From 09f201746f7ef89ad89972ccaaeceedbee24eca8 Mon Sep 17 00:00:00 2001 From: Elizabeth Ross Date: Mon, 6 Jun 2016 13:26:32 -0700 Subject: [PATCH 01/69] Updated image for new Intune UI --- .../images/intune-createnewpolicy.png | Bin 31438 -> 51547 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/intune-createnewpolicy.png b/windows/keep-secure/images/intune-createnewpolicy.png index 02a989d8ae0ccb683ef902dfff4705c7d13d6d1c..7f894c0eb00e7247714025134867ff3f9d4ccf9d 100644 GIT binary patch literal 51547 zcmce8c{tSH`?r*kBq_2JDlwLXM2NB^RF=%xcd|_OVi;K>J8A4&)~wmLn9APRX(sCw z#=eeq7&FgX%jfg`{;ubFuII1k4;Sy5^FHT3_kEvxd)>$Dhgz!ir`S$WP*BjTtKEG} zL2-PSf`T%dh7$NBf2zbE_;t+fv8ob9X)nhD@NmNRj^-T-it=bWqB#}tO#4g?>_$Ox zrse48SO>Jg3i$A%`#l499jJ}Fm$|Do#WQnzXLk{2Yj>U-B4Q#kjuL)a6cnA^>UZzx zJ~vr8q^mQ==*_)OR?RojQp&ZzDiU-e;5DbL%Y&)!2-AujOZ9R`^%^U~3Sm^7wT3(b zG(vUH`N5N+_qsZ;N2bolw{e=mbo4nc!UfkJ-#ew`FDI0x6ZtkKC?-L9^5ond6J1xb zTaTSH`??J%RBk!4xKd+oVnZ4B+&HDFAWg(VZ;-BdT`4nvaOeS_Q zSJkik@6=-VqyKxMjhhzOtn84e@i*35;wI}~Qn*8nnte?@!~Rl}*wPuzzQNEp#vewU zUMlO;0y~cR^viBN05@N4rYCi=IF3}4drRwiknlYDho>dl_N@qiiE5AMQ*aIf%STAb z3TzyT)~TH8o_*sw{!)0-XZ*~;Z9gy~n($5xl<|uNgebb2@#pKMqthBR{t8>=yFX&- zF>8I-JGi{K8yPGq23bhUtbX`9v}EjYq*u@bc!0eb1B(UE|7m zo0lG&w!ek_K)|L4-yt-TXk7U@owhU>XW90_IZj1M>5NZ~XB;BBxgz$*GfE%OPuWFq zj2wPiB{W@0uPsMn`|jl+_N2!u*PC$D=Lctt&zcHemXFl2X_%*p3U9dd_2&6}_-HQX z=UMor$VMu`2*~4dB(p_ZAKrTE`tzLFK(1KJ;|Qu)9nTsp-UsqVIkfq_ig-7Q&Gwg~ ziI>cm!}gd51L_iJllZsB7ftfJC_%RAE2^PETXlfU;sk9UY2YPPxB6a#9&%N~D&uxG zozM`MOmGS#q((U-`j{G0(bXy@4$ZXC#Fio)LwVh=YnQ1Ud}FLOrok_3rsl-YU5J+X zr$HK5E8?J_7D1#~4zeR7CB`$M?%|(T>@pm;=oHu6*B#HV%92{Rg_kjfo_AvW-(Ut$a^w7KtOvV`L4#^a8` ziVDND4|EDFq8C9qbe&E7$(q|3CGWS0=*4D#s1p?e`z@LK1C^FF?vL8Y-^IhuG*=67 z(=uF7nGNwrB=JOv_XnTuRtZ(;VFV3DWAg=mw9;e*#&|-6N+*my7)f1}sgi8XXlP|* zRdkCv7Y7Y_*VdefWs?~jZ4UnSHf$tIAX#YI?IA_ma(wrBs{XVRxD-o~1t+i7r#O=% zlAj0mafxx?a*ejLOTa1EnoHvi-$G!c$#|t@)rf#8o}f$geg!BxAiL0ev1zqUPnzt6ksfpKDWr?1el=fVAe_)bPOD-EsDZ0&g&X+ zTRz8A8P0a&O9X%0X3+v|QJ=sYNQ({y}fz9^t3Rwtv+zE;hvcTK?YovAks+UAvC0hz{Qa=`D38gQau zl#h(kzEjhNV(};Z%9)%O8hoqrVK@zAWasaFgq?xf=+JIOiCZN_9J}W?9@_nb@!c0O zdsNrg=ct4)I~Y|z_#t#~3&CK_ESu2r^J+B2PW1+xK*@))F;lu&u>7eX4@nA&5;@ky z*HsS+JMbwwpVZC{O7_0vKNVp?2o2uTK4svL7zJYc?X0IP77+|(iK`SBb&fRUUH*ur zO;#PEOBf{u;c@xWLAugVKF5J99XO(DpHSVB9Pfth#e*upTSvZzgtL(qOndryUDep!e4GM~Jwj%^* z9jN>or6yfP{L=5s_v`%}c8H((d^6*(2?pswNHKTpuTeA$uMnme8=${N1-UE#KP=Fzm3Cth8Q>*72C`v|7-i!vesIlV?B~4=A>GZ`E=dkNfVe z8m>a*JlA}aFAV%$R`6q4V0a&=`c@@`>3B=y^C2z%)u!E=&2b81T6`i$NF174i^| z8r-{mZ3rMkjYR`ON?&t~r#9p4Y^*ZBvHMTYhk9+BR^3)za-SImeOU9U99H3l``ylMtX8OulM-IxXnETBO z(8>5YEp&A(r;}rX zUB+lcL3USk(;eKL*g$*O#xjSPf7Fy)IXxSw;JHD6z`zx&T*8!v z>*H;JzWG8|F2~5S((BH#m#U9i^VVyB(wY`1{k(Ehpvj1BcUnC8&}L8@I0iQsYKh^Z z&2<}3dpMUw>-n3%xRs~AtVZ$1eA&2{ymIxjlxfo@Q?6WdX{9Qg{ZsFiVxO64;&+v| z3#J(Lz~Xjh*KsHR$j{DV#h=SR%HG{)^krF<@mzc5bkJKrb5cgmd-t}2%QsC=nkuav zGZcJ^kka>jR<9`H%5ASoDQVRs9mvEi+-40De0~=9%5!XJ%M-;Qg`GlA;#vU4PWoI)RGrJ?s`qd-?(l&TeK|=k0rS+WB-R|3i56xW`sHs&@JI(z`STzkyzl zlwG;Gu!%Y28izHfknOE;1HaiNp)*d-QT@It=ZzT#FunLjIWDy>eGIgksNY6i1p^4t z7=#iiVWV5d>2SJBUw0BYf==(AXd<{q^(`pSwN7iIsV-~{hwG^in)1qA%?u1z1Em%^ z8+VRolejX*O})1x=Zrr3E^XHuyS2RB79DSV(LwU9#pdSo9Ua$vTp2N|rmz$nEp2vhUVZqeSG_@DA{;db+Vv>=n2wY3lYKbVU?J{qLI8J=kVR zf^#)YQs zNt=9dadv80%l+6u{cvzh@&$y3Q(y(HwUm@~M?K%9Dt7k!vQ(z{tFTgbitCGmB1*Gau+mm;@*B+h+Ir@f}LYv#J9amieZ~b2e)bnvm^lBV^{Y1KL?$jLrI( z7C$K2&x~1P^2(9*S4qIN_)oKoRGYpG7ROwlE}LV!lepA3yyC-1WD`Y=9Ktp)y*3h+|?oBuE0te)I zgD@Pw-nGw>{l|#r;~2uj`&M8Y9rI))6JV)A#Uv1AYm+hccMpAURB2gh37Zart@10X zIPZI>1766f6QyvwZvp4QzPSAABq=HGyiV`c{0+Q!!El*@*lzt#}BRD|_8emgI)Mii&)$pIv; z=J@IMVyg4x?=<9PhK&C=Pf2A!`kIMj0=O6y^I7Tt=mWc}aAopU^)gET_*${*<=qNbpxv_>%by&r6k=;;PFb3eN_l1b2emq``Cr_$rNB4f%6E44knrf1OUb zrLSq;90zf6@>uC`W~5d52uDUOKa#pnOcm z7$Hg<>%reoH5yXJ$NkdArRCY)eEGx8m(=~Dg_-^wl)CYaXYBR&t8H?r;&*FLNd)}E zs|R23R1&TfJ}QuI6C>DA>0uln)rpx<&*K9wGB-Fwnx~!boa^6zC=wv`==&<`vr{

}RX(O&>e{2E#H~5UW z@NLeD;QgZ$Up<-_)1H#ar!Kc!-}ly!ss!CL3Xwl;Na+lsr0*^a-kgH=D|N(1$6Z>Q z!riQb3?_3Zb>xD_dB0D4zJRLY2hytigY23pd^^CY*HP4ilB-Ox%9{?mCnf$KCsv`t zzRF!;)zrwERd{!_2>R?0P(DUh$djY{CSQ+e5%z_oJo-M8Oy^VkU) z_|nFvm&2{OsDs{dZ=<28d{GW;ewXAig$C}+fGMI`FcU^#gPGsq-fRE?rub^z+5(1i zt!n2zgv7#i!2YMEC=BGN@GVvN*8D*BXs&XR$FJbIR=wP5cSC4r!mG{WXCJfOpJJVj zus)Q)_wHMJ(0$+I1|)jv@%7u-&D(0Gegxd8Gzbt4;9%#V^v%ss>_)!nlM%Tba(6IO zsE{YOG^*p!-zpv1crZdv{999-54&JU+TUKv*lWEKX1E(@!D0$4*Jo!MbwB>Ao9O6Ey1=h5LsQ@J1%tls^S(Pw|-B)sSVbo zd57xXse}|GG5i)n#bS(8oGu4QfZMnN`|!V+%tKmSf$u}3xega5e9)In{Q9OkCO21$ zRa?VArl)<}tAN>5_+p-GdQc2tp8if#oGvM%aRMB)FG}GgG&5><_qacz?^iB%e1m)& zwntAUHftk)Vvy^z(oxc+{VXyT%4G^8Oj)4$EZ!oxGg3rf#t%QWR2n^B94;c#xO}|? z{X3aKr!O1BD7-?j&@p2iX7amw*~WKvS#-eUad%?j>Zw0$dvy1s-EL2YPfHn`gfS(J zkPqRc@te(S0!N1e{Ea5fM=NC}+;9~1{{nG(pf;^k_r}f) zx~#b2Qt+3#qi=4fQ+LK9Z<2{6`w>|3j*}Q^ABr8s&&hLiWMFDf5~Tn`|}t0 zt~9Vpx?Ot+mz?L*jWgWvjVa4c@~7}k;_e|**-xS$uPBTqUDnirW&YjH2QUJsdQfaH z9^q+(Ag+eMU#tx4x5?U9wI_p{B@UkH+z6ZZLH#NjWwQcH9AJI-ZC9NmP34~-^kLnw zDJJBxQ0%^fA7SQmAh6&gA|VC29v(-i@L3}(oZ%wsX1_ZD;VQ%RvHnU=*`=}#Ny(6# z79}9^XH$|j&2AtPR`@j|2p4@z^tYPs^BL?xKQ0a__|{31@EP3uBZfQhc`{)Ws%o-X zDf*%--Ecjh!*4l|dq2SkdKiAdU|lWTe;tIR{+096rwo7;!YXuTygR`!tVkLR$SXDt zUOpd@Dz*BL{SHA1Gp(goyVK9eCm-cMK&`)fCR+kEXl4(VdMhY<%BpW6MVc1;wwQ%L z<_!>?1u01QvDUcmeV%nXzIGPC11xD6g^3=>t@qT z!nG%;4&P+Q?h*LB$fUG`3cUP(lJ*D$f8Q}V)lsS__9N%u(UedYy#Mq!4L6apZLTG6 zW2zIFuX`pHpIGbfy?<-(ZeA-s(AHx1G&>Bp^1*)WToUfUBFpQE0M~+9gRnwWD?R?s z3v9^CSl2q{8~*@Z$%Y8CzuH%QWk^zRtxkRYR*Jer(DxLFgvST-g41$0uU6zu6et;2 zl68fX-M2r*ux@tNkGQliYYNSVWm#$zc(*Yi1U)utyyP_6uZ#N z7gh~^|6~kcjeEkSh{7T&?w+5)5D(OvEAEEc)&;gF;5Gc(_va2e(^ar1jIYxhMURen zx8@0y=|>!c$bM|;okT;6%1dI2?7Pm}9`~xb{q_=uo(HTp zw#eO5U3I>eECX!W*Dd&1h)KWF*sUYX#gcT%fOPwSwEoo%GQC^sy+f{;Log7rYmw1w z$U`6GzQa{=V;Sj!46*ZoJZ0qMs5*<=4M8rFCH4G#9>C(W{&>Y-h@zBk_+5 z)-z6Z-uE={d(dd@l6^{=9l3=v!0ebG;To2`0HI9>{1R2V`r~aB6 z+JK`s6g^Ck##+eSJb-#mtk0_4qpf;?T6_7&7y|It*@YVq9;dLCoXZf?j?811A!cI0 zUiWW*zbiLby5=nRli>ZN9Pu-E)zNH0{?3MWzon=iD(QvofF&XH>HhY?3FP^aiaHr| zVQb##913tm5rl9vLI)I%@<@=HW+-dgq92pq+lwB<@R1`i#z{ExXO9Fz81sLM%@vd( zE;|61{ROhg0IxG}?7v}`j=D|S%F|q{C-eMch=B4~`2gYTFW)vcE?jpp6f`G8mRt}ed z)SEypQFIHiOe#l|oEDngrAET>HS4k!4vfGIKd8xD+7(;?ns<$U=top`$60T&+owJd z*W`SZZPxitUVF;q76cs7tUu`9{3%HDLw{U&#nR`_;$rl2_JNe+->9bnsN}-;=EZ}! z9x(hi#_WGXkJ7|u9M<=A7WGizZ*i&!XB?%mITs-Ee@wvV=u+Ys<|rWJ)y#7scuoH2 z@K=bV%1sQH9l`(i`+q+;8VTZ3p8vdc^%H)VyZNB?^})886;Opb4f?gh?SA~7V+iEN zt3&eq2ptXojir~=Q5kjQD>dU=6Mdt5483DjtD{Z3(yNsJ_0s2JLlRJ73NO=-2J*%3u`X$TQ-)a@z;r7A%4F3ThN_8t;lKE1GlB0Lc^3FyZVJo}z3E3hfhP}C zvcO2Y^5o!ME`^_N{5i2Nly;p0jOteh>7-YO1DUQwaU-X{co=S*-S5ZK0;Pq)mMRe0 z1Ylt_xRz*ZRNi7JdnWb;$FyfsDE#@P(hwfGxlBLUDVKF1b*I#*_U9Lm1m~uOGcq~9 z5?ZVFq*5Gr)7;+)JTR-@odH zsB9u!8A`b6(M!cU^EUn2VgP+3bd*&>nnTXdh_0@YvdDt$W=8dAYsW#{KvKOX>+U{H zf3ODm=+&})z_>f^L(CgnYuH@1blqua3Q6}H*#Y)#3BbDowlqMs>})yFZe4KTIbsbJ zy0O;mDWuDl~aUN&->sP>6{trI8FakQMyW}x&+&}Sc%YLr}J zg6-zyMDB<4V+}6Kw~B%Vaz-vF{*k**4bgJ<(w3QbcLB~6?yw@-AOF1f3qZha(##fR z-;vN2%5j$q$O?zFJ$Ect@0kLUPsC|>FKPO;;RC0xOn7l&p#&kg-&)o$;pK!ZKuA;N zK8(N-1WFAVwcD2&y}0QboyV${YJ?@i9h~J0G`j^GpiHfXqzz@CK3X_VE9PJV=KMc|Hby=gNY>ywD-ZIA49O`yY- z^A~aKvy~~LN(b<=S!gDu%T$2s72v!!fFqx1@5@a7F|G-5*BbC;mzu7C?GdkW`lcd~ zQk48|!o&DLk-j=y?Ft(R$po;{>hS{%K6=83TZti0)f}OHlzi3+!?&Zu>N|RWos#u9E^5)o-0URjiVssgjK!zHF$l?BkhjkG$Un;AbBWtj#wb2^s#vuoGHjc9dIh;ay_M>Q~|ZEtBf36wqb zoF2@vdNr(tn8uj6ZLk+og89jH<}=n7n=fZ6Dkw*&cvf_ctwLxOR3qlIxex6){F(&& zAEljDq5yIK!j1qjpzwM>l6QU-gxiZeVzT6l04hpT;6+2;klRb>c+AedA_l#$pB#M9QvKzLkvk57MxTZC$83B(Dd^i9Up;*xZVfl!)2AM> zFjFqN=A?1VBDN|Yob>Vj+@-3X(#h+*LBmx`LHy8KhaZZlc)3lAQ^<9UN@^Aj z2)OB8hCJ$DktN#SI3(<~i=iL?{o|bv3hbpOQ)5(EH_o}7hrWqj+^|Bndw5{Nwj8$V zwA^&f&qta+H+Fa`ZgSr(X!r(7O|h7jBvFe40QmeTB1)o3H3 zAF~y4;NoUYBx7g7mre~9ZM&>ZrLZAKnI-&$+0)K_hY82}#Sr6!n3xjnL?thCC7PGl ztngxG1HZ#wwEyzEB%A>gDmqlX!1FGZecRT%h2RpkzyWhthN8|B1!wXC#_g|ggZvT@&(0J&KF9aI~fnssm3Pyxoorxho)|yuK0#OcojRk zrKeb_uU{-9^?B|9_tbduAzCty^PLt)8-83QLu?zB>*}y^fS97#y=YcJ|=VZ)m~}$uW4Ssu*s!!=u7ahceq!Wf>m3S&kvSz ziwkRJR&fr|1f7(85^mL&92iTv-L;PklfEZ~y{Yx%N#-{rYYfbW!>1%7-{DqgF`li6 z-`J}bGB92}3wc@m-PKk+U25o(t#!;BP2PMbuN+zI#~aox6rC!GWo{i6n6jir>J#6s z(M`HRXU_p)0k|AycWaPl!y~kg<4Z4&;2VvbmdXUs#)kuwG)fLJepaJPB!(!4*Wtqw(M^qU0x;i`k6A-);$(RPVY|P z4?kM@?)#|n#?yM8UajbA&|gfb#a4fMjNqO>IQF@VQALA>w~E*q58^(@FozDjx@$ua z^SCH;O0D;T?9QE@N@>p=ky9D9E(umZM~gT=ec?~Hgf;R>mnBP?r^mti>-c8nCH_7gm!x{SUyQP4!87kYresj zFDT~puOo*Ny76qaMK#(O$P7XoYhnDYqbW#VA>>0LLY#_DC(!sehQo36<2FdUF5$|% zPV}83Y~hvZ`&-=4pK4b8TyIhhKN>Hzldf$htGTHGT&TsY~-G$ z3tFd7ZVAki>M`Jfs9b$V*NZIZ8}4u>(3plJ6apV2XOqC?#C6wU;c>^aN;cfUUYc=l z{>V9!N*F$&WWCbJFu8NwR^B(w%~=ikQO|PiTPV)3xwGLta@Rv>Xp7X1&o#Br0H*85 z&n1m~fSFhZ#SHxQg1^XM6ejO~t^YZ1YwVtu4Jpcc=M>>8ZHNdR)h1Xa4W#nfh-k$rfXLgZa{GvO%5J311^b#%<(oY?`sx z0F{3D|41Vp6g>wF5^*TmEsIH;#oN$jwUWeDm}Lj{wAD|Lf@g^+j!*MXv|k1LT``m7 zX|xmW#;>HY1|{91yv2pBJ9cgA(pJG$-3HTIqPH=~=BKu`^zq-h)Ry9(u<*BK3;f?K z-|hNua`Zbu1GFU>9OVKgE$Ce7d&sQiU~=ZGuyFct;5WDZVOF~EZq%!+spIY4W3RVp

^GdRsf1pA?btT!P0 zsx4STWwA%{`r#Y+2;P8`cEw&r&s&SVWH|AkGOOgUEGIH5SRl65haV*(xLI4C z(14Jq?FcKy8&owXBRYJYz&6j(Rm9P4nPZpNU;a09E#>;~Egk!;J!Kqrr92rWq&GC& zb*^6oMl@whz^k<4=Y0Fl)@bD3-UXj-fw%j)@%Ff zu9TFtS5ifWv2cbW9c`7MM*OQnY&`n?>~K-*rPv#ZXca|Y>p^K3$zaInt$P|fX%nfz zniAaVlmtKX!>zHUllT%B`d6`gR4>*)Q%kbaSw;=Au_<`mcj$_0wQ(mJWIW`NGBITq zh%bJ{*3K8~)a@x?C=0&z1I^Twv$M@uyzOAEw7s90Vy#$BXRlk*7Ju`karrZS3_9Ah zpr@eRy~m;?+S4LML5{QVT{EC5Ve8y(Re6PQa$=?!IZFuu2 zm?^9A>3TJ)dQ#V;P+qC)DXCS@kd^&?-hy{Gjh;Jq5v3G`g4UR926KPtwq9;(a zml~39f>HJIpnZ0%7+&YrM*pK4m!FXP2^rfCKC#<|AhYQ!RW+JD$7&rPMnYs=P!@D9 z)(tF$j}+N!Co3Zym%H&ijUijywEY{>62y@|oQUW(DsJ(x4MN|JjH*q)xg9wqt>WP`tC{eN4bcn$pH>uy|=81VvgYh&1fZ$6ni$6RI>+-?GnjjAskD? z%xKLVMAY|TvmHf@lwnn~cw=R{<5xs`g;iunp8NNkNy+q2o}&xtn>{YRVs^;R3RB+Zr2HfMET`sL;}JF++Rvoee5{2&S*Xx<0z>uN|)C4Sg&;HuhsE#!*h+ zMkaYzn_p|&5pyfl2>iC@a! z@f2rK)#=Pr*XWP`Zpk}Jp}A=@5;vGY{BoU@3~aEk&mT7LKYMUPL6L8@a?CdZ(lAny z%2KF3w)cL8#%W(%HzN=ozSf)Unp994S-%ES-_zmANN{NF8_g|h8&2Ifi;w@!_mUjw zwOnztT6ai=HS<+y*qfip+jJ>|poEZ@;(Q$^c|tDO2ch#a%ACqG%5r?gV@?Id?!j6b z)SS?!fm%$Co-?rx^K6=3ZcB*~!BdO0gO40^zTI0|cZ;=QvNw#3iu|y1i1!3>c7|1p z=A}H!kvg|>xFx9Dn)A>EL6z?q=WZ9Go!crY%|#V&7YTb zea&taqBFb4>~sW~Je;cZG3O$ovA0UC6&z~gMzuU@oQQ~#fleCkeL-XF8PJF% z-HbFc16J8=abLRQO`v!txN0%qa!<#=e?7u#! z8Wb1Rj24R%o)`@7UAh6eE3@2u+OUsyJ1Qr(*nrK1#Dux^{zD1gmLXEhSE7OiQsv?BBfw(8iKl7@?Mf9*fJlw~;#=K7tQTK?|L z^hs`~>S(Q9^`J{5)Yf|+ir|WdKX0wNjl*Md-7Br54=&PYpl)-&|29{#9T0SzY?EbP_ zP{+6*TIpHE((v9mpX;}2C9us z@ePcYL35nME}-wF`nd&O!+R0~FpDY>mLa|O*V)Z{2j7dG<}~?Imi~6D1e^z=bhVlR zX)vyFJ!+K4Jo+2{(WkiFMs?VRJ@(BDi3SPS*l>5y?)ql34hHD=$-_4UgS*!WZ+-E3 zfE@T>>Oso}*ZmCWM&|ew`9{mCIhfGTQD9y~Y~^)62czD=%>tu`iklsr9PLc=r)52mz9~IQ7y#VvG3VQ&TN)(b%ypY`V3Np!`Jvy{`4?=(^Y^I8dL6 zShU_}buc$-!-rpn$B^`hErF=Q_bunc{bo_{)$^)v9#2AcY`1m4m6@cz-?(d8NsN9x zcJf7`=a-TFfP;n+4)Logu`|{!JM8DnqY5*G`HZ^l1&I`e=*M{_IS1eZZQg*enw+a6 zQX5)-BfJ)%fTlpc(F|7a`XTh8Cu8wB9q&X$RpMq>odR=eF8%q$dDj`Ybk>8m9~fpQ zQHLb^e*qVTYgI%UO4E$&dD-Uk3EOoJi4k?ci-`)%Up6r>O1Li6sph7I#+sF?IB9Hs`5u53U;c_Ai4h$hNtixA{cn~FKq!Al}3N#H=PjWf2Pxb$VZq=j)7m| zI>;9u`n;s3I?;LiyeY%D&mEv~@xK5lrq&1Sp_$PZgsVfalMFE9gA5AA^bzSb`n})4 z7AhFQaKC~m8#U=RvSXO;x!_?dKeq^=YR4&QIWBGX$NE(De>_4`T=Suout#n;8z$*f zU)U^Z5I$i_xW1_>T^JV|Ug}N6iEh-cZFqeM+B4Mo>4lF;Y=zEht|vq+!RJ~QKYd6z zXtaKlY~K*~goMerg1_#0PM(dl|Ipg!HxQ4M4XOf6q_qJFC|jhz__mGR=%%-o+bl$X zdT(2bLIfI~?jWjQq0cv)h$7cfP~S<>vW?F7BegIxl{$+0&HlmYgh_Gm!M@a$ z=PU#5r)(M^0-POhjo4el$lG6O#geB>J=Hrpzbn}8>zjRLQQ#E{K`;RD;YuyXK6iSx z_|QIDv7BWR)~KJN12p2RA#ovd8wd?#3(lV%;oQo$xII<6L&z(!ofK_Kf{T-`w5>`^q62&_j{+h-i$~$rNuoF z{ZhLocqqMC1l5FTUV})JP;>b?o85l>W^b9U-M?`9fqIYkoZT)%igBu%4_!}}{*6~@ zn#`e1=A8&u6T3%WvKB&d*|4vUX-aCD_u?N|$L~`V5yjH3UXqd%N;)~abLo*O$HTRP zY$VXodLjuo_6`oU4+yWGTH+ z|M+Dk8+xD&V2?u1&ITrZ))-H_>AkhO9N)^JFn|HT5lc9NyP0L$i>>*faIN>gVBwmQ z2Kx>b?H8|n80IpP_Vw0^kVwE?;^bRTrRc5`L1wgQp4QcF?-E4mzyE%O(1Yzz|y%3B`@6}r@Tvb{FtXJ4FKqlMibb zdrRqaYaW8jZ_1@9eRRZwYtJa!-Tv0Fr+>Y-akC-pc>kiB#9o|ea>Z(&)5CH%aV zv;dR@fUNS~#Y^|nl)WYe5b*hR;}Jnx-Bb(!kNtv&Oq;2K_ad!Lzx~X~*=U<>?uH#} zgKv)1mgV}gyxj9$K=P!RA`sanY4X;lGd#X!wWq%g$ZK&bTg#<^p8K2?yQc6UCGA3G zRi7jCar?Ir>L1s${ck()s2$i3mcG0ZGeV`Q)Cpz7q*p3~d5)|lt}c3*y<7^d6o z!OE%8eLho^vk|f7;4pmMx_iD9LM{E?F*-TBBCdz7?&Qe@X9f$Xp85MR1>dF4>AbOe ze?PNiXY!-P<#+NRq_-ZMhX?;r;w6OtZEJRpv*P}xv5Jw{6ZgKYXOX>2iepEmmRW7DUaRw5i*jRmg}2$ z9tBzA^hY^%ztd9fiq~p#4|w!h_bv%?>#2jpWe-ok$8kGM)YWPC=roNrdTKm z^x|mBpMwt9Z=jVe2#ruDcrNwJMZ3ExDSSsLp@A^BspGY9Hz)dt(70CI)n;gpdP&01bQjNOEy=lIDijKE#qflaLX^ItbBdBw;nOL4BlRnn5bg0!7mahWYCML~HV+n;iOu=$ zcB(0~I=!P?I^j7shhYSFi`Pja)e)~UY}lT1*s|Gtt%|JleA*WOY@r=>gR6Rn<|)BB zXfRK*G^xk9NRL)Gu*#vrS|WTY>9sOdU>#lROii){^q4ZQpO3O?M4 z)T|EoUkH_CSHW`VNj4T-M=J?)$~tBg|9n-F@5m|K0q-yzwH>__#H!x2SPLx@89%?s z=fVX28Wf?r(uzRk7HyzyF{uy-)yKx39fMM`7qUZhixAUtmJ|Cb&j%j@Y^oYi&{-Nb zrPX^I_Ms+At@Wf%q20KwD z(GEdoSY1``-To0hX#5~?isv(f)x&y@l>%y8$Nq}m*)#l?}#Ts z)yyV>+5v6}XtUK)Qn32rXp#s6j{gm0&wJwbmHVv@AwT)n94L9o1k3>ePq+?+ws~b&HN-8-u7Ks zVZ3Ee+C)uZRWj>6c4`pc_3Q|Ls3yAY3zNTq8h=lfiR%;EB>fJYiUJS}VKB=%qNa2x zaLaj!9-tUzX>0PQMFJ@D0=*sZeQRH&??E67bnN4j{)uzIm?I?b*X=5Lpy}v8`X5M0 zb+^_Z*c_R%f9tG3C%}>Uo-=LR51Dgnm=BgVsl%!8SLiTfU3O01c-Paz*Z^($+hX)f z7~H8%S(|AGX+GPgZKL(OJInD@g$~M_!M|Fgj;@mA98qSBQh@E2lYfFi@S$F>)TW=E zk79|98>SpKRA&o97f1VHM+^fR29Da!UjhQc;6K;grk3zc_#Q`E8Dm+U%t(tKu&!L_gtZdgw3 zo3)#@j=q`SC8hgTbYORY4vc?UaNdmYV|}8dcjTG!lF%M-XPI(yU!+;}zsAIy6Davf z_?3gBmYgf;NJ3-Z$R2QUyoOJ<9hZ% zGXpH>*Z%@InGI<8-$t%JpzVojV{bYdj(?LuZ0*ckXF=}WD|tWzX8fmOaulkcZ_SRD z-&CF#W+1UpC+lAjk z&EdI@f)}%cj^6tQyjN@>f1bm{@317K?0b2i$*6rbjE*B2z#?Ixe!_2`w1Qu-&_p`u zm;cd;9G-@Bobpn};j*o*pC~{9SOB112my5!ZD7z;ZTN=A#q&_{KiIfac`5ncvAX7_ zZ#q~1Xun{n2#WlZoAi@T^y50h(3x?7+B*QD-C3CR3q$OzCES_p%XhY5k)?Pu)V z1wdikdKl+H=CT?9k5RlX1@7eiy3e#T)+7MrDn~~rCcq9tTAgSlw;}gf%3kz1Os>C@ z{9x_i9X0(9~eO5MS#Sl4={r4vn`&cs^beR;Mz}u@X*Rh{9%cb4dLhtlOD10 zAo!n2JB1aRQ--1tz{RkNr@)cdpZw0tcl2!@l#s8T7JKu>VwH_nqF&_BEv4eU^%e%c zavKSnrsBMfH{o>QSF}MQdn!+z(&aty5y5TN?m_qHa2==HU%y-vh|Dy8Es+buV{NWEgiqmW~Sd4*1;3u!mr8mbh>_1U1?TTNXdRh)aQ~V3vRx` z01hRH>9X>^dQwaF-^Dm`CuBOUJ6N|&-0*456aHVMeRo(>Tk|!Fpi)IZI*5Qs69MT0 zQl$4z=tX+3N(mxWr3;~pNH3uW1SAoVBB4kL9U>w~FQJC|9n|Z+_xHZv^L*vs+mIs3`F*(F z=li)%L~q9n6!R7o2#e*flW?_H9k;(`7aV%^D&P8+I#1GP|5^^am`KozJhfTwk^DDC zArNgdRNuFY*L}wnKUE2i_R9NU@;=Ox7megNnv`0EL#dZ<4H48=e5g5g_M75PdeF&J z9i!8X0M$DBLd;#9X!WRlWtxh36}=Kxj`Br)$qtp;qvMA%6I4a@hshVUB2xG(rC+M6 zjm##ge-W#e2d&tibcs2`o^^(B|rUob3j558RcEZX7RrDrpEBp&K2HX8jDLFRi%q4UAdjy{bQ_H zWLWDiPUMPAv8VF`xZmWrF+

-YmY84c5}p=lDru@md!x`Jr;QkafYXqqBA5_S$W; z%u@PrL~2VH*FDWY2SGu+9d@>~ovP!q_xy;NVB$j&m7)i^?#$8F!%IX*hGcjYN({w4QztG2;dVT6cA5|vg5-x2bI~*r z7*!A7`D&L{BZjPKbno&`C?be#;eDG_;R;=PM&3xc+v{ok`e8^IcL6WUlJilzKs5)l zc=cK*SQ=A9hOC`|mID=ncM~^XhQoMUZDQWTPWHq}9O!3CE!a^1ihmAWFKp zm@hg`4RCLud*dwh9VE>`Q!r`E~q6P2|nABg6- zWvN+hYz|BfU7T-P;7bAL)d`(_B^N-7j^%$B&w-c8&MXiEJ!EuAd*q^4*6S_wbx7GX zN9KZNGHK&v(RzoigK(GQbjecKb65Z+cfk&w`Q&GL6o21CQ=5SoWjOv-?ZU?&oF62* zy4F6^$&t(JzQ1-lW$9>c@^1a!^#DN^;|MJ@wP$sT3#p&F$%FWCHI*G@`^n*gNe zGPlFZfE{Q9>LXC5FX(6bPEonu42NWT$dEI(lP5i<(~j05UfFjs?fv{pV>p%*#I0Xk zRNgNl-C|yAj}tklZX)k8UO#6GwacFzQxCdq$_q>I+nM>)uLv&foG4f0S@Y}+Y%7X( zeBvWB{Y71G>@2L?2>W8ws~CTA;adblC8N&nL&@kvQ2Rc_Sn}txQzEYhdhA#f{v@L@qAxQiFyJ zCm!oFjPGmiPS%%Gy{`asS=>O4hVD`q@Pv+T@SOOT*^<4&OZO@(q^zgCK!51-(PG-N zWW94?aIbwK7&{oWp>G=LQE)LeV7awm{7fw~!X{0KS^))3)_AXDsVLN1V&rl!T7my@ zXdp<@iN3_JW_&CptM#;-Z8l|kaD-n>Cb@%FH|35pXtyNKn5~J{L&!vTS9PTdR=#^{ z?2+CHu@ve$YEXn{=VTA+VxH_B?=YYsci;5NKaMO^f0LxUTD#15qx9~xiNhUU1ED%mAV>Sx zx^%^Qk-%||4MuBI6D%o+N8Pm_BK$KQcz6&Ievb1gK``e_ItY(M)fhi_wTEpVU#qs~%7rJ}txvn20N=k)31DVz)>qr3O%Xor`v z9Bs*05B5&RuDgCChPuW2p8msyJxzbEamHw###$qgsGT#f5%E@&$I4N4-Uz-w(RgvB zU;eCAsd9TjwI$zmPiMTe5MB}A$J;eCBf&so%EhsewOD^Fk}9|ILv<3PuO`?Rq4QK6 z?7RC^@Ul5aKqmoC{cuQ$awN=Pa@4-Y#djOv%UNom#1FeQg@|Rj*{aBbSAO8*5{dA;z;PU}z+khreA8&@8 zad&9Zc-0UvoD)cP7W5V7`nGArd{ZM7g6Ofst|d-;m7p=(10BT!n9C$T*+CJ+K!u0) zH6S*cPA8--l$maH325pyc14nv9KV^7=>6P5pQUSym3~^_FXM=LaQPe30z3Jn7aX?7sE|6G`x|f40Ro7$S`}T5L<9kPX6ptoPe)XkuOo1ffCwXAh}`Xw9I?8P5j-ExqvfRw zL&#dE^(&0}?knKV^`CXL4cyHDw^sK|FeDY#*gc0``C7QR<6&8tJ)34dmPZO+J~$aXmlHosTk`Z?!g)IR%L(I*J1*Om={ zbNoDRNx?P(2od<7{_$HPAf)ns1<93x$PHMJ9thw&btl8Jic$@6B}_u*$_Fm`BlnHb z^puXJb8XKA0q<`kMCw*R4`FlQLk&;+x$Boz_QDl->x_NU6S>GFF zH9=P*PrO=7x#S1=)4H+Ym~n>6P6#p~FT6PV6H?^@7-a3mE(0g@h2JBiu*R~hPXziK+pcEr`MB>QoVtwTWo~gD&L&FuC()z&cis^g_{=E73)Tr(}Z)7y9WsIRM;fR6B zU56nE!x^k9C&Br+*Q29l@p)G&Zh5MjkQ0>i0oCu|A1HxC2cO{@yFS>=`{61Iq!3{E z>Nz+si7x=z5CNTjOz6Jonu?wAhavtN&d>cNoV&I0KgRBv9OW!6YQS0-f+5#5$!Mvr zhI<(Hay_Lku}@I6^*Jqzwk$4oxJ7rhGIPTF7OYiBdO%Lpd&C}fBBaz9RH&Yfd96HH zJV)f@sZ1CJ&wZv=m#hbp?6yv=&Xb|laM>EDo(5k*al-oTU$o%tl$&vrSc4 z%3o%O?>ON;d?dkak3?-g^feT#all%3y1Yuk6KdQqw9vGmJkhW+`lNF6><+c~iOToR zXHK5cbLWA6Jy7Pva4waRHd2rOGN)2M!~8tEt!f1Bl`gGGwwtr&3Sw})&0X00bDW90 zPLbs&U%U?{_P`7Bi;*uu9MB-tga(gI4buLNsiR|hQH&9pN4>!&SGCza_5E^1`!8ln z7e}hIWAifB!Y(qXbFXpVjcB<9gHp8_8LCT$M(tZj^^U+WE)jxpuZFleqUezvJEX{c zR4It7I*>@vCtV0>{wTdJi0D3D6(@CcRyCMsK)XuvK|BMbFC8Q~LV#qf`0VHxR;TLx z&g{{w^IWG3Yb#8Q2T3~Twj@TPWN&6FZxS!YWqjdsy7NiM8vQai8E?qmd}97GEu!pu zRLzRnyJt+e>1*Tgc>t0GP8^_`?=*<_{p}j;n}?RV1KnOPfka>$2Qm(Q_fUe9@kYPC zWLO+@M=Obw9IFmlR~vJN^5aZ z`46~MQx+BVa+PQJOgAjtxj~mi6YkNVax11VNM3R58PCur`RI&}c}S9c9Gncn8)91} z!n;H;57S6-(6z(mLF(OivcuMy^CdtX-(Sb{ygwLU=gp|PU#;q{)joa+Q|>f(wZ`>i z{8A2CQwhu9s^h|Qe6hyT6V|@l9umt^?N^O9Vr%>zVnmwO*}7YNy<_Zva=eyR(CNv( z)TXsT^bQ63a!JpAsW^~RvR#I_b+J=jQX$#e3ai=jsu-le?!}n%#PmcRdGgn6EfI|R z_}nm+Q4k!JWSSc_V?A0kJ}H7-I6xG4Ozb0qoN92#?fgrZ_SB*21}Nv{JNnLPKB=#c ztomNI`&=p6 zC3G+bUR6OJcz?7Fd+wXHvkLN&cuSUHolJtfb?%}P-xOk(O;%E(l=7pAro$=-^qM43+acAi*Re=?;ENz=_&`?4t-k5BY27ZGF zboF>NJhEAW-~4OO%EF(vYeX*)wZ07JavC1@;nh;FOD+XmejpKCF%x8LyNUMM>-fRF z3dim>#ZLRthkWv?fRm*e@#zlVULZT)TTGGJf}2%iXIf1*Av8IiYszV@+@ZV^+7S2C zx&SD*)R=F6O&YUwyL;;6!#3LqbkJkto1ENT<|E$;4_>+|Vq+8*l3a06(=3bA#|2`- zo{erYU#y2P(giuN&m*+HL#k^Bji9%Cqh@#}bFj2S>1D?;2G7aq_XAa56XV)Ss1RR6 z{Ex-CdSX;`9jz%~0nwn-EpqnrJgeWnK(^N| z6u`>nzYNp}Pu&a#(#{5^i2bi*Hs5ri-?155rgZ6m02JWRp+n=^M>Yi50+s8eM$!d0 zjnJYAp0<277Ec52z8+^TdYBPO*-L8#fAWE`C_`WBwmOts;J~O<3opY2Sf)RcoiF#y~g|BC1%(Y{Q=KbWmM! z?5p*KdKRo^z98~5NgIgg{cQUP$nJvX$i!}Ficrng{toraMwKpd<77HS32(foW6kTP zbnhglh=Pa9cj)9{&#JGiwTtc7{z50vU?el|I@+gC{@|p8ZZEh~K=>e#-puFZ^dxda z{z7)}^o;Dpm#JS+0AnEcL}xxT6Iy2Odk=H=0`lY%JMyBzr&aT-+ugKAlHeXEDZv54 z-Jy?3!;ia3(@pVbioUT&ylxmNxGs2tVIyB~IqkrOeIqo1TRlM8BT}@u5w~OC-0Kwr zcDJPC4sYk=5`G_Tb4!c5Hwl47RbJ+AM{MDEyQq~m=)>t~T=>v^-CWTHg3?r!awOQ7 zIg95#qEWNGfa4%$bIlHRJoar^-jMk6&+$xlm!IkRJRXGXrItA`t_)q0AszwMF> z#jul{SZD^?gdkDlewOzQ@_`-b;lwyY9qKs@XzZ2(#wY8$o{ol`|DkG@^xK7GT|=HnsJUr%o9sFq}yN}ZPu>^ zL!NCMz;QM+$G!?6QwhjAl{7n(oOi(sUgh!^lvLg}CZ$RJTqWmW4|xEDY5wYM-EHKE z>Q`8GPHIl&eR%D>Fi{0R(h!Fyl25n%1t#aDpep?3uC!2>-9YltLAvIunY}a7SP8jR?d& zP4Onp6N=+;N3sd|CKG$?TWVx|CR0OTWYSal!vLW(r6Ejz;e5Zq&)}{sVP5tH|I_RH zFM}_^jy5Od4=qemis@}X^Z#nlX)&5nUSsJ z>v+K5hnZMPH9^#*5&9y1WkO_VkwKx7GX0I@%JYIhzz$A!gNd9rT3DnOPVuIgngb&_ zB)_F+kUGM;*e3VDOz5#Rr=I|WAqz5cMs!8{ISOyGOi9n6KyQCZvGweno(vjM)kh#O7x+|{)aVKCZu5c2I4 z+F<8i*oHdZ^4zejlYlX#tg=v_&n1$+L&p?i-o%7cC0kGCW7WKzMARQsSl4HS1P49y zwow_NkI0hY&EnELGiX*gM+^Z-cd{1A%D6SvD?HdyI!QXHijoo;%`ialst5)ZiuyB3gn&M-eehGbC+1? zouGK;#^e>pK8X?)rv$l9-Nd4{jWv0TRdnfU-dyc6QbOKRq#d4EHI3K*38Ds1&V=6H ziaHk{I6n?NJ0-I@Jg|Gl07;Ii#O9q;#UIQHc=QWI#R`r}(l*ak^npMLfNarz$DgDe zj*ShDNYO!aA>!E{?If8p$BXmgzGz=|{?UyOyB)ZGIV0EPfI|CU*i)4+1pTB{Svedc z<@*c9b$$;*ZYMij_>xi?+ z5mTp^ZXr5G>IOae=T~Pefxx@2mXqRHB6QoW;;(+kvDl_)rvs^FjcnR>x?`?4>%GIb zg$|O-A3oXgwj3=tg;ND`G|IX(yczEVaa(NX8yde`DEgi}6iBpAIjIkdbg3~bEqyod z-^JUNe68Mxr$gN71Gd)2<6F`Hauc_(HqQx}qu%pj}Q}P$mU8yh0&J9T6`?w@Sf@%57UJR>i zet%RJ!dU+B#;E;;=J_KaU3M=+hP8(R=8r!jwF+zG9O=O*d>B;zkz5ft|3iwj-FyOb zcAzm6(F$xpKW(OQK9qbP{ZsqnU>s)Nu^XZTNF7RlZZHTu$EX42|9KSQHDa~C65Q}P z@ABL7@fmWM9QQq4#}a0x2Ho*{@3gW8T{$gfp7vG;$K8IppcHgz<~-z{MVBe5jRPUK za?`w@Do;U)(SfaOqok+Qk$u}?&&&?lG_z%7ubg4Fj@WfNn@RQX)mnYfU~efc(Q-#m ziF=7zn=yRloe-h4r}M{$hif#{o7;|eRh&%eLI6 z1CMWD3hL+IaL-*wAEfZ}EV&m-)f7`~1-&7hxTXB2$*B%{!;>=NS=#xjbdQQl4zCZ% zm|JN5XGwd$p2Q|fyAqDA4gG0d!kDuRQaUS#|bC#uT@levk8I)iD_V-NAX*pl7(| z_-l~*QF{73tGqxBrxJa$&@M-kMO%?lqOu;;-4UUDMS40(lR6UhAu%)O<&76MZs-D0R!+2U${H3H(0ncupxA|>T&~)Cnx}(%1dUPtnT0)G`ni^NC$fWQr z!hcZze&&Twn8?syVPSumU>20VODWn`CMYm@SVk}Zjea$Ft@5^#m9-Ch4cTGNJAGv* zbJ(5^;rJ?lx?KwJtP`KqKTVspRCM{bh-kdIZ%slx!KL&Ov^SLCU6ZBxR<-zP~^OScoS+kPtzthMDU3(68@o_nPY8oTt9uGad`Otzy!BgIQ$23N9znlTObuDuQQ|a zgxl)^alaCOp^g6Ck*5B*?nKYMU{{RYX76uEwb&SLdE-vxW>y||GU|n92k(HqE$g_U zPu-hxcT)qqP+J~-+%Hr11_`V6Zo7n&_+QV`shrSfb@{y{Hs8h^8=G}X7xV-(#7go6 z+QjX14V??c?juy`$SP}nmVG(vvfYPTG=oC=Ea~d}0fqU-7d9%F?~zUN-gm+~yc|(e zHw_u*cQUANG}{pFq(_-)Bb zNc`5{3L=2&g;5((#Va<#o+~r{0?KI@jqb*O&|<9yq(&s(?w2zG+Z!OI^Cx}(Gbg*j za=LMIrv3H#x%FF#@C>-F$TZKL*$$Q?1aVjyu#*A-E5cDS_@OG61Pj>Wq!L}(Jyv${`MR5FCmJt&lnM>cT0Av$RKU`bCJjHXBc@A)}e?tbh-LMC( zeV*r{b)VzoXhC37cDmqTDQ4?`T~hI+ovWH2&}lQ||DGEGK|eZ>Fg=~&F{1k$9XJQl1utrzp2GEbzhd zE5E`X^9Lt9eg}tVdt-BP;9JPmtIl$F&|T(_Ei##~ZiS_pA|58DJh{q+VULMzWAG7E zA8l$R+V9@Cqb`;$qcHSEJ-w!@9`gdh?FR~o z6DOME^l^8M`}@MG+bUT3!0#&Nj}|<6%&l#?nL?wpfrw6~;BQSM)f1!BJG5d}Ri8fr zAD$?SgP+?Uv&0p&%{P4=<1xS3t8e@jS|!>l-?xYqM?&J%iW@MzZ#p!Y4<)Qunt<}C zuxlW2*l(pl3}ge1?BBh`*}gI-Yjm^wF?#*mrFdM?`^*nR{7&l+==WpXUcB=KnGY)B z$=Gt^oC(z1*Wt=0W|~M|Llgx|Fc4%A-m**+sa?kS%J~`!QX0!ra=o>s5f~_dXh=LC zSubI3*mHqu=GVFQp`5=xq(Vr(F**3~BQ27d{HnM!t4-G9o;8+Zx8(2hPV@esIJjUjD-_RW&2R zk%BN-M3hzDMT%Ro%3kk+hx-~aaI#mBp0Oy~R%e@!@cGn{+4dPWQ{tY$uHLQ%C#_z- z29TkiPPzZ6HdQXHeb_x{+@f}9*jcbsmm1GmOz0kKna8By@UB-vZOjM%NjcD7r~_fG z#jCfWs)f}I^)1HgLdEfEjivfCDW8nEmKArz{MT`5_6N1IOyeM&PpYt?BI8l++nbCQ zTIAMX0IlSy*|-q-$`h-e}FPuXASl((>}xTi8d}?VyF)PctfU!%LKn$ zJV*p~`+vUQ?>vZ&dbj2$4Yia4yj!z$A@oH+ozDG(o^<1|yE`1VP%8<3hJi%;2gLpI zdc?eS+_}s3G;%15Zn+4L)(z_q-&+Qe&Ov(px|=I#ezy;7c+2qCHo#o zzJ_svk*Qxei(^v0ST@RUVE7r7NA;cpYUt^~s~& zK`q9#s$6JiVuxr2Nr1!olkh7t7j0+Oo@!O}Aubv?MmScCBzxZO;Rr^!T>@JyTa;T& zgxNQS>qc&QH<;2ZE#Hz{q};8=*h`C*uoA%&JC-8zX3aAz6V2|5&y*G2{zjNrX?Z|D zs<@b6_l&{x$I4e>JTihn!4H=cN!oPQJWZaLjA@I;=2-XX{m4>%xQ|zxFB<_QHb5e`F1A&el}k8c~o< zTUs9DHw@)T5vTk?-EE-qJ*9N+;um+SxTLC)cn5Mo|K%4RFEy|El!@jSO2QQI(YeRe zR(L|yAJRrgXZ^TE&?M-e2P#Ko_fgj`=KvmTZMQ0oG|xRy^ndZZs`@R^_~HCK|1VPt zNPe%4g+lsMd;hl=WlEeYW^dDCwEir#;O-oZB>y=AhJl=Y>~E&MFdE#>Wfmg!v>OnMS$=2KL_#j{C}b;!vcqYqs~B|4A0+oe6Gj((;fP4=5OaUM0IBr~T!tXtyUTYJ4>6MmkBG)RkLiKoXWflP^bZyG85%~PNioW8l^>DdE~>#S=3y08XqAQp#=UE^2aM?8DK=IMash z@^)(gj;)$KJTY<-p#JBLzF-1!=6PExxta2sOL=#zQ?h^r>hyVANlxFU%9Xk|@%&$p z%-wqj0@h#e1OY0O&|Zr!O@+UzAn^E_Ai6=A29N{VwuGL5XdDaG31Ng?b}+fPkETSz`wWSKa$-{LspIg%UnR zg&66VHE-lxo8K|z`A%rdcTcCo|(NG((I+dyg+w$8f@|m+wptIZ=)?~jRSS997BS!xO76m&Q)_Y!V1oyWG&WvbYUlIFTC8!;R#B6@_G!w zDe7sQFP)54)eqW}?UXoQ9Onf$98u#zkP7{g_>#q^F8xkHEYhnF>|6Y1cLq$Li9+#H z<=qsPlzFZwMf${CM+Nuw)Pift!x3Q@#WJH*jXK>ADY_LeB&EEF+*3_=(#3@oo?h*B z6XV+CV&OI#9V{=ufdmb$spyaxPS|z4Y*g%}R9_n-xFSTf#`bL}+A!q@M-AeTt|G6RVz$RzYnP4v=jt?4f*Q3ojFF(*Onhz}_*c2^F7R{7exl8FJbZq~= z2UMuptXt2i@0Pc{eTgMOXUj1^sFCKNdJ3T1F4Y%8r`7vulJ5V(h95#OkBzS>Pp0}v24&DRSU+% zzFJ^EAW$NA179#aLcUR)v?_mj;1ji5@8(N9X zK~8igDxs^qok^Ja=yUaj&Jk-Thl(0zB|eHIc*vP(jM8|gqhpNIM|^sBwdH)258r(Q z7@|CXnxdrKLr9N!D3K3zd)>IUcR~>HiNILgwFtGd<_yuFTEAcT)uZVeejGiWZysn; z#3K0pgY#HYYW|DIPyZ#YWWHiq){c#PNJTzp_qCtNSMm>A`R}jaQ#`s}5_EZPl7pcx zaA;?!I(6>j8G89xTo7IC+=Co@RoB8BfTyqK6+DM;d2@GTp@@)W+!Ffx|J-U99Xy)b--Br(uwUA(&pZXUEi7?6#FcPV~w>A`Uv7*x`iq?U$yL z=;BfD;*xT@?^aJA5InO>H9Rc`|N%n&Xz5 zWDq7~>-Tu&Jg2)+aRZv3HE%GPegi?9*V_!g+54z(PsLOHjTl=4O3sBvVmjOdx`}RYH$Xq`|o%mkd0$|>h(#kk_gIpUNH4Tx2g_d zb1`GK>tG_rz~M9Ewf=2o#dcWts7(~( zZYvr5vpeT!Z)ILRqDwxS-$rwW2y;a7rH46l&;>l!MUU$!YI;DUkn%Y8?)=0TwATz| zX{1_)Q_kS~4ml7Oy)p(-)wO5v3)T;k{b9C^9v$JtZW*7-W%TF0uvZvLYXUi#{QqlB z2F5t|?L(OxLn&4A$I&WwpLQHLyuCiVUDL2nq!%03V8pKJ&+vq_5L{F4DAGWdetLWnJ z$yBTz79YbE9+SQip^GXZ6-q z@hcexgfDl>lNTp)q@7?)1o|?D-S|>VAHjG|d*H%1D@B$exl1m}fFVliP_lcc(0&?c4YsW19|I~c zrk=#7`Ijxsn-+S)mao>ricJ*)LB*eqxN%A_(tdQP6HtCFoej(t!*ELJ=v@<;FMq{Nb%R4YXHEbr=ek!OnMGkl%o6hlN*FAYseQVw?q6 zQ$r(T)%La9Uoa4dP!HW{5H?JlGQx(XEFFd4R;^Ot9Irv>5F<V>1>uvjav!6sj_ zQr%ba_$I~#Xdm3a&^xfTg2wRY?jG=8y8VfJz>vVWN5Ztmw~tTd!f-tLja`L5CF(B8t9sx6e`k z-oNazPTe-}Rs~C6d2K++=W~2s%`1MM;O>Jn1qy@r+CL_W2dJCobETtO&V+R1!6zOo zAEd8C9%F6V&r?A_1oLYh$s(Dgwp4Tt*GJjYOzp8Xz*lVVONH&Ln(vQ2>5(FE+Tvz< zg51wt-hTo*wK*^Lu0JM|rA&oL0Y^E&u1URsBwcqsyJDK3y1pk#Q(^?pKSFJ=%JuJw z5eD42U+7rrQTkCRMt`|hl1cIWh4Zw&~VT3#^AT{)7NEG~^Y=N)S0 z2~g4%Wh%^=VyHvNo;9Bfxz^}~i!=BZ!B#{W+q_uSbe0h9`06szFZ$9_LxvyPxA3Kl z@aUSv&Zli*bmdtk;}9nD!p};A8cVD+pex7Ccj$V3D2e9!t#l480}Tt%>IZ#7gO1FB z@s!x^=5_6mk$2D$It88LJmQ;OP@4&R(>SX(=4m0KA$!&vHym}0F*!$zkhq%S;x83> zrpbr&vJvV-9r60ITc-9j_57E9aeeN*Bt0$sfpGr;7vH&=2opH^Gr#Ah&e0E$!c3GL zVYmIARD~Sa1T7&BtmMRX%Vazdxeo21kclgJl;bcvBW-q=iXsUR?&#+ z$Y5s;{2N}Hj6+&$uGTilQG7h%6IyKeDd|+#Zir~t(5oT&!g|>i@P&{DJ?`^1@M)P`(K+5A4*i|n!km? z;*FZo*L|kqIzLU&)#d3>y|nQqlI?rbA-(8f$;TDJ$j9V_p5sB2a<7=mmoM!t(IpyX z4YtPo*m+8Im54FdMMCiYPiDqh2QJrBNF2yWyoO0^=O4jh#QdbdQap)Llr>ugM-4_r zP0p$8bI}s_YCZCHGX@{B$faWN_EmWJvUv$f#qj;G8TJzIMJ+mtEwwcL!3eS#Q4ueZ zk6l4=GAY^tNYdt_sQMnfT+9kDl(}ZSjHm+xT`6<-GUwcZybV%{JnvAk8h|yH59VcJ z+Ykp|41T9S(zhDfXLIfb{eo!(FhCovko((i1LiHFMMakLQPnDC1fNrZ6E4hgLuNa5VCaiL}&jUNB(FX=%_>uqnE0Y+7mx!t=3 zH2&Jgi+*~lpI04dZa7g9!7i#trQQ7diHhb)*?$N3z~0D=$HxMZvYBPU{aGufLz2Az z_jLVZ@BEV~0HXf$s_mb(w|~+@zsF*M4I?5s7h(OAKKOZu-$m*_*Zr@|#n0gE%I}TK zwjIMe=9%lbic7i*C?33i(`1D4oAO*-x1L2ew`QMr4B;o8@rlbL(;g)WO13lekx&L% za$rMKOq{|C8L9iL|A2$P9~h{n=eqA+SFK?ggd$82ttwRZ* zMEon6IUa=9E+M|=3Wq2Q87he84`Jwc8YEQ|sSx!^3RvjOuzNmSEQ4-%+-Pnl&bY8E z&7>3&Q*);m?Ch4MB`?Z?Zu}K-{u$Jckz}69)U?@j0)LnEJ0vC{t`XwKjAy$ETo33s z{>SzE&BuHo$&2$^wj+$+S?-kpO3J@0)PHA^EpDL465^?xtA%~nC4HH$n?evks~N@G zk_RP&GG!heshI$B(!hHRqqy|j8>+Fwh7$jO7|S07 ztB{^^a9{-hT`=!$GdjS8J7H5zB|FZM{w@0@tdXOmd$5MNq z&-32Ryr7;n(x$^sw(hDoTP1it-r3S(evHE z>&wUwdv^C zVBBAXPJ6=a>tLQQ>L>NJtjYa-rG=6HAQdvH@oD$Q`;0O}F!Ga63k&+F8C_a@1^;XR zvg%6AGiSxuf5W3c4~^CZe2t<1*nR6u8=CF3q61zAGQnZd8SrL?&%}56E zJ4@lU8)!HfHyYl$8S`n+Wc0;CwDTCwc<;@7q)A@B73lL}#T~;(N(amhLMJ9= zk7+`UKOd&60-9C7n@;^g%puwHuYMT8DUQO;55hOI!yk!W0u&u0@?N*Iy6Z6)nW^4= zaPT$sAnt|f?cl+b{9euca-zJYmYaG5V4yvlrFlomllff-w%4QgSOm4+vZ0(LOeYvt zCaOhF^a9mKd|+}Y93rXjJvk|#zhz)l4MSYSVxkJLi z;e7|}(7!Cns4h?`>UFW7SOD%FmN%FAu2jI^axj%@7P24ui zkfF~Id^Q6lFt>*3F4P`70DaWX8z%lrq;eac27YaZ#Do6^`p=V>S3svvir&D}2DZ$*uE7`I#ro}~P-^tIw zs{BCP*k^956z3fre_ngOlP#Y{;xGe*_6z7Sj=v`i=!3WnP(_Dw4NsZi*f{g;^wH>P z%#gVd(^ZXLIyYpOl*nUlZo>-=d_^#vZ@GT#i!gkxM-)3vj%_?pr*~iYH5K@w7E6vY!7{Ld# z2k4tyGkv{X%>|RqA@#?HZAY5<EHIcheS$84}+qS#7n4@G|l`P~1cIyD`&3HcAcb zE#XzNBY-~sS32?VKaNEz9+HYBPTRCOoc9uzu@^(UwYwaXZI(E|NV@1aQ

