A%b3$bP{Dgw0ftd`L0}^(}cW8m`xp#6$svaOO@vIQh2bEevZd z5n?7w5+938kL}-YlGBm@Q%3EPE<4ga7F{nR%l)Cd#|pOM>9NN^m#9JIye0?QO~1Af zb-aE%NuKi|@UrTPfNlZ`J`@TC4`*YL2{{#10qmv|8v*45o1eKKYANNO5xr{?x1YQ) z`e#k@OHEfF3)!XpbdVquqO`f(>wzy1m*ZGP;QHA+?Pkw+dEL#Ei7pDzYJQ*7q=TiHp zX5=onyDXcrfy99vZe{n4`xxgrTh0P8H*DkfgF#c1m{mNye|}TNK}W>&Ghw@i;fbjnO|B#~m&wBs=gB`ZEHF zVr6TuM$EfGfSfmd0$goDxr)L@-`|Q!TKjJRH*X{>Vg-soPigVQ&mSNEGyv2D+4S6- zNVd}J99ulvXK8!$ss0lTNww3Q-JBa2vtqlcPlqX8_G^TG3Ut~Wo8w=|^wS+am0A~%w4WX_<6W^K*-gZs&=SLnl^@DGA2 z5$P4XtGs?QLy`wSmWG2Vjq9V@+s`crl4hc@I(t}?4b3N9fTZ;-V0GxImc%tvO7ty< z0_E0$LpcpZN9+HzayrTRt_?o%R+Z4w(A%LL_#J+eQ_GIl(}7&fn0M9jnaAtenHUXj z&)9dwWziQg+p@ncU{$?Dx zW}6@X5EzCHls2rH$IC~Zqfl!#BMNUG*(3pmdkvrN&motB| zOuwf88@H1FEKsRK&U|N|> z^d-iUfI=#ZL9YL$p3(g)HudA2AK+0<;`Qqz2Ot~>1!vTst)(L+M?baVOXYPPU!MVt zphpwJWGm|FyUEpe8|0J;JXlAG;DL}BKoDxl{h<0QAUub^Tvvz9@21>amrtbpMaTOf z6XX1fnK#J~u*;rXtN+jDD)9hmE?brBY9PYOWw~&Kkz*Mr#I&xh6dR#aX6_<}dN<|X ztS;ZeC&MQq{6+l(X)Zt$h6!NY-R&aj4fx)Kz-*hnz>^JW1JZOSq21I9_h8huM%Dg@aBTlzjNBBL0-eIW;VC951u6v&M?6XgWtox|DE)?4)3w<* z8%$vjm~-9Rk>u1{Y0cl`oBvVIk>Dj4E;}m7S{5#S_Oz%a@fn%I&0E;gIZw2>@gH4V z3WpduJEcBa=Lx2A0o-wk3~KA$hy(62nwq{K|3I-093RW`)i_9>T*GCScJf|0d z1U4T)$@(2ifMP$eDbk-#gK-RqyqxVv#rcXwfn zEgTWL^TvHFw5oQhm}xWR3hLS+?Poao-01P^S5?hO5BT;^V~HhPvmS0PQemf>B@Yh0 zFItR}z<~r2_B56cr9~Rgw&4zI<@xy0xRQ`Z(Dc4`zh&Y0z98v~8#(x-Z_2?P-Qkj9 zIPpmgmTKfuosHTtTBr^ak0KY5yu65nFE4(JCcJS>a;2NcAt?XQ*{K+&>Io2oA(-={ z$+94=(LrRoUm`Uy3J9YeLFhMpf9mLI3Pd54-E}1-*Y}=~X0E)46LAZ4Vuoha#2Uo8H2k zO9#Akc#In7-vuR)aEG4qG2wHD-Q*$s$nZeP#+K{@4gNh?j+qRl9X`$0whDMJ1F+WI zbJPfwoEd(as3oV8uc@)z#2Dbozz~^Y3HzcF_?R-HyZ(ZwbXV$DMd*Ix`#5_N!??N5 ze4QI6wK+tj-waP5(EnC%%pW~TEu4-P6ok}K5#*dMn}5G9%TMp)_}@B4_+3pKISplq z!BKud4Q&fRRomp5eJ-?f&Lz5=4)68$Um0sO;pun9#-vV|8CJ%MFj#z#9AtHeOv zt1DZs?7At-w>J~=T#`KF9&R_05)wFOw zf`(^=QL>!mtYTq+5|`h~TfN`sUL(hVXV3Q_`+($Y0_ z$50ZIN=kP(NH+>dcQ;55!_W-t>V`+w&oz~GsUc=3$L%C^q2 zQ{>F`jBbH^$56uQ;#1?S(N>_CkwyWi<~AoU@Vx8-ch;m+ys)*k)ufcsVbMNL7PRLqUOBCje7JK>xg(1I$$y;c&sUk`59*NgDaR;66w({>v(u z8_Bf83aH1L#E2*P?VpWkv~8lRo4Sf}y;VLpO<*A>m| zPx^A?+D4xZE|3rb-hNLC3a$VRv86pzR~Om<$zo(GCxZf0<&9*jg!tunVjCfc6Xb^+ z%?DLdln|KM_1wrhZ0+Ytj)Mc?zscEmkC4YE-#*?zH?Y}_`lPi=s;xg7=9fXdksy2?bct&NGg&d{qXBxZ9Y2{y`G~!oh$8`A6W+A zj!kjaCujt1bn}KoU3RS2m2t8uRunVBk8VBp$=sYUKa0G;DVNXfUEvuPpc}?`8hRVb z@v99L>-+}!bFg98K@|Nz(`2@hte&P5F#qT_jtpb6<)5wh(~QS0ME%77?9B|bZ~uEN zH}T)+*ZrTO%s|de&lJLE_^*W%5%K?qlO;oCr4ihd|NQm$OF9G^{GTh0VjjZw|M??V z--9R*N?1?;&guDE-xCd1t98MD*SbnOx&RfUCry$Dqs*gU0BuxF1PV;7w9b*I=#*CF z@il3g{|CjXasu3$yPZ56Si;cs=zQI;uMbJLLLw+WBGZI=nNJbnctjV3UbTd7CW(P1 z7AA~w#s=mnpL7GvmHksfbd0jBqW{`!LSm6@Yz`KIl!#zYsOA3!i|!%s=|9iTK!$+7 z{yPq_|EB}?zs>?8xc%QbP~djqN48=5aa*^rKXsP{8zq;Oy5`66(WWQ(A9k4$Igjll z9LYgY${^Kjgg`7)Gc=3solw@&{%_ZmX=hj0`82m>OX{0d43O~d-d@;=HXxSt1c1Bo zL{7g^0>$h3jeD?D7^%DuJK>&AT~A)kzO_f-A1;4md-kSEHjWY2Gehtd>IL!=)8srpoIQ0lG~y~h$10i+p2mivZ9?euLfY*G{p#SAwp|SivN+mjg?nK zBQG_(J0c42CU!F|4xT{|KBtcy+o$f5x&q985P%wWyFy5L)%pR)V-8-nueRB8GF*dj zQPMrO$b^7mV$9F<*_-#dn|HFqOF!Z}Gn~+Zi>Xm)^Bh|+fYC=^BKGKlG}q*Z$qOx# zP((|H%ovH(v~~}QE47#TdZd+kI7YVK91a|rZ|1OUn3l>*lFwAsaQ!k2^7o++z($GX zg%F^N7za5Ie5#9ZHTt;w#6q1qa2P>`YISZFvq&0 zmA`H^>-imx0{H<<>8fSy7EnZb3d``0_1KKp?AgS;c=DOk6(EQAULGcTY8a7iXuLz9 zIU83W&5qk{&lf@lWW8vSRK&#hAF;alof}@8q#ULByicjWhzmicGsQZ|+@Bm+_}*0A zS|HQha=iqLnm9&A@i3z7SXB+}Gr2t8biLXwKqzkS+ud#1t%JX6ogjRYf&53QJZpTL zfQ*=?4Of-TTs1to*CS|wVEg&D-5Y_|jkd}%B&l<~LHex3B5cE!!$$zo7@Wc@ELI-v zdv5Mae81JC%u2ig1b4lXb3<63UD9%=ISs#A(4+S8{en>*tt%tdNy~;~M^gIO0VbO- zf7ycF;O%g`IWIRiJ6&;-H{V-NuUPJ%&R}Yvl_X%SyCTeHN3w@sM`>9dwSlH9Q$)}^ zn&s_1n_ic>sB7Fvtcu(3bh(+hfPyE?xqmFJA9|^qa`{0A&KD1w%{XpClA4cWvr%eu z@}+47SU;wc8{`kGet&RME%UQ<{=fy}JQ@r4`M8rcXsLe(Wa?96nvzYFbgIRhWR!Du zO0<88p*i0I@E>XAw|Xu2we9%)L#(JmJ!a1^w(yOJ@#*|S^r^T#7~fUG5y)ux)2!7; z!ti7J{y>g}<8S0W!iHpcaAB>Jj;P0LfuvM$43yvYurw+@@u@myYAhlS^s6?uQhP_ z+oikAB8F3-cQ2~bLtvHzZJTM=@!-X?j+NV`6&$RU)P)8KM<17`Uz~(rG7Tfml%Zh} z|9%v3zeT>=g&XKw?(@@yysh0p>8W^VYb-zlpmUDTrG!I4Z$w6!`7a4y@dcOd{4%M0*3i7p6LS^7+UI7X~0cYIr*&>f`hHsPQNwBrS#_gsQ3#_pv zEKI|{E7?s1r9=1P2H#HrC6uRfM&Aom<6XU~`&W0} z+ci9-YJG-}#2ksMbHoGvEVX9s4GhKGz9drl3(~OH7j(A*+S}X(g=4{I>yIja-5nf| zCFH1)>qbk?Fqdb5DgTm36t0yETThpMg<;taJ(CnE6kDidyH-v(q&m*R^Ra*nnVwsx z%)Ca7XoIhNb4{wxt)LS5W3kT^%9<-H^%cDDdCtV$pPamERi2cqE6@@8x9QJwvQOB+ zRuXEc@9xUa$L{O<_|FK-1OyB(<2mL!SW3!f7brmAt88>qOwEVtu0+o36jZ~9Z2rvR zf$c~ZTItPegG0=zdOUL`+jbz@%Y??% zC&DgSx4$}*uuLTt_;#*=L?Dh0n8DR}V%?`+$5M+$di(4rWoB@Bo9F2F#!1piCp=^| z{TN5O16mobluq^)v(*a}uO86!e0lMD z;mi6vEnLypi}t?`xxZ9b4#~&UwUERy8$UMfX!>@IcR|rl9WxkmTk@4FuFltDj3?pr z0j&A`Cn8)N1*2~JMW<;(+Fe>N=yqa6IuL4e`c2%kM z>fy(hrei#jgoKJWxI!izbl8zZe4j@sjDOP6-_gY;qSd2gf*O1XH9GE`@;R4z_CeQX zZSD0?SI>k|tJq@5i%2})9u{^akFj)iY5D^#rGMb1 zLV|cK`u1Nf)MU=!gbiXE-2q)gHnarBh8LgTZ5%0dj9icP#L0y%<@iHLC0|=Ql(}?< ztb~5Fw5_t-G}K|`D+#Jjte*aoD=wu&duQJ+!T8)#nz>YG{83jTi@dwAz(M>02jW#! z!6CVuGPk+Cf|{dSSz19b?X}t#PC`3)B)gOK}bZTn9u_FfMB;xrmSfU#nKkEI1t6+=NWRY<^Ma%R=O z>HN_i-)3s+TW9LK9K#TJd&TCJt*OY8kSG-cJtiC&oEUKT#*@PZ37-zIdc^DNY z_?+{v%Pf2SIs>Rt+IRv9dj0r|ULIEA6Ck6k{=yZqaqoxX*XI|ZexbT*@BK-JqiaBF zc!Jzdpl>HBPtfM1pW%JncjSUCL7IhBPllI(6*`|Q_03+FgRIgEo2j0C?R9xNDkkm; z1DwOMiRkeQob5N3_?(H5$1{rUQ8WUv86&8CF{ap;vBcLkWf;#cZpOzS4{VsqFs=&( zC(z|e%~?cPWB9WHXaeKy>YHat@**>xGH%Zob^?gosrhu<7iN544l(^u!r$_7l0P zpL#p#pY9*!adY==sFi9sor~#Drq;so4&78#sy&9 z{&cnuQd$w5KUNRWsr=%?IAfMGWZV+v|6}>o)n&HyvRRw0u;MWcO>NI2RbNK`zssHD0KZ-<9Nr-9_6jPRgjIZ;5*SC>^GKacM1<7u8gphy?O^HY7g z7+?I<{5NWYK+x|OiZ2I$*7ME|CLBe-0iwGbPu8(BtUk4Qd+alOUBFA=QJ9FlmgOUU zZRF_>A+ycr{P>T3A6gXkJIR?rEz=(;jShrOT-8DePJqa4qHgpo_cN_!{0wvlbRh5R zI}Jb1k%!!;XV2&!f-6QcnW+M*!|P^(oNEY&fB%m#zyRRac-$5yPvGw#REQdIlz{c8 z#IP07*I5;KB9PacyNO*Rq-f5-ijMdNHvUch_*{~lKc~|#oYxVS)Bg$Xy1sq zPPjPn;5MtEA&wSfk~~M-4^!)0mb`&Lbz`8>ALXSw^~3o>4;p^V@DN`(1|omfrv3K3 zMq5&tywvK!AOUnh2oT=43Yu2q&DBhM9fDfU51KcrMRExKlnNKpM)29Sc$39^?_423 zy&K|Q#xb=s)kFlD{Twj*xz6B<{0*ln<%k+OYW^oMfPql*X`gcVdsI{u{2Flni~u=f zyPMXU8Xi%8-$M-FZ%r!*fDPUd8T9=a(N|YBZEfxKqPk0=XIdj_)l0)s2*{-HnVD6x zRSk#8VFwB#M;eOmfqe&PG*bz!htjajX8 zQ#E+R+l6fZ!?kGhLqod1?+>N-j$#~vun|vDEjxJiU;Z^%C2pVN7msQ^i=y?-LkY*C z^W&yh_2!>`Xf}unv!}mmN2INWQ?=n}Pyh^bn`Ta^i3oF%bv649`1WkZ_&d6Pfa!Cd z{%s)nN`5P&RP~4GH61!bv|S^20Z7MorLt985WLpb=PXqzZcOQWzae%n zT!p>>E4+G0@c0cNwhbKuW|@DpyDSj2RE+^aZL0wZh%@M|L{%fT)7}i--QM0-m0-HO zNW<54!Kc&x0^k%p>o6d`<+f4n;pLHn1nTCd#-3n^TUZFV3Qmx>k(#@QN8bzF$tU@A zKt0B%Z6%~UER@Foa_l-j|C8vWw|{7?U0zE27up-cJx-h}?{#_fLUBH9^T15Xpp*Hx zFJfn3cutaV>3}?b(WGiNZlu%Z<-;VS?a_Z0bolz(6Wqoz(Bhk5O)&0|H4u&5oB#Yd zHHVD5uq8%63>sG&xN!