From ceba5d7b6db2d3819f521d4ce6932c4c3bee7537 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 21 Oct 2019 09:54:39 +0530 Subject: [PATCH 01/69] First set of pages for Linux Copied from Mac --- ...oft-defender-atp-linux-install-manually.md | 185 ++++++ ...defender-atp-linux-install-with-ansible.md | 259 ++++++++ ...atp-linux-install-with-other-configtool.md | 79 +++ ...-defender-atp-linux-install-with-puppet.md | 253 +++++++ ...icrosoft-defender-atp-linux-preferences.md | 623 ++++++++++++++++++ .../microsoft-defender-atp-linux-privacy.md | 277 ++++++++ .../microsoft-defender-atp-linux-pua.md | 66 ++ .../microsoft-defender-atp-linux-resources.md | 118 ++++ .../microsoft-defender-atp-linux-updates.md | 219 ++++++ .../microsoft-defender-atp-linux.md | 113 ++++ 10 files changed, 2192 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md new file mode 100644 index 0000000000..bed05f108c --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md @@ -0,0 +1,185 @@ +--- +title: Installing Microsoft Defender ATP for Mac manually +ms.reviewer: +description: Describes how to install Microsoft Defender ATP for Mac manually, from the command line. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Manual deployment + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +This topic describes how to deploy Microsoft Defender ATP for Mac manually. A successful deployment requires the completion of all of the following steps: +- [Download installation and onboarding packages](#download-installation-and-onboarding-packages) +- [Application installation](#application-installation) +- [Client configuration](#client-configuration) + +## Prerequisites and system requirements + +Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. + +## Download installation and onboarding packages + +Download the installation and onboarding packages from Windows Defender Security Center: + +1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**. +2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**. +3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory. +4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. + + ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_page.png) + +5. From a command prompt, verify that you have the two files. + Extract the contents of the .zip files: + + ```bash + $ ls -l + total 721152 + -rw-r--r-- 1 test staff 6185 Mar 15 10:45 WindowsDefenderATPOnboardingPackage.zip + -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg + $ unzip WindowsDefenderATPOnboardingPackage.zip + Archive: WindowsDefenderATPOnboardingPackage.zip + inflating: WindowsDefenderATPOnboarding.py + ``` + +## Application installation + +To complete this process, you must have admin privileges on the machine. + +1. Navigate to the downloaded wdav.pkg in Finder and open it. + + ![App install screenshot](images/MDATP_28_AppInstall.png) + +2. Select **Continue**, agree with the License terms, and enter the password when prompted. + + ![App install screenshot](images/MDATP_29_AppInstallLogin.png) + + > [!IMPORTANT] + > You will be prompted to allow a driver from Microsoft to be installed (either "System Exception Blocked" or "Installation is on hold" or both. The driver must be allowed to be installed. + + ![App install screenshot](images/MDATP_30_SystemExtension.png) + +3. Select **Open Security Preferences** or **Open System Preferences > Security & Privacy**. Select **Allow**: + + ![Security and privacy window screenshot](images/MDATP_31_SecurityPrivacySettings.png) + +The installation proceeds. + +> [!NOTE] +> If you don't select **Allow**, the installation will proceed after 5 minutes. Defender ATP will be loaded, but real-time protection will be disabled. + +> [!NOTE] +> macOS may request to reboot the machine upon the first installation of Microsoft Defender. Real-Time Protection will not be available until the machine is rebooted. + +### Fixing disabled Real-Time Protection + +If you did not enable Microsoft's driver during installation, then the application displays a banner prompting you to enable it: + + ![RTP disabled screenshot](images/MDATP_32_Main_App_Fix.png) + +You can also run ```mdatp --health```. It reports if Real-Time Protection is enabled but not available: + +```bash +$ mdatp --health +... +realTimeProtectionAvailable : false +realTimeProtectionEnabled : true +... +``` + +> [!NOTE] +> You have a 30 minute window to enable Real-Time Protection from the warning banner, immediately following installation. + +The warning banner contains a **Fix** button, which allows you to quickly enable Real-Time Protection, without having to open a command prompt. Select the **Fix** button. It prompts the **Security & Privacy** system window, where you have to **Allow** system software from developers "Microsoft Corporation". + +If you don't see a prompt, it means that 30 or more minutes have already passed, and Real-Time Protection has still not been enabled: + +![Security and privacy window after prompt expired screenshot](images/MDATP_33_SecurityPrivacySettings_NoPrompt.png) + +In this case, you need to perform the following steps to enable Real-Time Protection instead. + +1. In Terminal, attempt to install the driver. (The operation will fail) + ```bash + $ sudo kextutil /Library/Extensions/wdavkext.kext + Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } + Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } + Diagnostics for /Library/Extensions/wdavkext.kext: + ``` + +2. Open **System Preferences...** > **Security & Privacy** from the menu. (Close it first, if it's opened.) + +3. **Allow** system software from developers "Microsoft Corporation" + +4. In Terminal, install the driver again. This time the operation will succeed: + +```bash +$ sudo kextutil /Library/Extensions/wdavkext.kext +``` + +The banner should disappear from the Defender application, and ```mdatp --health``` should now report that Real-Time Protection is both enabled and available: + +```bash +$ mdatp --health +... +realTimeProtectionAvailable : true +realTimeProtectionEnabled : true +... +``` + +## Client configuration + +1. Copy wdav.pkg and WindowsDefenderATPOnboarding.py to the machine where you deploy Microsoft Defender ATP for Mac. + + The client machine is not associated with orgId. Note that the *orgId* attribute is blank. + + ```bash + $ mdatp --health orgId + ``` + +2. Run the Python script to install the configuration file: + + ```bash + $ /usr/bin/python WindowsDefenderATPOnboarding.py + Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password) + ``` + +3. Verify that the machine is now associated with your organization and reports a valid *orgId*: + + ```bash + $ mdatp --health orgId + E6875323-A6C0-4C60-87AD-114BBE7439B8 + ``` + +After installation, you'll see the Microsoft Defender icon in the macOS status bar in the top-right corner. + + ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) + +## How to Allow Full Disk Access + +> [!CAUTION] +> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device. + +To grant consent, open System Preferences -> Security & Privacy -> Privacy -> Full Disk Access. Click the lock icon to make changes (bottom of the dialog box). Select Microsoft Defender ATP. + +## Logging installation issues + +See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. + +## Uninstallation + +See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md new file mode 100644 index 0000000000..84088ccd42 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md @@ -0,0 +1,259 @@ +--- +title: Installing Microsoft Defender ATP for Mac with JAMF +ms.reviewer: +description: Describes how to install Microsoft Defender ATP for Mac, using JAMF. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# JAMF-based deployment + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +This topic describes how to deploy Microsoft Defender ATP for Mac through JAMF. A successful deployment requires the completion of all of the following steps: +- [Download installation and onboarding packages](#download-installation-and-onboarding-packages) +- [Create JAMF policies](#create-jamf-policies) +- [Client device setup](#client-device-setup) +- [Deployment](#deployment) +- [Check onboarding status](#check-onboarding-status) + +## Prerequisites and system requirements + +Before you get started, please see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. + +In addition, for JAMF deployment, you need to be familiar with JAMF administration tasks, have a JAMF tenant, and know how to deploy packages. This includes having a properly configured distribution point. JAMF has many ways to complete the same task. These instructions provide an example for most common processes. Your organization might use a different workflow. + +## Download installation and onboarding packages + +Download the installation and onboarding packages from Windows Defender Security Center: + +1. In Windows Defender Security Center, go to **Settings > device Management > Onboarding**. +2. In Section 1 of the page, set the operating system to **Linux, macOS, iOS or Android** and deployment method to **Mobile Device Management / Microsoft Intune**. +3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. +4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. + + ![Windows Defender Security Center screenshot](images/MDATP_2_DownloadPackages.png) + +5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so: + + ```bash + $ ls -l + total 721160 + -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip + -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg + $ unzip WindowsDefenderATPOnboardingPackage.zip + Archive: WindowsDefenderATPOnboardingPackage.zip + warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators + inflating: intune/kext.xml + inflating: intune/WindowsDefenderATPOnboarding.xml + inflating: jamf/WindowsDefenderATPOnboarding.plist + ``` + +## Create JAMF policies + +You need to create a configuration profile and a policy to start deploying Microsoft Defender ATP for Mac to client devices. + +### Configuration Profile + +The configuration profile contains a custom settings payload that includes: + +- Microsoft Defender ATP for Mac onboarding information +- Approved Kernel Extensions payload, to enable running the Microsoft kernel driver + +To set the onboarding information, add a property list file with the name, _jamf/WindowsDefenderATPOnboarding.plist_, as a custom setting. You can do this by navigating to **Computers**>**Configuration Profiles**, selecting **New**, then choosing **Custom Settings**>**Configure**. From there, you can upload the property list. + + >[!IMPORTANT] + > You must set the Preference Domain as "com.microsoft.wdav.atp" + +![Configuration profile screenshot](images/MDATP_16_PreferenceDomain.png) + +### Approved Kernel Extension + +To approve the kernel extension: + +1. In **Computers > Configuration Profiles** select **Options > Approved Kernel Extensions**. +2. Use **UBF8T346G9** for Team Id. + +![Approved kernel extensions screenshot](images/MDATP_17_approvedKernelExtensions.png) + +### Privacy Preferences Policy Control + +> [!CAUTION] +> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device. +> +> If you previously configured Microsoft Defender ATP through JAMF, we recommend applying the following configuration. + +Add the following JAMF policy to grant Full Disk Access to Microsoft Defender ATP. + +1. Select **Options > Privacy Preferences Policy Control**. +2. Use any identifier and identifier type = Bundle. +3. Set Code Requirement to `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`. +4. Set app or service to SystemPolicyAllFiles and access to Allow. + +![Privacy Preferences Policy Control](images/MDATP_35_JAMF_PrivacyPreferences.png) + +#### Configuration Profile's Scope + +Configure the appropriate scope to specify the devices that will receive the configuration profile. + +Open **Computers** > **Configuration Profiles**, and select **Scope > Targets**. From there, select the devices you want to target. + +![Configuration profile scope screenshot](images/MDATP_18_ConfigurationProfilesScope.png) + +Save the **Configuration Profile**. + +Use the **Logs** tab to monitor deployment status for each enrolled device. + +### Package + +1. Create a package in **Settings > Computer Management > Packages**. + + ![Computer management packages screenshot](images/MDATP_19_MicrosoftDefenderWDAVPKG.png) + +2. Upload the package to the Distribution Point. +3. In the **filename** field, enter the name of the package. For example, _wdav.pkg_. + +### Policy + +Your policy should contain a single package for Microsoft Defender. + +![Microsoft Defender packages screenshot](images/MDATP_20_MicrosoftDefenderPackages.png) + +Configure the appropriate scope to specify the computers that will receive this policy. + +After you save the Configuration Profile, you can use the Logs tab to monitor the deployment status for each enrolled device. + +## Client device setup + +You'll need no special provisioning for a macOS computer, beyond the standard JAMF Enrollment. + +> [!NOTE] +> After a computer is enrolled, it will show up in the Computers inventory (All Computers). + +1. Open **Device Profiles**, from the **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's currently set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile. + +![MDM approve button screenshot](images/MDATP_21_MDMProfile1.png) +![MDM screenshot](images/MDATP_22_MDMProfileApproved.png) + +After a moment, the device's User Approved MDM status will change to **Yes**. + +![MDM status screenshot](images/MDATP_23_MDMStatus.png) + +You may now enroll additional devices. You may also enroll them later, after you have finished provisioning system configuration and application packages. + +## Deployment + +Enrolled client devices periodically poll the JAMF Server, and install new configuration profiles and policies as soon as they are detected. + +### Status on the server + +You can monitor deployment status in the **Logs** tab: + +- **Pending** means that the deployment is scheduled but has not yet happened +- **Completed** means that the deployment succeeded and is no longer scheduled + +![Status on server screenshot](images/MDATP_24_StatusOnServer.png) + +### Status on client device + +After the Configuration Profile is deployed, you'll see the profile for the device in **System Preferences** > **Profiles >**. + +![Status on client screenshot](images/MDATP_25_StatusOnClient.png) + +Once the policy is applied, you'll see the Microsoft Defender ATP icon in the macOS status bar in the top-right corner. + +![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) + +You can monitor policy installation on a device by following the JAMF log file: + +```bash + $ tail -f /var/log/jamf.log + Thu Feb 21 11:11:41 mavel-mojave jamf[7960]: No patch policies were found. + Thu Feb 21 11:16:41 mavel-mojave jamf[8051]: Checking for policies triggered by "recurring check-in" for user "testuser"... + Thu Feb 21 11:16:43 mavel-mojave jamf[8051]: Executing Policy WDAV + Thu Feb 21 11:17:02 mavel-mojave jamf[8051]: Installing Microsoft Defender... + Thu Feb 21 11:17:23 mavel-mojave jamf[8051]: Successfully installed Microsoft Defender. + Thu Feb 21 11:17:23 mavel-mojave jamf[8051]: Checking for patches... + Thu Feb 21 11:17:23 mavel-mojave jamf[8051]: No patch policies were found. +``` + +You can also check the onboarding status: + +```bash +$ mdatp --health +... +licensed : true +orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" +... +``` + +- **licensed**: This confirms that the device has an ATP license. + +- **orgid**: Your Microsoft Defender ATP org id; it will be the same for your organization. + +## Check onboarding status + +You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status: + +```bash +$ mdatp --health healthy +``` + +The above command prints "1" if the product is onboarded and functioning as expected. + +If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: +- 1 if the device is not yet onboarded +- 3 if the connection to the daemon cannot be established—for example, if the daemon is not running + +## Logging installation issues + +See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. + +## Uninstallation + +This method is based on the script described in [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling). + +### Script + +Create a script in **Settings > Computer Management > Scripts**. + +This script removes Microsoft Defender ATP from the /Applications directory: + +```bash + #!/bin/bash + + echo "Is WDAV installed?" + ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null + + echo "Uninstalling WDAV..." + rm -rf '/Applications/Microsoft Defender ATP.app' + + echo "Is WDAV still installed?" + ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null + + echo "Done!" +``` + +![Microsoft Defender uninstall screenshot](images/MDATP_26_Uninstall.png) + +### Policy + +Your policy should contain a single script: + +![Microsoft Defender uninstall script screenshot](images/MDATP_27_UninstallScript.png) + +Configure the appropriate scope in the **Scope** tab to specify the machines that will receive this policy. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md new file mode 100644 index 0000000000..91a5f56395 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md @@ -0,0 +1,79 @@ +--- +title: Installing Microsoft Defender ATP for Mac with different MDM product +description: Describes how to install Microsoft Defender ATP for Mac on other management solutions. +keywords: microsoft, defender, atp, mac, installation, deploy, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: mavel +author: maximvelichko +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Deployment with a different Mobile Device Management (MDM) system + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +## Prerequisites and system requirements + +Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. + +## Approach + +> [!CAUTION] +> Currently, Microsoft oficially supports only Intune and JAMF for the deployment and management of Microsoft Defender ATP for Mac. Microsoft makes no warranties, express or implied, with respect to the information provided below. + +If your organization uses a Mobile Device Management (MDM) solution that is not officially supported, this does not mean you are unable to deploy or run Microsoft Defender ATP for Mac. + +Microsoft Defender ATP for Mac does not depend on any vendor-specific features. It can be used with any MDM solution that supports the following features: + +- Deploy a macOS .pkg to managed machines. +- Deploy macOS system configuration profiles to managed machines. +- Run an arbitrary admin-configured tool/script on managed machines. + +Most modern MDM solutions include these features, however, they may call them differently. + +You can deploy Defender without the last requirement from the preceding list, however: + +- You will not be able to collect status in a centralized way +- If you decide to uninstall Defender, you will need to logon to the client machine locally as an administrator + +## Deployment + +Most MDM solutions use the same model for managing macOS machines, with similar terminology. Use [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) as a template. + +### Package + +Configure deployment of a [required application package](microsoft-defender-atp-mac-install-with-jamf.md#package), +with the installation package (wdav.pkg) downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages). + +In order to deploy the package to your enterprise, use the instructions associated with your MDM solution. + +### License settings + +Set up [a system configuration profile](microsoft-defender-atp-mac-install-with-jamf.md#configuration-profile). +Your MDM solution may call it something like "Custom Settings Profile", as Microsoft Defender ATP for Mac is not part of macOS. + +Use the property list, jamf/WindowsDefenderATPOnboarding.plist, which can be extracted from an onboarding package downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages). +Your system may support an arbitrary property list in XML format. You can upload the jamf/WindowsDefenderATPOnboarding.plist file as-is in that case. +Alternatively, it may require you to convert the property list to a different format first. + +Typically, your custom profile has an id, name, or domain attribute. You must use exactly "com.microsoft.wdav.atp" for this value. +MDM uses it to deploy the settings file to **/Library/Managed Preferences/com.microsoft.wdav.atp.plist** on a client machine, and Defender uses this file for loading the onboarding information. + +### Kernel extension policy + +Set up a KEXT or kernel extension policy. Use team identifier **UBF8T346G9** to whitelist kernel extensions provided by Microsoft. + +## Check installation status + +Run [mdatp](microsoft-defender-atp-mac-install-with-jamf.md#check-onboarding-status) on a client machine to check the onboarding status. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md new file mode 100644 index 0000000000..7a0f0c27d6 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md @@ -0,0 +1,253 @@ +--- +title: Installing Microsoft Defender ATP for Mac with Microsoft Intune +ms.reviewer: +description: Describes how to install Microsoft Defender ATP for Mac, using Microsoft Intune. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Microsoft Intune-based deployment + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +This topic describes how to deploy Microsoft Defender ATP for Mac through Intune. A successful deployment requires the completion of all of the following steps: +- [Download installation and onboarding packages](#download-installation-and-onboarding-packages) +- [Client device setup](#client-device-setup) +- [Create System Configuration profiles](#create-system-configuration-profiles) +- [Publish application](#publish-application) + +## Prerequisites and system requirements + +Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. + +## Download installation and onboarding packages + +Download the installation and onboarding packages from Microsoft Defender Security Center: + +1. In Microsoft Defender Security Center, go to **Settings** > **Device Management** > **Onboarding**. +2. In Section 1 of the page, set the operating system to **Linux, macOS, iOS, or Android** and the deployment method to **Mobile Device Management / Microsoft Intune**. +3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. +4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. +5. Download **IntuneAppUtil** from [https://docs.microsoft.com/intune/lob-apps-macos](https://docs.microsoft.com/intune/lob-apps-macos). + + ![Windows Defender Security Center screenshot](images/MDATP_2_DownloadPackages.png) + +6. From a command prompt, verify that you have the three files. + Extract the contents of the .zip files: + + ```bash + $ ls -l + total 721688 + -rw-r--r-- 1 test staff 269280 Mar 15 11:25 IntuneAppUtil + -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip + -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg + $ unzip WindowsDefenderATPOnboardingPackage.zip + Archive: WindowsDefenderATPOnboardingPackage.zip + warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators + inflating: intune/kext.xml + inflating: intune/WindowsDefenderATPOnboarding.xml + inflating: jamf/WindowsDefenderATPOnboarding.plist + ``` + +7. Make IntuneAppUtil an executable: + + ```bash + $ chmod +x IntuneAppUtil + ``` + +8. Create the wdav.pkg.intunemac package from wdav.pkg: + + ```bash + $ ./IntuneAppUtil -c wdav.pkg -o . -i "com.microsoft.wdav" -n "1.0.0" + Microsoft Intune Application Utility for Mac OS X + Version: 1.0.0.0 + Copyright 2018 Microsoft Corporation + + Creating intunemac file for /Users/test/Downloads/wdav.pkg + Composing the intunemac file output + Output written to ./wdav.pkg.intunemac. + + IntuneAppUtil successfully processed "wdav.pkg", + to deploy refer to the product documentation. + ``` + +## Client device setup + +You need no special provisioning for a Mac device beyond a standard [Company Portal installation](https://docs.microsoft.com/intune-user-help/enroll-your-device-in-intune-macos-cp). + +1. You are asked to confirm device management. + +![Confirm device management screenshot](images/MDATP_3_ConfirmDeviceMgmt.png) + +Select **Open System Preferences**, locate **Management Profile** on the list, and select **Approve...**. Your Management Profile would be displayed as **Verified**: + +![Management profile screenshot](images/MDATP_4_ManagementProfile.png) + +2. Select **Continue** and complete the enrollment. + +You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages. + +3. In Intune, open **Manage** > **Devices** > **All devices**. Here you can see your device among those listed: + +![Add Devices screenshot](images/MDATP_5_allDevices.png) + +## Create System Configuration profiles + +1. In Intune, open **Manage** > **Device configuration**. Select **Manage** > **Profiles** > **Create Profile**. +2. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select **Configure**. +3. Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections. +4. Select **OK**. + + ![System configuration profiles screenshot](images/MDATP_6_SystemConfigurationProfiles.png) + +5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. +6. Repeat steps 1 through 5 for more profiles. +7. Create another profile, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file. +8. Create tcc.xml file with content below. Create another profile, give it any name and upload this file to it. + + > [!CAUTION] + > macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device. + > + > The following configuration profile grants Full Disk Access to Microsoft Defender ATP. If you previously configured Microsoft Defender ATP through Intune, we recommend you update the deployment with this configuration profile. + + ```xml + + + + + PayloadDescription + Allows Microsoft Defender to access all files on Catalina+ + PayloadDisplayName + TCC - Microsoft Defender + PayloadIdentifier + com.microsoft.wdav.tcc + PayloadOrganization + Microsoft Corp. + PayloadRemovalDisallowed + + PayloadScope + system + PayloadType + Configuration + PayloadUUID + C234DF2E-DFF6-11E9-B279-001C4299FB44 + PayloadVersion + 1 + PayloadContent + + + PayloadDescription + Allows Microsoft Defender to access all files on Catalina+ + PayloadDisplayName + TCC - Microsoft Defender + PayloadIdentifier + com.microsoft.wdav.tcc.C233A5E6-DFF6-11E9-BDAD-001C4299FB44 + PayloadOrganization + Microsoft Corp. + PayloadType + com.apple.TCC.configuration-profile-policy + PayloadUUID + C233A5E6-DFF6-11E9-BDAD-001C4299FB44 + PayloadVersion + 1 + Services + + SystemPolicyAllFiles + + + Allowed + + CodeRequirement + identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9 + Comment + Allow SystemPolicyAllFiles control for Microsoft Defender ATP + Identifier + com.microsoft.wdav + IdentifierType + bundleID + + + + + + + + ``` + +9. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. + +Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**: + +![System configuration profiles screenshot](images/MDATP_7_DeviceStatusBlade.png) + +## Publish application + +1. In Intune, open the **Manage > Client apps** blade. Select **Apps > Add**. +2. Select **App type=Other/Line-of-business app**. +3. Select **file=wdav.pkg.intunemac**. Select **OK** to upload. +4. Select **Configure** and add the required information. +5. Use **macOS Sierra 10.12** as the minimum OS and set *Ignore app version* to **Yes**. Other settings can be any arbitrary value. + + > [!CAUTION] + > Failure to set *Ignore app version* to **Yes** impacts the ability of the application to receive updates through Microsoft AutoUpdate. See [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) for additional information about how the product is updated. + + ![Device status blade screenshot](images/MDATP_8_IntuneAppInfo.png) + +6. Select **OK** and **Add**. + + ![Device status blade screenshot](images/MDATP_9_IntunePkgInfo.png) + +7. It may take a few moments to upload the package. After it's done, select the package from the list and go to **Assignments** and **Add group**. + + ![Client apps screenshot](images/MDATP_10_ClientApps.png) + +8. Change **Assignment type** to **Required**. +9. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Click **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**. + + ![Intune assignments info screenshot](images/MDATP_11_Assignments.png) + +10. After some time the application will be published to all enrolled devices. You can see it listed in **Monitor** > **Device**, under **Device install status**: + + ![Intune device status screenshot](images/MDATP_12_DeviceInstall.png) + +## Verify client device state + +1. After the configuration profiles are deployed to your devices, open **System Preferences** > **Profiles** on your Mac device. + + ![System Preferences screenshot](images/MDATP_13_SystemPreferences.png) + ![System Preferences Profiles screenshot](images/MDATP_14_SystemPreferencesProfiles.png) + +2. Verify that the following configuration profiles are present and installed. The **Management Profile** should be the Intune system profile. _Wdav-config_ and _wdav-kext_ are system configuration profiles that were added in Intune: + ![Profiles screenshot](images/MDATP_15_ManagementProfileConfig.png) + +3. You should also see the Microsoft Defender icon in the top-right corner: + + ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) + +## Troubleshooting + +Issue: No license found + +Solution: Follow the steps above to create a device profile using WindowsDefenderATPOnboarding.xml + +## Logging installation issues + +For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) . + +## Uninstallation + +See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md new file mode 100644 index 0000000000..80ec6a0f67 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md @@ -0,0 +1,623 @@ +--- +title: Set preferences for Microsoft Defender ATP for Mac +ms.reviewer: +description: Describes how to configure Microsoft Defender ATP for Mac in enterprises. +keywords: microsoft, defender, atp, mac, management, preferences, enterprise, intune, jamf, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Set preferences for Microsoft Defender ATP for Mac + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +>[!IMPORTANT] +>This topic contains instructions for how to set preferences for Microsoft Defender ATP for Mac in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](microsoft-defender-atp-mac-resources.md#configuring-from-the-command-line) page. + +In enterprise environments, Microsoft Defender ATP for Mac can be managed through a configuration profile. This profile is deployed from management tool of your choice. Preferences managed by the enterprise take precedence over the ones set locally on the device. In other words, users in your enterprise are not able to change preferences that are set through this configuration profile. + +This topic describes the structure of this profile (including a recommended profile that you can use to get started) and instructions for how to deploy the profile. + +## Configuration profile structure + +The configuration profile is a .plist file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can either be simple (such as a numerical value) or complex, such as a nested list of preferences. + +>[!CAUTION] +>The layout of the configuration profile depends on the management console that you are using. The following sections contain examples of configuration profiles for JAMF and Intune. + +The top level of the configuration profile includes product-wide preferences and entries for subareas of the product, which are explained in more detail in the next sections. + +### Antivirus engine preferences + +The *antivirusEngine* section of the configuration profile is used to manage the preferences of the antivirus component of the product. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | antivirusEngine | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +#### Enable / disable real-time protection + +Whether real-time protection (scan files as they are accessed) is enabled or not. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | enableRealTimeProtection | +| **Data type** | Boolean | +| **Possible values** | true (default)
false | + +#### Enable / disable passive mode + +Whether the antivirus engine runs in passive mode or not. In passive mode: +- Real-time protection is turned off +- On-demand scanning is turned on +- Automatic threat remediation is turned off +- Security intelligence updates are turned on +- Status menu icon is hidden + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | passiveMode | +| **Data type** | Boolean | +| **Possible values** | false (default)
true | +| **Comments** | Available in Microsoft Defender ATP version 100.67.60 or higher. | + +#### Scan exclusions + +Entities that have been excluded from the scan. Exclusions can be specified by full paths, extensions, or file names. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | exclusions | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +**Type of exclusion** + +Specifies the type of content excluded from the scan. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | $type | +| **Data type** | String | +| **Possible values** | excludedPath
excludedFileExtension
excludedFileName | + +**Path to excluded content** + +Used to exclude content from the scan by full file path. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | path | +| **Data type** | String | +| **Possible values** | valid paths | +| **Comments** | Applicable only if *$type* is *excludedPath* | + +**Path type (file / directory)** + +Indicates if the *path* property refers to a file or directory. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | isDirectory | +| **Data type** | Boolean | +| **Possible values** | false (default)
true | +| **Comments** | Applicable only if *$type* is *excludedPath* | + +**File extension excluded from the scan** + +Used to exclude content from the scan by file extension. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | extension | +| **Data type** | String | +| **Possible values** | valid file extensions | +| **Comments** | Applicable only if *$type* is *excludedFileExtension* | + +**Name of excluded content** + +Used to exclude content from the scan by file name. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | name | +| **Data type** | String | +| **Possible values** | any string | +| **Comments** | Applicable only if *$type* is *excludedFileName* | + +#### Allowed threats + +List of threats (identified by their name) that are not blocked by the product and are instead allowed to run. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | allowedThreats | +| **Data type** | Array of strings | + +#### Threat type settings + +The *threatTypeSettings* preference in the antivirus engine is used to control how certain threat types are handled by the product. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | threatTypeSettings | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +**Threat type** + +Type of the threat for which the behavior is configured. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | key | +| **Data type** | String | +| **Possible values** | potentially_unwanted_application
archive_bomb | + +**Action to take** + +Action to take when coming across a threat of the type specified in the preceding section. Can be: + +- **Audit**: your device is not protected against this type of threat, but an entry about the threat is logged. +- **Block**: your device is protected against this type of threat and you are notified in the user interface and the security console. +- **Off**: your device is not protected against this type of threat and nothing is logged. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | value | +| **Data type** | String | +| **Possible values** | audit (default)
block
off | + +### Cloud delivered protection preferences + +The *cloudService* entry in the configuration profile is used to configure the cloud driven protection feature of the product. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | cloudService | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +#### Enable / disable cloud delivered protection + +Whether cloud delivered protection is enabled on the device or not. To improve the security of your services, we recommend keeping this feature turned on. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | enabled | +| **Data type** | Boolean | +| **Possible values** | true (default)
false | + +#### Diagnostic collection level + +Diagnostic data is used to keep Microsoft Defender ATP secure and up-to-date, detect, diagnose and fix problems, and also make product improvements. This setting determines the level of diagnostics sent by the product to Microsoft. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | diagnosticLevel | +| **Data type** | String | +| **Possible values** | optional (default)
required | + +#### Enable / disable automatic sample submissions + +Determines whether suspicious samples (that are likely to contain threats) are sent to Microsoft. You are prompted if the submitted file is likely to contain personal information. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | automaticSampleSubmission | +| **Data type** | Boolean | +| **Possible values** | true (default)
false | + +### User interface preferences + +The *userInterface* section of the configuration profile is used to manage the preferences of the user interface of the product. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | userInterface | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +#### Show / hide status menu icon + +Whether the status menu icon (shown in the top-right corner of the screen) is hidden or not. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | hideStatusMenuIcon | +| **Data type** | Boolean | +| **Possible values** | false (default)
true | + +## Recommended configuration profile + +To get started, we recommend the following configuration profile for your enterprise to take advantage of all protection features that Microsoft Defender ATP provides. + +The following configuration profile will: +- Enable real-time protection (RTP) +- Specify how the following threat types are handled: + - **Potentially unwanted applications (PUA)** are blocked + - **Archive bombs** (file with a high compression rate) are audited to the product logs +- Enable cloud delivered protection +- Enable automatic sample submission + +### JAMF profile + +```XML + + + + + antivirusEngine + + enableRealTimeProtection + + threatTypeSettings + + + key + potentially_unwanted_application + value + block + + + key + archive_bomb + value + audit + + + + cloudService + + enabled + + automaticSampleSubmission + + + + +``` + +### Intune profile + +```XML + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + antivirusEngine + + enableRealTimeProtection + + threatTypeSettings + + + key + potentially_unwanted_application + value + block + + + key + archive_bomb + value + audit + + + + cloudService + + enabled + + automaticSampleSubmission + + + + + + +``` + +## Full configuration profile example + +The following configuration profile contains entries for all settings described in this document and can be used for more advanced scenarios where you want more control over the product. + +### JAMF profile + +```XML + + + + + antivirusEngine + + enableRealTimeProtection + + passiveMode + + exclusions + + + $type + excludedPath + isDirectory + + path + /var/log/system.log + + + $type + excludedPath + isDirectory + + path + /home + + + $type + excludedFileExtension + extension + pdf + + + allowedThreats + + EICAR-Test-File (not a virus) + + threatTypeSettings + + + key + potentially_unwanted_application + value + block + + + key + archive_bomb + value + audit + + + + cloudService + + enabled + + diagnosticLevel + optional + automaticSampleSubmission + + + userInterface + + hideStatusMenuIcon + + + + +``` + +### Intune profile + +```XML + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + antivirusEngine + + enableRealTimeProtection + + passiveMode + + exclusions + + + $type + excludedPath + isDirectory + + path + /var/log/system.log + + + $type + excludedPath + isDirectory + + path + /home + + + $type + excludedFileExtension + extension + pdf + + + allowedThreats + + EICAR-Test-File (not a virus) + + threatTypeSettings + + + key + potentially_unwanted_application + value + block + + + key + archive_bomb + value + audit + + + + cloudService + + enabled + + diagnosticLevel + optional + automaticSampleSubmission + + + userInterface + + hideStatusMenuIcon + + + + + + +``` + +## Configuration profile deployment + +Once you've built the configuration profile for your enterprise, you can deploy it through the management console that your enterprise is using. The following sections provide instructions on how to deploy this profile using JAMF and Intune. + +### JAMF deployment + +From the JAMF console, open **Computers** > **Configuration Profiles**, navigate to the configuration profile you'd like to use, then select **Custom Settings**. Create an entry with *com.microsoft.wdav* as the preference domain and upload the .plist produced earlier. + +>[!CAUTION] +>You must enter the correct preference domain (*com.microsoft.wdav*), otherwise the preferences will not be recognized by the product. + +### Intune deployment + +1. Open **Manage** > **Device configuration**. Select **Manage** > **Profiles** > **Create Profile**. + +2. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select Configure. + +3. Save the .plist produced earlier as **com.microsoft.wdav.xml**. + +4. Enter **com.microsoft.wdav** as the **custom configuration profile name**. + +5. Open the configuration profile and upload **com.microsoft.wdav.xml**. This file was created in step 3. + +6. Select **OK**. + +7. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. + +>[!CAUTION] +>You must enter the correct custom configuration profile name, otherwise these preferences will not be recognized by the product. + +## Resources + +- [Configuration Profile Reference (Apple developer documentation)](https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md new file mode 100644 index 0000000000..0c56970e6f --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md @@ -0,0 +1,277 @@ +--- +title: Privacy for Microsoft Defender ATP for Mac +ms.reviewer: +description: Describes privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Mac. +keywords: microsoft, defender, atp, mac, privacy, diagnostic +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Privacy for Microsoft Defender ATP for Mac + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +Microsoft is committed to providing you with the information and controls you need to make choices about how your data is collected and used when you’re using Microsoft Defender ATP for Mac. + +This topic describes the privacy controls available within the product, how to manage these controls with policy settings and more details on the data events that are collected. + +## Overview of privacy controls in Microsoft Defender ATP for Mac + +This section describes the privacy controls for the different types of data collected by Microsoft Defender ATP for Mac. + +### Diagnostic data + +Diagnostic data is used to keep Microsoft Defender ATP secure and up-to-date, detect, diagnose and fix problems, and also make product improvements. + +Some diagnostic data is required, while some diagnostic data is optional. We give you the ability to choose whether to send us required or optional diagnostic data through the use of privacy controls, such as policy settings for organizations. + +There are two levels of diagnostic data for Microsoft Defender ATP client software that you can choose from: + +* **Required**: The minimum data necessary to help keep Microsoft Defender ATP secure, up-to-date, and performing as expected on the device it’s installed on. + +* **Optional**: Additional data that helps Microsoft make product improvements and provides enhanced information to help detect, diagnose, and remediate issues. + +By default, both optional and required diagnostic data are sent to Microsoft. + +### Cloud delivered protection data + +Cloud delivered protection is used to provide increased and faster protection with access to the latest protection data in the cloud. + +Enabling the cloud-delivered protection service is optional, however it is highly recommended because it provides important protection against malware on your endpoints and across your network. + +### Sample data + +Sample data is used to improve the protection capabilities of the product, by sending Microsoft suspicious samples so they can be analyzed. Enabling automatic sample submission is optional. + +When this feature is enabled and the sample that is collected is likely to contain personal information, the user is prompted for consent. + +## Manage privacy controls with policy settings + +If you're an IT administrator, you might want to configure these controls at the enterprise level. + +The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md). + +As with any new policy settings, you should carefully test them out in a limited, controlled environment to ensure the settings that you configure have the desired effect before you implement the policy settings more widely in your organization. + +## Diagnostic data events + +This section describes what is considered required diagnostic data and what is considered optional diagnostic data, along with a description of the events and fields that are collected. + +### Data fields that are common for all events +There is some information about events that is common to all events, regardless of category or data subtype. + +The following fields are considered common for all events: + +| Field | Description | +| ----------------------- | ----------- | +| platform | The broad classification of the platform on which the app is running. Allows Microsoft to identify on which platforms an issue may be occurring so that it can correctly be prioritized. | +| machine_guid | Unique identifier associated with the device. Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | +| sense_guid | Unique identifier associated with the device. Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | +| org_id | Unique identifier associated with the enterprise that the device belongs to. Allows Microsoft to identify whether issues are impacting a select set of enterprises and how many enterprises are impacted. | +| hostname | Local machine name (without DNS suffix). Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | +| product_guid | Unique identifier of the product. Allows Microsoft to differentiate issues impacting different flavors of the product. | +| app_version | Version of the Microsoft Defender ATP for Mac application. Allows Microsoft to identify which versions of the product are showing an issue so that it can correctly be prioritized.| +| sig_version | Version of security intelligence database. Allows Microsoft to identify which versions of the security intelligence are showing an issue so that it can correctly be prioritized. | +| supported_compressions | List of compression algorithms supported by the application, for example `['gzip']`. Allows Microsoft to understand what types of compressions can be used when it communicates with the application. | +| release_ring | Ring that the device is associated with (for example Insider Fast, Insider Slow, Production). Allows Microsoft to identify on which release ring an issue may be occurring so that it can correctly be prioritized. | + + +### Required diagnostic data + +**Required diagnostic data** is the minimum data necessary to help keep Microsoft Defender ATP secure, up-to-date, and perform as expected on the device it’s installed on. + +Required diagnostic data helps to identify problems with Microsoft Defender ATP that may be related to a device or software configuration. For example, it can help determine if a Microsoft Defender ATP feature crashes more frequently on a particular operating system version, with newly introduced features, or when certain Microsoft Defender ATP features are disabled. Required diagnostic data helps Microsoft detect, diagnose, and fix these problems more quickly so the impact to users or organizations is reduced. + +#### Software setup and inventory data events + +**Microsoft Defender ATP installation / uninstallation** + +The following fields are collected: + +| Field | Description | +| ---------------- | ----------- | +| correlation_id | Unique identifier associated with the installation. | +| version | Version of the package. | +| severity | Severity of the message (for example Informational). | +| code | Code that describes the operation. | +| text | Additional information associated with the product installation. | + +**Microsoft Defender ATP configuration** + +The following fields are collected: + +| Field | Description | +| --------------------------------------------------- | ----------- | +| antivirus_engine.enable_real_time_protection | Whether real-time protection is enabled on the device or not. | +| antivirus_engine.passive_mode | Whether passive mode is enabled on the device or not. | +| cloud_service.enabled | Whether cloud delivered protection is enabled on the device or not. | +| cloud_service.timeout | Time out when the application communicates with the Microsoft Defender ATP cloud. | +| cloud_service.heartbeat_interval | Interval between consecutive heartbeats sent by the product to the cloud. | +| cloud_service.service_uri | URI used to communicate with the cloud. | +| cloud_service.diagnostic_level | Diagnostic level of the device (required, optional). | +| cloud_service.automatic_sample_submission | Whether automatic sample submission is turned on or not. | +| edr.early_preview | Whether the machine should run EDR early preview features. | +| edr.group_id | Group identifier used by the detection and response component. | +| edr.tags | User-defined tags. | +| features.\[optional feature name\] | List of preview features, along with whether they are enabled or not. | + +#### Product and service performance data events + +**Kernel extension statistics** + +The following fields are collected: + +| Field | Description | +| ---------------- | ----------- | +| version | Version of Microsoft Defender ATP for Mac. | +| instance_id | Unique identifier generated on kernel extension startup. | +| trace_level | Trace level of the kernel extension. | +| ipc.connects | Number of connection requests received by the kernel extension. | +| ipc.rejects | Number of connection requests rejected by the kernel extension. | +| ipc.connected | Whether there is any active connection to the kernel extension. | + +#### Support data + +**Diagnostic logs** + +Diagnostic logs are collected only with the consent of the user as part of the feedback submission feature. The following files are collected as part of the support logs: + +- All files under */Library/Logs/Microsoft/mdatp/* +- Subset of files under */Library/Application Support/Microsoft/Defender/* that are created and used by Microsoft Defender ATP for Mac +- Subset of files under */Library/Managed Preferences* that are used by Microsoft Defender ATP for Mac +- /Library/Logs/Microsoft/autoupdate.log +- $HOME/Library/Preferences/com.microsoft.autoupdate2.plist + +### Optional diagnostic data + +**Optional diagnostic data** is additional data that helps Microsoft make product improvements and provides enhanced information to help detect, diagnose, and fix issues. + +If you choose to send us optional diagnostic data, required diagnostic data is also included. + +Examples of optional diagnostic data include data Microsoft collects about product configuration (for example number of exclusions set on the device) and product performance (aggregate measures about the performance of components of the product). + +#### Software setup and inventory data events + +**Microsoft Defender ATP configuration** + +The following fields are collected: + +| Field | Description | +| -------------------------------------------------- | ----------- | +| connection_retry_timeout | Connection retry time out when communication with the cloud. | +| file_hash_cache_maximum | Size of the product cache. | +| crash_upload_daily_limit | Limit of crash logs uploaded daily. | +| antivirus_engine.exclusions[].is_directory | Whether the exclusion from scanning is a directory or not. | +| antivirus_engine.exclusions[].path | Path that was excluded from scanning. | +| antivirus_engine.exclusions[].extension | Extension excluded from scanning. | +| antivirus_engine.exclusions[].name | Name of the file excluded from scanning. | +| antivirus_engine.scan_cache_maximum | Size of the product cache. | +| antivirus_engine.maximum_scan_threads | Maximum number of threads used for scanning. | +| antivirus_engine.threat_restoration_exclusion_time | Time out before a file restored from the quarantine can be detected again. | +| filesystem_scanner.full_scan_directory | Full scan directory. | +| filesystem_scanner.quick_scan_directories | List of directories used in quick scan. | +| edr.latency_mode | Latency mode used by the detection and response component. | +| edr.proxy_address | Proxy address used by the detection and response component. | + +**Microsoft Auto-Update configuration** + +The following fields are collected: + +| Field | Description | +| --------------------------- | ----------- | +| how_to_check | Determines how product updates are checked (for example automatic or manual). | +| channel_name | Update channel associated with the device. | +| manifest_server | Server used for downloading updates. | +| update_cache | Location of the cache used to store updates. | + +### Product and service usage + +#### Diagnostic log upload started report + +The following fields are collected: + +| Field | Description | +| ---------------- | ----------- | +| sha256 | SHA256 identifier of the support log. | +| size | Size of the support log. | +| original_path | Path to the support log (always under */Library/Application Support/Microsoft/Defender/wdavdiag/*). | +| format | Format of the support log. | + +#### Diagnostic log upload completed report + +The following fields are collected: + +| Field | Description | +| ---------------- | ----------- | +| request_id | Correlation ID for the support log upload request. | +| sha256 | SHA256 identifier of the support log. | +| blob_sas_uri | URI used by the application to upload the support log. | + +#### Product and service performance data events + +**Unexpected application exit (crash)** + +Unexpected application exits and the state of the application when that happens. + +**Kernel extension statistics** + +The following fields are collected: + +| Field | Description | +| ------------------------------ | ----------- | +| pkt_ack_timeout | The following properties are aggregated numerical values, representing count of events that happened since kernel extension startup. | +| pkt_ack_conn_timeout | | +| ipc.ack_pkts | | +| ipc.nack_pkts | | +| ipc.send.ack_no_conn | | +| ipc.send.nack_no_conn | | +| ipc.send.ack_no_qsq | | +| ipc.send.nack_no_qsq | | +| ipc.ack.no_space | | +| ipc.ack.timeout | | +| ipc.ack.ackd_fast | | +| ipc.ack.ackd | | +| ipc.recv.bad_pkt_len | | +| ipc.recv.bad_reply_len | | +| ipc.recv.no_waiter | | +| ipc.recv.copy_failed | | +| ipc.kauth.vnode.mask | | +| ipc.kauth.vnode.read | | +| ipc.kauth.vnode.write | | +| ipc.kauth.vnode.exec | | +| ipc.kauth.vnode.del | | +| ipc.kauth.vnode.read_attr | | +| ipc.kauth.vnode.write_attr | | +| ipc.kauth.vnode.read_ex_attr | | +| ipc.kauth.vnode.write_ex_attr | | +| ipc.kauth.vnode.read_sec | | +| ipc.kauth.vnode.write_sec | | +| ipc.kauth.vnode.take_own | | +| ipc.kauth.vnode.denied | | +| ipc.kauth.file_op.mask | | +| ipc.kauth_file_op.open | | +| ipc.kauth.file_op.close | | +| ipc.kauth.file_op.close_modified | | +| ipc.kauth.file_op.move | | +| ipc.kauth.file_op.link | | +| ipc.kauth.file_op.exec | | +| ipc.kauth.file_op.remove | | +| ipc.kauth.file_op.fork | | +| ipc.kauth.file_op.create | | + +## Resources + +- [Privacy at Microsoft](https://privacy.microsoft.com/) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md new file mode 100644 index 0000000000..2696590c99 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md @@ -0,0 +1,66 @@ +--- +title: Detect and block potentially unwanted applications +ms.reviewer: +description: Describes how to detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Mac. +keywords: microsoft, defender, atp, mac, pua, pus +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Detect and block potentially unwanted applications + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +The potentially unwanted application (PUA) protection feature in Microsoft Defender ATP for Mac can detect and block PUA files on endpoints in your network. + +These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have poor reputation. + +These applications can increase the risk of your network being infected with malware, cause malware infections to be harder to identify, and can waste IT resources in cleaning up the applications. + +## How it works + +Microsoft Defender ATP for Mac can detect and report PUA files. When configured in blocking mode, PUA files are moved to the quarantine. + +When a PUA is detected on an endpoint, Microsoft Defender ATP for Mac presents a notification to the user, unless notifications have been disabled. The threat name will contain the word "Application". + +## Configure PUA protection + +PUA protection in Microsoft Defender ATP for Mac can be configured in one of the following ways: + +- **Off**: PUA protection is disabled. +- **Audit**: PUA files are reported in the product logs, but not in Microsoft Defender Security Center. No notification is presented to the user and no action is taken by the product. +- **Block**: PUA files are reported in the product logs and in Microsoft Defender Security Center. The user is presented with a notification and action is taken by the product. + +>[!WARNING] +>By default, PUA protection is configured in **Audit** mode. + +You can configure how PUA files are handled from the command line or from the management console. + +### Use the command-line tool to configure PUA protection: + +In Terminal, execute the following command to configure PUA protection: + +```bash +$ mdatp --threat --type-handling potentially_unwanted_application [off|audit|block] +``` + +### Use the management console to configure PUA protection: + +In your enterprise, you can configure PUA protection from a management console, such as JAMF or Intune, similarly to how other product settings are configured. For more information, see the [Threat type settings](microsoft-defender-atp-mac-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) topic. + +## Related topics + +- [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md new file mode 100644 index 0000000000..2f67653ec0 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md @@ -0,0 +1,118 @@ +--- +title: Microsoft Defender ATP for Mac Resources +ms.reviewer: +description: Describes resources for Microsoft Defender ATP for Mac, including how to uninstall it, how to collect diagnostic logs, CLI commands, and known issues with the product. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Resources + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +## Collecting diagnostic information + +If you can reproduce a problem, please increase the logging level, run the system for some time, and restore the logging level to the default. + +1. Increase logging level: + + ```bash + $ mdatp --log-level verbose + Creating connection to daemon + Connection established + Operation succeeded + ``` + +2. Reproduce the problem + +3. Run `sudo mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds. + + ```bash + $ sudo mdatp --diagnostic --create + Creating connection to daemon + Connection established + ``` + +4. Restore logging level: + + ```bash + $ mdatp --log-level info + Creating connection to daemon + Connection established + Operation succeeded + ``` + +## Logging installation issues + +If an error occurs during installation, the installer will only report a general failure. + +The detailed log will be saved to /Library/Logs/Microsoft/mdatp/install.log. If you experience issues during installation, send us this file so we can help diagnose the cause. + +## Uninstalling + +There are several ways to uninstall Microsoft Defender ATP for Mac. Please note that while centrally managed uninstall is available on JAMF, it is not yet available for Microsoft Intune. + +### Interactive uninstallation + +- Open **Finder > Applications**. Right click on **Microsoft Defender ATP > Move to Trash**. + +### From the command line + +- ```sudo rm -rf '/Applications/Microsoft Defender ATP'``` + +## Configuring from the command line + +Important tasks, such as controlling product settings and triggering on-demand scans, can be done from the command line: + +|Group |Scenario |Command | +|-------------|-------------------------------------------|-----------------------------------------------------------------------| +|Configuration|Turn on/off real-time protection |`mdatp --config realTimeProtectionEnabled [true/false]` | +|Configuration|Turn on/off cloud protection |`mdatp --config cloudEnabled [true/false]` | +|Configuration|Turn on/off product diagnostics |`mdatp --config cloudDiagnosticEnabled [true/false]` | +|Configuration|Turn on/off automatic sample submission |`mdatp --config cloudAutomaticSampleSubmission [true/false]` | +|Configuration|Turn on PUA protection |`mdatp --threat --type-handling potentially_unwanted_application block`| +|Configuration|Turn off PUA protection |`mdatp --threat --type-handling potentially_unwanted_application off` | +|Configuration|Turn on audit mode for PUA protection |`mdatp --threat --type-handling potentially_unwanted_application audit`| +|Diagnostics |Change the log level |`mdatp --log-level [error/warning/info/verbose]` | +|Diagnostics |Generate diagnostic logs |`mdatp --diagnostic --create` | +|Health |Check the product's health |`mdatp --health` | +|Protection |Scan a path |`mdatp --scan --path [path]` | +|Protection |Do a quick scan |`mdatp --scan --quick` | +|Protection |Do a full scan |`mdatp --scan --full` | +|Protection |Cancel an ongoing on-demand scan |`mdatp --scan --cancel` | +|Protection |Request a security intelligence update |`mdatp --definition-update` | + +## Microsoft Defender ATP portal information + +In the Microsoft Defender ATP portal, you'll see two categories of information: + +- Antivirus alerts, including: + - Severity + - Scan type + - Device information (hostname, machine identifier, tenant identifier, app version, and OS type) + - File information (name, path, size, and hash) + - Threat information (name, type, and state) +- Device information, including: + - Machine identifier + - Tenant identifier + - App version + - Hostname + - OS type + - OS version + - Computer model + - Processor architecture + - Whether the device is a virtual machine diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md new file mode 100644 index 0000000000..50267f26bb --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md @@ -0,0 +1,219 @@ +--- +title: Deploy updates for Microsoft Defender ATP for Mac +ms.reviewer: +description: Describes how to control updates for Microsoft Defender ATP for Mac in enterprise environments. +keywords: microsoft, defender, atp, mac, updates, deploy +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Deploy updates for Microsoft Defender ATP for Mac + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. + +To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. By default, MAU automatically checks for updates daily, but you can change that to weekly, monthly, or manually. + +![MAU screenshot](images/MDATP_34_MAU.png) + +If you decide to deploy updates by using your software distribution tools, you should configure MAU to manually check for software updates. You can deploy preferences to configure how and when MAU checks for updates for the Macs in your organization. + +## Use msupdate + +MAU includes a command-line tool, called *msupdate*, that is designed for IT administrators so that they have more precise control over when updates are applied. Instructions for how to use this tool can be found in [Update Office for Mac by using msupdate](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate). + +In MAU, the application identifier for Microsoft Defender ATP for Mac is *WDAV00*. To download and install the latest updates for Microsoft Defender ATP for Mac, execute the following command from a Terminal window: + +``` +./msupdate --install --apps wdav00 +``` + +## Set preferences for Microsoft AutoUpdate + +This section describes the most common preferences that can be used to configure MAU. These settings can be deployed as a configuration profile through the management console that your enterprise is using. An example of a configuration profile is shown in the following sections. + +### Set the channel name + +The channel determines the type and frequency of updates that are offered through MAU. Devices in `InsiderFast` (corresponding to the Insider Fast channel) can try out new features before devices in `External` (corresponding to the Insider Slow channel) and `Production`. + +The `Production` channel contains the most stable version of the product. + +>[!TIP] +>In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to `InsiderFast` or `External`. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | ChannelName | +| **Data type** | String | +| **Possible values** | InsiderFast
External
Production | + +### Set update check frequency + +Change how often MAU searches for updates. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | UpdateCheckFrequency | +| **Data type** | Integer | +| **Default value** | 720 (minutes) | +| **Comment** | This value is set in minutes. | + +### Change how MAU interacts with updates + +Change how MAU searches for updates. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | HowToCheck | +| **Data type** | String | +| **Possible values** | Manual
AutomaticCheck
AutomaticDownload | +| **Comment** | Note that AutomaticDownload will do a download and install silently if possible. | + +### Change whether the "Check for Updates" button is enabled + +Change whether local users will be able to click the "Check for Updates" option in the Microsoft AutoUpdate user interface. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | EnableCheckForUpdatesButton | +| **Data type** | Boolean | +| **Possible values** | True (default)
False | + +### Disable Insider checkbox + +Set to true to make the "Join the Office Insider Program..." checkbox unavailable / greyed out to users. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | DisableInsiderCheckbox | +| **Data type** | Boolean | +| **Possible values** | False (default)
True | + +### Limit the telemetry that is sent from MAU + +Set to false to send minimal heartbeat data, no application usage, and no environment details. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | SendAllTelemetryEnabled | +| **Data type** | Boolean | +| **Possible values** | True (default)
False | + +## Example configuration profile + +The following configuration profile is used to: +- Place the device in the Insider Fast channel +- Automatically download and install updates +- Enable the "Check for updates" button in the user interface +- Allow users on the device to enroll into the Insider channels + +### JAMF + +```XML + + + + + ChannelName + InsiderFast + HowToCheck + AutomaticDownload + EnableCheckForUpdatesButton + + DisableInsiderCheckbox + + SendAllTelemetryEnabled + + + +``` + +### Intune + +```XML + + + + + PayloadUUID + B762FF60-6ACB-4A72-9E72-459D00C936F3 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.autoupdate2 + PayloadDisplayName + Microsoft AutoUpdate settings + PayloadDescription + Microsoft AutoUpdate configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 5A6F350A-CC2C-440B-A074-68E3F34EBAE9 + PayloadType + com.microsoft.autoupdate2 + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.autoupdate2 + PayloadDisplayName + Microsoft AutoUpdate configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + ChannelName + InsiderFast + HowToCheck + AutomaticDownload + EnableCheckForUpdatesButton + + DisableInsiderCheckbox + + SendAllTelemetryEnabled + + + + + +``` + +To configure MAU, you can deploy this configuration profile from the management tool that your enterprise is using: +- From JAMF, upload this configuration profile and set the Preference Domain to *com.microsoft.autoupdate2*. +- From Intune, upload this configuration profile and set the custom configuration profile name to *com.microsoft.autoupdate2*. + +## Resources + +- [msupdate reference](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md new file mode 100644 index 0000000000..f87f5332c7 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -0,0 +1,113 @@ +--- +title: Microsoft Defender ATP for Mac +ms.reviewer: +description: Describes how to install and use Microsoft Defender ATP for Mac. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Microsoft Defender Advanced Threat Protection for Mac + +This topic describes how to install, configure, update, and use Microsoft Defender ATP for Mac. + +> [!CAUTION] +> Running other third-party endpoint protection products alongside Microsoft Defender ATP for Mac is likely to lead to performance problems and unpredictable side effects. + +## What’s new in the latest release + +[What's new](microsoft-defender-atp-mac-whatsnew.md) + +If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**. + +## How to install Microsoft Defender ATP for Mac + +### Prerequisites + +- Access to the Microsoft Defender Security Center portal +- Beginner-level experience in macOS and BASH scripting +- Administrative privileges on the device (in case of manual deployment) + +### System requirements + +> [!CAUTION] +> The three most recent major releases of macOS are supported. Beta versions of macOS are not supported. + +- Supported macOS versions: 10.14 (Mojave), 10.13 (High Sierra), 10.12 (Sierra) +- Disk space: 650 MB + +After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints. + +The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. + +| Service location | DNS record | +| ---------------------------------------- | ----------------------- | +| Common URLs for all locations | x.cp.wd.microsoft.com
cdn.x.cp.wd.microsoft.com
eu-cdn.x.cp.wd.microsoft.com
wu-cdn.x.cp.wd.microsoft.com
*.blob.core.windows.net
officecdn-microsoft-com.akamaized.net | +| European Union | europe.x.cp.wd.microsoft.com | +| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com | +| United States | unitedstates.x.cp.wd.microsoft.com | + +Microsoft Defender ATP can discover a proxy server by using the following discovery methods: +- Web Proxy Auto-discovery Protocol (WPAD) +- Manual static proxy configuration + +If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs. + +To test that a connection is not blocked, open [https://x.cp.wd.microsoft.com/api/report](https://x.cp.wd.microsoft.com/api/report) and [https://cdn.x.cp.wd.microsoft.com/ping](https://cdn.x.cp.wd.microsoft.com/ping) in a browser. + +If you prefer the command line, you can also check the connection by running the following command in Terminal: + +```bash +$ curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'https://cdn.x.cp.wd.microsoft.com/ping' +``` + +The output from this command should be similar to the following: + +> `OK https://x.cp.wd.microsoft.com/api/report` +> +> `OK https://cdn.x.cp.wd.microsoft.com/ping` + +> [!CAUTION] +> We recommend that you keep [System Integrity Protection](https://support.apple.com/en-us/HT204899) (SIP) enabled on client machines. SIP is a built-in macOS security feature that prevents low-level tampering with the OS, and is enabled by default. + +### Installation instructions + +There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac. + +In general you need to take the following steps: + +- Ensure that you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal +- Deploy Microsoft Defender ATP for Mac using one of the following deployment methods: + - Via third-party management tools: + - [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md) + - [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) + - [Other MDM products](microsoft-defender-atp-mac-install-with-other-mdm.md) + - Via the command-line tool: + - [Manual deployment](microsoft-defender-atp-mac-install-manually.md) + +## How to update Microsoft Defender ATP for Mac + +Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. + +To read more on how to configure MAU in enterprise environments, refer to [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) + +## How to configure Microsoft Defender ATP for Mac + +Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md). + +## Resources + +- For more information about logging, uninstalling, or other topics, see the [Resources](microsoft-defender-atp-mac-resources.md) page. + +- [Privacy for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-privacy.md) From 9e19ea28af8c96d07364ecb8b6819d8ed40fd72f Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 21 Oct 2019 10:53:14 +0530 Subject: [PATCH 02/69] Updated overview section for Linux Updated overview section for Linux --- .../microsoft-defender-atp-linux.md | 70 +++++++++---------- 1 file changed, 35 insertions(+), 35 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index f87f5332c7..2a1e938b11 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -1,8 +1,8 @@ --- -title: Microsoft Defender ATP for Mac +title: Microsoft Defender ATP for Linux ms.reviewer: -description: Describes how to install and use Microsoft Defender ATP for Mac. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +description: Describes how to install and use Microsoft Defender ATP for Linux. +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, edhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,34 +18,33 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Microsoft Defender Advanced Threat Protection for Mac +# Microsoft Defender Advanced Threat Protection for Linux -This topic describes how to install, configure, update, and use Microsoft Defender ATP for Mac. +This topic describes how to install, configure, update, and use Microsoft Defender ATP for Linux. > [!CAUTION] -> Running other third-party endpoint protection products alongside Microsoft Defender ATP for Mac is likely to lead to performance problems and unpredictable side effects. +> Running other third-party endpoint protection products alongside Microsoft Defender ATP for Linux is likely to lead to performance problems and unpredictable side effects. + +> [!NOTE] +>How would users give us feedback? +> **TODO:** Should we add atp --feedback "Feedback" that will send the feedback to us / OCV. I am keeping the original line for reference. +> +> If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**. -## What’s new in the latest release - -[What's new](microsoft-defender-atp-mac-whatsnew.md) - -If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**. - -## How to install Microsoft Defender ATP for Mac +## How to install Microsoft Defender ATP for Linux ### Prerequisites - Access to the Microsoft Defender Security Center portal -- Beginner-level experience in macOS and BASH scripting +- Beginner-level experience in Linux and BASH scripting - Administrative privileges on the device (in case of manual deployment) ### System requirements -> [!CAUTION] -> The three most recent major releases of macOS are supported. Beta versions of macOS are not supported. - -- Supported macOS versions: 10.14 (Mojave), 10.13 (High Sierra), 10.12 (Sierra) -- Disk space: 650 MB +- Supported Linux distributions and versions: RHEL 7, Oracle 7, CentOS 7, Ubuntu 16 and 18, Debian 9 +- Disk space: 650 MB. +> [!NOTE] +>**TODO**: Verify this After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints. @@ -58,6 +57,9 @@ The following table lists the services and their associated URLs that your netwo | United Kingdom | unitedkingdom.x.cp.wd.microsoft.com | | United States | unitedstates.x.cp.wd.microsoft.com | +>[!NOTE] +> **TODO:** Verify the proxy paragraph + Microsoft Defender ATP can discover a proxy server by using the following discovery methods: - Web Proxy Auto-discovery Protocol (WPAD) - Manual static proxy configuration @@ -78,36 +80,34 @@ The output from this command should be similar to the following: > > `OK https://cdn.x.cp.wd.microsoft.com/ping` -> [!CAUTION] -> We recommend that you keep [System Integrity Protection](https://support.apple.com/en-us/HT204899) (SIP) enabled on client machines. SIP is a built-in macOS security feature that prevents low-level tampering with the OS, and is enabled by default. - ### Installation instructions -There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac. +There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Linux. In general you need to take the following steps: - Ensure that you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal -- Deploy Microsoft Defender ATP for Mac using one of the following deployment methods: +- Deploy Microsoft Defender ATP for Linux using one of the following deployment methods: - Via third-party management tools: - - [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md) - - [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) - - [Other MDM products](microsoft-defender-atp-mac-install-with-other-mdm.md) + - [Deploy using Puppet configuration management tool](microsoft-defender-atp-linux-install-with-puppet.md) + - [Deploy using Ansbile configuration management tool](microsoft-defender-atp-linux-install-with-ansible.md) + - [Other configuration management tools](microsoft-defender-atp-linux-install-with-other-configtool.md) - Via the command-line tool: - - [Manual deployment](microsoft-defender-atp-mac-install-manually.md) + - [Manual deployment](microsoft-defender-atp-linux-install-manually.md) -## How to update Microsoft Defender ATP for Mac +## How to update Microsoft Defender ATP for Linux -Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. +>[!NOTE] +> **TODO:** Upgrade story is not very clear right now! -To read more on how to configure MAU in enterprise environments, refer to [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) +Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Linux, refer to [Deploy updates for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-updates.md) -## How to configure Microsoft Defender ATP for Mac +## How to configure Microsoft Defender ATP for Linux -Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md). +Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md). ## Resources -- For more information about logging, uninstalling, or other topics, see the [Resources](microsoft-defender-atp-mac-resources.md) page. +- For more information about logging, uninstalling, or other topics, see the [Resources](microsoft-defender-atp-linux-resources.md) page. -- [Privacy for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-privacy.md) +- [Privacy for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-privacy.md) From 4b130022ee3f552aa42b364ab15135f622b63cc1 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 21 Oct 2019 13:41:01 +0530 Subject: [PATCH 03/69] Updated manual install steps for Linux Updated manual install steps for Linux --- ...oft-defender-atp-linux-install-manually.md | 141 +++++------------- 1 file changed, 41 insertions(+), 100 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md index bed05f108c..490b35ec75 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md @@ -1,8 +1,8 @@ --- -title: Installing Microsoft Defender ATP for Mac manually +title: Installing Microsoft Defender ATP for Linux manually ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Mac manually, from the command line. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +description: Describes how to install Microsoft Defender ATP for Linux manually, from the command line. +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, edhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -22,36 +22,43 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -This topic describes how to deploy Microsoft Defender ATP for Mac manually. A successful deployment requires the completion of all of the following steps: -- [Download installation and onboarding packages](#download-installation-and-onboarding-packages) +This topic describes how to deploy Microsoft Defender ATP for Linux manually. A successful deployment requires the completion of all of the following steps: + +- [Configure Microsoft's Linux Software Repository](#configure-microsoft's-linux-software-repository) +- [Download onboarding packages](#download-onboarding-package) - [Application installation](#application-installation) - [Client configuration](#client-configuration) ## Prerequisites and system requirements -Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. +Before you get started, see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. -## Download installation and onboarding packages +## Configure Microsoft's Linux Software Repository -Download the installation and onboarding packages from Windows Defender Security Center: +Follow the steps given in [Configure Microsoft's Linux Software Repository](https://docs.microsoft.com/en-us/windows-server/administration/linux-package-repository-for-microsoft-software) to setup the repository. + +> [!NOTE] +> **TODO:** Use a forward link for above instead of URL + +## Download onboarding package + +Download the onboarding package from Windows Defender Security Center: 1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**. 2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**. -3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory. -4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. +3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_page.png) -5. From a command prompt, verify that you have the two files. - Extract the contents of the .zip files: +4. From a command prompt, verify that you have the file. + Extract the contents of the .zip file: ```bash $ ls -l - total 721152 - -rw-r--r-- 1 test staff 6185 Mar 15 10:45 WindowsDefenderATPOnboardingPackage.zip - -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg + total 8 + -rw-r--r-- 1 test staff 6287 Oct 21 11:22 WindowsDefenderATPOnboardingPackage.zip $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip inflating: WindowsDefenderATPOnboarding.py @@ -61,89 +68,24 @@ Download the installation and onboarding packages from Windows Defender Security To complete this process, you must have admin privileges on the machine. -1. Navigate to the downloaded wdav.pkg in Finder and open it. +1. Install Microsoft Defender ATP for Linux - ![App install screenshot](images/MDATP_28_AppInstall.png) + - ### Enterprise Linux (RHEL and variants) -2. Select **Continue**, agree with the License terms, and enter the password when prompted. - - ![App install screenshot](images/MDATP_29_AppInstallLogin.png) - - > [!IMPORTANT] - > You will be prompted to allow a driver from Microsoft to be installed (either "System Exception Blocked" or "Installation is on hold" or both. The driver must be allowed to be installed. - - ![App install screenshot](images/MDATP_30_SystemExtension.png) - -3. Select **Open Security Preferences** or **Open System Preferences > Security & Privacy**. Select **Allow**: - - ![Security and privacy window screenshot](images/MDATP_31_SecurityPrivacySettings.png) - -The installation proceeds. - -> [!NOTE] -> If you don't select **Allow**, the installation will proceed after 5 minutes. Defender ATP will be loaded, but real-time protection will be disabled. - -> [!NOTE] -> macOS may request to reboot the machine upon the first installation of Microsoft Defender. Real-Time Protection will not be available until the machine is rebooted. - -### Fixing disabled Real-Time Protection - -If you did not enable Microsoft's driver during installation, then the application displays a banner prompting you to enable it: - - ![RTP disabled screenshot](images/MDATP_32_Main_App_Fix.png) - -You can also run ```mdatp --health```. It reports if Real-Time Protection is enabled but not available: - -```bash -$ mdatp --health -... -realTimeProtectionAvailable : false -realTimeProtectionEnabled : true -... -``` - -> [!NOTE] -> You have a 30 minute window to enable Real-Time Protection from the warning banner, immediately following installation. - -The warning banner contains a **Fix** button, which allows you to quickly enable Real-Time Protection, without having to open a command prompt. Select the **Fix** button. It prompts the **Security & Privacy** system window, where you have to **Allow** system software from developers "Microsoft Corporation". - -If you don't see a prompt, it means that 30 or more minutes have already passed, and Real-Time Protection has still not been enabled: - -![Security and privacy window after prompt expired screenshot](images/MDATP_33_SecurityPrivacySettings_NoPrompt.png) - -In this case, you need to perform the following steps to enable Real-Time Protection instead. - -1. In Terminal, attempt to install the driver. (The operation will fail) ```bash - $ sudo kextutil /Library/Extensions/wdavkext.kext - Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } - Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } - Diagnostics for /Library/Extensions/wdavkext.kext: + sudo yum install mdatp ``` -2. Open **System Preferences...** > **Security & Privacy** from the menu. (Close it first, if it's opened.) + - ### Ubuntu and Debian systems -3. **Allow** system software from developers "Microsoft Corporation" + ```bash + sudo apt-get install mdatp + ``` -4. In Terminal, install the driver again. This time the operation will succeed: - -```bash -$ sudo kextutil /Library/Extensions/wdavkext.kext -``` - -The banner should disappear from the Defender application, and ```mdatp --health``` should now report that Real-Time Protection is both enabled and available: - -```bash -$ mdatp --health -... -realTimeProtectionAvailable : true -realTimeProtectionEnabled : true -... -``` ## Client configuration -1. Copy wdav.pkg and WindowsDefenderATPOnboarding.py to the machine where you deploy Microsoft Defender ATP for Mac. +1. Copy WindowsDefenderATPOnboarding.py to the machine where you deploy Microsoft Defender ATP for Linux. The client machine is not associated with orgId. Note that the *orgId* attribute is blank. @@ -155,8 +97,10 @@ realTimeProtectionEnabled : true ```bash $ /usr/bin/python WindowsDefenderATPOnboarding.py - Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password) + Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudo password) ``` +> [!NOTE] +> **TODO:** update the path associated with Generating ... 3. Verify that the machine is now associated with your organization and reports a valid *orgId*: @@ -165,21 +109,18 @@ realTimeProtectionEnabled : true E6875323-A6C0-4C60-87AD-114BBE7439B8 ``` -After installation, you'll see the Microsoft Defender icon in the macOS status bar in the top-right corner. +After installation, you'll see the status by running the following command: - ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) +```bash +mdatp --health +``` -## How to Allow Full Disk Access - -> [!CAUTION] -> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device. - -To grant consent, open System Preferences -> Security & Privacy -> Privacy -> Full Disk Access. Click the lock icon to make changes (bottom of the dialog box). Select Microsoft Defender ATP. +**TODO:** Add step to verify ## Logging installation issues -See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. +See [Logging installation issues](microsoft-defender-atp-linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## Uninstallation -See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. +See [Uninstalling](microsoft-defender-atp-linux-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Linux from client devices. From bb622651e1495549c4232f1b04165c8b25179a8c Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 21 Oct 2019 16:56:13 +0530 Subject: [PATCH 04/69] Update preferences section Update preferences section and minor corrections to manual installation document --- ...oft-defender-atp-linux-install-manually.md | 15 +- ...icrosoft-defender-atp-linux-preferences.md | 447 ++++-------------- 2 files changed, 88 insertions(+), 374 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md index 490b35ec75..30fbaa6c7a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md @@ -40,7 +40,8 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic Follow the steps given in [Configure Microsoft's Linux Software Repository](https://docs.microsoft.com/en-us/windows-server/administration/linux-package-repository-for-microsoft-software) to setup the repository. > [!NOTE] -> **TODO:** Use a forward link for above instead of URL +> * **TODO:** Use a forward link for above instead of URL +> * I am assuming that ring 0 customers will download the onboarding package from ATP portal ## Download onboarding package @@ -97,10 +98,10 @@ To complete this process, you must have admin privileges on the machine. ```bash $ /usr/bin/python WindowsDefenderATPOnboarding.py - Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudo password) + Generating /etc/opt/microsoft/mdatp/mdatp_onboard.json ... (You may be required to enter sudo password) ``` > [!NOTE] -> **TODO:** update the path associated with Generating ... +> **TODO:** verify the path associated with above command. 3. Verify that the machine is now associated with your organization and reports a valid *orgId*: @@ -109,13 +110,15 @@ To complete this process, you must have admin privileges on the machine. E6875323-A6C0-4C60-87AD-114BBE7439B8 ``` -After installation, you'll see the status by running the following command: +After installation, you can see the status by running the following command: ```bash -mdatp --health +$ mdatp --health healthy +1 ``` -**TODO:** Add step to verify +> [!NOTE] +> **TODO:** Should we add eicar detection step? ## Logging installation issues diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md index 80ec6a0f67..9894750faa 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md @@ -1,8 +1,8 @@ --- -title: Set preferences for Microsoft Defender ATP for Mac +title: Set preferences for Microsoft Defender ATP for Linux ms.reviewer: -description: Describes how to configure Microsoft Defender ATP for Mac in enterprises. -keywords: microsoft, defender, atp, mac, management, preferences, enterprise, intune, jamf, macos, mojave, high sierra, sierra +description: Describes how to configure Microsoft Defender ATP for Linux in enterprises. +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, edhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,28 +18,31 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Set preferences for Microsoft Defender ATP for Mac +# Set preferences for Microsoft Defender ATP for Linux **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) >[!IMPORTANT] ->This topic contains instructions for how to set preferences for Microsoft Defender ATP for Mac in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](microsoft-defender-atp-mac-resources.md#configuring-from-the-command-line) page. +>This topic contains instructions for how to set preferences for Microsoft Defender ATP for Linux in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](microsoft-defender-atp-linux-resources.md#configuring-from-the-command-line) page. -In enterprise environments, Microsoft Defender ATP for Mac can be managed through a configuration profile. This profile is deployed from management tool of your choice. Preferences managed by the enterprise take precedence over the ones set locally on the device. In other words, users in your enterprise are not able to change preferences that are set through this configuration profile. +In enterprise environments, Microsoft Defender ATP for Linux can be managed through a configuration profile. This profile is deployed from management tool of your choice. Preferences managed by the enterprise take precedence over the ones set locally on the device. In other words, users in your enterprise are not able to change preferences that are set through this configuration profile. This topic describes the structure of this profile (including a recommended profile that you can use to get started) and instructions for how to deploy the profile. ## Configuration profile structure -The configuration profile is a .plist file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can either be simple (such as a numerical value) or complex, such as a nested list of preferences. - ->[!CAUTION] ->The layout of the configuration profile depends on the management console that you are using. The following sections contain examples of configuration profiles for JAMF and Intune. +The configuration profile is a .json file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can either be simple (such as a numerical value) or complex, such as a nested list of preferences. The top level of the configuration profile includes product-wide preferences and entries for subareas of the product, which are explained in more detail in the next sections. +>[!NOTE] +> **TODO:** +> * Should Domain be removed from all the entries below? +> * Should we add path to wdavcfg? +> * Verify each of below? + ### Antivirus engine preferences The *antivirusEngine* section of the configuration profile is used to manage the preferences of the antivirus component of the product. @@ -240,33 +243,12 @@ Determines whether suspicious samples (that are likely to contain threats) are s | **Data type** | Boolean | | **Possible values** | true (default)
false | -### User interface preferences - -The *userInterface* section of the configuration profile is used to manage the preferences of the user interface of the product. - -||| -|:---|:---| -| **Domain** | com.microsoft.wdav | -| **Key** | userInterface | -| **Data type** | Dictionary (nested preference) | -| **Comments** | See the following sections for a description of the dictionary contents. | - -#### Show / hide status menu icon - -Whether the status menu icon (shown in the top-right corner of the screen) is hidden or not. - -||| -|:---|:---| -| **Domain** | com.microsoft.wdav | -| **Key** | hideStatusMenuIcon | -| **Data type** | Boolean | -| **Possible values** | false (default)
true | - ## Recommended configuration profile To get started, we recommend the following configuration profile for your enterprise to take advantage of all protection features that Microsoft Defender ATP provides. The following configuration profile will: + - Enable real-time protection (RTP) - Specify how the following threat types are handled: - **Potentially unwanted applications (PUA)** are blocked @@ -274,350 +256,79 @@ The following configuration profile will: - Enable cloud delivered protection - Enable automatic sample submission -### JAMF profile +### Sample profile -```XML - - - - - antivirusEngine - - enableRealTimeProtection - - threatTypeSettings - - - key - potentially_unwanted_application - value - block - - - key - archive_bomb - value - audit - - - - cloudService - - enabled - - automaticSampleSubmission - - - - -``` - -### Intune profile - -```XML - - - - - PayloadUUID - C4E6A782-0C8D-44AB-A025-EB893987A295 - PayloadType - Configuration - PayloadOrganization - Microsoft - PayloadIdentifier - com.microsoft.wdav - PayloadDisplayName - Microsoft Defender ATP settings - PayloadDescription - Microsoft Defender ATP configuration settings - PayloadVersion - 1 - PayloadEnabled - - PayloadRemovalDisallowed - - PayloadScope - System - PayloadContent - - - PayloadUUID - 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 - PayloadType - com.microsoft.wdav - PayloadOrganization - Microsoft - PayloadIdentifier - com.microsoft.wdav - PayloadDisplayName - Microsoft Defender ATP configuration settings - PayloadDescription - - PayloadVersion - 1 - PayloadEnabled - - antivirusEngine - - enableRealTimeProtection - - threatTypeSettings - - - key - potentially_unwanted_application - value - block - - - key - archive_bomb - value - audit - - - - cloudService - - enabled - - automaticSampleSubmission - - - - - - +```JSON +{ + "antivirusEngine":{ + "enableRealTimeProtection":true, + "threatTypeSettings":[ + { + "key":"potentially_unwanted_application", + "value":"block" + }, + { + "key":"archive_bomb", + "value":"audit" + } + ] + }, + "cloudService":{ + "automaticSampleSubmission":true, + "enabled":true, + }, +} ``` ## Full configuration profile example The following configuration profile contains entries for all settings described in this document and can be used for more advanced scenarios where you want more control over the product. -### JAMF profile +### Full profile -```XML - - - - - antivirusEngine - - enableRealTimeProtection - - passiveMode - - exclusions - - - $type - excludedPath - isDirectory - - path - /var/log/system.log - - - $type - excludedPath - isDirectory - - path - /home - - - $type - excludedFileExtension - extension - pdf - - - allowedThreats - - EICAR-Test-File (not a virus) - - threatTypeSettings - - - key - potentially_unwanted_application - value - block - - - key - archive_bomb - value - audit - - - - cloudService - - enabled - - diagnosticLevel - optional - automaticSampleSubmission - - - userInterface - - hideStatusMenuIcon - - - - -``` - -### Intune profile - -```XML - - - - - PayloadUUID - C4E6A782-0C8D-44AB-A025-EB893987A295 - PayloadType - Configuration - PayloadOrganization - Microsoft - PayloadIdentifier - C4E6A782-0C8D-44AB-A025-EB893987A295 - PayloadDisplayName - Microsoft Defender ATP settings - PayloadDescription - Microsoft Defender ATP configuration settings - PayloadVersion - 1 - PayloadEnabled - - PayloadRemovalDisallowed - - PayloadScope - System - PayloadContent - - - PayloadUUID - 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 - PayloadType - com.microsoft.wdav - PayloadOrganization - Microsoft - PayloadIdentifier - 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 - PayloadDisplayName - Microsoft Defender ATP configuration settings - PayloadDescription - - PayloadVersion - 1 - PayloadEnabled - - antivirusEngine - - enableRealTimeProtection - - passiveMode - - exclusions - - - $type - excludedPath - isDirectory - - path - /var/log/system.log - - - $type - excludedPath - isDirectory - - path - /home - - - $type - excludedFileExtension - extension - pdf - - - allowedThreats - - EICAR-Test-File (not a virus) - - threatTypeSettings - - - key - potentially_unwanted_application - value - block - - - key - archive_bomb - value - audit - - - - cloudService - - enabled - - diagnosticLevel - optional - automaticSampleSubmission - - - userInterface - - hideStatusMenuIcon - - - - - - +```JSON +{ + "antivirusEngine":{ + "enableRealTimeProtection":true, + "passiveMode":false, + "exclusions":[ + { + "$type":"excludedPath", + "isDirectory":false, + "path":"/var/log/system.log" + }, + { + "$type":"excludedPath", + "isDirectory":true, + "path":"/home" + }, + { + "$type":"excludedFileExtension", + "extension":"pdf" + } + ], + "allowedThreats":[ + "EICAR-Test-File (not a virus)" + ], + "threatTypeSettings":[ + { + "key":"potentially_unwanted_application", + "value":"block" + }, + { + "key":"archive_bomb", + "value":"audit" + } + ] + }, + "cloudService":{ + "enabled":true, + "diagnosticLevel":"optional", + "automaticSampleSubmission":true, + }, +} ``` ## Configuration profile deployment -Once you've built the configuration profile for your enterprise, you can deploy it through the management console that your enterprise is using. The following sections provide instructions on how to deploy this profile using JAMF and Intune. - -### JAMF deployment - -From the JAMF console, open **Computers** > **Configuration Profiles**, navigate to the configuration profile you'd like to use, then select **Custom Settings**. Create an entry with *com.microsoft.wdav* as the preference domain and upload the .plist produced earlier. - ->[!CAUTION] ->You must enter the correct preference domain (*com.microsoft.wdav*), otherwise the preferences will not be recognized by the product. - -### Intune deployment - -1. Open **Manage** > **Device configuration**. Select **Manage** > **Profiles** > **Create Profile**. - -2. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select Configure. - -3. Save the .plist produced earlier as **com.microsoft.wdav.xml**. - -4. Enter **com.microsoft.wdav** as the **custom configuration profile name**. - -5. Open the configuration profile and upload **com.microsoft.wdav.xml**. This file was created in step 3. - -6. Select **OK**. - -7. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. - ->[!CAUTION] ->You must enter the correct custom configuration profile name, otherwise these preferences will not be recognized by the product. - -## Resources - -- [Configuration Profile Reference (Apple developer documentation)](https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf) +Once you've built the configuration profile for your enterprise, you can deploy it through the management tool that your enterprise is using. From 431a070d4e8e674776e9b80e952e74eab2c51d28 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 21 Oct 2019 17:18:01 +0530 Subject: [PATCH 05/69] Updated the privacy document for Linux Updated the privacy document for Linux --- .../microsoft-defender-atp-linux-privacy.md | 52 +++++++++---------- 1 file changed, 24 insertions(+), 28 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md index 0c56970e6f..0e2884b388 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md @@ -1,8 +1,8 @@ --- -title: Privacy for Microsoft Defender ATP for Mac +title: Privacy for Microsoft Defender ATP for Linux ms.reviewer: -description: Describes privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Mac. -keywords: microsoft, defender, atp, mac, privacy, diagnostic +description: Describes privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Linux. +keywords: microsoft, defender, atp, linux, privacy, diagnostic search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,19 +18,19 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Privacy for Microsoft Defender ATP for Mac +# Privacy for Microsoft Defender ATP for Linux **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -Microsoft is committed to providing you with the information and controls you need to make choices about how your data is collected and used when you’re using Microsoft Defender ATP for Mac. +Microsoft is committed to providing you with the information and controls you need to make choices about how your data is collected and used when you’re using Microsoft Defender ATP for Linux. This topic describes the privacy controls available within the product, how to manage these controls with policy settings and more details on the data events that are collected. -## Overview of privacy controls in Microsoft Defender ATP for Mac +## Overview of privacy controls in Microsoft Defender ATP for Linux -This section describes the privacy controls for the different types of data collected by Microsoft Defender ATP for Mac. +This section describes the privacy controls for the different types of data collected by Microsoft Defender ATP for Linux. ### Diagnostic data @@ -62,7 +62,7 @@ When this feature is enabled and the sample that is collected is likely to conta If you're an IT administrator, you might want to configure these controls at the enterprise level. -The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md). +The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md). As with any new policy settings, you should carefully test them out in a limited, controlled environment to ensure the settings that you configure have the desired effect before you implement the policy settings more widely in your organization. @@ -83,7 +83,7 @@ The following fields are considered common for all events: | org_id | Unique identifier associated with the enterprise that the device belongs to. Allows Microsoft to identify whether issues are impacting a select set of enterprises and how many enterprises are impacted. | | hostname | Local machine name (without DNS suffix). Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | | product_guid | Unique identifier of the product. Allows Microsoft to differentiate issues impacting different flavors of the product. | -| app_version | Version of the Microsoft Defender ATP for Mac application. Allows Microsoft to identify which versions of the product are showing an issue so that it can correctly be prioritized.| +| app_version | Version of the Microsoft Defender ATP for Linux application. Allows Microsoft to identify which versions of the product are showing an issue so that it can correctly be prioritized.| | sig_version | Version of security intelligence database. Allows Microsoft to identify which versions of the security intelligence are showing an issue so that it can correctly be prioritized. | | supported_compressions | List of compression algorithms supported by the application, for example `['gzip']`. Allows Microsoft to understand what types of compressions can be used when it communicates with the application. | | release_ring | Ring that the device is associated with (for example Insider Fast, Insider Slow, Production). Allows Microsoft to identify on which release ring an issue may be occurring so that it can correctly be prioritized. | @@ -97,6 +97,9 @@ Required diagnostic data helps to identify problems with Microsoft Defender ATP #### Software setup and inventory data events +> [!NOTE] +> **TODO:** Please review if all the following fields are valid for linux as well + **Microsoft Defender ATP installation / uninstallation** The following fields are collected: @@ -130,13 +133,16 @@ The following fields are collected: #### Product and service performance data events +> [!NOTE] +> **TODO:** Please review if all the following fields are valid for linux as well + **Kernel extension statistics** The following fields are collected: | Field | Description | | ---------------- | ----------- | -| version | Version of Microsoft Defender ATP for Mac. | +| version | Version of Microsoft Defender ATP for Linux. | | instance_id | Unique identifier generated on kernel extension startup. | | trace_level | Trace level of the kernel extension. | | ipc.connects | Number of connection requests received by the kernel extension. | @@ -149,11 +155,9 @@ The following fields are collected: Diagnostic logs are collected only with the consent of the user as part of the feedback submission feature. The following files are collected as part of the support logs: -- All files under */Library/Logs/Microsoft/mdatp/* -- Subset of files under */Library/Application Support/Microsoft/Defender/* that are created and used by Microsoft Defender ATP for Mac -- Subset of files under */Library/Managed Preferences* that are used by Microsoft Defender ATP for Mac -- /Library/Logs/Microsoft/autoupdate.log -- $HOME/Library/Preferences/com.microsoft.autoupdate2.plist +- All files under */var/log/microsoft/mdatp/* +- Subset of files under */var/opt/microsoft/mdatp/* that are created and used by Microsoft Defender ATP for Linux +- Subset of files under */etc/opt/microsoft/mdatp/* that are used by Microsoft Defender ATP for Linux ### Optional diagnostic data @@ -186,17 +190,6 @@ The following fields are collected: | edr.latency_mode | Latency mode used by the detection and response component. | | edr.proxy_address | Proxy address used by the detection and response component. | -**Microsoft Auto-Update configuration** - -The following fields are collected: - -| Field | Description | -| --------------------------- | ----------- | -| how_to_check | Determines how product updates are checked (for example automatic or manual). | -| channel_name | Update channel associated with the device. | -| manifest_server | Server used for downloading updates. | -| update_cache | Location of the cache used to store updates. | - ### Product and service usage #### Diagnostic log upload started report @@ -207,7 +200,7 @@ The following fields are collected: | ---------------- | ----------- | | sha256 | SHA256 identifier of the support log. | | size | Size of the support log. | -| original_path | Path to the support log (always under */Library/Application Support/Microsoft/Defender/wdavdiag/*). | +| original_path | Path to the support log (always under */var/opt/microsoft/mdatp/wdavdiag/*). | | format | Format of the support log. | #### Diagnostic log upload completed report @@ -228,6 +221,9 @@ Unexpected application exits and the state of the application when that happens. **Kernel extension statistics** +> [!NOTE] +> **TODO:** Is this valid for Linux as well? + The following fields are collected: | Field | Description | From 1976c84ec5d419e023cb2090047cb34041fdbca6 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 21 Oct 2019 19:21:53 +0530 Subject: [PATCH 06/69] Draft of deployment via puppet Draft of deployment via puppet (incomplete). Corrected spelling for redhat --- ...oft-defender-atp-linux-install-manually.md | 2 +- ...-defender-atp-linux-install-with-puppet.md | 243 ++++-------------- ...icrosoft-defender-atp-linux-preferences.md | 2 +- .../microsoft-defender-atp-linux.md | 2 +- 4 files changed, 51 insertions(+), 198 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md index 30fbaa6c7a..7116f0b7ef 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md @@ -2,7 +2,7 @@ title: Installing Microsoft Defender ATP for Linux manually ms.reviewer: description: Describes how to install Microsoft Defender ATP for Linux manually, from the command line. -keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, edhat, ubuntu, debian, sles, suse, centos +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md index 7a0f0c27d6..5cd69d9301 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md @@ -1,8 +1,8 @@ --- -title: Installing Microsoft Defender ATP for Mac with Microsoft Intune +title: Installing Microsoft Defender ATP for Linux with Puppet ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Mac, using Microsoft Intune. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +description: Describes how to install Microsoft Defender ATP for Linux, using Puppet. +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,236 +18,89 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Microsoft Intune-based deployment +# Puppet based deployment **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -This topic describes how to deploy Microsoft Defender ATP for Mac through Intune. A successful deployment requires the completion of all of the following steps: +This topic describes how to deploy Microsoft Defender ATP for Linux through Puppet. A successful deployment requires the completion of all of the following steps: - [Download installation and onboarding packages](#download-installation-and-onboarding-packages) +- [Create Puppet policies](#create-jamf-policies) - [Client device setup](#client-device-setup) -- [Create System Configuration profiles](#create-system-configuration-profiles) -- [Publish application](#publish-application) +- [Deployment](#deployment) +- [Check onboarding status](#check-onboarding-status) ## Prerequisites and system requirements -Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. +Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. -## Download installation and onboarding packages +In addition, for Puppet deployment, you need to be familiar with Puppet administration tasks, have a Puppet configured, and know how to deploy packages. Puppet has many ways to complete the same task. These instructions assume availability of supported puppet modules such as *apt*, *lsb-release* to help deploy the package. Your organization might use a different workflow. -Download the installation and onboarding packages from Microsoft Defender Security Center: +## Download onboarding package -1. In Microsoft Defender Security Center, go to **Settings** > **Device Management** > **Onboarding**. -2. In Section 1 of the page, set the operating system to **Linux, macOS, iOS, or Android** and the deployment method to **Mobile Device Management / Microsoft Intune**. -3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. -4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. -5. Download **IntuneAppUtil** from [https://docs.microsoft.com/intune/lob-apps-macos](https://docs.microsoft.com/intune/lob-apps-macos). +Download the onboarding package from Windows Defender Security Center: - ![Windows Defender Security Center screenshot](images/MDATP_2_DownloadPackages.png) +1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**. +2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**. +3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. -6. From a command prompt, verify that you have the three files. - Extract the contents of the .zip files: + ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_page.png) +4. From a command prompt, verify that you have the file. + Extract the contents of the .zip file: + ```bash $ ls -l - total 721688 - -rw-r--r-- 1 test staff 269280 Mar 15 11:25 IntuneAppUtil - -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip - -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg + total 8 + -rw-r--r-- 1 test staff 6287 Oct 21 11:22 WindowsDefenderATPOnboardingPackage.zip $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip - warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators - inflating: intune/kext.xml - inflating: intune/WindowsDefenderATPOnboarding.xml - inflating: jamf/WindowsDefenderATPOnboarding.plist + inflating: WindowsDefenderATPOnboarding.py ``` -7. Make IntuneAppUtil an executable: +## Create Puppet manifests - ```bash - $ chmod +x IntuneAppUtil - ``` +You need to create a puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by puppet server. -8. Create the wdav.pkg.intunemac package from wdav.pkg: +## Deployment - ```bash - $ ./IntuneAppUtil -c wdav.pkg -o . -i "com.microsoft.wdav" -n "1.0.0" - Microsoft Intune Application Utility for Mac OS X - Version: 1.0.0.0 - Copyright 2018 Microsoft Corporation +Enrolled agent devices periodically poll the Puppet Server, and install new configuration profiles and policies as soon as they are detected. - Creating intunemac file for /Users/test/Downloads/wdav.pkg - Composing the intunemac file output - Output written to ./wdav.pkg.intunemac. +## Monitoring puppet deployment - IntuneAppUtil successfully processed "wdav.pkg", - to deploy refer to the product documentation. - ``` -## Client device setup +You can also check the onboarding status: -You need no special provisioning for a Mac device beyond a standard [Company Portal installation](https://docs.microsoft.com/intune-user-help/enroll-your-device-in-intune-macos-cp). +```bash +$ mdatp --health +... +licensed : true +orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" +... +``` -1. You are asked to confirm device management. +- **licensed**: This confirms that the device has an ATP license. -![Confirm device management screenshot](images/MDATP_3_ConfirmDeviceMgmt.png) +- **orgid**: Your Microsoft Defender ATP org id; it will be the same for your organization. -Select **Open System Preferences**, locate **Management Profile** on the list, and select **Approve...**. Your Management Profile would be displayed as **Verified**: +## Check onboarding status -![Management profile screenshot](images/MDATP_4_ManagementProfile.png) +You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status: -2. Select **Continue** and complete the enrollment. +```bash +$ mdatp --health healthy +``` -You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages. +The above command prints "1" if the product is onboarded and functioning as expected. -3. In Intune, open **Manage** > **Devices** > **All devices**. Here you can see your device among those listed: - -![Add Devices screenshot](images/MDATP_5_allDevices.png) - -## Create System Configuration profiles - -1. In Intune, open **Manage** > **Device configuration**. Select **Manage** > **Profiles** > **Create Profile**. -2. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select **Configure**. -3. Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections. -4. Select **OK**. - - ![System configuration profiles screenshot](images/MDATP_6_SystemConfigurationProfiles.png) - -5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. -6. Repeat steps 1 through 5 for more profiles. -7. Create another profile, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file. -8. Create tcc.xml file with content below. Create another profile, give it any name and upload this file to it. - - > [!CAUTION] - > macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device. - > - > The following configuration profile grants Full Disk Access to Microsoft Defender ATP. If you previously configured Microsoft Defender ATP through Intune, we recommend you update the deployment with this configuration profile. - - ```xml - - - - - PayloadDescription - Allows Microsoft Defender to access all files on Catalina+ - PayloadDisplayName - TCC - Microsoft Defender - PayloadIdentifier - com.microsoft.wdav.tcc - PayloadOrganization - Microsoft Corp. - PayloadRemovalDisallowed - - PayloadScope - system - PayloadType - Configuration - PayloadUUID - C234DF2E-DFF6-11E9-B279-001C4299FB44 - PayloadVersion - 1 - PayloadContent - - - PayloadDescription - Allows Microsoft Defender to access all files on Catalina+ - PayloadDisplayName - TCC - Microsoft Defender - PayloadIdentifier - com.microsoft.wdav.tcc.C233A5E6-DFF6-11E9-BDAD-001C4299FB44 - PayloadOrganization - Microsoft Corp. - PayloadType - com.apple.TCC.configuration-profile-policy - PayloadUUID - C233A5E6-DFF6-11E9-BDAD-001C4299FB44 - PayloadVersion - 1 - Services - - SystemPolicyAllFiles - - - Allowed - - CodeRequirement - identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9 - Comment - Allow SystemPolicyAllFiles control for Microsoft Defender ATP - Identifier - com.microsoft.wdav - IdentifierType - bundleID - - - - - - - - ``` - -9. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. - -Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**: - -![System configuration profiles screenshot](images/MDATP_7_DeviceStatusBlade.png) - -## Publish application - -1. In Intune, open the **Manage > Client apps** blade. Select **Apps > Add**. -2. Select **App type=Other/Line-of-business app**. -3. Select **file=wdav.pkg.intunemac**. Select **OK** to upload. -4. Select **Configure** and add the required information. -5. Use **macOS Sierra 10.12** as the minimum OS and set *Ignore app version* to **Yes**. Other settings can be any arbitrary value. - - > [!CAUTION] - > Failure to set *Ignore app version* to **Yes** impacts the ability of the application to receive updates through Microsoft AutoUpdate. See [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) for additional information about how the product is updated. - - ![Device status blade screenshot](images/MDATP_8_IntuneAppInfo.png) - -6. Select **OK** and **Add**. - - ![Device status blade screenshot](images/MDATP_9_IntunePkgInfo.png) - -7. It may take a few moments to upload the package. After it's done, select the package from the list and go to **Assignments** and **Add group**. - - ![Client apps screenshot](images/MDATP_10_ClientApps.png) - -8. Change **Assignment type** to **Required**. -9. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Click **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**. - - ![Intune assignments info screenshot](images/MDATP_11_Assignments.png) - -10. After some time the application will be published to all enrolled devices. You can see it listed in **Monitor** > **Device**, under **Device install status**: - - ![Intune device status screenshot](images/MDATP_12_DeviceInstall.png) - -## Verify client device state - -1. After the configuration profiles are deployed to your devices, open **System Preferences** > **Profiles** on your Mac device. - - ![System Preferences screenshot](images/MDATP_13_SystemPreferences.png) - ![System Preferences Profiles screenshot](images/MDATP_14_SystemPreferencesProfiles.png) - -2. Verify that the following configuration profiles are present and installed. The **Management Profile** should be the Intune system profile. _Wdav-config_ and _wdav-kext_ are system configuration profiles that were added in Intune: - ![Profiles screenshot](images/MDATP_15_ManagementProfileConfig.png) - -3. You should also see the Microsoft Defender icon in the top-right corner: - - ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) - -## Troubleshooting - -Issue: No license found - -Solution: Follow the steps above to create a device profile using WindowsDefenderATPOnboarding.xml +If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: +- 1 if the device is not yet onboarded +- 3 if the connection to the daemon cannot be established—for example, if the daemon is not running ## Logging installation issues -For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) . +See [Logging installation issues](microsoft-defender-atp-linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## Uninstallation -See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md index 9894750faa..c203ebd24c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md @@ -2,7 +2,7 @@ title: Set preferences for Microsoft Defender ATP for Linux ms.reviewer: description: Describes how to configure Microsoft Defender ATP for Linux in enterprises. -keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, edhat, ubuntu, debian, sles, suse, centos +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index 2a1e938b11..83c84689a0 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -2,7 +2,7 @@ title: Microsoft Defender ATP for Linux ms.reviewer: description: Describes how to install and use Microsoft Defender ATP for Linux. -keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, edhat, ubuntu, debian, sles, suse, centos +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 From ed1f730864af4cf4d735b20de9f27f1c6d7de2fb Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 22 Oct 2019 17:20:54 +0530 Subject: [PATCH 07/69] Updated documentation for deployment via puppet --- .../ATP_Portal_Onboarding_win_intune.png | Bin 0 -> 95659 bytes ...-defender-atp-linux-install-with-puppet.md | 90 ++++++++++++++++-- 2 files changed, 80 insertions(+), 10 deletions(-) create mode 100644 windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_win_intune.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_win_intune.png b/windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_win_intune.png new file mode 100644 index 0000000000000000000000000000000000000000..f5c28532260e833cb94a120070caa32c471ecc90 GIT binary patch literal 95659 zcmc$_2{@GB`#&C%Rw{|IOgoW1TbQAg$X2#wOO|9COqRjSNTCv=?7J3(B4iocRLWRl zlHFjkjLAC8Fk{U2AL;%1e*WLzdi|E`_gr;(o_WrB&VBCtKKFUu%Xwm9X1H(n(cRm& zZQEyb)!@dqZTvFZwr$_Oa|ibq=;O5j?jIh=4a1Au%DN?Hxewd#>YM6s+g5?x!*t>2 zKJW6sY6sc2O|WJ2KMw}{)@|E1PJxkuzE!Bx0t@`ifd(Unhbi6s{*XU7ihl>=_NT6@ zxNVeUrvMgSdNv;(>zepr4G!uVHRPj&PF-rg>|oIM(48+_zWeAwkq>8fc|Ot*i+uIa zqJ|ngb*5HqZ(o+(TiW>J_cza%kHt%61!JC#8DVDc`_yVzWF3}>pfTCm5ICnhucWNk zx}OC%ZJsK-KxB54Xxc?jtpPbD8*NX7rQHVha4F|rpL|Z_Z{NCAQr@1tb+_$IOyt3> z+fQHjTkvk(ri<|!|9vlfNpIKI?d>}|Wq7u3P4@Df-nxr?a{T}8N7K1ep;R`a6d4SG zcU|ro<~4YSzodKgit%>jo*Ts{#>evwu=r1k-&H+9hVpIQ|2HPP{#@d3Tj3Vu z^xxZbG2rCBt^5B5J0=VR|F$*R3wrT)h}(D8A8Ty={GS*m*ywX@ z-70j+PyOk+>gmc?qZU;=?aJFTo8&~J^K0_35q&k3o}%d#wl+C`me?M$)IRCmy)MPD zhO&QV1%_OM$uyre7)y!`!M~u3=Dm$Ws^XTi!ZNx3s_l;!An-+ad4@lEW&EOl%FM~(TaJl} zW2gTv*!0U>A=XL@?Z~5)Jvy)N?ifk6IINf+R0@=0{~lMPzwsgogFE=botG^5I^LDQ z3mP4WYN+}5%X)sgj_CJ-#~Em+g%;9DeBPFU@V7c(5que8IJIZoFf%V=Mc(cjY$<## z6BW2zF*xmXp{Y|R(LT>&ky$^w`(Q`QJ{jlKf)Z>QsnNBT)Gk?jQfU1AgxBJ_iv6BI zeK3Hk3}6^R`^|xWHEC+6OhX~4nd!6AL+Ay->{6qg>F~PscXk8lyCkEtXhQ1p9Ed6R9xnp;^tQpj(ZM2lFkg9Zika~^AM$=c&E58?P(w4qAr zo;{QB#PIiE64-7+=!=Axp4Jy2c?G7@xT<<%5F?4gg+z^8nzu!Fg4@SpTiAyVY<-|` z7Z1TDY}sSwl5+93a^Eg5J$i=zT6NkL2ms*wz9R>24qS@B5R=jlPan6n+LHbEQ@kCQ z)+`R^slLn*F%Cnq*0Uc4U^F86@use*8y3kNs7`<~M4d1o2 z#feYvj_2!G%|?=Y#s*CyZN=HvS=7kDyX}5i>->R(ufxkl026+KGVhrJp=N7t_mbPU zY|tlz0~QILb5Ri!POytq&$Ud}Vw&S~&PtV5A$xZc@tQk&ccTQ#tP z>^d&wz7jQDQ-gdtSv#Mgf|!UTBhJYZlk|l^T&^}LLt-zMH|qIrY3niduFzd zGbLd9y*}1ScioC?TLLIn-!b?muiiunS36uI9hc%vxyjzWF3q6*1jH`M=6|2Ly;#o@ z@l$L5%m?OdS{_k_?B|$p-3E?-_*zpEpIschKHOaD+z7Pcg9T-N@~;iD*`7RAxlyQd zucf-agsm?sGKoUp$mw@Q%VI&SN42nZKCM~bxmO%)2a>W)XyS?W)1bgjbt5;GNUPVgW6eXaA8Z$ zm6EvAzejpGD(;X*7d6%Mj{(ZZ2`#E%2FAR}#s|WH$FYr6C#afh5l_J@_|VLIA9$|p zmr-tS{TY1yUEKFtAy8S9w9rChDti1q??4)1?OS+Hf8k$NNN!I~m$K)hKNAEfb~bd` z{oUmfw(%O9#5WbBb@e~T%3qzFG~a43q0enE7)}~?Rso$AEkVrw-E|DP+q&Slk@vZ) z0$ihSwoaMWCND2#ku#Xu8hLQbMm*-P3O>K0_vBK=KrN4(sV;oN)NZOldh1Ps2(Ph3 zLQ`yD$jU9QcFhg8+A}X|ZH=06?jPH~?SBX=GOp^;@yvOIJZI2(ogd0_X6`|)Vc8i> zG>Ck_aSj}mcdKx~$Tv%N>(kq+W`FQ?IMZ!8#_U)G8yja)S<-jGYs^aAWs9zD>87zq zElNHqi(DD7&Px0T@%UW$7IiySInXD*Ua^}Gx=7y^RQ9z ztwBC*wkC6^d(gLA+L3K7;HOL3UMk!Rr>Au+uNZcc(F7MaE{S;NodA25znK>T`Y%GKcFAD7J8!!VeynRa zOG^`|^mla%Ysz(K(oG~VvdAD-C*mG2MiFiar*^&jK61irKOHTP!@>l33O9mC({SH^ zeMvw_2CLW>Q-3=!1wID6QEshv%k@*(DYWW8FeQ!0A{Ik-hvw0M)EKNMDUWul18K|#b8Lx5JtgX>V zmhiMHVri!S?aiM|z3%3B_;ctavMrpD$y`xn=Owwkv7hT`SD$$E9~%9Mhmc~RXEz!G zZ;vo1SR-%(pp9H6qMIGn2%XzS&tnU57$=gg&;#$``wd}4w_Z&B*kAmvlyzmV47ek# zree1YR^Imt58;X2oWT8aEIE94W$vvSIXQ~-bj$|1BR)EC`0=J^!@X{+$BS7|-Jm$8 zQuh-%xk_=z(;5B4l%MlW$B3i;Dy5WbVV6)YxFJW>q&%QttIxLYg$MXLgag}8B?qp3 zJuP{@V@9uAdVn%F8s)Qqvmn2yf1z@~C&A)xYmeSGE-4Vc;qOO>94>&%UyY`u#C!-C zcThQNJJa1BWh`5pM!0dO$>l#ppqu~Qm?M_p({TfA)}5=H<$x*I%E;0_P83ylb9U5) zzGeoI9v<5Ie&q1|{7CZGCzKiEHkPSfCRkX#+lWNv^4t>kJzN3Rz5K7KN-E`l_wsW} zRi{-IQr#hh8ixy6H>FFf()`+f#ymYka}S3`{JSuI@f4I*sep!l*j|xkG-Op)R9x>1 zZobW3R}^31ZlJ@z)|~5Z8OjB@G{3!W?yyVhAvAXc!Z}z&!wu$sOhX|@eBL_A??2iK z%1B%O!y4iLpG);412M#?U~Tc?SbXF`y}N(CFFj$d8O`|zIh*d3d0wNM7*|xr1;M+X zMg4W=&L7WT_;icI^%+F05d8`{2ev1R@%=TwKORK}X5W7sazjBdctNtDn*A&q#(n+p z-fo$Y9l9jY(Kk{>6_Ti4?Xy)>yl8zsr)7`ugCBEhT4UmF$Yi5iDeU6h(Tbd34x7yM z5aJ;Wt%DOiq&Uv9+QC|I-= z>A9Qlk9%1a8yRSF1uFdZQqttpvS0iB*o9c9l#KGUu<{EI+VsG+nC>x!P>7-46Xo=T zNb<4cCwT}9$Mf$W_~WOh^Ka^>-9n(J7!d~k7M@4$?oUl6aDYXRcr&!>LX)-PTIj=f8*4B|8)C&<-#)@i@BNQS_}^ zz_XJ&JGwPR5V;5M<40FAf}i?E(Uqt60fgD1tYhD^_xJ(6OijQHt2AtjmHAnnzgf}9 z=m^gH4blQ$fkqtb32bCjeP=%5J*2~zEMU6_<637Fs*vKG^fY9=KVXwN++`sV`+Hx> zOZ?Th8nQKH8vmT>#W~$5TH%S%sppoyGxHK}BwL#4*H$aMOgR=YG=CSfF_@gst7D|`y_EHo49pW)6ZmD!)$^;e~Ra?FaoP-RdIgINK1Hoo;p3Y& z#FFc`p3BzQYsAjl%bNMTi+`*H)|+-6oIR>xQ><>KR_$67gg4*^Ka#~O@hqA;>)rdk z?F&$075@a22z^KbDtyNm2lbOjEMCv9SWz_9kOV6W7wWy#QewUpo{R}SalYLEd;FW= zjFWn9!OYjw?-%(m}NctN@O z-O`EP+{^N*!h8BGr5~JH88Jzy&2CwpIx$o}o~K>NTtB^Gi$asr!x`@u5n;?(p#8q7 zeT-M@-I}&U*&R7tT^J>zLlZ(dylA?B8#392<)HwPj5NxkcaC{#9c}X zv~Ll*o_R4f6r~Ms^3xRcf@Tp9>57`+pbc~Er}Qa#@nys0IE*wR=>sC7f zvFz--Uz)=hUKb31zUUl7CCo?0-VeED%o%=RNk(`_XWeDq@aGW`^oyFQtKMdLNK@bNv2c_~X0wCokh8ZzZu`gU;) z9s?11oZzdOmhtN*y^^IhUr$-ULccA(8oLk5;x+EAT_2UHc`_q?z~W3o5XxLF4-ROY zI#5GelU6IN)0LFD;JQ3h{F1|#@K`|2OM+}mS2l>wCD?I^A$6u}7F*ERb|WCE+InT^ z?LH^25F>Y;%$GPxxgx!GWuQ^(ED4E!C(|Rue`-AWEo>e9=*m6m1tbhIJ^sgBrOL^e zMow6*r?*{t@~VXI1v4PmuT!Vyse5-&OeXK zKMgL$V_ONU@5PEF^P0!{azA}`HX>WoQ9koofI&sVf{30iXiafb+u*lJ?nxE(Z&O(^1q6iEE+c6 zHM6!*y;PDLcWb%jdcM6&2#B*r32%D=&bDAMD@}Y)XJvB^9(_tfAs+O0yHXB!#C*xzQtn{>*<48M zlu{7CZ`h(5C3gmXXc+JCJgZ4dD}ef9^ybYM1qBcG`e8eVnH?R>FC8q$;qF>A`dHI6 za6~k6)_@y1UtHdVNs&`Nf1H87flcTb;G8Pz*H!?51m0Q7b~xhmn85?~MOfPSQQZ`9 z)J>o9Lj(xt*ZZ!v;e_ogYOLJ0-X~m+{KJ6Z2fSR|F02x=#Giq#IMz9j3s5>Tf=`W4 zIgNrB z3OAwb#}(DUNS^+rB)3ysGRP zOOeyZwfvWSBR?9gLn~IIP7!Ao6vGXFC^Qh9rr=?1!iO|GMHE&i@;D(h& z(}RT}0;Z=sKV*UUOC~cTGH~q{RkQJoH`T)oWWy+>rdD&oa_|^mUagsZQnf704b;aX zP^>gXwzbCoSsa*Qu8T72E2-G=Wi)8vB7cRdXy@?&$C6N40B)=Gb zYH2E9Pcm?{PM)ICJi-LX!B?&6NDj-_j*-#i_~7qMfAhH8*!E)@X{6406r}POtUKI3 zwY>0)(b_EOTHxf*z?v&`-4ucMc9!%rpq<-0g}5fkI> zUr-P-KH^?F7m%Ho=Cb}9c%~B5c5E+?xDXY%K=Mxd0JyVA? z$Km97`?cc*g3{o27UE;A_n(B-FHLO=J?LaMoo&Rrq(Q7gQ#xfd29qY<(EU0nDi)ym zCa&sO`X*RZ6>i9$(qMA^6PC)(A1)7s_kNwwXKet*U)15|KlJR9i8^*-4zjobZM&f` zsDH;Ye1fXR>Yai-6m1&a=dHBQW6m(JG0`mNAvNL#(FXo1T0fUN1&lQT>XVvQ6tu2+ z?*eIzD9|rL5tETJECGk%3v((ntnDC~Cfv;16`LbB1P_?W{;{o^-GYZLJc68x;u|Uh z-OXmo-nk*HhaA&z#HzJ^^N{(q-o^MERfUdvM|Sc)atr-syj`#$6cmt`9eGArq1+j? z_o|9M!i%rN4bM`aT9Kwcd6HEe`BOJ`6!L?veS!2UQYDmG-)TAF^bKyzhQ625AmE3a z`>cOZ1^YE9=_igW_VEyW(%(n^)WY;>-OM)O8jsX)VtPo~fIxCP<{hI>Y_1VY zEf}6HadkZu)@8<7B%;TG-IA7l1VW_(%irz*PKY)b=@gbmDzBj6DRv-G`WDT zl`%h-EE1$$)d05-gFt?Y`}_v{ybch^yH*_#nW=VN^DdMY>vDPjF@p*HmW^i3t52fR z^oEEVYeHfcHmhS}(wl@;N2-8?NZX0ETFwG%wpZ1+C-=BoU8fOW&BSN$IuO5n<>lObADp+qvDP~=x1X90dXKRPp zm}TdreU91qMQip^M1r!d)VwD(=u|Ih>AgGoG-0@1`(Jc=574Z)pG}#U-f(DO^YC>< z07rL3v7)C;mxP5iAY7l-=dGNOrM@c`j(Odp4HoA$W{LS@uZQP~5`!pE@W6GJKQ-z7 zYriy{JIjCMF+grtyMNzmQE2vDP}B;K7`Oc&?oI8H3Cc;K7ns5d-YodFb#%ng%{sWD z5|q|BGN?h#dsW1gda{RY_}UR_acAxh=hpsX$(>y_rt=L4^^IE}Wx9)x_gktv1U$@| zTN8G15sQ4Z2-Qcvh}D47U61Ey@2e8E7@>4)i;7UzpO#5Ua094MDNfckW$bTY+GrVw zBm!HK9yy0)<;Q!T+chy&^$S@36?^1AY;QWBu_dHQyz)(X=4eVhA?s(>wQ`LzUZorl z#r*A&?Z37lfE`zAF8^txc=k6$@~@qn8zlI>nWp|{BU0Uj7F-Y$85~;1#TuUiuITN` zSN->W@PCLjPX2{Jp0PyPKkVf8zOb1e|7Vx~uM+Y7Gm=yKc?r zCBr$H*$FS&9_~n%Jtu(>``t4!rDj*9;X3x{omaPl;Nz2b`MF%)yts5}Da#sI@i@zx z=b#7`L4?lv^PdF;a*Vx5x^DwP3y?LxKc2?cxWlwB^N*~ zDF5(%&^-FNJfE>f8-#Xb&3uJ%s9gA5`97JJAn)yr;(apqs}0c6HA>9HKhoxkR5;Q3 zo2d1HY}Ct4x^{K5-MGHqtYgYe@|Vwi{K@-Ry|!xguD(YsYJP_-)~%VUDTKfS_Wv6P zU+#IR)47Mq46^!UBbges-{MTU!QPF4{K(2Xg2_s5d#RS?~OCf1kX?)!09j zbHju}_Lm>e2)OHe7M9DH_`bfs-(m#aL~sEJ9byJ= zs`T{UP8n-}%+pu@{LA#|=cXUsWN%aWDqjd1fY& z@xFWN3v$%inCCH4akmOJcGs2*$%r6K=qlAtaJ&&}2t6b4@`6~<0FBqUpc!91r7)sS z;D0G*)GNII553#|S5`v%1HKLvMDc3*pm?#9rbe0%WQc1y{!xo0K7nLgn_yqd7MvsM z#eaIYvOT#$F7R~4yZW-n!`xM@+3`=e{~T@opLcHlEkyfoosO96oo%Q@RU8+8@2!gC z#%nd_{uwHXs{#;P8#nvvN^~9z|DiyAG&MyI(q0pLcFP0UWX<^_TKV5w+F9}ZT6s6e z9fvgwFDqNdK|%+qV61`x;3u8O4LHYG$PEJIe)k{nO-N{@WL}!lqoya&kwq zhP$J$B+Mr~`Nlrqwu^zF#oeFo|5F}hdWHR%Mla>FvomLH>rSk0KJl=Wn8fh3-$M4A zRCosF1KKlE|FBnxn@r9I2AK{lblH6z0G%!3!t4R%^L@$@$7*wdXR!{>DTY+3&0d;< zJ7uKx&@Ldt!1*2fwF8SpSF1GImbx+s7_AV!s^Yye0Nq4;(J~}Kxwh&;BD>%&Ap<#r zY1>Tca*H$$lTwh$eB5mYc1f~D(ypHQuCa3c$M|OPR^-%!$UxpcacUf&^qlx=q0*zB zd{-e23pAhY$rBD!{-*YNDB5j(ryiF{9sn3A)t2TIanTG!efJ%`mhet@^m$X0?l81Y z_8QnRbA(XateT7y=zpba{6X&@<%DS8qA$q&zQX2L{ZZ!?AOyIkNk zUaJ_+9j#|r+|LdD^vTnEr8jUxm|Kz2+y8vC3~~0l)uP{_N{2zsM^oQ z9LTC%O_NHGR8K@83uj~PXf}NZitzTNj(O4CwgKIwu7_3Q-MXltvv}eWdMGLLoNmN< zE3O(W>(YM`M4ysYBbcsvse=MS_Uzjx^z7Q&`oyl3xz|UqX*QJS+%gY%IlNo7WzCga zdEl62o2$;~#5s0`%u2Rs#I61Gjlm{8r8qRNIR(F4kibEXvDA3&@^+NBMiaE7kZyZ=E9@i#%6rO2UYiPYLW> z^R0soyeb8$?qjXh7|GKv+R{ijWb;=yqRk{xk>rUe9mHJa$7UJw=Pa@j7$&aQq?X8z z7M&hwl4p&jgxi+}mWEt01F;HqK6rc8l!v5-kyk|V$qm#71sb=uLVis$-Tdy{84SB#m(GTfH{fe^w1T(`QMJwyt%- zk-mjY?@@%CE$LXWhF%B=b$ya@XGP5P36nGIN$o9?xb86xf-0ah7gD)6qB~QG@gE?u zZ(G+qg`>}ka&=8~?AXT_yU0#xxFe7^!E1F|_yNqWOyY>*D zqWi_|L@M8M)NpTuDH3`DkNkFKra66X+*O9%dt?4BoAB8TCeF=ozvz{=c54SJ2b`{GuGeG+b~J@drz|u^u*!sw&o-Cb zR$g;VR7tMPts(m`J2OyiVtmb$Fu^uz&~XRa^HJF1GaYu1^t7rAaV5w4M%31VR^}QJ`zs{g-^aOrk!!QOQ+bf@gt^nf9 z;~@2$TKlPw3)>>+A}dd=%kNn%=9 z<2*1o%x=15~(y}9(UW}mJg z*kvxh_7eI@2yV|HvPA%7aJ@5&x8q$`v#Oz2-lb?$v4Q6eQDmo@MX|E{cVQCi$ckr+ z^Sa@xlko*h%HY!&_SG7xM(L38dIeUeVjBfJOhTD#PcB~O#uhT(VN-OUVft>9CQ8o9 zJEbW$QUeFlnA-9V)X4)XYCe{B*7t{3A|%?9fsx|NumnZIPV{fHr1A(FOfe_?rFz_m*7ob+Rj@n^pr$Q zaP7xBCXBqX#&1_2VlL&g*q*za*IsgSa^0?X9OM}j9Dx@{gD@YGB2^IZ(zoiEKQ#-2 z+^}xp!!Tj|Oc&6jLAhdMlmHrT|1o?a`+xx)aF$I8n{^(DRxdeAW^FiiesbB7>@~KKT}nTCV^j6g zjWi=cjc%8Q+=}EB4oNdO#ZB{VFJH6$h z=v>aBk8Jq&ugF@RFmorwxp~9R$Qw0>r@s^zHNvO4_7-tw9+4IKlT(qFO)ns~?3KaM zS{xo^>Zq61Q+yYA3U;Ld%-K7IH!0wz$~I%_8Id=f7uO#(RwnQKbwg?sW_7pCBAbt~ zK8Md}@1{||BfA{X=dhsQE4hfZF@s1gV?DaoEG;jE$RPbD#r84m920Hx%%WY9mFl@a zS@l7*mkUG4wYjy|pR61MpjV{O{*Fro*5LeFC99evXiWHQkL{R3!frKNEI_Ue90o~a zK}B%4LQ}ossOooka|Cw-8R~%zL)UX7CcaeJIRkAam!Yi(ECh#zBoCIlHXZX07Npfk zwf%hWeIwgAR>Go$^kbnE(z0k7tRr=<=`>|{#WUA%bB3A`o31j%jn8=TxzAYmwHfCK z8(>+Prj_k(`082ucfx$-YW^Gq{d#+HNqKl>O{kqhMBf6jy~sJ0{j;T`bUN4ytuW*~ z1q`|ZgilmP%sSo4LrQhz3<7-_oJTs4+045;k zrYYiVMb~e&QY*bdlC$@bACeW3fokF*;A2x_37MF|a`;85_i85X|%LTTJX{Ua8IWx)F+O9XE5dksCa zu!~)?Tbn`%_-z-ldMiy>C2TPUhw}Acv~AdnSZpk&0RjeJx(A>e-h)I5mCNwnB2DIZ zj4yZuRqx8^X+$7=9=%-rmoqjcB(vC`G+#?>WGKpmLju>{l-RwwSg)ic=c*|D7NwuQ zYmIE7)R_5G=-0r8%UiJ>VT8c3vMMk)Zb%E>!BW@5IyL+t$9hNRu3lc;U{JKiYG!+ z@q8&uv%0}?f8W`q8nwko$Mf%X)`;`J%NPL`fAf2s{yS|cB#faHDRGtyN$t^y{${+? z$iFEc)*v~NU7AoP!OvE~{Gy=n!Q5nHTutUhjiYx$u^P(RO zW8m96IrL6)%KJG0ezUw;3D+uSVK%cl@adpxr`CO|HzsnMvAbk~wC94^X!_Vhjo*ii zp^#ps6aLJnj#_+fg*^brV z&@%ZxLkP47{CXTWmMO>aH-{4!tz?c2s$Qc_0~S0swKgF}nLk;?);zcFIBm1G46o?w zte!UG-ffTgn0fkw=lw5gX@D1WfVMiiQPP1R%Ky+n0j0U6FnSfJxFPUo zADZ=35r;+?0Xf#drOlHw5~sQKt#W0#&%DiM($uSJPfYERw&o^kEk!I6bRQcr4Idh5 zPAA^WPO#Uz$96T`f7Js6zGJEM6{VWsYOQ6P<(#@lU+l<$DuT>OA#oPKgd7m``)KX5 zJ3V)7^T5uh1@TLIc0p@yH^&|&m2BfiMLI6&=|PXhidf9COmG32FCxhTa*75I-q>Hr zW9b)KP9dAMfW7w)^BOCLR?Ls} z*wz!A_xwVPMG4+)EI;2SI~>eT+1*X8*Qa?Oii)&c1UYMz%6#9IIzQu+H`u31cK1u1 zj@Ruel5sPAR(oSPWxu{XeKb=}V2Vm6Y#=D=qs@04-9J-T*kh%_zL7c~AgQ(UT@%$l zsM$-!aHbPt0d;3U8D@mF1(K*91@-jrI8Ovnt-CzLPiD5F0b_1G{Pit_z!-TUe6^Xy zd4XqO0g8S_Ek>5;*YF2In{0XR|0|Lljgw;w;eAR;(IaULTS`##mZo10QfabV~|ki8#%;#gb5qqOt*iY zN9xF95s`y2Nq+*OpL$dZ0qyPc*?ap4$yt0_Mc@#CSqV2HRY*4sB;WqF$EopC>&{Dg zF92;{O~j`Cj#j4(Ik)?Q{7Nl)i1&A_xq}myHeOm=Y~n%mJovimUlYwN?}vG|38}Gi^gI z!*k`|?vkeeIq2p8@tH<`W0-U7^O?E!mR*0iT(xn4<-|qIyCcX z^D8pdo0{^wN_0E4Q~2|9;b*g`Whz+CBr`b^RkF7_iiPP^EdkY!JyjN9$S0Wg4f-?g zd(Kc_!kM#dt7yOG)n?sziWZY@1wtRW%i5^G_{Im7y#lmfKTg1R2+6jzzuP*>_Uq~q zSG`#$U1;bZWuASzJz1;CucGnH`M#LF$*<&ok5avP%M9|GjC9=%1! zjD(CEh1ef9;xSl;TojYeYcS_LOE** zLO(%!Z-`c_4WLHSK#U}3V}a-G8>hLP>K|<1TxXiHTvK}3)?CU@vzQxv%w$Cd8ZNEo z;Ks?y0?8B2{k}!8F>{SiBLU41Rm8GHzy4v4=(A$w=+8GqdTkEf(t!ylxvHp!7Iw?fU!h3Mm z+B~KVM?Ng&R(6m*k<0AH6)UNf-A!F;2Mu*?QYf)+vzWJ3I&FIHccgAPeVycOGCS|=ZrNe1p5H<1N1vIEly}A`l>UZPAabGcX2+$3e0`YCNIr7Pl zO;1hnA4JIccLOP?p-k;vYP$S6!x2B_A5jpldBcP7@T{<2df7Y<(DL zGZhng(p`tApeZa6!dh-IvfftM%QfGhl-+oZHF|P*K=?EgVzHA<=g{%(MLtS&FrK@+ zk`e662=_Q-(B?L0*v~yVNvV8OmfI)D%~x*4j+0cA{zNV#UGF^uy--E{3I0B4-@=Yc za$GF;f45lZ|0qcPKVQrAzfYdW2yaI<+ei!6Q9P~}yigfzQ-COu4vE2eF7#$ixvmDnRa5Th}uYRM%Kx^Rl#d)xqh|o$CQiX8*48d|Re0h(m`A;Tay%sCiFt*CJ-uYG@@9(1#9Z$l zKARtWW>t92g7eD+1G1O{B+hc{;`L$$1ok{xZKQ^YKC7ub=p{&&8 z^>*_blx9);HN$_BY$a){uE2=BnZy@@7dr&MQM61IKNU@B70yF8K9~$@CS3h-{xlDv z4uFYeY}`q2mU>Q^NsL!p5I?{}SQcc|ePd)r=xMdnw0c<^p7*QBncSK;y}N~{^ZU%( zM8KzF!YgwV5cxZ0gt;K|3|55Yv6{JB@7`WWSrE)AnEb`KEB?ZG3M3i+ z9pkE|PdwKYnzJPOi+f0|Z_O2=X?V)>M83pBmyIxk?yO5xHo$DDqn(>ySmwqd8Q_8Y zXyDPYca4RcK3B%-(jB(n#(p~+Z^PH&Mp}oKI>`+W#4Il(c`oRoCl%#a|Jkb z$&I5_>JH6Y1Icu6ctQI?qjV5(4iHimeJX| z>y#9U+DwhRIb;C7&~-vp@v%))GqJCdT>>g2M|{vwT@s56u#y;@gUhK+NqIDKyvKln z6Lk_bq;KO*FrsUDF0o_E3+D()ilvUkf#Xoi)j?lXQl9pVKY|^gG+)S=&MTtVEpC)9xdKChZ?h?f5Zt4s zg)7sYEy}~+QW5ZI)=I5u4q^@2zMKsqR&fjAheARaAEzm?lWTHv;1fO#?Nf)lAB-Tz zLz={hSXze|mZ&m-)he?MYQBys^4ndR|q}HfeJ60~- zQk5pMxSd5#u$!VZE^=AthSL3#JE zG2Zj|6#NHVX3!Wl3hLPd9)o`vZ8EnG$kv^jHxEMuFiaP}b+RDK8mVaS5gmWMSx`3% zQw5XIXl9rCx%LtJKXg@cd^Zl&f@?x>COYUtojvZiEoeT{(PP{kgf-Vc( zDzj<7J-Ept#v5n)n^^^H-j9cfw@(o!WQ0sM;?!yq1dj6~0Uv~Sstzv(R@^JE^UeD` z*0lyYyae(H&M86EQ4k-<>SV;Dr)w>2H^mahXV9x}^&9-P+99RGao$0%@8y0cHwwAr znE*P1Ta@cLdL_Y~6-#ZKrvr|KL4Hi$-2N0+yf&((I6}n~%(Up%u1aV!aP3ade#3@c zXM#^>KWs$PZ^~iDKIBY-vy2)8$k9`Qb+{Oc=y%IHeEn1=)~KR++&nZvlTq2(N#7@> zJzntvGp-wB`=h>OhpjK32Mc6?KpetJ2ytI@``kI~{yh^w6NdpSaIVrVHsX>m` z4EuFo@)(=b^3sqh=Y&ah;_7w5P7m4c^R~d+VG0%i&w`XSOubCgmL%taMi;--bk&t2 zv+gxG;Lj<>_A4!