%N_9gfu_w$$M_|Lchw=3|UclmF>4L+*-k4FR=$GyJ&mkSnURCnwK-p*h; zJLqJ3`aPi@F~_j++0DzT&9ELA5v$# z6~QL}xq9M<>r!^+Rdo8DODTf#ScdPO06r{+11?o!L0> zck4Ltj&=4i5^*?oB)OT>4_@CkKWL?z*)8`w*>?+4;ku?x`#(lN1UglaJRBem+zd4b zkn*<&OxS~5_Y(wmvXklTTgv7SbAXI}?F4buQ~}>O**F6fvmC>t<38-3ev)-NiL&h@ zVtTqF%NvB1^?w`qJzs3*;oRzAEld>OY&`;1A8)vs0)KG2&#V+3SsBOM+oTp0gQE}A z3bOr&NWr-aYWoFqKIxr|0jm{~hg*o_(zu`nuk1670UQJH)wefT%ufzSrA`;kgICGp zz(Vlc3QBsnpv8GJVkUq4@b#lFNb^Q{zbg!Y;s{ZLSpio?*8B=>EkS)1(Y6^gEMaF) zFF9|%|G`jg;87DVpkTKR$aKk(oYwX*y|<_HybDAg^pdkvY5<3haz)}?Zz|h&$@jB@ z)kY3WVjQRb0nm~?Fg6VKf|2dAT6;0;FnxZ>P3A zXS|X-vl`%K0ds6Ox_Fu$z6Y!DGXkfq;yZvBbB;C;XY-`Zl#yFcgKttskZ@|>e4s`p zcc<;ObB<*UiX%u|u_GQ-)NTBl`g0;=u z6jc2{WpY`sMrC0wa+Zq52kPjNH`~wb%?eBMS{)B(+ zhFlTkF##~r9Ui9CDdX0A$ji4@fQiO~rqJUcgq?(um%D0f>yH7d-kh#S+$Qm#BM~sp z>_TB*z#ufh4VKurleIafqfhL{=rNCOLl%2mZ839vtPc$8+$5H4B5*t7`5X5F!jPm! zE&JWN7S4_;n;6{_f?}4G>)!vuJL;bz|+o?nml06hLL}f|#vSe!`OqQ}lw(P~2 zQMRINF+y32RQ5gF429H$kbN0p?CV&EF>{~M_FaCj`_cV>{qF~NkHlv=pL4ErZRfh) z@4EPOA&5b5Elk^oQ~A{!No9CczUk_`iDrlEyc|C^X`#FC04zQsv~b2Fgx*W@?Jc2> z!Q4|>qkXL9dwcH?buQGb-b!Q!x>lkUFEpYPfz#88G*dBD1~PMXwkHhc@2!3Op|-{s z{xC5~)(ue*Af5q`cJ7>tCTW7db>;~N!dibhVkw=K+>C{{p$kE^9c)=zWh21?GWH}@2E$~K3D7>c#` zJorRG&s?%pk+ceiN?Nt-zU?kfE6r80P!1D^jT4gR>;j_ARB8ulKKEp+(El+M>X>!J zlOt!zCsMcGccV#rH@2}Vq;tG$+XhKrQRiomReQ9PRJk3L zi03Eg?(N!5#VousWM3#zK#XRZYf3$pG`g-}V{&0=!r|UYL-|M5heIE8e@ab?kIsY> zFq(U=69q1IuXp4hT5)PGQ^|8u6*lO;>Xt;2BVdesF()=mFs*dk04z=p+jFl}cyF@y zo<;uyi=|0O)(bKcCUn0wJ9h~z(DE&UW5y;ma6mZP6mQjVU)FD#-S!x=nv<^Y+j z_I!LpSs~eAV4eT1>H=y)P@86v8gAChwy!EijNRJ3gLJ8E^FXitv*CLdP!oaZZfe z^YJSndzpAgTHq}ts#Cj=2eg1iRL%Hk_ zf4ScqSdoh=GvNH_s&0M|JmsW)9d)-@ZSCYqoUGH-S>qx=wuU}ar1V;s(zt$|K!rpM zHCo)5;A{dkN`WZNfy_rWbF^RZ)ULGFLkBnY)osY!y(vzUlA}w`ut%;aD~ad-Yg|u_>y1C5(TXn7y>Ey05GV9rxrB z{Xd@W3PBr$+=-4v~ua}{tSb1qO zR4qHh{-q4s7=MAjo%e|`7xD>d&X#>NrW`3c7h!z)w!EAzKpps-XX|;3(1Lk#`szs!&`a2y#STGQEqmW2B&yw1 zEHzi`^C;e5K!eFQsy7lUq3U+ieF!_4o$L?#+FzSy67$M+MXGADe721uKg}he~9si=rF|>CaEbyk0Gp zb3xgf{d08Ag!pl-hg`9-4Dnp`e&?Qt@cS|fo2xK&r9>M7otP6xo`c@im(r0&2CZ$M zq_-L}JjK)IcwV|v^7_H9G`HS%x%~hfq5PVha1o_MVyALB(|w_aF$K}02=(RrI(izK ze}|;lihkeTioTJZQ3ZAmsQzk^OwED3lW8I|(wpu2wH~{QoMt#Co_V%#Kz*kQH3tUi zYCtEukZr+N{HMt?aodAuZ8Lv;z!4_EG~SvoIpAsCZK6Y(hF~d+`30!$B09)|QcUNi zN}SseyuYo%#&2JpknE~8$nR4E3HA5I#54jV65g=fS~0TwStb~d4u$pih*2AoHCc6e zDjBgsoIA3qGrTVm!xpeZt7;JKK)4!wbkm!FTCdIXY`IIyvw+s%W|Yo6v|yZHB^1C; zzMQxQaa&8oUBy{Afv5e%XFUf+Db_rI`@9a(`Y}1|XCxEXF2{?nsZugAyi%T4&=FxRRYNLIkC zUy?G7G)0j)EGtC!Ik}zkCm`r2H9!xkx>y;7CHhC^^>QVSmVG;3{HMyHlfkU_xkxYG z!Gwj}bOUS?g)l_dM2R`-Om!<|jlyk^5HckyK?JN<8Ev;LR8M#2!<)fxs(@p^Kqyw- zYLrK%XYCS4Di*+~iV@SEdCA2hTE`-)*y^jy+mUokctrKQAg9-#Mw0+QuKNWBB# zNVXTyQw9R0#V|A;bWKj_S#5p|Q&|DeTk_8LAIwr&6^ESFN&FIq3sQ=b%+p_@u%Iuo zue)bKmc$V7=@>=E2h zLru;eWJd|{g3Na6Jrm4&{)+8R5(HRD@=_FnH=MPNJUf9}?DDPNQr)hDl9mNXGHj`c zSvL^mM4`ZEznXmVB9RAUwf6@L#O?qrVq;!uL1oQi!ujl`V}hkG@vOlLsNmx-Bu=>0 z=oXK20ZQ``h`_Za;^O+PB$z*jOS%=lWpX|ocQeeOxV3!}#Qv+{5@UH3LJ#o=0M`&? z4xBC!jo|nv2oj2w*vCWqkjV(&{4}#JETy_Jg57*hULmmtY~-upW4deRy|KhCbocJy zH~^pqD%i+99N!hUqw>-GQ_J~75IF>{1&Yflz%|mwqW7h4w#tJ^5h;e{uL>$1XfwKk zR!UC6EwFVnzQO~(P4#`-!Go$l<|GJ7E-OcGqlt9_u<_zla;ZG=Bf_H>a?_RkMu3#q zO|CT}Hzsy(FC!|ymvxg{5Pq|6q%~F2&_c~bD@k9%_L+*e*2vhKjwHns;75<^OBwuP zSzKP#_ZoXM9i2S&_5EeI2HRIwquiw=8_6kg^^bu41@p?~jM~3R;=Adl09$#g+(IUC zU3-}&ERTgJn34<_=i74#zoCm|f{=)5U-$$dmYz&SjSeQvlDUkkN$0jmV{MFvi0j=5 z!lWm8ki1+!GmrIXC2zKXUSL`Q;xG?(Lo0V!!P{ehinH7u{Mhcn^|6unhjd-Sa8)vz z&Iwa*K<|@;&8Sd(!h{{a!;)9caO0?zl7UG(^qqphGkz2QmL?Sldr883aG4&fHxm-1@Q;mA&?#NL@) z!>K(G*-+3fI+Rqeb13LbK%YUzp=2g0hA8z{T_woWJ92lPd2I5SXFv3?A!>EscyU+4 z!Exq*%^u|=V>vt*Pc=QsGSv0SNmsfgppjNuWzTi}up_D~0_(6Mmb^z})e*}E9P}@$ z81(2Q=(4kgOS{*N^Q?Ml;8(5lekXapq~ZE`lxA3}Cv~g%s~5ZZE2j4fn64);C~d`) z*Pr+h$08Zwc{7jsWUQ5M(=i&DOkmD-uUMM(`gng<7FlCR9F=4@7x!+Kj423rmoyW$ zKrY}fZ{5g~J(-ay&hvDksl`vRtXR=CNu&ElnS<}kyagsZ;{E>nlaSrhl~wuUi^So< z-BoslKJ8|X^`9kNqbIXa3zq`{&CDGnVyUc#0@;2URu2TB!*kcC?w|@v4fL-)K&cYf+kNs~)t84qr_n6T=Y1EjQAW z@|tC3JyN#mZ56l1h=|0?4BB75Rmctwmsa4mz8sk}2(RO7cv$n+ymI=mNg>U{r0Z2Q zO|4c5>!aG{=QksB+?Dpc_cAQ&aq%Sbf4gPzW!yu2Zzlt2moKfne#YFh7iq!7B- ze5I@FNyE@ivujOGQ9hk7kz=X|g zlE3$-`R-a$oQR{|39wvF6%;raavRHzU76B3^4aH@$=*swr1;Ite~+-@ul|a#Cf>O} ztEdke-#C#JVYc@Z60=tpQrsfOZ&F;Wp4W(1-+DcbWOaTSU|1aS1|V8CKuLoi=QVXu z8LRcre#41BHN!9h8{SQtslojJ3$ z)c5HrPXWWy&k}_aVv%VcptV($cqjAp#Ms>P-inUj9n$|ehUNN8_I@W?3L1f6C-f#C z{`J)2uMI;#DhGaMj{oX1|4RM-hXnI~xJ+FaiRidj<%-(Q`!Z@U4_W!k?EO4a1^_b@ z)~8wJJGLOTM*&o74nIS<--ix}&{USm`mJz(hIF7@TK*cEylcW$LonSeCfN-=^KimV zt^qw&YvFgpuq`0@@K(8MXJG)^K7ZFFAWFV<+T(k%M%Ev%5%3p0!m$IUg!8jl)Y2QH z0OUhu7Wuq4>8hc)$9H6U4yp!Kd>dylxjelO6MgZ-V{40D?mcpj~K6?8=Wg{)m>UY%#(?-Arjr&y!xpSnJ zyj#7)sdZ2S(`r%u0q-B7zI6Gt@+yTt`Pa~cdW(oz7M0teX{r=7Su0ipUMT!k+rud! z^8xyy+a^-IafXTqS{@-%UuDFoaqDi}0F()GP8k=xu&?Mc2As;x;l~$Njs(1Dz$Y9- zTF&0<&q99!^TH$!+Lw1gIqjS9tOCjm;$aW0N?fAGYQMQZpsOYW)c=&*^RFmO2(XNc z2aRvkG0M&LMQH}}9=?u@0&!9av6KBQ_BcIj6oKPzc2+Y!L5ve;X{f%@53w4W{CWKJ zLx8!9V0Ws;NS9N}jXl2L>6t3;RF9?JCD~tzxeRDRwm_oRxfJ$IL$^Wz1mlcY+N)!&0O52yglL=ThmhrdGv>@q|k2oM1LDa8RK?8Jz&xqA3Zr>)|VUCRL(j!t!C3@u%?`TD4xm5=&NQNnJ4C5tG zXU@1|Ie+ftI_B*)2siz&6z_j?jPuvH{(tH+agW=rnF*Gzg%fG^`H)pZitOM2sTqF6 zbeBhlQ}|}OEbMMXeVAi!huLi*v%d=O1U!FJPp5gWEgV1`qkLM!-;~s=x;ka0F1Oxv zM(?s5fD5+9mtg5vai;HMdbPO?F2;s+8^XutzhcZQu`4R!8Ki$*Cvr!WLB-Tx@MZU| zIb&~)KQ4Lq&asBePl7=_!7Blm4@I9E5AkxC9_Gh5hEU}HA2%hn;=ga&6Ld#d^VXA6 za%wPm$ca<%+uN1Xq3OFQ-@yB~Z#bsbJF|exzlU>5a+}?!G0yO}A&91}k{$yXOxCG! za0VRs{=;xHK3Al@J+6Ien&saQ^XuUuFtNJ>eu$OT89WxnQIT-WM8TBA>C%j))wwev zPfhJRDUphkInU?%DZAvogSkpDe0_ef ze9)&q!gA$>6?xSP0q9Y3j;TqJr-4SL zXHSu34QL|a)6jAEGE*rbl_R#wPoTLd^T76d9vu2A&bWrb^Nm`Esl$7P2_~5QULqUP z$|;euWg@@e&&@#Fb_V@BKX=~tbEIaBM^m|DjWufM7Qw&Ft+abSz~Wm`f@gG@yia@0 zS%=4zyCd>$5|n{FQ5bK22&OpoC*->4zT<98l^NY`y~m6Ou8)ap+gS{KFVy^S{_w1v zAk#MT0?HDXMpTiyj}FlL=dR7F#b?X=RPI=tkv44sTo`MHCuJ7w-ufO?nwo}Ttb_h!WK;U z`Ny}mWG@;E{be8pby4$2k%WF{;44e0u2-~zzR?%7s!iZ}mW_f-E>=h09t)1<_=7$p zQ3{MkFJ&7F|Ea_Qo@Xn3&6AnoxrCn4R)_9AR%;8 zq;9^EubDCcqG}HcAbw`*0ngFm&^l^8Q#xQO{;DOxjns@@!WL0^EKV6AkagAv_&}12 zj6)L>`dzE$x}a{`+gNhIrx*|_8a08S>xZ=NO*X-hv(cN`Vf=oRH{s(q%UlOHmsQEj z1{ef+OSQ@Rcz9%DDbW|T{9O9(Cp}J1&b9f$tuVw!7#Pi~AEyzNS_dyPQY!INDzPtr zyYC(?Bm6rTJl&CiAT@0rWY%hvDMpgPSh;MJU>l2rzE}hB{hWUt0wZF(8?n6xG6NtM zxQW1Bg*PBDG%#v3Ku~M>IRY!|i*V!#GBI^2 z3kF~wb|s$vvpq0a&kG&<=Dla~&TBh00pnQYAIOi<9tqe_hU^h!T!3}^|N6c*CN}&h zVFZZLG+xpCR#kT>7;nH(PSz#KgyW=ljSaiF`Ev!;iJi9Zz;98UT#jGDeED!OjOkrX zxsCL)a{?RV`ecOi)Lm6u3(p%Iaafe{SX%WU#2M?+xu)#jmA}V8S0+0|?ZYJxdL;Sn z)tYGtg4m@BqEaAi8lzD|_$&$))QWZ`FVHWP!04wMo-BeTAZ`bI+nk)q6Fc8!wV=-7 zudx8Zh6_OwNoJ&Q2pNozhd3M`9DSoMY7v~#No~hSQL^8EndT&QL2#(Ek^q^nwW#4-blljBHqqn&i-w?Uw)sh_~@D>ub|b* znuiaR^lJ!>fMhHgxHyTqNU|$noePd;`8}O9w_NjaPw#5KP4GFp{e99*hN)8es~rJa z<{;CJl8eOK6Rhscx&cI+AV9)q9`tK$SxrF*<;hTFtMzg4x0gqMJON^6N6twfoOIfBq`7o?DgV(ikob)o+~qqhBb{Hg#g6vMzR#5=9NRkNAH{ z9|-a({qC3UmsJ)GSLVw8;|-Z~F5Y%^-cY;WdISWbV1Va$^-X`iKU4Pk_x=I_E*N4Q zTS;d;eYZ>ezg}JGysF@C8xiD?m&_@;A1#~vuPYn~FQXwWpqeepDzWR|&m~@L;$&3E zEPTw@cly_8%t>P4*=e}-(W|fiLUXq>OPO>K#DSs)Kq0raB+>EL@}3`Gj#S;RP)0Wa@Q%}43=XVwyzNkEd{NF!#VEVhEha9?MP9j= zb)KUNdK|OvHrr#ZaSGwIRH=Gv4)X+j<6$Hg)dFuL#;LBpf$?R~fBFWw?VV|7PCD@W zxOZoc3fV9VUvKR9D!x>F+q%!?jP-#Hla(xu(Iu@2r0TifwOl~%FP?wYjo*$Ky`X>B zUh=`C_u{Jx$`)%#H/HfgxOgu&pF3zgUrDJP_xqE@Bo?U8~X;vHbs?BE)E321Rr67T)F& zWM7f6=_o&^rTeZr&PcJc+M(H_5xn}}n?eE{JSja|2%tNA`UHltKwsSY?JY$smabfy z-K%FKd0*@or%GCzvgj&^xx$YvfLU8Wi<_x^De^0eWKEiJmIyW8_P`dy(nRm2xDdys zAc*kaNh6?hUdEXgf`FF9pO)(EzK^|_sPUgR(2W8>(h&svZ}x6bDbWtR^ncmbZnGmi zBK<$rdG#jT5)sZa+%Ex=_uuEWsU*HIr-}243`hn4IYHmi{8~o;1HXcM{V*BF{WLPK z*Y3RgF`z#MrVCULgM(o$@Z&xW9r+#YAxvRL70Te*NucegT(z%#@6ImSxr%8jbmydd z=c-^YO-f0&{LWPxz$XWpOdiU!n1lxZ?=}B7Y4|;w>;Io6?cMe;-w%Ha7;wZhcdj4e zX^Wx+Q51=mb)y7Y6q!w=;X@f@|JX(vuPAwY%5$Ud+JGwVg`pbx zL9dSIzC&+5{&+9*!zCzbZLVM5xu?M9Ba3q60BpIrsd_xgDH?_UEWyReDT0`-oo(A# zP9+n)XS#$SlNGpS3MllhhX%=Vj;_xED0J^7s*qC{yG?WdwORER?{15%kK&AHaNdBBNRad!_Hx?P1|Nonh8C z8*{gT?8`S1LkpTU_8jvqsmt!AZ#bs6vqW6bBIW~WPMe9Ts)1;HwvYEY?M zx*27b`^YXpT5?^_)=OKXcM6M&(&PUxDt zBm#>H*jismxUA!hMe$+t8CiG()39D02IW||(y_yjixsNZ`kc~deLe)@o76ePse-~j z3*Q6?I`i4UEO3mf zRxaH|-H%%0N3PZs3`obcp;rvx)viJiY@mfz$a5rOgxkouaj;*`(jBvIRWhRl%jw@{ zt;T)G?asG~Qti%#-c-D5;mtv+CgL&f5B#YPsL>R$?9ndNldd`NiX|%{`5ssGFujgj zPXTq<>%)m({VJffxip`#K>B?L+&|hSSlHVwP5@Dmt{7v>XrpIy(4Owo(b6_4sMstk zGWcQ-%Plx+m|U=Zm_4>p`~U;$kzn8VRm z<(hGiT*TUC8wCO99F#7($ct`lUlT*f{`$t$rAIeSA%P_a)HFW#Zv-T_FNkgA(#4hy z+0l;~VUHN5zgT5j3GR0<3G8wPJ&PH8#hq!@xWC1g>|?xyk#VLc)+Qy&-q97rPEd(6 z+ZrcxO~j_X5C|ORQum0C=9O>`5Mt~pyWt$`h7lF!5@GDozc?g!v2WH~2IvweYL$CS zOA&M`pKu)qH>3|J@}OEr zE-t=&$WMaVABgvDcadSNJ>m9zNJxlg7>f{MrYrZ-3`i+e`7UU&d=m)spbebX`LFXG{!3Y~yj;V4rj*BacDkNa;&K^M1w4DcLV7*5J7C$SupS1x`z-i^yLCYW0v-`hm^8L2T9!) z3!;`2j!Qsg(CgY9lrzl8<)ikdX6qI2KkF0*(hv2uM{jSi+-`NJViCO;Q@KKY(64!jQ8T2L74 zc?zupU8yJXD)RS#%pdSw*=WYD*X{+D2+_?x|5g0ull5t^_7r{0BC~fls{kP7t!@XCdtV8I@b3vNi z@eA}}4j(;|=$W}i7Dr3!XiG+`I4dFKkoA)zJ@Mtd+zt41D7Sat8Fbe6ST53-9nq;U zBXwT2s&T`rJc|#Tzi+B?h2QZGF@(#~A?kZ!5zv$I8JP!}`5$j6QO98`y=Uq+`pbv# zxLJ?7!#4_NkHws;KW;0#e}DhkalxsXwMu{EVMp1Q@`Egd-7R+v2ty^U88!`Oju(D?dm>rmC2$v9O_}-dYdd zb_m*)J#d{M7Nq~IQxYh#C+~rwt$<*ea;@s|+)|F&Hw317<>}w*QA1m^si0k_o>6t;neH1mc&)4M<7N0(f=Rd=1G4v<_`#fYsPo=T^`iD@Zg=%(r z+6&8kN?>p`^|gBa04|t53hR+F=`y2T0MSkpZOYZBc(k@O!^PdGmS|+F z=a#knBDHJkqDg~F?Y2DqG4noD)Z)>;xGz#UX4Y0d8z-_IgkxajIdN0!525$ga!-*h zdQX=vK~;$TLuFxc{Z>hLn@@G?kdP4Q1%`(~jI6Fh)r43*sTl05kW#mScWstcSYRhM zS7&5&-=QRX=Lf4Uvf|MDre4&c3eWbpHU7Ax4^>`AWi#TF$!D_{Z`mVxk$^=<$WI$c}41sxL3xrTd!p zZMElk;8>cvvf-uLr-&vVZE&&xSsuid$Jc6WBJ+1by|M!wcmBD?+YHUR+vnToQ4HUR;K2z+wQOIt~fpknCJIzB_>@KWO?0YP;f>6z6HeE!y3Wg{;F0`ktQ z-?bD@a(V&+e;XBrm%4tlTiF9qkMyV_9M*>lNNIPxS>!~n-Fq4O{ulV}D{Ey-Vj+0S z@#T-)i$8CraQqYV6T|_fhbER}_P2a*4hULdMLO}3{A^dMjfF-_4+hEuJ zX8$M02l!j|FO3fq;^%uXHZfqKRTO}eJ>NN5*jqFhZk)M#>Fqc4`7AWo&}8A__wMiX z;aqe3O6h0V24AIRi&ot4J}i@B(8wW3Yv9L5ad!m8-K#ofPNu9pyhj$uNDF?NqJo!SC+Wg{ULOlDxX0Ueqm2>Y072{saL?APs=Aq*s);s z@0f(J&6r(FnZ14048cwn$YI&ED{%rn_tNP+-?%TA+z_G!`gulmuQX|QZW=b=&^G*> zUdry+*h5L^sPq^YgFgS$M|xb!)i7VWJ!?{K*wMUGLx;)`iviGj5AWRcIg2qc36c3fH3uknZYV6Nn9UFw`A6Z%5anG_Xpq_L&V zE98C#CM6(9$E~O1nwLsZ_0*aYes{2wpI!|blA;wy=0;&Y<)in@-LdD2$FJR-QKL#o zw~?15uzC+$)NH}(ALTwr5y1BC)A6vCY>BD861{*!6Q;moz4HUY7q)=Y&SRs9PT0JM zDC)f%)JLeX6PA{a%NMCsh3C<3&|dSo(gvvYMsjG@t-FaUVbjox2x=UHdt8n+#xD=I zQRdz)7h6PAjF|8j#{s+YlU=dyUk$LnBso}1du*&3>V9@iD3*C8R)Kf+WZ)0_{a&72 z)0EqjcqAq&RjqT^qZL-bu=qQwT2_ zf9NoRY?n*MeHvY!#_G_}m5pk-_kGZ+ptp|Hp{pZ^+)C06xVilJ8J8^D0$&cIg znUW=~=|Gw8(sIz|JE?SWTG&b@6d^vH3+YMsMg)(g152A0Gg+{{Uz$tf65O;|;g8U2 z%8hCt{T7WPz(AF%zWQw|RNky-sMpl&J|kYAtWo6&5PrcmZKFpVNZ9(3k)q* z#@Ry1bmT#0_X9M5;?eoGNDVklI}6TPGk=1lcmZO5hHGZXfE6e=1UNGcd*J5M#8y)g zP$FyU%KC?~gCz&;1mqWd#;3T(e!WA z_-fr_4HUqrl%N2B38m{FwAm$4h;Bs>g5}w1&PYUMbq8Fo$+tGu@s`J)ez69=}cCO316K z7Igrt4@xr8xvxzso)<`N7M8DVh8LZT+SNZ;Yj;iZy=$DXJ-KjBu%gJ*Cqn1*)szPY zvjr>6`VWy>xS6keVjIBy?+T_8)TD<+cFTSc)@sap75oBnAzAIi@HVq;4(8RaqH?E- zs8XDXC&Mmd(rCO&vcuCFWv6QG+cRy>$Qrvli`mn69oFC~-Ue-0i8b^gXv+|a`Bg-!743Yen9R(9Fh=kuu>WWqsY=7UK4EDqbA4Bx)UQoN`bSUrl{xX z2$S1LIMdHcE|_xVJ+8H(VP^yq;OGH6dx3R_{sN{Pjm~baC9$Eo&-$@h!IYs_R@cE6 z1wJ1lh22NHbq#il^JAjWv~L5gOUo-bF43`_LPQb@lcN?DG7_c2nBLbG7itnL2IOY3 z@Xh8C9qz`4F!Xj&)SQysFFY%}A|xf>ddKkBo)HlIYq|eFbN`rlf`4iMG5B;>>l4BM zmcHvU)fvh^d-e78Q>xoxa^hlZN@CT62-}0}PD11)t7~BHARb3KI$Om_s zpxrjEch<8UZGZJTiYSKoLo`q9VV;r>Eav5xoR^ z=-f@Eevr(Ba8%}$-@pX*EH|wUwP+5`dDsS1P;@k{ElWG_aOYr8M)BQTEx%f?zQDd- zCCQ@6c=aSmhV0>m`fe}$pF|&pFMEyhnd5VtoW2xTivc3E|0ybe5a7#^@^6*Dul1XN zIIq?^_3S-(Gt1Mf$ESc*{6}@w(BC&Jy7t_w-$`D2bjtT%EgAo*@gI6J&N0y#gx8T5 zATaiSc;Xpt%j#dT+P+--x7+{Q_^ER$Zd&i(zBPhQwyGU)8e9ULE>^z<<8%Z#-^p;yAV;sWwL zp96(3qGTIGaO+d%Vl6EK?r^wM6>u0sa_Aly2;b93^#|8WyZ9s1i^YO@NkBNhK{#XUn#$H6u)DtO9QE*<(AJRAKx*|p;324P6 zoVC>aS#M~PdRNvl{(cbCxawD=XIQ$tzcyLN`qBJdT57gU$fAuUVfvF^Bxvom@ zt6++0bKUk03yNA#i(yKl`<)j|qExucKY_!aSUP)?zQgkDY*?O%orrlJ4xO&qD&=)8 zI}*9e#Ip2YS?Zo*>JqL?%s=Ul3y(dwxoQS7k=YF&ew47>v-11o;Q zVvl7e`l0$CeTpBZh?}oU{4{X0a3}BiQ&8sy1g$xrE=Bb_E=gLTSXFAaSA%|^C()z0jVb2)`dUS2V2;G7)|6Cw%xNGweo4n`t(D~ z?WC@)nicD_eBhk8h~&nMT$uNRS^I8rW8x08Obr-Ea;LavV3xbp82BZmI{*xET{pce zJJz!-%YYOL85z-2%QRzT(Hh+wD)Rd1nYkUyK9m}zAYU|%K$q0sc$^V7!R`V2ygr?j z`+6AXofU5nwNaEZG1N}S@(=}y$Xy&4>4K(~>RS&+gz90X7-bJLRroWP7L#diyj5A`SzjP~7*f3CoHQqz z$|wmf}#NA2X~D@ zlxu;{ybf9GtveyEA{q16L(szyZ-y>USSEctGBI=V`p?5Kho5<0;T548MuKydt^QUU z#*|949k8AvG#s?p9#%JUc_?{V4fL(_(6xF*vm5tkl5;zZs_rhIoW}F8#2tO1OgB-p zvAQ4QCvQw(Pu;7lUe!INQdcObVEW|uSmR!~rE+=QLqf%X0-t-CAzu_=&&<1kYls|a zFZAG+s|46xWVjSW3CBVZaz@quh8mu6rv0l8_u|Beez&j}esNMI`rh6&s78Z``Ggh)K+8{J_ zEVXC(8nap$g~+7b{Js$+Kk2^JAYRRor7M2s+5D zs@%Pk+}sG0LBlmzHg&21Tw%+IK7Ehc>C4!3;j97~(#YyrPce(@r~^1Z9oz6~1_Y0| zpP3a)l_iGSqHn{b`JOA@#+tiNW{EA)zf76R;Z5U4v%GhWlknJ|(*S>(<3)xZAtZ-N z%C|k32yQ<9csJ1!6%~OSa&HlRtRpWeD}LUsnqG;@_CJj@y^Nw*6mrqtSSG`FdIe3-5)Rf!|=VZpeK2D>O7uXc6fjpD91Jwt<(wtO7qU* zkDt83i!UFC_j^4mF!07e{y%@#t3wML0?-{^dzEKr3*{yNO)1>ErG=aYU6aWmy~xh( zfsfBOzRz}-AA2=$7=Y`t`hA-7MKOwqzWtA8Zubpp@BPLM4tg*9ZQOQmQFlSn>4Se? zo5DR|scJ~XPnJ68Y*LoVg#4A`w)s9cxAbq&j;9a`j`8d{)^uqSw3t2rSI3zJ3!-7|KN=uwhj7pceJUMJ{vnc=N_EtN-^XnHAOo zkSNmwYaoSmcfP6bWL#$GNSa5~LrNJz1p`C>qDzzVDj^aneql3vH#Yp7)X-pqi@iZ> z@~AAj;Jp?2Xh4s}M6%N7HQ+(3`O{49y&aPdt@FEMW{TY~evB);W3)IzWa&2u7Jk0} z0+4`Hn8~;ffZ54Pu?8gogBT@RK;U`tVVlTFhlS|CV%vTCFzrl;&J9MK!S!Ja;y|-U zaU37-$|=*MgZA6vjxQW}R!@d8bamM6oF3a#;PLj*VbfV2>YnZ2QEwoZRUoVyFUj#8 zl{-TRo&8F2@U_h;Wr^cur0;?80|uczqt*z{EAo=3bz{|^z3KMFAldDOY^z|NRhk^$ zp;klx?e**E7`!jmLJ5cb6~EU|bZl^4>z{#Y`POW)L^rgB`2LUIy)(On>7w{IaSH7g z1uA%jjrYa&%;7LnCKeg1;?ZRj@?iX@ApyU&WIwuiTvfrtki?eN}=c zOTTi+{+s?^-E2E#MZ2_#@0`!&3zGz%(R*5h!#B`dq>yH>iLAx zAT(_-AY1RjU&ed@ymB6@B`$w>vIOjfxxBBkbA5c$^lg@biF~%jbfV45#VqKC6p#$7 z>4G22)d;{nu&!#r7`RplGo&1uvrH_EX>Rvz0-f$W#LJTqF9-bix9|NxQc2=@ycRzN|B;XW_N&?uddx<-i`?n2ymQ7XGG&5Qw90f7vOFNnT0O-s8@IvXR zDnzB*;BSWqZgeu6NB%{>REc9Y-R_5|$&<}3414>ahC<>C3JQMx;q;TjOFsq#u*90D zlyt85RdG$0w~M4-&PYOYzQ^(rAjiiKOUj*iGwYndlbt1QC3XDOiuWx;kKVtcil0)7nPbA#e|lwe2F>!T`T`sXj3 zY5k6=Tdr;lR3kUp*x>U8JuvRg(U#tZzAeP;ml+`mq3Nyq>Dv`17rg70yF+pVd^9HTy;3zLXl#_902c03DAo&O}&y^PVd1%PP18@}`1L zMQ8U;;dj}o-uo@zjUC{?=Jtj@CbG&6&m&@aM(7+w@q*xRgg+)70=#S5!cs~?K!7C| zkZ3vT!jK(k%i4x*(t|~JhH_d3{1<1Z%OkL0a60gE3M+FGEVXI@HA>e}c`T}L#j0S? z56e>-92Lk$@R7EpE+<-YmT}TAG4KFvMQu?-L|@-d#y@(JTb;4WfQ@A&UvP_dj1wk* z74W7-)2U738=$+l<;kYFIHLL>8`ZS;1r))17YZ60z<%=i|3oJ*1q?XXsD| z`{ScAw!u@socytv4bZX|513zXlrmW6_VTOI{-|^a3ebOjCGy#$LOF3abLR{pfCDD5 zgH1{1vE)p)8KsB_RPw?@Q!KL&y$!S4+%Hh)Etzs+{M7NsSJVX-u=i;4mvlm4rc3f^ zVF%iMCDkWy|z+ z8;j6pb+kU?8L#RoYG!gX-a5SbGmDTEz0ey(&i%3kyq)YP!b5E&_fk6C`s@5l2U?qh zr?@T`C-d!4x#o-vndx1yxF0Y|*KXZD$9^By0r4NOpc9i`Sf0zXR1tsy#?$5jLq$3$ zEkl>Xcg5_kA{vD2h7Ih0OO-efaeh(el;HgK$z$8$J}0|c-9c=uCSmUmWzB2pE6eO| z?1B;O)0h1YX%4hLe8oPKYs#1rP<^uK%6E4YgxUH?%~5haR+wZ!sebtz@3v}DEYYCJ zZFk+t(sYQPTiZ|&S*`wK?+R+2r_)AuZb=`{^JSz_bt`zaFVM`UZ>gUUqMu8h=Jp~} zSSY5?Su*OFW#0vBF*GdPD#*vL3Fz~MJ(v2NKIhH(-sM*Z{-^Fihg}<`qAn+6eaEZ0 z?y}m)99lFML1Kb;K7a;ZC1-DX4Y-vR><`{3Vc6V_)cZES3F45d88Ln-4tAicxtoSi zR+9;I*2K9{V?|1R$`M-@kIvhwJsZZ@S5N%68DSrEDUI5r0T0i%v4_^nskkxmb?!72*Pn7J2TyXM;n@uMjq)2aBQO1&WzMRjj0H7 zB3=Y2tAuTY;81C~Pppt|X1JY-DP;&tF4aB;v`K18_M&?!zBOq(dEaTX=Dthl6D_Ce zIOET3cvUs?Q8m*9<>(%Uy*O(EACDoM-~p_?49zb_jqw<p91wXop-Km=ofQMdZ*5u}T*J;2XzcE5u`PrhC$HGa1VTiryqV*VxLdUiTrYx3b& zKq%{4Wpp^=w0(mAiZg!k#~(EOPl{h9{{gc8leS$sNLTO+0X96z5p@bhu1N?To+E{f zk@eZIQ|Q{mavS)&4R`s1$J#Nw6!5v`gl3PERCiy9N%{8t#iRIb{XD?wha5&>y~Y-( ztRsivIw#cY9yL^1J}+5Drs&tc7>jiIk%bK;=<|L^tMp0Fd%Sm(y%o6Oxqp_zm7kIm z6BE_ccrbZMD>WUizic{+idNN*_)ffxsRq$=Z-qU`@R@8K}4 z9E3Ksik!yS#7XWCK(0H;orL`~2*Ln#e>Yw{6vMfkO?AMuGC{KDhR3_PL$ym2gx=#O zdPnmJ5~Dr@$?$$EXXO+RUJ)a?nJO}6cC z8sihLGfG-+9nG7D4m(b4UmYw@kqR45_MCwtgbz&?!_!4>OVWUc7wqH-sd*ADBLdG) zsP($eHkSx^($stMLk8tvhZ(6_2YMuRl9ifR9M{wAbL8JH8|nWNuYfizqz_91T;Iig zhYVO$>cr>PJ@q!@Qj|=JHX{(2qs%Q@{TiD&hDCNnB^@%}7+?hrs7FYT3=8XrN=rYZ z(o+*DiUb4k459wt>+?|y5D=jV( z=|9?AIR-)40Rf*X@9YKdX&2Ok?oYu**!a$>Xh?_9uLtS30*nPI0^+BejEU;SDentD z*qo@ysAFvyaTd8&#m#C+omD;KVo=kfX7l_7syfl~E$1G5;$3h7y-ZU6=X#<~qEpko zVz*+Bc&r1i8x7L;(GypI6zCHUWa2ct7Lzz0B-FF%tD?%Cto70`tIfM@TP zra=XL#m1P>r2nCJ0q{%xwmsZq=0P(y*uARrH%U4b$%j6ooT8Z zUhMJB2QK(>COye%dAd0F-p4^&M8}sGBq=P}c-(f;NnexVS|}_?s=R35`9!71QIo-K zd+LqHyXHjHMf_{hjNWmXDW2kK=B|sEB(xj>b)PG4sqk(SZ51=Uyp~_mf_KL9>Q(o5 z$$7+2*ue?`D~LPF7LA86-j}HBogc<;fJn8~8jY7GJz3_W?N%bGBp+Ze7K;{E%y${8 zgX3{YKLB7&zx6Es4?jq==R#-LkwIlmeDJsB3A%S4)H#-dRQYbZ=y54W?{se2*?!wh#Sm%GgFmxdFb|ijdqKjOcW$T(ryV;=n ziX(s-)A+}7GN(Mx)H3}zK_4qU!@e0*eqV_d2-dW>B;6ZY@jm5{e1n~O3_vjQhc`$8 z9^1!w(XMbi2J;P@@DyvjFl978Iby~Xd9^B!KQ4N)WW>adX?OCWk$UjOp%=RFf@8(3 z{41~*T0R9WUp(zSP3I=(S5`vRQE${@2=fS^y>rfE;qQ^4NQ5LU9QzI3ZLS4e90c#_ z&#a6+Z*yCly6g_Sb-3L}AF6)vt&4g&+o%YFx_Azl)$aVhE8iQSm8iW|Z8l}(@KfW+ zx?_W9uaJ9mVk>rv!Xl7%kNA<(v1~Dco*$eA^W;geD5w^5xMG%(oVTI@R4(xnlRRvC ztKxmwLI~nOX%x9t2aSv_YVYkx9P{t-=zbvomUMP)FV=WA(XjvRgi8YCUHx0W@a7m; zSWZ}C!8@7bW1Or_LnNFtEaYsJG!a5m>zd?u%a=BUVa06BSG~Kv{Mb=txnw`Vl@cuz zB|hc=*5xPGM48Q2d(Cxt>OwaV>Z*kM55>iPsWm zE>U{uv*R1V!~xh+QI7AGu9)j2XKWIX!>Ft@0HVRkgGXtc&#CuN{S@E8$j;{N(_w6;^6K>c824KLC;~mCZ z&13Q+`+m1$Kqjln1NA&m>%3T54~G^%D)6FQT4zYm&9u+A5psZ)KOx0xER`K!am=tZ-3m0V({_b>fM3!7Tj z@jsI!>CcP5XyLtVV0m+rbr?lIIKTB>= zpBvmu`0hxkO<3^E>)I>j+2&cZj9(4Ui3D{kWA+V-|uCt5Z({{7hD4T6ZFFOZ%XhlY;y(N z@BuWM?ymLq^;s7l@_H6GlBWeVc2HqnO^i<`JLs=$3@xA0_)~<+@Ydn}$TD2jkkQ4O zH!`5qVmC6?%x|oc3uo(4LaWp#964Kl>q%lv8L&HWRx*>QS|WU0%wGsD9j6KgT9bPG zb&Rjv;s&_K0ddm-d$m7yV|`$e2M(sCrPZd3F@rCY<#KQ&MVDk}(2J~d>pSuU)jc=Q z*4|2Ebk42(j9T_T@omceGc%Jhmo}}oqM$z{Iz}HC09K)9nSNp@vaBwgQb5*VIw?-m z?Q70f5yC36N)GIv9L1Ct%DH#?&h5?*OrVHmYgtfUbF&7$ZNie^UfH=kUw21)~@Ko0Sg+7#<0mCHTsJChH^BjUquP6y7P?N z71!T@IP=ESAwrm!5AK*{DW~ubjmd|P!j|n_Ep$rF(N&Ibq!PZIP;F2c>nnhP-=_`^ zu*)+Q5*=3AU%nSRI)^|~1u=Cqr)3D@tUwugpBvDc!%qOJpB9iD>Mxbe&AfW&$G3Y9 za1?MO0r{cHxGe|fi5r`qnTRJR<>v$U>&myF`KoATmhM@$ect@+tiUPI5WtF6cm z<-FDONFi+J;r*raY_I3Pz3cp=C9qMcr zj02GvxByTy>1ccGP}KVclsNSwUnz)WD&f{(`2bV^ z#SA*5-b@}C`oOQP31S+rkzrGpmom)Do4*w=d*rP$K3icD8?-?wB8ky4u76=poU{V? z``X?Zz+G@QKL(_h^gU0bb1Lv$Oy+LdT%s?T%yZH?zB+)NcN#x{?i)*oJr~LL5Uku@ zT?yR#6>&Ji{^MtTE1e{_u5a=Xe_1`9+Y_kLS#g+=Nu)_8PJM*^jmjNt1!3@63O6?O z15ciYfR(bgFZSFj9xkt(0SSELV~-8}Il{hMR9kgJ`byD$WACVm8+hufyc6%JnSmYH z3REgwyrRA3nhuF2j0}w&SUU(tS(RO1T5POIYIN3D9P8PUQJ>7TqDzNl?y$Ss-yMX2 zM_}~M&O&*9YQJpdWhb=adPIk+$_VLKh+a0iTascKOP`Xu@NE4w5{y)15^Ad!PN&sk2SYDfw8DCYjGYr!k1GmcI&Sj)Zutd^k#&vP{VMFUYO(@p=Z|( zmjnHmJCiV_sF^QyAvl`>YKyBKGBz9q#yJW$DX1*Ko>voqDhH8TnyVD$Bg{nzt~e5#zas^Q+=9IhwbLnf*RJBBg1y*NxJA&^J*(-Gq^l!q3--zW zHm7z@D0*b8U1C$z)rkQ?+kKCYX^cZ>OPDWV8;rJ}L(9`-t?aVSBoiXp$Ld9kKaKf& zkbnnk@F0C|s&Xt}G==MZPi3B_uy>IW@7P^fiTLBgwn}1}@7Yeisd*UYdjBnOurJgP zyV7@j-RfY)NNSzCoj956W_w|6qSh~oL@nlY2-LrM;Y3n;TWrWXC*q}xb4f{Q3DhC@ ze9}Zub8p8d0oOKN#|*gr4)zjtm*^!k;O2)HDA857QCR`D-qWarXMW&!u*X-0cZuG^ zYB!StD(F&~f~5J4GmB_%WC?O{yhL49`f~Uf6S93BB!9OTs$oE_e%xO2;ct1v6F>zV zF2ex5;=c#aE?;JlT!#e!ZT~C|woTu;Q6{;*e`nQ`5EL&;^zt=%FSNAO#nRH!-JM(n zaPv9{66POXCNtMHxaa z+TQ+wCVR<@K~8lpb0`KJ8oE&oM2wMk6D50y7hMgD$cG1H6V8Sg0x}JzLcz%Wn|uN2 zAMVdY6|h5#Nxy@_MPUby^+C=_G;W~Y7Cwl_>NhGT)1~}8fdd~Q%PCG?e{mv zJifW%xYu3s0WS`BmpyjskfY=5VWm+nd$~UN=|!Js#l-bJb5m1OW8)ISg^LOU_QT1e z#%C*T9UfOA`e%l?{~YfyWC}EU_Y5s0Ggrdrx!E!G_4Q+8I--FX{a)0zK|ka9jjL|I z$IGgp0@QP+q2@itE{Va#!6ziuX?7^!4>532m4qhK7k_B_z!%Mn(5)Mj?&M=n)Va)W zCQrBLeUkgC9eF=0`DLK;DADel&tkNpTgLBS`u^<&W+*|+Vu4JYO)lp71Alm|$|f<@ zMWHAkV-AM2aJi4(nGGcQ3w#a2B$@Tvwyo#ut*p03b5c~FTB(+JZzgC@_lKI)b&tJ- z-JI$LhZx_&E(g$j_%d{#+pMO({=nq+h%<+hlG3w2@C=u8VU#WrO`FC^b$`QSzyjxY z=PxUkJFg$h=XF(5Px&;*UNYNn6W2c$RYJ8(=|4}|ub`aDxlcEhFW-k0@QE?=%eYCj zLbm5l4)Wqi5-UTtRyr4Yuq77dZ}q43R^-M*_MgEtm~U<<I9mQ*&{R|{sLF8K2%c~vq9mW&l)ljqxsZcNdTgr^|H1M`P z@m?(I1Adw|3={ZImzJK8fm)B2Zc##gV<2NT}Toj9d18@*Q{TW||lg%=Gq(>Y+%a&g6l}Vl??)IP=XFvp5(_ zLo7#MXCD6({3-Cs~SKcocb2W@rKi+z(jo?<&>arEMqe3>$ zPO7r=MBA=Rtbma16fuef+w!ZMCvNL~KA-+Q*v83|`!oOXbKY4bo3`;#_E$)Oxt$MX z>$oawh|5i+7C(lkB-=lg8}Wvbm`dsw_3M+L9`frejtNS-3uT^>p)lw(WaIJKph~Y6j{zS$#z`!MtYhsbZD$_ z>?>R^=kBA98$u4Mi}>Gy%9b%k{0m8>&P^GI{j@`i=-^o5jB;Uiz~kaI8t z;(>y|(f7kC~HT=53N@2&)a^#d3)(UFyHL2MwmdHz07r`UU;9}yO$X@Od$Um z7nW@ns0IA~mJts!4p6Xa?xjl8Jz8<|O&lq)m14>IO6@*I_T9sz%tQg%hg2SgsVcTo z*_8Ug)vc$=#{@_?$RMDcr{yAgV(X*+2o)ag-K@K^+<*E%-8)F$I+ta`B#d4!AJ(uv zbG)D>0b$LaKT~hhxMuAxcNo{2A!Pq3%P$MO&Hc}UgJDmERHVZ;Yd-DZT(y`anT%n% zW*0p?0Lnfeu-2oRB*BS%pM>aU*t8=We;j*MZ{hHnwY_Fc$y<{-rK=jgpkV2dxD3Q=(WE1OCCN* zuS`?)`$z0ARKYX{7s_v9v!;h|R(#5~k%><^FZR!lZsL8hN=KA1htY!@S;7E^7ShkJ zI?)Uz(`6vZQj=jAZ8wZwWm_o&SB#H&wwq9He5-+V&mMYA7xeiDQ=&Tg6UI3%!O=PX zb^-UZ4+u#o56@Mq?Tho_5Y=`St%k^G5XUjOsCp$@Ds^1!Z=g8N^#QLCCic!RqtL8W zAjv&>tUhTBZ^=jup0Dn@xh-ljv{O9?XcuiGTx!KL3{7Ad0ibw>1LguBd}x7&Wuwgo zgg2zJJJ7Pac#VuZEc9%#r+js0GGdRku+aPQWX|Y^mnD<~ZKeQo1U6bZiQ0YMP>`*l|AEk1-QAl*QXc?K|BWx{aPhr+@&iF2xVN#?x z-|C~5z}TEu|I1fyN$5}=-8;4t>A_f$dJWrUG`E4-v<+(H)S;pwayB93XV3T>6*BVX z{Nd4bNYibl{LCyUh~shU?p89W<|&fZ#HWvAm)>4meZKB0GNsKf6Q`le=8r!!{r*Gs z)<#Jl`1WK4(Lpq5N}!3J7qnh^$5;1xDh1brLykKpY4zs#13n8{92I{~Sm`I)iDrG? z^vOv#;(V(y=FvBH>S zvc!*KF;!f<7}NK*Z*qVqUq#xr$?FHjxvv6XOe;Vk#IzEZY+T(GH6NG7EU-iMO6o(v z`yM(^ey)Iu3<^MMK{ysJEV}^hqpP#BD?b)koa<6c`Xl9^=$b2M+2KQ<5ec4j1!i1r zCh(Vht~Lb~2z>ruB;)Tk;|k>XhyG7g%2gg4t|g4Ydr4DMQzx4y;*zCYp}a~c^@(-P z+U4tiV_EP)Iu`RV004m5*~#3Kc7o&_AM*7jWd-DVryq6i*QR*Q#2;Lf@-99`^3(H77(`o+QbHP0HRdBQArIYd?{m>|E?9%7hech)S z2?XxDpK$KD5xmpMz$K4}?xH|i4{Q7`v{8JREGnZ@<$m#`Y$ijC9$1`AaN)13;3O6V zlxKkis|ieN4d`lj(3=-Hc7LAhFSLEk{Fk>fh}Ju*fZ zAsG!S3ecM$IsGNNM~1(7Q;ay}=C}r5KJDfd!B{w)*1~5;i(4)7H0;bT{_aM>>6(+1pWlnU|^XvYvWqCB9w{hX8T57xc+HFN}Qe;uT}? z)Mn6xXIOyMN7bH?hF^8@o&zeN=YFA!wCBR?KE&)&f;e$taogBMVQgS6Orm(?a%DHo zEd6)z(1be}LeZ(3&8?AHLUd2NE9QL!f1ywx2>fRSLqEI_=RGRpvva4VL^=&b9Pi}k=>1*J?SZIh? zyVr+5Zl#ZLrQ}>K=j4gyexywo#2I@PKn4tJ%J9bD7MnvL2PzUgc@>Qs6gq(}v@hhq3Tn)SLn<|M}Co;B81 zWZ;bU*hS{iZVxy40n1UrR*zyT8V{ae4;5MxrgV=*veEPN^dfCcz+mq#m!i9IU7df= zvhh>Z=#SO+x&{0m=gljwJCr`Rln#{Ud!+cAkXI@a6xUv2Y)FF@2}mgV$%n~V3~yM_ zbVZd9Vf-g=FVN$^^{X&I0s@N;*g?DIB58Y@_z}10fl({jwSyg0LW+#|4h&?F$mBnG z8ZRSrN4R{y{yP$cs-N-7^wDe{H1V|=fTbNMPQXH|^AVh=;7F+}=;6w2RLsD9&@U|8 zRKiuo=90VqT$?v#v_anK$(&^`(9p3Qic7h}vg)f1P6Z)#T!vC?2;1C8`;TYYYmC$8 z-gM~G*K7C&M3?DqtEKrmW#Yb}zTY_7j+PTNFwK&4M2(AFZC>#v=vV)s$-R3;IGE2u;7owNVqE{#A-HQ5XpMGr-6jQcp=-_07?nyYT_iM z3p(?g1voVH)u3K;m~5Z@`3#Kd$~wvNzY0aT3cWLp1my~j+*CVKjbFKv)Rm3J6FNwK zd9D5v(D2uUhNnahTz%7jBO0&%zXMH0V=pR0E>BnET0<_jPqkWu)h+`_cH444k8e$HyQW@Z$z4hQVj@DL*SGAVuTjKbAI!}VlaJ;X z>n7?MjAwI5hYsEoBbxOha(|ICuDz+kO@<}C5oqD`xW1V!=I7Gba`8e)Z2@99!k(0Z zLx6UMje(r}ubIBOtT_lZyO^&Gl!a%l&G{#|kJ9~}E_|Fs8_Wc4Q{V}-t)SZ$iSkax zhj9Lb^AMotjT8GqIR+3e5F^{(15L>vf9*cL26S+Lb~9NoWK{Oxd*k6ABGxvg_X(%` z7@L#2PtyBzpuynj{{H^T3hTsEO5*i)-AD<&k(FZ&+RDWHM(Pa|SKtv|Ru<1woDYV6 zMIWw9#uZw$%$qHswsTE|y}ot(Pr&s{-D zKb}}miRSPXzJc%SzuZKkHj$BzxHz4qIh|5^2&3kP?@X5A%=FPI)A|==ZW{h-o#voP zU4WmTVcD!OV4)!|(%5cP|A%{F`{LgTzUtC7EaTG(r=(O6bO4C~9B4I1&OccQao@f( zoa(*YRx3ORb;CByX1k$Y3Pj#>edA_S4IcW;J9*%bc+{`jWMTW*vQj?^A$c=*GpD*o zNrlV4Y~cY=aSp$nTup%>{87dfJNN8)#~3yAczd}EUR`ih+P`bJ{^fLmKBEJM6aUz7;`{%ix7)*lT9&iLab(ZDSal;?-5{_)_m8QC2ivTjMdW=%b- zMe>Yh+`a;YtV^oJ)@TfU;}vt8g~;T+ucO3w2`|%~Nj4W_7_$Bs|3i;ptpYxet!U)KY{Mu zhwBW~C;uPuRQWoNw)G6v08%^qk0XX3D>wxMP|PhFgkHP92JfEzCp;K0R-DMTt+UVa z*!y+Zbi-ES#;)i~=wEmb%J$93(8hLYvgMlzu~!i)#S<8B4LIKX(gyhA>#m$!t zd#3(jQ#~yhs^pXY@ID6f_Dlec8r~v7b76<_y_6Ft1K^-s17ed)#Q>TBb=)(J`Izwz zOZQikfVkWkO=tUmSAusSlKZKe!DOq2FXQzv+HbIaUwpn~Et>>Yi?7mEs|VQHIhB}% z-Yr}y|a{6@f&>TPT0xsf*Fdy{@?ra6-*M+$T{W8(YAHp`HQ=Q2rRK9&(9 zoQmA0!-5z&MPjc>2AL=__?OF?4Q@_RlUYn*oXsTG8uhFk&<#5%O$bi9MWUESHAi-k zMYX>mw5yxX_!zg%*1Vm45k-hM{C`zMGQlm8hGAQ%iDdWlkOBCF%4jqzKD`$rB^q1G z((iFc@}+Tj@-Un2fO(?#&kLtuPd_sA`Hve2Ek0Q(8blygWMo%2pwPXUS8y%1ezO8} zIgD!BlF%fwIx6!c@GUc}{y=8UPs(b@mk|FTGD`6#t0n&^SA19Ak~s z58>Ybsa;zH$7}plb6);yq31h|E5B)29T>rWavvg&0hj0dyFCMewKIc#kTHnkK*S%@KB^y_^Sb z+ROm{EaJV?ggKpW8Y{NFap$kWxA0&PeniBfKVG1s`b_K(!gl-bAFMP7Mh!#h+vVhV zWFf+j0(K&A8j*X=D>PfBVL?oR3ZGZsEK5>&s!P9*WQS%2Aiekc?2^NKQhQB`&UXt| zV)l9Ny#nhF@j;eDwVhYWD`J^GJO+3%)aL-Js9yg8dD+Y{%@{xKNQ7DmaIH>92xrWx zH|p$NY-8eBsgAmEt$V4%D45#Dd)D>ydEStb)ZB}sHZ~ub%fq#}%L^s?1^DIK7+}b5 zZ2@*lxza+t7b{Q*D4|$mTEt?pY@83d${iANm`>2&XCIl$AS}G;^w`%A_$k7JRwn(Q zcb>KQuN7s6=sRIFCq?z$lx8>PZ-l>!pR3S2k)~9$&axjB4tw9+_5b$v2qr3rVqb=0P7ev? zY1>^6tqyWNK4>07elmP5sOC3!vGTqwI8KcY*W%N@`>-JHdy;y_8;bOw$7=UB6!v5) z+%`!^ausL_6LDQV!U-@W2liEn4l{snY2L&SLWGAH*XYF?Zk652>x*#f1xNRSWduP< zLFdbu{fu{~7pC(NEff~hv?&cvL*W1)VB%e!T(zSoHmoGR69HL+1J$M9jJ{U)O<51D zAflF~{){c{F301_rDX70hl$DVGa`L=1r5%8YDj{BVN;LZS_h(5)i^30dt(5ny1%^_C817^L+A|C(<{?`R>iV3Yux` z%)X4ZmLrt-#JViSUNg92??dGX^Z)DWt>dD4zW;G75CKsUkS-}H=>`$$1_5c2&P8fn z7DVZ8kVYEmUSesH?vh$+DT$R`UFM+t3Li1+0g&Er#sRVU%G8UFzPeh zyfV0siV1|fAF#~sp2s^Z?xYd>Y?lcSVipT`qwW6$Ukopm(6gR!bL3bnO~^iSa0!$; z5$X!V&AF2j_VgiK5m81;zcER>f6D6lrkb@c-AJVh{wCyS09887C5mUBo;@}>oUbDw~&A%)B-qk%F7+ z-T<-H3-y|ft;g3qGQ zho=`BFNJFP)?D&IU+VJKv9=t=J+C+S$a93csNFOWsT)|`EZDAUYfeYVQEa(=)mP`d zBs}!HPG>yWc#n}0 zbYEPnsga-$sy7?^>-KMcHE!MI{^NmhtmLCpJ0hx>o_gr2moZqKcF0D2OW@*dNP*s^DBRH4$0)fZM@*x6; z0xQi}Brb82hsn(-L`am7BK?*~KWOlH0>FV?`cZ#@N2#a&j_I(af@?(z@d{E-dIg4H zdt<=`b8-!L-R>olIVI()Ax9YKocIcN6+LdAI8a^&sEwh}=sT-$VMWA-M^QXadDr)S z&$7(Hmb=Ipd{1-1dl=lDPkgG{ zlPeE4FS;#zPb$~MD69Fp5Q&Npm?&?hjNd_fP+JD&SBx#U#g>DT;QUkEoeFjCEzwZ< zZuThTqKCCbjJasZuHwM$yDZVC_&aFoaz44KwEO5*DM-nAp(?b9X`{POJY5tl2S_VS zh$J$?{YD#}erfR2T`d8cc?ll@`ua)V@pQ9%=Ymwyo=R-^-*o z9{g35L;tg9MxzO|g{j8P=kZ?wE^xMfzm6*n0*pYk(+n$0^ej&`KrGD|kBJvT08vh3 z=VcLnwHQ<7oj}LvU+`>)Aqwu38cA4=Nmr;h&sF*)YfY< z(a?0w3M<^n{RFi7-*+`&No>A7jl9$kP5ZIvkiLY+5W5}dv+5jSD5ik-r_q8@mOec3 z)HdGLoZZt-0iA2QqVOeo>X7qlMj_31F;9!2x3D21bWDuBw*@K?aT6DPE%Eawgh(GZ zWQNc&p|4?1ttuir&$@tW+ZVg2Nz%TX|oqt=h4!LwjH9kWB0%^f0X?1zJ*yp8M_ zo{>z8-FpI95MVL9tpvjFX*4~d^f(HuKOj#{aY7~AiQbzWSUgy*wT%@i#jzu7N4b#z)7tA8Uk$-hJl16{ZAwdc zt^c-C<>3yy;GQ)h$fa1U0lK%vnhX}8vGL;#Z*y64tq)Ci@9h=RavPSPNLJ3@FThpa z8U7W?TCqxLY5@3gfQ`y00wGlH2J2!E28;5L4Df^46in8pW(!DGPwfii2B(4(idV|S z_%DhiVFgD)`N<-6!>?m{M?^Wq8B#9=GvBaCoqyN8MkHK2@RNlFIsbWg|2m(6J>@?i z^7S?j=nL>i|8*z>mq5XC+z=Gg4dbM<`sZ)}KEzmGU;f>x{eN~v2G2ohtw9Ec@+-V` z=0)#Ze0|MQ?nIK?uZH4*6Q|rs@wFN|6HAhPavE&AwP&8(dl_((WM}G=Vu^JTXlNw5 zy&;U*i)V7=*5BUA2BAq}y)PS_x+~UnH+G%gz?lpFaPd zoLlx20}obj^gVyXzcZ521D`lXrnE5w!~6uPF>Zv+Plb-`H21((9;Sfj6~WY6s}0e9 zpq{VW9rs}ckl-WTAtTSg_j^NK>uJIs*}$uKJKW$o%72Qrkj7l{DQ<1%n8LT*^xIeK z@=dRs&DTj3JGnzgk#lcpCk%#vH%9jcMdpbFjli51CVkk{I7+b`7x^CZPi;!Omtqqs z8+jLD#6E=cs>u&c#AplE3T%H!Pbn`6ErPOjofJikV<8F)+Nk9J6>l5bgWl zllU06kwGv+u~ByTa(~{LWZFcihWr&MCe8fT-kU(7EekO#cPF=TGCK2^Zqvj(Kk}hw zwtmJ9u7D3rf^%hHj@+XBXJp++!Aa*r4Q`2o+GV8dPH@`mqzfQaVk+?^GGhE+|>*fQfQyO^JY{bxeMJ z-={0!vl{XXkI68d9|Thoi8|LY3!GhM#{cd)H%QjCwWSG(Re4m65+K(*1EsM=XYP2r8nE85OM1 z{~6;z>vz%Z7=OXHkumZ;W}dahPza?padAL|iPA6u$g7y5Nj}SCrir?)H+X-w%Hl2s zfxot+1$ihRNA;uh0m)=5pf_Z-+D0T+fkbBYzb4 zl<(}7xzxV_O?}a?SQ1$)HN7-=qsl{PMIIz9>6v|=BNHkvov_ln}W@L*H4x7&-Hli#Qf*g0si0cIe6F9 zYn?271(?RaUcGCt|G%i+|IV@jUb%)x7?%0l|7<1>hUM@5K#=W!O&M1~V0Sc)UJ^~# zKi4_8@wp+WwbN>)q>>u!Rdx@*{HCnYI+(3nbI-H66;!OCMK|p+Gmb4YsK8r@_YCTH zE|lai$HPt9Gp$zp&xzdXg;6i%I7222Wfg{Vcfup3BnII#TkU9m9a@~)^Cp@_nfqQ( zG8-Ty|M`{&&zpvz2g`?bY1m?7T0p+*m_stw7U8@&u|2~kFU6dzRn7g{`Xs+~2~I0T z?Mdwd?Gp;{U^h29jrZkz;mmKN&iI^y8NUJK5g@_`e>(r2E>C*KMWC^Kg4lkxA0f3y z{HruC%%d^9)pK?k>AskytNV>>-MV0-zXC}^PQEiZ-|#!T3+n9b94F4vb|i-Q4(79u z`}M-($H~gr%(*ml6GJ8Zu=_yLC6J2s66Y!Rr_MXhpGwK{7;Rt1-n=(Dj-#X!ZyN7w zo}aEYZ&5MZ_DRt=ZX;cnt>|VTwJX!T$J)%=ADS(s+aMt8>E=G?wOuR+$1L62!Qf9? z-;GmoM1iQLx9u@sp6)w^25uv1rm*)6sIb9%zzf!2%oG=dBTOVKZs~G;+`t5qYj)0ON2~NJ;}=&uJ9d6#|LLI$qSj=%gK6wRD>g<<_@y0VDh3uhA1N-5jK*PbDp_yw*X#!5!?U%Pi~xB7sH)UZSSCeV z;N|Q_wu?t&SXrH2xp~UsLkuoNS_2&wxm{8+Q2`#|IID1r$wgkGsG5fTG`f}ZcN}@s zQd6~aAqVwtEIN9|yUzke=c!y=OU)ifC=1p$zIw-#E+=_YuB-{{WjSv<^-hfRHk#IT z(C9SCq&hK?bSBodP;$x9S|&b75qY!v&=&$R=uEm<{RGnNF)uY8TpR-edwA#;tmxu0 zfl!@!@5)m&Go*6G7u;tcQuF1irDdvRcI#hfN4_^QQmq z>Z4IpRqYkpUJ=3<^e`oiZKIC<7Ax-}k*mC3-uaAf(Rk52$lT>7uvgFGhh&lN2lN@G z|I!_ytI}&*9~@X-ZwGVbrbK7L8wWUo$Yh^_Xj^^tZ5Ykno%HO{~IS7*Uh?vXviuE%u14 zAKkco0#WGtL)vE~=<)O_47sQG9uK$T(V&e$F*77j*50(W z5xFX(UkJ0tL}xtXNtIyp+j>dXp`PIQ4Zq1Wc(^ssxwxoGL8%mYVk4DicS}6wu|6Mk zC{Byl4QDIGsGDe?4N|f&IF>X2eXn}o|HeizZ|~=?VsTg{+y1XNV^4CYm5cS3SBIJ$ ze$v*B-TjbIx7~UCJT>JdM#M>qv~Ru{_f!-w7ZqxdSxll=ho)kEUZEvew_qI6>4O)T zZRxAP)`cI~R5#o7aL43`P>bJ}cb7qHXjSm*;yXdKULYqbKHxsThaj;4d2d?Mv!7~S zr)9*_r>j&AYWAC$jgUZzs+6L~k9ei@o`Qsoz^fyE(Wf4E3J)FZ&}3!?Zhnl0tySwk zrk~YvhI5@8I0G{nQSri9W`-X9IoBYm&r|Wcmn_^=2zsNxe58NQO2g#%)dCt`_`!(b zgOd$u>9L#+mQ4v;v_*s2(D>6I_ABIP#M9`9e;RJx&R7=a98qWbm`)ea^%mX>eShFg zO6apvhiz-~2wvjmMBIVQZ~*H*IL7M93v)BCAZ8n8nBwwceOgpJENqr7;jn>gB=2`t z1FRLbK$hmT`m4|2xGU#9nolQHuSB=l6`s53mSEVcsffJCnqx{bU#0h=s*D>H@erba_e;W>oktu<;-M;$TMf2vbn^0zn=K zmy9TRg;44_#zAIO4zWAC)sxxf*y1|U-azXaDaC;=_x}9xHl>l>vx6z!wZUUR+4^px zZnkwul94yR`SN{4S{aeO;ElfjUb>g+CS-=Po-#S}#%Fl&Hm22haZ`;Q#mPBtW=Mea zk?Bp7B<^H$r9{(ycY2g{=@^>w^qXO;S~onOS!`SAJr(mV_a2=AS6MbF1$_TvfTm(@HQ3qAXl}=n2U4l zUu^V`o7YwSaL4B6=KS%9KbF#W?jId_0MG0*T%igMIi>7c9~=@rJNke}A4|vTFb{CxdKv*iYG$&`Pn^kJ759$|Ti|6kQdervL zQlD-Jd=Ylo>7zpM?r+1%@z~2tsj*|8Xu5c!i`g2R;NW0n@GJs>SXht{5owR||N5Q* zgzIn*N@Dv+(v1>t6(7w4x9&|MU}jlnDUb%;K&8fkEq*bOalWa1yWN;>gf1w1;7Q_r zbulurbamo(4r85flgcL7xVk_AQTcozDj%|z#X{G&M4$DEy3txkv>+^8aXo>FG(+^f z5-)5b$-xQpd@i{1R$=!c0yk$NudV|NNv-E2@+n3eS{02$%Ol!uZ@^}yxJ+u zx9!Bd&!E;SfTPGhRTJd(HaCv`Yzob2Fr0E)ozB0Y(t-(SJ zT56&CQI+crEm1TVHx!xQ7h=@a;}uda{%I^q^IK z9FW{crzn7Wy7J|32?66^Rz$s}It%KE3FH*ayj%9_0d}|Ywh*2_Bc(4tgeL%gF-9*0 z{IHmTP z8a?1|hkcNv|Iv0wKKyn*8^mAi&i94YM~}ZRCaEF_7(gdFoYKj&KYvdD)YEce>^;Be z3&v=WW3eQp@HXFzvn@st`KJPUsv!E5yPcj7$qSqAvmZa8c$r{uw>KV5nsy?iTYr}> zjMDOB=_830B}5+6xbTgHWeE|3$?33&D2L&adoi{3p0D*%ESN#mlC$DDLNdZz^s)w} z)WZ||;rq6&GLqYUIfmoen(5#B1-~Sw&lc6sXHPd5iA)^Yf9^|*>`SviI668~*<7A< zy2fGCUOJ6ar7rBEb<+4Hi=X*9%-Y4Y7e3Pz9H%1VLk%sOA>R0d>%K-6Q-_spI$2u*v`pyoNO*3Q zx6D+>KHc0UbCCUu5*w)OLFQ7lY8OTayB zLB4Ok%jU_H5W`Q}CT;~pqePc{l3NVeD`uMMAPp65RSwe*UIWprBVhQC@c_{DCFT_kPH(QP z))Z`RMRy_9e>f%%92MR0++~ULcbi0&K{_Zxvm_48Hw}6v@bOc;ZeR2EM_pzVI==DO zYfChl(y4~n1p|)o6Y4?WH11ru%pm8 znm2|aC2vt|(xX^nbIP;*J>?{EJbUZx+(o&i^fqgPI)7-EJq0Pd76kuDL3cF|B8i0M zR%SA|8z`L~L4bhEqmm+_hj#l{v?zeg%`aZU(kO)Zu@(PfUQw|Qn_ygyI=X<0nMRxw zwyXA_1OFx0Q?;`k{BLUJ5#b_gR~JYp{lcG~Z{7+0N@hZ+9{Y^989t~a!#)PT@#;0& zsEvgQNhbaFK&c`esi-l-nFr8w*Ikdgpm^D|c7^v>3kZmq+(b7RY|3~toi zY&nE9E3Auqeji+JySHZV20GqmUBQv2#Cum1IO0hx{wTU~TY}Xt_DAs@sZ|lS;zv{v zhuhW}pagcik798fwhkoh6Dz9U^u3}ZWa`!Nop1~8qri2;t9t_<=Hw9>+>&PA?0Hlh zwRuGBWvDIi(ziyw;xd67?r0(Vl0)cQhLW$kOXf;eto|K1rYIsA=dUgzA!|=25or<1 zm~CcCuf4bVNGJ~jD+{QeXa>U6xEh}*rE^DK^LghohjDlOBcmFN*w4jxD{+YoY}sZA zy_zW_RjiWz8o+H6vAlneyvWvi;jc zjzTYJ+e21=v=_{EPFYWUyLXcu|E)d&C!vM^GOt^iNRj!5q61u!BouDSX8R@Br@G@=lx9u4)V(g_tOA(>>nHlQ1nw45LZQ8;P z5p)~A_3!Nn@-DwXy=!<%)6F=LWw!JKEu_;ct<>gXm8z^%0|A``p|3W})@B_>%^u~I zD8rcbib8E-J|Z7{V}*0l;S12R=cqmW<&X{Xf8gd=4OR}Id6!kxQ{xi@OMeLlg(z4! z8(}Ow3AX2oxr#k4wsnLt3rkE*dq34z zufoKvjDw|Hc&w<GF-*K!y3sY+UA;-xNqNg zPsQ^&=Ivu8EUBt-R}?Q&@&{8hG5UVtFi-!?c$D^y3OHR*pZMh3@%xoP#Ax%Kd&b*B z1~Z#2u0qj5!kp4H4VLgsZfkM$v^2UmOBpRh_t_M!ULQZ$Qo{@(miV0jK0l%Q3ZE$c zD_D&1%e&};7YHW#H|30|Ur5^^cpc{ZsQpn^3(nA|;11QTYJ!eno*q9i8=0r$^{q=gPOc_C7y4#y(i-z1a|| zYDj{q%#-$K3JCi*sG$dH=bXlcv(@-cPX-nh5NGW-V4>;5sb9|)SVF#NQRit8gOkTiV%xmmqFIbk1#S^w`n@mN(pZJGHUdwC1AEz@~oRr0r6y z%l-7pvMJx{*R9+3Kp2GtkB8mAR>>w`a3p6oD;L*%8u&sJk!x%sh>P-{m6i&a4uI|BKX4^?J;Utkw`HsaA1qD1n5DLK%O((2cHuR!_dZ8S4r>f1b(!x# zW*))4)kxQS5QQ=Z9@65+9^_#Ix;uAP2AEg#>(SXcJ|$m0b(9QGE~fGgUr7paz5eOE zfJpV&wb~pg;gIp3|9lrMA0vECS3f+tnPCq8LcH&?z-ybdfAn+lhGqEn$L7Vmqtv51 zKLsia@C?jqq$OT|*eMaBSm&Ndf0iIfGoMP@AMDif6I!Yu_vAy<_r(W!)Nj7!NpF_* ziT{|G_4u>>4)09oyD)JpwWJ^XAyN(C#gD=AA^~!j8cWX?=-^~Px8Bv`+F4i@yn5$Cy`b?^Ev4 zH7p2G*HPrKAt-}j1!>ws~WXr5)ZqEeKEZ&VQvnL`pW@b~dab(B>)YsgBsg zXuu!TuUwAxnxx9cf-k?L8NUz$#zpvL47RFKEl6iM20IoHQ>hp>eXRY=z0Qd+o*qPQ zS)@Q>lXfR-WPSZZ!vYfoOsd>&9lXYhQXaai76xoft}ZuwqQkK$U!RLJm@ufkqT=f8 zaJwg(&R8&DI0{}O3hIS60VFGIW1S3_@i+~blq$y8UBLrq zjpB?la5&08g=^@W)ja5gr0%?kM92yU|MD3k`FN5btE-&S`msm>eFoSf#gvRnO2{tc zHM>?LVeNhjH{-WIIXmduH1X+{#@$s;CE+*kydqaj+sMGrJ*)hDml_SE}3F*X9S*Uze0-m#yBJ>A(G9v*DWs;OP9 zpTD?xsW>}0ywDwQ;Q?Z>rUG>p=Ie@xE#%<#=F@sPeMsrxy^*z?^g=xB7Zn zZTP-~;~AK~Jz4DuO=t!&Sps;@P(fUt5j(rx6kbrH^1}hz1M}RBC(ve8Gaf)~K#XaH zU<$^anU`RftrvUU*{zoqZ6esnGjs3N;jOKrd!Lz>aE`1HmT8wkNGVpIWL2Yu@>LKLHZkA=#c}DZR`g@66TzwyN zeCM({MVHxZX}rc>pS~=A42@DR30W7<>6CY0U|9Nyxu3D+9+|EC7~uR2_&pJ*N7*@Z zIkE0E^#h(wHe|${!nQ|CMRmU2uefe0tl9t4@rQuv}{sgCHKe85gkJTEsc)j{6X7ku*`ImZxAYkfh0y<+t_jg#zfQ2 zRT2J70EPZ|k2RNH5W-SBxu-3!uzcySQ!TlX@jhoj+9CeIbJSCLZs`gE5R@=km=gy> z`-ECze(7qa>|l6JlDOW{_Dv0R7OFt&AiYrOwb{iXOeZ=e{C+bl6JeT&*=x(xXq26# zzU^gcYLKcTwCFRu{AJBp-C9cDpsVVnTFI#Jj1T0MHt7x`Nhyj+1#kP=8ao?Lr&Srm zJ%}stZLpN=OJ!^0FsoOxsaFCrx>U$8o-^-FfB9%HIs6PQ2}JmO>y_H!;d=ZXeS|UY z(7+4NFAxY#c9O{krra_9rC~4Y&2dj<|BQqfskShO2`}isUd-F2BD%`}VqVk!S>De0*88_oWAWfkth7t|C>a;D&6DuJN?J-zXs< zAt8CT^8L6X#n5Ru8=|qYHFav0b!Ms84et^@c#aZ_0HTl*U9PSC8r-VJbT$NM5ZSUc z>@6;;%%9N1DYrHl(PiWQ;1+){K|h?%$!F09A+?hB$As+ax zL%t}--9s!TJlX;5dyj5dDqv73791MC)-N7unKzjWnE>LsnIyy|rZ5yGO`o5s&B4^o zI(vjteIJ?&N;!jqHet}=Jqk&_uKC;T*hmL(+2TPJ&-~L-hJHxbs9}aZm|*XIWwvJd zAU~OsS7?9m90g=ZJhxHL6_1A^nO~gOn0hrl^n_(1yR#$chCNj?lD*6s?BVN5%iUOD z7u}+wt;vZIs`&ga<`uL3IJ^%ClRK~sOGXyc0CJvmf*5ppJ`eC^@#-F)lZZc~cCapbp;r6xUYvJ9I=b&avgfpY%p)s0h%Gn0Vhbr}y zPa>ck5&IpS!@-AoYPz9%fdLy^lt{$GGvb7sRt zAS;i*ls4DxYyflXOAvon-rCNC#D>(dAH`dCjCodRC+D-XdlBips0dH_X{H~$``Y8; zdtL`F^-8?M?y$&-v8Zo;eYJ%H4|bHR)e0ODq}FLaS;Y)-pA6aXg02JVI5lpc8;pR=A?;>x2!K#UoZA}ewcdf>RsL_TH0@ZIh={)VsgNS|$N?B#1UQ=|DCkMY!d!FoRUqJ@EL_xF(iAoV0^!jwAqt0YGFWM?nTUd%Rfs zCCrbsx;E76ukkd05A*zs|+N^d+hq}xlIcjbFIS?uYDI2BOab{ZO+DM{*k;%&a=0wd|05;m#vamFo; zBLc*&Et{_*b|t)oTD&jTWV5Ix;%Oy(ATH+!y73Rj#&A!j$Q~vLI+KLFKQ>Bmjb=iT zvl}k=%F=02ybtW_d)40F-U7waN__Zza$vE@!Z-+x929T8e}C~l^uGS^hRHC#%Kh;& z;AF7ne7VJYVR`iJ4K7AT zhqnmzH(}3FM<~pFjQXR6x{bxL&6Wnp=8uDgKPG}G#V6i_eNN8?jb6Q)Zio96f4z$_ z-An~n@1X*8;2z3wQ7b(!DL?A>kpt&({0mStaejwHXpVXOpd=&r!MpD8*#(VN8M#V%vEN zKCu~({1LbCZTx*F-=stY9AF=#Azo46|cU|X^^XfnWZZnoXT~EevT-*VpDSjP=H!Z({!{4_G0x2g>x^NMf^C!;AX#@Ps@>(pZ(uk}aWYWsD}F!Qh3 zGxzfjh!wiZP=QFCEG0!V*+&@DD($peSACXA)an3Jy0o5)PHd9a+c`6(YKJQn8kTVv zNQz|&I~7aC{`jR+=GB7WP1aNN=l3#^NYnc_@}KP+EuV^6?1tqthZ-CnHXUx1KcX(t zby%571sh>)==vP=hQzry;PA2JkKP;KPH@TWj14p}v@|>f2osXdjN;|@yc`Q|t%&IZ ziW1r~7>eu}UAP9e{5i-RFh`Ec7;dW8fy`Y+zU69hK&Kj)TQtuWGKi0Vu zKdHwt-6;BW;9!Bb$GT?ir&SOBKzSC`8$py+dS&T!ukb+Oy`;{JIk^I|63B?Sxu_e= zRV*HYjmcQbAjfJN3;$U^-Kc_<@Q32*{2iq&I!=q(Oage2kBMxAB;C#B8YX-m?tIs34 zG?$C3=j!Z9ALCka5&GRE6^qpjO;A#@TO|mSS)yy&`MkY!aA!PpvXR?)RV0%8KKDn$ zHEJD%uSW-v)eg1fiEUeVMmZ2GB+kr6D&$tV{c5mDV*~N?^RMqstR-TVDj>d#naQcB z)aE23O(3J75I?^TqTdLD-RtqZR6=|6e|3yZT~tFA-lfl3#oA4t-VU*0r~;Nm@1-d2?i=~TuVE(CHXh;AJFzUc?|6{ zRBk_Xca4kZ4~cpLEF~qy{*d+==${y`bFrg;MX|OPnzXN-7~x60mg|4gmcd6XuSFy> zf7ysV%@^w!21DAe;EjK*bN~a@L(<!n2rRVlZ!Lu+-!YDwmWJz38!d zqkcxHf}<&9XaLOaM6!u-Msn&1I!7|IWLcjMzEv$g(|w)mu%8M@ruY@E1*}Il5Rk0# z6Ivc<9LPlYf1h3X&uf@%u6%;nf_+ZyA!Sfa>`)I+p#o}d4V>BL)Q0V^up#iItB7~| zB?p}=O9|W$zRuH#YY1@WLGjnW9}IQ|mset}O!K<4T27OLAxl|C#cPm^cnp`v#-DNf z^BYM{kj+7_>kN#V2OcCMo%#COJm3z8>FEUX9>B>E$c#q$@^!99!WQ`a^8U-yQMBowTCJX) z{RHonc(;z`OYA6mSk$8cNJ#m1YdwSD=OUesb)z(Lv{~&(6l;UqCiuQy6rC>Os0H5( zn4tF20r4YaU&&dMtNn7Pnb@X2aacm_x{0s70XCi54AJ<)lvw(D4hdlZlby^Qw3TFa zPv;IsIAM`VdCp;Fd)tew|6qMF<0~-6C(e*u;7@|^b-GGG6Rt;nJz;<<-~vf1|9_u} cOnk(N!&AD!{-S>VI=zCDocgQsmv8<49}|IU0RR91 From 92f1fd9a3f86322c4af2a06822e62d82e632b8d7 Mon Sep 17 00:00:00 2001 From: Elizabeth Ross Date: Tue, 7 Jun 2016 08:09:04 -0700 Subject: [PATCH 02/69] Add new images --- .../images/intune-add-classic-apps.png | Bin 0 -> 36710 bytes .../images/intune-add-uwp-apps.png | Bin 0 -> 33779 bytes windows/keep-secure/images/intune-add-uwp.png | Bin 0 -> 11425 bytes windows/keep-secure/images/intune-addapps.png | Bin 40662 -> 8839 bytes .../images/intune-createnewpolicy.png | Bin 51547 -> 52194 bytes .../images/intune-empty-addapps.png | Bin 0 -> 20140 bytes .../keep-secure/images/intune-generalinfo.png | Bin 0 -> 17398 bytes 7 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/keep-secure/images/intune-add-classic-apps.png create mode 100644 windows/keep-secure/images/intune-add-uwp-apps.png create mode 100644 windows/keep-secure/images/intune-add-uwp.png create mode 100644 windows/keep-secure/images/intune-empty-addapps.png create mode 100644 windows/keep-secure/images/intune-generalinfo.png diff --git a/windows/keep-secure/images/intune-add-classic-apps.png b/windows/keep-secure/images/intune-add-classic-apps.png new file mode 100644 index 0000000000000000000000000000000000000000..bf4e5792c1fabc4b869979629809051686ccdee8 GIT binary patch literal 36710 zcmd43c~sKf_djY+gH2}h;6&Dw4NgsJPLP>dnOT{$h(%^9NX{mLm6lJM(xjFXsW~e+ z;($tKYB}UA2%;$&DI%#13IZ3a=kxvC;g7r4UBBPDYvJ;6-kf0%XYYN^dF}U;E0--5 z)+?=-lao`paQ^HyIk}YtIk~^yuU#Xn$>q=dl>J-fX=ZIECs&HuuykX!?EAXA=bZxN z-kj;}}H-jg~O=LQWoe)Bzwb`(4HGf>seN)slEvRg%c4RPQtw8 z%jlx*=y>ZO?~&cP_t_!fH@(S)}Yh|@IdJUgX&|ZtcA4C6a7=HBF}cuFK+zB)$_mQ zlE+Ij*?`fYv>6b3F~9@xsEcgq)kpWQ;MpigZM7B_Z@PT+nQO$G8Cn;+Q z*5oIz8tjut%`Nn>0^QqPmy2|RDj3c|NWU$x-(}IQ9dZd^Bf=TRI<)VBIa}E6AZt+s&%_b@9RBg}%D~>R5m1#dP*E58nY$ zM+R;q7o(@sM@Nc?Yt|8NIAO%HE^zZMKds3X58-Z~r9JNq|50P3YNz<)|7vVp?zbWT zla2g5kmevwOBBbx+ECf|AaBVl``&3B+J91WQH~A3Sx+|fQ)fK@gG9D282%vp@KUxg zVg2!ZciPTi^FzG{ZWP0n533&kP+Q!11fK)-Dd;~&Hh;O^cI+TNqks1sxE#~7L`&VpA_$>}aQ z%>JO^iO}yXTIpp~NZ&%#(QLAHd_eR?@P_>LD5sN>41^shrqoKlhu~pd2}4ST-#|Bt zE1)T1fOp>$*cu}zj-Sg9ct@T*p7>kGiEeWpCzIWMNTsG1wFPl-p;_?N9gX`G4=tJ( zDagku=4*uO*&o-^Gd+rTkGQ9|Ch@GYb;k80yv^y(AU(XAKTHo>*i6%RpxArYbYH(N zc0BV>zTjYy3(e+cYLjEmmzr0mo;SqTm3cmIe=y2gX`yMar<7WzSbBm&pA_MAO%`eDWu!92UUj8H6A6td{cF+4{qy0tUmIABu2_9i7{YITZ74l1)uUyM0 zWsi|uj-D6fPi7FM5~V>aAWT;YFPsbeY1PRJR!ja1MrOcpH>JIV>r-|5cJ($5#b+Zv z)bj4ygCyUtIKQGJyv2kofv?_Qca5CvWxn%STZ~U?*t9dwB0#%mBvYz>sI+c3CUm3E z{LV_2CJNXq&i%ctrw(+v%It^!J2lz*8!L$Ce|^2)2j|>y@45H-ZDVG}N47n^rr2Xi z#}?HZDT8>K>OUA&_7GjFNRLcPFtk>FanYN9_>d%fp1>qe7GYg2BsM-sWq zy61ME-$_As&9Gm{0$}q_p6PXz=_vE8c3)RPZ54S5WE53^@tiXCVydFF3hr4N2mi8a zdGsUqe3h(A5?-LW`PWn61H2nx2dI00V_xZ0hD||OsI~lyesgY_$fv+=%}!%|@IyE` zI^r;myziM7u*Ks@RO+GBg3`fx)`PrL5i-&?c)#hcXk(o%0IGFDLn@|5+~#ZY+tebK z2M+S8$_s!0EhEVEC=S%ITy=@V!uYB>PC~?F90Z z>-F_^f*K?;cIBOVZL&0BwF|OyhlnK_$@wJ-YQhUooXk8Op0vbXtQ>L%s_4ugrSFD0 z%}4_Le7@jaT2%=cj0POnXs*0D%K1(7b=%JY{dXS1X$GZW zpCJS+dur@meR3q+=u>vV;crok`lnB_%UKet_Zzu>0_nQrh2qg5H`|(^dC6l^eo$?H zLTk!O8xsxd75T3LfPjG4Mi)!00g!p2(P?cYShpZyHSO$qnS`g~?b|Dp))!=4W9n3* z$@i=eur5Y4jrJS;nMM6KC%DWs9`b0q>z$^v4R zG?|OhNY(9aN1@-X^rBzIi+m0XzS7l8w(sEY0z@2fyzt0xKzzQ_$0R;H6_yf~dTli7 z5r5a}+I@H5wRV27soX=rFn6^+uZ@r24$ICAC?8&k22x9(HE1aTT)_C3-AUI)H&kqy z#cHW&5k1u>;@UFP0yL%!pw*I6Ap@4ahD*I9X}Tbw^Kj)t|07?w%V7@ro#N6a`;02eK7Fn;}`lUz}6LK zs=R1Z6{N>gN{)fqd1LiirSey_X zMDa`b0kJJfD1eW4w`5+7w{sd0sdEq5vB|gQDXPUXJ1;)f$KhT7$GS5%so9RWQ|Zjn z-(l2%+uTOI&=RnI|3%dI@`&Jt2nj@5MgSL}ylLJ8EAE63@QV*tHcv#th05^X(MCc3 zw>{oJ-9-kHmQhC|3R?7;1CVrdEnTXhk1nM|lrItZcSb4KZ1cctQLAY5qVEXaZzrEe zc;T7X7|8~Sa|;(+?5XPgz7aLpRe-VF3fqFX)ii3?7)y_UXn6@L*4G=5nw>`D>N-hh z-~M8;v%}{TUu7JYih3bxlcS~L-XwtG(j&-Hb`wclB_)V7*_*wqh`|#nml{gx_2V?> z-&Q0m$;47Y4R+Z3>Lg+^Sbcg6EF_m3@#^W7-_bx&#S72F{~b6E{p+EZgN2v>`ukYpYzA%Y|o3ve(GC zAS>RtQ>R>u+}^lTR(@ab|F7=bS|Zs_p4gPsh`DyfTf5vsZ(J8d7?zIYToeW@<#3M| zg#011t>qzGgu$kmilz;!-H{VR$RVdzj#iQ>H=j7S7ioe#U#vTSIehB*9IqwTojCZ1 zQwedaUGlpkzAE@eJD|VDdQ0{XC1~`=XRamqX#Zi(kb8;vCV$#<7swpQl6A`zhcDjd zw<&Y3v9d3IK!^{v39!|NiDMsE4k@&X%MSfRfWPFNz%uzh=)b^dt4k$dpMU4LCK6tI z=F|Y5@yx5C$L_(2BIPrMtA>4PC&SH)nzR~&i~p5nq&zJL0XuNN_SumYee(2z829A$ z%`?2MwDW1zv!QU)hwLyJ5r!fINCG%$z9C{+17O(3NcfgBtkJjU8VTy|gf+By+WEX< zw?ahNI)YDe{wkMsk7NwAI_qc&xiJo6PfEylb_r zhwll>79|P(WBL(ybgiN<3W|LzwUz>F3@O2*Icv*rq@^sh1e@zUau>Z3r-1jqBJFYu zD#sEJKXFglfO1~*O9g4ZCmR!~#j?#rea%u1VeK2f747&>A>x{O^Nou2dCgtP;;;>o z{zeq)GiP4u&B)Lrl-i&(kgcNU!94%+-7-$>{-ytMrWBy?jo75yPU;KyIdxsVjB;7N zdEeWX`S80ig({xAGIdaW{!rtfj$)%p#Y^YW>E*TapSIMyo{_ji58+~v)((Wrs(vbI z7pv)3fP2wjeutEcn&%n`cgQmi`2BFT3DC7={%`!Xx)_@X`9B?`YbyDjxx2dX2!}h# zfRF90(N((=Hxa&j_SJqcx&digBEOX_&ifNvWNX>Gqmi(nK~P(A&3|A0**Urh@Y1>Uz7R~RNzaj$bliBpBEhFaWd-Pqgh zIK^c}P+MN|=agZ)mWX(x^N$fH3%eaV3kkXpZ+NGV;B-_Ey&Q91{cXo&U}#hYlR)2?>BD**{*TT=U>rGUYQ-`L$?$- zS1Jp4P~0_R?xxIOd~IT`ENfBeewi`pcZ_5ohuy!#P_~gx$esTG)=m-Be;Kgd^8afM zSc1$WDYWW#=+qs>GYk$SS@I_2V}f)|(oJ7EH#8dgF=nS9Z&Um`>1u53A49uFk#I0# z>3pz9>)RtY=04`CUC?m}S+*@@nut2hny1bU|1q(&(zS%be~rf;a7hAIV^o^|^Ce?L zJ63ctPhtMd`#R}I>j@L_{I|_#=v}E32fxg1`@V#zX%G#SPaF7l%^X}Zai(fACxWC& zEOp}2g&;RV{kFx~cl^rse=S7TM#2OM!IGrOBC|~|b>2PZ&H0b@t-8AIt#6GqB!KZu zg{u9RZw>B9JxCN+?52Sllr|J=xdcOq_J16}@izCuNG!Uz>D?vT{oR9=>L6$ zTt}#lI~w6v5=Y+9{=w%Vy!H=kJbt=sW^{|E$?_LfZ?Rd|&ljQfT^}*B*3gcEB^wvd z)u*red9$HNS&;3lF|hr=}q>%96YH2$YE<&_Xu-^@$vuH2m`2)b~@uC~v@G-bH z;ag(`OLS`^CwB+e?BQ1pHOh2TT^#}YAOpbjm_1f2PfeWgzf>qO0kfHxiE|P6xdXf_ z8arS<9SLCp1<*|dcsn63e2tK_$_4i2%WB$tdPTek z64@MizDhCqqk;*-lMYBW2gwy(q{aDqX|7$vI$NT8n(T9PBl*jEVTsH$2&cV})m81o z{Kd*0--r0$)OEcfEgsF-AWiYG*Hux=P#VM6?9M;Yoc)Dh;wsv)J#)^zoJxX#UfWf# z7OCE1&L0Y#md(QYQ~4s~p|-xKK_uL7f1)6HIO|(vPT$H;52Jg=S8D2x22bTUc3?>A z!GO65eG68z|6JkADMpwy!20V}MfF-l2yZjKdUC zJp*y#1S48e z1vy=9{bhGi6t7l@P1pvntc-hAmjtF^fRj%v)shB}wXwb!bBac=Zr&Tcx3;Rsu(Bx- zTIK%s7*t-DJpP{aJJo?v+Y#hlrO7-PZ`qHhfA8A4r5HlkBQQ0>JOK2WR*EGLMs#K% z{Q|1qPQp4UF;vQ9xZV}N(JvI3nLsdcsj){vhHE}xA|)NgxTJ>-=dQJ16LrsL&0f2e zc2{K8hHYO_D6Q@|WiApJx|->6p$MTBH~i^0FIXGG{ipw8FUu5W`<_87Rl=v>#M} zw^c~)CWvb~#q!`g7lB{jfl;=HeE*tMWQTi6%u>*DrGWsdPzhr(YvzloyrR|Dnk~}i zT4(efTTBV1q!cBM1ffikCK-_9^&OpO1U1XDoylnBl$(%l8z})$CwOGD-OM}T9eSA} z&moWA)=cXFT;{B1;v@beHP8*b1Ilze6d=&$%4F;3@+2Vb^=M#SSO+`U8D-MPdSbyS ztb!BO=2R^>X?)=8fW7VF+U5m&)FQ*Y4T*}?L+bTRm zYik!@sW;36lu@4p)a}(@6XpyE3Hs7s!(|j>jHgMHD$(!{`;Z%*;X_+#m*Z5Dq*f)( z-=}YufaAs^uZ-ZW4Yr`>pDCVoa&V|_dbp36k+ zE?sERnV$V2{^3D@Tx%}#b`2uxd2fuW$d%10w??|73SF$rX569;u-bO#_+Ia!v>l6@ z_l~#J^-;F9628Nj7yQUFb(qR=br}q=9~8dngO29~U4ug6tc9+$fU%2Jklxm3R&h59 z;&Px@So(3Cc zwZ=M?Y$5JxZ-aX6VdePc$6b9Zr19PQhW!r2TXa>yC+C&Y7zg;e?Yz(_J~y})z+ZA; z<&0wV3L;hqfsJQHy=+>Q<__V&$=e6Y0mw_jQ`4tjiTvOn=d*nLo`^Rf#daKw_jKUr zvTg%qeFcC>3@WstyZGvT!ql9cVk)H& zI&Gq3h#YAO3)?sy`eXiJ`x!vf@izveqq_L9A-COG-veM6yDFa{k4nFbshs>5v$GNF z2o#lvaFB4N5%0l{L_O1ugTQ_hQ%KdeD8;d<7H1~G7VxYrPEx|5I@E(ZfZZR(JHtR> zPBi(5z2awGP5spqaTcu_>`CAh!)u1bM9keVs71hk38;nH4Em9vxGo(HN8I*yqP=#e zcO`Ia4OOwNIjqXTu2i*cmc=ipY^IV2n6-m$`%xQf@(|6(9zp-1UWyB9TC7T}QFA5s z_~rRs=9|^q-@@hxcnfmz+f3Pce0K1h(LG#%HM0PYB3{B=4OCOon!>o*t68->8pK(_ zpT6pj?w>uVmkL7FQ+zD34#;@o^k`f*)zfgNAyLliHk;1)5kSPH%3kctm?RsLe0br$q3l+DX*-FHcM#Igs0 ziq~2fEV?%eHttQTllJ=VmN(QvUAFDBhffb23sz0KX;SFtrL@vmO}I44I!ArUJM%1v z^(6?D(p73|Pse#A4YcG>B&R9W;FgvhTeLe3%wBmY7xZpgK5>}Kl`oL&O(G1-zY}dP z1ZsISg#VmEeGUxVwi#_q19bZ4iuwl0Kfc3-y9y(^bNTt0{YE)=Xpu`ATcx^%l(8KK7^Csgwd5Vz*{rG{K`b!oCz+opuw; zcm2#NaTA-g0lD{H&1xqf6L-{p?#q^I&i#nJ!rI?Td4$DIeVuBKRZ$W|JBRptK>u_0n zOoM~?pO&{~)xc|+{46L;&Bs&+4*k0wMiaWWJN_Ws!)p-xE4=Wk_f%W#ZH%9YU4pfE zm3IW$NzKd(B?B)TfqKx4D!EEnsr(oh%1%lN;_V)ikYB^u$0j8;giC;L=zS3`qYhTn z5DLo$Qg~byJ37v+A22{04&*Z_p8M&?B-SWS17(gVD{H=QlFNqxi~pg z9cJWpd3jUIpm=;Nj&YOr46PSuc2ezjN*UbX%j|qi-6mR0PJk=Sh35po96N&vV!j@#(X?f7qLUs^SnEgBuzSQxt#h6<+auD>y7&{bS*AZeo4| z6$%@PM!h}!gFOMN$iQU5>te*);feDpY9<|VXMgayXzt1@FYnF=)4nsd6A;P=>*HS4 zuQ1m~M1@rR_h#|~EcR6Vg0RzyXROB`pq#|| z&~7sp1H^|14@)*M^PzL?mq^3MLHNlfmsni1GssRlT|ET+$ZCOGimZ!tIjYM+NVf`c zCb!Nv3`5lKCwxEy&p+Z%wQnWIcb3MZD^Y_~(;_(^gfwjCWPmhr9B1 z>86I!{M5&OeSHt;5ix3tHNHW}T0j_yfEhp=qxs+4^oNbuSnaR~e*F$1R>dI%SQtFL zaDf=sF?}ovN}g-*rbp-izX%PVlV|-LMC)iL`I??xkDRX`V_fMLwY8eXJ*rQ9A-c0? zTYG~ieKwD5&CwOP^^FU_ZUv@2UatOdazxT>_q;_oI`&xnXyjyo7WbYnG5Ux82T9iK zQRp!be-jDkXQTaPoatC$rtaDNg-ow~yB?yT&>gb<-+llLZtzdS3uRl3;(J0v3t)y= z3{U;GW{4NiJK`#GyiH2^>f7cLc*3{5N3d`nHaCA7$0nfQMY^US2-1bY6j6X6Iauy9 z&w0{HdD_y-%7w0v_=D%$;_~ZsYor5t?dY`x)|nD;nl+HiN4@u9X*LqdUdVs^f(_{W zmKr5Jb{D4p!ksuV%p*#=R^0<>E77b``U>Jb)nB?o9%|pWUVBepY78q$P&~VM8q6i7 zswITGvu?9lCm*tFH~&65Y?Iv!EbOAQIgBQsb#=X#`Ny9Lv7P4+ZE8RsO>qBjuu%vNELO4x>pD*TfxLtNYMQ_3#u z3Wc7Z=nvs*DOYPyyVyg(Ow~W!h;nF@G-qr5OmD2 z!k?d=-#H%As`9?)$ z|NT(EcP)YP_oCqEA|P$hQmPnJsN~}nK>qSZtu@EXYLpc3-4oHt|HQ5ueo6FZr95LK zAp>YeG#uG5IgeYuKbV>fLY$HOfmUd{w8-G#pNuDvt8dg5|CqVV-51Ir-?iscd<=VsGp8d$TzXI8Rh zKV@HC>oL`_6W!?sVncL=yNej}rV$4Lgk9oQ91sv1GHw?%4uUcJBR)|Nq+-_1b(Ofx zg0{lG&bMf{3!voZ>{}{q&k5?oVkCA#&}mmc+NR%GaqN+xI#pg8^4gtv{+@bv#YSLD zoO>)-QOEY%nJ;x{Xx~`0J5gzQh|2ax0(_4?#@*PonHeNWrO%^`*8526p7ZHtKOOwA zO~>P(ERHb(JQ@ibD^}6AKh$1hRsxO>-`j?)$XkeX0sg~kk9oWKd(sNCkrUo%o_dPg zDC(d5MQcFYY?z%iCgrT#?Kf}(lT!wjj5C)e$Opr9G*-a%N++&q2N~-itefmQrTq6h`cGs~t85MS;eFSju1Q#)n;IMHX0QW~UDMx;K%k|J-{z%2=P| zR-GR8OYAKH2>g^oU`HHB@EVCN(C6}Q3et=sE>9V889B59H-prs)cSKTyX2mTFNoM2 zOo485H76hVt({w|-L#ACW8kQP1A+cp7}zC4a7&NGIXq@HG`JWi^9B~ zRbV}0*;UzU#fo+cRWO!8!!yb4qCJG?604M24!^qHV^NY#w_xn!)?9S6`~b=22kbZU z^j1mv;t^PM8%4|gX{5Kwy0!0QqJ^}O$3uE;*%ROdhL~qAnvg}XE+0qGRMz)aq^`FM zAYi_9GGI4E7dcaN8sU;E`e~%rM=dSzh$COvHkoBST83G8-LydUq5(_^6P4qwhhh6@ zA*NMn)Wf1QpJe?Q)|m+3Dd^M!+U3Mh)vxG%GYo^P&fm^?GQP4#`2K~*oH_&evt8Ls z^8V|fF7SN2qB>8~W8kbVZHIb`zeN{RWC`DnmN#4DoO1+F!O&p5sO0Gg%VKm~(Rb7V zR4gh0ed}xWMkw)=uU~n3Pu%2Mwa3@p7d*fbheOKVm?DB*14n~M$t@YKAW$&*GQ%<0 zBzK)K{H#G|>P$H}=W|#_T(xcv#1L5&rlQm(6L3{bOa2e@p^(u;pSFs^E-d$i(uN3A zCp&DcI0{-$zD=?0t2n^67wJ+5MTZSuLjS>~#mFS>Q3eu^^oj2nM|c3{Q8mE)*|;ij z_@<_PlPM#Y%iC`O;2cFU`cl1oA-t1P*$t;Qv>zX;q9<`(2A`v*d@NheekaGbLu`Xl zrV#9Y(=}nK9!|m~r`vC8gJYoiiIWZIpz8gLx^DWT%2C__KK=*tSTP1%HE>cVpSAy~ z#Ye0`eTQ0Xg$LeCowWn}w5xt3q^3AmL_4`@Kq!&Wk0~p1jAUr)aUvZ zGV-xD$f5zD^YTh153!qs?XI>1wUexTou{#>%8SY^XW})dZ86ZkiXCZ5sYR@o;yV7d zR;8B>lM(|kCXR_8Gup_|H(*E4mWy8!JVyB^vbd5Y`t#6ca7aUn^y$ihZ;K<^` zR7GYF-?Hj(YXPknPHxERia@IPi-Y78Pov=83z=|zlc|gP;Ng>_2*Qr7VB(>I=e#b9-#;Lp7EBP{R0N3 z`g*tP;K<ABLpI@4VQ{a`*!dTpo(nBU8TUCh7z%O^Xb^214SXVi3yL` zpF$s%{t{5^m*oXCEBL*6W^e76kA9|z`Pt|ap4Vcqb`kbU@$=M54awm$$=7`J<3ivq zv1FLkS^)g24EjkI&MM?g=DN=rO_TWQl-|qYl_wgmS}@#OtbT}d;_ckpUpJ$)(fY6f zASIv|WNI_`yx}vNHyf3bWQq_jWJ2|zy(c$K0Oxr0xt!7tra_vmm+?JxK-kh>hHL8K z6bEnm-jQfv^z7nxz9SE))Rka_wdSro8?IIhvGspC7H$Bx39=AP1dVq+2W~<=weCv< zrgz_-Eu%nAK9-1YO|nj(Pq|@C!w}|kMPmd9Mn>zUK-1`1Ae1m#<{Qp#7W*^%1!guI zi13rREvVt|)tR%pe0BIovQueX(SA`s>KX6DQupH#NMEG}ixsdvZ9c~%2VZ&{`&}k2ZT=Y(PuWD7%HGZ(+_-H&Hsme0| zHY_+YO5sY;-T-0lr~J|m+6m_V)RiGi!tg_3OBc%&Ne#Z1pZsz#xl;%R#c^4%VZ?sQ zqhopXmUcuw#RFWAk=e+1pM?D67pQ1SJG$wnF*x4(rU|zu5%rOL(_jPbDwF6(bqoZb z2i8kmPg$ zUKh|X5YBtxQLSiPi4x{quZstD#PXUX$<*fz-Kv0b#>*IBk+sa8q{LSa-fmUo?=`en zU}y(|xJ!3Z!a=>hKcFZT|J#7EyU8tOlc`h6uMW^&HC=x(dxVe#HwR<|q`nnE;_B5f z1=jTV5zA6eLE2pS-(TvpTMtMe{9Rz%FsDk)cUJxvwUSbRW{ddq2J#ge*P@w(WV{Uj02nc~j3*mmq73-%GMkC5rK6(1HB}TFR_kbk-5d z9K3*bQs+!OMAu3UUvoJ!kl0Cv2Nrpw>#Wh}e#47#k#x&b={cn^qjO|w9w1?%Ht&<+ zv!P%}t*Wt(oiwFY%@tmU{qcsS2?Rp++o9};C z9@7JFII{cchNB8&Eo-j2U;2HeX#ra0Ql!+llh%o*9VcwQP@<~%P&?-$khXjvQ(5!> z36Bw6PnEkHEZ7MpA{Vm9t+A9Kb~xWuc36^hu}Mm5TaY3q z=D0{Vk}h>*KXD22HNo$>X9EHG@zke?e3QBmE;mqR0)4U>x%=qO-&heGIn$li`hg(7 zRvU`m?AW=InX;Y(Z{0%$x0CFVzgY*IP z8mHbb+6hQ|F#BATCX4v8^&M8xc>5^v@`|8!t7zF3j}kWD@o5YW9BmoEk8QrQj!;;B zh!Q_fy>q5yb&1OF3*Mytig)JJf+heLzpbzUz5gMfJU-^pML*gU+#FY4{iKaG_1LvD zmMIGEFEi%Uop3hb$sI5d`KSDpn^2o+TKX=Z@UuIc)@=}Ox=ENDTZVSDv7td><^X00Gu^Bj?P)dh@o&q372u;I*LB5*pHL53a{ z4~k;&n9y)4ZY63dte(I!kGJ5s0Bpk5l=v)sWPKi-?pXIhpOEX_ylU{)j_ z1QS|!x8#_pglrtp?eV`RVxwyQm* z1if3+x1gCdz6MNxO}BQeR5xh58` z)D&9R=y6G08qSx$X#Q9kyRhN{bwF`dGV;_vLT44LJEN+F5MMyS_r-f#XBP%BS3ePM zsJtZwCn;{0TQp78&u) z%!R}@j{&-geqOoMjvha@;a&0ggSR!hna*9BU5{`#0nO%d_Z-{opy2aySfD;iDD}jz3w(ldY=pwC1ThY} znVOcu4&g@Rc04VnUY?16v&^y4Q#5897oCe3P=FR6g$I-Jy;KDyL zo|5v{{N^X%khh{bTLhb`8tzU}+t;i3*VH-0B2Z5idd2i?D4()*_}Hg=bFEk7g4FfU zLdtaHr3~Qhu$1qmrL^ppca8^L9b(VZYNf)3=~DglSb|?*dqG2BJ&s+|OIzIw@NyB9 z-V)xbBC~Z*tQiZ9!6K%hIBeg0x1@Zi*UQ?LeGN8YX$1JRgaLhuXXG@vp*hp&4HI!RmF$KZPgy&cAY6JPy8?ssSEwNRnK2cbqUYkuG-agP6ywT4c&(rewCVrMzAO}sTXtR4 zY}D&XUsKZgEldy*tw=CXAstkNVqS%w2k%i znr;B}S@@^+H!MqxC5% zuGPpay(@YuQp3TGcg`NOXFs{~22mcm2Ty*3*gs9GmIXX-r%zO9wr=O+bBis+PjP!d zn-Yz&LZdIVb?`*!cWQiBHqgM|B#dO2G#-%G^#GiMS485ph{Y)FTd;A~KJKy^AztE` z3qT{$msqG)aW}KeO|j?Rg@3+~ev@RxLJeJonQ;@LcVw z+mq2V4g*~`Q+`xG(B991N<+T7r$l$k5J~y#bF2sSD8b1jq4#=%epDMvL{h=qY9fn@ zTY<$g58pU?*L)~C@+jo5D~{iN8@yBcBdvl0G<}2fgBZaD@{dX&$Zd+lO)0*bMvuSC z$6JVXXr1lAPf<-heS8X6few6?Ewdcx)W`Gcird1_lq8_Wn*=I;+ESoxghxy5M9m9B z@Lp)&($Bs?m3<9BEz_Ju^CV}o@2<2Bl_X(R(lL})nQs!y8L{7^b#JBhM;?CaCF*dN+jERFA?OQ!vz$ic*;qwyBuPc4+kvbFl)KT1o; zcO7I1rC?rA&giZ%syEBi?@NIP9E!jjd*z(EjQmnao^5Da3RPhd(s%VxKP$hYpLaiy7XT zjrQ?~v8o=zT7qNj?8tDhq7$o!-%X_Tuk8I)0S5R3Z58JzMc3Wmd&B1f{OxL^I_*ju zH@~0RZCz477P`g6w(-gb--UIYC);KXutH|N!MFA{IhV($*HucGB;Pa>*W~-V#b+Jm z-AUo7)*}^Tb6!`JeD|cgM z%lXvCmQh^o*X%RN8)_s$TXZ^WE8SfXwz}nPqJEPPKqqMJrAHvTbiom3x1wCQ$3I|n z9GXWO6s=#OSE0GWAnM1$C|E~$rA}Wo;{Go@_Rzy(@nR`jyU%WIM|)K7g7TFe{h6C7 zDr!D#<^i*krNN2=j)|l37Z(@Vje|)Q+s@=+<28de^2quW`!PEbF500UXS}8!qp;)8 zVgJ*;l%1n{sdsn%<+A5^lkmv!(CIoE!jkn$WIu1bnpW3#*GrI5=pnt9_7I+lBH~;u z;}$jk#a7E8f0KKcZwZpNe&G7A%QQMW)vdw8E#-dlcH-4eVLQn1ldD~vEamSQ#_x08 z32$COcVI|j$+EtHs*moHNQWqi^9)2V+38<=Txdyg1k1UT+^7})(nrd;s`EqWF)0nb zUYG7ue#7bNq#O)FJgUq`GREDN|MH+{I9pQTjyvN`WkDldkJ7?s$$mSWd#l>b_Fs;D zl|>BUdScAF6s`Y2xo4bf5C{XoONLCIf6(CUP1l!fedYlSrM$HSy0{7;IYbm-KuPt? zNI=$~Y=#~(3M&ccX91)iL7l#9ext_e^!d-ASz9^6fB|XI8nn7-6M4sdb-Jh(E3i#j zhQS?v2oI@3|AeB~zbEXw@2*;nliN61FA@mzJNNzql@o{|*o8doUnRwB_d3esH05MS zk`r2gdaq}#T;<|U+j6>OldFT=!}J?3yPXlgR{DR>&a1Dhj{~k zad&a`E)UYuQo+b{pC#e#k8y(*2O_oE4=ym(8!26x7PO!!~uu7i+Ym7H>RKH*E>wx zi8>T-0U>A5`+12CYZRnzeXPW>eqBv|?nsJ9%0O*Cu$k2&A~VgYd06bie8!|{`jl+f z4^asEiL4m8MO&mH%pVC=ywsU~qpSXX|KpCRw7P!Ce{k zOcrG~uIjNK8hv%m04V3zqhRQ{zAGs^V*mQ2F~STs6}i1ae-e!}V0p;; z(9IZ-W`RDVE518Do7sxeYb}i5;+2LkoU8lD>`3#`YY`4tfE~)x>k|Wy_6g*wF0sw4 zQfklD(oe)N4l#+WkGbC2DSshi|uVg&DP%#?rqJ?qR1?@*29}SDuTh z>~AOpITi#6#KNTGf(FUcLuz#l@!I+Zana!;zJSs!G&H3y$3HBEz-lAFIqE`TMLX<% zIkURYbU$L$jnRYdsN7D#;0!F|NzPq_$vo(~Hq;vre;5HDhONc$O~=|Q?IIwnXR94p zpMjaPU3$D@K_-tvNuAi0i($c{vQA;y)Iv5YpzhuP{_3R*v=h@tzq3+kbOjE3D~xTe z(Xhe-KVV&m-ewc4w${H#;VRp*Y8TzTGp=m%+@|RQ+=^RioB+{V@1_ggOQ$uLDe1*- z=}nh}ce5=}2H5?MFnS|lvbGFP1~La~D%z)cc3kzST3^A_FlBFIqR2k{QZu^A?;SO8 zE7_w$xAGFT1eznr$H3o+m*>sA%)ilEl#l6Tw~`;SAp?SNQzGiliJst~B|i~m6TGX0 zb^4EW1TWtwkA2V1omjJ7JpF0ZF>_Iy+i4#~_C*H0e1Uqb9N2FVaH3psEB~DQbh5`^ zpK3>#W$CCZ)~1fRgM~lu)YRf!0-tJMG+XNMRvcayOfoTJ_o((Qk5wx zYG$~l5veuK{jJ{?TF7T;%=>ICaI~z*Xta5j<&n?$5GYFpNR#D2gdmWdXz_J$__kPt zTXW#7ZF<1>#YkwAb%*KS3%qySmFL_6CesR9Fyy@k04nl`D3Ov|KRF3}=lkuwzKh2F zA{I(b?YPH13Kku~Lg|}!ww`ZS88r6i!ts%O3i6^n{)A?BWG1@k$)(61Qe^Rc_bIf4ZQ}2rr_C^A+N@6yiYa>Tk-?&qz4RpDO+TC~l$N5;weAsC4 z8kdc6to84o{in@l*n?tAxkjVA;1#=jbFeqo{mSrS&uCX|g*|}(KRu~+5s0_nhgSa8KeN z=Yp$$^eZ{YYv{k+_LE;#PyVY4JU?SB-Y#o=RN;R-wag#OYH}XCTd~h>ff14We}!e+ z%KyvFGl;(+{;w0QK~1tFC|P0~jlKj1aBbh8`YitaRt4`Lb6p31Z{pcAQz2Vn$9(;z zp$lWtzcUP%li2heW!)2nX$P0KAHA$jK?{&JzbS@S$Qb+9qJ%x8u*&7BN@L=3o_k(K zjEp$v<=Eioria=xXv43(!2T;1GI?stwB2C~?3n+b7cD%Ny?sLOj;woQ^t}9X_rL3@ zGhyFOV87r%g5l{85uy}jyt3Qzb~SN%*Fn*NfBTUQsrq|J0ug6A-!c6qA_C1XHb%5J zh@t^>M^k>IOSzyPmPkLEa^QcOImk%-Gdy*s_Q$B?96!yZA9#RB6}c-YZ-gI49t z^dK+)p#Gcw9tpU8+Z3zBSq~4*C|<*fRB`P^T?@2@_H+&K3TL6o<{SITfxY zAnLhA(=}bDnxgQVPPK!ZVIUILlxf)YS?3-L9k!@sB|Iz|tQ-!F`khi)sJlxGwA3(7 zOOpCR#S;gZ9-{JH15+8XT>^B9n-lG*~8);*gR~S&mWl zi7sc2XT?Cu#cJSuk%_zFPX$B)wmlm4JA1QI=-)W^kywrZ3&#h;SbKCo;le&I4%LUG z-sMRQNO~z)zjJ(tU09Z+fg?K+Xvd)^IUa~FOw;r`mPyk|?pATK4H>;&!sZBM+~O$^ zwoZMi;|eDlz~Fl&+EgNIzG+ocAjllct+SAcRK_iPh>qh3+Lm9up$k@wUlQ%QjbAKg zdPFSlf^cotIq~Dkb^1s)LXs#_HW5ycI^1|1^g-kgf!k}?e~l>9u3%Io`@n=jWvAK9 zd%TU{ z`I{^m(D=&3-T3h!8RlvJ45ap{{Bm~hq>LqrRktvtC8?8RMBog<6Axl^On*~Ee@)*e z5fVo`N4Rqv+Q?l?+}t5MX5A^#f)goicqH*Z{18jxWP0m@b!YvRz20Yr`CjAt<12+L z5o=3~-hVcc-4Wufp2dF1P2o3n;lW2*#wcM0wyjL8Jep4bxx_qBWtH%sIn>9y z$3ACmgTbFwnmHWVzR0<`uT*y9I#%?SZibPokgGqKXW1q2%nR$QbSgPx~ z@8@~$=YHPfIo{)V|LHg~=Xw6N@AvcFzrPh8>cktkpjqn(U7#z4u182+AeZa_Py)8y zU2b(a&SMyLZHiOQO*1I!wPXj;I?~ZaxJ$oB=MKxYHgTt1ACu$06T19!VuSv&Zns7& z8Ebiw+&_{offVuc?NMc5OcV!laoh1XDvh=2#( z>u}bSBaNL5W>kme*kmZ~g}GN>YpWcWCb=&s2cSvIr8f|k5n1_EHh?W{A%fnCLmW?s zpqIvGb=()mpu#j3mb0=tK2}lpEZ6Pwc_wKtCFekivbf{hMvrV89nRgB5d9s9s97xt zOKYC2At=nyX<@`scy_Y}aT0Ey&Z(tTbEr6uEBDDmyQ#u{;dZ8E@r*h4d^m=oD{L3R zsYKav$09h^8RF&{AReaF2E>duzM@6^K#R1NsgbIH&e2S2wTn1H>t(}d`69RWA2r17D)^%-62kw3M)EDilU}WC z?l;NoW+QH&Nro=BV2Xs=4omJkyDomXB8a*XnzYV0OUW~Xya4o=@4mSK8eEaVbNyl>NL^A#2Sg|Xv@ws zY+@byJhN4lYs`E$5ffoPhr;b?Re%I1B-!?~{6-TX81ee@yhWxYV?mQ0&$&-1TiiHW zp}P3yXM_#o83l9EqZ`HbX2u_}cu0%b46G?2TRR{u<0B^t5TJ=FH~Ym--%{q{?sI={ zh^Ok=zj%b1X~4bs{&*2B8#M;NmafCY)BO%Ui?Xuc@;tsGccC}XcJM)-C<8bE)syl{ z@eQH6)P)6$E|l*#u7}>20d(GPiH(k3UU{JX3{W`&AmtnSD^CK0y7smAfW$Y3I#UTP(rE}5M_Q)XbcD@UZHfr zum9}p0)(wRooDMtustbYd!hlg|7EyB6H98sZD+_gb9)z9QYlb*=Fjk78_VM4-##ss zjtv8Qz|+o_CaK^BykXtIFYuqNq@%u+X@!fS*Ylf6?BslR&Z;=%{_y<#a>Sd z&xsfYwb3^n1b<;x{qHBVZb^Jt3_2FH+Cd^G_tB1EuClUl@>1EP#V!#9L;sOIniF-E za!sx!|EpPQrv5kZh4C^>hyJF8m?bzE`Svp*Jzrl6L`&anJ1!jTL3cnJoBdh&OHXFj zbPj;?5>$EoW&*DLNw-)}2(A^g54*1&-m=kl8LUNlynTI)_V_}ai9TEb)^ZiBrKyyI zRgR*cqI{_)%0$gJ6HM^#4P$jL`X^>Jfs&mCOxne>C#kf^+gRgkYbPGkoNhX4h$CG4 z`rjvxt_9k&R6B_c6~u$UU;%n8ZhoTxjjx5=KRlB5IY8NO{WAeWAo~-Q&oj~wB-fD# zzO(~U$d`EI@6?O_&;-tKA9T1&B+cV^&_Y5HvLhh9dmcW1;2zI)rCas@^X5Myxc;l- zt02^s_N9wTdLKoPaEe;x_G$7AmBwF(n8Fih9#32Z? z4uBO%Mdbzp8iG!tqgB+h7aVgN_<6V)0|%3jx7{>#^M^GmZ$PAbO+{lthrV+kq=&nH z9?ydPY13bS@?^@aCTz{o<0H$U^2_yK)gneN6L4QG!O+XU4-GMY&OIwuTTaJtf*?O@ zVqDq-f$Hm5Cdbxg6t%V!+t!k*2*u(wld6|V`ifEjI4UbU%SpT1wU!7&jrz0-lJZ@r zGtMgzzpa8BUD>+h>DVfA5#s5wC%{_U8r7)b(*#iUhkelCj^|7#-WLk#%D!80)6aER zozD@~C{eEa=^X4aqG04HfloCGQT@SZqB4CfF2e;s#Itu_mUu!YH4B^i(tQY`;!(g? zpReFubhM=sv%jCk{`5z!4|X7m9B7#{g!+6s51y?6gXN#;C^wO7C(bQWF+?zB!M4#B zv(Kq>hEm%Q6UBF73BTI7Bij`;Ni#H$rIDlGCp~PkmsfSMq(k@Jde9YGS<; z`Q0m$zmsIMJHBZm2s2|d&U#uR(K7Z3v$+O?7ovkcD1Sf;Ez@ZH3pz9p7DAYA^tiOS z&`FTsWRBY;TZ1xNQ+jOmJyn75Wrw$&4}#rb8N4aKwxTuEd>>!u@u?g^!p1Yyu6A*) z--xs1whI-S=Wg=Dtj;E)r<45A5lawZZ~iNgUH)PpRHLVc9NC6(o_M4{bPYe*?Wnmq zKG?4}-xoP+24UpOSZH=V7TbOVjE_NSki84NUn^fwsc$sPN8a6DVePJox~xLliolFE zyi&|+P-zLk-yq-9y8ez^pOa)+;g%QEY4RJ<<>Tiv4du1oO1gQFa#IH!oESjws}p0a2TE&kD_yNrxN|fBAVYkj{YjX43suz!deq^G!z( z0IWPcJ~QlNVc@esev>%=T`qS>`^t^108D)2`!u@mNI;ARh6%M#(3hMw0YeG)bh00t zj9H$FC*(rL;6NFP1Me8w9%cn(OMbdde5{KPN1+*brF~4U2NFNnA^A}YN zXfPP;_@)K0KzHGG{#B#+8IZG+OPMX)GZ$+}KcRHo+hHXSC|IMhN6179DkvFK00>xQ_bf+i(m zJ8aRQ^#Crd6o~Fmjt=PM>zMtmorqz}U=jc*WeTM!lMhx7^#l?r1#jQBDu{yKv^!F2 zeA33b;Y+sSuL#|pv|Bqi!b0h_bIH~zuZ0bSeg_lZdis|9Xv4g(hH*r7XUlN>o2xQf zt5qH|4*Jr+JiB96;LK+RHVd(RUai2M<_GPf+@3hv?f2t1lbpSlSu|d`rOcl%STSAD zY%GUpxBd|Qy}spCf94#@qIcFP_eDRocHHh&bir`GjHQBwMEKy#eqYN-%64OVPGeL4 zXXmFA-HdX5&jxC9ws>;ZMe*d=k;MPClBCzB7 z*bN8EUs-2@(@_Q^m{7c1>Rqu9-f|nxxDV*uJ-B*@>f2w~=PtM4_mKm>Hf}-K z71(}tX8pdRPMw0gzwWgBb^qdLSRMFDN%x(urp?)HAx2Yi7hZ(E#T^tljTxn$zSAI? zNi#?b-H!EQ5H34 z%6fmc`G${4cFtn=9o|fb?x?Unuh2l(wQ`+c7ZTjF2{x(x9BvtU z(fNKiO3&RAX(l5~00p{HplXMQA z3rYM7rp2Aypu~p0Y8bhL7xrE>+yK7l`0sX@Z8~i!lc;!%7wld%sK9)l2%c)3Ob#wK zzGUrkE*qdeJ)3lCb9V1anD)HM2x#%*!Oa&N(v@dT&-#Bj)D#b@BIy&gc7$oYZ8Qp|=ut6ay& z_#0|48xY+~i^hye@YnM%LLbX?+9f^TK-xKjKj+(DosAv_i@OAD$>WxVRm*riaAbVv zH&HM7{&5HYm%8}WhNUz7`+RilaNaZ>_Aghk_YpX!6x{u**aj*$xf(>MoA&$CON*&h zoI5!B4%^Ju!pOE*`-xk-Zf^knpa!&JmX%GM;Q)s%GEIQMqorTsGAQo@zECQwvyQ5( zKZ`b`v<#up!uowRpud=#h|^wb*1#)IoMsJ^$;{A@v|R&2G+`FpS(1I7cXOtLd!5GA zw9<26A^o(DABbVAFI`qRn}3E&7Y`$z0Bsf-_r+csMp|ZFjI3j3wE9r=Y6#Zbk7pVr zoVV+bK|5`BNGEc)*CUKDVUK{DIY)pHBA&h6z|l7(ddp-cYK<7_JS% z6RR`OM^qF9O0(y#DO+lD0#G*@DtWLiXxh7~jEOop96dXjzCj>&#!bn6yZ+aRHH5TOpJ#k_UUbf|31!ua%aVXeG|P_M{toCrF_BU3 zqZES%E!3P4^2G8RV1tL(>+Ra{Dfo-x%(H9dC&QVni^^CJDgpJ_+wT z^vWOk__*Hza~Xg+Ke6AcdMh0g2+jRW&dYv@{E`jSr=OXcCs{yY^W;zP@XtS64Y1_Y zMY1{UCV)D~qcppX_b@PCf#t6E6ShKsT68=uJoXbj^27*eX!iq}E>8WsUU+}V0yqJ` zD}CXw^Z!HDlI{SakDpuo=p3K$+CCPi=~k^hy48nU0@>8&^IoYnh|pR-vLB+3l6BHu zC|O$&^t+nTWR4d(ozJl{d$3|g6n0zZmhz&$x00X@4nIQ3tz(4*P+4!&PxBOHIlM-| zYQhy|vYPR#6Ji!pdjm*`c3rD-RiapVhi<5)xI(7x7L33|&H5p&(U`Vt+~etHD{TjB zI%U)UJS>i|E2nDqEHmw$G_?pRLV1L-t;W*{~~vNGeVIrwo%aobrR zn`A$?&yvLUR5M1ZKwJ|+`8HWmY_=g);o1(DVD@sDmG*ng(eH`_SSKW;r_IiasTQm< zduEw^@kwWz;TnPm_f($xGl5oRb(NJ=KepFQ@J-+j4CU!Kp#%nFUrY`Om}n{y8( zvNgyq(MqP_qE)R{_qSN?mc59f3;FO^(Hb>KWZtWEWN;&D%MWL8YCAe`5yOIkyN= zP1wMFrg9hkGRlL?2aMUS)4mmm0YExz$YE5(bLcFG;k^M79!D)wBJ8Eg0tEu|Pi(;= zSpypgh62IB)wmKix#(eB4)fl#;M?SVZr;@jyWI)-Pl}kJMJu5Y_7&uzL4OiKEJG-C zc0))s|K32*)Y03TydS|oi$a7q{O#gfp(_Ubz=+VWFaH~_AzQ4_59u>eSKa~uS1>Cp z#S#D+it04XS=`sGn-ZRLgh42A*B+)q=d6a6Jchg!roct`QD5{Lx++}wjo4bi1QUgI z=+;9GD664=B2mC@C=;xxeZ3e#%illQd;LDCQmBZ+Y0C8Hq0SrKe){#mM0#G|bC+lv zV22rZoK#Y9LKVm6YzWW3Ydjc=*tbj_p>WNsrDKW}E=W<=#o3xRD}>J!!}hoiH73&9 zUF(8R(itSnkq83V>481%Y8_dueK43VP@>&U2^@_2O-UJzM{%y)I^5uA+E2RD*fhgEP}_uMcNu#b$2hiAl|o_zw6o*yT$AI2v3^ zjf?3i%TubO9*ycHqsgj|W)V<3S*Oh!$PLlM7zn-!GR02|4AmI-k z)h#?jCG&#vg(1}0h4T)z6sQR;uISsLs#9{BHo zPPi~Ow6zQB<2!p5o==TDLKJS%GTE{-kaB&F< z$Pst^ebHERf#$GfsxU;+Vx`J8PKE3}kVpM`RIc{M#aCv@nzRJaWtMOcy?61!v;udE zK4_;4JdS7P&j%U4n2%Ji>>RpxUbb9oZ5mPU`rFHegXB}s- zE>3nYP@mj)U5$D3>cw6%8EcdsA*uJAu1(z9 zRjRU{k)tU;=JJ`TNiF6oGY(zpo73UaW>3Y|$jjc6r1{39dk*@)b8i@qg~4P&IMt)I zCOx-Q-^f8YmSb)IjK6L7ZQ3c}^M_Fiu?ggGOx$ww!gQY)N~Pv>D`^}SCFo@xJ))A$=vPjhe}`HL)Rw2l~XIiIFx+ z?1*>!$zz!3z1ebz(w{-Tyq%=%(-Tb@rrB^ zj@=mGrp7EKFkd>h@Dm5DmBvP8+@hFW%7p0_(GV>y$=z$3Z){(Iq16OyxnB(;r-h!N zTbs3c+U%q@hwjm+ByJ@1pgm!9yE&vW0p z_O(B7_vcR?w^mSZ>BIG&sMF+Y<1cAkk+cQ=u|l|0Pnh`G$8$$9(W7Hs)o`02nRQ=6 zKC11)^Vw~`1mB6FD6b<3pNb741(BUlx_3u+*{ZQ_Mt4?y^AJ~S#=a;k=e~Xyl=WiG zjk*}^#0*N}Aw$;FLvN8I5en;+nl6LvSJYwQMxUbd=W0zbvUPrgo<7mH_(_2 zeBL_!h1J-9zD)qf$av{3hpfUpv3rF4NGM7lU1{B8JDHe+4hLP23!;?<1-1k+*sHP!}3$)WtMn{2Fy`%Ia1*Inzdz`Yfn>^)$yJv*RgjA62I*c!u&3K z+1^=Ewe9Hd6-er#{qYRH6g4a^&3*8YF1(Ta&K#R!E?KMJYL@-LFYBplNCw5*OvOAn z=Xyc>mztsO?a#xCf2k$0+(0*v5dF%I;Lzt04mMp%?b2=bpDon_JW_0Nhb1aIJQ!pgyNMx7Xpi3}q#yObR2 z?ryw7@AXx>Juknk}_oaWg1}H#dL=%Fh0zYg=8%=DywP=G1t} zlbr_M#Mq~YDF!s9fWC<@RKLV*Bm0wZ_Z_u4Z!R`@49|u#W!P_HlSi@Hq{w>G6&`3& z8_{n&6Q(Cl?XAjEmS#A+lN@UDZnP0Cw3B0Nev6@_#MGo`*?U1(l|p(x#W)e&lk~ys ziOUag9;ASI6MJ7o*t(+DIBBpe>1@Lad`$Y(Bf;g~T*;`svZzucP$za zw^PnW!i_d<(Xp`#Qq^l4%1XVd_eO%<)Fs1$mf@<;(pLJ;KqQAJ6eV`)`oHY5nMWni$KJ)P6MDC8>GIT%oVhW{3O ztR~Sik~3Kn(=Ui-X$vaSd|dEfw8H;w?LNu@&kh0#9_MRXsQt)niAMAgfsM}OCypx- zm4K59QsrOfB(5SyjpXiAb02zw%Wlz+^^yh^UGP53Wk7-D+4|r!P@=`u6q*9}nx^lI zRrUE+pl_F$PiIbvYmUs+!3(Kr1=UF9UXYX|PL7%ZO5#o^6@37iRO-P=6V4}w;`-5n z3Fo6#KicJ=k5TtJ8dbXv$F#>WNB@kLRBa?Tirb<&@!K7WabF|E%_&v|@K`%^W*)dK zqr^jS%Hq3??~s-|xNd4{Y+rFyv?gY@zFEZNs`GS;y@pHyYq&taMs+vB05rD%`Q5Yv z=fNl>&=X;@kiTP6xygzJ0x+I9;#lg4ZQTo1%vw3PXfs$(wMeFSPR6U8N)KXJA}D_#jta-E z$VegPaAp+z^C7g}e@`QD68`svn9Bl5WF}ta7Rc+VS(_PteElF$< zh5oeQQ5emZe+}`OJeL)m4yfCeow1w|9xD&eeLQ7dNwu*dfB#M6cfZ z+~pcG(O#a8Wsf!BCQD*-QH~1v(~rxEoGyKH3?1AEB1CSipp@wND~hhXpxrEVf^Z?A z@>Ey0^|Nyc%YRF-as&;EsVM6>V8=A1Sq|NDz!;N7MI_ZgQ+$x!GNV(OXDn>{=LOFL(S$zvN1m03j z09R;L63}?5_se0;(5(&-9WmQ=gJ4rl>F{vOfKBXCwkv$fRlZ%P=v!HkFma|awC1t< zuPyOT&wz8WoDjP^(Bt*Z8z*10l$A`k;B;k6Gg0_dg4}Gj8=gTP#1TC;(`U=|A1#9= zA77viG_wMA6DK({YZDl%IaA&snKxpP!2M9iEo2dx`o!so1ny7)T=mIp+opYh%)F!W zdwr3Y;qAXOJe)9a3Y-6VBVjh7H1o<_a8l=|RdzYWf)RJ z!NV;BAws`}ixIQIK4vU^3+qFJzP$p5AqHU+)GP+rh~NoNZr2L=_88||2q0oRk-%==NAz^=jwE9T9z|0X#7KWID}fi^QxrddG(T_O+M!UP%AWLY$w>@;Oi zdV&xUS_5(`e1WIEukr@BL;<)Tv>QhrB}49d;54nxh_H0_i@h%n49w||eREZD;7f^v z5_vj{UsB_xY28Kv6L|gKRr98?5pen*SI8PJ;5Mjv`_-eZo3n@Iu$$x4*hL|kaD$35@+^zj*;fD;5_WJzv zZ^r#8QH#IW=f)iNtM1mphCq%847T0{&h>L?S$Eq+iMRSJcp^0d1edcxpSyD-wd3O|U63<8bq$pN*e7eW zvimjrN^!IqL8S)xRQ4Y&K#CPhdF)a{M3DeDMcAfAD_S0$%)5?K8165{W~a4A(Duj% zEia;+4iy5In{6J3FS)!vG`_&ixDSuKq0AXG!(wAp8yT-fqX)6RbM+BKm)R=)Sk)&G z%*&4%*os_6;+tv^$5RLJG;q7)gM(Lf)FuKZ_rJ;%%w(*W7`S=$E-g25;r#~sWG~5nA{d5U)(dAj+-_x zv1FazfGAgXXW-xZS+m8!?=L8ePaAWA#hKdKRWckEf{rI);U;^tYo?lv1=VvTXd$MFpx(H;MT{_PM3{Yl^!5l z{^3gKLaQIdA0vq{p%uf_s#$@$BRZSwCxBj0k>Xmxn3eHsg-%@xnHVqCN>s5qZzsp;a@1v zO7l|&T!z2a#p(V*bGagFKFGmRKP0S^oJmIM*iFqPpfiIMie$qElO)u9#uGIE ztxJT#XuB76SyzR;gRH?Lb<-w6?4H4d%!uOIU{2Ffw;2L(Oe1+v4pc$(l%(d@GWs^r zLQn$KV`O3o%^TWyF+m2y(ibURcWL+%!+)Q zx&r1A(Jt02k>@loyCP(vnoI$LP_8D-%JW0f#odL?z`(#UmIm&M zw$AwY@SEk~^E+0CshT%{_ChC(9&G0$ z7vF~^70ANUCK!th-Wdy_R z>B@=q85+GeqWLsVCmj4=Sf7ei9=3u*SF3^Kj@yeuK@CUZ@1Rr>CyL5Jf|Yn*h9Rh) zJ_5|x&dTRd`c->CC%9rwGK#%|yAfP*x};2rsC0C3G&z5I0>_HJB;hHfpfs0q3YozU z4iZ4S(OATDlO4DM7AqKq*@y0H94sgB?7TD%9Wg1FHut23;ucrt&Ew#jn!4EjHMSPn z!xo(`pE#S3In< z?38uG2cJxP>zlbQZ}$*C3}$w)-ST_bJn@;iM=*<(jZ%-n^z*}yH8SoVxT1X*`TV{9 zZ7HkjoSZJPrrj+`D7&ZL_|&_xn+iN25%mjHvgQr^HX2i3c8`K;u28#B4Mw+?8O4yd zyiKc$IH3xX!x)*I!^stnP9U#TEaW7Zc)VDD7#l@z1f@{=FSQnt|^{;s?An=4JryjS0g|RXLq(-Yc0_Ckwt&Iw=ZMF zr(X>`DMjL@dScp%d-8!eCi8;S&<8s}`O{-z*5+(osS!WB4Tw8*NJ%-j95@#t`Tl_) zbH6R_@lz@j2`z0kUK~dop7G1 zI3n*^%G8L6?W!Eqh;61`X!L;Qls#}~YRy#VqYk$Qz0_sdpM9;+BjR2KUS!qxpmRo6 z9hRBdnwryTnyfA1^=JBLkWe|l^+j{{#lZAqv30#pKA&>uG(Plh&enr=P0ssk(H`L# z%6smJG`luQIK{L57f(vxrzVw(iX42!oZ9evEoU2iE%^z(N6b32h>x5>9}qJi)Q*JL z4ZBJz#)Dr|`Yl;ES4aF$#(we7U~vD(RIXIIDTjD}?SfAd@;4R0XO4S(sxYxrxK%;j@33#l zXF}Wqv&w{a0^~sam(_%SB?IvPfA)WGZ=>4JIAKXFNX5MW8tRz?jHJ9rK1-c)c=y6X z37@Jex5md? zCc1VQCn|#k_Mxi^pk2?x#G}$0%N2QV5OlIn=n*gVdtY3dP@7wvL_i|+MvhUEki+a# zRZk>X(`-95@5{Frr>5TfxPAkFv{^=2V4&Ulcc3hf{-H`z))J)~_sQKX zu5GJL-URyA;ev{f4czXEeCWJNmP02CO}%T-c*Ad?oFyi`JS8Ulc1G|kR1Fo#;59PG6DsXvx_k=~3*ppXHS)!mz56B%}22lmHxudo+!n>Jdbu~C2 z8M!X|()^51o9OlDyxRLQ0OewruS#(~?(r&TZBkCpvdhg!c9}9$Is6;I5y9l3mJ!JO zOTy)0sUfAtFVwxhu#t02)HiSvU|((Ann3QfevOhif>HOh*WGzosw6&rn+z@LuZx*Y zNYaC!8s7LM-gIHhOa>>!be7wDIZb4M#6B@ZRGJVp;+pk{1NV97o^VyU{jTC>-!q#L zo6>XQ=8yToyY?BSI|hAcuRkS%OLc?%kcT=Z4Q$1&Bz^GL|1xS~1fQ@T|8v8Kdj4^V z^E4FvE?k4C{88{&>^`GNX{5# zM?xeFkP4|T)@trI{$0hNh{y~15R=A6aWAK literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/intune-add-uwp-apps.png b/windows/keep-secure/images/intune-add-uwp-apps.png new file mode 100644 index 0000000000000000000000000000000000000000..933cd9addf285b444cdd81517e3318b9f74fd7b5 GIT binary patch literal 33779 zcmc$`d0dj|_do1Ri|sViROUuaQ&v`H=DslIOtz^_mP_Uqsi`ckxB``>GgE3!sU<2o zrDiVR1}X}prj(|X8^|q^l9D2#BA_7fqh&td@9+8jp4anwUax2QLws>@-{(Hpd0%I{ zu5<1`&bc~oT&KHEOG|6xsgu8)*V0-+($f0&pEavBBPG(ASz4yp zX}+(GIO!d&rM0Q`)898+_np438PtjS)hosw85|QA7!{-y5g3YyIgAL3*?H{nk;B$7 zGmNX2R!ZclUmP#Q`w5kBqTP@$I39INNK}p#u=3*+!Mi8gJEk)%TE7!W676zrDO)V! z+dw*R+OGc$>i+elMauB;?-|=T$G2}je*E~i{jZMO)edZjt^7tu7EpT>I#l2#^uM;U zwJ_bh+CCu39`0o~OQ?A8xMV)>fsuHk+54h*tcdTl98)tt`r-8h@2n-^3q%2ny|3uu z`P2I~AAGMCsb~vsJC-l|I&!+S=0JHaueLl`ODa^!)M;wib{K6s$bT;0wO!(* z95Ye2(XrE+>N!pmWZqfz`+w#wt3NKaeH@@itx`H+KZ1nEL*ekxg|0!#@k_)Nei`F6;thQCog;BDrft?b_~0(6(HD_V&&qP8%_5r^^|>O4>;;1>7n zVrAruqu2dGUqga2Pd#6_v;zyOGslcTs0pD#%5!nHm1uI#SLkAGwie8}YJ~MCsGxA- zRzL9|r@#TB^|na&nDnd6shh=viWS z876;&v2=VAtX>Ql%5)H4t${70J(jc&%r#p>xd}o_bJH!aPgs}smCh!|9c>|PD2*$% z4vas?NtxNN{n*Ljm(11Kh|Af@(Mg>x7OCa#8#(0C=(Qwxy3*;v{hf^!6ay|5==!?A zZ1UGJP)1u|PPZ`!OE2O22JEkzEK4We)}1D%cWs-NJxmeqqOF3U@;!+h4+%K;uJ$`h zvzv_L=l5lm^-o@iC)qs?NMho*mH@+2J%ExNp0oOIj+^lv?GGxW9N&xJCzLe7-@Vig z?8z6&UU)Js(PdS3)vTw$^U$mQo5BmM^um1=n+J!5aOqy0VfUZcqx(UBl;^~RQ&7{ zpVjwANpKhY4|PP3`OvF582|0v^9xpC^kzMVP(JR(%s|4DuRJ==rWWm z$J9bSL4UhaLRVx#(CiiMN%!F_!YSe{k08%I`a*MwPZKx1cx%oMWqk}_|<@P&RN#}@k`$))#Y$Fb-&fT2rn!BeYh+|6Zy_7(5`d9?cJJKa?3Ib~b8{k?v}zmXJL z6+0wgKRwu$n6H=xznBi!JBe`U04{8>_O^2Au*rvP_(iy+F_cM8oV~|{Vw<(*`k8Z8 z6rXM+a(Q^+q9Imj@7;szL-@2&EkqA?@G3rw#C2H@VA~WHQ-_*4mL$phSof?^xTo)8 z!yJwdPlqhW-FO!Nq{99eZZOupj`7cVQk^KkXZ39&O}VO&+8J$UaiR)>=F;2x<6rGS zME5;<*u@hZWz9sxqzU=AbV+290|P0V(6WJ*O{zz3!V|jd6h871kIyQ&?+YBM>y%#S z>nx1Q)~AsZ9vN;VB_-TL0Q*+_BHSgnP~cuP+!&vz(v^m|5}P^JAHj>z>$zKW5k7VI zeiLvDQ-of`{e%{_yoMoolM9UG1^D=fBu~$HhyhAyQ@DC_skGoApTk02;yAQEs%4&D z!hF{M^U$pYPc>`76}`olj8LS*p9fk!uAB?-0Y%m6uD6cF?AX~MwT{EO$Kte()zL0_ zl~zFFM!d`g2!)<{aPYCa8^p{oe%^G)`jf)t5b zU#xuIt!JMhw90}P^DZd%9wcGipMsWK4yhCOR{DS;pF@g^ zgxTfVL?U|OwSUrbiOK{k_uvjMn%BL&e)le~&*6)UXME}e(W zZA8|Iv|-s-+J=?4n)Oe$NI}atAQ6H9g$Y)yRxD;Jt038MnYQ{p zco^-IL`K2}toxnTpl=G>%IA=h&oNp5h1(&|2U3K1xw~Si!=iR~|A;ya^L=s}zPG^L z;1FvQW)q~`T@l&<)ek;@VDMGwh@M%ojEL{ntxldvr zo_+q=I5+y-4%z=-G2l@4e?qPQS3=DHvj{e872t-I_k9+y=A+;H;x<_LYtK@reiLP{ ziBOXn1gvfGs5pP~kd_wFP-^0Gqx{m%1HgI4M z>su`?#gD8P7f%y4*@E;};>EIu0qeE2rtbuldF*f5rlrN&{{I_6YmK(F8{^A+uygL< zAv;OGyLawKO=*O}$8eutcLKG_I*L`t7FB z@yus|jQ`#u<>7LuwaOjy#(s%aOJ0_cWHZGA1@AUkc5w}@4Zn{zJDg-8N}Sn^i?i=L z)OGV?zXgCs@XZy6FyA&Svb~7**S?5e-;_0IoZ7b#Yk2eyGUmZQJDBN(<|~I2fV;^~ zd8ytl(kEZws7@prC^{@wzTNvQ_4?2%4wW5nX?=UQzz4Qvsv!iqm?6M z*vR~dU}me9)-a?@8?d;wiRRdSQ+V>9ybUBX^4dZYHb1$~m}OYovxk*>Zn57TIh0(S zgto&EHSJMoo57o9@~52nrB91wh9XH3l8&G%*0bb5U96~JKsMce@f3F!HL~cV1X|k_0S0HJ=OM)0KFG$$v~Rax2Ujs$%E{_ z4clmE2;(FBQitk$l9HiG&ur2H6z>EwiyKFl(Nl*+!U@AOdsv8e2TrO6&VSIFSlq+D z{L@7v9LqZRtAn&!&Z?0aT)$U>j&MboqGkfotd|mHuZcI#9a>UwDNAa_M*@nRu zVG0~TG;m|`-%j|dc3;%!+qO@NQeprLA4M*1oO+LAxH@3#eZygxhbCammf^-&;vtMh zzQ<*wnecqI?lBE!1sWwQb>Bo1T2{5aXI}VTCvyiZg{_*|2IH?9#OSZQtfl3O`+5x& z(tb#7z^n?uA^kzbI=lrx4A8h2>VRDL=JYk9!6c&|s03+g(TzUM{c4JEqk1M>_a~lZ zF8bOuUjmR@h!!Rs#B;-aWurE0Us3SiWv&JeFK#Qesoer3i<0_?hc(6^LjK8AlE7WoJ`M#*r(wJD6`6qTnwe%V44g;atB|a__4J z`YA;?!zII2`D~20?q1wIT_)hM#o^9Q-EXheG%4bu#rO09_=*_>=UJ~Zi_0qRI*#wd zaxD&0gjB;zU%9(VbV>1-+iZLg*tp^MNY2q)9Y`2Yu=&rvow>qj8TfgaaiygpjI4BH zBMuDtv-xa6+NG~PL`Xs@t{sPSb7JgUP_!>XiXyd0i}62l_pplLFPAK}f#l};gVb#> z!GC19v5>elgxtQbZ>JBn^7czrNE_OU8cs~_qu_VZY<*2u&Z010mZCGXgZ*AwmCcyv z|GD!bsOJ9@pOyHkMJk`FPT<)`Mhq5T_fmvU1!WWIaghlFpGRNagzH*7 zwDGXtkZG|Uka;a;TWloF0YF!o0MQ(Kn_6^3F*X19B-a{Cxop^Xo`M|4*Ru)+`l1r% zUQWo1UF{n&_h{Q5nOnqt*CAd>xD6eWDZ)#3FpVrcwXH*&XLrQ?t}5Y05lt`cOU};k zZ01YZNmDmWG9PSqplnh)culdGy(~reRP(lMgZYu1j22x{1(D&toM%mn;C@t*wnS_I z9cDQs_B$-1K;c!v*x9YXZJWjPnF2eaNLDys3ohQYZDi9}f!(7XG(N9Y5eh=Dah%lw z!N%K?<9#u!J1`q^#_24(x2^|4^jZ<4Pl=g13n*8-s+=(F^j-zD)FqJ_nNDdq+;F|R zGwA{`Kby)d9*IkHkd^4eO0qeYqh>^fF)PYW!^eqk7r`Ih?Y}B^9u=h&N3GzJqCbMV z>%dylps5pa;Yn*&r~SmL445>*vG<WcjYRa!HSMhJXp`k{tn_V>J}gf-R3xe^m2nCgXq(mHcb!>$R+ZZ!3i3(; zN3|7ZU68f|2Ixh`6K*G6SbXwWq7~KFc1>}kuA)-NcB#t8W1WVRUx`Seihk}7a%!r4 zJ$BS&gW-=I;0Q6iPw({we(y(uKc_bzmy(Nq$ zwl}Qny9P&5wYl{s>zhVj%dJlOEsg_N<5;%Uw;|gQFwhy`o6^{=an+vw#4;6}__^i61 zIr+X4J&xod;yboZDAhY#YM%tYdpFkR@B?UV1ql7oNvWuD*Gsw48M#s@>77ANvDbF7 z(Ldoq`E$zcOw7?ra)WD^5G6LIZ`nZL%rUZe`e2#CBeH3`6P!nWKLP%b)8sBijszW% z-VPsQjWnr8BS#{XTj5esN;1aAV)XLMr2*45jgcoI(F#FPmf!BWpgQz3an0Q6Td`x2 zA4DAKqt?HxWS&cYXX@Z^27DOH^f(rN`Oip~%v}a4rE{!q5Ht@4?uoXWA)>iyRnfx+ z?$zaN(b%QC3I@r*dOLrgzMIUGI390!g@}$pbB2HF1r^LXTByEZpMm_)rCmS!&7%=m zTVqxCk$g;js?r=62ac&Ko&9Dz+XcB!=<-BW*zDV=d{P0q{;=2Kti&9AN1D=PH|Rk* zXkS^&bxd@B6nmEAVmEWB+>bG=K_t@ni9`o=Wq4wnBs&PrKA4tgJEAOBQ>F5!U@ynhQnFdIk ziE&ivX#5~^Jwlfo1C$B^DNm=H%{Xae`nSe8jlxB#Al2cPq%-AvSFT=9~6oP`p%UzrI90wBMZj%+v`k${XK38XD91C zNCTOH0GShc%Yq`A5JDgsY{_<@hoDq774i4fH-?ej=s&IzNB|=Z%sCP|^MFPleF1tz zQ)M;pZm$q0*lUP1&6u>VaLLJ48bS4>TL3+Q*rm8*XTEDD1rqYQVY2y6(D*`M%fp8V#=CvRygX65TKU#7bd=Q*xc3_+OBt2=v3b1_zc`3)DBeK zNbE}s@G6*zM)>#Xol0zbHEt<=Vpk9YnXIn%FJuQP>x+e(eu8ekCGB-6rkjnZ{c2QC zO!{~iNVrP94kGGlXNQHplO3Ub?parHN9_;thlbA2NtxpfrxBeg8UzJT@II4|j{OxI z2IXeDC@<&m|1Pan<}c`w!k}K^&}p5&V(A?+3#L;IzMT8oirddDW{(Hr>jdOs|HS-f zed$-RATHpftE!Q)FJW(5tb{gOTlK-IC;*vJJUXB+T}%@38YDS4Jqj@tBU{gHA|hmq)?~FL6@mA@6`pcu?0^GaC|F^0ZRX_M zT^X&9^MQxxrMjfM44%mh_0=tyCA2l*R->z?RT8~!C}Cl>!nv_dRM^R@2fy{Jc6z@c2aWQ z&vr855MwS+X$gHi9c{VIXPnv_>Bd~&8Jj}nHsG6q9qoMQc`9sBm{X)Ut+;S;x@4N) zKR0tXFXuf;0qPVGAdqpL4R!o*+sfVizzap-(fBUG9)mkpXt4tuQ^J4#!%dEaByzDW zGyzm;D4x|V-s%5FV zw=kz0)-o@CHkB)ZrPbh{eJ0Z`EZx|ONSxFTlRFx+!yI)hy*wyw7CBq2-aRJy z?Li&hfVb#X!aHhyBG7vXl~~#4^^9;PW!zVAQ9ZKk_$pj^+9U=Ji!=6coc#BhP+9 z_Cf|a(f5r(PIdZQLY3*Oj;E|(Cd#a5NqjoqfV{DzCz1l^@)zPy7lMYW5wt43l<|;* z`kr601wtYHicZLfR_!RX_dO(ztJAqO=~B3?m01lM|8CNu4f~A^ZFEo9U({^66*Y7I zMsXGbta8$uj69p}Nx_r4Im=brnPVruee0piQ)&6iuXY^J-nL+@F_~T4ROInovl7v$6j9XVFq6aTu&VgqX z(25~K8zFYI33ZlJ{kMO2HDZLdWWtHD-ynayK+q>wgO(Z-fFX>rAWi1Fr0VP-T1jj1 zqY_q9Q|Rs?i+vFA@pfry*8%3~cYb^I`(DmhE6cgNq4^nIA9S{&H!4m8APtK?HMS+b zMV$3~qFqVkaPQ>vVXTXd;b@}^a7J-|hCB_WaUbKGeJB>WvBeM{O|~SeV5z6-E%-Ia z5`EfRgiY|csi*@nhBj|dS1enl@qcRS$)s@IhJ$PUea0J3Zj<~Od96sn&Tu-qZM^OR zhyL=>!%i72+U~XBOC&QcqQLhESJiX`g-^-xW`>i?J0Uco4qwzFx8Bq%wu=Rw0)AI8 zI-cs>iQbk`qM%@i8;!_zql&-$elMKA6MVLQbEl<+Vkc|HZ7~4X=s10`-t^F-R^C*& zYE(tk*uZ+n9%bG^WaXLRU>g1H@I%qN?)c8%xICk=M|kZ~b^)9DPF_7Lj;&gOq2k$m z?FdM_9YslrB62WKNb1LnZ7W|#K-rv}Tx{5}5Xeno;Tn=6`c2wM5h&gry%m;}l<;$& z(%SNH-h)NZ3b#YQtRu-TM=K3gX1kj32web*wy03dktYyaK&5Zb`O~1m!QRNKk>iZyVkp0LGdGYx4{he;_x`QV%v&vskr9wwVBqd zVw;Vn&6_pBol6kJAGZTmb41?{g+4rCmic)<@XVVUfF@W4%=77!0=oqgic9r4KF)G` ztU$t?yj-xUb|$Qj>-iUJM5N~G%(GiQ^ZG{uN)cBP0IY8F^_o7gx?QOaRCh16pbj*3 zycd+b60iBZeR}KQpwicfHMjz*hjQ8sUjYT%;h3gxEFku-R5aYLWLI6zYG7wm#y3{^ zJ+hoz!%_a`Sx;Q@1G-FaV?kUIY1U&kU3+m9Tpx$CkW5j`FL zneqGpTj>q`iL|s_Xy zU4mVa4n5~&8^yIQ_;K;{Mk%7=nm!d9zne3tflQnvz@#2scT;LKoCU#m1(ycLMU zjlC&!L2W(IVuZD`%c}<65mxW)ZcT(|Q#=_nxl0=;4bsO4Bw^SLfiPOy zDw{lIrJ43Mn)f#K-dx7$k&LXRIbJlf1-1R!DnPd-`{EiBd5b0_OscI|PO(ki49cl< z+||Qfb!)cZ)PxLNEsx}YL?`xnWkVrRkG2LTvr(OTF>HQvd0KDe>C7^bJ0)}8OU#hpkG^OvD_U0mRlp~8 zTQe`fDJ>R{G1E6ESdEe~$q&yyErNBtgvfU?W7~;$vZTrc{9gDo=9vZ&dnvrXvJElZ zOOi8p^CQZdPLwgUvXr-_C0sDtpB+g%DJS}7SK7|O-WfU%9|kiuRtUq9C{NPOno+$= z$~h*XZb3f_dd|?9jd)%wdVD3BmpGT`0)*y_qwk=5=uaUt6S;uY46#KHW}j8~8Ojht znj>Tmu4B(h#zl$Ex<*0m^6;x3@1q$|{!!b(E6QrOxmdV7N<>AtTc)70 z66U!hn1VF)VMh36hyeORPjshTxbTRcdB{F(NfPzWZu>KU#CM?f&|@OXUst~qTs`{{ z8cl6;n1^QYd|Y#sr|77-iWuGxmTLiqJ-LQGBuNT~HNN%RKFJSGJZr{9YHyQrl$zw; zuthq<#+_CaT!Y+GfXaynlV2SJFH-a-r8f$_Y08}(^qM^){K5&nTiAIoADX;Smwifp zj~W8tF4GQj+!`3As9aFjbn}Sxkox_Mob6JAc7c2l&@YV~OSOFd+(0~n<9G z+iZHue-Slf6vXS71~O%p6~(20a~76wV}haYeBFwu3?XK$DvKFBOlQUHuLVRjxGjf) zsEODxRM!_iQu4Z*NLy&mkwT}Ih4OliXJ5(HWHB7+kQVvdN1sOD7niq5O(m+6+{`*z z01a-6+R|&$MNJC|du9_X@5Y5vay%eR#Zin`hp`59_1vQ$;qOB&ptqy+*!^< znL=cf)HndutI9}sqG96H1v*{x%`sWi;peZJSraC`%<2C6ZkNf^;+aNWJ>2=A@?POQ z?{!hvydcPU2#cuz(LWx>TS8kc=906RUMys?x2vcpvR4#5Toak0bd}q+m7`iQJaY#N z-)n?BRIm&18q-^)ho%{LSq;vJLRb6D7_~@IV=j9=mS;~w&L!;zU*~9RiqjJ3QV7dG zgTT~4RezfM5V`n-!^d7#v862FMSc`Vs-wXDLZn3QvHW8n2dVS|q@7CUCfnw~Un28* zrxf4&Wy*|B0_7YXo}k6*?(p^Ej;J2%ic^YrhMw57q4+N7ncEh<94Xz*4nJNcRXnot z%!-CwK!BOFZu0?x53L||to~N?7F9>p8v0h*;|!h#Qd<+BKu+*5is>ixiY`Qks_B*V zcVf#ZgN{hb0nKT#r_`j@K-Vu}kP|R~dhH zyy0M`kuaKuK*Lu5Id>T7QkdIiPD=9pOsY6e=#hSxOdolHpd^i756Q+1jkiljHY>>X zBtRxeMYYDaQ!`w)7gyeyx4YdaG;aU}(m4Jt*}U&y$ik)fA0hgEpphf?%kOnC*DU@5 zJu&T0^H}`(fJ1*VA}`dmK*o;MFQAXydgm^lC^bZq%!f)JxLl9f?|ztJ`&LDsNK^Gr&8PHWs7Ig-I->9$34!Ig`vfF8yUg zZe)6z!!)~lP=l2DWlLJY0TTR{?6_41(bv`$NK1dliP5JQpBb;)J_yf1c6j|#XfmmY znNHNV#|HY>@ep$2#+BWSyb`*}I>lj#Sue9RYN!(O?uow=(!Hqe{p6Itm_ zrhbl%Ty|9|Gw{tkl?2f{ywQP0KCbRf2+V&=CUO_z$GXexkdt#k^huXQ*nOyvJRHqltqlO7iEIIT>Kf*Jf*bT;jpYjh_@gTZb>bCZ9!wNQS~RePK?R3F^SJDg#xr$&Jb)0b_+$!i6-(8cIAg7&4V z^cXCZdC3c6?>uA;_VHLSXU>>~mrzihk?RRO>wP)xXpIL)A=e-pv->pQ8tCOr4FAM4 z%q~I?og)2_3w=8GII=Yrm1Fsd8JE<=(RrQ!#m^5f#b9GE|Ce;q*#5~Gy$ zv?^5VoQM?ufxi8Kf_PY-I}{4#<1~H9tDy$j*$xkh)QjLJo^QY6aV>_&v?c zB3lD*vtw4P1tpNZmN$R^lhV;|dLn;qRAZ+5<~{;vfm5<~GZbV&_)}D@B+GE9PZf5&?kLJ72x{07 ztBCus`A(#O@JG~et6)L@CGYj18~apdksX1@i~>Zpgh>p&W6v5o{&1NgGBW>!1VtwR z(_RmjmMj4AgS@9~tA~o;>7S-bXDvVk&L*_OiKF_rhBP}unuRi{fH+t@?&Kf0S-oVQ zm+89*a&5qTxuyTzoOjJFh{jm?fhj|w_?=PP#e2q4bblD186Crh-%{5%P)uV6aqx%u=tADfF z^QHPD`#ac>WlOfAVwp7FfBacMlFdq=o{NhxfodITD*nr<+yA}#51=hqZlb$dCZsu7 ztJKCbc6XKPAM&Dd;I17`a>54Ds8@-~_*vwTwJPT{PfhDwRwKuSMWUqzw5h}};gx#T z$dSXNkC9V`k-DweQafr~@1!^~NAb>jr0xBMFXbs9L2&@(WjdU&`I76BV*mv7RyM6} zz8{ceY`F^9ysk}gG_`HQUiao1kMK;{tZqh&nSLAf_=FRPWT{$_QIjajM?I1ZZ7MMu z7HM`QD{TDMlG66D3O0ctTW<<0&fd<_xu)GB{Xk9E^J_DGyH1k>yA$oZ!=ZNr)(>ZV zE_{)qT31|(&$Jk@e|Ss#;lek2(N99beus1Qf`==cBT1I;W*cd{Wa9ZHU)$H86N#b5 zI_>8XHC*@>@RQs$g%x($agRex5&W6ua*Td2{&1>9vyU2+01L#mq;P+kU8A5hH4VeL zwK#*WZp8uSp-j_qPlxLzbg(=(UtLKUw~$nYDjpg-*&w_r(O}dao*Vt>f-T1rgZ{uX zi#2#g$5&d$qHjS@$?^@|Foq|jfUov;Zy*%^Kp33a@~gPu6d6vp(*)dCrP=g#=2q3Q6>==;+B3--R2Qs@Hu+=4BdK%N&II%oofkzX?f znOF??jBttVLH0}7_zb?lKR9htnd6GwO4lW=<^O0uF(-4R&=%0TYy*laToJ|yg_y)N z*mYQ0P})K>3b}h1>ZH_H|qT2JYXp4frBHyM*uGffg8CL({kW>)Sg4S6zjIAPy4_O#5j4h@Jf_)r?s zCbizhn!}wYgLZT;egK^;X3MOwQe&q>2*oHPNQ^CpvCJy9fem_dqsocYLLS+9k^L=RRH ze6fFOVrZl+%kK`QEq~8YvEBm~Dp8q+?m+b|O~&kp_0jx|RQlaA^i18a;C14|w~5b=6g`_ zW9~$6WpgUrUlIB$#_VoG?{u{_qHO^!jsesG8-Ldki@6iYsT|;Drt-l4Zkj_7yDa`< zC0-bj(He4Iv-fzBZrmc>maFF>4`820HaW_FcGsl#IKQ{tdjJj!VEhAr8^RpBM!7Iu zmXKcoX}a(1t~?Ar-^)7$He^o{@yT!ge(Rz5`N&Al6MsUD?e@?*#Wir)pJ_!Em~x-G zxigw1GJAxGpS0jX-4Qu=U(a|=L67a3HZe%46@@}hFn&!){~_1(G#el7o5O#hpYqnV zx32JSw@Jy?heC!y3Tx)#J3ls|wzYWFsxP*SI{XZk9@H3(CwXTixclmjtHjVZgsS;P zMPwHfXAA?g*Q4tjsUyD5Iop*DQ-m6fGOF$#6@w~=6|7fO_PUK3WbVde+)0kRuF>(+V63&m0&8;WQ1PK?KT+h*^t3qRN= z+3yQ8;6@ih*zHi+lt|z8J5LFguH^uS&PdKMW{grAdqF zluhtKsqK;YBQRuTB-R~plTZ?#@5`{XPu27&G-B)jfGES-(|YO=F6zzS)oBj>1lXuN z{ph2sLm?^bxisa=*wy?n5aibx@_GV*N%!@19P&GGP@u@c1M^;Og2ki0gLfSzyO3q| znBKWZjSj6biIq@VtHsb#=ir$i6y2F-+!+h#J(5pGxR)izSv69Y*`i+;Ue5I2GURnk z@kU`t5JnxGhfV|QtAl)T!mi}zp+<`_6%cNO1*K}tOq*%DvZSvFCx7f~#<6;sD}L-p z2T)gV6w`2a4)63c%^Lstv3%Ag;>H6g8*y$lg+2O+L0Ll!YH(S}^dcT|x)!f&Et!v9ebG?x zp$hN0mPCHbiGXH-v?DQVevb5x7Q2v2?dumT$#! zQee)QT$M+9x)sa6%$&3+>@ zKxL%FD31_G+yyo)vk+-CLj&Wai}Uc}j$#-^5C2X;<`ml@>fKt+xk_J4Rw~jAuW0w@ z+R0`@ay7O2xi)6d)h6C!jh;JsM2 zS}J&if1o&O1e-atW5bO!-qo8zNQiJxR7aqE0Z>xq=jI>+HM zF*i6LUVrf0E7C2a$F$-EMO{2{dAB8z0-s+R!2g&=A_)eZl1Avo6$qslM9yOb5u9u% zsaGO4LHLNl*WX64Rc3(cv=b^3Hh=*?UkSuct6q!#aQMMMa6_mM-jF%*PV&z1XXF{8 zy`~&}bS;UOvE#{&zUc2;EI=tso~Q>c?l z=n4SRm>;1byEZeg;zD_G?Iimbbb#xAu`v>I*<`skZJLqppevk)aUn@5Bu>q(TQB}+=$*BNR` z_-B2X7>w?lG0TQ=tlf*Xjht#Z*6x5mAvF4`w~s{YG8NGZ8x~QJn@FbTI^fl@$0@tJ z#;WM1r~MflNePNc&BY>j^UE5vK9{k3fJjq|=2Fm>4DWxd6P?N?0D!0b5MTbaY7o#q zx8zoFN3Fv=y@%B!gQykUk>z2?qB9OG2Ov+sbdbDeGSt0v3!2haO`8doT79XH7o!)q zs{$=o4STAW@oG)yl9V31s(g~KYN0ol@;;RZexj(NDa|-PMEI}Wseekpby_1Do;#EYQ6H7EO2H68N;_w9`FH@BQ3e7^~|k(!l%&Sg+k znd*7KdRe|!>#q9B>*fZE9Uh+xZEd;zX|0yD83_&|D?+2yT=iM<)z%V7<5Dz1p_*A0 zv99>rS7dA5|M-lE-rqN%3@6 zx)LRCDQ~6)VZ{_!^nr<$KplZxG^)^NWXcwm7LpA~YyOq5csG`e(>;K^QiBM)c_=Rr zSb5K>nXw8`I1`0yNhPn7mNB@*RQr{myB37WTuVz=WN@BoooD$wtljHzxx9QednTjvch$-LSWf1P8OBrw9TTLYP?QpK^Pq zIlGdwzJyba!oE(5W(Ly`6>dw7OR7Gxrl79?zbp=%w)YcYmFSCpdT@ZE>~M$+W1cZa zgVLh$+Q59h71EtSOxyXn@;YC{0q1QZ&8@!2y)dtLN!m#HW7Xt}Up6CPlNad|-1uJ_;YIH+ydQho3X%988$T+&hKfQM5l5-zQ5{>@2`~EWju5 z235`HZ6KoX$fnn(=PebD?EIYNJafLy4&K7>Szph<=J`vfQ@j&F*RuC0P68FayTvm* zgptz|mdqggeMLZKv*pcqLB0SbXfo-^FjCeCDPFd}Z*ayd?&{^`hx0I(bVFCK+u=saa%40vKZG`TBzE4 zkE@?%dFw-LRLxz>;@U9F+WD5i2u(OZ7#*o+G=rAU~Ls z^-ZN6y=GZ5l#1BFAEfRH3B*8ov2(Pb8jqtlMDpZgB&y@)i$E8)> zrvc?0Ul-tk@!$D*4g>cYdokY$^TNpidR;Ii|;8nfkt;2tVPFk{<3~49YBcfgf z*nWnBc|P8EeY9f&`qxQGl-PbZZ7^5n6em2UG;BZyF@0)Wu*pzS8Vf}wASfTutbNQw z^2h1z0USRz|ANDevOzDe3@7(8;4WW!B-h`k$SDvJ%OPChTuE0Ly?yC>*g(p@78F&a z9K}x;r_STNFygQh06*U}6{dJ^6}2VY@cTx|@gk7UZ%glg8~JC9#BJiZC8n??71fOS z;v8uqYImAq+TxoJ=S1Sgdpok}$|8{{1`h?*F0~(9CcZOiE#bz%4G|Q7zV9+zo>BxOP%0b)>QX~%FfwD z!rj%5@BhnfefCa1n;ePu-?nT!v6eLDs7aW(wknVD61RVve`H0ixhec^4e7|#|9s0# z2r&r$$!XrKNZkC%)!N@YG@SJ9nzZ+g-wwu1hj{&K)5VyUZ8Nt2tDhs&)Q$gp4=7R< z3c5|yGIjHp*B*qpkM58@`s(%#6i%P&|Nn)Utb8lx{Gg?kmj;Ejt^3?B$4>%kK1Ce- z@&DqO`l&zT{Tu!N@}_ZAk<GGy?qFrv|`FWjBTXEgl90jqe|kuVBQwN92yB zuha@S^wm{TeTm~Q+x1?TK$M}MUv!{p^83`@XUipHX#riKXHtYnr2zXmB#Q0V%s%Xs z%(t~h{h*b-i z5cwHgoWs(GiBj6~DrZ6*dSHCQOuYylz})_q@%^Dorkrs-@Eqj3RUe{A{mB9BsqKSAAvr!C=0g;Gn% zY-Kl1oQmJA+3)<3d(a^FOtZeDVsXF~Dq{a_52Gv-j(3V)dMixFMEY*YV zE{H7JQWUSkU&xk7mTgCBmxeu?N*kv!gH4g2WR7qjHEL1I+Zb@wI9ZtvZ=Sg(A&kt+ zyOAmmI9%#4@Z6_aq8^&C2dSchg~jiW35{7)o(qAMJj1765m$9qCmQTzVWtzs)_Acs z&XUS&q%L3Is@ccO9~5@%{@hg>rXEGH4I$TCiD^AYfc zZ5R!2nwC*j+1hMIGg53avXJ#al97WRnmFVy$?aw+S$~^8f84dc>sqd*@I0sO zy?^Jo_t|GZ({N_cEV|2Cll^@Cj3zBTS_>>4h3j4!+f0mdP(8+|V@@^DvE-6j2Rd<9 zP}8*SXkyBnpf}4Y6P>0pMpN}7j}f}cMaBz zt>I8xAu1gm!ux)z>jq`%O*mT}S+-X~6MF8UmvuS)JmjDD!d{RW=e1Z4}j~5}a>!&*H_ik6A|SKqsX$Z^c?H&o9KTym`$$ z0QN{|!TVKy#O2M;@on7%*5Re}rcnpVj!HWKHJdV4Y2n$ba57h2G$Qu2#7;Ge{Z8)-$*yaq7a9Fo>DZNgoQ&0w*pcLof<{C?{aI)aM{&tEvUocxn;;ITp z#{>-nLva)@&Io=&Bb^@iRqd%b*5Q)fdM0OXvaQd(6DM@&zEEsq;YyYFu_ls(H#>! z%3-vsifdKeji%t@xAjm&Fv0+qIr|RI3nx(EE*e?6U}H+S0w8)hF}{Q>ODB~7g1l+J zW{;EJ9SgA-N^b~f-Gb;TZy@X`pWb3gw^s<+b|G|VgNJbpvPP)LClC*3=HaS6>}6Z6 z9dRR8WRt75w~@yfE$Tped$M-X%4h0y#f(AG+xNVXMs74gNyrsnJ_nl~6mza|&G4g% z+1g@EA|J0-5M%j8C70TmGVFrc`j%>2S%)@0muwpcKwG%_IFzVzux#qZ^cj3VrBl#H z5rG@X3D@R_Z&0bLBLz-uCRLo=$P`SvmHTk&%tWpAC(Gv=wAk)mdLObLfQD&L$ql-9ZdUxIb}*IUAST= zExq-0Zh~2Ee~aOBX^DcgX3d2y>E_;4Q)w}*mPZSZjU8eNW&lb>&p&wxj4vZ*-j2=$ zOKV@XYyyu0+K@1oA!B1|TY3)y$(*kdaF}U@j|Lkj;5Ro4!Bjy}fkFN-iZ?24PacwK zGS4+6M)~bClAQ{Wpj_PrE+-w845V%Tl5oOU>&?9yrhr&|{Q+~1_;0qE0VE#}GJ`*l ziD`xH^OMje5HfN=er8LsX1)j8!)@rFhcQzx6cdhjYb`nC$gd_U zz9;WfZA;+Is6h1OCjzeU=TG~9548>uy@?a~)+z`cZS4-q4%kWib%^lsPRkN)2sjut zECV;V()$*)DIEIe)sn;=D9s?kCVXg+1vg=Q(n0gD#TD4Ki6@C53(2=sqCT}y02f66 z9T$7wPfrg_PHyMN>I%sDg(#$o4E>sc_#vmY)k7Up5ino6qG2`$HQ7|}LI){K5vsxL zwpQIA!f=JGkKAFN>RVs$oKl66WB-c`>sv2$HGV@u<`wgcH>U? z^u>g*N>R_$>{RHBDuSvobD}qc_rADMK$v!=_cnJ>gXrXvv=@q3Ra8_68FoL>8|dYa z*SAF`%Y}H~M9LMa#91*ivQi>6{_HCaN0(~r=s@GFCSbk5CO!NmjV=J9MA$Veh&kMW zv7wZw+V}0?W5*oiBI2y9E?U>&Z+C*c>&@wk{@8A}0l%b|V(z%^5shsxm!~iU=g36z zc)O+g;wn*}Ag=V|&UVqu@l6r8{%T4r!W}Nlva{jxhDc>XqszZ5;`?}>_MFR_>WMxI zeWgbC2U*(k3`nQ5WFR4!Ul&g3(dAa9_CPkkAxy$fL(9qtw|VE3t62TV zW)?O(^=QIjpMv3d=jNjOxDs|Zy9asaJFy&0Inke2)OL3BgI7u4&yS?d9M2E>~*R^c>IeZ7Y>1>jY zc(+%F=~|=ctt9zy`VA}D+8JN^34t ziJ_;XnpnVmvwx{0qg2VN-D`g2;f*`!3y1qsqU66rzaS^5+0V!P{l2@zNv=z-NtNx3 zz;3s~MR|5QiXKU2dK87beVnkQTm1{9}EFwJb6$9iMTq)FelRS-S9nxZiIg%AhV94sFj7^np*$n84= z#fAVJJ8YSY?WdL{6Ba`n-tHgmS=c#&)iCmIW{DFUARdqZfgi%K77)tV(x;}qz$7#u z2YSz=P8;mwq8l8af8a`O4(1w%PZ1Yk07?XVjET}wajbb6GQ{{X<4lZu1Z^VC8_x0mcEo>7D;JFA=Ey*qmd{H^`hdApzDaTyn zE5hzMMEQ0v$Y>E5d_z-^P^VBGJV+Kw@jo@{l?5o!7lOjR_HO*A%9*1jb%puL;3Umj zQm^3+Q7S*p8g1gTO-G2suJ3c$QL8tNU zg^HCmKA!K#_>;p1tTUU=z4W#$csNa=X>Z{-89~BU8##Z@m;oy-O2rFNx@Pz>C8R`4 zjvGEXofFeBX`T*jt@Njlg{`-K*FN~>=X+QuT1cyrYk}i4CG{l6kr&C8&lS%JXSTh5 zy|s1eBdw29$Qb4&d$`?B{wKQT5}Wkp(fbuFB6qkhaiO0mW}Yu`cNw-Ota^Z?K91^m zpu}&=rYmu0tV{aqjiP;Xh)D-CV-ued>qj<(Z(^RENR#Ct-E{x93zW| zL?3W6j_s$cAl5$ynMx9~C6tJ~abItIc8p}K+cziIHpMMXt<29(Xc{YcgkHu{UgWH) zh`j3ILLViLy*k%!uUdOss8RVMu3-H-tS0^KG5Gr~T1j%6)0U;LeeS3Vxf`b(p~^0W zHEXJKm5J&eSZP$uK=6slk0zlcClua%6Q$ainYbzFO(9fir%foQEYa{98K z3L894si(mX*@X*cXQGLtn-P8;!Vu3D{IjG)%YvAhtcRmf+t__ign#&+2~#BY7Zr?R za<|Z-5dQkFMDLqf*)08V(8uDKh1_PBa~t^&JP z<3GCCJ3FTFqxd5O>ycL%?Q(I>SZ@Ee#ARI5_yXOXgjERz)t4$W;jyH9r#h~Scbp7( za3(I99ahoyZfw9Li}1*x%`ulz8@XQ{+-)`QyEmOfNR0dybDM)QX)cdNvJGkOR|mBo zs=szpq{G+swdlCTQ89}v&i8l|7l<>x{>JJ-pRCuaZ?Q4>9exzU=T0)+xOqrh81YTE zP{KH}=h+bB&O>{C2Q?jIZT`WnKNZhQH7fzDF9R`6{0tN3d)K9La&`|Do|lhKz3|ly z12B+s>BsYfaPVfb@-DNqzX8+P!gJ3XC@IgWr}v(HeEu6k40?1;I+cJo`6Vaj(t{(( zps3nsUl8C$>#=(V;zxhlYZmSc07vm($SnH6we*nfzM?}r%Pd_TC+|xt&n9{cV`I~H)7zg>0;90%gTi+~l zf}J7%)xbn}A~Gcr+q1U4@m>|Q*z@9xDOLI^f4(o)33D4P2*2BKrPem-t~fvOLCbAV za5HOld~!H9F5!YfJZWw(3Q6|bAeecuRiYn565F312c5r z!*%hR+wH~m?wd;ei;M~+i_`NRFqi(rkzDA9=I4DtIaT?L&rO6ARH9LcW)w!9Qe-!v zN{`m8RHiK(^IWJk_z&#?B|?o#+<9KY7Z`?rL2+rRYif3mt`+xK_boZ%--PguUL~B) zEh{hSw6(QGXqRlIuR-)Y=n@P-QTCI6#wiR}sf#>F)q0i6*2kot2EG14n)2-yF7^J@ zrL>T@=IQ3kiE;FE{Of$YirFp7dux#PV)%Z_@IpM3_`am1lxAyh2W@tw>nYyhmofQe z_0eWV4?{Zq$~g&)4=y+N=Kd>4tsN8(YMnTpJ1>l3f!pc%6}6DK1RssZp0PkVx@~t; z77>*ZIy$_4szmHl`6?k1Ic`GlJhc2QkIe+7vIntUgNKr4d~+~%(AjIC;*I-OHoL=@|Lf%1G?F`n)3!Y_L;um{L?8iELBcM9|4Vkkd?ITumyX3u$4KPDO- zLwmae$M9Rl{Km=(ak=$)%T7y$rzClzi4FbgwjaZ&^-PwC?$8ZfLx(@+j^qpH{qlb- zpoDzpg>?y3J1pg%vngvaPahd2t-md+4r~L)rjAAE})HcFR1OP)D`== z9wwu%o)q={YVv?h=`n$#M66o!lTMtf7WEa#qpDc*HF7{CEZWg9bm4R9oWq?3LtYrqH;}f_+-Htwna1@62VkE=NH)m>)Neyw zF^}LN;I@Em!%4C>MN!{8Tm<{ue?WC~z%JaibF#@+sjT72%ig}gdSoE)=A%X-{62pW zRT{WV&dH@%dshu7+yrIH*hbn!jN#*eO5&DfTop***JV~7jgk_arg|lR0P~$F=`?MM zU~Te5LVf?6wdAeVq107t`dA(LO=IUI{%oi1^~2em*Ke*uNo?bIihPotT=^+tG46gg zec8vRxbQlpMQn1VZl(%-#d>g2e~h$cNCk3aRgZ`YuH{P1CWOC3!XD*_Z=mVk!AMmt z{yswJ+q3_S0qtfO1RnjK7ol9%vFGUkbZkJe^8A)N<6 zrGh8e1kr1f(j9g_s0G@5(SZ?KO~8xjD;y6fCR44f*po7qx{A41LFGD=xh;yswZg?W zmL1ELakw{qlWn>7N2h&=xG?IrrS{5>KbbDu_A`-HXi-;K>0WkE?BC)p+8fMv=ObfS z{foU+6 zsir)|@$1*wM0vgv{#h=&bsBwmF~FpS`l20)^5yls9#!TQ`l<{3>0=urVaSHUMMM_|x+TR_ z)s{~c;^^3v-wf=OM#I4d!0Za@8pPVKb%oECP<_2o^Joo3v7(aLDqAC>Hy@-8^c;OfKZbrRn5^hLy#z(uh2wWD>#`I_xOXI4&cznB>Bf@*@-u0r1BY_j!FiO(9Xcr4 zPryzEGVEWa7*O5O#e~Bd{9!KiHd2o00sZc=tChqA*o^tdgEU>(PVL3l z)0Aq$=+7C`AhH+BvC)IIz z$i5T6CjWD`0a}#ASO3dK763{E^M<{oUU{vZoxQ{AgctR9_2M$vn5m! zqV!9Vx-Om|mbqaA!up(pq6jvKcrC5_aVf0`p+y^Dz5`?0=~%!t>q_(@glqo{1@SOH zfH~bsfWcdTG+IjcP{_M%T{@vkzj9F^duW3^(b1p)F57sd6kN56t15pZO6D(tNX9Ga z;6jiSf##PR@d$+>@$b-?>ku_Op!GkSNnnz{8PPnxVeud!WOcpJylDqA!|a1)$Bch& z{p?0txE<1FlM>Md2I<}gl-l}ZIjEkp^o>VQ(kp!TZbhOe?#02NNUW1;N;C4qxPdal zNsOlZI)YNeH*AZ{zD#lrtI(NYjb2db#Q>~B$ato&>{$T@z=$NCSqq$g$l z!p{!F#-keFL?19@A`L!}ggUK}Ax1ikYn~+IuwbBz1OJ&klAH-I$$Na*`0v=GwAK zR#2P!Te)J^4gk~y0G*>2+FE3#8f))6{457xhJ%|Clzt41X43zv>Nw|TwG4~{D6-gE zYN~$vQ2;66iK0@)an+-$i?xYSks42joSBJfVR;wiE)3BUhK)NeDZQQ8RKlMt=y_T? z(0hoCe!$qBome~;ZMR|6wc!vcw0JBGd&#SQrBU@n zuI_bDq=uEFBf0ICxW^`TR!*~Y> zHi}PWhSp;pm_urFIv-FiM2@z$sU|J9=Fp&{)}1rO4gE7kru`4jyDg>nRC!|Gr4;sT zx7F!+)LBn2w?E)>zn10Pz<<8H@Qs0ESK4Ot;ijJF*WMnonVEGL!V(>9Y-T6DM1wv7 zWuY^#Fj{K-cvir>q@0AE)VIijL}%{ws(}bL8BJk8rG~FhD<2?GQVF+H)H{2t&d#Z- zpLG}BXqKU~J}%mNV2*IA-W``g!=rZ6P^ezuTN69^$nUhE#Ndd*R1AKrw%=2 zg8C8BE zlTBoMHhUwr5iSVF@5dw%$p@S^zv4!KN;D37ZK6{6!9hcTVas&1x;Hg$hb`>P;xlAs zZ&2hk>61CHTrtMpX~^05lTBb`zFS#f!j$mT>^=9`#~J6mqhJM4{~X5YqEJ3A6#uhd zA^S`x{*zU_X_Wqj68cn8@0^+45*M;LOQs)JH4!`3tS399XKKe8I^-EmkDM6Ck?}nn z9#QJWi!1hmvkQIRFe(rOZ7uHUF~Dw6fKGdu>8P)2UiPp6t#pNqeZ4G|&CJE-jnQ!N zqw1g3km~;;D(zwfU*KR=WodS7zG! zz8kO9keCuN2eq?26@}b4V8xzlIkYM^x!If*QKnw&`DjzkKEt+#g5Cp3+Y4egb)uBE z##arXI24G-84%!#v=^E%8798BmzAF9HLXdhGCpH~ioK%F4n8xx_1BTZN7fZ6DfTRS z`XTi+ygBUYlQA3qsx>n)hQHs^%`cx-((LyPA-XC3{@$dH-{&%|WEHdQd1c-->yCQg z_;1?3J8jm)KB;RnsowsWp70#j?-?uHXrYqu;T`ysIICYIc=k?xflw&#zSr zM0pDD=bVA=RT|V}_ywvRW6BB*#;2o4DW2o3)GkVKb>xog)mtyNUGUT5^3nbg?CP=& zoROfeNrON7%p>dVqF~@YZL_VXILVBSGp1DSucjmn(88QZs?^IAbL!9fhD3WV?o{J( zebXWIQBZBQrI%Mbz!*!j@t#diXM{2@QCfHH@^Ti|oI{t=N*|Oy9IzIJCX=m?mFN6Nt(>fC~9F^J%J7-ZHVMg7+7$O=mhA*>in=(uGk> zFI9OadJA8R4zU=$ytKlYjqw~?8p;4Y6tLkA>q%BQoL_>gWj$$krkc`5S5eK{DG4dU zoslc~a&B+vIGaV_O zAEGyXhP98emVQkH*IB)dV+1+XozuVlNq^(8=ZVicgb_jQSb(zu= zarQyimvidE;%27jj4uXc_8VK8d~z-}6-1p3!Oqlu2zw{^?d7kVZM?yFEh6*cSAsII zHF>tAc4zPx&rF@7)p^S0@X?bKS}|B9S0~-9pX?)oL_m|06W-@BB2NaqW3vSQ%@f)+ zDBq7`ex!*K-#Trg=JLNxOj{#)Rxg z63Z!B~H=S$yI&3FGgQfkOFbVpW}# zw2vN8BhO5R_4{0eQSjaLx4dT^hxYleVi7xGmp+R<*#7(xFbqU!9^v0x4id^Rbk z&U+0>wH#klv&XQe-w3s11g1(F)%(EOOMXnm-T{>{Ql$16n1z_8UXx??7hjKi69B?- zIh&aU_2UMNU596GPi}bWZNGuc95w%B%pq~%kfLPZq}ajR$*vX^&zt-{UK3flo_PG~(|cP~6pX)Pt!M*IBty9DENe`v-rdGRk5y z3-Q8Ou%r+x7H@@pZHBNLpqftj>12^`u{eX`|mdtre+66J}xR6u?NcnNPq5M0l-No zgd@dO`(Kxo;9B;Q$;n^+q{R?-&}Z&nSUDnDi~p%a|8a7=gv|Fz9S?gMdRATdj17H* zX%)-kPMj5$p3H@oUWAMuo5;QlLPF7ZZ9=;SeDfK8SgPOE9J+9zwmf7{RY2y!tzpw3 z4+&j&jBXVtWR1{=pCn#=c$W^ zY?W52sSN!Jo?Vxb5&<$C_VRTLaSFqp24i>%*ph$Je!CyYA^wqvncG(mx?3!(dqKhb zA_RHM*Xb^jeXP%<$M?#`2iY>O!39fDW*H__*1fO^(dW~g^U+@xYf40E!q5=Cojvxg z0;EU<;=a4q~dOGroVl4 zb@dto%KYV3F6s3)e{Dq~h&@x>w;;&u4|vM#aQawO;`SvTt`hwTI8~{etsbeb`26Tg z9F)RUI=GXb0#ht6eMkA#grphl^%A#6`&mA!$9Lm3Cya_8_|DR&V}6+j{{r3!m}QRZ zmsvs}ZW2%C-;G3lQ8kH6R0HD<)q{JJodfNIxJ#0g`(-bbM6VlBxPGcpGb2C=IHOVr zXbdyztQ(~c8wKjcR~~)&C4p()^YX)wk9}{qezHm!OAaeRmZIk zM8b@sw=$_Cw=JZ)ZdCPy_P%81gOsHGp(WO2VjuLb$#jpF zFom;IC*T*NIB)|yGUJpV_Ca0LwxwLXEqiXgo=pAAMIFt5$2;5!Kd8LD%IGo;d}M7d zq_(Y*e^@TB2W3l9Ahzz`8!3*hSyEBZBSec|4f=ew)st|c32H3msS%`lJg`_XAnH%< z(M^adA8~!(Gvo&Oq!)JhIgk~Z%Ucyk+VbjxYD))qf5BD9Tsb$Vqn@b>e!u=iK|B*w zgU@w18rUf>{zMF^^t?0eGD7e6!O>2ZU^fgFiG4~KC_lv8i4h)Q3xDpx${G*R1Y{r5 zpTdBBcH7 zGAYsTbm$LO5QP&OkBB@Jl%5_@FK{44T2aL4&9zv?>YZo9`qJv@Lp478LP>gRkQ6D; zGD;XOShOqN_x|BAoxUafr#rei&8SN?H9mTw=0L1S1wbJ`cRZim^sDN% zKLxFC2M3wf#JUd1dSmmlgk831*40W6x_vxc=~^N8Eh~$50zpzpJX#_?=h9SalB@W^ zXzUfdjXAY}K5>eqbRr7lwue?dgQi#Gtg3e+pl)YLwfi^2)FAFoKzNjKea2UWeIJcl za{Bq$2^dv{CBeO zZ5GprO;IDR6*`v#@VU1^pC)S23A(~bhn8ODT!r(qB-gnNezwC2ZJ;pmJ$%bI2neYV zZUtidFUJ4BpzePgeE)AllJma*>9lMijQPLfms~WE9$Wpd)FkZu|5F(0jrdpwo7*9Q z+4GX`TUKnJI5BA><}sz843&N^6S!HDUtc0i*z;=X$KeanlB0m_^Os)P5)b8H^Y>>u zK*|hQO38Oa(+a^YU~upx{rJ2a_#7oTmzCa}Y15w9JJ93lEW3HY_`i41_JUeIQ#h<< z$+k7K$WrtbSsbQ9K_-v1HP?uALxl`ZPDkJ4f(&#vYR^LJEt@Pb8!QLmh2Dl1 zg}NG;eo+>BdUA!b2nPP21|R7DB=3aJ$MQ{`LEh>5b)c{+#y4 z8Rpc$U>OqH5z_XwtOyRy*LQthydYws;`V-0K)+xEV$A!6BA6hUb>BzV5kceyxt9}! z&V7u;u_IfdNq#C95*f1Hx%R7{R+UHNw*us?0BH>i10r6NrFXwkfg?nbIKJP&mu60Y zj|T2F16dWqVlRKjWBw`!7WM4zQ5)b9F9&KQ6?`J96`yVZ4sZ334%q_Hf1XG6ir>8b z+({NVCk)-;Fd7{D{%rw&>U_O#UGOPogl5jznRzMey>V?ot=6k5U3IC7IXPGjT}DR- zjsTK=L-<;wg9w5g54Hkjmq>rS*h)?OO~hWU1kA$wt$P|#8?Oa>7{SlJ8o7{b zLXt)2(TFla185tR^PFqX0=G4^%PW;gbI z8D$y9ni-6B=Dl=3&vW0O-|zQ6&-1>Y_w)Jv^Zvm(*L5z}c^=z&e2?RJaYtX1`S^w7 zAP|UI>$dtm5a>4n5QvU+>^I;|-Gp!@(9n6`(^LZ$b#W4bhoeq6^lpGaB{59(M>ftLaB&X@_(f^)tK#x*Qb>Ie zNc4=B`i=XKtyU&!YxYKI^XpWpt>FXD;1S)@`WJ1rZ6C|bcrFqb<+lT?a`xVoSZqR8|V6UPzsrM;YqJPx~e-}%YA)!f*CFPehKx0S2yXI@6>!M zMSec0@qUmB#gLL-o6$YL)2g^qU)7~dnJ};FDuBsI`FuCbK&UMOTfVu+4E$?HknKPq zdc!s}bf09xcIz(NU_dMcXz#z^gI#`^`Too;{2ky?;3f9m<(FfAo2reQxOmNI3tACV z`1^>Wl!lGTc^Az$zXoqvPWo;Cj1Puy2pOnsMK8$J@u2^xShHIRm>bPLy*6hbO47h zoxd<%P+^5vf~d}?dV3%rSxwi0r9cL&RD-j|@uI|&aS_Y_u}9?kZtqRoLAnLe3qk9x9D>LFklqJ7|`SJ5aRI zD|1noOk1x+9tzm30OIE)KS$t76?OEb|M!)~z19`Kuxu^;DcYwOG`N1DLt*wjo}`iM zoMsv&XG%$ccu1^_Jx45s*aZx5eA#SuC) z0=21c=7wqOJZlPpJNZ)xox*xCVoep+xoeX!M)7oIqz@c5#~{ z5mF*Eb|!-d&03~*GGglIr{jl_mj`fb4L{px+e7BvjaS`cP1ca}iqz5)yUWCy46Nyv z`ZQtn9KFp;mJ76DDGwR!r80zfv!4U^iw|>K%<*+$Pej88PFKeFIQg8&kI$61=_2!1BwQz9|6X5!9-fhP81` zJb5`F7}K)5#*sl@5s}y*8swPTC?fx99=RG9GF5}tc4#x9DCAnWbK_>ADt05Dqka#6 z6EzTh`Ikjrsq?2ULDLSN?3o7>9WnJ3i0QzKAX^ii5GOQxoe^`oEza8pcoYdjpc@9{4i%IXO<hUEmgHvDZ@Rg{urHy}`pR*(YF--*Z1AMZmE>nO<9P+#-^ujhMLyGH$7_r+3Y(aL+PSC~ z;u10-(DG@8&r4TCxP|qbjeZaV9Ncv{)Qe(7WWwMl)v6g6*E+ZsNY%geyL9 zgEeL;t}N;HT6}&{6X=|RBcI>KqmNC2juCgI;uj)oV{jRE(dB_X?2+<67_2$+^@*Xe1s?GjdKjUNGj)L47WO7^3E&S~f-CQY4&pOWMS(Ac((T0*tv=171 z(1_v(!(B7AiH&54rYb1}xHw5^-Cx7RMV8YI6$j=|=W=8D@GE zPpt2B)|Y-pW#w{CrN>t{GqMC89u46XDPL#GkC_luKG9U9_Ng`Fo!)~@OcGf;@1yj- zS7(aQq8_PqTeK6-DI5N52mnI!qcw*sSlI zJzDY6edVl2d=*AHz4zL{!+qLLM?m~{)B1)prP7Kve=M?0<>~0B1iIHsSHZi`7dxq| zgJ}dk8Bi*lR0m0rS+G586W7NPo9xIGy3LgapBTcPj%rTm4S&}>7-*IMWVPrA3M?9V6EyO6@l6AJ+7i5wMKiiW zcL5YK`MyQC9-!hhfwlH1Xk^YmwQsK*-2qc7(gD<>=#S3j@H!txP;tkmTn;4z5&^5$ zK>>!qBF504hVUkC`u#;)#2eRFAyZ0!SE>RJuJz!ItsIzAK$BjJ#7@r&V8REAiil!D z>Bud`KNOJ;^!CNSRPQg`9q3y#dHHn(RPFJivZQXaV8fzU&fBAIpoi!9V4W~ye;uK> zo?Xi#nibQ2`Fo|IH(xm=3c*04S+Q?j58m%Lkgm+?fl2hA((hk^?O#$!7;R-Tyl3H! z3Da;6?J{-5w83RF^t?GF&+Jz^kH86?$s0i_ZY<#bi4}t9;02+r5?%1@>BYne!9b_M zhj)4vtW9H%Y?)8U)2~EaWhNO_I0Aw9+Xu|>ll1aPnKf_^iqd`WjYqy)UZeGKi#|Q{JInjc#fD=KTjFaQ%9NM-?Y>szwCydVS^3^>+wgO;9h)CK za_6lt=FtLt;_c`s7p_MRi3X@Iy-UXOVd=N0=>_YDyuNG+*F}W3_x2}f1&wtKE^E#f zxeR|^OIPr-Ju+@EX374M@C39BQQ!hT>zfWK*jju8Y2Osi9v?t5mf0!1H}B!ixoNWN z>}tLF2D0^vlUN}e6e9&oNjoyqy&tIb66+~-KcyoD`jk;INN46MY>aV$XRHF1xOu+E zC&B5{sHlF*-4ve5i3=xPqQx~CBlM*({X>UaRd_vLWTfJe+E3;U3{5?S9O-j+DGpuh z_kvB5n_(X{Kg#0*6-vdJ@A<+w89p`4^yl_8PA$yNC6eL9@x>3LlHDGjn5*3yo=*#O z-!?Ez;SC~hxDe-|4!$p@#i`H^vUHkkE^_+yq>F24w$GRpC!R!4Fn)qz8SLMGWF-6sNdpz49A(b65Qe4meg5BQv#s&lQ@3Orq1dF| zDL(T~Cmd9UzBvX)wskDckt+_{35^e2JH=X?^!RMM?G4;N9#Jtvsh2Nx4turGqG5ZdF zyX6cATb%g1NQDdjcC&6SvX0g3R)!NrV+nnFxXF0P zPUJNS`{p6UjBl#00Nj4`Kz=yllJ$vJ@LN_r5U>~W&4=mEoLVPou&d_583c$z>9Rs{ z_S$p^jvp4HuRR;J0|6WGI9#CBheV!FNYRnYS(}>WeNp}S@oUI+A%(^zGoI~Jwi(}z z85DS7Azah{MtlAeEF?$`<_{VNcnJda0G$69E~L#@1Z!}ByVRm;=Mm7k&Ql1(oy~jY7=7+@0LH{2r{ zGCq$00Aq7Fi$ul!1Z>HHqWG~7pB=LblAR)VM3scvWaIg?q+nyez9IyCMKdLTQcXKr zj4W6`mKh7#JRe+-jVL7v(h#b@yq^dWxy(Q)fK^SzcoBO&Mmkx*c>eJ z*1R$nGKOD?g~~|IK)q;fH&%t*$OTdSzkzCdgzpb;iG$TZA*5d({hk2e;iGT;Ge)Ta z*CbCdY(bC38cg2?w)|~N+Qa89D~W!D_rKA`t0C-=UGh{VZ-d76Wq$%gdI7rF`FD+Vl!rS3*T*EgEMFiv?d^(?~o z&+$SAi%jl-ro>-mWT6J77_jJZNT^P=>RgagiLd}8xL-yI=u8)!(fLtV-PyR{`#K`^ zXI%GL%V^~~j|$dd?|Rlx{wo#3U5aZ;jOeAJI(>-P4Lm4qyIgo(EUvoLIeVkao}(Twfc z#n>%p=xAokwW%(#CFX^fhbAHxvUTIqvnR7pKklA;ggEsOnS?$4F30f2%l6RN*V(ZX zUcvgCs?4pDvdPUV+b!UY@I%{J_NZna{cd!vKeL_Ud>wlD-9ttLhRPl@$9(5Rl|m0A z;>hx;|3}+)5$It3WxlCodQgbqe-$YH34cbK5KLjB1_>ZM})>2R}$Df%Zx0~i5- zdYXW<%?$N2KKgYLYYNN=A;HatEABo*WO)K0awPHA5dfOj-F}WPA?S66Hw7kU3N*bk zPs(sEvXdQ zswM@qzp+~)Z3J%dPCqF zPP`Q@y{V%nP1cYN7fRB=iwb(S3}~6-XFZw%WxWGrNrGIzgL(#6Tfw~EL08iV^WaH) z>S*ImAV1UCWnU3+3W7DdAg~j_={@{u);`Rj5SxD!v%eDmKXIn4c}y^s$b;RE>*{g^ zTjG_xc14`J(+AIjJ`q~o_7{>di|u0?C`d-&e&nIgUCuo}+dGGAYiW23_}qF+p8DLD z_zBu&8cPzLwWxn;ye0}lQ6goF(}83QTjUXNg!goR-l0S8tlZU>)q$?#rlyLYwMY86 zU*0W)4e~q!S2P8dXU!eBNKR7<-W@>B?(wZn9t-B^rE+`nfm>*-(ZIx2DFL|qQI*{n zEk44fjWg#}?yjOBIGDd|@bj`~ffsP%UkonCKXEE-<+6+!^dA?nNn~oDdj2)&&R27G zx3yE$d1Ku81&`2ob{feP*UibfHNJ{zcdpjO0OuBkN&1ACd0*8#=x*@djd9Y2cKO_s z2WhGLhWhq(-nXGJ<2*kn#bu|mO)j^tHpN_q-ip)JTU`xZ%s-;4X0c;2dSn9aDKC|hhdvh`Rt6;eUpPh>BPsAsT;o~Cb{#y?zK z!i|xZ71lFw`&O+kW#q9`Z1gDze>*yh2XP&hy0v!=iz7Kbrd4hh?O~H!3W!v{M4``Y zmOq|9aV1i`+6dGZE*;+!m|Sxqcdh!J`lrPL6ym(DQ2^8=^_glzybyFWXfZ~lF6qY0 zkz9xOtNP3VTyl>9fT6?|Yyk;r_2HXrUY|uxvlEqgyb4AVeVy+|^ZZ=2{372qPu^hf z023;=C$qnfKsOIQSSD9SS{oQDno^PVGhA!8JMtMS_C;sM!YupDMZwbv8LbI^X-%?< z$i~j%nfkH*y}2=CSl8LWZo-&si}gvA#>GDKWED2A9ypQ2Y#8jfaXG(W;Hu^I694^D z*j)HT%ETFe_zSdY;6yBc_%ms@SOxv@FPqLmO!rs{F~`TtUX9}Gf3WqLR^erdD-Sek zr%3ni&(BsYya!~dsAdIec}7R2k64))DKOlQpCe4(^`Cb(`Oy&DD7qxgrND9!_Uv(< z_^ifHchcUEDYwa{`ux5=I3H#=+@rEDNA9YkTCkmwlQ?YDca*cLF1??3TF!FK`L%PH z*iB}N2WPkg_MmbKNn= ztE5tMFLPro)OXaZa?&!n+A^HOKk?aPD-Q#CoE09^uG~MqH#qc(Vrr-u)~Z;$MHoZ%*V2Zt@4!+KBE$L%w7sB51tDM=PmrNE`M+ zv{gpGpx|54{@&u$k^UMBi{Re5MH3biuIsh(>PqhezN#a;?NLhSf)rPd<*=Ujeo&d{ z9%JV{EoM}&b0u^DH5P7GV|c5Y?MAJkcj#ljAAAw+#0S3RTMyhnWcj3+r*!7@|Cp;! zY=91?n@c=h79mAEDxh?Tn|D-pJkv_cE4ai^$XSv{5!qbZ*g_7*)R}qT|C07}j=^zt zw%t76q}d`d(7kGXHH=&;RB^Db(;rBh#y}zm?rK}G9DOBm~{4NTZ=ZSxh8_gJhGrH8n2nS zw|w*(l_JWgxz%bXh};>y8&h3I>1bdoGH*nce{|aj7){)IP`K=wu#_jBdS}s;z3-U0 zgjwLQ`ds0Fh@H3&UOD~EFm*LMD^IfORd7PPwTqW3@=~AoLn1rD*{vwz5&I_V@KWW5 zSTPgM#KFAQz3&-`+2?+K&h3awW;d3?D}K4W<39N+LYO9Kl;j+4BQXHp7SEKjs>WO3 z<>LZLRixYFuDa$|cFlZtI^0#9X}wT;DsQfSzXUFW%`a_gs6f`t5z3AvD)&Vh@oQE| z>`25~RC(I%TF)9hx1%SDn<&`&y!X8^!kbf8$!t;e?#U9A1w{|*R!f|*+L;hjJa<J6gm`>dCP-u9i_ zH(w$)4AL!$<0wYe-Y+&ZB*8Q6^`S;8sjXS=Cn~)7Uk(%ozJv!XYj-P0%TK(~pRiS7 z^pIb+3V?o`_!`Fwd!L>aUnLsUcp*SW;%Uv7bu;&MBvCw{K}S4vs#j}1K{i*cl(!yD zcw}2o5lL?_U!fv*VrS_tZDogX-Hcx`-43$Ma9?{IShgR``x>uZf6eh~!crq?GS(rW zrrdH4=^_6ao?o9xUzkk`%thWOD&yADQj>Yi$s6WVzt!~w8YOv`a2)T z_4yri^(22Mx=Ed3u9LttiFLOmJF1}dfdDui=)}!DA4~A>C`ih+$eLG$uG4@^cU6to zqd5iAxPyaFb9<_VwU#Dz5#H&&?r)8VKMp`r+n*z+ygGX8Dfj}NF>gnfD{e>Wg>$lT z_L(c$tZkU$RGzL*D`&Jc|2$}!M}cv1>~gu%R9M(;sfy0|6y~DO-(bE0&vukGbzJe^ zRK9AAI*gK|lpnf+&uhrp`Y6@*F5gqmlDh;%AshJmv$9;XUT0XU9}kz-+oR{T<4oH? z-O{nk5*={dF+$k+8n|cIoD|p4InM3(O|G*2>J`#=I%`^w@SS0e&q~bdzKaxQ*+fX6 zoV%`MSrnGn4z%o72ZWyY@w-80BO;nllNTm$YT=W3(3ga233_hJ(ba|6b+LZclQ>6z zQDXjPHKk{Ylx64RerKe(mYBQo3pU0l%I`(Tlh!9ZD^U=e zI_>i}fjoi<{LBE5?+FLs*1w2N{NmNsTI>#$NtL?1@0zC{oSX@iIJo^I5u=E4haheN106Z&tI)x`8}Koy&ngDv~B59 z7gx;3fqt;m+57y}42mxXUBicUtRyxnor{{3JF-mWBqJzIAb$_)Nlll%M zX%Kb|2IQC<=^4=n*{Yk}oXBR~ZXV}8mUy4HX>!>$SXQ znDW{kG{oDwfwn#@reYHT7&KTFWP##LBTP& zK6{$#p_@uQbVp`quM+zv?xCq(;NBF-6J4Cw>gr%6|$B;HZ*}6XLw|B&9kfn7z>WP5081p(ShWCqT`af56QqoDlp^xcRr_(BFWnh40tNzv$f$@M_l?fkrr!qcF8TYgCFebho+8WCFe)$1mn6E762gghA(f9&dP zcp}&LGwLi*pK>G-$tjsM_B%|>{pIHY@$FKen$YD_UkpFJVcqw_9KFLn=wTTg^MhT_ zZ`Ljx*ot!D!@drn$mKnqj%xHd-Ib?RiLy;VU!WlSEpwd_SA(pglAW6d2-8`NtM?L&n?C1hg7Z7b-)*=IbJC z%uaY4ccB+aa=-Z6&+IuodMWIq_WRb1t%9;S#0z2b}8(T5CcF)Bi#$y z{@6LUz(Lo&mJ|Jp`L*&}3gbz!Mm3d~BL9ZdWA_#cqG&@QhclKDWefxVzomxlP@)|E sS`hnB1pPnN5beY0xeb@xPa56Gin?wx>wywbjtkPdrLSJ3X8rU(0FMhTzyJUM literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/intune-addapps.png b/windows/keep-secure/images/intune-addapps.png index f6569723dede5a195fbaceec81e8d5e673bf9325..52e3983adf2dffc48e79995b474b40dcb4bdf3ac 100644 GIT binary patch literal 8839 zcmdUUcUV(Pw>OFcB1IIWgNk&dBOOGli1glj5eQWXT{;8;Dj+R{-dg~v(jkOirAm>| zRZ6I#=En1W=N#YneD}G}{qsIqd+*7tSu?*?W@Tqqw7RMyF(C~h4h|0S3ne*C9GvSY z9Gq*932?DJ?=PX_*vAb!nO8D6I92htFD!22;Naq@t7yw(`*CpOapbY&i2d@bC69w` zVIP{Bn)29AM@JQNA4hEKSJTnn+{e|`6$k|S`T5B^f>q38RJ=0m&0`!L!4_{qExp1l zy~3@$Bdmc~inQ^Gvh|6!^^Lak1=;&yDaPI(OR)|C;MW0huLI*81LN(zGMs|m0f8V_ z*K9{H*y-&%r?>B&gFgU*696FzE+L8b;0)K$MAy(H*RUkFu#Z3x#0Ly@1jFpXRj%3X zU`P27FCP#PnCcCQ5FL&i~U9AahVk$2rMH%BQC1~41>MPu6&l+)CBgLo11H&+CVI0rZx^IF_<|FW@D;-V`>Vs zfWS;nVwMqy8&ep}eTs=IU?*gIV6&KR7r#K0ZMo9$sNThgVmB+zv4q z%pZaDfA2QTJ@XBV`j)Gbfd>u_N$0QY8U>s3TWlwlr@X$WmW!>Yw}rb6j;n^zb zE2gY!&OB_)90W zx-_0#ee_!ls4v}7nTjorP4D>nt5rNI<&5_^v16e0@eJ zTXj$JpzSBqrU{V=?~oeo!(kLIc=C!U($*h6xR|j0IY-m>{hRv{J&dgz(0%eSB>O%- zbAWL&vQmC6oixYV!|G#_8(cbE$6uMsGLVp?r=MOkke8VUE-kMS&kkL?T~uhrxyU83 z0xGmFK1-iIyv?QRBGE2?ep}Szhp?U$nH4C0`Z@^%-Fe1T3bVBe>O;jkN`Gj@uFMK) zmk2pUP>kGs2MsIS5j{>|umVV1fi~Rfo*@uyQafPwz`O&;sb&K}4>@D$-HHiWln80L zV?M5DL3mt=6dj0X1lNI)w#NSxg_-UT^#h@bsmf(KPVcMHxt2|X_#4pRLiE$O$Q4J< zi~ci7-DU%?InYMptE_d$%4I^u(lhA}mr{0gj$NSV!GntR5jYG!H3r*A`=0(B+S zWTiCUM8B5Z|IH1SASBp8nI8#`Y=1|Ziag-MA^L+Q+W$mmAR;)$RubYQA~geeREwX zhNZQrfD^hKHbvV7%1ojr4*~`{yA<|0Q!i$yiB}fi(xPZa%GK7lg_k&H_FMO)9FUJ$ zPl7*B?RSVu1WnJ0b%ob(W@}X@M{) zeIJqe-T4pfB2iYp?Xpwzb7lyXsb@Sst4gl3$OD9f;so34io$^LeGAfEak`T0W&wMN zk^y2Q-qe(0VWC@3Gz<+v8|DHL?=+)$C&*0-xu_;{bDKk`@K$*iW*gba)cXDATnfD< zC+=EQHMx7a?r2R-T|EcuXT$jmT*?V6zd3xns#)MF7Y_Jl_ZVlFFYLA& z6L$pOu~~@ervFwxdg(A&qf3-O;%(QSebyEdu5!ec<;(DDtjN*6PUKAV&%;k7MuN_k>zG`D)q*B$* zy4E05?|p0^1qc_|*L9mPxp+3rr_dBu0D=atR;Yy{qoYp+9)m_vdQ1>pVS7J4AS&XR#QmjkNqQ_61>=`=5$Wd3v zr{`zDBM_kB6)(AJQ@Y?EsTMrPQZVy(S>zOTlP z3p|;y%xfy{cnrJUV(7N=z>K@0B@jKH5p$mM!N{#of+o(F{YsG$hF@6c?Hzd5c_e=H zJjCMZkUa&nvNE)B>RAmlVktC~OGB@Xa<=m8=XG9n4zm$I~79V4&O0U1_s*`qZC!Fhyuj8^(Cf zCpStSnmsS~$@Q7v@uz(xn`Pxzmc4|5G z$TjBJQ4-TDe;Z4gw{O#Qh*!xfHi_O;b7;bSpPBx!y%AR$>C%~yNuBe9+OzLE&+<)^ zSmY(Kkh}lU?H(nRLHyp4e|x<}F8YvS+6Kbo?-g%`Z*AzZI`I0o-ZBpDaz;so(dARA z-dl&=>4rrnAHOQ<3jH)OeCg*l81kOerYURQI*q05^`pwIaAjW=@8>jbnQXPM7A?qI zz=gsSA1o*+f&B_alvbKKuNRV+T$2XoBY8LWf4MD~d*+?#Ru74h+^GJ<{Cqn+>UI#p z=Sa$2QxFCf$x3!1Wp>R%M3VJTL`(AaBw{M8VJkQPdr^Z-YkYn8C_ zny(uFtFbrz&$r-DjCnxud*<&Hn86J^qX;%^glhP10baa}sO|8D^`*>SiQ^397 zdOe@aTIwvu5T3jlTtD2xWjqf48OE!xEP}MOZ;m?mEdL`Jz3*_NVGC||Cn4bGLJLp# z(H+PoRdHHR+DfRZ9e`n02(-}{rC?jE|2E+N#PEv|Tc$T6ASCzF|x!i|%B ziN40D2sp&<%qu?lX#HzGupGiNKDaP3;i-AOaCHI1xbg)gZ2Rs%-hbfRdKY0Ml$4#v zJ7E_73m-wDHU}Z$;E46xOS7qI>E*Z# z-GK{zATw!y2Zp#Jebjv5!>uP($eM7nWuJvNt+JaktwG#@F9 zq}`>zf6;T2(+Y~K%s6s(3DlxnibXIun=TA-&R1O8JB@IEF3x2SiZE{QGcoIu&HTD1 zZWE>^B;#P?=sU62%O=|Fnj!j{ok232qIBI9#mjuq%(#@a0Y%L_FiKquppI{!(%NC) z0*kL|cB^{11}~2(dSw~S6*tmHcQT7{#5Cz4&2R9?q%D5+_xre1uV~!wX^Sgu6^WK_ zygRn{T8wO`dnZWuYd?`2m6w&B-|4_D>IW))xr2DI@=aUXbT#Af&4+Vx$%Hab;5`gX zBW>R5Pq#}S**iDe2~dUcY%svL!sZ{RAWn(Gkp}n+J@+@JtS5|bHB!R8h3D&oQzgD% zgTiO{Yp-Rren??WA8EP3#wR+G2pLzCl4pLWz&`lOF5hNcAlYFY| z{pp<1D(q{yg}v8et|&sLrI%Db&k6S8w3KkG-2E236hF?}tMA=ncSMNpSP~bLK~Z%J z#lj{x&kB(<0pSjQ`p5JKccGw2i!Tx0`rq@E6OP+ZC?7U^nF zpo=pc8RD9`GzA2P`MZPe#>?4w1f(nyD<(o~R%NVOZZK9DtzW4FF=f)VSl;1Bbw8{5 zIMhSwbE_fUH$9sq&%~c!I6iWs{LFT1#H!R#(p6U27AAR26+}>$RUd0IsV?nL zR_nC`WS^6X17M*hfFU?Vqk+Ah^I3e)vGefVScA*K>dJ_H0kI) za#9c)VR786J5+74nJN9VqgD31f4 zfYgt)*&Bq0j+|HP$GZS}Q=rKTKbzk3o%aVwI9uJ*O`&+(u;CRG^4&S($*he5;aZ)u zu^yL}$1CO0kTIa?^21y?(w{NjR>^Oi{B4bxV=8}Mw#*onC%5`qu#SaJ5qlYD#22sTV$ArOZ?0SHyXpjKWb5Z+>7>ZEQl`OqKB_6kIdX+l9$rA^4H1b z0}$QknKkPPcBST1V-HgzHFR@#&=u;(GZk#0tQb?53k}hkRNsNsYx_G=(Im^F?$y^J z>d^ZqH!T5Hg4t-}$)cB6-wAMuNYpF8q$Aa7ztAsz7;zNQ^0tY~gwSRSTH)lQAqji2 z59bJk*!AMrpr(RVwOi%D)}#hLgEr*em@Q51aEF?lrs=+~5|hRrtqyN>QzxCh^4s(> z(C4v4N<{{ydp|kOY>6+r`@}T!x%TmHWOH}fug3^**)ipDQH-1uK#W#r$%Q);2k#w* z%od1*XEu;Y-Fo`GpPBpep|R~Zwo6>6w@iy9e*3&VxA?W3inP3DYhL#RbI>rQMGqU0 z>V4A#hFHN2|HbHx@DRYKiXf`eIw${F{ak@ z2l9c+i7VE|406hNXt%UuFWOW3w)`OgW!ddia1n9qVSVJw-Y?!Yc9|V@SlIj z`7)6QdIwqogm)M}4XXx{FvMm+2I(@}=p52AWq&#yojtQW&yfmn3I2Ba-uDLo27;{y zQ+gRmS%FYosNsLA(1Pdm!XOqYo;ZLYbnf{{Ki26WHQP)9nwHLtIz+w9v3lS2^(?tj zY_Jr)KX^poqT9&xc>85EMbPyL@-`m$2!Cz=a)wbcI(43)41EP!S{H7(AfY{t1NTO5 z9Ie&1;w_h*u#pJer!Au~%T1V<7-B$&`yL#j3KPuodh$4#mZYc-8b#K9oZ~$ zvEPh9yE}Dur8CqyCUs;S9NYazQEzJ-wKa1RnHc!oUdew*pPaoF!LBRh)HLu$SBfh( z(T_@9tv>O1MmrNXn@!}Uyl}#}6ww_6h9Ls2!#kMh7wk}`yH-)sN;ZJNelB%*qYfx> zXks?YiA>C&8Ikq#tn-yBt2!RO+~@U4_5HV#p9N>XJ#NY#H)m-UQus0JaP2L zp6urV4<3NEfju;cmwlB1>hjVDP{D&&og|CQ<3a-=_3mjf@?veL2OVVl24y&X5y8$ zq?rN|KD0;V@>!A}iZ-QwJYFlTM|ynb;FsHeU`bs5l+nWQ+Y!~ZP9v4lYKmmH=obn` z>`+7e#z-AS!H4v4TkQhV%WUd2Ydeu>0FZ@!ycADGG9_w8P-T?tu9hbXx1b4A(G(W( zBbOv@p?l$mvK}+$-9sH*#7rQ$q52iQXR)1=jzHa4C`tEYP)~~PGRb*%hsI(Ir^H%N zf5Fx6_54Q`!CEY&!%C=A{k1@6dZ8;skE5yjIlltvxm5wcwI{G=LWKP`U?h!m$&>gqFCj^VGhCU--mj)iG_xeV^(G8&<@=Po;SrB4P^r_nfpKH6f zA9PQOruybrZwfOkB)kNTw?(rzxLI@ZT$*WvCwkaIkc4WdnRmxzQRiojGj|Nl?{ySM zP=2}6hsPHNP#x;}1N0TW_E@an@A|h=GKyK~+^da&BucjMiNaEa;{?r8^+#4KPWkUA z;yck9OtKxFswE!Kw5yMCrH|jBQ-bF{W8A`5$(}M!ZxG-W305dC-?Udks6Tk<-e7UK zo8?VjnMMe4m3JF0du?uOb~*ZhC{d+=QzD7eM#n=A)ewBvKn9A}A?D8Y$W~el+VR`C zS<7RU$F}KF@!HVA&ZR569(lTML%6~iH0`H;YsD`!dfKt^au=K{vtIk9hgMvHE@+16 zbR0+)&EvFJ&&sWIn$Ee)``M{DU`IqlIQ0yvlgE(pQF4Yi*bh>0D{X!ZI24X6PEeTV zOk52OOMU8AT3G85gqywYQsK#Sk!58J&Wb@{B+GZg?Vi9DhloN)KTCc$Z8PMJ{K*#% zA!}zZc&V4fiWh(GM#15>$x2&N}-_e4DcZ{bG=+ z8qbDbbkC!+3KD$CWP5BB?di!W!jhoqU>!it(eU(sHX00htYazxXy^$9b)%cqa( z;~VMxUj0sVF{Q)&|9>ti?*hkcWVSA(bnIRvF~8Zctg*4(QgrccO%KH6X{ zw*<8b&_{)?dRKE{2e{Z7FzQ}B*dnZ}M+R{YoWYRzFZ5t76qs~_sYnWGrKXTtq+Jh) z@v-hjaTOB3ZytmJbN%STc9?V=>t0m;DSrG3)b^>d(MO2HWzqktRYKoE)2J}!V*H*D z%$~(ZD2bJ|$!~2nLaWj3q%2r+U!MWO=fQb3ozqSr6}0Q&W}J#FRJdBb^x+LwK*cbi z-|I2?N|}O@YWwBq_J`FTpUE>roHxtSX5f&Hr`M(n(CqJxPzbj_x>ICPRNJ(bz&MQC zeCGUo>{#1AzPF3zX65F^IHNN_%FQOh1Id)$EMacwanaqY0g&owU<^I3bXvqn!~>d< zC;Bjo`wS-nw@;+JR{&GSM9%PmnMq!9Qxo4G>pCO^B$dr?4)`Pz+*+uKM0^;-%Emsp zoMnrjEbnoEI8US^4Mnt>>Gq|ZjPvQ&A70lBke3(U3D~*29mb=7?zDKGFxbiUvhtD7|}EnddDk7$$~x==iumbp;B;OcB7XTRpL(RcBa3T^j!A z@r=qW>aX+HzTeqfI>c%p`|?f7i%RY>W;SwM*PFtwI&p%bZYuzLG3}@W0;ZS^RMsP$ z#Q+9n+dD-$iWh;$_@k7TK6fumAK_82&#-4Yb;mv)y)*x8)H_!_Kvz^&6Gn`6^?-)) zbKfoumAAx_s55VZ3h^)nlSdexWyq+tuyNX~r{StLbyB^LP;ES68S9ozSaX+E0SoK+ zDRt(`8oAmyr|J6JcD4IoIEaNqQ4;hn3Ne}+=Za&l^R6-QgtC6V=8^|bceS+TQSp1h z(V*8%l#g(QTL}wCmI{&Y5i>_fQ$Wp!5NDAVB(-({RWQH7HGvrP`xz>G+lSRct_pK$ zcSRLb@5V6Qh$SqejQ+M7<0wL6!WHEJBCQ0brbfQFfB2(k!Ho-e%}&%1-BoBn*)@<0 zVqDPL<@K&czM%%$aSuaoa+tb2S;gTIZ2p=q8Z+DMuER53hh)^?k5GAOl)yC2_L7Wm zQB&e0aaBnNZ6>Rx4%z(mlpORSD0%Cyo=`E+)Cn)N!eZe=?#-p5%c$U&)ZDtRr7b1V zqG_cRMvQc(=Zw6m-uyf{P40AwX;ZTK19FMY zk&Y4_4%+T`Ms+bHq!81(JWMN#I$5?PGUM)5-<#(5YQIScT|^Hh73Ab_)Kg?SKE7&- zSu*x1ps{;FScl#8L3{&eO3p{2xj`>QXE~KG$-{gj)%0Mx7lYVTU=4s{o_{>DfRlcx zFfT`^iY6glLGwsh3uG z9oW<`%LS&s@ke49v33}Iut_)t5-uIWGK&AjFhtqbR$&V&zh>+mPmvk@V?N-=9-hv1ncYmiToxv95bTYV*f>zp~f^EEpNA zZp{YHSjLInzX56e8%U}VYAHRRFEopDW)Xym`wM#gzf08p&9MDzD)9d+0rAx%+nE2g z9(E(WGN2J4_?0n-URz;PG`2Rhl=8;{`kaepPqAf-m_`Z=@xKObm!m63{?N3H!bO+% zx3bc&Il2GV;kV)j9BawBzu@Tojq`Un{QnUBwJOCwpqWAc(!Kg`qx|yDpT|AeAbwf% zm)(1QD~Ms;#MAeun}Xc_;SI`vTIyFV4QmjycmHOPU*)u4T3!65)yBUZ`73aK(@I+S zA6oq>3i%s6)}xsjf6tG_U-Ng|{0IJ#!G9Rv5&%CJ*ArlCWgB?z0uS>3rIxUr0rqDn z=)7Zu*Os^WR9dqkd=YyjHu|THeyc_0v?0v`jg(e)8=i25y45@=LsRSHt=P)wqXb|? zJwqWdq@6i+Z2Cc2SzB_d~1rgHcsIRaRAG!nQvXv1)+(sDpSQ{f~gF=6UPK|W2@MOp-4{ML%XQ+`t z6`BnRQg|Es3@eb`35Z1U!KDudBeQ_2sFc}aU@PFP*>1eS;7+|Ms`BcwQ9zj#yz3jj zbe#A<^EMBx>0!a%mFj$!jacJOrYFiSrYIIW+5z^YDn5pV+ zaImwV&S@&h7`SG5Mo$dwE|H{R3*c2~d{o79dy@dSV k)FH2fgbNt3g(}9SJ1otFe)Cz_LOIS0c~!ZJ=jI{*1uw-)NB{r; literal 40662 zcmdqJc{tSX+dr(`Qklq7LQ^E!l0w#ykWiE*TL{@hb~Dq0l&uI!C_?sqW*AFl5JIvW zV?IV2j2R8aV9d<(9xdPR{X6dad7k?@?)#s|adc#+_qCnZdA`oq`MR!mPp+C8?BhPn z&B4L3&&cqiIS0oMGzZ6aJI>v}H`-($AK~d8X#4JAE_c~s)z9tL6XU|*sH-<$kl%F&UJGe>*TgS;<%~PO zPe5<`?B|#9CY#4k@0QqUeJdCAiI0%n^%tOQj6v$xRnhzN;r%UL8W8!BOkZVU}+ zsxz)ozlf%{Z389;{FI*9FL$J$wY=xoM~;$c-S`8}zdl&o9|ac8{;52r6Z@;dts4(P zJGQ?2P`ne&wgv~s{ToJsx{*e`AC32;9zEWVYSExHlM`74R@ClGKX@0Z2EHA=aShZH zn4MdXa|ow=(#{mXx74$CoC;7s)k2SGSu}Go+q{*G-x;2K}+q+-q`0z&snn!Q-++PTi9ywhB| zb|GJ+jO2gW@cvBx&zO9EeEHY?AAFVIAV0O5_s7A_%ukW7(W>d6^XDE3;jPsk#>-as z!25PT=G}p38l66Xcip+pcBuPY$7vl4+C{0y!Bbta(V<7$`S7|i7+L;$q+A{-&e={- z$zs9{tVL?3dHdil?fSJH)(-a=S&CD-8ek#3%rUeR_Sm>j4M<_8lpgTt*Vf4@L_acJ zl^dA;!gupIH>N{q2|M#(Fd9mOe?J9R(4-zj*TD7atn{?OGx3(mDheUn3LxlW_x5^tJ0DzS`Ntf$MMZ|<&m*#WI94Ni> zl4n6IjL3blPL#`1_OvEOa0T^Q9NwfBiDkSyelvaE_*uC%$bvoq6VIE;i1moy;BwR- zt|q)?>gY}gv^jnMoaAvfTOXAQAtyrWCacR(>(pRvb2?VEuQXC)xQJ0Al5>;-_YQcy z=fLU^t+2u8P99-rv4lHLSvx%@3qL;07Nx4`A~ z|A<|L>f}5zIU!heeb6D^;G3m!!o_zI*JT@;_Bw`m?&S*_>?}3xyi^?NX)~I1y(wF( z!}A|FgcI{L^vmP7?vC-G4hENN#JEv>pm28s?>W3n8Xtb}j9Guj^Hs!bo?${@vtL2Q z4hLJk)Ww=oKb)6?UT&fNmZcP>%af$m(&qfpM~}yvTvqm)3HZ<;e-2X2kJm?}KbK8U zeyTH_YAxR0b@_Tr)`;xr{CX?$+x18C52a}9Y0U2mxV)sX`Y?Bq5aPeAtVbZO_b{Rp` zpkh&KJz6=B+qJLC=<_>Q>#Bt_v%>mBFUR8#aw9`>EEp!TBCD@W6CACTSG2aQzM?ad zb|{4*iuZRD@>1w3yE^nuCN4MPxx?`@j3}h`qZy}BMPUh#V`7;vgxk7fic~d)@8OhCNa*Bo^bX;h`;SkF);6!6o6EU%1>tpD?`D zC#-zoa)CL+))QRLk6b%)B~@HsY|oj0gxl!DO7aJ)zCKobzoJql8>BU4zGCC^onh4I z_G|Ahj=Va=FONR-NPg1A`Ouub%G$#w)5K3p*0<-!j~IbGg(1UoScjzVx8HT~qDuEW zDii(IV8vffPtcmF+Z_(2sCDl9ly)G_-a_~FM2pr;87L{-ftLTQyJ5MRaD>~%A~14k z+GqZ9s+pX~Ol!(ss^=N1{A{(x&TDy{I5$Je5e-W3fjX)wQ&osYJ8waV4Q{WJ z_|}YKy`sr1f|P~Htqf?*a1S_vv8CAanmeXk?Vu(k={1}495!g969pL?HQ{`50LPDP07Gz!&eeM5d#Vi;T%dD$7b!;J~HW z!o;D|>as7v4jNzfv*Y=Ld9GJad>fDAhocL;dM2p7JW-*M3rRWPR`wJsuOA$F&8f)# z72qcFpg&9`_5Ups;nLmvt8ocml<=?LEG7STc=fm(7q;?)Is9g(6_50PQ;QE0O39#{X18JN%-VScw3L|k zbfRORTL=~&% z;;HQzzs%Ae?+ibch8rk#nFNr6G$#c=RtMEmcOOC8KMC6MjLO>hlW32JgX4r7=M&tX zCA^QR)(MtuZ}qWII_@JW40bSo1;SI8XX?MX_H=eu4}89(+t^*!+3w!cx%|6})29+R z{jqzi&_ms2=(B0rx_2zjkaChL6I7?)ozt8F;q&tq!HGN9zMmUY^fr8IK~+dQ;T~jA zWK6GiOXv-Bd$HwRuihL0_s-OXw8M{~&pD4<#Xg?6bjD6gMX8&Ul3aaVck`<~v1WO0 zCjy#oqkLjO0=@C(7L*~+VxCS-% z?4MuLj*^Bw7W{beuZOx11OBR!x!Rb{=xQq5+z-tIHI*@!5+dWkxwNTKJ*@wiw$E%#6oL)_UM zn(X`)(O19;+=`|0X_sOn^sNF8_gyV;Pm4$|>?&%uKH*be`!ns`uooSfBv7^R{L5<{ zpP6^A>b?~QNS@l38ySnFj+1m=w(U;K9Yvp3PT=xCaYsE`a3xu=E1=*ZCAgBg0Wa*yf?mTH#th_S892fBQ012=0Zbt z5;vYH$Pjs*eTjR!OV47eE^HNew{Ei0%+fMef06dULaE5%V%=md|2w2{E-#kE?TyvZ zk~xDBm{?KHHFqC&yF6;V#4uirNSx;p=Z>7M3Fa6rp(!K&_*{ z)4=IY_LlvI^($vM7325)0gAm_ooq434-$|5x0+lzt{eI7i4>CG^s_4E`}YlQb@|WT z*_G`+#$}F|dR09V*jSWIymk8T91}PxZ=@_|4Rm>i1vT z^Pi>`8$R%`+@RM;v~8Z*>|~nkq5a(tUzTf5e)6R{q;tx5aOd)Wb)NsQ!%uS!a)|bry**ewsl|{|_%ci~c zmaTA#QPoJlV*8-1c8oDq{`zXULu?H*vq7^!6GIqW9{LxIuW(hRPgN_xkLXUw{*msWq67k3EYeY?Tr#EV&~h1nIBf79{d1J2f2f2aMw>NHm#g8KS;en_o<@ea^r`!`3a z1K`1#Mj(9e=4teltvu|+0bN{*C&*Cc6YEP)!>I(g1#TE98(wL<3-S_scahx=$sA&i+ z!8Lg35?Y^b_Sj0EZU%tC%s(L!)H+*h8LOUU_cT80={5PAm#bu~zsrr7aJege7Z{r(VB_>R!bFF@uFAdxPE3q$_kTZKV+~gJS!?NcdCkvuiFdQy{+^N- zw8!Pp>(R(wANzPhvig_kFaPkYT}`hPYGob^8U7+HAmjj#L>?W~zcF@c%*ytJqp$o? z8KD>J%GgzNpCP-oq8xwQAPDbT+@!NTHo8%czdavk9qr;I&SPt4UCuKWK%ZA!g3ut< z(*g-eVi>59c-p<9Cc|E$Q7TczZF~<(ev&q*EIFi%!dPy2_r`H1gsp*2-Uxo_a;Ue? zX22>!c5v~k+56)`6Q}5&8`m(8XOWv@IgBxo%QZ-oC8iYCQ^FhkS{Do5{6gV&d46~? zyIPZYrUBAP{5d^hZ@JpnY&qYTe+Uso9Nq|2SM#0EoG&X^82@~-qaeI@D8VM{YH`w> zi-VX*#1}o$RM&GZvf<Z4gCWW_&5O3o0$17V&fGwxl1*0!oj{+=Gi# zKprv8j1KjVLEfnmg060tX+Aj^7@>GuA$O(m1;>CxK0}9CEOedeEDO^KF><`M>Z|^K z(Z4C!vEibN%AHbOQNZOG+{9XMsFqjvNGi#gwtXG`~3$2py)Pfg!CCS8Op86bGMe^S1W!Z`dQ5-40HUP92lKWW$r#icX|g;; z=NHeps@1RJm?LeglIDLN^Efo}I@~t$38}K0MZWI5TEOW45&hSo_%%_mhy-9l$ERwI7CtlLonAi9E|UMR0md{ z#a_KRBrt<>&$d;@t2n>>auM+wQ%1bP)1E+M=tnzp3MmO9yJ5fC?yARHL5z_7-V~Z$ z%dzM<4a(W`pD+CShGlNB50K#9zz2nEeW~XkK=DG_&nhaz?NL_< z4wG(-`hzKItGNp<4py^%`H>SUtVVAHPI$0R22Ytg?^b|CW<#m%1oNZ53R>lqhOgYCziU$$}Fn(L=u1K3BNQkL!!dBF&UQ$dQ;3U9usML3B#ejks^g9_;d+t)GYqdn^! zn}n*?;lVax#v!zDRgo@u9e?$v>>fRs2(tW+g0SrW$L>4 z`jdtcvAZCe-H!U7QqnZz{8* zLPQ)TZ+Nj^At5X$?ixlsb>H+m=;N7BiH<>yU!X5tq!o2t)vm9oF0UhYPKogbf@PN zuz~0m?OKr$fwYpGq2?I^T+S9^ay_ZYM@7rMq=MJNy$6aJG5L^9`$RU_9G{0f%GNNh zjjh@3TTvHmn&zh}jmvAL;~~{_i#f;K#`cN;yF8zTC1g&xSUWDsriZzWJ%tKEE6>h4*OGM`#T$MmxE_7hV3>1~&$({=E5(PP7_YqmWdHkZ_qRA{&n@@s zJB1pIld{?lS#5&wbNN{DD`566dLUxsjH>wy1$E$4)C9 zNnh?GbZd=^6Xp=*OUAF=)+K&Z_YV>lsx~#c3$9AZxGpsrct2@KU@G42cAd{NgH&V2 z9g~S9Yu%<%!DM?#SK^<^;A+wC&N5jBswj_r)}StO^lSuWK3WRe;<&&yq#trtFJ-yL;!qM zS;umR{YTl`=Rxzah$IZRu4j6QcQwoNc#v()0Z)ad8dv)&j>3@}Fp#X|Y6{1na^=d@ zZ9sP%x{Tek?a{Ewj=vkkNjaty`)8ahAiVxVkXbs&vAXgf_+rE7Ao${zihM^C6XNh) zP;kFgg^v?ZYsB}Q<)*+zQ7PTqI0`Zz?cqIR+ny==fI-+**Oh#b-*gfeN2wODGxs}VyhbU%b+Y?& z99yFzV?@P&3uG_%|A&VPuEipLcI@P^1pl1_o4J>m#46aKdb3bY2CifI>0);YU&tmH+vyJss7`NPk)JPW+aC|+$#-arv)MVOH# zW&al5v1anT_uNHhCo-HcYXvknp;`2y;gX>GfWjO7-xIwd4u@JTuR zh`en5%kB5`-L8Z8n+sAXg!>!b`8M}hmImLvM&vrQwsX9@5Zkc_ z&^j_MfhRTIfgTfVgBRzxt6D&3gtTt-i(1A;D171INPFcUW!?R7HrU;G52wGK!NA_* z=wmCAk_cx--Nr#WC&#l~+&S45c1JcO-Peu>=h6$8d5+s(h~{|ug?6E-lVxDI&si6RUyReQx~v}L5I1$9b$Hf@fq zMYGw%QE7J+{mY9BK_jqgah|HL(YIboa|%J%eF8)#qMekTc7n@?Kb8e^RBFT@N9)2` z7M6a}Oku1~I7OM<`a5Z`=~qmSN*r|7FBIXkj5x!S6c+jvxe*jXDV~6Cu)5V4x6>%34+-$ApmMi;7%ZssqH2fxlxKgQmq)*ni)`SKp z<~np%+Nb$BYADQCL6(z7Tp6djto`BC55n|dcscH0n*zEz z3>?qL3-5!GNI;Ed_}sUg{ft&W!E9UuVG8+!tO z;m76xIPLxJCr3ik&JBtfm*;bVO^3wO_nG&~4W#s)V7}z|aB8cCH-KI_u0qZ%?4%Y# zW5oZP(TwtA!QcjdrENEw*7pW(pxR70{byF^;!o%KbjQq0$1)_8%5)pu7aiEj!2KuN zz+%8mRVS*w{f;N5cYISVHQaq*A38Vl<_NZ6341HGX#HB*3y^z~4`bfT+KOaxv#T(} zLjVuJHoHCi69CL-PoPWo^q5v?t(*ML!=)N_t%LakO-!cu_E}&Bq__Fd#DF!K7e`F)iOXyd^xG&sPZx=~vWB+6P>l$B3!1+NS z>Evcy22TRlQ)FX~qA>_R;7ZGVSA6{A*O_+vJpl1>C*Z5jrN9c22Y`lY4=ltY!voH* zJOt^v0I3Va&qGnlSq5(UaNM`N57NuKQV8-hmfv%K%8*MD90k(-d>KHTb|Cj1EijF( zXx{K-KPjN26Z_U5NLV8Pg^A0}0kIaTTW4>wGMtLC0Da~_Z_$jeCqT~DX8<>g-Qs6& zOpc-}Z?i|;IybqH3DjGifC77TOQN%eL~b-K2C!;fx!df4>T_lBYUE;aXL zy*0+wrJ&Y-;H!;d>f zGp7<6@6Vo}%;TnnfE%Y2Y?r=Gk@{j6PZm|sS>0$qxBe~-qSZVP$!v=_&Q1iB1WV-E19 zRs~t<7ran-5?h8DJ|H1Uc5hUG?|+`w&}d@Y%YAjC{SBkW#ku=&)uBN`C`7xTUoW9; zren!<%zuzYA}uji6&$1%gxjYvf${>R-GgM9tB?<)U0q8%JkjQQVY@p(CR_xwJLnk| zL>K^KvXTylIkej$J=x29mU`s~NCSt;kJx+D3CzP&UMzYGnG&%Ylmnx~F%vE-enEcY zp{4(l$dUSAo|E#-m9=v4_vooQG@1n^7rbv;STf0x^G8v0pobd|eankXkJ z;VUC}IJJtj=Q%ecQPPk>d@iHsDT`OrtJlG`Bx3e= zZu@X}*(v=Z(#52&dv)rX4sVNpr%!+G*)e>s`14AdS==qgQu3hcnk(g{K0Tk=LEV3N zz^VP1WOD1GW3HX0w1iUF{bF7QH8#rF5mpIKC$GfT$gU;XQUXJydRQ-X5!u z?rPVSiJW<5r?9Md*VBafPKMJ8)3epQ-kH5$IJw;tQF;p9G|e}wQjiy~?|LL=vSreR z&kbhr9W#Sj5upu+7S8j(wVU7Zs4~(HEI95!dN==G#PQeMKFTeVds=9LdX(?ELzO0;^{8ZlZ)_-9#7W{X;mP?nFhBbj;y6Ne~{|5%v;t$hC2Yu_XF@Sk5_9 zczFY57l-xbMo>s^uwT=N{hlQ}{m7zN)#|6NkQjxC4J8IE)ejpG7qJp!LJot4ReWDn z{8u=gh(?+oet7z(G*Q}$^Tx9S3c_4r&ox%~^RJ7?9Kf%^hoQPDd?yqQUxgD(ODbUM z&Kh8`iH?JM3Hp~~A5XSitiKJp@k(ToZ^#Bw!5BYm8f&1y16*7P1y2SiMqrv2C(}o8 zgpdh6LSJysS|2YR2y<#5>@AKt)E8-5g|6?5+&mSsR$7DgT3n9!4}snu6?*@Jb=Y$d z+O^K1+u5i(7ldxe0d)i%7(eBDq5?4v^|LK5Y_M-GJ=HVAtNKLeVH)4?p!Hht#zJ1~ zE{AvXNlC`VnnOcoe2)*sHB4(SF!S3@yYT_RUs~61(S1h>+w%%>hfWD?q?ZT!YZnV7 z`PnHC0qB?C&O=FDo>2e6e4~)0NxB}g1}4DIuf3(zCeH}Pa)2rFtw3tgJ>+MnR zZjT752r*M9T%oP;3`^1_|HTysjy{mwnw9^IE$(|_b`A?U6tKMZMPF;ZoMpIb{D(#W zMJoI7c^o+XGzNrBj$c|)?Z1X+U!=JM9IyQ1BrE*v&-YU=u-OY6&WiY*bveON&r*R7 z5&%weVXy8L_Ge|_rpp%R*$qAca3DjGM%Y_{-~G0GhmI*E$K$9^7ac zb+Kt_*)flpHU>OY;E#)YKx2@GU}3M}@714K$&G2Wi(m9;ViqZ+5mq;S zB&l#Q36d==!(Zn?7aV_2uE2J@XJ)SgzFiAc%V*h@wW9HHbbah>)8#XK-}6m<@uOoS z;r{0y4jA|j27A&s!k4eloHd?^$+iWTANZy!-D%-iTk7y*Dayydr*HTgImC~l%zT-l z?AEW+aq11BPQNH;pl8_KI;`r0WzYe8-rHFq$+O;4y`%AW1PsLQzA zRUaIF`ItOl_}epoprYoi5;{*m*SxVltl0UbaiV>WaoojHt2^7_iFU> z{R80&)>Uuj>YrEJRX$bzr2J$w06zBAaN`B3u!|Ry?c9OzK3<_+Pt<}lt`wWF@Y7D1 z#3a{n@8x^MxkQ(s9J=>S4+F$ZI^=ZF?QR+Roy0Jxj5ZsQe1IL;!n7+QQK3Up$wZAu zQ9(22S>W;ls|8?}o>71j@HePcM1JFY0s^4T2D^o97O^T4={r8$J&OJ>p=oP>*#QgE z9T$!gJ`CLCxG(%~D5aF38!4~5xAG+DUvT#S)aJj7z*~$o4g@0tY}=r`VZ3QhTk9W( zjaP_<^p;g0vfN_B1Z0IjCl~>tWAvrjNMD-v2Q_MSVp~Ezowx;26ZGtk@+dT+}{dDK1?gU^16kQwRq50 zB|~Q7)%5UfmVIaKTV9}N!-zlo30#cY?B$IdY+~ZH|8bA0__DO)7ewLo9#W&-D@H$IJ|EY zNu8{du~!_nNy!fE)9k}8l`SGGu%RhAI?byML~Lu$=B6`I^-&aX=Wp)bCy}BI4>^Qp zaP9Q)y~H1JsWOSKuHE74UQ0d^2$i4+r=IjS*BdbF6N$k-O$&NzGvU;amzyt+k<$g- zQtODP=$C-i)&lAH7jDS_(zY1=9*wFS%c2ogP$Dg1nd&n-`Jfy~Z#~&d1^1&IH6>z` zQ8JOP1cr|C=U91*N=d$`e_D?0Lb5*V_Quh|5^?@!{hG>^?$+U%YX$k~W*alNTs8iY+iG{7P- zFyx->rK2I^huj+wO+*M;X6y{3tJXK8c{9(d-W~9vwqbvB-3*>Lsl(rP`K-^wnZw_6 z-()2WP2)|F#t!o3sMlQNtmi%5X+e9X(4Hun>i*IoSzK@$s@gscDa&Rh!++wV^c|>W zLvArZL1VRG)1a=ru?s?O5W%MVBJ;b2l(gun6{sY8|9sZ9vci^?A#%^+#sy%P9i+=H zyESS#SaBDyD5rXmmo@S-MphO)i%A+&k1KUGi}PgOwf2JO0hYOex{h1WFz^RGUZx(z z`%MOvsQ-Lf*kH!!6WY{9tyEoks?BJtK=#?ugZhRXk;C1U%(46=yP!JTwa4yAOf!Sz zOq_g&t~@wC6>a_8u-wL?_n=HMj=TD{iX&DAo#l-oTO4n;yc%dzzNlvy8CUD<_qLoI zGMWDMl71{t6`Uc#MzF(wqxzupOqUs?odjF4n2^$9*l1gnVhXi`XHuCFZQ+pvCMxww z5d47e;_;mCT8w%HLE9mN?beOg+^j#w=MQn;sfho9(4cX9HZYOoN{9{o)W`KRT(r}= zrOFYKaM?wDY_01|{Wxykn~j{`e*Cp|El9@7o?#P0$; znjlUxeQCUX;ZHD(pB*So7;PsliqQC_iITM#gn$xl^`(=!*{S08;Xg@hKyZujast=9 zxAeU}K)3tfB)I<*83C9xbJzz_&vuH40a)aRrj>JkK?*PuX2NzdsGdG6rA6|kuOi~i zft}{Gk^93IJRX5yl<|rNq2~D>GHH=sN&iBq@K?bFl%VE**iH=P(32y&QQET(ORo_1 zUM=B}Yp>WGyaYI&JKGD0w_!rQSJ+jcwFj6vk=~5YUanyMX#P1voJdds0Dog}i2PJW zo7_L0>D$l=S&bWMaBspVkY5p>u`}ZBI^g-fC0Qetft<5zLFTMiK_-Ms!I6DxyT5~DGb>~46A61Wj3V2@;N-hEl+$M?RPp6GY6 zI@ou(SD+)3HF7UekY_750y^~;4`4^Kd-En0$cC^<++he~pJO17*-J7iN0Cd&DORv{ z$XXXGSRs;X8&@{{UDsQbI@+HI8#ppzYjrtxXtB3HZ;V;mx%!m7Us-?l3%Dw*wSsg< zinRFG3~b>$H3KHTRnyP4+KT$I-AwMHNxd4S>OnaM7| z8?4P8iDJ}TkMxKl&G0YUmcX4-M`gjm+{Ugn(ho*ymi;j4n|@~Tz^aN6*;B-+Nelyt zrL%MHm7D*!c_4WGsZPt8GTQ$KPEmmszavuA#iatm^(pM6Lk z{o6joy>;hy_m-s~T9r)sigqz|CB1pPY29A@Bs@_Gcoz?P?3Gl7-eOg82ao$|XwR$p zg_7#Cx^{3sF4qHW7cY@!M@lU>pkW(P8z*xMA?vWkHY#rT0b9 z(+xQ7;J6KLEzIqO!}YoeZZFWNwQAX|_TeB*rd0aGP?_?apY_ z&Bw?5_jT)My)R}Cs`*s3!J$r=SXy_lAX`aD`IY?sZ3=Set{YacVf)SZQuXevZm$WL z1BHu574ZugfsrnStQ%;PvsdvhkXMe@q zO9}H1wP&Yzr~CgsEr6W=e*b`7GyIlA{;RL?bN~GFDc^T7(d0=`=ESG`^ajyP{7j0` z*5nFPshMzOZyG+d!hR7R1Ydb!v-dv~6~5;)gVz`~sz{ZlW)5(6j7#%y5Zq@O_K#fV za0N-)_JDKT_fXr8vV`;`&i|mpV0sdp_Fz9YMJN^7-_7JB?%<@Xa8fqvih^$Zsz^$I z2{8Vs=d+jHXkvD=2OQ*T=-wk<>ZtwT?427tlyPe2DW#4g+XBSBu0ucCCN3rX`*QJu zH6D*q_om*!8a+BDyL<*-o!?K4$^xgIOn1!yXCK*^IFn^mA-2b+oUva~X{(URz;A(y zf5h`qu?bXOsDl6|w4JS6+%WY~nR}NQbo2(a`h5;~c%iaM|M1pke)jw&`5;p5Zcj6~ zAI5`d$)~h!eide5#xKfGl4#Z+ckz8YEH^;$>0brT^S=a8WQI5?5?=}G=;yP(G4&ieTZBHwqgM-(_MhS{Y9iDq{iyTbhZ&o4B-!dK)X zYMA<%@=~6yO?BcVP*lzaB10WzkebXxOTy6Nl^)TV2B0;>Y&fyBx;M!v;mJb=z=e$0N zc(=bQEzqb#ToI}kp9*>S zw{?@2*~D-Bzrgo)U_635QE#edS@73$t9qXFF`xjxkFBXBb#Pi8F)cj*AW zQXx2F!;<{S$Lk{a(tWn-Bk`wtDlv*JTQEBDh_hX{G|1_PiX7TTy+Ga;k$PRfuhjxm z5U?=YUs^DA@$8L?@?GAzVuV(bJlaVe)7xK~1olj^EdY9xwfdU{<3KVx$D$c+KTdax zRDOFUh~KQjo~X^>8(H$0Y#|3nzf3%ihGv!~lF!hOJ9-Vj^cU8Nt%(ZXVR?Tm3v~nU zBmQC~b9`G;#1(c4{(ma1{}V*?(Z9pP)|odu=KgD;x4a1u}U-LiJDgu3Jz#Boo%2wbN zIkSjPucroEY_C{$gf91|d_T)Y(QcX@YCFzuD|;i2$PoN3al5^WS~F5mwbVGq4m5Mu z`bob7zwHBz%A(X)$ci1%Jt2v}K_e)!pfl1oXtUPaY9=E$r^PD< z>s>nb(>@z$Rfoct!bVV&Gf=7(Y{>CWJRfPK+hO&LHe3NpiNgw5*Nhg}`Vb1;XsOAK|lpeC#n)`ZA#yi1nsCa0T^O*pf%f!FTb`#xR$FEvfi1d7ThHZ=41EoHV0VS?}O2a~R_fz-v=0?1LG3>e269z?`q zo21Za(5a4FH*G1K9I$wP*8{Tl!C*Ud_A3}LYd=m*W>z7r(|F>+jy+G^=NkXnrEph! zBTsu=RK?UL*(R(2)bC>OCXN zF50Uu zBrFOMnr0w=AKjrR-jx^;54=07p7wOo{Re>%=N<=~+Gg8obXm}#n0x;gVdBg_1!=L= z^$ysk0Zj--5n@lnuIk-kF3KVI*Hbt<>XY!#NZr!7Lfm>5PCD(y`WJUC{>cw0-3j>S zHw8v=&dmPxI!Ail_*kI6F3So=wSu<$@*U?IYMTwXRFk2$he^UQ%dC?L34W1z^atW= z+i1}Wk#DWfsPf?*Syaam91VgaG_TfG2pD%ytoMej`cTzlWDY@2=a0C@GMR>I^SO!} z89D2RXxX&JLhCa&{d=4vRu=$=Gy~o<#9rgirir^@Y|k3Z%9^q;6#Ic>+>K4tuLkK z0{hkeO_uo2`+L@S$`)D7MH)-UzjLG%CyA25K6`NfZ$ev6UItld9jY~vz2a{Swl{22zMelqK)~n-EIWJ!`o4t`ZE^E`JE;02YOAXd z63T&acp8OckeQ7m>jg~T(aMiKy}hfPC0YypL}C(iHfiFK_~tEI1#6?C?bT+hGSxOD z{Z5lZMRIUm#YlcHSC-z>VXt7SJ8adR!Gx@}iU%7ciBUUFUL+(jcjJf-v?ZnLhE%PK zu0zcZX5l8pNAIDq5#3jU&OKirkHqEjhSs*+EEq}e0iIN2AudiAkG$JB5M|9*IQGpR z6};Y(J~iy$^OCsZONyyl5ut=5+{X*cSOjjpg#BdiI8znS0{v((m3#Y(bClICZJ-L5 zH;c?5#f#lX!NXpcG4UdzE_M7`rQi0HhnGX(upLk$0@{t+sL)vNG+QMUwR^Le45&?P z`xU}a4s$MN!**040p*Z)voO#hBx{x^+{ND5wGqqMc0)uY5ke57Aq|oYi4#NTOCXl4 z+Oo;x_tKw@U&B#Zk2Su7nJm|Y^MK8vV0|7U&z1V!qt1=Qyy2H z!D+IF@#ax?G=g*rY>x-&h~)D44Fv%w0Bfv0(iS$I@wstAov85O2b@g-R_e`MOJa@o=@RkEoK+VuF!nx|CGI$skiV)F ziMU2Dv3r(sbMNmLMdXttw zXexmyRiqO_B#1ylkrDz4fo}v|d%O18=X=k7&vmZv{P@Eg|`AMYOquZAI3!x)5XpI!)bKh?UcCtTtm zEjlcsoz@~alWqkeJ9&GwY5&NFX8K`@}%SQ9d zvFs4#na#Or#;H2)L#cMPKJzQ^&;IZ|+2cjQ0|m5V%F)Y81D5g;!--ntRnoEj)<%bg zFbb1GWQ7=K!I=K+7K74p4t)Iqi+GsxmRw@TPpZ`kfhLX z`Bc$VUUZ-Gv4eeCOC~UqDS=YrGdnt5)VNfjcqP`z7)RP6t;9}{X2r3XeWvEaX`j&xCy!3I2lx$X>R(|yB_&lw{HAIZvmnyb53R9pvv`&x|%XU-o{4H;=|0X`mCy}jURE~ z&Lqu*nH}xW8#H(2`V=kY%f(VA6?mgN=1$B7sk*& zw{&vjrVbC9sn#pc%#>t$?1don*cW^{R2b6+^!tW9J^bj;#(2)F>e#;iLRLTe_Lyj? zm3d#RB6ru9?lUYOxH8$}mhH46V&J}TKulLWGd1@o{P1h7IT+8QXe*PHR3k4bXZp?M zv7}BG7On6*gdoSky=4va#V#_upCW{AJ>wv|>u5bqRaI%}HwbT9qLsRZr zU@mx1S?cxv-5FypEW`a9hZC(3Vk%nUmn$J+rSNj?=+w8?)}IN!4E!}OY@}7>SQB5z zHxgTN@9xMrKR)`8h72tFxnRsj5H8t@VcEaiQb#9zwjHhfs+&(Bf_4NVjW;?tr?s~N zFS|gWHQf2nbj6q6RM5y#WY%sI?2AXknq?;4ReIVJ9gZ$rDR%mVb6I{3!AYN&$v4}t z4$BEPP`#|lrnv_eZx|Bx;XJ@aS-7qk1iT+$}q0T(*`E`dG>w=t4aU>R=0urQEA^4#%jpk2t|4Fbfiez}#FS z7;_fk4kKQQ83O$MYsWGhrjg%I+hq+Y)i%a8fkKSWD$yF=ujln5`q}!>5iU!o7M`el zr(LUd8&ur(wLF9p?vDX&=^#@2hn^<{%Fau#|0Vv=EN; zS)LdZ-{sF}QE|vd^9W*6V7=(W^d^Uu#Jk$rcT{E`&*|jR)fv6=SxdORWl+t@n0j+{ zwPOyXs%Wd1vgmQaJrzQyH=LsyDkR7DVF%N?6h?2!MsSGR)c&w}=Frsi!fZyeCn9lr zN5Sd)g;TG3_tiRdG?jXjca+_$<4R>;2s=T$rcdBvE8P)oR=q>5+cY?NDIT0knsIG$ zeS_La$U+uBaBdN47Zbnb9%5Rds`}aRS^HGe4#j{|&w7e8BOJQUo#c;Wp<51AtJs9f ztsgWcHA)RPwI@q`J;!?VPZQhh`SxkW@Q7ejg3P{W+nn_-FWabB@4wNl9w5hlNF2in zO<4tx*wc2dDQEsd=n>%n)@l&hMmf}axfWd` z#q11-gi2uii$mvCax$0n?2Zvyk9VF)ZQ~68G29K!MHgF_va2s1>68@y7}wwq$%Jt3 zMX-A*lPE5Zsg$hCss&)<;2&~CKaMFT8TCT?Ai<`P*TFbPE^*9JUA)b0#GiU9T3im5 z!k86qJ9XG@{t`t(N(w()H{p6;ZsU0cHd12@EL`Yjw@>OUyTWwI9;jo;V9;qHezwUR z0e&_{|A2`Qb|pRFODbf{{k72PhEyxapCJuXJN8A}hg+cv6kmxHU^`EQO+A*?&dwaj zyJCVc(2TxwgHZ-~Jw0D$1z8!K+L3V&6}Pc6?QXPs;$4tw!2qgcoJ+fq>t1w7LqX;~ zPTTsG50Y#C`-j;1J`g}{-hY-{!`OR;#PHs#(lP;`GFR2=DEBCdO&lGzQvor}ym^}R zqBp^&-61utk{aQZ9a3Y8Y5Yv<(W$<6FeN*#NXvhDL<9cC^~Nc2?L9mQ&i1z!rXGpw zcTWlz_3VpI74AMOjzRnOg*Y^tKRo}uWS$tRp#D^e<%!UFiGiq$1V>3-ma;d3t_K?k ze70Dvsok+^w*39GadCPHJ-*JVsoHU$r_{_V59|^-!uxN&>1|IkcP;%23%;CZvU6KX=j}YR+%Gtolg#>mD4=`WP6) zTQk0?p;kl?`y3mV4ZNwXIt*k##zN)jfGgJ_P`u4|LqygL*%YOz`vWipA{vFl`HjQ5 z@UYkB;g{hwlA4^R@Iz!#X8D+Vro#-3x2$z){*v501tr~1%gJOvvOL`DpD{GjTbj-u z(Wwe8#icwhT_p^lY|7I14;+^3Bt^t!&&xgz7~?XBK@mYyZc@B~1u zfuLMN9_5vEx$x^;}Pa@Bd%)!$>Z zCABrirL%rzY8OATG*;>k^NC}gAM1FERoSK)8tI@uKA&3JGPOgJzWvRdX}8ZJ{a@RC?^0KkVrvv9?w`*YRFL*LNI(<&Fp4oqsIZ4%?@U3?dw zH$JHzs_|=dO$qjGdcT-{j@fq78ebr|{3>@lp5IgUrrh`0w?kh(EAw|Y-)XoZbvaz* zd4inVcv@F}gZ^`lQk5Th#Ao80#gMH6J(o1*JHuO>*^1Ju<(NEsaa^Ihyk-q_8gyHP zSQbWR^n4uTPJ=t2{%kigi$aa_yaD}!r+1@99Z{C8rFu=lXYpzy;x7_Ua8$@l%y>v- z+4vc`wVLaVLxp&3Y7!2bo1|9WL`n)N^Atuo`3<(LC?%%EIU}HStI%@V4f0KtrHQn! zA45jQev|U>vZsaO65bw=5R}%F25(|VAet4OZYCGzoZD7R>>P2|HZKoVcV)~D+Z{|W z;7eK`d71C#f{N@spqR*@IiLz-bSZV(Ni6h!51%t_-}Td7`GfGd(OFsRMN`xqQFE(z z@mYRRj+*FWvZUNXApncO;%fb;i|z_dh~KRwo?Atj&vw7sjN zPohicqG;*#5h6Nh5Ua*02V-0V2O@1vLElO|$&Vm*wm%y!b$p;YoxAD)QnxB;IK9=E zTg^0JpGymV&M{ALxv9Uqhdn`(G~?r109%fWy$-{bm-fk4N#WBm)g~?3Mb=~z?H~ja z-LW8&me$3g@@>OR$tT6>XM=T_iNi6YsJRAz(s`Va>ujd2Rn=M2%Vo=jN{+lCKYsFy zC+8;<4GCkUwey9N3m>oRjf7p(l(>wnp9|t56U&ABg0SO9=N~7j^Z-oRNLrf7m0s6_ zq*(PXB-ea})||Q8@j_d(V!`-ms%}@)Du!%JJfowX&&Ly>@6}e|p2KFIi#SHb#aG?L zb#~2P{hl~YsO$0g*#y6J05n=03qs`hUnH99ERVFtbH$gtLip#T+Hid?hEVpnthmvQ zmFFd+-aX$uZ>|jOy(VFctgqgvcGa#TEL0CGPzFmPo4b&?lYXgw44c$q!f}}cDEk33 zG3fq7MA8BqhC=o`oE`*?^o=5xMPr-O4&uun2M-pJHLGUV*EP1f#y>k)J(8H37Z|lH z`?zS+qsteyqO45>pK->QTsmyCmqMFRuW?i4>YlBZ7gQ0>Vkx5?q7vL(l5n2L&HA%9 zxyt4?RvASr#dpr}OHp$T0-BfVI-MB>S>_0#qTzJXnM$}6w%!MjXcREIa8lS)E_PB? z(tUOZOCz6P^Zbt$Fe>Ob`65-v4f(o0&%d~d8#%j$#@(9JNcQIEwmP)P^CVY5PeW(< zBKIrbm#-|Yd_b4nm6Bp77;N7GWo3>R(<(iA~LkwcGAbJABgc1PUy zUH;DLmfZi6?H5{sX??2UCKq~6V7yl<&sMMkF2LVG70l7u|MxcH-&^p^85ri-^>0Dh z{~dt!fAI62&K$%h&6w)cT55G?jHMfSCH1({s9*PSA0hLk;a#`SKjvTukg?w(X@D9L zK+>czJoAcQW!-UO-t#qsd>4H`wk?b`X^uRcDNBS7A$w*O@13ZTeCKSB4qjy<(VowE zE)Q}wqZa^&n(|M~FL#&!IJt}F+;(CNJiT!M$N^s6n)klT!1EN*VB&ntljc^4sZ5ii^f1}+p>RXoS6!L0DyQWB{B|}t)^~F5j-_x7N0(2l zeO&X2_u`Tm<6Dysj;%v#!M+owyZHP42724?-L7iq*sWdpMf}su-U4af;M1idd+gNp z=`3Y;r4jzU17~LTm2o;e5vORBQKrizb7yOzMk}J$COU6d$}A>vmzlO+c?zWTOx)N` zUKEKvtQSwP`wLXTt*kK0ip_+5UsE<66j zcy8%Vt@uKjjvz}R{WWCYB;$>UFa|&Qj3Z!e@2n=L1N~V45V{FDR?{D{_?X7i3d3d& zPMY;N6pWU~_IVV}q~~igJ_?`7GH*~wtQbOH>q>S^OHPQyHVl@yjp(ge5fxcl%M%zR zsnSID@fT9OW7K+y+%r$8UFqowp7xeC;f|AumX2+p-k+-x-o_|xy=!#3P%Y0Z#N+95 ze^JkP{A!E1YrP=!Z3TxwVD8Bv+Z_8^R*DI(~VC#M<-`W#mm`UsEd__e7KaM?C z)7$nVKR1mePoJs4kGT$gP&0Pe+?Z*u{Mu>VC~9V+EuoMZ&nk}bceU5?w6iZg^iBVy zbn-SX!(6n`xiX8KM6-g$_#Q5wK0cb^$C!lGYwjbHHF^cT>7S_%^PkQkCH-y)ew9}$ihvEjg3XC!5wdDa#rY_AG8RUr3$?=U`_1^YRdRhUc$FvsudK*1w&=_G z=5>>QrK`f9Rwa+-m?XOn*(H1V=+a~hAskHLusE}e54M=^EUm-M+M})V4K>cy+GlPU zUvKYERS#G{yP0*%tfrp6QVZji6(Ng>stZ)PE~vfI?uv37xLO3c6w86L*9aH7#8r0o z1G9t+t;(ll%)=P^ln%S$Ic0WF?o!XK7) zrH@TdUtoHxH(L%Z$0&TjeU5p)2PLlBGE$a>!zvh(@~6t}$26;uuDCH-H+*7I;Tx0I ztv41vRmQbnJjCB(ukJj6rytv)%Bs$a)8)m`s|ax0JCL-Wn=*aZ)FhlR>eCs z{1#`?{Jt>j^u&FomW`igM=LIv?bbV4CiKAxe2ZCa0TWXRKPy|SO$DHzt5A(%&JL9nVH@r1HOVu%eU{_%07?pf2nBo z^agHQk;8A%1#s`S+YaylZOH4t6Hg?cUN>3#HB&z~{X z_7hBKQ@Yi%^VS`keVBq9&!fQf=r1@Jz|x4+e?7bvhe_BhD;H966MKH^OQ|SR6Sm$< zd2lzqXw*GPkm;8Gs}KjIqU+U;jeqbT=LfxXpGYPa>*KxOE>Ow3&@Hr7sWN(g~^#am8T5hawZ!w>KS;h)zc60@;RNw(BVx4H_UO9K9%U5He zy#|0f8of;{VMYLLv;?42Ul`vEHr^E#>~mlCj?1(~(lSWK!lK+t-cQ<^8u zy8IIZ##pUQFN!a%bs-u&U4fI9Q2ysyCp++u-d_j;_9o?XDj?&Sa^T=>7siLs0N)_$ z$5zdJ&Cnf5oK?g(({WPGd>8JIM3II1Vc#c5JY*`A+C)N_(N&;Gz1whiLsy4S968jc z3^#BFEaVSFkajG`=1kW{5n_CuHqdA#A$lK-JkVe=GBVAalbuRb3u;1XV74!^d~GqQ zafU9U+6YD$7-t!blD4FVWnm`LJcKnw>ZL4HOy`^5$oTO|edV=p#N?$+e^f2L1MiK4 zZmbaiFb9ob3?L}6FF!KDUp@eX)`#ERpw6#M17Rj0_LIKWo{1qYGO;fWohPXLOmx%w zqRmpU$i??c6QTy9X#i5Ltv+Aj-)Q+Ws1?Jc>>RCz)h3Mrbtu0B{j3@&t;mp&osD|r zbLK_mno{-W%uL$XM_hfo{Swu*G%~dL^*>D;Y7bPtUb1oUma1{%fbtOO=|6CD`i*PY zgOZqlDJQKr@ysE6a?sQ}ltg@6Kv(G~bzW@G-ErM?Qo%V&K7 z%hRX69RT89((}`4qCQ~i3oN&m zLKR*TH9}-!=YnXth+#Yvp+#|4Ij6YJM5%48g()xd`;7Wc)-d5g;z;kHiOZD>ebElu z$3!sFVf^d?gH0pM^HU*sJgyvhX5DQ>PW;Y%!QBeL)E_lKPTSTn?g{>6nW*4E)I z%UeK%&1TAg^?cH1TjP4<=A{XPjc*3)v!eheJe)-}1K=*rtrUri$SUi=le3%6fhTvZ zxI2Y$HG`-7VbLovRd}!GMA^rQ3)~vwZ^~ZZyps<|x{K1T84OzCoNK<_iiMS>CZ#U$ z zD_^&^&~ed)G7u%98B-;ZD~go^^M~7$gIEI^ysp=Oe^G$H)|qzWmQ|X_P{U2kMM7hB z>M(rT&1BC4dY%5pHZH^$+msf6h-gwzGMd}Y?)xBMTDJ|};}a?DLsKr~vW-^duzgb5 zVnL8;SZo!?hwxZUC8fjq&4PHfiA;o1qaJM9os3o4@SrlGcg#VQbX=`ZsWr7cslJ^7 zIIWYDte=qIKipV5qhN{eP}jvIPg8I)mP<( zCkDRPH%BIwCza_#T{ML%_f4<|rUBeEV3jpd4%l^leNm3UQ19;TpmRjY$BUO#e;^EH z9U*WqEPK_vbCoHgjiq9RXKnzTW5aUQfEAfeL!#%&u`WSDqX3BuS({KJg;Y+d=52 zo2$j{@IoHq)56k*VX8EjHu6rXRLcHMDq_=T)3l<^`y}N+tnZZx&DtUkvNyT6-6^+c zp(2MrC1e92V;6{KN21#btr;YM@B{60nLhBM#`!YmJzT6eClMRiHq>#K6@@DmUut;e@7urDgMquS2fZTx4LkI(Ap07}H9URX$$JP8HF;Fof5*#3KvRG z*I)Y6%J~p5@LV)93a8`I`(HkXCEVO8#=)w=A@xMhM;56`)bYO~o@El>>s`h;!5>39 z8WR6HA7tTG8FOP&nJT5bb_Q zcQN@6+}iYPzSid^$pL;&DEwV6Xj2kI^(Wx-0qO2totdFdCyj_aXCpYsnrNX!k8?4! z4a#e$@94Sos4x5cs^Jz`L2iF|t_kGSRBbCdp-!rd0|A1=WxEW7g3hMNvT8WvVfj-C zqZaXO<4HE>+Xzmop=x_77%YGD+ZJ2jR<)!ICC{l%GnpZn*< z3#@M&gI+DWLq5Wr+n5l`)(vfE24>=%J~M-7s7yfN2K_BRFz*ePlTU25R?9@6WH}7Y zsyK4F+4NKMni>&B);0amZW`O$<6&Cs6v5jz1YyjW@g&DA0G6y#tT$nZw9u)?!T0F* zB`^^|y?WRyuu}vOhK!VMkV=gkCW|0rU-o&22c5f0=gpj?ovGm9OYfCj1}A(<=I>75 z7Jm{xx082WCI5}tZS94PnT3bC+@5TfMEk+b=X!MZ)pA z+yL)=-5d#l%?<@6jVokw_~6>|DzC37M$Nvqdn(=aMj^mL9CJjBmpYJGT7t4OOPpWH znz~How`8^_;Paw_Rt8wTs(>cm(XS9P0m9Z@dTJBo zOLtHW*0gME&r;uJ@rWuvjRUsoJOUXF^J{7I(@2qgFt_>Q{6MV9G`3Rh+>XNe(cyA* zvDs!6(0?>VIpXpFdvtV2u&iq-M3MDu8mFx~ge}kYW9=xVq?NsAn)_}*8`|LmMaiy1 zNOv8KsFczm5Y~wh<=ZC!k;t*X1z%+O;liH7q9MMuh@Rv-{G)Y0s*m#@KX23WMWb;wa0}l?(^SdHh6G1s z%^x5SJik%H%!g)s^WV_y)D6ERM$oPgIQHG$thZ`LK6kzWM$40s<9YM6G}mW<9u8^|(P01X-wpXWm#KUBpDX$obYtUP z)>Z-I4$D6SoUPHXt=nmJPXgo1;()ftc!WZdb?g^l84@yT4}547RXH zzWdfy==Wc}OinG7aIfGPs89$Q%(UZzw2fWbYVN2d0^V^j!*x-iW~S5r>`eyh-T|UF z=$5emZKhSz(fef5>s8rrz;VD1NsqYkDcOE^%+#Gm;^JYGhO&x^FH2u0!&2AeH#e_Y z*^f62qpyg<{NOfzcv;vV`S3mV1vu(TMQ&i3gnCuu#0w{Ds5S9S6uswuV8qadZ#|@G zZjrPbLb1D`^f%@o-z!4bLaMXx6lqpRz_>r%tw~L_?;SU6aOGQ=$$3*Wl5tFK?RE3o_tB3E}e)vi_-Y!Oi>c4*ezWp2G@v` z*R@#fQty}@sQ|R;CG9E6Q*W=z-*=f#D0kz_89AjkV)6rxI-Dev$K8j=&tvwL6)SRg z--?iJLVDKo)%z{>b-M>fzerI<2?-c$1cH>}|{ms0X41+%_m`u*Q|I?G0g{tA~5P72a z+~~N1qIV4-{`X&I7A!`dxmr5&KIr?M0uZ#88+-}dQGPf!6wqv)`}+Q}RSW>y6WQ*> zR=KtzQ{4y;cYK0wHwLuFOk>z;x;mx+D#d0xI1Fn?GG;`f2lCNBhYE1J2>3nl*h- zOYy08M?0l)g?!lg-`4Kc-T$S=;-e(i%}3<8xC{{4Vmt1@V#QKK<@?HwS#XCR$+ERo z5dg)gLf94@M#J{w!d!b7Oy%{@lj&FQAJnprfJUyB3ai9I!k^YDET!sgmHPJHQ;IE$ zKA=^ht>t`@S9C!=oLok%0@N9RK#;i}In0^hf78i(sV1Gd!%QB37Cx4<-B9L|MA4sE zwUK&txvcnC7XF~dQwx+Okaf@-aRUaGy8)UYq2K}m^|r1^P%Dn~dGRI=*)dG3{YF35 zn%CgP+vjO42Va{*FE8Y+2;v)q%JUoIvBK_IC3t{~3kr`orD^x7v~bRm`uI_v>tU+R zijqjdKztQLJjtYuFtK`&@v_~WAdiUo*>~UnEAH=Vym!OL8}L6sZ|3sFALEh4I${jJrX1GaIL9<7dXK(TMk9#UAmaL7tAeg92DnEh#|W~rk1>3nS5E28?aur<$*t47hQ1X-rhP`H!rQxs5v&C&=%x_g2 zRDm-YIV(9`FN7O7w4qs5?ioOx^&!i;>i74tiyvSB5>iubiF)HZL|D^-NDEW$fh>F4 z%dxhVWYtQ#3HBYW!}Gwv5Ke>9z}}O7=^}R|H!-C=@_?;%>5+hd5}^>^JovmIX2WAh z6Bk-cU|m4pShVw1_(`{L_pb^U<)vatg%N%+6bMfPePE_%I3{E%@q5z95! z{zix=uRFx_gMGGC%ZjGy*cZE6sHnA{c>?TyecVmWr|)RA!ijN(8_+!cTF8BUQdO*}FwDdc50mx@xA&*}CF7A(59i!@xNCNU##m@jyA z{IiI8kVA`(zx*znp|^B5oMCF&pE#KJF*WNCvCgSKa6T(tTa)#_I!-_+>A&t*y>rHN zaX9{@JNO;?0$K;$iazrmlSSt9NH@Z?)F_Ie`_>_rl4=7|6gMQ>kzIL@egnkhScW$X zv$DD|z8BBcvC8_&bNkoX+{dzd{_D|g#*|S6;+g-~Vrl-b@ z@t3-M{FAD51{1YEC%QBy>4Y22Z-H>M_Q{Wqzj7D-EiwQHU716uk5%PB*B`op!teiW zZ{b76P~SNE%R$yBt+5I+7g^Ls;(ho3!7pWconM*nXQV0qYoA%a^(e$4zP`pasx+Rz zRnaK=JDTK5&3a4uEgh|f247V)bFv?g71)y`RGKcdpOZ-1SM^Lt`l@|EMvO(POvFSz zC_~$$ksDHdjNXReGuKp_%Bx>N2a@JXbR(^*Abkv$HX4xS!OG+2>s&`QENja+!WbM0 z3lS}H)+YF_6L0#Et^T1y)K_^{H~LpfEvzIVEhjByqg(jn>#^3ahy*YJd0{^Ir!j9) zyMn^hf90S|lF()f6&J&8Oq1H2jE3v-qQx=SA-z^svPl_p-eM-pf;=CC1l~X+DOD7c zCsY}&G)dfS1!A-@TA{4C|G=;)YWBj8LZ~=pSoX-^?v*@?QqZV@>N#i3dRK%WNr|{KZeTJndP_gAXE2{5t>fl%j zha>I{iDW1u?BFLM#Q5_K+mmY&8QF)w8*;Zfj)n#LX^-Z)-R2t@ZuroSPiP&_Pm$`~I$9D! z<9o}vYTin?nY1mVsrKYMN_GIonBNO2j-*zYV7}N1`?vKUjBU;gsm__P1+2p^EnPbI zfQ;ZURatEYk_4~BqPD;nzie6QS5Wk;M%Kk?U1a^d;oCiAqwsEZq{Mn&eKMAF{FDIK%1!#t-uMMFpDnHGNTQ3dIBkUSg0` zWjYeSR-|G)Ra6w(&?1zL)KIn~Lg`g5_Sa(Dg3QahAU>!r(hb}~18yAG(|CqjUruO< zAsr6hSUDC35F#@*#TR&fc_iF_#_U@d+msN~nUQ*IYK2=p z4h_$(^(6#JzfV!>_X&l)T&@{XxO4dR7FFV3U?qS#O_GqPro2R=i3hzv+df}w>} z>9(@itXDUFH#p~zLER*TjhC6{`(vuhVnRrBd48*1sxA*XN(Wb0X6U}-#q74UpsDhY z_xJu*c>%gVB0_=(gR|4NA3G%qJAtV>fdTSCOkmMZrnDQPm>t2oC~RlD!#C+yZ{!Y1 z7erhMV3~G%uB+$Q<|QR-1L`C})Z^XVv%R9gckKMsT|QJ4Yg1D%spwXy@40K%k-9P$ zb*<4dXAuBTI*`(+3Oa{wGCsE4z|Xptp1Ih)@Cl~}k?u2#v4J(t4(7yM9o4Uqn8|8s zmNFSyO}wkf=Iz%wZdi;8LZI!}2i3>3u-60di+F{?@oP#KNW;?v06RWtK=|b+VOxou zVYp1uXUvBek-A17i#S@;Y$wFDUi_&?Nd%)6;YOe0?!6JtcatqWlxShBhP!3L)#+8A z&)CQ4RuI2(D`~(CsvAGc_2uSF7G6a$v`=9X>#aAtVT>YYD{eH8yD53MJI7qj6TFQr zRtW8bFN{0H*wtBjs$|*aDG#2R`EtJ~Yhl{V+BViKu!Qn7FBduAjP|^!Fein@Hy3YV zUH^&p6kZEyw1OD>76qHtJUx6!I!}soXM*;VmzJY~q8d6xS@GVFkzBG$T@%?O5M7-H zqAcZN)Wa+1N(8MEqgK5O8tk#V|Hwh8SFZrL7Wyv`D%hTzxqAZRd(0ti;Il zn|!m+Z)kTwRVu1lein#VKY5tIFMhP3EmBQL zEjQg)0HwE;SNt@w>)|0%KO%WTu~svaXJ1$ifK-voN-cBZmaLYc?E&pEbqfkN4vU-e zGfGiYX@%MrsF@}xcS9>q^jgOl7`4nGNd^*u-XpCIR32L;_F1FWL(4dKb7h!o!Guim zIXmaJ!n7c}gY!PL>U}Zu)~}+@W;DOk1nk7<{^7Z=LJZcmNAZ@TlMu~ zrW^xMUIPN8hmsC`vWCe2;UxI`(1dDuQlhUh+ilL@%RGhG!?(Zwg+=`TWPSi(;{YCN zpw9?0Zvdy5J+9MAB#aODxIU+}v@vcT<0>hVd{p=MfLv z+dG8^n!ddSq+-(Va?|_^aFrg8Q`(CVCH_J$ z!7w+A6NkHvdpFwzG}UGe)Cs>;3?1>{^{K_-#mG%a82vWxAo40jy2^qw6y%aBX^!OT zNP7tptw8CK7usDlP_9**L9aB{l~F;LbWxY3uMo|#p%mVc$H$jn-?3!Mul+M9x)o9_ zlg{EIWNo!UYc*x;^H`PglxXAPpX*N@I4E=`+-scVOi&KJvCmFG-(uj>o#2n(13qL0TeS{e4ZTZdpWsp;* z)ZfHYz@E5xyj#La<7rQPZ;P5mgtbmlR`Ts0Kn9*AJ5z2dC26b^B3X#_HXe#7Nf^JQ zauwk@BuVEZ#fA*-bss79xD=iQ`5OY(T;SRHb0;y)60W9>JJ0roe#Bi*%`R%e5Qi!` z=vW6Za)pGFV+Nvi@sd3-wRXv#zgfr$OyUG5vA~p#lW3t)NMJ-iK^YN>-n5V({TVBS zfs;_N0M~*i*Z^#G;=lZEqH1_#d2?j{=Ig!_{Br}+x)$ydnKr4G%0(Pu<@vOvTj7+j z7=-s-zu(jJJs$LDFJi==^@MIrX-6oUD{^f|P9aGF0660|P-6K>;kNH@R>P(?;vM>u z&uah7U|Eyy0&@aE7CQ0`;Y0?5HMP;avgjN7^37fQ1e-b@{H@aRLTFiYetoHns#2Lf zbem<7xoI0^>Hv;tWS7S8JLF$Qb^bS_U&o^%t3&|KSV^tLukh7wyS)$TivQm4KKQLu z$-P*S5moW)=>(WL7$ETms=;_L7qtDh9@{awuTtnK0TdJ`>oXR@vo*f6=Pr{1?bY2w zM1Xhy6dCw;B_0`|Gs(x4`1;+pf#M*Td-@;08?9Dn&kF=G4*#~kOnsl2Z|ch1_U-;H zLtv7Ek1&bXcl^sAgMr51-rtN5Xl&F4-52qD#=foT_evL#u)hGkYW3~!3Lea-U_D^_ zK>hcx{=4-CBiL!T-KJ*hKcpUu_WVWS0~l(-x1pE+f^GlQ zdW3FG@qi^}iV0-`l}Dhh`SWk!p}+rn=zso0<~;*rhy>Dqpe2jUU}oq)a}RLs&$5Sp zp|$~EGWh@D(5=KYn`4P@>v?u;+ja?e?bn;K9{-di@OS-{4;ia*Ei3l2R2JFx$`0m+mq zXtbMo6{S6Yjb8&b%?Gki(cz)Y8>T-i*zu)qywzpoyh(##O$qeh{f_^aXKx2B)?y}M z14{FJCg}N5udCVX2?Ha&6|P@?KE0Fp!h+?TT^NTT=Jc*#FJ|lcpGV!v7Srmwe*sRd zwR{NB7H0!{&YO6r8?gR-GAIT@m>>O?#v@q)@s|MUFc6nM4a8wSeRzaxAPWo(HLz}L zx!scpoqGhJ4)T*Fu-w!jZt!Zv)kp&Vo}VVDd|ic7C{9<1u4~TqQ1z`R)}(7e2vS`E zVF<|nGVDsq%LZ~uP0lN`lH=66(WfOd8k7*ASqNlPZ-ecKi@^f{(8#f`?;n4f=mBM^ zZCf{fQ1|5Ng&CW=i+dK%wY}BaddE(DFf3}9_PrPK{o{+iCe6cbo+kIwlb%$xsxKBJ zJ9dli@lf;KMgy{-MMp|{J(;rhKmqk_-5aS)kwpFwQzoD2`lgE`ugI&d7Z=liCYXcF z?aM2USwT80b;Z_WF2Fl6EKorVkS%`?b_ak=0NHY|)tMsOi*e}iG>b2&-hTX9rKsCi z#eOc~tROsa2WQ`0Sx2~IxF#17eSZhPM!3yB4%-JHP5^T0rdGfZpX*7et7blWcQaUS zA@J6(=Mmgk)yOQckF#W`G)Vft<(P~myCoxu0TT&+_^np~R4KvX^N%0*5|WTL4mSMb zRa}wwPwUAl#$Ycb-d4vhofLcz`ZaF3UTx~At6|<8Tk8wX25_o%JpRWz*f0(KU$+ZW zN(dN@g!KPxM=;|9@Xp(G|E;2%Z{hPZ5 zQE+jdmO|IXfX6t*bZcAN240clE4PeOsBcOP1l;8RWa|M{ZV91gpoM-jvG~tD9<^IS z_FHe}-yIRF8FNh8b(B8N{5EPv`C8)iD4TibDcwitwn&9aMxuU$10usYf_yx7!y zd%;0lg0!Ia2REL9BPwAIhbI%K?@4`|Ok{k{q^au2^%n>#Zx)@9=Gi)jEB7;xET+4= zn8~4gqL!HaVxh{3ewx=@ByG=v*Vz~j7c&n0J+^(E#Oj!YZNGVjLd$UBSnpl>|MVq5^1SPj_(0$A3Avg~dl422$gDJc3xgjDo;U2EMQR`j!vz1#z25(scmfzJQt0wN?sd7*cE1@zIjeD-^B}K{?Q5_>1|P;Vp0|H{l(_^5b^-%y=&A0uT7Jsg=}7<@tZ;S37`%LL6)! z@ZWQ$OgkW5AKY3lAlv?%5VtfJFUrk83W!((gA*?tI|^v3ff!8~co^`P2iiOMcTMd8 sXqzqj*`{~2P-kmdz-Puh*c!k9+b8wWRy1OO`R}#W^{1}(ht*Ly2n4TC95ATMmih?d4-lao4 zJc4*40^BEsizUIhUzhFWH01E`D&k47mRE4k*Pf{ud*R`ce!KX=r{Y$-SVZfsXymQu zZs+Z5>1m7i%+k@#TfoiMn?*$6u7HHgy&z3IJor;p1vz~`^Uc$1^=9M7Kdxou>Ln*@ zJJLsy$rF5Si+eY5$HN8w%0_iO$z?LhrMuR~7{UpMfB+_yBvBwCGmS!Bja`M)-TT^F zS36TMIUyo(SDq+-R*@r0sGxW-YIIGN==*%ac1vQOsnHN380G#7 zyn@N_-D=8n73kW|`b0+A`nWk*sBB7iOFyme`b$FsS^du?p6HwvamnCsV>}k+n1?@#u{&k=4^v@ zh`Zu+<<$_&!v_+QYYz)${dVssDSczMa_U|*VPQ5&w$Wr8APG;|<6KJF?^G$@KHHeM z6o_vENo12Q4Kq6X+UmQcMHJ{sjXxQt#O{FkO}!PtV>`^8Tc_1BZB;gljJ&r9$)G|A zhu5108V#9>3Cm7@%}I2!^FtXL4gWIEfz(YRYOwyeR=hJS1Xljjpk6qpA&43y9xZH# z2_U<@YjxWDQ%oISF6y-wZ0~c%vLiDlf}r}&I{(IuZ^XH22ya)So&!R&W;99Q!N+q{ zXdNg`JUl|KCxS6pL~~Nsf|fQ|ihh}pzugAPRASuhV43>v8-Kam8UJrlNmD@ZgPW6L zCr24J-p+IIGxLS}B#Tf`cuug^3|E8p-o#vv(3^0+hS2GJnV)!jTz-%8Gw+>uAGw5C zXSz~^lhy#tg$bheVMl60yN;Q{!-~q!Oh>46I&#HNy#yMlBaUu4f`AF%K5|kuIkOsI z&7hA>uf~gb4zPQ=e5qvd?D_uOBuLrWlV~vY8+Z5%rqK6yRCzrJarVg}PjS6p5=1ZrA-86xtu!4C0gVg!n%fCmzy zcUfjteS!;$Jw}q&&HkJ>>N3ZuzBz%!U3WhAv^jKQc!}Cn#F5B%VBD(TVvW^~N~G>M zY;FrD5-rG+j=@R|EL@Vv8#?Cbx|7MrkVL|~TV z;jAY@dCe~u!%UF`*@b`9W}&<0*((mvzM3}1|7~clxs%r67QjT%Gg7F_A+V5}J&pUd z2*ulX92{7-oGYIq32KSD5+9531&mBUuXqmR2(m|1s)<)$CRUM`pGsv^UDA@^wC?zn zFW8-0U1PVYUU0us0jGmErKz51q)auBrOLfU!fAG5Kl93LYUM@+K5=I?d$`4^m(1YY!-4@=xnw=s9KdgNhdbC#wVhYi0-xmtE&w{=9&W}j9`ekDW zvsGqDLVR7-=Zlf-%@|_<$HvLjXhb)gi{9s`zy<7?H3BxbXA}iR?0!|MXot^@-v6<&i2n4shF+G z45^Qy&Es}%TabZkr{Uz*)u2z#vO>T8L7waarxwBXRMHoo{3{hA?mV;Z%~=g4ms3^D}Uo<3&|7;a!Y(zwc1W9L=KMB=~fB$jzzyErC=L) zxja#>QF+?tF}4y(P#L~|005a$R#lC~xoc-c!XqKBctq8CKcYO2H9y2;N7t-PD{qV2 zF0DoF)lqhlzZ(MQ9lqsTBaHLEd+SI25^Iew`p8h(Xqm#o#IC;9CA! zqS8ztB|Nn;DDk)dvtgR+wWC;NvQ`nMyYv@enB@>8Ib|0j7`8dC90cAMbM%Kt2t>bw zk1ue?109q_=s8Qu%cjjp5{+bt=e5t6a&8X^pD6(Ej9Oy$d7g3*t%V8~$$bE=HFiKVjZ{sA0gpTUhW(!Cnl;KKTkZXa8iZeS{4v_eM%Wx8Tb0Y!pv7v_|dXP{r_8x@W0(?MyqnsT%L$E^rk%IB_x}!(H-{} z?y>q2y#M;F*za$qa*_7oTMQSAh*&oV(Dxo4#{OEB@Z15DmV2V~>wOi;YHaU7Ap5UX z`AondyHzOpF91WN0NH!qh+nIS93%b@wz<{)1xjG7f^?uBza}$6gPhf83m{b0lXvC4_U&v}70?L*3WMm>A%e zG?x;3nd$^it=Digx=ISjevH3=$Xj>Yc*bY7G-KOT%D=xQooevUwxWRMvRBdHZ>#Pl z1NAPoHaRSja%?sH81tIJ!*azM$KqI^Vm^TGrql)t8cF$kFWn#va#_;opZ2?T*6cSe zBTfDv^9EV7k<_ z&h?O%zICE>rk3HF2>0uhY2SE{37hthFy&{XoAsE1G?aUzRcA?nThq_a8Kf*NE9oXr zMRgyd6dW*Kkz3Q%DgfB$u3bsbK;D(iXi>F0J2gqvyktXd*yZF`jB5F=)EIPFAOZ0a zI?HB)gy!9>K@tuV@G?nohs6NfMnCk zPEj(&XWyt6OmVCRQM#Rk&lwVS=i>x2;eiX1pCKLW@l56^z&jVK7CvBD^sR!a_g%zM!TV4FI0 z7UbEC&0jO#39ccB>Y3wpw#5>Ia9WVBS%o!`#zoD*GJyyKFqf2 zvzvMS8>LjFr$*D}^qw7@OcXIcHivGNC92=D3gxw07k4?Sh4!I2WieYYR}P$%Mh@Cy z!oH>oY~A+i{Ism&=U26CdTm@F%GgfsriVl{b#te3PZi!~(x~tY9N(Tq1RA#tX$NEiDGgK01zi zl##)XBdFqZ>S}ToRy3Yaw{mcw0RYq4#Rp{Hl*9qo}@E|UO&9y zf4ab!Jse0K*_lyH!n>*{Xz(H7jG|i(pUG6gX+a+|820$~{^3#IDW~DwvoXc#T2o)t z==ipU?`W3B^xo-Y&Ar)Rfuff*_AM#nFyTXqS^JW&pP?wR!?OT?!Bb8}%@!KD4cIOvo#gxN zhqLZ)Ok96Lfq;V`sX^2!dS2Ibn+CDHFC8iy?@soD4` zi)-m3fY3PN%`wfQv|Kq=nidE4{ff!X;3-$U3czxGQY z>@audk3!Xv%1M!KWTLF}Tn%dO$D z_-%R%)~^_KcMHRhPb#eIHm1uyJ+Iabg=oQ}JWvL}V}MCl0; z;0Msc)XtENL8c3}i_J0$I>o;&j|a$xXk94$8@y;Ws5ECj*L=@RQ#M4__qUg_N!pP0 z+bM0@E?7;5hB%|U78hOX5T%Ark}phx2-&IOq`$r44NY7ksH*!3V{hbU~p6#6a31g-k$H4XyqNaGeQafg z=pWy__6eCR`v1zg{(s=Z?O#H``x=BBu-w40=(^1@{OPm?B zb%zH$3y4T~b(ub~YABuY>`R!*hl%0ua}I!<9xs8(I~bJ>2|pt=z9#F>m>S7F@dHlI zK&U%4po{kS-)Q6U7kcFTAN zG1YHd>W@0!op2}<6LpbqUVXph>F|Iwu(R-r>O<6{2BIki%ah(xvXDyyB22mhh{aaeW+KB;V`NPrVLVz@#YcoM;-kP~9OF6Jl`k_) zSC&n%_r|u$BfOreeLvQD0Vfn!Se0}C8#!4cvuxjwcC@Vla`FHswJPzqOUAxe11z8= zVhySGj*A#PVGm-~_wi^Nx7pYzq8D)%{4?IB!h?4_r}z=e=H3>-4jz4lBf+B*WBiDN zhdSVY04wfevI0iROa|ojsusDth6r*eOy!5FI1A7{og zXV_fk{c9yMN#ZE z$7a$8No_BFyyH4029~_*2FhGFA#ei_-01xr=C!CbAm5o7pTve*M2c4faUv++`N0?@ zk4qVl4NTq2zC#2Q@AnDznCv}z_?cD4k22>o+Ko?K2Kc-Y;eC$3)b!m)5q?74u>w;O zkp|8J414Eyl}yPxrX9V{!Y1+3P6LjXp7KyAs`(W@*YS96L9Bml z4SDx$9%ez2Zwr|E&BSXBlW*bIZ7Kf>hk^3zjmQIFF9!S~{}=TpfQVoDI{&u?rx4dij~N2|0ew zm~A3X;|ben_xgo!g}oZ!@AyB1 z*nCT4=2ah!9kaJ=fezZ+BKUWC@T#>^g%up!aW9M2N}Bj)V2S9R>e)y?kUZP*Kc~5J zo)h;Wal${Km!SQYB>HLm*KPFg1d-)zoe6yG9?ytbGi%}^FM|f`T5ktx4Y6CbLj=R6 z9{^n+JLHk8G#3DaSDkBqNAsdoEGYENxKL0TcnfkBewa;&^8&wXw2S8fs{;(@n3n9I zr84jWz@6S5yU%_OLrB#gt+%)5E4T3iWP{wHmvwb7#7wVTV5)v^Nd2EfN_AHq;cbz^ z5RFB>Wl|M-QXSS>8%89@bU8?6AHzS}#PBcLHn|h#6!iCx)1z9?C>?O&N3gDAWX zdw6?lz59_8bL6X_J?T;GVWvx$sSh^E+u+%1h=nGx$kpEzoh9eT`htJnJ4fyMgN{P- zxM-6)dQ;3XeeqJs*zY_pyswg9cFJBc+Om47a`{l| z7@n+WLbWZQcmIwZ=KDr##CshDgvoCq+$W+wn?Bzfmi02U#-c-}gU+@B5ZG{p5_ar- z7tTe>cyt7hpYKOt!z@yI4QIU&=N|K43Z1Ap2he^1@b{dH9Co^#ZWhhuv=FIka&`%Z zh2PvF48qu?$=-l7`i9DJy$aCANLCbN=%OBCh$&-eNau zRt#6(!%jrVU*44I~#BZFA6OsmEqAfzl&NpeGJ0yqaDfuu= ztUDIF&=hnY*P{A@*&z*r!2gwihxdJiz(&UB7CTEH-kp~}%xg=PKM$t+oVucKUL z-*}y<^v!MyN60-i`3K#Cv9Q3H*8;b%>d`&ncaQLyhN$o(Xh>R`cz0C@hwU&P9Bv6@ zEU?O2)~cVEXfI6R3j5QAZ1C)Bt=Xz3_Mpu#05TZ*$Kv=Q0w?&VF!jY{XY-Tw)03nm z)&J59UV*)uR}+ag#n?5nApy)3&EM|~U1vR5nJO5OdC((HMjBP@DE3)`||A^4VE~77Fi6DZ`U8o zQ=Z^h#veomJrV;)XUa}B-r-5R3@kwUKD?-O)LGu^*haUcbPAT}75gJyqLE_v2R16d zzE+1+gVwl7?<8)}zaKZCX;q2~#6Ap~g^_p9lsw*ir9kAIKZ%~cK8G}n`DI#uGL-Ke z-kv;N@j5qF#tw}do;88@%bx6z1f9@;*Pcw5sjA%xfjDBAeuaOo6ERL0fCaCKU#!ww z;zIKFsp63$*IBe=BOhDL=aMVT`wL;fCvbN!q*cNypGaxt+zO&%x1*rL5mU-W!ITZX z=oblzk@JIhS7hsVl&2QYn-|;9ozCR~sLuz-Wg=x0&yEdY$6gUzAivYF|3wu z02TyXElL6Q`-#gZt!;zTrjyFLw%+j6ctW&^uR@~adX$sw@v0!r(zV8I(qRXth7)a_ ze#ctu0huA~v(+mAk&=7AcrW-8iD)?_8_yc0h55FVoTtu;fp^Y>EU?FC)3C!LSU4Jn z^O;=>OUy^n*$rze=g-<3Q~@N_kKxqn{swHaA_}4BUN^=#Zm!_4fVa>t%@bQC?vaL<2vrOm2IF0G2%jK3*LJwrJL$%c0 zLd7eS01)P3H{+R)-y&iyj%|ybfBy1~LiXhR=UIVZZ={w;NB?&7mi@uTN!{Uje%mFn zIcx_Y6${UBt7XhQ6_YFjtCzh0uZ&dj!<8ew>F<2 zYN&YIO={s}zt-wTD_>((2vzni%JUok8y{RGgtj>z@H6XZ!j2`r3My9eyT!fXt@yNp z5x!9AGd82Mis?E3P0szJR%d}1OSStlXG^s{UEtvw=VYvG{eiBZ?Ak@8bG>&Ay@aKMGd@~#8F^d(tCV&>2U397p@RU3zWHl^&kiN z>N-ETb^qjSkc8%@io@9HA+ux{`>irN- z7+8nJ6`Uw6QtP)MkCMO(W3w{g;nLG2cNOUEUR+J5HT-u{OKRtgiJ*zUIP~5ux*rH` z`6RV?g`rdyR~bd0B`S;WA}W#j(<)!6SFK8|_H+Z>M=0WSU2@vSt(R2;r?!J%n@N7_CBBRfBEXg8rgiAq0#)3bZet zWwjWUMYWrV&X%92OB41_d$;1c*vu`5v@zh#IFmRUn9Qxx`jvF)t~Q?TG;17DBR^q6 z7<|9Xw;I>SS6Z6XEqN{uyI4#ONwB*JFn@_+?*ux2?iEh(2KC^uEl7{xK#Jes zH(V7%;-GgCKWjU%`-yA?M(N|Z?CG^WIjb#2i$m9_w@7t=cx*r$`qd&$ig&-y_ez72bwXlDQR1?SR+l|JU7M?-zrQ&ChAWs2j&YfOP= z0Y_B+52cv>@72!l@ZENj;RsFG6~f6Z&4tVsLfpv~j>P?rwwQrl8cAtw@n+CRzmN{^ z^8=heau4EOx9H}(?O&B;LJT~sd^_r?Vcg`1DH*^C->_9J1bjFcK<FVUFdv1Exe9g#-K&CwWd7SI{AeCslHq;z{LC^iHD%^Pq?S^! zO%51=D(orIgh z00+!pKiUHke9zBuF!r&;;R*4pjtDRapDwtce5zPKb9A+`+d)68$EL_W(7m8NXz>BL zVG)#a=&TaLmsa05CC27=e=mBV=G8vcvn5pn;Yl7kym0n*`T)o2ntF;{c8eTnZr*pc z${x{2`%W~vl@Cw{_8p6A9p7>vyU1uWKh$Muz{`JE8NFQorJtPrcvV@JKElG4xLO~l z9XNaT$L=mwf~e{nrNuv6(O>VF*3~ev4tX!<2rDg=`H^eb{N5pe!!`u3#%DZo!pX|| z^+Gp)aZF|jjW}pRLo{y8H&&RoXQ8#Liif|#bhWF$PG+Pr<7NI^+T5ZPwqaERmf89# z?-4YD5#9P}>TXJb8K1!-5G7)4Sw3TIlwn|J?7Hr4dZIh4)!>m!nN|S9ixNHk5xU$+ zu-2S}{9KY%J@2)ARrQchH=B|*loqGY0b4B>a`oy@lwt}YQ=ojv<|O}KBV?8H_1P3A z$La}Fag<8=Tt^&%2DF~z27B?4Xjpz8cj6l|uDNrYWmU=1PiwmQOWUTU^lK52WB)N} zT_>Mn6EpJ+nvw_lJeSHgjiw*Mt;VLxu6tgoGIGrrox~TRmA#(=kLEdPC9Zg&LVbw= zXy6DWz8Os!ke;GiR4pJsyzv=uOJ0QvDDyYB$wMl?H2K1+G(wbZJUEuFa>dl{eLD{z zX+*=!^47Z2wD|SxNhf`cZ?1qkIuOe9ej>kL%W#wdwTK=4KBt<$5D3cOH8ed~?YwV! z32{VhS8*&FXh~O#RSzq9{NbTIynSuFb`xE?%(bacHVwQvw9wwTwu$ThUAdqVJ5FPM zwF5=*pWp7i)8UFqTm)n`4AIPc?) zRus@ITFwj~1wn{6)gpO$49s_8N5bi;tK8ntK7XrO82IjV2l%{7NzZw|hQLjLFRguj zdXFIl#1qrJxOfdvZLZ>xe#71j%JBG#F}Ngy-*CTtlY$~?|C*kI;A0|I?J$MgEBA3u z_#y+mtRj#u(}^?aYdAMW{*_bCBoQy^P9zTcfA*@s5rDoPp5w zWf8Xa0y|8t)tCx5ie8n}^*C0)(`3j26U%pJDe7Q8$wbC{2pfFtKN-^VX`WoM_?n2`~7zzMeYw+Fyd0+pEr_}?vNr=s#(H57$ayX zDwJ?tR*m50_iJ8{zoX?GKRhXNXmds-nTtoYc}GW!*~u*zTPMUq5cgx=Ygk+vapr7a zx4s2}T9kGmZ`hi#ceAdy>G1b&4y{$Y7csBr1HcVcw8|N|k2C#Lx?aAWv4-v+s83P% zA;scu>W|49m#$lykSH0m7(5oxktf<6K!1$^Fi+iZj%bPwV<-m+`K(IDn0}WZQ`{n# zVSX(N@60}!#B+Qr4V>`WdB&a2)#!eUrNQBtQLhq9-rMc$oW~fz8)w2ro^xlNp5vY9 zgCgxZ&~|04h-Q9?GvAnSQxCmBgJ~{}Sncx7k%$V8nz(NX^bEVPT0>|<;pmEL9@}yj z1NDyh_OG8xoy(AmdqpG9UljxTmQYy#WmdX5e)z4*#G{Mau4JzZ&y10qRPAz5?9Wan$+n z@`J4Yhz6;ILscspB@B>&eKWX(fG^rDWuJ;rRL*Rly08eu?c3@rje5TDeX}Ox!cu&I z^Gn=klm7U(w_--pH4*_W_5KyUBt!V@+Um)g|bAW6*YTUxYFd+hPPCFp)VYJ1n?4K?wb98 z*p`{!L*5|R5O%iUl_$D3fR?l1XHJh3kq0rc2}G28Va}kf=v|>4T;oxDFpEguIU&eq zYU%97f6hZ_#j9kNAN)FOptR&=(A~SbK7667DzX%mKGUIEA}U{06f9c|M-zp=oIq@e z_w~B*UX}uEF+-6SLpD!qke`dG(0V-H(H6dPc^>029c#h)iTS~qB~P3%g4oVRd;$$@@xhuBC7M*}be` zNYuiH!$~jB)Lz3G4r_R-vcvpLL>yxa&VbzXb;qbg){KLX4T5qE(44Ua3Fn#WwcV`} zIekl~{Y!QczlQ zR%`z6eg|vz&GXoM0?lKdW2Sy*4K&Zwjwb-j3(gnN_nouWqLC31dB;1JuWk;39WYN1 zAX<>H-}sRjou!8jP5Cm_?-Oc*x9ES&Bm}+q+>up84zB|x`sjhTQ3eHDr>~Lfupt=$ zECQEar3D$ulnKdqt^Q5P?mYAyG`b9jm3q60AJfs8I~Uv*X*t3ReymEED|_mVIhHMW z^==%%?6a9oL{V7w<1I3e`U2FKl{8}$83BRo!8Ek2Hr{_jsS8`h--g!cOMX;eFD>A1 zud&M6HjaYCgD`9sJ7ib7Cr8lMKFfcS7JLBn?~IdxgC;gCvgr^Dv}F)crv2p<|d$u9C(38M^O}4Z~YJ=FN>Tk}6z&&baD2xy+GZe|oz zw=^M^Tr!1P#-EqG_qrZUQW!gu;cPR)2|Sx|emsGmCE{YWg!b8*8BPxR4Sq+ZoYo3> z)M*|OWZ)H@Rx^H_IVz+!IAOcX+95Q|%S6+5zalg&e0h)YC_Eq^V<_JyuVx^QTP>8ED8urxvNzX8i>ymi@sR?Qc~1NV zZ9=P2VO5Q_L0EZPrJ4^#G|r}votgC^Y|E%8pVPI2*-!evMc7}`HrnMJ)siw_uCmUM)IzbKcn3gjP7OB{nny%1ZnXfQNmC4}&TvxS z+9^#?Ns8gRpG>ok>Z=8_widosl8>>qA5q*UwfIL3M~0T|_bD2^+^?&4SGqld+1gpN z*BBmHWkNrxkvxd5=Vvv`4(nI-=wbT#B$Xi8-jD{yhCS z+Oq9hN42w5E;O*KLetf9R)KddQsaglnYU}QB8t9B5~W(;;>fQ)w{OHUJ3EPe2+&weYw@Vt=c_zE*%!c@7lz21nlO~8veBM znv%2iFkW-G<|ZjVyB*vHG9e09G#*QbKEz zRp?kjcA0BMc3FO)kTxX|`z|KjN2l62@OtChr!DO9BZ}h=YS6m4ZX@o}EEcBwqEF1L zNo8pqYjY+H@@(0Q17Xds>V!#FebH-nl%HZ00%UzCsDyY@QfYihyYB8oKlax4$%2dR0Fd7gkmW3 zU9RgN;tqdpqIZL2@hd;^klq%Xi&MT7Dq>LFm+z@P>aMczl{|{KhQ}z5VWRTOjz0a>>wk)yZe}g7 zI~8_4^}ugV`#xAg(&5T)#xFgtZ@N;(D z!t~x1m*q3H1aILW3p_wh+0=%@+T#raD~zzHH{jBji9HSa(P*mj5FDLnN!qnu+=npV zG0)sIYV@yIY4;Aif3yGnozD@+mQVDxN}LhJ+4Wj{fS*HqMC__VH_TR>HFFhHTDRck z`o?d#4@ znBIPO1o>gOg(6o4El+2@@mX-d zpgt;q=}^!{v2m`lvn3{c92u87g7%s8m-_}~BwiE0K3+EF(_Wl-yuoWkQ;{EQF+7%< z{jNw?*G5!is9d-<$&$w=(+J=B>l9g9g-w@BTG+OZ2m2n0^V%^|N0}soirWDCrEV>t z4sfttoc^4T?uV{xm80q-XD&6?9qU@AI)x?i#AqKvp%=nZpD7~N4JXoFX{$04xzZ{> zRPaL#fTHqKzDT&_dzqMUoPbY0GkNh%g@$GcXMBvJ-8C zQ^9**4gehlt6vEPS9h0_wtG&dAN7hSy;XWI&LA0ug3M{Ja+rH0ndz%?18-uxHXEIq zzo@x<97QQ7jJlcLw0zw$TYkZb_e`j%+6l49YJdzy?CG&m`c*wEv$nNyv5y?Coq~QJ z-10qy%-#rBT^%bFrwY$)<=ZK;=L~d)I7SCE(!FTaZPSYXX!Z{E@#)zA%8yHBJZhNq z+vc??Z_}C?Y3dIz^(9bO`=gJe4S8(B$IF)A)TxY{hxm(vNKp;Gqh?FaX-xNfB6%i$H+3`q629(6!*hG1Q z3bzW~lZ{vXuhP#+xP%5-nmuTdim6OxL-^=7`>efGhao?_w1lVU_?j@No4}23^;O3f znK`l?pb8D*CJky_zPh#$N@Gwxwbvcx6m&g{8$bALjdE5ds?a%qHsB{M>)K<`sdm3d zoab)Q7;beVnvS@j?hWA+{$W9qp+dsPpePSvS&@XT|{>fKWV`lhn0EYyN@tF>N zDi+9&%r94i3L0}$DktmC0T1l=^(V{BGZmMv)bye2bce6L=z0Eaa{c8=V>hD^cShne zXX^n2Wkp<%B%FxGtAa8J&(>M7pd`PE=CfX8&U*llny5xIRdwFb-KW26NG{J%>l%+6 zKebdPWqvhznk@Tdms);`&Qa(`vImS`T%CdY?jW-3ht$1;=&xmfDf2Pm;eXpQV13*i z^5r=hN}TpkTDSgMv9HfLozJYV0W}`B5Q!BJbC0f$Um`X;?L}W z#)_>eljO|d>;Nd`r8@H_&3lgy9`wZ?>B;Lp#Z_CC!ywtxNLfq4hBxSV^rdrynq*u4 z6{&mB)GORfV@cV(j+hQw0CQ0kgU@|b)bT%pr*~PCc^2CC!?bA&MBBtDhwPgje;2=8 zlXNg*g1WldrA$J0VS<14o}B*XGX*Mj$V-t>qLw;P_QCJyUD)w&psr`53Xd3sdr9JM z3LRFF)lqZ8hCXsu}MM#L1sep>oG zoq(TCRyy`o*C!dCq4bh0tnSSrnuSOp^@mk=&SzQkacN6eE1HZ+;uykSAg)K$*8=+s?iLLe~!W zT{U<06mIdoU2}Tl&1mRpd!6qL!B_ajA+BkPlZo9L{B8{xLT7;uEoQ{+_yt`z3)%tu zeGOMYFRR;2mr9aW_Ho~ zKMy<7SIwz0q-6ZTNI<%{Hi7@C>G`o4L_qWO zv*_n>E!+L|RE>(P*!CWCth0)+pjPL{D7m%#_1Mr+0rRi{a3#M3-6H_~CmS_+&DBp+ zHI`S_rxjEXU&21)%ml8BhigW$2>HEkB93Eh;FI7K>O`!fa9!e=M*my!uXmudh~b?% zL#QuAO$SN?oGKSnxj83^Y^mMJNZ_6eY*$Q(+-@4uT&=i^&uaA2$8c3q5oXoMZ=k`q z`c3IcJ8^_va`%I8#|{-@J~b~7bwr_FWU9skR0lp$Y#}`jLapOPow=b09+1iLllk_CULL{E zYC`%oZ#eR^=XDJoY44uaT(rk)r9XP@#7VZJ$!<5^li&=A`gt4!{WaKFB(}Sr;48-p zwVpKb5$ADiu4oXuXYp`%8+5Sc?1)fgfm$4kbscAXKsq=VYECgoaLmL{To!(7n!J<52>ek?k~>J2^Nyl`Id177yW>ghgIj(dxr_&r@3M$$Xt(x+ln z-$f&QHBNX(1NShTikJ>tZ+;=YV5s*7aHyX_U_1Ud86Xn}tvtw8GE)9GCEE$E~+ zIa~Wdd9(2-JBHN3inhl~b3H2Qkc#{yN9zL<>twZqF0I=65&2cKvkjKb5sS@Ah1uaU ze(THD!`~osxehNA%<1PzZKvO;|6HWUjT(D!Ut6hc?)W8MQ!N7nPZ`L!#;Dur zjm=#RT*j~-Ag7X@i+q&@ys-ION3jpYW<0g|!Q+6w_&pYFrdS6ruh5HmxoG54Y>D5= z^=;SPS#`wEsNRH*rgz}N(9fLPo@ZuNAaISy9Q&+q+DmYi3uwvIl&HUe1|!;xm;R=j z^Ba+K-Z$ez^V|M|t)5ahk^!G?NcOfE5t`g8W5JQdjlB9)9O&BMNZkFg=k@qA&UcYU z^m?_H)jHQ}KIIjNTI<^XIBZdgcwU`$7n!diTca{qY$22_U}ROG4#-<5G`@a6u8P(! z(UHM^Q$LDlVJJ4$QOaq9Tpw2t`k>)#dJolP@QH$(&~e;miQrhWNF|~X;)q(Q8~PaA zrll~M9CI&9ZBD<1plDj)I6hM8g|o+cilDK|QQnD(5(Od!s#U`g;QC+Dd`RCP`5i0c#0 zftK*24=SaxI@AhiR4gU?>sG!}YRY6x_~kK;kMCSJ4AJ=>e0T{9hFJ;FkRtsLmS6Tp z(Ai$ywF;AgE|WgdMrSK#bsU8tsUJzsHUFWUW`)@73yx9fiw`L!(7P*d3KvQ)+t1yz zEVVEp`h@Eq<3)2S)%=-3&`h)M5q~^@hb!qHjRE2TS(eGac_@yoJ3;SUR zmo0*$1t*%-`I%oYr;q{9nqQh2x?5e$@g&e!gA$OpB!9Ryo8zufGn8p*V&-p2{v`fq zoJbCLy`v%Z`RU#!nR&I(@OP7&7YN~~<2p6Nh--ql{2R>Sq;D3c>eV*yK9p(rKR(8F z12&H=D$W)p7zCTw!%0LD!3v%|i@2GY_`l-$Z}}I;kFRMclk5gWh4Q&!F;jq>`hV=* zKegjmXTY=ErnoaQL5Cv^NrcDBajUWddixtf{4p_$Hu-2xF6Kh){{wd%{dH`XkRmX3 z!W4_BGu)g?%}jcz=xVifLD_$YLRxA;&)R)X*2z}E<7udV++D&n)N_`^O!?wzk7$D| zW!zN6ztdK72mtfOM8L`Lcehg>6K3w``x;&+0BFwtAdGN1=-Fy%o_z@nx=RkamMI_d zB9Iz^>%07ic<6EvJ_UHP7B^t;J&lv3y;*x#zo|)v?EOW6tmm4j&3B|=pUcH~#lI(7 zw!vKfJ$m+Mkn4A*aN!iT&*%UA>jc_ZxqoIGumagPlgPEC_eZ#7G2L1**NMTq(H0{; zp$Sy~F2YelMM-M6?H0I-F$;uNjf5K92`wi2TjMXknEDW2yp??vdVJEA6ZQY_CGI9d z*B;J(2O0nB3m!LQ?9HE@ltI_NIQGNj$=J?(mzT7ORj{~AH;0T;8(tgmo&vr07%O3 zJLfb%!mt^4%SQyow-Sx>4ZpDbi^y%`GdgGAi>p9yk0ltMt9@UEkZF$(sVa&@_T&BB zm9<~{HNeNp!A=1OS26+Q;9NGNzgvOCq=FZnaNNL^GufsH5PF5Q4~=XBMF#P|F=#V> zK}{6vY*71$2^{QGPhGQTX6mq(tkk&>5`Nfu1b-2ck(A9;uZoPB~TZ8-I zdL$K#dGRt)ZEbcp{f#x2xTtAxIftp~POScvln=Vikt7(c0}V1aGN zLcj=N*jfs|^W9`Rtmh{;WtI*3z|*Du$qJtR=fNA|6tVW54_oQ2s_1JSUxao)zpr~P z09M7(ub86w@+Xn&w7;5Czay*um&shzr;^97Z<%j5K2#KXJ6g3UL}bmV$`m=}CxfAs zUs3+Qczer$DBG?JR6&$Rx<#d9C@Dc&y1TnuT50J1Mp8OPQR(hcIz~FrJs98f zyzl$toImF;&WzW6U$OUId#!abidgNics?~Dgs#_U`Z}DksuDj5)~LVnJDD`4NXoL> zkFQyF+vGP^A?WH)9}*8#5I{pCH`#i0miK+UDp(IJc-}kbO+NxdNfG$dc{6&Z0x>w_ z_JydAsH