}y!W*Ht)8xSGeW4HnYF(N$%N3RPXx`G2Gn>qWWU$y)=)G%FOXA8d5bZv_xn{fwRxw-odOJzbxD&jncg^Y3|id4C7azRaClSZG$f z{j&hsJn|Ce=;?ELZz5W=rVB1_~LcZ)PO9%Zi;hHP*@sq%CsvFqmO}e*ksFVrjQufV_ zv)fxSX}YsdFpP&C&f^;*zgFl8cFfYFu9b40Stk|(!^1w$<^JZW@K{1(@6|v2*qoP8 zV#;q39s~z4jaN5k)%1Esq-u2djVUXBrpmj*U9sM?g0 zT`<4YxQ}gN=UY1UQ(-=xL6{4Na{mL8vO_)P6 zyz-}jig?moPd6EdZ=)#W7Eq)Do(S*XWCtK~CSYM7#~c|U)ziI2d5cO-7=^mfvMmDp ziZKrelDt5%%#b~Oovh-+L01(x{>xE(UnZUQxbT10Y0yYpm*Iab5qTsFYC(NgGK9mq)kE)Zzpyli z)hv{F54&Bu{QwpkWUb+>X@Jh@GKj7Po$GXYvv0! zLq_Tt)v!hK`}`|}Y7h52bf5u@1;YrON?e{8OO#~;D^J@C z?X3KFAwd?T@=mD%E81ZDl3fYhv1m`xHM1W+T*R^17*Jy4%@>1b<%q@)?$8qBm;F(p ze;hBrhWX8A`($JIOG%=0bYqWDUr)wN^mUG01VCAb^YrDlPw^EOt2C@e542#cPzAAo z1tFD(+k3q+PpC^yN_65ye|hin;N5#O()5Rvm+}9_H2*-dxN9zUb5e3Y>^%ht`5x9C zHah#xYw}cIo?l#;6C)vEgVaWmIymv~x}eRXCRoy^XmfZU$q!;;-mpaaLYozfn0rIS z?&R}|?bY67bHukj>Nwc|!SUZ4DDz-EAy$73x1vxo`1{NFheb2>>s}0Ga;&$Yi_fZc zUVmDm+T5?5f_oeKuvu=bDRWM)y=JcCt;IE#QhHwZVShZ;-*p$+qq-$=5h+gojo0-2 z?zwXXSXr+XPmq1lg;7W6*A3E;=;%0!ugHusyu}l0&i0Wp({*nili}tXhEZ|`vo42R zkBl0;zNv{X6G<>$*$amkjaz$?!RG^}`7vcXIua5MCMqwIA5S(@8POnILg`wE?b*Q=m)hjrRG66aB=~ai zL}X1NytWQa-a7oYehyX@d?m1>?pVct9c&LyH&scE&xtT2+%XGtGWd8%vB@TGb|Bv1|xG?wkSO?rOTV z0MJD;6#50N8w4Z4K)_xBrsWVBp1GpjVg&&1}>R%MdB?IHw z$WbKw*O40tCwiZrM__*2mRnO4)!uQ1@Gz3gBL*cWSl?Z<2AKp4lf4(%#Q)@ z2a=&XMA&1TnHi%ycj}hgkcb!hN@)LU!MRpx<6ICA6a-@bVTnTpD04KmT5mbCFa$AT z5|uZsW9l@!mSNGPdmqb^Bry6tj=sn?lw2UvWh@+X=f|}ASrK)l7s(r1F33{hJ`C%+aEaO1_f?2!ZWCcj@ zIuJmUP4Y(Ch}ImT;pB;%E$Q<#fbXu+>;b?!~R@uXsN zhxD%sbtv=DeE+C(EqfiEaa%xXXHyM0CWe+UTnlX-kj49~s$-o6}gTXjf9n{0q}ua0csf=uF{p zYQ@DT>bMN;(8%K59av^rQvrSFd|s3odR^}e-C6a>jn&Bbo{hn4dh|o&dY`8b)&Yh9 z5*zNqwt8uLuH26;r6UXLQm}*%6n;pe1Yu_v<58C~HZ%Z(tNSjp;MP0u{gxKTUQdqP zcZ5$zxzUVcip6j$xT5^Fx1=P#&?_bitA5wHw^*^*=t+fYclhweNFqn1QY@QEUrWZJ z=w%%dDfTIe%T%Fu39u6bd$D&I@n{^q5x>#>eO>hoRTYFH1sYa7c8(`w`?F_QB|+h3 zSzR4a;TS|+Q)S$vRmJG65+uif#)+xt?d~LqNk6$HLm0-0I<_yPo$=;Jx&AhVE*uak zoeCRHgQ>0VMa6w;%_&#)gi2AUw-xp?P#5E3;$`j^iCnfRA?}Z~I!MTtsUn~XUi~c3 z`-*KWrg{vd=;}20>)hAKiS3iRaeF=dB8+_av^)B2JrHAs2q?gkW}g@FD4tTtwPBll z`;uhvd+=MVQ=oFSRxGNH^x9C?~0_r|szuxtIB^ksH>ZNSn#QNiKi{1lFumwfpCo88YsF}+kk^#-I;d| zBzc8KD;OP+HlaScLk>1vws(m@zgIWRIkHpJ%Q;~b$JFdD1SNOM_L>H>7hjDjC=2Sx zzxFKi8saM<u|f${$lPlV>t2bFs{0mZC-0 zA`<$s^5+e+kmy##^D2CKK@XH0rWNVUV3s;3wVWb z_|Why`VHX0@%J|s%_vC;G?`Djl1x~4iG|#X)$e+QQT+U+>lqL~;VrbDP=4-Kor$b? z87?7k^0&2I9tg?s5eO?yYIoyM|J*|Z0+j^7rASB}h95`$82G?-^vismA1k0$e<9ap z-ji=xC`3A$%ag55`7RYj{vFE7R+to{lOH%I9LH=*I3IqE^w)St5gYg6JLe$&=)eDb z8{vo8G6Ac?2(T(1KL1-QKwA9YnU2r(=-=7x7y9)7yQb91kuq26>{e`@wuftZYF(k) z2&tf{si`?-r@9L;Lmgi)T~`>2mu{R+4l*e|isS?>PUxbDx6sZP&K zPR=GyFWcpX0ng_6gU>qQ+L7WM;F4-PIn}Uzs{RcIIBXdX9oc?nfWS~7cV^?w@xa8$ zR2v@nFtE;XQ|`j^;$Z1ux!!ikY9e3J31U>GRdL;LHmw6%>k2x!!!+%UqU3j2fBPtz zCo^LWDA0u%O+Vxd4m`VB=mHp!hXoy+H8^bSr+c*@(y7cBlmG^c|O>!tbsVcCGb7sUCg%;_~B7f&_K#be0+3*#mdy zlyo3T#U$ho!+ehNy}Q3GvKpmYYs~WJuoaj-WT3n!@kmc@l5HnJ$JRkYh8cc+c+d^0N9$Bw8=MATVEl5d8K z@0#o0)%?mzh?t$(^%S2qpj~xfF0s(x-#@<8edFQn#_8fUAu3oPNtz~=(dfJ43{vOa z6?IY68}VgN+TMelO#19DS|y6rAGqyJ79F%6iYYa11Lok_9=Xee;_Jo@bWiLTz>a@f zs58;H9W~IHX1}EdY*N}f3rk|(no*Khxsos+B_9AH(HbPfHxBs2&uwH;*A(zaol&DD z#A`U*Tc9#r3-I(Y{;Gt&JS1$~wcx5Eut->u8|Wl zkx^qLXNL{!^9FiRlej+q`t4vJK@;UsZm)Bji@f;|jDnmK;hV!>J_j|PXM3lYQwKH% zSGR&_G?&f}$7``&FIp3iFGqYuDZzz$O$T(*!bY(Siq*Ox&5q1f$+d``+U3{xcYC)d zuvo_Z9Z2fBnAi%tj~V8R89C3B;memrVM&KExK=U5C8VEyZ;XnCQlCgBmB)TP$a|IRvH5mU^!S#*l_r4` ziBzr&IhgtR4T@tFDSYbRP#|9|?`aYz}B~`lvD7y>*(z7ERWCd|FrS zYZj-Z!QUz3pl9atdTytpaAhgcqpwQ2%_s1^?-M~hR*85|yosWiLC#>d^Ay&E6z0)SKZ>dyUJ!W9He0FTJTf%g>T##?A9Mr58@UyS_ZxJz*pryDq&wqk=qF z5D26a4{yfGbh?S`!zR1%X2a`eHHZ#t_vfZ(wAkZm6o)1A1@8pf_t5 zbSJG7+gTZSY4U5b22(s%DU#0(-Vh{s=(V~viLqVHsk-N8$QtyaAtBlGx82oNY?h|> zr7jgs5(;O^z9iTc?+M~9dfk(0Y4PT>o_efj5ckornj4X#l3RiMA$+Zfu1xtfTI2SY zX1g9kCNk&fDX{SI?yy|T{q012)-*^c)RlH%?Du)v@w}KA+)SakA@75zeydN>1+Dge zcrszVl(aAiX-4^%Gofl#u9D9t#Da}aW47bZ02@*)$qyh#F@cte(bvQ4=b{DF zul^V)fixP{F$jmxKV8#EL#G<~h!q3~kCwi6U6ivM_#ADI^EpOF66Uk37FUmLleLlP zOf{)r%UdXOFi&K|&&&7|W3RMy%0TuZ8r;G1 zGOK@)CjYqu!4b>H_>SWyGzMp#FSowzbW)m`wzBz@87-RcY^RREW4G1@wMyHkupmjYAolD%?4lsn8<#ysrTzwkuo`#b+IB#Y2f?w6^CmdAGhY)ZYATT zjWN`a-w+;;n~)}03YYbcxsNmjA_;H zZEk8Rv3&NVnct)6w(x{IC20{9DK>9x?W=D+Aa?nL1=TEUvBF5vh^h<0&{iZTk4 zxty=tE-c>LJX+H7Z zAG&Ivb2w$L6Pp4sc#qyHA;rFT9@&}XIghBwl|@}3_<8^Z%(g&^df!UIu$~YVVEr1d zv*>prD{if}CGj|!*lIF)G_3b%?(AU2_jgcx?$Dz6@#HB>5A60RN?4xUuc!`Y#QHY? zCMD@Ic-xrT4eMAHE)lTdFcT>o&;8ZCOT^WsThBgcyEsne{f53i-hmbbmU?H`SyT-Re8zM||!u>D4)@A;|KJOx_hz{XoGF=l(R}L1yfxk1rX%Oll zh;roAH3HaA9UaWxXo?Ntsy%R?CB4+9aU#B5vJ71!#WiM&$w;P!2;!@d{4OHk92UJU z4j40RFOD0FAjWj*T1w{i`dSCk0%^W!#IxsJ2!8ZD9$Zo_-HQNWk&sR`RZz%h%9u7$ zejF6l=_TgB<)-`tUu77Z;48-W{^ZKPR%Gae2jlUV>$~_eOKCTrPy+*{(SM+)oKn(VXtxm)i$rp^+ER+6 zdWXfRVWh~!jM@ScdV6dY1BKJFJHj(mCjTE$cbv00N+$0=M>Efq5uFzew*G*10xO30 ze*-lC|K(!-(*N`+Deof_qMMvIc^_pd!T@j^+sky5XnJhg3NeDg?ZdIJ%Cf7+gUJE+ z_Lu(DAC>8`gX%T!O7gWPs6+6J&z2v0LO(GW>NoE z*!H0vY8;TVhQ6(Oj#a?6R0Wmk&eRQ32ieYDc++$-HsT6&>L!7IL;F8@;3(7GyM5Wx$>BC_4SeJwo)BE zNy{9fWdPJyA8Qr>frL#AL{DSro7WR|_8g;azq&QfKyZcanvHt@1Kg_-iDY{0%$6jC zvivw&Q*h&qwWn3QfVfob^F6fV_fh?n%fdBXAm(5`PL5&8$*DCZraUE$G`nopUF~&Y+l=sE;8klxjId@8dpIo3kdXaf{#%Q7ig1`|M;7l#&wmD**64Al?5r-EN_7 zNaTXhy;Q5JOXNeUz?ew6LHlz4hqOIryXkU0$TZ7aAS*Yx>{CsThyj3+Lj?1jO4dyQ z2%H`DS(;L>McQlAenKxm-C@xaL=wc=w45&DHQo#HgiM#oQ`Z0rgl>v1W8-ZuE-nXG zKuV{d5XnPFNvXo9M*mQ^ZCa&pX7{w!z&x&ZAr;zsrtx}jwsf!W%i%a)Gae+`RW{2l zb3xCu{oc_k3S_DrW=(T>%I_4 zO6uyJ#(4*z5^A%nMcRB36l|cjR72%7iA2i^^zWj7Taj zVR!;R75x<&#@}^@Gp4G{KEstf)m7)fRPxqZpJDl{LKOu34(Y4E79`tX@&6T+P*8%tZRhjlmKt;`CTm(Y9V5(!>rZ6 zND%ohr`P1-YPI`I@%QuY@bbzcI+=yJ`6}a(5}PNQd5quYep;$Fv8a?IgKIO2HLA-< zR*3pl6AO(r>I!udh*#3&;(0GMApdUCSpnR{?fD|*7hX2AzTCWLPwFjt7=~8k#`hJ| z(rm+^2YDr4P0&>bU-_Cc&s{Ph9q?j8Jd0-jFB~>ZGeT6$=0`+9tYBsRBXv$p@yR?! zT_WH_a#rEYE>1o443gNBq{sYnbM|g2?@DUsvBAs;F}+nyu}k&P@xNU%xI9~J^tlCA z7n%Ggxf*`7dlq>Y%|8t;2U%XNUTX%;E@mUHRP{CS*21Jg)IdDABU{3~*1}I8S^>fo z_UP|J|A`%Kp0>(woG_knmi+i~`uR*7z zUhvmubK-*btA1Xoyp|uQK{z-#1reG#{lt+JvCtoFQ4pn+uI+=8$cJ$?v|y1Fud%(a zuz}vSPRIUf$jle|QI#&2v>eZ~dmGRz=6w=>o@DrMb7UlXM;5qMhs9Ba)z7>%%Y78} zx+mr9wS&2!C-Lj^L5c;A(!%O)lJ@S0rjg`iRhTXQihGsZu8^eH`HCJIS@h&9Uod#( zSV<2E_3Bv|q;M_ll>mqv;*%K%An`|F*VAvehohoi`9OriX}z$!Nl=eQl?0WGWGbT0 zEzK?Kw*HBoWAwip{-I5+c28IVX$ny5R5}%10b1oE)Wfp`M3bstxblW&+Z%7qstt`P;_*Zj8X&I zt~c^1e$T3Hmjr_xmTdO0W zDtn~V3Q(VWjn89iPn-@;W>rJ>x85Y0zB$*zUsQgI*u1dO01#Vl9N1`W02pj{2GbbW zsjY#h*{@vzg1maK8P(@c>ziYl%?XFSeTO3X-%Pq#9K-jwJvPsXDO7c!%%58Fr$1O@ zCrBP`53~&Lo@Xe`yaF1|EPNPO^=^xE1~KEUFdgj!NM*3o%e1%}kP&h%Ei z0X0;??895_y75ZE&b55C&ht2$28IRz{^n)BaB^OBe{Br7v)ApmuSZ%3%fwXi4&cCu zE~L4R!N(4OdJDpN@g(FODCk7psykC!FY{nF50?