^6TzBkL6AI6FcY$pPc&=mMrz00{_f4HcV|0*vFO-66Cr}4_=e1eAu2{dpcyK!8cr{D1sk|_t|9e)hD^2V! z_{U;inWw_o;(fH2RO|#$1s-0*@nbyDag%#^PI&oHt#2Zc-(~|SEw-B%rF6fS;h##> z&q(#eueJ-NWa9ics(kqrG|t~wD+6ErP-(8NxhLx9h?d-j*GNe=^7axFHms!JoJ*_v z9sU8I%2G(3hweMkd7l|&e{tmK4l@Wy0qg2K_OO}qCl;M&JN9#LKu?~xQ zUa0;BQ+5Y{eyzjV+f#H$k`?h{Od;1YiYOk`K!)l#Xk=j*@bW>|%869fQ0{^C_i0*- zLqIyN9$PxRIHFuL=%}YPn3UBiS9$-nG^Ci|dXDRK+3D=*}rF{mgNUwFFt1S_AI9pQDy<8^YdR`-;Sh)n4S+kl2K)Bq}qzPO&%$7)@ z#p1N*Pt)$6X7`wNzprxYugj{jd=)geQP}@IuFAI&T#=+oUBlSUuK<4;2)Mq$#e(>2-#c*x3>N=37_VKqeR>bv<` zyi#r-*#zqJCJo~%dl@3NTE3D!PYyjbsBwcuX5jrtRp8=qyf`N3w|%ceObM~a(~m1? z>Euk>D&19cez4k`QCzNY>;3*n9qmjAYF?y`WSdUguUMO8rO8|KdjYzz4SXE4kXI(vfxe`)H@HJKi{WlkO@^{+mXP66vuMl3d4k$hz#)owG6Mb;DSA3{>cSH` zQcBnhxXK=b_2+~isU4f9r!9pmz#YyEgp9n;gE)`YOeVZ^(J3Yz=`YKmJ+0uU?3bKs z{Os9WLbFYH-7@vu!P$t`nOC|oRk%(p#d*X9Xyl+pVCC5i1H>4WsfATr{Sb>ADVWo*Q)h#E8Ky`yw0RA`6g*C?2yM>9##WM`DXz=dl$#$xY9Zqi-xy$o z!W(4Dbx>I=6p|3|&B}|g-e1u{O9T29nreqUf&9oTt*i>O61Pks=I?2h%7mc0u51c$d65L zo?CQ#OV>`CePG4uexcLt3%FBG`LYC%N&sUV^rZ*1;|Y6+Q8KP);A#ykfl~H2@AR(~ zN=wO{X?K>wq8l7oj+|GzMYvt;igS-3_|S8A*rEM8(Rh8)1YAbvQ`Ws|PMh{CSNFOp zzbeO%W{&ueUsw8=jQJU}l}&vRpE;#w7UUdou8*3MQ+yODw|2AJfMr~sHs@UMm5D*_ zx>lY=!j6U9G4X3C!A~etN1lFzU47P{gB;NkGN8PzBO0`X-sn^%G}=nI79l5;$*ozx zou{-02`kI3OV@I}y;!d}`!MoTwG-4arla*n|yr=zL zR(-H9sEY=n&s!nU-y%wbn?Cnbh&J~$0bl6*TE(ckhZfC!Ns@{PPD{?7C$9FM%4If` z!ja+;!!ux2G21|=(V&AwW7bXA_8*viVFzEDiy22VBX96uRpYt7We?UFs(rA4bocXR zxp!Ss`D|O7~{-u*sQfVI$Q|D8;=gLP# zj-z860zR7Bw^2?b&<0t8#vvMP z9eSrd>!H{)T-yMo+4ZyL(iR@G|+8HD^y@{9|fYvqJ}i z1MW>cq#xUzVwFf-yhg9$*Zc2;j0aa?!gkquEhoo9A^^+C+#^q=V8dPCn7 zRDE!Z*gUAhrHgX+K9BV5HEHF%H+78#RtQZOaNga}{v^RfzO?m(W_OG4?i@s){`jJL z5EY$CeX1v75*jK~EI#9ULa1llBgw6t0k+_CYF!BQROT4@p6??8BmdDHSu&D!?{bWY zY{0xP#4Y8s3Hg{+e#6DZ)2B^o zk#;Vr-6yJEV1ioSN_Q@vs%y?nKJJD$RNwtIWmWGE`qF{Hf>kkvolvn9iNu`G$7LkS z1cj+zGFsQ!v5!b(RGb%-6;xD8YHuzzHAq8ADI*7^Cl6jlgAD`x-M_|8=?j?i6T}Ph zLj#-dg80ndOZc@ySRzR=SZ#uaLeQ!u6iu-+^g|pyxfyE0MMpUzZ&CpRBm<4Zm+oC`m@q zCKaECxtqq;r1Ez!7&1H;P01fj)hwAv@$jz-R_YAfw=Ec>d}Ij}wJdJ?2$PzU>@`L8 zS(Uz49o!cptlnbI+289m#QwR-{4Fk)lr*uQ@P>E2FqnLrbi7YbYmQvs3U!ca-ch^4 z(NzubtP}LAQW4i}TA3{{KgI>z9VAZdgbEuH3t#S;e_N$LO20m_WM1@a|Lv2!7x#U) zrUVRwBdLj+(A0*@8j8KR{ckdw1eYrm50rN4+a4zk(iGSwb3?S@M>AoFIczJZ?=}%R z_`Ts|sOb12-E$D%_HLSmb33hPu>z@Du3x6#CP%VE_a_@puuMJkvaPCcb2!y@BNB4~ z1lE!cW8IrwaS}Bt^u(A7B8QR0q={!QeCs@U<=24t!+3n6=TzSvlO;%urW}~xY|Yj- za0!I5mo^F%=RJS2IQ+g-m6r#aH}Q0hBauQSf)e;dVg#Ai7izs=di8AKifpYl^pHEi zc$s3(@*8u)TjLxw&pdU6Y7A%HazYPtD-_7cPH$le5(}GREz8sGd>|(12BbFK#GI7-`^sPMC@&k_+tEyM%8f^Xd zXi{We;g^{ayDnPEn+?E3G~-CdW^ag;TWuI*BNmJfq!5E;jS=E7PDa8+_dR?&qLQGJ zjqj5`SkQc&H?ZmH7|$vX5bHNCvpUHlZsQ3rV|GxC%cQtmbZ#Y>!u_0Ym42-Q0#al0a{P9!)d<_!BPR%8s>1qd^_(wC8@eL`z&}5 z?HG0oK`U05oS9M7zH2NW3FN*twsKKbTbnyCbZu8i)fD2H)0#9f+EXNZU+L<()*C6} zKvto{G++{iTX22^fa>;c=u)kzQLSkTJ1tZIG_W;wJU^j7w2o#kt;~^q)ol7pmA)?F z!{)23QoX1-%`@6}jP96Cau;9U_jBB1cVKxr&za^M;UMh{$a#_>g!$Ar35tp0A@v=5 z>1&)E05-Q;q4=cHfG>E5y~C*3`Rx ztD@wqxdqYPHMyX=t6)Wps`8>i@H$!enp zPbprQVE5g2GfxJjbteQpL+buQRb<_@z|aI!(<^94jC+sHf6Br)g2aj?Kh>Mh_IX10!pqPj0oAY_cG2DI!@E}i`J>7ek^H@D zuV{;xk`Kwtru+wW_8B-Ot(gy)_BOFCLJAv0ePG*)$?q_!o@Uc zx9r~LZT7-SJWu832`;knZq4Bx6&`yQHD?~tPL@k(joQ^5{`m3f-(vK~Y>P0pvQ#j* zd;Vyo0){Yc7PcxH7{?Z^{svBvSiZZi_Vqal<+?&e8NsEKa>oj`x8nJ6U+iGt1V>*R zh5dbF=QgD&O)l{4x>${5RywXfcW|2(a+sy#7lLhO4{b`b79(E+Dg_D`I!L$2YObyC zy6!HB(<+VcLZLMQ6w;q&fi-b8ud4Cd4`>4v;i22y1og=f-{6kL9YXTJUF7AX!)dSv z#1Ws>itRe7_Ga#~dnTo{3woj$o16V8q5(JwAx_f}^BZ`f(e&R_ZcL-oCXtfI zWMQ()4{(NPxw&U119nU|YMNI}F|C*eTC_3I>);$NRx2$`K(6Z$+~6PpP8HSSlswA(Pz&?pe#}fFrDW zhjo8|IMg*m>blGC#n!L6SdcX}4f&_*RORBK`bakm#6k?@5`j4SL=ZTT9d1!}>oeev zS&+LaG)_g6K`2UW%F%+yJSM9#*gb5u5fp%YjW`Lod@x@(kNtRh&P@LRDBq{Vimx9S z+Zc?HIK3&&pnuzjPA{kcGnlYVeyg%H%TBOX>FdD)V*$<0Rj*2t@5x`x%y(84r>=P} zwFaAh&m`Hdn@h|Vl!e05ZmaU=$oi&4o{8?MG1D@<`169t3#on~T z0;FnKZKTblEbCF@dxudh?D!Tnyc1AW0E{ir_ob`4xa)(GE3?k6k+bO^+Ybu|HZ99w zgZE}6_|704yR|835w9g%bVI<;5=`Skj$*AbF7L%A+Z6B4!?knw5!keGY8O7_;aU!WcsR?(UHO2gThe+;B~y z7tXl0`Pg@eAj5fI&*ZfVlJ{Pdk#fsNAe@Js9p5)p@B=f^3$DgOa7w==O>!#1Ke`zm zYojZ#;47sJ>Rp`WIr?*T{b>HSlMamJGN3qACZTNG@G^H<;_f(F@(JG?Ud)2D9+Wf5 zIywJc*^Nc^X1J}K3*88~>7$HeQ?I7k3)(xzH zajBL@tSE&RQ>E?whhBc|%l+^^rM3`OMPgEy+2~z50%aBacx;I-E@6=DJ~c{^7;hg_ zJ15blBj%?ePSFEyN?cJfAV&K}Zh-g-@;V#Wc5O@v%T&4Do35pei-VIS9?rj4{jFkn z-EngASXKUPYUwRlBs3al?>4B1{h~p7Aa?zDUJ*akjU@^+{o+Z5hs9Fd_H*BeD#?-e zA2eu@Im+Ktbo*SGu~B0#cbkl=D-f@4_K>krt7_S z@Ardm!RDhGgM;g^#6C1h-DCK%p2OC)|PP`=p4`7%iQ%Uf8qZ zup*mf@iy49-P0U@OtzApqB|fP?n8_1_wvfzBApDc8 zPF-S^tWkBS;PR#fJ{EYy3b?)`7t(pi_lr!twxyYSah?6J0UrEqZpTFr+YsA{c^sCAkYA3w8wTpu3B&n#=IX@3l` z^YI5I2(>V6`dd$JP8;Kv_`uDk6?G$1dY6C8!2u8U`|WG?zO3oSyIQM@Hyyq8Tz@mj zdjFbS;)&nvvO&g#);;=NS^9a&B{@SinOx$qvK8 zqg)m`gB4Q^edFt|3vMDlkoCIvlLp7GHoP&V@Z+?|I$#%OQ6R+uQoLK(Q|?x3REbja z$B#B$??)mls`#?_+v_cRH+$HaAG(5!)AA6ZrC34ciqlfui8{KvAlY-}1>063s|&6T)jZv>78B=yn%IezVb{}(33|6k6=|K~T+HdZX!c1=45Fa98;cn!6# zSsMXM(jJYL|AZE6)x zi4FmD*81!XT|gbST(l)>w_T-oxevzen@Gj_s{B9CzGZ`@FgMNo`^~ma<+u}V=IRC8 zGp0!`XTDkb16A4YRD+y^Q7PV6%Nb$z|W_ zT(^x*|Rl@$;?YPOAtk%kZZOFWNv6?`#Wv|NB9H@kf3My5o)k>m;$OSZ-TQEaIGw z4%#mg;lt%c`o;L3`{tVQgF67^eHunT{L^=~ww>^D&*&9av;!y&PoJm7AIvtJpX?SU zTMs+Okf~`jzzwH!;UrKL2n0eS841GR!Kp5s!!^(T$j+3e-iZPv8*dFyUvq@5yQ-3W zyr5Zy$1?{6a&nbVj8r*R$io62Eii2P=30`#*(?j8dz9jj?i12LCR)y_6lYUx+L8%o>Z(}Tk)lo)0IycZdu>u^4H-1 z0kD$=Ge;;j>P^T=LnTgX6odVWOzzG2p$a@4_zytlEHR{K)j3w_VmIlntM|b z&%vc!zcSHO#DHktq>MX@Zj29(2`w1vXP=IQntcDBDPquXz7TEnCGzM5uTVsxu!Ni4 zk)J#v_2+Q+Jl5Qt_6sCH@M=7?%}TWf`x36KR2A;-e&vZ=CIEg+PY<$QZ~0yCg(&U| z?u$)=Cn1_2vA2?j(GDcdqvh;I%zE81+Yc@#AMCj!c$yH(YMhB^z~ZP8LbX-{Im-+r z9yTXQQmlpVlgcL1#usGLf?uOZsvW+Wh7*f)htt!kru(&j-E~y5W&s%pHv@KcuNcHY zj6I$M7Dp+6)q?GJPg&m&)!AZIH+COn^I7(OND>t*dpP>gHFB!PlLdiREUsHqm4$VD zFl!q)8wkb1&CRA4sa~a_YK{}q_$_N^f8p;de2A&RwH#8l!q5V%lv)ZayOeB zC;-U&W8x~>WcaY6ysZAugFvK#t z$A@-=@;+2^QLH!;C(#vnx6w(?duVc_UuU`K@=ce`p?(^!;fP9;0(mSo7qA1&ju|yP z02W%hR&`6uU+P=`wimc~t-2G+*!Z1#IwkrA{fgC6clBXD&h;fDdbG{gu5Fpz4D)wi z(45k^`BgZx=?`!D`T_B@lYE5}j8g^g7_JZEfvb*yj(VczqI~y>ad774po_eyVo+Jw!h}7AX zX36o4o*?eu_Sg7$1Bxm74c4rT`>@O!Du*;P*hnXIZgUl{dC4NVJ>k%0Z@?huGBUpb zd{Dh(CC30B+xgFtA=a+yzh;e)1>m7II^@b`KMIms7MDe0O8t54%H!h&PKSN~T+pXiBF;v4lMc&m3mYd(y4&Z^QM@y(5*OE|ip02@yMb1) z-OyRr8^7MC5!11BM4wc1$E5B=`F+W!qcU0fJ{if$fAr*AS3u%`=rzUZFT=NiW=UL_ zH)8b%pV{!SW>=WGdUKYiPRcLk)7oZWo!Rqhm^kg|q9$upreVLQg1#>9#PCjllED}? zCH(6!V3%!^lX*WGD0_k2eGYuOs_~>aU2+YnK^f{1t-^*qvomWuLDDY&FxhH##5oM) zECinb?7pDkQEGbcqKx|sT~`}IuX<-mm%47|l9c857YBcRXV?vS_B=_fazm`2q zuV|pc9#|i}ZPyTy#+ATw=P2esD0cL-@qd<$8|%erOSixM5Ti{~%nBbmco`2j9TNf& zNPp_7jcEw%`~h?O{>y7z&JfSv>}=wsl*P;WmYo`=PTlkfulfo{I3Al_afpiFw~KPoOM9R`CZjs*Lt>L z)X>b=kUC@qP&;}XDI!pNQ;MMS)cwTiP(4ucZo6#F-Q`m{D1NdUuv-6(!&>{)s}kpA zD!iT>0<%&=tcZU`Bl4lEU9`2c7696I?&sEByB;QwI@v@yQ&q6=I-HauF8;rNsMh!P z36b9QF1vmoA;C3d-_haX#hI-G??^lBW@u;3+|1d7Ub?ujJ_cm(v5tw)%-t}Fv+XyK zEap`~#VV~Z#HMe}!txJL#x5YBG6>?demEcXx>eW9c$(Mtz3%}8I_&2wsjPi0>JE2T z1zYRo?FR38*XE++_|SXICXU^Jzo`3r z6)V1p@HQ_Q7fe07P$z-v;H8VhP4TbdmoJ$0hK7j%3yC_CL^&u>wa#xM==XQ(Ye=;> zAb_XQt2XIZl<_CctjE)An9YVIntobonrANJOfP@e z8;f%o-gjdn>x*i)!3*|8LHN4T6c|nB*|Fy47rlr;crP>tw7{8r`#XURILS=^ghpM_ z#HT32oJA7|fVBnp2fO~7W&Wb30GJo48z*H{P=3R((C;@*Rm!V$9#!de52{yg-d?$7 zf%IsDCAg`vpjxHiolrG$--52s6A7(cL18Gv&(F~Bpi>{bYYT@-OfXaf)Iq_xl{qJH z`I3-TB^7#t96IF}VHl3U!UJQ?Jy`IW4tqr9eJ4bDeB(;D06c zRPR~{6@0t)%+Rzvth8Eq&wjE=vByHwf8avIi6l}V_k$o5V74*p^%jC|(O( z>Ets{8;jjUe~6gP?m8Lp}VJeygrI?I%fmRQ-*h6u;uPx*c_^28iz!8 zPr>yt+6mB2ewA9U+O7S(tfGPsgAzs?6sRk zuW4hV6Q#X&ni&A`HzGo505+HDyxB~WX^~@s$!0&n;Laa()mEaQJ16u$R&U`IksyL` zup%-4N?sM!D5YyTvJ8Zpw1)71BvYA;Ep#&tmy`N9R`ewMbxQ}czc(t^h4b|fj&B{I2H`H`ctr7BDY*2%ToY!I01glvyE zGc~!;G#hX@uIn^fF+@Q2$EM#@gz62*&pHRoRhCMIo+xDILi@)x)PhxgC`KtdVmVio zppPX)p(jQb)|=wg-w^)julcd^U?ODlD7C&f!g05qiuuLmNC0Cf@y}r%2KFiE4hX%X z{nm|d@=pvo-$#-u-zbJ0pT+yIHlI~_yY(*0K;~LXByQJZmremI^sn8=uL7K^Yc=?8Fm!9=DRx5FxqE^iU)b? zm1Ov7Vvnfahj+~1t=eyYF=GTX4F*LOjr8Ftvk4~Nri*)pn#H*InlnQIqrr=@0*D`2 zR#+j;&BiS9%ForH@rUITf{D4fgYUjhEYLAdrc%Yn;~Zfilg-zj+$8!{`6O~Qsb;A! z`SKwp2EL>S_QK>rQfh4l+4gHh)^F=AVL=?7Meed*k0_g7xwa+&^88=mMgNiwmI`i5 z*PhCLxv6vBUeS7hmT=Tx_y;CME^dk0K9;t%D`%d|{QSWh89rdLvbZwPGq3R~u|r|D z%Co;8>pQi~C1C;D%RR?A@-lM}gzP)x++eiG_?C`8ygy;&o3V6{{x~82Kqe_;kk}Y{ zBMG~iacfS#q#gD}FvtGM|H6{L_^v!l(7iaZd_2RPey{dKRBTqm#nIAl*2E3JM*A1x z<&J;Jddq{E5?KE;yECq5`~_Y73&*4xGwU2P=NIQ_>!qL4#RM-E#ej_ih zY2d6f2_>1yzcTgzMOf9gNh{N%wT6a>5iJ0s5x>h}{l5v9Qo3twn9*=|@8Jxg=KZuk zbM*g(PlZQ`74Nd4m{hTl&wl|Jn-04=Fr@8)kO?dSgmR=QTH63BIH?cIK%isbskvqs4Ma{$)f7k5m2 zi!$903IQ?|(r(CZt^6Py?4KWBY<<`CKVdv;a_xUZQ2_<_N~bOStUYko|NPf~uN>H? zuYp+|{(fzDG3x*PH9uLGs?KRgXi;cj*yTbU&uiHm#oH_fR~**P5OW^z(`&+YXcPG-kz zRA4-m70|*%?0=k4-`_BPrK|Io17S=FlYYl+UqwCuha$1?t&X4#U+?|T(^}qtOmKcO z)1<{qXf!{F3iTsM)Q`yam>_^RM_rKi0nE~H!866q5ATi?y!sFRs!-X| zSph&#UxGCo%EA#p0OHhRkvVv$<>iK~Ey||#Dy6nw>Cz57M1;Lgo8Y)(G{vS%PVx7Q zX?{}k%gQAzKmB8k6R2xEfH5LSj13vM#Xg9~b4RN(Z-i=Bvp)NEcbo z8NCkuHaTu}E{7C4%}nj*SaBvISNyo{x~b85xp*{BUd!6qNNK>RW7OaiM^Ppn3O`Nn z=!*$zEEd7`58}ebtIA+T1kVA*!6KNAn^U#iO{lSC4e=-lR31MEu&p@%u!_T_X;L4m#zp ziZ5esOa?XrJD?O1=Z5R)QG9x#vPy*kK=S__d%9>jofVsIzuvM%T6mVU8<>(m^u&IQ zf!LccJR7v8bs^gJeCtsF22RCDN*Sl>I> zNbtxO4gZYjzp`d&-1=hnaA>ar5)!0@$|Pb{*H#b|v%N1CKU|MHn%dF&G~alhqO zz1Wwf!I`U}?^m~YkDFhckh9>FG~TRo(;Z4BJpcg((F-a*-kb+2@TY8^BkqtYmzJV5 z}&qJ29Y48pmar*AEr^A#uT>n}P1d5Ho4acZR9+zOVVSXlCB?F(aq^s?!sn zU)sWbTskKds$7i`q6xC0>@G3KhUUWDDfvLo(3VN#S=%tuj7sVm7pPAl{yKZxWRHB+ zq{#ysZ#Y+go(SdbV_BVaR^P+p3GwdWKDBO)^fyVKJ5;UR_atHNd&Ahmfax2m zg*Ro{(UeCCC0O#xr}ap{nD)-`z59rb`j0veyi;_UZ+7gSNwqRji##w7dJdWBeS^B{ z-9m5r*pO+U^9arUAZ*7nIu7(a7p%DH>NtwvCdkDj@QO4UOhCtU9u6)L)!b~zeT3pD zQ>jz*#N1W$rWDMH@{iD9mMW==fy)+0G?&qz|Ae-lj9D4Q`=6p*ZOWd=y%L-k5QIaC ztTFhPy`1~UBi%nIWYhJN3SXmvuQ%Y^S);VhZX0eN-&EU3ZN3Qc$(fdY)xOPGP^b|b z>V87HyIEtwdtCr{??U5n1Z|sfEp;3XJ98x{z~`V#i$(>^UIBZR==~}i*M_C3UuQ;N zlbP5~FCbUOa$d5)*;ci=ytDd?7Y>8f=kCTVVe#Ev4du6MqkH@1j@cS_Jlz_L?S&{BtY^JZKAZ5}dpR|XRAw-k*_--H6#c&oEHSeH_)Ge|MaSkp2 z$TS2MCNBxu&$WKD`iICcNU7Wjm$NKE-6#-VHagZaakFDgjfV#bCT7nOJ+MY(#N3O@ zvhPMCJ?Km5;tX@&aQcGkFr;KA@|CsEJ;C#K4vpAGvGPRg%661@( zsHTQrH;NWS!Bz3(I~3;wnX#fatZVMB2&iVpcQ`ECRtMSGL#a-i} z!N%wiQ*QGX0mEr1&z*YfNCTo2F%~<$n9GdkDCY>qh`VY{*-KCv;+rO7iO52@H3c(_ zjW*#31@uRV?F;fTknamhFW6HNI{7R{;#6}t$(eM&J163fq6!fj*)tZKL4*J^ew&j5 zu>Z}?DvQ%9pK34R6{@N8+Oq|iH$QYvW^AIhXxIeF;zBAtCKt4$ivp~u?B<`&#axfY zR_e5)vrmhzVrTVW%g@s^wAV02jDJ8)l{@&kMAske6)8WhIc>RcCYfj&?3XU!5F6%2 z*)Ts^@8}acXd?6uo~i+co6c&1g(Z-)Cy9gL{TA07TuX#E368#7_~Xe(s^NMz>{xpm zSNn9SHD^aJbX0GbOmEYh2i4~%lu<8Jtxtc6%7H}-!UW^_8Ef_Q`$#Umkslf zADeFs+z~kuYfo0O6JZ-c=zX?d$@Q=#K`Gx3*3-K9e4qLsTO(4EV`8u(ysrUudrx5fOHT2Bba zzrsQXe->)I=F0-C;_$jN-tCXxpGS7eveLWn!e?ZQ{1w|DIn_xAP|ckmw=CN-I!aMC!#NgzYFi1ubso2PWocA}9) z5(?Df`^0r=vSUOeOXVOU$paM3?2wUt{JddYOr`z3vUZWkKvXm@S1msA z7pRFnaD_i`RX^o_QZEkVW5P)@xHhOgX%gRZjj{s2A@hdKJ()v#JA;4f>FpRu zZUm!j3D8+JB7IQK;<_*-XDlaLxWLcJG~|ASI`vs-PbNVsQFlBdd?bAnJM8;4U_C1G zoQo4%xn(1tMm!hzQ~4Vxp_d3T*NvTJgb-rlPk1fty0=pqjLuXVsmu%T@TMZ^*xsn@ z$quIDKz+H2JYY59E)}O(&|=@|sr3!TFDGRf`VMxtnv~JnO^|ur(N404MsrrVcfB9 zyb%r;@g5scOyZ`Tfgl5sMDLdU&3{1Xr@({Iwx=z>T||ic!S3Tph9!KHNE}>oo+PS% z9j*QK?Hl-!=WgDQ`^c5qy6nBEc}fs!UQjY9o#N~sKJnU(<%}jzTMc7Eur(+{*+qDc zel_Gru%fYd5uD#G3{AlQUjALuFUkl|1uMcqYTn_K?YX57s;8hK^!`<~_gyBNW%9)N z5nrQb8~yHg_kh@QlgTGxZ`Sn&KI=o*p0`+{S9y9bjehw@7s>5*QP zYEYga%IIVYB!m?OoA01_c5C9t|j`wV(aU~zS=e4{C3W+YC^I+8h-ccFM<}s|D?Yn&~ zPk3F;ZapLpoc4_Y9=h-uQ}IRJp*D&CiaU)nOYvzQ>@9}%RaCY143^zeA6b0@lm2Fn z>%4jME1?*dztoOH1m$XO0x~yM9({8zq>@Q>YL#wBW(}v)cn@Lu37Aa?V4~;dmw?_O z^pgfkg`po|+F*&?K*N-Zqy`@MY38clrQFnZEpTjNXg%av-7aAxEVKfIh=*T*WK3Db zvW87I(e2@RuT5M`ETZrlH=Ayq=mg2}_okbAD=g?fR;v7H;!GuDH`6cPA-6&?-Q$Z+ z1G&3CXt9^{=`Y`OKvgCW>ft!^gnS){PfD#@6-zIMiIm8XZ`Hidh)LgX8*;!|F~H*k zpBBYPv6^w?b7TMl1B;cjCD8xSO$kw}4I>u)5Zy5Z5ufwt(){RsNL9x=q4Xp$j!~kvwQ=l_J2xJC zoWDz+4d`v4)h9HigPW}BH~;QjXM;k3=JHg>zi<&)@5?k8XahhAy{hxGp$ zR2(XJ^}5JqQZjnEPn}ZXxI5hG5xps^a=fU^)7l1@gsuM!JhuRU@b8_q!~gMX^q(8L zIJ$m*kUxA-0rn}$EE+~5YkWv00GVW8I2iK)dcjE^!2V(BWE&&vy)xv z9~+r~W#;g|H>tTme_guk4Og_^vICUbP~2M~#|ZoC1^)D_DEY4orH8Bsu*vghfoeL5 zF>`LT<_^If{q||N@3}qX#e`p3m49ap8YO=KVdzM}vt@RzD`pG#FS8v`M8NA-on=EIjySPhn(fPd@h4v^K|)ve^^^HjG6 z+cI}1aCmoy0rf%l>V$&`%Kb2KWJQncnMTZOR8f4Dp%AU`Wdd(PbYbHciu5L7vM&kMKwn7Av&kg|zcB=lVGHN1`cC*9a`V%AR@r zO$hF`m>kUIqfeB6ldI0a-6RReON>^&fDqlYfU0N0-`Ze|&Wpk8Uj4D9O@o=vgF8Rbrxv5Q^jPV1fI;5}&`HZZ+RAFk7$GMoxm9lrPVl*qV^mY;!ST z_b_s-`uJwY%9Cd?F&L60IH(27N_S!uVx&TfAVSj$GfMIi~ z3@<9}k5v)`Os2$XsTqUA@lN8)6T(!Z+IgcZbRee*RI1gwJGhmz?BFiphvuA<8M&E% z@B=%6(s*Hf=UYN|Z+Q6hk4CbMnquWIFjJBJ3@W#*G3;4f*vD*ET-XeuR*j(tw1hzS znm9i>%@p&yla~V2IrmTIunpd`U%^i6&NNhprCiyZ=3XYUURWM`fwR$jtjb$3xgu_9 zQMX0e!});SF?v_e7#*kAvwRAud^yWr8+f52t^8d0ZDJW63xBc zde|rx76}3LNjm23$%18zx~kWTZNus5s&f(My`ve6K}aUeJ9>EskRwz`k8{9m2x%LDb)pHKVUg^}$uCI3kLcz3Morg#JyI=a z^^ch5W^SwRbdUAI1!|9@KKG;N>o25qW&=HjhDE8ocogRIL6gJJ;&pqKiekHnSwG;M zs?~sRTZ%<~+prd9^-P&4i;0>%XwuQx z3hlJ)J;R^7MGDD7^hO7-#^bYfx%H!soQg1;785)yiEpQmJB_a^Q6bW^h3Dya=2x5t zbefM>z0#tI>p|B6Wu;T;IA|o>v6v^*(&zHh4r}v`3*+^|4r|P#F}_QVb=GKDD30Xs z_2LQfk6Nr0j;yJ~&96c__eZ=X_f#n)9Pq&QY}Ih^4HN9<9x^%>e6_R^ErAKrw|d{N)XtvX%vx$#R&Emt(i}mG6~wwzY+_G5V&;a@ z@NbQzdm~t)8O2hTW|f@9XK}Ehhj){^j4+6zlcQKg{IEP`GWmr*dILoOS}!>_;HuP~ zG&_)WBY}3baU3eW=RqMBUE8mMT8UAC?SOKv0Qx@qjLoLEko zDq_PE%u}5E7D}uEczZU`*iQhSS%4AtE-+ELa(!}TL96W`l23rgYVx&aa?hDzYL`gg z_Y?K940AK+HHnt98Q3@4e?a<-W;7vco8`}OUbM`-G7gB5lUT-MW|m4jW>{8l7{QE; zD;WlA&H~FcN`5W;8_&F@a=0>Q7b!wdiGb$ID`zCovqnu6U9aQ#$q1~Gfzn+jXm!PR zXUgfk{F)k(&q;v+d8k$Rks**#!@wf>B_#EZ>w}T_Jw2KFgfZxIOaQtHDPG$`qF%ks zH9A4Mn0Cd2cxedUu)6fZIobV9(@p;K5sa>hGqCquc3x;dL0$Q-I>|0!)<_V)_BYU7 z^>8)~q#2kY^B!zrvV&52rIHlJzon=ynhWE~nB=uiFch|FABdz*J228A`?yr6D77Jp zj$nSKn{DRw?P|D5#`V}T-@QGx+OpPkcV^BWm=r&a=#E?-0K^r*QyuBNiQ}9@3>PF$ zwv*Kc!&SHYI`~nYnhqtvH+XLrUq;Rx4*J~P9l`neo`j7$2RfUm_4*U_Be1*SPl3RL zJW4?V=v%UOooRTJr;oUp&1xpjEyXzJ(G-`5J%T6@Tq8*eaxuvL&%dUy&b>9-{;DTx z6z2@;3Y)`tNOJaji$$2;wpe9?2WN(w@E6o=@0qj0THr&tFi+9)jmZHJks4r)9E&S=Ii~c)aR`Qc;l$9gMB;b9yo4A zC!4nq*JlMPqCC_Chmn&g7dL@d?rK88pW1Y78&`y-l!q61)B2I5OABpfe3KiUh& z=Te5>gkmzUxUh;w=ZJzLfX=Q(W0s-g8`M>2131_f%c?3>eeXy_A}D@hFQJx{+OPSO zpQWcR41H&KArLv`R@z1KX&Z8YJf8x)hsFf1P&7kHm(euLZ;FnQ(0bf&gy%ozq`Tbl zhIs^GI=&(pyHjA3t4@iYVV{plCKZ1xGtNML;gog{>rgNwl}1t`@~aUij-Q}U1E5jp zDA?AKgB-OFU|MyaanhnZQD5+Qp{{=q=5hp{bgQjNt&bg>gqU z$1XS{ioyh$Q&wTd9_gGXH}Sd8`!(%J3=<^icH1s5NnxMhVy>JhVi9j*tXMae@>Lvc zOoxN>Db2Kj*vn+JP*acejZh28Z#psasO&mI5)|#r{kDj=*H1XdZ3x1fR?>vi%c^U4 zOJ63V2^44?32m!?M%1M6ohQ08%R?u-k-)*L(ECE`MJkfCVC0&|=vyi&op}tj;@cVi z^cDXi4+@L1iRN1=>H3AR?&WxNi70>rv5-m5e!l5>*s%;r*V^`b54`>BwVxO+Go8$a z2Un2wE2B8Gpsz-gH65eg(eC<) zM6^=_X*Z%ATW0bnO&%2=|CYH&Fps(}tZ=|L&(&|l_ZbpvR7jT9^tIzqu%wwv5zbR8oYq3{01?M9(aXZHfwZV7L-phuL=!WG;Yo;4aQ* z&*>F&GXvX@O*(WJ-*(VzSd;J(0RihF!;{1EHqq~5j5O5(pu!b@hJo;QHoeeE5RDAO z)d`M&lUC6eJ@|RX`DcfbI!`hhcG3B_14B9!pxSv#kM8|Vb9?U~XCz*~Z52*gg4y?_ z$KA%_aSKW>Lt-(pkO=wgUhhZ^?VdS>(NQlzZ9hV0i``3xh6G# z3L0n?Vfm(u2|+;X+-{=e`Sx_VZS-akfuR1Wi(fM9FE<;U&3@yFGp4`Mw(L#Qh})jL z)2`9=>K>;ZBhTSDpf_n^mN2enJo&{HQ^XPb29S5C+>CWR?^y5cB4~ae@??wkxV5)4 zR8WpMQXCuuZdIW?ZUS$a5FKSXGNU+?+#`AMz$C5vJIS#|`E4 z;o9_^rP*=U{e<|p`5-RM1xPeLn{Z~(1y(_F^7xRvZb(Ov+<^^s@IK;H&K6=rl5d)P zKw;|~RB(H*M__P2>Pu>b zE?*bT3tow^1o|_zfeWbAMo?|O4#}L+zi92+zOsqegjaPIkza%2Im2%r=wC{99HlGR zvSUNb1C4@@9sr{X;dNeBmE$_C4GWWM2Hw5~#AaGzXhZh^HJ!uA2rRu-86QTVj|ex? z!yS*ti(y)IN6`Ip45N1sNk7je-)!Jq@KE1It!L;`K<84E))fa|_HGAS!9mC3n{YQx z#=o~Q)+Qui$L|})le@1zP@Lizt(JXmFJiRWbZs)Cj1qjj_pvs@KGU;A@V+oY3+$Mn zf@_bsOpfbRjMv5j{>1 zy_Vu#do*-Y@$IQNplA4uW#`*7btjr^eazh(viEw_ z{#A`P)!ilup163HB~zr$bPpr*?Za9A$nypeoEU6K9`5=7C5pL3EVEnu^ckbR6? z`&JSlu8~-}Ol6V44b~%sfAn3z%4v`>!6b$FVQlPUukZ|g!L1=1=cv2~^ia>S6_ggo zHL|BwBK0NK>oh%4zYLagE7}MOB$({Vd<(mcOUg)S6^yMj`N95jk|~(gie7A{lcXc_ zpueW6%A3%3d4EPa&k*7T$#c#F0#FlZ;~o0RfCc)+u1#;JHqd+ z6LgSSRX3?*?z!CgMzs9=zy$BzIn|)tCT9HY;0t9yas`TdzW2Fo z$UVro3tBOta>DnyYg@CwaBFH}12eT~dZ>KevAnA65Ij;m#?XyQEuD^hXY``Gz8A$A zRPY%!Qc{_XacKmx>vb_@=;eM{oWjN+QFFFtJ<|m!H^c6qL7I3ciY5h%bQMJ(lT1;= z%kHe_BcKHMfuE{D9vFJB&u7ec`Jd%*`5EqKF+Y<7nA9_hD-BM51Q7d$EMytP9*bcdg%K(rkeWp4PX3Ftaj-LhqC+kk=LYB zo`3i8MgPvxV|6K&Q^^jaa%CUo!VF8od_>3+r`1A1Kk_8F2X4AD7XTi*YqHyS0Mr4g zz}p2Wa&gce`{de|k2N7Fj1-(2uw|t5%Gu+5LS>i+0x;RtPQ+)`TPr5{QTFb_D@V2E z=4_zn%n{fX%&EbGQQzGsZRL+RLp24>QD1qJ)yslT?n}hzAcCBBx(m|r zHuX}Z;Tc8Tvf?$&?$URl@H}vc(ztq$qsJydG*kf3Og=%kS>i z(w$=$8^{P>#rqp1UtU=9r#9OYNd(Hx1RUjd+oS7L3Ri?pnnzbNk5S*_N#&yGv2)iE z=1o2;5xb>c6dWRh&rS86DpCHaF=pP7A1f?Cu#6I%b*nzCq;tmBzKeLy0L!(x+oYVi zi^E`Qzj$<0P+_`U)yzQMRyVS71|t0d-c>JLKJ@gvTXYK5RNdY5;K9W}SlO~YP) zs5=YfdhxYA&JJ~o`LF!ZJu=tl(tUT+WQiMUuY^khz3i^R-^2*fyg63$h;Td-)@z`C zUjB4J&+DuIi@EoXYHI7=My=RDR75&ak)kM7dI^Y%(nYG2pojE^2z$5FPe1$$N@Uf{UXWshT>nMX_PhQz8hB&i_opVDUwnFzUXJBk!>{hS zR;96PBdc&<=e}|Jq{r-i06iAGWmz%#*};sSp0**0$7cf}f+EFy7eB{3`&y|YFO=QqZRm-1)gj?HfGyUM(DxHRYVO<`DbRotQhSjB>;8QqG`GE`2iAM zhM$k+8UUV6)%R5)JtxL)9~aWTL?p$XUC0MAZx-(DWa>WuublVjcd0wnUoPMr-hZdOlr zANk&1Mm_Sv^z@-zYN&h3@y&%&?AwPiV{bs(U6jq8yj{QF>LPfIv|iUs>P( zCmsqYvrrl$uYQG2*416}KgGkg)`Rm+k>LI|L%#27m@%}Ij@B!(KRJ3NdgEc?*ie2g z)#-fVaL^F!6O^x;>F;&s_$w^aaa)DMQhbY*{GDD9i0l?YXITuLIFLb%*$%ln`o71k zTg3IC28&MB!|Y=RLzRdB`g-)5Hg$svn-$}+HtC#Q5WQPM zXBlqWs2H#TC@@{ef_do+9_RoUWmd6fs?e)TqUq?-Dx@9VX;dUnNJ!y3YxHE9H^#Zu zWL^Ad8{i?sR$a?Z^9JjH8vI7E^zmxH7w|V6@M@x4&IY=YkqYb}Y|jo`%g{9QvxS%P zmLcMG00#JG;EZc}C7{suqC&aazhm_PA%`$~3YGSk_TgZGiu)feYQl4Xx^SNPTNg4| z!gB3vkr&Dfc3C?r@i+0dnVSpYLze~5uHI0_(a{0DOsfsY8}sucjmIkSZ!Sa^v@GlI z8R^vl5|bVl-{b7>cg8KNHzt2>;W(UJziD4NlJ!K<=?ws3nR9Wx52gMl%xmCKKyV#} zsy@_Li^w&S4o8SnHEP4RZDRS6-uq9~hlZf3rVfwCeb*6bSf0O?(ahGkP{$`Cs`rHHtpFx2HzqyZP~y)lcP5f3qa+p9>*MaAn!|B!hNtpJD(%-2nd+LV+=)kW3i=|0s^=drEGVxV+$AYzGLHO9jKGzP6s$9YTObg2q zOOuE5pVcmb8FLwh9N*0{s7-q42^_p46D=`@qwXrJ7r!mwvsOS6SFRs}@x+3karsQQ z_ARkE<3~Ej4lRl`@Y8pk{r>dle5I9d@-L%i-M`)H-; zClaVK8&cf2q<=U0{vz_)I?anFX8;03aI5vb0iAKQ-B>pm2L^@FM8pkGJl zIF`tF0Qpjn!m7fvfJlj4-Q%5!kQ;)mjN~Z;ca;PL;+3G8mzm+i*eZa}LRi#*G1lwh z{fQT*hL#Vr2R#m=KD~nBfoQ5}!t)N(ZjLyxOjZbOE=E+hlL% zuKV4Lf9vA^%H`eTS^EF&XDK=WrER60*XD?ARC@~$9t4u+|CYqwF73vtm-}3woQI?c zSGp}kZYTM#K_l@z-+&kZK;64nqx#)VAv$0+#@O=14h6E4x4ne|$0o@@7lnoIbVg6)>ecx?L5%;7pP!VC{Y2nip!)B` zd<~V#iV7j*rUNq8+?M;#wECdU(?pTIDD^*l#Q%3}0iR0(Ry|-ik0lYtje~MI8!bR} z!oQ^gu>tyTK6qh~y#;h5a70Gor)}n)De&3-nbn24fS?cs_x__K;f&rDuk#!X9~Pmk z`g0^s)ptAM?9*8TB`-Je7pIDoeM=B=$mVkowT9stS;BR^GL+x_Gu_!?sym*sx0_@R&Y&+L&ws4G2&vUQR3;_ zoy2YPI`Y7}Lw`i6E^&tpJd=v6xYTZ##YJ z#oGhd$k--I&^^ewQLX1Ch}Kmub@vHa6-)?-EltoLJ{oy;ZnqEIhk;!BNMPqVzW|$+ z=efO^3!YBt8GHS5rb~t5Rh@Sb{5|Z|Ju8XbrjH5j+^r)Q02pF;Q$M`mY8+UKhQZK3 zCTl$zgqit)b>*!V@pcGvyoNZ$KYz5=n!bseaEsc%ZR)HMngw8-GrV(ar>u0J0rU5 z%F#3sp$(c_mW;g>ur-HiR~Q2iQGY0Rw2(Khk#ALR8^@AnlfZ^Ab2s|Z&_twNxgm|- z)g9tE0E_kiLeD)av@;9Bs*m)7{BT4pseBcV+=<$@c`;_LP0^eDId{R#1An9|CJPgZ zqc4F%^Ymhn=9mrw=^z^NjoOCLF90=GB^x@O>(EMVrIH#FITuTpcbaUFu~m|bZFs$(z|E>ok2m>>|E3fWQcT1Wx@ z@R?ieg2Dz4eL|88)K@z>;qV6nhqX0;nOM^b~ z&vVN8KKS;XyY*J?Z)<6LIXTK8W}z0w&o0jt%k<8ke9tDybZ5gDY}wuRv`z&$`>_P`p4U@?&xjJ^k5i@pUOL4vn~Yd&1- zb9AEJ42qSnpz^U${Fb{r$^-(o^(IZfI?@IUw==6Wi2wr)l5%I_J#yO{=AQLn=ZL^5 z+7vv6K5Nq`?^ik(%S3=(j0?pwW8r4zs+Y~cLXEXM>(&VWoDKi=6l9wd6s_Ph63*;@ z1<7Sm8{dtCV;xI(m`i91#&;;#h=&%I#Zy12#Ay6By2|x%W=aNv=H(@_U8pS0YR!HB z?Uq9#OZG)k830KO4E|2Vf=6RW<=|+L-!Du#?&@*gma!LKG$JU4WA?oHmqJC4DHZKbqSOnnY#+OL5}@PpbjF)RSntyzP)dU_Sw6#)5SIe89xhKey=J=g_0; zP3}zT&cb)bee<`Mi6iiwou4QGRf<0K=ju>AfCjY=^&^yx2bf8-nE>0Xjkb+S4(vK$ zY?RU2>4i0JN~MG;)_)gNBkRA$gv#!D_z&aa|C9gw{)XRL*n`;nU78C3h5d=IwOfht z4}8lhJ)IwWST9(h`d=i$(cYZxh{ERJ>^xcNqN{w~@1p?l+@pg{Vqh2Fo8uu-QdH7Y zgKDKp$*E`0;{#l5e{kJ@C(C0U^e;iEczQBWC!ADVjTEJ-E;~V6S3B2&9jo$2iupXe zEi4}1QMs!kXYqIAQKt{050A7;PhuwDhli(2d$>1NCjl^w4X zmV8Ql`<+i^QqvYU{l$o)VVKf!a4qaHHoTo7InT+AF8*^9-yxd&kEMR(xR6YocQ2mo z?*7oi?Pfwnm4t;o7QpTzWLtEei%n1%`1t8Y`eEzd3m;49T~=0Oh3r0cg@mAL#hS>0 zrShdDQ-ULL)5pDZi)-K?p&UFMZAUGxbh+OpSgzUs%04)tx9?*5x>~I{dvC(~YvxkN z3FGveFCPP2bZrNd9!<>f-dOaq`hJ^7uzvZf@TQvR#e?Vy5C;^pvN`Fp;eoBY_YeK8 zoSsT$(fbF|k9o=iilrZya30XO6%;+m>aW3G%zs0MpKn}W6bhjI z5=C!(6MLLD9Cv(lRe|}eURG=ZbzE4eZ;Z32V!ZB6iyxr+5iSIYo^g{Z(CcW&zt^w8 zq39?pMAM0bC8c#fQfVwp3o0F!x4st%7>1V>qlLhU}J6h-M%G%6?2_;zEOPiy%Utp!oLaYezNXXPc$P|5s zmOu^ln|=B0p7YmudtvTsHoYr^!k8LfAFqh1&na?b!D zT9kigS&jOR#2TYdC~S>+ZU!6&TmLx@0zdhe7Y}gDyXZI-0_awvn%z#-m2O>E0Wg6G zzdbFj6cpMk5?d}h^&rSU`eZ=`}@e~a&*7VsXMtY2iueI#kwlT zxc?E#UDEzcCcYtPw;ZYZBbMKEQUGZA;y*2`?9W^x+U^(|;){P09Z%&LGsWSn0Y-Ay za%g+!ENt}868qg$o0v=hX8B9bMt#imV%r0PI#T`50(&5f>zVPIaP19^SZ@z0~bJd+S}-fsTy?=ipLt=jxskb8y+kifqu4(%S!*<1;pss8=#h5a{?})5SW@wU@GQly8aK47J$U`6yT|*&>URk zH7+u9>J@7280Zq-_daa+_nzqBdl#mqOf}yI1BYYIqe5``4RgsEV;^Fz@ESbjL#U?W z!`;L3cfjV-LEC#_KUYPrPJj1vO+G3#K*`n_b!k-Rx_xqKwRMmM zMTPv-(5ZIo)jE+kXlBnm2M`ooZWx@Od*d3c*U3!mABc@DuRC^h8y;N!@sS35Kp{Gj zR;{hF@Wxj@{W26+|9Ir>NLGbo;2mVO)XZ8-Vrf~Gd=sqP z7u4km%3D3jsYht5#izxR)e^F=Rk|)*u9R|tFxL;NSb9-9S1Z5r`H%|R-?S6YcBk#G z8ZkRS=cKDK3BC_Ka0{#wrlwY^2m!O+E;}J~-}rdhF`-7Wh6w@W#h#hBZ&km3>5tgO zU3Vwpmetqtx2)e$lX&@VOKR`O)>aebVts@{*>uovny>lz+)-5_j_TtEt%F_H@5nt> zF{PPbhaFkQU-;r}$t6jvVN+z@rOx~g#0zy)U;~y0%?h?Mmn8kO2W8sTj|s76Ti|%8 zfQOA!*HI~kvY6l=~r_$*WNot2NWy+Y`^~c z?Z%9&!C_?r&51gh96L@st@py=$pQ4xWYh;`tOeT*C#G4+5eZUXyL-J}O~*0frjgCc zYBqKTo}*&vhr%Yghz{I&lQQsfT~x`T9DG? z#Cs9OyISwwm)l_Gt1oE$kg2ULC;rum7FaqgSVXkirwirF0Ea41F+T&lx8 z*ltVH_G448S}acUO~Q*&UH4Z#pW8g)z7acZGiP42HK;;ivwUwxDhnZY)eI=`Wv9XJ z^A1ZnoK&R) z$=I!EIr$0ixIVsCK(pDSAa?CN5m!Hb!iCa&*z45tkzLUX1O}|WU-*u=NV{?{MD~(o zeOl${E#uRVWv7xeOfV-DU8E~QNAa|+w za0a%Vsf>w)xAhlqk9YD~KZI40B5ER2x)B&2B~$O`_#rb3x!k$=C^$dmeGjH&L76TQ zg9ld$(sYwQ3=u1Ru3Lv8{*oktqolYub%|>YuUOEA2)yRu4;sEZ89s=%8CL5q)YO}Z zP4avc&F3CyT@hS5Yc<@_VpCP%ydc=eeZaG9`Kb=S1Wp*UUvWS`6D011wZgjW5sC33S-k+FXDdwbox- zue|98o$7PBO{*6m$hzZrUQ#OP$^rBdC|Xdr_Nr#i-Ekk|xrrUIPlJ9-QY$XqpUd{! zG{#F(9QJ#6A*}FLE2ejOBL?uR6;)S?JMCf_g@O|9v*^{0e%*yS0$zOpv8mem^rq)o zQt9IlD9MUz!`axu#V>I>52n;>KuXb>#slil5bX~x@^J!AQwr>RRbG)bd_5+`W3ozw z)-Kw*)=kS*ENtj+d7rxwQX@8AQZ76QRk&R{8A?}=)1)hp`3F563n;c%QfI$pWKRBK z2xC&YQJgY0XJGM=vSrRqtPia9^Dl-o@p+svgI~?f{ zC^gvn43nK>S@gL!)4s6y>Z9jK`~h@<$7~EdHCj;AJeF>Du+j%==%1ZI=WPJ`ayef! z$cN6FsandOks8`xrh}zE1N9q)^DDg_6%Yi74(8Io{3V+U>Z|+$yEpk)s8#BcOQDeGU&5 zQM1@a9^= z{Bd2@pQ&~vVJw_rV=WiedH?>F`G#Mj^K z)f{1iyt)~d-BoZBwAV3Bl}ag3RUHUSy(|(0mojY9Ud;GQH|+xsS|GjiQ^R8GbD*R< zYbMvhoV>NJ)`e_HRA!KZH&THa6D3-+RlH7}^0*OkA^jWGXS>0@vfQSnvb5?vLU~AY z34uOHj-%0yj!N${%SCLd8z{#?zZ=S~cqJMw@rfnT#?QC?7*k25 zrxe~;dM>D{ARkJh_s7IY`_kr5xZnwDBSlmhSC8ANZAP12;Q(B}4-uUw|IF{{W?Xpl zQ@LyfVryO;#$|9M(q{;K4ITs@UH^Gashs9xUz_p_9BwPWD=0SrGx8TN@xw`=YVN>i zpq+%E#l=RHB@5}1!iFZs!;<>V*W9Asb1}@f#zULnl#|r}pNQZCm{zDhH&V$vrr&^qgoeIGg0Qx-(hZZex zUmOUh=fo}t7EkL!Y3bf^ZLXz8hTGSaTpko`6oewbOgtNGw#Z?ny0WxRaEtp5~)kyS;j1u~MCADC7UE)>~VTC}mGWIT?|ZDaqbb z*tmfc-AcKHTC%l0&0$-9<^*u$`uA3kOc}5aBHL>2f7wiQo>=^z0nb%0O_e;--+si& z2xotARSK7zRQ;9(S6x<7JG1!S=2Xtm?U%{VByfeePqX^`=T}$d*Wh%dgshp zomQD-pAvBq2#m0QBS88pL^<6_nZ%^ZEmw1c8%KSK~;J} zk}eESMgnT|CRT13VqXfsE~fw2ulv%s<9q3|FOzi7pcPXp?>a74D6D=?Viww1tzERf zVG7y*-R+g?uTbi~eHLMMdX@;@0#2}Zt;Z5mQa?|(QZ|8oLxCS5qm+ZsEKdC&&DZE% zQ~LR($}7reJ3_d>R$gE#I-*2>+jrFknfk zO{@G4HhEbA6%T1+7zDjVH?U}(hQo&5SOj_EX`eM zx-7-K`K6g}D5qIzZvS_KmwyZ$s%PYlvgOs=oNGIg0e2b_z_z!%_a*n>2NYhdw%HHH z=c~$b#PYBN>|@~nJsP*7tAYA??Vq(e+lIcJAbRQmi_CQ~0?tF^0YOR_82Iy9#eU@p z0PudHHeAsUOrut%5W!lSjyj2ni!Zxt8WrjkJ2^jcd;x!|wOk&~&_=m03S|uYegn;v z+2H%9BcXb{Mhb)Kpq0sz${dHq>f%OC{F|9FKcAYA%wyMrXOm&kK0yCBhU-dc&idmXl(u!iR8EN z5@*S`A&)5>ui&0k2Aju5vG0@xc)6m3ALbl;)CM$@@pZ2L-$zrxUe7*L0Q+_B^I*Ps zh^igIEsO`1uX=eMYt4Amk7QGjtePM$ALuM;EoFUnIzZ~+zY-UB1|%+ZStdvOU=nce zmSST1b%FH9dgln~VN?#>NsWmtwvKd}u=Gjz2S$x>$;(M_og~P1ER#mK6sVSx#iyj>m(S_%?E3tOjlx^DQ1Q#P()Bzs z2^F=J>6GNJS-Yx=6-TaJ%o0t@gwd-&`a6Wg9oQ8)$dIw6pFO%~h?%{Tc>V{Z^8L0x{px9d{+qAK=%5?q#|e?d)D%2uAr~1` zVYs!yC485{$`|-(aDZxmCM~*6|jb=wvMs{}p%ulTMou*PDA(XACPhXJpVoMDxIdogPN?ENb{Re-a{YppXl~ zn((1$GGCd}+P^O6bs56q2V2A6<#C4dt3(lSoU@Y>vN3g@8d2TFXrKXGEd%1y?q7mt5O(Q zw06Oidd-x|@QlusIX?ceu!66OIU^}}MP{Nho(n4-Mcrd+yt$D5-KIahf8KzYmX2+Fp z{qmVFXIz|;qoOo3J&`JhSeuWdt_)Dyl==_N47q2FZ~493aM*UvbIzslb4CZ1 zkgt@|=O85B_PNhJo6C#%!o4JqeI^!wCb1HG(wp9Y`<-pYYY#sjBOlWBt`JG+c;oBQ z=p3e)(PwsJO&I@5j~+=NgW(M-D6aqHM1S*m(|pI*tT8KsvzEx)tnrrNw+4wB%k450 zEr_LGl$j_|weU?{`^KA<*k==8Qw5gBqK~u~UGFaBZi#n6B4wqi!)2tM!KIwd_f$y& zN-=gVrR(1Jjz%a5WrLfT9qugY)Xu5{S$}2Ds61@LT0dDrZG<3QXivk(O;l-|nDiQY zd4C`#C)I}+Stf5JCRqAgC1x?~ts6V~hvd<%qhV>SdOb}7k2IgY%4}+h{t+i;8H({A zHC7XtYdLxx{RZY6r8TdK6BLWFKNF?X$66wS7;7Tqzd%|IN7AERhioUBy&P^@i=*EV z`qrT+VwzflGD9Z2tC)-&4wm#hxuUM6+ctj8&DUbG4Bj5Pk-5<|C%pZRr27nMq(n(s z{3-l^!&QH1hHr9j)!pA!IgBm&uqK7V?C`VJ&lqeXy=GVvWjK|LtXi99I1aXi+Zd1_ z?3(Z7#9*&huM1$-#Ve1tcpT@HZ89f2FCyR66}w&;66J8SGvy8fM>N8b!a?Fi_p-(` zi`2bjPz_8yW9iXr%Y69-0_=R9Z&Gd9_2X0*%2!b9bL=?;kq*1cx{ApW-%OwmR|}0> zo4W*#+;xHN6SJ_=JMi7ABUIJYdQlq7F_U*eD$I?VubL1q3ftjWyUW+4Sg2~Z7!r8& z&XW&vb0~APZZa~0@}~4|XFhM`8g4YEG2W9vaTX|JpMXjhMmJuypk8BfJ!Li;5 zti{`V_F=3{XwPS~VLYaZBjFJckiG4CA}l@KTnv98N~=5PnMCPuRnb&*6L<4q_%_|0PZ0%KaxTu8|k0LAC;7%jpTB{6 zA~2i5WXzZ!`uwtgCS}Dl_=8a!ug1(#S2k?AaL@tm^)V-XX0n7T!K{X?hLBO zhZ>*jQndsjYuoONW#`f(G1>knTYbhs;CLvD50@H}QW#F&SgBFX@uEbO^ap>syx=xr zx|nsaP-3swT1;Lo*UNiFHWfBVlQ1=@H+k>Kp{++zuDXXsdmu2rnqkZs z2Q#mQ;tW8{Lqo*8Z!)vAeg{9nKWxXBs+GrIx5P<)=8S4h(Eb=@6M-F*ZESOJ^|WhC zG-x@r#wd&t3+rfX^x2Gtqpo`#&6+clM5T+GAyU+b3#I24QKi9y{qVU*c+`_*wxAp$ zDyGGb@{`%~HGX!GKT&f`nzLF2Ivv^)G55)}vN76l<6P~yIzG8&tW?H)9F|mvSJ?l1 zSpe4Q2}ZPGy7VNc*OL!Y(VrA37uDLP2OPp0qJKQ@dz#Tv8me8KIKILT9se%7HnUJ z9BnazYyGq%Yl~u&*H=96TGqU{yK^CfJ$jnch6$~;By~4+mB9u#DTHlXw|HlL0MJXn zZll5mO#SyS44Kcq*|DGpLJ7rdJ=Xm6nAZzxVtFnosh*0_t7Bikooyka3h``=^*xLl znAdARW(JNl*OZdWSLQx(bf%w0^`dSDO0ZN55Y$_p-}5;~Ois>AsA>KW@mW0%?BzZ& z#-5QYo|QkvI%ygQlzqY*HIr(cN1a_!EEm^0luynaWxCE~>qN-lh%SVQ$s}cGo#?5_ z6QdO}TeGpZrMtO88$BF)!%ing-UWcw0ZL)#lhfXJBgT{0eE7nvNfe!Z|0zWFiS&LG zzFhJ!^ij>gTayP)+9Dr2;^UTAz7I!5pxEz=Tqm!O-`Ke-eJsPvlO{N47NnXJj5Fe` z7Lan|zbzpo)%E#Xk%4=sD6E|!Qy{FCpwQ9%wz>0O1VCMd5X$C}!`Ifa{9*roPk$|S z$NpS{*nbH5>)cWB0VcIS4hU9y4Wl2)M_+6exv`)8x66-47_ctnR(0izn+hSnY}#K_ z6(Az;NYB!rwz2p*N{7>wS$XR`1OIpKKTLSwEWH*lg zfy3ADwdN*X2AnvDYHmA@6gRuMpm;puk)`X-Idzv9H3G;C|LP$2vGjhhOGb}CMl8La zD_mJ*AnrAACydq`)k@nE`NdZEPv=M#@_FAUo3Fe*AJAxz^5z}Bz{JR0j883E5%EYa?tOXcEGsRl!Y~gKz8Je9L58%wPo6kmE)|9=E~{^Z(bcs z4+8<)gG%SO301jH=(#u+vqxc9@i&U72Smf&8JOTX74fMuMh+k=y@-~p$p~T4%<7`r!O%vU;!`YL8}-hv`ozu z6QAEDMZtaXI$}c9lH?OBZFLv$b>B7DWKXIGipIB9EnM&{vEJXwav4pLT#QC>9bF2CG9E8;X3lVRm3 zD2JS9(v4nw9L(gN^t_f<^#W|@(-B?HHlIneAl9eraI3r@E5it6@v|Y@V%nn$S!TN* zQbN{@Sms3Yjk_@jz9#)vU5o5x3=|RELbCR7UFn8szn3xQ&G(V^NEAzDGUN?~=D(`j zcCK>C;IO$m1o>LHyi&#NpB7dJpLQvS#+s*ugP6L4<==X9hdT68lk@Q!RMEtww4_Jl zya~82`6oMaLNKSJtFcPpE62N8N0g^)sjL@{q+Vv3tGLK1IqA_EUs-c=m`=l8E{}j| zn0IWxAA>j3ETT-+hamKguNO^l<~tGTggJZ6ZMo1?&BWxx%U7fv7QP30V5Ww2=vN$6xz^<&op;&83Lo)o1vPw);OU0%=I-Xb*jy(gyK+Z@RZexeqiH%k`b1jFhUye%Rv$BMhd z6Ri{%%s21M5wX<-K6@^rw%xTv7a2jH$ytcxqKn#@`$amA{ZGW1-nw8xzwO`#85lkz1d-Mf0As9fcvCuTma;wj+wj zk7`DGF1=4LXbB(Uc7;mNJV!sy$i<<0n~H|~F0q9#2k?cR-WaG+EgZVsRho({f7^2_ zuCjIQk&?N^_rzjeIeVOB8=36GH!5gYUE7IKc2Y!k&ohNgv`@ubP{(4am0>PiSc#6{ z&>XM)6c(>XXR!a+Z^9WD%Ixz=^f9QjoA5S|NVJhd1Wso-DtMEPEw z@2XD?#EAmOQr2*>>kmQjGWhn&H2qm!A1+$#wxmwAP?>hkkx#2-n#Kgg-J8W=g_(%9 zrX|$r4Gv<)^9bb^OJ!gD3WYWwwrH;X#XQxm@RUmlH81WF@9oUntLz$2&rpuSY4Et# z6pqkRE+R5Kw7d(uQ}a$cTMQY)Ft^quH)u-3A2c7<@Dyq#+p?60H;OWo+TMAEySR9E zr>2AalWPYY@?p`1rPpP^9wKk&oyAZ`72c+G3+*_CWx+j{ttIeL-S<)6N8C18alPHf z!-y1*>xe24v_MPAzqoB%QLC_b!@gx6ZG-cEv3%D86WY0M41Q6$wkWV-7{4;D=;ipz z_Ylpvf_#X)8axLK5=2xj~-gJx1ntjv13k2!9$ORUAs1XDFcXEhwoev2E-%o0{tC11kf5RURP99{^@ zN|xM*v8|0JMQ_);q%cBBS75(?eD+uW3qevh=na$xllsvYv+CnVT#^#EEq}O$vC$lR z9LIf|Jdcy_vR{zlgAepT!n=a=u2YnAkGfoGj^f3S>%!975)I!~J`J8(icrWBeiEJr zu>&nAe`a@_xRhF`{Mu8~YrVaR>>$6X7JMDVgBR+AHn~T;{55nJmxBs>$Pqglw>+37DQy(@Xe5mn$EEpAj~q5Ji$e(4ZZv`1)iTH%J!X2NVbpYDyF zdSIf~`LPfZk#oKRU*^M>=icv;Tz#-UUR8^{rf|C>6k}{G@@CaaN59gIE)!M)Q5cPP z8M~bby$rs){lpji!V4_zHrEi@a%z(++9Ut2y!wQ(2xebjV=)t2fl$#n|MCd07<^-; zq)Wb?I}d~>Cg$ULWS^_l{%kl=Z>>$+3K1?mg%UotFDq(6T1b-Z_L~z&TwhM1-5~XE z66kULChp)HX)Cwx_+FTb!%HCSZ@8T9b?(vMa1!y{HW@4KJ)FTGVexFH*=o_pTI!5o z%qD9$m;+)Px=i1oK zkjtEsb?4zImv_#GXeX@6exXIfFm2fD(!q6Q!N^S)r!jhOoqYm(v!?{!FlubZDgT+% zZC=fJUDD~WWq^~g1U@}|{8vLmXYIhzGZ70RrZc2G{0XmR6R!J$ zt$~=bSUg`feUkoj+F_=%1JYLn()dgkLS(R`?%+)>%%+nnInU#o(xS*_^LYub+&S*cgYMdDPdm6610?I?04)o_X-~OybHmd1&SMiVZ4n zY#vFg+g8SsV>eypEfr)m1zN0@^hK`PnGQqsEX`TQM7S|mB(Hz(7b{cE(N^~pe0Gup9^ze_>vY#i-8<16 zk)d;Q4PtdiHSUgXRyxSWFfOTw-0;Z9~G{xH`30>vQ# zaDv~Dmgq8)Yf_6~xGj9ZF=Q=fS{(IB$tbFyv^M@B=^hHb5tpy4nda9&TP!etUl#e= zdP)}S+S?y)J&0{k{_@AONb_*wLC+6AL-P2&!x>eB@jF9XD9F z81?JSB*-g6D(o4s;Q6roTRYw^X^r<{{N^>n67*;gOx1 z`^%W+p%34#S$=DR9$iiz+jREQ;I1APc=u5Oam^00a?3~zrf5u)tx#bSl?^1Ocg%gc z80@dVwk9f__d@lVv!%nhVx(7@kFmW&1nXw`H4=`slaG_{Qq9w{*;Rw(DWRbYFUWV)}`Hq4^D zyTLCZ&7affa@?wC)b>eqotIM0H@V>>%gVZ_V|ALkCU|K>c_NI_P9#$9_9b%g8m4qp zJYk~^mt$Rfu!^FA1AS`WaLDn{0chLcfr^5zg=6kbc7qu|eTQN+`zAqrsk*4tFe>wO zk>8t@6F!I#RGL}^PA#(5dawZ;#}`S)udMm-0}1w?H@$xQbV|86% z^yVi5Wrv2cssbEQN2zeqeeH@teO^4ov^0cdHC`9qlcpa2Ua;IavNpvEpE>jNb&*yb zJ`_*b?sre5XPj7jp4uaKVTm<-QdB$XO2rm;7fy$zYiRQD{Ygn}a6K;(9sXp!sKI^U zCf=G-#P7HHq3z?4^wqc-yH(uk6I9MYmeD5s*)Y?API^c=AB=b4?2OK3RQ}yHt|h*L z>txm*-gleUW$=#4QnDs4s)?%;c@4dM#7{A8<~oSA-qm(M`dwu=J>uQaz1I4tIQu(# z<+-*n)gflFc(_r8Zc?fJ=&Xy~G3zzTVzO;NR8RVmWeHV$ zkeu3Z+WP2VzU?(cloipS=n}42SHfQ@Hmy&#MNHb&TFtJ&qOovIK#2GtD#R+{fxBPH zpwi}{?^nKlVz8kdlsm%Ad)-#;Gc~Y;S_}7l4zg%-}j!(cn-4_tTy7R7_4%65PdcH`^>-Wd+bXTj|(fI|v zK78E?IRhe)UNt0vcOVMdU5O`B+i`m7RE1B+o6Gfea2k|_+CQkOb;-KNQBtwMkkA-m5+dKxv0j)Cvnr)bolUNZxz z0Pm?cY;&0OvvmG;_74=zh(NZ*x+j>=+Vxnm1(PbOFj72Z)LO4l_TR&Na|nAh!mHCE zk(j&`NpCIhSHD|w%U3WAmaqM-RV#GIrl^jqxm9L)@daf^zf#LDC^p7+^ze+qYA2X2 zihO3OV%+bZtLu2^MEpB#)9Zumw1L;I&*hj_=djlm5StM8#u*X9TSve)=BNG6$#99a(?45o_RX)3%0_9`eDza#)LZ&_ z#$f9$#ENd(AnklrpSvo8%YT-xA8VthQTb!p!v8LYHCWa39R!`-k5l}^hhn8yc)Y+l zOFO>>Vb3Vp-Q+3&SrdP#TbA-{`Y?@hG%Jzc+MXgX+4}Yq>}oS%F>D-yE@srQFb?T1 zg`}!p#{joP@gdLedVW-+`Y>oKmOdg$ikUvsd zX!xvQp;{zqH95g_MhpEJaafMZH7%!pq^b8? zkNdcIc9qaV^+nl1KDrgb&;r)X_1lL8jP{Jx;b5i?uOt6RU^n5!1h4~gu<-nDz{mXi zr#}t@ek(n8wO*iTfm2dY>Oa2t55LrI@bM!7WV0q#k#*iPA`RD$`zRx zy)E1Sq;!b2lgqnS`l^kQP+OyXX$2~#^THFNi1n+WxIxi8rM<3oNCREj^^^I@<-f>> z>;}5OC47YVmoqp#zC##MEN?N-R$V~grua)AE^48b?430>*?!H~_t7U)ZGveA4+K*^ zr#p`C=Ek65?5+Z?<+J(hGMRE6!h9Ujtn%t3l)MAK=UD5=-rXF!)BE4*Qa?<>-lo+0 zNZ>o;6^M(~XYf^o2u&HC@xgc{ZSF~)@UH7)_&7H0k9BJc@oH-Qkmuz#6M#3zZN7Uz zrtfwEqOChyx^>AS-KZ#meYVuT+WKZ-ugvvjPeYKvpu7(F#ZCo(c+dZ0?!CgAOuMjA zof)xUM-5U{6hV|Ky$vEF(m|>~6r_eCga8pjMgf%?Y0`_*YorreEI_12YUqpv5+Ec9 zA%PGA`_-BGzHk2jy7tjN*g42S@?LLwp7pM0t##k)en@y!52~nAxZTU|@sU2ktUljI zUQWM`ZV(A{k~L~USc)cRUvwT>Gx4oKaelK~%=agB{=pMiZTE#$k&bq&@8Z%bKAvXF ziZ?kdNh)Al6yCRNce;59<6I0K1uSIbNk#-*Trj=}a-45c!{_=4v@BNa!E8>M3@Lrz zoeHpNDk`!gC#TCo1Fa|NCErDhL<&w97yBwiZU-DddFyP@G6I zh1q}fNQ|I9miGp$$sSsKvXhpcA@k?Xug_&hu%S_!IUgR%ZE*q@?0-j97&hE_6q>LW zqeo5)c=2Q^Klc1*AD&8Wm7=H%SM4bzsvswD#AsIDqj|W>x%2cojeM{BffZYNbobu_ z#5{TrBF5^xKl;Jrbszf0hsFeo2NV~V7n|`UM8b8h}Wq8vWMGYvIu9 zTPxnE^##F`AsvX!8EZ*yJM(zLuqNTtH-#m zZ2aR_T@D=W9%<)Df3Ryo-h?h~RYh1l9#dRa4|Q{l{TIAYd1+hs*K;66lyhbUGfSo> z!1XxS!t#%I`L7QElUMRh3=d)zRI)JDB-fIjdVmcPw5tPq zLg*xIb=n^siNvVsYn!KL;5a}h|_hx3u&k~!zP=HN^IVwXCL_xS6z60tSaw88=P2P z6_5Bk2m75+6B%hkw*Q0Xq!w$z$19AB$>4$Mw&LSLAr7tU-C8ip0gLei4W(h|mUr2j zLGQ2mE;KlZGG*dijyq*{kg{AWub?D=7pHhCAw4KGaqM*xyZErvHU6X}>-5}MX-kh= z^&2u`#I+p-dnX*7d#yX6ZYaNMo>VmoESZ1J4gmLfn0RAW;RV@~1(MPz#Zr5`IHMc7 zS;juz<{0O56DK8&1GgX{UjvlW{@-u-5`^3lUWiRX}L`YQXy5sZm90?e?kv`nQ>H*&n(&j?u?yq z(41-1S6`dbf_=wa9j=UpwNgFyB+$j2NeZrq;CV5_ee`76YA^qEZc?nAy5&qe{g_(V ztS-(zyQGWY#hboM3A@!&7JRTErEG92vHA$Kye}3N_vl7O(tnrz4xnb%<2{XL&IXoE zw88RJAU#>jtYs{_9w=_qPq{8nVHU2}`BDO46oduaIdm$x@byv2FrVsi>;r8h{>PMV zu7WaRMo^*Akf{7x6qmE-+!C(!*gdQ4)R37i5x%5vcA0CS^GWV4)GeUGi@DaX?#16} zmK+S%qu18|&xpTqHwnE%Me3A*a*(EJ=|N$Cj@A$v zr54$|^VhY1m~dXioF8nPF*4KswdPKmq)#&hb^ZWD_okRVrx4xIXE9r`KP?U|%wF); zfUyg+MbeDNb7P2A*gHaeNzwYD{o&T101bhWq_d>TD;sxj%vV_>*UO_dx@fGrwZ?!fw4NnMW~)B!rT*rYMCCZVEs8!R+|Q zl-@itnGkM>Qtqy{OQC@|~{Yf!*>s}~PPZz5&Ot(Fouv8lts3mAKk zGM~qB7k`3kKZB5;0Q|q{&5q}}7Ti60`gj16Qs0B{)#{ZWAlztzR@$!Fj#4A|S1nB30icpL=b4h0c!=&jKRW*Fjq8{i-rs@2jm^3PEW%Arx#OiY@Q~_R-IVDO7d{Z!`MazFZgJ zX70eqw~?30MsLe=egd}wr#PYrUnuPDwN~Zjwm%G=tfN7#c8kW3r6ga@AJgDkua<(SG-k$!#${?Gn(_OZpBhR!pLB7TGHEL#W~DiEk?9iD z?>GI+K9ibqR8S6J8xwEu=lG)V6O9Axw;46VqYqZCj0MzwxT;&zNXlrgC$Y0;YBtAo zA}3^y#5~?>dSKtsVXg(Y#ps9A5g{^Di2WIz@6Sm+#eB_acd$Fho0Pa8$X@-y<`C&) zpWV2eBl-uDvR(s0@ptenkVG5-7N{*ivpcG$Oc zD}x8K^8&j2q_fI(!UlJ+yJFLKR|Pf>lm?rh!P+SLq)wp7dOq`v1ODa?UB{`CPk-W( z4oyarlE_mI;NRH{4!6gqi+fk>NV^+~z=`%^1|iZva1_4j1k2#n*Ds$U_4lA;R9dPZ zs`s#7&wNeweXij#C%}TtcZyd$I!Sh^6A2>n5Vs%rc`e&dW zwpRRBla-XdKdXUlpb7+W!p)g%KSYCOhOE>}r}+=r`UAF#!<>lVs}66Zv&D=*vQEWO z39*~iOG7>x8y1%)9>}XRtpg-a4PvgILR-k5 zFeIGtVWUN&UGbishDa^<=(R;Ds3dEPH42r34W&jw1Y0Y&i4oMfmhJh?U?t61MYNlz zrYp~M&iIxrL>LXWLyL27TAoJogf)l)Nv~^3nXbRc zZL;K8r=@Z(!C|pEnn-da*xx=#-11Sn=hWD?6FvXuyK%-1`&zb)o>w}K!RvLjs)Ue5 z9uzPe+$~d--#)=pG>f_!CmbB1smKX@9evAgB;!3ZuPDve55hZN^Db1IOji5A0FiGN z`{3M;r^&RWPVtUkG{At&1#1F(=UdYfV@s&$*JV-8Xd88JI;kNJf?<^5qN(W_EuEB6 z)r0Pw*G*Fy=twj|AZ}HN@au2vAz))a0973}#Erl>_0FE`$E*G;RdaT~$Z~X3nOfeT zcP7`FRW=fu8a!x%Mikb2ww<>kHZ)V6tm+pZL+xG&xt|K`QA=6dA=$Ie!`mtWCTEBc z1=p9!v#~WW!|YT9aI=xltd-e-OW#_S*Ij77oTv+XBJF3tVzb1#=PD*)D~t>MQKfjn z!pfTg-W5a{W^pUcXQ)5p0k7+A`2cTh5p__86C}To%J_V0)Agc;VYOnIy67<4A+a~F z)IkZQ(D`I$S73YWFMM;NuBx)Zo{C&JTZath z1hIYq!+pqh)y7vhPJv(RgYuVjAO?J4UprBHuZ%Y@f)D8v*}g^4uOQBn;KK!lwTw}v zPMTUExkM`lf2r-_qCkIKM;~qr4 z-TX252fx5}>I_CLaG)46SywY=P7#tq%d)fk7}R0+h20V?>@iefVIqGXt*R-4w@OX) z8Y10SL#q43r)Ot6Jgy@^jjFj$kO?j)9ZLRMPxD-qV{JH;B4~AcHsIUDHeH-rVrCO4 zOiis<%L*Ho3^Xd-f*v6kMY7`v?_x%BPeaE%% zhMi5&9IE&ca$Tc4&ETiev?0w@bHN5-PTL0ouJe+>I z#fI9g%Ug!DyOq)dF|qwDZ)H!&pEAnM+e0D7n7ZG|GnSX(8(rvDdyrtWut6O^C2*(61IL_<*4VS2JrXS-%rCbW+MdyWhu@*+uRRzG^~ z?b}Dk-Tn~+)?r60hNGAN{744OTi||!gGsXelQNa9Zi!`9*uk>XR&Bi~7#pzda8)s4 z^yBlaUm7Tv)UQx=-FU$5n{D5d0k(;O)K*xu=Ltkr4kVBKI#?uksUI4c&3D9SDpBz= zpFLK|=w?nK(%wo)mj`vWzpCYhS?0ENsQu9HVCEhAtI^*@NJXMu5Znx}v#?Q6pFclx zv2qGT!NHF>QscwKa3pJ&N=M{bujBsk7ESe?wfw3)CPS?+%b`AgdZ@`u;PxqHZ}As1 z(8yC{qWPIVFPs&brJ1PD6VtO*^ z4DL#wL~bRRu|WP5iY`+OkhZKf;=|fS=?j;!d*=J&C_)>t5{0hKJ5V#1tfK|hLWo6y zL$RQ^z1DWkU1}*7%sOZ1&VY?OyLFitGv7O|0@5RN{oLQ%c<@mlZ;V zfdTJ-tU2f9|E9^4owXcE2H!sz=;aybGX*ng-P++S{Gl)(w0$e%Pe+xQs+bDOrcWniJAw2FbwFlmEkp5$JO8vRGxm2K zt8A(h>z3w~SfBY-xuX-?toNykmq++94~_QwhWHw+gih@|9aVHEF?jZ@rmy@*qr?JswsJHvJjRf2lctCVa9o15o|X`v4~JO=si8*r-;9R z(x{vQgWLu4V30$j!=za-KEEQ)c-3h&RY5}WH)s_7#>IK9p(EPb1wAlaMto#MtYV~Bw|%8IFVwqb-3-O_*b7*xZn}Bhbdg-M3vN&TinebAaadzxe%g20 zk2h9x%XjrWb(E*G8Uj18m6!#);dyme6`0;N~A^R4u8+i!G&TD*E$C^t;oG8n1QZU3F!7|qG{+7O`o{N@Q4 z$EQmhtI!NWkC}#qdiPG$I)78LXFW;P@Kc8UMl46qoMgg@rx)_Q!GeldyK7YWu&>~V z@tjK3G5z3Au*l9K|Fpw~$U>e+KB+)kUfHI`@O5Zki#AYplx)VPN1{w;`Gb9H6mh0d zlUPV7T&W?@9y!AQE!Qwf4rw2|ye~oim=lW7EQH4wO$UaCxM!WYcp_aW__}J!(U0&) zXGpS=o6X#Wx?5<&1SzRmM~$JWoAzAnn=0hs`Ae@_OCP9_iHLI|F-77FuH`IC1_gXX zF^cHLL^h!y1_ry0m4+HW=E!#?i=36E&(rX_$HDjThP&%>ZR7?iQ8`8JlYIGPf%0Jr z3vma!=~S_ZFj~%3WXus7-{;ITirz)y`89>19ZKw)C5c!xUoZ7kielBC!kZ>9ULvV< zmZ_%T?6q%61BT$j7m3C-3hnz4^0RPV_2y_dOSkC{2l%JxZK3- z_b~P&{lbS=1~_@pz7O|);158ZTiLj`SWB4~vHq5lwEATKzSLl#{&VNkltp*Pulvfi z{w@ZQ4U}!D1CcO3~}|(pgY6qa$i-@y=eE2M$FDM1(m8XAtiFi%p={gwEws*gPG*F_y*veGCT`Q;TX439FsTYNQacft zN_Hh-N=^E@kDi`>omfQ>3~;;sGd=NZr=x-#UJ8Xa*mj1y)5~6w<`4Z4K=75)0dUEEF1}9D`@Y zjuP)pSO9E`;phpso!!K#6<_2_fYnR5y^2!6z8slR5B**CUxVjylK)=h{*gy_EiQ9C zy6?Tl)>|!%KBk93rArr9Yo)~%9G*Dj6v1VEJ4vp}`>Si9TBxu)vdM7T!5a0-k9`F6 zAc#;XkkTP+&I{DqyJF7(#xE~goZ=5J zc~mUUf4|A_VQB|fa&uT^Y*nndAo{b(5KtUXeRTL4&}Ybet}?w=OB~;QUiYNh=`m^O z>&T4b(YA;E1)-{QQsow^g*ipN)*_XWX<$?|hyO0sa- zEvF;IXiCKZjH1EWz1l45!s%Gk{?}|Ki^}YJn8}sMzbIdt=f730#hb48HZqCtzD}5| zLfM8B{;~vrQl*-VQtO(o^yj0#Gw*_ySrN*R9@y+sNXs^_%PVxLohewXJPmw>cZ_a;ivbz`#+S z*D?0fFA2yog;?BtTP64a4+?~v>`Y-^x!4d0-w^eobci}nR|;L_tEm-!E{il;Pj7IF ztrykWovZuuuc|K4{A3WO#TwL?x)^@))}bF?Zpjw^bc6rrH`^_2T9#VmA*Z=BhV|uW@WC&$f6gQ}X$WS?%By2Ki6zHs*U05&py~m`%Za1OjQeLxS zS}Uw;`qucp(xBr?hWh1@yW7gtViCoX=7{RhCVhL^I{bq&#?-{B^3sR;p<&Yu+UcGZ zR&^%qyw1~ORvzU`L+kiwXOs5Sn$Dp?y^wZZdH`I%a&`(5XG*inEOz<+)TaZSVjtIO zk2;H>3D|d#5yoW1F&}qO8nX1DJY46W#mDW|s0*ob8F=T~?JOdBQ(L2kq(* zYK6<4$NU;`?Qa}b8NS2~v?SV)-cdG&hL`$ww!tTFsG^l&_Cct(9~}iBNHqI=Vl_v9 zH=VhA^t~wYZaU7+zGd^KSPHsp1=~;euwlC-kY9Zzq*he`4S1U^U6?q{IH&Jxx`gSB z(w15K4tbACs}1F=6TpLcEHc)=yLro zH`KSc*ghoQce~!pt9kKVzg^HxuL#A!4(^Y>lGYsMEszT>DCF6Etl&KC7f=yHCk4*q zPC99SatT8qT0{}F6|Sm~zHKgzMA9!2&Kr+g+h3=)cpeR%cI=m9MM}AFa9YUN9caFW z=t`Me&dXre#0e60A?Wz76OXYR2-$mYuT=Y>-Pqn#0XreC|E3|B`Xtr|Bg zD4?JA4mC_C$0|A`*5=e-e^v9nMJ{_qr4z5!$67*x&@Uy+;=Jgj)4d|f*cO3#W^#70 zY>~=p0W2ElCyPiXTw4*bD`Eysy5=B6m}a>YEW`;kJXHma_I#=9YX zJw5QV(811_6k1MUdHU+~T&lNWUHoGAbIt;}C;=O=J=F!~zK=81+{G;Gtti^f-huUV zGPh;UvCHR4QaQqFyRVq_v>LuyWcDkliLj5;a;k2@6EF)-u|^fI1_(0N;t(TMZw%9t zCiNs#G27Y?~+PU0z5r* zVqHnY9hu4s_9}nJxDEOHHFW99-2h)_IPLv%5pyU|YOJp#Eb!w)@D}U=;^Q~)g>V!# z^&4?cCo<6spu79}sHJbO5x1?GbE2)UB=k|M1eEY(v?LGsrgz3w)|!$mkX26hPWGTQ zNa&ZCFGmP!EkRKPqio#@mzBjJ#H~$i5m`_LXT!>T#`k%3#R9Uc znEIV*^5bDrVXWyZE!z``x>95Qpo-V{+=GmCM^`DI zBfo3Ws94F|X>~f&Axhq&m82;PkqY$?GFn_ zAPAp#EWy0`E+udc4)W~l_&hy1d?iC6?P-$~{g-m~SCH|uiM9k8^%2mC!2{Y;{mAk? zqs|zqbM4$Iw%>H@ik7+C?|wXR*Bpl}t^!^2ZSIej%xm2a$>;`Im<$(u!o!nSc}w}e(UD`6YeYh z&=2TUO(Ab&IO_;%a+fita@@pblBP0pz~U?VHQ}&WJ!?1e&>gw9?*|IdqS%{LiGPyv5h$(U)qU6oLe^$SKd=0ogx@d24=lXTX&J_Af{~pdrIT`_wV^CqkH1BQ);hA^C`ao6>*iwz(?U)8-T%;GDldyZ$N zexrkU>sNy`nnK-$9FPNzqNs7DPV=AvXPic>gT8uOPR61yTz#EhoNV`fWL@$|VzrD# z%t*BHgv59zjFO2AVTffBM>KhGgboWAkoA3#&She!cffo`AY4 znAjF=JN4`N2>Qv+ugWrb@keTF4&2+Pm@uaD#|?1z=k-mmEKrT&M$qZZfbgvm9(2#C5apz4@B*T6;-Z zJT-A#VvYDTRH2?!l@?4BKoR3fwh5I!xWjXl?!d}k>S3AD#hq8el(hoJYrhiILVxq^ zjv$F8=9;oelsru;Xeu7*e*J3V-U{^jo2iB_R;GR|+lNdqcQB>_&M@7KuYcm&sl8O4y=xcHWH?a^&c{ zA88bz(l8omQhx;eJC!@wT(ZTQz%bMVG-dyIGf4s$=dE31fqwN>U8= zgGi1YDX-F$YN+f>UC6{i-FtR8rm5|0Xyet>JK8eAy#_$@mTv%qxHD~229mQh`Qsy z*Hj5IZgJ?dBL;Ui(HU>zn7)A3m^^^l^%>)FFml<45A z{UvW2URGCi(oYBl&d*LtxML=94r<@j))5EkWy7SZ79kciHyFGCosmcBmECl(C8ea` z2_e|RtiZN*RP2usPku#Cfo+3tX#M7`s+A}(8^aiHP6=vcZ<*T%1uDs`u+~Wdqdm# zFNWWV$GEMsJKv&LIzo4*&S1y2hAzM>OinB*R;;*&7wU$!WcS4%VWpLA@;uERNA~{i z2LC6~h&-8&JoebgdFD5u%=9)$TeHodHikcB7`cUe)3U7kn||QlxGG2&BLcN`rghgATd>=OE=+PHRqIVB6U? zVcgEcj(Z3_%z6U%INdL5c}9EW$AIU#HQ169#uT!gywuUdBvLkJ?|vMzGJnaPc3J=8b2ukZ^Ixo z=(EWws$kc}?O$L$c43Cz>iT4fS&P_0`@ix|7hJAC=w<)Ow5bEPmkg)#E$|Y(nR2};*QLG$xj9kR3rtXzV)fzEs}1)gf-WjAMnGP3KgwQ9 z$H3lfKKIfbRY?zB;CPaxI!$dqkKAY^-qGlXhzI>s_& z+NY+VkJ4W{EFA1XGkNx@IFK*x7f3rd+gH9nwCbNNQ9yUX z(65)(I_RaP=>|U%?#xHkL2rV-k0ZYBu`a~D-K4wwAK#o!VN7|>(47jP#pLU>XBLUI zmOUwrZHVj#HAgm$#ahovgoMWI@V$=I-pr$)*>v?gyPC7SHq9a^xv%Pzb@v+CIWO~y z{VSKM=OEBRLEG$h`bfzhG;gTd0pCgZ;%jL;!;*3GaLC~hnQ-?hw~wWSKT`n3BNKrd>DsuA+O{Z$KcQaE~#{rnpC)gSZ0aH)4&HOtt{?-sg-;F$bdGV@`T@dZGex z*YsPqd_mj{Vy@5XrFI8{E#*VRrA!~@yF!|A(>I5lWm#{?#N5J5$sLr#p4zbdf!`+U`WkXs=8!G< zu`TF!vhdYuNk9|ArsDnTAVwfN7^d2Qb7YL69d|}FWPG{F+No#{JM(PK)lb`&q6b4g zNvz!9oR?7a2o&6b?_z8L(vKD=Ybq1f75!-uW1LW8eI?dwCS=*#(EFY;YVO$FO}M}F z-~@Xid1oh_T^)RbPiO5WqN!>^W<}^2GmaoRBQiZmEl^L<*yBCRv?jDg;cYZ6r!8B& zqt`Fh^_7H#HbM>e@_wI2YZ5;3K_Z~X=%~n_H zn~315_y(>Hx=1&?wR5elYB^q5=1wcuQ@cmAl(p9Fr*?@Tgxyo2*XtPqHOi;x(Ol*~ zePc`->s151s#>aejr)GcTE3LgM0Dj2|JkxZodRSF!V^5tn5A8M$EO;n^`^CWaBVXB z%W~@8B>`;ERVfn2n(jedpLohy_S^eq1nDWYKCw2@Qco|QjEs^ryQK#mz|C6qlDkyH^=(E>FWo6g8yUibx&eVMcFfMV1Pj?N*?FpkuDBp%>BmM#qAL(~D0lWT zN$W%neaelL1H{dsDSc6IskX;RIAutnEIC8FR>)Df(nyrB%erZnMrrUDTG)iRSH|x! zDmS0Q<;zmWLYpTK((wPx57L+&uq(KiV2u&Xs2jm<&`XRE#R8FEwRa}SAiH0 zWok=SDzq+OVle!A5J$hPVDDHmSzUoTSAA2`SMq7hl+dViC}+#pav^h4hDv-Q+>X~- zAQxulw_4;p7=%A$ru8=m#kIrn;+c6=xsVmya2@(`G9DEa3c%1QKIV!OQia04v?ZbA zLMcpb0(4MmkO*VAlhQS>GVF9Edt&+Vnn6=_fvt>FJqO_U4r*xWX4ZS-*6o0n?bXGQ z^0UKu0Xf#$iFaCm`vhj_WnJutC2r}x0|Uqbeek|M9g`8!)+fWK9qj6Qqw~DT`q<(I z5X5UT6oi|2UurE z2kVTt*O{4Wc-}Sxz4Re-! zLBmIud>hy1(b=1cqqYpn<_)sURj>sCzMMthL?p+$0Zm-r3+N^_=&EC{ciDSawyF44 zULj5QDtaq!!+Gc3e~Xk!&W0qy>lydpBMGCQu3_;RTOJ3fP`sd-#!gcN>q^yaq5|a# zbuEsZFY}l*>$;bGIV;fKIgMyf*0q;h4cmFz!7lYeLrbCdb<>viL+Mq^PM=h^@xlWF z{+?Z9Yjk61dF&M%if6f7!e2p{OfXl0MM(UJUD6Wh#@bv@^Oqytav;6!4%4QGz^(<; z^|8eGvktsBXOkBkf;vF7-_xx1{a8vS_V-g&H5i$tPRtHFT;eLa%Nz2lL;+>VIu8!R-FL`XVO^-u3vtj#*=OW}AH^Z)5+n4U_Oa$+5wZ)?0?zICXP;E1 zW|YBfnlemcMmG(ykd2?*3I8#ze6Hw}$@y&6{E#gels>e~ZgGNM%!p4T=leeHA24;; zyqru*5>M=+Gg(^+9_oF;DchXz+BkZOngRvjc!Qe zwe|hGC}I&d*s{oy@+19XzSrYG`{jc;V5Y6slib2fx6rND5OC@cx6-6WOXI6fS*f{^ z1DV06>OnjOp!xL(9fZv3Bm#W=KKS~5pN(rHbXoWr$v>8>19oq%j7RGi^>!pDKQVQZ zyz57grf^fEi8fuJfB^4DG@{)k!*l%+X?5g;kQFQ=lM=cy3oBPAnTk&vD`W?$KZkiP zPg-Z-d_9}W;R1MbvywPF%Lyynr=e84r`OsZ#tH}aUYWwzz1z8p7=`WZ)F*732c{)c z1Ba*5{4So806~T|GJ_ifcbvW{zou!sd#=HY;%{1Bp|{-EurkCt3c}+Q;)19i@L=sJ zU3-YdYh`SHt9+pWatZoeN|j(Hs6HElsa5=}ep*P1stZ=B%ssIdviv$5+eV*SkyAgx zX^6H;fmdxoym!wrUDU3+XPZs#t~1{tL-G*?oBl~fZk6v0DrJ4i{W2xswai1r!-j{k z4m&$(G*ua_N?h;EcY?fRnKR`!OP&bwqxGpz9b_u&Ozh>|RY5Nk?df_@s|hPF^^BLy zs#@%?jB%^@ZnCbZQAJQ}9!^v$E!5BkuLOk?2CJk3?J3IVazuKkjszR)6S^1|lhf*q zHVt#=dGR!nZYQ#kUOpK;tGbBvM+;e1Wmjs(J8zGWjdlb~$QQ54ozAA@!(B*mmX?2~ z2cL6mL8$Extm*otRmlqp-06*8JB~J8_SV*LsaLcJ1xbk1=mcnXFDzl>ZdLb7$$Y|_J^6JTgv*4Y6o_i*j*lHQ7(!A&Mx|{rmrFR^Ld>s@` zcq#a~$B79qdbupm<0n_IGN(5Odb~XEn9z@XxXMC+`WJ-YlnKp9yBr4ZN4py0IPYh5 zYr=_5Ku|vlvz&K9(x)XZh*N!;SsWMAwg|o0aN=ENdzIVBT07oq&FKcgq2G712<%Ph z=Qoy6J~1hatq74ULIidU^$rMZLeHwB53<1$0Lxqgd(N!f-8;PgquoT%C#c7Rx_++* z?#P$RHRxMu)-_~Z(iFg3Jdc;rII)w7bEfj@(RRlCC|J)0qKqGrwEhstAQ!5q=&rjv zPuNZI(hf|F##O~l(Ue_`Ij=GKau=2=F%~#TkM%!V(fD`1vn-fY5)M)iS4)IrQ6~+1@E`t6jzRVGQ#*s-L+%s*N9N!z%; z9^mJ3e__^l%YNd1fR@=m7Q zFH!M#{{Pq{9c+-bb;9FJ=;gePUxl(XX#gLmzHp9^^*1{1M*XY0!NujgWEG;1?YF+B z-E;as*R6>9dvL?G+>e&QNVMOoq{$}@Cnaf#ZYE7K1)(RaSrFX`R zLP@Jzf7d16Dw_gSAmxXvb1HR@mfi>dCavDvA(*s=s|dr{2dccG1Z zo_Qf$sin5>t7vJ*A%t>FynwzIn?H#JhI_e*m zf-_)Lez&ZDecvOd2DIQ3d{V7ua>H3V=)F0i&4=Bops;E@F5EEK>(v2-KYtQQ^23yF z4!5&e%UaczuUtwo*xrX1XkLK6S0x8b4H0>Xs#5=u8w_KC2{Jka^v;9P3Q06GH9+pX ze75{t*;C#mX>n<>p1a0T?`knuQlE_mt*~UiwVNcxwB5g=Eor3?r{z9ZCPX1dR*~^C zp`MpB;#Jx*#ofC7NM-RfxeD`sOp3X>Fg6=LmF4pv%R&Q|#q)_bDLOdH<*j@IpnC_f zhP>?3QI|#&42`DSDu&X{7^w{VOh@7Eyah_ieRWT?Lfn(7N>t=z^KF=CXmjW9a>BlW zxYnTSDvDki8%E}s)dBXvaA1wfl19ukfz2z!&?|i6sJ`uklxquK8*O2s2?%1W`jy@! zt@DV>uKWAr5woVfNl^EuiJ~KSpDajN`E}lI|VT(k@p`{^(O4@9qVq5j)y02 ze2XdXT;P_u^QJ9$NUq2LpeH40ov)KA%#rr4ng!%DmYWX~dRx=!W@p0`56We4ZauLO z;*B)y_XuyBuJYYJyl#_$_&8NQuw)hOWJF(_xNgCLBMRXBMLt$nyRjOiO*zBfH(HqV z>duT1GPvaEKOC0yV?cb9c`{aOsTVyaJ-9IH2HaB8d!xyQn8&tPh=;fqioLF{@7QKW zE~a_#$-Uf?yybO7l*4X!I^6kAROW)yyHHtCKhI0u@DtF->%4>k&Q(bHWStC?)(nZg z_Louo*ZtW1yx6mENr3Q#ax$O6IYda-=0N+`;%nzkn$#42s}Lv0itr}cd-)N&y&#U} z1DE*x-c>Cc+?4`($zfKdvGT0Y>a~L}+*709NOM(54eVnO5a$uxUQo)-WB-R!TL?dN ztnusZBR!5`gXw19rXvu&DBjHYrG_xqDBz_{}PSIqZQ2 zcVR%*;C%mh$}Ay>t6&OkS>-b{n)Be1hB=_C`Y#u0^lI!6h%oNOr{`^W zTEePh1bm9LY#KAFz25XhxSB8*ud1Tkb2kWvcY29qfhI3DYza|oqwau8?!T&|-G}4( zp7h@wa+COF@@TXtH^xxioCZKl)AP1_<9Rt# zExl{~0uirZD#yB=H@y7*tbjyRUNvw9de{Ds(_c(;AXz_r?|unTGr^F`e4N1(*p?i2-bN(DKlm$5XWbj zVH){=Tw$O5yQ)JyfVA&FR($Ix6H8!d$8^aCU~m5G=SS4Hnzn)nqp47E@urM#>LH-S z{m%h|KTPZqyLSla8UFu3OyNHop?`CL{yF_$8r%QFg!_rt z{fpH2o3+yBvpZ6)8>er5IsCt(5Sjachv)*}`M+q1KO~la$o}4{{tuh)R@?4NK&Z21 z-GwKQb{__8 z;`Q}^Xp?`u{+b)2W#6!{pTQ9hG2vwVexewQqHTo@%SKDZ{YXd}0ZBuYV85p(QVq z(C?>U)BT)fwr*qMdYP4GuF;}zQGRPrHKS%np>So{^|Q)|Qy6P8=-B z&aOiZ$#`f(mH+R1-;fnU2nBgQ=PIznDW2E)Y>M;`=`mlXtj)G|t^gu8zr;A32#pm~ z?kpsZpoD9T1Yz?kj0qkiQ;^SO#c@3tROP*4mP4I7Vsbwwq`-euRPLodtsW)(VEYQA z#x=x}8clgCfAzm3{q1PC2Cyr5p#BjeyfDwrWEthFSeQ@HeG(D^*vN-3TnlaZ(m*$- zbzNiA6whXz=}>k;6X~7#Fa#h2&IAqI;23t7+!V{P3Pf%N!G;eDTLx+hk7z@T{$rRI zwSjiv>Dbe0szR{lwm=ih;XB2ZldAQ<00#E(X4tw6tgj0Y>%QuF?`R9IKC93HF+Z?8 zH<@!H&Q-o3(B#s6?td)#!ef)L!Sk=Xq~MyHNlopHM@PT(ujXzz9qBnn>hD4k zZI-~!MY&V0792LPqe_jB%H^b0%bcwe*m7~Sw<+EVb;48C5EwLfkICtVVtpfx`fauw zgII*TN3D$Q>&%_1ptY^vWc#iOtJ~POc;&eJutOZE4<_>am9!cN3%D{ljVgV?;+_-J zXG4c~=A(!EP?+kbJ&BazY2%PN|se3`%K&4Rw(u z2dwtS+?TtjvkwP9OxbQ1fZwSPn(nr)eSs~{A{`qlR(r8XVsQ!vP28qtSN*O=M*)?6M5-z@T+)P6bqY&yrH2$DA# z3*JNy%M{hE2{q|u*^j^(UBH!Ss<}eV?3(2ko^p(htQeS+S5$nXL9_7q$^$bHWm~h( zf;ze|ku-ub-m-x8O*ieFt6P}QGeq(x)kyuvL|MnMIEL!vj- z6KNtd83AdyKHZkOc-L<2UuzWhZi%c)!t`J(#fE_v3;MUeznJ(jwohtFSawc)Iw z0FZSE<=Q}9-F;t4?1t#fYKbG;o2j3LXZf;s1r`+C6#jelcf0*xstY@RsFAumruPOK zkNz}+&v!))i?>DkGE|V4i_luE8o~->J80=^f=Zr>%c}MDDJ^)6!pZ3q%*-~6Y0lV1 z*y30EGV?f8rjb1$s9L+xwmcTZwV>YsfztmU^4>eD$#i`io!RceaRAxsC@4tA%^)ZO zB28)r8za3)FHs}CNfQGknGqG05*3i%1f+x_NI(c7ia?|#QbK4UA|((Yk&=WYBsnk6 zc4qJ2x6k^{T4#N0owW}CllLk2^E`LCuIpZWQS(GQTuapt^5<#ZAs+l)ZlEasvI&xV ze8c2%ohh*P&qA6jCc_{OE~53^0aRyOc$y&ey#-v_VndkPyyCc95o_rMyDwVH;V6w^ z!NvHr2B6O~b#jI4+CHd#8Z`uNi~RUFc7<8PF;bOW_+*KKJLAryV0`CjK|5ijeX_Y~ z!{!6%Fle|a9+BDVih^}q44h;VMxfZ{$|PIEi8&yM`D6^&+ki zZdS(<}- zW?ydv;&`=+HZpwP`F63o$DnQF6s~Cy#dz1lGZ>(lHaq-U4pxzjzi5XN^v54CH_!0uCDm#5Y`LfW&`u8VvUTvU z*X=rV{_-3Fd#%+u>gx?X+loDvi~6k&;sB`xPpsZRkMkGA(Qd)646Fw3RygcKlY_^K z)UdLwWhC8qYc0ydn{?ug8}(>moa92hxLqI=Re)n&V?U&)5mrI|9 zCQuS@>t8={|KncL`{0pZLo7q?@PY`$Lgt zvV8%QiK*BDmq&9T`vrw1P$k3hLOibWa4gvBM;^w{b95-kIb6mnZ}W)%uM4-1md{V= zkd{_sCE@~J6oC1!wka|KPhD&AP5ib2U=MR|i#!7ir=t>O#n2<^u~Lz1k6{N60WBz` zQi|=>pnA?X2z{7+8itel->&D%0CccxfzrJOaP4%X@`mKciF0iVhKWZ>8Q+$StX?fE zM0V0gw6d;%kIihr!jrQN%g@xMKpUQUzq&N;*GEeOJd|tM^o7$Tb$fiIAg9gvey?!z zWdj`m6~ zcj?|1+#-lvkw&CT^+fi3A3^|*NrU{H6e ze`I79{aFPqJ67asupn;vVpQhwJd&)4KDfd<(oC8)T+01!=F`OLOrx0Z86L=iM;U+r zzJL_%rrq=-M5lJi{510t(owF16&7#?_H-dcbsqE2z~D--j42(l0;s;tLpy<#5Z7_@4<;w?=L_n1ELR+-A{pS{{X9WH!NGt!DS0@w9S z_mb2~6)EVjZgwQZl=U=EU8AL`)$6QgE(o6jwkh)`zCCg!a_Wh(=GF!Ho@Kktc|pa4 z1Fx+2vz}Cph&#V@q|<~o3f)@E996m;iK-T$PYYEq{|nA$jZz$Gu~lPd>Sk)M_ioovr5k19CIezlyQ4d|~Yp`~?}&~ThEI6j2Y6{2AJ?b)$xZAH zIZh2o0DCgp3F^yrX$$jm3uR@sZ^Ks>j;eBP1_u48kXbfg7JtN4xcR z_S3u83Nb;LQBbQ&@p`n=IqoQJ)|!(oPv7Q!lqY8K0RDs>tXw@AjaF{l}t&bI?>FS z(5n6F&`g2!hJ1I;o=62UiqkX0(ESkf!#CeV0>QJ@VbOQ8{f4iC?V7^==H8(%c|`oF z^<_-Sn*80Q7)MI<^=Z|gk1otw@|R;HA17Jw9K{(pJFW~W~&rsHT$3j>$ zyN{&R1+x%d5|+iGjlCTp@9)(@ub-LiGdRTxsFUF~x17f)5=cI$5df$1?(2{?4M-VG zxzxat_+3Do#LPhKKVqnOc;wMTDeW;sxB>!7IXmswYvKn6s$i9jjWHAaPnk!9a^`SX zAjZuO8~?PW>7vA;hkcG(MkhgKxtSr$bj`SeTmR_%NXHSj*5rojzoC}X@I3R4SoO`; zk=cWzzmCbf-7!dh?H81@R?0#2?|VCD!tpz;dF@nyiSZryaWZ?t9V%CpWF9=~-IMa&T42NF{80Z00^ zl5uD6XXSEIeCTa|8_HYabP4J6T~%JQI-!&JTG`FYL7{~3YwhQE25r4v{Rx|U5kkh(Xc7*g>!9a_{t|y z#QZ`S^~KGCA8v573nx?8hR5ci$3je_y}X>nv^jGWrBQlAadVlV`lQnfOcN|m3?;Kf zHlHYQgyeGQx}au$6}2*URN#1^-|~SjV)fDYoE!TS9UE>rc@9ifz^W z@=x{u2D9ov=LI$$E=2B)#u>ctQhwa;<-bfBL~^a_6%tLI3DX%W0n_9Bd(l;@M925# z-GxD|&AqeAZ1(Mz-fuZ6o`@;AW*4?g#Ov7Bf%|19Gr5$j>K$WA&|iZV>1b}7P5?2u z8ctD;AI|Oe;)X@aZ5pjl*AwoT8h;X|_Z1sxq^hMXJ&p)v&(+C*HQ+s`eUo(eznVDYCtvFwz|%7#w+@( zDqa0Gu^W^t!!Wes?yyVuc$_2e=8k#2)62ZKa|H}T{V2*0S~@!S=V!isgAlK^93~vS zPUPLF_7vV$@jZ<3j#k^B5Gl}@Xzk_l6AOc6TYBasZC=-U!@H`G*fnS9_e&@5 zOgP7D!=7SKSRg#ZdOVI@qoy#ku^`<{nhl>FN-s78mvRiL4P~m7~UUUDE zuH~hDs4zwSxS;`Ew?2Q;56dnw0lkDHM$@u?JIBN^qY{+p;Nay;4Z(Z{hi`5VdWpm`&zM-##n6Ow10|C6k{ z#6Dv+-^RZiOQNR)l_U4GJT$7!&2>4Kqiu4_C2#e0E*ge`$JAav z>M{%=;a)f$>=c;3nQN=Xd#h_S)xW1VTiwEU*Z&YlM&WD~S2Y(cp)F@S_DTjBc1-Kt zjeJr7@p#s{&fxRjPCAENI^n(C62mn7G|i$m}_-sE!9~yMR&5 zc**YMUq?NgPgHxH1y+5{ok56hBd>itQreNs>SgGSvp)-}u7LE|mT7 z2&3qu1)%7yo5DAo*<2@IE8531m#F+XqJe>)iF1f&nbwgs%QGaY(N0T7=J5b4{i7a1 z&&X@6iisxcvUctJrE#jn$*kY5X&4E@p}X%FEve+>8Z2-R5>`g59#tAFEa0J)fy?ZS zxsW`ddRzn~o^A=9few0K%hX@E8F~LWprva0!r}UhfamQgEeCTVB%rB#7CeXT7R#@O z&P&@~TgjOylI;BsT62zDICb&xKT3`JU42}U^`C75_KRa6I-f#f@z9&=n(6C&GsAIjstYX>X(hY*Ka+=QY zC1TltwV;0febJ8#>LewK?J)!unX53qCApyA(YAf7Z*h_+nc#3P*5S{(=ZD^^9q>g~ zGSK9Lje#xX1}$i`zi|yBhuArH9{0F<=)TrMzn!IgVQDb-hE+;l?&(bSZN%hfA^{=c z;{tB=JmanQbn0GYs1uj!=e-xKx$}*#++3z)!q9)S9%4~-`2Cz9S3T*Y$_Yc-FVD@| z9O#yt%E&HS_DycvKYJwoQ(pIJRU^TPel|)^6Zhf=Yqf-P%mc%`}~E zO6j+M0{rHl^)m=sle$FN-ObVmUrV#a8BPG!Wslargb0#@zs+~uxq3woyVSRQ7|HgO ztGyJ-ZYPBjxB{u1cQG7V)fHJaaq3XFA`mvO#t#!0uH8szumyLtS%I90+n!llpIWYj z$mU{}wCZwHHD@^?^jS<2-%I^}IcpCV(vJD5?m3%K&6|GP8HKjSIGf?UBz(H(`n&v@ z3jHYu2@}!uLjNqb&iZCsPIwe3R#E9ldQL4uXRysGj;is)(2<8BxSQK+(iQ_};ggsF z_5nJ4{(ls=Eq>d30lF{tcQf82!?n`pDi<8X$t{1I7*na=zLxSmd&p>-7a9&C4+*R% z68}~FZJgMt{o38QYjpM4w+ZV9qd$?_t#zIT;)F-#(kt*b%rmNJ;qle;|2h-yAv-wG zit$%&TdAZirP0$r$N~Dh{tX>p%j^SHJMbl)F|2X|3pqF12P_{m<_VrYKs0NJj zOFemhQDWXhG@MAD1h?+0d5K^sL4HKlHQ8*lX)a)4>hPb7sJ(-L`68!ZBA>1z&a|yW z#_=5ezhl>#uHWS^*6&Lb_5OPm%3_}&(<0iAvRLOs?@}D9*n18<6uQg_A{kF zm)*GHE4~eo<6SO{U(~|fB%bds@;p0>X0Y;_U8+@<&Nsu)!|54f=B=EIU{i4t^7tso z<-aaf0OhsBJShx0y880R5Qld5gkR^a+3)|`f{mN=Q{Uxskmm5!@yr22X_?{qfFBba za-SM@n@+WfFV>^N@BX)yTp7}28qYab%~!=i{;_Q1E~Z(69FgKr@W7cB0l7oK(vz4M z#}g?dG7wIdtN25VXz1eD0Mk$GxdK(V_LYRUVD|Ox)l!Y*FCHbS&}fTFnCwy!Dh2sm zG@%)9ufCm_yI;tbhFlTz^%eIrmO=Q#_sr248hg%iA=Of-WQc&2{P5qVmOY$Qw=L6r z?##rSk?!e#;2**J2?bZgbr9YG%*z?Iz!~s#?IFaBo|>@Ph{M&4{jl8;L%oD7pNnuM z#yI>*6#VxwDyKx~KNpn+1H9Wskk@*JaJonQ+EP7F_?!FIJ+Pgm-&FCTX{29V^+|EL zSb4i5CbQE091>YZqp1FAF9ZK(YYUr3T;ybp-C^O;3#>m*odVyl0V=YnR2#_l?LM z;H?K_Tjmu>@g|hRV&Og2w>N5lAIyUnj(I=QEx+9VrK25X2p>CW z{TP?zL`#aBD$z0kN*0T9_YiwEYaj^mY06c*>vlG|siLto2CE<(<-P?5R~`~A5quKX zA>P+|#nW{w&fs;A2(a3T|FHG>N3YD)6n4?}+&%$LYpOz{(maq}(QnnJit_=0&L#-|T z+rhY{=4f;vy4>do5jug?&mDEiST&GhE*C%JLrbq zUHJ0Y1Rf1rG%~}rcfj5m{{}o}{H|BxwAkey7STc;0AQ$!s z+x65#U?EpJfE44-?(&hMj?9scR@;huV!YdGb0hp5Yz+yNEEI!u`P~$Xtfi>Y0Cgv!2lyLV7g+j^P%~z7Hj9g|&N9x2vz1 z=7mmIh>OMhqhHxIeVT}V*s}KVj@P-v!0;P?03N}XAq8)Tq_^hTLL*f*;PuLlKAbQ_ zefU}~J9ow_t<`30ZEY&XPU6R8^T=|aWzz{PSoqD;7FX@4gs=yJuNq<%8WUQ8s~{mF zCu+pUwgSJd7B|wd6obAu%&ZbYmZB+lCFb$MJomF3rkKwKU}xaTCdL2k$p})`4U(8w z2MH?~E#mT#XGZf8&}juPocH$JJmXM(8*}z&4BNCtVIcLiYS}vGn3P3J{6*a=Gv0d~ zBTb%Ur_#>!A7%o)V7u~=smfb5H}?XzF;E9=M(x>A)kaWB)4KKf6fG&CVG1luTQ&ch zTy}CX(7d~w(|hEdmPVgkx;4a1Oe_uNU!GLVtYAlA#1FT)tRceJ+N z---@&y47!yWyA!ulFTo0y(9U*hHVYDG2GZa+=XOSsa{NVhQ6v~T=<2A^_lYaCkohM zWBSp7NX2vC7eD+r&*LnAMiK$35zLda#g_B4KO{tyZH8ck@j_o-FuSGv(;4n1et#0# z09+{+D@P;kym4mjOV>B<^Ye0@KPtTiJk4O>ZFd8T6OSU`ZDA*LcTm~I_J6PmzfAE* z9D{CJE$SApqeeP9&M67Eb|YsZ>O~bDMV9g>W<*irWU1mh{iTzbVtvVyOd`I@$OG+&)EtEM0pv>B~gW1oZAwnn$d_JV5 zOaEB@@9B$C>>l%NQmFE=57Ls(EO zkY=}Nv*ph9$9UJKq9@wQL|M2n2jhsuiH4cK3+e}yP)>x9*B89tkmF56xkh7c=D3iN zM$fxp`UzPj7>l3&AiUq|GpWpIoJHx*8`_2$AhE5=XD}ggMufO9USlk6(i1ME-Ui{$ zw^=qX2?px4>ld+jZ|;KjhzjTd!>Q%43ay}VB97`=YU1eZ-y6M&rr_2HM?4#+~0Bqtht1`G#Pm!%r3P+AYe_^ z5-YiPYmp1(2_}Orvbad`j9_!4!iY;9gSUGOrG__5X#e|Ptd zQz70KtC#jk%>Qt5Ln|aMrc}rT2(R7X7m@gh=d9{Yup*Oh$f3%jYbKd?Mq%TX8tCa8 zLFbF~-c|=DtPca1f~|u}0dF6>CzokAS=Z8;qh?<4F@-ISS$O(a-+Jp3Q3RL5!5@1!ha9{#(ic0`F}mzfQ>TWaU;ePyUJiN>65nn==1MQegR@+-K6 z!E!WOY1ST@%#qVvSf#{Yz_A9%##OBk>vJl4>4}>L;nlHp9_72$%v`SRbX0z9l7}O- z)hX_Bu1|T0CF@1p*0UsQ5wWFfwJgt!_a<}1jXb?RJJzyl82vU|HV(D~LRUAKjmLp~ zHb2**#xTa5k#qwB zwFashN;I8~j8YE9_|3)DImTS_;b1?WbBqCQPZxqsDB|X?xo-%6_YGFow+)H?ImXN+ zI#)>i(9D}n*`J_2JB?1sUOp3(aE~{%u&L#63NypVz7Q?YsSB0)y8#)ZSv1h2p*>bh zme-r!N0sJ>U?NLI-@%ra_gwFh$jaz@c=gr<`yuCb%PhNm+bjyAkV;Y=Wr&z!$KRnOVB_1;glcVB9^l_dGx!?_j;F1Ig7Ds!Pe8BxLH$anQ* zcLHe_kVp9N`mX?a+#ER{CaQUpRgGCoZmv=@-I5%bMQ$VU_Q5nDmQ+J~m{z4I3bZc9 z^&gR6^~xZ2ZZe;xv#QcF5XlXQG(`PGft*xmbxfEH&ENJzkrh)h=|*2%eDlJt39Eta zpY91BY#Z$w?#odo_#apvk0W<8ShJ=-9&QXRFmNPn-yD2W-XzietJa8b-gZ4r2V#3f z=~vOdpF@)GFJEcSTz}TNYQ@sn=&ikn*EeZ_WaB>`Dn4Z=li;we%r}~%W?-@xlX3kh zi}8)c{TN5ppeyp}^w%ioq$8Rv2aOP`!B{Ma@B>i9bBR6`v)dOv2rQkRY8-IE_0swJ zBV_qc;eS?f5xTrt+#8v zjL4%h@C*5`W`2&ozJZHw@0pt}P3pe5Aie!}>E4?fcNE9R`;1>5uSvxey$32l&n&Av z3yW+fZ#LkTPwM$ojbANPsMXPR+@*-geR9E<+wWbhrZA^w}aIq@w<`*HP-KK&z?n6vN5Q*1&{vpz_dtK&R93=f?n`p|xP z)q-j-w>yik-jjvsH2LtLzW3zebRl44Ui8>?lnQj-6zNx@E?Xcd%^RUN-8grsK-{l@ zdM2vh4Xl!T!C(23TPH-fn?EzfIRc${vl!*zfGmYCx>!z1+{+d%EzIav{Z zd2bDt<=#9M2Df%gm)&D6wug%-q#u%dT=DCYVFv_X*5et{{6@EN6v$dP=3pzfA;(A~ zWs2(45p&G_z%RGc+TA7Q6F0dn2bo1tG4|ilOjH-ALt4d5>^HjrPLVNl>!gI35FVIe z^~i#g+HX#ulW3vS?7Qhr99?a8XKyN z+j%-)*iM4RDo0-$6duotsWBReDQrc-u(kCZ*Cl97eI{|Yf=0(Pca6ChdSF9tGX>39Jg%TshXA^*c^*ZyT zLQj#-aaaC*ydJNYW|plPHfMT-=5wQI9cWN6zpNha;dkLZyp{FKrgY|$>vDrd)zj0J4Ag`8dnW|*QC^b_WPXuh7 z=+uP3G@_OI_fLM%EZKcm69Iu#yKI9bSKl8fp(ycLGOMCJGY;Ijg{P*S}bLZSia zbT>5QoaxPB0$HfZcfF#CtMRNQMpnN(f8z96C;Zz~+8Zoq zjjPv$Psds%46$i6sp`4u5tW7CMfQ6_&ZQ%|JX*0@_D(M1b1%2l2sAsRX6m7S)-x1? zr5L<%71WGpgv?zxWh}l*!%8fBwqGj|zcVc9JY8kxM#vI%U`B<_D_16Qa^~9Ud9dL% z$-#wGFr4zd(b)-9I5o<$Y2MC{Dv?VcZ5+M?TVLLAmkD-piIMZQH5N$E%o3T2#chyp z3a?DpOrhT9!SW|!7g{%E*D*iu>KA6E65;ETK+8kBko{NoBe!2X75F#Trip$_ZrA>mMvVd7m+sX- zfqHYLEn+b^`cu6hnrr>ZNOjpLH`UZFWa?Jp1cF>nrne@`_}M5#Z^HtYtz#=GmTa7k^96hK3p=%+54-iiN|4YDt+UVj}q8O_M! zw%c^!YfT!8H-EvH^5f)ChEO?D8n|=MUKgnYk{I08yw7;EmRmwS`SD}1e z%Rmj~G9znN)5YTx>UK~{p1_g(9hnCUrXn$TjYxsnnM<$Y!mSbv8+t)| zk8ZRkkvT&#vj)_-zWLD#^n`+-X{(lGG~(k|P?Z`9c8(aSSE(4*V_s?AT-3KClb%Vd zw7{0fY##B$V+<6>966jYDko7k_$rWY z4kRF2jRViGbxLPepjlFQ!p&3XmnsEhvOLM3@`ins79AtbCr{u7e-FCiY{=Pi1i}gY z`7yA;lEK-u=84=Id*dpzN+0ChLjHi}$Rz0A4~WI%7()3F{9cnRb$3 zHVpGw#xzS`)wbPUT_Fx&)#YerSp9JK!*9Z*^6$|c;*hi8 zN^`K#p8dv$ei*vmPV>4#5Rc*Y7UnKU^&$lUn9s=V`|exi9_v6_sJa&to$bCw5CcGs zfkdD~pCW5tJ31#rw~ z<|Nv%c|4*f260iCBm>sqG&=wZ`@TZ}SyB6sBF#qi*V}9ZYA2d2FF1tKbO{sAtumel znN~N!MW@(LNC-2k&4pUIP>uLX(SR6JgxI=6lNB(Y zY8?}Im2sHwk!^13ZEL=9Rx}egHH7C9Qh+h<5;+5@TK{oi6#l+nDlq;9U(+ZNrc%8S zyfBwBLDhWVGs}3b#;FRKv~gl2NnRoer}1{k?G{K-a*umr==Q@GHZ|p@0v9qV1n0fd zT>7SHgkK+oh86;e^{vU8V}Eg06Taqw=7Z(a!H6zLMiMHXFt@f5Cq}#ad9HfLMqf2F zk5v|G7imLHx>jLy_-Nd7>b)$2;zA7rr zuK<}h#6nT*7D+Va6W$;(Z(b)LJ)EhK?yVCt6L%%7&*zG-IgltNM&hzDq)m5x^+3;9 zQ8imExZ}P>XPQTzR`qj^p}w|N4@R7$DyI+JZ?7fdKYxp1_WF&Szs|E*l4lGJ$W%~h zThhhBhhzCC*qlg^9l^R4q61S8s*#ug?-W*Zb{O7&^x?HmSeHex+}JfNQCVM+&r^x{ zVtKLsb-ii$fYIL~*FUF#b4H%%^m?V^qZ2mRZ`!)V~#;^xerm zg4bFjzxP-rQz5`DNVn9C=f(aY@*630F|GE-ubHt;rX%~cazV~?+E#Mw@`spvw|0i^ zZvE%bO%m4iMO(QHypSuNX`r0BoZxWg2unDHm5*G1BOP{d`By`+b|wIebU!P4@ge!t z;dH=HXyO+nfer~gP7E{voTLz%1GX@g-SIKzJ7T+;fx3I`+s(YzsJ;ZocAbUKtFlBU z>_UwZ_idmps7Y{}Hq6+R1lgGf!(%svZLB@)7m^_R$+CtgI;*^+jJ;EJXiG4sNb3C(eGHA6zPAYrQ1!ONtx9KR#<80eZ7sdOtW*OFWlcILN4JF2ekhX8x z6<5k^74Bp6tC;&d6kQ;QOH~QLeOR3FRR**-LsvD1DQKDyuJrxhL<8s4XU%TJ-Pctu z-0HyFBV*s~x$XwgrHW6h)&R6sWho0aBh+vh%JfW|cn>>Ps`t+EU^{1?X>ATm%SCYo z=`uHrtRhlCeKepj{^&~T&bJN%c!w`6rJZkaK{kb-xyFJ9SN(DY83lf1G`TQd4PCfB zGJG9bU(1`2d_K69sV|mZyPbK9WoVvkK6J4V{;O9bugSS^8m-Y97<2m+aD$ZS8><6X zSS(jlL^l9N>*C^l5_y4BTxYs}Dtq)us%C{IG8`W}e2*zuAja9@mb7=1y#~48_)7Pd z<7=C|*B%>o$8QfaFqx(=YT?^uFAKt|SCAI@4TGcbVOjk6=paa&+G-0gT&4^3R$Vd? zs~+AUWw^^~yHJaLizSevgutvq!jd(5#wsJ-F*tfS`s%kX)b36tSz^r;;Q6` zB8FrLb;7kpbUB){kVr0r2z;HyFZt`S5u%kAxzp|97jZ5+LK4cu@` z{PrE=K_tilv{fZAeRnc7s1E7r#k=ige&$xNjcv<1aF9?Y#i6HX6`d#R;@)>6MJ9Z~ z_aM8lR_0;$!QpaYLHj*PkfXj1Jo);afF6lqj#?Ge#dvTboTkm#MIJK`h7DnawXutb zy*Q1AxJNBQjiE5CX{m7S&V+YOon9*uzxuefZ$$iz-|GU>585_yqW!+lU#eHg7?KA$ z)P=0CSwqj&qWK5`Xba3(_lkb!7p1{L*Tk{iouj#MuMnXXnaFxoibJ6(IiTA^acmDp zA7!}>Jf|qhz6d7(IatI2K}KjQwy<6TCdMrF*6H$4mA&5L>{yg@)o4H@MkVzu>ljA& z!DI~~g>3K~Y*<6VOn@PJU|;1Lr|4?;@>gL|aWz9O?ffhQl@5sD5XV-C{>U~Z2i+3P zGIlk?7Vtl5ivxvCvZhtS57Tvi$j0}g62fQjhkHA>LBm&1tTuUvLaPw1uhNP zbr&Pl4a3yu;E8CgmMX;4-A+8~JAU_6rKpVMPBQ*%uF=5rc_wWU@{@7|$S=faU^mn> z8;j;BzbMl3YoM{YUXkXsJ6!v<&VF8wNGmOIWOOR#JH>|MenG%GU(`vmfVXV*#RT{u zZYtYN7g_apSnyN(ztej0jxl6iZ>IBT&oeF6i9~sfoq&2v5I}BeVU^=_eoUl}CE3E`P6hDoK4q4Y)+83ew(ky^; zK8hY(1Xw?G6A{21!w40gPN@E@0q=dw&zMao2}7j*L6ANfbRL1@iL91t zO?y^OZsu#X-AGU^Olq`x^loYCe4s!U3VgdI_a#qN*l~|M_WK@R`iEtW0jrggnv`dG z`p~f?U#Pl)SmgDd*NX9Wz;aDXn!Lpi43W#{8CiicV=QSlU3mq>g+Hd^JE)A}Nkb_Y zh;rJHTt0NW;tPb~_=~SL1mNHB+mn-I&FP!|KYMNOPNW7Wnj>kYH;hxC)9~wH024Ne zSId2@e9ewHY2FqzZnW6%^|T}3R(bZ)Nmgv$Nj-=4?!2WwIW1T;35!#*r6A$!@05qO z?&Z~1m@T!dH9VSsU4yC^fEZWQ3Ufpn)&ls0Yw;~vv$H0gz6L1^b>S{!)N9ahFyKjV z-6UjOfUjy{G(?L$?ZlCVu~LPu?Hq>$2O{3iIrlfZNvTcCdN_v7Nnl6_aTyC(T_Mbe zsKnjnIPqb-U_d|~O$BA{rz1$v?jH|E7n{`WPji@({bCK5zdmpZ)S|W!l9I;y(ws=Z zlC>t-N6nH!XC&q&A+C0HQ$NW+F#zUTX||M{Kv_m9Nzw*f&xAJi$ADu&;*{kWjBQGK za=k;(CT1y|J-Z7y%x$@>Tfy`?lM+5=8D9_DhG!ifXf#_w3>x#8B#WN5b^4RR z;&%-94JD^RZqlXw^mf*XXi*00f#JnMTc^T0VSnL$tv@hd=-RLQx#4GLD%zTTzElzY zPFlYL%WSoz#xB=fhtYP zLXg4l4|HZG8JLE$irAFX&v<(+#ED+rdaC&au!-%QD2k$b4m{;DuSk&EsR&|?_I8?1 zO!)WkR<~=r=0ZtByd#K)!(Bx>{968c^w5+sHI&uA5=k_PB0(7#r+9)>+zBna zfsHq!{*CXy_~Ylk`r~v`(JA3mZYF-)2ZIzNqDdy)2lJTFttkQ^ZLzG;i*MtFRnd{+ zMDp+Q(^X6e|0jw0sl(}Onh-3cbT8uCYdzI@h;kE+E|+7!bkrrW71?F96}|Gbe!YCb z9B$Ji`e>1PSvi9+dl}HmG`wTxCjR*A`tlr;@&PMl5oun`O}OCfw3l61ud+6tHO%s{ zqCdy`y^VXlHgLzVDB7- ztSNdFbF=Jia$%jcYy;Sv^@~MLE}YekhZ-R@pD}PuLLYJHjH&a^Z$DG$OOx z46y7EAHQZ<43HA@knJwWgBP=^6Kh6=04P}&si~ukj~fPG0pjXC7$m{%;jzQZ_v*lm zf966KnC20U4A6b8OHbP)2es9c5AQqjTlbr>Mo2ym5EOc`Two8;62?2ic}?akREH<~ zl#VEpT?tOnDBjp?AXe0FOeM@Fj$|w-y{OkZeps!h`UJlyR=|!vmB9fV7aa3gbbm$} zYBUfCJ85kYFTRrymvT!{e`@Py6n*hGiFy5kW*QeZgTO?y^sS|0R^jgXINq^n&cX2M zyPWRF=mo?qh3pl*w{EIDwdK>knbgj(N;U8cyyWLSf+t&W+Rg4)IUqt!`N+v* zlQCs=@$B%8@Rd$a#jc_$ajD__5Md-Ev>jV$T3uUn-Skt3`G|Brh|mmv6xrFGNM4x4 zy#|yd`ESZ%S&N`)m_t6kvg*}RJ>q!Tt62WAQWti-G-?MLLn-){RqmYsdE8!ZQ7>Zmrm&?m?Bo9F{xK>Umoo`di0 zqvvGcEL%6#Shfm=rFuYbocn+=b&qPNmZt>=UTdDfotCG1-uE^toT`b^PmWSO&^Iy@BHGJaCE{3M~6N$>Gl@`tJHcbU^cn|*($aJ9A)xz6= zw(dLb5NhFP{9?+Ei|qu6Y5oy#4@&nUZ@mo(oXJak;SO9XHiJ@YWIn=k0qPg{D9DCa39Xs;WD)DNv*3Sl1HLpAE|e%M#l!d@ zbhMapojoiGR%dkHJ3uCBY*)wjb$E>QNUES~z-x?6=6gkV08&0&%%#m|r(t(%t6+Ap zqWjK0^>&b1f{^gjIcXR@Vx+XKwq%}^2ZNsqec)+7n~ zFK$$aTUiXA+GO{|)wnG#_s6|6obXIuK4p$yFUrci4CuiDNvoan_$Nx=KnxtR$TNO6 zfw<_In&$>?%L!r%3Z2>h+2x|PgTqxF4Ric$RLt%hH71`F{u>vdm#42v5q`Y*T&t4( z;-3CPU<_OlNu?6p@)`8-{*CH;T-q?ikE+&f9Q0pM*TiNso(m0G=x;R|JJ~UL;rtmD zxc+>57hdH^8m9E@g4cf{WDR`(lwEzfe${U0zwvFW5`$SIv9lfW7Y{U`8tr)*5Rs{r z1)y*CWvX}ofFSS4sd@vNU#(Y?;yhC_b|>t2mIstU^i;)ND9@8QY3^|FwAT<`9OqY= zHj4bkt1&uZFr-jGxvsFG@jrg)v_#p}OMz*hE0iecqv($Zh&Zzrzm2LRZ$3y%?C>;B zEp53R)yzp#QHZ+}y8%YL@;5Bls0;&{2&Zzg%Z{Sx0r&G(JCS=rW`80Br;oto|3}0u8*A2FD&r z_}ue9bY!+cc=q=2_UES)KOM=58@YZ{f8iPi3ZE41DAYW8W(w^NnW*oB=OQ+>9Kp2* znlgs2vrg3<9B^V7Evh`SR!fz6@i(bnU4J{#DgfAR!V8;9Wgx8E1S9e!O>}ER9D^6o zN8+Y8yrX+hl;;o}gc#L7*Jp>WGJkjRjOuK}27ok3KJ1c<8vV_(Rgx(;;_Kr|$U;p2 zK31dyz2ti}qQ9&D8hoohYPcCxr?oE{$H_X1tb9ZblJB>K(w}vb2b&EJA+MOe-)*G? z7(1!RSoC1lI{SuQJNrTNad^?-UqpyM7O(!>?8jM2PsW{RxX0M#(r@^WjlIXh{Ox+7 zfp=n=wOysluW?#ZvsmMrfFm@_5+P*3oOD~~!u{$Smz?izR08WCds-D@4-${)GM-x} zxxxRhJ-U2-WqQoz4M-}mdkWbRel8^5GB#QVK@ zraW|C;Ds#U*~m{@falMhk<8v#ncm}cpW({0_`ea-Rg-Q?NYyqj3^)4xXH&|ZX?cqS z%^d$)05`%4vSEf8;31(z_TH|e`@zpR^O>)Ywh&$l%Ur<53bs?~wExafvfJ;8{UGf^! zuaB(NfXi^(dQt+erA9Uf%{V-RE%o`8qx(uTfG4xD0gZvDzm|Y_aPn1cHqz9-vsB`d z-LXl?9w=1%`i+2-WMgw2ppPQD`Z z`EkMDwy$sQPVTg{XmgBwt}^fZy`y@cFCV)l%j_d8G3B!^aQW_|OM9337-{53-kSWS z5mX3*>bP9c_Jo!V&*FdAc5U@C{~SYicpi&K+oviyr4*RFf8~O^u|W5&)dhxXivW+;4B+m^ z&!G7>sH1B^Q%}GnfD)TPC16tXr`Y?|S;1}a37!+-usZc;7;uFCr}A^N)Qygn_xf{q zZozi1Mn%Kh*62#U#z$MJl*GJe(W~azt7h1 zi?99FoNjXK$Gz_zwa}y~5G4&aw*J@K)AinOcRjm)<=s-<&U^oi*PoyEw|)Na$c^?e zpJY43J38Lx_o~`|o&Enu{)*`SZFU!qecvDY_r?Byj9*{>e;Kmz&HcT=P$1m7(un;DGYcXV-Hq4ihlVcMM;G6CSEGMm1U!YTZuMdB*S9wvwGG^#7+q=8ka!TbHwJP=+o{k6+kq9}=HGc6T5-yBd>QYrf5z^n>rzgli?B zbI0?~o|3vh#U%NNDDc23*wK&RbL&Jo-sgSko3VE@6NgZ70g|HHp?(Wy!KDE;UCfbmdatp_onboard.json ``` -## Create Puppet manifests +## Create Puppet manifest -You need to create a puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by puppet server. +You need to create a puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by puppet server. This example makes use of *apt* module available from puppetlabs and assumes that apt module has been installed on your puppet server. + +Create a folders *install_mdatp/files* and *install_mdatp/manifests* under the modules folder of your puppet installation. This typically is located in */etc/puppetlabs/code/environments/production/modules* on your puppet server. Copy the mdatp.json file created in above step to *install_mdatp/files* folder. Create *init.pp* file which will contain the deployment instructions. + +```bash +$ pwd +/etc/puppetlabs/code/environments/production/modules + +$ tree install_mdatp +install_mdatp +├── files +│   └── mdatp_onboard.json +└── manifests + └── init.pp +``` + +Contents of *install_mdatp/manifests/init.pp* + +```puppet +class install_mdatp { + + if ($osfamily == 'Debian') { + apt::source { 'microsoftpackages' : + location => 'https://packages.microsoft.com/ubuntu/18.04/prod', # change the version based on your OS + release => 'stable', + repos => 'main', + key => { + 'id' => 'BC528686B50D79E339D3721CEB3E94ADBE1229CF', + 'server' => 'https://packages.microsoft.com/keys/microsoft.asc', + }, + } + } + else { + yumrepo { 'microsoftpackages' : + baseurl => 'https://packages.microsoft.com/rhel/7/prod', # change the version based on your OS + enabled => 1, + gpgcheck => 1, + gpgkey => 'https://packages.microsoft.com/keys/microsoft.asc' + } + } + + package { 'mdatp': + ensure => 'installed', + } + + file { ['/etc', '/etc/opt', '/etc/opt/microsoft', '/etc/opt/microsoft/mdatp']: + ensure => directory, + } + file { '/etc/opt/microsoft/mdatp/mdatp_onboard.json': + mode => "0644", + source => 'puppet:///modules/install_mdatp/mdatp_onboard.json', + } +} +``` ## Deployment +Include the above manifest in your site.pp file. + +```bash +$ cat /etc/puppetlabs/code/environments/production/manifests/site.pp +node "default" { + include install_mdatp +} +``` + Enrolled agent devices periodically poll the Puppet Server, and install new configuration profiles and policies as soon as they are detected. ## Monitoring puppet deployment - -You can also check the onboarding status: +On the agent machine, you can also check the onboarding status by running: ```bash $ mdatp --health @@ -95,6 +155,7 @@ $ mdatp --health healthy The above command prints "1" if the product is onboarded and functioning as expected. If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: + - 1 if the device is not yet onboarded - 3 if the connection to the daemon cannot be established—for example, if the daemon is not running @@ -104,3 +165,12 @@ See [Logging installation issues](microsoft-defender-atp-linux-resources.md#logg ## Uninstallation +Create a module *remove_mdatp* similar to *install_mdatp* with following contents in *init.pp* file + +```bash +class remove_mdatp { + package { 'mdatp': + ensure => 'purged', + } +} +``` From 415e7b425a92912678ffc5b1868df2174cbfc8a9 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 22 Oct 2019 17:24:01 +0530 Subject: [PATCH 08/69] Removed ansible and other configtool files Not ready for ring0 --- ...defender-atp-linux-install-with-ansible.md | 259 ------------------ ...atp-linux-install-with-other-configtool.md | 79 ------ 2 files changed, 338 deletions(-) delete mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md delete mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md deleted file mode 100644 index 84088ccd42..0000000000 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md +++ /dev/null @@ -1,259 +0,0 @@ ---- -title: Installing Microsoft Defender ATP for Mac with JAMF -ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Mac, using JAMF. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dansimp -author: dansimp -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual ---- - -# JAMF-based deployment - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) - -This topic describes how to deploy Microsoft Defender ATP for Mac through JAMF. A successful deployment requires the completion of all of the following steps: -- [Download installation and onboarding packages](#download-installation-and-onboarding-packages) -- [Create JAMF policies](#create-jamf-policies) -- [Client device setup](#client-device-setup) -- [Deployment](#deployment) -- [Check onboarding status](#check-onboarding-status) - -## Prerequisites and system requirements - -Before you get started, please see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. - -In addition, for JAMF deployment, you need to be familiar with JAMF administration tasks, have a JAMF tenant, and know how to deploy packages. This includes having a properly configured distribution point. JAMF has many ways to complete the same task. These instructions provide an example for most common processes. Your organization might use a different workflow. - -## Download installation and onboarding packages - -Download the installation and onboarding packages from Windows Defender Security Center: - -1. In Windows Defender Security Center, go to **Settings > device Management > Onboarding**. -2. In Section 1 of the page, set the operating system to **Linux, macOS, iOS or Android** and deployment method to **Mobile Device Management / Microsoft Intune**. -3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. -4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. - - ![Windows Defender Security Center screenshot](images/MDATP_2_DownloadPackages.png) - -5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so: - - ```bash - $ ls -l - total 721160 - -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip - -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - $ unzip WindowsDefenderATPOnboardingPackage.zip - Archive: WindowsDefenderATPOnboardingPackage.zip - warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators - inflating: intune/kext.xml - inflating: intune/WindowsDefenderATPOnboarding.xml - inflating: jamf/WindowsDefenderATPOnboarding.plist - ``` - -## Create JAMF policies - -You need to create a configuration profile and a policy to start deploying Microsoft Defender ATP for Mac to client devices. - -### Configuration Profile - -The configuration profile contains a custom settings payload that includes: - -- Microsoft Defender ATP for Mac onboarding information -- Approved Kernel Extensions payload, to enable running the Microsoft kernel driver - -To set the onboarding information, add a property list file with the name, _jamf/WindowsDefenderATPOnboarding.plist_, as a custom setting. You can do this by navigating to **Computers**>**Configuration Profiles**, selecting **New**, then choosing **Custom Settings**>**Configure**. From there, you can upload the property list. - - >[!IMPORTANT] - > You must set the Preference Domain as "com.microsoft.wdav.atp" - -![Configuration profile screenshot](images/MDATP_16_PreferenceDomain.png) - -### Approved Kernel Extension - -To approve the kernel extension: - -1. In **Computers > Configuration Profiles** select **Options > Approved Kernel Extensions**. -2. Use **UBF8T346G9** for Team Id. - -![Approved kernel extensions screenshot](images/MDATP_17_approvedKernelExtensions.png) - -### Privacy Preferences Policy Control - -> [!CAUTION] -> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device. -> -> If you previously configured Microsoft Defender ATP through JAMF, we recommend applying the following configuration. - -Add the following JAMF policy to grant Full Disk Access to Microsoft Defender ATP. - -1. Select **Options > Privacy Preferences Policy Control**. -2. Use any identifier and identifier type = Bundle. -3. Set Code Requirement to `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`. -4. Set app or service to SystemPolicyAllFiles and access to Allow. - -![Privacy Preferences Policy Control](images/MDATP_35_JAMF_PrivacyPreferences.png) - -#### Configuration Profile's Scope - -Configure the appropriate scope to specify the devices that will receive the configuration profile. - -Open **Computers** > **Configuration Profiles**, and select **Scope > Targets**. From there, select the devices you want to target. - -![Configuration profile scope screenshot](images/MDATP_18_ConfigurationProfilesScope.png) - -Save the **Configuration Profile**. - -Use the **Logs** tab to monitor deployment status for each enrolled device. - -### Package - -1. Create a package in **Settings > Computer Management > Packages**. - - ![Computer management packages screenshot](images/MDATP_19_MicrosoftDefenderWDAVPKG.png) - -2. Upload the package to the Distribution Point. -3. In the **filename** field, enter the name of the package. For example, _wdav.pkg_. - -### Policy - -Your policy should contain a single package for Microsoft Defender. - -![Microsoft Defender packages screenshot](images/MDATP_20_MicrosoftDefenderPackages.png) - -Configure the appropriate scope to specify the computers that will receive this policy. - -After you save the Configuration Profile, you can use the Logs tab to monitor the deployment status for each enrolled device. - -## Client device setup - -You'll need no special provisioning for a macOS computer, beyond the standard JAMF Enrollment. - -> [!NOTE] -> After a computer is enrolled, it will show up in the Computers inventory (All Computers). - -1. Open **Device Profiles**, from the **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's currently set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile. - -![MDM approve button screenshot](images/MDATP_21_MDMProfile1.png) -![MDM screenshot](images/MDATP_22_MDMProfileApproved.png) - -After a moment, the device's User Approved MDM status will change to **Yes**. - -![MDM status screenshot](images/MDATP_23_MDMStatus.png) - -You may now enroll additional devices. You may also enroll them later, after you have finished provisioning system configuration and application packages. - -## Deployment - -Enrolled client devices periodically poll the JAMF Server, and install new configuration profiles and policies as soon as they are detected. - -### Status on the server - -You can monitor deployment status in the **Logs** tab: - -- **Pending** means that the deployment is scheduled but has not yet happened -- **Completed** means that the deployment succeeded and is no longer scheduled - -![Status on server screenshot](images/MDATP_24_StatusOnServer.png) - -### Status on client device - -After the Configuration Profile is deployed, you'll see the profile for the device in **System Preferences** > **Profiles >**. - -![Status on client screenshot](images/MDATP_25_StatusOnClient.png) - -Once the policy is applied, you'll see the Microsoft Defender ATP icon in the macOS status bar in the top-right corner. - -![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) - -You can monitor policy installation on a device by following the JAMF log file: - -```bash - $ tail -f /var/log/jamf.log - Thu Feb 21 11:11:41 mavel-mojave jamf[7960]: No patch policies were found. - Thu Feb 21 11:16:41 mavel-mojave jamf[8051]: Checking for policies triggered by "recurring check-in" for user "testuser"... - Thu Feb 21 11:16:43 mavel-mojave jamf[8051]: Executing Policy WDAV - Thu Feb 21 11:17:02 mavel-mojave jamf[8051]: Installing Microsoft Defender... - Thu Feb 21 11:17:23 mavel-mojave jamf[8051]: Successfully installed Microsoft Defender. - Thu Feb 21 11:17:23 mavel-mojave jamf[8051]: Checking for patches... - Thu Feb 21 11:17:23 mavel-mojave jamf[8051]: No patch policies were found. -``` - -You can also check the onboarding status: - -```bash -$ mdatp --health -... -licensed : true -orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" -... -``` - -- **licensed**: This confirms that the device has an ATP license. - -- **orgid**: Your Microsoft Defender ATP org id; it will be the same for your organization. - -## Check onboarding status - -You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status: - -```bash -$ mdatp --health healthy -``` - -The above command prints "1" if the product is onboarded and functioning as expected. - -If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: -- 1 if the device is not yet onboarded -- 3 if the connection to the daemon cannot be established—for example, if the daemon is not running - -## Logging installation issues - -See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. - -## Uninstallation - -This method is based on the script described in [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling). - -### Script - -Create a script in **Settings > Computer Management > Scripts**. - -This script removes Microsoft Defender ATP from the /Applications directory: - -```bash - #!/bin/bash - - echo "Is WDAV installed?" - ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null - - echo "Uninstalling WDAV..." - rm -rf '/Applications/Microsoft Defender ATP.app' - - echo "Is WDAV still installed?" - ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null - - echo "Done!" -``` - -![Microsoft Defender uninstall screenshot](images/MDATP_26_Uninstall.png) - -### Policy - -Your policy should contain a single script: - -![Microsoft Defender uninstall script screenshot](images/MDATP_27_UninstallScript.png) - -Configure the appropriate scope in the **Scope** tab to specify the machines that will receive this policy. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md deleted file mode 100644 index 91a5f56395..0000000000 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Installing Microsoft Defender ATP for Mac with different MDM product -description: Describes how to install Microsoft Defender ATP for Mac on other management solutions. -keywords: microsoft, defender, atp, mac, installation, deploy, macos, mojave, high sierra, sierra -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: mavel -author: maximvelichko -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual ---- - -# Deployment with a different Mobile Device Management (MDM) system - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) - -## Prerequisites and system requirements - -Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. - -## Approach - -> [!CAUTION] -> Currently, Microsoft oficially supports only Intune and JAMF for the deployment and management of Microsoft Defender ATP for Mac. Microsoft makes no warranties, express or implied, with respect to the information provided below. - -If your organization uses a Mobile Device Management (MDM) solution that is not officially supported, this does not mean you are unable to deploy or run Microsoft Defender ATP for Mac. - -Microsoft Defender ATP for Mac does not depend on any vendor-specific features. It can be used with any MDM solution that supports the following features: - -- Deploy a macOS .pkg to managed machines. -- Deploy macOS system configuration profiles to managed machines. -- Run an arbitrary admin-configured tool/script on managed machines. - -Most modern MDM solutions include these features, however, they may call them differently. - -You can deploy Defender without the last requirement from the preceding list, however: - -- You will not be able to collect status in a centralized way -- If you decide to uninstall Defender, you will need to logon to the client machine locally as an administrator - -## Deployment - -Most MDM solutions use the same model for managing macOS machines, with similar terminology. Use [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) as a template. - -### Package - -Configure deployment of a [required application package](microsoft-defender-atp-mac-install-with-jamf.md#package), -with the installation package (wdav.pkg) downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages). - -In order to deploy the package to your enterprise, use the instructions associated with your MDM solution. - -### License settings - -Set up [a system configuration profile](microsoft-defender-atp-mac-install-with-jamf.md#configuration-profile). -Your MDM solution may call it something like "Custom Settings Profile", as Microsoft Defender ATP for Mac is not part of macOS. - -Use the property list, jamf/WindowsDefenderATPOnboarding.plist, which can be extracted from an onboarding package downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages). -Your system may support an arbitrary property list in XML format. You can upload the jamf/WindowsDefenderATPOnboarding.plist file as-is in that case. -Alternatively, it may require you to convert the property list to a different format first. - -Typically, your custom profile has an id, name, or domain attribute. You must use exactly "com.microsoft.wdav.atp" for this value. -MDM uses it to deploy the settings file to **/Library/Managed Preferences/com.microsoft.wdav.atp.plist** on a client machine, and Defender uses this file for loading the onboarding information. - -### Kernel extension policy - -Set up a KEXT or kernel extension policy. Use team identifier **UBF8T346G9** to whitelist kernel extensions provided by Microsoft. - -## Check installation status - -Run [mdatp](microsoft-defender-atp-mac-install-with-jamf.md#check-onboarding-status) on a client machine to check the onboarding status. From 19122f00b630b3cbce6680ff276f0eb9d1d8c9c6 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 22 Oct 2019 18:19:00 +0530 Subject: [PATCH 09/69] Updated pua handling and updates Updated pua handling and updates --- ...-defender-atp-linux-install-with-puppet.md | 2 +- .../microsoft-defender-atp-linux-pua.md | 21 +- .../microsoft-defender-atp-linux-updates.md | 202 ++---------------- 3 files changed, 25 insertions(+), 200 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md index 9cd981bd65..63a75eb001 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md @@ -46,7 +46,7 @@ Download the onboarding package from Windows Defender Security Center: 2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**. 3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. - ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_page.png) + ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_win_intune.png) 4. From a command prompt, verify that you have the file. Extract the contents of the .zip file and create mdatp_onboard.json file as follows diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md index 2696590c99..2ff866b692 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md @@ -1,8 +1,8 @@ --- title: Detect and block potentially unwanted applications ms.reviewer: -description: Describes how to detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Mac. -keywords: microsoft, defender, atp, mac, pua, pus +description: Describes how to detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Linux. +keywords: microsoft, defender, atp, linux, pua, pus search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -22,9 +22,9 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -The potentially unwanted application (PUA) protection feature in Microsoft Defender ATP for Mac can detect and block PUA files on endpoints in your network. +The potentially unwanted application (PUA) protection feature in Microsoft Defender ATP for Linux can detect and block PUA files on endpoints in your network. These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have poor reputation. @@ -32,13 +32,16 @@ These applications can increase the risk of your network being infected with mal ## How it works -Microsoft Defender ATP for Mac can detect and report PUA files. When configured in blocking mode, PUA files are moved to the quarantine. +Microsoft Defender ATP for Linux can detect and report PUA files. When configured in blocking mode, PUA files are moved to the quarantine. -When a PUA is detected on an endpoint, Microsoft Defender ATP for Mac presents a notification to the user, unless notifications have been disabled. The threat name will contain the word "Application". +When a PUA is detected on an endpoint, Microsoft Defender ATP for Linux presents a notification to the user, unless notifications have been disabled. The threat name will contain the word "Application". + +> [!NOTE] +> **TODO:** Reword for Linux ## Configure PUA protection -PUA protection in Microsoft Defender ATP for Mac can be configured in one of the following ways: +PUA protection in Microsoft Defender ATP for Linux can be configured in one of the following ways: - **Off**: PUA protection is disabled. - **Audit**: PUA files are reported in the product logs, but not in Microsoft Defender Security Center. No notification is presented to the user and no action is taken by the product. @@ -59,8 +62,8 @@ $ mdatp --threat --type-handling potentially_unwanted_application [off|audit|blo ### Use the management console to configure PUA protection: -In your enterprise, you can configure PUA protection from a management console, such as JAMF or Intune, similarly to how other product settings are configured. For more information, see the [Threat type settings](microsoft-defender-atp-mac-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) topic. +In your enterprise, you can configure PUA protection from a management console, such as Puppet, similarly to how other product settings are configured. For more information, see the [Threat type settings](microsoft-defender-atp-linux-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md) topic. ## Related topics -- [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) \ No newline at end of file +- [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md index 50267f26bb..a75a02fd2d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md @@ -1,8 +1,8 @@ --- -title: Deploy updates for Microsoft Defender ATP for Mac +title: Deploy updates for Microsoft Defender ATP for Linux ms.reviewer: -description: Describes how to control updates for Microsoft Defender ATP for Mac in enterprise environments. -keywords: microsoft, defender, atp, mac, updates, deploy +description: Describes how to control updates for Microsoft Defender ATP for Linux in enterprise environments. +keywords: microsoft, defender, atp, linux, updates, deploy search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,202 +18,24 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Deploy updates for Microsoft Defender ATP for Mac +# Deploy updates for Microsoft Defender ATP for Linux **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. -To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. By default, MAU automatically checks for updates daily, but you can change that to weekly, monthly, or manually. +To update Microsoft Defender ATP for Linux manually, execute command -![MAU screenshot](images/MDATP_34_MAU.png) +- ### For Debian family distros -If you decide to deploy updates by using your software distribution tools, you should configure MAU to manually check for software updates. You can deploy preferences to configure how and when MAU checks for updates for the Macs in your organization. - -## Use msupdate - -MAU includes a command-line tool, called *msupdate*, that is designed for IT administrators so that they have more precise control over when updates are applied. Instructions for how to use this tool can be found in [Update Office for Mac by using msupdate](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate). - -In MAU, the application identifier for Microsoft Defender ATP for Mac is *WDAV00*. To download and install the latest updates for Microsoft Defender ATP for Mac, execute the following command from a Terminal window: - -``` -./msupdate --install --apps wdav00 +```bash +sudo apt-get install --only-upgrade mdatp ``` -## Set preferences for Microsoft AutoUpdate +- ### For Redhat family distros -This section describes the most common preferences that can be used to configure MAU. These settings can be deployed as a configuration profile through the management console that your enterprise is using. An example of a configuration profile is shown in the following sections. - -### Set the channel name - -The channel determines the type and frequency of updates that are offered through MAU. Devices in `InsiderFast` (corresponding to the Insider Fast channel) can try out new features before devices in `External` (corresponding to the Insider Slow channel) and `Production`. - -The `Production` channel contains the most stable version of the product. - ->[!TIP] ->In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to `InsiderFast` or `External`. - -||| -|:---|:---| -| **Domain** | com.microsoft.autoupdate2 | -| **Key** | ChannelName | -| **Data type** | String | -| **Possible values** | InsiderFast
External
Production | - -### Set update check frequency - -Change how often MAU searches for updates. - -||| -|:---|:---| -| **Domain** | com.microsoft.autoupdate2 | -| **Key** | UpdateCheckFrequency | -| **Data type** | Integer | -| **Default value** | 720 (minutes) | -| **Comment** | This value is set in minutes. | - -### Change how MAU interacts with updates - -Change how MAU searches for updates. - -||| -|:---|:---| -| **Domain** | com.microsoft.autoupdate2 | -| **Key** | HowToCheck | -| **Data type** | String | -| **Possible values** | Manual
AutomaticCheck
AutomaticDownload | -| **Comment** | Note that AutomaticDownload will do a download and install silently if possible. | - -### Change whether the "Check for Updates" button is enabled - -Change whether local users will be able to click the "Check for Updates" option in the Microsoft AutoUpdate user interface. - -||| -|:---|:---| -| **Domain** | com.microsoft.autoupdate2 | -| **Key** | EnableCheckForUpdatesButton | -| **Data type** | Boolean | -| **Possible values** | True (default)
False | - -### Disable Insider checkbox - -Set to true to make the "Join the Office Insider Program..." checkbox unavailable / greyed out to users. - -||| -|:---|:---| -| **Domain** | com.microsoft.autoupdate2 | -| **Key** | DisableInsiderCheckbox | -| **Data type** | Boolean | -| **Possible values** | False (default)
True | - -### Limit the telemetry that is sent from MAU - -Set to false to send minimal heartbeat data, no application usage, and no environment details. - -||| -|:---|:---| -| **Domain** | com.microsoft.autoupdate2 | -| **Key** | SendAllTelemetryEnabled | -| **Data type** | Boolean | -| **Possible values** | True (default)
False | - -## Example configuration profile - -The following configuration profile is used to: -- Place the device in the Insider Fast channel -- Automatically download and install updates -- Enable the "Check for updates" button in the user interface -- Allow users on the device to enroll into the Insider channels - -### JAMF - -```XML - - - - - ChannelName - InsiderFast - HowToCheck - AutomaticDownload - EnableCheckForUpdatesButton - - DisableInsiderCheckbox - - SendAllTelemetryEnabled - - - +```bash +sudo yum update mdatp ``` - -### Intune - -```XML - - - - - PayloadUUID - B762FF60-6ACB-4A72-9E72-459D00C936F3 - PayloadType - Configuration - PayloadOrganization - Microsoft - PayloadIdentifier - com.microsoft.autoupdate2 - PayloadDisplayName - Microsoft AutoUpdate settings - PayloadDescription - Microsoft AutoUpdate configuration settings - PayloadVersion - 1 - PayloadEnabled - - PayloadRemovalDisallowed - - PayloadScope - System - PayloadContent - - - PayloadUUID - 5A6F350A-CC2C-440B-A074-68E3F34EBAE9 - PayloadType - com.microsoft.autoupdate2 - PayloadOrganization - Microsoft - PayloadIdentifier - com.microsoft.autoupdate2 - PayloadDisplayName - Microsoft AutoUpdate configuration settings - PayloadDescription - - PayloadVersion - 1 - PayloadEnabled - - ChannelName - InsiderFast - HowToCheck - AutomaticDownload - EnableCheckForUpdatesButton - - DisableInsiderCheckbox - - SendAllTelemetryEnabled - - - - - -``` - -To configure MAU, you can deploy this configuration profile from the management tool that your enterprise is using: -- From JAMF, upload this configuration profile and set the Preference Domain to *com.microsoft.autoupdate2*. -- From Intune, upload this configuration profile and set the custom configuration profile name to *com.microsoft.autoupdate2*. - -## Resources - -- [msupdate reference](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate) \ No newline at end of file From 45ff7b35a75022791a9fb7bf79f008c662e11e10 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 22 Oct 2019 18:36:52 +0530 Subject: [PATCH 10/69] Update linux resources and preferences document Update linux resources and preferences document --- .../microsoft-defender-atp-linux-preferences.md | 2 +- .../microsoft-defender-atp-linux-resources.md | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md index c203ebd24c..9a8245fa7f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md @@ -331,4 +331,4 @@ The following configuration profile contains entries for all settings described ## Configuration profile deployment -Once you've built the configuration profile for your enterprise, you can deploy it through the management tool that your enterprise is using. +Once you've built the configuration profile for your enterprise, you can deploy it through the management tool that your enterprise is using. Microsoft M reads the managed configuration from the file */etc/opt/microsoft/mdatp/managed/mdatp_managed.json* diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md index 2f67653ec0..dffd8f9839 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md @@ -1,8 +1,8 @@ --- -title: Microsoft Defender ATP for Mac Resources +title: Microsoft Defender ATP for Linux Resources ms.reviewer: -description: Describes resources for Microsoft Defender ATP for Mac, including how to uninstall it, how to collect diagnostic logs, CLI commands, and known issues with the product. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +description: Describes resources for Microsoft Defender ATP for Linux, including how to uninstall it, how to collect diagnostic logs, CLI commands, and known issues with the product. +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -22,7 +22,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) ## Collecting diagnostic information @@ -64,7 +64,7 @@ The detailed log will be saved to /Library/Logs/Microsoft/mdatp/install.log. If ## Uninstalling -There are several ways to uninstall Microsoft Defender ATP for Mac. Please note that while centrally managed uninstall is available on JAMF, it is not yet available for Microsoft Intune. +There are several ways to uninstall Microsoft Defender ATP for Linux. Please note that while centrally managed uninstall is available on JAMF, it is not yet available for Microsoft Intune. ### Interactive uninstallation From 11268bd85f98d8a9b485057288b55927e16e504a Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 22 Oct 2019 18:42:53 +0530 Subject: [PATCH 11/69] Minor fixes Minor fixes --- .../microsoft-defender-atp-linux-install-with-puppet.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md index 63a75eb001..2977bcf490 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md @@ -28,7 +28,6 @@ This topic describes how to deploy Microsoft Defender ATP for Linux through Pupp - [Download installation and onboarding packages](#download-onboarding-package) - [Create Puppet manifest](#create-puppet-manifest) -- [Client device setup](#client-device-setup) - [Deployment](#deployment) - [Check onboarding status](#check-onboarding-status) From b89daf5ed14730bc2e44faedf043e62e5317cda2 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Thu, 24 Oct 2019 12:36:47 +0530 Subject: [PATCH 12/69] Incorporated review comments. --- ...oft-defender-atp-linux-install-manually.md | 53 +++++++++---------- ...-defender-atp-linux-install-with-puppet.md | 14 ++--- ...icrosoft-defender-atp-linux-preferences.md | 25 +-------- .../microsoft-defender-atp-linux-resources.md | 13 ++--- .../microsoft-defender-atp-linux.md | 17 +----- 5 files changed, 42 insertions(+), 80 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md index 7116f0b7ef..7e214e9a60 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md @@ -39,30 +39,24 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic Follow the steps given in [Configure Microsoft's Linux Software Repository](https://docs.microsoft.com/en-us/windows-server/administration/linux-package-repository-for-microsoft-software) to setup the repository. -> [!NOTE] -> * **TODO:** Use a forward link for above instead of URL -> * I am assuming that ring 0 customers will download the onboarding package from ATP portal - ## Download onboarding package -Download the onboarding package from Windows Defender Security Center: +Download the onboarding package from Microsoft Defender Security Center: -1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**. -3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. +1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. +2. In the first drop down, set operating system to **Windows 10** and in second drop down, Deployment method to **Mobile Device Management / Microsoft Intune**. +3. Click on **Download package**. Save it as WindowsDefenderATPOnboardingPackage.zip. - ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_page.png) + ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_win_intune.png) 4. From a command prompt, verify that you have the file. - Extract the contents of the .zip file: + Extract the contents of the .zip file and create mdatp_onboard.json file as follows: ```bash $ ls -l total 8 -rw-r--r-- 1 test staff 6287 Oct 21 11:22 WindowsDefenderATPOnboardingPackage.zip - $ unzip WindowsDefenderATPOnboardingPackage.zip - Archive: WindowsDefenderATPOnboardingPackage.zip - inflating: WindowsDefenderATPOnboarding.py + $ unzip -p WindowsDefenderATPOnboardingPackage.zip | python -c 'import sys,json;data={"onboardingInfo":"\n".join(sys.stdin.readlines())};print(json.dumps(data));' >mdatp_onboard.json ``` ## Application installation @@ -74,13 +68,13 @@ To complete this process, you must have admin privileges on the machine. - ### Enterprise Linux (RHEL and variants) ```bash - sudo yum install mdatp + sudo yum -y install mdatp ``` - ### Ubuntu and Debian systems ```bash - sudo apt-get install mdatp + sudo apt-get -y install mdatp ``` @@ -94,14 +88,11 @@ To complete this process, you must have admin privileges on the machine. $ mdatp --health orgId ``` -2. Run the Python script to install the configuration file: +2. Copy the mdatp_onboard.json created in earlier step to /etc/opt/microsoft/mdatp_onboard.json ```bash - $ /usr/bin/python WindowsDefenderATPOnboarding.py - Generating /etc/opt/microsoft/mdatp/mdatp_onboard.json ... (You may be required to enter sudo password) + $ sudo cp mdatp.json /etc/opt/microsoft/mdatp/mdatp_onboard.json ``` -> [!NOTE] -> **TODO:** verify the path associated with above command. 3. Verify that the machine is now associated with your organization and reports a valid *orgId*: @@ -110,15 +101,23 @@ To complete this process, you must have admin privileges on the machine. E6875323-A6C0-4C60-87AD-114BBE7439B8 ``` -After installation, you can see the status by running the following command: +4. After installation, you can see the status by running the following command: -```bash -$ mdatp --health healthy -1 -``` + ```bash + $ mdatp --health healthy + 1 + ``` -> [!NOTE] -> **TODO:** Should we add eicar detection step? +5. Run a detection test +To verify that the machine is properly onboarded and reporting to the service, take the following steps on the newly onboarded machine: + + - Ensure Real-time protection setting is ON ```mdatp --health realTimeProtectionEnabled``` + - Open a Terminal window +Copy and run the command below: + + ``` bash + curl -o ~/Downloads/eicar.com.txt http://www.eicar.org/download/eicar.com.txt + ``` ## Logging installation issues diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md index 2977bcf490..3731d54b7c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md @@ -35,20 +35,20 @@ This topic describes how to deploy Microsoft Defender ATP for Linux through Pupp Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. -In addition, for Puppet deployment, you need to be familiar with Puppet administration tasks, have a Puppet configured, and know how to deploy packages. Puppet has many ways to complete the same task. These instructions assume availability of supported puppet modules such as *apt*, *lsb-release* to help deploy the package. Your organization might use a different workflow. +In addition, for Puppet deployment, you need to be familiar with Puppet administration tasks, have a Puppet configured, and know how to deploy packages. Puppet has many ways to complete the same task. These instructions assume availability of supported puppet modules such as *apt* to help deploy the package. Your organization might use a different workflow. Please refer to [Puppet documentation](https://puppet.com/docs) for details. ## Download onboarding package -Download the onboarding package from Windows Defender Security Center: +Download the onboarding package from Microsoft Defender Security Center: -1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**. -3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. +1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. +2. In the first drop down, set operating system to **Windows 10** and in second drop down, Deployment method to **Mobile Device Management / Microsoft Intune**. +3. Click on **Download package**. Save it as WindowsDefenderATPOnboardingPackage.zip. ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_win_intune.png) 4. From a command prompt, verify that you have the file. - Extract the contents of the .zip file and create mdatp_onboard.json file as follows + Extract the contents of the .zip file and create mdatp_onboard.json file as follows: ```bash $ ls -l @@ -61,7 +61,7 @@ Download the onboarding package from Windows Defender Security Center: You need to create a puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by puppet server. This example makes use of *apt* module available from puppetlabs and assumes that apt module has been installed on your puppet server. -Create a folders *install_mdatp/files* and *install_mdatp/manifests* under the modules folder of your puppet installation. This typically is located in */etc/puppetlabs/code/environments/production/modules* on your puppet server. Copy the mdatp.json file created in above step to *install_mdatp/files* folder. Create *init.pp* file which will contain the deployment instructions. +Create a folders *install_mdatp/files* and *install_mdatp/manifests* under the modules folder of your puppet installation. This typically is located in */etc/puppetlabs/code/environments/production/modules* on your puppet server. Copy the mdatp_onboard.json file created in above step to *install_mdatp/files* folder. Create *init.pp* file which will contain the deployment instructions. ```bash $ pwd diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md index 9a8245fa7f..eb249f3fe3 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md @@ -35,13 +35,9 @@ This topic describes the structure of this profile (including a recommended prof The configuration profile is a .json file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can either be simple (such as a numerical value) or complex, such as a nested list of preferences. -The top level of the configuration profile includes product-wide preferences and entries for subareas of the product, which are explained in more detail in the next sections. +Typically, you would use a configuration management tool to push a file with name ```mdatp_maanged.json``` at location ```/etc/opt/microsoft/mdatp/managed/``` ->[!NOTE] -> **TODO:** -> * Should Domain be removed from all the entries below? -> * Should we add path to wdavcfg? -> * Verify each of below? +The top level of the configuration profile includes product-wide preferences and entries for subareas of the product, which are explained in more detail in the next sections. ### Antivirus engine preferences @@ -49,7 +45,6 @@ The *antivirusEngine* section of the configuration profile is used to manage the ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | antivirusEngine | | **Data type** | Dictionary (nested preference) | | **Comments** | See the following sections for a description of the dictionary contents. | @@ -60,7 +55,6 @@ Whether real-time protection (scan files as they are accessed) is enabled or not ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | enableRealTimeProtection | | **Data type** | Boolean | | **Possible values** | true (default)
false | @@ -76,7 +70,6 @@ Whether the antivirus engine runs in passive mode or not. In passive mode: ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | passiveMode | | **Data type** | Boolean | | **Possible values** | false (default)
true | @@ -88,7 +81,6 @@ Entities that have been excluded from the scan. Exclusions can be specified by f ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | exclusions | | **Data type** | Dictionary (nested preference) | | **Comments** | See the following sections for a description of the dictionary contents. | @@ -99,7 +91,6 @@ Specifies the type of content excluded from the scan. ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | $type | | **Data type** | String | | **Possible values** | excludedPath
excludedFileExtension
excludedFileName | @@ -110,7 +101,6 @@ Used to exclude content from the scan by full file path. ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | path | | **Data type** | String | | **Possible values** | valid paths | @@ -122,7 +112,6 @@ Indicates if the *path* property refers to a file or directory. ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | isDirectory | | **Data type** | Boolean | | **Possible values** | false (default)
true | @@ -134,7 +123,6 @@ Used to exclude content from the scan by file extension. ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | extension | | **Data type** | String | | **Possible values** | valid file extensions | @@ -146,7 +134,6 @@ Used to exclude content from the scan by file name. ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | name | | **Data type** | String | | **Possible values** | any string | @@ -158,7 +145,6 @@ List of threats (identified by their name) that are not blocked by the product a ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | allowedThreats | | **Data type** | Array of strings | @@ -168,7 +154,6 @@ The *threatTypeSettings* preference in the antivirus engine is used to control h ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | threatTypeSettings | | **Data type** | Dictionary (nested preference) | | **Comments** | See the following sections for a description of the dictionary contents. | @@ -179,7 +164,6 @@ Type of the threat for which the behavior is configured. ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | key | | **Data type** | String | | **Possible values** | potentially_unwanted_application
archive_bomb | @@ -194,7 +178,6 @@ Action to take when coming across a threat of the type specified in the precedin ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | value | | **Data type** | String | | **Possible values** | audit (default)
block
off | @@ -205,7 +188,6 @@ The *cloudService* entry in the configuration profile is used to configure the c ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | cloudService | | **Data type** | Dictionary (nested preference) | | **Comments** | See the following sections for a description of the dictionary contents. | @@ -216,7 +198,6 @@ Whether cloud delivered protection is enabled on the device or not. To improve t ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | enabled | | **Data type** | Boolean | | **Possible values** | true (default)
false | @@ -227,7 +208,6 @@ Diagnostic data is used to keep Microsoft Defender ATP secure and up-to-date, de ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | diagnosticLevel | | **Data type** | String | | **Possible values** | optional (default)
required | @@ -238,7 +218,6 @@ Determines whether suspicious samples (that are likely to contain threats) are s ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | automaticSampleSubmission | | **Data type** | Boolean | | **Possible values** | true (default)
false | diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md index dffd8f9839..295efbedca 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md @@ -60,19 +60,16 @@ If you can reproduce a problem, please increase the logging level, run the syste If an error occurs during installation, the installer will only report a general failure. -The detailed log will be saved to /Library/Logs/Microsoft/mdatp/install.log. If you experience issues during installation, send us this file so we can help diagnose the cause. +The detailed log will be saved to /var/log/microsoft/mdatp_install.log. If you experience issues during installation, send us this file so we can help diagnose the cause. ## Uninstalling -There are several ways to uninstall Microsoft Defender ATP for Linux. Please note that while centrally managed uninstall is available on JAMF, it is not yet available for Microsoft Intune. +There are several ways to uninstall Microsoft Defender ATP for Linux. If you are using a configuration tool such as Puppet, please follow the package uninstallation instructions for the configuration tool. -### Interactive uninstallation +### Manual uninstallation -- Open **Finder > Applications**. Right click on **Microsoft Defender ATP > Move to Trash**. - -### From the command line - -- ```sudo rm -rf '/Applications/Microsoft Defender ATP'``` +- ```sudo apt-get purge mdatp``` for Debian and Ubuntu systems +- ```sudo yum remove mdatp``` for RHEL, Oracle Linux, CentOS based systems ## Configuring from the command line diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index 83c84689a0..fa8fb3cbe0 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -25,12 +25,6 @@ This topic describes how to install, configure, update, and use Microsoft Defend > [!CAUTION] > Running other third-party endpoint protection products alongside Microsoft Defender ATP for Linux is likely to lead to performance problems and unpredictable side effects. -> [!NOTE] ->How would users give us feedback? -> **TODO:** Should we add atp --feedback "Feedback" that will send the feedback to us / OCV. I am keeping the original line for reference. -> -> If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**. - ## How to install Microsoft Defender ATP for Linux ### Prerequisites @@ -41,14 +35,10 @@ This topic describes how to install, configure, update, and use Microsoft Defend ### System requirements -- Supported Linux distributions and versions: RHEL 7, Oracle 7, CentOS 7, Ubuntu 16 and 18, Debian 9 +- Supported Linux server distributions and versions: RHEL 7, Oracle Linux 7, CentOS 7, Ubuntu 16 and 18, Debian 9 - Disk space: 650 MB. -> [!NOTE] ->**TODO**: Verify this -After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints. - -The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. +If your Linux server is behind firewall or proxy, you will likely need to allow outbound connections between it and following servers. The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. | Service location | DNS record | | ---------------------------------------- | ----------------------- | @@ -57,9 +47,6 @@ The following table lists the services and their associated URLs that your netwo | United Kingdom | unitedkingdom.x.cp.wd.microsoft.com | | United States | unitedstates.x.cp.wd.microsoft.com | ->[!NOTE] -> **TODO:** Verify the proxy paragraph - Microsoft Defender ATP can discover a proxy server by using the following discovery methods: - Web Proxy Auto-discovery Protocol (WPAD) - Manual static proxy configuration From 4c1a75e607b501e4616499f53109c91798090ab0 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Thu, 24 Oct 2019 12:38:07 +0530 Subject: [PATCH 13/69] Deleting private and pua handling for now. --- .../microsoft-defender-atp-linux-privacy.md | 273 ------------------ .../microsoft-defender-atp-linux-pua.md | 69 ----- 2 files changed, 342 deletions(-) delete mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md delete mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md deleted file mode 100644 index 0e2884b388..0000000000 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md +++ /dev/null @@ -1,273 +0,0 @@ ---- -title: Privacy for Microsoft Defender ATP for Linux -ms.reviewer: -description: Describes privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Linux. -keywords: microsoft, defender, atp, linux, privacy, diagnostic -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dansimp -author: dansimp -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual ---- - -# Privacy for Microsoft Defender ATP for Linux - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) - -Microsoft is committed to providing you with the information and controls you need to make choices about how your data is collected and used when you’re using Microsoft Defender ATP for Linux. - -This topic describes the privacy controls available within the product, how to manage these controls with policy settings and more details on the data events that are collected. - -## Overview of privacy controls in Microsoft Defender ATP for Linux - -This section describes the privacy controls for the different types of data collected by Microsoft Defender ATP for Linux. - -### Diagnostic data - -Diagnostic data is used to keep Microsoft Defender ATP secure and up-to-date, detect, diagnose and fix problems, and also make product improvements. - -Some diagnostic data is required, while some diagnostic data is optional. We give you the ability to choose whether to send us required or optional diagnostic data through the use of privacy controls, such as policy settings for organizations. - -There are two levels of diagnostic data for Microsoft Defender ATP client software that you can choose from: - -* **Required**: The minimum data necessary to help keep Microsoft Defender ATP secure, up-to-date, and performing as expected on the device it’s installed on. - -* **Optional**: Additional data that helps Microsoft make product improvements and provides enhanced information to help detect, diagnose, and remediate issues. - -By default, both optional and required diagnostic data are sent to Microsoft. - -### Cloud delivered protection data - -Cloud delivered protection is used to provide increased and faster protection with access to the latest protection data in the cloud. - -Enabling the cloud-delivered protection service is optional, however it is highly recommended because it provides important protection against malware on your endpoints and across your network. - -### Sample data - -Sample data is used to improve the protection capabilities of the product, by sending Microsoft suspicious samples so they can be analyzed. Enabling automatic sample submission is optional. - -When this feature is enabled and the sample that is collected is likely to contain personal information, the user is prompted for consent. - -## Manage privacy controls with policy settings - -If you're an IT administrator, you might want to configure these controls at the enterprise level. - -The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md). - -As with any new policy settings, you should carefully test them out in a limited, controlled environment to ensure the settings that you configure have the desired effect before you implement the policy settings more widely in your organization. - -## Diagnostic data events - -This section describes what is considered required diagnostic data and what is considered optional diagnostic data, along with a description of the events and fields that are collected. - -### Data fields that are common for all events -There is some information about events that is common to all events, regardless of category or data subtype. - -The following fields are considered common for all events: - -| Field | Description | -| ----------------------- | ----------- | -| platform | The broad classification of the platform on which the app is running. Allows Microsoft to identify on which platforms an issue may be occurring so that it can correctly be prioritized. | -| machine_guid | Unique identifier associated with the device. Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | -| sense_guid | Unique identifier associated with the device. Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | -| org_id | Unique identifier associated with the enterprise that the device belongs to. Allows Microsoft to identify whether issues are impacting a select set of enterprises and how many enterprises are impacted. | -| hostname | Local machine name (without DNS suffix). Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | -| product_guid | Unique identifier of the product. Allows Microsoft to differentiate issues impacting different flavors of the product. | -| app_version | Version of the Microsoft Defender ATP for Linux application. Allows Microsoft to identify which versions of the product are showing an issue so that it can correctly be prioritized.| -| sig_version | Version of security intelligence database. Allows Microsoft to identify which versions of the security intelligence are showing an issue so that it can correctly be prioritized. | -| supported_compressions | List of compression algorithms supported by the application, for example `['gzip']`. Allows Microsoft to understand what types of compressions can be used when it communicates with the application. | -| release_ring | Ring that the device is associated with (for example Insider Fast, Insider Slow, Production). Allows Microsoft to identify on which release ring an issue may be occurring so that it can correctly be prioritized. | - - -### Required diagnostic data - -**Required diagnostic data** is the minimum data necessary to help keep Microsoft Defender ATP secure, up-to-date, and perform as expected on the device it’s installed on. - -Required diagnostic data helps to identify problems with Microsoft Defender ATP that may be related to a device or software configuration. For example, it can help determine if a Microsoft Defender ATP feature crashes more frequently on a particular operating system version, with newly introduced features, or when certain Microsoft Defender ATP features are disabled. Required diagnostic data helps Microsoft detect, diagnose, and fix these problems more quickly so the impact to users or organizations is reduced. - -#### Software setup and inventory data events - -> [!NOTE] -> **TODO:** Please review if all the following fields are valid for linux as well - -**Microsoft Defender ATP installation / uninstallation** - -The following fields are collected: - -| Field | Description | -| ---------------- | ----------- | -| correlation_id | Unique identifier associated with the installation. | -| version | Version of the package. | -| severity | Severity of the message (for example Informational). | -| code | Code that describes the operation. | -| text | Additional information associated with the product installation. | - -**Microsoft Defender ATP configuration** - -The following fields are collected: - -| Field | Description | -| --------------------------------------------------- | ----------- | -| antivirus_engine.enable_real_time_protection | Whether real-time protection is enabled on the device or not. | -| antivirus_engine.passive_mode | Whether passive mode is enabled on the device or not. | -| cloud_service.enabled | Whether cloud delivered protection is enabled on the device or not. | -| cloud_service.timeout | Time out when the application communicates with the Microsoft Defender ATP cloud. | -| cloud_service.heartbeat_interval | Interval between consecutive heartbeats sent by the product to the cloud. | -| cloud_service.service_uri | URI used to communicate with the cloud. | -| cloud_service.diagnostic_level | Diagnostic level of the device (required, optional). | -| cloud_service.automatic_sample_submission | Whether automatic sample submission is turned on or not. | -| edr.early_preview | Whether the machine should run EDR early preview features. | -| edr.group_id | Group identifier used by the detection and response component. | -| edr.tags | User-defined tags. | -| features.\[optional feature name\] | List of preview features, along with whether they are enabled or not. | - -#### Product and service performance data events - -> [!NOTE] -> **TODO:** Please review if all the following fields are valid for linux as well - -**Kernel extension statistics** - -The following fields are collected: - -| Field | Description | -| ---------------- | ----------- | -| version | Version of Microsoft Defender ATP for Linux. | -| instance_id | Unique identifier generated on kernel extension startup. | -| trace_level | Trace level of the kernel extension. | -| ipc.connects | Number of connection requests received by the kernel extension. | -| ipc.rejects | Number of connection requests rejected by the kernel extension. | -| ipc.connected | Whether there is any active connection to the kernel extension. | - -#### Support data - -**Diagnostic logs** - -Diagnostic logs are collected only with the consent of the user as part of the feedback submission feature. The following files are collected as part of the support logs: - -- All files under */var/log/microsoft/mdatp/* -- Subset of files under */var/opt/microsoft/mdatp/* that are created and used by Microsoft Defender ATP for Linux -- Subset of files under */etc/opt/microsoft/mdatp/* that are used by Microsoft Defender ATP for Linux - -### Optional diagnostic data - -**Optional diagnostic data** is additional data that helps Microsoft make product improvements and provides enhanced information to help detect, diagnose, and fix issues. - -If you choose to send us optional diagnostic data, required diagnostic data is also included. - -Examples of optional diagnostic data include data Microsoft collects about product configuration (for example number of exclusions set on the device) and product performance (aggregate measures about the performance of components of the product). - -#### Software setup and inventory data events - -**Microsoft Defender ATP configuration** - -The following fields are collected: - -| Field | Description | -| -------------------------------------------------- | ----------- | -| connection_retry_timeout | Connection retry time out when communication with the cloud. | -| file_hash_cache_maximum | Size of the product cache. | -| crash_upload_daily_limit | Limit of crash logs uploaded daily. | -| antivirus_engine.exclusions[].is_directory | Whether the exclusion from scanning is a directory or not. | -| antivirus_engine.exclusions[].path | Path that was excluded from scanning. | -| antivirus_engine.exclusions[].extension | Extension excluded from scanning. | -| antivirus_engine.exclusions[].name | Name of the file excluded from scanning. | -| antivirus_engine.scan_cache_maximum | Size of the product cache. | -| antivirus_engine.maximum_scan_threads | Maximum number of threads used for scanning. | -| antivirus_engine.threat_restoration_exclusion_time | Time out before a file restored from the quarantine can be detected again. | -| filesystem_scanner.full_scan_directory | Full scan directory. | -| filesystem_scanner.quick_scan_directories | List of directories used in quick scan. | -| edr.latency_mode | Latency mode used by the detection and response component. | -| edr.proxy_address | Proxy address used by the detection and response component. | - -### Product and service usage - -#### Diagnostic log upload started report - -The following fields are collected: - -| Field | Description | -| ---------------- | ----------- | -| sha256 | SHA256 identifier of the support log. | -| size | Size of the support log. | -| original_path | Path to the support log (always under */var/opt/microsoft/mdatp/wdavdiag/*). | -| format | Format of the support log. | - -#### Diagnostic log upload completed report - -The following fields are collected: - -| Field | Description | -| ---------------- | ----------- | -| request_id | Correlation ID for the support log upload request. | -| sha256 | SHA256 identifier of the support log. | -| blob_sas_uri | URI used by the application to upload the support log. | - -#### Product and service performance data events - -**Unexpected application exit (crash)** - -Unexpected application exits and the state of the application when that happens. - -**Kernel extension statistics** - -> [!NOTE] -> **TODO:** Is this valid for Linux as well? - -The following fields are collected: - -| Field | Description | -| ------------------------------ | ----------- | -| pkt_ack_timeout | The following properties are aggregated numerical values, representing count of events that happened since kernel extension startup. | -| pkt_ack_conn_timeout | | -| ipc.ack_pkts | | -| ipc.nack_pkts | | -| ipc.send.ack_no_conn | | -| ipc.send.nack_no_conn | | -| ipc.send.ack_no_qsq | | -| ipc.send.nack_no_qsq | | -| ipc.ack.no_space | | -| ipc.ack.timeout | | -| ipc.ack.ackd_fast | | -| ipc.ack.ackd | | -| ipc.recv.bad_pkt_len | | -| ipc.recv.bad_reply_len | | -| ipc.recv.no_waiter | | -| ipc.recv.copy_failed | | -| ipc.kauth.vnode.mask | | -| ipc.kauth.vnode.read | | -| ipc.kauth.vnode.write | | -| ipc.kauth.vnode.exec | | -| ipc.kauth.vnode.del | | -| ipc.kauth.vnode.read_attr | | -| ipc.kauth.vnode.write_attr | | -| ipc.kauth.vnode.read_ex_attr | | -| ipc.kauth.vnode.write_ex_attr | | -| ipc.kauth.vnode.read_sec | | -| ipc.kauth.vnode.write_sec | | -| ipc.kauth.vnode.take_own | | -| ipc.kauth.vnode.denied | | -| ipc.kauth.file_op.mask | | -| ipc.kauth_file_op.open | | -| ipc.kauth.file_op.close | | -| ipc.kauth.file_op.close_modified | | -| ipc.kauth.file_op.move | | -| ipc.kauth.file_op.link | | -| ipc.kauth.file_op.exec | | -| ipc.kauth.file_op.remove | | -| ipc.kauth.file_op.fork | | -| ipc.kauth.file_op.create | | - -## Resources - -- [Privacy at Microsoft](https://privacy.microsoft.com/) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md deleted file mode 100644 index 2ff866b692..0000000000 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Detect and block potentially unwanted applications -ms.reviewer: -description: Describes how to detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Linux. -keywords: microsoft, defender, atp, linux, pua, pus -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dansimp -author: dansimp -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual ---- - -# Detect and block potentially unwanted applications - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) - -The potentially unwanted application (PUA) protection feature in Microsoft Defender ATP for Linux can detect and block PUA files on endpoints in your network. - -These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have poor reputation. - -These applications can increase the risk of your network being infected with malware, cause malware infections to be harder to identify, and can waste IT resources in cleaning up the applications. - -## How it works - -Microsoft Defender ATP for Linux can detect and report PUA files. When configured in blocking mode, PUA files are moved to the quarantine. - -When a PUA is detected on an endpoint, Microsoft Defender ATP for Linux presents a notification to the user, unless notifications have been disabled. The threat name will contain the word "Application". - -> [!NOTE] -> **TODO:** Reword for Linux - -## Configure PUA protection - -PUA protection in Microsoft Defender ATP for Linux can be configured in one of the following ways: - -- **Off**: PUA protection is disabled. -- **Audit**: PUA files are reported in the product logs, but not in Microsoft Defender Security Center. No notification is presented to the user and no action is taken by the product. -- **Block**: PUA files are reported in the product logs and in Microsoft Defender Security Center. The user is presented with a notification and action is taken by the product. - ->[!WARNING] ->By default, PUA protection is configured in **Audit** mode. - -You can configure how PUA files are handled from the command line or from the management console. - -### Use the command-line tool to configure PUA protection: - -In Terminal, execute the following command to configure PUA protection: - -```bash -$ mdatp --threat --type-handling potentially_unwanted_application [off|audit|block] -``` - -### Use the management console to configure PUA protection: - -In your enterprise, you can configure PUA protection from a management console, such as Puppet, similarly to how other product settings are configured. For more information, see the [Threat type settings](microsoft-defender-atp-linux-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md) topic. - -## Related topics - -- [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md) From 36f37faf2136fc96a5422250f4eb16985ae8863a Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Thu, 24 Oct 2019 17:33:25 +0530 Subject: [PATCH 14/69] added mdatp --connectivity-test --- .../microsoft-defender-atp-linux.md | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index fa8fb3cbe0..1d5f12dde9 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -63,10 +63,22 @@ $ curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'http The output from this command should be similar to the following: -> `OK https://x.cp.wd.microsoft.com/api/report` -> +> `OK https://x.cp.wd.microsoft.com/api/report` > `OK https://cdn.x.cp.wd.microsoft.com/ping` +You can also use ```mdatp --connectivity-test``` to verify the connectivity. + +```bash +$ mdatp --connectivity-test +Running connectivity test +Testing connection with https://cdn.x.cp.wd.microsoft.com/ping ... [OK] +Testing connection with https://eu-cdn.x.cp.wd.microsoft.com/ping ... [OK] +Testing connection with https://wu-cdn.x.cp.wd.microsoft.com/ping ... [OK] +Testing connection with https://unitedstates.x.cp.wd.microsoft.com/api/report ... [OK] +Testing connection with https://ussus1eastprod.blob.core.windows.net ... [OK] +Testing connection with https://ussus1westprod.blob.core.windows.net ... [OK] +``` + ### Installation instructions There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Linux. @@ -84,8 +96,6 @@ In general you need to take the following steps: ## How to update Microsoft Defender ATP for Linux ->[!NOTE] -> **TODO:** Upgrade story is not very clear right now! Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Linux, refer to [Deploy updates for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-updates.md) From 952179cbf11efe22fa98b4362e3e23c7209acafb Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Wed, 30 Oct 2019 16:13:21 +0530 Subject: [PATCH 15/69] Added section on known issues to overview page Added section on known issues to overview page --- .../microsoft-defender-atp-linux.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index 1d5f12dde9..c360a259ba 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -103,6 +103,13 @@ Microsoft regularly publishes software updates to improve performance, security, Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md). +## Known Issues + +- Logged on users do not appear in the ATP portal +- Quarantining a threat requires elevated permissions. Run with ```sudo mdatp --threat --quarantine ``` +- Product has not been evaluated yet side by side with SELinux + + ## Resources - For more information about logging, uninstalling, or other topics, see the [Resources](microsoft-defender-atp-linux-resources.md) page. From afa2a24c3b675b44f1ebb4bdfaa0601a4eb9c5f4 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Fri, 15 Nov 2019 13:38:53 -0800 Subject: [PATCH 16/69] Update supported distros --- .../microsoft-defender-atp-linux.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index c360a259ba..e582b3ace6 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -35,7 +35,14 @@ This topic describes how to install, configure, update, and use Microsoft Defend ### System requirements -- Supported Linux server distributions and versions: RHEL 7, Oracle Linux 7, CentOS 7, Ubuntu 16 and 18, Debian 9 +- Supported Linux server distributions and versions: + + - Red Hat Enterprise Linux 7 or higher + - CentOS 7 or higher + - Ubuntu 16.04 LTS or higher + - Debian 9 or higher + - SUSE Linux Enterprise Server 12 or higher + - Disk space: 650 MB. If your Linux server is behind firewall or proxy, you will likely need to allow outbound connections between it and following servers. The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. @@ -48,7 +55,7 @@ If your Linux server is behind firewall or proxy, you will likely need to allow | United States | unitedstates.x.cp.wd.microsoft.com | Microsoft Defender ATP can discover a proxy server by using the following discovery methods: -- Web Proxy Auto-discovery Protocol (WPAD) +- Transparent proxy - Manual static proxy configuration If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs. @@ -96,7 +103,6 @@ In general you need to take the following steps: ## How to update Microsoft Defender ATP for Linux - Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Linux, refer to [Deploy updates for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-updates.md) ## How to configure Microsoft Defender ATP for Linux From b427164ccedbc5c0671dcd210f0992fa62ec54d9 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Fri, 15 Nov 2019 13:52:59 -0800 Subject: [PATCH 17/69] Clarify ubuntu --- .../windows-defender-antivirus/microsoft-defender-atp-linux.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index e582b3ace6..ae7104ff7f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -39,7 +39,7 @@ This topic describes how to install, configure, update, and use Microsoft Defend - Red Hat Enterprise Linux 7 or higher - CentOS 7 or higher - - Ubuntu 16.04 LTS or higher + - Ubuntu 16.04 LTS or higher LTS - Debian 9 or higher - SUSE Linux Enterprise Server 12 or higher From c45c45ebe51dd9d51c82dd6a0cce22234d8a649e Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 21 Oct 2019 09:54:39 +0530 Subject: [PATCH 18/69] First set of pages for Linux Copied from Mac --- ...oft-defender-atp-linux-install-manually.md | 185 ++++++ ...defender-atp-linux-install-with-ansible.md | 259 ++++++++ ...atp-linux-install-with-other-configtool.md | 79 +++ ...-defender-atp-linux-install-with-puppet.md | 253 +++++++ ...icrosoft-defender-atp-linux-preferences.md | 623 ++++++++++++++++++ .../microsoft-defender-atp-linux-privacy.md | 277 ++++++++ .../microsoft-defender-atp-linux-pua.md | 66 ++ .../microsoft-defender-atp-linux-resources.md | 118 ++++ .../microsoft-defender-atp-linux-updates.md | 219 ++++++ .../microsoft-defender-atp-linux.md | 113 ++++ 10 files changed, 2192 insertions(+) create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md create mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md new file mode 100644 index 0000000000..bed05f108c --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md @@ -0,0 +1,185 @@ +--- +title: Installing Microsoft Defender ATP for Mac manually +ms.reviewer: +description: Describes how to install Microsoft Defender ATP for Mac manually, from the command line. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Manual deployment + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +This topic describes how to deploy Microsoft Defender ATP for Mac manually. A successful deployment requires the completion of all of the following steps: +- [Download installation and onboarding packages](#download-installation-and-onboarding-packages) +- [Application installation](#application-installation) +- [Client configuration](#client-configuration) + +## Prerequisites and system requirements + +Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. + +## Download installation and onboarding packages + +Download the installation and onboarding packages from Windows Defender Security Center: + +1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**. +2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**. +3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory. +4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. + + ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_page.png) + +5. From a command prompt, verify that you have the two files. + Extract the contents of the .zip files: + + ```bash + $ ls -l + total 721152 + -rw-r--r-- 1 test staff 6185 Mar 15 10:45 WindowsDefenderATPOnboardingPackage.zip + -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg + $ unzip WindowsDefenderATPOnboardingPackage.zip + Archive: WindowsDefenderATPOnboardingPackage.zip + inflating: WindowsDefenderATPOnboarding.py + ``` + +## Application installation + +To complete this process, you must have admin privileges on the machine. + +1. Navigate to the downloaded wdav.pkg in Finder and open it. + + ![App install screenshot](images/MDATP_28_AppInstall.png) + +2. Select **Continue**, agree with the License terms, and enter the password when prompted. + + ![App install screenshot](images/MDATP_29_AppInstallLogin.png) + + > [!IMPORTANT] + > You will be prompted to allow a driver from Microsoft to be installed (either "System Exception Blocked" or "Installation is on hold" or both. The driver must be allowed to be installed. + + ![App install screenshot](images/MDATP_30_SystemExtension.png) + +3. Select **Open Security Preferences** or **Open System Preferences > Security & Privacy**. Select **Allow**: + + ![Security and privacy window screenshot](images/MDATP_31_SecurityPrivacySettings.png) + +The installation proceeds. + +> [!NOTE] +> If you don't select **Allow**, the installation will proceed after 5 minutes. Defender ATP will be loaded, but real-time protection will be disabled. + +> [!NOTE] +> macOS may request to reboot the machine upon the first installation of Microsoft Defender. Real-Time Protection will not be available until the machine is rebooted. + +### Fixing disabled Real-Time Protection + +If you did not enable Microsoft's driver during installation, then the application displays a banner prompting you to enable it: + + ![RTP disabled screenshot](images/MDATP_32_Main_App_Fix.png) + +You can also run ```mdatp --health```. It reports if Real-Time Protection is enabled but not available: + +```bash +$ mdatp --health +... +realTimeProtectionAvailable : false +realTimeProtectionEnabled : true +... +``` + +> [!NOTE] +> You have a 30 minute window to enable Real-Time Protection from the warning banner, immediately following installation. + +The warning banner contains a **Fix** button, which allows you to quickly enable Real-Time Protection, without having to open a command prompt. Select the **Fix** button. It prompts the **Security & Privacy** system window, where you have to **Allow** system software from developers "Microsoft Corporation". + +If you don't see a prompt, it means that 30 or more minutes have already passed, and Real-Time Protection has still not been enabled: + +![Security and privacy window after prompt expired screenshot](images/MDATP_33_SecurityPrivacySettings_NoPrompt.png) + +In this case, you need to perform the following steps to enable Real-Time Protection instead. + +1. In Terminal, attempt to install the driver. (The operation will fail) + ```bash + $ sudo kextutil /Library/Extensions/wdavkext.kext + Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } + Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } + Diagnostics for /Library/Extensions/wdavkext.kext: + ``` + +2. Open **System Preferences...** > **Security & Privacy** from the menu. (Close it first, if it's opened.) + +3. **Allow** system software from developers "Microsoft Corporation" + +4. In Terminal, install the driver again. This time the operation will succeed: + +```bash +$ sudo kextutil /Library/Extensions/wdavkext.kext +``` + +The banner should disappear from the Defender application, and ```mdatp --health``` should now report that Real-Time Protection is both enabled and available: + +```bash +$ mdatp --health +... +realTimeProtectionAvailable : true +realTimeProtectionEnabled : true +... +``` + +## Client configuration + +1. Copy wdav.pkg and WindowsDefenderATPOnboarding.py to the machine where you deploy Microsoft Defender ATP for Mac. + + The client machine is not associated with orgId. Note that the *orgId* attribute is blank. + + ```bash + $ mdatp --health orgId + ``` + +2. Run the Python script to install the configuration file: + + ```bash + $ /usr/bin/python WindowsDefenderATPOnboarding.py + Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password) + ``` + +3. Verify that the machine is now associated with your organization and reports a valid *orgId*: + + ```bash + $ mdatp --health orgId + E6875323-A6C0-4C60-87AD-114BBE7439B8 + ``` + +After installation, you'll see the Microsoft Defender icon in the macOS status bar in the top-right corner. + + ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) + +## How to Allow Full Disk Access + +> [!CAUTION] +> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device. + +To grant consent, open System Preferences -> Security & Privacy -> Privacy -> Full Disk Access. Click the lock icon to make changes (bottom of the dialog box). Select Microsoft Defender ATP. + +## Logging installation issues + +See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. + +## Uninstallation + +See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md new file mode 100644 index 0000000000..84088ccd42 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md @@ -0,0 +1,259 @@ +--- +title: Installing Microsoft Defender ATP for Mac with JAMF +ms.reviewer: +description: Describes how to install Microsoft Defender ATP for Mac, using JAMF. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# JAMF-based deployment + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +This topic describes how to deploy Microsoft Defender ATP for Mac through JAMF. A successful deployment requires the completion of all of the following steps: +- [Download installation and onboarding packages](#download-installation-and-onboarding-packages) +- [Create JAMF policies](#create-jamf-policies) +- [Client device setup](#client-device-setup) +- [Deployment](#deployment) +- [Check onboarding status](#check-onboarding-status) + +## Prerequisites and system requirements + +Before you get started, please see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. + +In addition, for JAMF deployment, you need to be familiar with JAMF administration tasks, have a JAMF tenant, and know how to deploy packages. This includes having a properly configured distribution point. JAMF has many ways to complete the same task. These instructions provide an example for most common processes. Your organization might use a different workflow. + +## Download installation and onboarding packages + +Download the installation and onboarding packages from Windows Defender Security Center: + +1. In Windows Defender Security Center, go to **Settings > device Management > Onboarding**. +2. In Section 1 of the page, set the operating system to **Linux, macOS, iOS or Android** and deployment method to **Mobile Device Management / Microsoft Intune**. +3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. +4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. + + ![Windows Defender Security Center screenshot](images/MDATP_2_DownloadPackages.png) + +5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so: + + ```bash + $ ls -l + total 721160 + -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip + -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg + $ unzip WindowsDefenderATPOnboardingPackage.zip + Archive: WindowsDefenderATPOnboardingPackage.zip + warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators + inflating: intune/kext.xml + inflating: intune/WindowsDefenderATPOnboarding.xml + inflating: jamf/WindowsDefenderATPOnboarding.plist + ``` + +## Create JAMF policies + +You need to create a configuration profile and a policy to start deploying Microsoft Defender ATP for Mac to client devices. + +### Configuration Profile + +The configuration profile contains a custom settings payload that includes: + +- Microsoft Defender ATP for Mac onboarding information +- Approved Kernel Extensions payload, to enable running the Microsoft kernel driver + +To set the onboarding information, add a property list file with the name, _jamf/WindowsDefenderATPOnboarding.plist_, as a custom setting. You can do this by navigating to **Computers**>**Configuration Profiles**, selecting **New**, then choosing **Custom Settings**>**Configure**. From there, you can upload the property list. + + >[!IMPORTANT] + > You must set the Preference Domain as "com.microsoft.wdav.atp" + +![Configuration profile screenshot](images/MDATP_16_PreferenceDomain.png) + +### Approved Kernel Extension + +To approve the kernel extension: + +1. In **Computers > Configuration Profiles** select **Options > Approved Kernel Extensions**. +2. Use **UBF8T346G9** for Team Id. + +![Approved kernel extensions screenshot](images/MDATP_17_approvedKernelExtensions.png) + +### Privacy Preferences Policy Control + +> [!CAUTION] +> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device. +> +> If you previously configured Microsoft Defender ATP through JAMF, we recommend applying the following configuration. + +Add the following JAMF policy to grant Full Disk Access to Microsoft Defender ATP. + +1. Select **Options > Privacy Preferences Policy Control**. +2. Use any identifier and identifier type = Bundle. +3. Set Code Requirement to `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`. +4. Set app or service to SystemPolicyAllFiles and access to Allow. + +![Privacy Preferences Policy Control](images/MDATP_35_JAMF_PrivacyPreferences.png) + +#### Configuration Profile's Scope + +Configure the appropriate scope to specify the devices that will receive the configuration profile. + +Open **Computers** > **Configuration Profiles**, and select **Scope > Targets**. From there, select the devices you want to target. + +![Configuration profile scope screenshot](images/MDATP_18_ConfigurationProfilesScope.png) + +Save the **Configuration Profile**. + +Use the **Logs** tab to monitor deployment status for each enrolled device. + +### Package + +1. Create a package in **Settings > Computer Management > Packages**. + + ![Computer management packages screenshot](images/MDATP_19_MicrosoftDefenderWDAVPKG.png) + +2. Upload the package to the Distribution Point. +3. In the **filename** field, enter the name of the package. For example, _wdav.pkg_. + +### Policy + +Your policy should contain a single package for Microsoft Defender. + +![Microsoft Defender packages screenshot](images/MDATP_20_MicrosoftDefenderPackages.png) + +Configure the appropriate scope to specify the computers that will receive this policy. + +After you save the Configuration Profile, you can use the Logs tab to monitor the deployment status for each enrolled device. + +## Client device setup + +You'll need no special provisioning for a macOS computer, beyond the standard JAMF Enrollment. + +> [!NOTE] +> After a computer is enrolled, it will show up in the Computers inventory (All Computers). + +1. Open **Device Profiles**, from the **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's currently set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile. + +![MDM approve button screenshot](images/MDATP_21_MDMProfile1.png) +![MDM screenshot](images/MDATP_22_MDMProfileApproved.png) + +After a moment, the device's User Approved MDM status will change to **Yes**. + +![MDM status screenshot](images/MDATP_23_MDMStatus.png) + +You may now enroll additional devices. You may also enroll them later, after you have finished provisioning system configuration and application packages. + +## Deployment + +Enrolled client devices periodically poll the JAMF Server, and install new configuration profiles and policies as soon as they are detected. + +### Status on the server + +You can monitor deployment status in the **Logs** tab: + +- **Pending** means that the deployment is scheduled but has not yet happened +- **Completed** means that the deployment succeeded and is no longer scheduled + +![Status on server screenshot](images/MDATP_24_StatusOnServer.png) + +### Status on client device + +After the Configuration Profile is deployed, you'll see the profile for the device in **System Preferences** > **Profiles >**. + +![Status on client screenshot](images/MDATP_25_StatusOnClient.png) + +Once the policy is applied, you'll see the Microsoft Defender ATP icon in the macOS status bar in the top-right corner. + +![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) + +You can monitor policy installation on a device by following the JAMF log file: + +```bash + $ tail -f /var/log/jamf.log + Thu Feb 21 11:11:41 mavel-mojave jamf[7960]: No patch policies were found. + Thu Feb 21 11:16:41 mavel-mojave jamf[8051]: Checking for policies triggered by "recurring check-in" for user "testuser"... + Thu Feb 21 11:16:43 mavel-mojave jamf[8051]: Executing Policy WDAV + Thu Feb 21 11:17:02 mavel-mojave jamf[8051]: Installing Microsoft Defender... + Thu Feb 21 11:17:23 mavel-mojave jamf[8051]: Successfully installed Microsoft Defender. + Thu Feb 21 11:17:23 mavel-mojave jamf[8051]: Checking for patches... + Thu Feb 21 11:17:23 mavel-mojave jamf[8051]: No patch policies were found. +``` + +You can also check the onboarding status: + +```bash +$ mdatp --health +... +licensed : true +orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" +... +``` + +- **licensed**: This confirms that the device has an ATP license. + +- **orgid**: Your Microsoft Defender ATP org id; it will be the same for your organization. + +## Check onboarding status + +You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status: + +```bash +$ mdatp --health healthy +``` + +The above command prints "1" if the product is onboarded and functioning as expected. + +If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: +- 1 if the device is not yet onboarded +- 3 if the connection to the daemon cannot be established—for example, if the daemon is not running + +## Logging installation issues + +See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. + +## Uninstallation + +This method is based on the script described in [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling). + +### Script + +Create a script in **Settings > Computer Management > Scripts**. + +This script removes Microsoft Defender ATP from the /Applications directory: + +```bash + #!/bin/bash + + echo "Is WDAV installed?" + ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null + + echo "Uninstalling WDAV..." + rm -rf '/Applications/Microsoft Defender ATP.app' + + echo "Is WDAV still installed?" + ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null + + echo "Done!" +``` + +![Microsoft Defender uninstall screenshot](images/MDATP_26_Uninstall.png) + +### Policy + +Your policy should contain a single script: + +![Microsoft Defender uninstall script screenshot](images/MDATP_27_UninstallScript.png) + +Configure the appropriate scope in the **Scope** tab to specify the machines that will receive this policy. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md new file mode 100644 index 0000000000..91a5f56395 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md @@ -0,0 +1,79 @@ +--- +title: Installing Microsoft Defender ATP for Mac with different MDM product +description: Describes how to install Microsoft Defender ATP for Mac on other management solutions. +keywords: microsoft, defender, atp, mac, installation, deploy, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: mavel +author: maximvelichko +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Deployment with a different Mobile Device Management (MDM) system + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +## Prerequisites and system requirements + +Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. + +## Approach + +> [!CAUTION] +> Currently, Microsoft oficially supports only Intune and JAMF for the deployment and management of Microsoft Defender ATP for Mac. Microsoft makes no warranties, express or implied, with respect to the information provided below. + +If your organization uses a Mobile Device Management (MDM) solution that is not officially supported, this does not mean you are unable to deploy or run Microsoft Defender ATP for Mac. + +Microsoft Defender ATP for Mac does not depend on any vendor-specific features. It can be used with any MDM solution that supports the following features: + +- Deploy a macOS .pkg to managed machines. +- Deploy macOS system configuration profiles to managed machines. +- Run an arbitrary admin-configured tool/script on managed machines. + +Most modern MDM solutions include these features, however, they may call them differently. + +You can deploy Defender without the last requirement from the preceding list, however: + +- You will not be able to collect status in a centralized way +- If you decide to uninstall Defender, you will need to logon to the client machine locally as an administrator + +## Deployment + +Most MDM solutions use the same model for managing macOS machines, with similar terminology. Use [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) as a template. + +### Package + +Configure deployment of a [required application package](microsoft-defender-atp-mac-install-with-jamf.md#package), +with the installation package (wdav.pkg) downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages). + +In order to deploy the package to your enterprise, use the instructions associated with your MDM solution. + +### License settings + +Set up [a system configuration profile](microsoft-defender-atp-mac-install-with-jamf.md#configuration-profile). +Your MDM solution may call it something like "Custom Settings Profile", as Microsoft Defender ATP for Mac is not part of macOS. + +Use the property list, jamf/WindowsDefenderATPOnboarding.plist, which can be extracted from an onboarding package downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages). +Your system may support an arbitrary property list in XML format. You can upload the jamf/WindowsDefenderATPOnboarding.plist file as-is in that case. +Alternatively, it may require you to convert the property list to a different format first. + +Typically, your custom profile has an id, name, or domain attribute. You must use exactly "com.microsoft.wdav.atp" for this value. +MDM uses it to deploy the settings file to **/Library/Managed Preferences/com.microsoft.wdav.atp.plist** on a client machine, and Defender uses this file for loading the onboarding information. + +### Kernel extension policy + +Set up a KEXT or kernel extension policy. Use team identifier **UBF8T346G9** to whitelist kernel extensions provided by Microsoft. + +## Check installation status + +Run [mdatp](microsoft-defender-atp-mac-install-with-jamf.md#check-onboarding-status) on a client machine to check the onboarding status. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md new file mode 100644 index 0000000000..7a0f0c27d6 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md @@ -0,0 +1,253 @@ +--- +title: Installing Microsoft Defender ATP for Mac with Microsoft Intune +ms.reviewer: +description: Describes how to install Microsoft Defender ATP for Mac, using Microsoft Intune. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Microsoft Intune-based deployment + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +This topic describes how to deploy Microsoft Defender ATP for Mac through Intune. A successful deployment requires the completion of all of the following steps: +- [Download installation and onboarding packages](#download-installation-and-onboarding-packages) +- [Client device setup](#client-device-setup) +- [Create System Configuration profiles](#create-system-configuration-profiles) +- [Publish application](#publish-application) + +## Prerequisites and system requirements + +Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. + +## Download installation and onboarding packages + +Download the installation and onboarding packages from Microsoft Defender Security Center: + +1. In Microsoft Defender Security Center, go to **Settings** > **Device Management** > **Onboarding**. +2. In Section 1 of the page, set the operating system to **Linux, macOS, iOS, or Android** and the deployment method to **Mobile Device Management / Microsoft Intune**. +3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. +4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. +5. Download **IntuneAppUtil** from [https://docs.microsoft.com/intune/lob-apps-macos](https://docs.microsoft.com/intune/lob-apps-macos). + + ![Windows Defender Security Center screenshot](images/MDATP_2_DownloadPackages.png) + +6. From a command prompt, verify that you have the three files. + Extract the contents of the .zip files: + + ```bash + $ ls -l + total 721688 + -rw-r--r-- 1 test staff 269280 Mar 15 11:25 IntuneAppUtil + -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip + -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg + $ unzip WindowsDefenderATPOnboardingPackage.zip + Archive: WindowsDefenderATPOnboardingPackage.zip + warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators + inflating: intune/kext.xml + inflating: intune/WindowsDefenderATPOnboarding.xml + inflating: jamf/WindowsDefenderATPOnboarding.plist + ``` + +7. Make IntuneAppUtil an executable: + + ```bash + $ chmod +x IntuneAppUtil + ``` + +8. Create the wdav.pkg.intunemac package from wdav.pkg: + + ```bash + $ ./IntuneAppUtil -c wdav.pkg -o . -i "com.microsoft.wdav" -n "1.0.0" + Microsoft Intune Application Utility for Mac OS X + Version: 1.0.0.0 + Copyright 2018 Microsoft Corporation + + Creating intunemac file for /Users/test/Downloads/wdav.pkg + Composing the intunemac file output + Output written to ./wdav.pkg.intunemac. + + IntuneAppUtil successfully processed "wdav.pkg", + to deploy refer to the product documentation. + ``` + +## Client device setup + +You need no special provisioning for a Mac device beyond a standard [Company Portal installation](https://docs.microsoft.com/intune-user-help/enroll-your-device-in-intune-macos-cp). + +1. You are asked to confirm device management. + +![Confirm device management screenshot](images/MDATP_3_ConfirmDeviceMgmt.png) + +Select **Open System Preferences**, locate **Management Profile** on the list, and select **Approve...**. Your Management Profile would be displayed as **Verified**: + +![Management profile screenshot](images/MDATP_4_ManagementProfile.png) + +2. Select **Continue** and complete the enrollment. + +You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages. + +3. In Intune, open **Manage** > **Devices** > **All devices**. Here you can see your device among those listed: + +![Add Devices screenshot](images/MDATP_5_allDevices.png) + +## Create System Configuration profiles + +1. In Intune, open **Manage** > **Device configuration**. Select **Manage** > **Profiles** > **Create Profile**. +2. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select **Configure**. +3. Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections. +4. Select **OK**. + + ![System configuration profiles screenshot](images/MDATP_6_SystemConfigurationProfiles.png) + +5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. +6. Repeat steps 1 through 5 for more profiles. +7. Create another profile, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file. +8. Create tcc.xml file with content below. Create another profile, give it any name and upload this file to it. + + > [!CAUTION] + > macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device. + > + > The following configuration profile grants Full Disk Access to Microsoft Defender ATP. If you previously configured Microsoft Defender ATP through Intune, we recommend you update the deployment with this configuration profile. + + ```xml + + + + + PayloadDescription + Allows Microsoft Defender to access all files on Catalina+ + PayloadDisplayName + TCC - Microsoft Defender + PayloadIdentifier + com.microsoft.wdav.tcc + PayloadOrganization + Microsoft Corp. + PayloadRemovalDisallowed + + PayloadScope + system + PayloadType + Configuration + PayloadUUID + C234DF2E-DFF6-11E9-B279-001C4299FB44 + PayloadVersion + 1 + PayloadContent + + + PayloadDescription + Allows Microsoft Defender to access all files on Catalina+ + PayloadDisplayName + TCC - Microsoft Defender + PayloadIdentifier + com.microsoft.wdav.tcc.C233A5E6-DFF6-11E9-BDAD-001C4299FB44 + PayloadOrganization + Microsoft Corp. + PayloadType + com.apple.TCC.configuration-profile-policy + PayloadUUID + C233A5E6-DFF6-11E9-BDAD-001C4299FB44 + PayloadVersion + 1 + Services + + SystemPolicyAllFiles + + + Allowed + + CodeRequirement + identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9 + Comment + Allow SystemPolicyAllFiles control for Microsoft Defender ATP + Identifier + com.microsoft.wdav + IdentifierType + bundleID + + + + + + + + ``` + +9. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. + +Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**: + +![System configuration profiles screenshot](images/MDATP_7_DeviceStatusBlade.png) + +## Publish application + +1. In Intune, open the **Manage > Client apps** blade. Select **Apps > Add**. +2. Select **App type=Other/Line-of-business app**. +3. Select **file=wdav.pkg.intunemac**. Select **OK** to upload. +4. Select **Configure** and add the required information. +5. Use **macOS Sierra 10.12** as the minimum OS and set *Ignore app version* to **Yes**. Other settings can be any arbitrary value. + + > [!CAUTION] + > Failure to set *Ignore app version* to **Yes** impacts the ability of the application to receive updates through Microsoft AutoUpdate. See [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) for additional information about how the product is updated. + + ![Device status blade screenshot](images/MDATP_8_IntuneAppInfo.png) + +6. Select **OK** and **Add**. + + ![Device status blade screenshot](images/MDATP_9_IntunePkgInfo.png) + +7. It may take a few moments to upload the package. After it's done, select the package from the list and go to **Assignments** and **Add group**. + + ![Client apps screenshot](images/MDATP_10_ClientApps.png) + +8. Change **Assignment type** to **Required**. +9. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Click **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**. + + ![Intune assignments info screenshot](images/MDATP_11_Assignments.png) + +10. After some time the application will be published to all enrolled devices. You can see it listed in **Monitor** > **Device**, under **Device install status**: + + ![Intune device status screenshot](images/MDATP_12_DeviceInstall.png) + +## Verify client device state + +1. After the configuration profiles are deployed to your devices, open **System Preferences** > **Profiles** on your Mac device. + + ![System Preferences screenshot](images/MDATP_13_SystemPreferences.png) + ![System Preferences Profiles screenshot](images/MDATP_14_SystemPreferencesProfiles.png) + +2. Verify that the following configuration profiles are present and installed. The **Management Profile** should be the Intune system profile. _Wdav-config_ and _wdav-kext_ are system configuration profiles that were added in Intune: + ![Profiles screenshot](images/MDATP_15_ManagementProfileConfig.png) + +3. You should also see the Microsoft Defender icon in the top-right corner: + + ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) + +## Troubleshooting + +Issue: No license found + +Solution: Follow the steps above to create a device profile using WindowsDefenderATPOnboarding.xml + +## Logging installation issues + +For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) . + +## Uninstallation + +See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md new file mode 100644 index 0000000000..80ec6a0f67 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md @@ -0,0 +1,623 @@ +--- +title: Set preferences for Microsoft Defender ATP for Mac +ms.reviewer: +description: Describes how to configure Microsoft Defender ATP for Mac in enterprises. +keywords: microsoft, defender, atp, mac, management, preferences, enterprise, intune, jamf, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Set preferences for Microsoft Defender ATP for Mac + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +>[!IMPORTANT] +>This topic contains instructions for how to set preferences for Microsoft Defender ATP for Mac in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](microsoft-defender-atp-mac-resources.md#configuring-from-the-command-line) page. + +In enterprise environments, Microsoft Defender ATP for Mac can be managed through a configuration profile. This profile is deployed from management tool of your choice. Preferences managed by the enterprise take precedence over the ones set locally on the device. In other words, users in your enterprise are not able to change preferences that are set through this configuration profile. + +This topic describes the structure of this profile (including a recommended profile that you can use to get started) and instructions for how to deploy the profile. + +## Configuration profile structure + +The configuration profile is a .plist file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can either be simple (such as a numerical value) or complex, such as a nested list of preferences. + +>[!CAUTION] +>The layout of the configuration profile depends on the management console that you are using. The following sections contain examples of configuration profiles for JAMF and Intune. + +The top level of the configuration profile includes product-wide preferences and entries for subareas of the product, which are explained in more detail in the next sections. + +### Antivirus engine preferences + +The *antivirusEngine* section of the configuration profile is used to manage the preferences of the antivirus component of the product. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | antivirusEngine | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +#### Enable / disable real-time protection + +Whether real-time protection (scan files as they are accessed) is enabled or not. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | enableRealTimeProtection | +| **Data type** | Boolean | +| **Possible values** | true (default)
false | + +#### Enable / disable passive mode + +Whether the antivirus engine runs in passive mode or not. In passive mode: +- Real-time protection is turned off +- On-demand scanning is turned on +- Automatic threat remediation is turned off +- Security intelligence updates are turned on +- Status menu icon is hidden + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | passiveMode | +| **Data type** | Boolean | +| **Possible values** | false (default)
true | +| **Comments** | Available in Microsoft Defender ATP version 100.67.60 or higher. | + +#### Scan exclusions + +Entities that have been excluded from the scan. Exclusions can be specified by full paths, extensions, or file names. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | exclusions | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +**Type of exclusion** + +Specifies the type of content excluded from the scan. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | $type | +| **Data type** | String | +| **Possible values** | excludedPath
excludedFileExtension
excludedFileName | + +**Path to excluded content** + +Used to exclude content from the scan by full file path. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | path | +| **Data type** | String | +| **Possible values** | valid paths | +| **Comments** | Applicable only if *$type* is *excludedPath* | + +**Path type (file / directory)** + +Indicates if the *path* property refers to a file or directory. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | isDirectory | +| **Data type** | Boolean | +| **Possible values** | false (default)
true | +| **Comments** | Applicable only if *$type* is *excludedPath* | + +**File extension excluded from the scan** + +Used to exclude content from the scan by file extension. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | extension | +| **Data type** | String | +| **Possible values** | valid file extensions | +| **Comments** | Applicable only if *$type* is *excludedFileExtension* | + +**Name of excluded content** + +Used to exclude content from the scan by file name. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | name | +| **Data type** | String | +| **Possible values** | any string | +| **Comments** | Applicable only if *$type* is *excludedFileName* | + +#### Allowed threats + +List of threats (identified by their name) that are not blocked by the product and are instead allowed to run. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | allowedThreats | +| **Data type** | Array of strings | + +#### Threat type settings + +The *threatTypeSettings* preference in the antivirus engine is used to control how certain threat types are handled by the product. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | threatTypeSettings | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +**Threat type** + +Type of the threat for which the behavior is configured. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | key | +| **Data type** | String | +| **Possible values** | potentially_unwanted_application
archive_bomb | + +**Action to take** + +Action to take when coming across a threat of the type specified in the preceding section. Can be: + +- **Audit**: your device is not protected against this type of threat, but an entry about the threat is logged. +- **Block**: your device is protected against this type of threat and you are notified in the user interface and the security console. +- **Off**: your device is not protected against this type of threat and nothing is logged. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | value | +| **Data type** | String | +| **Possible values** | audit (default)
block
off | + +### Cloud delivered protection preferences + +The *cloudService* entry in the configuration profile is used to configure the cloud driven protection feature of the product. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | cloudService | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +#### Enable / disable cloud delivered protection + +Whether cloud delivered protection is enabled on the device or not. To improve the security of your services, we recommend keeping this feature turned on. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | enabled | +| **Data type** | Boolean | +| **Possible values** | true (default)
false | + +#### Diagnostic collection level + +Diagnostic data is used to keep Microsoft Defender ATP secure and up-to-date, detect, diagnose and fix problems, and also make product improvements. This setting determines the level of diagnostics sent by the product to Microsoft. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | diagnosticLevel | +| **Data type** | String | +| **Possible values** | optional (default)
required | + +#### Enable / disable automatic sample submissions + +Determines whether suspicious samples (that are likely to contain threats) are sent to Microsoft. You are prompted if the submitted file is likely to contain personal information. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | automaticSampleSubmission | +| **Data type** | Boolean | +| **Possible values** | true (default)
false | + +### User interface preferences + +The *userInterface* section of the configuration profile is used to manage the preferences of the user interface of the product. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | userInterface | +| **Data type** | Dictionary (nested preference) | +| **Comments** | See the following sections for a description of the dictionary contents. | + +#### Show / hide status menu icon + +Whether the status menu icon (shown in the top-right corner of the screen) is hidden or not. + +||| +|:---|:---| +| **Domain** | com.microsoft.wdav | +| **Key** | hideStatusMenuIcon | +| **Data type** | Boolean | +| **Possible values** | false (default)
true | + +## Recommended configuration profile + +To get started, we recommend the following configuration profile for your enterprise to take advantage of all protection features that Microsoft Defender ATP provides. + +The following configuration profile will: +- Enable real-time protection (RTP) +- Specify how the following threat types are handled: + - **Potentially unwanted applications (PUA)** are blocked + - **Archive bombs** (file with a high compression rate) are audited to the product logs +- Enable cloud delivered protection +- Enable automatic sample submission + +### JAMF profile + +```XML + + + + + antivirusEngine + + enableRealTimeProtection + + threatTypeSettings + + + key + potentially_unwanted_application + value + block + + + key + archive_bomb + value + audit + + + + cloudService + + enabled + + automaticSampleSubmission + + + + +``` + +### Intune profile + +```XML + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.wdav + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + antivirusEngine + + enableRealTimeProtection + + threatTypeSettings + + + key + potentially_unwanted_application + value + block + + + key + archive_bomb + value + audit + + + + cloudService + + enabled + + automaticSampleSubmission + + + + + + +``` + +## Full configuration profile example + +The following configuration profile contains entries for all settings described in this document and can be used for more advanced scenarios where you want more control over the product. + +### JAMF profile + +```XML + + + + + antivirusEngine + + enableRealTimeProtection + + passiveMode + + exclusions + + + $type + excludedPath + isDirectory + + path + /var/log/system.log + + + $type + excludedPath + isDirectory + + path + /home + + + $type + excludedFileExtension + extension + pdf + + + allowedThreats + + EICAR-Test-File (not a virus) + + threatTypeSettings + + + key + potentially_unwanted_application + value + block + + + key + archive_bomb + value + audit + + + + cloudService + + enabled + + diagnosticLevel + optional + automaticSampleSubmission + + + userInterface + + hideStatusMenuIcon + + + + +``` + +### Intune profile + +```XML + + + + + PayloadUUID + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + C4E6A782-0C8D-44AB-A025-EB893987A295 + PayloadDisplayName + Microsoft Defender ATP settings + PayloadDescription + Microsoft Defender ATP configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadType + com.microsoft.wdav + PayloadOrganization + Microsoft + PayloadIdentifier + 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 + PayloadDisplayName + Microsoft Defender ATP configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + antivirusEngine + + enableRealTimeProtection + + passiveMode + + exclusions + + + $type + excludedPath + isDirectory + + path + /var/log/system.log + + + $type + excludedPath + isDirectory + + path + /home + + + $type + excludedFileExtension + extension + pdf + + + allowedThreats + + EICAR-Test-File (not a virus) + + threatTypeSettings + + + key + potentially_unwanted_application + value + block + + + key + archive_bomb + value + audit + + + + cloudService + + enabled + + diagnosticLevel + optional + automaticSampleSubmission + + + userInterface + + hideStatusMenuIcon + + + + + + +``` + +## Configuration profile deployment + +Once you've built the configuration profile for your enterprise, you can deploy it through the management console that your enterprise is using. The following sections provide instructions on how to deploy this profile using JAMF and Intune. + +### JAMF deployment + +From the JAMF console, open **Computers** > **Configuration Profiles**, navigate to the configuration profile you'd like to use, then select **Custom Settings**. Create an entry with *com.microsoft.wdav* as the preference domain and upload the .plist produced earlier. + +>[!CAUTION] +>You must enter the correct preference domain (*com.microsoft.wdav*), otherwise the preferences will not be recognized by the product. + +### Intune deployment + +1. Open **Manage** > **Device configuration**. Select **Manage** > **Profiles** > **Create Profile**. + +2. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select Configure. + +3. Save the .plist produced earlier as **com.microsoft.wdav.xml**. + +4. Enter **com.microsoft.wdav** as the **custom configuration profile name**. + +5. Open the configuration profile and upload **com.microsoft.wdav.xml**. This file was created in step 3. + +6. Select **OK**. + +7. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. + +>[!CAUTION] +>You must enter the correct custom configuration profile name, otherwise these preferences will not be recognized by the product. + +## Resources + +- [Configuration Profile Reference (Apple developer documentation)](https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md new file mode 100644 index 0000000000..0c56970e6f --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md @@ -0,0 +1,277 @@ +--- +title: Privacy for Microsoft Defender ATP for Mac +ms.reviewer: +description: Describes privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Mac. +keywords: microsoft, defender, atp, mac, privacy, diagnostic +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Privacy for Microsoft Defender ATP for Mac + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +Microsoft is committed to providing you with the information and controls you need to make choices about how your data is collected and used when you’re using Microsoft Defender ATP for Mac. + +This topic describes the privacy controls available within the product, how to manage these controls with policy settings and more details on the data events that are collected. + +## Overview of privacy controls in Microsoft Defender ATP for Mac + +This section describes the privacy controls for the different types of data collected by Microsoft Defender ATP for Mac. + +### Diagnostic data + +Diagnostic data is used to keep Microsoft Defender ATP secure and up-to-date, detect, diagnose and fix problems, and also make product improvements. + +Some diagnostic data is required, while some diagnostic data is optional. We give you the ability to choose whether to send us required or optional diagnostic data through the use of privacy controls, such as policy settings for organizations. + +There are two levels of diagnostic data for Microsoft Defender ATP client software that you can choose from: + +* **Required**: The minimum data necessary to help keep Microsoft Defender ATP secure, up-to-date, and performing as expected on the device it’s installed on. + +* **Optional**: Additional data that helps Microsoft make product improvements and provides enhanced information to help detect, diagnose, and remediate issues. + +By default, both optional and required diagnostic data are sent to Microsoft. + +### Cloud delivered protection data + +Cloud delivered protection is used to provide increased and faster protection with access to the latest protection data in the cloud. + +Enabling the cloud-delivered protection service is optional, however it is highly recommended because it provides important protection against malware on your endpoints and across your network. + +### Sample data + +Sample data is used to improve the protection capabilities of the product, by sending Microsoft suspicious samples so they can be analyzed. Enabling automatic sample submission is optional. + +When this feature is enabled and the sample that is collected is likely to contain personal information, the user is prompted for consent. + +## Manage privacy controls with policy settings + +If you're an IT administrator, you might want to configure these controls at the enterprise level. + +The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md). + +As with any new policy settings, you should carefully test them out in a limited, controlled environment to ensure the settings that you configure have the desired effect before you implement the policy settings more widely in your organization. + +## Diagnostic data events + +This section describes what is considered required diagnostic data and what is considered optional diagnostic data, along with a description of the events and fields that are collected. + +### Data fields that are common for all events +There is some information about events that is common to all events, regardless of category or data subtype. + +The following fields are considered common for all events: + +| Field | Description | +| ----------------------- | ----------- | +| platform | The broad classification of the platform on which the app is running. Allows Microsoft to identify on which platforms an issue may be occurring so that it can correctly be prioritized. | +| machine_guid | Unique identifier associated with the device. Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | +| sense_guid | Unique identifier associated with the device. Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | +| org_id | Unique identifier associated with the enterprise that the device belongs to. Allows Microsoft to identify whether issues are impacting a select set of enterprises and how many enterprises are impacted. | +| hostname | Local machine name (without DNS suffix). Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | +| product_guid | Unique identifier of the product. Allows Microsoft to differentiate issues impacting different flavors of the product. | +| app_version | Version of the Microsoft Defender ATP for Mac application. Allows Microsoft to identify which versions of the product are showing an issue so that it can correctly be prioritized.| +| sig_version | Version of security intelligence database. Allows Microsoft to identify which versions of the security intelligence are showing an issue so that it can correctly be prioritized. | +| supported_compressions | List of compression algorithms supported by the application, for example `['gzip']`. Allows Microsoft to understand what types of compressions can be used when it communicates with the application. | +| release_ring | Ring that the device is associated with (for example Insider Fast, Insider Slow, Production). Allows Microsoft to identify on which release ring an issue may be occurring so that it can correctly be prioritized. | + + +### Required diagnostic data + +**Required diagnostic data** is the minimum data necessary to help keep Microsoft Defender ATP secure, up-to-date, and perform as expected on the device it’s installed on. + +Required diagnostic data helps to identify problems with Microsoft Defender ATP that may be related to a device or software configuration. For example, it can help determine if a Microsoft Defender ATP feature crashes more frequently on a particular operating system version, with newly introduced features, or when certain Microsoft Defender ATP features are disabled. Required diagnostic data helps Microsoft detect, diagnose, and fix these problems more quickly so the impact to users or organizations is reduced. + +#### Software setup and inventory data events + +**Microsoft Defender ATP installation / uninstallation** + +The following fields are collected: + +| Field | Description | +| ---------------- | ----------- | +| correlation_id | Unique identifier associated with the installation. | +| version | Version of the package. | +| severity | Severity of the message (for example Informational). | +| code | Code that describes the operation. | +| text | Additional information associated with the product installation. | + +**Microsoft Defender ATP configuration** + +The following fields are collected: + +| Field | Description | +| --------------------------------------------------- | ----------- | +| antivirus_engine.enable_real_time_protection | Whether real-time protection is enabled on the device or not. | +| antivirus_engine.passive_mode | Whether passive mode is enabled on the device or not. | +| cloud_service.enabled | Whether cloud delivered protection is enabled on the device or not. | +| cloud_service.timeout | Time out when the application communicates with the Microsoft Defender ATP cloud. | +| cloud_service.heartbeat_interval | Interval between consecutive heartbeats sent by the product to the cloud. | +| cloud_service.service_uri | URI used to communicate with the cloud. | +| cloud_service.diagnostic_level | Diagnostic level of the device (required, optional). | +| cloud_service.automatic_sample_submission | Whether automatic sample submission is turned on or not. | +| edr.early_preview | Whether the machine should run EDR early preview features. | +| edr.group_id | Group identifier used by the detection and response component. | +| edr.tags | User-defined tags. | +| features.\[optional feature name\] | List of preview features, along with whether they are enabled or not. | + +#### Product and service performance data events + +**Kernel extension statistics** + +The following fields are collected: + +| Field | Description | +| ---------------- | ----------- | +| version | Version of Microsoft Defender ATP for Mac. | +| instance_id | Unique identifier generated on kernel extension startup. | +| trace_level | Trace level of the kernel extension. | +| ipc.connects | Number of connection requests received by the kernel extension. | +| ipc.rejects | Number of connection requests rejected by the kernel extension. | +| ipc.connected | Whether there is any active connection to the kernel extension. | + +#### Support data + +**Diagnostic logs** + +Diagnostic logs are collected only with the consent of the user as part of the feedback submission feature. The following files are collected as part of the support logs: + +- All files under */Library/Logs/Microsoft/mdatp/* +- Subset of files under */Library/Application Support/Microsoft/Defender/* that are created and used by Microsoft Defender ATP for Mac +- Subset of files under */Library/Managed Preferences* that are used by Microsoft Defender ATP for Mac +- /Library/Logs/Microsoft/autoupdate.log +- $HOME/Library/Preferences/com.microsoft.autoupdate2.plist + +### Optional diagnostic data + +**Optional diagnostic data** is additional data that helps Microsoft make product improvements and provides enhanced information to help detect, diagnose, and fix issues. + +If you choose to send us optional diagnostic data, required diagnostic data is also included. + +Examples of optional diagnostic data include data Microsoft collects about product configuration (for example number of exclusions set on the device) and product performance (aggregate measures about the performance of components of the product). + +#### Software setup and inventory data events + +**Microsoft Defender ATP configuration** + +The following fields are collected: + +| Field | Description | +| -------------------------------------------------- | ----------- | +| connection_retry_timeout | Connection retry time out when communication with the cloud. | +| file_hash_cache_maximum | Size of the product cache. | +| crash_upload_daily_limit | Limit of crash logs uploaded daily. | +| antivirus_engine.exclusions[].is_directory | Whether the exclusion from scanning is a directory or not. | +| antivirus_engine.exclusions[].path | Path that was excluded from scanning. | +| antivirus_engine.exclusions[].extension | Extension excluded from scanning. | +| antivirus_engine.exclusions[].name | Name of the file excluded from scanning. | +| antivirus_engine.scan_cache_maximum | Size of the product cache. | +| antivirus_engine.maximum_scan_threads | Maximum number of threads used for scanning. | +| antivirus_engine.threat_restoration_exclusion_time | Time out before a file restored from the quarantine can be detected again. | +| filesystem_scanner.full_scan_directory | Full scan directory. | +| filesystem_scanner.quick_scan_directories | List of directories used in quick scan. | +| edr.latency_mode | Latency mode used by the detection and response component. | +| edr.proxy_address | Proxy address used by the detection and response component. | + +**Microsoft Auto-Update configuration** + +The following fields are collected: + +| Field | Description | +| --------------------------- | ----------- | +| how_to_check | Determines how product updates are checked (for example automatic or manual). | +| channel_name | Update channel associated with the device. | +| manifest_server | Server used for downloading updates. | +| update_cache | Location of the cache used to store updates. | + +### Product and service usage + +#### Diagnostic log upload started report + +The following fields are collected: + +| Field | Description | +| ---------------- | ----------- | +| sha256 | SHA256 identifier of the support log. | +| size | Size of the support log. | +| original_path | Path to the support log (always under */Library/Application Support/Microsoft/Defender/wdavdiag/*). | +| format | Format of the support log. | + +#### Diagnostic log upload completed report + +The following fields are collected: + +| Field | Description | +| ---------------- | ----------- | +| request_id | Correlation ID for the support log upload request. | +| sha256 | SHA256 identifier of the support log. | +| blob_sas_uri | URI used by the application to upload the support log. | + +#### Product and service performance data events + +**Unexpected application exit (crash)** + +Unexpected application exits and the state of the application when that happens. + +**Kernel extension statistics** + +The following fields are collected: + +| Field | Description | +| ------------------------------ | ----------- | +| pkt_ack_timeout | The following properties are aggregated numerical values, representing count of events that happened since kernel extension startup. | +| pkt_ack_conn_timeout | | +| ipc.ack_pkts | | +| ipc.nack_pkts | | +| ipc.send.ack_no_conn | | +| ipc.send.nack_no_conn | | +| ipc.send.ack_no_qsq | | +| ipc.send.nack_no_qsq | | +| ipc.ack.no_space | | +| ipc.ack.timeout | | +| ipc.ack.ackd_fast | | +| ipc.ack.ackd | | +| ipc.recv.bad_pkt_len | | +| ipc.recv.bad_reply_len | | +| ipc.recv.no_waiter | | +| ipc.recv.copy_failed | | +| ipc.kauth.vnode.mask | | +| ipc.kauth.vnode.read | | +| ipc.kauth.vnode.write | | +| ipc.kauth.vnode.exec | | +| ipc.kauth.vnode.del | | +| ipc.kauth.vnode.read_attr | | +| ipc.kauth.vnode.write_attr | | +| ipc.kauth.vnode.read_ex_attr | | +| ipc.kauth.vnode.write_ex_attr | | +| ipc.kauth.vnode.read_sec | | +| ipc.kauth.vnode.write_sec | | +| ipc.kauth.vnode.take_own | | +| ipc.kauth.vnode.denied | | +| ipc.kauth.file_op.mask | | +| ipc.kauth_file_op.open | | +| ipc.kauth.file_op.close | | +| ipc.kauth.file_op.close_modified | | +| ipc.kauth.file_op.move | | +| ipc.kauth.file_op.link | | +| ipc.kauth.file_op.exec | | +| ipc.kauth.file_op.remove | | +| ipc.kauth.file_op.fork | | +| ipc.kauth.file_op.create | | + +## Resources + +- [Privacy at Microsoft](https://privacy.microsoft.com/) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md new file mode 100644 index 0000000000..2696590c99 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md @@ -0,0 +1,66 @@ +--- +title: Detect and block potentially unwanted applications +ms.reviewer: +description: Describes how to detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Mac. +keywords: microsoft, defender, atp, mac, pua, pus +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Detect and block potentially unwanted applications + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +The potentially unwanted application (PUA) protection feature in Microsoft Defender ATP for Mac can detect and block PUA files on endpoints in your network. + +These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have poor reputation. + +These applications can increase the risk of your network being infected with malware, cause malware infections to be harder to identify, and can waste IT resources in cleaning up the applications. + +## How it works + +Microsoft Defender ATP for Mac can detect and report PUA files. When configured in blocking mode, PUA files are moved to the quarantine. + +When a PUA is detected on an endpoint, Microsoft Defender ATP for Mac presents a notification to the user, unless notifications have been disabled. The threat name will contain the word "Application". + +## Configure PUA protection + +PUA protection in Microsoft Defender ATP for Mac can be configured in one of the following ways: + +- **Off**: PUA protection is disabled. +- **Audit**: PUA files are reported in the product logs, but not in Microsoft Defender Security Center. No notification is presented to the user and no action is taken by the product. +- **Block**: PUA files are reported in the product logs and in Microsoft Defender Security Center. The user is presented with a notification and action is taken by the product. + +>[!WARNING] +>By default, PUA protection is configured in **Audit** mode. + +You can configure how PUA files are handled from the command line or from the management console. + +### Use the command-line tool to configure PUA protection: + +In Terminal, execute the following command to configure PUA protection: + +```bash +$ mdatp --threat --type-handling potentially_unwanted_application [off|audit|block] +``` + +### Use the management console to configure PUA protection: + +In your enterprise, you can configure PUA protection from a management console, such as JAMF or Intune, similarly to how other product settings are configured. For more information, see the [Threat type settings](microsoft-defender-atp-mac-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) topic. + +## Related topics + +- [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md new file mode 100644 index 0000000000..2f67653ec0 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md @@ -0,0 +1,118 @@ +--- +title: Microsoft Defender ATP for Mac Resources +ms.reviewer: +description: Describes resources for Microsoft Defender ATP for Mac, including how to uninstall it, how to collect diagnostic logs, CLI commands, and known issues with the product. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Resources + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +## Collecting diagnostic information + +If you can reproduce a problem, please increase the logging level, run the system for some time, and restore the logging level to the default. + +1. Increase logging level: + + ```bash + $ mdatp --log-level verbose + Creating connection to daemon + Connection established + Operation succeeded + ``` + +2. Reproduce the problem + +3. Run `sudo mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds. + + ```bash + $ sudo mdatp --diagnostic --create + Creating connection to daemon + Connection established + ``` + +4. Restore logging level: + + ```bash + $ mdatp --log-level info + Creating connection to daemon + Connection established + Operation succeeded + ``` + +## Logging installation issues + +If an error occurs during installation, the installer will only report a general failure. + +The detailed log will be saved to /Library/Logs/Microsoft/mdatp/install.log. If you experience issues during installation, send us this file so we can help diagnose the cause. + +## Uninstalling + +There are several ways to uninstall Microsoft Defender ATP for Mac. Please note that while centrally managed uninstall is available on JAMF, it is not yet available for Microsoft Intune. + +### Interactive uninstallation + +- Open **Finder > Applications**. Right click on **Microsoft Defender ATP > Move to Trash**. + +### From the command line + +- ```sudo rm -rf '/Applications/Microsoft Defender ATP'``` + +## Configuring from the command line + +Important tasks, such as controlling product settings and triggering on-demand scans, can be done from the command line: + +|Group |Scenario |Command | +|-------------|-------------------------------------------|-----------------------------------------------------------------------| +|Configuration|Turn on/off real-time protection |`mdatp --config realTimeProtectionEnabled [true/false]` | +|Configuration|Turn on/off cloud protection |`mdatp --config cloudEnabled [true/false]` | +|Configuration|Turn on/off product diagnostics |`mdatp --config cloudDiagnosticEnabled [true/false]` | +|Configuration|Turn on/off automatic sample submission |`mdatp --config cloudAutomaticSampleSubmission [true/false]` | +|Configuration|Turn on PUA protection |`mdatp --threat --type-handling potentially_unwanted_application block`| +|Configuration|Turn off PUA protection |`mdatp --threat --type-handling potentially_unwanted_application off` | +|Configuration|Turn on audit mode for PUA protection |`mdatp --threat --type-handling potentially_unwanted_application audit`| +|Diagnostics |Change the log level |`mdatp --log-level [error/warning/info/verbose]` | +|Diagnostics |Generate diagnostic logs |`mdatp --diagnostic --create` | +|Health |Check the product's health |`mdatp --health` | +|Protection |Scan a path |`mdatp --scan --path [path]` | +|Protection |Do a quick scan |`mdatp --scan --quick` | +|Protection |Do a full scan |`mdatp --scan --full` | +|Protection |Cancel an ongoing on-demand scan |`mdatp --scan --cancel` | +|Protection |Request a security intelligence update |`mdatp --definition-update` | + +## Microsoft Defender ATP portal information + +In the Microsoft Defender ATP portal, you'll see two categories of information: + +- Antivirus alerts, including: + - Severity + - Scan type + - Device information (hostname, machine identifier, tenant identifier, app version, and OS type) + - File information (name, path, size, and hash) + - Threat information (name, type, and state) +- Device information, including: + - Machine identifier + - Tenant identifier + - App version + - Hostname + - OS type + - OS version + - Computer model + - Processor architecture + - Whether the device is a virtual machine diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md new file mode 100644 index 0000000000..50267f26bb --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md @@ -0,0 +1,219 @@ +--- +title: Deploy updates for Microsoft Defender ATP for Mac +ms.reviewer: +description: Describes how to control updates for Microsoft Defender ATP for Mac in enterprise environments. +keywords: microsoft, defender, atp, mac, updates, deploy +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Deploy updates for Microsoft Defender ATP for Mac + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) + +Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. + +To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. By default, MAU automatically checks for updates daily, but you can change that to weekly, monthly, or manually. + +![MAU screenshot](images/MDATP_34_MAU.png) + +If you decide to deploy updates by using your software distribution tools, you should configure MAU to manually check for software updates. You can deploy preferences to configure how and when MAU checks for updates for the Macs in your organization. + +## Use msupdate + +MAU includes a command-line tool, called *msupdate*, that is designed for IT administrators so that they have more precise control over when updates are applied. Instructions for how to use this tool can be found in [Update Office for Mac by using msupdate](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate). + +In MAU, the application identifier for Microsoft Defender ATP for Mac is *WDAV00*. To download and install the latest updates for Microsoft Defender ATP for Mac, execute the following command from a Terminal window: + +``` +./msupdate --install --apps wdav00 +``` + +## Set preferences for Microsoft AutoUpdate + +This section describes the most common preferences that can be used to configure MAU. These settings can be deployed as a configuration profile through the management console that your enterprise is using. An example of a configuration profile is shown in the following sections. + +### Set the channel name + +The channel determines the type and frequency of updates that are offered through MAU. Devices in `InsiderFast` (corresponding to the Insider Fast channel) can try out new features before devices in `External` (corresponding to the Insider Slow channel) and `Production`. + +The `Production` channel contains the most stable version of the product. + +>[!TIP] +>In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to `InsiderFast` or `External`. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | ChannelName | +| **Data type** | String | +| **Possible values** | InsiderFast
External
Production | + +### Set update check frequency + +Change how often MAU searches for updates. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | UpdateCheckFrequency | +| **Data type** | Integer | +| **Default value** | 720 (minutes) | +| **Comment** | This value is set in minutes. | + +### Change how MAU interacts with updates + +Change how MAU searches for updates. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | HowToCheck | +| **Data type** | String | +| **Possible values** | Manual
AutomaticCheck
AutomaticDownload | +| **Comment** | Note that AutomaticDownload will do a download and install silently if possible. | + +### Change whether the "Check for Updates" button is enabled + +Change whether local users will be able to click the "Check for Updates" option in the Microsoft AutoUpdate user interface. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | EnableCheckForUpdatesButton | +| **Data type** | Boolean | +| **Possible values** | True (default)
False | + +### Disable Insider checkbox + +Set to true to make the "Join the Office Insider Program..." checkbox unavailable / greyed out to users. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | DisableInsiderCheckbox | +| **Data type** | Boolean | +| **Possible values** | False (default)
True | + +### Limit the telemetry that is sent from MAU + +Set to false to send minimal heartbeat data, no application usage, and no environment details. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | SendAllTelemetryEnabled | +| **Data type** | Boolean | +| **Possible values** | True (default)
False | + +## Example configuration profile + +The following configuration profile is used to: +- Place the device in the Insider Fast channel +- Automatically download and install updates +- Enable the "Check for updates" button in the user interface +- Allow users on the device to enroll into the Insider channels + +### JAMF + +```XML + + + + + ChannelName + InsiderFast + HowToCheck + AutomaticDownload + EnableCheckForUpdatesButton + + DisableInsiderCheckbox + + SendAllTelemetryEnabled + + + +``` + +### Intune + +```XML + + + + + PayloadUUID + B762FF60-6ACB-4A72-9E72-459D00C936F3 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.autoupdate2 + PayloadDisplayName + Microsoft AutoUpdate settings + PayloadDescription + Microsoft AutoUpdate configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 5A6F350A-CC2C-440B-A074-68E3F34EBAE9 + PayloadType + com.microsoft.autoupdate2 + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.autoupdate2 + PayloadDisplayName + Microsoft AutoUpdate configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + ChannelName + InsiderFast + HowToCheck + AutomaticDownload + EnableCheckForUpdatesButton + + DisableInsiderCheckbox + + SendAllTelemetryEnabled + + + + + +``` + +To configure MAU, you can deploy this configuration profile from the management tool that your enterprise is using: +- From JAMF, upload this configuration profile and set the Preference Domain to *com.microsoft.autoupdate2*. +- From Intune, upload this configuration profile and set the custom configuration profile name to *com.microsoft.autoupdate2*. + +## Resources + +- [msupdate reference](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md new file mode 100644 index 0000000000..f87f5332c7 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -0,0 +1,113 @@ +--- +title: Microsoft Defender ATP for Mac +ms.reviewer: +description: Describes how to install and use Microsoft Defender ATP for Mac. +keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Microsoft Defender Advanced Threat Protection for Mac + +This topic describes how to install, configure, update, and use Microsoft Defender ATP for Mac. + +> [!CAUTION] +> Running other third-party endpoint protection products alongside Microsoft Defender ATP for Mac is likely to lead to performance problems and unpredictable side effects. + +## What’s new in the latest release + +[What's new](microsoft-defender-atp-mac-whatsnew.md) + +If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**. + +## How to install Microsoft Defender ATP for Mac + +### Prerequisites + +- Access to the Microsoft Defender Security Center portal +- Beginner-level experience in macOS and BASH scripting +- Administrative privileges on the device (in case of manual deployment) + +### System requirements + +> [!CAUTION] +> The three most recent major releases of macOS are supported. Beta versions of macOS are not supported. + +- Supported macOS versions: 10.14 (Mojave), 10.13 (High Sierra), 10.12 (Sierra) +- Disk space: 650 MB + +After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints. + +The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. + +| Service location | DNS record | +| ---------------------------------------- | ----------------------- | +| Common URLs for all locations | x.cp.wd.microsoft.com
cdn.x.cp.wd.microsoft.com
eu-cdn.x.cp.wd.microsoft.com
wu-cdn.x.cp.wd.microsoft.com
*.blob.core.windows.net
officecdn-microsoft-com.akamaized.net | +| European Union | europe.x.cp.wd.microsoft.com | +| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com | +| United States | unitedstates.x.cp.wd.microsoft.com | + +Microsoft Defender ATP can discover a proxy server by using the following discovery methods: +- Web Proxy Auto-discovery Protocol (WPAD) +- Manual static proxy configuration + +If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs. + +To test that a connection is not blocked, open [https://x.cp.wd.microsoft.com/api/report](https://x.cp.wd.microsoft.com/api/report) and [https://cdn.x.cp.wd.microsoft.com/ping](https://cdn.x.cp.wd.microsoft.com/ping) in a browser. + +If you prefer the command line, you can also check the connection by running the following command in Terminal: + +```bash +$ curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'https://cdn.x.cp.wd.microsoft.com/ping' +``` + +The output from this command should be similar to the following: + +> `OK https://x.cp.wd.microsoft.com/api/report` +> +> `OK https://cdn.x.cp.wd.microsoft.com/ping` + +> [!CAUTION] +> We recommend that you keep [System Integrity Protection](https://support.apple.com/en-us/HT204899) (SIP) enabled on client machines. SIP is a built-in macOS security feature that prevents low-level tampering with the OS, and is enabled by default. + +### Installation instructions + +There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac. + +In general you need to take the following steps: + +- Ensure that you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal +- Deploy Microsoft Defender ATP for Mac using one of the following deployment methods: + - Via third-party management tools: + - [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md) + - [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) + - [Other MDM products](microsoft-defender-atp-mac-install-with-other-mdm.md) + - Via the command-line tool: + - [Manual deployment](microsoft-defender-atp-mac-install-manually.md) + +## How to update Microsoft Defender ATP for Mac + +Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. + +To read more on how to configure MAU in enterprise environments, refer to [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) + +## How to configure Microsoft Defender ATP for Mac + +Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md). + +## Resources + +- For more information about logging, uninstalling, or other topics, see the [Resources](microsoft-defender-atp-mac-resources.md) page. + +- [Privacy for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-privacy.md) From aeb4b750e7b0ea04502ddc301441de398bc32313 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 21 Oct 2019 10:53:14 +0530 Subject: [PATCH 19/69] Updated overview section for Linux Updated overview section for Linux --- .../microsoft-defender-atp-linux.md | 70 +++++++++---------- 1 file changed, 35 insertions(+), 35 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index f87f5332c7..2a1e938b11 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -1,8 +1,8 @@ --- -title: Microsoft Defender ATP for Mac +title: Microsoft Defender ATP for Linux ms.reviewer: -description: Describes how to install and use Microsoft Defender ATP for Mac. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +description: Describes how to install and use Microsoft Defender ATP for Linux. +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, edhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,34 +18,33 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Microsoft Defender Advanced Threat Protection for Mac +# Microsoft Defender Advanced Threat Protection for Linux -This topic describes how to install, configure, update, and use Microsoft Defender ATP for Mac. +This topic describes how to install, configure, update, and use Microsoft Defender ATP for Linux. > [!CAUTION] -> Running other third-party endpoint protection products alongside Microsoft Defender ATP for Mac is likely to lead to performance problems and unpredictable side effects. +> Running other third-party endpoint protection products alongside Microsoft Defender ATP for Linux is likely to lead to performance problems and unpredictable side effects. + +> [!NOTE] +>How would users give us feedback? +> **TODO:** Should we add atp --feedback "Feedback" that will send the feedback to us / OCV. I am keeping the original line for reference. +> +> If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**. -## What’s new in the latest release - -[What's new](microsoft-defender-atp-mac-whatsnew.md) - -If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**. - -## How to install Microsoft Defender ATP for Mac +## How to install Microsoft Defender ATP for Linux ### Prerequisites - Access to the Microsoft Defender Security Center portal -- Beginner-level experience in macOS and BASH scripting +- Beginner-level experience in Linux and BASH scripting - Administrative privileges on the device (in case of manual deployment) ### System requirements -> [!CAUTION] -> The three most recent major releases of macOS are supported. Beta versions of macOS are not supported. - -- Supported macOS versions: 10.14 (Mojave), 10.13 (High Sierra), 10.12 (Sierra) -- Disk space: 650 MB +- Supported Linux distributions and versions: RHEL 7, Oracle 7, CentOS 7, Ubuntu 16 and 18, Debian 9 +- Disk space: 650 MB. +> [!NOTE] +>**TODO**: Verify this After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints. @@ -58,6 +57,9 @@ The following table lists the services and their associated URLs that your netwo | United Kingdom | unitedkingdom.x.cp.wd.microsoft.com | | United States | unitedstates.x.cp.wd.microsoft.com | +>[!NOTE] +> **TODO:** Verify the proxy paragraph + Microsoft Defender ATP can discover a proxy server by using the following discovery methods: - Web Proxy Auto-discovery Protocol (WPAD) - Manual static proxy configuration @@ -78,36 +80,34 @@ The output from this command should be similar to the following: > > `OK https://cdn.x.cp.wd.microsoft.com/ping` -> [!CAUTION] -> We recommend that you keep [System Integrity Protection](https://support.apple.com/en-us/HT204899) (SIP) enabled on client machines. SIP is a built-in macOS security feature that prevents low-level tampering with the OS, and is enabled by default. - ### Installation instructions -There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac. +There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Linux. In general you need to take the following steps: - Ensure that you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal -- Deploy Microsoft Defender ATP for Mac using one of the following deployment methods: +- Deploy Microsoft Defender ATP for Linux using one of the following deployment methods: - Via third-party management tools: - - [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md) - - [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) - - [Other MDM products](microsoft-defender-atp-mac-install-with-other-mdm.md) + - [Deploy using Puppet configuration management tool](microsoft-defender-atp-linux-install-with-puppet.md) + - [Deploy using Ansbile configuration management tool](microsoft-defender-atp-linux-install-with-ansible.md) + - [Other configuration management tools](microsoft-defender-atp-linux-install-with-other-configtool.md) - Via the command-line tool: - - [Manual deployment](microsoft-defender-atp-mac-install-manually.md) + - [Manual deployment](microsoft-defender-atp-linux-install-manually.md) -## How to update Microsoft Defender ATP for Mac +## How to update Microsoft Defender ATP for Linux -Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. +>[!NOTE] +> **TODO:** Upgrade story is not very clear right now! -To read more on how to configure MAU in enterprise environments, refer to [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) +Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Linux, refer to [Deploy updates for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-updates.md) -## How to configure Microsoft Defender ATP for Mac +## How to configure Microsoft Defender ATP for Linux -Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md). +Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md). ## Resources -- For more information about logging, uninstalling, or other topics, see the [Resources](microsoft-defender-atp-mac-resources.md) page. +- For more information about logging, uninstalling, or other topics, see the [Resources](microsoft-defender-atp-linux-resources.md) page. -- [Privacy for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-privacy.md) +- [Privacy for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-privacy.md) From 39d96ebb0e39376166f36e07bdaad102a6cc157d Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 21 Oct 2019 13:41:01 +0530 Subject: [PATCH 20/69] Updated manual install steps for Linux Updated manual install steps for Linux --- ...oft-defender-atp-linux-install-manually.md | 141 +++++------------- 1 file changed, 41 insertions(+), 100 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md index bed05f108c..490b35ec75 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md @@ -1,8 +1,8 @@ --- -title: Installing Microsoft Defender ATP for Mac manually +title: Installing Microsoft Defender ATP for Linux manually ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Mac manually, from the command line. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +description: Describes how to install Microsoft Defender ATP for Linux manually, from the command line. +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, edhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -22,36 +22,43 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -This topic describes how to deploy Microsoft Defender ATP for Mac manually. A successful deployment requires the completion of all of the following steps: -- [Download installation and onboarding packages](#download-installation-and-onboarding-packages) +This topic describes how to deploy Microsoft Defender ATP for Linux manually. A successful deployment requires the completion of all of the following steps: + +- [Configure Microsoft's Linux Software Repository](#configure-microsoft's-linux-software-repository) +- [Download onboarding packages](#download-onboarding-package) - [Application installation](#application-installation) - [Client configuration](#client-configuration) ## Prerequisites and system requirements -Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. +Before you get started, see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. -## Download installation and onboarding packages +## Configure Microsoft's Linux Software Repository -Download the installation and onboarding packages from Windows Defender Security Center: +Follow the steps given in [Configure Microsoft's Linux Software Repository](https://docs.microsoft.com/en-us/windows-server/administration/linux-package-repository-for-microsoft-software) to setup the repository. + +> [!NOTE] +> **TODO:** Use a forward link for above instead of URL + +## Download onboarding package + +Download the onboarding package from Windows Defender Security Center: 1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**. 2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**. -3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory. -4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. +3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_page.png) -5. From a command prompt, verify that you have the two files. - Extract the contents of the .zip files: +4. From a command prompt, verify that you have the file. + Extract the contents of the .zip file: ```bash $ ls -l - total 721152 - -rw-r--r-- 1 test staff 6185 Mar 15 10:45 WindowsDefenderATPOnboardingPackage.zip - -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg + total 8 + -rw-r--r-- 1 test staff 6287 Oct 21 11:22 WindowsDefenderATPOnboardingPackage.zip $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip inflating: WindowsDefenderATPOnboarding.py @@ -61,89 +68,24 @@ Download the installation and onboarding packages from Windows Defender Security To complete this process, you must have admin privileges on the machine. -1. Navigate to the downloaded wdav.pkg in Finder and open it. +1. Install Microsoft Defender ATP for Linux - ![App install screenshot](images/MDATP_28_AppInstall.png) + - ### Enterprise Linux (RHEL and variants) -2. Select **Continue**, agree with the License terms, and enter the password when prompted. - - ![App install screenshot](images/MDATP_29_AppInstallLogin.png) - - > [!IMPORTANT] - > You will be prompted to allow a driver from Microsoft to be installed (either "System Exception Blocked" or "Installation is on hold" or both. The driver must be allowed to be installed. - - ![App install screenshot](images/MDATP_30_SystemExtension.png) - -3. Select **Open Security Preferences** or **Open System Preferences > Security & Privacy**. Select **Allow**: - - ![Security and privacy window screenshot](images/MDATP_31_SecurityPrivacySettings.png) - -The installation proceeds. - -> [!NOTE] -> If you don't select **Allow**, the installation will proceed after 5 minutes. Defender ATP will be loaded, but real-time protection will be disabled. - -> [!NOTE] -> macOS may request to reboot the machine upon the first installation of Microsoft Defender. Real-Time Protection will not be available until the machine is rebooted. - -### Fixing disabled Real-Time Protection - -If you did not enable Microsoft's driver during installation, then the application displays a banner prompting you to enable it: - - ![RTP disabled screenshot](images/MDATP_32_Main_App_Fix.png) - -You can also run ```mdatp --health```. It reports if Real-Time Protection is enabled but not available: - -```bash -$ mdatp --health -... -realTimeProtectionAvailable : false -realTimeProtectionEnabled : true -... -``` - -> [!NOTE] -> You have a 30 minute window to enable Real-Time Protection from the warning banner, immediately following installation. - -The warning banner contains a **Fix** button, which allows you to quickly enable Real-Time Protection, without having to open a command prompt. Select the **Fix** button. It prompts the **Security & Privacy** system window, where you have to **Allow** system software from developers "Microsoft Corporation". - -If you don't see a prompt, it means that 30 or more minutes have already passed, and Real-Time Protection has still not been enabled: - -![Security and privacy window after prompt expired screenshot](images/MDATP_33_SecurityPrivacySettings_NoPrompt.png) - -In this case, you need to perform the following steps to enable Real-Time Protection instead. - -1. In Terminal, attempt to install the driver. (The operation will fail) ```bash - $ sudo kextutil /Library/Extensions/wdavkext.kext - Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } - Kext rejected due to system policy: { URL = "file:///Library/StagedExtensions/Library/Extensions/wdavkext.kext/", ID = "com.microsoft.wdavkext" } - Diagnostics for /Library/Extensions/wdavkext.kext: + sudo yum install mdatp ``` -2. Open **System Preferences...** > **Security & Privacy** from the menu. (Close it first, if it's opened.) + - ### Ubuntu and Debian systems -3. **Allow** system software from developers "Microsoft Corporation" + ```bash + sudo apt-get install mdatp + ``` -4. In Terminal, install the driver again. This time the operation will succeed: - -```bash -$ sudo kextutil /Library/Extensions/wdavkext.kext -``` - -The banner should disappear from the Defender application, and ```mdatp --health``` should now report that Real-Time Protection is both enabled and available: - -```bash -$ mdatp --health -... -realTimeProtectionAvailable : true -realTimeProtectionEnabled : true -... -``` ## Client configuration -1. Copy wdav.pkg and WindowsDefenderATPOnboarding.py to the machine where you deploy Microsoft Defender ATP for Mac. +1. Copy WindowsDefenderATPOnboarding.py to the machine where you deploy Microsoft Defender ATP for Linux. The client machine is not associated with orgId. Note that the *orgId* attribute is blank. @@ -155,8 +97,10 @@ realTimeProtectionEnabled : true ```bash $ /usr/bin/python WindowsDefenderATPOnboarding.py - Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password) + Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudo password) ``` +> [!NOTE] +> **TODO:** update the path associated with Generating ... 3. Verify that the machine is now associated with your organization and reports a valid *orgId*: @@ -165,21 +109,18 @@ realTimeProtectionEnabled : true E6875323-A6C0-4C60-87AD-114BBE7439B8 ``` -After installation, you'll see the Microsoft Defender icon in the macOS status bar in the top-right corner. +After installation, you'll see the status by running the following command: - ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) +```bash +mdatp --health +``` -## How to Allow Full Disk Access - -> [!CAUTION] -> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device. - -To grant consent, open System Preferences -> Security & Privacy -> Privacy -> Full Disk Access. Click the lock icon to make changes (bottom of the dialog box). Select Microsoft Defender ATP. +**TODO:** Add step to verify ## Logging installation issues -See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. +See [Logging installation issues](microsoft-defender-atp-linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## Uninstallation -See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. +See [Uninstalling](microsoft-defender-atp-linux-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Linux from client devices. From b5eb6711756dc495bfe9f3eb01f4025967ba4c55 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 21 Oct 2019 16:56:13 +0530 Subject: [PATCH 21/69] Update preferences section Update preferences section and minor corrections to manual installation document --- ...oft-defender-atp-linux-install-manually.md | 15 +- ...icrosoft-defender-atp-linux-preferences.md | 447 ++++-------------- 2 files changed, 88 insertions(+), 374 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md index 490b35ec75..30fbaa6c7a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md @@ -40,7 +40,8 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic Follow the steps given in [Configure Microsoft's Linux Software Repository](https://docs.microsoft.com/en-us/windows-server/administration/linux-package-repository-for-microsoft-software) to setup the repository. > [!NOTE] -> **TODO:** Use a forward link for above instead of URL +> * **TODO:** Use a forward link for above instead of URL +> * I am assuming that ring 0 customers will download the onboarding package from ATP portal ## Download onboarding package @@ -97,10 +98,10 @@ To complete this process, you must have admin privileges on the machine. ```bash $ /usr/bin/python WindowsDefenderATPOnboarding.py - Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudo password) + Generating /etc/opt/microsoft/mdatp/mdatp_onboard.json ... (You may be required to enter sudo password) ``` > [!NOTE] -> **TODO:** update the path associated with Generating ... +> **TODO:** verify the path associated with above command. 3. Verify that the machine is now associated with your organization and reports a valid *orgId*: @@ -109,13 +110,15 @@ To complete this process, you must have admin privileges on the machine. E6875323-A6C0-4C60-87AD-114BBE7439B8 ``` -After installation, you'll see the status by running the following command: +After installation, you can see the status by running the following command: ```bash -mdatp --health +$ mdatp --health healthy +1 ``` -**TODO:** Add step to verify +> [!NOTE] +> **TODO:** Should we add eicar detection step? ## Logging installation issues diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md index 80ec6a0f67..9894750faa 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md @@ -1,8 +1,8 @@ --- -title: Set preferences for Microsoft Defender ATP for Mac +title: Set preferences for Microsoft Defender ATP for Linux ms.reviewer: -description: Describes how to configure Microsoft Defender ATP for Mac in enterprises. -keywords: microsoft, defender, atp, mac, management, preferences, enterprise, intune, jamf, macos, mojave, high sierra, sierra +description: Describes how to configure Microsoft Defender ATP for Linux in enterprises. +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, edhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,28 +18,31 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Set preferences for Microsoft Defender ATP for Mac +# Set preferences for Microsoft Defender ATP for Linux **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) >[!IMPORTANT] ->This topic contains instructions for how to set preferences for Microsoft Defender ATP for Mac in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](microsoft-defender-atp-mac-resources.md#configuring-from-the-command-line) page. +>This topic contains instructions for how to set preferences for Microsoft Defender ATP for Linux in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](microsoft-defender-atp-linux-resources.md#configuring-from-the-command-line) page. -In enterprise environments, Microsoft Defender ATP for Mac can be managed through a configuration profile. This profile is deployed from management tool of your choice. Preferences managed by the enterprise take precedence over the ones set locally on the device. In other words, users in your enterprise are not able to change preferences that are set through this configuration profile. +In enterprise environments, Microsoft Defender ATP for Linux can be managed through a configuration profile. This profile is deployed from management tool of your choice. Preferences managed by the enterprise take precedence over the ones set locally on the device. In other words, users in your enterprise are not able to change preferences that are set through this configuration profile. This topic describes the structure of this profile (including a recommended profile that you can use to get started) and instructions for how to deploy the profile. ## Configuration profile structure -The configuration profile is a .plist file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can either be simple (such as a numerical value) or complex, such as a nested list of preferences. - ->[!CAUTION] ->The layout of the configuration profile depends on the management console that you are using. The following sections contain examples of configuration profiles for JAMF and Intune. +The configuration profile is a .json file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can either be simple (such as a numerical value) or complex, such as a nested list of preferences. The top level of the configuration profile includes product-wide preferences and entries for subareas of the product, which are explained in more detail in the next sections. +>[!NOTE] +> **TODO:** +> * Should Domain be removed from all the entries below? +> * Should we add path to wdavcfg? +> * Verify each of below? + ### Antivirus engine preferences The *antivirusEngine* section of the configuration profile is used to manage the preferences of the antivirus component of the product. @@ -240,33 +243,12 @@ Determines whether suspicious samples (that are likely to contain threats) are s | **Data type** | Boolean | | **Possible values** | true (default)
false | -### User interface preferences - -The *userInterface* section of the configuration profile is used to manage the preferences of the user interface of the product. - -||| -|:---|:---| -| **Domain** | com.microsoft.wdav | -| **Key** | userInterface | -| **Data type** | Dictionary (nested preference) | -| **Comments** | See the following sections for a description of the dictionary contents. | - -#### Show / hide status menu icon - -Whether the status menu icon (shown in the top-right corner of the screen) is hidden or not. - -||| -|:---|:---| -| **Domain** | com.microsoft.wdav | -| **Key** | hideStatusMenuIcon | -| **Data type** | Boolean | -| **Possible values** | false (default)
true | - ## Recommended configuration profile To get started, we recommend the following configuration profile for your enterprise to take advantage of all protection features that Microsoft Defender ATP provides. The following configuration profile will: + - Enable real-time protection (RTP) - Specify how the following threat types are handled: - **Potentially unwanted applications (PUA)** are blocked @@ -274,350 +256,79 @@ The following configuration profile will: - Enable cloud delivered protection - Enable automatic sample submission -### JAMF profile +### Sample profile -```XML - - - - - antivirusEngine - - enableRealTimeProtection - - threatTypeSettings - - - key - potentially_unwanted_application - value - block - - - key - archive_bomb - value - audit - - - - cloudService - - enabled - - automaticSampleSubmission - - - - -``` - -### Intune profile - -```XML - - - - - PayloadUUID - C4E6A782-0C8D-44AB-A025-EB893987A295 - PayloadType - Configuration - PayloadOrganization - Microsoft - PayloadIdentifier - com.microsoft.wdav - PayloadDisplayName - Microsoft Defender ATP settings - PayloadDescription - Microsoft Defender ATP configuration settings - PayloadVersion - 1 - PayloadEnabled - - PayloadRemovalDisallowed - - PayloadScope - System - PayloadContent - - - PayloadUUID - 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 - PayloadType - com.microsoft.wdav - PayloadOrganization - Microsoft - PayloadIdentifier - com.microsoft.wdav - PayloadDisplayName - Microsoft Defender ATP configuration settings - PayloadDescription - - PayloadVersion - 1 - PayloadEnabled - - antivirusEngine - - enableRealTimeProtection - - threatTypeSettings - - - key - potentially_unwanted_application - value - block - - - key - archive_bomb - value - audit - - - - cloudService - - enabled - - automaticSampleSubmission - - - - - - +```JSON +{ + "antivirusEngine":{ + "enableRealTimeProtection":true, + "threatTypeSettings":[ + { + "key":"potentially_unwanted_application", + "value":"block" + }, + { + "key":"archive_bomb", + "value":"audit" + } + ] + }, + "cloudService":{ + "automaticSampleSubmission":true, + "enabled":true, + }, +} ``` ## Full configuration profile example The following configuration profile contains entries for all settings described in this document and can be used for more advanced scenarios where you want more control over the product. -### JAMF profile +### Full profile -```XML - - - - - antivirusEngine - - enableRealTimeProtection - - passiveMode - - exclusions - - - $type - excludedPath - isDirectory - - path - /var/log/system.log - - - $type - excludedPath - isDirectory - - path - /home - - - $type - excludedFileExtension - extension - pdf - - - allowedThreats - - EICAR-Test-File (not a virus) - - threatTypeSettings - - - key - potentially_unwanted_application - value - block - - - key - archive_bomb - value - audit - - - - cloudService - - enabled - - diagnosticLevel - optional - automaticSampleSubmission - - - userInterface - - hideStatusMenuIcon - - - - -``` - -### Intune profile - -```XML - - - - - PayloadUUID - C4E6A782-0C8D-44AB-A025-EB893987A295 - PayloadType - Configuration - PayloadOrganization - Microsoft - PayloadIdentifier - C4E6A782-0C8D-44AB-A025-EB893987A295 - PayloadDisplayName - Microsoft Defender ATP settings - PayloadDescription - Microsoft Defender ATP configuration settings - PayloadVersion - 1 - PayloadEnabled - - PayloadRemovalDisallowed - - PayloadScope - System - PayloadContent - - - PayloadUUID - 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 - PayloadType - com.microsoft.wdav - PayloadOrganization - Microsoft - PayloadIdentifier - 99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295 - PayloadDisplayName - Microsoft Defender ATP configuration settings - PayloadDescription - - PayloadVersion - 1 - PayloadEnabled - - antivirusEngine - - enableRealTimeProtection - - passiveMode - - exclusions - - - $type - excludedPath - isDirectory - - path - /var/log/system.log - - - $type - excludedPath - isDirectory - - path - /home - - - $type - excludedFileExtension - extension - pdf - - - allowedThreats - - EICAR-Test-File (not a virus) - - threatTypeSettings - - - key - potentially_unwanted_application - value - block - - - key - archive_bomb - value - audit - - - - cloudService - - enabled - - diagnosticLevel - optional - automaticSampleSubmission - - - userInterface - - hideStatusMenuIcon - - - - - - +```JSON +{ + "antivirusEngine":{ + "enableRealTimeProtection":true, + "passiveMode":false, + "exclusions":[ + { + "$type":"excludedPath", + "isDirectory":false, + "path":"/var/log/system.log" + }, + { + "$type":"excludedPath", + "isDirectory":true, + "path":"/home" + }, + { + "$type":"excludedFileExtension", + "extension":"pdf" + } + ], + "allowedThreats":[ + "EICAR-Test-File (not a virus)" + ], + "threatTypeSettings":[ + { + "key":"potentially_unwanted_application", + "value":"block" + }, + { + "key":"archive_bomb", + "value":"audit" + } + ] + }, + "cloudService":{ + "enabled":true, + "diagnosticLevel":"optional", + "automaticSampleSubmission":true, + }, +} ``` ## Configuration profile deployment -Once you've built the configuration profile for your enterprise, you can deploy it through the management console that your enterprise is using. The following sections provide instructions on how to deploy this profile using JAMF and Intune. - -### JAMF deployment - -From the JAMF console, open **Computers** > **Configuration Profiles**, navigate to the configuration profile you'd like to use, then select **Custom Settings**. Create an entry with *com.microsoft.wdav* as the preference domain and upload the .plist produced earlier. - ->[!CAUTION] ->You must enter the correct preference domain (*com.microsoft.wdav*), otherwise the preferences will not be recognized by the product. - -### Intune deployment - -1. Open **Manage** > **Device configuration**. Select **Manage** > **Profiles** > **Create Profile**. - -2. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select Configure. - -3. Save the .plist produced earlier as **com.microsoft.wdav.xml**. - -4. Enter **com.microsoft.wdav** as the **custom configuration profile name**. - -5. Open the configuration profile and upload **com.microsoft.wdav.xml**. This file was created in step 3. - -6. Select **OK**. - -7. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. - ->[!CAUTION] ->You must enter the correct custom configuration profile name, otherwise these preferences will not be recognized by the product. - -## Resources - -- [Configuration Profile Reference (Apple developer documentation)](https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf) +Once you've built the configuration profile for your enterprise, you can deploy it through the management tool that your enterprise is using. From b1281b6095ade765bb4314598eaf00511a0f62d0 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 21 Oct 2019 17:18:01 +0530 Subject: [PATCH 22/69] Updated the privacy document for Linux Updated the privacy document for Linux --- .../microsoft-defender-atp-linux-privacy.md | 52 +++++++++---------- 1 file changed, 24 insertions(+), 28 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md index 0c56970e6f..0e2884b388 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md @@ -1,8 +1,8 @@ --- -title: Privacy for Microsoft Defender ATP for Mac +title: Privacy for Microsoft Defender ATP for Linux ms.reviewer: -description: Describes privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Mac. -keywords: microsoft, defender, atp, mac, privacy, diagnostic +description: Describes privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Linux. +keywords: microsoft, defender, atp, linux, privacy, diagnostic search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,19 +18,19 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Privacy for Microsoft Defender ATP for Mac +# Privacy for Microsoft Defender ATP for Linux **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -Microsoft is committed to providing you with the information and controls you need to make choices about how your data is collected and used when you’re using Microsoft Defender ATP for Mac. +Microsoft is committed to providing you with the information and controls you need to make choices about how your data is collected and used when you’re using Microsoft Defender ATP for Linux. This topic describes the privacy controls available within the product, how to manage these controls with policy settings and more details on the data events that are collected. -## Overview of privacy controls in Microsoft Defender ATP for Mac +## Overview of privacy controls in Microsoft Defender ATP for Linux -This section describes the privacy controls for the different types of data collected by Microsoft Defender ATP for Mac. +This section describes the privacy controls for the different types of data collected by Microsoft Defender ATP for Linux. ### Diagnostic data @@ -62,7 +62,7 @@ When this feature is enabled and the sample that is collected is likely to conta If you're an IT administrator, you might want to configure these controls at the enterprise level. -The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md). +The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md). As with any new policy settings, you should carefully test them out in a limited, controlled environment to ensure the settings that you configure have the desired effect before you implement the policy settings more widely in your organization. @@ -83,7 +83,7 @@ The following fields are considered common for all events: | org_id | Unique identifier associated with the enterprise that the device belongs to. Allows Microsoft to identify whether issues are impacting a select set of enterprises and how many enterprises are impacted. | | hostname | Local machine name (without DNS suffix). Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | | product_guid | Unique identifier of the product. Allows Microsoft to differentiate issues impacting different flavors of the product. | -| app_version | Version of the Microsoft Defender ATP for Mac application. Allows Microsoft to identify which versions of the product are showing an issue so that it can correctly be prioritized.| +| app_version | Version of the Microsoft Defender ATP for Linux application. Allows Microsoft to identify which versions of the product are showing an issue so that it can correctly be prioritized.| | sig_version | Version of security intelligence database. Allows Microsoft to identify which versions of the security intelligence are showing an issue so that it can correctly be prioritized. | | supported_compressions | List of compression algorithms supported by the application, for example `['gzip']`. Allows Microsoft to understand what types of compressions can be used when it communicates with the application. | | release_ring | Ring that the device is associated with (for example Insider Fast, Insider Slow, Production). Allows Microsoft to identify on which release ring an issue may be occurring so that it can correctly be prioritized. | @@ -97,6 +97,9 @@ Required diagnostic data helps to identify problems with Microsoft Defender ATP #### Software setup and inventory data events +> [!NOTE] +> **TODO:** Please review if all the following fields are valid for linux as well + **Microsoft Defender ATP installation / uninstallation** The following fields are collected: @@ -130,13 +133,16 @@ The following fields are collected: #### Product and service performance data events +> [!NOTE] +> **TODO:** Please review if all the following fields are valid for linux as well + **Kernel extension statistics** The following fields are collected: | Field | Description | | ---------------- | ----------- | -| version | Version of Microsoft Defender ATP for Mac. | +| version | Version of Microsoft Defender ATP for Linux. | | instance_id | Unique identifier generated on kernel extension startup. | | trace_level | Trace level of the kernel extension. | | ipc.connects | Number of connection requests received by the kernel extension. | @@ -149,11 +155,9 @@ The following fields are collected: Diagnostic logs are collected only with the consent of the user as part of the feedback submission feature. The following files are collected as part of the support logs: -- All files under */Library/Logs/Microsoft/mdatp/* -- Subset of files under */Library/Application Support/Microsoft/Defender/* that are created and used by Microsoft Defender ATP for Mac -- Subset of files under */Library/Managed Preferences* that are used by Microsoft Defender ATP for Mac -- /Library/Logs/Microsoft/autoupdate.log -- $HOME/Library/Preferences/com.microsoft.autoupdate2.plist +- All files under */var/log/microsoft/mdatp/* +- Subset of files under */var/opt/microsoft/mdatp/* that are created and used by Microsoft Defender ATP for Linux +- Subset of files under */etc/opt/microsoft/mdatp/* that are used by Microsoft Defender ATP for Linux ### Optional diagnostic data @@ -186,17 +190,6 @@ The following fields are collected: | edr.latency_mode | Latency mode used by the detection and response component. | | edr.proxy_address | Proxy address used by the detection and response component. | -**Microsoft Auto-Update configuration** - -The following fields are collected: - -| Field | Description | -| --------------------------- | ----------- | -| how_to_check | Determines how product updates are checked (for example automatic or manual). | -| channel_name | Update channel associated with the device. | -| manifest_server | Server used for downloading updates. | -| update_cache | Location of the cache used to store updates. | - ### Product and service usage #### Diagnostic log upload started report @@ -207,7 +200,7 @@ The following fields are collected: | ---------------- | ----------- | | sha256 | SHA256 identifier of the support log. | | size | Size of the support log. | -| original_path | Path to the support log (always under */Library/Application Support/Microsoft/Defender/wdavdiag/*). | +| original_path | Path to the support log (always under */var/opt/microsoft/mdatp/wdavdiag/*). | | format | Format of the support log. | #### Diagnostic log upload completed report @@ -228,6 +221,9 @@ Unexpected application exits and the state of the application when that happens. **Kernel extension statistics** +> [!NOTE] +> **TODO:** Is this valid for Linux as well? + The following fields are collected: | Field | Description | From 420575c653ddca8765a27ce2ba6466d7cb3842b6 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 21 Oct 2019 19:21:53 +0530 Subject: [PATCH 23/69] Draft of deployment via puppet Draft of deployment via puppet (incomplete). Corrected spelling for redhat --- ...oft-defender-atp-linux-install-manually.md | 2 +- ...-defender-atp-linux-install-with-puppet.md | 243 ++++-------------- ...icrosoft-defender-atp-linux-preferences.md | 2 +- .../microsoft-defender-atp-linux.md | 2 +- 4 files changed, 51 insertions(+), 198 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md index 30fbaa6c7a..7116f0b7ef 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md @@ -2,7 +2,7 @@ title: Installing Microsoft Defender ATP for Linux manually ms.reviewer: description: Describes how to install Microsoft Defender ATP for Linux manually, from the command line. -keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, edhat, ubuntu, debian, sles, suse, centos +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md index 7a0f0c27d6..5cd69d9301 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md @@ -1,8 +1,8 @@ --- -title: Installing Microsoft Defender ATP for Mac with Microsoft Intune +title: Installing Microsoft Defender ATP for Linux with Puppet ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Mac, using Microsoft Intune. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +description: Describes how to install Microsoft Defender ATP for Linux, using Puppet. +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,236 +18,89 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Microsoft Intune-based deployment +# Puppet based deployment **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -This topic describes how to deploy Microsoft Defender ATP for Mac through Intune. A successful deployment requires the completion of all of the following steps: +This topic describes how to deploy Microsoft Defender ATP for Linux through Puppet. A successful deployment requires the completion of all of the following steps: - [Download installation and onboarding packages](#download-installation-and-onboarding-packages) +- [Create Puppet policies](#create-jamf-policies) - [Client device setup](#client-device-setup) -- [Create System Configuration profiles](#create-system-configuration-profiles) -- [Publish application](#publish-application) +- [Deployment](#deployment) +- [Check onboarding status](#check-onboarding-status) ## Prerequisites and system requirements -Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. +Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. -## Download installation and onboarding packages +In addition, for Puppet deployment, you need to be familiar with Puppet administration tasks, have a Puppet configured, and know how to deploy packages. Puppet has many ways to complete the same task. These instructions assume availability of supported puppet modules such as *apt*, *lsb-release* to help deploy the package. Your organization might use a different workflow. -Download the installation and onboarding packages from Microsoft Defender Security Center: +## Download onboarding package -1. In Microsoft Defender Security Center, go to **Settings** > **Device Management** > **Onboarding**. -2. In Section 1 of the page, set the operating system to **Linux, macOS, iOS, or Android** and the deployment method to **Mobile Device Management / Microsoft Intune**. -3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. -4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. -5. Download **IntuneAppUtil** from [https://docs.microsoft.com/intune/lob-apps-macos](https://docs.microsoft.com/intune/lob-apps-macos). +Download the onboarding package from Windows Defender Security Center: - ![Windows Defender Security Center screenshot](images/MDATP_2_DownloadPackages.png) +1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**. +2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**. +3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. -6. From a command prompt, verify that you have the three files. - Extract the contents of the .zip files: + ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_page.png) +4. From a command prompt, verify that you have the file. + Extract the contents of the .zip file: + ```bash $ ls -l - total 721688 - -rw-r--r-- 1 test staff 269280 Mar 15 11:25 IntuneAppUtil - -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip - -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg + total 8 + -rw-r--r-- 1 test staff 6287 Oct 21 11:22 WindowsDefenderATPOnboardingPackage.zip $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip - warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators - inflating: intune/kext.xml - inflating: intune/WindowsDefenderATPOnboarding.xml - inflating: jamf/WindowsDefenderATPOnboarding.plist + inflating: WindowsDefenderATPOnboarding.py ``` -7. Make IntuneAppUtil an executable: +## Create Puppet manifests - ```bash - $ chmod +x IntuneAppUtil - ``` +You need to create a puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by puppet server. -8. Create the wdav.pkg.intunemac package from wdav.pkg: +## Deployment - ```bash - $ ./IntuneAppUtil -c wdav.pkg -o . -i "com.microsoft.wdav" -n "1.0.0" - Microsoft Intune Application Utility for Mac OS X - Version: 1.0.0.0 - Copyright 2018 Microsoft Corporation +Enrolled agent devices periodically poll the Puppet Server, and install new configuration profiles and policies as soon as they are detected. - Creating intunemac file for /Users/test/Downloads/wdav.pkg - Composing the intunemac file output - Output written to ./wdav.pkg.intunemac. +## Monitoring puppet deployment - IntuneAppUtil successfully processed "wdav.pkg", - to deploy refer to the product documentation. - ``` -## Client device setup +You can also check the onboarding status: -You need no special provisioning for a Mac device beyond a standard [Company Portal installation](https://docs.microsoft.com/intune-user-help/enroll-your-device-in-intune-macos-cp). +```bash +$ mdatp --health +... +licensed : true +orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" +... +``` -1. You are asked to confirm device management. +- **licensed**: This confirms that the device has an ATP license. -![Confirm device management screenshot](images/MDATP_3_ConfirmDeviceMgmt.png) +- **orgid**: Your Microsoft Defender ATP org id; it will be the same for your organization. -Select **Open System Preferences**, locate **Management Profile** on the list, and select **Approve...**. Your Management Profile would be displayed as **Verified**: +## Check onboarding status -![Management profile screenshot](images/MDATP_4_ManagementProfile.png) +You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status: -2. Select **Continue** and complete the enrollment. +```bash +$ mdatp --health healthy +``` -You may now enroll more devices. You can also enroll them later, after you have finished provisioning system configuration and application packages. +The above command prints "1" if the product is onboarded and functioning as expected. -3. In Intune, open **Manage** > **Devices** > **All devices**. Here you can see your device among those listed: - -![Add Devices screenshot](images/MDATP_5_allDevices.png) - -## Create System Configuration profiles - -1. In Intune, open **Manage** > **Device configuration**. Select **Manage** > **Profiles** > **Create Profile**. -2. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select **Configure**. -3. Open the configuration profile and upload intune/kext.xml. This file was created in one of the preceding sections. -4. Select **OK**. - - ![System configuration profiles screenshot](images/MDATP_6_SystemConfigurationProfiles.png) - -5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. -6. Repeat steps 1 through 5 for more profiles. -7. Create another profile, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file. -8. Create tcc.xml file with content below. Create another profile, give it any name and upload this file to it. - - > [!CAUTION] - > macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device. - > - > The following configuration profile grants Full Disk Access to Microsoft Defender ATP. If you previously configured Microsoft Defender ATP through Intune, we recommend you update the deployment with this configuration profile. - - ```xml - - - - - PayloadDescription - Allows Microsoft Defender to access all files on Catalina+ - PayloadDisplayName - TCC - Microsoft Defender - PayloadIdentifier - com.microsoft.wdav.tcc - PayloadOrganization - Microsoft Corp. - PayloadRemovalDisallowed - - PayloadScope - system - PayloadType - Configuration - PayloadUUID - C234DF2E-DFF6-11E9-B279-001C4299FB44 - PayloadVersion - 1 - PayloadContent - - - PayloadDescription - Allows Microsoft Defender to access all files on Catalina+ - PayloadDisplayName - TCC - Microsoft Defender - PayloadIdentifier - com.microsoft.wdav.tcc.C233A5E6-DFF6-11E9-BDAD-001C4299FB44 - PayloadOrganization - Microsoft Corp. - PayloadType - com.apple.TCC.configuration-profile-policy - PayloadUUID - C233A5E6-DFF6-11E9-BDAD-001C4299FB44 - PayloadVersion - 1 - Services - - SystemPolicyAllFiles - - - Allowed - - CodeRequirement - identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9 - Comment - Allow SystemPolicyAllFiles control for Microsoft Defender ATP - Identifier - com.microsoft.wdav - IdentifierType - bundleID - - - - - - - - ``` - -9. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. - -Once the Intune changes are propagated to the enrolled devices, you can see them listed under **Monitor** > **Device status**: - -![System configuration profiles screenshot](images/MDATP_7_DeviceStatusBlade.png) - -## Publish application - -1. In Intune, open the **Manage > Client apps** blade. Select **Apps > Add**. -2. Select **App type=Other/Line-of-business app**. -3. Select **file=wdav.pkg.intunemac**. Select **OK** to upload. -4. Select **Configure** and add the required information. -5. Use **macOS Sierra 10.12** as the minimum OS and set *Ignore app version* to **Yes**. Other settings can be any arbitrary value. - - > [!CAUTION] - > Failure to set *Ignore app version* to **Yes** impacts the ability of the application to receive updates through Microsoft AutoUpdate. See [Deploy updates for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-updates.md) for additional information about how the product is updated. - - ![Device status blade screenshot](images/MDATP_8_IntuneAppInfo.png) - -6. Select **OK** and **Add**. - - ![Device status blade screenshot](images/MDATP_9_IntunePkgInfo.png) - -7. It may take a few moments to upload the package. After it's done, select the package from the list and go to **Assignments** and **Add group**. - - ![Client apps screenshot](images/MDATP_10_ClientApps.png) - -8. Change **Assignment type** to **Required**. -9. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Click **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**. - - ![Intune assignments info screenshot](images/MDATP_11_Assignments.png) - -10. After some time the application will be published to all enrolled devices. You can see it listed in **Monitor** > **Device**, under **Device install status**: - - ![Intune device status screenshot](images/MDATP_12_DeviceInstall.png) - -## Verify client device state - -1. After the configuration profiles are deployed to your devices, open **System Preferences** > **Profiles** on your Mac device. - - ![System Preferences screenshot](images/MDATP_13_SystemPreferences.png) - ![System Preferences Profiles screenshot](images/MDATP_14_SystemPreferencesProfiles.png) - -2. Verify that the following configuration profiles are present and installed. The **Management Profile** should be the Intune system profile. _Wdav-config_ and _wdav-kext_ are system configuration profiles that were added in Intune: - ![Profiles screenshot](images/MDATP_15_ManagementProfileConfig.png) - -3. You should also see the Microsoft Defender icon in the top-right corner: - - ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) - -## Troubleshooting - -Issue: No license found - -Solution: Follow the steps above to create a device profile using WindowsDefenderATPOnboarding.xml +If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: +- 1 if the device is not yet onboarded +- 3 if the connection to the daemon cannot be established—for example, if the daemon is not running ## Logging installation issues -For more information on how to find the automatically generated log that is created by the installer when an error occurs, see [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) . +See [Logging installation issues](microsoft-defender-atp-linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## Uninstallation -See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md index 9894750faa..c203ebd24c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md @@ -2,7 +2,7 @@ title: Set preferences for Microsoft Defender ATP for Linux ms.reviewer: description: Describes how to configure Microsoft Defender ATP for Linux in enterprises. -keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, edhat, ubuntu, debian, sles, suse, centos +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index 2a1e938b11..83c84689a0 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -2,7 +2,7 @@ title: Microsoft Defender ATP for Linux ms.reviewer: description: Describes how to install and use Microsoft Defender ATP for Linux. -keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, edhat, ubuntu, debian, sles, suse, centos +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 From 525a8c89fc7858dc1b3760e0a24d6d1b43b3a443 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 22 Oct 2019 17:20:54 +0530 Subject: [PATCH 24/69] Updated documentation for deployment via puppet --- .../ATP_Portal_Onboarding_win_intune.png | Bin 0 -> 95659 bytes ...-defender-atp-linux-install-with-puppet.md | 90 ++++++++++++++++-- 2 files changed, 80 insertions(+), 10 deletions(-) create mode 100644 windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_win_intune.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_win_intune.png b/windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_win_intune.png new file mode 100644 index 0000000000000000000000000000000000000000..f5c28532260e833cb94a120070caa32c471ecc90 GIT binary patch literal 95659 zcmc$_2{@GB`#&C%Rw{|IOgoW1TbQAg$X2#wOO|9COqRjSNTCv=?7J3(B4iocRLWRl zlHFjkjLAC8Fk{U2AL;%1e*WLzdi|E`_gr;(o_WrB&VBCtKKFUu%Xwm9X1H(n(cRm& zZQEyb)!@dqZTvFZwr$_Oa|ibq=;O5j?jIh=4a1Au%DN?Hxewd#>YM6s+g5?x!*t>2 zKJW6sY6sc2O|WJ2KMw}{)@|E1PJxkuzE!Bx0t@`ifd(Unhbi6s{*XU7ihl>=_NT6@ zxNVeUrvMgSdNv;(>zepr4G!uVHRPj&PF-rg>|oIM(48+_zWeAwkq>8fc|Ot*i+uIa zqJ|ngb*5HqZ(o+(TiW>J_cza%kHt%61!JC#8DVDc`_yVzWF3}>pfTCm5ICnhucWNk zx}OC%ZJsK-KxB54Xxc?jtpPbD8*NX7rQHVha4F|rpL|Z_Z{NCAQr@1tb+_$IOyt3> z+fQHjTkvk(ri<|!|9vlfNpIKI?d>}|Wq7u3P4@Df-nxr?a{T}8N7K1ep;R`a6d4SG zcU|ro<~4YSzodKgit%>jo*Ts{#>evwu=r1k-&H+9hVpIQ|2HPP{#@d3Tj3Vu z^xxZbG2rCBt^5B5J0=VR|F$*R3wrT)h}(D8A8Ty={GS*m*ywX@ z-70j+PyOk+>gmc?qZU;=?aJFTo8&~J^K0_35q&k3o}%d#wl+C`me?M$)IRCmy)MPD zhO&QV1%_OM$uyre7)y!`!M~u3=Dm$Ws^XTi!ZNx3s_l;!An-+ad4@lEW&EOl%FM~(TaJl} zW2gTv*!0U>A=XL@?Z~5)Jvy)N?ifk6IINf+R0@=0{~lMPzwsgogFE=botG^5I^LDQ z3mP4WYN+}5%X)sgj_CJ-#~Em+g%;9DeBPFU@V7c(5que8IJIZoFf%V=Mc(cjY$<## z6BW2zF*xmXp{Y|R(LT>&ky$^w`(Q`QJ{jlKf)Z>QsnNBT)Gk?jQfU1AgxBJ_iv6BI zeK3Hk3}6^R`^|xWHEC+6OhX~4nd!6AL+Ay->{6qg>F~PscXk8lyCkEtXhQ1p9Ed6R9xnp;^tQpj(ZM2lFkg9Zika~^AM$=c&E58?P(w4qAr zo;{QB#PIiE64-7+=!=Axp4Jy2c?G7@xT<<%5F?4gg+z^8nzu!Fg4@SpTiAyVY<-|` z7Z1TDY}sSwl5+93a^Eg5J$i=zT6NkL2ms*wz9R>24qS@B5R=jlPan6n+LHbEQ@kCQ z)+`R^slLn*F%Cnq*0Uc4U^F86@use*8y3kNs7`<~M4d1o2 z#feYvj_2!G%|?=Y#s*CyZN=HvS=7kDyX}5i>->R(ufxkl026+KGVhrJp=N7t_mbPU zY|tlz0~QILb5Ri!POytq&$Ud}Vw&S~&PtV5A$xZc@tQk&ccTQ#tP z>^d&wz7jQDQ-gdtSv#Mgf|!UTBhJYZlk|l^T&^}LLt-zMH|qIrY3niduFzd zGbLd9y*}1ScioC?TLLIn-!b?muiiunS36uI9hc%vxyjzWF3q6*1jH`M=6|2Ly;#o@ z@l$L5%m?OdS{_k_?B|$p-3E?-_*zpEpIschKHOaD+z7Pcg9T-N@~;iD*`7RAxlyQd zucf-agsm?sGKoUp$mw@Q%VI&SN42nZKCM~bxmO%)2a>W)XyS?W)1bgjbt5;GNUPVgW6eXaA8Z$ zm6EvAzejpGD(;X*7d6%Mj{(ZZ2`#E%2FAR}#s|WH$FYr6C#afh5l_J@_|VLIA9$|p zmr-tS{TY1yUEKFtAy8S9w9rChDti1q??4)1?OS+Hf8k$NNN!I~m$K)hKNAEfb~bd` z{oUmfw(%O9#5WbBb@e~T%3qzFG~a43q0enE7)}~?Rso$AEkVrw-E|DP+q&Slk@vZ) z0$ihSwoaMWCND2#ku#Xu8hLQbMm*-P3O>K0_vBK=KrN4(sV;oN)NZOldh1Ps2(Ph3 zLQ`yD$jU9QcFhg8+A}X|ZH=06?jPH~?SBX=GOp^;@yvOIJZI2(ogd0_X6`|)Vc8i> zG>Ck_aSj}mcdKx~$Tv%N>(kq+W`FQ?IMZ!8#_U)G8yja)S<-jGYs^aAWs9zD>87zq zElNHqi(DD7&Px0T@%UW$7IiySInXD*Ua^}Gx=7y^RQ9z ztwBC*wkC6^d(gLA+L3K7;HOL3UMk!Rr>Au+uNZcc(F7MaE{S;NodA25znK>T`Y%GKcFAD7J8!!VeynRa zOG^`|^mla%Ysz(K(oG~VvdAD-C*mG2MiFiar*^&jK61irKOHTP!@>l33O9mC({SH^ zeMvw_2CLW>Q-3=!1wID6QEshv%k@*(DYWW8FeQ!0A{Ik-hvw0M)EKNMDUWul18K|#b8Lx5JtgX>V zmhiMHVri!S?aiM|z3%3B_;ctavMrpD$y`xn=Owwkv7hT`SD$$E9~%9Mhmc~RXEz!G zZ;vo1SR-%(pp9H6qMIGn2%XzS&tnU57$=gg&;#$``wd}4w_Z&B*kAmvlyzmV47ek# zree1YR^Imt58;X2oWT8aEIE94W$vvSIXQ~-bj$|1BR)EC`0=J^!@X{+$BS7|-Jm$8 zQuh-%xk_=z(;5B4l%MlW$B3i;Dy5WbVV6)YxFJW>q&%QttIxLYg$MXLgag}8B?qp3 zJuP{@V@9uAdVn%F8s)Qqvmn2yf1z@~C&A)xYmeSGE-4Vc;qOO>94>&%UyY`u#C!-C zcThQNJJa1BWh`5pM!0dO$>l#ppqu~Qm?M_p({TfA)}5=H<$x*I%E;0_P83ylb9U5) zzGeoI9v<5Ie&q1|{7CZGCzKiEHkPSfCRkX#+lWNv^4t>kJzN3Rz5K7KN-E`l_wsW} zRi{-IQr#hh8ixy6H>FFf()`+f#ymYka}S3`{JSuI@f4I*sep!l*j|xkG-Op)R9x>1 zZobW3R}^31ZlJ@z)|~5Z8OjB@G{3!W?yyVhAvAXc!Z}z&!wu$sOhX|@eBL_A??2iK z%1B%O!y4iLpG);412M#?U~Tc?SbXF`y}N(CFFj$d8O`|zIh*d3d0wNM7*|xr1;M+X zMg4W=&L7WT_;icI^%+F05d8`{2ev1R@%=TwKORK}X5W7sazjBdctNtDn*A&q#(n+p z-fo$Y9l9jY(Kk{>6_Ti4?Xy)>yl8zsr)7`ugCBEhT4UmF$Yi5iDeU6h(Tbd34x7yM z5aJ;Wt%DOiq&Uv9+QC|I-= z>A9Qlk9%1a8yRSF1uFdZQqttpvS0iB*o9c9l#KGUu<{EI+VsG+nC>x!P>7-46Xo=T zNb<4cCwT}9$Mf$W_~WOh^Ka^>-9n(J7!d~k7M@4$?oUl6aDYXRcr&!>LX)-PTIj=f8*4B|8)C&<-#)@i@BNQS_}^ zz_XJ&JGwPR5V;5M<40FAf}i?E(Uqt60fgD1tYhD^_xJ(6OijQHt2AtjmHAnnzgf}9 z=m^gH4blQ$fkqtb32bCjeP=%5J*2~zEMU6_<637Fs*vKG^fY9=KVXwN++`sV`+Hx> zOZ?Th8nQKH8vmT>#W~$5TH%S%sppoyGxHK}BwL#4*H$aMOgR=YG=CSfF_@gst7D|`y_EHo49pW)6ZmD!)$^;e~Ra?FaoP-RdIgINK1Hoo;p3Y& z#FFc`p3BzQYsAjl%bNMTi+`*H)|+-6oIR>xQ><>KR_$67gg4*^Ka#~O@hqA;>)rdk z?F&$075@a22z^KbDtyNm2lbOjEMCv9SWz_9kOV6W7wWy#QewUpo{R}SalYLEd;FW= zjFWn9!OYjw?-%(m}NctN@O z-O`EP+{^N*!h8BGr5~JH88Jzy&2CwpIx$o}o~K>NTtB^Gi$asr!x`@u5n;?(p#8q7 zeT-M@-I}&U*&R7tT^J>zLlZ(dylA?B8#392<)HwPj5NxkcaC{#9c}X zv~Ll*o_R4f6r~Ms^3xRcf@Tp9>57`+pbc~Er}Qa#@nys0IE*wR=>sC7f zvFz--Uz)=hUKb31zUUl7CCo?0-VeED%o%=RNk(`_XWeDq@aGW`^oyFQtKMdLNK@bNv2c_~X0wCokh8ZzZu`gU;) z9s?11oZzdOmhtN*y^^IhUr$-ULccA(8oLk5;x+EAT_2UHc`_q?z~W3o5XxLF4-ROY zI#5GelU6IN)0LFD;JQ3h{F1|#@K`|2OM+}mS2l>wCD?I^A$6u}7F*ERb|WCE+InT^ z?LH^25F>Y;%$GPxxgx!GWuQ^(ED4E!C(|Rue`-AWEo>e9=*m6m1tbhIJ^sgBrOL^e zMow6*r?*{t@~VXI1v4PmuT!Vyse5-&OeXK zKMgL$V_ONU@5PEF^P0!{azA}`HX>WoQ9koofI&sVf{30iXiafb+u*lJ?nxE(Z&O(^1q6iEE+c6 zHM6!*y;PDLcWb%jdcM6&2#B*r32%D=&bDAMD@}Y)XJvB^9(_tfAs+O0yHXB!#C*xzQtn{>*<48M zlu{7CZ`h(5C3gmXXc+JCJgZ4dD}ef9^ybYM1qBcG`e8eVnH?R>FC8q$;qF>A`dHI6 za6~k6)_@y1UtHdVNs&`Nf1H87flcTb;G8Pz*H!?51m0Q7b~xhmn85?~MOfPSQQZ`9 z)J>o9Lj(xt*ZZ!v;e_ogYOLJ0-X~m+{KJ6Z2fSR|F02x=#Giq#IMz9j3s5>Tf=`W4 zIgNrB z3OAwb#}(DUNS^+rB)3ysGRP zOOeyZwfvWSBR?9gLn~IIP7!Ao6vGXFC^Qh9rr=?1!iO|GMHE&i@;D(h& z(}RT}0;Z=sKV*UUOC~cTGH~q{RkQJoH`T)oWWy+>rdD&oa_|^mUagsZQnf704b;aX zP^>gXwzbCoSsa*Qu8T72E2-G=Wi)8vB7cRdXy@?&$C6N40B)=Gb zYH2E9Pcm?{PM)ICJi-LX!B?&6NDj-_j*-#i_~7qMfAhH8*!E)@X{6406r}POtUKI3 zwY>0)(b_EOTHxf*z?v&`-4ucMc9!%rpq<-0g}5fkI> zUr-P-KH^?F7m%Ho=Cb}9c%~B5c5E+?xDXY%K=Mxd0JyVA? z$Km97`?cc*g3{o27UE;A_n(B-FHLO=J?LaMoo&Rrq(Q7gQ#xfd29qY<(EU0nDi)ym zCa&sO`X*RZ6>i9$(qMA^6PC)(A1)7s_kNwwXKet*U)15|KlJR9i8^*-4zjobZM&f` zsDH;Ye1fXR>Yai-6m1&a=dHBQW6m(JG0`mNAvNL#(FXo1T0fUN1&lQT>XVvQ6tu2+ z?*eIzD9|rL5tETJECGk%3v((ntnDC~Cfv;16`LbB1P_?W{;{o^-GYZLJc68x;u|Uh z-OXmo-nk*HhaA&z#HzJ^^N{(q-o^MERfUdvM|Sc)atr-syj`#$6cmt`9eGArq1+j? z_o|9M!i%rN4bM`aT9Kwcd6HEe`BOJ`6!L?veS!2UQYDmG-)TAF^bKyzhQ625AmE3a z`>cOZ1^YE9=_igW_VEyW(%(n^)WY;>-OM)O8jsX)VtPo~fIxCP<{hI>Y_1VY zEf}6HadkZu)@8<7B%;TG-IA7l1VW_(%irz*PKY)b=@gbmDzBj6DRv-G`WDT zl`%h-EE1$$)d05-gFt?Y`}_v{ybch^yH*_#nW=VN^DdMY>vDPjF@p*HmW^i3t52fR z^oEEVYeHfcHmhS}(wl@;N2-8?NZX0ETFwG%wpZ1+C-=BoU8fOW&BSN$IuO5n<>lObADp+qvDP~=x1X90dXKRPp zm}TdreU91qMQip^M1r!d)VwD(=u|Ih>AgGoG-0@1`(Jc=574Z)pG}#U-f(DO^YC>< z07rL3v7)C;mxP5iAY7l-=dGNOrM@c`j(Odp4HoA$W{LS@uZQP~5`!pE@W6GJKQ-z7 zYriy{JIjCMF+grtyMNzmQE2vDP}B;K7`Oc&?oI8H3Cc;K7ns5d-YodFb#%ng%{sWD z5|q|BGN?h#dsW1gda{RY_}UR_acAxh=hpsX$(>y_rt=L4^^IE}Wx9)x_gktv1U$@| zTN8G15sQ4Z2-Qcvh}D47U61Ey@2e8E7@>4)i;7UzpO#5Ua094MDNfckW$bTY+GrVw zBm!HK9yy0)<;Q!T+chy&^$S@36?^1AY;QWBu_dHQyz)(X=4eVhA?s(>wQ`LzUZorl z#r*A&?Z37lfE`zAF8^txc=k6$@~@qn8zlI>nWp|{BU0Uj7F-Y$85~;1#TuUiuITN` zSN->W@PCLjPX2{Jp0PyPKkVf8zOb1e|7Vx~uM+Y7Gm=yKc?r zCBr$H*$FS&9_~n%Jtu(>``t4!rDj*9;X3x{omaPl;Nz2b`MF%)yts5}Da#sI@i@zx z=b#7`L4?lv^PdF;a*Vx5x^DwP3y?LxKc2?cxWlwB^N*~ zDF5(%&^-FNJfE>f8-#Xb&3uJ%s9gA5`97JJAn)yr;(apqs}0c6HA>9HKhoxkR5;Q3 zo2d1HY}Ct4x^{K5-MGHqtYgYe@|Vwi{K@-Ry|!xguD(YsYJP_-)~%VUDTKfS_Wv6P zU+#IR)47Mq46^!UBbges-{MTU!QPF4{K(2Xg2_s5d#RS?~OCf1kX?)!09j zbHju}_Lm>e2)OHe7M9DH_`bfs-(m#aL~sEJ9byJ= zs`T{UP8n-}%+pu@{LA#|=cXUsWN%aWDqjd1fY& z@xFWN3v$%inCCH4akmOJcGs2*$%r6K=qlAtaJ&&}2t6b4@`6~<0FBqUpc!91r7)sS z;D0G*)GNII553#|S5`v%1HKLvMDc3*pm?#9rbe0%WQc1y{!xo0K7nLgn_yqd7MvsM z#eaIYvOT#$F7R~4yZW-n!`xM@+3`=e{~T@opLcHlEkyfoosO96oo%Q@RU8+8@2!gC z#%nd_{uwHXs{#;P8#nvvN^~9z|DiyAG&MyI(q0pLcFP0UWX<^_TKV5w+F9}ZT6s6e z9fvgwFDqNdK|%+qV61`x;3u8O4LHYG$PEJIe)k{nO-N{@WL}!lqoya&kwq zhP$J$B+Mr~`Nlrqwu^zF#oeFo|5F}hdWHR%Mla>FvomLH>rSk0KJl=Wn8fh3-$M4A zRCosF1KKlE|FBnxn@r9I2AK{lblH6z0G%!3!t4R%^L@$@$7*wdXR!{>DTY+3&0d;< zJ7uKx&@Ldt!1*2fwF8SpSF1GImbx+s7_AV!s^Yye0Nq4;(J~}Kxwh&;BD>%&Ap<#r zY1>Tca*H$$lTwh$eB5mYc1f~D(ypHQuCa3c$M|OPR^-%!$UxpcacUf&^qlx=q0*zB zd{-e23pAhY$rBD!{-*YNDB5j(ryiF{9sn3A)t2TIanTG!efJ%`mhet@^m$X0?l81Y z_8QnRbA(XateT7y=zpba{6X&@<%DS8qA$q&zQX2L{ZZ!?AOyIkNk zUaJ_+9j#|r+|LdD^vTnEr8jUxm|Kz2+y8vC3~~0l)uP{_N{2zsM^oQ z9LTC%O_NHGR8K@83uj~PXf}NZitzTNj(O4CwgKIwu7_3Q-MXltvv}eWdMGLLoNmN< zE3O(W>(YM`M4ysYBbcsvse=MS_Uzjx^z7Q&`oyl3xz|UqX*QJS+%gY%IlNo7WzCga zdEl62o2$;~#5s0`%u2Rs#I61Gjlm{8r8qRNIR(F4kibEXvDA3&@^+NBMiaE7kZyZ=E9@i#%6rO2UYiPYLW> z^R0soyeb8$?qjXh7|GKv+R{ijWb;=yqRk{xk>rUe9mHJa$7UJw=Pa@j7$&aQq?X8z z7M&hwl4p&jgxi+}mWEt01F;HqK6rc8l!v5-kyk|V$qm#71sb=uLVis$-Tdy{84SB#m(GTfH{fe^w1T(`QMJwyt%- zk-mjY?@@%CE$LXWhF%B=b$ya@XGP5P36nGIN$o9?xb86xf-0ah7gD)6qB~QG@gE?u zZ(G+qg`>}ka&=8~?AXT_yU0#xxFe7^!E1F|_yNqWOyY>*D zqWi_|L@M8M)NpTuDH3`DkNkFKra66X+*O9%dt?4BoAB8TCeF=ozvz{=c54SJ2b`{GuGeG+b~J@drz|u^u*!sw&o-Cb zR$g;VR7tMPts(m`J2OyiVtmb$Fu^uz&~XRa^HJF1GaYu1^t7rAaV5w4M%31VR^}QJ`zs{g-^aOrk!!QOQ+bf@gt^nf9 z;~@2$TKlPw3)>>+A}dd=%kNn%=9 z<2*1o%x=15~(y}9(UW}mJg z*kvxh_7eI@2yV|HvPA%7aJ@5&x8q$`v#Oz2-lb?$v4Q6eQDmo@MX|E{cVQCi$ckr+ z^Sa@xlko*h%HY!&_SG7xM(L38dIeUeVjBfJOhTD#PcB~O#uhT(VN-OUVft>9CQ8o9 zJEbW$QUeFlnA-9V)X4)XYCe{B*7t{3A|%?9fsx|NumnZIPV{fHr1A(FOfe_?rFz_m*7ob+Rj@n^pr$Q zaP7xBCXBqX#&1_2VlL&g*q*za*IsgSa^0?X9OM}j9Dx@{gD@YGB2^IZ(zoiEKQ#-2 z+^}xp!!Tj|Oc&6jLAhdMlmHrT|1o?a`+xx)aF$I8n{^(DRxdeAW^FiiesbB7>@~KKT}nTCV^j6g zjWi=cjc%8Q+=}EB4oNdO#ZB{VFJH6$h z=v>aBk8Jq&ugF@RFmorwxp~9R$Qw0>r@s^zHNvO4_7-tw9+4IKlT(qFO)ns~?3KaM zS{xo^>Zq61Q+yYA3U;Ld%-K7IH!0wz$~I%_8Id=f7uO#(RwnQKbwg?sW_7pCBAbt~ zK8Md}@1{||BfA{X=dhsQE4hfZF@s1gV?DaoEG;jE$RPbD#r84m920Hx%%WY9mFl@a zS@l7*mkUG4wYjy|pR61MpjV{O{*Fro*5LeFC99evXiWHQkL{R3!frKNEI_Ue90o~a zK}B%4LQ}ossOooka|Cw-8R~%zL)UX7CcaeJIRkAam!Yi(ECh#zBoCIlHXZX07Npfk zwf%hWeIwgAR>Go$^kbnE(z0k7tRr=<=`>|{#WUA%bB3A`o31j%jn8=TxzAYmwHfCK z8(>+Prj_k(`082ucfx$-YW^Gq{d#+HNqKl>O{kqhMBf6jy~sJ0{j;T`bUN4ytuW*~ z1q`|ZgilmP%sSo4LrQhz3<7-_oJTs4+045;k zrYYiVMb~e&QY*bdlC$@bACeW3fokF*;A2x_37MF|a`;85_i85X|%LTTJX{Ua8IWx)F+O9XE5dksCa zu!~)?Tbn`%_-z-ldMiy>C2TPUhw}Acv~AdnSZpk&0RjeJx(A>e-h)I5mCNwnB2DIZ zj4yZuRqx8^X+$7=9=%-rmoqjcB(vC`G+#?>WGKpmLju>{l-RwwSg)ic=c*|D7NwuQ zYmIE7)R_5G=-0r8%UiJ>VT8c3vMMk)Zb%E>!BW@5IyL+t$9hNRu3lc;U{JKiYG!+ z@q8&uv%0}?f8W`q8nwko$Mf%X)`;`J%NPL`fAf2s{yS|cB#faHDRGtyN$t^y{${+? z$iFEc)*v~NU7AoP!OvE~{Gy=n!Q5nHTutUhjiYx$u^P(RO zW8m96IrL6)%KJG0ezUw;3D+uSVK%cl@adpxr`CO|HzsnMvAbk~wC94^X!_Vhjo*ii zp^#ps6aLJnj#_+fg*^brV z&@%ZxLkP47{CXTWmMO>aH-{4!tz?c2s$Qc_0~S0swKgF}nLk;?);zcFIBm1G46o?w zte!UG-ffTgn0fkw=lw5gX@D1WfVMiiQPP1R%Ky+n0j0U6FnSfJxFPUo zADZ=35r;+?0Xf#drOlHw5~sQKt#W0#&%DiM($uSJPfYERw&o^kEk!I6bRQcr4Idh5 zPAA^WPO#Uz$96T`f7Js6zGJEM6{VWsYOQ6P<(#@lU+l<$DuT>OA#oPKgd7m``)KX5 zJ3V)7^T5uh1@TLIc0p@yH^&|&m2BfiMLI6&=|PXhidf9COmG32FCxhTa*75I-q>Hr zW9b)KP9dAMfW7w)^BOCLR?Ls} z*wz!A_xwVPMG4+)EI;2SI~>eT+1*X8*Qa?Oii)&c1UYMz%6#9IIzQu+H`u31cK1u1 zj@Ruel5sPAR(oSPWxu{XeKb=}V2Vm6Y#=D=qs@04-9J-T*kh%_zL7c~AgQ(UT@%$l zsM$-!aHbPt0d;3U8D@mF1(K*91@-jrI8Ovnt-CzLPiD5F0b_1G{Pit_z!-TUe6^Xy zd4XqO0g8S_Ek>5;*YF2In{0XR|0|Lljgw;w;eAR;(IaULTS`##mZo10QfabV~|ki8#%;#gb5qqOt*iY zN9xF95s`y2Nq+*OpL$dZ0qyPc*?ap4$yt0_Mc@#CSqV2HRY*4sB;WqF$EopC>&{Dg zF92;{O~j`Cj#j4(Ik)?Q{7Nl)i1&A_xq}myHeOm=Y~n%mJovimUlYwN?}vG|38}Gi^gI z!*k`|?vkeeIq2p8@tH<`W0-U7^O?E!mR*0iT(xn4<-|qIyCcX z^D8pdo0{^wN_0E4Q~2|9;b*g`Whz+CBr`b^RkF7_iiPP^EdkY!JyjN9$S0Wg4f-?g zd(Kc_!kM#dt7yOG)n?sziWZY@1wtRW%i5^G_{Im7y#lmfKTg1R2+6jzzuP*>_Uq~q zSG`#$U1;bZWuASzJz1;CucGnH`M#LF$*<&ok5avP%M9|GjC9=%1! zjD(CEh1ef9;xSl;TojYeYcS_LOE** zLO(%!Z-`c_4WLHSK#U}3V}a-G8>hLP>K|<1TxXiHTvK}3)?CU@vzQxv%w$Cd8ZNEo z;Ks?y0?8B2{k}!8F>{SiBLU41Rm8GHzy4v4=(A$w=+8GqdTkEf(t!ylxvHp!7Iw?fU!h3Mm z+B~KVM?Ng&R(6m*k<0AH6)UNf-A!F;2Mu*?QYf)+vzWJ3I&FIHccgAPeVycOGCS|=ZrNe1p5H<1N1vIEly}A`l>UZPAabGcX2+$3e0`YCNIr7Pl zO;1hnA4JIccLOP?p-k;vYP$S6!x2B_A5jpldBcP7@T{<2df7Y<(DL zGZhng(p`tApeZa6!dh-IvfftM%QfGhl-+oZHF|P*K=?EgVzHA<=g{%(MLtS&FrK@+ zk`e662=_Q-(B?L0*v~yVNvV8OmfI)D%~x*4j+0cA{zNV#UGF^uy--E{3I0B4-@=Yc za$GF;f45lZ|0qcPKVQrAzfYdW2yaI<+ei!6Q9P~}yigfzQ-COu4vE2eF7#$ixvmDnRa5Th}uYRM%Kx^Rl#d)xqh|o$CQiX8*48d|Re0h(m`A;Tay%sCiFt*CJ-uYG@@9(1#9Z$l zKARtWW>t92g7eD+1G1O{B+hc{;`L$$1ok{xZKQ^YKC7ub=p{&&8 z^>*_blx9);HN$_BY$a){uE2=BnZy@@7dr&MQM61IKNU@B70yF8K9~$@CS3h-{xlDv z4uFYeY}`q2mU>Q^NsL!p5I?{}SQcc|ePd)r=xMdnw0c<^p7*QBncSK;y}N~{^ZU%( zM8KzF!YgwV5cxZ0gt;K|3|55Yv6{JB@7`WWSrE)AnEb`KEB?ZG3M3i+ z9pkE|PdwKYnzJPOi+f0|Z_O2=X?V)>M83pBmyIxk?yO5xHo$DDqn(>ySmwqd8Q_8Y zXyDPYca4RcK3B%-(jB(n#(p~+Z^PH&Mp}oKI>`+W#4Il(c`oRoCl%#a|Jkb z$&I5_>JH6Y1Icu6ctQI?qjV5(4iHimeJX| z>y#9U+DwhRIb;C7&~-vp@v%))GqJCdT>>g2M|{vwT@s56u#y;@gUhK+NqIDKyvKln z6Lk_bq;KO*FrsUDF0o_E3+D()ilvUkf#Xoi)j?lXQl9pVKY|^gG+)S=&MTtVEpC)9xdKChZ?h?f5Zt4s zg)7sYEy}~+QW5ZI)=I5u4q^@2zMKsqR&fjAheARaAEzm?lWTHv;1fO#?Nf)lAB-Tz zLz={hSXze|mZ&m-)he?MYQBys^4ndR|q}HfeJ60~- zQk5pMxSd5#u$!VZE^=AthSL3#JE zG2Zj|6#NHVX3!Wl3hLPd9)o`vZ8EnG$kv^jHxEMuFiaP}b+RDK8mVaS5gmWMSx`3% zQw5XIXl9rCx%LtJKXg@cd^Zl&f@?x>COYUtojvZiEoeT{(PP{kgf-Vc( zDzj<7J-Ept#v5n)n^^^H-j9cfw@(o!WQ0sM;?!yq1dj6~0Uv~Sstzv(R@^JE^UeD` z*0lyYyae(H&M86EQ4k-<>SV;Dr)w>2H^mahXV9x}^&9-P+99RGao$0%@8y0cHwwAr znE*P1Ta@cLdL_Y~6-#ZKrvr|KL4Hi$-2N0+yf&((I6}n~%(Up%u1aV!aP3ade#3@c zXM#^>KWs$PZ^~iDKIBY-vy2)8$k9`Qb+{Oc=y%IHeEn1=)~KR++&nZvlTq2(N#7@> zJzntvGp-wB`=h>OhpjK32Mc6?KpetJ2ytI@``kI~{yh^w6NdpSaIVrVHsX>m` z4EuFo@)(=b^3sqh=Y&ah;_7w5P7m4c^R~d+VG0%i&w`XSOubCgmL%taMi;--bk&t2 zv+gxG;Lj<>_A4!^6TzBkL6AI6FcY$pPc&=mMrz00{_f4HcV|0*vFO-66Cr}4_=e1eAu2{dpcyK!8cr{D1sk|_t|9e)hD^2V! z_{U;inWw_o;(fH2RO|#$1s-0*@nbyDag%#^PI&oHt#2Zc-(~|SEw-B%rF6fS;h##> z&q(#eueJ-NWa9ics(kqrG|t~wD+6ErP-(8NxhLx9h?d-j*GNe=^7axFHms!JoJ*_v z9sU8I%2G(3hweMkd7l|&e{tmK4l@Wy0qg2K_OO}qCl;M&JN9#LKu?~xQ zUa0;BQ+5Y{eyzjV+f#H$k`?h{Od;1YiYOk`K!)l#Xk=j*@bW>|%869fQ0{^C_i0*- zLqIyN9$PxRIHFuL=%}YPn3UBiS9$-nG^Ci|dXDRK+3D=*}rF{mgNUwFFt1S_AI9pQDy<8^YdR`-;Sh)n4S+kl2K)Bq}qzPO&%$7)@ z#p1N*Pt)$6X7`wNzprxYugj{jd=)geQP}@IuFAI&T#=+oUBlSUuK<4;2)Mq$#e(>2-#c*x3>N=37_VKqeR>bv<` zyi#r-*#zqJCJo~%dl@3NTE3D!PYyjbsBwcuX5jrtRp8=qyf`N3w|%ceObM~a(~m1? z>Euk>D&19cez4k`QCzNY>;3*n9qmjAYF?y`WSdUguUMO8rO8|KdjYzz4SXE4kXI(vfxe`)H@HJKi{WlkO@^{+mXP66vuMl3d4k$hz#)owG6Mb;DSA3{>cSH` zQcBnhxXK=b_2+~isU4f9r!9pmz#YyEgp9n;gE)`YOeVZ^(J3Yz=`YKmJ+0uU?3bKs z{Os9WLbFYH-7@vu!P$t`nOC|oRk%(p#d*X9Xyl+pVCC5i1H>4WsfATr{Sb>ADVWo*Q)h#E8Ky`yw0RA`6g*C?2yM>9##WM`DXz=dl$#$xY9Zqi-xy$o z!W(4Dbx>I=6p|3|&B}|g-e1u{O9T29nreqUf&9oTt*i>O61Pks=I?2h%7mc0u51c$d65L zo?CQ#OV>`CePG4uexcLt3%FBG`LYC%N&sUV^rZ*1;|Y6+Q8KP);A#ykfl~H2@AR(~ zN=wO{X?K>wq8l7oj+|GzMYvt;igS-3_|S8A*rEM8(Rh8)1YAbvQ`Ws|PMh{CSNFOp zzbeO%W{&ueUsw8=jQJU}l}&vRpE;#w7UUdou8*3MQ+yODw|2AJfMr~sHs@UMm5D*_ zx>lY=!j6U9G4X3C!A~etN1lFzU47P{gB;NkGN8PzBO0`X-sn^%G}=nI79l5;$*ozx zou{-02`kI3OV@I}y;!d}`!MoTwG-4arla*n|yr=zL zR(-H9sEY=n&s!nU-y%wbn?Cnbh&J~$0bl6*TE(ckhZfC!Ns@{PPD{?7C$9FM%4If` z!ja+;!!ux2G21|=(V&AwW7bXA_8*viVFzEDiy22VBX96uRpYt7We?UFs(rA4bocXR zxp!Ss`D|O7~{-u*sQfVI$Q|D8;=gLP# zj-z860zR7Bw^2?b&<0t8#vvMP z9eSrd>!H{)T-yMo+4ZyL(iR@G|+8HD^y@{9|fYvqJ}i z1MW>cq#xUzVwFf-yhg9$*Zc2;j0aa?!gkquEhoo9A^^+C+#^q=V8dPCn7 zRDE!Z*gUAhrHgX+K9BV5HEHF%H+78#RtQZOaNga}{v^RfzO?m(W_OG4?i@s){`jJL z5EY$CeX1v75*jK~EI#9ULa1llBgw6t0k+_CYF!BQROT4@p6??8BmdDHSu&D!?{bWY zY{0xP#4Y8s3Hg{+e#6DZ)2B^o zk#;Vr-6yJEV1ioSN_Q@vs%y?nKJJD$RNwtIWmWGE`qF{Hf>kkvolvn9iNu`G$7LkS z1cj+zGFsQ!v5!b(RGb%-6;xD8YHuzzHAq8ADI*7^Cl6jlgAD`x-M_|8=?j?i6T}Ph zLj#-dg80ndOZc@ySRzR=SZ#uaLeQ!u6iu-+^g|pyxfyE0MMpUzZ&CpRBm<4Zm+oC`m@q zCKaECxtqq;r1Ez!7&1H;P01fj)hwAv@$jz-R_YAfw=Ec>d}Ij}wJdJ?2$PzU>@`L8 zS(Uz49o!cptlnbI+289m#QwR-{4Fk)lr*uQ@P>E2FqnLrbi7YbYmQvs3U!ca-ch^4 z(NzubtP}LAQW4i}TA3{{KgI>z9VAZdgbEuH3t#S;e_N$LO20m_WM1@a|Lv2!7x#U) zrUVRwBdLj+(A0*@8j8KR{ckdw1eYrm50rN4+a4zk(iGSwb3?S@M>AoFIczJZ?=}%R z_`Ts|sOb12-E$D%_HLSmb33hPu>z@Du3x6#CP%VE_a_@puuMJkvaPCcb2!y@BNB4~ z1lE!cW8IrwaS}Bt^u(A7B8QR0q={!QeCs@U<=24t!+3n6=TzSvlO;%urW}~xY|Yj- za0!I5mo^F%=RJS2IQ+g-m6r#aH}Q0hBauQSf)e;dVg#Ai7izs=di8AKifpYl^pHEi zc$s3(@*8u)TjLxw&pdU6Y7A%HazYPtD-_7cPH$le5(}GREz8sGd>|(12BbFK#GI7-`^sPMC@&k_+tEyM%8f^Xd zXi{We;g^{ayDnPEn+?E3G~-CdW^ag;TWuI*BNmJfq!5E;jS=E7PDa8+_dR?&qLQGJ zjqj5`SkQc&H?ZmH7|$vX5bHNCvpUHlZsQ3rV|GxC%cQtmbZ#Y>!u_0Ym42-Q0#al0a{P9!)d<_!BPR%8s>1qd^_(wC8@eL`z&}5 z?HG0oK`U05oS9M7zH2NW3FN*twsKKbTbnyCbZu8i)fD2H)0#9f+EXNZU+L<()*C6} zKvto{G++{iTX22^fa>;c=u)kzQLSkTJ1tZIG_W;wJU^j7w2o#kt;~^q)ol7pmA)?F z!{)23QoX1-%`@6}jP96Cau;9U_jBB1cVKxr&za^M;UMh{$a#_>g!$Ar35tp0A@v=5 z>1&)E05-Q;q4=cHfG>E5y~C*3`Rx ztD@wqxdqYPHMyX=t6)Wps`8>i@H$!enp zPbprQVE5g2GfxJjbteQpL+buQRb<_@z|aI!(<^94jC+sHf6Br)g2aj?Kh>Mh_IX10!pqPj0oAY_cG2DI!@E}i`J>7ek^H@D zuV{;xk`Kwtru+wW_8B-Ot(gy)_BOFCLJAv0ePG*)$?q_!o@Uc zx9r~LZT7-SJWu832`;knZq4Bx6&`yQHD?~tPL@k(joQ^5{`m3f-(vK~Y>P0pvQ#j* zd;Vyo0){Yc7PcxH7{?Z^{svBvSiZZi_Vqal<+?&e8NsEKa>oj`x8nJ6U+iGt1V>*R zh5dbF=QgD&O)l{4x>${5RywXfcW|2(a+sy#7lLhO4{b`b79(E+Dg_D`I!L$2YObyC zy6!HB(<+VcLZLMQ6w;q&fi-b8ud4Cd4`>4v;i22y1og=f-{6kL9YXTJUF7AX!)dSv z#1Ws>itRe7_Ga#~dnTo{3woj$o16V8q5(JwAx_f}^BZ`f(e&R_ZcL-oCXtfI zWMQ()4{(NPxw&U119nU|YMNI}F|C*eTC_3I>);$NRx2$`K(6Z$+~6PpP8HSSlswA(Pz&?pe#}fFrDW zhjo8|IMg*m>blGC#n!L6SdcX}4f&_*RORBK`bakm#6k?@5`j4SL=ZTT9d1!}>oeev zS&+LaG)_g6K`2UW%F%+yJSM9#*gb5u5fp%YjW`Lod@x@(kNtRh&P@LRDBq{Vimx9S z+Zc?HIK3&&pnuzjPA{kcGnlYVeyg%H%TBOX>FdD)V*$<0Rj*2t@5x`x%y(84r>=P} zwFaAh&m`Hdn@h|Vl!e05ZmaU=$oi&4o{8?MG1D@<`169t3#on~T z0;FnKZKTblEbCF@dxudh?D!Tnyc1AW0E{ir_ob`4xa)(GE3?k6k+bO^+Ybu|HZ99w zgZE}6_|704yR|835w9g%bVI<;5=`Skj$*AbF7L%A+Z6B4!?knw5!keGY8O7_;aU!WcsR?(UHO2gThe+;B~y z7tXl0`Pg@eAj5fI&*ZfVlJ{Pdk#fsNAe@Js9p5)p@B=f^3$DgOa7w==O>!#1Ke`zm zYojZ#;47sJ>Rp`WIr?*T{b>HSlMamJGN3qACZTNG@G^H<;_f(F@(JG?Ud)2D9+Wf5 zIywJc*^Nc^X1J}K3*88~>7$HeQ?I7k3)(xzH zajBL@tSE&RQ>E?whhBc|%l+^^rM3`OMPgEy+2~z50%aBacx;I-E@6=DJ~c{^7;hg_ zJ15blBj%?ePSFEyN?cJfAV&K}Zh-g-@;V#Wc5O@v%T&4Do35pei-VIS9?rj4{jFkn z-EngASXKUPYUwRlBs3al?>4B1{h~p7Aa?zDUJ*akjU@^+{o+Z5hs9Fd_H*BeD#?-e zA2eu@Im+Ktbo*SGu~B0#cbkl=D-f@4_K>krt7_S z@Ardm!RDhGgM;g^#6C1h-DCK%p2OC)|PP`=p4`7%iQ%Uf8qZ zup*mf@iy49-P0U@OtzApqB|fP?n8_1_wvfzBApDc8 zPF-S^tWkBS;PR#fJ{EYy3b?)`7t(pi_lr!twxyYSah?6J0UrEqZpTFr+YsA{c^sCAkYA3w8wTpu3B&n#=IX@3l` z^YI5I2(>V6`dd$JP8;Kv_`uDk6?G$1dY6C8!2u8U`|WG?zO3oSyIQM@Hyyq8Tz@mj zdjFbS;)&nvvO&g#);;=NS^9a&B{@SinOx$qvK8 zqg)m`gB4Q^edFt|3vMDlkoCIvlLp7GHoP&V@Z+?|I$#%OQ6R+uQoLK(Q|?x3REbja z$B#B$??)mls`#?_+v_cRH+$HaAG(5!)AA6ZrC34ciqlfui8{KvAlY-}1>063s|&6T)jZv>78B=yn%IezVb{}(33|6k6=|K~T+HdZX!c1=45Fa98;cn!6# zSsMXM(jJYL|AZE6)x zi4FmD*81!XT|gbST(l)>w_T-oxevzen@Gj_s{B9CzGZ`@FgMNo`^~ma<+u}V=IRC8 zGp0!`XTDkb16A4YRD+y^Q7PV6%Nb$z|W_ zT(^x*|Rl@$;?YPOAtk%kZZOFWNv6?`#Wv|NB9H@kf3My5o)k>m;$OSZ-TQEaIGw z4%#mg;lt%c`o;L3`{tVQgF67^eHunT{L^=~ww>^D&*&9av;!y&PoJm7AIvtJpX?SU zTMs+Okf~`jzzwH!;UrKL2n0eS841GR!Kp5s!!^(T$j+3e-iZPv8*dFyUvq@5yQ-3W zyr5Zy$1?{6a&nbVj8r*R$io62Eii2P=30`#*(?j8dz9jj?i12LCR)y_6lYUx+L8%o>Z(}Tk)lo)0IycZdu>u^4H-1 z0kD$=Ge;;j>P^T=LnTgX6odVWOzzG2p$a@4_zytlEHR{K)j3w_VmIlntM|b z&%vc!zcSHO#DHktq>MX@Zj29(2`w1vXP=IQntcDBDPquXz7TEnCGzM5uTVsxu!Ni4 zk)J#v_2+Q+Jl5Qt_6sCH@M=7?%}TWf`x36KR2A;-e&vZ=CIEg+PY<$QZ~0yCg(&U| z?u$)=Cn1_2vA2?j(GDcdqvh;I%zE81+Yc@#AMCj!c$yH(YMhB^z~ZP8LbX-{Im-+r z9yTXQQmlpVlgcL1#usGLf?uOZsvW+Wh7*f)htt!kru(&j-E~y5W&s%pHv@KcuNcHY zj6I$M7Dp+6)q?GJPg&m&)!AZIH+COn^I7(OND>t*dpP>gHFB!PlLdiREUsHqm4$VD zFl!q)8wkb1&CRA4sa~a_YK{}q_$_N^f8p;de2A&RwH#8l!q5V%lv)ZayOeB zC;-U&W8x~>WcaY6ysZAugFvK#t z$A@-=@;+2^QLH!;C(#vnx6w(?duVc_UuU`K@=ce`p?(^!;fP9;0(mSo7qA1&ju|yP z02W%hR&`6uU+P=`wimc~t-2G+*!Z1#IwkrA{fgC6clBXD&h;fDdbG{gu5Fpz4D)wi z(45k^`BgZx=?`!D`T_B@lYE5}j8g^g7_JZEfvb*yj(VczqI~y>ad774po_eyVo+Jw!h}7AX zX36o4o*?eu_Sg7$1Bxm74c4rT`>@O!Du*;P*hnXIZgUl{dC4NVJ>k%0Z@?huGBUpb zd{Dh(CC30B+xgFtA=a+yzh;e)1>m7II^@b`KMIms7MDe0O8t54%H!h&PKSN~T+pXiBF;v4lMc&m3mYd(y4&Z^QM@y(5*OE|ip02@yMb1) z-OyRr8^7MC5!11BM4wc1$E5B=`F+W!qcU0fJ{if$fAr*AS3u%`=rzUZFT=NiW=UL_ zH)8b%pV{!SW>=WGdUKYiPRcLk)7oZWo!Rqhm^kg|q9$upreVLQg1#>9#PCjllED}? zCH(6!V3%!^lX*WGD0_k2eGYuOs_~>aU2+YnK^f{1t-^*qvomWuLDDY&FxhH##5oM) zECinb?7pDkQEGbcqKx|sT~`}IuX<-mm%47|l9c857YBcRXV?vS_B=_fazm`2q zuV|pc9#|i}ZPyTy#+ATw=P2esD0cL-@qd<$8|%erOSixM5Ti{~%nBbmco`2j9TNf& zNPp_7jcEw%`~h?O{>y7z&JfSv>}=wsl*P;WmYo`=PTlkfulfo{I3Al_afpiFw~KPoOM9R`CZjs*Lt>L z)X>b=kUC@qP&;}XDI!pNQ;MMS)cwTiP(4ucZo6#F-Q`m{D1NdUuv-6(!&>{)s}kpA zD!iT>0<%&=tcZU`Bl4lEU9`2c7696I?&sEByB;QwI@v@yQ&q6=I-HauF8;rNsMh!P z36b9QF1vmoA;C3d-_haX#hI-G??^lBW@u;3+|1d7Ub?ujJ_cm(v5tw)%-t}Fv+XyK zEap`~#VV~Z#HMe}!txJL#x5YBG6>?demEcXx>eW9c$(Mtz3%}8I_&2wsjPi0>JE2T z1zYRo?FR38*XE++_|SXICXU^Jzo`3r z6)V1p@HQ_Q7fe07P$z-v;H8VhP4TbdmoJ$0hK7j%3yC_CL^&u>wa#xM==XQ(Ye=;> zAb_XQt2XIZl<_CctjE)An9YVIntobonrANJOfP@e z8;f%o-gjdn>x*i)!3*|8LHN4T6c|nB*|Fy47rlr;crP>tw7{8r`#XURILS=^ghpM_ z#HT32oJA7|fVBnp2fO~7W&Wb30GJo48z*H{P=3R((C;@*Rm!V$9#!de52{yg-d?