te%RGd<1w{0SRvYF9|Bh>fThV{xEA_WWi6 z=`T<<_h7KRS@C1)aCAopPRr2{FxGF_!rby~frnpTnh8VfqvBl-OmcZJ_ z%S;pbsapQv@Yb4)UL>mRDsZStX=Pf}W)I4nE?UJ3(dj1jPE;MXF|h)Cd;K>SXM?*< zT69*?I;NzB9=;zeq1#Lya}&m@MpH;YdMvydp*zp=xjN#j0)u&A`gx@3P<76Gp&0ho zr--C^>tm+m@|*X{DQ)tq?MEuh0hZ#^a z85c;DAY_v3M51kSY>$XZQA4Af2vi+cT7sHo%9PQ&3k)}SxPCqtwIFX{9wxZPE5+mN zYVnZ`36upLE^O-GC4a+qe?w-C{e7iNLYYpo{I}Pd%gM(n6D?6>VJlYgUtuOO{NEpp ze&k_VEKdU;JiiOFLL;i0xWo*Ot4E@LmbUNA5{^&aE3V68w&yRe6+#$F(PwL$O)khO z)$dc*YCglNtH)iO;}xC}E=mqXc-6$5z~0}t3Sg+wQHh><1Ql#gAXqA;EB&MLW)d{A z>!q*jiJwJjnBb14JMbN>=tAi(d(p-9-@f(lRRW5x-@Lab*CU$uyvO%56(z$ILK+DS zh*-Yn>v)dS-Rsg4*&sf8q|^6xu3)Q9RznAngPFcT;0sa9dxFbu*>#;!*-)Md1f zMh7j`vEf}pm=D@C|4>dZ^cF!&)X)_5LX zwYq^MtKI2e`tJ>{khw2Czu&OAxQFZAX(<-BkDxa-Qo__>hF)58S(1gO;SW%=I8#ZKSu0_+}ylG0L?=s4>pF_5J zzom3HXi01$Cfi6K!nXaVRx(uAn z)jAnfoFZzZx-|ySVwB+Bpoq7i3xrpeda|Q^R%*5{xI`54p_?OsZix0S7t%=|^3U~t zukIbLA2`C3PW6x`4} zj3dowI~LK$#?i3BS6>Gii|)EG`)2r>^4mgpOKv2csr20+QUgqV>g_RHpK@wwCd?hV zmPV!3vPJGHg0Y%)N_YFrt+)rA=7%-{{S&`1Xv%JI3pB(>mKdeKEg8tc)w+9V9N}>K zX8JXi-lFB*LXiMo%18hhumO=Mur*XI_4-c@>6pLGKI|ZdXOT{CQ1GLP<9^XI^X4m z4qGir)*q(K)ov0nLvn^~6s7M+b(DA5TwV)ClH?h+wP~Ucf zcy$*=I=xmCng1%UHMN-Sq`r$RnB?SV&ul++cdNSSkz|OHUg_yv7VV*?{uxqK#6vn} z!$zOMDAo`|@P8a9&$>F|HW_Q%p7t+t;jqu!xYS3s(s8#sCrD!tZ`yF{_h0Emd}9qR z;8OauUbxezABX|gAY`fH99le;u1y5Isq^oF{x60uuG|_2IX*YL`kX@ zKi5RP{=Jr>p~Za_W+m#VQISc7MQsT;G#$d~@Qz@!kI=_&_nP};nJDl)mGoI-Us=xH zGqrB7TBPxss28;xf)3OxaTHkSt+rQ6cf7_PnLA#k@k!si2dM)nS&Wz`7GLlPtH z9Djrg~sX(zm<{ib7CC6&e4R9tFbO;J|E4B zrUP-)=25MgL0B9Kd7J0v8NN(~GAMnR`!1s8T#Ls=wbtk2OpHvw(ncLKBBe6DGggL0 z2TR4$!a{Tnnx)wj6UJA#l~&%~bw3{zl>J8|faZ?=6`z+`>Y)YI2f%s*Q#hNXXDoTp z{cORe6jhU-^s4e{=dc7WQd0Av-gI$cd*wTMmVw~~eh{V}J^gpRuXbmStVmIn&*UIF zTxxuz^7%Wb(`rA|D7=cdL5z3ilphQ+fF|_q4az?kOn)X#uKD-=W+Ns%;1?=tFOE;| zY?xR$9X#CVfKJB#{MzGYqmk}0@rCC3GOIFrORYN=6W1H75?SdP`UY-KCjN(jwC| zd0{h1klZev1mwH)pFdOy>dmskd`zw1UVz7fD(C)>0@iotzsl%_KX>MY3?IaWKXe!uR$H1E+4w>Q@-z+oo@^&gF6lqY#7ho4|7 z)!^ENfY0irphd!6*oII_fc|y@g@VMMnuv;+2 z<}voJ5bW)fN6q7sgc39EKbda~V%HL`qBD5vo%9Ed=E9vMd6+cfz=A+m2XGtW`qdgj ze$r+U2R0C+X2F-nHeg9mo~s*iy2q$>WReAnAbY@2kaoP~JkxxKys#v2B4NdS{34sd zgQ0ra?^CZkt#k3P5(-4;TKv*4Gc|oY0EfG4=A~^%S;i)&diw0i79T?aF)Hooy#vuC zF=%Bq8vB8jh* z*jo&re8z`9!aZHX8GPO>Kqfzz-Jtt<+ZYE;^Cpq7;pLH%nomd{dk00v_HNAmzRc^s z?r+R#_FXlf<_U{{aTZ|dYy8IvU?JRSIR2%Jum1pRj=$b3UL&&5J9T3zDWby2OjUS` zu>->+#hT|B>16=XmlcucDzs%76b>a|GStY^vwLF?_D+m>nI>Tp2K#LD?EJrr#XmK) zwgAz5ih36e)G^AgVRcqWAgwXsmSb#;arg=;nlBsa5WLseF3^=q&0>1NX8pIIozku4MmZxF8eCoQ+O;$r`mmI=-Yc9B>_&OTIVRn1ty3KWX!lEJ;;G8uaxqn_GH*%A#(R! zRkz2}vM*BPVHh=5g(7a%>e?fpOUckT`##mYQfl*W^qLeiBM{;5zwfYGXNJ-pHSn0*F$46qG{HXVJBhjMsM*L(t`b^X8D2i}KyaC+v>WXc%_@yej|z zm{zn5+Yxf!-7}zXrL&ZlO-eQ1R5x#CU>hwdLJV?K&X;eamDG6=eXVh9rmVKEXQ@8& zZOR&^nykgMmBC)n7M9~jpS$D~u2m;5cMihI*8J(Rxw~~Cradfuwvte9P~oPV$V0vb zi7Ibaf&L&H6Pf9Ih=bOgH{#@tjic^xCScIQcs%e9ylR}lsFFu&PK9FA!%kY&zTza6 z*06m#+ZQYzcQDyc{2&+YsR?G2G1qinea*fupp`N`U&5CKjyhArvy*xEoA0E@f~&2c z;f_UpAL;Rgs-M8o9e4})1scu`^1_e0N}k!J3~-7n{bgC1vK*RKG)8wlz#+a?rMJDd zK)H)w9T%%e6asBU#S+B_;YgJYXC|^SadOI0QQifsq{!zfPtnk&(uE9@ls7NZNOA9t z703H12f1wWbf>0|A>{1Q8OGb0CW2#NLop%l^^oGno zsMXhH>WNZTgl7gF+8_#v@jtPIK=*~5lKHOcE~{1>dLam;^KS^zQOj~VaDP74N7#_* zoZ8TTDtKQv-h>S6SFgbxBIvPK4InX+b?t15=t1=}mvAiR*Te3|tu4+oU~0by@sqOX z^v-6RcR8irJ~E?JhuiuLmRv}q-JXSgpifbeT3&sn^o1DO;5N>tMN(=i4TFjL%efuw z%eXwk$WeYq9FjVTIKTSsLdp#fzHFfgTp7NI2qRWuyVBlQ1cXMs0ih>`f}i{9VRpfs zF%c>(^r2)B`a>+p$v8xtvBnF%e!Xsr$rs;h=9o>wtcDQhswKEc-AqU(p1dvoV`|h>wyf#s9UW$(Y#`=t)I%4Yx2I0p4mW$g^C1K&i7|eGqc^w3 zWbGXmsYH#2{oS0s+!dn(+YQmz(+v8k5uZ+jRXK1LP~sTI>sAb|4V8|+ulev_nxj^VEPNv_Ipqf$ z-N&6=h-gO;BjG<6zihv^*}Kx3$CxlFpjV*u9)p8PV*(Io*mW2`)f#_AotNTx5I=9g zWnyKTvXm2Ei;}0O(T8h3|JuR-YpC8hwv`*FvoIoPUTwF>2WK+ZgOG5*qcMG4#-?Yw zo<#|@A=mB&;~h%XU#+~0-IkkvW{M3RFNz}e#hBec?W!*bZ+39k64CsrLtek>nm%pT zunup%=xYRPoAD5$jkedA5Bfx1lo!PH)X-{cY)93$L48K0U zQL5BrFTEJe0#DPcjRBsK!<90HHLG8lMeza)OrXh;UTVL!=4>%L=awD^1Z}1|gl9$+i1c zt_LUh>`SJPU}Rk$BJ*;0R1DXrA7edPueLvX{O#+IDI-RU6~WGFvvwBDrV^pzU`Y1r zu`A~`uG46tW3E{zHARRSi%%!w_;Eb>!9Z~VLe0`LVas^Z{Jw>0*k!V}Scl(kTxeti ziCq>LzH^G9fTH;F(3$&T5nNSwxBB+YS>OySQPKXp{w>GG0xp#uZ;;!Pv%uzrRSNwtd zAyIg<%mA)VB9@PtLDoR=CwYN!Jc$h>OH@2^>TWthMS|=Pnp^MP{5Ih;S_tmg`5vG@ z*RfTGv44Rvxd-QtoSg9hkL`VdIUj@|a5KaIpg#KpV0?4irAzKf67&4Pu?E#C%Gf4{ zS+~z=ysBY(C3bitovcA)de-!r(OvFP#G8|q+BL-~ciLdz zrG!899(9S9>PqoKkr%JBhfaVEFTOp;w~^&^zo)nuLzz5>0m28dNX%*$i$O{T#Mxw; z_@uJlyigt!iE%YlNdqHPE68|uv)HqjLw4RH1gQn)l6s=y<7zz95vF$zOnE6g<;a4Vux^Kq03tdDdrg$MkyK>E-4G zn1m!Rqq5w4k=sIZldBT?qKwb#*^$=k1hfrDu_!A|)Qk-h(<@>%LcY-zGuJjCfz%MP z&1y{zYysR#JA$?}gP=(T`f~0u)DRjCQ@ z3eo>;g{U1W_Idu)ZGn#BGS5Y*hlK7jM*;rn9mBnl`Bjp_lUPj;!krXV@Hile;_ zI*DG%0nxkz3SmpA2!mx`HCG3Pj|)#oT6_bKP6bmW=h|i))nEj|!t(lJX}1)~lXW<9 zr&8aEqm6^!)o#rAyS$TM+)^8&Z!s2sp|vr#Usx9_jRxJmWJ32f%5rncKBqseg+Aqo za{G{l^ebP~8II9y&>MPDdCH%5lLu&fMqodP;nW2{Bf1CdV9_v~H#jHZ9e2K!>YJF0 zF?#djl=k#(VbVTlCV4L-~RLr4*${wzFT0}@drMj$_~t2;xu$v}WqO=dB_ke9QRb`)wx)5Il` zCZdCuwIFG-EL~mllu#9K0+iroyFW}$ho(xCw#fq?J{b|f5)_%ooHUs!le>F*%y#m+ zMk^y;B^x^PfU3j82d#wKHH^Vz;@REjj8{Ts|k@vIb*&}TMz$#$TbNf`V z_{u;7IB#9Mule4)pSh)rT&|nVy3cz&V4vJ+f(Bo?=S)0&33w3PHdu+-o%M3!cGB%kbQ*g#yw;7c^&<^S{lzK`jB~FT#q4KSO?f9th)??H4|l zpE(Oo33w9M>Uwp<;T)!va%j>Q0xtg1uv#{j7qyyv)5*`D7NrS5cshNH1YMo*9QI>g zH`A(YO)Y6OBP@5024(QMpX=`ztYg+gt<4GJH9wwOD6P)5u8f+)y7 zTr5~z^?-ZkV>5vf_Uc%j{X~JEb3k1!IsRp(-jfV#_;?H^r_c8O*s5Xz*%gB^7ggJ! zoj#h&@XHk8Lk!~=uL~R0=ST6*pY#OOqAlCC8Q)}IcZu|WYz_g&WSj!Dw>bA$vY&tN zd_Zw|SSWb);fwdRbLPdIh2X`9FJAW#rWJh8Ybj1YhFo7(pLFbb`(7`cwD0Nd`RvUu zUhfKeK`2BIt$^Mfd?M=szUg)Cr0&+doDY{5g6XJX~iZ(XrGl{I>Mn0$K}LGJn&Gm}2o zKNTip5zhE*{&RSE0(isknNmxnlo`~xA}v*E>(i8z74>VkZ*s$O-iUM{I1mXv zpV{}Fz>}Na)?JmZg*M893Wl^!%|)Aeodho|yU#P)HYl4#yD+!Hssw0VskjCTGEk>` zwXLMME1g)2NS{Hv#EwuGV0wg!TF7xGi1$Yv`ak+*YItjrY|RiQoZlB47vGDsf_9UL zT^=d=9os436X%VOFqpYFv-42gs8H?9N4>EJ`s3{0`%mGdW`LfsykOE_Iqkf^jltKk zm#>lOvs+-1-gx$aWhPwI^pT(s1uDAm!7p<`ct?RXYP7huU-W+wo=eN>`jL-BE zldaUoW<~hQmGhHH#flj&a7IP+mxHpkq$HwBIdDRQLpr*rb4I_K%X)I-KS-?mkJ6rN z`(LF!ey!|Q-FEMe>e=%L_3s+k0$&~|M%C#W1O`I2eTdYmx0M@<##vdVnqa9L7J6f# z;N=;GY86K_Q~ic6Nlme}aS}&8I*gVj&qn;vs6-hhg7*fu*i35~(BVzCW$H+KOD6#5 zecZOakb)%XJ1^3Y$AOG5(ws&O)$wpk;_I?VqvB$#r^F~#>CHdY07X(SIrM9Bp4!PQ)yDUXl55}aps+tR{L*a=KMmds z{(4@czDgCj{$$hE!&A&aj-6taXss>GMF|gM=SZ&XbF(scr!`>6o(sb<$Rn+M5Hd^$?<(my{OKyC%XrwI z$z7B#$*#J}OWt%w!~j{rzq@L)?~MrPLiRI6w4_UMvm+gH>OV;unLwwln|oaK-eaWJ zYhnsH=jw^YWwwuV+mia-aI#Fa-&o0{kxTYee{5*+jjbBO*#M09h~+Qhh2BcydwDEK;;GT ze;~#^JxqcxG|ZcP_fXGx(9bIp6zau>!qEK z-;>LD%oO&fkAT!mwi0v$FncnNFByk5TSQ~_I&K~S0`LyDpFr8D*Y3^YRMEcSxAyow zK-Gg=XgLG?6~KIgU=Sev>}tBo|JlpGa~Q!5pL9{5>(1zxRc)b33cWA8xk|ybs}j|h z$Ge-0Pz{g6%%?ptVI|Io>^k>_2Ese3fAh8hwhBtQFF?FH;?WkUdxX-&hyI8H@l~ko z8ej-aWRCSsf<$e9S}4+Y_+S5H^&X6ohqBVTt)w-aGkrD_VOiz`n@RA=*_|bw{duvj z*K4@`UN5Q?(4kFA zxsL&anOoq#hYDoS(LmS=^^A8jXbVvZYl^w-!L;0FuD_hpKNl83rM*E`e3)8phEv1v zDj$BvU26+`(r@n-G}*!Qw4^;__64dlK+Ub!p6~*&07w@jNy(nMCGg#fS>PQD5irH} z+;r4sJrW=;h7u5Td+dGeGtXrB<#t0!5*@s#|86Z)gFxW z?TLH(XY9WZ%E1KKj@FZdDe%0gzreqHsOuvW@EJ^@z3O~s`e_MA4M3Lwu%Czj(?WYP z{PE7JXUw$PZ{Ey(5dK|3zjjS;_<3Ur*trb`wT{X5z;cJuEFP#(045H07SQME`Jj%{ zmgbg_uIt(!;{zF25|E&21G?Wk`~Vr%UyRV~?+e4+yK}T7g5gjDcSttC$fLSJ@DqPk zMEf1#cQLy%9@|O*+=|urT2$Yf#^h{s3!#jk4F))qir!Td_hRm7Yw>&C@$8iKe(u#z zp*x8Ca@gzyua<8oN1$4i1kQMZhaY|N!3#%;xf^G!r^8KG8U{a8Czli+!QO?uAcHCb zzifK;Q{?o;l0e);_D6s8HQnat;27?0st~~15{&+)I2-EzD(Cp(0)-guZyV>CH^ld| zjeh(Z++Z*62@7Z4C0Ey%4cHI+LDN5~A`DWWq%Vf7HOTOvxaHdYF={#o``&!vPyW9z z!#gm4wCF&NOpGp00RPQ@{aJPqc7@9q#@^}S|A zPr=KTSCrgh+ha>*@qB{Rry4BiWLS7T?r?Jk{9zN~j-S%;dQ)e2ALC|cu<-rq%eZOm zsZhmsaL3R`AboKt97^YL)YZetWspaKkbDZf-!b>mG@iegdCY>O;%r#1xREktnHQ^+ zV%i(QFi8rz%6xX-+RO04zlJzuf`jy1k3AgM|nGNw5 z*ZGxCoj-spzmY=vAFnb3XXQKM|8tdk25`*qFvzQ?T#Ws|F+Ta^g2Eivr?|b#FuhmX zV3xP$5YYaFCWR5m;t;x13pG(;sJM(MWK|9I>7Qz@z=gA3!4$s_?UZ)t#SfTDTd4E_ zz;$MN2(58toBc&gG*MIftkmH))CyI@G{Vns=@(?3ElI1XDdP_Im82 zLNs|j-M--ni%bfVxw*oMW$GxceL{X=mS?z3Tv-$MW>7KXD zKCUl{_uqVZh9ydaCKd<+iwLx*w>zJ}N z46X6v$zQFbjuR!$PJD@wa-c;6VriRnHz=7}8WnS6T>XAg&fO|?aTFg%h9_fzcOfQ~ z8S`kBTg|ut6{eJOFe|PHAQgqrU z2=~I=sQ0d_?s-GFm+8iY*~Ki^%FMbLWa;055uVgq4ry0$QI~PP#G}N|dg!Q{ihGso zG?91`rO9F1C(eOuPKkI7>aW9OIcDB)GW;%TFV1BU;S?QI8l=VvEpY?6vT5tcVoWAs zi1UF`K|eI{#P6m>W1yqh%(-E>Ug=WVQLEWE`exMR0o)v z88sG?dbAiftT~5~QFI z6&0BY22;{_y_a4sEPm{|ghylv5&{45;2SzVlem2HiC#0|!p3zSp_={x7fSgwOA4)=t#ZC15k0=QHN$ zrmQffGE5d0Z<*R2krf;73}j<`LiNP1tMj$*aR}_VZ~BQB+5}S;nxv|*Zhp^Prx|-p z-NM{Jq&;cJ_%7n!s_;xn2)IM_gO8U@)H7{k)@r#8>;dC*_KDEX%=C}5x4t*bQqYVa z+18Vj7MeFV^EOF(#P(=y73Z{mo~$pHS$hU~rJ+4S;>7xB@W0NY#iP+i{Z`$X@RX#} z{U{+!Rc`Dcj?+)!I)TiGI-jI_t*Ll(sK32tdqJx9ymhK3vSil$p;>?!O$oFD}D2E{q2{ zsedF5h@fs|Q@p7^=_7N=s1WB={D^m~V{l$#=ZHM1y&9?5>yQGEOT5V4AS;bxnjy0LkFK>HSO0F;Ar>gnwV-;YSFYz*e;qx^e#rn}Aj ztTg<@s=6Q{4n(lEBRzpnSuiAP^hM;$k7J#>opmTm?r6oBt5(h}JaIV@r(%^wg^3bq zBTDo}`-#TsK9VHYohXbO&>HAqxYN^iA#5)6%vBPUHdTVE{4E#q%Yw%uZ!3d;2!(g= zm%EiW8(7H9Mn7id8a!k)&>OE5xbBJ1HbDP)LZ?JwfnK*nc(-jJJWtOaIa*{lLb)zC)eBL`CyzfKD5wFt5%1&2K8OFt9m$;>7bRG zjlLA|j7f>JZ@n`_cU-rSYHEDv@AAEl6oq=5!tDhQfqQ8_T<#z5sSXw{Gt)hme{7Y_ zEGkU-{wu=whxufD%T*O}e2TJ8LdMUEsL!e%+LYUN`i#qRJUPIz!LT5;>npJ_P_wIl z^p@fUW_~hDR-1%FJXx`Fg^nFtP;fpwC7WdC1 znLF3j*-_kow;hpQA7+T|F|pHbK;2T&6-?kBr8e28v#Ab-WQ04TLm|{K$hgy8%ccm4 zAx)csx-h_p=NG{@)3K;ECh`{)6vJ=G^_}@DiY9*7`L&5j8B9REq8=CWawf5 z0AA8IZVk}O9E$pt>%X=sWKQwB2FU%}V6FB>Mn4uEFnx^QD3mH%E4 zze)_iCbt)<)mokB4TI^*7luN`D)4iwuNz&b7XazIE~xkPBn&Y9iQ{ILf3Mj?65Te9 zY5Kt68kVHs67Urg#@6_#f^JENf0?G`a*$bmaJaNm6goXfB)zVgvp zp2eSOjto-?6cI5REMxn%NA!Dc@~ej%t;*M8kwTSCuuVlJ0M<1ixBX!|SM0$@lIFH^ zQ(e!u3%^CHdUdOEHmPo+`>W&aG60S`5q5v@A_~YCCD`mNYpP{anZegiTWC^=^ zHYlUfEimEk;>}1YfOuBs?eV+4uqqFEB1%sFCu@G`3%W5qUBJVORtrzyS6dE32U*%5 zXo@MzHv9EGp*_U!NJ47AiWj3K&luv#Cx0IOLrGbxt!^E8-7k%4k)QY}KUi-y0bfTK zIYoU6MhPX#%bj`LtEKR`QTrQ~GM`%9~Ez65YhQ6Pf9Je}G z@tf;ZRo6`P7(*4><8(O|B83m^P7S(tq-ysv&LdC<%8ni@N9N6CS$j}@y#?1>;O#)& zZLUEDks-f5Ugv;<-42T8OuQ|lbTbza5I-d zep>}bF>IRNRBO^msy?~wjpT*d!Pb)OyruT?(^1Z7L{hHdX0CXYVB>ajDHGnKFNo{d zJ7{*j;me6Kb}}5imIm-JZCqYxZaPxcm;1t{2Udy#lQl+|je98J7xy8wIasR0| zU;X#GHgZ2`)7xdeYGGFiRD0KKM(HRST|?ga!GtZSD36N@@9XkQ(;?nq6>o@G;K8 zhLEn1T)+NWl_R}Zj7XbiHBYjG@K1f0x6(kSib`ky1cWD-O;>58y>YFZI1ZPe+$ zY&tAmup`kpDm%s*Uki*;O-D|sS_C(OS-jSZKA3$S$u}ofnk^l}LyK8EFTHmiZ16=l z3QAjk_Q4XIulF5?QMZnA>+$oC=hn@JsD0LF_UTaN$~%B~y$=?DNmcg{CA9MR>?mH{_{Y@w-EK+313B$+F6-oK)bV(OQs{jruW`0kTTyiy~{hD$o)ilG5{ zsQb^05_!@Ex0nI`>l_Jl?FhYUWswd+Dc8ukhkxuq@oUb$_VBibC)wV!SBhnlA+zp| zYz>|a0u8lm_{!f6Uvn9d`sU6AAE@qy!e^n}`dfX=+Dd{Qbv@eHI7+k4f=6szJw7vY zz>p$@D~*{b*Y@F*+vx^TyF@3U^C*f$eXqfNO9^1r?6+JJheUhABi?Nv(L&e@gTcW4 zRdTCg6!8g(U7*G*?qFQn!*b)7BnEH##jfzZg79!FJML;;K;BD^8drp$x`iG!y4x%* zE_<~vEt1E3>-raTPA=Hc%6t1((|1OekiIp}GO?Yf%p7YanW&PX6z@oGVd>pwGO(|c z^mg?B@;1jySXXl~NQYl%?VaXJi`ar%5jsi>SE?GD12^0_KFEDCotScb&kS^_@a(KZ zj7x8l_?j5#nDwL|2G3IJm`v%8aZ#nUyPix7eS+SqtrDlKOrK@S>0FMTdc_&F`qYf0 zD5%iEBED|Ltxy0dW;TfRHE?AoC3L3m?nO8BZNsgd4-f!WAHf6KEkTU9s)R5ju}YSO zIH*r!!SSue{!H46^vB0Laz(I5k?w^nRm&L#X~Df@53UVLM^DCF3gg&VOjuIycWmQp zavohpkp{k1T};dMaEUDUT#HYgWZx?=)BTi@q^`i!@j&+K$ob(bwKO0m2~`~IJ)h-9F=%iIv>VNSJNntiE_6sakVxr@zy)2 zmuh(fkITX8^ev-kG?4@t1km|p70WZEh8a`aC4UwNwUv);aCz{l9uS-V5#ay@Oz+4t zxdBFZo2S@#6#}de3vr!E-SY?IFgOfB@IIFQ=1%=1Gpc!x`-}e3w5U1J*<>+$GckpO zgmRAl=Xe&J&(!H*{xZETk^_%L_r{<1)k0I(2O`)cYljOXx~eHtw9SyhfgZ9|rd8YQ zKrG#Ru5VyFx6hG)OX=2kX9VpL0#?KFGjeol8#HBeuH_&4c(u_YA`&>HWswYPz4TlA z2nXHCQJ>X-JTm%9^Udcvqo!tiWwA3nKKu~wA*7{OdUR&dQT-?OI_Y)l1Qo&%mZC~7 zE#l<{D+#XHCWnQlnqkmVz;sRI!Biwtmv*IXTkw4(>ZMKL;$4flowu486w7) zW%H3pp;$jE#XjB9sC$&Ay7Zmexh}6r|0a{cP{^bIsd70hS5nLpA{b4o7Qc+#jG9U? zV;wY7=I1A^mbIDN++0dwm9+_AsYq-9!?~nIFJj?GA|LiWxV51hIy$z^X63bC~?n9@TQ2^mi!IH>~q@_5T zBm&Y}YqVV=c(G{-8xPEuJLkl5CuE`*b&97vJc?H9Ugt3CU^Zawew#M>B>fFkDfv(d z()}F8DK*89Yy1nJ2J@5X?zg?GtqLF6vCcuv+)s&!coHRxi(N;*QNVU8tCs#%@7v>H z0vMq`ZkACjvCT8n3VO+O8eyVlx;ux{Xe} z*@nn361p8ahfwKYiN+j79$_iIH|}Ecu}OuHr^_NAba0Q~rTSECfC3 z3+!l@J>R0y)h@#EHooTCP__Aei|#=8N~<>HHI&kc5f}w3pftn!p$}U)V&N{UNJ~P5 z+4fBM{i_6@`&OSt!EE!0oDpwvvt6zKu|mb~NpQ5P;f1Qb9%LNN=*_7dC|;uMBu3Se z+Bacs6e7a;a6xhB~KkTax3pROqe{-q9j(&LZ>1u?+YduxboX_& zP#0Y>ZdYp~e6r49d|7P*#q3-6PGF$vU-od8t&L!D<${1 zpMBJ6r%-F`AB7bnE)2sfjYW`ek0Me56btbWQDoyS^nrWhO<;wp?8!kpt7`3~@(CnU zD)jx1E5R|7rTnzvPOgZILGI<`>ve1tK3jRbo59qZAp@tCq}?FsWU!JvZTg6jXpaev zc#-81!vdhAGoGxklqo9?!X1Vw$so^vxO>Oyt1nd%UUb`f^~EJ6F_Zv{s4M^u+!sRu z9nHM0;u2^)JjIlcFz5};7gjYQ0MrXoqAaW+QbNeR+V&;;emIPrX z9tfkxKkBucIKBr?w7aP8Iws-N5!ltw@T4+G&)o5!lP-vwIHKbs8Q z?VRHG3;#n%8I9kAeU=bI%??{2K})NPOJ#*{pyFaQY+{4JFT0ez-wq)o;ZLt{j}K)x z>eQM#OvTB2*nS!_!gE45!@8M%kIwWx>qSBC%zV!PxDo@^{v6*lP?-&risJ{W#>9g& zZ4i!4(EZXYOcJJuUoQ#Zwr6VF(Jo&3V*rLz8d$p>H&X`}w<9~eT?&6j7GDodT4W{! z`XjFk?=FtBjG=)y(Ks3i*daf3a-uH|k~KZM!7kr|o~D4h-_;hrdg!66DI1HqCF&gH6GOb+2|j&+8%(&>sO5T278z#))tDb)r{NjJ6ct6&CsV?I{oJ zCMrr`ijFf}BtxirsuL!k)*i~py|gJCDB57!Zv0Hs2D=YlXOv3HiUzCzu8P_4hrhhZqTanFLi`NC#$fpi5 zU!)&dIl=jqA{_OKb($9Y!kURIs*VW)+#}N(am*-sEqhg>7rPH7M&hWwW`fCY?g~9i z3&wW(oSacsh-7_>L>;9W+y zM2j58F1T)ypOEpj1J|15L;yR0u@WUj0v8^jitZkq-L>#M5)(iW)h75uZ32uR zZZ+f{=XwHpx^wf7=406hgmXT_Vq==Y4o{FgPJz!O>ipN|&o6YZ0k65YFuKu378o|s zc+G!}2H?<9t=&yq3(IJUUWj;^2Ce*Hj)fD&5W}Ec;P6%ng!TvCxc3`)x~lgIyxEuq zaWCBO$KPoR-tpl;= z)}(b_I4Z{!BA>&1y#LUp!<+h|kUc|lumKKvV_faMD3kYO?JfG6KHVe@faDVN-=FmZ zcTjOcC@zwA>n=Y4wur?4g7xgr;+T<3G_1`IG||}OvF;Bq^k9pw8vl5r!pNWuiRm2C zH=-Wh2eb6PB*;&)Oqr>FY+)m>8~xlcSi8j9lIl3W{H$(?^c`2CW%GFCCM_;Y5A#mx z*pJ-@=`Mtrgak|w>2u>S8F)O;?_ArG9{B9Gj)6u^=6Le zrKjn6TTWp^cZqxk?4H%QT(OM=BbO-rw;3<-%X-EGscBw#$Rx0=_Qh zef?@8tKT^LZO(YjEvloM%r#8Uu!&hEzv~y;iG!nklhUUAT*zsss%V-Kf}k3-3yKSJ zdBQ8Dqj}IT1plxMxeY+IP#KYQ*|yPXQX%4l7w=x@y7l!e$HfXr0MHQu{9l&|lvFkTH+UE!hDIpQ73fCdnZQ`=*C z+gtkTsH`Ds`Nhhz$m3DmxwoSMNqD?yRoY-aR?j&;Z5%sq+;?&eEVY6d=^87lzT zvwRUjB0`qN>9+s?s|Tv2ck3>-gnwOX`FF*8S6!Zc^aMSb|1YA^fuhfa{J;nh zQ2};P-4BCm|F1*N;eU=Ce{hFKc!=y=EnT1s;1CLMLiV-__9(@by>GcW|2*7TGZ&#c z#@GKDf!;+yZPfYN*Fx2t{x~cBjp1Ctow+$|ms$p9|NXU5_p@tO6yJ%F?66za#%=It zs|2%j^tWB>>`3IoNLS8U*aoLMUGo9l<@+db+um=`>voR=Pb_s=aAprlx?w8b=@1ps zD=xYLhy{W)#N16~aHK4AY7l<$=ihf!cZsQff`t%R=f5Ql2Nc6HKK+w_^m8cy%jbMF z^HDGCW*_8xc|O_Uvkf-5tT~fBooGF-i@Xd`>Fe^xe}{EHkwEBja~{PbUsx5pmj$_F zZJ|-IMDQk;k)7?88JwGv&eTC_;MBwL{EzYvxTUD=2MAyki(>H~&S3kkbgYu^CGWeR z8Lu65B(V=NGg16NBbRtvlV>hYp2Q*BwqbKx6MneGBZem!kgoooN8hA1M!DRmkZk^P{%pcyGYrg--L3x zme*8dX;T@94bxspf*zV;R;K@AVU0>a6duJnrZ84{6+dmaS0kByVrsne|AhG&7M4}i;03W1v#|1&{5?U4uWTY_Ii z`F{y2;N^BZ{(mRAx54mVdBy+yuEL@@{8r+BCPM-GIs(PNjmzFeuGd0+f2J*7p7sk~ z1AU>k)r>u_A1w<(J-7-l4o-Y;PCQcI*}{`>pZ^<}hs~MqMWZiT?M(!h&;HNMn@hN_ zRHgTh4L}P2A+Y}ztMy`j?;1GGi-M2`0piQ=`@?QWk&_9I(a$=4c*Wv<#u(#!h)Z$0 zFCnm>9rO4gvEyPhUP0h2+PytKN1-P8uj$e4qpxS*jx=yZ@MugW^Ze6~r4x$l0SStm zDO`%HDcT!YrNHqumd|Nz=EWs&RdJAe$Hn~3mCoV_YTz2cS^FLLZnyb2QHbwlF2&VS zh`?b!i#JmE&1rw8-`36NMS-I+!j3?}8(<#>t>4TqdLLZ@#CF>EuSFQCUR*a^pgwvt zyP7&p`p9>dveN5_(j)7|wKTaymYbVZ>I@lTrCax=wj|RjqXGGi&r6)uC)=xxqxKQ) z;&)25OBYE0GQVyoF7%Q1HDDujycVx;JuV@5o#cB|{l#ndr@{4*M*G=khimV(Qh@j0 zpLx0!3QRaRF zXu&-I4>l@_F#ZQvG6E%<%V>?e$Io#lXgm_gIPgo&;oQJqQy2oi0p{o@T$S)Z;1C=6 zO2yzZ4%MfVu;UPlbqzJRnqRz{_r0pTQDaPql-mY8s|-K1Da^r2H}JHtVSv>baKF*@ z3zs!IS#tg8I!&J!#UBT-C6^MK_|hMR0m@||Oa#~LZOeORj}Hc7wHKCRS)%Tkt|WNf zANb2LeCYtXVG+2D{eRl~@^~oU?{B;8*(*dSC1b0ok1~-$5~XAxNg>NbA&eO%d$LAZ zqKFoQmqE@Ao{7`Yk$dPo#8=L~}vQPlc)Iw*}Y;Mh0*t)!0_FX-WX?}hRm;~1vVfje3c zR1tBIuAGA7FOArnc7%&Gle%TkfR@kYVe!`ledAKw9Cp$GuM4$V;XnIu25X8pX2H2A~)?Qy{se8xJxgpzMC0P-VEiD zQV2Cx#Bl?Ltv*Xlwm| zD5gM_p7oNa8lYrC5&=p^8~J||OmjilH5|AWl>RiRgRI(^_r}#}fbhEJ$hAVnDb~+- z_C#M)=gdXAhIQ&KeqY zJ&rko&wGDhO+JtNS`UGfYby9sw|3S>v1!^PXDGr&uYO$j{!HW*+#T>07(^l;zpjM> zOxxoV$$iGj0bYUFu$dUh(73OET)=MSsLoaLeHf{QR9$3K!RiomjaBt$=f<5t+t6v4 z%?Li!1f04OK@CfVBgT_a3(v7G8`GA=Tf5)aOG{uHAj+_=aqaZnv)gr|;;vL5+3|1? zIPtgOa~Pj!o&-rYk;rcT=1W7D4yt+CJLHDL*kyKN8z7ILX?~K`` zXKUl&ewNooTod4s!^M+lO-QbbY19%SqPVA}p6wtjLomNDys%f;45|0PYoe8NdBHD5<=}qe z?c$Rv=hYt;O9w~pY)VVIEM>4cb0tKiW=--+&uXWV*phQcvF1BxsEpy2EARxsg!c`2 z>P3mf5itmqe+g*GD`)|;v+gdnD3OuX{Ugp_Ad=~J7ZtdE6C^}{O*2h+_F7uNpiHzG z2~~Gr)pt?QTPP}C{H_fEccyE0IpYZ%pZ=OM4A-(HFb5~zHAuAnC~umcZrA&cfrMjk zW`!a%UuF^;ccF`<&V7wpBQjr}8DAZ7QFX`ry^@};DRJGge7gQv${Xai3&vanve&q- zAzxaOU&MIG4uA76tBNeGCW&Pq69j0OXe;5=dxG=w1yGtiJwR^+sf~#h#p!DIJAocb z%-7q_dqIQWg36X3=02OiykAoXDEV4-D~h@ZY)ub#<$a#NqGkl`yEnFc1B&4ZHkSX}o?yI$CX>~;?2S&DC>F&k z?l({~*PKt(C2`zL0^Y2Wf@Bp5D74A9K_;>%j=jx0v^>5b+dsfuv#Noi7n@m0fPs?t ziQU44jQd|&SbyRmz;H<-{$w=(E_9S5p!D4jsJdyq=XtfMB96u&Xf3epPj9jcml;;F<+)(FDmBLkSepF zB)!?Z`c;}%Z!_|M+;5f8TOQTNK?`IY=W6O>OAHNVQ=U#(W%<*)uzQBZDMgkdlIl=w z+q-;gy=iAhtF=<`A}D+Xr6|DkKvHBqMXl+Su-@%+3D#!k7igc?*@mtV>x_5%WK!}n zCRPX8Zys~Zy+JOB>6d$u$v?X-L`_Y+u`9DW`fjpfkUv{~O&)TBf8*%Y$UdEah~fTr z?iL-$XJ1!*_xrBBIa>ZWuOMSgv~ZWEz{fj!q3IEmN$e3lXPh2E8fH4A&RPi1GWiso z?X#UH9*u4DQ0Z#3JvW{s#N7W#?D>cC%oD15Z+qMHj>Vqccd|8B;;T@Dpf7h(#LzTT zz2f1{U2+Ej(exkF*a;x^t~%2bdGsTC*1jl~&o?n#oSP8n?z^v#T=1$NG*;bTF5}eJ zu|La|f%{7r{vKN#e^PvpR-kHtuZ)M6J`SC*cP`?w$t_8jMnDt($2w1Tkx~;yXRI#b zz(L<+BhkZV$hw|Xf*e!o#HE`r9dXNNsyG#}fAK?u+L)}cYKDb?fAj|f-QPzaDl9OW z83EeoOa$v*hch<7vm&IQBhDqBDQCj*v85o&UhOZ;y6_3DaJen?glxtG{sij}?VM4k zdL!&>jyS-*;T&ytQ}Gw$PbZZ zaaM{xKa;?h6HlAABqv!#+bFQlZ8&jaDpKF5zvzs&xno|VoTG&=eCaB^(usB}bva|d z^JfI>G5*YN1v`;bRPt>wuiMl{G(=K&EnjXNyKo|OWcyQJq9q#*MlY_>#dP&1B@-pzFSMJ@6Dx!2btJUyLI;F$BK!mgL_`O?60J zj!o4--^KMf+~xH8j&1l_OKN}k?DqSLKDh)~f_HBFFFf4dl{~p5z25X(WEbO)k@yP` z?ROSkw!cR?+;z;JU!K||2vSJLqYx{(sCe@cZ*<8 z$9~9`As9neXLj!)iw%R7aU}<`O*1QwAGZpvIVj2Tv0tpkhMLP@t*5z-Z(E(nKL*PK zjj(-zRjvC$_M9wzgKSei$G96#&Yz!X^3yn&Kx|!40p!_AM6l^Ri2g>8aDZpHkw^4t zZNigNdrqv4%u4!Bd81an@f!}Pl}I?^l#yU81Vm;GH)!8Pt;>HOoPkr(hWB}5-l&{2 z`7{nJGJuZk zY~&;0>Q zw-rlQdKbc{uuC&Tc4VbtkBl2FN`RXFqow8t%HGk{n@I>ioT!o!a^3W7I6*GNv&g7p z3g=x(AmIomj9Z~C@LcIZpfSY=Ns2>JseIIaFQsHo1HtWmdo@AYxVBE)tbY?UVTSA4gjF}whyj__$N_O;T$dyGR% zmnJ*Wn_YagPh!ZCY}ELYGmQ+jM$L*Lzd}!dR=pdNDB|ickccc{f%B;!XY+53O&n2g9EcA9N!!#kyv z+7^?s;z?b_F5NsKQ94}$*f8LOsO+t2{jEIJkt~P$>aDrn9z~tjz~5fLpca;9ZAw;+ zo_(NoiF#2Jqn@o2scG3TKm24lt;f4^)nAg*7BUQ4I6JX609wp>`=V+=InyZ&=*PBC z_B|wlSkGNxot1sQk#wcv3Fr$Ya%y!CVt7A$+(k2_;?|jH6tP;SwH%>AJ&wftg9hGf za!O?aYP2Yu59!%5^o*$jZGLFgaZ3vScE_F*uq&Q<8z3|#rBO$6vtgLk5ZYHfhFH)F zoli6xT3<1;SwZ=appLH)sW8j$h(*cGX?iq2U(4ql6dSIX7rfI#)69(+S3r5JG^wM2 zO*#+YT|IC>d(fX);Hlx}Q}2^}n!rzQL^fN>)YKDLO0T5$X-K zHMH^wi}~InSvjSCzM4eqn>^*3fZvy>m1LAs6|p!L7I*X^>;iju4T1U4MJYtGV(8HX zquj0>^zoN`#f?9szKde^Go5bIgkGInDtEaH9SxnyVRC^D2ePrx--qw-sfQOs_9db3 zCzPC5DQUZQFU3F7rv=@|gOr6U~$Njs3eNIh5t; zsn!i52@WNJ;5rF!kOBnagtZjeSGnhBmCqKI`^212a?((rnNvp+V zB6RURZS_zIZDM5u^=>XqLdEvPEf#i2&gaCichi-H#dD`|zT36S1--Dn$QySG?#B@t?t z(e&~_j<9o_^&Sw+oe$EmcPe}F*pMe{IPB`(+sipsq*KzxCc@wK{3&}O5l#m2nJR1* zoBGafkFJ5TU+o?3q*-Bi`L2hko88|)@O)fB^2wNbKf;nq`PJqfpjm-4wD9F&8YKip z*?^Pd(Ae2Z18SbxElqfRL`0Ygo9?-;(!)a|?_d8Np;b%Ng;l<>DElUDTEN6AT$32ltfM9|PCd1ZN`5d7Bb&JcVXAQZF1=aBv6&HOYaK7cN62d(Uj7_=+B4%-Dj8 zEveSJ#M641%;k?MzeC#D=mb6t2nsiQRx7?v5GkL*Hn+W=R*u~$CvFx&H|o_f&$HR} z^C>fOkry0=rWj)p!^wL9Uq&Ti1D_wZ_H3~eR(QV+VPD(CFO#K(crL~NKlZleBS{Jj+FeKE~lg4V)w5aEtPKw(LEl(>-}5Q zsnCmdt>seeO=mw44L^+;#FvcT=TdWtV|Ph;tu8VU@TslPPehLvwlyf|>-k$VeJ-6r z$lRSl{|4CIQlafvLT0^1-fnILG@YP(Gf=uO{p+x-NEa3tlELmD5^-f)_cMg-w&|DQ z_juL`(9juhtop$O->+jeAg7beq1Aa1U!ItdR(3an;4Kn3COSQ4iTeHBrxFQJz`sIo zND0tZ+~^l|iD+0%*xl|3G@ari4Fz~2JocyTMx|wC#+=-#zh(!$HEQZCOP^kr%t2?g z1yY$froVol4F`K;wqVOQh*>iP)gjt?RIp)g)rrX9pa5ab6qiPhb`Qlen>6eZn5P03 zd4I5SblidzbLQ%$FjgWsw=T)c?-BaIT=VSNU2UW*M%(>sg^nXy@)}J}fMYW{1^ZV$ zIBW1OWRec}%zvsUmKsT;3oq8TPVlSXM5U(27GhCA6pT-wKLNhYA!n%Fk^CwsmgEC! zasdARTX9X4f}{su9i7CY%W8MOKFI36AjZPe*p1f!vKXJY_%aiXpg0+A01kF~==7^t zXDWi=SE_yhUQC&FJ0?peJ>cWLu=eo1#zaoMPK~8zv!1>M6+~gbRgw4?Pymb_9BP?@ z{JzhAUjm<&5oymV=nxQg?gHx4LskO~(zG4cnguhAMx*b{BliXw>g`XYpUWsMa z(4DML-MHmQ);m7;Es`{N9!-$^%R|U|Bsu}g{>P^&Dd3;IY9C)~rQ_=pyLO zuGi~Lx#dkxJwBAcm&pJ@@d6`2KQZ)!V`cZ|5@hEufargt%>S1<|6jUor-$w8-bAY# z1sef3j1q2U|GSOZ>2ABaa>V%^T}w+2IAIE17lo%{exI!$=1q(@=XN;sN6_`Rk^8Z` z6pd7UpPN;K_XNr(_gI&?4y+g`mY&1(H#|RXag7jj4YqFim#o)p#!*v&-Ac!j(Q^sn zTY@I>rwV=>E~)z@=H%|)>8rG4%6(CBS`7y)ax?hEHQm;AZz!R28(lj8&L$H? z1yHuBJxewHfMZ5AqMk3u(gbPyYRks5|EaphD>Jvrg82x;#V`r&#=)&#vOgh#8!W}c z&vXD~9@J(Jo|J%|3S$C)e+%e3e@vsyMVvbC zH<1H*sDpU3m$f9q_`OVZ_yB}sBRU|Qu5dP85ZGE%8l?%po{RTw^&1vU>*ko^pbzpZ z3o0|y%*&bx@2mUl4Ij8)tW;!$Q-aD0rHQNMnGo3#b|FCaT@(0nX>)k$+(#nopKmbZ zr3gcx!uAN`tC@w0@+QO}Si407Gvv$b^e@p6z=`I7VLc3u?K*c0*6}+w1&u@p=NSuNCL)ER^D z)3AC>jnxjCi^tdkV?38SNeed@KW`HtHOrtl!814hsY|$HraA1$C-K)3ko0CO?!F^A z?K*fVU648Df#0n)+Uzo_1Zn0hf?&r#fk0L}sd@vnZv$ceW9OcCo9eVl{F=8pNE-uK z83($IJQ}v3qR2`#LboNnl8|7Dq^+W09uq=zlk>+gw3$5WOpNYs^3yc(Q;1~=h0;nx z43VIqJV0f~!<-Cs0_~l5<*abt-MX5ZnrA2csPlZZXrPgwerhC7GT_sSgOcN58}DHQ zSQJf(Qlr!bp|wi-K?AEB{{nRgL_hq7a>=O>&=au78hrjb!%x-kJ#3-5HjAas();E? zH$X6O5KB5pwH6uSS@S1u+}@hKZjz+mw*uJa7uY76wt~mZS`%Z%kFf%w{`4!c@UXYy zdk1~PvTG@WB$eOvf)5nBEqa}p(mAVUfsxguE=1Al;gotTZIy;`BNM^kJGjqu10p9{ zD*%|rjeH0|idAp_T;)Sd3D}K*tUZIy-BuUG4WpUM(Q;{we*t2@Rb5KCLV$S1>=5zi zLS^vFPCVA73jO&;^9g)X>tLVk4h&NXCn#}DjLgAN>hviAU?3>L;&}QCjNTbzrpYq+ zY@i^-r$j%DxqP|$+1LiMv260A{C=#fWuunQMsYsa&TqsPAkV2Gn`bPQ%Rzh@J8^k zB}Vv^h3cj^`CthJjoqA^59|@pE@VZ|m*Y3xfL?%RLXGEsCK_5o%Lux(;J!rYV`o^I zfwpp#I>H2;jc8@7(+xd?LjfDG1c~3Sz1~d6l$wl?7vK9oef4I$wkgZc6+a`J07DGD z!{d9je8_H^n>SHk5@=l}Mx&LBg5X%hwRzR$IwjtF zy-vjlLEp^1MeQW~DL}Efz2lcwojKVuS0H|fs7G#l^a?6|;sBf0Dr>(2YVihSvcISP z!mt93%ZSPo2zvSeDY*7ifhUE?V=z8o&Oomrw!rEsu+9D`iUH;eSPF2hVExxr94H0{ z`{@I`<@`^bZAE@i>v4LYER4S|Mt^rmM6}LH;qZn%x0a||Co2~*IfL3ISvcze%Xk?bb|Nz zl`NHi8yA8SimlUXBb6^4?A-BhZ<7G!1Ynqy`1F#1n!(}MGeS;{ZKkc0Huk>%3%tjtNCK^W1G@Zr zl@_!6As<%tH%i8>O#)1g^MC)acLccgg`G0<@M@p^~IC;_c%DJywWA)99t$e>-_@;KOM6DK0HkzxA;A`<7E?bOj#Y)dBZx|zpb+5Ze_aQt{lnQo zwti5j%K57j3y8>sz`;U_ZLjA5Vl8TzmaBw1i*XZmFU}k0isBaDtBXxQu0>63*V}nm zI%L?5$ALWRB>tMo=&}5YQ?&vfT5v6p;|oPMB82v;K*@;yYG%mAzcx-Unozs4J3OOB zWKGajUmhnokq-fG5qkCY-)sKytOE9Q#Obz{vn@6EoY12Zl@~s=Cly_;GshqkB{eOC zE`#=b1evS3)xp<1bB}~i?u!U~5=@AiU#Jyf3A4LTaA39 zLQv-a`JY+-o7B75Tr)%C|E1mID7akTENyHq|@L#?ZXqmVj5CUg1|2&bPPNxUnt_^k_hv4sG^#5+#1DKT#om!2g|Mx*O z=!y)$wKH3H>1k{!iOkkrnV@wf2w?fQ2I%135|6FBwmF4tS%R&*9u%LVmx2G!&-~A% z{r5`RR!P&AV+A~tA@}~&AL1EJ1_;}h*fv(s>ow>?Z$C_j-sl%q;dF3-e(@4S97uf*pK))F6lktTVMeRK_>ux_=|6U!1uhTGEbf12gEphzLThkvx z@Zi&~Uk}zJET|x^ajRIU*ZBV7RMd}O+bJ-PrnnB2iH@zUw6@g*HI)4hQ)3e=>|2tK=y8EIw#QdN(`}3D`be=O=w>e1n)ZQ!nk0g%f9_DZ zx6Idm=e#fD((K1)&09Nin2IOGgxUZgD)TC6CKk$}>~ZIUpK@zS;d>@+d?M} z-(OKVaN^ZH6Ia}@L%xR0JF$G{lWkVI{;myr<3Sd>ifq-estjZN$M1$PMGvJNN#*C1 zWuGQmqj5}^_n~#cw3JmJ%*U`REPJW#iS?FN9vcupd-EnsTh?Lcp)eQQW>=!tI2v(> ztqD180P~$6(P|055%meDgcYA|Nmhpsm0cz^e7?ub-qsGnwh%ymRBo$xumquyCc4XV zkmb%Ej-2;amTM;6)+~z8xE%`EtNP=MT+iMkH8C)F^s9M%OPARxRxi~#&A=KUnR^*6 zY{qCdzdjeviatV=%gA|h?{eXZx{5P-AADU>kldci@~Dyp#i?|6!G^{{({i42-?=ht zks&TUAPz5j4b-XMl;1us$XNv^!^0ka*K_P1c651kcQMwxw*=k4U`YkxX^^PRwlBj4 z*Fq)+5sNKH9~=xN5W&>rG5#K$VPG*wH$7?8&FxEK@QQ_!0k>19Gu=f(daQ2q#1CmI zryut)KFwJ*@|@JzS9)8nBZOB%+hl6?&D(d{)LS^ZO#YyHOgnzb5Lw~22SN;Rg$Lz=PWV1Xc@5T<>Q>0b zRoI6`4Ma}gGG7IuHn%6&G6dR_V}9+}6)SgEYQ?ug+%3S!y+44(UP9!NU80o-$2p1f zN|J0g>m7;GmB>wB@fYFt+OvdCCQbQtilO?@osBs(%y;^wDI4m0U(wgG2&FT-tflUG zWxk8Fzhloj`xbuCvcaXkhtqGYm}5Xmb&peu_SF&GwignZ1Fs{XF)OBf>R80>c68(v zhj~rJKi0KwVvG%x_qCdss_uN|_4(LW$2Xg>>b97rAk|prwp6PrO_QoXPf2ki13INuv)Ex?GMe!E$qY{n0gQ4DnhJeJ*#Y$Kti7 zReU+m4g@B$ko5YOdC_5J!`)_VArprr=5=@~ZKjt1?=``gbiLwEEb9w;yr1@|L^o2>u57*7u;Gpg?v$X%sF2a&flp`KfZR zIc?r9$q*7F!lJHH;jEBzWD!Xz_K=NLqOLE{4ZVzj!x4NOjqzvNJQOh8 z`8Rv{C{FOj;5ic}Q>%9jBci(q{=zQ7u3{bC$N{f@o3s5TodS(UE5dayxEQwBdS&|u zUeC8B@U27k1ij~r4ph9gKaf#PCO#39$*O;ChuZnfTnR=`MuDaS13Jzj+qE0Jst(?| z%XbSu&LDo4NvSt6NI(95sk=&(TW zz3z%dbj7a5`!d#AtPtHB3sls-hHjFxt^MJUN4Z0O6TOCbZ`yJ;`2+lG=l2|BB3upY z)R{FmfQH>24LWLtc1vw-Fisy?nd0p&y`62Yu}|tf3&Q0Cg@l7wE}N3yAQvZFZh6}S zQ2eEZv?5O#X0Bww_~h>P(#a&}==uik1NjQ}MAs;u+pK)5{+PVSE<0ALWUGkmZw8)m ze26vfSW!Awtka=6Z%9@Qu(sDT!xSqx*;zz zt06dczY++v#)IQ^YdCFFJep5FBGy?HsW_H0J^f(VoL3vWHk@mEjhNu%PcHM|I`Rmxk83yMS%FyUJl4#Ov_)+U^~*KxL&dI zi|>0Mov`<`_3V)8FrTo@$E$_LvCNrthqjYN2}|mTyyB!k^2N-in8&_e{jk4ok^D-m zBGGWcKAnmQDC;+s^_k_*$sfV{-`bx+svOxqXLi0aU{4?mGDYoffES`iyPN>?^oBfo zS4p1VpP)qY-(2oFRS0S&5}Q@Enp;SD6{O}$ztyoE#I#~4;S?bzxPh)FD@Tr-u7n?a z7hMdxQD*Sd^ce_fmp%_E>QXKmaje`bKh#X2{H#5{3is2926$9Jjp?U%0?+3zdAKra z9Gt^3xM)E56?@-2AZHoZ!%HvmN7q+Gzlt&z@DLeMXx1xxguTx?-ClO)ynD=;T@sKRJ*L#azDLuNU-*?eF&#Wf45*!_trN-CC zae)TW~;b7%7~BQd95N?na+yhJT|qBb(bZZKG|*NE#z$` zJOA_rKIvD4>?o1wzz2B|@@DGd{kApoXfw@bDM5!L5kLWo^Ap`F+;AG&<6;FB!3Oy&#NBm(%^N!!EM{zm8A@zrShEd?;v^-j#00AD zKM+N%9eK%}q`lK8R5EQlgTVfo&okm=x%3RfsTc&61cr2K%-xA?qwjRi@4UHHjCdJDdi$Eq ztTmD!4mQiuo!l%28^5_ZZYQ4;Xi+a_rI8g*_~mb`gIJUF7cb{Fx1nAbHo4R$v98<* zfyRZa2{f$|pWPQ$cG=;Gw^$@Tj=Uy@CDdZ)oc#1kH#k? zG8Ba&3MhvmIsUc5JS)AM!21Pr9HL*de7%Y8+s5vX@|ti)?tp%N!F_fZcv6jhSQK=Z zmUSi^yXl3{uF~a-uO8*BB3=FRpk5u`cdQmB7<(-lk{&R}o^PjVGOyv#(*NF(W27PA zRQVg0S*9@AhI8A%2CBx$dqkK$;MC!WGK_mud*HTug~$=3r{!?nlfubKks?90+oTuz zc}3A_29>gk5d8pq#tR)c*xQm4B8pC4J+WV{aaHk9p~|+4r#ZPU?&y8dB+q#1T*6D{ zVkgKBj5ky?vmKMk=o_>9LRIs|RXyHt@)zaIBU+pWfsKhwY;O!yY$I$X$n~>N_4ER# zn8;@OxYtVMX%}7{XL2;2@paj8(xWYXx9F7!L&-1q>|eZiyu`Kt*wO1xfj9C9uQQQe zkqJVBbBq;C1AcK8B{F;9gZC@4M_31KYIDO;j1A_wBf~fMn%MOEGy2FF%*zxoHV$xl zlYM-Hk=x2DXQU;d7w_B^F$;{MYZOX+*XB8~4kyRS{! TP1_y@@K68rd7XFKw)g)Rj5Il* literal 51547 zcmce8c{tSH`?r*kBq_2JDlwLXM2NB^RF=%xcd|_OVi;K>J8A4&)~wmLn9APRX(sCw z#=eeq7&FgX%jfg`{;ubFuII1k4;Sy5^FHT3_kEvxd)>$Dhgz!ir`S$WP*BjTtKEG} zL2-PSf`T%dh7$NBf2zbE_;t+fv8ob9X)nhD@NmNRj^-T-it=bWqB#}tO#4g?>_$Ox zrse48SO>Jg3i$A%`#l499jJ}Fm$|Do#WQnzXLk{2Yj>U-B4Q#kjuL)a6cnA^>UZzx zJ~vr8q^mQ==*_)OR?RojQp&ZzDiU-e;5DbL%Y&)!2-AujOZ9R`^%^U~3Sm^7wT3(b zG(vUH`N5N+_qsZ;N2bolw{e=mbo4nc!UfkJ-#ew`FDI0x6ZtkKC?-L9^5ond6J1xb zTaTSH`??J%RBk!4xKd+oVnZ4B+&HDFAWg(VZ;-BdT`4nvaOeS_Q zSJkik@6=-VqyKxMjhhzOtn84e@i*35;wI}~Qn*8nnte?@!~Rl}*wPuzzQNEp#vewU zUMlO;0y~cR^viBN05@N4rYCi=IF3}4drRwiknlYDho>dl_N@qiiE5AMQ*aIf%STAb z3TzyT)~TH8o_*sw{!)0-XZ*~;Z9gy~n($5xl<|uNgebb2@#pKMqthBR{t8>=yFX&- zF>8I-JGi{K8yPGq23bhUtbX`9v}EjYq*u@bc!0eb1B(UE|7m zo0lG&w!ek_K)|L4-yt-TXk7U@owhU>XW90_IZj1M>5NZ~XB;BBxgz$*GfE%OPuWFq zj2wPiB{W@0uPsMn`|jl+_N2!u*PC$D=Lctt&zcHemXFl2X_%*p3U9dd_2&6}_-HQX z=UMor$VMu`2*~4dB(p_ZAKrTE`tzLFK(1KJ;|Qu)9nTsp-UsqVIkfq_ig-7Q&Gwg~ ziI>cm!}gd51L_iJllZsB7ftfJC_%RAE2^PETXlfU;sk9UY2YPPxB6a#9&%N~D&uxG zozM`MOmGS#q((U-`j{G0(bXy@4$ZXC#Fio)LwVh=YnQ1Ud}FLOrok_3rsl-YU5J+X zr$HK5E8?J_7D1#~4zeR7CB`$M?%|(T>@pm;=oHu6*B#HV%92{Rg_kjfo_AvW-(Ut$a^w7KtOvV`L4#^a8` ziVDND4|EDFq8C9qbe&E7$(q|3CGWS0=*4D#s1p?e`z@LK1C^FF?vL8Y-^IhuG*=67 z(=uF7nGNwrB=JOv_XnTuRtZ(;VFV3DWAg=mw9;e*#&|-6N+*my7)f1}sgi8XXlP|* zRdkCv7Y7Y_*VdefWs?~jZ4UnSHf$tIAX#YI?IA_ma(wrBs{XVRxD-o~1t+i7r#O=% zlAj0mafxx?a*ejLOTa1EnoHvi-$G!c$#|t@)rf#8o}f$geg!BxAiL0ev1zqUPnzt6ksfpKDWr?1el=fVAe_)bPOD-EsDZ0&g&X+ zTRz8A8P0a&O9X%0X3+v|QJ=sYNQ({y}fz9^t3Rwtv+zE;hvcTK?YovAks+UAvC0hz{Qa=`D38gQau zl#h(kzEjhNV(};Z%9)%O8hoqrVK@zAWasaFgq?xf=+JIOiCZN_9J}W?9@_nb@!c0O zdsNrg=ct4)I~Y|z_#t#~3&CK_ESu2r^J+B2PW1+xK*@))F;lu&u>7eX4@nA&5;@ky z*HsS+JMbwwpVZC{O7_0vKNVp?2o2uTK4svL7zJYc?X0IP77+|(iK`SBb&fRUUH*ur zO;#PEOBf{u;c@xWLAugVKF5J99XO(DpHSVB9Pfth#e*upTSvZzgtL(qOndryUDep!e4GM~Jwj%^* z9jN>or6yfP{L=5s_v`%}c8H((d^6*(2?pswNHKTpuTeA$uMnme8=${N1-UE#KP=Fzm3Cth8Q>*72C`v|7-i!vesIlV?B~4=A>GZ`E=dkNfVe z8m>a*JlA}aFAV%$R`6q4V0a&=`c@@`>3B=y^C2z%)u!E=&2b81T6`i$NF174i^| z8r-{mZ3rMkjYR`ON?&t~r#9p4Y^*ZBvHMTYhk9+BR^3)za-SImeOU9U99H3l``ylMtX8OulM-IxXnETBO z(8>5YEp&A(r;}rX zUB+lcL3USk(;eKL*g$*O#xjSPf7Fy)IXxSw;JHD6z`zx&T*8!v z>*H;JzWG8|F2~5S((BH#m#U9i^VVyB(wY`1{k(Ehpvj1BcUnC8&}L8@I0iQsYKh^Z z&2<}3dpMUw>-n3%xRs~AtVZ$1eA&2{ymIxjlxfo@Q?6WdX{9Qg{ZsFiVxO64;&+v| z3#J(Lz~Xjh*KsHR$j{DV#h=SR%HG{)^krF<@mzc5bkJKrb5cgmd-t}2%QsC=nkuav zGZcJ^kka>jR<9`H%5ASoDQVRs9mvEi+-40De0~=9%5!XJ%M-;Qg`GlA;#vU4PWoI)RGrJ?s`qd-?(l&TeK|=k0rS+WB-R|3i56xW`sHs&@JI(z`STzkyzl zlwG;Gu!%Y28izHfknOE;1HaiNp)*d-QT@It=ZzT#FunLjIWDy>eGIgksNY6i1p^4t z7=#iiVWV5d>2SJBUw0BYf==(AXd<{q^(`pSwN7iIsV-~{hwG^in)1qA%?u1z1Em%^ z8+VRolejX*O})1x=Zrr3E^XHuyS2RB79DSV(LwU9#pdSo9Ua$vTp2N|rmz$nEp2vhUVZqeSG_@DA{;db+Vv>=n2wY3lYKbVU?J{qLI8J=kVR zf^#)YQs zNt=9dadv80%l+6u{cvzh@&$y3Q(y(HwUm@~M?K%9Dt7k!vQ(z{tFTgbitCGmB1*Gau+mm;@*B+h+Ir@f}LYv#J9amieZ~b2e)bnvm^lBV^{Y1KL?$jLrI( z7C$K2&x~1P^2(9*S4qIN_)oKoRGYpG7ROwlE}LV!lepA3yyC-1WD`Y=9Ktp)y*3h+|?oBuE0te)I zgD@Pw-nGw>{l|#r;~2uj`&M8Y9rI))6JV)A#Uv1AYm+hccMpAURB2gh37Zart@10X zIPZI>1766f6QyvwZvp4QzPSAABq=HGyiV`c{0+Q!!El*@*lzt#}BRD|_8emgI)Mii&)$pIv; z=J@IMVyg4x?=<9PhK&C=Pf2A!`kIMj0=O6y^I7Tt=mWc}aAopU^)gET_*${*<=qNbpxv_>%by&r6k=;;PFb3eN_l1b2emq``Cr_$rNB4f%6E44knrf1OUb zrLSq;90zf6@>uC`W~5d52uDUOKa#pnOcm z7$Hg<>%reoH5yXJ$NkdArRCY)eEGx8m(=~Dg_-^wl)CYaXYBR&t8H?r;&*FLNd)}E zs|R23R1&TfJ}QuI6C>DA>0uln)rpx<&*K9wGB-Fwnx~!boa^6zC=wv`==&<`vr{

}RX(O&>e{2E#H~5UW z@NLeD;QgZ$Up<-_)1H#ar!Kc!-}ly!ss!CL3Xwl;Na+lsr0*^a-kgH=D|N(1$6Z>Q z!riQb3?_3Zb>xD_dB0D4zJRLY2hytigY23pd^^CY*HP4ilB-Ox%9{?mCnf$KCsv`t zzRF!;)zrwERd{!_2>R?0P(DUh$djY{CSQ+e5%z_oJo-M8Oy^VkU) z_|nFvm&2{OsDs{dZ=<28d{GW;ewXAig$C}+fGMI`FcU^#gPGsq-fRE?rub^z+5(1i zt!n2zgv7#i!2YMEC=BGN@GVvN*8D*BXs&XR$FJbIR=wP5cSC4r!mG{WXCJfOpJJVj zus)Q)_wHMJ(0$+I1|)jv@%7u-&D(0Gegxd8Gzbt4;9%#V^v%ss>_)!nlM%Tba(6IO zsE{YOG^*p!-zpv1crZdv{999-54&JU+TUKv*lWEKX1E(@!D0$4*Jo!MbwB>Ao9O6Ey1=h5LsQ@J1%tls^S(Pw|-B)sSVbo zd57xXse}|GG5i)n#bS(8oGu4QfZMnN`|!V+%tKmSf$u}3xega5e9)In{Q9OkCO21$ zRa?VArl)<}tAN>5_+p-GdQc2tp8if#oGvM%aRMB)FG}GgG&5><_qacz?^iB%e1m)& zwntAUHftk)Vvy^z(oxc+{VXyT%4G^8Oj)4$EZ!oxGg3rf#t%QWR2n^B94;c#xO}|? z{X3aKr!O1BD7-?j&@p2iX7amw*~WKvS#-eUad%?j>Zw0$dvy1s-EL2YPfHn`gfS(J zkPqRc@te(S0!N1e{Ea5fM=NC}+;9~1{{nG(pf;^k_r}f) zx~#b2Qt+3#qi=4fQ+LK9Z<2{6`w>|3j*}Q^ABr8s&&hLiWMFDf5~Tn`|}t0 zt~9Vpx?Ot+mz?L*jWgWvjVa4c@~7}k;_e|**-xS$uPBTqUDnirW&YjH2QUJsdQfaH z9^q+(Ag+eMU#tx4x5?U9wI_p{B@UkH+z6ZZLH#NjWwQcH9AJI-ZC9NmP34~-^kLnw zDJJBxQ0%^fA7SQmAh6&gA|VC29v(-i@L3}(oZ%wsX1_ZD;VQ%RvHnU=*`=}#Ny(6# z79}9^XH$|j&2AtPR`@j|2p4@z^tYPs^BL?xKQ0a__|{31@EP3uBZfQhc`{)Ws%o-X zDf*%--Ecjh!*4l|dq2SkdKiAdU|lWTe;tIR{+096rwo7;!YXuTygR`!tVkLR$SXDt zUOpd@Dz*BL{SHA1Gp(goyVK9eCm-cMK&`)fCR+kEXl4(VdMhY<%BpW6MVc1;wwQ%L z<_!>?1u01QvDUcmeV%nXzIGPC11xD6g^3=>t@qT z!nG%;4&P+Q?h*LB$fUG`3cUP(lJ*D$f8Q}V)lsS__9N%u(UedYy#Mq!4L6apZLTG6 zW2zIFuX`pHpIGbfy?<-(ZeA-s(AHx1G&>Bp^1*)WToUfUBFpQE0M~+9gRnwWD?R?s z3v9^CSl2q{8~*@Z$%Y8CzuH%QWk^zRtxkRYR*Jer(DxLFgvST-g41$0uU6zu6et;2 zl68fX-M2r*ux@tNkGQliYYNSVWm#$zc(*Yi1U)utyyP_6uZ#N z7gh~^|6~kcjeEkSh{7T&?w+5)5D(OvEAEEc)&;gF;5Gc(_va2e(^ar1jIYxhMURen zx8@0y=|>!c$bM|;okT;6%1dI2?7Pm}9`~xb{q_=uo(HTp zw#eO5U3I>eECX!W*Dd&1h)KWF*sUYX#gcT%fOPwSwEoo%GQC^sy+f{;Log7rYmw1w z$U`6GzQa{=V;Sj!46*ZoJZ0qMs5*<=4M8rFCH4G#9>C(W{&>Y-h@zBk_+5 z)-z6Z-uE={d(dd@l6^{=9l3=v!0ebG;To2`0HI9>{1R2V`r~aB6 z+JK`s6g^Ck##+eSJb-#mtk0_4qpf;?T6_7&7y|It*@YVq9;dLCoXZf?j?811A!cI0 zUiWW*zbiLby5=nRli>ZN9Pu-E)zNH0{?3MWzon=iD(QvofF&XH>HhY?3FP^aiaHr| zVQb##913tm5rl9vLI)I%@<@=HW+-dgq92pq+lwB<@R1`i#z{ExXO9Fz81sLM%@vd( zE;|61{ROhg0IxG}?7v}`j=D|S%F|q{C-eMch=B4~`2gYTFW)vcE?jpp6f`G8mRt}ed z)SEypQFIHiOe#l|oEDngrAET>HS4k!4vfGIKd8xD+7(;?ns<$U=top`$60T&+owJd z*W`SZZPxitUVF;q76cs7tUu`9{3%HDLw{U&#nR`_;$rl2_JNe+->9bnsN}-;=EZ}! z9x(hi#_WGXkJ7|u9M<=A7WGizZ*i&!XB?%mITs-Ee@wvV=u+Ys<|rWJ)y#7scuoH2 z@K=bV%1sQH9l`(i`+q+;8VTZ3p8vdc^%H)VyZNB?^})886;Opb4f?gh?SA~7V+iEN zt3&eq2ptXojir~=Q5kjQD>dU=6Mdt5483DjtD{Z3(yNsJ_0s2JLlRJ73NO=-2J*%3u`X$TQ-)a@z;r7A%4F3ThN_8t;lKE1GlB0Lc^3FyZVJo}z3E3hfhP}C zvcO2Y^5o!ME`^_N{5i2Nly;p0jOteh>7-YO1DUQwaU-X{co=S*-S5ZK0;Pq)mMRe0 z1Ylt_xRz*ZRNi7JdnWb;$FyfsDE#@P(hwfGxlBLUDVKF1b*I#*_U9Lm1m~uOGcq~9 z5?ZVFq*5Gr)7;+)JTR-@odH zsB9u!8A`b6(M!cU^EUn2VgP+3bd*&>nnTXdh_0@YvdDt$W=8dAYsW#{KvKOX>+U{H zf3ODm=+&})z_>f^L(CgnYuH@1blqua3Q6}H*#Y)#3BbDowlqMs>})yFZe4KTIbsbJ zy0O;mDWuDl~aUN&->sP>6{trI8FakQMyW}x&+&}Sc%YLr}J zg6-zyMDB<4V+}6Kw~B%Vaz-vF{*k**4bgJ<(w3QbcLB~6?yw@-AOF1f3qZha(##fR z-;vN2%5j$q$O?zFJ$Ect@0kLUPsC|>FKPO;;RC0xOn7l&p#&kg-&)o$;pK!ZKuA;N zK8(N-1WFAVwcD2&y}0QboyV${YJ?@i9h~J0G`j^GpiHfXqzz@CK3X_VE9PJV=KMc|Hby=gNY>ywD-ZIA49O`yY- z^A~aKvy~~LN(b<=S!gDu%T$2s72v!!fFqx1@5@a7F|G-5*BbC;mzu7C?GdkW`lcd~ zQk48|!o&DLk-j=y?Ft(R$po;{>hS{%K6=83TZti0)f}OHlzi3+!?&Zu>N|RWos#u9E^5)o-0URjiVssgjK!zHF$l?BkhjkG$Un;AbBWtj#wb2^s#vuoGHjc9dIh;ay_M>Q~|ZEtBf36wqb zoF2@vdNr(tn8uj6ZLk+og89jH<}=n7n=fZ6Dkw*&cvf_ctwLxOR3qlIxex6){F(&& zAEljDq5yIK!j1qjpzwM>l6QU-gxiZeVzT6l04hpT;6+2;klRb>c+AedA_l#$pB#M9QvKzLkvk57MxTZC$83B(Dd^i9Up;*xZVfl!)2AM> zFjFqN=A?1VBDN|Yob>Vj+@-3X(#h+*LBmx`LHy8KhaZZlc)3lAQ^<9UN@^Aj z2)OB8hCJ$DktN#SI3(<~i=iL?{o|bv3hbpOQ)5(EH_o}7hrWqj+^|Bndw5{Nwj8$V zwA^&f&qta+H+Fa`ZgSr(X!r(7O|h7jBvFe40QmeTB1)o3H3 zAF~y4;NoUYBx7g7mre~9ZM&>ZrLZAKnI-&$+0)K_hY82}#Sr6!n3xjnL?thCC7PGl ztngxG1HZ#wwEyzEB%A>gDmqlX!1FGZecRT%h2RpkzyWhthN8|B1!wXC#_g|ggZvT@&(0J&KF9aI~fnssm3Pyxoorxho)|yuK0#OcojRk zrKeb_uU{-9^?B|9_tbduAzCty^PLt)8-83QLu?zB>*}y^fS97#y=YcJ|=VZ)m~}$uW4Ssu*s!!=u7ahceq!Wf>m3S&kvSz ziwkRJR&fr|1f7(85^mL&92iTv-L;PklfEZ~y{Yx%N#-{rYYfbW!>1%7-{DqgF`li6 z-`J}bGB92}3wc@m-PKk+U25o(t#!;BP2PMbuN+zI#~aox6rC!GWo{i6n6jir>J#6s z(M`HRXU_p)0k|AycWaPl!y~kg<4Z4&;2VvbmdXUs#)kuwG)fLJepaJPB!(!4*Wtqw(M^qU0x;i`k6A-);$(RPVY|P z4?kM@?)#|n#?yM8UajbA&|gfb#a4fMjNqO>IQF@VQALA>w~E*q58^(@FozDjx@$ua z^SCH;O0D;T?9QE@N@>p=ky9D9E(umZM~gT=ec?~Hgf;R>mnBP?r^mti>-c8nCH_7gm!x{SUyQP4!87kYresj zFDT~puOo*Ny76qaMK#(O$P7XoYhnDYqbW#VA>>0LLY#_DC(!sehQo36<2FdUF5$|% zPV}83Y~hvZ`&-=4pK4b8TyIhhKN>Hzldf$htGTHGT&TsY~-G$ z3tFd7ZVAki>M`Jfs9b$V*NZIZ8}4u>(3plJ6apV2XOqC?#C6wU;c>^aN;cfUUYc=l z{>V9!N*F$&WWCbJFu8NwR^B(w%~=ikQO|PiTPV)3xwGLta@Rv>Xp7X1&o#Br0H*85 z&n1m~fSFhZ#SHxQg1^XM6ejO~t^YZ1YwVtu4Jpcc=M>>8ZHNdR)h1Xa4W#nfh-k$rfXLgZa{GvO%5J311^b#%<(oY?`sx z0F{3D|41Vp6g>wF5^*TmEsIH;#oN$jwUWeDm}Lj{wAD|Lf@g^+j!*MXv|k1LT``m7 zX|xmW#;>HY1|{91yv2pBJ9cgA(pJG$-3HTIqPH=~=BKu`^zq-h)Ry9(u<*BK3;f?K z-|hNua`Zbu1GFU>9OVKgE$Ce7d&sQiU~=ZGuyFct;5WDZVOF~EZq%!+spIY4W3RVp

^GdRsf1pA?btT!P0 zsx4STWwA%{`r#Y+2;P8`cEw&r&s&SVWH|AkGOOgUEGIH5SRl65haV*(xLI4C z(14Jq?FcKy8&owXBRYJYz&6j(Rm9P4nPZpNU;a09E#>;~Egk!;J!Kqrr92rWq&GC& zb*^6oMl@whz^k<4=Y0Fl)@bD3-UXj-fw%j)@%Ff zu9TFtS5ifWv2cbW9c`7MM*OQnY&`n?>~K-*rPv#ZXca|Y>p^K3$zaInt$P|fX%nfz zniAaVlmtKX!>zHUllT%B`d6`gR4>*)Q%kbaSw;=Au_<`mcj$_0wQ(mJWIW`NGBITq zh%bJ{*3K8~)a@x?C=0&z1I^Twv$M@uyzOAEw7s90Vy#$BXRlk*7Ju`karrZS3_9Ah zpr@eRy~m;?+S4LML5{QVT{EC5Ve8y(Re6PQa$=?!IZFuu2 zm?^9A>3TJ)dQ#V;P+qC)DXCS@kd^&?-hy{Gjh;Jq5v3G`g4UR926KPtwq9;(a zml~39f>HJIpnZ0%7+&YrM*pK4m!FXP2^rfCKC#<|AhYQ!RW+JD$7&rPMnYs=P!@D9 z)(tF$j}+N!Co3Zym%H&ijUijywEY{>62y@|oQUW(DsJ(x4MN|JjH*q)xg9wqt>WP`tC{eN4bcn$pH>uy|=81VvgYh&1fZ$6ni$6RI>+-?GnjjAskD? z%xKLVMAY|TvmHf@lwnn~cw=R{<5xs`g;iunp8NNkNy+q2o}&xtn>{YRVs^;R3RB+Zr2HfMET`sL;}JF++Rvoee5{2&S*Xx<0z>uN|)C4Sg&;HuhsE#!*h+ zMkaYzn_p|&5pyfl2>iC@a! z@f2rK)#=Pr*XWP`Zpk}Jp}A=@5;vGY{BoU@3~aEk&mT7LKYMUPL6L8@a?CdZ(lAny z%2KF3w)cL8#%W(%HzN=ozSf)Unp994S-%ES-_zmANN{NF8_g|h8&2Ifi;w@!_mUjw zwOnztT6ai=HS<+y*qfip+jJ>|poEZ@;(Q$^c|tDO2ch#a%ACqG%5r?gV@?Id?!j6b z)SS?!fm%$Co-?rx^K6=3ZcB*~!BdO0gO40^zTI0|cZ;=QvNw#3iu|y1i1!3>c7|1p z=A}H!kvg|>xFx9Dn)A>EL6z?q=WZ9Go!crY%|#V&7YTb zea&taqBFb4>~sW~Je;cZG3O$ovA0UC6&z~gMzuU@oQQ~#fleCkeL-XF8PJF% z-HbFc16J8=abLRQO`v!txN0%qa!<#=e?7u#! z8Wb1Rj24R%o)`@7UAh6eE3@2u+OUsyJ1Qr(*nrK1#Dux^{zD1gmLXEhSE7OiQsv?BBfw(8iKl7@?Mf9*fJlw~;#=K7tQTK?|L z^hs`~>S(Q9^`J{5)Yf|+ir|WdKX0wNjl*Md-7Br54=&PYpl)-&|29{#9T0SzY?EbP_ zP{+6*TIpHE((v9mpX;}2C9us z@ePcYL35nME}-wF`nd&O!+R0~FpDY>mLa|O*V)Z{2j7dG<}~?Imi~6D1e^z=bhVlR zX)vyFJ!+K4Jo+2{(WkiFMs?VRJ@(BDi3SPS*l>5y?)ql34hHD=$-_4UgS*!WZ+-E3 zfE@T>>Oso}*ZmCWM&|ew`9{mCIhfGTQD9y~Y~^)62czD=%>tu`iklsr9PLc=r)52mz9~IQ7y#VvG3VQ&TN)(b%ypY`V3Np!`Jvy{`4?=(^Y^I8dL6 zShU_}buc$-!-rpn$B^`hErF=Q_bunc{bo_{)$^)v9#2AcY`1m4m6@cz-?(d8NsN9x zcJf7`=a-TFfP;n+4)Logu`|{!JM8DnqY5*G`HZ^l1&I`e=*M{_IS1eZZQg*enw+a6 zQX5)-BfJ)%fTlpc(F|7a`XTh8Cu8wB9q&X$RpMq>odR=eF8%q$dDj`Ybk>8m9~fpQ zQHLb^e*qVTYgI%UO4E$&dD-Uk3EOoJi4k?ci-`)%Up6r>O1Li6sph7I#+sF?IB9Hs`5u53U;c_Ai4h$hNtixA{cn~FKq!Al}3N#H=PjWf2Pxb$VZq=j)7m| zI>;9u`n;s3I?;LiyeY%D&mEv~@xK5lrq&1Sp_$PZgsVfalMFE9gA5AA^bzSb`n})4 z7AhFQaKC~m8#U=RvSXO;x!_?dKeq^=YR4&QIWBGX$NE(De>_4`T=Suout#n;8z$*f zU)U^Z5I$i_xW1_>T^JV|Ug}N6iEh-cZFqeM+B4Mo>4lF;Y=zEht|vq+!RJ~QKYd6z zXtaKlY~K*~goMerg1_#0PM(dl|Ipg!HxQ4M4XOf6q_qJFC|jhz__mGR=%%-o+bl$X zdT(2bLIfI~?jWjQq0cv)h$7cfP~S<>vW?F7BegIxl{$+0&HlmYgh_Gm!M@a$ z=PU#5r)(M^0-POhjo4el$lG6O#geB>J=Hrpzbn}8>zjRLQQ#E{K`;RD;YuyXK6iSx z_|QIDv7BWR)~KJN12p2RA#ovd8wd?#3(lV%;oQo$xII<6L&z(!ofK_Kf{T-`w5>`^q62&_j{+h-i$~$rNuoF z{ZhLocqqMC1l5FTUV})JP;>b?o85l>W^b9U-M?`9fqIYkoZT)%igBu%4_!}}{*6~@ zn#`e1=A8&u6T3%WvKB&d*|4vUX-aCD_u?N|$L~`V5yjH3UXqd%N;)~abLo*O$HTRP zY$VXodLjuo_6`oU4+yWGTH+ z|M+Dk8+xD&V2?u1&ITrZ))-H_>AkhO9N)^JFn|HT5lc9NyP0L$i>>*faIN>gVBwmQ z2Kx>b?H8|n80IpP_Vw0^kVwE?;^bRTrRc5`L1wgQp4QcF?-E4mzyE%O(1Yzz|y%3B`@6}r@Tvb{FtXJ4FKqlMibb zdrRqaYaW8jZ_1@9eRRZwYtJa!-Tv0Fr+>Y-akC-pc>kiB#9o|ea>Z(&)5CH%aV zv;dR@fUNS~#Y^|nl)WYe5b*hR;}Jnx-Bb(!kNtv&Oq;2K_ad!Lzx~X~*=U<>?uH#} zgKv)1mgV}gyxj9$K=P!RA`sanY4X;lGd#X!wWq%g$ZK&bTg#<^p8K2?yQc6UCGA3G zRi7jCar?Ir>L1s${ck()s2$i3mcG0ZGeV`Q)Cpz7q*p3~d5)|lt}c3*y<7^d6o z!OE%8eLho^vk|f7;4pmMx_iD9LM{E?F*-TBBCdz7?&Qe@X9f$Xp85MR1>dF4>AbOe ze?PNiXY!-P<#+NRq_-ZMhX?;r;w6OtZEJRpv*P}xv5Jw{6ZgKYXOX>2iepEmmRW7DUaRw5i*jRmg}2$ z9tBzA^hY^%ztd9fiq~p#4|w!h_bv%?>#2jpWe-ok$8kGM)YWPC=roNrdTKm z^x|mBpMwt9Z=jVe2#ruDcrNwJMZ3ExDSSsLp@A^BspGY9Hz)dt(70CI)n;gpdP&01bQjNOEy=lIDijKE#qflaLX^ItbBdBw;nOL4BlRnn5bg0!7mahWYCML~HV+n;iOu=$ zcB(0~I=!P?I^j7shhYSFi`Pja)e)~UY}lT1*s|Gtt%|JleA*WOY@r=>gR6Rn<|)BB zXfRK*G^xk9NRL)Gu*#vrS|WTY>9sOdU>#lROii){^q4ZQpO3O?M4 z)T|EoUkH_CSHW`VNj4T-M=J?)$~tBg|9n-F@5m|K0q-yzwH>__#H!x2SPLx@89%?s z=fVX28Wf?r(uzRk7HyzyF{uy-)yKx39fMM`7qUZhixAUtmJ|Cb&j%j@Y^oYi&{-Nb zrPX^I_Ms+At@Wf%q20KwD z(GEdoSY1``-To0hX#5~?isv(f)x&y@l>%y8$Nq}m*)#l?}#Ts z)yyV>+5v6}XtUK)Qn32rXp#s6j{gm0&wJwbmHVv@AwT)n94L9o1k3>ePq+?+ws~b&HN-8-u7Ks zVZ3Ee+C)uZRWj>6c4`pc_3Q|Ls3yAY3zNTq8h=lfiR%;EB>fJYiUJS}VKB=%qNa2x zaLaj!9-tUzX>0PQMFJ@D0=*sZeQRH&??E67bnN4j{)uzIm?I?b*X=5Lpy}v8`X5M0 zb+^_Z*c_R%f9tG3C%}>Uo-=LR51Dgnm=BgVsl%!8SLiTfU3O01c-Paz*Z^($+hX)f z7~H8%S(|AGX+GPgZKL(OJInD@g$~M_!M|Fgj;@mA98qSBQh@E2lYfFi@S$F>)TW=E zk79|98>SpKRA&o97f1VHM+^fR29Da!UjhQc;6K;grk3zc_#Q`E8Dm+U%t(tKu&!L_gtZdgw3 zo3)#@j=q`SC8hgTbYORY4vc?UaNdmYV|}8dcjTG!lF%M-XPI(yU!+;}zsAIy6Davf z_?3gBmYgf;NJ3-Z$R2QUyoOJ<9hZ% zGXpH>*Z%@InGI<8-$t%JpzVojV{bYdj(?LuZ0*ckXF=}WD|tWzX8fmOaulkcZ_SRD z-&CF#W+1UpC+lAjk z&EdI@f)}%cj^6tQyjN@>f1bm{@317K?0b2i$*6rbjE*B2z#?Ixe!_2`w1Qu-&_p`u zm;cd;9G-@Bobpn};j*o*pC~{9SOB112my5!ZD7z;ZTN=A#q&_{KiIfac`5ncvAX7_ zZ#q~1Xun{n2#WlZoAi@T^y50h(3x?7+B*QD-C3CR3q$OzCES_p%XhY5k)?Pu)V z1wdikdKl+H=CT?9k5RlX1@7eiy3e#T)+7MrDn~~rCcq9tTAgSlw;}gf%3kz1Os>C@ z{9x_i9X0(9~eO5MS#Sl4={r4vn`&cs^beR;Mz}u@X*Rh{9%cb4dLhtlOD10 zAo!n2JB1aRQ--1tz{RkNr@)cdpZw0tcl2!@l#s8T7JKu>VwH_nqF&_BEv4eU^%e%c zavKSnrsBMfH{o>QSF}MQdn!+z(&aty5y5TN?m_qHa2==HU%y-vh|Dy8Es+buV{NWEgiqmW~Sd4*1;3u!mr8mbh>_1U1?TTNXdRh)aQ~V3vRx` z01hRH>9X>^dQwaF-^Dm`CuBOUJ6N|&-0*456aHVMeRo(>Tk|!Fpi)IZI*5Qs69MT0 zQl$4z=tX+3N(mxWr3;~pNH3uW1SAoVBB4kL9U>w~FQJC|9n|Z+_xHZv^L*vs+mIs3`F*(F z=li)%L~q9n6!R7o2#e*flW?_H9k;(`7aV%^D&P8+I#1GP|5^^am`KozJhfTwk^DDC zArNgdRNuFY*L}wnKUE2i_R9NU@;=Ox7megNnv`0EL#dZ<4H48=e5g5g_M75PdeF&J z9i!8X0M$DBLd;#9X!WRlWtxh36}=Kxj`Br)$qtp;qvMA%6I4a@hshVUB2xG(rC+M6 zjm##ge-W#e2d&tibcs2`o^^(B|rUob3j558RcEZX7RrDrpEBp&K2HX8jDLFRi%q4UAdjy{bQ_H zWLWDiPUMPAv8VF`xZmWrF+

-YmY84c5}p=lDru@md!x`Jr;QkafYXqqBA5_S$W; z%u@PrL~2VH*FDWY2SGu+9d@>~ovP!q_xy;NVB$j&m7)i^?#$8F!%IX*hGcjYN({w4QztG2;dVT6cA5|vg5-x2bI~*r z7*!A7`D&L{BZjPKbno&`C?be#;eDG_;R;=PM&3xc+v{ok`e8^IcL6WUlJilzKs5)l zc=cK*SQ=A9hOC`|mID=ncM~^XhQoMUZDQWTPWHq}9O!3CE!a^1ihmAWFKp zm@hg`4RCLud*dwh9VE>`Q!r`E~q6P2|nABg6- zWvN+hYz|BfU7T-P;7bAL)d`(_B^N-7j^%$B&w-c8&MXiEJ!EuAd*q^4*6S_wbx7GX zN9KZNGHK&v(RzoigK(GQbjecKb65Z+cfk&w`Q&GL6o21CQ=5SoWjOv-?ZU?&oF62* zy4F6^$&t(JzQ1-lW$9>c@^1a!^#DN^;|MJ@wP$sT3#p&F$%FWCHI*G@`^n*gNe zGPlFZfE{Q9>LXC5FX(6bPEonu42NWT$dEI(lP5i<(~j05UfFjs?fv{pV>p%*#I0Xk zRNgNl-C|yAj}tklZX)k8UO#6GwacFzQxCdq$_q>I+nM>)uLv&foG4f0S@Y}+Y%7X( zeBvWB{Y71G>@2L?2>W8ws~CTA;adblC8N&nL&@kvQ2Rc_Sn}txQzEYhdhA#f{v@L@qAxQiFyJ zCm!oFjPGmiPS%%Gy{`asS=>O4hVD`q@Pv+T@SOOT*^<4&OZO@(q^zgCK!51-(PG-N zWW94?aIbwK7&{oWp>G=LQE)LeV7awm{7fw~!X{0KS^))3)_AXDsVLN1V&rl!T7my@ zXdp<@iN3_JW_&CptM#;-Z8l|kaD-n>Cb@%FH|35pXtyNKn5~J{L&!vTS9PTdR=#^{ z?2+CHu@ve$YEXn{=VTA+VxH_B?=YYsci;5NKaMO^f0LxUTD#15qx9~xiNhUU1ED%mAV>Sx zx^%^Qk-%||4MuBI6D%o+N8Pm_BK$KQcz6&Ievb1gK``e_ItY(M)fhi_wTEpVU#qs~%7rJ}txvn20N=k)31DVz)>qr3O%Xor`v z9Bs*05B5&RuDgCChPuW2p8msyJxzbEamHw###$qgsGT#f5%E@&$I4N4-Uz-w(RgvB zU;eCAsd9TjwI$zmPiMTe5MB}A$J;eCBf&so%EhsewOD^Fk}9|ILv<3PuO`?Rq4QK6 z?7RC^@Ul5aKqmoC{cuQ$awN=Pa@4-Y#djOv%UNom#1FeQg@|Rj*{aBbSAO8*5{dA;z;PU}z+khreA8&@8 zad&9Zc-0UvoD)cP7W5V7`nGArd{ZM7g6Ofst|d-;m7p=(10BT!n9C$T*+CJ+K!u0) zH6S*cPA8--l$maH325pyc14nv9KV^7=>6P5pQUSym3~^_FXM=LaQPe30z3Jn7aX?7sE|6G`x|f40Ro7$S`}T5L<9kPX6ptoPe)XkuOo1ffCwXAh}`Xw9I?8P5j-ExqvfRw zL&#dE^(&0}?knKV^`CXL4cyHDw^sK|FeDY#*gc0``C7QR<6&8tJ)34dmPZO+J~$aXmlHosTk`Z?!g)IR%L(I*J1*Om={ zbNoDRNx?P(2od<7{_$HPAf)ns1<93x$PHMJ9thw&btl8Jic$@6B}_u*$_Fm`BlnHb z^puXJb8XKA0q<`kMCw*R4`FlQLk&;+x$Boz_QDl->x_NU6S>GFF zH9=P*PrO=7x#S1=)4H+Ym~n>6P6#p~FT6PV6H?^@7-a3mE(0g@h2JBiu*R~hPXziK+pcEr`MB>QoVtwTWo~gD&L&FuC()z&cis^g_{=E73)Tr(}Z)7y9WsIRM;fR6B zU56nE!x^k9C&Br+*Q29l@p)G&Zh5MjkQ0>i0oCu|A1HxC2cO{@yFS>=`{61Iq!3{E z>Nz+si7x=z5CNTjOz6Jonu?wAhavtN&d>cNoV&I0KgRBv9OW!6YQS0-f+5#5$!Mvr zhI<(Hay_Lku}@I6^*Jqzwk$4oxJ7rhGIPTF7OYiBdO%Lpd&C}fBBaz9RH&Yfd96HH zJV)f@sZ1CJ&wZv=m#hbp?6yv=&Xb|laM>EDo(5k*al-oTU$o%tl$&vrSc4 z%3o%O?>ON;d?dkak3?-g^feT#all%3y1Yuk6KdQqw9vGmJkhW+`lNF6><+c~iOToR zXHK5cbLWA6Jy7Pva4waRHd2rOGN)2M!~8tEt!f1Bl`gGGwwtr&3Sw})&0X00bDW90 zPLbs&U%U?{_P`7Bi;*uu9MB-tga(gI4buLNsiR|hQH&9pN4>!&SGCza_5E^1`!8ln z7e}hIWAifB!Y(qXbFXpVjcB<9gHp8_8LCT$M(tZj^^U+WE)jxpuZFleqUezvJEX{c zR4It7I*>@vCtV0>{wTdJi0D3D6(@CcRyCMsK)XuvK|BMbFC8Q~LV#qf`0VHxR;TLx z&g{{w^IWG3Yb#8Q2T3~Twj@TPWN&6FZxS!YWqjdsy7NiM8vQai8E?qmd}97GEu!pu zRLzRnyJt+e>1*Tgc>t0GP8^_`?=*<_{p}j;n}?RV1KnOPfka>$2Qm(Q_fUe9@kYPC zWLO+@M=Obw9IFmlR~vJN^5aZ z`46~MQx+BVa+PQJOgAjtxj~mi6YkNVax11VNM3R58PCur`RI&}c}S9c9Gncn8)91} z!n;H;57S6-(6z(mLF(OivcuMy^CdtX-(Sb{ygwLU=gp|PU#;q{)joa+Q|>f(wZ`>i z{8A2CQwhu9s^h|Qe6hyT6V|@l9umt^?N^O9Vr%>zVnmwO*}7YNy<_Zva=eyR(CNv( z)TXsT^bQ63a!JpAsW^~RvR#I_b+J=jQX$#e3ai=jsu-le?!}n%#PmcRdGgn6EfI|R z_}nm+Q4k!JWSSc_V?A0kJ}H7-I6xG4Ozb0qoN92#?fgrZ_SB*21}Nv{JNnLPKB=#c ztomNI`&=p6 zC3G+bUR6OJcz?7Fd+wXHvkLN&cuSUHolJtfb?%}P-xOk(O;%E(l=7pAro$=-^qM43+acAi*Re=?;ENz=_&`?4t-k5BY27ZGF zboF>NJhEAW-~4OO%EF(vYeX*)wZ07JavC1@;nh;FOD+XmejpKCF%x8LyNUMM>-fRF z3dim>#ZLRthkWv?fRm*e@#zlVULZT)TTGGJf}2%iXIf1*Av8IiYszV@+@ZV^+7S2C zx&SD*)R=F6O&YUwyL;;6!#3LqbkJkto1ENT<|E$;4_>+|Vq+8*l3a06(=3bA#|2`- zo{erYU#y2P(giuN&m*+HL#k^Bji9%Cqh@#}bFj2S>1D?;2G7aq_XAa56XV)Ss1RR6 z{Ex-CdSX;`9jz%~0nwn-EpqnrJgeWnK(^N| z6u`>nzYNp}Pu&a#(#{5^i2bi*Hs5ri-?155rgZ6m02JWRp+n=^M>Yi50+s8eM$!d0 zjnJYAp0<277Ec52z8+^TdYBPO*-L8#fAWE`C_`WBwmOts;J~O<3opY2Sf)RcoiF#y~g|BC1%(Y{Q=KbWmM! z?5p*KdKRo^z98~5NgIgg{cQUP$nJvX$i!}Ficrng{toraMwKpd<77HS32(foW6kTP zbnhglh=Pa9cj)9{&#JGiwTtc7{z50vU?el|I@+gC{@|p8ZZEh~K=>e#-puFZ^dxda z{z7)}^o;Dpm#JS+0AnEcL}xxT6Iy2Odk=H=0`lY%JMyBzr&aT-+ugKAlHeXEDZv54 z-Jy?3!;ia3(@pVbioUT&ylxmNxGs2tVIyB~IqkrOeIqo1TRlM8BT}@u5w~OC-0Kwr zcDJPC4sYk=5`G_Tb4!c5Hwl47RbJ+AM{MDEyQq~m=)>t~T=>v^-CWTHg3?r!awOQ7 zIg95#qEWNGfa4%$bIlHRJoar^-jMk6&+$xlm!IkRJRXGXrItA`t_)q0AszwMF> z#jul{SZD^?gdkDlewOzQ@_`-b;lwyY9qKs@XzZ2(#wY8$o{ol`|DkG@^xK7GT|=HnsJUr%o9sFq}yN}ZPu>^ zL!NCMz;QM+$G!?6QwhjAl{7n(oOi(sUgh!^lvLg}CZ$RJTqWmW4|xEDY5wYM-EHKE z>Q`8GPHIl&eR%D>Fi{0R(h!Fyl25n%1t#aDpep?3uC!2>-9YltLAvIunY}a7SP8jR?d& zP4Onp6N=+;N3sd|CKG$?TWVx|CR0OTWYSal!vLW(r6Ejz;e5Zq&)}{sVP5tH|I_RH zFM}_^jy5Od4=qemis@}X^Z#nlX)&5nUSsJ z>v+K5hnZMPH9^#*5&9y1WkO_VkwKx7GX0I@%JYIhzz$A!gNd9rT3DnOPVuIgngb&_ zB)_F+kUGM;*e3VDOz5#Rr=I|WAqz5cMs!8{ISOyGOi9n6KyQCZvGweno(vjM)kh#O7x+|{)aVKCZu5c2I4 z+F<8i*oHdZ^4zejlYlX#tg=v_&n1$+L&p?i-o%7cC0kGCW7WKzMARQsSl4HS1P49y zwow_NkI0hY&EnELGiX*gM+^Z-cd{1A%D6SvD?HdyI!QXHijoo;%`ialst5)ZiuyB3gn&M-eehGbC+1? zouGK;#^e>pK8X?)rv$l9-Nd4{jWv0TRdnfU-dyc6QbOKRq#d4EHI3K*38Ds1&V=6H ziaHk{I6n?NJ0-I@Jg|Gl07;Ii#O9q;#UIQHc=QWI#R`r}(l*ak^npMLfNarz$DgDe zj*ShDNYO!aA>!E{?If8p$BXmgzGz=|{?UyOyB)ZGIV0EPfI|CU*i)4+1pTB{Svedc z<@*c9b$$;*ZYMij_>xi?+ z5mTp^ZXr5G>IOae=T~Pefxx@2mXqRHB6QoW;;(+kvDl_)rvs^FjcnR>x?`?4>%GIb zg$|O-A3oXgwj3=tg;ND`G|IX(yczEVaa(NX8yde`DEgi}6iBpAIjIkdbg3~bEqyod z-^JUNe68Mxr$gN71Gd)2<6F`Hauc_(HqQx}qu%pj}Q}P$mU8yh0&J9T6`?w@Sf@%57UJR>i zet%RJ!dU+B#;E;;=J_KaU3M=+hP8(R=8r!jwF+zG9O=O*d>B;zkz5ft|3iwj-FyOb zcAzm6(F$xpKW(OQK9qbP{ZsqnU>s)Nu^XZTNF7RlZZHTu$EX42|9KSQHDa~C65Q}P z@ABL7@fmWM9QQq4#}a0x2Ho*{@3gW8T{$gfp7vG;$K8IppcHgz<~-z{MVBe5jRPUK za?`w@Do;U)(SfaOqok+Qk$u}?&&&?lG_z%7ubg4Fj@WfNn@RQX)mnYfU~efc(Q-#m ziF=7zn=yRloe-h4r}M{$hif#{o7;|eRh&%eLI6 z1CMWD3hL+IaL-*wAEfZ}EV&m-)f7`~1-&7hxTXB2$*B%{!;>=NS=#xjbdQQl4zCZ% zm|JN5XGwd$p2Q|fyAqDA4gG0d!kDuRQaUS#|bC#uT@levk8I)iD_V-NAX*pl7(| z_-l~*QF{73tGqxBrxJa$&@M-kMO%?lqOu;;-4UUDMS40(lR6UhAu%)O<&76MZs-D0R!+2U${H3H(0ncupxA|>T&~)Cnx}(%1dUPtnT0)G`ni^NC$fWQr z!hcZze&&Twn8?syVPSumU>20VODWn`CMYm@SVk}Zjea$Ft@5^#m9-Ch4cTGNJAGv* zbJ(5^;rJ?lx?KwJtP`KqKTVspRCM{bh-kdIZ%slx!KL&Ov^SLCU6ZBxR<-zP~^OScoS+kPtzthMDU3(68@o_nPY8oTt9uGad`Otzy!BgIQ$23N9znlTObuDuQQ|a zgxl)^alaCOp^g6Ck*5B*?nKYMU{{RYX76uEwb&SLdE-vxW>y||GU|n92k(HqE$g_U zPu-hxcT)qqP+J~-+%Hr11_`V6Zo7n&_+QV`shrSfb@{y{Hs8h^8=G}X7xV-(#7go6 z+QjX14V??c?juy`$SP}nmVG(vvfYPTG=oC=Ea~d}0fqU-7d9%F?~zUN-gm+~yc|(e zHw_u*cQUANG}{pFq(_-)Bb zNc`5{3L=2&g;5((#Va<#o+~r{0?KI@jqb*O&|<9yq(&s(?w2zG+Z!OI^Cx}(Gbg*j za=LMIrv3H#x%FF#@C>-F$TZKL*$$Q?1aVjyu#*A-E5cDS_@OG61Pj>Wq!L}(Jyv${`MR5FCmJt&lnM>cT0Av$RKU`bCJjHXBc@A)}e?tbh-LMC( zeV*r{b)VzoXhC37cDmqTDQ4?`T~hI+ovWH2&}lQ||DGEGK|eZ>Fg=~&F{1k$9XJQl1utrzp2GEbzhd zE5E`X^9Lt9eg}tVdt-BP;9JPmtIl$F&|T(_Ei##~ZiS_pA|58DJh{q+VULMzWAG7E zA8l$R+V9@Cqb`;$qcHSEJ-w!@9`gdh?FR~o z6DOME^l^8M`}@MG+bUT3!0#&Nj}|<6%&l#?nL?wpfrw6~;BQSM)f1!BJG5d}Ri8fr zAD$?SgP+?Uv&0p&%{P4=<1xS3t8e@jS|!>l-?xYqM?&J%iW@MzZ#p!Y4<)Qunt<}C zuxlW2*l(pl3}ge1?BBh`*}gI-Yjm^wF?#*mrFdM?`^*nR{7&l+==WpXUcB=KnGY)B z$=Gt^oC(z1*Wt=0W|~M|Llgx|Fc4%A-m**+sa?kS%J~`!QX0!ra=o>s5f~_dXh=LC zSubI3*mHqu=GVFQp`5=xq(Vr(F**3~BQ27d{HnM!t4-G9o;8+Zx8(2hPV@esIJjUjD-_RW&2R zk%BN-M3hzDMT%Ro%3kk+hx-~aaI#mBp0Oy~R%e@!@cGn{+4dPWQ{tY$uHLQ%C#_z- z29TkiPPzZ6HdQXHeb_x{+@f}9*jcbsmm1GmOz0kKna8By@UB-vZOjM%NjcD7r~_fG z#jCfWs)f}I^)1HgLdEfEjivfCDW8nEmKArz{MT`5_6N1IOyeM&PpYt?BI8l++nbCQ zTIAMX0IlSy*|-q-$`h-e}FPuXASl((>}xTi8d}?VyF)PctfU!%LKn$ zJV*p~`+vUQ?>vZ&dbj2$4Yia4yj!z$A@oH+ozDG(o^<1|yE`1VP%8<3hJi%;2gLpI zdc?eS+_}s3G;%15Zn+4L)(z_q-&+Qe&Ov(px|=I#ezy;7c+2qCHo#o zzJ_svk*Qxei(^v0ST@RUVE7r7NA;cpYUt^~s~& zK`q9#s$6JiVuxr2Nr1!olkh7t7j0+Oo@!O}Aubv?MmScCBzxZO;Rr^!T>@JyTa;T& zgxNQS>qc&QH<;2ZE#Hz{q};8=*h`C*uoA%&JC-8zX3aAz6V2|5&y*G2{zjNrX?Z|D zs<@b6_l&{x$I4e>JTihn!4H=cN!oPQJWZaLjA@I;=2-XX{m4>%xQ|zxFB<_QHb5e`F1A&el}k8c~o< zTUs9DHw@)T5vTk?-EE-qJ*9N+;um+SxTLC)cn5Mo|K%4RFEy|El!@jSO2QQI(YeRe zR(L|yAJRrgXZ^TE&?M-e2P#Ko_fgj`=KvmTZMQ0oG|xRy^ndZZs`@R^_~HCK|1VPt zNPe%4g+lsMd;hl=WlEeYW^dDCwEir#;O-oZB>y=AhJl=Y>~E&MFdE#>Wfmg!v>OnMS$=2KL_#j{C}b;!vcqYqs~B|4A0+oe6Gj((;fP4=5OaUM0IBr~T!tXtyUTYJ4>6MmkBG)RkLiKoXWflP^bZyG85%~PNioW8l^>DdE~>#S=3y08XqAQp#=UE^2aM?8DK=IMash z@^)(gj;)$KJTY<-p#JBLzF-1!=6PExxta2sOL=#zQ?h^r>hyVANlxFU%9Xk|@%&$p z%-wqj0@h#e1OY0O&|Zr!O@+UzAn^E_Ai6=A29N{VwuGL5XdDaG31Ng?b}+fPkETSz`wWSKa$-{LspIg%UnR zg&66VHE-lxo8K|z`A%rdcTcCo|(NG((I+dyg+w$8f@|m+wptIZ=)?~jRSS997BS!xO76m&Q)_Y!V1oyWG&WvbYUlIFTC8!;R#B6@_G!w zDe7sQFP)54)eqW}?UXoQ9Onf$98u#zkP7{g_>#q^F8xkHEYhnF>|6Y1cLq$Li9+#H z<=qsPlzFZwMf${CM+Nuw)Pift!x3Q@#WJH*jXK>ADY_LeB&EEF+*3_=(#3@oo?h*B z6XV+CV&OI#9V{=ufdmb$spyaxPS|z4Y*g%}R9_n-xFSTf#`bL}+A!q@M-AeTt|G6RVz$RzYnP4v=jt?4f*Q3ojFF(*Onhz}_*c2^F7R{7exl8FJbZq~= z2UMuptXt2i@0Pc{eTgMOXUj1^sFCKNdJ3T1F4Y%8r`7vulJ5V(h95#OkBzS>Pp0}v24&DRSU+% zzFJ^EAW$NA179#aLcUR)v?_mj;1ji5@8(N9X zK~8igDxs^qok^Ja=yUaj&Jk-Thl(0zB|eHIc*vP(jM8|gqhpNIM|^sBwdH)258r(Q z7@|CXnxdrKLr9N!D3K3zd)>IUcR~>HiNILgwFtGd<_yuFTEAcT)uZVeejGiWZysn; z#3K0pgY#HYYW|DIPyZ#YWWHiq){c#PNJTzp_qCtNSMm>A`R}jaQ#`s}5_EZPl7pcx zaA;?!I(6>j8G89xTo7IC+=Co@RoB8BfTyqK6+DM;d2@GTp@@)W+!Ffx|J-U99Xy)b--Br(uwUA(&pZXUEi7?6#FcPV~w>A`Uv7*x`iq?U$yL z=;BfD;*xT@?^aJA5InO>H9Rc`|N%n&Xz5 zWDq7~>-Tu&Jg2)+aRZv3HE%GPegi?9*V_!g+54z(PsLOHjTl=4O3sBvVmjOdx`}RYH$Xq`|o%mkd0$|>h(#kk_gIpUNH4Tx2g_d zb1`GK>tG_rz~M9Ewf=2o#dcWts7(~( zZYvr5vpeT!Z)ILRqDwxS-$rwW2y;a7rH46l&;>l!MUU$!YI;DUkn%Y8?)=0TwATz| zX{1_)Q_kS~4ml7Oy)p(-)wO5v3)T;k{b9C^9v$JtZW*7-W%TF0uvZvLYXUi#{QqlB z2F5t|?L(OxLn&4A$I&WwpLQHLyuCiVUDL2nq!%03V8pKJ&+vq_5L{F4DAGWdetLWnJ z$yBTz79YbE9+SQip^GXZ6-q z@hcexgfDl>lNTp)q@7?)1o|?D-S|>VAHjG|d*H%1D@B$exl1m}fFVliP_lcc(0&?c4YsW19|I~c zrk=#7`Ijxsn-+S)mao>ricJ*)LB*eqxN%A_(tdQP6HtCFoej(t!*ELJ=v@<;FMq{Nb%R4YXHEbr=ek!OnMGkl%o6hlN*FAYseQVw?q6 zQ$r(T)%La9Uoa4dP!HW{5H?JlGQx(XEFFd4R;^Ot9Irv>5F<V>1>uvjav!6sj_ zQr%ba_$I~#Xdm3a&^xfTg2wRY?jG=8y8VfJz>vVWN5Ztmw~tTd!f-tLja`L5CF(B8t9sx6e`k z-oNazPTe-}Rs~C6d2K++=W~2s%`1MM;O>Jn1qy@r+CL_W2dJCobETtO&V+R1!6zOo zAEd8C9%F6V&r?A_1oLYh$s(Dgwp4Tt*GJjYOzp8Xz*lVVONH&Ln(vQ2>5(FE+Tvz< zg51wt-hTo*wK*^Lu0JM|rA&oL0Y^E&u1URsBwcqsyJDK3y1pk#Q(^?pKSFJ=%JuJw z5eD42U+7rrQTkCRMt`|hl1cIWh4Zw&~VT3#^AT{)7NEG~^Y=N)S0 z2~g4%Wh%^=VyHvNo;9Bfxz^}~i!=BZ!B#{W+q_uSbe0h9`06szFZ$9_LxvyPxA3Kl z@aUSv&Zli*bmdtk;}9nD!p};A8cVD+pex7Ccj$V3D2e9!t#l480}Tt%>IZ#7gO1FB z@s!x^=5_6mk$2D$It88LJmQ;OP@4&R(>SX(=4m0KA$!&vHym}0F*!$zkhq%S;x83> zrpbr&vJvV-9r60ITc-9j_57E9aeeN*Bt0$sfpGr;7vH&=2opH^Gr#Ah&e0E$!c3GL zVYmIARD~Sa1T7&BtmMRX%Vazdxeo21kclgJl;bcvBW-q=iXsUR?&#+ z$Y5s;{2N}Hj6+&$uGTilQG7h%6IyKeDd|+#Zir~t(5oT&!g|>i@P&{DJ?`^1@M)P`(K+5A4*i|n!km? z;*FZo*L|kqIzLU&)#d3>y|nQqlI?rbA-(8f$;TDJ$j9V_p5sB2a<7=mmoM!t(IpyX z4YtPo*m+8Im54FdMMCiYPiDqh2QJrBNF2yWyoO0^=O4jh#QdbdQap)Llr>ugM-4_r zP0p$8bI}s_YCZCHGX@{B$faWN_EmWJvUv$f#qj;G8TJzIMJ+mtEwwcL!3eS#Q4ueZ zk6l4=GAY^tNYdt_sQMnfT+9kDl(}ZSjHm+xT`6<-GUwcZybV%{JnvAk8h|yH59VcJ z+Ykp|41T9S(zhDfXLIfb{eo!(FhCovko((i1LiHFMMakLQPnDC1fNrZ6E4hgLuNa5VCaiL}&jUNB(FX=%_>uqnE0Y+7mx!t=3 zH2&Jgi+*~lpI04dZa7g9!7i#trQQ7diHhb)*?$N3z~0D=$HxMZvYBPU{aGufLz2Az z_jLVZ@BEV~0HXf$s_mb(w|~+@zsF*M4I?5s7h(OAKKOZu-$m*_*Zr@|#n0gE%I}TK zwjIMe=9%lbic7i*C?33i(`1D4oAO*-x1L2ew`QMr4B;o8@rlbL(;g)WO13lekx&L% za$rMKOq{|C8L9iL|A2$P9~h{n=eqA+SFK?ggd$82ttwRZ* zMEon6IUa=9E+M|=3Wq2Q87he84`Jwc8YEQ|sSx!^3RvjOuzNmSEQ4-%+-Pnl&bY8E z&7>3&Q*);m?Ch4MB`?Z?Zu}K-{u$Jckz}69)U?@j0)LnEJ0vC{t`XwKjAy$ETo33s z{>SzE&BuHo$&2$^wj+$+S?-kpO3J@0)PHA^EpDL465^?xtA%~nC4HH$n?evks~N@G zk_RP&GG!heshI$B(!hHRqqy|j8>+Fwh7$jO7|S07 ztB{^^a9{-hT`=!$GdjS8J7H5zB|FZM{w@0@tdXOmd$5MNq z&-32Ryr7;n(x$^sw(hDoTP1it-r3S(evHE z>&wUwdv^C zVBBAXPJ6=a>tLQQ>L>NJtjYa-rG=6HAQdvH@oD$Q`;0O}F!Ga63k&+F8C_a@1^;XR zvg%6AGiSxuf5W3c4~^CZe2t<1*nR6u8=CF3q61zAGQnZd8SrL?&%}56E zJ4@lU8)!HfHyYl$8S`n+Wc0;CwDTCwc<;@7q)A@B73lL}#T~;(N(amhLMJ9= zk7+`UKOd&60-9C7n@;^g%puwHuYMT8DUQO;55hOI!yk!W0u&u0@?N*Iy6Z6)nW^4= zaPT$sAnt|f?cl+b{9euca-zJYmYaG5V4yvlrFlomllff-w%4QgSOm4+vZ0(LOeYvt zCaOhF^a9mKd|+}Y93rXjJvk|#zhz)l4MSYSVxkJLi z;e7|}(7!Cns4h?`>UFW7SOD%FmN%FAu2jI^axj%@7P24ui zkfF~Id^Q6lFt>*3F4P`70DaWX8z%lrq;eac27YaZ#Do6^`p=V>S3svvir&D}2DZ$*uE7`I#ro}~P-^tIw zs{BCP*k^956z3fre_ngOlP#Y{;xGe*_6z7Sj=v`i=!3WnP(_Dw4NsZi*f{g;^wH>P z%#gVd(^ZXLIyYpOl*nUlZo>-=d_^#vZ@GT#i!gkxM-)3vj%_?pr*~iYH5K@w7E6vY!7{Ld# z2k4tyGkv{X%>|RqA@#?HZAY5<EHIcheS$84}+qS#7n4@G|l`P~1cIyD`&3HcAcb zE#XzNBY-~sS32?VKaNEz9+HYBPTRCOoc9uzu@^(UwYwaXZI(E|NV@1aQ

%N_9gfu_w$$M_|Lchw=3|UclmF>4L+*-k4FR=$GyJ&mkSnURCnwK-p*h; zJLqJ3`aPi@F~_j++0DzT&9ELA5v$# z6~QL}xq9M<>r!^+Rdo8DODTf#ScdPO06r{+11?o!L0> zck4Ltj&=4i5^*?oB)OT>4_@CkKWL?z*)8`w*>?+4;ku?x`#(lN1UglaJRBem+zd4b zkn*<&OxS~5_Y(wmvXklTTgv7SbAXI}?F4buQ~}>O**F6fvmC>t<38-3ev)-NiL&h@ zVtTqF%NvB1^?w`qJzs3*;oRzAEld>OY&`;1A8)vs0)KG2&#V+3SsBOM+oTp0gQE}A z3bOr&NWr-aYWoFqKIxr|0jm{~hg*o_(zu`nuk1670UQJH)wefT%ufzSrA`;kgICGp zz(Vlc3QBsnpv8GJVkUq4@b#lFNb^Q{zbg!Y;s{ZLSpio?*8B=>EkS)1(Y6^gEMaF) zFF9|%|G`jg;87DVpkTKR$aKk(oYwX*y|<_HybDAg^pdkvY5<3haz)}?Zz|h&$@jB@ z)kY3WVjQRb0nm~?Fg6VKf|2dAT6;0;FnxZ>P3A zXS|X-vl`%K0ds6Ox_Fu$z6Y!DGXkfq;yZvBbB;C;XY-`Zl#yFcgKttskZ@|>e4s`p zcc<;ObB<*UiX%u|u_GQ-)NTBl`g0;=u z6jc2{WpY`sMrC0wa+Zq52kPjNH`~wb%?eBMS{)B(+ zhFlTkF##~r9Ui9CDdX0A$ji4@fQiO~rqJUcgq?(um%D0f>yH7d-kh#S+$Qm#BM~sp z>_TB*z#ufh4VKurleIafqfhL{=rNCOLl%2mZ839vtPc$8+$5H4B5*t7`5X5F!jPm! zE&JWN7S4_;n;6{_f?}4G>)!vuJL;bz|+o?nml06hLL}f|#vSe!`OqQ}lw(P~2 zQMRINF+y32RQ5gF429H$kbN0p?CV&EF>{~M_FaCj`_cV>{qF~NkHlv=pL4ErZRfh) z@4EPOA&5b5Elk^oQ~A{!No9CczUk_`iDrlEyc|C^X`#FC04zQsv~b2Fgx*W@?Jc2> z!Q4|>qkXL9dwcH?buQGb-b!Q!x>lkUFEpYPfz#88G*dBD1~PMXwkHhc@2!3Op|-{s z{xC5~)(ue*Af5q`cJ7>tCTW7db>;~N!dibhVkw=K+>C{{p$kE^9c)=zWh21?GWH}@2E$~K3D7>c#` zJorRG&s?%pk+ceiN?Nt-zU?kfE6r80P!1D^jT4gR>;j_ARB8ulKKEp+(El+M>X>!J zlOt!zCsMcGccV#rH@2}Vq;tG$+XhKrQRiomReQ9PRJk3L zi03Eg?(N!5#VousWM3#zK#XRZYf3$pG`g-}V{&0=!r|UYL-|M5heIE8e@ab?kIsY> zFq(U=69q1IuXp4hT5)PGQ^|8u6*lO;>Xt;2BVdesF()=mFs*dk04z=p+jFl}cyF@y zo<;uyi=|0O)(bKcCUn0wJ9h~z(DE&UW5y;ma6mZP6mQjVU)FD#-S!x=nv<^Y+j z_I!LpSs~eAV4eT1>H=y)P@86v8gAChwy!EijNRJ3gLJ8E^FXitv*CLdP!oaZZfe z^YJSndzpAgTHq}ts#Cj=2eg1iRL%Hk_ zf4ScqSdoh=GvNH_s&0M|JmsW)9d)-@ZSCYqoUGH-S>qx=wuU}ar1V;s(zt$|K!rpM zHCo)5;A{dkN`WZNfy_rWbF^RZ)ULGFLkBnY)osY!y(vzUlA}w`ut%;aD~ad-Yg|u_>y1C5(TXn7y>Ey05GV9rxrB z{Xd@W3PBr$+=-4v~ua}{tSb1qO zR4qHh{-q4s7=MAjo%e|`7xD>d&X#>NrW`3c7h!z)w!EAzKpps-XX|;3(1Lk#`szs!&`a2y#STGQEqmW2B&yw1 zEHzi`^C;e5K!eFQsy7lUq3U+ieF!_4o$L?#+FzSy67$M+MXGADe721uKg}he~9si=rF|>CaEbyk0Gp zb3xgf{d08Ag!pl-hg`9-4Dnp`e&?Qt@cS|fo2xK&r9>M7otP6xo`c@im(r0&2CZ$M zq_-L}JjK)IcwV|v^7_H9G`HS%x%~hfq5PVha1o_MVyALB(|w_aF$K}02=(RrI(izK ze}|;lihkeTioTJZQ3ZAmsQzk^OwED3lW8I|(wpu2wH~{QoMt#Co_V%#Kz*kQH3tUi zYCtEukZr+N{HMt?aodAuZ8Lv;z!4_EG~SvoIpAsCZK6Y(hF~d+`30!$B09)|QcUNi zN}SseyuYo%#&2JpknE~8$nR4E3HA5I#54jV65g=fS~0TwStb~d4u$pih*2AoHCc6e zDjBgsoIA3qGrTVm!xpeZt7;JKK)4!wbkm!FTCdIXY`IIyvw+s%W|Yo6v|yZHB^1C; zzMQxQaa&8oUBy{Afv5e%XFUf+Db_rI`@9a(`Y}1|XCxEXF2{?nsZugAyi%T4&=FxRRYNLIkC zUy?G7G)0j)EGtC!Ik}zkCm`r2H9!xkx>y;7CHhC^^>QVSmVG;3{HMyHlfkU_xkxYG z!Gwj}bOUS?g)l_dM2R`-Om!<|jlyk^5HckyK?JN<8Ev;LR8M#2!<)fxs(@p^Kqyw- zYLrK%XYCS4Di*+~iV@SEdCA2hTE`-)*y^jy+mUokctrKQAg9-#Mw0+QuKNWBB# zNVXTyQw9R0#V|A;bWKj_S#5p|Q&|DeTk_8LAIwr&6^ESFN&FIq3sQ=b%+p_@u%Iuo zue)bKmc$V7=@>=E2h zLru;eWJd|{g3Na6Jrm4&{)+8R5(HRD@=_FnH=MPNJUf9}?DDPNQr)hDl9mNXGHj`c zSvL^mM4`ZEznXmVB9RAUwf6@L#O?qrVq;!uL1oQi!ujl`V}hkG@vOlLsNmx-Bu=>0 z=oXK20ZQ``h`_Za;^O+PB$z*jOS%=lWpX|ocQeeOxV3!}#Qv+{5@UH3LJ#o=0M`&? z4xBC!jo|nv2oj2w*vCWqkjV(&{4}#JETy_Jg57*hULmmtY~-upW4deRy|KhCbocJy zH~^pqD%i+99N!hUqw>-GQ_J~75IF>{1&Yflz%|mwqW7h4w#tJ^5h;e{uL>$1XfwKk zR!UC6EwFVnzQO~(P4#`-!Go$l<|GJ7E-OcGqlt9_u<_zla;ZG=Bf_H>a?_RkMu3#q zO|CT}Hzsy(FC!|ymvxg{5Pq|6q%~F2&_c~bD@k9%_L+*e*2vhKjwHns;75<^OBwuP zSzKP#_ZoXM9i2S&_5EeI2HRIwquiw=8_6kg^^bu41@p?~jM~3R;=Adl09$#g+(IUC zU3-}&ERTgJn34<_=i74#zoCm|f{=)5U-$$dmYz&SjSeQvlDUkkN$0jmV{MFvi0j=5 z!lWm8ki1+!GmrIXC2zKXUSL`Q;xG?(Lo0V!!P{ehinH7u{Mhcn^|6unhjd-Sa8)vz z&Iwa*K<|@;&8Sd(!h{{a!;)9caO0?zl7UG(^qqphGkz2QmL?Sldr883aG4&fHxm-1@Q;mA&?#NL@) z!>K(G*-+3fI+Rqeb13LbK%YUzp=2g0hA8z{T_woWJ92lPd2I5SXFv3?A!>EscyU+4 z!Exq*%^u|=V>vt*Pc=QsGSv0SNmsfgppjNuWzTi}up_D~0_(6Mmb^z})e*}E9P}@$ z81(2Q=(4kgOS{*N^Q?Ml;8(5lekXapq~ZE`lxA3}Cv~g%s~5ZZE2j4fn64);C~d`) z*Pr+h$08Zwc{7jsWUQ5M(=i&DOkmD-uUMM(`gng<7FlCR9F=4@7x!+Kj423rmoyW$ zKrY}fZ{5g~J(-ay&hvDksl`vRtXR=CNu&ElnS<}kyagsZ;{E>nlaSrhl~wuUi^So< z-BoslKJ8|X^`9kNqbIXa3zq`{&CDGnVyUc#0@;2URu2TB!*kcC?w|@v4fL-)K&cYf+kNs~)t84qr_n6T=Y1EjQAW z@|tC3JyN#mZ56l1h=|0?4BB75Rmctwmsa4mz8sk}2(RO7cv$n+ymI=mNg>U{r0Z2Q zO|4c5>!aG{=QksB+?Dpc_cAQ&aq%Sbf4gPzW!yu2Zzlt2moKfne#YFh7iq!7B- ze5I@FNyE@ivujOGQ9hk7kz=X|g zlE3$-`R-a$oQR{|39wvF6%;raavRHzU76B3^4aH@$=*swr1;Ite~+-@ul|a#Cf>O} ztEdke-#C#JVYc@Z60=tpQrsfOZ&F;Wp4W(1-+DcbWOaTSU|1aS1|V8CKuLoi=QVXu z8LRcre#41BHN!9h8{SQtslojJ3$ z)c5HrPXWWy&k}_aVv%VcptV($cqjAp#Ms>P-inUj9n$|ehUNN8_I@W?3L1f6C-f#C z{`J)2uMI;#DhGaMj{oX1|4RM-hXnI~xJ+FaiRidj<%-(Q`!Z@U4_W!k?EO4a1^_b@ z)~8wJJGLOTM*&o74nIS<--ix}&{USm`mJz(hIF7@TK*cEylcW$LonSeCfN-=^KimV zt^qw&YvFgpuq`0@@K(8MXJG)^K7ZFFAWFV<+T(k%M%Ev%5%3p0!m$IUg!8jl)Y2QH z0OUhu7Wuq4>8hc)$9H6U4yp!Kd>dylxjelO6MgZ-V{40D?mcpj~K6?8=Wg{)m>UY%#(?-Arjr&y!xpSnJ zyj#7)sdZ2S(`r%u0q-B7zI6Gt@+yTt`Pa~cdW(oz7M0teX{r=7Su0ipUMT!k+rud! z^8xyy+a^-IafXTqS{@-%UuDFoaqDi}0F()GP8k=xu&?Mc2As;x;l~$Njs(1Dz$Y9- zTF&0<&q99!^TH$!+Lw1gIqjS9tOCjm;$aW0N?fAGYQMQZpsOYW)c=&*^RFmO2(XNc z2aRvkG0M&LMQH}}9=?u@0&!9av6KBQ_BcIj6oKPzc2+Y!L5ve;X{f%@53w4W{CWKJ zLx8!9V0Ws;NS9N}jXl2L>6t3;RF9?JCD~tzxeRDRwm_oRxfJ$IL$^Wz1mlcY+N)!&0O52yglL=ThmhrdGv>@q|k2oM1LDa8RK?8Jz&xqA3Zr>)|VUCRL(j!t!C3@u%?`TD4xm5=&NQNnJ4C5tG zXU@1|Ie+ftI_B*)2siz&6z_j?jPuvH{(tH+agW=rnF*Gzg%fG^`H)pZitOM2sTqF6 zbeBhlQ}|}OEbMMXeVAi!huLi*v%d=O1U!FJPp5gWEgV1`qkLM!-;~s=x;ka0F1Oxv zM(?s5fD5+9mtg5vai;HMdbPO?F2;s+8^XutzhcZQu`4R!8Ki$*Cvr!WLB-Tx@MZU| zIb&~)KQ4Lq&asBePl7=_!7Blm4@I9E5AkxC9_Gh5hEU}HA2%hn;=ga&6Ld#d^VXA6 za%wPm$ca<%+uN1Xq3OFQ-@yB~Z#bsbJF|exzlU>5a+}?!G0yO}A&91}k{$yXOxCG! za0VRs{=;xHK3Al@J+6Ien&saQ^XuUuFtNJ>eu$OT89WxnQIT-WM8TBA>C%j))wwev zPfhJRDUphkInU?%DZAvogSkpDe0_ef ze9)&q!gA$>6?xSP0q9Y3j;TqJr-4SL zXHSu34QL|a)6jAEGE*rbl_R#wPoTLd^T76d9vu2A&bWrb^Nm`Esl$7P2_~5QULqUP z$|;euWg@@e&&@#Fb_V@BKX=~tbEIaBM^m|DjWufM7Qw&Ft+abSz~Wm`f@gG@yia@0 zS%=4zyCd>$5|n{FQ5bK22&OpoC*->4zT<98l^NY`y~m6Ou8)ap+gS{KFVy^S{_w1v zAk#MT0?HDXMpTiyj}FlL=dR7F#b?X=RPI=tkv44sTo`MHCuJ7w-ufO?nwo}Ttb_h!WK;U z`Ny}mWG@;E{be8pby4$2k%WF{;44e0u2-~zzR?%7s!iZ}mW_f-E>=h09t)1<_=7$p zQ3{MkFJ&7F|Ea_Qo@Xn3&6AnoxrCn4R)_9AR%;8 zq;9^EubDCcqG}HcAbw`*0ngFm&^l^8Q#xQO{;DOxjns@@!WL0^EKV6AkagAv_&}12 zj6)L>`dzE$x}a{`+gNhIrx*|_8a08S>xZ=NO*X-hv(cN`Vf=oRH{s(q%UlOHmsQEj z1{ef+OSQ@Rcz9%DDbW|T{9O9(Cp}J1&b9f$tuVw!7#Pi~AEyzNS_dyPQY!INDzPtr zyYC(?Bm6rTJl&CiAT@0rWY%hvDMpgPSh;MJU>l2rzE}hB{hWUt0wZF(8?n6xG6NtM zxQW1Bg*PBDG%#v3Ku~M>IRY!|i*V!#GBI^2 z3kF~wb|s$vvpq0a&kG&<=Dla~&TBh00pnQYAIOi<9tqe_hU^h!T!3}^|N6c*CN}&h zVFZZLG+xpCR#kT>7;nH(PSz#KgyW=ljSaiF`Ev!;iJi9Zz;98UT#jGDeED!OjOkrX zxsCL)a{?RV`ecOi)Lm6u3(p%Iaafe{SX%WU#2M?+xu)#jmA}V8S0+0|?ZYJxdL;Sn z)tYGtg4m@BqEaAi8lzD|_$&$))QWZ`FVHWP!04wMo-BeTAZ`bI+nk)q6Fc8!wV=-7 zudx8Zh6_OwNoJ&Q2pNozhd3M`9DSoMY7v~#No~hSQL^8EndT&QL2#(Ek^q^nwW#4-blljBHqqn&i-w?Uw)sh_~@D>ub|b* znuiaR^lJ!>fMhHgxHyTqNU|$noePd;`8}O9w_NjaPw#5KP4GFp{e99*hN)8es~rJa z<{;CJl8eOK6Rhscx&cI+AV9)q9`tK$SxrF*<;hTFtMzg4x0gqMJON^6N6twfoOIfBq`7o?DgV(ikob)o+~qqhBb{Hg#g6vMzR#5=9NRkNAH{ z9|-a({qC3UmsJ)GSLVw8;|-Z~F5Y%^-cY;WdISWbV1Va$^-X`iKU4Pk_x=I_E*N4Q zTS;d;eYZ>ezg}JGysF@C8xiD?m&_@;A1#~vuPYn~FQXwWpqeepDzWR|&m~@L;$&3E zEPTw@cly_8%t>P4*=e}-(W|fiLUXq>OPO>K#DSs)Kq0raB+>EL@}3`Gj#S;RP)0Wa@Q%}43=XVwyzNkEd{NF!#VEVhEha9?MP9j= zb)KUNdK|OvHrr#ZaSGwIRH=Gv4)X+j<6$Hg)dFuL#;LBpf$?R~fBFWw?VV|7PCD@W zxOZoc3fV9VUvKR9D!x>F+q%!?jP-#Hla(xu(Iu@2r0TifwOl~%FP?wYjo*$Ky`X>B zUh=`C_u{Jx$`)%#H/HfgxOgu&pF3zgUrDJP_xqE@Bo?U8~X;vHbs?BE)E321Rr67T)F& zWM7f6=_o&^rTeZr&PcJc+M(H_5xn}}n?eE{JSja|2%tNA`UHltKwsSY?JY$smabfy z-K%FKd0*@or%GCzvgj&^xx$YvfLU8Wi<_x^De^0eWKEiJmIyW8_P`dy(nRm2xDdys zAc*kaNh6?hUdEXgf`FF9pO)(EzK^|_sPUgR(2W8>(h&svZ}x6bDbWtR^ncmbZnGmi zBK<$rdG#jT5)sZa+%Ex=_uuEWsU*HIr-}243`hn4IYHmi{8~o;1HXcM{V*BF{WLPK z*Y3RgF`z#MrVCULgM(o$@Z&xW9r+#YAxvRL70Te*NucegT(z%#@6ImSxr%8jbmydd z=c-^YO-f0&{LWPxz$XWpOdiU!n1lxZ?=}B7Y4|;w>;Io6?cMe;-w%Ha7;wZhcdj4e zX^Wx+Q51=mb)y7Y6q!w=;X@f@|JX(vuPAwY%5$Ud+JGwVg`pbx zL9dSIzC&+5{&+9*!zCzbZLVM5xu?M9Ba3q60BpIrsd_xgDH?_UEWyReDT0`-oo(A# zP9+n)XS#$SlNGpS3MllhhX%=Vj;_xED0J^7s*qC{yG?WdwORER?{15%kK&AHaNdBBNRad!_Hx?P1|Nonh8C z8*{gT?8`S1LkpTU_8jvqsmt!AZ#bs6vqW6bBIW~WPMe9Ts)1;HwvYEY?M zx*27b`^YXpT5?^_)=OKXcM6M&(&PUxDt zBm#>H*jismxUA!hMe$+t8CiG()39D02IW||(y_yjixsNZ`kc~deLe)@o76ePse-~j z3*Q6?I`i4UEO3mf zRxaH|-H%%0N3PZs3`obcp;rvx)viJiY@mfz$a5rOgxkouaj;*`(jBvIRWhRl%jw@{ zt;T)G?asG~Qti%#-c-D5;mtv+CgL&f5B#YPsL>R$?9ndNldd`NiX|%{`5ssGFujgj zPXTq<>%)m({VJffxip`#K>B?L+&|hSSlHVwP5@Dmt{7v>XrpIy(4Owo(b6_4sMstk zGWcQ-%Plx+m|U=Zm_4>p`~U;$kzn8VRm z<(hGiT*TUC8wCO99F#7($ct`lUlT*f{`$t$rAIeSA%P_a)HFW#Zv-T_FNkgA(#4hy z+0l;~VUHN5zgT5j3GR0<3G8wPJ&PH8#hq!@xWC1g>|?xyk#VLc)+Qy&-q97rPEd(6 z+ZrcxO~j_X5C|ORQum0C=9O>`5Mt~pyWt$`h7lF!5@GDozc?g!v2WH~2IvweYL$CS zOA&M`pKu)qH>3|J@}OEr zE-t=&$WMaVABgvDcadSNJ>m9zNJxlg7>f{MrYrZ-3`i+e`7UU&d=m)spbebX`LFXG{!3Y~yj;V4rj*BacDkNa;&K^M1w4DcLV7*5J7C$SupS1x`z-i^yLCYW0v-`hm^8L2T9!) z3!;`2j!Qsg(CgY9lrzl8<)ikdX6qI2KkF0*(hv2uM{jSi+-`NJViCO;Q@KKY(64!jQ8T2L74 zc?zupU8yJXD)RS#%pdSw*=WYD*X{+D2+_?x|5g0ull5t^_7r{0BC~fls{kP7t!@XCdtV8I@b3vNi z@eA}}4j(;|=$W}i7Dr3!XiG+`I4dFKkoA)zJ@Mtd+zt41D7Sat8Fbe6ST53-9nq;U zBXwT2s&T`rJc|#Tzi+B?h2QZGF@(#~A?kZ!5zv$I8JP!}`5$j6QO98`y=Uq+`pbv# zxLJ?7!#4_NkHws;KW;0#e}DhkalxsXwMu{EVMp1Q@`Egd-7R+v2ty^U88!`Oju(D?dm>rmC2$v9O_}-dYdd zb_m*)J#d{M7Nq~IQxYh#C+~rwt$<*ea;@s|+)|F&Hw317<>}w*QA1m^si0k_o>6t;neH1mc&)4M<7N0(f=Rd=1G4v<_`#fYsPo=T^`iD@Zg=%(r z+6&8kN?>p`^|gBa04|t53hR+F=`y2T0MSkpZOYZBc(k@O!^PdGmS|+F z=a#knBDHJkqDg~F?Y2DqG4noD)Z)>;xGz#UX4Y0d8z-_IgkxajIdN0!525$ga!-*h zdQX=vK~;$TLuFxc{Z>hLn@@G?kdP4Q1%`(~jI6Fh)r43*sTl05kW#mScWstcSYRhM zS7&5&-=QRX=Lf4Uvf|MDre4&c3eWbpHU7Ax4^>`AWi#TF$!D_{Z`mVxk$^=<$WI$c}41sxL3xrTd!p zZMElk;8>cvvfj|qgW91sDRS!hzf`ZNI!~*Qk5b|ix7$i0z&8^K}FyoLPUhnqawjj zr34Hm*dS6v2`!daA7hvV<5fJR+?=E!5<+e|Nl8<}9fwM}dl{CFo;pRd@<|nRP zJZ~N1%*dk89&NfYV*At2wHlYdlw6+Aete5*^-JuLUuJi2*gTuQ0qFekk&5j|>VW$j zKv11mhFa;n>DRLU@3y>n?d;9CkU8Gq5#t^ke`?c>Yd$}VOCP;u&c&GYSy|Y!Fiai` z1F4QcAr@Hd-0CSzUVaT-8|Jax@mBQUgPj+)2>#e(WXW}Nx%HRUZq}Y$KWeJD{>z0e z&wI96#eE-k;THBi>Co@*6rINYG5qBJ{_v?nQwC~vd=>T$FITtn*$dD1l6&x0v?p>l zjKa}b97HW6g(K!{S7*;-cKiT+fpYEJ{X7k<>xGCJ3B5ZvROt&u{*s3N;)Jq3@3U|C zP@nGNR0)4d7*WgG+$jEoCiTM4!o*P%#>lcm1oSL+WWH#G{mihmb|T86e&MqjfT=cG zTEfjQ`Gdrc=)KD$q2ZX7hb4;-J0GVsKi$(3$0wjx+&%moKBp9)|3QAmj!mnE+oDXaHFyD&nhXoN;)@ca{-=rTR zc-7!EGKI9u1_VUC&`br@Y`3Z3iJJOiB&(dFf6?nS7OMhCIzR0K@?u_mNi$xNozF+` zPS(V1A2&qO`?^@;KTys>yw{pt#*-=~tu^yX6q0Xu$>~T;9ap^U?iWsu%GbD0h<&H{ zQ4U_9DZArc4_Sv(Qr7uuVDV$B3kZ@-YqC~JaUkN)XmaK#zJatU&W$f(R$uD|I)aLG z=`B(B4A;ojl3P-ve$&rQ(skc4S^8Gbeg9OJ2Xlf3?j3(vP6kvuiHY z(7Zv2C00#UuRBP1@9Nu^J{OdOQA$n#rSCe{v2?jNC9-|i1dK7g!c8}*CplBSveXSm zi3)9B&#kncdG#hlbi3DKnUrQ?4!*a@-fa2wE!_w)Nh)0SI zUm&*X&mlCBRt5fa5E`Lko#3)y#%iZ2TcFmXrhK_onzl%U?+5{ZB ztHxs3T7>Fm_tqYG)#=&(Q5&1i<2~Xn+bc9)fv#^0B#B^NRR}33E6Zf;moDJiG3qOe zLy9I&e;89^n4CS`9pXB0MLSA|;F!|r=tek|qTHjBwNbCpfaj1Uf2rt_w|%j!tydOK zw4fvi5o-)7w8jUtBA__uyk=cxGW5Hz@qfZ1J!A4LDXv$?Gx2C^ba9K~Opd0)zD8VB zM25m~g0;gPKwX_N?&}380FS2Sp-Tb^!O|cq7K;j8V(0o?yY1+e-neJ##K+w&=J5j+ ztAPen?i9sjldr9jF!9S+KRzt7dGuO> z+`6|gJL*+@zK>(VcplgI>Fc5VeX(yowY!;KyS)K6z%B%NG^9Tfhq#QM8VC6o z`h5YMl1N~vUNzemsM(e}W{GF-Q@z&q6j_|MAMeOs4)6}o!oo>FObe^#iFE;Yrvwgs;hW;?xuxr2Fg=CS#GbR+;#Sap$(IfAvlfccU#=#LTvEUTGsx+f zQpjs-e5j*Tk3Ap`qlm=NX8b`Vz5u*Q#9ixZc}8g+3lyb(L>^w;&s%5fmYyT@S3fj= z!KCOG$dqcMfpy<)YuWbs<7lrAiR=ybHIGR};n>EPa;@+=|pEbnqnE6J8HY-0k<6*@PZch#Rdq&T{vPv#x)fQe7CDNN)tXxRjW^ zzvb5IcWvm|*-DMWRTDm^Pdb;@)vg}3I{GlQ$M0!^4NqmPsTaev=Kds3AMvEt4jiYo z$tw5kD}H{K_{gVtQ3swzQ@`-bLARi zn2Bp6JP+_LtUB$H>o@1#vShFx+T5emNRy_Ff|3=QFkm$p|K(Xp#p)tzxm&noWe%ki zvN#KH>vN)-fGy989L?Q?0i{4e_Hj<)%7U^9~p6tjD<&%DBAla&MiN&I?B1KI}v77+cd1wY*)s*YV{)vwM9 z`-XLAl+p3aE%o8c#!#Fx_STMS(P%L%sIJXwI%54b>K>ghTkA>il`{ZPuB-@yJr3U- z9*ZItUl}rGjLCnq%A!cjeI;Vzd$}v^b<)M1c=acpGCx;@|W~&Tz!rz?FWpiUoD%RzIwEY&l46_cvcL8X{k)0n%&T^9x zcSQ`=)3N}~DAu0uaaAz5gZlup9;gNUsIYedt%oH6&PCT#?bi)l@TXw!pTj{>|Mv{f z!K@6@^kUYzvj)yM2cxLz{2<}EMFh7yN01E*uHv82;(>w`VErcLC#$&X?N-~@Z%poC z42PmHYpJx*-Q2gN7c=ikKds%owY&+s7VHAruy%7(;WYMD&1pe4F1TLrNwp_ArP{CG z*ljaaoD$>*>o=!1{eKrsfEv~}bgZah)VG$OHq@4(p{lzY_S{kVicS^k1j@ix{CDoW zh{LQbGOA`|;bVTDAYWboQm7z>Y=o55eT#kfad@~6-P}@IqZ|$&oK-SqT>FD}6Rsdb z6pZcH*I(obxJJ;guW=V)+}L6Twf=*NT4`k4ATj;vh_L09808?;4#IfcbdkLN^XB9u zjltaVG1{yi7W#F@Gst34ly+vfR&ZMf^-e3+3(nSo%QTW?ZGPwaLvwUx;Vn}Z+~;%~ z($QTVIB?6ZVX)H4YUxa2{3$g1)gMyKB$0aYq=!oZn{8U%Pvfo(KTQ!SrRaa&-#H}j zYtifiLYy=O>(A(}^v{&$%|_|23Gyz(&(ey%V`8D@wg>1W)xVdd?tC~}ol&4%n@Y|B zDWb27d}+%-Fz`Fsyt$|$;DB6nh%Ril;SOHryC!&Nb*GchyPhq&Cv65^tSN;IZ8MwDNj&=tax2}$Niy;11C;c0P z>|P_fqPt*iX0)%wWIDQXWxuZ*FfDJ*o=J;D@^7whJ&j+289M!SC&(M;)dmkW8 zi%#waDpVY1O);rw*BJ5k#+rEq&Y;=bm4~HT9l13X<&9VOU5?07j~&jW67Jv5RI9YI zlA`x+W}ZR!W+Tu#y;diD)7Rb=I(Kr-XxfKJ_CQaw;?HJ`1-ZoL5*9UJo^vxYu`r{- zEjp(VBQC0e#XD1ql@13wQ{`T++upgoYZgWWgG?HIx#I!z4XTgjP|h@r3}TFy2e_*% zoMF$jx?N;V?C-R?WTINYp-Lo7W_*RWp~qtRmx}a9yR;#>yc!ul@P>y5Vyp*XXZA2N6dCdybuf zH#s_RoEeHQ3Q5hw%9tjeASc*S|GZN+XIb9z0)j zNOvK^0#8MEG-DjJW7b31y}7i%a?2t_!WG}On(?7%3|6_ zcPaL(X26?2-7a~v3kWF)A?tid`C4dNv@E@}B=ME_$TvZMZm)q9!Vt2wJe1c6H``ZTZ;;V``|zX)=#<8%eHOqA4dKBmsZ4A5XSE@YgNmGzt%K1F3 z|4c_^amF90dU}GelifV><>pGYn9@SEXLBatK?#FGvs=B?MZ~qx2LC`S?T;l>L6(fk zR1;p`AC7ICDcJkNKJuP8r5KEpAabsgYWL74oeb00$3MdK1b!UlnSq^^vg3HE67nK_Ns$4t{i^^v z*TVRBrvASb8w0b<7qtCqaPs(s@( z*D*7Uf96~ltQc{$<7r0AfhC;}xQ@8o*^*tzzL=okgfq9chBnF^hG!vj#wQ+rDxY>7 z){Pk*!5C%BdfwBiNr1^YCJ#d}K@n|3Uj8$wvwB&PR)Y>*R82k4u+cux53528U&(?f z2VlhwzrGp=f={H;FB(NOf!#{+)A#3VB`l3peT-ZV$947c#-wNRHo5NH-487FkeDy? zMcq?Ln8ej0d{nd{&fJOxX21ZgU1wBIZ!g|<8Cw-$x8_R4RsErd6sP zd{ocp*@Xbon+6+5*}L;HO}Ne(HM0r2Y%SruPcaoY=)6H((LrMU`BeJ}0_!Z6fAkb5 zy%sfgu)AWhzkDZ4tl<3fnXc`fa>RO(8sX)Tc!WaTPRqgcWL#f_%c*Y^B$Rr&LW!D^zjN7x1mp+prOX(?!4Uds#bKBG{X2bew zNO;sqHow{b74=!X6{`GA8Fk=LXn4*;BLd@Sk`Ih0f{q_#>Iio9+0yW zI9j#|$Mf0K$gNTEEpYrIn@UZ{WP)GO44w_+(|9LJVp^@BLm{;taxPlIbfWmdllr}B zgzR|Wk+FpfP7$*D+KWiNS7nR3p<9ch;u56LQ1f87$=K^!~_ z&Dv1Q(@V9SQzH zAKug)EucPN@IL(DS(ZZWTcDR^@!Cd1;9Nu^lmwTV>Pyc<1mdv*u)9Nt5_1p!Zt z4&BMj94EByl0h|OCrQGxJPON}mmsC^^E8XsOdFywil>8@geq`CouW#Wq)S+~v_a>* zG-|n{c|Q^WV+@8%?r)yST9Ry){Iqnnm!^@NEcr51Cg+qzF+bcCkUn7Nz6>5A4Na4#Z>9p9;yWFg4Lc4cGa$K zYpGD~=i1XSVdTML(wnW?3H?EG#*Sg9j5VcHMuEJSwDh8r;~fNbw!xIhIGIf3 zT}zKBoe7`G^XncxG>985>BH@O=~(T&YyKHAmmfOaPiI(4b%zf%arbrh)r9WmdCk8f zR8)Zd7zKmI+NF5=R$gk$z2V*!b0E6$%$Ng5yAmKZ8e*p7&U==Ysr{LZJ-D*}0VWFW zXk=9*!asPN<)uO+G?%U~>^ZLK77{zg^fBcU-dGM?bZd zP8!u8l$aWze^Kv}_VuYK9Zg$QNzyst0CVYlQw5HK#&~HZ@XJfOTqjKO`1osUqav|< zZ^inUR^dK#@v3Gf-Y#o7^mh5#2rx7(djcE-B09_SxbVJ-Q0XS>>*pcnSlxY;_itw6 zj8Ia%Gf8xN=VO`=UxmW#t`%CtbeKp0m`CPrq}x-wkf{OVjN zsWxbglk25TI{DDA$6wu*Tng)2c^xWA@e3Ryl;c8v<=xMUnB-r^bw7cqsLRwGn4`>x zIbPc4cR8!Nu+4C=xKf3Bv?TccQ;6n%uEw%PuOcoE{Hap5yQ|Xu3ABemtrh9_LyQNA zdh0DLHsK_JI`V{>!5WSBFH#aJMl6*|SP#p78h0go+i2bO3kj#O9b%@8o(?fu*M}3? z1&Tk*i&fm!E2hVO6uuLNG571k#N;^U$So9=PSO3RU5_CgIv5iWh}g<+9}f~gSPn-w zm*KC#v@Q*y!j|uSyN_s_=%)%yrpKM>w>7TT@7~T19@`Mz-ZoC^(z|{T?WZkAActpt z)O-f{dez-{?kTlUmVO0h6Ck&_tUny(Dp#guf-8PhKQ3@}Q*GSm^Nx?sGfuv2>q;fF z7j!x)qBiw)=Il72?p3J*+&nw8{hGSyUUowcF&>uI6sV}2B(2~olFOICJVIqF2hB|Q zVS$5P_?BD{q_yEL*o5YU-0gkiJQ)mQiwd_g4Tg}#-dcH-E|tA1jQ(>puD0bqi7y@O zP1>tni~Z83bE9fw*fXLw0_I0B!aH%lQFxSZesqlKbg<;kJB2bBVGF*(q?xx%^9$e3aulge_5yE}`^=Wb00YGvc>$|b5|l|8wS zm9ZFJB1@r$-ScJBlhv)SufpD?3D=jDEZ;Ba-K7$EWl55TS21I89Y5Ay(ae&-7;y^# zuZo9KPwxIOs44JWRY`rLlnUTcUg=ia$3bfX8JkEu z!FMCRpn>#+=k;*4t>gBL*%n_)_|AFF#PQoti~#B_MiY=>Ww}V}+ms}Kp!dO;>Q$^t z;)=KP2{f!3;!{cspH@gXCA|0R^6|tT6st7bD+`H}Zqjt9lJ#ne8m=;JkI{0?3Yz%@ zZ!H=Q+C#4DcbvlAqIA*bRm?(@xB()$rNM9d(GU%E`)mvoUD%!&A8{Yo%f3ROO`TEs z#JkAXh5}?d@Hc5y*#%`;h?3PSzT7U2XH!r4ZY(icz|i5SbMua4FcJjQ8!cV6a=cRa zKxi*6xvbi}DQ8V=4OC}hTyJf^){$a+(X#MVuf}SpY$ogBG{Gy1EXnh-YOU56k3Fa@ zL5_DZZ7-3W>^mR`K^v{0lKgwwPxU{Kxj5>{kM&WNH$fficTRuMexm#M^|D&GCXF{xc^PKbWow2J{CD;L6{HSnIOSUB#xXvF=IJnXT56#h1+3maOdr(5UZ#hTJi~{6+6!Z;{Y}+L^+k3!%8+>6PU1js+)z z0uKuv?0H_icba*A4?QFMWb0llK=i_GYHg8zT+I`Kpa!JV>~a;I>c_4C99*Tl56EOc zdM?wQs!=CX%0PB3Jq|6Pcl%8QfgfRp8a-#<+QpnyUG?r{3_wpd0$K~Ch}MWU6sZ8> z!PBAoQ1R*Dhy$~<08=;p*!v+6Ve7F)d{$b3u?SWp_Fsb=1 z`JMAN-K~a84=@Ll-VT#q|C~x5e;h*|Y;n0ZmKzWiGvZjd6uAb`zL z>{DddqPc&BJ*i6+&9=J%Jy&t>_btaQ z&a(mNUjCTfEG@cE6&|Q4*-R!PyOH)P`P@7L7_FX8H!TJOQ1QE{zc1!3e?|nIu%erN zxwR+q#TCb45?PC4#>n)GMkRe#Q`H-8pg=`CK@xp((eo9me@AN~C|I1nJKr-$Jc zncjiE{&?jUoE0>jedbMN(Jz~lcDM_I)b1rHXZc?DTt`Ie8|&iScDlNU76J>7gGV@} zz*a$wTskULzUqub#(@=NFw-%u2$HK}uP}~1?C6!STpP?%vkGC2$0cA93<& zL_^Q`MW1)$$9nkegThwZ=VW78J5l$71{Wa9{%G};^B!Z>M6oQZI&fkz#b!sFy;)HP z!V~|t+WfTa$s>g>8gs%w%VcZJ40a?a9`3s$%P60}h3*~l`~Zbuc;LcrZ>iop2x0x8 z>Ut|}!ns)E)+4g*Ql^TI!QEw-GT-4;VVK*akr=1VYY=el=%5+t1!1ciy=7*YohM*U zPj|b3(nRhMZV?a#6*ZCFP8c19s90&I-!KJlHB}4{7Pzdnlxu42xuV#YNlo8hzRq<@ zf6~oK$P@O))k5!LMzO;F&Pok5z|P24O$T4cvwc&3n>}C2XG3RjG{-Ei-LR3u>}pBn z*wPokVCMlFe_%qN_`Fi%7u;^b5$6)Z@t#Q_g1}-LBQoHPH+COnHNrB4gZm#%;vLC@ zw$(R&ogbx_DtpR6vgrz17S#ZSV4hYhrq3k|0;yWKr|#qn};)jB0u-bqxjf@qe7Zt%h!X?5PQ8|VhP$$L)UJK3*l z3J2oO0RnaTjJx2RT&V2%(?xsfGJWb1&*LavvY@Gp}Q9B_RhZ0eM@)E+Gfn(-V;*qNSpX|X_qTYefG*&b%c=uWbXYeq zm5AJ4rPR^KEk*D`&E;V>w0!2v=#LYP4&+ZfX{J{dSVyaB)NyO*L*yq`5s+d{l;r#h zrhKMF!F{Im)P{YHj#VH8x%5qtG9u#nBJ{ofqwWvJ?M)jSb*Bl)iPv^_##ami!i6wA zqk6YZOS=h{OJ6tIOkGo%fcDmZ?$R7e07HspInP>W0_7a|9ipYtV3`8=TO2E-xk}YDeV3svx;2e6>LWrAk>js%}-MmEq z(gYpx-Fibh1-DoCMoiAA0(l#T5Q~>dPe2_JaAi>O;23ejF0#M+&;=Hu*1t? z628QtO4a!o>=V`e{ZQUiW<}ntt_)#tFSplXzd6WC70z*p}yO?0X-AjF{Sc0IdbZK^kra;E$%2OernMM3d zh*s|@iTnE_>K!69w)|2MPbAD#1&#zdVQZgKjam&aNov5_*@jbP5c|jedLP5511Y1} z4KlupVwmud2;x}Rut~7BL;2+_kYix6kTR9xe^erbdP^-NeeG2hd9o3{}qcO zvTi3RF>5gg`##QLKnPI_%}pIf55uv%a#Wbg@rQLc0?S zu6?Gf?>y}`$R*<@NbE5F=8Lb92KuJElVboOA+-7NuLeZD*70{I2{c(#b@jYv19L(F zVEVnIZe`&tFzo!6Q4^E81Ba@I`~fgn<%(q$tL4xy%$Lcoi7R0`_lwIHEFbZbbgZ5A zAUN-R-M?swj+Bt(Wy%>Dm!>+}(0o%uH(L#>qIx~56y;ii7#B;k!gz=3nZ<@CmL{$? zI$o}K%~5%Ide5QYzd-B=<|)SbNZhkqj-CV-{F9(n68;KG;DOqiR; zOn>d99P)5mT{i2i?^5OM(AQ25i*-oAgb@iD7{F6nv9VyiWMHqlBI`QdFc6avrQ=7 zD(0{&G#^Ki*=Wg;j;ar%WGlqj$wqsMdTZNuZSxlfw6R|vRI046iZ;B7xfFJKDyG=m zLT-PzFxo&j9P~ywMQ3O0M(|9oX6Pq{>FpN?UI0f3tG^77P>_GWXnB00{ApfoNjDet z^lN6Vqx>Rw^c*=PAgjyP30Vw%64Tt`sf0|#sbuY>K1)tG>4T)bl&>S{V)VP0DR{KH zM`ONAf{6&Q?#7YD<@ zmn#^R2PbnGu9B^HdAFJ2{6k%pFpmjXysk#$?zE4|WGv^mx?ZZ<7y56s09|$VWk&X^ zs$E-_%10;2Pe-Fv%2qmP^K%7=d%jgV!QR6GC==QO9(}gB2j}>kO_h`%Bdzx7yx#MU z5nQN5Vo0uTZ0IkD{O*MM1TS*JLSQ-%=XmL*QgA&ZmNE*NqS;zL^6JW-MEKyo!lFAeOM$!4e}aj~^f!hW?6ukjOJFP9)rIuVaQ+WWvu#mm0$}*KpSu#1%64``&Mp0zhu#b9%7V`7nr!*PBe*M}_ zc=_n#F~$`CqXbe$W2nBc9k*GJ}1$4+QORU|Y z8@&{=t+J##e##CrSNL2)Z0TGDQDG7&JxdNx|4NsmU6DLIBsR1bw>a{>lff|P4bcxP zZk^0uA8U;Uswd#)y8YhJZS(@#AM~oUQd&#>Oa{Vd#{FHn)eJb4g_AAy zz6MjDXleDAnlEQ)ZB~##5VQiISlqF3mZUq-S=-aKZ4T_gdVm8mkMaCOrg8nz?LfxR zf$5AEt?NTRipoCT*2CkO3GNr2cKgAa$P4=P8z;L3F-D@y*~3sII9}Jd|{rq6gh}Q zFnXpE`G`Kvd46n}FgDhv%7IRQ+1?lv_A<4=7{5s-Mlah*Rd7PsD47>3c^dq2hU9-k z%4)^G?2{TW{n8NtKMbedm>Tc5VF=z_*KU+=)t5v02F?p>oIC!g&X9I=b@vJkVvI5Y zlW5(0DDq8)MQd(PFB`p*wv<;2>lpW@VCTxgI4chwS8aY7cLhCKO4N>jT3%{Sbr!dM z*f30B+fRBb($w{wEZ`$H)Yua!1WFlD6I`yfxnXhI5z~e_MSIfsr9N3Hy*5|VMIf*+ z5!Z;a`Fz?H2x||sT5eWvI0NM=gcoT7OgP{GnR zqQ!fSL+~!3Yx;kjidaBbATi9s}WC^R+Y!UOhBDSBp{qmfqZ1pQDvVm8q9=qVq<_K2u{MVvluc|u4qnX z^Btw{H57;zJuB#5b}#Iw5B}|OciqK_QoQ=p?@6*B^{h@tU!7^WB{HNt1(-I@Yv%-r z8g(nc?3!;n2V2!}#5Ar4&Sq65jt_|5fjsZ8ok)Vi}O zl>*FG1C@^Y3|-gLpI>fm+c*^Ao1+NChuT=K2+d9C@l7Be-~Bbxq#K9 z`RNmz2J4VC|LoK}1sA>krCn^Mx>f5;_P%WSQQUJMr%HEGH;5U{U$m)wDuyHjc{vNz zET)}5l~bkYA3tN2GBTyBXUI9(`-SF^tzV}MCU{NTO{5+Pa#C-+RwrgU$aUt7G0oa3 z)yrz3IMOOxQW0LeIm$msbV92u^$N5!b6EB?EZNKLQ~-+3x#w#!l4t1)<|E1T!1RPG zpDGb58o*#jxh}O|ye9FVO43^5XAGpZEw1|>6&7+h(h3z+#>kt3wb>2fv+Y@Pn+hdd z`B77xl@`sqr$gKAdJZZ#E&7uve8YXk+m+`-jHjOZt7mVW(ZU|M6Npx)7IXaa)B^{3 z+?^$*lu1MVQ>Pu_^9_ll0*Q_Lt4@D%Wx--uHTY;|(D^`5N%@1s*$TvcN2wOU4z2Bt z3RAL7M;{3?S|T-S2?P=jwig(5t|T$`KxHB7;z^p8M%)x4-8yfkN~WMxw_8vET|&Gw zZaOrjHDqC;E4(p(rK#T|FhBIhZ$}FtVk#CmS3uXB%Q}MnHZ9kT+$FU}U~vm?meK|B zoA%i~mHs%%t}1)A%cIa%u8$&)J2q6J>StV&Kf7OBsk&}1v&kZbd2dfm!g-|@S~cEh zMz3GPb`YDdU#WDk#Y{W``bbma}$^kBQwIRL#4p zLY$k?VVjxK+*COf``YDEuX(Mf#jRn>RI4M)Oe{I)(yL2I!Y377Fc4XxsPYr-YMOc z-F`2@iEvG3yS9;tl2JZCB@|3(rv5s0?YWtX%H-0~ey#&#C%q0h)$Mn?DYwhQskgBV z(Iwro1z19_&aNgl@t|eLRdt(pJ`Zn7L_z5)!6c8*V35Vhg z!6p&qsk?!NC*+S#FV=*RQqM)He?2!V@@?ePE3SPfDaPm^*rZCxmRcP z-(KI!QU2~~&MYER2Mgv8B_UtK?^P;=JyE5ee@pA{ozXM(X-5(38bns{=@B6 zP0Nx^Od!Dk@y@N#x|K(LSQn%^E1$?xB5s4E7hkh4zT*u$0Z^7ftK z;@%A1f4^YMIoNo+s{8#h{$R^)iOf>(*owQqE#fDDlb((F#1q0==FdqHx8+mP9`*dB zuW#Phghv#pm;CI2y40S#IA4l|C9k|GAmXI=NQ7+k;7^3Nwuue&0%b;@c$LjHH!GOd zgz7WtqD}XT`=~a}Q|j~3lFUePW5}sQ>cy1peIByVOp3ZhsGJq-LXZ+^GMMS#_CU*( z2cH?^JQK(xS+9Z3s&ofr4rFc(ef?&R#0+^Q->XS&?a4yq%1Q~+c#Wv1i085!q2@#} z?d#&uq9KVR8cVgm&8C_Bcf88^D*C2wcY&Wy+Uh5a-I-xshYnVH z0Y2}ly3-x#4tu4n&Ti1{)&8X9>KeRI$;g1GQ8wM!dfTFE^wp!7Q%4r&`cr0-q)%W^ zGA8=V{B|(%xG?^-+V~(zLJteyvb6kqB2#p`l1;BOGCm6A%k4R1#4&8HZ1sZ0f1*AM zFpG{;Zg7)$Wf_5MUy^=0l}ry$4D$}to0P6N-IUbbFq3TS?8g{@e}qAubbKI*oX);o z!Q+|52DJC>U#=T7Cc{`d-JGc5%GQQS!l|r`mb$E9%lO$m8D<5lN(Mm-tsrh)^B?C6 zjS}+w%mrmfc=?`##+ciP&L@q-Eh*iaO$2+IQJa+NC56VNbBC5P=lg3Lmy;XqI>yKC zFiyG}FgZ)z(v_!DBlXMaxWWEv19(2O4*=xtczyJJt$q7 z9R$jafYx7d5M+PHGiT$9YTs&!Lbean!(yl`@4V0CQM9i8_&_>PY-zmraHlf-KX@w1i7DK7SQW; z$4>9_9;$L3H2MY2KKm%*D-^x`g>xKMO=(-r+*F-U9MRw%DO*34EZ7?@>h9Lr_;$(9 z-zr1u-Eu*`s#Ehb%}6PBUFlhOd32C{o}MQ?IIwZ$<|*ukQ~UH~B8DXj+?2X45cJY< zSn3SD@`YwR>me?Fv({=&v)<-0L>M0+ymbwh?e>weCU;jF-3;xg|fvzQ}6>q-9Jhk$zv8yjRgZT`^ zgV#5aL@8+-#2D`AAf4=pPF?h$xTs;fONu7nsJqW?FJ6gxk=e9^*1USv+PS^wh9=EM zy*_AU-$4INlAy-xY|>nM;UkiRrUXwG@{;2qsQRks$Gn(Neb~so{MY){7ySH{^A{}s zvJU9GGE)GqNA2r-@cS{tTau6C60x97zc%oYz`riV)h`ze`L51H^uxyb;JepbPo9_e z)$zBMM(SRn%qPQM zcI&m%U~M_LxYhR8fv4r}h@{#I-7yX;aZy>Xw`PPd4vcJZ5PEI%U;Q>=tAZ7B5N2*5 z+zs6%l=qUeU;H~VqG<7(yqkKTCD#$X3F@RqVZgM=damz(hk-?e^nZgvtM1O>m4x6K z{9Hzo-l8^Oi>JrpU|fxFI6?S>s8Hrc2o+es!7b3M^dy2lA3vp6qVN}O98V4H`Q%=#DPeEQz|bf*@tpmH7-%@9wa5jr zVZHFYGAj>0KJuVQfxW4B;lc;fPnj|?sR-Z@EtSl;hcOeZns(33fmN%bbvOTzie3i@ zRBl+fJbgK$?HbRcln$TT8*%^ojh}fEjJTORQ%iH@@NvhXGaY$9blDQ}SSY5! zUss|>i1z+G0ED=M@}vnjuoqTjB(gh~8zD2<$!t@cB+(aB&H8G?F{uQmEsAsyqZV2p zYgrAbC|@1BW2G%qeyhwFXq{ne$&Qp`(Z<4fqMhzTxU1KxMwx&MMSOH{bb6A15#k-k zkVv=ly^T+%Jv%t)RXu&n^n>O|cC`jUFqfsN;G`9%D{Dyz2%o1JFl3b*0Qi#W!Eb>G zMq}#6+@-IboY#+FJ|J-Y&7r?CNj@TUnA8{(!N1T1@ECxH+}j#9ci@wWS-s<-f$f^L zkByae>u%jC#RM&EH*RhS^3JFhy-RNE8!W2@Cz>oQi%z6 zC__0SP;JEq_TWq#6C{lcZymHNkfxWW2}o>jKMHPM(0-d`1)c~qfxKj7ec`Fd1~bdN zpDeJjP=i<5+XE4_1>KvJ9XyQ1l5Qf)u=)D@3uayuGkHcLf|w2^e3Yao!KX@1#vlgG zllaRNm7sy%xycYF1aA&2-lJcL#HmfI{BEve%B%F(YDepY<|RfK+@G;~;?CfoRv0U* z*4#?14e4PuAd^Bh=?(Wtxg~vpLXHw-{3{ubUez%}GPbV?=G!t(6qZSfSFY!tC;5YVpxRgDtwA-2p5TAr?FTZYUiI=Jy_eb(p=Z4adedifId zF+b10(mZC$#Lc@UGYLOn7nq@S32Jc;SB>V_93eta$b;RM#6T zRvyiAH5cAJa=u%0o1oZj2UM^lxz=>S(3vY0xAFpQQJue z&X{INV^?-LvxTs8hZ98`XdhGUL#<2ZG*wCQuH|=MOGVyrn93x%K+qHtO#5Zs9>KSJDGlkJjdn%L(uJOPA8DrVqq>P zC<^#Da=c%7M~Qc>0q}VEbyIpIOuC!YF2KDi%cKl&#{Yg6V3#g{U9UQiqt3*f4t5+& z=3G}F8C1hWV0j07v#RzMTXCL$NKq4<38g+Yn@Cj)9q#ToYXkuvH7rvhE;E`pN4rNA zXaJ{^(^e-|dGRBzjECGg|n(}1WVg{AGMBK(%XtIRB;S&_KL=IyPDJ1=M^Iy+vR ze(?cc`xQGYOYT(8Q>na=!H&uU9UgtxsXrTEADDq{@Wy{*QD(1m zs(dt9C$T5NmzPR27Ywjj?7D}?HeO=4oy;;>HSHahALIGSHq`b}le5a(Ng_0|EQ!ykIng8$II*Zx#pf$$XF}dIrkH7Va7^smE9fopmwtVW+WVRy^do8!BPwP$ZV=+C zdg}F>;I~BcGh1rQ8UwAY%?=1HIDc?mZvmnR4&J@xOckX!nu3J|k=*7q_7?L!sgem< zE&B$M7wQ)@1fAQQN*28d+K~VEw@~18`*UjR;V{*{B6KbC-Y`{sOMMsqR^_JihPMin zb-h8jeD3ARL|knfA0_L03Gq_&;Gvc zMwwjsb-iHvjUcFe2aZ96AM#$Wb|{SeGydwcM84O5_ZrTso%#_IiQ?}1 zMaTa277aV$KT-Ie+`Lx*oh_r^%hv7o{W%1_{Ncw#i9a9CgfI5JU#~lVtMwNkK)LV9 z&D-j~Jrr!It`pOH{!bhUf&@Tty*~42#-PJL|2=stjQf*7#P{6jru(1L!L2NmyR7$s z-IV$B>Gu+gw`74YUAG3sA9FqWbFQjvZjT@vS_3QkC)nlV-#K{w(x2FIB80wonbBYT zk(#vg^uNvh`*nfl2qwG<{ykTLS-5_G;`AqOp@J=mHL!mJp*MH(-&BOsvcv@XBDn4b zc0hN;t@nO_Y0zOF^WTI2Nit=G2l@A?P#*M$n3et{`X5*eDmB(%di|c;{E)cR59Jd~ zAxIeirFD+8~z<}i)KT7|1ZmE3Hk@I?{a3tPW`!Rhr+1_zcYC- zlneZGz0RksE(2;D>c1rpRV~MH);}R|Fo6Aw0namnFX5s_5&l2W_#89GuBw*-UxkFv zC!sD%k)(6yZ>{_!bXV_tLL-*r_FD&6&FHq@quvrtiAAL!{w>SuC>_|6FLPbVRY>4 zg@m5{*zNdmeBTR2dYrFL|4;-!?LE#j$X6%iHI%;(8lIJ&Q*mxM-#Kh4d1%Gfnax9m z-R2l^0BKJL9tuz!NzudBtQv8GQ75t~#ebjCW-5*56fwN`b!C3(fGI;_>0kvslI)~)z3K3^gjP#Y0( z8tprst&oX$Px2v<@C%qOoMWoJ#rGM`zy)1L2(>j`O%Q1851!nL|E2sy^a5XEBsKNA zCc2Y0uC)Ulv?E>cT_neaK71Du0l=Z~TYMVETCbgmfS*7VtVG5l0XTgb2QN@esh~^( zZw{!hyG}%6SI!InO%xScy3FO7cT$3LQKC+SK5uJT_`7)8MXpIv>X3DcGM0YL$Na@0 z5fPad+xUtb3|g{;MxV&AUkSvz-B}^FV=-#1SAM8)j2iRTb~=~n^f!5Rl8;aq;y5TV z9!?Vr@WEo@0l_AHMNVr1rdtjy|5m8*jud7*PPE{e74eOwSj{cUQC=THM1fu{A4@CI z*V*#!*hyW;2BBZ&zOPMVuAR9^f1;6-a?4)@Yh@fa8o1TUp-Z5)w7mH@Q!0A|Rl45J zjp<}^e~Kw1-L!D;--$gofRfV2pbobX1tm0(SVROtx%LadqLEa5K2WeTAD=1^bC_9? zq`j_r5TLP?%>;ts0Qdm$UTmyPF|wqb3usSp?>q2!$(oe`Tyqv|?FPhUbwYrgXs%^J z{k&cX@Eie2PX3f3&MWV{W%_aPBaky|Ysz@GXw|D0f$0{gH-Gu8OkY=jKk5K8bXa)T5+*~uXigTCNto8r6 z?XPDdLjS+{1jPT`2Q40U{_&x;3-oS-npLqN%{q9-wvzm{oa~CB`NiT3H}C%sA@lUV literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/intune-generalinfo.png b/windows/keep-secure/images/intune-generalinfo.png new file mode 100644 index 0000000000000000000000000000000000000000..c740cad9139202a07df709804270bc684800ece4 GIT binary patch literal 17398 zcmeIacUaTe*Ds1XjtB~wv4FJ5SP-RHkWc~{gNi6cMFc5EKq*o}2py7GD5D4&D;AM~Nhm5D-EVNJw(Oah%_|=iGDeeb4*8&pr1!&-nwglkD%_Yp=b^ zXRW<EF;3!KHd z%a0lPJMHf6Y&*34P6C#+)ttBoyiIUPIxTX7y0Bz@n8#9&FkY-tuE%`qO8aBxiOC`K5K6OK8_I;*yyls}`1>I@x;-6U$3 zG0BmN1RNK(>@@c%vqO)(@=!KE8&49(tBOgS2GXhT3u#L;^Q+=Eu9tMrt#sR53w{`w z)uAWD%Xs+I)7h&7Ia=~Dzb{<)I^Gsyc(V06RY&Xb53BObrtBa@c=W56Aq~m^jBYD3FKeq_ z-W_50*q$4b^@$owngoqrEK-%cU#8#+hYQrcQG?JNq!s%0OL4}H z2O#%hl2dvYX8EfcmNhlVf{C)EgDb38^C{rvH+7G>pEAmb=RO0=O~`JJdo3;)c!%~_ z*Irb+vsTC4=wywS#YOZxOHHHJ*w}8(kA^8dT7Oh){0U}wtS8(=0eiS?(rfV=or8pXTybwj>xg$R>LZ(dV$2hoUb}ZXA}qB+jG`z>VOM54&R9L= zzmK~RAL5jhTK9N>?Yb|b5M?HjIjVwoQM>odL zF^~7Fch*k3@SyY{f`qgl6AZFrqOHMdLhrkoYURD}52tihMj@?Uw!2S$AJbWr6`sc3ROQ@y#*i6_cX=g#4HsSDIy2 zWIq_s2uKs}FYsE9EAwFF