^sUvvbe+sz{ zw3n&iXv-Xqp&P*!|H^hbOxo&qV3#>L^|W4h#8ru`{R1DDRh7LOB8 zm%#ZJj~bwE;?C=)ry}Q**5_?PzN-oK;B}!TNC3^-tRal$H*+oyOf+j(y zkmIje%8fzYUp0RYF555gPGZM$GebG|s)YTnS&IQIn7EH9$Z>r_#_rEfP=H zt*UJ0DizDr(UMf8OMUJp^N(JLb0l8N$$Cp~WgoWjdFyglgfe1Wp5kbc6d3$;nN6Na z*>^LDp2HcT`ssFS)b6ua`@`pMbK@K)vw)3+-VcPd_xoODDBxW|Ffeg-s*HjtNCj9I zz&?$Tt@`HTc(1lgc@lefrI02}OL0S-t`eGF)%sV|-x~Vk6KX1SRo5!cKiQ~7NaNHP*(YuGEwJ6@YwukzFNNNxn)~DsDnKH$8&|lcWaHsa@PkH z20#pgdEc6cVg8GXIyzGKPxqsB{R*O46IX+AIIniWZhb3|$Mnfpfl6#1T1- z-@dRUwkt}la%dzy7fBig2Hvl5oef;baD(tNL^A8~N=GyaT2i}w^}Kh9g)S?dbG$ru zE~h`KsHA}109rLo!j}96zBe^*J~hA5BhtN?kZ9I>T}D&rVST9m-`-D9canUIBkHVB za-B0jr>@fCwlpo`rqC0c|IjjR(dXVDqsJsqud3m-Mr!T3+dwZAtD&P|Yv6nFj^AbQ zF%V*GCo4qc#`IL3_A- z3?p2|SK~7-zm;mrY&8oO5EhyEXTq{@V8;-xfw_d!$4HRI{tTVh>tE{w5Rmaq|0{UD2&nu$_?z@7c0KLo|qsU+*Gn*_?bC(Y%HUe%AYaK z(XkoVGLE+bPEC;1p*G+)NW;2gkCHbzsOz?9a%IyaFyy-c^uH{pY~Wd1AI%S0bXvu6 zG(NpfK^6|T3ZlQfwY|{cUR*7%q5;XR*=K=~^YzBPxG0>QYLqo*L*$yYIZSnY?v+%0 z8bkStDdTHH=g@_RQxCI@Q7@Is+O~#>gR0KNJlpF@z>oP8@=~aKN;lt~f_<&Yiw5U$ zR&^EIsqLvxkc#N$TVDRiCNUBC-RrqQtPz`@Z&M|j&1BluW0{$I{i_*xs6lLN$TEC) zK}|}h@ATN5BidLWkv>0NIRy9)=0MGmnl*(9zY?M8sl;?^#Dk(stDrvtb3gvH*E6Y; z&GPxEJeNLJV&~Zxt|?=yfV{M^U5kYF~o#)5vb~ zbppX*V3cysm%fm zm(y3LkR>AC&X~|wP%*3Gq2-Tu<}aM`iCWX&oJ2Ofnn`4J@%d=KQE%EdTvyTbE|uM4 z44nM5$3Ta0QXx%n>WVJIdatFi?xGfIQvodrboB9nLRuf}tISCv`phJ^4}m^^V@}vi zmw5O9-?XHnwDJ>4nlVhYeY)-FwB&qBWXMdtv+fvkrmQbgg5WPd7=I0jS^(OkV=sUz z9d4an`*Sr*CjiH$aVDIY&C!1tNGpbRJr2Tx%v300FazF^!vZ0{g|Ew}ad)CdKw0n? zWsdFBrn;`=yI`KZy1XimN#M9VpDk7|8DGksG?kwjbwy*`qas=^=fASm6V$(`bJ&oc z@sYd81QqX$`CQ+grSC5_&$LdrX*=6&-R`x1LO4Gk^Jx?+&OBBCRrK8x%gQOh&~JbW z>ceWOM;^QiBtqKE-N%v%c&(PH^s%z_I|ElfzD^Zv?He_nC%NjV5<@ci5j9cgvFCUk zsI&^|@!eCv1B)3isoGzl@}bDC{Q@dAPw0Ikblj<(wq_+o!`>s$gJPQh9Kzt8H$eWH zU_%(nn5(>#C1Ws@qbwDU$9H2u0d+fM-SjkrjCTULl}m?g1PWoK+@Y6 zpP5L;UzQ&Iej<-v5i0^IE@lR;nd0!9zCCP`g2dVyt{&LuHwT!_H+<*+rglWzcC9LK zqkOpDe8^~Xh#YQE0BuC4KllHVe>l}3kc=a(&QJ{myIahyj%lNc&7JjJNHC*wa?Y>M ztqj@~XJ*d41vW0AcdtIXaZpoi;&tlA>m~+gp6I1ABmbU=dPcelE z{S=aUcjKUq=Q7u+?BsHz^KNq&GueZ>aT1*_ zh!RtFa*2r=Y^bl)%aof0#PfA3sz4uP)S0!tU(*J$V=5ePvbc7E_T(G5Wv+{LrU7bQ z9Ig=|;a5B`w^Zigk)SlKns15g!|*WD2SL{fQF;5`E(US6g~uj5rIVg*ExGT%yGkEf zSXpkLe%AM;q>xO7xL(aPh+eyS5zfP;*hl$=hd@SiE>g93)-cx}JjKTJ-0@3^6nD|y zTcVer!3j)gyqC^reW@a{OS#8+oU)x-4LC{AJ{#kPg?Kz2??1VQe=tM=5?IKu7b2RP zg@b^)T&k)M@|k={bfQ>XT9q9* z*!w6+_Bt-Ml>bkA-x<}^_ic+Ms8K`(1Sx_IDS{$J1Vd9m=}1!`fYM9op*JaF15`xm zD7_{~CqQUIr1u&^5tSMc>4b#06MpwU?uR?xxMRHcf8%|)=Myl($vOM%v-eta%{kYC z_1lNTOfn|s6SK+4>dp*jCH!g*=l*M<`(ZBX(KY?I2jn9;?Mv>R`u+lQyHZ#kX5M+3 z;EsQA>$19mK^E6-*KcJ+n4>B8%Gm|4oSyew4>;g@PZDHB22hy7=H~}xwH(Vto`7LY z&&g?FXJ_y9+PDZupTaGOR)Un2(5^b=wvG&#pcrqm%jiFgz=(z6hWNjcX=}<2W0sQO z%rdL=nt-)fJw3h3A?*81>HN8qh%+k{q@wX*uLcU)qNZu!%Dlzc`0dJiY{{Q9RW|KM zIRyS5v$_K+tQ=}XPo79MD5ZO zl5$E*2XgcB;NFoO%#ZpIdA>TS(uueK?wlr34irbaFgf(R_~8HZR@O+B@Z3bZ!uJ#b z!(9i}0E|5{PaqTsh`J&kr^zYJ=u3j2vQ?(af%f!+#-XE4Edckb<$?u_DMhk9`St6U zBWFCS6R@_$#KlL$n0SZ9oqQ9XO!7&tgfLj^mnRBAWafXQyXC!quCkA>>}2sBh)9%l zY1kl6IN?G*XBMaR>Gi(h5^bjTdBRi8`e?U8H>+O~L{ImeUH#Vbk-bhuy{E@ng=xee zzI0bWO$H2DzV9;Bk9L~^LbzNMzfR`xc#UtDPYT6naqg~1qaN#{FLTvVu=RM5LRM}( zTM#Z&u(czWP?Ji+oz0t@hFxgv8fVqkZjb(bsby;Z!%#XvO%_gg(#{Bk7adUbC(W>l z-He)b;5v%g3?vBed=J^kxh`WxGI4UjvnW)96lyVtHOlA$tb#nWB=vAMDD7*8sK4Xm z+V#h*hgn9GObND{HO}qeyg?7Ox^2r2m}QTY0uw}#S<=XyrFJnaz1T(}VZTb7T^rJ0 zt|5F=y}8aQ$2;r2E+lGV^@>UFh2LKCo})qSHYX@2@!smHY}X&(^`OqK8(VJnTV2UvgmYv}zHqi>6ytPst4 z1D212)3eP}6ODYZO|JPA6e=B{#%Bn? zIx4g2xrhgeQ_?ZLt~(XeLmTZwvSTv=>{pctVaeohMm&yU7oJyCxfw0mhnHQy6;+AM z4ei<1-z91oyh~fX4tLHVtgqN>+|J7Na5vH36eyLi5AQ^ybfrw)PCcjQymKz*B@-d| zWY3v#?!)|^kRcsN2$9I{2t!Fw*9Q7SAW8kMWoo*dYcEFJ z03F~8P$=OVVzTd2%K~TaS?w$LE7+S1UfwTLd3QyAGWAr`5ss<1%3UmjyB0)0R;?|$ zpF4TNl9oYF!q}$Fl-G80CnXU~5zDDapMn)T>{qfkiBfY5vmr31EiG19c#s8FI}qWs&brFI|m#0UY(WDO|M3f)az8zv9rcE7*IW?Wb9wUbo-!ih;3QT2qQq z%#CO`M610WBGy$U@Y(q-%aT%txeU39yDBJK7G4i7Iq1vtAdnCn0+O6MK&S!TdRigQ znQgW15aV!(ZQr6A9648s`g`}u8}tWl%Qt5s;@IO4c_Ca-HOJXw*Vhc09RPtg*Q9|t zGci)Y@ZJz{pgGx&xm5d!dWHH@wfxbw{?|AS>7_RoOKHB2^Esi~lI~r%0;Yn`%WAn+ zAfidJ$-Yeno|T&yIZsiSvc}WY5d=OvfEh1c?FE`P5GU(HgbUvlAG5v(cVT|WxAo_O zs*K~w;G;;!hdf{APwQb`1T*NRuCY5yYMT29cw_%6-?Cu1+uwQRI7-rTjMaNSYu<#El82ZBJB$Ysn#z7GdyK?S1g5pc96Sq=xi!8Wk}P6uX#D95HCgsn zS0(?Fc62UQtXcQ0?IT2f)G#`osQKh=F0wyNC1i76$_GU4Zh5YXde=uY7Xp0hS*)ae zQcUGv(KCHC@UeP|+36tkywRWFYNJKLHYQ+LcB3^r_G6Yh2Hji>Ox$DH+=4ym}Ay{u`m?cLxtz_Yj^B$ zagJ>cMy9wKJGToH+~6E$d>20-&~nXGi|d{7P%kEbW71>;f2KRZ-2C}K(24nZS~hg( zB>+=DBmw~kZ9hA~yRT27qkF*y(RlXcJPxf)E1{TqP zmUXG()Zd9B>l;h<=&!{rW1kS9%q8J8?r?-8hDPM(lmd*vQZwPV+GfR|Dwl^wd&;YS0a;_m?~a6j zhJmcz9rQaRB)p(9gJ2lU^K)y({A`rx$YvRkgUM`N;LwIOnGi z(sHe=y>yww$op{v9RKjjfev7c);m4*qH|i%`=7z$|09Mc)VFo7$#bQ`<+M*Shx)?9#+nq(4x1L?Jh-6?2C|IzN z=EY-kM_2mG90;)uB--5v^-|~Nn8>=Y*@MeE^-uL-PeTcne>Dp*KB1*$rA9`D6+~DY z30G}5==#lSpgQrSqu>42kE*=*xQC^$Fxokj^uJ`m}xfQ|8+8%Uw7S7g=c|*TC;0C$L zeoF~|ZyIYeX~Hm>7o>EEe!=@|j!=BTgQ3B8b-Pcfjzx9aH+e1b-Tq`6pvPPb6OUn>C-gIpH@zSWej?L* z7or~Ou{=&}I2Z9C?W@Z_GZ(D?w4Yu)0<&g+v6S2Uzo;7ce{?F2?jWl+)g%df`?MPC zRTt8fAlLrQ&=u2oAP@B|I+FN(mp?Ljq{5!OM5PaW{4~;O)LH!ewB`N>wOR!bbX>2S zgwBVGzVzxHt$LMwY=3A@98;Y8QL;4Rk+7qA)nP=_5P{2sJHq{uaReF5P-K$YVb$J% zWkl)Rd>oDuIdYZTwk(hPj-9D*SqE)ssg+NRWXHBiG?#;Frm1GWP`N!$54?Vth&K6c z^LecWHTmrU73e<7_7HJ!?8!%!j4{`yVHHw+gIhlH;pHmO@E!l{B@ zJ{=a2-FLDiTS4iGdc*tNk8}KmIe9lp-5F_%<>R`DTF|6MYOWM609+ zJ2x9krWGnJfMyY2H&~ZB;UAopnA@)zm9-G1g&W0B#G& z)!r%Q#jcxwh*qvV27;GC z`znP~$iUvzCBkd>#x8`w4L!^*CMV5LU?*GmE2e#QF-I;f!Rp{<=$ zO7h{IzoIGu#6iFSDN6;;cd7C!oMl?jOw3WOY<+}N(zy<7)~7d(pLGFd51hkIuhZgT zl{;71^|+Z8gg!Dt;I(@oZ7TEl9MX}W#)yXrTKgPKxX3F8)n!)O()tN{uXv&x2ZW(2 zel{0m4r@!MooWsjO`U;CF#nxR1V~;osoon|EnouJ@v^3<^${Cmc1=X=jVBHKF|yMBMFyl&XsUy)Nqoms?W(jUlr81yg;rfLtU`1|{#Q81{Iu3nm!(i2tG=X>?9 z(bdORW3I;$!u-0w+6@Sl6REP2A)sccSul*T_m_x6^isk;2emSO;6z>9XY=)Nyba3C zxn$cCO8fGR?wS2KFaDV1_K8v2U{^Vs!dJcLZhX0Og zbn*h5-sez3o8336XHFs;ibcbQ?8`E+&7ZY5bK7Ugaj&FV!|p)y^wB1;*-Q@Fn0@YN zxDV-IG+DgQc&2*FA24zomd_s_jPw6BQ?N0z0PTyw>98g{TnJTwg1FC28}j zNO<6qpCF>aZ{Y1{&gc7mZ`uHV_&0dS` z#CP;!{*VimW&CU3&z7ut`UiFrOydv+zuuxV_t*6hYzXJng%J>a((0#8?Lmh6AfCLI)s~?aQ_PYd~Ec zCpw5?H<-iRI^D?}6@2a=LKZzbmGR7eG#7*g)VTd+oo+1xpo7%o-=hc2TkPs=vFOEM zFk|KdF*oT#G!+%Yj06Np>nXQr->Tpp7@~6{4N^Dx@&4tp)KjIoxvjM82{AQ+C;nKG zoH}vi+idM)2#ul`RDT^E^!