$7 zf%IsDCAg`vpjxHiolrG$--52s6A7(cL18Gv&(F~Bpi>{bYYT@-OfXaf)Iq_xl{qJH z`I3-TB^7#t96IF}VHl3U!UJQ?Jy`IW4tqr9eJ4bDeB(;D06c zRPR~{6@0t)%+Rzvth8Eq&wjE=vByHwf8avIi6l}V_k$o5V74*p^%jC|(O( z>Ets{8;jjUe~6gP?m8Lp}VJeygrI?I%fmRQ-*h6u;uPx*c_^28iz!8 zPr>yt+6mB2ewA9U+O7S(tfGPsgAzs?6sRk zuW4hV6Q#X&ni&A`HzGo505+HDyxB~WX^~@s$!0&n;Laa()mEaQJ16u$R&U`IksyL` zup%-4N?sM!D5YyTvJ8Zpw1)71BvYA;Ep#&tmy`N9R`ewMbxQ}czc(t^h4b|fj&B{I2H`H`ctr7BDY*2%ToY!I01glvyE zGc~!;G#hX@uIn^fF+@Q2$EM#@gz62*&pHRoRhCMIo+xDILi@)x)PhxgC`KtdVmVio zppPX)p(jQb)|=wg-w^)julcd^U?ODlD7C&f!g05qiuuLmNC0Cf@y}r%2KFiE4hX%X z{nm|d@=pvo-$#-u-zbJ0pT+yIHlI~_yY(*0K;~LXByQJZmremI^sn8=uL7K^Yc=?8Fm!9=DRx5FxqE^iU)b? zm1Ov7Vvnfahj+~1t=eyYF=GTX4F*LOjr8Ftvk4~Nri*)pn#H*InlnQIqrr=@0*D`2 zR#+j;&BiS9%ForH@rUITf{D4fgYUjhEYLAdrc%Yn;~Zfilg-zj+$8!{`6O~Qsb;A! z`SKwp2EL>S_QK>rQfh4l+4gHh)^F=AVL=?7Meed*k0_g7xwa+&^88=mMgNiwmI`i5 z*PhCLxv6vBUeS7hmT=Tx_y;CME^dk0K9;t%D`%d|{QSWh89rdLvbZwPGq3R~u|r|D z%Co;8>pQi~C1C;D%RR?A@-lM}gzP)x++eiG_?C`8ygy;&o3V6{{x~82Kqe_;kk}Y{ zBMG~iacfS#q#gD}FvtGM|H6{L_^v!l(7iaZd_2RPey{dKRBTqm#nIAl*2E3JM*A1x z<&J;Jddq{E5?KE;yECq5`~_Y73&*4xGwU2P=NIQ_>!qL4#RM-E#ej_ih zY2d6f2_>1yzcTgzMOf9gNh{N%wT6a>5iJ0s5x>h}{l5v9Qo3twn9*=|@8Jxg=KZuk zbM*g(PlZQ`74Nd4m{hTl&wl|Jn-04=Fr@8)kO?dSgmR=QTH63BIH?cIK%isbskvqs4Ma{$)f7k5m2 zi!$903IQ?|(r(CZt^6Py?4KWBY<<`CKVdv;a_xUZQ2_<_N~bOStUYko|NPf~uN>H? zuYp+|{(fzDG3x*PH9uLGs?KRgXi;cj*yTbU&uiHm#oH_fR~**P5OW^z(`&+YXcPG-kz zRA4-m70|*%?0=k4-`_BPrK|Io17S=FlYYl+UqwCuha$1?t&X4#U+?|T(^}qtOmKcO z)1<{qXf!{F3iTsM)Q`yam>_^RM_rKi0nE~H!866q5ATi?y!sFRs!-X| zSph&#UxGCo%EA#p0OHhRkvVv$<>iK~Ey||#Dy6nw>Cz57M1;Lgo8Y)(G{vS%PVx7Q zX?{}k%gQAzKmB8k6R2xEfH5LSj13vM#Xg9~b4RN(Z-i=Bvp)NEcbo z8NCkuHaTu}E{7C4%}nj*SaBvISNyo{x~b85xp*{BUd!6qNNK>RW7OaiM^Ppn3O`Nn z=!*$zEEd7`58}ebtIA+T1kVA*!6KNAn^U#iO{lSC4e=-lR31MEu&p@%u!_T_X;L4m#zp ziZ5esOa?XrJD?O1=Z5R)QG9x#vPy*kK=S__d%9>jofVsIzuvM%T6mVU8<>(m^u&IQ zf!LccJR7v8bs^gJeCtsF22RCDN*Sl>I> zNbtxO4gZYjzp`d&-1=hnaA>ar5)!0@$|Pb{*H#b|v%N1CKU|MHn%dF&G~alhqO zz1Wwf!I`U}?^m~YkDFhckh9>FG~TRo(;Z4BJpcg((F-a*-kb+2@TY8^BkqtYmzJV5 z}&qJ29Y48pmar*AEr^A#uT>n}P1d5Ho4acZR9+zOVVSXlCB?F(aq^s?!sn zU)sWbTskKds$7i`q6xC0>@G3KhUUWDDfvLo(3VN#S=%tuj7sVm7pPAl{yKZxWRHB+ zq{#ysZ#Y+go(SdbV_BVaR^P+p3GwdWKDBO)^fyVKJ5;UR_atHNd&Ahmfax2m zg*Ro{(UeCCC0O#xr}ap{nD)-`z59rb`j0veyi;_UZ+7gSNwqRji##w7dJdWBeS^B{ z-9m5r*pO+U^9arUAZ*7nIu7(a7p%DH>NtwvCdkDj@QO4UOhCtU9u6)L)!b~zeT3pD zQ>jz*#N1W$rWDMH@{iD9mMW==fy)+0G?&qz|Ae-lj9D4Q`=6p*ZOWd=y%L-k5QIaC ztTFhPy`1~UBi%nIWYhJN3SXmvuQ%Y^S);VhZX0eN-&EU3ZN3Qc$(fdY)xOPGP^b|b z>V87HyIEtwdtCr{??U5n1Z|sfEp;3XJ98x{z~`V#i$(>^UIBZR==~}i*M_C3UuQ;N zlbP5~FCbUOa$d5)*;ci=ytDd?7Y>8f=kCTVVe#Ev4du6MqkH@1j@cS_Jlz_L?S&{BtY^JZKAZ5}dpR|XRAw-k*_--H6#c&oEHSeH_)Ge|MaSkp2 z$TS2MCNBxu&$WKD`iICcNU7Wjm$NKE-6#-VHagZaakFDgjfV#bCT7nOJ+MY(#N3O@ zvhPMCJ?Km5;tX@&aQcGkFr;KA@|CsEJ;C#K4vpAGvGPRg%661@( zsHTQrH;NWS!Bz3(I~3;wnX#fatZVMB2&iVpcQ`ECRtMSGL#a-i} z!N%wiQ*QGX0mEr1&z*YfNCTo2F%~<$n9GdkDCY>qh`VY{*-KCv;+rO7iO52@H3c(_ zjW*#31@uRV?F;fTknamhFW6HNI{7R{;#6}t$(eM&J163fq6!fj*)tZKL4*J^ew&j5 zu>Z}?DvQ%9pK34R6{@N8+Oq|iH$QYvW^AIhXxIeF;zBAtCKt4$ivp~u?B<`&#axfY zR_e5)vrmhzVrTVW%g@s^wAV02jDJ8)l{@&kMAske6)8WhIc>RcCYfj&?3XU!5F6%2 z*)Ts^@8}acXd?6uo~i+co6c&1g(Z-)Cy9gL{TA07TuX#E368#7_~Xe(s^NMz>{xpm zSNn9SHD^aJbX0GbOmEYh2i4~%lu<8Jtxtc6%7H}-!UW^_8Ef_Q`$#Umkslf zADeFs+z~kuYfo0O6JZ-c=zX?d$@Q=#K`Gx3*3-K9e4qLsTO(4EV`8u(ysrUudrx5fOHT2Bba zzrsQXe->)I=F0-C;_$jN-tCXxpGS7eveLWn!e?ZQ{1w|DIn_xAP|ckmw=CN-I!aMC!#NgzYFi1ubso2PWocA}9) z5(?Df`^0r=vSUOeOXVOU$paM3?2wUt{JddYOr`z3vUZWkKvXm@S1msA z7pRFnaD_i`RX^o_QZEkVW5P)@xHhOgX%gRZjj{s2A@hdKJ()v#JA;4f>FpRu zZUm!j3D8+JB7IQK;<_*-XDlaLxWLcJG~|ASI`vs-PbNVsQFlBdd?bAnJM8;4U_C1G zoQo4%xn(1tMm!hzQ~4Vxp_d3T*NvTJgb-rlPk1fty0=pqjLuXVsmu%T@TMZ^*xsn@ z$quIDKz+H2JYY59E)}O(&|=@|sr3!TFDGRf`VMxtnv~JnO^|ur(N404MsrrVcfB9 zyb%r;@g5scOyZ`Tfgl5sMDLdU&3{1Xr@({Iwx=z>T||ic!S3Tph9!KHNE}>oo+PS% z9j*QK?Hl-!=WgDQ`^c5qy6nBEc}fs!UQjY9o#N~sKJnU(<%}jzTMc7Eur(+{*+qDc zel_Gru%fYd5uD#G3{AlQUjALuFUkl|1uMcqYTn_K?YX57s;8hK^!`<~_gyBNW%9)N z5nrQb8~yHg_kh@QlgTGxZ`Sn&KI=o*p0`+{S9y9bjehw@7s>5*QP zYEYga%IIVYB!m?OoA01_c5C9t|j`wV(aU~zS=e4{C3W+YC^I+8h-ccFM<}s|D?Yn&~ zPk3F;ZapLpoc4_Y9=h-uQ}IRJp*D&CiaU)nOYvzQ>@9}%RaCY143^zeA6b0@lm2Fn z>%4jME1?*dztoOH1m$XO0x~yM9({8zq>@Q>YL#wBW(}v)cn@Lu37Aa?V4~;dmw?_O z^pgfkg`po|+F*&?K*N-Zqy`@MY38clrQFnZEpTjNXg%av-7aAxEVKfIh=*T*WK3Db zvW87I(e2@RuT5M`ETZrlH=Ayq=mg2}_okbAD=g?fR;v7H;!GuDH`6cPA-6&?-Q$Z+ z1G&3CXt9^{=`Y`OKvgCW>ft!^gnS){PfD#@6-zIMiIm8XZ`Hidh)LgX8*;!|F~H*k zpBBYPv6^w?b7TMl1B;cjCD8xSO$kw}4I>u)5Zy5Z5ufwt(){RsNL9x=q4Xp$j!~kvwQ=l_J2xJC zoWDz+4d`v4)h9HigPW}BH~;QjXM;k3=JHg>zi<&)@5?k8XahhAy{hxGp$ zR2(XJ^}5JqQZjnEPn}ZXxI5hG5xps^a=fU^)7l1@gsuM!JhuRU@b8_q!~gMX^q(8L zIJ$m*kUxA-0rn}$EE+~5YkWv00GVW8I2iK)dcjE^!2V(BWE&&vy)xv z9~+r~W#;g|H>tTme_guk4Og_^vICUbP~2M~#|ZoC1^)D_DEY4orH8Bsu*vghfoeL5 zF>`LT<_^If{q||N@3}qX#e`p3m49ap8YO=KVdzM}vt@RzD`pG#FS8v`M8NA-on=EIjySPhn(fPd@h4v^K|)ve^^^HjG6 z+cI}1aCmoy0rf%l>V$&`%Kb2KWJQncnMTZOR8f4Dp%AU`Wdd(PbYbHciu5L7vM&kMKwn7Av&kg|zcB=lVGHN1`cC*9a`V%AR@r zO$hF`m>kUIqfeB6ldI0a-6RReON>^&fDqlYfU0N0-`Ze|&Wpk8Uj4D9O@o=vgF8Rbrxv5Q^jPV1fI;5}&`HZZ+RAFk7$GMoxm9lrPVl*qV^mY;!ST z_b_s-`uJwY%9Cd?F&L60IH(27N_S!uVx&TfAVSj$GfMIi~ z3@<9}k5v)`Os2$XsTqUA@lN8)6T(!Z+IgcZbRee*RI1gwJGhmz?BFiphvuA<8M&E% z@B=%6(s*Hf=UYN|Z+Q6hk4CbMnquWIFjJBJ3@W#*G3;4f*vD*ET-XeuR*j(tw1hzS znm9i>%@p&yla~V2IrmTIunpd`U%^i6&NNhprCiyZ=3XYUURWM`fwR$jtjb$3xgu_9 zQMX0e!});SF?v_e7#*kAvwRAud^yWr8+f52t^8d0ZDJW63xBc zde|rx76}3LNjm23$%18zx~kWTZNus5s&f(My`ve6K}aUeJ9>EskRwz`k8{9m2x%LDb)pHKVUg^}$uCI3kLcz3Morg#JyI=a z^^ch5W^SwRbdUAI1!|9@KKG;N>o25qW&=HjhDE8ocogRIL6gJJ;&pqKiekHnSwG;M zs?~sRTZ%<~+prd9^-P&4i;0>%XwuQx z3hlJ)J;R^7MGDD7^hO7-#^bYfx%H!soQg1;785)yiEpQmJB_a^Q6bW^h3Dya=2x5t zbefM>z0#tI>p|B6Wu;T;IA|o>v6v^*(&zHh4r}v`3*+^|4r|P#F}_QVb=GKDD30Xs z_2LQfk6Nr0j;yJ~&96c__eZ=X_f#n)9Pq&QY}Ih^4HN9<9x^%>e6_R^ErAKrw|d{N)XtvX%vx$#R&Emt(i}mG6~wwzY+_G5V&;a@ z@NbQzdm~t)8O2hTW|f@9XK}Ehhj){^j4+6zlcQKg{IEP`GWmr*dILoOS}!>_;HuP~ zG&_)WBY}3baU3eW=RqMBUE8mMT8UAC?SOKv0Qx@qjLoLEko zDq_PE%u}5E7D}uEczZU`*iQhSS%4AtE-+ELa(!}TL96W`l23rgYVx&aa?hDzYL`gg z_Y?K940AK+HHnt98Q3@4e?a<-W;7vco8`}OUbM`-G7gB5lUT-MW|m4jW>{8l7{QE; zD;WlA&H~FcN`5W;8_&F@a=0>Q7b!wdiGb$ID`zCovqnu6U9aQ#$q1~Gfzn+jXm!PR zXUgfk{F)k(&q;v+d8k$Rks**#!@wf>B_#EZ>w}T_Jw2KFgfZxIOaQtHDPG$`qF%ks zH9A4Mn0Cd2cxedUu)6fZIobV9(@p;K5sa>hGqCquc3x;dL0$Q-I>|0!)<_V)_BYU7 z^>8)~q#2kY^B!zrvV&52rIHlJzon=ynhWE~nB=uiFch|FABdz*J228A`?yr6D77Jp zj$nSKn{DRw?P|D5#`V}T-@QGx+OpPkcV^BWm=r&a=#E?-0K^r*QyuBNiQ}9@3>PF$ zwv*Kc!&SHYI`~nYnhqtvH+XLrUq;Rx4*J~P9l`neo`j7$2RfUm_4*U_Be1*SPl3RL zJW4?V=v%UOooRTJr;oUp&1xpjEyXzJ(G-`5J%T6@Tq8*eaxuvL&%dUy&b>9-{;DTx z6z2@;3Y)`tNOJaji$$2;wpe9?2WN(w@E6o=@0qj0THr&tFi+9)jmZHJks4r)9E&S=Ii~c)aR`Qc;l$9gMB;b9yo4A zC!4nq*JlMPqCC_Chmn&g7dL@d?rK88pW1Y78&`y-l!q61)B2I5OABpfe3KiUh& z=Te5>gkmzUxUh;w=ZJzLfX=Q(W0s-g8`M>2131_f%c?3>eeXy_A}D@hFQJx{+OPSO zpQWcR41H&KArLv`R@z1KX&Z8YJf8x)hsFf1P&7kHm(euLZ;FnQ(0bf&gy%ozq`Tbl zhIs^GI=&(pyHjA3t4@iYVV{plCKZ1xGtNML;gog{>rgNwl}1t`@~aUij-Q}U1E5jp zDA?AKgB-OFU|MyaanhnZQD5+Qp{{=q=5hp{bgQjNt&bg>gqU z$1XS{ioyh$Q&wTd9_gGXH}Sd8`!(%J3=<^icH1s5NnxMhVy>JhVi9j*tXMae@>Lvc zOoxN>Db2Kj*vn+JP*acejZh28Z#psasO&mI5)|#r{kDj=*H1XdZ3x1fR?>vi%c^U4 zOJ63V2^44?32m!?M%1M6ohQ08%R?u-k-)*L(ECE`MJkfCVC0&|=vyi&op}tj;@cVi z^cDXi4+@L1iRN1=>H3AR?&WxNi70>rv5-m5e!l5>*s%;r*V^`b54`>BwVxO+Go8$a z2Un2wE2B8Gpsz-gH65eg(eC<) zM6^=_X*Z%ATW0bnO&%2=|CYH&Fps(}tZ=|L&(&|l_ZbpvR7jT9^tIzqu%wwv5zbR8oYq3{01?M9(aXZHfwZV7L-phuL=!WG;Yo;4aQ* z&*>F&GXvX@O*(WJ-*(VzSd;J(0RihF!;{1EHqq~5j5O5(pu!b@hJo;QHoeeE5RDAO z)d`M&lUC6eJ@|RX`DcfbI!`hhcG3B_14B9!pxSv#kM8|Vb9?U~XCz*~Z52*gg4y?_ z$KA%_aSKW>Lt-(pkO=wgUhhZ^?VdS>(NQlzZ9hV0i``3xh6G# z3L0n?Vfm(u2|+;X+-{=e`Sx_VZS-akfuR1Wi(fM9FE<;U&3@yFGp4`Mw(L#Qh})jL z)2`9=>K>;ZBhTSDpf_n^mN2enJo&{HQ^XPb29S5C+>CWR?^y5cB4~ae@??wkxV5)4 zR8WpMQXCuuZdIW?ZUS$a5FKSXGNU+?+#`AMz$C5vJIS#|`E4 z;o9_^rP*=U{e<|p`5-RM1xPeLn{Z~(1y(_F^7xRvZb(Ov+<^^s@IK;H&K6=rl5d)P zKw;|~RB(H*M__P2>Pu>b zE?*bT3tow^1o|_zfeWbAMo?|O4#}L+zi92+zOsqegjaPIkza%2Im2%r=wC{99HlGR zvSUNb1C4@@9sr{X;dNeBmE$_C4GWWM2Hw5~#AaGzXhZh^HJ!uA2rRu-86QTVj|ex? z!yS*ti(y)IN6`Ip45N1sNk7je-)!Jq@KE1It!L;`K<84E))fa|_HGAS!9mC3n{YQx z#=o~Q)+Qui$L|})le@1zP@Lizt(JXmFJiRWbZs)Cj1qjj_pvs@KGU;A@V+oY3+$Mn zf@_bsOpfbRjMv5j{>1 zy_Vu#do*-Y@$IQNplA4uW#`*7btjr^eazh(viEw_ z{#A`P)!ilup163HB~zr$bPpr*?Za9A$nypeoEU6K9`5=7C5pL3EVEnu^ckbR6? z`&JSlu8~-}Ol6V44b~%sfAn3z%4v`>!6b$FVQlPUukZ|g!L1=1=cv2~^ia>S6_ggo zHL|BwBK0NK>oh%4zYLagE7}MOB$({Vd<(mcOUg)S6^yMj`N95jk|~(gie7A{lcXc_ zpueW6%A3%3d4EPa&k*7T$#c#F0#FlZ;~o0RfCc)+u1#;JHqd+ z6LgSSRX3?*?z!CgMzs9=zy$BzIn|)tCT9HY;0t9yas`TdzW2Fo z$UVro3tBOta>DnyYg@CwaBFH}12eT~dZ>KevAnA65Ij;m#?XyQEuD^hXY``Gz8A$A zRPY%!Qc{_XacKmx>vb_@=;eM{oWjN+QFFFtJ<|m!H^c6qL7I3ciY5h%bQMJ(lT1;= z%kHe_BcKHMfuE{D9vFJB&u7ec`Jd%*`5EqKF+Y<7nA9_hD-BM51Q7d$EMytP9*bcdg%K(rkeWp4PX3Ftaj-LhqC+kk=LYB zo`3i8MgPvxV|6K&Q^^jaa%CUo!VF8od_>3+r`1A1Kk_8F2X4AD7XTi*YqHyS0Mr4g zz}p2Wa&gce`{de|k2N7Fj1-(2uw|t5%Gu+5LS>i+0x;RtPQ+)`TPr5{QTFb_D@V2E z=4_zn%n{fX%&EbGQQzGsZRL+RLp24>QD1qJ)yslT?n}hzAcCBBx(m|r zHuX}Z;Tc8Tvf?$&?$URl@H}vc(ztq$qsJydG*kf3Og=%kS>i z(w$=$8^{P>#rqp1UtU=9r#9OYNd(Hx1RUjd+oS7L3Ri?pnnzbNk5S*_N#&yGv2)iE z=1o2;5xb>c6dWRh&rS86DpCHaF=pP7A1f?Cu#6I%b*nzCq;tmBzKeLy0L!(x+oYVi zi^E`Qzj$<0P+_`U)yzQMRyVS71|t0d-c>JLKJ@gvTXYK5RNdY5;K9W}SlO~YP) zs5=YfdhxYA&JJ~o`LF!ZJu=tl(tUT+WQiMUuY^khz3i^R-^2*fyg63$h;Td-)@z`C zUjB4J&+DuIi@EoXYHI7=My=RDR75&ak)kM7dI^Y%(nYG2pojE^2z$5FPe1$$N@Uf{UXWshT>nMX_PhQz8hB&i_opVDUwnFzUXJBk!>{hS zR;96PBdc&<=e}|Jq{r-i06iAGWmz%#*};sSp0**0$7cf}f+EFy7eB{3`&y|YFO=QqZRm-1)gj?HfGyUM(DxHRYVO<`DbRotQhSjB>;8QqG`GE`2iAM zhM$k+8UUV6)%R5)JtxL)9~aWTL?p$XUC0MAZx-(DWa>WuublVjcd0wnUoPMr-hZdOlr zANk&1Mm_Sv^z@-zYN&h3@y&%&?AwPiV{bs(U6jq8yj{QF>LPfIv|iUs>P( zCmsqYvrrl$uYQG2*416}KgGkg)`Rm+k>LI|L%#27m@%}Ij@B!(KRJ3NdgEc?*ie2g z)#-fVaL^F!6O^x;>F;&s_$w^aaa)DMQhbY*{GDD9i0l?YXITuLIFLb%*$%ln`o71k zTg3IC28&MB!|Y=RLzRdB`g-)5Hg$svn-$}+HtC#Q5WQPM zXBlqWs2H#TC@@{ef_do+9_RoUWmd6fs?e)TqUq?-Dx@9VX;dUnNJ!y3YxHE9H^#Zu zWL^Ad8{i?sR$a?Z^9JjH8vI7E^zmxH7w|V6@M@x4&IY=YkqYb}Y|jo`%g{9QvxS%P zmLcMG00#JG;EZc}C7{suqC&aazhm_PA%`$~3YGSk_TgZGiu)feYQl4Xx^SNPTNg4| z!gB3vkr&Dfc3C?r@i+0dnVSpYLze~5uHI0_(a{0DOsfsY8}sucjmIkSZ!Sa^v@GlI z8R^vl5|bVl-{b7>cg8KNHzt2>;W(UJziD4NlJ!K<=?ws3nR9Wx52gMl%xmCKKyV#} zsy@_Li^w&S4o8SnHEP4RZDRS6-uq9~hlZf3rVfwCeb*6bSf0O?(ahGkP{$`Cs`rHHtpFx2HzqyZP~y)lcP5f3qa+p9>*MaAn!|B!hNtpJD(%-2nd+LV+=)kW3i=|0s^=drEGVxV+$AYzGLHO9jKGzP6s$9YTObg2q zOOuE5pVcmb8FLwh9N*0{s7-q42^_p46D=`@qwXrJ7r!mwvsOS6SFRs}@x+3karsQQ z_ARkE<3~Ej4lRl`@Y8pk{r>dle5I9d@-L%i-M`)H-; zClaVK8&cf2q<=U0{vz_)I?anFX8;03aI5vb0iAKQ-B>pm2L^@FM8pkGJl zIF`tF0Qpjn!m7fvfJlj4-Q%5!kQ;)mjN~Z;ca;PL;+3G8mzm+i*eZa}LRi#*G1lwh z{fQT*hL#Vr2R#m=KD~nBfoQ5}!t)N(ZjLyxOjZbOE=E+hlL% zuKV4Lf9vA^%H`eTS^EF&XDK=WrER60*XD?ARC@~$9t4u+|CYqwF73vtm-}3woQI?c zSGp}kZYTM#K_l@z-+&kZK;64nqx#)VAv$0+#@O=14h6E4x4ne|$0o@@7lnoIbVg6)>ecx?L5%;7pP!VC{Y2nip!)B` zd<~V#iV7j*rUNq8+?M;#wECdU(?pTIDD^*l#Q%3}0iR0(Ry|-ik0lYtje~MI8!bR} z!oQ^gu>tyTK6qh~y#;h5a70Gor)}n)De&3-nbn24fS?cs_x__K;f&rDuk#!X9~Pmk z`g0^s)ptAM?9*8TB`-Je7pIDoeM=B=$mVkowT9stS;BR^GL+x_Gu_!?sym*sx0_@R&Y&+L&ws4G2&vUQR3;_ zoy2YPI`Y7}Lw`i6E^&tpJd=v6xYTZ##YJ z#oGhd$k--I&^^ewQLX1Ch}Kmub@vHa6-)?-EltoLJ{oy;ZnqEIhk;!BNMPqVzW|$+ z=efO^3!YBt8GHS5rb~t5Rh@Sb{5|Z|Ju8XbrjH5j+^r)Q02pF;Q$M`mY8+UKhQZK3 zCTl$zgqit)b>*!V@pcGvyoNZ$KYz5=n!bseaEsc%ZR)HMngw8-GrV(ar>u0J0rU5 z%F#3sp$(c_mW;g>ur-HiR~Q2iQGY0Rw2(Khk#ALR8^@AnlfZ^Ab2s|Z&_twNxgm|- z)g9tE0E_kiLeD)av@;9Bs*m)7{BT4pseBcV+=<$@c`;_LP0^eDId{R#1An9|CJPgZ zqc4F%^Ymhn=9mrw=^z^NjoOCLF90=GB^x@O>(EMVrIH#FITuTpcbaUFu~m|bZFs$(z|E>ok2m>>|E3fWQcT1Wx@ z@R?ieg2Dz4eL|88)K@z>;qV6nhqX0;nOM^b~ z&vVN8KKS;XyY*J?Z)<6LIXTK8W}z0w&o0jt%k<8ke9tDybZ5gDY}wuRv`z&$`>_P`p4U@?&xjJ^k5i@pUOL4vn~Yd&1- zb9AEJ42qSnpz^U${Fb{r$^-(o^(IZfI?@IUw==6Wi2wr)l5%I_J#yO{=AQLn=ZL^5 z+7vv6K5Nq`?^ik(%S3=(j0?pwW8r4zs+Y~cLXEXM>(&VWoDKi=6l9wd6s_Ph63*;@ z1<7Sm8{dtCV;xI(m`i91#&;;#h=&%I#Zy12#Ay6By2|x%W=aNv=H(@_U8pS0YR!HB z?Uq9#OZG)k830KO4E|2Vf=6RW<=|+L-!Du#?&@*gma!LKG$JU4WA?oHmqJC4DHZKbqSOnnY#+OL5}@PpbjF)RSntyzP)dU_Sw6#)5SIe89xhKey=J=g_0; zP3}zT&cb)bee<`Mi6iiwou4QGRf<0K=ju>AfCjY=^&^yx2bf8-nE>0Xjkb+S4(vK$ zY?RU2>4i0JN~MG;)_)gNBkRA$gv#!D_z&aa|C9gw{)XRL*n`;nU78C3h5d=IwOfht z4}8lhJ)IwWST9(h`d=i$(cYZxh{ERJ>^xcNqN{w~@1p?l+@pg{Vqh2Fo8uu-QdH7Y zgKDKp$*E`0;{#l5e{kJ@C(C0U^e;iEczQBWC!ADVjTEJ-E;~V6S3B2&9jo$2iupXe zEi4}1QMs!kXYqIAQKt{050A7;PhuwDhli(2d$>1NCjl^w4X zmV8Ql`<+i^QqvYU{l$o)VVKf!a4qaHHoTo7InT+AF8*^9-yxd&kEMR(xR6YocQ2mo z?*7oi?Pfwnm4t;o7QpTzWLtEei%n1%`1t8Y`eEzd3m;49T~=0Oh3r0cg@mAL#hS>0 zrShdDQ-ULL)5pDZi)-K?p&UFMZAUGxbh+OpSgzUs%04)tx9?*5x>~I{dvC(~YvxkN z3FGveFCPP2bZrNd9!<>f-dOaq`hJ^7uzvZf@TQvR#e?Vy5C;^pvN`Fp;eoBY_YeK8 zoSsT$(fbF|k9o=iilrZya30XO6%;+m>aW3G%zs0MpKn}W6bhjI z5=C!(6MLLD9Cv(lRe|}eURG=ZbzE4eZ;Z32V!ZB6iyxr+5iSIYo^g{Z(CcW&zt^w8 zq39?pMAM0bC8c#fQfVwp3o0F!x4st%7>1V>qlLhU}J6h-M%G%6?2_;zEOPiy%Utp!oLaYezNXXPc$P|5s zmOu^ln|=B0p7YmudtvTsHoYr^!k8LfAFqh1&na?b!D zT9kigS&jOR#2TYdC~S>+ZU!6&TmLx@0zdhe7Y}gDyXZI-0_awvn%z#-m2O>E0Wg6G zzdbFj6cpMk5?d}h^&rSU`eZ=`}@e~a&*7VsXMtY2iueI#kwlT zxc?E#UDEzcCcYtPw;ZYZBbMKEQUGZA;y*2`?9W^x+U^(|;){P09Z%&LGsWSn0Y-Ay za%g+!ENt}868qg$o0v=hX8B9bMt#imV%r0PI#T`50(&5f>zVPIaP19^SZ@z0~bJd+S}-fsTy?=ipLt=jxskb8y+kifqu4(%S!*<1;pss8=#h5a{?})5SW@wU@GQly8aK47J$U`6yT|*&>URk zH7+u9>J@7280Zq-_daa+_nzqBdl#mqOf}yI1BYYIqe5``4RgsEV;^Fz@ESbjL#U?W z!`;L3cfjV-LEC#_KUYPrPJj1vO+G3#K*`n_b!k-Rx_xqKwRMmM zMTPv-(5ZIo)jE+kXlBnm2M`ooZWx@Od*d3c*U3!mABc@DuRC^h8y;N!@sS35Kp{Gj zR;{hF@Wxj@{W26+|9Ir>NLGbo;2mVO)XZ8-Vrf~Gd=sqP z7u4km%3D3jsYht5#izxR)e^F=Rk|)*u9R|tFxL;NSb9-9S1Z5r`H%|R-?S6YcBk#G z8ZkRS=cKDK3BC_Ka0{#wrlwY^2m!O+E;}J~-}rdhF`-7Wh6w@W#h#hBZ&km3>5tgO zU3Vwpmetqtx2)e$lX&@VOKR`O)>aebVts@{*>uovny>lz+)-5_j_TtEt%F_H@5nt> zF{PPbhaFkQU-;r}$t6jvVN+z@rOx~g#0zy)U;~y0%?h?Mmn8kO2W8sTj|s76Ti|%8 zfQOA!*HI~kvY6l=~r_$*WNot2NWy+Y`^~c z?Z%9&!C_?r&51gh96L@st@py=$pQ4xWYh;`tOeT*C#G4+5eZUXyL-J}O~*0frjgCc zYBqKTo}*&vhr%Yghz{I&lQQsfT~x`T9DG? z#Cs9OyISwwm)l_Gt1oE$kg2ULC;rum7FaqgSVXkirwirF0Ea41F+T&lx8 z*ltVH_G448S}acUO~Q*&UH4Z#pW8g)z7acZGiP42HK;;ivwUwxDhnZY)eI=`Wv9XJ z^A1ZnoK&R) z$=I!EIr$0ixIVsCK(pDSAa?CN5m!Hb!iCa&*z45tkzLUX1O}|WU-*u=NV{?{MD~(o zeOl${E#uRVWv7xeOfV-DU8E~QNAa|+w za0a%Vsf>w)xAhlqk9YD~KZI40B5ER2x)B&2B~$O`_#rb3x!k$=C^$dmeGjH&L76TQ zg9ld$(sYwQ3=u1Ru3Lv8{*oktqolYub%|>YuUOEA2)yRu4;sEZ89s=%8CL5q)YO}Z zP4avc&F3CyT@hS5Yc<@_VpCP%ydc=eeZaG9`Kb=S1Wp*UUvWS`6D011wZgjW5sC33S-k+FXDdwbox- zue|98o$7PBO{*6m$hzZrUQ#OP$^rBdC|Xdr_Nr#i-Ekk|xrrUIPlJ9-QY$XqpUd{! zG{#F(9QJ#6A*}FLE2ejOBL?uR6;)S?JMCf_g@O|9v*^{0e%*yS0$zOpv8mem^rq)o zQt9IlD9MUz!`axu#V>I>52n;>KuXb>#slil5bX~x@^J!AQwr>RRbG)bd_5+`W3ozw z)-Kw*)=kS*ENtj+d7rxwQX@8AQZ76QRk&R{8A?}=)1)hp`3F563n;c%QfI$pWKRBK z2xC&YQJgY0XJGM=vSrRqtPia9^Dl-o@p+svgI~?f{ zC^gvn43nK>S@gL!)4s6y>Z9jK`~h@<$7~EdHCj;AJeF>Du+j%==%1ZI=WPJ`ayef! z$cN6FsandOks8`xrh}zE1N9q)^DDg_6%Yi74(8Io{3V+U>Z|+$yEpk)s8#BcOQDeGU&5 zQM1@a9^= z{Bd2@pQ&~vVJw_rV=WiedH?>F`G#Mj^K z)f{1iyt)~d-BoZBwAV3Bl}ag3RUHUSy(|(0mojY9Ud;GQH|+xsS|GjiQ^R8GbD*R< zYbMvhoV>NJ)`e_HRA!KZH&THa6D3-+RlH7}^0*OkA^jWGXS>0@vfQSnvb5?vLU~AY z34uOHj-%0yj!N${%SCLd8z{#?zZ=S~cqJMw@rfnT#?QC?7*k25 zrxe~;dM>D{ARkJh_s7IY`_kr5xZnwDBSlmhSC8ANZAP12;Q(B}4-uUw|IF{{W?Xpl zQ@LyfVryO;#$|9M(q{;K4ITs@UH^Gashs9xUz_p_9BwPWD=0SrGx8TN@xw`=YVN>i zpq+%E#l=RHB@5}1!iFZs!;<>V*W9Asb1}@f#zULnl#|r}pNQZCm{zDhH&V$vrr&^qgoeIGg0Qx-(hZZex zUmOUh=fo}t7EkL!Y3bf^ZLXz8hTGSaTpko`6oewbOgtNGw#Z?ny0WxRaEtp5~)kyS;j1u~MCADC7UE)>~VTC}mGWIT?|ZDaqbb z*tmfc-AcKHTC%l0&0$-9<^*u$`uA3kOc}5aBHL>2f7wiQo>=^z0nb%0O_e;--+si& z2xotARSK7zRQ;9(S6x<7JG1!S=2Xtm?U%{VByfeePqX^`=T}$d*Wh%dgshp zomQD-pAvBq2#m0QBS88pL^<6_nZ%^ZEmw1c8%KSK~;J} zk}eESMgnT|CRT13VqXfsE~fw2ulv%s<9q3|FOzi7pcPXp?>a74D6D=?Viww1tzERf zVG7y*-R+g?uTbi~eHLMMdX@;@0#2}Zt;Z5mQa?|(QZ|8oLxCS5qm+ZsEKdC&&DZE% zQ~LR($}7reJ3_d>R$gE#I-*2>+jrFknfk zO{@G4HhEbA6%T1+7zDjVH?U}(hQo&5SOj_EX`eM zx-7-K`K6g}D5qIzZvS_KmwyZ$s%PYlvgOs=oNGIg0e2b_z_z!%_a*n>2NYhdw%HHH z=c~$b#PYBN>|@~nJsP*7tAYA??Vq(e+lIcJAbRQmi_CQ~0?tF^0YOR_82Iy9#eU@p z0PudHHeAsUOrut%5W!lSjyj2ni!Zxt8WrjkJ2^jcd;x!|wOk&~&_=m03S|uYegn;v z+2H%9BcXb{Mhb)Kpq0sz${dHq>f%OC{F|9FKcAYA%wyMrXOm&kK0yCBhU-dc&idmXl(u!iR8EN z5@*S`A&)5>ui&0k2Aju5vG0@xc)6m3ALbl;)CM$@@pZ2L-$zrxUe7*L0Q+_B^I*Ps zh^igIEsO`1uX=eMYt4Amk7QGjtePM$ALuM;EoFUnIzZ~+zY-UB1|%+ZStdvOU=nce zmSST1b%FH9dgln~VN?#>NsWmtwvKd}u=Gjz2S$x>$;(M_og~P1ER#mK6sVSx#iyj>m(S_%?E3tOjlx^DQ1Q#P()Bzs z2^F=J>6GNJS-Yx=6-TaJ%o0t@gwd-&`a6Wg9oQ8)$dIw6pFO%~h?%{Tc>V{Z^8L0x{px9d{+qAK=%5?q#|e?d)D%2uAr~1` zVYs!yC485{$`|-(aDZxmCM~*6|jb=wvMs{}p%ulTMou*PDA(XACPhXJpVoMDxIdogPN?ENb{Re-a{YppXl~ zn((1$GGCd}+P^O6bs56q2V2A6<#C4dt3(lSoU@Y>vN3g@8d2TFXrKXGEd%1y?q7mt5O(Q zw06Oidd-x|@QlusIX?ceu!66OIU^}}MP{Nho(n4-Mcrd+yt$D5-KIahf8KzYmX2+Fp z{qmVFXIz|;qoOo3J&`JhSeuWdt_)Dyl==_N47q2FZ~493aM*UvbIzslb4CZ1 zkgt@|=O85B_PNhJo6C#%!o4JqeI^!wCb1HG(wp9Y`<-pYYY#sjBOlWBt`JG+c;oBQ z=p3e)(PwsJO&I@5j~+=NgW(M-D6aqHM1S*m(|pI*tT8KsvzEx)tnrrNw+4wB%k450 zEr_LGl$j_|weU?{`^KA<*k==8Qw5gBqK~u~UGFaBZi#n6B4wqi!)2tM!KIwd_f$y& zN-=gVrR(1Jjz%a5WrLfT9qugY)Xu5{S$}2Ds61@LT0dDrZG<3QXivk(O;l-|nDiQY zd4C`#C)I}+Stf5JCRqAgC1x?~ts6V~hvd<%qhV>SdOb}7k2IgY%4}+h{t+i;8H({A zHC7XtYdLxx{RZY6r8TdK6BLWFKNF?X$66wS7;7Tqzd%|IN7AERhioUBy&P^@i=*EV z`qrT+VwzflGD9Z2tC)-&4wm#hxuUM6+ctj8&DUbG4Bj5Pk-5<|C%pZRr27nMq(n(s z{3-l^!&QH1hHr9j)!pA!IgBm&uqK7V?C`VJ&lqeXy=GVvWjK|LtXi99I1aXi+Zd1_ z?3(Z7#9*&huM1$-#Ve1tcpT@HZ89f2FCyR66}w&;66J8SGvy8fM>N8b!a?Fi_p-(` zi`2bjPz_8yW9iXr%Y69-0_=R9Z&Gd9_2X0*%2!b9bL=?;kq*1cx{ApW-%OwmR|}0> zo4W*#+;xHN6SJ_=JMi7ABUIJYdQlq7F_U*eD$I?VubL1q3ftjWyUW+4Sg2~Z7!r8& z&XW&vb0~APZZa~0@}~4|XFhM`8g4YEG2W9vaTX|JpMXjhMmJuypk8BfJ!Li;5 zti{`V_F=3{XwPS~VLYaZBjFJckiG4CA}l@KTnv98N~=5PnMCPuRnb&*6L<4q_%_|0PZ0%KaxTu8|k0LAC;7%jpTB{6 zA~2i5WXzZ!`uwtgCS}Dl_=8a!ug1(#S2k?AaL@tm^)V-XX0n7T!K{X?hLBO zhZ>*jQndsjYuoONW#`f(G1>knTYbhs;CLvD50@H}QW#F&SgBFX@uEbO^ap>syx=xr zx|nsaP-3swT1;Lo*UNiFHWfBVlQ1=@H+k>Kp{++zuDXXsdmu2rnqkZs z2Q#mQ;tW8{Lqo*8Z!)vAeg{9nKWxXBs+GrIx5P<)=8S4h(Eb=@6M-F*ZESOJ^|WhC zG-x@r#wd&t3+rfX^x2Gtqpo`#&6+clM5T+GAyU+b3#I24QKi9y{qVU*c+`_*wxAp$ zDyGGb@{`%~HGX!GKT&f`nzLF2Ivv^)G55)}vN76l<6P~yIzG8&tW?H)9F|mvSJ?l1 zSpe4Q2}ZPGy7VNc*OL!Y(VrA37uDLP2OPp0qJKQ@dz#Tv8me8KIKILT9se%7HnUJ z9BnazYyGq%Yl~u&*H=96TGqU{yK^CfJ$jnch6$~;By~4+mB9u#DTHlXw|HlL0MJXn zZll5mO#SyS44Kcq*|DGpLJ7rdJ=Xm6nAZzxVtFnosh*0_t7Bikooyka3h``=^*xLl znAdARW(JNl*OZdWSLQx(bf%w0^`dSDO0ZN55Y$_p-}5;~Ois>AsA>KW@mW0%?BzZ& z#-5QYo|QkvI%ygQlzqY*HIr(cN1a_!EEm^0luynaWxCE~>qN-lh%SVQ$s}cGo#?5_ z6QdO}TeGpZrMtO88$BF)!%ing-UWcw0ZL)#lhfXJBgT{0eE7nvNfe!Z|0zWFiS&LG zzFhJ!^ij>gTayP)+9Dr2;^UTAz7I!5pxEz=Tqm!O-`Ke-eJsPvlO{N47NnXJj5Fe` z7Lan|zbzpo)%E#Xk%4=sD6E|!Qy{FCpwQ9%wz>0O1VCMd5X$C}!`Ifa{9*roPk$|S z$NpS{*nbH5>)cWB0VcIS4hU9y4Wl2)M_+6exv`)8x66-47_ctnR(0izn+hSnY}#K_ z6(Az;NYB!rwz2p*N{7>wS$XR`1OIpKKTLSwEWH*lg zfy3ADwdN*X2AnvDYHmA@6gRuMpm;puk)`X-Idzv9H3G;C|LP$2vGjhhOGb}CMl8La zD_mJ*AnrAACydq`)k@nE`NdZEPv=M#@_FAUo3Fe*AJAxz^5z}Bz{JR0j883E5%EYa?tOXcEGsRl!Y~gKz8Je9L58%wPo6kmE)|9=E~{^Z(bcs z4+8<)gG%SO301jH=(#u+vqxc9@i&U72Smf&8JOTX74fMuMh+k=y@-~p$p~T4%<7`r!O%vU;!`YL8}-hv`ozu z6QAEDMZtaXI$}c9lH?OBZFLv$b>B7DWKXIGipIB9EnM&{vEJXwav4pLT#QC>9bF2CG9E8;X3lVRm3 zD2JS9(v4nw9L(gN^t_f<^#W|@(-B?HHlIneAl9eraI3r@E5it6@v|Y@V%nn$S!TN* zQbN{@Sms3Yjk_@jz9#)vU5o5x3=|RELbCR7UFn8szn3xQ&G(V^NEAzDGUN?~=D(`j zcCK>C;IO$m1o>LHyi&#NpB7dJpLQvS#+s*ugP6L4<==X9hdT68lk@Q!RMEtww4_Jl zya~82`6oMaLNKSJtFcPpE62N8N0g^)sjL@{q+Vv3tGLK1IqA_EUs-c=m`=l8E{}j| zn0IWxAA>j3ETT-+hamKguNO^l<~tGTggJZ6ZMo1?&BWxx%U7fv7QP30V5Ww2=vN$6xz^<&op;&83Lo)o1vPw);OU0%=I-Xb*jy(gyK+Z@RZexeqiH%k`b1jFhUye%Rv$BMhd z6Ri{%%s21M5wX<-K6@^rw%xTv7a2jH$ytcxqKn#@`$amA{ZGW1-nw8xzwO`#85lkz1d-Mf0As9fcvCuTma;wj+wj zk7`DGF1=4LXbB(Uc7;mNJV!sy$i<<0n~H|~F0q9#2k?cR-WaG+EgZVsRho({f7^2_ zuCjIQk&?N^_rzjeIeVOB8=36GH!5gYUE7IKc2Y!k&ohNgv`@ubP{(4am0>PiSc#6{ z&>XM)6c(>XXR!a+Z^9WD%Ixz=^f9QjoA5S|NVJhd1Wso-DtMEPEw z@2XD?#EAmOQr2*>>kmQjGWhn&H2qm!A1+$#wxmwAP?>hkkx#2-n#Kgg-J8W=g_(%9 zrX|$r4Gv<)^9bb^OJ!gD3WYWwwrH;X#XQxm@RUmlH81WF@9oUntLz$2&rpuSY4Et# z6pqkRE+R5Kw7d(uQ}a$cTMQY)Ft^quH)u-3A2c7<@Dyq#+p?60H;OWo+TMAEySR9E zr>2AalWPYY@?p`1rPpP^9wKk&oyAZ`72c+G3+*_CWx+j{ttIeL-S<)6N8C18alPHf z!-y1*>xe24v_MPAzqoB%QLC_b!@gx6ZG-cEv3%D86WY0M41Q6$wkWV-7{4;D=;ipz z_Ylpvf_#X)8axLK5=2xj~-gJx1ntjv13k2!9$ORUAs1XDFcXEhwoev2E-%o0{tC11kf5RURP99{^@ zN|xM*v8|0JMQ_);q%cBBS75(?eD+uW3qevh=na$xllsvYv+CnVT#^#EEq}O$vC$lR z9LIf|Jdcy_vR{zlgAepT!n=a=u2YnAkGfoGj^f3S>%!975)I!~J`J8(icrWBeiEJr zu>&nAe`a@_xRhF`{Mu8~YrVaR>>$6X7JMDVgBR+AHn~T;{55nJmxBs>$Pqglw>+37DQy(@Xe5mn$EEpAj~q5Ji$e(4ZZv`1)iTH%J!X2NVbpYDyF zdSIf~`LPfZk#oKRU*^M>=icv;Tz#-UUR8^{rf|C>6k}{G@@CaaN59gIE)!M)Q5cPP z8M~bby$rs){lpji!V4_zHrEi@a%z(++9Ut2y!wQ(2xebjV=)t2fl$#n|MCd07<^-; zq)Wb?I}d~>Cg$ULWS^_l{%kl=Z>>$+3K1?mg%UotFDq(6T1b-Z_L~z&TwhM1-5~XE z66kULChp)HX)Cwx_+FTb!%HCSZ@8T9b?(vMa1!y{HW@4KJ)FTGVexFH*=o_pTI!5o z%qD9$m;+)Px=i1oK zkjtEsb?4zImv_#GXeX@6exXIfFm2fD(!q6Q!N^S)r!jhOoqYm(v!?{!FlubZDgT+% zZC=fJUDD~WWq^~g1U@}|{8vLmXYIhzGZ70RrZc2G{0XmR6R!J$ zt$~=bSUg`feUkoj+F_=%1JYLn()dgkLS(R`?%+)>%%+nnInU#o(xS*_^LYub+&S*cgYMdDPdm6610?I?04)o_X-~OybHmd1&SMiVZ4n zY#vFg+g8SsV>eypEfr)m1zN0@^hK`PnGQqsEX`TQM7S|mB(Hz(7b{cE(N^~pe0Gup9^ze_>vY#i-8<16 zk)d;Q4PtdiHSUgXRyxSWFfOTw-0;Z9~G{xH`30>vQ# zaDv~Dmgq8)Yf_6~xGj9ZF=Q=fS{(IB$tbFyv^M@B=^hHb5tpy4nda9&TP!etUl#e= zdP)}S+S?y)J&0{k{_@AONb_*wLC+6AL-P2&!x>eB@jF9XD9F z81?JSB*-g6D(o4s;Q6roTRYw^X^r<{{N^>n67*;gOx1 z`^%W+p%34#S$=DR9$iiz+jREQ;I1APc=u5Oam^00a?3~zrf5u)tx#bSl?^1Ocg%gc z80@dVwk9f__d@lVv!%nhVx(7@kFmW&1nXw`H4=`slaG_{Qq9w{*;Rw(DWRbYFUWV)}`Hq4^D zyTLCZ&7affa@?wC)b>eqotIM0H@V>>%gVZ_V|ALkCU|K>c_NI_P9#$9_9b%g8m4qp zJYk~^mt$Rfu!^FA1AS`WaLDn{0chLcfr^5zg=6kbc7qu|eTQN+`zAqrsk*4tFe>wO zk>8t@6F!I#RGL}^PA#(5dawZ;#}`S)udMm-0}1w?H@$xQbV|86% z^yVi5Wrv2cssbEQN2zeqeeH@teO^4ov^0cdHC`9qlcpa2Ua;IavNpvEpE>jNb&*yb zJ`_*b?sre5XPj7jp4uaKVTm<-QdB$XO2rm;7fy$zYiRQD{Ygn}a6K;(9sXp!sKI^U zCf=G-#P7HHq3z?4^wqc-yH(uk6I9MYmeD5s*)Y?API^c=AB=b4?2OK3RQ}yHt|h*L z>txm*-gleUW$=#4QnDs4s)?%;c@4dM#7{A8<~oSA-qm(M`dwu=J>uQaz1I4tIQu(# z<+-*n)gflFc(_r8Zc?fJ=&Xy~G3zzTVzO;NR8RVmWeHV$ zkeu3Z+WP2VzU?(cloipS=n}42SHfQ@Hmy&#MNHb&TFtJ&qOovIK#2GtD#R+{fxBPH zpwi}{?^nKlVz8kdlsm%Ad)-#;Gc~Y;S_}7l4zg%-}j!(cn-4_tTy7R7_4%65PdcH`^>-Wd+bXTj|(fI|v zK78E?IRhe)UNt0vcOVMdU5O`B+i`m7RE1B+o6Gfea2k|_+CQkOb;-KNQBtwMkkA-m5+dKxv0j)Cvnr)bolUNZxz z0Pm?cY;&0OvvmG;_74=zh(NZ*x+j>=+Vxnm1(PbOFj72Z)LO4l_TR&Na|nAh!mHCE zk(j&`NpCIhSHD|w%U3WAmaqM-RV#GIrl^jqxm9L)@daf^zf#LDC^p7+^ze+qYA2X2 zihO3OV%+bZtLu2^MEpB#)9Zumw1L;I&*hj_=djlm5StM8#u*X9TSve)=BNG6$#99a(?45o_RX)3%0_9`eDza#)LZ&_ z#$f9$#ENd(AnklrpSvo8%YT-xA8VthQTb!p!v8LYHCWa39R!`-k5l}^hhn8yc)Y+l zOFO>>Vb3Vp-Q+3&SrdP#TbA-{`Y?@hG%Jzc+MXgX+4}Yq>}oS%F>D-yE@srQFb?T1 zg`}!p#{joP@gdLedVW-+`Y>oKmOdg$ikUvsd zX!xvQp;{zqH95g_MhpEJaafMZH7%!pq^b8? zkNdcIc9qaV^+nl1KDrgb&;r)X_1lL8jP{Jx;b5i?uOt6RU^n5!1h4~gu<-nDz{mXi zr#}t@ek(n8wO*iTfm2dY>Oa2t55LrI@bM!7WV0q#k#*iPA`RD$`zRx zy)E1Sq;!b2lgqnS`l^kQP+OyXX$2~#^THFNi1n+WxIxi8rM<3oNCREj^^^I@<-f>> z>;}5OC47YVmoqp#zC##MEN?N-R$V~grua)AE^48b?430>*?!H~_t7U)ZGveA4+K*^ zr#p`C=Ek65?5+Z?<+J(hGMRE6!h9Ujtn%t3l)MAK=UD5=-rXF!)BE4*Qa?<>-lo+0 zNZ>o;6^M(~XYf^o2u&HC@xgc{ZSF~)@UH7)_&7H0k9BJc@oH-Qkmuz#6M#3zZN7Uz zrtfwEqOChyx^>AS-KZ#meYVuT+WKZ-ugvvjPeYKvpu7(F#ZCo(c+dZ0?!CgAOuMjA zof)xUM-5U{6hV|Ky$vEF(m|>~6r_eCga8pjMgf%?Y0`_*YorreEI_12YUqpv5+Ec9 zA%PGA`_-BGzHk2jy7tjN*g42S@?LLwp7pM0t##k)en@y!52~nAxZTU|@sU2ktUljI zUQWM`ZV(A{k~L~USc)cRUvwT>Gx4oKaelK~%=agB{=pMiZTE#$k&bq&@8Z%bKAvXF ziZ?kdNh)Al6yCRNce;59<6I0K1uSIbNk#-*Trj=}a-45c!{_=4v@BNa!E8>M3@Lrz zoeHpNDk`!gC#TCo1Fa|NCErDhL<&w97yBwiZU-DddFyP@G6I zh1q}fNQ|I9miGp$$sSsKvXhpcA@k?Xug_&hu%S_!IUgR%ZE*q@?0-j97&hE_6q>LW zqeo5)c=2Q^Klc1*AD&8Wm7=H%SM4bzsvswD#AsIDqj|W>x%2cojeM{BffZYNbobu_ z#5{TrBF5^xKl;Jrbszf0hsFeo2NV~V7n|`UM8b8h}Wq8vWMGYvIu9 zTPxnE^##F`AsvX!8EZ*yJM(zLuqNTtH-#m zZ2aR_T@D=W9%<)Df3Ryo-h?h~RYh1l9#dRa4|Q{l{TIAYd1+hs*K;66lyhbUGfSo> z!1XxS!t#%I`L7QElUMRh3=d)zRI)JDB-fIjdVmcPw5tPq zLg*xIb=n^siNvVsYn!KL;5a}h|_hx3u&k~!zP=HN^IVwXCL_xS6z60tSaw88=P2P z6_5Bk2m75+6B%hkw*Q0Xq!w$z$19AB$>4$Mw&LSLAr7tU-C8ip0gLei4W(h|mUr2j zLGQ2mE;KlZGG*dijyq*{kg{AWub?D=7pHhCAw4KGaqM*xyZErvHU6X}>-5}MX-kh= z^&2u`#I+p-dnX*7d#yX6ZYaNMo>VmoESZ1J4gmLfn0RAW;RV@~1(MPz#Zr5`IHMc7 zS;juz<{0O56DK8&1GgX{UjvlW{@-u-5`^3lUWiRX}L`YQXy5sZm90?e?kv`nQ>H*&n(&j?u?yq z(41-1S6`dbf_=wa9j=UpwNgFyB+$j2NeZrq;CV5_ee`76YA^qEZc?nAy5&qe{g_(V ztS-(zyQGWY#hboM3A@!&7JRTErEG92vHA$Kye}3N_vl7O(tnrz4xnb%<2{XL&IXoE zw88RJAU#>jtYs{_9w=_qPq{8nVHU2}`BDO46oduaIdm$x@byv2FrVsi>;r8h{>PMV zu7WaRMo^*Akf{7x6qmE-+!C(!*gdQ4)R37i5x%5vcA0CS^GWV4)GeUGi@DaX?#16} zmK+S%qu18|&xpTqHwnE%Me3A*a*(EJ=|N$Cj@A$v zr54$|^VhY1m~dXioF8nPF*4KswdPKmq)#&hb^ZWD_okRVrx4xIXE9r`KP?U|%wF); zfUyg+MbeDNb7P2A*gHaeNzwYD{o&T101bhWq_d>TD;sxj%vV_>*UO_dx@fGrwZ?!fw4NnMW~)B!rT*rYMCCZVEs8!R+|Q zl-@itnGkM>Qtqy{OQC@|~{Yf!*>s}~PPZz5&Ot(Fouv8lts3mAKk zGM~qB7k`3kKZB5;0Q|q{&5q}}7Ti60`gj16Qs0B{)#{ZWAlztzR@$!Fj#4A|S1nB30icpL=b4h0c!=&jKRW*Fjq8{i-rs@2jm^3PEW%Arx#OiY@Q~_R-IVDO7d{Z!`MazFZgJ zX70eqw~?30MsLe=egd}wr#PYrUnuPDwN~Zjwm%G=tfN7#c8kW3r6ga@AJgDkua<(SG-k$!#${?Gn(_OZpBhR!pLB7TGHEL#W~DiEk?9iD z?>GI+K9ibqR8S6J8xwEu=lG)V6O9Axw;46VqYqZCj0MzwxT;&zNXlrgC$Y0;YBtAo zA}3^y#5~?>dSKtsVXg(Y#ps9A5g{^Di2WIz@6Sm+#eB_acd$Fho0Pa8$X@-y<`C&) zpWV2eBl-uDvR(s0@ptenkVG5-7N{*ivpcG$Oc zD}x8K^8&j2q_fI(!UlJ+yJFLKR|Pf>lm?rh!P+SLq)wp7dOq`v1ODa?UB{`CPk-W( z4oyarlE_mI;NRH{4!6gqi+fk>NV^+~z=`%^1|iZva1_4j1k2#n*Ds$U_4lA;R9dPZ zs`s#7&wNeweXij#C%}TtcZyd$I!Sh^6A2>n5Vs%rc`e&dW zwpRRBla-XdKdXUlpb7+W!p)g%KSYCOhOE>}r}+=r`UAF#!<>lVs}66Zv&D=*vQEWO z39*~iOG7>x8y1%)9>}XRtpg-a4PvgILR-k5 zFeIGtVWUN&UGbishDa^<=(R;Ds3dEPH42r34W&jw1Y0Y&i4oMfmhJh?U?t61MYNlz zrYp~M&iIxrL>LXWLyL27TAoJogf)l)Nv~^3nXbRc zZL;K8r=@Z(!C|pEnn-da*xx=#-11Sn=hWD?6FvXuyK%-1`&zb)o>w}K!RvLjs)Ue5 z9uzPe+$~d--#)=pG>f_!CmbB1smKX@9evAgB;!3ZuPDve55hZN^Db1IOji5A0FiGN z`{3M;r^&RWPVtUkG{At&1#1F(=UdYfV@s&$*JV-8Xd88JI;kNJf?<^5qN(W_EuEB6 z)r0Pw*G*Fy=twj|AZ}HN@au2vAz))a0973}#Erl>_0FE`$E*G;RdaT~$Z~X3nOfeT zcP7`FRW=fu8a!x%Mikb2ww<>kHZ)V6tm+pZL+xG&xt|K`QA=6dA=$Ie!`mtWCTEBc z1=p9!v#~WW!|YT9aI=xltd-e-OW#_S*Ij77oTv+XBJF3tVzb1#=PD*)D~t>MQKfjn z!pfTg-W5a{W^pUcXQ)5p0k7+A`2cTh5p__86C}To%J_V0)Agc;VYOnIy67<4A+a~F z)IkZQ(D`I$S73YWFMM;NuBx)Zo{C&JTZath z1hIYq!+pqh)y7vhPJv(RgYuVjAO?J4UprBHuZ%Y@f)D8v*}g^4uOQBn;KK!lwTw}v zPMTUExkM`lf2r-_qCkIKM;~qr4 z-TX252fx5}>I_CLaG)46SywY=P7#tq%d)fk7}R0+h20V?>@iefVIqGXt*R-4w@OX) z8Y10SL#q43r)Ot6Jgy@^jjFj$kO?j)9ZLRMPxD-qV{JH;B4~AcHsIUDHeH-rVrCO4 zOiis<%L*Ho3^Xd-f*v6kMY7`v?_x%BPeaE%% zhMi5&9IE&ca$Tc4&ETiev?0w@bHN5-PTL0ouJe+>I z#fI9g%Ug!DyOq)dF|qwDZ)H!&pEAnM+e0D7n7ZG|GnSX(8(rvDdyrtWut6O^C2*(61IL_<*4VS2JrXS-%rCbW+MdyWhu@*+uRRzG^~ z?b}Dk-Tn~+)?r60hNGAN{744OTi||!gGsXelQNa9Zi!`9*uk>XR&Bi~7#pzda8)s4 z^yBlaUm7Tv)UQx=-FU$5n{D5d0k(;O)K*xu=Ltkr4kVBKI#?uksUI4c&3D9SDpBz= zpFLK|=w?nK(%wo)mj`vWzpCYhS?0ENsQu9HVCEhAtI^*@NJXMu5Znx}v#?Q6pFclx zv2qGT!NHF>QscwKa3pJ&N=M{bujBsk7ESe?wfw3)CPS?+%b`AgdZ@`u;PxqHZ}As1 z(8yC{qWPIVFPs&brJ1PD6VtO*^ z4DL#wL~bRRu|WP5iY`+OkhZKf;=|fS=?j;!d*=J&C_)>t5{0hKJ5V#1tfK|hLWo6y zL$RQ^z1DWkU1}*7%sOZ1&VY?OyLFitGv7O|0@5RN{oLQ%c<@mlZ;V zfdTJ-tU2f9|E9^4owXcE2H!sz=;aybGX*ng-P++S{Gl)(w0$e%Pe+xQs+bDOrcWniJAw2FbwFlmEkp5$JO8vRGxm2K zt8A(h>z3w~SfBY-xuX-?toNykmq++94~_QwhWHw+gih@|9aVHEF?jZ@rmy@*qr?JswsJHvJjRf2lctCVa9o15o|X`v4~JO=si8*r-;9R z(x{vQgWLu4V30$j!=za-KEEQ)c-3h&RY5}WH)s_7#>IK9p(EPb1wAlaMto#MtYV~Bw|%8IFVwqb-3-O_*b7*xZn}Bhbdg-M3vN&TinebAaadzxe%g20 zk2h9x%XjrWb(E*G8Uj18m6!#);dyme6`0;N~A^R4u8+i!G&TD*E$C^t;oG8n1QZU3F!7|qG{+7O`o{N@Q4 z$EQmhtI!NWkC}#qdiPG$I)78LXFW;P@Kc8UMl46qoMgg@rx)_Q!GeldyK7YWu&>~V z@tjK3G5z3Au*l9K|Fpw~$U>e+KB+)kUfHI`@O5Zki#AYplx)VPN1{w;`Gb9H6mh0d zlUPV7T&W?@9y!AQE!Qwf4rw2|ye~oim=lW7EQH4wO$UaCxM!WYcp_aW__}J!(U0&) zXGpS=o6X#Wx?5<&1SzRmM~$JWoAzAnn=0hs`Ae@_OCP9_iHLI|F-77FuH`IC1_gXX zF^cHLL^h!y1_ry0m4+HW=E!#?i=36E&(rX_$HDjThP&%>ZR7?iQ8`8JlYIGPf%0Jr z3vma!=~S_ZFj~%3WXus7-{;ITirz)y`89>19ZKw)C5c!xUoZ7kielBC!kZ>9ULvV< zmZ_%T?6q%61BT$j7m3C-3hnz4^0RPV_2y_dOSkC{2l%JxZK3- z_b~P&{lbS=1~_@pz7O|);158ZTiLj`SWB4~vHq5lwEATKzSLl#{&VNkltp*Pulvfi z{w@ZQ4U}!D1CcO3~}|(pgY6qa$i-@y=eE2M$FDM1(m8XAtiFi%p={gwEws*gPG*F_y*veGCT`Q;TX439FsTYNQacft zN_Hh-N=^E@kDi`>omfQ>3~;;sGd=NZr=x-#UJ8Xa*mj1y)5~6w<`4Z4K=75)0dUEEF1}9D`@Y zjuP)pSO9E`;phpso!!K#6<_2_fYnR5y^2!6z8slR5B**CUxVjylK)=h{*gy_EiQ9C zy6?Tl)>|!%KBk93rArr9Yo)~%9G*Dj6v1VEJ4vp}`>Si9TBxu)vdM7T!5a0-k9`F6 zAc#;XkkTP+&I{DqyJF7(#xE~goZ=5J zc~mUUf4|A_VQB|fa&uT^Y*nndAo{b(5KtUXeRTL4&}Ybet}?w=OB~;QUiYNh=`m^O z>&T4b(YA;E1)-{QQsow^g*ipN)*_XWX<$?|hyO0sa- zEvF;IXiCKZjH1EWz1l45!s%Gk{?}|Ki^}YJn8}sMzbIdt=f730#hb48HZqCtzD}5| zLfM8B{;~vrQl*-VQtO(o^yj0#Gw*_ySrN*R9@y+sNXs^_%PVxLohewXJPmw>cZ_a;ivbz`#+S z*D?0fFA2yog;?BtTP64a4+?~v>`Y-^x!4d0-w^eobci}nR|;L_tEm-!E{il;Pj7IF ztrykWovZuuuc|K4{A3WO#TwL?x)^@))}bF?Zpjw^bc6rrH`^_2T9#VmA*Z=BhV|uW@WC&$f6gQ}X$WS?%By2Ki6zHs*U05&py~m`%Za1OjQeLxS zS}Uw;`qucp(xBr?hWh1@yW7gtViCoX=7{RhCVhL^I{bq&#?-{B^3sR;p<&Yu+UcGZ zR&^%qyw1~ORvzU`L+kiwXOs5Sn$Dp?y^wZZdH`I%a&`(5XG*inEOz<+)TaZSVjtIO zk2;H>3D|d#5yoW1F&}qO8nX1DJY46W#mDW|s0*ob8F=T~?JOdBQ(L2kq(* zYK6<4$NU;`?Qa}b8NS2~v?SV)-cdG&hL`$ww!tTFsG^l&_Cct(9~}iBNHqI=Vl_v9 zH=VhA^t~wYZaU7+zGd^KSPHsp1=~;euwlC-kY9Zzq*he`4S1U^U6?q{IH&Jxx`gSB z(w15K4tbACs}1F=6TpLcEHc)=yLro zH`KSc*ghoQce~!pt9kKVzg^HxuL#A!4(^Y>lGYsMEszT>DCF6Etl&KC7f=yHCk4*q zPC99SatT8qT0{}F6|Sm~zHKgzMA9!2&Kr+g+h3=)cpeR%cI=m9MM}AFa9YUN9caFW z=t`Me&dXre#0e60A?Wz76OXYR2-$mYuT=Y>-Pqn#0XreC|E3|B`Xtr|Bg zD4?JA4mC_C$0|A`*5=e-e^v9nMJ{_qr4z5!$67*x&@Uy+;=Jgj)4d|f*cO3#W^#70 zY>~=p0W2ElCyPiXTw4*bD`Eysy5=B6m}a>YEW`;kJXHma_I#=9YX zJw5QV(811_6k1MUdHU+~T&lNWUHoGAbIt;}C;=O=J=F!~zK=81+{G;Gtti^f-huUV zGPh;UvCHR4QaQqFyRVq_v>LuyWcDkliLj5;a;k2@6EF)-u|^fI1_(0N;t(TMZw%9t zCiNs#G27Y?~+PU0z5r* zVqHnY9hu4s_9}nJxDEOHHFW99-2h)_IPLv%5pyU|YOJp#Eb!w)@D}U=;^Q~)g>V!# z^&4?cCo<6spu79}sHJbO5x1?GbE2)UB=k|M1eEY(v?LGsrgz3w)|!$mkX26hPWGTQ zNa&ZCFGmP!EkRKPqio#@mzBjJ#H~$i5m`_LXT!>T#`k%3#R9Uc znEIV*^5bDrVXWyZE!z``x>95Qpo-V{+=GmCM^`DI zBfo3Ws94F|X>~f&Axhq&m82;PkqY$?GFn_ zAPAp#EWy0`E+udc4)W~l_&hy1d?iC6?P-$~{g-m~SCH|uiM9k8^%2mC!2{Y;{mAk? zqs|zqbM4$Iw%>H@ik7+C?|wXR*Bpl}t^!^2ZSIej%xm2a$>;`Im<$(u!o!nSc}w}e(UD`6YeYh z&=2TUO(Ab&IO_;%a+fita@@pblBP0pz~U?VHQ}&WJ!?1e&>gw9?*|IdqS%{LiGPyv5h$(U)qU6oLe^$SKd=0ogx@d24=lXTX&J_Af{~pdrIT`_wV^CqkH1BQ);hA^C`ao6>*iwz(?U)8-T%;GDldyZ$N zexrkU>sNy`nnK-$9FPNzqNs7DPV=AvXPic>gT8uOPR61yTz#EhoNV`fWL@$|VzrD# z%t*BHgv59zjFO2AVTffBM>KhGgboWAkoA3#&She!cffo`AY4 znAjF=JN4`N2>Qv+ugWrb@keTF4&2+Pm@uaD#|?1z=k-mmEKrT&M$qZZfbgvm9(2#C5apz4@B*T6;-Z zJT-A#VvYDTRH2?!l@?4BKoR3fwh5I!xWjXl?!d}k>S3AD#hq8el(hoJYrhiILVxq^ zjv$F8=9;oelsru;Xeu7*e*J3V-U{^jo2iB_R;GR|+lNdqcQB>_&M@7KuYcm&sl8O4y=xcHWH?a^&c{ zA88bz(l8omQhx;eJC!@wT(ZTQz%bMVG-dyIGf4s$=dE31fqwN>U8= zgGi1YDX-F$YN+f>UC6{i-FtR8rm5|0Xyet>JK8eAy#_$@mTv%qxHD~229mQh`Qsy z*Hj5IZgJ?dBL;Ui(HU>zn7)A3m^^^l^%>)FFml<45A z{UvW2URGCi(oYBl&d*LtxML=94r<@j))5EkWy7SZ79kciHyFGCosmcBmECl(C8ea` z2_e|RtiZN*RP2usPku#Cfo+3tX#M7`s+A}(8^aiHP6=vcZ<*T%1uDs`u+~Wdqdm# zFNWWV$GEMsJKv&LIzo4*&S1y2hAzM>OinB*R;;*&7wU$!WcS4%VWpLA@;uERNA~{i z2LC6~h&-8&JoebgdFD5u%=9)$TeHodHikcB7`cUe)3U7kn||QlxGG2&BLcN`rghgATd>=OE=+PHRqIVB6U? zVcgEcj(Z3_%z6U%INdL5c}9EW$AIU#HQ169#uT!gywuUdBvLkJ?|vMzGJnaPc3J=8b2ukZ^Ixo z=(EWws$kc}?O$L$c43Cz>iT4fS&P_0`@ix|7hJAC=w<)Ow5bEPmkg)#E$|Y(nR2};*QLG$xj9kR3rtXzV)fzEs}1)gf-WjAMnGP3KgwQ9 z$H3lfKKIfbRY?zB;CPaxI!$dqkKAY^-qGlXhzI>s_& z+NY+VkJ4W{EFA1XGkNx@IFK*x7f3rd+gH9nwCbNNQ9yUX z(65)(I_RaP=>|U%?#xHkL2rV-k0ZYBu`a~D-K4wwAK#o!VN7|>(47jP#pLU>XBLUI zmOUwrZHVj#HAgm$#ahovgoMWI@V$=I-pr$)*>v?gyPC7SHq9a^xv%Pzb@v+CIWO~y z{VSKM=OEBRLEG$h`bfzhG;gTd0pCgZ;%jL;!;*3GaLC~hnQ-?hw~wWSKT`n3BNKrd>DsuA+O{Z$KcQaE~#{rnpC)gSZ0aH)4&HOtt{?-sg-;F$bdGV@`T@dZGex z*YsPqd_mj{Vy@5XrFI8{E#*VRrA!~@yF!|A(>I5lWm#{?#N5J5$sLr#p4zbdf!`+U`WkXs=8!G< zu`TF!vhdYuNk9|ArsDnTAVwfN7^d2Qb7YL69d|}FWPG{F+No#{JM(PK)lb`&q6b4g zNvz!9oR?7a2o&6b?_z8L(vKD=Ybq1f75!-uW1LW8eI?dwCS=*#(EFY;YVO$FO}M}F z-~@Xid1oh_T^)RbPiO5WqN!>^W<}^2GmaoRBQiZmEl^L<*yBCRv?jDg;cYZ6r!8B& zqt`Fh^_7H#HbM>e@_wI2YZ5;3K_Z~X=%~n_H zn~315_y(>Hx=1&?wR5elYB^q5=1wcuQ@cmAl(p9Fr*?@Tgxyo2*XtPqHOi;x(Ol*~ zePc`->s151s#>aejr)GcTE3LgM0Dj2|JkxZodRSF!V^5tn5A8M$EO;n^`^CWaBVXB z%W~@8B>`;ERVfn2n(jedpLohy_S^eq1nDWYKCw2@Qco|QjEs^ryQK#mz|C6qlDkyH^=(E>FWo6g8yUibx&eVMcFfMV1Pj?N*?FpkuDBp%>BmM#qAL(~D0lWT zN$W%neaelL1H{dsDSc6IskX;RIAutnEIC8FR>)Df(nyrB%erZnMrrUDTG)iRSH|x! zDmS0Q<;zmWLYpTK((wPx57L+&uq(KiV2u&Xs2jm<&`XRE#R8FEwRa}SAiH0 zWok=SDzq+OVle!A5J$hPVDDHmSzUoTSAA2`SMq7hl+dViC}+#pav^h4hDv-Q+>X~- zAQxulw_4;p7=%A$ru8=m#kIrn;+c6=xsVmya2@(`G9DEa3c%1QKIV!OQia04v?ZbA zLMcpb0(4MmkO*VAlhQS>GVF9Edt&+Vnn6=_fvt>FJqO_U4r*xWX4ZS-*6o0n?bXGQ z^0UKu0Xf#$iFaCm`vhj_WnJutC2r}x0|Uqbeek|M9g`8!)+fWK9qj6Qqw~DT`q<(I z5X5UT6oi|2UurE z2kVTt*O{4Wc-}Sxz4Re-! zLBmIud>hy1(b=1cqqYpn<_)sURj>sCzMMthL?p+$0Zm-r3+N^_=&EC{ciDSawyF44 zULj5QDtaq!!+Gc3e~Xk!&W0qy>lydpBMGCQu3_;RTOJ3fP`sd-#!gcN>q^yaq5|a# zbuEsZFY}l*>$;bGIV;fKIgMyf*0q;h4cmFz!7lYeLrbCdb<>viL+Mq^PM=h^@xlWF z{+?Z9Yjk61dF&M%if6f7!e2p{OfXl0MM(UJUD6Wh#@bv@^Oqytav;6!4%4QGz^(<; z^|8eGvktsBXOkBkf;vF7-_xx1{a8vS_V-g&H5i$tPRtHFT;eLa%Nz2lL;+>VIu8!R-FL`XVO^-u3vtj#*=OW}AH^Z)5+n4U_Oa$+5wZ)?0?zICXP;E1 zW|YBfnlemcMmG(ykd2?*3I8#ze6Hw}$@y&6{E#gels>e~ZgGNM%!p4T=leeHA24;; zyqru*5>M=+Gg(^+9_oF;DchXz+BkZOngRvjc!Qe zwe|hGC}I&d*s{oy@+19XzSrYG`{jc;V5Y6slib2fx6rND5OC@cx6-6WOXI6fS*f{^ z1DV06>OnjOp!xL(9fZv3Bm#W=KKS~5pN(rHbXoWr$v>8>19oq%j7RGi^>!pDKQVQZ zyz57grf^fEi8fuJfB^4DG@{)k!*l%+X?5g;kQFQ=lM=cy3oBPAnTk&vD`W?$KZkiP zPg-Z-d_9}W;R1MbvywPF%Lyynr=e84r`OsZ#tH}aUYWwzz1z8p7=`WZ)F*732c{)c z1Ba*5{4So806~T|GJ_ifcbvW{zou!sd#=HY;%{1Bp|{-EurkCt3c}+Q;)19i@L=sJ zU3-YdYh`SHt9+pWatZoeN|j(Hs6HElsa5=}ep*P1stZ=B%ssIdviv$5+eV*SkyAgx zX^6H;fmdxoym!wrUDU3+XPZs#t~1{tL-G*?oBl~fZk6v0DrJ4i{W2xswai1r!-j{k z4m&$(G*ua_N?h;EcY?fRnKR`!OP&bwqxGpz9b_u&Ozh>|RY5Nk?df_@s|hPF^^BLy zs#@%?jB%^@ZnCbZQAJQ}9!^v$E!5BkuLOk?2CJk3?J3IVazuKkjszR)6S^1|lhf*q zHVt#=dGR!nZYQ#kUOpK;tGbBvM+;e1Wmjs(J8zGWjdlb~$QQ54ozAA@!(B*mmX?2~ z2cL6mL8$Extm*otRmlqp-06*8JB~J8_SV*LsaLcJ1xbk1=mcnXFDzl>ZdLb7$$Y|_J^6JTgv*4Y6o_i*j*lHQ7(!A&Mx|{rmrFR^Ld>s@` zcq#a~$B79qdbupm<0n_IGN(5Odb~XEn9z@XxXMC+`WJ-YlnKp9yBr4ZN4py0IPYh5 zYr=_5Ku|vlvz&K9(x)XZh*N!;SsWMAwg|o0aN=ENdzIVBT07oq&FKcgq2G712<%Ph z=Qoy6J~1hatq74ULIidU^$rMZLeHwB53<1$0Lxqgd(N!f-8;PgquoT%C#c7Rx_++* z?#P$RHRxMu)-_~Z(iFg3Jdc;rII)w7bEfj@(RRlCC|J)0qKqGrwEhstAQ!5q=&rjv zPuNZI(hf|F##O~l(Ue_`Ij=GKau=2=F%~#TkM%!V(fD`1vn-fY5)M)iS4)IrQ6~+1@E`t6jzRVGQ#*s-L+%s*N9N!z%; z9^mJ3e__^l%YNd1fR@=m7Q zFH!M#{{Pq{9c+-bb;9FJ=;gePUxl(XX#gLmzHp9^^*1{1M*XY0!NujgWEG;1?YF+B z-E;as*R6>9dvL?G+>e&QNVMOoq{$}@Cnaf#ZYE7K1)(RaSrFX`R zLP@Jzf7d16Dw_gSAmxXvb1HR@mfi>dCavDvA(*s=s|dr{2dccG1Z zo_Qf$sin5>t7vJ*A%t>FynwzIn?H#JhI_e*m zf-_)Lez&ZDecvOd2DIQ3d{V7ua>H3V=)F0i&4=Bops;E@F5EEK>(v2-KYtQQ^23yF z4!5&e%UaczuUtwo*xrX1XkLK6S0x8b4H0>Xs#5=u8w_KC2{Jka^v;9P3Q06GH9+pX ze75{t*;C#mX>n<>p1a0T?`knuQlE_mt*~UiwVNcxwB5g=Eor3?r{z9ZCPX1dR*~^C zp`MpB;#Jx*#ofC7NM-RfxeD`sOp3X>Fg6=LmF4pv%R&Q|#q)_bDLOdH<*j@IpnC_f zhP>?3QI|#&42`DSDu&X{7^w{VOh@7Eyah_ieRWT?Lfn(7N>t=z^KF=CXmjW9a>BlW zxYnTSDvDki8%E}s)dBXvaA1wfl19ukfz2z!&?|i6sJ`uklxquK8*O2s2?%1W`jy@! zt@DV>uKWAr5woVfNl^EuiJ~KSpDajN`E}lI|VT(k@p`{^(O4@9qVq5j)y02 ze2XdXT;P_u^QJ9$NUq2LpeH40ov)KA%#rr4ng!%DmYWX~dRx=!W@p0`56We4ZauLO z;*B)y_XuyBuJYYJyl#_$_&8NQuw)hOWJF(_xNgCLBMRXBMLt$nyRjOiO*zBfH(HqV z>duT1GPvaEKOC0yV?cb9c`{aOsTVyaJ-9IH2HaB8d!xyQn8&tPh=;fqioLF{@7QKW zE~a_#$-Uf?yybO7l*4X!I^6kAROW)yyHHtCKhI0u@DtF->%4>k&Q(bHWStC?)(nZg z_Louo*ZtW1yx6mENr3Q#ax$O6IYda-=0N+`;%nzkn$#42s}Lv0itr}cd-)N&y&#U} z1DE*x-c>Cc+?4`($zfKdvGT0Y>a~L}+*709NOM(54eVnO5a$uxUQo)-WB-R!TL?dN ztnusZBR!5`gXw19rXvu&DBjHYrG_xqDBz_{}PSIqZQ2 zcVR%*;C%mh$}Ay>t6&OkS>-b{n)Be1hB=_C`Y#u0^lI!6h%oNOr{`^W zTEePh1bm9LY#KAFz25XhxSB8*ud1Tkb2kWvcY29qfhI3DYza|oqwau8?!T&|-G}4( zp7h@wa+COF@@TXtH^xxioCZKl)AP1_<9Rt# zExl{~0uirZD#yB=H@y7*tbjyRUNvw9de{Ds(_c(;AXz_r?|unTGr^F`e4N1(*p?i2-bN(DKlm$5XWbj zVH){=Tw$O5yQ)JyfVA&FR($Ix6H8!d$8^aCU~m5G=SS4Hnzn)nqp47E@urM#>LH-S z{m%h|KTPZqyLSla8UFu3OyNHop?`CL{yF_$8r%QFg!_rt z{fpH2o3+yBvpZ6)8>er5IsCt(5Sjachv)*}`M+q1KO~la$o}4{{tuh)R@?4NK&Z21 z-GwKQb{__8 z;`Q}^Xp?`u{+b)2W#6!{pTQ9hG2vwVexewQqHTo@%SKDZ{YXd}0ZBuYV85p(QVq z(C?>U)BT)fwr*qMdYP4GuF;}zQGRPrHKS%np>So{^|Q)|Qy6P8=-B z&aOiZ$#`f(mH+R1-;fnU2nBgQ=PIznDW2E)Y>M;`=`mlXtj)G|t^gu8zr;A32#pm~ z?kpsZpoD9T1Yz?kj0qkiQ;^SO#c@3tROP*4mP4I7Vsbwwq`-euRPLodtsW)(VEYQA z#x=x}8clgCfAzm3{q1PC2Cyr5p#BjeyfDwrWEthFSeQ@HeG(D^*vN-3TnlaZ(m*$- zbzNiA6whXz=}>k;6X~7#Fa#h2&IAqI;23t7+!V{P3Pf%N!G;eDTLx+hk7z@T{$rRI zwSjiv>Dbe0szR{lwm=ih;XB2ZldAQ<00#E(X4tw6tgj0Y>%QuF?`R9IKC93HF+Z?8 zH<@!H&Q-o3(B#s6?td)#!ef)L!Sk=Xq~MyHNlopHM@PT(ujXzz9qBnn>hD4k zZI-~!MY&V0792LPqe_jB%H^b0%bcwe*m7~Sw<+EVb;48C5EwLfkICtVVtpfx`fauw zgII*TN3D$Q>&%_1ptY^vWc#iOtJ~POc;&eJutOZE4<_>am9!cN3%D{ljVgV?;+_-J zXG4c~=A(!EP?+kbJ&BazY2%PN|se3`%K&4Rw(u z2dwtS+?TtjvkwP9OxbQ1fZwSPn(nr)eSs~{A{`qlR(r8XVsQ!vP28qtSN*O=M*)?6M5-z@T+)P6bqY&yrH2$DA# z3*JNy%M{hE2{q|u*^j^(UBH!Ss<}eV?3(2ko^p(htQeS+S5$nXL9_7q$^$bHWm~h( zf;ze|ku-ub-m-x8O*ieFt6P}QGeq(x)kyuvL|MnMIEL!vj- z6KNtd83AdyKHZkOc-L<2UuzWhZi%c)!t`J(#fE_v3;MUeznJ(jwohtFSawc)Iw z0FZSE<=Q}9-F;t4?1t#fYKbG;o2j3LXZf;s1r`+C6#jelcf0*xstY@RsFAumruPOK zkNz}+&v!))i?>DkGE|V4i_luE8o~->J80=^f=Zr>%c}MDDJ^)6!pZ3q%*-~6Y0lV1 z*y30EGV?f8rjb1$s9L+xwmcTZwV>YsfztmU^4>eD$#i`io!RceaRAxsC@4tA%^)ZO zB28)r8za3)FHs}CNfQGknGqG05*3i%1f+x_NI(c7ia?|#QbK4UA|((Yk&=WYBsnk6 zc4qJ2x6k^{T4#N0owW}CllLk2^E`LCuIpZWQS(GQTuapt^5<#ZAs+l)ZlEasvI&xV ze8c2%ohh*P&qA6jCc_{OE~53^0aRyOc$y&ey#-v_VndkPyyCc95o_rMyDwVH;V6w^ z!NvHr2B6O~b#jI4+CHd#8Z`uNi~RUFc7<8PF;bOW_+*KKJLAryV0`CjK|5ijeX_Y~ z!{!6%Fle|a9+BDVih^}q44h;VMxfZ{$|PIEi8&yM`D6^&+ki zZdS(<}- zW?ydv;&`=+HZpwP`F63o$DnQF6s~Cy#dz1lGZ>(lHaq-U4pxzjzi5XN^v54CH_!0uCDm#5Y`LfW&`u8VvUTvU z*X=rV{_-3Fd#%+u>gx?X+loDvi~6k&;sB`xPpsZRkMkGA(Qd)646Fw3RygcKlY_^K z)UdLwWhC8qYc0ydn{?ug8}(>moa92hxLqI=Re)n&V?U&)5mrI|9 zCQuS@>t8={|KncL`{0pZLo7q?@PY`$Lgt zvV8%QiK*BDmq&9T`vrw1P$k3hLOibWa4gvBM;^w{b95-kIb6mnZ}W)%uM4-1md{V= zkd{_sCE@~J6oC1!wka|KPhD&AP5ib2U=MR|i#!7ir=t>O#n2<^u~Lz1k6{N60WBz` zQi|=>pnA?X2z{7+8itel->&D%0CccxfzrJOaP4%X@`mKciF0iVhKWZ>8Q+$StX?fE zM0V0gw6d;%kIihr!jrQN%g@xMKpUQUzq&N;*GEeOJd|tM^o7$Tb$fiIAg9gvey?!z zWdj`m6~ zcj?|1+#-lvkw&CT^+fi3A3^|*NrU{H6e ze`I79{aFPqJ67asupn;vVpQhwJd&)4KDfd<(oC8)T+01!=F`OLOrx0Z86L=iM;U+r zzJL_%rrq=-M5lJi{510t(owF16&7#?_H-dcbsqE2z~D--j42(l0;s;tLpy<#5Z7_@4<;w?=L_n1ELR+-A{pS{{X9WH!NGt!DS0@w9S z_mb2~6)EVjZgwQZl=U=EU8AL`)$6QgE(o6jwkh)`zCCg!a_Wh(=GF!Ho@Kktc|pa4 z1Fx+2vz}Cph&#V@q|<~o3f)@E996m;iK-T$PYYEq{|nA$jZz$Gu~lPd>Sk)M_ioovr5k19CIezlyQ4d|~Yp`~?}&~ThEI6j2Y6{2AJ?b)$xZAH zIZh2o0DCgp3F^yrX$$jm3uR@sZ^Ks>j;eBP1_u48kXbfg7JtN4xcR z_S3u83Nb;LQBbQ&@p`n=IqoQJ)|!(oPv7Q!lqY8K0RDs>tXw@AjaF{l}t&bI?>FS z(5n6F&`g2!hJ1I;o=62UiqkX0(ESkf!#CeV0>QJ@VbOQ8{f4iC?V7^==H8(%c|`oF z^<_-Sn*80Q7)MI<^=Z|gk1otw@|R;HA17Jw9K{(pJFW~W~&rsHT$3j>$ zyN{&R1+x%d5|+iGjlCTp@9)(@ub-LiGdRTxsFUF~x17f)5=cI$5df$1?(2{?4M-VG zxzxat_+3Do#LPhKKVqnOc;wMTDeW;sxB>!7IXmswYvKn6s$i9jjWHAaPnk!9a^`SX zAjZuO8~?PW>7vA;hkcG(MkhgKxtSr$bj`SeTmR_%NXHSj*5rojzoC}X@I3R4SoO`; zk=cWzzmCbf-7!dh?H81@R?0#2?|VCD!tpz;dF@nyiSZryaWZ?t9V%CpWF9=~-IMa&T42NF{80Z00^ zl5uD6XXSEIeCTa|8_HYabP4J6T~%JQI-!&JTG`FYL7{~3YwhQE25r4v{Rx|U5kkh(Xc7*g>!9a_{t|y z#QZ`S^~KGCA8v573nx?8hR5ci$3je_y}X>nv^jGWrBQlAadVlV`lQnfOcN|m3?;Kf zHlHYQgyeGQx}au$6}2*URN#1^-|~SjV)fDYoE!TS9UE>rc@9ifz^W z@=x{u2D9ov=LI$$E=2B)#u>ctQhwa;<-bfBL~^a_6%tLI3DX%W0n_9Bd(l;@M925# z-GxD|&AqeAZ1(Mz-fuZ6o`@;AW*4?g#Ov7Bf%|19Gr5$j>K$WA&|iZV>1b}7P5?2u z8ctD;AI|Oe;)X@aZ5pjl*AwoT8h;X|_Z1sxq^hMXJ&p)v&(+C*HQ+s`eUo(eznVDYCtvFwz|%7#w+@( zDqa0Gu^W^t!!Wes?yyVuc$_2e=8k#2)62ZKa|H}T{V2*0S~@!S=V!isgAlK^93~vS zPUPLF_7vV$@jZ<3j#k^B5Gl}@Xzk_l6AOc6TYBasZC=-U!@H`G*fnS9_e&@5 zOgP7D!=7SKSRg#ZdOVI@qoy#ku^`<{nhl>FN-s78mvRiL4P~m7~UUUDE zuH~hDs4zwSxS;`Ew?2Q;56dnw0lkDHM$@u?JIBN^qY{+p;Nay;4Z(Z{hi`5VdWpm`&zM-##n6Ow10|C6k{ z#6Dv+-^RZiOQNR)l_U4GJT$7!&2>4Kqiu4_C2#e0E*ge`$JAav z>M{%=;a)f$>=c;3nQN=Xd#h_S)xW1VTiwEU*Z&YlM&WD~S2Y(cp)F@S_DTjBc1-Kt zjeJr7@p#s{&fxRjPCAENI^n(C62mn7G|i$m}_-sE!9~yMR&5 zc**YMUq?NgPgHxH1y+5{ok56hBd>itQreNs>SgGSvp)-}u7LE|mT7 z2&3qu1)%7yo5DAo*<2@IE8531m#F+XqJe>)iF1f&nbwgs%QGaY(N0T7=J5b4{i7a1 z&&X@6iisxcvUctJrE#jn$*kY5X&4E@p}X%FEve+>8Z2-R5>`g59#tAFEa0J)fy?ZS zxsW`ddRzn~o^A=9few0K%hX@E8F~LWprva0!r}UhfamQgEeCTVB%rB#7CeXT7R#@O z&P&@~TgjOylI;BsT62zDICb&xKT3`JU42}U^`C75_KRa6I-f#f@z9&=n(6C&GsAIjstYX>X(hY*Ka+=QY zC1TltwV;0febJ8#>LewK?J)!unX53qCApyA(YAf7Z*h_+nc#3P*5S{(=ZD^^9q>g~ zGSK9Lje#xX1}$i`zi|yBhuArH9{0F<=)TrMzn!IgVQDb-hE+;l?&(bSZN%hfA^{=c z;{tB=JmanQbn0GYs1uj!=e-xKx$}*#++3z)!q9)S9%4~-`2Cz9S3T*Y$_Yc-FVD@| z9O#yt%E&HS_DycvKYJwoQ(pIJRU^TPel|)^6Zhf=Yqf-P%mc%`}~E zO6j+M0{rHl^)m=sle$FN-ObVmUrV#a8BPG!Wslargb0#@zs+~uxq3woyVSRQ7|HgO ztGyJ-ZYPBjxB{u1cQG7V)fHJaaq3XFA`mvO#t#!0uH8szumyLtS%I90+n!llpIWYj z$mU{}wCZwHHD@^?^jS<2-%I^}IcpCV(vJD5?m3%K&6|GP8HKjSIGf?UBz(H(`n&v@ z3jHYu2@}!uLjNqb&iZCsPIwe3R#E9ldQL4uXRysGj;is)(2<8BxSQK+(iQ_};ggsF z_5nJ4{(ls=Eq>d30lF{tcQf82!?n`pDi<8X$t{1I7*na=zLxSmd&p>-7a9&C4+*R% z68}~FZJgMt{o38QYjpM4w+ZV9qd$?_t#zIT;)F-#(kt*b%rmNJ;qle;|2h-yAv-wG zit$%&TdAZirP0$r$N~Dh{tX>p%j^SHJMbl)F|2X|3pqF12P_{m<_VrYKs0NJj zOFemhQDWXhG@MAD1h?+0d5K^sL4HKlHQ8*lX)a)4>hPb7sJ(-L`68!ZBA>1z&a|yW z#_=5ezhl>#uHWS^*6&Lb_5OPm%3_}&(<0iAvRLOs?@}D9*n18<6uQg_A{kF zm)*GHE4~eo<6SO{U(~|fB%bds@;p0>X0Y;_U8+@<&Nsu)!|54f=B=EIU{i4t^7tso z<-aaf0OhsBJShx0y880R5Qld5gkR^a+3)|`f{mN=Q{Uxskmm5!@yr22X_?{qfFBba za-SM@n@+WfFV>^N@BX)yTp7}28qYab%~!=i{;_Q1E~Z(69FgKr@W7cB0l7oK(vz4M z#}g?dG7wIdtN25VXz1eD0Mk$GxdK(V_LYRUVD|Ox)l!Y*FCHbS&}fTFnCwy!Dh2sm zG@%)9ufCm_yI;tbhFlTz^%eIrmO=Q#_sr248hg%iA=Of-WQc&2{P5qVmOY$Qw=L6r z?##rSk?!e#;2**J2?bZgbr9YG%*z?Iz!~s#?IFaBo|>@Ph{M&4{jl8;L%oD7pNnuM z#yI>*6#VxwDyKx~KNpn+1H9Wskk@*JaJonQ+EP7F_?!FIJ+Pgm-&FCTX{29V^+|EL zSb4i5CbQE091>YZqp1FAF9ZK(YYUr3T;ybp-C^O;3#>m*odVyl0V=YnR2#_l?LM z;H?K_Tjmu>@g|hRV&Og2w>N5lAIyUnj(I=QEx+9VrK25X2p>CW z{TP?zL`#aBD$z0kN*0T9_YiwEYaj^mY06c*>vlG|siLto2CE<(<-P?5R~`~A5quKX zA>P+|#nW{w&fs;A2(a3T|FHG>N3YD)6n4?}+&%$LYpOz{(maq}(QnnJit_=0&L#-|T z+rhY{=4f;vy4>do5jug?&mDEiST&GhE*C%JLrbq zUHJ0Y1Rf1rG%~}rcfj5m{{}o}{H|BxwAkey7STc;0AQ$!s z+x65#U?EpJfE44-?(&hMj?9scR@;huV!YdGb0hp5Yz+yNEEI!u`P~$Xtfi>Y0Cgv!2lyLV7g+j^P%~z7Hj9g|&N9x2vz1 z=7mmIh>OMhqhHxIeVT}V*s}KVj@P-v!0;P?03N}XAq8)Tq_^hTLL*f*;PuLlKAbQ_ zefU}~J9ow_t<`30ZEY&XPU6R8^T=|aWzz{PSoqD;7FX@4gs=yJuNq<%8WUQ8s~{mF zCu+pUwgSJd7B|wd6obAu%&ZbYmZB+lCFb$MJomF3rkKwKU}xaTCdL2k$p})`4U(8w z2MH?~E#mT#XGZf8&}juPocH$JJmXM(8*}z&4BNCtVIcLiYS}vGn3P3J{6*a=Gv0d~ zBTb%Ur_#>!A7%o)V7u~=smfb5H}?XzF;E9=M(x>A)kaWB)4KKf6fG&CVG1luTQ&ch zTy}CX(7d~w(|hEdmPVgkx;4a1Oe_uNU!GLVtYAlA#1FT)tRceJ+N z---@&y47!yWyA!ulFTo0y(9U*hHVYDG2GZa+=XOSsa{NVhQ6v~T=<2A^_lYaCkohM zWBSp7NX2vC7eD+r&*LnAMiK$35zLda#g_B4KO{tyZH8ck@j_o-FuSGv(;4n1et#0# z09+{+D@P;kym4mjOV>B<^Ye0@KPtTiJk4O>ZFd8T6OSU`ZDA*LcTm~I_J6PmzfAE* z9D{CJE$SApqeeP9&M67Eb|YsZ>O~bDMV9g>W<*irWU1mh{iTzbVtvVyOd`I@$OG+&)EtEM0pv>B~gW1oZAwnn$d_JV5 zOaEB@@9B$C>>l%NQmFE=57Ls(EO zkY=}Nv*ph9$9UJKq9@wQL|M2n2jhsuiH4cK3+e}yP)>x9*B89tkmF56xkh7c=D3iN zM$fxp`UzPj7>l3&AiUq|GpWpIoJHx*8`_2$AhE5=XD}ggMufO9USlk6(i1ME-Ui{$ zw^=qX2?px4>ld+jZ|;KjhzjTd!>Q%43ay}VB97`=YU1eZ-y6M&rr_2HM?4#+~0Bqtht1`G#Pm!%r3P+AYe_^ z5-YiPYmp1(2_}Orvbad`j9_!4!iY;9gSUGOrG__5X#e|Ptd zQz70KtC#jk%>Qt5Ln|aMrc}rT2(R7X7m@gh=d9{Yup*Oh$f3%jYbKd?Mq%TX8tCa8 zLFbF~-c|=DtPca1f~|u}0dF6>CzokAS=Z8;qh?<4F@-ISS$O(a-+Jp3Q3RL5!5@1!ha9{#(ic0`F}mzfQ>TWaU;ePyUJiN>65nn==1MQegR@+-K6 z!E!WOY1ST@%#qVvSf#{Yz_A9%##OBk>vJl4>4}>L;nlHp9_72$%v`SRbX0z9l7}O- z)hX_Bu1|T0CF@1p*0UsQ5wWFfwJgt!_a<}1jXb?RJJzyl82vU|HV(D~LRUAKjmLp~ zHb2**#xTa5k#qwB zwFashN;I8~j8YE9_|3)DImTS_;b1?WbBqCQPZxqsDB|X?xo-%6_YGFow+)H?ImXN+ zI#)>i(9D}n*`J_2JB?1sUOp3(aE~{%u&L#63NypVz7Q?YsSB0)y8#)ZSv1h2p*>bh zme-r!N0sJ>U?NLI-@%ra_gwFh$jaz@c=gr<`yuCb%PhNm+bjyAkV;Y=Wr&z!$KRnOVB_1;glcVB9^l_dGx!?_j;F1Ig7Ds!Pe8BxLH$anQ* zcLHe_kVp9N`mX?a+#ER{CaQUpRgGCoZmv=@-I5%bMQ$VU_Q5nDmQ+J~m{z4I3bZc9 z^&gR6^~xZ2ZZe;xv#QcF5XlXQG(`PGft*xmbxfEH&ENJzkrh)h=|*2%eDlJt39Eta zpY91BY#Z$w?#odo_#apvk0W<8ShJ=-9&QXRFmNPn-yD2W-XzietJa8b-gZ4r2V#3f z=~vOdpF@)GFJEcSTz}TNYQ@sn=&ikn*EeZ_WaB>`Dn4Z=li;we%r}~%W?-@xlX3kh zi}8)c{TN5ppeyp}^w%ioq$8Rv2aOP`!B{Ma@B>i9bBR6`v)dOv2rQkRY8-IE_0swJ zBV_qc;eS?f5xTrt+#8v zjL4%h@C*5`W`2&ozJZHw@0pt}P3pe5Aie!}>E4?fcNE9R`;1>5uSvxey$32l&n&Av z3yW+fZ#LkTPwM$ojbANPsMXPR+@*-geR9E<+wWbhrZA^w}aIq@w<`*HP-KK&z?n6vN5Q*1&{vpz_dtK&R93=f?n`p|xP z)q-j-w>yik-jjvsH2LtLzW3zebRl44Ui8>?lnQj-6zNx@E?Xcd%^RUN-8grsK-{l@ zdM2vh4Xl!T!C(23TPH-fn?EzfIRc${vl!*zfGmYCx>!z1+{+d%EzIav{Z zd2bDt<=#9M2Df%gm)&D6wug%-q#u%dT=DCYVFv_X*5et{{6@EN6v$dP=3pzfA;(A~ zWs2(45p&G_z%RGc+TA7Q6F0dn2bo1tG4|ilOjH-ALt4d5>^HjrPLVNl>!gI35FVIe z^~i#g+HX#ulW3vS?7Qhr99?a8XKyN z+j%-)*iM4RDo0-$6duotsWBReDQrc-u(kCZ*Cl97eI{|Yf=0(Pca6ChdSF9tGX>39Jg%TshXA^*c^*ZyT zLQj#-aaaC*ydJNYW|plPHfMT-=5wQI9cWN6zpNha;dkLZyp{FKrgY|$>vDrd)zj0J4Ag`8dnW|*QC^b_WPXuh7 z=+uP3G@_OI_fLM%EZKcm69Iu#yKI9bSKl8fp(ycLGOMCJGY;Ijg{P*S}bLZSia zbT>5QoaxPB0$HfZcfF#CtMRNQMpnN(f8z96C;Zz~+8Zoq zjjPv$Psds%46$i6sp`4u5tW7CMfQ6_&ZQ%|JX*0@_D(M1b1%2l2sAsRX6m7S)-x1? zr5L<%71WGpgv?zxWh}l*!%8fBwqGj|zcVc9JY8kxM#vI%U`B<_D_16Qa^~9Ud9dL% z$-#wGFr4zd(b)-9I5o<$Y2MC{Dv?VcZ5+M?TVLLAmkD-piIMZQH5N$E%o3T2#chyp z3a?DpOrhT9!SW|!7g{%E*D*iu>KA6E65;ETK+8kBko{NoBe!2X75F#Trip$_ZrA>mMvVd7m+sX- zfqHYLEn+b^`cu6hnrr>ZNOjpLH`UZFWa?Jp1cF>nrne@`_}M5#Z^HtYtz#=GmTa7k^96hK3p=%+54-iiN|4YDt+UVj}q8O_M! zw%c^!YfT!8H-EvH^5f)ChEO?D8n|=MUKgnYk{I08yw7;EmRmwS`SD}1e z%Rmj~G9znN)5YTx>UK~{p1_g(9hnCUrXn$TjYxsnnM<$Y!mSbv8+t)| zk8ZRkkvT&#vj)_-zWLD#^n`+-X{(lGG~(k|P?Z`9c8(aSSE(4*V_s?AT-3KClb%Vd zw7{0fY##B$V+<6>966jYDko7k_$rWY z4kRF2jRViGbxLPepjlFQ!p&3XmnsEhvOLM3@`ins79AtbCr{u7e-FCiY{=Pi1i}gY z`7yA;lEK-u=84=Id*dpzN+0ChLjHi}$Rz0A4~WI%7()3F{9cnRb$3 zHVpGw#xzS`)wbPUT_Fx&)#YerSp9JK!*9Z*^6$|c;*hi8 zN^`K#p8dv$ei*vmPV>4#5Rc*Y7UnKU^&$lUn9s=V`|exi9_v6_sJa&to$bCw5CcGs zfkdD~pCW5tJ31#rw~ z<|Nv%c|4*f260iCBm>sqG&=wZ`@TZ}SyB6sBF#qi*V}9ZYA2d2FF1tKbO{sAtumel znN~N!MW@(LNC-2k&4pUIP>uLX(SR6JgxI=6lNB(Y zY8?}Im2sHwk!^13ZEL=9Rx}egHH7C9Qh+h<5;+5@TK{oi6#l+nDlq;9U(+ZNrc%8S zyfBwBLDhWVGs}3b#;FRKv~gl2NnRoer}1{k?G{K-a*umr==Q@GHZ|p@0v9qV1n0fd zT>7SHgkK+oh86;e^{vU8V}Eg06Taqw=7Z(a!H6zLMiMHXFt@f5Cq}#ad9HfLMqf2F zk5v|G7imLHx>jLy_-Nd7>b)$2;zA7rr zuK<}h#6nT*7D+Va6W$;(Z(b)LJ)EhK?yVCt6L%%7&*zG-IgltNM&hzDq)m5x^+3;9 zQ8imExZ}P>XPQTzR`qj^p}w|N4@R7$DyI+JZ?7fdKYxp1_WF&Szs|E*l4lGJ$W%~h zThhhBhhzCC*qlg^9l^R4q61S8s*#ug?-W*Zb{O7&^x?HmSeHex+}JfNQCVM+&r^x{ zVtKLsb-ii$fYIL~*FUF#b4H%%^m?V^qZ2mRZ`!)V~#;^xerm zg4bFjzxP-rQz5`DNVn9C=f(aY@*630F|GE-ubHt;rX%~cazV~?+E#Mw@`spvw|0i^ zZvE%bO%m4iMO(QHypSuNX`r0BoZxWg2unDHm5*G1BOP{d`By`+b|wIebU!P4@ge!t z;dH=HXyO+nfer~gP7E{voTLz%1GX@g-SIKzJ7T+;fx3I`+s(YzsJ;ZocAbUKtFlBU z>_UwZ_idmps7Y{}Hq6+R1lgGf!(%svZLB@)7m^_R$+CtgI;*^+jJ;EJXiG4sNb3C(eGHA6zPAYrQ1!ONtx9KR#<80eZ7sdOtW*OFWlcILN4JF2ekhX8x z6<5k^74Bp6tC;&d6kQ;QOH~QLeOR3FRR**-LsvD1DQKDyuJrxhL<8s4XU%TJ-Pctu z-0HyFBV*s~x$XwgrHW6h)&R6sWho0aBh+vh%JfW|cn>>Ps`t+EU^{1?X>ATm%SCYo z=`uHrtRhlCeKepj{^&~T&bJN%c!w`6rJZkaK{kb-xyFJ9SN(DY83lf1G`TQd4PCfB zGJG9bU(1`2d_K69sV|mZyPbK9WoVvkK6J4V{;O9bugSS^8m-Y97<2m+aD$ZS8><6X zSS(jlL^l9N>*C^l5_y4BTxYs}Dtq)us%C{IG8`W}e2*zuAja9@mb7=1y#~48_)7Pd z<7=C|*B%>o$8QfaFqx(=YT?^uFAKt|SCAI@4TGcbVOjk6=paa&+G-0gT&4^3R$Vd? zs~+AUWw^^~yHJaLizSevgutvq!jd(5#wsJ-F*tfS`s%kX)b36tSz^r;;Q6` zB8FrLb;7kpbUB){kVr0r2z;HyFZt`S5u%kAxzp|97jZ5+LK4cu@` z{PrE=K_tilv{fZAeRnc7s1E7r#k=ige&$xNjcv<1aF9?Y#i6HX6`d#R;@)>6MJ9Z~ z_aM8lR_0;$!QpaYLHj*PkfXj1Jo);afF6lqj#?Ge#dvTboTkm#MIJK`h7DnawXutb zy*Q1AxJNBQjiE5CX{m7S&V+YOon9*uzxuefZ$$iz-|GU>585_yqW!+lU#eHg7?KA$ z)P=0CSwqj&qWK5`Xba3(_lkb!7p1{L*Tk{iouj#MuMnXXnaFxoibJ6(IiTA^acmDp zA7!}>Jf|qhz6d7(IatI2K}KjQwy<6TCdMrF*6H$4mA&5L>{yg@)o4H@MkVzu>ljA& z!DI~~g>3K~Y*<6VOn@PJU|;1Lr|4?;@>gL|aWz9O?ffhQl@5sD5XV-C{>U~Z2i+3P zGIlk?7Vtl5ivxvCvZhtS57Tvi$j0}g62fQjhkHA>LBm&1tTuUvLaPw1uhNP zbr&Pl4a3yu;E8CgmMX;4-A+8~JAU_6rKpVMPBQ*%uF=5rc_wWU@{@7|$S=faU^mn> z8;j;BzbMl3YoM{YUXkXsJ6!v<&VF8wNGmOIWOOR#JH>|MenG%GU(`vmfVXV*#RT{u zZYtYN7g_apSnyN(ztej0jxl6iZ>IBT&oeF6i9~sfoq&2v5I}BeVU^=_eoUl}CE3E`P6hDoK4q4Y)+83ew(ky^; zK8hY(1Xw?G6A{21!w40gPN@E@0q=dw&zMao2}7j*L6ANfbRL1@iL91t zO?y^OZsu#X-AGU^Olq`x^loYCe4s!U3VgdI_a#qN*l~|M_WK@R`iEtW0jrggnv`dG z`p~f?U#Pl)SmgDd*NX9Wz;aDXn!Lpi43W#{8CiicV=QSlU3mq>g+Hd^JE)A}Nkb_Y zh;rJHTt0NW;tPb~_=~SL1mNHB+mn-I&FP!|KYMNOPNW7Wnj>kYH;hxC)9~wH024Ne zSId2@e9ewHY2FqzZnW6%^|T}3R(bZ)Nmgv$Nj-=4?!2WwIW1T;35!#*r6A$!@05qO z?&Z~1m@T!dH9VSsU4yC^fEZWQ3Ufpn)&ls0Yw;~vv$H0gz6L1^b>S{!)N9ahFyKjV z-6UjOfUjy{G(?L$?ZlCVu~LPu?Hq>$2O{3iIrlfZNvTcCdN_v7Nnl6_aTyC(T_Mbe zsKnjnIPqb-U_d|~O$BA{rz1$v?jH|E7n{`WPji@({bCK5zdmpZ)S|W!l9I;y(ws=Z zlC>t-N6nH!XC&q&A+C0HQ$NW+F#zUTX||M{Kv_m9Nzw*f&xAJi$ADu&;*{kWjBQGK za=k;(CT1y|J-Z7y%x$@>Tfy`?lM+5=8D9_DhG!ifXf#_w3>x#8B#WN5b^4RR z;&%-94JD^RZqlXw^mf*XXi*00f#JnMTc^T0VSnL$tv@hd=-RLQx#4GLD%zTTzElzY zPFlYL%WSoz#xB=fhtYP zLXg4l4|HZG8JLE$irAFX&v<(+#ED+rdaC&au!-%QD2k$b4m{;DuSk&EsR&|?_I8?1 zO!)WkR<~=r=0ZtByd#K)!(Bx>{968c^w5+sHI&uA5=k_PB0(7#r+9)>+zBna zfsHq!{*CXy_~Ylk`r~v`(JA3mZYF-)2ZIzNqDdy)2lJTFttkQ^ZLzG;i*MtFRnd{+ zMDp+Q(^X6e|0jw0sl(}Onh-3cbT8uCYdzI@h;kE+E|+7!bkrrW71?F96}|Gbe!YCb z9B$Ji`e>1PSvi9+dl}HmG`wTxCjR*A`tlr;@&PMl5oun`O}OCfw3l61ud+6tHO%s{ zqCdy`y^VXlHgLzVDB7- ztSNdFbF=Jia$%jcYy;Sv^@~MLE}YekhZ-R@pD}PuLLYJHjH&a^Z$DG$OOx z46y7EAHQZ<43HA@knJwWgBP=^6Kh6=04P}&si~ukj~fPG0pjXC7$m{%;jzQZ_v*lm zf966KnC20U4A6b8OHbP)2es9c5AQqjTlbr>Mo2ym5EOc`Two8;62?2ic}?akREH<~ zl#VEpT?tOnDBjp?AXe0FOeM@Fj$|w-y{OkZeps!h`UJlyR=|!vmB9fV7aa3gbbm$} zYBUfCJ85kYFTRrymvT!{e`@Py6n*hGiFy5kW*QeZgTO?y^sS|0R^jgXINq^n&cX2M zyPWRF=mo?qh3pl*w{EIDwdK>knbgj(N;U8cyyWLSf+t&W+Rg4)IUqt!`N+v* zlQCs=@$B%8@Rd$a#jc_$ajD__5Md-Ev>jV$T3uUn-Skt3`G|Brh|mmv6xrFGNM4x4 zy#|yd`ESZ%S&N`)m_t6kvg*}RJ>q!Tt62WAQWti-G-?MLLn-){RqmYsdE8!ZQ7>Zmrm&?m?Bo9F{xK>Umoo`di0 zqvvGcEL%6#Shfm=rFuYbocn+=b&qPNmZt>=UTdDfotCG1-uE^toT`b^PmWSO&^Iy@BHGJaCE{3M~6N$>Gl@`tJHcbU^cn|*($aJ9A)xz6= zw(dLb5NhFP{9?+Ei|qu6Y5oy#4@&nUZ@mo(oXJak;SO9XHiJ@YWIn=k0qPg{D9DCa39Xs;WD)DNv*3Sl1HLpAE|e%M#l!d@ zbhMapojoiGR%dkHJ3uCBY*)wjb$E>QNUES~z-x?6=6gkV08&0&%%#m|r(t(%t6+Ap zqWjK0^>&b1f{^gjIcXR@Vx+XKwq%}^2ZNsqec)+7n~ zFK$$aTUiXA+GO{|)wnG#_s6|6obXIuK4p$yFUrci4CuiDNvoan_$Nx=KnxtR$TNO6 zfw<_In&$>?%L!r%3Z2>h+2x|PgTqxF4Ric$RLt%hH71`F{u>vdm#42v5q`Y*T&t4( z;-3CPU<_OlNu?6p@)`8-{*CH;T-q?ikE+&f9Q0pM*TiNso(m0G=x;R|JJ~UL;rtmD zxc+>57hdH^8m9E@g4cf{WDR`(lwEzfe${U0zwvFW5`$SIv9lfW7Y{U`8tr)*5Rs{r z1)y*CWvX}ofFSS4sd@vNU#(Y?;yhC_b|>t2mIstU^i;)ND9@8QY3^|FwAT<`9OqY= zHj4bkt1&uZFr-jGxvsFG@jrg)v_#p}OMz*hE0iecqv($Zh&Zzrzm2LRZ$3y%?C>;B zEp53R)yzp#QHZ+}y8%YL@;5Bls0;&{2&Zzg%Z{Sx0r&G(JCS=rW`80Br;oto|3}0u8*A2FD&r z_}ue9bY!+cc=q=2_UES)KOM=58@YZ{f8iPi3ZE41DAYW8W(w^NnW*oB=OQ+>9Kp2* znlgs2vrg3<9B^V7Evh`SR!fz6@i(bnU4J{#DgfAR!V8;9Wgx8E1S9e!O>}ER9D^6o zN8+Y8yrX+hl;;o}gc#L7*Jp>WGJkjRjOuK}27ok3KJ1c<8vV_(Rgx(;;_Kr|$U;p2 zK31dyz2ti}qQ9&D8hoohYPcCxr?oE{$H_X1tb9ZblJB>K(w}vb2b&EJA+MOe-)*G? z7(1!RSoC1lI{SuQJNrTNad^?-UqpyM7O(!>?8jM2PsW{RxX0M#(r@^WjlIXh{Ox+7 zfp=n=wOysluW?#ZvsmMrfFm@_5+P*3oOD~~!u{$Smz?izR08WCds-D@4-${)GM-x} zxxxRhJ-U2-WqQoz4M-}mdkWbRel8^5GB#QVK@ zraW|C;Ds#U*~m{@falMhk<8v#ncm}cpW({0_`ea-Rg-Q?NYyqj3^)4xXH&|ZX?cqS z%^d$)05`%4vSEf8;31(z_TH|e`@zpR^O>)Ywh&$l%Ur<53bs?~wExafvfJ;8{UGf^! zuaB(NfXi^(dQt+erA9Uf%{V-RE%o`8qx(uTfG4xD0gZvDzm|Y_aPn1cHqz9-vsB`d z-LXl?9w=1%`i+2-WMgw2ppPQD`Z z`EkMDwy$sQPVTg{XmgBwt}^fZy`y@cFCV)l%j_d8G3B!^aQW_|OM9337-{53-kSWS z5mX3*>bP9c_Jo!V&*FdAc5U@C{~SYicpi&K+oviyr4*RFf8~O^u|W5&)dhxXivW+;4B+m^ z&!G7>sH1B^Q%}GnfD)TPC16tXr`Y?|S;1}a37!+-usZc;7;uFCr}A^N)Qygn_xf{q zZozi1Mn%Kh*62#U#z$MJl*GJe(W~azt7h1 zi?99FoNjXK$Gz_zwa}y~5G4&aw*J@K)AinOcRjm)<=s-<&U^oi*PoyEw|)Na$c^?e zpJY43J38Lx_o~`|o&Enu{)*`SZFU!qecvDY_r?Byj9*{>e;Kmz&HcT=P$1m7(un;DGYcXV-Hq4ihlVcMM;G6CSEGMm1U!YTZuMdB*S9wvwGG^#7+q=8ka!TbHwJP=+o{k6+kq9}=HGc6T5-yBd>QYrf5z^n>rzgli?B zbI0?~o|3vh#U%NNDDc23*wK&RbL&Jo-sgSko3VE@6NgZ70g|HHp?(Wy!KDE;UCfbmdatp_onboard.json ``` -## Create Puppet manifests +## Create Puppet manifest -You need to create a puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by puppet server. +You need to create a puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by puppet server. This example makes use of *apt* module available from puppetlabs and assumes that apt module has been installed on your puppet server. + +Create a folders *install_mdatp/files* and *install_mdatp/manifests* under the modules folder of your puppet installation. This typically is located in */etc/puppetlabs/code/environments/production/modules* on your puppet server. Copy the mdatp.json file created in above step to *install_mdatp/files* folder. Create *init.pp* file which will contain the deployment instructions. + +```bash +$ pwd +/etc/puppetlabs/code/environments/production/modules + +$ tree install_mdatp +install_mdatp +├── files +│   └── mdatp_onboard.json +└── manifests + └── init.pp +``` + +Contents of *install_mdatp/manifests/init.pp* + +```puppet +class install_mdatp { + + if ($osfamily == 'Debian') { + apt::source { 'microsoftpackages' : + location => 'https://packages.microsoft.com/ubuntu/18.04/prod', # change the version based on your OS + release => 'stable', + repos => 'main', + key => { + 'id' => 'BC528686B50D79E339D3721CEB3E94ADBE1229CF', + 'server' => 'https://packages.microsoft.com/keys/microsoft.asc', + }, + } + } + else { + yumrepo { 'microsoftpackages' : + baseurl => 'https://packages.microsoft.com/rhel/7/prod', # change the version based on your OS + enabled => 1, + gpgcheck => 1, + gpgkey => 'https://packages.microsoft.com/keys/microsoft.asc' + } + } + + package { 'mdatp': + ensure => 'installed', + } + + file { ['/etc', '/etc/opt', '/etc/opt/microsoft', '/etc/opt/microsoft/mdatp']: + ensure => directory, + } + file { '/etc/opt/microsoft/mdatp/mdatp_onboard.json': + mode => "0644", + source => 'puppet:///modules/install_mdatp/mdatp_onboard.json', + } +} +``` ## Deployment +Include the above manifest in your site.pp file. + +```bash +$ cat /etc/puppetlabs/code/environments/production/manifests/site.pp +node "default" { + include install_mdatp +} +``` + Enrolled agent devices periodically poll the Puppet Server, and install new configuration profiles and policies as soon as they are detected. ## Monitoring puppet deployment - -You can also check the onboarding status: +On the agent machine, you can also check the onboarding status by running: ```bash $ mdatp --health @@ -95,6 +155,7 @@ $ mdatp --health healthy The above command prints "1" if the product is onboarded and functioning as expected. If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: + - 1 if the device is not yet onboarded - 3 if the connection to the daemon cannot be established—for example, if the daemon is not running @@ -104,3 +165,12 @@ See [Logging installation issues](microsoft-defender-atp-linux-resources.md#logg ## Uninstallation +Create a module *remove_mdatp* similar to *install_mdatp* with following contents in *init.pp* file + +```bash +class remove_mdatp { + package { 'mdatp': + ensure => 'purged', + } +} +``` From 3eab5136d871238e4a1d074caa87b11f583cfb77 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 22 Oct 2019 17:24:01 +0530 Subject: [PATCH 25/69] Removed ansible and other configtool files Not ready for ring0 --- ...defender-atp-linux-install-with-ansible.md | 259 ------------------ ...atp-linux-install-with-other-configtool.md | 79 ------ 2 files changed, 338 deletions(-) delete mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md delete mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md deleted file mode 100644 index 84088ccd42..0000000000 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-ansible.md +++ /dev/null @@ -1,259 +0,0 @@ ---- -title: Installing Microsoft Defender ATP for Mac with JAMF -ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Mac, using JAMF. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dansimp -author: dansimp -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual ---- - -# JAMF-based deployment - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) - -This topic describes how to deploy Microsoft Defender ATP for Mac through JAMF. A successful deployment requires the completion of all of the following steps: -- [Download installation and onboarding packages](#download-installation-and-onboarding-packages) -- [Create JAMF policies](#create-jamf-policies) -- [Client device setup](#client-device-setup) -- [Deployment](#deployment) -- [Check onboarding status](#check-onboarding-status) - -## Prerequisites and system requirements - -Before you get started, please see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. - -In addition, for JAMF deployment, you need to be familiar with JAMF administration tasks, have a JAMF tenant, and know how to deploy packages. This includes having a properly configured distribution point. JAMF has many ways to complete the same task. These instructions provide an example for most common processes. Your organization might use a different workflow. - -## Download installation and onboarding packages - -Download the installation and onboarding packages from Windows Defender Security Center: - -1. In Windows Defender Security Center, go to **Settings > device Management > Onboarding**. -2. In Section 1 of the page, set the operating system to **Linux, macOS, iOS or Android** and deployment method to **Mobile Device Management / Microsoft Intune**. -3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. -4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. - - ![Windows Defender Security Center screenshot](images/MDATP_2_DownloadPackages.png) - -5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so: - - ```bash - $ ls -l - total 721160 - -rw-r--r-- 1 test staff 11821 Mar 15 09:23 WindowsDefenderATPOnboardingPackage.zip - -rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg - $ unzip WindowsDefenderATPOnboardingPackage.zip - Archive: WindowsDefenderATPOnboardingPackage.zip - warning: WindowsDefenderATPOnboardingPackage.zip appears to use backslashes as path separators - inflating: intune/kext.xml - inflating: intune/WindowsDefenderATPOnboarding.xml - inflating: jamf/WindowsDefenderATPOnboarding.plist - ``` - -## Create JAMF policies - -You need to create a configuration profile and a policy to start deploying Microsoft Defender ATP for Mac to client devices. - -### Configuration Profile - -The configuration profile contains a custom settings payload that includes: - -- Microsoft Defender ATP for Mac onboarding information -- Approved Kernel Extensions payload, to enable running the Microsoft kernel driver - -To set the onboarding information, add a property list file with the name, _jamf/WindowsDefenderATPOnboarding.plist_, as a custom setting. You can do this by navigating to **Computers**>**Configuration Profiles**, selecting **New**, then choosing **Custom Settings**>**Configure**. From there, you can upload the property list. - - >[!IMPORTANT] - > You must set the Preference Domain as "com.microsoft.wdav.atp" - -![Configuration profile screenshot](images/MDATP_16_PreferenceDomain.png) - -### Approved Kernel Extension - -To approve the kernel extension: - -1. In **Computers > Configuration Profiles** select **Options > Approved Kernel Extensions**. -2. Use **UBF8T346G9** for Team Id. - -![Approved kernel extensions screenshot](images/MDATP_17_approvedKernelExtensions.png) - -### Privacy Preferences Policy Control - -> [!CAUTION] -> macOS 10.15 (Catalina) contains new security and privacy enhancements. Beginning with this version, by default, applications are not able to access certain locations on disk (such as Documents, Downloads, Desktop, etc.) without explicit consent. In the absence of this consent, Microsoft Defender ATP is not able to fully protect your device. -> -> If you previously configured Microsoft Defender ATP through JAMF, we recommend applying the following configuration. - -Add the following JAMF policy to grant Full Disk Access to Microsoft Defender ATP. - -1. Select **Options > Privacy Preferences Policy Control**. -2. Use any identifier and identifier type = Bundle. -3. Set Code Requirement to `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`. -4. Set app or service to SystemPolicyAllFiles and access to Allow. - -![Privacy Preferences Policy Control](images/MDATP_35_JAMF_PrivacyPreferences.png) - -#### Configuration Profile's Scope - -Configure the appropriate scope to specify the devices that will receive the configuration profile. - -Open **Computers** > **Configuration Profiles**, and select **Scope > Targets**. From there, select the devices you want to target. - -![Configuration profile scope screenshot](images/MDATP_18_ConfigurationProfilesScope.png) - -Save the **Configuration Profile**. - -Use the **Logs** tab to monitor deployment status for each enrolled device. - -### Package - -1. Create a package in **Settings > Computer Management > Packages**. - - ![Computer management packages screenshot](images/MDATP_19_MicrosoftDefenderWDAVPKG.png) - -2. Upload the package to the Distribution Point. -3. In the **filename** field, enter the name of the package. For example, _wdav.pkg_. - -### Policy - -Your policy should contain a single package for Microsoft Defender. - -![Microsoft Defender packages screenshot](images/MDATP_20_MicrosoftDefenderPackages.png) - -Configure the appropriate scope to specify the computers that will receive this policy. - -After you save the Configuration Profile, you can use the Logs tab to monitor the deployment status for each enrolled device. - -## Client device setup - -You'll need no special provisioning for a macOS computer, beyond the standard JAMF Enrollment. - -> [!NOTE] -> After a computer is enrolled, it will show up in the Computers inventory (All Computers). - -1. Open **Device Profiles**, from the **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's currently set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile. - -![MDM approve button screenshot](images/MDATP_21_MDMProfile1.png) -![MDM screenshot](images/MDATP_22_MDMProfileApproved.png) - -After a moment, the device's User Approved MDM status will change to **Yes**. - -![MDM status screenshot](images/MDATP_23_MDMStatus.png) - -You may now enroll additional devices. You may also enroll them later, after you have finished provisioning system configuration and application packages. - -## Deployment - -Enrolled client devices periodically poll the JAMF Server, and install new configuration profiles and policies as soon as they are detected. - -### Status on the server - -You can monitor deployment status in the **Logs** tab: - -- **Pending** means that the deployment is scheduled but has not yet happened -- **Completed** means that the deployment succeeded and is no longer scheduled - -![Status on server screenshot](images/MDATP_24_StatusOnServer.png) - -### Status on client device - -After the Configuration Profile is deployed, you'll see the profile for the device in **System Preferences** > **Profiles >**. - -![Status on client screenshot](images/MDATP_25_StatusOnClient.png) - -Once the policy is applied, you'll see the Microsoft Defender ATP icon in the macOS status bar in the top-right corner. - -![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) - -You can monitor policy installation on a device by following the JAMF log file: - -```bash - $ tail -f /var/log/jamf.log - Thu Feb 21 11:11:41 mavel-mojave jamf[7960]: No patch policies were found. - Thu Feb 21 11:16:41 mavel-mojave jamf[8051]: Checking for policies triggered by "recurring check-in" for user "testuser"... - Thu Feb 21 11:16:43 mavel-mojave jamf[8051]: Executing Policy WDAV - Thu Feb 21 11:17:02 mavel-mojave jamf[8051]: Installing Microsoft Defender... - Thu Feb 21 11:17:23 mavel-mojave jamf[8051]: Successfully installed Microsoft Defender. - Thu Feb 21 11:17:23 mavel-mojave jamf[8051]: Checking for patches... - Thu Feb 21 11:17:23 mavel-mojave jamf[8051]: No patch policies were found. -``` - -You can also check the onboarding status: - -```bash -$ mdatp --health -... -licensed : true -orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" -... -``` - -- **licensed**: This confirms that the device has an ATP license. - -- **orgid**: Your Microsoft Defender ATP org id; it will be the same for your organization. - -## Check onboarding status - -You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status: - -```bash -$ mdatp --health healthy -``` - -The above command prints "1" if the product is onboarded and functioning as expected. - -If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: -- 1 if the device is not yet onboarded -- 3 if the connection to the daemon cannot be established—for example, if the daemon is not running - -## Logging installation issues - -See [Logging installation issues](microsoft-defender-atp-mac-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. - -## Uninstallation - -This method is based on the script described in [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling). - -### Script - -Create a script in **Settings > Computer Management > Scripts**. - -This script removes Microsoft Defender ATP from the /Applications directory: - -```bash - #!/bin/bash - - echo "Is WDAV installed?" - ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null - - echo "Uninstalling WDAV..." - rm -rf '/Applications/Microsoft Defender ATP.app' - - echo "Is WDAV still installed?" - ls -ld '/Applications/Microsoft Defender ATP.app' 2>/dev/null - - echo "Done!" -``` - -![Microsoft Defender uninstall screenshot](images/MDATP_26_Uninstall.png) - -### Policy - -Your policy should contain a single script: - -![Microsoft Defender uninstall script screenshot](images/MDATP_27_UninstallScript.png) - -Configure the appropriate scope in the **Scope** tab to specify the machines that will receive this policy. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md deleted file mode 100644 index 91a5f56395..0000000000 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-other-configtool.md +++ /dev/null @@ -1,79 +0,0 @@ ---- -title: Installing Microsoft Defender ATP for Mac with different MDM product -description: Describes how to install Microsoft Defender ATP for Mac on other management solutions. -keywords: microsoft, defender, atp, mac, installation, deploy, macos, mojave, high sierra, sierra -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: mavel -author: maximvelichko -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual ---- - -# Deployment with a different Mobile Device Management (MDM) system - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) - -## Prerequisites and system requirements - -Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version. - -## Approach - -> [!CAUTION] -> Currently, Microsoft oficially supports only Intune and JAMF for the deployment and management of Microsoft Defender ATP for Mac. Microsoft makes no warranties, express or implied, with respect to the information provided below. - -If your organization uses a Mobile Device Management (MDM) solution that is not officially supported, this does not mean you are unable to deploy or run Microsoft Defender ATP for Mac. - -Microsoft Defender ATP for Mac does not depend on any vendor-specific features. It can be used with any MDM solution that supports the following features: - -- Deploy a macOS .pkg to managed machines. -- Deploy macOS system configuration profiles to managed machines. -- Run an arbitrary admin-configured tool/script on managed machines. - -Most modern MDM solutions include these features, however, they may call them differently. - -You can deploy Defender without the last requirement from the preceding list, however: - -- You will not be able to collect status in a centralized way -- If you decide to uninstall Defender, you will need to logon to the client machine locally as an administrator - -## Deployment - -Most MDM solutions use the same model for managing macOS machines, with similar terminology. Use [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) as a template. - -### Package - -Configure deployment of a [required application package](microsoft-defender-atp-mac-install-with-jamf.md#package), -with the installation package (wdav.pkg) downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages). - -In order to deploy the package to your enterprise, use the instructions associated with your MDM solution. - -### License settings - -Set up [a system configuration profile](microsoft-defender-atp-mac-install-with-jamf.md#configuration-profile). -Your MDM solution may call it something like "Custom Settings Profile", as Microsoft Defender ATP for Mac is not part of macOS. - -Use the property list, jamf/WindowsDefenderATPOnboarding.plist, which can be extracted from an onboarding package downloaded from [Microsoft Defender Security Center](microsoft-defender-atp-mac-install-with-jamf.md#download-installation-and-onboarding-packages). -Your system may support an arbitrary property list in XML format. You can upload the jamf/WindowsDefenderATPOnboarding.plist file as-is in that case. -Alternatively, it may require you to convert the property list to a different format first. - -Typically, your custom profile has an id, name, or domain attribute. You must use exactly "com.microsoft.wdav.atp" for this value. -MDM uses it to deploy the settings file to **/Library/Managed Preferences/com.microsoft.wdav.atp.plist** on a client machine, and Defender uses this file for loading the onboarding information. - -### Kernel extension policy - -Set up a KEXT or kernel extension policy. Use team identifier **UBF8T346G9** to whitelist kernel extensions provided by Microsoft. - -## Check installation status - -Run [mdatp](microsoft-defender-atp-mac-install-with-jamf.md#check-onboarding-status) on a client machine to check the onboarding status. From 5ef0b32d156c39535f7c22b1134691600612cba7 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 22 Oct 2019 18:19:00 +0530 Subject: [PATCH 26/69] Updated pua handling and updates Updated pua handling and updates --- ...-defender-atp-linux-install-with-puppet.md | 2 +- .../microsoft-defender-atp-linux-pua.md | 21 +- .../microsoft-defender-atp-linux-updates.md | 202 ++---------------- 3 files changed, 25 insertions(+), 200 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md index 9cd981bd65..63a75eb001 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md @@ -46,7 +46,7 @@ Download the onboarding package from Windows Defender Security Center: 2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**. 3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. - ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_page.png) + ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_win_intune.png) 4. From a command prompt, verify that you have the file. Extract the contents of the .zip file and create mdatp_onboard.json file as follows diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md index 2696590c99..2ff866b692 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md @@ -1,8 +1,8 @@ --- title: Detect and block potentially unwanted applications ms.reviewer: -description: Describes how to detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Mac. -keywords: microsoft, defender, atp, mac, pua, pus +description: Describes how to detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Linux. +keywords: microsoft, defender, atp, linux, pua, pus search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -22,9 +22,9 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -The potentially unwanted application (PUA) protection feature in Microsoft Defender ATP for Mac can detect and block PUA files on endpoints in your network. +The potentially unwanted application (PUA) protection feature in Microsoft Defender ATP for Linux can detect and block PUA files on endpoints in your network. These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have poor reputation. @@ -32,13 +32,16 @@ These applications can increase the risk of your network being infected with mal ## How it works -Microsoft Defender ATP for Mac can detect and report PUA files. When configured in blocking mode, PUA files are moved to the quarantine. +Microsoft Defender ATP for Linux can detect and report PUA files. When configured in blocking mode, PUA files are moved to the quarantine. -When a PUA is detected on an endpoint, Microsoft Defender ATP for Mac presents a notification to the user, unless notifications have been disabled. The threat name will contain the word "Application". +When a PUA is detected on an endpoint, Microsoft Defender ATP for Linux presents a notification to the user, unless notifications have been disabled. The threat name will contain the word "Application". + +> [!NOTE] +> **TODO:** Reword for Linux ## Configure PUA protection -PUA protection in Microsoft Defender ATP for Mac can be configured in one of the following ways: +PUA protection in Microsoft Defender ATP for Linux can be configured in one of the following ways: - **Off**: PUA protection is disabled. - **Audit**: PUA files are reported in the product logs, but not in Microsoft Defender Security Center. No notification is presented to the user and no action is taken by the product. @@ -59,8 +62,8 @@ $ mdatp --threat --type-handling potentially_unwanted_application [off|audit|blo ### Use the management console to configure PUA protection: -In your enterprise, you can configure PUA protection from a management console, such as JAMF or Intune, similarly to how other product settings are configured. For more information, see the [Threat type settings](microsoft-defender-atp-mac-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) topic. +In your enterprise, you can configure PUA protection from a management console, such as Puppet, similarly to how other product settings are configured. For more information, see the [Threat type settings](microsoft-defender-atp-linux-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md) topic. ## Related topics -- [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) \ No newline at end of file +- [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md index 50267f26bb..a75a02fd2d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md @@ -1,8 +1,8 @@ --- -title: Deploy updates for Microsoft Defender ATP for Mac +title: Deploy updates for Microsoft Defender ATP for Linux ms.reviewer: -description: Describes how to control updates for Microsoft Defender ATP for Mac in enterprise environments. -keywords: microsoft, defender, atp, mac, updates, deploy +description: Describes how to control updates for Microsoft Defender ATP for Linux in enterprise environments. +keywords: microsoft, defender, atp, linux, updates, deploy search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -18,202 +18,24 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Deploy updates for Microsoft Defender ATP for Mac +# Deploy updates for Microsoft Defender ATP for Linux **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. -To update Microsoft Defender ATP for Mac, a program named Microsoft AutoUpdate (MAU) is used. By default, MAU automatically checks for updates daily, but you can change that to weekly, monthly, or manually. +To update Microsoft Defender ATP for Linux manually, execute command -![MAU screenshot](images/MDATP_34_MAU.png) +- ### For Debian family distros -If you decide to deploy updates by using your software distribution tools, you should configure MAU to manually check for software updates. You can deploy preferences to configure how and when MAU checks for updates for the Macs in your organization. - -## Use msupdate - -MAU includes a command-line tool, called *msupdate*, that is designed for IT administrators so that they have more precise control over when updates are applied. Instructions for how to use this tool can be found in [Update Office for Mac by using msupdate](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate). - -In MAU, the application identifier for Microsoft Defender ATP for Mac is *WDAV00*. To download and install the latest updates for Microsoft Defender ATP for Mac, execute the following command from a Terminal window: - -``` -./msupdate --install --apps wdav00 +```bash +sudo apt-get install --only-upgrade mdatp ``` -## Set preferences for Microsoft AutoUpdate +- ### For Redhat family distros -This section describes the most common preferences that can be used to configure MAU. These settings can be deployed as a configuration profile through the management console that your enterprise is using. An example of a configuration profile is shown in the following sections. - -### Set the channel name - -The channel determines the type and frequency of updates that are offered through MAU. Devices in `InsiderFast` (corresponding to the Insider Fast channel) can try out new features before devices in `External` (corresponding to the Insider Slow channel) and `Production`. - -The `Production` channel contains the most stable version of the product. - ->[!TIP] ->In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to `InsiderFast` or `External`. - -||| -|:---|:---| -| **Domain** | com.microsoft.autoupdate2 | -| **Key** | ChannelName | -| **Data type** | String | -| **Possible values** | InsiderFast
External
Production | - -### Set update check frequency - -Change how often MAU searches for updates. - -||| -|:---|:---| -| **Domain** | com.microsoft.autoupdate2 | -| **Key** | UpdateCheckFrequency | -| **Data type** | Integer | -| **Default value** | 720 (minutes) | -| **Comment** | This value is set in minutes. | - -### Change how MAU interacts with updates - -Change how MAU searches for updates. - -||| -|:---|:---| -| **Domain** | com.microsoft.autoupdate2 | -| **Key** | HowToCheck | -| **Data type** | String | -| **Possible values** | Manual
AutomaticCheck
AutomaticDownload | -| **Comment** | Note that AutomaticDownload will do a download and install silently if possible. | - -### Change whether the "Check for Updates" button is enabled - -Change whether local users will be able to click the "Check for Updates" option in the Microsoft AutoUpdate user interface. - -||| -|:---|:---| -| **Domain** | com.microsoft.autoupdate2 | -| **Key** | EnableCheckForUpdatesButton | -| **Data type** | Boolean | -| **Possible values** | True (default)
False | - -### Disable Insider checkbox - -Set to true to make the "Join the Office Insider Program..." checkbox unavailable / greyed out to users. - -||| -|:---|:---| -| **Domain** | com.microsoft.autoupdate2 | -| **Key** | DisableInsiderCheckbox | -| **Data type** | Boolean | -| **Possible values** | False (default)
True | - -### Limit the telemetry that is sent from MAU - -Set to false to send minimal heartbeat data, no application usage, and no environment details. - -||| -|:---|:---| -| **Domain** | com.microsoft.autoupdate2 | -| **Key** | SendAllTelemetryEnabled | -| **Data type** | Boolean | -| **Possible values** | True (default)
False | - -## Example configuration profile - -The following configuration profile is used to: -- Place the device in the Insider Fast channel -- Automatically download and install updates -- Enable the "Check for updates" button in the user interface -- Allow users on the device to enroll into the Insider channels - -### JAMF - -```XML - - - - - ChannelName - InsiderFast - HowToCheck - AutomaticDownload - EnableCheckForUpdatesButton - - DisableInsiderCheckbox - - SendAllTelemetryEnabled - - - +```bash +sudo yum update mdatp ``` - -### Intune - -```XML - - - - - PayloadUUID - B762FF60-6ACB-4A72-9E72-459D00C936F3 - PayloadType - Configuration - PayloadOrganization - Microsoft - PayloadIdentifier - com.microsoft.autoupdate2 - PayloadDisplayName - Microsoft AutoUpdate settings - PayloadDescription - Microsoft AutoUpdate configuration settings - PayloadVersion - 1 - PayloadEnabled - - PayloadRemovalDisallowed - - PayloadScope - System - PayloadContent - - - PayloadUUID - 5A6F350A-CC2C-440B-A074-68E3F34EBAE9 - PayloadType - com.microsoft.autoupdate2 - PayloadOrganization - Microsoft - PayloadIdentifier - com.microsoft.autoupdate2 - PayloadDisplayName - Microsoft AutoUpdate configuration settings - PayloadDescription - - PayloadVersion - 1 - PayloadEnabled - - ChannelName - InsiderFast - HowToCheck - AutomaticDownload - EnableCheckForUpdatesButton - - DisableInsiderCheckbox - - SendAllTelemetryEnabled - - - - - -``` - -To configure MAU, you can deploy this configuration profile from the management tool that your enterprise is using: -- From JAMF, upload this configuration profile and set the Preference Domain to *com.microsoft.autoupdate2*. -- From Intune, upload this configuration profile and set the custom configuration profile name to *com.microsoft.autoupdate2*. - -## Resources - -- [msupdate reference](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate) \ No newline at end of file From a56d487cdfd4e3d0a7e92136ac1d8ba15f6fec1f Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 22 Oct 2019 18:36:52 +0530 Subject: [PATCH 27/69] Update linux resources and preferences document Update linux resources and preferences document --- .../microsoft-defender-atp-linux-preferences.md | 2 +- .../microsoft-defender-atp-linux-resources.md | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md index c203ebd24c..9a8245fa7f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md @@ -331,4 +331,4 @@ The following configuration profile contains entries for all settings described ## Configuration profile deployment -Once you've built the configuration profile for your enterprise, you can deploy it through the management tool that your enterprise is using. +Once you've built the configuration profile for your enterprise, you can deploy it through the management tool that your enterprise is using. Microsoft M reads the managed configuration from the file */etc/opt/microsoft/mdatp/managed/mdatp_managed.json* diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md index 2f67653ec0..dffd8f9839 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md @@ -1,8 +1,8 @@ --- -title: Microsoft Defender ATP for Mac Resources +title: Microsoft Defender ATP for Linux Resources ms.reviewer: -description: Describes resources for Microsoft Defender ATP for Mac, including how to uninstall it, how to collect diagnostic logs, CLI commands, and known issues with the product. -keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, mojave, high sierra, sierra +description: Describes resources for Microsoft Defender ATP for Linux, including how to uninstall it, how to collect diagnostic logs, CLI commands, and known issues with the product. +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -22,7 +22,7 @@ ms.topic: conceptual **Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) ## Collecting diagnostic information @@ -64,7 +64,7 @@ The detailed log will be saved to /Library/Logs/Microsoft/mdatp/install.log. If ## Uninstalling -There are several ways to uninstall Microsoft Defender ATP for Mac. Please note that while centrally managed uninstall is available on JAMF, it is not yet available for Microsoft Intune. +There are several ways to uninstall Microsoft Defender ATP for Linux. Please note that while centrally managed uninstall is available on JAMF, it is not yet available for Microsoft Intune. ### Interactive uninstallation From fd1ef148b145f0ceda134e88c769838ebf2a92ac Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 22 Oct 2019 18:42:53 +0530 Subject: [PATCH 28/69] Minor fixes Minor fixes --- .../microsoft-defender-atp-linux-install-with-puppet.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md index 63a75eb001..2977bcf490 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md @@ -28,7 +28,6 @@ This topic describes how to deploy Microsoft Defender ATP for Linux through Pupp - [Download installation and onboarding packages](#download-onboarding-package) - [Create Puppet manifest](#create-puppet-manifest) -- [Client device setup](#client-device-setup) - [Deployment](#deployment) - [Check onboarding status](#check-onboarding-status) From 67fb15b1efcec65252a61acd6e4b4db59dac307c Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Thu, 24 Oct 2019 12:36:47 +0530 Subject: [PATCH 29/69] Incorporated review comments. --- ...oft-defender-atp-linux-install-manually.md | 53 +++++++++---------- ...-defender-atp-linux-install-with-puppet.md | 14 ++--- ...icrosoft-defender-atp-linux-preferences.md | 25 +-------- .../microsoft-defender-atp-linux-resources.md | 13 ++--- .../microsoft-defender-atp-linux.md | 17 +----- 5 files changed, 42 insertions(+), 80 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md index 7116f0b7ef..7e214e9a60 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md @@ -39,30 +39,24 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic Follow the steps given in [Configure Microsoft's Linux Software Repository](https://docs.microsoft.com/en-us/windows-server/administration/linux-package-repository-for-microsoft-software) to setup the repository. -> [!NOTE] -> * **TODO:** Use a forward link for above instead of URL -> * I am assuming that ring 0 customers will download the onboarding package from ATP portal - ## Download onboarding package -Download the onboarding package from Windows Defender Security Center: +Download the onboarding package from Microsoft Defender Security Center: -1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**. -3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. +1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. +2. In the first drop down, set operating system to **Windows 10** and in second drop down, Deployment method to **Mobile Device Management / Microsoft Intune**. +3. Click on **Download package**. Save it as WindowsDefenderATPOnboardingPackage.zip. - ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_page.png) + ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_win_intune.png) 4. From a command prompt, verify that you have the file. - Extract the contents of the .zip file: + Extract the contents of the .zip file and create mdatp_onboard.json file as follows: ```bash $ ls -l total 8 -rw-r--r-- 1 test staff 6287 Oct 21 11:22 WindowsDefenderATPOnboardingPackage.zip - $ unzip WindowsDefenderATPOnboardingPackage.zip - Archive: WindowsDefenderATPOnboardingPackage.zip - inflating: WindowsDefenderATPOnboarding.py + $ unzip -p WindowsDefenderATPOnboardingPackage.zip | python -c 'import sys,json;data={"onboardingInfo":"\n".join(sys.stdin.readlines())};print(json.dumps(data));' >mdatp_onboard.json ``` ## Application installation @@ -74,13 +68,13 @@ To complete this process, you must have admin privileges on the machine. - ### Enterprise Linux (RHEL and variants) ```bash - sudo yum install mdatp + sudo yum -y install mdatp ``` - ### Ubuntu and Debian systems ```bash - sudo apt-get install mdatp + sudo apt-get -y install mdatp ``` @@ -94,14 +88,11 @@ To complete this process, you must have admin privileges on the machine. $ mdatp --health orgId ``` -2. Run the Python script to install the configuration file: +2. Copy the mdatp_onboard.json created in earlier step to /etc/opt/microsoft/mdatp_onboard.json ```bash - $ /usr/bin/python WindowsDefenderATPOnboarding.py - Generating /etc/opt/microsoft/mdatp/mdatp_onboard.json ... (You may be required to enter sudo password) + $ sudo cp mdatp.json /etc/opt/microsoft/mdatp/mdatp_onboard.json ``` -> [!NOTE] -> **TODO:** verify the path associated with above command. 3. Verify that the machine is now associated with your organization and reports a valid *orgId*: @@ -110,15 +101,23 @@ To complete this process, you must have admin privileges on the machine. E6875323-A6C0-4C60-87AD-114BBE7439B8 ``` -After installation, you can see the status by running the following command: +4. After installation, you can see the status by running the following command: -```bash -$ mdatp --health healthy -1 -``` + ```bash + $ mdatp --health healthy + 1 + ``` -> [!NOTE] -> **TODO:** Should we add eicar detection step? +5. Run a detection test +To verify that the machine is properly onboarded and reporting to the service, take the following steps on the newly onboarded machine: + + - Ensure Real-time protection setting is ON ```mdatp --health realTimeProtectionEnabled``` + - Open a Terminal window +Copy and run the command below: + + ``` bash + curl -o ~/Downloads/eicar.com.txt http://www.eicar.org/download/eicar.com.txt + ``` ## Logging installation issues diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md index 2977bcf490..3731d54b7c 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md @@ -35,20 +35,20 @@ This topic describes how to deploy Microsoft Defender ATP for Linux through Pupp Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. -In addition, for Puppet deployment, you need to be familiar with Puppet administration tasks, have a Puppet configured, and know how to deploy packages. Puppet has many ways to complete the same task. These instructions assume availability of supported puppet modules such as *apt*, *lsb-release* to help deploy the package. Your organization might use a different workflow. +In addition, for Puppet deployment, you need to be familiar with Puppet administration tasks, have a Puppet configured, and know how to deploy packages. Puppet has many ways to complete the same task. These instructions assume availability of supported puppet modules such as *apt* to help deploy the package. Your organization might use a different workflow. Please refer to [Puppet documentation](https://puppet.com/docs) for details. ## Download onboarding package -Download the onboarding package from Windows Defender Security Center: +Download the onboarding package from Microsoft Defender Security Center: -1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**. -3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. +1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. +2. In the first drop down, set operating system to **Windows 10** and in second drop down, Deployment method to **Mobile Device Management / Microsoft Intune**. +3. Click on **Download package**. Save it as WindowsDefenderATPOnboardingPackage.zip. ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_win_intune.png) 4. From a command prompt, verify that you have the file. - Extract the contents of the .zip file and create mdatp_onboard.json file as follows + Extract the contents of the .zip file and create mdatp_onboard.json file as follows: ```bash $ ls -l @@ -61,7 +61,7 @@ Download the onboarding package from Windows Defender Security Center: You need to create a puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by puppet server. This example makes use of *apt* module available from puppetlabs and assumes that apt module has been installed on your puppet server. -Create a folders *install_mdatp/files* and *install_mdatp/manifests* under the modules folder of your puppet installation. This typically is located in */etc/puppetlabs/code/environments/production/modules* on your puppet server. Copy the mdatp.json file created in above step to *install_mdatp/files* folder. Create *init.pp* file which will contain the deployment instructions. +Create a folders *install_mdatp/files* and *install_mdatp/manifests* under the modules folder of your puppet installation. This typically is located in */etc/puppetlabs/code/environments/production/modules* on your puppet server. Copy the mdatp_onboard.json file created in above step to *install_mdatp/files* folder. Create *init.pp* file which will contain the deployment instructions. ```bash $ pwd diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md index 9a8245fa7f..eb249f3fe3 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md @@ -35,13 +35,9 @@ This topic describes the structure of this profile (including a recommended prof The configuration profile is a .json file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can either be simple (such as a numerical value) or complex, such as a nested list of preferences. -The top level of the configuration profile includes product-wide preferences and entries for subareas of the product, which are explained in more detail in the next sections. +Typically, you would use a configuration management tool to push a file with name ```mdatp_maanged.json``` at location ```/etc/opt/microsoft/mdatp/managed/``` ->[!NOTE] -> **TODO:** -> * Should Domain be removed from all the entries below? -> * Should we add path to wdavcfg? -> * Verify each of below? +The top level of the configuration profile includes product-wide preferences and entries for subareas of the product, which are explained in more detail in the next sections. ### Antivirus engine preferences @@ -49,7 +45,6 @@ The *antivirusEngine* section of the configuration profile is used to manage the ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | antivirusEngine | | **Data type** | Dictionary (nested preference) | | **Comments** | See the following sections for a description of the dictionary contents. | @@ -60,7 +55,6 @@ Whether real-time protection (scan files as they are accessed) is enabled or not ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | enableRealTimeProtection | | **Data type** | Boolean | | **Possible values** | true (default)
false | @@ -76,7 +70,6 @@ Whether the antivirus engine runs in passive mode or not. In passive mode: ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | passiveMode | | **Data type** | Boolean | | **Possible values** | false (default)
true | @@ -88,7 +81,6 @@ Entities that have been excluded from the scan. Exclusions can be specified by f ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | exclusions | | **Data type** | Dictionary (nested preference) | | **Comments** | See the following sections for a description of the dictionary contents. | @@ -99,7 +91,6 @@ Specifies the type of content excluded from the scan. ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | $type | | **Data type** | String | | **Possible values** | excludedPath
excludedFileExtension
excludedFileName | @@ -110,7 +101,6 @@ Used to exclude content from the scan by full file path. ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | path | | **Data type** | String | | **Possible values** | valid paths | @@ -122,7 +112,6 @@ Indicates if the *path* property refers to a file or directory. ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | isDirectory | | **Data type** | Boolean | | **Possible values** | false (default)
true | @@ -134,7 +123,6 @@ Used to exclude content from the scan by file extension. ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | extension | | **Data type** | String | | **Possible values** | valid file extensions | @@ -146,7 +134,6 @@ Used to exclude content from the scan by file name. ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | name | | **Data type** | String | | **Possible values** | any string | @@ -158,7 +145,6 @@ List of threats (identified by their name) that are not blocked by the product a ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | allowedThreats | | **Data type** | Array of strings | @@ -168,7 +154,6 @@ The *threatTypeSettings* preference in the antivirus engine is used to control h ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | threatTypeSettings | | **Data type** | Dictionary (nested preference) | | **Comments** | See the following sections for a description of the dictionary contents. | @@ -179,7 +164,6 @@ Type of the threat for which the behavior is configured. ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | key | | **Data type** | String | | **Possible values** | potentially_unwanted_application
archive_bomb | @@ -194,7 +178,6 @@ Action to take when coming across a threat of the type specified in the precedin ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | value | | **Data type** | String | | **Possible values** | audit (default)
block
off | @@ -205,7 +188,6 @@ The *cloudService* entry in the configuration profile is used to configure the c ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | cloudService | | **Data type** | Dictionary (nested preference) | | **Comments** | See the following sections for a description of the dictionary contents. | @@ -216,7 +198,6 @@ Whether cloud delivered protection is enabled on the device or not. To improve t ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | enabled | | **Data type** | Boolean | | **Possible values** | true (default)
false | @@ -227,7 +208,6 @@ Diagnostic data is used to keep Microsoft Defender ATP secure and up-to-date, de ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | diagnosticLevel | | **Data type** | String | | **Possible values** | optional (default)
required | @@ -238,7 +218,6 @@ Determines whether suspicious samples (that are likely to contain threats) are s ||| |:---|:---| -| **Domain** | com.microsoft.wdav | | **Key** | automaticSampleSubmission | | **Data type** | Boolean | | **Possible values** | true (default)
false | diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md index dffd8f9839..295efbedca 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md @@ -60,19 +60,16 @@ If you can reproduce a problem, please increase the logging level, run the syste If an error occurs during installation, the installer will only report a general failure. -The detailed log will be saved to /Library/Logs/Microsoft/mdatp/install.log. If you experience issues during installation, send us this file so we can help diagnose the cause. +The detailed log will be saved to /var/log/microsoft/mdatp_install.log. If you experience issues during installation, send us this file so we can help diagnose the cause. ## Uninstalling -There are several ways to uninstall Microsoft Defender ATP for Linux. Please note that while centrally managed uninstall is available on JAMF, it is not yet available for Microsoft Intune. +There are several ways to uninstall Microsoft Defender ATP for Linux. If you are using a configuration tool such as Puppet, please follow the package uninstallation instructions for the configuration tool. -### Interactive uninstallation +### Manual uninstallation -- Open **Finder > Applications**. Right click on **Microsoft Defender ATP > Move to Trash**. - -### From the command line - -- ```sudo rm -rf '/Applications/Microsoft Defender ATP'``` +- ```sudo apt-get purge mdatp``` for Debian and Ubuntu systems +- ```sudo yum remove mdatp``` for RHEL, Oracle Linux, CentOS based systems ## Configuring from the command line diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index 83c84689a0..fa8fb3cbe0 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -25,12 +25,6 @@ This topic describes how to install, configure, update, and use Microsoft Defend > [!CAUTION] > Running other third-party endpoint protection products alongside Microsoft Defender ATP for Linux is likely to lead to performance problems and unpredictable side effects. -> [!NOTE] ->How would users give us feedback? -> **TODO:** Should we add atp --feedback "Feedback" that will send the feedback to us / OCV. I am keeping the original line for reference. -> -> If you have any feedback that you would like to share, submit it by opening Microsoft Defender ATP for Mac on your device and navigating to **Help** > **Send feedback**. - ## How to install Microsoft Defender ATP for Linux ### Prerequisites @@ -41,14 +35,10 @@ This topic describes how to install, configure, update, and use Microsoft Defend ### System requirements -- Supported Linux distributions and versions: RHEL 7, Oracle 7, CentOS 7, Ubuntu 16 and 18, Debian 9 +- Supported Linux server distributions and versions: RHEL 7, Oracle Linux 7, CentOS 7, Ubuntu 16 and 18, Debian 9 - Disk space: 650 MB. -> [!NOTE] ->**TODO**: Verify this -After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints. - -The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. +If your Linux server is behind firewall or proxy, you will likely need to allow outbound connections between it and following servers. The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. | Service location | DNS record | | ---------------------------------------- | ----------------------- | @@ -57,9 +47,6 @@ The following table lists the services and their associated URLs that your netwo | United Kingdom | unitedkingdom.x.cp.wd.microsoft.com | | United States | unitedstates.x.cp.wd.microsoft.com | ->[!NOTE] -> **TODO:** Verify the proxy paragraph - Microsoft Defender ATP can discover a proxy server by using the following discovery methods: - Web Proxy Auto-discovery Protocol (WPAD) - Manual static proxy configuration From 74c3a863092decb754bfd946f5a0872e6bb63be1 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Thu, 24 Oct 2019 12:38:07 +0530 Subject: [PATCH 30/69] Deleting private and pua handling for now. --- .../microsoft-defender-atp-linux-privacy.md | 273 ------------------ .../microsoft-defender-atp-linux-pua.md | 69 ----- 2 files changed, 342 deletions(-) delete mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md delete mode 100644 windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md deleted file mode 100644 index 0e2884b388..0000000000 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-privacy.md +++ /dev/null @@ -1,273 +0,0 @@ ---- -title: Privacy for Microsoft Defender ATP for Linux -ms.reviewer: -description: Describes privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Linux. -keywords: microsoft, defender, atp, linux, privacy, diagnostic -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dansimp -author: dansimp -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual ---- - -# Privacy for Microsoft Defender ATP for Linux - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) - -Microsoft is committed to providing you with the information and controls you need to make choices about how your data is collected and used when you’re using Microsoft Defender ATP for Linux. - -This topic describes the privacy controls available within the product, how to manage these controls with policy settings and more details on the data events that are collected. - -## Overview of privacy controls in Microsoft Defender ATP for Linux - -This section describes the privacy controls for the different types of data collected by Microsoft Defender ATP for Linux. - -### Diagnostic data - -Diagnostic data is used to keep Microsoft Defender ATP secure and up-to-date, detect, diagnose and fix problems, and also make product improvements. - -Some diagnostic data is required, while some diagnostic data is optional. We give you the ability to choose whether to send us required or optional diagnostic data through the use of privacy controls, such as policy settings for organizations. - -There are two levels of diagnostic data for Microsoft Defender ATP client software that you can choose from: - -* **Required**: The minimum data necessary to help keep Microsoft Defender ATP secure, up-to-date, and performing as expected on the device it’s installed on. - -* **Optional**: Additional data that helps Microsoft make product improvements and provides enhanced information to help detect, diagnose, and remediate issues. - -By default, both optional and required diagnostic data are sent to Microsoft. - -### Cloud delivered protection data - -Cloud delivered protection is used to provide increased and faster protection with access to the latest protection data in the cloud. - -Enabling the cloud-delivered protection service is optional, however it is highly recommended because it provides important protection against malware on your endpoints and across your network. - -### Sample data - -Sample data is used to improve the protection capabilities of the product, by sending Microsoft suspicious samples so they can be analyzed. Enabling automatic sample submission is optional. - -When this feature is enabled and the sample that is collected is likely to contain personal information, the user is prompted for consent. - -## Manage privacy controls with policy settings - -If you're an IT administrator, you might want to configure these controls at the enterprise level. - -The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md). - -As with any new policy settings, you should carefully test them out in a limited, controlled environment to ensure the settings that you configure have the desired effect before you implement the policy settings more widely in your organization. - -## Diagnostic data events - -This section describes what is considered required diagnostic data and what is considered optional diagnostic data, along with a description of the events and fields that are collected. - -### Data fields that are common for all events -There is some information about events that is common to all events, regardless of category or data subtype. - -The following fields are considered common for all events: - -| Field | Description | -| ----------------------- | ----------- | -| platform | The broad classification of the platform on which the app is running. Allows Microsoft to identify on which platforms an issue may be occurring so that it can correctly be prioritized. | -| machine_guid | Unique identifier associated with the device. Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | -| sense_guid | Unique identifier associated with the device. Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | -| org_id | Unique identifier associated with the enterprise that the device belongs to. Allows Microsoft to identify whether issues are impacting a select set of enterprises and how many enterprises are impacted. | -| hostname | Local machine name (without DNS suffix). Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. | -| product_guid | Unique identifier of the product. Allows Microsoft to differentiate issues impacting different flavors of the product. | -| app_version | Version of the Microsoft Defender ATP for Linux application. Allows Microsoft to identify which versions of the product are showing an issue so that it can correctly be prioritized.| -| sig_version | Version of security intelligence database. Allows Microsoft to identify which versions of the security intelligence are showing an issue so that it can correctly be prioritized. | -| supported_compressions | List of compression algorithms supported by the application, for example `['gzip']`. Allows Microsoft to understand what types of compressions can be used when it communicates with the application. | -| release_ring | Ring that the device is associated with (for example Insider Fast, Insider Slow, Production). Allows Microsoft to identify on which release ring an issue may be occurring so that it can correctly be prioritized. | - - -### Required diagnostic data - -**Required diagnostic data** is the minimum data necessary to help keep Microsoft Defender ATP secure, up-to-date, and perform as expected on the device it’s installed on. - -Required diagnostic data helps to identify problems with Microsoft Defender ATP that may be related to a device or software configuration. For example, it can help determine if a Microsoft Defender ATP feature crashes more frequently on a particular operating system version, with newly introduced features, or when certain Microsoft Defender ATP features are disabled. Required diagnostic data helps Microsoft detect, diagnose, and fix these problems more quickly so the impact to users or organizations is reduced. - -#### Software setup and inventory data events - -> [!NOTE] -> **TODO:** Please review if all the following fields are valid for linux as well - -**Microsoft Defender ATP installation / uninstallation** - -The following fields are collected: - -| Field | Description | -| ---------------- | ----------- | -| correlation_id | Unique identifier associated with the installation. | -| version | Version of the package. | -| severity | Severity of the message (for example Informational). | -| code | Code that describes the operation. | -| text | Additional information associated with the product installation. | - -**Microsoft Defender ATP configuration** - -The following fields are collected: - -| Field | Description | -| --------------------------------------------------- | ----------- | -| antivirus_engine.enable_real_time_protection | Whether real-time protection is enabled on the device or not. | -| antivirus_engine.passive_mode | Whether passive mode is enabled on the device or not. | -| cloud_service.enabled | Whether cloud delivered protection is enabled on the device or not. | -| cloud_service.timeout | Time out when the application communicates with the Microsoft Defender ATP cloud. | -| cloud_service.heartbeat_interval | Interval between consecutive heartbeats sent by the product to the cloud. | -| cloud_service.service_uri | URI used to communicate with the cloud. | -| cloud_service.diagnostic_level | Diagnostic level of the device (required, optional). | -| cloud_service.automatic_sample_submission | Whether automatic sample submission is turned on or not. | -| edr.early_preview | Whether the machine should run EDR early preview features. | -| edr.group_id | Group identifier used by the detection and response component. | -| edr.tags | User-defined tags. | -| features.\[optional feature name\] | List of preview features, along with whether they are enabled or not. | - -#### Product and service performance data events - -> [!NOTE] -> **TODO:** Please review if all the following fields are valid for linux as well - -**Kernel extension statistics** - -The following fields are collected: - -| Field | Description | -| ---------------- | ----------- | -| version | Version of Microsoft Defender ATP for Linux. | -| instance_id | Unique identifier generated on kernel extension startup. | -| trace_level | Trace level of the kernel extension. | -| ipc.connects | Number of connection requests received by the kernel extension. | -| ipc.rejects | Number of connection requests rejected by the kernel extension. | -| ipc.connected | Whether there is any active connection to the kernel extension. | - -#### Support data - -**Diagnostic logs** - -Diagnostic logs are collected only with the consent of the user as part of the feedback submission feature. The following files are collected as part of the support logs: - -- All files under */var/log/microsoft/mdatp/* -- Subset of files under */var/opt/microsoft/mdatp/* that are created and used by Microsoft Defender ATP for Linux -- Subset of files under */etc/opt/microsoft/mdatp/* that are used by Microsoft Defender ATP for Linux - -### Optional diagnostic data - -**Optional diagnostic data** is additional data that helps Microsoft make product improvements and provides enhanced information to help detect, diagnose, and fix issues. - -If you choose to send us optional diagnostic data, required diagnostic data is also included. - -Examples of optional diagnostic data include data Microsoft collects about product configuration (for example number of exclusions set on the device) and product performance (aggregate measures about the performance of components of the product). - -#### Software setup and inventory data events - -**Microsoft Defender ATP configuration** - -The following fields are collected: - -| Field | Description | -| -------------------------------------------------- | ----------- | -| connection_retry_timeout | Connection retry time out when communication with the cloud. | -| file_hash_cache_maximum | Size of the product cache. | -| crash_upload_daily_limit | Limit of crash logs uploaded daily. | -| antivirus_engine.exclusions[].is_directory | Whether the exclusion from scanning is a directory or not. | -| antivirus_engine.exclusions[].path | Path that was excluded from scanning. | -| antivirus_engine.exclusions[].extension | Extension excluded from scanning. | -| antivirus_engine.exclusions[].name | Name of the file excluded from scanning. | -| antivirus_engine.scan_cache_maximum | Size of the product cache. | -| antivirus_engine.maximum_scan_threads | Maximum number of threads used for scanning. | -| antivirus_engine.threat_restoration_exclusion_time | Time out before a file restored from the quarantine can be detected again. | -| filesystem_scanner.full_scan_directory | Full scan directory. | -| filesystem_scanner.quick_scan_directories | List of directories used in quick scan. | -| edr.latency_mode | Latency mode used by the detection and response component. | -| edr.proxy_address | Proxy address used by the detection and response component. | - -### Product and service usage - -#### Diagnostic log upload started report - -The following fields are collected: - -| Field | Description | -| ---------------- | ----------- | -| sha256 | SHA256 identifier of the support log. | -| size | Size of the support log. | -| original_path | Path to the support log (always under */var/opt/microsoft/mdatp/wdavdiag/*). | -| format | Format of the support log. | - -#### Diagnostic log upload completed report - -The following fields are collected: - -| Field | Description | -| ---------------- | ----------- | -| request_id | Correlation ID for the support log upload request. | -| sha256 | SHA256 identifier of the support log. | -| blob_sas_uri | URI used by the application to upload the support log. | - -#### Product and service performance data events - -**Unexpected application exit (crash)** - -Unexpected application exits and the state of the application when that happens. - -**Kernel extension statistics** - -> [!NOTE] -> **TODO:** Is this valid for Linux as well? - -The following fields are collected: - -| Field | Description | -| ------------------------------ | ----------- | -| pkt_ack_timeout | The following properties are aggregated numerical values, representing count of events that happened since kernel extension startup. | -| pkt_ack_conn_timeout | | -| ipc.ack_pkts | | -| ipc.nack_pkts | | -| ipc.send.ack_no_conn | | -| ipc.send.nack_no_conn | | -| ipc.send.ack_no_qsq | | -| ipc.send.nack_no_qsq | | -| ipc.ack.no_space | | -| ipc.ack.timeout | | -| ipc.ack.ackd_fast | | -| ipc.ack.ackd | | -| ipc.recv.bad_pkt_len | | -| ipc.recv.bad_reply_len | | -| ipc.recv.no_waiter | | -| ipc.recv.copy_failed | | -| ipc.kauth.vnode.mask | | -| ipc.kauth.vnode.read | | -| ipc.kauth.vnode.write | | -| ipc.kauth.vnode.exec | | -| ipc.kauth.vnode.del | | -| ipc.kauth.vnode.read_attr | | -| ipc.kauth.vnode.write_attr | | -| ipc.kauth.vnode.read_ex_attr | | -| ipc.kauth.vnode.write_ex_attr | | -| ipc.kauth.vnode.read_sec | | -| ipc.kauth.vnode.write_sec | | -| ipc.kauth.vnode.take_own | | -| ipc.kauth.vnode.denied | | -| ipc.kauth.file_op.mask | | -| ipc.kauth_file_op.open | | -| ipc.kauth.file_op.close | | -| ipc.kauth.file_op.close_modified | | -| ipc.kauth.file_op.move | | -| ipc.kauth.file_op.link | | -| ipc.kauth.file_op.exec | | -| ipc.kauth.file_op.remove | | -| ipc.kauth.file_op.fork | | -| ipc.kauth.file_op.create | | - -## Resources - -- [Privacy at Microsoft](https://privacy.microsoft.com/) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md deleted file mode 100644 index 2ff866b692..0000000000 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-pua.md +++ /dev/null @@ -1,69 +0,0 @@ ---- -title: Detect and block potentially unwanted applications -ms.reviewer: -description: Describes how to detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Linux. -keywords: microsoft, defender, atp, linux, pua, pus -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: dansimp -author: dansimp -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: conceptual ---- - -# Detect and block potentially unwanted applications - -**Applies to:** - -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) - -The potentially unwanted application (PUA) protection feature in Microsoft Defender ATP for Linux can detect and block PUA files on endpoints in your network. - -These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have poor reputation. - -These applications can increase the risk of your network being infected with malware, cause malware infections to be harder to identify, and can waste IT resources in cleaning up the applications. - -## How it works - -Microsoft Defender ATP for Linux can detect and report PUA files. When configured in blocking mode, PUA files are moved to the quarantine. - -When a PUA is detected on an endpoint, Microsoft Defender ATP for Linux presents a notification to the user, unless notifications have been disabled. The threat name will contain the word "Application". - -> [!NOTE] -> **TODO:** Reword for Linux - -## Configure PUA protection - -PUA protection in Microsoft Defender ATP for Linux can be configured in one of the following ways: - -- **Off**: PUA protection is disabled. -- **Audit**: PUA files are reported in the product logs, but not in Microsoft Defender Security Center. No notification is presented to the user and no action is taken by the product. -- **Block**: PUA files are reported in the product logs and in Microsoft Defender Security Center. The user is presented with a notification and action is taken by the product. - ->[!WARNING] ->By default, PUA protection is configured in **Audit** mode. - -You can configure how PUA files are handled from the command line or from the management console. - -### Use the command-line tool to configure PUA protection: - -In Terminal, execute the following command to configure PUA protection: - -```bash -$ mdatp --threat --type-handling potentially_unwanted_application [off|audit|block] -``` - -### Use the management console to configure PUA protection: - -In your enterprise, you can configure PUA protection from a management console, such as Puppet, similarly to how other product settings are configured. For more information, see the [Threat type settings](microsoft-defender-atp-linux-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md) topic. - -## Related topics - -- [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md) From f7224e378aee6cd43ce25fe07c2e956d66aa53bc Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Thu, 24 Oct 2019 17:33:25 +0530 Subject: [PATCH 31/69] added mdatp --connectivity-test --- .../microsoft-defender-atp-linux.md | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index fa8fb3cbe0..1d5f12dde9 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -63,10 +63,22 @@ $ curl -w ' %{url_effective}\n' 'https://x.cp.wd.microsoft.com/api/report' 'http The output from this command should be similar to the following: -> `OK https://x.cp.wd.microsoft.com/api/report` -> +> `OK https://x.cp.wd.microsoft.com/api/report` > `OK https://cdn.x.cp.wd.microsoft.com/ping` +You can also use ```mdatp --connectivity-test``` to verify the connectivity. + +```bash +$ mdatp --connectivity-test +Running connectivity test +Testing connection with https://cdn.x.cp.wd.microsoft.com/ping ... [OK] +Testing connection with https://eu-cdn.x.cp.wd.microsoft.com/ping ... [OK] +Testing connection with https://wu-cdn.x.cp.wd.microsoft.com/ping ... [OK] +Testing connection with https://unitedstates.x.cp.wd.microsoft.com/api/report ... [OK] +Testing connection with https://ussus1eastprod.blob.core.windows.net ... [OK] +Testing connection with https://ussus1westprod.blob.core.windows.net ... [OK] +``` + ### Installation instructions There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Linux. @@ -84,8 +96,6 @@ In general you need to take the following steps: ## How to update Microsoft Defender ATP for Linux ->[!NOTE] -> **TODO:** Upgrade story is not very clear right now! Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Linux, refer to [Deploy updates for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-updates.md) From 857ae9d75374ccf78d75b3c90751631221ebc0ba Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Wed, 30 Oct 2019 16:13:21 +0530 Subject: [PATCH 32/69] Added section on known issues to overview page Added section on known issues to overview page --- .../microsoft-defender-atp-linux.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index 1d5f12dde9..c360a259ba 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -103,6 +103,13 @@ Microsoft regularly publishes software updates to improve performance, security, Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md). +## Known Issues + +- Logged on users do not appear in the ATP portal +- Quarantining a threat requires elevated permissions. Run with ```sudo mdatp --threat --quarantine ``` +- Product has not been evaluated yet side by side with SELinux + + ## Resources - For more information about logging, uninstalling, or other topics, see the [Resources](microsoft-defender-atp-linux-resources.md) page. From 237a4b660327eaa30f3d7048a31e3b8601e414ce Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Fri, 15 Nov 2019 13:38:53 -0800 Subject: [PATCH 33/69] Update supported distros --- .../microsoft-defender-atp-linux.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index c360a259ba..e582b3ace6 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -35,7 +35,14 @@ This topic describes how to install, configure, update, and use Microsoft Defend ### System requirements -- Supported Linux server distributions and versions: RHEL 7, Oracle Linux 7, CentOS 7, Ubuntu 16 and 18, Debian 9 +- Supported Linux server distributions and versions: + + - Red Hat Enterprise Linux 7 or higher + - CentOS 7 or higher + - Ubuntu 16.04 LTS or higher + - Debian 9 or higher + - SUSE Linux Enterprise Server 12 or higher + - Disk space: 650 MB. If your Linux server is behind firewall or proxy, you will likely need to allow outbound connections between it and following servers. The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. @@ -48,7 +55,7 @@ If your Linux server is behind firewall or proxy, you will likely need to allow | United States | unitedstates.x.cp.wd.microsoft.com | Microsoft Defender ATP can discover a proxy server by using the following discovery methods: -- Web Proxy Auto-discovery Protocol (WPAD) +- Transparent proxy - Manual static proxy configuration If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs. @@ -96,7 +103,6 @@ In general you need to take the following steps: ## How to update Microsoft Defender ATP for Linux - Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Linux, refer to [Deploy updates for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-updates.md) ## How to configure Microsoft Defender ATP for Linux From 2d9edf16d90f55c4a476d40d09fe75ce0e6038ea Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Fri, 15 Nov 2019 13:52:59 -0800 Subject: [PATCH 34/69] Clarify ubuntu --- .../windows-defender-antivirus/microsoft-defender-atp-linux.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md index e582b3ace6..ae7104ff7f 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md @@ -39,7 +39,7 @@ This topic describes how to install, configure, update, and use Microsoft Defend - Red Hat Enterprise Linux 7 or higher - CentOS 7 or higher - - Ubuntu 16.04 LTS or higher + - Ubuntu 16.04 LTS or higher LTS - Debian 9 or higher - SUSE Linux Enterprise Server 12 or higher From 2fce4593c40a56fd9fcee884cc60ddf5af02ec45 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 17 Feb 2020 13:43:21 +0530 Subject: [PATCH 35/69] Renamed+Moved files as per new directory structure Moved the files under microsoft-defender-atp and renamed them to linux-*.md as was done for mac. --- .../images/atp-portal-onboarding-win-intune.png} | Bin .../linux-install-manually.md} | 0 .../linux-install-with-puppet.md} | 0 .../linux-preferences.md} | 0 .../linux-resources.md} | 0 .../linux-updates.md} | 0 .../microsoft-defender-atp-linux.md | 0 7 files changed, 0 insertions(+), 0 deletions(-) rename windows/security/threat-protection/{windows-defender-antivirus/images/ATP_Portal_Onboarding_win_intune.png => microsoft-defender-atp/images/atp-portal-onboarding-win-intune.png} (100%) rename windows/security/threat-protection/{windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md => microsoft-defender-atp/linux-install-manually.md} (100%) rename windows/security/threat-protection/{windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md => microsoft-defender-atp/linux-install-with-puppet.md} (100%) rename windows/security/threat-protection/{windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md => microsoft-defender-atp/linux-preferences.md} (100%) rename windows/security/threat-protection/{windows-defender-antivirus/microsoft-defender-atp-linux-resources.md => microsoft-defender-atp/linux-resources.md} (100%) rename windows/security/threat-protection/{windows-defender-antivirus/microsoft-defender-atp-linux-updates.md => microsoft-defender-atp/linux-updates.md} (100%) rename windows/security/threat-protection/{windows-defender-antivirus => microsoft-defender-atp}/microsoft-defender-atp-linux.md (100%) diff --git a/windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_win_intune.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-portal-onboarding-win-intune.png similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/images/ATP_Portal_Onboarding_win_intune.png rename to windows/security/threat-protection/microsoft-defender-atp/images/atp-portal-onboarding-win-intune.png diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-manually.md rename to windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-install-with-puppet.md rename to windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-preferences.md rename to windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-resources.md rename to windows/security/threat-protection/microsoft-defender-atp/linux-resources.md diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md b/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux-updates.md rename to windows/security/threat-protection/microsoft-defender-atp/linux-updates.md diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md similarity index 100% rename from windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-linux.md rename to windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md From 05bb4d335e944ba3b59ad0a083f7ab8a1f4231ec Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 17 Feb 2020 19:06:56 +0530 Subject: [PATCH 36/69] Fixed links after re-structuring files Fixed links after re-structuring files --- .../linux-install-manually.md | 6 +- .../linux-install-with-puppet.md | 4 +- .../linux-preferences.md | 2 +- .../microsoft-defender-atp-linux.md | 67 +++++++++++-------- 4 files changed, 46 insertions(+), 33 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 7e214e9a60..38b84b9fe2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -37,7 +37,7 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic ## Configure Microsoft's Linux Software Repository -Follow the steps given in [Configure Microsoft's Linux Software Repository](https://docs.microsoft.com/en-us/windows-server/administration/linux-package-repository-for-microsoft-software) to setup the repository. +Follow the steps given in [Configure Microsoft's Linux Software Repository](https://docs.microsoft.com/windows-server/administration/linux-package-repository-for-microsoft-software) to setup the repository. ## Download onboarding package @@ -121,8 +121,8 @@ Copy and run the command below: ## Logging installation issues -See [Logging installation issues](microsoft-defender-atp-linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. +See [Logging installation issues](linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## Uninstallation -See [Uninstalling](microsoft-defender-atp-linux-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Linux from client devices. +See [Uninstalling](linux-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Linux from client devices. diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md index 3731d54b7c..a61a09e1e3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md @@ -45,7 +45,7 @@ Download the onboarding package from Microsoft Defender Security Center: 2. In the first drop down, set operating system to **Windows 10** and in second drop down, Deployment method to **Mobile Device Management / Microsoft Intune**. 3. Click on **Download package**. Save it as WindowsDefenderATPOnboardingPackage.zip. - ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_win_intune.png) + ![Windows Defender Security Center screenshot](images/atp-portal-onboarding-win-intune.png) 4. From a command prompt, verify that you have the file. Extract the contents of the .zip file and create mdatp_onboard.json file as follows: @@ -160,7 +160,7 @@ If the product is not healthy, the exit code (which can be checked through `echo ## Logging installation issues -See [Logging installation issues](microsoft-defender-atp-linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. +See [Logging installation issues](linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## Uninstallation diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md index eb249f3fe3..d1a41ccd3c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md @@ -25,7 +25,7 @@ ms.topic: conceptual - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) >[!IMPORTANT] ->This topic contains instructions for how to set preferences for Microsoft Defender ATP for Linux in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](microsoft-defender-atp-linux-resources.md#configuring-from-the-command-line) page. +>This topic contains instructions for how to set preferences for Microsoft Defender ATP for Linux in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](linux-resources.md#configuring-from-the-command-line) page. In enterprise environments, Microsoft Defender ATP for Linux can be managed through a configuration profile. This profile is deployed from management tool of your choice. Preferences managed by the enterprise take precedence over the ones set locally on the device. In other words, users in your enterprise are not able to change preferences that are set through this configuration profile. diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md index ae7104ff7f..64f57159cc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md @@ -24,7 +24,7 @@ This topic describes how to install, configure, update, and use Microsoft Defend > [!CAUTION] > Running other third-party endpoint protection products alongside Microsoft Defender ATP for Linux is likely to lead to performance problems and unpredictable side effects. - + ## How to install Microsoft Defender ATP for Linux ### Prerequisites @@ -33,6 +33,20 @@ This topic describes how to install, configure, update, and use Microsoft Defend - Beginner-level experience in Linux and BASH scripting - Administrative privileges on the device (in case of manual deployment) +### Installation instructions + +There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Linux. + +In general you need to take the following steps: + +- Ensure that you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal +- Deploy Microsoft Defender ATP for Linux using one of the following deployment methods: + - Via third-party management tools: + - [Deploy using Puppet configuration management tool](linux-install-with-puppet.md) + - [Deploy using Ansbile configuration management tool](linux-install-with-ansible.md) + - Via the command-line tool: + - [Manual deployment](linux-install-manually.md) + ### System requirements - Supported Linux server distributions and versions: @@ -42,17 +56,24 @@ This topic describes how to install, configure, update, and use Microsoft Defend - Ubuntu 16.04 LTS or higher LTS - Debian 9 or higher - SUSE Linux Enterprise Server 12 or higher + - Oracle Enterprise Linux 7 -- Disk space: 650 MB. +- Minimum kernel version 2.6.38 +- The **fanotify** kernel option must be enabled +- Disk space: 650 MB. -If your Linux server is behind firewall or proxy, you will likely need to allow outbound connections between it and following servers. The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. +After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints. + +### Network connections + +The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. | Service location | DNS record | | ---------------------------------------- | ----------------------- | -| Common URLs for all locations | x.cp.wd.microsoft.com
cdn.x.cp.wd.microsoft.com
eu-cdn.x.cp.wd.microsoft.com
wu-cdn.x.cp.wd.microsoft.com
*.blob.core.windows.net
officecdn-microsoft-com.akamaized.net | -| European Union | europe.x.cp.wd.microsoft.com | -| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com | -| United States | unitedstates.x.cp.wd.microsoft.com | +| Common URLs for all locations | x.cp.wd.microsoft.com
cdn.x.cp.wd.microsoft.com
eu-cdn.x.cp.wd.microsoft.com
wu-cdn.x.cp.wd.microsoft.com
*.blob.core.windows.net
officecdn-microsoft-com.akamaized.net
crl.microsoft.com
events.data.microsoft.com | +| European Union | europe.x.cp.wd.microsoft.com
eu-v20.events.data.microsoft.com | +| United Kingdom | unitedkingdom.x.cp.wd.microsoft.com
uk-v20.events.data.microsoft.com | +| United States | unitedstates.x.cp.wd.microsoft.com