Nn_zW?j#;+rdD?2f<0a7%*5W4|QQ%NgI?^+%dwFbGS z9T2|B9~odhu9`cIWE{HBd=Z)EleG&C=;!hydrnSw2te>{eEg>2ixJjeL96Tce>61X zB(2Qcs8Blj#`I>_=!9VHFei7TTABrO_2r7HOQ8>uTuYUmRXiH|3!2r%+6`6<`x#HU zw}yhkg%3TA(%|K?Dk8h?^AC4SdPHi`*Vur;mg7U>XW@Zi7Df;{@poQUu)vY2D zU)5eC*hp*gLe6#iTQ7gE14InjQz@7pW#;tkx_(eQl~vi^DXwgZQQ1^_E&3{f6#NT) zws&;(@-nyUL6FfMa5j;_py-xXA%`L}m2*x}%;$QrFD-}a%g{Q)z*i+73p@p8C$#Z6 z>)%xdxYg|iO8cGGLz=AyO)uVmeto{yQ*0d*V8p~6#i&XM4veM!;7KhVZv2b!j{<&x zuwbX%LTS!`ZJrprNi=xu;yyQie$3OmxgJZbV<_(}KJLonMb)mBYDR2O`OXb}lHjiX zkEA4JzF!@RZgbuLuCG^<9y}z7q@#4UtqwG1!7_XNaDaj*cAaL8nlZ%(k+9jd-ZBEo zAK#IN30=y>IvNp?QdPwY3U5ecKOoMxR_i4drR4##)lhiYk!4Cxv~D?{SL9j$I=wr& zLEXpCN+qBzkT9g8TDo@5cO-|mtNEA}TEC-~cqr>p+y#7q_o_85T%J_EB zliZcqvo68@ZETx(XDk%VLkmqZXb@b;Zq9s-^?g2R7hgq3SS8Cf$V37rrN+-492v@U z2q>{%=+o?_G_4Owd6x3(=D@oHFQ7}uiD)drIyvR){E+)M>%t~y(&gG0oVaO_yD{52 z-dN3jHzx=Rv8{tS(^)sE3ER!BSp@T9Jd10QNcuY3_!V;xS~mAw+}KD;X`VoNVPpt{ z!~x-G&o~-30tkYKNh#h!DBf+du8v}m;BPaPY7m!V!EV6@y%T2&9P3Oxp-@+f?uiR_nq)4n@WSzM9#dQdL;W0hs>(e9iciu*d+`K(<` zP~XL+=Pfgpe`vLL8}3a>LcT0f(VT8IBYXdJ{D!ne_RV+3-;BUvY<2Zhm1C=eLNpe`EqqHO(~+N-4?IL=#8{+ zq1-!`pc0sL2z^FqxVD&a?I1WI|5vzk(}B!IQxQZBe&3cw?VJCztIom+zj=;q!10GR0kvYBMbux5hNf4y^&R%g0KM!vF^>=`79W9zQe2*NEE%3Me zhY{L;i}AW_6eUe`v6UPH?L_q3D2D7hw@|gx?n(*=0qFKE76h-m4c`MaUppn9E_(u! z!{?bzx(`bBB(4UU;-iX_dzAnjt?<_Rm;b!3UqNu+J=>}Jz_`~WVTy#e=D)yK0d350 zi9TBrPXixcDo`Z2t<~KOGzazId(IzGltXmEEzoTj(En>!3)`63w#C6tT;Q=&Dkler6%$S&`il{!&o=H1}%U(>TmwoqcddF}mKg0fTAir(IKBbwNI>791ul zreG#b$%ngIYlyQWEH}Unc*2bEPih1#yvfulF_c*I-*-U>0{pPW% znvVToerqxM948z;#i`(e+}G8x!Fw!z`pX-q?dJSf=c)>oWGj~``$-Ojc;%YbaO^j3 zunX~T_8s&i^5Ih;bv)gEt8T>Z4fz`g%2a*X-Dlr^c9F9|8_uF9Zbe#CDhyLW8uYl` zFHPCRKF3G8i&J1bw)zdf*!;f-dV^Kuo_P0KB_RbgyslXUKBSQe7#TBvkrJ{!?+apj z3moyVE4gRWbz_tk+$p8;xo$*R)Agu=@MM@=id7_Ki>molh1mjbWYD*tA0N_Pg=8|t)zbp5(3|rtq#eej; zTY&94zLh>}l1jnEv)4#Y|MPSD1$7y%f zf%WHZ?nk6xD70N^R$SwkY--l9{j(?*apbKD>3Z#00X^;cO!HAK-Z@q$v}@5=yPanB z5htaXGDx1Tjd}}BhqMdWbDZ^L+p}PIA!6bTV=6P}l!8Kc+mgYr@YstrT5!gbiev5{ zS{Q-v+>Fe4KH-WwvG3dlEDe6`C3x$?41Z5KHd$-+^W!z%mg}y0;x6|2>1fzKv1Ywh z->Je%ITkZUk9jp>cBh11Ainru+bxP^a#Hk}Cwkp;*GZ&Wbv)W?C704Kgj8<2dD3nw zekC?|pHR0e=#`}m>RD4fYyDH2=A_l3MPg)#J35SAKQPJR2EO8<&myQXvi^{oJ?#dy zMx`jd+oY6uMjxw`^ay1sfzpJcHwUV$U`}XB3DLHZ_9<${X0J!zSk*($9R{0oAxvg< zMeA1FxPpQiWO`^oKXIWE2wL+m#zdz!yw2pTSN;_Eiy5e0A6xPSTDaX%c`-QF^XqT?xM`wf$uW7l#efisa9XHCBO zWK@#^k;Q!hQzjmF^ltiqrgSndR%NiV?~>avl@@W+^Y2&a26CB2?tR-9lJIvD6lRi zgsvw*iGa$(=&fU@CdIUoNgtg1<^k4b<<`^DPJ?A?{?LxMxv=zc{#<@N4$}~8xkxA)O;`RF!)>=1VN4abJ|rHA#dL7{ z{I>0NBzxI^jc4^mT1Ap~6_$5X?GQM1M6Ar=L;3OB5`4W8S1ZG2;*Pp=hsF3Na3!4mCI{ zPR5SKDLO1FH-1@j)*v)x?N}wu=(BrjPouV43IECdhaLQW*?#*OTX%(;)u#(*(KDy~ z%1Ad31UzrKYNT0WVFmG}mwY>)yGcM(=KHoUcl(}X!1~k#YM3eg8Z=B~O8NZBGClf* zA65(1pz;&?%d>!@lIU6R?%Tp6x%cBpc;@y+y-;A^oI|N&xJfMvPj5nNXFJ-_E8}Md zRNHadj^)7LB5a@GTWZ5Mp*q`k@%q?^#_r;7(IGXM&Aj#1E{|~|j=uPGf$#z91NC<= z@ZZu`ss@KiKBfT3YH<0Ze-1?%CS{)%G~;K<;}+QCbPV&U*oiE@%2Njm3=@0$6?Od& zcMqlvyqA0$TFj(1%BsWW)+k(a_2+{`wz!2fv6In;hx$uR;sr=H<>Cktx11_0Sm{*D zp)AED^~9e2J+Nt)WCB^DOXC7aa z2!K8kY00nw7J|WQLE#VQ>yX@|{%Il#AckepIav{TsS^q3MJc^LV6rttM>_xXooA?Z zVw6NRQkX38DexGHclien561>PRekJ?@G;k2yz(8LT*E8?pv?wB!JJe~i~K54P3fud zw0=~R)KmR~-t(#i{kMDsM!OlYA&(!mug3wAmv>{v*(N}`{LN*Q`XOB3KvnEKRAJm( z{?*ehBxKIz2M{kwIX&zAFHr7!<{v8BT{iy%%EPxL{e#~?xWOcHHP1 z0MA@91VWn$bDJsgNRIS4xt_F5D2F+2%77JG5&?0s#HGHDSe6RPrr*9uA5EW>f14{0 zf|l68w_>B@LfJSoXXVTnp6Df?S*cu2`lJkWfu^EDi~zqvic{>mqr1pvUtOAePyBi@ zdXiYbJq|r$JM_zU2E-V__qfhObt6_zhWfYPTP~@+@;dnbc;fhY)T(O5yzjg6&C_(t z-?~+R74|dBS=nsqx8}BJg!K3u&uPdkZ260=5P{TTprN*k7<$rQ98Spu*Iyh|Ombp*>l|!3i%N2zI;FdK3XC7|@&FrM1tu`0{sJ$sQ6Vgcu)nafAcV+et&_YF+5v=M zGJG(%+it^`!y(_p!rIHGo8aWd**B7rw&;T8fG-~HlnaSHtx+Dji&Y7hx|OLZH4xty z27qk2M!&JC&3%8_$0B-r(}lct2bN#aX*u}x+|3w{mViXl_~h3@zAS8$(o?_~bXy8YB%BejFz+1j+7~rZ- zuTw=H)?5`f%W3S*>Dg?+a7AS#^=Kt4i>p&aZ0m(eq)}qjGX?V|$sI&d6I-_G86~-= zBE1_F_FYFj_cBD$T_B6ZT8qziZ9reSVUVAC zH*2JXL6SaTE!R<{oSHACeq`-6lb1ITVl7kpm(W8O6`w_V7-|wSLw;!BD;+p%+_O+J zT{;0e+bfGag*~MKXR3?N{-KrLmGZ$NvGuk2N-q6vt1KsT!7$JuV}>4={>3Ez;IoCt zKMYepU`bSTBbY(2$DyPP|4*9T#S{SH<#3<9bB8oA$6jipGqwfP{r=M_cNGw7@6&^H2DDus;O0Q0}I1-UDc z2}vl0+z3QS_g+nSnt9VpDhd*rWBU)UtI{&@wc?lC8}Lr=!P+aPaT_lyrZF6tQ5+(p z^*}57lk^-yBYL+sesa~NQ$XbRone`40`?h{It1z7T{AhFL)!c({8Ib%18IgSgIY|V zKTql!JnUdS=W6-+{+=4C$NuJeU!2{AUKs?eO2Jh;aofEKucxB{ zQFwLhA8O674G;p9I}LY+KkhuT2g!P!vBpzd!*{9Vrt5|ax3nrJ$}5eN+b_Q&7j7}# zgw{0?T9R%hyhuAbM)ZufAgZLsdZKkJ^WWIdqM@n^)qngmtiIdjn%3f^qgW4s`dM5; zs@uAk8H$9+7nUu)@PL<=!YUx^4?;^$@~uo0yZaxC9s=$ZAbTRTGLw$Bn!5;TKLwTbJafYRBn=3C~b{H>`g3;(-B9G zigNAu%67mOc3?a_8eJ8(|04uGN}GpD&lvAK8`FU>Pa_zvecC9~!%pa_teQQbYa-F& zARnIkQ0-HVS}P4O52x->+=v~snZ!<{{h&rmfA zPv0BUV7Z^@)7=o_nB=7}C=c`v`~fqpoD2Xf|00k%>l3IxK-OWY2IsuZtR^p_E-?R! zd!)! z8cKNvdLjDVB2@Lr>%H-t;dss+3R@($;0e@!^1T$awrWroZcyc{o=duINv{dtKp817 z)!L12(!axe>ml_TA*eP-^$WJip;bnr|2lx1n{+FsN};2UFsJLKZRnr;D9ZdOn_WQn|yRJ}*6>g{0|5C}pF>W&y1g5_KO<|8Nd) z0^deaQgCbi89w#RuS~_q+*5nCw-NY;oAyNj#W-i#jCjkQfQDlgZ$xT-+{D#WOX@i; zi5w!?XY$asli!W>XTF z4{v!x(tH(f*mzyZ)X59M4PM*~ZzxE83$1od>}i%Rq)i9y{X6M*Z2E0SW zfZ3lD6mLsJ*!@6&0C3Ew*L}u0{>z2LzrpQ`BN4~C_5VpUk6oXnrIp~O0(bqZ)Bh|4 z`JYI@Xq;jbi49Y~?@D9br7;9dk(4d+8+Gq?rpmGDz$H&#WgwL!kpzz~bGJ>t(d zOT@2(4g)zc#XO)#%p1AisM!kNr2mH;oqBL|;hPw+8wqiKCl~C)XTHPrZJ;A$0v#-xBd``Tw34rQ_uzdMBJuw$w9{TxH%*6}- zY_!fzx%^$@>B{N2s;K>*4*J}xN_}_EdhPoabRpI`t9ayvO~5aHHVXNw1TXUYoZLM@tG_tB}X@pwzwAlP~TP{>Pe~FLihu-A!k`HM3QT zZKgAzDy6DPJ?bXCQPzT7BBR>o1(6|VM#A_0AUH+U7P$elrr$NZd8Bo~Tz}8N6|fS4 zM(Z`dB6c2`UWvIlMzr|rJ92f)L6z>6XN9a1%N(@T<%a~Pj(k7uDEgkq4l4%6Jf^#7 z@*STWZTW#W{>RTmfV7je8MoLVBnzVHW4KvYnU38(RS}0gpCg>Z2^sVHs}*7tf#Cs# z7L|~tN#cfv29&bGwccm`$CaKaT)QG)98j*YSTqa-9Y6nrcjO`0-zLfS??W1+v_*p! z?EHU$QE#8?CeCX9pZa@hz^6$6w;kjFO7v3pr&g>OYxYPQ-zgTClz09bT1K2DB10*q zHElouB`)FQpg56PObLpYaC;<&BdsS*sRP3LJ%0;Li$H!58`1UZ$RERXlIyb45s~qa z{_OT}7py)(n@VcUVQv#2lY^l<93a4A@ePxD?Dt*nO6if5J1S!IFB-*c!Ne0lalPun zN`w}$=b|_J=ILrJ=X&c7(ZYF~sRb-~fOTGR3?g@If3G_u1!VEsUD07Px8K*@;<)Z2 zuyNw!{{XI3B|=TJ=8LbJmD<;$_GWZcu0FOwW1f@IMVv}UHahla1XKY^Q{Klo(Ncu9 zXZ-cf|E0ghc`EfLL!C8c+C&I?bc%wuoGd4iG0iUD_Ar@jDGNKxdI>V?yWn_XsM`kJ zk0{9@Q2Dj#-P>%uSJ=V9mb1jUQu{{8Z(X3_1C|imkxk`b+Ss5^opd8R#$a2+SuIUg z>{Z#6;#hN<2)w1amA-efs$%bmX<7t@Pp6|D>| ziH{*KRyrz62VxJWJU(Oi2l#T~$~{v~*q@xXcfT1AJJZ7z|5E;zaB;Ys`@xj+dGkoN z`iXn^2Fd)s(WZ&jJ#FmZx z!RT7#Mn+ynXNgwq<3ro4cQo^jIwrZI!TtHDhFZGb?fK{r+(q6!@vHn)8*M%28%wu4 zHIGHPn=uhUV(6RW6OQ-%*@jAq_N2 z$2&-}khs}HsJKucOtEKf#$`Hw6K|V1PoEWIVM@cFvldvP_QY3kulK14QsvNdTfukp zR0f|q;eNS@>b~!E-;o_DEp?|4a$%u*zmCjsHl#8KnWImjzcjx?eajq1rhIU&WW6Ag zInBN{Qz-gDuPiKdnQZ8T(3pJr_)~pymNR-eGwvXI(w$*QL}~RxDSRi^b5nLTdbtkU zPqPj!$j&j#uTNhCFjNQ0rklVf%j>Yu(CjGHD^Ar`e_96(8q1|#&+3q+{2;_Cx#ws} z`cd=|y4%;?XEp1B!4^7-8g*Tje-#WnN^;m)9uM?<%uc{)l<+)Ma3Hi4_2>cSuaRay z%qy*EbiOlLm6fr`i$@>YbaoRVKm8oeKy!@)&wZ_9*Ok#SR(N`yU?S3PgAlHTGcPn3 z@m>aH&lNuvmlQCve0QMAk{6r{9*z4Kr!ysJAM1v+r$L#l(piotj2(2gv+Gth@9;_A z7A#;%FPTqg4aw8*v-*iD%AXm;pN^{>*VN>ZOlFV9U1%HpFga2Agqd6N6*gUc;iY`vnukvgx1BzN-w z9(lX#%fH6|7s&nYp*Ac0d!pt4J>7p|>fztXOu17>NchI1^s%ut4Pq3 zS1Ujh|2~?Oq{ybC=WyIP5=V9}XJ=cA{i;RD92RPQOhG|a4!wZmI{>>VH0u0Fk9@C^ z`2SZz_TL4k<;)p`$O~7DO8{2ff#?FOye8THw>tb?A@aXKd>|K{?}ab_&cu03X>t!0 zC*{ctdz@JrMoZy)Ae@m6 zgvp$q6|^9pEJQSjJ#ZZ27>1W4E0tGzw|VVN41YrcKoWM7yLgN)xz#|H(qx~;C}3IZ zefph?h!zXkibQ-o%NNI$UWKv*7|v2uQ`2&XkOqO#p#qbXx|kqd*e@j6vRJiD8ZI9E zxv@^l6GCdp1JJD)Ts#IBi5Y`dcV>{+`O4|9CDoc;uCAKyYdu6mra?LTb zbJ=P+!jBOSMRYz`OY}&zO{kZO0yBdbpTp2!(7D#is{OK0yamq;Y_~^fh{0Enb3b^n znA0T6!1zxpC-<<{z4K+M73rHe z>P{UV#+FepxY;u1G7Oh8QC2l`9%8RU5W!PyI)Qh(T9j*uaWoLDg;DVH&u6Fi?;4fyq7@$wRee3ZKf(9 zgo33HB1v3@rc>5jqOsQ*nc)<`jF{>*O;oRWISMe%`uNjsCMqOQ!Zt|3M{^# z4l|n#mF;(e!L*eb9m132*4g-S`;QrJp$+bq3gh`7cR84nkby-WW?5b~$7r7(WisU4UOI_9|^N&p% zVHHZyzPEf|5Q8j=)T8MvDC~-5Z&iV)e>{Iitc{I+Msh45hB=}zg;*wM)B-q+&TNm4 zbRo;Y^~^@kq|>1THQV4$*r7nGjpgRrl$*yecEq^R=Hn&t4WG=3Oc=7HQ#L}S3Me* z{?aKnUW(NgMXS%*7cggAF6Rq{*)>NC|LvaDH zJCJP@H#e^u@A#>Xn>5QiMTfhmJjsRV63$`YMu?Mu7*@MACH{qRMh$E3etjvlwH7Av zr04Lf?9c`6A1sEu$6Q@xmPJvV*peE(Ui10v7V-2~$^2jF2{UoLrRSU!t5d^b>LYm- zTL6Pf_frfZukVtn8R8agWn=2r1u|UkuizW=??zJWv?qoMF{Rj#)uTUvf7^KEndHYnVGNMr}%~(`C<~VTN`K+F=xBaKX=swN+}g3c*UtLNI_-p8VamrSUq_G*gzEeGzm_hE|D(3lFGH-a5x zCH2vY#A(p<05aGIuh{ z@2k$Sznp^wIA*E+ejui`V4a-z*DT^LrRm^Y6s_{KW8rrHapDYob>>DmZd@Yuj54O>w{3(7(0XW@T! zpH5B=YhmTxa;%Z~T!Chd{~Z3k8-2Row}4&mJ9NHoKpj04=-4huHGRo(p>`3vHVJ<> z?bmD$HRYF+R3{GSH0&-FvwDQb#Y0a;*}}^ZJ^pfe_bdy0k%yxk>>YiG)~LZ#oHOzg zItP29t%x<0}*V@!x_VmVMM(Y@6SIS{n0OS zh7db(W#8W}T7#ZgjVC{_RlWc1&j7=Pd-J;Jb4Gn|K_^UE)ngO~9Ylra0cQ>{ny$nO3X$_ri@O!KxuEUSmy%Wxc^>4nr-NAo=?;mz}92(RVAObBI8cZ$ue4KP0mqK!ceP(|pItg#>|bU}bz}MtxHuf7GEho_ATM z)FIXvdS}v>#XE-(JdQJMX=$|1{Et@i5-SoheZ&rk#OGO0&DXcqrP7Qq(1oSIfw9xb za1HsT#DOgS35FE-|Ngn&HQT)wjZmTK1dy1EqS z@EDN86<@2QL&|rakdKWuHwT$L(h=xw^&Epg_M$9Zvg|ul1s1{O^kK1sE|>J`!TV{4}sho8Mq9tvnQL#{Dpj5OXh zfN`nW1QV8zi{5Biv7-ZaRAq5;ON_ZhR$-(z+y6vk4Vx}Q^EQusx$*=KZ2JOAYU$=Xgl-nw$|cq~XV_cLUWz-vKcz zep9_m??h;cDwQJS($Zy)gC6@0_d2cUThgoHQ#?!-$fB_>{#H;qd(J^O!k09PsXEp> zXN>#3{n-y#mrhRYi|WM&JH@d( zR1(oNVC5=u;Vk{z!n_h;^cC_@V%#PGf7|7s{ad)?*FeAO1GwY-_Zy*&(Emttv64m( zkH(3q9he$2KLt3!lUTNpXx}7A98by~gXB<#rQMQ#Yc4VZQ@j8{6u!ct%Aw|U|82xM%X@v`OT z=bVwJ(}!|kIW#h#ntkO&I8wey_*5YMydoEhzH|!xi&_Ha^UT)kC@lLRUXbg{zUfYr z(Jk`Dm49_HGH*nh3Ab6tr=O1)!emPoCMMT>J6oXnfWE*VN+I`R{CND>32@ZiuWRL- zuS6)?0(bHdmaAT!lfE9LWjEW#G7s>hLLQ-UT2Jz=${vG6^-6^J@Ui%`oi+0P+MAdk zWv7^iSYw&^e6LwcO@QRLz}@Gb3&OqlBei~(ReGyEtRB^BbBusv{U*qeis$5wIg#rp zDvI7o^@a6%RtNAG`#q)I@^_2MU%kGiQ}_IA7G-i&xfE;>t3Jy6L(SisQ2KopjB8aZ?x zhueZaM=~$an#~wF?Z4qhv8tpAWk&w!=vp>bbaewk5@YqL)}5v|9)#vHO+y=k#x1s{ z@vYdor;YMpW9z=4x6ZyxxEMs@pj5>f_|hRPt2jPFV68saKUgHqUCWpjKji4O<;fih zz&!`$?AjCU%wtaOZVt-T-nx)rRplw~@;=FE(i<%(?}YCL%|5Rv+spqAVZoD?0^Y zHOBy0&OEcKq$ZQzy5t+bt|T0_A~93JIAO9y_gbNb-&ibCK~7k3CVm<_QSZT z;d|P%3PK^0gcrtXXg?JnoDSO2D1#Uo3h{b6N}sUK%i;)XGw|GVVt#p@xshl9-yjix z>5IATyVFkh!HA2ZRfwmSU+;|o_doiTKLj4hQ9By=@!?kIx?m{Go%XQ1Lz(EzwHI6X zZ_R3pGw2n(9=wyf*r;d_Qc25Fn~KdvA*6GsO&9BC{RbU+=R0G~2C^H>sLks2QS}Qc z6=Tb&RhE$S_hF9XWvr^I&s?=Zeq$1(4x3x+rITw5IGp}%Viy6bmR?l7&e^LpDEk#l z(j!>I-HHhgt`Wc{b4AiSk~B#%)G7ebnP@FT_e zl$Ho}WXPGaH~kl9X&=jvH<>FuTZkMB!LxL$?+;twDGwk*jjMp`yPm93=^({NiZ62= zB8D3=hl3Ekm#rWv;i{D$G>9v1RQ3SP4vHV8dpDwWONUy0Tce&x!e`g<>fQ*CxFDJ& zJuxTl-2{w%2`FxOV8X!g^#a_|@X5sLecCzI4aZz+!cNLgJCXCYMvgrxzWC>rjz?v$h&it=Yn04R%DdaU70gZf~CcB?ODc31U)9nAQ}pmL}ivd z!Si$ROba|Ss?|)jZQ5E}lt;;D=M5{r5~}Y&KY(l6YoWySFRhlfx+H2F%SV3@Hfsm%bUH+T`hj@eedtYLoucIT2!s%6V zxY_IzX9250?@e^%CNHm#{A&H71#_?}@}czb#Bp-6ueY>WOAQ_46FMSfuV6H&PB?WC z$C1GmMoaK$lST63f@Vp$Rer`RSagg3o9s6WB1a5RenRPC`!DRr_4DcZMIH2g`h)EqU6co7G{dY=kfeW~nThoUA%YI7 zChaK1(y~~5 Date: Tue, 7 Jun 2016 09:54:59 -0700 Subject: [PATCH 03/69] Added new file for AppLocker Policy Files --- .../images/intune-add-applocker-xml-file.png | Bin 0 -> 31661 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/keep-secure/images/intune-add-applocker-xml-file.png diff --git a/windows/keep-secure/images/intune-add-applocker-xml-file.png b/windows/keep-secure/images/intune-add-applocker-xml-file.png new file mode 100644 index 0000000000000000000000000000000000000000..8829c070a628e29e7bff89320e69be1352010fe5 GIT binary patch literal 31661 zcmdSBdsLFy+dtei)3+(7Y^H-XsnpDrl?qyUJ}^zwNlPm;O;N_k98)nxRFuOUGN&x5 zJYb%fGIT7@Cj=EHO-WIi!2%VKQACCiNKp_Fc(LaDJkRg;)=9Z5_F9omsi#c-U z$f{M1c#GwzHRj*zuAjVwShZ^7?<;>FT;tqYXKvh{ax63@DDi4aT2ylMs_Rj)@Dw0C zI%U^kpcBv|{tz}`)v8SUQ{NuBkRB;FWHxw@9RZ}L-jFvK=st~JCOLR#BQAb$w&By< zP-V^B_lnto(Z4p-KmX3@!__{;IrrlGk}Xbof3!{Tjn$^ryLZpsbNb~(IOc9b{|DR2 zjfW4y#>y|r1Hb?1r|%NJR4qKayUlX>n(WFUS>a8FL{mLJj<@Ok=p+4qEGlR%Hy>!rgo^^M4fdc<){5 z?#B8V(#=7KiMm1FlqJZm2?u+z`E7zf#i0*||xY>$Kmf_{0 zz*N>5I_rR`=_{I>RlFB#vlfDCxu+7! zR6A&23*Uwij!FXj;?RnJ@yr8cyoA<=OIrM7uCH;s4@MlU*Z6kH7scU9 z8(ZrbBDV#N_(PjHQwF-wUqA3a;Xe62F;wIi511o6_c0rcRI~d_K%MNcoV$<>=pMjMEQd8Y8G()u%BiVn&^7 zVd#Z{pU(1#T8x9Oa9f+x2?WWZkh%ncn1V^MAv4>y{^V5EiymGM3$07zb1rGnR6wg? zVn~vzO|Fa6ySacH_mP+vC8#6UB;PnDIfM-1tajP#+_w#SmI*TE zLBGzq?DFv1r^UL1XbT?iYSWzy9Oq#7qt~DfaZIi)59AbGiGTgNzAONp@RIt?s~8;g z@{ut>AS5->s{oaYxa2jnTkM>}Eu8y8@Z4tk#C)P2&iI2=Wqa32K}<2enriocC8Z<+B|5`Fv6BU-a>T6;|E7569i4D@3pM!iX1}| z$gt>q2J?ufRqri)hP_X_MpF}oAY?0}&?dV&nVJHw8c77#cs)slR5gJsqaq6CUPNnh zxJF~3)v&KPHIB*JS}x0fWVEia^V#cfF=I?#RQ>goQZ#&fF=7#fI>6GX?z1K*U?H_> zCk^SZ7$CDq%x~IE3rbL3$HhkINevfYPzRSUe|9i<%M{^nhhx%e%n_PGJ#f04^S?h4?V%qH~gz+&Z&wohlCfI|i}9V;T!b7rah-y&lmxm=;A55`bi zIR0UdL2LHiH3H zxl)yKjv5eKs}wHG$9jZiMnVh1?Q08GkH%yu>Ig{Lvw}a0#v7kG(ia-5Z$$T`i@^QhMA(Oa*H?}fTWwqAL<4ICNEsMB9yQ4#IZKMi6Sq0wIEi%oU)OHsQ1G-B@LyRqM zS%QldOuS`&)A};D&gqaLuJhd%8~#J9 zcuU}z=2Nk;8)WA~l{hMRq^pleEK@`Ip@hC`1v^pT zH>!6H+1`Hkt5!AS|Np1y!U$W(Ciq;! zEN2CxzgN8q3XDb>Hy4P*_S}&?OydyqcAkheud?vk`7qq{LpwK6#+X|gY0(Ti6C!nk z`cxKXIi{Rf_$tN~5Ljr5_t77sw|5A={bWbp)5K+e?QVd!F;U^FUch4xqn54Q02a>h%gsuDr(w)8 zVZu207IN{RB(hmBqi%$E^b+?dv4Y?*%g;$$SFH+tdM>usZX0U>8@Ve7dO7dl4#M56 z!};9k`iD!=ZjMj?V^V_H*fJf-C7)UM!_9g3{849&v}Wss!g!l|!&{#lqb>{zv)oB) zEn}v2#i}aPA~tGPt@>+$9~&z-8)gvkQf%2id@~6-8TU<;jna<($AQ|lL)H15vrFX} zZ_boJZ53n{v&1dh#3r#ifM9QLdMSJTs^6vKeGj6K@C!JTxRP<<1TLbrr7nGF z$*#8-*Bct^^L@bM7UO(2S<=(?wo6()B+d@!a%e4AdGfwyTKfUBb686C0@d!0ND^Ro z3->tQ5!5$|5Ob_sRsOPh?!qw_pelgg;ySQDpJNH7J+sf8BnEa#BYG-oFZjtWT916b zLh>rbKEG$)HKpIgVz>$`4(;ngaGPRa_N~SDry~zD=EqFca}E50J?)WU%+;Q`Nf!!d z!(!!yw_w%rb~SDoTKea!Ru!KQBcXD;R^|#KM<*-`n})a1pX^fC`}=;B4m33TfM1?~(5?lSzsvk;Ln2~?ctcv!Nf{Wja>;KXu z@m;z5>xTdS?tjza|Guf(%ds{QH&Z4c;szs~kuzz+c!I z9p}un`hk@DwB;t)3Tup+B7OjF)o&T$`j_AB6JbPU18KMO&z@(|2q_pxfzW--_ zbuE=7U>9*)@AVD`T+&$6cYV+>k>PCm$b*Lo2n`_f&1OOgu$DJxCsRC#2iYLx#-n%t zS!Q2CN*2=EpIZ7Ks|{#siCmOCH-iJI=aeXfz(G@%Af5Fsoc|!ern#M!)A&d`{qfo z?adP<&2Nu;d9nQBmR~O}PbG&c;8~5NXx-Fujp+yXNoW=mL#-Bo#DS#=_%}%&;LOVi z)azeuBYa;%wN^tz$QxSkZp5Pk9u_B0QR!aHOzm2mu*Fxj(bG9i%t|H`K-LMr3!YNr>xK%G!n@*m5Z)!Jw&^o7UEPx3hJB zpEHqCm%iB6ymYiSJ>una&}Gdub4iYk@>YQS*4kfPn-oY(0b+>OJ$mW3zD<6SIUtzW zYVkUK`I9@MQ5;anP%z&Ns-lQ+y=oy9oHipjil^?8I+D+mkV<~ngoN=ZhZ$VQ$BKQP zwha3V;}FV@qX0b&Sc_nl6;C1pVo7CdL&7Q)KP|kNnXNHBXq-LzBspoKPVxufmo!Wg z-4S8c_!>UxZ`!@THtjp9N75&fVaGdXnu)PtBL5K$IM_aRTg#JX;)_IN{7BwX99 zxClpDwsv5#S?$IU?ZB~^HM?+$C z)D$nl@>lvGuR*DfoiIEUM43ndbnB*)20_F9R-FqLy6f<=MD7l5h<+ZBr-1IiWA@&s zLbG^19(h1$`C4(4*u6(5@~vbt9&u-UhtD`6YgC3>;)h*R)`5jXnmGQ|)S7H9%eG`} zqFD8a7wHDoGdX?tKwi0S`y|rVdQ3txeZ{*9an0`c2+ci&se9!Zj&8fr7>K#ZDbJCd zKy@4{4V2nWCBhPB0WLPh?XJ!goZX}@c3=$dHDeLBZHQmn5f{dV=eMd z`U3tn!UGK(u0(Q6tHiQYe2Cg^6r5HC4*w}$EAUh`#xR^epILA~8N?L}NbOQnqp}P( z=aK}kpD-G+kx9m_GHc;ltw_qh0s9nCKYYY#@Tl&gS2?I_!MfTfgm+w*?h3utaGH-_ z?&2wf(yzTS1kCz;CA$kbCkO<=nq7vo>j39R0J#+lAJ#7?Z}a7|En-7m z>kjb)!0tV2D!~$PIVpIu$G*nR@VgTHmkjWd7efX-UIbZ@Qa(Yzh9r+o_kfyKE|{PQ z@l@{;UpcXS95E*O)=#urIhyg1-T(jv)BH6&4!b#-(`v9yictUU$F??G*n zc$5&QtWPmQ4w&`tEccT2vv{LUGNt=D#rV@a`V1=@t5D7LHk$bj4H1Wi*b>KuDZ@-I zNiAunL9V}EuBb=_81;VJ6=?OVTatDe6OQkd^s{JWi%R zUYHxFY$oTyRh~S{fkj83z@F07di&viC-s}CeT6bc`z&UAUx97Tc&U5~ql#a(0I}z~ z3`c?61lSwMjZ8-#mIi25f$F@#8iuIQmhjiqV;siQ>PRRYjk#Quy+BDaWr!OC6S-}T zV5rp?_PA8mq1vlRbjC}aYXv|gFL1^+-mWh3+F;1TlAjk+sX~#nf3Da`D8(}5fi|M0 z;-w1|%jz!4#ZL9;jikhi7WVK_hgx!l>7Ip>TW#@eM%2fE)SjJaLi*fqn6C=}M(NrF z({3&a3Ir@&=D=;t+D31w`o_ zo+{S#9Rvr8Ge)9&tU17M#`rfezc5-yi3=2phhvsAN&hJu-{^g@e@&W_B2^(1OT(q5 zDG#ErA;80D450+ZV}Gi#ECtYZ4G|j7c;)*QGhj%$BB}wdiYw*ypT`l5+J>QVZ8#j{ z6UgS3UC9*7x(y44azB=6pI5fUYsrHIr44T&sq31z6w!fs_)u1j8Y`*Tw?oO#bbKuj ziH5QnOeBfn;?-y01}G1d9EyON^^Uc84nU}-12kWWWP2n?I~+8XXUp078N*d^>%6dSu&x$d=$Q`Lz_ku#_d4+Acy& zHs&yy0uMBHo8)`lc7ndRj(owF>=sxc!qnXKI2#swBDU+{LJwITwS`!sdra2+=yDPe z$lcs)IXd^4QlA+yKWP=2hrI`~iPKRb+UPxiw0m$n3|w*4XT9iSVspg=u4H5+V)EFS(SbgWGKilYU)D+~cQ=w;BuB{;@!$ujy4>9q;>Wxin~~&9 zDeA$5;wu>lYNZIlFLGWr7KhW&z_N;2_tWkFE33Y>KAK>9wl^1=LCco}WI&j(&MSHW zWG|0D)O(Rqn=&yX{waBESA3c@MydXBO7$fQn##;&k$8TL3&HVK))Kx^aoU>jom~C% z{PIqGpvPLhPSje)y(Mz0HgktA);<_M)`?kk)g@Iie%s>56Q|A!GP*0M6-jMU^tAtlkHQk1GzA@<&-bp;HNQiambth9P zfrV!n1lBpw@X&OlqU}B_csY-HKBI0%@-;0`&^b7SOg25$Mx^?Fr1iKzG&13>W?oe} z&mw40!}jh2OnH_#6}EH6NnommeWr+!L|?`c=RH6LtVI}raewIfjdbj*D>9ZkDWh%# z^{}MkErg<22+gLPR1(zX0M4h}OXXgZ*izm?YE_fryaz!_35DBZfZ$3|XVxMK_M449 zz^%=Ia0`gQ;nHcLu4NU;%bB;ih5G#5`tT6vo7a8TnMyIx+EMJ;a-o#+Ib6aZoAP*b z1ZwS-vM5~BVj|I>+ZD9qgs+v>w^G7><=QP0V=s`qw$6Bz@fzZ(!%pvYW&wg&Zsji_ zK~8MvzOufeI@fuXtbmuRl=hQYbb=G|j-Hzf3(!<;>AUCS7VowZrqq79t*`4Y+t15S z=4n`~E?WN30X@ngTFi5206MWqx)!UQw2lU}Z)PXlG@VbzI{TOV_k}4$3$6no`>ut> zNpRSG1%r=Xr|A6Cx2$FqtvuB2dSXe{g3E4kuVV>eAiaYz zWh`J-u@a*7g?H*JtwX@M^PyRKk-BdYj~7dxzfF$@&#Tf(uJBta0LfKdC_z^0jTNNp zqIIUv(i4a`CAX81tPS`xHYRqkq-VlCZ>~UfF?ToA6`Iy27?_{z3Zl`QJRH$q7JzU$U`b^b z>@(9bVdK_sNsHyOVPOw$?+wjJFoO4{Sy~7F&{C_dYgtW>S_()elU&fFS(eOa#=8<^ zmZd1ARc!DiEt-QOX0NKcVqfhX?r@~hC!-TEFzfWkveihl5u9y9EIH75>6A^R8-M@p z*bI6)e94WD>0^vEYTa%z_n8Aqzn?!Uq;{~2tzLKTOU12jvk7;o7$e@;uqQcWONT!8 z1Dh=!OV|!Y@v1_gre|{6n2eFTS{5^onSOr?=ev zqSzSwwu${Y6Hy4~8FT~A2Ls=Q5kL1FjVR#I7UZ}8x)-`Sk={}$gG7c&ZpS*b8okqZ zyz@)1{e3GfC`=aJ0BU-4MIC+Jp+H~=z0d((8-R6@E2`F{c#D)vL>DI1q=~GQd_`@xD*_Q&t+$T_t(m9SawX_rD`5o`(DuyW&U5I(Hb$h zGv)z8Gb;Be27D&45g_x1rMyAFkUGQh1|bBAs5E zt(crDigY1}`GK=nj};NIKH^?C8-y=c&qn!a;;e({caxzimhKiT*h5WPHaxJEV9Wf6 ztH)*P$h;jA;NR+mP+)oB5l?&&*+0scHQbjJt@qYqSxDu`6&tDcJiH@y*|Sx3y@;F= zAu`;8wFj41yjHF%kY_Ej=-|G_1r@gNPLv)(ogGZe!Gfn`^Qf{6oLC}o&rR_iLD*r? ze3On+Xj_rIalmkryYoS=Ptaf@1Xx}#&Cp5a8+)B4DrZGn+HeA62Xu2Efb%f7i?0+Q zc=GJUNEgtNjGCvCb53TzP;xwV@BymSvv7>IjY)vr*2JltTERhxF+2|9ivdOK8AOG8 z`(*zl6?KAV=G*(k&CZoKwZ2SFnL@QdBQc!7&|#`_jWkXV11Kd3D!INNktgZTcj{B5 zXD3YSttI5nh+Mleo`7<2FbI7r-N1%*eDBkdlz2t}T#y{oQ64Hrx;4BF8)PBxP$tdz z)1P!Zoh5IsXP>u~@7GjImEc&iKKj>in&}=N^ZQpy;=&i7-@w5_!)dx7cX0CV?8dOv zRtgfoKKbXB>Cjn`(+J8>pcJvj>>cGBv_X4#wCyojKgj+E6MiY%o@=Osbm z%Ii|JJ;1FLq||W z-WLmCVEd9P>?a+Kma;b&gKOM;uu-LBkWVB*vDOHBS$m?GvV-i5?AXHbg43aC)G`6H z+xLoO__s{rURIWzr0hzuMlcfH`s8g?=RK+ty7~=lJ8?bCA4)KLo4le-+!G~ZJo7p_ z!8z>^8(9dmWMw4~c_cwZO!K9h zXf)6!&eiHj^0K~TgnM(>omOioSZz$DDy7uQ8B!|t1?A-@3`a~IpU_Y@U%Ih7*|13k zBf>K^<3~Ivs!`hsfI8tJ#3dR5_#k0uz07PGJwpUWEB$7IBcs!+zH+AW!oz3gkb!ZU zEtywE+mB(fbxPKsNZ-WD8{8M7;Br`0#~d7$nRX{HDNR*Ags@IKIJ0J3tzEoZxhRNi zVL&J1Gsc-){n=*lcD5z+&llOex09t+P$2fV0sv?7 zXBTf@&GVq#TIP%FP|t~lZkxf{DoC4?l=#Kib#A)l1kXktw1g?djoY$h}~ z*Fc+JOwzhYUYR3U=y5B_9_x~~EO)CY`jqPks+1ZrkjuOn+EzjqP(pZI$o6ngW3?)2 ze(6kUcG3j!_98=T&#>ayv_)XAo*qij^5NcpPPF%l3Kg)kw6;?2X%BKw#z5nVxluy5 zYtv%<=C-lBj+YX*a5me5$oI_x4K@>1M8?sSgQZ^LPLdvy2~YItQMHOZQNWPCVt5)n zazM__?MaR1N#-@jAu+{RgNWkgQXbGWJik=M_#S85ta_9KcvW2e1h36Gt%T z0C%fwooXw?6WQUE7Mai3e?{&=dC>qT6{O~Kwo)y#=6(hl&Tb%Uz+2SdOmlncPa zJjzqbqM##4l5C^utq_D1UEIh^7n#g7KPo)2;xT|jlo5ZwSUXjN|i{Uw^ zn}UpHF}E~G&zzA2^`_cPc5PCB*;z-dl3U%n(k1l{5C97#k)dro`WnQiS&dJWBk#DC zmGD~Kv9m|b#F``dDwUO4z=%7fh714Zm%LDUf4)`RnX5y-kgyl?Vff04%_F?+pQu7? z8Ss+HxdG<`nlH^x1a^e+s}OGB@0U0VB;yG45c2kba%MqeCGRd(zEyR;MB`InDDzT2 zcA9ADa+>Ly`%313$9dKnqH+r^j-Lw)IqAFQr?<~HfiLJS2bX)mXhoLg?{ht0npA%+9F1Nc z8J+$xWi(Pl-+9Kj(+)h?Ay(xuUJ+xm^hx?m!1Y72F_Y6E=$kR`Evl_gc(wAlcEF4S zAkI|PN$Rqc*E-P_8XHb;4+Q z;3PA}F(;ur$-&{S1Lketvz-1fF|Cqk)~@|?r4O(kFY!I|hy$}Q?};GE2n}oKP+f69 zF2z34yCXaD6@ic#99bCYn%$$X&M#kkBs2yc;gL%b5ppXsF$V$C(l!40DB2LjL(veA zRft7za-~i;7gEpCTuZp8slr}tv`U!xWzCmhmX3QPy4!Wc`G$B(lw>1SR}Qx}pfm0? z!F(4X&KwARDBh=s5;Pp%4!|GLnghpXi_X3I*HeUtO&nEFjgsb`IjEeZq&Rr>$32Ea zn-bKx)Sb2<3AuxK*G))ALsgWr;_RfIQsP?fOmYWpD*XlQ4>>Nw`!ngX{6@kj%qrQs zZY)O=W38O#=ik->xdd9BYg*Dq^+ZK~1`}h+tmL&1n^_)8^RDV{6D{?miblk80sq3x zmp+`Romxu!V1evZu4Y=^9V|Jf_8qUQDlOq{Qb(28HGQ$0eE{N!9ldb_ms5mWQUgv$ zqyqLDvNO$K>iM4-_guUL;Hqb4TXN>+rh9(-19NXreLeKLPOn{yq@(#0uQIxg%1Ca% z2K1GF7jQ-OT!U&jl($E{o({i$fnFiHKn7m~cEQgwtgbRl~#pO{wN0P)~-AwWC1 z?uGLh2+eg?@~V^|^5^E!m3xQtu4tE+7MX!vY0b#^&5V$8`yj~$S4mVP*;G2(dwHS{ z@wk+H9qjY3BwUj?Z}Ex#ye(IXpa9Z5IVl}Ms?Tm10*TKQiAm+h7Z(GFor^~@vwaXzt{Qaa9nFORt&*P@))Gj@4H;Pw%L9w5k{of|-_ut#{#GIksSIfV{ z9!LlZqX-9}r*dm|9jIj-jTMJ(AVU3~wdDMh0$h1+#RW5`g#VrV{2!XKT{KXmg@T78 zCFxAt#$$_g^oMQ|&w7u~Ev59nObflI1}eM5Dx1RndB`Y)4Vsh(>j*T-h^CjHIlbFN zxYpB|0$sjZ_bFrdvQ?KT)2<8SS%>iP?2X&r^7!3+vys8EUAOGHn6+8cMWA`IO1xBV zATF7e6~&x{?Y5dAG%g{Pe;T{Xr|Tq{ChJ_%!P%aKtuM19!|Im_R(6XMUW&(Wnr+5+ z*2TVCVn(Q+Z0>DuYf5e z<@2?ls`r=!!C-At(Wv6OZE3VDfKl2BpR+DSDjzPi8cG>@ZRuc_W}Z@NC5aVY_sy3u zu7ia$?lTIXW`p;b4>=-@I{N^z%ZtmVly08!7{fOx+)qgL?%w6)Ym*)>r0(zBE2xUc z+6hH^w&AwyZx$JCWb31Nb1ve>lZ-8W<-nZ`XRYtPzA_p&Q>)!(j?lcO?}ftoCNa!m zkr7uCMVYrg$#u4EZs=-TrSC9mk5N>d`0azRbYMh6M z;AvFMcC&jDmI)2PzEU=nj=Hv+0xEdb6hC1o> zhTgQ!zf-M7uh>j}u^oh!%8lQ+cf#AxGOD^gdy>WJ>Xdqa;F7?Tkucar18CZZQurbA zqv$iJ%+7m>^siG?c{uGl*%^?!TG36s+bSfq8{yDw2@`bMiYMAKt?HoTkEAC+_VNSp zaZBf$$b#Ahml4DW9qv{)J(|zhT^Z0f|ul{A{>D(b{j!m#uH2^!L%xcS!I%z1~k4$<_!@(_|`Du5<6+ z-XY({I8c*DKD`?pNWLxFqIUEJ6xwi`9T`2oGkB#E=430p97*=S%dIeI@fwMw5?eX| zLkn1`?#Cw&#h6b!j30}Qc+|0-1oh069&}TZ%xBz)= z$A$Q39YjYu?tbn}Uj+7pQyTK}%RQ7Yqtkiuk{unBE3)RDqL!a&h;)6Zb zM)~yrq23DfW7Yo(F|j>bstVqIltlS$!~<@)*&)Sk9hy&!+STfkS%Y2BPC6Cp~X82>ooyXpYn+Y#OMYg+S_ zUqpW1ceoY*=hB*}vx@LzWXnnS4SMH)s9FF$pP@$-(ynH}2e_|ioPj@&;0f8hq@9azZQSVUQQ& zU{4V{dL}Xm4i+-d-~j_bl8}Lu+(^peG9HYV$*i=Y@3ye!n~aXb9>Y`KMTZpO5$QB< zp?Vl!hQq@o$=in zJ*nO5ncOodYqcZ_8XBXCv{hI9Z?se)@_a+WarD#M5!8+D(Sla{Wn63Wp9kO74e^ME zvx}4n-?>LaL9EVZBfkolq*@4K#rxXAv&B>Lg9w(u31E6CaSf!4C~pufuzpycN_=yO zV#(axhTJKm~ zsSH$_l!>S(?o88UJsK67^_x4BC$b_eNkY4pvJL{n4`Gk|qQjg5>@Q z22a|UD_URQpBvH!c{~cI5w$YT;1TLXa%4}F)OB7HiP>2ATN$ikuJq;1W8PI?bvm4Y zxUUqo({^RTLt}7mP8T9`}4X0FAtD@659m{`DM8x}QSq$w(Bjer9m9^akJTq$i@!8DsRl zyhL~BNep$!hQLXM@Iq{*U)&|99)kpYAJj}phQ??NW>it<1UU^G zu)v|c^GlW>X;Eh)gY@SQMz-rLE+veieME#G+6D8gZIIAGHZof8WQd-6nxy1(oYC&t zqX@|8;FA|FM_?zPuH*TWM;^M{PUd{0OXpvt22MU2Pwh!%H%2p%qsDe4);Pd@Wln$O z486jBq}87Dlceag4qR$ON2EGDkjqVPiu^Tu96F{u1E8DF41MDhrzA!=cUohv z?vDs)X}M|Wm=Bpg=x4t+sne=XXZ2f8k^UQf!yYI$chC%Da%1HFo(Zo9R*|2HCDRF) z&VQBYe@XX)UbN3o#v@AoqiYwkzSwE1QIEx_pbjHo3P!J{M0g0ccAgE*2KUPg$F?yZ zFGu6rN(y;Vlm+dQ?0XGUs&LVYUV|++%Eo~qplR*)4&(+VWBDcCr$k^WJ4N2=pR}}D z27g$?uax1gdS%0Y4A9hiDn2|G+qJU;2g`f{O%KED@ahF&hPnu0aiLAkw6nIt5xOo|ZeI*@((qe-VNB5OxUB9?|U z7;4J^Zz#77r&;PXBMH6pJGeUs;v8OTO&8k%M{)Gg)SmYUJk4C~3SJkW%;v$K^D6h1 zYC(ik>zL~&Qk?nWCf7&Pa;&^`|J@F#%h8(*iNEY#LwTrEHV<`8-+-e#)WV$4D3w+t zDPwQ|JK^x{cjz9;Ahnvr^$zgHJM#5cAin$I(PIgh!g>yNB-r6W2WokFIpp|D>~0I@gpRn@j&)bVn9E{} zAWs)?8cv7h_Fxx!8=)bQwCvMxI-UMo3p_DqP3CCi#jrHIg#OajyaCKL>E;qZjsfb= zV2rT0;(l~A9X%a!%clI9DZ6N1OhpEGbE_iZOnt<;yF3izHOZy0cd0o3VZ+2N$rO#@ z;im*S)@pSlrcFVsA5rgTQ0&(mm(Hl&Ei|Ut(+iv`KP4Hcj^96B2H&=Lzi^fymN-Ad_7JF z*g*b4{|0Jg;yn02@kE`g73@G`5B?J}Jo{aRJy7!@PNdvue#npV*QU~t-y?L7m_%#1 zVB>p_LZK%be!p(fUY~EV@i}S@pTsk6eD==SVPb^%{k7MH`>m{hQmt?ICmU=ozAJ|$ z=xKmV)Bn&%i9hh)_6Z7`GzJ0PKay;{PRPILp*3433=3~8o7{FC`hUJ5lZ)T?-wsof z*+ZXvT|c%g1=*^6a3(@_%vJP!PYKxYM!7?=it$|?gwNHWM(c@7)7P_qZeLVA{V{Oa zKu6s}XflB`?f2@&yU>YFbS4CE@KJ9DFZq z4`H&q{>_jMLLq0?|JqXXuM6CwY3y8dn?9&!$?o!IXtLfyn%x0*Ss=|lpvK-ue*`<4b0vZR?^rUzxXi+5y$V6Q2ipH!p`%`u!&->3FUUMt$C z88u#Il;ab?VF;{tTm#|V{b8lwVb{GUY%32t`JCFF%fuQgoO|{N! zFUtklBpM;~;RVY0l1BtW7*&7ty-Z~?GEJQ8al)k!h|nc9cs5VppXC&p!hQw3C?@>W zWf3>8d(&IhzEo*tYN%USTv=(TI%hOWD2ZOTj^_xqn$U=owUVQrmC0yrCfIQ2Z~6rZ zZyj6AWEJ~rb^Q?<0_TlKYXQx?$^+bp$fImkGrG}{p4wT`0>rQ8u`KK3Wq88pH9EPXp<^th`jJP1}J4+IGn3zFYc zDf5dRNCntUfeXbo(s{GQiqZ%Fm7j*}!hFvB>IYCrlfHjVtZ8)wA!3%?loMf2tzgD_ zo7+DQh9_iR*taOIKLxf|a~Z)KFNH~lpCt>#lr0MG?Xa`u&~q6y z2xjOdt5soeD)kby+tr1SX*pe2`SfbdQAirCb`sgIZwLa0-#Jv0(-nO}S`?)1#53T^ z&Fb%r07g+pSY4mTweBLw5yBn)7-iRD^XC zW+)XBqz?wHt-A7GRB@vIISoV$aDX3N1#p%eQ!hqVzcy0Y~e*k@rt4RH?fb#W@QHc zV|1xH31svnL9g^8ytT7a5DjkgNt(NK+<$LjEiL z6RVBpJMw{~ z#7r#0dK}$tS3ZRB(l8X~D^a=9X^u7Yxt|k-%j0D9&`XoUiOuH?ftm#`TuS>IhUhp68NTi4k<5O7ZhkEfRQt%C zK274yqu0_0Ieiq`%j}i&qRD!xpQu?#*M`)a=Eu;I9QqYiWqrDM#tyeI1_aN`g%nEq zT#lPb$n_mFsIuwiD4S$rxd4Y!$$1Rl;7ftU4H2Z^+%L>1N%*8C`3C%a*wLuWewnaM z5%Om^sMeq>*S{3x({%2lA~vJ$_R5wZ6YCDsG-W0KS9@O`*5tMB8{2K&N|m;Xs36p- zB7vl6nH0#bO0A%xpbQa+f@mZ2j7+g^!7V5_K%#=AD1jm*42CchON1y9r~wi&422LP z2Et?#LP&Df7jUR&?|aX=_qpe}f9(JAB>C3xu6KUl_4{y=PRG;JT52UBs6nOG@YD3P zdOUqa{}&cnnG=|&711$pveGxy#Bq4f-o2X-x~=P1uFrBx=)y(&seZeOsXE6` z#gv~L=vUT?cQw-Gt^GamJh%GTXf;lmt`42fC*b76TfJwKy10Z7*QvTbuv$M|gy&F9 zzOgS>tn9t_ZFA!te7F0djWBs3YB)ACJpIS3GW#h*3jk({cns*^Bh_fy2m<+mV5ZpPFVd7$E@TJ{zedEf$5dVkO z@yzJpK2;OuXo8pN$y$dZeS09u8Lny1BOU!coLOJ#-5`|Ts=LzVt?R5@{O|xNk3*|= z+gLlqe?@a!yN`UO;If}(Yag}*o_X-Ndx-GzNqV8UDzf}fQ}2uNT;qK#ahMVxC_S*A{{$GxU^ z$Ez(HLTB*T;-uvMvUAhw>4y(Winau}VKeXlgI&{OX-wA76@kmDooD@wPniS&@BwA) zS>L~|Wrg$DXfcN1kLSF+1>kl#d2q52Q!0^43~)5y~|o;r4r$2SrYUpx-8|4q@*a|14K0S0GQuv6kZo@8CIwDArwg zste9l|Ep%g>VelWsi=y(#sw~lbuMweeRjvx#g*B_I_jaT`}XcVb+Cp#tAnYMkDw-T zw^|kIA;3wIMD^ku~8T?w4Ci}Y^d>kiko_%Wuj*sFe~rnk%H+A?X?YBJX2Cs}1T z3Qs|$nR}fHob$_X@pH#{WOpbg+i?XB{@KF1Z`B>GqHm-gd-vwyDbz%PZeWf&Se4pc zH`1=`ZWXB;bp!jP$8dfGu2PPCQ8!Lk^0P{M@ttqL)!H36vARO8$ox=R2@R8hkZSgK z6dj|VkJ^IRcBO2lsZ%{(C{1tj+g+Vy{CBSujK8d-1i8B5@EXRLyZ4@!NaomBx~126 zVt(`5)M$_0zK#4)Po=-{v~%4zLk}i_Dasph5EV6?n%1^cq&p24phW4xeX=vEqWZbJ zsOj6i(}pvns3Qrg@dT+lGT7@qowkwn?^lo{t8Nk)v8Nr&fw{Px4<}Xg9!Utj~)(m>mKYFgwXUP;hDdxM;MqW&BWBnySJ(vhxgznoh+ZK zC+vw8@@}O1LhB{Wqh5Y$LKKz8y1H*NU2DVQBJ# z66;{Rwwi?G)$z5|bHhCExh-+Nn!BzV>AlW=xeqc9id*T*dg2Suxo9Qsi^9l;u_k0+ z{NUf!A;Aac{giBWi&^YnHDFO`Ti<`>48ct0fnhBE}({8`CwI$2e9qKC4n>B z@WIoHloAE)qY=S($AC48_JA&f2DG&yljBI>`sda*ni>TQAujk!V5zSx97KYqbGSu2 zcNrR7-aR>rIH1@@NQkITurVzJYwFp@h+Z^b_JY=t1_P z!o$gI1Tfe_jDie_7PDpCD5-#M2*h&&`s!=@6~7 zOCLxIP(GVJ;HQtcQ5HtZ+!XN&fJUU_!lw5SP}S#T4-Em}$n}*^#B)`5 z`VsHfAkD8 zZY(Pq7@`$k=>EC-_7#;N776>+zv{ijfnSJ;!t@oD`06^V{%p(}Tv|q7(3XJd(K(+g zF6TZgwU^exgN5jFycvY|D)2eT9$3b6ft5?zN9d)oeDbM?erc23V_LrGkAYit$^9Vq z0C*(`S$PTMAOiD`ksJ&*3=+)lt}(@eyVeHF(-%7wv6npxy;YOkKM!SsfOG&@5k{Uo zz9vY})}HgiGl+NA$Xj=y`2>ZU>~~44cP3`0Njh3buh-$|aS6J=@8ezQp<8V3J#Caa zIeD#c&>dl!M#jkGa(Rm|42x~m3b2z-%!Zkas9=u*p{Y7UpwoatD(~5@c1ZJH^l#pf zAmGv?t1^E~Iqlt+@91CUg)B(O6$KCD!m?KnQlCjn)+P?D_g+bCNfl?Gs%4CMt!?F4 z%RGY~Q1SF%y*)b(mz?JvtxxX15VF4Khj~GTI0{Jik0mp+VB=S($}{ow5%!(czkh8? zn5>?7(IgO1uH_J$P`2VqGtbS@ON)v!hpXA^T7s+7!VE8*Ei@Qf9Q)ldG~-qyttAu) zjK1^Oxal21I~4@Sno0L#4H5%|ua?$p#FLbq~o z4H-fK;)jpy)IN^BKjChPVI)GMu~p`CQJ-@Y|D@+O+{Lw4uBeQy*iK6baeE93ZdG2O zU64H3e!;ieQOnESu2(Febw-tly?3dYzfAeuVLA8+oX#@`E{+N5Qye0T6n?YM0B6?c z&|F0QB;-ed`5f&c07sfvNj;93`}20~TEm>Ae|yjCqysu(t;b zS3jES({NW+HZx0wMJL6?%mp0(0=Pt&HGEMeD^T4Xe9v7bo;)G0?m3D*$kcVlOGeFL zRa>CRKIa0Fgc=saTT0Hw0%u{9=Z+O4Pq|L39>r}@o10t8^kMoXd%PI)DFetlLUKOE ztv^>4Nd$!HLA{sAd7hKb?a$@=aYwf3C z(;tBK{R{iszQ>g8G&gR~5q@BjjmvF5F!`?61s_`T71|~fq!N`s!_?r0C>sux_;2@H zyH}p!snsw8uOQ*f-$Ztc(h*3DGeTWPJwGy03V;=+at*eer_I}#m=izi!pYj~$hJ)U z3JiMBhEc>J4~ofOWu#Hlp7g`w9IIW1;@+#gHH<<$ilp<)-GSQk8nJ+89(2R;LsBmd z?G!pV0ts|az0oUxPpH!*3f;uf&1UE3AZTW6lz2PDbgrHC_FRy2@Sp?ckg3n z^Ttf|*;@G8rr1W}eQ)n<0Qu1xBrmh_4j}C6x6|cL_k_0x5?I9acG4CKJaTffdm~y^ zV}r;V&So=cKXL*kO#-89_%!FpFw)?PZcy2{S$`!&ms zm}qq)6ZU+$-hVGrCy&f8whsd+2dpkBGUmi0 zlH_DfTQ%Fc>a@P=k$7jnTt|oJec_DQWUXFAZ>$V&+QM>0KWTAhm&C;=4@a~}BuPat z5}jjzcv^G8CqNKezT2%h_$;(OaV9+?Z5MyCTaOWhV82m(HC*ay4DN|W=G&Xyl|{q} z%x1^B0;6yEu_Ohe&nsEVoON0-(Q+bLqkeYUls+P;x-3^z#{3AKJVeRJ zT2kcmSQ^C(9X&giBwxxqfI*eGyX~ZjrB&J^Yh)bM!+?=eQbjhQF9At*;eGbUaHAw} zz9$MC${%`tv-NMe9QcVR$wpb&+y|@j4}Zh{YP+PM_Ir<^Mt|RJciKRG@EH|rw zF0#!+%HjQAYa5MJJIARgz;V3PrF&uElL|+-FH#zx_qM0}K4I9>ZR=VLhi`ovORI6t zG|9r(lz%M|t@lQ)y8BWz%Qm+olx(_Qd|$2onZVvO0pW!+^6lj_e8XA!!_r7PHONnK ztNplja<%+Pv!zW=+Y#J9rZKxZ%J8BZ3A-k9{llTjuf_f`N)Iz9ezm8|CP>rZ|>5P6OCm=`1|N$g|=pr_xcSS-K%3Iv6(%LXZzbTwd4Qzbf4~r&#!)< zV_>a>enVsHMDJrGz(R+~6Hi9Y9EzoMI`F+945NjhXW-|gvq}37p~BhWB-eH0JAn!g zKF2z~cPMAciFr^YFzK(ZF+*>5Y_)YeOPZu~fUZ;-L1tBo*EmZ+bsdGyR5te@5?G{?Fli{;{a?~#h zK*s9@lh!ny)LIK~XBv^^)z0v%(d$V%RZGW1Pnf>du3)2w%yO?JH_FSL>Py`m7`}yX z{!`9*_Uu=N-VTY$IKj!R`j;xOcW~zCbRtO}=ZtUCrf<6wrn$hME`A=2-=cv{w`m10N86u{({=5m$-hVzK zo_MsoqA?sj!aBVT?@o%u%%7}~;s|0y`S9pyK)6LlXAXOrY5nBY;GX#AGx5#deQK3V z+wp)4`p>i^W#CryY>|f#ObCAy5Mc#4gE~c0)J%ysoE%N8MUaKO#@U|~>b9J}s;>aw z%AHdCd*tPGndp^QHZiabiKyibR7_fYI~I+TMO!-A$xpeu_e*J&%iG(anUY1oa|f>9 zJfjq3Oc6S7y>aUd*%dQ4lhms96iFT_p{8SA*a-=o`#%D$%O2HzxsOnbao^K@fQ2Pf zbBI^%&FiF>b6=&Ej5!9@wDlVQ>_J!Z==JiRc4ZHxv|+ZZ#K55b4trTKNmDgoe5%#8 zEIm8%9YM#{mSXEIUQXq zeUgs5f0cMXV%D70rUIfh&}D$>?uN8lSsr5L&iMgGZLC=ZXQ6}be2O(OmGw8KcjBD!h7?{X#JwYDWNzrsB ze@qL=`Hs&`QnbeDyU)8`K<|E}Hy#~~N&oaiK6}6Vk45JEQf4B>i2SD~UaYP3egR=+Q%o@3oC)MEx2NMd$rlpS}yLC*Dr*PKhnL6*4M>T8kDk zO8*DCRmUUegM?GjlPUfC0C9?-E6kcsWexOA)>xrS?`Jk$(Y{e?x>F98)zn6zav-q9u{~X1KKyt#W2||jc#wm`X57I z((1H0XLcNoX7KqtXY)#U-Egu%s)+C^bN+?pV{_~dNL!62K5Ye+c@>@%dD;^elD?d4 zqj3O}I#vVAor$kdMWHRY8Jvjf{VPco=+CqdqZuUywV`b)_Rbv$SQS%q(mIEZ^VsX& z$U0E9>scq%o@8n=&tq-x>c%4V=1Sd^Q)nyT5Y7sN52HK6(0EQvEu03h2Q?FFbmBZM zi{PncZzSz9-O|AQCMiC3>o11AKynK>9)Ir*TdCfV-^+(Pio_CL21{Tc={{_7WfKOc z_Vhl*pW??X`a`vj0ze3%ODF}Vo;#}09zQKQFY3+&xck>h181QuTbfwG4AFy87P6DD zVxW_ugwKETLl_9(@RfD;d&TEq9FX{QCjp5OBQ@4Y=R83Ae{1t#uJ29HBKP-VwfF?^ z9Tv>jfAN7#fRCAus5OJw7{ddxO}9Km5sN^!S?XFEKB=&&se2Kqm>a#Um*%@mcR=g6 zm1nZJ4bqCNt;y$>Dx&w*GHvrU_6JrR#wD4rDg=qV)^2&z#FNNgB0JW_MUhM0F1Q*T z&mZ1l$KN5HQpxBzcb|E^{7Gqx7lAV!cru|=xqXewIwqn!^F`|PLscW~pvm!pG8Rk4 z?Y>qvdMJZ4KR(A={HK_;`>Oyb6;weN3NK~M9FZu zpEuUDppJ=C{Hm(HS;}Lz_?{fEK5SR%o2BOz15%p&22!&!+c>M6pUK`?;WPoKPrurtyb&Z-S(1hgeW`p9!z7t2w^Y*7zP7PD_C}gh z+r{45_I-RHc0ZOpw$c;iAc1X#R+`B{hrZ0D9-g{^N*!w%Dh)6S@Vzcd4eoE3I{K^P z>8&74tc#=Qu@ZkWm z(hQ+;XEFAEHQkJ{I;2hW)im12IdUJV|_ zgRGzNJ`eQIHwSE2XlMcKP0vM*9}IqZ=Xt_mMeofateAa|n({=s;t_-{TlChdK_acG zbo>u}2<`_d(bkn`gpB%2n?_|oWc$W=A)$#J+|%wh(T2)T9}PhID~wH&JomFy@r+G{ zXPg2M2*c$v%J|o$$QRszm=WKV;egH$530*Sbs}ti<*O5m%XyVm+MrqFk2e=ZnSee% z1C5~%Aax?t<*~OP`H8dhHAt>gEcM0@kG9d$$D&RuUUYYl5IEKHqv%D4z_q?d#s!|} zJy@;9CUbXg;ad-%Zf~nxs@sI{EnLpZ2_}jR`%gdk%j(APN%QXQ3}p65ctx0X-*~ET zHD%^b)m>nj#gopKs43p+n;Yv_Y%d)W{p9 z;_{G#siHNGC$?@YI7w`btxec(kX}L_^*M>Fwz9E+Ud;Vnh!0;;U?5dOj=GJztv(QD+;Vj=yiAx{HFe?_C`Fqlr1V3peYD#y5&O zguB_hkK1w9I(Qz4d0^t9w3r^Oifb+Pl;2?|Zs0j+4W+Pac+zVDcke0%Q(j^w+wc3^ zpO^dI7!!8c*JNik@w)S)a$q5qHSMnkEMT77Jgvl8Z@6@4qif;x*I#;iK^FmbE~-+4 zs2oUfH}?UR24}*c8sYh4VqXwgrx75wo{!@HyB`YN(Wu!;r=Y}FQ(G;^6Q!Sm&WW(| zb+TYp=ddtwfN%*u4(b4l+y$!~MKY8k+LA5>1uwY-qmBe^Mb>|7jFf6>H!X3s(E6;K z*t2Oe75VjIR{+r-gdB*C`zxe}vVAngni$C-1RP&U2&uRI3$*@2Wz+`A5=4=%8yKy+ z{-S7X14tqihoz7t$LZ>Xu2j$*^^YF!Mv3%`x5E#QC(vR;LBG{?o?}&?!3B*-yKBlb zu1Jb(OK{BOnIP}EWZ6;T@f)(bfu>q+LFMtGCZhcDu&v=}@FisoBhId>^4W&)j_O)t z!}xYR3!;3`@+fiTm({^bxx77)Zv^cZs@$Y%iI!Lr*CNi_*EGKQO*U%ljZZrqF`T1q zzr`j|&(DZb#5&VZRdWDcw|k_=6g7S4JJXcco!L;8TDBG1eXk^-YB|hpnQofP^s)Xo z(!s`;1dcntJc1WD73ekGuPUX$$s4fM+fomCuVU0FxCKcjdGJc40dDC**0Y}Q3N~5= zNk#`Zs*>-2LqZ}|n3MuI3GQgR-)ThjZScwo_PU%@9=P?s<=g(KD9;qkvyQ++tzJ2a zy`UPRR7uYy4qI8Cj30^NOQ$AN{?RiI9a996{7w{0=4LBb1MKpM#}~fr(7AsZc>BMV zQ=^i?tBClFa?tMC(x}6F(G%`>WK`@lHfdZhnnK^_QA<`AvE{ zw@~ifq((F+^j)nzP9dfTRS(U)nf|s-Sw%S|pO~Gva}qT?9E9S>P6>>eTf4o%&0RU* z8zgjUuP7bw7UUMMtkl)z-0RHqa7Wi_y}DL@v1z*t1s)faMeTWJ%gwx(XM=A-dePu_ zp1v5oC2MinPK!tw87u9JIAAv7na58PklP<8x(#nOjSH=QGdbg_?-q}+k>=2ik#PAQM_rbo4MBTsX**<-*^VCxcSD*)?U3E$}Fqo z4dLN#2la6@BIp(T(Nx1#!U-rMScT9p7@qTQsL(J$?u$IqsRyqzl8iQ+ntGV6Z#k^b z07TzrJbsCrpF~05NQum6k@$#Up`urPZUSIg&Aui@9jIxz6?SOw7Mr~;C|z-6+hv}j z+v;K28&&~tIVno^@^Up?Xw(~&_zZ+3*U^w9HlBI7V0zC&)hTCBcLn>o*I#Z%kj@w( zuq|vez-*sbd=pTF{B1xUQI8$SibbrZB0PT9SMRl+Tka@;RBSS>>lr^Y(Lj ztu9LLv+o>-H`^J~%+0rs@cpno$Sl6E*~p86VFbpBel--qR>-B$3hXr7KO=p&{ij^a zQ6z=D(!t%k0dE_9WgCkOx;{V93>a07r5pH1c(8-05#wRMcj)96&tUEEA^*?Cgp5?Y zwmgOey=oi7;y#pqN6hqrf2OX6%$>k!|LN}pTgkzHrmo6M5>HPT(P#a;w2C2JW;3u; zp@R|84L*PLr4`VY(TTHrvIunPK~4VI2#mYriJV(^Zra6gmdVJJMQQw`6p(ZUz1135 z59&4fFMh~Ai%l48S6=I3farfdU~Dm4d|m-!5fIBAOWOwP!Of2qb^t`8E5l1 z!DK{@Nh#8IfxR_6f?J^j>k-|Ewf9U8)^0LpZ&FV zeI852rsL}5B;4e2#*VDIn8Y^J3-YF!=anncgSk2!xubfpqnDqqlG8_2Yn5#E+)tj& z%kMTO83x|W;iISmy80n6tU4~y=w8|RWOfbw0V5ox_!(Ck7v%Q0OZQ%q!;Kz=R)0YU z1z6*G>l&OhizEZYcytE_wP)?YR4m#qniaJ;%A}#Y9Q*V796+IWi%)0A#=Rq2{kb4A zbp=kEr5c$KM>Y|cAh(gbMY=txQmYVURk zRpDz(c)4@vjms`h#k|c;`H|Jx@Tz5`AgWmCeEd>&;#p?RYK^Po`X%=EOIh1yt#!%`xpHjeWiaIrD=v?@Z0m?4rOHwR09Gj%!(( zv=M1GU&^MO$^e;ij;@`gtXHYHvGC9>@r+&K$!YOm*&ECO{hfb$x@JV{_4Ig~p;PMF z*j*Xv3U~KCXPL2xib#FTYi2Yd8in%QA2(8_?9@uPB+houXay$rC?r4B?nW0QgWRx- z|M<-XZLis;lLha_5!Es`I|D~i0-|`sJbBX)F3jkSxxY4JPB6wMV}ycAIJNexS#ewsNy0!Wp@wC}v#PC1C${;umCldBL8l|*e_*!VueVv_k>b+oZ5d4%}IC55s~ zTR=^0%NV3(y21=V`A2i8vIrOT^z%ZLwzu>3()kFMUI zDA2Mk)zM^U*{M^ciZFFUp62M8X8F4s>~DXbp0s|RDsb{}P6Kd^0au-e>5nbpFYa;%Y zIR-fG-J=wU!ysZmfmqHTc*np6*SU@_On9CNaoGQ#Og-P2|Nl|pV a{c2cs?fU)w(cmpcu>JOj_EL7AxbPpZ4eQ4M literal 0 HcmV?d00001 From af5c33d5aecfb61a1fd22b9506f4be51aa568b44 Mon Sep 17 00:00:00 2001 From: Elizabeth Ross Date: Tue, 7 Jun 2016 11:43:05 -0700 Subject: [PATCH 04/69] Adding new images --- .../create-edp-policy-using-intune.md | 2 +- .../images/intune-encryption-level.png | Bin 14139 -> 0 bytes .../images/intune-protection-mode.png | Bin 0 -> 23667 bytes 3 files changed, 1 insertion(+), 1 deletion(-) delete mode 100644 windows/keep-secure/images/intune-encryption-level.png create mode 100644 windows/keep-secure/images/intune-protection-mode.png diff --git a/windows/keep-secure/create-edp-policy-using-intune.md b/windows/keep-secure/create-edp-policy-using-intune.md index 194bdc40b7..a2e3cc12d9 100644 --- a/windows/keep-secure/create-edp-policy-using-intune.md +++ b/windows/keep-secure/create-edp-policy-using-intune.md @@ -228,7 +228,7 @@ We recommend that you start with **Silent** or **Override** while verifying with -![Microsoft Intune: Add the protection level for your Protected Apps list](images/intune-encryption-level.png) +![Microsoft Intune: Add the protection level for your Protected Apps list](images/intune-protection-mode.png) ## Define your enterprise-managed identity domains Specify your company’s enterprise identity, expressed as your primary internet domain. For example, if your company is Contoso, its enterprise identity might be contoso.com. The first listed domain (in this example, contoso.com) is the primary enterprise identity string used to tag files protected by any app on the **Protected App** list. diff --git a/windows/keep-secure/images/intune-encryption-level.png b/windows/keep-secure/images/intune-encryption-level.png deleted file mode 100644 index f094fae2f9c6951e405a053afbe8043aef700136..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 14139 zcmb`u2UJsC*DeYuf}sgSiZtn=BUL&CqzVL(-i-8Kr57my5drDFL{NI~5I}=crT5-J zIt1zM2H*ETl%A)}`|oB=V<)9dxiJM5QL?U9jEaPceu}~0 z!gv)i+J#>JzKW!uWZ{Z=txv`on{*%V1G5IOHpw2$GfJg;ft^P$)2mOYv_G7el$WHk zAJ=QV=c*J`n3`1SU4M^{%{*VF&PyQqnkCo35ywZw79!dw!iarq}N| zW8Dpg-`;@I+{kF5nwnggKe{GEl$v+s$zHv`|$qBsKyePVM`2ET4 z-QV{RBFq9y77B~c9Id6s9<@r;_BUKZX!)t%SmH+IY$*2p@=LP%5(QugG+|UzX_6>>| zfp#i%+rq77;q5pyZwgX&bs8U#eopKZlzsptlcB$x(j_+Pu>1FoIcPnx#eEJQsVE0@SuwZv@S?4AJyH-do7A@v% zW!hXjn4KHW?DK5nOTwGFC*q4uika)36pZ{-k6_&Mb}8D*06U?wpT^n~2NViGbAk31c%pU1xGp3)&n3KJB3#=YVRZKg|G8 z1|j<^uQo9Ahk~602OY5?1(}1F>JNUNRHjgoqF=rv16jl!e;?qv>-t=p(q(0YG^A20 z6xrjwKEPJfEH@i)BJBeDb(+skpl97r~ZT(41v?f$?aF{nTk%Cv=ddS^H`YT67v$5=PeCh{w^+~i8e!YNuei1T1RE1oE2jW2`jRzG8y zP~vTw%@Pk_E&!q){knm>(I=yifJxzCtJyxveOaA@h4y5+F|KT@o0oinJqG4|q2fOH z0F?%*>Nby?85Qf{{)3Ts!^OFB%;k*&V9gv}La1ZzW)?z|a0u}gk6}kyQqAhU3>4w( zb*y^RY-XwwjsBsYk99$y6|Mh zWH;b(?L|YyD8UU-BL+ zMDy*u76td$LviQBQ(&0WrB>up3ym``go00}#y?KB_e09P$7XMYlmvQ>u4mn@YGYyh zY=1W1d_|w>6ul(wyg^+lykhF2ec@)ijpGmAP3P^O(^9t$&pF-Vt6j5XUsUqP-!8(< zX>#5RS=G)zcFN8|clPK>SN%G2vupVpIhcAH9<)#c^y?l0bdg_1n%X&ip?w$|KzT{3 z+_04En8Ad@h_6RjDt-h%cLTQaU6%V_I3>p2=)UQ^TZkTENIp61Kj{nCHw)L7w~*_Z z&Pi$e8N{`tR@=tVNDurO&qK704}d55w%He>`90E0SG82x=fA9W0&jN)Zc0AqKbm35 z!v^ZqD`%&EM|;i+jbq@A15XyXnq02IrY>qeK=?K2S75FAjFTuIr0buxM4fXmy6MKe z0nCyVyY#$WU${BXzHL08*uf@VX8ED@KK(AxP|<;Y$dA{pq>a;H!@di@{TnnuKmK0Y z-+}*z5MKQM&JKBEfYsmlH%Lg9g>;Q#= z?@=C*LEfXshi4MP*2xjrK!$&x76iU)V8W#7|Nfmm=h43=+y`QzJO9fTkldZ25L|TU zT>}dc^smLzP#e(IaPt1CaF#@?;qSTX_Embfl9tOLBqkW@R`pDy*h#5A-G0>W_(AeQ zSCR69^|=o6QqiHqG<3-2QKg`|UTcsr_;A)2;$xr6nwtI;vL9<6|)5#~a z%0hL~tq9-Kd7ZS5tJB3H{Tyd=_@MJ-sJ0bi!3bneF@-g_FAg}1nan`S?z zMamWPs0aY-P-{K=q*S-@v(UYFhgK#u9qoAOAd~dSopGm|nG}00*r4n!WK!hDyp0)0 z^}%Qn`h~4YbDV7_$~<d5#|KVR?0-F{CtZMoGw=Pw=iVt+PKo@ z@}l1BQ`+BT+FymFz1)!}NSQt#wVnHgPkqTXNXx>Cm>Uy+@ukYrrrx%~caqOi*YJUs ze!8}-`Km>kK$_x8t=`7!c-0S~FV6*qc#d;~z7)i&6IE4ZiU$V_L! zWj*jZMcdQNj6_Zj7gW+P$h0JWX*igE@boK1GLvH0Kn_$uf6>2&6BoTl^|7!StD2cSV0n5 z9x-jNn4O7KY%K>0coELMrO~*{qvklR`%_6tbDH1oW*%~3TiDc zh?E-}nb4^X7f%EaBZxsYiNpOlNsrMhed{qmRvj+WB(&S8qE6Cvgj;pp3`(sGQQt`n z#0G?8!H`r5AIV(*sFJ=9>WnrtCVx*Fmz9!&n`!P10kv2s#pfZvE73BnDyHXC>}!wq zDlbFBx3Fs3+xqxrgT9rsRCZey)V)lCi&?5Pq&oYH*yjGsfm~=|L+?w+vnXzku=3ac zIftZ7sQ>wG?szsCw5S*}e3gc|?Ec{?c*!Ps6}S;(X}}f^|8hH=^@9TV;RJtZJV`l= z#urEcI66}g2amnY6iR3!2jd=JDW?gIiI}wD1Mazxz_i@5F4B7uu#)+~D3-+RW7*wsdf)6BggGbQZDu>0y zQ?DNIgt&{)H)4SjTm<3`9pCFDbTY?bEXwiLlK{hpHpD@Hg5&0a0z-KLy=WV#Fzp4N z+zUq{4k~pRF{h$vk)0A?=sE3|y0*FBf-g35`V8K+L0hgO>ds>Tjv9~cqrzi)W#FFA zvu}S0?vWIEJg6<%BbJoMJw8U+ilq?VYMF8G2{W?FtOIj2yIz z#~8S@?!%PvHU!dc(!PN~hc1)5yPTT z&!M7ek}uA&5R-d8&Clms9m|f9FqVMqSUlAp8F*i5b+BTElV*_*A+X2_(hER4*25R1 zt=3ghk4~A7UW?#GBUYb@_KmNjgE(tho`>3Pat2NieE}cM~B-eEfBS6 zr%T4}wq%}b;`A~}buJ?#r9kj})GXn|>uRA-9h*|5L+s8y3Eg)1kU@jsIT^UG=jZ#DvHy`*AoNA1@3_}3ZIC?dbUzysXs{l1-a{p(M(SqyZ61qx?#u7hr4G}37eMqp ziKeL8K-8cB2era!gl5wwJM+9fh#I0f8#l_*#R~Mdibv?5VeFaIgx#0vbj~#(r@Wf+Gpd$dN=FtJoapuhs zNP;v(Bx9f*7vwzw2_VpQ(b?{Vk(ATKs3~A$kF_)KdYi{@3GenS=GJTZhtkmk3}$C# z)gQ=v9d2dnUCabzX=4ToX%1vH_*>olJduC)!JWjaP5b5`r{dC38cr~#G+y~rQE2*Q z+>dUj*gWDxhzG|on}@{Q*4igp(PA5&e)sZ|cjL6TEIp)^FhaDiD*^EZjVLa?%w40J_8-GbZIjPCQK%``vcQu(Q}K- zcOJI0>%(f51)0}&mm;jCW>rJqm#HzT98#!7#a&tl#CGH7D-oJDWgR8*Cl|vg8{wQe zkXF*>0Uv2T(~!!y9g7cEZfa&d`k093&^c?j9ding2h7Evg>0O zZaxNjlc15F-{R$EvQycUm_^m0{)>wd&>34k7cr;{KJ zLh`2AIi2p#c#1wUAgm^QQQfR$rJxgo#RvfmJe-N?4t+j2_?_ z&?*qc&eTEmZq|p{o5bpQ&gg+&Jy8`S?m2olgHxlm;`tG*;F>>5P(P_(_$sF1cfD(} zW)^ZX8oTv?^GkBf3yz5AmWI&qfvyIViDs=K=GV<%CPD0?5g6nMFBifC=BtZ=UunY-|U9vVtr z*-)y(TTEws?Sx#dJm+8M?SEv58g@})?O|~`WP2YPO|ActGhSYnP|CPoreAe|aj49c zJ!9xM{t@l788}F+fI4NjVvF!Cp(;BzA&dKk*n^dt4WgqQ-aR$+i6fui#KRZ%Ybtk( zS1k<;AGc0(>&p6V|5SG%c>EbEr-ELs8U{9e6SEjJc5DB3>FD;n?P{VPt^aJH zn)Lnck)5ph2I@4=jUE7Y1B+#$B(rR9+mAmX@o195k*l91Gw<&t_C8z78B_?$f)CQL zNUZjV2x0k zsHhWg{O0&i*jlfOU4*fLL9_F5N8x&nzIE09x$eBU$LEs#3Vz-{WRgh{`-$mV6q3uj z0J`2EETtJE>jW?OUfC9H5>1K%d!(~Sj*i2mXE@P{R6-nu{ZjQ(+fbKX0e;c!X1WN3 zB7Gzk59YnJ(gP_FNc*MWo}~u06+}bDa3s5S@78Bo=$6(itCV9>Ny2DmWb2_m!Dm*h zb91U{tjT`JU~{=<~3p?+auNP27!AEeD6<;CKJfRAf%z) zcJrxZz+Q~odZIx7SHtS$vaIYjsJ*4*{3EzGbJY2-ZehCl>|2}oU=i5q2eLG;n=mG2 zYqrv45!een)g4!Wh;v<#N_us++w2wb5G_d0`m<*4#}Di6N%(YPY?H*f95L5#&7IA9I33?e)Og;m999bEfQ z5*wL^Y^$BpX7)S>ME{(7r9t+54}QDwv}c~6wl>{1+A23H`K!s}l6AAwvg&xsCEr?} z*e!UwpDZ(%h0@!2IeE#Pe%6=(l)vohhMJqw70>i` zFITfdauk!Tbsy>?S?t5m;zL=j zC#CZSmuq63bOETwa`Cf}@_@@&g{*+3+S7pQfJ>nXj63X5cMk~I&%Ne=Oy2v4%sMaw z*U@VY44-@P;5`Q{<{xGYhswbH)S=XX%tVGgaD3d7S+n2jA?uE5bEL*BjAbtBJDBtz z?rr`24rl$tZqe%N9UYgZfAB9+{_$V1iQ>O#^8W*Q**AlicB7(*4Edd|wtgIyx4vB@ zccK&VaNYW~(~&7=bnl;`Jpn+Iw6>F-fd#*fdb*6;-#uH?7wF^H&t8S-+nYw+g{-!^ zE{k_}LP3u675rd%tysP7&&6yfUT<%2sT+Ua=19k{n8d_HyyW$4@w4efSm`p-(&6*? zA0bsC7Te>YM(|c`MEAN!3qo~?N?X}f@cN+Xds3lDqxM|6M)??3ylh{afBF6>_w`hl ziue>;-*bGI^-zyL-|i9N*QeJKy<)!|a+n#`o+Qj~Ar^9VN>1_7ogH7nf;8m9ov%+i zTJME#NVa;o?8V7^|MKO_aWok@Il+^D<5oVm!=8Aa7BnK6J2SRt7^{H8tw4XuhPjs0 z;l;!6tF$2vsqORcvKcPIktPb`zu#LlG`7hoCa{N=aD~x6%aM}oO3vEBq0f0~YikS6*mg4)UP?i1DXZw~{A8<^ z;7+ty`UZ#8Y0ghks(@w@ml$Z#BAOCND?6jitbU+QNbT4cU>^K4Qe|R)_WDQl{|b~= zt<4q4{c)8-1W7kdlrETzEVvbqa!u5)qH7Ba3psNbJ!*1weHYy05prXAVnl!!EH=TP z!9`O5PaEfjomsi2OZE3FP2OJv>vzW;XAHPzdRcH)#^ylES*wLY8tr?eJ|5VACRwWT z)iY=)4eiHgXA^?YOX&e@Pd2KvuS<5+HYKLRV#H#oZ7{1y;m1)G_A*4T!s-|E&a~rq z<7-QwTaVXeMpYHY<8KL;7ksBj%^iFf*>xmVC={%{uPo@+M%o!T<`jQmYcu zh%%`s=@uRMMEo(|C(+sez$nR${{XNL-_0q4oP9ez%?KB&NTvLd%%@FNp+=g?%Xdnf!}9X?P-zeEnV|Hva|YQo8(whb z#g!UTJPx@ZV#!#4|EYI#O&@dj7#04i{C4@F-)W)4Ivf<;gc-Hu{?8P0TDzEz}Cq`Jq&yFn=eh`|0G7;wc zeJwM;At|*H6JZ{5L_YQrLft+ZT)wnNDB>4YrCef4=Qa*?#E7K&U9wW}p#ys;SifIB zm-ukFF!^0+TAz6N;n5y{f3&u*tMkL+Yg_kDY_t;h(faiCWbU{0Qnq6W_ri1o{m#W! z2XeS?-FqMRDOefk>IrTH)DNd}3q>(N6=c+8^Y6QEObp+UU%7f1D zxVd6PdCpF(q+y-jjrImXRU9wtgX?`*tje_SV!Ozw^crRJQjKNTX-}o^X^XDQW_~QT z7OVS4tex76jG^iIF-CtzazN%{Io3;h86WNVfrrq?t{pMoHu4$+UzHb0n+GC1JrB1@ zn4GsLk`UPkm0Wr5kwuabgUlfsqP;!b=o`b%*v!(z*bs2|UvLr;% zcs~~lwl@94`}L>OvOhakx&^PqODN^>sdcvNpwP!3oV4hHEVW5iTtt91=GRBb#{KgA z!5yCaPL4}!vaVhckN>P*9aQeOg-qgiiKNg+E`vZM*p=Cri`8N~_u z*^9Y&jM~Isk6PJIvhn1zyQ2xnfeAKMU5E~{_i3jIh`hNfZOav9dSapF{ zVC{MlKFsFfix7KeAUo0NOnM!pu54&_|d)hx8IC8V@bMQjBmY zL`#UB%lpE+-M5#KsI@P(Ke)L{jT?McUb#(k3QV0|aX8V6X{@g=^9a~1DA@_tFZgPN zXhMFgQV+cmR&tCza9IRz6JmTPC~o+Kp0%fmmt7p(0fqrQ180h+UWYStjImRB-19ZG z7P!PgE30K(G_SUH)oY-+Q^LR=ETAlWTKM82U31G&vB8%E7pt_iX{WJCEuZ%psLANe zw-qJ$st(*=wYq}BV`M=Im5aOvU&mjp=f2{VFl8<)*IZiBgrxY^cmGzENOW8*pHgH@ zG4ZRY7wV2!s_Qj!Ym_nZiQNXb5LrX?ATZ^6wwW1+0~tw3A`zYEzL%h&M4E_x-PC={A0G*r=)2Tk;r7NCmb}{+dP5gO8M-9HquP zNg||fY~s5(Y-UA*dv?}cAt^7wVxK6v1zhsuH{4I1$J?l!HNK`6!#;+_981@c#`XIj zhKs@*7MFDir@55oKi_xB@h~h3!1m0`fJj7^u@11w(*s3eqq9V?fd?>uM*B$=o+{FH zo%?y0sr7QH_$P~ar~910Mflp&LVRq#&ikE=PCRD9eK7sHPlp&d-7*YgAsEX{C9g}8 zm>qvHFS^QEmNP;ozeJ~WFNAy7zGC-4D=+Wd>zQV z?a1ov|7D_RV&ZS>Gu?`~7)_lj_um+ricGeiY!%4R75O;ri@=#Ok{Gk|n=e3^UZXNsh@{SEb!o4@>$Y8YF{-y6 zO#8O!xA~{DygXYeox6+zc*mwE2h2sC>H%Jh8zuA0Bepg~sZBWE(OuvEi+0}z(iOYG; z)2OfB`+ZeT=dSb1Ut7)uCZB&$xmLIjSi7_r<`O9PcdT8EB+g|y*ACg*t?Oftd<3?} zk%6A+$ag!qUM2CUCsS-7LNxGD%0)+#{vcD90CfVoUi_a4ycx1B6D{rkQcUD=yg7c#K`uHHfqhMS4#IJO-JDI)L4xekvSE5mEkF3}ufSBrB zL1Q*1Hah)s2T!5TfJp$lOU4XTq0U4#MS#rMxqYlIZFwlFd2=Z_b~Nhq>s%6rc@oe| zgW*eDe`-LB`su1azVM}F+}X7DCBGI8iMk~Vlg&#keT>~G#i`Iy-qZ{K`NbLk{-I2P zb5q^O=e_OSg>_$D0Y5@-rbIVZ(ix90SpPm68}#P^IGt~bA^VMPLhX78|dgLHinoG+!Fb2%C-#_`%U zL4LTfs)%Js!ONPlzeA#h&?QS*IFTX!NJ1!*d#RBlV7WM=7z_`1(7b0Ah$Srq{dNpg z27T;1Aw8m7&O+KkQrgDvWLx^X44L5r*v(cpaI+{pra8)}*y0FlhCcAn;Parsm{o{M_ z2AJ<+Pl)3BJ;yly^P_w$pLM-sWeAMr`>c+J{$DDC2EnKoq;~@C|4@G6aPZQzno_xi zyB#?Q$$2zG_WyzH{NHqDEWrOeWtzmuIXLO)2ro?)4tTqKuDc+55Lq8XEhh5T(qpBc zrVR5Rv&66gJbk9VCmT+!M>9nIf$kP>9sJS9`tllMXW;E@vD1L5;VPf>9gVv4Q(lLt zv3ye>|GgF1+S=N9W9s@J8?*J!o}M0<%8@#)-);}sf;+>0bURAv+^o64Bt6BRjMXj$ zEfHT7BrX6;G`?cp({&pbP;hHFueY$B$gpQ>JK~rwQGIEz#E-uc$|BJ>+N9%ze=NPm zJ*H}FsI?z-ybASH+t<6-!j*tvTuZRf^S7)TG4_#^+w2cR%WH1`F+D;KO-E0$({nnZJ z5GEz!+#q-v`;d%>+qli`lyrcMtSmEA-Qsq+~LBCmo&{|n2fv<4+#CCTF zQ>v<2wIJ2#i~=n%jnPL$(bTd^g>RfC9K}~Z#eV)?rYlLLi~X{gX4t-g-=4z-c-z39 zT5Fg)^JcdMnZXR4uKV>scLft zgUqXht#JLdWA%q?wFZ4N%yup4!Y92xvcdu}5iZM^Hyqq$7mhbeG>r2iFD@K)7(#rY z8#~`1!V#X)Pd590p8U#DoyBq&N@9yCsdBq;ZTh@3jIuOb;`FV>wM)nX`r?*PO1KNv zdPovlYdw;U#;If5QC;Yr zrR_h&OaS>gKX~j3&gxV-R<2Ws7N~T{pcRKzmT52cyBNG&jfZR3JAK*c-JFk-_lh#t z(<<*JjeR`RJMQsnXr!tGUsQ<}xHYe}0e*ihyn8sX`Jzg7M@v;xO(U;rB6z;`2eB;Z zqZeQ$bHw3X{ANTnU$Mk=e>pVF;myE%n=H!+)FeB{*wDpC01UMncC97S%MP>^?CHnofl@xSn{C$VJP-|FE$WZ=m4=?rxyiX7jC0L`YpAwZt9_?jX6I!}sN*PmC~d z?`FQ0iUxEw5;eAFNF^L*EE&k=#Qv4E2X=sdHIO-kKrU8Do9Us><5=gIP$~N zisLhLIbWp4*6Utqu)xgIY+PW|O4%zMEvmi4ZDLS@Y_mbvyQkL~T)>`_&G}$K5>0YgoNFV7hMzSYAZAtf!o0Kl5WXNi77z6>u5vO`WvyN*W~@VCy(9P1(7MVU`vk9 zAq;@_P46+#)JnDryF{S0n4_6c7- zJ8xVI4+RbHA2e+5G)e~wASp)c=Rn#F3j%05k&?~c9oEPRl?y@~@C*uoL*`9n<#!}yJ2USy>+yf={Q>7)*5NEsv;g6gyb4B& zXUE@zVbj*Wp6zpCH9xn0D1-+vqwf`8u%!gK<9OYI81KP8a0pAP+4a{ALsD+WvIdp4 zn8NSDyd@37Eg3TTLy_H!>zder$R7TuAa^g_=3 zEG@(1ZP{WaqD>EYFrG}yV8T)Q z3=2S|w%4fGd*GgoC&`@V?iPbvz4*_i6~(1$$0S*P?@TSn(el&br4_X76pR9f-)ZQD z%JyPhae{#AIKt zWOy_86>g62d@0`8aH2?0O&6B4Hc>K@bVK!ppDIW?FfclzMEI%(<(kv22EN-!SHFfw zBrQo;tc6nbzE^j_Ywz3&d3zr)MpOG3{}icbi%xdCp5eQ3w+;SCA2TT)TLp4Ez#}{u zhVjMhu&x@fY7JDmi7OH{NeirWd?@x4tUTK2Lb$D&hx%PP z@&6IfFn>mGSpTn`!bSp>Ba!wOdNs+e~ z5!tGe2ZJ$I+|r@AAaqLkkLh7`DKo=9?j7aXwd^2h{L_BOr2|R3%A4gtDrBb z1tC?ACbF*2)Az4VLXPN+^^FZp^^MaTz0SK17o<+NW{xJv8u9Ps?)$)KDWD0$?|3uW zB>U0}>h0b5*72)||8&ZEWmT2y((qM0j%jn%AS1cZR;|Z=;aK1PA1kwwOXq4K4Lcpq zUBzx-3A!F2_?|E;YmcCD`IKQ%hFb2lmkg!FrUKd8THY6 zM$Kc37g6%7!&Nn}H=}#0#?V9FN94z+a-%zRZ-)1u76o+d*O3;=~<<7QCtL)$jeS&BKIEe#<#v#UZS> zl;Zoo{PWAU=U%|_6cSlm&A%a)a?@U2j?hM}Cq{es8ElCm_FFH-r9L+{7n*6)0s-pg zKKXVF$1LXGD&0EOk*@Ql{CIR6=kE=e_^?%qKCOgdL}C#U@f!53?N5^X=?CW-N6? zNWLB}cl*!>97|-_o6rCL>s+VOCSAXTOTSH@^78X8hpN2YmMqKWP)=Ld=af@5UK5+^ z$DFdI7f>CG={%ic?`HFBCJ`QP+sWSQ0x>rKryQm8D7AcTv)0eX)geCqznV$LTI?Cg z*C}W9G7NQYTGmXwl)}j0dIhOBEUk1I|MYcc_vZdv()fbNFYp%Cr@caqupvvapRKL) zXmiexCiNG$$X~J<21oM}Ty%4R@%V~DK@Aq$`mm5B zM6ai7?*Vs7gHpy?&YFEE(GjDnjbYApu5ZbDUUH)>3E_*!K$Fj!{GD#`8;3pVjTWT& zQ6rK0yr7g}(hs6V$?9P`ST56S7P*2?qCPp<3le zpn<)1q%)D`>0Yn_NJpKAh9|povJV%JkWV;agN{vEPRw~0QjsxvK&#Q>#XgsJvN1(ra1pdbcBt zRr^XLg_c(0wMz2|smmxN_lN;&4#MU?%CzXWzW0P9pJoq3C|o$mbn^Is4<541z_&ms zIIoVEgY}TOu$ttHvP>u#YJV`|$7%r|3^Lv=iFyEJCkImlRO%uCFrhD{0f}sJANb!I z9*@;9XIc1J8GW|ZHYeV2cku{m!6u3WxReyj{z-OpKxGn`&>QDY)=Mf^d3o)CCf4r z(BW9=I7#0vB*;W*?eUy1oz!Wk$dPiI)=24;itfO`03uM6F=f@k6I}scVA0{0orQcfqh4ZMF=8B@`=JS^v z`#syo7H}m>(4Qv|A&q*=qI}-`3j>|8873p^&l)+?nG8p&)v^jXgR1%@fLh6QqX-FU z`19Uf2J*0&Bdp)CDt!8uE9DMb8B|1oqdj)gJ-@+&9&7;d-NN$nKK|2qv@m%znL35n zjYbWs>NDsBy(s@>?Y_9E?;(jU))R6Y3{mB!I#qv(4d>AfDtNtWy$rhWtONBQW!LWm z9pwud_EvY9S2CZF29QKgR<{4$wY;Xq_2U8O{fFV%etR55H;cs!0jsh3re3=(3ndG! zeS-gHl5u4I|AhMg19b4;{uN01KL94wqv1yCdq_1Fyf=6h{SR*#N-xyp%D}IK|1T5A B*k=F$ diff --git a/windows/keep-secure/images/intune-protection-mode.png b/windows/keep-secure/images/intune-protection-mode.png new file mode 100644 index 0000000000000000000000000000000000000000..80804f79462534e729ded06ac99f27b7122ccc65 GIT binary patch literal 23667 zcmdSAcT|&G_bu!>7WAN?pcH8bq=-^PG=MY(RFI~i6e&@Pw1fx|kP=W45oywq08tST zsiA~UL?EGs&Z)1-`4DQ<>P^+5;`^x&n7rBiC9@osT?c0Y; zLx1;uj~{yZK2h;?fAaSw zl?y6bAoXyIefu0{OpLDGed)uE%CVUn$x_Lo$~-a8 z+l4i*{e8_-_Spk5c{h&B;Y!VPhYBU$skYPy&yljp@}y7ZodWcaCS89j8h@{dHn&ng z!>474Gc>Fm-*|+`XbC34rzD~4yP|c;2*YEuM zx_mq6a-#;h@a&t9zh9r7)nY#Vw{meU9#UqCa7#OH*6|JK_0ya*~7^`(JYqd;5n>;uEi>d1-UWY z!)ht=zu&muWRQTWleJ22!Nd0Uf>Ul5QdoG7`#J}yV~SmrYkY|8G945K{+XN;pO`q9pLv$u+KWxEE*p|6n3ce~3k{O{RbIS|zZ zLQ;(O236Ts8T-<^Q&0B9hVS)VPP=={!2XNje`l*~BdzMNtdXR)4Y$n)6txZMN;yNP z*GHu2lsrbEu;g}X>|(Tqj!l?Fd^tbt>S%V&T$Cd7w^0+S402Hfh>W2E)Rg%899_+P z?Lw|k0ROAK?{MmVslB_%U8Vc4WGex4J*jUcj0EiA3NqQ}=|P>vdMgTW{*&FYa~nR( zjOzcG*xXh#LSjNA$xy%`_*K9y_d|;}6QcmPc&=*2Nv^c^D>%m@TP4Euf1ZHqOMYdJ z&EMgSs>$CN)iZgSY2=+YZ&K#jqnnuBn+v12-<+u03ANcu6keMY@2?#t(7ePN3!JoCDVw@wwnDb8xAqoskf6mw?I;C$yr(dB+80p zb^7@j(7j#$lk`uJ7Uq-xIoFKr?fbtbn}1R6VU9gICVQTA)=aMfG5@a3b7$Q7_FBbh zzRDY(rlS^bbw&88Ken>j#H=_Aayc!m zPw=F%;}l*#?{5s5EKAL})eh3uoi#OalN{O>K-@{`vo$FWz;qM&$hn4p%AjP#p;mN(H*&6y5E&nr(cZg-exqHl#R;He>W ziA&K8TWi_{r%;Xzg&TQt}dlu zJkT2Gv!b>KyAFc1HsTE0B+*~NXcUkLf^&QiF*Yo#7iozD1b8p*?V7)^o8(f?QKu6x# zu9%vM_=mcTmmmzXU6o8-RVrPDdNPQe^UrGiY$A#`+C4p|QZkB3m#fW7$BD(wt{(@* z&!?$QZcID-juox<#TJbIYrv^wsKq~v!`R>~zQUr&%xOcS!1dzoTm3tH#5TSk?r?9O z2{zMK(N>3G5o^1rV_A8N`6}K}*J|0%i-?nu`GYMfx|)W{pg(NW|u2Gb4F3D zwp$Lk<<7L@TPq)%y^;?Lu3y*56pC$lwluB#Idg6f{|A4no7I{W_T^Mirh2ryKtoFoMna4 z;(I&2-3-2xDu(S)X4mt0+*?`yg=-FOV0tuXQLpb~=Izf$$6ex?8#8T*lq3_GLeKOA z?!Cb>-P3mxC&NyYonfHl63(w7#Rki4eTzda54FSp3A#&XP5TV~SsYfPcPJX^RWLz& z3;%*H`CB;#AJyn$H8%9fK+Rovn=982rV+5y>RJ`x_#7jmVg06t^I(!2woWL|)3UNT zw{BSQO;cZWCSiV!D4*ntdGu?1k{D_32hH4)v5v}S=gB1n_HFMmSib+x7&W6b>|N6m z6Bk2J;u-T6(CYp$Qu~mfn!lf_#HM?B`d`qssn<13?i|PbEm7uLd2!~MUhyrSon%<7 zg^Z8M%bdvk^+;^M`&TFp*%+maBCN08F$m;-lPRaQVAFyaYE8Nxr6(&NUPfT%{4-nc zZP|Ia4G+_NMkk97H@=g5c(XXyC_SYh+55=#CI~;ZMlYH%R%o9b-?Dcr=33Eif9U1< z%F^aFO8!N|C-|5U{|~NKrZ;wBG^noMJB1h}maS@HS9i%qNY)Kg8QvrBY;^-Syikl= zCJ*m=E#I1rCKsD@zxn6uzjw$USuMkw``pc>s#`vnd(D$6nd`0Qe0ht<7kWndqV~R@ z1CP61TMA%)yLOs?)@ka&O6<~+)~|aZGko>?llPYs5Dau``)e1+frP>4FH+!a5L~2i zP(ugF_UcN}pU9Ygw3oY8oj)8N=jt`F z^yarXxccoA}#W<0tz7(+WurB>i{0jT{CAzo|UK z+0^G?yBIzm3Q}98m+wJxAu=gbe>8u3vTu{;A@ug8H_`5Q12buS8FvOBReX4ChXsHg zB6o^CJ^i1Zqh~1GEOJzork+pi<{$FP-XV(kA5Jt$w~`YY1(>{CKaiJO*PCK=t1;6~ z^VD*&T++vq@cekMbC@sIAyOZe<>>gXkmb3dFxqT*I)!fa&90#k;pGnfko@>J08uXf zR`0PZ>pyzHYLhLs`*@wg;pe#8ln?9Gc%RlD*9=)=0TS;&jFPR~HCO%z=nStb&Uj5L zc%y&vqAx%Ng4enmQ-G`*pfx>wO*jI{67p|>$P~Hv`x$dlj-=%Xy0qY*_b6H`eK7pvw(t(&it?aX|tRL(&3nBayY_5d= zHD9%s(wX5L4ld&;tk2rw&Gy(4TdVTu-5&Jvo-*yib4Rd524rE&d}d7$9re$i?0xFg zy2f5a^l&RL8g_**=2S}O^qJlL@XV|K%)G|?uX%C#r2nF@;V1uBVV%4_vD|fhv?uKBB@jopC z8!7puVNWhp{b!iYr8e2*)8=L}M}7|q`+sxLg6V7{U*8f|h8I|O;$CQx`i;bAGI^CL@NXQtWS zhodDnG!=02G4-qC>ODKtg#HF3a4xYU8Cf%)Kw93|?v&Y!yX0H>iWZdkmi?qZB0FIE zJ4JdCx=jBF(Uokoe3%`CDVKvgtWkb2?zjRsmLJ2!eVS~a|LntM7=?48XBL0hmbFSu z(|nr`jtiYfbxGlKYXC2u0gz#EJ##_bqk+0#IHfaci6ECm`*SY+1fj_&lK*)@uICTl z6e=`fzvTz=9aEY4@n_%{@k$qCs8o&0&OKqQF?^?KWAp7h=5fuf_hB!Q8v$fHaYn<% zQVysj{Ye?$)Zs0_=A_+bNd0RD%@NMb8R$H{j0M4PaXDi6GwZR6NOz!#TL*SPE88f* z{;5*)7IePmE{I)HYB+J~D&jy`>{fw0A6~Yp4#IQS} zfGef701PW6ZwxjvH8AfH=U#LSSrt0BJirb>)oB*8h)0X^roCBl$cn%ahbIUp(nHW# z>kS&3W?L)BdgA)WTF0?kNim9zt?KZd*u9ZPY>uG`R`}&fh%gCa=u{npo z^2*e87)K%=I79~Chd*w~)cj!n#atbGx0$>>uh@ZX*6u_P{ve_<$R6q~TcBGL{Y+`t zEhi}oqyMjf8mYx_&`_Vxg%54bv9!8?S)yJA=L7ZjVooLzjU;tIZY@6nJtq5XHd;$T z?|{%6n1kznm!Jkyf3u^WKG=S$IvT_DK^cSE3%4dPLauHDYD2D9U=v|+9SMY}Fif!i zn7CIOSuUPl1zAlXpz?RB*V?r{!bEPw9U-3I99MEz3-pqlSx3#puSqif3e!Igb#BjP&$m}tEZ7IS_pZ!9VmF^Lurd&&!FZ^={43=YDFWFkgJF(-ks3?uI~h6>^erJ4WzCYtcS9#5RG1zv z(x`hNB=o`Oh@md<2W!%TQtI1gjPwVb_t5 zBmoXvU0d~Mj>sT-J?~^A0foGoJL2+e2As(l;1`^3(Ru~z`GEpo!ymb}Q%q3Z#GC}3 z_=I;+;-v*1h!`mJtbJo@N~!A#XiCL*1%)XTY^Q*#H^i>#Pl_BZ@c^sDdsK_*^NtWk zpZTSQSCl5>*6PDBnXx$7-h)O$;d=}};@$S!$xSXcu_AE<^P@<`k)y zJqSC3gxw9!-e^!MC@9N`*5tVbw$l$2t+vGu+<6CSnQXGS%RYzgx?RzVzQn|k#v+gg&pE$1!q)g!_vJoq#YBKh$@IJc!)bVS z;3h|ub-b&pCCFuTuZqx`z2Fl4rDLE^_;O+h<`Ai;TfV(~qBP8+4p6XJx_p$b?r`5N zjz;(t;;v28X?=>n=(_-6+jGQQw?Xq7FT#o24@uWboB*#xcv&s4y=m$F460u(AWvcx z;vj_Ft3Kww_qqO*ULy-ryJbd9^%+??J~5Hj5Rx0i{(`U}OU0OYSuEKd(Ik7R1Y0$M zn(woE%wPYgGx=n>wGKISPr%+}E+nP%d4TM5v$3DY-HZOl8! zVJDr+aB0b?@H2hkYYIBG@Y>0`Ze*7$g5-Rr+#yR<2x+>^V9fk>K<$MaQOKc<^AR?2 z?CPg&>OLN0kG32)yQ<5HN?W%LnYxh?2S1fwB5O)+jax%BRH;3kESnVy29L2V%X7M@ zu=XxKVAt_mAD8`7D8>|RH6M=s^30Vjzzlosse>z;y>WIstp<^1{u)^Ckme`ZUzzW?Sao2${&XXp@9^3p4%^p6$M_N^K{f-&m%A2#< z0EQOS}`EGm>hFLgY3m!bo?IF zxjfUT@3sQ_!04_blDh$&lTT`E#Yw-2g*z>{eRvaF=wOEXwk&k6R;}>5=}M15H0+cx z^>%qv#i768Et3}>tEJ%y&bx{+`FKkZWn5w>;|hwhP{_ckPSq{8Bc{dy2OOlp$iTn0 z96PY>x0W!0rtB~JBKwwzIFhg9nmVSSxf`IvafCb)>-Uu@r_u(dmt6?tv1zgCl-h^v zpYF-{a|yIbHYfYkQddpR>L1$VQHwaFj_KaVL?Td}x@8vs<169?AEW%4cTbus>C0Ta zmoWP+!$pF0$OTrhmPQq6y97KydF17r(H{T~1|xLZDwh<%-HDqPy+m|;PGdrN^p&tp|St@qgrW+*USvS|`YxFgCc0eIEI71-1vn`!XLi=CX`{wQ6rV9Z2VZIbuGBX#CVo0t~SgeWYB-aB1l0 z(ob`LCKRFPS+#3MVqk}&OhXfZp^eCytL&qM_~0iK zb8jJmysH^+otHlx`rK>pe_%mW4F2T!MSd8oLe>lxb4H8&n*?>PX?D(h*#z?QziBg; z5$5BcnKAw*>#xY=5<*8)j4!JG|Aa_s>DT&Fe4QusCd1gkTu96Mj0QZKv*v&s!ngEi zhs~NnS$#RT-~8r-ZU6GYKJ0d^ZC3Q&4>4RVhmOUKYmmLmChNwRof`+T^@2VG@6<~H zfZ^*7xQ_F-hF-t~G;LS);QIP3s@TNEuF;~5oSBW472l1W z?O0r7Vt8pVb$w5;3l~p+1ann)#C487YP2i4?C`_??k8Fe{jr)h)hFn(7@QZm{EXl| zdJgGS0-=YW=@B87;^H51X`G|P#n>=NdJ?RKij9h=*KCh1orx{cSn03NZi&AVR9N2Z zDh>7W8hu=rVS4a4E6$FG*ZOKO^>^>WuR446H3x_LFU``rND#Dceeg!X&`7bZ)5Yz% zs9O0#eDjD7K^`7Nj?f=2O9CufR4ht75>V`VUCB!#&d-IV3P_kdctp>KI0`M2-fmYM zHJM35tzF>19@WBs#b%?4zsmnOO#D(?vN4)0H8Y%X*_F(>T7_u1oF23+oMt4sn=Num zKFRdDCZ0?B8LHfXu{Jqx39!`NXks1mFE;-hGTBfwcJW$G*G#T#@>rRZk7VdhD30HG zg0IGBM(nlt>FI|v6)DC#P2JK(+PB3wWUZFV-=U2uJ3H~>`Gir;LBPcrHvui4;!Goz zDbhXpBq8~vnePvN=L4$NH2C#LK#1Tr_Deb~h&AY=t3v+3)Dn$yhW3tgN zNI6>L!<8qVf>VsghudTx0D>q9A&-QDfVM!Ugv#=dd)+}}@-a_%A_-`%zu)85L{Sn{ zj8Cvo&)9MbU~FuxD)8V4@ciQs{ip4ddy?2P`9Ca?S?{4V7Th+T$p|N18qQ zOU`}7l~*H#I+Sd|UT{g|tdFbodmO;|3w|{G-B3|U?X@s019_CZx?x`HgHd`ci@iRTB|^t6h`o04&=wi&)>b+ylj=TqVRqV`gY&HKzrANz>8ck|`F#Bz&CV&6R6Ux?k#KW+AjmP&##c1z1Csw`3BKKOd{2xS1 zIDia6*cNc}N_Y*>>P&lriEK@TT1<9)BD-Tht}k@#^mc(Ca|hQ9ucaW~`%bKfFq?fs z*Ue`;dTil|9D0TU?R22pC~uxprl0HM*uwGS)32t4c76AIY23H}Ie91vAlImsz9L=c zcRioY3z)As(cuve{YkqI*C57Udvl${zIL4z3jl*sX;86GG1nKLo#a@C<{22sP(Q3f!gg}(1$!gc!J}a1c$l|*e7u;CApd3ZhqBt% z2pdKg>H?o18^6-#*e}a@f*v$q@4{FU@mbc>pk2r{v6(9RnEu5*12_N!FD>s6J0*^{ z%Fc^lFBx9F^jL2kd0l^2ok*d3>iK9*gAOu zK6CrAp)Y$wNK+D;j!WIrd65@kC^e1iMRs+#}5YvTERofs78Kf zgMSo&SZH5TnkZ81a`Ya@YqwOQ3^Zn24@4fD{+pmT+t66jeuFt1L(2mJPl&1O9KDN` zS}|qY@ys_p^DAP_O`nAcH|)0(9~&FZ!Vw@;bguq!-g-VZ6L(Bo!KX$0kq8eJ3UeHE z6j%=X7SyiS79NXl@R^K8ThJRsP@jVa`zg^6SSEzPfUpYZO63>s^of|+Fqjx6OCqpo z?LHAtI=k)88V1}1g*o*eYHxvvAE5Fi#M4cz6VoJs)p$K0h#S}leT$o%h#uSx`r72r zzD4rRr8ip&dFjWQB@YGYW9S0%g>+Izr7Y(C;bB>vk+BN z@j5!bowMn)^T-7Wf89T+4zD6EJhVmvZhp#Xyx-W4AKdT^#jSY3%|Pnf6^9GJ4h41! zZ?}mqu=YB4wU>3lgLWQl194OKjrJgoz9028>oT^xCFp(m>v+Gk<9LGm>DawBENelk zFZd5y2`l|=sEcJ0@EV9X5oeMY5j3M;{RBp|`#!=W7bzQt;Pl*jXj6%Ew+hTdBawHi$04k4G#`HmMoWx$&%OLfVgyCPH{1s~* zl`!P07*FfYb60DGkAbdDVAy~jtEBl3z1}U94LeIn!4(UQ0q=8IFr!cG2OguoOC*fC zmDK!%FH&*mEPc7E68!)etr|&HmqC4$5^)flcZ*&u^w^!SYg3P_ks!4M+roKZR2{|X z`EXXEmDL4w-zDZzv%lp0LO0*3cX-5(GSm|_m=nyWYoeDMe|bmHQlF$#y&b^ep=J|v zoBU>*n|UFWOrsn~z{+|b+0>zMLaGGHvCZ{tSzF%t?WT^C8lSv)!|y-YKvWSMUMLO2 zqInx*KI8t>xD%wm{fxJTroqz6D>@IzSJ@yKZOTvg1Um#sETcyQw{Pdc67^w&;HUjS zu&MN`IV}d5_I0g`1tvYOv>Rh6j_p-Simg`Z9j=>yTCSW2JCfPp$sAtef6YcFY;;r$ zV;kn+!>xuqqsXUdD{U*G`S*0JQ?aI(*kfNiu{Uep4!Q2)C3w2u0FAgUOTQa8Quj%% z3ZHF0S+mjx-xU0>cj?p7LwFeO z@P@!C(~$J;TT-*kuBrLhh$(8uTycD1wQ9%GbT&yDg{fTE>e$yq4C&Ha6olPY+y5l2 z#*#}~ussc`r?p3|R1>Ns9Ks6bohnU<)*A=9AHu9|k~3_$;Fuk2G6Ql%`&HGm+M97c z`miDPDJj*On3-|j3}$$U7k06C+f?OwDtca7;-gm zAZ~W^MG?u5w~6#1z+qj<_dp1=JL$R>O86AD0fm$PaK4c5Fma9`Z!3Frby1;JythI3f!U>ob4nFFlfwHVm$fzMa zg|A0mE#;3r?YjL+bnc$l?trbAbr~|DQgCGqroMW|JzE@O3*p`Jb$vJm%obCgQs`5x z@5AWbmWWPQasH7TpY}}6oC!PXB5KP|Ow;q(AYn|W&M}>WXVF|Y7TVdPA1^C?;cxBG zC0J+1p4c?(hkkSef&^DX9mV5UQ5JhT&!_+13!F}DF%~CAU|X!?ni4gId{s8L$}puD zAIWSRnpnjp>uc(txa@n}VXfQ-Yn_mm6Y3Afn$hzydXu%T%I^^$cL=p#Cu*SNmg246 zKEcFl$Y@kqf~0z!M^S`!U!cWn-N2mK0M>knXO#e6TpYdEY+7bLR>by#3W2dfMjghv z&*KAi2JJpHmp(`^(Pu-`4oe5dn#;`2mr{b|_dxWO6@|RytC&!=cdWiV{wK_z3T0|P zp!#WPh^}t@15!lL?4+efK5#OZrm)v;L!_?M?DQ1}8<5yawQ1nhfl-7N5Nprf8|R08 zJmC5b^HAJ*59c6?akr%d@Jc{8oBeh@I4Gz#cri^KC$&570au^zi@xs$DvxP1LULE5|T%-@)~YhNwCuN34fZMI8VA!ASdDzE8_1Vb+ZXa1CgE@ z|Cn5p9ocaxzKvsABsfSYvy^YF{CgQ6E*OJvf3(XvGdo@alhEK|tVG&SxkkiR7ajn7 zI@2|G)1my*>dG>}mNM?;thwzErBJ{CDc0~je5hRgxua}xU6*)!Ywq!fcc9160pA_v zW1pGKcz=~$f2>&{E0ChpglRX|Be^N1*Bk-v%3pLg{qv0pVyTMN7TV-eA0jYLRomN#1DfSi+fab*DFCn(4Y~kfFCJTpis5MahmuVqJ zEM=Vjd0|tXf*i1k`USIjhGgaZAzu6$kMK$;KvM zCoFFouD>$LYgUnSTP!S8JdvXj6NhL-RFb1-Wyk5v{1TL$uHZ;AZjkQxKQ137n>4(3 z^1s9VU)Bfv@TH_$xNxnd29T364=>l*#?AeR*tOZ%tWv$C0Mr_qXn`uE%KRg2&iwpW z=G^exn@XGe5V3V*gBHQ|gEHc4vwSps0gYq6mkRMtp1I*G(YOr6t_^gpd*pW3zqB{% zw+!0XSI?V~rMkz~*MRIT`&U&}4S~>sA(a73?h4yYjg6$H@I9A}?|DEUazog#U{~oQ zT3HPPq2&M;_jC4 zT3GX;)eNKyK>K&*!5`pDZkU|l{ImxD8Jw@hoZIdy%BWRHXDP@%3?pE3~iG zTrzu6z9Hs^tIixtbM8m@sdo&?RS%^~)H@?df$heiev=s;R>y!_OY^yiM9la`rV&H1 z@8N&Kei(B*1!s-dS#5bf;VszdQ0q&pF}n@ESg#N>Q{yw1h0Wb_-iQ>gHKbjse3vRT z)V5px(N!gr@m@7HtTtGZDr<$Q4}9jhEU)gS?)2&aSQJ#E9u|iUlS*X#*yFldOJB1# zfuYkw(UniyxJYqML*JZU4mOivEhZbA?K|s@mKoZHM-*y<xf z)rg4INU7cLGeHr|AO+Q?pN2uJ-D!x`=8&D`8Ej$rpw4Eyh9T|rY{vm%rO?|p@I>vG zpCH>VNIT$CH_ZO-?8Z*WE(Thv6};|7s@=9ZPW*OosAf!eC|YvN7eD7i%edas2r&7y zgjFI~;q}^3u1*oO>C;>`3>C8wP8lwHzvFXI<%!>^dgKLUESuh8o;z-M0CoNitU;uW zP*3`TA4XBD==(_qBq!atQlu`%nkl+_^sehPF*$Q*9?6$ptEaG;X)YEK%-=w@afysq zOmAhuS{4K8nQ}`g22Sw<03-Uy(Mo$TsImuheF47z+>L_7r~2C8U-{9^k4Ds1(6SIP zREYNdC{}(@qmKrmu7KEDxu1MOFmXa-GDs^SP0QL_n;=dRzEcZ8X=*oKsi|L>zx!nl z95*(y4O(tp5AMAj!bh#cWPT1FeG&MH<>K>Yl`P??-4>S48c0whtLkdNI91goTt5X_eA?{wr&GO&L|en2YHilYV+3Ua_|{@&I_0ZYwGry>R{VC zS-0?C=n%U%_59I%vrl~3P+cf{j*KI%T81~8{~fWR5m9x5O7zCjZt>mNqP>G9u>{NVFgjk!NRKJD3bC=MyCH|NyhCL~=PVa9rGN^50{z{=hR3l6yU#AIe9hZ?Fq2C>{5f)vWGM{xARA?tlLq?Gfk%PZgDIyG z+C1$88AHfqk=Nir^-9<|);Z(=EZBwhnTQd_;?k)S5p{`BW8$~)3n~GWF!B6VgP=Eh z4oG0NQ^$qPd&}6ka!G5EHec~4y{x%?7~_g*L9ltar*slEOG|G*M7}q@Tu^HxiI)-gLj>BzP z)WQM*V=%CGH|!XGIXh;xPw6G#-M^00W9DPwrDJ^!h^k!l)<$!WwuS9`7tm$)i zs)%hMr?#sW!D=PvGsxWScLHw@)U2Nj`|+djpJdh=;UIvUP99hocUwPrMLGFM)#Gcy zB|vW3nTvtxh`i>FrE~+~qR-rTHdONf> zWbX9`yba4@JFsRo2lr@Y{QvYCy`%S{n{&}Nh;^`FdzD(iKsFH^ca+?{S3g!O%({hr zG6$kcc^N;nFLkr-Jq46bZrMMa@^tke8G-EMGV(m)su2wc6_l0K9R9Y{fy;W&ANsAt z*2}N9ji&iPY`bz#1Lj2L-GaQe1*TKt4Zn`}6X(OvX?F-MLi5ZeT?ZG4=~|OD4$KnXjZy`v#*Yid7Hqtns>Q!u4y#+4W5 z`E`n{KfBX=r34M#i%(ikgR#!U_&_gG6iVW3YycSHPgA8L*8+Vg6VRry^nsSAC6j}| zI4qZY8;cFtj!ACDu9a@f2Rv3OR{LWIR1+|Bg^{28PHl9vouIoB-UXvZJ36pF0poaE zY`yxHwB(F+eWojdit*v*h*F{+KjuCi0zw9;F{&6bga(?#soLFO86OhHvdq(%>tTH`a`wE-k+G#gu5SGEL0 zP07)8!?H-H5B#&1vrheLOfV+IMT}Sk>xXstyA%%J3=P0%o2M#~9O6JtnY61cWz1vk!ZejL17m=T!WmyMngFy20| z_e&<)?JAV=^rh4bdNT!u-<@?-Iuqy@`0}9YIXzYIpH{%ySYF%Df+R1EzZ-u%(64)3 z)KT|L2ix$mIvvFr+fidQnqSa~4L^r4P-;(?UOQP~eq!f2_<_z6@@K3*`FvVh=%5qNcFg-xt~}dwAJk;tm2OXyp+RL?g z`6VlW^5CdZ)YI$Us5d#IE5o+1IOPR+xYUp4d(ijd!U{hPv4`1Unwp;L#5Bp9^DhYGGACnT6 zI6v#*zLM%%c4zft@APfw<+CuM;jjxdQqYa5*s(3X@yac;ZS7h1EymUsv$mMR^zD6= z3Dw%xv7UAc2FiFQ!g!h?+dAS?k>8guu=x|A_-yqBX6M)tO}6na=>EvmxxmqGlZeaO zYA+j9A(8Phs|txo?3MueGARf*W~Xwo9Me~Vr1Jp~jae!d9PuKUb+=gjFc-VP9zPl|o z=&zlVk6yVV|4h1wDo~q?DEh)tuwr+4?oTmJd)n<@F+QQt#+|{V>*a!<;!5ld!`+c? zUn9Ocw5#3|!evHubhS3~1VVI(#&Pv}!;A1pf4wVlOz&Ri)CJAc3`_fsL;^8pRgt+l zeLXXpTRYBBD0%9Xjz16xuJ+rI zpeWa#kXU|hMV`G5>E{{1wz`bf{uO;8m!~zJvZyeG$JKDzdtb z@+*B!-A9aCEzr-*_sEZL8IFDyz~ajvWD>LXI3MKHV#b_wURH!ZUDR|{OCx-~!uCm& z#NHL6wX*WpO45|?#3ofg4>#54=GpQ_0mS3e@2Lg#kqgLdNO;HkB+Ra-Bax1h;DCP7 z!B0NwlaX3NbDWT$*Qd_VMlqK=ir4i-f9f9Zf20lc%bu=U*PLH%Li4Pt^!*T;F8@4d zExbQca=Iy8txq{nyp$s$KWAr=sH{g_Z9GZx+S<;{h+mD_xS1o}bWBa$aDLu3QFm_7 zDJN1nQ1W}2A;sHO2uvm34umsE9)WTBje2lUNsp`ByhSi5Bc)Hv zC*9;9fBe`FYyK4veagH)lQS6I{8Oh%a4m__Y2{Snf#?dA0>AdT+FpL}0bq8&APw%+M zBK&l*$k7csEbia}^s&=)EJ1ksP8QJfd_pN*6nkUGQcWl*!A{QKymlHa8fN|z% zjR|WW+o5X(?ZA54ILxXuiitrPV5y~G7a>+-<~g`uOE9Yu@K;NR$ZK53)06#b<;;0K zX0>Y<=pY5EZ`CNEkUg{|O8UDvx;N5hnxmft`!3tF5M19i@XBOn;H&b)UPs^;m4!!! zK9D-xVd|TS8xOmu3Zw~bhqziCGW(g&^BR7{4~z;S@Hne?6gRc+Gj4pVWXYX+614O4 zDC{R~e9L85(B&p^3-|mRDiScx@OD22Q%inYu-`QN?Kcl02jTe}K<%;xQCyI|`M7 zA)~BU_4Vrl-2Xz>aK$)65D3oz`issVL7o3@_gc5(?LCYrHKe`Zd-QNuZWN;weH(x| ziG3eO*GG9wXM?_J9v-v>>Z`5X@zdeT8Nm-(7VeE&g)SE*wC81>Qu@+79pdD^T+!$0 zy{42%pRJ{-Aj<_9(~}eUR6Mq=DzW{qk6?5<5%)s zg-Lg!-zt#iEZIl07oPobBD! z?vt24jM>}J^}TJq4Tkq?bWME%@_6VvgDbCK?{pv1-g^0Enz@0Xp{5GhynA!0|AoP6r@Tjb-nAQ2QRCq$a zpol*V0b-pX1tQEB%1af-P{H*Iu6LG#vP##g@{Tv2Zd)Fk{!GlkUr=3>XvYiDBJ?az zoYEeW8l_S3(>)l}U9Q2tH+A@Rcnq-=dJ=%=NfF|*fq$N>6n>$^YbKMpukKwVggNbEGLy2B%hF zT4Lz|r3TTfD3&9!cJ%|lumH6z5u_9P>v_IgDYsKPb?+-9W;T?X75-A>{4WIL=@ZN3 z<#(+?Wc_u;`JB8x_joZXSCq9-wfO;jY&E47C!9^yb$w3TMpTVrMZs&v;{;T>u* z>v;x7mfta@_mLU7~a656_>BEn*M*nq5HsJfdGWE>O6q6ry*G6A@pQd z!Pu{b*}9X@f8^Ps;Z=C5?x7kjF+|m|6FaT`xx4*Sw*z)S&;8!2fjFgr9XmAa6<~aA z`MggN<}lcoIv=gTQ6hS@`n5e>h`h~*iVx_psJ1L?3@nV(CF5BdQ1m?}q4(e)tm{(u zbV-lo_5#anu^;7H+GOHPY{_v@rB%|2(65O^anxRSz(b1|Z`aq;^PnZ-hT4GIEtoy9 zgmWYg?7)W+bd|jY$XfF}B{eeVP-49?sSwfeqrx5>Fv^K>4nUNz~f2^ zYgop}X>rWKY57Te_^TEU_aQIDUbOnPb+w3lmnpE64QW`$=I*GPAO35!*GBJTMlfYh zELsYQ9BL8O4w+IQFpu?|r;L&OfA)^HZ9hZCyPjM%f!7dHX3zBg@f(B6z5uDjl4UE+ zQ{Td-`TeqOdMshE?;9M|F8Z=F65+&z}sB9AlQMO7~b~&Ic78c=nNT{ zncbc{Zy8<{yd{Mm(P1z1;<{}6F4eA19LfI&TOZa6`+b;eCM+BMG(UJjs%0RI1&o-; zhE12w5#!;wl^QYJB2+l55W#x5F{^+cacuIxoGSlYdU^b>^il;~`IbKy8^OWj;QEad z%gf7`NaZ=Xpq!9#6TQ`y6+k%xP0-m|7|W_vS=CRPn6QJ4Y5=P6H(!v4wS>T&)TQTY95_;OfavZB$PfXom2n_yMKLQ2h_d-=wXdYO;2}hYTZnyH^X1W z!8F5E@*%D(IXq0sPRIKbk{1CzEzaHKDx|lnFLxpQI>V+VrU9AsU5VH#0z7XT%nsey zof+;SrPNZwL;W}A%nOTc%NyL*al8<73q)vfaD_QwwTTn{c{0*ebN7(Mz5Bfk^of=E zXVcV2CR2aOC2fFYMm~A8n#^pv`H1pW-6Ub!bWXa%RG;dlX}&fbS(2DI)VC-nhQA&+ z#8q?#ScxC^+uapd6rjtI^%Fw`6dB`Co77&~h(m1m0fcad5jk{fWsZCkabAzgElt5q zDoCEyZ}cmupI;Hgp~BMr*Q)MOs$kx%cUXAnN@&y8vUZ|gKO?l(b|m^oatp?D{z5x9 zbJN1w?V2m{$PJ=g^{qKFQ|eI5xG(=1@NOc-Xq{N&gLAcvDBo_4C2@-)zJ18keUJ(m zYcrFX#whZZ*3b#^Nw7VY^|zX5`^;pRyeXX>QeSLVzoWR~qzl?alot%%Z77>JSwz z?7qg(ATkA>`ee2n&ve#>1+Gt9>w8ItOu;_{Mkz)gF%t(1D8e7x9e=RK5Zl`c*(vws z>K#};_qA-)J5wk72c^gQ_HGF*0y+p%6B&C`_e%kiaZxOBaH;Z20C2jh?ASy$FF01> zDL;+60zak~8%3*%MIzO!Bf-;iR6g79L)GCmv^2fhjb{X72On_G)&$lmqujSzzHH~} z2hwqeTN@|lU;RCXG+V00YpCPRmt_p+-p5~mQ_8~E;_#$2DJrdU(d5~bv$RK z(GG?D7MQZwFgX}{c6hERKL7Bv3wB^f3OU=)r~AK}IrDI++qRG2?Rix0d!|GaO4fv= zn}nGPWkN~|WtlQEF*AhhW|Sofku`)Ck}Q*DW%6|7FNyw;Tt!MwcGTaUhi)LdMO;jWaF-p;QAGEr zo6{u|jGM{#VxeAd{1++U835S6V3ub5IQTO4HW5&`ZIt6jZA;5oD*AigVq}J!9;oY1 zg`FPw@SQso*vlJDZ;nbK=*X?HHNzR+cZ-X~A#Qk{wuX7&_ly4|9tthpmhuEt{9rky->D8p07!DtO8Q;>_J zyXvB)QSOJr`jeu19j((wY)CVOP_vp3k019i^JA9>EOniHp;CpC|E;UB*wBut-TsXHPA-i$<@ zU^y1#wnkwD4=7S_b1N1@5`s1xh^?@El4%1^_raS$rs?mN%ZBKthI=Hm2M;TarQT$o zr@69Wty?y&_UcNW%*67sA&%7^BoP`SkWvXYy6$eYPY(07-tV=&MDELJmAXCyH7+wY z(=q_lVYyabDz^%pQ0BxtkQ~*%2Rg}PXVodGIIJF%b?cxOhWJcjeh>_8Qd7JYZ&RQ3 z0J{2CbXFo*KERz{U?y1^W(I2f0k*P!V=-!e>o6|aMD@tl41spl^0$x_804Y-pWPvc#r53|zc0QeL*3w~UxDHnuK3#B%*mp= zElTX2c-}8pX2EC~x$Mq#J3^wUtR}AH4)<>qB~RBD@4o9L$^Ri;Pwgj=cQR@GE?&1| zD9+!CuQFg=({3hbIpABvm}ofQFoHT*m(!rT*LSkA3*p$fzpOZpEv3xPz4H#cWov9` znq|oBHumFe#B;Nd49gQVj`nmfMdHK~Ms9h>hyooN*Qpx!221)Z!L(}v}|6mI#YDEH?`6+_mp*qbzfRJrhRk^E4j=|NbdV&XT3 zvgaF2vhf&pSer>fYdb_3?*bQDy$a`{5d~JqQt-_;$QJxK1QMYo9nCp^Od5PmxRw?G z5fCT&f7AgP{eQd8xs-AWQ2cwsP`GcSJ`3RyS^pqLgr;wFvs&(R`y^KRqvq@to5Y9% zQ7(4dUssrbb;+4K>kWGdVQ%sQ-pjzEv5L7K9=gTzbgoYfr$YDCH@^_CfdQT^E?xMNf3=2 z(vD8J7<+Xvq7cnLeZ?LuR}ewcGw-86p-VH_>|S|pg7^sykyo*We&$RCbSaJ^)s1ah zkElogl$XUsRFX_!bTO`H+{-zT#g8*=K`J#?m5G-4kA{NwK_wq#dbE$I=xl*yJMdb` zNcKzIU)FEb5wgmxo+1BznSJ=xddvEghF^nV3Q;4pij_UKfl(<+$^jtLr}36>U{xgIrw3Ia4?+g zZvLvBeA3q+HJej-c}AkAd`->rILnW>a`QNr!j-yP$r&f*WmfR?xJMN zR7eWeVPjb&jf0wKaXZ?HDq%5`R$T}$Es1%mWib4~B`o7)Q$qmL2Rz4_v{}u9PU^_p z$YDLcTl90iswO9PHuiGrdluC=L-cOlo8_63=|Rso`#)K7h5gm--QhM6VE`E!FHmIF zZryLRACQjc)2a<5J!3p-=Fp*O^=}>1Z@=-lJDcEkt~sT?j)aytE|suq*Md~$)Qd23 zINBFYv%FYF;H^vE7D0(SFZal!Dh1S}n_dN>q;CANT+9{RWckoobP1d$$0qL!exZ3* z3XIU;x&sl$z2f*>fCM<+ZUF9n^!Tj|HDQm)dJ}{&NGCOVv8>tR(c10c$xTQH+wuOO z>T(BZaTyv3x1xupop`M-8yR?n-Eb-ftAYlij$30Jor#_8^1tElEHvq|sSHT+&&zbF zJlfOg@R86md7@jTN}LDGY73+PZC!8Oms)I^#kTNTayK2Gz2@AiWTmAy1*))-1uCT= zStpR{?Fz~_(F=u=t0|3r(2It`sI7`m!+F^2)>|F%f3DZPz3%;(hPlBpVisjm^f)$! zVLU$_-Vz9_DjT^sCQwW{)eKw)4f7_)ETO_vKUtv4Cr2)RtMloMx~dns+v#9k06wNu zoIt%0m5S)k4ysTVA}b$pwB>P?CYK~H^j~Rp?&;gMv;|=L${-i}bfcDt*LIB@j;NhD zSBNds9W7GEfR9Ln#2!^#U=6o)|wdZhe@~=7mp0*ac@<7a{NfR z?3l~szh-l#{Ft>G(O`xP^YH3cI5c%b^(J6-~#msXGFZEPP_x$6;a`pT7i16uDP zCiV_mBh{ZR?Qa-_eVyG;sgy!pawQ3%*K4h#{aHbEe#xukk^L?FK*w0F8mSl7i%ci_ z-AI%;VTnERecx&cw_r`?PGur`O~#^HDl$IC+2BUqIpT^WyGs!5w2)Ufn83bwJrjbP zE2NcvR-|hKjqwW=L5`}C&lL=o?c$;4^rNTaOI`!4Wo8cBDXYIh#}%HPSnYIG@FViM zyP5Lm)7>H=7g!I%0?^=>tn>1f{8dPc2~fmOKM&ww7S1gN75RT}WzRt1D=uua+zaJY zIjf(CGtDZ`H!GnqKE`XTf8}D-k*(DCa*M+Sx+!zT+X#S}gvfQ5)G0cIimTqXuz#y!6< z)9&WQ&Bz!FPtep|5)L>o6kFmbdcu?7#=6q9^w!h+r^Wt~)b3pjCKB-aryD;WjkJ>n z++~i40|;QKwYmq)6wr45hgVU6;AGDzCCT7JR$xVpI@`<6`VGS0PxQLz)+>J z`;(~ZYD@j4V(OCRyD;kbl#0N6%hc>v?O@-%>%z=OzXgaI%K5ydB6TB>f0u}{Gs#$9 z@OpOLZ^i2VFM*JmJJ>_G6oo>gz_>6vz8U^VWLAq65=orper3CgAayZ_Yj6*>q;yaa5TLr-aDS zJGCmy&M=is|1tH!iDYz zABMM{hsRjlIVx7_eYEdAJl>A)6BHtkvuwcyl{~}5aGHd7LY0Y;hl#LOk&D>1@2PwY z=LZdg_?%$+6=Aj%bPKj*Pi{`$9Dl;15usA{Pv+;Le=sb zr&cAsr-02+SeZJH&JRJ0gLY#iIJ{-!yf5bUNBM!E0t(6yp2T6lh&NSba)6a^;H^&g}L#3xZ&Ig^JgO%!tBk>Xe8KbbHee)g8|94hn1d}Ke3XR zhxgiBjPv9{IalG7t*csWgX^1-^aE>Jw|)wmfyL@1TeA}TFRF1C8eHN(l{!A48)plM znAtsrRmo!SER>cMo__S<+*qK0WufsuhJD`JHz>wUz2Jb~`Q0UL^H7EL>S~?Si)5f) z8EgmIQh<&Dc=G6-->DEa;x3DS*9TpA$QNTXXFpc@jti^caO)yL&}{ctlrjv;O&EKr zOp$i&J<9sDrSlsTCZUO6u%&VVk>n*oy%h!fJm3qdDZ=ja287JAQ6Kk5f))J6h?l_m za6-n@ZnKn$ zQ(3WwJR92!uvl8jvj+YN9cjjeBl&`<8TR}f>||ogSnF`UcXvBJevzZZS}vo{X0j?Xwy%Y7Gkd~jEc zt-~zE7i&q$`{=jgx-dr-S-rJCsG!z&OLiuIv?vEq3@B^^lmsWGqs1&ghWnVVY(eE%B|-HX-Q6uzGyTlqYRK)Emc^%=`-<8NW-x<-yENcc2e)J=?)%hyKdu zY6Vp~YAit$&75l+6)``&j?w98;wO>31B)n=mD8n>wyM{@JUsv2JdjwDoEo$z@CwXj z$1zBS&5MtkohTO(U6kE+C%y11D%VbXU0mX6C&t(K*Q;moJ4f1j(5M00bs9pjGWb0s zJ>jj{3$MKzfR8Gm;^fK-2eZ}>>APT`n5scH2JiKbwr&WFplh&_l= zUQAuN@}%nZ(3*MV9v<@>KVjJ~g^x3TM*5<&q_=Wk$Cn{Uwx;^z zQt|64R<>pt zJAF3~CJ{ixUQ^mVTu!d&@-gLmK0a7<;HrR(3`5=oOLh~``F1pA?aAxjJ6^^R|DJm} zblLAAr$H*IzA4$nd4XuM@^-`-I}sHzWgQbvRi53_uD^l3*r(e2GdTOLYaE&s;u%yx zcGsTQ+pZIQk2aoW-TrZg@-#7vM7cMW$mbvY{?iGeQw@~{TP~&PpxQGeh>eFYo*%SM z8W~kv-!1q5CiNGJajV=h3D`>Cn0Tx~pWqHVX>1^4U~EcXzfD{j;WopsY#T#ntp<6m zdMm}{Z~evR98vqV347v;?5Q1sujDK=R5+B99*Y-frnA;+QE9ZGx%{?X3ST%jR%rWj zH}IE0ii!Atau1wauV5cP`|UL7X>j-7%&|=@dhOfRB$90VWvs-K0CVs^{(zfYFfKZC GGvuE`N)`J6 literal 0 HcmV?d00001 From 22de959f5b0b082731a4c21240779f6c977a3ed8 Mon Sep 17 00:00:00 2001 From: Elizabeth Ross Date: Tue, 7 Jun 2016 12:51:28 -0700 Subject: [PATCH 05/69] New image for new UI, renamed --- .../images/intune-corporate-identity.png | Bin 0 -> 7409 bytes .../keep-secure/images/intune-primary-domain.png | Bin 2718 -> 0 bytes 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/keep-secure/images/intune-corporate-identity.png delete mode 100644 windows/keep-secure/images/intune-primary-domain.png diff --git a/windows/keep-secure/images/intune-corporate-identity.png b/windows/keep-secure/images/intune-corporate-identity.png new file mode 100644 index 0000000000000000000000000000000000000000..4ffb6223ea2220fa6828b2963125b05c76efa4da GIT binary patch literal 7409 zcmd6MXH=70w{C1Gn<>1#H|Gi<`L?eg z;I?_e7d)T+*lv6}d6zqCrAOL**CMZe+6c}~lca1X|24UKX z4gi3Zzpa(IbF445C<1vB=X1-kM%{=`z3@eP77#1D*U)snh(DGO3tgNg$uf&$eu2Sg=^78U?T6thg?mMaU zWXav;g_DHC!otEf@}!isv^0GYUcFs~>%20&3R|lTJ5~QxX=B7usEmt?N$-MU1P??}{=-_~4+i ziG_R=OtWLXC2=Kt=^3#Zs*I5th0|{~F81H2T*{M^m&t9){6U0_8hLme>yVhnogLUe z$@t>?U@Tyiv6gRh2QLKSCyB8Nkji&-g+XY#=m^I*eTQFp-f!c{{n6Xht}#=$r4?_k z+l*;Tp~OWRWZ z6|J}Db2d*9ygO!fEOddHI;r6M4IvOA)PU&bTm_+*{Ju6iUT zWmE6u^wzA7`OXR!4%a05rMf>~XFr3CaRS4%)}k|~OchOB|BCIer*7Uz;>1QNv)L*2 z^nx`v-o5K4662hLwaiLJ42ga>kStHTwUWm+S97KQITwA zlQ*~~sQm~e;M?re$Na3bsPG>o5HPgO_(}@q>yN=Y3s`l)QcL05$uGIu) z4_`8I4YWCwGB{DQc^F7K7Vl^j;>}*CqB4(bGYsZ%A`MJ}$=tSqUkLitNCOl8m6KkP>O(l|wX4mH&-?4VHs-{m6+LB~BT&Ot>%u8jBUM7qQ$B z*Ir0oE-5r6jl&{E*+3Uj+K(Z9EA4cnmB6AxLwnGDvu91R}k4e=Vz27a!>t zPcHl2wDBA7MDw*&#dJ9q6Xy*@&7ez2^ z@p_bQkx6oV_`=q|htsrdB&TWSMxFmA3hHR%8AuM=`(o&o{^#M7#|_&EB(XvaoBm;# z(b`^ZLN)R&0rN$On!zfjl3D`EMr*0BcGnp84O1U48|mTpN9)g6bK*1QHwT{X~jA2 zfU*Tza25`$LK5R7tWc@vB$$ZS{s59#+KIqzLe=8i6$`l_egxG5zu_b1RG&Mq)1Fdq zZna$D-EeW02$3w8g}(@A-oVNwpda%-Z~R^!4ixv-@#t~q>{q8(Jo(n!SA2-lJME>> ztwbtjQQj7~$J_N>tTo$MO~so3P98JO8m{?DK0TCU_8L)a0Xy5j*>~r>eHm$WQBx@M zCXue;R-&+mcy|?(J~$CH$%TclC42^Xfn;0*eIwl`*=Ee!<}keJrnVV8cHRpmUCc?( zUu|=tVRQ;?wF00cE;&dTgz>xR%WGKsD{y z>X5>cgHScO=60oduF-CiD7Ha|8Rf+VK6U6sV||;re0FLY=04Li$CQv_UAWn$iCF)x zl(bapMd!;zDh+%V-Cn7sR39zA7LB<_zaTF!=+tn9sozAc$MdA(C3m*WQem@*hSfHF zM0;x+zJ6L-PwK8y+Hq`nK{x#)SKMvmN{SJP?g+)%cgsyXw2dkB9hF(n?9IIAMS&pj z^D)8Nn_nlOl^;}*PL4l{0;~v?%z~$;1kS=jMAaIM;M*2Q`M%GLF`o(}#s#leJg|IM z6jmCkbl(Uxn$sMf_SAF6ZrkK6p@rd-r`*X;(v_wrty#R2^S`)WckgF{WK0tQaTAm@ zh3x-_eCcmhv|xjqAL1xCg%U=hxt=H&grsSog#^wl0Fp23gp;g_5c81?)@(oJ7tTRfiH%Ew+i)8N4>nfvfMyC_4vn;#zy20 z3OF2TNMMLV*9A-pDW}fp5aTITbB*L;)fgBo~m5G}hdiN=QO}@rkojF~WLMF~F93~|` z6mSbth!L&L* zGp&-zA;RNby(jt>2B#Ucz|iK0A~32=nHytJoXn^`N{(4GRC?D$bfVRIyHdG{lGp5l z0-+}UBq;`b`E}}cQ$$<-!Gm7xw6Rz_**e$j1>2J%$zIX4;3dl8bMhKenKvKeUW$b4 z34-)rFz(7GRDbei%(?kh(pp+sv}WcE05ESc6hqHG<=$zGXphi>CAi_Cf7BgceD0~$>Qe1(^FAP;gl00 zrZ3%PGhn4!43BM_KWV1R8;z_tvoGhve6!|J(C$wq_IbS_tnGB93B!G>LNd-_^4rj; z)KKIXS@|B|WwT-b#H|cJjpFzvWj2Vr+b>Y1H#_XlyRrnIih{ClE%7%L)3a}c`g*~Z z4mDKDxL~B0>2BuNQ*%4te`*F@q8)iN88YsMehsusq!Za!KRDqEq)+%hD06qhy~Zjg z@-ynGMj+qVkBRcIFU#PZSv_*MbVqtwNRg>7`&hpr*?lj0B)M=4q5WDso1+CMmkVvo zCMB&432&dvn1Qeup|jO8Pxb;H2sc{iDGD}RO;a;1Y#XmW5-w% zRmoniNEL#s;$bOW5&NpimrQ`Bfweo1I6%quKMvImR(+ zQ&$#b8kntSL3M*>Za?C?z!Xztha3TL?c&!^C=)DN5nCbamNz}(Jd+zbo^MmJ0;cT9 z91RUBTqQv854l^W7(O@JC(* zlDc1B1xRRnbO@9#Y+~*2Wy?y}^zVPtI+#@#NLp-ZQ0T^z7HQhYLGdLFh?>~AyI2gy z07sK9+@FguW-Y`H1iu~3Y4KGceBR>SruflgneWXU0JoIoCVH-71twq*NQz~#p)vwZ zq)(N#PjJ`)8C;f-s0ue)>abN--MaXX?T_jvF70>e8#pU%xXvKD^B57H0drUS{0f2V zrZ#GW%V5 zpofnua+1IW^dAt}iO0DxO9{}6+Qkrfyvdjx@FpWEQ&ffZMQT?vbvZi4-W2=gz)6 zY-tHgm21wm4NVf$UJPrJzcEbT9@L%hFCt51Aa-gOFhaqXP%2G}aiWPG*-W)J2c<|eMg zI2dV=$myljKO)gdm(_`W{glAktv@^!ogumr8N?VNR2t% zT$U43)}%C>otHdx9T2>{;0NQ@nC(0@gT!&EyW28=bL_$;a%cg8kKg03*ZMPNRixy$s)cx`C{IrHy1zcvvpT=IO;O6KVsH4XBOw* z**-5OYeQ|I-HvPz;ope0d!GCqm)Gk@biH?5+$sd~esWxE6Q_X-pyOwWf|@(}fj$)I z(t9m>Haj1f4V_$We$X3IxY;NXspd1kSrUi7k)@s>h#;UBv_Hl!ZO+Y_aVCR`5Me*I z0ME^T?PsLPX?p~Y>WZGx?mU^ts3!ha-AB!=c#=V#>H83^Pe9+pBZN5Fk|5t_5(VEc zM>#MSLbV|*N>jHMENaQt?}oIa@$qf6z}f0n1k{e^&OjfE*>+CG4#30fpKL7gU8?d3 z9z=%KPR?o~%?}JD1YxbSD$<`7WI;!w)i_Pnkba0!N%P4>L6dO~XQi#}Y_X|$r1!tW z5aDx*07lq|gWB1tI7I^g51FmF%6du~zid)i$CZ19vSvI}4vYwkDnma$xSB!rOI|(8 z_2S6Q(-N9Y?9=W)s#z*GlOQ`!nfSj0UzQyti&GG(J(FUd#iQovgxEhpZ_M3seL8+V+}zPN`4mJNq;V7o*%I22QHT0rPZ3>&#ZlCm5aKL||T5 zcecA$AJvvYgyy7e7deM)lSUs4&he$mDp$RuT;W*n|S_MbvO z9rDx6cu>3i)Us~|tP1ItVX`eTd)EHO4W?(!Z6lED|mb4o)7w6Nj@bn|4@A`RB!%eg={NNm56Dw({370~4)@%$zK6P>biWI-

A+P6Y3hBX&Y6n{s z3E1616Si~y32Po$`#(zK)!y9g71Y^@K7FSES75(gbsV&~u@3y?12^KetMjgpM*iuc z)V){pmt{2eq#zeGZ-MuLvqKxaxp9^U?zm}K4`%&|3>W1l>~C^ktD|9Z>7$x0`n7&=O1V*Vh#5oLh&35$vSf0T z8!gB% z_~M1fuca2AK-vE_)ehSTKL4y8b@=wfNNXmt`u=nR~_bM(QS}m+TdMv->@)jsKvrKLHP=dru){hjJ-P=PDFz{;)SIuB=y{@8vr|7Je-q8*c<} zZM@_kuOVcrl8gRG#a>yG0qW!tiJSdhCgi#YKzd*D3u91qJ!J2YOgleNRh~K| zW=ymDb#>4y1_CW(V7T(PZ{=Uz*Jpcnkvd@;_mUC1g%CCP(>JOS z_O|jcL|#e8rfTI9w=!$?l_ojQ&WNo4pn*p}>MPc)(S0mSUa+Ty8WabYC#d?h4OOOh zTag04V&s$)=8e(0#FnQg-Y9$wi|ERbO(^8on|e)bsB3Y<5%$thytZQSdZM3IHN}(tWcAl{UzgcMn?PZ zRb9f67BjnkDE@Mp1*T|!MRPz7ahqLfes zX@UhEU?8DHx>8gU3@8wa5ah)-@2z|8+57Hw?^)}dAA8-@OBZcK1f>N*AdrZiE#e9Y z1O~X=p8p6ps}@u?a)H;!!qEZ*YJ4cfaX$(I@mO3!{f^}7AP^FS3U@%a_i{p$3orx<0fYQif`H+&goK2oq$C1? zP*_-4Qc^+$hy(&9F~2&c_(=v(`;b(hT|vnsHx*VlQwRhSkyKt@URhCDT~%FH+eWH= zUeVA|Md_?=>}qXo?e6aG>FFU*=+9pCb@dHW=yVGGkWL}cDHJaB_Vy0E8~D5b@8Q8= z+7NA&Haa#o_MW>Y=O*cs)6>(lv$GSk3-rUoLppuw;}RF<=jWMUm|vH_?riRCZ*TAJ z?(XmJb2tawE0ObceB2QV1lhWTf5Yq_cBB-}9rP*byZ z60fLEO&u9~^M>K)!8Xv<#T9imvRMcI&Yd2s{!{W^;RRadNr5Y6Rnue-7*RG#;qg=3 zrQ4AQYc?w@xAh{gMpRvG6B+knBrmGcLVJ52O`ld=>WR>I&$7%P4Q+E1hJIa3Kb_c- z$tn(UH?>||Q=dh!j~vFro+D$ZIuUFITnu05K`?h0+u!37G$h5D?S zj6lSnS0{ITIJ-RDT@1F`Npp@~DY5CY91>B++^mK+SD)~Z2K~&5@`ag)A7zbuq%%@S zN{cLhZ2xY|P%erY0*woz>AGIhxLtW|%S0lds{Izuh_>9mrkgXNqgX^f4+(nB;vEPg zOR7}fhR5s}L3qjHR5w|Pz*4SRvezvIJ2QvN{yiirApA@-^@&L`m8kU_+)g#& zvTs_dXNr{beOuiS;9mtshzYl<%%FHsjZ@>pJUO-0VdyNcL~z-nj*;`N zT=ZP9OvC4CotSygP#;LHf0B(g&Oyad-F>CFz53sYtBHGweTkl-bQPc{UHC`v3 zsU;bg2%s-GLS>e1PS>1hGTRauz3dA}s5+ld%2tvnGKIseS1oTTH>moo)VE5NRqq`? z74m@IpI2(S0AUA+|4CMNnV>JG2%um59lxrn<&B>+gkCla!F4Q&Q4MiMNH@3*`;$&9 zhAoW5%D}}RR~n4!FM&J5(71>jDK>0`2-Ai=KAknDA98G%4ErlG&qh?c!pHc=35Q1L zn7(cXdcgAivSBoWs@ViDHiW_T$EQNV2mpSCEW_rFJcwm`1r)RZa>zr*yP;Cjo`@Rh zj{nswGaB=WZyY8TzMr43d?`FQvX9YJ znd@4#p8{|$srsw#`lGOKzWmHNW8jI?%&Be9Uij=8T<>S)nb8=QJygo9NfL**mp*;? z-2ThQTfBQs4laLz;im;q?`L6gV0ENsg->SD1V*&YaOcG1u6BK7-ZwkNGut%)S*Td- zcA0khx;{;RHGN&{v7SXUCaUeQGxfhhhw^yj>9F= z0(}i^D;)2CH+~ZW``Bc-_*@en{wGNtjyvOuB;{4jR66o^swfUJ?5N#_-%ebFZu`0u ziAH&#`ulTCL?+cBGBE%Qp_gV@5YOuwckOZtGeKs&)w52?=3J#O}o5U9dk6 zU8ahGwsTs^Bca&*#hvTc)Co%`@&EfJ*DingC9bG|Yo#czmmVtPjMly!YOy)RHao*+ zKYl_TlKWNJEbPxi#U3L5$5?Yu9EZa>JDA)L!HqJN%6*zYtGG>}?dCF#h1EU=?60!& zh4R#QGKgxXj34hj{(@|LZ_hvY3B~sc=}@V$s{S8(oXlg*4kz?H^z59>G-NwXp`(#= zW-AcV^29APFV5}mUY++FuOh%iZti}Xlv@lbvWgL&;f!a|c9-^jIC^x`si%+j0cEJhFhftt3W3_`*#)Wq$(IYKk>LTed_pO(8v3o=1U9)BchjL1e*>Qe0%RA8b z?8nWJE&HC+{vY6Tax+Fnd%9+c?Qon3#`~&k?D9~AGwxTl;y&^__gV_k6n-Gr$uV)z z)X(}{_s+n@r)R%sL=~I>lzzq)seKWHW6G^~!SI=><=5S`vAM#jKDW5%Gv>Lk<>1~e zsTW8-gEtq&m=Pu2r4kRV*Cu*qD;~|M$xT6b(?aVRr^=Arw@&|S67^4$R{u1)CZ3|r zt349>@IshkP%6;*&wS341gi%)8N$3cGr84xrE2O)4VpN~4+l2L6FrdZo!ij+WW@dc Ofb5VL5%rdT-un*{wnCKv From c3ffd6438eb8868ee3885cb5702fea5ce54fcd8d Mon Sep 17 00:00:00 2001 From: Elizabeth Ross Date: Tue, 7 Jun 2016 13:14:29 -0700 Subject: [PATCH 06/69] Fixed broken image --- windows/keep-secure/create-edp-policy-using-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/create-edp-policy-using-intune.md b/windows/keep-secure/create-edp-policy-using-intune.md index a2e3cc12d9..cccc07b766 100644 --- a/windows/keep-secure/create-edp-policy-using-intune.md +++ b/windows/keep-secure/create-edp-policy-using-intune.md @@ -242,7 +242,7 @@ This list of managed identity domains, along with the primary domain, make up th - Type the name of your primary domain into the **Primary domain** field. For example, *contoso.com*.