&PaUH830s#=up?x6z=H{OWoGgE&#!O;HW@CoyMUE_^^ zn5cAg|A}z~Y-=@zper*12MMBR6AfyBSrW1YF3->3( zhg@2mu#-5S;W(n%+r_xIjwg){oaC}E+lcH;K9xBD#^u^OHA6ki40X1^tk%=)5&hri%~G^C$^^66f{G1vbj+!D98_O02~Rx9DYJBt z6=|;WjY;C^z0!z04umr(`8BxskeEBx%C5NPR(1u zEBQW#hc`}zzLvmkc}Y34FcOex)6)6?opZJ{G1nVoC` zXtujSbPDwC4n1zV-DqvQ`6WFp}<*ix3bH2>zTodgkSlh+XGL^mA>#G{qP$sF`b= zj6a4(rp%l|di~Px1SgN>w5&QMDl$t)_q_lR|K?NE zU&Zl+x#)?qPb$F^TB}kZc{;+`4>H~_dAG`HW`Y0!ny8>PoI2SgTRZifLu0NveNt(D ze!iFV`!3G5Mekjjqs)7I(%kG8ux+UHu$}Aj-occWZM#`X5nxG6@z|uP=~9Z?#Qq(s zC{795_*mKY{s@k}m+iw#j@3%Za+frR9f-i(X_|%$|Ku0rR@ssREu~OjW%pKP%YoI0 zKkA{PeDL7Q!MxYHv4gff0eh=~6iv@WS(&jIl`h$xo+ymJ?$(`x!n*NV z_RuJ5Q=dhSGWLW5`=|QDQXQO`n>yCf-akI*SSp@|nR%&#H0aC@;$^v~ko&=fMGW>O zBKRD_-pPsaV0>tjZ|5UHv542HLA;_ry%xXX#?sJIrz18~c^ad(Q|TH#Z~euWzGyfS z#)UPCiqyHqEkt<~2!}9JBujAy-!0N|nGia|V8iHWIihCwS~f6N;UsYyKX;drkTALq z+8FdeWTnD8^A;9LN6}zY3PYu6+Wa`g8>n8|(dU~ghl|>qo{+9##2U7E;^#Hj&(I!p zqk8?JcsJajk&avYN$%Tr4C_eL>*&mGVaD@qt?SieCNRHYWXSx|$(Y5tGckp~GkMD$ z$8MYFpJG1CXQ4Iu8F~gHJSBJ8==%kkYu#UcmJUHC^pr1zbk5!7+RG-pQ~r39*O{MZ z!(=}9V4-S7D|%8=QH&OT-D#xnEZti~sd7fsUH`2mWo!Wj%ghFdJsayf8ZU}cw8;GM9(zn zpuv9cQJ;$^5;^ifulw)0gH^8Md(H8OR7%&S7JAGH3gGR^70azrzR6miW6 z+WCcb&i!N;&64#Kf4Aqyc8`WPYRyAs?iZ>B;#u^ytp@W^8tB?3h1iPYPv67p)yAZ% zF!_SxHQ$1rGYd+al!gX}t4Eeg>+8bVbCu@o{g@#V$-ze;=ckZUa(BPHIhgo|?b^te zqwRJ3c9$ zVpP!+Kt(0_y&w@b&XWt)l;>nKT;T9RxM_K3q(*||)WKriu*YEnHkhm*8kc_zj`lu9 zAPR)PZ4)^H+nUAt@n&EC$PI{0tvqHf+KPL>t2-=Hq6L(b>>#dZKjal<3 zBO~7`fCB+k#MDYWO=;wMO2A;m-M+Cg8+cMueHk=i?->WeuFyYQ>%~;oQfDdr<{<`9 z)(2%+Ugq>Il=8N_Y-<*xa+C#Y^1IAgD`C8<>ZJ^$E$8qzduMR-dw0` z+mzD5&XF+oNE8TyONLBf4hV!0>Q!cddx8I2$SN`Tcr)HPE0^-hT%vnUOh#FU5aJcs?xk z|I>T=p8za(--qk*=|#z5OF@q^LpST*F-WlN!yMf%^G!FH1^_-}y^JFKXN%tb^DlP5 z?CUbPvLqLPdS?@Ke(t zdHf&nR^4S|?cExBus2*oaiSCtP==;O_V;YQD?mYCR^9((6V^B07uI4N);`;Mvuc{S zzEK>dUT6>)Sj4r{Z-HNVcWk4FKaC*MG8yHm&NdeuU+bIOK{0iX;HDZNsGmO z%J@LxWDD*DsnPS4KZjMDn3iH?y-Hf*r8}#K1~AA4D*3x+kc#nuDvpmzcOl>k8rAre z`pN(t8ejM%Bq`?~cLX6QR2x`M__X>2PFOQ>Qca!+9JI^fiwve0OE6t5JR}4HEGy$* zZ$`=;IjuFhY)UFkeOoDA(>P+5aw`!R-hus_a&@u1mQo_#JW5<$hT#~VN5ApJyo%4< z2=(`MN=V{Iei7K=xy59 zujzm?2!bT-8*#gMwkV#*eXdA4;Loe3+~(MUH>J9I1tTw{1dk_cO6?gNtjO5j>rvfpKLoG0*K9@Ga3RnDrT5>YAn& zk&={$x+y-o9BY#PJMKmRj_3f?K4PB7+#SlU=Y)T`v=!AuLQ1N3G#?2ZVqYZXun6i` zCo0<#j*xdI@#QxiBGBztDD%5jU*mz&# z09bH>Hpwvd<#U`B(xKZ^s$3ge3-zn7=5JX!&&Q3-#f6AS&vXSi%;fKQa<~m$@)+0) z=zTBmR-zt4zij^oKcYo9nP=%Y#0_CE^xM1&d)^qXmW$CgD*}>)a=wyoxdvcZ^{g>1 zO2&?=g(3v*k!y0@Kt<$-!m+^o251!h1uj?!pAX76C;p+`=8`+s==j z1(UdP_2sA~T)7dk+ut@}NoY)X!UO2V-F~M>4M^3b*i8cx3tVz~;z*J*X~F*?oqHLJ zBJGKuxC*K~%=zw&r^a9*I=Ob~8M*dC8Lj7P$34w+vx|x_tL^ihz(V_)o*OEoRiLUd zDf!flLw41B#TRcipGWWHIdky5$UY!+6EtGEqtk)Tng)!huxM zSy^m^jUUIvy2^kgmdj@ixAQ8=z|?<0?=O&21*O)%Y4XHLaX=sWRjp-v>`Xqm&|hTP z*1P$u+}Edoq%S?dOL#q+@H&utw`MND54mp#G^^h&tifd8MwD|)we}%?fbI0Gcxb~j zd_*35KaL}85r-B>(%>*XiTc)}TpnP~a5ZbFYP$BXg^pBgrR&&;xcYzq_9jRm6d)iP z9EmLH@bqomLYzol)fK{_lYuluC0=c`1CMyp+hclQpDTc&t-S>OY29<^>2 zB=FP)Q?CrQFww$`c_!Wo}790)V9S0Q3Cw~`_oSRx93 z@E?Y1x)q$Vq%O}5Cqcx!q+pjaI@Nd9r13p`5>PZD~!{%XspS>N;@(35S^4k>XI-)jub@%*zt1D5c0{@2PMmY@<={WBVOt{k{<9m34<>rgIlJ z1JcG%aypeKNRV6ea|a`|)A$p?Lt4pG!jJSyim?|;6#Lwjf36T-d<=kyTJe?lr@n_C zWAcGq!2VFgBe`VpeL&)ax92YH;?7zP#XUbAF_3yn8I3$iOt9xV_@-)i4?MQ<6iZ z&#!nfw`mWjyFe}Q+taTfSiaZRxc3HZ9=UprWx2>6=RVwd2vNVPL7Ft``pQ^C^z)th zN&gzjyI477NSxTQ zmniVI8~GQeY&z7xB?5I48$g=Qtj&B!nv!8Rp4K+n@0l!jnl zc8TuICoPfss>tLMgUCw%hreR1VlH*$+Fg5WG6E}fHfyTlSVVEKpJ+OLa(|(%o74iY z^|&eIfU3V9(ebNEdkxGCJqltOeP9{M!I_NuMxyL)D_!Tzjn5VVt< z_Fs+DCs9_38!9?u$ueVegK%8~TPIj;t7C;%sQ>PKkA#(l{M8Tp@HX2``pf@R^yC~r z6wqGi{}NRD-?@qY_qZJY!sq_yRA89@&5`*3S59#M$`AhMs=$-~Pd2>&^WuQ<`1cei z{%4W-KU!pr<)YPiO=)NiD6&j_!Uq4ou)i_Z1qliYk}Ttr!4^Gn;{5sjY#Ye20DDc< z7@`i+ui7Jwru!v#x)bTwBiO~~f8E@h2aE*s;BQKLVnZ|tkB;t@3OvEi-rgD#6*2cX zu{n|p&lZKVJ{LoSRp{uNHm-1Y&MH1GgN@?x6a51N>!0fT?1Q-`tiYXtLsBqav8uY- im`NPgFFK|+y2t338Su&TR~3y#@jy}I9!kM1_[\[1\]](conclusion.md#footnote1). +In the past, a corporate network and software-based security were the first lines of defense. With an increasingly distributed and mobile workforce, attention shifted to hardware-based endpoint security. People are now the top target for cybercriminals, with 74% of all breaches due to human error, privilege misuses, stolen credentials, or social engineering. Most attacks are financially motivated, and credential theft, phishing, and exploitation of vulnerabilities are the primary attack vectors. Credential theft is the most prevalent attack vector, accounting for 50% of breaches[\[1\]](conclusion.md#footnote1). -At Microsoft, we work hard to help organizations evolve and stay agile while protecting against modern threats. We help businesses and their users get secure, and stay secure. We [synthesize 43 trillion signals daily][LINK-2] to understand and protect against digital threats. We have more than 8,500 dedicated security professionals across 77 countries and over 15,000 partners in our security ecosystem striving to increase resilience for our customers [\[2\]](conclusion.md#footnote2). +At Microsoft, we work hard to help organizations evolve and stay agile while protecting against modern threats. We help businesses and their users get secure, and stay secure. We [synthesize 43 trillion signals daily][LINK-2] to understand and protect against digital threats. We have more than 8,500 dedicated security professionals across 77 countries and over 15,000 partners in our security ecosystem striving to increase resilience for our customers[\[2\]](conclusion.md#footnote2). Businesses worldwide are moving toward [secure-by-design and secure-by-default strategies][LINK-3]. With these models, organizations choose products from manufacturers that consider security as a business requirement, not just a technical feature. With a secure-by-default strategy, businesses can proactively reduce risk and exposure to threats across their organization because products are shipped with security features already built-in and enabled. -To help businesses transform and thrive in a new era, we built Windows 11 to be secure by design and secure by default. Windows 11 devices arrive with more security features enabled out of the box. In contrast, Windows 10 devices came with many safeguards turned off unless enabled by IT or users. The default security provided by Windows 11 elevates protection without needing to configure settings. In addition, Windows 11 devices increase malware resistance without impacting performance [\[3\]](conclusion.md#footnote3). Windows 11 is the most secure Windows ever, built in deep partnership with original equipment manufacturers (OEMs) and silicon manufacturers. Discover why