us-v20.events.data.microsoft.com | Microsoft Defender ATP can discover a proxy server by using the following discovery methods: - Transparent proxy @@ -60,6 +81,8 @@ Microsoft Defender ATP can discover a proxy server by using the following discov If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs. +## Validating cloud connectivity + To test that a connection is not blocked, open [https://x.cp.wd.microsoft.com/api/report](https://x.cp.wd.microsoft.com/api/report) and [https://cdn.x.cp.wd.microsoft.com/ping](https://cdn.x.cp.wd.microsoft.com/ping) in a browser. If you prefer the command line, you can also check the connection by running the following command in Terminal: @@ -86,38 +109,28 @@ Testing connection with https://ussus1eastprod.blob.core.windows.net ... [OK] Testing connection with https://ussus1westprod.blob.core.windows.net ... [OK] ``` -### Installation instructions - -There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Linux. - -In general you need to take the following steps: - -- Ensure that you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal -- Deploy Microsoft Defender ATP for Linux using one of the following deployment methods: - - Via third-party management tools: - - [Deploy using Puppet configuration management tool](microsoft-defender-atp-linux-install-with-puppet.md) - - [Deploy using Ansbile configuration management tool](microsoft-defender-atp-linux-install-with-ansible.md) - - [Other configuration management tools](microsoft-defender-atp-linux-install-with-other-configtool.md) - - Via the command-line tool: - - [Manual deployment](microsoft-defender-atp-linux-install-manually.md) ## How to update Microsoft Defender ATP for Linux -Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Linux, refer to [Deploy updates for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-updates.md) +Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Linux, refer to [Deploy updates for Microsoft Defender ATP for Linux](linux-updates.md) ## How to configure Microsoft Defender ATP for Linux -Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-preferences.md). +Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Linux](linux-preferences.md). ## Known Issues +- When a large volume of threats are encountered on the device, the product might exhibit increasingly large memory consumption (until the next product restart / system reboot). The engineering team is actively working on a mitigation for this - Logged on users do not appear in the ATP portal -- Quarantining a threat requires elevated permissions. Run with ```sudo mdatp --threat --quarantine ``` -- Product has not been evaluated yet side by side with SELinux +- While we are working on creating a better onboarding experience for Linux in the Microsoft Defender Security Center portal, the steps below temporarily point to the Windows section of the portal for getting the onboarding package +- In SUSE distributions, if the libatomic1 failed to be installed please validate that your OS is registered by typing the following command in the terminal: +```bash +sudo SUSEConnect --status-text +``` ## Resources -- For more information about logging, uninstalling, or other topics, see the [Resources](microsoft-defender-atp-linux-resources.md) page. +- For more information about logging, uninstalling, or other topics, see the [Resources](linux-resources.md) page. -- [Privacy for Microsoft Defender ATP for Linux](microsoft-defender-atp-linux-privacy.md) +- [Privacy for Microsoft Defender ATP for Linux](linux-privacy.md) From c734446d237d179506c578f1dbda8f6b4bfa7a5a Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 18 Feb 2020 16:16:58 +0530 Subject: [PATCH 37/69] Added static proxy configuration Added static proxy configuration --- .../linux-install-manually.md | 2 +- .../linux-static-proxy-configuration.md | 76 +++++++++++++++++++ .../microsoft-defender-atp-linux.md | 6 +- 3 files changed, 80 insertions(+), 4 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 38b84b9fe2..989e9be269 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -47,7 +47,7 @@ Download the onboarding package from Microsoft Defender Security Center: 2. In the first drop down, set operating system to **Windows 10** and in second drop down, Deployment method to **Mobile Device Management / Microsoft Intune**. 3. Click on **Download package**. Save it as WindowsDefenderATPOnboardingPackage.zip. - ![Windows Defender Security Center screenshot](images/ATP_Portal_Onboarding_win_intune.png) + ![Windows Defender Security Center screenshot](images/atp-portal-onboarding-win-intune.png) 4. From a command prompt, verify that you have the file. Extract the contents of the .zip file and create mdatp_onboard.json file as follows: diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md b/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md new file mode 100644 index 0000000000..ee3a9237c9 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md @@ -0,0 +1,76 @@ +--- +title: Microsoft Defender ATP for Linux Static Proxy Discovery +ms.reviewer: +description: Describes how to configure Microsoft Defender ATP for static proxy discovery +keywords: microsoft, defender, atp, linux, installation, proxy +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Configuring Microsoft Defender ATP for static proxy discovery + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) + +Microsoft Defender ATP can discover a proxy server via the ```HTTPS_PROXY``` environment variable. This setting must be configured **both** at installation time and after the product has been installed. + +## Installation time configuration + +During installation, the ```HTTPS_PROXY``` environment variable must be passed to the package manager. The package manager can read this variable in any of these three ways: + +- The ```HTTPS_PROXY``` variable is defined in ```/etc/environment``` with the following line: + + ```bash + HTTPS_PROXY=”http://proxy.server:port/” + ``` + +- The `HTTPS_PROXY` variable is defined in the package manager global configuration. For example, in Ubuntu 18.04, you can add the following line to `/etc/apt/apt.conf.d/proxy.conf` + + ```bash + Acquire::https::Proxy "http://proxy.server:port/"; + ``` + +> [!Caution] +> Note that above two methods could define the proxy to use for other applications on your system. Use this method with caution, or only if this is mean to be a generally global configuration. + +- The `HTTPS_PROXY` variable is prepended to the installation and/or uninstallation commands. For example with the APT package manager, prepend the variable as follows when installing Microsoft Defender ATP: + + ```bash + $ HTTPS_PROXY=”http://proxy.server:port/" apt install mdatp + ``` + + >[!Note] Do not add sudo between the environment variable definition and apt, otherwise the variable will not be propagated. + +The `HTTPS_PROXY` environment variable may similarly be defined during uninstallation. + +Note that installation and uninstallation will not necessarily fail if a proxy is required but not configured. However, telemetry will not be submitted, and the operation could take significantly longer due to network timeouts. + +## Post installation configuration + +After installation, the `HTTPS_PROXY` environment variable must be defined in the Microsoft Defender ATP service file. To do this, open `/lib/systemd/system/mdatp.service` in a text editor while running as the root user. Then, you can propagate the variable to the service in one of two ways: + +- Uncomment the line `#Environment=HTTPS_PROXY="http://address:port”` and specify your static proxy address. + +- Add a line `EnvironmentFile=/path/to/env/file`. This path can point to `/etc/environment` or a custom file, either of which needs to the following line: + + ```bash + HTTPS_PROXY=”http://proxy.server:port/” + ``` + +After modifying the `mdatp.service` file, save and close it. Restart the service so the changes can go into effect. In Ubuntu, this involves two commands: + +```bash +$ systemctl daemon-reload; systemctl restart mdatp +``` diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md index 64f57159cc..1205d192a5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md @@ -41,11 +41,11 @@ In general you need to take the following steps: - Ensure that you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal - Deploy Microsoft Defender ATP for Linux using one of the following deployment methods: + - Via the command-line tool: + - [Manual deployment](linux-install-manually.md) - Via third-party management tools: - [Deploy using Puppet configuration management tool](linux-install-with-puppet.md) - [Deploy using Ansbile configuration management tool](linux-install-with-ansible.md) - - Via the command-line tool: - - [Manual deployment](linux-install-manually.md) ### System requirements @@ -79,7 +79,7 @@ Microsoft Defender ATP can discover a proxy server by using the following discov - Transparent proxy - Manual static proxy configuration -If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs. +If a proxy or firewall is blocking anonymous traffic, make sure that anonymous traffic is permitted in the previously listed URLs. For transparent proxies, no additional configuration is needed for Microsoft Defender ATP. For static proxy, follow the steps in [Manual Static Proxy Configuration](linux-static-proxy-configuration.md). ## Validating cloud connectivity From 5e1bbff0a3c43704771be3a1785ddf40bf2a073f Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 18 Feb 2020 16:52:08 +0530 Subject: [PATCH 38/69] Updated manual installation instructions Updated manual installation instructions --- .../linux-install-manually.md | 154 +++++++++++++++--- 1 file changed, 133 insertions(+), 21 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 989e9be269..223833fd21 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -37,7 +37,132 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic ## Configure Microsoft's Linux Software Repository -Follow the steps given in [Configure Microsoft's Linux Software Repository](https://docs.microsoft.com/windows-server/administration/linux-package-repository-for-microsoft-software) to setup the repository. +### RHEL and variants (CentOS and Oracle EL) + +- Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/` + + In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step: + >[!Note] In case of Oracle EL and CentOS 8, use [distro] as “rhel”. + + ```bash + $ sudo yum-config-manager --add-repo=https://packages.microsoft.com/config/[distro]/[version]/insiders-fast.repo + ``` + + For example, if you are running CentOS 7: + + ```bash + $ sudo yum-config-manager --add-repo=https://packages.microsoft.com/config/centos/7/insiders-fast.repo + ``` + +- Install the Microsoft GPG public key: + + ```bash + $ curl https://packages.microsoft.com/keys/microsoft.asc > microsoft.asc + $ sudo rpm --import microsoft.asc + ``` + +- Download and make usable all the metadata for the currently enabled yum repositories: + + ```bash + $ yum makecache + ``` + +### SLES and variants + +- Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/` + + In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step. + + ```bash + $ sudo zypper addrepo -c -f -n microsoft-insiders-fast https://packages.microsoft.com/config/[distro]/[version]/insiders-fast.repo + ``` + + For example, if you are running SLES 12: + + ```bash + $ sudo zypper addrepo -c -f -n microsoft-insiders-fast https://packages.microsoft.com/config/sles/12/insiders-fast.repo + ``` + +- Install the Microsoft GPG public key: + + ```bash + $ curl https://packages.microsoft.com/keys/microsoft.asc > microsoft.asc + $ rpm --import microsoft.asc + ``` + +### Ubuntu and Debian systems + +- Install `‘curl’` if not already installed: + + ```bash + $ sudo apt-get install curl + ``` + +- Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config` + + In the below command, replace *[distro]* and *[version]* with the information identified in the previous step: + + ```bash + $ curl -o microsoft.list https://packages.microsoft.com/config/[distro]/[version]/insiders-fast.list + ``` + + For example, if you are running Ubuntu 18.04: + + ```bash + $ curl -o microsoft.list https://packages.microsoft.com/config/ubuntu/18.04/insiders-fast.list + ``` + +- Install the repository configuration: + + ```bash + $ sudo mv ./microsoft.list /etc/apt/sources.list.d/microsoft-insiders-fast.list + ``` + +- Install the gpg package if not already installed: + + ```bash + $ sudo apt-get install gpg + ``` + +- Install the Microsoft GPG public key: + + ```bash + $ curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg + $ sudo mv microsoft.gpg /etc/apt/trusted.gpg.d/ + + ``` + +- Install the https driver in case not already present: + + ```bash + $ sudo apt-get install apt-transport-https + ``` + +- Update the repository metadata + + ```bash + $ sudo apt-get update + ``` + +## Application installation + +- RHEL and variants (CentOS and Oracle EL) + + ```bash + sudo yum install mdatp + ``` + +- SLES and variants + + ```bash + sudo zypper install mdatp + ``` + +- Ubuntu and Debian system + + ```bash + sudo apt-get install -t insiders-fast mdatp + ``` ## Download onboarding package @@ -59,25 +184,6 @@ Download the onboarding package from Microsoft Defender Security Center: $ unzip -p WindowsDefenderATPOnboardingPackage.zip | python -c 'import sys,json;data={"onboardingInfo":"\n".join(sys.stdin.readlines())};print(json.dumps(data));' >mdatp_onboard.json ``` -## Application installation - -To complete this process, you must have admin privileges on the machine. - -1. Install Microsoft Defender ATP for Linux - - - ### Enterprise Linux (RHEL and variants) - - ```bash - sudo yum -y install mdatp - ``` - - - ### Ubuntu and Debian systems - - ```bash - sudo apt-get -y install mdatp - ``` - - ## Client configuration 1. Copy WindowsDefenderATPOnboarding.py to the machine where you deploy Microsoft Defender ATP for Linux. @@ -101,7 +207,7 @@ To complete this process, you must have admin privileges on the machine. E6875323-A6C0-4C60-87AD-114BBE7439B8 ``` -4. After installation, you can see the status by running the following command: +4. A few minutes following the completion of the installation, you can see the status by running the following command. A return value of `'1'` denotes that the product is functioning as expected. ```bash $ mdatp --health healthy @@ -119,6 +225,12 @@ Copy and run the command below: curl -o ~/Downloads/eicar.com.txt http://www.eicar.org/download/eicar.com.txt ``` +6. The file should have been quarantined by Microsoft Defender ATP for Linux. Use the following command to list all the detected threats: + + ```bash + $ mdatp --threat --list --pretty + ``` + ## Logging installation issues See [Logging installation issues](linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. From f2c1bbecf15e4a95ea8b14c1eea17b2893d4f9ad Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 18 Feb 2020 20:29:02 +0530 Subject: [PATCH 39/69] Added ansible instructions Added ansible instructions --- .../linux-install-with-ansible.md | 228 ++++++++++++++++++ .../linux-preferences.md | 26 +- 2 files changed, 241 insertions(+), 13 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md new file mode 100644 index 0000000000..e4b890e5fb --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -0,0 +1,228 @@ +--- +title: Installing Microsoft Defender ATP for Linux with Puppet +ms.reviewer: +description: Describes how to install Microsoft Defender ATP for Linux, using Puppet. +keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: dansimp +author: dansimp +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +--- + +# Ansible based deployment + +**Applies to:** + +- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) + +This topic describes how to deploy Microsoft Defender ATP for Linux through Ansible. A successful deployment requires the completion of all of the following steps: + +- [Download the onboarding packages](#download-onboarding-package) +- [Create Ansible YAML files](#create-ansible-yaml-files) +- [Deployment](#deployment) +- [Check onboarding status](#check-onboarding-status) +- [References](#references) + +## Prerequisites and system requirements + +Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. + +- Ansible needs to be installed at least on one computer (we will call it master) +- Password less SSH must be configured for root user between Master and all clients +- Below software must be installed on all clients + - python-apt + - curl + - unzip + +- All host must be listed in the following format in `/etc/ansible/hosts` file + + ```bash + [servers] + host1 ansible_ssh_host=10.171.134.39 + host2 ansible_ssh_host=51.143.50.51 + ``` + +- Ping test + + ```$ ansible -m ping all``` + +## Download onboarding package + +Download the onboarding package from Microsoft Defender Security Center: + +1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. +2. In the first drop down, set operating system to **Windows 10** and in second drop down, Deployment method to **Mobile Device Management / Microsoft Intune**. +3. Click on **Download package**. Save it as WindowsDefenderATPOnboardingPackage.zip. + + ![Windows Defender Security Center screenshot](images/atp-portal-onboarding-win-intune.png) + +4. From a command prompt, verify that you have the file. + Extract the contents of the .zip file and create mdatp_onboard.json file as follows: + + ```bash + $ ls -l + total 8 + -rw-r--r-- 1 test staff 6287 Oct 21 11:22 WindowsDefenderATPOnboardingPackage.zip + $ unzip -p WindowsDefenderATPOnboardingPackage.zip | python -c 'import sys,json;data={"onboardingInfo":"\n".join(sys.stdin.readlines())};print(json.dumps(data));' >mdatp_onboard.json + ``` + +## Create Ansible YAML files + +Create subtask / role files which contribute to an actual task. Create below files under `/etc/ansible/roles` directory. + +- Copy onboarding package on all client machines + + ```bash + $ cat /etc/ansible/roles/copy_onboarding_pkg.yml + - name: Copy the zip file + copy: + src: /root/WindowsDefenderATPOnboardingPackage.zip + dest: /root/WindowsDefenderATPOnboardingPackage.zip + owner: root + group: root + mode: '0644' + ``` + +- Create a `setup.sh` script which operates on onboarding blob + + ```bash + $ cat /root/setup.sh + + #!/bin/bash + + # Unzip the file and creates license blob + mkdir -p /etc/opt/microsoft/mdatp/ + unzip -p WindowsDefenderATPOnboardingPackage.zip | python -c 'import sys,json;data={"onboardingInfo":"\n".join(sys.stdin.readlines())};print(json.dumps(data));' > /etc/opt/microsoft/mdatp/mdatp_onboard.json + + # get the GPG key + curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg + sudo mv microsoft.gpg /etc/apt/trusted.gpg.d/ + ``` + +- Create onboarding blob + + ```bash + $ cat setup_blob.yml + - name: Copy the setup script file + copy: + src: /root/setup.sh + dest: /root/setup.sh + owner: root + group: root + mode: '0744' + + - name: Run a script to create license blob + script: /root/setup.sh + ``` + +- Add the Microsoft Defender ATP repository and key + + ```bash + $ cat add_apt_repo.yml + - name: Add Microsoft repository for MDATP + apt_repository: + repo: deb [arch=arm64,armhf,amd64] https://packages.microsoft.com/ubuntu/16.04/prod insiders-fast main + update_cache: yes + state: present + filename: microsoft-insiders-fast.list + + - name: Add Microsoft APT key + apt_key: + keyserver: https://packages.microsoft.com/ + id: BC528686B50D79E339D3721CEB3E94ADBE1229C + ``` + +- For Yum based distributions use the following YML file + + ```bash + $ cat add_yum_repo.yml + - name: Add Microsoft repository for MDATP + yum_repository: + name: packages-microsoft-com-prod-insiders-fast + description: Microsoft Defender ATP + file: microsoft-insiders-fast + baseurl: https://packages.microsoft.com/centos/7/insiders-fast/ + gpgcheck: yes + enabled: Yes + ``` + +- Now create the actual install/uninstall YAML files under /etc/ansible/playbooks + + ```bash + $ cat install_mdatp.yml + - hosts: servers + tasks: + - include: ../roles/download_copy_blob.yml + - include: ../roles/setup_blob.yml + - include: ../roles/add_apt_repo.yml + - apt: + name: mdatp + state: latest + update_cache: yes + ``` + + ```bash + $ cat uninstall_mdatp.yml + - hosts: servers + tasks: + - apt: + name: mdatp + state: absent + ``` + +- For the Yum based distribution + + ```bash + $ cat install_mdatp_yum.yml + - hosts: servers + tasks: + - include: ../roles/download_copy_blob.yml + - include: ../roles/setup_blob.yml + - include: ../roles/add_yum_repo.yml + - yum: + name: mdatp + state: latest + enablerepo: packages-microsoft-com-prod-insiders-fast + ``` + + ```bash + $ cat uninstall_mdatp_yum.yml + - hosts: servers + tasks: + - yum: + name: mdatp + state: absent + ``` + +## Deployment + +Now run the tasks files under `/etc/ansible/playbooks/` + +- Installation + + `# ansible-playbook /etc/ansible/playbooks/install_mdatp.yml -i /etc/ansible/hosts` + +- Validation / Configuration + + `# ansible -m shell -a 'mdatp --connectivity-test' all`
+ `# ansible -m shell -a 'mdatp --health' all` + +- Un-Installation + + `# ansible-playbook /etc/ansible/playbooks/uninstall_mdatp.yml -i /etc/ansible/hosts` + +## References + +[Add or remove YUM repositories](https://docs.ansible.com/ansible/2.3/yum_repository_module.html)
+[Manage packages with the yum package manager](https://docs.ansible.com/ansible/latest/modules/yum_module.html)
+[Add and remove APT repositories](https://docs.ansible.com/ansible/latest/modules/apt_repository_module.html)
+[Manage apt-packages](https://docs.ansible.com/ansible/latest/modules/apt_module.html) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md index d1a41ccd3c..fde2118685 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md @@ -255,7 +255,7 @@ The following configuration profile will: "cloudService":{ "automaticSampleSubmission":true, "enabled":true, - }, + } } ``` @@ -266,45 +266,45 @@ The following configuration profile contains entries for all settings described ### Full profile ```JSON -{ - "antivirusEngine":{ +{ + "antivirusEngine":{ "enableRealTimeProtection":true, "passiveMode":false, - "exclusions":[ - { + "exclusions":[ + { "$type":"excludedPath", "isDirectory":false, "path":"/var/log/system.log" }, - { + { "$type":"excludedPath", "isDirectory":true, "path":"/home" }, - { + { "$type":"excludedFileExtension", "extension":"pdf" } ], - "allowedThreats":[ + "allowedThreats":[ "EICAR-Test-File (not a virus)" ], - "threatTypeSettings":[ - { + "threatTypeSettings":[ + { "key":"potentially_unwanted_application", "value":"block" }, - { + { "key":"archive_bomb", "value":"audit" } ] }, - "cloudService":{ + "cloudService":{ "enabled":true, "diagnosticLevel":"optional", "automaticSampleSubmission":true, - }, + } } ``` From 1eda71519991d50387a9426155e987891d860b64 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 18 Feb 2020 21:12:59 +0530 Subject: [PATCH 40/69] Update TOC Update TOC --- windows/security/threat-protection/TOC.md | 10 ++++++++++ .../microsoft-defender-atp/linux-install-manually.md | 11 ++++++----- .../linux-install-with-ansible.md | 1 - .../linux-install-with-puppet.md | 4 ++-- .../linux-static-proxy-configuration.md | 4 ++-- 5 files changed, 20 insertions(+), 10 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index c969d4994f..d09defdcd2 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -342,6 +342,16 @@ #### [Privacy](microsoft-defender-atp/mac-privacy.md) #### [Resources](microsoft-defender-atp/mac-resources.md) +### [Microsoft Defender Advanced Threat Protection for Linux](microsoft-defender-atp/microsoft-defender-atp-linux.md) +#### [Deploy]() +##### [Manual deployment](microsoft-defender-atp/linux-install-manually.md) +##### [Puppet based deployment](microsoft-defender-atp/linux-install-with-puppet.md) +##### [Ansible based deployment](microsoft-defender-atp/linux-install-with-ansible.md) +#### [Update](microsoft-defender-atp/linux-updates.md) +#### [Configure]() +##### [Static Proxy Configuration](microsoft-defender-atp/linux-static-proxy-configuration.md) +##### [Set preferences](microsoft-defender-atp/linux-preferences.md) +#### [Resources](microsoft-defender-atp/linux-resources.md) ### [Configure Secure score dashboard security controls](microsoft-defender-atp/secure-score-dashboard.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 223833fd21..60f02ab8b7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -42,7 +42,8 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic - Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/` In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step: - >[!Note] In case of Oracle EL and CentOS 8, use [distro] as “rhel”. + + > [!NOTE] In case of Oracle EL and CentOS 8, use [distro] as “rhel”. ```bash $ sudo yum-config-manager --add-repo=https://packages.microsoft.com/config/[distro]/[version]/insiders-fast.repo @@ -54,7 +55,7 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic $ sudo yum-config-manager --add-repo=https://packages.microsoft.com/config/centos/7/insiders-fast.repo ``` -- Install the Microsoft GPG public key: +- Install the Microsoft GPG public key: ```bash $ curl https://packages.microsoft.com/keys/microsoft.asc > microsoft.asc @@ -67,7 +68,7 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic $ yum makecache ``` -### SLES and variants +### SLES and variants - Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/` @@ -90,7 +91,7 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic $ rpm --import microsoft.asc ``` -### Ubuntu and Debian systems +### Ubuntu and Debian systems - Install `‘curl’` if not already installed: @@ -138,7 +139,7 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic $ sudo apt-get install apt-transport-https ``` -- Update the repository metadata +- Update the repository metadata ```bash $ sudo apt-get update diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md index e4b890e5fb..2c430ba593 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -29,7 +29,6 @@ This topic describes how to deploy Microsoft Defender ATP for Linux through Ansi - [Download the onboarding packages](#download-onboarding-package) - [Create Ansible YAML files](#create-ansible-yaml-files) - [Deployment](#deployment) -- [Check onboarding status](#check-onboarding-status) - [References](#references) ## Prerequisites and system requirements diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md index a61a09e1e3..f1af7f4cb0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md @@ -82,7 +82,7 @@ class install_mdatp { if ($osfamily == 'Debian') { apt::source { 'microsoftpackages' : - location => 'https://packages.microsoft.com/ubuntu/18.04/prod', # change the version based on your OS + location => 'https://packages.microsoft.com/ubuntu/18.04/prod', # change the version and distro based on your OS release => 'stable', repos => 'main', key => { @@ -93,7 +93,7 @@ class install_mdatp { } else { yumrepo { 'microsoftpackages' : - baseurl => 'https://packages.microsoft.com/rhel/7/prod', # change the version based on your OS + baseurl => 'https://packages.microsoft.com/rhel/7/prod', # change the version and distro based on your OS enabled => 1, gpgcheck => 1, gpgkey => 'https://packages.microsoft.com/keys/microsoft.asc' diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md b/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md index ee3a9237c9..9f6f4b5dc7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md @@ -42,7 +42,7 @@ During installation, the ```HTTPS_PROXY``` environment variable must be passed t Acquire::https::Proxy "http://proxy.server:port/"; ``` -> [!Caution] +> [!CAUTION] > Note that above two methods could define the proxy to use for other applications on your system. Use this method with caution, or only if this is mean to be a generally global configuration. - The `HTTPS_PROXY` variable is prepended to the installation and/or uninstallation commands. For example with the APT package manager, prepend the variable as follows when installing Microsoft Defender ATP: @@ -51,7 +51,7 @@ During installation, the ```HTTPS_PROXY``` environment variable must be passed t $ HTTPS_PROXY=”http://proxy.server:port/" apt install mdatp ``` - >[!Note] Do not add sudo between the environment variable definition and apt, otherwise the variable will not be propagated. + >[!NOTE] Do not add sudo between the environment variable definition and apt, otherwise the variable will not be propagated. The `HTTPS_PROXY` environment variable may similarly be defined during uninstallation. From cfb38abb00222a1e225d6f64c18740673da52d31 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Tue, 18 Feb 2020 21:29:55 +0530 Subject: [PATCH 41/69] Fixed publishing warnings Fixed publishing warnings --- .../microsoft-defender-atp/linux-install-manually.md | 7 ++++--- .../linux-static-proxy-configuration.md | 5 +++-- 2 files changed, 7 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 60f02ab8b7..c3fe515c1d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -26,7 +26,7 @@ ms.topic: conceptual This topic describes how to deploy Microsoft Defender ATP for Linux manually. A successful deployment requires the completion of all of the following steps: -- [Configure Microsoft's Linux Software Repository](#configure-microsoft's-linux-software-repository) +- [Configure Microsoft's Linux Software Repository](#configure-microsoft-linux-software-repository) - [Download onboarding packages](#download-onboarding-package) - [Application installation](#application-installation) - [Client configuration](#client-configuration) @@ -35,7 +35,7 @@ This topic describes how to deploy Microsoft Defender ATP for Linux manually. A Before you get started, see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. -## Configure Microsoft's Linux Software Repository +## Configure Microsoft Linux Software Repository ### RHEL and variants (CentOS and Oracle EL) @@ -43,7 +43,8 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step: - > [!NOTE] In case of Oracle EL and CentOS 8, use [distro] as “rhel”. + > [!NOTE] + > In case of Oracle EL and CentOS 8, use [distro] as “rhel”. ```bash $ sudo yum-config-manager --add-repo=https://packages.microsoft.com/config/[distro]/[version]/insiders-fast.repo diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md b/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md index 9f6f4b5dc7..4ced587060 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md @@ -18,7 +18,7 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Configuring Microsoft Defender ATP for static proxy discovery +# Configuring Microsoft Defender ATP for static proxy discovery **Applies to:** @@ -51,7 +51,8 @@ During installation, the ```HTTPS_PROXY``` environment variable must be passed t $ HTTPS_PROXY=”http://proxy.server:port/" apt install mdatp ``` - >[!NOTE] Do not add sudo between the environment variable definition and apt, otherwise the variable will not be propagated. + > [!NOTE] + > Do not add sudo between the environment variable definition and apt, otherwise the variable will not be propagated. The `HTTPS_PROXY` environment variable may similarly be defined during uninstallation. From 62f4f7be969fd2fb860ee192ae3e10f752445b77 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Tue, 18 Feb 2020 21:40:56 -0800 Subject: [PATCH 42/69] Cleanup --- .../images/atp-portal-onboarding-linux-2.png | Bin 0 -> 267332 bytes .../images/atp-portal-onboarding-linux.png | Bin 0 -> 276917 bytes .../linux-install-manually.md | 65 ++++--- .../linux-install-with-ansible.md | 175 ++++++++++-------- .../linux-install-with-puppet.md | 12 +- .../linux-preferences.md | 6 +- .../microsoft-defender-atp/linux-resources.md | 2 +- .../microsoft-defender-atp-linux.md | 25 +-- 8 files changed, 152 insertions(+), 133 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/atp-portal-onboarding-linux-2.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/atp-portal-onboarding-linux.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/atp-portal-onboarding-linux-2.png b/windows/security/threat-protection/microsoft-defender-atp/images/atp-portal-onboarding-linux-2.png new file mode 100644 index 0000000000000000000000000000000000000000..7dd1c6d0e6ce847470464e07499b62d8523a9d12 GIT binary patch literal 267332 zcmeFY1zR0Kwl<0e4;I{=puv4Za0wFJH9*jfyF0-h5+qn4cyM=j2=4Cg&exflbI#l| zU${Tu-c9dk7u{9eRjZc1YjvoCoCFFYJ|YAJ1d5cTs3HUeYz71bv?BZ~;0)q;nF<61 zvW%ICh=P=e2&sY{*u>1z7y?2vG(incU8xT{T}x5wvoE|PLQ^O?JWMo(a2P463R*%m z42E<#!uzh_@*+PAoR4Lhh2&pKV56%HnZpc^!(g$Dbr@z8T;rhXkLZ{AmbvVo-M0q4 zrA@3&AVv$f20ppwgCK6lp=GXQtt(0)p-t^Ev<`+V!{>W)HM zux-qRH7(flT!;%Vh6o8EN!Xbp97syC)&#NA1(nhW0YOf%XO;J+SDBm0kb(yp%`gSg z)WRkd(bU`~caEAR9qH5wqL&?{myY6NjX6<)2s;}sas8_ENHJ3s(T5msO~^NyIe;5u zjqLU|P8oL&GH(#^%MvM5vz~x*2m? zkZQ1Ky&?BS(Ez_wXM8YOJp_f!iy6J(kWBoiq4B5KZek7`+S)Rc6X#d?4bdd{u)laZ zSH~NZKNo}8WH5&PaZAt~3UYjs^3(X_bKqr0?NkS7x_YkG8F-Si)3ipC3Lgs&qUi18 zxHX>$4ADz7o@HaWSzrz6AaJV`VhN#tF?EW6SqPwwKrvCG-0HrV?@c%@xH%*>3Clqz z!}nqkkRc{6txDRYzdP@e?!wRw$5z7*!KC20Y^z4N*}IV?wMLWTk$U7O@0!_p(hkTP zeJ6XQUMTrBX9%Z(h8{k2diXGLv&-zzww#t(IJd@k=EKM2?`dIC3_eJT9Z?bkh-(-e zwrhAi4OdF``O9)#$rHhuXI0@F3o^@;F2~}EBU6cEbc7Dq;t_}3uaA|X1`R=*t~Wo9c~#Ny zQ&*xBqm^LHA#l-1f7x8_V#Ti%d9tzUPFXey=M$1+=7&M`If%wHT{CG#A%T3fIU(Jd zMKZ6Ot5vD1c#=(r#`93JFDB|r^HY5F(eJI?^2mha*d@OHN0p2DyU&J0g!y#N`Wx=g z3*bG5fRX%T#$T>8#0PJj-thSowcw)Ic9c%;wq#PUuoF>-IyF zNx?G-+SY7o{aOPAOwQHiCDBbmSkS%0u~O|&L-QWtKE!ttsFjN-sN6<{><$$oNH3I& zl}J|D#8zzXws3wQt`oR6Qsi)`U!>?ceh6j5hPCON`iRMpTYicPud)5H^f}bwIQ@$C z;bu_q+aPV;q{3{sirHW-1nuWR^TRE!Fz$$<1q6(uzcT!yPIeVSzvf#OBSeWDD!vw@ zObOj5o)dzR;``tePazXC+50L7`xa|9icoBr)T&o@12i7mC=ANNl@^ImK$?Ig3M&8j z8b6RaYkkbpfmJgg@jKF(bmgnXNY3vPWA-~Ll|-JASNagY+me$xwt{}KFky$~8fYXF zehW-6z*0w1jpFFgyJMY-bTlBbAs=qls3p+uh;hMSYNc7PIDx$}_n=?$A?aaWzdp5o zK=PG)M^lUO0MFm9F3f3wm>I9|e&)lB1UIC!65J|djN~T_qEL_x*AEQ)kl&$5Ar>Kg zp%Nihoxz>N7@?n}?Wka*4W&F3A%DhKeyL1zNOlOFc<&}ZMWz)a(7U?9ULLRgp@bAn zK|-!aE=YE*c=7h?ji5Axm}H8$hUl!Q*$?gS4hn8RUnxtNLvX}=6-kpR&Y4n@S2$MC z+uzxl*}2&ZAB));9Q!#jn`^JR-8>BUm24=mJ2&@td}UxIVs@^(yr!^+^tTJ0C9&F1g(>FTPyRU0m(xjP8%;?eOi` zU*6tTTohhh@9Rw;v*_a@bA@p9a;fW=4XuQ?DT%~p`Wqx?j+S-WWUsPx1S5wV46Lxi zgp=TY!==F`5*MYAph*81`LS;7b+&4@wUNj=dUs#9Qbb`mDt-+c%Ma+doEU&i=?M)Rcos19CND1-TWO39ZMs!Wn*Q34at3L zs8-ghwn{v-o5!BF=A&;Ib7DK#JFuQrI+(pOyid5wJ6Pu7=FQ=L*cjb8nHcMg*;e0B z-*)KW z8}$T35$mcus@qQ9wDzAbM%OYUMD&m=2ogCh`^uC$nrq$bw(G!lEdmQRH~Fhw9p8dm z&TLN6T$Ek4PjlRZ+=s6$&pdeA9Rogh&Y^QP;_7BMd7YV`-W?pSGhUZmA6@)9?>qT< zRX5CO*z*ggO#U9jL&U@Mp7`W(W&2QVrDpz^*_-QG``PMAUV=CBO~eBGnSqZigrL5N zkUJ^;I|>_5efMZbG{Jo8o%dx{W$#?iiR##Jjr$+fJ`c_}%m{+z^5O&b>*a~sZYGvCT6&Goz{;IludQ?5{!GFQTX z%gAG8uQ^g%W=r4gnB$(C^h1x}nA>abh7EI&dPA0*`y-g#do3MVSX{chI$Zui-3z6K zCN4=MZI*EbQ57*A$vswd8^S)cW+xy(0aqZnxsl>P+a^`V${nEyVagWrc$qS58v0zowFQ;FA zKvB5p3zj-4KIJ#+;i{{v+;~Z!#S18*{E*H|&)8zMda9%mTNP{h(36Msqh_!yoyEEP zF(oyHz=W)V)wF7`I!%YQ!APz%wb=frz5Vu+?tyM&<;@W4TS4|D_4vWJt~W-VQI5Iw zxo6}1g166=*2Exr)>6mj?FW_fmUx7L;lzd{wRmq$QgxfF?Nvdwr-hn#76$v|$6^*Z zm^d;xdRiEjpY|2~bH!vxm*X7r?Dr|3**H~x!>f#W`IpFAXfpg(EqI#XSk;^ieyJ+(2=;Uk-L()()`oMd#$gJ->x4y zFKQU!icpn_*g>^BXqO6onav$y!S0d0kq$&dpt~|-!+}F1qbMC7(3Z=7Xg+41d{73z z(--@_lU<+RaKkrgv)+lG)u*Y~bwTI4+t-grm-o%8$5TN_Ae^sEce<9=1hY;%ile#N zNg~V{jqMF~N9Kc*)fQ6I*4pwdOI{)_>$^jZ-Cm&WH zdWM~jul%n?jx)TYPgbr(+B&wQ-b8^Mk`3;@6nue1R;XZY$ebrb~ zcp>jESg6O{G;^JT? zTf}8~`g#ruLXiz3W7E^K$>Qz~1omrNf?4VPH1w!QCF;VZPLeOICL3Vi>U_q`is#+G z$nmoth%OS1)ul{iWg+N*Har9@BnAXD(1Ha1ARzG}VE@sEfRKhH`0utNB<;WYKtVtR zn?b<*tB)q|`{xr4e1Xyb`h|`Sf`9}5!vMYk-=Y4iH*Cgt=>KX%1Mv<7#Cs(XDJkGr z$;i&w*xLRx*kS#tj{-P>U?Ztv4*`Kq_2&yIrAT=K0RiP`rmXIuF8hJk2yDe<@Cj^a z%;aKa^XEPg{4Tse)5_SvfYimx(%PQaMS%PtJ$QlkpVQ3br2pvRU?D)RE~`K)0=6?I zq0EId3s%r@9*p*`)(!?PjMnxP|Gde6-AB~e-pJ0(#=#71P5S4)28Liq2LW>OKM(rv&p+pB z>|*vmPqMcE*Rp^GGXJ^4%)<1J`TsV|!OY|@!~R_P=dgdQ>z|L~|8p~56?%*EJJUDOO1X%DOk#LCUZ{jXvF`_lh)sK);cW#M}F z?%#+0+ogXS`ezZm@^)sxObz}}5yZmJ{2%B3cYj4=d$6VBpYAHwW)2|Me+~Ixr~fsI zpZU+m{M$zTlMDWF7GMJqB0uwgvlIxiW!(iG0zwEvO7y+53*tPj>CPB*HSLvXx< zGX<%i;+Oo8fLk22_m;wDZ{9@5ze7_NMi)~ShUp~7GK*)Y-7V44*I0V?Fueu^8HX-X zC2ls{Ej8A8dfS^O-fj)nNmYZFkKzcpDWzgX%T0#pW>}*k5MDSak)a?FvI!1gU+NSs zWJoS_%ELk=8yN^A>GRhE10M3r2*QR?83Cmb)L)P2WOxM+xepR?Mr4o}q<=enVT66w z?4fwj4qm-9HA-rzHyN0}$2Qbon3p7}FWUE;RH4@}4e$RxFCnPVP>8PWP6u`#?7zzkM=F-mZg1kP>t=%5r;Z?$SUMFt9{a8F z#6d_%NV|g>mbcoqWyplw3c|v|o!d%mpI^Pi)1csDL~e?zg{ z*@=EiVy2~)wA<)4*j$swbTl6N%AxDnS!I<-@i)Q!$N7*Hp+<&`k5rw@jjre2+V{qt zLBYX#;!Gwli994mZ47*;mPfb#The98;8ahl7oOo;C{L=p##WS0#*d1}D(ZB!@K!30 zy2-MJfJQz&-g35F>i+5wHte--WJ6?Olt1H3vI>EqjR19ukue4dKU%Zw)gbhtTi7p& zpzIx4r+K{TzcccGwk5S;)|ysGZ2|%UI;BK|s?L8Z<*kXmS>wPV495}1rhaJ&^l~d_ zvI)%N4%)>@>zYU8ItCao?>rPK8gmT+T9kYSh|zv)@U&sEmT-B9c6-5ExlmQs&(Ck? zoCos5D<|K-s%StD+SMpXzJ#hm#d;UWj~ODVG6iQZClKvV# zw!NouqNctnd(}fj4LMy$C6)hFVzg&($jeEH^!G`$R*|8BPx01Hzj9bm^7HenLa~d^ ztgPt2RroFxPJUR0_mlvJUH2g3!*{Lgazt9(1L=p0kQ%T21zxRKYvRPRH z->f_vkb2a)yxtQvaJD&MyxEUcZaknmTLUi5kxr3T%#&gi3wx75x3^ud-{z-gNn4^r zun8fVHOH8_w{P1*t><3GVu3D0nV$E z#bT|R-e@urN{K7N@zVq~!y?3~A*HIrv22OHR$u=dm(w+`LKD+j?VpNN8jUW$5N5i< zlFHn)HNz8FV_%%3(8`yP5w!P46#UuDzlOYhpY*Oj(?E3W)dIpZm60j3oVcCtuB$&u zB(UH#Z&mJmytFg6eMs<|)_|DY@q_Rs-ZCD-2MpT%sggK@jv$MB@ST{|G;@uB<6iv5 zM~i*qz1N>se0;a7g5htngCIQX+U`Q&Uf(?j-nnGfGnsne(1)>4_@d2M7o)Yj;F^@s z`T7)U-peY~VG40s%~39od?kAuM;+6!zi8FYhJ9jBPR|f^>Pwo&s8x;I^=ZZK^1VXf zBn#-~aPO4dQMIp6DW`0wwUzXFErQm6r5Y^}3Fob$ZAt39<|l@hQIdV5*a}ZktdeJ( zg5g}PS($KVH=;<$esN|J0p@F|zk6~e%)aNc_N8EN>zS#Jj*iWfU+>N}8DwI{4%0e-5yL)V*S*sKdS>eNab~vj-{40_e%YR z`ilURHpX3R@ZnMi~Dt-mRBZLIc|_XU^mnk%T-s(h2jQ4)0LPwRN;eh4KTx z6A09@GA$t#&UigPUY|`UG3MH=wktM!xW3h?uUwd3(LJB^5PcMHC`YrIuX5KoD$)?S zyWFSGl}U^S=gG&x5pc$LqjJO^Xs{s^{ZcE{wK6=#j1pwh;shtM=F0prPaD4X$8md; z1yavXV1xkUfCvJvexgZm5{{n7Sb$k)-P7~cJUI4)*roH5E8N&wM=FnEskP2q&C29> zdNsMdsh^C@Ef29(z92&errJ{j?>0Z!vx5pND(|OII?Y({n+~%~Ncia>BGLGGBT=H`M8Z_@d~dzuehzrqiyDeTssGJeswPd*41QZhxk4X8LJV@V-#;c{ zU#}Ww*TRU`RnaQHYsryL>kqJ~Ok!1`lghr8D}Z%4+vt1L`Jyne)z!irGpJF1(`B?F z0goD0nfO|1c`D&N$;m zvmL5>6(+KqSM!DRc@yO~HC<=5Q*h{>+rw#gC+bZ>Det5jedR1nz8J)yT`MGxOh6un!wfRDZNEQi(9?B!a!twhOkr8) zGXnxltib$8&O~NClXm+^OO1`6AYe-%?5QZ#QxzyxdqbYM;#kyGU$hC@>#kgRw0w@>a ziVLwIgbXh_0|Nu<9bUa5v=nqw$qqHPt28|m_!cIR5DuKE&8D_)Sf^Ti!a3gZZHcgU z`mxDyEXz9R5@`e%8f1fc_F>+XVZO1>e#j2bNbDZBBS4-;U9;h;w0B*e-=MvMp5Xgq ziR*S6tCZM%V3=2gIoPHD-*#X8|^gLCPoZSz+hff?aS@sn-?l2ba&^}HWqTehx@XRIy6 z<`a?y%eKLr;sn+VAwGdz?W-NZkD%;dEgGJ(^63wOcbUTsC?u94wEL+2YwLF(0m1lb zE8!@kc5gGE72)F}B$dROcIZzJ1>>ZK?YiK?7^C;nmZtsL(l(Km0Cme>@Opi*RJmrq zP0mgwNcww>y8E-EKy(&U4}eZ}NQi$sQXk>NYzlLu7j(SFM)$)Fde1)>tcg|qJpW7P zH6b@?o!#b{$?3DWZotlbFLI2T+)PAxLnByCkGQJ6yWJn2Y1m5XC-W|OAX5Ji@8=ki z;MWLO=qs3R`_)8HH6+03YVMGIrrKq+qw`H>Qv2;8XDR9rB0i;RrRm6o?2`4)t}5-q z9UHzusFKYdw?pOlDQ`jdF{f~UH6s7qx)TE%VTK~t)uk-WDswu~q=W|Z$=D;E2FVPN zCzZvNyz|;zDpEd*SYTtx{Wt+}b6}r5 z>^-%RUV+#2>zBk!EeQZP3OlDY&V>VlXz!Dm3UF|7DXr424Uo1Le=<>jNuo9Id+Wh+ zywIfPc6E^198Z7$NR_e7kr7ZZ$y^kLUJ^CxR-#hvNV!Kp{@8W<*xnul|5h=l_HzbH zdh&y8wr&oG^@2Jl;K-=!pT?c8Z$xk{mB~*t>E!6#Uv1sbZbs~3aJ|GVe-IdYn58<; z5GHt$fFOtntH--bM}ww0R;#<3av2=FfE&W^S?1m0c*Qt2QjjuB0|>V08fm{H27U?- zyN*h-d-6K&O{k`ws}MC=b78AXlJL8X#x|u(v`(B3Ww*N*sut&b%!V^guiwT6S>|6H zPRq*`!ny+cG>GGHaaZ?}yM2g|>e%RhI4{S}$a^}$;QXsBLyc$hBk$=Ouk?xqyReA) z&Qyp_ckUWmoD;Q&>*jVo7uI zc+4v@!m#H$pF6fsy`;tIUUOMNuRXO)hQ1nGMgz2*$K|q4bvRlO+bgiZ01J^Apgi@_ zWb{@SYdw0RD2LewY!0aPG7ApH01BzExMr)oHtceY_2dQTYNY^^yAVV7@&|@9G@6e0 z!>;LlJd=tdom#Uj0Oy*w?_LqjtMETgK=9|6kn0{#%HWWFIKokk8Lf9D(8#t1w3TJn zhi9jt#*>G0#R3O2ot$?H>(BA9=i38o%Srhe>#knWa-RZSbSk=uSna1Q&6Z2j77A6n zy`QT-;&YkNXj#yV&)`7|vt>P`C?_TJ~GmS=?2NQZ-&_l#XgGGE!vK0V$!p55&? zMT>!+4FeXkm}E!crhibqNWFRh=OvUsklSHUtjyN{ytn(XBHb!!@d)C>QXZ|u@bSjm zIJ@UZ)LtUz1p_2xH!;PBAhd_0hGVIrug?7&%rt%QRd!Bf^NcAQ&2acq&ydi$!hwj` zC}H|A@v;Cu5{`Qsd7=2xeLP8T4$cf!@Qjwzi{;81%X8WNSOAaJ<-5b-)X?~n%Q^~X z?JwxC&3-!g?cSK*dfgGs+}tx~A{R{xLK$DM=$Ty4HNaIW}Z$cq9nV% zU@`VzPUqUoynqvU!c%_aLNQI-*UbQR7OI3ql)YIoQwb<2C<)I`^VFG{1}3nn zj9Q#Yn}lKdwXpA>g@t3Kj~42Rqk7@hh=-J`nEx0%vM*oR1{`Z;MD{EwMG`4-Be{U{gplvVA>S*1FUfQG+wITd9raIDJVRJ1W#I_RgE3O zOt_e8n$#OUya3_WHvf5$-cx9cqq26+zWD2YCL5#Xb=#k+RbL!-=Qz4S zhM8@u@`8+2=9A?P+XWQegW;5aM^7bBU}{(N{RBlr^Za`viQ<6BNc!{Vd_n;`QSxC? zNkD&4S3;c6?x%QA zIZj-(W{T)oU*$94<3c2fG@+COUrQ%yi^A^yrjZx_GX5rW-NOb`^L@y`80^;0Jwoxw z0qS2?0>qv|3-H=Xr+BI*kiNcjtTZvu1XBZ%%QyqRV&_x`qXzq)XAWjmB9nWuO^U`+ zdf&fm^reS}aLbp4&nswr`Fq?CphYX1=(Q%GjIJ&R;C`$u&`^{U$Ua8C9;Zc}bBErH9Pe80i zEd)-zt3nugOP>@s+BE>n>L}?;xQ4_>C#Co!4%6bPnp<*Ea=wJz@hend&P;X`QX*N- zMG+eA3rL^j%Bz2(_v!xr{+km&mC8T$Vcc$g1An?cS_EJ+d>)URvW?yt5#risubLs32=IupDE3>u zdIEY}HH4EmgGtDNVWLdJxI=d-)?C&;8r@7UP-DRXX3g>zc@-~lh|lRDxsQBGY)(gn`0R@!3SyOHYz-BmGT<$s=NyADdkRtUpNrEq+M`CRv#jz6y< zuUh#*&tBuK&xOPNbu=AgMyw}&V&4+@$3P@ii%gJTpmn`}2V~p}8`Bygy;9`Ar5@g@ z!7t*%r1T>k0BA%3pPup?7dR1}Li`U{oC83(82Mi5Eh(I`=E^_G3zv5&$hyvC6vSh^ zO-JHWBKG>nboi*=iAf{;u14Z?Re$|+@?x&$Rd0PWxDT?JPw(*+Mu{1mw;pAle86sd zfbE_&gLrq*3vmf>NzG3vl_BF-KB=}<>zeCeGK*r4Bsym1^4@h~rNy)ytLZR(i{p}|yRnl)Tfs|D&tr_-vTJ}=OnliyV;DZil zhk}DWR88*;Zu|nT98bSt!;BXU93Y0I2ACmLZ&|Q0KYV5XdFv7c-UfgqX{;*CbPkKe zO4lC|Z|IbJft*l@wuW#=dyYv2eyp6o$5jRR1lt5r#em1~NS@C5UosRpyT|V^q11o0sYCAN(eXXVdT&|>n>PSB2 zJ8scPt9f&?KE*s`u2HGamzEBIgo+q5(gq@Q8k|z{8}-|ue(E;W2LuOy z!(tQNrAc>b57?fqF#X0CxpF_Tu%#BaUirolecz>X zJ$W6aXCgzn@e{vR&O4D@I*fRRTOQ-=f|Z~b6(V4nL#j5}x*-NkY8NC+L20Xg(1}B3 z`XJl2fIrDs%^GVf5k^g*bTTMNdiY@WlUg0CoyV;-!rN4>;na}I=+|mUdu-;gfQ%_U zzmHWa&Ld#ZB5w|XpS{>8pS?Wg#>}ozDa!HUF)WVLBDr~yAe1(T2%S3+-!YdU}5`84(E+6&f;Sm^hjoxa=*dE zGcce_p!Q#n)Fhk`X;Ga_U0~p%QJ&*-#1s{4_L^N{dFr=sZ<%DbM!%137JAQ9EbJId z=>X+O@|Q8kS)OU#xb4Gxg?%JV_XwFQwUY4<9d_XjiFE(QZ%jI^*lprdbS;{^o>hglO2wR&45Sa6sr8XgGCiJ)qcaJy6TPj zOm9)aTRsBpmms$2R+RUoQ_T#d)E$$rM7KgSLj|ONSL3W?n`0d;J(eI^1Is2 z8U!vO|h zvVW{X1wc7kMvog3&;d)pAy5xMBWHhj&sReb;_p}))-c}AHkWsUjEMY_U5PG(?{sTx+gS|0L4xFE zXP;meZs14D)OnahOV{E1fAe7&{`fG9Hu{g@5N)#r+KpV1EiWYX0JV<6d*QW0M>wmvIkjS@Gbx}idyLO79ZNwp3;U5z11-1uLR+u z0qV!Nwr#ibr2rhn=Y$a3O`BFo&vC-?FPTaVN??H6X_=5iLrh=|LESOXF5go}TOs@c z%V6?EYNq|wm&sAej^e1)*H>s`Gc5xE#QUQ4#cdh1#|iA-CIrT7}%tV_ARdhdxU1 zW*xI>7pP}_SgtUQ(nV6l4Ho4QdQGPav)~E@mQ42zYJjw;C$wOs=#W%fFOmaE+8iJ& z>IavXTsT{9+)$ErlYmRI|K9=YzZ$-sLO#@m0XsEiBZSzUVP&xZMq zdmE0MXuvH3%66Ydn1J$~%Bg4)$i(rRi07=9>Tnltx5@|AnR8=Dmot~xA}_E&iPeVf z>CIs=^gX=m`Ib^4r(BFA{zEf5g1+v0Cc;qZ^=u~o2JJ|WA*oq=gL?~F4>Qy z!5#7YsxM~UVwQuKmwHzvnudW9#|G+Mj;{<|nG%C|qmNK< z`cctG27btF51;Lqh85*=JqZIZ1{#_zfohj+hobD3Y{;gP3IyE*lKP`K+n|cFlEmgV z<0U`=$!CU7tC#|v@zdXW=5hFiLVvyndp%UQi1v?ZT{ZHjJ0yXDVyf}&A+84vokqd- zb7(UhX=k$}Y3E6@4B*v~=VsC72fJ9R$LnQpyXB_K%gkf1`Rl3eIU7fp8XTGPt@Ed5 zWjydatuxOpbNsgAY0_`i3;v~FCtUxVN3|KDl(E;Pu(|BfY5=5%zAFqTNe`PT7MoG? z4_ZT|QU2+w?;CRlyV;yFz(GdEWP<%|iuf(38P`?DYI%Y>=cKis$0#`iVQ$*Q_nCT3 zLkShtS!Z>PC8;v!Q$)mG{VH9I2n*3L3lD!%<)2plV8;v9z`MU|N|C*{b)?dGt0E9w z7aE$8*w5EW_iXR!)k@-@9+%6{7r%{Etw-1!H`y+E z+#H_O-Zi=EeC2xGq9erXM^B*i_u+n$RA{pxi*kOP}7xpv!RJU%lFyJL>u z8rnWHbg#SB!Am01;!5{^x|OJR-rrhwc5S+BXbd@jHQ~Q9uJdTU{B0T`0||#I-gdqF zF3Re|Ch$Do#?ul;u-oxc6M#KlVh4h1ycS zdc|K>JIbZ!JKzLcNlJz+#B%KOc#1UE=p9{m-5ri=-{*G_XxHx(TrJKcxn$DlA z`DUvxv|^Sh!q1P{K?qQi9rR<*R`b+>7mgcdN_ojc6N1|nPPlC$Ac2o= z45?cA^|x1pJ?{1#Ai0zc&0{|2gYF>V_)b^2_Y9tQ7m3Y4faPle5s!fQI`(_(IdfA! zoFVhD1b;0MfyA{~=VX$g-RT>Lc?oOVKVC#aGr^U44=~oKyE+gimgYl0_V|}0h!Z3W6ptY?|_Wd&O4MH<^0mrpvP6OyHSL=k)w6ZOnw zD(k#qFqs*4iC+I=(j*BD_JQ7T2BHBFVvAYQ&xvhEE=e@_^-sWgj~-7Ws%K#Gq>4(D_8aDy7^mg@^aVFXD*ytX<()-$cX zDb(Y0Q1$2*P{>t`yoJ(V>r%vHt32QC51G20kK}5b{vG@uet=CeJPbhg)k}-XnaR&^ zTza)Bc3fU+*%4urp-#3&Gr9IOu19s-2i)d?r=;Em?IYN zB*CW>e+C7a#=XfxEt07c9SY_qApibzCxOQvyRXFS-8l{|DWFR7Gz?W+vg?7$LGhwLl2gx4>B__A8tMx?6?gR!Ar^{F>=@zE9OeS z8q_E@g!8;t5o?ZgYhLvo%|{h4kkk>f+Zr_6zEabZO$4Im6n$7SO8^LRI%3kS74lMD zJ_4cy)-kxt?+^4ueErf`)`E{4n3$_4qzI0|0h9@))ZSEp8N^aI%|fMJFF~+@KHH-& zovFLMoYw0D7L@ZLrQGT1edQ70X~0y6W_VHy?o~lx7Y8C?ReNO-huA{Hy;jIL*Xupd zsQ4674@sw1lA1PB>$Kw0?Yf+MUic?pk~}(JE@nTQzx|Z|FR+`O!x$aZ(eTs+&kgr90Aq0M^)0&k#}iRrkRO}pz}=?<;9@mYNxf4bNL zN29@{7^qKCEe0p`3O+wrO%rgL)CBG<9{(Xrv+VucL^-zqZb@>s z(Y0bzr|2?@L~wXZC=`P#;?W24(Re*5;)>J;sFCi!f@@e>^IfAf=5g4Wr#8U`a1-yM zg~sGJ-?)MJyu~c<5$JEfJ{eq3mzI5OR(UBP34#PhMdI# zX6ai*EMtIcSuM7ZH_Jsx6oxBqAq-}#tVl2Rftnq~X*@990Ls~z1j$!YRO=f)f1cl^ zdV20Q?+n`W%r^z(s%hm15h}xOn^d<2h?jhN9CY%p0N-$|&f%(2s400~Ch?)f-o846 z<<5^s04U4DE4_SbzH#Pzrc)`ggksowv?y&dL0WDGxYo7!g`*quEEVun$k&ci>FgBx?2EJ?Oy6v0nurH?VHh-Rd~Uj zW%tx10#55_aP#e4Bp3iJCt*WD$j8ge#O;IW0$S#~3%>cD7E>S2b};4VpkHwj7l!;t znTibu!p>0rvG~(Y#E+6)XYu3g5>K1Mg3WKG)@gGfOLXnVFNmNj%JW^>49^Skx$(;? z8$F=Z$b$}h7SyafamGcAqHs08H_l)R~0l*>+bI=We%*_$mJoU zXK3mHiFR<)=KYF4>H$~t-PPf~Qs&?lQ2uFjx$fq3PJCFfbI>t^KCw2gR{g;&1JR+n zw1n6LmD8g&uRRrYnh54H;ZQ^Xp6-*T=iSM`)hQRubc)Ky%_IhmwFW99-VBgJg#%Y} zl;G3M)ncucL<_H@+a#CSIOV*`{)cDBJdKJUAgoV1oEe~;a})yJiK~Gm`t{>uU+DWw z7co0P^@%kD#g}K9#8~v6wTT?o57FQlT_tohZ|A1^C)d$TPxs|#03z(q)}!N`SGPeC zSN~-g$m~3P&<%B8a-2*6Pxt0dx%J9k(O{}yLNF10ab$J7m_%Q?_WgKQRbGQ#eZ4-C z{i0#aAH|a{#+>sijtp*PQo)Tt*~+BJD~y zi|O!nv!uqyBnPeW6=gN52l`pSlXstw?4-XXs)z)`=%l0+T#{_fI=nTBm&sDs(+UHxtX6F#- zfFuQ_b$llI@Xk71Ld<#KI5KWMcdapZUj$O7XZiZ8^TO&k7NelUk=rMC88zFv;FeqT z{!gQ=z96g-E0Po&uS^s|c^J=D<86W&3jHv93`e!;^QEdlBjsv`w*>b9D(QK9wpH!j zl8Iaby#iP#?^{G1h7~0w3(;^U`BABHI8ORbTYZFMAVEKBJeR9T>;O0I#^akWA|pw{O!(jF z69uY$yX;=ptqSU*)@=Z}o&{{K;~-GJf-0ly^cYDwSG~QO#~aTd6EV+JpDQ9^Sw`1i z)GAbE9H_Bf7Y`G`Q@2=aR37U-)^b{?{iP_yn5MF#NIx+YOCcdwmHe>Kzrq;cYp#MI z^BE>}nVSn8KxvtLHF1V{)FraKz{z~qIQA%tABtsTUWJV(?h%{*&@5hS41%R8VFTVn z;3(9MFD{zOMCEiHEYh=Wx)Hrs{qX_MzQg~ijrR<&9v58D^xJ^fp+VA`tMBV)SE%V+ zs#ls=HIS4d@77ol6|H?A%I^}fTxTYf(F*+@mdEU2RK)Eu^a2vaVi|ZBsL$F_#|J`Y zZp^6rn+j(M&x!AIsHR_VK|(1PH)0t~a2P`EM<3Wi`_r*3F_~MSh@vP2@f(zdd1Hic zG>tr{jexv1C|5qC?O2-3_3X`*b1kLsCL2TDsyO8Uqs9eFRLg-C1|fxdA_XCzlk(H` zMw}|KQHk~~=TEh~>bsf}^IhOIh2NQf+dl~OwBW(zvainqKiVFSx{0_nJd*LD66jc_BR2-Lg zQ7sa*QC4MByHA{T>%kBCn2$F%*-^RI1mHRCF5AHQP-1f{{?*^|(I|LgByL};c$`+t zv-~w#z)JKEFoa2Nj{C{EEL)u2C%xHG{SE@E@IbaB(S48Wo%iZzOi!1G)1E`{qM$iK z6v&XNgB8d7cdG`;!wjK_?t^SQOV2XHK}Y+;VodgamS$rCBQ?sSwf_mTTlmb{x{y?4W z`>%Y@#UK9zWpCvmM{|gnlZqc&5yv8nTe?UC5gBB?vyRruSIqq~sIUr?)z<9ken?GZ z#&+nQ0*=p2G4B`qL(pednaB4X zxv#88bp*a~S;YpSfoX{c{_FXWEaZ$rGk(19(C209`X1wDxS?08P= zR2|gNL&q>nM5ag$iRl)H`Y;FhevM0Cn7tn8h_#QP zyv2nMTj4aI)T8G13tXkmPrqQi9*);c=4jD^?pK6P3%{a_%FKSZ(3wp4lsw}aSRX2R zPcq$17>6UdK)B0HRXp`t5q=G+U#;NzcJ=$#M;xzn9k=eZ)@|V`CtXi0YnUn=)yQ|$ zTm6xTLVpR1?u~1S0g0j8YtP;|PV@Jo6H%@RTujdo=QTQNE9(ma`F4(?!;1>HTHC)H zj+^OM^CqSpY@$K9(o8=mkJ*L?MkZByqT571-HaNHOD#@K6sTzF+-<~`Hm8%DGcx(V zLWv(vYe=q*I{j`nNa38G#rPkuXV%XBf#4zAYsZG;xS~S)hM8%tFB-FC$8$_^6olif zGCWoPBx<Te>@^4G>@=S{=PnZth9qhFvHn4K!ixNfCXS4XE@2aQi=^ZG0i zX6Td+Y~rza)GqbDDl8rFa#{~3_#85gR)Q-@`U~A=8@dyRVQVsb+hU6kca1F|&z)d_ z9!Otagt1vaaFZ;w>!BsT&hO>3oUwVEZ}<(9OGlUCAP`OvzC_^v5cbt!QEqGdf}kJ* z0|yq_c%J*Y?|W59kmM>)p9Mfs;!gs568J+eFW|xq8Z$-R<+E7`}nVka_-ab__=@?<4yxQUBNC>In=Ba$|13VXiQf6(5 zKd9&=&lQcT@uwuUklgV+ggTK*r((}jm{L_bvI*^!p_$|hh#vtAygSvDEr;d7?*u2w ztk4ZIF2_@Mf7De+e7gCZCs$JZyIoh2=VhPZ^B-j6vYsbRUd|hAu2z^4A~YO!!jLpr zk-MuMi$cxvxaVxV_|kVJUwa9;4~VX`x;R-gJ5WYF7-J*tsdGDCcV@3LFPG3A5N2Xf z%aqeTLKjl!6-dSA$(VSo#m6qT>PNn2xi0nCs+M9?MGtR}W$uTslX;*N={Ap~ycoi} z`;9h_+OyL;U;f7n0H1}l**1ed=c==TE6l)YEeo#$3CZUE@JWTV7zqLPRDu5U$+n`l z=4!P3hv&KZ8YtL;^WS-%KYs;%9a?dCw7#gJ?R~l-MkH|gQbd<>VPXE~mK5MwsuE6P zjyANgJVobm%N=07%oDeUK71H>$q%ca*LzN;Fh?TVcsX&nL+h!_JamAn`}^XM&ueZu zy1J#%40%C;44X%*@vKI6R=kn-KBGy;9qebe8(K|AsMxoPsZHI|Un3YSknoFRx1JE{ zb$f%xo#s!l&im^Hq#jK$e8vo+vZ!cm>s%Zpy(bqDNAvgGMG2YII%jpmjs8|4Fq4>@ zs@XOhF{LuS&pnR@7rKalVSbuiRoEDudU6k^LC@iH+*?1ulAQ2SJPjt6S1Wiq-rVsS z#TDivN7@N{e*Crhol?i#cGUiKsf{L*s9mkco<&Riu)AxrAX*V)% z+!kbTtyeP6Ps>oxDVC|Q4m{5fP4)-Gf-OE;7Yr0HDHXpawDWzA!i}{~Jkn|uuSusI z?W5-ZqOzwc#oqbXofY2PCpUue9nh zZxjhEnl+T5BS07=yZHp^2Qe&9HfBFq@S|wa+Ak{Ig8&H*CQh@gh=a^^1|*k3)ykRi zM>PJ_{fuu@u4Qkomv%5_yqtHg!mc;&G3DK;jA5+`N6-7R=kJV%UMDjE6tN*#5}WH= zKSOx-js`I{fuh@9dekQ0Dk--|s+Bc05|^{x?{bC;6NKkQ8y8whsuc7+ET?G;g1j$k zEv{a9nDxUdNF-jWv5bI4iQ7??+z}R@k#}>hsak2L#~pJ0wyiV-bEOKS(ozMGlonVc*Q=L)TN%ZZxk@ zMpw{QF_vq%-;-5V?{b?htR&^||CESCT_I$0K&&Izq8SbM^>ym`_Dw&U6jx``P^&v9 z{jh~$=G<#>h-xJK3zd_Sy~fKR54Re@iE$!V;3&Xfaj4dCx&S*q`DNr|_KIg*%F5kyJf&B8E0Z_ZC&IS?(v5)ItI(~xn8X^6r7QiM zr5H|+3y1v~2}(a3gqk%aUqdazWFEO5Ppm9$QCcB5@2=H2ZkOKwWgRuLlXtx=dUr32 z5JN;?r*Y^BwhrXWqi0knqYWMF9S%~^DNT2PNu_-pZ0_b9K91TzybBYsi26H9A&VAY z*HS~K9NjOgbb_JPxrZxWRIj}<||-VkU$t9 zb3Ha7GI~m477@Ci0U7P*T_Y2P>C3UTpFq4J~eSCHlrdIhC zTSxGosXS%VjlWgGPj@yCnICWNERCr0SDD+sl_1)YZ4mYr24ps>J2nu4bg_HbL#n4G zIj>yQy2F{N^AM#)ijP!n-V$Pb=VBm~QZtLUSs71!K7Jp}3!?9Rz}b7nS$7ZUD0Sdhs+&)IE@MX4%ObwabLOaiw-nU* zPGCxj^#kjOLPVycp1Tp>7f;k|>?gHmxn&sLaD`QqC~CU<*#icO&>@?6d|_>Mt%~}y zWi$0E{ZD6>?PZ0T=OmH>=NhGIigQ_63_f z;H=P{%sM5h>$mK1EjPJz6u)D%vLPm3_j*2COLyN}g*nbM!Ml4O=s zUmw?HR?xt5_a0_sl#cUDZU3nZnI0Gm`&t3VIh)PFMwk@&cjLpCi&Iq%uPQ93X>v4H zeUmUClGtm$F{APo>>J}-h#RH7+Fxp}p7w4&6uVIfPdZu+l+a&DLuW9!tGwa|U!7NAp)#$Q5W!dkxs<~E=-7b@r zS@q+vg=>!e2D;}J4}PXwNn8*=CLnlLxDemGXWMb#$Mfxu*t@NF`C3(%YoHhuW~p5h z$YMzUb0kmNqU?poe%H+eukqahA?LfT2tXR?dEwBI3Ulm^?9)7aIq>49`T-C5bk%Zq z-K8x*QNAU#Fy!v(Vz9rJaet8ql{_qxS)34K#FJXU#Exj?7{H;HVkq`~H*IflbRd+&@QjcDP-oA83Mw9TJsmTxXsRE5vj3;jfXluKCT^-H|$=|(2iC%o!`3Ven` z`*-AFkjmp71Z$si?M${lj<`P`1IZ6~0>9I@G2I;_pD450CrgCrTKAB8iI|>8iLT5a z2?-ApqP=h~6BP3g@*ppmalstKOMy&T^N<(53W)fDM>oy$p7hJ5bK@e4Y5)qh8^xi> zp-<-qaxR%7R=u`1l%>yNkf7g0i%yIDt3MyPOJz)LDna_HaIPL@T8-Tk7p>X3FO*u$ zPi?gAt==|1!P7T9bX0^BIk4GCM`~V1=E@nijSoh>uwMIN@N#y5Y{(!Ro=zRQfkALC zHpA474$EF*{W{B}n(+LK2Q>veUz^{-tzC;PIca;G0#nq0+o8ofz%-vpT;>p4pS=Cc zT=!hlG?~LE0JwiX2yC(OhM?P!Ld88=YixdmM7Q6&e*f8hW^S@Y%WH|V9lhcq8XKu} zl&~vlnB75OADvc39a0BcZ^CYf1d;su_ouA7q7(oOWpig7Bq^4j?qTflBpbYoZgj|MhvrRO_SN6l{L zdRGqFbmSuy)Wa(p*inft16GLI2UO{X-7GCqCm7t(Z zOuVU&Udy@?a&>RC&CM!JTkutjtgsG80NNsoW$WTHnS%sj!dL(6`3Nhu=L?JYj}*8k zMS1C-{&;v7U5f>&_lF;qP{*+G&e`G>sge$%(@%H8Hw_B4IfRJl{Ysud`B1@(>#z4Q z*>45_-=IOkC2B{*>LiB|^>oAm`Fz&Y0v%>}+S;E$Cm&>Rbd0ko+E@lK*4d4PEZuH; z2Qk~CIU^iFT^SR$HVIZI-V3%7yDA&D5ppH`j< z4*~kXY?Kn0D_Mo-57#+z9a8Hm^S{xz8aZhoE)@>4aWYfE^UK(gy3X%rft`yNvAg?} ztUeahXcUz&0IDXz+e04}lBX(uJbG99nLDJ`qN({AEhF7;Z`4Qb64mUh6&P6v^^hta z%hz*~v~&F!K}`t(mIB*a``b0MGtB#xmDN-AJ&VVwnQn{IR;uk5+O-wAFflSU+3Gna z$-1@eii+AE&mTY0-POi*h{lfd2O6d_|!D&QD1=b0FhP_qn1!GvdUXZ+$!dLrRDtq(Bv>?2z{Om#HF{s09*YIF zuu{Vt8MPOBXBqEP3C5tlyB7LfFgcSB`q)$J``@^&bli5`ew-c8dLlNP%n2Oc+5Hf( z*}~}gtE@ys|LLu@8ri#$&nUQeZvE5dD4r&>v`S^cURrp|C6udvyi7HhkP{Va)d_3l zb+PNi35onOvyWmMzzrP;H!u^TI+}WnU5=a z<~+|?{|3`zA|t7$z8!u2-$Dm4lZ)s4Gi|;%s_U-{1;*KMfeV)So#q4b9F_H>`xs+;5~1Su zA9)|)zEVb+;>c5Bgp1@MK{6i_s-d(ogSt? ztR-~>DXIF!iYaq*#S4}I;)B14XQp^iz;#=i&j59`7<%ETUhiJzzTZW+-;BZ9>4kLn zDNsM%a(vXQY|~#@Oe&K>4;7z*%03_#v5yc)?u6RiSn8dW!zveH+XAh;k?|`P}Qz0eAD;|jQO;>&i zRObY`rCK!cYqvlZ_?}N^^Iu4_=-))*TUTC<5ec~fikZ=^FURiOOCny|G*ApB|SC!3n208BZ@w=kii{Duu}RP6QLx2`&9}?mE1y`Y1fUsVz(1ZS!tuufm=-q zu-zCCGU^Tw1C|YlR7Z7 zn$oguM7^II54<>7nwpvjl7NJ*C)Ac6{$DH=!LPnLqqk0CGUO)SMMnO;I+(g_N$qyL zDM<&&eYg5a7cex^m4Ci1wqJXTmx1w!{{5PoIb@qx0c&Z^mU>T)AtVR|ml#Q>02hI? z9hNN@Jmka%uaM!CMq${f0q-<%rai6CnhZ=^qW4aCx(gbxPXxpC_w##ov_4`4+-%m>CXM;86&xhUxB9vOfUSSM(@Ugl`3J zs_nt-nW%@>Fo(P5ov*`8(V98PhJgU$%>Xv|LvKGZ3N9=0R$8lOB1*Tv`Sb13LCp4u z^wInvYV6pge8a8-pnhSOS_Ep2F+jBdDm>)KJ;s5!XK!a zZn-OOCxw1VW~=5fa2WTOu4^Y1*%b+CG4(NgId=GYIpdg$zr=zLq*_xA1}qLb6w^y} zYZNw(f0-uSg5GL1(~X#qn09a7KLN8RoQUH?r$MM7EvNypMXRY5N=LCA^S{ehzEy{~ z91cp|(oZ7Em*nDknuyup!*)K{?s~Ji-rURF8)5Q1i!)UQ0ckQ3L$j3Jbij`3+3ZjH z1U3W7TUw$`LqS?)8ehaHBl}qotIB#6QST zev7GVdA2k+UqVG{WF#!T>X_bKgra zKj%582Z>oA`|z*OfFMy8}=Rkhl{S|Nav6-`E>m0gFC zp1KoF{kpfwt22PygML;fMt}O?cujPvZgF?{r2T*!z182VuPiHol73}*1gk92awI!K zcYyTydoOo(kJ=!Tv-;YJ6SL!y#3L35%LIuwQ9})?u#d4W2 zfrYZ%y%P}Dv14AWVcZ%T$ebQ3c}u4e>N+>EQc*ANG_XeYC-BEm+-s^5yKo!=tQMDY z3r&}sx|62@ZwzmMrOM`$Pj+A~ka69N(eIpl&jN&)1IPNtziKh$iQ~2VLEjjc`_8OY ze2#NgkliJ>plaL;6H^!GnJF2LPX>R{8Qi&D+f@{-vgHzao_%_N&n}#{yGQcm2?Jn0 zvk{VvH?L#u?J9k7@7!T>xB74ic9rn`rS6^{hKHQ4Sw+9Q;#6JjcRnEFKX(1&vBaOE zI6@9Of{8Z>_op%QdSC)9SPiU?07KqouS($zSRi!)+c9{TThV2HfAqTV>XaDs?>c1d zjnTZNACkej9^p37(4VzN`|gz3K8%a67vymRxsiHvw9iHQ`U)1Slh*+egC^L%zW!w9 zVkjSae{HC$q|A2%0g5Rvb|yYyw6w_QaPH|a>gH*1q7MrI9nklsos5+$4u)e|`9!V$ zk3>6DfE!6@SW`Wjme<78n1-=knp-F%QsvYW*F@dd$}!Tk?8(|G|LHyvtxS z>c0I37j6oSHT5ApF3vo~y7Di}iVa~>6U%F_`r|wwTVSVP1R&E7^8${WYR?o?{DO!$ z+K+KU?LlGl9!)ZLa{8O7$lIuAB>UY`{l)h8wb}mXY>og*_3xZcCgZggzxBT9P~Nq* z>AW*fF!}`tClg*o3vjst^LO*;qoJKUmS6LRvRDHf`eSh&DpileZa~#qC8mev zpcLUs`{LAtMo*r7E%VyzH)p;m3$N}h6k_nuB|(pQ9X^HirC4L#UoFF2x!*c($iTif zF;|Rm31f=+(qoGLd7#XU`%DhH6zYBh#V;fWyyfn3UdY#{`|1?^#JvZ=`lBmrFm-7} zE@9ZpgJbP*J;!!cAIv&3BHg|m>JI4(2V7 z$;4=;0xPt1WY&^h@Dt9>^Wyi{?$4Afzg_~;xevE0K#duNuTN8#Bv$Hr40+RZ&ZECA=PXR5sE1sqVxDqJeTlM+&OesUTC^v^>?0m+< zE%5!zE)XvxHZCCWU296C?nmF=gmQ>;qJ6k!8dncKW(M5kNK_1hXbKhJeyJT;oO6~5 zy($}%Ve;52OMF|aX0tY#7w5j)bpIQ_lO?e7dnGMXN$17y4cu?L66@S@r=xT&jj1?M zR)A%kbeU;IPj&?3NVi>ypUD(3kmH=Kw2U`4IRFqJ8B#APN`-@d7+y%2zgdi`*C&cN zWw`FCeEUw;ldmJ>3gq2-andWiWI}>K1;{{4zQ3|}EmHH519$@ilR8Gv%OVx{jwQR6 z_Tk~?S?uP!*`AF<0WvoC=&DV$hY!D{NPIyjaFJ;AC5f*=a}M-%-LBn`v->$%Elcds zQlzzAm07Q@)e?G8FIe+C6LjWojuCCO!9XA9lFBV*{p+Vq!Jatm#eu=)6%W17(mP&L|b~@K_hx=tw z&|4%TQCqL=P+&Ck<%5G^qn9^r;X8U&Nz>6NC(@r+DcZFCO==tV}OtRyIvM*;{9S@dYT}TSGX6H6Lw^u8YNwZRt(7U<+@; zH?HO<{m_EVHtgVnbYQYj&q?)}ivP z5?pcE%7HiAU$obA8PwKo%6e1IOYjSDd+x%W^IgWyYuIzBW(m}%25 zSEKArc~+<@nt@!hY<5AtZwX!xg=7SyYQG;dlgB;6JN(MOZGB2A_;;l=0XMbkWX4VQ zqokW!_$JVzh1Xpi$D+D{T+FcP(uLMkEM8P3t`jEY&Nr|0Q@QAyI=j_q{ZeO)60Ili zvtpt?rGpUuG>C6#pwK{+H3$72+=zi^Jo&-jph(fn*! ziD9_!c@$|UM$?)1{p}N&IY@QBFI8v79>kg9@4-;?U*C!BEX?g7xc*Mrs^1^r-@GJa zh=wifka+4Y3Rn8wHr4x;vaVN^n*c3qQ3;xCU?*hi(PG-r1U>1=ah0<-zbQU@D@CmH zk{Ekyx%W)x_$M)G>tcKha{kG*XTu20OspqTzAK|IPKI8RFCPz*sHhsP!Qyr$$N#eG z2g@~|wTLHw<`)9y4-QS)L{?cK^x+;Q=)TFZ$}^v?9vPAq7&GGqDoBxDl-iY@yVx(n zjg#CGo9%kD9{;7-VU34dNfikXA+~IU=;I1#lUY)u^ZY>9L=%G~+$hbqIZu=3Grr%t zn5o(6ZkE94(|9}zfBjvrDdkl|5xp-qa%IbX`yHLSVdSecjTfrlQ>8*D2!IaHP0=XXz(Zt>K&k!4=fo>R}`eq;rh zsaXpQf>YRrrSMY1d=Q58cszmro@4U(k?!3B<}bl6TdkvJ+~wd?FQgQTH!WvlCDmm0{u>P3{0!8SF^ZGNoDxOin z1UsI4E?L6}?a^JF0plcS`?3XBLGTm7ZaKlDQe}S+N;$lg#L^$+I1q1S@6Dp7Jz~#` z2SlY*$W#=6dO3uP)BSCyz06@X!I60%2fsM0>w>(R?P|wH@B0~9pgxVbqSsZ0*i-8=rIMAe zwal`pB&`d@;ABG5QgqXPar@;K7B5F!&$A%wE{JLanr23~E`yHz_KM*kV%*v{@j5vaGcmQNiwx+O#=Cuzf_J2>(9o;2kBd&x%MWx2|Zx3~-MVM@dA4ibhm*!2r?3!2ZTCJMOgZR3d!PkxBA z$OZV-S|vq-r{6i|Is#u+OP!}ag?WhJFo5f77TWMtl7Bd$;RrDmfkl3wM%YTImG^x~ zAD6V1go4gX6!BzRlm)eXEz2cbBpk@Uzr1;)M1G3$tb|xak`Pfb793H(nlDE7?4Q0A z^JUB{{kAtqg-p<4aGB~?nJIF)1zZBo3w0i5)x#v+d8}(QDanE_H(2AIPkeKZhUuuu z!ntQJ(^c9PKkk3KtRx8Z>MR|bal7c~%`a@IB`Ys_etq~$UWuTUJ~tKT7n+*jPH|7Z zV~*$HS8Td(Hz4&WvuZe_O{c~(-k|%&lbeG+6^?zVdR{ad;x$JaITENHK;oJOy*^uc z#%eLUO0GL)Q8E4f0@-=)1I30z6kD4VNva&PL^1=4^J5=;>q~<~j*6H9N&zL^pEYrB zi=ww)VHbU_>b(0T_lMZmkp1BpeBWnDlQs=oZOHm;$_@nA$P0TAu~^P zL)eZ0HM4kcv0anHGyMukB#PuL+a4o%cFQx34IR&zv6_ukM_hc=VLbbc`SN2h=V&4S zcI9;WW^I-Bua(K)2DW1fPQ_z7ZX+rOW4qjw&eRtmM@^|Neb|H^h8fmXmLWQBl9})w zm4=+4)fSJC;$mx-8F~o8*~m(D8&{kTE!1|Jo_4Kv3-!HnxRGXATOy~L>X=3@Ed?T^ z8R2WE;=DOdDiuXfu3irKqd`oY9iAJ71+tng{Qwe2zl(Z7UiHw0yRlx_li(iuuA!4A zqqb*DTcN`K6B^s_ST1yXHxt6+;)O{qp^UaEP9Gn%UUOv1<)KiX=0}bvUeh;yBb0uRjBGlZ4cVh> z_xZ#M$VwQ@;g=)^&l1WsT2I&shHI%plY5T~^;*6yQ6YX~!+JJD(k<3QO3mYjxtnh| zPxuzad=(wDJTD*W#axRwK8bbQGk|5ubdJfBY~ie`qU5F*K@vca{oRO@DN7hRzSFm1 z!ulBmYGgi)kNhI?*CmWif>fhl0C_V<@p`_8b~}}S`7mf3v%XXK7<(^o8QZMcqBm&U zcM=Z_0dEtWfhtoCzi^g6t#wq-YjC4eQ2O(!qcJZM@Z(Z1D6{=vb#N^(6l_a%KFCR< z#tIOLpUsfr@*Hl$ZQ_cPj2rYAbuur1xB)U}R&farp`l3Zv-8*RFa2Rj0rznBWwMeg zH&0V#yA3bkTqzDJm9%nTmj9)>g?*PY=07*(-&gVH8@J!PvGtu@F#DBt zU*=LpkFs)C@RxP^NEN31Z?gC(n_u?F(yqU(zthmBQdo$*axkfVl7kl5xG9-@NRo~> zvROVmtoxT0$pkM;c#El<^7gtV9Ny0&&r1&Ihn+z0g0*VRceGd4Yh~((so`HYlprsr zq>XW`F>8tBd>r~`&#oG20XGWf7OZ%?;(4q4+#!IY!QI27>>_;70=@q9>NP=mDg-xi zQ(gqKx)aj4UR4i0?vgTzc|DMQ`-i>kD3C;6)v8B=J%_JJ|2p%%Cn+fQs<`O0v2L&P zO$1PS&C57P59_<4)|sk&ho6CuA9}mC^Gg5iAuT^e#!XsDtNU35t|B8LqTjFl>d_xf z|4Z}0j~sqpLOeWT&vS78+++W{_WbcCOA|C@Ebl6B@XMdu_@^c}KBT1BbMb$#LjCva z{NE=E6=<*A^EEFtQ}O?Nkw5PtM4}=K2M?QaCI4{*fEc6FW(M}??tjO1`LI+e-H7DI#UjTgHO z^V5UZv^|*}lt%vfTN0=!dRAg;YleI#C=O;iWHV%NySbx0c z1E90dvzomKTGI8rGV%m=w;q+8GuL3nH$Pk*c2Gex}~;TGU>=Hq7a9dHUc$igdyjCrUdq3RqQ% z$352*{SoXm3mpp)%679Y@#fqI%Da#J<~6~XPk1^z-GGMx0(^UTc7I4}?RgK3oZC{% z)b~qP1>*W*LW{)?Fv2u9iPtlzJ8&&_lg#7V-2?9n2Rx}aL z6|lgY1a_<@pgUYmS*E1s3{xF8B69Uwp6Mt;#9oIAw26fSq5XQ+LLhA)9-$ zbClR-*a@6{G|sce?-d5*9;2AZ`Rqvw%bDw3TUBm^yJ z)pmWHs@a55MA9r(hU=P#VIKNMmvLj9JGBRs$QVotugLiwbD;nR8g(2gSB_#zUWqX# zTh#T_oACfJs}gz9R~_pnRO)AKio(#-K5d5=v2K={AAfv$du8~91u) zqF7G3x}UGnahVR&n@v^PJQ<^cyfSi`*d1fjh01i1kzn> zmixC%k(|JV%t*VMI)i=Z7+uJ(qjmvAqv~`Fk;~Y}|M` z!qN;|$hraZ@$*JL`&ESuZpzq*N)b1>;K?|3sDOSSp@n6t7X3AxcV&{jhsgjew#7i; z)?Gg1YQ}$ACkZYRW`;_*)sS3=CTC7=}&A~*vD^W zSx|Qz3q4zk8ok!t+NxX(t*FvQqpbz4Ph4@;bc`|jjuDK>Jv9)*v)}o2D$!}X>i9@i zccPDbb~FD4Svdwv?Lhtcx^xXN4ch{h_BRf*+mT~1mg?vuxAdfhk&;Yccx+c+_i>#O zdJ5v+Eh^TrS{FNFo{!0-?z@!bZ3LQX4ITyKG*MdmjQN!*bqB`?N5hlUZzJ|M*H>Gu zcp>uohfVj%4S`um5ttNRSb~QT{`IU>a}XrT7^De9cWU5~+LpW*%W(x3D+x}omvG`| zT{oEBKvB{>uWYm&c&HR%&v?R*H;XGsZ96Gn8%o*>fqVKEEj&I!W@G4tu>U2iRHrwu z{ejNJAdG@S3+Tq8dH~eYf%-mh<=hPZdl9dF8)nuXt5v~vT(ow7ceNOyN;dq=pgNyJo!wQSct(=*?4}q z_T6s|#=30;Oz6HqpUqlbg#ly6&w%MHg`bj>k!3la{ z_fu=Lihhmqc}e1lc48}Y5XIIzOt|oG+zhUaHfw*lJUE$k+kwt zYMBro*s2q~2U^yN=8wcG?1i>UZ>006v%#?SG@onq?uxB4eETzW!8*?-6V}haU7Ct{ z1~rdG^&dtUh#_Ww8yD}#(v38zESxDJk7CX!XEWmLi!I70xZ0>5 zBv~(Xy$+&TxUN5$=yN)fZRT)^tG<9yPd_-#+LoI1xY&wX&$P@fnS?Pi?2I-N^pUQKOL$RJFDpopV?-9%N_A)Qia(OYj!+mS1`620;X@Ac{8 zLnpF8c@R`DzkX~qm%9yMroGi(jFp_s zK*w~P2iwLl`YYH{JDyUWkrzD$!&_c1nEfv6?9?mu%wXiLi29z9~S$jPg) zF`Kn{ZLU+cWm=w$k**j*<70z1*w(7FK%nCsHY}G0=f1gQIS-LLy4-ESW^vvLAALcktU>Jk11n{naJHX**3u1 z-!)k!(G&SvEyUG8M$!L)wKOjB;_S`kR^+dPOxIKy4#Kj%B2qoYlRX)YaFbE<8RVS1 zSUdyU``C{ir<|$zJGE^J1sm+TmP1`jAN_MkN1r4T+-8hY3)$F58nj(EHkmuwE*!+&&KyasS#vZwG3_*K1o#)wVimdLru5hXPs3eS{%b!x zb5OaHAFWk4``|8QU=j3Dx^o)_2`sT`tNic_ClFl?<=|z#c_U^UAgX+m;M@zWAC&yv zGur0rLA)1VcsSHEeliO+-d3o3pCGFvzVqv5=Y`u$n@esKI=0ZRh~A7sJXguqg8tLx zcP;*QRRaR-5wLP8*9MR`2!Q>BFSeee*+%(R)z&9O+^X}sU#d@b`S7PWvbfRg!llYJlP+myJhl<7`sOQ5Xx zZX4vLltd058Vsck)q@iUCa@fP^v_>4vd7rSMn9hsx;`xNq1iv!ZaLGt8PFFa$3}7@ z);$lvlnQ#R2#Me833A|>9}vSX;ehkB_+ydAo_~g~z*uS+K!lp7 z?Yt*Z4nD}Z!Xs!?ML#@-cOpm*+e^k(#XyJHYz+9fdzjLW-n9u;WK~jS4{_CIDJM|Z% zA;Q}zh)S{hCvf+OtRZxYTH>cV^$^91AmfES_>hDdZN@3TWF6aP5-|t$Yzft+b z`E#wMf}dE>)eJa;P&xAKxlR?PGQ0ONfv)@Bgy>_xwn`fV?bZ1Gu=>sCO4XWsT>IFo zdR-V55Z^9tu;~)d-^AANKk(B*_7Qdw6QE)7d)uni&9p2O@{^JHO9aNoe6BRcF`G(j zVD~|FItS&taownDk@`<<_@ zfvIH2cHstYomLGKqKWNd*z3t~brm(!MJ_)NJ!aA$!{@GV$Uno6VTT|sYU^O{id578 z+^m*T8yP{@C_r=s7anaT=lc!Eh$xWY{igx?K^1wV+&u(|`kGRJdRNxAslOppm8-H; zyW!Zi^a>4%(A=m%RHwLNX_63f} zd^MQAgh`@IrWm&BR$~ZH=tgFWU2~+v^Om!F)nG-ju<^07)HwEj1 zZ*)ViF>;2g@2DF5mrV%bUHv9`a)E=2z1|il{H%}^Y3#|;XZUZ*V0PT(jdlB9mH+gl zK_{+1@HYJn59|Qt$qFclhmRZYVn1bzsoWPg5;wjU1oSA!PRf9BzKvW1gZ7}9H(B|N z1DtaI*bM;hi2jAHtnM!PzTMTO(F>`3DN=J1Fbk|e>{=X5E?lq0#@kI|(~46LF#k;U zoV;?4Pe#l3yHAq-u}?t%^md`Ft2$U8ZH&pQ^wew?OBWkj{>tckAz_%Ch?Cg`JK``Z za?fBv{craLV6jk*I+P*^FLoUng$JY zM8+6ey}On*$PC{RL_pG>aGDx|^f{|&mjoJiDj?lU;~5RrKD zLjal>S%3WFuRaJO?`6EUsAT+7{h>}V@|gap;9f$i0C{r)zF490PX!0$CMyk^oPEmQ zCL^46L&hDv&pFNo_&0m>?F>H@GK_`>=4=+>otYW%a!lq1d*lE-@PC6W?@2lZiwfeh zS^N?DKkoZ0jo0qm29K+sLYv*Pg5(}~a#@yD>!t4!*g3bzm&`Pz9L}{BWA={?B#gqj zIK8{KRYPLb1(h9{N``noNG2KRj{c74rY4dUHjBeQ!p&B)Iy8~A&9c-rwkPi~E1<3I z$x+(-zua3P3cdH->7#?o&c{vgDM!Q|?qnN0jhGN+PEQGkx2kBsJuRe+Qp|rGuu~Jx z@sP#eol9y0MnkElWmOx9(sPFG-}R^t&&H-n2>WA`TXN4hr(OXi%+hgaEx=jhx~qBD zPXTFb^Y)l8kYtUdNtbDG9aBTk!RCC6UcHM|Et`y)C@dbY=+#_iJ*Z6C1s-4o%gz#K zAM7=Pe6Oc%I!KlJ=82}0x=U4m2`MEmIsh^iAodIV4(6JGTh$$@@O|J}k+^)p82g%N zmHaAgR$k~V&7$sT)TCY|onIj9fzEDVm0aD39t65z)d}2Et-ukKC7>os>tN!#pEgU9 z1LVw0_ExZa#Rs&UtHOs!{+Glc-XY3wZHg7C7dTkom&0F|`nLh|o&n&qnW8CZw@;Fu zMj?WDpt37d#sX#iY_kNO3yhdX!M>?!Uesnj10uAoazww5+g91I_&dbHhYPUi+?H8{ zB9amp#2g+6k?;^+ZK+X6$EfG?Lhv1R2CX#Dfdg8%UX z0I~DW5Xj@~UrCb;2iF%n2tZ3P2i8VqfHOG-4mQ!xOmxkbjc4*0R^hiZ6)du9xVWx) z;c1X0>Fzj{R&;Z7wc}}=YCOpY6r-(K*JGR10Mg#Fy*_)%=Q+2tl=NcI_g*s*fbMmXZ zkH-zL`4@vYashQLJ>RqH;Q0UU(wI-g$UZE{;b}X;ispfZ}Szrb0V(Zt2B(wag z4A8xn<=qT9;{a}nUjQCe%i%YGfGxkI3gWFtp(36D=9vT{h#Z?1&##zY%LYXc3!X>6EEZ0v)G z9Yo{Z_Rrof{I=hJU)94tN}XU-s@b_{bHtG%nI=U}kGC<%V&hi`v3#MLIuzK;YN5oE z+lZ5chC^fA!;1kA4vfpl5&&S}{v2k(2)F&@u*;UR(1P3k4<%ZBEu8U-6R>=`K`-`s~ zT&bYlnToUvDem@ zx|l3@z7Nikm;|tQB3Xaq=fVL|j0vD)F~5zq5Q?>{T~G z9N{pI2@`s&kyt75UKpzz$v5HsLAg>=qgSCkqv#W*L(xAy0f}PdkxLsurOOc(W_u@2 zfK*mGqM`|St7ehQb2w5YdKELSIeCT657wBeLS7^&|rFqw;gUpQBvNUW9NZmde)H0Z- zXlrp$2!MlV5Ftl=i#%!ho>v>X{+~wkYqn#>WyMEV#p?4`&4!8BD7RbpG?{e6KbM1Y z!f*?FcX8tWDSJ0=l&mp7vdg|nQSfsmoj`%MbI}9=dNr^rD($UG{qAE?54C5Ps+-{1 z7mv|*p|awVH;q28Wtz{3vt$wG#qGWM^va0yNB;AxE8rOMxvK z;Sig_%tyRubPH7ST%Mh#X95$oze5kZ-VqRlg}S;PRk!BRU!=VtGsJn-p~2BEp;crf zQ*zy97gVe$v<~mUk?$N+U)}g!O(nR#I3=28o}{!qg>A*KJFr@guqweKP86&Bn!TlgQ|P_z8dS|7sFc^Wsyp(oV-X* zH?^TMp5px;G38LPOp3+6xNGZDRG1DEs|{O47a?W0xb~o9>vz_L6d9KudS5lqe%_U* zPO?$Dj#YZR^*@s|C&8y6Q*}2>gLes>Ck4*TKqP|7`5}WKHv_RnX^{oEYolDo@2Bi%v4Ska zIS50oOTrwwBm%<2+HKdtPlS`ZI4u@Kt*_T2Zdg1HO4hS;GAwTeG>&cfQ3!Op_-Mls#X|}}R7wB-W=K|$y9I0`Fm14?c8P`%J2IK$ z5J9ZS+%}6!r+g|J)dyPN-sYs}0J3PzdQEBd%<42KBD31gDwT`798D z!i6O*QK3kXGE2P4gfaJ5%2 z>@~Qi%>(frmws#D)2~}~Co^5H0&1s6!Hft?pAvfk!{&f72=W zbJHY3k0%Vny6=8xE+0>MuKF?bY!rwQ4B3L)m;`LlMT8r!jy2sfZ}>et7|QlnemrtP zPouW9(_#yaHbXi0$AI0Ilw!?t)!&Ca@17DH_M;ZSnT0@nDUI~Bb&?FGe*Wl{Kg933 zCA9)LfA#;dcGgi*_V2oXMGz1X1|*ai0qF*%8Kglqv8l)5?l`o^#RE z0C#3eUv0eE0@7#A;4i(KLlQF=;DD&H`-&HmWS!dTwK8R~&;=t@Jbz(YTnOwP*6HPo z7w$es2uJs=?|CD2pIz43?Y}H3Jl^{v?f*)Af7aBWc;rl^MUFo4C<()lX6R~5vuX)^ zIdmQ9Esy>>_T>f%>G+Xx^>a~nfo(bR@zyu)EfknUob)^40r$rpc=DOMO=#oT00eD^ zw|)=d;Q#EO^@$(qroG~ywRsE3#-9Ka?zU}u)npkoN_3+B!*n0-R%Rsz(6JdkaRz1b z{FvtmI-X)F{=v}ucKhcf$Qpb0hqbTPT2Xy!>}e1UjZ((BBV0Y_4(f`cgZ@D~FH);r zFv(O(=c^)msJz22k)SD8MvD;)99Yx!6_K)YjGu%LtuWu@u0oy%{e|(b8yV}IGQR%t z^cL)4OiJpnWR=3;eO3CyS3w`P^51{CXWrp5X=DXx%)H48YT*jFKTJw|-ju5~;L|!j zKUDdt_VkwKZ5Z{z9ey0xZE%vFI#VNvO(g?xIEfHShh!0?g{Xzd%zf!D^9}KPE^WN^ zNYe5H83Sn})GI{c?3diHow+(^GO;%`@6(YT)KccWI-Wp7&X`PUAF6f(A^<%AF_6lX z-IV|o^IB2`KGmsCKGJ{55D>SNrBzTb0v)mBndiyN6gLSvZ`hAh@0djqJZi37mU}KC z^DPQP4|zW6e1K;b#t%49SO|ZI%)pl)D(uwA-WPpRH@9@#xt{__+}lO#M}EBj@%C`Q zl{78RJwJ^AE=Al&xKvwi zjafdO6uPxJ_9ahh<)-rm6GK$eFU>lEiI55L3k?aQfV3~mQyIn2;XGF7M}SW9gAd5^ zQ=hI=_(5zB`aTo)L)Y=L#Jpu1qp!%YKwksL6DVP8iOEQiNRo~(bv1Wrh}n}c?%$Dx zci(~L(cZ{-4LHlBS={UAJ|DdF75C``i4(>T-3f5*^4sqzxH$6lR`|j*akF=G&6~r| zDw;8^$nTI6S6Y8{GD~g~Fwy3ZP+tR`fu1eGFVZVBL7!8EX=OpAYiwX=(Ulad)6*s? zyAdnM+c3^MQ4i$|kfMb)pogL-P{X4XRHI(zLnf?wl$-%qs1@Y!W55;I$Mrk!mI5CV zUksjgPlft1m-FD`mv>saBj}9#CC?*NXa@Zw5}=an{4#=mPnONy5HeRG5fMqyJ6|bb z{O7((M2biw2F^ONW{Zn=qVPyNqB2e>Yc4XFq(7_2Gr5bJ$n4!MV$3E7O?T@ z;HX@;`F-Rhky~}7X!B~*H~}PliO3H~qbTs;BCh)|2^S(1N*_ep2Mc&P2i&KQJ_SPq zqHz_@kZ4l0{K-HP!~~RgpnacakdAK|j7f!FA#N^A#9CTou8}ZVZ$5bfw8Q<$w_|;x z#Gq6NIfpa-i-%XNXD_??eImoc6Vx6&p@bNV+mkD2cacNmeiWdIJ>?5nc zB1|19LiOo|VI!Mug-qIF{DYOL6QZ;B>hMS3>9_iV@`J0fR1A98!2ZT8zFX`4a}g08 z@hukEcM6aW9-~5YKpO7_S<9yCtR|0u;+0RF){5}kKySHbY5zNkXTw1EixG_?&_~Q7lOpAb zcagTlZO$-k8|=gD)8CumZBSUJVoHzJv_-%3dTnOCis9G`dCYNVwLw9S7i~B$)y+tC z_-pG_FxB%{X$CR5B2kJ|#xLd=x#_H8Vw{QX&Ieq>oZ0|2s$&On3^R8&go=MesQU+z zlf_|et^Nwwh67pmDPzlH8B28+mPY<=56JxBMwYGksB3v033t7CQ`qn;=CF229PzEa0*^Fm=ZRPa~H-^fW!l*nRgh|D_IItni52;;ERG7&=ZqqDSMxP@QI2q09bi6RIc zHz$e=LWw>FO7P=XT=1_u^;achIz`Gd32Ww@RFnbF_TA(1*eg#O!fE)@ig9Q|ypl5L z2DsXP1F8gCWJVGiux}u0=Oi8@;BTLrC*q@L)i~`#b^~0~zPVF{OsmdboAn7?WqTv2 zU&TsNUVeQUY9O3cH?cI8MeHX0S_GjxX0`s5VVz)`Uxx~zWyI5(Seu_YQGr@MkE?D5 z>LjruI!2^T z#M{XCLs?}oXRLFP9S3{qYeLv{4cC(6LXt(3U{2!DZf)cYF6Y&dHQ_&CzF$10Stah%sgg8eM<i zz^fz*q}ebg&p_DhShm<&FJ75QHc)nrj}d)9s_RJP~oDKJi2^oA$$!FFQa-yPD^~ zX1u1t@@Clby8&0A=|HM9hlagsn>PHndU=0*&K9+%pmkx7@AnH2)Sb7}fHGSDb(L|$ z(TgMQnmJn%?9}i=hHV`vd#Ud&2lSTABT%jubyl}%SE=?))p$QY}()09;HIwB`s!HN@-&^`=~dd(&)>0fC9a`sih!*1)(i9;npBqF>ug`Vt9wY^Q1M zR_ooQ=QriFn}WC8hyqIQTX=cZ5)0$w7D^E|t_(^zma$(EGtA@l#RqkQb<*{Cy0?!s z5rA+H#?NE7T>iKV?PnW?I{tuz!MiEf%c*zISb2Aw6FvpC3$GGMti-J*)bnry+*X#IvT0+q#u71@Ix80}0E^yvXQnof~GJTcqLuL@3tWX{Y{ zEw9}VHTwNSf0u`m!m~AC5zrLXk4%)~dip`n#9a7Tu7lczw?cf(pQ(q4mAzm_N<5ZA z2Y4;bFwLNAEdVh{zl#zQdKJ$6bk3YBMn^LfV`ougO+<7I$ODD+7Zqku(NY;JZ>ry= zoERXjlK2${RrC(%_t2*6xCf=EGp5o#3?})*Wij-7v^?J|f1=0@a<1)eGRak0G@<>Z z!M=th_ir->I`7CU?S)vM*Q|2h@fP!)RtW!Mm6=H%0aoD`{Zvt&Q7$sg8n#g1sFJq} zQ;)&jx6sZwlve?@>YW0a&oj#$*Y`S0&2kW0$qqdIc{K(- zd69H2LsN~(#!B4J)2JcGiXpGA)rjRk}u#THa|eY2s};ADMXL%zd%dSF*$30-K#TiCN2iWM(O(`9tkRW7dXzu_+FWsEhPML%i)(shUo>wk|kH@*L< zCb0bKM#SKPcxE;)6Jbrxs;26rhPXHuwm~&3q6#n}_9{G8-@+BT^HRx;jRvA6g&){W zz;Nb1IHd*s6?xV#n?X>;EYW=sO#Sgo*8p6eAt2}M6B&k@A-TCL(rHZjjSw=pkP&Px zq1PUG%NLbUzu&3Svo8AqDG9s_4t`4@L|ZV2Y^XAHvIcciKv1Bg4HYB<#8+3R{T10B>xcTwd7G>Y&vnwtPTc1Ezzt|e77c8({ z_SV!qd@?=>BYk~Hj&(bpHd--wI{8_c<2`aOmZ$Y5~`wE z5;8P0d^jYHAOyVjc@w|7u@UP7Xbc%ko_vPs!xa-QYkv>3ei6b-U%d|i{Uz_|`BGvX zJGakV`!kqDD&(a`p%&zXxf`EhSb{wl&SnsIOJsnxjmG6DEIn}6!@0> zj?7@HhzHJb*NCRAHTUW}QLA z*IPM+KbBr1BpTi?w!7jJenPMs>BLaI^2qqhrpbyh8D}Wz+!y$2I`v4{DV$5tuk{_VP3=bJ1y^|o@HRo7Wi~G#L>#l zMy*1K5=Se4f+7FAgTZ4o7%?sRl<^HFaFB&P-<`SsK;Eql-4vOb|7`x<0{yLGTl(jS zHxjH3sC>FVz`RBWYQ7QeZ5QuC(dh{3`i(V4@S?9(x_32EiFd5_QpRtl^9l`!+6v~c znz8!LT$5CtDb+d4(4#teH9Yl*De4LNiB%Q@i9wwdql zY|2zib8opSf3>^zTHjQs8h%{Q1uqBGhb`(PEqsZf=AVla$?~jE$@Q_%3cimWpfs`_ zeiG#v_p5l`gXg1{-dSybC~LZHUlm)`{+nKh_A=8pMFwF~;hR&I3qXRKxa`!WFS+}< zpyUPRn>oY6G7p2AtZAOm0DhLj?DdQWP21dSC|wge!zgyI?d+E}gTId47lK>sRKocL zzmiUxxv&Tpnr)=^`kfl3D*5c%1DDDBKRqZG3&w`(K0+MlIwPM7FPv3Jrh0S8GUoRK z6Edc$u6u?TqNgC%u25av6aK{)kLebX>81IKKXrj2GCJdWKRnn{Gtr6Gs!UCEqQi=9 zR#SK)Cct*#f#zzk0B+)b^e&^m*6XnpNoPEKfmTtjtE?!}jx5_%5*6jbYf^h^w+M#b zuGsRUXap`KW4&aM^%nU}ogRM0z%`PDVWT;t4_4n2I)<$p1k=(V#UI*{=8SxmrQbX zmmV+ruRaN%sPTL+)n6zB?aE;fMS$ZYuz{02UJ<9_RHuKwgzr`k(S66O1LOcp7FjSL zzAq$kd9jmU$=RZ$1+PLyMy9(y(+?+;T5Fov3U*^)({@oLTQaXB&R(10NhSQGg0J|y zN`!>eJxna9G|&tYD{V$Qct(U;eA9%iFh$i6lw&wnP+lEA%#Qt!-NVou0LKe9du`S$XsP>_3L{*8^sK26qKAMS{{2B$An#ZGQA=emOFAMn&|Y0|#Z1-$ zkO?M)#mNUm`cdQC&CAH}AsQ^FKQ5P)JMqyE&Jv|#AxEOP1YP?$NRWa@cw*mdqYp+V zBph4Gj}6W(Q*HZE3q!$QamgH~Sf$yMK#m+YBYVG%TwC;Yimi2sMb-{qZ(Xs1NlLd% z8X%$1h#v`+f;tqZJhqd3^qamq1e4Os&`j6@KZNYoB6W*d6ipVp;pds2pE@qcqEeZH z59G3*u+dflV{glJ-Gn;nS)W-u+Y36^N~TMct=Te#uwuL}sjq}@t*Byttz&s0$98`~ z@7&V*HfJ>*hBArN>v4FrIRjUa61j6cjm@c)f#b91M&HIUsfXqay_!1y5rdrets9>+_mUdj#2M;7U^d*@|S@75cI0WiIJ$CN#_22* zOUL^P0SOQ_0e{dt-j;}FjnGWSGbF?!l%QW$AOM*!SU8j|#RVh(xa2D`M8oDq%{LdP zYMuRocp+`5oP$-8YKfNn-*UdOIDAfsSwx{7jElrzr$s_FcVe3Y?RZdp%Io=PJZw z=V`)mS9^I3D40CihYm!!2U~pb_-mP1HN_~WXxKG^SDYl*d;@EqVR7*g*b`JDfVP-e z9Y-iC{<3scZZGA=pE<=9# z*!qmj*P9k2EWhe=Xg7=>^^D$w4(LMH%~^C_Y$!6sY3%RRvFSa&)4?`lo=S=`G7n`Q z5t^*y-+Lt&lbN5b^y;gRq4|F4k<<-V<7;Hk&?1DPon|4N4orhkG9WC4d?Q7FU_D)>8>WEbZ@xc2eU|6+e9! z=W&(o_`BumgAEXSd>F3mP4HYVlVODM;~9SMJ zbdV*t>h%)wQ*x0V*qr~7RUp!CSNN8ZF(Pcm17sx7@k-rEyB2^cYb$Fgf<~$=z@0l? zcNs#rW_x$(2k53m5?|-RMZi^&@pDZ7FWKK3_%0OSC;sL?%%6 zkn2QZCGfi9$lZTYxpZ~N&XvE+5FPMhL|%8@a4rLlK^2VO)nB|fq())U^&<-F!Cq~l z@4Bd6%G1;RZLMVcmDj!CX_u&g?*t^?$<86QJ51+6BuAtkn07%#U#U{3*rWC3bsTjq z{-fF*uL#|6KkFlMh6gQ`7Z+{}?jcCpj>ucxPf66<%SDRuNVzsS{RI3t7?6haOLJSr z`R=WqX+bnP-z2Yg0||zGa?WW3!vN2JEMOM;blxEvc}x()ng{}`aK(s%4@>V%O6}mw zxn1H`MEh&@$K~TE(OmmBtxnuINOsy$jFLuLAYXP3c0i)E*2zfr;jP`GQLUHxA)aUC z(Ga=W;ZyfynT8|yk1HurXncpu{gwT`Yf2iOlg7ZHv#UYztI^xiT|LM5NC@4}d}ry9 zPV1x&S&lrRq%K{tki$>GWhjBr8hsHRQI;#&^uT7=J+*NSDetZ->SGKGEl|ColR%nE zIX0&4I_!YVP4`*gd1wbY$m z2k&V$&FR6Q(w>Hm(I+&-4(09pr#&rKjELIBUlFQVoheosW{OxmDZuFZO?Ne1SHOPm zti2P0)itUr@?H_%no|N%^9plx1YKoR1Ik)yx393OaKV<`>sVL678!cskzhKHWFjFg z=go=TkFT3w8&bzjU_)u{A>mt$jQ{E+UNNJWbhnIs{@T7>gwEGmUWX=*R~+ z8e(*dAw0Cav?OVsgMe4-N%IIxv;EI-whm%%0(Jrep!II&VMGTC)op|0r5*C$FZ8Oo z@}paOc-s!3+%W3DfTo0;g-^+1y+Y2FWcQy3$n0!=tW5ZSHBHg<*y$a$>e z?Y44yUB&VmK7Bi@=xFs@;iE&p=1MPAQL23n2lG`z-KrD5GNP={`Z>#wz4c!)=TlobvnIuRb zBPEn+uF1W-qXmykd8dNYqTStxi|6aVtL{)WTY-vgN3f;NR&JctR$_Z{>7`$9U}^kP zBBuw5ccF&Bo;xZU?2JniYL0NSU5!4TLi1~UkHfH}<;RhHSvd*zfb)@G1Tv$RyatR2yX(*ZIV>j`B!0@?KTtd^Q!tpz~vKCei?!&_l`?Wt&EFZ(2crqT|o&^kM(UOh` zlNx*L-3eiTTar_ae&VigWJ3mkB{xX)B$@vDpp|u0jkf*J{`#Q#_k8pV;bcwL3D+c( z3GvWzy)ehNX!i)Ek*13n`(sbbb0>J^z)NU)>J`0Y)Co<#f{)8Cv~<~U zb9{7EUA)tzt%XZ}M!v4K6Mwq;DAmaReqGtBUna?ksday(1k`@cJ>%_im(6-!9f9vY z-%OF24~&SvuvX(hq?f!Gr*;Zd^kwOP-_P7DWev?(KO+D2-30FyES4@;5Ge$Yu%m64@Cv~l{vw#?%|pcf}6>j?%>V@O4}xN^N6q8&dQ6zn|eyW@heUR?_}>7e%Uqm z#m|VqqY~_oJM4-g} zTBJYu2`?OTk$#TxX5pb>Q%s$9Cf!7mmpdn%i}IuxfHEyU?ed~l^uCrz$gw9%JzJ6j z+;126iOlHlcEb5a9J*DMZkO*QSKrMXjXT*+=b%_IAQgEI&Tw$*N-rp|M$6S?96W3t@Wf z;YdCd>7=v&SV|ZVdzq8-!r^_7Y$n0cGlZb5n0E+GIa^!kEnYfpQPzAq8mT&prNmauyruak1LIX&dHcsN@*P$hT$ zCIG*)R&mLWol6FL@n)e)#^u~3P9VaUbn<>eQNh#{rAZ{Sjgtw%G zqEjPWv&@Goyzi8`#i&r#0+nB&x8OxHL;3%d?toXKiSTJ!Qv(pj2jP5VrPvyYL$!=+ z91}5_fT3ES!(Dg44Ift)Ei`>oi)SMAOI_#NKyIf;nZ&U0NLY@dej@hzQ|2MTl-}#L z+rlkguRnd1Cu8WMvk2vkCXzUWhBr{uW&7yar(`0Fi+PxU?7vx z=2xs=_0j^b=c2{Sk+-H~~5y;M#uyg5*d|m?$d5hcx%44~vRo;mt z+gU&hdz5($D5@nTYdeKSZiT;IsBGU=uVw5parhP?xS7{jrcofSm5|zabGT;OfoOKi zGZ)jQGfu7z8JbL(kCG@GG8a$H%Q`+hRP-8Cp+m}hS#0$u73HgzRleigVh5VHkSz{g zhced(tbeP0@LiAr+?DX%hVMLsMxJ4{KU@=>V1m!5wpp-j5_7fyZ)Ws1x;$ zX~uX*7vG5=?%%gT%HM=>|0K6yM7WBtge7RF5%hE5Cg+Vpi*<4bt=Cd?&MT=WDlaRy zO5UFzZD?3*t42TaGSMh`Iqjoba`L^V+&ka4d2@I&Y=)&M>&X1-`}=Ei7hue(Hgz77 zb}vdN)~1UA9^AMay9JSUT_JE;M-BzUA%zXXvWtR7*Wz5T$mtu#MBeO;i)u;vXu-ng z2-exW-U+Q~uj%@KxZC(V$v@3TPJ7-A@HYYG`aL2aQmgUQdC@y3_Z|^kXxa-~lG;A| zw{GV6lh(RNHQKlfGIv$1uDFX?UQ+zw@ciwIP4;=>AAbkb67&wZp1pq~+#qN}l5g~H z-{f1b@c4S&(#Qg&_$lzcQ7ZAHlD{nw0FVXzNBvKtJN`xVSe zk1D*tOpxPWe0eW}|12vV;s~8b_4ck-IZa=i|L%nP$Lr?1j?SO{$p_ceV_q$H8s=s=>G8~ z-*G{nXA3}6_KAo?Y1hTiLE-HtMi{F zm;gfZ*cLPpY&D@SvK;XC_}&Y-_lIN0FJHaNBH^7lR{nDE-y7tC2e#6xf9Zl`R_F{# zdK@W%=>n!x9h$BG@JqCH^gI6;f{wSxYm}Me$kZXKA%7WA-A3Ifa`XZqbczp|dnY@m zzwrOh&rVbMqOc;UGlc0EjBWy~Mxnm|V_qDDBV-K&2rrXx$F(#h#{u2E<)Rlx?Rqzwrp(2wRN8*Gs*>v zn9yfi=Oo$H?dTjanR6QG%42&~oM{|T2pM_k&)fuEU2E?1|AljuOh+)Lso zf^{eOye0(?h2*iOe|Saqvdqb6uj$k_n9fzn?`h&Mz)Qug8s z8~+;)O>GPmn|k?=vG%tG4){FTj^MSypPvl)FEgJ$`eR8n8>WGL0cn+m(es%;C(8hU z7jOdrAF#a>j4vy91vs*HLRsl+CKuiNDD_NzpK2x=I{mDSkg)wjOFjW46jT2Oy2uXg z%he)TbTE7yv#z`YIK$I;X`Zyq#8B1H>*+A9|FOjb#=rP8AckY{4>cywed`j7Zu_0o zp#N1Weh7c-40xQ~w>?y6qsGpnEy4%*#<$1K8(HC$=g%L~D*zywF-k*6=~TA`IMKL( z28()H^10%4uG;4*iR>fC5(rK-^C|d@K>HeZ-~qR?N*FFb`D(Qt2a8By0frz2bXf z5Ty-Fge=43Q2AmH;ZP2Axo7SW)4xS$x-}QAu0S?{dcD7q`?9<}|9tB;J+{UUc*2BB zruPoOb^%BLGt)CQ4w+ljLbl0Qi`IG5IZd8<-mqbLD*bJpq8$uxbLk)NGGLHW zlJ2seGEu2NTDg$ZXFQRklJpvKg8>#ay~T_3`p1m{tm74bD3JONBo76UJQyL;h!pZa zkQlmco&5;bUap2YCx~!!HK0rHJOS)NZ+EZ$xPEqP<}K;OUCMbHc7W>qK{en@8Z2&H zx%+3iG`i55m^)hN}a|B zO-bFxCss||Kt{rdRt@Z%rtRxDEjz^EKxB<8pca@a>!!8Y6`pD>4O)Pn&X3?TPU=A; zUq?YOdjJcl5+EDQFL*Q{$jXCj$DjRvy+7-HsLVRU(mZrJZMFFN4yWaM2NAD?gZH^1 z6u2jwypKLB_H=(=4OvFvSh88fxaeD(2l$ zYMW+vuKw2<=}jC1V53Wx<$k*XJ#1hb#{C5b@=Y{I#&j5L3?9_$*P0bF#r>X*cj#E-ErX~Q$(e{%;#=n@J zOgfj<3>yMSfAufvc?S~gV55ip=CyP%IX453&78Q4NWjK67xeE9UCj&NX>lr%F0(~e zVDF>l*OHl587%f|*U@?2@#ifY=HblS7KT6WxoE-xxtE5{Q0*DuuV;P*EULlGK$Ev| zOp2?43T6X@S#Mdp&BGOc0Huh?@!8xmf%|igbFLS5)z==|SbSQ zTJ*e5e--dQ4ziF|F10_rh-uB`%rju!smZW9{lGa5z%~bj;yRrvUs}@Ldc^Mv;68y6 z%6evH&(x2^#r_#I%WmdcVjTu5Hi zez(ZBILNsy1$n|^Pw~gr@g_Sjm819lKYoDwYjzn*b9wx!xihR7dlqr*UUU0?DIkCo2px(^x;&m| z?gqwD$JT4%6z94%=Q*z!2#{)U(NPpDyK4RGi%-gjt@%RCge$DX_^pO@Oww+<*jCK8 zoJ~Ouj*#B|E|`v z$cBo-}K%q?m{%=}zl= zg66VT%W$4a4pLL`;kRJoruWS{f>7SRd|bcR*vIn|kMN+s2-rTx|KR&RXwhBX#RK-kiif_*9U)J!D3}iIU6Sq} zq5 z>WhKk&FN8L%TZB^ZhV9Z7*i8;b_bVXC6Bd2zv%amG=mNC$;bc7a1#uAUd5fM!jhnu z-4z)NHpT4+I#m;a9R_iMTs%};hufJHyJ7)=SGJbXVj1PxLUJ)LwAfg&TiS7-y*NAk z7i+yi_|@s`V7pkqi+T< z{#rRSVH4@xp9`OEH%1hpWR9({vCYjcspDP8MzBs9iavF`w>#>h)h`GMTYS+LL`aQVe(b?e38WQSe)`%mrT9q zY4#lNvCz+0EWl}TRau|lF(xUOy)W4>2INg`IjmlP1!x`C5kH8Qzxdy;?&I0EyZA8Q z{ifP>v;E}Mb<6t53M)fj1Rze89!D{sU;k)fKU`7aodK-wF;QQCM4_8K_o^%hK2KN2 zNzLhxA0`Z#%sabBP{hCuPEEj!BnRCW@KwKX9(4y{x#q)j@?A7${-*WzL?f1Q)65W3 z)L6e|?zNw)-96YWe)Q}1RY#@pR2XNm-kGPM;Q2+XtyrG+Pp|@s>f%!J z!+TbisgC*mb%FQ-v{Yaqpy7|->zXc7W28zIIn>XeZ}*Q|O>!I|aGWegH-{WhGy-nx zC%X6aejF~>@VKDxfxIXQs-AEIYXF1|3LcT&pU^ zc;pS-#(+I&XQDmw(%&aMr+l^H{IkstRdgo87cW*M@XLVWUxboFkcLu|Dc#CI3e451 zlxfT5Vfes&e#|p8Dlm?lOkV-8c7Op`9?gnQKfyY|B<_|TVBp^cw1X-xq`}YCzu4+h z#Q>Kp)(b%CX~^~7zIGzySJ!sqN-yWUyyE7AZ#*Jt@O6FVo%LH?=GSJjTv>#}No*xK z1pVr`$t|=Pf^Nwu(XJ@SdH#DhFy{b(;&ZAG8%pbzauk*-sI-O>)gsPCgtc=vm;rfH( zi(c2htrU0L1!2>dA!e6-Z)S&ekxYdvDNMGCkHJ^rq%LKVq|Z}GGnk?i8TrJ?mel-# z4xx~ws=jO8+75$TG$v2#6T54gwxt(lP}o8GY3QXs6@|VV(e!aoUo4bARVb7s(Zi57 zTk3M(-wwDG3z?tozvfC!BB*9^u+57|0gu32g_z@O8)C|gU3=lCFJ|JO^|tNo%aSNl zhJ7=Yq}x?HI^NJg#;`5|Hr`LXy`;LD3v6*l>e`SFj@0Pm?}zG^@~Mu4!H0k;%mPz7 zC?(^XzDtd&JORTo3;-gO?$`ojIc+goaWH*ZXm#-r?XhwuBwd-rt7V(o_&xn+=vvi7 zY)_X*WsK3#go&j(_A=sfZ5(W&j0XD(P^=B*$=Bs`8sKlo(0hk^VLh_u_GEoHkHilX zYa*HzJj%qFxLf)YBO$S@4eA*iZmyChKm_}xs}Q2vXazGn?W|JGJ1vGvn;ijvHUVVp zn~x&u&D9m^^kNgahg^kLFJ5Xc*oqeYUz0~AA_~U)vETh9R(%(FquJpQ!$+U=1(E*BdZ0fj{ z&u|EA2QJOXu74%zTk3lP$Er9sgL$l^^~!@b&aThi8(IqYs>b%ou7S(aik-wMX7EXja#_ddpjCBTgBL(uI3c#`Q+D)1}T>b{6c zun&ll+wS$g;Ioofm?0220=?a_V&&Vm`2N!xTB}{T9Qpi?`y7qOcy`$K-0*yVy&XVbrXeYiIYW@Er`|^nt--fr<=y`D z>P>FWbtAh2zg@K9?=`%X;;Y*>Gi=oC2(|;z{h4#8t-M{Bt%8#J?Qo8PY6MOLZy_15O( zaC2o76Q|6DKcwCtG(tczsO}G$f8v+Cix-xhQ3?g0Zb{t-st8XewYQ6En(bNCo^ z6>#eSD|SbQ=Wni zygkVsAU-g#r42BX*Hw58HeYXX8WhW`%mRhOqGdzkQ3JfA?*hv}E#?SS)6%qkQQzF~ z(x#;?Xw&mvBaFiP=Op>T(ShO~Q}>L4L(>{Mgf-S>KhfuUsuj&mi&aOGUk^heiH*Iz zoCav_Y9(}DzJI-bH?IVk#Cx&3*WeY6+my(_!4B-9MRH~u$=T8&-;K_l#n`3VH`Cj! zj#G zpwMAS3?!F0O)YPAi}jqWFDz=lCr&I6$O8FWy(%At`+n6mJE~%I|4+U5%PU+`Mn`68 z0?p!Ac$_hz^`5jYugUmI_M=k(RBc7IJeqq>Z7@vv8!{;8Hn$2{mH6KIg>d=A}mp z&GZ1Zgxq-J(M+H!#vB??Ain5*TGS-0pY}-HRrSXsesbw^fW>g!JeMG+A@|Mh5*3t( z#n%Fvnnf&ilP$Yvde_fDqam@iOC8N7&T`;*b@U0Zw0HNKJ$0T)!x26E= z_>}7mEcnSMtJ!v{8~TPl%gK{Xl)2Z%5&txB4;ULfJmIO|_j~e=KV)Op(apxGov?dW zTi19QXIeq|K?~|+*0#m_)Wz3MuPru~|HFy*`HtWa5b4lh;7xVrIs<2=Sp_HC0O^Xv zjyFJ4ZAy_RgK`$ZE-NY(FMeH%+L?lSJmI$oGGK(ccFY2o6hp2MKmp=R_%He+61)@s z2{>C>b$F|RSklc|4PN^dC69tB;5T2KYBBue-3xxpw|E0|J=O;=eS!2 zhMaH68gzFWK|amayKF!4SxIUHXg?w8CV9|uqhAsZ@Rk{CyX#N@A$fn#wz4dgoMmRP zVdrymTj^r+#S>Ul`o&O`$E)nR%ncO;m5y0ZPt?c8GAY{S?6z(?&%%RGEL|y_#`&qi z^adZc-T{up@cCWT)|fRpx-`sXKblZ#zx8VKf<*kH?BKK~Cg|OD_>fUEaT_+U9?At= zC&P+XNko!6XtiuEWN{(QUdwn?528rAWFJDl)oM&O?e_NZRtR0UT2O&6*rZ&+u2c#j z_YGh7e*AR!uQ4E@xDp|B4F3f{F=cLk-T)oMoa!F%a^$2*g$nOx!ikN;&Hllg-d-WV+F-=_^?(Z=Cy9W9Qvwt7Z%hO}XnX%lqy&%*fA>tz44mgc{ILuIR(In;+~= z#0H-ISEP%)0@D*xrh%;Q11V%}Lqr{Z(HhMrPYp+dhBx3AI< zK>)EfDngrMWdYY97PZgGT?1!?ZA^9#u+uI{=_~N{qbhpgVd7z((%9b@DKzzE6}aMZuX4w=39syh8GyvQPy3$SV1^c%?R1R4BLjcQ zNZ9Q*=_bVjd+Y2hok@sQr+ocbO~da-!A`|_NzV-J5g;9kjLMb>`yIXCai4P(ePgw! zx>WSJS)}=y_0xbX=@KRD$He(^{z`FS0r{%dFJHv5yt2+>`zn(S*GaKLJk@-mq+IdD z;(hG$^`zT;jXf}D_Gq@`txHbfr)d?zRg>4d%V`yZGdAIY@4g*Aw31uRmX_nvfLe((2g(s)|Q2S3@Jl6^M>} zq;A4T#<{Olr`0D1)W6?Jdwjb_?KNnOhWqJttQ_NaD8~nWJ^`+e>TSV9Wk(YtWrmTR zq2r}NF2Bdv8NmkT%kjf?&Us1zGu+%PZH@`0>?#*B2kfvhK%{D3$nD!*iMDApL?WCdgmMt9j#qcNhUriS*jU}TbT%- z)ygo6BmF3)K62G}X8m|s&+jY9zZHDVty>uQOv2beFWD>NS7p|!TAM#CNlN2H31dm6 zs6_q^sAtFl6?RKv0a3YO`j}|kwznR{#pe8UM0q6I#UDIYn_;L|M=&yKg{6fGMUn)Y zlS2Kn#{*Uu#Yufi8W*zz?+YXOQs4-R!58T0DD;VDC_Ys zYIDW%i{){}cqHB}r_4Bus{*82hw`JLXg2$?`cFB(v$%%$r8>(6QuTg=@PDEuB@a8w zkI18>7+eRGtKN?rCiGg>0=&i?g2h>))#no}*HIH4TeqdSYznlCR(Ki;6UtemD&@l- zxBwvpnnWs$r4q=hR>ktm=IsGtn>QCfSye6-BOc}G#Kz0d@aa?Qq*|rH6v8$d;g~vu zi(@wok|V90LGxupcc%M@%jSrD;XCL2z`UQ{-)j{_w)@||Pf&Z~9!@q){OCh4fRS_T zk0gNUEww|>eu@Z6!BF*iWy-PkocTQ(p?REe)TFUny1l85yV&VEqO* zO(1R)uYl&lF_c?=cp0YhU>ZTo%2bGVy&fd<$K*b9Mx@V0Nas!LP|{ZNxD4vD6`w;Z z*Oo(Muy4N%WUzX0anD2o>EBarXvE)z6@5` zrn_l9D{6#zWkF!2R!0x`C`G=|>sEfDam^wm9( z=lVTBAM0%DRALvE1CsW6W8OZCg@>5ba&-B;_?0tX8IsSoMo)ppP^WOzj}~@?NZvIT z9ZKdbyeoM9^JcYX{fc}+W-^4Uv;QzSN1)NYTBMWyEboAGEDK?OFk_GlZfIH*gpOv3 zHbwFTs499X!e6R|N#qsUtA2TiLge;kFB~-dL>$6P5C!(FQwUk`zT?&}B{4%^whE!0 zFx+k6Tijf~%MYG3*MB?k$t=*u({Q?}{+y7YMw7#7JDQXLf)+bKtPa%`-7W?8FG;&A z0e{&hF*(g}#sI58ZE)7h%eO>{gcq--g4-?t<4bU5PpT^rRR6j#KfFKWyu??UL1PEs zVSkJ};LaDW&>Helf-lmn4Bm&Jd8hNI>Gu85 zq$B=I+sEd?vDw)d;<*{&_N*CBDRTKOPWorp>^!3rbUNj$x`XJ18$oePN9=yiRu?}n zQ&XqOUt~!jMh50YQ5%VqtP}lS|169DQzdaoAGaK%;;gKV)c(}R_OQPqhzV*g>#^~j zm^pzP|5J_GVw6ZhjW670Jnv`ehcm@lAjW-36_bG+N~HcQ{38>Zu=;6P@(A>xJ)lL8 zwarM4hKS>XEdMR7I;6I{$!U3ZW1fJA_Rbh68e`PcMaO7@Am@U3g z+p^KbE zS*u^8SB_F6EgZ61y!79{Phfqo0@8WLWd>2jpmHf=fjo`X-K4|6EFRH(3kufahz2%CUE;|sV-h|;G<@RwpZ=o z$0LcqW^LbnvO0Tt6f}1D+Gh3>M#SndLRlknPI7xFOIMSRUcX>l&Ge(|uxgDVtJp8PKs6)4&cC;!E}mo5q9TI*JKI6<_#6TO0jEx2fAA%5Eh_ zeD60pwb(lg*S)@VOW)h^|NXxHxk!#hG^@#Dq4EmX-rm6Vy4QIud66TZ=t(GvGI{ns z(vr8qZN)*e7YOL)bZ6&i?h0Sg^Kh*}3@sQ&3?Ud*i2a*dp*X_=iHnK)lT?HE^ zVc)7=S+IofIk5-|l+CFLCL*M1d;5ILE1RHh_@(obL=BAXEHz~!%^&gmyV&*b$Rh%-V^WA_YL$26IE#3}_0hdDwLysS4jsLgM^nwcFE zlWT}9EhZ27>|v5;FJ6eKg4Yd$8omR`Rl;xe-5r(hn}FpxjI-v!#}H=!69r8*WdAPt z3!)x!1#iCTGK1y@AM<1L`Vw>njC{YUtdcM>kja;HnSg{vca@GTUh|xhN&0TyOyv_y zX-$4HoP2)wamehVLOA6Hz7dZk;6*s}it5Tm@X$)&V*ZZJYB@kz3I; zDl%VzP@?+@+m6@C7LcfsCS@<{{@Gdb01I4a+HGGgSKylt2_N_TI=H<|65k#1-o9T#*SvtUp4^>V{=!lw--x*%~#R( z)^OT-$+QS(x7m~8vgC5V;fZ@0D_my%O-|F18z$6?srd;`Ac z5345=GSPIO$YizMYBvY3x|U9=4i=3rqy6DJg+nG zrCgkFuZTX(j1}K}Pgv}oaFf`S6^_8#T+dXxRlRvTVDn6co%gLpcx^s%qr39VELN0i z@oQWa4VnSxdcq|cA8&fgC?s25~$R0tF(WmL!y7g6{)8nu{* zGhbNdJKCu>*y=QD^Mz*!dsH0b+|y*RG=GBWL(Xk0Qh4m9cmzm7@*S&gyY`^UnAzd?JO3Mfa@A@BSmO`ZRG6f`6JDKDnH3#qo%XUY14TiKotMI zoq!dptKW8hU0ld|k#RkaF7_)zw!xN>qJ51)J}b$(?NXm$jN1RyN%1KTk=7s-jjynW zU+C=hP1*Od%&5^XDPlrdfp0L+t+Zw6Ba^=uSKFXn<^KC51vCfG0d6dL4=q+$Wz#=? zHkXZY!wwZyFVPiLNcBIEjv}cTI(y2SAJ>Z>%gliEp?G=O$xmf<}Hcp zP34%?mN_A3ke`hDK(6{eU8joM;e&>1$TpI)gtaMGq2JUFl-RO zxZD4ol{{uGfFv`_GPiR)SEe+W)vH)RM5wwa9FBXfkBk>yvLlvyRl{!728*WTpQ%5b zlHwQS4JIW2g-s#QF=d{1)vcgh{*-$45h?G@6$lp=s0la6r)Fumjmua zHF72xwaHa7_(ntlMy5|vao|!&w7Bf(lwFk6){fh*`f1ubc&PB4|7B5hDCybT;+gk+ zx;8+5^Y9gMBL5O=Zt-w>*d%DTlsA$>eB>J;{*tj>geq`0rnZW8r0p9UAMv6?a^(jcm9Gg z2dNNTvz(~qp>__Iou}F({@>?|FiTSw2fNVYTYzGt^b!KRv<-fRa-3o?;U8(B-_iofETn-CmFy$^_Z7exiogc-2pzZsv0s*gFH9 zf(bvC^@s);`_1ykUXNBhGxl-VJD&t5*(jzB9#h`VC3vb3RlI$nZPX`$kLG&`?zk78 z`hMU3c9(y>H69~dl_(r-EBGfeU#r1pD7J}t%WQO%Atd|6LTC>mr_MQlMNi4l&bBn8wh3!1oN|)QaM^>DAfA$ z7`C#$j@J^U>cjsqb=TixLw8`ux_m!4y%g9G6KV9hT$6#ZFEv9jjl_(6H;CNy z8g72~t=xZx3;12teGB|1(zv{!l@t?faO+*alxC@+#h_bl+PkzLbl?bXFkY{rF<_K8 zGC$zB!KBoZ-3>LZc1~tJ=pz^INiaovb)s$cLnEXHo7vK)-`-(ejYCTOy`G8Te6n8yvi`a|rPmLI z3A<;Ki{FWPyuJ0d4v#s8SWjEq|DyB|072u$@pOb$?`b7Mo0zgZy9_29qS-h&*qsqV z`h@NK6%c8H!g3Ai9h~+|(_-9^PWSqgy?Gb#6KoDy6GQ|s%xM{JvwkRAwcnYN^UKbC zd?&|8oQFGcPrLEMkU=5E)n>NBjb0|k5diHJL5aEK@Shz$fByTDYE~1xd*3JhSS}L9 z@0s%BGGfV-20!|OOFI&L7p7R6I+>}}?32B65&7)(xNGYoRHQLcLBW{f(|mqAgG}bR zPy_}Fr@c7x!O@cBl6}$SNw9l0Ak8@LHjVZis(ChUG-msK)3B>*^kx<}2x-q|^Xfpw)Dp zoS8?ht?$6c*o|C&K8_BH?yEEF>F5_YXq@IEaw=X^L&u*2H(m{(pPNY8=bYEJP?Teh zBELr=USE9h^_Hl6fFL_;?ahv*I!z0#DbDxveR@I4&NZr{Dt%l=T-NcWEi#b&SwZ;h zMUTbeqYRD-2pC`Ti-&u~x>aIDCUin}`~-h&aN43$rm6F~7)dhT0FiNs^(K znAiK!fyavL7uNQz$aiQgUI-X1r6)~;6<3~`K360cQ^8!6To!SZwt?Quo}*qDtQ0( zkqI(;(`ci!Iyl!yEWG|$S6otEiG zi_DI_zQFsT)VdfQ&`#O%_#W$_wpi^vtW1Y@iC7`EWNe`;IM(B}^^7Z^_<5f_?VojR zxzLsRH+1x$bqXB^xVJZ)jZ)I(X==70-MWEfPNQYSNQU>LyZ{JUHCzeOwW$w~`kgJH zN#VW0Dny)ydzuyc+klc^f2nNnIAjvF8-)L$(pOAiaYUi@5M$Lp=*}UdpmTi8;X0;t z>wm2c{#6kFTs3s+hx0gM@woosYVY2ZYE`-e2{LY_TICZqn6r@^)R<dsFHi4bfbK8WYM#0e>cW>Tn--9>8& zd`DvREkY3WB41Cau^Q|0ss)lbo@dxos;y#(;@)Ye#g2Ykla8W5=r-E#D+~M#V=a$v z%;&yyuk*arA(7wu^5_W|$epp`CZYoImY+E4XiCT7ZV}mUPr|p?f#u5=3H&ds(t#nL zM=0I*WB>oZ^D3S|((@zeRsgtODIQg7D|rU+Qo-}Jmd*2=WA6I7dB9Lav(Oh!PD!qV z7*3m%G7l09cb`*Q522Ucm5xz~1QD~U_j#o;NDJQtzV ze8unQHolB$u3ZC@o|PaYC*T#j*f0XbxN5FDBcO=88@Bu?GFowA_r2#j9winuEow9w z6CqcCYB4r_>eA)q2$0MDK3ORZ@TUEc6>v+q)WK!@REcydgPx%0b4{5)1;4HKp+CTL zA^4_t=g@w;ITMyIRO55}uLacqzDfUf1`{$gGFNiG5oMAc1m6`>Ku%sKi0SB}ET3~y zK$4JMd}x+pXC@kTd@(8<+GGId7X-lAiiNak*h&rs;>OQO2iZqn*=*7s(oazMXZx&o zcQ#vb&E5zGQgVjab!z4iL#Zp}I<*VYlpfh^22FLWh3GgGtJX6j{p=~nVT&yCzk$4l zSxO+6QFr9E%?uciUOLQFpn0*)uDR5pFve!GAeyz9Nhy6pjEHUDm(JtvA)5aE-6I%x zKSeHT&U|+*l**Yw{^el6(~JJ>05CAi_Wh{!{-e&c2SjrAsAI%I7PlEp4;Ucqsb3A) z%^&AZT_`uY^eYRlz;|RJvn!54tV`{{(BjemV{vJ`%K->HsCb{x3;V0uebe{Xeq*U^ zM(lc=2$ahbjGKj>>Q9Oz#ya+!1R$(IYbsV^}J)Qc8d*@Hn0yO*LyA{ z%;nnEIn4zl8WlFP85&km8b`UYqmF>QQPcnRm|(x#?y>=Uq~&Plc3%|LK2;{y+vEl2 z3QR)QJ@1R{+=#u-phHI>WF6crl{BM$)6jP8JR8tqR{=O)ThrbEl17#>ARu=FFpt-~ z_-z(jtZ|eyn7Gsvj;{}B6qmY!F%3d@7a(4ksbJII2uOWShqAo9vwDH@bjyvgDAroc zI-lBcg;C>7eS39KsYYpv?rU61??UEGo8|%~&Y9heW_P#4@G@W@GJAzf;h7;U#mD(L zBPG?aq(XkK=xDjxte4nbnBQ~2SgT}8j;!5k@}eYe<{=_fWOt@A5|z8m;9pRv_QK=@u4%U0+Pyn^vak6XXvp={|(T}H-nqn1J$r6Ds?3g1i z{{}q#+eY`#7pe;V!J)euF46TZ76bFwYYb3q>4)-?SzveWaKP0zC^R=5ut}8Xflq%D@XM!X?1?KF^6cqB^WE8V$P7Tl&42 zr-JALUn-K&jWcrSIjG(e*hw*p@F)?E>1Q*ij7>`E#FR#OO3u&MT6lmrKeyqb#IKGX zc|chT!47RYKP#kJzdMEa0AjdTRHb$VV^fJj>w)Ii=XPZ1oCH@87n$9l7-6l7ZUa8$ zhe?3>{SP3hXx?paP6r_sQrUI|wId>?4}L~G!J`V!cAJ^E7R{oU!RcImd;zcoib@j! zXiXE;ep38SxMMl{4@UoQmFRDOqWz<5Z5|Vo4PRw?asS%R%rMfmO;;u)?~piNZ(ZhjaUmn zedL%ett>IUQgJFBmjyK>9Q(I}L2$ zOrM*rs{HNr{_||Ve8BKTxUkBe8+DlEY)C;+fLl4ZuqRpya*Ti}Beye|RHh0~qDUu~ z^5O5{z{2K3q(yC#G+h!@8^a6@d(Hb1+P;>NKMVN*yK`g2djjv<`q>XAB6bU|q8#|8 zhJ1XAYjku)X@r<21f8mPH>jmRw39Omv?{!rUh&A+M@t^Dnk(blY8e!HgBkqUtVM#2 zN5DI!2};UM8TlIe)Ju^O6t2Q%O!reB_}#;k|3E%UU=Ual~@2S8>rv5cPd>)4Kv z$fWRC>oDIW@*W)VNj(d*w``m~=e8{HL8Hn$Df^^LXvlz#6{L^O2c8!?^{z=D;(UOQ z@>I>2C#=8X6O`K;{LjMrw{~kTsDlc7J&P-#f%-X@0-Uq`vWxx3^-I%uM=#n;D}`Pi zxW|vNg3_`7OCbI%E^qGy$pS;hLotACXFqNkX(q2m(5uvYg}U0Ua4F1oZ)%F8VJFA9 zL-yNibeUF1iEr(}g}Oc!UJB#vWU18wf1gcekS}kc!8MkK@7DcRm+!25hYVGqoR(uR zt~vuBHOsesjPcqUHg~qYG-)CjJ#lU`e_2&}X^W$)ZPV3(`^%^22hwf?_`p^5d9pOi6 z+U);uZt_JvvoE&&3zc>GEhJ2jF#~Vn3BaH%O={Qe9!g=~P3N=P^H1dZCxPW}rSN~9 z;+qAGy>a=1@1y+(^bbQVBCq@|fk#Kba=Ec266>Tpss{f8MA$hH4Jyo=A--Pt`Xt?y`YXWqMwn#xDc!!AHm)ChvjOPWX9lQPapLSYGiTK4PY03=fQ?MzxIsh{7ZpE9shxVc1uHTD|*?lW6hXS*$iz86t$aSE7=}9_b?rU~y z@2$7?DsH|DId6)mO6hKchR?x6b%sFmq51EgQ8Lzdh_X z4lyVu@fh23C$cp5#`Jsiik%9n#9#UzVP}4ZPNk;WA3=pGi2o$E{2Rn{Wb}q+C~1s2 zod%?))H(QitKj#BQ0deBna&*FQN<-CT5GSaSt2U2kFN{_vJIG^+02=~R=uPvr!h!R z?QfKm>n6xFC6zW$uhaE#+vlVOo>tvfH*N&#mA>bqo&QI9>G&DhK{Ywv+Vhtb#l7}u zj`^KD9~i(xLze)F^d2D8Dkdt^hMOuiizol`VYz#dF#?iO8n>F=ermf7GVe&L_0=ofKw-$1}q&dn03sKW^hwt|O|sVzU14iwgYo zOB8LDiaoz$HFAiv9sDO|UG#dd_F%!L(#=*(>y7Vvj=5o@{daqj(ATcO&dPvcUKY1& z%U+Y^c=g1{6%gfYo)iPKF~`H<2h00?Ulzp-dH!vS_#X#wP5z}-Q!H0o_j3E)MMn@W z81SY86S3?5mUhYDcW`IZs&JK|aQe!oQ-1%-dIoD_`&Gy@H zi=5+&*Ehy-UI7=mr(DDGQ8fu#-p+>#H|^n&$F4Xkq%d$Um z;VWOTt$l3j$AA!v^W~KJQ>($OIY|%f>u<8zNa_@$%+P^8HE*8{5#BydkO8WUJDN1C*uq=U&z7lJ36U zBFguk{V|U)5pRYVdmV5Px`-QM_&K`fb4d0nUXfy6+Z=&+ngnZ6o@} z4WO}m{Ox4UH95Cc-`Jp6A9^OP1iWc30Lnfxaa?ZrX9pn$Ofk3bIia5~fS|XU59huvlFNl}2THO8yLY1~| zF;>1vB73lK+I+|d{zHz95qTpK=e67dX;Q)7$3&`aWYc9~1HT}CqucHb*3u$RhFH0` z>P5hHTY8Ewx@qR9-tkRJvP&~^IKpS_OITX!|8zM%`Myv1k{AK1VrVJ!{yMw) zY({TsT!y;bqz70FDS>he!J$;%vbQ3+RhyeT|NOTU&oJhEFMw1a2%lYrJO9$uyxZZj z62GM%;3jg~Z6Jd73I#fBgA;66h#<%B2bnOF>Vuu|6v;XG%LOKmd9eHdX9u7GA~%~Q zBiUjS^*4W7h*E(5p8MIF^0tNLL=ab9;BdJI{iFlebS%)_u2PfX!7OgLLNT$SZ~P>| zae;=vt`n4bR7KZoA_5aCCB&?DZDW3{qAM~P!AnId2auX`1|+H-c#g-fMt@3}%7H|P z;(QYf1-E>wRd(Q2=k)?~Ak{<<_dIe1rUwZ98LU!@deW+t+CRoQ+o?_^Z(xfv35#4EOD zCg5->^i2%-5Evo~%T4zQ%}KT>sNTx=B)$rVmx-(sW-YRdXe-AV=_2{sUp8HQ^}4e8 z?}|xbi?LUKJkOfWYpHyO^mVHJ$YHeXyW<}uU|*$;o5X2km^=kuTFs{$kDk3m{c}LR ztfcM0WDq-Qc5j_G@JA5}aVn?3QX>RukETCd*p#V2g@SAyxVa7Aid}AueHT`V%J0=# z@I)|1)V2Tso0k84?Uo~8GZK!($=1G-yb0W9R|3UKX1y;cTU6IPCvi{VOyQ%%if%+; zQiq2I-hh;PCzWGSXsy)}=pKU%?607n3H_r%B6}hvmLiiv1--GpZ~YlL*WB%q6hDox z^~jYvgN?O6(* zPTPXK3&vyuEgkDpvYWIxV%ENLuWRYas6hZOE-sa=R}tg^_m3*1qsibUy700Zop%={8H*a%gG*;8IEnvBbA8-L#yVZY;k z;%vGtplb-8Xb|0%v zTer@Bw_l+(gLt5!QT7-S(tKm8b^Ku)9=!el0nynyz<>!C+}s~EerrQg+F6$u-k;$d z6_CTjuJkPwiMh$Ce*S?pQZTU0bctGrT^PpeKKitir{LJI`p@&E*HDYBP%6$ z1qZ7M;gFLBHvwv2U}x<-5kW0-iPJAn#hl5hk7Mz85^boi?r1>PYo;)55t99mbWJ9` zDpNCSqi+MU?Y^Cu9S+P^fIuh5LVSRyWM8_Cw5DK~02WcS{)2xb^Az@mM$rCp8| z{whfd%)-)^ir58&crFpdx$V6ZECZ1|s*pNS>?gq>4TuOMQr?@<=O zk^2y7KSV5|>m36s<jHWdzqIgK1Uazq?Pif-3_yPCz6ah6q-ric#~r=V^BN$PYna(s9(iq#t0=vp!!&mr zSC$kQYC>K?E;4eAr635`K|DTRYY0*i$q@ybn>@Eyq;a^0Hx5fziQU+t@%gkdu`rMy zA589~(b#TZSp-bWw9Q_Ltf675>V@hR)-OH}Bc0z*=rMG9JD7!$J zH{pF0$9lH`aZVQ0FvTwt_e%2e6R!ra&H-jT1xWn}y)wI}7rXYsb{rZUcIgtWSoc(B zU?H^WeZ%0eQ+LQ&_4!1PlRt^@#`ytatUMz14%gR+MQf100O6F*QiltPuJffWW z<>;kjR?$Jyp!fk<;0d-@+*48-c=rkWt>1V~u+VwXrPUME&l{SUuZcJ<(aafqYs+s| zf-wNpEp8~Dw?r1Z0Czc7mb{GK58CHdH5SJqdqfW~Aj4gt!GULtRFJTB@hE)XZ}c%j z$Dh>Nq_^H3C#HZsZ@Zx~K*i@!qmGOP|ZYDZMZDMwe zH%3B3<)!pwVh^XD#p%>;Q=+;5h4fN+#Rf0k@B)^Cb=X~>U$E~DulTRn=r~L|4pGSZ z$olCD#AWl-b?49}X+X@(MOdzbju8zGtaByo6{8Kz{{{0{AEt|{dnZ*Ou}hj-T=ue_ zc@zm%9=8_@?|5s!=YN&xKhw`0CPvSFPgZz3vMT;1C-!<@v`aKl14Esf=T8#uAfWZ0 z72f;vH>pq0#ftv{MqjGX99>uZjubqhsni#g-1bN-=nYcK4UGO zl+-Huz|tB@;ph5xNoKWv*3fO2VI+Ye(tz3t<+>J(ecBtJIu#z+3GdB@m`Qy>1MKj; zn{>CbN^^WK*X{vn4YS9@AQKy(@gKnn8Nc1atMYC@(BMoRrk5mx*1sY-F7W9WP2=^& zQiMxAZ)teW8-ibhGyv5msKR_Op#oT_*l$ndAH;`JyKl{kulNCD;tntPYJS?_La%Aa zA01L3m1^icC<>}5l21`|W=diH+477?L>E?5r;*hXMy3hQ`UbjY(Vse^yXf1kjC^67 z(elZ`rCTP-wKtNOc)kG=Z&io=%pFGh{HXtTv}F{Q2&9pYzx$RA{e3V1&0DdihM5~1Cy2Itf4Deq+J(~U)?{VAz z9*f>c+W_W)=e={f^*L=o3TwSef1<@qS=s^zuoZ&5nBWMwL4~quSN)KOlKf;3!6Dsy zMl5Ey>!zN{v9PrY(1m5I2RP~F!Q}^~ob6L}fKsTn%sK3wZGvRHZH+sQ$$@IN{r;~t zgSj&>g2)2}WYM~e3NnSv1Hwbb+tT<_KnSMTiA9~nBJl)w##Q|OxHhI$_<*F$d6IbB zviKU#-gNQgc$LF$${<%iVG0F)*AMANJE6B24ny0cVTXzWi_x9g%1Z4rLwJc+Wd&F6haDyt=%;FPcGVxB z8&s@Nzb>Y0DwAd(r>UsUtN>{)97cD(-lGu&Hk>wW3w~FpR`$>hmO#6=R;fc49AJsX zr&6~-H&c3Rv$WtQ=CokZ|^JJ}SR0WDUqCo(e^hT7GcHG}q|Nk;-mLNv(IL z6mm`Sa;qoz?WYvl!b!N(XnQBML<7@go@iJ70B4L4s;%Zf1-1&mH{k=aWH1eplha9O zae=p2(TNbNuWjfs$J;aexFd075B?HxDbFZBqq+}dBn~Kcc4o>8MN~1wjyfKd$mV6L zLo?wie)Yrk_Dc)j+3n=T7P_ixz0x6O2bqwPI?I?m@#D9~2QbKiMs*&iRz(Xr&!-p->-^AWnaAI+4?1uhUu{LV*k-e<=Zq6_hRe(qZ z%=Z=6*!tAIGO6X1N5|*8lHpdFKEZXLA5oSID?1NH0jbCj(*v$;aoF{r)H{#aC68U+ zvF5{;+!MEEn@T4wBlZg^IhE}6mnSjNg)KEX7dUBV+X1)NXOYQT@0NXJpe@6{lVJ1{9tuz?pMncE)_sd_lHofW|FBL!g}44E#ToGa#tFqiwpG9HQlH|BF$ zNkhYbA^Y(TLCZ+TS&D}=A={oTRFR~LqCaL3rh^9k(WcTLzbQ5OIz)UD2KpH_z{rE= zB@jN4upnEg{GIOj`3pSEXvO3VS?S9Gi7*ix&p!)woR^PDQWt^n>Nu)wK7OT40ovo= zxx95=7`3DdhE4QmW8&g;&-9~rr>f1&yMl0~H_&9A5>r1dKXbdgfk)=Y|6wKqJdSjt zte)@$xk}5CbV9t~=&VQ{x&(EAC3~e=X)*7aXC4m6^ZGKq3owRdB%hXStyJh2`?kq$ z(i17h3y0!F18XiyGESm5cxtZw3u=a3^ff=r`oi;7@;1VIUG14Zd$oB~8ph9*S4IuW zf!8`(b8XWS=>e0ypCRFNVu59|20rD6>WwMvoYAm}Rv*c-?E$j1mk76=DYY>vS`w?p z2BnRV-O9;poG&>8>L>)la1smHygB#(c#Ef&`MVx8s1##VJe%!zt^?vcP6DYZ9%@KJ z6)f{S&KIwPd*Wj*DTY zqC{G?ee>~JhF(%9U(heC!_ET$hk$zJvz@7M5#Y@y8^!gk(5;uRL`X>FIp;;k4rG>g&v4O(fS zXy)qVi~Bp`UYwRr`K07@b+K=f9QF$@XH?7|fd_h((m#DKVzMe!Oe?cvB=TKglKPqB zg>59vk#uLUce!r5Un9LBHTAIC9S`$p08&319>ybg64@pCzFZzbq6{!ynVgp)Taubg z>kWokPR!J4KYq_qRBT11@#HJylRdIqtQ)_a=ZSGRSkM?lt$7unL+V{^ov_71@SINZ z=+$B*v%EH~T9Zb|G(wX6s?EzdCo~6SeI%yjVEvNz%{E3Bv#8UI%P4ZjndfUeVcLT{IKUF zK>@POA~`o@;=D{@fqGuZAbo5yeG)tc1#EmN*NraBUAB~A$Z!xqisqqv#u!aJG&&%a zkOg^A<8RVWoVUU?nwCnt8##y`Ug zhDnh^v6IpO83~V6M1Vn=URtvMlfm3c={I?1pt}`yy3R91t9B?o@ zyRDD0erLD=LR@akOr3h?jl~VIH{^gNG|0U&!0X&LdH$eV)3QA7W&phjylr>GJLa)B z_x763>mz1+%(2J=odCbpyX*Yy{a;+0dAeIuQ>Uxma*>;On;(7y9ckoLsh-T%;|hq% z4B#hyEYH&hThI2|B+W@$_S)K)?Z=@!y#czE8Sk(Ook}BrLETEA`t81MIi}1~I?x-h z;i2=0@VbGr(I3+qdW|c?^+b3a3|*CRfacuB3IA-01%FFJSiu?1;< z`&BR&`OZs|$WO6ER7O~6dHy%i(lA26|a0RWECfodcLK(FG2wno$0dJle#E5gP+i^~b z!t!w7m;YKiuEt5w7+amDg7(MQG_|##usn__oMV!AC9A(F$+HgT3j=P>22#k}2tvx2tPG;ZCxA(vX}yN> z&B@TMB0F|v>w(b4CVA!Vdu_h>a(zfm6GvRCg8>|BzZb`Bqt9C{VD6%Wu@cIz*FdnF zV|2FQzlzDOe_3qfsAh)T)m7i^Z(X&X*H%m-Q8t{Jda!ai*bFjKJq$O@HlhV4dxerEAy; zti~z074*H-2zKEM*7@=j2w)#9+(2>XRZZgm3F=z^nU0;PLHnagK2fY>?uMilLRa58 zyaChiA=`evsa5#yBS5eEB$7{-z`NpI@FeUH-$Z*|W}=LEBt3~xL95X&S5tR`TO=|v zc!sC?MSkmX_`N17OtMbb>n4M{1?RtnIeIJGC{&bp^cS%8M;qcFz5i6Mh&AWB$~`BKp&vd=z=-)&hy0_ zxco~#RJ@$AAhyZw(rt*=PT|yP(LR|tq!Bh9yj{(cG2IWWUvafcHR?$x(S3PK!PYL~ z<*XpCS25#|pBJm$+F(Dw<9)ufUKNsSAjkI1FSOD)Oo-c^7UaiiJ@vAe1T23wdrW9F zL{T;KUF%w;y5L5jLF6`o+IN)$AJe3d2;3DJFj}2gs`@if*T3dP;55#PU09PhZClJy zmnm7qd9R^$^>DrKbEo5<3jMe|>x@5hwcCgK3$)4OaKxU^40X#yr&RkF7@FZlpw%&R zEe)rBY|4N~36>?&>VNpV() zYlNpOcpy~dlntY0RBTtV|Ad`~?p{O7p!|dunRDqO_3k!5uMDP5M22pRxl%h;!NGy! zZY72~qP@xe7Mb(@*f+W4pg!NA99I#4XpdLQUCkOYosimgF|4ja7m~nCIBlARsaa~Q z)6R_&>!=m}2ESkF3;dY#Ac3VZFT6qa)o15o&Lk!kLxb?n9pasw3cknmqgDzw_%Qyc z?6_n94{h-6odpcBSdp8!-Kk=ivfIve`RY63eD3jLjG?9L9s@%AGUiCaXODVz+|KuO z(lsSrb3~G>Kj>`{p!C-}wm}fwCr;jKeWL3xsHZnf?!L@iG%xf?mON$`>cw+ zCFj8rlBcYCRgm4Weu*EW!flx(%gSPQrgzaCgQRkug?cio0nW z1Lf(jym0H+*tka~3|)3LSLl%rVT6B;4Sg(&di3eMY<@vTaEr>@CR?oOefTakxfJ{i z0fm;NU+J?}0;w4TA}5K4V{z_sFZunBK{{4Rrc@4#n*C4H>SN`|c4MJjrxGi>0P8?E z8$Vb?W3(u*)EB%-1-pW>Z5Z%fVRgu-A9;GqT|M=~Yspz>@UU(9l~RUNM8k&uW8zrE zxffA>y7X-q{eb#VTdMB{+wc_kfM0u4Lc2tq%gVXL2e(350*ypIoMv9XT`I}7;Bz47#Y27V zAKE?CFTd72Y9E(AdO5t)sX(D%LYqj;K(dt~`SWW+sKs!nrz2q`4>rDnsuyjGk-@{4 z$)I9HH~G8b&!)qlPBy8}@_!{Mf6e_NZ~zvymjZD*1z={I#f10aDYwSPjg%g#W0&im zmD^0@g=gvAsvS5irB7VcF~(6((9jEzs`=kNL`};ueLIWCZM{6gX^htX24U4GwdT8| z!Q|=0#A-?3Q>TBFHi^vzezf;yRoai5Yp+~9B`JPRul7$Sxy~RA96)!*Jz_P zbvx!vdI28(toZTDi?4GGgK7#5E`eR4K{H|V{iSkQltwYB!|{p7 z#pY40*p=#*M^ex!dl;%-dmLW8quib=98OruJntf`kJ|7)(?In14@YJg<)G4t=iW@1 zzx-vsnJM&zV*CB`FN2p-xGYEuSYm1{HLqoBPKEXX!0CgioKE8w97VthN6FtKxM6Jr1cN})8%1H6c^16fkGP}2PqVb1s z@xmAY!%~d-X7ghK3r$DvfT{5o`SO(eiOeXUf>0_NNz5mlo?!ZAEWx2u~zr32J&W8(d;{H1Npn4{J4cjZ z)1TL)_LS^UsOaI#7;bvZjCE^Kkx1niJ3M`!MbMd^7*h?K_$N}_6ey4vEGeEcUW5sZ z>U=?5y@hMrwBaWEGx&URa1Dl)HO=chx$G6aY#Rg_FYRg{GO>B(rX7bU>?6Ln# ztJwN#Be5uXNigKbO7~Rg!N2bskLh#?**>iicSzqq&|A&(PMQ~$+oPdFs>v~7Kj&y#Dl;9VlEMA8qx?YKnqmvjb{9e&j=`Hu(>^> zG0RvskCHktkX-#LUl(He z1XfFM*tKEL;l84V)n2D6Vw?>;}uk`2d)j`Ps)`cZQ-$`+j|FpebnfY4kYHBfMw&zi9*1#bB zzC^h1Vx(C_Uy?|hk98+a}XKHQ?}spXm9xnuQ43%OiBJqs{_u%RIv$ zM+KS>3or*)SnwxI%AiuUYDPJ)3&a?Yd0Od7pSP zI4I3RKLx5jmcONgwW4huKrenlZ*@i3?lFczdC+P=P5%=uyVZBrGO>YrlQCPpg1^Un z11&=XG0H5`)}4<`5~bKhwb$w1{v_iMl{ILvjgJNXJFOele!u1xfwC6~?OVPZ%5X6zrQL*;Fx}WV zhH>JxJ1X6L2d*=FWN#@0od{m|`VWnQw@>w?OS-30?CYsg7~>VNUns>Z+w_{YBk0cq z+r4a!+EakE;ywGQ$Pj2DGNvv3Oak`1KZlilIFYmPW2s7@8)utU^;eq<^wMSDP#e=w z1zO}cNuOoVbsbGr!0YM$LoMe=3eOGsY#g?BHN9eDPJNew9!ra2>0?}B^E4@P1Dp)t zlDTCDHn0EWH`Ee>28Zin&V>5$t}KcyCXfr8T3$}pqPZ`vvg)w8&wCsyowkOvZzxcX z``$cY^E8N4CfE{8XdA#sybMir6{+;8bd%c-!cmYw1bXGBjy^;N4h3D3x37A8dz`A# z3cxb)_m~R&RX(?8ZGXdYJN#LtkuOVJe-#E%aDMSMj8RoK+lr)S?Pa`K8&@2w%^i%v z8?PC^l3)pczq$}oB$f7w^)H8I!=vsisJFvPvw39ha-EKz);=ey6xxSY%NU!=cm+3c zFVYs_q?$;vYCGvhIhOb_hxZQU?- zwQXsoxsV?sS83k50sg)8q~yK&G^Q$ z2@zIYrWGQ&4_890MI?y~@p*+kBokeAlj#gOB8{5wr&fnGKSHt1Nm0k9$W7Sk;QqoM z_V^Huq&7K)0)G^`SGoyGg~Qc8)eL4ySHHO?o)({C^=|9QBzCzs74CqaK2loFfUjDc z84;3)$EKCwa~_YkcK$S20j)KU#FnPfa&`?%bWp%&T}G2&duTN{sWyom(hTU=dW6qyhP^c8lut!$B&8 z*`~O@vm0D%v#Fmsy~FC?U#S+nUd~ohxg*hq7njV@Q_?8u)AO?QLD1GGVW^WZZ@PF`+3+y zK6Gk~l{%w56l9sMrX<={p0}8YNP7x*Nt~I~FaYQNaDR)(ho8>x>p#}%_C+Y$LZZRp z;vVub*0>^$(;*OdJEp-&8q(}l#UX0AZMi*~Gus)UbF(o`1y+Qc)Y{lOdilwY{rkmB z{Vgo^h!E+|L`6v{ifiG<`X{APE-6o)jKsAUaNm=?gu0Pa&#h+i*-q2O=^o10p)m?X zs_{!ci-4MMo4@j7ZBE=G zi-^h^r?hr;KgDW^@xF4{D~&|+()&gh==@dhf2#Bah#q&9vcH`El#wFJuC$Hcppp=_ zXjt|-UkwTOt!6_k-HS_kv9Z%)X4rG=ew%`^k0V3jzb$TUe~EQ|%D3l>r*Bx`i-%Ge zE*(ydvoc|)%JYVGB<~&GHA4vev3JH2$0R(BY-GBsspU_@W|e+|y>jw%CHy=0oE7&u zL6hq9&7KyP+@1ts4TB3rJBvoX1?UYi)%JY9K|fv}NQh?`STFk$%J>`aNh@uT4fV>! z=}rL~vjdhx@R?g9+vE^&kh-U8RGGS$lxkR-`W9(LlBD_S^|+z0(v{kL9y?6R^dk$! zQ&Ii1d}Jj>2ek?ARt98^-4T|V>8aN5&d91+pS1n>mrQI-Fztyrv&1TzX-KF=jZ;h< zGs#v>20U@AV~?*k(Y%4Q?5WgX1pCsKb7>UB)rvW+`GxEjf+{aIk#T2={INUyJ4D% zH9Fs9J4ESv9J4eR!&7LNx&~nH;(V%R`BdT_spd$*!=7lgcx9b&N%@Br&xUba;)8`uN{dv_1@rI0e>vO(p77-%C>pR0O6_0P1yzczasrYhXBQ1VkbsTs~ zzm7MCb>qdF!nZJ6JrKMfs7o||>g-0#&=s)T#ThefD<&&aaJbTzBkH9Ta6h9=VZ-nC z7|m?Vuxq-h?EBm|A1O7wMOn12iDfW1R7>_eTK_38JJh)o&b0?Mlzecr9IIUGvUo^> zaMmk)zd1Ac)1czHlr~gTjl75bN^+Q@`E5K@e^L6=1t@xQx;nd5i>OIvZ~8$*g+(Ec z89M44<$xZo-htI#-(JoC(q-T5vr&;3ROIb(jN|!wM^e4YYSNb3y}Ja#Dxjfk=IY+z zY{hu_a7{pMh3&lR3LUwYfR~MbGhxssp0e=I#zml@!w5$U+63(^KP2&k36)turz>eKIobWf zXhXeWX*5kvf8B%FnxU%5$~*pqe<~+20xR@+idn(^F39!%ep}Y*{R?gWWQ0ydz2s`# zXAisUwhpsfl)L)lZ2H-vzLZxA-Kp;8uzU5x?i;H`{M~0Sl%6z$%#(8G^DwEn0`rE? zDU>N%(RaJwv6~$5JJ-nRAs#ya=`9cX{NmM``7UFx?*RtH zT)_XuZeHfeVH>M&okILx<_g$!M-^8;G%3}_C zLlJ)BAF0+)JcRBMR{Zwu{sL7|#u;MGKrUtENuoGx@NMCM&TWYcrMKZb-*~15M<=8> zEJ%mnaP&g{IH*s?zd%ZSKnBIZhE-mp(B|O0!GwNS2iY~_UALP1aHcEis&~*!&&s#$ z_~O6^X+M{CxR`mYw!8)Swy0*K`+ZAqh5F~;zMUR{lfx5 z15zb9ixp$Ic8K@{Hm*tG{EQ zNBZ3-sf0!W%yeU2CVRMN-1{@d8LCriQ)#*-i1OwGgE+Ew?uhUeD$*^nAsTM31rJQP z9)~hivnN3G!^5#vXjC8yX0_*v$&MU-M)p|M@^|m;&;dOWX(6_RIjC3*mMckAcS4>m zOS&U;^^@8i->fd2IPK(aNJ1FHNoXf5T&WflVIHv@5`|bs$BMfn14=dVqx45{FNIV! zb(6a!DRL>a4ZjGv!P2?fSmd=ZZQteAJ z)d0YO=}|bpq5h$b1}d`is!3|{&2@s8zFn;xzipvGRxs1=w={9N(k-x`LamFRP>_Cy zfc;%?pf5RT(d(sPp%HXUpP80VcL!`D@VYt@4cgBinBc^* z4klrZ%|ly5I9q(H8(PPg#a;GaMoZl;XSIdH1~auWVnUPz-etbLY|f|*AD>q;U;0RW zAYjQoq?6ihIeuhW^38sN^ozkQriq!*&f9t=Y>~>Zln;Ae>4Yo4b{*m%q^3a<(;YZO z@}DF_lE=62KDY{yy!8`3e33+*F-lhTKvdR~@`b#2sE6t+ol_Dw9LVaGL^gZToCA>W8N&VC zd!(P`R*j23zn^M!RWTr+ao=@01YIbaN;X+8((~~y{K!JL#-I8k0Ti)?WzsvRTNG6t z*wqIfSHWtEo#u^1a(%@T(hm*3$y%6o2(G2#rGR!T_`2 zS}B;9;-5s)YxYdSq}HgBV!wTG3tda<-H?8?NVH3ITjW-8^}K)xpG$xc-mGVHm<3r~ zl~m4Q(?6?21Oy&;ajleTWSB*rIWFZstuNK_(xh;|Ba{?BAcPS_!Bh4$E6|?;av0v; zaHj~(?R>EX(&QsU+th2CjXgH+Rw7L$-n4(TMPvB+fj*VBW$~5^oQgr*gtb%Y^&I% z8diOV9u2t2`TJx(KovbWL;E%?+-Gwmxv><~iKU?RRp5cj?n3{EPo0H^r9VDDQuhpp ziL zZP-yHO_n0j+WrKTL2dR@pnupL;xoQ zHv?S=pL%JJWG&rib@DX?v?P0B@Ca@v9t?8Jb-lMXh}yIRu>*2b?O;o4+^FwSbkZJKG$Mh z6uExy?|C}ws?Lzk3XxfE*Xd!+V0r#Y)X6CYz|tvnmbxGJCNiY+h*RrV7ryb59{4G=WCms>fw^U9 zSxFi!Vz#x0;s9lCF+ga0W|0LleieAgb8zmHc&5LWn6%ZtxV$QWem2Z*c4$kBu9&C>TR$hNE2@dG3jT3??0TghiB z-k{NKlcFxf>`>q9w#+ynl6`5HBm=-b%@~&+ z4jm+1Z4(xgVugp4!Qn4D6zq)-hB~pzj#_GUYReZ{l=hPhE*!i#*jJWd-J#Y)y5v|@ zS?#jubKL2I{H?V&c9VIB6HT_|s|E-g;x#fdcg09HzaQs@ZSBbXBbRb%axjv)M#6)vW z#o4d&{c;W-+B-MTfb>wZ-5t}7rIkO;kZm$U(iwuMLYBGlhQnB~3lgdv-utPrfbkZm zMd+COr!#9(VULIldb4~Af&dnohuFk? z`X*zezFB9@7)I%qp>V{o!DSXr2%}(Q-;tA(>-Ta+_isi%ymyCLKsNGrWI>2T@lrXR zJC{H737HSGHk|>?R8D`&J8vNIY;wf_4%_pFqf%s?z3eE4eP=-3CV@Gw$j|m-C(=cb zyfrME1PrQQ?$&GHsvbB@ zm$>XatssEZ227ApL32WZ-uN50Q{>s+qcD-ke=bjKB{bL!^8D8a&ZUYB zWSMj4I-OF=58MDZhHaWhTi7?Y8@wX?+Nhrlp|GTTJeK?HA-t$PTKEK-<|^_-2hEWb zd}qseh8Z@w_cG5`jGj=$dwyYQ{sAPR(U*qGi~SF=d*`tM(-iy93RA=KRz-6!GFr^-68+$Hp$vQMfv#pdQM zi5RuD(D?(=I1E~$xF^sBj~;b-G>2o{4qE1tSK2-P?#>J&X%-D?uw<%RY0HXYTcSkG zr%OwbHqA-8d<1NNtm^Kvg*_f-F^q@$i%I=&Iyj}Ow}k*L=>cHE8&mB zETJ&uHRzIjeNNJ~i-g{O!f%`ppO?XJpRTfXHR=4MZUbt$7d2T7cPDx`fj-zTWFq1i zRE6h5{pk_Td$rbamkN9_0hN0bY;`m9xmUkk6IrN)RPmXbY%lv*^=n7GscwOmsZ)Hv z0F6T2gIfo}L-?P}H#!Gu?>jyS4V}|#YS=l)Po9s+-C}@GYicqT_;qG(_QH&|`0k_c z-qG|EdqfcQp`?jK53^@`nJTBfBZHCA5l3I*ESp&hIvx)6g-j7Ce#~w9e;`b6?Ehe< z8pLfWkV(9IKN+C>?<-u zAoM`;hKD?nM6~XoY@XHXjqKe%#t8htr#8dm#hBFk-|g)@;wnAez*PTt}s({QC_$!nf0DsvGaeRalC(V?t=#$~T5*v@O!}Z)CL)=AlyX@6%-iLQ0Ok zhkDnCTQyV0jE~~k^rv|3MtWc?r2Up**++s0D1jT;laKLBAYjO4u1e!ggJ1bxy;)@Q#Y z#QJl>>ES?P-fb^HqFQUW^AhCv`qN-m1B{QF8T=E5{2CB06)!#@^PVu89Ql&sM``z^ z`S$;Zo)ALapk4q+QxF3)-d8V?-rp~mc3kJ2+d?4WHEBsN?EQ61-uN@K?NX??NRN&T z8pcxQp}|ERf5~uR&Vh;&OEvs%2E&7t2;GM+HQ4r60D}ZXl2{fB^BM(w{Bp!4)i$^= z#Kpu|;$U^nO?gCqj~J-FVn8YLK7@sS2$RAv{>l&mtFNkK z!P?vR& z)12re(`t@uQ{icIzpuj#;)8rB#k3!tJ_T}GYStTNeUD@`HLyMJ7}?2zz%D!Ao(P94Fkix&wTrnnJp%eQ(On4xRfaW<>N0wEw*w<_4|2!Z%Hov zWx!t3ZDajq{|l=eJ?+_-+dNxu&VsF2f008<%7Y8SLsj%?djL3R(h>~bt)S7V>W`Uyt|FcX!0P-a>M>>#M9qpVOs^5-5 z7nV;FSbw6PWd~I##oTfCyQ$O5}`(*4s3e1Zv+Enyy`;50FFw)s`nP858wDm?oL%O&ybT!(8Y~m0CY>O z(4mceOKVsjVZso!7jl!Ltl2a$U9}VSz{>2?of>f5#A}z~A*t<(*|68WgN!}wzs($P zjdd$nDd~Up(=npIXqUdd8LIRsae1brq*dTjTQ~|Qq*qLOlQ1IN<}>Hzo)dP_Asrg2 z#q9VA5={2Ol@y;)aZThw)SdtG5gS5#d!EXZ!K2U@!`tF}$UpDH9Ql6TbgWNhy-4qr>5=P3vO0PVC68$0{M@h$r+(p1y>}l*p6bFr^4R;7mD@R2Dc)Q;ZOneJT2^%jjoQ`we#RbWq0zMr z#>(ffXFr;1Fk3K8T^_mjCk1+gMx|EgOc4&I{F|aS&52Oc|GEfKa0Q;BYQI0IyQ?Gu z$v^YWAP#F?golU3!*0F9jjQg2y*gvlR#Mb_v(6~-fm}$iO zkd_yjIlo`s8x8}!1cK%Bf(sehZPX*QFw-{P6mhClQQm~TSiAM3)T?D(FK2y1=wJEo_ zzBqRL##Emv;7VWsDQp|0V2BCa*{?0RM_4_(6GEuR*+4-Tn6b!Ff(Sy7VnDnD_n=_>Cs83?ge zvuyDyJ;{oXBp@shT2hy}6Or%ritI%K^e(0uGenBMj-}eiLGqm-?^L=7+ z&IjF$vL-p5Vak>gkSZ@zVYzMvCRPUe8n5mg2~Bw<+Sc;_ww^X0{6Y#IZ$o3yWc~j8 zhw?rOQ-+D35zl{FmVbYpVw(?C&Qm>HSmgfubA$a4C-6@E0B1ADm;Zi0@F|{{t=Rt z_?X>|-j`fzvBOHbk!V#kRNS+7OeFr|MNtN!Evh9&PX7H@L!o!@;b#cYU3*PdG*KSs zTy5JOx&rF6E>BBjUYbjrBKTteam#=1bf$KwmbdL`HSVy}KZk?^4hpoTqq8%`48|Om znfd`q+!=zWH}{3t+Vo_5GK7XnJpt~14mt)+x5j>s`FgWDOpu=J&RTO-+0Xk-z!?5& zFuAx;bVMwc%Q`E;?X#^>i-^)e{5XP$Qx6lLfl|gm+}jMDYzw9I7n>0e^B_BZR|!?~Oc`F! z<&ewWPQT7Sv2>dJg@GWT2`1_}RJd%L@IjPVEmeulq#C1EQK}HI_#KCp`m#Z1CUUbN zFbB?h8w-lflUs4a5MN;<@%iM0+Yg6?W|y3nyV&5$LW2->7G^!lo>wL0_930;oMGoa z<>g-|-qc=7rt?}S0Lm!$?;8+H5-e^*Tyj>D6SAybwvz&sc!!bb72>UW8!IiZpmC z42OT|0hWfM^cJ7(axeE*mmkXYJ)ihnwUrA$|G;ce$1pa2cPguAnZ&+c4mdw-v2;o? zEuKyNbx^_MpU5eoGcDy>~g<#G-lf8~N(F zvRNIUSZ^Qk&oBTKY~pI4J)hJ82vf3x*BPt8RwEhTf2kP#Fo?C#W3T4>-?~2Ou-*aj zkHHx)#mfs4kRx$g4nwfT-_AOQGZ`GFy!31jeT+OB9!M$(J)nq)#eBjnTh&R58ZZJ*oQz620DCd8+nudlnh-;~|f@SL`oOcCx+eP8>C_FDf180X^({*v4=+fYppe zYO>l#*Z8s|0Fp=-m?-pBGc$_jedkJSwd>UC9Lh-?1{Wtg76fhU3`8|tWS8tGd+f&p zMfN*^Pfp=VDY9v`$JrLe1|21aO+H9~)s|h8q2Mjp4w1PJq>X{WnWPE(fV@33D{ z_?%^qqFY-)HHx7%FM*NG0J^|=Rt{pB{t&<7KL2=VSm*Ln&;6Vhd9fe;gQ(bk$K(2V zJjZ&RjmxyldhBL5QZ#obpSfzzBPAz`HA}j|)_LONlJ8&m5K(duvOi8gg67v$km29E zK@UP-jPC!ts}Utj`6h?7xQNbi>)U&W)BP2~*cDJ=kPw7*%M(8T)M6xx{kxZC&`DnS zN0c8Qg0`@G3+PiF0^Vz^?6-fU(D4{6oE+Ja4hYAB?we~_ZveTbsa2C+c%r^b4L+Ni zq^(O)eWStQ?`m|?j1yW}kKioo)eM=%%Ft2wUq+j@6k`5BHZlAx@xH7+~m8{XO| zNF?iyXr0>kxE*h5xXi8gCe!fGUx~(shBgoc1XV2fpAUWQTS)&wA5f|sccyJluu2%cr()oP9pisL(F}RU$1iv|n9~|4c zY^0k+uvx22EI1FU*Ne7d4*a~7(N3;_rtP+yrdzvc`Ay}gEn9Gr&B?1h^X;BvE2-;A zi`ZUFkDj>vTn;HAQ$iNEdQ+`}H;@t>Hb6w6u$nIWQUH)-^4Xh7+MB5 zi}mHdWd?exl~)ejs8vrf=1vQB=Dfu(5enIvkTb0N?SxFPC-B?IBQG&;gx(T7dcel! zK=I`maTGYEUbag7V3N12s%?u&uR62`v9hR$-w#36i+-K213wwmOiiq=-gaF4NZ$>( zbG@SPyJKkkc*D$wZojIq>t*kwYzu$V{fqOxOA!rQ;e0y`6&m~pdxr!|cA9=h1yc;= z4n>wlhIb{8&4kL2*ZH_U3j>ONlUjc+amT;f=D{#)Tq1e!LwAkm?>CLZmVwnG+xOf8 zp{^`y+gY@JRId`;3gHQ0mi}#BZJdJ^^#0`yT9Bo|v0VMzL1V-grY32jPL2GvG-0_L zl(GqM^1s+epFam~SIX&Hq{zBB2V-MZSLL5 zqO?%)%bLJ|8+(0*(l;%5rm;F6Z9`Ls5|{)UdU=`)>7ta$b$_+Y^D(x^1G2wOs}Mwx zz0jOmUsML$YJBGr-oC{s;_im3x*K`(}hzf-POMkMkLhh@yu)?tuus|9Dqx}=2?|`99ez4|4^W z{5l>W*pTyf@LTRkUm|h!5wyiTX{5=*hAGUF6 z=|3P=msRq1fY=q#nJ3&eK7aT zA-qZ=kIh`O{H}BDH)?ZfIGcL%BeqinKmP+lGEKtVvl2cO1>vm!Hv=#$cD3G?GY8#$l0 zZ|ZjP_CWj^4++{5f4b_z0H3u*n~L-kKpP1ZI14zbb$CcIrouxw=;C>c6Y0H&-Xqf! zB6S9aq_F9&FNc_jfz>xQh=BC89^J*~rsb(6+fRk;FyX;vD(ve(7_sIO1{>t^E#Aym z%17>$+-~X7A^v~iN^_C;zt$CzNWOCq4Zlf6=ytyif?Q3pCto;p2QH)e`AmbSYqG#Q zV<_=suQvlW&69?}>Ft%dBd@D9%r@aOkGrr4DxN4`D~X#mq1k zE;sFM8j3<#ptp2AdKY9>#w$DExz4;v1-*`UG%~AOf|P*ZXyLkz^JI`tx$|ANBKu!E zRdlHNnj$ZrK?6tg4BBSw{%}KbqfSB`85kD6<3o1hnKWSN@3$qA{TwH_{I*?9E6r6!tYWAocu$K$>KGgIa_k1MgRc&V3a_d8#y$L5I^VR5xp| zKxcP7$8SOz^ZYT0jF_XZip!m)o#!Vin^*}SYb25G9KKx}e52m{DWz9&NC_M~kyJQS(}jaL`sVD+R8ol~MdGit7gguT*c0gh0)5^s%jGMnl zn{Z<95Nt>YkVBaTmj_;NJ7pBFwAYVsvzu7D4C$ro3rUvV~DETF9eWJQCNGn&I^z>4-1>3^< zSvQ(-*aVPk1MI-NOaznmrDh?N3X#apUqu4=%oWSsu_1Q+T$681T>oOX`N#gl1@UjI z^aAoGr8WR40+NL$SeUz$Wu0-qO5A`POR!=JpHlyeJt4rE`B^hny<59w)6(+w+w;Q( zbLIc#va*y;IId2D5{Rwn>y3G8ohg zTql}`{_c=Ar$gPp*W^9T2ZE{gxeX$m^ViQk6WH*pm5E6!6SI1Gye5Eg=AR|oyq0G* zYW=~tm<+zD{p4R~Pcx??XirKXrJW>QKxOp!LIaC|l04gV-Xe;8US? zS@5;EQ*?oe8&9b<_%4spIAnHXdo+{@&pJE3^7jx#e~xWReVkv6-3Hj8ms@M~nonjr z&dT${`#}o6fPdW-DX$+3u&k81S^)0$$$kv0ZmQi<&TaTLtwm8PsL@C#{@caMaQ)y; zE*e4>eF>~()Nh)=;BnnS@kxtDd4-!I`!Dm2I7;jbLxz4!>i(oT!AAr+J=85qv!B>O zvZNb4tfeC5v&)hCsN&y4M9gsDU}qDfc*TnstnswTiT~TcprFb~QpD_A3O2Dq99G$Y zwU$d8C1u!dHq~FY1pb!TPpp*`{*mc!DidGyzkDk$Qhypid3V5{c=H$g(EmjF{dxX) z^IsOTIsVr_L&5oqOkVo?q+bZd@x#jXzC4i&5S^q^lZtt%u6yb`I``~_Q_{y4C;#iC zvCgBh^tSfC#ee%c;J+WyhD=+;hyHKu)?XGC`hJWsJ;-tJl;)5uf9X2>H@VKNOkJAH zk6X6!$?t1EIct@IGIsyDRIt|hGUfy6v_KB_qYnQRDq{WZZvY360Xzvwg&v1@>-6|_ zK;I%Vf|y&HfCWkkibvvsJCvK!_$I<6qWw9=MsDUtAytT@Fq!<^`!OZHkbimUvXp^% zUy0(0L*W(Z`OCzQG#FkWR7~gW=;&w%$dHI|Hg6ndQcwnpd{#n($kFLnYI!*ZL zdHZl{GQ@~J(}tlN*Fd>YF@f#UOmcOeP+n#I=3=YZaRaUdq!b^)fXq!vb=TGJ5A9^x zGQnNd*`{cRAgn3@B6Ze_LUT`2%Pa;G8V7_4)3bzyMMMnj>MDYI2j8O&L|$iaN_pr6 zL66(RAY&xGf!@8d;INO?)t#XR5W8n6hLy9|VwDk}_~+i9bI83sYX`O1xKC+X4=?$o zD}fj``M}yr0Jx63*Oq(Kt~;=>`5D#9^WN`_^}(L78|d}FxD{f@?O!u%dk|8Mr!C^P zy@N6UQh%C0x8D9Bji|3F0leUqB@h?{(M~cI6VvmBQi~&jy@JlpDe2WnA?$?1@;7=8 z^TS!AWUq!%wF82N9DEN~mDIjAAMp8PRiJ46W|Gq7v!8l)?yQL3>GYH@=-a=0ER=L0 zxZf!m3qz}#xd2s%IjUJ$D?l|YR`cg>f~M;{t9`?9g7;hmx~LEl`OgL0FQUGU!o4y& zu{q^rbE|;Q+5IPQIb_@m%z&tus3QES?}y|-M7_ADE1IU2*63JheY6D?PTFeVos5R1 z3N58}(}q3;grn)jE75v4M{AQ_^z=qhVUiLnlwluDQ3O$x%V96Pxv;LF)h7GV*s6!a zc-JzWVkh7sqS*a(dy>_9w66_3sJ-Ja0xgf0>$Z8{Te5^mvXM{7JoJq@a#ET{uwRfa z89!r@n85EwjZWv2uLn00CNw$rDdKunW~8u!!ttX?1)X$asve=gCD}Z##R+N5Y#;`j>7d@J z%5)%I|KiwP+Wh+YK4|vCLaH~~myxgYRK&?W@_y=1BQ(TM03Nj)#Jxv) z`0G|~!DK@-d+xGr+S7A$eTkq=)T0JDaEbd3M`1ixGXmSlJL7W@QAPe!@(Sw=MnmP4 zT+AwGHL)k1k-{g{f4ptYLOrUx=-5%9EKhQ``dZW7xl6@zA}_igG=?F6e>gDLs8f29 zsw{jRAr^fD^rE`Ti<>|ol&~9k@^rIxqDGiaYa^p=pft($c3J(^sEE)rkobrNQEiMu zr^8hQv;9WB;O362>E=j2Fd#HF&WhqKYj1NKd#7^^jgB@ahp#v#y1iQN5q9Zce1r5T zFlZXOuRHi+7@}S z)fRy@G*xbwbNa#OPk51e&xx~g_`5GVyU=ZYZhSOcfdJ745v2w?f86(2Cg6KYDvtKk zjY_r7p1mC?tGy!L7qS~_Ii`p))(+4$<&HGIMH#!{%#uMI4xGl~y%G?&vzt>)_be(d zd`%0YwYR1w7{_b|<+9|SSDb=ux9?);mB|Iqmt#k{&RyLrUG0|+n(v+>@RW~mpo%m= zGjIU;IX%l~N^>9ZN()AQXee;(My(CX)OCeEZd-A3roSt7lRD`H(2Ib|s3-l9!kk^& zUajD))7j>YUX}H<=KU?KBp`nEAZ{Y?Sg+NBzlU9?T4k!j7ux@Vy+y}!xhvX5S!({B zhXlK&aR7HxSn)Mc-+-}aZY)s^rd3*ag z&U+nJ91S*VMcG5b=4{7vRF@qJ|DF>>Of(M<7bz|8H7eM9})v6le$uIKZrXAUfQ z&CdSTsPc2;1|-HkT6*ZpBEy}FZv=I|ztT@G=$Y)%_>r{2f^Wj!coraZtV!f#soITAsg-f9H*RO?m2bqD{>6_Uov> zdx7hoh~sAd_wLmBRXM#y%g0@PC6;_81&PCdE;c9!F!nGIsI@n$6(in4}r<)y7m!tm5T~XN~TY-VVul zuSZXLqCfzDXmuE!!VOfkebPu4k&hn+(ViG^j-{X;hiv@dslP>0C)EiG*`J@c9!m-! zmHN86HBp+y=xpD3?wcDYd_1DwhuHuUW&!o$*3eW1==e)w>?(@Bl=(vWgTx$}$aJpv z>nb&iVa!=f>6zQYTZI=eu_maX)JmHb(HgqruH~@KZv7S;bNB&rPzG zlNW-;NyA>ydXnzB8xIjV6RQ=v$WuJqm#8_Z-Fo(&>HT-+NV`p!yX-I5`Z5R&R36*K z>lD1a%BI0Xhw|(SE*i7JtNH z01dGSU|X_fDPQF5G|YXAdj>jRiwpa-hPX6h;WK!}w*>b;^5QKBs4fcn=Y9Mq?cPYZ1>&t%;V$aKk-||)+Jc2te3!5J{rPyY|36E)e z8&2n#uP>Y48sax!%OGCta;zMJlaktLwO`Bn40Y2n$B(HsB#D}gV9MDlgX(xIgEi-M zOQaL7_9-hrf9zyaKW~nU>13_NSPW<{5;Lwu60p!(b?VE(< ze-d48Sd`#F&Pa(h9aV4uf3uDJSu}bWXo4C@=9U@TlGtA#+(VREX`EH)JfWr}gQO`7 zA7|GCdDYw!KNuP&CPT&>cxWXhCCI(qL}{Tz627PZAHLoKD2~3(;tj50NJ5Yxg9LXH zf)5rvcyPCb;2s8-zyx$_H&N*&M zb0^gs!u*JZEvXhFv)3o!cnkj4Rd3H^md}1}+r-t^gGBu_{GA}OyTB@9P&HYqn^!x6 z`^{y7^*Rtat2pCp9HBX#*0?3s%-V9N1Tf}|3Qq1BP$EfkV7Ga(3Un^}f!I+dwS1q~ z2$PwtE$5N+$+ipny58*;tFTx5Z~i0;u-uvW*$?DT5uQT1FQTP^P4X+{H=?#AL^e8l zZi>p^W-IfW$bCghf58(TEJibrWh$Z=RoRG~^Zd-Oi-69kFV>shSx57OdVdr8;tRkj z|F;Nx!qdtQrs7uzL;@XKHmNhGtVpM&YsQ2Uoq5#KGh4UF%9ZFY01ACOpgw$R(=(K9 z@uS@VaB=6boK>?srKe3;eTk{tsC}y%V{R(g{Qle6CYdt7D4p&#XTwf55?;qjf8>n! z1vC6-sYDChbg4P%vtpNEJAFmjC@Y2dhK^^f{u8)G33V{)!MP9jX!EI;_eH0lHql( zf$--_-}{^YG;ujBH<2lolYnL#xuwgJ;lhmOYi#6wBMEKw5jIN~AB2k%Up%q*NP0vJ zz>2M64M^IOoG_dCg8~yneh|F{d>9#+t(qp9@mg(xz}>8GYvSD)8bAmvP1QL{Sc5qa z5XZ#KT6hAKT?%6FyT$`Oili2bRktD>)%cpkYY%+~@PRGptA4mU>)*!DN9kY|&>1RX zErr5~1>rwyZ$i8jrH_5AN$=^XxI|M>n3vOVL7wQ>4sTLwsg@}oSDY+2AooA6?oe~` zmA>V>mp|NLvHosH1|0*zPbxBXk2}8B2zi=S`JFpRe9|ILeQm#^c2}98dE(m(HI4AA_hx*e;ACuo7cN}Dj!sL{02WPYY z`nSlay9gujs~4S-IUiFfW0JE*uhiMSo*J(3jC~F#f-u#Ml)N@Gnb|#TK*m?Q*iABt zg<9v9XsSn4DesA$gJa{a`5)%(hpSLP3Gct$sLPPONmkZ!s?rCLY<_IXJ09Fg2?}dXlCrn`jr(rkNu_+0V!ARg$t?jTO+Hp5`BJF z5m}b3vYj%B~J1Vp!X+jGbF~ zn6rvy8(XFg-3&=6TkYwlTsXznINc20ow`hJQ0R-Y6_&;#ya&wQlN z7s_YU$&9Cek2rQa&>&FTh1K8UUXFD5E500rw+e~EX*;pqa}!@#@cxo13=N1YTTxiu z*I%sEA#QvqT+-L$7J>$vb7*N-mtrdi<`Z|X34S=Wg$$!Q{o!hb$hp_P!*>PSl-d8py+I3Nk9{Y9uZka^amL#vmzK+A` zFYRpg+=k`2620xPoA*7SW$zb4Qbd!l?m(JLA@w1$K)Xq$pS9ZZqEnQ#|s#g zr@>kuD$^t*(!aC?qgQs#p>#3BS5B%k9*Z>V`gKWG37gA&Erm#oUEe9nlzL8Ik$q7U zJKOC4b`+53z6VEIowRIVv*IlIvcGMZ=NFIcNv`*kb*(E ze5M!JMBLpx%s>WCYZ%WVh;V5!TkxVFsoZ3MqG03f0d?=feE{#8m4ob}fpWg0Ee5Ty zc`BDU2JNUp!s9plz}-hGQcIXCF>){FAr(%L_aUomNo*1k9Urfol{P|XwWwUFPV>>X z@PtS&JKfFS<|P#+vCX3dbHMmXTloI_41Gio|NmIIOd?;J(~fG|(L|vYRJ`cWt?5d4 zx!k9C3So!K-+v^ya+!g&b?5ZZCMrk*yYR1pFCR(Z!0z<@fbepAhs^@-*M1Fn-+P~i zlj*GfpvfZ5U#l~(+tpL^R{RLIDdjntS)&o0C1ImPL4Fj=-guLK)0Cf8Hs0g?b}6|7?hb^}S3i5hWRo_yP-@^l z{d#zJqF_Sstl~=urc>=*TB0mN>zgamB;w@`A_T1FHd&lIY^r7WQWguIo1E9n=T8ARyPbucne^peY2Y!plJreMsi;)iot;C`qMXu z!Hox{KK^#>gsBRbm&tjDZ@NQB&9_i&!3BKjbroOzV;a<>UtsPQ?^;7c>M^}liu`_j zt@w8oL>XP{k{bJ-A<{Q- zHkI;6%x&x_JXQ2g8rGTp61DDLV_R3&BL!Qvy#?j9P}Nd+2qqQiXL@!;qZux2 zfW%nvu95_ijC&x4(fWbQmZUP$M^FWs-Cz&e_zIhJQkomi>yP025 z%t5UZ)&1P@MKNsLdfUWcppI`GX5pz5ymJarfvywzGxr_8vG0e${v(S~a=i2wRh##s zkn86y?jMp9>c?zCvxSq{x+Ddik*y z8zB!es_Q>*{@dVi$h6TPS7T0S@6YJZPH=v3)#$K0E&MuR%_6O4POJJo3WsqkL$z^U zsq#`}Gd7F+9Rn#d<0Gw#I$DmyCC1iPNRd@463mZpT z|9ZmFZ~Fvgd{!f-7(L#X_uH-Oj*oZE!mP*wJ|35hiMj~Y`d^693=#It=eocW2riqR zkZQ}8UbvM`!*4^LmLd1!`=GApFAi1wv`TaZ4!ZQ%-Shn7oB;|Hdsruy{us=pGO~$7 zO2$55do61+lBRd2{Q^P|{@6`SwGkP_GFsw|x*IfM7*NdgvT_5Icbkpi zB3LilV{1#wNci=Y;LRW$`341(gn*2gTb#9R@#x)8EL3&n+Zz%7%OE_N+8meW(+x&- z&w)M84>rrs>frf|<3*p{d6f0gpDg2CUVZ8faQz)7)0ujBZz4Zgjs#*V!0#nnblH>D zu_zB-_P{cCV)}gDA>T3`G!5(*S&B4k%Ge1>2y{Qx6@^i)Bf-XdC5v&g|JjxoGD9~W z5sP{W&QnspYhm?8W8qIk1viF%DM%&pK?EjG!I-*T+PeD=5LiJVn#LJ7kz+&VEDXM` zEKizCGC5BNGHK!Le z=MATw)_-r*jlDCS=F6-(QSWGOjZ;Gu|E!yV3GpnK&5pa54)R>U};Mg==e_%bnf;i&ofI526W$z z5uB1&b1mbt$eSQKIjRjK3K6DjG;#faG8lgZf+MfFyr`}XB42cyUS&1Pm?FL<%#q^` zuR}JXq6eR2gwh-DO(yohU(9y)tRk8cpL=ZwIKr@JQpqYauvDzqHeD%VlEX+RO?7$LHD-lbbW6clq z)Y(-5Rdth)Pk}#!WOi@uwWYY%#+6eMK_Gk?8oJMViaO`DrvGygT=W>R(e~z`%Mq7E zBBESDUV6ZX9UkbB{=8Nm&WY5VJ6sZ=e;d~AVYZo{F~Tw_{BParx8WxknV*OwPi~=| zu3j(`eo0E97YO#bh500HzBKItw8?KPE?#M^`*!IRJ`*f@SSB5O#f)Y$P!}G=`$LeQqQR8AaZgw9@O6vUgA6+h!Ps?{ zM5Vlq5~nRj6T``XMZh58FO96!U)FdfghL7ai>XXos=CvDMo>8>zXD>I8i4q`Bcc;e;KRJU}^7Xw6_tkJ)eqMp<6>Z zxWF9*6>Rk`2QKQnmGZCpa>()KedI2v>8MfoOxc=a_dZsaO*1JOfBiMH9vkU}Ay+rOBD|71*_D#pv|Z*j$3p-fI^y;m6h zs>;0PDheNK4GBSi(Q}er^2d2As_Uv-I|NSKeRcuPET$_UNQwdnLPdoX-4cQC(u-vB zJzbYv8<|C5{)&d|*x=g+=nM;=iOu|7XU22$siNmvTtf+5tc7kqDx8IM24()w9^;F> z=n7RwuLO@%Jyw@S+!{6OtF7S<>H=YytR6qFbvBjHgt}^KFoKu0@E}@A#D%+<1pWn~ zNP;aeCe)X`gUD`VZ5L}(={?>-dTYr}xrLVpK{a*l19ge|q{*9F@@F5QMDk(tK%euI ze4p)mBC;(lYk7S8pW!d_U~#nNi>9OeVb&QN!X%?j_rl4#Lu35bOg!`f-*2WNS$ga9 zW7#46Cm+8%5;^)tGiu2d1GW#P@%jzz5mNgf&8^v7?M~BUu4+>gsp`PS?ztD4m4zut zy`V#|nfo9hJ^2p?{y)F({CZltZ11lRLQC}&2tr`e{MmeLMW#?~l6_&@4-$XgNFT`zwO@5$<>za~HRyqNgxSj8^p zUalGg2u~z|%FmxGy66@_I}_0rgs;^Q%cMhDv#>aN=OMz)RPJ;nSGwEHj{jx=Kkg5{ za3`hywKk!uKh=aE8sxQvmtCFuiQ#NB(vr2YnmIRJ{EJkDqlt=~n>K&XX+eSqdih-Q z7wXo$?*@9Gc-7!%#cS#md6nz^i5@PF7fp-Ii3bYCq|&;dZE|lqLNNE=Qd8wsdi{LA zBwOGT6&dw;HqEKmq%HF5*VmLP0`E6rO8Y)f|U zU}ZdMw7ku&?Y{C5YvZ5tkXBDAF9@&(^mq@B6dq}VU0>|>y!1R)dvm8v3e|s3dV^v8 zekPe9(05tX{4ba~x?kZK^{h2)1K^8_4pZgT)&XKx#^5AazQMQOYCH^nyklDmR^ZLR z#((3`GScRtu7 z^>FwLS*OBAg-aK&3)@Wo>oNzuSeu_KPSL$s8zpGguR;}D(2meT4PNM^iJ-`1UJX-G z?uokrvWR`w_#8mb=HVP3Y=ih6_(Vd{y_Y#d-2DNF@=U;I_?8fj1nZYINomhNZo{`W zZ_yQQ+}`GPhwp&S9#X?BByK4L%MbOHqolDm&pgP721w)tM@7U--REh&&&8g3{2o&a zqSSiTm`ye2?6&{v`0QxTsHJD$;H~!$9)=|O&k-S;?Eg+-2>AnA#xqZw-wy+5cbU6# z49xi1!?YfG8V0jMi16z^{cM@4CSM!J&@+2DF~vWTQ`?1~>9g z&s2vsOct%}Er>%masI{gQ6Vbu8x_yCy!^;(Mv@@%?@w%a+LNF(O&&}PJj&t882V*H z08(c9YDb1sAceL%1X=PKaydz9E8DOC01W@@yO1V8GVw6eDWN{SODFj=l=uIeObz&* zu{h#&cjW&#@TcSbZ(pO)tp@ZduT&-E$1W8J|NT<`Lp#;V4j`A&!+=Es1QoXw>z|+f ze~v}}@%lGea+UrqfOP8zxcy9k`>F1-RiePd++o<&*azKW|KESz^T9i_s=M#}9-yD3 zXkh5kf7ETv_3j`6Q-b@-2uVyIzWf&f_Md{;|9Zt6TlVQdffD1V@-qdF1{H^tEqJdz z9OlK%kQ()|=i~o{iuL||(rYwYFE!h2rG3IVm^)JHcs*=Wa{_eqrHZxdko$K5YYCW+ z%?~X5f6!C^?Xo^y;^lZs+&KIu?{p&R&BQu8Oni#qurNSGf;=+Je-^AVQf;Xf1pZ(V zZ?RCXa=JCZdUCrumhRI3U+3{Z&kW#4zarxdoDyMvrAuDvfdZ7uDbR`ebxNc<^z(by zSwz_%>tA~Pu;;8 zfMGh{8SB9VM1_tVV(+7e6(p%@!Q1cm(Zv2aX8!wKl1cSMF^fiEV|`VBCpv=dcLvZR zvSr%YpNRURXu}*1=Xna9#eo|4|8<()gTmw!kd(Af{wQaFy9o5Srso_*Q1-JSZ*z+V2pJvW&c2)p5<$W(qLl-{2;AV#GkW!gYB_uE2!l?L|_K-gCQ zTq-ky(I;@{W~4l4v+H6fP!p`GG#Y@fa?YA3eOd2qd;9v=af_MtTC24f8KJPmM$x z`DCU#`;A!lG<*QHg>-q;869px4L{tz4U}Ka|Lm zAvwUW`0ndaBp~{bis}y8SYp;Po-Um-ncUYHEm=CtHtqg_Tlo`}D6GQ+$WZ-Lg>m_U z|4+=gM`E~3>FMlR9W~(JaEffBv-Rc2|h}N1M@XQ?~~~6X{iG&(%WN) z0M9fo0-ED*q?JrC>jQGW(uFGXxV!tSrEY>Pq#a0Ep;iqG6WUfVFupEtzd+Y5kSI}| z{P^#q{J%!TTa4ow2SKbuQk|y<-S}=TrFE-DM&u1by>sOI>iWhSfpn zv1TXTg0IHVGi9c%l$u-|<9Wbdv;YBm3LK5h(iU72 zsLmJz$?2n2b4E%vRys2U9<>s|BosiJXUrNF87oQ{E8PN_>!9u%67nBt|JT49-i@r3 z<#zd@wfzGp1rOuSc<-R3N$UZiyH#V{iUexSsziC1t39sgk?Hk6$*0c&nJj}^F;kep zL#^>ZtgOe~iNrS>D}fuM5soSg7KW3P6N9Wrz&Iw;{nqL9;Wpz*#+&b^`*uptwaV>m z!QmHx>IIWPw3`(+-mTvO^o@b}c5r8qCGcVY^B()pS9+b1%gN-T(&%LWEUk<~nWFzB zaFsOPbW1{uhwY#EYRQmY&P-q!o2(MUBFKN-`eo-j5W8uH6uVk#X!X!C2e=II#G>_o z1uePVS3MyxOnHyjYhgc3nUOXwF=+9kzb&~j0!RvHmOXGI;@B*$aMb=E$3yO2Nn@i9 zticxI2Pv(6;dY1lR_}l7Iz-GnUM-B~8KFI4S{f`RDsjXn(sAt6wmz^BGgO-Y%CZM!>m~q@KU$|uORrs9>aag8#h{jF z7-)8dMvC7{`u}^0fJ-MS`eX}1F^CuBv$WUg_h>d*NYBM-&N9q@Ux`h~tsqCIt^imH znH6)Ee}(z*1O@1n8wZfHBI5NN(m{Y|X}cMdxIW98B`ekK;^@nBz(J`Ox|M7$z5V5n zRrD~e=eI+Fa5O{5t|odKHkn4-^u;8&BsEz9Erz_>QRlL?hL0d)d7S+yVf`K438sOjVeE z5~p%6pjM)&^TBG`#_Iye3Hu}WPj>LX%}IB(fU(XUSRdwSA4a{V?$BJOPydY$^pn2ZTvrMjv?{j{!n zEBuU=_`V?e(J)ke0Uf4UQ^ONbY*L%qYag))k6)aPT9G?uAJs2xSk-GJJz%-vJk^`< zth`N#*zKqjKCa`hvyIet5#M#Sv%Ii1w>Y-VOShBji}@qDvp9Ti=bkRmL%Ee9Kx0$n zW5g8ebg)-DNg~nktuX9qwHHYpZZeUtg3+Q7`R6y}o&G5^Aov)R;uffW6FYp(9=^x? z%-}!00A!gXeGya#ehw#ZN3H?OFZR8!M=49S88J)1nt)soZ~XeK)OJmLCKZ2JED$eZ zEtGF4qmJ5}O77X3<88HNqy)iq@CDV*Pp(zL;%C@S`_mD|jIG@sOyYeppEaZRgZr0} z%lBmZ_HAu9Tfk>`Bh6OFN_e0TWxJuAWNVdw=wK~I6w59jQ;s7E^vG`n2v~#0L|dV) zN3iqJVT+nrx+f3|3gzWbG)-5UCVUAO+>?YD`=3~IC~1odTIv=7%E7q*3e zvOGYyti{9XTc_%`Nw@_m61CEiWCr)% zad#t~0Fn#_E?v)}W%Ji`LHr*#ubh{}`z73rwUs#dpJN6A3Gh>s*g~$_sMXFwkFs-9 zEuNl1SFSkK&ez`-cCA!I?!VmI$b7Vh4V+w(1r%LTC^;2g>o@C@?XPVd0xRH5nK%{> zz&+{!(DJ2t#!3L*TjU$Ar4|Zbq_3!+yj|L!WdpmkYIxdb^(M2JdFQp~mnyFc0qAL~#eUQZe!j&o`o^s3-r`PO^VlvWgzE{z5#)TF+c!Fu}L0 zN-Gni;XV6bQXv_op9D&31p%IT?hwIzs#rGiyArl`_EgIJ2h|7l6Jcl@|8!4$7cY0w zVe_2!i*$MAY&ZIQJvVms!OMt8879AhpXKirOxF5QD~j*#yT#faGn3=2Q{>(BJQ7nI9?Os1XuKz(WyBjzUEFR>ZG zkJB&Dz+4V#{OzKvV-FN3hl_=6K0>hq>b-!T3XS01aR?4k?%|;&>yGA@71RoO@dFs{pr}oY0dgj{@^sSN(w?BXklVD+8pj+(7nEg zU}&%}$@uHwt7<5*;e@vn8JWAf7N!NHGx zfREPZ6`YklY&e3@mjn%oMELQN^C>k?h1p4-87;Yxth**l6181AKit)K3l*d9nOLv2 zaCr{3%q`;d8a}cOuGDYRMYUZN9|*rr(K@1h-Y6hg&Futj>VWj6Y9k|P0~xD=3nkp-yDf6U<*>Ba@{ zmV)^weUU=lKc(qbj`-G0&H17Y@Iz0h(>pR2T?PuZPD(wL0$y^s465JeWAuB1bRoUC z-`XyhwbzD;pfk&pbD>3H&xgZ|#@BjuaU8{y(K73p_IntD`00Yq^@T{UMctGA8-;&K zUe#Ba2q@TY-QXT=M1W7)&JGo{;A*8{tE2&QT zg*{3=!(a1XI;FeQVa=dBpD3moQqRHWCBMYtUJu{C3@OQh3i@6&ppRp5*)>$@F>5VS z0I1%dLe~<&kG0}b^cH7V=HpW1K`+dS+rETK-MZ3=5Md(2%R4}ZlKQDe$$yaAT2Xpuw zh>O^e2-7_HY!RQ~G#3{tHq|!*KtG1;Ul%IT_oyr&M^`=pmhwh0l|Z~8VVJuhSHwMf zvflUx69s5$hyT7l$7ZGd^m=Up#e6fdB&fQ^a%!kct0n2Hx@v1a_*)y$7)o3kXvOhF zZ)^TIq$sS>d^AsWR&TN8<3cfqbom12K?Q>AHUouAi0R&e+`%28M$16Q2kw@19n%4G zQP>;%VCqhT!493bvq4686wZ$$Xknsv2&YuVNSU`c?H=48Z*;be(4gskSLM0Gdmj_e zK*?Ie<~!bZxkxvSdfT3tBrXSLu0D?GB&R+IyO`NG%{5#UI_Fsa=_}A@8;xYl791|; z`_x~P9AoeOkzXAloeHZO3kgUDS%_A`sRn>bB=F4Q#0W*xUW>kNyZet-F--cIAbOfU z07DdFzj?2)=;0du<8y>JIOwS9vH9G&J}jD1ZLw42Tj{4F^6}Ye*S6Tm zccrj-Qv^Yp6QozCs>Rv{DJCLNA1`o^P2DqUZl(mAeL+nfvQV`m&2N}qrhr|D$_gbNQi{MW$a7ty#TG|_?7~ucX?rgk zir`+`!!w|p^hQ+MWe?#@lGz*DK5z4=h-C%XcldeE=+Jd0Fs77XAek~ zt!zz=8be@6;8I1}eo{4Zcs+u1Jeoc7I59Y7`77RmP*eEc7N(^bpFk>egA+}#L1rBy z@k#Ehp6jzyT^z0P063fOUl4M%sQWg!n_c~Ap`quL@_E}v*WTB4Mh64kL~yAPX*g`S z6qqfIw#dF6HUsTnSfi7yS(ExYS3&hVXHxi0Y5#ePyNlJ}l9?eg1SWCIR{d9eJg7Nc zm#!Ib*C0^NJeax$-pI#3}u#ajXe!t@^}MT9Lj@FA0jPslRF?Jt*UUT6FPN&(tJ$KuOi&gJ4r zwY1+Hj0K=bO|o;Odr?=Ldr^cs=oyVUXmx}P+1lEMMKp!q{p#>uPs%xo@RdU4pLq5T z?d{J~D7hmZC0O?S-9>1bqzyy;WON zkt~bVKhgBYeQ&<_HS3EVHw!^VZOGWarh>{4qy2&X5C_VDF94#VuFV+JXl+6MajlPPWoH9bkK7la$)Js@M2NE^NQC^)-2RTZW(?)M?% zh?|SsbKATW45{%UDkiE#+d ztzS;Ppa*jq0ZN|)jxqv4w?)_8C-zuB=a&AF(f5biR1d+nv4)7?Ud_v_lkV8}Vvt0w z#K&c5E5z6!=mWX_UJKR>5QKX;e#w@UVxe0O(^E!*uV#_U;$E|h=ZBxbrp!5-qt}Vu zz0%vvv#eq2UYJ*7{NqT;@y+<9hQzH*doq#Zk~Dg(nAg$e7cwOIF_X~Rm`F0ekB{vChRc*+Xp;zc9E2Y zU9S%o?`^-0=a$_o{0OU|SI+K*{XPOz#E|VC9*@-aCeb*Suvw?`+oL>@GOxalt(+u2 z$7rB*)93ZTnxCa@m6txLbj^+(RCtrG-i8F}$0j^Zk7m%2W>76O6|}m)TkUyI_KerT z`J-9B-7V`Ob)d;n_29!e#0U?*lTo2RA7FjA4oD?y(2P6R+(hN(U}Tl-+Hx^MrOU}| z9zFsjVMGF&f@2;dci&VML!H%K(p|qF*h8ugi}lM-BGUi^-O*A5D%YR&7nAsQi_ooK zjv%uBCxOv!{)O#d5a(`pZ6|aakN{rZe}}q`YboV_rr&TY7sy>9@!&oYRcXDa1kNuz zdWwLDnv?VZI8;H6YPVl^sZ*0^E{l4jae^_7YO$DR)PNu4`<=`+t{?`|o?wrqA^JPU zmg{z`*>3+2lQzk`{HH%#Nzt_Jg)aF4gTAlEPo!JEt{a3 z;<|e?liH7=jRv?uHfXA)m>8{P#i8ciM(UaTZGHF>pbjVy`Gz}SO;#3c;%TYvIX4RR zoRjv!C+H|Q1G^s2?(bxoZ^K(m%M6u(hDU|7pPl&~+8Wi6l*isXbyTEKAVdL58syn4 zFLC z^qI>KW9W5p#4?F9;FJ2d^%|+KMorXzy-krA_SGi5E80H(dvR z#owO1+_r6syFWdXho4>uRLFH*V-AV3AYmQ@9@Jcgg*OikM+b>(9u7wWmYL~8RU^d$ zDt}BL8?c&JuRq<_85Orzg~fe^#Il#LOxEFS5n25dZ@S2~m@ggKlpW;ZW<4gj%hV)T z9RqT-IPQ=yq8`ViWfSB$H{PXni?nl-efm zM{nOwZ;YA~8<}sLm+TDWRDI}a%)hEjYH*Ui*yY^kjW1byDC?>3n_t>A(^}%_G6P)A z9B_zC?XkOG>e{SmiVNxyb9^kB`o>{+ZA09!jGUDgLRB<1^~PD^s3jgP75hCo8t_+hnjIhxUJ-yBg4{dw%({8Hx$$xs+C~W1q;~BJ)rQGVb3${jmR$9EY*6U6 zsuSr=Tral`&d$Ftc^Fyp$(C?xcPJQMj_!Rgf>S<>)qGwyM>{7$(8Tuqk?eL^w29*rzU~I!#J}E z$aT&0VqxvDT(JGHGJFDC*JZNUJ=?8d>NX>ZFM(-L(WF0iA}%2dL`bj>auo?dIosD&KvBfS_uLh7#40CDU3~-#V8(-UkJKRDqZ>s`M_&yaKjj#qwXfsO6?|!G?Uj5yz9k_(7u7%W6_qUl+ zEO1t4&a@?q{R43SYTxSI8kgv<*atnVLj1how&3n2(__Yx?E$1FRf({&C6}CJr{DBe zCn)_AuV`oM+N_NRp|#e6XXj%aiak?P{SJWV9k1%%v^9SsRimVb_LljebrdAQ7^_xo zqHdFz^h&{Stp=@FE0{8CXBXzPA%k`8Rq(~Tf6cG$&uW1y(%;=CZ6$l6zvLL z=CbrCw{_DM6gRD=PuF8(f!k_LKPZ6x*5)(DHgS=H_`_I@w;5Bdyk`$PP`S>eMXY71 zv6_j@E0JgW3-f>bIF9%>6LU8lUW~otE3*wWWU=!=rhGB=&q&^jQmDL%$97kEz5`kh zhZOps_gG5`QasmjQydG|WLD?h9Yc#!$dMxzh5vm~OyIbU^hFYUDT)#{KspLTlNp1J zhHDCIECN$FMdl=dY6-;n2ZJgdu@bf4LCx z(lFdmJOqNmRA=;d;{&*62z18ZzITT^M5V=2QQW01>B%O&sRyKDqQG1*1J6=rOXICF z*U#|mdh!i)1Uxkdw%lQ zWcD-hV(-rr9R9oTeSt_Rt4`+?JoSaySaww(YLJuVod4%Cg4tqzMR0dpt2a`iCwCnD zZ_b)wX%g7ohT|s1?NqAPeOe;HLqV62*7OQkapNkX1Xf`jSS;knR3V7~^btY*$KfbV zgc+zZV_)efHt_^@r>0?U*q;Q>3ZqKU7Kv7G)9UGf2>jUCatzHQDg!G`WA4IxI#h+; zq^IWY$TJNP8Q{$pIO^}~-|1u;5w?ip`ePHl+?~&hVjqPy{r#I(qH(JTp7kwa;1OX_ zb8pq;`>aT+S!b4Yc*Itme_mZp(ZV1PxGg5)Dp8k(TmZ#!zv9|eJL02S7GT~_`YR@z zpzaZDeNjaw!pGjMIF%`t;&0V(F?oD#1q2IGsGMuLwra%4rM)vtwAyIfiwt7L%o`SK zP$fSCY9~0Hmb2W69%CU~{(uz#X}hEUiB}6Sc}_bc`O@UI7|9_M9~ zYt@b^O$$o+P-SPT2Y}_4a$Y2Cqg`FWbr1_tZPV4x0L9?|2L7Uup~)Kv;MTJ3$;AaK z(rxN@zS>!s>o=Ou5P*l1GN@%6qfe2Bj!gM(h6+X|^L-vM-+I0E;tX?>MccY+DA(Y0 z#ELkhUznK$M3}J+@?qE&y%^3XZl9Lsevl2@n^6}@$^Q&tK5su8)&jE)v7>RCIRm!2 zR{8T73$y8d>|zhMhfQiFaaZkAGK@{SpQTL7(Ezt>-ZY^_q|MgA*ZnZSB;+@TN#Gwn z!gmQ5zn={(gNH)k4Au7D&e~(!J$?l5OKk(r0#E+tDt6#*q9WS_e24=^zCX1_i!G;t zj3W7Xg3J6O_?un;4Z@s>sb`*|Ndp_oS5q6Fa7YksLz==a7G~q#{yl!;w=@-x^*PVT z;xCs?d!0DgZAd}v@^OX_#7!RvB%|4o@X+)0zWCVYh0&Jy`n4M!;!Bj*73kuFJo<88 zH@}iGH(Pl2l-ViaY-mDa2*N^k+{=1PvjryVv2S;9@{cNN_}(o{Otj#Snt2r)I|G z#eL)@-~qK{?x5IlzR_%EDbh0qJ=@x8s=lD?_Hf7%OlRFG9=YwoEh0cXWr!Wpa2Q~& zQ3s21Q5zB*)ZHF_@CSTEEyun@u-It2B~ye7HrMEgvK%N9AQUkL&(&{#y$~a%WYnlu z`L=a#ZH?6{MAj2sr!hto(ehH%{o>-n)+}kQ|MB zg_iH8?#a%p7)~K&$=A|uznN@SlMArYCw1!x*o#lxJ~l5)HLTYm&#ZfvZpxFsO|cB+ z&5ts87TR!BT@ccfne_nmpR=4&4e}V}CI5@&v}DOuV7^OO7fq_OGYohJ6^ER4x{LIr zFTw|f_-9qI+`CtFI|N`3{MOp82b|v)h`D;lE^F1lC)4wOhxDIIPQHRtSl=G}F0paj zAIWIgL2c%rVh*`a4s!1PRpe~D)Z17>=CF*Q3fV3AlLliN6(cfF34R@{V}@@(O z<7hH@OBg?bL*z?5UhzW0viLeaBgHfYi9OtvHRy>ubV z?nqO@ip<;=5&4c`-~>^e_K4(^YpxoQ!m5U8 z5%^TZq=(;B*11UDwLG3 zSIfG|AeLQy<-KKj-F`uAx%$4+Lz<|6{?UYhrA(2WDz_2z7|%HFK0tvMQKz4v3Tc^2wvTkrA$w|9QvZO<@x}UxmeG+qXyq z&*u-g<ntls^W>Y#B?h=1L1;~rck-3kA> z7Fh3Iuli^9OIeWK@Zo}Md>4Z%Z$mycw4o!cvKqNtxyq9CyS8;j>_--lq@V&l{iJmb zcf%?v-cs3%tZ1#^`N+C2HyVoH-;#{iSM3Cw7|nIyL@^{-{I;UiC7b%y+$x8N2$%nL z8b^}0(McKHnA;*Sag`g1eVLxBH{Kq6_ie9|bu|^XCu%;(9CP|LKT5yChwtI~)#%)Q zS$NMVet|~2TTGM&ZDVOT0l_NA+nMG*0utWuJNc6tRkAfnnw5X6n_Dzzsw!*Ml|L+5 zp*eE0xAptV?{^vXaOIVWUWiPVcjL@bU34G%0XD7uab{Jp4c!?#6K2oZw|p!^Nr5!HT@dKs+Q3)<@#dSx|JAk@@vDS8kpt)nVl)IdDM6Z;M>F6 z@_546XF<>hGh6VxD7+$o|A-Wh<#M#0sN!N`M>Vv}&h+09Bc+JqHEeL@upuLD410wJ zjXr7*V&TAYgmWIO%-i2;EoC;It59Rdy?NC0yjLN9j6n1M<$Wg^CjX_zxT|FE%dRwP z%9!-qcoViY;uEC<$3BRZAc810bo}Ls0nggtyD=l8$@0uJ9r|CCMIgv@KWaB^ie0`z zqowah)*HWY(w^&!d5+ixOj7ZJbU+nhN!Xufeb&Qn{WIXhw`_rsO%v-(o1~t_Q zus#w*j{Dqj&Q-Nuw^7OWfZ@S$b}HNH2Z}HFqC-hb!ZG%EMK zINVBkfyFcTkg3gQbSypNW&W2oxy1VVHAxJ`xeJl|4;Itv-!a|Iu3l@O9GBIrnLETG zSV2Q-aH($x^I!6)hs4rriO=2B5gWCJmU(gDke=3Fyza(7RO!7_?|FIHM?Mgr^EP@T ziV19|mX#!!r~0@KOWxj&FD=;K)UtZVsIlwiB<-pnhkU=!#*DT`d2pt0>H4}~tyBkN zS#EAKS+U{^bHmVd7&Y%f*j{GN(qFV2np7^R(Z)jdLCYZK8~0LfNVzE58M_<_;z9BW z|BZ#OHZZHTBB1?lUQY|!3f$05$CEb<)-=7M?-zm~?_%#yTMDI6ks7@nhK@gf@Q?Vu zod)}z_0F-TCA4o`z?;+-ZO`7QK(!(MlY`*hPpZOXCXrar;OC5Qz>e%4#|EE}kFv^G zQ`&WHlk$td$JUqZHYML;T+b5bxf~~yE72UU-@v}gG7VNN^gt#!d<2UNj zL6%`8HeVZu+*sxvYZj(Hu@ti6Jja>ICc#lcoNe^DPkl&7T;mmib}p;~|>N&-E(K!|$SrrC2>h?WNjx zue&cM8y-KwPP++Cm~vGPahNTRC&Hlum)r-p&zbjPnZHl&nOHD&apGHrJMYkWyTy_T z%2k~BnAhH}HOKGoJ>DPjO->bj&SNUsk)zUX4Hq1q(%-V2g_MXg9C!us z-05gf(+=Ouw)SJW| z`8K^{&N3Y-@sJafFW!d+g4cWyNvA^}@~!5Y&m(0l3Ql)&u43?|tpM6ftNH(7>#W0? zj{A47fPf+)C=DY7L`p!qOBxiUTe_v$XaND~934tXcQ*oKbR%6Gof|ds%;!1hI_F&1 z?=Sx1Vq^P$;(p)v>wY-0_e-1bOOTL&^QJyMifJ*LWHz~G$M06Xk5dY}E6tKzsX4z) z)-i5)$^!I%xbv!6?YOx!A3gytc_TUUmEdprxjzKtc!Scyr*fq*hl1U9z!?UE3Igvw z@zU5X$y(YNX;@Wo>Bez6=vXs6c^dnV>jSCKY>Yg~DY0aH_rkPh@Irrb)5|ma+G$B^ zAKNc{wds@jjU#GT=GrvOOkaw>p8sE4eQ}f1FzLAIcn#?tTj;q zX)fc-n1>S)jAv__O4W*}gzwa^ol5GPs0$TW2yIrw0NLrUrF-7l26yGRzX-=+b~s)| z`;*I-DgvMhcn%xJ@=&FPI`d!xAU+~$Ne)|<_g<+xijd@!_y7|TfTnp%*fmCx(~;QZ zAak4g3jRBiRH2gTn=y+wsI%V%Z32u|_{}>!<-#pCdAm?V=c^1ao&KJ;?ZnK zGZcqj5603cDFjl%@Qw(bI#A4RosYN`C4NT1gkJG@>JEgaRh7>2{|Yb2wbTrS*;MB;tKmuZX6)41@n+pp0Z3 zkXL6!2X-J>)PnK>T5JkKQ;TnH2Li56#)kRi{(O%PIoyo9Jv%vBzS&zJUIF zQvQa&HN|~!Ng#o-7@_Q!FDEI(vmt39{Oq6g%y+&U0#68`naHebj`s$rA z*}Jd2Qkl-v?NR#Vl)JLcHe5|lBnc}tbI`eLWxyu(hLlmSplPRHRO)`N1?y`vl+W7b z)&iGz(Id+fNrRqHY*z~K`4H?IT;s9?qmd+^qxjsx_&eTLPoS?)2bJ?vz!NS$RgaRG%j3)ioU%acvN>lm95vvTb|igHPDY{POtk-t1q&lh?>V>d|19 zRV)OPk1&3#Bxu2^7IV>5F%Z}9IGUSS9z0TV=QPQn#N-P$s2&{Qx!E;e&a?oz7{GNi13Q(i?M>E2Q*O%`iEf0Y6R1Ya?m7&Zv4 z?|B55S&ETO7A?^D3x0Bt>a?xxyP_i;)>AM)u=X{Wt$ly}qVqfP^)v@uD!{ohCFtJ# zMUwDOaopZK6;o*gQ&A2B{+T0`>VwXZhdmjGL46X%l(jDPr0TSF*CC#<;1RhCt&u_` zHxBBAwfK@Rz<*sB^t*+0XD)41UhmLnL7#)ek+rt6(bg@s8LN8$HX9T?d_Lc>$Pd5|PBBx1JGOCO(r&uCA6iMpm{LU(wIit<$VfOpZEcIJo6+ej-* zh1>1v9J*D~XS6nngqg)SV||1<_jt{5FYl{HFgwIv@5@x|2dOKs^hax%g)uHbS^mhA z(^m~u_za+zQ%lfk?nrN#v(Ju|rw)-|zdoi3^q=ik<;EvnugaxE$~ZV6ghEz4=wS_W zB9*<;i2X`_sq;SFfkaZ_3+-*%yHYBmKZ$N@fz%kCX$oJ&n!*wuRDO1cB30PCibC|O zr7Vc(p2h(SiSe#h%xgAvn!(1PV!iXYSoPP%0A_Dr zx0n{`IW&7Q?Lh+!MyamcR|~rgS6OiW2B_ub><2x67!e?0YIi`z3xL)hQoFbvDNV}A zOnl=x-kMVETQbKq()$u16L>4==T1Y)U`#;MXWxA_`O6@Un)V+sPHpEaz&S|sj$Il5 zgED9$=o_d(8?lsZl|yV$eEf{Laf ziWN#K!o4X5l&996jPm*e=e@M{dpLF zfrskhJEL>r@$MKfqehx<5P{vvN|P_q5hHW1avA4vp|hXVN!u^$(~tgEC!%!1%Jx?u z+L&N;kyi&@-GpqN6s_a{Xt1ar%=~s__Ofa8&PA$QcjxusoJoMCKT@+LrRoVg>@-hR zI?9EsP>s}X@o=`hRWERIyGc#YkW7M^GE}>(ot^0Z3z-u=18K`~Kmxr-XSxMYvLi9355G(wY$N}~ zF_4CZNHy*9?a9xIrWh42a~>}LN)-|LerCIM0?#vLbsYaBN03x!u2Y1J@!G>ss>vjZ zm~d%cOC~2M*CUG>K=nukvljL z!#NT4-CmO_GyoczQs#+V8=7or7NHg{;*ulW5aN*YzIU2r%CUets&{Mme{L9S&OH!+ zh)f^u2#Gu%%#LfkVG^;Fk7LEpf^q+QDt(KgEG|}IxA)(560MK)6RnvMl$u}=mirX5 zJ!OWeNPFkPq~bY>4`Xed2?KQnrHD^77-%)BlRC6Gtm&$OL}Sl=N(*+-gZ7_XhNvZ& z*=cu!3vE*;1**Paz45v!dHent=p!hH{rbCvY^#bw^spN>c$#Bd_j9!+HO;hh+3y@l zpQbIdl&4%U%0+76Clc4xCA0cJ+A`;QHm>oZeRzqOv!tVE;su zgN_l*W2JyU6Xzgx@nlH9wEt0lcHFVA#;6_lOZ*W$+vm9UshUQ`12!3Z?NzRbL9lIX zNb@y<0ap&g;wg#=vqk#Z#0TI!fv^;h3|4zdO66*4J>W6k1_Tf=JW!6u)uzB4m1D}u zl-lcahs5`nw*l--)CaeVMqdPp*KvdwU!NlnEPt5d==BbD{;i2-BXWPtHaB;kS?-ZN zDpNT&WrR%|j>jsyDtW&dE9S%%jj7o%j^L43pn?5l3qhf+z2;4UGs-O4?BBYUpnLA#kxn~qhaiYj`Q-Q zP1*hkmxaQPdf^_s^VABXC`qg-83LitoHL=^M`qI$kx!-xJ=CaFX1V7&@AvFIxDmxr zh5+$i^Ml@JG|HAsvnM~fJs+WahK?qYspe<*Hv!niCBHo~8Gvo9iDZ7U$7oCYpnKP| z4!Ovza=#a`HQokc?|inGANGcz*(Ci!3p`wB%O947&4fm|Pn!cY09nE`$>+xKmMK8B zcCHna)$zjO0Y|#zoh&;&04}`z17C6jdSjr! z!m@RWueMYX>@HJOL0$o#w(z9;baw9>9Bs_!zNDId;W3P-4g|7Y<+6<#rj7Ble-k1| z0dLtt^c9=#2B?2cvvlrC-qVJU9aZ|$M84t0Q`tib-5n&pg-~OYsDA;z^UO1-wK9P6 z%^7FRX5HMPQ=m47^NUi#X5F#VSM^s8v!|b`F?5!uRMOwOupU(ZeB!h4ad5#8dg>9Q zKP$rTMsle;I9f|T=5=OyEygu&d1-_Y=RdhHC`j)394{%9qD2bJlW8A0EBK@8&3V9B z?qQbD$J^gVGyUUAf^gaS($V50v+=&a^QusLu;W zhI*UOmf~f--@Bl3C>;n{O-Qw<`YR^uywwP+xhlFtqzxu zx5dwJCMr_Pw)rdpd#}S;Re-mqzt3GB04N$LfbIfv)LPJmDl+R7WrETV%0mu41eRYL z#q7Nn*?pZ_zIE-|a^}WQn8UBg{)P{+H(jAwb?(OfQgm8IJm;6cGH@SF<^d=e---H& z+>+O)uLqHSJ29;HT+(BCDdGPRyd=J(=E0bNu)IvYmirzBye=*}45IG*ZoQMS&5MbW zL>$#9vz^C-D&h-!(~2x_i&D8y(OSUoa!ceIsjC0503o_n#iKsrAyHl2EQIHXm`*m0 zobH!e*23=V%s;W0vL3;CTyE7M(~X&CWirOMtc3YtW@RM!?B=7N*>=%gHEJvskp12= zG-fDPM|r1Kl{p`q)E+9SzZcP!0t_#*ub{~#Jp`9>?Fo34dIFg?w^I4|P&9e>bn{1k zZTip|&45yoqiJcD6`e&{7FO_T-7mBSbKc^UiK_)9u7v0g^5)Z*^CICF3824E?;yRz zk?K8pVYFXJ#jbnAiZvT!RP7c@>lu4T(WOVuhgWEL2>+KN=T85hT&j}|lapn3nk22C zR|CtMAG#rjphS-JR5|LDjjNINvznn{9Vb9NUD?OHw&Bk;dz?&TOFuG?lb(3m32z;y zff%crK5E@@gXlO7bf7toEzYdfzUb@iV2VM0L(OJ}&k|rW3QO|CSay4ou80m9sDry5 ziJ&BJei8!wum^stKvt+C~7wqx;vqS2zjB%r*Pio!Fg_i(o#eS_RKsH(w!rAA6gBA&?p9! zTVID?0waGv{KhOJkIxt;ixMh4-c{~N+3~q*xfCwS7SQZDZ&-BFIw)G;{4Nim`f~TZ z<3m8(4#FPZM>ajTJ0?*~IBNobVPq5Ho2OP)CaP*Am-W@xnemox%v<6So?23du(;7a zG8jF!LXLJyX6q1B+_K_bx>I6x>UmojIu~9#gfqR9mOoiEFf!a3`r_yk2*OIV2z#fF}}QedQe;R*H==`^Y5Mt_qs zI2VZ~H15<{Cu@(q4lL?)p$S;#IP>pLRZV--2>*qu@D-7mC5=_cDU*k7Lek_iHPytS zOE{|IKC42YoT8DXV(o4L!+`bKWaZ7^D~1JXZU7Nn|+(ZB+Cqhd&s}+uL{XJnL`S7RhIPTel`v zs?Xl<^pN+)RL!}sKct$26iJrrr*qAMUjp^U8(8Iu?T<7)_NG;LD>e!7tnaR~og$y{ z)tk^(Jv`=-COZSava9U98qif;%*S5=&Mp7s$}uALSuXDXi|e1^ln(FEevWBV-kH&A7xvnO{* zTeE}l-+r|&6^N6dXZI?^vbTRh0&P>67{q2a#-be;JBfqlgAZqQ%dYwLXxF-vn{=bh z`kue&!hA!xm_I}+7+X(D*zE8$)CO_g{Wf;L4L4M=X~+vBFd`GDj7=#?!7=RI?LJyf z*ONQQ^4mx-x}H$nr}k-n(WVH+c!WC?Igqag#RU3_#-IfiwhUtJxV>J*-S=uNiOEs!MX_{{2wW}} z7h3_WQOhk=TGI$i>O)+N)v76;4T%io8iuDLsxbCTv@eEhu^X=IULX%0P8n{RH*a^S zZxJUI+WM@W0p7)!_!D~zsglJ8B}&{S^Cvny#E_j1WVnv6{rQeN{N)r_WNr#vnM*3heU#{)K75f>Tn6WdFaX^mR+g>Ek+K^Fl7611RHUUp| zC$1#I%<))|H0R@XRzMIL4}FHUn1YZos88F}S)lImpxWIOK^*+>)j^zGuJO|qevTM@ z*d|{3dzjRH+Fd9jady8aWTz8Gu0XpMO}isWC1u4!WL_g<93I)&f`c6>WOy#OKdlNxbe_aq=3GMB5wa%=6khr!k za`s&^cFI6*_^;c#S7+PV{Q}$6Ix!PLaR-}*m!S8eT8^tTa{l>w;sc4+FPEmX zMm*-dZeHC_+!f<`P>V6i#H7Li5heW1TOBkd{B9~shkq{JGTd^?&nuN9L1#g6DQeVk zlR8JU%H$q4O%-OlMaR(J9rJJd86aBDR^!uESHIj>1>^X8ZZo{+eXCdPOxiqWMf&O$gdo~}(Sw+^AmjOjRLexxf>*&4-| zBh=s3))aH5J=P(6lNm}l0WM+_tdtz;r=Ze;tAYm`CW_aj18Yl|*0eXAwQ zEH_bT;upa^29S{Iy*fuPDxbV)7*{>i$Sxw;#Nj5wrd~e!0 z+BM7$xbfKVb|Byz{XZ-K8t;|-%Ni!+I!FTmhNCQ7k4~HW^CKfDu_zMlNcHH<^-GvM z1sr4Jq_EJqTd$hCR?#z-lPn5};#hE^;K1hJ+p|4>6Loc8XM<@bZ*TGYLsUHTq7X?6 zT)&|yZM%ySwF7QTxou}h8LO{gx3|Tiv-9k6FT^#Jt5zTv33IEyi_9CnEFX`C`MZD! z<44~x9kqJmrFM#WnNb?V8cCHK41=h7MhBA-rT z-HF(nQUg`2_a%gZV!-=sf4Re0?|isO1l~MQ=xW468j+dxMsS;_twM}*S9gGpZ!Y0* zZVK5hiZWzbb+BBgbd43cAQv(!X9sRS@=Nw@tDy67YKN1$u}*aO`7r9mfy>p}Miqw6 zE$9L)&^>QT--`_h%kp?nbw3Hk#j7OVW~mH0yVJjRQSM)-gzTjE0@7$>oyY!+O>K?; z*{2ek+c`?TyI54e`0J*QPJD{ZC75X~0(r{!*U4Fs+myoeIg)8cCNV|;@cQWrb)ak-M}`3o}--c?lg&VJlBVp|G9bw z{fw1Fm`y7G2{v}^*&y_X?n7~8My(SQqjFfsDy7O^3^1}Xq82x;M7HM?a*8z(Qpq?z zguUl$DB&OocL22Ok09pbV=NWrFtLc&yAz$(CUrtF6RhlNwRzDktwY{4rES(l7UzWw_p%dqd%`YJ>uU}8OWU^?79_mm;X>XSniXGNG~P{C(!o^ZC6ui$dyQW$|qv2lAQU5Xf8gS;)a9J1s*k z^yd$mqYdJSjLrd#9qwqe1F z)$|@()Vu}L&>DPTI&{+_H>YCQjowl%#!V4*djUcq6{8Y56M;9!4s*O?OtCsifVqgA zX>eNtPYpb)E&Dc$qXIm|z3n1$XIK);YAlg|-ZYSJbX`3Zef;0CAa+oduQ5dugW5k! z1`md4ZU`J%q9? z*{9Q`RLsMt_7;Z3Yd=FnOW#lY?E30_N~ZGV?iqcp{$1L64nD4Hm1$#Gq8XLG!B5|% zIbbzf4Hx$Z<~-g6#W{wyHq33inXP|duEWDhiI&tA=c3AJs<|M-MF0=Ys1h)PqA4FU zgQUc9P;LCek4a3KsdP=s_j5fpYytj?rEwnR^03BxqTIs?G@g*S4zs^?hM{EE#O0ae z=o<73;cW5Ra|&{-2eb#dZlo`D!Z}OD(AV>n%L}t=p%?ij9&H1~Z|C5i9mmG4BWZ=~ z3)Xo9px9bjRG-aex82sUpIE%K`Xz;4MWPE!@U*1<9Dc|viQy}as+{JsmmZdRZKgLj zSH@4z@t>;#UvQv-ad~WYr0s9#PlfO{JcEHAr1U~A${(V`N?uc*ilAS^k7pSBJ_q`%D6(YG!pHNo>&s*O z`pnQgLsM!&vhV4C-?{64GSHtm$HxqP(^o@Ob&4&r{m#RfR5tX&_iS0(fGperoL;?1{c97Mh* zBnE*de5ZN(`^hD)4DVxN8?ybIH$w+L5NFPHcKTkeSDks>w&(2a{# zOIe0r1t`#&y*g3U^c0Wz^%+xzh)|!RI(mC=8%0s_*%zAp=v98t!;xFrdJmfSm|G5S z!7@u`g)r<$AXJQ%_tso)MR+T6#%}q6EuGO z$kb)Pq_EE!SL^y<~jEkBQ9Y9n_(43p#cM7MH}kk*_8M~d5v zd^8T9=Qi&jKzCk&$vd?rjthpcvN!wh=#!=(yE9|ficiJ)Kk@I~+Zzc|i-Fwpm~to3 zP(|^C2oe^j_gL>e)PWCZBXIpJfz2yu!=qDC+eulJLNzvWW}ZN8E;FZ7!9Pn-hoe|0 zz*l$CXc>+avtE%#IZn0&bnhgzzmNI9|Gxk3=8|hUbVM+ugp?!Slw|t9x&dR~Q#l{o z7bN%G7XT5Tz2j&Z{}L!Nm`Ke!A7znQSyt0Z5x65nQS3Kj$?jpi#R zs`wYOlMp{(1bIX~awKuxJ#1V}*^E8rK;s<>&&1keZ?`2Ls{P{?B}rCq7)uZtf@9)0 zWri*&OCI%`kV|vyxZ$h$AK;{I9^NraWrz?iJEF)W%YEbNuK4z;4s$?k>(AqScK_|I ztv!qtTp%KXC52%x(S;X&U2hqWgz{vKw|ar1nqeD}aCC&d!PiekreSDk*jjFmXOov1 z)zq8%aDZ<0MALqlv?}l62ll&a2WKcq4O3|dUoh$R}%1w zeby?mrLAV%*H!6d;wsBnBEjXu+eB;FqDzh5sfYnvEs}z4tzw%sKFeicT4`{&(7M4b z4cO{?ZSJJzg7Q3I7rO3VeLoheA?hKb4lj7nNiyNTQ;a%FL%E9och2ztE-7VtSR0|i z_M~I4l*|#&))(6434v&Q!U)F)G=6W2tQ{Qe~)*@ z$-iiyQ_HSZu~BOS{4$bwa>DGn3ekLrmskH6UPjp*+K}8xo4skt6TVr_n)v8oK1V zUtWX0ye>xVe?yLegY_Fz+AkKAzvELCT3q4P++Bza6y^9cFp2{>vtsrb+LL`$ZLnE6{j&VM3bt4wgUB&KwW?RD)t|RrB`Nr*_?{M_M>dkT6 zUCieS4ZV`j6%1soX}!{tA(Ezk43ev;!#R_Jd#m&MF&fKASK2w$P~-{1C#_)tM8&Ds5#`k+{>Zt4kt8z#6yLcG7bX!X#@S8`y2@<5Sg?nM zGseWxc>bN((Bx!aiy#>7Ri2F)($l_A1AaXaZf1`W3pg_*b?V)0X~Z9EHT%`S`+k50 zjqSp%Qx{J=gd*i==?$90H$D11ESf5OYp*1!7n1kQdunbO#e=+IX$ORgG)+gA14&Te z=(+F~dE}#aXc*X7dgLOTXVr_ zo1pq_{t}E2GDN&9K{udN(==Mxj8Hkgu2Br7hMGtMyO}IMW@#qyk9Y?yeO9WF(kD^R zOYx2V*r5{Bb~wDPF9et$`wg{IL=e4DlaLUw|>|i1k zy^3qg*PakB?#0*(zc{qSVfs$5d(?5`1pLgwI3|4KP)l^Q0DsfG))QG!PYiY29!<8j z%Np(_+1ThK%LWGpV-G2^sW|h4HqiGNMPo0=8&}RYbe6J$4tf;FJ z&7zn(yBVd1WlsYjJXr^JN4NqGn>OJ~G%stQ4{&b1yQs^CMHrTys|i*V`SO3skDnrf zq7TNd=zUQC@ZI_!xcpS1Dm;=)o-z+pYUQ*l7#`^ykZ?^&whu=Kxpg=s0iQ6gz0)c~ z#$eC@j!&(cg=!Ou&URE43#wGr1SstF=e906#ID;pUfH6z1B``Jj3pwLIQGU3J6D|a z?+O011suk4yX-qQO!Va(a(Iy%#_W9!$t=4gO^EiFYjY9)K-5^+GEFb(DaEf-rVGV= zOIkwCs02@`vF{DbXApl)W&YHaoP``f9{Cs8#fghpPtC$%f2mch!6YWGYxU$|0H7CF zb>Q$@-(#xI;pf*Z@$aKeEU6V0Z%f$X(P$r`sV6js*ryX=Zu#p1-A|4ENyrj_lf4o% zmXamxnMixvZ|drwuqQQ~5Mf>B?2;Yk;mQ0*yiMQL)Ql^BtE>h2GS#sMc{Ha2u6K)E$EC{43C8CY1V z*=cpZO?e-~E%Ie+IL#dBEewhGr8em(cIy{+CNY#Znaul#*id_x80uRQKe~u5qSO_2 zA$8Is3$VzAF!U9<@A7CHFECyQ(EwmT!;WGWm?l}B;yVNggT-FrE#~cb(Cq+@(2~xT zkrp@o2;v(_{lIJWaKFKI;S*JW6xpC8oy4e*qyz%(dQZqgc*=`j6TxM{Xhtu2$^d-_ z7$?hCM2JZv)+qn-Lb8K)C-~QgJBQYUoyB~4ybUmW8spMsp}MkJf}XtQL-t!uW_4~+ z+l;m3q-g4+&Y8D`q^<*QN4|dAZ;J6`m6qk0W&6_Z_0A?BJ*vLme*xZG}>Ji z8C?~5*DIS5bE`oJHgz#>cIryqQ&n{9Gt|7rEO( zlqf?DmMbBOd{sr}i$0C~Khh(emXTRe`ChI?nnk~+8P4wOVvgHxOi)`HmB}j3PKj=a zXd>K~*jPIfXHpm;(`dgThdf|v5%=Bot0N~gzBXSxP=5aJJQ_ywkNA3c`wDDQad)PE z&KOXCu;glu2Dx@1O7%5X-KU~!h_>W?me8cT2{)t3e7(sC#nn0z^Vn$(cAcLeUT@BPr9D#c@57o7$b zJt1UStpoeF=jb^gjkemr9eSFqMb_;U$Ic2eJbbzGMX5Kd0b`m`j>pPw#wKv&3leRa~7b;_*?DOs!!BWREgDwyYB(HKj8R6TNS0%Z)73 zDy^QfO6kbIWcUYcj)&BlEd0$BslL~)K(cU?h|{XP2WHY#Kw?0N9Ib)SG1CQ%|1))bag9@)S23mtyr zLm?u$;Ab6vhr)uq*v}~i$30QECwGL1+XpcgGGq7ZbCRzW#j-@&iPqc zdAB%|Dj_4u&i9!t0(F&4B2LEWf?zUe;<0*CQAa8#AKT7G9IeS@akl8`eU9sKRcC=+ z+Qy{E+MDLOEKVo*OK`WdT9RKQI~R>{=9`?0lG1ZgoenAq9W@6{`SWo(s+qh8bMu15 z3a$K^lw^wzeTIOO^Uuw9BZ?Z8H7)4)L(tiBXGxUi9GyVBgw|dPn;C*jrXyi`uH&5) z_IU|cL9)WVk9Nn>tdm>=B1|gb+(09i^&y1!&Z7yKg&-t}>>Ehqar{U#M+QHy zbe6kH)2Zchp{fDNrf~AyZS`y9+V-7pvV!xnoRx7fwk<}cAiKNdPjfMx-HTBX=Tf*= zKqBy{`7YUa-Yx=B2=9-TG^JsXZ2eB>v$b24M_Y7xdc0G% z{#1NhJSMj>KMgtEgsT`iwCtv2M0@v^)M-K(Es-MvU^KX*=tju=8RDkc*HcrnSNdDc z?{l<>RMNq^Zy7`H6CJ(oRnn7Y-uhje`9Ry`NXm97Zto(TCm%EYk@oz*5pM44c*ry^$(lDe)0Y)(w) ztyleK?#7cn9aq~g>z;JnT}nuL#kH|m@AYhC9JjG#?DlNzO#CWe@>&5F6?joZ`6YWe zw8=*FtmudNU7v9`Qms9g0`3-&vGP0Hi+Sl_c&EA_gOYrOZ}F%~AAX4l)43dLxu!QA zumdHbPM*D2ueUAG?PN(Xc(S?8t(zJ>|tp zP>^g0$e&}~FI^BvpRUEvef+=CbfWsH5bN@QK`~Iw)!6TceX6M2c1>f@t{h{2BR$zX#pz}?j;D_lIuAwCLL;ZESQDw4Q^U9B^lj^f8vF4%_Ki!_G;%@F_soQNxim0cO*L3THN>q zB*tgJ2DOzKYL7e-VN2xLzdY_a^ed5K(qQKoWcFK{=uaXb4 z?PveS9S+%kfPU%y?=a&3yB0pd(x~0jQmEqjlqQRk{c((bY~}|#<=tzZ$3K2CV)4f9 zTN_V}K!~6&{OUQ5>&~XScnV}@5D$?YA)N19p{7OyPzcRRGPPpxkGjsVsM#fj!iSQ< zfN4;CS8wwB>=@@0_3y*`v~!ylv^UR_%aOXDR)2RCR_pd|p9St$C>s#@2)hSHrJ^;{ zh!9=6s7Xa(SYy}*lg47H5VP7ydi`X|1Z`OPa2z=nY>e~jaITvCti06_Qj>lwCMm4` zQDQ!BF9a>z7?`{~|3)k%uZ-?QnXC}t;YOUD(%_b{VbL{J5seJln;v=7kpQbHI7w|F zW5ury8)~egA&Pym%s)GZL*g$6gI@?CCwAOe578zO zN;(MuvZ0EUH~Fwib{6V@9@rBk#w=sc83}Zih0OO=-_ZJy?+)`BQ-;eStgnA+eGMF6 z40yog;PMQocJUUO*CJaUD0Nx}+08G@(+z3TTXL&)K5RsCy}AMFS@1MW8viy3KScNL=n5}TdpzeyvyCG3 z4#1z-+!Zu&-Ed)OZEOA~o(sWrgL~KG8$JKE^Q$;Ms*(A?(XUHF3VXFKc8b-resqi%B0zLTcQMJnMI#1pAjcYtl(Umy!qTJi^kO_fpZ)iinl6w2mrOt8-=0RQ!$wNL z{5q7nLSPLHGBCB}G$`HqosDsINZm@_kCxE^ZUHh_WMs6($4cs-6C9$ar!RpPt8Z(v zh`aJD^N++!O6;Sk{lwoSx90m2!%E7MsN#T#fYp%%68*WPAL(QvAY}h5%dVJLu&Luh zJ&CMxcuT#O+`KEV;XZp(7JucNks&exFddVYzh8X{?fsNH%Ezi>dZ8}KL4($dv!yCq zgX8{xhs*!(FsO@C*7UT@0{^MyhStxf4hsdAN|mZq71vGO#(h?sTrYRlPbIW%Z&fD3vYss zLzFHUdeC`)&b3>)2sQ!1wHWa`bb2B=mK*?=anr$WG<8M?wLZ$IEeN+2t3qox&tY$( zTElBJ#rAV)g-?EG!>_hB(F{|Wey`nynF^#da~TUgAAu0;BO4hPm%}fEU-Vt$uX-MJ zW;^J7_r=`A4eGl75GXEV5MtWrEaFFux6DB~T@QAuvF{q-@vxQwSgu>GECDA=EZHKJ zeGfr1iUNy1^l~3 z`(6nfoUp#hsem(FFl;}&&r-=OgxohMr`J?(vr{Tsac zqp$n2er~kQy8FoNpp~v3^OtG39?&10BoBse~QdTlwKvD+u43 zX<9cOrIuXgsL{lH=D8peQZxB6^pnGqfi`D2@P=YA_P&mW)L9Cb>=RVHK0}{@5og0Y zuthq^+sefY$(&JSVi@Uba@H&TfF3S^MP_Iqw?NiT_|jN6sYYgBNOgMzL7NB}q-L30G6iQ*$}sO1`@0%c^JqQ1aE^J9!}*TMnnrhqJ+zoa z3o4$^TBtpK%>+z#9j?dm2fMwCZ;-Ur2zrk-m{I8@*pZXTh2v!OiFC(#P{D;h50%B5 z~W%?h0E*Di_qSK8(XuTSiL3pXcb2>|*DJMn<7@@{v}nOrKe9wKlCmk`Q56 zaLb|K+H4Mdc=_#69>&SV5~3+;3~wdbsD=KJBDqRGw1u^iX@-!Oh<6p|blvm-af= zyO1|;^InrY#_J)Ow!vef)4K z*^$^m`V4Tc)o8qYmjAy9d+WHmnY4en1zOxnarffIrATpi_tN6-aL`iR9g4fVyA+3m zyHgwv?hbFdkL=#}?(cp2$seRAnM`IfnaOp11>u0bv;u-PuC5iE4OR(d|vQR?gMQT4b>uyvyq;f&35f{bjbz`YyK6ubDlTj z>WZQu__{YyUjy%a)AzXb3ku(=f;vi+GyPY==XJ4-?L<8myF<1?t$cWl$xUdZtFt~w znpXgBfr;`sc%UC)=89x=Z{k}5P9(!-k3f&R2Q>xhw8R0(H7!AHxB!CV64IP)I%`Q+ zQ<$$8B(Ak6#*>*ii+O^c`KUvE{N9QDM=yuf=A<-Jbo-U9m+~sC4I|QW8?y}XXtWII+4a8ntqNfu^%=RvJJ4VOyR;VPZG!(v= zb|hxaDZRFIQY3g9MBPZaP4WzJ%q?g;EV-##ml|^D;L?z^-f##{lb%M*(rG$x{^D4v z6@SC=l|W}4lkd*j)7D~TAva-73Tdjt*fgV4oNMmvjjU#8-@(j5QZMp7h0*mxzER-| zZvt(c|RcU*cN{gh&%mBq~CTL^H7i%JdyCGCdNMO40 z2hz*4&4NQv^8iOxftU%Y zR8LFagI8D5ozge7Cjr79}ADAt;?SoA|P{Lvlnk7?k~1pa}# z`BzBAGd$EwkcaVk!V%>UnV6rcXVnz#OwD^=(|Ts29HtSjX;wxN*1ylNGA$d}8)9&0 zU_N3Tg_`1dSlt`Ol6~IM^BAPum!t$@WlKjKplzPq;ZUZIuS;cB315}KhH0+TqClS5 zXka|ccm)w1CR$kHK5QFj1O6pnMh!j@f>^7AT3S6HlZNy(4O^;j5;F|01r)9rz3I$; zNtadXP~RGIvHz0Q#81z~0&6reDIgX?*o(mo5Vt(VO))Iuu1!D=O(OPPn-FSpe{BM$^N?`vH*_9X)${&iD{t-)EoHt%L*NNn?JT}~=!tM%o{>UAa&O)lk)igXLY*z6 z3hdf?Mk8rx-8U}h9~s#1Q)2IzCs-k&>czPxFcK|$>emun>0Onp9nG-{P~E=UTs zJpoB>ntZv<&3YgA=_!bB>iGHqioHe(^i~b}+B_J;uH=WchF9d=8{}nAooxP+22&Mz zqiqPzva-wYFsps)W$g$M`Bqx>dLWcm2ZTelb$lSzsa>8t3B5+bM zS-E4;IPuih(Ed_@yuGOhk2_3;w0SG{scu~KxW5cZP}j>rALWBFVCGpNAz9|Cq3k+LtpZ8QTf(! z_9oSLgHaz!g^YS$HKxX;nAC03lgzf6co~<`5lZvn=jX*USQb}djbYId!_hE-iNt&SkC+g^y4iue3m>jmDHa=)B8|+F|uf<|)wY1t-YlgF&C%&7|pyDjlRRgQa zY>#ORJ@dvVRe)3~l%%vc>FHcb)^@#)Acd3;%(!QpYxWldN#|>;DP}t~(w0m)G^H=b zMTqE*DP@LNduI+56=G&)3N@vNdUWb5HhYY32r&XnuNeZuN|nW<*w~VD_EJ&;prNwgpK)ot{i)$^-Q|J)VMKogT9xRguAf} zt^@<{hE~mH5F;OfqTX*EtfS-D=n?gXIyqK`ZzqM{PDH>FV0fJOGy4U?ZgE-nWUZXp zB~tV_q}?J1_XkGt+E8!klT@aoegB?avFx>EbsbY*`{^pS#Gjmmd710|OAt zCk9ZnqdIZY5)-Ly+V1joJSO~`C35|)Q=61*SRd(bbhC-?U7t5BZ0MTYf@A8n=Upqi zQ9c#F*&Sx9aw~3ULso~OPIJtTHfYpx1(=$%4WtVDy9`=~^yKk-Jwv!n^m5i^h-PT( zQF(DG%%-uj2=~0*KJUaE5zp+xT!Bs~%n55d}$2+V&T`RA( zRTQp0>P;G6P)U_?e%v79CFx$9#O~B}E{Z7(X0gjSw+piCeVX-UXL7!%3P#e%+{EcZ zXdt~s?;Eqv5etvQSrgQE;~KBOWVL3N17)Vh?cQR@#np^K3b5J&OYlQOOLbD^!+#Xn zRm!C`bL>P1_;cudBy>5fQqmt}(OX=U2SdJPgT<+b=67qS4tqh3-8i4FIrq!kPe|p1 zy}QFXrM*3I53WC1+Asz5BsaQN#nrh>>oz{z2n%l^>4sTWi(=sSj~#iZ&sgZT?fy>0 zC%fHTC(jdaC=Z}y<<0Lx(pd7fu6d{LB2(qqFE4c%<1-=YK~ z;>0T9l>YZ|!^?C1?fMb+LM^4l3J>H#BgNlecIbU#4CN(vc4nSkd;Ps|fXA~#b$v>f z_W;L?)R2wxMV>xbYO+-kRCeKERz5oxiJC!WWkXEq;#g?(oK;dn-$Mrd4%8xsxz$IQ z4?cT&R!uGpJ35Guj!jOSs?RI`cAHNmsd!BcabALWz-o$c$;=!%0>&{lFDORsW zJQ`^nZ6if@T~Jp<>8poFO}+X_%)GE-KX?jzfHlor(vvc7cR!mmVK{1X)n{^ha@ek$ z`M3YseRj_Vi}+Px$+6J&T2XO*3il$D+W@q=;@A)NC$?Y^Le=d*F#}Z+@|ihp z`fk}delp$r`Hq98r`c&BDvM`==o{A9t#|A1ABczBBJFAK*Zeh_m?sQ>fDOZgHSCpY zrIM)0Sed^suZ~m0Ma-NJHL=*e8-L2lNQVt(buyS7HoOIFJ`!2S_Dr<%lfI)8KNsoP zuJ`f;uPs4%S#_1rQ(j@$4p^S?dUx!AHr#Swnsx^e%~y~FKl4Uzp7U98tnkTsRB*#| z;_G*5m>JLZCWG^ArJ;OfUUnAP0=B-3kbMWBCryhH(s(|-+>300UMU<}nFgm&s~aAD zymX-|)f2F;(+?K+2;wM>zS|)Z^Hs1vejSjtdbn&KMozj;dQ$fNcxTNHi6`YQ6Fh<4n&iI zrJY~o9x6GtBW2jMB@ATR8T$YK6}4b4t=gUR8!EtH-S-st&h!oum>b zs4akx0!Az-3KIZ43FBwd-rki;@bd^obUVtY7SArw*5nT{mf5hT78tUeS4GV-_4>aQ zy`r%y=e=AekY&|lXpt@fN8+VyL8Q@0^RSC%ZXIdLzCpJAXx7 z3GF>(EAgn7&6P^51V5^cIclsVbgEe{QeIvnLP_e?_V#ueJ12J3jBBDF9Jzcc$2St) zxw=ZRS33io3H_aD8MIHUEr+6cGerri{TP?LUtCSgD% z0H~Sr06#)Zy z4}jyJ7}tAcIS)kM=y8+mm8+Cr009aYLEM_bL3#|c51|ca6*;*&FUSNaim%!BH&ygP zD}>((%L(%ckGhfYJ*PMIfg)n<`H0rU-XAoecfGkF7+c%=fEz|n1kV?VIe7C(lBoJ7 zR@RLv(%YSX&tO+YUP=&e(w?vl3oL!Npr`jlLid-9x#%AiyioHIOslrUYtPCb=O2sc zb(`bv^azUiS*tvDQsCKRb?9SkTV9cd<>6q-X;7Y#jLmA&yHv}fs7G1pFn)#mvOmxd zeRUFRB+x+BPMQv{(R&sQKzc-B_K1@V#j87RZTeJx5W8#EYh3ci ztPT8F-q^HHvvt(;5JtJL>aW3g^TKkaF~K|-V;9rWBu13#yL|O+j1x36W&~+%Wud%~ zdae({E|qTaNN*xcgQOPBnOH-C!EJtU0)YBH?J9~qW+ z2u^)x4?tlM*7kPKb*TeD#0SwQMwJ(#AqzF)oSs=#2T}9_9kD!j>|@rVpn%!~TZNjv`OY`kQDHvAF$PpDncw*duyndUex1<|qY7m&QoRSTlwl)ab9Q zWJ%Hr-U#y6USh+aqEgUDE1~8(AH2H0Ut~#m`;ayO^^+&L?;JvidsN>PFIO`e+6ZhaHBnoYy zKm&%vU7ou8(ZhkvcwH`l6$*w=$a`%bdO;TsWf%`5GN zuOFk4&p}2LA+A21&3}j?(;7`I{26n)Wg>D12(Km9-rfI#iFMz;uP$_iN_MB@c^~kd zkyp48aPl*02xCOL_ec5L$4F;D$mggreDe{kWBVua^CU9nEF-A>Sn&vWnMS*sGa%D9 zL{pGT1~h1O+e#X?=GoUwK;A|DEfNk%B;WNso?Qp}R?ROWfTbW52oxm9kKHWRgo2s< z^xzp|*`!`p@%v`?sz}&)A@=q?RU6Ay*yi6l_KUC(a39D;9HDZWY74tH*dx@T?f!F- zRi)X?4Hk29dY)IR?iY{4xU5(HjCa>cTsO$!c^D#f@*%p`9{=0OqJ*!HgT3^1){JQA z-6-rn$lOv~h5Y-6*Pn2Z1(whB!R}n93{@Q3_^o3)zh`q8K$0C&|6rpw+KP4za1uB= zA}pJbH$ccx#M%FvsQ%Y!=D(RGBxoN*;2yt$ffw{^r6!qu7W+P26A8fOddnYM?_w(mVo8^L^aOQ8z%smST$ef5tu*6#v`4`38Ew4UhkA_^76v$`#(Ii|Iq3hYj7~H+uAL@Yz_+m zB)*!}oN1srD^Ep)i^rU7+>|7I8e zrw;m`KJ5B4jQlI)gmV7>j{3)MA-qt)c)OzwgZh8f@qdd@xCQ8vO{X)GrvGU$w!3$S7HAwV*SsntxKIc zOYz@3TZt`|;(xRN{&~hfjuR#NGvj+;ioO2Z5C7A)|Gb|M9)D_c3!z{`_`ljNbATMs zS%|La`tZ-w|9Wfx-1A2TYJjMp<|p>=m;C2Z|M=}a2*y6d13vrJf9-vR*%{H-2&zMz z0qXummpn?FW%g-~eJ5J~-p7*@?C~#_}5BaMz4@jns(P6CzO{}sE7Qt1o9r zX9QapJb?l%NH7S?5gmlVyWO;cS$od54X{jH*CaF!x}D6;6P z&hOd(&!^GJ9~h7a2>S!n|L39Ma6WZX{7gzF1&G*;%R#@xvfuuxW~CSU2ci>J?G8+| zrvII>{$5ACKc^;sP!y6%WMt?K!DM}h$MQcA(9T8SFZt~=w(GPgb*D3fV~bPP+mwln ziZW6(vF#zEn)^sYg^xOI(B%ww7TPcIG#{L_)WDk6nW^+Lr!9s4!}jmlpM=-`-e17& za2UhP4zazD!QB9zZw<0|+}dhZe({N;Q5Lhex4)D<2|cV~_9Zex{qw|pu_AdDt<_-( z@1voM36+d57{TH}dHG4b18i|`f3K;pHXRjC{F26$F+9MTc4-?P7@5BXE?~vhYMNtv z-RAd9P#XBT{!XhBm3l1kWkkzVnys^e zyU?xbh%2M9w?;-=sqd?r$@X*83O%+=E<^&xG$}G<^gj^G{AB8;8cn=27j5Gx^G(c4 zDJJDS)Kx8CHo{0MLBeGb=?lXpzu2Lf zLjUhM?MpbxE8;*=Q<|$1g&)zLZ>%GNBJ(c%-jKOC-Fjb-LVpY~ci)7SKy3>kf+K_x zK~sUjR8iRfno|g;@#_a>3x9_0T1{I=8(sES?Dy`%ZsNeiDHIqLB?t9#v9d)UYlNW% zMd5+%Y_c=!;LVz}@U(N7bpOsp8&UI9dwgkQP2O-zTaip_V?-Px4Rwjip)&H+t`%f) zAHT=C!lZWFBC$Ppbm|V0*J&fTfxu);b>)r6Kn8n$Kc~TD;?o+{(O<7>y;;bOX1+ zzU=d+Hg2)MX@RY6d6wR(I)KT3;!(rAqgJ-&p_Y0+S;U%b@@nj91`G&VR{GBHsn(ta zaSwax6ol#*f}JXBtV(R0pyD+NYu;Q)sGRW^3q|QTS@Z2rWfkXAL70kanIW!6l^lE6 z-)^bt#Bmo5mQq^#6ZE4S@a81H|8Z3R*9|4+Rl5zQc31aXVPWAs`3(N^&L>m}L&IDk z2`<(bK}ZJ=5C2YukrPS03b!-j&-uT($Sd))SylGFzti!;L0ji2G_ebHi&p9oYoxH0 zir0j{u74jLD0V+pf!zl|U(^M^kkjLjzX=T(ID+tJ{ zi!fnHm1|gm6!*Y2&*F(e?+vmN!?8825Y|RiFabS*9(%ZTZ4!jJ#CUrng(Iu^U&qT!~7* za68}E+6j%MK&f{WKIM#qN`p^Ok{DZbfnn4o4`1!*kk6(vFUcc#;L@@PS8wWzZQ1kg z`a3mFC(&Vdnt5pXj`aL2qhU#V7UAKqR)x8149M@>g&0oi;nxmA{C(Z2zX&;gb#vRz z9WS%IH@8RqILlKB-9Jlp1Pg!B$2EU*aDG_Johcvmf@9%-9ehOJ>vKo8zVbD+Tkq7F zpiXbKvYcq`Upw=^{zeJ^?nO!0?l+ECR8(}n6)P`wFk6-f1eMN5IM)UMNDfmtKIbe` z&jM0MbYMnRW#|c);TVOj2fD({;g=X%ORksFl^DhXUUWKYz8axyVjX(ac4E32y0_pJ z-yBLYKGUooD}`tbyO@?aglJM`bS2sN?hbYiR*_~gtped~lEG1Y{Ectg$QNjsYJI^m zY3EGknE@@py_c_GG(ZyXy-9YE#Y!*=dYrE5vH12A(H+^1^x=$Z@ zgz8JabMaA9tE0_wu(In&SP;Gp8Ang5J|q`;8Wk%bkfQ(CqsOFjpGJ;-b`siVO7rDV zG?-!ys-ac4_0tFj8JV4ZAv}Ppvxx|aaj2CK$}`n2eA<&<%1)=)mRN$2+P5#ZDco79 zX_Itruv>}O$EiErO!lEq<~SFAL$64mT<6gbx`d0jQ&R~_!4NVY9=B>S^>t#$jN&Y8 z^cFipqh2gmJ9A9GUTYEjnX1mJp+-ZT_$BB#uwyPC+_q*FLxE{(=NS<}Pt8CZ7mGW{ zZU43I%l;IJ&hrE)e{UWw4V~Q0c*vSt6?CooP*qWhno>etjdd3z*K4IdDd{x%gjaGQ zGuIl*{wOV67W(9ekH}McP~i}chMV;O|LvSpeF;o%_Iy7PEH$eUNwzwL5m9xK;!a7ROQU{1V{HZl;3hNFv-iw z$4RSxY<=l^J6R}~o8EnTssV_H&65bPN=GR^nGeo*;tgRCSH!eQZ7$lK_u{!m3ry?l7vbXs$zgcwpq zS!bkX9>F_bRITIb#aE<5G=`)g%W0I@dV8e>vUHA_R+zY0GCHX?RnbA6=^LlRf%ql~swc6(rqM=J$XzH%+5fbKUQfE2eB)#bn z+FD{4_TUmeX(5XH`URFFcaRTbW2?pwiCejMvckrcexi=-5*L9s)*|raC5nW+ec=ON z2`u!yhgPa4`PHYS~XDq)Y8Jzkg~!D+$%X5g*8 zT;hkO^Crsk(HIqwjfz8&8mY+hqe_+bU?@omYh0R~=u}7t5U}Xm?CJ&F2UsyCD1R-sNDZ z4~Es5Srgqy3vKoof}M6};;Nvtx0i5Jwjbwa2mDB{wjLSlQqjUa1sFLr%iY}T4i(4t zHD=ZdT<=>stPA}1s?>5~R?%E{h?A0188|Iu4z*#$q-PL*MO-1fc_6uahx_f_{`Pw1 z%|FWD9{ma)@b3NB?NGY&0@-`5t9!(!a}kg)!#2+`3QZ_)xx92-lP^MTc==Y=20tX7 zKp(BQn@*0;Y3)cQBq3J4y)_uS4QM6+{KQ7R@^-gcor0>$j@u0fY}h4{J-~o{=(goJ z=Fswj+)?*5{Lc*S0izP@xDJDcAjsbEC<%_LBRbB9jj~M$netNE#dJc!EK-ugDwlL( zSek}+Kv-7p{zlR4?8p1GZ{Bphyq_ME-vJ{gReNjCjWLUoFl+g19Dv8CR z1|vJLzUTv((*)eXRLWGQ>gu)I;$(kB2c}Rt3V~xNKvnT;Zp236Ej1}jJZ>YT9s22o zOlcquh*3K=Jz8|pQp@lca)^jSMue=C#CEl!p72$oM^v=6**`GFPm>dP%G?^Yu~q2n z9Um);W0fyazI@6_Mmo||$10rvbngw`@@JZp!Z5npGYU6MOux>Vj&*5s%h7-FmfpVf zW{RuBpV~TifD9JVN(slkNoJ&7EXXqfTdbAFUk&XSkxoo1`0u`WVNo}9)Coa~6~eZ< ztoPnQaYh7Jo2Dj0X5eBWw9R@K=PY-sZyv6hWQkxd~8Uiw8DwncyBMI)SdZY|Q zIwThfCsD5pL$K)V>~PFrhUs^{d2H>6Q#F&m^61EU<4aN3d^2`Y##I zU%U(yUlmO@8@zF`ED9*+72f)lB}>6duC29Kb+IL0WnXOnbi-X|nC{j=js%DCmyz&i zRCH!xeBfx%3VQ2Gy2Hxr%38ycc8g%MH<>KM^?WcUupLP39fQkiEV0(^d6RSu=!E3z zzdYNY^(IOvDaBAwQ4Q6M@sb09#(2P9x7!XpJRC4yg zi7HcOP|-^vVA||hBvUF&9rpMnw<9nu=a!}-d;IK{QmW>|mTwJ0$CO)QFV7UZkSi*v z%Kc>a!Eeu;RF3V*{1=K@#c}WHj=wA4Va^pJoXriDw&64gIkzcf@Lho*{7d-r~+cgI{oA{LFI z=QF-rhF8mJS*xY$?G@itY3Qan%cFZ=iZ^&$N6Ii=(GY}LMD9~{RzRWpkA1Y7skw|p z=E7~Xq{pQG-P-C=4ZGAuQQGxi9_DfnD%6IC5_0LeZ_?O#;`z?6H&phgTdQjoEA$mf z+rv31#Qh*czf};Z5^?>preobD@_Su=IAsPjH@&!r5fblmeiw2t;h`{SBHD~ zZSozo8cDl#sq3kXq;5DjMA%e%ZC3Lsh<_6JNx2Ty(ir@sRVj$Bwo|ZuZ;7TT_E#`Wbw5#hETc zAA9#4d4}D1euH(CeN`rz*`m2m*V3?8REe3$$6BG?UE`o#u+!gHM|xfzzM!y=T^|guqyME)Dc4J%}26B}_m@(}8KL?RHXnGGCPyv*bY%oY17Vu?;Q>icKu_Ug9u*zEc~egpc~X zPlZ;xo1%eSW^3h`i^RnzCDz(11TRG?4 z?P$14T!5#=xJft(x2UjAr!v7{aO;O!zqGQYpuXtT1cqCZagnCD5#<7Kmd|nQ5M;Ye zfv<*?ETi}=vA}fMYMPUIso6n#P9GOr9MpucFp~2ljq`aYZdw0CWtx8o(yk41a41q` zmr*N~$KYd28)-C}6ntZPSaFqdwIk$;YgV46^mY2tHM}1wnpfP)Vx}?1Ee3YbyIq6a zg2QA`(@EGcx-aY5(=yD_T37TdXa0c$)#cC0t$gjOQk9uaMz0!{iFWxZPfn0a{h^A@ zS@RGfC$p_GOp(nl-sH=4GNTOKwN>@A6?+i%mg!aC*BgURQmVJyk=1QC&EmH#!*5zWbVFpc z(y6pnL{ysOl4p_Px2?+ez?wL3| zhlY$igMn-2<&oSv-_l&GXfrEL-7^IL4SV2L@<0c7wZ14Q=skK7S#88qPJLP74;K)o ztAnG?TBjE559aB<+DlzVD%&80^^QUp%jJCCNeNM@pU~($TK@W}E{L`IbVBrHe$4Cy zeJAFuDhv1Q-GY-uJc>8Is#Q+GRNus?*64AeuF zr&n9koup$CYJwhgL~kl`Poim-98t6y)V39nH?!E8e{$|~Sfh33<3T)IWg_$Z@iLlJ z<3<&ykgkkhvTfq}d?KRo*)Js@4zLE?JFL&0Y9zbuNK|K@t1>p&miw577}RcHHH1#n zpT?Y%TD}G@XIAxASgH$pg^a~9Lj+f@{E8WKrNAjz68-AxOF&l@z)Q&(FHP`uQ zv7GqE={cY3~5uJyh zU$0ob;@BJ)5hD|uL5rec)h#q&yHT0P8S()Ui$1ChVubvUC;#^?Mdk#@*8A`gkLUox zTUS@yyN3W{x#`w28$N24^rsE`LB)x(2)DFisv`^l?58w=wt*+IrT$i|DR7p3y0P6V zMa?t0Tf`=?C#5=gX&Xu}|Auk*Q9?ensYppPiS1j83iPQUdDE(&(OPRZeZeI7DZudl3yja)z+9skKgaDKS}7iW0!+tR3XSfPnw^1 zi2^P>y3INuwK%$)b|0T9Csn3&7K@Ys-9q||2vdreq*gshQBdgZ@BthD)n=&k5H18A zv0@+UNPUTPoMYT|NFS+!>EyXhR?NBV*l#JggBJSg_p{M6N7MQ8{rS>>Dd?_Xgyp){ zmRp@Txj}?Di1V9KvtQs_?h|uAQZsju?EXwsKIgdD@cod?_4$KDvCjHwk#bN@u@C?GN{(8!bAxp4xOH-)MDinkz9y4z{~`qiW=s z?umA1LTNZSZ1icl8(E;K*+(Wh_5){sTp}e;qAE!5*hoe6vg{qC+UJ!l*1L*i{mj0 zuB(`CQ=2|CvS4-J!u@^GjA1Yl^~=n+_B6My%|7J+wAM!l);D*+>piaOTR+d(GN4Sx zMT)04GBGjn4g-T62r|YF#nU0SX2SxCe!N+L(E*7(-&LH)^WClzfRx>ZxBPLCCA+;> z$Aa28Kd%uSs?AWQRcGJlc(kbc7I}{vh$1;(1V)8%Zy@q?MUf<(J_0rm5+y+F5+JEC z3N)5mJotLg>jdxgaDjo3vJ!D*n_8 zaosC5x%er44Mxl>LuK7Ik0}*6|5cn1f;}>-V;cyNXtz8Ba1n$ixiEcL|FKHZI;C~O z-`X^rId!+h1d?`A9`o>)Gw#z{PJ6v>++tIK3Q{zpq!fA+HH4Uq21Brb-Jnv1+s|R` zBE8XV@Bpf`i+Km!Se11998P;U$xhKo(tT|Mec`wQ{MBneG>e+c?N)Qu`QhpIGoi=5 z-NZa8&nuZWDPdP$*6gGdaJ~rU4*{LBjRR}Y=E;$LOrKNxee3=Gs}}k@r*&sD9coTP zxO=aSnmYTn-U<6Ow_%~UC$(?yI492AI`9Tnu~}7A_?m>co80eFt|Gz{rN>IinIf!r zL>3#vi|kLtEmC0_M3#n!g$~7ChP=!?LZ%gLc5eD=9qnRBxz>1%VjV+J;?b2G3U8dE zE)}a9a~31`cPnIKK2euDkup&|S4rYQ_(70j<7%CUq#82KO=k6({jCMaCN)G-PwZJS z>ndq%cEHLvd;2&P|C8O!P80suD!ro`713T+tQ8I%I`3ArSS?On8B;j$KrDjM)Zf#0AVx)Z-TPGaG5|rL{KhkNG6@M0!D>>Y$g7)djCL87G8?!oT zUp4S2Z_D_6`*wsgxQg@NuqBtS z6Z%kQm@e;ahT~vYBjd#@OlkEaBck~$$|iAE23aaC;!;6ho$l;LvG~gE?IX#%*^LV$xaBi9A@T7H%8ZEenqg z;bOabbMf;(MdUvx`T6+?KWn{NXXE43wQd2(SdswbIqlP2FPE4^&`HOO9@^JU02P)1 zC>5#xK`T|XT_=YTa8L3DG4b#$`sd#Q0wxT)&5m|YnH|2eXnHx>*%8IBEH*AmD%v3; zJHLEkAM%->%Uf~-1AYSnDuEZ)0eg>sq%i}DTbTeW?Fh@cKxD?JUE*M~cjOJrETh=a zZi5@W_AgI2gRsPMQNMqGN#e50e!Sd_JnsQ=2E8HoowTwX@~=$_UO4Ybn%R2Dqhaj%42$W; ze*V2Px-K)9C1-lZE$9Nthe>dy$b{0Y@-^o3V(}capX`jLD50KFQ$Uo&B#-ccg)60J z;abK4tD&S+L~7}}fJ%)sQTB}Rkc4QDgxZ+86PdFo$M|jcC-(d^wK5p(FLJdzd8Vsk zgs4lHaq_a5L!1yC8Xjk1%rxc-SJgQuRb$iEbt?4jtuP(~TBVYxB2sLU9_QIE*CTSJ zC6_r^{PLwLX)2oqN@xqSFtZW)nf9+vnyOYj(o5y)=pNMpSo_$RWM*3Rdi_)R{GN&h zfoT0K%KZnKKiv8Y6&8w)1j5Fm7R^0$8B}WW6iKg7roHejK-nR?-i04{g@}JP2tWL+ zE%I|lQs0aegssxbp-efi8m)_}QeOh7Yfu*9 z&kEujoKNt*eXkMo7e$O|ORk4 zlcqyIlsL@IPw-&9yEiLzJ{f=V^ZckxTpL8lRSL>2RV?qInY(;(jOs0k&D&(9+hz-A zNXv$0k4Woa&+QFuGcW2~``p)FuR~QK6U_<<0HeBv^_Y3}F&-o9uJpIEeNU;bw9wn_Ivo&6jCbb8%~DU;ZqvIEtwyww=$uFw3p)H`Un# z@f;(pv}+KTHtB9EdbjgSzujw>pKK+(zX2>@g(X)Qu=j-t&Tek+VjLx1>&tQv+Re`A z1twKDg+5Mk{Az#!Kz%#BlB+Ac=TY7rvW z-><2q$YI2R5LN%hup6DGG{*O-$;quJm$hhC_sck@_FJLeOE&BWw~K@kmb)dJv|Gy! z9-;VJt2w=H6GwZG090Z|AjRg45$IAobK%BD?g#%>BE!KM6_@pzstMpY5PZY$FjUN` zqxcLZD)>r>CVfm@k60|wF#w_1Wn`WdEv=2)GMShpi|$vah$1zkREcNrFCcfHge ze4~&Nom#`Dg!qy;Y?8JFfNXd~6N^oGkK$=>je85EF^}+_4Fu{YJrl}btxnu=s6fjB zO#8qy1EDvB4K;2$W0S5k+Lvzy`O1`q^}j^8p$|!t_kVKII2`q*#g9`?He}+72TQ~L22om+o3=h*6sg|e( z-vqIpxlCmHD@h86c81~$c^DdkI2&F=za8oZG>!qhWHb8ivjQ?Gq5YDI9uJeL}W?V00K5afez z&W5kJ%EGe{a@p5nk_SA0t0CWM6?WVdb5PuvN%6Ys@`|-!os%Wae_Wu56RMO1A<547 z;rZFZ9m!_$oBsg0j;BMS<=A?wn-a1Z4*d$6uKcayIKgy*3W&_uPKwkDU9Cc@!8r=#i(GU(f&<;LQ6_N>%pYd|4wK!=ei;(+Cu|qw`$gEk5|UhdSu( zaTyF+Z+r!->*Sd!dwlllOrN;5@F@$`(YI=1^uC7&l7oVRE>oFENLdeTXL@ zmW=>B;!PzbjyYt|!TC!rXaTMS3bUbn6#oI)*+A|K+yjYF4nnf~4MzQhI5J<5d9hJ5 z1oBhYxiyn`S;MsSTPCs|Gw17~?2yDN--Rxu}AeN{^7UJzQ`j1&zQ8Iq=;kQH{fq}?sg$lp;c*lu8!(EURZ@d{Z zb(JiD$e)oWjQ(Wqp5beyAy}E+$qSpGQ4c4e1oV)O`QMJDv5G$fQvDgXVH~))xaCBx zndl+Vyr)pqiIw3tLtaGyn#X=O&86A)t+#v%mFNAnlhp_Q2cHcp_&9qgv|GHwMowye zS)wP~8UC8yBABm7#+c~Z#k(}EfrwIQk0@+ew0=!L-i43=PG>J1Lys4aOK+;-L2qQc zJB9&a%Xs&rI;R(ogvdPa7yku)9Htj91pIF8xt3$AO`DpT?wQ<=_+_Zm;`33?Ge5Rg zZ8(QGFI*&Yk_}>#qsbkvNIll92jWm5G)S-KmGV&*buQYqW9ZL@s#q+pQdMG7#8_Yp4TeDp`%c70Z1y3<(DOIB&H?_ezot(^C8uDcf8urZ zk>+`PpLBo;D{th*+<840%K;9tH~E_RZ6rgL*)b{%DSNYNsj2HoxAi}A^?$(u_-s(x z&Tp`aY_pDWO@a2mdQN1EP6CNg!LYBcTq!2D3Qd{cje?$ZCVO{57dwOFS=}qXs8ubU zuZt|xckK^mt#YIL9QEoQi)xiQ*4GW*;otMmt4X7A%%QtR_*yDZ+6u;p}?!}ZbW5E8}a7b-5 z5Nck0T7uB%;!9@)lu54j2RB~rHu5&W9qmylGn#)7o#VJKT(@{s+>O(g_ph&9pUt10 z2Ek)}46?-Kus-kg+D}dU5cOJIlhiA`af!wQS==@CDb38XZN}31wo@HO;lH?*lf1{n zqpj#T3#jne8#icoI_PEzQ?D@|+3FbMJNcP?2#AbCdp+GtfBl+0U8<>EtXg6$+eiUK zQzPI%E6{yL<&7w^g#fF7eylD{!%dXF*A%ABny?x-ubSy%XkkAElHtas{c8gHzy7|3 z17-%K*O*yU!@judRFx5l!6j5I9&&+avOEHQx?QLohT_$))fkY(5=SC1TKcJ8KlubAhWntsmHD$v{rd5V{F!YO z_Rrp5He235F$G+q4;yHa!~%M5H^&TcMd%*{4Fei309Roe;2(d*-e;$z2By~tqYo?w zDDVUaFq7=ozlL<(bA$1U5rGHPXEW;6*P4C^d?xP3&yRmk*>~EBWJ>gyoC+0&18v`| z(PLm>@CE@4$L-_VtH-pu8N^v21w~<-ie9MBEa7&L+C6gwczgJ7hCvlbL-ljMcID+% zUB}&p{JRzd&p`v>9#Jq1fbQO)v>D#-N>cj?UUM_Au59sb97^~#EAYUc~#B{_7 zH~I+vIx0|7j_*-XDy;CEt<5;|7lhF@e8py*@+aY$?sJTo=D?HJQy>FZ+SQj>?P52R zaR=4jvOTvG+1okLn$@j{{FA=#|6NAEq)JD-gPIHG=H>$LCNRFf|4@zcLVbeeFP!dw z&x(d=`+$)FyY@mGQu0{URvaZ_X~o*svrN~=qRMO zkfopKEx1wii9T{ZS)7M5xp8*sz0?2y zLw2A#Zt8WkNe2BQzRuAqdFzb*fBlyK{jI;>tpKbQf%0)YX=k3dzrs+yV@3K(LBx0N zd@D0`+QCi-AE!>M6V_UL_5b-LGP6h{ zR+(jLt|DH$D=8_(X&QLQ7FC}+0=Zo=hno&@Tsjr~E~GRxoL8PFM*e)^hs`8!O;2`> z1k8Gf1YCO_P>H0&0arC-Y%dUJa+`>jac^(W775L>NsNhMWsx^v^9Ay8IE70mZT?4B z^PgA#XCdsD=o^x0U&)Gm$5!eI9csX*`}=Fgk@(P5%_6-=OiUR?o*zH{etmK2Rf8(p zvlZvzQKA<9$R!g(7#-I0y0f!0`ZgMMw&8Qx8ZYp^L7J-QIfRY8hDi*5x}xhiF!#0K zlj1)Q0&p5I12cw!tY?8BrPOlh;k76G5(0i12LP&d1E}G=#d53<&ghM&V5F9%({mcj zfihE=gtfE@y^!;#*Qw`)huhP-ABPLpo2(fL~x`r?Zm)QL2pF^N-^X zyc+)x%ncK;ijsP3LF#2HD*%LDjdJMsrHDL5e{I_Ii^SfX^{UW`nLljbZ z#{J^yOGQPe3u&m&>Q>cHL%0uhA4|(|f1~uplYiI&|L4tr2?SQ~Lb{H0+NV>(o3*lE zDFl4yKUj{z>IH2^U(a}=xYJh4J$St8I(j-{2+;;gW0Y|#r-YFf5>UQcRTj&M-<3O! z0q%@UFIHE2le+s-#E^jwLAZ9SC`0y>_)eTpN&? ztgz;KDtNE`lu~c5#j^MYk=@G7Dmv~G2xc1M#B}xbxt_{|5XWBCA7%m;NpC@y?wN!% zsb@Eu^y^$3w>;Az|Nd?lSb^oW@KaZM7O&htsDuiQ8jDw!IvWihlBS0yGCkI9f{;gX zHh|AAjQ_KU=J3eUR}aXri0sThb>XAP z1^W(Ot&f*xeZ7Jj%V%E44guEetKy1t_ft}%x6AKr0c4qeHBr!