If you have multiple domains, you must separate them with the "|" character. For example, `contoso.com|fabrikam.com`. - ![Microsoft Intune: Add the primary internet domain for your enterprise identity](images/intune-primary-domain.png) + ![Microsoft Intune: Add the primary internet domain for your enterprise identity](images/intune-corporate-identity.png) ## Choose where apps can access enterprise data After you've added a protection level to your apps, you'll need to decide where those apps can access enterprise data on your network. There are 6 options, including your network domain, cloud domain, proxy server, internal proxy server, IPv4 range, and IPv6 range. From 7e6603fd988add39edd62d1c0351cf649abfbc8f Mon Sep 17 00:00:00 2001 From: Elizabeth Ross Date: Tue, 7 Jun 2016 13:19:36 -0700 Subject: [PATCH 07/69] Updated image with new ui --- .../images/intune-networklocation.png | Bin 15879 -> 28128 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/intune-networklocation.png b/windows/keep-secure/images/intune-networklocation.png index 3b1ec39b7c4476b72aca2d1de3b3cc1cf965bec0..058aaec38e5976c29e2c933f2b4342d7689f9365 100644 GIT binary patch literal 28128 zcmd?RcUV)~w=Rs^y)D~<%2tpn7O>JHgr2P^sEDW_pj3&3PK3}xNmLYM(<~^201=Un zM5Kn2h?EE<1f_(I5=bDS2qDDu8{GSx^E>C>^W5{t{r>uR9tdl#x#k>mtU1Pf=ljl; z#H&}VcKojRyNry?j*A!0U6+yhg)JkqVS39Z>6t3?SH9AZ4Y2E0XJsmSl;@-ezj~js zIU^%enYK-M`#0(F*1H#O!enH2wyytfAVQ1pNKYz+o_7khgF-?hZijfu+`a7^6si^E z6?)*bmX4ND0041CMkesu#dBxuBi$C77pjyy!!Sn3kBG6f&;y=_)>`9RyU!bXiq3Y9 zB^|J!?>flX(e?!JL8gA=>3c0CkNCKj_Iq#cTz?Hea&3?ArPpmhyElikV5h9pPbKN8 z)H<9s(#LY$&2*!M~G~L#D z$4D6&G>LaLTW*sZKu@d|GQ+UZuAGHQ@xnlythtjJZ~FPb#Dv@X9qV?HycZydaC$mR zdZ%4yh~b0_0Wpr^)-}zX8dxkCXSSoY9kfj)XT#>E3Ye>NeFH3a37^@KqSRTte!C7S zizF;JR=;nXolJ^}v_`J$Y_dhq826*Xv2DQU!p}Hvn7)s<-8%23`ce@~RgzSFe5I1SRk{$OKumm9TSb z+fWhVLir}1Z;Ar1tg7rOT%sl}(p2V;^)=cy0#~t3E0^^4tylNPw`nB{0qM)+$!T8s z0kRVJcPR0O9(UowvM63Hq#~o}wE#}9v)W&m8=vU0Kh6O$;eDV7m|@cy@s2*;RY;XG--w_eTgzBohff-oD{HE}Ourso52 zldCxq+S$A{Xh)MlLC348jY}{#1c-^N7)1i0_~Z*96p%YY>ShE5O({IB4EM4LA}gG| znQrZ=8i$g_G-lG19+8Jh0}5iMyQpkYyK!-UUv4x&GM2&^vkjbh@%ZP!_HD}_D4+8- z=zgM;r>Og-xsH{x+}|+)P7brtsr;hF_sruDK+L`p&V@p&svvk>yzbnx&&IbY;n{VP z0C0nziDO998qL0V78F8V-M=c}E=+-6g{_ zejQH%^CKi`wGog}jiQ3UtUc2DJw&Gw6{Y}!q8|N^XOCMbvCB@I#J2g; zD>8%IAgYRk07oj;JtAIw3JSNbiT0(63Wnr!k$DZF%h$vBtG--I)kCtHm`qX9?gWWf8I-c@ZX+jNAcv{ zV!Xo^P~K(!RH!sVJ*;<|Y;=!dSa(L7$jFo@Op$~GEQ&+K;@Ae6ds`1`gRgVLWn`RW zrFRZ(|WxWWvY3s_BiMH$3QRswC47%jXxrmHgem6_RlA zg?QuH%dEM+Qw%K-qsQGmqSlQ2eHa!P>pesX_i8aTmfPPmKuQ9$+!0zYD6Io98_^%e zwH488-|kj)(|U3kr3oxrf*Qi`cwgA4@~>ce+{K=Ow2-X}m$&FEix0mtd9mRX*gY(LBF`;8AbP!#N$!$TJKlF?zyq1&rQ3MAb%Q z!2H!gii*tXe>Wi=N>91HBNWoFCad^?Z6E863Rd2T@^l;$(y|w{PWA>EO zprN0|`~?&orp&Z<-k+qA{)qR~n4#rf0sF4Ooo{WKzvPy)9JoI-DbFQf_-gi(h|`N% zLgjFVa>4`%5_`nWPfO;*ed!n-I+@A4Z@9ttQ2dtxC7s-c6c6y`)Gm^F-R{R-GwB~-AEx6>RCxe& zo{PQI&_%+|{-cL-Fs-3CA2%O^o zPn7Rx6Gupo48FN&r78^FHP^d)&3t5NKg}s0?7y)L9Kiw8d~B9(lbUwT?BTH3mGIe> zyA@OefIK^7D-BBVnj&=@g_#?$4c1-@HUnheZCMW`vfd7WtZ%Z^J%)ZdQcQ&|Fa#i_ z)1!18%lr}lufbFF{J#WQ7l19VE4{_;--r9=b=Xn9UHbO}WZiKex<35lK2w6Uh0K#e ze}jLTpy3!fd7y}3DT2{>sKE2a5Kv7&dwsO$Zw&LnaNQi~kKAv7_3R|0bM61i?Mn{G6J+W{?BH4N6fDeIvcq@6MXs$!mNp6nrA_hQkH3RGL>FUOwBEryi5KSd*z zJReAWUbIikpc&kn`qy<}p8dFKZ z@34D?;?fT*gb;sG0yjcut%x1a7$u#=Ox_1|{!tPs31tdrUVb0&M}mTF2}E2!1|X); zj$#Kse1jQY%0EVZVw#Z_zOzr6&aV}CUxy$za)%EA*^kVuFXbp z+dHLWO)9%S!ee^^HJVGZQtneh9Ovr@fw4wFR+i+0zX5Y$z-kHjzUyYnoRcQo6qg zm{ys&O>HN4_34D#0`F)-Wbzkp z=;RUR-14xw9s5K*&QVa5!+?nAM_A^kag`U8%#iA7#RwZGVsP*k`!sWYu>cU}zJqF; z2|$5{t*^oREN9oQBFs;P6A~K2UB1QmX)~B>I@Bi>XvMN@Sz<#FKk6@5xS$batH+2! z2yb;|m&8tm>d8X0rwl=c3n|_9yM4lRIouy$_xSADtv6Y_m2eqPw*5?#g`*&{9aB zB`~x2B>vmXz8g?gR|<4UD<1FBAZ$?hHWWDa#Of~%=y*}J3e$Fq$P>UT<=-XwPO)$t zV7<`BiW>=E&DkeZKs{_p>U(9n8G%WipvCmcQ`YRHa8Ush$ z6afU|Le;XIXjctPBS)WI{&?^(0I!vrHA=6~pR@{BJp~a)O^%p>8TqYTHLkp8)_cYA z1m#g2Yk)kx3kw&Wcc35Fbts{d%clF%(Uq*4x_XWSd{+M@<@3aK&S`eXvr#~>IH|3~ zw?kosh2vsqv3)7+^CiYt9zV^ojmrU;q`veaUnaaP4k`_(tSn?SVdBO!^!7PUtnO!C z0(~K{v`02a<;Dn)QVJ``Fdy5(-snp5=NIjN!# z^3|YqxwS4}E~VGyR2E^}@wzr}>6w+|zNHt2RyA}Dy!lRAFZEqo#-!%$@zt16uz`Qz z(^`!yK|47vIi-XT)jZ%T>^ivobM#g7I{z|OR^@DFa~Ns9?AQTtIqD@UV_VV1rgrVu zzN4e|kSd_p?JBE>;hUO&@IO9dH=`eSIYMK`gJ$UmFDN$;|6(DU`;jZojyG=p;g>sa zDL?P>C}f|u0W;vtn&veh@28TqD(T6Zs zq)5*M8x;_Kifyz?oc)wc?AQYHqw1L95vU&cQ6#xHW`y%O`qRr(d%S&O?V^vnm_}Y-5aT>jUrr>}04vm7-31WZB`#z4~er(-si&+%(#2 z&J?!%JagG9x|Uj`Deq4Im`Ww5uq;w(`gh^oymM-b(Xkg&`Sl>EN;p)OJn)6*Z%O~W zaH!GNtb$aY5~PXCEx{z<3C5PQb#)Lwca5n>oLU~|YA`3e#>>W~^TdAQz%_6`57MEq zfV@GU8V%PV6sK+Nldb^}5U}>p&OV1zBV)g*G-r|vKUez42Pua4F_Y9m`)rpyeH55j zWF?1jx__?Sk^P3zbb>WCyE36X!c+awb3Yd=c2eB4d}MQ?9H}wM4%xT3a_j2@Y%sW# z$U=x;5eLCMUJY$0F?=!1HF2C%AXvk+#+>(mb~A04BL%Kzg1-;9XDBx#8lA$E;Q^8c z0s@ueXeJwuoq^4!eb&{0qZ50dN%f#z>iOH(JL2hnpM?qhnjzDM*#1f2sl?b5;0W!SEQISA zA3jt;{9xYM{(Sip`|e#zaeXt#F?fN)S~hyf{@ipV{5WBsqb31cc#lF5 zW9+|u?wx#xkPCYrkmjW>oI=+|eU9H(ee*(dWxN<>J=EWT9}PW@#}DOin_SiB7WVeb zf}bJYEL=sdK|B~o{QRf7hd#C!flOS+>nT@NT|;+H7O9R7NlqUpMj=97=7=+XA;G7? zi6MGMpT??*#+CYK?zOYxy2-IAX6mjy*?odq@8@uf=RV1Y( zyymCiV(;#KiGYY$GX9y--33;7I5Gh|cgP46AK4=`--4Sn6-BNHj<{3bwK)YM@RNw0 z*B$FJA}hu?!vina&-@9X#QkZyigp^dMm^-b^Yn|1lhrKW(Ls1)b5`dhIVYFV;AV&w z$od}=g~oCj+6Op%stq;m6m>TCz;^P$YhD7p*9*tUBU?}!W3IR6RD z+>6I^t7T)YRfnUWR;Nsb@>mL5YWjo~0Qx&u5Gu;co*%0=nro=d>4MJVvwqQ|=t~!c z8oFt>zTZ3fpn@j<;bi=+>b&3fe(aFF11$9b>px67-z%SuoouTRq}#}Ay~;ydALx0@ z0#Y%lOLLTxiFemx^fmb(x6Q)qCVLCqBh0h=XoHL$;X9{?CP)p2<3C1S?0c4nXy_N_ z@>A!d+sl1JVP(rA4mEa|mohp4dqr>QX;zMay&36L>_^6nUz_DglFmXXzlV$MLW3=m zNv5|*s_%?uV;)7m{l$XK>JE^6Hl2+vTG<*q1A8pk!4L>~ri%uLDy$Y2-x;m43W&a) zDeV(-(}rzd1b}QMC25{o;2fIuH;HhSB^MPWU8B71vPtW7-FzGYG(ZLw2emx_?_E{k zGz}{UjJwUZ@vcrT?L`4zM5Ozh+ZrvdWns8Ju^abj>*9->QJ8-57hE;&dmxsE(;h@^qp8+$=((a^*(X+~{?^?pp@jw?s;Q*dT?p8uf;cfU~sTv%lTOuCTk z4^AQFtEP=26V1MjWWoIfIvkF2{Lts9Iq%Gh$!w)8bmSN$z(!E%ulHM)Zu%X1x0S(Y z^}cbJewkD6fm7&k_&em=r$^)4EF?qkZNR_XyLcbvo_=wnSJ&c+C~qlJ`<{rKTU8&O+t}iWoWTlT2%Cd1#*2@eyg%ynALKdmYy!3hvaf?IAZ`#qn+qCT^4#y?x1Ol{SuXd2%Yfw9ePqX=T zg+ar?SMKlWFc|z=A;74(TE#R{9U%1atO2fEWBB5Pp%AH2ee4cYrH3Sl7Iw<9@Kjp? ze*0bJ783UNz^@#}4qYF;L9?}AGkJL3n}b_C>D_q`D^v9ASrfqLy6h0OVE=vM`L4s_ zPP>}KiSHuaNAqu6ll3zrr5wcCwQN)x)MwcyKRWUg?`~^XtikDc2eCE*eTJLj07HEG zacQTkS(t^A4*Oa_n479gUhHbG9^IL{e|+AxSt}#E^9dp<>~$?~`S)ke#btsBR`B~1 z)+ukHh!ELdkmid-OkeCddP_1vtuLP~-w>wuc(T0ZqCU6Q6`S&Lt%PwFYlW`bZ=K1o zR~}D0!1^kI&NkLIj1L(l@%;t^+$76kG=|UJYy(I&&@+TOa#aYACB7N_JfCR%vaMgB z+YiM)B4v-b9L6Ufn?Gby$4A@=uCyPoU6PVG;jbG)W-jG4;%!THyBJ<;7i|2Nwnb%I zaJQzUoDy~6QdfcH@)w#QxFk14jE)8=Ie4tdn z9k!~{^g9gElHg#a-F|l}p27AnblVS4vG-%q(?-=x40lI_scUNZxPDaj%1wr0H6{S% zOt_4RQayW9D`*eEK;^^$^r&r$rkQMO^u>4nB_K`ez`R^Z5tq8Fndi6YJd9^jEU1qc z9hr}4#WtSMf^M0wI-dZq3(GOX50&D^PE)eC0>}84y%Tq*3tvHZl~Cd*Qd%dS-l#UX86KUK&NlPJM#PqXrd4yM zj2>4;+ob6$CphgP(zCiX&u2TDYSy|pzYI664NAyie5>jA3YkbHXYevZ%4w-BDQ8Bq z%#6ky{cP8WM_BYUL12S^%|giX29Il5{&iB07?>fAWm)?8`1a|Dlm(lslfQ;wb~GnM zMSwp8nYUxm-`^#UTokr>N3&De#k2vAFj7R3dlM7^o(CDeHayN~(H*LkLX>s4b=q*T zf=XOxaHf)3e7I|rsAE;?Gry@%-X?_`4rdrpid~Uo3vosA1b6C;Gp0MGBxOK(bh$Hl zNNMqYX;-MT5>fBYrPsmRNvKt|1-o`n5k<|r0;2#*?Zu}0(pbSeUeqv@{j@nfT&mHu zsX5|xP)f7q7lEE7S9{h-nGh7!6rNlf(4$&OZ8RU84IYVVAbE1LR4_faizU1tMn0TFlzj)waCjm}JM z{P6lT_uYF^Q)BR;(VSA5as=>HtlXzqgUp2Vr2VSZWU|fVAAO*l$56{=1stU?1s}{; zdf!7Z-x-MJe{QWw&1lfI#5uX_jB<+^)o~NOdjF$lc7(ZkxYweg5f?2qj8`)inNI2Q zX^|DL#a6$EK z=j>x4BeN|;ZEdt(Hk4*9xhA}fI^R*iIK`EF;3htfD8}UU6<1I+Ybq*&AZo*AgGx)q zVb4uzv9CsxaTW8CQ@o_lv~ztVesRbwTHP?QMn<(r}SP<;Ge*QI=lq~ z;1nW_abg^s!&p^j)@0XJgiQ1ln5&*;cK9#S82o3HWkoFA+aP%7IKMr1!-s>P^j+*; zqLy4&7vrBaZk?7UGX<64=DQZ#rh|@)H%zhW384x>B<7i2u@#A)W$XvBKA(0_&F@UR zjN&y&aj8l(&t9eE!2(7gHs>r(L!OuAY8vg7)sKZm)QjTiegnEV!r_Kvg%uk7rnnH?iF@-j(?N3UgKcQ z^gln5&-iI?y)CJ)UC9U-K%fW}=8$N_T_kZ9w>NYGXLd)hjnT+QOg@xKCY1~tEoky$ zve4z154*@5hb&YAEk1Tj#{Jm(qvc!UJujf9b-iT3PX#Xw1{DP}zsh_qZXvbuhhOR9 zV+Cu!%sXI9xZ>8v#P{O~tZa9?g%S4M>3MS@pLw6!6#h-`UZts!Pj$e;7g*1|u*e1f zQYv2j?T%E7c>Sh{^xA{|%}HIpW1Duu2%&T9 zQqZ5*Jm?!Xy@QDJ)dVNkk9SLt=~C5ki~7S|XRS_2fx(s#h&Telh>%{DN&R&{G8r4h=Ri#vy5eRHvN>J*H7?HP;)QlZdTX`QI!f+f*(`@-?mKF z9q-b-`W=+Y|)fod&lkL8j4qz33tj3AqgEzlcWN5?Cb#caF?;0s5gh%Vjc0!>z(VoYt*|D zLGPLO0j9Jy*EDT4duUW2TKUVGMTFL=Cha4VBpW8-Aqf-WW@MA?fB*?0JsvYcob~+(}Kp0Av$xpMr?HH}~9gDJOSD zK7WY9P@X}bQroU!+n=I%^tZw?_bcftzu=31`JfRD;ltFhVo}bCxR_ZXjw!043KKvg zBciS7YeK1r%_x&F*1Wh3Z{*j6k@vDL$O?W7e+;-M`1BWTh+FV}X=@%T5Vy;TO~Edt zY!5mk4nFw@f3=Yy z!j?8dqoX-BjND5dpDz$H;q6aQNMEN=f3KjjDNWnQ`i1d_UffH|k=6T7ApjiJJ?n6gV(2S++)M9TlU)xig$ELX}QgjlAMS}m{q$8ra2X^eeVVu?mt`Jxize5c(&&^K)%h3 z?7l#Y#$0&f_e~wO+k%g%`D+!ZsQ?rV{1InU2mfS7s#}?*?!qczDWBPtMLq_GE`CIDSjZIrARfJk9r6b;h4{}G7yMhmpplsWynOunV>P_ zp!aH3bqhEh`PwCWMC*DlQ#0p4KPp8`B`PI(3W`BSa}o*5W<7@<<2i4k`j}GYS1Uv{ z|I_oO3$@njB2W6>q)hmk?IOD>hA#W7Qw_>?e|P%Lst!_Clf8+$SLErqnXPg!jh8$R z^ItY`hD?Je<|>ETvEYn18PGAu;^*D^N`yqE_L9$mcXmdBZOG42{x>DHlNxo+ZAKZ` zMCvo9w@32z++^?t%0th>8B~Ej7OBZ^=uDgz`#|sO4yg(6R-RlB1PdP z{QKp>-I+dS<|r#A?Oh`U^oyA1V|PeV6CBfWPcyB-Xa`2Rw-8@N+fmIn|3Vt&)zRLC zU8g1Y42TNx{aenKs0S}M-_1GT4S4S=;3&S{y`GUAVj%q9t|JA;^_y*j?QJ8 zGsFtFP0LQREi8)x$7nVKwJ3O^9I7Vw7^_Z6(eC9_2qJgcy65>{r*vZ~#+zp0ZUv}1 z*sx}u!E$y7D_va|DP5IkD)x{lJr3@|BxH~lh_`@!ix+ejy`KC;;ODD_A^#Gurb+7g zxk-%!n&J`n%e8es?bMT|olu>R-xeYcG#!z}SeOXtrXGTK5I5wpUiZTxkcpWBargaK zqr;hN3j4q>Am-lt+N#6oAJIi_%^mm7ZPL2!(pEja{nZn_bEoz{2U8fHhl$=Jbov4F zN#IQ9SQNvu7Hw6S(i41FRVkj{DQW)_Bx)^JMxrk zNs93k*)gojrGpE=c2vV6cwrLu0rwwkl7c8Is%n5BBp~~w$xq&#SLZ6gh-QgdfEygB zxSd*Rl9uxpu{bJ;(Mz@Dx06ofy7iJ0>c;psOZU$ zQW3qc_F_s4IWJdDI*TTMK=D{h#rRMrQe|2s+g#AVu8pu)Lx>-}Y__5}V30KT(#1i# zD<&gqQqb#MhD?8)|MX`Nk(v}HJ^r$Q>r5CuxVc7v*-A)|PbB|VEn?oh4yZ~>WTf6e z@pAKY4DDVgU(z{p|2t*2V0%#UAxLKy`gE{~|C7Vis~RML>wS;-2OB~w*(-I$W)h+G1M{yNQ8C+Aow&#X$E7?N7@sX$Ka$U`rOS4lA6B4!b%G% zO{%)f$Pgbn%bGceMgX=Bgm7Nq0Jcelg+7$9RiLGag|1-1=Ff}LnSGzkPm%qIbf3iExaudI z}8yma@E$F*G~5R$F&;kpZwj#`&e2khjv?7h{HP5S=;%wrRzjmZbN5Y=_K zIeYXGYO}(IzYmW1MU#YkNv0=d|2h60Agl8W$@HugnO^E2%;Z@+Rve*hOx^%U+jVwJ z-kyKG^;nM22yg0fJXLWuyef*lVKT@!}TUwv}Ybho^^nr9pTB!J3UT2Rgsf9BChep=z^ZIY>``M_S0h_yXtt@940kgj$s8T`RUnFG#>;{|t zid4H>n(23|JL*h^F#5pi96#x9sjTko`E24dd<0W+>e>-TZL-j~n@?Vo&4R%@Z>8Ow zwDGI$Td)%ul|^q3!fKRV9ImWiY<8%03jvL}3pZUaj32~bP^lA;Kl>(0_ef2{@9CDe zlNyzSuH3S>+k zMP~9iTLFYjDPK8i`4E?ZuQeRqpP5S@{EPV%I5S^he7?F?#SJ61 z%fLHE47EtHhDz52f3R*XXyhilZ`!1++ag-@HBrF9jkvtQBkp#{3Vv)jNRwSyZ5^3$ zq*xz~<_tJKU$FOky4uvvnZj)~V)CC^0W)014Obph2a;&vjQ*$w+`3|Iu^c#-efvdi zt&QOzY>ZO|V{UM>?N|rBpwo(?gVjlxUl8y4vo3W8Xyi3mx*NA7(Vk~j@ z2{&~3>ZDIjhhX5PmSy6vi1^_VXSneGQ4KuSz&L2qg=EmUNYBk{9KcPA0Ece97$R> zE!J0l8<`5`z3;Di%Z&uu;t_^w3q=iABDFq6##g9EHwy$2E~;HGhl@r}u8(2|3B(*9 zJgihhz!8DCyR-=4Ij?}}4S7)Ucx?D&`+)4{?|*K8hM3yyK(`!j+X=S}&Qgl?``=eK1UE@(}#w{#7>y47SJTH#+)&*%kGnya#lid1YC??l+yIHMU zvs;gPA?1)h)?#^~X>lnbxZRH%|6CE~>4J9y)zxB(ZOox3K&chjJWfB$gQ$>J(AV_C zIQ~Y{B3ZSo?F(D`ncld8Cfat?ashrKCqp$NXy@yiU`%7wXW^`QK4+D)`lI^IWX0u$ z{9DV);ew(%O?#wyQ4lnY*0ogDTewi_P^S^xn7gT?lzI;P!beB@MN&`^Y~RJysB9X& z5`+~T#|Ez~AF)kIo9iB_v}DUMj=aaUafyaY{rYbh#uIGUa&gmuyUa}MFM?3?dZuVG zCdCvj7Agf*3>wZV<%~I@x0Rm{D#W3)&7sgtPGUnd;o6A#A(T?7Nzhb%rUvFJL@m{| zF^a^&d^@A5yE+u6lmpXt14MX2@`H~YW)GUdVoZ=@WJ1S_9i|uNT}Ix|XE%zoGW}GW z8=B&$1e*&DHu1>3&*(m9?)~mk+&J#coh>_8g80 zschvBMTPGOi&k={SX|Jp$#qq#G4P|rM^)t90s?KX39?9vBXH)*JEO=qCu=m%n(Sw_ zocUCcx|@0GuG!;{QNzOW_zvSBN{LbWq31~x!0?4fS6^a?h?_&Q7J>+;;GW6=l(MWV zcRBJ`$B9w@WtYdRE}fZE%f$%SlZh%srCTQbTh{}glLgm~?Ne${r>nYLx2oIvg%Oth z>bp*#?91GFo6)QXBytUs{Zcq{W+IcTk&1XFg&;~QAdyb7+DkH0+(UOip^8Cx3@2nf z+t2NlIz^a`-t2@WG4%cbeHtiX5p|7ch+`L-7q){W$LrigF%u%)@LPAxIOhNOPaoh)OPTQ<}4)V0x^nRhZHGC`^`FnIP2524vw6DPZpogAbW~Ikwlm z1LuzZ;V~hVaFZfU7~5QA4+5cKI2XyAavPv6oMO-2P#vaA{2_z zh^3a^V}AbhOCh~9H8v)4;iqp{n=>gOQci`*AMW^FkFuE$=Id+D++FT>nS;;M3o*`_ z`FVQYhOc$QS482`)k~3bLd=YGTFJ03IzQ!nbE6m5#AxTjxB|zN%B~pQgp0AC;E(LZ znJ4p-1u5Kz)w1J5l;sfv97^s8HbyO zs~p;EOF>URb!FYJOdW+SBkFLorXLj=D;hALNNA#u>SfhDf{)qey$t2-TE3vmwguB~!v~ikZb1&@M^lfXFU9H^$K~1s z8_~XzPiEO6T2Z}+RexPb0cb||y#x#1`3i2x4$v)6KKx;j(BFD7%{|Rbq%*5(s-Cv$ z6yqxINJ{sUe}P-kPy;OH;i|oim)^OFUAQu^>#%<3?#nTapb&qC=jpKUEJ8ZH4AP-A zLua+Y?yUHaG)nY52e10iNBMz|bV*}xS#ac~YFy}v;LvEJTHYgmp3Nm=C<=Wv0n$v< z?_*tCvI#T0RDSgaa*>S8#Q1=Ck%6|?A#3RsX!MCWYK3(~=BV|!X(-HZ&Hj1W@8h}b zOc7))(^Z@54pF18M`1gB)aAOsl3PI41Ev{+j50?3wZb9Em86E#Kg49?dRkCLqmZ^- z7kpL{^tNAI>P0kS)AVnz&XZg0$gPQGyN;mm;&OGL7?E)rFNY|Z@M_zSoBR(i3B$NiJ^(5Ze8HyR-7{e;Vsy}}Qsqs?QZ zqdcQv+%fjc2E=vTDMAp+=xxF1VeHNPd2`$Hw4-$xFv{#pe|Mce>vjRc6*P^w0e6rnA!qF=>nKVN}=*}%EKgnJefX(l~s@aQg_nEyJu({7j}twDyRYc$3};E}}C3@J^sa2!0~JBOR= z7&1Nm;^Je5j>FOCh_H%IzBOHi40{{?mfUo)`Eu6HIYfNNDX*LoHjc8?O?@8h8*|y+ zpt{f)VOn&3qCae5iuaQDnf)482kx)rvzxH|#|#{L+aWvPfWdLcFaGL^BM}W1Dt$v? z-Q*Jd;yD4w^yFbPdK>=^7iMej?rPBQ(9t)j&(`vC{XI&xA-ITN6}&nkOAb8gJh)VK z>bW>;d9D&?mg7Q02*z^H_~h1pA}wjG$6F3$0{L?DLo+JSPP~5?=*_ur_cdip;^Mwv zEdf7FcpTLmS%TlQ{NUJQ8;i4vwXb_8xP26Tj*hk2{2}nc4lDBcPu8IM0_n`y9jt{k ztKD@-73&(Ole!FV+zkKYP}8@0Pwy|*T^-xNDvEWvYUpS;3yySVE@EgXv$B74G=I1B zV0COn*HYBrw8tcsF@na^SbuiX`#QF_Rn{B^x>6T$0~OAQE2GQwj?DCwBF1S|7y{%x z7tmEW8n9Dou+rV{&H%h#%PZVP2XR=F!;RDtz9kBr`z`87g?62w3|I|iWA)P7jN%N z3$8fk;I(#N!E-z6&GQW{%^e9r8)1smAxos0C+`I@ zZT#s0itglKdH!5Pr0Usb1k%DEB+h#0RZ6)pQU?$CmtzCxM%`FJlz!1{^S$1K>#H`8 zafrEcx4v9Yr;R&E7y?q+1#j&&+dh5!AaUHHl_*R692eAMVG=dud}O3y^Yf_3mJ9j( zW#yp+Y>&FZFUwA=aqv&dH-{5Sm03o8GnMK}m|cqKLcwEc@X)oaK{aU>nnVc*f-RKgP#qZvTM+EMJ!`re|B3y&32I z$WsB`6K>S!-A(k23N^t-Du>5>8_LS&4xx%#By2$6rgV(330ZS>##&PHRlxn&;e>`9H!Jnj&qu=orQI*VILDC75#wKA#(w3N!?C&h zkx?LLo-p8A?c1B6acH_bJ0m|9P$Nc(SJ=9z>uwoTELJ%{COZu|V-c)LLPXd?V|`Gr z<%Ha>JwKCllyp*izeg@V#n7+%gM3n_Kf2?u-oMtpB4rZtINJb|o%kD92pd50A4!L* z-~H=S|9?8|{TuD@-*O4k`E>IB|9~_29}yGIcj(&xV`gIp&5IsLZJZ5f+MW@Qor(Bm zok$^GUJvQZ?Ia4M%C8o=E2s4*w?TCL=d{|`b5QFjZ-}%+3IF(L&c{aF9LJ9=8X5lV zg?|eggbHYeCRHMOz$y6zZCNP^(yQ@v%@j(CxuG(jP{*!BQ5z!OxtqNMY}@>FYsT8h z2a4Zw!sH*9PzK*U=PmaCWNb#7q!TlSNNQcV+({BpJUdcQP*S+{9l8lSS8x7Xk;&Qu zzE@PfdEH?2zIB$SPmld=L5SD=F|M>GM)Q^-s_fKt+UC$YY$$}#TPt1SMo9iugk)62 zg1xJ6Hzi=5`pK93c{70B5~;LtNt@*7?d^RGp#2_H<11+U*>NTL^%67apDa*d{{O2X zP<%>{E&rUcq2s@UPG{yI;yV1A$$+h@u$3u?5v;$mXy|FqjzE_1<=rLY^kdC#>x1xW z14{CPAx4Br#3K6N((5s}29i189*{a%Cgo9}Qa`F69VbaXd5hiHTi1Pd#K(>TS@+B( zAX`nmN-@AlouO|3zel|ck@yy3y- zxK7fEvp$0A5^un|rwh=$CB8Gp*ZjA{YvJ;@+r%x(tdn$~*PEhiX~g1$qYQc~4poL5 z*qOHsF|Q1g(=8KJ<LDuQ}Xa`2Iqv{SJZd9$O|6To_JQC#6&_A#FiuMFa2 z9ne^hTMwi!!_=v~vnXm#GW%gFUW{gRze?Em*!YgFrAH#v3t>xv2s4dOz9_a%Dz!VK1PtlD6eNOghe! zN+khqY3ni5DvcTG6TuP$30byhI(F$B0;rj)2dFQu3i^}KA$2#b}>a7b( zM-#`Zp~;yk>j0)kxBtC{^gT3~!Aorx<;C=IFTGq*T$}-A_{t~SnTcXnnVL4KHAZe2 zdg47>q2uruSOt;AsP4W-+y##tB|kDC8L`W|%R|83j8RPMtGuy;ac|culCh41ZSHrJ z&otwAo%K1x!H`)$!D~C37ZLl8_eZ+Hqbq|CPgwMya6WwHl>fc*ttmU~yGT6o^n`ls zt&PTq1MkFDRzcj*T~|c9m!doMGb6k&aKp4jV~i{wKU=Vs^fi(ncs|O_@isly+!f`f z6d1Y?#ndYk^P^_i3zR$`w;*FRprwAH+f6y|r@_B+_|nYu+W^u4YxPfnd1GUc>|;j* zf6po3>KI?_=wQ9wGvMJD(EZ&vHy#d*^JSu&dq@{e0)O1HWAY!{)Mql&4<2&1P7QOO zb64`!MdFX@I@%C!pPcYuVji}ElNhhnC^b<2OVbsN%1J59N2xM#p!L#H=^x6|dd?vC z%~f8A5gEA&+R4JEm_`G!w*fmOiGHO+fob5sFCNR%(o22i=DtO}`W2r-=WJPD-F+bo zUzki%V}4&Le23fRoSmqrp{;kWCVTD$f5AxZgr4p3E2nh-3~W{mjE^V9=y;Zdw_Mm9 zqH$91ea%^u*elG?%H%T!jHyV(&d~C^T5YVqgmBjZMSBoYs%)Te`|KNEg{Szf#+)-k zb1tH$cUg#&?i-N!Y$v&L*zXS;a4`#!7K^yC(AbEc`Eeg?F*_-_mEue#>^fy~c1w!A zWVlK7pJYjhDM|)D9z4CC+eS-m%+S);3J*!sBdD2spWgTR_n+%r_*Alg{Hpj69*KHfa
(A-J&y382 zh}~*vS`9gTyC)zZRWf0sv*3WG-JyG%$bK)7qL-_>KcV|^2*Ln;qe>Jvs|-QZNRgYg ziHqx&OHs`_e2LSogG{Ia<-Pqcv}eb|q%)Eqlz>f+P`20}Ch%&B-MS@kAmcv0yQRG1 zgx8)E25fUk&zQBOq+TjsH!a9#=BP~89S96{-TQH7Z%_A7+#7t1?(bge)M7+RZpK*T z`ZEsu`CR5Q;ZVb7TuMr$(DG)NVt&9Rsf^}P9(VJlg89QVl_^|Q%XXlKyV8=Bb6AMd z!_8{%8zEV_ANSiqzoC|}7}|K0acjJZ7nx(EmSv^Au3zQl?^&NDrCN))O2IR_B069B zuGb)m`a9j}GPC83>*8goiiJ|R*Fy`TOOprP&eG{b=F;OrwLtoj)VGZ8)l76`$Ggpa zr!axZS0U`}?A_+FDI2679(l8_w~2qy?ry*MHtfI+fWW>r{MI-lQS{aGs3yG$k}fN`5@whquauM8L!M{na>l~%r2J@@D^k(0i5PWyCPwh1MF zQI)T$_ta%{=wx@s7H*Lqd*voNbZ$~U1<1ag?CQv6;u|o-v&wW7yi=3gE+aMnR*?={ z2Y%gO<-&k_{2YqcbI-p@aXa1u<>H;157Tf1zds~9n$14SHYbvj+IF$TH4i#>{z}7= zn?AMAazGQLq>swKofWDBuIoZEkE^L0+f ze@KV_-n;(@yni!Ax;5=5RQdxVR)G001%UiW@ z(D>yHpa=c$=rEr6NV0vx0zz-p1x=Li;JMYHkIMe1i@S8^JlmiXBP>*yQ4z7cyC6ra zbzT4cH*piA*hnptwmHTaX94puBcGH6S2bpVY|oX(h9;D|^!r=>u@WJDt(*|Xj)Ezp zLj;9xXx?`N&_EFL&7kpt%54W1paV}kklbgx0H|yWAi74{)U;n<-h$@{aAyei-a41blYTjYuTJdW!{nc5^FORQvjRnMT=tNU)L5FR)^U4paDViqV1ikLjs0J}eS16;>L0&zDxFTcoYN_yNEa$) zF@_YCQYul2Bv$0s(qf^_&_x^xA(t7JAWxz(C`R zSybB892K>vXbRRxSdN_WKN+gZG7|HeZ6rrv{p&gWD5F`#yN&z2jPvr5PHyG5vhQB# zp{R^D_vp{Bz+9PQLu8|UA2qpJbK54=QX2i1@=x=v#`i`(Dl1;j>M!s`rSYTZi!dvl zJq`s{8EBqBVEICkCq z>b3Lf4(wm-IBcg<=1a7lGOokQxa98TwK49DtBvJNH)_$h%*Z^#vL$JGe0j5#srgB` zcv9s);oLmE%vevAab^4i5$1*J2tUX*yuw6z+%@Hb#q4%j_(4T@dglF>Nc}D1{xAs4 zl?AY6%hh$0R3a=VxxQnD-7GpZe#2QUL%YVIwF#hx7Kro7+2M?JzR21|ov(a7&;IVz zqDC_tiidJqeUn_7RAK}2 z3-PoC9?Ai?+3kOi>2h{(t~qKtF_p~9VJZHLHX^c`OesX|?)hA3GF^;c2u6IAyG1TE9-X zM>h7sLZ+1EjWyB5yutCq`1}>zVkx)kT8Rzyel8o9(hjCzu5q=a}b|eV-e%c@yLlj zKt&th_5P_ZY#X-x`&eeo^f z?}|?dC~8>u4<2L9*T6G7bg1X-wJsw)n?vv2-%~;$x|n^b$?&j5CQ&@~M@cD7=b z|1Lr$;bT(1gV=*%{S5GMWNsIB2T9zy=jARTnmyD*A)mqfyxVxc{e#E+Gb%B_DMfp> z$8x0fjEi}`hA*sgP9Wm12R6fH^kcw|QUzRJi ze|&;dlkWTi*Ts3_RhmK6BPHsq7|Z)Oq(|s+iblc>4LjHl+`S7f;z3JXA}>CN=9k~A za!5K=!53R(TS*=hU&>0<^j^Ne`3^O_8o9W6(Z(T1%D5?&*u3TO@Z=D4)8pJ;iu#Bf zRQz>dNchdsXXk2jCT@*H^EsWl@j3C_@!qoD)^@NYjd~XQRqwmH#VxYN4KvVpnAjUYv@mL&ml|sxT`lShsNXYLQtqu~B}$$wRnv!YuJ>k4Say}N9cxif zosKCxQHc+Cx5p}!CQr*p?pG!Zy3p#;LMXnA{Q2PbKKbBy9C`xzCVPlqcD*au|91TK zJ}k(=|`E zxT)q%6n4^J(!wsdN^R|&nfVv}YS+)#HQOuHtg*0v?&6KN+SRT3omK@B z{1Uh1Kj)Soe6Igl?9=j8;PlZzEC0zb_=|w)qXF%G5ISd^Yo#Lmax@3xKYXHtAgCwk zlmPQ34FpMeSjUHf$Qx#6+?QNAKb>i0??2Q$wjn#Pzs z=aoa{FQK&jSy#g}CMqjsdUrv@ak7v`9;3evoGBw+5KfA@b!H+SQiSqd^`>P@Q0F#D zD6Rn<$R1anZl&m+aKz|2zwFxNx;0Hp&*|e!+$uHQ8;@mCZHfq{yq3@)w16heA0!kutpOc?B1Jaep7HA z*%d`voYN=09j3aNEr~VT>k=;p!sL~X&ezW{Y9?wE8*Q2pCNEYL+Ak+q5aT>fUEf{F z@fcwWJ_(*<_SRh)J$w?D)ze_IPuZq3<{u%byj}{QS;ESDXa4q%I!cu_e>OrU)Ne zh%W+Kfk&U?sgoa%YR_DCVKrO3HaAB*hYT@Cu`};Ka_S4swbnuziLtV-af(~kK8%4L zc|&6&c>r?&Q*2VPm;FUbItG|z=OCkt+!+gY&nlum74 zp6+V{=tOOX*M|A27D7=TS#%z6w8qKXLw2f!bGa`1LgRHT_o|78H?=pryl|k~Lh&NQ zs6DJMJ~9`zc1et~5sTT=*~U(1y&Jkb>zD;tA%8Wu=~qoPXaF(13sNn-2@#c?L+6sX zy19QGa`W!l2@M=>&;@(Fj62S#^7CD-#jh||LEg1MC>!9j;vHWfh&(JeJ|_xRKr(e5 zN1L0k&o<@XQ-uaf{F@*IvL+hu5PuF^ufGz>q-}P7iE%bhV*YyF)6>tJFKe!3h#+D| zGpfS26%5>>Kf;M(m$7yBI7BI?!LX;UZipr~eNa4rn42z$dpw-vt&1!i@FG~~bybKg zNu?*7$@a@tj8ov5KI6Ki6lm4VGHU#J2G3{LD#MDv!Jw^lEeIOR;_-J!AKggTzuMkx6=4!HTHb_MTmqDD@bl#bIR8qLBLl3+&q(hT4Aq4yH@)K13&&+Wp_;=21 zjA%3MVs({5YZ;`f@!HEh+X7tHkcz*Q&bq>~^_Z%)AB*hyy%(3MX1>Gm0?;Qo&O_JQ z@~5L3KhK8ujf5kyFEL-==vn9c^|2!ga2B`^(-xNwcRn$*^9U}vGi5M8+jaT z9-us33I_1p*`0V8o`aOLRZ>qX^So-XC3ECL(K@BAp|oP89O8Mho-+t@ z*B5%HUF=Xu!;E0sar8n$Qfk2Fw3ot;K^tA>rKf! zoKwLlSM?k9Y=CkY%u|4S(4Mh#c!O^Wu+w@{nwLOHis}#!zC^a%`y5NEAbD#} z*$Q8{m_Z=}rQeQEPI-1KFEhQ9l5EQc*iG59QMkaDd*ML6Gs4t;QD}?L-{Q9IL6*yU z&OpUp-hLCY{BO&Sf*81J?sBw;l6jI<=t7UxNPCV7mAeUyH|vjv>A5&9PImd|2PlWP zVGjqeT|Shu|J$whi_VNri0KnHa8U`wMn&9R*QbPjxbKi#GO#q_h)m6LV`Lwu9D|-{ z@^9R2Zhy3FxJ_@+@j{6~ah;=b)#=f)wI@{lje(qEgwgVSC9~MZ#p#7lr6LH7a%|5QaOnU7c4?l_$>~ktjou}9R!b;%bMpO#zWB^(j0Cln#GlXRi|&nxgnX)m?H&|yX6j^I{525%S%B&y z#T3X-0q^hN;TmJk{r`pu0|l9Zr2meAM~VP8E(rsh;W01}2$mw61IBMp^;sFezj!ax|M zmz;)@Uyh$MoT+k*F}e|>#@&9dU%$^`dev`r*TheD*ycBoWC8wt`sb{XC)+8FwBAc2 zdpJ2Zp#zU~k!PdD4~kMt>cAxtmWys?o|BSY0s6t1uP1mI?a(#NKC&M7Wh`rNAiy|% zeD>bk?OZY5bd8+7UddBc+f6m2@p5Kjc7;F6V4RA5T=YDj(}G0Tyl-+TD%~}x=_JPr zLVNbl8+w;IlpCDfk(g7Or{b%xLWTD=pGpq2$zb~!JiF3$q`8b@CMHJacG)-F?9)7) zRHR%st>oC?x}R&p*&@vP%dZt(%!l;Qt{N5ccQ^T6-*6T_5z=ckyyHP1mAf-0(7iWMm}f4gs6NS=B_t(H?j>sox7?P&3Dt{l{1yeSz&9M$#jj)H1YeUbF>SK}ctgYHv}b(lg5;A94xI4g zpgktcolW~;!KK$8n#I7pEMhPwD7RRh!s`@IAxwQuBXjd4Pz$Zpj>R_};d-Eo(LAk{ z`Q`8bQTwGN(*WX3h2G4l{uzFCwmc2t#^^qe89P(18q{Dj@sX(Z4e=7ETG*oGjRiH^ ziNoVRkHj~p+(X_@esuA*aD<^wQf?Bq=|Aci0 zevJ_-1?!oLJPP??-VH%twEYAAF!^k5yP2eINhdy|#vYTi#D`RC`6EmehOWuM_4CPlX{U(r_y~^`aD7In9?GTbuwx1DBQJN`z_b5tG z_p1HY8NbcdkGxlvA9GN3dF-^?K7&@~nK&143N>(=-AXB_8-@72sQuHiWT3wKgP&as zDyyqC;&k)b4Te=*CKYuZT(8RQr z+36{m4O!O|kS!v9B3lSm#Mu9~b_}kT^y+LC{Ua$^TtIHaN=z~E+wDc*@w60rT^jJK z^x7Qz><6GJrmBelCpMJ9{{Yw(5>)L!%#Lr*rosS_Yq=U2Os=ro;$M*Gw^vLcJ< z@x;q-SNnZBta~E%U=;9iNGzc4eD^CBjez+MUf%sN>1! zH3;``P!}UXbzQ1?fK$ez0^9Ma*+B|1Tkq?(r>@NVU&0Ql#nrdfDKPSNCt#7Y5Or>U zwSN$7m^bY`Bfq=PqTQ65E{;Ca_P88^4c*`c|FkvFPOpgBL?IaV&Dtj70-5_4qOe;5 zp1sciYHWzgfc2_xPTR%w64|+Ed2Rtve0un2Z|9!wVb08Ci_&!u%n)jWp)1oVI@tf^ zE~K@$5RGJp%!gBfJRbC8!{QUhs;6|8dRNB0(Q##-Et?VQpj?>wx}U%eudFq{2}yr7 zlX%~!3^@UWC^&*f#$@Sc2E|G8RxY&=;57yfa;B`im)ZDFoy9w$4CuYu^AFZvlb!fl z+cLesj^bz1Q}Z4-qUB;Fe*({Z-5ucUaC85DS6J{Tz8O`V#G_Cuv8Db&m~zkisIkQ7 zQ|pQ}EBeOzLUNWmaO58daa8C8@8`8*=fZRvSg%A0;5~JrueY7Cu7F0=zE^C^nlvrZ zP{Np`>^fTz;%M7ed5qk%y3uu`x^u?<6A8S;miWOn^Eb<%qdTARk@MEY=TF7I7)SRQ$+CRTbtC3xkFdvye_|A za%QCYTHa;p96yzk8%Rr_f!Awv{xm$5YXE%WYfpqwXR(?|k~KNt`-WSrz6wffKz zaEg+eo}7vKJ3sAp$?@bbBy+-1T6pw#=ETCucK2q=z5@rrPIvVslmA^Zo@evJ7NHRo z!Ey+xsA85<)KS9LlUc`{ip}Y`51xb57?W3KzHR|ZBa#EI&UT96K{-bFail5PQ0ByB z>j}uY=Kb7@-ZLW|BiWfL;B^2TJ;YD600wyV&V#_ZBg1h7dvcVHyNuIzI)$--f^Ks^ z+sp*-R=W0ZUhW&h^MpTj32+@i6jaTwzv8w!JOA1yzu`B(X+h48f^ zIP*Q(1fsZsX+NrxQW|UUJfK}JaoIonMV>sl@?Q!6wXA)S{uV$5qYo)zvZ~&E9PK*Q zVPn*?A=d^3T~z`Fp8CPhIx!uR>zpV)FdZ{L%e7`X%xOxAqAvLY>PURRP}jm`PRdd^ zceY|-8~cEOdJI6#b7Z9hC3yk8kl>#5cge%$cY|iRGta+)`iCzwFHcG8`hJ&Ppj%V{ z6?f@IIGw-?=UmaP#B`Y7`ZO}?^;G%cwttk)(5F-2w+an?(LN;=M8AU_ca9tb#e@IA z;H?48{j~izhs99x=~h6xhj&+9q-u8QASZkw`#zRNIUVfsATQpBPOZRrTkp?yoG%rj z+zcy;Y&Os}xDn7G_TB`lQgdaBzZwf&L1DMI91OxS^g{_Bx3AHZwNqLC0q^JBLmzqDl_t$&{!zlL zy1q%>QS+<0HY+5mMl#1uBz>b>HU=$yVK70~illvk{My;eCX5C-^~DD`sgQnK{8s)~ z3RWVu0CbXq!I|#cOn-0X_nDPE$9D&tQNmV{%p^!|sR&G}gyNE~_45k@ z-OaC#Ctc_hGxeU%!-chaeyogB(xSJott8Aw}`1oY{`BjP0;witsegA$@UZDJJcx#!utUAWX1zshPvOsjloHIWG{I- zbdCu7I$xAfIN&yTUpii=m4|0Mc-8T}D4k>ZV|papz*O)C(A3z$S4A&NcSOzMi#(LP zF9EG@4dfIg-M>`W&TJ%=lmIB!xXIK3>@6^|HBoj9Imb`$l>B(TxxRw**XxCyNr6vc z!ZXcS&qt(=_yZJy*Ux>a*KVbRk$6;Og>exQt^Tds5r4Qi1i;eMsYKC^hzb+)fzv@jw7Z!VxO=I`ZG$Uyt~5_ZK;)hBha3 zVBpZgDF0DLs=d-^pfxg;DcnKDLMM#D{zx>(6l0-6U pze{c2|J4`A5es=QUEOCX6qB?A|MJ15{im~ARu~RkhVaPL8QCkP(vu)h$0e-(lbK{!jRJ4O2Ztw zQ(9WO;hw?wyZ`t7|Gm$>JP-TKUT4SJtJmK9_`Q7bl==+Q83Y1BE&c3?0s=w0j6jg| zpC*MN#axeW!w(W$g{O}Y87(ZcaOH%_L)nK2M0OD6zWzzLPGR#*-4=m3TTT2Yskcrx zLLkJVq@O%gavE5O9<~~iqLtb>y+?ILk3^zMi~Y@cFUL);{@;%-UD`w&G_z^=iRW?3waKQ5*XreQZA9P(*@bfE3th@w> zWilgNJb;Kl|3AP_Gr+ku^X&AJ(X^@f**1e>Mardwxiaz1#*EhCs=4u7AWMyNzLv_2 zBR_57Gr(a(pL>+#l|}DJM8I;zUdt$xTk0lUZh73blVUq=m+BtNYPEAEfgx6vTYMmS$nTLv)tW2u`HHRhm%rZ<}ckX`t_b*3ac_Xmx@TkP1E3j(&d&l7=Zv8XO8b8;AjnY27L z+J3$^^{h2s_A|4Mlzm?3CXjLfvfj+n?A- zfL()cmz`ZJ@U|5oUanIk7WHap{SUAhXs29!L&Vglk+nx7{Hbk*thOYNg$3;hRjGbc zZgAT6HOKPj;eDRJHPOucczMCZ;c}MDBFg7ttlC%mF^47NSs7p23iVU-)!Bz{`?5&L zyvD41PxoZZhpm&@3l26Xnm?4yk4&t2G)a4D={lBGtks+;;C+%6VZ>sm^?P?36{UPY znDEUh38=Pd*gYpdm6{6wQ8xQrzp|Kc3YcfDRGnVC&l5t1&3%$6Js5V`vgjNp5s{Mc=8Y|8}ppW4{99X*umXc}@y6Tle(rJ_c}jeDg^t92ljhXZ0zJ zgIw?VdtXMRq+&Hhfs|TH+=2JJA$^^I!F9D?IWI9-wne_ zyPAp>p<1DZ61U>9W{3UfjaB`#Wm!$iiI4TnoeWl|+M3LzGIA*8eT=E!T-$ESI;YRh zV=K^&Vqfm2sYi2_3%pmhRZWJBaQ$l(l#??KLZVgMRm+FXe-KUF6NafS`y?f-PHOBH z4*?5?;bw(t?3R*wwm~?%C<{{owk5Y$!DBe>Rdud4VVp{BS6rKWF*NU}D?qtoPsxfs zKbw=DmM1(vr8bSRSuj;!V>o~v(*2op8)$o`nDT6OI1?)!Bf0Q2b}U<@U!SeIN_8=( ze2N-rK8oH^sQpSYx80QTC<1yed0oy-BCt%&(a5$}WoFoCh*Nww)nqsC#>}qPl)LY5 zXJLLZGihr|b1Cr;+wu$`VY9sdx#I8dZg~UBM9O@t7L2Hp181{!7>OJ6iW%7$f@KEG1Pmv~ro@H18;5wGINaT&&f?s? z_#*vq2L3_^{546JN1~ev^qQ$*4HIv%(yUSGdl|UIyMhKYqU#^ccEfAzw+#IlWMWOX z+;ebeT`FdRx)R&7hPW6qZV|*+YTKrxe{H_qg7JkDxgR( z#YepChf>V(+>{E{%%yj2<(^9|Ie23mpZrb zLN}ziS-s*fQ|Y|(9|T2bREV*PG1MMl2(p9kuV2AL;6?1TRRlS;~^I{1X-NtKA1*zMyHJ?&0&={#YX7bA_ z0F6_jGSrg(HN*2}{5UQp?7*Ud{&r_~VDW>AFm`>7?$4*fztGvIAf-FOpq>)py{U^1!mM)w*Rn4oXZFYtk!9bZ} zAuC-nvx=#X08_SPVxGjs=lLlx#}u3Kqpfv6Es)YPzX~kRQ|vJJZ$EfA+mfs)ZQ0i1rmjD^#QdohQN{&|~#YsTF+0lHj z2R*cfqIFICVKi?3X+a>cx z(7N25v=2@TK%s&s{A_`+it#7M;Z%Jx80_83(;e97KsN=Bv!DjCBJOeXI<~OE`D8*b z@a?v&2K3Sljt`xR%-KypL}6!F1@Z4cpW4$<$mrmY2h$yz%t3=hKkX`*_oEru^Mm%d z;h&5GhC1zRnzxooc~!ALc}HsvbOfpe^I&v8$wDklNkUh4N7<({XJCLRD4_V9AbQm) z7p_!&QwB!Qmf6$7gB?rpakTe8r8t?fm6i3VZ1@+8sYjgtAnKvwmmn{W}w7ID5DwMF7yh=_V$p(%?w7}iytM8~W1}uNG_Ug` z_pFltIR4oj-)YNZGWbmpdCT?R~=i9H|??;NK%?FFi6fQIipUoAC`!eQb^lMnHrRAsZp%-738kBIE zuH0p3HL)xzncv65|03tcP?}UFuSdmXpL^@D?;)annsv9{P z8R$S-QwUKAyy7XFb@=$fxgjQTrim{m(mtyq%<|bHU+Ygh%ho0KHM<1!>2X?JDuk~J zP-!l}_6TH7K;9D-9P#|KD$cawB3Z-57#_@X)mflZtNbW)5kLEW`R(T?3ZgqkQa2*g zb893E=Ql&yw<(GX^6k3Y7#!<*Se%BQi85Imr#y~_wAicFqc{{D^1q=Fy!Vy-DHm4tGScCRCZ~>vgZ*spxiyHo?Yu= zA=h(D*s| z8RXLMAynLq&(1=yi)Oyuvxx53#`x&o>pk9wkLT0HEeyZ}6y`Q_<5{gJr@XKyFbZG6 z9CIn*UEXxAWlsrnsql;M`8I93Q7L+_Le1G_Tk>loOfUFc1{_nsc*}+*Pk8_qbEio2 z>BTxFAWkpt~o2JF$}xt#jZeWSxRrtFm~NS|1~42H?x}-U*v(^bo@1mkl{&O7(U@Oe@e&thi<|k zHLOHSx=@scCR1S#Z^KVsy-xRLZH%xmc25&1_3GuKIe(}S;M}9(MxnNx5jK0P_|=V+ z=|~Yd$CrR%_1*5kg`}dMl%XXiiibk2*PZ6It4dQC^KHyE8{cVHshr_6*NXDk%RiSp zBS(O}Hu;^6jC>!h>B9BN87oGZI#uq|AhQ>f%>9-P&3(~b)8|pHnag7J6{GbtERL_xu3wr$XZ{x28NB{?YdVxxO%5nPIyK@}{ zjF)4ZK-=%;0GnZmsh$h~0FT+)-XaibCPrnPpU^0nZ7SbBHWV zPY&h+^6_!yt6AvPdpO1g*5CeN9kKp%`|KSlBQ`4KhTrW&6)LTC}-<_0Pvzf9UIixeJR{O!x{9b38rOHSe zA5Z+KcQ=qakiPulM@9{}&iUR=aVu$h8t-c8=ckaHR#|fSjI06RBd<_u(e*YbQ}XHj zvbaUWPv)dQ1<=-^SNFz_NfbeiNQ+!@ODQp4i#QL@F7r6~leN65_&MY^q@s^XW`(&- zc44>;1O3g$}b28W^XlR<0f@WX7snHuMLH3T@LeUy^@b=Bf z#+)VYs7!ua=qNkRhJQ<&3eiVk%4U@BTW_`9z3N}l&~>?|ApDo9A<(H3XK%@V6gU8B zSf(sn&0fgoYXg;@-lA5P_)VP=^jWeL!J=XYjN4}%aUIQ7Z0E=2kJo!4aGYh)!@Yio zf%$50;lWYVmS8d|?#tWjDhIg*%V(HUe}LF}uqLxZ)rjF;Kh?xt9wUInFga0Nd07A! zNR^Zm7B%2%r|>{LCX2$}`5U)eQK1Qz)Ur;yBRd|$js_EvY~3#}O1hW)h%_6YACff# z-T<<@Z%ZLRj*U9?b`%|w%nQoPfC7C2^ZP8U9dQAty7~O_)t$%Uio5D^Fh8C&4ai^C z(mk0j@vZpGC7e12QlsUp2gzlIlLlVKq767r4K3^DKCGV6T_k(EL9XQLx23vrSt-i( zo+^n5okAZK;vMJ1fId_SNzy0pt{>n&w1g3ShhKb%@ERCEG2!3^meOnJD*Yg;BrMlB zvqX(sGi-quzx7eUYU>3djwPO`v0v#)#ZDt&@ME3?`VLqjEUf^MEXIG71>}KiCxaaSTuL_M2LdQXg82Gzc4^k4VNFUO zsP3Z*wPdG2AQqb(kzy~8IBLPK>`2?~hF6bHUrRXaM*xGXzjeLNLQkKC_sTy00KZNn z*Hno)!5ip7Gz@ALpK=-i{zW;TZon}jz? z<}PdD8k4`C?S5O6*~lW=r#`A{@A51>!k#YnylO+WPKvo@k`cZtYt;g7-U%Cv_ zw$Y7Rk4FeHl&6G6LSzzSMTCXv!!>p`^YU)-UQ3Vem15d9U#a}8aaj9!;EsX#@97je zRn}4ajTPT`C|?Zd)peF;spLh5`~TQk?c*H!K}b5(s_h zxSkN_P5Ktfi-bP(G_#99$QoFla;DMKs=gU04$`%;mLI-`?h%LUCOe)gE=yxiuk_Q> z9fehTtp7+X{$9?IL|*N{@H7Jl1-@+74?~9Vd}^8u@Kvsw>?<|$&~H!WHK-qFd3kRp zQ_ft*V(GDHOtfyOr~Q0*J=k?4G+Byr8WpnNkA3!<(zcJHxqgE(V(-+Bg>!3~}2EF_5|{T9;>KT)Sa_ z6Dm1+4Qi^5yx0(>m)oD|;gM$&FMegHJAG|u?MQqN-P-nN)+oqC_mvTvT%#IX7b!BP z>A6SREVNE@@VfaNu5om?*_TJ@w0%TGJry(A>0Hb{7i+F}2~u&RFECwd&UtvIgXWfH zy4!>AH>rJZb=P)ONa0RcaTj)JK48%mH>Drmk0VXP52#Aql{vpY!8~lKlVZ=Lveyth zwKUi88aQyVzjjNo!ure0EGY6RGQtg$$=hwPRy-8kW4wEF-eiimYE|n~x5{go`6*xM z^KKtuLuXn2d$fS$t@H?u62==QW2)Fuc9Zq5qFC3|0k(qI7hC&7gPPEF z?ro-<#!2ko_2c+(>g`jP#{1kxyRTb}fZ{`9D@%2mPOlv%gtIY`swIl!J@v64o{p3( zrxDT3W;CV1WrGpx3S%!s!;ZKj29)k~U9(zuDDLn#)yv-ug6^M{FNc&8bjOer9=D%! z2DnczVctZ)T{<@kye}{b zF(OkZa~bQa)_c{EZZ}KsX6BVa=?ky(@VuKX1Bc#XW=Nb+?7-@PcI=wbQJrh7=X$mX zJ4ejO(PW{>zKB1YA<#yOq*Du$*>XXH&bSrsc|X`|TdiIgc-|7nKW%h2%ZK{LJ3@+| z_T*jTLXDFi#z@6&rfA1oH?QM3wF1NyRb+5?+38;~DRAJV>veRucCz+gS4XfevMN~^ z)5nN$AKvyjTuzD=|I+trJ;px9{g^H!xL3xHG)2d_8`|(P3$vFTOA^L0crJ7u&n9&? zW2>M6*ZB+XLUZ@#3{_rwesk84YY_~SsYr77exb&ztiqmfq|w-gYFmgb#-}0ySruO? zfzHWXOqd&6(C5==Fk$9nY2~>{MdpekSDA$aiHh6xhA$5GPi7x9`vx`W9vwym6fgDN zW?niosLjHNdxI~;d^W%@4fMR0vAvij@2gUBrcaUdcFL*#{gT!*DkQ2KVXtGMzEgPt z*=jGx&xdB!re49xpUNYz<4!qKR_E1YTSpZb&acueEX!a=vDBNsZk!wQsg0?hjsIdM zDN>iJhf7b@raIhyPnE=#_o=QRU6CF3^S}T>ZB%p1gOkq{=`L89zx-hOAqK6wFj?5s zYG2>QHl8UlvR*Fum}saXAS!*}Wg@gKrTARX%ALzxpYv;Y+D7rnM$kiD>~{i4s+y># zdzL2JtfNKZ5A(nq8L2Yl#Fe(9ysG6hVKg~em$rwsW1)9$x!MvtSs)E_vQ6a;Rwos! zPIZ|A9=cVJR|AH?Ck~&?a~-PYgBI0fl`4yFjDrVBC)Pa;+b*Z3{CRDMqY%6M$lL^= zBeQnQa9oqB-woLs{Wc@G<*6-tXg)LCGm+`&!9(-}_Boh0lYIFs+m$bnt{QW(!))(h zOKn6x>imoO%M7YluvM-W*5!ji-{dJTNDp}Td6PiEFWF8U%qVDj_PXl6+i};eFCOdb zZ?EWwhWn`WfD^Fy?c#%X(qiTp539R2DS=s2TZh+sfSC5)I2r77Es3pQubZH~HZq^I zW!0S7{atdic7ip^`4o->{r=pe1`W!;e)$|6l^jD(Bgq!^h-YR3q_{UOaA<>gAnVr! zk`ul2ac*#&BfxFpR3Qs9hXzmOvk;>i_$}@YoDKSvmF&T$&t%)3p$NPE*L zg!)oA*;~DzHy$H6@A&&&{lIW7?(6C6aUTS(p78#l`GV!k$y4|LJj{t3u!?B5Dorx! z0S9_(1R_~81eN;rO zj~o4u9tcFA5YG8Mq&JUL41-vQr1uh@w@)5NF+VOp=`Ex2#l$uvB}kS@PMKb{@R4rG+KA6LWbR7gW~5_9 zx^=iTBLeqhWDxcJ-mo{52RCo99>tEIK?Lo+UJ!^-AtA=2S&Re=Anx#<&J}+OT+uI{ zo(fSp#rx6`HLp4ks9eeN1yA zKu>TKcfy;^<+R{vn>#EA>-4))Q|aJWbt&W`5sjN2Bs_C!rlHMzuE-!MpDvAl7qK{R z>RTREfD{B+1pRA^N%#-$T(DViHG7)5T0v2(+0_gWney1YqTcBdwrVhc;5w00fEAE} zs!>L2*ZrI~!(nJ6Ug7*OaU+}2jdsr%EU|ume($I)*&DAJD@$Ca&D7YGkWYKAe0BJ6 zh@20zj!oxJ6wg*iwBMUhZIcqnnGz~5w?MPI=rifKOcP3jNU|^{F`n%jpVE@~Et^4P zUtM;3Ua6*D!&~4e-uPfgvm9bK2b|E?h zP9NxtxSGOTA9*h30a51U1_t2Tu|}INe{!g0wEH z?gp-394j`4@z(>&FEm%|FO7&DE>ajB17Q8BhLr|^koy3+efjUILe!>z^ogj>I1)JZ z|EpYmRL7MpMk4&*l&cEFTTY*}5c&@-oMvzR)MWk*2oSxE6uo$?n6#-2x2`p3I-8P` zA$;`!U09I{peKp90``CJQo+dtajs(0#M6&LrX<&d%g~C*>hQ=~vlGc?so@cKu*CDls3OF-Y%|JDa=hnYXfiX!Ja9Cv!#deqSt=XOlaExS6A1YYH47i>z zmXJd`l-L}ap5Q=^q*J`J!8sKQB{2Kew@_sQ@CsnN0(OA$pYqu6dPs*{&?k29qjIoe zuu&CyZXx_o;E_y8zOlNiMhbtlA)xL2+aL^o9w!fPhQkt`dq}aE*QaD{#~DHw@WiXc zqPGuqgG=6ZQL5Cdp9*FpY_o$^u*cTxJxm#gCNRbj_;UpJ{x|XyjmJMcf~Ws$_!l*&bB zjCyXX618t~hIPOF1PNmAXIaQ*8Pc{@O!uw&8Sc&eqDkj)&|($++5We}d6|%B85-${ z0m^(jd0k&ic&xEk#N8rqF1`(|dvtlX_bi&7is`UFFlqp`kfPoaaAS$jU_nABIK5|> z!(2o&kDIJzwF{&#KMR3Q9Evm_^q(}IrdIC}pg$-bZeGtLt9{=2yIianR55(^G=*7} z-15NC`H_OzT*cQLWgGI15W*JqcO5@0mS6Nd#dhcERAY_vHGl3EW1d_cSiIAyZ23Aq zBn%|cnC6UXhJDxu=!Xuo116=Yqj*P&cyAFXt6pw~Y6ZbGs}vqfpU1BqziQMzR%A4w$9dIJFjVP0{_O5{8?VF z4-^JpX=N{ZA;;;>{tqv)b3e0d>F6Fc{NO7eX%#^7_7 zx;0>UH*n$SmCJVBpo@Qhou`!&nmp351B5LZq#L-rZ$pn$ckK2-k z-)wFU+-5d?FGWjgN(E+DF-R)hAFKjD&8@aMp+my(GJPnq9=_IB-AF*-7LKF<4V1$o z<^}P~Y@{uV7C>Et;w6a|YFC)JHL~OHngjWIN@5>>Gko{9MfIZy^)=5GOR^0UJG#>D z3OEF-;H7TMz8yko+}AV&%=(Q}n`}QpHzGtUAlUF@ne5h{)8R-mJdQCI(Dj%)6`Nu7 zL}e37??VkqmE=%5DLHmvB}*6`N;~}*1c|Qg2lTu~H-kFD?l=fhRl&DR1iP(GPWHQQEsMLhuH0ZPgr94+ zj#h4)J&JOpMK5s0N2{9uQr?+7M!kSy41?SVzsTSI5NLB1x%RV>`CmaxT<>Uf{!Z2c$JoiuCD^%aS~ zu0_=laC}v}aA;ZSzPAbC1g(dPR=O1Bvj58`!A9;l3VaWn!T)enL_-XFtt`yrTuex3 z?!>9BJ2|~QX(?A!xPk`{JF)2qh#A8XI=l60cC#Y9BJ7Gumb*k8{fi!tScf&l)iGNa;kyc-!Y0XPg6POFqWNqg{&8#fq14If1fbPiu_U-~>W09Ade0IPc7m zjggf3b~akB%fBs(o+)7DWVWx4YCEV9@$|jQ^btz<63C98`_#;T7ii#tX+;Hx zNMbmO&8%RpVg;PKL*yn>AD|*9zK}N?_}Y<|=R2awkjAgw1%|f@-{jHeIJi`DAS`+Q z?XhF62G90`3Ud(0yd#Opk;x2NW1*o5q2*bloEf~>M%nv#*z>dAoeKg0J0>InIB$sL zmAY1vb?&mC|5diP`@$Ok1rFK!H-02gfiz&kPBWp21C0h==?1ia&&P9ZE zrP!dtIftdaNq0Fp$N0Lg{AZ{;)S9uR;^k1(37=IuADhsp0=R^jcd(?v5e`A90CQ5m z_V(O$vzzcaIGkPm0Hizo`vy-{uI(7yb|G-NMa~OO!tV{8(jbA@o!+_pu{SyKEw(B zKJ);Q!?*3-VJ{u0oVB%axyx2_sb-~%^@Sf()+@9%aiIBRiVANn^3}4oCTB~LOc{E3 zMV=b&uLqQ7V<3DEGfs%7N8SbNPzj$yEJAl`$PhLzu+QAqA;8x|h-sq(8u*xk!^sOz<_V_wKqnysM46=Ddgv_1*~7ya~E_yX;E7rYIX4*Tb>4nG37<5_$8?bmq_ z_gl+64tA#@T>QPDD`N35aS6O=c7AN2Oh<4G-8GxhkHhh?;yse@@u=%``uT_RBjB!o zK*vdC73uOO_uEc>3;}Nb;g@Q&e*4ht)5rOU<{I2i};AVZ?=2$e(ckkAvM1hs5z`U|(RSYIF~1R7P_VN8%;8cZ{M?8nmu1^kU}= zbfHv868FV=)}b{IqT)#?X%Ts{)8H{*az$>x?@fn*CNoY+t7A2=fKgeQ%K?kGWLNt- z`uET=3v+oO(0uTIc>@|0UE%V5#PXQwg*h;0gkF+*ZN)B5!z}#Nf@SK4*tEh;4x5S0 z>WA8kXS(gsK>E-86x;NH*72csB&Tz2b=MG#Ra$YglNq0KasNKDuO*&1m78+aW^4qvZ{B zNmGI%rJv<;#wQ2m1dQZB-SGj>{TVokb_qh)iQ9dQe@^pR=DL`>%Vyt&Wf9prnsi?6 zk_4X=-TN2ud}{X&ln}M*9xI1UV`FijUWVJ;PJ5w?_(vL6a zE`z21E?=$KJA;#wKW`17IAb13gQ-Y5p{KLjHk!BU&)l7#8I@a^-&+~OG&9E)=IT~> zPVJfkx?03kBuf-0{hZRdAml{)8H#TQzk$j|&R@4I_fF^%`o%3(6)&E=`B->B6nd(i zyJFA}KJVOkwwJGveWM^4N*OHn2CpJA#AwCRvW}x`Jo5rIqZm&$p$7ENwzLG?MWwSjLdx#`N*O>I z0F4Ej1B9X!g}j8Jo6+n<3Wb{h(!!zpNo&dLFLx{3_UueKtVYd(3EJF*-(PZi*>RW! zerdi`&ph{}6eB<#tr(5J%BwEgf#3>Hw-d3J-7|CAUqz{CI%4;S-afNihn^=<5YuJJ z9?-7!A?1^7vfx+^)MKpV#y?yzc1bG9HILdB3~bOf{?ZGsb=zsfp8>s7>0F5sR! zs3o?fybD$VYb9O-4Jp<+~NE+em*Lp-)>6ySdMd`3mD;FukoXy9`ltLt>3kX z$~bCbNYir2QI=N7%LGe)u9&uV_ptX*OI#|_mFlZypxMBIxc7lL2|_IfHu`HBq1WTh zN*hr~<{iGrZL}!|t&Lf}%xK5+TkJT$*h!sS55qZaXE~AdT3>P4Iq*5+`nmdB31A?F zx`Q~9jai){*&*)^tae15N-D%W)Cx?o&#&u}?!Fd!T`J^d?ylB=$wLgkd7BMXB-0ur zme#$IkkFp?SX3~Zu{7l%X;6JIFnzMa`P+DbNYm~;N#l8&rykjdO_yve^Pu%KJQyM_ zy+}g){@MHTm%U>KbP|in9TS4VFBDh$t@1FU5wW@oHFpUJ!wRvt)0 zLUfR2_Bd$~*~e#X%>)wu6d}Kz_{r)ipX>JOdV_zniTfjJTD})u;cZA+hGpYQ+{~lG zQa2gzcJ-msPvKNY8|PBr-6%n}P?ypmCm2HSS2yG%*(Ua$eo;U9{tC-)+}&WayNQlE$6a?+Cj2TQA+J zr0aaQWXAw1EiKpgch&|5)OlE-t%|8NA7QaPWF;X z8vt|2_*1_0A)oz!Ke_P45$_+3Pe200!i{ny zL2`zv&AC6ouF%{;0x}w(B3ro3fAL#<=Lwr@=xNO@ICkHj7<61(EosQau@3M4s-D+9 zY*NkCI_MB>fsBxB_0Mt@t0afp#VFk`Ih1r>_}B&EMKvvOuh`ZUtG=L;j{@cPe`~zh zxnN@j9LnFY#M)QJX^WmLtLVJY(%ECJfNRgbaVkC_$ty%98qH-`AaXJgLTD-BitT46 zmaBYbe!M-kwKQC6Ki`vY(c4mgBo;Kfa1v4U0BN{1bTfjujf{{fzzp_LMLi}eE~OE` zIxNoq_XTAE23MGMyxpzWkF@pGI!kmZ+-GH$?+MVa{9Ip+4JvHDdc6cy)xDk55z{5MFot{5@y3^xEaAG_j_YxZdJO%p(3durJq z*_kh^jMHA~$`{f36J z^VbNawi0UL5IUHEUyZ~MuQYAnuF5!W-wle_fO^)*HE8+BjU8zyb9yO=2D!%jEkDS8 z2%>Lw*!`2u=vAl>Tc`f~+>qF5RQcIgvFuK%#>!ZltK~Q=t>+z|E&eC>gk(N`*}CrO z7|iND$yxq`hNCK;xRPVC5A94U8UyYQ6w=ol>LVw2MX&k)3h{-+xwI2ggf*V>L@wpD zgG!ei!lPqqe$i9?NKUlN|HdcdW65xt_SIOpfXkP<$QJd`=87DRvJYr^?(z%EiE>S| zON2Rm?3NV0TUNN{Z!t7lh`zGKH#=xq1M-(%H9j=C z7fqVj@%2tP`0*lXf1y*eqUK&!b);7C`ULhK&EYQ$NZqoKm^+d+nB;!F-6|(bx%C&iiNI9_ChEmJE)bgeMe%# zX?&)gBQ)XD&8S;z4q!)SCB;MARlZ#9ktB{-iTlEb+aae|-L~7MET(I5K$`75n0_Nl@U4#HZO%34OJL_+MpbHg=KLvZ( zE$~PCTTNm3{@O2zs#ujCLexyL3ly69E8RZP%o*yExa}D~d8zXEuH;5jy9V5%3$>p< zNs@a`%P!GO61s8ZINybGxrkm;PRh^Z=lPCtj=dPO9joyny==UoC5&C5S}X(e=dmXA z6-=#g+thSn__Gk+SYCe7k>rk;Ud{aF+!=LcVAe8gHl&`+<~98Gfo3ITkq)pz$1rqK zbf%?W$dM#MPOpYTnkH|f)GMMJwUaLAR`GX)$`1ZgLr3fHwm@T=_}*yB&|^B*kZ|Jz z-e0@DdD}ITjwDG8wH+ZQ8++c(9D2_)*90nr;<^RsJWSIVyHLu@{T4^`f1;ChMab0D zfid3#>_bRNY%EQZ^DgeSV<(LG?i~@>bVvU*n7>xRD2)?445!cB|Re@z% zcl}!*Pz8otCZlyc+nP)MLNv61+QH%U-sKJdPNe!_Tt8>jwwLslUCG;rmB7Jz^Qjr@ z3p7hxIpgrP=fXehLGbNOR|O#VwrnRa#mf0n-soIRflLzaqPBujQ=ZeRLRLNpv%Fn#h~3V{Hg%H3_Z>x z;5=pbTuvwIyB{loHz@Wx)g^M|2Tc0Ds;HV*+1cg}?nHL%=J5@9iGHfEx&q5sSC*cOArnNbJAu zjxmSZy(C`p?Fuv`4)(vB{nHk{_xb=9YM4d;DqaHcuj4NN^n;}d=Gg;c0e>2BT)@a2 z&-C@bFoMy7$08QTnE$Id?%0-r-J#0(y}iBt=g*&Czw|skbs=~U4@+?>+U7UKsjoJd z{C#iCfHqd-UaqgK>azcf0RJ(}f6f075->W)YyG=mDdH0TFWA5QkF`I5{-4YKyLKuf z;i$GM!JnQGfxv{t>eC6VEqg8#jw=tLNDKyEvmpq=T!G6TB`B)ptU}VK&SXXau&{@x zxeEX=so+u(W&(Us){*2J2=^{#dCMYMfjW0Ius1B`sH??iMq9$3Vt2AXaK$Y z_G>R?Y)5_NNAB8Ktf|XcZOXD^>-u@4PfkCB#U}$9Row{`McjSpYKhy zw-sY>6)g-Cxs$_}J{`|R=px8Y?gU>^Hms=;{CW3vvm%~aK+!#VqWN-bPYr`m)Jf)# zQeiaotuNhdg1H-K=v&ia{LJgn92V0HqGI}=Jra^JDhVh`bNr!j@4FA2Ej?N~oy;ms zx8$OvQ=&euO31F>65YuY`HOrCMgf|fA+MX*R`nFJ>ui zymPy<2%Oe6^IyEja`x|ZJJgF8;rLVNQW}Q2qQ$J{LWF-^a|;x@L>jYiws_XyFR2bU z%IMdWO`BC8!n7v9M3*A6SP>SkVv9_JF}t>8@xBQ}*0(RWFp zda;)ZfsVwEAuY%eOEq|lY0j;7M}$q%_%&&G({K?F2Zuyc<|UE|N0^(ttXocdZZ229 SXv5o&2x-X|Pck0qdH*jZVNrkp From f6029a63881718708c5349204ce303bda0a6a11f Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 8 Jun 2016 09:35:56 -0700 Subject: [PATCH 08/69] Updating images for new EDP content --- .../images/intune-data-recovery.png | Bin 1886 -> 3150 bytes .../keep-secure/images/intune-edpsettings.png | Bin 4303 -> 0 bytes .../images/intune-network-detection-boxes.png | Bin 0 -> 4448 bytes .../images/intune-optional-settings.png | Bin 0 -> 36815 bytes 4 files changed, 0 insertions(+), 0 deletions(-) delete mode 100644 windows/keep-secure/images/intune-edpsettings.png create mode 100644 windows/keep-secure/images/intune-network-detection-boxes.png create mode 100644 windows/keep-secure/images/intune-optional-settings.png diff --git a/windows/keep-secure/images/intune-data-recovery.png b/windows/keep-secure/images/intune-data-recovery.png index 0913c7a22b79d8834409b8e8aad309ba7cc9d7a7..32d72821109649dfb349e2174e7cfee754e987b1 100644 GIT binary patch literal 3150 zcmeHJX*k>28c(&Vwl>s0v=yz6Y7DiMq0=G}T2)$2QB15wBBCfotR<8*lp1P@Wt6EP zsI9iBini7=i7l~IDD$pPv>z)ge+sG?7C4giPl8DBRBfvQNNdoF??&_R&3 zr7aw=U$}4q1cHO$XaE2T4hI1<7z_r?5C{Yuu%ppvK>e+8I2<02kBp2|zTN^y6VYg* zOVA_t5Q4|U1kZ>QWFotv8n zgv;e}*48*{`)eEyFg8~=H#Rl^w6+h(+Sb6C;n`mWo3-BnL&8-ZqB8SXVVM=bCo0on~U+!lbPWqaaDwctQP*n|+o~>keLz z4RY?^jCId2Txxx|lxTDoS* zH7<+%dAu{))gALDG%cViEC5+QV3P4`jGDsv@8UU%Upxlp(f3mz#zJharoql+_L|>` zs!IC(-?~1peo~Gnx{tfK2IbHb6*8F2hl>=_8%-HbM4=Z)>enY zE8A|{eeXk4hCJ69oXMnEZ%ubyAC{wGcb7{2>x+$9&q&B3xld`*N@+chznap^Q)q`} zROSejjm_LIcG`u$h!9u$xQ>wjVMDKK{HFVZ62UDMMphl-artyp@~CyIBW8v5mQHc% za%>P(A8HJPo5AXFcY>!@8aKr5W_=MkwDiwmIqlFjQmOLn<%}Nm$nY##We;AasAC+?eY}lu88rU z!n=?E=zQS(>C^d&PX<;h$QrNw%`2}Goj$vTm6rMHi7Ks1in>sTvvvG-Tz4exO1bR@ zWYOMo7w|Q3|5x#mpL6C_V#-fhi2j-_Pr%oCEH>Ov{@R3(@?_0_mF+_nq!Y%KGB=xF zYLC^F4x zp1rB}UuD+1_}5v2VN#%gA=%?GV7=qoh_dp~F;=K7d;Z;5al0E?1+T`6LMF;RPvd#WE&YhorYc0)Uk^~cJ;`B&-(saF>wqJc9n8R;Eei7n}}(g;syB+HFD@y zkr161Ro2DrXRb&|8BUIG*;qchbV#+;-idzRx3>IBGkC>Brop(Zrf?7jr7X1d4_$1fJKVn}i*!ZDeG4 zrZVuAbt8(jJEyQgW9li&`sSLM9f!5Gs<(ZjYXy#?O2b9;T{Ag*3ax50DetZGieV!Q z`MDFKtaHdyqPc31Mh!Qj7FBAuk67xp5+&YSNonDcm5RGJGMY=`c#4TNi|QH?eI5(jlZxV zf%QNoKRHp#E_&n-jbZk7&T>M@+z%e7y9Bp!%BS^KSLr+3-u`mueqe>?UW~6Hgo_1KJ4cAt zh@stsY+i|26J?at<+p>A(A_Kja~G(#Bo8a*d%vE}9ar|=lB%)~i6S$nTm}z)=aYJ( z+TnLZF=MiM{WZ9Ddhw(w>uT9#!&)`~2D6p1#f-BMhXe;4eh@k`w><7d6+vz~?6B{(d@_ym1?f(0>vU_yeQrNj>< z{T=#|AG*kIVB`eQKns*#V4UATJ>QQ)^Yb(K`50k-13&Wp$Kv=6gliSXl^&2id5mx8 zr3%HBij(kQfCLJIrvB%(_p%&YA)M-%An{*(zzs>d?a;!#0dq>s^`CBxlY4giZcF`W zbGXI^9d=sQ6-IYmpP1b{8L5%uI!&K#oc-3eq4N{j$JyCVe-hJI*^r62uWaV7s1DXQ zBDGOQm$yGlCxrV9uU}fV-r=e~P}{k>%rZ&-pzpK(zO4t9AXYQCx4*SO$qZ$)PBUt4^h67Poh`la-WcXySwjGK* z+C6l(s+OBHYa|Q#YtszIukXn9aagd~3l$uz&PiK-Gf1Q$2VBw@}Yb6{{cv{AZU1+zM7B+rr4axwHL8OdL#0yh6tXkvHQA+{Tt*$Of?H74P{e-1 zrBa!kW(KFFqP~^I<+1Lk&ev}iA0-c`0ZGSNFowR zM&3_|ByyojB@uPVB_fqdI5#InLMD?*oPD8DswB@%L#O6C6{J(cFI<_xHV zUY>6LN#glOL(!vFT0Kop!^)jf4~-1Ll#kPSLGmp)RdvD;m!JR8G*XunB2GgKp5>YS z)R@ZpXT@LLV}xI(;lI1j8@BUK;CM z10(|D4zGWR++{g$i8Tx{EYif@jroJYYM$Xu;xw_$n4Q@}hGkPcVm-QQs4zo$j^v@r zGBSYR9C-QI-Tb)Q(p^{awkk+bUiVs<(wbsW~Ir zIFPgKru|C(o4)(@7WJ1F0BkhN2-mnl^ZN4O?~SgzpypJt^3Xm{!L{VN9)dtZ;Gk>I z1_$?hUo&^Mj`h_r?j9)Lp(h41LoazLG;$rfKk1m|O&nwCl<4mB9Cr*lr8aJJ%%eXs z&&BSXwCo;ZA}PN&MUyd^=5f2KD|yF>!^ER#2u<)dsCUy0L&s?uNh{5A)G^ufiA%~# zVhIdZmXLyMC}w{9CPKQKR~#qFF4F~kJI93-ED!j|BNlVRfgr{(5HxEJ4VQWhE!JAf z1ODOtk)5*o^cJD4cjP1{CHIbwkuA9XU7y413@M8^^!eq1xfMb%Owk?93ha&f2D z^Rh0M9s025MJZ1qlm+-+Ht2FaRnp?9mGZh5u27^a!HDXM*8-H3isMqff6J3{NOit% z?!LiXAQvyTk2qci)@WM_G;h?o_F0G=i_-;CTAKUO!2uTYQFH;neZJ1iJ}~+GB-cj!3p6*eK zF>7Q#SdqVc`C|Xv;zLWt#z5P3a%wzKG=f=Ayh&lJcg3^=JBiTV>BIezW7bCni6rON zQ7FSzhJCR?eqC}2uP}%-7VKv zd`Gzh0&Wn4B&RIM=!M_+jKUEVzSGw&VS7MJ8F}=1=4BoSw$L-luWbPBPi3DxGN2f@ zvNnEqKt>*WmU+3I1KT06sR2BPz<>e8MO$m*z(X=}CjyxqI2nQK4WNXWeR8H>QEF#x zTx205_aKnPfg=$(*8l=+gt8Edj20oIT?j4bz&8-O)ByG(u%}qw62OP!`u+86<)IrXPE8V*J52^fznAA;q6*>IqSYeEL<11-tUhRQx*}F22C&?3b@CV|8eD1*vPL1k{p;e4@Zr^RT+PZXw z;)N3rX+9_b@4szU!3+|mVly`#Qe<@U=r^a|Hs=QYwZsYZM#hHBKJd;>dUb<#DDpL- NyzoArb?%qa{tFQ;ssaE2 diff --git a/windows/keep-secure/images/intune-edpsettings.png b/windows/keep-secure/images/intune-edpsettings.png deleted file mode 100644 index 882bf0d46bcc72bf2cc83212967a0136f25d6412..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 4303 zcmY*c2UJtb)&>+2DJn&zNwcDW)EE&VVn8fdK#53EDG@^rgpSgYk`O>ZLMRde5rNRV zh>8hHQ9^=1Xp#US1f_#b-W?hq9v%@9 z5g8H58?mvmaj|hoBod8Ar=+B0WMpJzWnr=~SS&UtCnq;27m36tVDU&i9?wJAg#5hx zf`S4Z4p)dPEGjB0E-Ef9EiEf6tEi}`s;a84uCA-AYi(^s;>lP%0XLY?@D*Q4&#Iy4 zv@Mk22?RW00#Dv1;IU*pl1#>b_+36hz;BcB@87@w{Q2`2!k4bjuAZ+w-QC?iJw4yL zzx93VqmU>A0|P(EKZb^es8s6c=qO=gf-td7-rk-Zo7|otY;Tjt$H(b(`qb1EV~W9? zW-=IziEZAPSXfwKFR@ovR#sP6*=+XO+8T$$;c~g_>+2gE8@vcbu_8NO*@V3>-Sy?; z6aV<<;U{>#cIG(``hg*SR$i`t0T19VeBKY-JpD91UHp{wG*4>+-F2T>@`58QE`qEB zhgdm@dHwy;1S{7tz3_Ijdedy=3kv(FKhAm|bNF(ts=zMCBd;W0rrQqL-Z@Zaec&yH zlNQoDIZEwv3UD>hReC@6>tkG&g{Nna5j)#=zT0_v7yr&~i2ZKN%W#FAG-YKWkcqee zeBa-&OeNs)!Z|x(WFoZ_+!quUW`9YCOMdD;=(6M{Oazsw)YIBDB`+55u8;act-r1a z*lwFsY!0Owibfj5*|En{RoN`7V~0~$Dg|lz1}V+=KPadjbLMoWEwX&9!W|9|-fB;~ zQhY}H>z1*^>tl_|JCV@}g7s$4nTPE9y`gpRj53^pn)#$L3i)Ydu|VMoKM};VRLXd~ zoFUyvFAPq7|4k$BMqe-*_d!ZNNH-z@D}q#{Q>kPSyJ@iUwfCxW{b9!1aB&ZFqKGCO zcu+3r6!iGn+hfW%fv+&6xOU=qa}yzCg2F<7vO-EtXy^_aYDxY9Yn=I8TW=3s=1iUe z+OWg)Oztsk=5--^Sta1$by8f~bc909_vLmf2|spWS*89_Tj-e*FU{W?XqSMriz$#-h>rZYlwbJC8u90pp7mtfa7~^&?X~qg(`##UdhA!*4|RCleACK-;%vh=hA7eFm?O(xFZ!H) zS&56T`v_Zm5Gtuwc_YoAfe&5aP2O80Z-=N=Dj((0s@1G-fJmxqs<&;NL-pGX}l z&8v&2PUfD4IzGr@fi%_os4AJeKz(Hw>Kx^q>$=KbiGWNFp&kJY&pPK-c+$m+uDXwE zdCLwRu(HKVWwnAlll6zA3Pf?^P?hFdOfz9F-AOO!MZoQR#LmVR7a`Ki!I67NqmA=2 z!~JsFXMSotzGHI=)lrqCq3X0}Nd5ElY7*s^FQi7fw(n3`lH|!e$DuE~Y-x2?`YZHt z!>iZ7vmPhD_WX4OVflroV2ydJ@A~chYE^^k)NH3u{B&o-O?Hbu@{L4@dfi>Q=_O9z zG|Un@>Mq%M>>Q#;(KQFA3dMA=9?*2=4OQC@=1r}DPljC{C{J>e0uFhH+vi|#socei ztEMY*T^mkrAz7KUT~;?O&UZG`sR>BM9 z0I&yxFW(cXx-;zB@^`!M&Gpuvf+wfhz#{91q|eGl(e-?S8{57tR+ z4nx?a8qGZ1(^%V{&*@%9hkUl0?t{L)B1Zdk(n7LPXRtB#(9BXkz}EY`R@4n#j~S7E z;DiwzF`V~dejlxc_}VK3ohV`a1sF9_==k{aB08~yNHqf*1uD`S5*%o$W=r-vl5R>k zXA>J2AX6V4kP0Df2bCII2=itm3D}^_Bc??p&B{G+=;&j~Mz#?`^J#k%)dVGb+Larh zeyp+(6&p%BZvQ+6QNyW8YmQ2_PY0lvNa-{Q;2lZW@ySd(bsZ=oK7AHBq8)G8A_KG} z%s;2xH?r$mlz@GwV{5o_A0J4(JS6KRSb_O*Xoz1d~L}7=((*gH{4&+ zeSi7@HX&VLsE9T5mH)Ci`-Nck6Vww7@kMbRT}v|Z#uZql4pS* z&IO^9OPpQXLg$uWj0%q~ysv~!ZULZaFJEp4rva}0SaThQ1b7TLbONgH zwcCjQVr_qbjitaQMYJMVu^>-9&ClkVZ%7?0zhh)}ifs!#RCi>W-uU_#0f$p}aap3# zC;|9+xR=uAY)1vka>-a(h$cr=%&AM!5&$X>n9P^D$;TfTqG5=wXFSxBc|O1}&kU!A zS1N?LIL45)CE}%tVkRi>D~XJQ@r)g4`R5R;Ctqq_#UZ+Ir?Zm+*6YzIl`s5_h@!o> zALR;_&Itcj?FQVNPG-yfba)RDCzct8jSG3xUvlr0WLIZ%?#&aH`H5wK4BZC0Jv;90 z_o8DGj$>@2qP-@bPPEJG4YVEurR-0<7_qBwqp=(OUb9~IU8eh(1i{p>1Tcf&<`|;vB*h%P^ewz%ysx)jxh%f6 z(9u<)C%0%Cba$yMjOpvTa7k=jI)VTjc&4M@*4(~W?s8@Uc+5TlahP@}lr~`tXf1B? z@WS~rr7>}S0kU=NR$~&cK2oh?ajJll&lh?O-Fi9e-99j^*DWKTsIPysZoc&G%-eZzn~S>)^Y%;$Zs=TukVdsbDTp?72V zmw_r03B6_ChVAZTJ`E_<>@64RC>E&_--x_d+gephA^3Z_)i*@mRd#zu*#QvOIYbJ6 zbl0Uie3NP<=gv5_FiR2KN^e&8?mQ{xJQ2jrJ9kx|sJ>EZ)Ah}|5$_>U3Uzq}>k)x3 zo(#6Ozd$TR9&J9tjEZJuNY54uXW0v$CC6f}^CXJ%e6Go?IhLz|NVHf==EfThxeu8? zDImpez*dSXX)j;+ci4|Su)kj0y|jyEvVf|KyFT$Bxl#N_ZseutYeJD~vs~#I^mzVn zo2e~97ff2LolZh`CMasJYMV>Uk4gRE7Z;vrz-Z5us!nwy;$%Vxw=NpqXjNk|%sqPni0A8z zjg*v-A*<;EQM%@;GGRcItt)$prRiMCukHECyQxc(qr!Z#skLAiY)B%e?G}sQ8mg5_ zdQ7W&b+tfM!@cv_Q^{=AYtjZ1C)rQ$n@XD3*s*k0d}_K1ty&*OSFP{AVN~iLs`&2p zK6aj;g+80vzyu7Yc6Q*XF_7R=!8g}S{OCzu{?}AfArmhJ(q>Vtz^#&7wzA6;?X^&{E z{F>NmHmKmB5^(x=)&7laVr4+A`0gWrtBT@3s&Y=W(d;4e#BYEk>_nEzwKM6MB1R35 z)?u{cceAAiq7(|r2?QnE)D0U^Gn53f(*q;PdF!4zSl>Dm9AB%M@pkLOin%1P$_w(4 zp4>-kdcjHYT(SU?jt-lx9H#ISEqI5Z@s;KNDhm=un>iv$xdle)1g0~^do}7j=S@~n zO>eX+Ed#jtY202IYYl{0f2Tt1oFVNLmc0^(O}Z+nDz6`TKUb*!c~b#*>aq)gtbZxp zQb|uS%ON13G7z2CkgD^RjmD8mNURx1U5`gE>ju`a|4>d~hfZb1K{TX$l@s`WIU+6i zfRrubj*Qb%r)PDdrNd)g*16)DA%^K(>>*dXnR?iZv6k4*(2K=;&%>=bEpxUvXf-}f zrcFtwNKLgnIt(edTZz}$M>{9>p6C2vXtzqXOh!0)P(OGuQ61OKBsm_Rn){sG-qc4{ zD2xto#|*qv8{=?_WM2*+&F@ cySnnU4?1tHJtLOOYgqX#z?K)wFWis(KWNc}-2eap diff --git a/windows/keep-secure/images/intune-network-detection-boxes.png b/windows/keep-secure/images/intune-network-detection-boxes.png new file mode 100644 index 0000000000000000000000000000000000000000..256b586c70217f7636d29252c7ab6d46ebb76f63 GIT binary patch literal 4448 zcmaKwc{E$y*T8Xu|yQ8R6|W+G-$W2zdVs#RjD*3g)O ziW*|3s%DYYTog&n#1IKD{jJ}6*Za?V*1G51ea<>(-F@%f=kwhs?vANGAI~`+006*e zXmIN;0KkSlya#g~KdcXUTB(N(8|<#W4xpq*oN{PzxM=^Y4FKTKK&B(-q0Q}WUW09cd1L~9m;Sh5APqxlnH(wSv7tv+WiM+y{{BCk~fkQp44EeLth`HxLjWflQz0_ zR6hPLH{*_!;?l8BYB3Vz(0;1n3q7=X|FJB!d*IT8p-@=8S_eh)c69|WKlG72^!Tr8 z3r4g3ZjJ%EIyyGl(c9bGW7E>pD=e4(JM_*TVLm!Ky7gIWVbCI-LMf{WT?(M@4yjOE z-?@l&7E-*3M4FO+r4(1>>Wv`g4o)p#8Kbtf?M$6&ilVOOv`}}}W~h5B4Wz7(cdJV| zM~%#o#I-?}TD5K!eAQ5#lKtr6GjKSn7)V?vmD*b(`6ce=%a|3$YuVlJ0(McCnYQp> zlOjVdvYPkw6U5Dxl%lqO<>a?e7iKFF^$lBP)wSgh<;JZaT*;~Wf<*g!|5)|aL%s3A z5S$c}t`0s<)c-CS+n;38@R|~54pv+9bAmq()Ih2c7w}p=k2{xsf`irzk?^oA1-{#+qDd6*k@q(&%o&omPE$EaI)|2 zz+=|4co0-~7d+L<4NFsyn^gF22IXW48yZzrRq;@xoSlBith~HwJkw?cyLsc$wsO=Q zQb*ko$x8-sS@MGwqeIY0Vpe8D6XP#xy(2H0%NBAz0Dh^m2^%q#yn#n5W`-YF&XQv z?s@E~Zjar%&m#_Iblogd*0(0ghC{VyKI!z3$U;HvfT0>s3DIU$j^zAWQ;L#f=+E0h?WCHibZ1Z+zEV8W4A6%`z)T# zoEQE+5@ht%%%VcYg}Ad*Eurzzo}Cc5>daD8!WT%YPskYzr!v>Rana9@rHZ~a0Sfa; z_n&(hXXvW_mgnX6r(;-Q-Y5|lp1+_&$Tr&iZR>?F#ILDpZ?@=oc9AO)@h{OpcU(N~ z6jZ!WRM1?!@d<|1$h^wEq==jHp(~I0%M9f$Wz+aoe*qz7xb}lLo|*Qia-zc0_sW zpHSg7t7HRS&T0*Ghu)F2%jPEtsy_L(`$6BjIVP&=Chim%m@pd8X#!iT+HBU&Xy+%z z?*DeWdCLco?qkQkQF^JegWRYB^t_k~x_52;4l;@qjaOU==Ny#Sn|DBzt6wm8&r!hV z$P0{>*5HC_RekEh2-C^~)-LQ{?lA*FF2I$n$T?XFXv>Si4v#hPqt!L4hNWmnO=>%M zd2>Tl#~LLurjofQb7S}1^#Eu;>3MQ;vj1ixg0K33FZoA$#fB>aUO(k~;y+;@jB|+G z1qG1n84Z-T0XVX`HT)baQ2@=u zV->X}9_f3Y_tome*KnF_#1N4CNgkmXe1Ba>6(x>aBXf@K*|rOh299njt$o|e8uVC? z+ORP{ZGqp2nF``{*wvp5a;L2eG9G9Rlas3;mtMu4ooBvq7Oz4o2ZcCgq?joSL$fwh zuF|z9t4qaSYM@n6YdBpooe;kXH<%EEbSV!Cd_u6{ovCVE`9bRa*g)-|7IL%pBirsE z_;&E@D-@Dg#YS6kiarFtq9K3x?}|-tBx5R7G}*-M#YuzgC?1}@Xg$O2(6#p$0;X4L zb$-x$J){cI`{t7(l4QFH0iI#ubg`Cs7^_dFMt^^mb7^EvlhW7?fHP9bUp>^Hm0-}0 z?nV*fQ|&bFjk!4)NST6NE-F-g1Ui0|GwgPthC_qeLHeung-+JV`li{S>HL)nnvJBl zW_ivaxoDhi?c7YzR7<4j$Sx*a^TvMK=heh zhP?IZF#&32J9uz~j5;|IH({gZF4>&@S~GFPbf*QC7#R+iJ-CvJJD>;9FTP1DUz?2! zrc9mKGJ1N^7s{s;6#)IM`G7lvLiaH~B9!H12I<5wtdu}BunXJ>gD*4Df6!efHp`!C zC;4d9KUl4Z<4_a0^m>ND@dQE%VsA+$glIZjc8Wt=)ZvMX3vq5Pubzss#(NeTzmxxo z^}m2jk>YB8t|P#k-ypoGDb!DjTpqN*uZ$*$TO4T-+W*laT*dlFqJtxce#jkL!d5LK zlqv?F?y5k|4sGJ8RC?21`oYn(wEF!9o5M)%Fw1)IM}R18R>q%pAyio&jy6jT((e7u z_@e_p29c*(UyyC%DMTmA#AhS!FU1<6AG7!t+Ibbg=*oV9PbOO5-s+;?cWTsqvEOOA zeQ>`_d{JmKdmulhSNs>dWsGuPCI2d0BPeXMUta5&M}TB4v3KLd-r?%5)6qe#9nI^k z56tKXeJhOoM{aJ|Y|VdU+By294UA_v=pg2Jh>YDv3(wCk)TiY#BaQJ4_m;XvdR{G- zm*$wV>Zan#14ElhfYO4=&S}FNrkN6$>Sd5@Bk<(-1lLFyxjOb2n3>+aR=0l zii=}kknEpSE%1fHb@RdXH+MK_0t*&qOOwIMTOS|a8zG55+ zTNTf#*RGQia1>WM@j4@bWBoxlc9h9l#1y2X*hD_m$vEe6yS37;Z!0#aN@%lwrVbHr zXN-$y9^}!d5CFd_^Q@Y*Rs#94c+pW;>Jp{lcMpwU8n^&CvS|6EzhD%F1}4Jk6}`&-+u1 zX<~m7BPjgZ@U!84^|vEsmoJ;=VXZ!vC{Sc2GI$cA7!(Z!@BFMoXqUyz{U~xTU)lZO zGvkMg@*uyPn4i1drxlF$nf>TA@1X?CE*4U*>a2P#)n4TFxx28bZbSWnj}z__!cZyI zvlxBNRsVN@g-W~%JxX*&RPtW*oFVB&f0n27rIGb7NqC4}>cJe{!3nT&-7iE?VN&IL zkjz^$I$OD%6MlMG;SQ_-lps5a;rm%v7P$5`(av2#|My1jQh~J!LVgqFxA!%5Us6;| zY_P$kN#N6%EcR!5g==W&Si-Wvdc&J#eyoT9qR8H5PM8?gk`?zm!bW zF;BkY)=Qd_#xd=CH5b~C`EVHa-fW9u*z`L_AglU9$Ty*iYcUZ(!br4n=t;4%Z@blv z!q(&z=z*`I_f+Hs16gX*?y=PHv{!uQ_BB0Z#NVyg1#fSR87`El;NZb(w<8aOw7 zFRyK(oq19{PtxL|v}S&eMgduHF-xAQyU`NEW0&j^|&}4POi6FMsE%`V7{7n`%^pJAM~&qUNHl z;Wk^8+qma-BtMtc6W}aL>y?5qc%8C$L&VD28;lodcdI5fTLb%pS{k&-;~qovG?G zdq;B6AR|h|=5nsEZv%zHA*-2)dPRu+*u$Vo*xtm<1!*N?fq(*mgg6{$)N8J6dESN7 z95$01aUYvk!&qUqH{;q}fj6s{uA9CfxjREgB4)w{nnWIp zpN8O3vYs56A@x6>HD&h5bMS0BS~moT;t&ahYvFgKK)3tshRl1cc5QRhDY_8Fw~qDR zIxNkhIYgjDyGY?&#TM~shvGu{gkehZ=#46_A4+6!3Z?xuP$#iC<>H)h{(+P8vhUt` zo3f1Mewcl98x5N9@p#&>PCLGR@|2dyjt;Fb6wZK~x-Ob2dNWpOI+V%)9gDufPS1+mZrCqDMBlxqoT+ZEAi-?3 z{pKir*j*{9`UmdA7mtt~*%$nW>Vgl^|39ejBU4@+6@!q+ cSqv?WWXz-e)F*Eb4?qBhdZxEZbQ~i82OKm1N&o-= literal 0 HcmV?d00001 diff --git a/windows/keep-secure/images/intune-optional-settings.png b/windows/keep-secure/images/intune-optional-settings.png new file mode 100644 index 0000000000000000000000000000000000000000..6a935cc4ee12eecf657fa0f73d85449f68b28540 GIT binary patch literal 36815 zcmeFZ30RZYx<6{S-B`DvZLP{6uv-)A0#SxA1i}y^LP*k`Q6zK8#Xp=*znQtCtASBr@#E<4gB#D>a5GR z8^{B@MZm+y;orD_vtdJR_LkL)e+Hg6$DQ;;ZP>8&>DsT4=&=t&fkEBG;LrSPcJ+^`C~l7^rz0_ALe{nzx~PNS8KC@_qdxc#(nnNVsk$oZTjt% zpDul?3;petZ|(1qba@@A^M$$iDfh-8b%16}b4mW}+IH54K(%HS55vek!LqVG7)BkC zTWb6J-sT!@ka1xr@hXih>t1)mON}^O&CgwEQ%boxGrVS?pXbdWBJk z)KySgq#G|9l3|yaOYfz zuaAWO9X3UzdH-u-=3C)8P%jB8Ay`p4NVbi@|Rbp=QaLnIL=Jz_7@qa$pREsL#> zFtL79r{?o?$oZt&f`!im4`?Ob=V=^zbcg((4#bWNs8>FyMayGqDPAinrLO%ov&db1 zUYpGF%}eUnO3Lx7izq3od`x*#z%%k>+e1=<4(H@$F<*i$nldnU{kKT0Nwz;v zbHtg8S2w2EoB~w6K=e35Bzf6O= z;GtuZx9K43y%}_mVf1!h60Il!q-gf9-)U)Gng8=Zg>rXJYRr7SOQ6<(_FY!=YM2%R zzM7K1X)f|H(a`ftX8bhD&zoW!`Fy4|DM@x0az@T32BQ3-%*2`tj_jnD4-S{$CyG37 z4H!rlEL@y3nQt6*`(QaVcw#MV)#-f0uH+q=jkEYq{w(dm)yv|(Y>ehrz7~H*F<$py zBo}+-$BoNc78WrCyOL)oZM`poc!&3C9calnvV&C>#h=nSZCrYTY{{*@0`=Vf=}MvS zPJU%jK^E)b)1xj*YX5^%wrNI&brEXrX>kSzZULWnSVHtv+b$Ss_FNq0x@V}$5nIna z9%xo%=W2-C%DYsVI1?uCU3=bida?bwgYhpfUbSq(#&X*qcfT}vP_vUkwCcD6H z477uJh^>x@CYH^cuv#Kvk;Mz!BjdqK z7?7Ka-Ulme9+G4OpMnzOP5q$=32G>$W8DG1IJ$05E;A`Z0V^MaY%cWODrm|tH;EAC zJoiuDe$?8ehY$mN+5(o#j)V@?vSZ@BpWcmNQ7WH0}i;}+cGj%H7ir_xg_ zPDJg!UnsgMZyDw^9pYDaNdYp$I2Uk&*b`OR$@_gmZSG5BxRXL{4~0>tLPjGyvXa`I zv_SJY{ML&z;EBhoEOq$VWy^fwoh-3+u`|XZneqU!*6zGfqJX0HchHi_Zbsp4}aA43EekV!BGWg1 zgM~~?#hUzeEfNq;8CW*qmqx-jsq}dClFKtoJrF2XPSHp^ChGM!p<2hdxu%5wbNR5vtzeMcMD)o5({|NiXi%m2t`ia-4)mXFdVtJ8i@ zvI0e~Hy`mYRFC16v6deJsqKah%TuG_L=tVe%*+S2`g+%y8edl zk8U$WjhwiR4e3y@y59uHz2yGXxt1+&`2Ne9sJMNEA3BdC08-cAPXE61cgR5KKH6k4$?dSnKWEimj19U^{(RGRWKC$W{+{@eCqpD zN@2$b{>z@9J9Zxa?C+QUlh!VR$M4_y-}~_7q4s<=POUhqk(#O>w!BI=@K2e%c9-Aq zK*~$OK%EaFl62;GRW%MTjH8TIPnOaBE`!CD$jg2CqH2-YVB)NC@$?pBN6sqrkY383 zqU1guRzAwOm}ZBoFKH~Y1!30(t9-U!dma0qD(x-j7hF5YF}r?(KDi?AjYAmo{7X^l zcD}NGFNn`sNl_G+Mhr^s%#?1y*y;7jA{R{8G=4Xz)TXJ~w8`Q=!SD9V=<&GI+tc*( z1wwSE`H&LXioOT9ygL2XPItzGOs|12Qp^xqeFnVYRYrek_vH2G{pGd>^g&i8)1S$E z#7OY==J^ZsG*-z8nV|X@XT1w2#)_R!+jWPMMDhpe3CJMFxmrbWNC;A;fNM|}oWfhW zQBqoc_}ba|djWh{D=GNIF5<%mZDe=EC4F8A{W)&{)@s@T2tR683uIk?Lw?;IHug(b zdCbcfTg{tnnR@vh^{~(p$4EyI0syqYC;&B^vLuWn|>fPo!P@xg+ll2X>RFc zFo*;BWX!jrapA(msxP%Tk7}d2!d2c#P(y={4w7SQ6Jn-2+hrRr)>ixpAmrC$y6v5} z^>ggoU&Xv(gh_5C1=Ufkrge~-5R-DYf;X_8cQ~?NtFbSWLGT>7(7^B=iynv+>R#(C z&K$FO7QS=DXEzWZ*vC_q!LO}-a0#xYovRriw}7vo;yfVrS>VgDx{sl(6C9bR@- z&xVIUQCd;^(h6bWm2ye#4Pm-26z^fXM|4eD^Kz1ny?JC*%=|^}Z@IS0ZZln|l^uaS zdBog$;=FsmS1V;^VzNNK1b^A@o7+iX-_ZY?0o|bW_|pd7Y8h&*X`fc3D)-#Ap0>)( z(va)y`26;4;SuYm`^`3;MuRf(7HJAk@xgzVew>zZqM}wGnt%V!=F=y29^^xrE*+od zlTHmNo+p--TVM|tP_5{0LRTGfUVa$!33p3BKT&(CG^L^wO)ng>WnzC;JeWSTYU{80 zQVUYg_FM45c<$mf#;w6E8{%d!#JzlL<(sxed3+hHvo>^rw>I=s=N0o$9jDgZ%J=bU zAA&;zBfqhpILzhr$@MLOfB5zGpFeoa5gQ4Z-$$%nd%Ni-;Mrep{yi}K`tS0fOYKw< z0%9K`o9?kmjaQ|2O5T^A;u|1IM%gm~!+_mV6$F{e>%4Q{mEWUi=IZ8oZ&o2j-#5Qk z=J@{H`LTK<{JS((VXX4PdFQDolWVHG;nz=(HX%OMN^1Y(nY=%(nsNyI?k;wRJbje& zeHij^_z4N%{+#;cl*5I3F*J1z#YtSvK--J?sfPZN2DLly(XhmI%A+?namw`6VH=5VI{-IFcM zAo}2Q;^ckou#-M-x&%XR5tCc13}V}AQ&eJD$Ii$a%zSf2OQL8fapxKp-zSu$F7?a| zS9-IGlX!l`nrHHvgM+DME$^4RW?p4GLfe&r3uF(XQy^9?Are=df{r#tBywHSFtYI^ z2w2KBuBOST{J{3rT|q;xeEeKrRgS6Wr5P8P{3)wlHep{J=2&EJSF?3%b~&Y?@8zp+ z(3caDiYVP(1BO1PTepVK-Tryy)mz>bzZyqB`otl@yUFjYi!a4QjGKBC9h*SJzk;@> zr$w>6nd-MK=f|$#vSw36?U$io@51}y>FNbJccDPAT3ol4Ek)I35f|@aM10D=Wx3zT z)?HO;qk~P^*`KK?L>1rgx0KbcDs7l@{VyAVw=X=7~*H;Ij1 zC|!7BJxnxmP{ku(#4CRZnnp9xo{vO)Y6j+*ym@iDbw*ARB>CCqNZu__1*?V+Df{>d zeTP|sT}H8b++6i@6(My#Cp-0V@=YZv7K=z(UR+Cr0YahJviIS!n$E98o9CRjIi52# zG`w=w9cy(-F9YPO__P*A4m5^~!z@9U?Q-ENwg*b>oRpALj}@?XX?`Gy?~QP&H)eZG zj+Gc(WsE0^THbzs{-A<4iDA|rtPyadv{h{Zt*~gJjL7d>o}PR+dDre?m^WFFq^i~B zl`YuM#mEPh{!VxYMSI;9K3*+*Y4SFO7(J6jnyAh(=YmaJ)G6BrDc*5l?~@&};S|5s z=H@eoMuPBXSlKva9LpI$yyxI?ElA4rXp#-yM0RY=DM!L|=Bx2ydd6N!ih5N(Gdo&$ z@0>wsTyE+Hcc({DEMxr~P2I?R^)}`ejUX@e7bR?>d7BG3i}8|oVHh>IMA}x|vnii- z9a*(=U=+LGhAMBeslmP#L2q%IZJO`KVzfbni4)FAN@4V4@YiJvupTqZMlC6^17?C!n9n-2bjzk& zqYe9BG|!~7vsg{IxdysU4^<`>)%ltyXM4a*1zii0l|e$VMk1uIL{G_xY_LJ86D>=H zq0`kWyU{fHV5GwGWe^5)7?*vRKOvA~&RI=66gOHU#k}beD)c)6*A5HKNrpXmPp!{0 z0^56PTCQ1k1o$f{xl(QgHq~i-p=WVX>cQ`Om0~EOJ}yI(Tg$0z|5wV(E!)cBhmQ*y z_z>H~tv2Z^r!{H#20Y2pgTHZ(*u@Uohgd)ruMWyzFI*F~^)#t@({AjYcfPYoXM}KY z9+=&v$V<>_e!}vu(;_jw@&-dBFjifbmdM(|f7e`^KF`2u+4A_!WbAA$y-L=hQ2{bu z`M6PaFIWAilGU3<_;>HOsmkxHJ|XU2z`gXq+m4xqXEU|*SG!9h?a1s4 z(^K@!mC#G-!%GVX@wk;bULv#EO=+b%3=?FF{L=>L#162>TjAM51|8Orp~1m+?P7ka zdPUicHOc@Jv9c#bB8AEi*)@a8CNm!p(TD}uQ$piFi12B-p;cV{k~dlVn?f${U_r4KMqXKOmG=y1)0%C|7zhu_CHD-jPOh9Hllm zcE3h9%KR|%r%1~@)!+~0Yyu|;rfiwQg}agEZyap`LbSl;!3Gn9V|G{d2_4bUL4%2R z=|ZzxrwP&Xo9B0dWnDAwu_?^uw}Ow>azLzgQ-$Uo3y>_!_)WHYmh^yoCe1#4DPux& z(;fV1)$FwDN1|paXmyHGkl->sz;KEX!mLl{_s^vxu;2eIPnDok;nc(!Yst33Ec4u= z98<*$=>q9y@=yp;v89>arL#a=};;Su|wS+0wy-g^365P zempP?kyGUAt|%$d809Uy51JV@5(xJsQQePa1GA1+ofFPGD=@)Sd4b7$iTfann9aIn z55YUR2}|1W25=5V*VAbjgL0~PtDCH$3I#Htmt*d^ugofou$9_45@%N)t4UXO^qC2qM`q~RT!2Mo_| zb<~Z|l!%*08qF@@)Oaf{#?&#k(0+U)OtN79Y7pcIh(y0sZcJo~U+f0{erR6w21@0> zlpkp$!rvaVciFY8jX$LFj1+qCH*FELBFealB$2Y;ICnk?k@?fA+{LZCR?M`s2~48< z@8W>M?=^(-)QH%SgMiZ^7Y||6vARRs?vf4KdZ2UYF4)B_k=T>TCWr`z zU-rS(t3l3=CtA#MI63C0W541mc}9EMuR+sS;Fq?NY{xJT%_dC$N2cmDJ9{|Yw(J2W zkJk7dAF!%cr*O`2_g*D zyP0Y%=a-Uf;i76*RUf^|hW4}saNwKg#5^3Blh%qV8D7PFC9C66or*ONe6w?R3zW%; znWO{be;5}VVSu2KH@D+8)(dErt#HNqBwwOd6{uI=AaYQT;<=m#ERLaW7MI4a>Mz@k zgEZXduuY6<{+2%et^*=FHa1o)jm|W7qz1$W zVx=q=s6)>12$XE(SmCLd139oE6cv1OtmB2W1&unRNuUab3V&E}?|E$|yd_L4(?cx% zaAV@aTeMvX!w?tuCc>$nca=b9yMmEpR7itx`{~h&LwyYAUHf;Oc+!Nb<6lKkqjzr!>B7xYgzKnM>=5mq~0#OS$dc<-l$vScN zil&(jI~_tD9i*RY?t6nr4yh#6TXO5XB41?- zIgW~ty_S3!3v=Nh7pXmi3#TYky9u!ie>UbU@3wEBsG~6j;nM<`X^2eiC|DBVJb$Jn zsaHdU3$+Spl(&_AgI^MkB#Li#l!&7z_PBP(%>7`tfNBY5|GYzg@w@M!otFijl!n&Jl9xf9yRF5$%CqbUqG&NzEtrW zFbnOCAI^E-f1!P34X_!BJlgcg*+Kp$hgIoaQDwi-RA;BTCSkxF(2JrB)>C6lQ;Mv0 zV%(wGFs*sV8o)DG`r+iSYpG~?tS;NC>hez6Us}-;K2Q`1oVmA{wH=*9uYN#JegoS7 zUp=&cF48nEHmKRdZ}`9V-NSc~7CNqOT0562x2yv#yc;i8C0Ziztr8c_!<5?2xy>Jr z{)!LiebR0>w<$053km<7y~A71whtIg;h%u)!Bl(x*dx=&E>}0PZs4u#v5yf^tc1Pv zXE3jlR7UbWPxq)es)?9mL+jBUC{l*BXg3JIww_%3^wF(k-87{^1zV^ zsSc`rp|j!%F2>QPU7j9LO@FHIe_WUM*<@x#Nt1$dpzr;F``ncopr*;XCaMonsP&+F zXDulcljT~&6qm*RcQ)lI!Ewxr?&+*7csJpP8`N(j^C0q}T=B&IR8|4i?s)4ONO zXh)7tyRdT-d0LkzpclGYJ`_gIor+NQL~govZO)>J&|F_pgWMV$XWfC1s^LES9#K4x z7#f)Lc)hYcaE*WwNAf3W%3qbp*pe#RLPG$?De$m&-=r2LZdGKY{$T1`e5?SX$f!KHn~H*fy}V;@{1o1@Tfo z$B5?$wm~Z_!4=acX?%`MFvL(gLK^(qbINGYgE#JQ;wH^_@4R;+A} z<~CD~4H74N>lGAJnPn5aJ|Ie1l9@~X480|7i})^|8Md~$k$oqC6h_P3IvcLbiH&2L zD-C!@wj;FiDEnnVH7R|_0gLvGQaS{#qtW9RhqXX9S=*Tho$buCP#d{zHr`{Y`$ioJ zF+rF*yIfGy3ODmn_L#)Bu5e(-fup?re?VJDqtXg7udCWh(mk{vspWsgw1~B5htKrh z^@vK|SfCG$4K=NGv|Z7h^HPe)3#Qhdh>C8`aOC$d-F~mdSZQdy_u1w(5*4W92GIJ#CzD2Ic~y(QQrE`zZ~S0Vi$7NCZ-cItz`nOw z1A_iPymS-f10XcpO{+>#yUHo1yA6%bo%##=<8}MKtF3)RzxZeq-8Hw<(ZQj{ef}Fm z24E3Dixlwbzv->{ri*dexdWz6o365&OSx~1jNDPzI@{yOcJZ&Dx#{w&?68VNG|LBa z_$^I2U%2u-ZQYaoLC53%$?H$kNJgQtJ%a6q?$5>JhjBnAn_SXs) z@&i^FR>PP~@&55e%g19C*_|;Z!yX})O&0a)9`Z4V2z+reELkm|t_ILHvUwu~GcGP4 zow~4Ijq5!Rm{!)NM;3rNm*sYnUP5kf%O1EGhgn)?dO|443`A9Is=$ERpYYpe8+`Yw5 z*4|N|x^$r`)LsP$WdD-?wm=nrYS}Z-P2iW^9 zl$PXk_O#NcY2}QBEBer4{!j(;z;DZazY}m#jt+UcFP{IkcbN;pWM^?bzg2N?+r-@d z=L7wB`{$Mso$f?#sL6?1DeGeFPZg@v@wOz%cb6`?*&E}I`-QMn!IFuf5M~&czl;LQ zP$Z5%eK1VRA0|O6>N6i1Ywk`wZ5~~j-buzde-Pz{3!eaPBgT6K$K~oC4QK1u*<&5e z^H1^r3;=Wy1Q9~?o{_hb5@pe@m+5vFhF3z*3QwTsQ4$2A>#O9sX^YY*LGRmwe57Vn z*rRVk$!Tu<1ObWfyt_D(2!mBwVt9(md%X!V~HoQ62c#zY6t6^ zwAqWPzxc;)ybO3<6_2(Hwc-@kT<)z?BA5kBcOvqz+O^!|d?R=Ny7Ud9?+tpvH|E9)$W4* zyI9J%S9S%x?LS`YZ|u?xtzl0yQ}lD+8t~trsCEw_if0Ph%wxUBrJrLZg?w#bLRS=a zRvd&yl_}VbG*-Si03sHINv*OHyxPCxt5+JI9_yW&xs$CpA+^fw_Coq$ecIo@&bYXH z>h#RcYH9qr?1aGhTLx!g6*Jj$N7rXn4_MbD!t z>MoAlJ#|0jTIiGe03868$`%M8S{eGFB>^j5TdAbm>qu4Z$#m1}rBE_b{xJ5OCkmKy zhXuKftS>#*dwck>uUPQVXsYG)e$WG&2g`U2paxjcw-^yI{u+ubL>o`fcp;h6{Tx}| zjR?VqP&RHv{pi`G*3DPq^{<*$=br8+t!;9holZB+KaBqe&rhCUG)B&%0CGv(#u6QSrH=5u++!ai zSEEbJ2J@yLLf^Nnf3>}LGhCb{dv%?|DVFz$6^SG81LU(&trrk5l}UkQcqfroV- znj8Xn_(ip}mV%KoZl69;b&%6YX4Cs-eiOlEKm`9qIYcMyfjOtfgQ-qgGhXC_SqaWF z;&ZB6!}S#-Sk39|!vj+dezJJ7(UeVKb^xrIG?b?f8txB38;aUxa3Uke>hE$nvUut31WIuAEzy#70tzIkJ&S4vu6 z>4OOLN&t2?w@j7Nyc`*2@wWneVLmM{vtI9qoNWYbsT5Gv>!rM36m~xN=&S21`lHGB z&>5)a7&f-3+NIf@QwrsWoVZU|tKF^@Zd{D9^(h)9zoYj3>#htRtbqTlgu5X)Ze!0o z^we+mxlh2poe@l3XPR+O-iPs0=n-GBB+`-Ky0=s~X0_5xrU4HCon|-O&VS+3yx&(G z0+Y=Y9=x4-4nmF%Tr>L*mfQ30JAehO!^Tp=Oym(lDetkOYKU+Nm~*oQV9ah-DHO7M zDt(w!sR*&pTwC#F6-tK`P}CPwH!pxX_QtdrO(~2lKabhHmH@5vOggQ;d&;sLbg;xy zZH+LqwKGqyY+*uBQ5%2m)YdqAe~}7J3HKR4ZdCjAyJy&ko zP>H|xuPsT^SL(x%G6?bF~uC*Z8jf|STl|Ho;YW6wv+A-E~X5&S%gh;T#p z6#X49(zZE`)F<(=Nm6f$s&)ngQ;xIx@UQl@FRM7T8oT7B&spbu_?K05hbQ)D={fF%;r!}j@j`vHs9jjed z6t+wzHA{W9CAULj-y!K5#H%G+q)z|c5%tqGa$Nq7lgk6q5@4r z{K6@gVnpHZL^A99-AS#u!W3swIN%nAn^lin3$ein9Sv z5XEfan&IVrj6vs=Hb`Py?qK_yeP)p>!<^O!Qn4hGdYxxa2_McG80LL^k(RXyTa=oBC9JzT9+)utx4`DbV*x2Z2&B9yjJosN){ z#~|4W&SIjxKRjrd$#ns%BG4j4?zh;P9Aee-IfzN)U|uBhH!lugBkiK{!YX2_xMzmj zh=auzr*`$ssFe!~!w1Pue&eYU24nZibi5<=Bk0j4JkSQnO^tXyoVSeMPMTMqur(uQ z%-HsPT)qetFgZ1@V()<^FMd4`Z9n+fcrvcT=aAACB#-OKneyWbTfwui+VHF4W)scXKE}DEo-mFYtmtm z`Ch_z2AkFkJQhvqw6m*qjhYKLmVa8gch#sWD=X{U%5o=tdl%IfYeXD=Itf?N({p|% zml{+(uT-#uKXC2Sa&xUDrIw7ZQR4aipRxA-p~O!o@0>CLD2Hkz0ats6<%-^?4-Mqt zR|eIi8I_-9DpICql+kgF*-?4ltZJ@9)mT`2KgG)TNcdvBF0}Zn-U!ed*M75;!%Zyl z9VEmmUR-rbl#}fjT4o6~U+6(av-x!lVh>eNYF^3%Qm6HH2-7r#XI$8~FjW9JXm378 zGCc?hA1u)+D*!cNJMI_hL#IL$mcM|&PuD(xz2gKXjc0f|O3yL*I8ik*>&7=;fwiIZ zuLlf6OjeB5Pw~g9MaNjt9;a&EN|)HDjn(h2h8sKG?DkQa;+IUr=~02br>;|4W~%(= z8gb&rpy5>~Suce4SY)<+KPoCYAZ<#@Wj_pAO|ceEJIQRZWe?F41u(j1enE{yjN5IS zY7gZNb0O*O@HmyNe-QmWdcW@xLubi>g?-MmoT^2}J8oWYnJV#!`ttbjd3WW5LRvjV zyCk$$n+*04ygm55!3LbpzFVZZ{y5lB;>edcl5jTJ15cN3t~j4?w?^#K>v~8GMV)7K zduG3c_KJ%RRjBHkQ-cKg2c(>ns+fty-BY1Y5{qEj#;$1l3E(^eBUCySc-Kl*+cdAh zR-6E9gQu^T9Un-1gSyWOG^P0EY&e=wT0oel5VLY_48`A(&`(y4Efzp(_5AE7*vMr3 z+}!H0CukUFWFG|oI{*YQk9At;p3SSmoSIHmH^Q?$jwVVmv_ieYbDyU=0l}JQA zht@$TGmtNDE+B*f5fgAa_AZ)Guc6eI2Ac*#b%A0=)&$EotT?ayrCVgDg3g2|6JnCR zRkiIe2D2LDRVnqCs`ER22C`$|{R2I3DEUOw_B*|!Ep4k#>Sa&Oa)tt0uNG|&>cUZ0 zZ6kIY@Jl`pV6aIojz2WE4fxUDUMBg~`WJG#huTC<+&zRyiNbd%kCtsnu|5xDl*((e z!4q^7)s?dfMSN5!O7Y$W9HbJ)s)e)fBl`D)eorh|lN0am5f9w#uU20Q#Y&IejGCDI zI`?ehllwpyr~A%o%1q0}I?B<$rWxmRA#abd`cr2%_GQ)>mL79FAt$Y zbtAbII-Lotx&;YLCOvhl4kl2}TWpL%TlN=>xjhWFyk!?us|S;E;(JH)ykLyV^N(#A z!%;>sP|vf--7xQHEeN_#S<%o}GI`0d%pC#OZa4P{6b~W5xq8sz*p!+qrhAiN1?Og$ zg^oUFY35)hlJ4gY`b^)_qKQ4oE^7@p7g+}ts0fv4o_hURm1;^-5MEH6G$*-S)q=bVF7*Tx(gKZZC&xJa)? zYC+`7y48_5!%~BQLVmY5-msz&Qry8<2(!kJ;%AGb{vq=C!*^~B)i%KU{Ay5-3c82= zsqpb%53;#6<+SV8G}7^qQKz@MmQ9!16jj+-90%N1@EyfS%b|vNm3gmNcZx*pVMo-? zk%Gq52iS}Ho{0Ja!)kwj4#I$=5JMC9P};g0JnTJe?Yo1iI}2Z(J>>mb=dSQwNF^Li zwHr`;?TgQ#X6I!4j;s_CMKO|cXjfM`&_gA9tp2ug__?rT61RwgMPqgB^exu{L4~^5xPbk6 zB!E)+7Xk^dzQw)YivFZn;Zrc?V5Lw8`CW`QMx_U}Y=s|dRrupsEJ!V=7XDpnNdL1n zP9X>vYolz_#7adAQo(q18h&&KrtV;JU8Jp)l`K9cg?I?hV22^}%giYB)T(?+o1A%P z!F05V?P7rnPxpOHJz(Q3qMtcp(F9*|)2BxT!TS>^Vf~4Ls*#q9FKoFf{n}%-@SW(u zM5ijhf#C56Q5}aCrhUYmBau!WJ1q;~!6bl*kwFFlC=oTYASeJ)8-+V!XeM~LIIN&? zA*8|VeUV$i=?~)3ZGo1C2o)o-3T{G0?9K-TWNYVV$>?8)hdiW26$~!5z%9aeig(9o zOCew}qPG7!?CQYSlKNPoryz2xICq7LW!qMnpu$wCHPXmK;|?=;c%(xkmbWK{R2Q_fn{2Y$8)}C^#Z2RaPapV-8_--` zeQ!A#Ef!7?i9%N1okqdog))>Iou&34XPX`X++lS@xJH|$C0Jy~H`Rljqs1;%xW|`w7l@|}4ncLlnv&m&gOji^Ix)MU@`Tc*Z zG6|_J%A(5Bx`DQopvr7UC8vNs&?#Kf;s}S#Z-UJX#hiN;J$9xHif_n)igr#*bdW(` zFj1oX%CN9gwL=@3rAP{n@OOP+4utC%u4$T>IH^|b0qr~`lmcf%)}CyK&re&&#zExQ zAG1(e9GP@T=X&P#EG9(jwq+W^WCQ`xCg=N-PT7*~^-Xe*-O1RCsxW9S>h!5WdCj_$ zvaQqgJOMv7;ZP2A0Eq<_O(`+fr{wOsP}XVz8fh2Q?IozB7G#MnnryE2aAKm{!>wpj z)-=Fh5ex}?dUzu#q0fEIo1(0*3U3b6LqkS&)w;!vQ9w`VlvTw51o5aS^A1Jx#BB9R zhDCh}i7LiY)bKB?;RBQ0)ER`Jilswk!)@CefFO{AjE-?SU)J+O_5W>HU6 zORbyyI~1bJ)zuxweM@khRe3@~I98jict{!Oaz#}lQD3v;Ee`t=gT^Kf-bsZ?U)rV4 z5^@c5PAg00F)Erb;9fTZ6@cTBs?{_0wD*rik}_$`BLHXf>0D=X5zAzk2djLlqiXS={M7KnP{ zx!!?2KTc*}j8pBl>&`BXw|0T0ArR+k3c7PbhnKnjr^II% z-7n$`Jh6$A`__IWwI8Cp-l?~5xH3CP++Ny@uF0J4P(US5jce z?@{g4B{KYPK6N2JjTDb+c()%0j(A6UBiq*t^mV1b$(Ge#>j;f%AMV)V%=G_i{bCu@ zNe?Q}iM{MBy=O)w;go%iQZ@?$3uJ*{#Vx{3 z@R_&l%ljrz>-Q=8PJSIu+RKE8oVMG<3e!JSVSX#;3qT^-_pBe92!7A){cES9Nkd6k zP7))ta%QHwZK~g)@X*3OR0YufX@`FL+MQ%bG58CMF+9`lk!)Da!GVW4OO;mTlrkWu z^*`rchDSiGn`}xRs2;UEDBNB>n%oPG0^iZ&C8id4u)i!VFQDGkzF%DE4|JZLF)n=C z?G;3SzU=35^M>2>tzmw)StQ=-l3hB<^LlqBo*h6R0q#LJ;j|4A*x{(HjLMO|nX@fd z{acqTjBwG6GFu-@RMg{;&1#KtxKB&Z$dVOi_jI6`5N?+MQmc`ZJc%qdihA18S_i=zfS z5px>tWCOROWxZ^=G=Fo6O?Q>Z3$$J4bvwXSqH-vSUEV?(XWyBxP>6IbJ#Wqt*?>_y z)q}6IIR2-Av&J-4i%~pKp=P_(QX&bybpqx{=0n4f=~>yyp|)NOfI`GvWJ-{=PJk5D54Bn+>j zXsD6WL}?N@o}BW|%;^mF&8Tc;$V|gU6q?rC_H5w4>xSL>1|fW_+!3a+V;qk!kSqac zN{-tF2modG&0udkbxLnuo4w9bT=r`}XK^VIfG!Ky&|cY%4|t&h0Eqzrk;rB?WhXKZ z)*Y6VbJ+hF%NKVKmb^=m)0&Iie!-=OuA~OtthMwO@7u$={htaG7H$Aan1Jqc!Iq{J zxC-_+*3haFOAWic$PbWfg%1F_-%%Kv-alN9o@%coWc^W{7NNJG#@40$H@sI5s`B&mDlF-KGqDD|tTn+nHUk$B zFx86mjw*0s_z8|T0AZ82Yc;xAz}Gk-7VOUj(EC(>PeD=Wb98-QXIP`V=7abC1^HS=u5P6Mn` zUX@faaU3>^^TIFQDq+u5&d)XSCsy;v6qZL;{g)n_|1Le69#5m@YcOb_N#6v(JHSv! z0QW{@n89c@;6h*QN*ys~>44PC>))va0T3m4VDr5$?{5~VAM`CudbX!&t;Vnp!%n#T zH$D8k=b_w&fF)PQ0!q0K#BblZR%HZ0R8G4>c>2Fvo5TOw+FY8yl%lKDBU{&3te=58 zi+4^ZjMc28orPqVW*R;710Vu@`y4e9z1ElELP*R>yz&TF4(|)(;&s z$ZYNg^7tgTBdi+l$w^?-HLVR!9{aYB?D(y)_HR`c{PoXi2SdJ2`&trdOQobv9W2EA zPbJ}|li*k^B0jg1I-zcsn?U1< z%nSgEqGT?_0CZFs&T&RHE?ass;`<7wT7_w*AyJ^iB5;8 zLcjCDEcKYyX>p7xoJL+k-xN^ansRqfKSS!$SCUj^z7{`#7q^374u4Ti1sX)@f0us$|DT)v13z+X zWU}C8J>`po6dK&uePULqO}>S5_v=2t?jv;545t6ZQsG@?_m13 zvWx%Ie)WIaul}vuuRgfwAK;MdLQ!tWKZn3|6EV(wN6Jnhlg1MfqAs5 z=Czv~amTP96>j)f+TzRYyk{?Z-=%bH5pVie+SiRvQf)=k+8vfnS6!GjZ3|v&|ApC! zt1i=r0u0?y%GC$5Wf2p&4iiYdtDJ9*_1u3Y=aL4T2iOM7F zWxhaQ_NVIT3!-y>q6#gDwgob}|L#=&R(SI#-Kl_`Wq{q)X^RDcv+OUw2VtF!tx*!+; z1mnI7BQ1KveI4JtVJ_;8GC4s>Ku#?PpyoUH8o})*9L43*4mixqN8XdOk1T(lmzGCO z0XXe9>V6I8k>vt)hfQ}SbyftcXdIjA%Sml)NbTh1Lbw&Q`Gj*EYjK`L*PL0BRvwhD zy)bOqsh$A=su{#t_DZHMGS~LIlX}wNS{@LokW2>xFeYwcFd| zdp(hC0hEh^v@l7KRXt1a#XVaIYMZJvpA5=^XwYV?n;nEWk@it9MY<(vLb0N+xq2EG zr{1=npxR=2*P5WrHlT3CnKI`DfR6a~ghtw`L1hxoL^^&>99 zzwBW^U>t!(V!!VXrH2j#eF3b!s=CiUHQOfcaXgy@Ge6L#BjycHFUD*)wOs5p zwtMJWNratWkyqN47xA&LE*ko<&Nt(p)XA-y4E=C7$X7Fy4Vp;Qr&}U;H?FLpxGn9i z?W+lJ5%6WGa}T~$h$sC#UP|^w3lsLrHrZ2lZ|V=Oufzyx%kNYA5u{0*;^?glWfmIQ z{g1O0V{j}~C2>M;1jj-j#%dQj=|`-&7FY;t$auh6dTU`Ta(Im;G=Db zkm5`mZ+HClCWz7C$9t){i(~zEJ)6G8Sm%Sp`9`Hby*ufo3$p|O%u6$N?}l#YoM#7C&Ao*inA$mul=DXTmzWDSza+ywl|?eXdF$V87Mi= zm!ivpqxvP8@UE+4RleTz^4!MdvX$w(;#!-HG@}QcK?AVLzp9aNFVaC>}qOOcYhLE$c}?{%vqL&%_EIcNDuS zJ2kCi!-cw&7lU2_RP4d3bZQQ6l9f=o6r8zd6cHP}h&S{>YslwR$C@puX$>{2bM^$9 zAysn%ZFcQHm*ohzdw4w{1jC=-`=Z&1T;!TzNmGW;E|%io7G{Tli5hIcIs zZ#Wpgs6&~Gt)5o0iU{cDyD#` z9wi=1u$MYYMqm-;^5;e{AN$uo85JfFl!=0@7zbZfgOh&UMh&YMr44GcQ{OSMv}&^%asEWwrShOMek5DAo&Ae(mWk-&3vkV&_^p!ON%P} z^lxf%ATVTy0`+K_c_GEjyF|Fy-#qAg2F7$(rqA!}kG5RSuvrl|W%^qFzXTC72&W-;?I+3GBK+Udtn_J{xcd=&{IHVY-({W8f znYWC6Nvf*}AX6P4Gk zQm|po6g#Vd>xCWS!%oxWkIW@)qb%*h7??CfG8R@}t05~% zrkTX39>}~apJ}>HBZUTD0RgCEam zzpLM_r*{ZArk4-#c-yccLqDp6S9mEJ20JD@$1vd`H*IV@sCzvY)<&W;j%@MB(0Rq- zx=i8$65y}7#lR+c?nc-RN`u+xYH_>vaTV@AuJ z2dtKkUBEbrBJxlZP>PvlVPC6$Y(qw747)PUlejGWg3bp`*U=%1D8xmrSEIV%D_6QA zinlRkqSNEucc*QmoJMM2X1K&H1!P|W7uwwj3S zdt7ve^UU?}REMsTw#TY2bwTm|2wM;Qrf%GIv0{kX&&ov6d|`gcD`JP2=kWa$*e%7q zhl|y$)ACI3?V-hhve{MCMLX2Ox4#`VWE6GNzN&V(X2M%>poQXpBTV70C1CvUdOUwp zr5`V17h)zAQw>^CcV?JL-bh>tjy@%O7}+Mmq!t@u;#c+X+7-hb4{&!&e{S^pW~!2d zr7yz!n#-a*zfA2d+1_lqi=C*l)<2WkPsgihRkGapk{urQ+lX1$Xi@39-RTbMjs%bK z2qr$)X~8{HFq;(`{xCH1rT^tMV)-*e+x`p+Bzd7Gxc_k+_(6%5(P*9LE{tS-O79SWIZ3Anvrjh&mP?)&c%7iqkxOOYG9*%wX$^BA;MfCI~D{g|&b0V9EYH zT-l2u#n<%8hmz+L>|&w)Geugb1^Y(_E5i5^dho{=*gvWqP;`&l!)G&-de&UwY#5=6 zWZN7SY0_B{j97b5&Q2@Y`?6TF;+P~CT7MGvZYp?0BCJ^5Hq41((=WX_6$=0VLkmb+yJX4Hgu2G6?BQkg^Fd$crSc0%?c8H z8G-O3^`#p&xv)DNlA9eLjrgHy{w*m*EQ9Qc$sSZ??nv8^GYj(SrC(h=6r*%0_(@V$ zG40h;rBbJ`ikgaZ?ty?n8grbAJ(_mSH++4HRY0|4!Jx9D)~wh zmolxW`Rdtfa;E2s&#+?-KJi<;W9Rx7aXbl_y#)UDRXHMOSZ12)aPg@GW=iy zk{9S4{DYCR+{HH!j6^S-c}j^%SoX8H{S=IuOv#`TF!oys{8;Dai*nS9-iJOw{17d;J)G;Ds7fiP)gs&UfPT>l;>fh8!3S&j8b2`f&uO0 zPw%=ab9dstU);-9V)s%8BZE{F&+`a4m9m3<6qkv<s+#{5b~zbitoYsKkNeuAq$`3>f!WEbdRKCT*-;?8@tNN$h`Cjt&&EMWm4(78li_ z`O}+|c*}$PMlY_fZw{?^&Nu+|D?6PlECZO_?ZwEb(c@R9Yq}`?5emowcsT`N1)y|k zvqwfR|GCUMtq|*LsowBt;^Xi=)R>W!SnPJy@N@+IEB+yar&QlngoJ6zN6G0VBDb4u z$U>EXraFuE-L81-zad!gtN>pl(8 za|kQpumkk!nPo_(Dnel6=^#oT;z9_6CaLqQhro_YHJjz(pcq zNLv!crHNDmXLNISxuAbqTQRw?iqKdUzHFH3{V3yx^qy>Q@N=bnO)vROe)$6n%UDHWHuJ5XLYe_kP_p|=k(S@ z#J{B8;*axREBqQ?NLwiMZpzVwIH}|(<;rU8%az*1%F(Gy%8^P&7@stj6CgsoF7qER z_B6)CFF!40rC=cxRJPpc57@2JV_kIYn0Q)bbNxuPRNkxV zJwxV?PI-wju8fisIZ{Q)L|H>NDv8c91pwc99xLZw3NmEqvMP zV~wU~*X9~pfAI`?U^R>%&fTDKy3INfHFTMl$G8zxt2}H_B6FK}uk^dww~j?M(_VH2 z87dhBI|j;jIjjfRkii;~+{ngxcTT3|xi=)4E;SyVkF=~F`eSzF(a(Wxs0Q9PjdfFW zkycVf-0@eS$x+9YW(qQ`F}c&`RVH<>?w4!NTWS8k+G*>XXbwz0{$7KPy#pwT9qPZc zt)DX^?_B{VfdVK^e&$g=)2Om%0L}4d%g}aq7xPO*<9hfVyI*^s?*6u&mKH z7|=V&xyGC{tG1LEydLbZUW$fi0+5lwk`mz}i4TrMY6A8e^Y5MY^n1+EcU9kesUe6~ zke=2vg4m2*HQjq73pf`*>7Scrj`#Yl9^k!7;lMcjz|B&>T9Ya0=lZ-Oi@y8ScRqrj zpLLbn1;%Pn>{~qmV+MDcP0{#m2FUI8M=pTJTe^3y%zxs=Je@y~O)*>pjQywf+q`)J zzw|BrqkK-^ZixO}`z^lt@7Ztjj?VJ^fN?ku>N^1W)Yi z=gqFFmm7%H8edjkSy2qeDW-GQUOQ_I&T9c@hzmkwY{Q)8_;$4nHh@&Z_EE+M7a4sb zm?_ax*^M&rp(?!jHKWY%n-N}$mw5)o#stxU+i=2bw>CE)XD|kDX?$1Z2@7Qa6;crO zy4a`?#g!B4v9G@{B2mV%BVTxsPod|>&YlVza@^~8xzaxb+eo+WL;9zF>mTo0Sbb z4Pfy({}0SF#|mS9DFzQVs`=(W3jL*6MrK(HTlw4cfFD?vC=zqypj#LU7Z3% z%S9X}XW2pmk4w z#B_g#;zGTmUlCL@qq}4y(FV$+Le=IPhf9}GqCq=yiQA(Liu5rhyJD;xU#Q}w$9I-` ze5S^=ae`T<%Kctp;qm^$-CW_KPO`F@TrOph6_Lv3h$%xsq-q+!mVK+f^2AG%Yfsn- zZmUVGCYXFeU=NI_$pA3*LF_LJ*r9JhLqcSN{h|69)wotp&mE&`5ovPrB0jXyj($=C zt#;W|b18G>I65vb_dfbDHZs!9fa~1EtKv16PQ+KFYBxeYk5ANfhupPSKd+8J5cQLI zUQiVaQ^`}s(^r^7C+{CF^Rjm}9%nWu(bq2ClzlCZ{KMEcvG4J9$ESyMpR&gb+jH{a z{Bl~Flh~xh4Oz)7t!O{VJ(Dp~A)S)Jscff;b5B3@;-Bh|B4^h>8WkRQsgz26Te&8d zx-4=Ggh{DT`D#Z6_e_ap$TNDYpIFKUHCq4QHFM_80|BXhARq;w87u^;rwZst4drE3 zR{_prEdA2r$1c_MOEM@!eX$Cg?ZZ=exzuE1_LbwJ7LxfBXmtX)zU!xs37b;m&7KW6j~B8qCi735GrV#4%EQ zqU|C!6!~Bevva&O1;Kl0`OG(b5#=DDCc3Iw(xph6qZY@DxMqiWt>3RYO?u=*wuluI3Gk(VST6@rYIk6Z#H=U3aXu zNf#_7;rxLhY_x3y*EtVbp}uHS-yoaI?V_Kv@IhHX$ndcL{YctFnl%;uh((GDrakeZ z-mq@)`p5-AP1t6=BHpk4!o=%a$Z7FDJKLD9lo4xZ-`>+5Y5t#Q7IKlMT=qkPGv!>? z>1-5r3z?B#;vzh9`=PKk-h|4TS=N{C<_Dg;^M2a!RD>fwUR>fwWB9i9=UqB>HFr>QOu2*qp`)N_Ayf7q)nAhNXdwNt@suyWm3|F zs>^jC1bZT0V0~l7CtIb~mF=)H*Lo?tAzR#1KcfIS25BB`!Y&-&0u@SNkuMC}7);fd zBYW7UGGCA4ppafnMLUtot+6)+!}T2fILLo_XfBp4_u|CRA}i%06KpKi&-mBp-JhSr$SBkkPP#W zjya4uTJ6NKC~WDI*6)s66HCO(<9cWvy*>dySWY^fR3R4!B9{0sziL|B%7~2Xxm}H! zQ9W-J#rm@t7A?X3;Q2Yc}ob^J@im8+6aL+zABnjQPRJ753tP>SRH(@d_?uu4&zs2B>}lS>3+MLf*v4GVJ{|W_=y<*CP_nU4TKjyB z7w+u$4)9=)KOE^`w{|aCMCSfy^2W23^V;i}KFnB>bw;ud{kLG3h zF0=JNyZBcHdVb^Ce-|=JPS3ab-Gkg3xVDC1KO1)VZ`9@A7s2mE)6yUF!Mas_c_94cQlGhlF#JEH=pgaq!Cf+&dxvBLBo?Qe6qKYH*ci~E%J z%uRU?LY^aNw;eBXc%7JVo&X-U_}#;XE@V%}(x+lO@mvK*Fc@QiCSbdNojv}rU&skR zu8byYYYln|dhO?j26guHt9`COhIDwn%lH9UjlE8wwSG_=fmwU7qYHL1#tH-XO z?ce@C!03F#j@fT~_*MC``va@q7U)_0O~_|&ihd|Mzq$JDSI(c^rgLQOp0-~tHGcb* ztc*|p$?XH+lfmjX`qm9!_ppt3Ab&L5p-2N^x7jLX+3!EDzc2MBFf=R{e(hFHv7Y(;T6S`0No%&&`3fwkL;74Zh%T)X ze_CL5d3}PzE7EB$_UjbcIqp(seg3bDUQ1~`XqKUG4mGnu z5QjS=xX07|X;Bfl2g;NWHnob{q-(7F7WP5<9*pLqI!(P|px-VL`rZsc)P5dcs{g^v z>idP9B?&MmQG+?Nm8`5}(t+y{bv@2sd~B|pn{NJO=ZKq3rNDz)?^4$0Ej)vEt)J)! z=e*y1^a5j}X|;MW8u=)_J53_awYqenExYuLaiCjSvgM_7vmM9qx;ENr7J;OM(-s9~ z_x13pQfHQlDGN;o83x~Uv!)TKmc+DV-Gd1$3|4ps->f^iXK}pv=`~%<0=5+^K0s2M&x@H81>$lmd+Z*D9;E?sA) zMR*?nqqE!C2)Bp~&8RrA{knTsc`<9C-6a+JobbhLk9K8CIeAa4hf5khjV771epNhw z6>{A&WK9=49>rT-*L>AeE@$^L_BVx>G zCoW4Z!Mo$l+{J@_*UUyRY?mI)4M1S#7J+i3%dHDEvk`Q_zplvnPygSS8nBWrkc$N~ aS~}lD9+Q5!->+FZckgg@EZKJSyZ-?v?>PAY literal 0 HcmV?d00001 From e44a3027a4b045c5e9d9b8127eadfc54355625b9 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 8 Jun 2016 09:48:21 -0700 Subject: [PATCH 09/69] Updated image name due to rename --- windows/keep-secure/create-edp-policy-using-intune.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/create-edp-policy-using-intune.md b/windows/keep-secure/create-edp-policy-using-intune.md index cccc07b766..014d4cc5e7 100644 --- a/windows/keep-secure/create-edp-policy-using-intune.md +++ b/windows/keep-secure/create-edp-policy-using-intune.md @@ -311,7 +311,7 @@ After you've decided where your protected apps can access enterprise data on you - **Protect app content when the device is in a locked state for the apps configured above.** Clicking **Yes** lets EDP help to secure protected app content when a mobile device is locked. We recommend turning this option on to help prevent data leaks from things such as email text that appears on the **Lock** screen of a Windows 10 Mobile phone. - ![Microsoft Intune: Optional EDP settings](images/intune-edpsettings.png) + ![Microsoft Intune: Optional EDP settings](images/intune-optional-settings.png) 2. Click **Save Policy**. From 9a84164f718ddccca350b24f5e9e4c4a33eabe2c Mon Sep 17 00:00:00 2001 From: LizRoss Date: Mon, 13 Jun 2016 09:10:10 -0700 Subject: [PATCH 10/69] Updated image to reflect recommended choices --- .../images/intune-optional-settings.png | Bin 36815 -> 34263 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/intune-optional-settings.png b/windows/keep-secure/images/intune-optional-settings.png index 6a935cc4ee12eecf657fa0f73d85449f68b28540..ab992ce3c883caa68d2fc5570f56757315f30ac1 100644 GIT binary patch literal 34263 zcmdRW2UwF?x2}#eI4Z~}DoD%NKt!4}5eTEGsEAQ|k4Ps}BQ+#AqBu&4iqrs65s(@w zp$7zo(2__?NC-s`B7`C(2_%Hv05kLd|2^m4bI*CseeQGTc?R=^{q1jmYwfl6TJL%n zPj22Y5!)@jd)u~cVpp$RG~c#uNAGtHJ6`+ z*Si9**g>~#+uOYH|Mr6?uiY1ZDRu9X?LCVCk9(mmcip!Ix_JBFQ}uVh_p6qwx~iV9 zCgR4nZI7(3UOaCZ<~)mwdViuncm!7X!ZJg!_;~3Q8KA^OTIRgCmNb0qT9Q+T%&l)+ z!@3ScNXxJIe1?I3g5%c?P%^mab{F#S{`iM8g=O!q9P$!*_RH;`exY1E++Oxxy|U>= z%&vWD+g%>sJpOxYS?Tlp=daKaxLO$68OEZ)YkA9hy_^hE-n1#EoIHmMou7l=h{_|0 zI*`yj|CnDc{Cwo0@Q0imd?6OxrCz;tdF0{V`hR>TUyyR#7_>1Gazs@1&wE~De-V+~ zy!*(*&-On@$No9QOXXqHr9bDXIAs5%i9fkVZN8B&N0}333MQhcBQ#ovh?hW8Fj6%a zwO|S!5|Cp@sGQc{{+-HtWjRXFB`A+#&W6rJjTAa#1y$?h5t`tU zX{dV5U&}pO{B_qHWSt`L^9YP$GZ2Wz*or2c0J-iafC-2rX%h_$Si{c0mw2-0TGr@# zeB*+y$7CO5T&Y5m-vY+{a@bj;ZW#F2oH{nj;SUN4Q@@16-z?>Yt~ZASIRh6*XizVW z%=&RktTwzC3kYU2d8C`9-t48136PofJ1&9yHUz!5 z(t7>Js#v?E^kF=t_o`qv+X^sD$fut~kD$ms2UI=xwwSG6N=c7Y-x(XP$I8PtRZv%- zT>UuOx`;{4ZFU?E#~+KQnUvrv-sOyV5&=aIIUbKoUE_zqr@KyXJm7N^nG0+x_7BVR z^-2!c%+yltuRXnZJhVeZH?=rFeI9u3q)3(Jv^Z#gj27knxJ+H6?bdd99bK%=*RSp; zupfY+$;C@|0*(EC56bfmOj)&z>_2BKqMO2dtmtigZU%lXB&zh!{j}3TIqCruyYQAX z#rrX|&BDMh&cmoiOSgjs(on9^?ddnGe4b^RjlRat#SMlv(Be!xevDXJ6pi-`9K0T& zZeo9jMq}^uF5gG1lrD12cQtL-pUe$6&powvK<7$vklu(ryZUIN7th;!{xE$qeXpi_ zwlv+5zzWcOJA}t*7c~a*y}~J(4U@FH=kqz&2Z63qL7SWVD?|l7%GTC<^PXf<5p+}c z)fbVP2Bp21b>vO_!-|i1&p8y#DpWJWlydx+EwlqvoBC`uzsP}j8tIY#b8hi8QAhRr zuMct2p6@+cF^S>Nw6&Sk#RENT2PD?1j};V#H*_G?q-9166nrw%7Z-h zlyD|s(wda*s6X2+`GxTj|_E;KTN8&T# z*A?isp-45L^P5aquVDZ#ot3+N`R)+WxT7t^kXX^NkQ4Ac)Y-y^m_OZ_2J#xz@+ORf zP`&0Mju<#fPx?+q2jp`KP|=CtRh}6o*X0mf5wWa0Fa9tiqDFo}TIcQ(xA-esJZgQ@ zUcF?CXC>$jy3ew_mHQTtUw(P!;FlQv7aCWF3Co`sip*PEq+hCD{z&X~D7;*fy(@6g zswUi{AhDofH&)6c05_SYb*tkQjHg8apLPhyLY0yFg5EM-SO?MN)_-*wrbnmG7U=0u zYm)4Tc&36c#y6pcIL=#w7&!Kv?##fZRz4dPPmDCpM)Z~>X(iBpJ<+cf^@giJ)>RlL z+#6Xim+q||z)sx>tV`eaJQL!5eG=db_^DhX%@RvKH==cUVigtFl$i~j^zLF_>~lme z)5I(|>phIzWJAQfp*PfttJ0qVSpZJGAKrT3RH0j-K#uvqdIslrl>~g4Y)`LFJ0+pT zx$0I@vFlyjlbTYNe=aYMlB*FPI}7oRhKNPS>1G`%a3=-%#5YGy*W{U5(Pp$bX;li9 z^3D#?`jfP{@XSBb`SFH~IX*%64WZ%bD$*lxR@)|_>KjaE)3@bdlZCGB>I~E(Q>!|g zelrDbd+f{5bf?sRt{B}$cNzN2rc%l)O2bn4 z?7I?vutqfkwe^OR#Z{cgSBGIelauU1tN0@jb7y5XKVkDIY3-9;yN1YN%;0f12g9GYc4BCSKs5V-jaAFo_(u)5}Jrfuz=tU|kf4E6T&KE}pGtdOd48c!`la z!hNhq!#=C&asU*TP_CxNQle~4=IgP=L+Y#P`@g;2oam?|&!0 zIlkU{{4y+LT;@338X6e)aITl#?_K|}R$5XepguRKa4_7Xv>0c-bh!}-@`K;g__=A@ zA``{HDe zzj05Z=v%?UnJ$&h$)^7~_-P(J`e)!|zvs{MT&TO^NB>Q+)&FYx-O#u<_N0U(~C;?*1QK z7)0}C%1LviM1N${rR?3&dp0LDPUZY)(=}tXju(V^MBsF!9JLD6g|WEsKlO*^BGIvz4~j@`j){48ruxnuFn`*{(`fCZQ3ih+v+l!|XUh-T^baw&8#Eb)<1wBN4h~fP`LK%<=&oV!uG!-c|9Q|8DY{8ntm>(# zthLnaMou0J)e4o65Oga-BAsn>G4$pGsGOlo>QpPPD)?A(mpu-ZvD^ z$Hs?9(I=+srRZu#spyeV_xTQjWoWie*Qouq@&UZ9T1vPGMf2NTQMhPHRM!w$Vq;0a zw!9Vd_r8n*SssfSjQ<=%nl8`lGlJ*{(lxj4t zLCC7QmE_TB$^_|+6|ZBtM&x~12i@1fLgu33PTrC;Otx~kWi({9J+NZ0Psy-`U~YcB zq`jXhP0Ab8*u8LezC+%($eWttFM(0qcmY{0g@C|IkJ|fn-_RTnfx?;gD_5bk(U6fm zE$nN;&aek{M~i8r_L@qqC*5~rQ^Z6}WgH>v9v)|00)HZP(Hy^-Agz`q2>Cj`<&N%8 zv-RYAL5ZF4ir4XCImYU=X{pnd$h#%%u%g#RghGY6!au{dfl}H6#JHTKnnP z4&f?3oFD&9%CW-E9@~VCA!~vgreej?0%++mA%8TPrQIN{QA4s^C<75br(-LY;`}u@ zF{`s>)hcm2$4#p&xJS;xh=n-kZK@r-Z0#dWN-k z;9!@nU!=K+rjA1?wMeNo^^YbMUcA`MXT@siArl`ttznJ4$;Q*sGSA@SOJW-`-FfiO zJ1sm^rJ8z7l5z{WiEBfo=IUJ0z6&C{hNOl`5PmyK=1w3>BPZ@{Yk=mPCc`% zvlTndjX7jbZ}?UFw5Ci~pNi5`gj;m$Y1*jBQV!vcx`Uqx1@&0_{%e5WOnQu8!)m$f zV+2o%z5>YK-w{;2s~^6*8}S6oX`O=vJ{qH+g*aj;DNC#GR$T(O3#TUku(>?1 zY<@zI0@HBi*)9hy!Wn!}E!Le`%9|$+hx3R0#aNPm9cTBO09z_T^Z#Q6~sJkw;h!Avdh(Rm90~Jn_4XP|52a zHI5v^VXeV(v^}GYKa>VQ>XH@q{B`V}4HOAwbAn;Z76O;?)><*;(1$?!e2+@mr=teE0LRx z=-=(TN_F0LrRRM8bU@&E$m>JSu7U8aUAyh}&xtzKclO4jci6O=%h>a1nz1a>6G);# z-)Kx2d+94PSYKnz-I>-3&4;{sxsUA}@Q)+ziBZ!f)XBddv^_dj;qPGQ|KY`4pmW%l zpSEH|Vr=fV4c{e2{}Kk!+6v!_FIa5bT%4_#lR3ewaIUl{1Gn~@;Y0D1x;(4#OLd3Rdwe>NzGEn501T}z9 z4sf>t!-GSsnm@k2e{zzeO9!N5V{Sm+o44H=Jl?50q#m~(2dX^`m_0onSdkNIRk#+V= zDPA7R@$21OzPFs{+-%iI7XNb#hO}4iTwg)dI!O@D4iL;X&c4me%$ynF*F~iaK}m-F zC(Y``)5E!aeiU~br%;rGL#2P+T)|B3AaH_QJKYT$O6HGQQ3%4UFyEB?r4nR#F4oXgUz#_uwo105QcemccZ{ zp2p%DYvlu0iuBNEJy)+H4nb;u;WZ>5Ljg`NI@`v}6H3x?_~1zS6KH+q6}kgk?_020 z{Gy#QBcKiDGZ1dn#@X#U{oF)escSaPgy_a-2qyM30PB$pmQ|Sc%pZiIrCxD#6K=6X zx!f3I^l}I`k1MYI-n^$=u#8@}@N^0t3Z{Pf__**^x^QPadaCxCe(&TXwYL5tU!BHJ zt<_DaAx8%Oto~j`7+&YD>oxL`4CF7J;fGlY9xr8{>)E$RB}h}gUs?M3@@3-HYQ%9* zj0!AEhcFsqrEb+jc{9(8&N~scK2f?ZyRSXMgmHaXa!=MrD;fG&t>%2yq=u;GxiaU< z`A5T5$BF_ZsY?cxw7Ff$e7ix%kBjhZWN7y|V7$Djv19x*g|@mT`VxHtpm+B;Y-ZW@ z`D-`}IqYzSA&>a>W$fylZsV$1l^V!m^n(^;_RXJ=9SnR^I-+2qjP6O2nGl=n%F zDKe3M=g5~_GaROjhv!|GSUa!^V+n-Gfdd>v`>m)}HO;)+aU`w~*km||mR0gc=CdOO zUhNFxZlGY9(S4>bB=a=0+`6Q{47mb7$^e&q;Tq_1G!6S_)1_?)96~lVn6aRL0kJEL zS6pRs+4}2Y$L@H1!0GiHC6tsrr9gGjx$&qB+!9y(G~wpcCfxkObTE+Yp4r+os%pw~ z3j}4JOOi7}(3AS!5&)6hUR>YcC~@_NQ;qNMPJpE+(5GAdCORt?6cZ+69izhX8f1fw zT;j$=jsalF$cB3zYGpT>!4~~zJymf$P&)!$M&ftM!NRx4RBY<$WWX#PcST=N+@805-ikt4v)7{-4( z4Mk-|S70zHcdrkboK2`)XDtv>c!T!R4l%z0A+i7!hd8!nzzor<(1S@7FBWZ?0cI@l zF5lrJdf|}buS=jwBj&LYBP0u(?Fz>wLvA*LW?@IOU1oh5%JL=I72ze$#$ydVgVa1mxplr^n{e`#V@R}@w+!%5?a$3)i8^lA=Lc!6vw$>$717~8Y#~FR*KcNyP~hf?UYwJ*FBh$#iclrG0vR|YmYf6Vj=>qYou5Z zWY)+XfFwapogP;r)o+~T1P@jN(t3Rx-wj2!8=X91WK?-sCx--Fq0Z!@{O|G>wSLa}M@jbY0vh+CR~m5KG~=t^$jUO)%8Q^|VCxFI!VFiJLs7s9)H`fcO=yGh{NHtyiH zG0AbgD|J3=-%r?(NL{)Cg-F9L74H55a&z(Fsc}gxqWD&l|XO7@_;f(kcEVlrhW_(t4D6dMPd>r|* zp=5dC5od8G!`kmD`$z!W8x<{!1R`+gEB>nP`WS)N>E0ViL(ttw*2)4)7GSc(rv|Gm zFHG4-#v7&s>O!+RLSD~@@w+mPYC}3#*7iUX$6p5Tad1ksP0;@u3w_H?3BQE>B#VPu zEn|jVzc>!)9SHBA&s$`6={LM@wAO2ImXIk7wx&F?3RCkYB$&t<-&1`W$*;`-Ygft_ z`s7jcm;ERX2jX8RD9Q?E!Xi%Ey9Nx)P5Sh|Bg|F-Z{+82`+H`a6Nlc%^SrV+ftf9? zDcA;l$;i&Thzn5*Yhz2v+^&v8DPN3hR}x>*Z!I=s8jNW1J5o(%5e?m1qsiZ5j3_ph2ZaC-`@2>H)3 z5cVEpOGN&Z+WP|JyUcSX-%PPo>jV%|j*Df|RS&Bsb}3>f}4(`PZKo!U`zoh@G;{Ys>L}e4PzjNVoJUDy%7aYM<3v z<#PJ42{NBEe{Lttpq!-v=^;19XTxV}QnObKP)s|H)u#oGNA{GOr^{H0VRSz8^gG0e z76nAPljhp)j+x>@U-?3iq2nc90?AIOG7^DyTEqh4*=hWf_+_55OvMDg6AU0`h>fXM|DR zupdJozP5`xjwCw}>fB2RtNlKGlgl!MOQbxra^N)cgyZ7{mKSC_+^`@$J@E?0doVn` ze=)=N<3O2+%ib4><34o>MPG48c;AAIjn2Oo^ucZ|*5Xc{OVDc`4e2!(^Y`^}wNTRb zbBv`lWmv~RJx)0wB4qh;^t76T!CKYNm8_vU;eBR8Cr`>UL>VrBHZFN__Cz2p>w&PTE1HTjaA18vm!U=#h=W( z`XlWwL$UnA$`;8NG|vj?Fx!DI%uYWZQtz^ z*L#LhxkSIjvd4#~8K4iArG9m;wNDSq!7$)%_E=kNn7(-_$lWRWOK2Yu~kYoELVi&`N z`{HcFa7leKAQOwF;I7ar;2v6UTb0;WOUem`^$d^M<ZWiE?F^MCNE zYf{EPWlRVj60DX_xoM7P68t4g^1}Hhu4&;W43C7dC0Q_OAzTH*O}~Om z8JtwagUO5QUBKGR3kR8bMC5Wd<5$dV?G)ww)Y7lxQxKQ+U>A3a(TiI0o0?0M+rf@5h!$F* zZSiAge3+SO4l#5vc)&7puQb$R$)AWVX<=wvyUsy*@gxX^M7y(hHCPq{TThcLzO+DP^3g7`Bcn86oeW(^LPk{G=+<0ruzK~P%W=V;S1Djbja5L{N13w5NH&$o zX19&>PQy!}wX*^v28C1>4!aNlDBic$__Ewo8mx4k%H!yy+*vvtoL*_BzwI_k3iEuyMp?=$LS$pz@M$7~t zXBU>r%YK2F_YzLxWaLy{Ksp~T%1%$F1cN7WbXPg|y|p8OH!0ZtPA%!5(> zE!r?A7^7tM+!Z9oo#d`EW#qW$9I?MN0M_8?SIGCoXM<4<`ccGp^-lBV>#H{ajTo+U zC-Ow2c-pK(m%gD*9oUDkY!C}^yV2M!{Sba(@K6#j9|3L09wK!*@8C)!F}n)piW& zX0jL1PBgfyaHhguSUW1jG@OG8b5}ahJpBhDD3PyN@**Ygbf;>Y2Tu1eT!SB%-!(@X6CWY|?_5kM;+z&CMqwnFw3?{$)(D#q~-Sy@Pa( zn5l0gTn(b_m6;G8%LKawcH8fXjwN5o1EE!~&pkF;{xZ|YxN%VMy^oql@=!E_o~c{S zMa3#s!3o7)yM+KZ(ZV}W!boiL$<*)t=cMRMkN(R4pCzq1u1cU+E-r|J+I#Ia>UHUX z#tWhTEnmZVU0XT$uIT?5LfBi;bcv}X`k%ohJW^`~koxY%bf0xVm{Pl-v6v|k57^gE z?-3X^Mi+k_AiF01iQ(`J$FUEe<;APVoalBy;=-lFyiF#-Qs_39dH-#~YM?vk7ICI{%X z`9Hxb>94+DtXzPSr`!E+=AmoT;cMuVDXn?k3MtyvXYxL)>NMnvyB}o%m7?VY7xm_p z-QT-smekGF+SLtQX@&o2A&F3RJn7DsU^=dC|GhlG`wo=A&QBPc!e{k*0c(~GAjhO- zdRMADOW)KS-hr0hv4Pj13jYbiF+1XJ;M!{=okWwJ@bI2X?C+7fB%&f!-Zt90U*gd9 z9G&X@O!#u-?%sow7E=1|^+z?s9NZcnESF9%#8Os)N60TUij@+sztTjX3^|BNt5D-A zu?u+=kVkCrEjW$U%eX1y_+)SrEYs~_#_>kBm$>_gZa_(XCI1XKy&0gl#9Z{bQ&zDG zNsLS)^U|t3KsA;D5^1;?U&&w6i96mX{-aEW9SO z2cjY%sOI)uuiTLpkWU+IIFhz)B0!`A)FA9=49t~>ix--W)pejSyce^5qR!=W7h z@_9M@iPEB|e??UP4HWhlNxsrj9wAlR^E`JTJ4&mtLB&7e4eVATgbpKJ) z=myGG3c3>gASkg`>gB83mb3$1&%YJW&qfGqsIK2aXs-yO=BkD}GsP#BW&kqR`m40R zCsj15#HG;i4ie9`BU~~&C^@&p;NP(6a>gC>G`+`gmi;um_(?y+1G1oJ4eg>_7r0!! zH(U_);Z&cr2&F=@pP^uQxs1Y^sxHXq=reb8?X+TUTMB$SJ;FSG12NR9+}I)tJ4OCytg-p)ht0R!!VtXE=a36-HCg*F!UEPQ3}@1;O&-E51qe$k8-8VD0S|w%f0X;-cVQTC52_m)S*JhP zqSL-zyZUY<6n(?t&)Vv?eLI^+=X_H{`ZWKz6Y&uQ3k@Ate9iT2)DQRbaP#!I+2zM7 zAAMuye|#N;F3`tBuHhvNQ*JnS-g%3>Y5QJ7iYCKEFvV_=a81#_txf zM@%|ZJc)Zh7o`vWNb_a7LK(Q@e^+$dW#|J3T0stbcI0;1yMz={a@w{0WJIdM_ObFI zm4Y{<@3m*rXrd7cH%UgoL#BRO5Hu>w;lQ3rth};R|7VQU(Cysu#z9Bo>qx&==Ocd? zBfg52@a@VFDy63`DS)m!tzEP{T-hd?Yvz_Mkkxp2$v>ef!%*d*)oMtz!x8?En)WTF z^{#CinBt~lvm(ThR%xwYkZ45Q!QcO?cweWFCW8(Xx9@57^U&GR@zu^%Hm#;jG$9}` zhv4g*H18G&^-$w5CuKo?DdfiVd)U%<9p!}#* zly}kZ?Z`zHS(xoHer;h>JdYx1vouhoxT)>>t7hQRBO+-HnifB3z3U&vnn&ql-gDE4 zrx`!|Raf~i>VI|t^qycu3(orR4~E2s5pEW&)PEFJy}tLaNw-IDn8=?@2r0s-kHv$} zwwpz?`#U-tx_b^2MuAatb%!sw{=7Bn{h`}|`~Dl$WFls1} zFSdaemqQX96Xo#a4Et_YZ$?srGgq+_;NrPljDiuPuK+aFjWy|A>Tf~w&oAWL>;davQG+b z-5wgC4tIobZrEUwKh6a!=hs-%J9O3IJ z^@*zht!Rgta&4L?X;l}S?jmBdejn-?iizltZe3LyN#SN(8`;Sc*H{aFGM~wnN3ES+ zO^1}U%j@%P-Mqm3Y|f#cn#X{M>aZ8Q%=ySX8f^B%=+TP3A~p!~wQ|79Yv&h=72*cp zf2*vkV+ujS%iOugHRp>OmPtHGR`}W(nZ#(fKzs%SpkBSFCxVy~u#KeFX#^DY-|4o# zvum^?e5k!qA0N?E(=AdZg#jW~RjI>dc>H&uq4@msF?|hmRa=Q^h4qffkg-osX4r%N z$he|5&FVKY$PwGMOuF_@(XpRvrRcf>Apz_~D#ar2hC3b!2t9$lB{axt>d!GI&J@6R zci#8c0RL+|!uAsb4PKX8tssG6NbJR^duq}IFtRH&xGETH}SG2;rR5ypyu^rXm2V%w!tC6?h0Dd zv{UbTm%}6ke~NO2du<+&nP>+LCcGSf=weRseHfRQpe>Cr`kjIXmb?!L!>zzRD9UC# zni8}L6Uz>cq0{!gOWlxMSACFSa>bt2uMG19f1CM{kXZ`F7#?qFNeM8FeX&Bj;;5-Y zDR(wGY_UEHCl5OULW-9)D&TXMml8@AR%906Hc9j`cS+$D@6_}0&x{cH zMe%FxBxLb(v#D}%gbwfXW1!_ME@Z>tC8J?fJR&#cQ$3LTEt|T9ExQ^uiGh8m#Dl0+ z+&dcJ+g#J!V03*Hr}N!A?Z$_Yj&Kr}FxV-1Q;)IIsT!$qwTL0bO@#;LyCTPA;fbTg zvANyk!_Z1hoJ2q5Ex^eX@%uEkr_>k<)UKSA^9<75Uu+|#3-5IOg*J7B2)+sql7Z=*xSRd!+` zP&|23){}Xp)Gn06J#%rXfE!DK>7|@Wpa5s`C^`XYBchM7R`14l!>7j8LIdktU zK<5DeeCC^5O9^(ILb9b$cU;*@k^||4^W(56I59TpjYc}$Tga*8bxr2nf}Z9qP%3Q! z{ph~8PSx_hxUfuH(lR&rHv*+3I_@>E3~dqtjM&Sn@oMGTgARi<9?D0o-4)I=SaL)y zf%5r|Q9vh<5B2V5R+l>^NLGf#&vIArHsl^Wqj4uoHg@SC*MdQp_w+&;XJ5NZj-$Za^&mQi_rv@YjGs?Dm2NPQzr`33E$ zh)u(f51KtIa5dj)(`;5s^7{7xsv@_!;}-b0`1DIvRs(7QaMAS?OT(xm^tb^vH$(Jf zt)*UYq|3lGm*WR#-gK1S`grZ3Lj&*50alH&&(0gO^i~8cd2j+FnMValxHHBseRk zw`#j0?VN4kIi$2p1dGq`$}W8xC>}+m9KieXf@!;4hB^_Ql`LufcN#K~`~)*HUZ2qt zd=j+gfwwzDguS}D=5$lu^(+w9z{2jIm#iwLbb*aj@(DzfG1(vQHC`}$95y_`d@r)V zeam@Lil>CA%5;_d9w~}-UR>Q@xxLOBp#qHYnxWcm4|epB|B{~Qx(k1(r10B-{d=Z) zf+Qx|ur*xtOtpzdwd)28rB~?sIKX?C)SiSJ!q~p-&&J|4FK8!0fd{#`wD2Z)$qZ!cR8)8@hhrO0B8ohxvc$telO-m8xDUo--L)Uh#8CF#R%g;2~u{ zDd7@_`mNER^*z`XxZ43znba^=LxDb}^vo4fKHY&tfZ<&l5vpthvi6iI$1p%Xg1AuH zf_M5AB3BH$Iw-Y$%Aq7}WuRmHXNq|(Kod=dbd;FY=eoe%idJy1m3W_dT?zU@xT_X0 zv9P7nWP^Z_kQ*UTR~i4**c!&=cm4rLP_bEO?LZBcd9nAbcqKU8iIoKOJfsae&!L_P zI1-uA!swE%a^^g3UG+LowgYQEh$2{TsYEdgYSztRhXknx3#M4Uc8xVJDRHu~)~P9S z78n$NZ?_*Sy+24VxynuRX-%i>+Ug+m7O9C{O!;JoUX!AgK%3;jgEh;~YC3qD%SU*o zzR0GMBp@T0pcnJK_FPtan9A4o1!wILFGwRu$Y$!GnZUJ6nRoCKGeKR)SP~O2o08Bc zNA7m2^bbRJib%c|^2@6tzc}HJPqH>K+Q`MLHs%fuO)5s8Sdz{wdhSjcktyUW~60f2^ zF4ymQy6{PK8cH^pqe@#*+)L3!##1oTIROk?Z|J3d{w#{ z{Fqd>ycY~@I(XTPFp?E;SWy-lxwdfbvG&rPA@It2V#9J!3nj=b@^o$Hkcl%B@*5c7 zZnR*p^8~4uH{lp@07?)N^Jm-F*?d2W2{Q{SU=;BxSAF|(Zjrncx|n% zy)(ec14=jn{>~Q3Z+o1P7CIzmA zcH{WfY4j{9PkPb%A;0d%D~(SL5ObWxVQW(?GX4-I)X`#fFXh!cUjRqL0iDcjnpZTL zbtOf`9oD4GJUc}rntdp7@tKQ|=Sr)*E!oLO?4#=Szg$B17cNY*bDit0AC*)C*eE48t!Azkown~vLs-=^3T>g;nS{aZxb||i_U8$ zP!;Xb1q$O-h<=w}8|=3dOyBCu^w1m48iNb>jM%mPOdE`yY##YNv*wq#jh{=hVAKGE z8@4;3hF=FD!(Ls?UVZbNeAV!fvM!6^1QkCY5a)3-tk$*ztJE0Q3M- z0!^_5D6NeAcxfwXP!^o*6Jq=+LjoHB0m!GDoSUK`mWo>>XfHo)1Bb9M2ck~>>{P1z z^ZU6rF`vQsuL}EzZnAT#+v5UMcVzm%+pZ9kiq?Tf-ZU~YZSZHZ@rc|_>Yw7-{xD}Alrq_k6T&X2YVqO z>tEBe8*#}|m$2_1Mb+HGZ)Sa)iQ2dYpVSe*Dk?a(TqD?%sS{n;w3#6OCb}`#+`vnb zP?&=NG`i%tUfU};c4#Z(`zQ?lA2!LMdPe7FX9?>J_M*|F5$ce(NL56SLq5AXr)g-o z1frQ;WLB(E-69A>kin?)s`z4p?#7dgc5Ob|)#5OnZZ!8*0ZV`SrD*9vUq}e2Lz0{C zw~sP=ZM?uItErzSsRq?_N@FT)q6GIh!u(%ELVbOX$z&BIU$z!vh~s%hcf$7cdUyF$ zfSX5KK>^D7d375PdB0DnvF6c)c%3qq1^sN}kI}KOHv~IyPbg%UK)ixZwYJ$fYW>Mw zzrffiI8_51e|FwMScMNwL7&{y|DDt~^X7j_ivI&8C3M1um*lmMY%pSdf7#N|gZ%Wp85`;Nfcnlm}nEFs7{NldYj!hXln&1j={w;%^l&K~d9K>+!<&G`U$dmV%|8=kEs9~+sRK6^@Ye!z2$qlXs`EG@<+GVX zr<8|7bq8s*Qx)ZPl4aD8q`|L>I1{8iLA84HLCi)S1AAq2PyhXBdowH6flyCaAtD0B zsGy30LS&4*hi^9UhUPtl8{FH?e}vP(vFZ=m6!2d!*=b;Lq7{p{hH@8zZRL4Y=f5an zK84Xw!xma3%S}~l-l|sxzy=2kW+MO1Z86qHX-O2?cl)p2Y62;%WJCUPFV$gqF?mMF z_X|l%6W;_+bVP-H#6q6y6eO@y5j$u%7){HZWuII5SD7@3*!&Td>zHo0sswGr8h&}C z^)I6NZ_&*s%hyvsZ>TeR)6O>if$g46(=(bq3hSUuzB2|ns@=OjGdA4q{O`BTkiZA2M)v3Xza#9Mcg_3xGeUt6| zAEQd@2me!$lF%=FDBEDQ{!I&Ab`Un|{9c8KV$;9~D@EMg7{%@JUOAtBByPc^3^rGj zC++?;gIHNrS%&NF@6`4P2vr=U4i!4bH%%4|ouUp=i6MoT`WI3S)>p<`dTGLgr=19A zW)zZ))>g;zRTYGqysC&&B;`-}zu?`H z&Qr+=icj-!GNYYJ*b`kRn(P-i;n}`XGG-4<;g1^grUAIBXGFub&mUV7>GP2c{r+L0 zxYRc~oHpp5N$3NDnVpDtDPMQZ?hrS4Haj<0`y##Kc>~WSzV}T00U_otB!s>9jfVYu zFwDk=wB5ToRcsS{DL`;>BOwW%wiNa?1=*O(;72{EM7H(4Y&Fbmuam|O?$!Az+>kE> zmKSkw-hy)wdBSKsDI#n(e*9LP6;|j{h%gnU$qEa$-4%k#XMVu^%w*bKU^#q|?T0_X zW3G1sJA#Z=yYTB5?W($0EzxFNj1yDu98MRac1^nOofD4yTFubEU{8QbGbG=Sfmg$O z;D1@J?T5G$QJ>1!Q4GtUnFl!*>=D9fGC!9I{P)m`jn)a*=s$BTVFsnS5y5wx00?un zOjY4KwTvE$X-&QCe&f^U1AaM9>ZW?+leU`X$PvaxAssp2-T0$`4K)QxZz z-QQe*5%kLO7wa=YN!sNxdbB>OYyZ+Bw~yZ^YFnp=-+yNcW`k)Gg~#xZM0Zw(yTf+%Mf|U+{Jko$EFVg9>$$6m`Fqw?W`ixfA%YSHm>l*$%F>vhuNL3Z^$ zBU+!`_}h5YY%e-b-FMa;e-!#6BmyTb6bIa+?OsHy24pF!9&NmbZ=0RV*~3&A0P@3k ze@6SzLz-fU*giC zBzF*S^{sNgihtmvMQp=V)nx_$x=d8bz|A%w*1MZe3353zBhm8p?9;KUZ#B~ECTx2i zYnyY=Ry^-9y2WnY*Za+okQMJh$d07Wn4nHQVUQq zuJ75XNpBDeNQaEr*m3H7`Z zePNjH?=`VWVc5Sx&!^Tv8A6Qz zo!d48`}dAptr!WWJ(h=!m1AspPEvr)jN-%H8ez%Cxn`kNh7(ZzC8h|O05ED0C`K(R zVuYvDH({i0ipt*&3Iff~dJO8fdP5lDH%bf>_kpTsu0 zT7902{Q1lTIsHlj3ljww$c(Hk%?N*7W_w1lg{>KO-Dr2PfQxoV0=Z%AHo@6M!?o|n zsK(-k8Su$+ad%bIb0&K7g0{IYsIbPcF}Yj4AiSLZ?- zQBDz4InQh0Lb8pG)!D@$OX@{}Fa&l@)b$tH_tU=TGIOc@}*7Jgr#1XfNX& zYcM+j$nGf1LnF??Ivs{zzd&sL|H8%pNrCgHZ99dD141cOG@y~s zp2-{Gj#I_!S-f(}`eNa^sbI-Q1^s*9ZWbbD;*DNx^(c+M7uGUoXXdoWmhe-)Fo?b& zz{qV*XtDi;EKg6E^577&?%K}iU|^;7jd^#69VL9$Mc~fLvUadYMtRQnm2spb2tpFF z&h$CO&=R2FJ0mu)Hr4U|4x#h%%MzYL&fybDR1l7LGi0GI>V5fM-1^N0iy|G|db4qh zB=^^+GNr{ayBr@i8RDvBkPd`PBlS=7?Y?@jg)Pq0XDh7TyJ}G%cHB8|VCT^2-YkK1 z>WOenfG|159C|$-3~QkH4zH-7_o3L2?>aq4p8!J%+Emv(K&Qg>#%hgzG8L z-NvQNc}tj3KEmv1Q$E6jz=-!dVERP(1>T1p;%;?ybtP{V{NBzVc{!=An?C8`dr*Wj z{No|rkikLhE~zgH!7SZaqF5M0wlLy{gr-cP*A?}@%Jcj*ZB)KjMDa#On}6dhyRGf1 zL9}x1!b*J0Nc&IsckI}dLCa{vYE{%`7;`T8ls;muS{OXs37p7v@UI97eOcP&ty$fp zV-TD=F%ffP=)*K>wNj>1z2Rop`L2+D9YnLT?xQa;rS<3ORH`@eSYCBn$>LGN5KGM^ zv86vI3j-`;tLG@%%Eh{sCwdxncj8Lke1@yggLZASZa)IP@UGp$7I7l@yUJ`6sx|5 zbm*dVMQZpI7Sbr9pQRa$(^7YREG((X4ul^c!AB?jkM_Pitf{M8-`-Xz6{H0f6omo; zTE<98WDu$-GNU3!8G;4@C5F+c0Ryd6Ffs|qJc%NRK#(a6GKezIG6hHgk(q#$Awd#C zemg<5_WRnezk6+;-sidh@Nmv^a?T#sUVE)~t@Z9aRvtXts}u@xSL&Pkx3NKi4ZIt; zYbBtvY}!tz!w89xz%9O<2DxqSG6j`9aA()YaWcg}wZnG04{vd{zLe?mWW-Nz@MOd} z?C=&wcw9`U$*KOUO)Ptp5K)ZN zH#>^A3wi{+gtgO)0>msld@UvHf}BO1oiT7a&vEDd0ch=7jqDZ!UkAlEs%0+usp|9o zLeKBmHQIjPZ9wl}O^?;ec2(BO+MQ%=#mRdlw|W)2ZJexlqbrd{^67znYD@`wZU-OMMjjm-*8T?(@XSBjvvIaF}Wr5Ar;eGN@({$ zwa5i&yP!#D$2}s=<9)B&dd+O|?ElI$(f6%JKz0`t1T@dc+s#_$ENo8NBtEA;Q}a8K zyZ4I#=^C}QnL@Wwstqfspi?Lg}go8@Y8NNmDv1P}`9i+=QwUrLGKENVasDopD z6SmFO;u$JWq4$UJwaORNk4AzTj^aLVOG3tZE8a8G{m^)r*Jf%lM#m8{I#(w;6n~9$ zY{}!;Qrg4RoiAzo%}G!1Wk=jkip1Fbe2`~p50A*J4FD;NO9OG5S=_{JVEKE}r+Zg| z=y&AP1yqYxgYJ~q&m)UpzJzHrc#ND~Q*2c7kC1IV?8x^@A(Un&AImVQ@7t)mGYurV zYzCn>?x1ExXAtt`QSDauX-189d9hL`H22hTTg5Ff@2(va%T;%4w{-t7`(XG-m~!Pn zbZXztxy#MOEEgx?CVt&wKi%N0Y2BppF|}KO?@ih|-~4>}uz)mOwvbel@uL+LpTD_Ew!btu6vO0tVi_L~&jF4QPeRC?nSEL35U z?siaWTC8nP>%h(ittnh1WXi7DHe$}ETB%jo;GovkG`WrXX_h}ON^3DI#K!K)|_$bEc)z>|J!SEtj6+W zAF`Qe*=wTx(`!Kv(J0G4KxHTqgNpVKHhK*zHpugdIklF=pjv*~{nm*crb*I9-w$5U z#t||iiGFX38d%SZpNtRPEzkM@U;so3xfIyqql={iwB)m z7K1Fmr97!`HY-Z+%=wntAP};r{5TY*HBHdZ(_#Okhw!kN$eTL$VTm+{XTJy`!`wdR9(ak)&3(pB2>;-lIOlIc>6 zhRe$xW9{SVvpEs4Ruk!aB#lhlBs+O#*7!G!JJ^W@$!v4d6(`D%R}s^5)SShVn{Q4~ zACB8*M&;@K^!EDh0bVC@_rT_*Q#}=TwJDE$Fr`-%Z(d+Ec_~|4ED>9MobL;f$GXE%a6kiM&Zo z_?~LgxrL_(rN?D)RY2n*_)Kv+8a0Q+ygA<1rDNiQv|Wcm~ef$!R&VJ zofSO&z!D`qLGvnM$HonjCUf}>*nNJLH!)`)^T0vs*`IJ0pZx>^4P1)@*vV%hBjXM8 zKHuE&xn{Wf>~!LkxaO72x0;2@Ws4`ezS^)EL>Th1>wz4Z|8((DY(Qo0>EQRK|JfJ7 zRcsdKxoWLq(eaZ9$4VF5%rQq)iiST#5L`L^{^%&F$1E&Fe_|pD&tuvwuQ)Ut_xxiq> zz$I)ErEoH7ySt4=2Ng6u7cX3?+$i$>WdJ2UKCyevF+)`{a* zT3Ikn#-0wcoUZ_!S8t4toAt7_K=X3F$oGA12Z)@RQwC@OB%e`Fc#^k^9gj7~{!Wl! z2>7mJpuRu}ByI+;oWwd_74#*C{#$qL!$@6LE4l%m)r94&9LB1@3lFT1K0}o9I<29* z^A!78XXG*|GFj*20ekO}e|X<}xBdOdzxVB*yl>!#01n^`g_;3R_Z#z@snTGye-r@Z zQ{c|KcmP-aKG_9;7NAD!Z~MzHC_`H8m4)8Ia#|Ma-U>~D?vA+RVW~0RW$p=FCri8D zscVR`Y{d1s>h5@v##6NmQ#cIZc;H-g*C1LluD%2~OlRx@vUjSd@gewInnf-ODQC^N z9JLaoS_3Yr!kj4ZqeT$Ne+vEsPn;$dl#DT^GzXVWQ3R9?Q6mxl?wS5sZ&Fa1^<(jQ zgjKe)2bAurVboGyu?mb8A+6;VFpwMH0ob${_^Rj)LJUXUU=-{*9ws;FSJ^fVEC0Z|rE70tcS zpu4A^CTh4)p>L!iPM#>c1QZHIh;?p;yC2v#@Vjj9M5o__A zU8c?(AVtAdzpOPc5k4yqaYm~vM`m$5E(LMmUIdp}e;1k6LM{nn>IcRS^qn5>>+37w zJ|Yb{hnVJcRHGY{MJO&8lJ1J6T1I6Bk9VQLeNPGe&>T`Z>al+*sXK!lA5=yuW!w)F zLo3tWaZ{3!S;1u`QK*12${j{@Lj|$Frx8ojw!EB~O#3>`JtLF4-(tzVk>FKKU>YB@ znIxBstl<^@;bK4V6Qm*6*O~|VY8Yr`)e>Nj;&l9}e&89-MTVVn)NT8W1)}q?w$Ovr zLTGm}kw|prj*Y%?w1^j{qrn)P3=|=|O21&Vq}x7Y7>g0}QqLYZio8||#BEA)wtzMT zb+l84WtTr1(IbO7Nb2k!dDWxItRM^_ zD=Ul49UCFxv1$ajZ#JZfElmQcqjF8>$hT zbBR0cB6tY*0y8~&BIgojpc_p&itJqMuF)WYz2co@@GT&fIX})JpfJs}2+?$+HL2th zMl1W>6!C|Mcom;KFj7WD^p9Pd9v$lviJ)BY%88RNO^^C@)}CA~nBn&R z<$XJWEdTuxR`xcv=_OHCSNa<<{f;-L3KK2#PHFy7EsLth-FFNon;AmF(au~Npm?JV{|KYhAI zZo;MB+MHX-dM;9aXVmuA8E4Ob3scRFKr4=?>jl=k2z_czVDGW)I4tikC^5kP#b3MB zXN{gGeDH!64yw5v6W(hA8^~wV3oCGJfRODmcJ8qyYHY?moO-7bf4P?nZQ9phqd@dG7E~jg^>N0dwq$3nvQgCNZu7ilUTo2giGS=>Y)>k) zCgEfs8E}Y`hAz*Xf<4RO@@rF*s&!EDT)N+H>-#7?&*>t-=>V5|C9 zS`RF3v8ywSR4o2%8tppxwgy%{Z?;;m6DqgI*~VzR)YB08UuAC#vT-x=`^rZS4FENc zllia~;#MbhSZUciL3U6B-mN1W%~4Imv&`~YuThYKZ_o|&=xz&|ps!ZxPNS-S8 zvAis7TG?us|LTcPt=l?xuLsV-78=9qd@5)!Qo-caq_$B7?Ux3;Trvl|;qmBpmta3lsmHV2-^WQTZ z-s=Z-jK z8LFL1=^DkeMVTR zs7^u@DNF=kzsV|eF^$aQiwZHCCzdr?HKoqz)(G2etND`AKgjB@$uX>Ghl;kqL0#Yx zlbR^pb5v-4DDleX`8*`3CotH}^jEL*mQ-f6vX^yQ3CBYh9l=LD1ZXOLqEJn<(K3}?a|02 zaj&pgXi-?+2u~Xep9^(H9>&=4M^o}|5Ama`>kJjtit&+Gr119av)ZHSPoixm;q-85 zu7CqfzsYWjkFc07a8V^!V_W!M7g|Ba4KI>#Jzp#mEM1B&1H8eqn zR_$|m_w-@IvDreF5a}juXmE)I{HE95y@^I`0FMq1WV@)r zK6}Ffi%rC=Ln!>jRcZ5~@dkI{LL{6zNa7G5p>uay z5K4v8uB6{|INHB6W%jJ$5#-2pPqI&XK>a3iTU3?Qr1Iic@ss5WVUVP(W`qEDR2a7T}`ZZtiz>#MJ@dc2Av3;eH zEKp${oIH5XUd%eix5~2bM?a#ZM2&D(M&;JL?PE%~Mlh!yLgCx!o800m1NieJ^Usrcx}XPqz#80>*rxdx$tq3}2dh~K8lwW=2F zi>x{kuB}@!Z<+YoutH;eZ z_O2MsbR*65g6-D$hhsBx4yH?cJ@}YFLs%W3&;=6yzy#f6+Z5VaeY!#WT+ks?z&;V7 zU0rn(a^prX|5r@j2alFESwXClaVqg)A|2ZpUkmS1e=07S9U?RGFsZFDGkxSnWkhTu zs^=)bRdiZayD6e^Rmezb#6ClSFp^?3p(^^rB%C3L-45@gLyGP{5ifB$zKT$$M_gCQ z8qh8oaB!7L3(*yGyeOZ`^xA=RT^{`6(+)g`Q(l2Mf0-tnL~eY;&IoZx@_r+ou!yQy z?p|Y)QGUvRj~LiPYNT|II|ram*PIZ3@;cnKvIgOFW0+sS@@J$WZoh_cEah-+UjdTTHz8YWk`MDZ|-9Q?&`IqFT*1n?<-g+t^J>|Cit04YQn0bl`ZRp=&x zKi=^XPPkjPDWHstG?oyyx(`iewJ1tKPC%D#Dql~2i>c-C-mpM5M?}4j7KT2V*IVBj z-{f2}mx{x>%a5I!|X*;(*Hbuq7EEbWL4tPfzYj80w9Sucz-X`5HEBn=Yb zgXX~DQ@H$z)4Ehi)6r9BNN$hcj7Hilx!Wwo+>-^BMO+r>|3#SOnp$}NYO@^dM*&}E z;!>%cZbxWz>)9W4xga!mX8&1e`2tTCa-iq+NQ4$x1t(~Cmijy~ad|mWad6v{ z?hj_F5d^aXRbWeiFS!H5RqTX>`7-Io8pt0Itd=kS`lNFNW>?x2!nqeL9!wISlhC{9 z$Y!3aeP>Dd{pyeK>ovuB&eh+yG6DLJ5}`#%(Z5YRCSUp+!Y&*CDD1Lk)PgW@ zJi^R1D0%CP43<)$;6F;-%K(qbwcB2vE->;yZ&vPW+|@h~=Q*VL)JrlB4KFtFZujC4 z-`v=wbYY?jFKiL;{Xc8&)ryApz5&HQtVL++#XPaZX{dL5Y4Qk2&wdz%*bzfsDx1Yw z6zt-6&ifl;hubKB6gv!GKi&YG^R*K~pqck6kjecq2g(G#GQ-N$3_BoC{I=e(`ELl+ zTDtyGp!WUNu^s7J{k!Ssqki`qns|NxNh=P*@4TFHMHA(9>}g&+`nB>^=mMTb^Y zN86hk%wlv2GknS^m9L=WwXA}_G}>DEN67^5EgQ#Ml{dS7`oCT9U!%DH++FY=XGrb! z4M>%SBvtqkEnh<|eihc{IBGV#Ycjc6G=CDc`X75g#6RQx za2X0dHHW}X%`2DKR8aosZR^WqCYAfJ-_8v)L5#6vjd%l`#R-c3XCuU1O5JP|Yv`fT zWS!-39W2OF)O&w+*|%dSji;nO?YWrOc$Rt{llqh7`o%vw_0#hPGnP~;%VhenXGIvi z>{k-!v%UJMxv;WHlU|pV8ka3Rrwc)O;fEtSQ}_wdJ%H0-KNHTLvbC>ZWK_iVds4G{ z({xxD3qLyaQ_|km*LxK1EyJuksvVY~h26)P%ykCIyT3ZM)X}xNX#hK(pz1*_0QsmN zzH<#6oZbul&4HmzJ4AP0Ijd4$_E0swwCEQxI<T|XPQ?`!PXXPi6edBzW{kt~$qdjFt@6S3So|9_wH|2$i8AZkX3ZLEq2 zE5)G0Nwpf2<$&40HNLntD@ex0#(ez{-F(UUCf^Lo9?KTW(!q+EX!n}3SzlAltgX?O ziY_+f5gH`5>a5eL;%!pv<2+GXrz&WIQ}Ocl(Sb%5i>>m_zIMipb#(W=@y3-{_|e%~o- z6*seQa}$3Nw5Vpfued>bpCEdJ*g~T8T1$fCb#ApakPbZvIo|y$#&JrnVs5UMs-+1} ztx!=~pZd!PFwAC-iP-X7$bxt5C4mcQ(}KCs)qFl7-_aeacCIvG%JaK>^VCpjCRzBK zD#42~wNh3ndYJ6XQ0@$f9&yMTGZ6E_Q`K$-x#zcFXJYOrKsuZfAVnP7WFTh?QmtC~ z8Q!su0*_@yB_O$dhc9-VcMI~cH~hTdr-0@>eTD)P>;e4V~G#} zXLLipW5&jHM|5B)|yvy;vBNs)4(*?JSoq$bU}b{X8gJi zsER=Yx!KFCSwGd8GmWndjDuzOl}5O2p?gT9lB7ISjZ&D#F+Fuf(37#5&n`9Ht!$P_ zg`Q;w1$qi{7efd{hMJX=dg_jy4Wd;_yG;|WN(KV`@}c+VRApq9>{H0Ux3Zwe zb(02eb48kWO71su{5j_i5ZRv?^;V?2fXjwEsOVc-3qNx1K(V-c-t*mRGV78o2Ii4- zr@#au@hAyYE%Ck68Et+*#5s4s%K5XOk^H$E@a24RwM5M2f2Y#E)|hA@uKFO<)agfR SD~@qArNI%?!-PX;Z~Q+9UuO9L literal 36815 zcmeFZ30RZYx<6{S-B`DvZLP{6uv-)A0#SxA1i}y^LP*k`Q6zK8#Xp=*znQtCtASBr@#E<4gB#D>a5GR z8^{B@MZm+y;orD_vtdJR_LkL)e+Hg6$DQ;;ZP>8&>DsT4=&=t&fkEBG;LrSPcJ+^`C~l7^rz0_ALe{nzx~PNS8KC@_qdxc#(nnNVsk$oZTjt% zpDul?3;petZ|(1qba@@A^M$$iDfh-8b%16}b4mW}+IH54K(%HS55vek!LqVG7)BkC zTWb6J-sT!@ka1xr@hXih>t1)mON}^O&CgwEQ%boxGrVS?pXbdWBJk z)KySgq#G|9l3|yaOYfz zuaAWO9X3UzdH-u-=3C)8P%jB8Ay`p4NVbi@|Rbp=QaLnIL=Jz_7@qa$pREsL#> zFtL79r{?o?$oZt&f`!im4`?Ob=V=^zbcg((4#bWNs8>FyMayGqDPAinrLO%ov&db1 zUYpGF%}eUnO3Lx7izq3od`x*#z%%k>+e1=<4(H@$F<*i$nldnU{kKT0Nwz;v zbHtg8S2w2EoB~w6K=e35Bzf6O= z;GtuZx9K43y%}_mVf1!h60Il!q-gf9-)U)Gng8=Zg>rXJYRr7SOQ6<(_FY!=YM2%R zzM7K1X)f|H(a`ftX8bhD&zoW!`Fy4|DM@x0az@T32BQ3-%*2`tj_jnD4-S{$CyG37 z4H!rlEL@y3nQt6*`(QaVcw#MV)#-f0uH+q=jkEYq{w(dm)yv|(Y>ehrz7~H*F<$py zBo}+-$BoNc78WrCyOL)oZM`poc!&3C9calnvV&C>#h=nSZCrYTY{{*@0`=Vf=}MvS zPJU%jK^E)b)1xj*YX5^%wrNI&brEXrX>kSzZULWnSVHtv+b$Ss_FNq0x@V}$5nIna z9%xo%=W2-C%DYsVI1?uCU3=bida?bwgYhpfUbSq(#&X*qcfT}vP_vUkwCcD6H z477uJh^>x@CYH^cuv#Kvk;Mz!BjdqK z7?7Ka-Ulme9+G4OpMnzOP5q$=32G>$W8DG1IJ$05E;A`Z0V^MaY%cWODrm|tH;EAC zJoiuDe$?8ehY$mN+5(o#j)V@?vSZ@BpWcmNQ7WH0}i;}+cGj%H7ir_xg_ zPDJg!UnsgMZyDw^9pYDaNdYp$I2Uk&*b`OR$@_gmZSG5BxRXL{4~0>tLPjGyvXa`I zv_SJY{ML&z;EBhoEOq$VWy^fwoh-3+u`|XZneqU!*6zGfqJX0HchHi_Zbsp4}aA43EekV!BGWg1 zgM~~?#hUzeEfNq;8CW*qmqx-jsq}dClFKtoJrF2XPSHp^ChGM!p<2hdxu%5wbNR5vtzeMcMD)o5({|NiXi%m2t`ia-4)mXFdVtJ8i@ zvI0e~Hy`mYRFC16v6deJsqKah%TuG_L=tVe%*+S2`g+%y8edl zk8U$WjhwiR4e3y@y59uHz2yGXxt1+&`2Ne9sJMNEA3BdC08-cAPXE61cgR5KKH6k4$?dSnKWEimj19U^{(RGRWKC$W{+{@eCqpD zN@2$b{>z@9J9Zxa?C+QUlh!VR$M4_y-}~_7q4s<=POUhqk(#O>w!BI=@K2e%c9-Aq zK*~$OK%EaFl62;GRW%MTjH8TIPnOaBE`!CD$jg2CqH2-YVB)NC@$?pBN6sqrkY383 zqU1guRzAwOm}ZBoFKH~Y1!30(t9-U!dma0qD(x-j7hF5YF}r?(KDi?AjYAmo{7X^l zcD}NGFNn`sNl_G+Mhr^s%#?1y*y;7jA{R{8G=4Xz)TXJ~w8`Q=!SD9V=<&GI+tc*( z1wwSE`H&LXioOT9ygL2XPItzGOs|12Qp^xqeFnVYRYrek_vH2G{pGd>^g&i8)1S$E z#7OY==J^ZsG*-z8nV|X@XT1w2#)_R!+jWPMMDhpe3CJMFxmrbWNC;A;fNM|}oWfhW zQBqoc_}ba|djWh{D=GNIF5<%mZDe=EC4F8A{W)&{)@s@T2tR683uIk?Lw?;IHug(b zdCbcfTg{tnnR@vh^{~(p$4EyI0syqYC;&B^vLuWn|>fPo!P@xg+ll2X>RFc zFo*;BWX!jrapA(msxP%Tk7}d2!d2c#P(y={4w7SQ6Jn-2+hrRr)>ixpAmrC$y6v5} z^>ggoU&Xv(gh_5C1=Ufkrge~-5R-DYf;X_8cQ~?NtFbSWLGT>7(7^B=iynv+>R#(C z&K$FO7QS=DXEzWZ*vC_q!LO}-a0#xYovRriw}7vo;yfVrS>VgDx{sl(6C9bR@- z&xVIUQCd;^(h6bWm2ye#4Pm-26z^fXM|4eD^Kz1ny?JC*%=|^}Z@IS0ZZln|l^uaS zdBog$;=FsmS1V;^VzNNK1b^A@o7+iX-_ZY?0o|bW_|pd7Y8h&*X`fc3D)-#Ap0>)( z(va)y`26;4;SuYm`^`3;MuRf(7HJAk@xgzVew>zZqM}wGnt%V!=F=y29^^xrE*+od zlTHmNo+p--TVM|tP_5{0LRTGfUVa$!33p3BKT&(CG^L^wO)ng>WnzC;JeWSTYU{80 zQVUYg_FM45c<$mf#;w6E8{%d!#JzlL<(sxed3+hHvo>^rw>I=s=N0o$9jDgZ%J=bU zAA&;zBfqhpILzhr$@MLOfB5zGpFeoa5gQ4Z-$$%nd%Ni-;Mrep{yi}K`tS0fOYKw< z0%9K`o9?kmjaQ|2O5T^A;u|1IM%gm~!+_mV6$F{e>%4Q{mEWUi=IZ8oZ&o2j-#5Qk z=J@{H`LTK<{JS((VXX4PdFQDolWVHG;nz=(HX%OMN^1Y(nY=%(nsNyI?k;wRJbje& zeHij^_z4N%{+#;cl*5I3F*J1z#YtSvK--J?sfPZN2DLly(XhmI%A+?namw`6VH=5VI{-IFcM zAo}2Q;^ckou#-M-x&%XR5tCc13}V}AQ&eJD$Ii$a%zSf2OQL8fapxKp-zSu$F7?a| zS9-IGlX!l`nrHHvgM+DME$^4RW?p4GLfe&r3uF(XQy^9?Are=df{r#tBywHSFtYI^ z2w2KBuBOST{J{3rT|q;xeEeKrRgS6Wr5P8P{3)wlHep{J=2&EJSF?3%b~&Y?@8zp+ z(3caDiYVP(1BO1PTepVK-Tryy)mz>bzZyqB`otl@yUFjYi!a4QjGKBC9h*SJzk;@> zr$w>6nd-MK=f|$#vSw36?U$io@51}y>FNbJccDPAT3ol4Ek)I35f|@aM10D=Wx3zT z)?HO;qk~P^*`KK?L>1rgx0KbcDs7l@{VyAVw=X=7~*H;Ij1 zC|!7BJxnxmP{ku(#4CRZnnp9xo{vO)Y6j+*ym@iDbw*ARB>CCqNZu__1*?V+Df{>d zeTP|sT}H8b++6i@6(My#Cp-0V@=YZv7K=z(UR+Cr0YahJviIS!n$E98o9CRjIi52# zG`w=w9cy(-F9YPO__P*A4m5^~!z@9U?Q-ENwg*b>oRpALj}@?XX?`Gy?~QP&H)eZG zj+Gc(WsE0^THbzs{-A<4iDA|rtPyadv{h{Zt*~gJjL7d>o}PR+dDre?m^WFFq^i~B zl`YuM#mEPh{!VxYMSI;9K3*+*Y4SFO7(J6jnyAh(=YmaJ)G6BrDc*5l?~@&};S|5s z=H@eoMuPBXSlKva9LpI$yyxI?ElA4rXp#-yM0RY=DM!L|=Bx2ydd6N!ih5N(Gdo&$ z@0>wsTyE+Hcc({DEMxr~P2I?R^)}`ejUX@e7bR?>d7BG3i}8|oVHh>IMA}x|vnii- z9a*(=U=+LGhAMBeslmP#L2q%IZJO`KVzfbni4)FAN@4V4@YiJvupTqZMlC6^17?C!n9n-2bjzk& zqYe9BG|!~7vsg{IxdysU4^<`>)%ltyXM4a*1zii0l|e$VMk1uIL{G_xY_LJ86D>=H zq0`kWyU{fHV5GwGWe^5)7?*vRKOvA~&RI=66gOHU#k}beD)c)6*A5HKNrpXmPp!{0 z0^56PTCQ1k1o$f{xl(QgHq~i-p=WVX>cQ`Om0~EOJ}yI(Tg$0z|5wV(E!)cBhmQ*y z_z>H~tv2Z^r!{H#20Y2pgTHZ(*u@Uohgd)ruMWyzFI*F~^)#t@({AjYcfPYoXM}KY z9+=&v$V<>_e!}vu(;_jw@&-dBFjifbmdM(|f7e`^KF`2u+4A_!WbAA$y-L=hQ2{bu z`M6PaFIWAilGU3<_;>HOsmkxHJ|XU2z`gXq+m4xqXEU|*SG!9h?a1s4 z(^K@!mC#G-!%GVX@wk;bULv#EO=+b%3=?FF{L=>L#162>TjAM51|8Orp~1m+?P7ka zdPUicHOc@Jv9c#bB8AEi*)@a8CNm!p(TD}uQ$piFi12B-p;cV{k~dlVn?f${U_r4KMqXKOmG=y1)0%C|7zhu_CHD-jPOh9Hllm zcE3h9%KR|%r%1~@)!+~0Yyu|;rfiwQg}agEZyap`LbSl;!3Gn9V|G{d2_4bUL4%2R z=|ZzxrwP&Xo9B0dWnDAwu_?^uw}Ow>azLzgQ-$Uo3y>_!_)WHYmh^yoCe1#4DPux& z(;fV1)$FwDN1|paXmyHGkl->sz;KEX!mLl{_s^vxu;2eIPnDok;nc(!Yst33Ec4u= z98<*$=>q9y@=yp;v89>arL#a=};;Su|wS+0wy-g^365P zempP?kyGUAt|%$d809Uy51JV@5(xJsQQePa1GA1+ofFPGD=@)Sd4b7$iTfann9aIn z55YUR2}|1W25=5V*VAbjgL0~PtDCH$3I#Htmt*d^ugofou$9_45@%N)t4UXO^qC2qM`q~RT!2Mo_| zb<~Z|l!%*08qF@@)Oaf{#?&#k(0+U)OtN79Y7pcIh(y0sZcJo~U+f0{erR6w21@0> zlpkp$!rvaVciFY8jX$LFj1+qCH*FELBFealB$2Y;ICnk?k@?fA+{LZCR?M`s2~48< z@8W>M?=^(-)QH%SgMiZ^7Y||6vARRs?vf4KdZ2UYF4)B_k=T>TCWr`z zU-rS(t3l3=CtA#MI63C0W541mc}9EMuR+sS;Fq?NY{xJT%_dC$N2cmDJ9{|Yw(J2W zkJk7dAF!%cr*O`2_g*D zyP0Y%=a-Uf;i76*RUf^|hW4}saNwKg#5^3Blh%qV8D7PFC9C66or*ONe6w?R3zW%; znWO{be;5}VVSu2KH@D+8)(dErt#HNqBwwOd6{uI=AaYQT;<=m#ERLaW7MI4a>Mz@k zgEZXduuY6<{+2%et^*=FHa1o)jm|W7qz1$W zVx=q=s6)>12$XE(SmCLd139oE6cv1OtmB2W1&unRNuUab3V&E}?|E$|yd_L4(?cx% zaAV@aTeMvX!w?tuCc>$nca=b9yMmEpR7itx`{~h&LwyYAUHf;Oc+!Nb<6lKkqjzr!>B7xYgzKnM>=5mq~0#OS$dc<-l$vScN zil&(jI~_tD9i*RY?t6nr4yh#6TXO5XB41?- zIgW~ty_S3!3v=Nh7pXmi3#TYky9u!ie>UbU@3wEBsG~6j;nM<`X^2eiC|DBVJb$Jn zsaHdU3$+Spl(&_AgI^MkB#Li#l!&7z_PBP(%>7`tfNBY5|GYzg@w@M!otFijl!n&Jl9xf9yRF5$%CqbUqG&NzEtrW zFbnOCAI^E-f1!P34X_!BJlgcg*+Kp$hgIoaQDwi-RA;BTCSkxF(2JrB)>C6lQ;Mv0 zV%(wGFs*sV8o)DG`r+iSYpG~?tS;NC>hez6Us}-;K2Q`1oVmA{wH=*9uYN#JegoS7 zUp=&cF48nEHmKRdZ}`9V-NSc~7CNqOT0562x2yv#yc;i8C0Ziztr8c_!<5?2xy>Jr z{)!LiebR0>w<$053km<7y~A71whtIg;h%u)!Bl(x*dx=&E>}0PZs4u#v5yf^tc1Pv zXE3jlR7UbWPxq)es)?9mL+jBUC{l*BXg3JIww_%3^wF(k-87{^1zV^ zsSc`rp|j!%F2>QPU7j9LO@FHIe_WUM*<@x#Nt1$dpzr;F``ncopr*;XCaMonsP&+F zXDulcljT~&6qm*RcQ)lI!Ewxr?&+*7csJpP8`N(j^C0q}T=B&IR8|4i?s)4ONO zXh)7tyRdT-d0LkzpclGYJ`_gIor+NQL~govZO)>J&|F_pgWMV$XWfC1s^LES9#K4x z7#f)Lc)hYcaE*WwNAf3W%3qbp*pe#RLPG$?De$m&-=r2LZdGKY{$T1`e5?SX$f!KHn~H*fy}V;@{1o1@Tfo z$B5?$wm~Z_!4=acX?%`MFvL(gLK^(qbINGYgE#JQ;wH^_@4R;+A} z<~CD~4H74N>lGAJnPn5aJ|Ie1l9@~X480|7i})^|8Md~$k$oqC6h_P3IvcLbiH&2L zD-C!@wj;FiDEnnVH7R|_0gLvGQaS{#qtW9RhqXX9S=*Tho$buCP#d{zHr`{Y`$ioJ zF+rF*yIfGy3ODmn_L#)Bu5e(-fup?re?VJDqtXg7udCWh(mk{vspWsgw1~B5htKrh z^@vK|SfCG$4K=NGv|Z7h^HPe)3#Qhdh>C8`aOC$d-F~mdSZQdy_u1w(5*4W92GIJ#CzD2Ic~y(QQrE`zZ~S0Vi$7NCZ-cItz`nOw z1A_iPymS-f10XcpO{+>#yUHo1yA6%bo%##=<8}MKtF3)RzxZeq-8Hw<(ZQj{ef}Fm z24E3Dixlwbzv->{ri*dexdWz6o365&OSx~1jNDPzI@{yOcJZ&Dx#{w&?68VNG|LBa z_$^I2U%2u-ZQYaoLC53%$?H$kNJgQtJ%a6q?$5>JhjBnAn_SXs) z@&i^FR>PP~@&55e%g19C*_|;Z!yX})O&0a)9`Z4V2z+reELkm|t_ILHvUwu~GcGP4 zow~4Ijq5!Rm{!)NM;3rNm*sYnUP5kf%O1EGhgn)?dO|443`A9Is=$ERpYYpe8+`Yw5 z*4|N|x^$r`)LsP$WdD-?wm=nrYS}Z-P2iW^9 zl$PXk_O#NcY2}QBEBer4{!j(;z;DZazY}m#jt+UcFP{IkcbN;pWM^?bzg2N?+r-@d z=L7wB`{$Mso$f?#sL6?1DeGeFPZg@v@wOz%cb6`?*&E}I`-QMn!IFuf5M~&czl;LQ zP$Z5%eK1VRA0|O6>N6i1Ywk`wZ5~~j-buzde-Pz{3!eaPBgT6K$K~oC4QK1u*<&5e z^H1^r3;=Wy1Q9~?o{_hb5@pe@m+5vFhF3z*3QwTsQ4$2A>#O9sX^YY*LGRmwe57Vn z*rRVk$!Tu<1ObWfyt_D(2!mBwVt9(md%X!V~HoQ62c#zY6t6^ zwAqWPzxc;)ybO3<6_2(Hwc-@kT<)z?BA5kBcOvqz+O^!|d?R=Ny7Ud9?+tpvH|E9)$W4* zyI9J%S9S%x?LS`YZ|u?xtzl0yQ}lD+8t~trsCEw_if0Ph%wxUBrJrLZg?w#bLRS=a zRvd&yl_}VbG*-Si03sHINv*OHyxPCxt5+JI9_yW&xs$CpA+^fw_Coq$ecIo@&bYXH z>h#RcYH9qr?1aGhTLx!g6*Jj$N7rXn4_MbD!t z>MoAlJ#|0jTIiGe03868$`%M8S{eGFB>^j5TdAbm>qu4Z$#m1}rBE_b{xJ5OCkmKy zhXuKftS>#*dwck>uUPQVXsYG)e$WG&2g`U2paxjcw-^yI{u+ubL>o`fcp;h6{Tx}| zjR?VqP&RHv{pi`G*3DPq^{<*$=br8+t!;9holZB+KaBqe&rhCUG)B&%0CGv(#u6QSrH=5u++!ai zSEEbJ2J@yLLf^Nnf3>}LGhCb{dv%?|DVFz$6^SG81LU(&trrk5l}UkQcqfroV- znj8Xn_(ip}mV%KoZl69;b&%6YX4Cs-eiOlEKm`9qIYcMyfjOtfgQ-qgGhXC_SqaWF z;&ZB6!}S#-Sk39|!vj+dezJJ7(UeVKb^xrIG?b?f8txB38;aUxa3Uke>hE$nvUut31WIuAEzy#70tzIkJ&S4vu6 z>4OOLN&t2?w@j7Nyc`*2@wWneVLmM{vtI9qoNWYbsT5Gv>!rM36m~xN=&S21`lHGB z&>5)a7&f-3+NIf@QwrsWoVZU|tKF^@Zd{D9^(h)9zoYj3>#htRtbqTlgu5X)Ze!0o z^we+mxlh2poe@l3XPR+O-iPs0=n-GBB+`-Ky0=s~X0_5xrU4HCon|-O&VS+3yx&(G z0+Y=Y9=x4-4nmF%Tr>L*mfQ30JAehO!^Tp=Oym(lDetkOYKU+Nm~*oQV9ah-DHO7M zDt(w!sR*&pTwC#F6-tK`P}CPwH!pxX_QtdrO(~2lKabhHmH@5vOggQ;d&;sLbg;xy zZH+LqwKGqyY+*uBQ5%2m)YdqAe~}7J3HKR4ZdCjAyJy&ko zP>H|xuPsT^SL(x%G6?bF~uC*Z8jf|STl|Ho;YW6wv+A-E~X5&S%gh;T#p z6#X49(zZE`)F<(=Nm6f$s&)ngQ;xIx@UQl@FRM7T8oT7B&spbu_?K05hbQ)D={fF%;r!}j@j`vHs9jjed z6t+wzHA{W9CAULj-y!K5#H%G+q)z|c5%tqGa$Nq7lgk6q5@4r z{K6@gVnpHZL^A99-AS#u!W3swIN%nAn^lin3$ein9Sv z5XEfan&IVrj6vs=Hb`Py?qK_yeP)p>!<^O!Qn4hGdYxxa2_McG80LL^k(RXyTa=oBC9JzT9+)utx4`DbV*x2Z2&B9yjJosN){ z#~|4W&SIjxKRjrd$#ns%BG4j4?zh;P9Aee-IfzN)U|uBhH!lugBkiK{!YX2_xMzmj zh=auzr*`$ssFe!~!w1Pue&eYU24nZibi5<=Bk0j4JkSQnO^tXyoVSeMPMTMqur(uQ z%-HsPT)qetFgZ1@V()<^FMd4`Z9n+fcrvcT=aAACB#-OKneyWbTfwui+VHF4W)scXKE}DEo-mFYtmtm z`Ch_z2AkFkJQhvqw6m*qjhYKLmVa8gch#sWD=X{U%5o=tdl%IfYeXD=Itf?N({p|% zml{+(uT-#uKXC2Sa&xUDrIw7ZQR4aipRxA-p~O!o@0>CLD2Hkz0ats6<%-^?4-Mqt zR|eIi8I_-9DpICql+kgF*-?4ltZJ@9)mT`2KgG)TNcdvBF0}Zn-U!ed*M75;!%Zyl z9VEmmUR-rbl#}fjT4o6~U+6(av-x!lVh>eNYF^3%Qm6HH2-7r#XI$8~FjW9JXm378 zGCc?hA1u)+D*!cNJMI_hL#IL$mcM|&PuD(xz2gKXjc0f|O3yL*I8ik*>&7=;fwiIZ zuLlf6OjeB5Pw~g9MaNjt9;a&EN|)HDjn(h2h8sKG?DkQa;+IUr=~02br>;|4W~%(= z8gb&rpy5>~Suce4SY)<+KPoCYAZ<#@Wj_pAO|ceEJIQRZWe?F41u(j1enE{yjN5IS zY7gZNb0O*O@HmyNe-QmWdcW@xLubi>g?-MmoT^2}J8oWYnJV#!`ttbjd3WW5LRvjV zyCk$$n+*04ygm55!3LbpzFVZZ{y5lB;>edcl5jTJ15cN3t~j4?w?^#K>v~8GMV)7K zduG3c_KJ%RRjBHkQ-cKg2c(>ns+fty-BY1Y5{qEj#;$1l3E(^eBUCySc-Kl*+cdAh zR-6E9gQu^T9Un-1gSyWOG^P0EY&e=wT0oel5VLY_48`A(&`(y4Efzp(_5AE7*vMr3 z+}!H0CukUFWFG|oI{*YQk9At;p3SSmoSIHmH^Q?$jwVVmv_ieYbDyU=0l}JQA zht@$TGmtNDE+B*f5fgAa_AZ)Guc6eI2Ac*#b%A0=)&$EotT?ayrCVgDg3g2|6JnCR zRkiIe2D2LDRVnqCs`ER22C`$|{R2I3DEUOw_B*|!Ep4k#>Sa&Oa)tt0uNG|&>cUZ0 zZ6kIY@Jl`pV6aIojz2WE4fxUDUMBg~`WJG#huTC<+&zRyiNbd%kCtsnu|5xDl*((e z!4q^7)s?dfMSN5!O7Y$W9HbJ)s)e)fBl`D)eorh|lN0am5f9w#uU20Q#Y&IejGCDI zI`?ehllwpyr~A%o%1q0}I?B<$rWxmRA#abd`cr2%_GQ)>mL79FAt$Y zbtAbII-Lotx&;YLCOvhl4kl2}TWpL%TlN=>xjhWFyk!?us|S;E;(JH)ykLyV^N(#A z!%;>sP|vf--7xQHEeN_#S<%o}GI`0d%pC#OZa4P{6b~W5xq8sz*p!+qrhAiN1?Og$ zg^oUFY35)hlJ4gY`b^)_qKQ4oE^7@p7g+}ts0fv4o_hURm1;^-5MEH6G$*-S)q=bVF7*Tx(gKZZC&xJa)? zYC+`7y48_5!%~BQLVmY5-msz&Qry8<2(!kJ;%AGb{vq=C!*^~B)i%KU{Ay5-3c82= zsqpb%53;#6<+SV8G}7^qQKz@MmQ9!16jj+-90%N1@EyfS%b|vNm3gmNcZx*pVMo-? zk%Gq52iS}Ho{0Ja!)kwj4#I$=5JMC9P};g0JnTJe?Yo1iI}2Z(J>>mb=dSQwNF^Li zwHr`;?TgQ#X6I!4j;s_CMKO|cXjfM`&_gA9tp2ug__?rT61RwgMPqgB^exu{L4~^5xPbk6 zB!E)+7Xk^dzQw)YivFZn;Zrc?V5Lw8`CW`QMx_U}Y=s|dRrupsEJ!V=7XDpnNdL1n zP9X>vYolz_#7adAQo(q18h&&KrtV;JU8Jp)l`K9cg?I?hV22^}%giYB)T(?+o1A%P z!F05V?P7rnPxpOHJz(Q3qMtcp(F9*|)2BxT!TS>^Vf~4Ls*#q9FKoFf{n}%-@SW(u zM5ijhf#C56Q5}aCrhUYmBau!WJ1q;~!6bl*kwFFlC=oTYASeJ)8-+V!XeM~LIIN&? zA*8|VeUV$i=?~)3ZGo1C2o)o-3T{G0?9K-TWNYVV$>?8)hdiW26$~!5z%9aeig(9o zOCew}qPG7!?CQYSlKNPoryz2xICq7LW!qMnpu$wCHPXmK;|?=;c%(xkmbWK{R2Q_fn{2Y$8)}C^#Z2RaPapV-8_--` zeQ!A#Ef!7?i9%N1okqdog))>Iou&34XPX`X++lS@xJH|$C0Jy~H`Rljqs1;%xW|`w7l@|}4ncLlnv&m&gOji^Ix)MU@`Tc*Z zG6|_J%A(5Bx`DQopvr7UC8vNs&?#Kf;s}S#Z-UJX#hiN;J$9xHif_n)igr#*bdW(` zFj1oX%CN9gwL=@3rAP{n@OOP+4utC%u4$T>IH^|b0qr~`lmcf%)}CyK&re&&#zExQ zAG1(e9GP@T=X&P#EG9(jwq+W^WCQ`xCg=N-PT7*~^-Xe*-O1RCsxW9S>h!5WdCj_$ zvaQqgJOMv7;ZP2A0Eq<_O(`+fr{wOsP}XVz8fh2Q?IozB7G#MnnryE2aAKm{!>wpj z)-=Fh5ex}?dUzu#q0fEIo1(0*3U3b6LqkS&)w;!vQ9w`VlvTw51o5aS^A1Jx#BB9R zhDCh}i7LiY)bKB?;RBQ0)ER`Jilswk!)@CefFO{AjE-?SU)J+O_5W>HU6 zORbyyI~1bJ)zuxweM@khRe3@~I98jict{!Oaz#}lQD3v;Ee`t=gT^Kf-bsZ?U)rV4 z5^@c5PAg00F)Erb;9fTZ6@cTBs?{_0wD*rik}_$`BLHXf>0D=X5zAzk2djLlqiXS={M7KnP{ zx!!?2KTc*}j8pBl>&`BXw|0T0ArR+k3c7PbhnKnjr^II% z-7n$`Jh6$A`__IWwI8Cp-l?~5xH3CP++Ny@uF0J4P(US5jce z?@{g4B{KYPK6N2JjTDb+c()%0j(A6UBiq*t^mV1b$(Ge#>j;f%AMV)V%=G_i{bCu@ zNe?Q}iM{MBy=O)w;go%iQZ@?$3uJ*{#Vx{3 z@R_&l%ljrz>-Q=8PJSIu+RKE8oVMG<3e!JSVSX#;3qT^-_pBe92!7A){cES9Nkd6k zP7))ta%QHwZK~g)@X*3OR0YufX@`FL+MQ%bG58CMF+9`lk!)Da!GVW4OO;mTlrkWu z^*`rchDSiGn`}xRs2;UEDBNB>n%oPG0^iZ&C8id4u)i!VFQDGkzF%DE4|JZLF)n=C z?G;3SzU=35^M>2>tzmw)StQ=-l3hB<^LlqBo*h6R0q#LJ;j|4A*x{(HjLMO|nX@fd z{acqTjBwG6GFu-@RMg{;&1#KtxKB&Z$dVOi_jI6`5N?+MQmc`ZJc%qdihA18S_i=zfS z5px>tWCOROWxZ^=G=Fo6O?Q>Z3$$J4bvwXSqH-vSUEV?(XWyBxP>6IbJ#Wqt*?>_y z)q}6IIR2-Av&J-4i%~pKp=P_(QX&bybpqx{=0n4f=~>yyp|)NOfI`GvWJ-{=PJk5D54Bn+>j zXsD6WL}?N@o}BW|%;^mF&8Tc;$V|gU6q?rC_H5w4>xSL>1|fW_+!3a+V;qk!kSqac zN{-tF2modG&0udkbxLnuo4w9bT=r`}XK^VIfG!Ky&|cY%4|t&h0Eqzrk;rB?WhXKZ z)*Y6VbJ+hF%NKVKmb^=m)0&Iie!-=OuA~OtthMwO@7u$={htaG7H$Aan1Jqc!Iq{J zxC-_+*3haFOAWic$PbWfg%1F_-%%Kv-alN9o@%coWc^W{7NNJG#@40$H@sI5s`B&mDlF-KGqDD|tTn+nHUk$B zFx86mjw*0s_z8|T0AZ82Yc;xAz}Gk-7VOUj(EC(>PeD=Wb98-QXIP`V=7abC1^HS=u5P6Mn` zUX@faaU3>^^TIFQDq+u5&d)XSCsy;v6qZL;{g)n_|1Le69#5m@YcOb_N#6v(JHSv! z0QW{@n89c@;6h*QN*ys~>44PC>))va0T3m4VDr5$?{5~VAM`CudbX!&t;Vnp!%n#T zH$D8k=b_w&fF)PQ0!q0K#BblZR%HZ0R8G4>c>2Fvo5TOw+FY8yl%lKDBU{&3te=58 zi+4^ZjMc28orPqVW*R;710Vu@`y4e9z1ElELP*R>yz&TF4(|)(;&s z$ZYNg^7tgTBdi+l$w^?-HLVR!9{aYB?D(y)_HR`c{PoXi2SdJ2`&trdOQobv9W2EA zPbJ}|li*k^B0jg1I-zcsn?U1< z%nSgEqGT?_0CZFs&T&RHE?ass;`<7wT7_w*AyJ^iB5;8 zLcjCDEcKYyX>p7xoJL+k-xN^ansRqfKSS!$SCUj^z7{`#7q^374u4Ti1sX)@f0us$|DT)v13z+X zWU}C8J>`po6dK&uePULqO}>S5_v=2t?jv;545t6ZQsG@?_m13 zvWx%Ie)WIaul}vuuRgfwAK;MdLQ!tWKZn3|6EV(wN6Jnhlg1MfqAs5 z=Czv~amTP96>j)f+TzRYyk{?Z-=%bH5pVie+SiRvQf)=k+8vfnS6!GjZ3|v&|ApC! zt1i=r0u0?y%GC$5Wf2p&4iiYdtDJ9*_1u3Y=aL4T2iOM7F zWxhaQ_NVIT3!-y>q6#gDwgob}|L#=&R(SI#-Kl_`Wq{q)X^RDcv+OUw2VtF!tx*!+; z1mnI7BQ1KveI4JtVJ_;8GC4s>Ku#?PpyoUH8o})*9L43*4mixqN8XdOk1T(lmzGCO z0XXe9>V6I8k>vt)hfQ}SbyftcXdIjA%Sml)NbTh1Lbw&Q`Gj*EYjK`L*PL0BRvwhD zy)bOqsh$A=su{#t_DZHMGS~LIlX}wNS{@LokW2>xFeYwcFd| zdp(hC0hEh^v@l7KRXt1a#XVaIYMZJvpA5=^XwYV?n;nEWk@it9MY<(vLb0N+xq2EG zr{1=npxR=2*P5WrHlT3CnKI`DfR6a~ghtw`L1hxoL^^&>99 zzwBW^U>t!(V!!VXrH2j#eF3b!s=CiUHQOfcaXgy@Ge6L#BjycHFUD*)wOs5p zwtMJWNratWkyqN47xA&LE*ko<&Nt(p)XA-y4E=C7$X7Fy4Vp;Qr&}U;H?FLpxGn9i z?W+lJ5%6WGa}T~$h$sC#UP|^w3lsLrHrZ2lZ|V=Oufzyx%kNYA5u{0*;^?glWfmIQ z{g1O0V{j}~C2>M;1jj-j#%dQj=|`-&7FY;t$auh6dTU`Ta(Im;G=Db zkm5`mZ+HClCWz7C$9t){i(~zEJ)6G8Sm%Sp`9`Hby*ufo3$p|O%u6$N?}l#YoM#7C&Ao*inA$mul=DXTmzWDSza+ywl|?eXdF$V87Mi= zm!ivpqxvP8@UE+4RleTz^4!MdvX$w(;#!-HG@}QcK?AVLzp9aNFVaC>}qOOcYhLE$c}?{%vqL&%_EIcNDuS zJ2kCi!-cw&7lU2_RP4d3bZQQ6l9f=o6r8zd6cHP}h&S{>YslwR$C@puX$>{2bM^$9 zAysn%ZFcQHm*ohzdw4w{1jC=-`=Z&1T;!TzNmGW;E|%io7G{Tli5hIcIs zZ#Wpgs6&~Gt)5o0iU{cDyD#` z9wi=1u$MYYMqm-;^5;e{AN$uo85JfFl!=0@7zbZfgOh&UMh&YMr44GcQ{OSMv}&^%asEWwrShOMek5DAo&Ae(mWk-&3vkV&_^p!ON%P} z^lxf%ATVTy0`+K_c_GEjyF|Fy-#qAg2F7$(rqA!}kG5RSuvrl|W%^qFzXTC72&W-;?I+3GBK+Udtn_J{xcd=&{IHVY-({W8f znYWC6Nvf*}AX6P4Gk zQm|po6g#Vd>xCWS!%oxWkIW@)qb%*h7??CfG8R@}t05~% zrkTX39>}~apJ}>HBZUTD0RgCEam zzpLM_r*{ZArk4-#c-yccLqDp6S9mEJ20JD@$1vd`H*IV@sCzvY)<&W;j%@MB(0Rq- zx=i8$65y}7#lR+c?nc-RN`u+xYH_>vaTV@AuJ z2dtKkUBEbrBJxlZP>PvlVPC6$Y(qw747)PUlejGWg3bp`*U=%1D8xmrSEIV%D_6QA zinlRkqSNEucc*QmoJMM2X1K&H1!P|W7uwwj3S zdt7ve^UU?}REMsTw#TY2bwTm|2wM;Qrf%GIv0{kX&&ov6d|`gcD`JP2=kWa$*e%7q zhl|y$)ACI3?V-hhve{MCMLX2Ox4#`VWE6GNzN&V(X2M%>poQXpBTV70C1CvUdOUwp zr5`V17h)zAQw>^CcV?JL-bh>tjy@%O7}+Mmq!t@u;#c+X+7-hb4{&!&e{S^pW~!2d zr7yz!n#-a*zfA2d+1_lqi=C*l)<2WkPsgihRkGapk{urQ+lX1$Xi@39-RTbMjs%bK z2qr$)X~8{HFq;(`{xCH1rT^tMV)-*e+x`p+Bzd7Gxc_k+_(6%5(P*9LE{tS-O79SWIZ3Anvrjh&mP?)&c%7iqkxOOYG9*%wX$^BA;MfCI~D{g|&b0V9EYH zT-l2u#n<%8hmz+L>|&w)Geugb1^Y(_E5i5^dho{=*gvWqP;`&l!)G&-de&UwY#5=6 zWZN7SY0_B{j97b5&Q2@Y`?6TF;+P~CT7MGvZYp?0BCJ^5Hq41((=WX_6$=0VLkmb+yJX4Hgu2G6?BQkg^Fd$crSc0%?c8H z8G-O3^`#p&xv)DNlA9eLjrgHy{w*m*EQ9Qc$sSZ??nv8^GYj(SrC(h=6r*%0_(@V$ zG40h;rBbJ`ikgaZ?ty?n8grbAJ(_mSH++4HRY0|4!Jx9D)~wh zmolxW`Rdtfa;E2s&#+?-KJi<;W9Rx7aXbl_y#)UDRXHMOSZ12)aPg@GW=iy zk{9S4{DYCR+{HH!j6^S-c}j^%SoX8H{S=IuOv#`TF!oys{8;Dai*nS9-iJOw{17d;J)G;Ds7fiP)gs&UfPT>l;>fh8!3S&j8b2`f&uO0 zPw%=ab9dstU);-9V)s%8BZE{F&+`a4m9m3<6qkv<s+#{5b~zbitoYsKkNeuAq$`3>f!WEbdRKCT*-;?8@tNN$h`Cjt&&EMWm4(78li_ z`O}+|c*}$PMlY_fZw{?^&Nu+|D?6PlECZO_?ZwEb(c@R9Yq}`?5emowcsT`N1)y|k zvqwfR|GCUMtq|*LsowBt;^Xi=)R>W!SnPJy@N@+IEB+yar&QlngoJ6zN6G0VBDb4u z$U>EXraFuE-L81-zad!gtN>pl(8 za|kQpumkk!nPo_(Dnel6=^#oT;z9_6CaLqQhro_YHJjz(pcq zNLv!crHNDmXLNISxuAbqTQRw?iqKdUzHFH3{V3yx^qy>Q@N=bnO)vROe)$6n%UDHWHuJ5XLYe_kP_p|=k(S@ z#J{B8;*axREBqQ?NLwiMZpzVwIH}|(<;rU8%az*1%F(Gy%8^P&7@stj6CgsoF7qER z_B6)CFF!40rC=cxRJPpc57@2JV_kIYn0Q)bbNxuPRNkxV zJwxV?PI-wju8fisIZ{Q)L|H>NDv8c91pwc99xLZw3NmEqvMP zV~wU~*X9~pfAI`?U^R>%&fTDKy3INfHFTMl$G8zxt2}H_B6FK}uk^dww~j?M(_VH2 z87dhBI|j;jIjjfRkii;~+{ngxcTT3|xi=)4E;SyVkF=~F`eSzF(a(Wxs0Q9PjdfFW zkycVf-0@eS$x+9YW(qQ`F}c&`RVH<>?w4!NTWS8k+G*>XXbwz0{$7KPy#pwT9qPZc zt)DX^?_B{VfdVK^e&$g=)2Om%0L}4d%g}aq7xPO*<9hfVyI*^s?*6u&mKH z7|=V&xyGC{tG1LEydLbZUW$fi0+5lwk`mz}i4TrMY6A8e^Y5MY^n1+EcU9kesUe6~ zke=2vg4m2*HQjq73pf`*>7Scrj`#Yl9^k!7;lMcjz|B&>T9Ya0=lZ-Oi@y8ScRqrj zpLLbn1;%Pn>{~qmV+MDcP0{#m2FUI8M=pTJTe^3y%zxs=Je@y~O)*>pjQywf+q`)J zzw|BrqkK-^ZixO}`z^lt@7Ztjj?VJ^fN?ku>N^1W)Yi z=gqFFmm7%H8edjkSy2qeDW-GQUOQ_I&T9c@hzmkwY{Q)8_;$4nHh@&Z_EE+M7a4sb zm?_ax*^M&rp(?!jHKWY%n-N}$mw5)o#stxU+i=2bw>CE)XD|kDX?$1Z2@7Qa6;crO zy4a`?#g!B4v9G@{B2mV%BVTxsPod|>&YlVza@^~8xzaxb+eo+WL;9zF>mTo0Sbb z4Pfy({}0SF#|mS9DFzQVs`=(W3jL*6MrK(HTlw4cfFD?vC=zqypj#LU7Z3% z%S9X}XW2pmk4w z#B_g#;zGTmUlCL@qq}4y(FV$+Le=IPhf9}GqCq=yiQA(Liu5rhyJD;xU#Q}w$9I-` ze5S^=ae`T<%Kctp;qm^$-CW_KPO`F@TrOph6_Lv3h$%xsq-q+!mVK+f^2AG%Yfsn- zZmUVGCYXFeU=NI_$pA3*LF_LJ*r9JhLqcSN{h|69)wotp&mE&`5ovPrB0jXyj($=C zt#;W|b18G>I65vb_dfbDHZs!9fa~1EtKv16PQ+KFYBxeYk5ANfhupPSKd+8J5cQLI zUQiVaQ^`}s(^r^7C+{CF^Rjm}9%nWu(bq2ClzlCZ{KMEcvG4J9$ESyMpR&gb+jH{a z{Bl~Flh~xh4Oz)7t!O{VJ(Dp~A)S)Jscff;b5B3@;-Bh|B4^h>8WkRQsgz26Te&8d zx-4=Ggh{DT`D#Z6_e_ap$TNDYpIFKUHCq4QHFM_80|BXhARq;w87u^;rwZst4drE3 zR{_prEdA2r$1c_MOEM@!eX$Cg?ZZ=exzuE1_LbwJ7LxfBXmtX)zU!xs37b;m&7KW6j~B8qCi735GrV#4%EQ zqU|C!6!~Bevva&O1;Kl0`OG(b5#=DDCc3Iw(xph6qZY@DxMqiWt>3RYO?u=*wuluI3Gk(VST6@rYIk6Z#H=U3aXu zNf#_7;rxLhY_x3y*EtVbp}uHS-yoaI?V_Kv@IhHX$ndcL{YctFnl%;uh((GDrakeZ z-mq@)`p5-AP1t6=BHpk4!o=%a$Z7FDJKLD9lo4xZ-`>+5Y5t#Q7IKlMT=qkPGv!>? z>1-5r3z?B#;vzh9`=PKk-h|4TS=N{C<_Dg;^M2a!RD>fwUR>fwWB9i9=UqB>HFr>QOu2*qp`)N_Ayf7q)nAhNXdwNt@suyWm3|F zs>^jC1bZT0V0~l7CtIb~mF=)H*Lo?tAzR#1KcfIS25BB`!Y&-&0u@SNkuMC}7);fd zBYW7UGGCA4ppafnMLUtot+6)+!}T2fILLo_XfBp4_u|CRA}i%06KpKi&-mBp-JhSr$SBkkPP#W zjya4uTJ6NKC~WDI*6)s66HCO(<9cWvy*>dySWY^fR3R4!B9{0sziL|B%7~2Xxm}H! zQ9W-J#rm@t7A?X3;Q2Yc}ob^J@im8+6aL+zABnjQPRJ753tP>SRH(@d_?uu4&zs2B>}lS>3+MLf*v4GVJ{|W_=y<*CP_nU4TKjyB z7w+u$4)9=)KOE^`w{|aCMCSfy^2W23^V;i}KFnB>bw;ud{kLG3h zF0=JNyZBcHdVb^Ce-|=JPS3ab-Gkg3xVDC1KO1)VZ`9@A7s2mE)6yUF!Mas_c_94cQlGhlF#JEH=pgaq!Cf+&dxvBLBo?Qe6qKYH*ci~E%J z%uRU?LY^aNw;eBXc%7JVo&X-U_}#;XE@V%}(x+lO@mvK*Fc@QiCSbdNojv}rU&skR zu8byYYYln|dhO?j26guHt9`COhIDwn%lH9UjlE8wwSG_=fmwU7qYHL1#tH-XO z?ce@C!03F#j@fT~_*MC``va@q7U)_0O~_|&ihd|Mzq$JDSI(c^rgLQOp0-~tHGcb* ztc*|p$?XH+lfmjX`qm9!_ppt3Ab&L5p-2N^x7jLX+3!EDzc2MBFf=R{e(hFHv7Y(;T6S`0No%&&`3fwkL;74Zh%T)X ze_CL5d3}PzE7EB$_UjbcIqp(seg3bDUQ1~`XqKUG4mGnu z5QjS=xX07|X;Bfl2g;NWHnob{q-(7F7WP5<9*pLqI!(P|px-VL`rZsc)P5dcs{g^v z>idP9B?&MmQG+?Nm8`5}(t+y{bv@2sd~B|pn{NJO=ZKq3rNDz)?^4$0Ej)vEt)J)! z=e*y1^a5j}X|;MW8u=)_J53_awYqenExYuLaiCjSvgM_7vmM9qx;ENr7J;OM(-s9~ z_x13pQfHQlDGN;o83x~Uv!)TKmc+DV-Gd1$3|4ps->f^iXK}pv=`~%<0=5+^K0s2M&x@H81>$lmd+Z*D9;E?sA) zMR*?nqqE!C2)Bp~&8RrA{knTsc`<9C-6a+JobbhLk9K8CIeAa4hf5khjV771epNhw z6>{A&WK9=49>rT-*L>AeE@$^L_BVx>G zCoW4Z!Mo$l+{J@_*UUyRY?mI)4M1S#7J+i3%dHDEvk`Q_zplvnPygSS8nBWrkc$N~ aS~}lD9+Q5!->+FZckgg@EZKJSyZ-?v?>PAY From 1968c0319cdd7baada08c0b641149eb181bf7f5f Mon Sep 17 00:00:00 2001 From: LizRoss Date: Mon, 13 Jun 2016 09:52:39 -0700 Subject: [PATCH 11/69] Updated to add a border to the image --- .../images/intune-optional-settings.png | Bin 34263 -> 34325 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/keep-secure/images/intune-optional-settings.png b/windows/keep-secure/images/intune-optional-settings.png index ab992ce3c883caa68d2fc5570f56757315f30ac1..2d2bf90bb1d3aea7337cd8a02e73b050b5e93f82 100644 GIT binary patch literal 34325 zcmdSB2UwF?w?FEP4mOZ+P(kWA4x%7U1f+#eEQ|$FkX|B&9;%TJi4GzvB`Uo}L_lhU z5JC+CLTDjULqaIhA%O@X1QHT%fYF(A&UgOz-2Zd$eeU&n1mEP{d#}CMUTghU^ZD&t zhC&C#5A52tOX%7kmrZu<+FiM8*AIRB1o)r){PKw@|JNRui$)iB?J9*I+;I4b|GeMl z4=c#7U56UC{{C?E^z}#l55*o{v3zLi?ffvn;epdG9|t$Dhe}>f4}U$cq@twdp$5IR zYga_vwaXXp2HG#w!9K|L`;Fc(d;Nj|FukRVP?mUw*83T^~?PaKRyG$jdrxM6dSsCt?9|L z&POT+r~i0U>Om_N6FA|^Va_jx1uyi2S#yiMGdD*e07QXuU6*wYYoxA*pvBDqsM*HH zop|!I!M?2@;5Siaq6FC9Zy%5`jbp$4^`-Se2cN?`uk9<2P^sJ=!2dB|AZGi0{0Tv& zzh22g|12Q-*F2xC_k~COwS=o;`7hxdiy3=T2u{a)kfXENu~}vzG-wf0zqX0>qu&7X z=0`Mv?A1(7fp1gc&8K9NTzr~eV(FUR((WDyxug1wP1>;Uj9thmBb7+w7S}T|tI#hm zJa2wq|Br-7+eHxyk&E0M>KxO(TLTzdpEzrSy&EzBg1O321~8^dndn{W%^bb z`)sz1u1Tmt=Fv+>$WgovWx|!G7M&#+;qTO#O&w3-?9mkK&01z(7QIDhM--3OhOX43 zXFlK8_9Y^Zg4wwefa!tmwcy^II^r81v-`5iK0CFK2GcCCJ*-F&&IkWNV{Cn}=h z%GP}3(Sk)G3)UV?lvP6N2oBtPZF2!+CNqN1rovyf?~*q-j#3P=Zv~^$rL?dIY*X)VupcdJI`+I_%qKu z2$;HwQ;0nQHjjKCb;j#`^_PsYEURh!!=B2!)Uwt%${7jDy^36SEXTE8jAD|nuX|0b z$F?cfo5s8U*PU6#OhQ$N^O<9ZUJ+et3epySLQJ2v5&bmwl>FnwEz+10BY&*`T`%aR z#1b~{dHQgW^YA|oKEE|M*i&~dj16dzT0UYdkxepI!pA(|ns#1ajCtr6=lO1?XEyJ3 zof};v6R9!r`rPA@THQ+%$0-`U5}mISlPfC1E|Wc;R1^y+Sj-QaEXP*4Wya?p(2o!@ z0o!(A67@=2e#ZP& zU6tIv-RlL5Z3EQ(Uck7M2RNa3CHDI57WaBdO&h=GIN>|_lqmjs8kbbHz?3 zGJt|&b`A}pS7VjYfQGws6^q&dF9Q?<4?t2dJO?kPZabPG0x zG%0brK70YLVqfyk*O&cAis`EWwM8`Rfe{Ln0I*=Nj1*`J^Ddd!)#0+qDbt|_LoFA& zv?I|gT~)1_sLvzR>>#0d2rZFV)2qfs<)=pXKx_l zN}S6{UG;~ii?3MgvC~+44Q|!h!UKgQs)D%Y%Y;aM*tP~cA3F(9B(n7y7D9H=M#ka<%j43vWj`tPX%P zuZiRcR%48NH=4_s(^Y3UH>C`NmE4ZvhQA2^GL6@JPbx`8Wdj&R{dM&#GJrkm#NH5N zGUY4!J)|jCYMV*;I0|@&Ny}^xQ(~Hb@jKr>fiwBJ>mvP{rC8M^uUt-SQcrSAbBU2? z_)!0zXEfUzpmUpIoYTn}t?vrZ1M9h}@`O=G!9_`?sxio3?(KB&JEB)|H7g0AiKZ=u z(66OYd%W|fZKGJ%BAHjWRa4XNEVn9i{;dF?bPwqnqVF&9{y5#1TA3m*a-Ma~v7~(e z`{?IYrA+?f(ZpQUn5YG?M>tq0JX$mJM1d2**FB~&biOLj$c#)o&q~3Zs*tv~3D=n> zM+ap*OXbGs%`9^9ns4#g7wd3mp9OV`Sj=pQ#P)u3Wce#^iIB?kFt36*fq;04`7&Yf z@3m=jfC+Sdp>ImPIez`2Y9+VpV%UUC^j%TLXNyeI*J+GLc-pxOtKuu<002^|A6>5` zK=h8YuW^_k8Lefm@>JTkj+O#N7pOWKwS$|nquciDbMosDq-|lypE{Sr5MwV=PvzLT zg;OQ8jnAM&mIwZL*Fw{_Ph*Q^RV?ZDj-%pEYm?~xhsQ+1uMzADKLa=kV4z$L)`EI zED6jvGMx6*`$!|vpTeg`@3zN02n)BaFdF`lsM+6>q<*e!^sL43B)CaMP5qSe^|XZ8 z3H1BQAL#dNuSYD6Pp||NPZt$tMkd{mHpJelFs{2b5?A_pQx{|*E({y?7@?}sWM(=h zzLsQP6tFmwkp`v8OuG^drq6kY6;<2IIVjn0I!M(q1}glU`cV2adS|ZJvD(owgz%&^ zCN*7+UK{VpW$xIkiTrB1_~=+>@OXY5Y_(oymbtQO2wmAEhm0FzYXjyaFmJg}bsLJ0 zc82G%r^{=vX=;{U{c_d5&^KGJW=ZHZpit|=RRfkAXa2msfn7{gqNaUsW&eUMYH+~5 zFen>{$g2QUi#@rw>!j>JW0%oQ>)wrbTc@hPb?-H8O#!x#y%6Wfv6JNjik%Bag&mYK z$;h@9vQX~_UMg;`o~Wlrof@|;YC*qLY1+QUuAycu#|a4vcG`U9tBVYYqt7GAxYK5s z@Bt%`MAlsX!kN?7ATt3XtTARAkhJhEGEVaqYyrtdj|i|j5gEgrMLKWMwZ5K5++@?{ z7Cy*Ty6U@%bjk<>s3kz#;XA|3r%on)-NQn}F!orm8z?39FAxWW*Pbsxd)fuPCR~<{ zj25m{apJ()T=w4G%WBhpJf|PG&1wAIVVziSpH18Z?A$DU48WW04cR;5(>5}?kp@Ez zUe`|^Vh-f$k|y^rPCw7XZ11YjY)WxGq{NlkW4xfzu;SpOX~>pQZlY{Mv*KI*dSZV= zE#9%e|NS3e*OML0z$c>o*#85l?z~zhklmB?7s}h06;_ziz@#V}gfSywYmsU{@DcK^ zT@R;dBoxV_p50F)xgex|Cy9nfT|Fuwy8Y$TUr#ZWdE?3g)Cf`gk7I9rBO12A_O3@K z&bs?t5wksCpu$Jy{68vt1eH?L{|66*G3?jIgCUG}Lm;2-_l;veZjJu<^R!;WQ8f;H zb4fol#U3dnAQ~etsI>LfEz0g zv;r6@1ViF`W~6*_&)|L{NO{2@H*l-xIZ|L=Wp zFcDxG)%!%G!Is+e+e>Pf+y4;Ooh!FVa0F%f;G)Uj1E=>dKCgim&(7Kf=;baOyU@=~ z`~T87rer2&yS;z0#>;|>AW}|JqP{V-H^+wbTwdAOebleFt{_8BwE>S%()VHQMF~^5 zhNQh-@7-UW@EnqpQ6n6kNJU&FWQv1)k_xyWpZeEzI`vBaGQ8_d^30dvlcWSXz@)Cg z9=N_3NaWp!=nNP21``Ds%Pym!S6ywr4ElyFRgZx;@k@rC5g{HudJlP}RyC{d|Y) zK6&!Y7hN@RREmJbd{pY~9ZJrIyGc-N?`s#Qq#viu(|ZzqA^OCz)xkWT6>6QB{?}Nv zn}Si|OzCw~bN%(vur&wb%WFWCe^n`3z@lCWcC46ekxNj2)NDHKJd{fQbzW-_!6Hw5 zU@8esp7s#njLzOVC8u_TXKGc?uW_J=D3 zIuA@6=m!_QMY!HVJETp?n@ZxBo7qf*tJx)vg*=>%yR~i-%LE}I|PM-GazQEzw zQWZ=v6s0fu9#;;b;EA%*$G6ULRf5wv_7>k$AXK7Wp1Hnk1oUVP?HxE@eo4@){bBGl zp@Jb;(=uQRvU-={@-V7Ov(q~XJ@4gX11~*?%9T*d)jzg14b5An()EFLaf4#aEgGa~ zeTlr!S4XuZ^OY@SEVl&%A_pY}3IsUcQV>$DeEiu$tl|QoA7h?8^i}|~AQpv{5UA0b z_Q5mLAL0(;zWC9b!fj}}d{W6a!Q$16;T0-DLnp2xyT?rN1I zxs{ej^MM`l{ACW7m*uL*{D z;cad9;n+5L^5F`(r_Ws!0RI}^CKSA;kV%qD;qn{?p2>2 zY1%Lg`(vaKBW{a^y_D)L2`9Elqu#((%VqBSM7UA;Dfw|0MTber-5K_!o4 zBQoM!AAJno`iQSR6CbnUx6R7H!5w4q;k4n1lzzUDzVeJq>(;AOzT!8!C1z_G&!)4M z13b3QLSz5`(6ao$^xBha5)@&IkCXpYLY3Fr8yon_q)dV*vi3wsVzW#5kxwx-!ELP#0A#ng6 z--Q> z*O8=$3v7FDS!S*Wwxs+?gH$Z*V)!=x`z(L{r!Do^ICcofd2?}ljn;X><^};}3|)>R zdGn^dor!h>N2=BFc!Ux zvsi-^&w0+esAh}+_=EfxVsI34nIEkMjFNzdk&FHMClG){?l@YrtHM4l|Hid#$<&!%dlgGJQZV_GGP?+Y5nfCJwJ?KydJ=675D z*C=A5o^hJ9PmO%C{2aKO#pU(B*56#VgvCB{tjmU+qDTEi_);L`!BMA3qzZ9G|fI(S8%B@XM@Zd}dm5`4*O066743tljQ3bYem3rlIo>-o+< zZ~cs2HC$AF2Y~~YU6+1mA$jvi3Rc(XaTv%)-=`^ow0Dtr5>xU19bExg;pJ0q%$CB!714@x;pa^Q6;fwWr#e1IRQXzt7$v2PR@pb1 zKd|%qik`C+jq&x$5e}-4EG9aKq0D8~d3X5wA5eMz(is8PW4S`&x}}A`_}=iE zv&C@@dO^#M{wuS0EKK4w>NiseD<Lupn3cF&pmR)b=qk=aCYf71Osg`9riyK`8{sL3hIsPtZq#Y-`!F(KL7 z1EgAfWpIq66npr53)mD!N(!pW{gNIrA%C|RHA%x}8HE--2fa8#SDqk)3n|F3ba20} zKDW{;x&55gRU z7MKbJ1kd0@Jy@)LyQ-hemkVSzk)LRgX8ewm*DQAc&RG!jihNH%7MY>doo09Kv-`ol z2v`P=F7cenF=7>?Ula6GHjCh)o4NzU*jOghy5u4kfTlkWTwJnU5swV5ZDFd5vky#M z$UH?Ky z?~y@KKC^4|Ep^T6IJpwq0K0{})-i2ln1fGJj^DXT_>AT(ivocwTV;*QT%S;?P1z=}X>^?Pk!& zc4=XAH-Il@eqAV7YD%)z(^ngQBguO?haE;s=EfpzxgJsQ;~z-cIHR6&&{WPh9PJ9%c8 zJj;cM{*225FR8BvLTMvG@#-D#);>f5zB(-#PzOJJV+aH8Gdv8dDb(kX&e%t$`V3U&u+Ex43~hXzbslv6vk+ z(&TpxZa2V|u7S$5uJ7kIGolDK^J>|;GgImsX&{4Y3=}=@M;a9eE=xeCZD*L2M5YMUuUGpx#U(SSgj+;3#R*8 ziRzq)6Y}+aE25VDhJClBELL*J9tyZT+#xR6&nqcf6zR*27_^vZm6^`3)emqADyOPHgw3u8%eQo~;N&A*Dz7id4D5kat3%k) zD;OC7-V@rAA+>mV_#AP1!(H7S!j74KJJXwMCBtO?Qqr^*Tuyw1l{PcNUwcO^U(m(7 z2i>Z0@URM3+1u9Ui?%Z~UmkfGwo;jec=H)HUw1la*#3wVPSU}r#w}k!Qv+R^AD^mG z(oDT~OQA_iEkRLVFP3*`v6J#bTb$B*q);nOcRrUd>@HpDZPG!Lhb>GLZhq}GX7$_` zz{K+&VStwT!gq(v*)RPYJ|FXB8b22=1O96Yz>dn2Mv^L$`jYPEg(}sZGC!xh{^OZx zckJ2hDl*S(X#C){g*@*g3)+|)VZIgx9QTr;qG`#H%Ke@TsHx;4nmAvJ6E64zLyBG1 zTijA0LqUsggNr9>J5O{Px9nrMm0UE4@rxnk)Di%8bu$JwVZ(zH^V*SpOYz{-nzyF3 zE12FBvlnPp$=PeVX;dp#e~&k@>P0R3mFLYAL6kJRV>K7l?GOa#p^^i*yv;YN zwmPeoO@sbI4~>AJ-@wwH`bJA6wc39KB z`bT81ukEGdLF@VskfUMO+!7$qS~@ui#k?Mcc$Nb(C)94Wn|10p`f-|V(@9_g-1;j?l}BinbRVo#aS zrz+OlmXgr5`Y5CkGR3AlHlK8DE)Mku`?K!WUTkXO{r&qpSrKhweMhHeI) ztGxH`Ms@g;fcRW3nupw$4zJ6d@*7SHQf65iri3qQriGduba6o*nxH1JT7`1&++{`HBtJszaumRzuwWuiy>`6$l zRa<3xjN0b2pcB?nE!{KNb?Ji)R2UU<>cuE*VH_sXXLLiY66<@`2r1Unb74TBJW%SU z=Te*_^L#~MG2UI#)2E4g?}?uzJg>7vsv{0m`3mW$Qn?KO!)`rx6B%fb_F8O=RYwma z-B7OUySD7iFSrRoP2k`b+2@x4uAfh}LEBE2TOZW~O`kfPg?^>}aNmNd-s&KTlocLX z)(g*w6)aBNh+eOzmULtWj_=37<8wd06Y`pWUN|}B=IZun3MO+Tb5VY`&GGB1@0}Dq z|5e=3f3+gIDGtP~mw$m+ocDh_?&j$f8g4D5lDc*IY8#p-rF8>8tX*3Ydo71qM!jat z5ct%T%A9lU<>!V(&BbiX2l$~;^`3mwyaREZSHiI0b=KG8n)P-4rmNIQ&k32WUNy{$ z@itE&L?QLZxJ{i(PkAA)@w^6I)nN?ZV-LyVdrLbBpt9Ep1=w;N;w?O}|g&Jd3kCbxsNYTy0N6?y{xV)#~G=63B&t zL*Z%QW&w)w5wU>=L?*~QyN4M z#Qb0el%^Fk9e0C((s)~{8UwG9R7g!z{hF`3b&Taz|D^VaNsF3BSk9e%{2i~vX@Het z%pJ$if2u|adYx5uXt?Vhu24E+NXS#Ma{xq?nzksM3&;J&IQkB51_#!5vG$iHM!OmL zI{uikez~+T5dSW$+qe`sTn{~GQxrAdTY>;YlEI}IT@``m~#*PrSYQ2azrkFa*jbj)l&@7`o~yvg76cv_iC zQtKzJU$XONOw$b1WQGTl8=iJn@0nXaYQnV?DI|6dtcZ81m3pd&QJRAk2Q2fopH@Ks z>)!Y5zK?&QUT!D!Mjd=6+(!HzdBrWR7*GB+T*oxbBeTI>tX1Bk=rQQRm4VrQ=dMme zjNeSIH*WIX@oa9PKe;HPa@IIS-?ODi>tGK~nwxE<__S|T7Kz?3$cSaT z&LQtsIisMA)hqhV&?W1q>+=_C7w`KpWqu#zrBUaID_Ct&=)kbX(@syG`c~vC%dhW< zSpV3M(LV@m1?XbJ48)H_r}Z_z+4EC&Pwu_g%f#uHZnetaj$gv`3V1rdd@!dq8>(XL zusL|U09*VR$yX*0wS9n*)MrKA2dQ_lN-^%UmyrE5F_Y=8PAys?(S!~*DzaCzi6WGy zg0RkP;gfF}=G@)pSpzDSxpnUWnscfz{93ll10}X(D5CB0wxFVvTXH*%|n7)(Zy8mSx%pszUmb$&6L;|=f1s{(ya@kqV=D|pC6_?wRd}W{|rAi zPJaAHSaC=AlO@Ieb2Rf{-0uGrrKCxO*VOslsi;HQ)Lr*+*Q{{`*91FgC3xDECu~|Y z*4jN&^hE!pg|3P7^rYWK-uDlvXfmjfycFPAq{^=P`QCrjSC6?4K9Jrjbe)|<-w`_@ zugmiKfHUD>{QKIG49ycEMa4L5{eLEupLuHU#b;2K7CgL<4*kyQ8*5*}hiQ8@>|~~Q zU8Wu6lV~P>oAB$4x#CkV7igc14VVNdhC%LZ?dp7!JXB_1(PosZ`l8!75`DOYJQw_R zq*;VS0{D(_pO>v9U>NuiUEJGi{eao6asrXMMCgiT!@oKRwNVr@)qJo?#w~ zwMl!vXPAS+CDIz#+`tYWG#63c?8)Ph=7k;M(gMn%x!^QG0E zzJkHgM<0Ky1Gq^UOEf+LhFHjpVNytfr{i2=d>yBMQ@em|NYFr)nqlJ_@F^)bb)M!r zg=WPy_^~mbQ5x=eiyyx4b*s>)v1jE4?1)+}_5L5|l)h;rax728$*d4aWQaVJITNnn zS^g?<;ZkK7kMHZ=<4uSwqoE% zekJeDfJbP4Zh&9RyOlH>c${P(e5PiT$3dleS8M46e!b_<&7z`C8pb*b>wf*$>T-v& zMe%?*e=t9)O32VjlG5=%Tf?3&L=~1)yC1m*3>fya@aJu;yC2z_FInDLk9pUB_H!03 zc8K2k?<4p+p=&;?ooa-;#l&Mf6Vq!MU9`MWHi*QkV}_uJo6BJBxxGpucK%}@ADeS$ zjd?!)qhTzw?2px@TOyANDF{YO`d47ug%^q!?R|mxP(CM=BzYRJk8@|_S99+^gAR>58J2O%DAO99?3CtPnvbK3hJLbUI0%S3 zmuG4UF1|fqLU5`zUggYWbi(S7Q|=?8u5xHqUvtgXI>*{&e7xv1b7b)63!76M6NKqp zNImbw(|V<)I@3{596}Zd<1$Gid6~}y7r?Mdo`E)N_9Xn6@q>Eqg11EoQi_jn`1yf$ z;}@{iaQ(p>|1lu`$0%1t^I3lq@2AbT*hfHTP#HpSF&VP3TOi<~HDP^OXe`2M9T(ZK z@Te1pIBu(j99j>Uu{74!B##}N=*KCK%G%geBM*<{iH_-+gvw1bj*kpQOdy3!L=h{s62% zjtrvGe&IBWrOCn&UvoZW(7|AbPJ?`jy!)Hgc7qmPwg$IGlaE0tC15@R_f}QT083s< zAVR(l$fnY1QA&VCl5J;g(}Td)bUz!qnBRzv=1`=*y{?5;uF_2XVqs^8kI_)o}JkYv7W0fHu79wKF+AsnQM-*1oaw9u9HjK)n8+KIEFKhiN| zCd&*EKLp99G$A?w8()OK-JIqz`}HNnoUAGmuFnhfC+M*%Uy}!oeVRmV*q3Zqi?NoS zqRG71Zo_i)QSLc;cf9hK)CVJ5kZ1X)yIoqmvV*{zzfiTF0-S-i^MlzJ3`c(tq`q}4 z_iIUCP?)&P6rVFBz6QPtE`CV+oNgRb9E7u?L|>*JZFxb69L5BN-v+@=$xoRmPTQIj zVqUwT#ec@^6H|AkDkajMK3mDi#6$tcL5ZdBV(bi$qXvoT5^i!e8bkCWp0Bx+?+D>J zS~ybhA07k4by&gf+5+Aw;&Tc2b{*alj0z>q1Y z?j~BY*GAc1Za}RLDs`KIrv3_=#nNV8Wx_Krg(;<$Vh2oHOa=MrsCo*2o(gbl)P#EZ zAYrJ?c+=K;Mcd0eVIrc~4pal+EhV5=me%PP^>E{%5xhPv3@*i*^DmIyizTZ1(RW5+ znKO_DH1QZeL!e%kFIP!`u9IjP^iUTxi_EW-aJ3U${4xrI@Fgq(=J=7b6#-Vf?^CGh z&UO0rCIpR^)yeEi+z;NXW)M5?7D%D*ON(VT)}j=Lho)Dvy@}TY~|3zx)UD zYmL~LiYxj{*6(6_p$<>05(fQ>*`slr5mD|UF(818cTlX zqii^>*X%CEaOaoAiEwv`0WGM$#;f&fz#eFT=4kz_vJ7YdsRux7_;*FLr)H$p-8vrw z=GT$bmawlQ)S^=J-f%op0?HBMniY>&qX&LZOTKi_95y6L+YCDJyLgUP9 zbP*67xnQf2Y`1$|%)M@sA?vZ*zj(tsRIqyxRr=$6Wv6bVx*YD8SVdcl?o#wUVveM; z{oashhM1#|Fvth@BR>`fXDn?( zxj8Y6mXyQmDO0~Oaj@j~(3GE6RM&teOO(bW&mqwe{w1&;hGXZJhAJeJ8f(t%L&|1K zMJ=MbVL{Oj^(~=CDh50h!kQt-nIp)YVGHE*=7AL~I~lZMOA9Ij_arTbjOebUPk^G} zHUApWwnn_JQ2nt7W2?4Qnt(f8lJijC8Bk1&w@V8&YGSuqE`?k&UCm;pNCk`s$K|ey zf1S1}3L3#Kq|+u_G$<;f5JJrD;Sp(sby}idDFj7)p6e^^QNLV0uMpOC);;sjMU>Ns z!J1?gAw|opZt-Xgqx;Vy6xMmqW@_;cON@1AQs2^xi^px}dA(Fp85D8`d0gvQv5K-z zuDvEl>g~|Hdf~)_v)*maM<7XBYYfcH+syC<8{~5oU|qG`Zst!tYz1WQ1SEmwGJ9z? zX;3@OV+J%6T|Mb&jV1zf##|NG@R{zpV%BLH#m`OI4{@EM~3=$ zu-w(5!aCxiEf{j&$9r?UCgfTtbvr(CNS>InWna!}bgP&V0f~WgQ;kb)9Lg6sUHL!hF|a)M1DvPq5zCsk4L-W3t6dBruG4K07lDFa2q(R(;2WxKtg(E zRP^Y7-q%$PXQ!*fLn^NJ`&rTQ7+U!R>6EndaY0uY?@LGm?m~?h9K`CNOTLNfZkjd+ zQQkwr6?J>bBQre}cTD*_vT50mlaztgb~)f{Em@-2&3DRSwo87tA~I24F05BXw)khF zA<4Kl(P(_4!%Ztmy4jWiHU);1)rY}`nB7Fjf@6q@<-zP!@h0iQm24#ZYwz5j_hXl= zt;DIXMW(b@9KOh;y!f~c!YrVv%S%WpJd^|0^c#>(vVC2*+^$euy%LjjY?BtMPfK!) z;r5(9Gi2dSyIQw)f36zNHF-(wO1g`xfAMw7>WpM~=>Eub-Z?MmwUnT#9_npqmbtq6 zUT-^R2woQWbyXn0H8MRVU`XiFpvAy7-q^3aGUO@&*GqLJDq0J>rCAz>*xGf$>g<>N z9JiEU4?|(vmD~^h^#Jb71m9@q*b9ej%rOUW$B+TGrt61@Z{B;zuvBdjiPQ$VoZ$k9 z0E<4ZMx?!zCwCcrEOBsO43=h#E50k)%Y_~$Y4yi55dDQq^Q*b`wdUYgmNs;2`UATo z2$?GgXF*6YRh0^EeKS39A@X_9-buZ~Gi12V&4x^okY4GRypFJWkn+1&wZ@{0=VM87 z)`)^r6C|)sr)O)(ze+z`pw;EN4mLBS_R`*jakXDj;10SeWKfkO0T#^|=^47g& zxf`N4IS3xPQtT#{w_t1CUa?epE`ZMN2j>tB%l#E+EQz$_Rm&)dJCLv%gCh+mgOF^h68{*?n$z+K!C{4yDh>F zJ5&mKYBDlDjy0y1#tI~{#vcaF=jWAOiag{LK!Fp8^=0^e1EPhmY%hB1j3~^eocWBkul@$g|<}bcFY51ZZ!ui`>`mes$Jw^VleX`?i zS{~%%;s4;8QJ!}%Bi|oGe^u6;7u#N8%Sj6eE!ecGQbl}$Jpr&_S-s9a>N^uZYuK7g zDy?VC%X4mXe`sb0Fn|sFbbs6HyeGy#43$cdsW@eLc$lr^FreXB|KkvhK$oxik)e0UlMw?KK9Xrr3$XaADC z+U2!wppRA@ueNiuHN&e_25*i#dF3iVhIfJlA9DFj=NBOwc{(Y;Ea-!_M{( z=DKV9Z1o@9YuaYGl<3X=hhtk)etgQuX#2u-l#&bPK34HR__hgK6|>&Qkgf7a34!hH zSH8R1-?eJK?dT>z{)%n=(6MVf81wC&-;EMf%kKxGMKn01=B8$P&BG(r@1enIGvy>9 zV}A*Kw~^aeMh4x{!q)eSqu1yrk7d#Czby#gHr=6XD%*mFUQctX(HZ(;q-Pq~uAnNd z*vV@&?s+JUPorTLe*pEhEAL#+Z~Q|F>ka|7#bHoohZi}>hNI(%GfB?o(00iO zp2mSE_(j3|Q`HdMx&##8hPy_4ySBn9-`4*#KlM=hR-?wZ8U6>{R5f$e{>KH_E^7U6 z!YluKw`@D!^G^+NZ{Pn{>Q4Wv;Qe>x+|ys~xuNXD8im398Ah5edxfPtOY|Rx`A@dK zqCMU#-D(eApDH-YKkKt1f0Zusm9>(NKh4sg*>B-uVdvL>`ZacupCY4etTXyg?@~FM z89bj)`6#*UcbU>kmu&KFvWOJ=_HZoYt(ZI!d~ z(_@Pn0V65g6&u)D4i*FTUS$KJMsnPbPRNc!k{3P~$Z*?ax)y8bSoiod59Ej1^$+?R zn<*2MhcgyDLR>Jx>H=vf|3XKX5QU-qV`eze@?@OxF=Mc?zQ4B4CZ17({W>f9BCk4` zFVv5w{@g0J*A}CIOR7$B@>!CtN+ASRzyQA_^E7m1Fjv#|!JEo!i-vCL1)A(ugBSdK$X@41*G{Mfn}#p#1bc*w@u60HjqaP_MB zMMLj1yjxo;>FnO^qi-I=u4ACJNuO#nb%W071h2eT$d3W}pgcmTZ)dLp?Jc|~ zNxgQeyV=+1`NJ8sx5W$dX0^t{7P|Z#rp5dhv}UZKs(Jt7+o+0V`x`H`Jd?tXnJ^AN z+_V|e3Cc|;cpz%ShJ4$2)thDT2b7lw8KwGn20R}E`d#99U}A9Wt%WXf)aw={cMGK7 z>4cl14p+Xj`a0z`^RVyR1RCDj7h^U^wV&f*-X%ee`U?4g^M_WlS zk~AuXyFV>=RpDG}f$>}u!qmP)=yoz(8naOOPCvxf318$8tKr8lJ*lk)`01iiIs_=_*nJgz3|b+X0!Uf0_C5QW#|-vlth*;lXr z>*teqiPt02Hd0>6v){7{8M5fC_ct43gI`;AYs8)sEBwO@NUq#R{xGPO5YH$La2wRvW+s-Z;>lW0B+EMrU50tv*+a8@`#0xRa@B?(4?c2%-i9GEELrlURXq8 zCKA64k_i!SW=aS#dd47?)-mapt#roO?Y@fv{>`DkD%^6CQq)|^45foUCG;JG{b|!e z7PQ=*yMOvqssy;lo$or_lLjvOTD3r7CPics1 zsN+V_7y02S7eXdJ6Uuh8FtMSG9hd@#^?JwLr1&dn+LdO#40G>&%Rx>wIu6RcX!AYN z9QOz4d_a5YJ7Ms<6<^nrIk301n3K8PA*p&2m{h~{G7?=!Dimum@;NAfw|L@Wt9 z8wAX)8>!EgRO>Xxpg65mjc_n>Z=D7|?O2qS8GxOhvZV!gP(ODKIAW%QBUEYXZwXg! z)*iFtdn){sOFs5pd=;S^U_;a>k8G6T*Cw0fh^$?{UZ@l{k<+~S`kjo?rC+ZajG!9! z#0#AHLn0@)>cDK6yXntxGjaGJEvKdX3HQ%(tNo?-grXMfJ!T|BBGl~-bn6Fc@y<7w zr)tr6L|*t6to8=Y^>%fq5q<;DNJVABTV>Sps*icpH?K(vc_oL;f^0J6bTAcuA_NLa6L)i2~-{u`%@ydj{0^b9^7fi_#16}e86uw-RiRV4*Ygm zD(%?Nzv1Jqj-Pf~HvX5`@B4Z;dhQ;-r0~>&V<)x)sXjgk8hgCgzHTbfX4MP3K3xQl zmDa0f;b0p$ijmgdNlQbZ^7%f8fZiKRZa*e{twMEeQvL}qf6H_-gyq2xOqNgV@VE$ z`30HdUfyC6h7Q~06uRsDwfb+ypiLU#6J=GcQkd6psTs>ZxN4QkZRqG*jOcMD zEq3__ni7s=E?3G$j+$yIc zX=W03WP#H8b$8LBnq||Bvyg@8B@0t0KT(Vku(cZiQdB zId2r&O2JeF6j)FRs{>a^U0$PRWSJsHDf)rC=H|Ht{(p5Kx2)xJM`OL?5v1ZsX6SO; zxZA=U?v~3;eb7k1s5IAL>8@zp!4Gu){lNcsK=nocHc(wNkh$!8(*I7=o|49~O!Dw^ zT=Dc`4a~?Jt1E?N&!S(XlOMnS=zOE%IlgTCaiUv69ssWNz zyJQ16sj(nDRsEa(4J?mMMakXLJA9l>c>JKeU`gHnvtG1{3U?8eMx*(8?_(JfUpFq8Gxtb_>)5GOicwy#5}x(L zoEL=uZ5HyUM`63SSNnJPm!Bt@%C+$-_peAO?Q~PC?5PM2Ck9nznQDGuJ7X7~Dn=_G zf&7fJL&qS#wi`KAI-K?X8H2&3FZ1jC>lAPUMryJY#+QpMmEIG+_X~` z>Ky!{yP~z%U%HL8^k%|ilh#j_MjAz@M^#k++uY#pj{tu4fQB(YT8`XUBdokmCgNmZ zx-~PIA-2~%KQtsrq|ZBF^Ln!)6iK-dAt5S3l{j0K)vamfWI1vnf;Z`W$}i50^?$VY z-C<3iUH`ULd{ht%RnVxoQ4ujJAPAv~17xYlkP$Rt2q8>Ch6$}G$le5*qJXTBfTKY5E4mP%H9ej2qEy^321Gfr|o+^t^N64*Y6)LzPY~R9_O6Gda*Sa|1o>1rq#hB|kX@hQ*!=LSA6tC_g0~EuPrQ4i_tm6GfKw>vrqapTY*nYX z*;S%C9%s9%jRvPW(MG4{2<*nnA*L8BfFSlj*NvPsW<55|L_=x0(+7~@G=Gm+p%MF< zp6nhSO!R_T;A@xBY=fJI?wQwX+Z<9IO^4i!We6G5?a@=Jj~fgb(ywM?`@S34(M5x^ z@4$(7;sO~h0#a9`d|l#qZ| zR;?8In$uwz(&Dwn2=fwRV>GRCC3Q%j)g)^=m$I*A5Ao@MkH+HugIKyFtR+6OYL5g)5;Zz`3Gg1kgd?6)P0@Jq<)yTD|hciv~KgZy%*{W-gmAMp}GpMq8Ys|e8 zjh^qU)MX_$I8JR@cN3Ps37jn2Ptc}0{~Tzz1KC@-AuH^MF%z+ju_qXE%e-M=WuRDN z<=#Qp;|&=ek}r%PoD9`mh!lST*i$oC2(Bo-;lfWF1FvoNJ$d1#IaDvCYJ zBG;dCina1po!e@GsXNXlqHAVb6V@R^=6oEgL4HTLZ3%}3+{jm}d8-YG0gsv7zQr9M zca}A4`lZ&hQ2GW>MuDYJZ^fAo(|a-3AWv+3%K|iRYR8lW+NQ*)h)o8mwRVKFrES~G z1j5Kwm!%z%2V_D1V*2bo&S+g??c+}3*2ggFe4e}wMmhZ*RVPR|P@{o7pXPX5-7Sus z{ivt9N$C>H_Gd|F0dzv0+xPU=*}{%sWX&z#dfYVvl%xF`R+&P0_SR9=y}r+Bn64QB z33j?4L~JV=h0GB-Ni+!?!+by54KGqkGJX^Uib!6rg9UqFN=?O*6Pw*L%@{7V7p3O> zvtCcj<(!!c=zlp-Xl04IAC%E96}!%TeV>y{8#7i_(tsE{J3@cAwfBX>O&eJgJ=^VZ zK~K%J(?elkIE^J$uW6R`|m96ftc+q}5Ie1~9V?L5(_xy%!{7w8Y zAv!_S0<&AEGdM!p-4oLFR@$~~+TQQ7_g>UPMjJ#Y z3EP=2O!^Q^dqC3QxzU^gQ!#(CpJe&Xw1GEs#L?QUgsE^^?5H3H*1I%lZ|nUOv5Jv! zVxzGYd3xTD=|J7TAt8vu{=QB*FnhLhEgRSD4Pg=jX<5k|@CmLH_fV)vwb;k|tgy`% z#Z0PHVU~lrW10gRjhuGt?Ma*JauZ;ku(&R1KK2+%s1zJXYmmD?AVv(bRH|=VAPpmB zFav9o-^*KLWpDJhCp8cS7h`t(khhw*27q(6V)y2H2W~xGy*P<%v#7`BhGChqodybt z8mjznBWPs&`>3H7YovmlMBGI-vHg_-HV#VL6dZ&|e>QsZ52 zwd+x@(tA$V()sjU{yd0dSS$H+@i)tD=encN-ht{#k8guLTrMp9tRFwTUCtrt{Yj!! z$-G1B+7+zLTq#+mV#wV4XBUAr?pXm_xmT7zpoZk+R@oruQ9H>z4e+MZuJr#{^1SD%r)aw=lo}3G3{e<2QB!=(>mVr zN!@){m-F0P&_cxIw!JdoG$I%zEe9Arv;`2_l(BR<+I{ryNTuuRQ&=tIn$DM6v0=cA zD-JWZFW(qK!Ys18OmrB(c@prxm50#}uIJO^$76FOtZmDcEIP0JUYOuxFT_1#b}Q+0 zcD9vwJNJ?X;%k7jMl|i3qY~3=f$tA`{L||tm*?bRV}Yz4;NEJDLrRz6>z4uqAI232 z0|BqJ9O=A1h=PcgEg)>;`b&RxB7TV)d~5_Fz40c1QC9p^y40-C;g;otSDSxu@;?8? z$ygu|P4-+7J1XGy88b~1grYa#Kkj|T zwBhKH3@#FmCuKRc4ZFaX@3~bxwM~}gkmmNn9ZfE*YkO5wmm!r7$R%0>$VLfn_rbG- z@jg02N;V0WGD$##d*S4uP1{g66e(%#2S?;JTgmM?Bk-&dnD7<7x%`P$%N!cLe1HT{ zh2O-G`+aVQgnFovQ;0VDs~T74VId^%V)#`}GNNs`2+t@8qNEPt1Dvw(cszr93rtA3 zpF1)i8ZQC8jQ&;ALqxYr{kGu;Nlh$-6z$1&@X}Wq?xg%zH3DftY4a#X06A7~;_=za zEe3-22Z_~%f!a<|#L+_BNMXY_tr5jz?#qbO3DQ@TZh4{SG;UkLFp&wAg1o*W{d^g2 z$NeZ#ybF2oVf}o0+Yy=Z-B2qx6fzElLXGfl38LI}&Bk#b)~Dqa_Rn4Lzhan$GR~Ke z*CT@8hcSD+D*ebt>Dwp4@h}@l@XXY(-vygo@~awVnm2eUYZ#s-$#PI0Mjl+GJ0qnA zTG=<6vc0IvvDNsTtez_!HImQ9`wGX8opMUHWy68!aydpcZB{@F0x55onisD(Apx~P z%SlDzc^%&cHRoLfl8p{V;_DfO0c;ij=uW!+0G&=R?WjD}37XQ5p-V_?#%uHl%c;b+eIdVd0#-S$5os`8^zi2$fC>B`)C%nTT-}7hfhTdLk9_Z@@ ze?zXwptv1>rs98CB^0Ojo@0PH_^-tqq;Lc3leiAY21PZ$hFH0^h~ZeJRU2D zXK5)?z^nCU9MIV~$Yn9@Sz7*5@BIR$bGN^_ViV!C?a46Qrp-x;=9I7|T>`_H;pNkD ztnIX7PlPBg&QG;w^u2rE6J+s3GcFz8`Wf^WJ`Pw83D{xn1UKf&lGz{0fVjqHqOnxj zeKvs7$(iX|v|8xI>JSCEHgDMoJnt!oAJ!3cCE)dlau9ctEA#ALSvnYoxfW$$8{I*F zHo22_GNBP3=x03r${o~K9@(kcr+bxVpFZ9fX*}a#JoDh;K5*DULzCUsjeX~5QadR{ zIV7vtmW`~;$siQVKO0WZI2SVQ1h{uLYS~OdBCIG;^ZUO2yA7BO&O@fy?QM4{Iq3HL z-R|N_9!J>~Q?mgTA2MXzYVht8E|n))T)e)l*NX$>xKS^CSO~cS4-uUg}kw)CEyWK0PlSw!qCjPGOZA2=-g4` z)M0Ta`WvqHjahiIyFCRrF-}et9b*p>7xY;eTTbUFvt&M6bMD6)IBwesyN5bTb74xc z9k;qL<)V{eW@~Ik?3x+|hkO$}ujeEWFB|Q*En~Dlgwyj zBN}F3sw$Tp>OZ4{OUy##*P$!hNF|hCW z`%G!e9$tQd5~Tfy`K0$2O7A_%d$ewdxeX>-TUdZtb5g)`+%DN41U%WvQkb+On--ZR z3$&}6>ivB<6L^#Xzm4q5lY~w^L_6JqyD382VSdk+Iv?blDVfJD=G+<$M7q;?XDQ^} zdIvivIGq#M?F=3M$^xtba<8IeSx-v^wCu|7{(CBbr6+?aUX9pauFr+LpT=hSm4XR* zD^`3E-HWki_^!cs_Fg?w-uy&Vz~`*chn_;XeKeRLS+50zs7Oq3*>D92( z4c^gFO^vvS`J@)s&QSdssh&30BdyzSgwMJwp7$x=kDaYCIo$v4TnH?g+-ur#n*CPT z6dKcfZjb9#L5{Flnm6W5Gp@J%{ZLU+WRZ$G{FQH#QU^$fa5oAij+u2LWYA(q<3*ny zIoCKbUq5j?P-iY8ztpa{Uz%{h>S*z(Fx)RGAUDr3IANn2<0s8sZA!JLSnFJyJQf-j zU7Z8K%h)P|DRUpv z8=7gF*{E3&Vl>#peaqF{Z+A4OktOCMY$nLsi8%qi-V7YiUA`f%sEXBUJr7Wp(H0EHw1m;*(tssSTXE99eVXc#^{cfd z3?G=hGNF6nYqhO}{Psjbl@)UZDz4Oy7Ks;>uJBcTns;qWURp#krC0S(UZd@iySsdt z1)ai1mLlqSu%l{u9+imq7yhpQ0HAA)(zM(y4MjHV)*44y9C?K3F58-Xcx|>!fsi*W zDZXTJZO?%ze)OH45%2a!+M6n*4aw=RdMfH~t?#$N8^$HDyG1=esHGlV6glg&CsM8o zE2KsqTVrzq+u_|Ip4++wAmF6_XvNvp$(bPvaTe zK0Q`8=S6!aG&2A7nyi*RPXbU!+M5rn)Sij*Zb_QBcHu0dcl1@FN19*NIz}UovTI0c zdZT*MxUvJ)$oGy9e<+qhxmRc-G8a-ft_IPxlrVIa%nJ^it(MDi{1=+J^-S{<71m3R z@3hMKhv8+k1}xF46ngX8bB%=Z5wk0vT9Eu06T;-BUrGj3$Lgai@*Rk&v)OCA_*W^SP42tJQ=(7Znsy5&HgsipyaNuE~(HnMrM0`4#-NN-U zx&G?kyjA_pIg0jn5?4NrJsur0SK-gB_eoouqFZ?xN1MVvI+QI6bM5kjhSQD)7DZxC zvv)v$oP~ZTJ7&zE)dI{cv1Ng~fL0~!uPG?~!MAOml)xr+f;G$f#rz%1jl1^&!eTvE z#6l9)9M~eceN{g8VVqtkQDwL{<}l#tzIq5f1`|R(KIpVrmVziq+K0|0d&{Z@b6+b0V zuE!oZ5B7-GdGEsYCvYW;{R?O0D2ba`#L!t)#|;TT{arCbh!DVIzd#J{;vB0q4TR&F{hR5WeFRFJy#$Y1yLK1yr*&v`U> z4CdF#MzeK#yj-KnmsG3peWcAd6S}K4oSEk&zvCygF!-~2DeCt)Wew3zC8clqR%Rq{ zX|uf*J933r^&DiY9P*MXT7OPj6d59_TQ!6fm<=y& z9ZNbq#+{G7kQKyu3x%E9(soe#*y5XR*`orE)x4T8K$Y31ybXQJF=sKY4ZdupG zpw`#ph15>EO0v}sk%Dn}nS#(T=fs9tZ<*U*@!45-@+-Z`(p)$8 zpj!-B>|pEBvB~%s;}e$mOZxybOy=JJ4SY1ti`{|?4_{TkY}LYIW!>LODMe!XN6()e z((~xSmkZOwDJx7|I~cvHX3&aVN|$Ut0B8t)#s}DDehCVpI)RczxnsMb_MgHbmNFIz z-Cno3@YXL7+8;p+61``BC%+KD~vk%;1>#vQJ5CxJh4;U2iRBapSdvRt_ugmpbk7A}qlTSxCE) z{QouVu+ic55WZe=7xc2sOt};``@K`;dDwgiIV?fxLDi>(H{?F5qN{^MzwU&T;WqE$ z%YQf6@=*niPAx!F=g&QIlZMR-7(_y%hIQ2ceyppn4+Jn0=31V>BR~ivo?5NlF@Fv* zvA_oA341Y$(I{i>q(Jyge)ug)!jYj#fr_=s&h^y%~J&$>Uy zkU)eJoI-lccui3?*ojR%L_Vb9AX=;T$K>Dc55rSnD zt~GlZe@n|Zq80v^hO_(60ZhP@=2;pi^F@i!G_>F(!?3M>JZ)H~KCOdy89=Fbu};F#*dQO{8!PssDgD_2?VjtyqEt~G`^?HjHw-|E|c*#K)fJQ1P~1B0kV1?+T;_05|FL@67%ep=Gc$ z`#+S}@yina|Gm}dkPj9j;F_4!5p#o zKZ?ERoKBH7D_IyRfs0=2*z{@r(%_>72n4U*rwJ#+BZ5;+n7`m$x$Tx|!fdTYdp^iT z`B<3juB*rD8MLjtA*(3}d;FyRn={id%{ur#ecO?SZr=xF_V_c4ekuy&(f)pg&^0z9 zzdt0Kqzj~q-U23?fRDA_UVkXUS~j>oWc1{*0*{3&WmLK;6Qtp37HtOfWT}$O#=r zTRkjpYpl3jUw#99him^=%rIgWdUEc2PA@(Klt^7_Ib=_R!b9vNHBSRB#(k9ep%Cs3 z&)x^CTeLb0^Q%Tyavuem)k}Rv2P;hdFjr+rlX1mxA8iF{u~h6#Ak<OQ3{ znGTX?J`8!|st}9q(Q_ABZ#v=Dha81T*23BZH+5qXh5jRDjI(rhC(khR%?-9AHk{f(F(bQ7`U|IF3ecX{U!< zDtGEE4@5c2c5h{r{AzANQ1xH6>!(To#HgrXKdenGMC??|A*h;Eu_)wx+xZyD&CjLH zCC^=$YwfA0AJ9f26=gR+jn}qZ&x|cxZeDU3C7Kx;yY&go;6ne0l#tYl|rEGNgJ|^Gw$1Yj^$! D?$Md& delta 24807 zcmbTe2Ut^CyEZ(I3ZsII6{KZsAR95F&&kB?%;i`~hd)_dVBt&Ue1+^D@DZz1LprdDc_!dztd&XIlKv zPXhqk%NNesM7qurfVanc!$uHANj90n#fM8L`#>rzv`uc(m6YM5S5jPB z!kd007ch+s6P>@dLQ7cLJ(_e3G|CM&(P)qq+%_>q-+>Slz zTiotnKlVp+dD*kO=PnJR2z3aoD}v2H*727O^t!p3)ck1+Tt(j;A!2?GehtW{N;pxm z{J^+h&;N4xzUWQC6S)u%ZP%>%@$vBe-3`f-y9|@3c1i$_k4S>aT^jR^0tMQfFiSWA z&_@`IRxw|pv~Z+)4p^{&4hj3>N9f$<-~Yb7lI~bXI$+8h9;tJCQ>L~I2-}4f0Bbg4 z1{f)F#S5#~`$ibT2Nn^Uwf{WuNXge7bFg)qFu*$);4o3B#`sDSL5N-lJcS5h$4L4F zk%=IR$HxCXrP*`ZWsq zYAHWr{e5_dD|m5)0r%C)Y8a=*>ms}HpfHwi3}NcXYCFB-T1U&KI9~esABP0T-cUF> zbrkp{=aGHyhOa*|$gvHxn5WKr0F4;ncAnF$DS)G%wvU~Z2%J8>YrneB?k3CC zi)k4#n&R;Z2JC!1sgl0>=<#4B+Nw=V@7bGT`al~0p|YRp z*%{>7aG>n(9U|_e3fyDi7hZFx_}d~rSsMjB@iwW|(Qjo#v{Y;LyLv6Fo@HC)V6SlU z2m_Hs#uJOyZP81M5(z%R16PAI%^lqt49*_Eiam@f*<$Ac4~rJV$-F45ypwDD^)8i! z7>qb_YK|oP^8NhgfkT6n8N0Q;a%2acDeNHa*F$8SZgFFbYMa~QI#BXugv1W=Wfthj)ZS(CR#EWx>Z=4LLncMaLSlmD2Po^M6**x{XLfc;#hl~~c?rbd9PmoraQ za(TY4TPNiCib0EKwWj@BGiJM%rWroPC_(P9$B}v2B?h8)v4Jl*c%^}P5zf81X)dw& zMdcco_QIZJuq&oAZs?nM&R9BGZy)fP^4kjh%2133*!5KwqT4u#kipK|vK%_pVcPmB z+_*i`=iw_~GP`e(sQ)zEPqk<9m>KZ=^novNhDlnN zhAGRR7mBT#n`ED>n|)dGl3&Gc+KuzJt41|Np>NF3hTeQ4G+d<%oZ9LPHR&ghxiu4FQ(Vw#suzbiX=4tto}^@reZ!D zl}wC~W}~}HQ*;u&7{49w)d61dl=}3QhADSO7OZ5uYx?n1?!omLKRwHW`CXj^d4RT8 z>`S-7_njTlF`HP$JRxP}fG7RhSr>Yo(aQ`;Ywmg%GcVN`HE-+(cj2k^X2KT0Q*VcV ztoVi9da{)G9RQyyaypl1;MQ3>H93RV(~vihei^#TJ%qD#NoZTc`*-BWlV&4!Ps<5! zy{>!lkhs_$r{Cx$H~5@XM*E9KT#A}~Qz{74szG6XJaV$6n)~qbFrsU6l2c@xa2RIg zs>%^0ZhFw>9@%w;K`YDTuF^^pTQV#EIUU#$1v_Tt5w3uYkJ83vmdW;un=180enxKB2*G+zb&uE_V!R2M>O7f3BO;>(_9`L*2EX<3_yw%G9rtq+sJ+C(}|EYH4bJ77_ z4rEyiGUrIKX#~A@Ho`-br|@!lZUS9&H-JNU_q8?QZzjMFyT$$3v@4?d&cXsON}(oS z3WVdrwJ*&mSE28aPSu`_Y)1CISGsmy!2;#MAA9bq8fA1H-^igw%MDfl>x1iD6fn;< z;|ti0>ogxo&_iR=Me%c(TkD!Nn1W?%)TVRQsY>N;<6;w*w%PMYgQbm+u{)(!9?hQX zYLy5a_gS>GoV{GjPln~h^2E0;YEOo(d;Po_ot{_f#PUrP1>NTWac(CWJ7}`Z+r<@5 zj;vvt>^4TK)|+TiIspmRhZqqy-H~HSs(0|73}r!2;J&LMu?YBU;lk;5waw9{MQMph z7CVpm?2J_vp4(iH=xujhuD#f+>e ziAg6YOQ>&NA#v{NG<1Cey1TD}3U+$oETJxIDdW8PmCXBBV)n<7w}Lx;lRE)zV5WjP zM@1$jNP?)iRlaOHv9G&lXbE%(mR@|G&SaM%vDkRC17gyf*Tg+NUE}T!6-?Xvn5=y;$rMcE*8MqhjSF)0&K&chs{b;a z)pHVIWh}k|5Y7vc;cF`kGdUoEFJ}P_81a|$O|r7iguK#htWy&$?&Lp_oDjne4_3*uF8PyN9o~juNM&)x(ykqE*qo(p(Ns5y@HM zMM>>UhSZ8~<=cO)@3PDw+8N;&-l?$`?G`+;x@&-rDHVJx=JX39m~kA&j8?B}XvDDa z>kPZ~0m`^W=#w!!kcxo(yT;4VuRvc|hAkMg~4*L<;MqNWFl&NSHc?3Z7qL&fGi|m=8 zbZUL#tSxR+MO{}Xca-MevSPFPZ)Yesv_{5Nks2O%&Q?Lj9+m0gWd?JnV-5`xJmy=e zK>flKx^t}DWWH{YLfk#lhCuI@US*8tWsg4Iqt;$1V+l`IkSO#?jHelM_6$V{@Co5E zgA>yYGJ_f>zzgh1gx7p4#U>(0uYJ_F9I=y;}&nTKBY=oRFReUE=k#Y;0F z7GrTWUpHAh)=A*PI2}00lpR#$_n5%+gc*SLkDIIY0&-gxjqLndrD7P5a6Sl$VmYo{2H=d*@R58S z{7Z^>3Q|$!*BWmkE-&rkadtnNwBh&{9rh@ylXLk$*5F;Zl{7;f)`ZekrJv`fu)*tPED!y{*NuU-t zZgsZYZb&karDf;ccgLf7nf$Y8oV&4-V$zn^igasoJ0BqvbxmC54hJeX_i87_%MJFd zgkLqB-%B0sX!pxKET;b}Z|8@DocXL=BRgd7ub?xml|R{dDpu|(a(qd0L#*Nl z{=U=NTV00KWuB5(*x9i*M15bAC((0WOy8JFoP?0KVC39`*;=_zUN;A6zamivUMRIJ zSw96<9JDtEkw2wb;~VOjPRjD|uPi%BxiM%r%@`G1%B8q#It7T)Fb{R_z61r#WW)s! zS1UXoqWCg{E1-hCtsx~ldXYOjQIGK4<~dmKgR#LgFlQVsZE5w*s$1|D(a?QAZ_dvv zxM}}IrBAmcJvD33NulW4PG0Jjdw^~)%Uq<|ez*!pgJbqqW>UWOx`CZeQ=_`eoPtvg*mY%aY*!q^eqBu^i|7_*j@2fLV@dg zqT0sQN`EAq07}VVK>6>NETHKZ%U_3Sw5ivhqTxZotY?bC@$y+Onm0O%ePFtSg`*4u zOi;b94)kAfM69Zb195)+yY<&LZbiHWGuL=nXP^S>$SfBOrGwD=eM-Cj30r4^#UeP|koZQp6Ron~RJ*@# zT9M|<=BFYzHQhThlt2mnR;^Q4QFSHSh`-IA=GnoUAHPyEe-oo50sI{|zl<7_Y{jlO z_T^c*!}gmx!OTAF8~pCrUZ(fD^F;;lsnEtZO|NEk&35ELPh@n*Fw62^QSUBk)<1X` z+=+Uz`on0V>OaBCO-*vH0eeD9tELY96dM#g9{%#6t4A>M$L9Iz)-TC=HSW6&% zStud-KfJ_t&jq_ie%Zd6>D=##PhQ#|0cfm`X_P}^#`e*J1bsnX_E2P4_}A~xX5!=m zKcVKiD4b^0FnCF4`{vdYk5vu&J`h;1RzLPwwY*KEF=qc|XvAQMdHCF5t^ac+j_Hpy z_;68oK14c>^8v&Q4xfhSmj@XwCCtop`&1-j4bq2Vx+(O5k#){Y85vN7a|62fzY}du zKLv@o+3JyO!RIC%b+^LVoy4N8k(J@)r%9Q;es3qc8QDcUbgC2i*IL+~1Mr9M5DK<4@rUjdhAa zE5!y_tbvDbF_$7Uzwi=PfTMw@7hP{AC{ju@2;{IB#p75*)s;afj={Gu%Y;P-Rc6p9 zgnxgO$tUhkkLhRTiYo21>E<1tOk!9^FB7yLvtUyV;99bN7G*C6C9x#JVykL}DbD2i z5MrKCQuqD+t_tBYcHP>?C1NOy{^i5Nq8k~JAe{$~HC_(hIq^W_Q}57iy~dBtH6+ZC zGn0JAa5poOtQYEWrSEVi`q#FoLu@7Q=W@>s9GhekWoh3pE&XC<)^WK8b<78+hRD{V zjE3840=8YWSM&VX{Nup-MA^Fho|b5H=G9^8UD+ROd3*jMX)X=h)*QgV1A$nPrb>FOh8Y zu+t@`BI?_hvCDJ%jjNW`8W8KzcQS)qD8hjQtQ!jZOVmzI@ypx%hoXeZf%P{b-t!GJ zqV%dd?qKIx8Ryl@WkxTNqko8(4-L84TP5p73`O~9Tpm$rkdmEmzCyh4{vm82jb7u} zA(<_2p(T7<63VlvZn*47SeQO3c%a5K9eaxp5N|7PIeiBeD4!b9eVlo*l=e2oIZZAG z2sqn!(IeAo%5-?%jfHoBsxg-!xLhR2IilB=Zd?1Ff9naAC+Zq8T_eh?1S9h~F+$%K zX2(vjaGBY8x+gsA6sy9nw6`3+f;_^6mVV(G8F00YduKCb?I~PJ4n2&yV0a$2Ba&ZI zZEj}w^^kLC0y*f^`n6J8TE0rKCLl344rCIRcv7b**B_Gz^9$2q;6AUcX40s-1@I2rE@MCKFa!%WJQEcggCmQ4*F@SxNCl5m|l=} zsq0aPhbaAo1x62)F;JLB`EW~VLdltF!v?>-Q0?8T8Lep?NPagqxIF;D7JA;yIR zN~LZUrA-SR>F^lWeFCMPh8rr!$+CTQH7eFjd;f|BMqu$Pj{;^c4!ts2>7gdLFDVX!8OoTC39eyB%=F4U*Goj1{ zzL~oK)s2Led|iS}ny`+Jn4sDC91kQR6?VN5GK)BpjWCiXG#>`xLXZh@#P>Bf8avBq zJDKGU$*2!TVVSBSE;pxYFBEdH3i&9PkB_LSzJj7!dm!M>aA`zsBS4(R&ve+gWEauP zswsx{IyC3GFy|7}>so29f@YfSl~9S7QVy!C+^gO!>5?*n*cjKn($0I%r6U=I)i+Tt z46$tF^}|x&7A_B~(3;oIaKi>_K?C zu8m2L8(gaQU;BRCo=R=k4=O?%x2y5?0)>6=OAbwqTj0_)=nY?2XXu`vGQmzih#WosP1Km6Z)R&zJ@l2gvPK}7TAD1$b3ma z4^vxSm~xCsFwOwgM`X8#znqU0v}YdCg|)4$?SdzdKM&jGLUK5 zJOOUIj2rg&;@oerKdN^=f05O0NPOF9XFzn_Cs!0^M|)r!so_USG*>Xaqy9KXP?rhS ztx_!V&!-tK2hg1MC%jBlmIs70ku5 zW$B_S6c;n4+C+U$AR1Zzu~k$;0s(%bvAM#!^Xe3sJ8U6V|H7$+o?n5=mPHiS#g9>1zQW&)z_GigPg5> zk+WiiVL5PZKQ3rJaHQ2fUdHbm#ul(ny+MuW&>%GTbdMG<+!PP~*KHV@IuGdEeKSog z`ljk^SOI%;Te|e+uLHU}@X^=2EI~M9JEYM|rCP|uh}1;?1ly?+o7KpH<%Aehj=}bG zY(v_@-1wiD*fvkH=0SKB9!*fNRM^+=>Jx2JKODd`M6T_ikE8pXDD_^Yl+|AUp2=l7 z%0+6vWd(Seb=>*k0^1h{Y(W|qW@IE^!ubtEW%Mp)-u}>EF6Op7DS6z#KC$>K;V}PO zh^fiBm%<*zjm0{`iL;3Y??=PCtt10)`+Hcc=mt2)(@2?iad7XGPN-;kfx=*V?SU|z znrA9@aJ{G=OOZpTW*cLSmp_}9zP5WYs*Ih)-c*$=AD+GUQjIZ< z-K*=_c()a~ENyD+S`na8piyvb)j8U-*wb}!yH$H{jDr~*FDR;Nl1^ekMouuo0@HY7 zr8eAN=V}Lv0VjALgW=Pr4$5XFGT6lD&~rEM@r!b zqF_gBtK^z_$Zls7m-yb8AO@@sjHOh$97u!+&w12@&xAZIo0a{RL2SOji<~W+9)AXY zY_d|^VOj=V7kqZ^UcBi=AdCk%L$q5^Uu0|t$D=D)K#=W|09>q@aN7BDNk$Q&V;L1r z80d)Ltr({W?l0||g)xUt(DbM4~SM|MG$1z ze7LkB6_ka?(+HOsl}K-$*Uc&%+a=XR;|8Yp>~dKZHb?!6;DUiy@am(*y`Dg7F_b)6 z-2=?{6?>>#n}n2NM<4t3nn32fgJU}rZJxMre3*YS@Ylq+wao0c>~_lnWs!;EOayl{ z*t#_dQs13`>b&|aRQ;c*WUZ_Q^?Tn%tPn3)8GwbUP;8^;a4cRcjj*`9ZF{F$Un!J9s>8swd4EZmD}^-+Zi@ z4eAo@apR?NsXI{$L-JoirEVq&?O#Wp>zKSKd90E83b(lH!|<(7umPydfMD!W!Ah4E zv@XGMDCkW1e4C1^elN7=Aq7LL0J9f9N!tr?e{9Ds4MH$c7~N3e76MIH>8Y&RH`-q;JgGQ{Q8@|@6Pbx49R+)=^ zRUua=!_o};$1j&yItlgq_$*}I2{3gcDu8gX_hzTOW8e8k+yp3h2cFK)NkYy0iUx5p zaj7Vzo{N&;WTeuIW{xH{DgSg_Z+=7{% ztDo<$7gsY2xS$hsnl+g>M{{z}DHZo!M$%h6Bo zh9t6ug(pyTMFWo>=i^frB>i>Y`EKq&G3jK)%J(m0%1s`ZvIkoM>XnWxLwnJDP@n#? z6g6?Opl-pPj=N&x`!3}}ua zqHb)5wO{Z)6UoU(Q-AcHl^I-mz&#hciT6BBS#w_9hh4d_AO&gZcGPOn9}G5KhzM-@ z8pUtlEWwkt4;&ZUT}isgQc0FPpayuqs1w2(IvX?m*FljgEyBhUmQX5aPs?DJ(4;Z8 zT=ZbNF=h>+;Z-&LHb41{beck~f z?r0vn(VaAUMAU|O)3aIm?}#;&pN~~~qmxoS;r$x3M^wrO&T7^GwRX3Iy##qnp0b;) zh?iE@KgGr?DND=+i>m*>zF(+XfcH(e1YXa_)@2~quqV=*^E;K&bZbuMe^%Ec=1F-S zVS`m-6@(WI=2X4jdS#W?&(%59_g`v8ZnKs~sXL$W;_PENuWk9GBFN7jPT>?J4o#7> zyM4j6%SN!HvVdIoN=;kYtJ*_bv9en?@I6eC%H7TOTEv-Qam&MAMjqYvvMCJt32(o- zll0WxJZD?1|{y*h^>-S=Zvbd_EEtTGCUcnZzHW+X~Io?6eGuWpPP0_w7 zxz%Cfv2L(L{wG-iqdk4~Th-j)^Y)DGx|8|5G9^1)dWp!KtBP+Fg8p99J6|z-%-;LW zdzU}(|5~`}8UWOU!e3pziYX{KASbKkRDpc{tOEH+WlZkh%^jH&P91N!?jY-_i|f$UR9HzbyjFWQR_TK*s@By!KepL${Irj_$Pr6H#? zqOB4(3|^-yIYZ?-a4Xm?^j7f0apdRUHf}pyxl>e(cmzjORhMTC5vFbLbtC9~oNMg& zp=Sq%8684Zw_){A^`ePtPVI^o6>)Y;;M;NEMrSgv~Zrw-1er8&s+TwFs|(C|25aL}@l zb8Zug{f1x8A@3A(L`}L>K6>(Y4lsm%VBBVTz?p<&|APHmvQ*$uj#4W-c~J>+)n)C1&7rDK5_y)MIYN1@`xgTfNtwoK z2W(fvW1S8QwrM*yl_e*t9s^2Rb~Oih>uqiQ>fj-tUi(QRF(^2fa{G45yk{`nTd6zo zrQadwH_za#^?-p_364v)cmL_Hi-G|!?yU}C4Ak^ws!ql#KnWj}T$Lld;LtlwW3O!+ zGH)HdA{X#_;>?v~2hIUG_T#TB$Fn2?uX#2XEgXq;y4B~~atqjmHhy%cDfw@Y_Y@({PdINHVO5syZ;$=OYE-Xt^c3_GL%t&>wBMXZr*fv zYa6k%>kwrW49wLZI`8qzkE`AuycN9X{f}{rw~H+B$9{Ob8)y)L(sTlM7&8S@(FOkaKGEHd;<5bqyEHtjhr*r0n-17}ic-tf6G_Cmn(@S$ z!CH9liOqT1W=D=an)&qXD7~b5Fe8gMSTG|;jX7$_U#8D|^||J)KXL~izWl9orXWAN z&=Ciyi6$e;V}?=uSvsVVO|Ae%vba7t!GwKS7fT&w8UF3_OFKco9B`~&L-NUWLb}1O&|6q)${-*Cz+e&)DJW{x(%f%C#ExU{R>qZ5=I;R>b@xt#6*g{w+VaBl-@MIPU<+j%rk9*++>Kj5mE<0 z_XQ_{e%)nl?MGKC+y`6q3Xcwo(5dL3QVM<+W(a|S+ehC&>01KgNG{Kt*|kr&E$4&{ z$*UlpSf`l^U4{>JRUe<>CT72W7w!{*i|&nWUey>$<7HkM5ob$jt%W_B&*CX!)=sTv zz)D*b4FxwneW8LJ?!m6whoI=1$RvK&d`vzAG5c=xNab!Zdz95$1!(1^Ym#!Ml+pL! ztLp1nqQ09M514ycd#;$cOyx_nqt;H#CC7ROlQUr;&6-_Z(H&_)KT$Q>Ou!O>;-2f` z?W3(xLoJPlj_o1&r9(*WP*cO5 z(hvz-S1QRV&6ilAQMXd#1J_#G-S*`$yf1*@(GwLkbQ`oDx!^qUqApWdhdZsIulrI7 z-n9fQkV_=)GpNHSzJaHgj*d662B(ZBuVnbaUB|*HY?baM+&SdzM`j7Qe^oJ zl;v}rEhxH_iDf6}h-t^}rA}C$hato`wQ|?$SEf~Bp#A(v_$-ZPicGMvp#>SoC#^6p zIcuxYDqPJES+9>G`-YuC;U&vjmB=}>rNq*O75R&BY=RTVHgyb@LzQ^QTT%l4;-7pr z{+SuBxF~g{g^DhDW;sITl}PAAg9Gx-2bFDQLP;vwGl&G=5_)VM}O zkO9}WL@^KS8WdQ-dUazd(ScjkXCu-dPri!kL_O~MFcLs^#D~1n%0T*wSZDn9$=n<8 zQ``kw)lE<@w&%4=jpA)WWY$gUGB50R3avEu$xD7Y);t;9D-=wSBzc@ z6^#Q7lpfYdq8kLAS>6iSzOReSY!qk9$1fe=Su+O}ef(#) zCWNUp<7hTd_1IC_R9kx&+qGD$zE2{S3Tnav+A_S57-56JDQvjarcp&ftUfpCh5f3z zSVJR1HHmRV%$~UI-g}=)LhX0PG=~kOrLKPuqAT;>x88vMo{({|+O}UK2r03iW@8K- z9(>ZT;c1MWtg|r)i*Xw<8+e6{RI?)cHEMnsyfRZ~hm2%-lkfCdzJ&)U=7Vv^*_mVb zN`BRl3|*9e^3apnMT#2jP1)o+CFB%wVDj*%jB0eQZ>?Au=v8QYX!c@VHUR6GS^MZw z$<1LzGh^ahFe_&>no5vgUzfgYMzJFkSmt<1mV6@!^J(q1hF@cK+B|eQ4XwqZDPkSv z44LP>C><16<&0)s543};Ju;V?evxAR8ClhC$bckZI%xaJxA|d=9d1KysJ1G$tl=9i zIaooWWgpp)*%WpHvIcmQ9Zq*3{<^&8a$V8m3>ZOVSC`P*p(bhtln(PT`E7R^ z&l^9C9G+mk6Pt*pSG8pc#%v0)@aoH7U}`s=>)4vA&%A3;E!otb49d|?yzVmvRx}$onzFe zJ7vK&4pIc7I~K~C$S%LZ6iOhM2V}NPIhCfb^tX=xLbIv^X=D3ft)-R?d2UG0;uXS6 z75-;_d!k_o;j%SCGIHrupHa|A__c7jhg{%`_*$mfo4_D6q{OnVuD_Pfy3l<_stOwA z!cGDE9MpxJ)_W+9B549*~!!0|xobV9!FyR#Y zwnJm>bJ`R6c)J&A3f4G`V0UK#JEJ$mAhp_4`*CfX{MzaO{05c8DWQFIz^=(KO5r3$ z=s@lA)7n4Y#XcuGi8 zK#>;P$jSu$IH+uF<+HylF%K9Fyq#m3UKKAT1)oPV^knEGN7TV%RU-7 zJa@D%uAMjSsFiv)g3VwG(&2>ze(z=PhpF-2*A0?*YeMWP1SzDS{8McG@8jSD^6tU|LP;%k2`uy+#;Cb?AQF^ffsr$8(iQz{4ES$@TgS2a;8)vai zqk8(4zO&6*#ggDHG)b3Zk@NaCG{*1eM^`Hjor&H8fUDDng!Ui`STJaQc8Z2tDrwrs zc>eJxXgC|UA2|7oOPT&JZ|6Qq`VS<0RoXjros(PB@+3%oYgXW!ElP1OuzK*A>n0{v z&59i$w8?s8IOQ3vTpOMFNTMWl?aAu*FCUs3E6SVyok#CivIkdw-RO+1AN!t-0OndY zdt*N@kwyc5b|3Wyenx+J>|38czfDZK?}-RxX^_ru+XpdvrXb=T)U#8aDy*@Fwrd}( zeXw9m)>?bZ%p@jIJ$taUw)TMNkcWtGvB?O1idAhBN}8^JQHlC~7!rn7Ftl6C8u)is z|4&T-{JSXl3ARN{`tXlZvi42qX&PKB_BlD>3xy{rfU?Ko1LYs zGdYVU4@T%ix?%zAE7dAAc!cy4MpP&TW|&0ZNV^v@>s@})K4+AirVrOk5n?nWN^t60Qs z|D$r*g{fwCa?Ze`@%&=<$X(rj?f#X}_oK~_Ak~8W`i-Z&-LqLcB_`;Vv#kfuG;WKH zf4L#s{yQQ$y9JY#^lEf1$1&@VLIZ;10VG`upKxa0Nd&w`q+w5N(AaLv{Fr7pWi*cV zMY*XW#>);?kYB43i}3*RjI^nenl;dkC&709p9H^I-~C7N_P^*Uu?;c2q^NUvgSvP7 z*W?r6v&qkmjsRA9{t-Tg14D)`gjNGW+D7T5aqG~njWYPw-|9$vU2rbT5AtjBx#1PFSwkmPha>a{7>tvZ74_2P^zf8{ugU~-v?4{lX7pa%M&lWO zX>$|amE5{1ZD&VITekQ92p>cdDjLJAq)S4=E{_Z!X%iVOR;l0N0a{P(LrC=}p0c+m!JG4g;}_tXa<4m48bhIrx&? z&;6RoFe8hdA8lSv{UQ?Jt=MEV_+qk&kz%rnnesoR>;L=-Y`+`(DPDv4VuRg8m!yq6 zRRG7Fsh|9$OE2>vm-FZ9H4sy|X@z#8(cWJDn{M{M71Wvs{;#WP5x8FHDB5lB%Kr=5 zY}rY~FaM(&1#lQpl&vyhZj9#naJPbgFPgAmUXGZn&6o9hoY_%TT~$u#?rqcc4vJ77 zpbr(fCXgnJhfdOm=pErj7kd|87_G02H+3^aF0G{l$;vFEnyjsk6{stTsPMOHMI?LR ztEkN6wyNUVQPV>Y%i~7`u~}i?*bg6L^{b}X(uyYollV7e^VM=g64Je0EEy*gcg5CA zqy_{}__S=`QJnrM@)1-1G>B0Bw8MDq^M|J7!TA`bVeha=V454${0$CS3UoA<|)kV`?r3mT%FD{R_EM8XfT zw~`}|deb{Nc6V|#aI@VmT3dOS=cfomw_%9<=mYcC+ym(2CgUm5k+TWoH=fwyMH{{Y zp{6ofY0YuCL^1y?2%4XnOb-QDAQw3S0QoqdwcZA94KY=3C$C>{sP0^~!CLZgE-Zty z1bvvs71{bXE`+|98peTzyMol-!wLeJWDT-6`Pb#TUYJJ*=3~V=hH3K)>j2l9GeQ|n z738tN|6O6WK^XRk{X3BqWr^AwDM}|`4x-G}vD8JYY8pKl*ZjiF>)OZ9`vY=aG%XDJ zPTbVCN}aCJl=lWA*DwSaBgw9bc>*wnOO4;8#ZM>n2@TFE_bJvLLQ{OCZyxbMBP z$2RQTg!sQCmG@hYa=)xDK*>soPbnNkU$r{g6Y7|0Fj3}7^O-t@@rY`*+C zuBoHowO`!*V52@6x&dRnOK>wMkGqSd)DIR!?flTE9(HO=iv_@2qrA9FVow$`Zydqp z`vqH@+_-kgS%lxKRS#Ot{ug~a5xoU2)Y2MTQ&6tv%;6%xZ zq0g9OPCjCnO`(bnQfPJ9j4v>nQEG!mx9dFAI`PnC{s0~MH4H<-(_&pQ&q->1mQ+LN zQmA@3VIs`e2UhL`C%gw_II^A0BTBCErQgw4MG@udt_{3w1E!=NG~wXK>GLtOypB!k z=O!>MP5AO^47l8d&O7|;(ZiE!FYb2zw%sqMN5_5(0TQrttnAA89t@%9OvYR2Q$5wg z2aDZ01!=RH9=Ny77Jo9OF+MZ>-|`VY4+%Krj=CpMAMy&IfgdM%tO>TaGG z-Us>eo9tju**pKJu}8|~N6iyGtA|5j8$9F3K;-m)vW%OOo!Uh__jik%W~3l-T>Yop zii>csRcY!3C_BkyFe$%|oT#9>-Z5*TL9oG#GKjlg_x`5Di%CT|4=-hN|Jt!bG`F8p z#gp%wnVh**n75U=k!fr?^{=AjO!{i?ozcxBRi~tXpr7MOr)@>327PXLYTCAAim>4; zll#n$1GS=#v1{!@vm7_5=1W{LIuT?-6e%glCeC*S;U6n@SmHA}1@PyhQCz`V7|uDI{(l z4|5U4em`B?UhBcE*%IDVKz6scz7aiO?RAvt>Rd!4#wB_x_gO7cgrwWs4*bYrPf16~ z@|l48WEEC)qFoAfg3~nms`CL!AuTHJ$`hF2xn3J5Ji;3S1jW9$c73!^k<*YHkr z4!!IaIKru_wxzFbrWZe@?)m|2hNSxxe*8SGT(RgV=NfM`I|0gREzifI&LY~JhLe!| zfsxYFqC#Lp5C0N+7i}~Z;$K}+C5|^7m<{{>|NnaL&IRgo3vE>suidp($_-CN!b`qw zX8+rt1?Ri>Z0Puu)DH!2{QDPzIt;+=g_9lRN8s9*J0jmb>F{Vd}wrcwovxP@hDu7D9gtkd^sM5AkuCRuc%@7 zU^ov$U7lf&L*W!%x<@`JUShTgSROuqmK%)nI0*@DT*{iaL5L(Iq9kleNaU&j6aF8d z>Elu7`R}$$dDhq0m%dgCcs+mk`J}FX#-#V{17ft{Z3p$k2L|vvWWFecvGwCSBqLGs zMbSSelCsogoFxJ;^L;)}n^f!;Q@)n@DX?*t^Xb!Lqgd6tg_VS+k(TXuw{G2(LenU5 zwHnwAw`apn8lu)}L@~}C2%gAu3aku|cwW}-r(M&fXB75gVj}L^(7S2OYL#4-Ch>av zx%Tj0J=A+u{Rdy-${NlM(&>I3NAqjaOBatAhudf`NiO|4SrlXwUo%J3RV~r4I^NZ& zFHR_Z^%=LFb`3-GB zM9G<3M_IuuMIb;tQGMEgOg@dV7?Y3sDCi5YrrGuoGvJG|l`o>E@UTWP!))y^f{v!g zLs6$&zCY?1FhY(^tPoV#;}8vcTA}KU>HoHAFZq-BPn#waPa@2Cm~>mXyMmC*oiieO zNa%4qNz6VlxDa!^_Kz-o`OxwGfzG#!gWi6PGaIo@%ZPO7TF1KqUhCg<+1{3kbDwbw(g6qD7^ zUrialv4=`G4rBi%bFdVGHiT=yehXak;%{&EwGU z2;soxfH$OGeZrUKiz62vWF&flkfwP-{^u=2>k)_wxgt?{DMxV^u9>MUAJw-%eW5?~ zn;br}v`&wOJ5QzdwPLg@pt|Ulo2`EwQ`U#GGblNk`NQVCWSV1zfvtYLwypl?FeS1< zPZ!`R*jrT|#cfepbyZu#onN|Q zA{7FJyg@pui)9O?ZtsxYE=#-f0IYtFniJ(JfSsFUe1lS&6pJ+L^n5T*; z&9w}aV`-76leojtA-zm}#BNq?n92WF%XJ1cm2GPsXJ8mXMiGgkARxsH0s#pMNJgb%^1(TRrENJ`KLRYDpi9~sr?V;ZZsEWxj2Y43F?*j={?Ds)=L~8 z)7UX_+ws8IyB1??TK3GHJw?Az>Vl;#@9I@MD#>1*0U!$&!V3_!Ab|k!XJ*~XseWwm}ZHE^R zx3FTaGhC<<3mIrJiu7MY%Ntxb0F2(u%K`kWD=&mB4vLjK>TCcuVX;7=+f=Fot@pTQ z0h7K0*}Vx^l;Rd&7%(icUZ5PHsrJPxT~ybMaJNCx(_*Z9TL*VH=uD9skyAF!))}9= zHB)xESS=kI?p>rcCTi8zru6iQD{5u$=7`vG`DnPFHb!42e~MLn4pr!I;qA1E+X9ST z9caMY)P*?;9$EC*_=NQS5wukw$Dwxzd%?4t1I{XpzUG8!M{ z|3v>IATU$s6LM?K3xjF}m!7pw>@rG}(LXqJO_!9N5mD&3Qry6KSMqxN9M(V5sx`Xv z8KE({GJ8+!(I-uMAn-?68vDRJWYKLYnHHD!v}i_&)j#nQw{H8}et>g=UQ0_~j5qQiCnRw3IGy8fY1; zn`8#OWAzgKnHtSU10>`#FP5!AOU%WWwHZA|%h6gcA9jtkkEhS(hHJJO$|Ut@Wm+fN zD6+H0x3ZoRCl;h~OnN*WXm@U6r|0Ooi*Fu$K2Lu!Zk-uPK6!WL_P#-W2MPDU=H*Mh zm0`NHmk^=M^T2~^oF;D-OAE5)$K4vn3$X4&R*}yKLb!UYemEX4{=7#9lElPwyYa7U z4{ydJ@sfMIkN6zIkXnxFaEnO>Y_}Fh>qSZOq_(L-P0!VZ(xWota-<5<%Fy>4Gmn5e zX(AwSC~_4#0i*f9i*&yc+K{2=++NVP_4a!t;cN$P%MU07egxk#TL8@i@5R1ncZr<# zLS1xSn?rqT)F^ke3Rm}s4Z9TpwprkXfF6ip6%4X(GaE3EYM-tKFpezK;CStu*}Hz& z5Mel%-#}FJt9n4V@`}$C5JmnM_~z|h5O7_0LH6-tl*p0shIwe~Q|Q*&wYO#oQxe*q znJd~wD&>pkyMEfR1pymfP~8LqpYYuaE|5JHXcX{Z3ZWiQMeNS2Zu=6?bma{eV4Fyk zZz-7!$I@nWUV(}<;2s0V*zpi=ws>fTE<&4$cXZLzECFbx1wrFc$-27@5JO7ZUW?Z} zt9}qWcmsr-UY*$W*Dp2#muA|r2Mt}!7IJ2aj9qcyK^}{XY{RkAA&#>rhy$J+V~}RO ztuH$9uOl4sEj+(RwfIvz2;5*CGQbd!`K5gWdCOuAX<;o2fqgKIx6^f_5XH38`j~jF7y>uEM;+$R+p3*?pQ|;bFJ|%$ixdk z5ObTpsax3c9PI76n(jEU#!IyeQzQbY5awNUQ?M-=H$MQl-5Ilh>znFrd;wm|vZ%$u z6`UEDQx@WMOCX$4lp6`Yva%!>AOXd!6o_AS4Ha@wBuk7WB+ zJ7y5H74N?3VHIH?9P0f-X6oz^qnsBXp4=-=gXJ-HtvU+^OAbUG9=X=~d#ww#wvb-HK?HSJ!g(Kb6ji)D1VOpw90sVB z_n`;dqkr$7ZN;)1bEZ;ytX5;D+miLNSh<>Or#)MbEN{1|!$ce?**NXwI;r=_FadoCD)Ed0lg5Ua@PFXii$rZjgR! z2ypAjacX&N3*kS_vMXl2M*#`zOgH;<;AIQYnqi|7`N%e7q0reTLj__svLQAo@;3by zkH>W`c2l&{sB4d*ITb83J&~1edL#P)FtGCA>ifiXQy8;us_C!0v~CY)1H*jcp-bh` ze}jzb#8--Pn$s%ZTkP>)gOwf4pgn@0fki}fI!lFZ#VXnS+VnQMuF*1egogU271JCi9nm z{$ks*lq}vP6u61`vO7&MqIhlq=C*W$MF0}tNX&I4OphKH@!XP}P5u4_YekqljNV== zjx9O^4_`(om>`Si$-fd4k9e|j>)I+Qq8>F1ZYwU;_DK#aD5LVEUn>kZ-i9*qbiOHceHYP$dm5G?qA26T0YY&YqQ+7 zSsPaicX*HMF$fs05XQCU{=Z_*>%P<_`39UqjhW6|wFo&b`*GE(KlgXZ3Tda2`fMjf zxq~`OLaAn~?a!rhPvbbp%@_h2AyK~!1P4k{EZoH`U8|H-IHxW8l<%K4O z_3IwrMqjhlp<)+-_)i%q%Ntk7MbxN}CiQD{j-lJr@+0FiEv`xW+*7hM>3_ISg`NyO zQ(Af*e3}(nhCs(h_JoQB)Ni&3Sxlqy`Qn51=L^f5ESgeh^e7@WJ19T028K8Tl-#qG z?I=WxDPTaKFr-A1-r+;?Lkc~&%#(3|Np)r)+y8K#kCY0lmCJG%O1)Aj4Ls$Y1ZXn*~o(9NV( z@H6PgC|upIgUOQR!A+;8LL*W0{1-zbIg&mr!>0LFUA4-D`bNaI#;Eq-(_>OL_j}B_ zb3mf#S^2ayz00@y^aHcCqx+f6T#dZ_Bt}&$;ECQ|$V_aD{A@DbkApGpNVw8U2Fm&; zrX96D6_F_69U6lw4keH9wQ&OSP|mpH1S`QPTK=P9L8qF!vq~Bz0TG_k0k+&Lx})i@ zqpT)P889kO$WHTglg*Ss_F}rwb=5qr9q@ilx>{`;N&(RTG%y01EO20~xV3x6;d6S1 ztjI%A@7pf9yFXWfmR?&=m`vf$jz+y-Q{%rb<0Knlu9_`PjqI$h4ybQuUU9HhT-eOk zr@js+o;AdURIAy&^e?Q6dK4YM{JkdP7v%NA9R|-)1?`bhIsq?su!Q{1?aP(u@xG@x zb1z*qKmhhasON{f-Fv5V0;slh>~~6$voq*_RI+(N@Z<$SODO7j=LxB9KGTnF{+$cU z)>n0G6Os*8Q`9P|)t&^(YaHRvxU$1HLe+%lLZShyx*GCbbkE|S0s$Sd2z*AsIw z{fyDab1+SX)2nBp3+%kbG%~u*E7ej`t4L))T=8F1SJCT$gF(Bw#UP8 ztR2#C-kc)fcOYMQn@E(To?8b{ZaQm7`H7@IW6h;Q@v8xOf#QNMqnZ=hC5dznkT>&d zQi-~R#GRkTx!PJ!VjP@+L|vFoXdFVb55i#mkt2lOaS*OfsA=#1ER&0Rbw1KfPsvZ; zp`8+=&(>KfUG-@m!O)AP5sqn#R|XhnW3K@dV&?*)f|(*31K;FC8C-@Va|M|=1%@#{^Wu}kZs|t@v!1taKw1`TpZa2aRaQQoZrl)l3*D}+;@|EVSh&_(bW-o z>kxq161p2q23AkvxP#ua;jnJUh87DBzL8j3_Q~(J7#BR8_}vT zXEJf^I{d^b|A(WR#p5vfl(X~3?-Q2GKJDJTvV?n^m9I@y z2Z&sJd=NpigWa5M;GaDd?M-Ebj5~I(aoa3{U0p<$8e*kF#+2uZX7G$fw#NF^e&ESk_Rz^E!167CXQ|7wK&bQe&LK{;m-o<+ImqN>UaWi zz2(o{K>u?;{+n`y2P0?DTmyA%Xc@r??y1$9tN=ymt#Ku-SwXTcRwnP(i)BISp45Dk zZw5`lyoI)Wv~niOol-vQYowhe8fAXK#fmzzgiNiz;&7>ChcuvYt=|YVQC6oeY)De| z_JPo-h>`%y!hrqz>%{UPWHi0ghlL(+Lk84VpK6@y1%4BS54SygZM&%%$K1& zi9;mO1^S#u9mK&ZJJuCs{C~cq;6orOk?a5h!uIr1)ms4p=(Y? z1#=;5`2yQ~M|Y{)xGss%-i7TaYv9uivjQHdK3SBlmA1e$LghY$tSYAX!zadG=#?Bo5}DV3{CdZ)Zb2TlXEznx zecVhw%~E2irlP95>$+bxn_o?OU$N(lwVX8O_s!rY9cvpu2{P;1F?66yBqkLY^wmm! zj29!0B|pyJy1gUJi=_!hXs?Wa8G1IR5GmyB)Q~SV`w!^rTzo7j3biqa_XRGOZR+~S zz75QbNI7RX=7_-IUF01yvYaV5`Iyq3&`WrIO9Ufj=~=m{m!8@{ z*yw(gFTRJ^Z4`e~DiCb&b>mvU|Eub}+T)PKLfAbSavv0mcfqjkgPpOXKZHE-gz z0K>h@s<-F~`>MVEqtip3g*&_!6p@tVGvBQt`^}!k!BX;C3JkH5FB3s}LEx)iew!b# zb6yMBKY!{*lvnTycFkY=`KtWCPqr{m@Y|uGHPKMG24OW0Gfvc2p5q-eXHFO$&pvkL G-hTn(D%RTo From 831708343307203163d12b14e3b67126dc1ebbad Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 24 Jun 2016 10:47:24 -0700 Subject: [PATCH 12/69] Updated to match the SCCM topic --- windows/keep-secure/protect-enterprise-data-using-edp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/protect-enterprise-data-using-edp.md b/windows/keep-secure/protect-enterprise-data-using-edp.md index 1603119340..abdea7db70 100644 --- a/windows/keep-secure/protect-enterprise-data-using-edp.md +++ b/windows/keep-secure/protect-enterprise-data-using-edp.md @@ -60,7 +60,7 @@ EDP gives you a new way to manage data policy enforcement for apps and documents - **Copying or downloading enterprise data.** When an employee or an app downloads content from a location like SharePoint, a network share, or an enterprise web location, while using an EDP-protected device, EDP encrypts the data on the device. - - **Using allowed apps.** Managed apps (apps that you've included on the protected apps list in your EDP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if EDP management is set to Block, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. + - **Using allowed apps.** Managed apps (apps that you've included on the protected apps list in your EDP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if EDP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. - **Managed apps and restrictions.** With EDP you can control which apps can access and use your enterprise data. After adding an app to your protected apps list, the app is trusted with enterprise data. All apps not on this list are blocked from accessing your enterprise data, depending on your EDP management-mode.