organizations of all sizes, including 90% of Fortune 500 companies, are taking advantage of the powerful default protection of Windows 11 [\[4\]](conclusion.md#footnote4). +To help businesses transform and thrive in a new era, we built Windows 11 to be secure by design and secure by default. Windows 11 devices arrive with more security features enabled out of the box. In contrast, Windows 10 devices came with many safeguards turned off unless enabled by IT or users. The default security provided by Windows 11 elevates protection without needing to configure settings. In addition, Windows 11 devices increase malware resistance without impacting performance[\[3\]](conclusion.md#footnote3). Windows 11 is the most secure Windows ever, built in deep partnership with original equipment manufacturers (OEMs) and silicon manufacturers. Discover why organizations of all sizes, including 90% of Fortune 500 companies, are taking advantage of the powerful default protection of Windows 11[\[4\]](conclusion.md#footnote4). ## Security priorities and benefits @@ -29,13 +29,13 @@ To help businesses transform and thrive in a new era, we built Windows 11 to be ## Feature overview -Windows 11 is designed with layers of security enabled by default, so you can focus on your work, not your security settings. **Out-of-the-box features such as credential safeguards, malware shields, and application protection led to a reported 58% drop in security incidents, including a 3.1x reduction in firmware attacks** [\[5\]](conclusion.md#footnote5). +Windows 11 is designed with layers of security enabled by default, so you can focus on your work, not your security settings. **Out-of-the-box features such as credential safeguards, malware shields, and application protection led to a reported 58% drop in security incidents, including a 3.1x reduction in firmware attacks**[\[5\]](conclusion.md#footnote5). -In Windows 11, hardware and software work together to shrink the attack surface, protect system integrity, and shield valuable data. New and enhanced features are designed for security by default. For example, Win32 apps in isolation [\[6\]](conclusion.md#footnote6), token protection [\[6\]](conclusion.md#footnote6), and Microsoft Intune Endpoint Privilege Management [\[7\]](conclusion.md#footnote7) are some of the latest capabilities that help protect your organization and users against attack. Windows Hello and Windows Hello for Business work with hardware-based features like Trusted Platform Module (TPM) 2.0 and biometric scanners for credential protection and easier, secure sign-on. Existing security features like BitLocker encryption are enhanced to optimize both security and performance. +In Windows 11, hardware and software work together to shrink the attack surface, protect system integrity, and shield valuable data. New and enhanced features are designed for security by default. For example, Win32 apps in isolation[\[6\]](conclusion.md#footnote6), token protection[\[6\]](conclusion.md#footnote6), and Microsoft Intune Endpoint Privilege Management[\[7\]](conclusion.md#footnote7) are some of the latest capabilities that help protect your organization and users against attack. Windows Hello and Windows Hello for Business work with hardware-based features like Trusted Platform Module (TPM) 2.0 and biometric scanners for credential protection and easier, secure sign-on. Existing security features like BitLocker encryption are enhanced to optimize both security and performance. ### Protect users against evolving threats -With attackers targeting employees and their devices, organizations need stronger security against increasingly sophisticated cyberthreats. Windows 11 provides proactive protection against credential theft. Windows Hello and TPM 2.0 work together to shield identities. Secure biometric sign-in virtually eliminates the risk of lost or stolen passwords. And enhanced phishing protection increases safety. In fact, **businesses reported 2.8x fewer instances of identity theft with the hardware-backed protection in Windows 11** [\[5\]](conclusion.md#footnote5). +With attackers targeting employees and their devices, organizations need stronger security against increasingly sophisticated cyberthreats. Windows 11 provides proactive protection against credential theft. Windows Hello and TPM 2.0 work together to shield identities. Secure biometric sign-in virtually eliminates the risk of lost or stolen passwords. And enhanced phishing protection increases safety. In fact, **businesses reported 2.8x fewer instances of identity theft with the hardware-backed protection in Windows 11**[\[5\]](conclusion.md#footnote5). ### Gain mission-critical application safeguards @@ -43,7 +43,7 @@ Help keep business data secure and employees productive with robust safeguards a ### End-to-end protection with cloud-native management -Increase protection and efficiency with Windows 11 and chip-to-cloud security. Microsoft offers comprehensive cloud services for identity, storage, and access management. Microsoft provides the tools needed to attest that Windows 11 devices connecting to your network or accessing your data and resources are trustworthy. You can enforce compliance and conditional access with management solutions such as Microsoft Intune and cloud-based identity with Microsoft Entra ID. Security by default not only enables people to work securely anywhere, but it also simplifies IT. A streamlined, chip-to-cloud security solution based on Windows 11, improves productivity for IT and security teams by a reported 25% [\[8\]](conclusion.md#footnote8). +Increase protection and efficiency with Windows 11 and chip-to-cloud security. Microsoft offers comprehensive cloud services for identity, storage, and access management. Microsoft provides the tools needed to attest that Windows 11 devices connecting to your network or accessing your data and resources are trustworthy. You can enforce compliance and conditional access with management solutions such as Microsoft Intune and cloud-based identity with Microsoft Entra ID. Security by default not only enables people to work securely anywhere, but it also simplifies IT. A streamlined, chip-to-cloud security solution based on Windows 11, improves productivity for IT and security teams by a reported 25%[\[8\]](conclusion.md#footnote8). ## Security by