%^c`a2xQ-45b^~NH zKAD+ue>y?7*YUQ1>AuOc0t;5WDR=(=eU$(CWMTz2PldtJ(yq8ioQR8Kxa}}-zITn< z=ss0%n;6VdW{Af%sxb--0RaYz)Deq`Icd>AL0TI{dref3X+}g5;F4&NiM@ENo;#P+ z_?bO*jsC;HhcvIbsR`^-{ru0x%Aac&`G7w#T}k;5=?m1@GcBsBs-RLxb=#vZ zpZU*Fj{`GGdhCTVO=&r*1(D|ORQRZs=`b7j=PWU|UwmB30*!Jr0bQ)kAD-*F6X&odjLXyZHuXq4PSSR& zfErkdDp!KU8OZ>(U{)-7o&(=l$_}waU&#wU~eUxmyAVSGvq8 zgZe)0;&t|Q_QmhOZ)V&tUKI6MB}u)v8M&I}@AQuchX0`aTzacHyM*~_#}Gn-yR@`a z4Pf?Hw+Q*E4eH_zeQE>&FhW|5RDXT~&<7Xa(0w1MrXyWi6SJ+Q^!1-l@dh#x);&=x z&Fj-ZAr-v;5}$;`ZQ)7Ks-~g$J5TfmTOiuV9S=Uw%Ohj2^y<|&jY6HyYKO%LubV&G z8UL+piP6Bqh%gPB_8WWBVuIJ3sGSHh5{+s|{$7q8sq(qLLtO9b{xWQSq{`K!w`yl- zKc-pB|J_Sg5xhmL4G!ri9H8Po+b8)B#gdkj3qi_F*DpwKdk!QZ46YY+x(R8Cp}#vK z+JB$eO=yjr_bj_}{>ZJMO3GlxqhJSj^6!4OKOSw_Nm$=&m7_0@;?iPc*+`_$OSlZ6 zT7Z;^-D<2TmY7bg8kdM!BJ?wlf7l25>z5Jp5KCls!s9M#Vq${lb+j;Il*DajtsS!; z;Z=P>|8?scYz@tOyS&tw!uI%am%gU;Htt7W+f;h|n>1%w#nQ$Td-mxw?Cq3*p=pc{s^ck)UwQoY7W0CE*H>CvWkeDqzAo4 z9aPQwkV`DxzmREoAqCVQ-(78xuaK@=dax16Z%#bhrPfOBem3yS3)8-2(NHcB?%lwz z%|4qf#p53{kDG!CvJ1D1fdl9zup>?LevXKFb9rz$xoW5pgA|fNM#@eIpZyKq1HoGY z-7LwqQCock{!Bzb;56es!?wQ{{2frn_}zLXev^D`w>$D-_(tcCr&cB{?=(A&Bc*ua z^@Uz|qPMvLM%Dz@FN@o3vfLHBKWrTNDwJF~2Doc!>r_}U0d0U$N3|CxK;h%#ul55` zlc0O%YV*!ns^TmckLan*q~Jt!%u)$udu1o)HBhXio%Mi7w8Z(;e zjzZjyP{gjTwRHi#6v0<-^{`T4iK=;9Q;5GH{_`dZj5k|QLx#68B8e8Jj_f`Q_5jMs zyVSIghjNtThlkZa5A%*`^`%J}Dv7PLg6vCzXlVt%15?!k@8{2-9qnm8kIYkD;)kQ+wtU3uVVI|HpDd?3=V zsi9RJC~X>NPB$lEw+cQms4Q!W8;#UwKd&ONvNCEyJ z>-V?Hk|W%ln!lG$0`sz)FePG;Lx$$b5BN#*6W~e99Q<2$1d_q$ayb7;Hw5WN;Q^#UKRC=t}1i`@6=ZD7I<~{3j@9g zVqHa4lCQR_t)PM*hdaWtS7sdau>WS?h`ECmx_KJLn|;#siE^}_7hKwg$S?%*BB`E! zj8V_m=;a0?MBhCNQ;N9;kD{b4+204~1^K8ot@>|j7k5m$ujp&6axuSjfIx(d}5V{WH{6+oDR5+0a zarAJ!W6Ebb-7Cxk@{2jsBY8PFg`tPx*&kZJ6cH5f62<|BT(Z7(y&x2&OF`lC{KHMl z9Ovl%ewBM?*1Lvo!5E5M<-=f~`o*&`PF=I&_trx0DBUYa#nE_?UQHQ*oDAJhWVE&^ zt=Lm-94(~vfY_RL98CJT93s<=Wb)Lq?|kttMHCixFVXyEyO+*mvhR4zcZ&qCN8w~Y zk~bD&kntQRQQWP_#LP^Lxh*vJ)vF$rtN&V5de4j?PZqz}lJ zgMmFn>yhh&m8f;4PfvM*(ZMyXdGY(lv%c(KDR{n3x_nfG`&|44jM(nd(`Ov5R<^0} z%H~FrvI7}Kgk$f%7ekzg~IMK65)#33f87L1Lu8 zAQ&cFwLLv8(n2arV8hF zl7$qzS=e-G(*eV7zTaCVQQ3y(&ArKvzt-md-`>10zT@b3&=4;J-fP3gu>&ai8X!(- z`Yx(!$`KfnISd*#O=*osw+n^=);5Rcb6M{?PV^b7(Xj;e{=BCv*=~L^<?p;pwkK518SPxtAmqa{t#00PMArXud(z z;Hy_NF(-7ml}T{c9e_h%{Z@u8yK}-kje8b+P&rk!>V_9`fkDS}-6!1hgECb5vR?TV zV2i`AelxQ+`4+q#*h_Xo#1d0`=9wePmw~L!-ql!}EvO>u4DbbUG*}>2KO=dN9$*%x z_w+;1>tqqt*8MeaYruirkX1}fr)*^O<^}GWh$z<1K`{`P;{w;UOW^6}Q@P^OE&!rc zxU`{KW)=y#?;guF+ir5=4VfQ{C;PDuVpaJrathw1(l zVB_bY)79V~$oiD+9ZWStl!avozk@TbxZkI{*1`Pzq6&fZ2I2=J4kGA2_X+h-EnXFk zApo2D4j>))=kww(eUDj{FMNK_sON6A=nwO^eI2<}It7OP5hCIjD=Pi=3^QQ@$=Z89ED9sB8d zu4j)1TThg=250+KPwUr*MXOZljtwon@{U?^8PiWge3g7FJ3@-KZr>w8?5MI7e-m|D zT|V<_kYT|kUSt2B17>$YjXHU^eKa5^O1Y*86px?u*?SxvW#3ub#e_sz33Fen&sPIA zry~$8)J5kuvtHDk8_B0xuO37%1g@?lvwmI3%T?b#1?0Zw9^|u)={bd0eIc)#PYe&e zC6}LTw+KvVd*$6V7hY`Xk%&%=_(df)#0 zHu}fcF=|+$w655xh$Gp-acM9y5x$GTz{w*X7?>FW+kL*)Kg25h#Ew<8<_=$}iCd+fho33vTI^5k^FJgN4;Qe%`yvb|`agWNQk6mNb4$tzJ< zO2=Vpkw9ce1$72?^KY*c_!{vMC3L(kn>$4_6;`7~fVP@@|GDdyzXtc7soKYw- zok_*zU2~v!AG9YbuFLQ{r-|>D7c1W3E^Vl$o8tZQ`lcscWYkzQt#)wqFY;X@mglbO z1O3#%uofb#N=WccGalC()1cO9@Qsb&ObqQJ zB^ldevYL5w;U>#0&NRY){1lj0OyNc)v7O0qr7_}Zmlslzr-}hZuw^717b&sND~zy+ z+zngVE!zIYq`u2%s^?~LtFFfxsx3~ zeBc@@-QQeuceO20*-J0^L(84Mo}R(+mLb8g_I4hSzz1Pu0`Bk*EXQfA2UTiK@)b}y z{;04W(EIl7yM9W*=J8510pP&;J)x#4eEf!eYu?s{j5<>$^m{UHv3@?E zP|K8a3hn}nF^#v+&xP~xQeiRGnau-2`~Lg~J67Sv7jd)61JUTnU3Q=*%+_;gz2A4+ z{v+~NrKi%E%VHzXu4Z3q9H|1_Wyk)Zg-f`krT2{K#M`)Dc>@eIoalOQ=e~^*vFqpLWmmo}o_flgSrY z!&L%y2G1_|(*C%%5Zol6-Ms-|t92Sbp4vQoVvcZVN{OZG(sSGDiUU+P>cykcMWRh? zbMrQohJsqZE_bu$=8GRPXEqtk+szI*;=C`$s+a%K^5X1+oR@Bclkh!w9O2-88j76&Ehd)=(`bk z!@MSRk(uGDp8@)1?}kiJ>T{i6{1y4{dhcuNw=uycT*#hpV_fp5VNUuu|lt&-zQCRa=m{)`z?_SM`b^osH5bU+rfpy9sYXSJz zISIU*d_1<5z~w?~kqurvPs`)|C?t%JY0o+oZ^pbXH}5qsAd7C`iRQR=kqLJGh>HCPKlxVUe>Kp5fphS`#{`&4C{?HW*sY zd=KX?ri!02fLD)iwpEJ9o)#X^#QFy1));_O_I}2i((M70z-#w5ccA81FP&n+^1=wK z-X|%|*RCtF1}fZG9k@kgh4-1zMB>ez*(pV;rpUSA&>PIp7>{7U8Gaij|L7#>?Qm7n zO`E60=(6mZdC~qhWN2X)=*1YhvV^KeYf+OK=+^_|9g(7OO01TRm6a7(((MR73N*Ex z73~^PQ3IxgO@I<5!zjLveS@3u&i)-F1L)XJor`r#Bgsh;daUu~x4y0#n*N#NzLHzm z#JLSV$SjmDPzx}R)3C#W&Pn_#t}&~qBl9!xKIll|gX~5AZ7BtiZequr=CT0pLP(Y% z=JMNlYgAv-5?3srvF}-R%b)>=A8Du!t8Q&L)(q4}wKZr3xPHIE=-KX`F=ncX{q{#$sY%cm9x%#Fr$iDHu_CLG*GMbVN1?NOBE=Et40kOw_PG_5BsFY`-* zzFw)z^X|{Jag-MLst2_+wlM&b(|tcFw2(XJ^(jxWc2PKKoZSPj?{gV}54XL}aBx=( zliNi^L|zOYGKD=fqk#i4t{wV|?cE`0RDG{E3a`fK>?7c0EC2-g=}#H+zP<9s_LpFh zY@P^?uqM_b8Q5iNqjG|oPT5=wZY@Q=3K~it;+_dvDn#kpQn3T2sqEW$J?+#Rb{;d? zZd`V-E6*1%e(tOUmHH+4R+S~3sBV`Al|u28!x{E%xRzK_Ml17s5}zR0K`bPTbK}yE zJ$FRf^l<(T9FZqtelwfPAk5Gp1p9mq2dt!H{% z@f}b(ckjT@SxF@9;RU)?eX-A4^sDXt!)Sz+M)T9Hk46B6g__zEQ=lm)f@UMo5J)#z z(kK+S=$AgWe>NVzOLL7#hSGzjOQZ@(TB7L1S8mrREL!twL&rb=9_Iz5t(bO+3Ul!3PWPFtu}oz~gT*fEyJQKI?JdQZKi zwK{nlrHRB3)62Ra7}y@Jct)&p?pkX}73x5oN$%V-bVsqQ2n}|qW-XPrGsLgPoKl3( z6P>wjPpz*w0ZGaFd-G-;){+d4ClP8aescQ>+> zG&T5d*AfRL0g+8kdA*pVv2f*YJU6KZCENV~HQ0{!ByOD63it6tL2jGl^9%E!OCY#Q zFysUb%*JjibLaSkga>J%HtDJZb}rui$-;^49|8Px`B#!{3_|?`$QefJ#RA1-H-JO% z8rxMXQCnDq_LuN^YZ<(&*}2612@c)|AuQEH+})LSW;QBmMFi#Qj_8J;i0!i7vSIRk z4i3pdqaSC&FdLkG-Ib6Khw9atv!$)7nJ(c}H)0_WM!K39Z|^ua;c}gw0p+ScQD$21 z)v=HrKQn*JyPT|Gj}KNuK+z54eXImchKMPTe@{$g%POWXWVW{vzK4HbeYzTJ?(#VzBJSD*0(&D|(x@pkK!vu>iSL-P=BO5h zlOY^sKV&>^O4<1`rB(qzZC#{nI#CC5nh`bgCoM8~zE@kq!b-t+?k`VVowt7;nlph^ z-~OBSO^&@=U97CEn=Vz4{f8PUM>xWbyLb!O>{kbt0Db3kwI6LW;VMj9?pJ3Od_*`~ z_PeF-9l1b&f?S?Xr49@#Z8PtGr*8&GekL{M7ixL715!{{e#<-K&VEZM!jfxQ@W}BO z2+EtQ7sYFhg^|?_^5=VoL<&P4m{N5UaO@JV#3b|<7Z=$CS=EEbXMIu!cPMVh!+e}>xVR=o=F)Cd%AS=nFiW)U}RqMd6EE9G;;D;tkY2;5?^OZzks zzSn#xcQeR+ak((?B8;-d@Jd}Pv8o7-t2;NZ4HJf_;28Lm4og)CWv9+Ai1~~7wJg;rLf4C9zw!S*K-p3 zB%;dZnQ^AlGgF*p%F!MFiap4x*k7T|PBzjL;UP9RP(|_|WweCnt7vjrO>i+EK%F0Xs>~Dqz%8 zm%UIFBeiH7<4H((cy_FIYE^`<$1|6HxtEsaxnv2Jw)nGuCHY^8UF&+hNd|qc<-+m} zhW(ry_!Mqemq!#M?zl*V|0r*Pfsv{IN(~%y#z``q<7?nxM`>nkWLje7yKGk1wWc!x z`M;Fbe-r10x4Pm+KRXy)Gc*7EM?MlD^|RVjS^iDaCY{G7y;n25t)mq7&rGA=tq6MH zSCNmDl>b*DkeVW(J<6M|On&f}m-1i00IlS;_K4mq;`P5heRdr1^lEihqWu3V5%Ij1 zh)5pMCjQ&gzv8~0fUaYXAO2;ySnUt-0D+a~rl`QbJ$;PMb?LBGwA}J10PN4Y8HKqu zKsg0I9CtGLx2NZ*yp}{w>UV$sSNe2-1z`2pN>@An?derMUdzL7yKSXPdfnpvi!krM zFF_o6w*p@Mo@Z;cC6DTkdE}(BLT`N$xRD(D*D3s;-*FBP(5dLXh;rMR;T9DYh0S!u zadQG2uM?6qgXDz@1kj!G#PsyMzScP$_<^DzF#no=)e5xV0A5OH4LPHjj72KHambWI zyUk#kDdz;hm)5y%ecPT!T&oe{fL(XY@tL78c{32KyE2@HCDF#gBN#=2W_5Ptsy z4KHi*5HY*9l>A0p;)GAND??v031sW?!B+A4`}TuT`C0jov+nKO+vo)ojfAZSl*L&d z=X6CxCtQKX3ktN9@{R>fN65xF|GnrrrxMru>R0xWp93)5ecdk zu4jv@%X+ks2I8FueS9!F3jc2%bVJR>{80 zO_2o0@|qH%R?)PD&AJlN`{on=eB2RxHd9%h6&%(j2)0p8hmtZ-%soE+&UMzqD$RPmz#|#%68UhIE zBj9o#39veH6kG{A3Ue>EeEG}1*9tSZDejdm8RA~d1%rQH#Og|21BtXASSM!{aLb^T z#%@R?^l1%C(=RlN{7_Ci4iQvQA(#lHs+RO;vfHxh6__9Wf!jRRZbFOv^=qwsN5NHVw-Q5T_??D!c~5G*t-7%FEe+rjOaD zD=KGV8k2M!Lz$4Vw&`kzte&(quN2-5{-d$9i4vpc+ZP3;?|nzG;}*e!UPoMwv(d-p zvJG9bQKCR*+Rbtnehsn&RP7D(Du-B0aQs4h^z-jahQ3YKJ4Pd2QJOm6@kOiW7McP*sw6WCS+^7%-?rgy0H)+a zlr)nk(s&6VZ%=8iy5ptGd#*qj_8&%xzLy6D(Bql90Nx+(zwm}@ZTItoE)L&%0L-3# z3P9PNB;al)Bm(#K%77l3{XC!`gTZi}E|shV|7ngSoZaonmL>-a>b`ATo-|ogO)}Ulyz@xS4r%&F~c^M z6LvFb`X)WweSptjDhEi390?VDySjj`-XZ`(e>qFQV;_J$sqL-ndG^@C+t6)*hq2k3^ z$YKQ=Zi~ac>>i&X&Cm|va@EqTVB%c^sb1GBNE{rVy;TL+i#$v9z*ri((A1Uq z5O5y2ENSDbGZgI6^+@6TMissV`iM+tKqWqmE~@6f_)ZPo8yLe`pnyulrkX|mD!~ND zdYtVRCFzTbPB<>#Z`OP8GG=F@{z}yA%)ut+J9^d740$Ppxtd;Z=gK9yf{f;Hll+|8 z_+Ys>cd-76lXr}!772_L*N7J6vZj^X& z!4x^e)AI|c+`B0aeYV7f=gmfAI%m7euTCSAy^kig&zEf|Ev7N;l=WU{O?tp)!*Maw z7Vw-#>yWPemVR4y zB^D{v6%`d3WVi+vH~pfXALq5ngqYN#Te=@t0K0lH+J-50%#U>JF0X}Dh|M?_ESj3) zR91za1w2YE^)nHw4##$PT2$EH^M?pQs`B968X;D`g}EHFQ`XkQRVJw5-qtQ_u$7e} zXFH@^cB`^xv0MwF3<^GibkENYCO;7E9=|Qpn~xrcF6xT!40aXz#!QHHammV##6`_b zArt`+%hCqweX{C-oH*$y7n(r_bQO}=odP1nL$ga`m|;HCJ?g$hfU++V>zjxxn7(YQ zz|3S<;ycfj3!oUbxOi0>f+$7r#eJ1s$wcE|68 z<#5nn`Jtw;keeDksnX~)uWdNUhz`BETxhjbXl0H2cx<%jOI6S032!0b;Msjp{8dZ= zCpK#{Bb5H0dm1$&0Q4lC=PsrRCEbRwi9Xvd-078yf%VU<{IYUv!ruZPAtj*3_bP1l zpb+g;Uz&X5Wy}~y?~kfoeHv`<+vt(rGo)-<-0IdW=4i!Z%%*5`6r!5rl0*)6k{30Y zxhx>s&`H!sWTdGVM4g?IF5|GF5EyyM@a*za`HG!R_{-p|q&3okRka+Umi5VSEQ zQS$nvkFmw_l9FU-k#J~g2#sA@GVwTFj-L)qu_~_7;DMjtL2D(f+_D6dHDPw=o0q#d zi(?uwbCScdG!^JnXW|cQ#*oJ?ks@fAZjEF1*`uf1Dzk30_50)Bm0y1U^(JNdMa6m*oSZ=PYX+}wA=c@;ZJVhLDF&?>ytg{|hO#oV!3+YL@=KTtL-|mN?1-bhY zYV*qhaP6xD7T6`Aq}fg?Uj5K5FJ95E{N$~gD+c8E;n(ir^H*=)pf4(5z*)Af7Y;rb z6aw4~JczS+FcrKg4*BP^26o2fbVF zZ&EtRm+?M45xxAz_H_zzpZ}L{z&Kr%`@Sr~qZ8O!4jbO*Q$ zJC6Z=%Z=N*XCGwJy6nADdevvnxnkt>C=ACM&zX>ER>a5}8pRiPL1ZM( zDmbi(=;Akc-XwNmI!vs|aB4;{>M%9GL*gsEMq+x|xzBgy4%B>hQaX~G*v1i;o9tH{ z#}UB}n-4g0nz(&N?sI7ST710>6W>@6d48o(LfN@tJS`sL2GR-*7qPA1vavOQop{Ml z<{Hmy-B`3n&o#r^X2Vm)-p8{IbBC3NuUC#tP7Yo{S50w=MJ~A!n-GZB2cK3KVBg>; z-VEYS_{z4+y*6cR?XVpjcx%#QB7@{G@<xjlmo`3ucM~E}(TH|*o0%0)@HqZF(meb9*fZ2Mf!84J9LdaJ+<03L z{#!k7;r9ZqrO=#KNx$-g?jx$vy<-T^4z-PU4Y7n>uALBuA<{w$$bfk{f?!i#ACmVP;-4=7BJ_o^#&Nk-&63d9NVtUr2tyguc#3`wF7Rd(EyeOQ_XuRXi z+^CT(9&N8wf*>3hdRWqUTsF4;8PMk~5*Nis?0)7;-#8m68k8|rv~FQsP(r`9)4X!q3tRsnDpKr$ z*Vk>_p0Ul=Q@nO6!6?Ze#Upx6HCZLzfdZRO=Y`CTu6k}*Y@6c7+R16E{8Du@9#ZW{ zJ(80rAL(yZ99$7boEm|~rT%El!}V{P*2Cg!z^7zq0jtmmStmH}%;;a^@5g=;?z>0t zq7Pds4V}4*HSP4zt+7+#BJ*ItytAmc&NGxglR(MZ^)3OQ`sc1Yg9N>bS7&Jl=W+$V zl-a#ko?9n-ZseWvI45qfZKv7$ml1r9ooFSYECn<<@%cs6>l<^=!|P_>{1A+eHvl)j z3#~?vF~B>YUrcP_vnS8(_roemo<7w3CjFB2y>GYH_Mj8}WeB&;5U=2s_ck1pA40TE z`z0asTK7W!d&_P-j+|X7#`)r#C}tynI#eH=;0>?5li*`cClZsT$$vv>uyTEi8_Z^^DbZs3nq*C1%@GtD)vN8cvjAR=V!q4sQMbJJS z^thkqWy>piaX93?S_~-Xl>5Yi0L`t6p{Y>WPYDhf(+eXya^orAtBb+fcUInO8`F0w z=vQE*b9z!2JC*`(eP_<*ny(z;Jq=S=CyQ=GWV=BvYaZ4iA+)vI7@DQBZXPH8eOtQY ztIZUg^jO)U_Ay(-I=&k?1iI??2ykAgJ|pBKRUso)CA*0&t5!lIdyl}nwW-a=X7h!r zVO<^i^b#)WM(hPVBiR?QxIID?(YCq0xq1CpqQ3WWRX#EDXv#{thRag30Q>8CxoL_w zLh`tSd5!46PE^ZXv>{LlxSKz#W*`6v2Dx$ftZ*5I8c_$?wifXnLgO~QyBovWqF~10 zsgjIlldVb(vZ|re$}s~X%2#p1NSLQpS<0S#s+tj!y@`<|rh;V{@tT0o@2pzL)a-ckUmz zFwqcf+M`sT$-Ir(cLi6t9g{xgy~4%)pnLL%%O0yKc21q%$I~=&`nhErMP@viO4K6# zGrDt!H-sg;n(*60&3au+JTudqZJOqoWSS{-t&L3k(|Qz(JJnEcAG!0WUucsP(ulEg z@mMXT`JBI$fY^&1jT^USaZ)4voDO=c`YU&;n&l@C7t3P;-`Va;i=S)&VjAMeZv7GF zuDaY9Du5M$4x}8-xQw-wM7S5Z72D3kmErH>z{50irtq`PA&{WWWQ9UtLg+kOTNJi! zeo@`gWXW#}kZdT84RYH^qSF(%iaJZ)&^ol1{~}UkU%@MpPo!E63{3P;d3p~KzM}Z3 z!Q~cm<;OY+i*Sb^JtP<8B7z>c^hqQ!7gV2i^SvnURhFRTEG+PHl15(}p5oB9 zZuGkd`90JnkTWEi9xPr2NLo8>g@+3@d7+PWD#&a~JOk1gJlB|<+|+XVUJ3b7A?m#t z3QOzaV{vvGx+A47wX~k?v{>|)_&;)7NwuQhS}be8rK1?w3gaxUme6zBa(PIjEVlPz zQRdzUK(Svx@E&B-&j8+S^y`j}RlfvSAbL;?Ve7Q^PF5rYJm&)_DK{}!UpR{%fX>dJ zlpBEdJF>8nRuf=)EFtD90y5%UoyP;*<%^M0OxBPIv-ySy+#sfJG_=eSbmF5Jdg_6d zPJ|@o?XP20EW12bRYS^B+|V2uIt%C}h9-eCvw7Laa@vK4O1UY2ml5_Xk_?{dF1x*z zK|}I@s^2b*^91`u6&JjF&uYURtQNYlypT2DD?C%-@!oTZ+3JLVw_1AftdegQdhpV< z$g;|9&L6rd`mD^{sWa7myXFdZ)@mO9e6cNwYO8Mu)OcT@I>q=r<#E2bZ9ShI|M3lF zi%Sty&lA~$ktXrCv!m79Rsy)DROgX;4yk;p!|uI-L#NwyJH&zAm`d+6@8?&S?bJnI zd8o5%_8LnnmPAo&LrUV3*0t-uK zSWoQRp=dVRPCgJ{OBiiZpQSdlaQx(j?gs2;nrsMk^W+D9end^~?d;`9Q}*)xeb|C> zdT|?`4OSSsY!R2o|ii!b$-KPvAOJVXidhks(i4j zfDrTa0YaHL?CDC%&~iXlr5j??(Pva zN(4>Aop7DVjt|xluex*mNeXs#iMyrgi`T47Wwf`ud;gmZiIS&^fcNK;rMrqDH^0ep zP|`t_MmiI3Vk`Ay@+{q-RXv^=5}P;gJOZ+!yH{@HNS0w!6W{e-ml-9_x9s&(Y&~s3 z8lw0z&VS6~CFML$;`KNt72bqK@C;Eo6~qe-ihV{;EOjD6yeD^Ph@;PMQm(g0(oot) zqj*;+?`2h+E!N8cmR>@M)kl-TNHc%{$0wo@B&4ed!5%+;0*N-7wJMs2@OXRGVT_kL z-hOp4;;C2Op%V4zXJj|!Cl2OcJVQwR>I97nPDx}ar!R-l*m6*v`tJ$xZ1T{$M0d(9 zEq_zwF+C8n3L=RKapOgQS7aEitRT6pQ8*YR@VxSijLbSajGmfkTj1>TunC7-i~+*n zA{vdaD8}uf-IArYcRJ19yn&JaKXQD}(89W!PiG1oq6Jicqr>L2-Ac_$xe=WTA*;FFo3)DhyXRkdlel(W+iaBKru$-RM_q#lSkyg4hwKkCCFVzQ8l0JaBoE{}X)y7}WTo`%$yoZQ0+>lBHznmCWwD7eHiiV6lI1iv1O2Py-{Av}JvMvPVI}y)InLxnGCO z2-QgzqSbDXz%?;$H!!Q1PxK&65VZUjdoZZTJ6SHYceLsKtJmzI>91DH@{bOaT$4|> zw2aZ7i9*gt1vJ9iH}NV(Esnze+Z9 z(uq}!Iju7DDm=5=`gwT+%-Z^@bUWTaOb!*=NRe~Qt~L3RL_#GQmt8420qBAlUdXoS z*VBGVBL3zlVW+DF#M@!&Sty10cGNVmOhOdzBo7|?t}%TbdpNnEjoZ)TZj?JJ%AO|C zzW|`o^q#`I{r=H6Rb4-;DYoGJ=R42~NGxvsjW#dwaH>b!o7yy1 zUU7pnsnJy8Tf+k1Wz!|QSIgD}dp7WiwyQ5(o7+XO^j1W?IoeHw?=eFjdTiIMa&cD} zgB8fk5w#C(5glxE!0=YO5V&BO^qTK=+-m6F-vP>7#KJN?Qy@=RahBIHPlU~ymsTYG z#B}D<^!T4To~Ol6K^e)m)5N{b{U&?ENtpWmR~bIL0^Tgk5v^};Td}WkW`m=zvU7WY z?ZI|g26wRXW98duVzGOj6mhmU&u^T6qIEhYOe3Zdt57g@fAs5n)tDurWR%wudxYy| zt(8@$U(#lxvzm%YFJ!hzOCHfJ>|vIz7epUwafvl&7e8A8@1#hI|1PO3G%M~!HY9=_k+5I#&0D1_pRX*%F<6(KsQdiQ?b@Y@-;&WaFW@7 zc9fat6iUW;ixe*Suua>+ui{F5LW*y$q-k*LQkag~ZeY7p*SyhB-l1|r+Sa?2(n&nQ zMM<~sx_gwD*%dH)s~le(BdbIhNI{NEpEj5LvA;ScM=Hh_=A?LjjP|L`OWYcO6b?i~ zd+bhK@NLXt?-8w2&kb)>eJqqt?xtR;;+VIU``=9f{z z32EQ((eW8y_yt!Tu~gX>Wcrs##H03A&%5qYPwd`abuAHA3zPe_Ad ziF5XEmNa{6B@^S7Srylh`eb2S6xFERS^pqOvN_K0B*Fb-ha>g0-`#v9R`YSu(~h3h z(J_nRZcCNK%`ApbEYqo8kZ$J=RlOm7pgrwjaU*A|jq990-5Z0N@Ps{`p0K2AJuCqv`=XAFxYsk&d)n%=u_|&Z)s5ZX5X$g20 z8Yah!)v8L-&R+2d_Z9B@5l9;~Q4^_l!aRXp%cp2pEFkxJwd2bip?Kmg1jU;lLE`K) zrlSv$c0r866(ly4R$72bVoa$iha<5^0b^CJVVb{*>-@1v&#DtGyP z^p%A4oZe{n6tZ_0P;yJbIEAO|S<3qwzhuJ-lqkQo?&;dqTMBrhF;@3xq zCISLD$pi`T_UHN~uN$$N3WJi?+HS}30jHOCWXDHSJMAw^NhsSRQsO>H=Or97?@(ElLwJQI(ou zx_p+Z6Sh>;XQXX;rS`kMFt(BCvi*IGauk}FB5Shxfp;}=7+Zo+7%MNX&RS?3_m9vm z2(quK^nF|=s3J<1W-I4>8d>oO#z%xA#So#yF)xzdR%XwA!20^S$kcVyJ$)d=v$$gL zRmicXw)5V8r(F1*s&~}yMTax$H_oG5o$5!=QpH}bo5ZcY7=&d-g4znYJ=y{+Lg`#f zK#f?${gCSMs~Js-jL2Zh$9h(wFvYIN8$c6QsmG5~npw!{VTiKJI56c+_uiJMJu#R* z_Vc?>ygL$a*!knKq@=8%vmw7XhpSTe$CbuOFywv4)i18)ba5y%Tk*+Ndgiiba|qEg zgST|)j4=-toe=qs{ry-87n4e#i^?%AkLQ+x6G|E-hc|DeB%A4WJ@+k}T$WJz5}Fd3 z&G=MNgv%iDYew@8?Ir!f_%rHUJ{xfN5FEij?^|{U>*s6!)W(fy*8!h`2HWr1bi05% zb5~iB3y#ivqr%>jX@ib~sC$wcl#|%So5R0jPs?v#v255q3SEkXWK<@40s@CDk&p+P zhCX{WZ6l6m-o!<3geHd9x+YN++7`w}ijo;OtFu}AMIOV69WW|=k86$4wFL$M9Isuc zgm5vP11J_s-lI5cow3xhnB;|&dtun`4_mXIlZ^D5cCVDh>@X5o+X!-luJ%H?rinKO zCv1J~(GO6wq4YoQjp~(WR0dy8sZb<{(Uuh)*4%qpmTRLILsQMz{DtnlwI1VFeXgZ> ztG4&?fy8&n*=JO%TN$b61af07{Pd(#Z|>eRjzG0g(=#A%l6aMhX5a{Ul^hFpwjZu5wPFep7Rq zJubiqlb1)>WIp9;fG!>2@tV{F>)@-fdKA3cAw8M>@~rv<{!BDA;c$+%d0wD_z6+GB z;Q;?eOkM8tODbAh?YzUgRl=3ruRu$ddCcYg|6%N{gQAN6e}51G1p$?k#-Jnx>17cS zkPf9=+Li7G5m369P7#sr?%t(Sa)D*(*rk`e$IrcYe&73>xp%(vo&jd|pL3RT-tSjE zAJ3qB~-!SEN3fH#0t5mVrdS;gt#$Z*%~Q)z%%+(h;yW zT!*k-mO74I3p+i;8RNCQ8bG z#Np%Y)Je?k(Igq$c~;ro%Dy(^Dk&7j%hY=>Y|ox0s7O6v!Jwz#`j(+!js)*cc4#z> z-II^3mqy-unu@$p;sy0jgSJnP z`pt))(J*y=Ay9ki;2PudEXjBWOKCl{YBSM}`WI>nfJ)Rlm=>XndNxexFfJ--`mc^=d1X zH^Vp;eks-WkhZU0@wkI{oknoao}JXlKZ@oDdhiY!c;^S{11G zmS_emI3pUf4$UI2*UfeoyjeV364Z_U>fKriEnLyci>1(*3~lvVhe@HzX)OWG)it2s9?%fCUrNNszvs(Sz8gd2>tc2VIQvtmi1A8c{9{ z!(to7Rnn3T-G5E{zRm}T5W5;nUCVm~SUGUj9BZsA^mZ)^5Uz7A5aXyQP7|~98aOum z_83o$`^F+HmdhVnU4G6qYyu0(_LRlx3@UEKL< z?>OG3aZCkqKVDL#1o3PN#jE%||hAM1{)!26ffbb+J5fLpOIp9^xu~^jYvVAm0xM#!M6O31V`Hqm^Y;7AyZ@i7& zU3k`vhiE&Ig=O(^wKXLocdp$pKlJ&Ua z7fKvl43%H7ltjE9$1dG51Qw%V+m{}ohfxNOS0OJh(2fVTZ!qPuL2sK@LG=3~2+FFi zs%^IMSVZ8(;BSLt%r~d&t8ktq$S;*&SA8`KhL}e%RP(N`cZq9Q(Hx!zagr_L zK%w~2PQC_IO|;(1wi&~4CwW5VBL{8g!vVY@i|-rKmP#pymJOoNS3Ayj6$XidMHjvB za-ko*Ee9BQ>$rkznAyTs@6*TocX2j1n+L1vpsx3?^^)U%a2(6~8ur{u*%CMy^2xwv zE%LiF6nTReTxS-mH$*Caw@Yd$DB%F?K%Daw>1F(ar@RTrc)X-6bx;lRYz8!gD~|tz z{By_W4HV+rzn8S^cl0gLr+g|LW~&+GLl%?9=;WIkyOy*8!)aD}S`j1I+noM|L3)BA z7kzGePAEzLj-L~8O%&-|Gs&igO`LjfO%ZeLzT85Y! ztYA=?;4(7U<#+KsPAV@O?OqD+qRdw$+McvPz0+I#Uf)zK9;6;LGzY_{1qFOMb#8!| z?FHr5r;r9Xil3Gyln-w0>@3RCKT|JgSi$WL29X}lf5K3V=ZHW2=EPpQ3%jt<1?t*(I$5ya?#%%A~HhgHhDq~F9~&fAsy(WcVU zW&;vwN8RM4#TD6sT^nK!@6<`!#M-6nG3rOQt*fX^M?`t=tnM++jCZd7(KT9jLZEC`RU~YZQ?3JhNRgm+PBMoJh6CLuz79; zI%qx`JXFwT9wH;(96Xd)urZXWq5cvJ{Sh`m-7$ESey6&J+OPFH(4B9tNgERI1K9`= zdvJ+HC6v7%uP~tz^N10ev2?7Fng$G^Txi3eg_m!Hri zq|>o8M$VDCiCd}WCKLGR$_h&jSrR5c1@$NoMzopl>PVD3&j1tQACwckD`uyk$LC(z zPvtyLk3*05(ZxTgqkcMCgcVrfeFt?tJN%v*8eEW-_9cz!5W&tA*cxMDN>ZwE2zQL7 z!vDa5eqEc#88bOIEq_y7@%k&H=fWE1kXQuHzumEVZ1@+f$)!GXtGwloMQQ7ZHa=rq ztL=XLiR5Nj9H01A+01LP!Uwc;xYv9nza*3{HGh-Y^l!P!N_EOcK`;5;*Dm9%R27Z1 zH4f8AW@H)*zvWsnU=dyREMYBA$XqupO#M8Tk2}4XSVZ{BDAFBiZpYSDwI{iUce)6I zA`$!=5Af(!$O$~MmJg_9xQUdw`bQG&KNpW2UCUmp{Sh-H`2k+F5?aD%G-}Xb{AFM? zd6L1ki!&1a)t<(7IPfhmrB?^irl>BQFQJK1j?swmJioYq)Bb`GQ4_F{vlwAYfo!B= zMC;QY#VqJjU}F1@0`Ydl6Z`@uhKhf}{@#bQCW+To%xnD2DK!#?UA;Yd8we+$3P?Kt z9tB5(*za7xZjpaEOS$aoF$g99C+*dg=kNzqs0Wm}l;yV3qxwUGwiA!hY1u z*qDQ-X^vhQKPDUIZRKkIHo7yiLV)#<^)of>8N!K%!f}w&r0ng4Mii!=$=X^KMpmmt z*aD1{Q7@MG-Il#iau-6!`c8ttNk(Chn2yOYZi`t%s1quq4pBkj$N;`t?pjSg+GQk* zN*(BVOJ}X>>J-c0u9&r3sR;QHw>&`!#{yAon8hYfiF@qsmPU^Km;Ett$IiyFG2q*E z6GH}2BR*QQ!Q}}r0uOPDIZ&2eenDMF0$C;V)oW7@VhasU(^QR8Ny~XWRS64^4V!s73ib);itTMY{JWJ8$CT617Ev0} zk`04n%BlIgLR9y44=5Da=`Jk}2X<`wVHaMr7D?QCA1}`3eyu1MbZsR&xBrxH%&1na zKWiln3)5ef_-F93uD8O6E!YZRB>=~O`M)#~ZjMOvlEFpMX&f^xT z-tD&)(h(hdgTVJ7e;t(d<6RD>1s7b7zOAN*T7X>~zGH(g{BE!XG7U1cYXr#1S0SZ$ zMct-nH$HCCjpx4Tv&Ka?@>?~0{rl{tj|YVKN{$S=ZBdzMkO%8~t@b%`+ciMa_X?Yg zn)fF^;M>#A0S7yL{`fu6NOMRKY{X!Ep+fPVBH5XPPx(@ zvhT^`lJFCLvbrait4F+VH&h5yQGq@iHl{9RMpOsU3mMHJB-_$ zFNqCQ^{RcGg`oJkA-Ei|EJ{#1c8j@W^1_Z6u3O##@yx8caJ}>tmq>FXq}qy_?<%Lj zb9jor31y;m#B`>lS=`@CGd4%iRet@1l=XbYcpIsCkM4>8bTrY4+^cVz_X8g6&73_c zdQJ?Xx}cBhO}nr7o6Mn6rXp0T?~`tl<(%Rt{|hWzl~5?@GD89Mm^n>;Bz&RVGSOJc z`xp4&a}^}pqweD6-8X57FqE2bfqS9Yqm499qi0k3icmh+&r%ICzMf+VoZ$>@{ewQSAHIc0D#F)qT#I>d-3tT+L3(9SCU6bK{I{*r);c^-F3bia|`pw8-s_=uAG>OW&5J6tsHqIM3MvUU3%m5b$ja&Dy z5pqK)G_L`}L8w_pQ1Em%m zhu0Z-tzZLs7~hD~@ER+~>ldhGsQI5vp)}TB5*OIA$7T9#+jMDi{oEzI2D@(S%NQm2 zE3_DRepDZ@dCi*_v~hiXh6ro!>kzZeFMF?etJ1u)zsfp)bnf0tRuLc_2#3?#5ITM5 z#8fkwaR1otqQrMRUL3$veL%RWAo*|4n1eqOHF%nNiazX@I9q`C7M_&YJ?uVaVG?Gj zciIbc?(_>YXElqy=zc>-0u_--e%d8-{i|qWWo0WcF$MC zN0i*&kfWL9sB~Q(E&kG(8TT+MlN&;zrK^b{vL7f$$t12~j9z*)dE`30mukQ?#&u;Zy4#!aYNJLIsSED> z3~w7S);s0?>@4QW-fs-ox-!YUYt0Gj*NL2=I$QLvV<@izBYP^b7{|ka)<#VohmNCd zh&{zTEWM97;o5{uOq7A$K2nf2xiXDf?+&_8S$L7c$gANE@5N)N1-7-Lha_O-Or9scrT){suUpL_>T zdDBTFPJA+mAm~5qsT(E3!6)ZOJs3JD)Q^qm1<{}H09uJs@}&7@*p9D22>OcdmwWGx}X^ z^*L<)h3|z(`(0J`n;FyQ?)x9#K4Gj40G^}ITP8Y_3qsD`S)VKD6I znd2n55*mKaNr5xlRdqK+B8XhHr6wWu{H=sBKQTLtsx{%vm$N13Xovos#S_bm)>@k* zH>yMYfyOCYN8L6*=_ZZ|tyZ$Sn9GMtM5WZT6!6|oFEYb}g`C;bmF{?g&sCL8i46W< zMr03`gYNkGjKna(gDp_?2D6kNs-e6p&@OhX=&gBP`oEZf(f7{Oe#w}Xi1DS4`Cdy( ze8UF@)NY8xZxccWgg6E?ZH8fguTS?L(v~(PVR6l+2RfPZXX`ODf75n6Cxq?!Hfj~h zjO3E_Db~B5sL^_eg0&xy5QrMH&4sd1j=qQKwY*jdO$|*>BNH;v>6w@Yy@^kp1h?uQ zJKuu|gt2g8)kyJF$o#s<=o7Nvbg&7OW-E2PoZ--^>MBADHRF_X=oh5#45DN z?tL<=JbcL+E=dHsud?}}&Q5~CA>A^~tJsrm!K;ZQzr(q_79#4_2|I5*B#XDi7>*_caXNOc^4~t z)le}Y+RI$YlIh(%tn=~oz&!%P-Morwx34CDqaN1DkhKCS;{B!K%SP|L;Al!7c`1Nm zy{An!Og@-_N04sqahxlMRce7boQFbpuIE19gz~n0DaMAiZ2d~>YGruQhLZN`A`u=p zh0K4FtdNzf2vYo7mmh$zI%wH#zo+PR9ww~}xC%C$f0mH#eVT8gb*yYa%5!0G^Vn}K zR!-j2Lq+6$Xk2~IO7FlP`9Z}sE@nZ=QB2x@`r$FPNC*iNqiocZ9O*Qhoj5pbn&qd| zx_#47?MlPI2;~M#Z;Da9ZZ$=IgpN?V^RDuzWaIrpgOKMFz0pio&aYu|q%Rt+>AN6H z?rW~#fg|MRE9jgp;rMO=Hg`V9P?Mn6o?>^b`O&AKNU(Rs92^JdW=-ZLWK;P=qiAwvedzo7>wiC9H z#_#UV=6PE`7p4T7S#{Tjg@QrwIcd@@+F|fzvD1;otyzlM_C~mxq-tJ^+^Pc1^UlnZ zeps?41KF-Q%y_)48}oyR!Be*&YWi=u%R17&I@%BdgWQ$F6=ZaEZH%JA8u94mW*%omw0tz! z!kGd?A11&=z0quK!23tE-$D|?kT6RPiP|ipgPjeWL!RpL*G=c>+G9xe@RIF^#dZdr ze33_zm1~Qoi*NhzPK9+Vw|+%-0lZ(s6_ZYEq}#?!kY=fR&2&$hOLHrGgKQ$x0YWg# zjvX6m`gG^>IxV3km-TLAm`9}EAC=?@o*?3B^TqnSrJD4u zr+&-saRz$~JKu(y36Cz3(!9h}xgq$~voGb=K#7K&b>U@>QT-B1+g5n`&MmL5v~T`E zIzA1#3M2#lYIcOH;|?R0mH@Fai9Fxpz%RMqafJPK6)z1mdz9T#A9~*f>Z#!{cF!f^ zD`mPv0xhEy!gkGG^{#R==6!jf+ug_&jy$}}9MuC%pB}$v|D?8D!G0_ww8cT~xkoHD z9zWfs!yGh0*=q!zDe7=PUkQa4l|iZf%^12@sA0wR8JVm+(R||*1l#hn=`xu7NF#hW7?eLGfGM#G@D%h6+=aUPxXbqH}leA!D?a&bTDWEpz>S(CqOiHOuWDs5!6)M4iG9?)}(b>e|75^yb55p(BYA3-- zATsbJT&<1aQ6+Ye?t^*UqaQ`|y&NGm*h8r?HR5`<2FWdp3&Ga2G_Uve@(os>l=Tx| zkljRCe1mogQ+eooSdkX7vsZFfWjd+|Ri}C#%v-1pT9P0^c={L_w~G2~5DAB#gQ*TC zbB2KqJWbRne4t#Tdy&BQ4v4qShKWDa@xZJLd31c@aB+7j4|L9@0^M+jeMfo{kWJUa zd72`&#mh*i=03N8=GK~_QeuRgU*}(Y^r0BHehVwuTazWgc1)`jc)l{t{;&|@|MG~# z;1fHG_nL1Fn)FU&sD=+diD8IXsfJ5%AB{G>-&oy}R%-^^ld9!Tu_JtgBBrf@{+n{p=%oTQr$3qvyJC^~BeV`FTBl<&OUCQ2bwbjkMwXS=4C-vt z$TF>nj$mFweiG|D96}E0Pc?o6T}e5I`uO*n(KL7WIal}ffdZ6*pvlJdhFvA36sC?X z?9m&4&L8bqUQnWhuI~n1>R&%4zFueNjej==RtXL1_dDcU!sR750Q1%tJyTR$4HBCE zI6Ufi^C@*r{lb>sV`7VP#M80Odr9LczYpuqVem@Tqfz7ak;r(TGl58s?jSi9({(jd zGM}>oD=HPz-F@wr?&JLgkvIVE+i_x9H+6VOW+-|b!su3R{K-~*_8dpf!r3TO#mKlb z_Cv9A4B2GICCrl#A)E<4T(;tBL<*K{uq{1BXmxVH`y@w}+Q79h^^HBSKF|AB1wXfD z7?FzPc+(sIQHfw-UJuoPIBdg`%f2Yvz5iboTa`>6x_09wnWu% zczYdA-t~9&C<-r=rxBDFsDg0>hei(hUG71sVCS_i?1|IJa~{eA(_;KnY89?=(cf<9 zbJ(GGODTPnyU$-cnZnA(W^}$%1LBr_bi7ZT5Sfxzvwk zI(xhO;DVj`bMq38gg?@Se0|!Q=>-G+s;Z0*-Pl!x=as;P0nNToy`&^CpQ#acV?#A$ zK$E2(O8Lq|j0`U6?NNB(Gk4`&2x8Pqs}_hW_|q&{B3_6 zuv*}OS-t28D274N~BCyR<5`E|Iiw6EAReg%c z*+yU+*FI=dXQ@iIjQDGdPUyEK@TxPbFCXNzS3lp;OX|yIlc0or)9>PB^9r=JX72d|E}w997DE8t1^`nXqlT zzL7zvqm%TdQ&EN%J0k?hkLw$~57J0iPjv%hL@>fAOY7s{mCi|y^tj!#xthgnw8_iS zwnm1^g@uM{k90-Nz)h()O|krcyxr*6q8-l&XYOr1zDl!abd9Xa&1&f1TKI2i*=c$Yf6(N)V(|J&TwDmbCFYfb4 zS_2xpvVxg`tUBvT8H~g8GLNVoW$>X#D=1Tg^01n5V?=NWC^kmT?`(TsiAI%eyB9Wk z>S$tDotnQKPQA8wtv|wmp$=+)_4l2p6Nx#DS}%YL_y$33F!TthDPVR_o`a1gqr-Rh zO@F#C3-!6DhSI+$-*^fdhVu3uVfGv|!O?6g`V)v(rQ3%IFWVYHi9H*RvBO<2;U8Wu zTtcbuGkJfJJPID+PTX#Xhs__DPN9bSf`XbI{ca5@Z$x;a1#an)aH!0j2-q*mf94nH zaEfBJ^4dLprpr-ZC#70*+1&+ zJqXVY25Bi)I-?dRJ2J~6*e@86c@t2y@8R%S4&PD-s}$tpbfwR$f`h$P^WL{seOtAy66SKOBN_Ie*#4Wciwr=VS@pk6ph-myB zo9029>(qn3tE2QW*kstd!2h{Y)l3=}?YjHbaRgH8iKE(XRxjT1xzkr^VCZL_UjM5O z|69qT6mK%|1|D0lk243eF$p))Gf~`t- zhG9Pl76$f0&fWlZ>11E__H)&wkt$XHpQ$f^62||1T`f{1b0m!z*@!PDOgRf_cYIb+ zp|>hrorNm{RpbBOs-nhU&)k}dZHj!>-4-6W^{>VF-&yVHDuF3wKA967NpsNu+}8iR zx&PNsHE#U4!v?*_`FH<&*Y@L1P5v7V@J!Mt4&VRQMFAIHL-8KA@mW6M@&Em6`#(RK zOu8eFHP8>sKmPAt)RYD@M^+Jwy2AhKUjOT7YWhSkP|mg-N#p-YQvcRq1x0@)7g}3C zITKXFjYOp0AQaMcb?qHS6s~SxlnoBsUhb5&S>Ct#195i6RQ=Sjcn|p?WJ6BDj<(O1 zarITaia>)rZ%JI*e}3RRA^}NiSz6aPzA3QL z&|Ey6Of||JL>3M>bLdUIKp+y=4}SI>*B1V1b!|<1l*z_xF}Uw5*mA6h{Wpm8zt;_z zXfRdt9HD*tQR9F858EGT;OzYR$64X}d46qQ?iRMAbW}9=Z6*W+U?aUe0AT>6Wd%6g zqq{~VZw=CNZ;XG+*kH!wm_h)c%AWDelJ0B)@R#j5U_ww3&RR-w36#LQnEbCyMGlFc zG4){`9*_LN?7>R^feD*2y>t^(wYn+yY0dzMMJT}a=m?A5!zyu>@;9u!#v*QSsDY8M zniMS~+lM`_&Y~lAw}2W}>(Ix5^~4=qs;qxgTHSVasCa&!7j3EMi19(0Ia{*3AX_6b zq6lBW?R6!X+9-M7tr^{UgiD{l*6;FMndYA~<$tdm<9`p#t+Cr>v8_vUY)TD_W~7AC zckK-R9#*13U5bD+Nat6tMJ#sAZ4EV&b$K7U^wzHMQvex{mH7=%r8|l`ozQyn{?qP z&Q|GujfC?+94LXQ8UfQ?9E*y%NUSZ7HaHjXIdy-}{c25n<1JmFLKrdvz8s{GV;nx~ zkA2<==WR3Kn!v2L9i0qF_HF$*;s?aWTMiS-!bx2Rp4cc{u?gz@_M?Qbv`oJ9Cg*~v zm2h4nh1=b-L)RaUTAG06<=z0C1hzVY+^T|<(%8#%W0CxvmwO_h)<0K{=^IV^jXO%X zSm1>U*^f&xY+`&I1v>mbT6gej1)V7&eR+EMt*Eqd{DMq$9j0)g3X8-fd7U`H%^=<~Ov1-$F}GEv*;J`h_*6;{Z*LYQbE~~dUZT3Bl$<+Ptv$%%^7gWU9JWaD&sGX-lY+i@4Qly_%0k47!&+Y9d3vFHnQZYp(sp#=X>vA zQLE4)VZ^g94X7kk!sEpJ5#-SZU_=4_2QoEn4w zK;ED>6xGHFR}^`OL|3EF0?1YFwM2B0b6>rpMj&pZ6Y zOSIG=$;qY^@Ff|oxL#VRZ8{(UdN)sd_LwwQm5E5S^+lV}7y3B>mMiH7xV?M8pr)oy z*_hW#a;tB_n3Rj>J2R^^+gk3>x{oPFS=)2#Csy=0#9ZZX9Jxe{`g)ur4pJed_c@Ep z-~KfXWq@IVk;hj+zEd_N?5bnmLh>&B>tgVkOvJpux9_zm4_nlc!&>hhVy?|-)6wks zF2GHloL2C&xhXMEy$LhPGIlSAfGKlnC(b`gz1xxTChPW!ZBQ8DGtIl$=t@S+U9FZ} z?C4e6dj%K)TAw^6Ij-M+IZ#pQCFa{6-?uYj6yopAa5VBw65Wm`w!BM8EA+)WlqEx) z;h}5iE(3IbuOKO0<5L0wRIQWS&M=8LnNfGl+-lS^j>E;mtG~ z&IU=$7wFeUOu3fkQLdBu=w6=<8lFr}73#gjGHC`Xk4r9g_7j%g3ytq(9{ z8T<1;+KB(}(VdVAG{=G%-ldIkVOFCNI{KQHSb;o?YjUg=6yjBNc(ExdHS^Ij_l+`p zyX(r?&u`ZN!VL1$LnwU?DXdqft^?Vt=>jB+PlRU8T}X*TxGDwxXv#XP>trG7e~a$;`X2vP5~?5&Fh} zR0RC839PEODK{I>CRtGF&y{qtRgm>f`_I;gZ2}YJ2&b7H1}I@mGYEEAtJAw_HYP(& zqR7)=UQzn4Lwjv#!|{r}AJ{Su&=>O`x}wDQpJ?fq*y)%>3U+o7GCk&L+zsQ~T#JwN zTfP8t_AbwjOgf`P{0(4c+uRjD+V2}nl8y!;Yd+L}0^T&8<)n?5U7mMav`6Ub@ivLw)OJr`G4QfBo$F1yg&jWD-(=N}VjrSm=4$y)(zdTI{uqs} z{8(0?fExO+ZclqtIE)I5HiZSvSpKwIbIqL7sr21*osNC%*HRAqQxpR9o<+V? zkICi$F50qV7D*Y7qDfF1=8#@sLrWgw1snrP8H5bn7b7jNRTqEfjR;nsZSXg|X>Be> z-=qpf`Bysbz0L($?^bqAcuSPy6!^zdujNGlY8H$nDA|JUdb z2>2x^-Y1PrNY~KxBZ)y&P3}vca>*hX74Ay^Sb%R;t~v3ma&E_rSYB0IQ~f8dj*?h8 zj^)@^xH=gxP>Hz`&tkpZ-BR$4pWf*ZY+;lj6@ajkl|7(#G5HXpsq!E(|Lk@C>TEIa zm^V-Rp`CnPMzcFiopoh32wcWaHN=11p(-mw9v^7bLmqF~jJxNyBb0GHsQmnn$K*N- zH9AXqf+s(yf@w$(T;Kh*%JThFLYk(CC|)Nw2Am*jA6Y#JbUt(*36_!$Nj?myHeh3P zT?sa=X)Fr1Z@poCKnoI?Ed0Pm@1_&&FsUw=f={!xG`@awJfT8D9o6_bXM zHz5a^_bI6P{n-!qC7RxdhIiHa|L_)ApgY@{3MtY2(scG}<~J{c0BiMJgJ%84epCJ% ztdv42Qz!a^?C)kxCHYql%Wrh~gzua2($TruEQ-;)j7qHln-v+gp^LhXG7%doTkYKE zqEW+>d}ZmWEc+I$W&QE^s}&(#ZYK8y3~L*3T>o*{`F8(5tOZH=S749+(egtWC!Iw3 znz)R`FehZ@p!HIy+O7qn^A`4zA{&UCnl~HVMQ+Z?J1x^}sYnyJ7;~G8{(Mql z*>5>8>N@!ali17->auIvv-HTKh+g#CxtoWaP?ca|!Bm-MonD5u8geg5rZbNGmK+vA z9+$^??B|h567@0oH|wU|u;Nc_D)QWqmOM=^E~6$ThRr$uwhmjp2Gr34GBXv|(Ii9W zj!hi|biarCXv!!qs-^z|L=E`K){7Gkq6;xsEq+E5uH$`Qm%q+sEnjv!nEn|#*8@hz zGRUd761vQJ?KV$udOA})dXxPH?CR$bie?GYp}^tD3{VyzreKCYqX%;RFU2KU4_Y=d z9iq;yYZ_fi$jlhUV(hfX?Ej8F?S<$hbEOlfvT4W)&W%ouU{e?YtccG=k9J1{L|Ax_$lm;luL&zp}|!*dUw znQl)Ot~4Kw2~>IKxV)7%hwkx_O}eABS-RbO(8=)!R_d6M%l)RZl_<&I zY)?K1t&3G zB2}N5RN^&H4aE!a_i6RGA8814boWIwQ8W5qIgX(Whe*UBc4B`?b+g4yK-pl~Q?taZ zEb1+P5BG%gUBFY1nDhHB-RmzVu-yi@9nq8A8_(Zi|_$AYt zRgxYO7F&r7V>{^o2=#5#t8QCv{eH>VyPYk%Tj_n*o`2XEulhUKZMw|fct>^hz4lAn z!ty8D7TDF-H%$~g92u2zjDCOPtOY*gkiPQc5aze-p2!-jt96UPO!`v|RB?EKdWm zv3LaCn=LhD?a7mXcXC5&KERdyiuZI&pTfopmp*e^Rer6m2k;`?@$>gC4QKnvRj;(q z&-&RzYt^zA-RGyar5HIT|6;5(#OT7r_v;rk^Rvr0M%vCn`d@N9tAMsAQZT;tz9pKq8_nVqbxT&V%jBB{QYhJkI_;?;5dGl!Cg{m)OY zHuIwA1a`<*^P8)!3h>CPYXA-UkCDte5nWMg8xQQ?iWJhf;fHcWm%9{WcLVC?t7j$B z_)*+D;+^J&sXG%0_(>r}n-&>Xfz|UDweM`z5lQu5UC=EMZs|0WYH%4T_5843JY9xmnP(WjMjm zUjT9s6=~Ui)tONWML7yB(t0V#q&?6?i$r;7H#Z)J!KqLYq`v$Np;rI!3g;`4Y?&U< z@(gh*^S$frPW9^^@N=B=b8zmZL_-xZXFb$b0F#907lx@q3C-8aNgQfii?C}_0#^!5 zoBpH&S*ykJ#>mXSw$)Q1u$}gZSGs|b__{hFYv+lakbr|4d~E|XA*E2kv?Yv0LWz8? z*3<0&RwV?6h?feqsRBn>F(3`C1%GqvKe7Dd&BatuV7ElppI%FghYpf1K_z>bj^S?% zWct=J_dUV$OmPG@Ga4`JHu$jkeEm}#tix&m?rhA{Anr^IiLYJ#idXn0G8$0@qyw-u z4I{1kg?C2d1ickU2SB|+fT5B`1sp;`m-Lhv#~hYQqRk8QI(#k=00_ntkX;*Ws=YN{rp7B0Pyr7$Y}MJX+s| zNDDKV>*{gjRsmXj*-9*_chc(88aEl*M|?;h>!}|4If=@krCQjOlrZMU@-UnzTBrL z%C-WDArz&eH#goZVVqkx8sbOVcK3O+S{<&_(e?lG1@b=Eu0N$6LGhBd9ucGlb;o>% z($dySIzG0kR=iNZ91@-Ohe<%a-7ODCyAZ1L>ArW$lO%JXD{X-Ba@PbAXWjmRTo~+K z>-x8Ck4y+y4$}#;PA1l{1hDL|rrDWR<}CLeOG?2AtN6RV(uBY46>9bC*lD--iM(?q zYq?CGSTxix!S%diQ{OrV--6}(*FdgUBhgJ`@fc27^ew^dxuZ55h(o4q>~(pBp%3sq zQc@EFOdC*80Rs*GZ_0G`zo_rDT4Qt?lkz5<;PB3(T^4i89PKBF2zM?NqYt`+*`nCs znU6KLA#QK4V>_WyirAjF@~3~BUr*64;BYH%T|KN9hZ*9&hCX+7%dh_MoQiCo|^x_YoAjgtm3_c1_GO4Z0JnV#rc)d*PjWYGa?L z#hk{SB_9b;(qtE;?FZb>0TV&>rLwnvbS$zsm?wx^~rk7bW&LC84Yf9Z@0iHUr&XEoL26iiXK)f_9f>FQ(>x2 zZ5zr(fdhwg5S66MG|3SDA>byYR_t93A6MUxXk7S!ecLt9U?Oq!#GqBHF0olu?O$a; z5pz6hx6)iSQu#{OyTYOPLAhROe-lI%X&8w~cK2MF4W^EK1^;;Atf>n&ehPQvI>hxb z187rqm?%ky^=+Uk{O3z+#=J-JYf}HDRr^Jq_T2bpoMTk9(DrEF!V?yf6%924hF{4& zZ4`$+#~PnQ7R{%kxSkn0M-EuQjrd^1(mTZl1?dm|82h_cea~OmUL&xhJr-%MTl+f`Lh4y*sA38FH7`%2H4CZg!G!4?oJJS9zA5E-5utZ+11P}CGMUdh}xSftQ_l+;A_VM_eJUhOr3P;PfXWSh$xJ2NBj^`5%d zq;1m%OMmU?A4#sqjjc8?3WXjGmUNKPdJkFw6RZDqSti^W*z1kZC=bE<=5>EM*sU6V zKz`8L=TymjI&?oALe*%H5r3loZ581k>v`!;?ajR~&|A3>rK?=kwCCVQKW*4B@}8H?9T}6` zqP^m$EbTa(Oj{8CYa%^g@4#@;2q~)>s^GGCJ74SlH&I*2jeYy?=I&n~xdtAONuf05 zTIH1QPpEjBq- z-a^V|Jn>m)H1mnF`+8#j^lfILN??& zlocs{I0$ET{;6N#;IotqayXYtbMHlA|J)w5ZM{7AIhykbH~zR`6N}&9VTNM7(@tS-fr z!`Z~_Wdb#!tDIWpX6M`n!gEF235=ojL~RBKPuuyb;s?E$B+xOTGmVFb8~ACue>Wyh z_`+f@5GnrKqyX1CR8vs8sY<j@e{t=ONNIYZ-Rqsn0)2U&FKoW`{6CHS zf6e^=H1rABV-iLL-ZamdTRiQ1_E53$;t;u!_E6|IY3rEfqj3IbA!Th?F%wa|g%_Nn zTzM|Rf2mp&-gtl$^8l6`FOEd3U*lM;|&OX5La7OHOlan*Kv0RxedkPhUvwFy-i zTfaR6SYF(1*V^xQ#otc_yE0F_y*d{o#vV35 zNEXlg0cR&K+Yl1frAV?rVgS)%CTYv;>+}+*X z34zAl-3ji}=$!A)nwk6EweFoo|KLZnsP3v$b`KcE6zUE4MG%xiK3xDX8z5mdSO|5x+*dwy zJw%g#B+sYk>Zc#$iexs2dTJ=*srRNvQ8aF0y^5E!2z}tf&mb@z+~aMy=PQ2=kXcmE zXF{^Z2GCeY^t~$yM?%Tqogb37jra}-1Hpp12`u3-IPuzj<9JMbIsesccGY6jADo$r zswG``>Q^?*qlTf;-5(n;&^13RUDm{<9EoB*dt>N`;^Uc*9;~X>V|_=-lk`AYNNPoPSxL-6U|y8rwJ$Niudze`a8_nK!MR0-iNU%X)Xglb17Cfe?MS zm5~eN=yYqGCPg9BqfgtW_XW4cloaG&GClK*xD+r_{V?3#anBnAEps{9u>6d6610e% zA^!EXP3(@yri!j7j@AoEui%Quq?{*RLeawemJEVt%3f(TS9npxf-^?pTPLtn81)k_ zKNut<$ko{U#I?*Cc5HGNZ&V_3+K`js*}ES%*)QkSA^{cXd^TmEtVfG$vVgH``} z3^tMLeNn!)(C0Z;A^g{8jmE*o_%pP@!_f1=lRwciDq|{2-&^$5Pu;lt=LuwOnM((>1--X-X}0t>UTfxhe^E{& ziEZ8sTPISHo#D|Z9#twq@>K8>c8}0{yU|Zn(uMYynnPLJF?UOOn?lgFDs-VcEz(rr z|7HQqS&&ZDx0B(&?2w9aap(Wot!J~F3sNoyB~BRsM+g|6S$XSik|k&1kSDKAqw2;A zS58Bg4(SJJLI_*0*Vp9x`T)`q#5Td+9 z8li4t9{Pr3@OtD#c(KdTCc1UoxkOCC1yu0_tBvB@ z6{Wg_AW#$_==Ob+r+rduLzpohK|}qsh@H`SL=fw|bgL{1+2ZA>O`O%!C;>G3c-9Nv zThzq#rF6)Z8rxN~QvX-K04;$i&BKq-WvzO-w)-kp<=Po3tVW|JKu@6ZU`k?&)YE}p zRpX>A_d_*(&j#Nx{#xJBGkA&;y`Te$w}oFDJ)vxIy*q|L8``vZZ-hA@@R!e;CTKkL zn@RoY`{cidrq;3h?#daN4g0R2A?|df{Z4($|m83^kNZ=lKC$tc%IHj5JFC>kW^s%i**W>WxpOd0Y52NF`$f$ZnDAHe5b3}o7DfB= zOvv}tppbJ#qLtHEBY^9dVpPo9ny=Bo&L1betE0BeO1kCd_jwWl&8f*{?$9U_VkS#e zitLr9RUlam&C`SKx~4P14#q&tf8ArEp94xtUQFc$3q}W|`{XK2qpqLn;`lC%gsKU* z)=~-Tf1=t4eS~N7o!Pd2mo*=haQ!}JCV0tjF*fuzI+tbT8OeUEQqk+jY*CJ9Uihmw z@m@l01Z4DD#e>>l?SjRuq$YU?XB6XXJnebn4#>J}HvWks?FK8~<}EF7S67Uo(}@c`R_dsN!(?TbED}=_{A*;M#mg(tnUAG*2g^~ z+(W~e!s@CRS=12m9=0~`OZKi&fS@?Lpta;$7Ble8}t$cxsBQe)Js?8c9M8bKT;+G(V5ll|%- zCceg5*zYhKjmY#}c+JqeQwebbM&FF=S~(hKOCiV&MFE1r7e@1~+ii5<$ih^J!$*z& z7=RfYSCb@KSUZ#Ep7eXQfC~2UsqxZ~<3%f(3(RMR#Et8p?uqk+W#-HpzXfcdXli*lkbE4!fj#Q>7#Vlazb32whZ`4xzW6 zM94M4uA{CPZA1bd3613)$~;(q$-4bJC^egjSq|D)9{*9k80F5EdwW+$q0U6wSyql{ z9mbTY15;2#n_xDPA0yOUk%4wKr~c?J_^S14W##X)AsMKx&yaZ>#WfPFae)Z$lfN`M z?aEg20@J&{LMippC69MEucaddk8F7_4&MtdFc5h$I(2rgv46}wZv6E_#@xsFx2pFG zB2JC_x^FygYFSkS}o5zO!Tbn6_-zk75kwY4#e>V@EtdNIH19z zbyc&A))e5B2&!`5idC+3e64@MrWz3+Ewpa>7t0&Kgl~$G^vy8U#Y9zC;#^U4VGX?; z!p8S9r#H#|&Li(ik5u{$J~gxkToG701Sz55MxNQbR)8uSrL@&eOYR+V3o1s!vi z*qAWkhBB60givHwZ4YWyS!p8&=x8X~-(y8(_1f9@$H>Q2{h#9s7J_}`-)QYdMZa0B zK!RYIX=Jm7gLyY)FVzM6?l-Qcu_IQ%A5w9B zv)%BUGlYG3^4p7aeI6U$%?QbDm95fp#4A<6K)mfpW~SKVT(bKMPW^(5P)>Ly&wn{= zs}22Anw|qvt4g`H^F!D_(yWgxTE=!r%Ce)_ef95;f>EQ=>k{=qP&>QdOm>!4m%6rIgX4^@3M>moKdmUy6BElbx#gq!m9}}CbjuKz5+SD*%Nd)XdnY}n zq35r7Q%ecJOzn$jzh^q{8QQPri?^+bS~ka$|8^Pb!;@lhb&=82@ah)r7~Cn}f^2P0 zf)vF;meBGD`MNaDYn)OiGa{RTXZQV3AysDo#U4l&~3z@Q^QZ3#7wUUzs6OC z!HDd?5b|BwRXdEUA9uMl;+_sY$5$JziN;^YQR!Z5k0RLdVG-KG^I54_R#lOVne+Bg zS`PPCe-Wf^5htg`ij%>=@sr@SEyM3O#J0^6@CKWV<6aT9l6hIYKl+ijo!pcu$iyCH zdOQPYBsQudT6_NNxLY8E#xKH+6FbEF6oxCWE{gCF@91#e?#s92`#gK!xDTHbNctKM zSpDP<@BjO~s5On|5sm9mOVUB?7wHVTTGO~6bQHN|asVz|Xjg$I_Dg1^8|#ye57;gH zf{c>7m%EX9{XN>HjWde$b-zi-V9z)>;Mc}AG{)EQ!_8loavG(R8*qRZ?MI{$5xz!W z|5v^HpP+FwDigS3$%Wt*6N8WL5q}s%+oKgP&j!k6H!**o*HD$_mvj3Sx^UK|}?|NY=!<`LM40kqYv%KALyz zxM5USw@!j66-1Zs+2fdRar=szLz0>zJfF#D#P~|~N@!VLKj?3R7SzA`eT&q?DHtXk z3yrb%WF|d9HV19`!`{Rr$8=J%qN~#0Rop-*G;Mg}3LN2cQhms(YAxE@MZsxy;=syVi zZaV3U6(|?CpfYHdpa+G;&uy2} z>UCd4aVrwb*6cV^1E`VXqf^%>dDS4~O3DcfD@9>7z?@91fsbhNX1PAgO~n??SN1-idbe}8$t zGf+}fnNfUDbp0E&Pu#+ox4|$`GdHkXRJ=@sL#UJNh(AXAPAr8Tx@!D}f()ONts>#t z%{DgS8z$(EDanG;J6~ZvXBW^eS%@HUcGI#TaW1u)YB-E_2lr=q7=8)T8-9{~*|`4G z8oq{@jc7hY+fwF7Xbv%?5%Fz`rcpBZsEpxm*tBd?l7f`1{oz~fU*gLNObhtdRh%SL@2yc^GH<@| zrmfZ3mGXkis4feprMuiB?Hly3@eGUbZn8aKkgq?(ds$p4UFPzBaKkizOxZpRm{+P2 z!c??nC%h3Y<|>C+MJ0|V7uD6?iSP<&DTckz<7nt3O2^ja29YSQWuCOp#LtyY+wKn| zz;!Urm)hBv@*5f+Mbdo^s8q<_FWZWbW$`h`x7hOi%1*ms7CR-K@UOwivA>n${K%Z^ z@}A#vtsE~R{!B_pgJqp=;%;OD{-Ap)hq4iCixvUDOLH*+r~lFKezoU+)4eH;++8i= zcz?K?x3h3Jcs{Q6o3sEt65E$C-;3SzN*}LxB9^tkumqw<9F3ol=qMua=a4x@R*8l# z&DSH<{5NQmf%*eReoKqSThiVcn(fPe15rw2gzby4XE?SM2F5Q|mFRnn?dr5zv!bRq zRz=PLiw%6EGo&RznLpGzVd~z2C;-v~F9`dB8rnZKxwxBFAsOkuS^dJ~vMH!e@>M_y`im{{=K5 zvKfB5&&MM4Z?CY$cO}BYMQ^mfoNWUVG$Q=Lae`a$%d9`0acP_}O4HKQ|j8be=O16&a^*taZ*RBy&u@csl@vtD45al8P2FCR5kSj{dN z(y`s4&23+;^?2duv31JM5Hkw&?xS+;dGS8v0>|+aE9&Z(4tR#LvC?T#{Enep z-3By#WM6yXc+bYQm0#2HG`fw`vKUA3@`N|CuF5SEjo}k|xrpH|f9jes4qb)#mwPP% zQ?m3RUwGI03i+|^M{tPOhqGX|Z4Bvo)b!}Zzyp*1<>^7SI81|e#@xM&)JAa`;}^?i`2s6lI(Ak>g2mxW>NGIp+7+G~W28 zJ?zr6nbpkr4HOnhud*Wj$j#}5A3Nn9uh0aZk;Wi?-KPUIW^FMMWixfZ3%RK07uI&o za#0`YSmiRN@mTly>Et59H0ZQ7z4A35r-@bjStsaxS~g_Qsai=ba5cBe^Sg9Qx;@j9 zcTtCRFF z!ab6T)+IpS^S&2iDTi`BCA*zIJNH6bbyC$c|5^FBcf$$|#yGh9xRL z_LKcR`^TWShP{*R<4|$BkEX2eu;jKA@3h+itj2Kj5|_*Inyc5H=W^@Lf$ib(^3J0D zw5su;PHSH&$T2_1BFAFa5fWP9Azhw5-~|xi---FOzy5`*_a6}Lh-d$YLf_H%$;XN- ze1f+56&_bUITYt^_NqpwWd}P?G*4VA1b@ddcXMF@XBwiaUBM!8&fZ4GxNl0n<9ZVI zGV$n+t?-l~;4;^Mi8PvAVQj6b#X@g|`SpCL1y^O&R{&>8;X6t35(>^0^DLpd#L%%g zIc^6(rn)iZJSB0rPdpJ;2mNR2JPibiJ{@+RK;vMalw^uI6-$iqs#q}d!o+lJ-OsKk zo?N>n{u|@cx#*qrmpPM5wr~`HARiv{Y(zv{@?drgK5OG4-;;bV-vi727i^w_>D5o$ zie!B1?0*=1|HF%h5g35XY-aZA|L~@F5l)!0h!iJyU=;AR{=aYXzx>{TDMisOknU-l z5c4tv)*dseulfo=tp9f}33n9v5|3ek)*OsK%j57jf)wh)dKj7c`F|S8r{{g|Bi?R( zC`khZ`rx^C?{c4$aC}O@-N4!ublH~>9 zrk+(goqh%&4nT6-2-v#{J)}8>@B!@ce>ZXp-x_g>xqf2@R4fw}0bozo$49F^yxl*^%E z6+^EW{FtWj(Sz~pKhwyDvMLAxqcr;LSEk|~vD4=+%7GuFH-6L4>Q6?#QssvEeT=S8 zRkMHVS}M*GVEb)%F<8s~HvHR9bz#$Aa$ia}_$!?fr2n-bOnpBE$BZoddfr|2rSZE* zSs_ZWUTM^1Ye-r}wR(C*1C!j*C*AQzs!vfsOd&xugl~>V{7R6+tIK0hKD#VtI&$0< zuW!d-;kxpx`NNg%H*>pON7q;Dak6T{4`)14y9}6m9%R z68lnKGEvH}&V;n?H%gQIgKz?`qm}i?r7Ra4BQKug@}xf8UhW(2j_2YQir0lS zJ>J`=^3U>DMX@z@TA!|$Zvm;jU#6jw(#gApp|Gtaj&?v_`IKVR6sW%r$i1*e6lyDF zK2+t33Z;O<&25m|dm}XR1jOYxTwpQ3?*6q>Ba|>nE6<1shE=N!A^{A{z|HB#H`n`l z^YXq1+YJkEpxdAKQ>^We9|PyB0l33|tS;XhOw#YUy7lVTaj^`_YVT=rqwR3SjFbZp zmYS8dJROr3?aqhn0P9*mAorlC*7jbyKikkCD{V8eWu_jNk0Mu<5q4|^I_Kk!=dt4( zR|{K5&3FA|t!{mQL&^Z~BHooN#u7%GT#EPT3bG$9yB|fewB0}##c~$gAon=a8G?vT?Q6Gn~WF6G=Zyw-j%8SJtN8z_PQu<6@@1jm%J~f|i-+sN)}d zGPKy1@8iZQRJpt%@i>KwV-c{xq-`fITvs5OoVh>|CvIYx469-zvCFRJBNoN zNOnw6QuH&q!&zKzhg12st`?f4+U^lsSLFQf+P$pjYrgdCi-@W`^0V9MGz{ysYSqs~ ztEkC_n;81$DcFkITn8?x#k<5-04-Myy2r)}aVsFE)6*ceQ(Z z0IRU~rzmV`kX0w>ckGB(;H*d&cv&;Bm%}&s)RN$+=co%p&?|r2wy>Jsv$kVb4~Q!+ zlzbu5^ry%Pw9{e5Nq{J33y4<@qkDP!>ul$HVbSHgRJx*1Bp8wK=K4cBN*G+1uaHtj zpwKV@_V0P*^rZp<2z+%OLPr5mwCnvT{2OlALuev<(j}Nt+=dG8UYwUXkBQjr`qUV-1YBB<8M~XjGW@Fb~;p>Yx8th>5NhVYo~I4 zv)de`%NFCOR4i7C{V>ce0<=P)i6@f^XMiQK*ROu1j{c;m@oq0D-MePvu6MQnl}EXH zy%MmLUWucn9P^g|y_%;SceN9eVA~ecYJe)r?TC6FL#NOaGZNAGhlu+7sYm$tqVHdd z(%j4F0&N8}fxHy&dH(~9zo3{y403cSn-*eNRoN&)$}l_zIe0mx9|y@p2lv;rnKu9* zx5Cncn`G0M(HqFC&27vAwfkyuYS7k^8epZ(;E+Rg>|6zU|8B@O*yy_7VVGi`I=M!G z!O?3~sLVB^%GRKTo0V4g`qk3+=?XvnONOx=DJXENTrkc~8djZU1DVtxYk6MB5FKWO z0eL4~JvfHAK|W3q1b2K>>m*;t$gkvBdPeSaQ7@3sQ1``K27IhTx#qFLT`R~!TVcud z{=5~~#rCYi9kwo?;IwK!q0GqJq}yrrxPve+DwgM)SC*k~`ZI@ap5G#=vRW08=)$Z- zm=CCic0jje1}_gAuhg-)V%gz`{Hh)S62bV* z2%-4{5~xC>(JtUYhzho>w%Wy3 zl>zNfo5xPB;VI9fJ%$ZWM0} z+ylNJKqC%L7RJX)WGHJ8ek!kNqLE3nu%cG(w zB7#!HU^GKW{-~t-DUn?c%rh&{{(6oCkHr)Uv;fT+1%meb)e6wXX}zPm560#pc{e*Vc5qKC&#i z=bA!=3-q9S`hg<79*)?0Bw&%1DH?N))rRS8`hnBwLcC5bU(1@0)QAdFPM+xkjs+tG zSs2&ea-C(e0F<1rcv5qK4sq7Uvy<{#NiS2cm(_fl(e-djc?+oJ#{hPI#rZl*h8ZpQ zR62D)L&{0Srk8`qq&A7CXEQh6C`Dj8SrFOBA?CeN{I~1H!5yKhu*FgYQa`)O?9;^r z%&wmzZV%SU}AsF@0q=qXq+DTK{6$??2}hKXn$G}pG!R*fPK2Vo(2#&XmM5t zQ7zOT%O=(pQ{Q6z!*R}q*|o0sGvt=V*~S53g=rI`A%fDWyhBGL=TBv)@55f=Yvspd3N*O zI^MIl(5iOe0?z(AZrj-4P*RjQQzam; z16f)p-nZR4D{KoE!Z}nZ@2|NV$HSLwkek*>qxp=05%@!M!8OF3CbS>|rWhGP#OIMW z$hisqz;625LfUXRW-gRSn(2FQOa;}&kY8RrXY4;@-Vr3w*7VU*XkWBUcqEWg)Tdok z;AwZjO_#ZYL93bWq8H;)Z;?o@&^YKh_?JzlU)2pNvgYyhfb4Lv-!EVLBFH>(i8u(| zDxn>N8;5*yB9;e#O!`sha4ppd+N^d&-1^|O-k%L*noi^eXt{31 zjsgdYaFGMXKZfQ^K(fr6!}TW<;BE%y$)sDkUiR?h#Bqzi3mPcFe@odaH?e>H`a^-= zj-X$*;3~>6294d*<3wXNX=ZRzgc?&omMwq(x9VGr=Lz+Eb=EugVXJl@o!E{QcL|$z zdq{-MQq8~p^)q&o)~eJCI22D4_kipy=K++sNl6}Q0l~mHCQafZDB|p<_`M zYfdm^K+t-*MRp0qf>CHklLN*TIb5g(c|Oh=$K^>D$yQ4x2Y%<#yZa|1msUCMMJ90A z&OI6@m47Y#AkrJO%C1Xt$f8!mnll|ai~RuDj57CjltG2U@GE~;CSk#j%y0WjnE))j zCrkF&kc{t74z&WA~U0R$F0T-d)80~v&WW9pyIb6pi*Z(!AT$!j-&HXD$2iYM%`?^uL`FO zCHU=!3MvU5>D(HKUwE9a^;T)BUt3AYUTSu(<_T@;$Oo>EAXXS_exyw7Vdg&^MORV< zU`qL=lQi8-C6=63ng*=+ZX?Ip+*zE4S6!ZgNUaG8YO=i+E^lpuIRaMfa*A2p7T~Af zw+{L#FU27OBVnXG@;f$zDP3&$fWc|rL(G@Qe*1@w$6Ftvu)Uoiz>R}%bTTRe4!Bqg z$t|wpn#}pKG5WOZ(sgCaOu}RLBkgWaO*Q0&M@HNGFcwVyi&1~Kqfj34%tHk`1Drx2 zLTWNdl``cVx~h^4JY3b?0VehzR*hRm3q1({!ul=X;H(Zs>Jf*S{4kp?u)2eI-sp0( zU|sAx*QauIA`3ynXE`|PY};@~Y&}sUegCx^j6e4^XkHp6c@DDT`C*OHN*Bp6HUHPF zcGkC>q|SOYpt!7Yo49&aUi7D$ktWS`VJ%@vCv*F~UG4Oqi@d7I-wqOn7JRoTF;X)kSI#oh=lMY+FtQQ_Q?pFcx*wUZ=_cZ)%?7zDC_*$43nhd4f z0~YUgR!*nZ$o?rSohGA<6Cp@~B@ar7eCHi29rS7uVWN#&ym1soQMvGn1sKwC$&^v%qdwYLG5B;`}e z<#Jsm6>>nVx$9ZsPL4re)HEI=`ZgQEcPBPrHfAVV&88G`(_}h2iQvvR%jR zYa~Mo20!|di|Z19)oHzUl}bG$-)39=&^v4uoj3+%t-1T6ka4ETDpeHx@KaPswHtwE z4t}Y%DktN2v`0}a0=Z%tN6oBI=VDYhS2AlA<=<}HS39#VFwZ>%cMC(hXE>Wsvx@AQ zQSF|SGfDiO3TNB99xSr3LU!c`Pw=aTvrjA1ic%x!5I2eMzD89w<}+FX3g*@*737>} zm>XIBAFFdjy(&ac5I-!BXXqae-HkgJ#zmH#JE>86ZfjK9XUbczioUuz=A{(cqi!Th zmC7k17+Ij#q(!6krR)-y=S4&ymA~1K(r!bQYNc*$+XQsgqM&xX21%it&rHTF%2KN> zuIFlZy)f_I=R_k)Am`p{ms34QNF3dP7V<9kp0)-4L;+2@+Ry9V39b~JkO@o~L2JiP z(kee?ymoU>?ms2!$PSgKI9n;2j%69%5DL4U+=wKfkQ@%4s4wTs9G{RfYPYp$6nX;Z zbgJSZ^nt`W+Hjobm-XPcKgGlvYW1f2mRZX^--rj+%iHVDDtdsM)v!uo;mCNGW z=$X_gwrVFwuPNnXYZOv2llsT__urD|8$L~QS}tIe4DoA}#I<}&`dF(;Dnr0!LSYG< zBI*n?rS6$(q)#U2uLpG;L+w%SwYsv%b|?llYp}1m0j?s>2a}@1qTjQ7V#%%!;cM7n zlnV2Srm%34PzI`y(3=jP4E>;Rx52GyyqcvVPa02=Rj%q9FCedjM_KdfuRoE!qkNqO zQ6i6d;8wSWV8%x9GxG~ZH*(X3y3{ZN1IxLpSUmZCYZY7N3H#v@U|VZ^?%5yB2fN)q zHdMNyEeE%5LN8rmHsQBTa8mJ#dK}9T$iIp~HXfLNrZ`D`85_98Ip6aJw*nE@@pjDA_Dy0o*7Lh`eSmVUgHuhDi4ULKAzhto~-=Hc|u`#r*8z zI%1b|M@wL_FyNkY?EXN0eD?@=g|VrBKP|frXeD1kBOOJL+y%<1+8jpU)~_T&P|gZ| zBb6sntwKRtXfb8(`VT33TH?tI`GvyhUSgS(9SqB9@O>XY{IVDuk5$qz)ZGjp5Zb}< zQnUEebzeM)pbrQEumrcW8xFs_VJavq_o2#wE+SDhKvigTygRN7seAI;b0k|-Z`}|8 zw6&luWu(G>owAgw5J^C_UHi(C)V0oPj-JDOs)oL!_ip{H^j5UV&ra&w*IJ_$$8c&bN4a$Wzq9M4B=6W>faxI{%vXk`UdepcroCeM>%c z#*t=k}RCMefFU~99u)(K*2CkO@AHniTjhOYL1D8~IIUDUUO`;fDEE(j3uC%0?vli1Wxwni@ z(|GgMJA+Ej)c&OcPoKziTHG$_8@)RoI0?+A$}Bxr+fb2QvGAdb@6UFo%!!~mpHyni za%<$Ti7-~tT`P2GxIcr;Lg;fZx&41HF2Leg2!q^~I8fFrVQuStYM-EcIMd#Hg#q7p ziK|)jVmobmr17D6YE?G_+;GhB1!4}paP^D1eaXHAQ);&*0(&wHX&03!nK$((r3XUQ zv%;CP;>r2+?%E&mY-e$fsM<$ZXo2b~nHe+3s+!?Wc&e`8O#$fWd&c)G9py^5!M7QV z!`{Ha5bV2^;pfQxVrYL-z1(d3QfXk+x{wsstJ%Qkqz}n#o=s%&+#`n*=NqDz%s9%q zR0azG*SH=LoT{Tvec1_GMA{nTJb5X$B0qNCv62@mpb1+73*L^BCm9ST^o66wpo4mG zR0;o8)u$+ZDN%PeXFaI18yaG{ctE+D_e_ZvC}wj6pp}SS#43#`+Yarac-`3`dCq7$ zt7@s#=-S4nnIV28v(eJ&aHMLnq&%RZwsEegR&>N%vJ}fGEVeY&VsSU=Aup)dlGWqh z(&sKw2;r`CofUww&{V>7ks!1sawBeuD@-OC@nKCbHP9BX?h8XcX1-vwxHo#~ z>KANH`*D=~(N^F8Od<%{>~uIua;LX;`uiKnnGRzm#w7lbf3i``rIQ?FQ`Gebp;YUO zypE16Xawqc?>QCt){n$sGN6h7b5Ayz$}XyPTqHpo!P8i>&`sn;cjrr3vdE?=5AABl zvuU>%?`*PgN0o=Cv`s>Pzc?paYc^c@f*7Emt%D7*t=ud`DDnn ztB9#m-`msH{=HACq%-{lEwPo8VU7&5A zB&TIJzFAK9vowaC&Bt>**r(BoV}*&4Ov^r;&6=PjtB6`wjz<0Y=wW$cQyCJ?>3Dt4K z<)7K$Vj>*nWW1CkZxwd4X&HN8^7oX)XH=t9WlA$pm6~8;WvHs?Lj2_F;ZCkqpz-U< zZ$GdR3MpuX@v*1Q|Ge`YZepn~pONCQ?|4kZs9A0BYekRKzbq0r#n~mp*ZeuSU}weq z33I^oH1hmo@tE`bX2Mp^&Y;frnIQ{6A|iX@diQzp&A)lr9&=^^n$WTceb$ zc#0Ded|B_fkKg<#oN_735Tt#vc?em!QPYbWtsJZUat!pM@Spl1}QlzwMZ~b?= z&6^bRzeXlc79CW=$=_U7n__ux!i$eoKJNfoTM?kW$*N?p7Br|ZL0RWpZcT?%nwkKg zWXL3D9gs9v&Md}hvifP)`Fbf!pos}~8~0I)bKw`0e*kPUs7Q2e8$E!YkZC0@ihs$3X(92o?`zZ5q+%hIGRC6`rxCX1or{ot78#ZjuI;_KXY zhUMz9DIupFUnNWMUD&H7?iMJ7^`$mRi~yO=r2@3(qwzZzm*z0#_7Eko6&|3cMl(m> z%1rQHL+m(qR**Q#WzkGw55AedT09v#5Qlia+xsA&_tjN(XHCa+sVG;KUe)lP!uR!$ zXW{0w{!?(Tn@k)n8ts#-;iqu)>K#ols_Wto2gq1@Jk!$mLB5m~<*TjxXvL&so@D*|rUjA3jYLkQcQ3mL*yUbr+H{uG_yND$48P3?XhUM?gak z)U#Gn-Jj@(iS_p%b2Pb*9veGKD3ihY)d}nGdM1CbgN61HgFnZ%0l~43LhyJd@a7+D zxbmLU?*V}7#+3EwVtIek9L~e$(5t^Ewy#!Pzlh{1C{ibe(^0}5s0vgJn(4Z+|eNnvI2U4Y#et+r{^8hB*Z%e%H&!`ZoVB(>~qkvW4>0tvCtv>AP7`7%qg*iVctJMa4W;*Me?MaYn$GAFO!#V_A&Pch*Cgr_GDw z50Z%3b*;KAF`sYqX_Qc|-UKYX)=1V75N5X6D8(Gq{c%1bsGT;AfbDO}=Sn8Z6H6Wj zk-L2=GADk1>$l%(xu8dWkWG&EuO_+#2!$O|__E<89QBCk7VE;Ye(5TG-K)|aM$c($ z8%DxP`wDmU3GwwZ=qCwki3yGrY5Qp46sFaDCPiNao09!W`n=3NMtwmiwp8(~a_~a& zNJpYs=W|Fb#v^@R^$(7b{B%z2hErjj#)4)czGjb#rVuj`8hCV9w`cU>QV_Gs`Ve~i?!pkCzdb`#Ld zW8+!%9Lb|zo0or^nNgA9S}BWnG@(iNdd$7giIa+^k&d|r_~re=_$nK^(%%#VPW_yh zYh6^nQt1ekKAE>#Zs^a~C>x9^@1cG2jQ_0%Qo2cKrUiRfulfePlTC7#+n1)rq5ocx zA^9M95UZ9$<8V%7^^@eCO$ufVoo0{L5P2Ea29sGNx_3wUNTM2C_1G-vU`vy|vG*Q>@8^CRxICWl=MEAHEiBc|r>nXy#v zIIa>9cFGQ{i`v}}hrS8SQ1cz+mhRE=75+G!_SU&7@;Z#E?J4@&A7ov?VRY}pcfDw4 zH>EgJ^y-YgP^Gf!pZuq+kjQR1sB7Y?^XV(<-`3)vI&b@n%e!O6w_3#^F>mokFIJQB zelp}S+Jv7z3lVNmJ$Z(ps2=#mMZLK9(owXH2dVze31#TXg+0qWa`oPnc>+7;jy8C# z|LxF1VTR;Ve=L1LR7utwU&F0{+fnDcD>BZWG_F8nv4LoHCKf8!bh-6Vn^YI7F9b8u z-7Aco0hV2XVL9<_0h{y;P}1%$jGKU-u63ZHhlMwOB6Mh9kkzkPD9l4wj>U!2a7L?{ zS0ZpxU=-{~TOwXSeP1$Ttls3E0p$jdt$?B5yODn%%vG5qCcff^)MpqKv6mae7KX-2 z@Q1>ZKSts-iJ?3%6LGMWP>5Kke8(6tcEq&Qq{_Pu#k-4m&cxz1-f|URUI7k2L%XaN<|=A znD5Z<2{uLE4qly4xbn(u4<{CvMd&SCbvn+!iFb~P|NaZ0fKGKigvX@*TfAX2h^bS1 zkbPO+9~yBR`=Zd>cyVCfyDy4bKF`-n7|C`x!L>TyjX`WY;1uQ|L+Fn5JHDQj`S zg|FV`Ncu+5YdTJyM`b#y(fBQYp5sb@5nnb~q6=!E)oS1XI*j2Sfdm2LtAo*oO8qXm zy*es~OGQm#vr`LO$Zpa85VIw*G(50PkF-d!x+%<`-d3aujuq!8zvu2ab(}LK6XC9#vX;14m|R#sDB^2L;KN?H?MB}PiMtaxwZGY*rbHh*9Z0u{V!eHv-AR z@hw#7q~Y?THC2N*&=xN}j(otldSlrbx-4+}`k;QtxpCC`qH{#M^KAC&RMb-lO-pcl zK`j+s$SMsVap<^l)4{gsD1sl4Zg|o8Yp8TJ#kMi>$n`YLT${{0Mwf#8%R}x{WkVo?h7Av}X2( z!*c$kFGrcy4ZPBhM^cY0-z<}5NQYr?!%#2x4$vo_*C>tD*SaqAxZ;Uw|Kw}KWAPVTYF3RVuPh@~F_h(Ng;g%Y zQ2qFuC2Kin+7rs3w@dR_mpWX8CrPyUQo^Yi5vX3Rpf~guaV9@m3d`ltOG9)#l|F5C znNL()_|_^ew*(RF`mQLba0~Jn)u?J2%NO66O$~FIOSD8i0Ok9Hke4d&mrC(tTto@W zv%E@}KdkbioO&J~8QYpXt@JWGgO9XUprx1f+2bA6b(KqM<_Ys4MTr2DA zcb|v`4bw+@cLb8hlp^TH{my6SC+c(zk12^?%Y-PU=c5v#Ed1o;dTV&bJIZPB`#1r{ zF#h%&egA^}l#E7;tBs$f&Hv1eyoQX&NQ+r*<#jXzJHK5S>fPD{PMW*lmj6NooeKUP zv->D7U)75<*OQu?aPXvY%H$poJIVqMJ2tb`-d3xH!Aj@rr_PtAl#s6*oc~gnlCnG( z*F=yWB&b2900p0AWJX?-4%VW`sxVRc7N^zX>>^XgH4F2f3H^?@yt4BJ)Nw6E{a2E) z429mq{BGHCnr4$FnU9$H2{JN^F@(Me?k00(ZRl$P*-E8qS8lZ9`~|gPOW$v?B_dK+ zTF^E;NVvWMmeshrJ@nUJ?8mM7>8)44NR(S;`>mI2c!midsu7TLN=q&= zx9Wgp_H z`FesDeXdrQRN}Vo%oMAcy4t206$?gLoG01emMTy2h>q@WRo9-;{jW8qmKQ2}F1pSU z0_|T`KU4Yegt?ObFTTDyEXrk3m654y0_jM~Xw$9{Jd2)r^IiylV~SLyf4 zem{aqze*4s-&Cm0fCOIIgorx>-u-f!T3@R*8JQs?y4borK4 z?dvoEI_!~5IKMJB9Pz8_LH%N{9-#+7M!@MBeg4+ zy%l9D#4qU`KYV2D4eQdDS4LaE{4k%_I;?j04b?8ZzjmKKg-NETd1%g6+dvYW%2da- zG&BhCV<~=|?@Yz+Hh!-5cm3^>eT@=^&@F|h1dL1+Y-+}H7kXFUeVnR4OGF@@U$st^ zL>!mr@0+U7XgRv(|#B8O37Q(iy$@@s-F?oaE6HnO(G-6tXxj zUH#XKwbAUHrH8Ame#e9_zp@$#FAY3u&6*^XSK9fkTgZ^_*ptX!jUY6-?F&|tf2qW4 zen!B9ukeSw7#l*ziEI04+*2Wla|hk3VwXN9!}0xdaVs*_z7dv^Msz9S;2zi-?0d5Z$_`- zCY;*FS^kAu?OP?a{7oBNs3fp^2{Z?cv1J&OGQOT6;b<^&PeRgkL?u*`C&)BQ>59Ft zaZi8lSfH`d8oNEtVX%9e{Ih&FMa~RYz6fVXeCRxhX+7uh#QzxZ|wlg&&nI6Sd zw*^8NzFV|1Cg{?$Yw3G>vg4svpq`(JqnT>czar><{&X-EXp#?{vMWZvZ>Ym3db9(T zX3r-iyFaPY*#WP;8;?OD> zxrf$~)UHqSmOcA`c|n|9D0&(SqNUnF23-jOH3U~yiLof9L3&@&P&-IA z$5@oKzio`*oKA!i-!t1Q!N?n$pi3C3nNz(ndW?%`&~GpceoP^tp4)N~Qm-YZQ#UVa zUw`x(<&<`YH(SC`yJK@8apaC55J~RP`%L3r+#kE^xQ~Pt+}klPK>;W@)dr4fB}2MR z{4tOiP1z)(R8ZF>V01}c*(Y52Xl>q!y4{=VmjVpGj*}+5Qup9rdM5jZzuby=p}htX ztO(Y=NbtIOVL9-Z-rWNu*pYy*AYr7A>FWsrPTtiQu`=C|lKqI_E?l|=w(K4x%Gru8 zjgv>$B=VqF5(cw``EimujP`yZmYo@talT*X;wOSYkJhl*sy1z1)0V}>m7mg4Ag?dP zP!Rp1OmE{hugEnWJf^D0eA-X@wm+0Fu{K+mK|0_De%hn+=J#$e5!ITnC)*{{&lK7# zY0L}m?=k$}J)=1texNC8qIlh;7TsF5jz9A4+%S2+ZJk9N_vJ4P1E4=LCgPh_;Q0u= zfFw?U<%0VTH=3yY9c!ZDDO{n7S#?w?GPHC==JMuv9XD5c11mQJcaLr)Ljq$+cW(at zY8lKDChY2NcAItpley#}ARhG2J~p&0qbx-|f3%CYvHsUx`Y(DA(H&sm?08j`2Crp{aXe97vAM*-fj{bA^es_v>hZ#|3WG)jqxo!B+kHHe{1DVt6Tca&nyP_)#(Y>g_jN1hGnE%WB z{_B%O5ig@Spe~WkatbIVKA(w+Mt7ui#kWWMU;jf@^OvsDKcyqow*=|yP6)E`thubt z8+wKWFLi&@^}kP-f05W&2Ot4=IH;_Q|CinCFY6uh6B!XSK&K>P+L!hpZx^^}(eE^( zwPe;7jEtDTKipr4Qf+NJsLwL|{ge5QF@J091oK*Ki@ksKW4wd00tDQlbqvze5r9)( zF3AU{`|&a`Nc`{O9nl5`9}l&KSc{Rg#g=hs;B5OFNuU1BH{9e;1JGosn+fa(EbkQ| zx2E3zJ~(4wE_i{X-r09|yk8;e{x0hhKjz45VDy4e6YZ@KUec0I+<%p?5Vv6Y7)MY zO=}DgWgK8HcWsvfVJBqZEF)B#HmN5ZpknM-c*2*DwXEHj!e6;Im^9uJ`6z5}wo)#F zoIgTpvMBcN3($Yv-xFXYoxZq6D6Y5^2rV@@+obeoe8p}U4^r9cHY;&Bcu(8}$8!~8fj+^^&Jo}J1*gneoxN!T z!MKz>Gzhc-+IXlM+DuUR64G6l%1r#4fE(iHgc|ERGrhE4JbTHi}*K*JENv%Kb z$JC*JrDOebAS2Kpq-`N~p;l=PA_|18Il>H(k!v6@ zi)#!#@-j%a1kXez@Qm%r=X^gN?4UXy%#;hWa3PTVb$=Jk|ARY9jfYHb>bjb)6*<4w zXg=_wkg|vJ=Bfu=6U_^dQ7@?EPd_P1fN$uQJ@)5B)`kV$bp(|^TMkBXcmhr$H~%{0 z|Npgb)>|JOJWBd9EDfBTB4&#}t!@*mk#eC4tm{BqvG+T-O}0#Q=E<@jNVdfjUiAHe z$_u22zoZ{w$q(5Ok72dp>GSAkN_f;Y3D}d;f`AaKI7Wv6a#hI_oAI9m4^-GefOze# z&T;d*gTuNb05AT~`^wO9eUQFTvpA-Fwfo&{h57n%k90r47BmA`%H~T=Zez8Fi>evo z=<%BrZU^<2>yL|xLk>MC9@NE5!M{r8{(B{|m&XJa9r@QiFwD5OS!u4~1?t7G{4hj5^ydP$&tgU$-dX~mwg9S& zmP~UfTMVEy)9H_AW+3CWivx(8?{Y%oi&PnZ+#ya!%4n@GQut5i3dh#~nt806lCTC3 zWQpYnj%~9Mx;ve?1Vzjg-Z^a!$M;A_!~y5|UIUl&c+_ig%bR@N*H;inA5rJ`{iK*8P>ZoKS`V`3ke zHu7ejpI9I90|~PLaZ#Gu_0W?DB#-}nY~NsYIy7duD{FirzZ3b6TY2ytMVWHC`3U8K z>R!L%lX(RMXT{UQ*vcP2L|4cwqjNkRDf`4y#Kr@-ua*!EC3j$|yab%JH!+nWNLV9< zIDbDK$!ko1m6h)EYxko1!z8Eq*@NB*&)Z)^f}1e+!|NjdCcodl7tMwGF)$;734045TxSid zcpj_i_ddv~nXV4?a#T;-7jap>Ic@gQ)$TaJfNsgjQAcF2vVr}lt`OKBU&lNyDgwrE zx!_SMgxJbD>232>Rfqmsz3OoYHl+fUo^13nKS-4nzVpO0^n{gTsLK4ccKWAE)i+C$ zI%55_bw7b3}bn5&|NDs%yURzF7B7qGs{D46lYJF_Y?xA~YP! zwMW1a<{Q$}wxguGf|hc7AV4aaIfA*QNtK9ApV1W+8RTjoX8Na%cj;Rxgk&v7sQ$D+ z!Q1qvtOH#-OO7oXYqe*9U!!0~BAvOk?$(wM)=5yqUi%53i%+2=fykdloMSUkL?m z@F&$|e8hHij=wiy?(7J~1@7_fGBIg8G1Ec|R8W%|hi)J*#On2MZb-H>LiVo4RuA+u ze}&`^(2j_cZxFT~Gdm|(RM33`$zT)W`DXrNOoei41XJ0L7*L?xNb0@a>%qHnTxuQ| zi>BHaFAw*DYAbeVv@!gE+R1KTA5s|~2VOtZBWMNg{1@8$VGI)a{4g0KpEpWNLb-h1 z5;-j{=g~mZwJ+7>B0ou4sZ@Pr#|RE4Nf&yrxjkcW*+s_p}-3{m(Cm0YnjO>%3k8L$n=32TC%j^ zGyzCYMFa7=UZeaF_PFR2BgCfQ6e$iW(ke~Uhn`R7Du2l&#<|CJ+f(6RkNehz8Esjb z5LnGQ1{p&~mKFxfrl$v};)K{tKtkj9=WT%0;D!8_ha8wYuI-29f$~1KNMo3wDSpAyfdby;?}{50l!9)o(o< zcb$Y;*^cX#InY47v1%JFr^ZTv7L#k$4Sy8sgIMubwu8XDT<=9tIR355`mc$l8Z0`q z|A_pfnVJ$F`g;Rg<7=4|J5emG_0^9CXV^IU=lk>1Z^=2{f7My5v7OfpDWp=Aek|N70)CKWH$0aMj6x)7`&UVA%m(fZIdU-S&;_Bk(%f}-0 zNOBDDTn;es;D!yf#f+W`V663sc(QH&);cCQQZ~+dm5crCl^ITaM#{AB+5Qf(`*exH z1{diGP5KZZ0ns}t{6&8EURcy2zzc1F&aNW>*TOoSqdn8_F#|jDV4%SV^B-#QSzvZ0 z9#Uf;Q^pn~Hok}(p%7C?VCXh#NqRsR4lJ}(abq*x9O0*^5gO#)K^@6hGXc!0AAuHh z+ArOgS*dc$ff#GY&< zdgzzQ+mpFD&;}1ix@znElAV(<<7d$f@&+;bIXu`OvtVCi=81e?!FEs<@UYkM`~d^@ zO$VT|X@?{AWQy2-aU=ny+edVA_zPXJYZiTb7LZAbOf-@fuu3tXBbQhXSp#e$(&KwL z_K+_%WGkoEaCTP1XU;9l>@qD1qNd>0Vs!Cyv*}8)fnw1LC?S70{>dQ zO8berwzt#elVd+&j0Yx$O$krB52cW6*{8#$#iHZ%D^bcDQ!*lV841cYe-FGkNs8W% zC_dkGPNw69z<4EPAq>==VD`5*9nYq*;&G;kizAE$YJqb4$xD1#dBX4Vb@M0vvG#@X z^#42@{Og791Vhxv0ZYd4^19_bm8^+LDW^)ifEbbl7r=(0ysL6JqXKT0N;b3bPX^+PB2L-N> z+@(G+h*QZp&4QpVTff^`(zQzTnVg)(#97=o!3vRr=-B^Zxc+f(oEAS)ZD+ngj){%fjklYyb5NK3p%O(E?Zsp;g&fQeK}b*bh1FTNSVo&DBEKjiBf8056Al4Dc>_ zP{bNLv=g!FK7XYxWcsBQsG}bURDk9%LOxYM0}%R1{utT*$XPB3{CD^CK2G$*zMlOz zMm%9Oe;X;}CwvGrS0(o|l1l$8tQT_d$Mo1N34o6WTb6WW0y)2<46x#vA1$}5Hh#A4 z13(Dv(Jxqdp_Ytk*O!Ovz&wcoHbNa8UEv;)*Yd!J^BrR?>jz`lKb*7w{<3ev`pvlG z8rjx2>s1jq5`i6C19aPRJ?{Wxi=l#g`#--bK1{yao~`_;bKTyvqhJWY&(7)j3G=z@v zq^ykEQ-}_iXrwogGl}bGowZHk!{hirUe=MKA>3`sv>nh#EXjX*+%EQJRr8c-^7U#< z&WT#m%j>AemUB_v@?8}@2z{UY9U1#qSXA`G6PfapS^xIJbs!`zda2nX`3p%)8Uf;L zn+`CK;HLVmEX4Kj4chwNwvG5RsQsAL`Zp8{FthQoqZwcNmh$*X&i50NvWE(J@JlSo ze90%g?jMisXQcsGquAvCLK8XeFNN+?7o2>XAIy&a_2s)NiFBD;$1nu=EnEVES`;&I{Gh7rXqbC>-B8SkXa49-xpLCu+0%nTX>#&uk4&@AqiNxE?@^ zb~`VMA`(O97wi)cs?2kekj>7Mx6Fx}E9tKl^Sp!mf-6Fay;<*XDrdW0b`w}nfMj?E z&9Lq5Fdq?pSQ6c~7b*YHw z1eAX1^1*$6{VF5jynuUPp{9-=&XNvwWF$HK$7jHkrN#A18Pvb>tUD1leoVo#3HNho zZ~D)xqi-Dk>sqqkBo=)sVvjz*dS3GxI7>K`BRb=%+A9dqT5dlFr+6>H9p9~XKNQ>j zK%P6D@){oL8|?)J)DSeIV4p9)S+ko3B0E|j7z2Rf!0$M1y4BCx@MQ&Sr*r_&y6xTL zcgitnyl@<Dy=K?%-<|RZL--{2q|Dscz!h#fN;utJnuK@Q8(7jW zE6SnsJYrOt)vM=jqy;CoN)r11*w5(Y5{hQxUMhT-&5}x-;Q?o^gBW(C$|xBtICy~_ zi$+Q0Jnk`xz?&4xV#-LIsX*IOu9majn}xqm`F~D--?b;0df==tMLL`^H8b8Hxyb2J z3S>%Ds|#MeWR?NWvt|={3~L(I0fzY@l3#&y)eJ97U~OLEBQ!=_lVfb=Rb%qFATh}m zK)7nQ+Kp@BynD=e4Hyyi0-zB|$-wyX9jde4QdJ+Y?Jr?Vd5Y4w15~iJA>MliZ^(ib zXG6@Vo(PJQ3q8oY>D|&;zwe-SPtih_2fUHTWp9R3Gk})jRzeg3Xf(}XB`k}1=UJeZ zLq}Q>R{-Mb?)PYz_Pe8D?>`hNgPn+W8;g1X%P>f4_H(X$(psFFB34hMC*%EQgL4J+ z+63-*l3onhG06d*O$vtDG;4ja(f|(-GT(mF&QbaHwvGJi0VAdCgi8dU?@j}UcrSKf z;p7CjyZ>hEo>^@&NF;N%3vs?iR*bs8oGdJ6gCstj1ON9|lrGu|3*YlXI=SKo9VH>O z^pJ%{7YN@o**?{rfjq}EpRPp_W1oq}yfk_B!asnOc0Vp)lyum9nI;5yFgR|ISbkGI z`PJYI#9-S+1Aw(23FE84$0V89Bk~naJ&O6TbYFd^A?{pt=th#|+UW>57674T?QC}e zUH|&Tm!JIt8tH)P3Q$K3z1p2BiPvj%)*4uls?e;Zq7c%qum}x4oVw+)o+-;Cx*)CZel#A$xSz9q!8`$+kNRB(TE@LLW0JTmd)4|6;hSj>lFJWi z?k4p6ejqUQP;zY)4tvvY#C!j9)YVT%%f4m5Jg&-290N{ZC9_x)&APjCHX zfliw32PPn)m(F~$Ki&}lhaHFcH#=26w^kba-kj{Rk7Y?K4YcY$Yn7P%!f!G7S>_fY zVDUlhu8-kI?~#c_&Yq5CU#34!&b4i=+~#oVI^e1m(}*}r08VQ_M%m(veZfyr5fp;o zX{jp2MkC6crWNb&?=Z6ElQ^HKO7f5OC$KV$u-?CW=*h2kM-i(d*TI zjDHZ`%EmDgSiFCB{8!tBe_euAMX4iB_|ebHwg{fsH#%yMw%j3hcfQkvGU1r`Ujsma z42?!^3!g*gnhN?}45T%Fm}0&^6Ve(BK&k5MCwTRZMj}A3B7`Z|1U{d0`fSX*4b>3{ znfm^V@IVM35F6%}2;W5~acQ{g zQNhQEFwmF)k`!bg`S>Q z?@nk+p2@3${V<;H|L{g69gF_J-z4go0bOT|Dlj%$4t=L5O#4o~s6iv*aq+SKu*Jjt zj_jUmU=1L>6p+uZ!-);m*^&lnJvWM`HOjBcG^&+~3tjRGpL_-EZhJKhO2W7-^lCc8 zbif+=SxSq}*!`)iK_lYnTe&Q`#LUq%9r5!tn}tBL^JjYT5$- z9-yz>L^l#jXcV=ner#B^Wv$5&HzV^D0 zezL)>uD8v@S2FO@z%gc&lq+;*i|fWz?)`N_+^==^z+W3vzkP3H-;SPuC%5teAi^_a z#{ux0mcqO6J8^Io?}rISxN31O0UkLYBk!kXLx6?yqz1p#pfTdrDRHtMXbrx$8o7SL zEbtEK!Vp#?7Hez^9Rg8^ksUJ(>MD@}-JCYROI9?_1DWC$W7)^_j<2UOg-xY2_PTdI zx8Avzr$80s`Ajw67Pk}pR(kz<_e1ql_M&6u2|BZpw4oVMov=XU0l-lLwx^SAJO8-` zWCvuj#|X{+0E~u4``gfEYVB(CXB*#miBL0`L1 zw{NMsK^Cz}$dt0zBQ9==&C_#oxvrh&;b12X`!a3P?uMgtG(}zFU!FSQbNXt>j8DF8 z*vQ>W!H!RJvv#e&$ML^U81@x}4-;V!iP3)qFn;3)GMaP5yFyGtEs4>Ib4WBsgMC8B z$0x>!G<(~TcuBO&K*%jA-f;SE_nH0=ZfJ}tHF?+Jf(K1%Qo_eyA8Y;Sx3@<2=RFZi z8dYG;6S=*?seDOUXvczY{A^xf(Ny~;cL;@-9CMVd=yrt!+E*BQs-Uh#1N0XYzVG0W zBJPG!#q->w(tT#X;Zkgxo5+9q>4xC+6lipA`7y|{d zkpt18#Pw0vzNz&kefew0&AwvOi%<>J*-@UBawOw>kHhFb_U3Fh{zo#2YzEo(e`rn2 z$wK^mFL6xk9J^!-F`TdN8>)AIh0@cu4(vmPc8eTOsv1N{PS>=pi>B5eM6o+QgO9g^ ze1@^Ywt?j6mpBufd`mG$_4c&qPdGcc35cYjfLL;uaD#iJm3it|6mK)ibX0^~`pEnq zII`r6+_{{y`u&J_rI=E<w?H0-4c_QnVV$~6;wudp_0jA7e zE~czQ>VTx>pKybVAN2z9wm4YfOk=MD>cG&=RF^d%SXywWBMAP9Ww?2XSN~`8?Se;Mg$=Zl%{^OQ8Fo zx*&+=fl2ZW3$T59imi)QYuqJS6e#?isOeeb-pRoF$!FFf=SOVA>8@$7O`7UeMUx6N zM&b$Rq`rHb?`7F7-28c23cbc_u>TY4?%UL3mp)Z$#13@RE6Bw4)enL8QCwWL&E%B- ziDr^2##CRKtbk;E-%<2UGTRz4>oV=!dQaCU08Cj2+?BMbeizF#edSd4q@fa@EYL6y zVk-+Ivsw^sQ$^#=C_|H;0WdW__6v}8J=EjUgo`{1gHs<1H}Vkmt{8~Bq{x@!=&@|j+;-;2$47}cSv}Md&a^GdWHV}u7dbwoweW|!wB+m{#e@~#Vk3sF)8beFwg)_=C6(kC6uQ5=Z zAY8yR40QEaO2EQjrf=+!9(VuC_ah4L(_o86eeqLyPJsxRREYTu!-`w@`2%UD-3>e+MvBibi zmV(Sv3pZ;K>bbo&o+4M_oQ#L(CRFq9_%Gdc4!JIbU4_MFg>YeM#I}Ft_F6m+xoaKT z1C#l@%I+sKB`*SKN{~SXg}m&C&W(Es_6DDAt;16+dqGlXfh_}m={is<*PC1Zj*la`Yka%-;>%yoR{tp(!;18^c4?_=fu>BcSE(^?@rActmp+?L@2 zb-&Tu@~vclASeAWBSDJ_37=KeVm8a2MR`ih<W{5>?VB=JW73BfwtnkDy{#V~WF8jMqP*hck3!!|g|F|4fs}Th{H(^mG zx^22>*geabc7$T`4EMvO<(v5u{ljop94Oz4K#MA@pvsw79bDOs@{Ex+ZT3IF`i*a4 ziq8c;e5_;H@f9+T;Oq@umVNgz3olF|D*1BcI?RiP3W2i0Mz-=gP+&KixOey1kbSP> zx#;IAU!mnM0{T2c>Tmhi{2OUqlD>ig{Khzqj_M*BwEyyHlhPI!BI3?sAb^AaY1;U6 z_FjMQY`?a!FQeCQzgLp zU@bReW_r(`n@1mjj0iuF-2fypyIndn6xt%I;mF0zLj_5QGZM~g$^8adKDBM30gZ9+i0lYFny-PV)v9eK zf6T);H-X}8S~z@%%}eT>O-tB=-2p#nl^@gF=6=iGLkas5)5lT7(5@6@o3##C(>;zvj$zC#!J4daraE&~#l|>2j^==NffsdYSP2qj zqh7?Go+^Qn4zKa{SEwAbgt{>t0Wx0FOg*uq`2-jNCxA+byoQY$stz|>;jBB{3SW)( z3<3#Il2kN;W92V#h|;^kJAkz;XoC>(wWfV`UdkxlHGt#Ml20cXK^jiBgPjJ8>e<`? zyoRekzAU7waCf6}stUc}aA_YMx25aHFcbBN!nk$3TMqX!rFy(drdEYBYY*<=y;A|L z$;i$dqh(?0SE_4mFh+Xu^ZuZULg#!>g?tTeIZlPK(24xBoCTU}k3S4WA1y995ObIy z+y6l}YPt2+`;Gj5Z7QDmCY^f{-%s4DZmPWc)@hWBYHG@rL4 zwf?TdXUX)+bRdZIxv_udOXk8TaT`F_a%BuPq$JKX9A5o$dxG=!tOpfwnfU6rUnn^( zYYfg>P>~2JnKt@?D$f?`+#|wG0-dGtbmPFsfc*sKrVIRr4DdE321p+#8El5_4f>t@JpI2n%&vI5SMdb<2e4RD77#+O=x zxb`P!s7}ZUS@q|Ce6I;Ft0oXq*L562`5~-_S|28%nG>jw`0Q43WO~YxU9j1=Y_>!^ z?^EFfJ$|%T+Xqv{jrIL?jiq2K5<$b_UFN*fGlq3j1IAM?=oJz=-je$B{1V33T4lzY z^3`?sqQzXhfazGX`=ZI7Nqvp&E|1%hFUH&=JdkwLtd_XB~l za+YIS3YtxKlMYc`7%luMuj&Hkn=aPm<#BC>nfpavmmtcpHNzr>Zle0XDcLpN@_2Zl znZ7ppg{JrQ%&_{C-p|c3K;WWnfH_%lSgcnA@E^fe5FAm%UVkU1xRDW|+c+V_3_h7$ z3hL|JdYcVca*OW50eJ^XgS? ze)S$Y@zf-*nr6R$fqLs&jNIN8bTu5#18PHdjvqreqoEomi()0^CBKyE@e6uK$j}dA z_TnOb61AP13?X6xW6#wZSo_OsQG7I-x*lA$6c%zpnt0Om*k< z7@jxIB5JzlAnm>VZ&0)4O(zLz{b%(b}&9qBifHu4tk7A%Ovp#>sF! zJz6;u0lxGL!0Mm3R^^+=<>EAKr{~6(Ip3<{5AtDw2J<;{VB)0*J^Y;9Udw<#B60;&W+VRG%iZdrhqTO+@XdV*KSN)-NmcAp?pA zjmC*!@}Bylf`-d4A5D8AG+fk}KN467g<*tJ3VYe1AcF;qK(o5}rRhaR8@)ttglM}#e% zKy0uhY7|HWVDTfVxrt4&dv}ZRjrMsf)APiu;pQl^5Ex*bn@<*H{=Q|*Ib);50P@>( zU7q4D$mx*E{a`Zi)>RJwl-%j*p8bLUHRqsn3OfhvSkSM5;PrIt#3^z_exSxSp60jR zt8RCS!Hdg zI2(n(wDG`QFqh-y)sXAns5CmHzUp_iLGBir7?t-`hJKb?Nekk`?hkIF<3Bwp!^f_n zn4648l4S6^ktH1@T@7wq*K9pfv5C+inc=f#yD-b#`U zn1$5yCQ_QkFSe8G7|l+Kaeyk0^0$dovjYQVsu0BM*l;*2=1DWH`g;H zV5Y-qwi2V@^@MDi_(@I8U9`N{iYLtw%b_*?m2I5smpvv%W=;t_qw&Z=+7Dymo9c^h|v)Vr0W3Vi;gPA>Bpfx5?bjJsPyafBlgIX`=-ZksLgong12-qa7~UAv9EwJqIt{h!sRUn#^PrRJ?^9j|nKO;*4J0_$o? z1vHO95v>Y5cY<-O4YF6;Ffixv9fHaFl$4n5UTy4W#ttB8(4+5}OB&v4 zAF^WJ?2t+PXCNAn}W z14azyzUy^j;cDE>IV`WR~mqLmkJrNL|g|?l$>vI$TyO%;2Gpi?gE3Kz&f^yd$hvmti#%9qj zfPEyoBd%@Pgmf3gsdKnhNrxxgN%?7^boG4UbeQYpa}#(_oVWil-GfAw4_07y^+#6r z^a6L4eAhB)Zx>RhqR4;8M<+iUy9}`BYtKU~j3v@r%shVkf?E_}akEm_-x?sA6g@i~ zkuGtfQoKikXX&@$Rt>li5>H9={UvPne zz4fHxoCM)<)No7szRL@A#t`pS#;?*47jD{(*4kWE?|t7QmB6C%E9+CznB(N6*1SMy zQw;t1)D*qbrux#M1Hy8yu;0D&TovMM+lHFg1rwOej*t0zhVguqS5fFbN2$6MXg%{MaX1AGp?7z2 z=<=REC1(2iOMuv7t?~k#eeF?pcXa7<%l26R*yWGUEvW2x!0&75{UPnGU|xK&SX5t; znly0u&5@Yl7}nZSn*w+Ja2PK)l_n`N+dQ9!Q8T32XFdrO=7u0L_(7O=KhZv)xR{hj z1bQ6Q>$$2y7^+)DvL$gUZ@SJ&O_9eu#}$~hNtX11y};oj7io7sCsF^yS8f5sx9Z{1 zmXQ>JtsV&WYET7!M{ncu&FO@zX-NELhR4!e;r8WPN%M_CXGg&4uy7CMNtxH=RBN^C zKuOiGGnL3zTivhyagH8JQ$9Gku^(iq*X<}HaNh-W1^&ITv?9=akl<`p45nlGBgbxY z%#PPePHcA`W5*5~?s=t`2FE(!-4ei#1}zQRVmf*;xTasEG|UT18H_tm1d25t%<(C? zbSShovFdyL0B1q_QG4(%oufR?#VA1baA;<8RC^ONX>VLIq`eu@*zU!CqxqPEQ@a>8 z&nPC+L&?&7vSU*)AXsBZ*Rgw+wJUyG1dh(SA3DF|z5vBgGb(tDp8-mGVi9Vf-t#VvI-9}{@#d?>>Gu^j5 zeRn%a3jZH30O?etYYwiZftRbo?AGuukNQbrcR-&5HhTK}~V`4Rfqm1CUi;5!SQ*vv89>wTXG)$B&dCBPiMys$E?`-sCHy zMuUbXYoZpJCRNC1knrB?U1CFm68-v+RJDLWC5?&9svzBQ$03D6ow?nY35ka8NsD1( zV0*g$A@_<>9f`UNC9zvYQna_c)of|}Ho232cAX{~A+2XdXV2VOT->7k4Ef^H{V1g4^zoPCA|IUtu2h~F!#O5jRF zS)IpQj&(8Gnbm_Y7$NxC+E4w^Pe?|XadQ1O7LBMFxu=D3T}9hFa)>8?km1zj42eWe0IpZ_kx4u9 zr0pe1k@rc`&oq#{$QUjQO+fin&zCsIkBSRFl_2A&1IM?Y^i@C*eq+}D4v=S|2|Nrz~{%3;2R|gN3L2oCyB~FGRUV< zUPiXW+@bF}v*-N8ZJ_4SA7D|J?%@$cvWmjBaQ%h&hqO=c-S@j#AM;h#JDj-CNZ%ir z43}S|xZI)FlyE3&i+CZnrQ=gy?pK`Wm(nzGT;`XkM1>Z`Z(Vv58-0As*l>)`p~ky` zh@LBL%BVgBU-!?;%5p;R!1hLN+w0Tl&EFyiiO*&~6q4(CY)f1myXplSb|anp`uU@s zhP6aB_V(PL6_z&VW?P}p!?GkpC33DA7OSBmeSc(QRKfKZ3G7zR2_-5~s|a>O>=Y>9(v zo0wL%^Z8QM7DCFg02l3dyf?_NSM<$UG)%1;Ka0FRa~`*(4Iruo>WZsKxM z0tf4n?4r(pc+D9YdgjL#GZ=q5sNbA}&^h~9JJV;yuI_tMK#I?5@0Fl9{ye_uAmY!n zZp8Wd(o;s5A2$Tt-C8pkpi1fcTeYosEhD3Wp?jf@K@HE&V5nY%GM4&6M{RyJ$cT=H zo?oa4(Qg=9O$LF-SkC5pu)Np{sec?<|7(Rjj}(m>*=+@B>Y!E{>i5Bv;kVJ%xhq;a zv+-twN2uJL-X*a3<$;RD@~s*Jm*>eTzcB zn}w%9_H1H3$*9!q?)26{HhG=BT9^hg8SeXc@)Uh-;SKIH)d;y)*5YnO$8E?s1~OUC zoS8rH-r}o%tmzx#dD|yRY>>ysC^e%Xl(1neY0!1{GU=p>#GnpqlT@E?!{j?319j=m?RW|1~-LTLMSXAVby|h%nReU8GcN=OfNmb)rqk0=MjawdE&2_+YG!4qQ z&2H#(T^sEw+TTjUX}_^AEjX=MVW1hHcTJ9+ zlMa@HO^aeSd#Et-G)`_Uuv!7q786Nc!lw_Co19D-v*9>TU*|x3>0PgbdQRe8=djbL zJA~S%dEr)c&eM72NxDQ@O1rt!X9T_#YfKr?x{tFb3R=-!Gp2j#g!|@(G_j)O0vuA* zwb2r!=0RDvS9yESnV{HppBOj6v0J zK?a#n5HKUOQ>9L#QVmr;LSZnIP}C^Ue&^1V(Y;_g5&}8%)N*D=0c*2+7uyAJZZesH zeK`R~vWzJeaYbbt#1C&uD^P{2_8Rm{+AJdO)0A$|Smp-`!y;{6Ezg0?wKZ*$vlm5? z^`gxaBXwfl-C3&<2YuCvu899f*jI-|xvt$SAt)j!3epWCr63^PAYIbk(h>s~vopbiyzrW_1x!!r>srR|pz3#OFYT>I9b*X*> z7lt&{m*PeX?^2N1c&js~-(dGPH7YXroLZVA+fF4pC+!C-x0vTvZKe<~yz!o032DZt zR7rl&X15Px+{S?dN8^v#2d1V2nAjHLOF2XV?l}be-AwPXNX{7s$3UDTp^y!}M}Rp@ z%P~qd?t?vB?2z!Tk1LM&EcIql2j)hTQYhQ|Jj15^xchyFJ@n*))WtilDa*T^F7g8GLi}ajXl~ z?ME2jxy(^dD$hJbTL~2C@R8UGz_C`&U%GO<%R%H`52td?yHmNVxyP2#BHVUdqd0ut z(L2qa3gvz-*!bMD-H33iR!vIGYO!J)^RLMi3!SzPohw-WXIqMk2C z^Ab5mC=30C)>-6>w*4pnyHFtU0}jhCyoyDhKfsz~$Iww1_maZJn&iWn4RaoQ3z&e? z_cyrv4u!pNyx7~gXvI94QKI1s(mb+?P!fa2{^&xDZ5|}G;*)a-K<;*6gpqrr#OlyW z6kr;Po@$e;z$VuvynC}1&bgm!UzD3KFMS}`;o)e0)f~%|x9kDb01xn>X;Brb#RmCR zy4uqNU+cJGV&^02o1_u7i=HE%udV9bWO|itp)TTHc#ZSH*jlz^F8gE6#W7 zvvs8c?TnA;<|JcU)4U<*y!(uomGdM}D}bcmyq55Fx_Y@oP)#PS%@$*mjF#2(z#95aty(gU zd%o3J-jEFGEqT3xS#sD)#Xm0m#u(n2{roCqU$d9BhiHQAVY0-bpp+7mWBVBOVwffw z!-T1=;ev#*f4MO%ATc;kO2i@9#PGZ9^iLky%>~yX;gwBRP7Px?OxMulM`wAn_fge8 zMvsm$yLlyG!`?&CaGN#nF65zNU2hJB?;uZrS1iHTwoV@)tzVYmGa6pUdE51akIw7^ za)I&gHz+!yKA(&HWj@kb$EGViS6BcA?iR^J_CCNwuyfg`R3wjFA8zo?c{VPIt%onDgg&?H<;XzU$r()V>>0d`9oXd zBSFqTE7r0G29|0i&%OJ-;=EGJWBfTiHWRW68s=Z9RB~A>at)EX>S)%FfHs31sn;b_ zzp57uPHGV>Q}L(z_8OR6aUa`Y9#MO(e_g$YK}Tuu%x)Rv+mGE5>1SmKMX#n?%#_x@ zf-RXSHKO%bXXcv^Ci$k#?aJf4`1$#@9?Wt3lRS+`=<+yCcXE$a77*R5k0|~m@;utD z)2dG7i030TKzdjI><;#?K$4xfZ%Wx#kN_Je(DIU9IkI#2DRI#uIEa$GTY4?qTC1~v ztR959m3b(R0gm1HC}^Jkdi8txle}}UbOUcvZJl{D(~FQzNq!9En%$-z4!WfIlta0! znKIjx%ZaM;%D6;p7J_NIEKw4BUF^;BLe`V}j)6=x6{ES^z#YkoyzJKdRgbHPU8od{ z=8b;%zjQEd#uRmv^3XSS^-s1*J}R8dbnrDVE%2N4pn5U#;LxNQy*KBf$l3W~TbdV% z1uN{9;yk2(e}Oa@4z<=3Jt*-DIzyrQGD|2>d)fX44UrO)QGz=b1bAHMHEAuulG$fY zjHtr+1uKm6%2NRaauM{Yxp!lr@9owgFWmJIyZEcKMVzL0I9CYg{Pt-9$u1poQ0xz; z$RQ;8XT$k*`tr##B&;&cz}b)w|mt! zA^Mo4gYP|7od3Gxq7wV#f#q+Q^_b)b7l-7F_LM(7SC}5L!uSrYHZd7JL?$9XL3BH# znUX@V*edtBx+BS3K=m_zI2$9&2STES0F@zPZm;qo1>e5rVMs-kUUGn-1yR}E3W1Ld zAMOW91yZzM-a30SF1ntw{Zomld~~ObgW*?3nel=js`8OoJhO^=JtmyAQZg&hB0lM2 zSPK?{74RNXZK%(0Y)sIV_81J{ea?3Kv#vu$!3S^X`G47m@h%gkr|X4@7{RY19N~u6 zAIZ2Ng*#QjmMbHnP_t-(sD$@vIzn+yMPZ`qhGk<8H`(Dl-d)Gd}y8 zVqNYNO|xqyN~b3iE=OO22zb@Q;Y*eGe1Pn;;>iFXTxmJskdnvNE$y``U4D84S=;jz zl<{+x=xB#9u`_s2B~af(s@%jCUCX|l(DLpZc|zrH6M_zmIa$`bZWsH^zjQu|wK1ar zv&HY1fvo9#ZW-`e{A!uakjT&2Q8DIY6AeBeACaHFkcO8gwzn(YKYAg1$LG4#aU4`P zAijjVerNyq#{s9#Wj{R|<;gJrEjgEfh71$oss*LB@?GySOANIPwg1qruBuEepkbDEA8({+D=v} zORp@yjI08AilkAfYef{_VaT32n`!f>1(VqyCgON6-w1dS`d#do`^wJ|f(_j+U{eUC zIffl>%9HXba)N$mTy`IF?vv1U{X0Ox%!{&N%968<8PbSDhk)E@kW6S)UD;q`b=(5*>`?xrmZjOXKiJH#~8r0nFf zth`yNjVVT_i&sti`DbwF^vPx?-L40%$2PXdn{khMaNqpm2cM7?OAVpvSxLj=rmN}V zPyTmZoep9L4?Ger5M;^3_NX&>ZG9*jd+qm~9qJpi$n#8vq3WR(KhTt_HXLIhuis0BNh#6d~+0D-9RNy*3g^dcQoP4!4>FV1oDxjx~Iu7@wU8O(1@=7l@HNwM@DgX*dA zbtCEn7hKPh_nXt>W)}N`-h}D%rmk!kX1g`Pj*j)?;x)P^@jCl^S24ENOrIiuYa9C( z5`6YbnW5~qoSg4p7?X=zC)49WFVuXWL*`=8%4`XCuEl)sNT)T1L+o zVpP)#jU)JG80utk5tRyQ(KhcTl&P#Xl`-mZsNP{ZNHeYEoG`=ZNlr1oaa1ga4Wc(> zg!39HP(*P8VBM&d+$*k40UE?$GY?E8MD2tR@=V8M8N2_TsMkYT;RIQK3>V0^>{CxN z3vx7V?z`-0cGd(09y$w$ba59x-oXQYPxQ0+_%kBUu_oT7CLM=Jhc}mxV27nEr3r`% zS9ThA>wNm}9_D;bMr1TW6h0U%r5)38!}ewT&g_6RguFoH%j+Lglh~-2N$U#J*ditL z?PD#0t1Od+kmxV4XVDZu@u`mbiM{V9pTh#mgj~l}3<#ktc&S^~`>vmIW0?MoYk)xO zeM28#SK;9Rck8m|6~s>_|9;l#B?oC^&LN*es91J(4mrO_A@OcWs7|M(m6g7CY%s;9 z)pETODC(eM$RGKpPleC;`ZX#9Q;H6>e2i&)yuO)|%k0vvkcs71S7$?E{Pj|$ng=>RjQ-Q9+-c+?i&+4RZL%Q!~Z1Hp>3KE8A!FcEC+ zLz>rDi&^90uA4H-F8I#PuO*ZZ$onB;)_#I9vgfUzQ9fb0B8^%nawR=j6@3N^?~2Xs zQve34JF{o$J~ zW;eCwLWY4dSEm=-ci8x{Ee8iws3hv#mgG)^49Xqf8`1>4{W8b!Xsw~V%%GPx2nb?? zxFze{1Mu6BMyZY*+2p#Lzo(sCpaCbX19q#Ry0adY%qvUEHM~&$1cO=qlG>@-AUh3j*umqa1Ep}Z<#9yh(Uw% zESJ`+Sbj2-Dw43~VwFwR=4%+XAeHCZp*tDYV*?R?aEL`y0V4=i6-BxITM~M) z;!T=7FmnFH{@HGW^<-j`jGwyJYAtYtevwoZ3IW(0lG}Gn0>t4an~}{hVpRLs5NSXJ zsIaeZe4tM+WR?>}1Md>&igfLb2|YvMnMk1RtAsdagpPP)Ls8wdQ4L`St^Cx}nfF&1 zMW&d`nD^JS*dY|<*~dg{PgRp%_0p54`cUAZtm2hOMS4E4i5L|WKrig=%9Hn-C=7XJ z4-vFdDz#am>*p)+(Uv&1EzOHR@Ytylc$;HQ4X!iW+iKg}0ZK*P?t zwD!3Jr~zx9u|fRm2G!6*^cC&gd4kBkOIG$PfXwCl+mhc)*KJ84b>~vf$BKqSmk&`m zv#c%cv5Dc0aR$~ck2ni=ZR&<8o;)(i>~9bD@ri2#iIrRIc{OdPLSh{oEH^Zk?iyup zB&-)(7-l7v%=8JkcgvaWZp-(caJ8fPAyA)QZ~i_)<3Dz`U|cM8299(_i6mB_k5Qf?MI&(6Z$b3gJ0oh!^p1+9a)Q= zEE_B*qlb)3@GH|ev|BP-di_+X(22Svmes%GjGL0L1vjQpUKFwt>Y)|}s9EH3Zr>hq zrSgkQj}JPNZ5Ifq@n;zZ|;f!2YO2dA4^`#)`K&%vg8oqE{_RRTb?P6$rz7Zmg=;rk-3tM-SsI zQM~FMO@_x^mV9YosjNd-!=IaB-n7^+2q7@{mN$2Qj84;J<0+_oqzY)g6LO1>P+a6% z7zM^8#~8@~jyolxX=UBVV$SunoWJ|UKj7@^k}aK>|8h$JeNth}$ix2=Sp1Zw>0ZN! zMdO*{jqPSWkr|LE_%rDEpV*`J)2%%7IQwJmb+~Oltxq$(SoShKT=KAy9?-k^BRu(^ z51vQ>RJ9`;i6Qx4041OmhIO0Gcy1GIoa6Ex8bXNs1B`#0)a-xn;O4*gq-f5SpJNk; zxBvSY|N7e(6JW4#Jk5TCf5Soew_EtHZ#wul0}FpR=gq&4EB++bG}uz~M!My{j=Z_& z+F-HS^fGn}$(`PthPK3&_WIY~u5Sgb$QWIVDL($2OKOn^K==$D)^ip`rD%950Bs_f z{eNBIp2UZOzKiZIjnzQaPc?sg(fEH|w1@^+XN$hP?LJ`Buj>yhjZB<1dw3N5Dt=vm z?3XHmsd-03j7qRX0o8Ke+d}nV<#N?$f9CuCPm7D0EKAZrK1Y@h;YmgW`EcBC-Xj1# zQ)k!~?zsEQ|JjbQ=Il&{fmr;S9a(zbmj4sguUlS{G@bokK{qJZ-?Zq_XR%Wsqb|w{ zKyj#q$Lwo5DUH@aUv|IXUO~3S#p%9PBr*xwbBKR58-61t)C~v*aRPQ|&Hd?u+DwWm zCQ3}r{?}Jrpv`ffkO5#@VlkM(PyRe_r0g%7AH}uWB+7 zw*g3Ulyk{!x=UuLC^X{aK02SCRTQj~FqqD#QU*P<1(1*Oe85f?Ww_AdvcX7_u2b>) z`oh&>r90MLi4qXA82qH-ccc;Xih$3+zxi-uY=)!x8lt0%&by!dWQnE*VBxG=JYn1wO0oTZ!58rRhUqjle)7D&EK{$xQmUQ~9%qF4$5~iK zlBLT5e3Mf9ksN7lTLe<7uuooM(Iwu7Y7Gq;&anzwdZ3d8HVv6y0O1S?(EBxt zSwj5L;}?K|isf!|8c-7c;DuR26Ch8TFyHJ2XaY2*g%Ez%xpfU#$8H{*x*O>}BH=Vj zkQKS+cg$D}`GM@SH;TKTDePU>lgklUAntYz1duY5kD}Q|PucWpy35vzyd#|TNb(xs zwI*#Cq%TZ9^bdd(Vj23a2QzHAgdac?Iv%B>@~(j-rqtR*sCR_Z`QgJ&)ET>^Bh_Gm zN;U_8WLe$D7Xd_ul6p0ZJb88VP{N9uDDa|+=)I&>$J^Tt%XL^TX^YNTIMDcsxjO=H z%M7G@6IjgA?;`XqRnmEtn3OZ#?fb+ge_)%wopp5!1Nwg!)xT;ke9C}d@844%RS=~C zT9;5=ZURa!sUpo{D~5GIs*BcRc0@)1xCDlHl?{rCpy=wH73Am6O3km%qK!xhciiWc8R}f*&`t5+v=h2+7 z3klwtl5cDZ?A2$iZ@<$(&O8C?pHi0`AcsB&)X1ay%40q~VI>Rjg6X}Z9;wRrIkWK~ z6?89oTW%!TH%|*ljo*-idSBE^`6*k%7PftBxg1MTeDTS~e!2}UCs}WcjRt(U7Dm36 z4$Bw>3yoFgQn>AjZ}Kjaljfwnva4$}DCT%WV-Gl@6VoSBdoKDF)+-4^(MkGwQsIwe zmdrr2vf&%W~J&!)rv`=H$&S_n|C9=lWgc-_?SigEr-Td z8n46iYmfa7nb!-TwM;F7mal*ohd=-B#lb*uR|IDhO}f_XxX&B^nZ{_L%YN?BufE<> z9lR49;DDmXVPi01l968<-%U(Y%k092@XpGBn z?({F+6^j{v<}vR9M2Hm&Y@B>GQQh7cZt98@C5GNhFSe`h86gs-eQ@ zWju=vy{Snp7Z1UK89=&8sA@9(#&R%~HKIUJ#2gi?4b%_U22$DOu`#$`p5cFf>QwH? zMCG+k%NXdyGe_;YCq4yEHq0|@6lA{ykhj<&(R0Naw~|@6F(oePyU1mg*J=+0)@h2% zfJ$fi(c`#eK!^>{8D!Bt515@Q%M{vQiC2GH31s$U5sQ)!lDu~voQP+X+#MLscN)uI z!RzWBW|Rjnc1c|jiQ1_~j{NsSOrTv<-rbi)LwG}?oY5l3kXi(=ygg=X5Kee&U*R@y z8cNAFgbz1nCJ;r1A*77}J)p$*B4U92k7c^x)oxYaN<@}$BB7{`96G@Oguc#O(_VO5 zcAC&>HdmUN*v02TO}NIK=@xgy2&9I!;nXJWcfv?AyubN~E?O6sVxd!BnwP+6*69E4 zJ=S_ADdvQ}COZ@{zLvdtY4U`LLFROVOv)4!8qHeyoZ)4=y6)YpneNj)Y+fhx*2Wv~ z`s|LAtr5xN5j%H@69%EYU@cMsW6mtmJy1l79G`5_0UkKz#xHB zH}ct;NwKfR^yute9ge9mg(7q0hb2OY-Ye`+7ngVY*)ra56Okx|0%F4)!d^aBC|(POx&6=)uSTQ)|jL!Sg&v@8|b^`AA~__zB_M=E0hjL-cpQnf))sa|cu zGnfR^^Hdd2WNCfgvMVR){{4~WL_HA?^+$eL4G;fBTK;=af+V<|kCQ;(efnKMS8n5| zz-pWV_X7D4w{H#fD|pAuG~J=@VRye;!^k3m=miZ>mKkbOIp;ppL!K#^&Kd?3Ue1+d z$fbz-XFbZ7L{xTB#dkyyD^xDo1l9wV&01yeM$7I&>)YG3BvxLOesvV6=yc~wcflj(=#KAr zuB4065}Ev6gxdEs)~6t8UguG+B%pxWe}n@r(kisAGMN9CuJy_#^Hp-S{ggUK^_?Nf z#*yg7b~mfrC=|Vf5k^a8SM<4ImhUPc$@Go=V09poX)`Y91E<5;Co$d8*lkoYy8>zI zPD6aT{glh3%wQXJgl%AQ`P)Ju(at-u^k?|}-*1sgVT=P3jtSu$peakq?5tl$s53^$ zZ#;+ zc+1ofK;MhlILGrY|6*&<3ZO1INH1bYObWaYiljCk_2HQ+o=RV`z-QbA1w&5{FJiLI zWun#LkE`?4^LvSRZS?J-`RFteF;LJu#)^kDNfVlGM54SCtT|epSe!qhYlw`FX*rW9 z*KzF5BfeQc6gi!A19=wfQFB(zRT5nv3tQ!{5@2`JQ+sY?*E%k`)u@Jt9ohIHtnGm_|MoOG3wirPpsBm%Wg z^?RA{C$6;Gx+!q&O>py4+wn`(f}#9`86SO*=Vb?lkZi6bZQp#bX2rJ}kd7$WwIPSM zoq!`J?kPdb`Hr{6Vrzhm+tP!;fwNzV(W=UqJfergLGq7OUeN&?vo;rmrgo}|#c2FT z7Dvtp!dvfabNps`*Cew=$7NqdEVXT}r3@VVop1B81|eKzkGOr86 zw7*~@${1H#W#%ZiTkM)*sUJ`p(~k3#|>(Ces)B zE_1QzeVA*GtS8wTDp`>C-r%L2?fm6b&`KwVx#cMY+MuGD=BYJpS{q1S#BNljcz5U3 zP^DgAjw;O_rz{OyHryHKY^l1m;nzD=fA1*;KFW_49Z#?(D+PC(s%_fufU&xV*xe3V zjhelBKyX7=z`HL#7>~F&$u{37@=^N7d-7lEUgrfr?9gF}rsB~9L}2U=Ufvhq1fB7d zp90EZm@bpL)@j}k3_i^Iol~mIvIF#`RXZEspZMz5$kG8}soc&;1n}al_8P8s-)7&M zg;n&Hy{(KhCYu6OU)B^qVSq}t?hw> zUY9^)J6<}57{8wU#-?2|u89W3@{S(FTiVGj{U&}7-nB=zv!i`Jy zc=)w@jsP}+b{TZXi++07fARL*v&vex-K+2fPVIREzuEW8ky;d0Y4~_|qiBg2cQgd5 zIZ(fOv4rm0>%F$xdWs&}C@6m7CG1@>yuVRUt8(B$Z-%}62e9`SQ-lno>AhiLk*n0`vlQeM@7#jo%YZ z9PaTh8iT+26%`_Q$nQRSCfkxHRCafVEXb8Dls0Fsi^rL2^oVofEZNB=Wt^GFd|G@4 zFj+NeDUOw#J>B;&DwFOH0$N$@r2L_x-c-P>fG#I3SM zB}0Bxx7Os9#R9#*q34GI47*xa9S=4CK-rwbh89z4Ym& zhsk9=XUta&r&BMpc*v4-QZ0G~6}zKk$Y97>#LSm)yVfHXB&(TOuX|Wr4u21mIu5O4BiMbX|RVi!6X-- zBwX))dy*ikG1QOrSLfB3oQ4d3Gp>V76sAXFM?98untp@6Q3FSut*hl)6lY{Sp~5PO zy7*yqhXTM8wwfQGVgL6tRqWH=Li>D=8&dl0WAq#@!l$?+P@SbKvV6DZJDD`W)0YZ6 zn`fcpY{rUZLN0hyMKT*0yUUphr^j#`mmhYpzE&hsA-~GTqe$+fFtu~M6DU_U9rXkb0EBMNxm zSjjtL7*yrEZxTy)3bJ~VRHibHQcy`6VCw5*924TGF1skJPCSBGT%r?)KA%+iYey^c z`#GRm!~CJUr3}cu*F)DH(K<%vBSKz>PobN=to{Cc#J>Qe3=IzkVZM7y=v^~n^uG|f z|BJi)&$K!U{y_RfaDmQ-Xc>%`^hS-*RpIfRl*v$iNf9fNETQJyA{yfGXI-Yw6O#`|`pZRdxMUC$$={&RMD`qR8u7O_U<(-<(bt!aR&lr6wbo?kzZ{4#@cG3-=vCWX~(56v+ z2f$g-VYiMVmZbApYdSlJ{*=A*b>3D{uYNoT!W!AR$$5SR z7wr30X`Y|w$OJY=POk1?W=>l8PE9{`{=0yv!WLJI@1Qb9fz8RV`ZLAYm!`K`eQOT7e9sL5QVREgC=JSw&_G?dATYuy*%oxOyh z}WoEq*IyJrQ;NRows)@gA7f~gI%15m^J0c4xe8PPawB|)C< zua=(vcPHN9H;*~6G9VpKI>T}79edd|{f8hwy7^YBhVXcRpwpN8r-k1d=AEb%mW~NC zbV_rQE4J*8nq-!G6&gNLJ@BM^9Ib$8@GX{)dNkBsTNNa3n~~4| zfhzs6j4v8Tf0!>TC%lL|Wqkc%vO={q5%1nkNUp(#8J9}WLSZ$ro_k4*@G~A0)8j2^ z^>W+0f-0`qHpNJG*2Ea-0dWC$VJiwMl11BccVZmFyZ53d29sPfkGr}Ok4)+7-I0M0Wn=1xaq-Y&^-{@M1DEsHNoBwFh)Hv^9yu`2N0f25f6 z>YFaj-Sg7iS^J&3-{!NajL1KL$KStoa?&4sZp~r%4e~i9jVX1^K)m5ut$FnsBwW;>2ymP?=4jYMPd~6>oGJs z>Z@IiM`AS|XT@mqtsx>5vIy45EF-#eg_-+4Zs1LPaUdcUvZ^yUnp2!|EqK*)U)N7@ z>^Z76blIXegRx3sPD#m`x$hdxDj`8ru}X-WJ!JQwFXr)IkG6jWtg77)pM53nb!fO` z!S_#Lsvd`-KBh(_!%FWHU6N?5CytHj$eUjp$jwi&@`LiX_03m)25?VQ>E`8aj{QC?&6ldA3p9^RxHnT^#1B3m6Gf;@ zI2_hUqmD@Rd$l$(rwzS$r&{7D&d+v7E1elxG$s0M5aJ>vsDS#|B9fH@nd$wJt-l_G zH)D}k2J5QYU&#hKV@B^s@?CUIR`h8>y93$XHx>jslteV3_^Whb;e&N7w~2d(^r zIqS@o!xGC?Ktqq&N1U%z#~^K@++w71#DpyKl*8xdO?P_6@ao>*AppSr>nPxkzpY9p zxShV5Bi+^06s(Z{U5|=$Lg~(2*8vx!rvj_9kjmZ7xQ@}h@+Z$1`|iGrvXp<4SSp`r zM9WuI8N<|Um8cH3aU4;^njFR>$@dj8-&Wk?a{p@V zhZ+D(N<_9Y0Z#S@`v%{i45;ukty!fzB%Qo{4)b|PeKRMBZ)Z&p0!V#t0z3JE>zo92 z?O(j$32`s*v3?N}vab0A#r1SdJa2ecMjqvJQ2O`rHfUUugwR| zNCh0r#utj35;XcYE4+*(zl5gLhKT8il=HlkeE(OC@aMoXmHi^+eB`PYCXq>IqfM#& zIya4I_z6hz=eHTnR}Mj*98#IYMJo|vztarSMWlECX|e~jhD3jWVymt4!@XsVf`EO* zfh7GmZtfMt=XkL%do+YeL%{`{67hdt`mb&)lH&Hs-Aw#Dr>lAX>-Jze4#H=OxE~R& zrkjz&jQBdO@l~gvL$^w*Gm>2U z9s38Mf}IVh59e6|E9r^}?hAo7A8#zcuJx)*jD{p%6%qX7Nwx5Rr_si%^VjO`85+rz z?Mt=3(w2!Pv&0bg)6A39<1}h|&H6h$BhbQ9VTd@CiYl9B2<2>^$)Ech=tVb4L{tg^pRwjzViAIH+m_I6x*h|kyd9X3=a zMne9*ZT{n%iR4Wd^XS)4K>8+DInyW!2nb87h?PCnS35|Ib=rbI#%Dr4yyqjNT6^+7 zlYMTP>%dz`c9aXrsm>t$(H36DPVIM53FOo|imP&y*XT6rtPh3I`Q9y>!dCIxfL|4h zW|3PKZh7B99FP)VfxQ~i2K*8F0BzQnh1yPnoK{^HQ%@c((f#9a`1R%{r%37Xs-3ZY z1<>JL8QYo5*ROXR-41eeR}$Lr0hHKlFi0ERHq;|rLCne-&u$VlK#BsFgA+G_nOdtm z51i50uAU~uZ9Ql}o7wQJ8c2R9FvD;TDe{x1Zp8dwMGuw0fE1Q`vll4f^EaU*LaY81 z(;bfQKbON~NeGBKqw9To+*A(e5t*k@8h0epNm{mqQ~b{>#{@V7~3A^wwv@zhAr_=%9E$p&&LZh~#$B<@1iyik-gEvXWwoc6s3Q^0g;_AvXs|?Nc)IxyN@@BHt z{w0vJp5aOA&htO~jU#_JZ{t8J;P&0Vehw()Od^d{3{aC-<+B-G;nWc>Ih}RsW4D^{ z*>diZTb7CZ9fh!A9KS*R8PVkrOTI>npl~-XR%e(n`}W*FE!1p`<>~A%$$VNEKfAMW za!GKb`=B~1IAU7wtQxmZmNU#4a zAImeY2|=Nr(Tctga&=CsBT;bPoN=FVKxi?>`J)jeeerHnvD8}G?$_-Gac_&>%8~Io zviX0@vMmB{Xh27AnI0`>t(O8O@!7?Kt6gyT*oiAl0a z^MdYLjx)?-a!~aTNIJGxm`V;aH&_ll~Z8m1hFaTSP|8G_Lvou*ewizFn=i3`UN5}X@%Ym z4{f|YQZj6o!56GQwna#PB32`{xt>Uhxxk3GI8T-|-AD8$6NMQE!nK=aKn}9gB;34R z(yn~66kHY+HSe6)?}6Kj^lCTdDTXRhfYDwin+D~{uWBed`gj1lKsoa{zWeM*?-F;~ zDcxD&mmR+M1XTdPK>_Ya-6QO=z)m^N-VIdce<9u&VDkrJr@vkS{%16j|1048IX`bf z#Hc+%DRZM2dVnlfxV&>TQRNx%s4+iJZj1?4)Zl(&uB6*LsFB?RuqBwyXa(Za4_PGb z9jOd1+3RQJ0Uv^|SckV)&4N7HVwj5-mY!=Cb=TO8p?EP5xd^M|B($Z;0`8+P=IR&Z z%Z(P^6ex4DZW#0$_${WV@e)2mYQc$Pz47-Id?B~n7^Q*a^uZzNx3U*5E}J^;DDd34 z?BeFJb1sOy?8g^lv#>ynn#Xu&J29L3+3&=rufa%PE+ zQl>!1h5j;Ep6-~H%Q63&j#^1AwcjbNV3)^1IdpP-N5b;z0;~l?&I3#eaI>qmcghE8 zJ`OR!#LD{2n~LcFyM}(gNiWJ~;!VkafLwgNK3Ux{>!S4FI>D!i*3^C=dbrC>_zlwZ zOuMY5MXUHz?J|N*=xl_G#w1pzs6M#+XS@Jd&8MC?aMf6 z?B?#JTwrx?=N-A(>h{js$JD8^XOpn$(4@Z;PVklF8z$$rdL>6(ajZ0{vXT=VQDTI< zMj!RgCTR?^A(q`1bzK>YDZO}y~Q>{u_SQp^zXS7SV&h%3(I*t2^j)5GyQ z;4|r{W`FA!;Fva$J}930DP1dJFw>atN9Hf5M4@YdgP3pnGbAaz=`@weqC@^tfZG2@ zc*sP%91->*47Y;WW;RfEBx_ssX_g~_%gc~o; z%+$mKenIl|M|?iA>AV1|C;8d!%f#`*>RJ`Ajty`9@%b@UykR7cBXnR_JC6T#GJ^z!s(C_FJ{DX=wOs~}Z$NBj| zE8`lkM&KD)ZD$GjWw;lBso~?ozH`Uy9UrDRG;NAe^5V<+*~PA zo_>yS_^#os;}<7D>D8h^4;-z%FtQ8UW&&isc+{RePtX>fwxJ$@T%WF{J6#1%@I#XZ zP28`bYqnYCmdw5{D&X_psX|mVz*fBL&2|JwlNec1uxn{r?TTv0Vq=Sq@gz{o6MJpw z6}|;I802!_(t+xodnFr=VnOufy=VRoEc>IM?7MO8bJ7FDwV;Z>b^seYNvLsdGI`Qwp-4u`#EL9Z!_N+NbK1#k1p?&)}~~r zz0Qcpbcnz8%9nU^75*O-NBF`Db7|wlEw^D7XZ9dIE*q4^&&UBhzR6q1kZ6`%^RBM` z&QH=cf`7l;k9>FoMcI@K+N5QBO^s^vaEPY%oZ44i*_`!SFd?k7NZt~o(1&BnJQ1i) zTb`Y-U$~}5g$AQJm=7RThy54iNS@c&=%&hJzkj&OZ4e~|&0}S(ipRlC%kk_M3LeN& z3;yUnrra;DIg=9-`?E{0`rXRn5r$S=3q@JpQw&r+2dULotESkbN_$*Wn|n3(XR%42 zhuC0MZk*}koEkC)IR7-=FvtZkejh*yPb!G=(1j_0*7iQShviudjV^XRv|qDl8LW*+ z0X*3uW1gqKW%Im_YKAuGq_rNT_MY5hQDuf;P1c09_oOIM(`hhcsCgm@S(Bc*9$$O(tp6) zfU{j)0>S(N3`UTP{Yebc5N7(1SGWO%f1sf6k7VBw0p}%uiJ`N{32-$XO)DC7*m@%nC~n@ztokM*OBCnrM=1BwtHT3FUqc{48*vW9n}nKRxZ0wvYX2@ zwaZ%UYPk_Cmz=mkw(;+6L(Yp~if%GJajN0CxmQM9vBxHDFpkpG=D{DgMjGrrOy4=F z>=qi`I;Zs|j8QRu#+6!wt0MjL9;vPk0V&tm64yS9QoKqid&3cF%!* zy&;g^uIDjI?8|;(8VH0=D*my%4tWDLl=pe_DsI?(*K66=5INSL`_$SMRM_{agmgNi zDD6J7Z(j%oTrBvWlr{mpK`xJ-S)tLB-EN&Ra40@G6JQ@L4Imu#dJcMHXCLqmI3@mL zh^aokNrAjLlvuy%VDeWO%4K2|Sspu36d;nR?@gPNX_Ch0lx5(0G=bW#U+B&0h+wBu zcdX2^zS9fo?|)S`W`iaY$P>IfU+*Le1|C6CQJrb6$Bs+&jxX1;TwhYQr$pVWm0^)u zk{Y2Qp@Yv&2Rn^m^fp6wRaWQA^eqc7@ipv3_GhIuslaSe6pix$!b6wI)azIl4W@#K zRd;`+C!*MKLq_Gu3ldYZ-{7kJhuW%VMR^Eq4=deljT^6l442*>KnR;ogGE=Q zT9G$%L!~n~xvza>nY*v-)0RbQBI3GnqqvF}vg6bO$gN-d!eEOUK)$+)Z|>LhB;9+u z548m(4D_j;;5x3X&{x-<1}F$yqI>dBFTZwEc8lq88`csycA`=*x^XSlB_1wv2Qa<# zh91U698Akn5%jo5>rVl}wpEM8oIf)=x6^;DGxoo3I4ggS@_V;2{Hh6P_inrf3bNh# zNE9{yd>PCV2q4F930u$ki@4LM=sbmYCS2u*2~B6c0SZKBqf1$N@agbv2hO^je>D z7o{D1JhQZ<3rt&PsItU0CTv`1E^dh@-^XO9xon^vMfG~Yroa&JO?UHGJt-RBt%^AS zq}Ka@0yj%KmUL2~!9LGRz#2L3-V;EY*=DL2^`Ujl5Z3S0W0!24BXxJG#A=|40shmF z$v$VxqaHNL1a;B$t))pYN>kHzO7q@LImZMNI$$Y`bMBQs` zeGEr?uSB_a&yTm$nF;uLcxTvDPV$5}tE=ifMMQ}c7C^3sEX&SDS>{~608`avIg*de zCaXWbKRKZd!V2J5R$7h6K62=G=K;M#V7sOedcK=%9xbfJJLjfxL!kwD4s)!F87x1` zxml&G{MwLfDWy%Kug_1Hqw|y+8&@vyIASs~D8^pu5~HVj*R*$gmkfEi(5F0z*UYbM zrlkM?qp-;?nt5R8I!alDiDmc5YH}NOkuo0P@*mt-UL$~%Kks=iqDOTDRN~%#!@_oW zqoXiuE0(n9<<6z3olHbX(!`-OAB;!R`+?do1`6GIN@IU_b~qj<`K}HbQ#e+AO$M)n zUKV+%1*H*{2Tl`8`NJ>0s#gxe>lPSC^!|exQ-JUpp6>mgnzsjy9kfTetfeM-EFj|od@ zHGvphl=XnWQg1eN=V6?sp(EL{o3K#<(f)WFba@eO5}W;CtkxK)J!gkletAH!;irHc z(4mbKQQTZbjbwhve|4$`fA5R%Ki<+M&K?iN9gUT3v>AH4E$W2Xl>^N?VW^b=IMeVm zfqDuAivnyER&8C-6@-lH?>~Eow;U9s-ZyL^fcPFSf*tgzBf`!&uQaGsED2B$wc3zO zRpZTSHmXAF$WpzAI&#q21S`xut;e$Pyndg>pDYyF#9EwQb*N$WtZcgo5M?o{LEa;- znOl>q;uyNmQ9{t~t%4)#hTwLXK72CE;+d6L+kps5j`rU)*%^*bkR_%byt{a(j%p1A z_Aa?Rq!}yd1}@jO00JY zhJ5UQ8)2M?k4y6>x5a`&kGhcgWbo_@5so;4Q?TFV?nbvk$ucFL-y|o7!$~ON;u^s( zw(@V_IgX%Vw-(OhcT_fqLpDpS?C57bH7h-+@ZY#B{xdXRs?&@y5%YA!n;g zzyi8a_p)gTKuxaWvvD3I6lD9!7riZge#3VnG4>P}*yQm`UC=yv3PL*416KEsO1_pu z&z`$h?j35V^zxFyz}wSIcoM*EP{kw*Hs^`x!N$(~;%%Sr9t%1q%gI}uTz`cDT6AxZ zr>v<O-YR42uCyJdpA2^|W=eXQk8B}ucKy-yiGroVD{-tj5_WbtzSCjlbK z;B&U`G3kv3>08a_asd5hbSsi~aG?H;NEYmorS^U1z1tjZ2t05y$`4*v)s^KvT?_Ad z3fXOWpryUAdv@ikok4iOn)Te0&D@*>O!W zpDcJ}vl-N=Dyy>YTQ%;|0z!wWO?$Jh@)Rm+h9Yrif?FmH>U;q$p|=`-hae}?js?Nn z6WaMzaq1wD{bGT8d)ULIE3Y+pJ|MVJn^k2S-W;Epd!g^toL|O0oo4*LLQJ%i9c!kG z+P?(ipL_a>sW`H>xU5N{NW0w8+;gQ{ZF&vX4b*CwqGX~dY|JAn_l~rU$zOI!Ceuf~ zrX%nsN;nT@O_CkI_Y^h)*qwdYf-EcZuIgwzHWb!AdS87b2pIzqSP~A&(kEgZ>I$v% zv*CRAfpdMe^iR+>25TA(?+coDx{*sd9%XM?ua0swZkf5>-2#BWDIcVjy_i4{&T{w_ zj&(Nj^HjQCeNqy;zMg?yrc+Etwht=2>3mRd8m98*VAWd=09CYU?%TjKx2NSqYrR6= zUpIBFJ@+@8fkFI~9^lW5Mm3>Wzq~dB5qGrWc+pxHAl6xyK$&@e#up7U9Mg*(b*w-vh%ub#_^nlk~BWS z+}9IOq_bEbrVW8VW;CoUqvEm6D`h6Eh-o~T^-X4*;14_TDlo%I@tOHc;RK3AqH3Zt0R9TBJjeh8bz; zmZ7CVV(1Q$k{V#>2C1Q?yPKg?hI&u$danO-Kk@lp>-h$2&A`k)_dfO!zn}yco(9wp z35)vPfrO3&iJss_5B@fqFW*F0Plbr&{~0ypZ-Wj?oX=bE_RmZGGD^yHh!#B$4M~4k zU)VMB5iXh=8T#y10O0xn{0g7?<8HDu0gINVyaSa*?=9P%(Y$cu*?AugsGx*LxHLW= z`KNoJ{c2>b%WGILTV+YNWO)k`TziHyNq2YP1Dq7s!B3pxxWC)i)dftjcy3lgC}W3& z;VoBaYtrmfN}=8*n%&TUt!~N*X}(Q9FZ4Z?y-!x%q1r=Vy8nrkz<`sBb88^8d1P1> zk`+&`$V_8ym>Vd!`$J1MKOWhOLU6WhrwE_6TI6mHW~8Z~(B@5=7Xo=S=Q-emvAJ;t zY3}8VYB*WCxbEYgj<%>qSOwWJ zf2<#zbX8X7P zcE{ZPP?DWPBZS=Lqk@1(rSANQ+>GoR@z0!DMug_Ni z=>uN@XE1ak0SyHg=#g<7PyUVGfKX&lG`F&9SDN$=glf?SUJb>ofz(BhQO z2iB1f{T=wV&{Y*RC3w^7*Cy^fd{^~9!-U?U8{?8Mq^FBhc;13$wpVD>*~^VX%5HJg zL%*8xO!^*R#6oFe66msCXD4=dP7_$2P!;uc0vJ3el}v6Xvcu$>Plx8Tf?d2nCd}F| zd8=Ew+Bkm9vJu}Hw^iHS&WTbeWUyHj)aH3p=KE5_wWcUT9mfMP=XL40-r(-J(?KKs zR9|d$oI+KBYHynF1SVFb`SmkYsC(!Bc1flNFPcgeCVo)&;c(s&nJiw_MZ@eJYQ&R_ z&#p(Fj+UO1?54TRz@6z{TnV8_)rRnt>4_D`s|Gt#^w3FFQ(JaA6K7)TZY%h2+4rEi6whKHTwKs2`Q!04bW*62grwt zQz7bw&O<_TLsuD=h&gz}=OydgaD&OwYnMTWZRyl;;G~(Os${m4#E=Tigmy_YKH+UQ z-@`fH+#tsR7s=aZg<;pxA?5MGhQoa>zkf=b0gZ<85gGzJfwQtJtbgk|lsv;YBk3w> zF8`(Ry{lyPM**M@$pe9yX&JMX>D?UKA>;{}ONrq+3C7J@2JDWCMH_XP4D1`BiL%qh zTY$kgUvV|iQ?8zxt;j7lEDk3BuH~hJd3wBD=GU5|m81$fFVQ_OKTF?5Ig|Gh8Ez6Ae`4T0E*Xn^?g=JQ|%N7Ps^vvhu4P|lXdjR4L6$F5EHF1 zgVqAAg^*$fjHY>DF;HMr;83!Yjr&ySiW zG8=a9w!8l2O3-947?MG20}udDO7*5pO2fOpHwLQ34wlqcU@?pr*OsO`oyc1$3-`ja z)N%GjW~=xV%^6?=-_hpP^F6T{63sGSIqrFX&h6SV4Xan3sScIODk zk6-VMQ|WUaECRADBg>4{Dcu zs_Tx|?gy;JZ{=Q>%9a#X{JP{0eIj~_V{N_oSG|AeTS6=^rcbxZc?;oubnkY1nYX z92!!n&fs3#kE-F|A=bHUE>rsWKTY*)T(EMNxEHrmDW3fs$@}9z-Gi9+$h&Wn;>DhU zlxUWdfOmqcUvnE<4i*(5iXq=k#>XTLVDQxL*H~Sb*BF5WRUuOT7BXuq1-AFs`B0cJ?X$I!&Ym znSPbv_)sqnDOOl@7qR}Uolk+?=6sQA$Dh@SSJRfy8G6YSk;=v2;k?K-GuGELl@jtQ zKXDmWLoQ#oJn9ai{2X}I1(>5Xs7uWS_-cllgDbMcef_Qsx)~IJsYgVhB%W)d7o}L$ z)YRC-_i3;zrUf9_f|Cz|sEElCSk^ z(y!7sKx8eQOwtYUNSm$)>M_eE_);)H%PBX8s@_W1?m*T7HDX{$EO7!L6Iet)e;|=_ z303ij5hA-~c4GtEpf+l)ei>sbSW;L z5pQ~eB5U*NpHGa(k^W)@M#)X}?}VM>h1!3c*i6px?>ErTaO(eH4F}q~sdWJTZf<_< zXT=thAlrv2tFZ_twa1m+C{wM##99jB<$euSa|F}`Ul<8 z3$`BEZu)h7^LxC`yx;(9;V7bK33S$Au*P0DnkW1<<;Viv%a*pw(s{>f2N{4&;rk90 znlXES9PjF;#`w1uA4|b}@MTw@Nul3<2ViI!KJ^&#S9h(%wDevztRGLAVvpBVgNpRCEC_FWX zpRf40fWh09DCs3pQ$=;5&AK&P+fSppVW9gHl+%T-g#w)`iEGyjZ3Pt-mCOUUJ^8<~ z0r)BZt;2=(D6Jj0*PGOmL0+b1uPf`;ph5PMS3LFyh+bWY2x*2mefgy(j3mRl>E zGJ}cg`vs7~#Qre|_No#)TMlrV+pkUINI~Gn&HH@wH7|si`J3dGU2f^BjOEYN@2qE2 zj3r>5H}yJoC3sOJStO(!h?p8Z$sDkM+tk<9!!A}P(mXEj{Z|stQj6hu2%Gzr1g$iS zXEXV+hR^&llMcDFnZkiNRBW=Mdx?dqr`(?!gxagTA07U?+fCryqBzZ^TUXs;l_vnE zzp9-mP|4;Un@+YfbD=G?=vD<2O13pTLW^=XOy9hZ5G@A;ty*E+igx^YrpiZ7nHK4A zPP>?JyA)gFP2#B#&8YKF)eUx~KHcJnS2Bx_Q)enEITlt{SBv3+UN%QTMfO#15ZdOi@u$ zW6M1HTk!~EYE^}%Ylq6xF-hW^#FN(t?F*$6^3ji;d{qQc8G7l!4@C0;X7^hnjjc(& zgZjPZ0`xOWUKh=thXX)^(}(x6rMcDfAjQKOe@>C2s3Q?m)=N&~)}?5CjY)LWhcGP_ z6VyPw{_{6&zUbD^47d3h6Ae0Pkgu^ufNpDDe)Ky#>)-AfPgWJD6e&*E%>&)1-gJ*n zxabLd#hh#ic3QYvxu)W|@Oa&Qh@lhxLsdUD&W0{mYZl<>pUzQlxGL1an}>wm#a5rR zpg0k`v4slGiXpcwGF~G}os#7e1O(kQ18Pw%2ReqeDdNnAo_PD7CeCT3%&E?NqytGVU=+q5XA>WH5aqxuu;`+QLxE^A5M7!ff8$r-KiQ7S}J2gro?A)5|`Y(meN|TRuZzU91dV4PW?b}4p|Ff63lG;>$=U$lNs&mKDcun7L`3Zvh8fGAWxw@c0dJ@WDaM} zkyrj$(Wv-k+Bvetg<8F#{u?t)fIe5;;zP^sVDtU$VfEMXBWYsJgcbnAT)>c|!veu? zgE+%vZsnS2D%u|5Y;rNP&CAm64FZ*UN{>GZTfS~H;P<1$P|nhhCbOtQL!LGj6P1=t z-0MJh77Y#X2NBl(b{*{>Vxo9sl%85Jbo_B7{N=op9}3^q8S_Jera)zqK=Po zVmgc4DHf>gqUs2Nw~l&WE~MpW*`cA{pLZIf<%x&k+5tb>a(;La$;#|S26>(gR)y9! z{MF--zqhsdtV|;G%LSudxi}uVd9q{oMUg`@p2Tv6ES2&#rPHU2=@&CU1)V!u#_T_< zR6Nkvvo3|0mzD1r+nu5jqvnnQ_h}iQ2k84GF)7liJ;PL+1}F9Np3oWeTuTS%YHI6? z64^m320^C-MS5;?a=Ukow#^fX$5yxVmSGHuxKc-)J86u@#*@%$N=`5ce=F4*j=X2= z30mYuQjO9|!olRnJ|^!=s0(5J`%+5#Rcl|AzDZ!5r1Guf---Z`*ik@8I^ikqG|i=b zFqUEk0NgUeZ&+B>+=~=25PvppxkWvG8Kp*{5vXL6Znb*3NJ78ykVbJ}2PTH*LM<4D zJe^6c?woVMn-G#$Pk9xQNgCO!r<%9--1lT_3Ez#enTTU(=gn=UTKr^nTa& z5~fbre>%Xc3VO4hAbR%$*7D+KPR7*2pZTC>5&I4ku$=@Jl53{DD&Jg!PB)K;qG5vE0V zsWJ#$3d@g|7JkAnc>?&8HCY}D-rXMhkeNj~zqGeG8&SpLXcD=^x1YXRrNIrnisimH z9szU&<&0|If^v6w^_Qxy%>8r&{d7!YWX2kfkAi%%%PazYw#N$WzXq|Ky5ezOTbH$R z*9JI(u!MGUiN?+ef39~WftBt(_kDMQlZ(SS8a~xzi0$c;ZcWgFg-=P;3GjCi`{%Sz z5krto*dj5qFBNc&$~5V!M<&M6f9naOik3NbH0AwlkFFs^>M+uDqP50C;YFW%@Ew3pE?agjPrCOIa z2Gd>vV*x3~fyiLNC@weF0Q|Pgb(+8v3oxn#rniL~?g^r)!k6q-A>$am1AXWVd#8c+Aow zowVX-l6(@_M@D!(IzWT1DrLA-esvaMZ=fotp~|alCwpE!@p~f8)4C@>B(inAdP6c~ zh}7lR5TPu2jPb*naaQBl*6X3hoiC5^3q`bYHnW=+E-*$F2<5aYqS$nY)FbqL+Bi*+$+XH5ird(>{? zd~|k+=mSpXM)B=l9yzS!XV1EwMHgL->X$WvDNp(=TE`16>W^1~gIjElP>_Pwp5k>j za~aWf&DN4|I8QY_ohTIVjt2C`^ZeiiWsY?hs;)oiZiO3rM3!tiNHkjYam``Y-8nLc zZvIS>3aqQhUJq^9IJ`&FC!Xjdg81ose45AgZarL)8lroc8b9BFjyu;@jNElfOBiq! zDYhRyMxHOYT}wBd*UVW9bmti;qD@sb-(77NCdOzpn!5A(j2?wrE7z0=wCt~WcPA&( z`=PPk#k1x!FMgrrrVo%M4a9%z?{EVGyKibCu$s&OX>oT|a%I|;@h#KX?fDT*!Nz|a4MJ(DfGz9uir1_3!8 z+nFyW3dV%sdb6FYCm|4J2Ken?e8}C`2`gT%cnD?Iz_G_^COX3I;uPj~jnacw!)q#t zJmt4@Z=ZJ<5I}xD2n7Qk zLb73`3ls?Ls?XK~Ic z7##Fyq}UcEcn@SlgI#Oo>tv)+KcsCm$X(}1!MycO^g1tu{WLPf7zBF4DJCr5e_=+n zMY4tKJ#sVo67h+3D+nzkro$y$ERX(Bo9_AQ-YNsZSp-wUBY6(cX<2HDBU-rf5kxb) zd_he-6KRhb@Q}v5VKqf3n!0^g+ppe=4mrd3d7o}BOJ^VqoDnzdQg>s&zm!p~kE!~Y zKpP*Pcq8(s_o`M*|0@*+j>a!O!j}hM$M~-Ab1u;Bp=2J%T}iooS`a!(v04Vlv7gHA zfMP#ww5#BjJhh-qt3Vti^Uai$EaZ+CqY@mD9Q7UT!ewEljNATE_k!H+DA9U zyPBpMf$5}h%%`bUTD(?-*L(W)?1eU1v(dezFJWIXsb(}=n7y|ss`i}lwf$o8^JO;U zn3vU}9uZ2x%QQuu&}eEC8R6oH`Y}EIdY>xY%z|mPSZd@q3t%E0x7#EW#e?-U2KVpR zWvW?Xx+;)Z3miW^PRYL43H;F^;FBZ72U>jZTq}r7vQ)Cf^h%-Ps89laYE-eSjFo)w z=UtW;GV z?Q@a~nzMwy6DwbOjma1<_oyW29IIBB@;p0BGU)Mpmbn7ub)nWifmg`lsB9anLff6< zN%pyTirGZ;hb;C^>l7rN=Cw4qFksE9NC2~lKjF95MloW-shoM(dA4klc`LV^jY_c3 z9Nl}aIK|alG_U`UYU-sQJf!XDezOt02Zj>Grlc`J_A=yFK#+N+K3vu8Rxyf->kFVYH3{4_z zBNz&WFV@3AA0fg=TpgeLLQY=Wb4Vs1sYPK5 z?klsO7m5m-xxL8pXi%7`LFVLC)n=-k^l__^4fe8RrKs&jrRb26^p>-`CS6V3s%ux5 zc(9QvE-+AbrcPAA6N&;j;CX!(;WoNaN|rDe<}7x1Gck7)mPo6)!Sg&T&WZqWoW1z* z*5_pVN&K%>&r|0%g}Xq^u5YvpQXv<4dRm7%HHDnWc=tYSuqcID=K8FOr?YJmx~JP4 zJ+J56f5P(ar;c|Vn|^Q6!2kS=zldh_93`Wu9Es0TT@do8tFk5EhrSzizS_ugK@Khe z#1O(p4X|`)5_}_{2$e6AmG-&Op78Rrysbbf@ z9@NYoT)Da;yNQf9F8L-6=oSF?mYtQ*=Bu;}x2Ue+LJ=wHNdJgGr_OyQ0xAduqa(*2jc`qP0iRSQq;-6_ufY2P`Q!Dj*+ z$+6Qt&||+kQ2{g@%{KHl0^C#^6)~L>&RJn7GSdjV3WL$)k?P>);M;O~$L%mK$T z2}yp>SY#;|WI8Dbv-TnHxk8<18CBLy2_b)At6v4-jN7Z^gMFHtMl(12()#Tc7u53` z%0kp8Zr%&oh1=$Q$DesWBE*8Q9T6=;_q9}O)mERpAJOd7y3YIja%oIOq?s7czphgu zc81MZrr%iupM*ifjsdc1*_y}G>oQp*YFqok!XKNAie-@SIAb_;$sGidXP*pPs(G)h z={>PlvumviFjjXrT=Sph9gJ8uj`QYU=vUT)-J3yswj91n=Uw~%NC1KEk0DmF7iGs9 zje6jdZ2G?Q5I1805nj}#&O zIpx*F=v080p~sHdiPhTaaH|BPGz=E>m6{A+XgykKRSL{OQV|Q3X32Xrjgzm6dwzQN z=XL~q3|wb?x5)2pbeAC7EyUM{DT_%jXyd*GjxMqf&W5eF4;^|Mtq|R0A`8UsAxkw6M zs`~!*{rZbdPnh2zqMtnt?0LFhk|d0P-S*S@Yyve)d>=ac@Or=1*Z5&Y&{md6^VOp4 zjN&zwZ!3eL^S3~Y9Ln+@;ti7D=Pk*5JNFYixRef>jQ zsfi{JTkm~{JLd3J?FZ}qLY^t%bj}M3Za%gZy*cWzOz`P1uz>uw_pzmH`n=n!>2cAe zZEb>BL8J1u!PaMA?-%Ud;Pb z5_?4ZH%+4MnZ+?fBGO-x zqu%u5j=?K%l>RE=ctv1*9&{O+9IVhOKtCR2e6!$sxv;Z$^eqUQPXRK#zFZPpfOeeE z#JxfsZ?UpvX~BMv(t{GT(OsOQWyUcQ?%HJp8^fa428`N;txC}?P$TKH=T=7F!(N%# zsApX?x}m_<5cg?m9USC2Q1J2f8v%InfjAYs;T_+g9zN`ovoq%*Re;Lg+oQ-{{Xx$m zJIJ{%Bz@$JVE`ILiL2xC)kOyC2Z3HK@f_n?{zVGVi5qiqQjMj?mJWZWrLY&50?>g| z$z1!CFrAa_O9j?D5GpqkhqHl;nA(6P1k0Tr{ioh905EE_wS1D%%i{W<{EpNiBA2qc ztU=Rf`)*6-qm6p^`B()~N~1I8sJJ1rnJ=FShZ%zo7aC zL&5s$CxxELO4Q*FA7}pe2kcB(zU92Nsy`AXfWinPcm-@6Z74OBCeGvIU#*lXFwlt{ zdxT`p63XFF`|kvSSs}0^LA(NI^O-T8Zaa4;Lm(Ya`@nM==FlWuX3+Wg*m#p>Ou$?A zu<^Pi82>A2d4k|aJlA)a2dY3M@j@!6GT!xe)*IO3vVtmmuMe&dof@TsaeHwTlu7p$ zi9I&~<>fP=LnE*mqvLcC96b{c zbmI$iAYuc2-!nnTB}=Kqw>QSfI{^O4abCBPsPvjh(R1PaRfp+vp6FJ(vxOAZ)w|os zV?rAK7W7GRoB2B08eUJlDpcBd(2yb_hI_bn^qOfU8)U)uHJE+(@nYY!?sLXY-8=)H z@jL^{!DysKh9`Kpb>Xw+NEflP@9z#fO8@~neDc@AF@O%r7n5YkNpp+>n^IJUkTe*p z1N;Z=!|tG!amsZ*d}`_}&aYkEs=~*eE_%?h!^%S+%LGkr(sq?9VbVXn!fuR58+-_` zXKBJz@z{%#2u1CeW|t%XtmOYQkO!=Bw_`}cpSHUJmv??E*vCB;n9v4HlfCLZP<_rF z${87r9~}>E_jv*SvE(g~9vT$SMiPiK$=Sn}cvU$htna}9veX8tkE6o1vZ0o%|cL4IE_{IT`x>p=Q_X zzSo1b^@dm$NHtIawuql7XQwd~ppBa9*#Z5huT-g^lswq}uTT27tfw2QvKedSzlv!HV zd3&5@A8hW;riLZ2B-QgPJF;#)Vil+H$l&fAje>o+Z@u>xB099WT(ll;!dlKxvrD|B zNvCnJ0F-KVnj9S%gW5?)!PpUUogB?O4aL?g+`#TjAYal8C8S{K_M%o&Vkr)Nks(S*bagHOE_2W3Kp=mvBzV1#{({Oii4x`a zEL;4Ox_`O7Q1qr-{|Ugblh60cJHE^lA+6+;+$&07+^Kb&Oq3KA~=fHXbq57krk^A>fgM4F_6?GrWu(GqGpN%is!bC@RD%w^q z2u+fcN1>EU(Ed`Pnu8S)$pQc-W*-`3H=H-P^4HF09Q!!JM+rd z%ghDo=`|5`zr3$6l%W`h&BKejfN?QU;48QMM11PpznD8D;4W1yn(*C7xbHR&!ZfEL z_6CU(D*#%YC%1`dTdD#8Kjy;ekMPA9w=7l0pDzEL&_dN%o?i$>;#SAs8cH#!HTk<* zl)Xypf@>1>R}xhm_9`_z-;wQ{^if|hl!n5w)94t$kdVuw%d{a=FTr$H!^Ddt(OU!) zvN9q)T?R9bJr6Cvh7#RwXhZTPNx*-fE*I2iFz0UzjV2HLy`s=?xt-a9b#jI8``bH} z4|xLMF1bpZ`ig`Y1z+?FCA_%m|JShkFFOX~5mD!=+iH2YyaaU%wLs64N4TrRhijCg zjBsnt4d`EM@`}Dkleg4AS$~NmrJK@e3S)B8b-Ds!Uw*%^4DaCuHLijx#!DXxiR zLu1qU!L4F#7aH+vsYtnKKl5O)cx(APblpAYob}@T86vUyoJIOJI|_}lc!r}yim6`6 z3QWVsnGnV26=|RQpFAFsoqJ`mYeeF{jPZ0j3VftxTv8D!gFVuYsk=@ci0wSey4hzc z=@h5Xs7U5c@WoKr{=?*Kayd24iZ&yDdO@0iZ+_OjNB?Yo{ByAN z((f4WVcf9EPV`p-o1rF;4ckF$6^j&z>eO~(ZGPqWQsQlqSd{#E=#U2@&!D=AeLsn3 zzjSHR!#1HKf72ATG1bp{Ju&KI?aC~0HUHe7gZIz0`d^;MzyH$qJMv41T}0j*4)KBJEuk)TDK*-jJg%L|CzYWM-H@x9vx-TPwpYO9$nJYsrPH z!E7<2#%4~xwe&pNx|ct}sMtkoU#rDbNDHi4vskhFp1;Tywd4HXlcfLrIDbAt?^XrW zOP}s(8moPh%V^4fY5{PxiW=I=Yb%;r6|?ii+79z?kA0My16T5S>ap6F=3PwMD>f&Z z>ai5hf>;n{3m22DuF$3b)wle&Y5g}8HJ6ja0({Kva{Pb$qW}0*!q~v-XJC{}y!w}? z^51@G;CaND)p)Yqc=*3w-v59Jy!2C%YFl?^dT3q!e|a4|0$2<<2z}7_-?Ga8T(E!t zGI0c4SM&01dVgw=|HI$>#!C0`q@ESla&7m2xO9OKzfF&!B zYe};Z;>i6AS5u4ZupN8Zi+Va&S5t_ulA&!^ptG%wylu7nhrJ2c99|dLR|*pat+hfQ zSmEd5{i+v-BNer!wjXR!EIkxq_zlA95N*=Omt+4GAGc?*B1GNv3_Z!`J^vI_QW(_i zzpMBni@X#)Mi_Wj0oaB-P;1Hq;5wNaS%H=uV=~)YKx)hq@bumRMDGTaVOF<^dlVTw zGsnG5S-Ak^kn{G?_nxeH&l+yOd<8UnC)hXJC7sR2O_bbo0cs#sE-*gj^1i>lbUlwy zV6+80^)l?FSY-B21fqUyzsxe7@ZA(SrJUDS7#6#>*`NO;53lSqJw%nYW!^JjoZ z&sKiCxbXh>0Mt9#q1urO3#D=Iy^5YufV>iOy+HV~W@^*-?lfx$;4@lR2s@u-uFpyRd;my4dV{T@cQK+7`^lM+e|^p~`A@`e*4 z|1-V=v#*3d0XgB_oHrlPCWt494vDi9)-Q^PSl5rWwkB-=YVi6hpn}fNx>;u`1Zd!e z7Q>mA0C7y^a={Iv6)^CF9@%?$dtCs)hxoLu6A-ngiWi7E=&E4;=80h2K0X_jRYsY(C*|XiUXDqf~HKu|c8=iYJ!u?K| z()(=W^RNJAwA}Fa^eCw-jXht>_E!7wb49io4&aSLpWwO~(`w#GN8l?I05HkwV8gKN z3-_a%Jw*Q|=KI&$K9$e-UdTmRqX9D-NQcB#>BQl{$!@ZXxjy@jxsrD(q~D-@BvxA$PH9F(839FF}seDp)ykH;gG0 zn%j_Pz!AZD;$mWWP@G;mYbM_RHiM@yoyYqFho>u>>LKNV=WFZS(!F2AenntS7BggV zjrL}O@NTa>lm5yyVBVB|n{|J~WIvKEb^~naVRub`uoguzPXt-*^y>{N$*Tk+Rd-tl&=Qy?~;x+X-osiZ7v_AT{53#JaiSW%?j?;ec z9hSLbZ4RNDg+{mGkW@vMoXqFw)G-ZCh_mUAS)$#TmxlhXfU{RWd#w_c_t|@X$qn-O z{e){owNQ$B%^s{=eU3$1)in!*L=Orqftrtg;*gtrwnYm(fWFMhy~u?itYn=gye7tK z;#n_g^e<=Y6;8u-O<~Co^@SE3_Jzf{1Wr0*(A0pz0hZ%))ue02z!^X2I+i+DxY7 z#-s18WYcO}Ok7hmLq7!xs4NSu(kK1s_ z4Q+AU%cX}Ddp`PEX$}zEJHM)lhW<_EF|Ve@z~Y9oR@| zr>PD$rDZJkLq0B=`_fvc`uv54>&#m@JSUp~w(QNEP36RiLYls{zPB{&B2T|Y)0JAE zvoN#Iw64~D~E=sikZJD-7Cj5hwBJjZ#3UZ&y2rzc%m2}}3uYa}d#`LtD zD3WfxkMb5ahh!ll8e&Z#wgh*}Us>UDaY{VcGrIU@pr*BKl|pHc8HGge9a@<8jCx%_hYbUDy&9rEtQzS;(%_0N+Z1_^oB-#ZwkOkvv6Pd6$Nq9N+fQxb>ApmD)fs&F z5=bpE5~<8TV`>R-n)>mt`p~g4&&ZQD%o^ik;+g8xcR2s+&INjbAz0A%_G1UNg+Dj3 z@Ke8M0@Ku@#ASu|$1q%XOp-(z+LhQ<0nY(e5j@?{S&$Ei2KF$^jllJ&&EdF+e{g(^d+P6wATx zm!&VzX;QU@SDU9=57i?m`;Ip|I6%Yjrjx!m8}S_HRF*AQn~K(@)mo{ple*TfmTBcrI^TDRMPb`ZQZWKY zBbA&+31~nyU|{3=b)irIr{3vK!n|-{lz0XSYO8btBuwRi|6xJt+lQ6($S3TD!q!Bkv zVS^q8ZIe-c18Dfxv@JX)$T|}$=fnyLd^9Ohb@qA*Gv3l=)-Y6JW|(l*!C?Q@TWd%KF6*!lgDk1@73nJt57SL3f9(47W|^;8V+> z7g|WuA8^8S#i~Iv+=v(6S-^L;zSw%o3K8}Nuy+WM*0z}!%?Th5Qw~USBRi&zU zOl#;(2dUB8ngbL}<1#&V3&~IX00I>xV>kzLcak*ILbd8~sTP>D0%ACJh&&C6CO(<8 zhaXzSU0`cIXsHUZ8*-h^5hs9Wd7U#MqdCxnVSp^~6UP5A7d)dA!yp{kN#pKJ6Lq+c;-&&3@>TeExPi0sJ++W12_99ogs2iM>m|HDt`N>b;sXLV6mnO zn|QgmzWuxkxYu5IVxLNqH3VN=%e1~Z1Vt`3ZLc*9dgZZGS~(83Z30|uF@cc50n1Hi zOS&MB(*QBQ$7@KTwwm-LBo96{REVh!EPwI5fLtUjau{kXu=S%)zhOv`M1Ng=I#O&% zynHhmMc*1`U?Nx`2&=2%ffV-CaUWiZ0=QncO7e@ov{#Mw2LTg+=t9bVhl&r(%))vr zbsZ6N$MZi5<2Gn;Ti}|m?>xnyliv1;t}T*Yz(4K@sizk~C_U0l&fHF&d99-*)WS46 zPsP)o){AJUU!>`VconD%!Sk004@rdSLiw*9H;-(m#TqA>}v zbst?}xc?=|eQDrq@tlBy9$7L7sOeC+ug6>kXOX!$1PJ<32Y^=1?*SEGWgzYR2*)^B_uaHB`w<;sY4Cs8Zf8Yue9loC4w>=IR(AYBp*KYIT}38rJBCuns&C zHj}56&?-qQ0`0WA0s8fAPQ*qCXcWkDlWPgG6r$Cl-z>|hlb-AT-USo@;O>^ARH4q1 zbh$SAXv{D<@*^NM6OEH1Z~^wNGo^sLG@{Gog+Doh7(rmKHX8s6#Fc#dJyd6o9<3;h z-p;9{AeiqHS&QIBT(b5++oi~*Y9!4yf}hbF#o?#6P_xH~uSZLtkoSDvtNXngJ_aP; zslASy1lbhSGe_wk8Y7;p4S02~5uBW?$Ek8mSe&F@y(K^3o7ABrk{_tx8DT;z2;sk? z{z)xt8B#&hBD|IpI5?Q0LEwylIm1rBIAa)8Bpl&1fVs4$@tCWJgi-WOOZJWXHS-ZJ zKa^{xrB+Kr01aq!FPho*t90j~UNZxxyTkiCPSN8-Caa!30xSQ!_h80IdDj+h^YnWV zXocK#(U@rqcgwjpnF^%yM+4==U`4V^SzsZ)SMw}DySc@A@cj~?9Np)|(IT+k?4^

Nw!{wb5X zJQB441m)DHxG$r(aCxRfnj`STuDS%Dv!-6*W0%ypFC**U05#(V3V&-HaI8x^w>tP1 zaJw7g#kJzm=86@Y_1RsJYpLmU1I5Eb-~H+*DMfl3NUno%MSm7L@7QBT=8g(*{)!Tt za>p{cxUyX_C>Z3)4hVTNpuZV@WZKVt8sHr59C4b7X=rd*4_05Cbc41eTIG3!%Tsm5#-bynoD&Qs3$>6cPBFU`&XL!m(1+Ux{GinPlq3i9cI^ z!_TpjL=t+1AuyfTHqC76Fu+@kZ5t0 z76MQBJZb+$0N$^+i`G$|ef7$p3+X=5GJ)|mqpZb_yo@^2$&MhZo zuQw&4?@oLnLp&SP9~BAmg{W@iM!Q~O)azOY)W5>F2TmkT~F##LuuSaE! zm@OaS&NRp);^A}Zr_P3v7S0#OO!CmA>vg~P?milD)T>i1W~^PdV(UUU8E|Ay*^!gM z)Qe<4$FwG1ec(iH>ru9n8le1dN(Qg=j50ESK{jhG#c_n}>u0OtTbS)>r&or*`1~S{ zRE9QEr_OE0`MxbCcLrn|w1R!(nGE!n60WIv39UK3H`h3$CJGdQcccLeR zt*Qss$9qoedAaJ^$GQWBW+(laddIHUBT>^$v#R&M zkA!QuGS->mOv~(u^J$+r#?&_1DgU&NDaWSo@|={?T-Us2VbeoF2*@mfTy@wnGYGrv zBrZ2V`yNODmdL?RBDQ%EftG@MM;(Y-dIX^V;tOXgQv?t)K}pP%iDwC&$+1w)j6f10 z9sg%x^$ajn`ui(mpH-6bf9KXl+cFH>&9kUvR% z_MK}k9FtQXU5%9%bzGw<1U)-kYR$*F4k&?7$l%?iiWD3j(XYfP?2Z+v(t^GmwFNxK zH-4T?*@l0pJ;2%Oo0xUS!EKLMnhWb03}tbb4`V_-$qDjn58pxOR!0W(AC1bt#DS-kJd}9!_~+xUjvuquWFOOULBmYI44 zR?}+|Yv0oel)9f!q7#*C%#2Vmqb1Ie$^a(_5iF+n0aoEeV)zW)yIkW6qzZ(Ysugbj z?U2R{a;8u_nYaB5ClbAN-PWLHEe*c#p09)8*z<)Z9Q1JW@q(VvG#GEnKJ>_@P%{d_ zxR4c7O~<*Y6T|#*IMwV&&OP;a?4~TH^zViHR~NK=G+5**l@@Sg;pZvE0M8>T2K+V( zC#tGk@wC;OJVEwRagq3f|6#arzCNw;)3gYe*mQ~<&z!KapNtSBxGPGD5u(^YFUgMg z!1!9Sj118+m?dC|7LN>cs z$PgEyNc^t*A>n;dasjzuQoV0SZ#6GxV2qvjJhT@5Vf$)ckJ?!kT?eENqN6w&i~UR| ztg=7y?%r{ zW2%xgA)*|tc+rZ&cxZW${fP`H9Gmv7vddxEaOqi_2Imc84GI~hOynDF>-=aKCmw}N zZ`2SMW+Vz;{K?^)ZS-(!oV!;dEa2BW@_0kzA`W+j0jY7*aFZ?`7dS1qW&bBi?|_XD z)H18h&rG%|y<}?z-3sw>slVG$5S6Bs>9|(r{AgdXL-aZ|WE8ePogCSZU*Qy#Vfr14 zE6cck2bC)s;wEFg1I8bCFx7HXDi+AwD6E@UPx<8JXZ>JBaPKVuOT90C8g7zNSsow0 z9*QlCRxwJeOIrzuF)p|+W4UwM+)8|oe4S`NN-FcarI`$at0S)aXo~p!i&Sl6#j>c; z1aI!?x=sbsW~n)o+H;v_O;DY5csm*GJ#YBiAQacSr$Q4piu$9hK~4tYJ{ISUNP!6g zcyJi~cNHd~2yj0$(%CWMGVJ|`1Dhn!DUo7@!2uAMjAm3$NO zLHI@8f$f>r*8=BHYS^McRN(@drfQl}yt-N`+_O{cev#5bQ@b@L`Cco-R=+G!4`cDV z1`#n7wfctUhCX88u5=!@p6`RvI$0ZzB9O(sB0HcBi`Dt%l+Wk|w!%7VJ;;pQZ0Ac1 zAhQAZwkA5(221lGU;p5#ZSUW8;z40KAq;CaFg6dSu%lT<=Quns`ne9WW4ZxZuWaR0 zdhbzS0aC_+I36Llywg&aSZp)q}E7z+PQynXP=pRm)^wC1}uX`yGlZsO_v zlBwH>w)??T%!ceZZ1@isjtMZieP;{4c#7w_zgAj0$x2(wHTYXTPq6R}6FwC-Ja1FF zO=iln$Pj~fx>Id-{po^2895zt1AM4x+na?YJw&{t!+tDbkUYyue3eo{NBA4D@-Y$h z@o-~&I_+&o(6Rso8&?D?;C7uDaN~xsa2fP}7SUTbFMVVG>&*TH;G0h9-|S z$3zqE$EFB&QX4}H_+*R=CtvLK7FyU@AN*t%dp{c3ZpDkTYPI$>M;1Dl{8c!zP*eTfZC;=r0hyDF zcLMPqCBg5f5S=cqF}XVL{uJqC+Xg2`u``BTw^bb`WMrCo2Tp!&R)Z}c4lmg6GEsNm z4Py`wkTF4LXfItmIDSGXZ!=b3e7|=0gNZadNW1vEBq@Sq?S0sKX;E8`s4?5pw1o5! zgO#!5fhHCY^ATv8DcSjH5O@zI z83S_dc%mTfO~T|a_}xFUy&ma}4M^?ODiXKtHIIhwwbR4qZmRcv@e8{P6}MT2uzH34 zpt;xyuD?bx^Bq1S`|@tK2gRddrleR?X2Z732Nr2OcE^AYRf)5aF*tDEy?OT=;~KSL zwu7ou7}X=`ui_mtx2s0nWH`Vvazv^8Om{xgzZ&L%$-cvamjEEH&rU6*d*z{jmA8PR z8-bT(l?!`K^l5I)ys0pLaV2VIK1JiObGh24sircuD^W6@Z}xitH@AV)-V_T)ctzOh z#R^Voxsi8ftT@OtkTB*W`-yx@ouN~>5Pg!Jf#%cV^=5r0Jy}CROs9%bXRPh;{QSN7 z$8e}GE)QH{9Tr7dOScZwsPqJ*%^Z&i*sOsluhsJAdyhsl~~RW?fs=MvCk&Wh;NKEUp#w*8J@!0|nNZj8=?8I3W05*N59N`tYTk5s)ofFDNUlZeQS zy8TuPU&w1XHT_`erMwxoktq#-FW$))p)gR*;?13TZx1h(HWMT-O>BGo=}1QPvljZR z(Le{!a!MWLsFD(A#nWCUTMih*rGEXh?={~Oa3Db|oYZ;U&ukbd{XjMI_g<0~jX$X- z4d*iDAi70cM5hoh97)bcO(|XJ;2p#79W$t1y$;uHEv|=l*@@aUhaJ=Vsn2_Xd|RN` z_GNi&^Sq??!uYJ)Qs49wQ3`XTR?P|UHcA0lciAu zBfUVs_diZ~KX=w}`f2gPqeB zer2I4ds!r|IEe0oKW9SDDg*P%Mfr_yUkYBgX3NQ3bGJagp$0{_j}1fjy+u?_t3g09 zMqg=m()}aN$UXm5#18~ca?du!V(TRJQuGkbNsAp1k-12siFzAEIX?WueD^`(>>A)o zF4$DkjBp<_4ju-?m>KTZO$#J?1^zmb{j(Gt)_28^`Sf%7c5YT`OzDHAx0jv?x3;EM z+7BzLkC_Fs6MZJ63fOH1docz*AZII_YTqUC#f;RB2%M*)dYeRCMOP3ar1idcNWf^H9 zlX}wgC?wi(p0i`VIrRK(;UGG5UBqQ!sKV?C*2_bRNQP&*_x>u|3EVBwK znW8(}s7W0%YV|WCi}63?v5MuL8|Uk!jRP7&di)Ql;kL1n`=JszX z0@%|2OCeJKZ3^MUY3-3Wa=eP6D-2!L1ontr%a-76AKb#9`% zk#zU~7p+Fh8)#{PTuheKn4Lw4as5*CNIL}s;PR$FWE9+TJDR`ut&vHtWWNPk9YelH zj6DGgs6FR8RPE`=lq1*_o^W zQmKZypGq~+ly}Keg_y<^`lsZ9x5VGI#-`1#4bwjb*~L83=Tm(iGg_~eo(BN*4FFH# zUzE1*M*-h)N?xPTZjy^Hh>lmnQ*WJ<2z^yqx&7YfP!9+5EhB<}D@(zvz@nGMk8M*F4a@H zL0*R`)~-=P-CL&4SjC5#!YQ_~2ISC9iqx&gMfl=lEsJ;hcnlYV+xmN~S#Wu}OVD=? zh`wA$49`o)*-q^ayqS3%=D%+hO1SW@w3uY8^R$E=#cZ#WYUv32T>Ayu)?elYm60hK*Z`K?e7s&VFhLY6evG zVtD77`cVWibiB86M*LIJ+oGXYhti@+{;RLAKQZk>XjI}saH-E4*Xf=>xwEJyI96mN zQXgg4s8<&3-RpBk*mQZz1im0toqHx`_Nt@AjM6f7@80BYZ6*?JGkjAF#6i9EBxe3r zm$(ihNApyRo&R8n(1jNQ}uFH3z($P`p~>xi)^fP3Vx5?XMa{ zQ3~&3h?;1|UWi$wpuIbcNk*x6T2z0S>l_o!BhJs=W=HoK)N{Jh6JCQsdIi4=`XU zLs8eET1-<-w}mchK3cZCf4h8=O%}w{ZEJ;Acdk}YeV2YNFoUrL->WE(+c(rb3R9hZtpr?j4^E${e)N^vL z#=A0l#lF!5YMDN;sjNlR)BsIvUxv_)lte9#o@Je7x#jBIGI#b@X5KYwhyz`hb=XG7 zNLQXt6$fIK-hneAhhg&ZLB!g*`}w!T;8zFOjpcAvntu7*1qo5noJryio%LU<7jd=F zNxQ-=AW&dbBY7f^S+i$R2&Yf^jnm?^AxC0i?}Xqe5?fJFsTOiGL~RCc$)dHP6A8_o zM3!RqtAI?^v3~uJ7#o`c2n>WnXd-VJ@4)+| z3MLk^9M#yB%bQP{3eRKJ9%PyxM>o1zm(am>JdjPV&{59&z|CYVuX9yK!R z*?(XS8nK zq+D>IB`T*?wUk9e^a*$2{?x(9sg^C$agB3p_oDj!I}C$KuEQg>P4qqeBwH0aB-#x*Y`==*1t??e{r5?p`ulpVQ;xTHd_ z8s#)Lm!nkicvXk`6waRReX=IfEr)7#}SOTd20l(C4g4sBDS9jJ{I%Y&O@A zo2M>EX@L7qjJ^s0hp-8j)Lf^h$GJMwx%HbyT0tgDj2VlVCA3|rO~Xm=AAI!hM-c$$ zned_UMYNGqK?U{(U%hIrV_Vvg)bv}wKxpNdV;;bRxyE4qHSeM3ZbZ32=WJ8Ivwaxevl#iufn`pV#je%KXdI5>I{^qY@bgAyRE zbtQW)SD0#3(h!@4vezn%H9Yr*X>Pqa1su9#$dpbv4auG|^Th-vClg0^{j<*HGwF6kOzunFv-)+vbA~Lqd*&!h2L%PyM<$ps`ujiCN1t{r)a~y5#;g8#l8g zt+9GYE9ekyZ}QahM>f)(*8@~gz3{x^M_cjQteSYV`;WY&dTozMSkDf$4#l z6%!X3`*}2lROm-oL0yEN8W=2y5MR7r%S!AZ66$YFlHBk2=Sd8DHd)nvmPBU);MD2* zQYAmFrsUt%ptCbHq0W^|gZc<-!ARS4?F0Eayo>fxe%7P#4>r)9bxSXfit&-k3D!{! z=oW`{4y;q3)h?%}6zSa>!qQ{M6UssCloBQ0_JT{+qCB&#!7Pg-D*}VXiP` zB_+DxC4u*ilw^5zv!q4e0Mm30z1fJHt_lG6RgH6HV}#ZVm)hO(7lqIWP-c{$aL+67 zb8h1MNF16CfyM`x_5xW`&f{j`CLiv?hVMqOck^GK;b+GC9Z4R2x;dCtQY(fh(S1|f zKG+^?jKu$!1aOh+2K~lS!@N**@Wh?@;qkV;Z|{Jb*d+s)!40VH^buL6hXhx&{gQa( z-FjLc4X2J5l$UokD65k28lGydna|BD?7ZYFmsj&x2hS|l>uv<#9+-40HA%SEM*Jy^ zc(OwKx^IQBCEjOU3YfCxbAI^d;rZr$x#Lk`QGRWHhHldb1LY+*j)1;+!SI~L$YR=M zpnOmnTDEj1WfWC84Y-^CY^Si`GDW`xt+Oqf`;OjI#7bf?5fuGJjc2Udk1oAbw#^ca zq6x+4-ckCb-17V;Bnw|;|yYD^aSJ$M!kN|EX2z$&NtZ27x=57>=$4d%^!OXCnt%G=J(0(zQ_(? z$k7c74RjlGpI_ccgiZaG5Fc* z)UGZl4a|6KC3je!pl>M9JY(PDc=HH8J*G}WgiSPb a^0f^l(w1q+w-yD=DzfhbBYwE1!fdqWXcyM@;jZ*~5BFk}W zSF|-kGT$j6(IXAd{*cZXPfeQLI>f5QH3}PUHe-F(f>iShdj)uCIt6hXyPN{TLAPXh zf&~v-FiD0!s$8uJ&$uP8CSdMUk6q(~6qld4G8W(yzs$y7GSj_Kt_$WBDAg5S9 z=hglxGW5pw8yj8YkNYp8jy>AHLbhRxq-?rBt50>A>%rU7NDlSs*sJ>%Ag*!7(y zpEGrEUx_`T%aD$CxRKO?J4w6jQUB-_4+|rcaaZRO$X{|H8FX5C<=WF$W|M}%=q=pG zB=bp@6KU^DJKYK+zxhu@WAz~@tOw|oE;=x(D=(J*KC^o_B(1u(|=?lNdMC>6U`)r5MYF`~tlORis|6k2_(f zzSz9R7g3_v{ELx00D}6h>}JNQ#+b#9FSLZu^An9&s+7nL(Z9edv~yrs>Ou zy)!PVD2%tKUoo@{RpaK9pkRBG6c0erY6P%3s1QTy z4CRb12Or&LRL`p>1*zQ5@I=1y7X4iKsf5NSHl@#8CxVP7;v6d=D@8~&;?$yf6+0#i z8h63^D!dpX{ zn!o$6oN6qHEQ`NWBkrx#{=AIVcq~s;`GlB=5^iZYx1AI+8}<=AZxfyHnZ}{ z3p!kY&{%)J&Jf0idj1I6x%VgA`;X<|uNFHa2l1C?Ny&9B8mHdEP15b4h{Pz-%W*k; zx^mN;G6|7yu?;EqT<^$sB!6#~pvQ!A3!3u;bQpk7=tY?vcQ1wUBc#V+jX}C2vAaS~ zba3|K5G0zb?!oAjXGQ_MOecvMmht?ji z$YI;-_f>72r#{kS1U=n!xwtLxg<@CE&&O0Es<#}!;|xP#he_%W0Qtg$o;I!pZCDF( z-TV9uDAP4hi6W;;e;<4c9p%SMy^={coF7isP!rwT;m+Q+8TMJv^)4LS7cgGZA#n+S z)wu-gODsisW1d(=V*f-`{*N%_pZa0V+e%twy<9{Qx_>ZhTSs~Oro@uTNVl}%M3wDw((a)do%3hwbOK&v0F}_JrzZP}+XiUK)};D9q#@l(X*V5DbGK>K zuqPD%3$9IJ?Rw`vmaXWP^rQlaWb!y5gGde7AsAJX5a@;N)H_|qVUnzSAO3=(TD+Ui zmbsjc?oG_y{N*;|Ag^*;Igo5CI*OrQPQZ&|k!~DTIbHdx)6aa>-|NoEum9-q^?@}{ zG}$ZXpF=*UR0CJrCqVFI#H8dlWtF|JIJf|RnPd_nLK2Fha#@Oo2-Ucy@YhGpx}O#} z?=%N5!P~*pcW!&p?T+oJc_o0~VP;e%Gbs7-dVYszD5f}G|SKegNQUVuy> z>w!fQj|%BI1$M^6YRhGWI;UY?lnIT0thM#|94V1a&PnPqreI(J(p!oY#(pcm^ghjc zMh4~g0+ObzVpW7x{BOT{!QdXfJzO`cfNYxff46nt>seo%rb>K-)NW?^2B%oISt68k z!}qD=;h2eEG0X-Tcu5Ukn)RKPUds*P31{Xp!KTh`rWH2)ns_)a0kD3u0ox0qEvit7 zQuyo0;$8opuo*y=Z_QJ*JD?3Bb|I8W3Z(3cLou9ukQcD>y+vx7_$!}z!AFS*HP-Ok z&;t|5;x_3ON!fUdo&PZFZ~UkK8qp?qeDMII*8<420_tTK)sQN~gV8!Ua@VK{b!}M# z^XPA8%kGS{$YyZdBatJ+s9N?9LX$RLygXq90qp0kUGW^SHuy3(F}OA09qs%*!pDFFB8As%+k>>*yBh6=3cm-K4)CYT19c8Jow^~0qiW{cD}24;N^h|VwQy3m z(B0MPy5FESj~t!&^@I3QN99LixwTo@qCPtc%+7e{94qk?$2^sDXIfz^nI$1id!v7| z9{m?=`d5maD6CEbUmjDI2pQwIHQJ9l`m-kyUoN}S1G zKX6k4VS9SDzzw`nZ=o0vfY{Y3ujg$p=pwQVJPxxgoLw@qhkjB+4N(8D{|(%TGyl~( z_VB0cItgT4|Ddw7;;Y5WF4W69s$o?nccxHoZ~(;E7}epSifnvvqLSi)tQm~gc@;0~ z9Fob&^H$M_WfXZH(LW6loiM5UQ)c$JMg>0jV!-xe;g~3g3;6pditHqI$w%F7olFt@ zIqWoC*U9}q-cSOZO8no|vHT$(`D48Rlq6=r_7uTR0ZtvP0nO17usrv(=Tx-7Zb}o} zQTAJw~MM#$R?i{E&Ij3ff?qI0sT>#RgUz)K^Z>L7brcZ_XAMKpimI(hseKm!y6POEVl8fN)Xw-_|4Y^MkO_IgsU z)QKf6g*1a8}O@P(p1xV479K=kpc&#b7{vwI|VF`>7!}PR5@0x lg>d6P1|Be?!&q-z645EWS+++I1z7y?2vG(incU8xT{T}x5wvoE|PLQ^O?JWMo(a2P463R*%m z42E<#!uzh_@*+PAoR4Lhh2&pKV56%HnZpc^!(g$Dbr@z8T;rhXkLZ{AmbvVo-M0q4 zrA@3&AVv$f20ppwgCK6lp=GXQtt(0)p-t^Ev<`+V!{>W)HM zux-qRH7(flT!;%Vh6o8EN!Xbp97syC)&#NA1(nhW0YOf%XO;J+SDBm0kb(yp%`gSg z)WRkd(bU`~caEAR9qH5wqL&?{myY6NjX6<)2s;}sas8_ENHJ3s(T5msO~^NyIe;5u zjqLU|P8oL&GH(#^%MvM5vz~x*2m? zkZQ1Ky&?BS(Ez_wXM8YOJp_f!iy6J(kWBoiq4B5KZek7`+S)Rc6X#d?4bdd{u)laZ zSH~NZKNo}8WH5&PaZAt~3UYjs^3(X_bKqr0?NkS7x_YkG8F-Si)3ipC3Lgs&qUi18 zxHX>$4ADz7o@HaWSzrz6AaJV`VhN#tF?EW6SqPwwKrvCG-0HrV?@c%@xH%*>3Clqz z!}nqkkRc{6txDRYzdP@e?!wRw$5z7*!KC20Y^z4N*}IV?wMLWTk$U7O@0!_p(hkTP zeJ6XQUMTrBX9%Z(h8{k2diXGLv&-zzww#t(IJd@k=EKM2?`dIC3_eJT9Z?bkh-(-e zwrhAi4OdF``O9)#$rHhuXI0@F3o^@;F2~}EBU6cEbc7Dq;t_}3uaA|X1`R=*t~Wo9c~#Ny zQ&*xBqm^LHA#l-1f7x8_V#Ti%d9tzUPFXey=M$1+=7&M`If%wHT{CG#A%T3fIU(Jd zMKZ6Ot5vD1c#=(r#`93JFDB|r^HY5F(eJI?^2mha*d@OHN0p2DyU&J0g!y#N`Wx=g z3*bG5fRX%T#$T>8#0PJj-thSowcw)Ic9c%;wq#PUuoF>-IyF zNx?G-+SY7o{aOPAOwQHiCDBbmSkS%0u~O|&L-QWtKE!ttsFjN-sN6<{><$$oNH3I& zl}J|D#8zzXws3wQt`oR6Qsi)`U!>?ceh6j5hPCON`iRMpTYicPud)5H^f}bwIQ@$C z;bu_q+aPV;q{3{sirHW-1nuWR^TRE!Fz$$<1q6(uzcT!yPIeVSzvf#OBSeWDD!vw@ zObOj5o)dzR;``tePazXC+50L7`xa|9icoBr)T&o@12i7mC=ANNl@^ImK$?Ig3M&8j z8b6RaYkkbpfmJgg@jKF(bmgnXNY3vPWA-~Ll|-JASNagY+me$xwt{}KFky$~8fYXF zehW-6z*0w1jpFFgyJMY-bTlBbAs=qls3p+uh;hMSYNc7PIDx$}_n=?$A?aaWzdp5o zK=PG)M^lUO0MFm9F3f3wm>I9|e&)lB1UIC!65J|djN~T_qEL_x*AEQ)kl&$5Ar>Kg zp%Nihoxz>N7@?n}?Wka*4W&F3A%DhKeyL1zNOlOFc<&}ZMWz)a(7U?9ULLRgp@bAn zK|-!aE=YE*c=7h?ji5Axm}H8$hUl!Q*$?gS4hn8RUnxtNLvX}=6-kpR&Y4n@S2$MC z+uzxl*}2&ZAB));9Q!#jn`^JR-8>BUm24=mJ2&@td}UxIVs@^(yr!^+^tTJ0C9&F1g(>FTPyRU0m(xjP8%;?eOi` zU*6tTTohhh@9Rw;v*_a@bA@p9a;fW=4XuQ?DT%~p`Wqx?j+S-WWUsPx1S5wV46Lxi zgp=TY!==F`5*MYAph*81`LS;7b+&4@wUNj=dUs#9Qbb`mDt-+c%Ma+doEU&i=?M)Rcos19CND1-TWO39ZMs!Wn*Q34at3L zs8-ghwn{v-o5!BF=A&;Ib7DK#JFuQrI+(pOyid5wJ6Pu7=FQ=L*cjb8nHcMg*;e0B z-*)KW z8}$T35$mcus@qQ9wDzAbM%OYUMD&m=2ogCh`^uC$nrq$bw(G!lEdmQRH~Fhw9p8dm z&TLN6T$Ek4PjlRZ+=s6$&pdeA9Rogh&Y^QP;_7BMd7YV`-W?pSGhUZmA6@)9?>qT< zRX5CO*z*ggO#U9jL&U@Mp7`W(W&2QVrDpz^*_-QG``PMAUV=CBO~eBGnSqZigrL5N zkUJ^;I|>_5efMZbG{Jo8o%dx{W$#?iiR##Jjr$+fJ`c_}%m{+z^5O&b>*a~sZYGvCT6&Goz{;IludQ?5{!GFQTX z%gAG8uQ^g%W=r4gnB$(C^h1x}nA>abh7EI&dPA0*`y-g#do3MVSX{chI$Zui-3z6K zCN4=MZI*EbQ57*A$vswd8^S)cW+xy(0aqZnxsl>P+a^`V${nEyVagWrc$qS58v0zowFQ;FA zKvB5p3zj-4KIJ#+;i{{v+;~Z!#S18*{E*H|&)8zMda9%mTNP{h(36Msqh_!yoyEEP zF(oyHz=W)V)wF7`I!%YQ!APz%wb=frz5Vu+?tyM&<;@W4TS4|D_4vWJt~W-VQI5Iw zxo6}1g166=*2Exr)>6mj?FW_fmUx7L;lzd{wRmq$QgxfF?Nvdwr-hn#76$v|$6^*Z zm^d;xdRiEjpY|2~bH!vxm*X7r?Dr|3**H~x!>f#W`IpFAXfpg(EqI#XSk;^ieyJ+(2=;Uk-L()()`oMd#$gJ->x4y zFKQU!icpn_*g>^BXqO6onav$y!S0d0kq$&dpt~|-!+}F1qbMC7(3Z=7Xg+41d{73z z(--@_lU<+RaKkrgv)+lG)u*Y~bwTI4+t-grm-o%8$5TN_Ae^sEce<9=1hY;%ile#N zNg~V{jqMF~N9Kc*)fQ6I*4pwdOI{)_>$^jZ-Cm&WH zdWM~jul%n?jx)TYPgbr(+B&wQ-b8^Mk`3;@6nue1R;XZY$ebrb~ zcp>jESg6O{G;^JT? zTf}8~`g#ruLXiz3W7E^K$>Qz~1omrNf?4VPH1w!QCF;VZPLeOICL3Vi>U_q`is#+G z$nmoth%OS1)ul{iWg+N*Har9@BnAXD(1Ha1ARzG}VE@sEfRKhH`0utNB<;WYKtVtR zn?b<*tB)q|`{xr4e1Xyb`h|`Sf`9}5!vMYk-=Y4iH*Cgt=>KX%1Mv<7#Cs(XDJkGr z$;i&w*xLRx*kS#tj{-P>U?Ztv4*`Kq_2&yIrAT=K0RiP`rmXIuF8hJk2yDe<@Cj^a z%;aKa^XEPg{4Tse)5_SvfYimx(%PQaMS%PtJ$QlkpVQ3br2pvRU?D)RE~`K)0=6?I zq0EId3s%r@9*p*`)(!?PjMnxP|Gde6-AB~e-pJ0(#=#71P5S4)28Liq2LW>OKM(rv&p+pB z>|*vmPqMcE*Rp^GGXJ^4%)<1J`TsV|!OY|@!~R_P=dgdQ>z|L~|8p~56?%*EJJUDOO1X%DOk#LCUZ{jXvF`_lh)sK);cW#M}F z?%#+0+ogXS`ezZm@^)sxObz}}5yZmJ{2%B3cYj4=d$6VBpYAHwW)2|Me+~Ixr~fsI zpZU+m{M$zTlMDWF7GMJqB0uwgvlIxiW!(iG0zwEvO7y+53*tPj>CPB*HSLvXx< zGX<%i;+Oo8fLk22_m;wDZ{9@5ze7_NMi)~ShUp~7GK*)Y-7V44*I0V?Fueu^8HX-X zC2ls{Ej8A8dfS^O-fj)nNmYZFkKzcpDWzgX%T0#pW>}*k5MDSak)a?FvI!1gU+NSs zWJoS_%ELk=8yN^A>GRhE10M3r2*QR?83Cmb)L)P2WOxM+xepR?Mr4o}q<=enVT66w z?4fwj4qm-9HA-rzHyN0}$2Qbon3p7}FWUE;RH4@}4e$RxFCnPVP>8PWP6u`#?7zzkM=F-mZg1kP>t=%5r;Z?$SUMFt9{a8F z#6d_%NV|g>mbcoqWyplw3c|v|o!d%mpI^Pi)1csDL~e?zg{ z*@=EiVy2~)wA<)4*j$swbTl6N%AxDnS!I<-@i)Q!$N7*Hp+<&`k5rw@jjre2+V{qt zLBYX#;!Gwli994mZ47*;mPfb#The98;8ahl7oOo;C{L=p##WS0#*d1}D(ZB!@K!30 zy2-MJfJQz&-g35F>i+5wHte--WJ6?Olt1H3vI>EqjR19ukue4dKU%Zw)gbhtTi7p& zpzIx4r+K{TzcccGwk5S;)|ysGZ2|%UI;BK|s?L8Z<*kXmS>wPV495}1rhaJ&^l~d_ zvI)%N4%)>@>zYU8ItCao?>rPK8gmT+T9kYSh|zv)@U&sEmT-B9c6-5ExlmQs&(Ck? zoCos5D<|K-s%StD+SMpXzJ#hm#d;UWj~ODVG6iQZClKvV# zw!NouqNctnd(}fj4LMy$C6)hFVzg&($jeEH^!G`$R*|8BPx01Hzj9bm^7HenLa~d^ ztgPt2RroFxPJUR0_mlvJUH2g3!*{Lgazt9(1L=p0kQ%T21zxRKYvRPRH z->f_vkb2a)yxtQvaJD&MyxEUcZaknmTLUi5kxr3T%#&gi3wx75x3^ud-{z-gNn4^r zun8fVHOH8_w{P1*t><3GVu3D0nV$E z#bT|R-e@urN{K7N@zVq~!y?3~A*HIrv22OHR$u=dm(w+`LKD+j?VpNN8jUW$5N5i< zlFHn)HNz8FV_%%3(8`yP5w!P46#UuDzlOYhpY*Oj(?E3W)dIpZm60j3oVcCtuB$&u zB(UH#Z&mJmytFg6eMs<|)_|DY@q_Rs-ZCD-2MpT%sggK@jv$MB@ST{|G;@uB<6iv5 zM~i*qz1N>se0;a7g5htngCIQX+U`Q&Uf(?j-nnGfGnsne(1)>4_@d2M7o)Yj;F^@s z`T7)U-peY~VG40s%~39od?kAuM;+6!zi8FYhJ9jBPR|f^>Pwo&s8x;I^=ZZK^1VXf zBn#-~aPO4dQMIp6DW`0wwUzXFErQm6r5Y^}3Fob$ZAt39<|l@hQIdV5*a}ZktdeJ( zg5g}PS($KVH=;<$esN|J0p@F|zk6~e%)aNc_N8EN>zS#Jj*iWfU+>N}8DwI{4%0e-5yL)V*S*sKdS>eNab~vj-{40_e%YR z`ilURHpX3R@ZnMi~Dt-mRBZLIc|_XU^mnk%T-s(h2jQ4)0LPwRN;eh4KTx z6A09@GA$t#&UigPUY|`UG3MH=wktM!xW3h?uUwd3(LJB^5PcMHC`YrIuX5KoD$)?S zyWFSGl}U^S=gG&x5pc$LqjJO^Xs{s^{ZcE{wK6=#j1pwh;shtM=F0prPaD4X$8md; z1yavXV1xkUfCvJvexgZm5{{n7Sb$k)-P7~cJUI4)*roH5E8N&wM=FnEskP2q&C29> zdNsMdsh^C@Ef29(z92&errJ{j?>0Z!vx5pND(|OII?Y({n+~%~Ncia>BGLGGBT=H`M8Z_@d~dzuehzrqiyDeTssGJeswPd*41QZhxk4X8LJV@V-#;c{ zU#}Ww*TRU`RnaQHYsryL>kqJ~Ok!1`lghr8D}Z%4+vt1L`Jyne)z!irGpJF1(`B?F z0goD0nfO|1c`D&N$;m zvmL5>6(+KqSM!DRc@yO~HC<=5Q*h{>+rw#gC+bZ>Det5jedR1nz8J)yT`MGxOh6un!wfRDZNEQi(9?B!a!twhOkr8) zGXnxltib$8&O~NClXm+^OO1`6AYe-%?5QZ#QxzyxdqbYM;#kyGU$hC@>#kgRw0w@>a ziVLwIgbXh_0|Nu<9bUa5v=nqw$qqHPt28|m_!cIR5DuKE&8D_)Sf^Ti!a3gZZHcgU z`mxDyEXz9R5@`e%8f1fc_F>+XVZO1>e#j2bNbDZBBS4-;U9;h;w0B*e-=MvMp5Xgq ziR*S6tCZM%V3=2gIoPHD-*#X8|^gLCPoZSz+hff?aS@sn-?l2ba&^}HWqTehx@XRIy6 z<`a?y%eKLr;sn+VAwGdz?W-NZkD%;dEgGJ(^63wOcbUTsC?u94wEL+2YwLF(0m1lb zE8!@kc5gGE72)F}B$dROcIZzJ1>>ZK?YiK?7^C;nmZtsL(l(Km0Cme>@Opi*RJmrq zP0mgwNcww>y8E-EKy(&U4}eZ}NQi$sQXk>NYzlLu7j(SFM)$)Fde1)>tcg|qJpW7P zH6b@?o!#b{$?3DWZotlbFLI2T+)PAxLnByCkGQJ6yWJn2Y1m5XC-W|OAX5Ji@8=ki z;MWLO=qs3R`_)8HH6+03YVMGIrrKq+qw`H>Qv2;8XDR9rB0i;RrRm6o?2`4)t}5-q z9UHzusFKYdw?pOlDQ`jdF{f~UH6s7qx)TE%VTK~t)uk-WDswu~q=W|Z$=D;E2FVPN zCzZvNyz|;zDpEd*SYTtx{Wt+}b6}r5 z>^-%RUV+#2>zBk!EeQZP3OlDY&V>VlXz!Dm3UF|7DXr424Uo1Le=<>jNuo9Id+Wh+ zywIfPc6E^198Z7$NR_e7kr7ZZ$y^kLUJ^CxR-#hvNV!Kp{@8W<*xnul|5h=l_HzbH zdh&y8wr&oG^@2Jl;K-=!pT?c8Z$xk{mB~*t>E!6#Uv1sbZbs~3aJ|GVe-IdYn58<; z5GHt$fFOtntH--bM}ww0R;#<3av2=FfE&W^S?1m0c*Qt2QjjuB0|>V08fm{H27U?- zyN*h-d-6K&O{k`ws}MC=b78AXlJL8X#x|u(v`(B3Ww*N*sut&b%!V^guiwT6S>|6H zPRq*`!ny+cG>GGHaaZ?}yM2g|>e%RhI4{S}$a^}$;QXsBLyc$hBk$=Ouk?xqyReA) z&Qyp_ckUWmoD;Q&>*jVo7uI zc+4v@!m#H$pF6fsy`;tIUUOMNuRXO)hQ1nGMgz2*$K|q4bvRlO+bgiZ01J^Apgi@_ zWb{@SYdw0RD2LewY!0aPG7ApH01BzExMr)oHtceY_2dQTYNY^^yAVV7@&|@9G@6e0 z!>;LlJd=tdom#Uj0Oy*w?_LqjtMETgK=9|6kn0{#%HWWFIKokk8Lf9D(8#t1w3TJn zhi9jt#*>G0#R3O2ot$?H>(BA9=i38o%Srhe>#knWa-RZSbSk=uSna1Q&6Z2j77A6n zy`QT-;&YkNXj#yV&)`7|vt>P`C?_TJ~GmS=?2NQZ-&_l#XgGGE!vK0V$!p55&? zMT>!+4FeXkm}E!crhibqNWFRh=OvUsklSHUtjyN{ytn(XBHb!!@d)C>QXZ|u@bSjm zIJ@UZ)LtUz1p_2xH!;PBAhd_0hGVIrug?7&%rt%QRd!Bf^NcAQ&2acq&ydi$!hwj` zC}H|A@v;Cu5{`Qsd7=2xeLP8T4$cf!@Qjwzi{;81%X8WNSOAaJ<-5b-)X?~n%Q^~X z?JwxC&3-!g?cSK*dfgGs+}tx~A{R{xLK$DM=$Ty4HNaIW}Z$cq9nV% zU@`VzPUqUoynqvU!c%_aLNQI-*UbQR7OI3ql)YIoQwb<2C<)I`^VFG{1}3nn zj9Q#Yn}lKdwXpA>g@t3Kj~42Rqk7@hh=-J`nEx0%vM*oR1{`Z;MD{EwMG`4-Be{U{gplvVA>S*1FUfQG+wITd9raIDJVRJ1W#I_RgE3O zOt_e8n$#OUya3_WHvf5$-cx9cqq26+zWD2YCL5#Xb=#k+RbL!-=Qz4S zhM8@u@`8+2=9A?P+XWQegW;5aM^7bBU}{(N{RBlr^Za`viQ<6BNc!{Vd_n;`QSxC? zNkD&4S3;c6?x%QA zIZj-(W{T)oU*$94<3c2fG@+COUrQ%yi^A^yrjZx_GX5rW-NOb`^L@y`80^;0Jwoxw z0qS2?0>qv|3-H=Xr+BI*kiNcjtTZvu1XBZ%%QyqRV&_x`qXzq)XAWjmB9nWuO^U`+ zdf&fm^reS}aLbp4&nswr`Fq?CphYX1=(Q%GjIJ&R;C`$u&`^{U$Ua8C9;Zc}bBErH9Pe80i zEd)-zt3nugOP>@s+BE>n>L}?;xQ4_>C#Co!4%6bPnp<*Ea=wJz@hend&P;X`QX*N- zMG+eA3rL^j%Bz2(_v!xr{+km&mC8T$Vcc$g1An?cS_EJ+d>)URvW?yt5#risubLs32=IupDE3>u zdIEY}HH4EmgGtDNVWLdJxI=d-)?C&;8r@7UP-DRXX3g>zc@-~lh|lRDxsQBGY)(gn`0R@!3SyOHYz-BmGT<$s=NyADdkRtUpNrEq+M`CRv#jz6y< zuUh#*&tBuK&xOPNbu=AgMyw}&V&4+@$3P@ii%gJTpmn`}2V~p}8`Bygy;9`Ar5@g@ z!7t*%r1T>k0BA%3pPup?7dR1}Li`U{oC83(82Mi5Eh(I`=E^_G3zv5&$hyvC6vSh^ zO-JHWBKG>nboi*=iAf{;u14Z?Re$|+@?x&$Rd0PWxDT?JPw(*+Mu{1mw;pAle86sd zfbE_&gLrq*3vmf>NzG3vl_BF-KB=}<>zeCeGK*r4Bsym1^4@h~rNy)ytLZR(i{p}|yRnl)Tfs|D&tr_-vTJ}=OnliyV;DZil zhk}DWR88*;Zu|nT98bSt!;BXU93Y0I2ACmLZ&|Q0KYV5XdFv7c-UfgqX{;*CbPkKe zO4lC|Z|IbJft*l@wuW#=dyYv2eyp6o$5jRR1lt5r#em1~NS@C5UosRpyT|V^q11o0sYCAN(eXXVdT&|>n>PSB2 zJ8scPt9f&?KE*s`u2HGamzEBIgo+q5(gq@Q8k|z{8}-|ue(E;W2LuOy z!(tQNrAc>b57?fqF#X0CxpF_Tu%#BaUirolecz>X zJ$W6aXCgzn@e{vR&O4D@I*fRRTOQ-=f|Z~b6(V4nL#j5}x*-NkY8NC+L20Xg(1}B3 z`XJl2fIrDs%^GVf5k^g*bTTMNdiY@WlUg0CoyV;-!rN4>;na}I=+|mUdu-;gfQ%_U zzmHWa&Ld#ZB5w|XpS{>8pS?Wg#>}ozDa!HUF)WVLBDr~yAe1(T2%S3+-!YdU}5`84(E+6&f;Sm^hjoxa=*dE zGcce_p!Q#n)Fhk`X;Ga_U0~p%QJ&*-#1s{4_L^N{dFr=sZ<%DbM!%137JAQ9EbJId z=>X+O@|Q8kS)OU#xb4Gxg?%JV_XwFQwUY4<9d_XjiFE(QZ%jI^*lprdbS;{^o>hglO2wR&45Sa6sr8XgGCiJ)qcaJy6TPj zOm9)aTRsBpmms$2R+RUoQ_T#d)E$$rM7KgSLj|ONSL3W?n`0d;J(eI^1Is2 z8U!vO|h zvVW{X1wc7kMvog3&;d)pAy5xMBWHhj&sReb;_p}))-c}AHkWsUjEMY_U5PG(?{sTx+gS|0L4xFE zXP;meZs14D)OnahOV{E1fAe7&{`fG9Hu{g@5N)#r+KpV1EiWYX0JV<6d*QW0M>wmvIkjS@Gbx}idyLO79ZNwp3;U5z11-1uLR+u z0qV!Nwr#ibr2rhn=Y$a3O`BFo&vC-?FPTaVN??H6X_=5iLrh=|LESOXF5go}TOs@c z%V6?EYNq|wm&sAej^e1)*H>s`Gc5xE#QUQ4#cdh1#|iA-CIrT7}%tV_ARdhdxU1 zW*xI>7pP}_SgtUQ(nV6l4Ho4QdQGPav)~E@mQ42zYJjw;C$wOs=#W%fFOmaE+8iJ& z>IavXTsT{9+)$ErlYmRI|K9=YzZ$-sLO#@m0XsEiBZSzUVP&xZMq zdmE0MXuvH3%66Ydn1J$~%Bg4)$i(rRi07=9>Tnltx5@|AnR8=Dmot~xA}_E&iPeVf z>CIs=^gX=m`Ib^4r(BFA{zEf5g1+v0Cc;qZ^=u~o2JJ|WA*oq=gL?~F4>Qy z!5#7YsxM~UVwQuKmwHzvnudW9#|G+Mj;{<|nG%C|qmNK< z`cctG27btF51;Lqh85*=JqZIZ1{#_zfohj+hobD3Y{;gP3IyE*lKP`K+n|cFlEmgV z<0U`=$!CU7tC#|v@zdXW=5hFiLVvyndp%UQi1v?ZT{ZHjJ0yXDVyf}&A+84vokqd- zb7(UhX=k$}Y3E6@4B*v~=VsC72fJ9R$LnQpyXB_K%gkf1`Rl3eIU7fp8XTGPt@Ed5 zWjydatuxOpbNsgAY0_`i3;v~FCtUxVN3|KDl(E;Pu(|BfY5=5%zAFqTNe`PT7MoG? z4_ZT|QU2+w?;CRlyV;yFz(GdEWP<%|iuf(38P`?DYI%Y>=cKis$0#`iVQ$*Q_nCT3 zLkShtS!Z>PC8;v!Q$)mG{VH9I2n*3L3lD!%<)2plV8;v9z`MU|N|C*{b)?dGt0E9w z7aE$8*w5EW_iXR!)k@-@9+%6{7r%{Etw-1!H`y+E z+#H_O-Zi=EeC2xGq9erXM^B*i_u+n$RA{pxi*kOP}7xpv!RJU%lFyJL>u z8rnWHbg#SB!Am01;!5{^x|OJR-rrhwc5S+BXbd@jHQ~Q9uJdTU{B0T`0||#I-gdqF zF3Re|Ch$Do#?ul;u-oxc6M#KlVh4h1ycS zdc|K>JIbZ!JKzLcNlJz+#B%KOc#1UE=p9{m-5ri=-{*G_XxHx(TrJKcxn$DlA z`DUvxv|^Sh!q1P{K?qQi9rR<*R`b+>7mgcdN_ojc6N1|nPPlC$Ac2o= z45?cA^|x1pJ?{1#Ai0zc&0{|2gYF>V_)b^2_Y9tQ7m3Y4faPle5s!fQI`(_(IdfA! zoFVhD1b;0MfyA{~=VX$g-RT>Lc?oOVKVC#aGr^U44=~oKyE+gimgYl0_V|}0h!Z3W6ptY?|_Wd&O4MH<^0mrpvP6OyHSL=k)w6ZOnw zD(k#qFqs*4iC+I=(j*BD_JQ7T2BHBFVvAYQ&xvhEE=e@_^-sWgj~-7Ws%K#Gq>4(D_8aDy7^mg@^aVFXD*ytX<()-$cX zDb(Y0Q1$2*P{>t`yoJ(V>r%vHt32QC51G20kK}5b{vG@uet=CeJPbhg)k}-XnaR&^ zTza)Bc3fU+*%4urp-#3&Gr9IOu19s-2i)d?r=;Em?IYN zB*CW>e+C7a#=XfxEt07c9SY_qApibzCxOQvyRXFS-8l{|DWFR7Gz?W+vg?7$LGhwLl2gx4>B__A8tMx?6?gR!Ar^{F>=@zE9OeS z8q_E@g!8;t5o?ZgYhLvo%|{h4kkk>f+Zr_6zEabZO$4Im6n$7SO8^LRI%3kS74lMD zJ_4cy)-kxt?+^4ueErf`)`E{4n3$_4qzI0|0h9@))ZSEp8N^aI%|fMJFF~+@KHH-& zovFLMoYw0D7L@ZLrQGT1edQ70X~0y6W_VHy?o~lx7Y8C?ReNO-huA{Hy;jIL*Xupd zsQ4674@sw1lA1PB>$Kw0?Yf+MUic?pk~}(JE@nTQzx|Z|FR+`O!x$aZ(eTs+&kgr90Aq0M^)0&k#}iRrkRO}pz}=?<;9@mYNxf4bNL zN29@{7^qKCEe0p`3O+wrO%rgL)CBG<9{(Xrv+VucL^-zqZb@>s z(Y0bzr|2?@L~wXZC=`P#;?W24(Re*5;)>J;sFCi!f@@e>^IfAf=5g4Wr#8U`a1-yM zg~sGJ-?)MJyu~c<5$JEfJ{eq3mzI5OR(UBP34#PhMdI# zX6ai*EMtIcSuM7ZH_Jsx6oxBqAq-}#tVl2Rftnq~X*@990Ls~z1j$!YRO=f)f1cl^ zdV20Q?+n`W%r^z(s%hm15h}xOn^d<2h?jhN9CY%p0N-$|&f%(2s400~Ch?)f-o846 z<<5^s04U4DE4_SbzH#Pzrc)`ggksowv?y&dL0WDGxYo7!g`*quEEVun$k&ci>FgBx?2EJ?Oy6v0nurH?VHh-Rd~Uj zW%tx10#55_aP#e4Bp3iJCt*WD$j8ge#O;IW0$S#~3%>cD7E>S2b};4VpkHwj7l!;t znTibu!p>0rvG~(Y#E+6)XYu3g5>K1Mg3WKG)@gGfOLXnVFNmNj%JW^>49^Skx$(;? z8$F=Z$b$}h7SyafamGcAqHs08H_l)R~0l*>+bI=We%*_$mJoU zXK3mHiFR<)=KYF4>H$~t-PPf~Qs&?lQ2uFjx$fq3PJCFfbI>t^KCw2gR{g;&1JR+n zw1n6LmD8g&uRRrYnh54H;ZQ^Xp6-*T=iSM`)hQRubc)Ky%_IhmwFW99-VBgJg#%Y} zl;G3M)ncucL<_H@+a#CSIOV*`{)cDBJdKJUAgoV1oEe~;a})yJiK~Gm`t{>uU+DWw z7co0P^@%kD#g}K9#8~v6wTT?o57FQlT_tohZ|A1^C)d$TPxs|#03z(q)}!N`SGPeC zSN~-g$m~3P&<%B8a-2*6Pxt0dx%J9k(O{}yLNF10ab$J7m_%Q?_WgKQRbGQ#eZ4-C z{i0#aAH|a{#+>sijtp*PQo)Tt*~+BJD~y zi|O!nv!uqyBnPeW6=gN52l`pSlXstw?4-XXs)z)`=%l0+T#{_fI=nTBm&sDs(+UHxtX6F#- zfFuQ_b$llI@Xk71Ld<#KI5KWMcdapZUj$O7XZiZ8^TO&k7NelUk=rMC88zFv;FeqT z{!gQ=z96g-E0Po&uS^s|c^J=D<86W&3jHv93`e!;^QEdlBjsv`w*>b9D(QK9wpH!j zl8Iaby#iP#?^{G1h7~0w3(;^U`BABHI8ORbTYZFMAVEKBJeR9T>;O0I#^akWA|pw{O!(jF z69uY$yX;=ptqSU*)@=Z}o&{{K;~-GJf-0ly^cYDwSG~QO#~aTd6EV+JpDQ9^Sw`1i z)GAbE9H_Bf7Y`G`Q@2=aR37U-)^b{?{iP_yn5MF#NIx+YOCcdwmHe>Kzrq;cYp#MI z^BE>}nVSn8KxvtLHF1V{)FraKz{z~qIQA%tABtsTUWJV(?h%{*&@5hS41%R8VFTVn z;3(9MFD{zOMCEiHEYh=Wx)Hrs{qX_MzQg~ijrR<&9v58D^xJ^fp+VA`tMBV)SE%V+ zs#ls=HIS4d@77ol6|H?A%I^}fTxTYf(F*+@mdEU2RK)Eu^a2vaVi|ZBsL$F_#|J`Y zZp^6rn+j(M&x!AIsHR_VK|(1PH)0t~a2P`EM<3Wi`_r*3F_~MSh@vP2@f(zdd1Hic zG>tr{jexv1C|5qC?O2-3_3X`*b1kLsCL2TDsyO8Uqs9eFRLg-C1|fxdA_XCzlk(H` zMw}|KQHk~~=TEh~>bsf}^IhOIh2NQf+dl~OwBW(zvainqKiVFSx{0_nJd*LD66jc_BR2-Lg zQ7sa*QC4MByHA{T>%kBCn2$F%*-^RI1mHRCF5AHQP-1f{{?*^|(I|LgByL};c$`+t zv-~w#z)JKEFoa2Nj{C{EEL)u2C%xHG{SE@E@IbaB(S48Wo%iZzOi!1G)1E`{qM$iK z6v&XNgB8d7cdG`;!wjK_?t^SQOV2XHK}Y+;VodgamS$rCBQ?sSwf_mTTlmb{x{y?4W z`>%Y@#UK9zWpCvmM{|gnlZqc&5yv8nTe?UC5gBB?vyRruSIqq~sIUr?)z<9ken?GZ z#&+nQ0*=p2G4B`qL(pednaB4X zxv#88bp*a~S;YpSfoX{c{_FXWEaZ$rGk(19(C209`X1wDxS?08P= zR2|gNL&q>nM5ag$iRl)H`Y;FhevM0Cn7tn8h_#QP zyv2nMTj4aI)T8G13tXkmPrqQi9*);c=4jD^?pK6P3%{a_%FKSZ(3wp4lsw}aSRX2R zPcq$17>6UdK)B0HRXp`t5q=G+U#;NzcJ=$#M;xzn9k=eZ)@|V`CtXi0YnUn=)yQ|$ zTm6xTLVpR1?u~1S0g0j8YtP;|PV@Jo6H%@RTujdo=QTQNE9(ma`F4(?!;1>HTHC)H zj+^OM^CqSpY@$K9(o8=mkJ*L?MkZByqT571-HaNHOD#@K6sTzF+-<~`Hm8%DGcx(V zLWv(vYe=q*I{j`nNa38G#rPkuXV%XBf#4zAYsZG;xS~S)hM8%tFB-FC$8$_^6olif zGCWoPBx<Te>@^4G>@=S{=PnZth9qhFvHn4K!ixNfCXS4XE@2aQi=^ZG0i zX6Td+Y~rza)GqbDDl8rFa#{~3_#85gR)Q-@`U~A=8@dyRVQVsb+hU6kca1F|&z)d_ z9!Otagt1vaaFZ;w>!BsT&hO>3oUwVEZ}<(9OGlUCAP`OvzC_^v5cbt!QEqGdf}kJ* z0|yq_c%J*Y?|W59kmM>)p9Mfs;!gs568J+eFW|xq8Z$-R<+E7`}nVka_-ab__=@?<4yxQUBNC>In=Ba$|13VXiQf6(5 zKd9&=&lQcT@uwuUklgV+ggTK*r((}jm{L_bvI*^!p_$|hh#vtAygSvDEr;d7?*u2w ztk4ZIF2_@Mf7De+e7gCZCs$JZyIoh2=VhPZ^B-j6vYsbRUd|hAu2z^4A~YO!!jLpr zk-MuMi$cxvxaVxV_|kVJUwa9;4~VX`x;R-gJ5WYF7-J*tsdGDCcV@3LFPG3A5N2Xf z%aqeTLKjl!6-dSA$(VSo#m6qT>PNn2xi0nCs+M9?MGtR}W$uTslX;*N={Ap~ycoi} z`;9h_+OyL;U;f7n0H1}l**1ed=c==TE6l)YEeo#$3CZUE@JWTV7zqLPRDu5U$+n`l z=4!P3hv&KZ8YtL;^WS-%KYs;%9a?dCw7#gJ?R~l-MkH|gQbd<>VPXE~mK5MwsuE6P zjyANgJVobm%N=07%oDeUK71H>$q%ca*LzN;Fh?TVcsX&nL+h!_JamAn`}^XM&ueZu zy1J#%40%C;44X%*@vKI6R=kn-KBGy;9qebe8(K|AsMxoPsZHI|Un3YSknoFRx1JE{ zb$f%xo#s!l&im^Hq#jK$e8vo+vZ!cm>s%Zpy(bqDNAvgGMG2YII%jpmjs8|4Fq4>@ zs@XOhF{LuS&pnR@7rKalVSbuiRoEDudU6k^LC@iH+*?1ulAQ2SJPjt6S1Wiq-rVsS z#TDivN7@N{e*Crhol?i#cGUiKsf{L*s9mkco<&Riu)AxrAX*V)% z+!kbTtyeP6Ps>oxDVC|Q4m{5fP4)-Gf-OE;7Yr0HDHXpawDWzA!i}{~Jkn|uuSusI z?W5-ZqOzwc#oqbXofY2PCpUue9nh zZxjhEnl+T5BS07=yZHp^2Qe&9HfBFq@S|wa+Ak{Ig8&H*CQh@gh=a^^1|*k3)ykRi zM>PJ_{fuu@u4Qkomv%5_yqtHg!mc;&G3DK;jA5+`N6-7R=kJV%UMDjE6tN*#5}WH= zKSOx-js`I{fuh@9dekQ0Dk--|s+Bc05|^{x?{bC;6NKkQ8y8whsuc7+ET?G;g1j$k zEv{a9nDxUdNF-jWv5bI4iQ7??+z}R@k#}>hsak2L#~pJ0wyiV-bEOKS(ozMGlonVc*Q=L)TN%ZZxk@ zMpw{QF_vq%-;-5V?{b?htR&^||CESCT_I$0K&&Izq8SbM^>ym`_Dw&U6jx``P^&v9 z{jh~$=G<#>h-xJK3zd_Sy~fKR54Re@iE$!V;3&Xfaj4dCx&S*q`DNr|_KIg*%F5kyJf&B8E0Z_ZC&IS?(v5)ItI(~xn8X^6r7QiM zr5H|+3y1v~2}(a3gqk%aUqdazWFEO5Ppm9$QCcB5@2=H2ZkOKwWgRuLlXtx=dUr32 z5JN;?r*Y^BwhrXWqi0knqYWMF9S%~^DNT2PNu_-pZ0_b9K91TzybBYsi26H9A&VAY z*HS~K9NjOgbb_JPxrZxWRIj}<||-VkU$t9 zb3Ha7GI~m477@Ci0U7P*T_Y2P>C3UTpFq4J~eSCHlrdIhC zTSxGosXS%VjlWgGPj@yCnICWNERCr0SDD+sl_1)YZ4mYr24ps>J2nu4bg_HbL#n4G zIj>yQy2F{N^AM#)ijP!n-V$Pb=VBm~QZtLUSs71!K7Jp}3!?9Rz}b7nS$7ZUD0Sdhs+&)IE@MX4%ObwabLOaiw-nU* zPGCxj^#kjOLPVycp1Tp>7f;k|>?gHmxn&sLaD`QqC~CU<*#icO&>@?6d|_>Mt%~}y zWi$0E{ZD6>?PZ0T=OmH>=NhGIigQ_63_f z;H=P{%sM5h>$mK1EjPJz6u)D%vLPm3_j*2COLyN}g*nbM!Ml4O=s zUmw?HR?xt5_a0_sl#cUDZU3nZnI0Gm`&t3VIh)PFMwk@&cjLpCi&Iq%uPQ93X>v4H zeUmUClGtm$F{APo>>J}-h#RH7+Fxp}p7w4&6uVIfPdZu+l+a&DLuW9!tGwa|U!7NAp)#$Q5W!dkxs<~E=-7b@r zS@q+vg=>!e2D;}J4}PXwNn8*=CLnlLxDemGXWMb#$Mfxu*t@NF`C3(%YoHhuW~p5h z$YMzUb0kmNqU?poe%H+eukqahA?LfT2tXR?dEwBI3Ulm^?9)7aIq>49`T-C5bk%Zq z-K8x*QNAU#Fy!v(Vz9rJaet8ql{_qxS)34K#FJXU#Exj?7{H;HVkq`~H*IflbRd+&@QjcDP-oA83Mw9TJsmTxXsRE5vj3;jfXluKCT^-H|$=|(2iC%o!`3Ven` z`*-AFkjmp71Z$si?M${lj<`P`1IZ6~0>9I@G2I;_pD450CrgCrTKAB8iI|>8iLT5a z2?-ApqP=h~6BP3g@*ppmalstKOMy&T^N<(53W)fDM>oy$p7hJ5bK@e4Y5)qh8^xi> zp-<-qaxR%7R=u`1l%>yNkf7g0i%yIDt3MyPOJz)LDna_HaIPL@T8-Tk7p>X3FO*u$ zPi?gAt==|1!P7T9bX0^BIk4GCM`~V1=E@nijSoh>uwMIN@N#y5Y{(!Ro=zRQfkALC zHpA474$EF*{W{B}n(+LK2Q>veUz^{-tzC;PIca;G0#nq0+o8ofz%-vpT;>p4pS=Cc zT=!hlG?~LE0JwiX2yC(OhM?P!Ld88=YixdmM7Q6&e*f8hW^S@Y%WH|V9lhcq8XKu} zl&~vlnB75OADvc39a0BcZ^CYf1d;su_ouA7q7(oOWpig7Bq^4j?qTflBpbYoZgj|MhvrRO_SN6l{L zdRGqFbmSuy)Wa(p*inft16GLI2UO{X-7GCqCm7t(Z zOuVU&Udy@?a&>RC&CM!JTkutjtgsG80NNsoW$WTHnS%sj!dL(6`3Nhu=L?JYj}*8k zMS1C-{&;v7U5f>&_lF;qP{*+G&e`G>sge$%(@%H8Hw_B4IfRJl{Ysud`B1@(>#z4Q z*>45_-=IOkC2B{*>LiB|^>oAm`Fz&Y0v%>}+S;E$Cm&>Rbd0ko+E@lK*4d4PEZuH; z2Qk~CIU^iFT^SR$HVIZI-V3%7yDA&D5ppH`j< z4*~kXY?Kn0D_Mo-57#+z9a8Hm^S{xz8aZhoE)@>4aWYfE^UK(gy3X%rft`yNvAg?} ztUeahXcUz&0IDXz+e04}lBX(uJbG99nLDJ`qN({AEhF7;Z`4Qb64mUh6&P6v^^hta z%hz*~v~&F!K}`t(mIB*a``b0MGtB#xmDN-AJ&VVwnQn{IR;uk5+O-wAFflSU+3Gna z$-1@eii+AE&mTY0-POi*h{lfd2O6d_|!D&QD1=b0FhP_qn1!GvdUXZ+$!dLrRDtq(Bv>?2z{Om#HF{s09*YIF zuu{Vt8MPOBXBqEP3C5tlyB7LfFgcSB`q)$J``@^&bli5`ew-c8dLlNP%n2Oc+5Hf( z*}~}gtE@ys|LLu@8ri#$&nUQeZvE5dD4r&>v`S^cURrp|C6udvyi7HhkP{Va)d_3l zb+PNi35onOvyWmMzzrP;H!u^TI+}WnU5=a z<~+|?{|3`zA|t7$z8!u2-$Dm4lZ)s4Gi|;%s_U-{1;*KMfeV)So#q4b9F_H>`xs+;5~1Su zA9)|)zEVb+;>c5Bgp1@MK{6i_s-d(ogSt? ztR-~>DXIF!iYaq*#S4}I;)B14XQp^iz;#=i&j59`7<%ETUhiJzzTZW+-;BZ9>4kLn zDNsM%a(vXQY|~#@Oe&K>4;7z*%03_#v5yc)?u6RiSn8dW!zveH+XAh;k?|`P}Qz0eAD;|jQO;>&i zRObY`rCK!cYqvlZ_?}N^^Iu4_=-))*TUTC<5ec~fikZ=^FURiOOCny|G*ApB|SC!3n208BZ@w=kii{Duu}RP6QLx2`&9}?mE1y`Y1fUsVz(1ZS!tuufm=-q zu-zCCGU^Tw1C|YlR7Z7 zn$oguM7^II54<>7nwpvjl7NJ*C)Ac6{$DH=!LPnLqqk0CGUO)SMMnO;I+(g_N$qyL zDM<&&eYg5a7cex^m4Ci1wqJXTmx1w!{{5PoIb@qx0c&Z^mU>T)AtVR|ml#Q>02hI? z9hNN@Jmka%uaM!CMq${f0q-<%rai6CnhZ=^qW4aCx(gbxPXxpC_w##ov_4`4+-%m>CXM;86&xhUxB9vOfUSSM(@Ugl`3J zs_nt-nW%@>Fo(P5ov*`8(V98PhJgU$%>Xv|LvKGZ3N9=0R$8lOB1*Tv`Sb13LCp4u z^wInvYV6pge8a8-pnhSOS_Ep2F+jBdDm>)KJ;s5!XK!a zZn-OOCxw1VW~=5fa2WTOu4^Y1*%b+CG4(NgId=GYIpdg$zr=zLq*_xA1}qLb6w^y} zYZNw(f0-uSg5GL1(~X#qn09a7KLN8RoQUH?r$MM7EvNypMXRY5N=LCA^S{ehzEy{~ z91cp|(oZ7Em*nDknuyup!*)K{?s~Ji-rURF8)5Q1i!)UQ0ckQ3L$j3Jbij`3+3ZjH z1U3W7TUw$`LqS?)8ehaHBl}qotIB#6QST zev7GVdA2k+UqVG{WF#!T>X_bKgra zKj%582Z>oA`|z*OfFMy8}=Rkhl{S|Nav6-`E>m0gFC zp1KoF{kpfwt22PygML;fMt}O?cujPvZgF?{r2T*!z182VuPiHol73}*1gk92awI!K zcYyTydoOo(kJ=!Tv-;YJ6SL!y#3L35%LIuwQ9})?u#d4W2 zfrYZ%y%P}Dv14AWVcZ%T$ebQ3c}u4e>N+>EQc*ANG_XeYC-BEm+-s^5yKo!=tQMDY z3r&}sx|62@ZwzmMrOM`$Pj+A~ka69N(eIpl&jN&)1IPNtziKh$iQ~2VLEjjc`_8OY ze2#NgkliJ>plaL;6H^!GnJF2LPX>R{8Qi&D+f@{-vgHzao_%_N&n}#{yGQcm2?Jn0 zvk{VvH?L#u?J9k7@7!T>xB74ic9rn`rS6^{hKHQ4Sw+9Q;#6JjcRnEFKX(1&vBaOE zI6@9Of{8Z>_op%QdSC)9SPiU?07KqouS($zSRi!)+c9{TThV2HfAqTV>XaDs?>c1d zjnTZNACkej9^p37(4VzN`|gz3K8%a67vymRxsiHvw9iHQ`U)1Slh*+egC^L%zW!w9 zVkjSae{HC$q|A2%0g5Rvb|yYyw6w_QaPH|a>gH*1q7MrI9nklsos5+$4u)e|`9!V$ zk3>6DfE!6@SW`Wjme<78n1-=knp-F%QsvYW*F@dd$}!Tk?8(|G|LHyvtxS z>c0I37j6oSHT5ApF3vo~y7Di}iVa~>6U%F_`r|wwTVSVP1R&E7^8${WYR?o?{DO!$ z+K+KU?LlGl9!)ZLa{8O7$lIuAB>UY`{l)h8wb}mXY>og*_3xZcCgZggzxBT9P~Nq* z>AW*fF!}`tClg*o3vjst^LO*;qoJKUmS6LRvRDHf`eSh&DpileZa~#qC8mev zpcLUs`{LAtMo*r7E%VyzH)p;m3$N}h6k_nuB|(pQ9X^HirC4L#UoFF2x!*c($iTif zF;|Rm31f=+(qoGLd7#XU`%DhH6zYBh#V;fWyyfn3UdY#{`|1?^#JvZ=`lBmrFm-7} zE@9ZpgJbP*J;!!cAIv&3BHg|m>JI4(2V7 z$;4=;0xPt1WY&^h@Dt9>^Wyi{?$4Afzg_~;xevE0K#duNuTN8#Bv$Hr40+RZ&ZECA=PXR5sE1sqVxDqJeTlM+&OesUTC^v^>?0m+< zE%5!zE)XvxHZCCWU296C?nmF=gmQ>;qJ6k!8dncKW(M5kNK_1hXbKhJeyJT;oO6~5 zy($}%Ve;52OMF|aX0tY#7w5j)bpIQ_lO?e7dnGMXN$17y4cu?L66@S@r=xT&jj1?M zR)A%kbeU;IPj&?3NVi>ypUD(3kmH=Kw2U`4IRFqJ8B#APN`-@d7+y%2zgdi`*C&cN zWw`FCeEUw;ldmJ>3gq2-andWiWI}>K1;{{4zQ3|}EmHH519$@ilR8Gv%OVx{jwQR6 z_Tk~?S?uP!*`AF<0WvoC=&DV$hY!D{NPIyjaFJ;AC5f*=a}M-%-LBn`v->$%Elcds zQlzzAm07Q@)e?G8FIe+C6LjWojuCCO!9XA9lFBV*{p+Vq!Jatm#eu=)6%W17(mP&L|b~@K_hx=tw z&|4%TQCqL=P+&Ck<%5G^qn9^r;X8U&Nz>6NC(@r+DcZFCO==tV}OtRyIvM*;{9S@dYT}TSGX6H6Lw^u8YNwZRt(7U<+@; zH?HO<{m_EVHtgVnbYQYj&q?)}ivP z5?pcE%7HiAU$obA8PwKo%6e1IOYjSDd+x%W^IgWyYuIzBW(m}%25 zSEKArc~+<@nt@!hY<5AtZwX!xg=7SyYQG;dlgB;6JN(MOZGB2A_;;l=0XMbkWX4VQ zqokW!_$JVzh1Xpi$D+D{T+FcP(uLMkEM8P3t`jEY&Nr|0Q@QAyI=j_q{ZeO)60Ili zvtpt?rGpUuG>C6#pwK{+H3$72+=zi^Jo&-jph(fn*! ziD9_!c@$|UM$?)1{p}N&IY@QBFI8v79>kg9@4-;?U*C!BEX?g7xc*Mrs^1^r-@GJa zh=wifka+4Y3Rn8wHr4x;vaVN^n*c3qQ3;xCU?*hi(PG-r1U>1=ah0<-zbQU@D@CmH zk{Ekyx%W)x_$M)G>tcKha{kG*XTu20OspqTzAK|IPKI8RFCPz*sHhsP!Qyr$$N#eG z2g@~|wTLHw<`)9y4-QS)L{?cK^x+;Q=)TFZ$}^v?9vPAq7&GGqDoBxDl-iY@yVx(n zjg#CGo9%kD9{;7-VU34dNfikXA+~IU=;I1#lUY)u^ZY>9L=%G~+$hbqIZu=3Grr%t zn5o(6ZkE94(|9}zfBjvrDdkl|5xp-qa%IbX`yHLSVdSecjTfrlQ>8*D2!IaHP0=XXz(Zt>K&k!4=fo>R}`eq;rh zsaXpQf>YRrrSMY1d=Q58cszmro@4U(k?!3B<}bl6TdkvJ+~wd?FQgQTH!WvlCDmm0{u>P3{0!8SF^ZGNoDxOin z1UsI4E?L6}?a^JF0plcS`?3XBLGTm7ZaKlDQe}S+N;$lg#L^$+I1q1S@6Dp7Jz~#` z2SlY*$W#=6dO3uP)BSCyz06@X!I60%2fsM0>w>(R?P|wH@B0~9pgxVbqSsZ0*i-8=rIMAe zwal`pB&`d@;ABG5QgqXPar@;K7B5F!&$A%wE{JLanr23~E`yHz_KM*kV%*v{@j5vaGcmQNiwx+O#=Cuzf_J2>(9o;2kBd&x%MWx2|Zx3~-MVM@dA4ibhm*!2r?3!2ZTCJMOgZR3d!PkxBA z$OZV-S|vq-r{6i|Is#u+OP!}ag?WhJFo5f77TWMtl7Bd$;RrDmfkl3wM%YTImG^x~ zAD6V1go4gX6!BzRlm)eXEz2cbBpk@Uzr1;)M1G3$tb|xak`Pfb793H(nlDE7?4Q0A z^JUB{{kAtqg-p<4aGB~?nJIF)1zZBo3w0i5)x#v+d8}(QDanE_H(2AIPkeKZhUuuu z!ntQJ(^c9PKkk3KtRx8Z>MR|bal7c~%`a@IB`Ys_etq~$UWuTUJ~tKT7n+*jPH|7Z zV~*$HS8Td(Hz4&WvuZe_O{c~(-k|%&lbeG+6^?zVdR{ad;x$JaITENHK;oJOy*^uc z#%eLUO0GL)Q8E4f0@-=)1I30z6kD4VNva&PL^1=4^J5=;>q~<~j*6H9N&zL^pEYrB zi=ww)VHbU_>b(0T_lMZmkp1BpeBWnDlQs=oZOHm;$_@nA$P0TAu~^P zL)eZ0HM4kcv0anHGyMukB#PuL+a4o%cFQx34IR&zv6_ukM_hc=VLbbc`SN2h=V&4S zcI9;WW^I-Bua(K)2DW1fPQ_z7ZX+rOW4qjw&eRtmM@^|Neb|H^h8fmXmLWQBl9})w zm4=+4)fSJC;$mx-8F~o8*~m(D8&{kTE!1|Jo_4Kv3-!HnxRGXATOy~L>X=3@Ed?T^ z8R2WE;=DOdDiuXfu3irKqd`oY9iAJ71+tng{Qwe2zl(Z7UiHw0yRlx_li(iuuA!4A zqqb*DTcN`K6B^s_ST1yXHxt6+;)O{qp^UaEP9Gn%UUOv1<)KiX=0}bvUeh;yBb0uRjBGlZ4cVh> z_xZ#M$VwQ@;g=)^&l1WsT2I&shHI%plY5T~^;*6yQ6YX~!+JJD(k<3QO3mYjxtnh| zPxuzad=(wDJTD*W#axRwK8bbQGk|5ubdJfBY~ie`qU5F*K@vca{oRO@DN7hRzSFm1 z!ulBmYGgi)kNhI?*CmWif>fhl0C_V<@p`_8b~}}S`7mf3v%XXK7<(^o8QZMcqBm&U zcM=Z_0dEtWfhtoCzi^g6t#wq-YjC4eQ2O(!qcJZM@Z(Z1D6{=vb#N^(6l_a%KFCR< z#tIOLpUsfr@*Hl$ZQ_cPj2rYAbuur1xB)U}R&farp`l3Zv-8*RFa2Rj0rznBWwMeg zH&0V#yA3bkTqzDJm9%nTmj9)>g?*PY=07*(-&gVH8@J!PvGtu@F#DBt zU*=LpkFs)C@RxP^NEN31Z?gC(n_u?F(yqU(zthmBQdo$*axkfVl7kl5xG9-@NRo~> zvROVmtoxT0$pkM;c#El<^7gtV9Ny0&&r1&Ihn+z0g0*VRceGd4Yh~((so`HYlprsr zq>XW`F>8tBd>r~`&#oG20XGWf7OZ%?;(4q4+#!IY!QI27>>_;70=@q9>NP=mDg-xi zQ(gqKx)aj4UR4i0?vgTzc|DMQ`-i>kD3C;6)v8B=J%_JJ|2p%%Cn+fQs<`O0v2L&P zO$1PS&C57P59_<4)|sk&ho6CuA9}mC^Gg5iAuT^e#!XsDtNU35t|B8LqTjFl>d_xf z|4Z}0j~sqpLOeWT&vS78+++W{_WbcCOA|C@Ebl6B@XMdu_@^c}KBT1BbMb$#LjCva z{NE=E6=<*A^EEFtQ}O?Nkw5PtM4}=K2M?QaCI4{*fEc6FW(M}??tjO1`LI+e-H7DI#UjTgHO z^V5UZv^|*}lt%vfTN0=!dRAg;YleI#C=O;iWHV%NySbx0c z1E90dvzomKTGI8rGV%m=w;q+8GuL3nH$Pk*c2Gex}~;TGU>=Hq7a9dHUc$igdyjCrUdq3RqQ% z$352*{SoXm3mpp)%679Y@#fqI%Da#J<~6~XPk1^z-GGMx0(^UTc7I4}?RgK3oZC{% z)b~qP1>*W*LW{)?Fv2u9iPtlzJ8&&_lg#7V-2?9n2Rx}aL z6|lgY1a_<@pgUYmS*E1s3{xF8B69Uwp6Mt;#9oIAw26fSq5XQ+LLhA)9-$ zbClR-*a@6{G|sce?-d5*9;2AZ`Rqvw%bDw3TUBm^yJ z)pmWHs@a55MA9r(hU=P#VIKNMmvLj9JGBRs$QVotugLiwbD;nR8g(2gSB_#zUWqX# zTh#T_oACfJs}gz9R~_pnRO)AKio(#-K5d5=v2K={AAfv$du8~91u) zqF7G3x}UGnahVR&n@v^PJQ<^cyfSi`*d1fjh01i1kzn> zmixC%k(|JV%t*VMI)i=Z7+uJ(qjmvAqv~`Fk;~Y}|M` z!qN;|$hraZ@$*JL`&ESuZpzq*N)b1>;K?|3sDOSSp@n6t7X3AxcV&{jhsgjew#7i; z)?Gg1YQ}$ACkZYRW`;_*)sS3=CTC7=}&A~*vD^W zSx|Qz3q4zk8ok!t+NxX(t*FvQqpbz4Ph4@;bc`|jjuDK>Jv9)*v)}o2D$!}X>i9@i zccPDbb~FD4Svdwv?Lhtcx^xXN4ch{h_BRf*+mT~1mg?vuxAdfhk&;Yccx+c+_i>#O zdJ5v+Eh^TrS{FNFo{!0-?z@!bZ3LQX4ITyKG*MdmjQN!*bqB`?N5hlUZzJ|M*H>Gu zcp>uohfVj%4S`um5ttNRSb~QT{`IU>a}XrT7^De9cWU5~+LpW*%W(x3D+x}omvG`| zT{oEBKvB{>uWYm&c&HR%&v?R*H;XGsZ96Gn8%o*>fqVKEEj&I!W@G4tu>U2iRHrwu z{ejNJAdG@S3+Tq8dH~eYf%-mh<=hPZdl9dF8)nuXt5v~vT(ow7ceNOyN;dq=pgNyJo!wQSct(=*?4}q z_T6s|#=30;Oz6HqpUqlbg#ly6&w%MHg`bj>k!3la{ z_fu=Lihhmqc}e1lc48}Y5XIIzOt|oG+zhUaHfw*lJUE$k+kwt zYMBro*s2q~2U^yN=8wcG?1i>UZ>006v%#?SG@onq?uxB4eETzW!8*?-6V}haU7Ct{ z1~rdG^&dtUh#_Ww8yD}#(v38zESxDJk7CX!XEWmLi!I70xZ0>5 zBv~(Xy$+&TxUN5$=yN)fZRT)^tG<9yPd_-#+LoI1xY&wX&$P@fnS?Pi?2I-N^pUQKOL$RJFDpopV?-9%N_A)Qia(OYj!+mS1`620;X@Ac{8 zLnpF8c@R`DzkX~qm%9yMroGi(jFp_s zK*w~P2iwLl`YYH{JDyUWkrzD$!&_c1nEfv6?9?mu%wXiLi29z9~S$jPg) zF`Kn{ZLU+cWm=w$k**j*<70z1*w(7FK%nCsHY}G0=f1gQIS-LLy4-ESW^vvLAALcktU>Jk11n{naJHX**3u1 z-!)k!(G&SvEyUG8M$!L)wKOjB;_S`kR^+dPOxIKy4#Kj%B2qoYlRX)YaFbE<8RVS1 zSUdyU``C{ir<|$zJGE^J1sm+TmP1`jAN_MkN1r4T+-8hY3)$F58nj(EHkmuwE*!+&&KyasS#vZwG3_*K1o#)wVimdLru5hXPs3eS{%b!x zb5OaHAFWk4``|8QU=j3Dx^o)_2`sT`tNic_ClFl?<=|z#c_U^UAgX+m;M@zWAC&yv zGur0rLA)1VcsSHEeliO+-d3o3pCGFvzVqv5=Y`u$n@esKI=0ZRh~A7sJXguqg8tLx zcP;*QRRaR-5wLP8*9MR`2!Q>BFSeee*+%(R)z&9O+^X}sU#d@b`S7PWvbfRg!llYJlP+myJhl<7`sOQ5Xx zZX4vLltd058Vsck)q@iUCa@fP^v_>4vd7rSMn9hsx;`xNq1iv!ZaLGt8PFFa$3}7@ z);$lvlnQ#R2#Me833A|>9}vSX;ehkB_+ydAo_~g~z*uS+K!lp7 z?Yt*Z4nD}Z!Xs!?ML#@-cOpm*+e^k(#XyJHYz+9fdzjLW-n9u;WK~jS4{_CIDJM|Z% zA;Q}zh)S{hCvf+OtRZxYTH>cV^$^91AmfES_>hDdZN@3TWF6aP5-|t$Yzft+b z`E#wMf}dE>)eJa;P&xAKxlR?PGQ0ONfv)@Bgy>_xwn`fV?bZ1Gu=>sCO4XWsT>IFo zdR-V55Z^9tu;~)d-^AANKk(B*_7Qdw6QE)7d)uni&9p2O@{^JHO9aNoe6BRcF`G(j zVD~|FItS&taownDk@`<<_@ zfvIH2cHstYomLGKqKWNd*z3t~brm(!MJ_)NJ!aA$!{@GV$Uno6VTT|sYU^O{id578 z+^m*T8yP{@C_r=s7anaT=lc!Eh$xWY{igx?K^1wV+&u(|`kGRJdRNxAslOppm8-H; zyW!Zi^a>4%(A=m%RHwLNX_63f} zd^MQAgh`@IrWm&BR$~ZH=tgFWU2~+v^Om!F)nG-ju<^07)HwEj1 zZ*)ViF>;2g@2DF5mrV%bUHv9`a)E=2z1|il{H%}^Y3#|;XZUZ*V0PT(jdlB9mH+gl zK_{+1@HYJn59|Qt$qFclhmRZYVn1bzsoWPg5;wjU1oSA!PRf9BzKvW1gZ7}9H(B|N z1DtaI*bM;hi2jAHtnM!PzTMTO(F>`3DN=J1Fbk|e>{=X5E?lq0#@kI|(~46LF#k;U zoV;?4Pe#l3yHAq-u}?t%^md`Ft2$U8ZH&pQ^wew?OBWkj{>tckAz_%Ch?Cg`JK``Z za?fBv{craLV6jk*I+P*^FLoUng$JY zM8+6ey}On*$PC{RL_pG>aGDx|^f{|&mjoJiDj?lU;~5RrKD zLjal>S%3WFuRaJO?`6EUsAT+7{h>}V@|gap;9f$i0C{r)zF490PX!0$CMyk^oPEmQ zCL^46L&hDv&pFNo_&0m>?F>H@GK_`>=4=+>otYW%a!lq1d*lE-@PC6W?@2lZiwfeh zS^N?DKkoZ0jo0qm29K+sLYv*Pg5(}~a#@yD>!t4!*g3bzm&`Pz9L}{BWA={?B#gqj zIK8{KRYPLb1(h9{N``noNG2KRj{c74rY4dUHjBeQ!p&B)Iy8~A&9c-rwkPi~E1<3I z$x+(-zua3P3cdH->7#?o&c{vgDM!Q|?qnN0jhGN+PEQGkx2kBsJuRe+Qp|rGuu~Jx z@sP#eol9y0MnkElWmOx9(sPFG-}R^t&&H-n2>WA`TXN4hr(OXi%+hgaEx=jhx~qBD zPXTFb^Y)l8kYtUdNtbDG9aBTk!RCC6UcHM|Et`y)C@dbY=+#_iJ*Z6C1s-4o%gz#K zAM7=Pe6Oc%I!KlJ=82}0x=U4m2`MEmIsh^iAodIV4(6JGTh$$@@O|J}k+^)p82g%N zmHaAgR$k~V&7$sT)TCY|onIj9fzEDVm0aD39t65z)d}2Et-ukKC7>os>tN!#pEgU9 z1LVw0_ExZa#Rs&UtHOs!{+Glc-XY3wZHg7C7dTkom&0F|`nLh|o&n&qnW8CZw@;Fu zMj?WDpt37d#sX#iY_kNO3yhdX!M>?!Uesnj10uAoazww5+g91I_&dbHhYPUi+?H8{ zB9amp#2g+6k?;^+ZK+X6$EfG?Lhv1R2CX#Dfdg8%UX z0I~DW5Xj@~UrCb;2iF%n2tZ3P2i8VqfHOG-4mQ!xOmxkbjc4*0R^hiZ6)du9xVWx) z;c1X0>Fzj{R&;Z7wc}}=YCOpY6r-(K*JGR10Mg#Fy*_)%=Q+2tl=NcI_g*s*fbMmXZ zkH-zL`4@vYashQLJ>RqH;Q0UU(wI-g$UZE{;b}X;ispfZ}Szrb0V(Zt2B(wag z4A8xn<=qT9;{a}nUjQCe%i%YGfGxkI3gWFtp(36D=9vT{h#Z?1&##zY%LYXc3!X>6EEZ0v)G z9Yo{Z_Rrof{I=hJU)94tN}XU-s@b_{bHtG%nI=U}kGC<%V&hi`v3#MLIuzK;YN5oE z+lZ5chC^fA!;1kA4vfpl5&&S}{v2k(2)F&@u*;UR(1P3k4<%ZBEu8U-6R>=`K`-`s~ zT&bYlnToUvDem@ zx|l3@z7Nikm;|tQB3Xaq=fVL|j0vD)F~5zq5Q?>{T~G z9N{pI2@`s&kyt75UKpzz$v5HsLAg>=qgSCkqv#W*L(xAy0f}PdkxLsurOOc(W_u@2 zfK*mGqM`|St7ehQb2w5YdKELSIeCT657wBeLS7^&|rFqw;gUpQBvNUW9NZmde)H0Z- zXlrp$2!MlV5Ftl=i#%!ho>v>X{+~wkYqn#>WyMEV#p?4`&4!8BD7RbpG?{e6KbM1Y z!f*?FcX8tWDSJ0=l&mp7vdg|nQSfsmoj`%MbI}9=dNr^rD($UG{qAE?54C5Ps+-{1 z7mv|*p|awVH;q28Wtz{3vt$wG#qGWM^va0yNB;AxE8rOMxvK z;Sig_%tyRubPH7ST%Mh#X95$oze5kZ-VqRlg}S;PRk!BRU!=VtGsJn-p~2BEp;crf zQ*zy97gVe$v<~mUk?$N+U)}g!O(nR#I3=28o}{!qg>A*KJFr@guqweKP86&Bn!TlgQ|P_z8dS|7sFc^Wsyp(oV-X* zH?^TMp5px;G38LPOp3+6xNGZDRG1DEs|{O47a?W0xb~o9>vz_L6d9KudS5lqe%_U* zPO?$Dj#YZR^*@s|C&8y6Q*}2>gLes>Ck4*TKqP|7`5}WKHv_RnX^{oEYolDo@2Bi%v4Ska zIS50oOTrwwBm%<2+HKdtPlS`ZI4u@Kt*_T2Zdg1HO4hS;GAwTeG>&cfQ3!Op_-Mls#X|}}R7wB-W=K|$y9I0`Fm14?c8P`%J2IK$ z5J9ZS+%}6!r+g|J)dyPN-sYs}0J3PzdQEBd%<42KBD31gDwT`798D z!i6O*QK3kXGE2P4gfaJ5%2 z>@~Qi%>(frmws#D)2~}~Co^5H0&1s6!Hft?pAvfk!{&f72=W zbJHY3k0%Vny6=8xE+0>MuKF?bY!rwQ4B3L)m;`LlMT8r!jy2sfZ}>et7|QlnemrtP zPouW9(_#yaHbXi0$AI0Ilw!?t)!&Ca@17DH_M;ZSnT0@nDUI~Bb&?FGe*Wl{Kg933 zCA9)LfA#;dcGgi*_V2oXMGz1X1|*ai0qF*%8Kglqv8l)5?l`o^#RE z0C#3eUv0eE0@7#A;4i(KLlQF=;DD&H`-&HmWS!dTwK8R~&;=t@Jbz(YTnOwP*6HPo z7w$es2uJs=?|CD2pIz43?Y}H3Jl^{v?f*)Af7aBWc;rl^MUFo4C<()lX6R~5vuX)^ zIdmQ9Esy>>_T>f%>G+Xx^>a~nfo(bR@zyu)EfknUob)^40r$rpc=DOMO=#oT00eD^ zw|)=d;Q#EO^@$(qroG~ywRsE3#-9Ka?zU}u)npkoN_3+B!*n0-R%Rsz(6JdkaRz1b z{FvtmI-X)F{=v}ucKhcf$Qpb0hqbTPT2Xy!>}e1UjZ((BBV0Y_4(f`cgZ@D~FH);r zFv(O(=c^)msJz22k)SD8MvD;)99Yx!6_K)YjGu%LtuWu@u0oy%{e|(b8yV}IGQR%t z^cL)4OiJpnWR=3;eO3CyS3w`P^51{CXWrp5X=DXx%)H48YT*jFKTJw|-ju5~;L|!j zKUDdt_VkwKZ5Z{z9ey0xZE%vFI#VNvO(g?xIEfHShh!0?g{Xzd%zf!D^9}KPE^WN^ zNYe5H83Sn})GI{c?3diHow+(^GO;%`@6(YT)KccWI-Wp7&X`PUAF6f(A^<%AF_6lX z-IV|o^IB2`KGmsCKGJ{55D>SNrBzTb0v)mBndiyN6gLSvZ`hAh@0djqJZi37mU}KC z^DPQP4|zW6e1K;b#t%49SO|ZI%)pl)D(uwA-WPpRH@9@#xt{__+}lO#M}EBj@%C`Q zl{78RJwJ^AE=Al&xKvwi zjafdO6uPxJ_9ahh<)-rm6GK$eFU>lEiI55L3k?aQfV3~mQyIn2;XGF7M}SW9gAd5^ zQ=hI=_(5zB`aTo)L)Y=L#Jpu1qp!%YKwksL6DVP8iOEQiNRo~(bv1Wrh}n}c?%$Dx zci(~L(cZ{-4LHlBS={UAJ|DdF75C``i4(>T-3f5*^4sqzxH$6lR`|j*akF=G&6~r| zDw;8^$nTI6S6Y8{GD~g~Fwy3ZP+tR`fu1eGFVZVBL7!8EX=OpAYiwX=(Ulad)6*s? zyAdnM+c3^MQ4i$|kfMb)pogL-P{X4XRHI(zLnf?wl$-%qs1@Y!W55;I$Mrk!mI5CV zUksjgPlft1m-FD`mv>saBj}9#CC?*NXa@Zw5}=an{4#=mPnONy5HeRG5fMqyJ6|bb z{O7((M2biw2F^ONW{Zn=qVPyNqB2e>Yc4XFq(7_2Gr5bJ$n4!MV$3E7O?T@ z;HX@;`F-Rhky~}7X!B~*H~}PliO3H~qbTs;BCh)|2^S(1N*_ep2Mc&P2i&KQJ_SPq zqHz_@kZ4l0{K-HP!~~RgpnacakdAK|j7f!FA#N^A#9CTou8}ZVZ$5bfw8Q<$w_|;x z#Gq6NIfpa-i-%XNXD_??eImoc6Vx6&p@bNV+mkD2cacNmeiWdIJ>?5nc zB1|19LiOo|VI!Mug-qIF{DYOL6QZ;B>hMS3>9_iV@`J0fR1A98!2ZT8zFX`4a}g08 z@hukEcM6aW9-~5YKpO7_S<9yCtR|0u;+0RF){5}kKySHbY5zNkXTw1EixG_?&_~Q7lOpAb zcagTlZO$-k8|=gD)8CumZBSUJVoHzJv_-%3dTnOCis9G`dCYNVwLw9S7i~B$)y+tC z_-pG_FxB%{X$CR5B2kJ|#xLd=x#_H8Vw{QX&Ieq>oZ0|2s$&On3^R8&go=MesQU+z zlf_|et^Nwwh67pmDPzlH8B28+mPY<=56JxBMwYGksB3v033t7CQ`qn;=CF229PzEa0*^Fm=ZRPa~H-^fW!l*nRgh|D_IItni52;;ERG7&=ZqqDSMxP@QI2q09bi6RIc zHz$e=LWw>FO7P=XT=1_u^;achIz`Gd32Ww@RFnbF_TA(1*eg#O!fE)@ig9Q|ypl5L z2DsXP1F8gCWJVGiux}u0=Oi8@;BTLrC*q@L)i~`#b^~0~zPVF{OsmdboAn7?WqTv2 zU&TsNUVeQUY9O3cH?cI8MeHX0S_GjxX0`s5VVz)`Uxx~zWyI5(Seu_YQGr@MkE?D5 z>LjruI!2^T z#M{XCLs?}oXRLFP9S3{qYeLv{4cC(6LXt(3U{2!DZf)cYF6Y&dHQ_&CzF$10Stah%sgg8eM<i zz^fz*q}ebg&p_DhShm<&FJ75QHc)nrj}d)9s_RJP~oDKJi2^oA$$!FFQa-yPD^~ zX1u1t@@Clby8&0A=|HM9hlagsn>PHndU=0*&K9+%pmkx7@AnH2)Sb7}fHGSDb(L|$ z(TgMQnmJn%?9}i=hHV`vd#Ud&2lSTABT%jubyl}%SE=?))p$QY}()09;HIwB`s!HN@-&^`=~dd(&)>0fC9a`sih!*1)(i9;npBqF>ug`Vt9wY^Q1M zR_ooQ=QriFn}WC8hyqIQTX=cZ5)0$w7D^E|t_(^zma$(EGtA@l#RqkQb<*{Cy0?!s z5rA+H#?NE7T>iKV?PnW?I{tuz!MiEf%c*zISb2Aw6FvpC3$GGMti-J*)bnry+*X#IvT0+q#u71@Ix80}0E^yvXQnof~GJTcqLuL@3tWX{Y{ zEw9}VHTwNSf0u`m!m~AC5zrLXk4%)~dip`n#9a7Tu7lczw?cf(pQ(q4mAzm_N<5ZA z2Y4;bFwLNAEdVh{zl#zQdKJ$6bk3YBMn^LfV`ougO+<7I$ODD+7Zqku(NY;JZ>ry= zoERXjlK2${RrC(%_t2*6xCf=EGp5o#3?})*Wij-7v^?J|f1=0@a<1)eGRak0G@<>Z z!M=th_ir->I`7CU?S)vM*Q|2h@fP!)RtW!Mm6=H%0aoD`{Zvt&Q7$sg8n#g1sFJq} zQ;)&jx6sZwlve?@>YW0a&oj#$*Y`S0&2kW0$qqdIc{K(- zd69H2LsN~(#!B4J)2JcGiXpGA)rjRk}u#THa|eY2s};ADMXL%zd%dSF*$30-K#TiCN2iWM(O(`9tkRW7dXzu_+FWsEhPML%i)(shUo>wk|kH@*L< zCb0bKM#SKPcxE;)6Jbrxs;26rhPXHuwm~&3q6#n}_9{G8-@+BT^HRx;jRvA6g&){W zz;Nb1IHd*s6?xV#n?X>;EYW=sO#Sgo*8p6eAt2}M6B&k@A-TCL(rHZjjSw=pkP&Px zq1PUG%NLbUzu&3Svo8AqDG9s_4t`4@L|ZV2Y^XAHvIcciKv1Bg4HYB<#8+3R{T10B>xcTwd7G>Y&vnwtPTc1Ezzt|e77c8({ z_SV!qd@?=>BYk~Hj&(bpHd--wI{8_c<2`aOmZ$Y5~`wE z5;8P0d^jYHAOyVjc@w|7u@UP7Xbc%ko_vPs!xa-QYkv>3ei6b-U%d|i{Uz_|`BGvX zJGakV`!kqDD&(a`p%&zXxf`EhSb{wl&SnsIOJsnxjmG6DEIn}6!@0> zj?7@HhzHJb*NCRAHTUW}QLA z*IPM+KbBr1BpTi?w!7jJenPMs>BLaI^2qqhrpbyh8D}Wz+!y$2I`v4{DV$5tuk{_VP3=bJ1y^|o@HRo7Wi~G#L>#l zMy*1K5=Se4f+7FAgTZ4o7%?sRl<^HFaFB&P-<`SsK;Eql-4vOb|7`x<0{yLGTl(jS zHxjH3sC>FVz`RBWYQ7QeZ5QuC(dh{3`i(V4@S?9(x_32EiFd5_QpRtl^9l`!+6v~c znz8!LT$5CtDb+d4(4#teH9Yl*De4LNiB%Q@i9wwdql zY|2zib8opSf3>^zTHjQs8h%{Q1uqBGhb`(PEqsZf=AVla$?~jE$@Q_%3cimWpfs`_ zeiG#v_p5l`gXg1{-dSybC~LZHUlm)`{+nKh_A=8pMFwF~;hR&I3qXRKxa`!WFS+}< zpyUPRn>oY6G7p2AtZAOm0DhLj?DdQWP21dSC|wge!zgyI?d+E}gTId47lK>sRKocL zzmiUxxv&Tpnr)=^`kfl3D*5c%1DDDBKRqZG3&w`(K0+MlIwPM7FPv3Jrh0S8GUoRK z6Edc$u6u?TqNgC%u25av6aK{)kLebX>81IKKXrj2GCJdWKRnn{Gtr6Gs!UCEqQi=9 zR#SK)Cct*#f#zzk0B+)b^e&^m*6XnpNoPEKfmTtjtE?!}jx5_%5*6jbYf^h^w+M#b zuGsRUXap`KW4&aM^%nU}ogRM0z%`PDVWT;t4_4n2I)<$p1k=(V#UI*{=8SxmrQbX zmmV+ruRaN%sPTL+)n6zB?aE;fMS$ZYuz{02UJ<9_RHuKwgzr`k(S66O1LOcp7FjSL zzAq$kd9jmU$=RZ$1+PLyMy9(y(+?+;T5Fov3U*^)({@oLTQaXB&R(10NhSQGg0J|y zN`!>eJxna9G|&tYD{V$Qct(U;eA9%iFh$i6lw&wnP+lEA%#Qt!-NVou0LKe9du`S$XsP>_3L{*8^sK26qKAMS{{2B$An#ZGQA=emOFAMn&|Y0|#Z1-$ zkO?M)#mNUm`cdQC&CAH}AsQ^FKQ5P)JMqyE&Jv|#AxEOP1YP?$NRWa@cw*mdqYp+V zBph4Gj}6W(Q*HZE3q!$QamgH~Sf$yMK#m+YBYVG%TwC;Yimi2sMb-{qZ(Xs1NlLd% z8X%$1h#v`+f;tqZJhqd3^qamq1e4Os&`j6@KZNYoB6W*d6ipVp;pds2pE@qcqEeZH z59G3*u+dflV{glJ-Gn;nS)W-u+Y36^N~TMct=Te#uwuL}sjq}@t*Byttz&s0$98`~ z@7&V*HfJ>*hBArN>v4FrIRjUa61j6cjm@c)f#b91M&HIUsfXqay_!1y5rdrets9>+_mUdj#2M;7U^d*@|S@75cI0WiIJ$CN#_22* zOUL^P0SOQ_0e{dt-j;}FjnGWSGbF?!l%QW$AOM*!SU8j|#RVh(xa2D`M8oDq%{LdP zYMuRocp+`5oP$-8YKfNn-*UdOIDAfsSwx{7jElrzr$s_FcVe3Y?RZdp%Io=PJZw z=V`)mS9^I3D40CihYm!!2U~pb_-mP1HN_~WXxKG^SDYl*d;@EqVR7*g*b`JDfVP-e z9Y-iC{<3scZZGA=pE<=9# z*!qmj*P9k2EWhe=Xg7=>^^D$w4(LMH%~^C_Y$!6sY3%RRvFSa&)4?`lo=S=`G7n`Q z5t^*y-+Lt&lbN5b^y;gRq4|F4k<<-V<7;Hk&?1DPon|4N4orhkG9WC4d?Q7FU_D)>8>WEbZ@xc2eU|6+e9! z=W&(o_`BumgAEXSd>F3mP4HYVlVODM;~9SMJ zbdV*t>h%)wQ*x0V*qr~7RUp!CSNN8ZF(Pcm17sx7@k-rEyB2^cYb$Fgf<~$=z@0l? zcNs#rW_x$(2k53m5?|-RMZi^&@pDZ7FWKK3_%0OSC;sL?%%6 zkn2QZCGfi9$lZTYxpZ~N&XvE+5FPMhL|%8@a4rLlK^2VO)nB|fq())U^&<-F!Cq~l z@4Bd6%G1;RZLMVcmDj!CX_u&g?*t^?$<86QJ51+6BuAtkn07%#U#U{3*rWC3bsTjq z{-fF*uL#|6KkFlMh6gQ`7Z+{}?jcCpj>ucxPf66<%SDRuNVzsS{RI3t7?6haOLJSr z`R=WqX+bnP-z2Yg0||zGa?WW3!vN2JEMOM;blxEvc}x()ng{}`aK(s%4@>V%O6}mw zxn1H`MEh&@$K~TE(OmmBtxnuINOsy$jFLuLAYXP3c0i)E*2zfr;jP`GQLUHxA)aUC z(Ga=W;ZyfynT8|yk1HurXncpu{gwT`Yf2iOlg7ZHv#UYztI^xiT|LM5NC@4}d}ry9 zPV1x&S&lrRq%K{tki$>GWhjBr8hsHRQI;#&^uT7=J+*NSDetZ->SGKGEl|ColR%nE zIX0&4I_!YVP4`*gd1wbY$m z2k&V$&FR6Q(w>Hm(I+&-4(09pr#&rKjELIBUlFQVoheosW{OxmDZuFZO?Ne1SHOPm zti2P0)itUr@?H_%no|N%^9plx1YKoR1Ik)yx393OaKV<`>sVL678!cskzhKHWFjFg z=go=TkFT3w8&bzjU_)u{A>mt$jQ{E+UNNJWbhnIs{@T7>gwEGmUWX=*R~+ z8e(*dAw0Cav?OVsgMe4-N%IIxv;EI-whm%%0(Jrep!II&VMGTC)op|0r5*C$FZ8Oo z@}paOc-s!3+%W3DfTo0;g-^+1y+Y2FWcQy3$n0!=tW5ZSHBHg<*y$a$>e z?Y44yUB&VmK7Bi@=xFs@;iE&p=1MPAQL23n2lG`z-KrD5GNP={`Z>#wz4c!)=TlobvnIuRb zBPEn+uF1W-qXmykd8dNYqTStxi|6aVtL{)WTY-vgN3f;NR&JctR$_Z{>7`$9U}^kP zBBuw5ccF&Bo;xZU?2JniYL0NSU5!4TLi1~UkHfH}<;RhHSvd*zfb)@G1Tv$RyatR2yX(*ZIV>j`B!0@?KTtd^Q!tpz~vKCei?!&_l`?Wt&EFZ(2crqT|o&^kM(UOh` zlNx*L-3eiTTar_ae&VigWJ3mkB{xX)B$@vDpp|u0jkf*J{`#Q#_k8pV;bcwL3D+c( z3GvWzy)ehNX!i)Ek*13n`(sbbb0>J^z)NU)>J`0Y)Co<#f{)8Cv~<~U zb9{7EUA)tzt%XZ}M!v4K6Mwq;DAmaReqGtBUna?ksday(1k`@cJ>%_im(6-!9f9vY z-%OF24~&SvuvX(hq?f!Gr*;Zd^kwOP-_P7DWev?(KO+D2-30FyES4@;5Ge$Yu%m64@Cv~l{vw#?%|pcf}6>j?%>V@O4}xN^N6q8&dQ6zn|eyW@heUR?_}>7e%Uqm z#m|VqqY~_oJM4-g} zTBJYu2`?OTk$#TxX5pb>Q%s$9Cf!7mmpdn%i}IuxfHEyU?ed~l^uCrz$gw9%JzJ6j z+;126iOlHlcEb5a9J*DMZkO*QSKrMXjXT*+=b%_IAQgEI&Tw$*N-rp|M$6S?96W3t@Wf z;YdCd>7=v&SV|ZVdzq8-!r^_7Y$n0cGlZb5n0E+GIa^!kEnYfpQPzAq8mT&prNmauyruak1LIX&dHcsN@*P$hT$ zCIG*)R&mLWol6FL@n)e)#^u~3P9VaUbn<>eQNh#{rAZ{Sjgtw%G zqEjPWv&@Goyzi8`#i&r#0+nB&x8OxHL;3%d?toXKiSTJ!Qv(pj2jP5VrPvyYL$!=+ z91}5_fT3ES!(Dg44Ift)Ei`>oi)SMAOI_#NKyIf;nZ&U0NLY@dej@hzQ|2MTl-}#L z+rlkguRnd1Cu8WMvk2vkCXzUWhBr{uW&7yar(`0Fi+PxU?7vx z=2xs=_0j^b=c2{Sk+-H~~5y;M#uyg5*d|m?$d5hcx%44~vRo;mt z+gU&hdz5($D5@nTYdeKSZiT;IsBGU=uVw5parhP?xS7{jrcofSm5|zabGT;OfoOKi zGZ)jQGfu7z8JbL(kCG@GG8a$H%Q`+hRP-8Cp+m}hS#0$u73HgzRleigVh5VHkSz{g zhced(tbeP0@LiAr+?DX%hVMLsMxJ4{KU@=>V1m!5wpp-j5_7fyZ)Ws1x;$ zX~uX*7vG5=?%%gT%HM=>|0K6yM7WBtge7RF5%hE5Cg+Vpi*<4bt=Cd?&MT=WDlaRy zO5UFzZD?3*t42TaGSMh`Iqjoba`L^V+&ka4d2@I&Y=)&M>&X1-`}=Ei7hue(Hgz77 zb}vdN)~1UA9^AMay9JSUT_JE;M-BzUA%zXXvWtR7*Wz5T$mtu#MBeO;i)u;vXu-ng z2-exW-U+Q~uj%@KxZC(V$v@3TPJ7-A@HYYG`aL2aQmgUQdC@y3_Z|^kXxa-~lG;A| zw{GV6lh(RNHQKlfGIv$1uDFX?UQ+zw@ciwIP4;=>AAbkb67&wZp1pq~+#qN}l5g~H z-{f1b@c4S&(#Qg&_$lzcQ7ZAHlD{nw0FVXzNBvKtJN`xVSe zk1D*tOpxPWe0eW}|12vV;s~8b_4ck-IZa=i|L%nP$Lr?1j?SO{$p_ceV_q$H8s=s=>G8~ z-*G{nXA3}6_KAo?Y1hTiLE-HtMi{F zm;gfZ*cLPpY&D@SvK;XC_}&Y-_lIN0FJHaNBH^7lR{nDE-y7tC2e#6xf9Zl`R_F{# zdK@W%=>n!x9h$BG@JqCH^gI6;f{wSxYm}Me$kZXKA%7WA-A3Ifa`XZqbczp|dnY@m zzwrOh&rVbMqOc;UGlc0EjBWy~Mxnm|V_qDDBV-K&2rrXx$F(#h#{u2E<)Rlx?Rqzwrp(2wRN8*Gs*>v zn9yfi=Oo$H?dTjanR6QG%42&~oM{|T2pM_k&)fuEU2E?1|AljuOh+)Lso zf^{eOye0(?h2*iOe|Saqvdqb6uj$k_n9fzn?`h&Mz)Qug8s z8~+;)O>GPmn|k?=vG%tG4){FTj^MSypPvl)FEgJ$`eR8n8>WGL0cn+m(es%;C(8hU z7jOdrAF#a>j4vy91vs*HLRsl+CKuiNDD_NzpK2x=I{mDSkg)wjOFjW46jT2Oy2uXg z%he)TbTE7yv#z`YIK$I;X`Zyq#8B1H>*+A9|FOjb#=rP8AckY{4>cywed`j7Zu_0o zp#N1Weh7c-40xQ~w>?y6qsGpnEy4%*#<$1K8(HC$=g%L~D*zywF-k*6=~TA`IMKL( z28()H^10%4uG;4*iR>fC5(rK-^C|d@K>HeZ-~qR?N*FFb`D(Qt2a8By0frz2bXf z5Ty-Fge=43Q2AmH;ZP2Axo7SW)4xS$x-}QAu0S?{dcD7q`?9<}|9tB;J+{UUc*2BB zruPoOb^%BLGt)CQ4w+ljLbl0Qi`IG5IZd8<-mqbLD*bJpq8$uxbLk)NGGLHW zlJ2seGEu2NTDg$ZXFQRklJpvKg8>#ay~T_3`p1m{tm74bD3JONBo76UJQyL;h!pZa zkQlmco&5;bUap2YCx~!!HK0rHJOS)NZ+EZ$xPEqP<}K;OUCMbHc7W>qK{en@8Z2&H zx%+3iG`i55m^)hN}a|B zO-bFxCss||Kt{rdRt@Z%rtRxDEjz^EKxB<8pca@a>!!8Y6`pD>4O)Pn&X3?TPU=A; zUq?YOdjJcl5+EDQFL*Q{$jXCj$DjRvy+7-HsLVRU(mZrJZMFFN4yWaM2NAD?gZH^1 z6u2jwypKLB_H=(=4OvFvSh88fxaeD(2l$ zYMW+vuKw2<=}jC1V53Wx<$k*XJ#1hb#{C5b@=Y{I#&j5L3?9_$*P0bF#r>X*cj#E-ErX~Q$(e{%;#=n@J zOgfj<3>yMSfAufvc?S~gV55ip=CyP%IX453&78Q4NWjK67xeE9UCj&NX>lr%F0(~e zVDF>l*OHl587%f|*U@?2@#ifY=HblS7KT6WxoE-xxtE5{Q0*DuuV;P*EULlGK$Ev| zOp2?43T6X@S#Mdp&BGOc0Huh?@!8xmf%|igbFLS5)z==|SbSQ zTJ*e5e--dQ4ziF|F10_rh-uB`%rju!smZW9{lGa5z%~bj;yRrvUs}@Ldc^Mv;68y6 z%6evH&(x2^#r_#I%WmdcVjTu5Hi zez(ZBILNsy1$n|^Pw~gr@g_Sjm819lKYoDwYjzn*b9wx!xihR7dlqr*UUU0?DIkCo2px(^x;&m| z?gqwD$JT4%6z94%=Q*z!2#{)U(NPpDyK4RGi%-gjt@%RCge$DX_^pO@Oww+<*jCK8 zoJ~Ouj*#B|E|`v z$cBo-}K%q?m{%=}zl= zg66VT%W$4a4pLL`;kRJoruWS{f>7SRd|bcR*vIn|kMN+s2-rTx|KR&RXwhBX#RK-kiif_*9U)J!D3}iIU6Sq} zq5 z>WhKk&FN8L%TZB^ZhV9Z7*i8;b_bVXC6Bd2zv%amG=mNC$;bc7a1#uAUd5fM!jhnu z-4z)NHpT4+I#m;a9R_iMTs%};hufJHyJ7)=SGJbXVj1PxLUJ)LwAfg&TiS7-y*NAk z7i+yi_|@s`V7pkqi+T< z{#rRSVH4@xp9`OEH%1hpWR9({vCYjcspDP8MzBs9iavF`w>#>h)h`GMTYS+LL`aQVe(b?e38WQSe)`%mrT9q zY4#lNvCz+0EWl}TRau|lF(xUOy)W4>2INg`IjmlP1!x`C5kH8Qzxdy;?&I0EyZA8Q z{ifP>v;E}Mb<6t53M)fj1Rze89!D{sU;k)fKU`7aodK-wF;QQCM4_8K_o^%hK2KN2 zNzLhxA0`Z#%sabBP{hCuPEEj!BnRCW@KwKX9(4y{x#q)j@?A7${-*WzL?f1Q)65W3 z)L6e|?zNw)-96YWe)Q}1RY#@pR2XNm-kGPM;Q2+XtyrG+Pp|@s>f%!J z!+TbisgC*mb%FQ-v{Yaqpy7|->zXc7W28zIIn>XeZ}*Q|O>!I|aGWegH-{WhGy-nx zC%X6aejF~>@VKDxfxIXQs-AEIYXF1|3LcT&pU^ zc;pS-#(+I&XQDmw(%&aMr+l^H{IkstRdgo87cW*M@XLVWUxboFkcLu|Dc#CI3e451 zlxfT5Vfes&e#|p8Dlm?lOkV-8c7Op`9?gnQKfyY|B<_|TVBp^cw1X-xq`}YCzu4+h z#Q>Kp)(b%CX~^~7zIGzySJ!sqN-yWUyyE7AZ#*Jt@O6FVo%LH?=GSJjTv>#}No*xK z1pVr`$t|=Pf^Nwu(XJ@SdH#DhFy{b(;&ZAG8%pbzauk*-sI-O>)gsPCgtc=vm;rfH( zi(c2htrU0L1!2>dA!e6-Z)S&ekxYdvDNMGCkHJ^rq%LKVq|Z}GGnk?i8TrJ?mel-# z4xx~ws=jO8+75$TG$v2#6T54gwxt(lP}o8GY3QXs6@|VV(e!aoUo4bARVb7s(Zi57 zTk3M(-wwDG3z?tozvfC!BB*9^u+57|0gu32g_z@O8)C|gU3=lCFJ|JO^|tNo%aSNl zhJ7=Yq}x?HI^NJg#;`5|Hr`LXy`;LD3v6*l>e`SFj@0Pm?}zG^@~Mu4!H0k;%mPz7 zC?(^XzDtd&JORTo3;-gO?$`ojIc+goaWH*ZXm#-r?XhwuBwd-rt7V(o_&xn+=vvi7 zY)_X*WsK3#go&j(_A=sfZ5(W&j0XD(P^=B*$=Bs`8sKlo(0hk^VLh_u_GEoHkHilX zYa*HzJj%qFxLf)YBO$S@4eA*iZmyChKm_}xs}Q2vXazGn?W|JGJ1vGvn;ijvHUVVp zn~x&u&D9m^^kNgahg^kLFJ5Xc*oqeYUz0~AA_~U)vETh9R(%(FquJpQ!$+U=1(E*BdZ0fj{ z&u|EA2QJOXu74%zTk3lP$Er9sgL$l^^~!@b&aThi8(IqYs>b%ou7S(aik-wMX7EXja#_ddpjCBTgBL(uI3c#`Q+D)1}T>b{6c zun&ll+wS$g;Ioofm?0220=?a_V&&Vm`2N!xTB}{T9Qpi?`y7qOcy`$K-0*yVy&XVbrXeYiIYW@Er`|^nt--fr<=y`D z>P>FWbtAh2zg@K9?=`%X;;Y*>Gi=oC2(|;z{h4#8t-M{Bt%8#J?Qo8PY6MOLZy_15O( zaC2o76Q|6DKcwCtG(tczsO}G$f8v+Cix-xhQ3?g0Zb{t-st8XewYQ6En(bNCo^ z6>#eSD|SbQ=Wni zygkVsAU-g#r42BX*Hw58HeYXX8WhW`%mRhOqGdzkQ3JfA?*hv}E#?SS)6%qkQQzF~ z(x#;?Xw&mvBaFiP=Op>T(ShO~Q}>L4L(>{Mgf-S>KhfuUsuj&mi&aOGUk^heiH*Iz zoCav_Y9(}DzJI-bH?IVk#Cx&3*WeY6+my(_!4B-9MRH~u$=T8&-;K_l#n`3VH`Cj! zj#G zpwMAS3?!F0O)YPAi}jqWFDz=lCr&I6$O8FWy(%At`+n6mJE~%I|4+U5%PU+`Mn`68 z0?p!Ac$_hz^`5jYugUmI_M=k(RBc7IJeqq>Z7@vv8!{;8Hn$2{mH6KIg>d=A}mp z&GZ1Zgxq-J(M+H!#vB??Ain5*TGS-0pY}-HRrSXsesbw^fW>g!JeMG+A@|Mh5*3t( z#n%Fvnnf&ilP$Yvde_fDqam@iOC8N7&T`;*b@U0Zw0HNKJ$0T)!x26E= z_>}7mEcnSMtJ!v{8~TPl%gK{Xl)2Z%5&txB4;ULfJmIO|_j~e=KV)Op(apxGov?dW zTi19QXIeq|K?~|+*0#m_)Wz3MuPru~|HFy*`HtWa5b4lh;7xVrIs<2=Sp_HC0O^Xv zjyFJ4ZAy_RgK`$ZE-NY(FMeH%+L?lSJmI$oGGK(ccFY2o6hp2MKmp=R_%He+61)@s z2{>C>b$F|RSklc|4PN^dC69tB;5T2KYBBue-3xxpw|E0|J=O;=eS!2 zhMaH68gzFWK|amayKF!4SxIUHXg?w8CV9|uqhAsZ@Rk{CyX#N@A$fn#wz4dgoMmRP zVdrymTj^r+#S>Ul`o&O`$E)nR%ncO;m5y0ZPt?c8GAY{S?6z(?&%%RGEL|y_#`&qi z^adZc-T{up@cCWT)|fRpx-`sXKblZ#zx8VKf<*kH?BKK~Cg|OD_>fUEaT_+U9?At= zC&P+XNko!6XtiuEWN{(QUdwn?528rAWFJDl)oM&O?e_NZRtR0UT2O&6*rZ&+u2c#j z_YGh7e*AR!uQ4E@xDp|B4F3f{F=cLk-T)oMoa!F%a^$2*g$nOx!ikN;&Hllg-d-WV+F-=_^?(Z=Cy9W9Qvwt7Z%hO}XnX%lqy&%*fA>tz44mgc{ILuIR(In;+~= z#0H-ISEP%)0@D*xrh%;Q11V%}Lqr{Z(HhMrPYp+dhBx3AI< zK>)EfDngrMWdYY97PZgGT?1!?ZA^9#u+uI{=_~N{qbhpgVd7z((%9b@DKzzE6}aMZuX4w=39syh8GyvQPy3$SV1^c%?R1R4BLjcQ zNZ9Q*=_bVjd+Y2hok@sQr+ocbO~da-!A`|_NzV-J5g;9kjLMb>`yIXCai4P(ePgw! zx>WSJS)}=y_0xbX=@KRD$He(^{z`FS0r{%dFJHv5yt2+>`zn(S*GaKLJk@-mq+IdD z;(hG$^`zT;jXf}D_Gq@`txHbfr)d?zRg>4d%V`yZGdAIY@4g*Aw31uRmX_nvfLe((2g(s)|Q2S3@Jl6^M>} zq;A4T#<{Olr`0D1)W6?Jdwjb_?KNnOhWqJttQ_NaD8~nWJ^`+e>TSV9Wk(YtWrmTR zq2r}NF2Bdv8NmkT%kjf?&Us1zGu+%PZH@`0>?#*B2kfvhK%{D3$nD!*iMDApL?WCdgmMt9j#qcNhUriS*jU}TbT%- z)ygo6BmF3)K62G}X8m|s&+jY9zZHDVty>uQOv2beFWD>NS7p|!TAM#CNlN2H31dm6 zs6_q^sAtFl6?RKv0a3YO`j}|kwznR{#pe8UM0q6I#UDIYn_;L|M=&yKg{6fGMUn)Y zlS2Kn#{*Uu#Yufi8W*zz?+YXOQs4-R!58T0DD;VDC_Ys zYIDW%i{){}cqHB}r_4Bus{*82hw`JLXg2$?`cFB(v$%%$r8>(6QuTg=@PDEuB@a8w zkI18>7+eRGtKN?rCiGg>0=&i?g2h>))#no}*HIH4TeqdSYznlCR(Ki;6UtemD&@l- zxBwvpnnWs$r4q=hR>ktm=IsGtn>QCfSye6-BOc}G#Kz0d@aa?Qq*|rH6v8$d;g~vu zi(@wok|V90LGxupcc%M@%jSrD;XCL2z`UQ{-)j{_w)@||Pf&Z~9!@q){OCh4fRS_T zk0gNUEww|>eu@Z6!BF*iWy-PkocTQ(p?REe)TFUny1l85yV&VEqO* zO(1R)uYl&lF_c?=cp0YhU>ZTo%2bGVy&fd<$K*b9Mx@V0Nas!LP|{ZNxD4vD6`w;Z z*Oo(Muy4N%WUzX0anD2o>EBarXvE)z6@5` zrn_l9D{6#zWkF!2R!0x`C`G=|>sEfDam^wm9( z=lVTBAM0%DRALvE1CsW6W8OZCg@>5ba&-B;_?0tX8IsSoMo)ppP^WOzj}~@?NZvIT z9ZKdbyeoM9^JcYX{fc}+W-^4Uv;QzSN1)NYTBMWyEboAGEDK?OFk_GlZfIH*gpOv3 zHbwFTs499X!e6R|N#qsUtA2TiLge;kFB~-dL>$6P5C!(FQwUk`zT?&}B{4%^whE!0 zFx+k6Tijf~%MYG3*MB?k$t=*u({Q?}{+y7YMw7#7JDQXLf)+bKtPa%`-7W?8FG;&A z0e{&hF*(g}#sI58ZE)7h%eO>{gcq--g4-?t<4bU5PpT^rRR6j#KfFKWyu??UL1PEs zVSkJ};LaDW&>Helf-lmn4Bm&Jd8hNI>Gu85 zq$B=I+sEd?vDw)d;<*{&_N*CBDRTKOPWorp>^!3rbUNj$x`XJ18$oePN9=yiRu?}n zQ&XqOUt~!jMh50YQ5%VqtP}lS|169DQzdaoAGaK%;;gKV)c(}R_OQPqhzV*g>#^~j zm^pzP|5J_GVw6ZhjW670Jnv`ehcm@lAjW-36_bG+N~HcQ{38>Zu=;6P@(A>xJ)lL8 zwarM4hKS>XEdMR7I;6I{$!U3ZW1fJA_Rbh68e`PcMaO7@Am@U3g z+p^KbE zS*u^8SB_F6EgZ61y!79{Phfqo0@8WLWd>2jpmHf=fjo`X-K4|6EFRH(3kufahz2%CUE;|sV-h|;G<@RwpZ=o z$0LcqW^LbnvO0Tt6f}1D+Gh3>M#SndLRlknPI7xFOIMSRUcX>l&Ge(|uxgDVtJp8PKs6)4&cC;!E}mo5q9TI*JKI6<_#6TO0jEx2fAA%5Eh_ zeD60pwb(lg*S)@VOW)h^|NXxHxk!#hG^@#Dq4EmX-rm6Vy4QIud66TZ=t(GvGI{ns z(vr8qZN)*e7YOL)bZ6&i?h0Sg^Kh*}3@sQ&3?Ud*i2a*dp*X_=iHnK)lT?HE^ zVc)7=S+IofIk5-|l+CFLCL*M1d;5ILE1RHh_@(obL=BAXEHz~!%^&gmyV&*b$Rh%-V^WA_YL$26IE#3}_0hdDwLysS4jsLgM^nwcFE zlWT}9EhZ27>|v5;FJ6eKg4Yd$8omR`Rl;xe-5r(hn}FpxjI-v!#}H=!69r8*WdAPt z3!)x!1#iCTGK1y@AM<1L`Vw>njC{YUtdcM>kja;HnSg{vca@GTUh|xhN&0TyOyv_y zX-$4HoP2)wamehVLOA6Hz7dZk;6*s}it5Tm@X$)&V*ZZJYB@kz3I; zDl%VzP@?+@+m6@C7LcfsCS@<{{@Gdb01I4a+HGGgSKylt2_N_TI=H<|65k#1-o9T#*SvtUp4^>V{=!lw--x*%~#R( z)^OT-$+QS(x7m~8vgC5V;fZ@0D_my%O-|F18z$6?srd;`Ac z5345=GSPIO$YizMYBvY3x|U9=4i=3rqy6DJg+nG zrCgkFuZTX(j1}K}Pgv}oaFf`S6^_8#T+dXxRlRvTVDn6co%gLpcx^s%qr39VELN0i z@oQWa4VnSxdcq|cA8&fgC?s25~$R0tF(WmL!y7g6{)8nu{* zGhbNdJKCu>*y=QD^Mz*!dsH0b+|y*RG=GBWL(Xk0Qh4m9cmzm7@*S&gyY`^UnAzd?JO3Mfa@A@BSmO`ZRG6f`6JDKDnH3#qo%XUY14TiKotMI zoq!dptKW8hU0ld|k#RkaF7_)zw!xN>qJ51)J}b$(?NXm$jN1RyN%1KTk=7s-jjynW zU+C=hP1*Od%&5^XDPlrdfp0L+t+Zw6Ba^=uSKFXn<^KC51vCfG0d6dL4=q+$Wz#=? zHkXZY!wwZyFVPiLNcBIEjv}cTI(y2SAJ>Z>%gliEp?G=O$xmf<}Hcp zP34%?mN_A3ke`hDK(6{eU8joM;e&>1$TpI)gtaMGq2JUFl-RO zxZD4ol{{uGfFv`_GPiR)SEe+W)vH)RM5wwa9FBXfkBk>yvLlvyRl{!728*WTpQ%5b zlHwQS4JIW2g-s#QF=d{1)vcgh{*-$45h?G@6$lp=s0la6r)Fumjmua zHF72xwaHa7_(ntlMy5|vao|!&w7Bf(lwFk6){fh*`f1ubc&PB4|7B5hDCybT;+gk+ zx;8+5^Y9gMBL5O=Zt-w>*d%DTlsA$>eB>J;{*tj>geq`0rnZW8r0p9UAMv6?a^(jcm9Gg z2dNNTvz(~qp>__Iou}F({@>?|FiTSw2fNVYTYzGt^b!KRv<-fRa-3o?;U8(B-_iofETn-CmFy$^_Z7exiogc-2pzZsv0s*gFH9 zf(bvC^@s);`_1ykUXNBhGxl-VJD&t5*(jzB9#h`VC3vb3RlI$nZPX`$kLG&`?zk78 z`hMU3c9(y>H69~dl_(r-EBGfeU#r1pD7J}t%WQO%Atd|6LTC>mr_MQlMNi4l&bBn8wh3!1oN|)QaM^>DAfA$ z7`C#$j@J^U>cjsqb=TixLw8`ux_m!4y%g9G6KV9hT$6#ZFEv9jjl_(6H;CNy z8g72~t=xZx3;12teGB|1(zv{!l@t?faO+*alxC@+#h_bl+PkzLbl?bXFkY{rF<_K8 zGC$zB!KBoZ-3>LZc1~tJ=pz^INiaovb)s$cLnEXHo7vK)-`-(ejYCTOy`G8Te6n8yvi`a|rPmLI z3A<;Ki{FWPyuJ0d4v#s8SWjEq|DyB|072u$@pOb$?`b7Mo0zgZy9_29qS-h&*qsqV z`h@NK6%c8H!g3Ai9h~+|(_-9^PWSqgy?Gb#6KoDy6GQ|s%xM{JvwkRAwcnYN^UKbC zd?&|8oQFGcPrLEMkU=5E)n>NBjb0|k5diHJL5aEK@Shz$fByTDYE~1xd*3JhSS}L9 z@0s%BGGfV-20!|OOFI&L7p7R6I+>}}?32B65&7)(xNGYoRHQLcLBW{f(|mqAgG}bR zPy_}Fr@c7x!O@cBl6}$SNw9l0Ak8@LHjVZis(ChUG-msK)3B>*^kx<}2x-q|^Xfpw)Dp zoS8?ht?$6c*o|C&K8_BH?yEEF>F5_YXq@IEaw=X^L&u*2H(m{(pPNY8=bYEJP?Teh zBELr=USE9h^_Hl6fFL_;?ahv*I!z0#DbDxveR@I4&NZr{Dt%l=T-NcWEi#b&SwZ;h zMUTbeqYRD-2pC`Ti-&u~x>aIDCUin}`~-h&aN43$rm6F~7)dhT0FiNs^(K znAiK!fyavL7uNQz$aiQgUI-X1r6)~;6<3~`K360cQ^8!6To!SZwt?Quo}*qDtQ0( zkqI(;(`ci!Iyl!yEWG|$S6otEiG zi_DI_zQFsT)VdfQ&`#O%_#W$_wpi^vtW1Y@iC7`EWNe`;IM(B}^^7Z^_<5f_?VojR zxzLsRH+1x$bqXB^xVJZ)jZ)I(X==70-MWEfPNQYSNQU>LyZ{JUHCzeOwW$w~`kgJH zN#VW0Dny)ydzuyc+klc^f2nNnIAjvF8-)L$(pOAiaYUi@5M$Lp=*}UdpmTi8;X0;t z>wm2c{#6kFTs3s+hx0gM@woosYVY2ZYE`-e2{LY_TICZqn6r@^)R<dsFHi4bfbK8WYM#0e>cW>Tn--9>8& zd`DvREkY3WB41Cau^Q|0ss)lbo@dxos;y#(;@)Ye#g2Ykla8W5=r-E#D+~M#V=a$v z%;&yyuk*arA(7wu^5_W|$epp`CZYoImY+E4XiCT7ZV}mUPr|p?f#u5=3H&ds(t#nL zM=0I*WB>oZ^D3S|((@zeRsgtODIQg7D|rU+Qo-}Jmd*2=WA6I7dB9Lav(Oh!PD!qV z7*3m%G7l09cb`*Q522Ucm5xz~1QD~U_j#o;NDJQtzV ze8unQHolB$u3ZC@o|PaYC*T#j*f0XbxN5FDBcO=88@Bu?GFowA_r2#j9winuEow9w z6CqcCYB4r_>eA)q2$0MDK3ORZ@TUEc6>v+q)WK!@REcydgPx%0b4{5)1;4HKp+CTL zA^4_t=g@w;ITMyIRO55}uLacqzDfUf1`{$gGFNiG5oMAc1m6`>Ku%sKi0SB}ET3~y zK$4JMd}x+pXC@kTd@(8<+GGId7X-lAiiNak*h&rs;>OQO2iZqn*=*7s(oazMXZx&o zcQ#vb&E5zGQgVjab!z4iL#Zp}I<*VYlpfh^22FLWh3GgGtJX6j{p=~nVT&yCzk$4l zSxO+6QFr9E%?uciUOLQFpn0*)uDR5pFve!GAeyz9Nhy6pjEHUDm(JtvA)5aE-6I%x zKSeHT&U|+*l**Yw{^el6(~JJ>05CAi_Wh{!{-e&c2SjrAsAI%I7PlEp4;Ucqsb3A) z%^&AZT_`uY^eYRlz;|RJvn!54tV`{{(BjemV{vJ`%K->HsCb{x3;V0uebe{Xeq*U^ zM(lc=2$ahbjGKj>>Q9Oz#ya+!1R$(IYbsV^}J)Qc8d*@Hn0yO*LyA{ z%;nnEIn4zl8WlFP85&km8b`UYqmF>QQPcnRm|(x#?y>=Uq~&Plc3%|LK2;{y+vEl2 z3QR)QJ@1R{+=#u-phHI>WF6crl{BM$)6jP8JR8tqR{=O)ThrbEl17#>ARu=FFpt-~ z_-z(jtZ|eyn7Gsvj;{}B6qmY!F%3d@7a(4ksbJII2uOWShqAo9vwDH@bjyvgDAroc zI-lBcg;C>7eS39KsYYpv?rU61??UEGo8|%~&Y9heW_P#4@G@W@GJAzf;h7;U#mD(L zBPG?aq(XkK=xDjxte4nbnBQ~2SgT}8j;!5k@}eYe<{=_fWOt@A5|z8m;9pRv_QK=@u4%U0+Pyn^vak6XXvp={|(T}H-nqn1J$r6Ds?3g1i z{{}q#+eY`#7pe;V!J)euF46TZ76bFwYYb3q>4)-?SzveWaKP0zC^R=5ut}8Xflq%D@XM!X?1?KF^6cqB^WE8V$P7Tl&42 zr-JALUn-K&jWcrSIjG(e*hw*p@F)?E>1Q*ij7>`E#FR#OO3u&MT6lmrKeyqb#IKGX zc|chT!47RYKP#kJzdMEa0AjdTRHb$VV^fJj>w)Ii=XPZ1oCH@87n$9l7-6l7ZUa8$ zhe?3>{SP3hXx?paP6r_sQrUI|wId>?4}L~G!J`V!cAJ^E7R{oU!RcImd;zcoib@j! zXiXE;ep38SxMMl{4@UoQmFRDOqWz<5Z5|Vo4PRw?asS%R%rMfmO;;u)?~piNZ(ZhjaUmn zedL%ett>IUQgJFBmjyK>9Q(I}L2$ zOrM*rs{HNr{_||Ve8BKTxUkBe8+DlEY)C;+fLl4ZuqRpya*Ti}Beye|RHh0~qDUu~ z^5O5{z{2K3q(yC#G+h!@8^a6@d(Hb1+P;>NKMVN*yK`g2djjv<`q>XAB6bU|q8#|8 zhJ1XAYjku)X@r<21f8mPH>jmRw39Omv?{!rUh&A+M@t^Dnk(blY8e!HgBkqUtVM#2 zN5DI!2};UM8TlIe)Ju^O6t2Q%O!reB_}#;k|3E%UU=Ual~@2S8>rv5cPd>)4Kv z$fWRC>oDIW@*W)VNj(d*w``m~=e8{HL8Hn$Df^^LXvlz#6{L^O2c8!?