You don’t have to modify line-of-business apps that never touch personal data to list them as protected apps; just include them in your protected apps list. From f81b48df5c92798c9cc048796ffab4ed8fe65e91 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 6 Jul 2016 07:11:48 -0700 Subject: [PATCH 13/69] Added intune changes --- windows/keep-secure/change-history-for-keep-windows-10-secure.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 812c222e48..656a34637e 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -17,6 +17,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |New or changed topic | Description | |----------------------|-------------| |[Create an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) |New | +|[Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) |New | ## June 2016 From 34ee0febaad3f26964e438ad0d80d87ad6232f0b Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 6 Jul 2016 07:13:27 -0700 Subject: [PATCH 14/69] Matching today's build --- .../protect-enterprise-data-using-edp.md | 51 ++++++++++--------- 1 file changed, 27 insertions(+), 24 deletions(-) diff --git a/windows/keep-secure/protect-enterprise-data-using-edp.md b/windows/keep-secure/protect-enterprise-data-using-edp.md index abdea7db70..851776710e 100644 --- a/windows/keep-secure/protect-enterprise-data-using-edp.md +++ b/windows/keep-secure/protect-enterprise-data-using-edp.md @@ -2,7 +2,7 @@ title: Protect your enterprise data using enterprise data protection (EDP) (Windows 10) description: With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. ms.assetid: 6cca0119-5954-4757-b2bc-e0ea4d2c7032 -keywords: EDP, enterprise data protection +keywords: EDP, Enterprise Data Protection ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -18,34 +18,34 @@ author: eross-msft [Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures to their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. +With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. -Enterprise data protection (EDP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. EDP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. Finally, another data protection technology, Azure Rights Management also works alongside EDP to extend data protection for data that leaves the device, such as when email attachments are sent from an enterprise-aware version of a rights management mail client. +Enterprise data protection (EDP) helps to protect against this potential data leakage without otherwise interfering with the employee experience. EDP also helps to protect enterprise apps and data against accidental data leak on enterprise-owned devices and personal devices that employees bring to work without requiring changes to your environment or other apps. ## Prerequisites You’ll need this software to run EDP in your enterprise: |Operating system | Management solution | |-----------------|---------------------| -|Windows 10 Insider Preview | Microsoft Intune
-OR-
System Center Configuration Manager (version 1511 or later)
-OR-
Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634.aspx) documentation.| +|Windows 10 Insider Preview | Microsoft Intune
-OR-
System Center Configuration Manager (version 1605 Tech Preview or later)
-OR-
Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634.aspx) documentation.| ## How EDP works EDP helps address your everyday challenges in the enterprise. Including: -- Helping to prevent enterprise data leaks, even on employee-owned devices that can't be locked down. +- Helping to prevent enterprise data leaks, even on employee-owned devices that can't be locked down. -- Reducing employee frustrations because of restrictive data management policies on enterprise-owned devices. +- Reducing employee frustrations because of restrictive data management policies on enterprise-owned devices. -- Helping to maintain the ownership and control of your enterprise data. +- Helping to maintain the ownership and control of your enterprise data. -- Helping control the network and data access and data sharing for apps that aren’t enterprise-aware. +- Helping control the network and data access and data sharing for apps that aren’t enterprise aware. ### EDP-protection modes You can set EDP to 1 of 4 protection and management modes: |Mode|Description| |----|-----------| -|Block |EDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing enterprise data to non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.| +|Block |EDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between apps or attempting to share outside of your organization’s network.| |Override |EDP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](http://go.microsoft.com/fwlink/p/?LinkID=746459). | |Silent |EDP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or EDP-protected data, are still blocked.| |Off |EDP is turned off and doesn't help to protect or audit your data.

After you turn off EDP, an attempt is made to decrypt any closed EDP-tagged files on the locally attached drives. | @@ -60,30 +60,33 @@ EDP gives you a new way to manage data policy enforcement for apps and documents - **Copying or downloading enterprise data.** When an employee or an app downloads content from a location like SharePoint, a network share, or an enterprise web location, while using an EDP-protected device, EDP encrypts the data on the device. - - **Using allowed apps.** Managed apps (apps that you've included on the protected apps list in your EDP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if EDP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. + - **Using allowed apps.** Managed apps (apps that you've included on the protected apps list in your EDP policy) are allowed to access your enterprise data and will interact differently when used with unallowed, non-enterprise aware, or personal-only apps. For example, if EDP management is set to **Block**, your employees can copy and paste from one protected app to another protected app, but not to personal apps. Imagine an HR person wants to copy a job description from a protected app to the internal career website, an enterprise-protected location, but goofs and tries to paste into a personal app instead. The paste action fails and a notification pops up, saying that the app couldn’t paste because of a policy restriction. The HR person then correctly pastes to the career website without a problem. - - **Managed apps and restrictions.** With EDP you can control which apps can access and use your enterprise data. After adding an app to your protected apps list, the app is trusted with enterprise data. All apps not on this list are blocked from accessing your enterprise data, depending on your EDP management-mode.

You don’t have to modify line-of-business apps that never touch personal data to list them as protected apps; just include them in your protected apps list. + - **Managed apps and restrictions.** With EDP you can control which apps can access and use your enterprise data. After adding an app to your **Protected App** list, the app is trusted with enterprise data. All apps that aren’t on this list are blocked from accessing your enterprise network resources and your EDP-protected data.

+ You don’t have to modify line-of-business apps that never touch personal data to list them as protected apps; just include them in the **Protected App** list. - - **Deciding your level of data access.** EDP lets you block, allow overrides, or audit employees' data sharing actions. Blocking the action stops it immediately. Allowing overrides let the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without blocking anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your protected apps list. + - **Deciding your level of data access.** EDP lets you block, allow overrides, or audit employees' data sharing actions. Blocking the action stops it immediately. Allowing overrides let the employee know there's a risk, but lets him or her continue to share the data while recording and auditing the action. Silent just logs the action without blocking anything that the employee could've overridden while using that setting; collecting info that can help you to see patterns of inappropriate sharing so you can take educative action or find apps that should be added to your **Protected App** list. - - **Data encryption at rest.** EDP helps protect enterprise data on local files and on removable media.

Apps such as Microsoft Word work with EDP to help continue your data protection across local files and removable media. These apps are being referred to as, enterprise aware. For example, if an employee opens EDP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies EDP to the new document. + - **Continuous data encryption.** EDP helps protect enterprise data on local files and on removable media.

+ Apps such as Microsoft Word work with EDP to help continue your data protection across local files and removable media. These apps are being referred to as, enterprise aware. For example, if an employee opens EDP-encrypted content from Word, edits the content, and then tries to save the edited version with a different name, Word automatically applies EDP to the new document. - - **Helping prevent accidental data disclosure to public spaces.** EDP helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn’t on your protected apps list, employees won’t be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your protected apps list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the business cloud, while maintaining the encryption locally. + - **Helping prevent accidental data disclosure to public spaces.** EDP helps protect your enterprise data from being accidentally shared to public spaces, such as public cloud storage. For example, if Dropbox™ isn’t on your **Protected App** list, employees won’t be able to sync encrypted files to their personal cloud storage. Instead, if the employee stores the content to an app on your **Protected Apps** list, like Microsoft OneDrive for Business, the encrypted files can sync freely to the cloud, while maintaining the encryption. - **Helping prevent accidental data disclosure to removable media.** EDP helps prevent enterprise data from leaking when it's copied or transferred to removable media. For example, if an employee puts enterprise data on a Universal Serial Bus (USB) drive that also has personal data, the enterprise data remains encrypted while the personal data doesn’t. - **Remove access to enterprise data from enterprise-protected devices.** EDP gives admins the ability to revoke enterprise data from one or many MDM-enrolled devices, while leaving personal data alone. This is a benefit when an employee leaves your company, or in the case of a stolen device. After determining that the data access needs to be removed, you can unenroll the device so when it connects to the network, the user's encryption key for the device is revoked and the enterprise data becomes unreadable.

**Note**
System Center Configuration Manager also allows you to revoke enterprise data. However, it does it by performing a factory reset of the device. +## Current limitations with EDP +EDP is still in development and is not yet integrated with Azure Rights Management. This means that while you can deploy an EDP-configured policy to a protected device, that protection is restricted to a single user on the device. Additionally, the EDP-protected data must be stored on NTFS, FAT, or ExFAT file systems. + +Use the following table to identify the scenarios that require Azure Rights Management, the behavior when Azure Rights Management is not used with EDP, and the recommended workarounds. + +|EDP scenario |Without Azure Rights Management |Workaround | +|-------------|--------------------------------|-----------| +|Saving enterprise data to USB drives |Data in the new location remains encrypted, but becomes inaccessible on other devices or for other users. For example, the file won't open or the file opens, but doesn't contain readable text. |Share files with fellow employees through enterprise file servers or enterprise cloud locations. If data must be shared via USB, employees can decrypt protected files, but it will be audited.

We strongly recommend educating employees about how to limit or eliminate the need for this decryption. | +|Synchronizing data to other services or public cloud storage |Synchronized files aren't protected on additional services or as part of public cloud storage. |Stop the app from synchronizing or don't add the app to your **Protected App** list.

For more info about adding apps to the **Protected App** list, see either the [Create an enterprise data protection (EDP) policy using Intune](create-edp-policy-using-intune.md) or the [Create and deploy an enterprise data protection (EDP) policy using Configuration Manager](create-edp-policy-using-sccm.md) topic, depending on your management solution. + ## Next steps After deciding to use EDP in your enterprise, you need to: -- [Create an enterprise data protection (EDP) policy](overview-create-edp-policy.md) - -  - -  - - - - - +- [Create an enterprise data protection (EDP) policy](overview-create-edp-policy.md) \ No newline at end of file From 36d31e4aefa148e28abea056b2b46567f6713e0d Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 6 Jul 2016 09:36:44 -0700 Subject: [PATCH 15/69] Updating text and images --- .../create-edp-policy-using-intune.md | 574 +++++++++++------- .../create-edp-policy-using-sccm.md | 6 +- .../images/intune-add-desktop-app.png | Bin 47883 -> 0 bytes .../images/intune-namedescription.png | Bin 8789 -> 0 bytes 4 files changed, 353 insertions(+), 227 deletions(-) delete mode 100644 windows/keep-secure/images/intune-add-desktop-app.png delete mode 100644 windows/keep-secure/images/intune-namedescription.png diff --git a/windows/keep-secure/create-edp-policy-using-intune.md b/windows/keep-secure/create-edp-policy-using-intune.md index 15a048cffc..8d593d6ed0 100644 --- a/windows/keep-secure/create-edp-policy-using-intune.md +++ b/windows/keep-secure/create-edp-policy-using-intune.md @@ -27,319 +27,433 @@ We've received some great feedback from you, our Windows 10 Insider Preview cust Note that if you exit the **Policy** page before you've saved your new policy, your existing deployments won't be affected. However, if you save the policy without reconfiguring your apps, an updated policy will be deployed to your employees with an empty app rules list. ## Add an EDP policy -After you’ve installed and set up Intune for your organization, you must create an EDP-specific policy. +After you’ve set up Intune for your organization, you must create an EDP-specific policy. **To add an EDP policy** 1. Open the Intune administration console, and go to the **Policy** node, and then click **Add Policy** from the **Tasks** area. -2. Go to **Windows**, click the **Enterprise Data Protection (Windows 10 and Mobile and later) policy**, pick the EDP template, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. +2. Go to **Windows**, click the **Enterprise data protection (Windows 10 Desktop and Mobile and later) policy**, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. ![Microsoft Intune: Create your new policy from the New Policy screen](images/intune-createnewpolicy.png) 3. Type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. - ![Microsoft Intune: Fill out the required Name and optional Description fields](images/intune-namedescription.png) + ![Microsoft Intune: Fill out the required Name and optional Description fields](images/intune-generalinfo.png) -## Add individual apps to your Protected App list +### Add app rules to your policy During the policy-creation process in Intune, you can choose the apps you want to give access to your enterprise data through EDP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. -The steps to add your apps are based on the type of app it is; either a Universal Windows Platform (UWP) app, or a signed Desktop app, also known as a Classic Windows application. +The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed desktop app (also known as a Classic Windows app), or an AppLocker policy file. ->**Important**
EDP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, EDP-unaware apps might not respect the corporate network boundary and will encrypt all files they create or modify, meaning that they could encrypt personal data and cause data loss during the revocation process. Care must be taken to get a support statement from the software provider that their app is safe with EDP before adding it to your **Protected App** list.

+>**Important**
+EDP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, EDP-unaware apps might not respect the corporate network boundary, and EDP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

Care must be taken to get a support statement from the software provider that their app is safe with EDP before adding it to your App rules list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. ->**Note**
If you want to use **File hash** or **Path** rules, instead of Publisher rules, you must follow the steps in the [Add multiple apps to your enterprise data protection (EDP) Protected Apps list](add-apps-to-protected-list-using-custom-uri.md) topic. +

+>**Note**
+If you want to use **File hash** or **Path** rules, instead of **Publisher** rules, you must follow the steps in the [Add apps using Microsoft Intune and custom URI](add-apps-to-protected-list-using-custom-uri.md) topic. -**To add a UWP app** +#### Add a store app rule to your policy +For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list. -1. From the **Configure the following apps to be protected by EDP** table in the **Protected Apps** area, click **Add.** +**To add a store app** +1. From the **App rules** area, click **Add**. -2. Click **Universal App**, type the **Publisher Name** and the **Product Name** into the associated boxes, and then click **OK**. If you don't have the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps. + The **Add App Rule** box appears. - **To find the Publisher and Product name values for Microsoft Store apps without installing them** + ![Microsoft Intune, Add a store app to your policy](images/intune-add-uwp-apps.png) - 1. Go to the [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, Microsoft OneNote. - - >**Note**
If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the **Protected App** list. For info about how to do this, see the [Add multiple apps to your enterprise data protection (EDP) Protected Apps list](add-apps-to-protected-list-using-custom-uri.md) topic. +2. Add a friendly name for your app into the **Title** box. In this example, it’s *Microsoft OneNote*. - 2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. +3. Click **Allow** from the **Enterprise data protection mode** drop-down list. + + Allow turns on EDP, helping to protect that app’s corporate data through the enforcement of EDP restrictions. Instructions for exempting an app are included in the [Exempt apps from EDP restrictions](#exempt-apps-from-edp-restrictions) section of this topic. + +4. Pick **Store App** from the **Rule template** drop-down list. + + The box changes to show the store app rule options. + +5. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is`CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the **Product name** is `Microsoft.Office.OneNote`. + +If you don't know the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps. + +**To find the Publisher and Product Name values for Store apps without installing them** +1. Go to the [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Microsoft OneNote*. + + >**Note**
+ If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the [Add apps using Microsoft Intune and custom URI](add-apps-to-protected-list-using-custom-uri.md) topic. + +2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. + +3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata, where `9wzdncrfhvjl` is replaced with your ID value. - 3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/*9wzdncrfhvjl*/applockerdata, where *9wzdncrfhvjl* is replaced with your ID value. -

The API runs and opens a text editor with the app details. ``` json - { - "packageIdentityName": "Microsoft.Office.OneNote", - "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" - } + { + "packageIdentityName": "Microsoft.Office.OneNote", + "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" + } ``` - 4. Copy the `publisherCertificateName` value into the **Publisher Name** box and copy the `packageIdentityName` value into the **Product Name** box of Intune. +4. Copy the `publisherCertificateName` value into the **Publisher Name** box and copy the `packageIdentityName` value into the **Product Name** box of Intune. + + >**Important**
+ The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.

For example:
- >**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. -

For example:
- ``` json + ``` json { - "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", - } - ``` - - ![Microsoft Intune: Add a UWP app to the Protected Apps list](images/intune-addapps.png) + "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", + } + ``` - **To find the Publisher and Product name values for apps installed on Windows 10 Mobile phones** +**To find the Publisher and Product Name values for apps installed on Windows 10 mobile phones** +1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. - 1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. + >**Note**
+ Your PC and phone must be on the same wireless network. + +2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. + +3. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**. + +4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate. + +5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. + +6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. + +7. Start the app for which you're looking for the publisher and product name values. + +8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. + + >**Important**
+ The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.

For example:
- >**Note**
Your PC and phone must be on the same wireless network. - - 2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. - - 3. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**. - - 4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate. - - 5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. - - 6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. - - 7. Start the app for which you're looking for the publisher and product name values - - 8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. - - >**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. -

For example:
- ``` json + ``` json { - "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", - } - ``` + "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", + } + ``` -**To add a Classic Windows application** +#### Add a desktop app rule to your policy +For this example, we’re going to add Internet Explorer, a desktop app, to the **App Rules** list. -1. From the **Configure the following apps to be protected by EDP** table in the **Protected Apps** area, click **Add.** -

A dialog box appears, letting you pick whether the app is a **Universal App** or a **Desktop App**. +**To add a desktop app** +1. From the **App rules** area, click **Add**. + + The **Add App Rule** box appears. + + ![Microsoft Intune, Add a desktop app to your policy](images/intune-add-classic-apps.png) + +2. Add a friendly name for your app into the **Title** box. In this example, it’s *Internet Explorer*. + +3. Click **Allow** from the **Enterprise data protection mode** drop-down list. + + Allow turns on EDP, helping to protect that app’s corporate data through the enforcement of EDP restrictions. Instructions for exempting an app are included in the [Exempt apps from EDP restrictions](#exempt-apps-from-edp-restrictions) section of this topic. + +4. Pick **Desktop App** from the **Rule template** drop-down list. + + The box changes to show the store app rule options. + +5. Pick the options you want to include for the app rule (see table), and then click **OK**. -2. Click **Desktop App**, pick the options you want (see table), and then click **OK**. - + - + - - - + + + - - - - - - + + - - + + - + + + + +
Option Manages
All fields left as "*"All fields left as “*” All files signed by any publisher. (Not recommended.)
Publisher selected All files signed by the named publisher.

This might be useful if your company is the publisher and signer of internal line-of-business apps.
Publisher and Product Name selected All files for the specified product, signed by the named publisher.
Publisher, Product Name, and File Name selected
Publisher, Product Name, and Binary name selected Any version of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, File Name, and File Version, Exactly selectedSpecified version of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, File Name, and File Version, And above selected
Publisher, Product Name, Binary name, and File Version, and above, selected Specified version or newer releases of the named file or package for the specified product, signed by the named publisher.

This option is recommended for enlightened apps that weren't previously enlightened.
Publisher, Product Name, File Name, and File Version, And below selected
Publisher, Product Name, Binary name, and File Version, And below selected Specified version or older releases of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, Binary name, and File Version, Exactly selectedSpecified version of the named file or package for the specified product, signed by the named publisher.
If you’re unsure about what to include for the publisher, you can run this PowerShell command: -``` ps1 -Get-AppLockerFileInformation -Path "" +```ps1 + Get-AppLockerFileInformation -Path "" ``` -Where `""` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Internet Explorer\iexplore.exe"`. +Where `""` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Internet Explorer\iexplore.exe"`. In this example, you'd get the following info: ``` json -Path Publisher ----- --------- -%PROGRAMFILES%\INTERNET EXPLORER\IEXPLORE.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\INTERNET EXPLOR... + Path Publisher + ---- --------- + %PROGRAMFILES%\INTERNET EXPLORER\IEXPLORE.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\INTERNET EXPLOR... ``` Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter in the **Publisher Name** box. -![Microsoft Intune: Add a Classic Windows app to the Protected Apps list](images/intune-add-desktop-app.png) +#### Add an AppLocker policy file +For this example, we’re going to add an AppLocker XML file to the **App Rules** list. You’ll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/applocker-overview) content. -## Exempt apps from EDP restrictions +**To create an app rule and xml file using the AppLocker tool** +1. Open the Local Security Policy snap-in (SecPol.msc). + +2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. + + ![Local security snap-in, showing the Packaged app Rules](images/intune-local-security-snapin.png) + +3. Right-click in the right-hand pane, and then click **Create New Rule**. + + The **Create Packaged app Rules** wizard appears. + +4. On the **Before You Begin** page, click **Next**. + + ![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-before-begin.png) + +5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. + + ![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-permissions.png) + +6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. + + ![Create Packaged app Rules wizard, showing the Publisher](images/intune-applocker-publisher.png) + +7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Photos. + + ![Create Packaged app Rules wizard, showing the Select applications page](images/intune-applocker-select-apps.png) + +8. On the updated **Publisher** page, click **Create**. + + ![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page](images/intune-applocker-publisher-with-app.png) + +9. Review the Local Security Policy snap-in to make sure your rule is correct. + + ![Local security snap-in, showing the new rule](images/intune-local-security-snapin-updated.png) + +10. In the left pane, right-click on **AppLocker**, and then click **Export policy**. + + The **Export policy** box opens, letting you export and save your new policy as XML. + + ![Local security snap-in, showing the Export Policy option](images/intune-local-security-export.png) + +11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. + + The policy is saved and you’ll see a message that says 1 rule was exported from the policy. + + **Example XML file**
+ This is the XML file that AppLocker creates for Microsoft Photos. + + ```xml + + + + + + + + + + + + + + + + ``` +12. After you’ve created your XML file, you need to import it by using Microsoft Intune. + +**To import your Applocker policy file app rule using Microsoft Intune** +1. From the **App rules** area, click **Add**. + + The **Add App Rule** box appears. + + ![Microsoft Intune, Importing your AppLocker policy file using Intune](images/intune-add-applocker-xml-file.png) + +2. Add a friendly name for your app into the **Title** box. In this example, it’s *Allowed app list*. + +3. Click **Allow** from the **Enterprise data protection mode** drop-down list. + + Allow turns on EDP, helping to protect that app’s corporate data through the enforcement of EDP restrictions. Instructions for exempting an app are included in the [Exempt apps from EDP restrictions](#exempt-apps-from-edp-restrictions) section of this topic. + +4. Pick **AppLocker policy file** from the **Rule template** drop-down list. + + The box changes to let you import your AppLocker XML policy file. + +5. Click **Import**, browse to your AppLocker XML file, click **Open**, and then click **OK** to close the **Add App Rule** box. + + The file is imported and the apps are added to your **App Rules** list. + +#### Exempt apps from EDP restrictions If you're running into compatibility issues where your app is incompatible with EDP, but still needs to be used with enterprise data, you can exempt the app from the EDP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. -**To exempt an UWP app** - -1. Follow the **Add a UWP app** steps in the [Add multiple apps to your enterprise data protection (EDP) Protected Apps list](add-apps-to-protected-list-using-custom-uri.md) topic, through to Step 11. - -2. In the **OMA-URI** box at Step 12, type `./Vendor/MSFT/AppLocker/EnterpriseDataProtection/edpexempt/StoreApp EXE`.

Where **edpexempt** is added as a substring, making the app exempt. - -3. Open File Explorer, go to the location where you saved your new XML file, and open it using an XML editor, such as Notepad. - -4. Copy the text that has a **Type** of Appx, within in the **RuleCollection** tags, and then go back to Intune and paste the text into the **Value** box of the **Add or edit OMA-URI Setting** box. For example: - - ``` - - ``` +**To exempt a store app, a desktop app, or an AppLocker policy file app rule** +1. From the **App rules** area, click **Add**. -5. Click **OK** to close the **Add or edit OMA-URI Setting** box, and then click **Save Policy**.

After saving the policy, you’ll need to deploy it to your employee’s devices. For more info, see the [Deploy your enterprise data protection (EDP) policy](deploy-edp-policy-using-intune.md) topic. + The **Add App Rule** box appears. -**To exempt a Classic Windows application** +2. Add a friendly name for your app into the **Title** box. In this example, it’s *Exempt apps list*. -1. Follow the **Add a Classic Windows application app** steps in the [Add multiple apps to your enterprise data protection (EDP) Protected Apps list](add-apps-to-protected-list-using-custom-uri.md) topic, through to Step 11. +3. Click **Exempt** from the **Enterprise data protection mode** drop-down list. -2. In the **OMA-URI** box at Step 12, type `./Vendor/MSFT/AppLocker/EnterpriseDataProtection/edpexempt/EXE`.

Where **edpexempt** is added as a substring, making the app exempt. + Be aware that when you exempt apps, they’re allowed to bypass the EDP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic. -3. Open File Explorer, go to the location where you saved your new XML file, and open it using an XML editor, such as Notepad. +4. Fill out the rest of the app rule info, based on the type of rule you’re adding: -4. Copy the text that has a **Type** of EXE, within in the **RuleCollection** tags, and then go back to Intune and paste the text into the **Value** box of the **Add or edit OMA-URI Setting** box. For example: + - **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this topic. - ``` - - ``` + - **Desktop app.** Follow the **Publisher**, **Product name**, **Binary name**, and **Version** instructions in the [Add a desktop app rule to your policy](#add-a-desktop-app-rule-to-your-policy) section of this topic. -5. Click **OK** to close the **Add or edit OMA-URI Setting** box, and then click **Save Policy**.

After saving the policy, you’ll need to deploy it to your employee’s devices. For more info, see the [Deploy your enterprise data protection (EDP) policy](deploy-edp-policy-using-intune.md) topic. + - **AppLocker policy file.** Follow the **Import** instructions in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section of this topic, using a list of exempted apps. -## Manage the EDP protection level for your enterprise data +5. Click **OK**. + +### Manage the EDP protection mode for your enterprise data After you've added the apps you want to protect with EDP, you'll need to apply a management and protection mode. -We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your **Protected Apps** list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**. +We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**. - - - - - - - - - - - - - - - - - - - - - -
ModeDescription
BlockEDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.
OverrideEDP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](http://go.microsoft.com/fwlink/p/?LinkID=746459).
SilentEDP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or EDP-protected data, are still blocked.
OffEDP is turned off and doesn't help to protect or audit your data.

After you turn off EDP, an attempt is made to decrypt any closed EDP-tagged files on the locally attached drives.

+|Mode |Description | +|-----|------------| +|Block |EDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| +|Override |EDP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](http://go.microsoft.com/fwlink/p/?LinkID=746459). | +|Silent |EDP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or EDP-protected data, are still blocked.| +|Off (not recommended) |EDP is turned off and doesn't help to protect or audit your data.

After you turn off EDP, an attempt is made to decrypt any closed EDP-tagged files on the locally attached drives.| -![Microsoft Intune: Add the protection level for your Protected Apps list](images/intune-protection-mode.png) +![Microsoft Intune, Set the protection mode for your data](images/intune-protection-mode.png) -## Define your enterprise-managed identity domains -Specify your company’s enterprise identity, expressed as your primary internet domain. For example, if your company is Contoso, its enterprise identity might be contoso.com. The first listed domain (in this example, contoso.com) is the primary enterprise identity string used to tag files protected by any app on the **Protected App** list. +### Define your enterprise-managed corporate identity +Corporate identity, usually expressed as your primary Internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by EDP. For example, emails using contoso.com are identified as being corporate and are restricted by your enterprise data protection policies. -You can also specify all the domains owned by your enterprise that are used for user accounts, separating them with the "|" character. For example, if Contoso also has some employees with email addresses or user accounts on the fabrikam.com domain, you would use contoso.com|fabrikam.com. +You can specify multiple domains owned by your enterprise by separating them with the "|" character. For example, (`contoso.com|newcontoso.com`). With multiple domains, the first one is designated as your corporate identity and all of the additional ones as being owned by the first one. We strongly recommend that you include all of your email address domains in this list. -This list of managed identity domains, along with the primary domain, make up the identity of your managing enterprise. User identities (user@domain) that end in any of the domains on this list, are considered managed. +**To add your corporate identity** +- Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`. -**To add your primary domain** + ![Microsoft Intune, Set your primary Internet domains](images/intune-corporate-identity.png) -- Type the name of your primary domain into the **Primary domain** field. For example, *contoso.com*.

-If you have multiple domains, you must separate them with the "|" character. For example, `contoso.com|fabrikam.com`. +### Choose where apps can access enterprise data +After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. - ![Microsoft Intune: Add the primary internet domain for your enterprise identity](images/intune-corporate-identity.png) - -## Choose where apps can access enterprise data -After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network.

-There are no default locations included with EDP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). +There are no default locations included with EDP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). >**Important**
-- Every EDP policy should include policy that defines your enterprise network locations.

+- Every EDP policy should include policy that defines your enterprise network locations.

- Classless Inter-Domain Routing (CIDR) notation isn’t supported for EDP configurations. -**To specify where your protected apps can find and send enterprise data on the network** +**To define where your protected apps can find and send enterprise data on you network** -1. Add additional network locations your apps can access by clicking **Add**, typing a description into the **Description** box, and then choosing your location type, including: +1. Add additional network locations your apps can access by clicking **Add**. + + The **Add or edit corporate network definition** box appears. + +2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table. + + ![Microsoft Intune, Add your corporate network definitions](images/intune-networklocation.png) +

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Network location typeFormatDescription
Enterprise Cloud Resources**With proxy:**

contoso.sharepoint.com,proxy.contoso.com|
contoso.visualstudio.com,proxy.contoso.com

**Without proxy:**

contoso.sharepoint.com|contoso.visualstudio.com

Specify the cloud resources to be treated as corporate and protected by EDP.

For each cloud resource, you may also optionally specify an internal proxy server that routes your traffic through your Enterprise Internal Proxy Server.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example:

`URL <,proxy>|URL <,proxy>`

If Windows is unable to determine whether an app should be allowed to connect to a network resource, it will automatically block the connection. If instead you want Windows to allow the connections to happen, you can add the `/*AppCompat*/` string to this setting. For example:

`URL <,proxy>|URL <,proxy>|/*AppCompat*/`

Enterprise Network Domain Namesdomain1.contoso.com,domain2.contoso.comSpecify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.

This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.

If you have multiple resources, you must separate them using the "," delimiter.

Enterprise Proxy Serversdomain1.contoso.com:80;
domain2.contoso.com:137		Specify your externally-facing proxy server addresses, along with the port through which traffic is allowed and protected with EDP.

This list shouldn’t include any servers listed in the Enterprise Internal Proxy Servers list, which are used for EDP-protected traffic.

This setting is also required if you use a proxy in your network. If you don't have a proxy server, you might find that enterprise resources are unavailable when a client is behind a proxy, such as when you’re visiting another company and not on that company’s guest network.

If you have multiple resources, you must separate them using the ";" delimiter.

Enterprise Internal Proxy Serversproxy1.contoso.com;
proxy2.contoso.com		Specify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-EDP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter.

Enterprise IPv4 Range**Starting IPv4 Address:** 3.4.0.1
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,10.0.0.1-10.255.255.254		Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter.

Enterprise IPv6 Range**Starting IPv6 Address:** 2a01:110::
**Ending IPv6 Address:** 2a01:110:7fff:ffff:
ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110::-2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff		Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter.

- - ![Microsoft Intune: Choose the primary domain and the other network locations for protected apps](images/intune-networklocation.png) + + Network location type + Format + Description + + + Enterprise Cloud Resources + **With proxy:** contoso.sharepoint.com,proxy.contoso.com|
contoso.visualstudio.com,proxy.contoso.com

**Without proxy:** contoso.sharepoint.com|contoso.visualstudio.com + Specify the cloud resources to be treated as corporate and protected by EDP.

For each cloud resource, you may also optionally specify an internal proxy server that routes your traffic through your Enterprise Internal Proxy Server.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: `URL <,proxy>|URL <,proxy>`.

If Windows is unable to determine whether an app should be allowed to connect to a network resource, it will automatically block the connection. If instead you want Windows to allow the connections to happen, you can add the `/*AppCompat*/` string to this setting. For example: `URL <,proxy>|URL <,proxy>|/*AppCompat*/` + + + Enterprise Network Domain Names (Required) + corp.contoso.com,region.contoso.com + Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.

This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.

If you have multiple resources, you must separate them using the "," delimiter. + + + Enterprise Proxy Servers + proxy.contoso.com:80;proxy2.contoso.com:137 + Specify your externally-facing proxy server addresses, along with the port through which traffic is allowed and protected with EDP.

This list shouldn’t include any servers listed in the Enterprise Internal Proxy Servers list, which are used for EDP-protected traffic.

This setting is also required if you use a proxy in your network. If you don't have a proxy server, you might find that enterprise resources are unavailable when a client is behind a proxy, such as when you’re visiting another company and not on that company’s guest network.

If you have multiple resources, you must separate them using the ";" delimiter. + + + Enterprise Internal Proxy Servers + contoso.internalproxy1.com;contoso.internalproxy2.com + Specify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-EDP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter. + + + Enterprise IPv4 Range (Required) + **Starting IPv4 Address:** 3.4.0.1
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,
10.0.0.1-10.255.255.254 + Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter. + + + Enterprise IPv6 Range + **Starting IPv6 Address:** 2a01:110::
**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter. + + + Neutral Resources + sts.contoso.com,sts.contoso2.com + Specify your authentication redirection endpoints for your company.

These locations are considered enterprise or personal, based on the context of the connection before the redirection.

If you have multiple resources, you must separate them using the "," delimiter. + + -2. Add as many locations as you need, and then click **OK**.

The **Add or Edit Enterprise Network Locations box** closes. +3. Add as many locations as you need, and then click **OK**. -3. In the **Use a data recovery certificate in case of data loss** box, click **Browse** to add a data recovery certificate for your policy.

After you create and deploy your EDP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data.

For steps about how to create and verify an EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) DRA certificate](#create-and-verify-an-encrypting-file-system-efs-dra-certificate) section of this topic. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic.