design and default diff --git a/windows/security/book/operating-system-security-encryption-and-data-protection.md b/windows/security/book/operating-system-security-encryption-and-data-protection.md index caa221afea..6b6b528b59 100644 --- a/windows/security/book/operating-system-security-encryption-and-data-protection.md +++ b/windows/security/book/operating-system-security-encryption-and-data-protection.md @@ -13,7 +13,7 @@ When people travel with their PCs, their confidential information travels with t ## BitLocker -BitLocker Drive Encryption is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers. BitLocker uses the AES algorithm in XTS or CBC mode of operation with 128-bit or 256-bit key length to encrypt data on the volume. Cloud storage on Microsoft OneDrive or Azure[\[9\]](conclusion.md#footnote9) can be used to save recovery key content. BitLocker can be managed by any MDM solution such as Microsoft Intune[\[6\]](conclusion.md#footnote6) using a configuration service provider (CSP)[\[9\]](conclusion.md#footnote9). BitLocker provides encryption for the OS, fixed data, and removable data drives (BitLocker To Go), using technologies like Hardware Security Test Interface (HSTI), Modern Standby, UEFI Secure Boot, and TPM. +BitLocker is a data protection feature that integrates with the operating system and addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned devices. BitLocker uses the AES algorithm in XTS or CBC mode of operation with 128-bit or 256-bit key length to encrypt data on the volume. Cloud storage on Microsoft OneDrive or Azure[\[9\]](conclusion.md#footnote9) can be used to save recovery key content. BitLocker can be managed by a device management solution like Microsoft Intune[\[6\]](conclusion.md#footnote6) using a configuration service provider (CSP)[\[9\]](conclusion.md#footnote9). BitLocker provides encryption for the OS, fixed data, and removable data drives (BitLocker To Go), using technologies like Hardware Security Test Interface (HSTI), Modern Standby, UEFI Secure Boot, and TPM. :::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** @@ -29,9 +29,7 @@ BitLocker To Go refers to BitLocker Drive Encryption on removable data drives. B ## Device Encryption -Device Encryption is consumer-level device encryption that can't be managed. Device Encryption is turned on by default for devices with the right hardware components (for example, TPM 2.0, UEFI Secure Boot, Hardware Security Test Interface, and Modern Standby). However, for a commercial scenario, it's possible for commercial customers to disable Device Encryption in favor of BitLocker Drive Encryption. BitLocker Drive Encryption is manageable through MDM. - -:::image type="content" source="images/device-encryption.png" alt-text="Screenshot of Settings - device encryption."::: +Device Encryption is consumer-level device encryption that can't be managed. Device Encryption is turned on by default for devices with the right hardware components (for example, TPM 2.0, UEFI Secure Boot, Hardware Security Test Interface, and Modern Standby). However, for a commercial scenario, it's possible for organizations to disable Device Encryption in favor of BitLocker. :::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** @@ -39,7 +37,7 @@ Device Encryption is consumer-level device encryption that can't be managed. Dev ## Encrypted hard drive -*Encrypted hard drives* are a class of hard drives that are self-encrypted at the hardware level. They allow for full-disk hardware encryption and are transparent to the user. These drives combine the security and management benefits provided by BitLocker Drive Encryption, with the power of self-encrypting drives. +Encrypted hard drives are a class of hard drives that are self-encrypted at the hardware level. They allow for full-disk hardware encryption and are transparent to the user. These drives combine the security and management benefits provided by BitLocker Drive Encryption, with the power of self-encrypting drives. By offloading the cryptographic operations to hardware, encrypted hard drives increase BitLocker performance and reduce CPU usage and power consumption. Because encrypted hard drives encrypt data quickly, BitLocker deployment can be expanded across enterprise devices with little to no impact on productivity. @@ -56,9 +54,9 @@ Encrypted hard drives enable: ## Personal data encryption (PDE) -Personal Data Encryption refers to a new user authenticated encryption mechanism used to protect user content. Windows Hello for Business is the modern user authentication mechanism, which is used with PDE. Windows Hello for Business, either with PIN or biometrics (face or fingerprint), is used to protect the container, which houses the encryption keys used by Personal Data Encryption (PDE). When the user logs in (either after bootup or unlocking after a lock screen), the container gets authenticated to release the keys in the container to decrypt user content. +Personal Data Encryption refers to a user authenticated encryption mechanism used to protect user content. Windows Hello for Business is the modern user authentication mechanism used with PDE. Windows Hello for Business, either with PIN or biometrics (face or fingerprint), is used to protect the container, which houses the encryption keys used by Personal Data Encryption (PDE). When the user logs in (either after bootup or unlocking after a lock screen), the container gets authenticated to release the keys in the container to decrypt user content. -With the first release of PDE (Windows 11, version 22H2), the PDE API was available, which when adopted by applications can protect data under the purview of the applications. With the next Windows platform release, PDE for Folders will be released. This feature doesn't require updates to any applications, and protects the contents in the Known Windows Folders from bootup until first sign-in. +With the first release of PDE (Windows 11, version 22H2), the PDE API was available, which when adopted by applications can protect data under the purview of the applications. With the next Windows platform release, PDE for Folders will be released. This feature doesn't require updates to any applications, and protects the contents in the Known Windows Folders from bootup until first sign-in. :::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** @@ -66,7 +64,7 @@ With the first release of PDE (Windows 11, version 22H2), the PDE API was availa ## Email encryption -Email encryption enables users to encrypt outgoing email messages and attachments so that only intended recipients with a digital identification (ID) - also called a certificate - can read them.10 Users can digitally sign a message, which verifies the identity of the sender and ensures the message hasn't been tampered with. +Email encryption enables users to encrypt outgoing email messages and attachments so that only intended recipients with a digital identification (ID) - also called a certificate - can read them[\[10\]](conclusion.md#footnote10). Users can digitally sign a message, which verifies the identity of the sender and ensures the message hasn't been tampered with. These encrypted messages can be sent by a user to people within their organization and external contacts who have proper encryption certificates. diff --git a/windows/security/book/operating-system-security-network-security.md b/windows/security/book/operating-system-security-network-security.md index 1d37fb4775..932c58b935 100644 --- a/windows/security/book/operating-system-security-network-security.md +++ b/windows/security/book/operating-system-security-network-security.md @@ -25,13 +25,11 @@ In enterprise environments, network protection works best with Microsoft Defende Transport Layer Security (TLS) is a popular security protocol, encrypting data in transit to help provide a more secure communication channel between two endpoints. Windows enables the latest protocol versions and strong cipher suites by default and offers a full suite of extensions such as client authentication for enhanced server security, or session resumption for improved application performance. TLS 1.3 is the latest version of the protocol and is enabled by default in Windows. This version helps to eliminate obsolete cryptographic algorithms, enhance security over older versions, and aim to encrypt as much of the TLS handshake as possible. The handshake is more performant with one fewer round trip per connection on average and supports only strong cipher suites which provide perfect forward secrecy and less operational risk. Using TLS 1.3 will provide more privacy and lower latencies for encrypted online connections. Note that if the client or server application on either side of the connection does not support TLS 1.3, the connection will fall back to TLS 1.2. Windows uses the latest Datagram Transport Layer Security (DTLS) 1.2 for UDP communications. - :::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** - [TLS/SSL overview (Schannel SSP)](/windows-server/security/tls/tls-ssl-schannel-ssp-overview) - [TLS 1.0 and TLS 1.1 soon to be disabled in Windows](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/tls-1-0-and-tls-1-1-soon-to-be-disabled-in-windows/bc-p/3894928/emcs_t/S2h8ZW1haWx8dG9waWNfc3Vic2NyaXB0aW9ufExMM0hCN0VURDk3OU9OfDM4OTQ5Mjh8U1VCU0NSSVBUSU9OU3xoSw#M6180) - ## Domain Name System (DNS) security In Windows 11, the Windows DNS client supports DNS over HTTPS and DNS over TLS, two encrypted DNS protocols. These allow administrators to ensure their devices protect their @@ -46,7 +44,11 @@ Support for DNS encryption integrates with existing Windows DNS configurations s The number of Bluetooth devices connected to Windows 11 continues to increase. Windows users connect their Bluetooth headsets, mice, keyboards, and other accessories and improve their day-to-day PC experience by enjoying streaming, productivity, and gaming. Windows supports all standard Bluetooth pairing protocols, including classic and LE Secure connections, secure simple pairing, and classic and LE legacy pairing. Windows also implements host-based LE privacy. Windows updates help users stay current with OS and driver security features in accordance with the Bluetooth Special Interest Group (SIG) and Standard Vulnerability Reports, as well as issues beyond those required by the Bluetooth core industry standards. Microsoft strongly recommends that Bluetooth accessories' firmware and software are kept up to date. -IT-managed environments have a number of [Bluetooth policies](/windows/client-management/mdm/policy-csp-bluetooth) (MDM, Group Policy, and PowerShell) that can be managed through MDM tools such as Microsoft Intune[\[9\]](conclusion.md#footnote9). You can configure Windows to use Bluetooth technology while supporting the security needs of your organization. For example, you can allow input and audio while blocking file transfer, force encryption standards, limit Windows discoverability, or even disable Bluetooth entirely for the most sensitive environments. +IT-managed environments have a number policy settings available via configuration service providers, group policy, and PowerShell. These settings can be managed through device management solutions like Microsoft Intune[\[9\]](conclusion.md#footnote9). You can configure Windows to use Bluetooth technology while supporting the security needs of your organization. For example, you can allow input and audio while blocking file transfer, force encryption standards, limit Windows discoverability, or even disable Bluetooth entirely for the most sensitive environments. + +:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** + +- [Policy CSP - Bluetooth](/windows/client-management/mdm/policy-csp-bluetooth) ## Securing Wi-Fi connections @@ -86,7 +88,6 @@ support from the Firewall configuration service provider (CSP) and applying thes Firewall rule configuration with Package Family Name (PFN) is a new security feature introduced with the 22H2 release of Windows 11. PFN based rules enforced on an app will include processes request by the app to run on its behalf. Currently FW rules can be set on UWP apps with packageSID. However, the processes requested by the app can have different SID and hence the rules applied to the app can be bypassed. The new PFN condition feature ensures the FW rule is uniformly applied to a package and its associated processes. - :::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** - [Windows Firewall overview](../operating-system-security/network-security/windows-firewall/index.md) @@ -136,10 +137,6 @@ SMB Firewall changes: The built-in firewall rules doesn't contain the SMB NetBIO SMB auditing improvements: SMB