^{z=D;(UOQ z@>I>2C#=8X6O`K;{LjMrw{~kTsDlc7J&P-#f%-X@0-Uq`vWxx3^-I%uM=#n;D}`Pi zxW|vNg3_`7OCbI%E^qGy$pS;hLotACXFqNkX(q2m(5uvYg}U0Ua4F1oZ)%F8VJFA9 zL-yNibeUF1iEr(}g}Oc!UJB#vWU18wf1gcekS}kc!8MkK@7DcRm+!25hYVGqoR(uR zt~vuBHOsesjPcqUHg~qYG-)CjJ#lU`e_2&}X^W$)ZPV3(`^%^22hwf?_`p^5d9pOi6 z+U);uZt_JvvoE&&3zc>GEhJ2jF#~Vn3BaH%O={Qe9!g=~P3N=P^H1dZCxPW}rSN~9 z;+qAGy>a=1@1y+(^bbQVBCq@|fk#Kba=Ec266>Tpss{f8MA$hH4Jyo=A--Pt`Xt?y`YXWqMwn#xDc!!AHm)ChvjOPWX9lQPapLSYGiTK4PY03=fQ?MzxIsh{7ZpE9shxVc1uHTD|*?lW6hXS*$iz86t$aSE7=}9_b?rU~y z@2$7?DsH|DId6)mO6hKchR?x6b%sFmq51EgQ8Lzdh_X z4lyVu@fh23C$cp5#`Jsiik%9n#9#UzVP}4ZPNk;WA3=pGi2o$E{2Rn{Wb}q+C~1s2 zod%?))H(QitKj#BQ0deBna&*FQN<-CT5GSaSt2U2kFN{_vJIG^+02=~R=uPvr!h!R z?QfKm>n6xFC6zW$uhaE#+vlVOo>tvfH*N&#mA>bqo&QI9>G&DhK{Ywv+Vhtb#l7}u zj`^KD9~i(xLze)F^d2D8Dkdt^hMOuiizol`VYz#dF#?iO8n>F=ermf7GVe&L_0=ofKw-$1}q&dn03sKW^hwt|O|sVzU14iwgYo zOB8LDiaoz$HFAiv9sDO|UG#dd_F%!L(#=*(>y7Vvj=5o@{daqj(ATcO&dPvcUKY1& z%U+Y^c=g1{6%gfYo)iPKF~`H<2h00?Ulzp-dH!vS_#X#wP5z}-Q!H0o_j3E)MMn@W z81SY86S3?5mUhYDcW`IZs&JK|aQe!oQ-1%-dIoD_`&Gy@H zi=5+&*Ehy-UI7=mr(DDGQ8fu#-p+>#H|^n&$F4Xkq%d$Um z;VWOTt$l3j$AA!v^W~KJQ>($OIY|%f>u<8zNa_@$%+P^8HE*8{5#BydkO8WUJDN1C*uq=U&z7lJ36U zBFguk{V|U)5pRYVdmV5Px`-QM_&K`fb4d0nUXfy6+Z=&+ngnZ6o@} z4WO}m{Ox4UH95Cc-`Jp6A9^OP1iWc30Lnfxaa?ZrX9pn$Ofk3bIia5~fS|XU59huvlFNl}2THO8yLY1~| zF;>1vB73lK+I+|d{zHz95qTpK=e67dX;Q)7$3&`aWYc9~1HT}CqucHb*3u$RhFH0` z>P5hHTY8Ewx@qR9-tkRJvP&~^IKpS_OITX!|8zM%`Myv1k{AK1VrVJ!{yMw) zY({TsT!y;bqz70FDS>he!J$;%vbQ3+RhyeT|NOTU&oJhEFMw1a2%lYrJO9$uyxZZj z62GM%;3jg~Z6Jd73I#fBgA;66h#<%B2bnOF>Vuu|6v;XG%LOKmd9eHdX9u7GA~%~Q zBiUjS^*4W7h*E(5p8MIF^0tNLL=ab9;BdJI{iFlebS%)_u2PfX!7OgLLNT$SZ~P>| zae;=vt`n4bR7KZoA_5aCCB&?DZDW3{qAM~P!AnId2auX`1|+H-c#g-fMt@3}%7H|P z;(QYf1-E>wRd(Q2=k)?~Ak{<<_dIe1rUwZ98LU!@deW+t+CRoQ+o?_^Z(xfv35#4EOD zCg5->^i2%-5Evo~%T4zQ%}KT>sNTx=B)$rVmx-(sW-YRdXe-AV=_2{sUp8HQ^}4e8 z?}|xbi?LUKJkOfWYpHyO^mVHJ$YHeXyW<}uU|*$;o5X2km^=kuTFs{$kDk3m{c}LR ztfcM0WDq-Qc5j_G@JA5}aVn?3QX>RukETCd*p#V2g@SAyxVa7Aid}AueHT`V%J0=# z@I)|1)V2Tso0k84?Uo~8GZK!($=1G-yb0W9R|3UKX1y;cTU6IPCvi{VOyQ%%if%+; zQiq2I-hh;PCzWGSXsy)}=pKU%?607n3H_r%B6}hvmLiiv1--GpZ~YlL*WB%q6hDox z^~jYvgN?O6(* zPTPXK3&vyuEgkDpvYWIxV%ENLuWRYas6hZOE-sa=R}tg^_m3*1qsibUy700Zop%={8H*a%gG*;8IEnvBbA8-L#yVZY;k z;%vGtplb-8Xb|0%v zTer@Bw_l+(gLt5!QT7-S(tKm8b^Ku)9=!el0nynyz<>!C+}s~EerrQg+F6$u-k;$d z6_CTjuJkPwiMh$Ce*S?pQZTU0bctGrT^PpeKKitir{LJI`p@&E*HDYBP%6$ z1qZ7M;gFLBHvwv2U}x<-5kW0-iPJAn#hl5hk7Mz85^boi?r1>PYo;)55t99mbWJ9` zDpNCSqi+MU?Y^Cu9S+P^fIuh5LVSRyWM8_Cw5DK~02WcS{)2xb^Az@mM$rCp8| z{whfd%)-)^ir58&crFpdx$V6ZECZ1|s*pNS>?gq>4TuOMQr?@<=O zk^2y7KSV5|>m36s<jHWdzqIgK1Uazq?Pif-3_yPCz6ah6q-ric#~r=V^BN$PYna(s9(iq#t0=vp!!&mr zSC$kQYC>K?E;4eAr635`K|DTRYY0*i$q@ybn>@Eyq;a^0Hx5fziQU+t@%gkdu`rMy zA589~(b#TZSp-bWw9Q_Ltf675>V@hR)-OH}Bc0z*=rMG9JD7!$J zH{pF0$9lH`aZVQ0FvTwt_e%2e6R!ra&H-jT1xWn}y)wI}7rXYsb{rZUcIgtWSoc(B zU?H^WeZ%0eQ+LQ&_4!1PlRt^@#`ytatUMz14%gR+MQf100O6F*QiltPuJffWW z<>;kjR?$Jyp!fk<;0d-@+*48-c=rkWt>1V~u+VwXrPUME&l{SUuZcJ<(aafqYs+s| zf-wNpEp8~Dw?r1Z0Czc7mb{GK58CHdH5SJqdqfW~Aj4gt!GULtRFJTB@hE)XZ}c%j z$Dh>Nq_^H3C#HZsZ@Zx~K*i@!qmGOP|ZYDZMZDMwe zH%3B3<)!pwVh^XD#p%>;Q=+;5h4fN+#Rf0k@B)^Cb=X~>U$E~DulTRn=r~L|4pGSZ z$olCD#AWl-b?49}X+X@(MOdzbju8zGtaByo6{8Kz{{{0{AEt|{dnZ*Ou}hj-T=ue_ zc@zm%9=8_@?|5s!=YN&xKhw`0CPvSFPgZz3vMT;1C-!<@v`aKl14Esf=T8#uAfWZ0 z72f;vH>pq0#ftv{MqjGX99>uZjubqhsni#g-1bN-=nYcK4UGO zl+-Huz|tB@;ph5xNoKWv*3fO2VI+Ye(tz3t<+>J(ecBtJIu#z+3GdB@m`Qy>1MKj; zn{>CbN^^WK*X{vn4YS9@AQKy(@gKnn8Nc1atMYC@(BMoRrk5mx*1sY-F7W9WP2=^& zQiMxAZ)teW8-ibhGyv5msKR_Op#oT_*l$ndAH;`JyKl{kulNCD;tntPYJS?_La%Aa zA01L3m1^icC<>}5l21`|W=diH+477?L>E?5r;*hXMy3hQ`UbjY(Vse^yXf1kjC^67 z(elZ`rCTP-wKtNOc)kG=Z&io=%pFGh{HXtTv}F{Q2&9pYzx$RA{e3V1&0DdihM5~1Cy2Itf4Deq+J(~U)?{VAz z9*f>c+W_W)=e={f^*L=o3TwSef1<@qS=s^zuoZ&5nBWMwL4~quSN)KOlKf;3!6Dsy zMl5Ey>!zN{v9PrY(1m5I2RP~F!Q}^~ob6L}fKsTn%sK3wZGvRHZH+sQ$$@IN{r;~t zgSj&>g2)2}WYM~e3NnSv1Hwbb+tT<_KnSMTiA9~nBJl)w##Q|OxHhI$_<*F$d6IbB zviKU#-gNQgc$LF$${<%iVG0F)*AMANJE6B24ny0cVTXzWi_x9g%1Z4rLwJc+Wd&F6haDyt=%;FPcGVxB z8&s@Nzb>Y0DwAd(r>UsUtN>{)97cD(-lGu&Hk>wW3w~FpR`$>hmO#6=R;fc49AJsX zr&6~-H&c3Rv$WtQ=CokZ|^JJ}SR0WDUqCo(e^hT7GcHG}q|Nk;-mLNv(IL z6mm`Sa;qoz?WYvl!b!N(XnQBML<7@go@iJ70B4L4s;%Zf1-1&mH{k=aWH1eplha9O zae=p2(TNbNuWjfs$J;aexFd075B?HxDbFZBqq+}dBn~Kcc4o>8MN~1wjyfKd$mV6L zLo?wie)Yrk_Dc)j+3n=T7P_ixz0x6O2bqwPI?I?m@#D9~2QbKiMs*&iRz(Xr&!-p->-^AWnaAI+4?1uhUu{LV*k-e<=Zq6_hRe(qZ z%=Z=6*!tAIGO6X1N5|*8lHpdFKEZXLA5oSID?1NH0jbCj(*v$;aoF{r)H{#aC68U+ zvF5{;+!MEEn@T4wBlZg^IhE}6mnSjNg)KEX7dUBV+X1)NXOYQT@0NXJpe@6{lVJ1{9tuz?pMncE)_sd_lHofW|FBL!g}44E#ToGa#tFqiwpG9HQlH|BF$ zNkhYbA^Y(TLCZ+TS&D}=A={oTRFR~LqCaL3rh^9k(WcTLzbQ5OIz)UD2KpH_z{rE= zB@jN4upnEg{GIOj`3pSEXvO3VS?S9Gi7*ix&p!)woR^PDQWt^n>Nu)wK7OT40ovo= zxx95=7`3DdhE4QmW8&g;&-9~rr>f1&yMl0~H_&9A5>r1dKXbdgfk)=Y|6wKqJdSjt zte)@$xk}5CbV9t~=&VQ{x&(EAC3~e=X)*7aXC4m6^ZGKq3owRdB%hXStyJh2`?kq$ z(i17h3y0!F18XiyGESm5cxtZw3u=a3^ff=r`oi;7@;1VIUG14Zd$oB~8ph9*S4IuW zf!8`(b8XWS=>e0ypCRFNVu59|20rD6>WwMvoYAm}Rv*c-?E$j1mk76=DYY>vS`w?p z2BnRV-O9;poG&>8>L>)la1smHygB#(c#Ef&`MVx8s1##VJe%!zt^?vcP6DYZ9%@KJ z6)f{S&KIwPd*Wj*DTY zqC{G?ee>~JhF(%9U(heC!_ET$hk$zJvz@7M5#Y@y8^!gk(5;uRL`X>FIp;;k4rG>g&v4O(fS zXy)qVi~Bp`UYwRr`K07@b+K=f9QF$@XH?7|fd_h((m#DKVzMe!Oe?cvB=TKglKPqB zg>59vk#uLUce!r5Un9LBHTAIC9S`$p08&319>ybg64@pCzFZzbq6{!ynVgp)Taubg z>kWokPR!J4KYq_qRBT11@#HJylRdIqtQ)_a=ZSGRSkM?lt$7unL+V{^ov_71@SINZ z=+$B*v%EH~T9Zb|G(wX6s?EzdCo~6SeI%yjVEvNz%{E3Bv#8UI%P4ZjndfUeVcLT{IKUF zK>@POA~`o@;=D{@fqGuZAbo5yeG)tc1#EmN*NraBUAB~A$Z!xqisqqv#u!aJG&&%a zkOg^A<8RVWoVUU?nwCnt8##y`Ug zhDnh^v6IpO83~V6M1Vn=URtvMlfm3c={I?1pt}`yy3R91t9B?o@ zyRDD0erLD=LR@akOr3h?jl~VIH{^gNG|0U&!0X&LdH$eV)3QA7W&phjylr>GJLa)B z_x763>mz1+%(2J=odCbpyX*Yy{a;+0dAeIuQ>Uxma*>;On;(7y9ckoLsh-T%;|hq% z4B#hyEYH&hThI2|B+W@$_S)K)?Z=@!y#czE8Sk(Ook}BrLETEA`t81MIi}1~I?x-h z;i2=0@VbGr(I3+qdW|c?^+b3a3|*CRfacuB3IA-01%FFJSiu?1;< z`&BR&`OZs|$WO6ER7O~6dHy%i(lA26|a0RWECfodcLK(FG2wno$0dJle#E5gP+i^~b z!t!w7m;YKiuEt5w7+amDg7(MQG_|##usn__oMV!AC9A(F$+HgT3j=P>22#k}2tvx2tPG;ZCxA(vX}yN> z&B@TMB0F|v>w(b4CVA!Vdu_h>a(zfm6GvRCg8>|BzZb`Bqt9C{VD6%Wu@cIz*FdnF zV|2FQzlzDOe_3qfsAh)T)m7i^Z(X&X*H%m-Q8t{Jda!ai*bFjKJq$O@HlhV4dxerEAy; zti~z074*H-2zKEM*7@=j2w)#9+(2>XRZZgm3F=z^nU0;PLHnagK2fY>?uMilLRa58 zyaChiA=`evsa5#yBS5eEB$7{-z`NpI@FeUH-$Z*|W}=LEBt3~xL95X&S5tR`TO=|v zc!sC?MSkmX_`N17OtMbb>n4M{1?RtnIeIJGC{&bp^cS%8M;qcFz5i6Mh&AWB$~`BKp&vd=z=-)&hy0_ zxco~#RJ@$AAhyZw(rt*=PT|yP(LR|tq!Bh9yj{(cG2IWWUvafcHR?$x(S3PK!PYL~ z<*XpCS25#|pBJm$+F(Dw<9)ufUKNsSAjkI1FSOD)Oo-c^7UaiiJ@vAe1T23wdrW9F zL{T;KUF%w;y5L5jLF6`o+IN)$AJe3d2;3DJFj}2gs`@if*T3dP;55#PU09PhZClJy zmnm7qd9R^$^>DrKbEo5<3jMe|>x@5hwcCgK3$)4OaKxU^40X#yr&RkF7@FZlpw%&R zEe)rBY|4N~36>?&>VNpV() zYlNpOcpy~dlntY0RBTtV|Ad`~?p{O7p!|dunRDqO_3k!5uMDP5M22pRxl%h;!NGy! zZY72~qP@xe7Mb(@*f+W4pg!NA99I#4XpdLQUCkOYosimgF|4ja7m~nCIBlARsaa~Q z)6R_&>!=m}2ESkF3;dY#Ac3VZFT6qa)o15o&Lk!kLxb?n9pasw3cknmqgDzw_%Qyc z?6_n94{h-6odpcBSdp8!-Kk=ivfIve`RY63eD3jLjG?9L9s@%AGUiCaXODVz+|KuO z(lsSrb3~G>Kj>`{p!C-}wm}fwCr;jKeWL3xsHZnf?!L@iG%xf?mON$`>cw+ zCFj8rlBcYCRgm4Weu*EW!flx(%gSPQrgzaCgQRkug?cio0nW z1Lf(jym0H+*tka~3|)3LSLl%rVT6B;4Sg(&di3eMY<@vTaEr>@CR?oOefTakxfJ{i z0fm;NU+J?}0;w4TA}5K4V{z_sFZunBK{{4Rrc@4#n*C4H>SN`|c4MJjrxGi>0P8?E z8$Vb?W3(u*)EB%-1-pW>Z5Z%fVRgu-A9;GqT|M=~Yspz>@UU(9l~RUNM8k&uW8zrE zxffA>y7X-q{eb#VTdMB{+wc_kfM0u4Lc2tq%gVXL2e(350*ypIoMv9XT`I}7;Bz47#Y27V zAKE?CFTd72Y9E(AdO5t)sX(D%LYqj;K(dt~`SWW+sKs!nrz2q`4>rDnsuyjGk-@{4 z$)I9HH~G8b&!)qlPBy8}@_!{Mf6e_NZ~zvymjZD*1z={I#f10aDYwSPjg%g#W0&im zmD^0@g=gvAsvS5irB7VcF~(6((9jEzs`=kNL`};ueLIWCZM{6gX^htX24U4GwdT8| z!Q|=0#A-?3Q>TBFHi^vzezf;yRoai5Yp+~9B`JPRul7$Sxy~RA96)!*Jz_P zbvx!vdI28(toZTDi?4GGgK7#5E`eR4K{H|V{iSkQltwYB!|{p7 z#pY40*p=#*M^ex!dl;%-dmLW8quib=98OruJntf`kJ|7)(?In14@YJg<)G4t=iW@1 zzx-vsnJM&zV*CB`FN2p-xGYEuSYm1{HLqoBPKEXX!0CgioKE8w97VthN6itTpqWCx7|*ZdScdQErtPOx;t8@3FaV zbbK`b6puX$N-#^8Za!&C)BdQp3*#o-h1l!EhLx1(01 z5LH#aW5EbkYLwIsGd?IxmV1}2&!s?hraQtw$vpbG2rJ2B3~u^F7cp177#c+mUzXnd z^&QF}{eu}?4had$(UM9~w7@)huviJIq_(_I?hcpRt~TiX+1Xx8y>D|^Q{@#ix`7i? zhTwA7#y$P!^3-q{=Vgy<=g_fj0NnP(3ZC#DmagQO_Ztk{Cms^SokQ;RE1#V%d4+Vg z3?}ogvV;Zn4PEQZ-N=H5Qh>Q$P#n##&#Z z!W($G3q1zY+GmPGiAm1rtdx#o129aFe4|zK68%vNNM09#9-^cEw@-#xo`RnuYb*7l z+i5BCmzRIbxXZr?m_}SRyp&PiVmkek^PE~uaJN0ckPEU<#yzf>BLkyZln;zoz!&kQ zv6i{BQg&aar8*ygOAj`i$t^Z>=wrXawp>;BrH5%D!cMRh;e=Z<;^KQ_V!mM3PW`SC zy_I1#@~V{&j4NS@TI7FDMLCSMmzM(Yb~gZrD!o7xX=8BwliS+A!)*`hn6q=7WARDBu&JA9zs5)>CJN$hLRsyZLB^viu;h~(f}E5d}R zmAsZnKLzDW&%#I|znKv_yztv`75;kQ-?x_P$E|xZZ&(tsS7iPN8X*?HPTSM1ilWxbZL9`-Ues-zOrM|8nYShf6}-~b#(N!2d2`lV{DYswH(S)YqhqqsCQ^39cix&G}-lMy#Wa#^h8g zCHMpbT0;BB$+y`p_-%$I@8**hvDT>p>*t*K@5U93q40tyh^{9cd90?nIzLbHl##Xn z*ff8la8>%uhjjjAuB|ea)gjT2b6?k-wnvO5;LhTfzNXiup&QY%)4+)Rxyu`CnOW5k zZ+R@qd#aLV`0Yd0t3lO!4Jac5O`s|pd=;qaf39M=W@9E6>8&{#vEBQ2am>TpG{76F z)Hr#=?nFOUlnU|dTRTKTsC`Joy=UdE4^&2-PS$DgF73)F(y8mhjoNOZK9J8N5?20( z%!O)jz|k+zVZST>=5ZiT41}tb@1G@?jRJxECqE1!KI`q>LNpM zbC&~LX9%pf_ze{lCurlRQl806P0^yRsYI(+}`kBafM?4#au2xAc9h+6#sjW%hBwdV!&1;k_LadFM3S2VBH1EcZ zUz|EBJgR;{8YnXXU)fiepi42tyauM%lhyD}%WDkkj85~;$1>;5L6A);(s7SFWJVY5 zDA^a=Z(~{paC-y;VjZC6?&XdWJHD7wLOtHD*-4{lN8Ure*Tk)BZf?%!3Y1(WX}J5e zd7g5itre-EUQ7tj1eShX$~ZP>yR#bEvj>Cc_(%-146 zAY6GC%y1&`KFy{P=H<~+jsmW)nk;&0 zFF!U*y|ZXMepE87y%foA^yeo59N*Vv1f78PTKrYXX}oZLRa3Dcu5NXD)O%b*j*DC$jT*HQWYaJg@YDZdzB?NPCo%3_#z+2>_s-`g&XZPToV zAI6rwPoHbL!!PtuBg(in{1A9|)P{Ew8|8*Qw@@TS|5jd@0_3||jVn`*|Bz|VHbnJZ z++mv;PW{U29ahYFFQ4~eB~wQ3kx(a2R6J96QN6Hxw_q`{?{05(8BF)bnVFmc5^;0T) z8X=J?{Os?o_lsfhuA1pY-ge(L|5c^Wg^$%)3=y0TNloN~$n46Cu>p>WjZ zQOVe|j1ZN`y}8?DsMCGwbf1WHfGI}exg%g^b&Yy?&av--qotGQf%7;&NHmBXb9KT} zp6w&UNUjae?Hm6#EVtBUrpdNsqLJx}hNg#x%?hm;E7|yWGPsWr?4%EvL6hpct?nlJ z?Cuy|CGD%8R(ho$#-KOEK+WaLCiQr&Hy)0TcdfXfD$OF!^JYq4bMn=z^W8i~I%`yG zzYE8D#>pW9Uqu)Buu?@=5&6Jm#qC$WzWNsAZb0H-n2H)sOUh-*O{5UEn zX(!jm-cH3>huD^+rMW2dJJB#G*T(H&4T?oZ_)(q-&<<;FBWT_3TWj8Ikl}77N39Tk*?|y zxwzk=ez~kTBiIxZXnx00Ne{)xyL~j=^c(Ab+4a#+_1_6s=Ar^m<;Q`iGtP#!M z5VVcb?A*idLtdo(OMNd~j4BUe8Kw7TM><}bgvo)jtfy8)3On@i6nfi}Zrz#98Hlo@ z+=2U3qmg2r`^QUWRgrIubQI!UPBwl?iVt<{2C?j`>Ifs>twhRJ+bLf!Ujif=_PIXPi@6vB9VT?-C93o_1o~9vrk}oIkx%nl`);Ob9CZ7lCjZ{~XlTism?Xc74S^;O*1-H!eMv!@u?RXa`5|w9E7n(?#s1p99 z%Lbx<$Z1z4q1l6G_t0DJ8_NBD-Dr=d*W(bW?LLk<<1}O8=y}gB{{Uw*@y~`Vi zy%xpMYrrIrb%2 zPcVe&99U>#aGj26&*=RGJaW}nxTs1#=w47cY8iTU2 zBhM>QJ0+2)L#*2I`+${4K$r)Z9?I7FiWo(|ufq5y5W^FVLmh1+b4-e(&J~k83~vOZ z928><_Ojm-X-QRap2l8=VNi7%E}eZiYL4x_4{Zv3Wqbugqfl{T?a?$aB}VM@viE61Hx+dGRR5T^C=SZg2ZH z9Mlme{F=U$m-LXS$D6GCiRB0nKO)Jy zv#RfyPaKbrO8I(_o^L|VS>eWF&ptD!+`5Z?wQp_X*LGTbJJLZ7@p!{aTC_kpz*Kx^ zDK_+-sSSJcVp(?ZOB0u4c7VKLw)OV-bOceO<-OH@B_mz=2*o_j@wSafF@LwhcRYOmA?tqfiSEqCf9;K#a4AK zMB$M~Mki*JT6`BqOyHZdfR2(NnQD|Cqu>?)u$~n})Tl>dpi~n#OluVTnnzw)Bfe9Z zB%4G{CxOSQgtp^=(EL=f-IFB$G?!wmEJ~{S2Q-p06USyoGMTI6eI_|Yz!P()>mHkJJ1XeDw7gu)p&T zwS*^ioq}}^0%}n2ibI1#Ev}3TJ}mq3j3A=8&oqTR888pV>1>bHZoNd-$Bbh56NfrB zuiEU-+~iSN*F3%=V1FPOE^@z;(GpbhCru40!e55VCQb0VF||Bsd|t+A`5XBmmnrLz zdQz9^_=#yzy4A$11nqkieM6pIlUf;cX!&zw#Y($C0Ow5>+7ciMx<;OS%O(%fDAYCv?QbSi2D_1KsNPOra35_&0aG z^42VPi=UbfUa}em(<(tQQ&&}a74797;}=w{W&}HOVObsxmdDIl1NojI?9kp5tqjLX zY{dD4B;A|e1Cpsv9aj7idBVxW<0W7&SbJ?J#u`4`gFhzaSUX+Z*s%TWdJ;||Xt$EBGpCP$5Gx<9gmPl|T(-b2AI&tA&@D$l zhfyncPnL+RlOORfx?|@%6xBK&eWg5tzecn;+Age|=Yn$Bd-34Rx-#T_+3C_t=>%&VhNsA|1XTsmbj4KrIIcDLNwG; z{q&NdAdK~(2gnSUj{11hP1ENd9PsytGHJiU;U1D;F^O)}A2bGP#4wS~PsPggWXkgG z(|f3u`Hdi7_gPNYWOE0fp29Ijn+NonZA8l}$%QGNBsmeZ#nd5zz#sKqcaKKZ+vBx7 zmKWM`MY5k|+*FkZ6!httTMQ$NtTs|tB9+xWu&*>Q}!A^kT zmP83$CXl8pR-k8mf%#4X0*&IaOzlP?R(>C+axpbD$^0sHj{TDUS+}ure=jB{iJuMA zTz8TFg^(rFuR{Z+XL+RB32*5{2nk@p#34GO!~6SR)EF>sNE2(gFk-NHsQV-T$xyiK zLE4F&4smQ;AY_^Ar+;46~3#U9|}OQ;sHt!J@GWHJ7{=7jHJ( zI;3P(!*ZfY-Y3qn^K=sSTCJNNVzg(eh=%D@=ARs?*V05D=1mLH4}Kbbr^2uVz5U|p zaz5*z_$Gw`Lu{p0z59)(&Wc1Hqrl{%?sz*y8$WQJNjCD{?9g{6Z=GT3Y=QiDxfWHu zalCOc9LMB>>17Dt=g)}%mQJF++=bN}`zD1=fLyCG|D&tuz%QOAIMjh!deT&_UR}0CFLMy5eP!*+1X*1!=?X9#(jZ2y$Y>Qu zoMTOS%h_CgXE~XB{98rG2B*ypzT14+*p%fn8vz={k-DnrrRrSoT2RNlV`dxcuS%u? z#~b?KGW!$&&Y{A8fnqEPfRps{k|A1 zJ1ApfqkMGt8b}YtTRt+_TwZ->hHMcV5>0)3&SRP#tuu@oxgaFZk?;}VD6k1X&IN?*&Sux4`x zJSTFeQ=`%@F_6%ja?2fvy_j6pZY$Y$Yl9<6y%20KEXjETw?kNByDB-`iyliAOlYE0 ztW1S?F_0$bkYc7%sK($v%~_LS@G2VjzPj>Me54*AZiX)emtMS)Pk2(Rb}xTuJzZqK z`||e-jB2k5LNe8?0H8Pi(eeD~V*gnn6!y>Ui7o?QGIMk}=)=7HyBv|-m9507e`m7P zu498rCh;e>m*blqif7yCcNUxMP);?t5FOQ$I0QD+1BgF6T(=7D3uPlY$)UqW7zxM4 z3XV>yc{W1Y#j5Uel8Eesk3#tkcY)c|Db~mP{!4MID?9<@{-d63YpnYl8HX+Sv(|6k zV3aJyqN@;=n{l!f!4J=b$DygV?BHe{A(P|T3Uz*~2}N0@+hAW^Ok_;)ct`&!pkthf zM+QCL#PQE#431$vYC8?(0_od-e4S2mc$6NVu7>bFA^SdghJlq%o-d?*BE5;`cP51V z5AT~b$dG5y%|Y1u2U$9C%YFl{at8*AFKRw zc^PKj7^lJUf-#a(?jTs__a~**)x!a7ao&GvO1xqLB!^?ZnUS-ia)U1H$pD5zeU;7i z6gN=@d>T$<2S-YjJRB%^xiCApQC2=tm(d<0Y-BBI5TDLx0u*+y=Q|z+8>{O7jQw_D; zQRTFn zelUEj>4423NWHa?ADVqf&r?D=759u91s%slUv;slb%(jPBfC>oQY687$!apV<0Yo5 zB}ccQOY*}dVdvhF>U{`q{d~~87;fuyg@uEDM~I?1sO4T#rq|h<=-mSPV1q}oJ*S{5 z{D-P1b&uVCwOQ1)6i0+t`ThiB&CGoE&7wmrJsFQYE^ULwbsvLP^@tnUJw+CZQG6u$Jg?1ujf!t~MV0W(!6 zU_o*e$G#7gp7#^jEYp)f)y)q;K{6)l2HRaYhC|H2-ztNzRqq^8egfNJbX29rwPfWo z(MmbjmO#qq_mULuIL@2*K$4&^X4oO*|~Oo0+?pAHLu`#$!gWYI zAbxl9UdyX5Tgobc{rtI#W}5r;JBOVGDrx7=Xa)`CLPAdSh3+VtS9-tqCjoF*chaW)|%b;DsM#5TG9<#b{$3z=B^z{f%$qL0al`|3=fpP^Ko#rl`GOB} zM0u$T==9YB#k({4laP-5LM6=m<-eN3&agatYs(_f_%nJtJ-&C`AZ+jmQ9U+2}| zKb;qXq!>;iWoOxOnwXlkfoPRX36WcNE>d>^M;yq)fNvX@#n5 zwvvQ)wO`xejnn5*!EuAY>X3;H$Au>5SbAP|JsK)W0r)(+P9G+1#PWf>suF_)^AkvmIT{^%cW7~VI zd3(HFHKj-MESgbkirsQ#P>VFC_kw;^_hiYaZziHGh~2&T71&l(dl1{8bmyw8kI-V_ z2>liYO^XHE47=?-HWKK@e^-BXKla|y6S1h@oap@t2xEbSm*rOT1?wY-lb^-i4~qQF zLSxR42V!&YdjS&FOs$puMV5yr1xh8r_$U~*g&;|;1L0DE!b2jr3Ejz&gv76;mI;mb z|3CBu58NjC0=Sxd-_YTFcZK#Y3NG(D%-Oa0V+2(t$8lSEY7~9+q+{G8k+T;a9r>dZ zNtz4a#%DVy#)2{jDoRWhaJ$~<93}>9pxIZUTYUl;q`yRxzR)&sxd#{Tm+T7@l4l94 zm6ZL+^zfCGkCChi`&D9~q85oeq%E8%X*y2(`n3TyS;_wWG53Dbc=9+mYj3cfJ8YoW zWxq6O-KqY(%AvLaY&Ass9pR_X>^$KGIP=;iQ-E7&aI-;yV~ZtwHMRXx?QLxlVCow# zG5Hv^zW2KgwkeL4M_!(;ae$5bpC6JF4IeDF7!K_5VkbTpbb5-q=sD42c;d^#n3VCj zb@}Gx`Y5qV47;ndD~O4!S?xlmNKeezV?70m z{<2u159lb9xhqR-dMXg@+SVy2x1D_Ts%|}9eQvj_I7fW}V(p9P`7j=HhA3y^M})-BVzpoWg2B2FQF6-oTHhE*e7%7;bEV3pr_NlBodU5-cFJa>jf%Gz8&6f6Fw#(U-qijCFk955g^LK4F^%} zJvW#QmuMl^wQkes@#)%Q;zit`xgwsO`vabn%jxP@s0z}s%kqw;YJ;|DE~j0A=9VuJ z9uDELMuz^W!E(THLV@a`=B1cUJ(poO?s29lL3yd+0M#lx2ggvo+m=YdWmB2{dZ^Hm z*Xj(_e;TC6*y2f#cvErKBR^$r>IohuHe8-*IF$)eA6xp#q3XV9rmjs+-I>(LmQ7_` zH+5YmerdE+4?07>-bqTvGE(4?zc>zD)wP=Gepv`4#5;O^k85U-Tk-t><*=a8M`dWW zxFfU7uWX{y#(T1AyP#&NuL;4#5e08F>=j~$WKez7KBLpsW|M7RyB;He{yp$0hSKyA z-)b>5qP{%!{vo&6{6co}n8m1FuEg@k%Q^&tx@m&G&FMRb zB=XG^UkATcwh^!ryS~*f;^R{!GA)6zoVvQKDNUqd5F!1AK*&##N{w_Pgm}}4cBD3?Vv&E5A(!~)yU^Cah z*jbRM)!Yv$7!Q%$Ne3UO0Nq<$B3*k{6R>fV`BQsdY?m{qfLe2L-RHGrN!+OWh;xf^ z7(OctT(uBaFH}Ku+&6LuVK(sBf?C1Pj;)L5t{2xAaUO~Jz`7C`2;UMzImTZ9?eg+e z^aF@o&*nv<6iT`|CfDgqc5%V8c{a?EQ8T0!^(j$DMNbvlPUBU~Eo=-|V?(ZT^JE?nB zVNWYEbdP-=w|oB0oHXiU2k`bf=ZpR|)M1kFq`1q}TGe09A{9!1n9^nGza^ONXwAHH zn*i@&V9>+-@Dcy-E7Jn*$9)L5#qr9{!&hFwggfw>1scLmR5fyFHrPw7XNnOsb3pdp z@N8$2hB=yQda3f}WLUPuZd*CAVeW-Evwxk-c|sqcy5vl}c=m7a{_x+%F6pl+1JuWV zmM6d`yf=YkL<71CGJyX|2RHx`!33<5->@lxPyns%gSce2bbPb+Ad~+%{nLK4oN)FZ^@8O4&h z?nMoC*JqMJ+?J8&d>7&+#siFqXL(}I(nB+Uj12@m@DX<^%x!91*-rJl64-K_+XW;x#Z$(BlLf_LKUaF&f zwbD$ThWf?J%3mM3_gki~p-^7PM1O_1A@XU?>#U`!=+XBZ18M#})`WkqP}UGC{-ov{ zJ*N$vKH_ozn>Ej`P5~C@FCv@%STLV)IA6omekf4B-Oew~RR8_S7F<9*bcMCFhCR`d zxEC2JeK3v;8+*CKnUTsBP8D3 zFav{Y#F@bRDz@SNZrbmKTBvlCe(=E(^n3XiF6qD7RAJf3Ogo|p(3>P4u==50ftIelaEw$-rLIm4l-!EK{x`~=&ooLErxN;&mm4` zR#y&@q^%tXSQOII{zx_ElPsHmmL*V`J>3)8O!dY*LVy1^3xIfT!|~?g@P#^j^B#=v zhLqL#j-1!|ECMj6xpsl%lI+Etw{N(v9{3);7%D?OHN4>Fv&hL0^m# zu}gmGqyPdE=!QIxNanVeT@AxY!6M(aM5A>^MGe&zr8)c0Cl?ocbLUOnmDV za{sNPX4{c50tgkibTh|*Z`gNL^rS=Q@3xvKa;D_OGshoQ6+}L8_nr%$u2HQ2upC;k zkQ{0Dhvjh8PO`orogZ8p53dBX_J@fC-Lb*uyVsRs268+sL(WVBzNOJNlYc=h$ODH# zbO9|o*yb+E#5j@KEtWolnvLF^-p*2-pT5*-!E6{TCk|eA#qu@uUY)7{4qNcItWx8F z^77-gTgIFpb$}w!A?OfAucZER#Oh=7C*Xr-D(}9towW;*b`1kn!~K(#J(rc{Z3`&qD@%m>58GB`>hQT%{SG}thpQ`~V;&-u3IF>LW<>)Bp< z>GLhf&26q?O$?ifb(P_B8U^7`Kg1j z%-;A?e4LYYa!x@5O_y0a(Dd;lk=63iO*-+sxQWB6(zy8P7JELLh2^m7?C0pitB*AIy^!QMuvaU}*%n>GFP%?EvQPzbtIi z=&wOPFIq8#C4HhU^qY8Sb^uS zPR3Hfhubm=DGpxYye_((_t3~pYL65>axV^X=eVyRNVLsxmIoQKjx_{cw<|oVIC7Hm z1{5zxf0yO=MN%f{G)FDAWr&O}DGsXzJ;+iZ3>c7yt&{3zBL;iGK02jdl}) zv~_v39@H_{b0P6JmZ<4B{=imaJd_23GXQ4q0wquuFl!;)uaCasXRv=72?Ozyhr7K+ z=VBQ9V}JC61rX86dIXYVe zYDNINX1S(#82Ts%a`q$}6*yw0@(WP&CqUb3bbCm@{^bF`yJ2&Wx>a%8yZY4_4fHV> z=2!Vg*NDRc;rRMhTM6w$9*vLa?6D@d_3E#MwyafE&l-rd5%nyslT!9mY4JL6Y{_IZ zNM!LXtGNpB2cD~NN?P+wg**F-oftozO>qB2RFMj}W0#vbVR&UE+(;)L+dngO09PVz{?VHzcCSU&RBc4a4t$R{Q{b-oWT^y*PUJ)Nq{oK`UvkbmdOPv0kB7Yy-*Cv8=TJNU>nw>5wLY?iwC&&I@Pv!6#PgNU-+YyZXj{`VxC%&O1At8pYD$F?wwir?lIoK z8{xoA&NPJUI&<|C!>czCvi4K84X-yxzIKdyDJTMP8CjX`G=+fZp7aaiT&=DDQQPfw z^enCt^|dJh&-#1dPuU{@sY=ljPI;E81OAI-(+!;MOX#o9#toBRcG>h!clD*4Wwwb zhY~_SWI5^wiQ8+W&yTO4JVh&$)y!BV3#L|7FEb$<{i$Wnaib#tjKULtD5d0+^e3N- z1D|qW&zEBoA$1(CP2*%~R1_SoC0fNXh34qIv)?foE!|XQK@fDzEoT6wbe#K^A9Cf2 z)9cWR#$NNM zliWNoaf#>HRScS+J=pTQYHsmwhI8qp_4uE@Q5gReMVKW3&?Ba5LA@@8@F#vj8mo89 zr=_jymqWRCD3u)_WY`v$_( zl{`3CaoCMc^;$yv21>BmGIw`!=_fwYuZ#F=jf~;mPoTRm8Mk+}+Ph&VeRd<@~$ z6ws+1Z`8K+$3qu1ID@~&w9w@?K^@m^HDUY?M~B@VHnK}&}sub5juVmR=I$Lf?IaI>rIMx~*fKZUVwG5t+=0Jt1s z<^#q7$e5(0H-e6Li~b}Az~DI4gFY~cc~Vmymyn$R2fsy6_yE;K{Yn2N@LMu@;V><< zDo-bu-vz9YGeB>rkRaN!DR>#=Z16I#Yq>DHdWxQrjkQgD{{^%UGA0y?pyjEAZxs^Q zER1%oc^!)1zBx(PU73&{*ml&(RjhS9loPv}z78}GLYaFpor_qwvyc?Nk9_8R8csqZ zCzj|UxcqHQClkaw!u;`2osTYcNv825WA*ulvMZLU|87fC!gak!CBm+4qE-26uFLsg zIpSpAO1*_gX{Bk4Jp+k=NxU!SLel))t}G9u!ms`sbN6c9snSn08-PcB>vC*vTTe%~ z#m3s|W2+eE#U>r*-Kb$Ey_=#TR$;(yC!^Dxw+}stokl-fb&`lba=vq*_;Ka0NL=>q zYT}&do+skY%YuCO5(=Ho9v36V`MZZSgrj+pdPwQg(N7e?xHc%(MHXs4+_9(QcB*s< z^iKNB3IQl&2sk6h*cp$KV`7Q_IxsLjO_mG+2DW9cOagg8pyrQxG_8_?AI$YVtxAD8 zd3jKFlYQ4@=-Bw;l!U~z&y{$uk)B~!u|G#walD*PFZF+iX#N#f_Ehxb4{S5$wRZj`zTQy|9`dL?pAE)qB; zE4e%Q^&;r+qdnN9n34SMB_*@lsHvDKheJ&cb53H_4*QnOl2|#o)8H~GVHwdS|LeiT z6CMdKM|>C089`^T?qq*Tu-Ddlm-Y< zgaN@8jfoJT8?Ieq)Yn}^Xlh<;Q~j^^__w#@hcor(59CdKI7~nWAO@I>Q>X|a+n`U* z#*+e+MQFghMvvsHDH1zxkfHuQY`DK2(B{I&{W*+o*&p@yBli#_`wBnw)YBkn024;W z1QO1gV3z4KL_;FL8h&tI`|^P3oJaK2XD>T}1PQs)&ky0ir6-VgcXX+>tyOaN_zM2>r%X0DNmVFpYiyJz-Tc}@Li8P*&L>Y>raFqdi@x>8%Bk} zP5p1-NlXD!C19q;3BlsCBPY;`z3?!Gdfs|*I6O=TDF_tm%#t|~GCm`Ae*d-)yHOGS z#QA-xe=5$uZBQgkE?Q^tjX$gt`zzkBl=(KIBX3`&h`Cg|0JCMEhOrhA^Uad_>XZf@xz*2@S*s6 zAbx$m&quY4($>IRt##=dDxxFiK$R0}$47O!`tQpt=_S0vs;_s>QLXJBoM^L_oe%k3uORUPVc31#U_IP*-uWZ~+MSjd@9a0i0W7b%^LCHrX*U ze2j6BP$}zBZNGXsKOg6&cQHO-<(O z-C|CA2Kaj1cK4p?pw@ZdikiV{#dXK_O?gyT&t*voiom`HmS02JYK+w!5 zujck+>SA+cNNYFwHdWdF?duPFm&kqF)>9eip{Q&3fH5ZyMyHj40>cof?nD4B1o5eI z3ktXEvuGeYMoGgjw#}_hytZ(85gbF_Lops#F-!3qcDIb)@M!9{Gid`UdLuOCfxsa{nh4pVFMaIm$+r^X135(@D9XWoO38g)~W{Y z!!KHjRKn-P6)+OtIpW)DE-te%`rT5iO7|5WGLDuWr;%KFg*wq^+xmMm^RGQT;f^Ns zVGQ+MUSSOd0eW#{kQVhGsY}3fZ zESHKss>%)q1e}GYmF#==nC(IuqCneNflDySui^TZW5|rNBvN-l`O%-}>kRjP?@sHjCGI zPe*6Smf};78}6YhM=3F~mi3oLH2H9LKNPYuLDP5yrPI}jN}At#Z74u}E_PB> zXU{3P7|^qXz?J=JH{a{-C=4^V0@U*5J<&+P{Hc3+WLN?K|C2RVRv#9>fZ82fVChKI zyI$r`f{=LDmrWKULVISh3E}&mQE$TK6XuM^?VHVH!Wtxzu*a!I%dd(tI0Ob(KN1E{ z)&zKM94cU)ltel?nl};FOFX8WHU@ds3GGfr>&mIo$l`F{>Xl9ao)n82GL3LaNw}a)hgT}y4Z~C|OXgLx;)_biA5DA6w)=PTGRsNs73DT~lDJ(>6<-3^Sp;wOy0@ zV^i}GsjhS7mLfZ)74dSsI9X^q%Y4EU+7m@Xu}k9iA%`na`l~;dQ^_h^P3)P!QykxHserny-b&!LY2x zgg>4rEaqLT7S#i}_vUQcimEJ>kW)Fu{fZ!Oyy{q=)?hr6r2c-cwb|+AU4~ep_CqGD z=fgAZq0){>g`$rFrw10~4`F@R2FCCEyi?~D^X?P?+1k;5+COcTx7$Q(ol4~}V^i~G zZ$<KfLAJmX``iR78O!@^nAsQ5$~VpS<{ciwP6$xJZV;Gw!QSMHYhW&f^{h>!2A$lFQ(erap8 zn67e?05m}zpN_93huWSbGH7tT-QFpcafSRq^ExB#Z$_;F^@rVXbrP5Vl_;?ozgkZv zp-jA+H8>`K>iP6xooSCO-#$c@*`D9nXd*s)N&gUk33;}37XS*0?rxkS=u{ZH(m7vU zo$VUW?bkT$#&FI#3b|ixie1{RNt=R-7SjweP3u=c1VYj5xbX=_!Ua_PUYWyuVz4=o zUZ;Gf7Vtm@AyrFveq_O7g(UD!ZlwnKJ17iy_c@(%Z#`~Hfctob*qGUP?Fjrr&`%{+&&SP}^_}EZ3tKwc z;roWlWP2)1^F4LH_A`E3CAww_BDDHTULjRe?{}QHoG!yNR(!LaZ^zrirj%60vD#0a zBTlW~E%)ZA?d7Yh8$Yf0vZxJCeI2HZeBlI#u_QXq9>oj^RU#{^{uY1h@J+$$~~A^y;+2^|eG*k0ctFis*Pal1(S zpa6)%VPr#@rZ}f8{Z<@_?jRFkXN`c!Om94E58Csn8sHi(^V2V`rx4N<)}8r{K7na`K|h%BtNdnP=fX!h z%y+Npp7NHiw|Tv=twdYLXI*;+pL;4_wTfKRA=cRlh7bMF9^#^wYHv!HHxg8%dbmV8 zmO`_htkSl1S(*1~BfN>W9^)k!e|!kXAqnvyNWH+y%qJCmueQzSNL&x<%ZBi$73W;$ zE3cB0lTp9N6vEL#!>#o{wzNNkn-h;ibU*rWeziACR``W3;M&*5EnCoblO-!Fk;Qx5 zUc*ffF?|c~yvLCDyX zyY?z-_R#s<_0(99$x^D@K#W&$2aI58;X;M1K&Lk?Jp{=5&Z6V*vn1E2iXXeQ5~hOC zx2<>JsjB|@+^llS@S(to7|AJP-Y-ru+W2IDl3Ja${_7S?wC}y+6k`%pT8T(z-h@~J z*<&^{5WchD+avO@!%b}5?@f5eUI#b*8deh1E_=V-u}hwp^;rCSy_xtnDAUMULa|PR z(-}F;!qutW2I!ajEj*Xku1+Aw99{RwbT{F*!h3`iP;D?BYaeAbS1VE1_#$qB)ox3y z8BI6`rR`Wwcne2G1IfHiDgkJK};U}I1bPTA^#2b}8v{SemP206zpgnI~>oCfn0^DF4{tPjk*vn zo0WS_^rEI%F4}8Heu~@6_0+9DRRVP~tg7NqdZd@efu_Bwb}5J`h6C}H3A;Q{SW5L8 zM#!y9^*#Z&-kz)gg5AIVfA~7^N-EtY(%qdB(t?0= zsVFTSL&G2qA|N0&bPnC{-R?K`exAMG&)Yxn@Nm56j&)sYt@C%TNADkh|EVqXL`rzP zI~bh=r4%zGVSa@ZX31h8L_O~n?L961Fw82==#7GbZ$f5hVA+ zKU(XzEpM^OUZpxpYvZR2jG*AUQU}`3Hs&&|cw4-hw>bXi$3mtzEjMUS)WsGJ(8e{e z5loy1NZF31Cl_(CH2iiyivlX~_knk<;#2Dw1V`F0yR`Z3LllQD-M{u1Bc3GJx55m?HuGhT2#wG3BbJ3pP~|EB{`9y`U9rYWrn9hI=Hw=oAWDNMK+R zKj@V?@!~%~uY1{D=#T|w%=s1g>?1z$avXlqUVJcSG=l&dlm{U`@SD?l3Nl~d+shzE z8`JMBpX?$|chNUM=@(F;%sl%A4AU5Blty%Wgv$mE|HP^oR!3-Zz*X-aUWlf|vW9mK z4NKhGRmxNnjbiT$W_*D#nz?8ddsK=y-W;4c^XWk4kq}RoNMeM~NwVe7B%*6Upu_3& z29og2qJKKoi$|Ke)X4eAC;vz88fW!tvJbmv-ALvip&|H%jFks|;#OdBmVlsMM(d$Sf0xiWAzn>s}a$d;cj6 z6R5u^*5V{9Akl`H@-E=VF1!0T#mpIW#0o7(j7fnEW1yHU&94w}_+sLAoBp0z&L!f* zaICM~7sFqegx?*8_aaPXdbeOMvjN-9T+*6=oz}#3LEtThYxCm;1=6y9ud!}K=5GoI ztJf3e^dHoS_o4aU*ziv89@YE2eFinp;~o2A&(mGgY(FD-@MiALwJMT$AL1I8$_v}7 ztZg=)4U_DM#i4av_U-$MBHS~dbH2L}3NbOGH;VJ#d3!iJSH}2^Vq@^fBK4ek7nuKlJL+ z;T8OMS#NM5{>Y(-wOoX@OlwI`R~WYC?ZMkrGkdMQdIGNcHhO~HGTx^VgfwMydY0+R zFppXFyVKl1tG1pW^9`i&Cix8dbH}@Hau5j&ePe_1!5rJAW7oXRg-eiWsXfnuR*iB{ z%f)7K>7$eKmd)qUAcD$!#&N|~G1@V>8_Kawzw%_*d|}W_w4F=`WM`CmttzP}L42?I zkYi6e_U@(`eptS^uZKSTz~^-L!Orw=Htp`?=n!fFn=}R@M=LKb89!wI=eHD(zZ#_v zmU7xLt8Dx3DJSAW{d&U~{3>r3I^(x_-HHoa4ZP6)0q-RB7!!;f1sU(YDW$z&>Exz< zER+Uvb}S9g39@Rk=nteOHi>$F*${W=*!p&WP7L?<{Tmw%ej?p|d z^19+qd$X|(;P>UloOD6$HPm5mrDXBY3waCNg7+^?N25Ap0S0QrbtHio?$MmrNeg?E(y>W#pQCxoN*j$T91@mhh-3K<>Sjt^ zbq&w;at7MxRk}Wgnos1o7OwNE~Y+jkgQTfM9$P& zn|D-2W1(4#eRb*l7uCsaqq(QRv<#w6YjiEiC=1n_mFAGQKh8*Z<^uEJGSWX}e{yNP zI1?xPKA0QJR*0Re3MpaWTObMal4tg&x@alZwDoCAxy3{5D_ou|f+>xJdWpS-Z^1olmP8q$hZNV0 z%WaW~%$%7RFm=bqhA5xxxQea2ecELP)~`n(#b)K1ZoMp0{`g7LYdROu&L78pY zv^+qYr9co{9)r!j^;brMVxeyUB9K#CLeZ1ERf+x(szM*vpsUYu+AW~=aC^hsY z!MZdhVh={&SAYxNKCO?HING@1dXrszXxMrK6>~^qyXfW}ND)G z;3yT^4GfgG<}GvPU__^|yEexBP~)fw1`H5WBX%w-PYILvCIy1Sy!Ui#e0KF+aeC=w`u;xpscq>f^;_srA#RIXNe(EpbeRkd7NWQMqtPJ#6 zlwxeuTFYiVZ$l|ApJ&9w;a=LecuNPh4aF%+T?C;unIGL!dlC@r)+*V)@VeNIhe#pVULkw zgxOI(aZ2cxh>%zZ280x<=Cqt>w1cSQ5x@@Y`<71?&XQZ@Qg@;HXCxtLs7c$%U)cwC zUWi};tFmiMK;{4z`TSsSv?zl3i7+Ele+ zcok;cZ-Q01O>)@cUfje%ar0I4@kh-q!H^L~1+Ts? zAU8jEv5T$&yGqSo^O_q~r~X>(p@oGpo`}k)9dB{p&_8kT3mq@_{ouASVQ9{1%+0+? z#sTOX#?!t-@jDC{+`5A>uTC;O=Bjw#vJDgN3uM z=l@)f-LaXFueHY@;3be#Q9ive>2SsjWT_s^%jY7E<2IV6QKG8!SejY z2Zo1|Q-7R9ywy81z|I1TJEu#E+;2Wy3R?nF({fvbO-s$LaP2um&)RBxFF#+pYN+^y zw>LluRr~jb62e~F=mf{ni5AJP3{q=X+gtHm`M)F!(y8*F5tNFVM7amhI|fDaUjlJT zt@7mq1TjlMIfy>9-4^R?5hr$jU5ZND{*@L;4|1f2i|<#7kn4B9 z4Z7jhvqlDxh03=Xx|FsfTxC$SmRxK5{<-_IufN{1IDjo5-^b5fypCy<5{t}=Iq#IA z%|>RwOK+Ny47AlMPce98z;p%f*>i0w|BVl}LCGEJ4N2s1G=y1ecS=5PhGdS&f77bno{FPC%p) zVM~e;I@mkrh&Hb5foE2+?fTUIOM7N$;WpyFOzs|14kVm(+niRIK7gJ9I){#wh}~aY z4gak2sLi-sT0|OocCr7h;M|*K?Pin~*Z%LKnYMk_gnDY1W_eH2<9P118_Fjw3mqHW za^0G@X2$hSBp*uWqKnq@WvVw8D_=uALRLl(Ol}jfSJ)HG+@Qvrq4;wafE1fA7&Bxa zn8`rH74B&SfT=4fua%XpT9lwW$bu<&{L9UsLVUT*v+15^ak3!^(pl>;ULJ7DmMRIY z`^vU_e!e&Zb_vBl2cuw%2FHiwC+H-#5Ij6bb=5iCizEByJLD4C`M+WYqDSG33>{lP z#SMScZ=29qjCQb`O%-bvvjT0q58l+Bmy{hXs@+IjeelEm(EHoWE=pRA=zja$R))h| zp0{w%o;NKINg&!HQ}S&FUS!BR1%|88$q1dT?}vU8)0WaGdHq?QF3?M}+7MT%-@P>v z4Zd_!Qr=GDULUGD*lt*{)vKLx99gmZN9XJtV@*U3c! z9t-aMJyK?!!CZ&E6@v=IG2&WNx(9Wet3qVMQI(ak(2Pxu6`LR;@sJdOF{^b*{Oe3S|mR z?a9z;xRbHCY>vqcqlnk}Hbj&icYeUAA-~SM?ZoVmAW6-(FiDar5y0g`KXT?#F?+~- z7>8|9QF^-Q0kpAH2e>x9r|V5a9m9vO!|Wm+;|R`905u6mqaVTfXx8mTBr@XcM?1WO zoa`6+!U0PY;b^xvMbemJMnm5iF(W@BR}F`OJmR0^**i6}SCVhf>|onNpLtg}Jg+6A ziHIl4;o?KB;&co%Fy;U{fWP)(6&9v|Zn5hl-r+*$7i6T$fEBlKIuNxBmkz5g_(~|K zXBw&z8ie~V^lNM^3W8E0^v3Z@RO3G$Qx4x>sn8zji0vwmtxt)peEaHT3AU+r3)GfJ z)M$Pje+(mk1*BW6MB%CCQde2R`*gbByrKXZ$;ZI&beww69}tlTg&}`>?#)@uoc*lU z<$ngvm@^8AoXUu_BwDm+4o9PrS^F!kCV3&ELuaQ#d_||U*sodeHi0C+T6hYm9HdA< zuGv*>tVp~biSif!Lt!j;XU*A+UC$esvucOk|IQ{uqhaR22c1p#h0*gK1;;B{E>a)F z!sj~tRa2VtdN{VYA@kN*fV5!ql@mNvFl5FHKg&3k7ZmTDl{}bBR8GS=+#h$uFJLcw zl9jwu*vGu{z*9m`V)Wq8fb6Z1K-G7O={tYFpbRV6l!qcKgoD!6Q^`_4+PPb4#t%Uf zktCbkQqqRwQ8C_8S5~!%G9>D$c%cbQIkK-kE$gAY-3u>{0>@JyIrwJT#MCFWR}b?7 z*Vo*E<_kAFa9qe?(0YuZR~HShW@5++x-5=%{^mLo-ECqm5-{VHAAO+a$H&%KO+;)whiOWNrJ;mr2eXiND#yW za_{$XuCMI+6so`q28BWEH1`9JkwBhPiN~OF7$uO85=mb;MtQ|CfAr6Jbg00NTN|&! z;5KyF6|WM}@VC8%breA9p`5DYKU*d0%tyU{5XLTI&t(5GJXRrNmMxepqOB6q?zS|L z!OR$3t;lfXIhe!wyopxW_3!Co?%9CAKU((ki2wqZH?_5nX>o;Up zPPF&_dV%iX)5-vC>Uc&w4_QD;TZ^|~kp*aqCZ6%1*iMTcWOCvMNs9WK^637ZZIjev z1sXM+Q2(JU;GPtb1>G6^KLA(j#5>ve7XPJ9`=?^=Z{5;hjRy%#`yxkzry6vi*ne*e z{p)|9iHZG^1r8`FF7HdWvH$De{QJ*^g2At%hIx5;zu8W5ZTzbG>~AJf>9){@;lJf8 zdf6`cpHzka{FJsY$_&mwg`*nE_3OBzsF}bS`yHj%mnZ%3>vqAr>nxR(n18>V|NO_m zr62!uqLx69eDu4_E06MZ3@qGU$!jTT`n&5-M=KNlEu#KQfK{=s0sM1FkYVQDaP(v1Fza&Kj$xhT)<{d zU>df>8v+TTKZ>>g&)sJM z?mksW71EJjz$O_`l_>SZP%#6TMk)ptPTIok7j-tWd`7rTg4}`d$QNNy`v3oN5)Q^= z(f12aAOu-@@yl3+FEsm|yO5(AnbR~?rgbU*4n=l(64=hP`SQRVU-j7cl`lFum+mROhXA+pO4a4PsmjhSR<6x;d8`-%VI1bQW$#gax`8Zy z-`ZtvHOYGrF4|hxie!D@o3P!($owJZxx4J`lTQnd`?m*Vi~(aZ1Lo&I{j`l8Dv$Y{ zG{?VL_uDJpcB;$D$_U4MOSXC{Kr`~I5&*z{do{##3EEEGglMO3Q472?XmIH!`{Lv* z>Eb*MXdNcCcdbSb!22S37x*hp;(tg_T5+J@e!e!k6_xTgmENBRlR*?CfGu|DO@n++ z+v4M%7d@CD%VsOE^(~w{8FZKx@`2Cdtr_PI;G4e1@#W=;pS4{vY`+8EIfY*POQx!80Gg?TN7hwM?32P=>ybb=wF^L~fAl`6 zXjHIEYek81E8Gqj`45HW6bW8-F|thiDS3=ojbpu0%lWSF2Z_Lz7^s*QTz#L)1CV1uPQu|Iyqrt^^5XvW zZDxZ8rzI0oNn5)Fyc}EmG9sv7YX^{t`+QDqk|IF89~ctZHwGw9GNu8Gk0&>WayZ)B9WrT{X@bhcwa;xF@S8fVD^$R3u99b4Xe9|j1G zHkh=B?00z96a6R9`F}xnNgFbS#5GqN5NqkwOi^WKlMQ8Te|f#MUX251mZ(QUSgqsm8CIgZ&w z0F0CfO!@0K&l3G3?_Xo*Ge^}PHJfNBTOGZe< zSvl~`08$A4jhWB!gmi*R2dm$i6;rutMyRRyBu!K-U*BGAaZ4Gp;34TB!hPem$0|%^ z8VY0y4y8R`O!wPPmT?MjBgUVue^Pc#QT^=iuqdvkf-&uM@Sj+s|30s_7Yqsc6*Tgu zFzb$GdVdlV9yd8a^1lLz(cf{mUcDR=y|iOD{1g-OLuarEEAb3af2Qj4TYi;yRq%s@ zA-mWWHWMWljG_!GGG0J+Fm)hZpkKJ-F|`CQ^VuFh&}49K_77eYaWu@j|gdHFz=sXHWoYVgNH1)$3f==~M~z8E1I zIdm!{!-=5m51uDicpUk_iE*)2ydx2DZW>=;Gu8GEx53v;xYDYQvh;iAl`2Vkw$>}_2{L*jW10U#5@ZVh zV?BG`dM~pX-`E7;rIQyRlVr}X(SG5S2}a`YLh+6Idxyc0cjmtv-B+)-4-dH)N2h^Z zhoKr2Qy>6#4P5kZFT}F}4;^k1*VQAtfOl;#*n*B5f%4V&uiR5H_o?H2*4PwqO)3B` z{i!^bAghP$m-jll$(z=!j{#RDkJ6{Keg^#4?1}0aLAQo@aJr;f@ALU2!zRxU>!}7} z@>O&Wg-fg)0r`e(X6EMc=lilb;B|CovJbXXNoC7^U{)_GmhWnQ)rt?P95^K}F*>2Q zIe64ndmp}bvLS+`;b1#yUt0g~h_&z#9CT=|chfrZLh^Z1gjA5J5HZ$E8|~owZA_UF z!4`1tz?&k>%|(NHC(|Y#hGA}S;?9c{0b4D004abiQq>+7r50E@s0gpoJ^36wp;`5L7g;1ByCBFS+B=)7Kqwj@)` zus^eE1so_o?Em)s=D62_o{vwSQrf8%PLZ(EVIQChaa^8%xLvMODb0`#Ek;ELOqA#{ z0|1io+juFPL(vaA!COF6oTI$;rt$Z~Q&gc_j%@+dkzD$yIGFNAw;*q#iIGv z@`29neU3Y}nd*2ewMNDcbj937aR77IZteQ~UjroDo#15uCUFc_r$@vX#^40>$F^2V zFQe-73&>j&|ME5OGo^v>$v+TETP0(VE2+>s`0X~oH?W#_=0~r!p08%`0mFhT)Rxv< zY+|_>eeqX(Tc5r6758J+5~}=WW&Z*yBwQLL^FLkyJ9GZ0hTcp2yRUtd;J<#h zNDdy!K@}2@Ll0wW>2xJrB&Jv^`Nj`juEawio1GwW2F2qCO}qBnE0n;Z=(05NTG?X5 zSaIhJ2VsUVs&JfFDH+&$8i4c5#Qz%I38J9yzl4!y;Qv&9IFAfDNG|NG%u$0z)zo~e zuSps|W7;u+uC4wNivm4{9C3WoBUq1U(3#)xZ+j(hx3fGAOWn%l=*5X>JKr!t-H+Rs zi-DS|whC1M9p2rfg*{_Rv&AsWl|Qm0_X;@^YnP#s!TcpqxE27U7GThlz1BS=g8o&Z zJ8Ep~GY%1dwkrSpoj{8jbDl|SgDe_MjO_k%g13~)!M}k>$s(1T-(%I<;%xo}FyTlR zLlL$U$ZCJBTkAZnc@KR(#QWmTT4i*xmjRu0aL&w`n<<8&cK{E!F!pk1(?}RD=M?nR zOnqDm-UY>TXs-aZ!$VN$mXMRm9h3}oLqqM&T4_9P&U)u%yI(Hh;=W^D#7$}G(BNA1 z1t3sMfgqb1{4bAFqq!P;yS}fG7P4x-=TNx04eTSoY{_fD)(Clb=!Ot)<^ zBhsFddKVc1%OTigIB%J(gWbgn@7)@$N<~CtY!SKdlT~lncEsEb$m6s-qvgd_eHcn4 zp&~`o?vdx7YpXJxfpsYpGa|9+^_DiULVO$NgO`2=R-8HQi~8p|?R$MZxg13=z5)!BmUtQ@=U<{eE_={`gS`K%?i3PR6E89#9nZPG zXw7GAKJj89^|#;1^Ery^Jn?s@1JBgS?+tU=(5~vdQy=C1|6-zNSH9^I@2DLPKU+)4n|kX z_{Xd`t%lSt-0_|2X(s8wGWTe~GY;arViELAW?ZcATm>{k+h<-kTo#$Up{bk#tm|0# zwa$LLug8(iFbNmBeA;8cF6J&UHe$LW+*y#9xNha#Djr3&TK^$f$7@Q?*N>?=nm?|3 zLvTcBi3*kGFk9c=6T>%vb%;#&pec%m?+;I{&#HwB1iLreTCO+C%~Mp(h>Z>}h=vnQ zNsCu>i$wSzMTPB~_|D(>f0H(rj;RT8DP*Vu*b?j8!0zZ5@y?8|#j`ouYA`NGNw;$e z&D$E=e57)Q@LfCnfI)u7+EV&Wo)I0OyU4IZ%t`#}VE-JlX;X>%>{*J5I}@7#fgB@r zapZCNq=$D~o^^SV8au-(`aEB?Fl==d337*>z;sNrOadzIcGJL|X0yCqHqBMOHwc<< zr%6ow0CbJpdl83I8ieLJ4BjCAz=8lrCN3?KWGc}c7~ z!ctfKiS%D6?W8`^eLi7*JzcZa`%~N4-mYZ=dE4Z+V*_J&E`EJva-3hr3e2h>mW%{>g&a2^UagO{3$v5XG-e2o_ z=7!Cg{8#$czF&i2U<$s`90It+%~=5(MFl$fMsU&gE-}7AzotV~hpzQMCZ7L6jU}}roNm-MguCZF%2pcvB zZ7K<~Tv2^3OM8Q)WEgTE0%RKiOvNA@O+KlEkoaz_c=Imc`tnO!?en?7TXEfw`PB8b z4!`BTy&7a9px{t&+6A}%QL8q64?z*@$5#hF1^j(Rgoo0__2DWfm|2r+5R3y z$=t?s4m_}{5t##>wV{_~1|s@2A5c#h7et#&91Qg{z@tWE$DzVwy6#H9zO5z1H3}XS zBOix7cM2-H0@@N*2*?Vcl@u@~=4c%iUP@w9ov8V#?{nn!a??mldsE2DMEW4;=DKDl z;8#h9{T$5uqivmo%e3|9H;#I3Ttl2ZZRe4q{i)nZxKJM*u7+h&GUE9W9pplaYWLC3 zOs%3P(asBlc*sOoxlhZ<&S7#3tf8WkTcbW9JEPd1!&akrXQsS7yGj-65+`wl?j$WR zLMc*kCjz>b_1SOJjZKT;x8Ie8=IxZS{a2~PA#cA=aO!g|cL5fJg@CTl#pwMbE#k!^ z;K5G$<8644oTJDax8qR8?l?~-`#qCv^hTvF6P=j*JDZ0E|ntg?jmJn2v-P0pBk zPh3|y#sFaw*@5rlAF@6Mm2<6EO9bL4JNDvcrF2Sp?$l&SbJ&ivF&Q`KZaYnp99oPG z=R0**rCz~0o#gG*>}k#7q=8(5WLdPS?< zrFX=1)825pS&q9{{YTg*U~x%T__>&fyS%j*kUXP_9isNL*4_4ewTX(gx1NppA|m&w z9}c+% za^?V4xIaEY+4Z1|v_M?)5{AqWYrs5?Kd-9np438&OXM5yl_+f5DEoy9#6az5^H;+= zGE_a*Cr8>W@%=WFPhNaALR@&z(tD!=&bOn>KR%5jU9F6A#|-{8%eAkcigO{07X(Qr zfJKQFr$q}SP8n3>XO9S+T<*E$&BJ(~zIH9gv&_H%(Wo&Aor=!9 zRF$}XWlF(NHZe+b?<_10cTc~B3NJ+GhpUEPcm=-HDew@DXD|%+0&ZpY1GYa=eyu(` z7u4|v5%zjD-`pcn*L`959)8A@{5@UXG43U0H77oyn1l%<&>kM`yHZ{cwMX2;U<2h^ zJJS;mzvs8??26)f=RW#tl<163xJ;HAJ_*=Q_32!GZEK0tkQJShEU}ucma@W!eY~Tp zpKShn_$(kiCcrc%%Mzgd-vKeaPYv-U?ELrGGOM@s6}A}L;?9ix8!Io~0?rAKYFEFc ziOz;M7l0pPEe$D9;Tdza37z%W;&e$V!^%XN#2(+vy9UhKNRF<7nOD8~j;&;7g|=pS zb6wPecJ+vQO76g}Sn`UEv4*5(*djRsLtSgKeQ&H*nZ{dL)~$rmNh$=~?6IR~Jy9Js zWEu9Rv%S*C`^wAvAPOnqSU*>^`RLSU9PZVn*3J2-zd;!v z`8*jnN{L}(_^KhQ2)|lZY&aTIw5OwM%s!d+)--TTG1*zL7zArMItCPLsFMgCJ&{t| zCO*d9TLw7rgKWO^v!NM5qY{~tJ-Z7gO9SKdS-*l9zuj{$*G{5)JTkqMkti=yx670G z>1LlT_pe4-dIu+k-(Lb=fKA!3JP!C7npy01G{p9LAZl_i4{3Ffe7fEELD87fzqjUm z$>yb2JV9Aq;@Zu?+s(=3-$MVHcL6zAf*q!tt%9Ja;2+(5@HpcgUYt3kW9#)Nzl-mm|CG7-uLgzY zixMtlq7=Zk4EF>8Fhc2iU54znxu#PMvI(m*@0#ai zs2`>2TExtDL37$YX)B?CS)Gk(M27c=?u$ohI%`-iUC%_>Z>&{& z0%r=NV%|sj9qK>D0~s%Jxv-Zfjr?V&i$6bxk&ezcP^(_PAg5>i#PIQl{1$JI+P$d6 zg(dm`u+ip3sW~R3>k%yEw#>)6lNjd0h?gRA?RF02%1Y}89wt#Yj8`2pkgGP5+Ux!6 zdKG0dxhB%h4PuZ%WCXYmyoq5hM-xMakNQ#&!qla-=B(Ousazs=?)ylED8M7_I7(#c zEM_!qipwp+Zo8^>>sGfs8?o2d@F+igEq`t)(N&735Mfh}@EJ~h>=|DAzVH2G#qN7+ z4|5t>UoWmo9nR?M;St5~yXNpYa?pnzOf)WQMH1OP)pJEN?-Y8U{bg5= zccsrn*~@m&q13}LrPW2cdwUqZ5hXHN{MhP|C+jFoasv_d3EML z34xpff`z0>0pO9A9Kv1g9$9mDu1H^wO3KS9-;5($I>>StaGsRG%qo+$`ovYpq%<`A zs2=s{9`-cm-Fws2KJv24k)L`aBBQ?zkN4BtqC9~<^0}t=Of3CWdn_@`xkBI3=%JT+ zj)*G-YQ5Dd4h3t|3rFtDiL06(*3GY`p9L7bKUDVWZVUsua%W>c>iGEC{nN3$!P*?z z_uJG-!3K#V5<^vv@0ClZ-H#~gDn36@!`a&dz%Z+8vl2khg{!JJUaCLukQ~f^0NBoa zb-#TAa>`Ux5Z1nKu8C>mp2Bo3`CaLQwKV6k(=o}~)dA(-6(Cb_R+`hq5U*^2@`&cuBG{sla@QI(mT+0bIrp8|a_~z{w1I0>!DS&hL`-lPi z(VXb*kN#9oUJ*_kd#`AQun_}5zqt@EwSn{dQko;}2A2m2itsYFbr4eU%f+vw>6k6h z*!jiNu6EnQ=8+oRNm4u6Cczx%9$nUK)LB5$+zGm4=&Q77{doDjb;=S+6j7aLd)f2G& zpn#i4TxrZW3mD=JbXi8KU7ox#id-{O6D7Z2L8rv(RU~}x#r?%c3%o>?knFs&Amm;O75|&11s`!gGY;_DLbv#H1ZjEWl1syFd&KhB;<9fE1nrd_Tu-HPqW4G6 zccw7*th!W<9%&o7f2@=dyE17(2OOh9j)PH{sw&BB0uY+wO_fVctEcmDdfGjgm7yo5 zWAV_ir#v!LUGT5~ykSFGk%v3NT;LEID?9>Yv0fRPLOb0mDv-o$lb9M5ehAw;D5}>z z(r@Zb8_*qPJq#E=+xV;nJx7CaC9ZPI94E&Q?=gz+zI2>54$OLxYMmAfFk@DBOIdlf zefMU;&kO3py}xHYuG2tNd>w?)4+^sSC(@DHEln{H;&cRzm+Q+<&$*UAu^t<@TY#Nu zbiQpPqva;)5-xM_iambg)n=LFALrcTC1W>MtWX@{3MA#c!XB9@u0k_Tjx-@{@gC$l zQ7B>pioN#rkxmHv#DfVMI~48=nycpohn$CT1SK2_CA~oM$}8Z7B?8jTMCwnb@xQub zBY^_1z6gMy7d4T%3a{DCgd475Fw$T?B%Q$Dyzu!p(8gWeer$IcxARW^&8rgg82s~! zs4YyhaTIk3je(bF$K`Z^c~9cV>gtF15h{pgQ?G*$BOJCVt5^|hPKW_ui9yiiAdd{e zYg?mb%DU4Cb3=tr22%%<1d&}F%Ce-5<5g_Z)!jqchYx0Br0NNZ%a`C6%GE6?D15we zV52^0u0bm?Ys)`Duo}*$a&KK2E!3H_+m?2f9_b2Rl z-VOSzoT4xp5XU5wzViLk`B!*=8CjE|*{LZh9Ml$^RuQJF&!dR!z$f-rEqdm0{{9=1OR{4In>27fCKGmTws=l5`<}mvQD>2at~oyH z$GdxAa8rocQ-x&Vhe{^U4mp)$m#09%S^!W2P=vY;82kjNHPNR}$c?Rwp)Lpwrvrd-1HS;8ZXBCA!u)+ z*o?aLfmhDHiDp&$4wV9d@jlDOUxflHZg>N$+xOc9mqZIB2JT*hb?WSXo2|aUt>uka z5FyT^z~8Z%C@Xf3@Xb)BWu9ttmKF%PAh>Ox!7X+&p9* zAO&rAro)9-*Fh%$%x-1I=is$G;Ve@v54X!V_Ocy5+Z7|Tp3j1HhrKc&AbH!pwwu!) z(2ij+X`Q2gd^sJnp9_pWaP6Dl{1|_{EOhL&jed1!;*NCVeNMe6&9DCueoZ%wErMxn zI78$)Ny?Fbb^c|b!X^$VR+KXr{4aHkf;i?`K4?#t#c#j-BhxBkGd5hO0epwSVDXKg zkd@ynSRXM+Fp>vs$Pm}2PR;!(B$CMVA>U%R`)QFpE4I*-OmC@C0B z`Ao401ZZtGm&Idomd(TSwFmIa)59YNUTa8)1(DmtfMi3{>#R(}=?S?4dz-|Fld;O5 zfpnWG8`^?jY%*kZ`U1|}8K(jpBCLyFiz9jyLLd%2GX3whjVy4C&yE4pi0|e{)cmz1 z@$FP7LJJJmxplv^osE-TCLE8&Wt zU3_y|tAb*di&D=g(RcZM-yVWiBKFX^CioPv<`C2!gU*6_?k>nKelnuCuO)YA>;bLY zg47~<6*rxY({1U^U?OMlop9x0dA;4hc(hV_*C?HLeO$a7{Q~12Bxzvpvxjr%u~6C~ z=~S`+rH;ltN6k726b8FeY6IS649>NR9_sX6nv2OXx8V1R8+Pi;zuQid# z@_~BKhN6C}SD!=7K&d!ga+`K4(dig%AreP|?c0q1(ln?yd zxfJav_Irtug=mtIVlEn; zLOcB_kuB$6ZBn_!3+lA2Uj{R1qcN(P$Gje<&|?Y5f?8rI&%eAUO8YrF=%u5M>t$Si zJ@4MZDLN5p>D3`GVC;P?P^=y|v1nkI`YW7>Mz87VL?YuWi~wY{=-@`WaKhgXH8NtB z;k9(9#~+nx6@VixidM(KXgHdqF_KE2hr%fUO{NMXIn&Y9)%`$KdKN@(>1B4*R`KSP zgT4+hf2-PAq;%mGHkEWPz&NGk<*5+=#EkE=IlFQJSeQqO%4O%Xg#%*&B5oi?l<9On z3R4Dh{D27qvU?UD62VE|=D>wP4}JDZ(U+FzMp8Y8f0z)G85kh^Vy*VTlryG2Yx(^9 zC;`gCOKiW3Y}<+$2G_3@)w5I+;tOSvYtvlLBJu;Z@$ao3K#K2i%epx~GS}lk%229ACb> z(f;Gb+TzLHym5HFphq}2{kzZZn|AWpUOjeVrURhq9?vx zFCrpTxYE+McYjQ9N+*_0JtS6s@GS@;`o(ecxAkfft{2_p;Fu`s-TLvFAgNR(O^+cv zIo8^7k6!$YgyJU3A_5!h?LxcX6*hLPCu_qisQ)kYbJFq<{> zMg{~oAt2cqH|pK;3z7&3j2(J(vxtP27%dv7mKkzz((h1)=0yt%@Af?tdUT80g#8EIW$a(9m5J?r`<5?L zWNX!ldhZ%Va9niIt`1_$^82>GJ!L)j)j}Np{8icWT69EOS9q(D%V}JNWJX5UHi@Pz3;Vdo|(7HO~Jf{eC+_x>i=BM?X zt;~yynXKNxfDnBvu;b}-aX3!MtGmB!eN;4BJJKmVninB3DUSmJZLM>l0V{`%?Q?Si zg1eanbcY?z%mssQTq7xbtk!I;kl(wa$grz2no*O4@e-Hc;NV{p>b1mgzLhe?d-loY zmW+$fEzl=`&PcuwHErG`*@&ZLRANdk=d#wE0EU+P1n-mlOe7fsDrga4k{g zTqg&WKhPEgw_@cMO>e&IV-d8PsY7T>oCh-<$2h!5HyS$h&nKus&L_iR{r&%m}97o5PI&`j1EU%UQ;1a{~`}_Jj#P(XqF05Z{q}!H1PDW_ZL_~Nk zqLiZ(DY$RRwTdjx+Xg|iBa%GX#q5c{GGz#W+(Y6($JtJQhia8LoOagRi~R z2J6CLo&A1hz>lf|VJ>9h3dNX|wB-hy26;N`EuEQGpzA5aJD2nbvytX@4D__TS7&oS z4u*(5(xku2lUv=P-^k=5y_0k5@bInk`wrB3J@s6q#EsH9ubml(u0w;xGb*Ei^Occ{ zb*;rpwrsvoQ8)0cQ?F|be@k811s0;2TZ=*!rOi#VQB@%xYs@b3Bnf#g(~=f`Hg~um z2V3rb*h_BCiVg?e^4Qfc%GFxX$3KfvX=W1-2IexWr}Q}?tA!0rkWN+SS+CdKMOYmL zvszu#qvH4IpxV;3s-oFh#IFbp-oFuU{fwf+@VW}Zg`#|1(qSNNU#O70H~3Jo`F_O~KkRwe=jcGBO;u**W!g=;rRt$ojNa z&G)60+4X+E&bIlhyEnY!wggq6^GR{wHTUVn@-vyL!b3i+49NzA*IAB*&lsH<{`WB1 zU6SO34;vnfd`@PSSjto{Qg&k{W&w_YZrX=}qsRm>O@Nn2C|1b=+%}UP2l-12xMAJd zZ+K&X+eP8K=B#2&$Q{?&E5(rYd8L7JV7tj|7#)EUk&C0H@>x#{%krH2)y(AGvO1l& z+8xO_;oR-kjb8FyXT0B^6#wCZ+Zy$aJanz$`A=&Axjyx4X6Baj7<#ocS86-uvt>U} zbpV)85rQPHD*P3O`)N9hp6M?6@%}%u-ZCo6FAVplK`9lb8B`QhIwXe@0hJV#?hugf z0frJOiJ?2CrMrgi9=dagp=apkJpcDy=bUxUS$vrftOaYH{p@}3>%Q*aWz(`nn^*8} zuk*gRvN7`eukj}xWkk2Z%dridaZ`rfr@Px=88ZW_20>R3$4z{b%jbJKM=(3P?7eppymol%z(4lLIR=BxHu}apO@mjv&&hg9(*(L{dLnCayjkCBbAvIB7a;oC zEu+JqD!J64jkQF_j0bmC#?y5{X_R} zvvqB7{8eSNkMUc<4}r#9f?}pNvGZ;Xe^poi&p&!6{a;n*9eH`owPONJ3uG04CTef+ z!{Iqi`mvtrd!b{uA5%SWEIKKMv@EOCo{*=U-SvxpBmDz4ZZu18Ia^H1QYv#&naCqn ztAe=9rj7rK{jW9k-|8}OS^sZcg;(>OkH>^BCWP!#BZ*~#RDi5CzuzhtM{Y}%(f`h@ z%@1T5<1-(ICr^{~x7ydVBDs`ResJdLZ%rKy6K@=4aj57H6IZA9C;VSUDX`a^I|Bdf z)|zm)$Dc=ZMr&)i!PbLePU*leatYXBHSu$9*SHnK9sNSpz6ZE{_9|SH{-gB&6|n!E zg8%y`;aDi5R&n@pBO&XHk1S71f4le~rP%WNF&p&MA+M9x2HO8w z+*w`Gka7~YFpnU3Do@p%QTD=hcXVwS^?>W;zr{RBoBo0qVp$MzCc~i;cwT7bUxkr( z;7Zo?LaFJZ{J%aZM6L26F*Mj z$x@nqhvZSYa6`9s*IG{;GI$Or``2=*Y@LrqNM~6uXARrx4OhjxG9%4^7!Wp4;?h(C zE{f}-zVnIPj4Z+BCtZ5Vu|UFLmc>D$@N{ze;eocxGQ-jtDYU? zsq<$eQ8bLT(zBh#+Ll#Bo z=RVLwlro^5myZ0pDS0!Z+j6&ma!UI|<}jgS#k?N$-=iIdLaQbtH)wpRgfbO>5H4~v z_4D!?e0v|5L?cKs*y-yXjoWtt4ylK|ymMHnvl|xj>;O`AtY?}iWU(I~H0+kx^`yG` z138z~AKyN8wPek_I0wi)!C?M)0ZDP6l<&y4$wXS$B^T!V4%2?zy|rz0(Qd=tIq^fycn zn8tqxksj%0vD8Vn*LRJr3?)YyXb!4%zRfI8IOWz1DDlrk} z6Nf$qXnf!60B>rC$lPK@>kaW!Cl>cRTz0{5kf?irLc5Vl+sH>F035Um1P>J=Y&*9% z&pftpp?5%gYY*x3J$CjuRQ3M8o6h!IEHr72p=Uu&yj*b|ba@Z>Fn+Rm^GY!ajr4>w z&@DlahYFlB)L&g)WUVp=(AmPdp@21(H^)=BL}>e=zSpG2`2c6nGl;Ax#;=z8x*33q zqXC!T)~Qa{fqhcQ&grH#KG=I_?}qc6z$TH36gURic-TxVeuMVwd)>{zDXS3dH23qb z{?9*I4cn=4i3PR)$0uX1A;>g$?rN0FZ+*Y zAm5gwB)lGUVy81Ah1NXFd&U3kTChvK_J*=uo-bd*n64e2&5Q7gs)f2=Rc&p*ml)Zz z|7N<8pqBcTX3&cMw6Ct5M{{^HG0qIFOjYT3kU)85_5)g23la4;U0QgueMkg}BBTt%_ z>hg2OyT!8|cz_hliYe4djP7>6Hi5{?**^Pkg>h3gsdp-Tf;KH`aW+~=dKc5_euHRR zEo5Oo)p(4;0PpD)u(<^S9Nyo6k7@=o>;dqe07}K;54@}c@Gug&MXhd%S;s(ie6P>6 zZT&@TS{9kJK=J8 zK3imYz_i0EpyriVTzSAk25379GhkYqr=u|#05o*^K7iZVimM@C{bU`Oea-#y!D|Pv zqxS_N!y^DO$YNQWR`%{9n`x*jKm~p4`E~}R|Iqe3Cg-T@ut{+#N^E zmmkla0ocL;BR|_9XOe|VOxwU$%_S>(=-V9qwJNXloUUbcAmWix+)f0fX3sbZk`_2hD8!dJFOut*xS+}_Hy?;O9{pD$DvCEXQkKbTHmPzLC?s&b(7E%zr<$u3 zf1ToR)JKrKNHjQor*!Dq{QZxNIW6xGC&9Csn#|j`EP=zRB6MlvilXoNMD`G9!0|{! zdLKl|>By}y>zWoY4DpGptni(Tv_rHiH?b@>W zgT_Dxmzg#&6(eNj4w2E8y9zKhNNt-gWdzp|KQe)!M||9aA%VrG08AxK*|JN^@Grqj zvovQH4Ip1A?5s}8H{auXcwq^g2k3%RPUWl0RyF#UaGAy zBmDKON6F1m%6f-etch_% zkIT$fz|Wuv$>)r|=ft}+LBKVj{~&~+_Q{t2F+_-4Z%eeU!qjo;D%MG_Ww^r#TxxNZ zz;UF)Y>P`4vPB&~zGs@Z=mtK;ZuyLSF(B)Gcu5tt0E7{KiR&2`wiPAiSr;^-P4zmm zKXi!flDrkv=iuZh?a^CiB!5K`ep{2$Y+#R-J1KLb87C=#lW5_7cJYpm&byiRS~k&Tc?qEtF(l65E{8r1u*&&n{J`{ zXYm^@Rg)J1eUMViS`hzPGT6<*kbBtt8%>4tis{-z((+J29VH5J$HOW|a@}ku@0+E8 z*e*HRF%eE(4sfY{A7jUc7}?$4b}&-+Mt+vN#;Rua$0`7Bt$^&@P}2CRYgyzVJ{o^S z=}BzwOzID`ii|XY!&$mX$!w+IoUw6ERk5b=x>Kl((#GQhk3nufaO-nY!8e?634Vyn zT|~IgXwl?XS{`s-`tuxZ=LvM*0r*Vaj!J93fIGl&_}9%fV`9PuI4MIa${QE?EjVSzmMVI?;rdpAhDwFEI5`q)=G*r9zbK zzFBc-5CsC@f*f!3D4G7{k|? zwpZlZWf{YWU}6v@^Vy2;FNCV}T()zfFy0?pyl$A5dg6RJu9mZfyGpcwTk zR(|2^TXF=JT7aQ&FwjnVx$sJd%)K;#<(WTdQ-q|ZsMrB{STy0i7v_d3wO zEne?ODoubjuz7pjJSYsA!Ihmf_IpTx7fA0AR3qUenedy|H>YPJ zhqJGq;9j;VoDs`d!%hA`{E8=!W4H?ggR^d2*?t!M&bsY!OV z0S+}y%GWDkmg_res@k&dE`TmHm+qs8Y2Y-}YV=YY+uR*!5BbweP(3kMEi7&LqVW~C z>L6*u)cY=Mj{3E1|g259i)+&9?dIy-01r*`&_{S-yB%<$Kms;JXij>y{O_#tDq2S>90F<>`R5~y-ai9_m~-)zdOnh59lR?n zGCFBjXGCzo(J!?~F4TImZ%jAv2*iJl6D)>sHrGuO+oQ3>vWPY1{TN$MpmCbs5Et6~ zJbmXXEFNq&Cy|zAuVe!X3UQZK!a6csFU&EPLX2q&B`H_c#1o|=8)@-27OcG_UzxQ` z>^gMFKH3S4#sNLa;O#c#9Jqf(sAzt>Q^;8i%4hmeP~jWDQt?Un>bVIWlK{4t@*zSJ zOG#l&iqrHjh}+x&pK>FQ<0epmif0gKxBpKd<=Pt&3k%22=~DG&5}qF#RHE5_xkZDt z<)e(D-s0FTTlS)xN&?vnR#U81M6pFwK`YJybS^N-S#HUYT-CSr+xkTmqD6 z)uGg{oCyEGiD}J9Wv}S{%kz%SR?tYej*ybi4xjwA7RdO}1g&8C9Z3*lFJ+Qv5GGxI zJ!Ip^N~Z^HFr($&>TvwrUyHkA&+JXC$%?9qqw(i-8L`uOqA96Mu0Kh+o7cL$(ZwgR zgSa1z8ZLjPiiw?M@7ypua`VIrYwfl~d&GMCk@A;0+`LYyl3uIWr@z3vKpyo&@RL3> z5-K4N-@@V}E6`~!3fHa-!y;=s;l6Toj$(iwTV@&N6%5%S)#@eI?@gbKTn7Y|?h3r2 zyYQQ|VN)zk0xD;$lCN1}??peSYNx*OZq^~j>-KE9iz+2IxGjb`^4=X|k(lGV6g7S# z4z=p-%jotvitIjR+Ky0I53b-6)7OLhOtrjnMAclH2E7u6;}YC*`I_zA02NrJ{pI1B zciJ7k+)=ngyGLpKFR#b?A^3J^*4)xoX-`2;us9eSHt-Ddy_)WX2)jwzN9KfaBTGS$ zZOupe)@>OcdLmY#Xs7q&9@y8DUW~o$zZYaj^p*=Fg4-T~?sJ&>a(_y_W2{5^q%g^@ z_`oK@rWudqmqQMG1n_o5mIGQU?eT7(f}J&e2sS^r+#FSo5*NYY8BBR`(idc2@uqgl zHakR`KNh4!UM*Spr1z?qmrDZYjns0%LmeFB9DhokH{k0%Uc+7Mng^D})p2cCx^-uB z9*1SC0dxV1sfv|HkmP}_qKo*tW$$!qe%m@}!PU;_c8fd?6>|ziE4QQ)7z3%3lKsF@ zdBT%vkL=ELP3LU~%*9kY)1{1Lq9--^ z{;?F;*PaxrrKb2{p!YM8MrRi~pK*tvL*$A=HfYX4>jUVHBM_Huy&OPWrwlwim0}HR9)(-@zg3@E-#lmB7#PmXC>E}e*IVhJyNLR* z*1Fg4`$zO#K4a`@0P`6&w{pJIQVB`O+o?o}b}PasuP*~*5H&}0`*!`G=K`Fp@|(J8 zSH0Xohb){Am>tAFaYu&xyj+zH^l^~p_CC8bqdcF|w*C2`@+)vR5#5_56ayoC89f&4 z`6brfEZrmkTk6IX4eu<_>>^Ahmi3gNz%Jb(+n=WsODm0^MmJyYQ#FszdeCo4_8hGN zP~O&1Y`W9EGIV&eL$5L~c-*4w*MKbL*L=KhYYn?a3@)?I>U8<&gPM6;Vkz6kd6JQJ zO`X&)BE@$Vy1-O7zoFz?Q`NCo9OT3w?!9wKLTjz+>S?yOC5V8t&z#!fGy*3~N&L9T zjnt-UwELNw;XqrC+*)f(H?~RI12tr~NB}V*3DGnOjZxa=eI%6klQA0Q$Hx2}z^o`#IZC&QbDP^}6AtO;bZ37hN_sKQx2u0_b4s6+s6mQ@wOaMnE{IRU%4q zDOSsbPRQYR^>y_|sxOD}lOCa-+f(jItuaaJj`hcC3R!&X$KjJDZW&^6Nv< zvdc|U=g`sJ8s#1i(wYqZ#XO4{o5uaHQq(xF`#G7}wmF3po9D#)X&nl^(aXQ`CkUxL zi%8fag_8Lee%dmfHT)|?)$Hs;4>lo)TB}<4pM-!2AHje}&`J9CUR$)Hu+Sc&uKZ*; z@NZ!{N`H{Vity7k$O+LFH*ycT<>79*`d4V3EY=-9%F~&W|G?0AA6*9|qgqY(0!k27 zxN6I&r1m5opSiNb-(TTdkY93DpX#DQy-prD5A6K><@QTq59LSmoMPk^-BSD{J1?h4 zxR3C45%2p4I>Vu%$yQ?$mx_GN5|-ty9v62&N$}Hk82?Az8XaNpw`kFGzMEct*+yF6J-A^IY-_Axe(=Yg4_Ui0fC{?&K#$~i>EsUeP0>3eq zzP!;lP@AUV5x{9V9$A9j~q(%Wj#1iUtnG_!mZ3umZ*l>P+9zfkMsMaNh_zVK zoT94VqomacN#Spb8s>J^j`IZ$9)%Z9ghZu|S6?(myXa&V_A2?1jg5D6Fo0)VY({f|7Dt}*!{ndXA;DwP zW3H#u{}{XP`NW`nYfPyjU@$P8^pgI??MbeS!RgNAKsQO=m#Nwbql>Rc9HNy<>1ZHv zl5?+N-e&cI+v7!G=-Cjdz^~Q_Rh@5JCfPa>oklfo#3gsY#BcH!U!AtUr5!P7U4`$5 z5R#Ip>xyW-dy8(N)2G$E9e8eKS?ygS*&-=LnsJa$HpFqyqS1=RbA@R?t30US3*7_SIf!nH##=J z#?auh|6~7nr?8Z4MC{l}L(zDM+*zl0_KKiyGkGgaf(;8@{xkGRD2v;DlGB?WBd$0p z0e#lFBVmWH+r6))wiHw48U3OivhtRrDB6`zzXD>8WW5fI*jkH`Vz_1H1A9q{?Y@6j z3LtR>dJ_8Erj}Li11|_EO#G~F$H;`*Wx2`M>y_=vKmi8`AzNXQ%&6^|?(pUMVK;{z z?`OtL_dSo{*<7UgF{&im=^K{Qi&~B>waBXukrPUpn#y7DI6Y0Pkn+A?ImiC4^ETm? zpJJ-;{9|lX-T8^-a;EW&Y6EEkBoG+Kn&Y23c+u33GxeHE{|PXiV(CtBr&BCOoeG~Z za$9o#<+?!-XLN;sD_0M;Be$ma{HQP8@@SV8ESD&?P>hUk9<}Mqf{AsT`0}{yPEC^d z&s*1~(oh^Ssx`S(CS0*UHgv+G66&DAlQN-VkCPJL2xOUUrpcr34>RK+-kBIW=b`>P z&7GnGDiv@!)p-NcCGqV&|Eo14tZh7K$Zf9yE~Cn-#QN9SYx* zF8`Dy()IC^8&E55-xq$l6T&H0>y@XJ&RguY(j$7lz#!;g`aX=5n#F0?t6^JpE#GmI z9niUTG&H-j`o_LPZXL4wp$-{+{VzR5uQoo1`PzYmuTvaJWNgDYYa$J)m+aCmviqW| zRIAfZh0sMYB{^Zp?JziE`i2cx(A|&!lV;z5ta|2g0ZaNr_UghIA4T1*mizD5Go6%a zTpw8rww2dXmlr5}aLKnFcc=9SHsh=8m!c^d?ts8UTFyw^9ei9~8Kf-8O~W`>s+f)K zqh0n>)7PYzmDtT6L{9O=H4_X5yLjt>Ew0%vzPlzgU2L+>%=R=S5agb}Ednp`j0`?O zwb5<-cD^sWF1p*9cv~sWy0fr7d}c4m$K7K}=9wG1MLkc$Y7G718!cvZzW6?#lHL9d zfA~9!=4d6MuDLaCS;ia}go67I3Z(cA_;eyXX`az+*fcc$L6_5bfWyJgM14p%zy9ya z_hkO!X6epxZZWuwP3z7C44R1&dE+gkBNdJbXVT(ToojNx({@C*ZLhyjM*6%pPCJ-7 zq|@nA=0v%V0sc08S`qoG%XXJ}+q}Co^Jwg`AGn7ZBiHZxhc3d9lCHC+({|Y=Pg0Ww z9Jfr#LC=+DFtE>6R&EJ+SzVC%>y{PMUXN!*pM>Y3OKw zPG7GeDc&OxzrQ)Q+B>h`dy`jn_=wv3WhDxyJJJ76ug9Z2U$VFV3G#KyF`PY$z)QKg z;3NTJw^NXpD8&eGFCbg&(h1{liaMdYtZ>XvOQOph$P^C|k25_1c`gu-h}(*cZ)a5? z6;X08>8zcRXrObLa`94(&-u2c+%-b$|I__leEn@cPg2Q|E^>A|m zd8Ft2iYW{v`Vhk-zhzR??`-b<;7G=;!h4Tfcxg0O>xY}QlhLq}J>aL<2_ z?ntTeooynxkO_=w5-seg04IHWnpO{lS<096fg0yU6i!G=MPu%_$8sDGB4t74EDCQN zg=IyyE+7SD;;yZC*IRsF%lUu-(U`XJ%W5Idn1Lms#j}XJL1nU5ZBM?+=XAVJFX(Yd zK;{|R+e$KpDZ?|yCT9E2tv=W;_rNIZW{@SkgRI`VW{!uYLtBv|B!wW5(mTeffM8ch zVP(HweI%_u-5ZoX{`+n1d`aW_&(fMNCEB$%^^FG&yaHY~O7%d>s-`eaiT_r?LObo@ zVbi%@0J0!2t)dRdiEDXNjCcWyN+B?-2gr_E^J@&&^0=P|3LWnqXz?~p)`zRjm%uDc zv6E2*3iZ0KvqE{FWfUpO7JzCrI$9u2bi6y0R2M7V=fTJustqO>n94CJLzC92=PZnN z!znJajoG_nNMOif%($xR=Oj;_;{(SeFbz8bPrr}6IIz|{(&J=Q*5OEpcjm~ecfWbw zCf9XTmj|+Cl2UtvdVO?$FgakiJ;Uhtn*8~|HLxYjRFXWPEM;IkBe9MNY$o?46F-}G zO{W(=11QqNeOXMkfSj~x@^sMGkEbzI0y%4zZh9mkw$uU)`V*)VXm>aQ=7Ws}rvtX; zuv#8>z5YE4$RiL{#S@JdtdaH6iTqHX=d8btoK#C7hkfc zYv!1c5pKI}8c|`!oQNFWoE1hHE-NOU>O>{nz0-&IXc%XuM^onVj(&o| zG?Oep9#CRArW;PVg;L+z+U3s!>+I!uAIoJk#`82#TdwDMX(+`RP#jCUEm}{fjOX>~ z+gzH)^;$@F?Vtc`XK%4?OIqK12V5~!=E4H+Fg2ffMjzEk=x4Qm)hVZkp&m|NP@C(0 zT1~pR!2Hu`gkowYafElbR29n!aoK#8O{%fHqz^1RP|ReHrfrKxG#Jd}-Rg~MBV-q~ zJD;lzZu_OL6;bYfb%BhmSKyz`e;%UsairQ}d~S}@DMO%5E;(m!#ehvNaa0O;vbH4v zsMY_-Bh^ki(0LCb*>J%jM{a9koGa1%TqVTZGsn24sLj4JfFONQIh1~y0W7(vtYts+z)wJ z32$5&{^H_sZ!(=W~U@+ay;FYDr8H z@r=d`Kre5yUry7Mn$OEJFJn^Nq2a)LI*!AePd3?s;ftOLR+_1^IzPMH8<@+3jbY(R z*rFw-4T9aW`rdi!uN!Z5h`mfa<-1TaCm~3Lkkc~;dIJsL>TuPsOf)I{6*qePdqF>f;xc` ze&IJS{oPYIYXf4l73ihB$QNJ#l}=I^wK}eFhQJIOt~I-b3<(U7s%!gtrS4lIpL8RS zIM}L8`~Be=^V8a{sVS6h#YHiyA!@m*_0!>sL*jGVo-Zg$h~LmTck$j9k?c+BwMt%9 z%oT2+?pJ7#f4W7iY{7V(&PYd&tLY(rYXkSt1{y&-gM;5lSgqL@PXJc@`LU+vM0)|| zdw^NAsd;ws`={g)#3<}=%2r3M1#WkQ0sw*2$JcEf7#2x{Q>fQ;?~IM6YcRAkc9XUG zlWoyC$jra+qz52N^I~HgJQdGOi1e7wZ-~mRu&Gjm@1}7YyGEN4{-K-kNPviN{wxv;+&L!%k;A>==8 zLQ6Ya5pjFsinjy2<2}^r+pcHo`kIE|qPsv0mqXjLxd*+iNv74saJ1bxL2^(nXEMNe z@sga6RaaYNd7+AsbIT;uIr(bb<7If>t6Fg9b%7>#)V9^MhfkQ#TNjJ1h}vD+>nDPw zKoQuUYztT3@vyHu+N+GW*wDQDa-j)CW;fy9vq5YmMvHA=Mr=LQsBVii}R@4;@%{L-#?4wC}8rAl>BZAhD-|WIE`?6$EymJeQ&pi zmQu7QC02;hwLn@R6{^SrtSRW&kPZ&Gp=TK(B$Z2;ZpRw{X7(ieC*kq?lHN1@vRXJ6 zYH?fPPfJ9v8Q(f;hpp3G6m@s61|DL_MvfyPMLGLrU zmAZgF>XSoG8s!d}BZ3>1v=+#p34P0AbXQ%ee9K<#^4%u4+u7_E9%;}JaR{#&EJF6_ zzHeoZ#$}Io+X$rebE1W~wspP#YP-j;)JK6q1T=N>_lV}9Ysu}p|B$bnz8@KVWXXGs zJFO!;YQ{ygn1ayF_{?csIv9Sv?>*S|FqTMW(#`TL?DTz-Hi~@%2D;yYL>6ZjbA09% znm#RMaAGvGYmITAoDRXS3zXMLkK4Im&Lbj}{V%~VLP ziAz7;`=}hx~+;A7B;?}RM&g2RJ;+dy=1=bN$*qe zARJr(;~$|<12|It2$iL+^G|WXe#`R(;uG+W_2`?b*K?1p6}zkc9KAbyNpnI%x;=d0 zk=938ClF1zAbi9hZ9j7%^RhoQ{xQ_+u*tP!HIUKplu#TUI`7(oOA0zVi{9DHj#lD^ zK-#%w;G0P=HisVUL-e;wLug4>aObbR%mqK{&GtTo2#hNF6xYnPH=C|%7m$krl4K6N zfvEL^Kpp&LdMnbn6tY@D@iAJ!ZDlc&;mLerQRV>p0D4ewwoeTMvYIEsLPAlY7%c`j zCI>RHM#44jpcfO2=u!SRoadnm==>7IemZ2R&WQcwpKNC)X?n@{>jNbcs zf+o?$vr}ONtJ9 zxD5gyZ_M)XEZDDrvEQjoEaeU@MV_#f80InZM+`2lAiygy)>knRAan zR|dPtVg;Tl(9pi08(x3lDd>KZUzUIMjmEnujJ)YUYhH6bE%0O`CM;FI%j9bS7ZZ~b z@|R-N>GoFzw-E`V%mdc~!v{#d1p#qPtFiJPCkxRW_*3F$PRvtm3rtqE!iEu{92wE1$? zCrMm^Z>s|N#j%O>&wdThH{PllIk8_i(~)&cl&TfHK`ZC#K3LCVw_JTma&K3+Asgua z=6!g32Se&ef-iS$Xs`@Rj~U1b{oDSEObimKSNLX}*ojrCgd)UB%U7uYoT z2}$#{Lnb&^U`bH?3}0ZW7O>?l=Nrn|Xa)v$Pn zqt3k2Z28tr^+ZrsIKnuag<%834Q_z`6N=g7W`wpTuu|!HZEQqUkg&Pb+3^*QM1Pt3 zUUM+!2=oIwef!Ny#wDJTMifgp1-#LseXqUV;Jp6>H`?$0XY)+hDmOZ3briK(?ep@y z70;DD*~S0jfBvee8vgXR!?a8~a37oc&ABI^ z=JwxW2Xe8Sptt9b=Qi8pWNX~rgSJ-~wB22;s!T7?NN)bmA8cm4-1hAE*#_RtQF>fH zQ=gm4BJVG`NC}t0RBpaoBBFIx)9i4HvY4CVyqyxDSuSDkG>E26-xRZOj zjlo!XaJa zloWtMkYUq);F_xM4QUM0Wf9Ej2$grO<43%wL#Q;8p+P?izBR?QsdihE0ei4dSTEh z%k&GZvk$@F2_%kF4fDSXG1h?1cv|B` zJ*3Cr18rtCYsGL+Os4CI=s8b=4}R0p%W9;?;G;~EPTt3!zB=-3 zPA~K^&J}01V+I&BqN1vQ$al_6}H->j9$^+|^G+Ak=biuS&g-k%xkE(-w zF*^%RP0fAKRE#gxU0}7{{d`o4AlJ4^xouPg%9bP{#;N41?!D!_^fdUTnTx4H)Z9q)-XRux=kU>FAbcfEuWo}tN?iZd)%&y7NCejFnU z`OIhq?UXOXhx`SX{Lj`Z6laMLv7Yh&O>1p)rFow(o=^4gru|iPBUi{-$zY=KXebiY zyTYC$bSoI?i#{@@TwAT5#!SS>yWuLXIN0!R9jbtE)UUE0PgE@}l zu}w6a-p_cQy0!koQ06>BTDfiJ;R0rm@FT8x^*mf^H8Gkr&SsOc@BvzLp0>a2#B|F) zt-jaVh!&~}G&|-jnMa$Y&E}yJ2ru-M#0Pq>!YGq8@UW;%&Ey9)z$LDnO7e6!t*ib# z5pl~e$AA>Nw~@B?>ysR*=+VGurc2#awB&y3px)JgtQ_Rpw)4G|FIQ-4h)TA01mEuC zJy392W>3klFt*Gf&15lZdU$7*j%S?>bYuJ&)T;&*MSj|!Lqr0IXae-1e9>LYbuB&h zSW@qMe7h=s`*i|6^vF_PZoi7Qfhc$RVG_2dkEsa-OWD%R0UrRK^2X*xdS4P1)U2nV z^FlZ7Ei2>P$GFw>>AV+Tyn(BzDw%vGCNV%NOH%U19+(0$71v@XU}mxCUP$_=x>}0S zvr&&Cr^9(_Yq6$cqtARkKbT(y~ z;C|X!2~bW)>z8@reUgtP%JfDp>0&0mG@qS1-&m1POz%{yb2<$d(F!wUBZbIPC_ZgT z&)DAIzURJtLC;~#39_F%dP!at_XFypiH1{)$T0A}GY@GTZqXh9XHiGEd#Z}To7P%8 zZ)+L@{G**H-#Ra&TUAcU*YJi}d|P50lwIZY zWZzkF3XrDru_ZmVA25sKUaN{!2`JH9cl0|2vO1CmF=-Za5qCjZ zGy9)~iEbi@rNrK1&6FdLMhw%+kXi$Z<48uzwjHhOWg5)DZBJsEQ41dfgV2 z^O@_b;KttcJn-$qO2KDjwneO5LEok27Yi1HWOw^4@9Wq{1=h!(zyb>hhd(zen)SBa zUD0Lsm52mT>2FwdpIV^_t?b6d_kcdnCZ?YzdOuu*AAHlB#hj$mVif7o8HB0iOKGC+p9nM^)!gwf^ z8BfA`=?GG~sx{hQ;oBO)Kh2}|toqlTrG>2n-^02!^n9ggE+Z+mG8VT-^z$Z&N3#9R z{u70wzh2-m_QGCxQ@DM83^D6|iHQ+B`dQc22YdABE~@U*cvb6y%?qcov;$7zJ6JmK?>+68Dx+sFG#F6{d^bWqtqFO>u8$mvM&ZNJf5R@5i+ zkHbdIQdGv$47-MAUjZ&L!H+8B&E1xNy0j2H`oW4yCb20lnQ*+r3t4+RFXb*MdMcfP zOt>lk;ECr-f-u^q-yJiFK4H+K2EVRG>Kz}OJ z*f}HRK4N?&4Shq?|Jfdn#)cMTt&}zI;Xe(tWrm@l|YIh-uXC z-q*w&sEL6M`Quh8^5kd|_!ih>S{n-U!Qge9LdF>R=Fop1VEQTV$%it?NrJ;t^iG#3M%a{yNcHSNv z0jR)Vj=V~{Tg86X%9W#Phfw^dg-sBl@OkgEL$?629qNVFR^n;XutL}2r3w z(aKh-Qu|v4Vd^dHHRvd*4&sX@nBg2wC+c3cnN3GcJ8ZVBuq9BLJaR3#(yER6yMX$F zj$qUhyI8p`gKdsbe)~E+z9;xlQ-YI+WiumYVflw#Lk(=gfwr!%( z)mHlz6X(WDJEg<|?}Nh>3-A28vnY$Zg$*boN&xnYfAzXZSkhk5l1H?s# z?X>86DEgOEpX!uvSxDAc5MBi{A6?iK*;~uxxEPjHEB#P7{en;RoZ77s1>a-}7i_2e zp()W3Ogd}Hk|)$mNO69S=>El_=%uNN(_G5{k)n~?;htqi7~`2sQu^+n2#KfGmL&*Y zC@$K$h%F1hWga-0Uq6PEu>!NuKh(+AJ#uJOWc>`rzGP6mLPVHD_+-S){oCqgVQDog zU2)Ht$E{R7_4`xF1)o_u5txH6#=kS740a0$2~eUNscV05mq=)x%4>o)L@9(Seq%q0 zmJ|y@G&s{G+X<5kOt}nc+cpk~{d+HwrcRyqpvfcMkb=C&PX+$5FqfKvO^?xaw&n)c z577}QxQ5WHQ{KZ9<`IMQom|niW9AMZlao^NG*7mi9Hsdq{E^|7dBNvlnLXR0QUh`9 z3W=pvDtEiJR%Xo_jE43d{9HuPh@DMsn`)S)uKVo$EQVT7W-a->CFMcGHR#%0k(EJw zY-_Oc;R$amjxCVu^nuek4LXrqTO#k38H_z&MhGJ5vB)`QR;c0<1BeRfQpXG^N#N38 zApCJuO&ekF)W4Qo0(*Tbf&uDR^PqVScs48uv&t=2)kW9{@?Psh6q_Bk`-EY0uYzc% zKdGvz<-%NR#ztiYlI$%`P~0`nFmeb&hPt%^-#Q--GUx2V$>wQoCzdR3j`%%c)p%^+ zF0oCGMd1^8{&1hdPl$k$xneIVzjmr&jMQz!atyf zj#F)2!!WiiG2k&brF8%6g&&{r{3NP#z#~D-;J6$fjz2?C%cg_*N(W|7u-X~C;8K|% zyN_eRiN5zdn^k9YfVZt>;@XOmv_Ryz?KYTnE+e)cpKdz4W{5q9d_49Wl)`T6GN8w$ zpx|Skw3)ugtZ6(YD1s&g6<3^-)BWH|q&Gxo9B}nFK2A<$hHCs=l|BlIgrv8@ zjC{!rFr%!gZRUangp{AqCkvlJQL(XM?mTrIdhX$-#LyUqo8NHopYVTU#AHxo`zW3l zA`rY&)Y1_1p&n;1Flauo{>$CyXjD}%ImX{CG!FVZtPdM4SmATU(OYCvryzY0=;6)regdue1~rWs0L3>P zD)O{`tt2kyH28rHGa)j+L^CqVAr8I2eR%XopmBh;s-sk}wf2IcLPnUfXQxU5;qw^`Bt&1}rJMeV>LU8Dwr& zxY*pBu$@fk#ivFgjxzV78mi1%ZIZo}P4$1NE ze};L5qsWz%a+to0qp=%^Cd8ekz5NZ3K41uFA+Z0!)>%MB`FHzXS^){^R*;hJ8V01h zQ@TOAYiN*e>6Q*@>8_zuK|&ga?#}!8fA4$Gd(J&;)?zWl%=~IU``PjNV%QaB*+B-w zJ5ZW7MH`I`13O0mErgBDR7;#H#G=L59=8AN&aXc*hs!=PR{0v7}nVeQKUOQ}FA^uL)Ge|_D{&65rbkp>_?G&rs zJ8>Hef@>Gebw)9t52?Ht^n;jvL|6bh0tz<^hp;Y>zNRs`ijcId$AJ`Et3H4fH}Nfb&HU5^g3 zb`gq5p0X4ovQW{Vcqz{YYri>SrdniLjfP}b>6(FdUX7g%LX>xyU27(l{LqyF56}#Y z;N?#oHwX%64YP@6_Xn<+&t+Gm5Mtjciq6W7)XHD+%Dx~aK!u&|d&ZgMM7(+C1+Rd~ zSqm-8NLQX+>4p}K%XVjb?|xII%XRbu{VS%g@ksin4|6N;JBMSJa7oTr<1v}R$iq;R zsp}m!OQQ+}!7lp+>RM^N{;fbsQZr|#R+ED;+B>+Y!SA0q(Y&o_vAZuRJ$}cZ=N$-7 z2=bVLqCjiBp^_)90IU;Ij2^oalzhG9oim_?mfjYa!~W~L4i9Gn4(fv;X=^7qOg9Vs zDm5x^N7G?;QN&e3Nct9oZ&T^s(59g?^vTwYV(4#GQwsHT7t65br&umdls6uYKuiAb zR5fA;sPl#Xy3N2XA^@#fdT zJjv{)7s4dBmnmyA39ND)Tz~f+Mx{rp2pwR-a0GG2<(wDY;Gty?pnM!*$+<2lLNF;u zOLT_!fcRtez7ryQx|Gvj z2m$jK9-8o{xJVO>ZgoAjvn9w+MDbbeIbqAC+N3on*EyBRFj{TCS(l}wtiqJ~ zNTMsAh=Ezqd()q6baYCbi|Nlyv!1m%C7;usd)$|(z@3kH6AkWw* z8+iT}y8E4P{$fGu6uJv}CjT_L1JLem(^gCqkwKx0^lw&V0@0wEa z^Sp!a(y`cH@mJ~z^!l~MC^qZj43rMjWMQ@we)8XMGgOY}=+Fxdimi1WCq3#%inpkD)s{`4R-y<6uF%Nl9h+BMx!>E&9O*d-yZ60sk|2e|NyFU_GxJUY6eN{wi-AuO%~V zO4fA>XZ?7?(z%Y>yWth;xTbXY<>s!u$_#SDxMQNh-5sof-yiey8@rCJz%WiuzJz5c z7_6<7E$ivKZHD8;%ij~59Z&@E9#lMw3;CNx*b}87pSBA*ZTOYKAx0#`Sk=O(r~m9x zYlJ9F@OFj}iI*g+PTWeA@h910L$v3@)ObvMC|T{%CDwVM_ulUt4QYYStp!6sHIjrkQvS1-nj(ayCNr2g*rhu?BN&Dl`Pg#eR|C_oj!`}`vKMhGrlCEe3 z&YtTp?Bq`PLLhh)1v-+w9S;0AR-GF7KVDHR1_b@VKM34d(f}>+awGADd0N}5^0wJu({S^t^^ z$6>KvP~%Y#T7A8Iul2mB@`$Fhz427&bB_`4YsHo1+igjLVi{z&AZVd1@V&q>yDL=w zeZIwICu@CDBk6#w8*#n0yDr>MTtPMQR(hV8m&%hULkAUC0!K}M@XdG|wq6kVvig2a zN}6{>xabV&&~|=9YW`ByW0&}YBI*SdLH!V*;Q`8=>&!uiF{EL?US3BOZGTHU!dO>7 z)IR4)-t)DS)B@4qrGBHM!K=y^_S&fqEp)5p^}#MX8GIu)jcJyE&|3E5Unpxoq~>N_ z;02T?reexLE1GE$#|k(QSM4ttcP#cK8uk&z%adG#(?3M3s&cJ&7ccTGGpJ^sDPx5` zzw-zsBhIKn-}vT9gT{RsHOiLVQ=*|M!8g3k-tEeDX>}k16nqgtMe|Xnu`KTDbc@=_ zRIfNTC-X5G7JBZ)iLKel?`1JwMD^adVM}Pje`yvtYSWWs(lDteJZP6BI) zBaLXw{?xs^N{W%OncuT4Pid0t$`#twp)vUUQJx|oN#4kHx8qAgx$tTQhPK$)m1C4` ziTlZE`}+YkKyM0t!;jcLGK1$2qdvPO z^~np;f*6m++S&OHOJB7|8=H{t#j&sIp`pj@OiD_dh3Sh(B0W~-C-A3b>bdQ%I;6+Q zJI%w<23X)TdSCEquCRH$g`Ab5&wdha`iQ2^$cjMXHMufgY+Y4OcTQS3tK1sJ`vKh| z-TaOQCsHB9iZSHr4Ss%Jr%Ny8^fBX3wa0De^PwecYy!t8*Sq&S?dF46=UNu-bo?!m zZc3ta`cBL@Pxr?WSJ#Xkre@(A0z@p$Hoc+47lbR@dCca%e=kZjUWm20`;vGHS4k9;zk%ahiR+dvKn`Rx-< zM4|HoIgEFne@yuB35A@KS{FSQ#)PyOS0uy{g>aJLJWu%3!)J_j)%oRHkGRVOdI|m@ z{AqUoFqDdd!q?c7X^0f2tV*!P`Y1;aM=V0IZfj(|zO}62ye~ssw_z68Sbs(--{26` z(Uy&^l}6^pxH#&tb#3{j9`I&80q8+~pEg=D+eCNWaEn|N+sP1Y;s?T(u!;2zBCivE zW2`a6H-w0WwH`x~+^oU(ViTv`_E8dDUoe?|^y9K9;lncVLDd1$o@t|eiqeW*BRJ#% z8RA02I4MJKb}=s{d_2LH`H)p;90H^mO_U`2Cz`cWa}Vkd)JyEf=+wr^uH0w3z@uj*A@McTz9(*$$s@! z{f6TNVjQU89j43I1np2L*LHsAHM_bvRa1$ip%U$2$jnZ4?#$Xp7IsO2VhmCqt6U=O zLeL=nnG8|f>zj|QgTv)1DG!r-YZF4J7&)KZ;V?m)`SK2CA4A+HUuVXA3SP^=1Zp+E z+h&+2L}aQU!&~JJZ4u~g+jg71T_k_P67(QY2I94YRsk4i@X$3Kk;k>PGgYuX!pSQi zc)d;P*Qbp2`SyfCZ~P^fjl1^|+a^bnlq#5Btlaiqt3u?yhM=LhHTlKO5h4rF-2Tj% z@vq1~&da((qH&oiTBGGB6qF)beeDrXZ}<(9^(hZwq27wAYEOqLhEu^^L(+Vgis@k; z1p` zS*3d17GzNn?WyoIyb#@6L>}-8-HoYBVCMz1WB;AGNA?!=&AKr09>J|Rcf69W;SagzB|`83ihy&H6LJ%31Vo4-1(3cOxhc$}Ag&RlGa|Sz8+&jOf|z zzD0w^Ofw99aG}CvX7{|yqB`Y36C4V@^+yS24q zw^;-+P*0UKz+p5|8t>a)ayjWKZ}N-u)WGvS<9}3;bgkljXkJq1QItvHWo;)dsX0xP z2rR~=Xlnr)k8R+^iihR{D&FK&j>FK&VE)EeUt$gONmEm^C|TIsTCi@KaI$6tUwG@Y zf)yG3p1wm|vTbsD62AjpF)}ts5PsAzV&e=-6k2iu>G*MUg*j51EC+V5=EP0Z=otfd z>POhXaWgH`@ok>u?XCCc2ybMnhcHnB?>0=8hxWOOVrsq8Ra=IP0jq0>W6MqUjmnK+ zmBB8@All)BF>e>EmpFrtmY^^J=v_?Liz@ky**t^i^B!V$aO)Jp@2+5!uFErrExrMH zVv(p7eOyn;CwSW}2<`V7B;BLejWmZll{OB<{-W9t_WhejnHJ-BB#JGJ@-aaVOHfb{ z_wuPT_(p7W#=_Bb_pLp?MP?(783Mrxs1Lvg@^+|su_T@+S%ey(CeIvNt-XTF#sUdl zkF$6TP8hv`b+5=XL?65t{#@&{cG5h+tGgYgZ|0JQ;8(*>Ddc!Ecs_7O+)Kk0;C|ZU z_+9!L4BEh~LdWoMt!j6yuX+^Xqd2M` zo|m*?q-^GJH~jjJnFcL;yoybK*=)^XpCe;=txwa?gDfG(VtA8(#0r+?VdzC{dCktp zJZ-3JEElbe<`d3C#;W+s(X+t4rTqYds))h+*yGWs#$w(7P;--X<25IC*|16Y@be4k z?zt1r*2xBdF^P>l#f=>4skyjK!P^{l6h^5oUnjHj7xxk=brM)&v~6R#V*Ww^gq!jg2BpdFaKF*mdr)E`~v6mPihmN?04}<_kwXXL?QSW7~KiX0oZQp5^ zBOePA$N0vzuJkeMBVPhFgd!DN94N0Y@G#*&MFGeuK$`>2_bm>)i}wqPzmN)P*6_sNY7ge z$HL7;BZ5t3{>inE_dxF!o7B7JD(oM94g0G-VK;*WBXPwj;A>yk8&G0)Z98>nZ4JK) z`thn(!=NN+CC5;*8xDn3sUCA8IUceaKC;W{&*Mu0aAT!(Dj4}n<8kF)FtQ$Xjvq;DpKQPeItoZ* z;y5-THf}rh!55n7cewMeWLrv2Hg>2xUI*T@DfpoEhEJ!6*C%uQg_$8=mNvNm76h;* zmW^(?6bugZ)H$DshU{D&c;)BoK^CsTGoqv}_=$66JMM(Ou5D~&R|+T1>$YLn@7Yno z1EJYaBM0iv&RDCkV?m!Qy$8}23)gZOY_CaIqXxO(HrXTgyq@iV5dV6fcLJyP#Jzvo zV(nDUt4ef&BxT6R`%|ZgtZw6`5v3f^J^zcHGwO#4NMdKnEas#23fNB!>y}heHz&C! zL1?~K^U`KZ#V>fb|5QDRRzi`SMc{hA&2hm-7kJM^+WSl&O-Ar`VhXh{to~~R12RYC zoDr@p$wtJ+#=Xkz2Ir{{`phme^7Wuf!!s50_=Izfu0!7J)hWlt3nwpNxfT66BPH`Q`07O8Ppx`Dq-8S(U~+ge9aR$nOe~R9mTQmgjYXw%fYyp!)o2h;{1j~Q-s_0$@VUTm-XH$ zcOZM>CEw!A%?;Wj-$;2@d6joPjJfT2VSK!d#iXz(d} z|6C@*4m@%KP<+LXfQpt^N&6XtY3nccHg$?LH~P#`xk1wzSH5)UFlr!U6%Y2}GN5h{ z=*Dun7(hHOvVq9+qFO9c${)0@p!<#-V(TQFmKY~ z#58mnbw#brba5I2HS*qWKg9r|qr9R5Lh3v}+NBI%B+_0sCNY&aDN^!XxUp`!&kFSf zY`)QM+kE)54de?E-8l@fU z_g74J*a22XoHA@gImIE)^or|UqgyY$D2Z|sPd&F~w0}*`+XhLBm3BM-!cvL&%jiw( zhZ_K-cxMV+%^jP}9oT4^KE9&Gp38EMFe)`KlrP0W*(S$e9Z36i_!FvLM|^xSOZz_%^^qIj|_N^u>})nhg%Q6NQ+74>EHCZ@*$? z<6weL{C$2TRfV5ZJ7WyNHV}Z?@2HNFg^7-f@a~0kc?J{ULw@2*IitoH)y0@>NIc~u z%CV^Ys{Z=VeOZ}m5pFmF5VK8303&D4L=n`bE7rZCa9#J}_%%|o3F%4tOEqTTWu>~$ zB6?-5@zrPI>6-lCEC7j()VUF%{98VTHEIC$yXn@mMOt#2HjzDrQqb{vXQBe~ZWQP( zwD;JImlVn3ckMy6UAdPv2!(AZ`f_tF<92-7W}V^sfB0rY38$|6BBECu-7iu@w=hoM23ahJD3 z79Y#RKpN4Oe*Z-x-z{T$nklHWe; zv`lxmZXId6;Rn2{Xe;jkowu9{zjfK2XYMLi(DT)z{aXH7Z|^{cO+rkW%-(pqv4@c{rb7 zAS4a18pa}lnrMlyGze7M{*7vkH4#HKQS`-8i$VPk9y&x7!|NYLMjGL6)bYv!4fIG! zQ7-?|&H%(iI_lQNYKg)!WAtV>;nPN}P}x%q7g#B$jRmhPvRLbBcSr|a-|L^9@ppIp ze~%X^=4Gcuh=90s!z<3kFKJTenIh}L|2(>IF`7O){=Ka>;b6Pmt17&|MGKeejmJV` zs*m$QA3l%kicatt{`3IBi~b6fN0Tr}*GJ-rk;J9Q`veiD*&CzK? zC*Ih5?lH0N@&dNxeE%h$N)kE7$_c~<@qwn1KR_vrik}a06|7dW z8Syg#uzpMmBEYIcTb`NdKkbX3+mD8+yi-6yA00h^#e6CGg21W^Z{x%pCQ3?i-sS)G z*|BA4zrK~RZ+F_~|BmEesZ$_`oayAt(yXo!!HRh#0xC=@Np{M|$ zI$8Z@JEQ7w-j(*W&!}xvDvZr!AeDzhLJIzraqkr5xGol%1EPPHBVCIXI$Q1qJr|SC z2EW2N2&xu(1}&c%b8hh#9K=ga!a+bKf6$10z;;VbCqUmJ0eU4sw6VPb*cVY6#aY($ zEdeOZJ4L!Coi{y}AsDNoE5K1IVwYzH>Ep{52!Rsum)FQZpC}r)ENM?X{q@2AvgyYi z_skGLy-LD>p7c4as6R!ElCf@-T>^pEA4Sjv8uR1f>#OuEat9Tm)jK&?Q8EwEarY&l z`Kr~fv}_#U5)9NvE$ks`O)|c}%7#qB9ZZ1lE0k8mL_$X}&BVY@D!woT&$R%QDw4ez zr;iMptAF{@S90n9i`L1%wNK0uQOt+aCO87C5vl&M8HRQ+e-aF6EQP(KVAQRRoR(K< zVXxPI6~z-HkDBqzK3Qr zi2aN2Y5(s@06tN@CP9++QG-T?!?b1XG)Ca)rTZUGi@(&;sH~hXG~P#eF`zRkj_Rue zN3W)f+GjLbmiBrgbvBu+y?H8K$k3|8vEcQf0B>hTh;xD8(K&>a`dvjUj`(+L>& zN#=P*_KMb-kBw$rX^$H(BJMFip@V&ABzy9jVADOdPM z7{c{oynGoL_A)S#PTs3359y7F*J_SCGf6B~+?#^2y&uPmSy?`A$35*UOE%$e2tgjK z?B=5-#thBMKcge~BWfsO`peYI<3ycI>=#>*1ih|A9`7!H9F3-N)NCJj#UB zmy4|^W+Ta>0Q6j~%jY9uGZ>YCIV$A~M*mW?GZ*wMU(joZaJJ%>gvxXUetV?ohU6># z%g4KG$?ia;%gacXwzruK#(-w$2h!u;HDvZ}x5+W_mqGxEj8XRlO+^(Ez!WE~j z;a#2JZ|8KA&r;Q-<2unVJ4lG^4@a$~TCL{a?`j=4 zB-$8#YW@INg1;#DZ+fj)n)f;r0~Ux;{@ASW5?wC|;iwG%_2d~F4kzcCYH~LE?{D66 z!9}y;Io<|gE^F4f{4AOJP&S?|NRn7A*N>wJF06t*-B95_HxQbLS(>RGZ4M=#-tAYF zzLmqiVj5D`l?xs&&i48w-j}xG7pvdywcctq^TS6a0hU4=<&*_f7Y)P^1=UdaAlj8d zbtkg~Tt%`$oI-pJG+mrUgs=FoV23^qqS zi6-GvT1ySQ;FthM0`rkq9F^~NN&KNpwZiNjj|7_ENjC~H-eXMIF|Injp=PNH-bJTz zf5a#E)!dICqE?n0zTZ#;K`H!50p2_wzxz?ty9vQiJ3WeNaGA#UBIV8~(`_0*(|${s z_tEEAcggn9g&)@CS|I%^W)FZ8e^MECdSTS6%PJ)$r{oCIX*eJhaAREdFhLxMy2Tnv zVS%O?Kw?T)_b#zfOI)6)!5igvMxdzb)sIe_c?!$fYI1J7MW%zY{AZK)sqfy`xZRLx zi^LPHm5yP%F8`;U#YPHZuFrJVYgqhlZ4`5Qni9;2KPS(bKP)aX~Qi;+- zquAN@corH^YFv)mP+^d#OH>~}Xn{I|%aO6-K@}JjRHIHAK>uy}OYBb*RAdPfA^NE? z@d(^07xXA!a>hVLs&aZxK#$fpHDrTQi^J*qo@i#OR-NI;$XpaL^QZcfBCisaLiRGv z@(3WCZKbo&0y}Eu>PJ!)gn)PJR3G%;DtFzSNqHi+Ir5*_8&Wt4iQOj{t#$oZsb$277lz&7tG+ssRAS z3b`=ZEZ0lVinfK#|8jvyQc=ape%saj{^|R!BCua$ewAzDgp@pFqqOq;cPsEOli<*S z$ar=O8PXQ`YaP0f-sEBp=?*nJZOw8L;D&0ang?02h`Fl;@Up$bj{0Jbv55l}Bn03LhnFyQH zH1HHhGTxQ~UL+x5Imk9mB510eadduEc=H>j*!>`KC`7*VQ5@F{QcEj&QR)k<-teNxGnM zXSjz-etnbp!f*cP6cn1MnJ!1Te0Vnr8aZ2VCgo*pE+A4qSWx9O&jMEIWzNg*Dbn1c z1zi(t9>IQT5yC-CG7U{-ef5f+-Hr^{H4Tfd9>alCn) z-|DV-{33v6uoc+zzqyPSD zSK6QQUA{?LOaMt2+Yclp>4-@I>e^&@>X6wI6XkT`^)DpEC9KkUQ{p>EOEse6DyWHR z;&kTT3&z7?q?8`Dm_pdPf;}Y`LEsdPKzbTFUkPzCQM+(oGcwdQrcVvipmAJr`_Dd! z66C7CO~u&vn?!bJ3ooSjiUKPo-xjU3zZVqy+_@{{EPWo|AKuP+n7Fh&Z_E$AC-j;fe` zhjH_j;$mAohclxA7k0$H7@SsphOu^$yIKZgQM6)5@CLT3O0NR1T)xp9zj zVF?+yMZ^D05;2a8Mk}BGo-dZ6^ySE$v~>6f8Fm&YNo-yNuQg9;k{VIlL)^8qXzVI! z{%~(q?jGy;T59lR#Z-wAr0_&Yg1^4rPHOjX=QC+OTF;N^Ng0A6lF^!4&o^pz!*l8Rf~ z)x!RV78TxQdioDvq%)fPT2Romn!3w?7Gi(ZyP?3j{KJ|S{FN<4N{q*r zjcM=!2@Q14z*qj~fgO{3P9aYuM7c;#d#qDFApI&e!R%LAQo?gf#8nED4mW@|A{O)p zN1WjeTYtcqWnv-Gsnn}OmJ8|W@X(>E8VUmN^J-*r@jcC}d<_51$NBe@@g#q7a1H}o zx&7a(oD?lQ?ggRMU4acQ5K5nr!dUL)^mEMr5`6+Np)6T&aqN>I<7;oa@0C)R>GWFa zw-Ji`WgIy_A}#={DeDA68A5gq;@V3qeVYnRgLkM1>qSDv|5>6pYZhZBfp&c`FDicA zp71GO6~^2$MG+#8Z$~V}R__&^-a`K_L?+_LX#D8TCr!GY?Foao;&NN3y0zgz0xsM{ zcI3EKOv>UjrUbew$W?@Kk$q27++sK5(PjTh2z_Tok$a<+3;`KKjly#7Ri2<1sBHbJ z7xP(>M-D`XJ(T0~REXNUDPhzEV5@G#DZ`<@H+f<~$9+E6?!ti3sruKgR9%Yi)Li|5 z*IEE(CC*|*#ijF4bM_r@7@`8Ac;vRdCUQAzi1U!!a|R0-P8uuO%lYGlA3Bd!dc`pX zjlcahzjS6hee~ZjCz-YAbH+@w-}W{y!;p~S*m{Kq?LI}41)o4sh8`kbjNNW+2ilA* z#=V;`>Lan=(W)~YswkC}=)CUOcG_OLjbOPjI_dH)Q7><(3A{mG!=E-)>n@PVjZdk&LokBEtfBQ1d0< zd-3bq)%U-?*GdtgT~zisoV|R9_l`lcvI3|ewTN}q(#lc(_4M@oa@uC3r6MtT1=mgR z5Y(K>=cZ|y6Y^A3E$D1KlPoL!jdn9;NmsC_I}A_X({u^9n!choXDE@@nmA_J=gzW# zr{8%YuUdh^G6(duOBEV5m1rL5TZ0*~S`RI8UMMmgS=VxCv#S6pw1Qw_UJ@7_Dp{FC z0izvObFI}rUv;r~-}4pmxgTVFW3%PekPGO(wJ7k+20f3m99Dx5ok$_3YP^e1@}8a7 zI}B;fCM{P5`k7Jo$II=MM<`)A&1w~3X18zOVknjF%(4%Dg1ztUC;qwk{QGbLC#s44 z<%xI5J=np_!$x2K^cEjBrnD?(pVDL+Yci5pNg5Q*a+MwT3~xxI(w- zJa~#`n-!t~X)yXql?Rt~x^6^7Q#owRSXsS@1iAe8 z-pEm;28WWUU2g4XyLndKX~yMmX4l1^SM+TvQLgB}$MKw;P2S_&4bIsy+H4r@&-c|R z<%tYszHiZ~)juKKKiU2hic_!Wy|BTy9lyuc3ZxV9aYgxo$+t3BU3+w7Zq%Ztr2;u|ZLa+@Qv||02`E zHr)1>g_E;9VrAL3?Qq`t-?v)-F;lGY&l12D+>go>_Rk~|q`eRqMup(QYcE;Pea9i9 z=lv`_%km?el-Fs~A%adiJ`t)%GJB1W`J*(`y+KzHwPLB@WQ<3`aO2BskB#q*>NZ#S zZ0(076zk_hY;C1?3BFpo1|ROu6o%;=6r7`aK180Y8oXa=HW>#SoJ%YMYwacyD9H#; zBs+F4eRR4S4Cud%Kj`U<>Al@vXmMMPB{vWxz`e-~>8WF|1C48ZrqCrhc5E^MN^VtS zqoG={P(@;cGt!#Q`h)5$y#IB87NT9#cA2lK%S`}Rk`E_0*UXCNN$_xhFX-~Kuu&ZS zyC%=KJWO(A(g*672083K+%nw5I<0O@5dy(-tSg7c0|tx@qU;`Xq3`Aius4 z*O0g_lJr89K#`P`%t`pPE+clx#9xe(!4MyCYxBR}JE`EXp5CfV_+S2W(P#G?KXzhrjyL=co^D$_ zWm*}29jhW6qx|2!lVd1_VjLHEC3F)2l_GlAs{K!FKbMMoL zh{ULC77*QwoVML#t6?#qSc#n0{3L;3s(X;Q(WZ+A%Onxd9|srl2*ji`K9|KY-OE;8 zr$9!#RuqpatDOq(d_s)4-T%AU=n{WtxPC6){aNClpIa#UD@QNkve45@Q<2h_+}+(} zCzVKcr^EjWL_#|mn=_#L@IeO2GW-?T8)dw8`_&->JNuhR0v46$=SVdIQkIZ;+r zUuEjMj7>TGG^kVF*GF(r&ze4;V>Han`%cZOf!XgmEIM%M&L{Wwooj%k)m+qzv1XVD zCKhqf#%^OL{1 z4_vO(+xioep7SJ>4I?fxlzS)^?Oof#>$wJFl9#1w4yaKq@zn_86bb9jKl0ym3 ziDa@kcZpqYxB+ym*REz|m2BZ5vKe`{z z2_Oa5rL<6VfM=S2UgDS@d6?u4@|m5P0`RpQ`o}4aPg}ZohW8x5gl71T8*n9ua*s{g zFX3OzIedEJ^R~)5Z-BzA@aCR$CkoY9$Yc*k((W8=Zw9?cuW2d#qO4|$vM8I%vs_wM z6W>SSFwsb`#Pm$q7=IN0GiQif;>Pt4Bb6I3(<=KCnaJ&hwT+NpzrEM zP}QtlH!>Cxx3b>7h(>wXVy9ry(c(Ppo~>&F#oAqbBS6tjCI`BBu zoiR)JG-e?1&%yeSW7IYO_sAV+Ys>#NOu{XI?fKyh#lWT4Mf}tHjCt+86Gk*sYy^k{ zE)Yxz)PzrUwAGvthOFG&ctnxhztbn?N55Wj#uO0|Q4urLTvaJlfy8D=?hJM31U!e){iqiH)5 z*Y@b-s@GWwbb+c`dgPqj?GLDRh=|)tQ0RM{QUd~3nx5yN*qZ1@gVMw1jwQmS{PU35 zqu(Pen1I8!&(#ip=s->c$D-)ERG+l)ly;~1Cv=~d$DX{>*Xw45XTMk(UAJ+F5bHU2*|0V1 z07Ib=%iy-Xpo~3_gzdy$r?0aeCnW#*>H1p;_P}t9)Y}t+hD}O(u=bWz_A6uI_TX1= zT@zaqET-{XmVtWZmB{HWBI@SLuFXpEIKfDYH;IH>$E970h&P8NH#HCMm4uYfZa2_up9LW@_YBg5vNZubVFYmujAB zOrX^+yDFYh$gp52uiG6o?yWj0@NY_?#MQ_+3*^yJG6*{tq3 z{>^+zN*2vu=G*imZGrnxNp~D?y;y|(K3bNy(pt{N@?eP|a&V{bYv!bw@Y>bn6r#;M zgEPsoHq@r>Scw!v{QX-RjpgF$)Nd|rq}SN@Mxh(nIPSUwqb9Vmv91Xv*Ll$PZz59VKBn33=v4eJWYYYNi3Y8fop!CxcCWMs3*n~( zk9mK?c09=ObUZwq`j0^S-wS)d1=Y#QVS1u3ID`71EvYW65nutbqEENSfYO=n0V~SvbK@*7eI}u7#SP|Mx<14$%eP35XLI|G3qIXL_p)54K|pDv)FemNq(4jl`3QW zaHDv-U|nVX6$V7or@rrtdK_M2(;0NMMc4tddHsosf=oTDXys4Cx)b~Hk$5sg0jDsVBaE}7nk$_smCpxX_TvQ*b6(3FL&=?VYeFy&o zm#+IC*AFj>xM(COTF)MwC-StCbyFug?1?>+StKoBMRrpZIwM4CSah>xQoY~8fxOEAn-y(b&iH1G|8@9~|d z@bmBBA@I%Qh#0o-yu^1KBn=)8Nkql_usYHC^mEWp-#_ogeLpP6q~!trtwp774-GNE z8sUscq02L7n`4>Nvavx==d_AwrC!f5k=OHxvhjVowHQqkB$-R1r`mvE=g8l^q3)Zt z?hP%+#Pt~R@jszDx5)NI&6nsb-VfW)I*y(*@P3`YLc(Ol1D<00<21r_r%##DxZ;I# zi-y~mJeF~CgQJL=@rjVv;l)B@C)(xy+}!mfAoE#7AdZYqm}_l1o;j~o13~h--pz*% zrRBioOT_dkI>U^6?_Q@~{ZRv5UT_RypU`d+U~{~0HCHaAJI8cPyVIOQ9^_LCPK+P=7+bvKkjZN68PA~&Dcd?8JA@O&J%s~zz=teXvO z#)~NVFmmBU_OvOx0XW7(U8QY4jQyVVlg@r+JAip-cfzbDA23?*E~d+bAl z23Z2Hmh;02fAeFO;f`cd4ixLlUM>7j<8n?5c%8R(b; zs*;p_lP~(G8H$O}16H$Gu=jd6ty-J+Ws>H}VdF|!+-*YGIIcawS#$iFvSTG7bdC3M zzXOBJVMd;(R7${lmJxKfLv?evZ?6^=mAvy4a9>xm+$AX$vq8UUr-~oRz0s+bA)+CY z5=qOyo)o@*P)7wK@M`hVzDim}kI=rS-dNB#5k~PzOt6Om;%@YM)k`(X;8U)A{uS(+ z6e~o!ag|BkM!T#67+vHRrJBlS{)z0A`*^G~SI-ZXLYccJAYY10rz9+X!6RmwDR3=W zZ#}0k{^L!;UYK7yC14&cNXV9Ha8o3CB*Lo@`-xKKFO3I%Qc7US4(is8N-E zyVCbhu3K{0-h*+)A!DF47zX7F7Lm~Vqk(C&k$4@%?Qk5LlCb-{u$hYcybA1yKab)| z1%AsRCWO3}SiZMg1WQ2jF`_}2CDH7)>+{NU{ZrS+AoT~>Z-LMoIw+ zK7*+3Svq~AZn~4vH%LI7-5gK1*=;1OOLi?M@L3A`8@-2W+u?;U3Xm(7L_DhSFyKXu zXadWOJIg=5-9PWegvu z6M`nb$2l7^xgr;GY-2o5OXIMJxOoa4-v#RN;&|-!K};e-bHfaG*>}jmgyf($T%>i1 ztlr(3JwbjZ{Yd0<#?P`wT{j(e6uRv*gz)ior;#rGj_&t2*`j zFXn|FatXr8lP)DcdUyP;@bh{6THTQ5^<3_u-Ol48-)_pLGD))y@vzr{;Hrv;?&92prS~zt6Dv-=R8aT{sfeg-)_z zXBAgQ^ypj@^ilC4uxSTxL5q)i58$+`trXF}j0#1C_(V{>AH=+W|4p0Id}-x9Cc7DL zz*y*;$@66RH%Xar(y>S8QZSQpUP-Cdz8oHZGSK29ok_2Mf5cG}z@a&6M^tv_fRaHsCwd%Zh1V_-%WoIqje(L+`j!% z1FxA-Z?R0B!8CqQE20xO2ve3niWyU|pod-cWd*(?L+ndO+%k( z^ikX*d!r~IN(w03D*SMvJZU|9AaTf`A3WL6xbns8vU08i6`%2a{GWC;#_LgkTI0-b zf6lf>3iZ%9EhmM=L3hJpfC>6d$#bWo7%W@_e+$?<&Oa|zH5|~bXDg(g<(Na@@4p$Q ze!MeUgK*jXR3dU1#XX_eos!LW^7LJBpJ849?ylZu!T$=i)`XgcM_l^~rne)|Zvtiy z<)X^g4y9+v21uC^m(t$~)T{K#)XQd-I%*tiyiRk!keUp?9><~5w-|rW7x!B@V~#o~ zY?41sX>i^gq&Ie;jZQA~7zuOMx72EN`##!Bagt=IEJ0DHQ~(Q!_@G|4)5NzDm0Tnr zv8v0Gse`%*zOh!W8$rZo0Q+ddhn703S;FGiqgvC9wi1SBpX}u z=(1VD#`6{Uq}Qn0zI{uK({>V|z|ZqYdf6$Lq|ED{yQ!P3#{Es$!ZgNQ+B;tQTk)+F za*`-ys`eAN>Ck4V9J)Yq4=2TP2>rLhmgFj5p{Q5#wRsUQyKE?k4`@rd9{RI?WAe^} zNf5)Bu3TB!$ydHdN?a#^(4Vmju)?|1EKy~t9dke*djyvZ$54O;4wIqDGvKq( zX>f#xcv|A=)!r4Wl*%i75U$W5(Px33ZgsylS3Ci#UFT(A&=z%xX(W)FB?8%^t7uP% z&D$R5okXXeC(o?R(LMd^9u~Vtd{JO0bzDMM)A_nDd=wpY$WvuUtadwe=iR%dx5J+= z8{Fg+aGg5n_W3?jt1szEb}1q_ScwogY6=z4lujXWdWoEU4v9@kS!FZx)$#$*c3 zmG>oaB95#KY3HM{p8xax)geW;Cp+p!a>^1G2A#5e9eR%&i|^ep8g>Z($PIUoNyttZ zd_kdfIt?gP!SK`S9$RwtZ<}|c9)_NyIIufhm7+VBu~@1cL*?*u-?79Gri$n~PX+Ki zCnCslilubUR!xRwM&pRmHHV={Pu_(7!pBI-)rU;EUl?>By>^8Z2<>?rNQa~Eq}m3b zi^%c#fj~)RXHZuR5ZPfg?xum|eHTdR+e;>SA41Gv z9^CmB5piM)Lpm#Gwi?cPzOs+cy^*o5xW#gt#9>?I^dD&4AGZ z9$2^A(RYR>Co9Uyj?im|x4WbP09~{Va=FIpuisf8MRuynp_Hm6wXN^ELC%W76|DEM zowyJ=HgD@x@D=O3#2&Uck+*xj1yp=O@dfA;{A2^91{wg?p-#`cW!%M@T2#O*P7(3Z z{qh;kK=IK4HyD7?mG3}Hb5hQSjR(u7_iaTC@ZesdEV5 zAz=bLY1rJ(0ygWG+NE1bd44i6ne}HJro*T)hwafkl)lUGYqv13--xhJW~kdBiy6rQ z0e)!*yXqCx0Xlx?VQk5}6J88eob#svDxzYYVW|;zrm&J7o`Q1C$;Emrr3XtQC;E5% z?pJYQ+i$+E2Y6m^t&)Yk_sUeDT3W~tzrNc*U|N$JAQ}g-2e(Mu4+wYa|*d_EhWIUyZ<6^H&>-3@i^LV zgYy0EIV9!=#=#%L=kUpa-f(kgdW4P1`iy^o1>(7@rAbi6i8)HaB)07G@^o(j2ZWJE z$0AQxVU9zsRQcToItMx}$1p}5JRF6;7nZw~lz~5ctFs~`ltv2rF_8=R`aKtt%5@vA zQDI!=P&IyBEYi@do=C`$5Z&anP|Zop+azO2Kez4rwd4!pqQ`?`g%y1xUY&(9r9GNg zcS_|v&y*AAB4&6kR~gTlV(Ca@g`?McE(jgcZxNBGkh{5|x)+B2<668ma`HL~cZgy^xb{zs3ATy&D8=-S0P zw{A(Vbon)<4q^YF7gf>tlNihla6POmNjpArKf~VVpY_0NSR?jx@Qr;~ZGa+%RePt0 zuA@9Kc4IcHfo-tNs&BBcRjx>#f1^iA&Pv53%$!~j<&gs}iok*RiilSuEf9RXAPA2z zdI`IKj~bntLaH1mrZH2bUW$9tTHFdw!c?~V9lTs}N_`&f$$SyhGrdm6`4bO-n~b;& z&7!jlq;SbO0M-;AJuV(B&O>-{cQC|sb&7iIK-R=0@UjudQi*hP6LLlUuE{{sb6pGD zYyfmue+p>b^+cIu%%o0xjD({;4E6XC-|>pA%44w_*PQykhMRu#u(c{RTVE{0lD4_4 zxw3MNC>f>Mh3<1#A5Y4gW6q7Va(tVL1<%!f>G#a6)F&GZZ9|2(QTf~(ju)c@lu>)L z<9D4n#Xx_2VoBAQe>w%PQ)i@(G0Oe$J{AF2^5(o`tAuc>9IK&-@UWYzyO?YAT2pA% z1M+ca^y5%+BZh{Mz=$}pVek#lrNidbO+iRMzLX~$I}jvr*5W{k0T-D0LUw>mRp*6FiaBdW-V@Veso|k=gEvowYBzbI;PXmJ+&YrsOQ)`Ap008u)@nd z?%iG>I0!KoM03X0$zA*8TA57kxiy-A!Vn6#{(9iSL-A4XshvY)EgTrDf|f`1PY2@^ zoFY!DC)pGM@SdS4mG?FSas*V7Jr{4XyxLxgx0AFp0zsPRl=!>lf$0a&Ez7xoWE6I# z*Rq8{5TcVuI6iNYQT$XSaWA=(S7S`N^t8me&&IYV&l(7S#dR^Hd^S)W&e|Z?i%l#V zhK4ZqU%mvE8~U;2Q?1rm6X!MS#vf2x90vOMTt<7oGV-~&e^s_{=te=K!};)}OqRbTGd31p;OBs3 zokp3ES3)SEPBet0N&GV1(JUVtJ&Re|6GG zA|#EACd@}Acy5!}4xdABI1;|x62LD~dGS%$Ape6Nq27)fBgtK3v2rP83Sq=l#-)Ph z7GGnhoju=j(+kq;djU$6)_Mut&;ln-zEQpE-_E|!uuA9#DL_5Z&`beTB&Ypvq{5-P zftNQ)Ve#JXtq6;DVXa@Ur@|pghz7G|X?wrVp)h3BUTSAof30=+2}hOw#1mrup&FnJ zaJ{yIpZ6x2eyecg(tB!|SuQqV_`MM*gQ!=?l88g06^xIxGid}w+^iPRCx6Rn-CFd@ zG=RgnrkSv3ILm&sdx?Wm-00;h_idjH_igz@9s^U5t>v%^A)%L8UoQglQtHLZ!^t%M zNGRqLE%)z&Y}3kYt_tsVOWghWshAXbR@7w3FCaVo3zSS5(DSwhASg&c_^lnm7*|v`&5pGIv`OW@FS+z5A>U3 z(&p^jr)W}P$7Or37KFYrZ?>z0c_9vZO&IGEY;^RJu+~HS)SAAl-cW_suQwt$)>FX62INK%c&(of=C&iUt)T`ykD5k+$~Vt#s5r;urgl{ATSED_EdrV|BZ=;^EQtcn zgyP)>wL)@@VB=&6STSL5cPvqOBf+I^ZQ1#bUBJ=0vS%D+L+kBo;9``hy%Z7G5B~v|ZJ}sB->R&2yKqCqsFtad58w<(&51@$fnRi!U4}Ve zqV5nPSPCt%YFuukbvH`kNlz1iY6!TWZlexuh{9 z^1SbdKBLepN4Rsaq05QEa9@w%dG3xp5v;MK7syPHum+Rq_W|kD9#+uDMDl6G4BV7^}9B>6Kjm#f|vxoxJfV z z`)5->&xtoVmGfA$sPolC_s25`ll5nx;UiZ8#b4LmG?$M&NnX4eb4-&Xvbj5UD|>Le z5#A5;SQ$u!eDDAyTScweX@{%fyuoQ}=Dk&(my8|ZGHxD0L@22GLnyDziz+_e=W;_ zpwVeLs*8fIq#?4XP+BupD&0+?<;a7;zDJL z9+qrJ@e!OKVb<<8ydHu#b3}5PNjr z3!vCwMtjjbH}AiK2Y-eB>5^Zy!=0~2Du?~@7GKK_8Cw$e0*am9N?(935LPlj`E3=f zO@7SYx|-Dy9YCcpGQcfQTNyLh@|aAz^&ng;2}Wt?hq>)p?%u6N%edp-c|v+ch1+Og zIIt^intis#5O$V&V*x7A-GO0MS)F%?ELyAp**uC1OroWhRiqUkT2>3(k90zg{G41< zom@w+4v#Ks>ygY_ov&LK0SsAsb%*G+sIbXpj*F@? z;>ku}pMMuwo4`D-kg09Xg+D?0uPfNiEJg-^Fw@{OpjlIFe}*jX%$MAvKGq;lbB8?w`s^Lsuyq?5Ar zn1zg{U*ZzdS&n&(@%3$b99zv^^@w7GY|Fu}Z=G_NdDoKZGg}SFi|uc&9yLExGln9V zryMW4F6A5sdhM~C#}@lp%_Z#a&k9`gxz&xa3)C3({9FD2hj#w$)O84&!3HI|U(liI`Chg9B#g)2M()6}|zhbq-eJVO*&=d+YKqHl6Hf=(1 z+W2L;ej$plPx`l`r~B+COWQT5cZ5yNHNx^%%q}hk-QHoq-e^d#pyJ{R@)uVv@^Wn6 z1;pY%T^*1XSdHgLC=mS#_WFU>Q7qZ}^c>PyFLRQ5*fnoozI-=XD`6FSyws$ZGUY5k zE0Cr|=pt-2=pKmLUY)ogeEY6sI8XG27KvF8B=|ZsxgZ{0**B` zSRIG2a+h)b!lwKm!Nax#hS7YBjq{cMN(*o{@X3Mnh zIV0~p`HR^3^pBD?@>kW`;O;p6@nBd9MAkb4WbPMZz4+5wDV{wy+o9?Pz9$0#yqVOM zEur!BKB-$?_XOq1f17Z?I+IEV73u*}(N`AWhu2gziiNg_r&ao`z_Iyu5Z!;SL3QMz zKRisnQ)9vaJu&!0gvRb?{C{ZyB+6+4k@rs-E3M34onVaKR#+pi%5-jrd`re_%#aZ5 zF{Z_(_a#Qf38vFOoxVu-NyTJ148sxqVMQF)~tp7UDjwZa~__P_q(Uxob|>dH^{kfe<9psYt(QUz}3DApST@)%G8W_&ZuiWbJ~~ zcD&ofYkzyhDg*xPP6tqM%mrVyE!!d%;U%(3J&yBri0 z^jqrN3N{P$;Y?{P_4%j4a5-}ea?t{p^+adP>&>U7<_P}(;ad4h$oT00tY15N20hNE zSL#sl=+F|$M<#o>-*QGoUJfkF&sNX=-6;XOX}gUkhDDJSEwRF>Zx^jCNzlQx=COq( zdHU7k1UyAYkoSN(5}yAY_m~cNfE{rIu?pRRv3+jPun3r+fe@^0i>sX?kdz=34exBW zY0rYLF^J}NFuu9WW!mT4Yb(jH{?Ks^CG^FN4E(c!`h09Qe*)8=6wcwIKtSt$#X z&SON|KmQu>+ykZav-slkp~rHyY;(}e)3V9JH`5}==E zbvndSO8rSzJ048oP<%;{EGm{c8vRdO|9i7-laU)T`%O6Cyc?7O-Q~Xf4P?eUFZU-| z+^;Q}d){zjY*;TIgi9NjixSoVm;kn4+PXr2cvX~8t(u4-UEbl#H-Et$K%4I7_sRd^X_Ft^XIA6Os{r%E2iacl?*@rpk+g(pm=6hQ>M&QsxVZV_f2n*66oZ}OS- z5cly?IEBZwJ#8T)oOA}W0*mTEOV=*QbUPv2oK!o}|6GjJ$#hqx%4>1jJ$h3ZH`o*` zZBf{IfO6BV3f&5XIZ179iYqQooR~@fvka*ruen3wZmx~ilezW&%Y2@NhI)|x$}oJf&D#qs z3;?AqSFT~nl35~w9(VqbgLvzAW51h$A$v}4Bmr-J_CXAVM9s-|=f&kY1;wKb)IYmz$I%5b22?WJ>vt>iZ1=(m2o`esa9VB3Ev<94o#+x z{aokDV%>P9j8-R2VhtDeYx|SWso73b{eQK&HF>m(Up*51uV;;4u*g9Qvc{u30Qn6U zJ>|}0s!$Fva8%&9O5g+v$5uYov zn(*+Srv2KMA}+nT**>mx`){oLzufps65EaqHsS5wa9oQx#tZ;bf(szZpd8TII_HJo zJlx&qxkWT)lslfg-Cb-qygWzfT3cY+>z<28Xfo=wL5E;4MO+=uWK~rR#L*z*u%&b3 z#&7^!uS{oZ?U9TZHm`&aAIvOvN7H_+_!aT;J-OP8A0jmWMezQ+x&I%GK=Ta@>(NT< zBHA~1s8Qz5L};2E4;`;NBa952ct>Q$);CfGAS?`wJgd2r&!n&C6S7YO<{EsmEEGgY z6%1Xn9n`N?1AA6i1t_NBlT*v0XoTH%zB*IT)4vZyA`&@SY6Rp?5MAa7!+#lx`=C5X zBB7CUuQP2wK&t!=r2pJe_>_Uzhn|`RgmmYyXR$u%_xbHtVA<_K? zp%FX!KVR`*FW}#Am`L+yTju7-U+7QgZ{8tAeE*)Wv|5uE zJ^il+MWq7xMgV+@wAmLa>f!N7vr!eg@F8KOFM&}jgu`kfReqPRPj}?+xrqPR*?Z>)<}%g1jE@ ziy#qWH0y9Bzk!)~vb0a|I8{9dS3_hUq&uBFJ??3;)No|G< zjO2Xx7W>`;$)C)j8}$8TjN_f>z{kjmSHMvyL-38@^M6@D8jRs{Q*J#*kgI+Ff|QT? z`n;3M=SX|aQf&U;pQ*|4he@PvJkbj*nZJyLe0)czQYe~{NwXu#NZ!Vvy;Rwa;s4nS zP?68BpdLMZqlk%a`{Dc_QX62(R1^O(Qob)?KEY!zIOd1_0Gik$;8noxtv}kF*BRHf zFurJaC0dXKpPoQHpmpvOJ_(;oDwxInTfh%~3@3_h=q>u#vEM5cxM*YBBe1$W!}O}{LCIQ$Jfb13LlP8u7WvEcLu)Y;X! z&_GLDl^n!qE3@&R3vL7apWegEj^qNjou!1jVY?R-ueCedvwLi$Ak27fftvT+4hxo? z-N~+y!-EnP1ik5uO|s8HuQEFSR2KEVANR;$pA(~~L4@A*}}x!R1^56B;i9F z^uH9oTN!v+d)E1VflpRxz)*klY29TCHDjjwe;xQ=f4jl(&#N)qEB%vr|NEE!*3Mtk z5&*GGg1MebIyLG;Afwl1&ZYfZ5fd%Id~9jn-m0?BO9ZdpbNsDm|GS>Gz$e`v!EUy@ zei`Q$dNc1MX8rc<+n~tEM1s@E0>=@Ecwel%HbhfiK4xa!VI|e}Si3+``pSP1|4AcF zQR*n~Pye}mlfZYWTz#P$Q^nh40}joSy&2(s7c0P%j!4F#AL{ z{E$F`1#pCd^<`S)C1z+q&D$?eOD%3}+8*n$82N5%eMGyN27QQo^VM))ua1KM;MV}z zA+u$H=iApVHLV1H*d?>lan6w_C@8LbS&XVRrqSsI$bW3sw>a@tKqEAXFZ?A01M2>$ zPken|b(8K33;o+j<&H~z*R!FO990)`OfS}62SF$0 zGOm|IZSc#>2+DmFc?jfjIeP9ZyL7SB*e$nHMBjtVLg zWcnXR0oy#3v*ro>wwNcQ8a9L;fGf>r0I-$1#>S8UBGG3-K@onJqdAs8IP*w>XaBa9 zIxD}WaM8vlG=kKyc>`=6GD_rm$+A#yaVkCkXD?PE zf%2*nLuRV$C0|eLQ#ZIs6=1d>H&z_PE$m!Q{ytoX@|FsjvU5u>_=ia9;{_=xVSf_T zG{gjxWD)M1^w|y6I%-JsG}?oygKJV>{R7Gn(;7kZI2tMhyF6&(>0MSR!=!uhwVU?u5NGl`$1<&NTkR zet*H|A~TGP`vew*gXd#m+wjyr1JnX+(C1lj*iUW+)b_LKzJv z@b6>m{5B4JIPDrvUd>S|R_>4ItB^brBc`GnkzkACA0-PIXb76M>U zDahFY{$W&(hP!{sg`}ctxk(^88CH;la`f>U}T7)M9dQ*ES{&5qf9s=w+&F;CX3V~1z~%w zGR%^((!Pn5(FwliejWV_Z6bYqF1_ug^04xNTU0?_0fZnk`gM%MEBiN9h?O@=22o2j z%kxUb>oF;{;LpOZk)>RV-dR-&)FvLK6x&n2+)Tb`l#6zcoAR+3VBqeI`oo+Dc5(); zYe^rFeaLWX!H=yma97cM@fhI|_oo$3|8m)c6cKWkCX~I#TW=NAGc=>Gx_Y-)xkkxe zu7eYam=<)Ja4IOrJyxhcN^)GuaQrwKN}A|ILX{gubGYYl`Xyb6hv^`6&Vc_)?x68w zr@5t96AMMkI3!|-L|jIR!y+oepd)75^{!Z{p-i5VIV2^W5{WnO!}1sYo0>y@&=|Ji zliRuDb9z}TWQ6eVc)vf6&=S1rLb$`GQ%9}P=g(1OCenc2@b+Lj@IZD#ZXEIlGl{pf zmTtDWg8j?XiZKtSN<$kRcFi$DIOzd?tH?7ntZcKiR(DVD0m~mReeHl!P%rWuuD~1W zy0prEvza-{4TzI4BwKgoXs*>nfRrpJiopVNY5pgpamxa1y&_{+ZA?0;pua{w-`cUD zBeb(f4+#g0I9blTlH`OPez1gM%28q+8M*zuMomOK^-Rur`WVlQkt5^rF)wE1SrQC} z)O-TPwu9XJbA@p3xI4r0sbvC+#*1w?5tL}Rh=Bdi5nsF|M{LC`#~GhU5kLjMT6G>* z=yv;eh#oF4r#gdd-c>i}mNW0i)+YHaT)9xbsBwzV;bT!w;E)=iP1|_IOk$b%d3L{z zO`Cx8%!w?5un{49bLUgz;O+jxm=y@O196>N4&h$9Bwp^%2xi}Yt5RdWxv9Oqco3ee zpu=}#y`w8H^e3;CaCgro2+&*U509*Ill91yy6@xWqXdv}>8^Ym78gA9&T~w#x)Fy- zb1sl>9(-@t5);XzNq5N!$yv0;qo^wknq9S})sNdW$op`!GbA`<2%cdH99uO43!4QI zpGLzbvFK9+PLt4CPYsdh8?|D{x7@XTIbu;5_9ba{%TuXXvxM7 zrr!WhDaK=rNMEqM&9y{^$a0|prLC>)t3^S$Tf>OFUeOTSBa|!>Rb~j zWK~6h#}me4VNY0btr7-s!ZbfU1Bx^iTq?FAaWMw;7#GH$62iPx9l0>WzifZ1?VLY% zfnkcHD7cLplbn9ZC4e2&K@>J<&xJ8_*3zz_PDBzFhS9<&%-Ox2zdy{vjvI`}u`0$C z86oAape98;C$+9V)_5Dxu+OSoQpOL?%BH!N!N4A15JVr;A>U=syHwtWYNNmchQCvtpg_20xdMCO&RxDMfaHxE z2<;81((j8lZOVQoZ5BuECYXUKsxe1! zxc2(616wivk|?#{-JQ@hh+FO`PxonPg?cNoc1mPMWq(NxxfJC_8$xb*O(Y>mbDrg# zWw{XHkRh{BQ!0N6a<7cQTlof;k_m)QjDFe6Mu-QLRoxgi;zvfXY0HL=&8ZC2fs3w4su3C9uBbm;J z10YosT84?TgaQ$1@rzZXf7Ums1~bR)8LfEWxFtU3WuS~NwN#i^>Qif!wOG^7m8h{T zM@3~roMyEG=VJtT$N?@8=J8)H83NS!C?Dz12VF5jY#sTkN$OR_U1?n2#UUsGl&e9N zu?RjKPxh+I{Vf1;+If*XJhxKNjE-~ zms0=eYWho;4ot^@L&93ejW^gDrFK6SbNqqm1Ba z2;7>6sI%#M`l635)>kwR$(Rj%@>$*jWjMR~MmiTI>avx5kv$$a{8Smtcqc9dB5%h& zAL+Euyk}Ic>1YwQ_+uJ<1@zMd3rm6@Vl)E$fd(Xjn4Rfj?V9&w$vb;1y~6cD-l~+;-B$M-`(GYe_}-Wy1M5M z_ilG6xNuMPu}(ksz5{Hw>%(m{)Wp6jgZiJSJUPgfJvv~3P)l1WXkv_KCSSHjHN7aPlkvP~6bYTonMkT$oWv;L$; zYE<&^Au3kgonIQi8?1!`5{aWX%Olc!jqt7yxNdKd+QFGaw}<1K&zMPfL-sXZ#;k4l zOSq+Y%F|9L*w{YtRb_-;o~#j6l=>M#gVjb>>?kQM$cvtnjOVjh+|_}Z$C-AjI9~6U z4->$vaO%YFrpAU*oKsz$wTmf}YgA}^cg>~Ci~mh%C>0J03+zNFRXT8oyoRMFLJ6cT zvK0!X=PC{0zTWJGsIi&+{Ts3^uG((IdD2)!_?=%B zA!DG|XShhSUfymk5Wc2R?F)>N06J4D-0Uu5%m{*zoEUigV~Pt|IgRht` z{<3ze&$3?N?>aYznwb9SaMbyq0a*p8mBT?(pO&qapd8Qebk+yz+m%LK1rt-`ie;Up z4w0!g_JSgfGwo;VS=>9`u@|ag9v>uh4qlPuxK^TTHvcM;Ed+ z7F@;VFtD8s%klO{;1aXwsJ4uE)>!6 zyHSw_QPKiGXb%(;x0VdI2fV4HXGGh!0!b`@%(UmJ_wlo;&vjYq6x?4!pQJi7~*f&>vipSRx@XH8B?}g9Kq^8dv zT0C9%%bHBRJSphoD*3s#6fEZ}WoDu8{B$C!iAgw;m2NS(dD0c=flfa z6^5rQF!E>rHF>ow^{Y)Ojk5`2)6b4a59kXi79zJLKepyiuCa))K_n{aJW8Rfc-OA_ z&6hF(nnOG-Jj$mBK%g>#X^*9lqA^oVQ|G?(501IP9RBQSjPKVp#g$;$Z{nk9kNSDA z;xy@Q(zSjDc$R}cjdObz)r8lTO3$4YUP55pZf|*mC;V&L?egdMUhYtB+Lf=hbTYE> zrdX<6){)#Rq+llWg)g9HVMAW2ss7uV3-`#e@u61Qge>j69z;ht4cGa0P9DTbGgf-qawwDappK;iuar6wG0+^A* zaIBE@$QZ@K#@!m%OS>M9LHijIE)stlfj}}atA_#8ZC#%4i5O+zX;sa~#Y;2vraiUX zQe&DiV7?eB^DfE;g#rsqXihJ8Fz^CRLrv;d1f6V`1DyStc&-ROw- zIfiVYT5RfpN~R_e0W;99528a{?)|1wWFzvLY4lgBKz*h~PE|i4seVmd_FdIL079mA z?O~ilj-Go4~O+9!Xk~#Rp9JeBIGRoP;lOuMw9jmom+**&UFxYT7^L;)m!(< zb1SRB`1rr&JV&E_@|L+ob$2z=bnfqjy>HT&V|Lxp%%=*o?lL0rxx)Y+boLcMkv0<% z?(6;nn%L@eMnQ?DG2?WdTU{mU=;*i?&bR`kQ#Sz-ZZMG1{uuJ3F<!bA1v-n)|cE zsK7#bH!|1qu;OYBqJvX*KK}OH!%C`t3d%Rt{TaTOC(3+3Bu(2rOW?wlQY#K@?Yo|rP<=vwbk z+qo*ek4ww>To)4H<2@!oil|wnP^A*y-uOdr#~Hk&I>C3$03k(>2p&rAV4>Gw>i6B1 z4KTGbpVVT{s|@ZQg@Twqe@@D{fk6yPau@1A?iSCziFit1y1BC#QzsFht@!GQ6^Fj= z4jJ_nL;n;Xpl>y=nO-9#8UcoO6PArn?G~j_=Tny#W$yX>4%uxmNZ;QOMtJn~dUOz` zU3=M<@(M*`e0>1H%+EWA@4EFh1+HG|FBBag70ix!sSgUkezOA^u#*u)Jt!zC06)ig zMb{AFZEsnHEeaQ#7~#>dst(IrJ)n>TdVYIDvp%Th;~C=}Z!`*CePD+S=qA?inR=&h zXqP7^$>oH*AIVLTF&;zsB4m!%C~)fpkpb-+E%&!5#@v?T!ldtK zJCebjFEu_EN{pL58HGGLNzBbn`3NoQ%5>Ftk@+@ecZSYu0xt2DHLc}GzYr&{aAB;wLa zxJ^;oOJ|UuItFCD=#CA`cAq})eK+(4g$>-T0q))$YbEuN;EDa_ zR!#OOhMr&@K9xFr=Mbt(-^WQ52CWPxwvm?k5w^;4Dw^SrS7f`eK44d-!#JzVHGR;WBRWJlbwo%{dob8gPEDtQw@xbkbyY+(H}QEK z>G4gab243Li`OwQeF9H|c;AuF~*ZmVl3Pl(wxwj~I!e1(13(LVghDsIcW~pMw zkveBR3xZ+ruG+jNZny1~Tda&O!4MkplSTuOh zDU1r~pt~LnVQ4m5Iyh!kDD6iwdm*uuNpBO(|5+T-T;49m!(K|eDy73z&soH{o2DeS z@^GNSUAqFA$Q-j(G+7L_zQt!~8DfaaZKLoi2eoW6|G-wTo{<9lD1j>{j_ zschf(eg86jUH&Dott-#Ry1=z1R4T?7M$G3wFJdPc)4Nn2YZ^u)($EB2wW?eXkViv_ zPW#G|fuJVhyZ&3TH6P#CBTYErnodd*jT<3!UB?}$3tDFERtr<~Y5XWxEx*fkxCqVx z=+4cSszu!ystNEAX-DV>MLsKep7NUGr||cuP5~Y_m*M8qjVjNly$Dj&mh*?NYoS5p zJ@!Uy#k;1P0kt$WAA|aBmR)?&>5?P{<7sJ46w9e^`&V*o!eYJ%8*B{)BW%|xFOHm^ ziC|=7l`hcV)LB@5+nW`TiN{yE=x3@{N$#;7%CFt7_udH}R)Mm=W@VV{*8J#ENHiRa z$})qcinwSe7imVR_A|!Zo)TT@7@2TN4P2{vF+Db!H$Go5fS^?#vvC^EmWXw;>QQOA zS}Sw%u*!bdB7}ygE{>6FbK>=#&*QMCE>)@2pGs<(SVFlh(LpKG15#2c z#>&ZLT+|E7D4iu9ls}Y8(u)O6R~poc5irxYqhQgLb>;0WbGV<#!`tYiP$%M z(}E{KhdRzqzASpZZ|>Z8^oxoa<=Z?;Ys0VwGJ{$SDamhfF+isxx^q5yqzLQuq5gigm(xji&vP-8|Z4&u$^C+vYSVEWm9DnnM zKD3K0AU*$^o*f34OHrOpI;*hKdn@|pDI%sNp|D4jjmG zoUZK)!H1y{bJx?hr;D9HgS?wa$W}Hgpro5!%IdQI?kPy?Q!tN1#sQw_fL4ID}dGy=og9*~^$M3@S17xeCQQ5GN{*Q?nbmbtA zG_`R?jauz=Y(90?eNk5$fvo(eE&3Bzn*xgc z;n6!%W2_w?tJSZiGpZH8zJFBC^$2@U^iUtiq$Qc&+@7YEA(LD!i91`GU;N&wn54YE z{E)dh9Rafl_H^jflWN(zRg!SuHjf_$JBLWSq+~P9sn!1!4xfFNphC8HGWbasfA`00 zb=D0%Bg@U71Z3r2kFk8?EcKe@i;AHL2ZIf(CWEX_S5S0YY4=Kll5VnMho66oE33Xc zyqIbn%A0f=$xRA5PH}8)&wh%b58Uozc@dlbVpQTyH?`d_P@V8){o9?-mytXNvB*!W zg9sVxjueRlXg7qBqF3y)~_rzL z+ZbB2wnnv5TA`9Ux24@@%gh?Jk0em2#Q%Qz)*$x-`r|(vc>A_gUfbbtnm*hVGb6(z z^Ehk|=XHKAX&(`kZ&8CUy_JddX%p<{ABQS~ECtQ2E0w?alDRx_Mbx|ff z77@2&lYO6;THe*NYH7oL%qVRvrcIPL$0k!U@x~Iin ze*30~-6h%{MKC|P&WJ)rhx$zstiEAs(_nvITlQFyrlhjf5(!zNO?)vOMx2ywR@SC! z^@GpW^d*Gda|F{#yvnt@rbtul+LZs$`DD_oSKZqW$<=Ll=&qqMS%mSn3NP#?xV5IGF@%xcD%ynYd>!$?Q*Z5NQ3(a>BhU`Hy(Kx+YONv#O_`!OdmmZL zmD>lfIS)F%&gVa^7D`T5e2ZPb>f7TY4c3A)hQI@qc){Z zn4)a^Z#E}hol?fnjK#{I>k4bHb`dxinpVrKIqLRb1nz%t{mS>We`?&m{IQ++{>3@D z1_OxNkT=wu~e07BU%z} z`-EsplQhy@#F-ShiT~W;OvIqh7uJkL%aD7;(=A8#q_UJnMQxf@u)Ie3E-V zKN>5+vfwH=*Du+JrrHnEyp6#4hEDIUSBZzNi$)&>hQ4tn>;Z2%KA*H}vrbLdIS zF2pDDi|Ihcz+A1EveFPgub3a zK$H4<}>f?P1`mW2%))P`?j{p9wJ#x zW-GIhiWOlZ$9Y1`2^O^6RedUb`;<$)t3$FIKQc{VG_nk58GOTT)}EBmFBvpUxuz;F z!?ShHUjbq7{N^Dp%#kFyl1NkGwp7$+QBOQq=vzfjgP0O55I`U$UD29@Fi=kaAA4UJ z5Y@N7D~N(13`k21NJ>g5Js^#=Al;2LNO!BmfFPiBgLHREgLHQcNDMs;9d~oiz2~0e z?|1&6?#KIW12gQs*Lv4lZ#?hw82n;9t-&0jzL<2x81z@#ed*dOfZQuJf= zwuxiZ`Ha?5RS;^cE!6?g+ov+PR$0+EO>mwc+U3f=T);tCF3e0spikmggEeYOl<`RC z6xepViFTPM`Mf-g!}-zheOxV?MQ5Rc7bUvYhelp`_u&K}#_AtP=ffmT8&8cUxZj#u z$^+OWYxT-Rz0kai-n-|8;0E$cS( z^%6^^dpO%&pVuqVKMz@&_dNZ>GgnYWeeTkLQs#Q=f6eLiTh4tYn3&dlFo_-_=0?eB z@=?cQD;toQRoB+Zs(sw%K38q?Hd7LN3t)q;e>BX%-T&7-MXLG~n4_+$0)VHGBYb zE3u>T1KdcRX#zg11%}~7aITPEGZn-&<$5p6F+Ayy6*9#W)h?T$DvC5H0t7}IeG!U&VOEVZoZ^6t+&ZlBn@!F}@I zHrMLpv%T0G0bQ9+G#kuaEY->!ZBD7I&u7%xBwIw=i@bDG^5Y;LcOaZ{fVH7t1atTs zs_p8#6K0Rl#|6S4UGo>}pD|}m&IG>{z6kfyaE)WPZDfpBxeWBp${ZNgQ2f3$1?b0U zh{I?iUGp2hMo#JFAx)l~#oxHEvTR*%fgN2OC<0Hg*OL+lx65s{FF=%kU3T zsU_}r!>#!SSG!)I`C=zRD`_2(z+s%B1%a92tRhl`JhQB(ihq~4_vhGPu*lyzxVJ*6 zxMv5{ZTVP}eNKUrH?oX@A0L*vWMYn2VYOaAq^;jXd6t@=I1&TvTqR#dwP*~geIUzY ziIDygmMCR(ql;dTTganDN=y@oJQJJ^&i)Z<0QAYrLDgE~k(Nfg*9AVT1mRedQ0K2o zBF#ZxXvPAN=o^8~QYU-~pvO25CgrUg4lhHlN_~p;A*shV%j)MR(7Ly;g@*wg6y#gA zMRK@O4bcWcujS9O8Z49=we%#;y?vlM-R`nLuP*z*S+h(%*u0YT@h2qcJZj;BT$zm* zXASE}f-D;D1J!a*ExKt~QubX|*(mwKWE%E;2tFe_)z9EGDbpm%ku&Xi`|L9K70Dkf z3HWhT;ck~^iK3z<21plE08B#ZI#>OZfeokO3(}02s5;KAsGt5B90LJy+CZB+hu3nX zZta%-*JTW>*TsHXW%Z`JEu0(yXisR;=7xB<)cTHO`hPh~nR-u;XcPqpPVO<{pb$ga ziHqmhT3BXi*Hzs@<}f?J{eHg>@BPkow_4w|WF9DzB6J=bk@j}qpW?Y6>3kbWM^^oh zdHeU+L@G?=bEo+}Nsx&KTl?g-|4^1>Q!2fR;Q4sjpu3BTFm zEp2HvdKx$TH^wIwD)OV#9Af}C`Vh2~!Nz?_u&@N!phm2um-W*tp3&{|%|g9uQ6T>D z!fP!9-A1*IvWwT#O1FI19P|Blulntoy29Sc`(oxuF+*Zo#ehA@$UT0f_swQ?-{hZD zv+PEF7lqxof6ez+uIuRL`Z8NF6~YPdb3Rwe31`u7)&XdrjKNQXJR{QtB4H06UcSCF z^DPOg8=7j3Ha-;%RM~>FovKUjx~3Bs@9*=DzobxUqxexTmUT}rrBQ^lJ#DvV&7S|K z|BLd3_XKT}7Q!&@jnO|-VICh!=^%=O%FC1gNEi(IjJpe zxBW?Gh7-=Ntc#GGikAWo&u?n~O8k#iK9IaieV3+(0UKrHn#i+O-50wSn)m;3W*ii$ z6dvv&fec*-?EkD3<U?IH# zz!+HO8_vfFp|KfC5jyH3vy;wMNY1if`8k>{hE58ckg6qm3x(;5FBEpz?%tDDruAi( zR~@HpbR%`X3SWasug<&b-8M3?43VPRLsch{h}4RFP3IiBGPT&==O0g~Rl$M;Pd>sH zr`BRkDS@Y~#BWW+bvNRaDf&EwNX%2G|NB7pW9d4sND9E!I~ znQl;STZr9aBd2K}!Ay-^Y7(#o-3eRr!NR#rfM!ch*F7D}k&NJMKsmC%?;!NfMil5# zalbJUj-h|}R`I5-@tf&fanz1Lf)3gGCaq4xV1{$al8c6#H9reF&X3a#lOMBgox%k! zg>oyu-ewq>@eyqJ#QjwNuozC~e@yFlO=pexSo{En-! z_ZwGk8u>r$Dajg*irZ8@J^#%ombcvc^cAWK&~}QBA5G|@^bmD6yf4X~VrIQbQdyz77V$lzky&?8Xx5>0P5TuGjr8ue42TaM4!bX_n!}IkNVFL zR<##|jzfMH@AjC3bn;iJhwWmcdqDf`??k(-*MSeqJx^`%%kh6Dgrj|2qV| ziBSPq1Nj3~H>E0V@8*rSsrxr(9m*Cb!Xq6i*JVE|9?kZumPBE%zPwV}81;SlrwRUZ z@9nWbeO~Q#g41@y_f{$3EQ!Vwr{Z(5Mp;HIv-%*~`&%k%mYjHYecLTt)?K8-o4bc+ zph5AhkN+X%HDW0u5;DPgGxo#+nMCBlB8!?&o7P}6dor(D-EZ{oN5S2-eK=9r3 zO}%y`(0&MKUbt1$q0$hmjf{&^O8(S2cErcQFGu5VEOqaamo=3u(l@r%KT=UjpY}QPX{<-b{nS=(|TfG$YQwk&g?w208B6%(FMs;?F9L(~>OY_0 z&l~^$LAtY~|7U|V!$SG}|8N2Pzp|U3+D`|I-2^$44bd9eZ>M&=sxy(yCf7+k^Jr zT%(%+6j(UVAMIwOZS7;4Jd!XmLxW_Mw=)VWB|X80>xK^ zVCQvZt%1k;-^%6(XVKsJ6|y*ab5`AY{&s=dU*So|taFLu1pWF}u{qF^K(ei7@lmQC z>;CK4YbJ!4Cj|}IXlFiMZa{xJlX;R)2te&MunN5A^RXQHn1|R;6ND|+P{M#lir&7j z%-MiubsYPd6YmF&a>gZ~kGlux4Q9e3`W637; znmlW~gl&_?g)gn21Fii(B3*gSB_IU9J~kUsz=XB5n}tlo8=mLmUyB{=GSHc-e3>f2 z=d4eTJ^thljM5)R182zH;p7m5>F`p!+Iri}D0OG1qC04qoX>F@`_(81H1SuH=jnIQ z8t`jv(w4S?1Zs*zEe`r{5DNGyTB3a7tKN?#&9MMPOY;hl^;l~z)?H7#2$ZzP!6IUb zBG&h6TYctBC77AwDd7C&Wr4aZtV^Djo<3J+ZtrQukB}%7<;${eN+jTiZE6;nmLf=vyCt(O52^TsjvL*m zkkiIc8K6saV&kg)q`K2{zlmWiN1^KCt(KkREQIpt?95@Y?uV(YW`$XVb3aUFwA;eS z{!JeP5BsDXQA1TLEe`(?&Yp_-|qNN7Rn{|YBK|~waFX^ zljOn!<$$so11btRa~TNe=>}rEAJnJLo*J`DJ`KAqxN_`uYfs#Nf6INx>qDFJ;@f=L zihQWgkPtJtz}KBzovI6nKi=8atrNMQd^2CWv0d0nPdKHiL#8mEx1RjcGS72M{Gswq zh$NZQ^s{P-vKS^UqP_IFDQw4~xudM!=la6s=GfSY61l&$5-C9ITCAg1)ty_JeB9Gw zG4f2nH5u^9x0H1QoJH)1Vi=$h#v&3Q=`RLm^ncwUl7`XVdUaD0q}bJO(OZsYeF7Sb zhagetSc^nVUz!17mxtLgT5udNWS+&>b$6DIMlzfr_ReY)`BC@_w2GVf4E!`b+4Y;{ zn$M1yzr8RFNb=mPJG3o6&Hw6Vf|37#91U)8&m7IG$9^>xfBj@`zf=$qzftMmAjyB5 z{kieH3m%8woa1}Dt6q`jG}8J2)ZYpQLKNdS_v{$FZaSqcJ=z|u_!#KxHoBEjfY}>% z9QhExxY}(${QUMMp-r2})pd`>W|dNo`Z9uNk zz1#f(uB3x?oA2=FsWJTT9ztw|l57mBY$W^L;w9~40Plp!^`U9%Lxj``>2Bt&o54q8 z?i}1yJWvkhlY(}{8Fx80d)V`f$1CTJh(WG4GLW56b4D{Mm;G?si=pMSXK=ZX+AqL5 zFY~X=7KI6Ym`nJ+fD)zDSKlETBV=_DXne+fu43K z#B7yo76p-YvFYse5AXUvd>nftJn6Et@RgO284f|alq7`pCnAF?1=)RH6K$K7Gfu($w4{6Hwgr>MSU2o;4_H5cUD>ENlm>q_% zmhr3{7Ns=J_K@uluV{=IEX-Dw8+AHXL{{>$MmCn(7pm5kKO$Ye={0Ykc-bv9x^|UA zf6%_f1;j4yiNnpK(AsvZ$}7e| zH#9q8Ac%Zh^@h%q)N33LKjirwRLQV&y4KXjZo=2EkjgYs&0 z&X3-f8oZ`WB;?J}BSQR5`iKE^7evRJ!W@^UzpWvLmUT=dMG;V?X1Ag(hannH%?@kS+hL$&ix6p90zd_LNb`) zVg&$|OP9c_G;quHNg@!^Dd^t&TEn(8SEJqqy_MgdEV8;L<8urGdPy{y^1`Sz>@T&6 zWRS$pu%d*P+Z%2ATLiRD+hV*nn%jE1CrD%Ci-r&hxG<(W@>;=cFyT3!?AO?WaXS}a zF;4``unACVxs%Hw&puw=c@`s?QvHqYPE{r53BgXt?Fm*gw96&mTisF)jNjO^HhwgzAx@$aW|xx7>U)bsK-vy~%@3Uxc>{Z)&i zoR*_YoaTepGnu=QPha+30Qy+UPRdmhy7bqXI?Ivw+47aZs9pD_SYjA%GmBMo`l+v_ zO?UaLoV~}fe04?;ZAJZ~bh24x&7aVgMwWa8v?hx+t-xiS^#N%+*Oh%RA3+>AIw-8o zxCnAUo(p#9;K3Z^FDPDK$*JK2?6T-m`&wiVGheqMQqxg=9G$TZV(c@TC36I4Z|Qk+ zoxs-YZhzQGEK~J_we_M=z{5E2s{*80fF98y2Ad?IdjBEN$UH5DPAx9h zIuuRQmBS|JDO6f$wb)p9wGX#jJKwlWi48a2I*3P85JYWG&Ddye5p%oTL976N3#7*e;hVxTeq1Jww7oo z*((NuSOl!RQ?H7>W+F*(=pwx^*bU7?x;?M}tq>DZuiO}Ce~u(BfWrCBlj(@{+@b|f zcPb3SY}oPnkdT|>F{l|G&g-gdNNb^Le))W{-Sjdx`C0#|mmVc(1;Do(fL(1S%D+}S z^{@=JQ1XqIlTRXsjxEPb26r@F1e1#bcJ=WY`iuzmN9+ojG0KQvHi!g|xBS}hsdHS< zj;`NyJI{{)*{wE&^%~hlRvdp*(pb2w8b4Vy*HfI_utrAs9q@k4QI7)70qU|}lY9EU zH&kGut;O5=NBUN>Qa7c7O@Vg1+xp{OfoT4DDxeD_T~s7$+!gMBjOPK6MBDrzQc1@qdo_J~ zy5wu;(37cVl@8QuLLk@2V^Kc5?C)$O;klSK+nnd6iz?v6G|`Heg>g>lkS5PLuTo)M zepejtvlaA}L8Q-7@31U;6Tu!A?UO7sl_BVcgZw@v{A@FnVqHMGMa5`r{ zcXLkL4*QYr$kkC)GpUiT{9g1g_#F?asO!=K$Ks2L@7%|LZ0cN@`h#)%r;+T$`X3CX zI}O4R#>7NQOUNl*vY&@@?QyJ$V!)n)Gm+==M!LvIXf_Azb7q(aV5DUg{yH- zVGi4H-Yl@>WBM7+K{B9~sOro>UobOXN^>pwV9qYZM5QVPdtoL$Fnb`0k0$B&Ik3=H zcz@+Nm#ufY_qS(AV2Md!u4CmhZY#ffH!{(6Jt76}32H+fU_6)0)sPHBd<&Wg~UD(*GNY!b}L-47IDMJ1GiUKN;TB%=q z!Az-bU^aQ-VATFkEcVzbJx_UnVA?8f_^e(?uL+RGiXYHLyP`#B%{ex^48rDfG>Heu zyR>c>o?%b+pKeMKgT2xcwbFIpKi=D(R!;F+b*Pi|)(e!%?)$pdyXb8ar?u?v7tB?d zB?LfvW?6dXmRt(P1$Vh;TI^cR-FH2fyyHw^AraesYt-Js4gPgJZBp1^uLEk?b`M@n z5&@8c%(6IL+A4q+3Sn=#dVA-u*LP_=vCntv2;k;3?nq=<`eAz1&#qo|?R9%|KLC{S zg9fL{KE;X+6wrN7quhv3Yr4SpRe)vb==EwC`#La^9AWCm6t|^Wwi%O^{c$DSR=?jn z6tg^oAHx&|zQ3f2`Gu6~FVMp9nw2fmx_u)R6hDRTa0HOV_0(OILC}s-u7idQ$Q98+ zqyh7BA*npaVukyUDK6N-v(DS&c!UKK!KzLI0gY|~3>8|tKc5i4?lgAN3~)~_@-?F@r9mKpiMyU%f?&CFnnv-bDeM(USoOWN@w|1RL_ezF|NDOaKsW0S{iH zD0$rr`7+$ky>`PQzvR6bt^_4UF|N8Y`ZoVa;LLIP=qf^Qr$j;xJ7Q4e*5hw6W1@?Gg^=+z<>A)%Jsj z#_aRaA_T#pO`6y6M@gZA>^frO`A%`?5hqTBvmpr$Qr#%GJsOh9sXus^vSror*PDE$ zwiVCGXUVc}szN2gNng5O+xs3Nr)btEwe6}Peq*G$6R|+#s~xyWeDsWfNp)DJIA&Xd0r=Fe2Rxcmmo9ryiaU`WMwQa*TTmu7*|t+g4&|IA=c%0BgM z!#6zQZ*bNQsLzQ~l__lB973TFS96~Dgh+*xakAEzR^EzE{on-nAqU2>1aNSjv zokt(Ig%PUj7=q_zrLCnK8@lb7Y)=lstgSp1=q>5pp-lnQ2@Dz_-t@<)L6<+?DLx`b z)EkW*eP6F*csM2)sd5(!inVs~c!}(#c<#lid=O4K9x}n-6J&iUB#_oUl{3JmS}-Y4 z=q6Q#*3~^XtLs!1etCoLNk-$w!u#y%x}j>?*ip$JN9JoE;ZI0rAe}*7qS(@)-~L)q zKutk0(;91)0;RA|<63{}5KG+QVV!7jSkQyf9{xs_pzVRgSJSSjEQ&#Tk8V%jF{zJx z7+n^zrK;i%umqxmz8LN|W=b6E5UTS9Ih`4Hp`TGrc42O58O|RP&a~dMw3?7QT3uq; z483=&rYwAdO`#E!3DF>g-48j_p!_L_Ob6&z@DdgKL0#eZs9lkLbSpfT0jsrBAUukj zA7#7CUjF65VFXn-o|LJxfjuuCK;>@;=63oftV|EmUiTT5RISLBQCKfl_CgdsJ~fQE znYfkwT%T4B!Z_Jq(x0ugGzLBLN@iML;~7l))7=Dehl2j9pN48*cgwTeHroNIh=xNz zpgp2F<2u;e8aIOr^~id$TvNDteD>&dR#(KeFJA|yU>Pce_sr2qP7oS~uQv!QOVZFX za^?bR9aP4T43>iK)qdD|a&4hUcfOeknn-R(PFiRMneQX1g@E=JJ>6d>yC0O|A$HA+ zOY>s$ZmvIZg={=&=K&KkJ+>roSxZ`!IKzSK0mc z#MgjhDBxJE8W-)|QO~4S=;k(WF)%4LZg#&lBM1B`e1NnC$}yWd?~y%xdft4JE>(ke z`qpB~-Kg1mrkvB_z@Vs#;?bm3qn`uE-{f76(TVWO{jVZQbcAHVHu>lbH^*O>LiWe=4@?S6nFya-H} z{L_M=Rp6}q8D!qk9zb--`ulLdZNq!}@R5SNTZB+b+8|KU>|d@4olSgxp zV(-}CI!4(RM1G6#<80&iqO`=-UD0}fn9->b-p$=J^#qCT?8!SCI!&S-!H>m5WZI`5 zRrTH>eEHn#b1jfgeA9G+glT3oR71X4ofU$?sy4zt@&FBLtnNj)!Q}}>b<@R}Hzs5+ z@&SCH2F^9eD+Wewv?Us&5LmPXp$5Q4`btUqS?VY%pZoEi1vl;Jg?<+?I*3#>gpR9FUHCfm0KxP zG)ZB}3+^%$^!{h5VTl_lo+$txD-v?Kqrx2N5v|su=Y6g$oD;gdYfSm<@a?sq!6a{i zNe8t_KPL0~nNb$qrlQ%d?^_f|Lce+;IT3@63@jZ`8@nImwp9llMk9d5fg_w`PlStTU=ACC zL@dM&tG)26K!`Qg1iJ+xp1uN@j&nmg%{$U5tjRFCSp02%asCqp@E`f{ob&>SlnAn;z@-^; zo+xx~yTn&TyRd*wo_V`FxR8hNd60p(2gL#PLN=nwG2&t-MaU}d(+>@HrwPZ4P~LQ~ zG0@}``zu9YX!a+`a9rrSf+_e;G;+S&RQ7r19`iDod=7IqR6{@(-twc9@aRaEeJ0dQ z_ZZtU)pc)rYoaqT07m5O`&Hw>3DxeoS@}DR?{_XxOrVTQy`mEVAfsp0}gA0=8)r!uq?2 zLWb%cB$Y;anI4~~mQ4f(Q+!HS^Me@&b11sFMXZYmT%RM-g ze*VE_>wS<`96%V{2hcxc_cxtN^EvNE(a=i@$Eizu2;Bs&^(Hb{^F{o!K&QdXZ)sH9JA+u|=NeWak?(-IWZ#grV_1#X9T2oF($J&ciaM4`l z*YCN>X3ip&!Bt47A>=#wjw@^P%mew|c25K{T{JZ}wTvT!^$Ze%Jdo$nVJ2jL7i~4G z%bd*b%t=qIJI(S7)j31IJ$7i$u7#CH$F(SyRb8)WwBpA>!)ripNZE4c$2&otnPWq- zuRq?wI?qL4vARkYad~rWkJpp{a_+M6Y{~1Nf5(#r-jp=u2!=@mL4gUtOMeukW$b&@ z+l{JD9ttwt(Olp2SH7<&&z+aN573Emkm00K(M?Jf{L~7cfs`ZP{_66bsC3EPhPGdweyo zA?Si*pyyS_t6$Q9gDC#U;C88~+0`jO>O_A@_?lWrw6(SSnwn+^(Ah%5ih^OC63kdw zs`fZ>*uMiw!m3x|d1`S^c4msy8ku+8bn_kQdNZ2iPq(@+%guV9x+MB}C==OI=?vpc zVq58a+}JatP9Wj~VNC%=H0j74K2^6O3-8zNPq2{i=)r>jODnYkTrH)~#Ox^s+NI5%VtxQ{ilo4R;s9*ptscTVC2}BjAPA9| zr+02Dd&64LMrPy$tTJ2*c7w;IMv~ej0)x>SP?ErsOoL?4lbx~?dzzosIO@TAobXAVUAT;ikJ&L10vCOUr}B1Maz_#*NYL&PNG zEa{;isp@!Vive2e1h?sf83Wq5b6`8ZyZqHHpNDgxZs zTWVC&=Yw^GWv~uMC28c@@%J1l&qZPT!)1qN@+1!}6CWt_7yLY63$kyi*9G$?Re_4> zU0s$d2D&!^(i?4FDSPKl6j0D_`4ab%xw&IgJ2DkTM6E$e&vDRETKJdIz9<+*%QW51 z-vqL9XruaGkZ+szEO&mi{bLMqOpmRF;P7JM@|LX$y*F?f+nbIfx;P@6B$;(ZCLyil zXa~}!Bn>dWtXRvJH>b^T8W1GSh2$?ma;uCS6+%Yv70&+*7g{F4OFQ!lZ>`Y$dkEM6 zhERM1upp3cQ*7Omf0@&N%Qkm^yw|y5jFvL+*BAZ2Zfa|V`^!B3+q5c}0mui%-&OrU;p4v}Bw9J1i5#Aj_?uV!HCXw-zp>{8z)W78B@4#f z)$O4mSw;eW$s(}jiQ8s-^rC&_e|?M_?Yk$_13-cME0{1oMB8Zocuz`mp_>X5M)td9+&I%KhfNIlwJwO+$i4(FF2w zT2HE!VdUuHSkr)kckgqUGg?1#YfRg0D8*EUGF3@;(~5gVDE+GKq|p`{_z@Hj#>hLJ z)V7V=8q1j}?`GyOCeobb?7XI(bTP7Q3{RLxuXy~y8Z)H*+BNhfQe zkfT!ax9P_xC$7?mtDUAbU97tG;~ir_aY>^&=;Ak0y#A}-@@$0^Xlt~pAeQMJ6N_BK z*Q%+Fb?=#6J@6==*UVU^d{eQ(;uE?zZ%(Xd+Gm8IQfTnowHU=L@lQ`i0Z$dqzWpg~ z34U7HvkuV9_on&ZU$1NSE+Tz#wcHM((_i$eCNEj!wIgryLA(6zOfxu#uzWGlZ~xaC z>Azm;zz#69+X32k<3-vicul~p{D+1H$7FNXEm zX6zYKY-9vu0dSt_6D3OH$kZ0`1hG<~W5RUl=x1GMwh&-qEsdd{K5?)CngCUTXAUDI zu$fZBKmrzx;jV4cRKJ0i;g)@5e8 z&~jU#wIsj^2pf?KTBOCYsc7}Zv)eh}ULl5#03nBO6G*A|&jsyU@8xTkq)8FCW zj!x$6WOiq(;#9O*= zU7HS3>AQ(O|6#mPb1Y#fiBBcP`!^|{{ehnsQ1v(hwnD zb7UzGLq~T}1#XS8M#f_k+qeGa4ST4=Y&jGC#(gZoZ16KDyXqI zaUyg}vz@VqSkX_2@>!_b%`z`xSR0jPe|bn^1nF2;*YlRYXgX;8+$Z)fXwWj_01)7w zNIiaC;0oxZlo?%gr%IO@b(+AsA{^VDr(}TC#M)=(Vn1JO_g&=FdPW%g+od`7gzPiT zDk~Wp!h<1!eL?rFY~pOoF|4)if)XN)1hEfN_Wh39%b@>$9El{{6Xqq6bogMl{DdYp zsES40LSydX{dud};YV%9HHWYPAUu^5k&__(SlkmsBNZ;c@*8!s?au99Aw@mQ&rM+h z5;Nsje20n!J}sYHpn_MWsy|eFTM^%EuH4?7e$@f0w3-a;8ZVY~bXhcbmspCF2|G^H$fEFQ zB&89|s~fkTqvFnw%GJyUlhWh*a(hkVbsjsnMn}+?@ zg5tmYcK=O)e1kk$w!T}mP{J>m^9o-qD8$#ahBhQ>3lYa5IxT))yT2ymMCfGb?rDnX zU+*JQ?_D^ZH;x;|eMcQ?^!Z*(55Pticg2+TEY0U*(*diH&9-V-yW+~T;C2LVNx?*3 zzNkwf*o?L#FOPyiivxPo3gr@?Mco!AZ9@>SsN!lB2eT&D^cYqBND;PcMq(j(tfzTd zvMy_*No`+L=LeqxK!p3}T={MbqTMMn3%=H>JS4~>z3>O#2OJa-a%ME+9kx+)i5uMp zm-qSzZOwi2l=(W-(2KT{d#|5bo=Gh%hj2WbchUAdUk(Ii$z+B&dWPauKdyP6G6i3b zMN=R^jh-vEyWDKq7t5!>+7@l~`M@1;DpYh0dFqXP^~ESwwSFq*`}1vx7M%X&wXDsz zaFaNV)M2(8==w?gB;cE;5H$j)NbY)4*-73XQL1@cr?l8LE4Y9rS+XUB9AZe!*%iOgZWN)?1oM zh^{ap9)P>Ihyf0rver~_TP(Y}Lf=w%qf3zWr37T$TI;zHCdq8EqQ+^tHF=(8OfnQ^a$cu`li1G_$8JP`a_>%|Lyyn=WZvA6)Re zjeFu2hfo}xH~ab&>GljsYAm>Tk%%|i^p@$sb**J z;L}%RnB@(aTN~MFsPSZ}a|gfW-!q=sFwpnDmCqASp=4=yzuWhvKi^xhrIlb@7&R{X zQ1L?`V)0_60XW6J=xhlq;WTW-J*J@cyL`0Mz9@RF_loWqfu!&daleAp6mo}c0a@x`cz`qSMWj7YrI#s55!!`)+C=w)oOSHih9* z($Oj3(@s*=9$#{w$dfa_)mC?$m0Ga4&lYk600AD`F!No@C{XTm>0AJ;M+|Mx0F(bx zv^@rC0@@bO{FtiSV(4h&Ej^%9bDeW?yd@N2%ibCQm~~l;`X$QTPXL5vbEz!3U$F`J zcPhKsrI{mY@7=_i?+-?I|FSrb4CP&-SIB~8IJG00i^HIy_ab>qmNk;}04pgbBM&@~ zC(&7=pU_XrjNiIOJu>tnb-3w3@hJwH@H@?ma==@}EuHeONTh3A>rOh+OD|X*JHcH#NbNagd=Her$Pu4yFMi@!y z!W4i_EFl1AiwfBGqSf`?B^JqF46{)gBIkDf(X$pNY}U^Km%QlqvgJ0WefIb6?p*)< zh5BADMPVA6mUFef{0Fa4(M&Xu9<9L^KtNRpfd(#r7m{+(uYBI+Z$BiIYy#kE-xqlm zOtjd{xwN69DuYCguML*&gM_S&-Ix7sx54$9=e90kt2xBnUvIsU+4J_-&Zx>1=Nu2i z7Z5|=37L!ATeyNYi7$~c#k%#*xF7Cvc{oqu6N2{?M1Eb%OwOxEwP z)#++1!27E4q@b-(oCcRI77EoUTL9Pkb*LEh;7vT6G2-Sv79xqy*!qyUDXpdH+GbQn zH|g=MSMBjOvbIwIoxT0}BVLrHR|j}Q0K7*gelXc)4tV_r#iC7tH=YYAfXa^14E2qh z4}0qD^KF?tHfZ;N2waU7X`CKbL^@Bqd_PD3G1#_wz6=QWZ}-*cPfDrUt5RBSBfS&i zrl+55GgF$m>t`bG+oa2bfb7~=f&E&cD=OCX@<&x0NO6VCb;Tchv|})F{rR1{1ly!Z zrOToRob~(-Sm_zsSRf*f66m97IC&W)25yQP`)Y?Aal~`W#mlvm9nrxF?EsC^Ms`ULSl#K zpW0JdS(&PO`)q6^PFPh+YmH;9PAab5@dfR~hQVS`q-Spt%z~U4A1?c23>BBsdkyd9 zi?aozFYUZ#ukKHTm`4jgH7`L|0fpj#zcdIel0p=Lx-Te4?-dC#U#c>^>oO>`%XO;> zEu0gF{NpvRdu6k`Pg3R`v;|IId_Q1Aao^LiYu!CiMc)p<7B)2=uZFGA+6k0-;LBpE z6C`|!0~b=?NQ79p2f9CzRb*k+K>r;RL+t(qljQ!55P*3bfYHEZ6fWC1Kds;WRmy(x z(s^_EbrVmc3^=3%;)l^$C-wNZ{Cf!BuGH^O^LAxI9;wgf!dMc&9~+R`p-<)R+BHak zH!14|MVmWj#lG(g_+G!10n>ULzVl3ObMb;`c|Te|ZS0j-+~$Y8oXT57-)~XG-;T+> zL;Knv;ik<+WHz!<_pMTefo`$MPKvD;>L+dtQ65K6wIg}vsp54!@^#$^*!AYc359u= zT;^;p3>*6gL`ef!#NUFZbjB1O%+u2|WwK)Q3r(!LR$yY=uPc|E$l#kP6ORI$-BTh1 zW%Mh`mXiy(;Run#>B6b6VLZjn(`e}ZJwZL6b3*?K!XWE2KU<(vLc=Sh$15;08;Hm0 zU0Ml0hAnK00U?!1$H(ZC549FaSmBAb^_r|{+7bi$1!}D40490IIL!VM1#XL0yW^%| zr`4JhRqcNR0Mmu7S@*7Mw|^A;s>f=s8PNy5d_Nhhe*YW~R6|cm>9t8+HLjHjUn%AI zpiXTO>W`LzcVLsLR>U>2-5lSFls)aHtg>k^%#^GiAZ8+f+bx_jkHap_D*5rl5RQw* z?CAY&Pa)s=jMf-E5%;#HeY?E`w0zE;y&A8dX}oe=gm*{i4N(eZ$xan-8#l+A_Q$iQ zdY=(s-K6y*(BX$SR5-*7%cauZ9iXSYN-1OL7HuEa4*4PHYxtMb7C=u5E~_Sz*Xe!L z_A4lued8RDI0;%EUfY9Ph;FHY(*hFRWARo8vLxJ}mi+tYfJ)@x3jxJb zZf1g>FjGZY#*%K>%IYSE@lIyG9yIsd@vX|xzK!H>sNAXPnyfA9P?+W0b#Jo!D#Fl* z{b`X|qP6-Cp&wXi(BO|YKIJ{$NL}?{JNdv4>+jh^q!5K8wx7s~rC4l1T#{n!iAF$;%EcAYS%Hw*x|BDlx=b8Plj+Y?OgM{7nMvAPK{wed@sEyNDD!TXj5;#gdrH``vtcaVYgfFt+`WoOUIk@$;KM88DjmeItKIk zru&c8fd$PDcg_s&c0cdPX|~hxI_z|TuDC1fn+Ub7FE_@^SZuoodLK7lU$!urr!I&L z3Z3d$4Z(mcZ(}Z9WjMOmG){nNlib=k9OE~#wx=cz)v-fVVK(uF5#dTB1#9;sf0S5mMXzw7IEz%wC1ZyU!AM(%tRg(z=hJors`* zgBGDGt+R{Xq3D#zSKf>L4`Bh`m^tV$@5Qmq33Wu}Si7+lf51j}WBj8*Pkjg9M0UF! zB=smhrk;N3jX}~-rk6cLYYwn8#ZCT2_?z9AOno$Hm$)-7);M=L=cI5Tg7SJi$%Iqx zli{bK4MepE*cGnmTe$D9&7LsOo|=ar;U+8N5YyLD z{-o7MeWS1f4Wv+dJw8tM2_WB+0fOG2t2Bj5hS8YJ@ykBz&W5tVWZ!yrar!Btj*L)s z05(03x7e+W&eDXteDbiwh=%3Be+Gj#I z<{Hcj1zG9=Jff?HVf9dv8v{R2aN`M_sJ6M}XK>rj43~V8RAMxWw@#(Ke?1fbQJK;K zU!mH23w*ZlVftw|urm5@4xfWI-T=$CS4u5V{KCfl9#BDf(Bv4=K!Yl4DF@q{!~w*B zvP4vD?UcjcjtJ=h^-~|XMw+mP!SccEO^VX(1-}5{&T2=Et}<*Cgod5HYk-f3P#now zTiIjyqB{*ZA$|W-)3fb4+-bkpCS)m*hsK2v7dZ}FuY1I87v!!xNKONPj&$&%9Xr&t zFmyRV8I-^)Yt2Q83yn&$neI3E?DB&C0O8}NKPlQ(tXgt&31Fv%g*Mj05 z%cxyaMYWqLJblb5>g2_Z@zuY{58obmOn5Y<>|Pvh(aFXo1UGc2xB6%gm0dolMhQ2! zOA33nCbpE3>=bBYwpRaIfY)|^p`n}7-uTJ_NYC#+fl0Io;h5StcW6grFyiYlq<}6} z4!lAeN$l(wq~atfD}y1+R}b2sqLI@yfu@P(k@&Mm&LQqQcFeHB5ynu?Xq59NX!IOS zpW?`V`_5;lg;ka)aJNEuH%!UyU^Gd@>afXU?9a_!0#4iVlux=ot(+ip^_%#(Jg z4dlk)Yi;p`itgh8!fkO8eTN<3Oz12jE!~kD4(&mhR$eIQmPoCg8dppOTXLHdr!FRd7I5+j=c6$Pj>jB1sMt~++_!`i@NLQx`xC!L2tB8)ufHr`imlaaCReM1 zC{n)We-ZZ8K~YBkyHc`Z%vL&;?AAGwy_|-3P zaLe5D57jEy@U}`!L9xc`9a9mGGkw1EUE`mptrAwO$4&bm8{u7D2Ykm(`uGK0OU~I1 zRlh&TUGD0GbMY9}-d``x&n~66iTwlsV3~ub&28-i^2z5#uh#k}XQ0@-T=Vp8K(1G| zHN8K)9P;LyOdI;A6HU~xEnxqKZejI&+T*rMgg>;&e~BL%Di)L^b!pTb2@U2X^?I-= zP|eQepKfmK%x@&rIB6}LR>66G5T)7OZjRd*mqZarN>)!2YdVF|){osRg=t!5?m{o_GrVZ=Nl`{`uo z+as~OHT%6tdwM8@%(6044d zj)&6NC69zhaH*oV@vkdLX8ui)=jXjY)g++0xIZj_*-ApI|JFAv( zJ)WrEjlv?~jy@KU`Kgt5-_2_@9Q)^9YM1YW&Ic7o-6ZQIY+LFDnez*en!Npx*xcXL zkh|~~wK9hQ9|Djzyk-Mg!r%$zV3!+!-n~&JClqhn@17~R0HoR1Sj5)d`lyGKi@qH2 z$M4==zHGVguzIx;zgE_A_Z5&z{V3PQmmfnp`h9{$fUu0QQ&ehkwlzScbDDHm1`p7h zwlE2>6s@O#l7n!84W8$E!Oj5A2ivf9Ab02?0bJi-KByJvZ}g^%p6w%{ zL-0ut+H5iBg+9lcl{L#gm(^Ij5t#?n6Yp=hnfw1)tLW|0Dw``vF_>u>JQAFrJzJg$G5q0eJNH8?e+uUOFV|Hn$W5_OwNsF?Z6DgYD;N+xL zv(YTa?V9vktEYz@>Qx*m*9n#lyj&N0)DF^5XLYH(7_%U`2SGJKSWGQ&xrAL&5@x~m zFtx3a{Hg}+Le+Ejd76q6J)%yVW8p1t0p8Ke(a;utlQdgjuA31odHDjVRSexp@eIZLIO(y5U}q6%Ycs-NG418v6|nEa(I6*K z*aOHn&4_4;-O`=UBh)w&8bW%{g7zo972p|m_%X9=`9EpH<-7WEs6|~l5wmp^36V_`gGzZ+ zTCGiZ`L}cF48ftLh%N_472W%GB1gdN0OJ^9eGAW5(3g6?<|&J}(0(`5c-&I-QtS3Y zc!Br!MQDr<#b~oSMN58Ty#xyV5Mno236Zj;M>yp z#n~o3++o?<7q!D`mYY~R(9UR|qfjd}cY}~4b057Nq?K(n9HUzJy;SdrNp}JIbw>1I z|3=W&!|}JnhrcuV(K9P@yMijs;uy^dsf@~;tglmR5NjI zwV6yV)Sd4h(gB6QN*%?oN89ZPk_Dml=~vDRHa&-#8D39)dXt4@Ib4;Q-bgR~F7)QO z3&7{{V;#4muKE@(^5RT67M@3`Jedu~Qs z{$|SI4kXstkgWmoH*k%`1h3zzw-hsXq;ZA|O%B8ygLYR!Ig>kJ{bGypd&yTr!^f&k z1shuXAEET3K@x4YfR-u@C81esu&7PP;qe3pR(ZWE)6BS!Dpm5V0&%S(xw~19WF%pz zSZXQ*H1r?`;H)DxK@>4M#I^jEkn?~<-`6nJ3L9AQX^Wh?!*-#?T&K{3eQ7IBQ92{F z zH;jYIRxKiTj|l4BP}@a^nY}ZMRSRJhH6q$>-(QDc{Nt^cf5?LbF26&hQUJ04=HqS; z#KKK{1CSOGxdMg;P~mR^~K-Juytxr zyU8TF22~3LU!LC)%~_m%|7RFLi}P zPV^(rh50;-<%Oxf=Ux5I?2DyU*D8m#J#! z2<`J{yMU93)$SfCIr2w%Yr~?Km-BMBWA?HZ$Rn>9`+~9{LHluL&e6w_*RhE{2b|16 z@+kgnG!$|Off^PQ;W{ypSg>18j@}f$hb%q)$bY?PH?lY_$W68kv}Fmm{(!|q>c6Xh zdIZ5qZHUj;*`O1~>7KlU@8-Wn#YWB$_@YL*y^mxMTkoeY8`W=1goe4($@_gYarLZ= z)WTDY>+4;oaJC;k$47)(33=*2Y_oIoEmdqU*bQSAh^22fAI&-1Y^Ps#V}*_IG z_)GumKOZ(GwTec9_vqhMk>gT_5e$2PxM!T3H5=^FR#ie*=KWr&LJ!O>$d7tdQD*4R z4u#5vE&|i-$~7rh9_(hR6a6Ap8SP1QQo3!3_D5>n4(wzIIbKB~4RE9GBasyK%n$TB z=ws}H?>yHrW&%f0gS-GbQzmVOGlhG^`QvzG$)lDt`JkK!TA*6(PeWn_yzScF{WoDG z+vp2+s|!93-pt?1aHF<*2#Jp`5kmfY0HlP~^_p`S3&}qE{UyfS_9{%MwrK}{?>CoK zDdYMB!d0ZemC4ObB(iobP`sT{V%!(pwLsT>e&h)C7A?<$GH5RvnOE(q1?wsuf0$sb z!hcBceh&S6S9I0yzN~>7CK`z|yK92Fab{7Zm-n@!a8&kqmAp@|(N% z8iJ0UvFzurV#Pc+1{nyJA0VPtOqoFy$_%~GDDbhb%cxy&x9i=nzsW*(NKrMMm#t_0 z+c87)cHG}my=qDml%zSD;I5r_lv{QfqO?@fx88zrKPGC&4}kWYD7u{7apqb z7~Lc0$h;zwEijh~^d%1MRtAXakCfG{pKXwdy{F!I`xMf$e&gjqjQB;l0*WI+WVKS- zs`^ZCpKOA183p?^R%-AUVo?FZJkBEggB(*UE6!J?u-=`;Qd?u9Jv4d)FI})~Jp93j z%9!vn%b_0uaEtQHB4ooLGLPnAyf+);?QkUHTpWuNbIY!rbCcdi8G1X;#ki{3r9_d; z%!)Qut@SoM2liRy?uf~^G%7W% zgy+DG6+w3KO_!Nt}DPjMe|_!b9N|NEY` zVeRrbV@@@=S}b-oK4W8bR1}O8o>85U44wL@iKNCo3P$(DvbaOYEH#O3R~8f$Q@npM z2Dd1)TcWIwE<~1Mxg-kt~uS7ui%>!z&mJp`tZVBIl%Mz5o{XjYhXV2 zHG^kl4K#+A3;8so?G#STz97T~eUM<^jC_k>emna8d1Hii%zl5WD)8t@XP;%Rbwud7 zI5l?c%YcZ7B`sl6C3lWOft~6BcK94#vUYd*Qgh@FMn}X^uF^N*n(P~>RTN8T?g=Ye0T6bYa?3{wL=}eFb zZz<0|rYRktQL+c*^`7 zgSP8g)dTSyAAN>m6-i??5vr=CP0U0N^kyX-k)skHDrn<(VUx;ti;9XBfpXWR0xD{1P-x4Kpuj`1wwSi+k^OIh;x4o9zC9dhSI-Uv6h~RbcSvkum z$eHKsqB<=!)b7SFbCb0C2_Vl-_pW3DJFp1`Tj_w0Kk?{w!_ViAm~w|4xz6K-yR7J^ z=mYCt49%_CmL_aT)|E~a#}sqRzYvfn!<$B#n6NQyw_YU+Jq|tVzD9Cd3axy{xNh6- zf)?m+cf-?&`o5Oom#M*$&B6PQNtBBxw_{^R?lG>hY5!hPsoCcCTc#XQffKD%L5qgF zQ0DLVrT{t4L0W&N9gQ}fD!J-5H;G+mNv=}hP5Pa|;GYp2|92zDN%n3gjK}B4hSHr- z-t|qk5&jYfE#b3DnB)AOCDI-E@xYoO1JqL&{PNIlr1j6S8$ir>l5_>oEPLZmr8eFD z3z@L?xt`Uod%Z$peg-L6vgP1JH-dHL)kBKO$VV>YD3{+uY59R^hQ`7VE$*MIQ^dFl ztESzou@Op-3}D_aXoUMsvE+_vR4i^9j**Wvb8{tz%J8=Y=ww?~f%Z>U@ce1gxO7%jMaD4O<74-CFcBpWCZ+7AMgnWzvf+NWxFdER*tg$Bf|~4xtBx zasFRIpv1bYc{@Bm1HX+ZSePgJcQCsyP@`<0HXcU1)J}XXv3UA$t7REMXGi78|7mt> zrOJ>t^nJdG7hJ6ct@5&H^VKmXuxpg}Q;2CZqDTK0VaTnS}Edvn@^grH%f1ofpXSgyc|8z2oz*v;7Z&AYZ!D9}2ZO z^Q$V-4;JVRr?{8c^)l$+R^&>}&qkEm9>LsSghaTO>MWd3GErf-dU^m0Zz`(GaNNqz zCHm!A^sDyRYLFEo?UlE4J_-jc&8*nBaURijr#!$wbHhI8F{SkJZu+PJ(XE~c#qb`Y!Y7n>9%}-L;{OS z&4~i}iCKf3M&o8w-EJsEPr0dJu5RW>UxFnpKiVLeB8xF(zrK9zNmEpEd!dcg6ppaq*iURJChk&FL`w}LA zUcJoxf#~=Zos1;Ymxm9buSs|vl+w-pm%l;pV(^~|6weGGqSdQNpZ^5O`>|Km=)Utt znlI;qlXO}tB=7HXQd!dQOV-Bnj?>IcRNr79eo{4uD`%7lOen)y(HY|-pLZ3t6D_)C zerAX!b+5H)QT);+Vw|sILDBt8IGMJ&yx@|{z!dTUd#n(Hfr0~X73*+vhiO;tsv?A_ ziEi^Y6fev2wi_AE;GyV8Swg*XoDxthBMxUUWoH=r>XRbvf1j$%3NGjye^$bs766varqQ@&%%oX1yxGDSl*0YYhsA z7YLDfn2-*#*K;a+f=A%G`L#6GFAplMwX9^$aJ>QhdIq`Ax;8y?ngJ*lN_)Z9om><` z^t>O{yhQ3eH*02sO>>Xv9(t<33YbcO5@Yq{CTNCO^-*Y?4i-h1O!C|gn-dwnTqxpv zvuYLKIB0!FXeifHQBSUnmB2%pGqE{A65TsCCK%cFyu7uw=ooyhdTZJ!>4VzDz&Q7Q zzDG=7S%!k_qDaH#u&Du44Rde`aD%hvAkaH~$7VEim(#|VC}?)PAl+c7!j%w^AUXGU zO2BcJYc@wVHT=Q_gVP^o8PXFDn;sM)CtFi zeDBpE7&EDh1>s4OqSLQUXiyzDmvNe~Bz0%c=OX_(zsq}K=}?qbDfGR8(3p6gWY$cp zfx^eNAyr+DB*`8uv#6MJ(N2plc|YU(IQ!Zp@H=(&-9njvUhJT=;)sMIc~#3D%-)oe z<7iM;;(EESMtB$@d%>}mJ_{1cw8d_Ss?a>0c1APPNLQS=zc^d<7vBg*LiOXylbwi! z0GUo%x- zA6n0cP^^Saw9#alE6@f@&jZS5a4Uuw^K0_rHjGN%_9Z4CHRL3dC~b0R!I+@jbc!dL zWO6_eYjnoVZ}71_QE5sQM(k1Y_!3@70ExjVz^Zu<*_Lle7_ZTJikrH7Z3%K3isU9H zt@~8nn{TxTAkk4>nF|-X$m^Ai{5rMlmZESm4$saC=aWzOn3)iRx`Kr7T6Q8S$G1nVl6r9Iw{nIxL^>^^m( za(7sc`!Im@lK*^C+aq{X`E4!2Jyxx1S5qOI5jju&bduUi<^jsw%;>^cI~~07cf{pG z8q}74X~JjVjp%tIhLw;Ll7(yL(#=F7)Jj6t!_D_8?yft4=a2|PCdl5%i<2)F)gjEY zjgRyitJM8!*O-uE7`9NhWptM+#^vSw)=EP<(fjNz$H$nL?gg;`!?qv_Ii(by>nVcw zY3#Mdd}&FTfIwmqk;iq=r`|K;8?Lv)G|ypRtCm~w9fsss@kyjzVH3rW-x$q-fnD1k z&>!a(RZz4wHCIBG0XdB_cu{xmL&-L+rv!5;>iWfV3pv8cVls(=ZqGWq+!uOaaT_D?{^kZPp}H zXVZqA>X*MqYc6P<4z-JpL>MsLzU$C%%YHvbJ3rTl&_3c>NkvU3ee9@PSziC9mJBXI zRl#^wEzOyQawGBV@jD@XLg+>8=LQ=$gQs6cS4d#N93TBN%VX8jgHGPV3pV?}H=f;) z7SPkX_1BaOSiITMk=A$so5KMvidU2Yv=?X7?46zWc8ytm)E_>8p{`>umjU}%wx*c% z*L)w&LZsL!jP@7~O>;hp_KguPROmrF}%))rhfuAX02WBzN+%~;9oR?dS z6-qsh@;JDsW4ro+b+|>PD%oZc4AR0*7g1V19(GoCLT5elqTqX*e_iLbG7UiJX|Wgk z^Rx@kZKA)ONRw|@bl%qDpWQ!RFB^3;b}(CxF7N0wn6N}>y3TG6OkwC^$7EN(P}OoV z{{2fuAmP4ZJa-<#ky?@voZt{a$C;aHZuflv>2Tr>$cZj>jBHhS(&QB~b+V1SLMZE4 z;+WPB&(J18kkGjlBh$Wj~ya>Hy}(^CMfb!+c0?ABycKO!XSHP@T|{Ym@Yo!9axM zk1UxalF3;3>H2y^kCj3ReXCOIlY_|aSbwO3C8_f!&c`e}sTQ46h?4cNXpmcy_?Td! zNXDdCGA8#ohFMP)Cc>wy;;t-^MhSX9@H@BM7kv+u??j4_*G}p(^DxKwSu2dPMxeVl z`XWgEV1Aiw_(B^?Y(l^-J!Oz)lR?GL6kjBF+CFjtPy}d1*wUmbL{r*>M#yeMUs>`& zW}p7>1!t@AIJs4T6O@0|7@`cAzvdAmPO=TAr{P&fYhxy}>QOWW`Cey$Wmkt+H;hEa^o|W%^HZ$kqE0@@-S}r zd4L^kJFblv6a|${14lUx z4`6RmJSP|HVI!EDhEhV4g+J&8h@-o3fx9zM;_13I@TbsJLp%vGOG~GI9+G;gjCI8P zn#o|!adbw~drA*5Mjwq#$}YLFA9?uwQ6pE=2e^VZOEhh7w*WE)mVVE}?eZ=hf#yV) zxZqn&$U!drD@;XWK;pEgYnk2Crd!N87IRAutKXZ;!|iUq%q+$5`l}pE8cw7DC-hCE zsO`EF*bu=tV*DewMucN090~gg?6Um}-)}b=s`qg>lu1xosCtFxb(v{wZisTFOnEsX z*zeBlT=+#e#C z=Dr;=bg{W4n&7EA86F=@e>fcE(jlz3<&Q*RlSf>=X`?S5vYSz@6J>EWiQ>n}oLm|v z4Ek8RPuTn3J`Eea9ypC7$ff!a>${>+y!g@H2k7jDsvB zY;C&9?dJ8dSS-}B@a7T(bgrkLbspNFnnp7CsWs}J_6$BTbJ_(l5!MPZJ*f7O%wZEY zVyz!2R;C;Pw%bEZLfkhcn)g=?+<~(%oXI~g$`0C<=O?8?+E6puj2vH)7-#WPU>Zuc zC|d{aP{#EP>a2)+5Tx^qCJ9ttKVXk*#~e%fC9UA7Fk>rGt4+AGWU}}h4aleNZt>H>dUEP>pIxJU?AKigLitE|?I&SBRP8rcz6V*K z#^22Lv=rXS(t>wSm9q^!o#jO0;yJ%)hi~J_30?YqEN2s1*O@hV=5~S?{Cq+cgt*_> zPx-(Vt8mp8DSOgFql zuaIL5tWTH!B&CJ4^(fzBK$Mfw;~@R0*0@5_9r5K%A(f}FS$!7wmt<1XxLx#xTjXhn z^`A1@^SE?h{HxO6r7p4~J$c4=R;lUBe25Wkdx4*xW@J7LbnBQiMU0n^CVp9i{bhIO zj{p#0Zp2LjgsmA9)LBQ@?qLN=iQNxd9(Tk<)7n;#H+QoHM8E6oe)1&~hz6z?LLyrkA7xP7MFTN^eA(;8)2MFN>#$r;&hkejw_aC$ zGimJ1>ar~AmkbwaKI<=<6c~==?FDb@q#Wu#3s4ceX$bNBe)|4sQf2!F6N*8|KG|pJ z`!c-a=5$?@w!)(>Gzq-=-I}MDCYFrAFFk*L_gB?E;(=n-HHEeXLx4*lG4zVE#{?Qyt zZqKo%KmfV^Wlp#;l55t=4=k%(PZpC&u$9NV1<)M2O4dm>RZ7W zeGwC#-4$cVsXH0%`RCiw9G~RSawW`gblcGwV8`@DFLCZqredD`+;0q_fV*rEw7*Gq z2L+PDeBI`d(5XT4<$Z&FM|3*4jWCm{2_@6{YLuYJnDEYsYbh&fMfC!wuk|;~1&yYf zrjT7uG`W)k<+2tAYmI!!rOCPA#fbs#S6E)HiL&k2`!NX;lD(O-GQ_{+<1J+4BE9&E zKxEJ>lVrSF49fglNoLU$oYesh>|)~iZEjqR4v04{Vtx`_oIazTAP;9#AA5e-{lt^L z@mp_K|RB)r4}?1G>~B4jk?3nWBBx%rQ!?;LzJ#vEM72?~2KY&{lo1Wn6Pu#Cg$7A#d^o~K~ zdpM0F#$R1#e}@0bXc3-g4LPl`2z(Abp4+#Q&m?@D=pHQGmwb-1X$y+B zV^jTJaRZ_s;TL62NJHKa?u+yIYt=`t@;lN2Enk7LDctS;sLF}k3_kml?IJgYHl#lL zykosGoHSgxoRsTGgusi=crM`YNR0}B>#CbcbrIl~V0bcw;!}#J7Uj}nJuRQNQL6QT zD9|GWge315gnM}Ixb>wTjw;Tw6kO&;$>%Ih=@T#yhk%{rFKD5HVCnmw-qpcK$F6ZI zwqu;9S8x(q$0SlHK{eV^8Vs51rdK#pkL?orE?K%+rTOUNRiIUai_ct0GXM*UBvKka z;1P|_Thul)Kpp!haS&ON`I4w^z9XLmLLBoyzRQ%9Yt&P~X(u|?Ft5QRh*{=ZdmSgX z*!jTqhG>EFY0Yz7k~Z|@&%noytgKoi|G^mzF>|&CXq(mlmNi;zPF-duqEU7Gq5qvbe ze1xl%=x+r6LMEn*hp=YmBr65}?eh)u-pmqx_gTj_9`@4Q5?felUHr2%%kCr%qz-Xs zhQc>HrJ6sihu!YvD?A3Xrut~pa`@Z{*%v61ls@{@wfo9WUsIqvua`Bc-Sh0KwDjU! zc}cMjV`VrA=o`kYplTr*91z1>wRhed(TRr>mY{!}-FnSAP3mTzVLfY@i07=G?#O$b zR2{`7i&~-vTUubDHnc#Tco!DWVg$;usHiWP98nrd4q~n?5Z@*#Z)}19eyuZu6z^}C z%c@TUe)+YNvL^4;O{5QIoWzj;9-D%5v?4Cu=JZ_dtKLM&k&HQ*`+cbhu_j6GH?HY} zjHE8?v9-c^sg)Yf&R2iAE=W+ocwH_K<0Th`)>69l@bJe$2P`9P+T$R_z}J{^LXU9= z?8Ow@e$^PhIg9dwLDxe-D8;uwmIsd`Dy(^O%cCXxW4s9m)rx?c~JTVIrFXO}qc z4;nKD+iPQ81`e!8J@5U%g16ssf94C(7t#C|5)htnSX-m<^=+AjEi zngf~XKj!%dPr$-Y;=J8sI4wG9YWRK8)G73df;+34Dj45}N2pO?u}U*M`}v}NCJ2Xj zhepM-$0D+!$95t*oyjgScunH2uE?}t%SLGLV;}ZXFqNMsm+6y_d5$N9S zd}lPE2tD&gz17)gf1V9uUzKUt@Br-h8oKHVn?n1%I4QJ=1A4QBFZVdUi=xiQ#=-jE zZR3+}VJZuIh*q2RK5McQhC@$9s&)tJLHc0I53RbNiap=6@3p7i}$YI)WG(Pf|8$`orDq)|R2 zHD6&9X}v*|$psgkT}xJ14G%prKKRU*!crUp($MSYyy|V~y&ymyhg8<0=hzXZ6$`TECUkEjJ~>{kSoCtR)Xww>MCyw>nInaDAp zbu8nGN9veh_|G>a7Ed-rI?~yUr=Ge_7>&GGeqFZ|0_o^xktSS{R-Mqg%^~6Eb&jBfI*6Htn!_E zDNjA?Ddb;~ZGrW^=46&e)58Erg4Me&skR5=FZ%j6n%RncsW(LhrF9g?>qwV?R!=`B z0u9?o_m9NdDK}l2mGxau^+!@fOnoCa%%?yt(EM55z&2mGOl!-RjNmE58OonPbvWMn z0rNTQ25(b4l|2N<$nbA$I2ghyK{6%A5m#Yh8pl|CYcsTEW$A8B%*a3Xr6(Xi`gS|S zYV}nkVdNTAw?p*GySMptrKS4qdC+lqM*Zy6LZ}@hoh+x9T~*QFSa;6rcpI5Bak3A3 zO>Zh>&&XI010xSVWZ^z6xgCdeo2nHN33Z4nWz4P_+f96N5fZ!Y(T%-!527>>4$^@v zaV^>_Ceh8;R`jW9^d|(GTXvT*3!%q0CD35fQ2TD;v)EIfGSLAA0d>K$}x&Juo;adOM@6!+5{wWCSmd`C7xX{szm_aH3z@ z%mbw3xW}_4q2i(%e^TZ4jsBF~G=biv{56IpeI!oDz z42X*MsM~&JwmP^xzB0Q2^2LxnXVcX?u)4m@+WX(JYm(UjWyI#|Ko5s&C2LS-~Iqf4Fkn0AJ}9k@ZM*I4(e z4Ryl&De77$i1-g{F8vk7oj1s144bF)>{emvYbvu+L&(u8dBy@^bAcpvFN|J ziOUNiAt@Jus5a|2j@s{@;Y@vOx5VdCxngj*kY~iPR1E29h?LEoBcz9;w({%pI0cCm z5|>n>+rql>LMi~i>0Ex+@n_HYeWAaOnc`#7X+$wkQz?TLGs@C-k~!PzH~bhbZm#Qc!m06&x2Pq^6xyz4ZV??0?<@ z@`6|<)5WT{y+PYq8f0x*wg62*`KOliwN-`K(^|j|b;b?@&;jSjv0!^Z*gnGbsDR-3X<8 z`u^{x`0ak;>dfwQBG{P{|T$aBa4ng|j^lt}N7FTs8zCIb4# zz-p(k3J`z6KxiEXaNxCn2LvG8JT)G(IUc?;qz!R^zELybzW%RS1h@zPP~!jNgUTk> z`--iqc&tO?9X}jd5Rfm32{_ihZaiu*%P%)Vso74wqsM)UX-$G#>LYHqZuse%f6gXP zbJS1yL43FD5h-J?{o$h~(I0_&PSM@+bCv&0(|@MnA7=8u{nyqn@@KLGNa(^+8~yq0 z5?=l0a?Y%br0{#e8@)zZ*K%J_f)~Ktao}pd1gNXI(5zrzvbhfsgcDzlsN_gVn`4a= z4UHWB)c?%L|MuShE|33wpu8g}PVL5A^{W|UUPp%4V}Wd0)7e)QAb;rwfaiadhY6`Q z0c=rYIPei29scMrpwoa4^!Rh2*{2et4d=srMOgDUPwJ&Q`aVYVY)R5-yd0B7%5rj^ zTeB#I0kW$zh64%yR;`bm=1r&F1FLGz($^0Ek0Jg?{fG~4dxf4c#O{YC5r{#QD`MbR z2$CUZPf7f!Nx0>-d;?sk1dr}7AxmcjlpvUIlwe`j}?td$%YbQtuzU(Lcgg6t&x zTy4K(qh&q6eSLR%h*R3MmyFn944WvIU3+^EL-+RT3c*Fk)#$N_c?fa+NM~vKVAu7b zpTx`WM%&}^$Ie25qVq!^ttgNt!Ir#^m%)mQ+M3mW^z?rl$p0QsZbWK9>rwdc7vM}S z24=u9)b<7lGk^`s83h2oss6yF!Urg)@pXZP;7%G2RE)a_{_x-yU?5>MDdt(`*a_WD z3?);SKqyODfVx#PW7EUgfZAu++ld)~n5WcU5l@nOTFYF)Jk``fp?ZBn3VRR(zQadZSK&5I}z*3DO_%)M5pc zbgad|FI@G<*OJ%00F+=H2Vn$k9YEN~#fpfz@NxBoY^K>vDUW|{axdM3zK{H1BtP|B zJ!l_TP^U+qR(xT=SY>>eJ+{Tl20Bk;p`QpDPl2o*F`2JA#za1lKu*2xjX;Q}yf=q? z3-$yKpxMJe+%|keV}NUr4H(!TX3SImmBe0t$4w)H+4JGYPv!d# z8+}odF+{<={Opc`JWLF}gK}RzsmIe1z4jy){SF}TCP!qk`FfVtet(*g{{!M_S!+7J z>*ZdFDWxrI@s{fwnrEBwOq;q*i0mr;tQ_vmOqASn2`w*93pyu9j%NtnQKidDl0 z;>oQ)CmT3&LFErK(LB2w;;Ta=g^@vbwGB9EeJx z$yGJ-uku^=dOFW2mqy;lvHJZk-R-KrT(}0K$xXV+0H6P-2G^K?9 zzlQPL=I>R2u>Z}D3AAO^yqRz^IU$Eqoh1Zl8yMAr)I;3B?F=u$rpK%KOxZMA$#1+k{*F&30bzNZ6V z4z5;0AbadJ5m2c_I3XkAP7kaOo$0%$zF3gQX8gKXzI*8_f2QUGR$O9AYa@jjK8jy5*p{8n^ zfsg?8&tD#eum!Wzq_tKgQxU{{puOAj%wnH>D7HWTIwrn95+~19&TKtw;z&lu~oY z!OG*@&zPSl`0SO$%=;^4rRIl~{5ciV2fB&dw{+=o2D17!;-32lrDBvN$7v1<;mWaw zS_C6Sh3^?|ZLLJ!-{#$oSYbI-w^leLRm)+mV;>t2 z-Z(BgD037kI88JZ28TeIj5y2h-GM?EMVh(OhT&+>8imNDG^xQ^f<4XYEe<6X;kwC! zUOMvE$M|#x3Uhx;oJ_lYAPe*Qyj8iK!H8PR`AL<7S~w}-a^D|V0JLR(=#(Og>_mQo zc=^>xc6{%bVrt2!kpqSDpy&HYvobE)r^Y487Nq`mexfGaLnU$k#J%zhiM1*6V4Rv? zaI+%pk7FJQ6dY)ORJ_ZkEAVha`MoVn6`ife=8wrw#hD!cA+zd@cGMvQ>fk`KI@ime ztNs9aQ1N5sdvZ%6tELK9N*%AO`fawO1TW{}=Ha>iL{8^*3@*P|Szc9?k!t$tE+FN} z`=pl=OrIfSNWK}T_|m@w3b3k)0DV^k{~8EeaAeB3h|S~V-|h3h7Bs4?EbdhUK8!g# zi#%VD(f`qv%W!US$iVfp-lMW+$lTJpcQZZZKIArPDJ0IK>l+iVqp82Om<^QG7SC^n({`=>#*iTc`0zw8x@Le zu>okXT7R6Eh}P^)v7Odch#?$VAoe$7Z+&cQ@R;Y+vuY6KmL1F_gZsAPvft zyr=~_)4zk?UxsQP1J3vb%_if8%B{i(jOczdQ`BB?O>yg%U=uDtFz?!*aIzf2$woM= ztl|0lr&ieqwNt=6KKoVFK6;sPh6iWr$K(sRo}j~yDcyTZz?BlTk}*;T#-5<4Yd;<_ z^!iDZB8C0;khF2sXT*%)ej_dQ(^yUo)B6)O}@Y3A=u9F zj5s%k^lp4mjfmMg&yE!Q)_8Id^&X80b8hjIG}bJlj^u=*>H+&&m~TwXrIaI;%?KjfOkMLFUswxvV=SJhAD1AtjF7Uk)Hcw1#<$awLJF*79FA5W~rcG2YbI*|!E@hOFjSTB8aBJcI z4~)Y(DEgw?#b~77xqcRU4PMEyz~4hMKf%I*=+$7_jBl~zZb8%h&@P+f$x|JcvQwy@ zF#pro&eK&&*`A=2I5-8FP~!!Y!>eD{9e{p|f6zrQ#R7-nXzb+2n(_j#S6Ns!e@?il_e`20pB zH|+jz^ks|3aQXposWzKJob?ZiYiI81%FDmS-h2dW0m}1sQlS;s4S8j5_#40*fSCA^ zAgRpWy-IL>?;c?^m|1}ge9n5tLbu`m?Sz0%Bm=|^qHMC3yqy?4L8pMzKx z$9+L15VsiUI7+T;MEa3nXoCHk-^;Pm^3W6rkh`9yf%f?DJI( zSscmv-(CRZj*4M?FJPm#N>idooT zhclNFh?F?WlD5vJ?^rz$xrD`GMuFllYn}V*B-4N`J7t>Z#77G#R$6%M*^qEckA7Xy zN@$DWT4sdp;&D;ShtY}d__gX;ZSv!mon`(o6xY|MeX_lFfI|pgw)YbPtEa;E&C!2U zVFToemxC{*nKY17yM~f*a#?B@KY>3eBuVTNpbW87A`599B3y*$wFBY2TAbU3AI#_i z#!xx&(r#f|*@pQFKMNYGQx;d<`>4`87YtJ2UIJxNA@B}8faCdQzS8lOOelk9RNU&;F_ej z@@#PNP=K@)Si0b<#o}BtBac|JVCWZQ>)Jo$o*ge&)`1%_6%>?I((DZNROZy#=!d(_ z{4h0XBDS?{e1MfLIWH7wu?_{>nwwDXEWLSPE;i!#U{!$gvuq>*cVUy^GSCSaE2`g( zz6SS?W)L^xaS}gg<`lU+-5mN3LdTtfJ5<-DxLz9SQ|E8l#5FNLJ1z$uCt@2uvJ0@! zkGyCrt#Xpleyinfp835s5F@W5FwOmsyJpJ^rqTfYGxzIsmrw0Wr;ejoJ84`(K+?J} zH?+xSoBV~!wpQ)3yH@gBQ##R8)tB13@hzQ#c$_V_(eU#7S6_JV(JjAwI^)>)h|Bea z6`plIDQEw>jN3jNdZ13)K#t0mA1y4?Z+XV ztqCE8^?0oFQHCO668wu1hhSLmD3t10snSHNplt?ubbkFus#Gu}+~u&9`b6C@{qK#p z>z(KwrcyAWneCiW|89|45tsu(2wI(wA|!IF&jU`jkJbL?xn_qf6WX@&^Cp}ZuWG@j zvEbQDDlYL4G?j`&y|^S}HSV^Lg`Lw?mb$V1U^?pLF;06E#6JJ19lV{W7i^*A+ehyu za>e`t&rG8CwP>y~|m?7B}Wy9KRz(IW2ISeSf=JMGU5iyDF6S(P_#C5Ehh9Y<~w ztxBs|a&E*d>2lM+evmNy33<3(YqV{};8U!Vbi=j1f34)LKkKgiN^|7z^%QBA~ioJ0(xL9CNSdy(6BmRN3ZH2qHV8s#T%dMTa;3(u5h)z*RT`cTW5a_X)xM&OH@H3+A5Q( zHk0$YhxFG3F`u*7fb3|%5{{9emdFI!_!GOHyGv5R?VdhmOW zK}OPI@*IVR7{TQP4En^g#Gpe%3h!f$HiLHbNug6}ObprSKh~7SZ|C?nxc7dA<0tNL z81@d#O=?tC-4?>Qnuzq~oRo8ArV-r&6qKd2r`dWGV>$Re^GC<0eZqxQY)An0r?IB(eMtqDCQ>Eg#!yBr*XDiH!nM?BB=IM1==_IC=X z6q^B#v}hQRoCtz_0DP%xj+p_h2=JHLekz3EJZDZ*sZIX=ef_d6%>9k<#QI8E_@L;M zTu-hJ9!1kSe-8-Z24M3LZ1+($rw-l?nT4^`pnaJsekm2qe*2umR*E8t^+A4R%eLR( z`oiGn9{|}+QDn6A!}{|vx$4=B>s)n}wc3G7S&uf>1Bs(PZn9W1J6yxreq42rD?X&* z@iVqm$tT+4Z=%r6=HIYlOxc^t&jbbiApT0n@cUCa2<5rf98tXEVxML0>9ep|BSH{# zD?WfTW;w+T!>tN5!7#KLdZj<%2eNLga{FZ!j}8Ua@>OWhecmUvzkmsN0q0@-ca=4j zfJs|a(gzieE@@hb&bS+>ZU)+%WFMCIGuY!Zg=km8RIxjhq}F}Ntzo6{Ool#TasS4D zfhhqIqA{bVNo*%_U=*H}&;sxzPP7*9Vg$$K4f(TZt$rDk&uh}mTWmTNf!oFpW85qP!LmrT_)&Fq~wJ?PGI z;5{FK-Pw=+&04^XyYwFj_YFgM<#EhzablNq?*qtg%gX6^-KcbpIP8kf{S23gDx59aHAy z$n76*^fSF+%86F=E!+Erl0-Fb@V(y54m1J&n#egP5POz4|IKFH7r$_yxx3cg4*Ruz z%aUo=&cO87&acGKG^4_~I)gHq5SMU_v~Ew!%9-B)`MyQ$O5B_5<3?MP!EPdqIpJiG z2Pb89MgM8u5(wBda?{xV1#fw+dl#Pcz!M&cU#DtsM40_MF&wFGm8>D$y-zm5OdB() z28{ZBt76p5rFcZ6YxCI>y<_>K<&5y2&;5=DFLtl^bd!)2_*AqW(6IiZJJmc-(PXYN z5ZJtn9{DWRHA9pz0kBto-dVbQpXyW2wvVIxQ9=6L>Q~E0Y9wM8Zbx~Fez-pkyOL1ly1KI!D1Gi4rx=oIQk zk9_I0Z}rpKr^QErc{$-y7}{H0yZn;EbrqrA)$w&16)uqbdZO!bl>0cvvsO1@I|udt zeyQv~{TI1o&Vdlk#7e&2f9S$j)Gkp3Uv0*%IRGlaj5Udd)n~1+?<>D!b_$=n0OP`r zmjV}GCx>~l?gqX;I?Jc}+veCpeMh2|p)iGaU0BXjz5dYA(Z5C{&0f@Y1N~Hp4?Dzdz9u>J>ThNNvBe{3vp# z3|)RRPjv=7sCVny;NdrwZ(*f55gt&mLGpFfRZ;|Q99yw|IUXE?`@Wvd+-kgsPzc2g-BZ%SSJ--1vZ%LX|(}`O9 z;_Ax;8bKGd(U$v$W6Y-GhJ&suDA$kjpVCno7Oasd$v|3%*<*W-d8G+7Xiv7PcGPG{ zhwfrjDk9Zij2`F3!8VJX&?9_<6SACjCH|Cy)5>twE;dExP<(XSbit$dODYm`_G4q7 z?!2|jk4s?!so8`jGQGi{zyie@ocqMOFI-Q3GS>mskvymCFc>;*q85C)Gn7Gd63ELL zc{MWR*RHkTGsR&jqInbUbmkFrn=h|Tb99)Xri)#j`(Qh7CaZ(?JGxe-ZGZTG4Q=9I z_|`k_$XwMOY-DhhUnCz`COC& znJLig(S$H)sC_Djp_B|bGNB)!n`c@mc~{1Je%*JhakjO=r&suJb>yLK0R%P`pn_Z} zuK+8G-1i>x8#>+(R|QUz=q|vn=axCBE01^ix0Fm(>n8)mx6?UiiSJA{KBk2c-;rbIQMVYq@GUEP9?qEy-kUf<19*Kn(5zR~SaJu1(%n*t>86IZN zOleMuVDtCf*-6>8Th)A2=l z@^7mM1$&eEdt4iz!&M%J5Axn?sXeeZopwxZ_DAh{m1NH9dVGO{VyVdoWFYUz7IiPg z$nbts!DK?lG&F>6ca6LV5CXtq5z|xd2cPAd0lesTC;`5T9^xZ7eG{#~fcNHr%ea;U z2F%F5=u&SgFP=6&-X7%KFYz#|AD4R!P9C4b8HULFOe1gfNKb z#gicxjZWpFjjAXLU&VtjF8sgtt4D#j-Oi0dCiPC%793`uawt3wIgVB~<6Jl{f&8ww zw(Bu`cxE|JvTt84oOPj9)fyz+9)wZDNLIPMf>qthcxY2%ih@U15%%Jf}K|a~8@;u+V2?n+NA%I{g+uE`x z;D5;ZA;gD`wnGMMaMWWSdhIlu3;5T?pd0d?C4aTicC4S&g;^}U<8dBJjwkz2v^GM@ zK|RSz6b1t}9f*cwBP`BxUWt6qU-Q@qoqup&RIjtsmpM$!H=?3diJD5S*>IUWg2yR> zXH4;)Tg+?-IkK5}eL^KG)7zKb1685-6gJbIoWa#on&ub7Ir8H!5ukp`A-x>t7++>} zxvpRfd-mbrXfm$nm_%8J?Jd@+ybQNkU2r>CnSQ~=sEA_b-pVSC3ICMse1*s-pk+>t zlp32^E+ddI@^S<870P{jA%Z~Fyn#F~dcHPuos|EgbB z3twBM!_Xi}v@M<~hQ*iPD0>mKH%HbAjcp4KdNAGS#!K>GVU*%4@awLu@w3x)2nwj0 zef?_z^dH7VmOq-&iVH(!M1o{d-r%NuE&X7Zbd?yvo~l|+BVgrHq;DkNP!X$Z4fmmX zC_Q$TP{ItHK=P@xbAmYJpgE%%yayoGa^@igbPRznjbD?<7=iS(IQ_a8KTlvuI zITT@eXmeJ#PI19o%OCz1p~OHWqwFa`u!)4K&aQc~{TF>plQzlv7Rbu3Y8T&8gt0c2A{R6(^q(#TR z*ImL;&Ex}pX`~cmGpPzkUnF(Yk^A>6sL5kDAF9SF2cwocpRfgTULSFvf16vA_J8P# zWPN`liAH2${aMy6B%11Q%3z0mBb|6ZD$f!j&BFQ(iS7-5h?Q7pHgRCyU-+01C`nog zXJ4fQ5>Sg(&Yu&g>f)XHPX=O7BRQkD`X#ejEEk0w^3F%~mgz@eNwoUXA4FnjjMr?G zy|0436TsIOd?N(qvkm#ixklx}q*UuSsf2~{=J;IX}U5r`_EdW#S(an=ALD* z+FLA4HhgYERi0x_uxyb~-Xh$&Uy%d{UZ(07m>qqI(-D{|L~H1HGmgBdv9Iml8A`KV zK;gLxo<5$cVel+FvQ9a-lx<{E&xcDpF+!X2(>Om2qeKVvM34s2yl>R<7f<;G43Cw0 zn#Y6lG3C4cv39h^2rBU0q&M(?wzNAZP6^nUMQ(ubQ{qIPnv}3DnRY3HG-RzS^L8-e zQ4X_#f=Jq<=Uf2e7zhhAWEHn`yQx{=ZatC#MJ=#yH3`J6i86$s;_2 zYuXiPZv|m(99TXAtaj}%&Z7i&DQ^?Ym5Rn^5en<#tAirO@sd%9Uh(X8VLqIF2B8-B zVWMDsUH=pS53w+1re1_h(62xaig4FEokIBqK-%-a}U9AI2d? z6y9;XZs+~<1?C(b*7e4}#gc=3*H#!0QJ^;)b5R44XE{y=L#`Um8(#zcoYmZp2J|m~$LOCjT=l#3If@u1(O@5IX_f2@ z)E|iNty)p6yVF>xjv-8fp)=euw4LGS&!C12Qe~NGb%L1X^SL7pHK|2%-UTm{OQbhFsM7l!5 zM1Q0#mC3OyZ>*Siol79o|R(0qal^1><{%RuvG{uG?Kjoo~?NMAv*Gh)Tv5-Oi%N-h!}p!_PcZC z8xE4ad7Dzzle{hwsE9QF6KLo*F%rY9ExXh_sCN5flT$V#pkp))X6s~XIra{6tyDCe za7aRw%lOwxB)KQJPR;kyFUkSgo^tddoRns(c2hw3VIZpk&XeXmYg3pf^F@q;+p>pC zN}Wz2Xv8vf)iE3GSo5$duA(Ep>x-K2WX9lH4#GKSSTy#9IGQDg;8|)imk)0A-WUHW zI_+B~MoQz-a{ZQO>ke-7ngq1SbDSx848a6>xR}2^uv;~UZ*C}l{vZxdY&?k}mY&R> zXg$rdVbRgXTlU50Rl<8|`zb$?`9;o=F^zTxjkwj}sJJTqs-CZvb8Ef?vxy7;($_2tO6CKvw*0Wx zd99)5LQM2w1yVJuqPkcM{KG)-ldOEqX3&$Yo#Fy(4_4zG+8q@PtWx^Ata)x#a#dB4z{3D@?lw{&#?5iZf~<3-L&)N^po2O1oU>85` zxJeL`!c)d|wLPe+Sl!c@;NhNjOS|QWcW}aa(g_$GRDMpzz!;E8iC-Xa#1+zg>%_ft zAplh)d}#P^>(o;A!_%ieW|w8hY-PI2ON+np)9j2i-m{di|DZ+<&?dM zNilEOoDwo#7&0PVaFPAAGQ>snBK0#;3r?Z!<82`kDN)@)fhNVr1iYf@@bRk_bgX5% z`MDfk5fPQ!pL#av6tN)W#;l;lu1jW@PR7Nr9^FkD%{I+5*?Q~W8 zu909@dO2PS+X>0}09?vFwjz>YGYN*OT(jvBTVskEG|4M_9$Bm;W_5|7h{i>iTr)6p z{B}q6+{U+$ZG+;79N!Dq@U5{Qki+ycul2#*_nJDd!ZqlT8aAhK$*JGeU7*^mN!RjU z0)hW)~K{y+F5RJa#m!Rz)Bvf$9^|I*-yZa@|57%;$wFtYN75}`u&<7)IFZt({ED4Gy^XKpf#f9d;H{-xj8TE*k*kCXwXDsEem>j;WlSi z`gY6f^a7J=DlFta|D3z1fb?+F5JV&vI-L+OTjq9O*ZUk2j{4mdJ6haK*0YRTFntq` z6xtPnzBUp|8^*(YZ1!2ptuE9&(hj<3`ui*Q4|;f|(lZS(Gph}=d$c0WfCM?^t9DgJ z#E;121kcwLBm|NP#8(4;cim4ZXCAS7@jNyB91l;2SpE3P5wXp|o7jpMF%ibr@}66+ zRvTLdIet!tC!2<>A7mUnsQfuylOlN3ARPT?(PJB$_59(R;4qDJ=s7Hu<;;Cz z<0sp0^F}v){wCaZ5~D4tgLvL&<&Hj0a%rw%H3?BhX|9@wURo{f>9BaksuK{`(F+$S zAIWx=EzLT9(zzxug<&!jk0tW^mMz2*reeEA0~fXI|2_*gpdr=TJ`H5f3@7azdB?@k zLO{mHExwF%whp5WPwbp_?L9lpK%!#7se8=}CZM;SpQvcDGfV!Lg*VGkO1O4oq)hv>inaEq`bD+iu(FmPIXmVQ5qwr74A@n_>bo-|}~lZ&#hG_FNQeM{21>G5eW4*QQWbH89> zx5%wX$~`?c8SZl0JC@1ElSaPQC1n_jn_=UXh?RydRmznTiQhMYnO7{kNKogYTV11j zgYv*@UZc6-`9ise-$76R(SH^p9!H81(Bor91zGGZi-DP6M@(&s$%%Db|ul`k%3g7>b6bor#aTLlxDucI*NYMw4t(7=nPd*jhIfO6NcJA zyA$2w`qu$qqpf>Z#=XvD-9K;xSj2JF>5+I1m~7!dQY@?0?gvV$04Bp!HZW z(~Nf2GHsQa4kfJGbh*B~#_G_wK>j-*?I04EW2f+A|03!+aJr1zfA*y(LI}ZF$VN$Z zzekRuos{CEw!kYc3M6#X%f`b;b~(F2UT`9vZ4YSq5+pW|cB%O}RnLYjuEq4IZh>QI ztE_KOTnI22gt!m+2<+uf4$Z38boDC^r7n^6Uhc*?74704jorvpWp%68R_Kcr1|)xN zkcaXceve>7+acbGj6netP!teCu}>rlX^@BP1z(+3YoF>PSPrs~28H0$z12HsphE|Z?q=`#sIc)R~$nEFQs;KuC?m0lO{xidG-v#kbK8NG~aPgNq|6f#4nGhdK zaMH^g5S(V5Ucg zMZo#E`EgEg@pc$%(+8^xg-M*<()UC&cXMEb?6;s=6O80COoX{nox%xC-{MvJ4A<{a zH%URDgS%E4=IyvTnq|X$Nt%Ch<*sOL#cMUD#PgHo2ykf)#bqo$>kDFa=HFuPWdF8X za9cj=Y<}2_jpyqS+b5_sC$AELV>Q68arm5Ou1RXhTIg}=scZY#d=1FTo`^bk>S{SL zH}E5z6tyahvL^vX7<3_5Glh&W5vDz^y;CuqZr5zA2)CeS%_Cx|G!f1!{Nib-!NnZ+ zX&cirg19#KH$#eKGto*csN<-r{%L_kC&yAl;I={Sod;fC7D~FjB|&x~+5R6yzc|Hr zACGo;af|g&c{>z}wn&?_s?6|?Tb^RHK7O(5TjD7Ee=QSqa zx2dHPY8>Vr9f;x-{<6uC-z+IpC&3TP0DkNL&S2fJ9S5VM9k8KGwXXRAec!WuM#18O zF{|tC$BNv=8{QZa4T}eUNh@pXD;{4 zw>)~j#SX}0cQT~@kw=r#3myM8n?BD&A!ddq&d(9Xf*pgxj?SNcds&~hjShU| zZWOsFs_de;&KYaf(<`rR4mp=L1R_YppW*LQEF8>L1-kZ--|g>2k+2+Dk0QESWHn_D z{1niPtqB`TMe(=MiJGaYj!QPI2N=wNQwr7q5;i}(5Ny|Q?Ki7*AOK;TJxOFqxlvY4 z-H|N_Ho-eC*4AZNr*%-talo$iFfZ*qFMKv{3h~Seh_M>H=UCZ}ys^j@7hB(DsUh`G zbR_t;!YrDQ$S+6UkLhURPodG`?%NF@6DTCQQgY0mMsc~XuDk|Kj;hBO0VxUx>FyeX z+!&LbHkoFzb4p&W+DydF@ay4-7a(AG5pJu|+xv2pg<^75k%GY`oc1{RkYSHsD%ICj z@1D|7%$MWW0tY7@_w4Pm)x|KUamBl`cQo=nFAGL6sXpfxU&@8QJ}k?Apv(gAZ2~>* z^*b1UL2WkYc4qd*r)$H85aMts=ZqKrE|-$WJV)Dcs%}SV%oM}MDgeVzLdG?r*<`y6 zN2e&}K}oyE&kpA%ZCyvhNrd0^i6vx5`L{pk*_mBrhTfaxA#zCva+oWJH>93N%6glO zU$e%f6Tu>l+xO-S9h(ekZIImbIA?$)@DnGEse$QZ+&>#pABn6kX#64X3Ebu1j<{Nw zgyWX2c#V1)ygOlbV_PoXK+MZ(!`c`5DjJPM`PY)d$!Yt7o9|LB0? zU;6T#E5x!HUwVT{@Moc%?N#W9BAGO!zQE|#=NTx-?4*cE{MAXOw_d7fXIzxAKcQ#S zcVWae^ z4dYBMnCODNMcdvqO!zy=Ky(I~od4%BBcS3RBlnP@Jo1l8T0o7$IHy^&O z5>~hO!DKtVRl}H;r#@_>fXH<(>qi7`rb92H=mcLjwfG7LHS&*dz2p`$exAt!h@HZO zHD>GCdqHhoa4oV4(MDp(RMHkci|b*~cMzg{-@1|lwxbTQn#&sT`i*m)apwz{;M+Xb0;Fxk=&dM^b6;on?*`|@cX(0G<~1p@ zpYl(6)7l44#Zwz%=g@mp88Nufs4K%ffvflK9g%H22N4HdaLy@2b;W#sDR%Db| zLp){C0cAK5PaK5WN@jO-3g-R$L;jiZNl*MD{{1}96O0zKAZ^4d#vir&z4fo63x`XK znm96)r0wgu++G%I%5lHB&|a*GwjN?%hApoOQVO}oDdNsG93nc3Jqrt9KShpXP?L$=5 z8~sq><0iy|>ynXm*es=+v^TokA`=}^_A&MWW#QJF)BXPtGx)w1YYP}<`kv7Xs91c{ z&`vovI(E`di)sMUoaJont151Lhcmq&O%A!`oJ(N?wo-8Bj{1KIjO*3Q)IZS*~ z%f}gi3}h?uwqK{61ccO_M;#dvNjex9jhqj-4m69r*^hvhiMWBx{=Mtf72h|G>^CF9;}RdAHDrYbIn%-V%f?aIYnqqlmhVv9GBn121Y>l zS#`yP2~xb?Lo(yym1mR4oAg>j7aJ+VBB@$rJDCk^%zE?pL&GJBww=Qn5BvWR)wP9E zuA1 z?`Rpcl<)h4whGEB@Sn4Y(hN!{Zz(;_xybWH$q5sKN)o~PfP#F@*5<7FCN)!sMbAHi z0oI#t>KN9Uun8XVJFBofOxpZ0%%;{7XMZ$LfKuipWOSNk*XD~_@ccp=1bL&ic*0V% zI)9F+H`thqrw8!C{Im`!g4hl`Wcfy9(@X#@^GEOX^C(`<*@>!?zyjoyY(p6}eo@Nh@{hT~ zfBzFQ0$*c!=;wIT$$zh3(Jb_OUh5l6j463$JJ>r$H*&W-Rsj==&VRq)-};;rw7S#! zrrGG7(SQG?PofPaWviA!iBDIANmV3rC3J149PkbN*Ju6r58v}((SY-0hS7fzX8yT3 z`%k$Be%baX!UrQ$?dbMm@t>#ipD+0z*(EEU-I`;45y5Eu|1fd>A8%a93!ENZl!GWF zH(+{LDmQZElM(K>^8a}C|4?pEacEXiu^&5MD@|sLEi5Z@y!ns2>putf&!cS<@dHlC z6T)I?GYonPe09r#j~B%C{u2e!wiX-BE-P4s+U%Mef3?^`Wq2^<9C3d)jx<{gn)$CDtV3YLMCOi zjJxjT$VB~LStbVHYApoR6arL5$H6yre0$sz_jXa8y=(V>?JNGz!v0_964-K;uB{> zx4RdV&0|KRYAc}c!M(3rwTP`PyB*8-?cZY7cHD%hcc~&GXM72828jL&|GrHQcj!@nXt~Sq=y!H z$hn?8T#F|-75dLtng*Sz=@Qq>8HCvZ44we`OixbF%kkc|7-eZZu-C1>(~Jha=goAIJ}?OA5JRm-mv#{lS_JQvj2Y~tcg~w;k`p}K zTB=uk`#9&_`XG_?EAkc<7xsqS*BgZRnlWegC7#7x$ES} zMt_VU-#_#h3ii1A*s7{b#UHxTuEZgtgYbV{M1CM+mpy0%t zjJH%x5oI7Bo1BDBzCrkMe_HT#oX7c)AMX<%7HIUI`LFa>f4wUtdxS34KMob^)9}6? z0qf@o(WkagA0B$~-f|%mq2?*1lk9)gD^~s`6>^u3F40GcVHi#rj!&l@@-SG0%hZ;9 ze}=R7h1aQ%0@tgCb60}+o}G^C@k_C0_2)&bg}-V}mvAellkXERn_3>-Gr}KuBywdE zWQGD8GI^~ne(SZ0{RV_1D4?|GysLM16R z>g$O5`=|4an`tU<&)~ylhg!SScGQDjtnceKOOfc4`SP>t&6n%4YZiF8G_F$YO0sfR zmj|Mf%K2lxXepJ{c2;F75@Vn_mG4=O^$A`NhbiSpcJpG$DQLuD^ZW0EMqeZWIhK;B`EG>y`MZN5-k&2Z)*oj$;D~H;i05%X?wi%^p`T zaKNWNFMjT=%)^ZxE4k0K@SfgecDOEiUJPf;Ced`BA)yAUD3ZTacz5=GKG(iT7pTqB z#$R61&BN)JTooG9AyD(RX*Iq6oS30n;ojNgs51|Mzth=wF&gIg`fk~kl36fEr5Ew2 zExF4)B~^z7Ohmp=n1A@~$1mOONcNI4c#o-MNx&J~P!xCAIh##O=(2xJwt8K8%) z0f#r~vFNC*4+-dIV5E3V?yj(7rn}l*<{8R-@_MJ}{W^m_EQtwcTcJ){ALD`s!uzD% z1lS0$M4pXo6YeY>$IX7G0Iv*oe2Ow`Fd?|!urrryeBH*a=AH;z*GkrY5XL6WS6lSh z&|5sE82LYi9WIFbHtXj84&-T&hn`+u&6vm2`xqI1uQjyp`F2-h zEq>=G=ntVTS~mL?acLOlAOOf_nf3wEOF?_L|Y8!~Rlb*DO#TI7z0L=(H54(tAvH9zr!@6w^akifR^JNZl zcf_Oj(1khP@27wc3{xYZJ-u?cMkHhQx-8&XesV`XzOXn?xPr23NM-hCH>7ib><{VQ0(uUNfv4|w1CNDI1_ZF8Qnv{1B@ylgU*Y~swM|L`z zGiXtStMQ6B$_DmdSse%HM3`#RIaay`2&ZOVH4Zqi0`>sKw#tsW8ar7cD1F;0PnnNnDco#mV=U!nI>2wJlwy-}Ys&W?9I}UG~+Su3elP|hOE*(;| z8hLuuu*2lk`xfgJZ`Yn{B+soJV`cIf9Zz{4917wEw*v3-B6HnPrXdG`_O3D4`i45Z z-d;~Tbc2vDG6?8W|5r&EAVEmyp&`6C)L_JHv=rk%-afg?^jJJ)V&zb-32`C=I(4$` zm2acHV&R1$_ZK20=hc{&)6fq!%HGANb3sRdbwY>Q$LAF5uK+S9H&@ z1epu{5?IQWO*&m4Ed70I2x#tQuFhWN?_C3}p^^}CVraV4Li1@tI8r$NjiJn%&@tfR zQ5KmTS+^N0i(~@gU9jR>vVdIi%>E`01Tx~piOa@}QF9#7829G55QtDe#2q|Ux)3~5 z{j5VKQufV-X6e(!#L^Pl@3*Jpv=P({OSEqp)W4zq^e2iBj-ObfU4pk)*-%HuP_h*O16aEc?weWG9 z%$22I=hBT*ywQ{)$f&&NEH8@ZQe(vnq#Dqt`aBBzHvTyr#X#_TPy0(U+u*Ds7~ZVG zD5OmoWzmMx2Zv&rs%-^KpgWyq6^-iEPD+gyRg%5QT4;P4;;@Sk<`MFQw>^~M+VB1v zL0XP%=OLqFUxtD<{SI*J%)|xKMY;@0MO@25uFx)%#mRaKilPY-?03VS)8j-qLf+lk zZ4HPx4DsKEJC6nK{H*!a9fQAuL@U z^++QE*9SdJtXk_E=VW7k*KNFn+jEMhYTCYeRQUGPVoS`hdnWsXnxq%2C(Fylp(Aat zTC}w{yOF5yIZIFze@~SV*q-@7h`QBbyrS=yVW+@;k=n&vJ{~)wR2v!*0?k+Ca34I^ z805voQ8*L=n`y1O2t0|9!Cv;h`~r5>@rM`aeZLChhS_)ec|ACgH9>WkwCmPxW>2aW zPTM1*x$3l^28N%nhZ3+bQY&%5?l8sBFrKh(jLH^BNZgJc+!n1wyUa#PhoUHWQUb9_ zr8o?GUagU+hF=Rj95*+{q8f|<#v+To7j=Y((rIZPh|Mg1+&!Dpg>Fz);_ zx%CmhZ1Ry(W`z@Re1909{n;HxSefM%6j|=Q09Y4OrRqWGgM5H4?r&igZ4@u!VHfI9p6e0#8(+l((Uto&C>qGuKPgh z7pe@p4Yy>vpIxbURD*Vw`rP`x3%qc88CKF!dLY8=k3-Dq{~VjFk2QcZm=dG##HzG) z#O6cFWRl)U9H023kvCi-5HnXi;KfH$;F$Rv>Qu{TIUQu^{2z*YZD_ENQTfH}!qdnlm^|7!&$Asryatz6N zC)oeyV&?+hshs}KX)oPnIS*k7-J8v1B#i;1%Y6e2;!5)zV}wG$GufbWA?I+u^6pMB z0?e#k7d?vyPtn~#vBIGc66LX&$^v+g(p@t^D8%U*`zH$3pICKP?bMY(QA>nGkP52K zaJ99J#Jo9WBL{VHs?PykhTf}G!ik92OuSxQ7{}{#S{EBpO_27_rD4m*%gw1Ka+xE& z#*!VKF$c4@c9|uWw6|z78A1Y1`XyK-ygAfON+mVZwI|Y_LqJXIN1#ho%u}RtXVIs} z*pq>2ruC9PdaaM=xUY{qd96tj7_sk zt1Sz++MK6sN1Z^js$`|BZrO9BMQfl|%TjzkT)N{Mb(HOoY;k(X!r-x)@IT)gR0KRA zHiASK+_d{Q<&o0_)8`vn6_y$_o2Q~2S3OKPd`3l@oTjqGynw8EoUNU1AHxb-7{G|D zZ%+SqxXa;&%at)|StbrYahp&Y(Q!d)$~JVJ5V$)i73K~AnI){(*7MrV%c;u|+jPX* zgYx8lF!z2&&P3yOJ^d=vwn9tU5xL5TF`)KVk(AeJ)w0dx7F6nnK)2Bw6~|Xxw%rX! z$9HSria&2Q8cH6ovfNPs=l{G&j+~gY-(Wz>9EE2DpsojC5N4BG5l2=nkOiUIxXwlT zTx79jX1e-OYEGHO^IB^<(-Wxmun?2Awo!vi3(rt9H|iAb9dAG#@aNbh%&a4J+G`$@ zfWCScH}e`E8Ca|G&iQcnz$LYHhw810HcsG0#{>=t4z_E%uEKFcFcnfK?LD5VFdY?p z4S(n7b7AoK{pLR1DpdR0&gyH-o^G>;O2~S*+5VJyJiYDmQ<~$aISBE8SFHakU%rH5 zKE(mr`HGnihcqy`PZhE zedSVZyE4LK-+?^4SnsHVgo+vcjo?y;C8hObom6_>bkK-!<**KLQ0c!I8^6-6bkQMX z)sD_g;rY`@!eh013nUclaG4I-IUU^khOt=WEdFJ|M+9P#)WJ>`=jQ<`+p$Wo~T^;P^wuSdRZyNaD|UA+9v?keYeo_%PN{QUIXBmX#4AqRDE7f6Vq1d=j^$s%w)mExS#omP#NbGg$SXPr8!t>L(Z?(dO@f)_H# zPl%}6m9F+YA>z$W2UD=w%okgO^{!%HKAwy>Hx_!{RIn02a-QlaW{OpMuf~Hw4eSKr zp;V6*!gSoBD!7|N-s>KcotY0R& zambB8-m(MntXrD(=YsRzPt7JJ)s{1TFhDq^gTCJ502tMOfVEec43iwU%D*G{`0f5S zS_6li^Zg@1xhVY#X*8yZ{V%C+d;MGj(w`jN7)n6?ctG(#jHNB9%phCXbfzF>v8GTw~g46RM% z${K-s4R61hYcmH9fH9&e=7#Z0le;oEN3}>6JW?Ud$2HvbLK*H!;D(+NEv`Qdt#v zhVM6+B-SA+SASTI!+8to7GeY{ zkr)9>7t?kbEK|Z%PlVy>Z9n!`}ZR=276brYp@NboNdTW~EV}dIUW_kO6G?%%}SB&i~v3CUx_g zXRl~w(t@$c=GbO`HQk(tymn@F_Vt~e=vBN4|CF!5GTcUu5B{?Dokm!T{vA?DOqrd3 z0xd?wIRR=B-x>vC*ze~A>P<05>Iv(%(Ul^<@m1GO(IYI43RSJ&N`}6Q1#PXijS1hw;s!uX?nj}*TY-TP5a z&{e?Ky@Cq|^Gi0QWm%g835AP}dcHdqR>XQt-@XNPYs0REl?WQT=U$fOnyy5Nh=kH5p@0nCozmT1LwDzQd*1i+o^w9O^ZWh9#dXcKXV2d2d7icI`(F3L z!8Q1-Gr4)-=jxy-9YL8+qvok#HeTR#$2!zt0|2Ewy_c>{o{+jWpP;>l`K0C}+N1g? zjR?u>8}ZzJwNu2;j-+La^d?`dP8(kVPowThSMz&eymqDTF-vT0;+*;8-O1+eQMq|l zvD;ik%v=-sRkQz*2l5x{(;Ou0%s#EjtOA!YDPct6gKJ?BDpH(Sn<0bJv!SV$7I1<{ zJ{Ju$Uw&&-zS4GfA0tVjO*Ss3f`8;)l}uE#Ii|4o+z1L6OMVzH_X0gOWXF2P+knJk zx#q*k<|wck)B$tql$3c{W(Z9GQ8m#eiRcZ)Q?Q9;AS-dS! zO`QkvFO?Iz`bGD-n ziec(fk<7f|(^6f?CgiO>A6#Hro*AQ%=)Vr?2q)8)8(mN*2qj*UM(@(qKDc~=b_%v8 z3ZyZ12_L5r+cwidSTx~~dK=54AlbBeq`hzg%y1;eYdi>lSVLU}8KaAxQDK>&5Bnh% zYl8x`17h24{Dfd^+#&u#NfW{=r@gtw)Q_d6N03YVuAC*b7DgXJts2+x!^39_I82e) z`Z!am`_OGR-!_hZuVa3eCDxVk?s>P8=U28KK(gyu6|sPI{(iR3uBPEuv(7el7H#zl zbE8a0#*O#h7S4>7v7+ch8&L2kkA4NdAzK*(UrF!>Ft#?%pn(L^<|{abGe^tgB-f%)J(6yybzqk-ou%27%Mt+>jATT`Pwrh_K(jY!2Orj0x z&|8Gm$MRT1)R`V$nQ)<&jAO3{4eupRNQrm|*VFb8Pzk)z{LtCl#cNsJkaON=;8sB! zS!^3{StTN_u6YM4^@O_pT)y-wPC>N+-5Q(=$8N%YN7&BU*{}Yc*yz}qLWC3$@d|5FH^^e`kM9^-B&b4 z+H_IN1@?B^&0GEtZTLs-UMqs8@EE!*%gK^r!{xTr?e*|1?{haN%q7=+p`{0(@@AK|o+6B8^ECsi4 ze_fAT=Phsf-dRL~3NVw#z~dJR#ap!;IR zf8WHz(X7$KjY5`+DRhf}%IDnQ3p;o}mON52LxVT6Z2v&l7U~CQLK$#FSvE_vbt6A5HQ4xQM0(X12w^hx}U!e zpSquh9&E!h9Ly)$tr@IgAOS}c1>cEO*6Tj{#&=X`u~^3Zts78`0-(MKo!1CbAe-nS zvjW}pKxPq3L@?XPGCY54;r{sBIu0LPW(7s1_7wSEyMzZ<^z zb315^r0bFwq;B<=o+|UfGs6zIOgZ?V!JwqyEAzIlUCvf!elpwv=N4?y>G6Kx{0Ua& zcYDsTpm}aEO;fxhM9tl>M`@pVP;Ns0SoXB z@rTIsGM%8BuG^*qFKp5F=GYc?S3D09-=k-)J)|Si?#;{Bqgx4a9bc{4=p`bl!+~YO zGTrxk%pB`&dK8MR$$3l%I#1GD=QOm2{_Ulp`-f+yJXiw;ip(WC|AL(X(M%fyaz4ht z;}Gy;?>*1xzCCXp#lkQ=J(Agu9JHVd6gqDrF@^Wi;k$ey+2vP+IM7D=r`_|)Jj#BQ z`ye4z_M)2{PW7%`9c8tyP4I}Xf`+lMB*}sTm0^Dc!m>WRvA$Wa@u-dbhOPw zw>)gavhd76!s?1e*UWBgno3DGD?_E6F|7=Vdp3HpbmCHAemW7WiG3ngoqA0OgSd7N z>t*)NqMn~61J&Z(&Bvh*V7iye8q1`!Xb1Zv!pnOk4>T$)?7o=JWjro|X~)BY-tj#N zAh?j25lCliP1k|9veVSO741xTjLQn&FQ|Or)%Kzpa6tGR2$_)b98mBJOGCq)3Aj!Ui>4vowYAw3LI zc*afyJm0idgY7Z4#Y@%X&nP(<&j*%v~+PMvQs^!%Vjg$^!9vRc}F z-FnmNskV*iA1mbsjxgq<;|k#$XSCkkx^6ukWV=OW{F7bxIQ$!hXzh9u4&#>z3zX|M`Q+31t1>4X2dlbKnV%>7hHjyl1-aYCx62+k z?@ws%87>r}pZofAtK9pIaFxnYKt?p-gWFDI^WWf>gn)wvS{}ai1 zJrX55t7H5nhX7k7B6g`Y1?SJNggvr!$HhKKh8B5VobcXWwcP9smgK~QbZjKN&3oC- zl632I@Coo&S9SP%Ka`x<2NzGk0eqEKt6jp7uqU&jEMwZ_c z$ze^qp+M7g`6l-z zg~oLSqDSR(f>Z9NQ)yE4ZHqky8%ekQWHDL+OXX;7PbH>PsnSgutiSlf5H-|gXS$47 z)(X!3h4pR3hw<+Wsv;)KZFG{fm@4r5nX_>P?_LVjhc0;IUEXh40sJIBJFf;)9ixgF z7S6fnS|pC?KMt?j7|Kc%x)z}h`oafGqGPV%Q`(vss$~*T_k zv!maW+rM`a^a!b+=XgHoQDds&LHjBGur^A%y&#_cfbaQy-=`o3CHN z%bOV1CD`f_2@4V9tL< z9wfn!qL+LqtGDgT;byZ{2?C~eP=>5m21qQ}5p+u%9+Zr04^&DW=8t;0tEvgO=3P2=AA`hQj6`i^1dKU*hQ!kFG!~{wY-i8yK zP)kH&LU8nx8m*7V+oOqEb$H*L<}8`xu8sSXh-FPo6R*PeTGlo2>e>2|coL5Y(o~*2Fk_?NGv{R?nIs_MY0VO86#V z4K7zNv5cjMsv+OhP%>A#utpyGYIF_rvmzF56CRRc5b*Xs#MdVATg_DV`AEgw z1r@BvuQi=Il%Lmh!9WHhu0&$E5)^QM$K9D=*8GMC-C}T(AF%f$s6}CqEs7djd~`t2 zBCqd#Fbr{XK^^?Stmmx{bC~=*Xw&3buCZ*ea5qFXMb)ib+-1*g2QKY3O~y-LGU7s; z_w!+(?B^cD-<1e%8lmkz76mO_?3XLAJD~ZG_YNsVpNrR>i+a|@N_rUYQ^LB^V9Zi< zh0!_2(FW2ITxKxnt~honlRS)*?*-C-)=3;d4UaXAIiY z(RdL$2>Uidh;@tGoH4FVWgiO7NC6?KBE}Vt{4OFT;4z1Up4IDbD0hcysoCDB5t2zC zP0-!j>MIP;fq^ALj!Kac;IYO^0(vYHuVWW0T8>YziWZDiN*7H-}j8)rs zEQAwj;@WJd&Es_8?>a1uQ_riOd>!=2#5W89y2N-7|6&~XGwul$orgs%hn}!shb(=28U5bh#qDLgm~SPWUmF>k zWoNb1o;=(cbdktyDrPZNnoe(CecpE62p#c3UAMc57~nkZh&Gl6*Uj>0`it7S-J~?qG&6H_5oR!gg*+s9QMnhGf)I z#Nc4N-}6)tz4wmej9lo*q!yX8<_lY|v{?@B{}5ydLMDkG@h{s?bKzf|i&6om9ciNG zs`n2jpO(^5p}Gf{Xl1{7`L5WUKTAG&YTo9D#lmn2@ctF2ho~z~f)o`Wr?_86hjnO> zS=p?+iyX`ieIjXc!F$=tbxsU#@EM*Nj+3V76G)mCE!$%)tf)-eEVBRiCj}zEciw>O z)=a&GYir$dREc`eQimn=Hxjv^`Y3JuJ@Q0t8I8PfO%iIX9X@V*hlu@-)r;)OobGew zmhZ+ys&tzOSJNaF_X)j|-x5t|=RXpTv?$%$?l>~xLcECaJ$-prhWAL-IQ60v=Y?QF zo<#6xdZA2tg+(%(1cfUvKK!8<72i!0NH+GJ^6M?!&jtnOZ|UxO$hdMPis(nI8XHCY zjbmaRg(5z-Vl$?(_!;jQSa)H>Fh1H8neDoFg2~I*ZNeXZlrO$qcS2&yN#r3^RCpo0 zb#KGnLi*~i@?b^w}YG3%I(J;G?^!o!xvIk%K*zdg5E%=fpap^T9-aY&|P zJ-QXW8rHZB0(r-;YFCnY3HsV^4A%e;PZ<6ce;0>ypZ+TZAjAKP(|<7Izn^s* z*txW;+u#^A30*661ax8`CJ%-S|^C_}umPTY1PAZp`nl^Xe-!SHX z+()f5n!+P!<}@e_@T?RCW_M&1XjBXVyrGL|`q-OldsB5ygzahr2`ac{$3tDB$G_nRv@ax3yFV!tH8a9_YL0m|u?NyQ#9j z)ph?ANc8EYK}4zEo4d0$Vm(y@gypLCj_nPXCKi7GKVOcJrIlzydbO^4Ew!*YQn{@_XvThyOi~|L1q=C3?XQ;!ijZ7iloeHJqUs+Nw%Jl5F~uCl?}kSp|NC zG}^8K{4WOiW8^y`&|H6mK>p&swGkH85tDxVBZIB@F0BtgeHpruA@t zmC)<}N{dWDog0-Q5lkP-0ePw%1IWuI1~a9dLWkDU1XSxz-$gRT0d z;u1unIB>8tQRM3ZuS~QocEzyD z-d!IN$|b%SecMUJ*O?kyaO9Ila^K1(cUq&meR)`;sE#2rcK`^qQC(wW;cHR6nGGDhIQodxCzfcBllm{gtHKuqr##feWphc$QdBSp5AqF%SsnyQ-X#Zb5Z*mps$c0_;+@Rqix-7RlI5k8? z9MI9;^u%)=eqR>oKQX|oF1(TOcrM^^T^TcOUx2+Vt{u|=C{|WPX_8TQW{sUlQ<^$D z0`)s0b|S`Z)2}yFa@H?Tq;H%~u`RT!?Stthf@p6f$;EoUay+%1sVv^<*-PSjxuU~| z6+tEVqVId{N&2>JRgp-objeKirw3ZlG4gjw%xcoEi?xUQF>% zECe9ZG%_=R?w5*#`jVzkH1Oa4RQ3nPbPB&KF~SGzRC8iB%f=;QSb8j3-j$m_{VAx3 zBen{1M1tsi2xn_;qF=?ZyaZyCSjhocY{%1u4aFLfCJ%k5H%DuD9|xs+$rpJE03#u6 zZfrJJUS8_tjhV-5B*-70E{OUvDX+-*ovRg0D*}hxbycrOBB^-&^~GcA8?ymKI!>z0 zbfpc$W7(9XrPg0kPB*Rg01;AZ+)oWORl^>?O!5OzLm7+dvdqKPXEIel`?BJaMDY3x z(w?p#YCe&+bsI|oQF@L1(Oo*QpZ*u*?@vixNi&YA^`1$rq>K$AUTv!n=E zH{Jx#S}zveHF|s)|5>*J>uTOpEZ03vE}?jnfzeN<@d;S!{oHO7imy`X&@CowS8EynEb4pXRuV$j~Y^i8|l+hvPh(0bYMshCP>2-?y(Ujki_q zf;>M|e9O(}CBG}@7};E4Ic&`(uk|HAYvyM0oc}Q5<$87z#QY|g)`xM%h1Tt4^zHW4 zGN*f!%R!7;`|$=#qleUN%~={C?p6lc4swBYfFWy0+zMoq(vQ{6Ps84BX;9I!X+ojk z+z+uKECKZjqd(r}m<(nF;|P2ld%f9$#w4+h?UAwWQr=}b{DW9dkAqTe9x+m&{GHyg zD<)p~sPa~?d(Hjh*>4F}E^zlV4K^|KlJ_rT{f~@T8pYjys#VeNT$&ZaABhXq*&*5F zl26GbBPip6(Tj{H)WEQEKaJx;6=WaAe6JilD9|d?$N&D24<@dJ8x|qXPQ%S%-hN{x z2)XC8ZC1)69xzd7y(pF-WXM@&BehX8X+*&-YojFHLJ2?&`y}`%_xxlO7wHS!09| z;k8yLu(lD|2>H4CF)7jGQUtX*lOpVp@~6GjQ6ENfpI$AfWxY}j`L%p;wb$?sPt&XP z!)Sp2bwhv zXW2IBtkX1Wgi{P_LaM>_H>VWk+#VX`bY7wBT_3HnZT1^c6ZmZCS88!fVpG@_oHdB=P>dT54gY3KycM2Oox4Yd|d3jOlpaiL9pbdSVgV;T07bR0;$p5wIV{MwxEH(exs23+00Mt&;@P%`L2FPHJ*T+y z8yga|$C~d;^>H_)tm@ia0){ah4Nz&i5g`_ByBrI~&aL~47`&80fhap<12BxR#}M{D z-e@iVnR@rc!xDBAj8g1DVmdU9^*Cm&0I1&l2y?c;mfzPcJd@tl!v;RuDfDOXE$T%~ zay=WogLfVHp&y73qZB$qT?d~``I>!x%p%b8fKPqs+Y%w!Mqj-y4IO2_Kh`(12A;ma zVKBClaeoTf%rdA3$AqT7(t!;#l?IS=8w`}gZa=wAIgLbOqI^8t7Bw3y$dTB-BiC!X zzSwnCqQtY;{MynINFWO}zEemRTGeI&UzE)!04aCa@zWaE@A!XeHkN-3{4F6(k-p5o ziF)-{W&g*A?JR~C8B@lX-xwkc_4ZW92oMQPgXGIM?GfZ$Y?OV@v8;1_Q)onNlZ-kD zZa!N172O((#<|iHFNQW#t0ZvkRF~Q{4p+qlAm5|%i}cM z?dp^j{1g|$)QP)F1wH_e{jxR#C$_ymmw|TTUbx_bxXbQ95y0*s4vg|+yYl+U-29?T z#7lJ%7${{qJwAh#&hWo)^m(ST&#yto>@|b zwgWmkotZ=troNb`xEh|Gi?1{GhX` z!Jp#r=DdZlG>A2g;auHs*}J*^=1Rg|+Lgd@(B@zX)2FPoxZUxXbnxD?L?fkXgH2LX z#R~}=jPtplYGwDejKTANf>8c?J2)@V09@!Zx3BtJK!+nqD&8ZUVSIJpd0ycS2_)Aylk77qp0%*zki!}jonGuiz9B13D|y)`^GjU-Jg#Huia@^!Pj z7t92nNy73*X7j9F^uhKx7lRl7klmL0{`lodt&0(QQOF-F3gC4vh|&U+eRGne%Bg>) zdy?qmyX`=62iMfY=f(+boh!C5`W_g&_?%*ZhukJGgPp~>|W>_)=nI#&?Xe+$sl z8|NI@3*N4DoCa=voPD<@Fi?&iRunwa0G^wvjWeekpNe(_7%WmEBbx{bM^Y=Z{YMz58rsC1xIIwPm+ybC)`@d%6q&c(A2a^8 zJkzLYkYX+5XFqU6WrYL(&q9pU8zGA#<*IjbE41Br8A?+X+|TYo;4_L&{D6n+6nvbq z7{A+-iQHNuT^Zulzp+vC~=ZJ@+Lf0$aPX$>p$ z=-sO-Jh&u#Q@w_}IjkW(w}h65v^m07`;wh5Pn3!dNo~SzKH~TIgs_^2b|tVrgPF_F zhJL_0OHv*4c5g1jrw(~O`&QW%y&&xBY|xxR zHS2Dud;@ibywycr8~@b;>#RmnNtoT0&7nZ|q+=(zk+L!Tb+!G*y04`${LLv?k4(Q5 z8s7fmQ1U(Q#?`i^B+0lRjRTx3G^l6XF9=K@qCr);gey z|M`5IpP&+@wyf0#PAcWqpyIef!bD8yKu?w5Zw?&%h7L|JWLHxsl`nkRv`hf9sd)Vn zB;Xo=0Q4WbUmP0#(8z(T_QXd6V*Mw$a;F=!p%4~L31D-{2HNNcdg4oFehMsnK!;|9 z5#>(iu8CAcbD$}{p4@Tw!d!C`2gd!o5z8juCQ|i#%p_z2t>hm zU2r4EZ%_y94_uG!Cm%VtxlAIjRW?8_AxO34HQ$?0mxrt6!~4{F2cH^+!R=R5pDDvM ztz+0!0-ls8CJRdwgb*&$*srIZJ4#8x)mk=bEMK^}xm6bA z)~oeL_&=K^o(lK_EcB0OBo^cq+)sxw^n>H~n-#j}ja~bRR@2~kV^l@cNLREGD2fMx zrlhCX8k{Y??M2HSt-Vq}Dz`o{n8|H%_z?U#>I?wIxQ%*Dy5e>meyG;G0D?2@!6O+F zpd%HMPUdseOTqgHCSegYJzfZ#^85_dAp38W0Y;!#)hrId<8FiB5Co1M8bTtX$CBL< zz*2yjGFk0%i9;jbRoViNW(A#0`(|8XfN}{OK3!@lTlQg0mqUQjuq!E8DvYcJnkcOl z67#gJuD!a+k>G=LZ+DNoo`^|7{Wc z&!-pKet)p-uwv}Ly^Zijvz;xx<_P z@^bzIkS(PDz3z#>jsn`;R63D|_-42f8())`9W4X7DU4?e8`BNMoe40kdnV9BktkCM zf4G)6%Dt~CU|Mon=XQ*q!wWL>)BIZ?_f1hMCdAe1M`>bCyY8zMblOe>%8a0WO2Cz! zIHgdtN(^Yc$pk!yk}YRzUjh{xv5?GsxdjCPM?YB$06_F&tJSm=ts7s+ph$$(fKdkt4f3Ml-fVg;^#GCy>P=Fj(zu^eNJYXP+TV44Qz-T4i z)HpVQ%7a^fMTS`skrvdy$*ezFoE1YSjs-5D-4y#Ywoq&RNIuDrUMh^~WkN^%Ps3v( zQ=F;#_GOiB{$XzUBg}G`lF)G|*|0Gp^$~JIiYfJKLLA z06JB&O;g>U$ccva^||o8|CKb_y8~$7xZTdJ$%UK|iC-cfBX0SJ1Mq32lrkh@Hyu(C z%RQME%PLz=?URlZbY9E!uVR?=j2mAl|6yU_lwqI^v58p(78n#_{9cyB+?)4O0I@RA zLCU06Y3=>s$!n&9JHQm_O{t9D;(-Lp!1T9Vw~PCq8Q+zz z+XGEEQ-F5(Zacj}y~lEFTiB6saA02K4XDm(kGkomLjhKh^XTP-YT%ZRDGbPAmNpHJ zbCrfVj!61cfJ8OdphKSC=yxV4Rpjru%B;E`NTW7)&Ep+U^{YQ$!hKi${@&x)F^X=SXEe_hH6yoyc5rCoi*SIK6bDis+#Q1_ zh=kp-f<&Bh_bZP_8HekGnM~rBc*l#sjq`F0SQbcK&d%{r9rj79&Xp&$v|(tQ->#M31?U#!b{?Pw*ogZV z&qEK0o+wV*8k$ZZ7WJu;*cB|9wQKo^*NO-!`GV$LYMwgm&PZNj4w9kbH5DtSi*bis zaoM%wB|NwJ9JUH{BR{}3`_d z0Js6f{a6vLcATUOiNnT(_n5`GWMy+RnO(X^?qqH}(8>Cw`M31MknO-aUDq3}83&iP z-0hC)(*26Buh0N%$9Fx5W;Pi`*CU1w5^=iCN$>u2D}_o?NbN6}Az# z{)%R7?IODeXovJGz*nY#!HkqSSp0JYX~@nvUmirx$k&eh4S(gW(DZt_4#l$`^XVO4zdojhBg&LlkkX>*BG@qc}fdpa-oAv<{~3KtzE_NM(jy zZ*R`%9P6-peQh#5aZrQZJ8`K%F5rd0i=OX9#}~$_p#xz>Gt~~!hefgk80SOnnsjL_ zLrN86cY6(N;Nh~pP7*+&K*mtsL<1Scc?Sh@sco9e&#jY%Z&Ohs@GCuRs2K`xbN?s_ z0wv(A3x6*}rD7wUH`}@3=L*u} zo=w4e#N*5-P4^j7gJLW0w?-b?xk!70Bde27%#z}o7^g&ohy}}oCMU*hTE6hIjI;Vt zp}7jJ8&8l`g^&CJVi3bctzpCmu&2|@#k@xWbv6wMu=s)mlUgZh-O+B%5*u3RA>G2g zHvlH|T|6-2P0aA(DHH8)bNi-PpRC&5)AX4@E&s&Y)PG)zAulhY-ivUJj zQkj>JO5cW52sBXM_eH|F^`d;otf^q*x9;G|@26@BCw?@I z%u{GQ(re3u=~JZtq4e>4f#zsMK4tW1`?%wGBComiDwqA0O_gCRdgKQHEvu_@Po%= zTHx(PTM2Xs${R3Dui5Vy8oHGw`!MI{?8l%1=!atyZKfjL0__{&wlJ`YrU%d*AR8i{ z-|pj&(*=SoY^so-2uzDXEAdekFwVoFj@P6-rZZm)2DmzX{Y_PJ4wJC9r6lf86}}BY z=@Z2LV{NMa2(^aSJ?gl{ae5JGbURUg#sI?9b|Ui$uW&ZW(Wiko4Jv^C z1m`qW+yu_tW=awy-yFOTv(Ys#(rSFr+R)1w{HBR8BesM18Ka&8`E z5vp66|FIBgSwH}~&C+ALPLT<~PwsY0WzxWumjUqs_x_&GyG83M#?-7^1#DKPGFc@i1%7wK`As};#dC*j0)fo&L=ouSC8^|b6#X9N-R*;obv(ro}>{k)Az|K zvR!ENE3Y)GxPE{`Q;Tq-_)naMwv_03H*x?fUTAa&AOoXGZz)un=stbDiCUIM$C%71 z%O9)W{;!%+AYA>7&=$q*koi_p3x%{Y6i?0_IjHK%oLUfn)eq!$s1T z21a}Z*D$H@2Rxleyt(zlrqhvvV+)j4e33fYps{}c#tk*?+%|F^UOF*^Vo*_fzn{|@NJ zZV4}|FuI=G)9J!ez;+KPlVNppB7vuLi`ks|twHunt@p@zY`=xwNXe~VkI(8MEQ}>&wGZ}feGxtO>SA5e- zKdio*YBa#OLN@W_diV#}Blhpztq`Ir-rAr~SWT5iSyN&_d^RbDe7Wwt%fN8*%itHs zLT&XW!rRNDT>!sn3TUhjb;ZBAMGzLCx)XFG#dPgLxPx+mw)|`wk8^LwovD+aoC6oF zj}GQnXL~t&4LXv@{?xljl<*>PXKKzBqH5p=B7XMfl6d9-#@6h>Y}++1fQue#AjPe-^Kj?1& zIV}Npam9vQ`0MkjyYmfuh0v9c2@B>#?j7~*!g6&fhAsYt(%oO!GiR)7MFB6nM=Wbq zCW~V4fT1VAZukYl0vGvh>JdbM`tB-SGud6msLzqR?;@C!DU$DLzgpo$eSe%~MTL!E*ahOCaHm&51e1j!BYbCbjW=lKWuoV&zWv7dEB3%~%tlNPYM;qp&f;o;B~r zA#U7a^;9ZFh<2U)LjCq)BFo<~~h~8y3FFahzW?Wq!$Q^#x6L_IKv5NzlVVEFq8qb~_HPbzelVp(j;bM!aGS_M@M<@n1OUo- zdn5TugT1(s|97sj zu-}_KZ9aH_f_>)G9H4yJMM$z*E*wh{^6CL8o1KBT^YV-|ben-1I8#DhLAt6zu7Kmd z0?_Z2_3){(Ozj+HSD(tY*!0vB%b`KGQ=6mQ8^V0ol|i@4_;DIzGK=L$xa$pfw}Qm% z+M4YY$*jq|#XRc(JN4?Nvr>N^%MTvYYsgLe72>Ca7U~JUX_pdUUuoS+_;uL`0?S2T zZhp~@S%kNGzO*x8QTDOM^O{i|bZq1$Nd!KU^l2_UIvkx442~12)YIgO4x2&CkChw4JbCeF)c{!>h&*di;n#kz7;N;O_OqY3_v`R zt`Gwq6AfRvG+LQs{8v2`MW@y{-sHoBwPj;Nnu|txF2gQ4BE11m*-wOc1Gly8^&q1O zscC^-Y>yi?$92Z?mMe}SXhyvZWu!uX+ReUWEgk#NU?hN<4VG<!hGJ5C5_QOjl1&rdb_)#Oxsz5_M%KD&`#g4Dg1LS)|YNTFzLfdQQCN*NJJ1pL=8cr28q!}7ZIK4z4z!wCqySo^pc1YjNW_iEqXWlgi&X7#=LjV zInVEu_nbdxEo;H?YRxXG= zj*B-hs;$`n4(z){(iTN+PqV6EB+&Y~#o~-3P$>xj;ryv(0uCo_eY5@PYW%3IS789J z>b+{-`#b_l-d}*3_&L@{`yE`%=Z)E+v|y1pK38_-xAc3bQyAYR<^ay?0eSe6m-`aP zItE|gL8STXr>{q{Zoyn=)adqQ6vBJmD~sD=K$3v+O*TL!jQIBWmptdr6s75+Ne&x`Ut{{7%OI z%?bd{vC!WgSkI#=H5)bhj(n;!*rHVzx*-dMmq05%04MEtBm#V(1+4O^Rpa0UDS<#{ z5FXdtkP`$ng=c%^`=>Q=EFbITY#hL%DSGLa+A9Jy%>B#Eb#AiL~A?~)GEd-JWGSPuqrjg_C2!aKPyZqT@|U1nd&BD!`}Q0XT-OFB^G zOtH?OvqaUG;^THK=a3MrkGb@(gmL$33EQdG9+r^sRqsO@8q`9V8V&_5)}L1uzQE+nhCprJ4oVnle8!{F}4)Ah>Se=D69QsmRBc&abyi^m@;Q>`s@x)Dmec zRu(b9APuYG7_bT;%KqMpN~5n@)lTF|I)Dfmbzlp4|0Y`X20UnyWx&8r>RiRF02q=_ zA)Z-2u@?K%`}`RIJxJSM+%#cH$C%vr37Gx7zBdR#St1T}UV2vjel(M3r<0<(ajzOK zersm=E&=5LB(hdiI{Jy&5y>GeIPV6-Q3U|xl2@PdIBz}Rul)mZ$|AoC76at|>)}Rt zx^X6#VnoYjI6z3XfSf0>+wcTwq--Goyb@z58)b*cF*Tg{aeC1Ezxd`*Vr!E_Tg)nk_e0 z?TMt=Yl5q6J0BHTk5tzHnEv{*po~m2`chP{ktB5{U?Qp$6lUI9wn-*)Q=Y*{c zL3w%FOY8S*mg~n$e(+mqFbo3MV;Md%R9Ly$j&J{T&!JweL@jI!NhwA-U7DYlo-Z5E zw0|S_DcZo3LsY3pM-uFCt`$vKMa-;V>)SRjzRcTkagaXoUTB|5K5YQ@peh2==(0_( z6Tr-*>wfrculX!ZRYHX6YsL?)xvmqkp%%=I7e8+ME0vr+B#6a*U-$ZqH-d`xkKJ1x z<|DJ-6O&)HJw66xkiQjcq-h21g}UJfzyM~!7z`pUA{^;@ANE7374EuJN&AOx^pE0z zkQdfXYZUnE6#5U5^pL@yl78_$pv=67K9GriIt)_J>O(Zrp6;^*P9WwgQLH;Szk!|X z?fg{Cp7+^LLt2na*xXL7dzJ{jO3Z4S%Hl_P(<3Pyt=Bj zPhN>)p9c(?uC$5KlO1nQ=&;>ZW@5sR!K{bi|LNoKMPE+5I;HeHToEH)eO3e5M-nv~ zPmRZLZlG7rK19q)m}g{BGG&J0PCz9ij}W}WidD9}!fN2K*an#SeKp&~QC(s2mRP9K zSRPygxW<-ae6$PRmCyOAv=rH^k+M2mv0JW%uT<;B`60i!!eeI6=8%+YdlY0AW1xgl zU@$P=h>sSuv@07ZqW#$5^Xuys2->9)_EPQ?sFr#aT!)^6^GJqDYn6$KdW{@?1ERG3 zr3PisOp~f8+*iF9tG)DOU&cU(MM`-&c=EJoh+bWhY+&HPcXup8g;|A$AH}I{Bf1y&#ynP zoV>xe#cK&1_PfeMk!2R=P8IS4ja2(6tzMmC?Ki%kR>+C{myK+00Fi0J9ajA1l6Hz% z|GKAk#n~EQ+}~V=l&=bPzv=hMMAmPm%MB6I++8)Ip!qGD+~b%SfwQ^jut7#lLx{tn z-}GY5#gyy;CCHxsL-kbA%r`b6jYF*%0m|2wba3#pKpR9e-(K(C2;noJS@BcwOpsc! zr)vt~tB%E=htS@5H=6Y^u0gBdz#n7amUpT<`!GXJiGuPi%7_DIYW& z{OHY_*%Z*G04WG z^#*0kBjUmGg&R zc?OBB)CDf&r&e1JB%e@eR+xr0#qyZ%@?A9EUad#q>TMX2ju0Oc5?(IbopQu1&FtOn zc{F=shtrrQjy`X{Bc7hMvK(LfV+Cuu&P|-I7j{obDNV%WZfmtlMBdS-RUydo$1}aU zBTjhzH|I-=(U&xQ(NFjTKOcP(5Nhj&F-MYPd0)BNp@+AH&0j@g>_ts`Vc|eHt%A9^ zb50OQi8Qp@Z{n=yjM!+15~z|#PquvX(WM2vW3axl14<7sy!DQ1e7NTpRLj)&@YO@V z1;g0r);AwJAAP0er9b$Aplq#gx6}S-F;1NDcBS`2VP_*@z)nW@fVhp|iGAH^InFLk z%Wcf*!o}m@;sPQ8)UbVUIO(P|X(?WB1i3+t^4**0^-8IN2Ff;hR%oP2SLENAaA{nj zS#`wS!wo2D!a(-Z6I_tbZJZo2f6bA^aE(&EuW2S5QdH1)e{Ap5!DWlVQye=%Z!{wk z*?-bRh!KH);T|)7a|8CiY{8uMV=_A;-6Uj`muJlviHy2fN&j1c!RYWxMv(nyqk_=O z4O$VjFP-@J2iV|6mz(a6x7p9b&?m)agP3wDO(|cgCITI;L=t>WJX#`DZKV{2y)k|{ zBP&$Q=#5U!TP|XYwx-AUFoag*=imNm>wai8LS}Ua=bAuq3DmIHOh;f4eL^6%v&`Jo?! zG?t&?xo;zH1I`}xbCdT(4s=7!y<~?ev*FYocSo=yRdF798$&}U9KTa-8L?g|gluvy zN`D*W>vdTyMM*@c!!R%Q+Slxbc!K4gl#R9rQZ6g_i{6hgE)zxbWq!Ipjys|g$9|1p z>BRi~eA5CB4N(w%uot`;Ij5Nl*a^04HdBcuBPGhs|OJdb#9pTb zK|Lcyg=+Z&9H zETr$e+1Q=qIlg1?gN|cOJM0GVM@R=L9TN}|3txS9Ze|%pX!*WXZ_;$s?#q5Yl2(x$ zF|o_pLVt`8XBZ(rW>znpblU5tT8jz~W;n5*Zy7T2cWnqgRd1wuaI(NQYK?} zT57&>8U%dsYt>$!{nk%oX_lPluG#ex#hR0#9^*veE^y*HfJ^5NS4 zW;g4J5I~WC1}A=E=(pN|l1#Phz0r6+921rBD3Cyt0A7MduC{i zxR!HP=jRyREI!=T;BIcv%(*V~;-wrv;T#-mkq7}S5&>kbU*8HdHSkk4U*WWtSeYiT z`uM=Xso8bxWLg<>iutJ+@QO+Eqx1KR)8X7`UnlgY120?vjfDKj8WIlR8f$GnKDavY zbaqUkIRGXuq_pB*%hP4JI`&e#@4TrFIsPR~w*QN=W3etZ-*sIfvc^ddW*L7ZjfW*h zhld?NM}$2M4j{^!!B9yO28t5B$i_Zb?uudUl3`q`N(F7< za)762U7*P#()QrOV|P*r(a(#3E#oI(-itA58j(ta$;v{}%zjm-G{dmBGT-#OIIzHU ztiK6W=f4pi(;^t5U#@#|&4xS~z~K7}HA};bk-xv~9@$*(XH)5(D@Ur6QxX`3>`wLK|8d+RKJBF z8&(F~2PQb2@f+1~c3$WSu+J+c8g@W@VZWVAT4EiJ)~Yz2q2*Q)O_QrWaKWKHO$uj| z5MLv%p*l;-#7LagG*r0B+N#8yE+VQ%R>rnN{vJI_&zkr?C!aEC?Qu&WZqc`%dXUZZ z`{wqe@4G(}^AFoSDKz-z;4h6u0=P?ow6R86J6g@gQI=mQ55A34MTm4vldRaI?yCmB47ljAXPhmo|6t5bApEd5>}Nl+O8)_w{;z zagPo^z>X$oOLjn{U9i|H81XwSdwV_obRyGQXO5yC^c~+5DlWS|z_LTSe-FRkn=S!4 zK@n(94 zj;zx~q9VC7^DN%qEVBEh23P2Ar`Swa#ANs?+qax1@nOB+dz#aGOfH=>*1I!hqe)#g zsQR`_E>m{~l&s1tPW0DlFT1&ygBd8r`2Ov%<6%jK-vW1?k4-9}$?1~`o*c&AGrB(P z%tukXFWQ5#F1R!${A_*r*W|8_!ecf=CgJP>w6=0dIXH}L{^v%cG3;Hu7-AV3Y#HC5 z9LcS8sEqRtEb#34_sHs3F(&J4{^a`rk>rZ%N-X3z-|>3PUhkU=Vq}?8(TC<#EsgmY z32Fz5N8a!daEonuNw;S_ZSqHkFD)O9<}2bopsoAr24$F8XT{3U zAjGSae%T9C*vA0>?&shU$ZAsDaK-1}Tfq(mPnH04+%;{5+>rav+J0tx+TWBuhMB)v zo5Y_DASIff8x@!PZb$xG08`KjVrFJ5)6;|0GqZ3}61J>d%x z$jV%yE30#78KT5)c&*y2R%ggF&W+!I7?TOW2YfPjPCla^vpP>dhx6M!EZQmY%y|0x zcy-uiEg$rdH78v2mn z*Y;((7o;I?)_YjILoXH25R~iXHl^X75D4T$bc+Q>&yZb(ruGqFrHt42^j&FuqCrY) zpWawAi)PJ`|YEU_06BX>0{DsM3PnyK^|=ZWzufTk^2LD^{pnW$~-6Oq!Dwo zA;{&mGkVI&O|Vf~IUj!?YS+`lzcX`x9POFbbXrkT*3{imS9%)agk6#~T4+PP1D}sL zSlg&RTfL&~OPA5bjH@zgVjw>h|E~pzv6m$*?zJ`dV*GL)$EK+ zYN%H@1br3QCPyNn1MP06kJNfcAyd+zUC6$q@t|y4$2~th~ps@8+T;%ezP5kI_525oY-yvrVD`QD< zrE8R{I{C{wYl!X{>+hM`n5G<853Lfexf#&S%_YQ^Vx9f(0SFLwXqIBX`^i~pGi^h7 zW4eAF5=?t=lT`%P(tAvZCAPx(yp52ZCW&(Zo{zaT55VKBt0^r z0HFf{dRiSpt=m1W_Dz3`gBw!@*rH8Ip zZi}8%*gfmX_Lv=znt$g~+lFjBjzQDa-oglW3;A*RVbaOxTWgfr%r~y(2|aN{AnLl* zy8Q+lvm6m$bVN9ZE%wR2;DPnBo!a8k;^`gnqg1Ih3-!qD5elWNsJs*I!Mw>Y{S zopQ|!2l0#Qah1uEr4=6WIR@YVdfa&y6ROmy~f_-D!t#&4bbIn}6uC|BN z4|%g@57&FWctLAE&B|a7K_Xg%G5PdNRpR?{uf5CT4uCPdiOZv>yh*Rt)!Dik+mpvk z-bdzO*tPdxXz~!M8nw2DORG;hon$p=QDr}h={6yqZ9J=-J{tzj$gis%XYe_yX!9vO zGyB%?w4EgxiOJ6v5~(4^N--es6}hx5b6kssK<%{hhomT%zC{w?!j#F5ed6w)$xu1w z6iZ=0_NG6pLnvgB>&_idxi0_W9qORIV-uj*RcHyZs%v#oXmU^lOXY$eG%>2?ZH2D&s81! z-Dy<4q-dUAP!_v-LgPV;*KkF0{=M1vk=1SI(%$?X(6Kph!mJTZhfLo~3Z|c2oC$EI zd;1Tf!8d#hqK{(3&UN7hrL`(MwWJz&wj~f?xU!~?tk{FR$fFc};i=K{DK~1$Z$l%h zGZIjZX|+osA9kP2!jGCCMyYw3b6|MBP)4Z65oME;iYyR!MTL7Xj`5CtpBXQf#s zz;L=t1e2q~c7xw^rpF4E%&(4GF8Iw8p8-R?OnfNo<-;PyX{Fk%Xj}WsTcHRZQ8P&d0Thc7+&qeF?wVrlR6Q2Z=XI3)v5oHlW<{rmz zwf^An@&sQ+B025$?ewQm=>#A6d*lZ#mq-jZZ4Lyt$kWp(>--GkB}Yb&A*YFpB^;Db zcdGrFO+Qk8_1W8-$gkBV0oA6(44(*uu7EXX9@*43>!;OA@7JwI_axdd+lOch;*~%R zrdhHUznDp=V4JX=&b7tJ^Y9ba^U{YpF>Iujw#KILm=EM<`B=k`crQWJ%5M1|iZ|MU zI7wKe==a_F>*AFIe$?RQvTV2Axf8>q)kJwFi06)+-odCaCVgXbsuqD`W3CRzT8EoI zndv-(VZhBs$Iwe@P-iQ65D?7z|tQry9 zA#Xpezu+f3oc{Vo6JelYr1l6qu+2c+pVmZE@9PZh52=$F$_HglFWJ6?U~V1WiRe{^ zG^NR76Ti4Hk`urpJTXLfN;_W9c5>qZ^`Ai6#IB)le5KaEDL~zRHHdgs9d| zdq+6!c2$_AltCQW4P%KGxy#l}#5rFeW$Xr~ARh{~c>k&+F#RBh_&$QtM{=@*os!Ze&cF z;s68RIBzyK=x$%92L;GSB3U#+dc$}xZp-GW!eqQr-v0BCUMm4yuRiQZ>K+sUWDB8j`?wSslzhiWm{ckY4gTrHV07p^Nf{*!4Ts zM$UR7RB-bwOff_8x0Z{O7{$zwqHlBT7JXL+Gg}0lFJ*-{ za^DQ{U6{O@w<%3M z9}+lnPCu1Jq0*fLouf{$DFa6t&}Y7{^aIZ_YWkB9m(oic%uz=lhnYEN9$iWscqrG7 z@}D4`d=FW6b^ErqW|-ITQ&sE62?J3fUKNVo`F1<9`VvhB-t-D6P_nC7*2RLDPb8sv z0vuSSx$*|Zwbb|idZ#B*dQf8^?oX{_56Wj378mh3{BD6icx<7_F5Mziuu|~-Gef;|CjdW@$$X6}47o}z7 z!;nG#Ohe$PUx=#I>ac|l%PRMjA+~N;q*xX`*-j|$>tP1K$DIlt3aL>-OY-MsGQ-d<)##%HEDmw-}}d{ui8bXhU16f#Y? zNL6yPd;2!&PC*-*?DUx7D=EkTl73|2d((_OEQL^iQsybdc}ku_zu(ZOoSS832TZ8n z3jD5Ns1}s42CRv2a@~&cN>Z15d7?=V^PJH2VwNJlm+?yUW}|#&7)TpzUmRRCMd@aZ zL?M@HF0N-=nXhWpf~lqkc~0V!eB(pheC$2Ov)9G;Hf};_cy5y;R7yD;9rUNUH(Fyu zJbkF2Pn;`IAb;tL-DXM{RZr^O6j1bezwuq@gh)oG3$h}}*^}{LgHeQ^d0BC7+pA>d z#N(=kCjGXV><=MVRc1~Lu?t;S)z2E-O5~gl6BA80z;5JRhg=*tT;#Ma26<={!-+5T z{m^gbJ`_7B3Zh*GWiC3lUQf8)ylLzG(OgT(o8m&<_`%Xyg6iZ^)6GUYQ@xi+>CF9Y z%HAAELoZ4eeM7$lPvAdt%FKElI7;rkYIbp4aU8a8+Azv|G#5~3x{#1>7h{moGC{U` z?|5|3Q>RKX9Yv4fUXt@inDUY%kKWxqxPyLo*P*vJb2!Qcp%cx|n7Oj2mG#K^tL@-K zoSm1Jg^aN5sYr<_TK_X2<{_vw3#mWC-KF#Ql-v|A=saDF*kJnE9}Vu=uBA1aWCdK{ zx9KO1*}0qse{U_pExQL0K)WpR_rclswSQ0|J#~PRairfds`QDokq_z;e-I^el|E#k z*&Lj!EMv5tQ?77-V12v4#ng}Ur>$E{U^G6ffu^?D2|D&%eX6zaSiM^6B5*`vKpS27 zsoLGsql<{@XCEd=S=A?H<}fM5trZK|wj3Nd-Ch^qxJ=g4-Xqz! zr_U&ouJ`S(@@H0i`$szl7*V9h&1J~oTv9ayH=%5MF&jJioe)~G+`7-nMbo>k2zz^b z$MB-us+nGkIA^ykzM7`sbXTg-dF~HnS<~R(qgmZ@942rSI>+0HRrlU0-T}81;dda6CSKCKG-pT%yy0nW zaJ7Gbu|l$jq9w@!r9;=qM!y7+cLSgce%;JUbEfQ}O19eVqNW^SCVYKu#EmoeNE?fW&49Rt)PF zi-c~8M=40dvxE=nR3sK^O{(p~TK>SScw5R@ni+xeJ)Y5< z`(w==JaD9XjxyKyp!pQyvukVUx&_d`sJ!Y;1?OCQ9shb7f`D7u3^$%f#Y3z&ZgzN; z6{lBiLhB6Vn7tvdAVBQ>=X2AQ)c~8Xsiv<)x_P%_sc1%(+v9L$sxMKuW#$X2D}%VQpd%CERGghL@TD z?bxMc%5PMiHjVWwyAFqHSnVc6_KO(_-boaJpBH~w>MT7O6+-b~|d=%>G)h?3~` zjs8*Xq5-ASOg5`civMUm#=xE(L_UQZ@Ymk}clBfCKNs|Rm`vS92n}U((?t&@_s11c z3O>tk)Fg@mr5pAzm)IztP?Uc}1O<<|rMIVs^V&;A5$G3L6kjQcoE5Sx-kUqa^W~?L z__KB(96_i5Oq|o~`Lgw_(TDeik-MjF+xe4zL9bI=0Jau>BCM6!;&CqPzRzU9y)ISO^3D}|4{Y?O=v8Mhm~DgCvq#2rCmLJ4 z_{Zm7W>g5ZP(Ay~rTc6++GQD~|tN$9$-Q>9XxfFBsl zvY8#hkq9Vx%AW}+S=^T$^Dp!=d3{n}+s-PD2%iZ7ywmWo!KFsmc(<$C_%qi}DMk_@ z1KSqq&x*CH6B`fqjbd~a)W=Tuz4pJd*UWZEPW94wynaE&BFSPb&Zp z<;}3nn6$4bE*V;O4I3~Bm_5&bu;{$m9zw%S8z?kzv2us7FUi37*&FNWgd>nhiS_DgL521;{3J&4N>fxMk}_ zUfM=}mS4rq5#P>UEzHOy=h4~%h?P6@d(6ev?`IIDpx7&*<2Wfl zbB8fW-!nxE2V^rp*=0vHzD~bU$Xfa(>24F$w@^`K%r%~LUQt_T0_Js4-^*4&>v>L0 zlF|!IHe9f+j7q$imULu`RRnKhQ}DY5rhn|Xha8ik?Z1Z+P-uC=rNXi^tDBS0fhCm4 zrj;u4%bl&I6=={o!)-a&R5kH9HO$3_S2Bvi!GAtcZ?)5)T{)y!ZxEDVdPe}l8 z@F{ikDeu|Ukim!S?xKQ;A!H}`#D(FS4R_jn4pcke9 zQ%*ON2AF|?m0wxZVfe^EtcwOZkF6MZac^d|E6P{iTB*Fit} zY{{a7XOGS!(`lf9`*8DiO)Sw(7+_v0-mNtd9E{0Df=}n=9`YamigZ1(PrW($St_5C zdp**)Yiw3dp9xK4SX-D~di%?_ATF1CPqpCeUM)>1!Xgur*F8oXv?4g^8V!Ic*oSLuIOKsk#wSza5 ze@JU(<_ty!YBpc=AhzOi0H1zE=R?81GixybF#U1ii^V`f{|7>{oe(Owx_hIND{_~8 z3^57(tvBY|n}bP7^{t~^2+PX=);NGQucO^WDvt&I^pE86uV3)5f*^Cixm|5)+SDKtS#>*(@Dh`N$vnoY=NzVe74-+KgjizVtP8X{#;3Vh~|3C&4NAMB^Q`I{D^{NqOVz~^IHmRrb_H!c1`mh zM~}LPI~M3GVTR(kD2cVAZVjlKGLi4SW&Ps$Y8NW2tif5TBqevsAb<)g*XVY&;6939 z1hk42e7tV_ih*G`V$J4z_1x@iZhrVUx2Nz}yqho|hO&wL2;(d%9oX@`b4CZSTI(M? zIWJsvLJg1WEd^d5_$3uec~TD2I!MLef|J-JjsA~c@lC+Fd_zf?jF&9%(qguPZXR@p z7t|H*zq&j@F#C9(B?6M`PqQN|Qn$f(MbpI_6s~)}%1vY{6EgBe;>kJn@o?suDoO~(Qj@TN`1pxN%1X7?7rOn21^sXzED$% zkO#5tpTG(F&6z4=_0an3HqaXrI;H925+F->!j*LT@lK#zIItdOmplr3Mt@X|-3?TY zUc&lBt5=5iqgu%&TMyqgB2V~`tPW+oi2J@!1jBIfTInPRwJJj;n*ivzEyfx7K7HNR zTSF9Eu%}7S?6hlRRTYG%!i|fUe)Q^{Qp1J~;5w>}_+KwjaILH5Gk_uW?m)z6*Bpy% zsqU5)Fm4s^i*%V~b2-z%yy^ofn?GvId@b7dV9CMUC%cuSA{A2~bYvHn+~VzOm!^Y&Sk+fETHx}Dvrm8~;zOH=Y1dxPiHo(? zz@qJ!7A5v9ayCu6?kehm(uCdJGRso{ChoXEWhGL8y2;&eiRpUqkd20wk{9DBJu zk3r*miIk>&%$>#2x%ZCdSoOY9vNPeB$H=^2_Pru&xL92nZ-O{4P&u~w-%bT(eBxH; zEui@{pZOyxZI+VTN=pKE2`$OGrt$?qWt|DuFKcJ;x#VakA0zrZf zU+h+OIW=HkflwLLNGy z*lXVcgq#haFq1UM*{lXIF}@{^@DyhP4k?|+&?z8Ah<&MO3UnUjsCCeCQEnND$y?^$ z{6tNPpYxGwQNFQ%&aP9Ha7ry;-en|dI1m1aLFa~O-=FzF{5jPT zo1f_veqq!@+S{f9d!?LsEI%nPl_I$i-hK)HFu3uo&TygLnfXt2VzyDhF#JZg^DaSd zu07scf!no|$F*K(`^X4wh@v`djFaHWi#OJjWye6fQvvN>RgC4LpZED{2y3~(8`wC7 zxt@UQxDaih+i*?%k{fJzXZ@}?z>big6j?u>$O+cwbNFDvGiN~YfI9KiOxWl0!NtLx zg>2c1(U6AR3WYUf@O<_b5qKzclA~`V4WtM(7ua=_M%2`8op0x7 z4Lu?U_h6G-%F1c$I7ia$m=SlDKjbK&yf-dFHX2%|$-QnLc)A@@sZgUR45$P#H5LUi z8xVnLpu0>{Ff(z97g9j0K{H2hSMk6^La9fix-uKqOXZWG>%8Y`9yQbxRV8B(Zx(No zD}4DSf^^-)_S`*>=5k~ArOdgWj|3*qUfvq9*v6S6BC{0rK22n)t{h^dOi zm#)X~L?Edr&B8)D1~%TI_%O$w6=038nHjA=X*yqa!LtRfxc2|^%m0e#ej--<%Zwhi zsXRW4)+qVHx>PI|zbV9_K^@!;sW;W@zpkGjRexg`~SbZylz;lD9D{mBl5TSJH}$$INjuG zibhAlQ|g+jGxY)xp@SW7CIsrBZsPaYdN=y`;a@BO`vP^=J?93Gu&LJkHCNMGJ*6f% zD_e8fYfjp%{~e}^8JaK?t)Y5EI;9M~Lz{K%re5%j8&|AeVMbhdTmJvY``d#f(nUvb zht(DEq>M5YrC!&?{<(u0vR1OWh1?y9KlDnO^_Zmp*Z(=4?mu6?