+ The **Add corporate network definition** box closes. - ![Microsoft Intune: Specify a data recovery certificate for your policy](images/intune-data-recovery.png) +4. Decide if you want to Windows to look for additional network settings: -### Create and verify an Encrypting File System (EFS) DRA certificate -If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use EDP in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. + - **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. ->**Important**
-If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. To add your EFS DRA certificate to your policy by using Microsoft Intune, see Step 3 in the [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data) section of this topic. + - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. + + - **Show the enterprise data protection icon overlay on your allowed apps that are EDP-unaware in the Windows Start menu and on corporate file icons in the File Explorer.** Click this box if you want the enterprise data protection icon overlay to appear on corporate files or in the Start menu, on top the tiles for your unenlightened protected apps. + +5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. + + ![Microsoft Intune, Add your Data Recovery Agent (DRA) certificate](images/intune-data-recovery.png) + + After you create and deploy your EDP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. + + For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic. + +#### Create and verify an Encrypting File System (EFS) DRA certificate for EDP +If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use EDP in your organization. For the purposes of this section, we’ll use the file name *EFSDRA*; however, this name can be replaced with anything that makes sense to you. + +>**Important**
If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. **To manually create an EFS DRA certificate** -1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate. +1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate. -2. Run this command: +2. Run this command: - `cipher /r:` - - Where *<EFSRA>* is the name of the .cer and .pfx files that you want to create. + `cipher /r:`
Where `` is the name of the .cer and .pfx files that you want to create. -3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file. +3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file. - The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1. + The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1. - >**Important**
- Because these files can be used to decrypt any EDP file, you must protect them accordingly. We highly recommend storing them as a public key (PKI) on a smart card with strong protection, stored in a secured physical location. + >**Important**
Because these files can be used to decrypt any EDP file, you must protect them accordingly. We highly recommend storing them as a public key (PKI) on a smart card with strong protection, stored in a secured physical location. -4. Add your EFS DRA certificate to your EDP policy by using Step 3 of the [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data) section of this topic. +4. Add your EFS DRA certificate to your EDP policy by using Step 3 of the [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data) section of this topic. **To verify your data recovery certificate is correctly set up on an EDP client computer** -1. Open an app on your protected app list, and then create and save a file so that it’s encrypted by EDP. +1. Open an app on your protected app list, and then create and save a file so that it’s encrypted by EDP. 2. Open a command prompt with elevated rights, navigate to where you stored the file you just created, and then run this command: - `cipher /c ` - - Where *<filename>* is the name of the file you created in Step 1. + `cipher /c `
Where `` is the name of the file you created in Step 1. 3. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list. @@ -350,38 +464,50 @@ If you already have an EFS DRA certificate for your organization, you can skip c 3. Open a command prompt with elevated rights, navigate to the encrypted file, and then run this command: - `cipher /d ` - - Where *<encryptedfile.extension>* is the name of your encrypted file. For example, corporatedata.docx. + `cipher /d `
Where `` is the name of your encrypted file. For example, corporatedata.docx. -## Choose your optional EDP-related settings +### Choose your optional EDP-related settings After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional EDP settings. -**To add your optional settings** +![Microsoft Intune, Choose any additional, optional settings](images/intune-optional-settings.png) -1. Choose to set any or all of the optional EDP-related settings: +**To set your optional settings** +1. Choose to set any or all of the optional settings: - - **Allow the user to decrypt data that was created or edited by the apps configured above.** Clicking **Yes**, or turning off this setting in Intune, lets your employees right-click to decrypt their protected app data, along with the option to decrypt data in the **Save As** box and the **Save As** file picker . Clicking **No** removes the **Decrypt** option and saves all data for protected apps as enterprise-encrypted. + - **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box.** Determines whether users can see the Personal option for files within File Explorer and the **Save As** dialog box. The options are: + + - **Yes, or not configured (recommended).** Employees can choose whether a file is **Work** or **Personal** in File Explorer and the **Save As** dialog box. + + - **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult. - - **Protect app content when the device is in a locked state for the apps configured above.** Clicking **Yes** lets EDP help to secure protected app content when a mobile device is locked. We recommend turning this option on to help prevent data leaks from things such as email text that appears on the **Lock** screen of a Windows 10 Mobile phone. + - **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether apps can show corporate data on a Windows 10 Mobile device **Lock** screen. The options are: + + - **Yes (recommended).** Stop apps from reading corporate data on Windows 10 Mobile device when the screen is locked. + + - **No, or not configured.** Allows apps to read corporate data on Windows 10 Mobile device when the screen is locked. - ![Microsoft Intune: Optional EDP settings](images/intune-optional-settings.png) + - **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from enterprise data protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: -2. Click **Save Policy**. + - **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. + + - **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions. + + - **Allow Windows Search to search encrypted corporate data and Store apps.** Determines whether Windows Search can search and index encrypted corporate data and Store apps. The options are: + + - **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps. + + - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. + + - **Show the enterprise data protection icon overlay.** Determines whether the enterprise data protection icon overlay appears on corporate files or in the **Start** menu, on top of the tiles for your unenlightened protected apps. The options are: + + - **Yes (recommended).** Allows the enterprise data protection icon overlay to appear for files or on top of the tiles for your unenlightened protected apps in the **Start** menu. + + - **No, or not configured.** Stops the enterprise data protection icon overlay from appearing for files or on top of the tiles for your unenlightened protected apps in the **Start** menu. + +2. Click **Save Policy**. ## Related topics - [Add multiple apps to your enterprise data protection (EDP) Protected Apps list](add-apps-to-protected-list-using-custom-uri.md) - [Deploy your enterprise data protection (EDP) policy](deploy-edp-policy-using-intune.md) - [Create and deploy a VPN policy for enterprise data protection (EDP) using Microsoft Intune](create-vpn-and-edp-policy-using-intune.md) -- [General guidance and best practices for enterprise data protection (EDP)](guidance-and-best-practices-edp.md) - - - -  - -  - - - - - +- [General guidance and best practices for enterprise data protection (EDP)](guidance-and-best-practices-edp.md) \ No newline at end of file diff --git a/windows/keep-secure/create-edp-policy-using-sccm.md b/windows/keep-secure/create-edp-policy-using-sccm.md index edfc06c2ec..0b357dece8 100644 --- a/windows/keep-secure/create-edp-policy-using-sccm.md +++ b/windows/keep-secure/create-edp-policy-using-sccm.md @@ -443,12 +443,12 @@ There are no default locations included with EDP, you must add each of your netw 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. + ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate](images/edp-sccm-dra.png) + After you create and deploy your EDP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic. - ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate](images/edp-sccm-dra.png) - #### Create and verify an Encrypting File System (EFS) DRA certificate for EDP If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use EDP in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. @@ -464,7 +464,7 @@ If you don’t already have an EFS DRA certificate, you’ll need to create and The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1. - **Important**
Because these files can be used to decrypt any EDP file, you must protect them accordingly. We highly recommend storing them as a public key (PKI) on a smart card with strong protection, stored in a secured physical location. + >**Important**
Because these files can be used to decrypt any EDP file, you must protect them accordingly. We highly recommend storing them as a public key (PKI) on a smart card with strong protection, stored in a secured physical location. 4. Add your EFS DRA certificate to your EDP policy by using Step 3 of the [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data) section of this topic. diff --git a/windows/keep-secure/images/intune-add-desktop-app.png b/windows/keep-secure/images/intune-add-desktop-app.png deleted file mode 100644 index 8d8186398a295dc8be866f2d15bc9e7eab20b735..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 47883 zcmZU)1wd3?w?B+1q6{I53<%Ol$2*}a8e83kp0r3 zCf6-GkVcBx;&Wm1K7(tJk4#(;a1taG1E$Q0k(Z!)+DzzfL*Y#bJ58G;uCA9;d`~;) zL_;)WK==>O^(T|RK%Pd6f#4g2f7t^6m-XL0|MvPF9|Ml*^H8QPxx2pWJR80woX2mR zaL8&YEtOcABMjmDJTTDooho**_~X0}di_W^ z`BxaN01FFC>OL30MDl9BaciVP1k;(8D*&>M^J|+UJxMUOQag|@V+x^EJ^ZY9_ z3tMgW7#^mG-?25sdUd_m%zn#N#?n+>{T2Vk!Gg|D-@{ z^va*p^~x%MfYtF^Fg;^Pcy#cQ{wscgOw4ZFm4w^NLpE*r2qI{H^QO-7hE@+S^D;17 zUQ_1&X8rtbRKzDz+cgCYZgRfgt^{UalDd=OU;N1s{GVxjk^?*9Yp11#g|8T}vE$px znO2{zkN~}FEB>ob0I^&!O1EkQn#pyRUdKQF)Op7Ptd<7xqR|b^42?uP@x>;lfnna! zS#F_dfpJ3z0wYwjFMVA>&VixBuGhi)u(k5IF263@jpKo!0%Qb)-cC*)V6s!K*q}2= zB8Ng@Exul+wuV{x6De9~fz?#h*i@Ij`OhQqCO+cSyqn6)4dp)d`oxfQp5*kx;nT|c zilmlkt~tA391}R{sY&T6-=n~KE@7n&vubmkbZF}a*b?gX)2oJuz0z0e7*8>@a|T8A zt~_NN6yoOawxXct{el+*WYcC_2)&%fU)SyD}X1yQrcZm$Gx7tcwB zVSF#xObgz8m$lMz#--D`x4fRIQ~ez;5lm}2q2rQBDE&9fdpjS`z&^JLe)O3I1x}=G zJzE;Ts<)w(?{9}a2tQKqsaKG$RhGuDp^c8Nu0|J#-p3E!TRAxbEvTlVf~72B-jczk z2jQsh(^YKipEgX+g}97r9~skw-5=wIO3M9*+y70ccUs7`zJoKD3>I1hNg2vN zrq*4gFUFXj3UL`Qsip+GUs_6^f#N1jgH+uY_-vIS<=5-0g3%)<*VPk~$3=Dh*mwvC zW&JLogT<{donSNfuDFxRs9>!V&5NOZDr>T!_U1ejLV10q@de=!l&k;%B>JPiY64;( zCMF$e2n{tvj$fIIcHrT7E_<7mIW>abI%Y=KjqW+IcsjlxXA5t<6xLGLVvbI~Zx?w& z5n;}8n?oNTM8EY`4)kWK^K)~eP{u_IgcY9Xe`!&2s5AKt>X`qrV6N`nLkl`lHa3o>$*GS-XFjII4w4K^TM}17d`1G_&-A_fm!R|#$K~XTOo5xV$gR75dgS> z82c9>04dIT*xy$yw*@Q5`^Knmh-&`L3WfD(gWlNCzD}EcF=eQ1Y01a>A8~XplNduK1IW>8T&J#q zF0YrQ%O8rkZwwmxu{S2qsXYmX09Q~m7|m9?L%e9d4f4*P1S<5UQNF=W(O&46cGGdZ z2PgS#w!PP`pHIO8rV&a_UanG#gk;WPg^@yQ8W|##u*&gn#q?hEFqZ8~vTlZ}Vf_Gz zc4w2hEGXdACI-NjVxBLhz;)~O5@W>Be{TbEir`>N^+{q;m5i-?BTCojkR?{sc*xiNQKm*cz=HF7#Q&(8Lm?`6By?-VG zy-SG2AV`70RQrg_7~}@aMiu$7@VM*SvhqQ8KYn`4-llyykQ&AG#>if;DSL9Oj$C|b zg7Ri^o;%CX$?LUsQi!LcYu0a!*Z)|F5MnyyOWWt0lLBbUpNoQEzN(9;C{r(DB3^nY z$NY!Do$>LUKQ#3LTJlnyP1b+_IV`D4fm#-&>v)qrOoiNGz*Vduh;iTZ^NQPwRfVU_ zmDQ4zpHdOJ5xo+~S)Atn>$~mQ2IcV050^5I%8hayfaoKcsCFp@8Oc5*o4}jzGBd4$ zGD=yv#dW{wK(Yi)V{Y~D`=AMOc{)k($m_9k+Y*EpNMW<^<#07_oW`r0MN4mHChQgq zp3n#KO%sK2;C?(Jj%hO(=k1uO7NRC|c<(Q}3zc08)}K-7oG4Yc4wDJ$-a ziF7tU@XKW`6C9CC-F9%j2KUc_Ly&v&C!bic)yzdaZXf@&I#;|MhGO9nv5Q&7roola z_R?4X@su^(Qxha{5D+?_?=i@zTz}?G)!?%r_Df>{pHB`vJ8@TsQIr9R-Eus$;@ExO zz)Uou#ExgWFs~OA&&@^OljBCvq8ZW4g0@utG-to}uD(nTdmTkf3GCA?%j*|&0g6<= zmaENIrWdd+Y^I<7aNi4%zPzzMpOl5NZ=jcE_)-kmyLs*%4-BKi^zV2$loRg4Wow!aq#%uBs`k$a|<*o{o#gKK=482uQ@%JzvT z-sA@=V6g)J8m&mhOMUcYXfS4MuymdV$6QbmN@LrLq~5lUAny#8ck@Zgp!{e4pdZ;= zHtVlbXh}fAEym~;wcSDz>Koo?fc{VdP8JF}HXll0$_=84o<(q+4y&KC+w`*I=P8;h zr3sNKFk9tFlRphG2%=t^yEdXBi4G<`aTUAJS{Eoq(wDaiL)fMh@KToF3ALqPc;dBSWWO zW?NXRSWCfYtLjYFM8^7UC{kp#nry4ph$dcTUj=fDu{|EP@9pAvkywAqFZYg1kEmEu?Z6Uy=Ewq5r7HP;Bb&FPJmB_Hl1>H6i@ z;ekJn2{RFFvLNT)eJ}8oDi8#nYT|j<*SS6(!gja0)VTVp(SGD3(`@R-pgc<<7)K=> zd8k;+)TZoQDt;hgoNlz-?xvCKn(ygC6-tJ(7AK?hl>XoR8u3Qi7s|x^ z!H$3+Hs%s#dZMy7@#NJWx2ywa?9X|0hv~h`cM5NKs77svTYsINb8IFL#?3%23RJkI z^4^y7@eTPS@}>treC=NhP2oZVv$~g~X*yimt$w7X(14kfan>Zs7WJj-q3 z>{`^)wU``_7giEi>uLt)`J&%O{ga6Z!#NuQJkxF1mYDj@o;N15*^t(u=b^h;2_j_K zNV+sNTchPbh8!@CCb-s-L}eR$#qpl>0>5ZHNgYZrHEZ`y`RgL($4HGOAqvGqh^<79 zJ;`%(+GD6tiK8PYOyIsKQQLsLk=7yDmSGx|wZ8$V2FS9&iIi?0YbN_ggWrd;Hpg2j z0LIv{#UucXG0tYy+q+Nr-Y_AzA=6aL#Dcgya+ZtpHj+-sbPxZ1A5tEKf5_fI><@E@ zA}EP(OB^2?|2mCQSGKx_rMGPFHAz6pvMpsz4K#WvLR2b*Bf-Uk8Yb|)4FT4c0y*Ao z+1iu*+WrcSZ$s+MzX~uFLLJA|I}SbcEeAVW&R2c(+O!@xV??2^20Gc7LeZo4UKiIm z$&AA|+^A7b4@dTD&@vjh2TU7ZtbH|V54f8*->+%G# z6R0)k?<-fA_QN$WXrJSNwJmBf%@+k)M%zY(`eCX~z!Wv#{-ecD01HsGo8sj@@ym$j zx97j5`&ocK!3%XUn}7r5?b8bQ1r&1l%aC4fzzw6+tZEWmHRGyu2=f2F_c}G`l$?|* z6BHs8*1L`ag}HG&5;yKdKr+^Y^sdMCg&((ksm}se?+nMpgSq z_Z~k-GuWz=ZR_d&z05BMK&&5Sn(i)#=gl8>I8EupD^ru_!`r?WIBU|x79#t1gW~)B zl7c^ZxCJZ7V6503-5+d!E09-E^lWfFUN_?7e}i1ptt4W=(CCB5Fi?_JDYqOGIwdS(zN@f}s{!trZ`!>anRoq9R{x3_Zq zXF@FpORG2k&Z~MO@zl*k^k)j0tn&>?_?N3%UKHpf}%=2@xmA7z*31qPquuY%E zeC;9`3pV9ci=t;3|X@= z_AX=y!0ULIkJYo++YfVHOz2@q^;5K~_5i)`@_k)K+^USQZ`2**BH0pue3b(K(Cjn3 zUqq({*1Sw!G*FMLqw0J6+PZe({(}ckWj4h}bhM`N5Wgqv0Z!aN7>OpOo8&&yQZwF} zBPzG-9Io5xhJtOP7*4V}*Sl6NP0eT{aoBVf3}IEadx$&X(Z zON+xyp7_d=A{Kz>J*ZWw_qxTR3YW!+V=?~4Kekv2Km)p4gm{H-Z*N^(T)v`J;^5-m z-*Ft1m-BM4&<17R409DhWg-3jW2gniM>j7gI8e%|&Tm{hx)_^d;pbxJIUY#)k;~z- zXVi$(bKQ~Y8#|Y9!Qz@~?AL#k>tEijOdI@|55il|KfjSSJMQ#Uq@@dc8Gka1A;^g- z_Do<|o2w15^tiXME2Dsn->v=njm9*p0iu}_MQ?U+JSf-#-?Sa&oh+`pP!{?tFTG$9 z;YKso3bxy^%dF05YTsCC>YQN;nO6+_KZ_Y$IpQPrbezwR3%dy8HsXSJ9I#pk5vf7g3-F7@E%PARQ4=X$1+bWYQ}u>|zKwq+c9Nu5j@7!(g%4jiu0e1FWc)TqGo zBI_8Y<3V@m4F>T}2AdyRvZfthVHt{6Y*+H63~ogC-aIBPE;wEG-}yYkE4iQdalz3P zmG}40zk>ZvPcHd7>=;1cy1LVLU6ku1qu@_*fUv4ONt^DamJ1AVAjaP$jdIet-P#1B=8`>Y`Kl>wY9; z?b{2shLoqc<6ppZw3bgdEZjI*?P0Bb?IYj=$4?4e>K%!sV@y*YZCcY>o@@Tn_*2bZ zJDM2o3CpxwTyTN89xI2#p`a=l1T)X2!<^sQ+4-UYyned0*lfcljxw`Xu(-HbQc`ko za3J-Gi8Cpf&tU+`C0}EZ`CxUVyyf{LS--F|EZ~tHv*=)gb9Pb(Hq>xzqHb#rN9K&i zU^-6vEEd@8?95e5$0P^B@|0K}>MB8nYN%)!%0ryn!?5PSnbnz_uE)mOSE3h2!E7*f z1@Utfpn?OT-QJoO)Tnm^+Y-2uSEyXau44nokZdO*$0z5SG=-*YhMN-aqOD~jx(2~5 z)`t&mH>bekl}f%x#_O@_x(Ts)Efxc~yuq_Yl4@@4)ID#!c>61vs3B})n8@ilY`dZx z7Xe|`0qQwf#}=LKaNk&c*Ab=*WoHjRToOC%;$(UJZ3e%uivv6zQ~gh839Y}NU)kT9 z`@h(pu&1l+KWvr1c;DaN|FD1m#r*zZfBuUO{_Xt_yG$2aCr{boa(pqd%lC8-iSBJ% z${t51-Uzg0BNLB;|DlU+Ypj@Is;ysl1y?6ML_TqiFC}v1_ui{p(gIaLf4jv2J_F+b ze+R%2`+c8yy^v@BhocSs4IzH&RRPw5mVw2dCiwh6GX5{8AL+kjzywC~wk+YptG}(S zt(7aAHC4mKM2r*ncW!KKsKXoX`xj^KtG;zTtMfqVwWuSSXSU*Zo+_g;YC|-q_QhsJ znXdHendVN8fzsJF%{gW)r$7Hs_1iNV9ad{iJK zwyG*;IGVyICcb?If#cBWBuy|(iyo&+gV>S^Cdl3iu z5d%QzDTG*mfU^-GKSoF8`;g>82t*$JzJKFcf%pIRQ(mP$b&6PsiHVT~MZn|b^d027 zR{I7M6O(}}2TTMH7$r~*nvj4x-|)yo0w;rTM!~Fq8`NO}(xG%u5{Qx`a6iBhselMy zpaE1sk0;(2`!CQheMkthpw;-`iE5T_Xr%D*I=L~|IREyXt^^xx_8;*Dz$t-Yg8pCj zPcRX@qde%%UvXcA;Ph8xxGGOQV*v17xYQ>lBmY{9(1-LSxzFw9Y@~?K@w(}E=LqV} z8rss5WQ*Kiv*4P*rOdNd-8q8cMW{+8zf7_D_L^x7ARC_2|H!IEJ-d`(Ofa&!=Quzc zzMi;U!f#$_;J4eD^mZ5u8K3bt*;R^n&jEMH8JFRpzVuIq+lK(38ioj0}-|Jxya$d(mb;drK^su}fF#BM)9TNF1I8q4*jjQLE)EDRz zj`ddo28>wwH(MqcONldAdpnhqZi$SxFmpQ#XI%*R!qDE9jK>s|MC%d@@Sh=*``I>+ zbDs&#oS*+A@~@YpY_*+>Dk>_BwLTv&BejGub08-KeUv)%R6t)oL-Z$!zTo;A=z)^l zvLk*kM?|vv09%#H`;em6GG6PRLE+uE3V<34&80gG=hcC6&bw{vb%zEa8O4o%wnH{1 zQ)m!l0DYaUj?WRou!Azi%8ZPSjg5@*OG|6jiXkG6Odf2$Fp@32(F!kBr>hVMKlC?N zd~jkoH-*%v`0nm!LPB>Qu*_N}Zmx3P`9xL0=1YAx*8WbbHV82jb7EevS#e#Rihz$s zsZ8BQX7!gmxu1Llx6aAdQzn2uB!V2s$SVX@r`km0UrU58lKNBn3;wXBvkX9(#44zM}UtBbknR2K)ncn$w za_0I4DmL5sDKQ}-rGOUb@^Lgv85H#k0hyJj#nRutR?Ha#okVAddo%NE+8-$E*6h** z|5Ple`uwAT^J&cYmv`7 zDWx#|{=-#IjMS)Ls=4QM(kRPunX<{fd9`{yf5^eS*E}4~ zsoFg2aw#$OQ$)G%k=XUj#Q@;OJTsP)eVVis+P2)&*>mI%&8Up+@AXw7B>wV3h_J); z*)AQuCy|!WTJvzdr$8892kD8foxH2ncku$`2mldKOH1nuh!_4aCigaCRbWu>(fQr^ zf>37^7Y;Jy**anmQUt)t%IYXw8nj`y(SG~RW09Wn*rx!G=WX&U6vx$chr>7hzh{HU zJO;4mmPAFX3Oq~bT&-Vm#zdt z7d)TNFZM-%W6|huUf}m2;o#sz1Xq#+3r8$ve=r|Se7=EJaQG9woUp0b+7_>}abinHHn%njux}?9Nf{W#1|* zgMGd`xo9=M{=$dqU*9G1)4WsHyfL;|Oh7Ls^eZ^uZu97DEu884PZTN1)v=8m=;uxU zPz6VP_(5+!R;c0szPpQ@-}I=0sUc^!e87vIxE2wbzg{Cd%+6;Lnik4iQYE&g@n`pU z*4p($N-qr}!yRIVBA9KvAov^x==1wx$C7q9tCOEhsP9scLJqyDm2jP-gJBu} z*Z2p2I2m@#ep4hSbouF4O<0j*r?adKHR={>eRqPVI7BAznB z?f@Qi*0`s$9TpRr8^AhrOxSt9m$&Myibulqv8U7BBrLaQIaKgRPzab?!pGN`weMs$ zW^>k8DVM3?qA;kZQ-u372EzU`@tt2z;l;{}uWR+XBZ4O}-@X$P|5HHegm*g=5v&$m zJU7kv1@ybMwKaL&>w5kCtX4l+I%5;3__o5JuG{Ktqxd&f8lSo#3E;Rie^ZsGxN&YL zb(az~4a`0q4h|T0y8{ji=W+3JnSx%K3pWT-egS!cJ%9Z8k;(+kH|w5|kL(<+LXH*3 zb_g&Ed>qOM+LDh1qGM^AIqw@}){8U`Dp%$!Q`{0MuVcN*(P3pb=_WrYU)P!E@vM5i zy(bA4$&|CeF+Tfg$jKi8@Y6QBufC=bf6#ZQjRse2L*q>P#e~%u)Nn+EFGV(#t=6GZ zqrJeUOv@j%t6aQyBjlgaC^u?IcrVv=ZeHXG`=Gk=e&}0AzhZ1?e9&txT3cKk3(127 zjgh$B-#aJMoUbAvZx_h;aP5szZad%*s855RaXS|zgkSA_oM6t}#`%m|47oAzG0ZYc z6+~L&l80!QsTfuD=`aZErsp?iAT{2I2~~0vwqbc5`-Jnnk(-hJ6QlR|)A;5p^;0vi z{k;CV9d`YO-$0WPV#-ET^~lxoE2?_750(e`jm*tkA0h=~cI=A26~y_frlf(flnkJu zvx6NTy*d$*;w7ja8`C~xBu`2G0$PTn;lZZV?5qlgxoVt&u4@Za1f&bC*<7J&NciTP z42+wMua>jbTnVDhKJZ2grEsLB65wlr2P0oyq-;g2zNJFFpVdSij%8*)JX03ip!ev` zbC?L~6OvJbZf_4M}kI>8qL zWJN7`r$4Awd?G(|Eqzsziu3VZZ|4XPf3TTQdm0+8_O9sgPtBvQsDB}K=2zV5h*EYKMFLVP%ewVIZ-UXOV{xcmDr&w zyktsZIUH61nYT#uqocoVky{#y7pbI9lG9Rf_HDYR;n3C;?$- zFB5+wzqoin0d7!%(;FJdAPihPtaCp)&gxdfVtRa4evhu&6n-Ncx!oi6+0g7hkeo7g zGBxK2J4s--0mn2rPvR)s;FG0E5V=TCb7P=B=;5ZA_R>{wEKjb$urWN(PyLu;crY9_ z53?`Ii%Vkq8B{X`C`3W4PULDY#|Te_{`%-^Z|BNg^_n^>I;~4zv#5r1eRV7k716_;X^Y}r{9B-{SPiWT(P*GCbU|=a41(BFx z*Ns`>&$ynR5F7pWg7RMGUf)i1l>@!mCSmqW;&0+w2Dtll)V80#Qz-?5Q)RU69GOw6 z6JKn;eTFIL^djCYk&nbtHAjj>AOt`5YNA$8LW+GI)BKzZm7Ws_Me{dvuS-wKKanjc-_zIdQLhZ89d3 z1E(Kz3Q0XvRkdvHMW4L*H-Y71@aAq>uTu=oorizLulzdD5(}pu`iSA(=-W(AE#}Dj z{(b78)6hm)JV3+SIDb9!S5yxYM4l1S8BX@s zG<%$WlsX|dQ^=2sU~pV>!U|n;6B~_qSr1|v<-AtKPcB4Jg-^gS!62yK%SA=3XT3zw zKS`aGhIwOGe3>=)rN|{qLSasS3$>SGTHqUwP&6sTl=!Fo;2 zjYbK2P1LhdQjdo!S;uMB~$hG1WftXuSZ!cZ8W>UvP+9WI_il%sv@o(1A3Iv^Y)yATh zsu^@YN5Wf<;$q9i&A8eeAw|HI#Y0>Yb-pLi`{fDJCcA~yNO%0LEq($bGvS^Y>YBv!cB^06v%vRf;F28<0L{in2e%NS;~RC1Vc2aqWOjx7^;_{1 z57bZUI>+`o%BY(AsMoG>S=~;OVJRuHR2C=C6_aR(|_xjzka_BK0tT&7;?Q7ajF)}TlFF~6XWm9i=5ICj<9}vHrWcv;^9y|t zBe}Y_5FHUQ85#QY-J7&Zg}xbQH3I?GS1lC7orvFW)A)c~GQ&*e7f**ZXN#lWh0P{U}ePCQ;gNMsde$wgQV@5f6G)z|%;wgm*CuObh`4vN5Ue*TeSUG* zxY{}C-f|M_w#(*IYH91Z|LX_|sN87#vloC~`u%?TGJQ)87o9YS=-#alDHedBk_o}& zlRdgvK2}<~d$eWBoEmdlgJD!0Q~2j=ncir2lut}<)?u;I|A zmeo}YKiqAb6+{Fds`k9U0r}S|GN)(Q+)SQ(yLCE-`Vl3UhNLA*tM8LE>YyTf*p`)M z(NZIR-v`qu!k#f6h$}b-(lVYnkS=y?Kla{*yc*8P4l=UT@~m3^^Nb{A$4>xVh(B zu6w)!z_86wY?f`BxB|;WLyoO7#{`<2?L{)G4EJ<))MzX7{QEI5Bo5?tEW&m=na&+v zIS4p3JD#mWk&xNaRw~@bGv8@Fu=?3$foGMt;&1$cDe32$X1lLYj0<}QLWzNw!9>a- zY%75=!Es8tIf;pYdh;`lXVsxdFG5!>;3MGG8X)|td67Kd>33D-2$(|F|EPr%N@UDfTT;_|_Jhwz0NU<6MH z{D~=$O#D+{=Rxf!=gGSdjpZTI7Z*|o^H{OLC%iB(I9>=}nc@rKkJ4LzxEK)2HHTbI z_Byc2tWP~oHkoWU%~o#Ah7A?)%z-RJb9=82{_y|rK`Um4P#zn7b%S4)F4Z30jLyYu zm%=qXpMeuhOO#J)e}T$^VgONOq^0hRRi!+YEj(9MH0+VPH<13WoXd`lPzq;Gz5%^9 zGltPh>y3l&|66=ZW#zkckGqlFgEGx*kWsy!`5 z!sw5fe}ZM92tUEuaHJUi^pEGS1#kz!fqu9+Y9PX2{=as?d&vGX(GyDl??mulPwsr0 zKI7?`03|T{Nk04+TmT$2{wo0H1$PYP6YwwlPnh5We!?U5m;3*ljGGjuv$^p&&6U2; z5z3CRsqeg9?7tYHucwXs0~N6|5*YL41=8!cQD|_eOz#{V2;5>i`wci-1oq&aJ-c~X z%%h9%GC)}QBh=xV_u310I0Q}Z%I#**Qo^g=MiM6+N)&*IF!1+rXUY(GAY}AI`%o!u z%0p2Czuf{Q?m5jm;szoD{gbW;M{Wth-dXo)y73aR#tZ^mR*c3gUeMogGvQs}L=Ws_ z0pceB5T00Y+Ca4V@n6l0?O>@}WqGObP_z4BA-RwUWe+)-#tgBD<>H?ac}E}Rl%<>A zR$)FDK08oIrQs2p%Kgxy^!nS7A??5g)R*)n5?9o{XsV4CJW@7K9!Ef81@_|bq8>&+ zYe}*pMit2X@#ak+cR-mg03w)=Txkw2JpG<^j#P1Cq$tW)! z5EjrX0UEHQYDQok51r;?8|cJM4rU3(@FvCB804~OFk_Lir8}L;Hdh}cmATcjv7WM- zgjtxS(|`CUZn9vTNV?5c+6{rPGd-4|9(YW$2ZcNB*O-De`82rDaGjT=fZZRZx=tzT zaCDe$_h84g^1#|5d4MLuV}PS0X1+lo<#ijBwr1Ih>~lZkmF~ zYL(BI8z**jK%SQ#HrwEHm}Qakl)r`P&R;n> z?k9;jnTE=2f5sX`S+kz69oV8N*cNH9X&_#g!N@kQ*RS2wSO;LqqqKV*IL!K$2z!8X z?YNx!>>sbK&D3*qg>C8@32yuo0WxRH@c4i z^^(K#B2n``kp?cJkZv&ixcUr#EZ<7#ac?u~u~P^m!_hxK;pL<1FjvwTf&s@R&oVT? zQgMYgx7U=-#&dkT@!yVA;tJy*;bx;4fY{lGrofJ4$@I>(YC+Jgnj#f6R3YX=I)iV5 zOA2c?;n1UoVv`HEG5hG&>zW^4#(S*5Igl-KazWMN_zsd;fAk zZ3bWZAYGVjpEiwizdj_jVeNWxf@IA?^3&Th(F)|pZFjx6YTGuiDSFtKSi8!yg#5W8 zG(!7Q>_7t}MZ8NHKxEQ#Xvs%ns*pO*Tt347x|Uh1bnG-U*1f7J5NSMgi+S)Yg->5d&IT zAD=Eg9)t!cw<$`+5OL&%{|38~Tb8Re>skPw&S&(%1OWPgu)7VWinn;>rxR4$(^iFe zmu#sH&VC{z4)uIfpkC-O`!nqZXv9hrZvt(UA&_L7R9YpV<^zjKdiuTh4!8$*C%0JY zXrlrbz0_gTHKjM*m!&=C;n0{nB=T3UiM4gtd|0fl-lh~Svuy%z$c>gmdypal|5SN;LZATf zAK`U@V6fOg6&DUUf^8Y~JaM}0BSkUp_K$a;L{|u?dyztN#C%vqG&&^+kOu=cYEX#8 zdXa=Ed0*|;189DmCh+=B<1>sZZ@s8#`}k>f--3Qw{ydxaJ|vsmX|m~*Qb>${sgGCO z>n*g72Xef`=g|_x-r1gLwX?Rehy1Mnm26kx(nEa=Pbc-CG>x1OU!#5|BE7ct{1nzx zr}mcm2wAL@*aSmdO5P*at&2hE{PYEK9xim1wXCv|X~t88u^RL6V<~+ke`3*e$IV`_N!ngKGE#_j)^!r-GJ!Z zKE&|%5&2=AW!|K~BL)yrhIANTn_7N-3j4tDxiiQra43*JpJZyA^v(13CJY8yv8nw) zWbE%J40$rdP5deWxB1d?%Y^X<+b{u?2r`PMl!)Fo=v#u7Xu27?hd7s(JyHY0oq33d z@jqzMzlIIjfyge!EuVwRCN3*`eN$bXzC*Mx@8PJ6{X`2j^eCLu4}!O?5dtQ_Wc#(X z#8JI+%wMU&)FwMnEuG%yNCK?o2Z88@`fU`fMm})c8RT^u-LEI!V6JGM^JJL*PJHF| zPL@2^^wzk%Zz9N=g=RADS63+Fx_}kRY1%IgOj3Joy@}ea(q7gUx_1tm3sR)SW7elY8nCJ)4nR}7gLb5&q+1+~= zW9RuBHEWjcPGuSMRh6m|Q+#`naGxj=P#*xESB5-8_Ks zqu*5gw2VIMtN79D+d=ym{bGdAX^RQ1%UdVmEgG-tzfv4mdLFjVJa?P_{r6$z7+Xka z>W^vcX9V0g+TVQvw62`%jKU0mE<)xpNlBhf2Kpz3O~hS^9$U~Eha!J!aEc>i#gF$=Vw-Rz z7EV1#--SSn?;)+6WMS%q_2#~=zv+wnR!3WpWrH|Oa>}}D3MHpIH>gjv5-bWP7kQQm zkdY+%QJ?wgHw-G_rDu#B7IAs9q3RmnGq}@lEz|4nOZ5MmNEYyMcd(hLZpSgJ9pzyk zQr_}023`mL3M>ZI8`Y6cE}$xz%^KiXmFd^4ije`K4!kqB`AU$id)yjzwS~R6HAIl( znh1a>&QH%ZYN#NIk4Ks0?&;%9L;Pa?F9grE)9)LAGUK+ei8C(S-LL@(KJQN!0pUJh zG6ASB)8i-FHc1N{rU=EYwSyOPlcy{vlatPLA?pgXr;9uc{Ing)dPV1ak51}~8w0)_ zmC}!c93M&DG{esn`B-xAIf!U4Hv%pNMe}kxTzFjv#yNnm_b=p;Z5{^P-j^Bn83UM%a%=HB*TASi;uA0xqJ&O9 zm9xQ+AMj5G*o@D~R{&n;!rFA?K(g@9biIxH--0(-7z$ry1aJBREu#ef1V63o`3Y8m zSHkdSt%kT@9+wLr<&|C2Ba}p;XHVtt$JpQ|mrFl5Z}*6Cf2l)np0Wq%F90atlr9!MvNo5MZ5=%=w~7hIUijWA zP~PwUG}-FJ)mm%T+9t^DYCC>qx6{({&URBn1%!Hc)jLz#PM5aVaJM|78KwoFP=^#o zB6XzxzP}+K923m7MM?vo^tk0!o*L@>73`?IlHvv=bH|ZLK;MkTa?|cuSs7w6Oaqkbw6z86>s>TVpp=)kz@W~f9}O;5fF~na^DkE&{KHbO zS1y)US1X}Vs6PfFItGSvVYP|5m7X4%D;FOhp;zZb@`N{G`om80?mu%Vz%rdaw0(+h zwWk7VOF0Gut6Te!euF*(Yfa7__&Dtx9GM%_Qc{W(3u7hpjf{+3U0u!0J~zHvQZlVB zC@7#`9%_oDuTy$l$Uuch+$!)s43Rr9PWxVAyWtBEi2;0ps86wuNEnPi-d6hKPSNj-P3dS{~^ zhyov?1_)svU8iK8GAqeqYR9tCZVUd#Q4L!VHOg;~0!=9o{(Hh^A!6ZzzyPn;L@(dW zYf*hWejb4NF8M}YXPlCRLH27I$;iSacKsao)~I>y-2Q=mZMEv~fo-0{LH}Nr@5|cZ z=;T4$jiFSo(}K%hj?LVIoPJnEhk_nsCCGfG+V&>HHrgarepA2#wZQ(Ea-cI>Ovr}V za)x*XJ39_unreX%Y3{xlh!|B5Eqg7^eq{nm$oplyMlHb90ZHkuCL@|=1Ra@SuKjw* ztugs1K{)5|Cu9J-)~FSJYT{nmSlwAJZn8|J#fpbOQz!$$yqc=l%BC>bd0eVygvGTh zFH?Lpp2t0D^Lv|>%YsyO!PpPS&OHJ}_GfldC7oXF+Z1@OKM+VPb+Nl6)1i}0FUjm4 z`F)d1#}gJQk|}z4MXQ}X2I!DYJ8059y6uRS5g3QBw*FF>0C3>{%47dKW3t2iNT3f z-GX08&3{TNH{i?3U^8o))ODOx-UV~4-f^~uyVJgwRy zZYk;q=g*K}+h}u-;MK(1fA4&P0^8Q|@C4~T9)PeUH3mA{p}yd9otkTr zt2Lvg)&exnoA&AG-n%}VjdQAmb==$840QE;jXjTI*#6aPx^vPB=qv7_5Nw98KAgFU zUv)#-;E1265*x6_oV{%q?DJAdMZ~5cs0;^1a#FnPrvY<8hC52-knpmwnH>nM$vCj^ zj}Cqc z3F#Ks_-jXuiiBVhiGadYzo;TisV#UoP)C09EieOjXyZ7EYGU3!ImO9Fdr3Xpm}>Ah zu6`++4fCcuVb`ZmCq(8bX&IhCW3F+q=X>?k;C4UgbfD%-I1ZQqNKc%(=JA(Kzcu?3 zHnv?=7Z^Fh)oW`3DN!`76gKYN-aFb#04F6TMq11kK9fSeYA%P?ZN?k+dpwQKm%&=ol{!;pLbB}+B^|1Z)SZ&JG9Q&IC%wmcm-c! z?iiA>Feve-|K5+SNZ+0A)_U(XaB!-sUP|A#^F9h&2>B)yds6mm=%talyMs1BU3QjXHQ5lSa5^A+nv9FlU^lO)rQV=jFX$Ks;4!~aI>qlLwmcMnaPL}9T>!P#oYY6ZDv<8E z_A+@eVwIu&>OeVW5W3EFYyqeR!~*{P?Iu7kQ0#^gEv#p7kV<^#l;J051KIt*u?D;r zXlX@7TkzS&`btU>CO_GWen=oGOQ1HJtp>o#8g@^VMk4GgN1_D4Mx&L?|377l#BcAXiE%BEH zdP;HY0ow4fVS_pzjNmbcx67Hyp-re57g_sV_jzg7{DIFY69PfwUY%@>=au@8%xw$*7=tpdAQjR%M{b~GVC!(F3x*X5}bxl#`)CzPUwd_#_2?d$G?*+Yvd>+Lr)bf zppyQta1O}jg_`YR-XFQYHt!38zL_AOJLu*D1?&~`LJ9(zU32mbdtQ8q=wfj4r-5l_ zEgguHWXsE$D__ube*Bi2q{d!o&u+4DKEgc4) zOr&yw27PzhkBom>{IL|msfe~N3f`s7Y5O*y!M}nrT`^cn@@p;@lb$VAb{{*CSYYQk_oq?p+dW-q7FrShbO3~Lg@94Ue8G%!8pe$jvA`q zq2AJ$Ufs5^nWmJl(`@$6;~XI4pV`%N76jPEw(vV^-|AGvZa!uO&3s!RQEP|z`TDoy z)psr+w>w<#p5$r3f{lvqaq8UhvLF>v6>Fa88?c#;#XilRTYI|A%f@dd9R=@0UMSKz zWrW(o$3LjX9izP3*kErFf_5e|!XAm}R2#G&1XiNgAQVVNV8-&p!e2)<=si?p2F1`F zynD3W;W3oQ3G=dzcwjiRCo7mb0u@yZ<3sUacWDjp3&;JUQviJeH#q4rphN^c44!%P zKeNCW<^M!b$3Sktq?~|V!S?Mpc>{FMP+{a^k&mJanYz9*G&ON?w6ZpyuZ7xVID+$%E+(mpo0mrQI6x@*!(E$_Y=w;5ax4HIx+cgX(+O= znm38vzl^{l_h?JkP1+%f$jrWlx({@2OZA_{)27_<4U1aaM>;$z{)jv)L_(V}m%!ye zIg%)Pn5lEHG}L-ZK#Q$RhwSah5z`Xf(}YDG?P9Ct5=7gO#iUc^T5U;fZEaOmRe8B` zzH+VI_xhvx-RCI`%F0K?w*dm9uv1L#qh`P0M<>Gyhk&GJsL>Eq^;266{Ai5wz`Vml zh({(;jUA*#!)Fvyfbg~eryL}dmZC&rJ^Mn^c4_hu!{a%cHN2UoG-=i$Gv1r8hTzWLmwtFJ$m6VbIAz_*fcx-29krkLs7Rbacl4T&6(+Pq)JScrU zKS5rn{PFhO)fxWgaO!{J(hi$3$$)~RHrax<$f6P5ID>!*pZhUo2g+V>^K^fjTiSUO zZ$qzo2kIA>Yq-R4-=^oL1K7a)!g_nu)ND~QUpY3ho}M3)EK6NN;yN|BXa2}I=I*4|`214kJu(fxGz0hlR6P~->kg$|L#6ac z7;$IZ;24(>WuD3-@LojTEM~K&E2mj5fxLTC_9)ANIv9cFf`Q*c^*}4D1xoWqR$usY z&0CGt5{Mr?m1&8gR=~XS=Cc<#{Oa?-$!Q_epFCjh>^To?wX8K+9_(S>`fEEF8X8B( z`1NhLBaI7IdLYF|4~npyQUMC3=SnWk^65D|^LV48boa8737IV#`kHXpxSPJvp646Z zCPc?;IGNq2xNv31WaBH;(5fMI-Hr8pByI#2Yci~=Kc?lcfA{K18Y30e?`7)~t>+Z1 zP1IBpn%#>%Tl_ZnIv7X>EWBlzU&}BOHWbnVA_KOhBw$P5^uBke|1w@#Bc}r@5lu@Z zlQRZNKKa1{Y8|tbS#8#rG3uwck5-}T-}+2PS26Nya;O7ZX>0u!N)|)ag%W863p2Lq zEj_N6g|vI@!uZUp8DcPICfmdYKToZ+v?e4pxUh5HhcB(RR#42tv=-Ku%5$- zLZLGQiAUv<-%BB`7BU|~Vq^PX68Ol@ssD1)y0ovzg9dfq{`H0#bW_8`s2c}j^1Zad z<&)zLp*1w^QP__kM`2Gtta!uwv$$ntg*H@T!O3C#H%-9p5CnGvKL}1AY**;YK@iiq zxT{BLq|$8e8u%9FP=0t~^S)0_O>OD+dCLmu>C^0I9vb|F_vHSR`G2p5Vr|*JdaQSm za-iy?s{vBHi$RbUw><-LQmY9luo zTQ5eM;1wml427NTu3`ZcaY85Vb_vQ8drE@?UX5~#j=Z>Vq|VS=^S>foBODlgH6v<)Fb;5ys}1m z^zaGh);Drr_w6F_+o;*km3&88wX3LtWD1=o<=}Um6`@n3om?Co+o)N;slvVeENp;AMf`G>Gu+%#W=mF)eApaG0egkCq|pVx3zvmzXy2=v7Y~E+Xpdkn z_&KuNyepJS$;1GetusJ#vA+-@JB%62WW?tdVcc1!!v7Ju%AgAdn1(i^yqZY^#l{3z z{HYa8E1KU@Bs7~UAoiB^C!u?Llir5q+1*t59*Olpxl}Lnrk-yKQ19W~y7denf;cA|>01PF&y7 zHbH->=5lDN-;#qM7YU{5Q+hnP@^Dj@KVB5y=c7%j33fW-<2~9mmbb!qbSAP?SSfKi zMX}fyUuoJsjN7iRj98g~V#z(xY{wWgO?mJ~R{ z53RGm>=gA5zaY>idw(tB<>V^KQuTS8>$YNlW^m&u>Zz7;sKEzS{|}idwr&oKbFmdr z&wRZKtV9)&M#a0mJvoDL0WAx+F_q1UA`ICuIwe#C0nOVuWw7bTU;~EsSyS)#1(|jmCk##63zRE}rGEW{@^tz(uCv+Hb`1vUR z(8=>p!(&@~92tL^cb$dEh({mjq_*Xw)km;^AKrJ#{zN7Qif6a|4lXus$B0bsJNL#5 z4`e=fcX*LaQY2Uz3;z~?kVT4ne|!0t2pYF??|nfne?-y3w6$+d(JA&wa+VHFO*FRl zwit!?z@(ts%*!WzP(u1VPEt(tA*Ua}QdMErxh;m)8FtaSL2Oz1Azz;;z~CkHJ&67H zbR}&)*&`UKR*qBvOjv&TpkT6YOsG0=Sr2@Nd^%?Q6(QF57tS{e`J*tVF^j#V6eAZK zTF5I&j*L53gBC@arHr+31C-G~Eln$!oKrjGNoHKkg-CnkD>36R%ZK_M9<{X&nK=p) zM-yZWsFank7iiO1RtQB#B(+3($MNn)P)$-ZcDb3Tj*Clt3ZwjTyW#nit@S1WGP?VgSY-Ay@gU6u$6XBM{eXuDBK_DFkF`8ipXqE0 zEPs-ATZ|0tJ1qT_=*6Tf1*8J#>GF_vN*z2FSRktx1W zZGZI^{^&%bmT}G~`3wg7U(W+*F%#Hp1$OlL` z_7}JYn859Fcds^3C|=F!bdWmHY}{#Yl~ks8EOa%{8FnaqkeYdUVK-S968H0oWE)eC zn!Tqq5DuZK6>JV}gB*^){&>b2A!wWn)1fbl67+lBaAn0wr!`|?J_ZoVlRlXah*|*0c`M7N z%=xTmsZb#G8$dxKUsLnoQSsl^JFO&C5mNdatC?MU@m${8826u29&%uBj)E!Gs`4MI zTAWQ`GG^w<(fT(9jTUShSA8y{}R=e}J4LAz4 zYT~~-iHQyYg<08M;Vu@wUi(xd?aiR1_%S_D*;1^WT9u4`=P zRgv2?Ag=${8q=>Abfo{*0*Jl}PNDm5#rSWl=pX;-9|+W3ho@4ZP(7vVFAEKX3px^Q zNHrI2Yf~%h6t%6N%gYU8!hjY=x8z~PGHk`d$)lvMj1GMPfe=4AaHkF;DyD#{9?TJg z?#M~aVj!gO&gy!f!+~->E35pc#MxDgLTaY^LAAr<1Gl4W*Vl-yobZ~6LB}y6bsz`^ zbh*@qluu<5c@h z+;~Ck8**mqY$q4bcN!%NzFWT@Kh3o z2^O80bypfx&w(tTVD3@1op+3c8vBn3e8&4>@S95&+li(yI?!(@IN;9~38R&_)y*$f z+J06ndJ8(#yw-uwXnE8q@^MGZLGe~SC3a$!r(#xKuJHGXrH5xpNzeyYw+r2-mq;Y# zO~TDaGWaa5A!9zvgSu2BD49q+y5aJ6CN_01bA*u>eMJ`slMnX@dB~IHi34e^hECq6 zVQ|~@O_P@Mtf^K}3%Sa(v%psP>uLgi$N`Iog;+I>yr@aSr88ffAM5)cKhLmR>YLui zMc`~(e&2*uhB&PY;FF$*g~LA+H|UFAK270D%d?-qbbY#C=DrZ-9K&Zqz)*fzdy-h| z^uc(}`xbLtB#bkeE*wJ=vG!Tg4@oJ;IgNeL#FS*W&8k$a(DG)BKOhA^HKFd4*vp?= z=Qf;4J?~@=WmDYZ1&I?ls&rr|$HQAUV6On4GsAi+#w9N zTPo9*m$06iQX{>^0rRn(7NU{0FIkZhj2X>Q@U5dP`dJSGP-4s>4jZT>_C9s{L|W7n z&s1G-1Bv=cdzckC1k=iLC>*moVj|S(E|>{_YG-c%)qG;4DL5oP((~?w$8jwh8}KZ` zUPZwz;?7^8$lfI_OrOTiS!b32J%)qG3oQkuP4u~Dm3sUE3 zj&4K8=+5F27j?$no;D~0)iB0w)<$UK)R}m#UHS~*k9(^o>;}X4%{*XyPav9D>d~ec z(EfVf95G}BKr2>D$4fB(^2SRCJjy|SsWQS41nK!N_X|N`$?=)g~TwqsA1h`_ZTVr2;M*-j_eT{5+>jV;@6{3 zNOPm%sDZ7cZ?(6b;9n4xw;8B3(l`D4mX!};=Y4Ng`p3bER+|x7hw8Nwixp8YIZlwu z^MEmCP*0g7s_nant~q$|7H|^9Le08H!{?r~BWnl^Ws_kWtOoT^hcb!E;k1X((G6>7 z94Zan*^d|JV;h@MqNWaQkzc^?B*Bb^Cp%?CbU=zlMDy<&TAlVh9L!NnBhVAD0b3#8 z^1ca;fiK^{VU)c5NlIRP=)g8pnr# z0}Pmbr~2RkW7MsmZ`eVBA%5pn#I@Ch!c`Uew!P08*zR=><`Z|1$Rs;t=kU`#+OI-n zRn%l6nm1m^0e4D`P_nBe!&(?4jl~o>jXz94o!=ik{p2F*0{2JFd@3Y}XQRDg=`llS z4vv_#nt;wL2kf;H=4>z$fV^q_4XpRq5;%IM8ul3Fp06?9x}JAH__7^&u1#P84mmdG z5zHuZnAcHL;#RMC+N48AsC=J>sZzE7EsaZNe0gU7P8}*`tbEyq-U%-1-)=rXQb8x& z?Vrs>8~zz?aiXH!)Lw5io;FamsHv0GADrO<3lkxJ9|bB@29{ zJ~BM(m}g?$Eu|m^?$^DZdVmM`BbY=v9{Wax=l;tpxw!*N;|5?|1CH}{4?JM;qJ6jM zLl3}5Y~UjrBK{M~47x7o4(w-u>+JhSa1{1+pa5O$x;nbKU(j(Lv33k}ec-?*!VIz- zf!6Q|x#1>}Di~VY+H#Tv;^N|pr}lJqcJ4jeZkxJ1S-d)3;JG7IBN6ty2kXlt(Re8` zF9QEC1q5b}&K??e+1lDA^1JY!ivsXI(#seBG`-3S%3LHZ*Q$LgvgbqXR^#lL6-Z?pjM~83-wUK>);EGYQ=iT7LoDL>K)9%zJ<%R}A<+i;+-t z;cCSt)Ei#$_y2tU|Fapu-9Vk1zxjrfQ>Ci2rD<&syx7B3Yr$BFlPQF%m2P8a%8rUFjQS~TsBDOnc9abA(SI)poJZrCxs&pVB0FtA@?ygIT0KJ-*= zuz52y?TfOfEv>|cdWrzODpGZE$ieO z^P!eUep1$dnqsX_WBiPwAk|)(mW+g9+^m|EnYmH5d%UxU2~>1!FXzk_c;+BY{11j~ zH9+lOc!W-pHs0`3U!vX_zxnj|I?jc17yAtz_dy&P#KKur%YJt@*%x|~{P{TGx0os8 z0(U$>z@nNK?$&tz4(Uc_Xx522hw&8= z+LaTX93V#gjE&yY&6B=h3CiYR&s3c1YLFX%u@czyIDT`LoEkn8h@U4eC+^ z&{cgU#a+SqOhXos@Y{x7;SnCt%xIiL=Ujn7A}+-ST@yceGKUD z`0W$cGpV`bty!0gn&Z7syER)8UNZ?^ktzo0m2@r6NTC-neDP(6=EbMVkH0QF7RdPm zyTF*_0);<$;hOHbqjDHgX$@xkRA7nq?rZ67LuQbrUfpL|h}#}7{9~DfK7(A7FCvPv ztzj#p)EI31h=zJ`&yHoQBnr+{f5Cc2y1nUku|SHsp7Anuf`fqtv@HCq-I$Bc_9IHi`qKpUKr|IRnLr7<)eMK+m~rkXxGaVCOF zkyV?ALffEN3R_jr){!P-$g2i_Lc4)*G#rA`=`hA;TNFBXX^O)xONR(F+pR*))g$AY z_d#4CFzte;EVdeQlj7^W@+_dH`#5DTJ_25y%w0O*e&gUDuGFa6yX}w(@jN!r>gl!j zp6DUWk_nZfxkxs?Opa5cpWwk@Fr%btM2khVNg>a8Z-({;B44bm6QUs8J*aiMT9@Gh zFvvQ;bz1qM4Y;Z{{gq#>P-~iBC@n%X9vcxO**SkE%>v@m1~-+$J9f2?R+%fkpaL~7 z5@en|3q=s(k_1=u@_^_Nx|+#WG}2CPd!oxMO^Y#!(lT)tu4~3C+MxkxS7kPFF@`6}{I!W=P;1TXgkTng{`41DGsrnPbz~hfhflu1Za-RPx$Iam{8Rue; zco|*`kp|^#zO#W1ZgxiG8V;*dj4yNA`0;`cjlgO6G#jW`cprJ%O@~J|T&P&T`*Wp^ zlsw+Y3UfY##-OXUh;sJ?B0_Nk(6i+z?A6F)+dx^k>z_DpFueUXY^L8akK*OLc8Qah znuz!Zx!%%ykVSyUrCQ9VgRC@87Qvj@(=8afk2`^j0v9+vKNzuq#H76@9=6q_AsIBp zJCOq&9t;vaQLtAsLFEl>pbRh%7A#q%P-3CyNE8@6Aa0{5IDHfxarX7Wx>$U17N=oY zF;n1ol#ZHFkovb7Dq%&aSa}n1lPSJ~9=CYpN`GWl`qK!|Q4u0ay6-d`{5)(TvE5N| zXfEv#%<)x@>33^i^m!ybQQlezfVgpm_wpbzi(q1?oOJoAJK2;`aCj6vOpFENlD^&J zUGQfZI79EDMkiT8b+8~~L5M~JT3KA{iv14ci~D!SeihwoS3B%s2%JDJdxliJ;r$g(pH4$Peok&0_{7h!;Ka8TIAh z1pP=7D-Nf>(%kBJ>92`{+evVy)+C8}YZQja@XIXScz0@Ps!v7^Bou$x~HN2D?Eiki|! zyyMk4c!xpi>ib62?0coWEnA)el#ZZ|W&qkqxt28PuT5Z?|7#Nf_HncW?uuq0T?*YE z`rFm20FV%9%m(@^&>hirZ|HA-p8_QRU!UG=Yex<>L;3fs^OMH*{VOJf_J1Fr_tkNa z``gh#%&a0fV4&N(v=rM39J86To`0~{l!<7zBh(Tb zh97b)`{whr9cVAqJ~L=-xt!9ADpP`7wvXL6^`7yY{_a*N4M#P6eFCcYKdqbo3GL#q z=x+Cjb^@{G@3`9B5s%}~O=TM|25Z}1-d72cnc$0sZ>R0B!}AbZP7&W5y%P*z?2_|u z3?D*h*+ETTf|bLf;Df(k|3`=)!AbrI`;!qQwn`d;rmL5+v~X7C*gkHFjymTqRpss6 zGp*xL0pp}D4W&4|v$88CEsdlk_@ACB6%`dt|F+q$m-0KwR-e&xY_)KJgNy^+PM? zP6#pO*wrbV#Q#O#M{$%68{*CR$|TgE_2NXJv+4H@Uq|J_YM&yAG|xS_u<_Kcg+5r1 zfTW^+U>>^z$}Zt`^fvX9`q8`AcE|{~w~r-h)l!a!icmR~y-&P}_{ zx&JcaR;($1Yi{@hHvuJz`f;)5ss+9KZ~|Dc-=h|w%&ttx!9_dd2aZG{Dy5JGG{WbO z`0^0&jc#%Yo$Yn5GtoZ2?;(=>Am7>P&~WI{RlvUJIZW;lWCrWy{u(GQe+TgKEBL#K1S&p5-Y_ok;k;WcZF#boYG}x!?+1Vecb&_8!s7=p&5|$SyAk z^&+}MBB;Rzd~#A7IEb3fDF=-0Tl`$+lRSbhqUb}w-DXnUi_yy^0M!LZjE@Us<>K39 z0~R4j82+lHR1$rHoh{j$dtsUrtZ}FV<}`e~YMph@Asb%t9n0=O1QtxJX@8d}Rr+m*hpKsB&1(*v)u-W-U)SA;nsB81y7K15^ge<;+ha+c zZNH-x4k1MW?zAJ2Lwg@}%aIcV=F4BGjc3!I^PLS9etO-p_71 zwZ0-?Wwj!8GM3acTl=Y|D|7aBTO`vTEcx!<^3HRX{kM-TLj&&u(y*wpn?_X<0O7@0Wbp=OCZy6mKnO>6Q&>?F!*s{{pmflj`>)GYWPdbNAO(~qd_0GP}NPC zm9C&cJoidh0m`tv{C11f$oCbD3vv;#R~RM@mLT{QLqr36Vm zW)=ALt9NLPUQo4@EmOTS6y?{D73!j1fFpVvodvC_62YWsBoCdUp`j*w)XLiY^1j2cI z3V9||O0}{F4YA7}9p}ut7LCt7e{|@%n2J&@TiWA-yf*t*<1-*QvihXuH9<=Xv+rAH zsW8*zQ5ZYX2g{=G?iQW~q`;7Ayt0)}g<{}qF#3`uPohCk7XNPuQ_``#cch{k0RWnL zS#j}TTSXDu{eagRp}%ShH9%NN?T2L;hT+=oG>1oFUyXA`msIef;(}iK2_;jRvoCKn z_Oa*)DZY9vd>+>8I~)XPn7@h(nD>BvX_DZ!J<3#1ynLLtHvC~ssvT*xaS{F@y;=(* za0Fc2P(hOI`!Zlx;z)CM{@XU>jUv{{Y{M5k{~y@19J4kxZg?c`*~Nq!sczxlIVKrx z8$YpDQBpaK8xi2!JL`+BQ64w+gmVs+L%^v{d4}NJ5&F%Ia;~ z7tW`c-ed{sBJKLtvga?tjEC6;X7k1OD6JG&#NfrqdI_o%=7SqkePZUvvw9UUMrZZv z7VYJo$8H&G+aC&hL6OZ!)*A(1L8FQ>et$6EbEOnu;P`wOAfW1cK+S@+KXgxd-2?jA zKW`!+qi`=6o+BynOp>O^7iy%-0L^u?O786Y#xk!{Fn#-u%nd8yZ_t;`7$QM%?NGRk zo9k9r9|Hy9C%L$7MV5~ear>XMr&U1$_H7(?;$MhDBoeHg`N%`o_y@=lTdF^gDvz?M ztcq*g`~1wUic6yg-GmUIaYiAEq0W&VWT0%9xJRvg6 zU$Y1|mrq z+?_K&J37foT%DNq*LI>-ndd&{(KFrrBO{Ja}IUOr>jLK!J^Fsx+el`3T27VkV(O5vm{Lu%$T9 zr*PWPPsOFzqQX8r60Kom5ZQ)M2!?R-()NiD?{^C!y8WRtH}6>WFlW!jsxu;rnp8ug zQdMr}bRdk9*2l!a?*AF0yI88jXq!qwBC(c}rQKPBNBm+}?ZNnn%5S$uE!WfAfoWM4 zf){cWAT?-Dxz3A~cA2d-mDG1&w8Bfij z7y?h=b_Zbk7mtG6gG1rd_g;gIg0TCg!RBidjW}4v>UzJMk?l4lf&0hZd_L*hKTUtZpJ+V_8{-SnsEjlJN8Xm>`oY&3KB0I#hTo-s+CU&#(WuQfJX?jz81v zd3j%)zkK~^OP2%7U`ps`o%m`9uW;w~=F?y)m4j;aH0GPnZQ<4z&@OZQ-whM%9~1iT zzFO5gn06LYRL(DnDi+1 z9E5Ds=UN?zgGI?#e|EkH$FyxoyG>R9QB79hnIC{j9o85)J$C-`S88|AY+^C;7diq{ zgAQ(nK9tVHS8=L1p`S!3PqDyT@}v1>H+JoDe~-eA7D!tb`l$?spNdgRsB91W^Y;C33fW-M4yzun~gJabR$h zh2%T%o>2AL9-~8Pkh8VxurSf(;X82aQ@qolOYfBW$z$I1FXOsm+hp6%2Qa$U{GZG> za2X*btm=kdp5IqCEy+-j>zgW$fwou7=#dZd-1J~d$ZR(nVaYVL3N}@gd*rrLsrLPS z{^@%ICx@zuX3~E5u?4&s3*+Vyg-shUJ2|}_V~40!h{$f5=9=%@zHDeL2Sc^e%|?DU zO8Tx(6Fm6;BL8)yg&Tbce7GK3n-X>3(d}k)l2V8DEWsV z;I~hgnx3zCI_o}jK6vkP)8Ut2D_0Ju*cc>5>6lRB^;JvQdgdRD4K5$(mb5NE4T z@2bSTPFPV;0`V26?oWE7o#u11=;&iWukRBweh=Io`g{T#-#iMJZn`Ew!Jc7S#f!~X zZX*2h9y+CR=6uM=w35eOYf^U|kV_~h^T}8#7;c*4iiQ5q)*`&xyY3?m#v7Fne&?!~ zGr{lfc@8VzoE82f`H$+uo4@s{8CleVJe?YMJG#U7avmBZR*PBHh)(D~LyELKG`=g7$wyo+GFYK*5ofa!O^xZCVKTQcQG|+(1*}bMl zUV#W0A|t~X7u4?bG&s<-?}sO!g~ZZ`X3 z`lRF4KP{lMgV7QH8|c4lBtaN98YY1TUwpMfX9!<~^U*jAH0(qho$ve4^Wv6PWZN~u zqSb>101#Xy6t@B}lWPP9`ns@G07HaM@I_zM^*=?>IGO)zkIDacq5zOWE7E;rMC5Wm zR_JiQ(D;I|QYk7HmT>0^JR%EDFh0dFouQ2BDOW_T|31bT~RO8F-E!3DR*HxQr7sG2w0bA__%Cok=oJz4~sA znU{BTY;0^~X=0f`@q`8XHvWX32sWHBW>()F~1q5m_sb z0ePb#IB3bqf(LtWYwL;m2T7hk!ri$XM{udr^mk5ocLRyxVtu|6s>ebJX@2#NH?sbU>N0L1ezelNwsglZj@Qgsma-0aR42IaDR)wUeeT+q1s z&#x|?RU=uzvJOspCO+ukC2!w*qLCJ z$_V}8rP5m#SjqrWrW5=;qRX_fkfJJ27gq03RcV4Wq#?7*&}nVoY(X8wZY1(0=|A5*Xamn`=tedR!DTdj5G21W}DcwtnLo(YYHFSWR8 z4J*?{+1Xt$`S+@lh-L=M>c+ECr3si^wVM)xW)rK0F9N4#D_qJfC5)L)EBkWaB(M;D zCm^t1&~oU2f;*kmkk2g18y205ULl#;R6xyoURXtpMsC&6&(9UyR-OxITK`d0M<3Rm*qkpYz~0cl+i1dyDzIM90)MvfqfF&slwaW$yEY zMkJh&z+DPDi}T(64uQ_SMmmD@vbS#MiB<@(Kn}s60q`ri zWT+xPL&}z3`c!8Nih5Iei0K=iMkRl7E%Dua(l@!8};iW+{_ zdK5gS4LM5!lZ#U{XoGl^|M*e@p+kEpu9wr7_Hek1m#Z^spd!@DQjn|rK+5oyCdKR* z_#;EuF})jzN;3ig1`@V`3ZZ9zY`{5Z}z00=XSewnc@!B*HrGo5T;e+!_RPG3_>w73pVJm+2g(l$p3tjMVM49rR{Ra`!(2a8XmSc# zasXNe0tP`YXPB08U?xawCK^Fh3OD6Dt^1{GAALjM;_Vk1M%ra~vfH<*LFF`sPuL{& zg%6+7UUH5>EFsn3gD1dZ8@#O3jrNd=h>ZRBUZOK-uTrnkn1}t%^*EE9-z$g z3H~w^y?Lq9dAS+8&8F|y9%CO?GXtYYU8gqvpZ!4|;X2oZ?XOOvRZ`&jp+tLiem?Dg z+Yq@NuW^`H6>s}Re#l`aWY_xiuSP)cw}9siz1KusJN}2*;NpA#Z1-ssJ_?J1lMYw5z(`yH+hRDdBVN@p z)><<=-!0Ufx_v{hyQO4;?|@YKuMGgnsl6PiJDY}}pUJM>)S*Tj4OjMs;@CwxU>J-r zf{GvgV=_Q;%ubyx>Vco5A3J>+zK31`Nx)mfqR_kQrS__!(+LQlOEX*&fs`H?w>|Fg^>@tz?6VLe;&lCL)MzXs%___a=wo&+MMg00Q zlbawfvcKo4T^mG2YPTO(vh9o8NOj^+#wK^b+=Y_|kWSB1%CTyy+c#_@{b`lgP>p!^ z&l!i!^sjH!+Oxuh=_Mxd-^?PHwcq?IA6CtO={-GM;A=6So@A?B>fF4zJ#9meaK1M` zL7j$?q|x{gFB0JAHR@Gz%wf9PqZ(K9IQ7yUiCqUIOPkS{f2jo6s&HkWNsMNmb}@`= zT+~|?{~8j#kwn~vw1VDh^`O17Eh)^5E|*mz;NeqG9k%UwU4ZpJS_EyROoB#T8HSM2 z1)bUcwuJ_*r8{4st;j~&g@$Y6Fyx@+r~*5GVd!Gm4TAB76Aa2<_;#rYDrqT^qqGg;#+fZljrzCZ>B zCdA*4Iky&A0MY(n1X%*JE(5w1Q5BB1V=|#@0=)J1T`=GcWq_8h{TDTAE}K0(=sEx` z8VKO!U+C?+ao=s*A3d!j;QuOG4fP`i5Zo`PtXOPC|0$YgM#`7>e-NU4de%KY8v>x9 zK19IN|EG;L9&S5v;H_y4ZOHh4KT(@XD72slmPLBy%~=9j@VhGfnF> zmPpKfyt*$W08H=hfvLj47yPOJNTnAnbNRz;o*uZ(r44q?g{w7Gm5zx!XUxLJRx*on637W@fZ349Zx(Yof(CXy+YMyuhMNk9Bf~^4| z`oQlsVl5`@sL_TEz#AkVCoeDW9r{Lfo&Cdiow%7jM*XY%YWYB3XLVIo>w=Xt*#$eS zEM5>rD&T6haoRF6Wj-`VJ6O$LPj?{vCgIXNpWOy$kg6JU*wTmXxHWrInTf{Cg|vPB3*!#BW}GR?cV~yyC;6|NdH#YqH9`jmnN+BOUj1<|4ih7Dt&}^I9 z9XO3+vTEBo&A*5HF&qFvw|eo3K^?nHH(pNQWt>+T)95QH(2ZV9`CXidA7-k|qI4W6 z@gA7zC#R=FNP?I!~`;vlaqTj=id?aP678#cv7RCK6q9DGgxEyPT7JNxx#VGigE9{Fbk7(g@=bqjru#ZTzkBy{`)u{?pR&wNpRxn3Ud z#!FL{_$hgXOYqVOb)ri$*y;4-caM$IBT3jRVV~GoxU&RaMx`X+lMsjC2!3;_k!u^-#dObf&Par1Jg zK>daq6<H{n%0~zr_!FVZn#@(eNwuRJj2w28|L+ zi#wSNUJg{0^Tp#l2ZW#8j+}XW4CiLIPK~-~Kg6AKotsCjADIUu>!~xRj5qt|Asx9k z##x+?)63)YxUosAXlkvtRy5o*)Lb7-a>2$%tZ4@0maQ0J(%}SYnJ(pBrtM8TPS8FCWvvxl_dA>}a5F zc_;2Hij05@^yt?@OLr^ZW@1k}GQ4gzbXP8)3KhYQ76xb#N&$KER@S^M^bs#d=|kdY zX5O~eOJJF$_F9nyMxYxYoQxJTb2^7Md04%XSvh){MPakSEMfhFGa?@{VsBn;^7)}=m!%&eah`KAgCM40&60#7wR{^Jo3gSp z;BAgbLvX?5i+qbs<+TY=_jY@1LAJ;usjnS)Bd6&@;;ha^Z6Q zQ64`sI@-!bgMaS;H*j0w-i7YwhHGk8!wsC>u5}C_AG-`n9TA4}W_b=O|4%VAZz-E9 zf88hi_C1UJ^{Z)udMsDbe(YGn*Tq~$TceGHx-~<6&v=~-P}a#=`sKi>*`mCfuX-=T z(5*ch;~$?^F~$eusKR(RmZir%9V_O+&apldWCh*PTFGqVd~9sHjS0kc>J+Bu_B)8* z7GSNavtEphR(;L0pS(_*I=-QsMLA4LUinWta?xY{>`AOuTR0r z_QVG4o~u8<@;?Wk;T`4R#(Kw`s$dE^u<^hfgpmUxYMCS| zA;vimc!??6pN4inl`s3j8!35GNrDq$#h(xo>pG_B*wOK_vCiLWdnw>dSrL6ALpwu<>r7zE6~1YqN0YY?KY2&j>tRz>&Og)qX?frr`K52Io#L+ZHLmUFkYD}S7)>-pk^Dmxw#x zI?La;no+rVBcI^n#Eav#>eX=#eTSqhm}otpjWiD+v%A#_fAEGjVEbPk`_L4Y&b37X z?$BF{Yli?3nV}6^_5Cv%V5jYkn{YJ%-Tk|< zc6bJp%Ys^EekG1IUmO0_KR7_5bWlZ49jC17=)xKlaU3NC2_(%6Qa+uTnoG-(|7u;| z<*;EmKm+#uz$o_H%J%&O2sp`tziJMei~p}@`BJq$V$dE1jNd71PTt@;EiCDP|KSFZ z{43VAPD`C#sj&cRd(p+A3yJ<2HlS3p#My1X8R3WqtST);`u@X3@Z1|c7zI-f27Q!- z-itw(dDsrhn9Zb=sW^hO3E4cKW{sl5`&Rl>6S*M62$BuPpLs0C$JnN{VAl+vNd&Pr znpw(uVR&P$cI7u4v27*f^tKQ)I9Y>#WN!Ma01gM^;krNm*6SLFKB9HCFLATopK*_4 z4n}P6vsngkNmiPZyZq)m&#;3{$`8(G*UT5jM%`neF51kEa=i#DMvmA;~S!U2Zn{5PYp@f-s5rGu; z^PJbi_wai=G7SWxB;EQjLmw_LBMPo^R1a(Cz$4Zz0cxUOL{UEh;1U#L(7iCoHs#9p zQ>vBgHzjWkP^ZhP=FrDldN(5wvFL3%jf#MGVYg@VkCIyw^~B0T+1qASKULv27UB%% zK!4wp*5oC|#1&9-LpGY26xBGy$sSM!kx<2=+n+>=aL-CB$Dn`11spT;^;M;HzI|ol z^wflfQUjzwzk-t_Vhql<02J#`#~*%!AjR~=k|;zjT?UEI+yDxbbM9^f%dBdR_f?V| z>@g_(&zu%A#F~fv5e%4!K z?>}qh=!&0~GL&YSjcb{sMmG0nom5Lw^8FM0Y^xlE9zw+GUEmj21#9<3+Wi;5Wga4@?Vsoe5kI$b9v#e~3{KnB*))c7Ll%%lK> zhJg=qAMmHu9xIamhwV>Ca@O32cp#>xrg0Ua`gK^_A*X*DpB>vf%t)30#1EkNr5zsV~OJuooR`71f~y{W!=-FU5T&S3IC zm>H0}_0^M`dj?Y{WpIFEFyt>u|~tx#`ad!_|Mh zZn(L91ba0%!dKDlhQjVw>KABo4P?$KVwz}|mM2RB&&}9nDdN-!+z>e-HNTI0gb|^! zGj~DKp~Ta}`X}Y(+ZeR|{%Xs|NYd0MACB0iu_NQM1KXM$XITkr ztXe4OUPNO18QO2$KKoIM^1dooYv||w(eHDEI12z`@I8{Ou%Vkt+;R2FQuS_4&PMI= zA;`VlR3Ur=kyL$&l9`Wp^3<}ZmT;rg8FiJ0xOr-^KwLZQv7cFzwp;Cse#SHDXLF0Xd(d*y7;t3TYW@z`k>`xpJDM~#IVPk|>@$!O zSmBDoVx7?!{~?O82DMor8@yuRyO&yXdoeU4aJsS%ZOf_2;_dchIxd0_i7K@9(rPq3 zk9m9HLNHY5^@GOWm$jfme(Zs~jZ}67YE(3}rbRR4)GfCiKkqD$%?% zdpaoIxz(@F<}%S!pr1*3*h~^8U}g9CBxxyIUhr382P8C00OD?1lm^K!}DY|V9U6+h+j&y zy1bV94wt;&M-q*9ODE;G<$t&~ggM9W^9erTPw;MLuyK)x4ULwv9G8m{(JB|3-i5JV z@MgU*OF(oEJEVD{KPb~W)zJ#4dlQ+>!C`f1@jaTUx-GDP%Jkk-LK@+z_c@t`?>upmAK45$jfV+=g{k2O)w8_c~u~~;7hZi z6y-iL-X+{yeb^Oeq0yE37;Pog8aH0OXu+3zM>52h#WAYxn+D{&Uh2e2y~=e61g7V{ z+IYA%ZR0-meYUfGglPCTS4HN)OKbHIlE;^`6$Z|Q-u5;W@ZK5qEYFmuxqVQ9H~|hpqSO z$jz~SvEog>lEq%TQZC))pEvk0+*h&)(^Rr3ioEbWv=OPUr*)jHDgX(W`b||Mx%K0V zD0Z*5q_rtFjdtxO%6@Z4*~BH!LMd**I>R^^`3RoPY@T%Yd^BI72^;+N*3$q5Sn)Yl zHOC(F4*7573CL1O3r?Io++~IEN05FXpM^To+~br}F+RDs*S~dboQ=`{%gup@G%Erl z>`=k}s4RHYi?P+^TXy%5bSrS;tea(>{J~eRJX#4d^YNV+K<%48FXxFVEpOI2Z+3GG z;e%*MgyqH$=vbgsjf}RDTNaTg6LMX5nJuEwB?cZ74?O34P6ZEscsxS*{FSh@BN$%KwP_t;mm!)riV0m-kCpAA_d$ttj0YwGJl zqKQ=D=RR<8sn@^!0k0T)MxGae&eb+DoJJA^7*~1EHe8KryeG>&NrPQyK3I<=b$H)x zfzEw~PfVY~PD5p4IM51z+9x?Hi*SIn!UcpL!iWxCE$9QH*|s1Xomr_bE@3N0bi_Tl zu0zOWX-);7kmQgG=^8v}gJ&$Rvq-}SzN{=ir6Z9a(&jyI8;n0_C2S#gVQ56k;8t5J zVJjio?DUBw?=%|(dW(}eIFfKjZvIwI+*m1Lw_ct&8-&7VJ#)&iwnhM>(CN20h3>s- zs?|u*=J!06X@gS!?Nut~G~kq|{aymgw2q?e>)5FmdtdV>MrL3#u>Z1>SVV5Y zrV*(?P5v-T!0nQ8g)z*V$v2$qmqjOhPXytMtfZ(L#!xNLps}2;Lhq2B@E4?14!tn< zGJx>Ez%{!yx{J}I zW4r`^<&M6!Nh+vneIi)V<0Bs^kBkR zi_nddfoafPr3g|Fy+G%R3)L8QJ{~<2qe))lgQ8zVp(L-b(O_F;C6csVubO?As=MQ} zeLeqTHB9jHLmkJ$t{UzKu%WE!6~@)Z;c+P4qqlz6ymDsFeI~Q%WGmT8GVG^2?M}dm zRvUfNnR-0+JGx~e9m2?%ILPt7ARHkd`WtCwZLNxXI{{M#c(a}n2BfKJwf#Zw&|`d( zAq%#v3%!cW2}4q)@#^1Xxzgh1wi4RwLL*2mzSlp^oagyK%`xAQ%J-#P!A2ql!MX=&%!4;a~0_)W7@OR z7>=--kNULX<~%&zU4!T32``nis=~9wQWej>CSWPbz+_-=kGtHV0+;62bS3eq#gYXu zzqxL`pdf$Ag{^!sH!{OlD z2=uwU*nt6vN{Yv?pO(Bsy~0vMV`Gi~cYPMNY`bfutxb3PMh*^I2c+u`Y~Drboy_nV zlKxNA;8k(94*$I6(5FM#!HLo(5wDp~5dCvKhk+2o17EZEk6V7&@$OoB%bSn|3Eb{z zgv0YFDtL71EWep2eeW3aPb_{}^JwX*wHgck%wy#vdy2v@dAtF~O!aFVb;|83Q+7)h zs9Moe{4*c37pk5gD68NH7i>ijlw6!c1ZZS2r2aTWg)=F(6Ut%V;&Q)$GN=zKoL!f} z8sh4MA6$JhV4UHE^n6eCJa*r$7y7~7P2c^UAS@Cz%@l zMlsz@%LdwL2nw!B_^#}p3$u%u;9fWls@i>d?>JV5%pfkx} z<6mYX3f7KK;w_bAZi@D<9#uWSg3E7_f5rnmj@_O(9WR=8MF`L~=Y2-`Bj8%5OFG=s z0l#eQs`f%eC388&i4T!vl%ek<|fs%fe%_Ws!wD=4re0qg4=?2&i$v& zd40h+kqkl!9T`$z?{8ej_6#np2JO+mHH+>=Wt?v(oHJHy+J&v1fI|@aqi9zSQ&|A> z{}5}OVq3O;AouNtTfLoFGQ$LGtcp^dNMG0$Bb!>>Ub%(YsE!KqDCH)p} zT>P!Ff6FluSfW2lJy8kx6z<;c{!)~wukM1%)|X;&PDsg*GAAza`!VS4;;!<-?w1_= zOrpKDHF^Mj<7fbEy{h>B8=s5Y$=70gBU3@rpi3^a``>;-ieFpZ;8xV%+WVH!+4iLo zulkE<;#~Upb^mxLYmaun!DojEou2q`>0`u^MI5OKCTyIo-S1gJQeCB_I;`C<(=Sst z3(3R7fPnE1kvxME8Tuue3!By=1#>I`LqLNjmFA@IQzc&8zcq#u+=xN<)A3!J@Z zL5nhqWBH;boo<^TzOvEbr2Q#Vw$60537x6LE3^6OlCKZKR@#Mf&urbTk^e+i^*Ces9Se5b zW6)S6uPpWv@80iG#?ep#ZaB&KXrdNBfihgBbbwL%BR6El@e$Vp4Xqp<$_p(Rv}xIg zx`)s56tQ@w_20jLuMv1&rjs*}j^rnslNB{!Jvt(_(dLIbsnMhFhA2=6-J^p*Qv2F` zcJk;BHb1H>GItz9Htwm_3Qz@W@j=Fw+UE?EHu@8g?jZfSPP}RHW{x+;5XPL0oZ;0lUi;L9v zTtl~2mr4L~NIyUAEi0Bv_dM2a_l;7a54Nl^Y@)kH4|R>`3Cq;ut;*XCdDYbJeWIs$ zW^v(zk~fmu#C!N_S|LmHw>Uq0;=!%+SS=~)RCyj$$KH$q+{H7pJ zxeLbpZaArt*UEMJxs_F}$u#fC4N@O|Vi&;=GiqTUNbjUY_t1=sz7r3REtDBv)v-D$29Lno1U9);^Ay$SY=z?5qt3X*r;Waz51YR*1TgqWMo^a7 zz2H3W4oz>M3ghkW>Dk;R#LAq*dbPX4o?Mi9nnH?FE2Wj_y_|v$3c6VB-a|mKjE&dJ z&AYULynyg^@Jdk0A?6q@t?@?2D0}wbSP0|r?wKtMvJcO@_r7Z}3298KzZNk=QEE=P z6G$)%l`KKPN?R;X#T<22Q1z#8-P_=^9_}>MO1FDuLUuVmgrARB4@BCis9!3k_na|N zS7O1~(v@R)VpZr(O%myn`JfuF3~Vn1!}69n$vWhuBN?HH4lu}$cJLTKV)j+AIG0Mv zy=g}+ON}CT*1imVZ}bR7jcOrNgo)rUB4FOTx-1vT2&dq_$f1jy>k<&j z0EMToDLreGJG|`d_<4HZlL3#vJ5bjebb-B3iMN$uF=81a*!2o8WDFE?2oyvO98T+I^^?EDZh}WqOEXlXo zaJ~_ca+5L{`7`%*z4ry|SMFQtsI*>U4=(8iZ%Sof{{zE@t9DE386Q;0aT@=i=Q|u9({8Wp#Gz6u_fx#DI%8EpzLZ);+_6} zA{&8LI4r%MM2dp`nY-H;g2`o57^fxrR{qqa;e> z-SxO%Gm4fVp=O1WIPN9F1S&N{rHME+ZQ(Qv^EF1^$cPb!7Q+|gA4iZ~Ai&DVox?hJrhg@&buN0an5a%E zI}vPJVzEK!{PePE9QLK|dtmdE^T{jc4js7=pV5!qfMh-#VZFhkaPi zS#K2gjrR*?5X`_Ws#^w~JpEDU=$`uutv3Sv8i792Apmo;1m=cMjstRL;xRX8g@iv` zX4FMwEnGlQHECrRM1AqTlBuKI!}m>oq^zhcGz)+wFCCF<5 z&rUxUFyI*&ED@Exd|KkP`^mcB9)$S#eP0vYC#Q#>-0DpXM7$RP~IqZU$rSW_Jr|?j>sFXo; z_9>s!d+9;VY1ybfL((iAyZW1uEI!DJYdc|Q4YG92eg9_=&J=y-)B@&ak)p(vo*2^j ziaoe1fDM15<8gje6{DBCeP(sXHbxg6F4vh;GP~#e&ux8}j#KJ!Hu7^)2Yh+eC*Y6O zA7BDt6rY}bqLX@*3+^@XjT{GL?K1)tbQbd~gRT4-mk4OlJ4(ly`_Fu1AcPOyH*~bV zx#r>g-00%w<}Ml{e1%1Ne}e;OUq5qu0mAH!4cs>OPV74i4xU;6%J zPW{K1fs4SyVb8M!u$oze%hux)HwT5j=WK5;H5)F)j+jbR*43@;{p0ZvXm8>!=`+vM zSXz#Km063W&P(qN31YMtW)9)Iqf;G5^Vin_q5(d6Kjv*O>oTVu2+dQ;635=H?hEoL z`W}8oSEcq}o!-{S?pKN(SxGik5BfmgMv~WSE|}O=N$s>tT<-KH6UBSr$L5c7{Q{s1 zVy(^Il^21TLf@mVs2;a5VYQ%38+d*_{MX7#6H(~Ajn!35L{i;Mp?XN&AjvanDoC@j zQCgwaQTW{Sa>451pP)vN2=#vTN_W@xb8822?fC0mP-xRhd}ZPmdWcmB&8_%kFelk& zm%ZRIjOX1YOt%y@*-l!av*TR)r%NDzAo7iKrL*b%x0OSleM$=jEy|+hI5dtExb8%- zZG-}jyhh^!9l6KTxs#=k&%$6eTwSJ*HcOsG`uEcaXjk?o9uzwBJaSG=lv#A1QfMn0YM<930 zYG1l%UV?-)CR}Q3V!hoCSFRop>zY17n_3E|XiZ8S^udTuyQINJwAz^Js2(X1t&d?> zZN!oF%t`m23Euuncr8}`kXx8!&T z_O4b?>{SLiN=adUk7J>3_GI-KJ{Ul z6CRG5GmIgp*J3uqv|dfVU;RAQCS~IJqYoGfdY+z+>U$h6eL#NN{LV;93S7T`;yjFN zr_;kNxic#d*!B&(ZN`>Xdg8kcODgl(Z5n9@bMBuYRq+?lYWaqs-jgyK_7Jn~{L1 zo6kp0mdg?9S6W^9GOE91y$fG&WQ*pDto!29BD5KtV0}v(?sA>`FeA~0uNU?tU=G^Q zlqp>B$IAy+fm>d_Mn3Ok)$Jpz?w@oeHwapOl<-3x8bz;cG=A%4c`0CNFH+mx$&=l; z+}wZV)+qJwWtr7wmE5DgaigQ>k!{@fRUCp^Ktqj;EN(7#p6$%cRua|XvvKG)iBff* zII~m-fw=(($3rc|gO&AP_fg@UQyZP)<_4FA5+ym8q{_J*Tc8~pd~N(&q1e1~vbRz>B4GK>b%Iw_R3YC&63 z3qiobJQEDMS=FkSYkq))b|i!Ic@KruYCRgR)o-)AqHq>0=~MzXsJXnZVk8__`yISL-q+ z)FbyN-etd1rr)2hRusfmiXZc*B0*wz13bL3^HHSikcvY6`~mI(o9ONgeM&UFa&K6~ z^t}c3oPjWo#-AZS9gD_BpC8#1`#ga^bS&W9aiXt1nR7Wrl9{(hq-qJgzN|*e2038l zj1ha7#QYRBie`swZf;74j$=*s_OZ=UkbSuFLEW01xJ}p~gl#+d%^R@^i&CFO75apP zpl5Jqk3%^rY#=y+sPZB^L;+@Fw8Bzqkb5tyTbRRLY?qQkCt&U17Wzx~-JDq7#5XTn z0v{UBx5ihu+T7i&2t1|y#Wx<8O16gx_2)eHJ~n0&BUT>f%ym;mvX@oHEUuTq)#@J_ zg(**+NEBHqp2DV|yi#KlyARY;R}?BO!uV(Jsp;cHBs-SAY@}m@St+OUUEc@$DvwL~ z!IdXDlhTWlDB)(JxoC9V={`6jE>Q;cdUm>eXVHo$PaPP{`ecfqBx`$6&+xs{89ujx z*zlcSo%m+|&HlR!t;q{5g;_%P2Y2@`cPAn*iLohfn-a!k1fMitF+*Oyb3B1w%P+(< z%J`!oAr9Sii_%eP#Gam9;|3=EzL;9Q7$H#yup4x3&i(TDFsA-D?4H>(L-IWrmwJq$ zSo4aU-KzSgEz36WvBpWUrgm>>`rvvx!?>`Cl)@TCUUCy;1AesKqF*!oyxAO$$+=_p z>-*q3mP_-IT-9r&=Cf12s+@Ein-q4)hJz}w8M9*X+L|&o1+js(m-)B`1`gy=R}{!< zwLaD?Nu}*@rIVW}qpo2iz;{OhC$9tBj;>}!#dI6@-q9}?2%GrA1M}%(pGz`_c#cdA zzl>vtM3MeO+@R>5@$q)z&!4~fOat2rnr#beyV2CVuabSZ;Z#D@(mV>A8yGEEm8^5m`ON~BIM4s=g9 zY%1p2KPb@Gb^~KJIIbRuTlHhhyWQsjvoS6*=0nb_k8J6`{FR% z;GEq^O$q1qAKe-E!>4ohHh;V&#H-LK!IspFTL}s+Z*P~CEq(jep^w_YaoO%m6gqrE zlvgURtJCeWOVjb8ff5XiU@rzYIy^Ae&*YnneQPXIM`Rq+QFhnt^&nAz9c_NI1aCQQ z_{(G3HIOtg_Lu*?{Fyu}3dspZ54ge(Q3R@iLKG=z68s-CD+?F|SP2+pBci9E2q*ye z+Wc@2fELf1J+WLnu}?GyVX6+1F*kV#iD?NL?7c4q63j8Hr*&$(k+9;oaaa4hNsLy zdA#z>xP`_Q)cnKY0tFP?FDCqA#@=5#-P|*<7Cni6jNRKgh9R@`^z@QbQvCG=u7sYs zW2zxCSdo(!-K{%;&zH5VsWVoL!-k<9sG>efu^4pawU{DHY7Cl7zmc0utnzVV!IQjq zuU@KptPSr3;$mq4iyZktEY)4?&reLO!&>F$;-5Mil%f)nFk`e#a01KE4z*l|b? z61Z7#QrNIc2zpY5b;_*KF{IXkcK=m12ifn076GX(aZ`AfOM&6rICRbdmh_kLClV4z z6pUma{H_~a+dz_jToc8ivonyykK5OOR$7m0_gnZY0(j@RAkyt9Rq3=okm3J~bVHdr z=)QV?ulYM%ok~TV&k)CevtK|Wt_c3%e$UkCvq}HY-Tz$vbN9p*3k-`FJxNZF4M7C* z)ivd;wXD9yxw&dI8r?R#;_P;^(YNrG&&Jl))}|JmH+p_*ga?`Cw_IvhMwdU_5UX41 z;ra|biQC57On-aKe!hX;M0wr}c6P1P?!Ei`G>bj?>+Hm|6#Crf&xtA|%=>2~H D?{hA> diff --git a/windows/keep-secure/images/intune-namedescription.png b/windows/keep-secure/images/intune-namedescription.png deleted file mode 100644 index 874b8b52a5f2c37f1437bcf578679b1570066e6b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 8789 zcmZ`f2UHVXvq8Fmpfp1by`u!_y%Rb}5djrkKnSAJd+$X;K%^r@YJ?C0X`=K*nt*ha zDvCys4pQ=h-~Y=0-gz^3Gjpfky>mAAWRqxSqDOa;?IH*SqJ!ycTYx~M00>0#n2MAr zS=`XSLnI{L7J8bX+F_1$;)Kjq!&n0Zs!yXiaU>_ssUPdxdV@fhy3a3?{zsKW_Y37_ zMwU86B?u$~0_lLXh{Fw}qXW`01L?p)5d;w82!tSj3U)|HNJvRZ$;ima$;l}xDJUr^ zsi>%^sVS+csTmpRnTWtl1O{dnmaA8Ka-gkQPWsOADl>rK6>-qve`RtVRbUL#*JuigPg2(Shs0&2-?z&r}`6 zkq+Wa2lYcwAEvLbZ(v|xY+`C|uHta#o}&}sq6KnsF?LC;btQru{J{fLcXxNV4hXIz z11Cm-%bdr6o56{YN*uB9)KqvX8eVV&FF1pvcHpQZc>Cf*&nE%rkQfk<6p)w~kdz-9 zdM6^nF)}hTHa;=IRVTsKEg>KvAs{g!F*zYIFCnKcp=LaZXq}Hvh0CPEbyDGGsj0+4 z44;~cI!Z;yrlN~e(dbn4L~8p^>c}_(fk;nJMgwvysb<8i==>x! z8jeQCo+lwf`wqIlAKkx%9$7?BbfPB+=&zmcQF-sXdf(5UboF3+dNO-@dU|_%`_cLR zM8FO8FA)Z7k_QjQ2M$He69#Ps|Gp>u*TF+m_q5n=Yr zbXVQ<+`{z1$?WXQ&qP>QUFt_K5eVPE*R2x)zxCrs{f{3%e*NCt-utt&f4n>&Xb5IE1?BYUR0B}RtAB2)XiH1uW01+dNrI_H`O%U|g3Vzur9UD#^82$MVQ=_ zjaFZVm^y`uzYvW*UB+7amSQ`B5*SjB#gwQ^vJ+dQEbMd=q4AMXai;l(%U3XVPk&v*80#_C%79th=4VD|5Gpc;zCC^UEE_RZQc@G8Y8-Q0RH>uurOkr@ z$o<=uHg=PMrJqPzL1+DvDmgGa@_2fR&y+XNOIlMY>2dAJ3vh8C(yj3!idli)1P<-^ zQAqWkzBMt!*?J5gX5nGS)jT*R+KfydoX%3R{o1xmW^e)g%%Rll@$~Ku%}KpGRl;Qr z<7kVSa@OFl8ymfEIdeBwo;0XDTW54)Iykvu#uNJTj2dWfc$Aj=ZL=E+dC- zje2__zvBpb(Ox^3oZJ{S{?G6q?6R$18XGConACI8I}JQ-E_R=`<8 z-l}0NSObfc{S($>@R)_t)>VR6 z`D}<~j_c!}w&d`950Ucr`+a`H{lKbrz@WP&KuvIk5%dkR>~TabbQ zcM6Om%64QDz>)R>uh@twjomT#6Z*@>k~*sXLIC; zr@x$k`}-IHB4EhJdErv*rDa~u3%(i4URoLgHEqpQ;E^g#Icf=s&SJ<*GjSiUb$;8y zQ=!oCz=J|H%?AJ6@o!+sgP@iSe$}v!gU|(jPrrKYV+MQeJb@qYCy>qr-I$-Xt&KEF zh?=(KeRhK_l>Qv)vLR-o@qT4oP$SMw)L#`=WA_~zXE`!&WH!aupCvFp?yBgk`ED1S zf%GiN+`Ty&-Gs9`#JR7*Qvnm%pwp68?KfQOMc8f^DL~%VbtuDkNI7TL8A-d0#2?d$ zb$>YtX=%T>;By(e(6yhZbT@>DoinFSk=4Gx-HWegqqHF71*>Cxw$i2=o0bI5M@x!5 z-~M*6DU0|Gsh9Vs5^I&y5AIHiGVJN(9MY6Nypn(8NhJ%9B+jEhf28ite~RJ&P%@Ivk9NUF zUJ>W_Cq$n@pD6lYE|0$>Qx^zp-zck)c+H0u+l1+`Rzkj;4oEW28j5UG@~gCRMmbFNIekkWl-sHoq4|(TC*}E5FP(PG&$K*A*IX*7 zi!bMarhsX))g_9Y^u&68{x&NpxZmAtp0$>`K1jwJ{h0{~tLqz6tB(c{x;P(Xpv1%( zHYL-W8NPV;!&`0sj6Uq7p0UTvM{moaFzU&l-+%nB9j(vThU%9BH=kK+V(hPaFvB51 ze7sXgBWSu4M%MCcvC$3R7q7Sw$i0c7TUHav`V?-Ng9ly)7~2kJ0~fjv5;NgOn$VRr zq=%%b@Qj+@Fz1`pt5n@lY@B-fmw^%WGKR&slq5CSeN7XFkLpRFIYIq5R-e|c=(2Un z;ZAlIYwskiYEz_~kfIKFkkXk)zi8dOJB(-^u6hSSKh(t1N<&e;5N!_*3~uOp-rKfR zA?cD`ruI|>?7O^XxoR51{LVGtP1a7h(44R|=qHKI-FIn-)1KQab!ikiXVVPOi#%;? z&^-6`Pxwx2ycqB&9pbEdNp67(9E)(E2ghn+iJT@@m`PI?D@@=62HW(D=dVIt7|PB5 zD*j7b%z$Cna+#|=(2;cxzr8>5oz-u3@QuwxWl$Uqfkd%jC>H7RdEvyupgR(V^(4vJ zXurd)>QOXPH-LE-5&!e@Z~>>Qa{x@=V#M4CD;bTy!5ouu;t9A&YLRSju+TR z}|W_;8L*01O;&GR;rKtLPMM!j0a#UG2=1@u98z$ep5UI!VX-u zYD*M)O*el=VY)Hy^UiO>ph8H@lcQ_J15TyTpon=A&6nevy%&5@dFz7cE%sg&sssK)xfsV=K5&a12>zi*}AwQiiRc-82 zmaM3$%f8aUQq6p=Nv1;Z^MuDF-^4O7GpBLWVR*8>o#wrJ0K9K(<&SvXCbeg~@y2Y|t=@u@zN}D5iLXfhIjd)L!6~W6&4#XAa32 z4wlAz6|7%XqfXooU980LqfU-2P47#qac(>&<*qM$7CbR`??oCpG(1dk(fm!vfKAR6 zf&9}#Uhvyq0pb0j>J8L!Ake`W7UQu;bxaq5SK%=-St4?UfjA^*m9|F5=us? zr>$LPerqvnXU;k9TD1-KLlMob?$O)gfx92LYm!XgoQW;`F6Ex%oc9Xb5($Sxf(NiJ z8u4<`g*q&hcJy>TzZ@SH3_t1%wuQiX4Lws}HN{fq&%o>89bxL^>(Y*ao<$iFj?d=Y zX3CeZOZ}OD^tp#JMx>e%gBBH+5EFha_n;*rcUI}f&kcNsa?zife0v<87q&O)(LxO{ zO*|cRs;3uwAnbvx3J^uT5uc!oO&2TBvc6;4YFz6kaVmfnM)+zA+O*IDOpUC7Z(DQJ zpem2?a`-P^tZ+3uG_c4c(Wp<}XYu|^hXyT98#iZ44PdcbGG&DVn)D+oWt~#^BEUor zMVK=Y?WeG+H#b`tNTC-22q_q=PI1nZs#9RBfs^?K$E`e4Fwr!U_FQ}J^VdlCtpKnR zF+-(6fnnA08!&Q%kj~KX2Fr8YB8qL*&c&MhHs0G=JvV9%qfLbokshYMmcGx4Q;@Dj+ac6@<|)U-*Ai^|Nuws`ckFfPAmKWdnWQXHO|-`U89GB5ToJ@v^FPT|pS%XB_Umk5%Dgivpr4d6faNAn z)R?B7iY^S{QS98i<&+Y$SEK4-{(@TO?pRDk!4~h|Y2jG8_v+~#$ zHtT+ry|LGDX&W@2)wu|8)7idu_*9NozT1$jcqYsq+E%IOobJ-jPnd3tX6lU;PFWdf z(JD?UX7x_0{i;61Ovd_pmzH7-3J1rus51<5QoNy?X~xpE!`|6g2^L71_cc}co`loz z3Cha$rUi+-{Nfc}S^YHWGI959RouQViM>`9_t9T?_bQx+{-I~T;XCwF9er%si-E%3 zR#6V00sv=30reWa8v@h}TZR8^8$M#kkbtq%VIY8vhzF^7%9iQ~e7JVsE&H3qcDwMm zyUtaRb5pFkt|zUn``}{BW(G^?8KLCl#QxG$iXc|q?}9B)SJF%l_NoCQ5`P2piR-xR z+~G?KibFAUEoAh&y;J_DH0jZ=U7bakVC#j{^Z}aEZw>ZLu3ksNoa@{rKE%#z)svAb zzU^b8{A!^1b7GF>b(nw%cJ*rkoy~WJdduuat_zs1g^vP18E^8E%&71&UWZE1`F2>C zE$ciuQXCy#z2`g&trcM?Ff0%PBNSL8XThX2P{dxUyL;oLVK8E7*55H4LQ^piza9C6 zoS2SPl`Qe~?cEs`s0j7_mT6RIj7Xh>WVz$%LYQxg7;%SHsuRWS@eRTu9wWeZYxvsF zUf+CN$M>Z8THhNq+{5qGIMJV|Fk-q{N1>Iw=Ke3n9IDIr5~H)O%xo8(ESGx!I>VNz z3~)i(Jb^vcq`-Mtz|zC@m61~&%vZPh#a%wcdTRpsWJ50tjVHm(sh6jm2v&?ozkQ<0 zGLx7iE;FAViMK}JvR=|*ly6Av{IX}+M*J*1^2(8YoHIpt2UGjY=qU0!@$OH%?Z{vP zRvN*k%Unl0L4r4}89yt?%LdFC9Wkq7u?vI1@voNq+c1xBW11|-IY)92`*-9Zd>&=q z{#cfsY84shngBk(2$bhp?%lZcta%@HRh*0*YN#IKo&4v81yAs!)=8i>dg4lTd1*0!lAT42=)yX{7NHl-hE zmY<#p;$!Kd+a1ziIw5skBK}*4-LE9h5toVX5r3a(BN3jb65uZ}$z67BGp z5TO}q+f|$Q&w?B`J-p`PB8A0)(iJLOrbTdq_(jWuMc(8q-zOhF81I0@2S8%N~9R& z-M=R=(^wC88PAkJceX8eK3;vow07jRkWGFb1>*}z7KV?t$_I8%vrLi1v)Tj#Xa0iv zvPde|+ne;P{Fj6F0OWR;?Z?3u!@rUC5G^h6Pqs2{)Ld^1NR%8uLh{~SO~+btxe?W` zqQ!S7#Ez7_UH{tB$B5s9HQ_^Jgx{#wAHy%Pe=?K1@_J|7Ar zLMOyU`uZr{Ta1WDRi5Mbgu{E5`sXYka6?m?NFMR(bWKWB~K z)%1%-oQ5oQH**CC@}4W=MwW9uw1|GG=f-|N7R*O<96qB54n1$~s#qqd zs}2}7Uf~5jTj$2vTmpo4@c#mj2)Irt5`AZHEtfAy^+22*-E0`z`1=aemo4q zGh^HP&H1{#cT3XiK6}wq^@gO6>BRjqRG)N;fU%(x=fA|NLS~ z_?;e4?Bgp|&#t;nXvD^obRZQfwVw>~Nt)!2KldA=)8HOx8?)I0CJ*Kn9HfIdO1dHk zjGp^?u$r!oTe!c;{IzzYwECgr;piRyS$X13W4*|#0z_79@5e)|Y$9*IBO{dQS9))K zpc0f_Yg(#m6Rx*(tJW^HjL<^Lnl_WW8bx<5{8e@Q~R6)`D1^xErEdbJ$E-s zOjB*{9W9C^3kM@Nxd-|Vv=)tG4p%Xn2_h?Rob5vFW#{_C z@$+v@=FF}}ERkvjlQ?8&PnViJrcU5VGV_dpfB#ZdqEG99rM0u>FRONP!kcKRL@@Y| z9p>K`G6zwMMoW#f#hxhCbDezU-<}j6f_r0CzgVp}`FD)fVP7U+0Tgnwlgp{$e62R&dwm-wS zw&t1tRP1qAh=&~>Co1=9Qh)(to&hy@BrO!1t6?3}E`rclqwLz`#X=YXga$>IA`$#Y^AGvUW692~1kXv-xg+C0gy{b_;6Fi#_Ww^R zjE#CzxU*|RMGYxdF#*4OEZ0~bU4-yu$eArvq0Bk26znlh&Y z7`zk^Z!zW0iD9p@(-0)$-(WLWFbsn1YG>0LQ7920Lj=Px`R91QEs!oX~+9X zSp$V?K?AxNwHe&+psoG6M=)%~u*3Z!M%e!IyJGxGuI5(mD`)7iV_oN3^jcr79e-Op zCsHfpyY08aAe6XcAK|IhNNvWebPtmiT}-$Zw3&QllBzKsKjVvezS(gN6VtGpZKW8p zn|~)x_6sKkyMTfmZvL{uNA>nk@f8tx?~{;e?y}nWCiq&tw38r4KvdfbclQA8-E=bs zFplF*F{%=kLzGzvSF1L~`Ob$wfch{#(kpvE?)BT9+N}I;%OK46e&Z7h10xYz%j6 z8uE@x-zL{eWH+wNUyAys9RM`Dw|XBQ*^bgsskFr(?|&*?zG*yD*#QRXtkd24-L z>+I^tRZccb?K?;#e}4uHl4eCR8__6QnR%+3+SYSa;{*N3bM+D*c%5!0zn@OD3_V^ezR4scHKCu=ZMT$N~AuUE~g zvfNC$5~Q2ULC+lIssDJu*wYp%E|GL`o9dPhrm1J3kfI_vEQyfWkP3(u;P<{2^{;$r z=K(K|%dL+IKuhzNjjQgr_=ex}`(aW}gP`&2?7K;)z$KRkw#!`T(wmVi#s%xNPgUQcBXrcDHJk+9-p81u z=Y`4-4&9OK-O*ol6KXrhOQ-GgGMduy?HM?=(lpk%KX>tY4oS0SO#OR0*F7t4So$L@ zE(9{nYd$GlSkid$X z|MsPiDTwiSB{@zxV|^Nz6lEYO8^(}K6|zSQM5>opr)A!b`P_rH5C(MAfa<%ZTGo|b zy*r@@^8+Qs%k*TavB#vC=(G+zB*V>J!`jF_xK0(@d_1d{;uppW1-E?i$$qTu=M?ii z`@Ztt4;gF#o6q)S-9Sh}X7{=t^osF1B>x$62A@vkwrK8#*^ zm!gE|4I_nSiZ}1l+Wz49IZ_c&1Eoz*mqxet-V)QMW_!Kp_4I>eg1d+{_V<3PJ)o9& z8ip+~kle0p#%0-~eBX(&x{dSt-&FE#p;9wbo0P!T zB*(BXg`7FOx_2jx8}B8(z0y*t<*DB1tQ?4eKnd%sK4vDADnP0yruA9qFH6!$5(Oc)?qU;yU z){C~SC9Y45qCn==^rE={rU|CBG23|YG9E9Z(m&0x2QgQ;Cp?-rY)&(EElfhtUy`+k zFX-?(65mJxP~+-F;R7ws8a>SWSBZupJ;=isGM&|p5AW7yge_rp0NxMW8;{IGW=-YEv2lqw3w&esOb2MbhFrTA{2ePMk7aOa{R0Z?4 zG|_(;VXKI^hMibWZVv9@t>U(#QY2U zbDs`iCXluImDvhWhVAX-;Kw!^aWbUw^P;$3j>fM(X+DCVo+;Qky6kW9bn9yu(u;F^ z`@a2p+u2~Vm(iRd!rEE3^w-#>6E3O8qcp03Sr&=`{)58RAJ+$wv4xDPLt(j@d*7TCp}2ugO{ zSuW8=>&w3~!mzLoB?V;@oYrw8nkDb{xLNDM+U=02)s9`^iuh*vmn^J1w_je+Z<4?f z{~EE3-}SN20nT`sxkvrAGhYWsyUA!@w(zN^3Ow8@S4~PQWBBu|#9*DD-N)6yVawcZ z%lxFbaY77amxT{Cn Date: Wed, 6 Jul 2016 09:51:49 -0700 Subject: [PATCH 16/69] updating text and images --- ...apps-to-protected-list-using-custom-uri.md | 43 ++++++++++--------- 1 file changed, 22 insertions(+), 21 deletions(-) diff --git a/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md b/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md index 5f10d77fb7..99ed1825a6 100644 --- a/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md +++ b/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md @@ -1,6 +1,6 @@ --- -title: Add apps to your enterprise data protection (EDP) policy by using the Microsoft Intune custom URI functionality (Windows 10) -description: Add multiple apps to your enterprise data protection (EDP) allowed app list at the same time, by using the Microsoft Intune Custom URI functionality and AppLocker. +title: Add apps to your enterprise data protection (EDP) policy by using Microsoft Intune and custom URI functionality (Windows 10) +description: Add apps to your enterprise data protection (EDP) allowed app list, by using the Microsoft Intune custom URI functionality and AppLocker. ms.assetid: b50db35d-a2a9-4b78-a95d-a1b066e66880 keywords: EDP, Enterprise Data Protection, protected apps, protected app list ms.prod: w10 @@ -18,34 +18,35 @@ author: eross-msft [Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Add multiple apps to your enterprise data protection (EDP) allowed app list at the same time, by using the Microsoft Intune Custom URI functionality and AppLocker. For more info about how to create a custom URI using Intune, see [Windows 10 custom policy settings in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkID=691330). +You can add apps to your enterprise data protection (EDP) protected app list using the Microsoft Intune custom URI functionality and AppLocker. For more info about how to create a custom URI using Intune, [Windows 10 custom policy settings in Microsoft Intune](http://go.microsoft.com/fwlink/p/?LinkID=691330). -**Important**   +>**Important**   Results can be unpredictable if you configure your policy using both the UI and the Custom URI method together. We recommend using a single method for each policy. -If you only want to add one app at a time, you can follow the instructions in the [Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) topic. - -**To add Universal Windows Platform (UWP) apps** - +**To add store apps** 1. Go to the AppLocker UI by opening a command line window and running secpol.msc. The local security policy MMC snap-in opens showing the **Security Settings**. -2. Double-click **Application Control Policies**, double-click **AppLocker**, right-click **Packaged app Rules**, and then click **Automatically Generate Rules**.

-The **Automatically Generate Packaged app Rules** wizard opens, letting you create EDP-protected app polices for all of the installed apps on the device or for packaged apps within a specific folder. +2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, right-click **Packaged app Rules**, and then click **Automatically Generate Rules**. -3. In the **Folder and Permissions** screen, keep the default value of **Everyone** in the **User or security group that the rules will apply to** box.

-You want to keep this value because your EDP policy needs to apply to the device being managed, not a single user or group of users. + The **Automatically Generate Packaged app Rules** wizard opens, letting you create EDP-protected app polices for all of the installed apps on the device or for packaged apps within a specific folder. -4. Type the name you’ll use to tag the rules into the **Name to identify this set of rules** box, and then click **Next**.

-This name should be easily recognizable, such as *EDP_UniversalApps_Rules*. +3. In the **Folder and Permissions** screen, keep the default value of **Everyone** in the **User or security group that the rules will apply to** box. -5. In the **Rules Preferences** screen, keep the default settings, and then click **Next** to start generating the rules.

-**Important**
You can also use **Path** rules instead of the **File hash** if you have concerns about unsigned files potentially changing the hash value if they're updated in the future.

-**Note**
We recommend that you use **Publisher** rules because they only work with apps you've specifically defined and they can be configured to not require updating simply because a new version came out.

If you can't use **Publisher** rules, we then recommend that you use **File hash** rules. **File hash** rules are a secure alternative that can be used on unsigned code. The primary disadvantage to **File hash** is that every time a binary changes (such as, through servicing updates or upgrades), you'll need to create a new rule.

Finally, there's **Path** rules. **Path** rules are easier to set up and maintain, but can let apps bypass enterprise data protection (EDP) by simply renaming and moving an unallowed file to match one of the apps on the **Protected App** list. For example, if your **Path** rule says to allow `%PROGRAMFILES%/NOTEPAD.EXE`, it becomes possible to rename DisallowedApp.exe to Notepad.exe, move it into the specified path above, and have it suddenly be allowed. + You want to keep this value because your EDP policy needs to apply to the device being managed, not a single user or group of users. + +4. Type the name you’ll use to tag the rules into the **Name to identify this set of rules** box, and then click **Next**. + + This name should be easily recognizable, such as *EDP_StoreApps_Rules*. + +5. In the **Rules Preferences** screen, keep the default settings, and then click **Next** to start generating the rules. + + >**Note**
We recommend that you use **Publisher** rules because they only work with apps you've specifically defined and they can be configured to not require updating simply because a new version came out.

If you can't use **Publisher** rules, we then recommend that you use **File hash** rules. **File hash** rules are a secure alternative that can be used on unsigned code. The primary disadvantage to **File hash** is that every time a binary changes (such as, through servicing updates or upgrades), you'll need to create a new rule. 6. In the **Review Rules** screen, look over your rules to make sure they’re right, and then click **Create** to add them to your collection of rules. -7. In the left pane, right-click **AppLocker**, click **Export Policies**, go to where you want to save the XML file and type a file name, click **Save**, and then clear your AppLocker rules.

-**Important**
Be aware that what you're saving are the actual AppLocker rules using your local policy. You don't want to apply these rules to your employee devices, you just want to use them to create and export the XML content. You must delete the AppLocker rules before you apply your policy. +7. In the left pane, right-click **AppLocker**, click **Export Policies**, go to where you want to save the XML file and type a file name, click **Save**, and then clear your AppLocker rules. + + >**Important**
Be aware that what you're saving are the actual AppLocker rules using your local policy. You don't want to apply these rules to your employee devices, you just want to use them to create and export the XML content. You must delete the AppLocker rules before you apply your policy. 8. Open the Intune administration console, and go to the **Policy** node, click **Add Policy** from the **Tasks** area, go to **Windows**, click the **Custom Configuration (Windows 10 Desktop and Mobile and later)** policy, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. @@ -59,10 +60,10 @@ This name should be easily recognizable, such as *EDP_UniversalApps_Rules*. 13. Open File Explorer, go to the location where you saved your new XML file, and open it using an XML editor, such as Notepad. -14. Copy the text that has a **Type** of Appx, within the **RuleCollection** tags, and then go back to Intune and paste the text into the **Value** box of the **Add or edit OMA-URI Setting** box. For example: +14. Copy the text that has a **Type** of `Appx`, within the **RuleCollection** tags, and then go back to Intune and paste the text into the **Value** box of the **Add or edit OMA-URI Setting** box. For example: ``` - + ``` 15. Click **OK** to close the **Add or edit OMA-URI Setting** box, and then click **Save Policy**.

From a2b719e1719688adec03d5fe994c433129af9da6 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 6 Jul 2016 10:17:22 -0700 Subject: [PATCH 17/69] Updating text --- ...apps-to-protected-list-using-custom-uri.md | 43 +++++++++++-------- 1 file changed, 25 insertions(+), 18 deletions(-) diff --git a/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md b/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md index 99ed1825a6..56525c8a4e 100644 --- a/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md +++ b/windows/keep-secure/add-apps-to-protected-list-using-custom-uri.md @@ -23,7 +23,7 @@ You can add apps to your enterprise data protection (EDP) protected app list usi >**Important**   Results can be unpredictable if you configure your policy using both the UI and the Custom URI method together. We recommend using a single method for each policy. -**To add store apps** +## Add Store apps 1. Go to the AppLocker UI by opening a command line window and running secpol.msc. The local security policy MMC snap-in opens showing the **Security Settings**. 2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, right-click **Packaged app Rules**, and then click **Automatically Generate Rules**. @@ -69,27 +69,33 @@ Results can be unpredictable if you configure your policy using both the UI and 15. Click **OK** to close the **Add or edit OMA-URI Setting** box, and then click **Save Policy**.

After saving the policy, you’ll need to deploy it to your employee’s devices. For more info, see the [Deploy your enterprise data protection (EDP) policy](deploy-edp-policy-using-intune.md) topic. -**To add Classic Windows applications** +## Add Desktop apps +1. Open the Local Security Policy snap-in (SecPol.msc). -1. Go to the AppLocker UI by opening a command line window and running secpol.msc. The local security policy MMC snap-in opens showing the **Security Settings**. +2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, right-click **Executable Rules**, and then click **Automatically Generate Rules**. -2. Double-click **Application Control Policies**, double-click **AppLocker**, right-click **Executable Rules**, and then click **Automatically Generate Rules**.

-The **Automatically Generate Executable Rules** wizard opens, letting you create EDP-protected app polices by analyzing the files within a specific folder. + The **Automatically Generate Executable Rules** wizard opens, letting you create EDP-protected app polices by analyzing the files within a specific folder. -3. In the **Folder and Permissions** screen, keep the default value of **Everyone** in the **User or security group that the rules will apply to** box.

-You want to keep this value because your EDP policy needs to apply to the device being managed, not a single user or group of users. +3. In the **Folder and Permissions** screen, keep the default value of **Everyone** in the **User or security group that the rules will apply to** box. -4. Type the name you’ll use to tag the rules into the **Name to identify this set of rules** box, and then click **Next**.

-This name should be easily recognizable, such as *EDP_ClassicApps_Rules*. + You want to keep this value because your EDP policy needs to apply to the device being managed, not a single user or group of users. -5. In the **Rules Preferences** screen, keep the default settings, and then click **Next** to start generating the rules.

-**Important**
You can also use **Path** rules instead of the **File hash** if you have concerns about unsigned files potentially changing the hash value if they're updated in the future.

-**Note**
We recommend that you use **Publisher** rules because they only work with apps you've specifically defined and they can be configured to not require updating simply because a new version came out.

If you can't use **Publisher** rules, we then recommend that you use **File hash** rules. **File hash** rules are a secure alternative that can be used on unsigned code. The primary disadvantage to **File hash** is that every time a binary changes (such as, through servicing updates or upgrades), you'll need to create a new rule.

Finally, there's **Path** rules. **Path** rules are easier to set up and maintain, but can let apps bypass enterprise data protection (EDP) by simply renaming and moving an unallowed file to match one of the apps on the **Protected App** list. For example, if your **Path** rule says to allow `%PROGRAMFILES%/NOTEPAD.EXE`, it becomes possible to rename DisallowedApp.exe to Notepad.exe, move it into the specified path above, and have it suddenly be allowed. +4. Type the name you’ll use to tag the rules into the **Name to identify this set of rules** box, and then click **Next**. + + This name should be easily recognizable, such as *EDP_DesktopApps_Rules*. + +5. In the **Rules Preferences** screen, keep the default settings, and then click **Next** to start generating the rules. + + >**Important**
You can also use **Path** rules instead of the **File hash** if you have concerns about unsigned files potentially changing the hash value if they're updated in the future. + +

+ >**Note**
We recommend that you use **Publisher** rules because they only work with apps you've specifically defined and they can be configured to not require updating simply because a new version came out.

If you can't use **Publisher** rules, we then recommend that you use **File hash** rules. **File hash** rules are a secure alternative that can be used on unsigned code. The primary disadvantage to **File hash** is that every time a binary changes (such as, through servicing updates or upgrades), you'll need to create a new rule.

Finally, there's **Path** rules. **Path** rules are easier to set up and maintain, but can let apps bypass enterprise data protection (EDP) by simply renaming and moving an unallowed file to match one of the apps on the **Protected App** list. For example, if your **Path** rule says to allow `%PROGRAMFILES%/NOTEPAD.EXE`, it becomes possible to rename DisallowedApp.exe to Notepad.exe, move it into the specified path above, and have it suddenly be allowed. 6. In the **Review Rules** screen, look over your rules to make sure they’re right, and then click **Create** to add them to your collection of rules. -7. In the left pane, right-click **AppLocker**, click **Export Policies**, go to where you want to save the XML file and type a file name, click **Save**, and then clear your AppLocker rules.

-**Important**
Be aware that what you're saving are the actual AppLocker rules using your local policy. You don't want to apply these rules to your employee devices, you just want to use them to create and export the XML content. You must delete the AppLocker rules before you apply your policy. +7. In the left pane, right-click **AppLocker**, click **Export Policies**, go to where you want to save the XML file and type a file name, click **Save**, and then clear your AppLocker rules. + + >**Important**
Be aware that what you're saving are the actual AppLocker rules using your local policy. You don't want to apply these rules to your employee devices, you just want to use them to create and export the XML content. You must delete the AppLocker rules before you apply your policy. 8. Open the Intune administration console, and go to the **Policy** node, click **Add Policy** from the **Tasks** area, go to **Windows**, click the **Custom Configuration (Windows 10 Desktop and Mobile and later)** policy, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. @@ -103,14 +109,15 @@ This name should be easily recognizable, such as *EDP_ClassicApps_Rules*. 13. Open File Explorer, go to the location where you saved your new XML file, and open it using an XML editor, such as Notepad. -14. Copy the text that has a **Type** of EXE, within in the **RuleCollection** tags, and then go back to Intune and paste the text into the **Value** box of the **Add or edit OMA-URI Setting** box. For example: +14. Copy the text that has a **Type** of `EXE`, within in the **RuleCollection** tags, and then go back to Intune and paste the text into the **Value** box of the **Add or edit OMA-URI Setting** box. For example: ``` - + ``` -15. Click **OK** to close the **Add or edit OMA-URI Setting** box, and then click **Save Policy**.

-After saving the policy, you’ll need to deploy it to your employee’s devices. For more info, see the [Deploy your enterprise data protection (EDP) policy](deploy-edp-policy-using-intune.md) topic. +15. Click **OK** to close the **Add or edit OMA-URI Setting** box, and then click **Save Policy**. + + After saving the policy, you’ll need to deploy it to your employee’s devices. For more info, see the [Deploy your enterprise data protection (EDP) policy](deploy-edp-policy-using-intune.md) topic. ##Related topics - [Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) From a0484a4e1f24cb209cbc5a6917fc1b11278febc2 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 6 Jul 2016 10:48:59 -0700 Subject: [PATCH 18/69] Changed Technical Preview to Tech Preview --- windows/keep-secure/overview-create-edp-policy.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/overview-create-edp-policy.md b/windows/keep-secure/overview-create-edp-policy.md index 119659b070..caa34aa197 100644 --- a/windows/keep-secure/overview-create-edp-policy.md +++ b/windows/keep-secure/overview-create-edp-policy.md @@ -1,6 +1,6 @@ --- title: Create an enterprise data protection (EDP) policy (Windows 10) -description: Microsoft Intune and System Center Configuration Manager (version 1605 Technical Preview or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. +description: Microsoft Intune and System Center Configuration Manager (version 1605 Tech Preview or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 ms.prod: w10 ms.mktglfcycl: explore @@ -17,13 +17,13 @@ author: eross-msft [Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Microsoft Intune and System Center Configuration Manager (version 1605 Technical Preview or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. +Microsoft Intune and System Center Configuration Manager (version 1605 Tech Preview or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. ## In this section |Topic |Description | |------|------------| |[Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) |Intune helps you create and deploy your EDP policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. | -|[Create and deploy an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) |Configuration Manager (version 1605 Technical Preview or later) helps you create and deploy your EDP policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. | +|[Create and deploy an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) |Configuration Manager (version 1605 Tech Preview or later) helps you create and deploy your EDP policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. |     From 4573ff486cfab120c74635868cd6e43626ddffe9 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 12 Jul 2016 09:55:00 -0700 Subject: [PATCH 19/69] Pulled content out of topics and into its own to better address customer questions --- windows/keep-secure/TOC.md | 1 + ...reate-and-verify-an-efs-dra-certificate.md | 85 +++++++++++++++++++ .../create-edp-policy-using-intune.md | 48 +---------- .../create-edp-policy-using-sccm.md | 41 +-------- 4 files changed, 89 insertions(+), 86 deletions(-) create mode 100644 windows/keep-secure/create-and-verify-an-efs-dra-certificate.md diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 504f41304c..0e7321d864 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -22,6 +22,7 @@ ##### [Deploy your enterprise data protection (EDP) policy](deploy-edp-policy-using-intune.md) ##### [Create and deploy a VPN policy for enterprise data protection (EDP) using Microsoft Intune](create-vpn-and-edp-policy-using-intune.md) #### [Create and deploy an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) +#### [Create and verify an Encrypting File System (EFS) DRA certificate](create-and-verify-an-efs-dra-certificate.md) ### [General guidance and best practices for enterprise data protection (EDP)](guidance-and-best-practices-edp.md) #### [Enlightened apps for use with enterprise data protection (EDP)](enlightened-microsoft-apps-and-edp.md) #### [Testing scenarios for enterprise data protection (EDP)](testing-scenarios-for-edp.md) diff --git a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md new file mode 100644 index 0000000000..5f98952a87 --- /dev/null +++ b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md @@ -0,0 +1,85 @@ + +--- +title: Create and verify an Encrypting File System (EFS) DRA certificate (Windows 10) +description: Follow these steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +--- + +# Create and verify an Encrypting File System (EFS) DRA certificate +**Applies to:** + +- Windows 10 Insider Preview +- Windows 10 Mobile Preview + +[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use EDP in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. + +The recovery process included in this topic only works for desktop devices. EDP deletes the data on Windows 10 Mobile devices. + +>**Important**
+If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. + +**To manually create an EFS DRA certificate** +1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate. + +2. Run this command: + + `cipher /r:` + + Where *<EFSRA>* is the name of the .cer and .pfx files that you want to create. + +3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file. + + The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1. + + >**Important**
+ Because these files can be used to decrypt any EDP file, you must protect them accordingly. We highly recommend storing them as a public key (PKI) on a smart card with strong protection, stored in a secured physical location. + +4. Add your EFS DRA certificate to your EDP policy by using either Microsoft Intune or System Center Configuration Manager. + + >**Note**
+ To add your EFS DRA certificate to your policy by using Microsoft Intune, see the [Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) topic. To add your EFS DRA certificate to your policy by using System Center Configuration Manager, see the [Create an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) topic. + +**To verify your data recovery certificate is correctly set up on an EDP client computer** +1. Open an app on your protected app list, and then create and save a file so that it’s encrypted by EDP. + +2. Open a command prompt with elevated rights, navigate to where you stored the file you just created, and then run this command: + + `cipher /c ` + + Where *<filename>* is the name of the file you created in Step 1. + +3. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list. + +**To recover your data using the EFS DRA certificate in a test environment** +1. Copy your EDP-encrypted file to a location where you have admin access. + +2. Install the EFSDRA.pfx file, using your password. + +3. Open a command prompt with elevated rights, navigate to the encrypted file, and then run this command: + + `cipher /d ` + + Where *<encryptedfile.extension>* is the name of your encrypted file. For example, corporatedata.docx. + +**To recover your EDP-protected desktop data after unenrollment** +1. Have your employee sign in to the unenrolled device, open a command prompt, and type: + `Robocopy “%localappdata%\Microsoft\EDP\Recovery” <“new_location”> /EFSRAW` + + Where `<”new_location”>` is a different location from where you store your recovery data. This location can be on the employee’s device or on a Windows 8 or Windows Server 2012 or newer server file share that you can reach while logged in as a data recovery agent. + +2. Sign in to a different device with administrator credentials that have access to your organization's Data Recovery Agent (DRA) certificate, and perform the file decryption and recovery by typing: + + `cipher.exe /D <“new_location”>` + +3. Sign in to the unenrolled device as the employee, and type: + + `Robocopy <”new_location”> “%localappdata%\Microsoft\EDP\Recovery\Input”` + +4. Ask the employee to log back in to the device or to lock and unlock the device. + + The Windows Credential service automatically recovers the protected data from the `Recovery\Input` location. diff --git a/windows/keep-secure/create-edp-policy-using-intune.md b/windows/keep-secure/create-edp-policy-using-intune.md index 17b58ff4b3..81f4eb2745 100644 --- a/windows/keep-secure/create-edp-policy-using-intune.md +++ b/windows/keep-secure/create-edp-policy-using-intune.md @@ -304,56 +304,10 @@ There are no default locations included with EDP, you must add each of your netw 2. Add as many locations as you need, and then click **OK**.

The **Add or Edit Enterprise Network Locations box** closes. -3. In the **Use a data recovery certificate in case of data loss** box, click **Browse** to add a data recovery certificate for your policy.

After you create and deploy your EDP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data.

For steps about how to create and verify an EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) DRA certificate](#create-and-verify-an-encrypting-file-system-efs-dra-certificate) section of this topic. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic.

+3. In the **Use a data recovery certificate in case of data loss** box, click **Browse** to add a data recovery certificate for your policy.

After you create and deploy your EDP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data.

For steps about how to create and verify an EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) DRA certificate](create-and-verify-an-efs-dra-certificate.md) topic. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic.

![Microsoft Intune: Specify a data recovery certificate for your policy](images/intune-data-recovery.png) -### Create and verify an Encrypting File System (EFS) DRA certificate -If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use EDP in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. - ->**Important**
-If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. To add your EFS DRA certificate to your policy by using Microsoft Intune, see Step 3 in the [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data) section of this topic. - -**To manually create an EFS DRA certificate** -1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate. - -2. Run this command: - - `cipher /r:` - - Where *<EFSRA>* is the name of the .cer and .pfx files that you want to create. - -3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file. - - The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1. - - >**Important**
- Because these files can be used to decrypt any EDP file, you must protect them accordingly. We highly recommend storing them as a public key (PKI) on a smart card with strong protection, stored in a secured physical location. - -4. Add your EFS DRA certificate to your EDP policy by using Step 3 of the [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data) section of this topic. - -**To verify your data recovery certificate is correctly set up on an EDP client computer** -1. Open an app on your protected app list, and then create and save a file so that it’s encrypted by EDP. - -2. Open a command prompt with elevated rights, navigate to where you stored the file you just created, and then run this command: - - `cipher /c ` - - Where *<filename>* is the name of the file you created in Step 1. - -3. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list. - -**To recover your data using the EFS DRA certificate in a test environment** -1. Copy your EDP-encrypted file to a location where you have admin access. - -2. Install the EFSDRA.pfx file, using your password. - -3. Open a command prompt with elevated rights, navigate to the encrypted file, and then run this command: - - `cipher /d ` - - Where *<encryptedfile.extension>* is the name of your encrypted file. For example, corporatedata.docx. - ## Choose your optional EDP-related settings After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional EDP settings. diff --git a/windows/keep-secure/create-edp-policy-using-sccm.md b/windows/keep-secure/create-edp-policy-using-sccm.md index 9fd513eda2..5668449d99 100644 --- a/windows/keep-secure/create-edp-policy-using-sccm.md +++ b/windows/keep-secure/create-edp-policy-using-sccm.md @@ -441,49 +441,12 @@ There are no default locations included with EDP, you must add each of your netw 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. - After you create and deploy your EDP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. + After you create and deploy your EDP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. - For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic. + For steps about how to create and verify an EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) DRA certificate](create-and-verify-an-efs-dra-certificate.md) topic. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic. ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate](images/edp-sccm-dra.png) -#### Create and verify an Encrypting File System (EFS) DRA certificate for EDP -If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use EDP in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. - ->**Important**
If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. - -**To manually create an EFS DRA certificate** -1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate. -2. Run this command: - - `cipher /r:`
Where `` is the name of the .cer and .pfx files that you want to create. - -3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file. - - The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1. - - **Important**
Because these files can be used to decrypt any EDP file, you must protect them accordingly. We highly recommend storing them as a public key (PKI) on a smart card with strong protection, stored in a secured physical location. - -4. Add your EFS DRA certificate to your EDP policy by using Step 3 of the [Choose where apps can access enterprise data](#choose-where-apps-can-access-enterprise-data) section of this topic. - -**To verify your data recovery certificate is correctly set up on an EDP client computer** -1. Open an app on your protected app list, and then create and save a file so that it’s encrypted by EDP. - -2. Open a command prompt with elevated rights, navigate to where you stored the file you just created, and then run this command: - - `cipher /c `
Where `` is the name of the file you created in Step 1. - -3. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list. - -**To recover your data using the EFS DRA certificate in a test environment** -1. Copy your EDP-encrypted file to a location where you have admin access. - -2. Install the EFSDRA.pfx file, using your password. - -3. Open a command prompt with elevated rights, navigate to the encrypted file, and then run this command: - - `cipher /d `
Where `` is the name of your encrypted file. For example, corporatedata.docx. - ### Choose your optional EDP-related settings After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional EDP settings. From 4e064571bc7deb976fc431845058092773c6a3d7 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 12 Jul 2016 11:03:09 -0700 Subject: [PATCH 20/69] Updated formatting --- .../keep-secure/create-and-verify-an-efs-dra-certificate.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md index 5f98952a87..ae8da1f1a0 100644 --- a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md +++ b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md @@ -68,9 +68,10 @@ If you already have an EFS DRA certificate for your organization, you can skip c **To recover your EDP-protected desktop data after unenrollment** 1. Have your employee sign in to the unenrolled device, open a command prompt, and type: + `Robocopy “%localappdata%\Microsoft\EDP\Recovery” <“new_location”> /EFSRAW` - Where `<”new_location”>` is a different location from where you store your recovery data. This location can be on the employee’s device or on a Windows 8 or Windows Server 2012 or newer server file share that you can reach while logged in as a data recovery agent. + Where *<”new_location”>* is a different location from where you store your recovery data. This location can be on the employee’s device or on a Windows 8 or Windows Server 2012 or newer server file share that you can reach while logged in as a data recovery agent. 2. Sign in to a different device with administrator credentials that have access to your organization's Data Recovery Agent (DRA) certificate, and perform the file decryption and recovery by typing: From 905d9446191ae2c61be625fdab2b34755796293c Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 12 Jul 2016 12:19:25 -0700 Subject: [PATCH 21/69] Fixing formatting --- .../keep-secure/create-and-verify-an-efs-dra-certificate.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md index ae8da1f1a0..133b453239 100644 --- a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md +++ b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md @@ -24,6 +24,7 @@ The recovery process included in this topic only works for desktop devices. EDP If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. **To manually create an EFS DRA certificate** + 1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate. 2. Run this command: @@ -45,6 +46,7 @@ If you already have an EFS DRA certificate for your organization, you can skip c To add your EFS DRA certificate to your policy by using Microsoft Intune, see the [Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) topic. To add your EFS DRA certificate to your policy by using System Center Configuration Manager, see the [Create an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) topic. **To verify your data recovery certificate is correctly set up on an EDP client computer** + 1. Open an app on your protected app list, and then create and save a file so that it’s encrypted by EDP. 2. Open a command prompt with elevated rights, navigate to where you stored the file you just created, and then run this command: @@ -56,6 +58,7 @@ If you already have an EFS DRA certificate for your organization, you can skip c 3. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list. **To recover your data using the EFS DRA certificate in a test environment** + 1. Copy your EDP-encrypted file to a location where you have admin access. 2. Install the EFSDRA.pfx file, using your password. @@ -67,6 +70,7 @@ If you already have an EFS DRA certificate for your organization, you can skip c Where *<encryptedfile.extension>* is the name of your encrypted file. For example, corporatedata.docx. **To recover your EDP-protected desktop data after unenrollment** + 1. Have your employee sign in to the unenrolled device, open a command prompt, and type: `Robocopy “%localappdata%\Microsoft\EDP\Recovery” <“new_location”> /EFSRAW` From 2c8e5b7e4945b67aefb2f43a89881479cf799705 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Tue, 12 Jul 2016 14:06:14 -0700 Subject: [PATCH 22/69] Updated change history for new DRA topic --- .../keep-secure/change-history-for-keep-windows-10-secure.md | 1 + .../keep-secure/create-and-verify-an-efs-dra-certificate.md | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 812c222e48..ff277a1095 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -16,6 +16,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |New or changed topic | Description | |----------------------|-------------| +|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |New | |[Create an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) |New | diff --git a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md index 133b453239..03d72f1d40 100644 --- a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md +++ b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md @@ -1,6 +1,6 @@ --- -title: Create and verify an Encrypting File System (EFS) DRA certificate (Windows 10) +title: Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate (Windows 10) description: Follow these steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. ms.prod: w10 ms.mktglfcycl: explore @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: security --- -# Create and verify an Encrypting File System (EFS) DRA certificate +# Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate **Applies to:** - Windows 10 Insider Preview From 56ec734cade0f4b25a3e047b0ac4a45bed5879ed Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 13 Jul 2016 09:24:26 -0700 Subject: [PATCH 23/69] Created new topic for inclusion in the guidance area --- .../keep-secure/mandatory-settings-for-wip.md | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 windows/keep-secure/mandatory-settings-for-wip.md diff --git a/windows/keep-secure/mandatory-settings-for-wip.md b/windows/keep-secure/mandatory-settings-for-wip.md new file mode 100644 index 0000000000..9c265848d2 --- /dev/null +++ b/windows/keep-secure/mandatory-settings-for-wip.md @@ -0,0 +1,31 @@ +--- +title: Mandatory tasks and settings required to turn on Windows Information Protection (WIP) (Windows 10) +description: This list provides all of the tasks that are required for the operating system to turn on Windows Information Protection (WIP) in your enterprise. +ms.prod: w10 +ms.mktglfcycl: explore +ms.sitesec: library +ms.pagetype: security +--- + +# Mandatory tasks and settings required to turn on Windows Information Protection (WIP) +**Applies to:** + +- Windows 10 Insider Preview +- Windows 10 Mobile Preview + +[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +This list provides all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP) in your enterprise. + +>**Important**
+All sections provided for more info appear in either the [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-edp-policy-using-intune.md) or [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md), based on the tool you're using in your enterprise. + + +|Task |Description | +|------------------------------------|--------------------------| +|Add at least one app rule in the **App rules** area in your WIP policy. |You must have at least one app rule specified in the **App rules** area of your WIP policy. For more info about where this area is and how to add an app rule, see the **Add individual apps to your Protected App list** section of the policy creation topics.| +|Pick your WIP protection level. |You must choose the level of protection level you want to apply to your WIP-protected content, including Override, Silent, or Block. For more info about where this area is and how to decide on your protection level, see the **Manage the EDP protection level for your enterprise data** section of the policy creation topics.| +|Specify your corporate identity. |You must specify your corporate identity, usually expressed as your primary Internet domain (for example, contoso.com). For more info about where this area is and what it means, see the **Define your enterprise-managed corporate identity** section of the policy creation topics. | +|Specify your Enterprise Network Domain Names. |You must specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. For more info about where this area is and how to add your suffixes, see the table that appears in the **Choose where apps can access enterprise data** section of the policy creation topics. | +|Specify your Enterprise IPv4 Ranges. |Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries. For more info about where this area is and what it means, see the table that appears in the **Define your enterprise-managed corporate identity** section of the policy creation topics. | +|Include your Data Recovery Agent (DRA) certificate. |This certificate makes sure that any of your WIP-encrypted data can be decrypted, even if the security keys are lost. For more info about where this area is and what it means, see the **Create and verify an Encrypting File System (EFS) DRA certificate for EDP** section of the policy creation topics. | \ No newline at end of file From be179441ece74f8c7868c131255860d7ba79b7a1 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Wed, 13 Jul 2016 09:25:45 -0700 Subject: [PATCH 24/69] Added new topic for mandatory tasks --- windows/keep-secure/TOC.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 504f41304c..f478cdc121 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -23,6 +23,7 @@ ##### [Create and deploy a VPN policy for enterprise data protection (EDP) using Microsoft Intune](create-vpn-and-edp-policy-using-intune.md) #### [Create and deploy an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) ### [General guidance and best practices for enterprise data protection (EDP)](guidance-and-best-practices-edp.md) +#### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md) #### [Enlightened apps for use with enterprise data protection (EDP)](enlightened-microsoft-apps-and-edp.md) #### [Testing scenarios for enterprise data protection (EDP)](testing-scenarios-for-edp.md) ## [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) From 822c5361923d799d09d362ef0f6bc931438fdda7 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Thu, 14 Jul 2016 12:00:58 -0700 Subject: [PATCH 25/69] Reorganized, rewritten Device Guard deploymt gd --- ...iles-to-support-code-integrity-policies.md | 327 +++++ ...ty-policies-policy-rules-and-file-rules.md | 108 ++ .../deploy-code-integrity-policies-steps.md | 384 ++++++ ...ce-guard-deploy-code-integrity-policies.md | 30 + ...rd-enable-virtualization-based-security.md | 246 ++++ .../device-guard-deployment-guide.md | 1169 +---------------- ...ed-security-and-code-integrity-policies.md | 78 ++ ...certificate-for-code-integrity-policies.md | 101 ++ ...-on-the-device-guard-deployment-process.md | 56 + ...nt-planning-guidelines-for-device-guard.md | 124 ++ 10 files changed, 1482 insertions(+), 1141 deletions(-) create mode 100644 windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md create mode 100644 windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md create mode 100644 windows/keep-secure/deploy-code-integrity-policies-steps.md create mode 100644 windows/keep-secure/deploy-device-guard-deploy-code-integrity-policies.md create mode 100644 windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md create mode 100644 windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md create mode 100644 windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md create mode 100644 windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md create mode 100644 windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md diff --git a/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md b/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md new file mode 100644 index 0000000000..626a9a939b --- /dev/null +++ b/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md @@ -0,0 +1,327 @@ +--- +title: Deploy catalog files to support code integrity policies (Windows 10) +description: This article describes how to deploy catalog files to support code integrity policies, one of the main features that are part of Device Guard in Windows 10. +keywords: virtualization, security, malware +ms.prod: w10 +ms.mktglfcycl: deploy +author: brianlic-msft +--- + +# Deploy catalog files to support code integrity policies (Windows 10) + +**Applies to** +- Windows 10 +- Windows Server 2016 + +Catalog files can be important in your deployment of code integrity polices if you have unsigned line-of-business (LOB) applications for which the process of signing is difficult. To prepare to create code integrity policies that allow these trusted applications but block unsigned code (most malware is unsigned), you create a *catalog file* that contains information about the trusted applications. After you sign and distribute the catalog, your trusted applications can be handled by code integrity policies in the same way as any other signed application. With this foundation, you can more easily block all unsigned applications, allowing only signed applications to run. + +For more description of catalog files, see [Reviewing your applications: application signing and catalog files](requirements-and-deployment-planning-guidelines-for-device-guard.md#reviewing-your-applications-application-signing-and-catalog-files) in "Requirements and deployment planning guidelines for Device Guard." + +## Create catalog files + +The creation of a catalog file is a necessary step for adding an unsigned application to a code integrity policy. + +To create a catalog file, you use a tool called **Package Inspector**. You must also have a code integrity policy deployed in audit mode on the computer on which you run Package Inspector, because Package Inspector does not always detect installation files that have been removed from the computer during the installation process. + +> **Note**  When you establish a naming convention it makes it easier to detect deployed catalog files in the future. In this guide, *\*-Contoso.cat* is used as the example naming convention. For more information about why this practice is helpful to inventory or detect catalog files, see [Inventory catalog files with System Center Configuration Manager](#inventory-catalog-files-with-system-center-configuration-manager), later in this topic. + +1. Be sure that a code integrity policy is currently deployed in audit mode on the computer on which you will run Package Inspector. + + Package Inspector does not always detect installation files that have been removed from the computer during the installation process. To ensure that these binaries are also trusted, deploy a code integrity policy in audit mode. You can use the code integrity policy that you created and audited in [Create a code integrity policy from a golden computer](deploy-code-integrity-policies-steps.md#create-a-code-integrity-policy-from-a-golden-computer) and [Audit code integrity policies](deploy-code-integrity-policies-steps.md#audit-code-integrity-policies). + + > **Note**  This process should **not** be performed on a system with an enforced Device Guard policy, only with a policy in audit mode. If a policy is currently being enforced, you will not be able to install and run the application. + +2. Start Package Inspector, and then start scanning a local drive, for example, drive C: + + ` PackageInspector.exe Start C:` + + > **Note**  Package inspector can monitor installations on any local drive. Specify the appropriate drive on the local computer. +   +3. Copy the installation media to the local drive (typically drive C). + + By copying the installation media to the local drive, you ensure that Package Inspector detects and catalogs the actual installer. If you skip this step, the future code integrity policy may trust the application to run but not to be installed. + +4. Install the application. Install it to the same drive that the application installer is located on (the drive you are scanning). Also, while Package Inspector is running, do not run any installations or updates that you don't want to capture in the catalog. + + > **Important**  Every binary that is run while Package Inspector is running will be captured in the catalog. Ensure that only trusted applications are run during this time. + +5. Start the application. + +6. Ensure that product updates are installed, and downloadable content associated with the application is downloaded. + +7. Close and reopen the application. + + This step is necessary to ensure that the scan has captured all binaries. + +8. As appropriate, with Package Inspector still running, repeat the process for another application that you want in the catalog. Copy the installation media to the local drive, install the application, ensure it is updated, and then close and reopen the application. + +9. When you have confirmed that the previous steps are complete, use the following commands to generate the catalog and definition files on your computer's desktop. The filenames used in these example commands are **LOBApp-Contoso.cat** (catalog file) and **LOBApp.cdf** (definition file)—substitute different filenames as appropriate. + + For the last command, which stops Package Inspector, be sure to type the drive letter of the drive you have been scanning, for example, C:. + + ` $ExamplePath=$env:userprofile+"\Desktop"` + + ` $CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"` + + ` $CatDefName=$ExamplePath+"\LOBApp.cdf"` + + ` PackageInspector.exe Stop C: -Name $CatFileName -cdfpath $CatDefName` + +> **Note**  Package Inspector catalogs the hash values for each discovered binary file. If the applications that were scanned are updated, complete this process again to trust the new binaries’ hash values. + +When finished, the files will be saved to your desktop. You can double-click the \*.cat file to see its contents, and you can view the \*.cdf file with a text editor. + +To trust this catalog file within a code integrity policy, the catalog must first be signed. Then, the signing certificate can be added to the code integrity policy, and the catalog file can be distributed to the individual client computers. + +For information about signing catalog files by using a certificate and SignTool.exe, a free tool available in the Windows SDK, see the next section, [Catalog signing with SignTool.exe](#catalog-signing-with-signtool.exe). + +For information about adding the signing certificate to a code integrity policy, see [Add a catalog signing certificate to a code integrity policy](deploy-code-integrity-policies-steps.md#add-a-catalog-signing-certificate-to-a-code-integrity-policy). + +## Catalog signing with SignTool.exe + +In this section, you sign a catalog file you generated by using PackageInspector.exe, as described in the previous section, [Create catalog files](#create-catalog-files). In this example, you need the following: + +- SignTool.exe, found in the Windows software development kit (SDK—Windows 7 or later) + +- The catalog file that you generated in the [Create catalog files](#create-catalog-files) section, or another catalog file that you have created + +- An internal certification authority (CA) code signing certificate or purchased code signing certificate + +If you do not have a code signing certificate, see [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md) for a walkthrough of how to create one. That topic uses an example certificate name of **ContosoDGSigningCert**, and the procedure that follows uses that example certificate name to sign the catalog file that you created in [Create catalog files](#create-catalog-files), earlier in this topic. If you are using an alternate certificate or catalog file, update the following steps with the appropriate variables and certificate. + +To sign the existing catalog file, copy each of the following commands into an elevated Windows PowerShell session. + +1. Initialize the variables that will be used: + + ` $ExamplePath=$env:userprofile+"\Desktop"` + + ` $CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"` + + > **Note**  This example specifies the catalog file you created in the [Create catalog files](#create-catalog-files) section. If you are signing another catalog file, update the *$ExamplePath* and *$CatFileName* variables with the correct information. + +2. Import the code signing certificate that will be used to sign the catalog file. Import it to the signing user’s personal store. This example uses the certificate name from [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md). + +3. Sign the catalog file with Signtool.exe: + + ` sign /n "ContosoDGSigningCert" /fd sha256 /v $CatFileName` + + > **Note**  The *<Path to signtool.exe>* variable should be the full path to the Signtool.exe utility. *ContosoDGSigningCert* represents the subject name of the certificate that you will use to sign the catalog file. This certificate should be imported to your personal certificate store on the computer on which you are attempting to sign the catalog file. + + > **Note**  For additional information about Signtool.exe and all additional switches, visit the [MSDN Sign Tool page](https://msdn.microsoft.com/library/8s9b9yaz(v=vs.110).aspx). +   +4. Verify the catalog file digital signature. Right-click the catalog file, and then click **Properties**. On the **Digital Signatures** tab, verify that your signing certificate exists with a **sha256** algorithm, as shown in Figure 1. + + ![Digital Signature list in file Properties](images/dg-fig12-verifysigning.png) + + Figure 1. Verify that the signing certificate exists + +5. Copy the catalog file to C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}. + + For testing purposes, you can manually copy signed catalog files to their intended folder. For large-scale implementations, to copy the appropriate catalog files to all desired computers, we recommend that you use Group Policy File Preferences or an enterprise systems management product such as System Center Configuration Manager. Doing this also simplifies the management of catalog versions. + +## Add a catalog signing certificate to a code integrity policy + +After the catalog file is signed, add the signing certificate to a code integrity policy, as described in the following steps. + + + +1. If you have not already verified the catalog file digital signature, right-click the catalog file, and then click **Properties**. On the **Digital Signatures** tab, verify that your signing certificate exists with the algorithm you expect. + +2. If you already have an XML policy file that you want to add the signing certificate to, skip to the next step. Otherwise, use [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) to create a code integrity policy that you will later merge into another policy (not deploy as-is). This example creates a policy called **CatalogSignatureOnly.xml** in the location **C:\\PolicyFolder**: + + ` New-CIPolicy -Level PcaCertificate -FilePath C:\PolicyFolder\CatalogSignatureOnly.xml –UserPEs` + + > **Note**  Include the **-UserPEs** parameter to ensure that the policy includes user mode code integrity. + +3. Use [Add-SignerRule](https://technet.microsoft.com/library/mt634479.aspx) to add the signing certificate to the code integrity policy, filling in the correct path and filenames for ** and **: + + ` Add-SignerRule -FilePath -CertificatePath -User ` + +If you used step 2 to create a new code integrity policy, and want information about merging policies together, see [Merge code integrity policies](deploy-code-integrity-policies-steps.md#merge-code-integrity-policies). + +## Deploy catalog files with Group Policy + +To simplify the management of catalog files, you can use Group Policy preferences to deploy catalog files to the appropriate computers in your organization. The following process walks you through the deployment of a signed catalog file called **LOBApp-Contoso.cat** to a test OU called DG Enabled PCs with a GPO called **Contoso DG Catalog File GPO Test**. + +> **Note**  This walkthrough requires that you have previously created a signed catalog file and have a computer running Windows 10 on which to test a Group Policy deployment. For more information about how to create a catalog file, see [Create catalog files](#create-catalog-files), earlier in this topic. Also, before you begin testing of a catalog file with the code integrity policy it supports, review [Add a catalog signing certificate to a code integrity policy](#add-a-catalog-signing-certificate-to-a-code-integrity-policy). + +**To deploy a catalog file with Group Policy:** + +1. From either a domain controller or a client computer that has Remote Server Administration Tools (RSAT) installed, open the Group Policy Management Console (GPMC) by running **GPMC.MSC** or by searching for Group Policy Management. + +2. Create a new GPO: right-click an OU, for example, the **DG Enabled PCs OU**, and then click **Create a GPO in this domain, and Link it here**, as shown in Figure 2. + + > **Note**  You can use any OU name. Also, security group filtering is an option when you consider different ways of combining code integrity policies (or keeping them separate), as discussed in [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). + + ![Group Policy Management, create a GPO](images/dg-fig13-createnewgpo.png) + + Figure 2. Create a new GPO + +3. Give the new GPO a name, for example, **Contoso DG Catalog File GPO Test**, or any name you prefer. + +4. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. + +5. Within the selected GPO, navigate to Computer Configuration\\Preferences\\Windows Settings\\Files. Right-click **Files**, point to **New**, and then click **File**, as shown in Figure 3. + + ![Group Policy Management Editor, New File](images/dg-fig14-createnewfile.png) + + Figure 3. Create a new file + +6. Configure the catalog file share. + + To use this setting to provide consistent deployment of your catalog file (in this example, LOBApp-Contoso.cat), the source file should be on a share that is accessible to the computer account of every deployed computer. This example uses a share (on a computer running Windows 10) called \\\\Contoso-Win10\\Share. The catalog file being deployed is copied to this share. + +7. To keep versions consistent, in the **New File Properties** dialog box (Figure 4), select **Replace** from the **Action** list so that the newest version is always used. + + ![File Properties, Replace option](images/dg-fig15-setnewfileprops.png) + + Figure 4. Set the new file properties + +8. In the **Source file(s)** box, type the name of your accessible share, with the catalog file name included (for example, \\\\Contoso-Win10\\share\\LOBApp-Contoso.cat). + +9. In the **Destination File** box, type a path and file name, for example: + + **C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\LOBApp-Contoso.cat** + + For the catalog file name, use the name of the catalog you are deploying. + +10. On the **Common** tab of the **New File Properties** dialog box, select the **Remove this item when it is no longer applied** option. Doing this ensures that the catalog file is removed from every system, in case you ever need to stop trusting this application. + +11. Click **OK** to complete file creation. + +12. Close the Group Policy Management Editor, and then update the policy on the test computer running Windows 10, by running GPUpdate.exe. When the policy has been updated, verify that the catalog file exists in C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} on the computer running Windows 10. + +Before you begin testing the deployed catalog file, make sure that the catalog signing certificate has been added to an appropriate code integrity policy, as described in [Add a catalog signing certificate to a code integrity policy](#add-a-catalog-signing-certificate-to-a-code-integrity-policy). + +## Deploy catalog files with System Center Configuration Manager + +As an alternative to Group Policy, you can use System Center Configuration Manager to deploy catalog files to the managed computers in your environment. This approach can simplify the deployment and management of multiple catalog files as well as provide reporting around which catalog each client or collection has deployed. In addition to the deployment of these files, System Center Configuration Manager can also be used to inventory the currently deployed catalog files for reporting and compliance purposes. Complete the following steps to create a new deployment package for catalog files: + +> **Note**  The following example uses a network share named \\\\Shares\\CatalogShare as a source for the catalog files. If you have collection specific catalog files, or prefer to deploy them individually, use whichever folder structure works best for your organization. + +1. Open the Configuration Manager console, and select the Software Library workspace. + +2. Navigate to Overview\\Application Management, right-click **Packages**, and then click **Create Package**. + +3. Name the package, set your organization as the manufacturer, and select an appropriate version number. + + ![Create Package and Program Wizard](images/dg-fig16-specifyinfo.png) + + Figure 5. Specify information about the new package + +4. Click **Next**, and then select **Standard program** as the program type. + +5. On the **Standard Program** page, select a name, and then set the **Command Line** property to **XCopy \\\\Shares\\CatalogShare C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} /H /K /E /Y**. + +6. On the **Standard Program** page, select the following options (Figure 6): + + - In **Name**, type a name such as **Contoso Catalog File Copy Program**. + + - In **Command line**, browse to the program location. + + - In **Startup folder**, type **C:\\Windows\\System32**. + + - From the **Run** list, select **Hidden**. + + - From the **Program can run** list, select **Whether or not a user is logged on**. + + - From the **Drive mode** list, select **Runs with UNC name**. + + ![Standard Program page of wizard](images/dg-fig17-specifyinfo.png) + + Figure 6. Specify information about the standard program + +7. Accept the defaults for the rest of the wizard, and then close the wizard. + +After you create the deployment package, deploy it to a collection so that the clients will receive the catalog files. In this example, you deploy the package you just created to a test collection: + +1. In the Software Library workspace, navigate to Overview\\Application Management\\Packages, right-click the catalog file package, and then click **Deploy**. + +2. On the **General** page, select the test collection to which the catalog files will be deployed, and then click **Next**. + +3. On the **Content** page, click **Add** to select the distribution point that will serve content to the selected collection, and then click **Next**. + +4. On the **Deployment Settings** page, select **Required** in the **Purpose** box. + +5. On the **Scheduling** page, click **New**. + +6. In the **Assignment Schedule** dialog box, select **Assign immediately after this event**, set the value to **As soon as possible**, and then click **OK**. + +7. On the **Scheduling** page, click **Next**. + +8. On the **User Experience** page (Figure 7), set the following options, and then click **Next**: + + - Select the **Software installation** check box. + + - Select the **Commit changes at deadline or during a maintenance window (requires restarts)** check box. + + ![Deploy Software Wizard, User Experience page](images/dg-fig18-specifyux.png) + + Figure 7. Specify the user experience + +9. On the **Distribution Points** page, in the **Deployment options** box, select **Run program from distribution point**, and then click **Next**. + +10. On the **Summary** page, review the selections, and then click **Next**. + +11. Close the wizard. + +Before you begin testing the deployed catalog file, make sure that the catalog signing certificate has been added to an appropriate code integrity policy, as described in [Add a catalog signing certificate to a code integrity policy](#add-a-catalog-signing-certificate-to-a-code-integrity-policy). + +## Inventory catalog files with System Center Configuration Manager + +When catalog files have been deployed to the computers within your environment, whether by using Group Policy or System Center Configuration Manager, you can inventory them with the software inventory feature of System Center Configuration Manager. The following process walks you through the enablement of software inventory to discover catalog files on your managed systems through the creation and deployment of a new client settings policy. + +> **Note**  A standard naming convention for your catalog files will significantly simplify the catalog file software inventory process. In this example, *-Contoso* has been added to all catalog file names. + +1. Open the Configuration Manager console, and select the Administration workspace. + +2. Navigate to **Overview\\Client Settings**, right-click **Client Settings**, and then click **Create Custom Client Device Settings**. + +3. Name the new policy, and under **Select and then configure the custom settings for client devices**, select the **Software Inventory** check box, as shown in Figure 8. + + ![Create Custom Client Device Settings](images/dg-fig19-customsettings.png) + + Figure 8. Select custom settings + +4. In the navigation pane, click **Software Inventory**, and then click **Set Types**, as shown in Figure 9. + + ![Software Inventory settings for devices](images/dg-fig20-setsoftwareinv.png) + + Figure 9. Set the software inventory + +5. In the **Configure Client Setting** dialog box, click the **Start** button to open the **Inventories File Properties** dialog box. + +6. In the **Name** box, type a name such as **\*Contoso.cat**, and then click **Set**. + + > **Note**  When typing the name, follow your naming convention for catalog files. + +7. In the **Path Properties** dialog box, select **Variable or path name**, and then type **C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}** in the box, as shown in Figure 10. + + ![Path Properties, specifying a path](images/dg-fig21-pathproperties.png) + + Figure 10. Set the path properties + +8. Click **OK**. + +9. Now that you have created the client settings policy, right-click the new policy, click **Deploy**, and then choose the collection on which you would like to inventory the catalog files. + +At the time of the next software inventory cycle, when the targeted clients receive the new client settings policy, you will be able to view the inventoried files in the built-in System Center Configuration Manager reports or Resource Explorer. To view the inventoried files on a client within Resource Explorer, complete the following steps: + +1. Open the Configuration Manager console, and select the Assets and Compliance workspace. + +2. Navigate to Overview\\Devices, and search for the device on which you want to view the inventoried files. + +3. Right-click the computer, point to **Start**, and then click **Resource Explorer**. + +4. In Resource Explorer, navigate to Software\\File Details to view the inventoried catalog files. + +> **Note**  If nothing is displayed in this view, navigate to Software\\Last Software Scan in Resource Explorer to verify that the client has recently completed a software inventory scan. + +## Related topics + +- [Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md) + +- [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md) + +- [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md) + diff --git a/windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md b/windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md new file mode 100644 index 0000000000..6710758326 --- /dev/null +++ b/windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md @@ -0,0 +1,108 @@ +--- +title: Deploy code integrity policies - policy rules and file rules (Windows 10) +description: This article provides information about two elements in code integrity policies, called policy rules and file rules. Code integrity policies are part of Device Guard in Windows 10. +keywords: virtualization, security, malware +ms.prod: w10 +ms.mktglfcycl: deploy +author: brianlic-msft +--- + +# Deploy code integrity policies: policy rules and file rules (Windows 10) + +**Applies to** +- Windows 10 +- Windows Server 2016 + +Code integrity policies maintain the standards by which a computer running Windows 10 determines whether an application is trustworthy and can be run. For an overview of code integrity, see: +- [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats) in "Introduction to Device Guard: virtualization-based security and code integrity policies." +- [Code integrity policy formats and signing](requirements-and-deployment-planning-guidelines-for-device-guard.md#code-integrity-policy-formats-and-signing) in "Requirements and deployment planning guidelines for Device Guard." + +If you already understand the basics of code integrity policy and want procedures for creating, auditing, and merging code integrity policies, see [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md). + +This topic includes the following sections: + +- [Overview of the process of creating code integrity policies](#overview-of-the-process-of-creating-code-integrity-policies): Helps familiarize you with the process described in this and related topics. +- [Code integrity policy rules](#code-integrity-policy-rules): Describes one key element you specify in a policy, the *policy rules*, which control options such as audit mode or whether UMCI is enabled in a code integrity policy. +- [Code integrity file rule levels](#code-integrity-file-rule-levels): Describes the other key element you specify in a policy, the *file rules* (or *file rule levels*), which specify the level at which applications will be identified and trusted. + +## Overview of the process of creating code integrity policies + +A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. Code integrity policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of code integrity policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional code integrity policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the planning steps in [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). + +> **Note**  Each computer can have only **one** code integrity policy at a time. Whichever way you deploy this policy, it is renamed to SIPolicy.p7b and copied to C:\\Windows\\System32\\CodeIntegrity. Keep this in mind when you create your code integrity policies. + +Optionally, code integrity policies can align with your software catalog as well as any IT department–approved applications. One straightforward method to implement code integrity policies is to use existing images to create one master code integrity policy. You do so by creating a code integrity policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed. + +If you plan to use an internal CA to sign catalog files or code integrity policies, see the steps in [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md). + +## Code integrity policy rules + +Code integrity policies include *policy rules*, which control options such as audit mode or whether UMCI is enabled in a code integrity policy. You can modify these options in a new or existing code integrity policy. (For information about *file rules*, which specify the level at which applications will be identified and trusted, see the next section, [Code integrity file rule levels](#code-integrity-file-rule-levels).) + +To modify the policy rule options of an existing code integrity policy, use the [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) Windows PowerShell cmdlet. Note the following examples of how to use this cmdlet to add and remove a rule option on an existing code integrity policy: + +- To enable UMCI, add rule option 0 to an existing policy by running the following command: + + ` Set-RuleOption -FilePath -Option 0` + +- To disable UMCI on an existing code integrity policy, delete rule option 0 by running the following command: + + ` Set-RuleOption -FilePath -Option 0 -Delete` + +You can set several rule options within a code integrity policy. To display a list of rule options, you can type **Set- +RuleOption -Help** in a Windows PowerShell session. Table 2 describes each rule option. + +> **Note**  **Enabled:Audit Mode** is an important rule option. We recommend that you use this option for a period of time with all new code integrity policies, because it allows you to test them before you enforce them. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. To expand the policy so that (when enforced) it will allow these applications, you can use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy. + +> The mode—audit mode or enforced mode—is set by including or deleting **Enabled:Audit Mode** in the code integrity policy. When this option is deleted, the policy runs in enforced mode. + +**Table 2. Code integrity policy - policy rule options** + +| Rule option | Description | +|------------ | ----------- | +| **0 Enabled:UMCI** | Code integrity policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | +| **1 Enabled:Boot Menu Protection** | This option is not currently supported. | +| **2 Required:WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | +| **3 Enabled:Audit Mode (Default)** | Enables the execution of binaries outside of the code integrity policy but logs each occurrence in the CodeIntegrity event log, which can be used to update the existing policy before enforcement. To begin enforcing a code integrity policy, delete this option. | +| **4 Disabled:Flight Signing** | If enabled, code integrity policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. | +| **5 Enabled:Inherent Default Policy** | This option is not currently supported. | +| **6 Enabled:Unsigned System Integrity Policy (Default)** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | +| **7 Allowed:Debug Policy Augmented** | This option is not currently supported. | +| **8 Required:EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All future Windows 10 and later drivers will meet this requirement. | +| **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all code integrity policies. Setting this rule option allows the F8 menu to appear to physically present users. | +| **10 Enabled:Boot Audit on Failure** | Used when the code integrity policy is in enforcement mode. When a driver fails during startup, the code integrity policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | + +## Code integrity file rule levels + +File rule levels allow administrators to specify the level at which they want to trust their applications. This level of trust could be as fine-tuned as the hash of each binary or as general as a CA certificate. You specify file rule levels both when you create a new code integrity policy from a scan and when you create a policy from audit events. In addition, to combine rule levels found in multiple policies, you can merge the policies. When merged, code integrity policies combine their file rules, so that any application that would be allowed by either of the original policies will be allowed by the combined policy. + +Each file rule level has its benefit and disadvantage. Use Table 3 to select the appropriate protection level for your available administrative resources and Device Guard deployment scenario. + + + +Table 3. Code integrity policy - file rule levels + +| Rule level | Description | +|----------- | ----------- | +| **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. | +| **FileName** | Specifies individual binary file names. Although the hash values for an application are modified when updated, the file names are typically not. This offers less specific security than the hash level but does not typically require a policy update when any binary is modified. | +| **SignedVersion** | This combines the publisher rule with a version number. This option allows anything from the specified publisher, with a version at or above the specified version number, to run. | +| **Publisher** | This is a combination of the PcaCertificate level (typically one certificate below the root) and the common name (CN) of the leaf certificate. This rule level allows organizations to trust a certificate from a major CA (such as Symantec), but only if the leaf certificate is from a specific company (such as Intel, for device drivers). | +| **FilePublisher** | This is a combination of the “FileName” attribute of the signed file, plus “Publisher” (PCA certificate with CN of leaf), plus a minimum version number. This option trusts specific files from the specified publisher, with a version at or above the specified version number. | +| **LeafCertificate** | Adds trusted signers at the individual signing certificate level. The benefit of using this level versus the individual hash level is that new versions of the product will have different hash values but typically the same signing certificate. Using this level, no policy update would be needed to run the new version of the application. However, leaf certificates have much shorter validity periods than CA certificates, so additional administrative overhead is associated with updating the code integrity policy when these certificates expire. | +| **PcaCertificate** | Adds the highest available certificate in the provided certificate chain to signers. This is typically one certificate below the root certificate, because the scan does not validate anything beyond the certificates included in the provided signature (it does not go online or check local root stores). | +| **RootCertificate** | Currently unsupported. | +| **WHQL** | Trusts binaries if they have been validated and signed by WHQL. This is primarily for kernel binaries. | +| **WHQLPublisher** | This is a combination of the WHQL and the CN on the leaf certificate and is primarily for kernel binaries. | +| **WHQLFilePublisher** | Specifies that the binaries are validated and signed by WHQL, with a specific publisher (WHQLPublisher), and that the binary is the specified version or newer. This is primarily for kernel binaries. | + +> **Note**  When you create code integrity policies with the [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) cmdlet, you can specify a primary file rule level by including the **–Level** parameter. For discovered binaries that cannot be trusted based on the primary file rule criteria, use the **–Fallback** parameter. For example, if the primary file rule level is PCACertificate but you would like to trust the unsigned applications as well, using the Hash rule level as a fallback adds the hash values of binaries that did not have a signing certificate. + +## Related topics + +- [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats) +- [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md) + diff --git a/windows/keep-secure/deploy-code-integrity-policies-steps.md b/windows/keep-secure/deploy-code-integrity-policies-steps.md new file mode 100644 index 0000000000..e754b2139e --- /dev/null +++ b/windows/keep-secure/deploy-code-integrity-policies-steps.md @@ -0,0 +1,384 @@ +--- +title: Deploy code integrity policies - steps (Windows 10) +description: This article describes how to deploy code integrity policies, one of the main features that are part of Device Guard in Windows 10. +keywords: virtualization, security, malware +ms.prod: w10 +ms.mktglfcycl: deploy +author: brianlic-msft +--- + +# Deploy code integrity policies: steps (Windows 10) + +**Applies to** +- Windows 10 +- Windows Server 2016 + +For an overview of the process described in the following procedures, see [Deploy code integrity policies: policy rules and file rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md). To understand how the deployment of code integrity policies fits with other steps in the Device Guard deployment process, see [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). + +## Create a code integrity policy from a golden computer + +The process for creating a golden code integrity policy from a reference system is straightforward. This section outlines the process that is required to successfully create a code integrity policy with Windows PowerShell. First, for this example, you must initiate variables to be used during the creation process. Rather than using variables, you can simply use the full file paths in the command. Next, you create the code integrity policy by scanning the system for installed applications. When created, the policy file is converted to binary format so that Windows can consume its contents. + +> **Note**  Before you begin this procedure, ensure that the reference PC is clean of viruses or malware. Each piece of installed software should be validated as trustworthy before you create this policy. Also, be sure that any software that you would like to be scanned is installed on the system before you create the code integrity policy. + +To create a code integrity policy, copy each of the following commands into an elevated Windows PowerShell session, in order: + +1. Initialize variables that you will use. The following example commands use **InitialScan.xml** and **DeviceGuardPolicy.bin** for the names of the files that will be created: + + ` $CIPolicyPath=$env:userprofile+"\Desktop\"` + + ` $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` + + ` $CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` + +2. Use [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) to create a new code integrity policy by scanning the system for installed applications: + + ` New-CIPolicy -Level PcaCertificate -FilePath $InitialCIPolicy –UserPEs 3> CIPolicyLog.txt ` + + > **Notes** + + > - By specifying the *–UserPEs* parameter, rule option **0 Enabled:UMCI** is automatically added to the code integrity policy. If you do not specify this parameter, to enable UMCI, use [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) as shown in the following command:
**Set-RuleOption -FilePath $InitialCIPolicy -Option 0** + + > - You can add the *–Fallback* parameter to catch any applications not discovered using the primary file rule level specified by the *–Level* parameter. For more information about file rule level options, see [Code integrity file rule levels](deploy-code-integrity-policies-policy-rules-and-file-rules.md#code-integrity-file-rule-levels) in “Deploy code integrity policies: policy rules and file rules.” + + > - To specify that the code integrity policy scan only a specific drive, include the *–ScanPath* parameter followed by a path. Without this parameter, the entire system is scanned. + + > - The preceding example includes `3> CIPolicylog.txt`, which redirects warning messages to a text file, **CIPolicylog.txt**. + +3. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the code integrity policy to a binary format: + + ` ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin` + +After you complete these steps, the Device Guard binary file (DeviceGuardPolicy.bin) and original .xml file (IntialScan.xml) will be available on your desktop. You can use the binary version as a code integrity policy or sign it for additional security. + +> **Note**  We recommend that you keep the original .xml file of the policy for use when you need to merge the code integrity policy with another policy or update its rule options. Alternatively, you would have to create a new policy from a new scan for servicing. For more information about how to merge code integrity policies, see [Merge code integrity policies](#merge-code-integrity-policies). + +We recommend that every code integrity policy be run in audit mode before being enforced. Doing so allows administrators to discover any issues with the policy without receiving error message dialog boxes. For information about how to audit a code integrity policy, see the next section, [Audit code integrity policies](#audit-code-integrity-policies). + +## Audit code integrity policies + +When code integrity policies are run in audit mode, it allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a code integrity policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log. When these logged binaries have been validated, they can easily be added to a new code integrity policy. When the new exception policy is created, you can merge it with your existing code integrity policies. + +> **Note**  Before you begin this process, you need to create a code integrity policy binary file. If you have not already done so, see [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer), earlier in this topic, for a step-by-step walkthrough of the process to create a code integrity policy and convert it to binary format. + +**To audit a code integrity policy with local policy:** + +1. Find a *.bin policy file that you have created, for example, the DeviceGuardPolicy.bin file that resulted from the steps in the earlier section, [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer). Copy the file to C:\\Windows\\System32\\CodeIntegrity. + +2. On the computer you want to run in audit mode, open the Local Group Policy Editor by running **GPEdit.msc**. + + > **Notes** + + > - The computer that you will run in audit mode must be clean of viruses or malware. Otherwise, in the process that you follow after auditing the system, you might unintentionally merge in a code integrity policy that allows viruses or malware to run. + + > - An alternative method to test a policy is to rename the test file to SIPolicy.p7b and drop it into C:\\Windows\\System32\\CodeIntegrity, rather than deploy it by using the Local Group Policy Editor. + +3. Navigate to **Computer Configuration\\Administrative Templates\\System\\Device Guard**, and then select **Deploy Code Integrity Policy**. Enable this setting by using the appropriate file path, for example, C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 1. + + > **Notes** + + > - The illustration shows the example file name *DeviceGuardPolicy.bin* because this name was used earlier in this topic, in [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer). Also, this policy file does not need to be copied to every system. You can instead copy the code integrity policies to a file share to which all computer accounts have access. + + > - Any policy you select here is converted to SIPolicy.p7b when it is deployed to the individual computers. + + > - You might have noticed that the GPO setting references a .p7b file and this policy uses a .bin file. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped onto the computers running Windows 10. We recommend that you make your code integrity policy names friendly and allow the system to convert the policy names for you. By doing this, it ensures that the policies are easily distinguishable when viewed in a share or any other central repository. + + ![Group Policy called Deploy Code Integrity Policy](images/dg-fig22-deploycode.png) + + Figure 1. Deploy your code integrity policy + +4. Restart the reference system for the code integrity policy to take effect. + +5. Use the system as you normally would, and monitor code integrity events in the event log. While in audit mode, any exception to the deployed code integrity policy will be logged in the **Applications and Services Logs\\Microsoft\\Windows\\CodeIntegrity\\Operational** event log, as shown in Figure 2. + + ![Event showing exception to code integrity policy](images/dg-fig23-exceptionstocode.png) + + Figure 2. Exceptions to the deployed code integrity policy + + You will be reviewing the exceptions that appear in the event log, and making a list of any applications that should be allowed to run in your environment. + +6. If you want to create a catalog file to simplify the process of including unsigned LOB applications in your code integrity policy, this is a good time to create it. For information, see [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md). + +Now that you have a code integrity policy deployed in audit mode, you can capture any audit information that appears in the event log. This is described in the next section. + +## Create a code integrity policy that captures audit information from the event log + +Use the following procedure after you have been running a computer with a code integrity policy in audit mode for a period of time. When you are ready to capture the needed policy information from the event log (so that you can later merge that information into the original code integrity policy), complete the following steps. + + + +1. Review the audit information in the event log. From the code integrity policy exceptions that you see, make a list of any applications that should be allowed to run in your environment, and decide on the file rule level that should be used to trust these applications. + + Although the Hash file rule level will catch all of these exceptions, it may not be the best way to trust all of them. For information about file rule levels, see [Code integrity file rule levels](deploy-code-integrity-policies-policy-rules-and-file-rules.md#code-integrity-file-rule-levels) in "Deploy code integrity policies: policy rules and file rules." + + Your event log might also contain exceptions for applications that you eventually want your code integrity policy to block. If these appear, make a list of these also, for a later step in this procedure. + +2. In an elevated Windows PowerShell session, initialize the variables that will be used. The example filename shown here is **DeviceGuardAuditPolicy.xml**: + + ` $CIPolicyPath=$env:userprofile+"\Desktop\"` + + ` $CIAuditPolicy=$CIPolicyPath+"DeviceGuardAuditPolicy.xml"` + +3. Use [New-CIPolicy](https://technet.microsoft.com/library/mt634473.aspx) to generate a new code integrity policy from logged audit events. This example uses a file rule level of **Hash** and includes `3> CIPolicylog.txt`, which redirects warning messages to a text file, **CIPolicylog.txt**. + + ` New-CIPolicy -Audit -Level Hash -FilePath $CIAuditPolicy –UserPEs 3> CIPolicylog.txt` + + > **Note**  When you create policies from audit events, you should carefully consider the file rule level that you select to trust. The preceding example uses the **Hash** rule level, which is the most specific. Any change to the file (such as replacing the file with a newer version of the same file) will change the Hash value, and require an update to the policy. + +4. Find and review the Device Guard audit policy .xml file that you created. If you used the example variables as shown, the filename will be **DeviceGuardAuditPolicy.xml**, and it will be on your desktop. Look for the following: + + - Any applications that were caught as exceptions, but should be allowed to run in your environment. These are applications that should be in the .xml file. Leave these as-is in the file. + + - Any applications that actually should not be allowed to run in your environment. Edit these out of the .xml file. If they remain in the .xml file, and the information in the file is merged into your existing code integrity policy, the policy will treat the applications as trusted, and allow them to run. + +You can now use this file to update the existing code integrity policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing code integrity policy, see the next section, [Merge code integrity policies](#merge-code-integrity-policies). + +> **Note**  You may have noticed that you did not generate a binary version of this policy as you did in [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer). This is because code integrity policies created from an audit log are not intended to run as stand-alone policies but rather to update existing code integrity policies. + +## Merge code integrity policies + +When you develop code integrity policies, you will occasionally need to merge two policies. A common example is when a code integrity policy is initially created and audited. Another example is when you create a single master policy by using multiple code integrity policies previously created from golden computers. Because each computer running Windows 10 can have only one code integrity policy, it is important to properly maintain these policies. In this example, audit events have been saved into a secondary code integrity policy that you then merge with the initial code integrity policy. + +> **Note**  The following example uses the code integrity policy .xml files that you created in earlier sections in this topic. You can follow this process, however, with any two code integrity policies you would like to combine. + +To merge two code integrity policies, complete the following steps in an elevated Windows PowerShell session: + +1. Initialize the variables that will be used: + + ` $CIPolicyPath=$env:userprofile+"\Desktop\"` + + ` $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` + + ` $AuditCIPolicy=$CIPolicyPath+"DeviceGuardAuditPolicy.xml"` + + ` $MergedCIPolicy=$CIPolicyPath+"MergedPolicy.xml"` + + ` $CIPolicyBin=$CIPolicyPath+"NewDeviceGuardPolicy.bin"` + + > **Note**  The variables in this section specifically expect to find an initial policy on your desktop called **InitialScan.xml** and an audit code integrity policy called **DeviceGuardAuditPolicy.xml**. If you want to merge other code integrity policies, update the variables accordingly. + +2. Use [Merge-CIPolicy](https://technet.microsoft.com/library/mt634485.aspx) to merge two policies and create a new code integrity policy: + + ` Merge-CIPolicy -PolicyPaths $InitialCIPolicy,$AuditCIPolicy -OutputFilePath $MergedCIPolicy` + +3. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the merged code integrity policy to binary format: + + ` ConvertFrom-CIPolicy $MergedCIPolicy $CIPolicyBin ` + +Now that you have created a new code integrity policy (for example, called **NewDeviceGuardPolicy.bin**), you can deploy the policy to systems manually or by using Group Policy or Microsoft client management solutions. For information about how to deploy this new policy with Group Policy, see the [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy) section. + +## Enforce code integrity policies + +Every code integrity policy is created with audit mode enabled. After you have successfully deployed and tested a code integrity policy in audit mode and are ready to test the policy in enforced mode, complete the following steps in an elevated Windows PowerShell session: + +> **Note**  Every code integrity policy should be tested in audit mode first. For information about how to audit code integrity policies, see [Audit code integrity policies](#audit-code-integrity-policies), earlier in this topic. + +1. Initialize the variables that will be used: + + ` $CIPolicyPath=$env:userprofile+"\Desktop\"` + + ` $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml" ` + + ` $EnforcedCIPolicy=$CIPolicyPath+"EnforcedPolicy.xml"` + + ` $CIPolicyBin=$CIPolicyPath+"EnforcedDeviceGuardPolicy.bin"` + + > **Note**  The initial code integrity policy that this section refers to was created in the [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer) section. If you are using a different code integrity policy, update the **CIPolicyPath** and **InitialCIPolicy** variables. + +2. Ensure that rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) are set the way that you intend for this policy. We strongly recommend that you enable these rule options before you run any enforced policy for the first time. Enabling these options provides administrators with a pre-boot command prompt, and allows Windows to start even if the code integrity policy blocks a kernel-mode driver from running. When ready for enterprise deployment, you can remove these options. + + To ensure that these options are enabled in a policy, use [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) as shown in the following commands. You can run these commands even if you're not sure whether options 9 and 10 are already enabled—if so, the commands have no effect. + + ` Set-RuleOption -FilePath $InitialCIPolicy -Option 9` + + ` Set-RuleOption -FilePath $InitialCIPolicy -Option 10` + +3. Copy the initial file to maintain an original copy: + + ` copy $InitialCIPolicy $EnforcedCIPolicy` + +4. Use [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) to delete the audit mode rule option: + + ` Set-RuleOption -FilePath $EnforcedCIPolicy -Option 3 -Delete` + + > **Note**  To enforce a code integrity policy, you delete option 3, the **Audit Mode Enabled** option. There is no “enforced” option that can be placed in a code integrity policy. + +5. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the new code integrity policy to binary format: + + ` ConvertFrom-CIPolicy $EnforcedCIPolicy $CIPolicyBin` + +Now that this policy is in enforced mode, you can deploy it to your test computers. Rename the policy to SIPolicy.p7b and copy it to C:\\Windows\\System32\\CodeIntegrity for testing, or deploy the policy through Group Policy by following the instructions in [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy). You can also use other client management software to deploy and manage the policy. + +## Signing code integrity policies with SignTool.exe + +Signed code integrity policies give organizations the highest level of malware protection available in Windows 10. In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the computer. These policies are designed to prevent administrative tampering and kernel mode exploit access. With this in mind, it is much more difficult to remove signed code integrity policies than unsigned ones. Before you sign and deploy a signed code integrity policy, we recommend that you audit the policy to discover any blocked applications that should be allowed to run. For more information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies) section. + +Signing code integrity policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward. If you do not currently have a code signing certificate exported in .pfx format (containing private keys, extensions, and root certificates), see [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md) to create one with your on-premises CA. + +Before signing code integrity policies for the first time, be sure to enable rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) to leave troubleshooting options available to administrators. To ensure that a rule option is enabled, you can run a command such as `Set-RuleOption -FilePath -Option 9` even if you're not sure whether the option is already enabled—if so, the command has no effect. When validated and ready for enterprise deployment, you can remove these options. For more information about rule options, see [Code integrity policy rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md#code-integrity-policy-rules) in "Deploy code integrity policies: policy rules and file rules." + +> **Note**  Signing code integrity policies is the last step in a code integrity deployment. It is much more difficult to remove a signed code integrity policy than an unsigned one. Before you deploy a signed code integrity policy to deployed client computers, be sure to test its effect on a subset of computers. + +To sign a code integrity policy with SignTool.exe, you need the following components: + +- SignTool.exe, found in the Windows SDK (Windows 7 or later) + +- The binary format of the code integrity policy that you generated in the [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer) section or another code integrity policy that you have created + +- An internal CA code signing certificate or a purchased code signing certificate + +If you do not have a code signing certificate, see the [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md) section for instructions on how to create one. If you use an alternate certificate or code integrity policy, be sure to update the following steps with the appropriate variables and certificate so that the commands will function properly. To sign the existing code integrity policy, copy each of the following commands into an elevated Windows PowerShell session: + +1. Initialize the variables that will be used: + + ` $CIPolicyPath=$env:userprofile+"\Desktop\"` + + ` $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` + + ` $CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` + + > **Note**  This example uses the code integrity policy that you created in the [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer) section. If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information. + +2. Import the .pfx code signing certificate. Import the code signing certificate that you will use to sign the code integrity policy into the signing user’s personal store on the computer that will be doing the signing. In this example, you use the certificate that was created in [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md). + +3. Export the .cer code signing certificate. After the code signing certificate has been imported, export the .cer version to your desktop. This version will be added to the policy so that it can be updated later. + +4. Navigate to your desktop as the working directory: + + ` cd $env:USERPROFILE\Desktop ` + +5. Use [Add-SignerRule](https://technet.microsoft.com/library/mt634479.aspx) to add an update signer certificate to the code integrity policy: + + ` Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath -Kernel -User –Update` + + > **Notes**  *<Path to exported .cer certificate>* should be the full path to the certificate that you exported in step 3. + + > Also, adding update signers is crucial to being able to modify or disable this policy in the future. For more information about how to disable signed code integrity policies, see the [Disable signed code integrity policies within Windows](#disable-signed-code-integrity-policies-within-windows) section. + +6. Use [Set-RuleOption](https://technet.microsoft.com/library/mt634483.aspx) to remove the unsigned policy rule option: + + ` Set-RuleOption -FilePath $InitialCIPolicy -Option 6 -Delete` + +7. Use [ConvertFrom-CIPolicy](https://technet.microsoft.com/library/mt733073.aspx) to convert the policy to binary format: + + ` ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin` + +8. Sign the code integrity policy by using SignTool.exe: + + ` sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin` + + > **Note**  The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the code integrity policy. You should import this certificate to your personal certificate store on the computer you use to sign the policy. + +9. Validate the signed file. When complete, the commands should output a signed policy file called DeviceGuardPolicy.bin.p7 to your desktop. You can deploy this file the same way you deploy an enforced or non-enforced policy. For information about how to deploy code integrity policies, see [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy). + +## Disable unsigned code integrity policies + +There may come a time when an administrator wants to disable a code integrity policy. For unsigned code integrity policies, this process is simple. Depending on how the code integrity policy was deployed, unsigned policies can be disabled in one of two ways. If a code integrity policy was manually enabled and copied to the code integrity folder location, simply delete the file and restart the computer. The following locations can contain executing code integrity policies: + +- <EFI System Partition>\\Microsoft\\Boot\\ + +- <OS Volume>\\Windows\\System32\\CodeIntegrity\\ + +If the code integrity policy was deployed by using Group Policy, the GPO that is currently enabling and deploying the policy must be set to disabled. Then, the code integrity policy will be disabled on the next computer restart. + +## Disable signed code integrity policies within Windows + +Signed policies protect Windows from administrative manipulation as well as malware that has gained administrative-level access to the system. For this reason, signed code integrity policies are intentionally more difficult to remove than unsigned policies. They inherently protect themselves from modification or removal and therefore are difficult even for administrators to remove successfully. If the signed code integrity policy is manually enabled and copied to the CodeIntegrity folder, to remove the policy, you must complete the following steps. + +> **Note**  For reference, signed code integrity policies should be replaced and removed from the following locations: + +- <EFI System Partition>\\Microsoft\\Boot\\ + +- <OS Volume>\\Windows\\System32\\CodeIntegrity\\ + + +1. Replace the existing policy with another signed policy that has the **6 Enabled: Unsigned System Integrity Policy** rule option enabled. + + > **Note**  To take effect, this policy must be signed with a certificate previously added to the **UpdatePolicySigners** section of the original signed policy you want to replace. + +2. Restart the client computer. + +3. Verify that the new signed policy exists on the client. + + > **Note**  If the signed policy that contains rule option 6 has not been processed on the client, the addition of an unsigned policy may cause boot failures. + +4. Delete the new policy. + +5. Restart the client computer. + +If the signed code integrity policy has been deployed using by using Group Policy, you must complete the following steps: + +1. Replace the existing policy in the GPO with another signed policy that has the **6 Enabled: Unsigned System Integrity Policy** rule option enabled. + + > **Note**  To take effect, this policy must be signed with a certificate previously added to the **UpdatePolicySigners** section of the original signed policy you want to replace. + +2. Restart the client computer. + +3. Verify that the new signed policy exists on the client. + + > **Note**  If the signed policy that contains rule option 6 has not been processed on the client, the addition of an unsigned policy may cause boot failures. + +4. Set the GPO to disabled. + +5. Delete the new policy. + +6. Restart the client computer. + +## Disable signed code integrity policies within the BIOS + +There may be a time when signed code integrity policies cause a boot failure. Because code integrity policies enforce kernel mode drivers, it is important that they be thoroughly tested on each software and hardware configuration before being enforced and signed. Signed code integrity policies are validated in the pre-boot sequence by using Secure Boot. When you disable the Secure Boot feature in the BIOS, and then delete the file from the following locations on the operating system disk, it allows the system to boot into Windows: + +- <EFI System Partition>\\Microsoft\\Boot\\ + +- <OS Volume>\\Windows\\System32\\CodeIntegrity\\ + +## Deploy and manage code integrity policies with Group Policy + +Code integrity policies can easily be deployed and managed with Group Policy. A Device Guard administrative template will be available in Windows Server 2016 that allows you to simplify deployment of Device Guard hardware-based security features and code integrity policies. The following procedure walks you through how to deploy a code integrity policy called **DeviceGuardPolicy.bin** to a test OU called *DG Enabled PCs* by using a GPO called **Contoso GPO Test**. + +> **Note**  This walkthrough requires that you have previously created a code integrity policy and have a computer running Windows 10 on which to test a Group Policy deployment. For more information about how to create a code integrity policy, see [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer), earlier in this topic. + +> **Note**  Signed code integrity policies can cause boot failures when deployed. We recommend that signed code integrity policies be thoroughly tested on each hardware platform before enterprise deployment. + +To deploy and manage a code integrity policy with Group Policy: + +1. On a domain controller on a client computer on which RSAT is installed, open the GPMC by running **GPMC.MSC** or searching for “Group Policy Management” in Windows Search. + +2. Create a new GPO: right-click an OU, for example, the **DG Enabled PCs OU**, and then click **Create a GPO in this domain, and Link it here**, as shown in Figure 3. + + > **Note**  You can use any OU name. Also, security group filtering is an option when you consider different ways of combining code integrity policies (or keeping them separate), as discussed in [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). + + ![Group Policy Management, create a GPO](images/dg-fig24-creategpo.png) + + Figure 3. Create a GPO + +3. Name new GPO **Contoso GPO Test**. This example uses Contoso GPO Test as the name of the GPO. You can choose any name that you prefer for this example. + +4. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. + +5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Deploy Code Integrity Policy** and then click **Edit**. + + ![Edit the group policy for code integrity](images/dg-fig25-editcode.png) + + Figure 4. Edit the group policy for code integrity + +6. In the **Display Code Integrity Policy** dialog box, select the **Enabled** option, and then specify the code integrity policy deployment path. + + In this policy setting, you specify either the local path in which the policy will exist on the client computer or a Universal Naming Convention (UNC) path that the client computers will look to retrieve the latest version of the policy. For example, with DeviceGuardPolicy.bin on the test computer, the example file path would be C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 5. + + > **Note**  The illustration shows the example file name *DeviceGuardPolicy.bin* because this name was used earlier in this topic, in [Create a code integrity policy from a golden computer](#create-a-code-integrity-policy-from-a-golden-computer). Also, this policy file does not need to be copied to every computer. You can instead copy the code integrity policies to a file share to which all computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers. + + ![Group Policy called Deploy Code Integrity Policy](images/dg-fig26-enablecode.png) + + Figure 5. Enable the code integrity policy + + > **Note**  You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the client computer running Windows 10. Make your code integrity policies friendly and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository. + +7. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. Restarting the computer updates the code integrity policy. For information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies) section. + +## Related topics + +[Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md) + +[Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md) + diff --git a/windows/keep-secure/deploy-device-guard-deploy-code-integrity-policies.md b/windows/keep-secure/deploy-device-guard-deploy-code-integrity-policies.md new file mode 100644 index 0000000000..6a0dfeabe2 --- /dev/null +++ b/windows/keep-secure/deploy-device-guard-deploy-code-integrity-policies.md @@ -0,0 +1,30 @@ +--- +title: Deploy Device Guard - deploy code integrity policies (Windows 10) +description: This article, and the articles it links to, describe how to create code integrity policies, one of the main features that are part of Device Guard in Windows 10. +keywords: virtualization, security, malware +ms.prod: w10 +ms.mktglfcycl: deploy +author: brianlic-msft +--- + +# Deploy Device Guard: deploy code integrity policies (Windows 10) + +**Applies to** +- Windows 10 +- Windows Server 2016 + +This section includes the following topics: + +- [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md) +- [Deploy code integrity policies: policy rules and file rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md) +- [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md) +- [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md) + +To increase the protection for devices that meet certain hardware requirements, you can use virtualization-based security (VBS) with your code integrity policies. +- For requirements, see [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard) in "Requirements and deployment planning guidelines for Device Guard." +- For steps, see [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md). + +## Related topics + +[Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md) + diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md new file mode 100644 index 0000000000..85ae77b74a --- /dev/null +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -0,0 +1,246 @@ +--- +title: Deploy Device Guard - enable virtualization-based security (Windows 10) +description: This article describes how to enable virtualization-based security, one of the main features that are part of Device Guard in Windows 10. +keywords: virtualization, security, malware +ms.prod: w10 +ms.mktglfcycl: deploy +author: brianlic-msft +--- + +# Deploy Device Guard: enable virtualization-based security (Windows 10) + +**Applies to** +- Windows 10 +- Windows Server 2016 + +Hardware-based security features, also called virtualization-based security or VBS, make up a large part of Device Guard security offerings. VBS reinforces the most important feature of Device Guard: configurable code integrity. There are three steps to configure hardware-based security features in Device Guard: + +1. **Verify that hardware and firmware requirements are met**. Verify that your client computers possess the necessary hardware and firmware to run these features. A list of requirements for hardware-based security features is available in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). + +2. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. For details, see the following section, [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security). + +3. **Enable additional features as desired**. When the necessary Windows features have been enabled, you can enable additional hardware-based security features as desired. For more information, see the following sections in this topic: + + - [Enable Unified Extensible Firmware Interface Secure Boot](#enable-unified-extensible-firmware-interface-secure-boot) + - [Enable virtualization-based security for kernel-mode code integrity](#enable-virtualization-based-security-for-kernel-mode-code-integrity) + +For information about enabling Credential Guard, see [Protect derived domain credentials with Credential Guard](credential-guard.md). + +## Windows feature requirements for virtualization-based security + +In addition to the hardware requirements found in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard), you must enable certain operating system features before you can enable VBS: Microsoft Hyper-V and isolated user mode (shown in Figure 1). + +> **Note**  You can configure these features manually by using Windows PowerShell or Deployment Image Servicing and Management. For specific information about these methods, see [Protect derived domain credentials with Credential Guard](credential-guard.md). +  +![Turn Windows features on or off](images/dg-fig1-enableos.png) + +Figure 1. Enable operating system features for VBS + +After you enable these features, you can configure any additional hardware-based security features you want. The following sections provide more information: +- [Enable Unified Extensible Firmware Interface Secure Boot](#enable-unified-extensible-firmware-interface-secure-boot) +- [Enable virtualization-based security for kernel-mode code integrity](#enable-virtualization-based-security-for-kernel-mode-code-integrity) + +## Enable Unified Extensible Firmware Interface Secure Boot + +Before you begin this process, verify that the target device meets the hardware requirements for UEFI Secure Boot that are laid out in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). There are two options to configure UEFI Secure Boot: manual configuration of the appropriate registry keys and Group Policy deployment. Complete the following steps to manually configure UEFI Secure Boot on a computer running Windows 10. + +> **Note**  There are two platform security levels for Secure Boot: stand-alone Secure Boot and Secure Boot with DMA protection. DMA protection provides additional memory protection but will be enabled only on systems whose processors include input/output memory management units (IOMMUs). Protection against driver-based attacks is provided only on systems that have IOMMUs and that have DMA protection enabled. + +1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. + +2. Set the **EnableVirtualizationBasedSecurity DWORD** value to **1**. + +3. Set the **RequirePlatformSecurityFeatures DWORD** value as appropriate: + + - Set this value to **1** to enable the **Secure Boot** option. + + - Set this value to **2** to enable the **Secure Boot with DMA Protection** option. + +4. Restart the client computer. + +Unfortunately, it would be time consuming to perform these steps manually on every protected computer in your enterprise. Group Policy offers a much simpler way to deploy UEFI Secure Boot to your organization. This example creates a test organizational unit (OU) called *DG Enabled PCs*. If you want, you can instead link the policy to an existing OU, and then scope the GPO by using appropriately named computer security groups. + +> **Note**  We recommend that you test-enable this feature on a group of test computers before you deploy it to users' computers. + +### Use Group Policy to deploy Secure Boot + +1. To create a new GPO, right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. + + ![Group Policy Management, create a GPO](images/dg-fig2-createou.png) + + Figure 5. Create a new OU-linked GPO + +2. Give the new GPO a name, for example, **Contoso Secure Boot GPO Test**, or any name you prefer. Ideally, the name will align with your existing GPO naming convention. + +3. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. + +4. Within the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Turn On Virtualization Based Security**, and then click **Edit**. + + ![Edit the group policy for Virtualization Based Security](images/dg-fig3-enablevbs.png) + + Figure 6. Enable VBS + +5. Select the **Enabled** option, and then select **Secure Boot and DMA Protection** from the **Select Platform Security Level** list. + + ![Group Policy, Turn On Virtualization Based Security](images/device-guard-gp.png) + + Figure 7. Enable Secure Boot + + > **Note**  Device Guard Secure Boot is maximized when combined with DMA protection. If your hardware contains the IOMMUs required for DMA protection, be sure to select the **Secure Boot and DMA Protection** platform security level. If your hardware does not contain IOMMUs, there are several mitigations provided by leveraging Secure Boot without DMA Protection. + +6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. After you configure this setting, UEFI Secure Boot will be enabled upon restart. + +7. Check the test computer’s event log for Device Guard GPOs. + + Processed Device Guard policies are logged in event viewer at **Applications and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational**. When the **Turn On Virtualization Based Security** policy is successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. + +## Enable virtualization-based security for kernel-mode code integrity + +Before you begin this process, verify that the desired computer meets the hardware requirements for VBS found in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard), and enable the Windows features discussed in the [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security) section. When validated, you can enable virtualization-based protection of KMCI in one of two ways: manual configuration of the appropriate registry subkeys and Group Policy deployment. + +> **Note**  All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable this feature on a group of test computers before you enable it on users' computers. + +**To configure virtualization-based protection of KMCI manually:** + +1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. + +2. Set the **HypervisorEnforcedCodeIntegrity DWORD** value to **1**. + +3. Restart the client computer. + +It would be time consuming to perform these steps manually on every protected computer in your enterprise. Instead, use Group Policy to deploy virtualization-based protection of KMCI. This example creates a test OU called *DG Enabled PCs*, which you will use to link the GPO. If you prefer to link the policy to an existing OU rather than create a test OU and scope the policy by using appropriately named computer security groups, that is another option. + +> **Note**  We recommend that you test-enable this feature on a group of test computers before you deploy it to users' computers. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail. + +**To use Group Policy to configure VBS of KMCI:** + +1. Create a new GPO: Right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. + + ![Group Policy Management, create a GPO](images/dg-fig5-createnewou.png) + + Figure 2. Create a new OU-linked GPO + +2. Give the new GPO a name, for example, **Contoso VBS CI Protection GPO Test**, or any name you prefer. Ideally, the name will align with your existing GPO naming convention. + +3. Open the Group Policy Management Editor: Right-click the new GPO, and then click **Edit**. + +4. Within the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Turn On Virtualization Based Security**, and then click **Edit**. + + ![Edit the group policy for Virtualization Based Security](images/dg-fig6-enablevbs.png) + + Figure 3. Enable VBS + +5. Select the **Enabled** option, and then select the **Enable Virtualization Based Protection of Code Integrity** check box. + + ![Group Policy, Turn On Virtualization Based Security](images/dg-fig7-enablevbsofkmci.png) + + Figure 4. Enable VBS of KMCI + +6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. With this setting configured, the VBS of the KMCI will take effect upon restart. + +7. Check the test client event log for Device Guard GPOs. + + Processed Device Guard policies are logged in event viewer under **Applications and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational**. When the **Turn On Virtualization Based Security** policy has been successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. + +**Validate enabled Device Guard hardware-based security features** + +Windows 10 and Windows Server 2016 and later have a WMI class for Device Guard–related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command: + +` Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard` + +> **Note**  The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10. + +The output of this command provides details of the available hardware-based security features as well as those features that are currently enabled. For detailed information about what each property means, refer to Table 1. + +Table 1. Win32\_DeviceGuard properties + + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
PropertiesDescriptionValid values
AvailableSecurityPropertiesThis field helps to enumerate and report state on the relevant security properties for Device Guard.
    +

  • 0. If present, no relevant properties exist on the device.

    • +

  • 1. If present, hypervisor support is available.

    • +

  • 2. If present, Secure Boot is available.

    • +

  • 3. If present, DMA protection is available.

    • +
InstanceIdentifierA string that is unique to a particular device.Determined by WMI.
RequiredSecurityPropertiesThis field describes the required security properties to enable virtualization-based security.
    +

  • 0. Nothing is required.

    • +

  • 1. If present, Secure Boot is needed.

    • +

  • 2. If present, DMA protection is needed.

    • +

  • 3. If present, both Secure Boot and DMA protection are needed.

    • +
SecurityServicesConfiguredThis field indicates whether the Credential Guard or HVCI service has been configured.
    +

  • 0. No services configured.

    • +

  • 1. If present, Credential Guard is configured.

    • +

  • 2. If present, HVCI is configured.

    • +
SecurityServicesRunningThis field indicates whether the Credential Guard or HVCI service is running.
    +

  • 0. No services running.

    • +

  • 1. If present, Credential Guard is running.

    • +

  • 2. If present, HVCI is running.

    • +
VersionThis field lists the version of this WMI class.The only valid value now is 1.0.
VirtualizationBasedSecurityStatusThis field indicates whether VBS is enabled and running.
    +

  • 0. VBS is not enabled.

    • +

  • 1. VBS is enabled but not running.

    • +

  • 2. VBS is enabled and running.

    • +
PSComputerNameThis field lists the computer name.All valid values for computer name.
+ +Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the **System Summary** section, as shown in Figure 11. + +![Device Guard properties in the System Summary](images/dg-fig11-dgproperties.png) + +Figure 11. Device Guard properties in the System Summary + +## Related topics + +- [Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md) + +- [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md) diff --git a/windows/keep-secure/device-guard-deployment-guide.md b/windows/keep-secure/device-guard-deployment-guide.md index 90d7c6aa3a..85dec6ce25 100644 --- a/windows/keep-secure/device-guard-deployment-guide.md +++ b/windows/keep-secure/device-guard-deployment-guide.md @@ -5,1162 +5,49 @@ ms.assetid: 4BA52AA9-64D3-41F3-94B2-B87EC2717486 keywords: virtualization, security, malware ms.prod: w10 ms.mktglfcycl: deploy -ms.pagetype: security, devices -author: challum +author: brianlic-msft --- -# Device Guard deployment guide +# Device Guard deployment guide (Windows 10) **Applies to** -- Windows 10 +- Windows 10 +- Windows Server 2016 -Microsoft Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security. Windows 10 employs Device Guard as well as code integrity and advanced hardware features such as CPU virtualization extensions, Trusted Platform Module, and second-level address translation to offer comprehensive modern security to its users. This guide explores the individual features in Device Guard as well as how to plan for, configure, and deploy them. +Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications that you define in your code integrity policies. If the app isn’t trusted it can’t run, period. With hardware that meets basic requirements, it also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code. With appropriate hardware, Device Guard can use the new virtualization-based security in Windows 10 Enterprise to isolate the Code Integrity service from the Microsoft Windows kernel itself. In this case, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. -## Introduction to Device Guard +This guide explores the individual features in Device Guard as well as how to plan for, configure, and deploy them. It includes: -Today’s security threat landscape is more aggressive than ever before. Modern malicious attacks are focused on revenue generation, intellectual property theft, and targeted system degradation, which results in financial loss. Many of these modern attackers are sponsored by nation states with unknown motives and large cyber terrorism budgets. These threats can enter a company through something as simple as an email message and can permanently damage its reputation for securing its software assets, as well as having significant financial impact. Windows 10 introduces several new security features that help mitigate a large percentage of today’s known threats. +- [Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md) -It is estimated that more than 300,000 new malware variants are discovered daily. Unfortunately, companies currently use an ancient method to discover this infectious software and prevent its use. In fact, current PCs trust everything that runs until malware signatures determine whether a threat exists; then, the antimalware software attempts to clean the PC, often after the malicious software’s effect has already been noticed. This signature-based system focuses on reacting to an infection and ensuring that the particular infection does not happen again. In this model, the system that drives malware detection relies on the discovery of malicious software; only then can a signature be provided to the client to remediate it, which implies that a computer must be infected first. The time between the detection of the malware and a client being issued a signature could mean the difference between losing data and staying safe. +- [Requirements and deployment planning guidelines for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md) -In addition to antimalware solutions, there are some “whitelisting” technologies available, including AppLocker. These technologies perform single instance, or blanket-allow or blanket-deny rules for running applications. Although this is more preventative than signature-based detection, it requires significant ongoing maintenance. In Windows 10, these applications are most effective when they are deployed alongside Microsoft Device Guard. +- [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md) -Device Guard breaks the current model of detection first-block later, and allows only trusted applications to run, period. This methodology is consistent with the successful prevention strategy for mobile phone security. With Device Guard, Microsoft has changed how the Windows operating system handles untrusted applications, which makes its defenses difficult for malware to penetrate. This new prevention versus detection model provides Windows clients with the necessary security for modern threats and, when implemented, makes most of today’s threats completely obsolete from day one. +- [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md) -Device Guard's features revolutionize the Windows operating system’s security by taking advantage of new virtualization-based security (VBS) options and the trust-nothing mobile device operating system model, which makes its defenses much more difficult for malware to penetrate. By using configurable code integrity policies, organizations are able to choose exactly which applications are allowed to run in their environment. Configurable code integrity is not limited to Windows Store applications and can be used with existing unsigned or signed Win32 applications, without the requirement that the application be repackaged. In addition, configurable code integrity can be deployed as an individual feature if organizations don’t possess the required hardware for Device Guard. Along with code integrity, Windows 10 leverages advanced hardware features such as CPU virtualization extensions, input/output memory management units (IOMMUs), Trusted Platform Module (TPM), and second-level address translation (SLAT) to offer comprehensive modern security to its users. Device Guard deployed with configurable code integrity and Credential Guard will be among the most impactful client-side security deployments an organization can implement today. In this guide, you learn about the individual features found within Device Guard as well as how to plan for, configure, and deploy them. Device Guard with configurable code integrity is intended for deployment alongside additional threat-mitigating Windows features such as Credential Guard and AppLocker. + - [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md) -## Device Guard overview -Device Guard is a feature set that consists of both hardware and software system integrity hardening features. These features revolutionize the Windows operating system’s security by taking advantage of new virtualization-based security options and the trust-nothing mobile device operating system model. A key feature in this model is called *configurable code integrity*, which allows your organization to choose exactly which software or trusted software publishers are allowed to run code on your client machines—exactly what has made mobile phone security so successful. In addition, Device Guard offers organizations a way to sign existing line-of-business (LOB) applications so that they can trust their own code, without the requirement that the application be repackaged. Also, this same method of signing provides organizations with a way to trust individual third-party applications. Device Guard—with configurable code integrity, Credential Guard, and AppLocker—is the most complete security defense that any Microsoft product has ever been able to offer a Windows client. + - [Deploy code integrity policies: policy rules and file rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md) -Advanced hardware features such as CPU virtualization extensions, IOMMUs, and SLAT, drive these new client security offerings. By integrating these hardware features further into the core operating system, Windows 10 leverages them in new ways. For example, the same type 1 hypervisor technology that is used to run virtual machines in Microsoft Hyper-V is used to isolate core Windows services into a virtualization-based, protected container. This is just one example of how Windows 10 integrates advanced hardware features deeper into the operating system to offer comprehensive modern security to its users. These hardware features are now available in consumer and enterprise PC markets and are discussed in detail in the [Hardware considerations](#hardware-considerations) section. + - [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md) -Along with these new features, some components of Device Guard are existing tools or technologies that have been included in this strategic security offering to provide customers with the most secure Windows operating system possible. Device Guard is intended as a set of client security features to be used in conjunction with the other threat-resistance features available in the Windows operating system, some of which are mentioned in this guide. In addition to an overview of each feature, this guide walks you through the configuration and deployment of them. + - [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md) -**Configurable code integrity** - -The Windows operating system consists of two operating modes: user mode and kernel mode. The base of the operating system runs within the kernel mode, which is where the Windows operating system directly interfaces with hardware resources. User mode is primarily responsible for running applications and brokering information to and from the kernel mode for hardware resource requests. For example, when an application that is running in user mode needs additional memory, the user mode process must request the resources from kernel mode, not directly from RAM. - -Code integrity is the component of the Windows operating system that verifies that the code Windows is running is trusted and safe. Like the operating system, Windows code integrity also contains two primary components: kernel mode code integrity (KMCI) and user mode code integrity (UMCI). KMCI has been used in recent versions of the Windows operating system to protect the kernel mode from running unsigned drivers. Although effective, drivers are not the only route that malware can take to penetrate the kernel mode space of the operating system. In Windows 10, however, Microsoft has raised the standard for kernel mode code out of the box as well as provided enterprises with a way to set their own UMCI and KMCI standards. Beginning with the Code Integrity service itself and continuing through the policies a Windows client uses to verify that an application should be allowed to run, Microsoft has made Windows 10 more secure than any previous Windows release. Historically, UMCI has been available only in Windows RT and on Windows Phone devices, which has made it difficult for these devices to be infected with viruses and malware. In Windows 10, these same successful UMCI standards are available. - -Historically, most malware has been unsigned. By simply deploying code integrity policies, organizations will immediately protect themselves against unsigned malware, which is estimated to be responsible for more than 95 percent of current attacks. By using code integrity policies, an enterprise can select exactly which binaries are allowed to run in both user mode and kernel mode, from the signer to the hash level. When completely enforced, it makes user mode in Windows function like a mobile phone, by allowing only specific applications or specific signatures to be trusted and run. This feature alone fundamentally changes the security in an enterprise. This additional security is not limited to Windows apps and does not require that an application be rewritten to be compatible with your existing, unsigned applications. You can implement configurable code integrity without enabling Device Guard, but it is intended to run in conjunction with Device Guard when supported hardware is available. For more information about how to configure, deploy, and manage code integrity policies, see the [Code integrity policies](#code-integrity-policies) section. - -**Hardware security features and virtualization-based security** - -The Device Guard core functionality and protection start at the hardware level. Devices that have processors equipped with SLAT technologies and virtualization extensions, such as Intel Virtualization Technology (VT-x) and AMD-V, will be able to take advantage of virtualization-based security (VBS) features that enhance Windows security. Device Guard leverages VBS to isolate core Windows services that are critical to the security and integrity of the operating system. This isolation removes the vulnerability of these services from both the user and kernel modes and acts as an impenetrable barrier for most malware used today. One of these isolated services, called the Windows Code Integrity service, drives the Device Guard kernel mode configurable code integrity feature. This prevents code that has penetrated the kernel mode operations from compromising the code integrity service. -Another Windows 10 feature that employs VBS is Credential Guard. Credential Guard provides additional protection to Active Directory domain users by storing domain credentials within the virtualization container that hosts the Windows security services, such as code integrity. By isolating these domain credentials from the active user mode and kernel mode, they have a much lower risk of being stolen. For more information about how Credential Guard complements Device Guard, see the [Device Guard with Credential Guard](#device-guard-with-credential-guard) section. For information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-credential-guard) section. - -**Device Guard with AppLocker** - -Although AppLocker is not considered a new Device Guard feature, it complements Device Guard functionality when enforced code integrity cannot be fully implemented or its functionality does not cover every desired scenario. There are many scenarios in which code integrity policies would be used alongside AppLocker rules. As a best practice, you should enforce code integrity policies at the most restrictive level possible for your organization, and then you can use AppLocker to fine-tune the restrictions to an even lower level. - ->**Note:**  One example in which Device Guard functionality needs AppLocker supplementation is when your organization would like to limit universal applications. Universal applications have already been validated by Microsoft to be trustworthy to run, but an organization may not want to allow specific universal applications to run in their environment. You can accomplish this enforcement by using an AppLocker rule. -AppLocker and Device Guard should run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible. In addition to these features, Microsoft recommends that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio. - -**Device Guard with Credential Guard** - -Although Credential Guard is not a feature within Device Guard, many organizations will likely deploy Credential Guard alongside Device Guard for additional protection against credential theft. Similar to virtualization-based protection of kernel mode code integrity, Credential Guard leverages hypervisor technology to protect domain credentials. This mitigation is targeted at resisting the use of pass-the-hash and pass-the-ticket techniques. By employing multifactor authentication with Credential Guard, organizations can gain additional protection against such threats. For information about how to deploy Credential Guard to your Windows 10 Enterprise clients, see the [Enable Credential Guard](#enable-cg) section. In addition to the client-side enablement of Credential Guard, organizations can deploy mitigations at both the CA and domain controller level to help prevent credential theft. Refer to the [Credential Guard](credential-guard.md) documentation for guidance on these additional mitigations. - -**Unified manageability** - -You can easily manage Device Guard features by using the familiar enterprise and client-management tools that IT pros use every day. Use the following management tools to enable and manage Device Guard: - -- **Group Policy**. Windows 10 provides an administrative template to configure and deploy the configurable code integrity policies for your organization. This template also allows you to specify which hardware-based security features you would like to enable and deploy. You can manage these settings along with your existing Group Policy Objects (GPOs), which makes it simple to implement Device Guard features. In addition to these code integrity and hardware-based security features, you can use Group Policy to help you manage your catalog files. For more information about catalog files, see the [Catalog files](#catalog-files) section. -- **Microsoft System Center Configuration Manager**. You can use System Center Configuration Manager to simplify deployment and management of catalog files, code integrity policies, and hardware-based security features, as well as provide version control. For more information about how to deploy catalog files by using System Center Configuration Manager, see the [Deploy catalog files with System Center Configuration Manager](#deploy-cat-sccm) section. -- **Microsoft Intune**. In a future release of Microsoft Intune, organizations will be able to leverage Intune for deployment and management of code integrity policies and catalog files. -- **Windows PowerShell**. Windows PowerShell is primarily used to create and service code integrity policies. These policies represent the most powerful component of Device Guard. For a step-by-step walkthrough of how to create, audit, service, enforce, and deploy code integrity policies, see the [Code integrity policies](#code-integrity-policies) section. - -These options provide the same experience you are used to in order to manage your existing enterprise management solutions. For more information about how to manage and deploy Device Guard hardware and code integrity features in your organization, see the [Device Guard deployment](#dg-deployment) section. - -## Plan for Device Guard - -In this section, you will learn about the following topics: - -- [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment). Device Guard deployment in your organization requires a planned approach. In this section, you get high-level recommendations for how to approach enterprise code integrity deployment in your organization. -- [Device Guard deployment scenarios](#device-guard-deployment-scenarios). When you plan for Device Guard deployment, Microsoft recommends that you categorize each device in your organization into a deployment scenario. These scenarios will provide a roadmap for your Device Guard deployment. -- [Code signing adoption](#code-signing-adoption). Code signing is important to the security that Device Guard provides. This section outlines the options for code signing and the benefits and disadvantages of each method. -- [Hardware considerations](#hardware-considerations). Several Device Guard features require advanced hardware. This section outlines the requirements for each of those features and what to look for during your next hardware refresh. - -## Approach enterprise code integrity deployment - -Enterprises that want to consider Device Guard should not expect deployment to their entire organization overnight. Device Guard implementation requires that you plan for both end-user and IT pro impact. In addition, the deployment of Device Guard features to your enterprise requires a planned, phased approach to ensure that end-user systems are fully capable and ready to enforce these new security restrictions. Perform the following high-level tasks to approach the deployment of Device Guard to your enterprise: - -1. **Group devices into similar functions**. Categorize machines into the groups described in the [Device Guard deployment scenarios](#device-guard-deployment-scenarios) section. This begins the roadmap for your Device Guard deployment and provides groups of easier and more difficult implementations. From there, assess the quantity of necessary Device Guard policies. The easiest solution is to lock down your entire enterprise, but it might not fit your individual departments’ needs. - - To discover an appropriate number of policies for your organization, try to separate the defined groups into departments or roles. Then ask some questions: What software does each department or role need to do their job? Should they be able to install and run other departments’ software? Do we need to create a base code integrity policy that aligns with our application catalog? Should users be able to install any application or only choose from an “allowed” list? Do we allow users to use their own peripheral devices? These questions will help you discover the number of necessary policies for your organization. Finally, try to focus on which people or departments would require an additional level of privileges. For example, should department x be able to install and run application xyz, even though no other department does? If the answer is yes and justifiable, you will need a secondary code integrity policy for that group. If not, you will likely be able to merge several policies to simplify management. For more information about configurable code integrity policies, see the [Code integrity policies](#code-integrity-policies) section. - -2. **Create code integrity policies from “golden” PCs**. After you create the groups of devices, you can create code integrity policies to align with those groups, similar to the way you would manage corporate images. When you have separated these groups and set up golden PCs that mimic the software and hardware those individual groups require, create code integrity policies from each of them. After you create these, you can merge these code integrity policies to create a master policy, or you can manage and deploy them individually. For step-by-step instructions about how to create code integrity policies, see the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) section. - -3. **Audit and merge code integrity policies**. Microsoft recommends that you test code integrity policies in audit mode before you enforce them. Audit mode allows administrators to run the code integrity policy on a system but not actually block anything. Rather than not allowing applications to run, events are logged with each exception to the policy. This way, you can easily highlight any issues that were not discovered during the initial scan. You can create additional code integrity policies by using the audit events and merge them into the existing policy. For more information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies) section. - -4. **Assess LOB applications that are currently unsigned, and create a catalog file for them**. Catalog files allow organizations to sign applications that do not currently possess digitally signed binaries or applications that a customer would want to add a secondary signature to. These applications can be in-house applications or from third parties, and the process does not require any repackaging of the application. When you create code integrity policies at a rule level above hash values, you will not discover unsigned applications. To include these applications in your code integrity policies, simply create, sign, and deploy a catalog file. For information about catalog files, see the [Catalog files](#catalog-files) section. - -5. **Enable desired hardware security features**. Each type of device found in the [Device Guard deployment scenarios](#device-guard-deployment-scenarios) section takes advantage of different software and hardware integrity configurations. You should assess hardware-based security features separately from code integrity policies because they provide complementary functionality. For information about how to configure Device Guard hardware-based security features, see the [Configure hardware-based security features](#configure-hardware-based-security-features) section. - -6. **Deploy code integrity policies and catalog files**. After you have created and signed the necessary catalog files and created and audited code integrity policies, you are ready to deploy them in phases. Microsoft strongly recommends that you deploy these components to a test group of users, even after your IT organization has tested and vetted them. This provides a final quality control validation before you deploy the catalog files and policies more broadly. For information about how to deploy catalog files with Group Policy, see the [Deploy catalog files with Group Policy](#deploy-catalog-files-with-group-policy) section. For additional information about how to deploy code integrity policies, see the [Deploy code integrity policies with Group Policy](#deploy-code-integrity-policies-with-group-policy) section. - -## Device Guard deployment scenarios - -To help simplify the deployment of Device Guard to your organization, Microsoft recommends that you group devices into the deployment scenarios described in this section. Device Guard is not a feature that organizations will just simply “turn on”; rather, it typically requires a phased implementation approach. To see where these scenarios fit into an overall Device Guard deployment approach, see the [Approach to enterprise code integrity deployment](#approach-to-enterprise-code-integrity-deployment) section. - -**Fixed-workload devices** - -The lists of approved applications on fixed-workload devices rarely change as they perform the same tasks day after day. Examples of such devices include kiosks, point-of-sale systems, and call center PCs. These devices could easily employ the full capabilities of Device Guard and would require little management or policy modification. Device Guard implementation to these devices is painless and requires little ongoing administration. With Device Guard fully implemented, users are able to run only those applications that the IT department installs, manages, and trusts. -Device Guard components that are applicable to fixed-workload devices include: - -- KMCI VBS protection -- Enforced UMCI policy - -**Fully managed devices** - -Fully managed devices are those for which the IT department restricts the software that is installed and run on them, but allows users to request installation of additional software or provides a list of approved software in an application catalog. Examples of such devices include locked-down, company-owned desktops and laptops. With these devices, establish an initial baseline code integrity policy and enforce the code integrity policy. The IT department manages the policies and updates the devices when new applications are approved or are provided in the System Center Configuration Manager catalog. -Device Guard components that are applicable to fully managed devices include: - -- KMCI VBS protection -- Enforced UMCI policy - -In this scenario, an application list is provided and trusted, and the trust policy is constantly re-evaluated when a user requests a new application. When an application is trusted across all of these devices, new user requests for that application do not require a policy update (alignment with application catalog). In addition, you can couple this with an onboarding process for new applications that you should add to the central application catalog. Initial implementation of Device Guard to fully managed devices is simple but does require more administrative overhead to manage trusted signatures of newly requested and approved applications. - -**Lightly managed devices** - -Lightly managed devices are company-owned machines over which users have full control, which includes what is installed on them. These devices run the organization’s antivirus solution and client management tools but are not restricted by software request or compliance policies. - -Device Guard components that are applicable to lightly managed devices include: - -- KMCI VBS protection -- UMCI policy in Audit mode - -**Bring Your Own Device** - -Device Guard is not a good way to manage devices in a Bring Your Own Device (BYOD) model. When employees are allowed to bring their own devices, the management of user-mode applications on them can make it difficult for users to use their own devices when they are not at work. In addition, Device Guard functionality is difficult to maintain from an administrative perspective. For devices in this group, explore alternate hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. - -## Code signing adoption - -Code signing is crucial to the successful implementation of configurable code integrity policies. These policies can trust the signing certificates from both independent software vendors and customers. In Windows 10, all Windows Store applications are signed. Also, you can easily trust any other signed application by adding the signing certificate to the code integrity policy. -For unsigned applications, customers have multiple options for signing them so that code integrity policies can trust them. The first option is traditional embedded code signing. Organizations that have in-house development teams can incorporate binary code signing into their application development process, and then simply add the signing certificate to their code integrity policies. The second option for signing unsigned applications is to use catalog files. In Windows 10, customers have the ability to create catalog files as they monitor the installation and initial run of an application. For more information about signing existing unsigned LOB applications or third-party applications, see the [Existing line-of-business applications](#existing-line-of-business-applications) section. - -### Existing line-of-business applications - -Until now, existing LOB applications were difficult to trust if they were signed by a source other than the Windows Store or not signed at all. With Windows 10, signing your existing LOB and third-party unsigned applications is simplified. This new signing method does not require that applications be repackaged in any way. With catalog files, administrators can sign these unsigned applications simply by monitoring for an installation and initial startup. By using this monitoring information, an administrator can generate a catalog file. Catalog files are simply Secure Hash Algorithm 2 (SHA2) hash lists of discovered binaries. These binaries’ hash values are updated every time an application is updated and therefore require an updated catalog file. For simplified administration, consider incorporating embedded code signing into your application development process. For more information about how to generate catalog files, see the [Catalog files](#catalog-files) section. - ->**Note:**  Catalog files are lists of individual binaries’ hash values. If the scanned application is updated, you will need to create a new catalog file. That said, binary signing is still highly recommended for any future applications so that no catalog files are needed. -  -When you create a catalog file, you must sign it by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. When signed, code integrity policies can trust the signer or signing certificate of those files. For information about catalog file signing, see the [Catalog files](#catalog-files) section. - -**Application development** - -Although in-house applications can be signed after packaging by using catalog files, Microsoft strongly recommends that embedded code signing be incorporated into your application development process. When signing applications, simply add the code signing certificate used to sign your applications to your code integrity policy. This ensures that your code integrity policy will trust any future application that is signed with that certificate. Embedding code signing into any in-house application development process is beneficial to your IT organization as you implement code integrity policies. - -## Hardware considerations - -Careful consideration about which hardware vendor and specific models to purchase during your next hardware refresh is vitally important to the success of your organization’s Device Guard implementation efforts. In alignment with your current hardware life cycle, consider the process that is discussed in the [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment) section when you determine the appropriate order of hardware replacement in your organization. Device Guard should be deployed in phases; therefore, you have time to methodically plan for its implementation. - -Different hardware features are required to implement the various features of Device Guard. There will likely be some individual features that you will be able to enable with your current hardware and some that you will not. However, for organizations that want to implement Device Guard in its entirety, several advanced hardware features will be required. For additional details about the hardware features that are required for Device Guard components, see the following table. - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
RequirementDescription

Windows 10 Enterprise

The PC must be running Windows 10 Enterprise.

UEFI firmware version 2.3.1 or higher with UEFI Secure Boot and Platform Secure Boot

UEFI Secure Boot ensures that the device boots only authorized code. Additionally, Boot Integrity, also known as Platform Secure Boot must be supported. You can validate it against the following Windows Hardware Compatibility Program requirements:

-
    -

  • [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)

    • -

  • [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](http://msdn.microsoft.com/library/windows/hardware/dn932807.aspx#system-fundamentals-firmware-cs-uefisecureboot-connectedstandby)

    • -

Virtualization extensions

The following virtualization extensions are required to support virtualization-based security:

-
    -
  • Intel VT-x or AMD-V
    • -
  • Second Level Address Translation
    • -

Firmware lock

    -

  • The firmware setup should be locked to prevent other operating systems from starting and to prevent changes to the UEFI settings.

    • -

  • Work with your hardware manufacturer to ensure that the devices are Device Guard ready.

    • -

  • You should require a firmware password or higher authentication to change firmware settings.

    • -

x64 architecture

The features that virtualization-based security uses in the Windows hypervisor can only run on a 64-bit PC.

A VT-d or AMD-Vi IOMMU (Input/output memory management unit)

In Windows 10, an IOMMU enhances system resiliency against memory attacks.

Secure firmware update process

To verify that the firmware complies with the secure firmware update process, you can validate it against the [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot) Windows Hardware Compatibility Program requirement.

Device Guard relies on the security of the underlying hardware and firmware. It is critical to keep the firmware updated with the latest security fixes.

Signed processor microcode updates

If the processor supports it, you must require signed microcode updates.

- -## Device Guard deployment - -In this section, you learn about the following topics: - -- [Configure hardware-based security features](#configure-hardware-based-security-features). This section explains how to enable the hardware-based security features in Device Guard. Also, you verify that the features are enabled by using both Windows Management Infrastructure (WMI) and Msinfo32.exe. -- [Catalog files](#catalog-files). In this section, you create, sign, and deploy catalog files. You deploy the catalog files by using both Group Policy and System Center Configuration Manager. Also, you use System Center Configuration Manager to inventory the deployed catalog files for reporting purposes. -- [Code integrity policies](#code-integrity-policies). This section provides information on how to create, audit, service, merge, deploy, and remove signed and unsigned configurable code integrity policies. - -## Configure hardware-based security features - -Hardware-based security features make up a large part of Device Guard security offerings. VBS reinforces the most important feature of Device Guard: configurable code integrity. There are three steps to configure hardware-based security features in Device Guard: - -1. **Verify that hardware requirements are met and enabled**. Verify that your client machines possess the necessary hardware to run these features. A list of hardware requirements for the hardware-based security features is available in the [Hardware considerations](#hardware-considerations) section. -2. **Enable the necessary Windows features**. There are several ways to enable the Windows features required for hardware-based security. For details on which Windows features are needed, see the [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-security) section. -3. **Enable desired features**. When the necessary hardware and Windows features have been enabled, you are ready to enable the desired hardware-based security features. For UEFI Secure Boot, see the [Enable UEFI Secure Boot](#enable-unified-extensible-interface-secure-boot) section. For information about how to enable VBS protection of the KMCI service, see the [Enable virtualization-based protection of kernel mode code integrity](#enable-virtualbased) section. Finally, for information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-credential-guard) section. - -### Windows feature requirements for virtualization-based security - -In addition to the hardware requirements found in the [Hardware considerations](#hardware-considerations) section, you must enable certain operating system features before you can enable VBS: Microsoft Hyper-V and isolated user mode (shown in Figure 1). - ->**Note:**  You can configure these features manually by using Windows PowerShell or Deployment Image Servicing and Management. For specific information about these methods, refer to the [Credential Guard documentation](http://go.microsoft.com/fwlink/p/?LinkId=624529). -  -![figure 1](images/dg-fig1-enableos.png) - -Figure 1. Enable operating system features for VBS - -After you enable these features, you can configure any hardware-based security features you want. For information about how to enable virtualization-based protection of kernel-mode code integrity, see the [Enable virtualization-based protection of kernel-mode code integrity](#enable-virtualization-based-protection-of-kernel-mode-code-integrity) section. For information about how to enable UEFI Secure Boot, see the [Enable UEFI Secure Boot](#enable-unified-extensible-interface-secure-boot) section. Finally, for additional information about how to enable Credential Guard, see the [Enable Credential Guard](#enable-credential-guard) section. - -### Enable Unified Extensible Firmware Interface Secure Boot - -Before you begin this process, verify that the target device meets the hardware requirements for UEFI Secure Boot that are laid out in the [Hardware considerations](#hardware-considerations) section. There are two options to configure UEFI Secure Boot: manual configuration of the appropriate registry keys and Group Policy deployment. Complete the following steps to manually configure UEFI Secure Boot on a computer running Windows 10: - ->**Note:**  There are two platform security levels for Secure Boot: stand-alone Secure Boot and Secure Boot with DMA protection. DMA protection provides additional memory protection but will be enabled only on systems whose processors include DMA protection (IOMMU) technologies. Without the presence of IOMMUs and with DMA protection disabled, customers will lose protection from driver-based attacks. - -1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. -2. Set the **EnableVirtualizationBasedSecurity DWORD** value to **1**. -3. Set the **RequirePlatformSecurityFeatures DWORD** value as appropriate: - - - Set this value to **1** to enable the **Secure Boot** option. - - Set this value to **2** to enable the **Secure Boot with DMA Protection** option. - -4. Restart the client machine. - -Unfortunately, it would be time consuming to perform these steps manually on every protected machine in your enterprise. Group Policy offers a much simpler way to deploy UEFI Secure Boot to your organization. This example creates a test organizational unit (OU) called *DG Enabled PCs*. If you prefer to link the policy to an existing OU, and then scope the GPO by using appropriately named computer security groups, you can certainly do so. - ->**Note:**  Microsoft recommends that you test-enable this feature on a group of test machines before you deploy it to machines that are currently deployed to users. - -**Use Group Policy to deploy Secure Boot** - - - -1. To create a new GPO, right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. - - ![figure 2](images/dg-fig2-createou.png) - - Figure 2. Create a new OU-linked GPO - -2. Name the new GPO **Contoso Secure Boot GPO Test**. This example uses *Contoso Secure Boot GPO Test* as the name of the GPO. You can choose any name for this example. Ideally, the name would align with your existing GPO naming convention. - -3. To open the Group Policy Management Editor, right-click the new GPO, and then click **Edit**. - -4. Within the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Then, right-click **Turn On Virtualization Based Security**, and then click **Edit**. - - ![figure 3](images/dg-fig3-enablevbs.png) - - Figure 3. Enable VBS - -5. Select the **Enabled** option, and then select **Secure Boot and DMA Protection** from the **Select Platform Security Level** list. - - ![figure 4](images/device-guard-gp.png) - - Figure 4. Enable Secure Boot - - >**Note:**  Device Guard Secure Boot is maximized when combined with DMA protection. If your hardware contains the IOMMUs required for DMA protection, be sure to select the **Secure Boot and DMA Protection** platform security level. If your hardware does not contain IOMMU, there are several mitigations provided by leveraging Secure Boot without DMA Protection. -   -6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. After you configure this setting, UEFI Secure Boot will be enabled upon restart. - -7. Check the test computer’s event log for Device Guard GPOs. - - Processed Device Guard policies are logged in event viewer at Application and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational. When the **Turn On Virtualization Based Security** policy is successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. - -### Enable virtualization-based security of kernel-mode code integrity - -Before you begin this process, verify that the desired computer meets the hardware requirements for VBS found in the [Hardware considerations](#hardware-considerations) section, and enable the Windows features discussed in the [Virtualization-based security Windows feature requirements](#virtualization-based-security-windows-featurerrequirements) section. When validated, you can enable virtualization-based protection of KMCI in one of two ways: manual configuration of the appropriate registry subkeys and Group Policy deployment. - ->**Note:**  All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. Microsoft recommends that you enable this feature on a group of test machines before you enable it on deployed machines. - -To configure virtualization-based protection of KMCI manually: - -1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DeviceGuard** registry subkey. -2. Set the **HypervisorEnforcedCodeIntegrity DWORD** value to **1**. -3. Restart the client computer. - -It would be time consuming to perform these steps manually on every protected machine in your enterprise. Instead, use Group Policy to deploy virtualization-based protection of KMCI. This example creates a test OU called *DG Enabled PCs*, which you will use to link the GPO. If you prefer to link the policy to an existing OU rather than create a test OU and scope the policy by using appropriately named computer security groups, that is another option. - ->**Note:**  Microsoft recommends that you test-enable this feature on a group of test computers before you deploy it to machines that are currently deployed to users. If untested, there is a possibility that this feature can cause system instability and ultimately cause the client operating system to fail. - -To use Group Policy to configure VBS of KMCI: - -1. Create a new GPO: Right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here**. - - ![figure 5](images/dg-fig5-createnewou.png) - - Figure 5. Create a new OU-linked GPO - -2. Name the new GPO **Contoso VBS CI Protection GPO Test**. - - This example uses *Contoso VBS CI Protection GPO Test* as the name of the GPO. You can choose any name you prefer for this example. Ideally, this name would align with your existing GPO naming convention. - -3. Open the Group Policy Management Editor: Right-click the new GPO, and then click **Edit**. - -4. Within the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Then, right-click **Turn On Virtualization Based Security**, and then click **Edit**. - - ![figure 6](images/dg-fig6-enablevbs.png) - - Figure 6. Enable VBS - -5. Select the **Enabled** option, and then select the **Enable Virtualization Based Protection of Code Integrity** check box. - - ![figure 7](images/dg-fig7-enablevbsofkmci.png) - - Figure 7. Enable VBS of KMCI - -6. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. With this setting configured, the VBS of the KMCI will take effect upon restart. - -7. Check the test client event log for Device Guard GPOs. - - Processed Device Guard policies are logged in event viewer under Application and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational. When the **Turn On Virtualization Based Security** policy has been successfully processed, event ID 7000 is logged, which contains the selected settings within the policy. - -### Enable Credential Guard - -Credential Guard provides an additional layer of credential protection specifically for domain users by storing the credentials within the virtualized container, away from both the kernel and user mode operating system. This makes it difficult for even a compromised system to obtain access to the credentials. In addition to the client-side enablement of Credential Guard, you can deploy additional mitigations at both the Certification Authority and domain controller level to prevent credential theft. Microsoft will be releasing details about these additional mitigations in the future. - -Before you begin this process, verify that the desired system meets the hardware requirements for VBS found in the [Hardware considerations](#hardware) section, and that you have enabled the Windows features laid out in the [Virtualization-based security Windows feature requirements](#virtualization-based-security-windows-feature-requirements) section. When validated, you can enable Credential Guard manually, by configuring the appropriate registry subkeys, or through Group Policy deployment. - -To configure VBS of Credential Guard manually: - -1. Navigate to the **HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa** registry subkey. -2. Set the **LsaCfgFlags DWORD** value to **1**. -3. Restart the client computer. - -To avoid spending an unnecessary amount of time in manual deployments, use Group Policy to deploy Credential Guard to your organization. This example creates a test OU called *DG Enabled PCs*. To enable Credential Guard, you can link to any OU, and then scope the GPO’s application by using security groups. - ->**Note:**  Microsoft recommends that you enable Credential Guard before you join a machine to the domain to ensure that all credentials are properly protected. Setting the appropriate registry subkeys during your imaging process would be ideal to achieve this protection. - -To use Group Policy to enable Credential Guard: - -1. Create a new GPO: right-click the OU to which you want to link the GPO, and then click **Create a GPO in this domain, and Link it here** . - - ![figure 8](images/dg-fig8-createoulinked.png) - - Figure 8. Create a new OU-linked GPO - -2. Name the new GPO **Contoso Credential Guard GPO Test**. - - This example uses *Contoso Credential Guard GPO Test* as the name of the GPO. You can choose any name you prefer for this example. Ideally, this name would align with your existing GPO naming convention. - -3. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. - -4. Within the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Turn On Virtualization Based Security**, and then click **Edit**. - - ![figure 9](images/dg-fig9-enablevbs.png) - - Figure 9. Enable VBS - -5. Select the **Enabled** option, and then select the **Enable Credential Guard** check box. - - ![figure 10](images/dg-fig10-enablecredentialguard.png) - - Figure 10. Enable Credential Guard - -6. Close Group Policy Management Editor, and then restart the Windows 10 test computer. - - >**Note:**  The default platform security level is **Secure Boot**. If IOMMUs are available within the protected machines, it is recommended that you select **Secure Boot and DMA Protection** to maximize the mitigations that are available through Credential Guard. - -7. Check the test client event log for Device Guard GPOs. - ->**Note**  All processed Device Guard policies are logged in event viewer under Application and Services Logs\\Microsoft\\Windows\\DeviceGuard-GPEXT\\Operational. -  -For additional information about how Credential Guard works as well as additional configuration options, please refer to the [Credential Guard documentation](http://go.microsoft.com/fwlink/p/?LinkId=624529). - -**Validate enabled Device Guard hardware-based security features** - -Windows 10 and Windows Server 2016 and later have a WMI class for Device Guard–related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command: - -`Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard` - ->**Note:**  The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10. - -The output of this command provides details of the available hardware-based security features as well as those features that are currently enabled. For detailed information about what each property means, refer to Table 1. -  -Table 1. Win32\_DeviceGuard properties - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PropertiesDescriptionValid values
AvailableSecurityPropertiesThis field helps to enumerate and report state on the relevant security properties for Device Guard.
    -

  • 0. If present, no relevant properties exist on the device.