now supports auditing use of SMB over QUIC, missing third party support for encryption, and missing third party support for signing. These all operate at the SMB server and SMB client level. - - - - :::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** - [File sharing using the SMB 3 protocol](/windows-server/storage/file-server/file-server-smb-overview) diff --git a/windows/security/book/operating-system-security-system-security.md b/windows/security/book/operating-system-security-system-security.md index a8113563d1..46fb829be3 100644 --- a/windows/security/book/operating-system-security-system-security.md +++ b/windows/security/book/operating-system-security-system-security.md @@ -91,7 +91,7 @@ Security policy settings are a critical part of your overall security strategy. - Whether to record a user or group's actions in the event log - Membership in a group -Security auditing is one of the most powerful tools that you can use to maintain the integrity of your network and assets. Auditing can help identify attacks, network vulnerabilities, and attacks against high-value targets. You can specify categories of security-related events to create an audit policy tailored to the needs of your organization using MDM policy or Group policy. +Security auditing is one of the most powerful tools that you can use to maintain the integrity of your network and assets. Auditing can help identify attacks, network vulnerabilities, and attacks against high-value targets. You can specify categories of security-related events to create an audit policy tailored to the needs of your organization using configuration service providers (CSP) or group policies. All auditing categories are disabled when Windows is first installed. Before enabling them, follow these steps to create an effective security auditing policy: @@ -119,16 +119,18 @@ Visibility and awareness of device security and health are key to any action tak ## Config Refresh -With traditional Group Policy, policies were refreshed on a PC when a user signed in and every 90 minutes by default. Administrators could adjust that timing to be shorter to ensure that the PC's policies were compliant with the management settings set by IT. +With traditional Group Policy, policy settings are refreshed on a PC when a user signs in and every 90 minutes by default. Administrators can adjust that timing to be shorter to ensure that the policy settings are compliant with the management settings set by IT. -By contrast, with an MDM solution like Microsoft Intune[\[9\]](conclusion.md#footnote9), policies are refreshed when a user signs in and then at eight-hour intervals by default. But as more available group policies were implemented through MDM, one remaining gap was the longer period between the reapplication of a changed policy. +By contrast, with a device management solution like Microsoft Intune[\[9\]](conclusion.md#footnote9), policies are refreshed when a user signs in and then at eight-hours interval by default. But policy settings are migrated from GPO to a device management solution, one remaining gap is the longer period between the reapplication of a changed policy. -Config Refresh allows settings in the Policy configuration service provider (CSP) that drift due to misconfiguration, registry edits, or malicious software on a PC to be reset to the value the administrator intended every 90 minutes by default. It is configurable to refresh every 30 minutes if desired. The Policy CSP covers hundreds of settings that were traditionally set with Group Policy and are now set through MDM. +Config Refresh allows settings in the Policy configuration service provider (CSP) that drift due to misconfiguration, registry edits, or malicious software on a PC to be reset to the value the administrator intended every 90 minutes by default. It's configurable to refresh every 30 minutes if desired. The Policy CSP covers hundreds of settings that were traditionally set with Group Policy and are now set through Mobile Device Management (MDM) protocols. + +Config Refresh can also be paused for a configurable period of time, after which it will be reenabled. This is to support scenarios where a helpdesk technician might need to reconfigure a device for troubleshooting purposes. It can also be resumed at any time by an administrator. + +:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:** -Config Refresh can also be *paused* for a configurable period of time, after which it will be reenabled. This is to support scenarios where a helpdesk technician might need to reconfigure a PC for troubleshooting purposes. It can also be resumed at any time by an administrator. - [Config Refresh](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/intro-to-config-refresh-a-refreshingly-new-mdm-feature/ba-p/4176921#:~:text=With%20Config%20Refresh,%20you%20can%20now) - ## Kiosk mode (Assigned Access and Shell Launcher) With Assigned Access, Windows devices restrict functionality to pre-selected applications depending on the user and keep individual identities separate, which is ideal for public-facing or shared devices. Configuring a device as a kiosk is a straightforward process. You can do this locally on the device or remotely using mobile device management. @@ -141,7 +143,7 @@ With Assigned Access, Windows devices restrict functionality to pre-selected app Windows protected print mode is exclusively built to provide a more modern and secure print system that maximizes compatibility and puts users first. It simplifies the printing experience by allowing PCs exclusively print using the Windows modern print stack. -Enabling Windows protected print mode is highly recommended. +Enabling Windows protected print mode is highly recommended. The benefits of Windows protected print mode include: @@ -149,9 +151,9 @@ The benefits of Windows protected print mode include: - Simplified and consistent printing experience, regardless of PC architecture. -- Removes the need to manage print drivers +- Removes the need to manage print drivers -Windows protected print mode is designed to work with Mopria certified printers only. Many existing printers are already compatible. +Windows protected print mode is designed to work with Mopria certified printers only. Many existing printers are already compatible. :::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**