`5<&0CwG&LDE3eC z_KvO#E`B7r1`8Gq9q~&_3HQAl@Lv`~vlV-bQm(a8Y&OHB zZuVVUG>JoNQF2RG6+Un=`aV%7rhr+;PQTr-;B%8SRu%qeL{bhr)QUlz=tcM+wIaNd z#^fQ^fBoG8MTr@ebcfRi6W&F%hjx(orZTsV8qkvtB!2mns-7ra8xxBWEYEyxqoh@+ z&Su8JUlw@7uo^$s`u5-%k6F)woas%rnM$s)Z2eZKXN6WZ_s%o}yCq8Y1$1YsKfZ)< z`BU3xSzsXuob|Ic{>Kvl$IvF=Rw}3c8$3-BgYzND0)ytr1Wr9&mc*AFwYw_nG#(DA zk>2}W6d$D-`WLF2*g6St3s0ZPjfU7O`FG)KWT?-HYoii?|= zK%?iV34IlBtEX^Z31jr9wo3+JOJ17Lvj1C}|8JWSiiP&H0{EqzMZEZ4gb6$~_QG-)~^BQ#GIa znNi9bJD%+=V9l0qF+FSek3jif&UTqE9^En-&xA2s#NOL2c1?OlwH0=~?BtClWYqOX z2+17Ob1rf)ayPT#x7Umgc#we_k$f0grb`dg7BD*rw=+IRA73~P;;VMKn5wtKIdoYx zisYg{r>U3eg1}&{n&m3!HMe`1x3FtV?5al%at>a2E4xQ& zv=Ic`5Q%DRbT)|^+}EPQ4LFel7W-rntPK>>|M_0|Hw8j72K!4IM5_-JX0MdrL^WR( zr&gqr)Mi2 z>?NM}FK4P=@ z2xVGI_6BOJy;f6tM25|a_vaoWnjp&fw_o(%K4{KhBj2pPue84{fBlF`)JF5?^gu8U z=yi!^NzRb!)mBO?d)2PyGcV0VgYI9kE6*d{?O7MAFpz6>Y5^<2I`OwVadRC{>-`meZzO|9Og4Y>H zDc{K`Y+Uc-_y*+L+TpWzxzE=->)nFaoJJcbHuDY0-Z`EOb9o}E>J5LFRv_H0Vkye6 ze@#zqMr-(fp=jld-68;$KdjSiX#yRw<3atf%2!t|vpz-T;TAbFf0W0K2u*EaNJjW> zgjbi?FRyijhP*hJF{Cop<}xI}10h*pkbAOA7b7MOq9gw~vsI`7ds`RDOudY87I+9E~$>T>e1iNN=to zj|&JkFX2pstPH;DgXXc^^I7{CYr0%HGV-B47412iD3*aA4mU5r)-a}F?dP=VWx128 zw7*Iys^;?wsiv<4As!)xDj(2Nz0#i$?($Ly9N^_%Z^(;yj)PbrP{&3y+yVq2`ad`w zz!whZq>VAq1UP2wfA|cOg<5jJRG|1uuT1x8s1~>5n&g~O2z4Unwrs+;R)A@clqa9| z?gF_<@)B`YbcO+367c~2Q?F*pZQ;%SFJMf~2KlCvMdk2xUG$45*#B~o{&mF~nlKz5 zH1E8<${~ibE(0!nvc>t>A z2W{0~MhxB@-x$zZvv?b=nCNzFCbOU<>2nY~mNH(lsn}dm8JgWy}hvmmRcpNRMCWC`?^F2L(h_3CqyJ>6iDtmuF{p4TGlQ=xL zcZO*#s6Zr|neh~N?hJC;1phhzqSzfsh_FHr(0|F+>?zE+cWT277<5ZNC=xN3CjgL> zGGLyHHjrhczw8YTk9fjKNK;#A!Wo|dTYstev{ZNRuR=osAa;PvvgS79do#z@D;AiR z)&UM-QQ{EE#;OcWx$!bNC&Kl@LKZz(e!@Fg{JA;P^d@h(W>C{AUg2$?7ey(LpfE*i z!)CnM`M#Y;qdks6jjh(4X?)cvlj0x;qIb^K!x!3cb&BB3mE(j-CB0TutT}MK$cG;_ z;143q)_DHwafSuldUPudWi-~LDYZ3jZSO5R>X6%1U#cmBl@M6L7}4L`Fb5kBf!?Tg za||Yre@O(=%yXnC+N5 zpM8yobt}!~3jmTso?rcZDbW0uC){ee#_|aO=etZq;=OAY5oy6l`VD@K2gV_OtP?-< z1bT$Y`v(Vk@GX1VB1B=^a=?Q?n<8o>lX-5N32h8tvHT&9lcjvaugWSY2}4lv;L;NSAPCqVPh5BmqDOxKd- z0!Ia5ewVT!)?ZFTcaDyeAPmp1`n*T7z_6_#@64J){(#Ep|tXgYG`iD<)Nh};oigwV}e7*f)v!?wlV{8kqo2pro;wsNd*yVTB*&f#?g1~}=&;6L zAmc8)mj>UPs9b)DA$2jn$Zm3jJ{qrGBje{CD-d`F>x`~*@x36Iqe?~aR}r79w*Z)U z6WHF9Sm#Cs1#8HoURq9aJ(u!bz}UnMRBP%{(Sm>oP_;dgW7PTCX}=zx@*+Yf5@->X zZA35h10!iT0Wa3qiBUcY?P_awci2*=IU)?w7fFp6Joa9MrpNGKTGne{g=u;LPW6FLgu%o@=d*!tr1?mHIWvE}Vc5Pf7%ZR4{)=?)R zn2okT3WAf76wYF9;5N6()E9HT!-_ZnpDwC4q&vkm9U|#~LQqB&aUdIK&_amIu6|44 z{S%-p`4zxm$lKSo6z$fjvhr_yk$@`xDW{B#`zu1I;0)$j=w;z@1ZYHbzoRb<#tYtTy#eBbg&sO z6N0b5by&`qa;1;~-72rE4;l9iFgLYy_Q18mM_MonVx4)((o$npS$RL2Ay+m&kLj}; z!mTJQO2fdXI;<`8TrbabEx>C=lze9B1AwAY8kMB+E3|mtw;0>?s<8quxMcX){}9 zQ~?NfW|O~OIy#^9`2sOYrIeV|O_d4%h=eypY?{(!zF2u%K z+`-aiZ1F}iL7n`fl>0ICc-6Q1tCaf>8V<0M(3&d6$-y5^<^EH3=XSQH;uvm)R^?MV zuWjZKYEO&q22TNnE6;Hl%PVDHb5fu3cIl1GBC3v2(ys3!ai7Xk$}hki$Fc_O@zm`;2 z)4@Y>W2QDn^!K?CNfvP`@yZn%a@A{m3i?K|YgBEv?gZGdx37Ek&|Ptp7=;DHKZ&CCN_ z(*qJgzWO_wozc3Q~T4&(rJt_&Oj(>?FGlh&OqC19rJNi!EoQXj$bV5B!p_kdO!PhlUVZky(z%8pns~&rKPAB1tPcxAxfOFuY zNmnQ(bOV2_nDS*m-eIR%$>uJ3h3}4`0S#ttS1)eB7^(%p4vIvj^*1CJAmc+k_AT4|o8L-A zxK0;xD@MeRwZ1{-YftX~EzW|6Lv-E2DhV>`Qq@%p04&ISNAuk5Ek~=u?s?&>PI0oI z(ECb*LG;QM<+GyIufR=$(0pp}n}i%2mY*k~BSwTec3Mg-Kbf}ynnWfsbGgLjDFQMm zz(=*jJoo1P0}m%DNj^?`CYuK|yl-w3UcUFtUkoh^A0YHr;k(V9{>Uk8<#Ak{Ck7cv zMZ{0pi71cA0d~-8H>#Qw-FT*vqeoaiwgzpJb%KTdQ(J4_A}iy5vI;1LD3U>sL4(4U9a`_w}MNin4^6CBgB{&}~B3+L!F zxn#x6)nd2#xG!+?(jclE@vKVy_W043>m;m-2|$^nDYl9sAZyC7wfVY_TLjzRj3V`j zXHi&HfrbT^I&^P1{Y6>wZ(F~AQnsE3d~7U_P6~*K)km>>gcPE1Wt#U_Zj&aZO(5^LH)AOTk>*ZX8>FXww^Gxur&g;!BR|Ueh`Eq-1>=)z z`q;b=eJlSp`WF7EE(hbjbW7QH&|z7J`ZIA~Y%NRwfycfSIh@76huW#gN9Ln+Yq3UY zmfif+*c(GZCb*YB@i)6UPLp49Bj&Tl@+r^TusV$fQT}3pb5NsYc~E#8)8{;}@q5>> zlAG{XkL<@SQ1Uv5UZFs{(eVUv%}|J)m@-F)uzS~2@V*PS!f9?4akb!fI$VGCH}l$m zft2rw0?Mv8H2T!~MecCV!#_Ka--tdC8IrXTS|k4KKsG2&NtU4CYQrED2kF;^T&+6BaMDt|J3;;14c>=uf6uM2&NK1li>9^eJ zNaB6!Z)eiB2z4+!;6Repk7V`SX{tXsAyGmK|FqgxEzz~i6>9U5%^%HObt8pboi8|< z$dL{J=DuuRyJ#i!UB$N5w2JWmyb1pAH`l1)G}BtsPmUf>KQ!I%&W-y^WT+LuPJeZa zdsFkC@w)-{vdPSEJEV{4mKoHCL&sN{X!N`4VkAynev?I*7rC;l6_|h^sjB3W@3Ncj zL=)#iIgA92INLcf#$h5ZNL8oIwsprUCGiZG3LoVD8Pu^R zWKS@zi|L(RoqXkib0ylxOCl6E5_!BNKIUG%)2lkIY#@{z>{9z210?yexbtzP@DhG9 z0h7gH){Pm38$~aE%&mS77?+s=jU;62cedTVeVFOFv>j0Y!`?>rElpFe90=ENHe-CU zT3J%c?p4J?AIOo(-}lsG#j-Gsg#StBg{;)tb&bBO9sn7S=yC>nr^B_agK>YtX8$L| zU-p|ASaoh@DwE^lBlSuSC!*MY4x4zFG+f%86(Hp&TZ9)XQ7b92avOt*0;$|0J}z*j zb*-_3LLEC7^zXdDgZ1zc(qw84!vzhsq(dSIKGS2%{|L_lAl_8n-A^-71kS$1(!{%X z@8ZTA)7j_H%mW@7$vSgN+{s1kTKpR4)0@<+174YZ-hS(i7|DbW&D*|)7%$3;rA9ih zbKi`u(!AnfL|T&moZ~8ck$sl5K6H4?*Q*J!HnmcLUKc)c%(?hoQICwM`_CKS>st_& zeoe~V!GSz`jCmRnko`;xOocJl>X{1qZ*uW}yh7_R;NqG-Mx&qePJ#@B}W!Ol>NOXSL8SKf>c_oW!w)|hm z#0mS|qI3NwKhxdplIv#%;1d#Da!TaaY!l9#cbYi>BnphmKH$%jPvtP~j?_YJlaBkt z!8)TrR-fq+cgv#$+w3U)2IqY5gFe;+0K1xboY@1XE*rUUTkv5898re!=M!L8V@l$E z0B5*f`2r-}Jve1p#uI!CpR9MB&JR2GTAQ>-e6H2A$l!3}H{clhh{T2hL3ekRPS`oL z341WW>$U^I z40uq0?gB7U>fz2sk%9HjAyRqn7cf*99vx_xdQ(@ z+1mDm02ZfAqDmz%mhZ{wXI2Hmhq+LQaRGflPJq@O$)R1<+mOHk0kdd8Qk5oylLyu} z_NPrX@^(y8)z+@EHw&F?_nLt~Eqy?M9G`gdXtKp*nw_h0wnXY9V=H_NzmO@l`&idh zl+g0>pl%gWp$Z2-fT4pPSg=-_4QnrXf;Fd2#QYAuT%mo&`auxiv-}L7$<);SxSrPs zjXlN4F_?*Kv&oF#6HXC(pl$tc(}B(GbqBEyA#gp?TW?FW`fV}ci5{J-8~~a*%~E&g z*)gCGzz$Rgu>f~Y(sjmGpfU^fdxfj=K652vh3}krcZ=Z%UG4C8cl$u{(+}<8Kt{Xt zGmV0b{PvlBenD4BtT zsxk|UdOR4Sp^#3~Jg;V5NN^%22d4(OkP6|mHg2+D=roNKIY zy1G19XEv=2>hYkkZ?T!K03dtM9WhP~EjuFjhGT9K{evkKH@Kn7MmtZDrSE)+izIyW z%>IWlH-~$px98~=Hp^UXGeK^BsWEv-ab;@kp4H4)pWL3qOWR5LGoV=!36TI1>ak1{ zDxsBz&jEbc6q%g`Pq$0k^r`@HR~D4JgRVF@T8@X#Whr9N2i`0|I&%s`GT1dWY`ssk z&$~}p(+#i^92mCh$>P=$cc6CS^aPNOob&D40iYaWNw=v8yH5wwwX0uSClxdYL_gC6 z%I1=7GYCEnj~0g`puUrZQQ3Xr%FAQ{d=w^oOtg?AYRz9=HAr`_MO@-Ps2A>D!@2-> z|GCrFe$MH!_$aG>e8RD7<;>9;mT#K7U+OQ5*wcpVb*sUNjtN+|3}}cY653zcxB4d! z7T-3y8)MGe!HsmpSqkjQ?Q8tF^ojx~f_ViNXl@1q<|K!!ZKgO$pWiXGadMgur6oG7 z#M*QWtnB#9%-_Y+kxTkfd8CqlVf%F3Ci`LclAC442H_oYCj+w|z5aMitog(l9kHw#}7e^^#&nZ_5i z5Ao^i)Frq25ZQhhMlHsp9>D1Alg*m0R*zlcwu1b)EiT0}g~?H#J%JDuc|iHO0^Z3f z0slau<$MiH(s#Y{W)FxfW`)nA#35@`0J+))^kPAF2g!gr0RVM)S1)e!noZJgzfY1l z&$1&vllEF=c;5|s0w@4ybYJI>tbFk?&`W92UHO*vS01-ih(s7Zz|2o;L4Q0Y{0L;0 z@m+;oio`IV(c<#+<6zx6bC-Wy_0COo*9xyJg@~=tWrGy=?|M#5Xbiy4G(qi#Kx2(_ zdnHCZ$!SDr1}MAw3oC$(#R30hy)TkC?;vB2^A7^Ft9Qye9w_H4Ghdfvx;_($ya$DG zR#F!!HZ2!NEY1vn7+i$xxxDQ;0%*hdmcPor-Nk=*$=xC&kcr%i9P)56wd@AJ<^Sf+Gy<*xd{qE#1 za=eS5}q0!mE$jAG+RTjUM0n)7bD>)ddB>s!=WKZG^ z-8+PrZ(Zj-%;l8s(Su}YkE^41e^A*cbjgto04sfN(yUUi3F#-DYCBG5xgW=iKA1#} z)dKHspa~FKWizd8Wzll2dm?qVdJCqZTguP#>?_?p$82^R8=Qjfx~^d2OX*f*;VU8+Yl(tdmod9mcps zv|dk_Y{!I&BM(fft6kep5$^!8l?{PX%JUBh?*wZ1MM?FAPj^XdY|F_&?pHTS*6TJM ze@WgkozjsywXZX(*D3bjr}9B$y1lJ5o0(2qX>jZ!O)mUHKt|8QG`6WEDK7^$UsYpM zt;WQDQ3o=7ZrJY5c^)i^KI9u!fdQevEmM?^g;%ShPFyeT=VynRr^L=SvTxN4!6lqO z-$8|)hEzgOMZm(|q6@FJw|7WJoqp~;1mGvblep??%j3rP0ng8ZZ+UdLxRGTTA!?}+` z7-M@vH+i64``T>7V_s%t0+6_k<=w8StY1#s8?SUxbt6g7Ye%@i)Zv_zDW&MQQOc6up9j%U*SqT#3hA@BKf&@kbvV3ps^jPd8z#q&>>dLZ=_)(|-}JGY(0( zCzJ|6J5VK+x*9-4h>p5NCPpJ zD}bo*fl4Jt{76$a*w)KKa`Z05??|h_E;Eg-+P~VE6s%%(p5!S%K%`2fxLtm3$2RwA zI9hG$UA1Mk3KDo}fnRy2a@}G5vG6Q5*LAvHLAL9e9IO5e*iCULL#X3gK6sFDPmHbl zwqpMKcx5?3_QLNUkg=~HOnUZciKaHX?Pe)|nCVw|EI!{2ba&s1sJHRCbP&MuO6u1s zMb_<;qSQQ;OSQlJ01RE~#(|6-`%RFZNUtAS5Hn(BI&p7K*`Qu6=!}h2ZEGq8Is1gd zO>l!=4h6&$%65^R52r*6t#6FadtET)8bx%0J=RF`Yv*N0l51sfoP?Y=V(-@iQa(19 zGs`?vWI)%o=Tlu?biOqV#fumMCf+pVec0&XXMYU1%eBx6fY_3hZVlWQ(KHQ_vU z-dDYLlN2r_I_g`2EnMc+nf3%164Y(zsir^GpL0c7C!F z!;3n}jseMTFO+0PB@1al`twzkgr+CONRdBMC*AZ5J^4DKeK-r(Y^_Gbj^08K`q?L& z=V#x#45lGE9*A|Gy}GE9f!v+8rE{At&#xR79&?ZFLBPc)WM52Nw%+8-s$)v*J4IwB zYpHmuu)3_LnrqKZ+ZU0hILx0{zqVJL)&!ljxmg+@!Kpml7ijGha;+3~E9l|CZSFw)e3MuxHxm4FQVT8t=}0k*tJyAWZ@(zPcFA z*1fc*nRj(MLg7k7FMc7qyw{;Zw^sUk5_`FQB)6$>zc2{>4czFXvVd}lb?NnHeO*%R zws_;*94@!6Hh>rhcp(X+>4B*hq&X^tpc8}j6f`>3Jgdfd_y(kw+d1=j3}Av@@#3+| z)-OOwXvI9IL>&p1;TJ#$UZ-I`K{nG9$##_4!dL7H|4=$t z3&$#R!$xNg)8u}ozsSEyDB4;wM)u9#lZid|RUOUxnGP-*FwvYliL(SKMQ6v)d`jXc z*?#lGeCR^d9{hVi@FMw`RS8i6#?|BG2(iBN@b`dD# zJkKYkn`~dNwvohy# zxe4npyZwg)S5!;JnDTh@eC?2jsvK1q&(?rDa2_Yuk3B)v3j?rP<_#*$bA(8tsQ@}^ zjc;-jfFz!?D{8jwnt(~t*Uw*ddmbVSOL+0Uk!=NsJB_? zNo;;+y*#IekR0*0`8A=~8=tmayJ^&TJ`=g_N8fJKPW%z^meDktQdB%9o<=o{4EpU! z2#s$Y&yT3=7$IqC6uc`K2jS@eeL&;b`;DJ#bf$LKzzOgp)7P0D&lflA9ua-mzsWi| zuDNke*%_FH#<#Z4`uS6@0Ah1(VbmYi9_{1}C3GIEOM^U0jC;;^ zCOdGumjlqdnwhLf=8xOcxeC_Pz)EUM%dYy<047mXc=sgs7~~*-)^^9Oss(>M0)xr3 z%2%K-9m$p=%JUFhz^h?#!RpcZcpRnXnF0kt!X^-UUx2Ra5V40E!mfZmSAWEX=Zs5S zb*sw)qW@WB?Z4qIxB-kZ^cRs1aa6AN1+Q`5vZK57CVQ{_R(ngw#o9&Ao*rbf2rh@O z68Oyel!20>C0gl_C(%oh2uZ^2lcn|lFgYD{L(6c1cTEIDF_FX|i zuk>Ecw#33uztPUS%gb~<2{KPpKw_NyjGaD(-_g+H`NC#-^1`w&WYh($$Tv-lzXWv6 zy|cOAe2nscuJZlOJD2lcs&no(jN+D*uQ=Lo0j@S@@6xMmjmLQ0=?N`yyQfO#E{`&s zLIXlIb!^IW!=hO%Y_xlDN$FTkiJJjguyRxRCu|iGDI6rKS5px#hOfH%WKf;qa>lJ0 z9I$_RhuXxq97q;;n(HEZq9J9mPJDifCQlhL)%|V*==n$te}>dReeFQbV?ARN-=}C@ zLMrivR)g6DXvf1R-^khVCIE`W@p9+Qhnwzu3??deaudaGj7ic3kIqg_#Gb4i5N?EK zxG%r^KACtBGv^ksBH~tKybk6BZSVUI6xx?@fjv*Xmq_Yl6RU`%sXhTAGifbafCsUh zH*bzy*x-lTq2ajtUU;5^g)jxm(|irifuRdLJ27~{0M46v00{j7i$1zVO!F;%(Hghh zA+F&GLm6#4zopdz1uG6i;PY3{jdlP)z{=V!WB$dylO+s1Q?RJse-_l35)KCS$w}Imqn!*d$#>R(vN`|2dh+iL6u~_9j||Y&Awr=2N_}z z4q~|5zK4Iq*LtN=<_y-VO`GB`)b=2dovN-AMs4&xcyAFDdRcySw_9zdd;}{zYMVE5 zqkE7bB97_vKv2UHtrPf_lqxP_^4a9W-i`*QU-}5u6L>b^sgn^!aUIm*((`JsCqp}F zluG)-hQQIu?036VJDhQ=tRwoMw}WtiScW#A@f5Efd%(WhO=bVwZ|lSk@#9WF4c4=_ z9A1j5hFX~s#5Sikm&70xpnu?qW@dZNom@R;J&u4Q{s<7K=vh5G zF>H8Kzr=XYjrwehLFY?9z;82zeFm~{`c{-MNh*qvMeBZT=Tn z{Wk;AveWNW)MHEF$EXzlh&v~5yTzY18xp$_-6ztp2bhf19^)U@&mS#ycRkq!2y5Wp zHsoXc>Ubq#ts|Af>Kuz#zSt^8F8B0l7a;HS7CD@?ZZXh>_B+vy06PFJPD~$XEx-p1 zpT6HT-K&(BXlf0yK7X*i_GFvHqsex(d`Crteo_g^{N((TOJ2;-7!ePihX+OqY@ebA zfrY891ELF)qO!#<;rQ61vEq;M4oUg`wWJ4Yg*;VmqkXLDrUqZi(Sq-bqstjDlPgCnjL z7tT<&bb;N7mp|;OMU0Ebv-vPg<5>>f6pphFJ*hF1jXO;$CG|(zC^=Vf_Y*(b6v)DO zDQ}zB=E?=dfMxd!R`E>H$Q5$ZS7P=Rx@@HSe!ZHeKM>IkWjIRf0t|Ynt{zTMsh8Na zoX@@FmkZ4o;~^X#9t@03&%7GFm-DcDOwm<>!-*89=}V{DJ(Mk3;Ra=|=tTj}mU^1` zy_LrFBd2NwVHC%-`Eo^2sm`)SqCg{u(-%>Js@nr!z%e5aTs)9gsG zGKxjF1qFUNJO13&w8b^i5kgNNhX~!X8fE<##%xfnwIbI13CtSO9J}qdFfbeIq39!1 z*b{)jo@$LK88Vfc))kCLAPz*+GY?wI*f<3oSAMx99^Pepc@WzW2ONCsr zdT6p7Y`(nz`y~vXz1t_;bRRM+xGeQkxjH<7OGleaZDD+Nao;+C8A%1&79s~MTx`(_ z3bfeMm2^roFXYSMGDn?(5$l1k_P)?V>$3F?;lHuaa3TnQ$HOgwB>?LjDrV(~dkmCZx`k8q;7f4o( z;SaTs?IdMe>?VhLr|QCwh>xW=nb3Bmk!1m0rQ*KB(g6S&F5GrUigL1`?yW@Rl=d7A zV1tm%>UmUUjC?ia_zj24hHO2+y_R;?9O9GXl*~0rcF{VzV^~clirg@kugfcW!j5d^ z{n!>*HNhT}RrxzPVtrm(SpS(Z!}k6vnuo@7!?52%synhTSW(v=ur!}w@i#ObUXRuE zuRNuvnk3$EIv|Nq=71S?W{72{Um9XihCqCuy7*?D)5bK~!L+`$^Tj$HIUVjr$3iBfuF8&B4G5xLepXiW zcFr(@q0a1$e};Y_ug}0E)59 z)cWVu-LG6am&q?jI>fIso}{x2vd&})I=uQ(s@YgMfA8Mm$Oy&3`(){2qIK4FhhSW> z#U@Ca;BNj1EDzDe=-c1{&9+?C3P@jWODizU?{d4Y&coCIQTAx2epzs z)N7G4fv#zLT@%mxtFf^|a?oaYwLqe}NOcYB2G(c0JfALr^+_7Pt(l$jR9%e!Ogg{| zhph*q?zYv#1De}(F67R?`BZc_ff)@DPKr&X6wNE^Y!n>e(n9ZwRAeN@*ewBB-1V}V z;@S=2q7=4v0*))4Pbc2MEI0Ebumwqit4sCK_8NOY3BWu`Nb#mcetN~;UFk7BOU!@% zSFQFVHk<*!3$lE}9)tg)4WK@^nnQe_T{WIjR!+H;2h(A(2IAX?d~XB{;%`0>{8iL$ zHCdF)A3eZ18$CgHk_VaWdXvCj+9XTlwXfv8eD^BJ3|V4)R%LlG;&aT`M!;Uv;DRC( z{#o_Yt07}=*Kac$6J?s0shv-MQpGVy&Qdcjg94)74$1(SnX=^<_Lct6Wx{X4;f2ug zg;KllTt-asBv<>mC0ID!Kai-`crsKxayLoGJ~7>{;e)W-j>$@4wjCQ6^ia9-tB3|& z7YG^Jk%P80|M}IoyaD;M$Ya#EV1MEKTX;gUwVt;kz)~7RZja|zVs1+20mQVe#+F3& zfjt0kp8jUHVQOR}LV98t6}w{epgjyQ#yhM;bWr;`lKmr*e4YDq8OoQr zM)Vj3)i#V#CLxZz005X91#4C{=uPVgy9uk&1zc$Y5RrDe&LpJ^uic!eqO%iUb!U+o z&Kw4|U~p^Gi+L^U{)xE@swW6un=E9NIV*ME=?Mr6b}>I%Eh`XNUfRUEc(d8QiAt(* zZt1qQaWt5djLMPGszb`|_LMW-#r6g?Z}sQZ&sFn({K3Zg?v14CoVtBGeM;>pCNG_( zg#Oi;=yr~PYx&76s(!@%;IYLk z%FGq%UceWN<>q*B-;{%~=|N84K}E>~;MStOK+zGbg>EW6lQX|yyl2FaX>)FX3D`n# zqk14@W&J=SXSb&NA%f9KIwR!p41B7K!5AQ*^WKtW(CV3DS0}vMyM1MSENVGL4Gauh z;%YYIl%Q^{3KxxMeASkIx1P+J$SxWtwGu3WuBD`>b&w zce^ocETJdF{pf`Fxrim?7;Y?3ztvy3mJ_e|h4y%^)E6p}G7zR-taIV#g}A}37Pq$a zI_b%W!0&`VnSQ^0|0SombY8?3YTeRJ4`x{s3UK(X`HKBI-7wX!B+%aR}=(7beEvp z^XDNm%*oifc0$|k^RI^P_Cn%KkoVd(R-`@qm%fLX0k>_MN6mF;jGLGEfmFx>--$s6 zdr4h;J7KT(Ol-XOQPH&Pk`#HphxfwlOYgg#$#IY7cPT%=c-FYpU>!M88l)TYv0cBp z>Ru%DxnfA!1GYP^WbqGzaAYPwJ+!^a=NI!WdVz#K5#MPU-gNny!PVCt;_(8@C2_pR z+!4n5051?TqVLSWkGB7f9*H5)z0=L@Xf~8(dJ!$gzpe%$bL~Dx!MN|C@Gg?U!q3<1 zS?Lb_7CgPe9=(e!WyE2m|MT;{5^wxoJ-gpLsN%tJ=GD*jJ0XGvq5gQPbU5Dr>q;wB z!88spPcKc5DR3m8Jv@2V7V0`;*>5L7&NKU&#uN{PcXxO{WRG%AH{#QwT*QOdavfG;>noGecMChsQ?#GXIN4Vzeoe#`N(w#`IGDKrg63D&7sWbDiIm8eXDX7t7jS1T8epO5tLELfnJuXNl#^?=reE{t7| zwPUeSeKj2UMtJ9Tan-XGP3yYzV$9iMU`kp zv|6#Y-gzH365MrPxw!!Ivl zVi@gfprWM%e2N~}It3}LT4xRK<)+F!&+L8C)aY(z(&v*Ow9pxA-qM@_!0cacOH$-X2zP}tYmDMKOXRU z{Ntlah$DVQV}S{k`S6b)Ji$F#RFr)0^kE9s1fon>VVhad&jUk;d-h-;^_nc#QYWfo zgb#F1-^ zGp=vRZ-?qRVU}uW{>G@kFkX8+9Q*YB~CprI2$T%!)Z=YdgKB6xmd8p|R%YQbmF;SWmApN4%BS>#3hHLwOYc z<)NeTED%mZI!;5HxRZD{K;BjeG^J#*qp&-3KDwE z)Ij50e=aBgy{`P*mowW87$`SZAdkDXe{9|P7JT;{wFZx9px-6w$edK6K7d^TF; zed?$Kh`;L_3^aPdy+8_YO}@&H&T=_)qe(q6@9$$|iT6C8Tf+^1<%Qls`jtY&$>t+sk;V0K5YMp-ecm zd-mru@k*kG_~cww@M>$sC*981qr6I)!V`L)`%)s<1;T-GD~l zLL#DFtYBeaC`~yr z#JjnPd)rQ~Nv~<{e7&-5a(fg#PKdAzA{2LPIdt-}cM>U8^6{ef)t%6tlaca1cc*qj zf%BrF2L}V{ExtDkRzzprihjla?N|V)(=I@OM@E3P z^LTCMCNGz40Mb|v)+eLMJpj$c8gP9m0vbD`Ab?&v<2H;SxAi?=WQvR&N7*B|Z6#yPduE+K3GWPTp7p(i4C$B6@G{c+RU7 zy4Q|&@EvT!=Kw4{E}kyNP`-SY^YE1S$a=QU;f0|ukO5avZ8ryJ310Czp0ftZ=xA!- zbxVy%6@s3wQ}L|-&W6<3H=nXpOc?|bIPyRDxMnNtx9+Ub&nr{%+gJb?wQB|>qCK=} zr6-245e_K>`uSs_rrA;a;YXs-i%A`a(o;a}->yqng@DjeEn8C9HlHEcfgp!FHh`#D zdUzY)7c_OICBcpf#Rp?x!$8A!g|Z{k#Xuo-0SE@NuC{{R%hxq~>}2!%`-ZSdv~^=y z2LyaN!H`rv^lByIKh1cd5(-Rv1DrK4qa*^>8yWGk6w+Q)GsR$o2pU(S>-b1-jCEOl zdW#G5IX^7-K!+c^I{yXupu{w4cpcAAAI&-`HSWOMK1-x00Vw8J361C!JeX$C=X{6! z&7km+%icRniZ@$JOrK|fuDX%Pc2)fLL)@MC+tl_>ch`Q zCcNQv?S+doIG{ta7npZ9e&JBQ2XuieMLMQtY-^#Ijo%$54F|G7hH6N*LNiSbUcuGz zh@tDLY4UW=yVB`sk)sL%0UN8li_Ms$WqfYjtJlTn{4-N_joWtSnI6)Q%*Ik~6Ewhu zZQyMW1otG;`OHf)ok#uY!>=AI_?~UDHZC6w*lxr!0K*x0S{>0l{FAwI$xpkz2Jyyg zu`6UKxJzLf)x{rP+@VLnDH}e5&#lJ+E*(z8LNh={wFU4HDgh^3D%ZAKh?%d2rO~eU zdv!|yra{)-WrtEd5h=esY){`(L}0S02^D(qaijBMt6;5ddsEHS_e#tzj63|-Yr8sz z@cHwd#?m=&w896DJSLt5m;kj*>Wq3o_sl}QZJ1Ru?19+C0mvkKQhrP|R%In8bK4}Qs0x0Y0 zBzK7!{M`0-i(CpPg;;8@c4=JO_b;|XnPRGL6Hs=}HRFvlwGV5%)+kR2DMIndaE~Xx8K_`6>6> zKmriK8O>M&-NU1;X`Wkn7=b$hCu!EVwIKAp9id=Y?VPKZUG&~-!Ov?z50}<7lXEep~{Q9%%<;c=qGYj z%72-7*8%o|KlG^fGid7%w;OKGy+cuZK2k)p&{+@Ioa=nOUzkzVF7G91%M)}|x3XMf zwzbhR0(im#6u_u04=?vSNR`^J%4I`IQI?SI z(x2vIYfG1_YyRyp-YoQLJKv_j52bXnF=Kk0FCuA<$8&De^@vO=DXo#+NDBqYjSOpXKeU8lxi1MN}~%UnjE%tuw}HTkV42Wu95y^NFj*YfkE zrEX+6y_u5wMra9oi;#prxOXx7O4KRn@l4)Gb2&WKc^f{V2ng7-_Xgb)TqWyIBNy0s6C&;Wc*jS9{4cq<}_jO~gb@2RKP z<0i1?v!8FW;N#hfyd3cGi)!aH79q#A8$M+WIOt^}oU!*ipK%`s7V4cXQg-#vkI2W2 zFEVz6_Pn>s%VS0otDaoZ9(YzV&73}m@!P^bS$})_IfTyhV`6j5)uq?@3PdrYy|QQO zTgMLu7uk^BkUtE%sIl4saS;d}iT~yPYcm4({}!%(o?@KEJ9q@cYr9ZJ-tVYu;*?jg zGo>xODhkJC&eJ7GLi5G*SFEpgz;2h2p{u2k6qPzabXoHv^lNB%XtI9rT>Cb>I)>&T zSKYwPIVe^m`IU%iP;5(`;+(LMq^LTJ(#g*I410?5FL!`o!)0#U1pDSo_@zM3ocmF# zc{uXbU}%?0o_t?ad>sb}Y>9a-8rt%R+;M-JYt=^)g$zjv`yK4uc}&dU(@Vv0>-K4K zAISwqKtF^_sw~t#o1aPx;PZZ`gRskVYIQGSfi=0(>oxqLE3JUl`15uBECG8vuA~?c z_SX>}O44wi))-pGwL|3>5qRP^0N9?~G=!bXc3v(^y}mDVm|JxJib*~E{9DrD)4>7M zWAo{XHAAr^>0$i-6_G)5Nf2h+s3t~#RlG>Q++bMn*&>B>(dpzq?3-*{$W0rPoa{A$w$j>Q-H#q(-_wbBzVncj zlz*cNrad@QCZfwn8yCI#I2aoJA?JSjmjN;+xgG6pjaZ&+xvZp5bM59C9_sSt2oH-Rz^R6ly`7=+5B`RY)`#}174h&mW!@)*!Xp_;;aG2=sVnb!4cZy_Nd3#@UrD; zmuTp%xRX)2JKb~!O~R}8EQ+7@EDdGqcWI+tyL^daPQ^2lIKgIsaamY@li6$w*!@GV z8x;H~9ZF~0DJ{7bT_lG~>L^TJs`5iP`n8{{(G_MHt+6>%8b7YIp=Sj4*k)eabP*2! zkIVLT%?77`U!~?|8`(q~ooeA<YZ0s)uw(mcia&fmjw~poCvGIUN4v@1h(Z)X_E^2XNck$cO1pXrwh z3_lbzYsvtp@^0TPJF^fWC&UIiuk<*ECIVs=a%S@_rn0zdcX6_1_2ZT9O-oU|((J!q z<`i%qLh#=}z|ev4F*W+<2gVLS`a%o_wEzUw=?dSk4}w^m$yS$U!feS z#C^RZNj_sAFWJ^!#<;QqhqONyT?8G~BY-WZi(aHmTl692^nr>d zVXfHZCz5At>0o%yg~9!M%ff8xy`+loV1nu!@BX$_o_u&CckU_C2_QJvjAxOm51m^B zc28Ex52!8XYT*5a%ML3F{KIQ+c7A7v5D0FXh^&b#*4WL}L>q0g3a2@a4zx5BxS$G(z9V&ug~fmqrMCD1B=U zfm4@K<@%8Ao(pWo((f#L8=%<#CS*MLDyea&t;WLL_hdH_Hva(2RdeTcw599AN|vir zh+mZqo!1LiSGV2yx$Y<`b3`zm*J{sARLJ8N0ug|vb(W$#Z0&04b?+gBI`FypYD!Wa ztzpU5&mT6GL;Q&cG#8(+3p*jOPM_-ygSfoMx|Vs*A!pfMwbIJ3`oAB}Y&g|`TJD1* z)n*!Hy~N6+Fo$i&K*NAp^(g|6RPY-G5d_JNX^KdR)bJqvTOX3?x@Nr5(H|an-+RUGh$4lM%1vKEJFI{HB&s@c)Q6V&& zIb4R#n=WfBMNv!{(`2H*N-jyZf;7sm(Rb&Lgst;~%wgj7= zgMgdE;^>w%ruH2(9uP#_-gWk#>iuL))Q3D4ybt`hC^vP(XA(#)l4SfB((>M4pn z!|s8n9c0l#_V6iF5P+AUfT)_6gqFhVBM^HfF^uZThj!MjxLA7;PTHWJF6&ac?PpFq zz6D4s@%)(n&hMbVUjQwxCozSpFPFNZx@yM<@Zx?YsTtUKT`*-Hhj`R$O1#m~y^d&w zH2!kth-6JzaRWT`4qYUhux^ebMdBKFb>W}~gEx7*jH!_Z-QQwIPow-t?GmJ=F(~E$ zRZW%!-qX~+Lnz!?BCoWiW}SBC1&{FKdN)zaK&Q^S0>6( z`JF1fP5(JC{69ZJ0Bcjt{Qv4Y)2Jl3HIA33qO?-WGSjr-W}2y4X{m&rwDiOYP0b+( zG}8tLZkdRRnt9676sN*+%ru;F#u3W_I$2U`kb;tuBZA@tf*kMmu6tJZ!->TgSS;T6 z<=OjXKfh=H{|{hHMaNTPf}Wg#MHwRpOpJ6N==_w4eThB8yR{?!zT(gD%YWZ@(gzC$ zcl~FVQhv(Gz~`bS&jC`ia7F&yfu9}^goL{uph9lPv0K}I8XvG&v1#5o4uQy(tDEV% zCC%9q19XcoclwRIcYTVm$e}1|iPu^N$P8>W3=kN4{&NJhH1`VXWAQSra}z6~Pq56Y z4<;vxUeS=dl^Yg(nXx-`qBribzp+EHz;m6$LzH{nqVa06=^vlHuB+pve6c6e$;WH# zNX>?zuY#sZQIywX)cQ9%%G|wCT2MGv@9X>gvk{kDdhZ}FFW8m;>8;iwYQ-xXjue}Y zcD_RMTCcrrbqsQ2ey}B0-~}&aUzNsog44+TSTseq_*U$@N6`7ohQWN{ajDOss57+e zF_+lnW&doXVUU=Jo#}X`$uj4P8+0Q6zTBwERXV(up6h8<^SRpH-`9y?r8nf9o+Y=& zL67b)!&)c)EB}J;BTOrVRkDi$Vf(p-K#KfYX2rxJw;&v`Xbvt33_Hp`+f|=P?sj5~ z%*`GvL|nBE@hW@QAd*lfXWWub(Njx_1X|d|`1C!5rl#U;s1WKqii4fIauCN=a!2Z5-gJD_>N0e}jG+Iw#CF+CWDt@VAu;VFi0!3Kn+ z4H(ky9CO?F@M-)K*mhqHM9(E3_^#@3XICx?530}|X@ zp!HO-?R-}#pu3Cjb%m1b0i8{8a0vtew?JVndk6^8J13vSGx6Sz zgGSi!nYR#h|4l;Q230=~e`akBIFtTgA$zU?xP=QSFSPnKL+z-?y^GI}9YpKUnhp=Q z6x9N?dUWQU_u2r$J-MZlO_NVhTK5R(e3(E)&+)~Cs@}J&)!qGo@HQI41cCt-DJNDM=&60MUy0iw~^_dwY_&4Kti z5EsVh_=i| z8M&QDoJJ5QV5$4pdBL-blveJ=c~k&MYOya`{v+UtK1!OaoK5l(6|p_I?pOkIZfzQb z7#O4z=N<;tb2xe9(_V*>sk1HE2j~@#%q&9f&C_Gh?&NqKe_Fo;F)d!0B-})E8X#)>UrfC%?Oi5$oYNqI^UBv*lb1-==v>{+Im=NR~byYCj0T`CDg+L}6 zK+`@KRI@k8QsWk(AsG?#qB|Qp4)uC*1Tzf)w~lht`z6pqIBl-^br-0w9dyBqf1?e+ zPIvQ-)U-u&$@Kh%n~jXdQqqz^JT8!gvS}F)4MwQ-pv6@I#OB2-N`)*9&Wx46<2AlE zN!Qa3YKG#Z`HuzN%m;_A_>*{$1RuM&GGD{|_k3E9Nw%b`Ik+pVIsdP2r_+cs0T|d_ zWS~YLH`-%bW6kXm^rS7ba9@{1{7&3W7jodF0vBgIx=S+t3Wre{lQ;iM=AOP+lL%9Y znw;H1%Ku1{rqQxY+UbF`((t=S!>eP!m1s?BnfoPM4y5*JWv3bGbJd~l1 zXv%Du&tQ~KvFfWTwkipe;t!SzYs2{UhscNWV37;ONEPJnS$DWVk}BLl;*7&`FJUf7 z8}|e`o01rpe*F8=4}se}gYc!-71X0-&%QC+JWJ?aZBwJW>HbT(4Sj3N^S7w_NomCc zmUMCngCA$s3_R7Ed0_05TmtGlfLp3O7cATt_yf!?(`jhf_{*5wg8N^G_pjHu7c%n# zl8-LUW%M~MN24-Lh8%4xHpP#YD zTVi(O#n5?7bC-0Zh$USW-%T zyFdx6J^n2sZziG>kKp%k1WTT6#?zaCjkT8HU~Vv?ByQ9yd&lrNn|`QNV~`l*HZM5}f2Hl=mcZ6EUD98;U~kn_cNG4Qf$IxTV3&0tK~n)NHIBIF&2TF1 zABw(Xb(9t(0uq+qt;XLK8U++p9`LJ3(7^N=TB;9~f)p_;jBhNNX_GGnZHMRtYYkuE zr2aTj;oLi^$<_8pX_mVMDZTR8f<^frtk!CZ%^Et_m%5M= za*Z25WW-ay@4%C@C)G9Vg!+150 zU3&3tw24kN#Hpcmra(B%Nw8$!UIr7yV&4?#O&IG>$c_jNI9W+(zXy4+OmAn9Q0%(e z9naY(+1Tx4IO}Cz(_EJTE_)R&$5`JOsuBaucUAuPw}vx`p4U(BA6RW5=t2UOt|Jr* zey?7hf)2MCylOW=`yHs{WRs_cM@>AJ=XdYh*|Jpu<9r;Q-}*e{z=zu(5n0eaAcl%_ zqSkzmP^f&At?vT7Bb6l;l59!RFgj1&L#<5Sws#8Lo|59?5F2f5W@WcysjmH}M>tpIlt&i^g4rFCKO~Ru8V4K?r2npJ7JzLURY^%zD0xoe96;_{ z*vdFa{suQ2{G|@z@ebkKg7WMNV1g!y6yaLs?n2@1N(Qr}ugY(hnd0>xGWy1(-25)E z95$rOqNirB1*Cp{Wl0sRBH}qo(B(ja#!|Jjx$WaAvV>13hfC@Pu`lUOA#++Y7t>C? z4P6{pVFzb{I-bbAUwdkorcaq6#j}hhVRgFVMGGe^T&XNMS2ot59jQ@{7I~RzR!d{d}Y~1u*!J6SfU#4 zBsbbB6?|%w2WI~2J|H8FuXRmdHr(uwU3*@w_^>+AVcBtltX`-Ln%BqFuY|-$k`8R3 z44E9*v5lc4gb6htq&X8@pA5l21LMCVCGboq+!o(fOuB!qGZr<{fBiIev!9jMuMvU# ziTUt0|2o1u#s?|;r8$Jt&l%zshh|^jEW4;Q{7^UWfg!Q}nW!7@o5_tcshd%UhX4ua zuw)BEZ^hlyvWcam4nZyp25Az7x$o{H(htlDh;?^yo^bbc)JTZ_qp1G}H}p#~EAptK WD)ZCh-*VP~$8YBl7G-BW?*9j7w!jhq literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index c3fe515c1d..6986fb5d5a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -37,6 +37,12 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic ## Configure Microsoft Linux Software Repository +Microsoft Defender ATP for Linux can be deployed from one of the following channels (denoted below as *[channel]*): *insider-fast* or *prod*. Each of these channels corresponds to a Linux software repository. Instructions for configuring your device to use this repository are provided below. + +The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in *insider-fast* can try out new features before devices in *prod*. + +In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to use the *insider-fast* channel. + ### RHEL and variants (CentOS and Oracle EL) - Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/` @@ -44,13 +50,13 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step: > [!NOTE] - > In case of Oracle EL and CentOS 8, use [distro] as “rhel”. + > In case of Oracle EL and CentOS 8, use *[distro]* as “rhel”. ```bash - $ sudo yum-config-manager --add-repo=https://packages.microsoft.com/config/[distro]/[version]/insiders-fast.repo + $ sudo yum-config-manager --add-repo=https://packages.microsoft.com/config/[distro]/[version]/[channel].repo ``` - For example, if you are running CentOS 7: + For example, if you are running CentOS 7 and wish to deploy MDATP for Linux from the *insider-fast* channel: ```bash $ sudo yum-config-manager --add-repo=https://packages.microsoft.com/config/centos/7/insiders-fast.repo @@ -76,10 +82,10 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step. ```bash - $ sudo zypper addrepo -c -f -n microsoft-insiders-fast https://packages.microsoft.com/config/[distro]/[version]/insiders-fast.repo + $ sudo zypper addrepo -c -f -n microsoft-[channel] https://packages.microsoft.com/config/[distro]/[version]/[channel].repo ``` - For example, if you are running SLES 12: + For example, if you are running SLES 12 and wish to deploy MDATP for Linux from the *insider-fast* channel: ```bash $ sudo zypper addrepo -c -f -n microsoft-insiders-fast https://packages.microsoft.com/config/sles/12/insiders-fast.repo @@ -105,10 +111,10 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic In the below command, replace *[distro]* and *[version]* with the information identified in the previous step: ```bash - $ curl -o microsoft.list https://packages.microsoft.com/config/[distro]/[version]/insiders-fast.list + $ curl -o microsoft.list https://packages.microsoft.com/config/[distro]/[version]/[channel].list ``` - For example, if you are running Ubuntu 18.04: + For example, if you are running Ubuntu 18.04 and wish to deploy MDATP for Linux from the *insider-fast* channel: ```bash $ curl -o microsoft.list https://packages.microsoft.com/config/ubuntu/18.04/insiders-fast.list @@ -117,7 +123,7 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic - Install the repository configuration: ```bash - $ sudo mv ./microsoft.list /etc/apt/sources.list.d/microsoft-insiders-fast.list + $ sudo mv ./microsoft.list /etc/apt/sources.list.d/microsoft-[channel].list ``` - Install the gpg package if not already installed: @@ -163,7 +169,7 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic - Ubuntu and Debian system ```bash - sudo apt-get install -t insiders-fast mdatp + sudo apt-get install mdatp ``` ## Download onboarding package @@ -171,42 +177,44 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic Download the onboarding package from Microsoft Defender Security Center: 1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In the first drop down, set operating system to **Windows 10** and in second drop down, Deployment method to **Mobile Device Management / Microsoft Intune**. -3. Click on **Download package**. Save it as WindowsDefenderATPOnboardingPackage.zip. +2. In Section 1 of the page, set operating system to **Linux Server** and Deployment method to **Local script**. +3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. - ![Windows Defender Security Center screenshot](images/atp-portal-onboarding-win-intune.png) + ![Microsoft Defender Security Center screenshot](images/atp-portal-onboarding-linux.png) 4. From a command prompt, verify that you have the file. - Extract the contents of the .zip file and create mdatp_onboard.json file as follows: + Extract the contents of the archive: ```bash $ ls -l total 8 - -rw-r--r-- 1 test staff 6287 Oct 21 11:22 WindowsDefenderATPOnboardingPackage.zip - $ unzip -p WindowsDefenderATPOnboardingPackage.zip | python -c 'import sys,json;data={"onboardingInfo":"\n".join(sys.stdin.readlines())};print(json.dumps(data));' >mdatp_onboard.json + -rw-r--r-- 1 test staff 5752 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip + Archive: WindowsDefenderATPOnboardingPackage.zip + inflating: WindowsDefenderATPOnboarding.py ``` ## Client configuration -1. Copy WindowsDefenderATPOnboarding.py to the machine where you deploy Microsoft Defender ATP for Linux. +1. Copy WindowsDefenderATPOnboarding.py to the target machine. - The client machine is not associated with orgId. Note that the *orgId* attribute is blank. + Initially the client machine is not associated with an organization. Note that the *orgId* attribute is blank. ```bash $ mdatp --health orgId ``` -2. Copy the mdatp_onboard.json created in earlier step to /etc/opt/microsoft/mdatp_onboard.json +2. Run WindowsDefenderATPOnboarding.py (note that in order to run this command you must have `python` installed on the device). ```bash - $ sudo cp mdatp.json /etc/opt/microsoft/mdatp/mdatp_onboard.json + $ python WindowsDefenderATPOnboarding.py ``` -3. Verify that the machine is now associated with your organization and reports a valid *orgId*: +3. Verify that the machine is now associated with your organization and reports a valid organization identifier: ```bash $ mdatp --health orgId - E6875323-A6C0-4C60-87AD-114BBE7439B8 + [your organization identifier] ``` 4. A few minutes following the completion of the installation, you can see the status by running the following command. A return value of `'1'` denotes that the product is functioning as expected. @@ -216,18 +224,23 @@ Download the onboarding package from Microsoft Defender Security Center: 1 ``` -5. Run a detection test -To verify that the machine is properly onboarded and reporting to the service, take the following steps on the newly onboarded machine: +5. Run a detection test to verify that the machine is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded machine: + + - Ensure that real-time protection is enabled (denoted by a result of `1` from running the following command). + + ```bash + $ mdatp --health realTimeProtectionEnabled + 1 + ``` - - Ensure Real-time protection setting is ON ```mdatp --health realTimeProtectionEnabled``` - Open a Terminal window Copy and run the command below: ``` bash - curl -o ~/Downloads/eicar.com.txt http://www.eicar.org/download/eicar.com.txt + $ curl -o ~/Downloads/eicar.com.txt http://www.eicar.org/download/eicar.com.txt ``` -6. The file should have been quarantined by Microsoft Defender ATP for Linux. Use the following command to list all the detected threats: + - The file should have been quarantined by Microsoft Defender ATP for Linux. Use the following command to list all the detected threats: ```bash $ mdatp --threat --list --pretty diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md index 2c430ba593..016794bca5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -59,19 +59,20 @@ Before you get started, please see [the main Microsoft Defender ATP for Linux pa Download the onboarding package from Microsoft Defender Security Center: 1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In the first drop down, set operating system to **Windows 10** and in second drop down, Deployment method to **Mobile Device Management / Microsoft Intune**. +2. In the first drop down, set operating system to **Linux Server** and in second drop down, Deployment method to **Your preferred Linux configuration management tool**. 3. Click on **Download package**. Save it as WindowsDefenderATPOnboardingPackage.zip. - ![Windows Defender Security Center screenshot](images/atp-portal-onboarding-win-intune.png) + ![Microsoft Defender Security Center screenshot](images/atp-portal-onboarding-linux-2.png) -4. From a command prompt, verify that you have the file. - Extract the contents of the .zip file and create mdatp_onboard.json file as follows: +4. From a command prompt, verify that you have the file. Extract the contents of the archive: ```bash $ ls -l total 8 - -rw-r--r-- 1 test staff 6287 Oct 21 11:22 WindowsDefenderATPOnboardingPackage.zip - $ unzip -p WindowsDefenderATPOnboardingPackage.zip | python -c 'import sys,json;data={"onboardingInfo":"\n".join(sys.stdin.readlines())};print(json.dumps(data));' >mdatp_onboard.json + -rw-r--r-- 1 test staff 4984 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip + Archive: WindowsDefenderATPOnboardingPackage.zip + inflating: mdatp_onboard.json ``` ## Create Ansible YAML files @@ -91,16 +92,17 @@ Create subtask / role files which contribute to an actual task. Create below fil mode: '0644' ``` -- Create a `setup.sh` script which operates on onboarding blob +- Create a `setup.sh` script which operates on the onboarding file ```bash $ cat /root/setup.sh #!/bin/bash - # Unzip the file and creates license blob + # Unzip the file and create license file mkdir -p /etc/opt/microsoft/mdatp/ - unzip -p WindowsDefenderATPOnboardingPackage.zip | python -c 'import sys,json;data={"onboardingInfo":"\n".join(sys.stdin.readlines())};print(json.dumps(data));' > /etc/opt/microsoft/mdatp/mdatp_onboard.json + unzip WindowsDefenderATPOnboardingPackage.zip + cp mdatp_onboard.json /etc/opt/microsoft/mdatp/mdatp_onboard.json # get the GPG key curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg @@ -125,82 +127,96 @@ Create subtask / role files which contribute to an actual task. Create below fil - Add the Microsoft Defender ATP repository and key - ```bash - $ cat add_apt_repo.yml - - name: Add Microsoft repository for MDATP - apt_repository: - repo: deb [arch=arm64,armhf,amd64] https://packages.microsoft.com/ubuntu/16.04/prod insiders-fast main - update_cache: yes - state: present - filename: microsoft-insiders-fast.list + Microsoft Defender ATP for Linux can be deployed from one of the following channels (denoted below as *[channel]*): *insider-fast* or *prod*. Each of these channels corresponds to a Linux software repository. - - name: Add Microsoft APT key - apt_key: - keyserver: https://packages.microsoft.com/ - id: BC528686B50D79E339D3721CEB3E94ADBE1229C - ``` + The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in *insider-fast* can try out new features before devices in *prod*. -- For Yum based distributions use the following YML file + In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to use the *insider-fast* channel. - ```bash - $ cat add_yum_repo.yml - - name: Add Microsoft repository for MDATP - yum_repository: - name: packages-microsoft-com-prod-insiders-fast - description: Microsoft Defender ATP - file: microsoft-insiders-fast - baseurl: https://packages.microsoft.com/centos/7/insiders-fast/ - gpgcheck: yes - enabled: Yes - ``` + Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/`. -- Now create the actual install/uninstall YAML files under /etc/ansible/playbooks + In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step. - ```bash - $ cat install_mdatp.yml - - hosts: servers + - For apt-based distributions use the following YAML file + + ```bash + $ cat add_apt_repo.yml + - name: Add Microsoft repository for MDATP + apt_repository: + repo: deb [arch=arm64,armhf,amd64] https://packages.microsoft.com/[distro]/[version]/prod [channel] main + update_cache: yes + state: present + filename: microsoft-[channel].list + + - name: Add Microsoft APT key + apt_key: + keyserver: https://packages.microsoft.com/ + id: BC528686B50D79E339D3721CEB3E94ADBE1229C + ``` + + - For yum-based distributions use the following YAML file + + ```bash + $ cat add_yum_repo.yml + - name: Add Microsoft repository for MDATP + yum_repository: + name: packages-microsoft-com-prod-[channel] + description: Microsoft Defender ATP + file: microsoft-[channel] + baseurl: https://packages.microsoft.com/[distro]/[version]/[channel]/ + gpgcheck: yes + enabled: Yes + ``` + +- Create the actual install / uninstall YAML files under `/etc/ansible/playbooks` + + - For apt-based distributions use the following YAML file + + ```bash + $ cat install_mdatp.yml + - hosts: servers + tasks: + - include: ../roles/download_copy_blob.yml + - include: ../roles/setup_blob.yml + - include: ../roles/add_apt_repo.yml + - apt: + name: mdatp + state: latest + update_cache: yes + ``` + + ```bash + $ cat uninstall_mdatp.yml + - hosts: servers + tasks: + - apt: + name: mdatp + state: absent + ``` + + - For yum-based distributions use the following YAML file + + ```bash + $ cat install_mdatp_yum.yml + - hosts: servers tasks: - include: ../roles/download_copy_blob.yml - include: ../roles/setup_blob.yml - - include: ../roles/add_apt_repo.yml - - apt: + - include: ../roles/add_yum_repo.yml + - yum: name: mdatp state: latest - update_cache: yes - ``` + enablerepo: packages-microsoft-com-prod-insiders-fast + ``` - ```bash - $ cat uninstall_mdatp.yml - - hosts: servers - tasks: - - apt: - name: mdatp - state: absent - ``` - -- For the Yum based distribution - - ```bash - $ cat install_mdatp_yum.yml - - hosts: servers - tasks: - - include: ../roles/download_copy_blob.yml - - include: ../roles/setup_blob.yml - - include: ../roles/add_yum_repo.yml - - yum: - name: mdatp - state: latest - enablerepo: packages-microsoft-com-prod-insiders-fast - ``` - - ```bash - $ cat uninstall_mdatp_yum.yml - - hosts: servers - tasks: - - yum: - name: mdatp - state: absent - ``` + ```bash + $ cat uninstall_mdatp_yum.yml + - hosts: servers + tasks: + - yum: + name: mdatp + state: absent + ``` ## Deployment @@ -221,7 +237,10 @@ Now run the tasks files under `/etc/ansible/playbooks/` ## References -[Add or remove YUM repositories](https://docs.ansible.com/ansible/2.3/yum_repository_module.html)
-[Manage packages with the yum package manager](https://docs.ansible.com/ansible/latest/modules/yum_module.html)
-[Add and remove APT repositories](https://docs.ansible.com/ansible/latest/modules/apt_repository_module.html)
-[Manage apt-packages](https://docs.ansible.com/ansible/latest/modules/apt_module.html) \ No newline at end of file +- [Add or remove YUM repositories](https://docs.ansible.com/ansible/2.3/yum_repository_module.html) + +- [Manage packages with the yum package manager](https://docs.ansible.com/ansible/latest/modules/yum_module.html) + +- [Add and remove APT repositories](https://docs.ansible.com/ansible/latest/modules/apt_repository_module.html) + +- [Manage apt-packages](https://docs.ansible.com/ansible/latest/modules/apt_module.html) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md index f1af7f4cb0..a2f0a9375f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md @@ -42,19 +42,19 @@ In addition, for Puppet deployment, you need to be familiar with Puppet administ Download the onboarding package from Microsoft Defender Security Center: 1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In the first drop down, set operating system to **Windows 10** and in second drop down, Deployment method to **Mobile Device Management / Microsoft Intune**. +2. In the first drop down, set operating system to **Linux Server** and in second drop down, Deployment method to **Your preferred Linux configuration management tool**. 3. Click on **Download package**. Save it as WindowsDefenderATPOnboardingPackage.zip. - ![Windows Defender Security Center screenshot](images/atp-portal-onboarding-win-intune.png) + ![Microsoft Defender Security Center screenshot](images/atp-portal-onboarding-linux-2.png) -4. From a command prompt, verify that you have the file. - Extract the contents of the .zip file and create mdatp_onboard.json file as follows: +4. From a command prompt, verify that you have the file. Extract the contents of the archive: ```bash $ ls -l total 8 - -rw-r--r-- 1 test staff 6287 Oct 21 11:22 WindowsDefenderATPOnboardingPackage.zip - $ unzip -p WindowsDefenderATPOnboardingPackage.zip | python -c 'import sys,json;data={"onboardingInfo":"\n".join(sys.stdin.readlines())};print(json.dumps(data));' >mdatp_onboard.json + -rw-r--r-- 1 test staff 4984 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip + Archive: WindowsDefenderATPOnboardingPackage.zip + inflating: mdatp_onboard.json ``` ## Create Puppet manifest diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md index fde2118685..e38317e818 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md @@ -254,7 +254,7 @@ The following configuration profile will: }, "cloudService":{ "automaticSampleSubmission":true, - "enabled":true, + "enabled":true } } ``` @@ -303,11 +303,11 @@ The following configuration profile contains entries for all settings described "cloudService":{ "enabled":true, "diagnosticLevel":"optional", - "automaticSampleSubmission":true, + "automaticSampleSubmission":true } } ``` ## Configuration profile deployment -Once you've built the configuration profile for your enterprise, you can deploy it through the management tool that your enterprise is using. Microsoft M reads the managed configuration from the file */etc/opt/microsoft/mdatp/managed/mdatp_managed.json* +Once you've built the configuration profile for your enterprise, you can deploy it through the management tool that your enterprise is using. Microsoft Defender ATP for Linux reads the managed configuration from the file */etc/opt/microsoft/mdatp/managed/mdatp_managed.json* diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md index 295efbedca..00a3968eb8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md @@ -60,7 +60,7 @@ If you can reproduce a problem, please increase the logging level, run the syste If an error occurs during installation, the installer will only report a general failure. -The detailed log will be saved to /var/log/microsoft/mdatp_install.log. If you experience issues during installation, send us this file so we can help diagnose the cause. +The detailed log will be saved to `/var/log/microsoft/mdatp_install.log`. If you experience issues during installation, send us this file so we can help diagnose the cause. ## Uninstalling diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md index 1205d192a5..0f13038052 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md @@ -59,8 +59,8 @@ In general you need to take the following steps: - Oracle Enterprise Linux 7 - Minimum kernel version 2.6.38 -- The **fanotify** kernel option must be enabled -- Disk space: 650 MB. +- The *fanotify* kernel option must be enabled +- Disk space: 650 MB After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints. @@ -96,23 +96,14 @@ The output from this command should be similar to the following: > `OK https://x.cp.wd.microsoft.com/api/report` > `OK https://cdn.x.cp.wd.microsoft.com/ping` -You can also use ```mdatp --connectivity-test``` to verify the connectivity. - +Once Microsoft Defender ATP is installed, connectivity can be validated by running the following command in Terminal: ```bash $ mdatp --connectivity-test -Running connectivity test -Testing connection with https://cdn.x.cp.wd.microsoft.com/ping ... [OK] -Testing connection with https://eu-cdn.x.cp.wd.microsoft.com/ping ... [OK] -Testing connection with https://wu-cdn.x.cp.wd.microsoft.com/ping ... [OK] -Testing connection with https://unitedstates.x.cp.wd.microsoft.com/api/report ... [OK] -Testing connection with https://ussus1eastprod.blob.core.windows.net ... [OK] -Testing connection with https://ussus1westprod.blob.core.windows.net ... [OK] ``` - ## How to update Microsoft Defender ATP for Linux -Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Linux, refer to [Deploy updates for Microsoft Defender ATP for Linux](linux-updates.md) +Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. To update Microsoft Defender ATP for Linux, refer to [Deploy updates for Microsoft Defender ATP for Linux](linux-updates.md). ## How to configure Microsoft Defender ATP for Linux @@ -120,17 +111,13 @@ Guidance for how to configure the product in enterprise environments is availabl ## Known Issues -- When a large volume of threats are encountered on the device, the product might exhibit increasingly large memory consumption (until the next product restart / system reboot). The engineering team is actively working on a mitigation for this - Logged on users do not appear in the ATP portal -- While we are working on creating a better onboarding experience for Linux in the Microsoft Defender Security Center portal, the steps below temporarily point to the Windows section of the portal for getting the onboarding package -- In SUSE distributions, if the libatomic1 failed to be installed please validate that your OS is registered by typing the following command in the terminal: +- In SUSE distributions, if installation of *libatomic1* fails, validate that your OS is registered: ```bash -sudo SUSEConnect --status-text +$ sudo SUSEConnect --status-text ``` ## Resources - For more information about logging, uninstalling, or other topics, see the [Resources](linux-resources.md) page. - -- [Privacy for Microsoft Defender ATP for Linux](linux-privacy.md) From 57b1726dd4d99b221d3dbbe36a08d93129ebbd1d Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Tue, 18 Feb 2020 22:19:42 -0800 Subject: [PATCH 43/69] Cleanup --- .../linux-install-manually.md | 3 +- .../linux-install-with-ansible.md | 15 +++++---- .../linux-install-with-puppet.md | 33 +++++++++++++------ .../microsoft-defender-atp/linux-resources.md | 2 +- 4 files changed, 35 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 6986fb5d5a..a7d5745aeb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -178,7 +178,7 @@ Download the onboarding package from Microsoft Defender Security Center: 1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. 2. In Section 1 of the page, set operating system to **Linux Server** and Deployment method to **Local script**. -3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. +3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip. ![Microsoft Defender Security Center screenshot](images/atp-portal-onboarding-linux.png) @@ -189,6 +189,7 @@ Download the onboarding package from Microsoft Defender Security Center: $ ls -l total 8 -rw-r--r-- 1 test staff 5752 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip inflating: WindowsDefenderATPOnboarding.py diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md index 016794bca5..e45283ab7d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -36,7 +36,7 @@ This topic describes how to deploy Microsoft Defender ATP for Linux through Ansi Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. - Ansible needs to be installed at least on one computer (we will call it master) -- Password less SSH must be configured for root user between Master and all clients +- Passwordless SSH must be configured for root user between the master and all clients - Below software must be installed on all clients - python-apt - curl @@ -79,7 +79,7 @@ Download the onboarding package from Microsoft Defender Security Center: Create subtask / role files which contribute to an actual task. Create below files under `/etc/ansible/roles` directory. -- Copy onboarding package on all client machines +- Copy onboarding package to all client machines ```bash $ cat /etc/ansible/roles/copy_onboarding_pkg.yml @@ -99,7 +99,7 @@ Create subtask / role files which contribute to an actual task. Create below fil #!/bin/bash - # Unzip the file and create license file + # Unzip the archive and create the onboarding file mkdir -p /etc/opt/microsoft/mdatp/ unzip WindowsDefenderATPOnboardingPackage.zip cp mdatp_onboard.json /etc/opt/microsoft/mdatp/mdatp_onboard.json @@ -109,7 +109,7 @@ Create subtask / role files which contribute to an actual task. Create below fil sudo mv microsoft.gpg /etc/apt/trusted.gpg.d/ ``` -- Create onboarding blob +- Create the onboarding file ```bash $ cat setup_blob.yml @@ -121,7 +121,7 @@ Create subtask / role files which contribute to an actual task. Create below fil group: root mode: '0744' - - name: Run a script to create license blob + - name: Run a script to create the onboarding file script: /root/setup.sh ``` @@ -137,6 +137,9 @@ Create subtask / role files which contribute to an actual task. Create below fil In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step. + > [!NOTE] + > In case of Oracle EL and CentOS 8, use *[distro]* as “rhel”. + - For apt-based distributions use the following YAML file ```bash @@ -206,7 +209,7 @@ Create subtask / role files which contribute to an actual task. Create below fil - yum: name: mdatp state: latest - enablerepo: packages-microsoft-com-prod-insiders-fast + enablerepo: packages-microsoft-com-prod-[channel] ``` ```bash diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md index a2f0a9375f..dfd667c83c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md @@ -35,7 +35,7 @@ This topic describes how to deploy Microsoft Defender ATP for Linux through Pupp Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. -In addition, for Puppet deployment, you need to be familiar with Puppet administration tasks, have a Puppet configured, and know how to deploy packages. Puppet has many ways to complete the same task. These instructions assume availability of supported puppet modules such as *apt* to help deploy the package. Your organization might use a different workflow. Please refer to [Puppet documentation](https://puppet.com/docs) for details. +In addition, for Puppet deployment, you need to be familiar with Puppet administration tasks, have a Puppet configured, and know how to deploy packages. Puppet has many ways to complete the same task. These instructions assume availability of supported Puppet modules such as *apt* to help deploy the package. Your organization might use a different workflow. Please refer to the [Puppet documentation](https://puppet.com/docs) for details. ## Download onboarding package @@ -59,9 +59,9 @@ Download the onboarding package from Microsoft Defender Security Center: ## Create Puppet manifest -You need to create a puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by puppet server. This example makes use of *apt* module available from puppetlabs and assumes that apt module has been installed on your puppet server. +You need to create a Puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by a Puppet server. This example makes use of *apt* module available from puppetlabs and assumes that apt module has been installed on your Puppet server. -Create a folders *install_mdatp/files* and *install_mdatp/manifests* under the modules folder of your puppet installation. This typically is located in */etc/puppetlabs/code/environments/production/modules* on your puppet server. Copy the mdatp_onboard.json file created in above step to *install_mdatp/files* folder. Create *init.pp* file which will contain the deployment instructions. +Create a folders *install_mdatp/files* and *install_mdatp/manifests* under the modules folder of your Puppet installation. This typically is located in */etc/puppetlabs/code/environments/production/modules* on your Puppet server. Copy the mdatp_onboard.json file created in above step to *install_mdatp/files* folder. Create a *init.pp* file which contains the deployment instructions. ```bash $ pwd @@ -75,15 +75,28 @@ install_mdatp └── init.pp ``` -Contents of *install_mdatp/manifests/init.pp* +### Contents of `install_mdatp/manifests/init.pp` + +Microsoft Defender ATP for Linux can be deployed from one of the following channels (denoted below as *[channel]*): *insider-fast* or *prod*. Each of these channels corresponds to a Linux software repository. + +The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in *insider-fast* can try out new features before devices in *prod*. + +In order to preview new features and provide early feedback, it is recommended that you configure some devices in your enterprise to use the *insider-fast* channel. + +Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/`. + +In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step. + +> [!NOTE] +> In case of Oracle EL and CentOS 8, use *[distro]* as “rhel”. ```puppet class install_mdatp { if ($osfamily == 'Debian') { apt::source { 'microsoftpackages' : - location => 'https://packages.microsoft.com/ubuntu/18.04/prod', # change the version and distro based on your OS - release => 'stable', + location => 'https://packages.microsoft.com/[distro]/[version]/prod', # change the version and distro based on your OS + release => '[channel]', repos => 'main', key => { 'id' => 'BC528686B50D79E339D3721CEB3E94ADBE1229CF', @@ -93,7 +106,7 @@ class install_mdatp { } else { yumrepo { 'microsoftpackages' : - baseurl => 'https://packages.microsoft.com/rhel/7/prod', # change the version and distro based on your OS + baseurl => 'https://packages.microsoft.com/[distro]/[version]/[channel]', # change the version and distro based on your OS enabled => 1, gpgcheck => 1, gpgkey => 'https://packages.microsoft.com/keys/microsoft.asc' @@ -127,7 +140,7 @@ node "default" { Enrolled agent devices periodically poll the Puppet Server, and install new configuration profiles and policies as soon as they are detected. -## Monitoring puppet deployment +## Monitoring Puppet deployment On the agent machine, you can also check the onboarding status by running: @@ -135,13 +148,13 @@ On the agent machine, you can also check the onboarding status by running: $ mdatp --health ... licensed : true -orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" +orgId : "[your organization identifier]" ... ``` - **licensed**: This confirms that the device has an ATP license. -- **orgid**: Your Microsoft Defender ATP org id; it will be the same for your organization. +- **orgid**: your Microsoft Defender ATP org id; it will be the same for your organization. ## Check onboarding status diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md index 00a3968eb8..e3e5cf0f15 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md @@ -69,7 +69,7 @@ There are several ways to uninstall Microsoft Defender ATP for Linux. If you are ### Manual uninstallation - ```sudo apt-get purge mdatp``` for Debian and Ubuntu systems -- ```sudo yum remove mdatp``` for RHEL, Oracle Linux, CentOS based systems +- ```sudo yum remove mdatp``` for RHEL, Oracle Linux, and CentOS based systems ## Configuring from the command line From c9c874eb7e2d7f3ae55f9dae61317d4e7b6c4aac Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Tue, 18 Feb 2020 22:41:16 -0800 Subject: [PATCH 44/69] More details; cleanup --- .../microsoft-defender-atp/linux-install-manually.md | 4 ++-- .../linux-install-with-ansible.md | 6 +++++- .../linux-install-with-puppet.md | 11 ++++++----- 3 files changed, 13 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index a7d5745aeb..cbb09354b6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -189,7 +189,7 @@ Download the onboarding package from Microsoft Defender Security Center: $ ls -l total 8 -rw-r--r-- 1 test staff 5752 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip - + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip inflating: WindowsDefenderATPOnboarding.py @@ -218,7 +218,7 @@ Download the onboarding package from Microsoft Defender Security Center: [your organization identifier] ``` -4. A few minutes following the completion of the installation, you can see the status by running the following command. A return value of `'1'` denotes that the product is functioning as expected. +4. A few minutes following the completion of the installation, you can see the status by running the following command. A return value of `1` denotes that the product is functioning as expected. ```bash $ mdatp --health healthy diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md index e45283ab7d..471190a7e3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -77,7 +77,7 @@ Download the onboarding package from Microsoft Defender Security Center: ## Create Ansible YAML files -Create subtask / role files which contribute to an actual task. Create below files under `/etc/ansible/roles` directory. +Create subtask / role files which contribute to an actual task. Create the below files under the `/etc/ansible/roles` directory. - Copy onboarding package to all client machines @@ -238,6 +238,10 @@ Now run the tasks files under `/etc/ansible/playbooks/` `# ansible-playbook /etc/ansible/playbooks/uninstall_mdatp.yml -i /etc/ansible/hosts` +## Logging installation issues + +See [Logging installation issues](linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. + ## References - [Add or remove YUM repositories](https://docs.ansible.com/ansible/2.3/yum_repository_module.html) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md index dfd667c83c..5fdc1c6ff3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md @@ -35,7 +35,7 @@ This topic describes how to deploy Microsoft Defender ATP for Linux through Pupp Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. -In addition, for Puppet deployment, you need to be familiar with Puppet administration tasks, have a Puppet configured, and know how to deploy packages. Puppet has many ways to complete the same task. These instructions assume availability of supported Puppet modules such as *apt* to help deploy the package. Your organization might use a different workflow. Please refer to the [Puppet documentation](https://puppet.com/docs) for details. +In addition, for Puppet deployment, you need to be familiar with Puppet administration tasks, have Puppet configured, and know how to deploy packages. Puppet has many ways to complete the same task. These instructions assume availability of supported Puppet modules such as *apt* to help deploy the package. Your organization might use a different workflow. Please refer to the [Puppet documentation](https://puppet.com/docs) for details. ## Download onboarding package @@ -53,6 +53,7 @@ Download the onboarding package from Microsoft Defender Security Center: $ ls -l total 8 -rw-r--r-- 1 test staff 4984 Feb 18 11:22 WindowsDefenderATPOnboardingPackage.zip + $ unzip WindowsDefenderATPOnboardingPackage.zip Archive: WindowsDefenderATPOnboardingPackage.zip inflating: mdatp_onboard.json ``` @@ -152,9 +153,9 @@ orgId : "[your organization identifier]" ... ``` -- **licensed**: This confirms that the device has an ATP license. +- **licensed**: This confirms that the device is tied to your organization. -- **orgid**: your Microsoft Defender ATP org id; it will be the same for your organization. +- **orgId**: your Microsoft Defender ATP organization identifier. ## Check onboarding status @@ -164,12 +165,12 @@ You can check that devices have been correctly onboarded by creating a script. F $ mdatp --health healthy ``` -The above command prints "1" if the product is onboarded and functioning as expected. +The above command prints `1` if the product is onboarded and functioning as expected. If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: - 1 if the device is not yet onboarded -- 3 if the connection to the daemon cannot be established—for example, if the daemon is not running +- 3 if the connection to the daemon cannot be established ## Logging installation issues From bf5a4ff2348a4123e9dfbd192739a10e26a8fede Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Tue, 18 Feb 2020 22:51:59 -0800 Subject: [PATCH 45/69] Update preferences --- .../linux-preferences.md | 47 ++++++++++++++++++- 1 file changed, 45 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md index e38317e818..d98c03bf83 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md @@ -75,6 +75,17 @@ Whether the antivirus engine runs in passive mode or not. In passive mode: | **Possible values** | false (default)
true | | **Comments** | Available in Microsoft Defender ATP version 100.67.60 or higher. | +#### Exclusion merge policy + +Specify the merge policy for exclusions. This can be a combination of administrator-defined and user-defined exclusions (`merge`) or only administrator-defined exclusions (`admin_only`). This setting can be used to restrict local users from defining their own exclusions. + +||| +|:---|:---| +| **Key** | exclusionsMergePolicy | +| **Data type** | String | +| **Possible values** | merge (default)
admin_only | +| **Comments** | Available in Microsoft Defender ATP version 100.83.73 or higher. | + #### Scan exclusions Entities that have been excluded from the scan. Exclusions can be specified by full paths, extensions, or file names. @@ -128,9 +139,9 @@ Used to exclude content from the scan by file extension. | **Possible values** | valid file extensions | | **Comments** | Applicable only if *$type* is *excludedFileExtension* | -**Name of excluded content** +**Process excluded from the scan** -Used to exclude content from the scan by file name. +Specify a process for which all file activity is excluded from scanning. The process can be specified either by its name (e.g. `cat`) or full path (e.g. `/bin/cat`). ||| |:---|:---| @@ -148,6 +159,17 @@ List of threats (identified by their name) that are not blocked by the product a | **Key** | allowedThreats | | **Data type** | Array of strings | +#### Disallowed threat actions + +Restricts the actions that the local user of a device can take when threats are detected. The actions included in this list are not displayed in the user interface. + +||| +|:---|:---| +| **Key** | disallowedThreatActions | +| **Data type** | Array of strings | +| **Possible values** | allow (restricts users from allowing threats)
restore (restricts users from restoring threats from the quarantine) | +| **Comments** | Available in Microsoft Defender ATP version 100.83.73 or higher. | + #### Threat type settings The *threatTypeSettings* preference in the antivirus engine is used to control how certain threat types are handled by the product. @@ -182,6 +204,17 @@ Action to take when coming across a threat of the type specified in the precedin | **Data type** | String | | **Possible values** | audit (default)
block
off | +#### Threat type settings merge policy + +Specify the merge policy for threat type settings. This can be a combination of administrator-defined and user-defined settings (`merge`) or only administrator-defined settings (`admin_only`). This setting can be used to restrict local users from defining their own settings for different threat types. + +||| +|:---|:---| +| **Key** | threatTypeSettingsMergePolicy | +| **Data type** | String | +| **Possible values** | merge (default)
admin_only | +| **Comments** | Available in Microsoft Defender ATP version 100.83.73 or higher. | + ### Cloud delivered protection preferences The *cloudService* entry in the configuration profile is used to configure the cloud driven protection feature of the product. @@ -270,6 +303,7 @@ The following configuration profile contains entries for all settings described "antivirusEngine":{ "enableRealTimeProtection":true, "passiveMode":false, + "exclusionsMergePolicy":"merge", "exclusions":[ { "$type":"excludedPath", @@ -284,11 +318,20 @@ The following configuration profile contains entries for all settings described { "$type":"excludedFileExtension", "extension":"pdf" + }, + { + "$type":"excludedFileName", + "name":"cat" } ], "allowedThreats":[ "EICAR-Test-File (not a virus)" ], + "disallowedThreatActions":[ + "allow", + "restore" + ], + "threatTypeSettingsMergePolicy":"merge", "threatTypeSettings":[ { "key":"potentially_unwanted_application", From 62c91eca754faec91fef5daa677e582cb93f304b Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Tue, 18 Feb 2020 23:09:50 -0800 Subject: [PATCH 46/69] . --- .../linux-install-with-ansible.md | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md index 471190a7e3..262a71ba40 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -37,12 +37,12 @@ Before you get started, please see [the main Microsoft Defender ATP for Linux pa - Ansible needs to be installed at least on one computer (we will call it master) - Passwordless SSH must be configured for root user between the master and all clients -- Below software must be installed on all clients +- The following software must be installed on all clients: - python-apt - curl - unzip -- All host must be listed in the following format in `/etc/ansible/hosts` file +- All host must be listed in the following format in `/etc/ansible/hosts` file: ```bash [servers] @@ -79,7 +79,7 @@ Download the onboarding package from Microsoft Defender Security Center: Create subtask / role files which contribute to an actual task. Create the below files under the `/etc/ansible/roles` directory. -- Copy onboarding package to all client machines +- Copy onboarding package to all client machines: ```bash $ cat /etc/ansible/roles/copy_onboarding_pkg.yml @@ -92,7 +92,7 @@ Create subtask / role files which contribute to an actual task. Create the below mode: '0644' ``` -- Create a `setup.sh` script which operates on the onboarding file +- Create a `setup.sh` script which operates on the onboarding file: ```bash $ cat /root/setup.sh @@ -109,7 +109,7 @@ Create subtask / role files which contribute to an actual task. Create the below sudo mv microsoft.gpg /etc/apt/trusted.gpg.d/ ``` -- Create the onboarding file +- Create the onboarding file: ```bash $ cat setup_blob.yml @@ -140,7 +140,7 @@ Create subtask / role files which contribute to an actual task. Create the below > [!NOTE] > In case of Oracle EL and CentOS 8, use *[distro]* as “rhel”. - - For apt-based distributions use the following YAML file + - For apt-based distributions use the following YAML file: ```bash $ cat add_apt_repo.yml @@ -157,7 +157,7 @@ Create subtask / role files which contribute to an actual task. Create the below id: BC528686B50D79E339D3721CEB3E94ADBE1229C ``` - - For yum-based distributions use the following YAML file + - For yum-based distributions use the following YAML file: ```bash $ cat add_yum_repo.yml @@ -173,7 +173,7 @@ Create subtask / role files which contribute to an actual task. Create the below - Create the actual install / uninstall YAML files under `/etc/ansible/playbooks` - - For apt-based distributions use the following YAML file + - For apt-based distributions use the following YAML file: ```bash $ cat install_mdatp.yml @@ -197,7 +197,7 @@ Create subtask / role files which contribute to an actual task. Create the below state: absent ``` - - For yum-based distributions use the following YAML file + - For yum-based distributions use the following YAML file: ```bash $ cat install_mdatp_yum.yml @@ -229,12 +229,12 @@ Now run the tasks files under `/etc/ansible/playbooks/` `# ansible-playbook /etc/ansible/playbooks/install_mdatp.yml -i /etc/ansible/hosts` -- Validation / Configuration +- Validation / configuration `# ansible -m shell -a 'mdatp --connectivity-test' all`
`# ansible -m shell -a 'mdatp --health' all` -- Un-Installation +- Uninstallation `# ansible-playbook /etc/ansible/playbooks/uninstall_mdatp.yml -i /etc/ansible/hosts` From 9fbc2c1e1423b7f3cd9008742fead4c382ffb469 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Tue, 18 Feb 2020 23:12:44 -0800 Subject: [PATCH 47/69] . --- .../linux-install-with-ansible.md | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md index 262a71ba40..930f27761c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -52,7 +52,9 @@ Before you get started, please see [the main Microsoft Defender ATP for Linux pa - Ping test - ```$ ansible -m ping all``` + ```bash + $ ansible -m ping all + ``` ## Download onboarding package @@ -227,16 +229,22 @@ Now run the tasks files under `/etc/ansible/playbooks/` - Installation - `# ansible-playbook /etc/ansible/playbooks/install_mdatp.yml -i /etc/ansible/hosts` + ```bash + $ ansible-playbook /etc/ansible/playbooks/install_mdatp.yml -i /etc/ansible/hosts + ``` - Validation / configuration - `# ansible -m shell -a 'mdatp --connectivity-test' all`
- `# ansible -m shell -a 'mdatp --health' all` + ```bash + $ ansible -m shell -a 'mdatp --connectivity-test' all + $ ansible -m shell -a 'mdatp --health' all + ``` - Uninstallation - `# ansible-playbook /etc/ansible/playbooks/uninstall_mdatp.yml -i /etc/ansible/hosts` + ```bash + $ ansible-playbook /etc/ansible/playbooks/uninstall_mdatp.yml -i /etc/ansible/hosts + ``` ## Logging installation issues From 6d8e77b85d2c7b94035e9f263fa6aff08b001972 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Tue, 18 Feb 2020 23:18:50 -0800 Subject: [PATCH 48/69] . --- .../threat-protection/microsoft-defender-atp/linux-updates.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md b/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md index a75a02fd2d..2d951143c0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md @@ -26,7 +26,7 @@ ms.topic: conceptual Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. -To update Microsoft Defender ATP for Linux manually, execute command +To update Microsoft Defender ATP for Linux manually, execute the following command: - ### For Debian family distros From 3119273924ea6c5d4f7bb625e57ff6e2928448f8 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 19 Feb 2020 16:20:33 -0800 Subject: [PATCH 49/69] . --- .../linux-install-manually.md | 15 +++++++------- .../linux-install-with-ansible.md | 8 ++++---- .../linux-install-with-puppet.md | 8 ++++---- .../microsoft-defender-atp/linux-updates.md | 20 ++++++++++++------- 4 files changed, 28 insertions(+), 23 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index cbb09354b6..9626030b11 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -27,8 +27,8 @@ ms.topic: conceptual This topic describes how to deploy Microsoft Defender ATP for Linux manually. A successful deployment requires the completion of all of the following steps: - [Configure Microsoft's Linux Software Repository](#configure-microsoft-linux-software-repository) -- [Download onboarding packages](#download-onboarding-package) - [Application installation](#application-installation) +- [Download onboarding packages](#download-onboarding-package) - [Client configuration](#client-configuration) ## Prerequisites and system requirements @@ -37,7 +37,7 @@ Before you get started, see [the main Microsoft Defender ATP for Linux page](mic ## Configure Microsoft Linux Software Repository -Microsoft Defender ATP for Linux can be deployed from one of the following channels (denoted below as *[channel]*): *insider-fast* or *prod*. Each of these channels corresponds to a Linux software repository. Instructions for configuring your device to use this repository are provided below. +Microsoft Defender ATP for Linux can be deployed from one of the following channels (denoted below as *[channel]*): *insider-fast* or *prod*. Each of these channels corresponds to a Linux software repository. Instructions for configuring your device to use one of these repositories are provided below. The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in *insider-fast* can try out new features before devices in *prod*. @@ -50,7 +50,7 @@ In order to preview new features and provide early feedback, it is recommended t In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step: > [!NOTE] - > In case of Oracle EL and CentOS 8, use *[distro]* as “rhel”. + > In case of Oracle EL and CentOS 8, replace *[distro]* with “rhel”. ```bash $ sudo yum-config-manager --add-repo=https://packages.microsoft.com/config/[distro]/[version]/[channel].repo @@ -100,7 +100,7 @@ In order to preview new features and provide early feedback, it is recommended t ### Ubuntu and Debian systems -- Install `‘curl’` if not already installed: +- Install `curl` if it is not already installed: ```bash $ sudo apt-get install curl @@ -177,8 +177,8 @@ In order to preview new features and provide early feedback, it is recommended t Download the onboarding package from Microsoft Defender Security Center: 1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In Section 1 of the page, set operating system to **Linux Server** and Deployment method to **Local script**. -3. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip. +2. In the first drop down, select **Linux Server** as the operating system. In the second drop down, select **Local Script (for up to 10 machines)** as the deployment method. +3. Click on **Download onboarding package**. Save the file as WindowsDefenderATPOnboardingPackage.zip. ![Microsoft Defender Security Center screenshot](images/atp-portal-onboarding-linux.png) @@ -234,8 +234,7 @@ Download the onboarding package from Microsoft Defender Security Center: 1 ``` - - Open a Terminal window -Copy and run the command below: + - Open a Terminal window. Copy and execute the following command: ``` bash $ curl -o ~/Downloads/eicar.com.txt http://www.eicar.org/download/eicar.com.txt diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md index 930f27761c..ebe4a8e842 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -26,7 +26,7 @@ ms.topic: conceptual This topic describes how to deploy Microsoft Defender ATP for Linux through Ansible. A successful deployment requires the completion of all of the following steps: -- [Download the onboarding packages](#download-onboarding-package) +- [Download onboarding package](#download-onboarding-package) - [Create Ansible YAML files](#create-ansible-yaml-files) - [Deployment](#deployment) - [References](#references) @@ -61,8 +61,8 @@ Before you get started, please see [the main Microsoft Defender ATP for Linux pa Download the onboarding package from Microsoft Defender Security Center: 1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In the first drop down, set operating system to **Linux Server** and in second drop down, Deployment method to **Your preferred Linux configuration management tool**. -3. Click on **Download package**. Save it as WindowsDefenderATPOnboardingPackage.zip. +2. In the first drop down, select **Linux Server** as the operating system. In the second drop down, select **Your preferred Linux configuration management tool** as the deployment method. +3. Click on **Download onboarding package**. Save the file as WindowsDefenderATPOnboardingPackage.zip. ![Microsoft Defender Security Center screenshot](images/atp-portal-onboarding-linux-2.png) @@ -140,7 +140,7 @@ Create subtask / role files which contribute to an actual task. Create the below In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step. > [!NOTE] - > In case of Oracle EL and CentOS 8, use *[distro]* as “rhel”. + > In case of Oracle EL and CentOS 8, replace *[distro]* with “rhel”. - For apt-based distributions use the following YAML file: diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md index 5fdc1c6ff3..783fd9d3ad 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md @@ -26,7 +26,7 @@ ms.topic: conceptual This topic describes how to deploy Microsoft Defender ATP for Linux through Puppet. A successful deployment requires the completion of all of the following steps: -- [Download installation and onboarding packages](#download-onboarding-package) +- [Download onboarding packages](#download-onboarding-package) - [Create Puppet manifest](#create-puppet-manifest) - [Deployment](#deployment) - [Check onboarding status](#check-onboarding-status) @@ -42,8 +42,8 @@ In addition, for Puppet deployment, you need to be familiar with Puppet administ Download the onboarding package from Microsoft Defender Security Center: 1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In the first drop down, set operating system to **Linux Server** and in second drop down, Deployment method to **Your preferred Linux configuration management tool**. -3. Click on **Download package**. Save it as WindowsDefenderATPOnboardingPackage.zip. +2. In the first drop down, select **Linux Server** as the operating system. In the second drop down, select **Your preferred Linux configuration management tool** as the deployment method. +3. Click on **Download onboarding package**. Save the file as WindowsDefenderATPOnboardingPackage.zip. ![Microsoft Defender Security Center screenshot](images/atp-portal-onboarding-linux-2.png) @@ -89,7 +89,7 @@ Note your distribution and version and identify the closest entry for it under ` In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step. > [!NOTE] -> In case of Oracle EL and CentOS 8, use *[distro]* as “rhel”. +> In case of Oracle EL and CentOS 8, replace *[distro]* with “rhel”. ```puppet class install_mdatp { diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md b/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md index 2d951143c0..0870f1d408 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md @@ -28,14 +28,20 @@ Microsoft regularly publishes software updates to improve performance, security, To update Microsoft Defender ATP for Linux manually, execute the following command: -- ### For Debian family distros - -```bash -sudo apt-get install --only-upgrade mdatp -``` - -- ### For Redhat family distros +## RHEL and variants (CentOS and Oracle EL) ```bash sudo yum update mdatp ``` + +## SLES and variants + +```bash +sudo zypper update mdatp +``` + +## Ubuntu and Debian systems + +```bash +sudo apt-get install --only-upgrade mdatp +``` From 02242dc5492fe542d7411f79c22dda04003288c2 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 19 Feb 2020 20:28:04 -0800 Subject: [PATCH 50/69] . --- .../microsoft-defender-atp/linux-resources.md | 5 +++-- .../microsoft-defender-atp/microsoft-defender-atp-linux.md | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md index e3e5cf0f15..bacff9314f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md @@ -68,8 +68,9 @@ There are several ways to uninstall Microsoft Defender ATP for Linux. If you are ### Manual uninstallation -- ```sudo apt-get purge mdatp``` for Debian and Ubuntu systems -- ```sudo yum remove mdatp``` for RHEL, Oracle Linux, and CentOS based systems +- ```sudo yum remove mdatp``` for RHEL and variants(CentOS and Oracle EL) +- ```sudo zypper remove mdatp``` for SLES and variants +- ```sudo apt-get purge mdatp``` for Ubuntu and Debian systems ## Configuring from the command line diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md index 0f13038052..ee8cc752fb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md @@ -59,7 +59,7 @@ In general you need to take the following steps: - Oracle Enterprise Linux 7 - Minimum kernel version 2.6.38 -- The *fanotify* kernel option must be enabled +- The `fanotify` kernel option must be enabled - Disk space: 650 MB After you've enabled the service, you may need to configure your network or firewall to allow outbound connections between it and your endpoints. From 0197775acaad7f046bd5ed5711738890fe78163e Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 19 Feb 2020 20:35:03 -0800 Subject: [PATCH 51/69] . --- .../microsoft-defender-atp-linux.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md index ee8cc752fb..f42311c713 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md @@ -25,6 +25,7 @@ This topic describes how to install, configure, update, and use Microsoft Defend > [!CAUTION] > Running other third-party endpoint protection products alongside Microsoft Defender ATP for Linux is likely to lead to performance problems and unpredictable side effects. + ## How to install Microsoft Defender ATP for Linux ### Prerequisites @@ -33,6 +34,15 @@ This topic describes how to install, configure, update, and use Microsoft Defend - Beginner-level experience in Linux and BASH scripting - Administrative privileges on the device (in case of manual deployment) +### Known Issues + +- Logged on users do not appear in the ATP portal +- In SUSE distributions, if installation of *libatomic1* fails, validate that your OS is registered: + +```bash +$ sudo SUSEConnect --status-text +``` + ### Installation instructions There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Linux. @@ -109,15 +119,6 @@ Microsoft regularly publishes software updates to improve performance, security, Guidance for how to configure the product in enterprise environments is available in [Set preferences for Microsoft Defender ATP for Linux](linux-preferences.md). -## Known Issues - -- Logged on users do not appear in the ATP portal -- In SUSE distributions, if installation of *libatomic1* fails, validate that your OS is registered: - -```bash -$ sudo SUSEConnect --status-text -``` - ## Resources - For more information about logging, uninstalling, or other topics, see the [Resources](linux-resources.md) page. From 017e2845935b9f4c3c0a51edd3c954ff5ad1105b Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Sat, 22 Feb 2020 18:41:06 -0800 Subject: [PATCH 52/69] Edit pass: microsoft-defender-atp-linux @mjcaparas Edit is complete. Please review to ensure I didn't change the technical meaning. Once changes are approved, sign off and we can merge. Thanks! Kelly --- .../microsoft-defender-atp-linux.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md index f42311c713..6497259a59 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md +++ b/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-atp-linux.md @@ -18,12 +18,12 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Microsoft Defender Advanced Threat Protection for Linux +# Microsoft Defender ATP for Linux -This topic describes how to install, configure, update, and use Microsoft Defender ATP for Linux. +This topic describes how to install, configure, update, and use Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux. > [!CAUTION] -> Running other third-party endpoint protection products alongside Microsoft Defender ATP for Linux is likely to lead to performance problems and unpredictable side effects. +> Running other third-party endpoint protection products alongside Microsoft Defender ATP for Linux is likely to cause performance problems and unpredictable system errors. ## How to install Microsoft Defender ATP for Linux @@ -34,10 +34,10 @@ This topic describes how to install, configure, update, and use Microsoft Defend - Beginner-level experience in Linux and BASH scripting - Administrative privileges on the device (in case of manual deployment) -### Known Issues +### Known issues -- Logged on users do not appear in the ATP portal -- In SUSE distributions, if installation of *libatomic1* fails, validate that your OS is registered: +- Logged on users do not appear in the ATP portal. +- In SUSE distributions, if the installation of *libatomic1* fails, you should validate that your OS is registered: ```bash $ sudo SUSEConnect --status-text @@ -49,11 +49,11 @@ There are several methods and deployment tools that you can use to install and c In general you need to take the following steps: -- Ensure that you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal +- Ensure that you have a Microsoft Defender ATP subscription, and that you have access to the Microsoft Defender ATP portal. - Deploy Microsoft Defender ATP for Linux using one of the following deployment methods: - - Via the command-line tool: + - The command-line tool: - [Manual deployment](linux-install-manually.md) - - Via third-party management tools: + - Third-party management tools: - [Deploy using Puppet configuration management tool](linux-install-with-puppet.md) - [Deploy using Ansbile configuration management tool](linux-install-with-ansible.md) @@ -76,7 +76,7 @@ After you've enabled the service, you may need to configure your network or fire ### Network connections -The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them. +The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure that there are no firewall or network filtering rules that would deny access to these URLs. If there are, you may need to create an *allow* rule specifically for them. | Service location | DNS record | | ---------------------------------------- | ----------------------- | From 9f3a64350c34827a8b469a976d248acddd7c2e12 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Sat, 22 Feb 2020 19:44:20 -0800 Subject: [PATCH 53/69] Update linux-install-manually.md @mjcaparas The edit is complete. Since "install" and "deploy" were used interchangeably here, I changed most instances to "install" for consistency since that seemed more accurate. Feel free to make a different call. Note also that I changed the instances of "Microsoft Linux software repository" to just "Linux software repository," as including Microsoft could be problematic from a copyright standpoint. I couldn't find that usage anywhere either, but if you know for sure that Microsoft should be included, you can reject those changes. Please review and once approved, we can merge. Thanks, Kelly --- .../linux-install-manually.md | 50 +++++++++---------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 9626030b11..e3bd873642 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -1,7 +1,7 @@ --- -title: Installing Microsoft Defender ATP for Linux manually +title: Install Microsoft Defender ATP for Linux manually ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Linux manually, from the command line. +description: Describes how to install Microsoft Defender ATP for Linux manually from the command line. keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,24 +18,24 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Manual deployment +# Install Microsoft Defender ATP for Linux manually **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -This topic describes how to deploy Microsoft Defender ATP for Linux manually. A successful deployment requires the completion of all of the following steps: +This topic describes how to install Microsoft Defender ATP for Linux manually. A successful installation requires the completion of all of the following tasks: -- [Configure Microsoft's Linux Software Repository](#configure-microsoft-linux-software-repository) +- [Configure the Linux software repository](#configure-the-linux-software-repository) - [Application installation](#application-installation) -- [Download onboarding packages](#download-onboarding-package) +- [Download the onboarding package](#download-the-onboarding-package) - [Client configuration](#client-configuration) ## Prerequisites and system requirements Before you get started, see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. -## Configure Microsoft Linux Software Repository +## Configure the Linux software repository Microsoft Defender ATP for Linux can be deployed from one of the following channels (denoted below as *[channel]*): *insider-fast* or *prod*. Each of these channels corresponds to a Linux software repository. Instructions for configuring your device to use one of these repositories are provided below. @@ -45,9 +45,9 @@ In order to preview new features and provide early feedback, it is recommended t ### RHEL and variants (CentOS and Oracle EL) -- Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/` +- Note your distribution and version, and identify the closest entry for it under `https://packages.microsoft.com/config/`. - In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step: + In the below commands, replace *[distro]* and *[version]* with the information you've identified: > [!NOTE] > In case of Oracle EL and CentOS 8, replace *[distro]* with “rhel”. @@ -77,9 +77,9 @@ In order to preview new features and provide early feedback, it is recommended t ### SLES and variants -- Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/` +- Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/`. - In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step. + In the below commands, replace *[distro]* and *[version]* with the information you've identified: ```bash $ sudo zypper addrepo -c -f -n microsoft-[channel] https://packages.microsoft.com/config/[distro]/[version]/[channel].repo @@ -106,9 +106,9 @@ In order to preview new features and provide early feedback, it is recommended t $ sudo apt-get install curl ``` -- Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config` +- Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config`. - In the below command, replace *[distro]* and *[version]* with the information identified in the previous step: + In the below command, replace *[distro]* and *[version]* with the information you've identified: ```bash $ curl -o microsoft.list https://packages.microsoft.com/config/[distro]/[version]/[channel].list @@ -140,13 +140,13 @@ In order to preview new features and provide early feedback, it is recommended t ``` -- Install the https driver in case not already present: +- Install the https driver if not already present: ```bash $ sudo apt-get install apt-transport-https ``` -- Update the repository metadata +- Update the repository metadata: ```bash $ sudo apt-get update @@ -154,31 +154,31 @@ In order to preview new features and provide early feedback, it is recommended t ## Application installation -- RHEL and variants (CentOS and Oracle EL) +- RHEL and variants (CentOS and Oracle EL): ```bash sudo yum install mdatp ``` -- SLES and variants +- SLES and variants: ```bash sudo zypper install mdatp ``` -- Ubuntu and Debian system +- Ubuntu and Debian system: ```bash sudo apt-get install mdatp ``` -## Download onboarding package +## Download the onboarding package Download the onboarding package from Microsoft Defender Security Center: 1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In the first drop down, select **Linux Server** as the operating system. In the second drop down, select **Local Script (for up to 10 machines)** as the deployment method. -3. Click on **Download onboarding package**. Save the file as WindowsDefenderATPOnboardingPackage.zip. +2. In the first drop-down menu, select **Linux Server** as the operating system. In the second drop-down menu, select **Local Script (for up to 10 machines)** as the deployment method. +3. Select **Download onboarding package**. Save the file as WindowsDefenderATPOnboardingPackage.zip. ![Microsoft Defender Security Center screenshot](images/atp-portal-onboarding-linux.png) @@ -199,13 +199,13 @@ Download the onboarding package from Microsoft Defender Security Center: 1. Copy WindowsDefenderATPOnboarding.py to the target machine. - Initially the client machine is not associated with an organization. Note that the *orgId* attribute is blank. + Initially the client machine is not associated with an organization. Note that the *orgId* attribute is blank: ```bash $ mdatp --health orgId ``` -2. Run WindowsDefenderATPOnboarding.py (note that in order to run this command you must have `python` installed on the device). +2. Run WindowsDefenderATPOnboarding.py (note that in order to run this command you must have `python` installed on the device): ```bash $ python WindowsDefenderATPOnboarding.py @@ -218,7 +218,7 @@ Download the onboarding package from Microsoft Defender Security Center: [your organization identifier] ``` -4. A few minutes following the completion of the installation, you can see the status by running the following command. A return value of `1` denotes that the product is functioning as expected. +4. A few minutes after completing the installation, you can see the status by running the following command (a return value of `1` denotes that the product is functioning as expected): ```bash $ mdatp --health healthy @@ -227,7 +227,7 @@ Download the onboarding package from Microsoft Defender Security Center: 5. Run a detection test to verify that the machine is properly onboarded and reporting to the service. Perform the following steps on the newly onboarded machine: - - Ensure that real-time protection is enabled (denoted by a result of `1` from running the following command). + - Ensure that real-time protection is enabled (denoted by a result of `1` from running the following command): ```bash $ mdatp --health realTimeProtectionEnabled From a3b27a212e6cda1593716a5705185ecd496c95c7 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Sat, 22 Feb 2020 20:15:16 -0800 Subject: [PATCH 54/69] Update linux-install-with-puppet.md @mjcaparas Edit complete! Again, we're using "install" and "deploy" interchangeably. In most cases, I think "install" is more accurate and seems to be what's used in the code, but "deploy" has a slightly different meaning and might be more accurate in some instances, so it would be good to get crisper with the usage. TOC titles don't need to map verbatim to H1 headings, but if you stick with the TOC version, use "Puppet-based installation" (or Puppet-based deployment if switching to that language throughout). On line 172: do you mean "2 if the device is not yet onboarded"? Thanks! Kelly --- .../linux-install-with-puppet.md | 44 +++++++++---------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md index 783fd9d3ad..d03507dd0a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md @@ -1,7 +1,7 @@ --- -title: Installing Microsoft Defender ATP for Linux with Puppet +title: Install Microsoft Defender ATP for Linux with Puppet ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Linux, using Puppet. +description: Describes how to install Microsoft Defender ATP for Linux using Puppet. keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,16 +18,16 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Puppet based deployment +# Install Microsoft Defender ATP for Linux with Puppet **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -This topic describes how to deploy Microsoft Defender ATP for Linux through Puppet. A successful deployment requires the completion of all of the following steps: +This topic describes how to install Microsoft Defender ATP for Linux using Puppet. A successful installation requires the completion of all of the following tasks: -- [Download onboarding packages](#download-onboarding-package) -- [Create Puppet manifest](#create-puppet-manifest) +- [Download the onboarding package](#download-the-onboarding-package) +- [Create Puppet manifest](#create-a-puppet-manifest) - [Deployment](#deployment) - [Check onboarding status](#check-onboarding-status) @@ -35,15 +35,15 @@ This topic describes how to deploy Microsoft Defender ATP for Linux through Pupp Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. -In addition, for Puppet deployment, you need to be familiar with Puppet administration tasks, have Puppet configured, and know how to deploy packages. Puppet has many ways to complete the same task. These instructions assume availability of supported Puppet modules such as *apt* to help deploy the package. Your organization might use a different workflow. Please refer to the [Puppet documentation](https://puppet.com/docs) for details. +In addition, for Puppet deployment, you need to be familiar with Puppet administration tasks, have Puppet configured, and know how to deploy packages. Puppet has many ways to complete the same task. These instructions assume availability of supported Puppet modules, such as *apt* to help deploy the package. Your organization might use a different workflow. Please refer to the [Puppet documentation](https://puppet.com/docs) for details. -## Download onboarding package +## Download the onboarding package Download the onboarding package from Microsoft Defender Security Center: 1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In the first drop down, select **Linux Server** as the operating system. In the second drop down, select **Your preferred Linux configuration management tool** as the deployment method. -3. Click on **Download onboarding package**. Save the file as WindowsDefenderATPOnboardingPackage.zip. +2. In the first drop-down menu, select **Linux Server** as the operating system. In the second drop-down menu, select **Your preferred Linux configuration management tool** as the deployment method. +3. Select **Download onboarding package**. Save the file as WindowsDefenderATPOnboardingPackage.zip. ![Microsoft Defender Security Center screenshot](images/atp-portal-onboarding-linux-2.png) @@ -58,11 +58,11 @@ Download the onboarding package from Microsoft Defender Security Center: inflating: mdatp_onboard.json ``` -## Create Puppet manifest +## Create a Puppet manifest -You need to create a Puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by a Puppet server. This example makes use of *apt* module available from puppetlabs and assumes that apt module has been installed on your Puppet server. +You need to create a Puppet manifest for deploying Microsoft Defender ATP for Linux to devices managed by a Puppet server. This example makes use of the *apt* module available from puppetlabs, and assumes that the apt module has been installed on your Puppet server. -Create a folders *install_mdatp/files* and *install_mdatp/manifests* under the modules folder of your Puppet installation. This typically is located in */etc/puppetlabs/code/environments/production/modules* on your Puppet server. Copy the mdatp_onboard.json file created in above step to *install_mdatp/files* folder. Create a *init.pp* file which contains the deployment instructions. +Create the folders *install_mdatp/files* and *install_mdatp/manifests* under the modules folder of your Puppet installation. This is typically located in */etc/puppetlabs/code/environments/production/modules* on your Puppet server. Copy the mdatp_onboard.json file created above to the *install_mdatp/files* folder. Create an *init.pp* file that contains the deployment instructions: ```bash $ pwd @@ -78,7 +78,7 @@ install_mdatp ### Contents of `install_mdatp/manifests/init.pp` -Microsoft Defender ATP for Linux can be deployed from one of the following channels (denoted below as *[channel]*): *insider-fast* or *prod*. Each of these channels corresponds to a Linux software repository. +Microsoft Defender ATP for Linux can be installed from one of the following channels (denoted below as *[channel]*): *insider-fast* or *prod*. Each of these channels corresponds to a Linux software repository. The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in *insider-fast* can try out new features before devices in *prod*. @@ -86,7 +86,7 @@ In order to preview new features and provide early feedback, it is recommended t Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/`. -In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step. +In the below commands, replace *[distro]* and *[version]* with the information you've identified: > [!NOTE] > In case of Oracle EL and CentOS 8, replace *[distro]* with “rhel”. @@ -130,7 +130,7 @@ class install_mdatp { ## Deployment -Include the above manifest in your site.pp file. +Include the above manifest in your site.pp file: ```bash $ cat /etc/puppetlabs/code/environments/production/manifests/site.pp @@ -141,7 +141,7 @@ node "default" { Enrolled agent devices periodically poll the Puppet Server, and install new configuration profiles and policies as soon as they are detected. -## Monitoring Puppet deployment +## Monitor Puppet deployment On the agent machine, you can also check the onboarding status by running: @@ -155,7 +155,7 @@ orgId : "[your organization identifier]" - **licensed**: This confirms that the device is tied to your organization. -- **orgId**: your Microsoft Defender ATP organization identifier. +- **orgId**: This is your Microsoft Defender ATP organization identifier. ## Check onboarding status @@ -169,16 +169,16 @@ The above command prints `1` if the product is onboarded and functioning as expe If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: -- 1 if the device is not yet onboarded -- 3 if the connection to the daemon cannot be established +- 1 if the device is not yet onboarded. +- 3 if the connection to the daemon cannot be established. -## Logging installation issues +## Log installation issues See [Logging installation issues](linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## Uninstallation -Create a module *remove_mdatp* similar to *install_mdatp* with following contents in *init.pp* file +Create a module *remove_mdatp* similar to *install_mdatp* with the following contents in *init.pp* file: ```bash class remove_mdatp { From d8645c694b380be60dd1a25593c77d84bbd1c30c Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Sat, 22 Feb 2020 20:31:41 -0800 Subject: [PATCH 55/69] Update linux-install-with-ansible.md @mjcaparas Edit complete. Again, TOC title could be "Ansible-based installation" (or deployment). Thanks, Kelly --- .../linux-install-with-ansible.md | 54 +++++++++---------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md index ebe4a8e842..489504c74a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -1,7 +1,7 @@ --- -title: Installing Microsoft Defender ATP for Linux with Puppet +title: Install Microsoft Defender ATP for Linux with Ansible ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Linux, using Puppet. +description: Describes how to install Microsoft Defender ATP for Linux using Ansible. keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,15 +18,15 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Ansible based deployment +# Install Microsoft Defender ATP for Linux with Ansible **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -This topic describes how to deploy Microsoft Defender ATP for Linux through Ansible. A successful deployment requires the completion of all of the following steps: +This topic describes how to install Microsoft Defender ATP for Linux using Ansible. A successful installation requires the completion of all of the following tasks: -- [Download onboarding package](#download-onboarding-package) +- [Download the onboarding package](#download-the-onboarding-package) - [Create Ansible YAML files](#create-ansible-yaml-files) - [Deployment](#deployment) - [References](#references) @@ -35,14 +35,14 @@ This topic describes how to deploy Microsoft Defender ATP for Linux through Ansi Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. -- Ansible needs to be installed at least on one computer (we will call it master) -- Passwordless SSH must be configured for root user between the master and all clients +- Ansible needs to be installed on at least on one computer (we will call it master). +- Passwordless SSH must be configured for the root user between the master and all clients. - The following software must be installed on all clients: - - python-apt - - curl - - unzip + - Python-apt + - Curl + - Unzip -- All host must be listed in the following format in `/etc/ansible/hosts` file: +- All host must be listed in the following format in the `/etc/ansible/hosts` file: ```bash [servers] @@ -50,19 +50,19 @@ Before you get started, please see [the main Microsoft Defender ATP for Linux pa host2 ansible_ssh_host=51.143.50.51 ``` -- Ping test +- Ping test: ```bash $ ansible -m ping all ``` -## Download onboarding package +## Download the onboarding package Download the onboarding package from Microsoft Defender Security Center: 1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In the first drop down, select **Linux Server** as the operating system. In the second drop down, select **Your preferred Linux configuration management tool** as the deployment method. -3. Click on **Download onboarding package**. Save the file as WindowsDefenderATPOnboardingPackage.zip. +2. In the first drop-down menu, select **Linux Server** as the operating system. In the second drop-down menu, select **Your preferred Linux configuration management tool** as the deployment method. +3. Select **Download onboarding package**. Save the file as WindowsDefenderATPOnboardingPackage.zip. ![Microsoft Defender Security Center screenshot](images/atp-portal-onboarding-linux-2.png) @@ -79,9 +79,9 @@ Download the onboarding package from Microsoft Defender Security Center: ## Create Ansible YAML files -Create subtask / role files which contribute to an actual task. Create the below files under the `/etc/ansible/roles` directory. +Create subtask or role files that contribute to an actual task. Create the below files under the `/etc/ansible/roles` directory. -- Copy onboarding package to all client machines: +- Copy the onboarding package to all client machines: ```bash $ cat /etc/ansible/roles/copy_onboarding_pkg.yml @@ -94,7 +94,7 @@ Create subtask / role files which contribute to an actual task. Create the below mode: '0644' ``` -- Create a `setup.sh` script which operates on the onboarding file: +- Create a `setup.sh` script that operates on the onboarding file: ```bash $ cat /root/setup.sh @@ -127,7 +127,7 @@ Create subtask / role files which contribute to an actual task. Create the below script: /root/setup.sh ``` -- Add the Microsoft Defender ATP repository and key +- Add the Microsoft Defender ATP repository and key. Microsoft Defender ATP for Linux can be deployed from one of the following channels (denoted below as *[channel]*): *insider-fast* or *prod*. Each of these channels corresponds to a Linux software repository. @@ -137,7 +137,7 @@ Create subtask / role files which contribute to an actual task. Create the below Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/`. - In the below commands, replace *[distro]* and *[version]* with the information identified in the previous step. + In the below commands, replace *[distro]* and *[version]* with the information you've identified. > [!NOTE] > In case of Oracle EL and CentOS 8, replace *[distro]* with “rhel”. @@ -173,7 +173,7 @@ Create subtask / role files which contribute to an actual task. Create the below enabled: Yes ``` -- Create the actual install / uninstall YAML files under `/etc/ansible/playbooks` +- Create the actual install/uninstall YAML files under `/etc/ansible/playbooks`. - For apt-based distributions use the following YAML file: @@ -225,28 +225,28 @@ Create subtask / role files which contribute to an actual task. Create the below ## Deployment -Now run the tasks files under `/etc/ansible/playbooks/` +Now run the tasks files under `/etc/ansible/playbooks/`. -- Installation +- Installation: ```bash $ ansible-playbook /etc/ansible/playbooks/install_mdatp.yml -i /etc/ansible/hosts ``` -- Validation / configuration +- Validation/configuration: ```bash $ ansible -m shell -a 'mdatp --connectivity-test' all $ ansible -m shell -a 'mdatp --health' all ``` -- Uninstallation +- Uninstallation: ```bash $ ansible-playbook /etc/ansible/playbooks/uninstall_mdatp.yml -i /etc/ansible/hosts ``` -## Logging installation issues +## Log installation issues See [Logging installation issues](linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. @@ -258,4 +258,4 @@ See [Logging installation issues](linux-resources.md#logging-installation-issues - [Add and remove APT repositories](https://docs.ansible.com/ansible/latest/modules/apt_repository_module.html) -- [Manage apt-packages](https://docs.ansible.com/ansible/latest/modules/apt_module.html) \ No newline at end of file +- [Manage apt-packages](https://docs.ansible.com/ansible/latest/modules/apt_module.html) From ae89297431aafa38bf1d67b7c56b734c6b51f6d6 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Sat, 22 Feb 2020 20:39:15 -0800 Subject: [PATCH 56/69] Update linux-install-with-puppet.md --- .../linux-install-with-puppet.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md index d03507dd0a..c1eef92f29 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md @@ -1,7 +1,7 @@ --- -title: Install Microsoft Defender ATP for Linux with Puppet +title: Deploy Microsoft Defender ATP for Linux with Puppet ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Linux using Puppet. +description: Describes how to deploy Microsoft Defender ATP for Linux using Puppet. keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,13 +18,13 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Install Microsoft Defender ATP for Linux with Puppet +# Deploy Microsoft Defender ATP for Linux with Puppet **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -This topic describes how to install Microsoft Defender ATP for Linux using Puppet. A successful installation requires the completion of all of the following tasks: +This topic describes how to deploy Microsoft Defender ATP for Linux using Puppet. A successful deployment requires the completion of all of the following tasks: - [Download the onboarding package](#download-the-onboarding-package) - [Create Puppet manifest](#create-a-puppet-manifest) @@ -78,7 +78,7 @@ install_mdatp ### Contents of `install_mdatp/manifests/init.pp` -Microsoft Defender ATP for Linux can be installed from one of the following channels (denoted below as *[channel]*): *insider-fast* or *prod*. Each of these channels corresponds to a Linux software repository. +Microsoft Defender ATP for Linux can be deployed from one of the following channels (denoted below as *[channel]*): *insider-fast* or *prod*. Each of these channels corresponds to a Linux software repository. The choice of the channel determines the type and frequency of updates that are offered to your device. Devices in *insider-fast* can try out new features before devices in *prod*. From e70a4be669bc68bbdab5c3037f93b4fb5671290c Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Sat, 22 Feb 2020 20:43:48 -0800 Subject: [PATCH 57/69] Update linux-install-manually.md --- .../microsoft-defender-atp/linux-install-manually.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index e3bd873642..9b9fc9f351 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -1,7 +1,7 @@ --- -title: Install Microsoft Defender ATP for Linux manually +title: Deploy Microsoft Defender ATP for Linux manually ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Linux manually from the command line. +description: Describes how to deploy Microsoft Defender ATP for Linux manually from the command line. keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,13 +18,13 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Install Microsoft Defender ATP for Linux manually +# Deploy Microsoft Defender ATP for Linux manually **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -This topic describes how to install Microsoft Defender ATP for Linux manually. A successful installation requires the completion of all of the following tasks: +This topic describes how to deploy Microsoft Defender ATP for Linux manually. A successful deployment requires the completion of all of the following tasks: - [Configure the Linux software repository](#configure-the-linux-software-repository) - [Application installation](#application-installation) @@ -246,7 +246,7 @@ Download the onboarding package from Microsoft Defender Security Center: $ mdatp --threat --list --pretty ``` -## Logging installation issues +## Log installation issues See [Logging installation issues](linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. From 8ee3e9dbd459ed9df2a44e4d4e1127d2dce87d4e Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Sat, 22 Feb 2020 20:48:50 -0800 Subject: [PATCH 58/69] Update linux-install-with-ansible.md --- .../microsoft-defender-atp/linux-install-with-ansible.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md index 489504c74a..51aaaf6a64 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -1,7 +1,7 @@ --- -title: Install Microsoft Defender ATP for Linux with Ansible +title: Deploy Microsoft Defender ATP for Linux with Ansible ms.reviewer: -description: Describes how to install Microsoft Defender ATP for Linux using Ansible. +description: Describes how to deploy Microsoft Defender ATP for Linux using Ansible. keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -18,13 +18,13 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Install Microsoft Defender ATP for Linux with Ansible +# Deploy Microsoft Defender ATP for Linux with Ansible **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -This topic describes how to install Microsoft Defender ATP for Linux using Ansible. A successful installation requires the completion of all of the following tasks: +This topic describes how to deploy Microsoft Defender ATP for Linux using Ansible. A successful deployment requires the completion of all of the following tasks: - [Download the onboarding package](#download-the-onboarding-package) - [Create Ansible YAML files](#create-ansible-yaml-files) From dd3664679afbc4bf01f5284eb51de20f1c2a3ed0 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Sun, 23 Feb 2020 15:49:25 -0800 Subject: [PATCH 59/69] Update linux-updates.md @mjcaparas Edit complete! Thanks, Kelly --- .../threat-protection/microsoft-defender-atp/linux-updates.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md b/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md index 0870f1d408..74979b6c15 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-updates.md @@ -1,7 +1,7 @@ --- title: Deploy updates for Microsoft Defender ATP for Linux ms.reviewer: -description: Describes how to control updates for Microsoft Defender ATP for Linux in enterprise environments. +description: Describes how to deploy updates for Microsoft Defender ATP for Linux in enterprise environments. keywords: microsoft, defender, atp, linux, updates, deploy search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -26,7 +26,7 @@ ms.topic: conceptual Microsoft regularly publishes software updates to improve performance, security, and to deliver new features. -To update Microsoft Defender ATP for Linux manually, execute the following command: +To update Microsoft Defender ATP for Linux manually, execute one of the following commands: ## RHEL and variants (CentOS and Oracle EL) From f5f73579e4a88fd7b4a2581cbdefe041864d0235 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Sun, 23 Feb 2020 16:11:40 -0800 Subject: [PATCH 60/69] Update linux-static-proxy-configuration.md @mjcaparas Edit complete. A few comments: - TOC title should be sentence case "Static proxy configuration" instead of title case. - Line 48: Is "prepended" the intended term? - Line 73: Implies that two commands follow, but there's only one command beneath. Thanks! Kelly --- .../linux-static-proxy-configuration.md | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md b/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md index 4ced587060..43330660a0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-static-proxy-configuration.md @@ -1,7 +1,7 @@ --- -title: Microsoft Defender ATP for Linux Static Proxy Discovery +title: Microsoft Defender ATP for Linux static proxy discovery ms.reviewer: -description: Describes how to configure Microsoft Defender ATP for static proxy discovery +description: Describes how to configure Microsoft Defender ATP for static proxy discovery. keywords: microsoft, defender, atp, linux, installation, proxy search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -24,11 +24,11 @@ ms.topic: conceptual - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -Microsoft Defender ATP can discover a proxy server via the ```HTTPS_PROXY``` environment variable. This setting must be configured **both** at installation time and after the product has been installed. +Microsoft Defender ATP can discover a proxy server using the ```HTTPS_PROXY``` environment variable. This setting must be configured **both** at installation time and after the product has been installed. ## Installation time configuration -During installation, the ```HTTPS_PROXY``` environment variable must be passed to the package manager. The package manager can read this variable in any of these three ways: +During installation, the ```HTTPS_PROXY``` environment variable must be passed to the package manager. The package manager can read this variable in any of the following ways: - The ```HTTPS_PROXY``` variable is defined in ```/etc/environment``` with the following line: @@ -36,16 +36,16 @@ During installation, the ```HTTPS_PROXY``` environment variable must be passed t HTTPS_PROXY=”http://proxy.server:port/” ``` -- The `HTTPS_PROXY` variable is defined in the package manager global configuration. For example, in Ubuntu 18.04, you can add the following line to `/etc/apt/apt.conf.d/proxy.conf` +- The `HTTPS_PROXY` variable is defined in the package manager global configuration. For example, in Ubuntu 18.04, you can add the following line to `/etc/apt/apt.conf.d/proxy.conf`: ```bash Acquire::https::Proxy "http://proxy.server:port/"; ``` -> [!CAUTION] -> Note that above two methods could define the proxy to use for other applications on your system. Use this method with caution, or only if this is mean to be a generally global configuration. + > [!CAUTION] + > Note that above two methods could define the proxy to use for other applications on your system. Use this method with caution, or only if this is meant to be a generally global configuration. -- The `HTTPS_PROXY` variable is prepended to the installation and/or uninstallation commands. For example with the APT package manager, prepend the variable as follows when installing Microsoft Defender ATP: +- The `HTTPS_PROXY` variable is prepended to the installation or uninstallation commands. For example, with the APT package manager, prepend the variable as follows when installing Microsoft Defender ATP: ```bash $ HTTPS_PROXY=”http://proxy.server:port/" apt install mdatp @@ -60,17 +60,17 @@ Note that installation and uninstallation will not necessarily fail if a proxy i ## Post installation configuration -After installation, the `HTTPS_PROXY` environment variable must be defined in the Microsoft Defender ATP service file. To do this, open `/lib/systemd/system/mdatp.service` in a text editor while running as the root user. Then, you can propagate the variable to the service in one of two ways: +After installation, the `HTTPS_PROXY` environment variable must be defined in the Microsoft Defender ATP service file. To do this, open `/lib/systemd/system/mdatp.service` in a text editor while running as the root user. You can then propagate the variable to the service in one of two ways: - Uncomment the line `#Environment=HTTPS_PROXY="http://address:port”` and specify your static proxy address. -- Add a line `EnvironmentFile=/path/to/env/file`. This path can point to `/etc/environment` or a custom file, either of which needs to the following line: +- Add a line `EnvironmentFile=/path/to/env/file`. This path can point to `/etc/environment` or a custom file, either of which needs to add the following line: ```bash HTTPS_PROXY=”http://proxy.server:port/” ``` -After modifying the `mdatp.service` file, save and close it. Restart the service so the changes can go into effect. In Ubuntu, this involves two commands: +After modifying the `mdatp.service` file, save and close it. Restart the service so the changes can be applied. In Ubuntu, this involves two commands: ```bash $ systemctl daemon-reload; systemctl restart mdatp From 35a5b869d9d77a70b98a71fe39b16b4cf928883a Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Sun, 23 Feb 2020 16:55:40 -0800 Subject: [PATCH 61/69] Update linux-preferences.md @mjcaparas Edit complete! Thanks, Kelly --- .../linux-preferences.md | 56 +++++++++---------- 1 file changed, 28 insertions(+), 28 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md index d98c03bf83..4229bd1d87 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md @@ -25,17 +25,17 @@ ms.topic: conceptual - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) >[!IMPORTANT] ->This topic contains instructions for how to set preferences for Microsoft Defender ATP for Linux in enterprise environments. If you are interested in configuring the product on a device from the command-line, please refer to the [Resources](linux-resources.md#configuring-from-the-command-line) page. +>This topic contains instructions for how to set preferences for Microsoft Defender ATP for Linux in enterprise environments. If you are interested in configuring the product on a device from the command-line, see [Resources](linux-resources.md#configuring-from-the-command-line). -In enterprise environments, Microsoft Defender ATP for Linux can be managed through a configuration profile. This profile is deployed from management tool of your choice. Preferences managed by the enterprise take precedence over the ones set locally on the device. In other words, users in your enterprise are not able to change preferences that are set through this configuration profile. +In enterprise environments, Microsoft Defender ATP for Linux can be managed through a configuration profile. This profile is deployed from the management tool of your choice. Preferences managed by the enterprise take precedence over the ones set locally on the device. In other words, users in your enterprise are not able to change preferences that are set through this configuration profile. -This topic describes the structure of this profile (including a recommended profile that you can use to get started) and instructions for how to deploy the profile. +This topic describes the structure of this profile (including a recommended profile that you can use to get started) and instructions on how to deploy the profile. ## Configuration profile structure -The configuration profile is a .json file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can either be simple (such as a numerical value) or complex, such as a nested list of preferences. +The configuration profile is a .json file that consists of entries identified by a key (which denotes the name of the preference), followed by a value, which depends on the nature of the preference. Values can be simple, such as a numerical value, or complex, such as a nested list of preferences. -Typically, you would use a configuration management tool to push a file with name ```mdatp_maanged.json``` at location ```/etc/opt/microsoft/mdatp/managed/``` +Typically, you would use a configuration management tool to push a file with the name ```mdatp_maanged.json``` at the location ```/etc/opt/microsoft/mdatp/managed/```. The top level of the configuration profile includes product-wide preferences and entries for subareas of the product, which are explained in more detail in the next sections. @@ -51,7 +51,7 @@ The *antivirusEngine* section of the configuration profile is used to manage the #### Enable / disable real-time protection -Whether real-time protection (scan files as they are accessed) is enabled or not. +Detemines whether real-time protection (scan files as they are accessed) is enabled or not. ||| |:---|:---| @@ -61,12 +61,12 @@ Whether real-time protection (scan files as they are accessed) is enabled or not #### Enable / disable passive mode -Whether the antivirus engine runs in passive mode or not. In passive mode: -- Real-time protection is turned off -- On-demand scanning is turned on -- Automatic threat remediation is turned off -- Security intelligence updates are turned on -- Status menu icon is hidden +Detemines whether the antivirus engine runs in passive mode or not. In passive mode: +- Real-time protection is turned off. +- On-demand scanning is turned on. +- Automatic threat remediation is turned off. +- Security intelligence updates are turned on. +- Status menu icon is hidden. ||| |:---|:---| @@ -77,7 +77,7 @@ Whether the antivirus engine runs in passive mode or not. In passive mode: #### Exclusion merge policy -Specify the merge policy for exclusions. This can be a combination of administrator-defined and user-defined exclusions (`merge`) or only administrator-defined exclusions (`admin_only`). This setting can be used to restrict local users from defining their own exclusions. +Specifies the merge policy for exclusions. It can be a combination of administrator-defined and user-defined exclusions (`merge`) or only administrator-defined exclusions (`admin_only`). This setting can be used to restrict local users from defining their own exclusions. ||| |:---|:---| @@ -141,7 +141,7 @@ Used to exclude content from the scan by file extension. **Process excluded from the scan** -Specify a process for which all file activity is excluded from scanning. The process can be specified either by its name (e.g. `cat`) or full path (e.g. `/bin/cat`). +Specifies a process for which all file activity is excluded from scanning. The process can be specified either by its name (e.g. `cat`) or full path (e.g. `/bin/cat`). ||| |:---|:---| @@ -182,7 +182,7 @@ The *threatTypeSettings* preference in the antivirus engine is used to control h **Threat type** -Type of the threat for which the behavior is configured. +Type of threat for which the behavior is configured. ||| |:---|:---| @@ -194,9 +194,9 @@ Type of the threat for which the behavior is configured. Action to take when coming across a threat of the type specified in the preceding section. Can be: -- **Audit**: your device is not protected against this type of threat, but an entry about the threat is logged. -- **Block**: your device is protected against this type of threat and you are notified in the user interface and the security console. -- **Off**: your device is not protected against this type of threat and nothing is logged. +- **Audit**: The device is not protected against this type of threat, but an entry about the threat is logged. +- **Block**: The device is protected against this type of threat and you are notified in the user interface and the security console. +- **Off**: The device is not protected against this type of threat and nothing is logged. ||| |:---|:---| @@ -206,7 +206,7 @@ Action to take when coming across a threat of the type specified in the precedin #### Threat type settings merge policy -Specify the merge policy for threat type settings. This can be a combination of administrator-defined and user-defined settings (`merge`) or only administrator-defined settings (`admin_only`). This setting can be used to restrict local users from defining their own settings for different threat types. +Specifies the merge policy for threat type settings. This can be a combination of administrator-defined and user-defined settings (`merge`) or only administrator-defined settings (`admin_only`). This setting can be used to restrict local users from defining their own settings for different threat types. ||| |:---|:---| @@ -215,9 +215,9 @@ Specify the merge policy for threat type settings. This can be a combination of | **Possible values** | merge (default)
admin_only | | **Comments** | Available in Microsoft Defender ATP version 100.83.73 or higher. | -### Cloud delivered protection preferences +### Cloud-delivered protection preferences -The *cloudService* entry in the configuration profile is used to configure the cloud driven protection feature of the product. +The *cloudService* entry in the configuration profile is used to configure the cloud-driven protection feature of the product. ||| |:---|:---| @@ -227,7 +227,7 @@ The *cloudService* entry in the configuration profile is used to configure the c #### Enable / disable cloud delivered protection -Whether cloud delivered protection is enabled on the device or not. To improve the security of your services, we recommend keeping this feature turned on. +Determines whether cloud-delivered protection is enabled on the device or not. To improve the security of your services, we recommend keeping this feature turned on. ||| |:---|:---| @@ -261,12 +261,12 @@ To get started, we recommend the following configuration profile for your enterp The following configuration profile will: -- Enable real-time protection (RTP) +- Enable real-time protection (RTP). - Specify how the following threat types are handled: - - **Potentially unwanted applications (PUA)** are blocked - - **Archive bombs** (file with a high compression rate) are audited to the product logs -- Enable cloud delivered protection -- Enable automatic sample submission + - **Potentially unwanted applications (PUA)** are blocked. + - **Archive bombs** (file with a high compression rate) are audited to the product logs. +- Enable cloud-delivered protection. +- Enable automatic sample submission. ### Sample profile @@ -353,4 +353,4 @@ The following configuration profile contains entries for all settings described ## Configuration profile deployment -Once you've built the configuration profile for your enterprise, you can deploy it through the management tool that your enterprise is using. Microsoft Defender ATP for Linux reads the managed configuration from the file */etc/opt/microsoft/mdatp/managed/mdatp_managed.json* +Once you've built the configuration profile for your enterprise, you can deploy it through the management tool that your enterprise is using. Microsoft Defender ATP for Linux reads the managed configuration from the */etc/opt/microsoft/mdatp/managed/mdatp_managed.json* file. From d15f142285194c6843b9248924cc6c35d9860b4d Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Sun, 23 Feb 2020 17:11:54 -0800 Subject: [PATCH 62/69] Update linux-resources.md @mjcaparas Edit is complete! Let me know if you have any questions. Thanks! Kelly --- .../microsoft-defender-atp/linux-resources.md | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md index bacff9314f..388b235ac3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-resources.md @@ -1,5 +1,5 @@ --- -title: Microsoft Defender ATP for Linux Resources +title: Microsoft Defender ATP for Linux resources ms.reviewer: description: Describes resources for Microsoft Defender ATP for Linux, including how to uninstall it, how to collect diagnostic logs, CLI commands, and known issues with the product. keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos @@ -24,7 +24,7 @@ ms.topic: conceptual - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) -## Collecting diagnostic information +## Collect diagnostic information If you can reproduce a problem, please increase the logging level, run the system for some time, and restore the logging level to the default. @@ -37,9 +37,9 @@ If you can reproduce a problem, please increase the logging level, run the syste Operation succeeded ``` -2. Reproduce the problem +2. Reproduce the problem. -3. Run `sudo mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds. +3. Run `sudo mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The files will be stored inside of a .zip archive. This command will also print out the file path to the backup after the operation succeeds: ```bash $ sudo mdatp --diagnostic --create @@ -56,23 +56,23 @@ If you can reproduce a problem, please increase the logging level, run the syste Operation succeeded ``` -## Logging installation issues +## Log installation issues If an error occurs during installation, the installer will only report a general failure. The detailed log will be saved to `/var/log/microsoft/mdatp_install.log`. If you experience issues during installation, send us this file so we can help diagnose the cause. -## Uninstalling +## Uninstall There are several ways to uninstall Microsoft Defender ATP for Linux. If you are using a configuration tool such as Puppet, please follow the package uninstallation instructions for the configuration tool. ### Manual uninstallation -- ```sudo yum remove mdatp``` for RHEL and variants(CentOS and Oracle EL) -- ```sudo zypper remove mdatp``` for SLES and variants -- ```sudo apt-get purge mdatp``` for Ubuntu and Debian systems +- ```sudo yum remove mdatp``` for RHEL and variants(CentOS and Oracle EL). +- ```sudo zypper remove mdatp``` for SLES and variants. +- ```sudo apt-get purge mdatp``` for Ubuntu and Debian systems. -## Configuring from the command line +## Configure from the command line Important tasks, such as controlling product settings and triggering on-demand scans, can be done from the command line: From 3b58615ff860fd87991617c4bd8711b42cc7d167 Mon Sep 17 00:00:00 2001 From: Amrut Kale Date: Mon, 24 Feb 2020 19:10:21 +0530 Subject: [PATCH 63/69] Update TOC.md Update the sentence case as per review comment. --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index d09defdcd2..dc6112a767 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -349,7 +349,7 @@ ##### [Ansible based deployment](microsoft-defender-atp/linux-install-with-ansible.md) #### [Update](microsoft-defender-atp/linux-updates.md) #### [Configure]() -##### [Static Proxy Configuration](microsoft-defender-atp/linux-static-proxy-configuration.md) +##### [Static proxy configuration](microsoft-defender-atp/linux-static-proxy-configuration.md) ##### [Set preferences](microsoft-defender-atp/linux-preferences.md) #### [Resources](microsoft-defender-atp/linux-resources.md) From e86d3fd2601dbffc7d543d49995b2eccb9c15c0f Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 24 Feb 2020 07:13:52 -0800 Subject: [PATCH 64/69] Update linux-install-manually.md Updating anchors based on Resources heading changes. --- .../microsoft-defender-atp/linux-install-manually.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 9b9fc9f351..202daf5f2e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -248,8 +248,8 @@ Download the onboarding package from Microsoft Defender Security Center: ## Log installation issues -See [Logging installation issues](linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. +See [Log installation issues](linux-resources.md#log-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## Uninstallation -See [Uninstalling](linux-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Linux from client devices. +See [Uninstall](linux-resources.md#uninstall) for details on how to remove Microsoft Defender ATP for Linux from client devices. From c92dbc70560905ecfb265427d5c0a5fb6c50ddc5 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 24 Feb 2020 07:16:15 -0800 Subject: [PATCH 65/69] Update linux-install-with-ansible.md --- .../microsoft-defender-atp/linux-install-with-ansible.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md index 51aaaf6a64..2ec6fa1eb9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -248,7 +248,7 @@ Now run the tasks files under `/etc/ansible/playbooks/`. ## Log installation issues -See [Logging installation issues](linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. +See [Log installation issues](linux-resources.md#log-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## References From b4b27872fb311a0829804b1406f26908874f18d4 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 24 Feb 2020 07:17:54 -0800 Subject: [PATCH 66/69] Update linux-install-with-puppet.md --- .../microsoft-defender-atp/linux-install-with-puppet.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md index c1eef92f29..a27c84b264 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-puppet.md @@ -174,7 +174,7 @@ If the product is not healthy, the exit code (which can be checked through `echo ## Log installation issues -See [Logging installation issues](linux-resources.md#logging-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. +See [Log installation issues](linux-resources.md#log-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs. ## Uninstallation From 0af20a18be6fec0d3eda55bfda6c86879932008d Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 24 Feb 2020 07:19:45 -0800 Subject: [PATCH 67/69] Update linux-preferences.md --- .../microsoft-defender-atp/linux-preferences.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md index 4229bd1d87..256186213a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-preferences.md @@ -25,7 +25,7 @@ ms.topic: conceptual - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md) >[!IMPORTANT] ->This topic contains instructions for how to set preferences for Microsoft Defender ATP for Linux in enterprise environments. If you are interested in configuring the product on a device from the command-line, see [Resources](linux-resources.md#configuring-from-the-command-line). +>This topic contains instructions for how to set preferences for Microsoft Defender ATP for Linux in enterprise environments. If you are interested in configuring the product on a device from the command-line, see [Resources](linux-resources.md#configure-from-the-command-line). In enterprise environments, Microsoft Defender ATP for Linux can be managed through a configuration profile. This profile is deployed from the management tool of your choice. Preferences managed by the enterprise take precedence over the ones set locally on the device. In other words, users in your enterprise are not able to change preferences that are set through this configuration profile. From 14cc50e75964e781805dec5e977804c450a68e83 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 24 Feb 2020 10:10:27 -0800 Subject: [PATCH 68/69] Update linux-install-manually.md --- .../microsoft-defender-atp/linux-install-manually.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 202daf5f2e..24930516c6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -77,9 +77,9 @@ In order to preview new features and provide early feedback, it is recommended t ### SLES and variants -- Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/`. +- Note your distribution and version, and identify the closest entry for it under `https://packages.microsoft.com/config/`. - In the below commands, replace *[distro]* and *[version]* with the information you've identified: + In the following commands, replace *[distro]* and *[version]* with the information you've identified: ```bash $ sudo zypper addrepo -c -f -n microsoft-[channel] https://packages.microsoft.com/config/[distro]/[version]/[channel].repo @@ -106,7 +106,7 @@ In order to preview new features and provide early feedback, it is recommended t $ sudo apt-get install curl ``` -- Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config`. +- Note your distribution and version, and identify the closest entry for it under `https://packages.microsoft.com/config`. In the below command, replace *[distro]* and *[version]* with the information you've identified: @@ -140,7 +140,7 @@ In order to preview new features and provide early feedback, it is recommended t ``` -- Install the https driver if not already present: +- Install the https driver if it's not already present: ```bash $ sudo apt-get install apt-transport-https @@ -205,7 +205,7 @@ Download the onboarding package from Microsoft Defender Security Center: $ mdatp --health orgId ``` -2. Run WindowsDefenderATPOnboarding.py (note that in order to run this command you must have `python` installed on the device): +2. Run WindowsDefenderATPOnboarding.py, and note that, in order to run this command, you must have `python` installed on the device: ```bash $ python WindowsDefenderATPOnboarding.py @@ -218,7 +218,7 @@ Download the onboarding package from Microsoft Defender Security Center: [your organization identifier] ``` -4. A few minutes after completing the installation, you can see the status by running the following command (a return value of `1` denotes that the product is functioning as expected): +4. A few minutes after you complete the installation, you can see the status by running the following command. A return value of `1` denotes that the product is functioning as expected: ```bash $ mdatp --health healthy From 54e85741752de588e6275c798ec98fd3588215b4 Mon Sep 17 00:00:00 2001 From: Kelly Baker Date: Mon, 24 Feb 2020 10:30:25 -0800 Subject: [PATCH 69/69] Update linux-install-with-ansible.md --- .../microsoft-defender-atp/linux-install-with-ansible.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md index 2ec6fa1eb9..8eae3591a3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-with-ansible.md @@ -35,7 +35,7 @@ This topic describes how to deploy Microsoft Defender ATP for Linux using Ansibl Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version. -- Ansible needs to be installed on at least on one computer (we will call it master). +- Ansible needs to be installed on at least on one computer (we will call it the master). - Passwordless SSH must be configured for the root user between the master and all clients. - The following software must be installed on all clients: - Python-apt @@ -79,7 +79,7 @@ Download the onboarding package from Microsoft Defender Security Center: ## Create Ansible YAML files -Create subtask or role files that contribute to an actual task. Create the below files under the `/etc/ansible/roles` directory. +Create subtask or role files that contribute to an actual task. Create the following files under the `/etc/ansible/roles` directory. - Copy the onboarding package to all client machines: @@ -137,7 +137,7 @@ Create subtask or role files that contribute to an actual task. Create the below Note your distribution and version and identify the closest entry for it under `https://packages.microsoft.com/config/`. - In the below commands, replace *[distro]* and *[version]* with the information you've identified. + In the following commands, replace *[distro]* and *[version]* with the information you've identified. > [!NOTE] > In case of Oracle EL and CentOS 8, replace *[distro]* with “rhel”.