    • -

  • 1. If present, hypervisor support is available.

    • -

  • 2. If present, Secure Boot is available.

    • -

  • 3. If present, DMA protection is available.

    • -
InstanceIdentifierA string that is unique to a particular device.Determined by WMI.
RequiredSecurityPropertiesThis field describes the required security properties to enable virtualization-based security.
    -

  • 0. Nothing is required.

    • -

  • 1. If present, Secure Boot is needed.

    • -

  • 2. If present, DMA protection is needed.

    • -

  • 3. If present, both Secure Boot and DMA protection are needed.

    • -
SecurityServicesConfiguredThis field indicates whether the Credential Guard or HVCI service has been configured.
    -

  • 0. No services configured.

    • -

  • 1. If present, Credential Guard is configured.

    • -

  • 2. If present, HVCI is configured.

    • -
SecurityServicesRunningThis field indicates whether the Credential Guard or HVCI service is running.
    -

  • 0. No services running.

    • -

  • 1. If present, Credential Guard is running.

    • -

  • 2. If present, HVCI is running.

    • -
VersionThis field lists the version of this WMI class.The only valid value now is 1.0.
VirtualizationBasedSecurityStatusThis field indicates whether VBS is enabled and running.
    -

  • 0. VBS is not enabled.

    • -

  • 1. VBS is enabled but not running.

    • -

  • 2. VBS is enabled and running.

    • -
PSComputerNameThis field lists the computer name.All valid values for computer name.
- -Another method to determine the available and enabled Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Device Guard properties are displayed at the bottom of the -**System Summary** section, as shown in Figure 11. - -![figure 11](images/dg-fig11-dgproperties.png) - -Figure 11. Device Guard properties in the System Summary - -## Catalog files - -Enforcement of Device Guard on a system requires that every trusted application have a signature or its binary hashes added to the code integrity policy. For many organizations, this can be an issue when considering unsigned LOB applications. To avoid the requirement that organizations repackage and sign these applications, Windows 10 includes a tool called Package Inspector that monitors an installation process for any deployed and executed binary files. If the tool discovers such files, it itemizes them in a catalog file. These catalog files offer you a way to trust your existing unsigned applications, whether developed in house or by a third party, as well as trust signed applications for which you do not want to trust the signer but rather the specific application. When created, these files can be signed, the signing certificates added to your existing code integrity policies, and the catalog files themselves distributed to the clients. - ->**Note:**  The Enterprise edition of Windows 10 or Windows Server 2016 is required to create and use catalog files. - -### Create catalog files - -The creation of catalog files is the first step to add an unsigned application to a code integrity policy. To create a catalog file, copy each of the following commands into an elevated Windows PowerShell session, and then complete the steps: - ->**Note:**  When you establish a naming convention it makes it easier to detect deployed catalog files in the future. In this guide, you will use *\*-Contoso.cat* as the naming convention. For more information about why this practice is helpful to inventory or detect catalog files, see the [Inventory catalog files with System Center Configuration Manager](#inventory-catalog-files-with-system-center-configuration-manager) section. -  -1. Be sure that a code integrity policy is currently running in audit mode. - - Package Inspector does not always detect installation files that have been removed from the machine during the installation process. To ensure that these binaries are also trusted, the code integrity policy that you created and audited in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) and [Audit code integrity policies](#audit-code-integrity-policies) sections should be deployed, in audit mode, to the system on which you are running Package Inspector. - - **Note**   - This process should **not** be performed on a system running an enforced Device Guard policy, only with a policy running in audit mode. If a policy is currently being enforced, you will not be able to install and run the application. - -2. Start Package Inspector, and then scan drive C: - - `PackageInspector.exe Start C:` - - >**Note:**  Package inspector can monitor installations on any local drive. In this example, we install the application on drive C, but any other drive can be used. -   -3. Copy the installation media to drive C. - - By copying the installation media to drive C, you ensure that Package Inspector detects and catalogs the actual installer. If you skip this step, the future code integrity policy may trust the application to run but not be installed. - -4. Install and launch the application. - - Install the application to drive C. When the installation is finished, launch the application and ensure that any product updates are installed and any downloadable content caught during the scan. When finished, close and - reopen the application once again to ensure that the scan has captured all binaries. - - >**Note:**   Every binary that is run while Package Inspector is running will be captured in the catalog. Therefore, be sure not to run additional installations or updates during the scan to minimize the risk of trusting the incorrect binaries. Alternatively, if you want to add multiple applications to a single catalog file, simply repeat the installation and run process while the current scan is running. -   -5. Stop the scan, and then generate definition and catalog files. When application installation and initial setup are finished, stop the Package Inspector scan and generate the catalog and definition files on your desktop by using the following commands: - - `$ExamplePath=$env:userprofile+"\Desktop"` - `$CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"` - `$CatDefName=$ExamplePath+"\LOBApp.cdf"` - `PackageInspector.exe Stop C: -Name $CatFileName -cdfpath $CatDefName` - ->**Note:**  This scan catalogs the hash values for each discovered binary file. If the applications that were scanned are updated, complete this process again to trust the new binaries’ hash values. -When finished, the files will be saved to your desktop. To trust this catalog file within a code integrity policy, the catalog must first be signed. Then, the signing certificate can be included in the code integrity policy, and the catalog file can be distributed to the individual client machines. Catalog files can be signed by using a certificate and SignTool.exe, a free tool available in the Windows SDK. For more information about signing catalog files with SignTool.exe, see the [Catalog signing with SignTool.exe](#catalog-signing-with-signtool.exe) section. - -### Catalog signing with SignTool.exe - -Device Guard makes it easy for organizations to sign and trust existing unsigned LOB applications. In this section, you sign a catalog file you generated in a previous section by using PackageInspector.exe. For information about how to create catalog files, see the [Create catalog files](#create-catalog-files) section. In this example, you need the following: - -- SignTool.exe, found in the Windows software development kit (SDK—Windows 7 or later) -- The catalog file that you generated in the [Create catalog files](#create-catalog-files) section, or another catalog file that you have created -- Internal certification authority (CA) code signing certificate or purchased code signing certificate - -If you do not have a code signing certificate, please see the [Create a Device Guard code signing certificate](#create-a-device-guard-code-signing-certificate) section for a walkthrough of how to create one. In addition to using the certificate you create in the Create a Device Guard code signing certificate section, this example signs the catalog file that you created in the [Create catalog files](#create-catalog-files) section. If you are using an alternate certificate or catalog file, update the following steps with the appropriate variables and certificate. To sign the existing catalog file, copy each of the following commands into an elevated Windows PowerShell session: - -1. Initialize the variables that will be used: - - '$ExamplePath=$env:userprofile+"\Desktop"' - - '$CatFileName=$ExamplePath+"\LOBApp-Contoso.cat"' - - >**Note:**   In this example, you use the catalog file you created in the [Create catalog files](#create-catalog-files) section. If you are signing another catalog file, be sure to update the *$ExamplePath* and *$CatFileName* variables with the correct information. - -2. Import the code signing certificate. Import the code signing certificate that will be used to sign the catalog file to the signing user’s personal store. In this example, you use the certificate that you created in the [Create a Device Guard code signing certificate](#create-a-device-guard-code-signing-certificate) section. - -3. Sign the catalog file with Signtool.exe: - - ` sign /n "ContosoDGSigningCert" /fd sha256 /v $CatFileName` - - >**Note:**  The *<Path to signtool.exe>* variable should be the full path to the Signtool.exe utility. *ContosoDGSigningCert* is the subject name of the certificate that you will use to sign the catalog file. This certificate should be imported to your personal certificate store on the machine on which you are attempting to sign the catalog file. - - >**Note:**  For additional information about Signtool.exe and all additional switches, visit [MSDN Sign Tool page](http://go.microsoft.com/fwlink/p/?LinkId=624163). -   -4. Verify the catalog file digital signature. Right-click the catalog file, and then click **Properties**. On the **Digital Signatures** tab, verify that your signing certificate exists with a **sha256** algorithm, as shown in Figure 12. - - ![figure 12](images/dg-fig12-verifysigning.png) - - Figure 12. Verify that the signing certificate exists - -5. Copy the catalog file to C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}. - - For testing purposes, you can manually copy signed catalog files to their intended folder. For large-scale implementations, Microsoft recommends that you use Group Policy File Preferences to copy the appropriate catalog files to all desired machines or an enterprise systems management product such as System Center Configuration Manager. Doing this simplifies the management of catalog versions, as well. - -### Deploy catalog files with Group Policy - -To simplify the management of catalog files, you can use Group Policy preferences to deploy catalog files to the appropriate PCs in your organization. The following process walks you through the deployment of a signed catalog file called LOBApp-Contoso.cat to a test OU called DG Enabled PCs with a GPO called **Contoso DG Catalog File GPO Test**. - ->**Note:**  This walkthrough requires that you have previously created a signed catalog file and have a Windows 10 client PC on which to test a Group Policy deployment. For more information about how to create and sign a catalog file, see the [Catalog files](#catalog-files) section. - -To deploy a catalog file with Group Policy: - -1. From either a domain controller or a client PC that has Remote Server Administration Tools (RSAT) installed, open the Group Policy Management Console (GPMC) by running **GPMC.MSC** or by searching for Group Policy Management. -2. Create a new GPO: right-click the DG Enabled PCs OU, and then click **Create a GPO in this domain, and Link it here**, as shown in Figure 13. - - >**Note:**  The DG Enabled PCs OU is just an example of where to link the test GPO that you created in this section. You can use any OU name. Also, security group filtering is an option when you consider policy partitioning options based on the strategy discussed in the [Approach enterprise code integrity deployment](#approach-enterprise-code-integrity-deployment) section. - - ![figure 13](images/dg-fig13-createnewgpo.png) - - Figure 13. Create a new GPO - -3. Name the new GPO **Contoso DG Catalog File GPO Test**. - - This example uses *Contoso DG Catalog File GPO Test* as the name of the GPO. You can choose any name you prefer for this example. - -4. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. - -5. Within the selected GPO, navigate to Computer Configuration\\Preferences\\Windows Settings\\Files. Right-click **Files**, point to **New**, and then click **File**, as shown in Figure 14. - - ![figure 14](images/dg-fig14-createnewfile.png) - - Figure 14. Create a new file - -6. Configure the catalog file share. - - To use this setting to provide consistent deployment of LOBApp-Contoso.cat, the source file should be on a share that is accessible to the computer account of every deployed machine. This example uses a share on a Windows 10 client machine called \\\\Contoso-Win10\\Share. The catalog file being deployed is copied to this share. - -7. To keep versions consistent, in the **New File Properties** dialog box (Figure 15), select **Replace** from the **Action** list so that the newest version is always used. - - ![figure 15](images/dg-fig15-setnewfileprops.png) - - Figure 15. Set the new file properties - -8. In the **Source file(s)** box, type the name of your accessible share, with the catalog file name included (for example, \\\\Contoso-Win10\\share\\LOBApp-Contoso.cat). - -9. In the **Destination File** box, type **C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\\LOBApp-Contoso.cat**. - - >**Note:**  LOBApp-Contoso.cat is not a required catalog name: This name was used in the [Create catalog files](#create-catalog-files) section, and so it was used here, as well. -   -10. On the **Common** tab of the **New File Properties** dialog box, select the **Remove this item when it is no longer applied** option. Doing this ensures that the catalog file is removed from every system, in case you ever need to stop trusting this application. - -11. Click **OK** to complete file creation. - -12. Close the Group Policy Management Editor, and then update the policy on the test Windows 10 machine by running GPUpdate.exe. When the policy has been updated, verify that the catalog file exists in C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} on the Windows 10 machine. - -### Deploy catalog files with System Center Configuration Manager - -As an alternative to Group Policy, you can use System Center Configuration Manager to deploy catalog files to the managed machines in your environment. This approach can simplify the deployment and management of multiple catalog files as well as provide reporting around which catalog each client or collection has deployed. In addition to the deployment of these files, System Center Configuration Manager can also be used to inventory the currently deployed catalog files for reporting and compliance purposes. Complete the following steps to create a new deployment package for catalog files: - ->**Note:**  The following example uses a network share named \\\\Shares\\CatalogShare as a source for the catalog files. If you have collection specific catalog files, or prefer to deploy them individually, use whichever folder structure works best for your organization. - -1. Open the Configuration Manager console, and select the Software Library workspace. -2. Navigate to Overview\\Application Management, right-click **Packages**, and then click **Create Package**. -3. Name the package, set your organization as the manufacturer, and select an appropriate version number (Figure 16). - - ![figure 16](images/dg-fig16-specifyinfo.png) - - Figure 16. Specify information about the new package - -4. Click **Next**, and then select **Standard program** as the program type. -5. On the **Standard Program** page, select a name, and then set the **Command Line** property to **XCopy \\\\Shares\\CatalogShare C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} /H /K /E /Y**. -6. On the **Standard Program** page, select the following options (Figure 17): - - - In **Name**, type **Contoso Catalog File Copy Program**. - - In **Command line**, browse to the program location. - - In **Startup folder**, type **C:\\Windows\\System32**. - - From the **Run** list, select **Hidden**. - - From the **Program can run** list, select **Whether or not a user is logged on**. - - From the **Drive mode** list, select **Runs with UNC name**. - - ![figure 17](images/dg-fig17-specifyinfo.png) - - Figure 17. Specify information about the standard program - -7. Accept the defaults for the rest of the wizard, and then close the wizard. -After you create the deployment package, deploy it to a collection so that the clients will receive the catalog files. In this example, you deploy the package you just created to a test collection: - -1. In the Software Library workspace, navigate to Overview\\Application Management\\Packages, right-click the catalog file package, and then click **Deploy**. -2. On the **General** page, select the test collection to which the catalog files will be deployed, and then click **Next**. -3. On the **Content** page, click **Add** to select the distribution point that will serve content to the selected collection, and then click **Next**. -4. On the **Deployment Settings** page, select **Required** in the **Purpose** box. -5. On the **Scheduling** page, click **New**. -6. In the **Assignment Schedule** dialog box, select **Assign immediately after this event**, set the value to **As soon as possible**, and then click **OK**. -7. On the **Scheduling** page, click **Next**. -8. On the **User Experience** page (Figure 18), set the following options, and then click **Next**: - - - Select the **Software installation** check box. - - Select the **Commit changes at deadline or during a maintenance window (requires restarts)** check box. - - ![figure 18](images/dg-fig18-specifyux.png) - - Figure 18. Specify the user experience - -9. On the **Distribution Points** page, in the **Deployment options** box, select **Run program from distribution point**, and then click **Next**. -10. On the **Summary** page, review the selections, and then click **Next**. -11. Close the wizard. - -### Inventory catalog files with System Center Configuration Manager - -When catalog files have been deployed to the machines within your environment, whether by using Group Policy or System Center Configuration Manager, you can inventory them with the software inventory feature of System Center Configuration Manager. The following process walks you through the enablement of software inventory to discover catalog files on your managed systems through the creation and deployment of a new client settings policy. - ->**Note:**  A standard naming convention for your catalog files will significantly simplify the catalog file software inventory process. In this example, *-Contoso* has been added to all catalog file names. - -1. Open the Configuration Manager console, and select the Administration workspace. -2. Navigate to **Overview\\Client Settings**, right-click **Client Settings**, and then click **Create Custom Client Device Settings**. -3. Name the new policy, and select the **Software Inventory** check box from the **Select and then configure the custom settings for client devices** list, as shown in Figure 19. - - ![figure 19](images/dg-fig19-customsettings.png) - - Figure 19. Select custom settings - -4. In the navigation pane, click **Software Inventory**, and then click **Set Types**, as shown in Figure 20. - - ![figure 20](images/dg-fig20-setsoftwareinv.png) - - Figure 20. Set the software inventory - -5. In the **Configure Client Setting** dialog box, click the **Start** button to open the **Inventories File Properties** dialog box. - -6. In the **Name** box, type **\*Contoso.cat**, and then click **Set**. - - >**Note:**  **\*Contoso.cat** is the naming convention used in this example. This should mimic the naming convention you use for your catalog files. -   -7. In the **Path Properties** dialog box, select **Variable or path name**, and then type **C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}** in the box, as shown in Figure 21. - - ![figure 21](images/dg-fig21-pathproperties.png) - - Figure 21. Set the path properties - -8. Click **OK**. - -9. Now that you have created the client settings policy, right-click the new policy, click **Deploy**, and then choose the collection on which you would like to inventory the catalog files. -At the time of the next software inventory cycle, when the targeted clients receive the new client settings policy, you will be able to view the inventoried files in the built-in System Center Configuration Manager reports or Resource Explorer. To view the inventoried files on a client within Resource Explorer, complete the following steps: - -1. Open the Configuration Manager console, and select the Assets and Compliance workspace. -2. Navigate to Overview\\Devices, and search for the device on which you want to view the inventoried files. -3. Right-click the computer, point to **Start**, and then click **Resource Explorer**. -4. In Resource Explorer, navigate to Software\\File Details to view the inventoried catalog files. - ->**Note:**  If nothing is displayed in this view, navigate to Software\\Last Software Scan in Resource Explorer to verify that the client has recently completed a software inventory scan. -  -## Code integrity policies - -Code integrity policies maintain the standards by which a computer running Windows 10 determines whether an application is trustworthy and can be run. For an overview of code integrity, see the [Configurable code integrity](#configurable-code-integrity) section. - -A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. Code integrity policies follow a similar methodology, that begins with the establishment of a golden PC. Like when imaging, you can have multiple golden PCs based on model, department, application set, and so on. Although the thought process around the creation of code integrity policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional code integrity policies based on what should be allowed to be installed and run and for whom. - ->**Note:**  Each machine can have only **one** code integrity policy at a time. Whichever way you deploy this policy, it is renamed to SIPolicy.p7b and copied to C:\\Windows\\System32\\CodeIntegrity. Keep this in mind when you create your code integrity policies. - -Optionally, code integrity policies can align with your software catalog as well as any IT department–approved applications. One simple method to implement code integrity policies is to use existing images to create one master code integrity policy. You do so by creating a code integrity policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, should the applications be installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed. - ->**Note:**  The following section assumes that you will deploy code integrity policies as part of your Device Guard deployment. Alternatively, configurable code integrity is available without the enablement of Device Guard. - -### Code integrity policy rules - -Code integrity policies consist of several components. The two major components, which are configurable, are called *policy rules* and *file rules*, respectively. Code integrity policy rules are options that the code integrity policy creator can specify on the policy. These options include the enablement of audit mode, UMCI, and so on. You can modify these options in a new or existing code integrity policy. File rules are the level to which the code integrity policy scan ties each binary trust. For example, the hash level is going to itemize each discovered hash on the system within the generated code integrity policy. This way, when a binary prepares to run, the code integrity service will validate its hash value against the trusted hashes found in the code integrity policy. Based on that result, the binary will or will not be allowed to run. - -To modify the policy rule options of an existing code integrity policy, use the **Set-RuleOption** Windows PowerShell cmdlet. Note the following examples of how to use this cmdlet to add and remove a rule option on an existing code integrity policy: - -- To enable UMCI, add rule option 0 to an existing policy by running the following command: - - `Set-RuleOption -Option 0 -FilePath ` - -- To disable UMCI on an existing code integrity policy, remove rule option 0 by running the following command: - - ` Set-RuleOption -Option 0 -FilePath -Delete` - -You can set several rule options within a code integrity policy. Table 2 lists each rule and its high-level meaning. - -#### Table 2. Code integrity policy - policy rule options - -| Rule option | Description | -|------------ | ----------- | -| **0 Enabled:UMCI** | Code integrity policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | -| **1 Enabled:Boot Menu Protection** | This option is not currently supported. | -| **2 Required:WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | -| **3 Enabled:Audit Mode (Default)** | Enables the execution of binaries outside of the code integrity policy but logs each occurrence in the CodeIntegrity event log, which can be used to update the existing policy before enforcement. To enforce a code integrity policy, remove this option. | -| **4 Disabled:Flight Signing** | If enabled, code integrity policies will not trust flightroot-signed binaries. This would be used in the scenario in which organizations only want to run released binaries, not flighted builds. | -| **5 Enabled:Inherent Default Policy** | This option is not currently supported. | -| **6 Enabled:Unsigned System Integrity Policy (Default)** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | -| **7 Allowed:Debug Policy Augmented** | This option is not currently supported. | -| **8 Required:EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All future Windows 10 and later drivers will meet this requirement. | -| **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all code integrity policies. Setting this rule option allows the F8 menu to appear to physically present users. | -| **10 Enabled:Boot Audit on Failure** | Used when the code integrity policy is in enforcement mode. When a driver fails during startup, the code integrity policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | -File rule levels allow administrators to specify the level at which they want to trust their applications. This level of trust could be as low as the hash of each binary and as high as a PCA certificate. File rule levels are specified both when you create a new code integrity policy from a scan and when you create a policy from audit events. In addition, to combine rule levels found in multiple policies, you can merge the policies. When merged, code integrity policies combine their file rules. Each file rule level has its benefit and disadvantage. Use Table 3 to select the appropriate protection level for your available administrative resources and Device Guard deployment scenario. - -#### Table 3. Code integrity policy - file rule levels - -| Rule level | Description | -|----------- | ----------- | -| **Hash** | Specifies individual hash values for each discovered binary. Although this level is specific, it can cause additional administrative overhead to maintain the current product versions’ hash values. Each time a binary is updated, the hash value changes, therefore requiring a policy update. | -| **FileName** | Specifies individual binary file names. Although the hash values for an application are modified when updated, the file names are typically not. This offers less specific security than the hash level but does not typically require a policy update when any binary is modified. | -| **SignedVersion** | This combines the publisher rule with a version number. This option allows anything from the specified publisher, with a version at or above the specified version number, to run. | -| **Publisher** | This is a combination of the PCA certificate and the common name (CN) on the leaf certificate. In the scenario that a PCA certificate is used to sign multiple companies’ applications (such as VeriSign), this rule level allows organizations to trust the PCA certificate but only for the company whose name is on the leaf certificate (for example, Intel for device drivers). This level trusts a certificate with a long validity period but only when combined with a trusted leaf certificate. | -| **FilePublisher** | This is a combination of “FileName” plus “Publisher” (PCA certificate with CN of leaf) plus a minimum version number. This option trusts specific files from the specified publisher, with a version at or above the specified version number. | -| **LeafCertificate** | Adds trusted signers at the individual signing certificate level. The benefit of using this level versus the individual hash level is that new versions of the product will have different hash values but typically the same signing certificate. Using this level, no policy update would be needed to run the new version of the application. However, leaf certificates have much shorter validity periods than PCA certificates, so additional administrative overhead is associated with updating the code integrity policy when these certificates expire. | -| **PcaCertificate** | Adds the highest certificate in the provided certificate chain to signers. This is typically one certificate below the root certificate, because the scan does not validate anything above the presented signature by going online or checking local root stores. | -| **RootCertificate** | Currently unsupported. | -| **WHQL** | Trusts binaries if they have been validated and signed by WHQL. This is primarily for kernel binaries. | -| **WHQLPublisher** | This is a combination of the WHQL and the CN on the leaf certificate and is primarily for kernel binaries. | -| **WHQLFilePublisher** | Specifies that the binaries are validated and signed by WHQL, with a specific publisher (WHQLPublisher), and that the binary is the specified version or newer. This is primarily for kernel binaries. | - ->**Note:**  When you create code integrity policies with the **New-CIPolicy** cmdlet, you can specify a primary file rule level by including the **–Level** parameter. For discovered binaries that cannot be trusted based on the primary file rule criteria, use the **–Fallback** parameter. For example, if the primary file rule level is PCACertificate but you would like to trust the unsigned applications as well, using the Hash rule level as a fallback adds the hash values of binaries that did not have a signing certificate. - -### Create code integrity policies from golden PCs - -The process to create a golden code integrity policy from a reference system is straightforward. This section outlines the process that is required to successfully create a code integrity policy with Windows PowerShell. First, for this example, you must initiate variables to be used during the creation process. Rather than using variables, you can simply use the full file paths in the command. Next, you create the code integrity policy by scanning the system for installed applications. When created, the policy file is converted to binary format so that Windows can consume its contents. - ->**Note:**  Before you begin this procedure, ensure that the reference PC is clean of viruses or malware. Each piece of installed software should be validated as trustworthy before you create this policy. Also, be sure that any software that you would like to be scanned is installed on the system before you create the code integrity policy. - -To create a code integrity policy, copy each of the following commands into an elevated Windows PowerShell session, in order: - -1. Initialize variables that you will use: - - `$CIPolicyPath=$env:userprofile+"\Desktop\"` - `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` - `$CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` - -2. Create a new code integrity policy by scanning the system for installed applications: - - `New-CIPolicy -Level PcaCertificate -FilePath $InitialCIPolicy –UserPEs 3> CIPolicyLog.txt ` - - >**Note:**  By specifying the *–UserPEs* parameter, rule option **0 Enabled:UMCI** is automatically added to the code integrity policy. If you do not specify this parameter, use the following command to enable UMCI: - - `Set-RuleOption -Option 0 -FilePath $InitialCIPolicy` - - >**Note:**  You can add the *–Fallback* parameter to catch any applications not discovered using the primary file rule level specified by the *–Level* parameter. For more information about file rule level options, see the [Code integrity policy rules](#code-integrity-policy-rules) section. - - >**Note:**  If you would like to specify the code integrity policy scan to look only at a specific drive, you can do so by using the *–ScanPath* parameter. Without this parameter, as shown in the example, the entire system is scanned. - -3. Convert the code integrity policy to a binary format: - - `ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin` - -After you complete these steps, the Device Guard binary file (DeviceGuardPolicy.bin) and original .xml file (IntialScan.xml) will be available on your desktop. You can use the binary version as a code integrity policy or sign it for additional security. - ->**Note:**  Microsoft recommends that you keep the original .xml file of the policy for use when you need to merge the code integrity policy with another policy or update its rule options. Alternatively, you would have to create a new policy from a new scan for servicing. For more information about how to merge code integrity policies, see the [Merge code integrity policies](#merge-code-integrity-policies) section. - -Microsoft recommends that every code integrity policy be run in audit mode before being enforced. Doing so allows administrators to discover any issues with the policy without receiving error message dialog boxes. For information about how to audit a code integrity policy, see the [Audit code integrity policies](#audit-code-integrity-policies) section. - -### Audit code integrity policies - -When code integrity policies are run in audit mode, it allows administrators to discover any applications that were missed during an initial policy scan and to identify any new applications that have been installed and run since the original policy was created. While a code integrity policy is running in audit mode, any binary that runs and would have been denied had the policy been enforced is logged in the Applications and Services Logs\\Microsoft\\CodeIntegrity\\Operational event log. When these logged binaries have been validated, they can easily be added to a new code integrity policy. When the new exception policy is created, you can merge it with your existing code integrity policies. - ->**Note:**  Before you begin this process, you need to create a code integrity policy binary file. If you have not already done so, see the [Create an audit code integrity policy](#create-an-audit-code-integrity-policy) section for a step-by-step walkthrough of the process to create a code integrity policy and convert it to binary format. - -To audit a code integrity policy with local policy: - -1. Copy the DeviceGuardPolicy.bin file that you created in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) section to C:\\Windows\\System32\\CodeIntegrity. -2. On the system you want to run in audit mode, open the Local Group Policy Editor by running **GPEdit.msc**. -3. Navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard, and then select **Deploy Code Integrity Policy**. Enable this setting by using the file path C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 22. - - >**Note:**  *DeviceGuardPolicy.bin* is not a required policy name. This name was simply used in the [Create code integrity policies from golden PCs](#create-code-golden) section and so was used here. Also, this policy file does not need to be copied to every system. Alternatively, you can copy the code integrity policies to a file share to which all computer accounts have access. - - >**Note:**  Any policy you select here is converted to SIPolicy.p7b when it is deployed to the individual computers. - - ![figure 22](images/dg-fig22-deploycode.png) - - Figure 22. Deploy your code integrity policy - - >**Note:**   You may have noticed that the GPO setting references a .p7b file and this policy uses a .bin file. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the Windows 10 computers. Microsoft recommends that you make your code integrity policies friendly and allow the system to convert the policy names for you. By doing this, it ensures that the policies are easily distinguishable when viewed in a share or any other central repository. - -4. Restart reference system for the code integrity policy to take effect. -5. Monitor the CodeIntegrity event log. While in audit mode, any exception to the deployed code integrity policy will be logged in the Applications and Services Logs\\Microsoft\\CodeIntegrity\\Operational event log, as shown in -Figure 23. - - ![figure 23](images/dg-fig23-exceptionstocode.png) - - Figure 23. Exceptions to the deployed code integrity policy - -6. Validate any code integrity policy exceptions. - - After you run a code integrity policy in audit mode, Microsoft recommends that each logged exception be researched and validated. In addition to discovering which application is causing the exception and ensuring that it should be added to the code integrity policy, be sure to check which file level should be used to trust each application. Although the Hash file rule level will catch all of these exceptions, it may not be the best way to trust all of the exceptions. For information about file rule levels and their purpose, see the [Code integrity policy rules](#code-integrity-policy-rules) section. - -7. Create code integrity policy from audit events. - - For information about how to create code integrity policies from audit events, see the [Create code integrity policies from golden PCs](#create-code-golden) section. - ->**Note:**  An alternative method to test a policy is to rename the test file to SIPolicy.p7b and drop it into C:\\Windows\\System32\\CodeIntegrity, rather than deploy it with the local machine policy. - -### Create an audit code integrity policy - -When you run code integrity policies in audit mode, validate any exceptions and determine whether you will need to add them to the code integrity policy you want to audit. Use the system as you normally would to ensure that any use exceptions are logged. When you are ready to create a code integrity policy from the auditing events, complete the following steps in an elevated Windows PowerShell session: - -1. Initialize the variables that will be used: - - `$CIPolicyPath=$env:userprofile+"\Desktop\"` - `$CIAuditPolicy=$CIPolicyPath+"DeviceGuardAuditPolicy.xml"` - -2. Analyze audit results. - - Before you create a code integrity policy from audit events, Microsoft recommends that each exception be analyzed, as discussed in steps 5 and 6 of the [Audit code integrity policies](#audit-code-integrity-policies) section. - -3. Generate a new code integrity policy from logged audit events: - - `New-CIPolicy -Audit -Level Hash -FilePath $CIAuditPolicy –UserPEs 3> CIPolicylog.txt` - ->**Note:**  When you create policies from audit events, you should carefully consider the file rule level that you select to trust. In this example, you use the Hash rule level, which should be used as a last resort. -After you complete these steps, the Device Guard audit policy .xml file (DeviceGuardAuditPolicy.xml) will be available on your desktop. You can now use this file to update the existing code integrity policy that you ran in audit mode by merging the two policies. For instructions on how to merge this audit policy with the existing code integrity policy, see the [Merge code integrity policies](#merge-code-integrity-policies) section. - ->**Note:**  You may have noticed that you did not generate a binary version of this policy as you did in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) section. This is because code integrity policies created from an audit log are not intended to run as stand-alone policies but rather to update existing code integrity policies. - -### Merge code integrity policies - -When you develop code integrity policies, you will occasionally need to merge two policies. A common example is when a code integrity policy is initially created and audited. Another example is when you create a single master policy by using multiple code integrity policies previously created from golden PCs. Because each Windows 10 machine can have only one code integrity policy, it is important to properly maintain these policies. In this example, audit events have been saved into a secondary code integrity policy that you then merge with the initial code integrity policy. - ->**Note:**  The following example uses the code integrity policy .xml files that you created in the [Create code integrity policies from golden PCs](#create-code-integrity-policies-from-golden-pcs) and [Audit code integrity policies](#audit-code-integrity-policies) sections. You can follow this process, however, with any two code integrity policies you would like to combine. - -To merge two code integrity policies, complete the following steps in an elevated Windows PowerShell session: - -1. Initialize the variables that will be used: - - ` $CIPolicyPath=$env:userprofile+"\Desktop\"` - `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"` - `$AuditCIPolicy=$CIPolicyPath+"DeviceGuardAuditPolicy.xml"` - `$MergedCIPolicy=$CIPolicyPath+"MergedPolicy.xml"` - ` $CIPolicyBin=$CIPolicyPath+"NewDeviceGuardPolicy.bin"` - - >**Note:**  The variables in this section specifically expect to find an initial policy on your desktop called InitialScan.xml and an audit code integrity policy called DeviceGuardAuditPolicy.xml. If you want to merge other code integrity policies, update the variables accordingly. -   -2. Merge two policies to create a new code integrity policy: - - `Merge-CIPolicy -PolicyPaths $InitialCIPolicy,$AuditCIPolicy -OutputFilePath $MergedCIPolicy` -3. -Convert the merged code integrity policy to binary format: - - ` ConvertFrom-CIPolicy $MergedCIPolicy $CIPolicyBin ` - -Now that you have created a new code integrity policy called NewDeviceGuardPolicy.bin, you can deploy the policy to systems manually or by using Group Policy or Microsoft client management solutions. For information about how to deploy this new policy with Group Policy, see the [Deploy and manage code integrity policies with Group Policy](#deploy-manage-code-gp) section. - -**Enforce code integrity policies** - -Every code integrity policy is created with audit mode enabled. After you have successfully deployed and tested a code integrity policy in audit mode and are ready to test the policy in enforced mode, complete the following steps in an elevated Windows PowerShell session: - ->**Note:**  Every code integrity policy should be tested in audit mode first. For information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity) section. - -1. Initialize the variables that will be used: - - `$CIPolicyPath=$env:userprofile+"\Desktop\"` - `$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml" ` - `$EnforcedCIPolicy=$CIPolicyPath+"EnforcedPolicy.xml"` - `$CIPolicyBin=$CIPolicyPath+"EnforcedDeviceGuardPolicy.bin"` - - >**Note:**  The initial code integrity policy that this section referenced was created in the [Create code integrity polices from golden PCs](#create-code-golden) section. If you are using a different code integrity policy, update the **CIPolicyPath** and **InitialCIPolicy** variables. -   -2. Copy the initial file to maintain an original copy: - - `cp $InitialCIPolicy $EnforcedCIPolicy` - -3. Remove the audit mode rule option: - - `Set-RuleOption -Option 3 -FilePath $EnforcedCIPolicy -Delete` - - >**Note:**  Rather than adding an **Enforced** option, code integrity policies are implicitly enforced if no **Audit Mode Enabled** option is present. -   -4. Convert the new code integrity policy to binary format: - - `ConvertFrom-CIPolicy $EnforcedCIPolicy $CIPolicyBin` - >**Note:**  Microsoft strongly recommends that you enable rule options 9 and 10 before you run any enforced policy for the first time. If already present in the policy, do not remove it. Doing so allows Windows to start if the code integrity policy blocks a kernel-mode driver from running and provides administrators with a pre-boot command prompt. When ready for enterprise deployment, you can remove these options. -   -Now that this policy has been enforced, you can deploy it to your test machines. Rename the policy to SIPolicy.p7b and copy it to C:\\Windows\\System32\\CodeIntegrity for testing, or deploy the policy through Group Policy by following the instructions in the [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy) section, or through client management software by following the instructions in the section “Deploying and managing code integrity policies by using Microsoft client management solutions.” - -**Signing code integrity policies with SignTool.exe** - -Signed code integrity policies give organizations the highest level of malware protection available in Windows 10. In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the machine. These policies are designed to prevent administrative tampering and kernel mode exploit access. With this in mind, it is much more difficult to remove signed code integrity policies than unsigned ones. Before you sign and deploy a signed code integrity policy, Microsoft recommends that you audit the policy to discover any blocked applications that should be allowed to run. For more information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies) section. - -Signing code integrity policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward. If you do not currently have a code signing certificate exported in .pfx format (containing private keys, extensions, and root certificates), see [Create a Device Guard code signing certificate](#create-a-device-guard-code-signing-certificate) to create one with your on-premises CA. Before signing code integrity policies for the first time, be sure to enable rule options 9 and 10 to leave troubleshooting options available to test administrators. When validated and ready for enterprise deployment, you can remove these options. For information about how to add rule options, see the [Code integrity policy rules](#code-integrity-policy-rules) section. - ->**Note:**  Signing code integrity policies is the last step in a code integrity deployment. It is much more difficult to remove a signed code integrity policy than an unsigned one. Before you deploy a signed code integrity policy to deployed client computers, be sure to test its effect on a subset of machines. - -To sign a code integrity policy with SignTool.exe, you need the following components: - -- SignTool.exe, found in the Windows SDK (Windows 7 or later) -- The binary format of the code integrity policy that you generated in the [Create code integrity policies from golden PCs](#create-code-golden) section or another code integrity policy that you have created -- An internal CA code signing certificate or a purchased code signing certificate - -If you do not have a code signing certificate, see the [Create a Device Guard code signing certificate](#create-dg-code) section for instructions on how to create one. If you use an alternate certificate or code integrity policy, be sure to update the following steps with the appropriate variables and certificate so that the commands will function properly. To sign the existing code integrity policy, copy each of the following commands into an elevated -Windows PowerShell session: - -1. Initialize the variables that will be used: - - `$CIPolicyPath=$env:userprofile+"\Desktop\" $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml" $CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"` - - >**Note:**  This example uses the code integrity policy that you created in the [Create code integrity policies from golden PCs](#create-code-golden) section. If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information. - -2. Import the .pfx code signing certificate. Import the code signing certificate that you will use to sign the code integrity policy into the signing user’s personal store on the machine that will be doing the signing. In this example, you use the certificate that was created in the [Create a Device Guard code signing certificate](#create-dg-code) section. - -3. Export the .cer code signing certificate. After the code signing certificate has been imported, export the .cer version to your desktop. This version will be added to the policy so that it can be updated later. - -4. Navigate to your desktop as the working directory: - - `cd $env:USERPROFILE\Desktop ` - -5. Add an update signer certificate to the code integrity policy: - - `Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath -Kernel -User –Update` - - >**Note:**  *<Path to exported .cer certificate>* should be the full path to the certificate that you exported in step 3. - - >**Note:**  Adding update signers is crucial to being able to modify or disable this policy in the future. For more information about how to disable signed code integrity policies, see the [Disable signed code integrity policies within Windows](#disable-signed-code) section. - -6. Remove the unsigned policy rule option: - - `Set-RuleOption -Option 6 -FilePath $InitialCIPolicy -Delete` - -7. Convert the policy to binary format: - - `ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin` - -8. Sign the code integrity policy by using SignTool.exe: - - ` sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin` - >**Note:**  The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the code integrity policy. You should import this certificate to your personal certificate store on the machine you use to sign the policy. - -9. Validate the signed file. When complete, the commands should output a signed policy file called DeviceGuardPolicy.bin.p7 to your desktop. You can deploy this file the same way you deploy an enforced or non-enforced policy. For information about how to deploy code integrity policies, see the [Deploy and manage code integrity policies with Group Policy](#deploy-and-manage-code-integrity-policies-with-group-policy) section. - -### Disable unsigned code integrity policies - -There may come a time when an administrator wants to disable a code integrity policy. For unsigned code integrity policies, this process is simple. Depending on how the code integrity policy was deployed, unsigned policies can be disabled in one of two ways. If a code integrity policy was manually enabled and copied to the code integrity folder location, simply delete the file and restart the machine. The following locations can contain executing code integrity policies: - -- <EFI System Partition>\\Microsoft\\Boot\\ -- <OS Volume>\\Windows\\System32\\CodeIntegrity\\ - -If the code integrity policy was deployed by using Group Policy, the GPO that is currently enabling and deploying the policy must be set to disabled. Then, the code integrity policy will be disabled on the next computer restart. - -### Disable signed code integrity policies within Windows - -Signed policies protect Windows from administrative manipulation as well as malware that has gained administrative-level access to the system. For this reason, signed code integrity policies are intentionally more difficult to remove than unsigned policies. They inherently protect themselves from modification or removal and therefore are difficult even for administrators to remove successfully. If the signed code integrity policy is manually enabled and copied to the CodeIntegrity folder, to remove the policy, you must complete the following steps: - ->**Note:**  For reference, signed code integrity policies should be replaced and removed from the following locations: - -- <EFI System Partition>\\Microsoft\\Boot\\ -- <OS Volume>\\Windows\\System32\\CodeIntegrity\\ - -1. Replace the existing policy with another signed policy that has the **6 Enabled: Unsigned System Integrity Policy** rule option enabled. - - >**Note:**  To take effect, this policy must be signed with a certificate previously added to the **UpdatePolicySigners** section of the original signed policy you want to replace. - -2. Restart the client computer. - -3. Verify that the new signed policy exists on the client. - - >**Note:**  If the signed policy that contains rule option 6 has not been processed on the client, the addition of an unsigned policy may cause boot failures. - -4. Delete the new policy. - -5. Restart the client computer. - -If the signed code integrity policy has been deployed using by using Group Policy, you must complete the following steps: - -1. Replace the existing policy in the GPO with another signed policy that has the **6 Enabled: Unsigned System Integrity Policy** rule option enabled. - >**Note:**  To take effect, this policy must be signed with a certificate previously added to the **UpdatePolicySigners** section of the original signed policy you want to replace. -   -2. Restart the client computer. - -3. Verify that the new signed policy exists on the client. - - >**Note:**  If the signed policy that contains rule option 6 has not been processed on the client, the addition of an unsigned policy may cause boot failures. - -4. Set the GPO to disabled. -5. Delete the new policy. -6. Restart the client computer. - -### Disable signed code integrity policies within the BIOS - -There may be a time when signed code integrity policies cause a boot failure. Because code integrity policies enforce kernel mode drivers, it is important that they be thoroughly tested on each software and hardware configuration before being enforced and signed. Signed code integrity policies are validated in the pre-boot sequence by using Secure Boot. When you disable the Secure Boot feature in the BIOS, and then delete the file from the following locations on the operating system disk, it allows the system to boot into Windows: - -- <EFI System Partition>\\Microsoft\\Boot\\ -- <OS Volume>\\Windows\\System32\\CodeIntegrity\\ - -### - -**Deploy and manage code integrity policies with Group Policy** - -Code integrity policies can easily be deployed and managed with Group Policy. A Device Guard administrative template will be available in Windows Server 2016 that allows you to simplify deployment of Device Guard hardware-based security features and code integrity policies. The following procedure walks you through how to deploy a code integrity policy called **DeviceGuardPolicy.bin** to a test OU called *DG Enabled PCs* by using a GPO called **Contoso GPO Test**. - ->**Note:**  This walkthrough requires that you have previously created a code integrity policy and have a Windows 10 client PC on which to test a Group Policy deployment. For more information about how to create a code integrity policy, see the [Create code integrity polices from golden PCs](#create-code-integrity-polices-from-golden-pcs) section. - ->**Note:**  Signed code integrity policies can cause boot failures when deployed. Microsoft recommends that signed code integrity policies be thoroughly tested on each hardware platform before enterprise deployment. -To deploy and manage a code integrity policy with Group Policy: - -1. On a domain controller on a client computer on which RSAT is installed, open the GPMC by running **GPMC.MSC** or searching for “Group Policy Management” in Windows Search. - -2. Create a new GPO: right-click the DG Enabled PCs OU, and then click **Create a GPO in this domain, and Link it here**, as shown in Figure 24. - - >**Note:**  The DG Enabled PCs OU is just an example of where to link the test GPO created in this section. Any OU name can be used. Also, security group filtering is an option when considering policy partitioning options based on the strategy discussed in the [Approach enterprise code integrity deployment](#approach-enterprise) section. - - ![figure 24](images/dg-fig24-creategpo.png) - - Figure 24. Create a GPO - -3. Name new GPO **Contoso GPO Test**. This example uses Contoso GPO Test as the name of the GPO. You can choose any name that you prefer for this example. - -4. Open the Group Policy Management Editor: right-click the new GPO, and then click **Edit**. - -5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Then, right-click **Deploy Code Integrity Policy**, and then click **Edit**. - - ![figure 25](images/dg-fig25-editcode.png) - - Figure 25. Edit the code integration policy - -6. In the **Display Code Integrity Policy** dialog box, select the **Enabled** option, and then specify the code integrity policy deployment path. - In this policy setting, you specify either the local path in which the policy will exist on the client computer or a Universal Naming Convention (UNC) path that the client computers will look to retrieve the latest version of the policy. This example copied the DeviceGuardPolicy.bin file onto the test machine and will enable this setting and use the file path C:\\Windows\\System32\\CodeIntegrity\\DeviceGuardPolicy.bin, as shown in Figure 26. - - >**Note:**  *DeviceGuardPolicy.bin* is not a required policy name: It was simply used in the [Create code integrity policies from golden PCs](#create-code-golden) section and so is used here, as well. Also, this policy file does not need to be copied to every computer. Alternatively, you can copy the code integrity policies to a file share to which the computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers. - - ![figure 26](images/dg-fig26-enablecode.png) - - Figure 26. Enable the code integrity policy - - >**Note:**  You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the Windows 10 client computers. Make your code integrity policies friendly and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository. - -7. Close the Group Policy Management Editor, and then restart the Windows 10 test machine. Restarting the client computer updates the code integrity policy. For information about how to audit code integrity policies, see the [Audit code integrity policies](#audit-code-integrity-policies)section. - -## Create a Device Guard code signing certificate - -To sign catalog files or code integrity policies internally, you will either need a publicly issued code signing certificate or an internal CA. If you have purchased a code signing certificate, you can skip these steps and proceed to the sections that outline the steps to sign catalog files and code integrity policies. If you have not purchased a certificate but have an internal CA, complete these steps to create a code signing certificate: - -1. Open the Certification Authority Microsoft Management Console (MMC) snap-in, and then select your issuing CA. -2. When connected, right-click **Certificate Templates**, and then click **Manage** to open the Certification Templates Console. - - ![figure 27](images/dg-fig27-managecerttemp.png) - - Figure 27. Manage the certificate templates - -3. In the navigation pane, right-click the Code Signing certificate, and then click **Duplicate Template**. - -4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** from the **Certification Authority** list, and then select **Windows 8 / Windows Server 2012** from the **Certificate recipient** list. -5. On the **General** tab, specify the **Template display name** and **Template name**. This example uses **DG Catalog Signing Certificate**. -6. On the **Request Handling** tab, select the **Allow private key to be exported** check box. -7. On the **Extensions** tab, select the **Basic Constraints** check box, and then click **Edit**. -8. In the **Edit Basic Constraints Extension** dialog box, select the **Enable the extension** check box, as shown in Figure 28. - - ![figure 28](images/dg-fig29-enableconstraints.png) - - Figure 28. Enable constraints on the new template -9. -If a certificate manager is required to approve any issued certificates, on the **Issuance Requirements** tab, select **CA certificate manager approval**. -10. On the **Subject Name** tab, select **Supply in the request**. -11. On the **Security** tab, verify that whatever account will be used to request the certificate has the right to enroll the certificate. -12. Click **OK** to create the template, and then close the Certificate Template Console. -When this certificate template has been created, you must publish it to the CA published template store. To do so, complete the following steps: -1. In the Certification Authority MMC snap-in, right-click **Certification Templates**, point to **New**, and then click **Certificate Template to Issue**, as shown in Figure 29. - - A list of available templates to issue appears, including the template you just created. - - ![figure 29](images/dg-fig30-selectnewcert.png) - - Figure 29. Select the new certificate template to issue - -2. Select the DG Catalog signing certificate, and then click **OK**. -Now that the template is available to be issued, you must request one from the Windows 10 computer that you use to create and sign catalog files. To begin, open the MMC, and then complete the following steps: -1. In MMC, from the **File** menu, click **Add/Remove Snap-in**. Double-click **Certificates**, and then select **My user account**. -2. In the Certificates snap-in, right-click the Personal store folder, point to **All Tasks**, and then click **Request New Certificate**. -3. Click **Next** twice to get to the certificate selection list. -4. In the **Request Certificate** list, select your newly created code signing certificate, and then select the blue text that requests additional information, as shown in Figure 30. - - ![figure 30](images/dg-fig31-getmoreinfo.png) - - Figure 30. Get more information for your code signing certificate -5. -In the **Certificate Properties** dialog box, for **Type**, select **Common name**. For **Value**, select **ContosoDGSigningCert**, and then click **Add**. When added, click **OK.** -6. Enroll and finish. - ->**Note:**  If a certificate manager is required to approve any issued certificates and you selected to require management approval on the template, the request will need to be approved in the CA before it will be issued to the client. - -This certificate must be installed in the user’s personal store on the computer that will be signing the catalog files and code integrity policies. If the signing is going to be taking place on the machine on which you just requested the certificate, exporting the certificate to a .pfx file will not be required because it already exists in your personal store. If you are signing on another computer, you will need to export the .pfx certificate with the necessary keys and properties. To do so, complete the following steps: - -1. Right-click the certificate, point to **All Tasks**, and then click **Export**. -2. Click **Next**, and then select **Yes, export the private key**. -3. Choose the default settings, and then select **Export all extended properties**. -4. Set a password, select an export path, and then select **DGCatSigningCert.pfx** as the file name. -When the certificate has been exported, import it into the personal store for the user who will be signing the catalog files or code integrity policies on the specific computer that will be signing them. +- [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md) ## Related topics -- [AppLocker overview](applocker-overview.md) -- [Code integrity](http://go.microsoft.com/fwlink/p/?LinkId=624173) -- [Credential guard](credential-guard.md) -- [Driver compatibility with Device Guard in Windows 10](http://go.microsoft.com/fwlink/p/?LinkId=624843) -- [Dropping the Hammer Down on Malware Threats with Windows 10’s Device Guard](http://go.microsoft.com/fwlink/p/?LinkId=624844) +[AppLocker overview](applocker-overview.md) + + + +[Code integrity](https://technet.microsoft.com/library/dd348642.aspx) + +[Protect derived domain credentials with Credential Guard](credential-guard.md) + +[Driver compatibility with Device Guard in Windows 10](https://blogs.msdn.microsoft.com/windows_hardware_certification/2015/05/22/driver-compatibility-with-device-guard-in-windows-10) + +[Dropping the Hammer Down on Malware Threats with Windows 10’s Device Guard](https://channel9.msdn.com/Events/Ignite/2015/BRK2336) + + diff --git a/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md b/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md new file mode 100644 index 0000000000..07a789467a --- /dev/null +++ b/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md @@ -0,0 +1,78 @@ +--- +title: Introduction to Device Guard - virtualization-based security and code integrity policies (Windows 10) +description: Microsoft Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security. +keywords: virtualization, security, malware +ms.prod: w10 +ms.mktglfcycl: deploy +author: brianlic-msft +--- + +# Introduction to Device Guard: virtualization-based security and code integrity policies + +**Applies to** +- Windows 10 +- Windows Server 2016 + +With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks. Device Guard on Windows 10 Enterprise changes from a mode where apps are trusted unless blocked by an antivirus or other security solution, to a mode where the operating system trusts only apps authorized by your enterprise. You designate these trusted apps by creating *code integrity policies*. + +Like the operating system, code integrity contains two primary components: kernel mode code integrity (KMCI) and user mode code integrity (UMCI). KMCI has been available in previous versions of the Windows operating system, and protects the kernel mode from running unsigned drivers. In Windows 10 and Windows Server 2016, UMCI is also available, to help protect against viruses and malware. + +To increase the security level offered by code integrity policies, Device Guard can leverage advanced hardware features on hardware that supports them. These features include CPU virtualization extensions (called "Intel VT-x" or "AMD-V") and second-level address translation (SLAT). In addition, hardware that includes input/output memory management units (IOMMUs) provides even stronger protections. When you enable the features associated with CPU virtualization extensions and SLAT, the Code Integrity service can run alongside the kernel in a Windows hypervisor-protected container. The following table provides more information about how Device Guard and these hardware features can help protect against various threats. + +For an overview of the process of deploying Device Guard features, see [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). + +## How Device Guard features help protect against threats + +The following table lists security threats and describes the corresponding Device Guard features: + +| Security threat in the enterprise | How a Device Guard feature helps protect against the threat | +| --------------------------------- | ----------------------------------------------------------- | +| **Exposure to new malware**, for which the "signature" is not yet known | **Code integrity policies**:  You can maintain a whitelist of software that is allowed to run (a configurable code integrity policy), rather than trying to stay ahead of attackers by maintaining a constantly-updated list of "signatures" of software that should be blocked. This approach uses the trust-nothing model well known in mobile device operating systems.

**Specialized hardware required?** No security-related hardware features are required, although code integrity policies are strengthened by such features, as described in the last three rows of this table. | +| **Exposure to unsigned code** (most malware is unsigned) | **Code integrity policies, plus catalog files as needed**:  Because most malware is unsigned, using a code integrity policy (which in most cases requires signed code) can immediately help protect against a large number of threats. However, many organizations use unsigned line-of-business (LOB) applications, for which the process of signing might be difficult. This has changed in Windows 10, because you can use a tool called Package Inspector to create a *catalog* of all deployed and executed binary files for your trusted applications. After you sign and distribute the catalog, your trusted applications can be handled by code integrity policies in the same way as any other signed application. With this foundation, you can more easily block all unsigned applications, allowing only signed applications to run.

**Specialized hardware required?** No security-related hardware features are required for creating and using code integrity policies and catalogs. However, code integrity policies and catalogs are strengthened by the hardware features, as described in later rows of this table. | +| **Malware that gains access to the kernel** and then, from within the kernel, captures sensitive information or damages the system | **Virtualization-based security (VBS)**:  This is protection that uses the hypervisor to help protect the kernel and other parts of the operating system. When VBS is enabled, it strengthens either the default kernel-mode code integrity policy (which protects against bad drivers or system files), or the configurable code integrity policy that you deploy. With VBS, even if malware gains access to the kernel, the effects can be severely limited, because the hypervisor can prevent the malware from executing code.

**Specialized hardware required?** Yes, VBS requires at least CPU virtualization extensions and SLAT, as described in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). | +| **DMA-based attacks**, for example, attacks launched from a malicious device that reads secrets from memory, making the enterprise more vulnerable to attack | **Virtualization-based security (VBS) using IOMMUs**:  With this type of VBS protection, when the DMA-based attack makes a memory request, input/output memory management units (IOMMUs) will evaluate the request and deny access.

**Specialized hardware required?** Yes, IOMMUs are a hardware feature that supports the hypervisor, and if you choose hardware that includes them, they can help protect against malicious attempts to access memory. | +| **Exposure to boot kits** or to other forms of malware that runs early in the boot process, or in kernel after startup | **Universal Extensible Firmware Interface (UEFI) Secure Boot**:   Secure Boot and related methods protect the boot process and firmware from tampering.

**Specialized hardware required?** With UEFI Secure Boot, the requirements are firmware requirements. For more information, see [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). | + +In this guide, you learn about the individual features found within Device Guard as well as how to plan for, configure, and deploy them. Device Guard with configurable code integrity is intended for deployment alongside additional threat-mitigating Windows features such as [Credential Guard](credential-guard.md) and [AppLocker](applocker-overview.md). + +## Tools for managing Device Guard features + +You can easily manage Device Guard features by using familiar enterprise and client-management tools that IT pros use every day: + + + +- **Group Policy**. Windows 10 provides an administrative template to configure and deploy the configurable code integrity policies for your organization. This template also allows you to specify which hardware-based security features you would like to enable and deploy. You can manage these settings along with your existing Group Policy Objects (GPOs), which makes it simpler to implement Device Guard features. In addition to these code integrity and hardware-based security features, you can use Group Policy to help you manage your catalog files. + + - For a description of catalog files, see the table row describing **Exposure to unsigned code** in [How Device Guard features help protect against threats](#how-device-guard-features-help-protect-against-threats), earlier in this topic. + - For information about using Group Policy as a deployment tool, see:
[Deploy catalog files with Group Policy](deploy-catalog-files-to-support-code-integrity-policies.md#deploy-catalog-files-with-group-policy)
[Deploy and manage code integrity policies with Group Policy](deploy-code-integrity-policies-steps.md#deploy-and-manage-code-integrity-policies-with-group-policy) + +- **Microsoft System Center Configuration Manager**. You can use System Center Configuration Manager to simplify deployment and management of catalog files, code integrity policies, and hardware-based security features, as well as provide version control. For more information, see [Deploy catalog files with System Center Configuration Manager](deploy-catalog-files-to-support-code-integrity-policies.md#deploy-catalog-files-with-system-center-configuration-manager). + +- **Microsoft Intune**. In a future release of Microsoft Intune, Microsoft is considering including features that will support the deployment and management of code integrity policies and catalog files. + +- **Windows PowerShell**. You can use Windows PowerShell to create and service code integrity policies. For more information, see [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md) and [Configurable Code Integrity Policy for Windows PowerShell](https://technet.microsoft.com/library/mt634481.aspx). + +These options provide the same experience you're used to in order to manage your existing enterprise management solutions. + +For more information about the deployment of Device Guard features, see: +- [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md) +- [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md) + +## Other features that relate to Device Guard + +### Device Guard with AppLocker + +Although [AppLocker](applocker-overview.md) is not considered a new Device Guard feature, it complements Device Guard functionality when enforced code integrity cannot be fully implemented or its functionality does not cover every desired scenario. There are many scenarios in which code integrity policies would be used alongside AppLocker rules. As a best practice, you should enforce code integrity policies at the most restrictive level possible for your organization, and then you can use AppLocker to fine-tune the restrictions to an even lower level. + +> **Note**  One example of how Device Guard functionality can be enhanced by AppLocker is when you want to limit universal applications. Universal applications have already been validated by Microsoft to be trustworthy to run, but an organization may not want to allow specific universal applications to run in their environment. You can accomplish this enforcement by using an AppLocker rule. + +AppLocker and Device Guard should run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible. In addition to these features, we recommend that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio. + +### Device Guard with Credential Guard + +Another Windows 10 feature that employs VBS is [Credential Guard](credential-guard.md). Credential Guard provides additional protection to Active Directory domain users by storing domain credentials within the same type of VBS virtualization container that hosts code integrity. By isolating these domain credentials from the active user mode and kernel mode, they have a much lower risk of being stolen. For more information about Credential Guard (which is not a feature within Device Guard), see [Protect derived domain credentials with Credential Guard](credential-guard.md). + +Credential Guard is targeted at resisting pass-the-hash and pass-the-ticket techniques. By employing multifactor authentication with Credential Guard, organizations can gain additional protection against such threats. + +In addition to the client-side enabling of Credential Guard, organizations can deploy mitigations at both the CA and domain controller level to help prevent credential theft. For more information, see the [Additional mitigations](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/credential-guard#additional-mitigations) section in “Protect derived domain credentials with Credential Guard.” + diff --git a/windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md b/windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md new file mode 100644 index 0000000000..55f3a36e0e --- /dev/null +++ b/windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md @@ -0,0 +1,101 @@ +--- +title: Optional - Create a code signing certificate for code integrity policies (Windows 10) +description: This article describes how to create a code signing certificate for code integrity policies, one of the main features that are part of Device Guard in Windows 10. +keywords: virtualization, security, malware +ms.prod: w10 +ms.mktglfcycl: deploy +author: brianlic-msft +--- + +# Optional: Create a code signing certificate for code integrity policies (Windows 10) + +**Applies to** +- Windows 10 +- Windows Server 2016 + +As you deploy code integrity policies (part of Device Guard), you might need to sign catalog files or code integrity policies internally. To do this, you will either need a publicly issued code signing certificate or an internal CA. If you have purchased a code signing certificate, you can skip this topic and instead follow other topics listed in [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md). + +If you have not purchased a certificate but have an internal CA, complete these steps to create a code signing certificate: + +1. Open the Certification Authority Microsoft Management Console (MMC) snap-in, and then select your issuing CA. + +2. When connected, right-click **Certificate Templates**, and then click **Manage** to open the Certification Templates Console. + + ![CA snap-in showing Certificate Templates](images/dg-fig27-managecerttemp.png) + + Figure 1. Manage the certificate templates + +3. In the navigation pane, right-click the Code Signing certificate, and then click **Duplicate Template**. + +4. On the **Compatibility** tab, clear the **Show resulting changes** check box. Select **Windows Server 2012** from the **Certification Authority** list, and then select **Windows 8 / Windows Server 2012** from the **Certificate recipient** list. + +5. On the **General** tab, specify the **Template display name** and **Template name**. This example uses the name **DG Catalog Signing Certificate**. + +6. On the **Request Handling** tab, select the **Allow private key to be exported** check box. + +7. On the **Extensions** tab, select the **Basic Constraints** check box, and then click **Edit**. + +8. In the **Edit Basic Constraints Extension** dialog box, select **Enable this extension**, as shown in Figure 2. + + ![Edit Basic Constraints Extension](images/dg-fig29-enableconstraints.png) + + Figure 2. Select constraints on the new template + +9. If a certificate manager is required to approve any issued certificates, on the **Issuance Requirements** tab, select **CA certificate manager approval**. + +10. On the **Subject Name** tab, select **Supply in the request**. + +11. On the **Security** tab, verify that whatever account will be used to request the certificate has the right to enroll the certificate. + +12. Click **OK** to create the template, and then close the Certificate Template Console. + +When this certificate template has been created, you must publish it to the CA published template store. To do so, complete the following steps: + +1. In the Certification Authority MMC snap-in, right-click **Certification Templates**, point to **New**, and then click **Certificate Template to Issue**, as shown in Figure 3. + + ![Select Certificate Template to Issue](images/dg-fig30-selectnewcert.png) + + Figure 3. Select the new certificate template to issue + + A list of available templates to issue appears, including the template you just created. + +2. Select the DG Catalog signing certificate, and then click **OK**. + +Now that the template is available to be issued, you must request one from the computer running Windows 10 on which you create and sign catalog files. To begin, open the MMC, and then complete the following steps: + +1. In MMC, from the **File** menu, click **Add/Remove Snap-in**. Double-click **Certificates**, and then select **My user account**. + +2. In the Certificates snap-in, right-click the Personal store folder, point to **All Tasks**, and then click **Request New Certificate**. + +3. Click **Next** twice to get to the certificate selection list. + +4. In the **Request Certificate** list, select your newly created code signing certificate, and then select the blue text that requests additional information, as shown in Figure 4. + + ![Request Certificates: more information required](images/dg-fig31-getmoreinfo.png) + + Figure 4. Get more information for your code signing certificate + +5. In the **Certificate Properties** dialog box, for **Type**, select **Common name**. For **Value**, select **ContosoDGSigningCert**, and then click **Add**. When added, click **OK.** + +6. Enroll and finish. + +> **Note**  If a certificate manager is required to approve any issued certificates and you selected to require management approval on the template, the request will need to be approved in the CA before it will be issued to the client. + +This certificate must be installed in the user’s personal store on the computer that will be signing the catalog files and code integrity policies. If the signing is going to be taking place on the computer on which you just requested the certificate, exporting the certificate to a .pfx file will not be required because it already exists in your personal store. If you are signing on another computer, you will need to export the .pfx certificate with the necessary keys and properties. To do so, complete the following steps: + +1. Right-click the certificate, point to **All Tasks**, and then click **Export**. + +2. Click **Next**, and then select **Yes, export the private key**. + +3. Choose the default settings, and then select **Export all extended properties**. + +4. Set a password, select an export path, and then select **DGCatSigningCert.pfx** as the file name. + +When the certificate has been exported, import it into the personal store for the user who will be signing the catalog files or code integrity policies on the specific computer that will be signing them. + +## Related topics + +- [Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md) + +- [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md) + diff --git a/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md b/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md new file mode 100644 index 0000000000..9b96e7267b --- /dev/null +++ b/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md @@ -0,0 +1,56 @@ +--- +title: Planning and getting started on the Device Guard deployment process (Windows 10) +description: To help you plan and begin the initial test stages of a deployment of Microsoft Device Guard, this article outlines how to gather information, create a plan, and begin to create and test initial code integrity policies. +keywords: virtualization, security, malware +ms.prod: w10 +ms.mktglfcycl: deploy +author: brianlic-msft +--- + +# Planning and getting started on the Device Guard deployment process (Windows 10) + +**Applies to** +- Windows 10 +- Windows Server 2016 + +This topic provides a roadmap for planning and getting started on the Device Guard deployment process, with links to topics that provide additional detail. Planning for Device Guard deployment involves looking at both the end-user and the IT pro impact of your choices. Use the following steps to guide you. + +**Planning** + +1. **Review requirements, especially hardware requirements for VBS**. Review the virtualization-based security (VBS) features described in [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). Then you can assess your end-user systems to see how many support the VBS features you are interested in, as described in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). + +2. **Group devices by degree of control needed**. Group devices according to the table in [Device Guard deployment in different scenarios: types of devices](requirements-and-deployment-planning-guidelines-for-device-guard.md#device-guard-deployment-in-different-scenarios-types-of-devices). Do most devices fit neatly into a few categories, or are they scattered across all categories? Are users allowed to install any application or must they choose from a list? Are users allowed to use their own peripheral devices?
Deployment is simpler if everything is locked down in the same way, but meeting individual departments’ needs, and working with a wide variety of devices, may require a more complicated and flexible deployment. + +3. **Review how much variety in software and hardware is needed by roles or departments**. When several departments all use the same hardware and software, you might need to deploy only one code integrity policy for them. More variety across departments might mean you need to create and manage more code integrity policies. The following questions can help you clarify how many code integrity policies to create: + - How standardized is the hardware?
This can be relevant because of drivers. You could create a code integrity policy on hardware that uses a particular set of drivers, and if other drivers in your environment use the same signature, they would also be allowed to run. However, you might need to create several code integrity policies on different "reference" hardware, then merge the policies together, to ensure that the resulting policy recognizes all the drivers in your environment. + + - Is there already a list of accepted applications?
A list of accepted applications can be used to help create a baseline code integrity policy. + + - What software does each department or role need? Should they be able to install and run other departments’ software?
If multiple departments are allowed to run the same list of software, you might be able to merge several code integrity policies to simplify management. + + - Are there departments or roles where unique, restricted software is used?
If one department needs to run an application that no other department is allowed, it might require a separate code integrity policy. Similarly, if only one department must run an old version of an application (while other departments allow only the newer version), it might require a separate code integrity policy. + +4. **Identify LOB applications that are currently unsigned**. Although requiring signed code (through code integrity policies) protects against many threats, your organization might use unsigned LOB applications, for which the process of signing might be difficult. You might also have applications that are signed, but you want to add a secondary signature to them. If so, identify these applications, because you will need to create a catalog file for them. For a basic description of catalog files, see the table in [Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md). For more background information about catalog files, see [Reviewing your applications: application signing and catalog files](requirements-and-deployment-planning-guidelines-for-device-guard.md#reviewing-your-applications-application-signing-and-catalog-files). + +**Getting started on the deployment process** + +1. **Optionally, create a signing certificate for code integrity policies**. As you deploy code integrity policies, you might need to sign catalog files or code integrity policies internally. To do this, you will either need a publicly issued code signing certificate (that you purchase) or an internal CA. If you choose to use an internal CA, you will need to create a code signing certificate. For more information, see [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md). + +2. **Create code integrity policies from “golden” computers**. When you have identified departments or roles that use distinctive or partly-distinctive sets of hardware and software, you can set up “golden” computers containing that software and hardware. In this respect, creating and managing code integrity policies to align with the needs of roles or departments can be similar to managing corporate images. From each “golden” computer, you can create a code integrity policy, and decide how to manage that policy. You can merge code integrity policies to create a broader policy or a master policy, or you can manage and deploy each policy individually. For more information, see: + - [Deploy code integrity policies: policy rules and file rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md) + - [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md)
+ +3. **Audit the code integrity policy and capture information about applications that are outside the policy**. We recommend that you use “audit mode” to carefully test each code integrity policy before you enforce it. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. Later, you can expand the policy to allow these applications, as needed. For more information, see [Audit code integrity policies](deploy-code-integrity-policies-steps.md#audit-code-integrity-policies). + +4. **Create a “catalog file” for unsigned LOB applications**. Use the Package Inspector tool to create and sign a catalog file for your unsigned LOB applications. For more information, review step 4 **Identify LOB applications that are currently unsigned**, earlier in this list, and see [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md). In later steps, you can merge the catalog file's signature into your code integrity policy, so that applications in the catalog will be allowed by the policy. + +6. **Capture needed policy information from the event log, and merge information into the existing policy as needed**. After a code integrity policy has been running for a time in audit mode, the event log will contain information about applications that are outside the policy. To expand the policy so that it allows for these applications, use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy. You can merge code integrity policies from other sources also, for flexibility in how you create your final code integrity policies. For more information, see: + - [Create a code integrity policy that captures audit information from the event log](deploy-code-integrity-policies-steps.md#create-a-code-integrity-policy-that-captures-audit-information-from-the-event-log) + - [Merge code integrity policies](deploy-code-integrity-policies-steps.md#merge-code-integrity-policies)
+ +7. **Deploy code integrity policies and catalog files**. After you confirm that you have completed all the preceding steps, you can begin deploying catalog files and taking code integrity policies out of auditing mode. We strongly recommend that you begin this process with a test group of users. This provides a final quality-control validation before you deploy the catalog files and code integrity policies more broadly. For more information, see: + - [Enforce code integrity policies](deploy-code-integrity-policies-steps.md#enforce-code-integrity-policies) + - [Deploy and manage code integrity policies with Group Policy](deploy-code-integrity-policies-steps.md#deploy-and-manage-code-integrity-policies-with-group-policy)
+ +8. **Enable desired hardware (VBS) security features**. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by code integrity policies, as described in [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). For information about enabling VBS features, see [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md). + diff --git a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md new file mode 100644 index 0000000000..0cfc7f0b0e --- /dev/null +++ b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md @@ -0,0 +1,124 @@ +--- +title: Requirements and deployment planning guidelines for Device Guard (Windows 10) +description: To help you plan a deployment of Microsoft Device Guard, this article describes hardware requirements for Device Guard, outlines deployment approaches, and describes methods for code signing and the deployment of code integrity policies. +keywords: virtualization, security, malware +ms.prod: w10 +ms.mktglfcycl: deploy +author: brianlic-msft +--- + +# Requirements and deployment planning guidelines for Device Guard (Windows 10) + +**Applies to** +- Windows 10 +- Windows Server 2016 + +This article describes the following: + +- [Hardware, firmware, and software requirements for Device Guard](#hardware-firmware-and-software-requirements-for-device-guard) + - [Device Guard requirements for baseline protections](#device-guard-requirements-for-baseline-protections) + - [Device Guard requirements for additional protections](#device-guard-requirements-for-additional-protections) +- [Device Guard deployment in different scenarios: types of devices](#device-guard-deployment-in-different-scenarios-types-of-devices) +- [Reviewing your applications: application signing and catalog files](#reviewing-your-applications-application-signing-and-catalog-files) +- [Code integrity policy formats and signing](#code-integrity-policy-formats-and-signing) + +The information in this article provides a foundation for [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). + +## Hardware, firmware, and software requirements for Device Guard + +To deploy Device Guard in a way that uses all of its virtualization-based security (VBS) features, the computers you are protecting must meet certain hardware, firmware, and software requirements. However, computers lacking some of the hardware and firmware requirements will still receive some protection when you deploy code integrity policies—the difference is that those computers will not be as hardened against certain threats. + +For example, hardware that includes CPU virtualization extensions and SLAT will be hardened against malware that attempts to gain access to the kernel, but without protected BIOS options such as “Boot only from internal hard drive,” the computer could be booted (by a malicious person who has physical access) into an operating system on bootable media. For an outline of how VBS-related hardware strengthens the hardening offered by Device Guard, see [Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md). + +You can deploy Device Guard in phases, and plan these phases in relation to the computer purchases you plan for your next hardware refresh. + +The following tables provide more information about the hardware, firmware, and software required for deployment of various Device Guard features. + + + +> **Note**  For new computers running Windows 10, Trusted Platform Module (TPM 2.0) must be enabled by default. This requirement is not restated in the tables that follow. + +## Device Guard requirements for baseline protections + +|Baseline Protections - requirement | Description | +|---------------------------------------------|----------------------------------------------------| +| Hardware: **64-bit CPU** | A 64-bit computer is required for the Windows hypervisor to provide VBS. | +| Hardware: **CPU virtualization extensions**,
plus **extended page tables** | **Requirements**: These hardware features are required for VBS:
One of the following virtualization extensions:
- VT-x (Intel) or
- AMD-V
And:
- Extended page tables, also called Second Level Address Translation (SLAT).

**Security benefits**: VBS provides isolation of secure kernel from normal operating system. Vulnerabilities and Day 0s in normal operating system cannot be exploited because of this isolation. | +| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)

**Security benefits**: UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. | +| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).

**Security benefits**: UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. | +| Software: **HVCI compatible drivers** | **Requirements**: See the Windows Hardware Compatibility Program requirements under [Filter.Driver.DeviceGuard.DriverCompatibility](https://msdn.microsoft.com/library/windows/hardware/mt589732(v=vs.85).aspx).

**Security benefits**: [HVCI Compatible](https://blogs.msdn.microsoft.com/windows_hardware_certification/2015/05/22/driver-compatibility-with-device-guard-in-windows-10/) drivers help ensure that VBS can maintain appropriate memory permissions. This increases resistance to bypassing vulnerable kernel drivers and helps ensure that malware cannot run in kernel. Only code verified through code integrity can run in kernel mode. | +| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT

**Security benefits**: Support for VBS and for management features that simplify configuration of Device Guard. | + + + +> **Important**  The preceding table lists requirements for baseline protections. The following table lists requirements for additional protections. You can use Device Guard with hardware, firmware, and software that support baseline protections, even if they do not support additional protections. + +## Device Guard requirements for additional protections + +The following tables describes additional hardware and firmware requirements, and the additional protections that are available when those requirements are met. We strongly recommend the following additional protections, which help you maximize the benefits that Device Guard can provide. + + to take advantage of all the security options Device Guard can provide. + +### 2015 Additional Qualification Requirements for Device Guard (Windows 10, version 1507 and Windows 10, version 1511) + +|Additional Protections - requirement | Description | +|---------------------------------------------|----------------------------------------------------| +| Firmware: **Securing Boot Configuration and Management** | **Requirements**:
- BIOS password or stronger authentication must be supported.
- In the BIOS configuration, BIOS authentication must be set.
- There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
- In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.

**Security benefits**:
- BIOS password or stronger authentication helps ensure that only authenticated Platform BIOS administrators can change BIOS settings. This helps protect against a physically present user with BIOS access.
- Boot order when locked provides protection against the computer being booted into WinRE or another operating system on bootable media. | + +## Device Guard deployment in different scenarios: types of devices + +Typically, deployment of Device Guard happens best in phases, rather than being a feature that you simply “turn on.” The choice and sequence of phases depends on the way various computers and other devices are used in your organization, and to what degree IT manages those devices. The following table can help you begin to develop a plan for deploying Device Guard in your organization. + +| **Type of device** | **How Device Guard relates to this type of device** | **Device Guard components that you can use to protect this kind of device** | +|------------------------------------|------------------------------------------------------|--------------------------------------------------------------------------------| +| **Fixed-workload devices**: Perform same tasks every day.
Lists of approved applications rarely change.
Examples: kiosks, point-of-sale systems, call center computers. | Device Guard can be deployed fully, and deployment and ongoing administration are relatively straightforward.
After Device Guard deployment, only approved applications can run. This is because of protections offered by the Hypervisor Code Integrity (HVCI) service. | - VBS (hardware-based) protections, enabled.

- Code integrity policies in enforced mode, with UMCI enabled. | +| **Fully managed devices**: Allowed software is restricted by IT department.
Users can request additional software, or install from a list of applications provided by IT department.
Examples: locked-down, company-owned desktops and laptops. | An initial baseline code integrity policy can be established and enforced. Whenever the IT department approves additional applications, it will update the code integrity policy and (for unsigned LOB applications) the catalog.
Code integrity policies are supported by the HVCI service. | - VBS (hardware-based) protections, enabled.

- Code integrity policies in enforced mode, with UMCI enabled. | +| **Lightly managed devices**: Company-owned, but users are free to install software.
Devices are required to run organization's antivirus solution and client management tools. | Device Guard can be used to help protect the kernel, and to monitor (audit) for problem applications rather than limiting the applications that can be run. | - VBS (hardware-based) protections, enabled. When enabled with a code integrity policy in audit mode only, VBS means the hypervisor helps enforce the default kernel-mode code integrity policy, which protects against unsigned drivers or system files.

- Code integrity policies, with UMCI enabled, but running in audit mode only. This means applications are not blocked—the policy just logs an event whenever an application outside the policy is started. | +| **Bring Your Own Device**: Employees are allowed to bring their own devices, and also use those devices away from work. | Device Guard does not apply. Instead, you can explore other hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. | N/A | + +## Reviewing your applications: application signing and catalog files + +Typically, code integrity policies are configured to use the application's signing certificate as part or all of what identifies the application as trusted. This means that applications must either use embedded signing—where the signature is part of the binary—or catalog signing, where you generate a “catalog file” from the applications, sign it, and through the signed catalog file, configure the code integrity policy to recognize the applications as signed. + +Catalog files can be very useful for unsigned LOB applications that cannot easily be given an embedded signature. However, catalogs need to be updated each time an application is updated. In contrast, with embedded signing, your code integrity policies typically do not have to be updated when an application is updated. For this reason, if code-signing is or can be included in your in-house application development process, it can simplify the management of your code integrity policies (compared to using catalog signing). + +To obtain signed applications or embed signatures in your in-house applications, you can choose from a variety of methods: + +- Using the Windows Store publishing process. All apps that come out of the Microsoft Store are automatically signed with special signatures that can roll-up to our certificate authority (CA) or to your own. + +- Using your own digital certificate or public key infrastructure (PKI). ISV's and enterprises can sign their own Classic Windows applications themselves, adding themselves to the trusted list of signers. + +- Using a non-Microsoft signing authority. ISV's and enterprises can use a trusted non-Microsoft signing authority to sign all of their own Classic Windows applications. + +To use catalog signing, you can choose from the following options: + +- Use the Device Guard signing portal available in the Windows Store for Business. The portal is a Microsoft web service that you can use to sign your Classic Windows applications. For more information, see [Device Guard signing](https://technet.microsoft.com/itpro/windows/manage/device-guard-signing-portal). + +- Create your own catalog files, which are described in the next section. For information about how creating catalog files fits into Device Guard deployment, see [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). + +### Catalog files + +Catalog files (which you can create in Windows 10 with a tool called Package Inspector) contain information about all deployed and executed binary files associated with your trusted but unsigned applications. When you create catalog files, you can also include signed applications for which you do not want to trust the signer but rather the specific application. After creating a catalog, you must sign the catalog file itself by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. Then you can distribute the catalog, so that your trusted applications can be handled by code integrity policies in the same way as any other signed application. + +Catalog files are simply Secure Hash Algorithm 2 (SHA2) hash lists of discovered binaries. These binaries’ hash values are updated each time an application is updated, which requires the catalog file to be updated also. + +After you have created and signed your catalog files, you can configure your code integrity policies to trust the signer or signing certificate of those files. + +> **Note**  Package Inspector only works on operating systems that support Device Guard, such as Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT. + +For information about how creating catalog files fits into Device Guard deployment, see [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md). For procedures for working with catalog files, see [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md). + +## Code integrity policy formats and signing + +When you generate a code integrity policy, you are generating a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10 Enterprise, along with restrictions on Windows 10 script hosts. You can view your original XML document in a text editor, for example if you want to check the rule options that are present in the **<Rules>** section of the file. + +We recommend that you keep the original XML file for use when you need to merge the code integrity policy with another policy or update its rule options. For deployment purposes, the file is converted to a binary format, which can be done using a simple Windows PowerShell command. + +When the code integrity policy is deployed, it restricts the software that can run on a device. The XML document can be signed, helping to add additional protection against administrative users changing or removing the policy. + +## Related topics + +- [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md) +- [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md) + + From 245f1ee8537b33b785890ed2053ddf5b7bba1b8c Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Thu, 14 Jul 2016 12:57:47 -0700 Subject: [PATCH 26/69] Added Device Guard subtopics to TOC --- windows/keep-secure/TOC.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 6d463f47d2..ae6eec1804 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -816,6 +816,15 @@ ## [Enterprise security guides](windows-10-enterprise-security-guides.md) ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) ### [Device Guard deployment guide](device-guard-deployment-guide.md) +#### [Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md) +#### [Requirements and deployment planning guidelines for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md) +#### [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md) +#### [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md) +##### [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md) +##### [Deploy code integrity policies: policy rules and file rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md) +##### [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md) +##### [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md) +#### [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md) ### [Microsoft Passport guide](microsoft-passport-guide.md) ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) ### [Windows 10 security overview](windows-10-security-guide.md) From 0359558c86cd26a19440362ac80ffd82e9beb519 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 14 Jul 2016 13:40:55 -0700 Subject: [PATCH 27/69] Fixed naming issues --- windows/keep-secure/create-edp-policy-using-intune.md | 10 +++++----- windows/keep-secure/create-edp-policy-using-sccm.md | 10 +++++----- windows/keep-secure/overview-create-edp-policy.md | 4 ++-- .../keep-secure/protect-enterprise-data-using-edp.md | 2 +- 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/keep-secure/create-edp-policy-using-intune.md b/windows/keep-secure/create-edp-policy-using-intune.md index 8d593d6ed0..2aa5020b0e 100644 --- a/windows/keep-secure/create-edp-policy-using-intune.md +++ b/windows/keep-secure/create-edp-policy-using-intune.md @@ -46,7 +46,7 @@ During the policy-creation process in Intune, you can choose the apps you want t The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed desktop app (also known as a Classic Windows app), or an AppLocker policy file. >**Important**
-EDP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, EDP-unaware apps might not respect the corporate network boundary, and EDP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

Care must be taken to get a support statement from the software provider that their app is safe with EDP before adding it to your App rules list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. +EDP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, EDP-unaware apps might not respect the corporate network boundary, and EDP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

Care must be taken to get a support statement from the software provider that their app is safe with EDP before adding it to your App Rules list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation.

>**Note**
@@ -56,7 +56,7 @@ If you want to use **File hash** or **Path** rules, instead of **Publisher** rul For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list. **To add a store app** -1. From the **App rules** area, click **Add**. +1. From the **App Rules** area, click **Add**. The **Add App Rule** box appears. @@ -138,7 +138,7 @@ If you don't know the publisher or product name, you can find them for both desk For this example, we’re going to add Internet Explorer, a desktop app, to the **App Rules** list. **To add a desktop app** -1. From the **App rules** area, click **Add**. +1. From the **App Rules** area, click **Add**. The **Add App Rule** box appears. @@ -278,7 +278,7 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* 12. After you’ve created your XML file, you need to import it by using Microsoft Intune. **To import your Applocker policy file app rule using Microsoft Intune** -1. From the **App rules** area, click **Add**. +1. From the **App Rules** area, click **Add**. The **Add App Rule** box appears. @@ -302,7 +302,7 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* If you're running into compatibility issues where your app is incompatible with EDP, but still needs to be used with enterprise data, you can exempt the app from the EDP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. **To exempt a store app, a desktop app, or an AppLocker policy file app rule** -1. From the **App rules** area, click **Add**. +1. From the **App Rules** area, click **Add**. The **Add App Rule** box appears. diff --git a/windows/keep-secure/create-edp-policy-using-sccm.md b/windows/keep-secure/create-edp-policy-using-sccm.md index d96f3efa02..3bf3f76ddd 100644 --- a/windows/keep-secure/create-edp-policy-using-sccm.md +++ b/windows/keep-secure/create-edp-policy-using-sccm.md @@ -64,14 +64,14 @@ During the policy-creation process in System Center Configuration Manager, you c The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed desktop app (also known as a Classic Windows app), or an AppLocker policy file. >**Important**
-EDP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, EDP-unaware apps might not respect the corporate network boundary, and EDP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

Care must be taken to get a support statement from the software provider that their app is safe with EDP before adding it to your **App rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. +EDP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, EDP-unaware apps might not respect the corporate network boundary, and EDP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

Care must be taken to get a support statement from the software provider that their app is safe with EDP before adding it to your **App Rules** list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. #### Add a store app rule to your policy For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list. **To add a store app** -1. From the **App rules** area, click **Add**. +1. From the **App Rules** area, click **Add**. The **Add app rule** box appears. @@ -153,7 +153,7 @@ If you don't know the publisher or product name, you can find them for both desk For this example, we’re going to add Internet Explorer, a desktop app, to the **App Rules** list. **To add a desktop app to your policy** -1. From the **App rules** area, click **Add**. +1. From the **App Rules** area, click **Add**. The **Add app rule** box appears. @@ -293,7 +293,7 @@ For this example, we’re going to add an AppLocker XML file to the **App Rules* 12. After you’ve created your XML file, you need to import it by using System Center Configuration Manager. **To import your Applocker policy file app rule using 1System Center Configuration Manager** -1. From the **App rules** area, click **Add**. +1. From the **App Rules** area, click **Add**. The **Add app rule** box appears. @@ -318,7 +318,7 @@ If you're running into compatibility issues where your app is incompatible with **To exempt a store app, a desktop app, or an AppLocker policy file app rule** -1. From the **App rules** area, click **Add**. +1. From the **App Rules** area, click **Add**. The **Add app rule** box appears. diff --git a/windows/keep-secure/overview-create-edp-policy.md b/windows/keep-secure/overview-create-edp-policy.md index caa34aa197..3b7920eae2 100644 --- a/windows/keep-secure/overview-create-edp-policy.md +++ b/windows/keep-secure/overview-create-edp-policy.md @@ -1,6 +1,6 @@ --- title: Create an enterprise data protection (EDP) policy (Windows 10) -description: Microsoft Intune and System Center Configuration Manager (version 1605 Tech Preview or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. +description: Microsoft Intune and System Center Configuration Manager Technical Preview version 1605 helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 ms.prod: w10 ms.mktglfcycl: explore @@ -17,7 +17,7 @@ author: eross-msft [Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Microsoft Intune and System Center Configuration Manager (version 1605 Tech Preview or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. +Microsoft Intune and System Center Configuration Manager Technical Preview version 1605 helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. ## In this section |Topic |Description | diff --git a/windows/keep-secure/protect-enterprise-data-using-edp.md b/windows/keep-secure/protect-enterprise-data-using-edp.md index 851776710e..6ac0d869db 100644 --- a/windows/keep-secure/protect-enterprise-data-using-edp.md +++ b/windows/keep-secure/protect-enterprise-data-using-edp.md @@ -27,7 +27,7 @@ You’ll need this software to run EDP in your enterprise: |Operating system | Management solution | |-----------------|---------------------| -|Windows 10 Insider Preview | Microsoft Intune
-OR-
System Center Configuration Manager (version 1605 Tech Preview or later)
-OR-
Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634.aspx) documentation.| +|Windows 10 Insider Preview | Microsoft Intune
-OR-
System Center Configuration Manager Technical Preview version 1605
-OR-
Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634.aspx) documentation.| ## How EDP works EDP helps address your everyday challenges in the enterprise. Including: From 38f0db375c49eb5eade844f18d98e9b7ee37e414 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 14 Jul 2016 13:46:38 -0700 Subject: [PATCH 28/69] Fixed so that it says you have to use either IPv4 or IPv6 --- windows/keep-secure/create-edp-policy-using-intune.md | 4 ++-- windows/keep-secure/create-edp-policy-using-sccm.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/create-edp-policy-using-intune.md b/windows/keep-secure/create-edp-policy-using-intune.md index 2aa5020b0e..014cd3a221 100644 --- a/windows/keep-secure/create-edp-policy-using-intune.md +++ b/windows/keep-secure/create-edp-policy-using-intune.md @@ -392,12 +392,12 @@ There are no default locations included with EDP, you must add each of your netw Specify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-EDP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter. - Enterprise IPv4 Range (Required) + Enterprise IPv4 Range (Required, if not using an IPv6 range) **Starting IPv4 Address:** 3.4.0.1
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,
10.0.0.1-10.255.255.254 Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter. - Enterprise IPv6 Range + Enterprise IPv6 Range (Required, if not using an IPv4 range) **Starting IPv6 Address:** 2a01:110::
**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter. diff --git a/windows/keep-secure/create-edp-policy-using-sccm.md b/windows/keep-secure/create-edp-policy-using-sccm.md index 3bf3f76ddd..28d4d0a737 100644 --- a/windows/keep-secure/create-edp-policy-using-sccm.md +++ b/windows/keep-secure/create-edp-policy-using-sccm.md @@ -409,12 +409,12 @@ There are no default locations included with EDP, you must add each of your netw Specify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-EDP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter. - Enterprise IPv4 Range (Required) + Enterprise IPv4 Range (Required, if not using an IPv6 range) **Starting IPv4 Address:** 3.4.0.1
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,
10.0.0.1-10.255.255.254 Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter. - Enterprise IPv6 Range + Enterprise IPv6 Range (Required, if not using an IPv4 range) **Starting IPv6 Address:** 2a01:110::
**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter. From d5a25d1e17690d4cf5fbf16c5ec448125cf3de30 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 14 Jul 2016 14:52:34 -0700 Subject: [PATCH 29/69] Updated IPv4 and IPv6 language slightly --- windows/keep-secure/create-edp-policy-using-intune.md | 4 ++-- windows/keep-secure/create-edp-policy-using-sccm.md | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/keep-secure/create-edp-policy-using-intune.md b/windows/keep-secure/create-edp-policy-using-intune.md index 014cd3a221..7ec9a9ab6d 100644 --- a/windows/keep-secure/create-edp-policy-using-intune.md +++ b/windows/keep-secure/create-edp-policy-using-intune.md @@ -392,12 +392,12 @@ There are no default locations included with EDP, you must add each of your netw Specify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-EDP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter. - Enterprise IPv4 Range (Required, if not using an IPv6 range) + Enterprise IPv4 Range (Required, if not using IPv6) **Starting IPv4 Address:** 3.4.0.1
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,
10.0.0.1-10.255.255.254 Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter. - Enterprise IPv6 Range (Required, if not using an IPv4 range) + Enterprise IPv6 Range (Required, if not using IPv4) **Starting IPv6 Address:** 2a01:110::
**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter. diff --git a/windows/keep-secure/create-edp-policy-using-sccm.md b/windows/keep-secure/create-edp-policy-using-sccm.md index 28d4d0a737..819d99a608 100644 --- a/windows/keep-secure/create-edp-policy-using-sccm.md +++ b/windows/keep-secure/create-edp-policy-using-sccm.md @@ -409,12 +409,12 @@ There are no default locations included with EDP, you must add each of your netw Specify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-EDP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter. - Enterprise IPv4 Range (Required, if not using an IPv6 range) + Enterprise IPv4 Range (Required, if not using IPv6) **Starting IPv4 Address:** 3.4.0.1
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,
10.0.0.1-10.255.255.254 Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter. - Enterprise IPv6 Range (Required, if not using an IPv4 range) + Enterprise IPv6 Range (Required, if not using IPv4) **Starting IPv6 Address:** 2a01:110::
**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter. From a1567a40b66bc1e22cb859af19b226e124e31647 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Thu, 14 Jul 2016 14:56:06 -0700 Subject: [PATCH 30/69] tech review feedback --- windows/keep-secure/credential-guard.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index acf87038bb..3974a748e2 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -29,7 +29,8 @@ Credential Guard isolates secrets that previous versions of Windows stored in th For security reasons, the isolated LSA process doesn't host any device drivers. Instead, it only hosts a small subset of operating system binaries that are needed for security and nothing else. All of these binaries are signed with a certificate that is trusted by virtualization-based security and these signatures are validated before launching the file in the protected environment. -Credential Guard also does not allow older variants of NTLM, unconstrained Kerberos delegation, and Kerberos authentication protocols and cipher suites when using default derived credentials, including NTLMv1, MS-CHAPv2, and weaker Kerberos encryption types, such as DES. +Credential Guard also does not allow unconstrained Kerberos delegation, NTLMv1, MS-CHAPv2, Digest, CredSSP, and Kerberos DES encryption. + Here's a high-level overview on how the LSA is isolated by using virtualization-based security: ![Credential Guard overview](images/credguard.png) From 841bd4085ab4e49aa8fa37614348f6d598df2184 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Thu, 14 Jul 2016 15:03:15 -0700 Subject: [PATCH 31/69] Changed SCCM name --- windows/keep-secure/create-edp-policy-using-sccm.md | 6 +++--- windows/keep-secure/overview-create-edp-policy.md | 6 +++--- windows/keep-secure/protect-enterprise-data-using-edp.md | 2 +- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/keep-secure/create-edp-policy-using-sccm.md b/windows/keep-secure/create-edp-policy-using-sccm.md index 819d99a608..aeb770bed1 100644 --- a/windows/keep-secure/create-edp-policy-using-sccm.md +++ b/windows/keep-secure/create-edp-policy-using-sccm.md @@ -15,14 +15,14 @@ author: eross-msft - Windows 10 Insider Preview - Windows 10 Mobile Preview -- System Center Configuration Manager (version 1605 Tech Preview or later) +- System Center Configuration Manager Technical Preview version 1605 or later [Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -System Center Configuration Manager (version 1605 Tech Preview or later) helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection mode, and how to find enterprise data on the network. +System Center Configuration Manager Technical Preview version 1605 or later helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection mode, and how to find enterprise data on the network. >**Important**
-If you previously created an EDP policy using System Center Configuration Manager version 1511 or 1602, you’ll need to recreate it using version 1605 Tech Preview or later. Editing an EDP policy created in version 1511 or 1602 is not supported in version 1605 Tech Preview. There is no migration path between EDP policies across these versions. +If you previously created an EDP policy using System Center Configuration Manager version 1511 or 1602, you’ll need to recreate it using Configuration Manager Technical Preview version 1605 or later. Editing an EDP policy created in version 1511 or 1602 is not supported in the Technical Preview version 1605 or later. There is no migration path between EDP policies across these versions. ## Add an EDP policy After you’ve installed and set up System Center Configuration Manager for your organization, you must create a configuration item for EDP, which in turn becomes your EDP policy. diff --git a/windows/keep-secure/overview-create-edp-policy.md b/windows/keep-secure/overview-create-edp-policy.md index 3b7920eae2..02e9e28ec7 100644 --- a/windows/keep-secure/overview-create-edp-policy.md +++ b/windows/keep-secure/overview-create-edp-policy.md @@ -1,6 +1,6 @@ --- title: Create an enterprise data protection (EDP) policy (Windows 10) -description: Microsoft Intune and System Center Configuration Manager Technical Preview version 1605 helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. +description: Microsoft Intune and System Center Configuration Manager Technical Preview version 1605 or later helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. ms.assetid: d2059e74-94bd-4e54-ab59-1a7b9b52bdc6 ms.prod: w10 ms.mktglfcycl: explore @@ -17,13 +17,13 @@ author: eross-msft [Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -Microsoft Intune and System Center Configuration Manager Technical Preview version 1605 helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. +Microsoft Intune and System Center Configuration Manager Technical Preview version 1605 or later helps you create and deploy your enterprise data protection (EDP) policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. ## In this section |Topic |Description | |------|------------| |[Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) |Intune helps you create and deploy your EDP policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. | -|[Create and deploy an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) |Configuration Manager (version 1605 Tech Preview or later) helps you create and deploy your EDP policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. | +|[Create and deploy an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) |System Center Configuration Manager Technical Preview version 1605 or later helps you create and deploy your EDP policy, including letting you choose your protected apps, your EDP-protection level, and how to find enterprise data on the network. |     diff --git a/windows/keep-secure/protect-enterprise-data-using-edp.md b/windows/keep-secure/protect-enterprise-data-using-edp.md index 6ac0d869db..9e052274d5 100644 --- a/windows/keep-secure/protect-enterprise-data-using-edp.md +++ b/windows/keep-secure/protect-enterprise-data-using-edp.md @@ -27,7 +27,7 @@ You’ll need this software to run EDP in your enterprise: |Operating system | Management solution | |-----------------|---------------------| -|Windows 10 Insider Preview | Microsoft Intune
-OR-
System Center Configuration Manager Technical Preview version 1605
-OR-
Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634.aspx) documentation.| +|Windows 10 Insider Preview | Microsoft Intune
-OR-
System Center Configuration Manager Technical Preview version 1605 or later
-OR-
Your current company-wide 3rd party mobile device management (MDM) solution. For info about 3rd party MDM solutions, see the documentation that came with your product. If your 3rd party MDM does not have UI support for the policies, refer to the [EnterpriseDataProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt697634.aspx) documentation.| ## How EDP works EDP helps address your everyday challenges in the enterprise. Including: From b5ca417354224a370d204aa7226a97e5c1b0b0c0 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 15 Jul 2016 16:10:14 +1000 Subject: [PATCH 32/69] fix location of title --- ...tal-access-windows-defender-advanced-threat-protection.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md b/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md index 9f3059a07b..eb788e5359 100644 --- a/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/assign-portal-access-windows-defender-advanced-threat-protection.md @@ -9,6 +9,9 @@ ms.sitesec: library ms.pagetype: security author: mjcaparas --- + +# Assign user access to the Windows Defender ATP portal + **Applies to:** - Windows 10 Insider Preview Build 14332 or later @@ -18,8 +21,6 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -# Assign user access to the Windows Defender ATP portal - Windows Defender ATP users and access permissions are managed in Azure Active Directory (AAD). User can be assigned one of the following levels of permissions: - Full access (Read and Write) - Read only access From 9646c34e74745769337af17892e619498aa5e770 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 15 Jul 2016 16:33:06 +1000 Subject: [PATCH 33/69] add table back --- ...nts-windows-defender-advanced-threat-protection.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index a31bfe61a7..d2cc59754d 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -115,7 +115,16 @@ These policies are categorized into two groups: > **Warning**  These two groups must not be deployed on the same machine at same time, otherwise this will cause unpredictable collisions. - ![Table of policies used in Microsoft Intune ](images/oma-uri.png) +Policy | OMA-URI | Type | Description | Value +:---|:---|:---|:---|:--- +Onboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding | String | Onboarding | Copy content from onboarding MDM file +Health Status for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | Windows Defender ATP service is running | TRUE + | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | Onboarded to Windows Defender ATP | 1 + | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OrgId | String | Onboarded to Organization ID | Use OrgID from onboarding file + Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | Windows Defender ATP Sample sharing is enabled | 0 or 1
Default value: 1 + Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | String | Offboarding | Copy content from offboarding MDM file + Health Status for offboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | Windows Defender ATP service is not running | FALSE + | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | Offboarded from Windows Defender ATP | 0 > **Note**  Policies **Health Status for onboarded machines** and **Health Status for offboarded machines** use read-only properties and can't be remediated. From e0196fb516587708a6dd349af748f576b83afd8d Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Fri, 15 Jul 2016 09:35:38 -0700 Subject: [PATCH 34/69] Tidying TOC & parent topics for Device Guard content --- windows/keep-secure/TOC.md | 23 +- ...g-a-device-guard-policy-for-signed-apps.md | 109 +------- ...iles-to-support-code-integrity-policies.md | 2 +- ...ty-policies-policy-rules-and-file-rules.md | 2 +- .../deploy-code-integrity-policies-steps.md | 2 +- ...ce-guard-deploy-code-integrity-policies.md | 2 +- ...rd-enable-virtualization-based-security.md | 2 +- ...vice-guard-certification-and-compliance.md | 105 +------- .../device-guard-deployment-guide.md | 2 +- ...o-run-on-device-guard-protected-devices.md | 254 +----------------- windows/keep-secure/index.md | 4 +- ...certificate-for-code-integrity-policies.md | 2 +- ...-on-the-device-guard-deployment-process.md | 2 +- ...nt-planning-guidelines-for-device-guard.md | 2 +- .../windows-10-enterprise-security-guides.md | 8 +- windows/whats-new/device-guard-overview.md | 94 +------ 16 files changed, 34 insertions(+), 581 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index ae6eec1804..215f9a8b8f 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -1,9 +1,6 @@ # [Keep Windows 10 secure](index.md) ## [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) ## [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) -## [Device Guard certification and compliance](device-guard-certification-and-compliance.md) -### [Get apps to run on Device Guard-protected devices](getting-apps-to-run-on-device-guard-protected-devices.md) -### [Create a Device Guard code integrity policy based on a reference device](creating-a-device-guard-policy-for-signed-apps.md) ## [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) ### [Implement Microsoft Passport in your organization](implement-microsoft-passport-in-your-organization.md) ### [Why a PIN is better than a password](why-a-pin-is-better-than-a-password.md) @@ -14,6 +11,16 @@ ## [Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) ## [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) ## [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) +## [Device Guard deployment guide](device-guard-deployment-guide.md) +### [Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md) +### [Requirements and deployment planning guidelines for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md) +### [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md) +### [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md) +#### [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md) +#### [Deploy code integrity policies: policy rules and file rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md) +#### [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md) +#### [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md) +### [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md) ## [Protect derived domain credentials with Credential Guard](credential-guard.md) ## [Protect your enterprise data using enterprise data protection (EDP)](protect-enterprise-data-using-edp.md) ### [Create an enterprise data protection (EDP) policy](overview-create-edp-policy.md) @@ -815,16 +822,6 @@ ###### [Verify That Network Traffic Is Authenticated](verify-that-network-traffic-is-authenticated.md) ## [Enterprise security guides](windows-10-enterprise-security-guides.md) ### [Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md) -### [Device Guard deployment guide](device-guard-deployment-guide.md) -#### [Introduction to Device Guard: virtualization-based security and code integrity policies](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md) -#### [Requirements and deployment planning guidelines for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md) -#### [Planning and getting started on the Device Guard deployment process](planning-and-getting-started-on-the-device-guard-deployment-process.md) -#### [Deploy Device Guard: deploy code integrity policies](deploy-device-guard-deploy-code-integrity-policies.md) -##### [Optional: Create a code signing certificate for code integrity policies](optional-create-a-code-signing-certificate-for-code-integrity-policies.md) -##### [Deploy code integrity policies: policy rules and file rules](deploy-code-integrity-policies-policy-rules-and-file-rules.md) -##### [Deploy code integrity policies: steps](deploy-code-integrity-policies-steps.md) -##### [Deploy catalog files to support code integrity policies](deploy-catalog-files-to-support-code-integrity-policies.md) -#### [Deploy Device Guard: enable virtualization-based security](deploy-device-guard-enable-virtualization-based-security.md) ### [Microsoft Passport guide](microsoft-passport-guide.md) ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) ### [Windows 10 security overview](windows-10-security-guide.md) diff --git a/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md b/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md index a1b2db57b3..fdf497e545 100644 --- a/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md +++ b/windows/keep-secure/creating-a-device-guard-policy-for-signed-apps.md @@ -1,112 +1,5 @@ --- title: Create a Device Guard code integrity policy based on a reference device (Windows 10) -description: To implement Device Guard app protection, you will need to create a code integrity policy. Code integrity policies determine what apps are considered trustworthy and are allowed to run on a protected device. -ms.assetid: 6C94B14E-E2CE-4F6C-8939-4B375406E825 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -author: brianlic-msft +redirect_url: device-guard-deployment-guide.md --- -# Create a Device Guard code integrity policy based on a reference device -**Applies to** -- Windows 10 - -To implement Device Guard app protection, you will need to create a code integrity policy. Code integrity policies determine what apps are considered trustworthy and are allowed to run on a protected device. - -## Create a Device Guard code integrity policy based on a reference device - -To create a code integrity policy, you'll first need to create a reference image that includes the signed applications you want to run on your protected devices. For information on how to sign applications, see [Getting apps to run on Device Guard-protected devices](getting-apps-to-run-on-device-guard-protected-devices.md). -> **Note:**  Before creating a code integrity policy, make sure your reference device is clean of viruses and malware. -  -**To create a code integrity policy based on a reference device** - -1. On your reference device, start PowerShell as an administrator. -2. In PowerShell, initialize variables by typing: - ``` syntax - $CIPolicyPath=$env:userprofile+"\Desktop\" - $InitialCIPolicy=$CIPolicyPath+"InitialScan.xml" - $CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin" - ``` -3. Scan your device for installed applications and create a new code integrity policy by typing: - ``` syntax - New-CIPolicy -Level -FilePath $InitialCIPolicy -UserPEs -Fallback Hash 3> Warningslog.txt - ``` - Where *<RuleLevel>* can be set to any of the following options: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Rule levelDescription

Hash

Specifies individual hash values for each discovered app. Each time an app is updated the hash value will change and you will need to update your policy.

FileName

Currently unsupported.

SignedVersion

Currently unsupported.

Publisher

This level is a combination of the PCA certificate and the common name (CN) on the leaf certificate. When a PCA certificate is used to sign apps from multiple companies (such as VeriSign), this rule level allows you to trust the PCA certificate but only for the company whose name is on the leaf certificate.

FilePublisher

Currently unsupported.

LeafCertificate

Adds trusted signers at the individual signing certificate level. When an app is updated, the hash value is modified but the signing certificate stays the same. You will only need to update your policy if the signing certificate for an app changes.

-
- Note  Leaf certificates have much shorter validity periods than PCA certificates. You will need to update your policy if a certificate expires. -
-
-   -

PcaCertificate

Adds the highest certificate in the provided certificate chain to signers. This is typically one certificate below the root certificate, as the scan does not validate anything above the presented signature by going online or checking local root stores.

RootCertificate

Currently unsupported.

WHQL

Currently unsupported.

WHQLPublisher

Currently unsupported.

WHQLFilePublisher

Currently unsupported.

-   -4. Type the following to convert the code integrity policy to a binary format: - ``` syntax - ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin - ``` -Once you have completed these steps, the Device Guard policy binary file (DeviceGuardPolicy.bin) and original xml file (InitialScan.xml) will be available on your desktop. ->**Note:**  We recommend that you keep a copy of InitialScan.xml to use if you need to merge this code integrity policy with another policy, or update policy rule options. -  -## Related topics -[Getting apps to run on Device Guard-protected devices](getting-apps-to-run-on-device-guard-protected-devices.md) -  -  diff --git a/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md b/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md index 626a9a939b..a20497761c 100644 --- a/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md +++ b/windows/keep-secure/deploy-catalog-files-to-support-code-integrity-policies.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy author: brianlic-msft --- -# Deploy catalog files to support code integrity policies (Windows 10) +# Deploy catalog files to support code integrity policies **Applies to** - Windows 10 diff --git a/windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md b/windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md index 6710758326..f9cae0de10 100644 --- a/windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md +++ b/windows/keep-secure/deploy-code-integrity-policies-policy-rules-and-file-rules.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy author: brianlic-msft --- -# Deploy code integrity policies: policy rules and file rules (Windows 10) +# Deploy code integrity policies: policy rules and file rules **Applies to** - Windows 10 diff --git a/windows/keep-secure/deploy-code-integrity-policies-steps.md b/windows/keep-secure/deploy-code-integrity-policies-steps.md index e754b2139e..d9fa657c72 100644 --- a/windows/keep-secure/deploy-code-integrity-policies-steps.md +++ b/windows/keep-secure/deploy-code-integrity-policies-steps.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy author: brianlic-msft --- -# Deploy code integrity policies: steps (Windows 10) +# Deploy code integrity policies: steps **Applies to** - Windows 10 diff --git a/windows/keep-secure/deploy-device-guard-deploy-code-integrity-policies.md b/windows/keep-secure/deploy-device-guard-deploy-code-integrity-policies.md index 6a0dfeabe2..02ce631862 100644 --- a/windows/keep-secure/deploy-device-guard-deploy-code-integrity-policies.md +++ b/windows/keep-secure/deploy-device-guard-deploy-code-integrity-policies.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy author: brianlic-msft --- -# Deploy Device Guard: deploy code integrity policies (Windows 10) +# Deploy Device Guard: deploy code integrity policies **Applies to** - Windows 10 diff --git a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md index 85ae77b74a..9eda4d82c8 100644 --- a/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/keep-secure/deploy-device-guard-enable-virtualization-based-security.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy author: brianlic-msft --- -# Deploy Device Guard: enable virtualization-based security (Windows 10) +# Deploy Device Guard: enable virtualization-based security **Applies to** - Windows 10 diff --git a/windows/keep-secure/device-guard-certification-and-compliance.md b/windows/keep-secure/device-guard-certification-and-compliance.md index 6ac463047e..5e60c5e980 100644 --- a/windows/keep-secure/device-guard-certification-and-compliance.md +++ b/windows/keep-secure/device-guard-certification-and-compliance.md @@ -1,107 +1,4 @@ --- title: Device Guard certification and compliance (Windows 10) -description: Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. -ms.assetid: 94167ECA-AB08-431D-95E5-7A363F42C7E3 -ms.pagetype: security -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -author: brianlic-msft +redirect_url: device-guard-deployment-guide.md --- -# Device Guard certification and compliance -**Applies to** -- Windows 10 - -Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. -Device Guard uses the new virtualization-based security in Windows 10 to isolate the Code Integrity service from the Windows kernel itself, letting the service use signatures defined by your enterprise-controlled policy to help determine what is trustworthy. In effect, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. -For details on how to implement Device Guard, see [Device Guard deployment guide](device-guard-deployment-guide.md). -## Why use Device Guard -With thousands of new malicious files created every day, using traditional methods like signature-based detection to fight against malware provides an inadequate defense against new attacks. Device Guard on Windows 10 changes from a mode where apps are trusted unless blocked by an antivirus or other security solutions, to a mode where the operating system trusts only apps authorized by your enterprise. -Device Guard also helps protect against [zero day attacks](http://go.microsoft.com/fwlink/p/?linkid=534209) and works to combat the challenges of [polymorphic viruses](http://go.microsoft.com/fwlink/p/?LinkId=534210). - -### Advantages to using Device Guard - -You can take advantage of the benefits of Device Guard, based on what you turn on and use: -- Helps provide strong malware protection with enterprise manageability -- Helps provide the most advanced malware protection ever offered on the Windows platform -- Offers improved tamper resistance - -## How Device Guard works - -Device Guard restricts the Windows 10 operating system to only running code that’s signed by trusted signers, as defined by your Code Integrity policy through specific hardware and security configurations, including: -- User Mode Code Integrity (UMCI) -- New kernel code integrity rules (including the new Windows Hardware Quality Labs (WHQL) signing constraints) -- Secure Boot with database (db/dbx) restrictions -- Virtualization-based security to help protect system memory and kernel mode apps and drivers from possible tampering. -- Optional: Trusted Platform Module (TPM) 1.2 or 2.0 -Device Guard works with your image-building process, so you can turn the virtualization-based security feature on for capable devices, configure your Code Integrity policy, and set any other operating system settings you require for Windows 10. After that, Device Guard works to help protect your devices: -1. Your device starts up using Universal Extensible Firmware Interface (UEFI) Secure Boot, so that boot kits can’t run and so that Windows 10 starts before anything else. -2. After securely starting up the Windows boot components, Windows 10 can start the Hyper-V virtualization-based security services, including Kernel Mode Code Integrity. These services help protect the system core (kernel), privileged drivers, and system defenses, like anti-malware solutions, by preventing malware from running early in the boot process, or in kernel after startup. -3. Device Guard uses UMCI to make sure that anything that runs in User mode, such as a service, a Universal Windows Platform (UWP) app, or a Classic Windows application is trusted, allowing only trusted binaries to run. -4. At the same time that Windows 10 starts up, so too does the trusted platform module (TPM). TPM provides an isolated hardware component that helps protect sensitive information, such as user credentials and certificates. -## Required hardware and software -The following table shows the hardware and software you need to install and configure to implement Device Guard. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
RequirementDescription

Windows 10 Enterprise

The PC must be running Windows 10 Enterprise.

UEFI firmware version 2.3.1 or higher with UEFI Secure Boot and Platform Secure Boot

UEFI Secure Boot ensures that the device boots only authorized code. Additionally, Boot Integrity, also known as Platform Secure Boot must be supported. You can validate it against the following Windows Hardware Compatibility Program requirements:

-
    -

  • [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)

    • -

  • [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](http://msdn.microsoft.com/library/windows/hardware/dn932807.aspx#system-fundamentals-firmware-cs-uefisecureboot-connectedstandby)

    • -

Virtualization extensions

The following virtualization extensions are required to support virtualization-based security:

-
    -
  • Intel VT-x or AMD-V
    • -
  • Second Level Address Translation
    • -

Firmware lock

    -

  • The firmware setup should be locked to prevent other operating systems from starting and to prevent changes to the UEFI settings.

    • -

  • Work with your hardware manufacturer to ensure that the devices are Device Guard ready

    • -

  • You should require a firmware password or higher authentication to change firmware settings.

    • -

x64 architecture

The features that virtualization-based security uses in the Windows hypervisor can only run on a 64-bit PC.

A VT-d or AMD-Vi IOMMU (Input/output memory management unit)

In Windows 10, an IOMMU enhances system resiliency against memory attacks.

Secure firmware update process

To verify that the firmware complies with the secure firmware update process, you can validate it against the [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot) Windows Hardware Compatibility Program requirement.

Device Guard relies on the security of the underlying hardware and firmware. It is critical to keep the firmware updated with the latest security fixes.

Signed processor microcode updates

If the processor supports it, you must require signed microcode updates.

-  -## Related topics -[Get apps to run on Device Guard-protected devices](getting-apps-to-run-on-device-guard-protected-devices.md) -[Create a Device Guard code integrity policy based on a reference device](creating-a-device-guard-policy-for-signed-apps.md) -  -  diff --git a/windows/keep-secure/device-guard-deployment-guide.md b/windows/keep-secure/device-guard-deployment-guide.md index 85dec6ce25..e82f511105 100644 --- a/windows/keep-secure/device-guard-deployment-guide.md +++ b/windows/keep-secure/device-guard-deployment-guide.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy author: brianlic-msft --- -# Device Guard deployment guide (Windows 10) +# Device Guard deployment guide **Applies to** - Windows 10 diff --git a/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md b/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md index 42e7d1cff1..542e85c56f 100644 --- a/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md +++ b/windows/keep-secure/getting-apps-to-run-on-device-guard-protected-devices.md @@ -1,256 +1,4 @@ --- title: Get apps to run on Device Guard-protected devices (Windows 10) -description: Windows 10 introduces several new features and settings that when combined all equal what we're calling, Device Guard. -ms.assetid: E62B68C3-8B9F-4842-90FC-B4EE9FF8A67E -keywords: Package Inspector, packageinspector.exe, sign catalog file -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -author: brianlic-msft +redirect_url: device-guard-deployment-guide.md --- - -# Get apps to run on Device Guard-protected devices - -**Applies to** -- Windows 10 - -Windows 10 introduces several new features and settings that when combined all equal what we're calling, Device Guard. Device Guard can help to protect your enterprise devices against the accidental running of malicious apps by requiring all of your apps to be signed by a trusted entity. - -To use Device Guard in an enterprise, you must be able to get your existing line-of-business and Independent Software Vendor (ISV)-developed apps to run on a protected device. Unfortunately, many line-of-business apps aren't signed, and in many cases, aren't even being actively developed. Similarly, you may have unsigned software from an ISV that you want to run, or you want to run certain applications from an ISV while not trusting all applications from that ISV. As part of the Device Guard features, Windows 10 includes a new tool called Package Inspector. Package Inspector scans your unsigned apps, and creates catalog files of the installed and running binaries, which can then be signed by the Sign Tool Windows SDK utility and distributed using Group Policy so that your apps will run on Device Guard-protected devices. - -## What you need to run your apps on Device-Guard protected devices - -Before you can get your apps to run on Device Guard-protected devices, you must have: - -- A device running Windows 10 Enterprise, Windows 10 Education, or Windows Server 2016 Technical Preview. -- Determined which unsigned apps you need to include in your catalog file. -- Created a code integrity policy for use by Device Guard. -- A [code signing certificate](http://go.microsoft.com/fwlink/p/?LinkId=619282), created using an internal public key infrastructure (PKI). -- [SignTool]( http://go.microsoft.com/fwlink/p/?LinkId=619283). A command-line tool that digitally signs files, verifies signatures in files, or time stamps files. The tool is installed in the \\Bin folder of the Microsoft Windows Software Development Kit (SDK) installation path. - -## Create a catalog file for unsigned apps - -You must run Package Inspector on a device that's running a temporary Code Integrity Policy in audit mode, created explicitly for this purpose. Audit mode lets this policy catch any binaries missed by the inspection tool, but because it's audit mode, allows everything to continue running. -> **Important:**  This temporary policy, shouldn't be used for normal business purposes. -  -**To create a catalog file for an existing app** -1. Start PowerShell as an administrator, and create your temporary policy file by typing: - ``` syntax - mkdir temp - New-CIPolicy -l FileName -f .\tempdeny.xml -s .\temp -u - ConvertFrom-CIPolicy .\tempdeny.xml .\tempdeny.bin - cp .\tempdeny.bin C:\Windows\System32\CodeIntegrity\SIPolicy.p7b - ``` -2. Restart your device. -3. Start PowerShell as an administrator, and start scanning your file system by typing: - ``` syntax - PackageInspector.exe start c: - ``` - Where: - - - - - - - - - - - - - - - - - - - - - -
OptionDescription

start <drive_letter>:

Specifies to start a scan. For example, starting to scan the C: drive.

-path

File path to the package being inspected.

-   -4. Copy the app installation media to your C:\\ drive, and then install and run the program. - - Copying the media to your local drive helps to make sure that the installer and its related files are included in your catalog file. If you miss the install files, your Code Integrity Policy might trust the app to run, but not to install. After you've installed the app, you should check for updates. If updates happen while the app is open, you should close and restart the app to make sure everything is caught during the inspection process. - - > **Note:**  Because the Package Inspector creates a log entry in the catalog for every binary laid down on the file system, we recommend that you don't run any other installations or updates during the scanning process. -   -5. **Optional:** If you want to create a multi-app catalog (many apps included in a single catalog file), you can continue to run Steps 2-3 for each additional app. After you've added all of the apps you want to add, you can continue to Step 5. - > **Note: **  To streamline your process, we suggest: - - **Actively supported and updated apps.** Create a single catalog file for each app. - - **Legacy apps, non-active or not updated.** Create a single catalog file for all of your legacy apps. -   -6. Stop the scanning process and create the .\\InspectedPackage.cat and InspectedPackage.cdf files for your single app in your specified location, by typing: - ``` syntax - PackageInspector.exe stop c: - ``` -You can also use the `scan` command in place of using both `start` and `stop` if you want to create a catalog of files that are already present on your hard drive. The `scan` command recursively scans a specified directory and includes all signable files in the catalog. You can scan a specified directory by typing: -``` syntax -PackageInspector.exe scan c:\ -``` -The following table shows the available options for both the `scan` and `stop` commands. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
OptionDescription

stop <drive_letter>:

Specifies that a scan of the specified location is complete, creating either a catalog or a definition file. For example, C:

scan <path to scan>

Specifies a directory path to scan. This command recursively scans a specified directory and includes all signable files in the catalog.

-out

Specifies what type of info should be created by the tool. You can use either CAT for a catalog file, CDF for a catalog definition file or list for a delimited list of files.

-listpath

Specifies the location where the installer will output the list of files for -out list.

-cdfPath <file_name>

Specifies where the tool should put the created .cdf file. If you use this option, you must also specify the file name.

-

We recommend that you use the full path to the file. However, relative paths are supported.

-resdir

This option isn't currently supported.

-name

This option isn't currently supported.

-ph [true|false]

Specifies whether to include page hashes in the catalog. You can use either True to add the hashes or False to not add the hashes.

-en

Specifies the catalog's encoding type. By default, it's PKCS_7_ASN_ENCODING | X509_ASN_ENCODING, 0x00010001.

-ca1

Specifies the CATATTR1 in the catalog and catalog definition files.

-ca2

Specifies the CATATTR2 in the catalog and catalog definition files.

-  -You can add additional parameters to your catalog beyond what's listed here. For more info, see the [MakeCat](http://go.microsoft.com/fwlink/p/?LinkId=618024) topic. - -## Sign your catalog file using Sign Tool - -You can sign your catalog file using Sign Tool, located in the Windows 7 or later Windows Software Development Kit (SDK) or by using the Device Guard signing portal. For details on using the Device Guard signing portal, see [Device Guard signing](http://go.microsoft.com/fwlink/p/?LinkID=698760). -This process shows how to use a password-protected Personal Information Exchange (.pfx) file to sign the catalog file. - -> **Important:**  To use this tool, you must have an internal certificate authority code signing certificate, or a code signing certificate issued by an external third-party certificate authority. -  -**To use Sign Tool** - -1. Check that your code signing certificates have been imported into your certificate store or that they're on the file system. -2. Open SignTool.exe and sign the catalog file, based on where your certificate is stored. - If you are using the PFX from a file system location: - ``` syntax - signtool sign /f <\\SignCertLocation> /p <\\password> /fd sha256 /v - ``` - If you have imported the certificate into your cert store: - ``` syntax - signtool sign /n <\\CertSubjectName> /fd sha256 /v - ``` - Where: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
OptionDescription

signtool

Specifies the full path location to SignTool.exe.

sign

Digitally signs files. For a list of the options supported by the sign command, see the [SignTool options](http://go.microsoft.com/fwlink/p/?LinkId=619283).

/n SubjectName

Specifies the name of the subject of the signing certificate. This value can be a substring of the entire subject name.

/f SignCertFileLocation

Specifies the signing certificate in a file.

-

If the file is in .pfx format and protected by a password, use the /p option to specify the password. If the file does not contain private keys, use the /csp and /k options to specify the .csp and private key container name.

/p Password

Specifies the password to use when opening a PFX file. (Use the /f option to specify a PFX file.)

/fd Algorithm

Specifies the file digest algorithm to use for creating file signatures. The default is SHA2.

/v

Displays verbose output regardless of whether the command runs successfully or fails, and displays warning messages.

-   - For more detailed info and examples using the available options, see the [SignTool.exe (Sign Tool)](http://go.microsoft.com/fwlink/p/?LinkId=618026) topic. - -3. In File Explorer, right-click your catalog file, click **Properties**, and then click the **Digital Signatures** tab to make sure your catalog file's digital signature is accurate. -4. Copy your catalog file to C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE} and test the file. - - >**Note:**  For testing purposes, you can manually copy your file to this location. However, we recommend that you use Group Policy to copy the catalog file to all of your devices for large-scale implementations. - -## Troubleshooting the Package Inspector - -If you see "Error 1181" while stopping the Package Inspector, you'll need to increase your USN journal size and then clear all of the cached data before re-scanning the impacted apps. - -You must make sure that you clear the cache by creating and setting a new temporary policy. If you reuse the same policy, the Package Inspector will fail. - -**To increase your journal size** -1. Open a command-prompt window, and then type: - ``` syntax - fsutil usn createjournal m=0x8000000 a=0x800000 C: - ``` - Where the "m" value needs to be increased. We recommend that you change the value to at least 4 times the default value of m=0x2000000. -2. Re-run the failed app installation(s). - -**To clear your cached data and re-scan your apps** - -1. Delete the SIPolicy.p7b file from the C:\\Windows\\System32\\CodeIntegrity\\ folder. -2. Create a new temporary Code Integrity Policy to clear all of the cached data by starting Windows Powershell as an administrator and typing: - ``` syntax - mkdir temp - cp C:\Windows\System32\PackageInspector.exe .\temp\ - New-CIPolicy -l Hash -f .\DenyPackageInspector.xml -s .\temp -u -deny - ConvertFrom-CIPolicy .\DenyPackageInspector.xml .\DenyPackageInspector.bin - cp .\DenyPackageInspector.bin C:\Windows\System32\SIPolicy.p7b - ``` -3. Restart your device and follow the steps in the [Create a catalog file for unsigned apps](#create-a-catalog-file-for-unsigned-apps) section. - -## Related topics - -[Download SignTool]( http://go.microsoft.com/fwlink/p/?LinkId=619283) diff --git a/windows/keep-secure/index.md b/windows/keep-secure/index.md index c400267003..08feae0e2e 100644 --- a/windows/keep-secure/index.md +++ b/windows/keep-secure/index.md @@ -18,18 +18,18 @@ Learn about keeping Windows 10 and Windows 10 Mobile secure. | - | - | | [Change history for Keep Windows 10 secure](change-history-for-keep-windows-10-secure.md) | This topic lists new and updated topics in the Keep Windows 10 secure documentation for [Windows 10 and Windows 10 Mobile](../index.md). | | [Block untrusted fonts in an enterprise](block-untrusted-fonts-in-enterprise.md) | To help protect your company from attacks which may originate from untrusted or attacker controlled font files, we’ve created the Blocking Untrusted Fonts feature. Using this feature, you can turn on a global setting that stops your employees from loading untrusted fonts processed using the Graphics Device Interface (GDI) onto your network. Untrusted fonts are any font installed outside of the %windir%/Fonts directory. Blocking untrusted fonts helps prevent both remote (web-based or email-based) and local EOP attacks that can happen during the font file-parsing process. | -| [Device Guard certification and compliance](device-guard-certification-and-compliance.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. | | [Manage identity verification using Microsoft Passport](manage-identity-verification-using-microsoft-passport.md) | In Windows 10, Microsoft Passport replaces passwords with strong two-factor authentication on PCs and mobile devices. This authentication consists of a new type of user credential that is tied to a device and a Windows Hello (biometric) or PIN. | | [Windows Hello biometrics in the enterprise](windows-hello-in-enterprise.md) | Windows Hello is the biometric authentication feature that helps strengthen authentication and helps to guard against potential spoofing through fingerprint matching and facial recognition. | | [Configure S/MIME for Windows 10 and Windows 10 Mobile](configure-s-mime.md) | In Windows 10, S/MIME lets users encrypt outgoing messages and attachments so that only intended recipients who have a digital identification (ID), also known as a certificate, can read them. Users can digitally sign a message, which provides the recipients with a way to verify the identity of the sender and that the message hasn't been tampered with. | | [Install digital certificates on Windows 10 Mobile](installing-digital-certificates-on-windows-10-mobile.md) | Digital certificates bind the identity of a user or computer to a pair of keys that can be used to encrypt and sign digital information. Certificates are issued by a certification authority (CA) that vouches for the identity of the certificate holder, and they enable secure client communications with websites and services. | +| [Device Guard deployment guide](device-guard-deployment-guide.md) | Device Guard is a combination of hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. | | [Protect derived domain credentials with Credential Guard](credential-guard.md) | Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. | | [Protect your enterprise data using enterprise data protection (EDP)](protect-enterprise-data-using-edp.md) | With the increase of employee-owned devices in the enterprise, there’s also an increasing risk of accidental data leak through apps and services, like email, social media, and the public cloud, which are outside of the enterprise’s control. For example, when an employee sends the latest engineering pictures from their personal email account, copies and pastes product info into a tweet, or saves an in-progress sales report to their public cloud storage. | | [Use Windows Event Forwarding to help with intrusion detection](use-windows-event-forwarding-to-assist-in-instrusion-detection.md) | Learn about an approach to collect events from devices in your organization. This article talks about events in both normal operations and when an intrusion is suspected. | | [VPN profile options](vpn-profile-options.md) | Virtual private networks (VPN) let you give your users secure remote access to your company network. Windows 10 adds useful new VPN profile options to help you manage how users connect. | | [Windows security baselines](windows-security-baselines.md) | Learn why you should use security baselines in your organization. | | [Security technologies](security-technologies.md) | Learn more about the different security technologies that are available in Windows 10 and Windows 10 Mobile. | -| [Enterprise security guides](windows-10-enterprise-security-guides.md) | Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. | +| [Enterprise security guides](windows-10-enterprise-security-guides.md) | Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. |   ## Related topics diff --git a/windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md b/windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md index 55f3a36e0e..f915647f15 100644 --- a/windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md +++ b/windows/keep-secure/optional-create-a-code-signing-certificate-for-code-integrity-policies.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy author: brianlic-msft --- -# Optional: Create a code signing certificate for code integrity policies (Windows 10) +# Optional: Create a code signing certificate for code integrity policies **Applies to** - Windows 10 diff --git a/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md b/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md index 9b96e7267b..2715141f20 100644 --- a/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md +++ b/windows/keep-secure/planning-and-getting-started-on-the-device-guard-deployment-process.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy author: brianlic-msft --- -# Planning and getting started on the Device Guard deployment process (Windows 10) +# Planning and getting started on the Device Guard deployment process **Applies to** - Windows 10 diff --git a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md index 0cfc7f0b0e..2c6b76c490 100644 --- a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md +++ b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy author: brianlic-msft --- -# Requirements and deployment planning guidelines for Device Guard (Windows 10) +# Requirements and deployment planning guidelines for Device Guard **Applies to** - Windows 10 diff --git a/windows/keep-secure/windows-10-enterprise-security-guides.md b/windows/keep-secure/windows-10-enterprise-security-guides.md index 30f130d499..a5c487491c 100644 --- a/windows/keep-secure/windows-10-enterprise-security-guides.md +++ b/windows/keep-secure/windows-10-enterprise-security-guides.md @@ -1,6 +1,6 @@ --- title: Enterprise security guides (Windows 10) -description: Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. +description: Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. ms.assetid: 57134f84-bd4b-4b1d-b663-4a2d36f5a7f8 ms.prod: w10 ms.mktglfcycl: deploy @@ -14,7 +14,7 @@ author: challum ## Purpose -Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Device Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. +Get proven guidance to help you better secure and protect your enterprise by using technologies such as Credential Guard, Microsoft Passport, and Windows Hello. This section offers technology overviews and step-by-step guides. ## In this section @@ -34,10 +34,6 @@ Get proven guidance to help you better secure and protect your enterprise by usi

[Control the health of Windows 10-based devices](protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md)

This article details an end-to-end solution that helps you protect high-value assets by enforcing, controlling, and reporting the health of Windows 10-based devices.

- -

[Device Guard deployment guide](device-guard-deployment-guide.md)

-

Microsoft Device Guard is a feature set that consists of both hardware and software system integrity hardening features that revolutionize the Windows operating system’s security. Windows 10 employs Device Guard as well as code integrity and advanced hardware features such as CPU virtualization extensions, Trusted Platform Module, and second-level address translation to offer comprehensive modern security to its users. This guide explores the individual features in Device Guard as well as how to plan for, configure, and deploy them.

-

[Microsoft Passport guide](microsoft-passport-guide.md)

This guide describes the new Windows Hello and Microsoft Passport technologies that are part of the Windows 10 operating system. It highlights specific capabilities of these technologies that help mitigate threats from conventional credentials and provides guidance about how to design and deploy these technologies as part of your Windows 10 rollout.

diff --git a/windows/whats-new/device-guard-overview.md b/windows/whats-new/device-guard-overview.md index c96f390c98..28e92f028b 100644 --- a/windows/whats-new/device-guard-overview.md +++ b/windows/whats-new/device-guard-overview.md @@ -18,94 +18,16 @@ author: brianlic-msft - Windows Server 2016 Device Guard is a combination of enterprise-related hardware and software security features that, when configured together, will lock a device down so that it can only run trusted applications. If the app isn’t trusted it can’t run, period. It also means that even if an attacker manages to get control of the Windows kernel, he or she will be much less likely to be able to run malicious executable code after the computer restarts because of how decisions are made about what can run and when. + Device Guard uses the new virtualization-based security in Windows 10 Enterprise to isolate the Code Integrity service from the Microsoft Windows kernel itself, letting the service use signatures defined by your enterprise-controlled policy to help determine what is trustworthy. In effect, the Code Integrity service runs alongside the kernel in a Windows hypervisor-protected container. + For details on how to implement Device Guard, see [Device Guard deployment guide](../keep-secure/device-guard-deployment-guide.md). + ## Why use Device Guard With thousands of new malicious files created every day, using traditional methods like signature-based detection to fight against malware provides an inadequate defense against new attacks. Device Guard on Windows 10 Enterprise changes from a mode where apps are trusted unless blocked by an antivirus or other security solutions, to a mode where the operating system trusts only apps authorized by your enterprise. Device Guard also helps protect against [zero day attacks](http://go.microsoft.com/fwlink/p/?linkid=534209) and works to combat the challenges of [polymorphic viruses](http://go.microsoft.com/fwlink/p/?LinkId=534210). -### Advantages to using Device Guard -You can take advantage of the benefits of Device Guard, based on what you turn on and use: -- Helps provide strong malware protection with enterprise manageability -- Helps provide the most advanced malware protection ever offered on the Windows platform -- Offers improved tamper resistance -## How Device Guard works -Device Guard restricts the Windows 10 Enterprise operating system to only running code that’s signed by trusted signers, as defined by your Code Integrity policy through specific hardware and security configurations, including: -- User Mode Code Integrity (UMCI) -- New kernel code integrity rules (including the new Windows Hardware Quality Labs (WHQL) signing constraints) -- Secure Boot with database (db/dbx) restrictions -- Virtualization-based security to help protect system memory and kernel mode apps and drivers from possible tampering. -- **Optional:** Trusted Platform Module (TPM) 1.2 or 2.0 -Device Guard works with your image-building process, so you can turn the virtualization-based security feature on for capable devices, configure your Code Integrity policy, and set any other operating system settings you require for Windows 10 Enterprise. After that, Device Guard works to help protect your devices: -1. Your device starts up using Universal Extensible Firmware Interface (UEFI) Secure Boot, so that boot kits can’t run and so that Windows 10 Enterprise starts before anything else. -2. After securely starting up the Windows boot components, Windows 10 Enterprise can start the Hyper-V virtualization-based security services, including Kernel Mode Code Integrity. These services help protect the system core (kernel), privileged drivers, and system defenses, like anti-malware solutions, by preventing malware from running early in the boot process, or in kernel after startup. -3. Device Guard uses UMCI to make sure that anything that runs in User mode, such as a service, a Universal Windows Platform (UWP) app, or a Classic Windows application is trusted, allowing only trusted binaries to run. -4. At the same time that Windows 10 Enterprise starts up, so too does the trusted platform module (TPM). TPM provides an isolated hardware component that helps protect sensitive information, such as user credentials and certificates. -## Required hardware and software -The following table shows the hardware and software you need to install and configure to implement Device Guard. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
RequirementDescription

Windows 10 Enterprise

The PC must be running Windows 10 Enterprise.

UEFI firmware version 2.3.1 or higher and Secure Boot

To verify that the firmware is using UEFI version 2.3.1 or higher and Secure Boot, you can validate it against the [System.Fundamentals.Firmware.CS.UEFISecureBoot.ConnectedStandby](http://msdn.microsoft.com/library/windows/hardware/dn932807.aspx#system-fundamentals-firmware-cs-uefisecureboot-connectedstandby) Windows Hardware Compatibility Program requirement.

Virtualization extensions

The following virtualization extensions are required to support virtualization-based security:

-
    -
  • Intel VT-x or AMD-V
    • -
  • Second Level Address Translation
    • -

Firmware lock

The firmware setup should be locked to prevent other operating systems from starting and to prevent changes to the UEFI settings. You should also disable boot methods other than from the hard drive.

x64 architecture

The features that virtualization-based security uses in the Windows hypervisor can only run on a 64-bit PC.

A VT-d or AMD-Vi IOMMU (Input/output memory management unit)

In Windows 10, an IOMMU enhances system resiliency against memory attacks. ¹

Secure firmware update process

To verify that the firmware complies with the secure firmware update process, you can validate it against the [System.Fundamentals.Firmware.UEFISecureBoot](http://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot) Windows Hardware Compatibility Program requirement.

Device Guard relies on the security of the underlying hardware and firmware. It is critical to keep the firmware updated with the latest security fixes.

-  -## Before using Device Guard in your company -Before you can successfully use Device Guard, you must set up your environment and your policies. -### Signing your apps -Device Guard mode supports both UWP apps and Classic Windows applications. Trust between Device Guard and your apps happen when your apps are signed using a signature that you determine to be trustworthy. Not just any signature will work. -This signing can happen by: -- **Using the Windows Store publishing process.** All apps that come out of the Microsoft Store are automatically signed with special signatures that can roll-up to our certificate authority (CA) or to your own. -- **Using your own digital certificate or public key infrastructure (PKI).** ISV's and enterprises can sign their own Classic Windows applications themselves, adding themselves to the trusted list of signers. -- **Using a non-Microsoft signing authority.** ISV's and enterprises can use a trusted non-Microsoft signing authority to sign all of their own Classic Windows applications. -- **Use the Device Guard signing portal**. Available in the Windows Store for Business, you can use a Microsoft web service to sign your Classic Windows applications. For more info, see [Device Guard signing](../manage/device-guard-signing-portal.md). -### Code Integrity policy -Before you can use the app protection included in Device Guard, you must create a Code Integrity policy using tools provided by Microsoft, but deployed using your current management tools, like Group Policy. The Code Integrity policy is a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10 Enterprise, along with restrictions on Windows 10 script hosts. This policy restricts what code can run on a device. -For the Device Guard feature, devices should only have Code Integrity pre-configured if the settings are provided by a customer for a customer-provided image. -**Note**  This XML document can be signed in Windows 10 Enterprise, helping to add additional protection against administrative users changing or removing this policy. -  -### Virtualization-based security using Windows 10 Enterprise Hypervisor -Windows 10 Enterprise Hypervisor introduces new capabilities around virtual trust levels, which helps Windows 10 Enterprise services to run in a protected environment, in isolation from the running operating system. Windows 10 Enterprise virtualization-based security helps protect kernel code integrity and helps to provide credential isolation for the local security authority (LSA). Letting the Kernel Code Integrity service run as a hypervisor-hosted service increases the level of protection around the root operating system, adding additional protections against any malware that compromises the kernel layer. -**Important**  Device Guard devices that run Kernel Code Integrity with virtualization-based security must have compatible drivers - legacy drivers can be updated - and have all virtualization capabilities turned on. This includes virtualization extensions and input/output memory management unit (IOMMU) support. -  -  -  +## Virtualization-based security using Windows 10 Enterprise Hypervisor + +Windows 10 Enterprise Hypervisor introduces new capabilities around virtual trust levels, which helps Windows 10 Enterprise services to run in a protected environment, in isolation from the running operating system. Windows 10 Enterprise virtualization-based security helps protect kernel code integrity and helps to provide credential isolation for the local security authority (LSA). Letting the Kernel Code Integrity service run as a hypervisor-hosted service increases the level of protection around the root operating system, adding additional protections against any malware that compromises the kernel layer. + +>**Important**  Device Guard devices that run Kernel Code Integrity with virtualization-based security (VBS) must have compatible drivers (legacy drivers can be updated) and meet requirements for the hardware and firmware that support virtualization-based security. For more information, see [Hardware, firmware, and software requirements for Device Guard](../keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard) From 42bb28e4dfe877a4c1a96154da4e917136e8da71 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 15 Jul 2016 09:36:48 -0700 Subject: [PATCH 35/69] Updated to include both IPv4 and IPv6 --- windows/keep-secure/mandatory-settings-for-wip.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/mandatory-settings-for-wip.md b/windows/keep-secure/mandatory-settings-for-wip.md index 9c265848d2..9a23e25d67 100644 --- a/windows/keep-secure/mandatory-settings-for-wip.md +++ b/windows/keep-secure/mandatory-settings-for-wip.md @@ -27,5 +27,5 @@ All sections provided for more info appear in either the [Create a Windows Infor |Pick your WIP protection level. |You must choose the level of protection level you want to apply to your WIP-protected content, including Override, Silent, or Block. For more info about where this area is and how to decide on your protection level, see the **Manage the EDP protection level for your enterprise data** section of the policy creation topics.| |Specify your corporate identity. |You must specify your corporate identity, usually expressed as your primary Internet domain (for example, contoso.com). For more info about where this area is and what it means, see the **Define your enterprise-managed corporate identity** section of the policy creation topics. | |Specify your Enterprise Network Domain Names. |You must specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. For more info about where this area is and how to add your suffixes, see the table that appears in the **Choose where apps can access enterprise data** section of the policy creation topics. | -|Specify your Enterprise IPv4 Ranges. |Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries. For more info about where this area is and what it means, see the table that appears in the **Define your enterprise-managed corporate identity** section of the policy creation topics. | +|Specify your Enterprise IPv4 or IPv6 Ranges. |Specify the addresses for a valid IPv4 or IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries. For more info about where this area is and what it means, see the table that appears in the **Define your enterprise-managed corporate identity** section of the policy creation topics. | |Include your Data Recovery Agent (DRA) certificate. |This certificate makes sure that any of your WIP-encrypted data can be decrypted, even if the security keys are lost. For more info about where this area is and what it means, see the **Create and verify an Encrypting File System (EFS) DRA certificate for EDP** section of the policy creation topics. | \ No newline at end of file From 0e901ee45dc367875a0307977a8a2dabf0a66d4f Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Fri, 15 Jul 2016 09:52:31 -0700 Subject: [PATCH 36/69] Added to the chg history topic --- windows/keep-secure/change-history-for-keep-windows-10-secure.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 2c19fa25f2..c9bbc186b5 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -18,6 +18,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |----------------------|-------------| |[Create an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) |New | |[Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) (multiple topics) | Updated | +|[Device Guard deployment guide](device-guard-deployment-guide.md) (multiple topics) | Updated | ## June 2016 From 58c3cf81b95b0df8133fb5af8a02d7b7939cd17e Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 15 Jul 2016 10:17:23 -0700 Subject: [PATCH 37/69] Fixing image issue --- .../create-edp-policy-using-intune.md | 540 +++++++++++------- 1 file changed, 337 insertions(+), 203 deletions(-) diff --git a/windows/keep-secure/create-edp-policy-using-intune.md b/windows/keep-secure/create-edp-policy-using-intune.md index 81f4eb2745..7f51444b81 100644 --- a/windows/keep-secure/create-edp-policy-using-intune.md +++ b/windows/keep-secure/create-edp-policy-using-intune.md @@ -27,315 +27,449 @@ We've received some great feedback from you, our Windows 10 Insider Preview cust Note that if you exit the **Policy** page before you've saved your new policy, your existing deployments won't be affected. However, if you save the policy without reconfiguring your apps, an updated policy will be deployed to your employees with an empty app rules list. ## Add an EDP policy -After you’ve installed and set up Intune for your organization, you must create an EDP-specific policy. +After you’ve set up Intune for your organization, you must create an EDP-specific policy. **To add an EDP policy** 1. Open the Intune administration console, and go to the **Policy** node, and then click **Add Policy** from the **Tasks** area. -2. Go to **Windows**, click the **Enterprise Data Protection (Windows 10 and Mobile and later) policy**, pick the EDP template, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. +2. Go to **Windows**, click the **Enterprise data protection (Windows 10 Desktop and Mobile and later) policy**, click **Create and Deploy a Custom Policy**, and then click **Create Policy**. ![Microsoft Intune: Create your new policy from the New Policy screen](images/intune-createnewpolicy.png) 3. Type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. - ![Microsoft Intune: Fill out the required Name and optional Description fields](images/intune-namedescription.png) + ![Microsoft Intune: Fill out the required Name and optional Description fields](images/intune-generalinfo.png) -## Add individual apps to your Protected App list +### Add app rules to your policy During the policy-creation process in Intune, you can choose the apps you want to give access to your enterprise data through EDP. Apps included in this list can protect data on behalf of the enterprise and are restricted from copying or moving enterprise data to unprotected apps. -The steps to add your apps are based on the type of app it is; either a Universal Windows Platform (UWP) app, or a signed Desktop app, also known as a Classic Windows application. +The steps to add your app rules are based on the type of rule template being applied. You can add a store app (also known as a Universal Windows Platform (UWP) app), a signed desktop app (also known as a Classic Windows app), or an AppLocker policy file. ->**Important**
EDP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, EDP-unaware apps might not respect the corporate network boundary and will encrypt all files they create or modify, meaning that they could encrypt personal data and cause data loss during the revocation process. Care must be taken to get a support statement from the software provider that their app is safe with EDP before adding it to your **Protected App** list.

+>**Important**
+EDP-aware apps are expected to prevent enterprise data from going to unprotected network locations and to avoid encrypting personal data. On the other hand, EDP-unaware apps might not respect the corporate network boundary, and EDP-unaware apps will encrypt all files they create or modify. This means that they could encrypt personal data and cause data loss during the revocation process.

Care must be taken to get a support statement from the software provider that their app is safe with EDP before adding it to your App Rules list. If you don’t get this statement, it’s possible that you could experience app compat issues due to an app losing the ability to access a necessary file after revocation. ->**Note**
If you want to use **File hash** or **Path** rules, instead of Publisher rules, you must follow the steps in the [Add multiple apps to your enterprise data protection (EDP) Protected Apps list](add-apps-to-protected-list-using-custom-uri.md) topic. +

+>**Note**
+If you want to use **File hash** or **Path** rules, instead of **Publisher** rules, you must follow the steps in the [Add apps using Microsoft Intune and custom URI](add-apps-to-protected-list-using-custom-uri.md) topic. -**To add a UWP app** +#### Add a store app rule to your policy +For this example, we’re going to add Microsoft OneNote, a store app, to the **App Rules** list. -1. From the **Configure the following apps to be protected by EDP** table in the **Protected Apps** area, click **Add.** +**To add a store app** +1. From the **App Rules** area, click **Add**. -2. Click **Universal App**, type the **Publisher Name** and the **Product Name** into the associated boxes, and then click **OK**. If you don't have the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps. + The **Add App Rule** box appears. - **To find the Publisher and Product name values for Microsoft Store apps without installing them** + ![Microsoft Intune, Add a store app to your policy](images/intune-add-uwp-apps.png) - 1. Go to the [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, Microsoft OneNote. - - >**Note**
If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the **Protected App** list. For info about how to do this, see the [Add multiple apps to your enterprise data protection (EDP) Protected Apps list](add-apps-to-protected-list-using-custom-uri.md) topic. +2. Add a friendly name for your app into the **Title** box. In this example, it’s *Microsoft OneNote*. - 2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. +3. Click **Allow** from the **Enterprise data protection mode** drop-down list. + + Allow turns on EDP, helping to protect that app’s corporate data through the enforcement of EDP restrictions. Instructions for exempting an app are included in the [Exempt apps from EDP restrictions](#exempt-apps-from-edp-restrictions) section of this topic. + +4. Pick **Store App** from the **Rule template** drop-down list. + + The box changes to show the store app rule options. + +5. Type the name of the app and the name of its publisher, and then click **OK**. For this UWP app example, the **Publisher** is`CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` and the **Product name** is `Microsoft.Office.OneNote`. + +If you don't know the publisher or product name, you can find them for both desktop devices and Windows 10 Mobile phones by following these steps. + +**To find the Publisher and Product Name values for Store apps without installing them** +1. Go to the [Windows Store for Business](http://go.microsoft.com/fwlink/p/?LinkID=722910) website, and find your app. For example, *Microsoft OneNote*. + + >**Note**
+ If your app is already installed on desktop devices, you can use the AppLocker local security policy MMC snap-in to gather the info for adding the app to the protected apps list. For info about how to do this, see the [Add apps using Microsoft Intune and custom URI](add-apps-to-protected-list-using-custom-uri.md) topic. + +2. Copy the ID value from the app URL. For example, Microsoft OneNote's ID URL is https://www.microsoft.com/store/apps/onenote/9wzdncrfhvjl, and you'd copy the ID value, `9wzdncrfhvjl`. + +3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9wzdncrfhvjl/applockerdata, where `9wzdncrfhvjl` is replaced with your ID value. - 3. In a browser, run the Store for Business portal web API, to return a JavaScript Object Notation (JSON) file that includes the publisher and product name values. For example, run https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/*9wzdncrfhvjl*/applockerdata, where *9wzdncrfhvjl* is replaced with your ID value. -

The API runs and opens a text editor with the app details. ``` json - { - "packageIdentityName": "Microsoft.Office.OneNote", - "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" - } + { + "packageIdentityName": "Microsoft.Office.OneNote", + "publisherCertificateName": "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" + } ``` - 4. Copy the `publisherCertificateName` value into the **Publisher Name** box and copy the `packageIdentityName` value into the **Product Name** box of Intune. +4. Copy the `publisherCertificateName` value into the **Publisher Name** box and copy the `packageIdentityName` value into the **Product Name** box of Intune. + + >**Important**
+ The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.

For example:
- >**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. -

For example:
- ``` json + ``` json { - "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", - } - ``` - - ![Microsoft Intune: Add a UWP app to the Protected Apps list](images/intune-addapps.png) + "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", + } + ``` - **To find the Publisher and Product name values for apps installed on Windows 10 Mobile phones** +**To find the Publisher and Product Name values for apps installed on Windows 10 mobile phones** +1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. - 1. If you need to add mobile apps that aren't distributed through the Store for Business, you must use the **Windows Device Portal** feature. + >**Note**
+ Your PC and phone must be on the same wireless network. + +2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. + +3. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**. + +4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate. + +5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. + +6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. + +7. Start the app for which you're looking for the publisher and product name values. + +8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. + + >**Important**
+ The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as `CN=` followed by the `windowsPhoneLegacyId`.

For example:
- >**Note**
Your PC and phone must be on the same wireless network. - - 2. On the Windows Phone, go to **Settings**, choose **Update & security**, and then choose **For developers**. - - 3. In the **For developers** screen, turn on **Developer mode**, turn on **Device Discovery**, and then turn on **Device Portal**. - - 4. Copy the URL in the **Device Portal** area into your device's browser, and then accept the SSL certificate. - - 5. In the **Device discovery** area, press **Pair**, and then enter the PIN into the website from the previous step. - - 6. On the **Apps** tab of the website, you can see details for the running apps, including the publisher and product names. - - 7. Start the app for which you're looking for the publisher and product name values - - 8. Copy the `publisherCertificateName` value and paste it into the **Publisher Name** box and the `packageIdentityName` value into the **Product Name** box of Intune. - - >**Important**
The JSON file might also return a `windowsPhoneLegacyId` value for both the **Publisher Name** and **Product Name** boxes. This means that you have an app that’s using a XAP package and that you must set the **Product Name** as `windowsPhoneLegacyId`, and set the **Publisher Name** as “CN=” followed by the `windowsPhoneLegacyId`. -

For example:
- ``` json + ``` json { - "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", - } - ``` + "windowsPhoneLegacyId": "ca05b3ab-f157-450c-8c49-a1f127f5e71d", + } + ``` -**To add a Classic Windows application** +#### Add a desktop app rule to your policy +For this example, we’re going to add Internet Explorer, a desktop app, to the **App Rules** list. -1. From the **Configure the following apps to be protected by EDP** table in the **Protected Apps** area, click **Add.** -

A dialog box appears, letting you pick whether the app is a **Universal App** or a **Desktop App**. +**To add a desktop app** +1. From the **App Rules** area, click **Add**. + + The **Add App Rule** box appears. + + ![Microsoft Intune, Add a desktop app to your policy](images/intune-add-classic-apps.png) + +2. Add a friendly name for your app into the **Title** box. In this example, it’s *Internet Explorer*. + +3. Click **Allow** from the **Enterprise data protection mode** drop-down list. + + Allow turns on EDP, helping to protect that app’s corporate data through the enforcement of EDP restrictions. Instructions for exempting an app are included in the [Exempt apps from EDP restrictions](#exempt-apps-from-edp-restrictions) section of this topic. + +4. Pick **Desktop App** from the **Rule template** drop-down list. + + The box changes to show the store app rule options. + +5. Pick the options you want to include for the app rule (see table), and then click **OK**. -2. Click **Desktop App**, pick the options you want (see table), and then click **OK**. - + - + - - - + + + - - - - - - + + - - + + - + + + + +
Option Manages
All fields left as "*"All fields left as “*” All files signed by any publisher. (Not recommended.)
Publisher selected All files signed by the named publisher.

This might be useful if your company is the publisher and signer of internal line-of-business apps.
Publisher and Product Name selected All files for the specified product, signed by the named publisher.
Publisher, Product Name, and File Name selected
Publisher, Product Name, and Binary name selected Any version of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, File Name, and File Version, Exactly selectedSpecified version of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, File Name, and File Version, And above selected
Publisher, Product Name, Binary name, and File Version, and above, selected Specified version or newer releases of the named file or package for the specified product, signed by the named publisher.

This option is recommended for enlightened apps that weren't previously enlightened.
Publisher, Product Name, File Name, and File Version, And below selected
Publisher, Product Name, Binary name, and File Version, And below selected Specified version or older releases of the named file or package for the specified product, signed by the named publisher.
Publisher, Product Name, Binary name, and File Version, Exactly selectedSpecified version of the named file or package for the specified product, signed by the named publisher.
If you’re unsure about what to include for the publisher, you can run this PowerShell command: -``` ps1 -Get-AppLockerFileInformation -Path "" +```ps1 + Get-AppLockerFileInformation -Path "" ``` -Where `""` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Internet Explorer\iexplore.exe"`. +Where `""` goes to the location of the app on the device. For example, `Get-AppLockerFileInformation -Path "C:\Program Files\Internet Explorer\iexplore.exe"`. In this example, you'd get the following info: ``` json -Path Publisher ----- --------- -%PROGRAMFILES%\INTERNET EXPLORER\IEXPLORE.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\INTERNET EXPLOR... + Path Publisher + ---- --------- + %PROGRAMFILES%\INTERNET EXPLORER\IEXPLORE.EXE O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US\INTERNET EXPLOR... ``` Where the text, `O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US` is the publisher name to enter in the **Publisher Name** box. -![Microsoft Intune: Add a Classic Windows app to the Protected Apps list](images/intune-add-desktop-app.png) +#### Add an AppLocker policy file +For this example, we’re going to add an AppLocker XML file to the **App Rules** list. You’ll use this option if you want to add multiple apps at the same time. For more info about AppLocker, see the [AppLocker](https://technet.microsoft.com/en-us/itpro/windows/keep-secure/applocker-overview) content. -## Exempt apps from EDP restrictions +**To create an app rule and xml file using the AppLocker tool** +1. Open the Local Security Policy snap-in (SecPol.msc). + +2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. + + ![Local security snap-in, showing the Packaged app Rules](images/intune-local-security-snapin.png) + +3. Right-click in the right-hand pane, and then click **Create New Rule**. + + The **Create Packaged app Rules** wizard appears. + +4. On the **Before You Begin** page, click **Next**. + + ![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-before-begin.png) + +5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. + + ![Create Packaged app Rules wizard, showing the Before You Begin page](images/intune-applocker-permissions.png) + +6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. + + ![Create Packaged app Rules wizard, showing the Publisher](images/intune-applocker-publisher.png) + +7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Photos. + + ![Create Packaged app Rules wizard, showing the Select applications page](images/intune-applocker-select-apps.png) + +8. On the updated **Publisher** page, click **Create**. + + ![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page](images/intune-applocker-publisher-with-app.png) + +9. Review the Local Security Policy snap-in to make sure your rule is correct. + + ![Local security snap-in, showing the new rule](images/intune-local-security-snapin-updated.png) + +10. In the left pane, right-click on **AppLocker**, and then click **Export policy**. + + The **Export policy** box opens, letting you export and save your new policy as XML. + + ![Local security snap-in, showing the Export Policy option](images/intune-local-security-export.png) + +11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. + + The policy is saved and you’ll see a message that says 1 rule was exported from the policy. + + **Example XML file**
+ This is the XML file that AppLocker creates for Microsoft Photos. + + ```xml + + + + + + + + + + + + + + + + ``` +12. After you’ve created your XML file, you need to import it by using Microsoft Intune. + +**To import your Applocker policy file app rule using Microsoft Intune** +1. From the **App Rules** area, click **Add**. + + The **Add App Rule** box appears. + + ![Microsoft Intune, Importing your AppLocker policy file using Intune](images/intune-add-applocker-xml-file.png) + +2. Add a friendly name for your app into the **Title** box. In this example, it’s *Allowed app list*. + +3. Click **Allow** from the **Enterprise data protection mode** drop-down list. + + Allow turns on EDP, helping to protect that app’s corporate data through the enforcement of EDP restrictions. Instructions for exempting an app are included in the [Exempt apps from EDP restrictions](#exempt-apps-from-edp-restrictions) section of this topic. + +4. Pick **AppLocker policy file** from the **Rule template** drop-down list. + + The box changes to let you import your AppLocker XML policy file. + +5. Click **Import**, browse to your AppLocker XML file, click **Open**, and then click **OK** to close the **Add App Rule** box. + + The file is imported and the apps are added to your **App Rules** list. + +#### Exempt apps from EDP restrictions If you're running into compatibility issues where your app is incompatible with EDP, but still needs to be used with enterprise data, you can exempt the app from the EDP restrictions. This means that your apps won't include auto-encryption or tagging and won't honor your network restrictions. It also means that your exempted apps might leak. -**To exempt an UWP app** - -1. Follow the **Add a UWP app** steps in the [Add multiple apps to your enterprise data protection (EDP) Protected Apps list](add-apps-to-protected-list-using-custom-uri.md) topic, through to Step 11. - -2. In the **OMA-URI** box at Step 12, type `./Vendor/MSFT/AppLocker/EnterpriseDataProtection/edpexempt/StoreApp EXE`.

Where **edpexempt** is added as a substring, making the app exempt. - -3. Open File Explorer, go to the location where you saved your new XML file, and open it using an XML editor, such as Notepad. - -4. Copy the text that has a **Type** of Appx, within in the **RuleCollection** tags, and then go back to Intune and paste the text into the **Value** box of the **Add or edit OMA-URI Setting** box. For example: - - ``` - - ``` +**To exempt a store app, a desktop app, or an AppLocker policy file app rule** +1. From the **App Rules** area, click **Add**. -5. Click **OK** to close the **Add or edit OMA-URI Setting** box, and then click **Save Policy**.

After saving the policy, you’ll need to deploy it to your employee’s devices. For more info, see the [Deploy your enterprise data protection (EDP) policy](deploy-edp-policy-using-intune.md) topic. + The **Add App Rule** box appears. -**To exempt a Classic Windows application** +2. Add a friendly name for your app into the **Title** box. In this example, it’s *Exempt apps list*. -1. Follow the **Add a Classic Windows application app** steps in the [Add multiple apps to your enterprise data protection (EDP) Protected Apps list](add-apps-to-protected-list-using-custom-uri.md) topic, through to Step 11. +3. Click **Exempt** from the **Enterprise data protection mode** drop-down list. -2. In the **OMA-URI** box at Step 12, type `./Vendor/MSFT/AppLocker/EnterpriseDataProtection/edpexempt/EXE`.

Where **edpexempt** is added as a substring, making the app exempt. + Be aware that when you exempt apps, they’re allowed to bypass the EDP restrictions and access your corporate data. To allow apps, see the [Add app rules to your policy](#add-app-rules-to-your-policy) section of this topic. -3. Open File Explorer, go to the location where you saved your new XML file, and open it using an XML editor, such as Notepad. +4. Fill out the rest of the app rule info, based on the type of rule you’re adding: -4. Copy the text that has a **Type** of EXE, within in the **RuleCollection** tags, and then go back to Intune and paste the text into the **Value** box of the **Add or edit OMA-URI Setting** box. For example: + - **Store app.** Follow the **Publisher** and **Product name** instructions in the [Add a store app rule to your policy](#add-a-store-app-rule-to-your-policy) section of this topic. - ``` - - ``` + - **Desktop app.** Follow the **Publisher**, **Product name**, **Binary name**, and **Version** instructions in the [Add a desktop app rule to your policy](#add-a-desktop-app-rule-to-your-policy) section of this topic. -5. Click **OK** to close the **Add or edit OMA-URI Setting** box, and then click **Save Policy**.

After saving the policy, you’ll need to deploy it to your employee’s devices. For more info, see the [Deploy your enterprise data protection (EDP) policy](deploy-edp-policy-using-intune.md) topic. + - **AppLocker policy file.** Follow the **Import** instructions in the [Add an AppLocker policy file](#add-an-applocker-policy-file) section of this topic, using a list of exempted apps. -## Manage the EDP protection level for your enterprise data +5. Click **OK**. + +### Manage the EDP protection mode for your enterprise data After you've added the apps you want to protect with EDP, you'll need to apply a management and protection mode. -We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your **Protected Apps** list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**. +We recommend that you start with **Silent** or **Override** while verifying with a small group that you have the right apps on your protected apps list. After you're done, you can change to your final enforcement policy, either **Override** or **Block**. - - - - - - - - - - - - - - - - - - - - - -
ModeDescription
BlockEDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.
OverrideEDP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](http://go.microsoft.com/fwlink/p/?LinkID=746459).
SilentEDP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or EDP-protected data, are still blocked.
OffEDP is turned off and doesn't help to protect or audit your data.

After you turn off EDP, an attempt is made to decrypt any closed EDP-tagged files on the locally attached drives.

+|Mode |Description | +|-----|------------| +|Block |EDP looks for inappropriate data sharing practices and stops the employee from completing the action. This can include sharing info across non-enterprise-protected apps in addition to sharing enterprise data between other people and devices outside of your enterprise.| +|Override |EDP looks for inappropriate data sharing, warning employees if they do something deemed potentially unsafe. However, this management mode lets the employee override the policy and share the data, logging the action to your audit log, accessible through the [Reporting CSP](http://go.microsoft.com/fwlink/p/?LinkID=746459). | +|Silent |EDP runs silently, logging inappropriate data sharing, without blocking anything that would’ve been prompted for employee interaction while in Override mode. Unallowed actions, like apps inappropriately trying to access a network resource or EDP-protected data, are still blocked.| +|Off (not recommended) |EDP is turned off and doesn't help to protect or audit your data.

After you turn off EDP, an attempt is made to decrypt any closed EDP-tagged files on the locally attached drives.| -![Microsoft Intune: Add the protection level for your Protected Apps list](images/intune-encryption-level.png) +![Microsoft Intune, Set the protection mode for your data](images/intune-protection-mode.png) -## Define your enterprise-managed identity domains -Specify your company’s enterprise identity, expressed as your primary internet domain. For example, if your company is Contoso, its enterprise identity might be contoso.com. The first listed domain (in this example, contoso.com) is the primary enterprise identity string used to tag files protected by any app on the **Protected App** list. +### Define your enterprise-managed corporate identity +Corporate identity, usually expressed as your primary Internet domain (for example, contoso.com), helps to identify and tag your corporate data from apps you’ve marked as protected by EDP. For example, emails using contoso.com are identified as being corporate and are restricted by your enterprise data protection policies. -You can also specify all the domains owned by your enterprise that are used for user accounts, separating them with the "|" character. For example, if Contoso also has some employees with email addresses or user accounts on the fabrikam.com domain, you would use contoso.com|fabrikam.com. +You can specify multiple domains owned by your enterprise by separating them with the "|" character. For example, (`contoso.com|newcontoso.com`). With multiple domains, the first one is designated as your corporate identity and all of the additional ones as being owned by the first one. We strongly recommend that you include all of your email address domains in this list. -This list of managed identity domains, along with the primary domain, make up the identity of your managing enterprise. User identities (user@domain) that end in any of the domains on this list, are considered managed. +**To add your corporate identity** +- Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`. -**To add your primary domain** + ![Microsoft Intune, Set your primary Internet domains](images/intune-corporate-identity.png) -- Type the name of your primary domain into the **Primary domain** field. For example, *contoso.com*.

-If you have multiple domains, you must separate them with the "|" character. For example, `contoso.com|fabrikam.com`. +### Choose where apps can access enterprise data +After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. - ![Microsoft Intune: Add the primary internet domain for your enterprise identity](images/intune-primary-domain.png) - -## Choose where apps can access enterprise data -After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network.

-There are no default locations included with EDP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). +There are no default locations included with EDP, you must add each of your network locations. This area applies to any network endpoint device that gets an IP address in your enterprise’s range and is also bound to one of your enterprise domains, including SMB shares. Local file system locations should just maintain encryption (for example, on local NTFS, FAT, ExFAT). >**Important**
-- Every EDP policy should include policy that defines your enterprise network locations.

+- Every EDP policy should include policy that defines your enterprise network locations.

- Classless Inter-Domain Routing (CIDR) notation isn’t supported for EDP configurations. -**To specify where your protected apps can find and send enterprise data on the network** +**To define where your protected apps can find and send enterprise data on you network** -1. Add additional network locations your apps can access by clicking **Add**, typing a description into the **Description** box, and then choosing your location type, including: +1. Add additional network locations your apps can access by clicking **Add**. + + The **Add or edit corporate network definition** box appears. + +2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table. + + ![Microsoft Intune, Add your corporate network definitions](images/intune-networklocation.png) +

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Network location typeFormatDescription
Enterprise Cloud Resources**With proxy:**

contoso.sharepoint.com,proxy.contoso.com|
contoso.visualstudio.com,proxy.contoso.com

**Without proxy:**

contoso.sharepoint.com|contoso.visualstudio.com

Specify the cloud resources to be treated as corporate and protected by EDP.

For each cloud resource, you may also optionally specify an internal proxy server that routes your traffic through your Enterprise Internal Proxy Server.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example:

`URL <,proxy>|URL <,proxy>`

If Windows is unable to determine whether an app should be allowed to connect to a network resource, it will automatically block the connection. If instead you want Windows to allow the connections to happen, you can add the `/*AppCompat*/` string to this setting. For example:

`URL <,proxy>|URL <,proxy>|/*AppCompat*/`

Enterprise Network Domain Namesdomain1.contoso.com,domain2.contoso.comSpecify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.

This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.

If you have multiple resources, you must separate them using the "," delimiter.

Enterprise Proxy Serversdomain1.contoso.com:80;
domain2.contoso.com:137		Specify your externally-facing proxy server addresses, along with the port through which traffic is allowed and protected with EDP.

This list shouldn’t include any servers listed in the Enterprise Internal Proxy Servers list, which are used for EDP-protected traffic.

This setting is also required if you use a proxy in your network. If you don't have a proxy server, you might find that enterprise resources are unavailable when a client is behind a proxy, such as when you’re visiting another company and not on that company’s guest network.

If you have multiple resources, you must separate them using the ";" delimiter.

Enterprise Internal Proxy Serversproxy1.contoso.com;
proxy2.contoso.com		Specify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-EDP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter.

Enterprise IPv4 Range**Starting IPv4 Address:** 3.4.0.1
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,10.0.0.1-10.255.255.254		Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter.

Enterprise IPv6 Range**Starting IPv6 Address:** 2a01:110::
**Ending IPv6 Address:** 2a01:110:7fff:ffff:
ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110::-2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff		Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter.

- - ![Microsoft Intune: Choose the primary domain and the other network locations for protected apps](images/intune-networklocation.png) + + Network location type + Format + Description + + + Enterprise Cloud Resources + **With proxy:** contoso.sharepoint.com,proxy.contoso.com|
contoso.visualstudio.com,proxy.contoso.com

**Without proxy:** contoso.sharepoint.com|contoso.visualstudio.com + Specify the cloud resources to be treated as corporate and protected by EDP.

For each cloud resource, you may also optionally specify an internal proxy server that routes your traffic through your Enterprise Internal Proxy Server.

If you have multiple resources, you must separate them using the "|" delimiter. If you don’t use proxy servers, you must also include the "," delimiter just before the "|". For example: `URL <,proxy>|URL <,proxy>`.

If Windows is unable to determine whether an app should be allowed to connect to a network resource, it will automatically block the connection. If instead you want Windows to allow the connections to happen, you can add the `/*AppCompat*/` string to this setting. For example: `URL <,proxy>|URL <,proxy>|/*AppCompat*/` + + + Enterprise Network Domain Names (Required) + corp.contoso.com,region.contoso.com + Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected.

This setting works with the IP ranges settings to detect whether a network endpoint is enterprise or personal on private networks.

If you have multiple resources, you must separate them using the "," delimiter. + + + Enterprise Proxy Servers + proxy.contoso.com:80;proxy2.contoso.com:137 + Specify your externally-facing proxy server addresses, along with the port through which traffic is allowed and protected with EDP.

This list shouldn’t include any servers listed in the Enterprise Internal Proxy Servers list, which are used for EDP-protected traffic.

This setting is also required if you use a proxy in your network. If you don't have a proxy server, you might find that enterprise resources are unavailable when a client is behind a proxy, such as when you’re visiting another company and not on that company’s guest network.

If you have multiple resources, you must separate them using the ";" delimiter. + + + Enterprise Internal Proxy Servers + contoso.internalproxy1.com;contoso.internalproxy2.com + Specify the proxy servers your devices will go through to reach your cloud resources.

Using this server type indicates that the cloud resources you’re connecting to are enterprise resources.

This list shouldn’t include any servers listed in the Enterprise Proxy Servers list, which are used for non-EDP-protected traffic.

If you have multiple resources, you must separate them using the ";" delimiter. + + + Enterprise IPv4 Range (Required, if not using IPv6) + **Starting IPv4 Address:** 3.4.0.1
**Ending IPv4 Address:** 3.4.255.254
**Custom URI:** 3.4.0.1-3.4.255.254,
10.0.0.1-10.255.255.254 + Specify the addresses for a valid IPv4 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter. + + + Enterprise IPv6 Range (Required, if not using IPv4) + **Starting IPv6 Address:** 2a01:110::
**Ending IPv6 Address:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff
**Custom URI:** 2a01:110:7fff:ffff:ffff:ffff:ffff:ffff,
fd00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff + Specify the addresses for a valid IPv6 value range within your intranet. These addresses, used with your Enterprise Network Domain Names, define your corporate network boundaries.

If you have multiple ranges, you must separate them using the "," delimiter. + + + Neutral Resources + sts.contoso.com,sts.contoso2.com + Specify your authentication redirection endpoints for your company.

These locations are considered enterprise or personal, based on the context of the connection before the redirection.

If you have multiple resources, you must separate them using the "," delimiter. + + -2. Add as many locations as you need, and then click **OK**.

The **Add or Edit Enterprise Network Locations box** closes. +3. Add as many locations as you need, and then click **OK**. -3. In the **Use a data recovery certificate in case of data loss** box, click **Browse** to add a data recovery certificate for your policy.

After you create and deploy your EDP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data.

For steps about how to create and verify an EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) DRA certificate](create-and-verify-an-efs-dra-certificate.md) topic. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic.

+ The **Add corporate network definition** box closes. - ![Microsoft Intune: Specify a data recovery certificate for your policy](images/intune-data-recovery.png) +4. Decide if you want to Windows to look for additional network settings: -## Choose your optional EDP-related settings + - **Enterprise Proxy Servers list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the proxy servers you specified in the network boundary definition as the complete list of proxy servers available on your network. If you clear this box, Windows will search for additional proxy servers in your immediate network. + + - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Click this box if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you clear this box, Windows will search for additional IP ranges on any domain-joined devices connected to your network. + + - **Show the enterprise data protection icon overlay on your allowed apps that are EDP-unaware in the Windows Start menu and on corporate file icons in the File Explorer.** Click this box if you want the enterprise data protection icon overlay to appear on corporate files or in the Start menu, on top the tiles for your unenlightened protected apps. + +5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. + + ![Microsoft Intune, Add your Data Recovery Agent (DRA) certificate](images/intune-data-recovery.png) + + After you create and deploy your EDP policy to your employees, Windows will begin to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. + + For steps about how to create and verify an EFS DRA certificate, see the [Create and verify an Encrypting File System (EFS) DRA certificate](create-and-verify-an-efs-dra-certificate.md) topic. For more info about how to find and export your data recovery certificate, see the [Data Recovery and Encrypting File System (EFS)](http://go.microsoft.com/fwlink/p/?LinkId=761462) topic. + +### Choose your optional EDP-related settings After you've decided where your protected apps can access enterprise data on your network, you’ll be asked to decide if you want to add any optional EDP settings. -**To add your optional settings** +![Microsoft Intune, Choose any additional, optional settings](images/intune-optional-settings.png) -1. Choose to set any or all of the optional EDP-related settings: +**To set your optional settings** +1. Choose to set any or all of the optional settings: - - **Allow the user to decrypt data that was created or edited by the apps configured above.** Clicking **Yes**, or turning off this setting in Intune, lets your employees right-click to decrypt their protected app data, along with the option to decrypt data in the **Save As** box and the **Save As** file picker . Clicking **No** removes the **Decrypt** option and saves all data for protected apps as enterprise-encrypted. + - **Show the Personal option in the File ownership menus of File Explorer and the Save As dialog box.** Determines whether users can see the Personal option for files within File Explorer and the **Save As** dialog box. The options are: + + - **Yes, or not configured (recommended).** Employees can choose whether a file is **Work** or **Personal** in File Explorer and the **Save As** dialog box. + + - **No.** Hides the **Personal** option from employees. Be aware that if you pick this option, apps that use the **Save As** dialog box might encrypt new files as corporate data unless a different file path is given during the original file creation. After this happens, decryption of work files becomes more difficult. - - **Protect app content when the device is in a locked state for the apps configured above.** Clicking **Yes** lets EDP help to secure protected app content when a mobile device is locked. We recommend turning this option on to help prevent data leaks from things such as email text that appears on the **Lock** screen of a Windows 10 Mobile phone. + - **Prevent corporate data from being accessed by apps when the device is locked. Applies only to Windows 10 Mobile**. Determines whether apps can show corporate data on a Windows 10 Mobile device **Lock** screen. The options are: + + - **Yes (recommended).** Stop apps from reading corporate data on Windows 10 Mobile device when the screen is locked. + + - **No, or not configured.** Allows apps to read corporate data on Windows 10 Mobile device when the screen is locked. - ![Microsoft Intune: Optional EDP settings](images/intune-edpsettings.png) + - **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from enterprise data protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: -2. Click **Save Policy**. + - **Yes, or not configured (recommended).** Revokes local encryption keys from a device during unenrollment. + + - **No.** Stop local encryption keys from being revoked from a device during unenrollment. For example, if you’re migrating between Mobile Device Management (MDM) solutions. + + - **Allow Windows Search to search encrypted corporate data and Store apps.** Determines whether Windows Search can search and index encrypted corporate data and Store apps. The options are: + + - **Yes.** Allows Windows Search to search and index encrypted corporate data and Store apps. + + - **No, or not configured (recommended).** Stops Windows Search from searching and indexing encrypted corporate data and Store apps. + + - **Show the enterprise data protection icon overlay.** Determines whether the enterprise data protection icon overlay appears on corporate files or in the **Start** menu, on top of the tiles for your unenlightened protected apps. The options are: + + - **Yes (recommended).** Allows the enterprise data protection icon overlay to appear for files or on top of the tiles for your unenlightened protected apps in the **Start** menu. + + - **No, or not configured.** Stops the enterprise data protection icon overlay from appearing for files or on top of the tiles for your unenlightened protected apps in the **Start** menu. + +2. Click **Save Policy**. ## Related topics - [Add multiple apps to your enterprise data protection (EDP) Protected Apps list](add-apps-to-protected-list-using-custom-uri.md) - [Deploy your enterprise data protection (EDP) policy](deploy-edp-policy-using-intune.md) - [Create and deploy a VPN policy for enterprise data protection (EDP) using Microsoft Intune](create-vpn-and-edp-policy-using-intune.md) -- [General guidance and best practices for enterprise data protection (EDP)](guidance-and-best-practices-edp.md) - - - -  - -  - - - - - +- [General guidance and best practices for enterprise data protection (EDP)](guidance-and-best-practices-edp.md) \ No newline at end of file From fbe41720ed152269e3b4f3db517154804a320063 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 15 Jul 2016 11:22:20 -0700 Subject: [PATCH 38/69] Updated for publish --- .../keep-secure/change-history-for-keep-windows-10-secure.md | 1 + windows/keep-secure/mandatory-settings-for-wip.md | 5 +++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 8a96eaa113..d43c87c4e9 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -16,6 +16,7 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |New or changed topic | Description | |----------------------|-------------| +|[Mandatory settings for Windows Information Protection (WIP)](mandatory-settings-for-wip.md) |New | |[Create an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) |New | |[Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) |New | |[Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) (multiple topics) | Updated | diff --git a/windows/keep-secure/mandatory-settings-for-wip.md b/windows/keep-secure/mandatory-settings-for-wip.md index 9a23e25d67..bc0c26537d 100644 --- a/windows/keep-secure/mandatory-settings-for-wip.md +++ b/windows/keep-secure/mandatory-settings-for-wip.md @@ -1,6 +1,7 @@ --- title: Mandatory tasks and settings required to turn on Windows Information Protection (WIP) (Windows 10) -description: This list provides all of the tasks that are required for the operating system to turn on Windows Information Protection (WIP) in your enterprise. +description: This list provides all of the tasks that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP) in your enterprise. +keywords: Windows Information Protection, WIP, EDP, Enterprise Data Protection, protected apps, protected app list, App Rules, Allowed apps list ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -15,7 +16,7 @@ ms.pagetype: security [Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -This list provides all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP) in your enterprise. +This list provides all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection(EDP), in your enterprise. >**Important**
All sections provided for more info appear in either the [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-edp-policy-using-intune.md) or [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md), based on the tool you're using in your enterprise. From ab1347da137452e8e0765e04c798d3e7c5b2fd26 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Fri, 15 Jul 2016 11:58:45 -0700 Subject: [PATCH 39/69] Fixed a typo --- ...ments-and-deployment-planning-guidelines-for-device-guard.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md index 2c6b76c490..9a91fc9bee 100644 --- a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md +++ b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md @@ -57,8 +57,6 @@ The following tables provide more information about the hardware, firmware, and The following tables describes additional hardware and firmware requirements, and the additional protections that are available when those requirements are met. We strongly recommend the following additional protections, which help you maximize the benefits that Device Guard can provide. - to take advantage of all the security options Device Guard can provide. - ### 2015 Additional Qualification Requirements for Device Guard (Windows 10, version 1507 and Windows 10, version 1511) |Additional Protections - requirement | Description | From 46ca2a3d5eb56dfd20f5471417f0a8827a5fa4dc Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 15 Jul 2016 11:59:54 -0700 Subject: [PATCH 40/69] Changed App rules to App Rules --- windows/keep-secure/mandatory-settings-for-wip.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/mandatory-settings-for-wip.md b/windows/keep-secure/mandatory-settings-for-wip.md index bc0c26537d..8a68a0c1ac 100644 --- a/windows/keep-secure/mandatory-settings-for-wip.md +++ b/windows/keep-secure/mandatory-settings-for-wip.md @@ -24,7 +24,7 @@ All sections provided for more info appear in either the [Create a Windows Infor |Task |Description | |------------------------------------|--------------------------| -|Add at least one app rule in the **App rules** area in your WIP policy. |You must have at least one app rule specified in the **App rules** area of your WIP policy. For more info about where this area is and how to add an app rule, see the **Add individual apps to your Protected App list** section of the policy creation topics.| +|Add at least one app rule in the **App Rules** area in your WIP policy. |You must have at least one app rule specified in the **App Rules** area of your WIP policy. For more info about where this area is and how to add an app rule, see the **Add individual apps to your Protected App list** section of the policy creation topics.| |Pick your WIP protection level. |You must choose the level of protection level you want to apply to your WIP-protected content, including Override, Silent, or Block. For more info about where this area is and how to decide on your protection level, see the **Manage the EDP protection level for your enterprise data** section of the policy creation topics.| |Specify your corporate identity. |You must specify your corporate identity, usually expressed as your primary Internet domain (for example, contoso.com). For more info about where this area is and what it means, see the **Define your enterprise-managed corporate identity** section of the policy creation topics. | |Specify your Enterprise Network Domain Names. |You must specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. For more info about where this area is and how to add your suffixes, see the table that appears in the **Choose where apps can access enterprise data** section of the policy creation topics. | From 025f685626aa1aed85a9dd08dfc69784348e90f0 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 15 Jul 2016 12:19:47 -0700 Subject: [PATCH 41/69] Updated parent topic for new child topic --- windows/keep-secure/guidance-and-best-practices-edp.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/keep-secure/guidance-and-best-practices-edp.md b/windows/keep-secure/guidance-and-best-practices-edp.md index 805ac84dfc..dbbf9a2d3a 100644 --- a/windows/keep-secure/guidance-and-best-practices-edp.md +++ b/windows/keep-secure/guidance-and-best-practices-edp.md @@ -23,6 +23,7 @@ This section includes info about the enlightened Microsoft apps, including how t ## In this section |Topic |Description | |------|------------| +|[Mandatory settings for Windows Information Protection (WIP)](mandatory-settings-for-wip.md) |A list of all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection(EDP), in your enterprise. | |[Enlightened apps for use with enterprise data protection (EDP)](enlightened-microsoft-apps-and-edp.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your **Protected Apps** list. | |[Testing scenarios for enterprise data protection (EDP)](testing-scenarios-for-edp.md) |We've come up with a list of suggested testing scenarios that you can use to test EDP in your company. | From 8bfbea21ba52d8d1fb49fdb46116e9518e111024 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Fri, 15 Jul 2016 14:16:19 -0700 Subject: [PATCH 42/69] correcting typo --- devices/surface-hub/connect-and-display-with-surface-hub.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/devices/surface-hub/connect-and-display-with-surface-hub.md b/devices/surface-hub/connect-and-display-with-surface-hub.md index 35d14c4df5..e5250193a8 100644 --- a/devices/surface-hub/connect-and-display-with-surface-hub.md +++ b/devices/surface-hub/connect-and-display-with-surface-hub.md @@ -130,7 +130,7 @@ When a Surface hub is connected to guest computer with the wired connect USB por - HID-compliant mouse -**Universal serial bus conntrollers** +**Universal serial bus controllers** - Generic USB hub From 0850fc354fc42f9d563a2836fc2e8c90916b3702 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Fri, 15 Jul 2016 15:50:47 -0700 Subject: [PATCH 43/69] Added missing space between words --- windows/keep-secure/guidance-and-best-practices-edp.md | 2 +- windows/keep-secure/mandatory-settings-for-wip.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/keep-secure/guidance-and-best-practices-edp.md b/windows/keep-secure/guidance-and-best-practices-edp.md index dbbf9a2d3a..fd1ffe2dcd 100644 --- a/windows/keep-secure/guidance-and-best-practices-edp.md +++ b/windows/keep-secure/guidance-and-best-practices-edp.md @@ -23,7 +23,7 @@ This section includes info about the enlightened Microsoft apps, including how t ## In this section |Topic |Description | |------|------------| -|[Mandatory settings for Windows Information Protection (WIP)](mandatory-settings-for-wip.md) |A list of all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection(EDP), in your enterprise. | +|[Mandatory settings for Windows Information Protection (WIP)](mandatory-settings-for-wip.md) |A list of all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your enterprise. | |[Enlightened apps for use with enterprise data protection (EDP)](enlightened-microsoft-apps-and-edp.md) |Learn the difference between enlightened and unenlightened apps, and then review the list of enlightened apps provided by Microsoft along with the text you will need to use to add them to your **Protected Apps** list. | |[Testing scenarios for enterprise data protection (EDP)](testing-scenarios-for-edp.md) |We've come up with a list of suggested testing scenarios that you can use to test EDP in your company. | diff --git a/windows/keep-secure/mandatory-settings-for-wip.md b/windows/keep-secure/mandatory-settings-for-wip.md index 8a68a0c1ac..56b79bc283 100644 --- a/windows/keep-secure/mandatory-settings-for-wip.md +++ b/windows/keep-secure/mandatory-settings-for-wip.md @@ -16,7 +16,7 @@ ms.pagetype: security [Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -This list provides all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection(EDP), in your enterprise. +This list provides all of the tasks and settings that are required for the operating system to turn on Windows Information Protection (WIP), formerly known as enterprise data protection (EDP), in your enterprise. >**Important**
All sections provided for more info appear in either the [Create a Windows Information Protection (WIP) policy using Microsoft Intune](create-edp-policy-using-intune.md) or [Create a Windows Information Protection (WIP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md), based on the tool you're using in your enterprise. From 7fbffa54c4f1f9b59bcb39a785cab234872720cf Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Fri, 15 Jul 2016 17:51:39 -0700 Subject: [PATCH 44/69] Folded in add'l feedback from Suhas --- ...sed-security-and-code-integrity-policies.md | 6 +++--- ...ent-planning-guidelines-for-device-guard.md | 18 ++++++++++-------- 2 files changed, 13 insertions(+), 11 deletions(-) diff --git a/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md b/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md index 07a789467a..f0e196b799 100644 --- a/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md +++ b/windows/keep-secure/introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md @@ -27,11 +27,11 @@ The following table lists security threats and describes the corresponding Devic | Security threat in the enterprise | How a Device Guard feature helps protect against the threat | | --------------------------------- | ----------------------------------------------------------- | -| **Exposure to new malware**, for which the "signature" is not yet known | **Code integrity policies**:  You can maintain a whitelist of software that is allowed to run (a configurable code integrity policy), rather than trying to stay ahead of attackers by maintaining a constantly-updated list of "signatures" of software that should be blocked. This approach uses the trust-nothing model well known in mobile device operating systems.

**Specialized hardware required?** No security-related hardware features are required, although code integrity policies are strengthened by such features, as described in the last three rows of this table. | +| **Exposure to new malware**, for which the "signature" is not yet known | **Code integrity policies**:  You can maintain a whitelist of software that is allowed to run (a configurable code integrity policy), rather than trying to stay ahead of attackers by maintaining a constantly-updated list of "signatures" of software that should be blocked. This approach uses the trust-nothing model well known in mobile device operating systems.
Only code that is verified by Code Integrity, usually through the digital signature that you have identified as being from a trusted signer, is allowed to run. This allows full control over allowed code in both kernel and user mode.

**Specialized hardware required?** No security-related hardware features are required, although code integrity policies are strengthened by such features, as described in the last three rows of this table. | | **Exposure to unsigned code** (most malware is unsigned) | **Code integrity policies, plus catalog files as needed**:  Because most malware is unsigned, using a code integrity policy (which in most cases requires signed code) can immediately help protect against a large number of threats. However, many organizations use unsigned line-of-business (LOB) applications, for which the process of signing might be difficult. This has changed in Windows 10, because you can use a tool called Package Inspector to create a *catalog* of all deployed and executed binary files for your trusted applications. After you sign and distribute the catalog, your trusted applications can be handled by code integrity policies in the same way as any other signed application. With this foundation, you can more easily block all unsigned applications, allowing only signed applications to run.

**Specialized hardware required?** No security-related hardware features are required for creating and using code integrity policies and catalogs. However, code integrity policies and catalogs are strengthened by the hardware features, as described in later rows of this table. | -| **Malware that gains access to the kernel** and then, from within the kernel, captures sensitive information or damages the system | **Virtualization-based security (VBS)**:  This is protection that uses the hypervisor to help protect the kernel and other parts of the operating system. When VBS is enabled, it strengthens either the default kernel-mode code integrity policy (which protects against bad drivers or system files), or the configurable code integrity policy that you deploy. With VBS, even if malware gains access to the kernel, the effects can be severely limited, because the hypervisor can prevent the malware from executing code.

**Specialized hardware required?** Yes, VBS requires at least CPU virtualization extensions and SLAT, as described in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). | +| **Malware that gains access to the kernel** and then, from within the kernel, captures sensitive information or damages the system | **Virtualization-based security (VBS)**:  This is protection that uses the hypervisor to help protect the kernel and other parts of the operating system. When VBS is enabled, it strengthens either the default kernel-mode code integrity policy (which protects against bad drivers or system files), or the configurable code integrity policy that you deploy.
With VBS, even if malware gains access to the kernel, the effects can be severely limited, because the hypervisor can prevent the malware from executing code. The hypervisor, the most privileged level of system software, enforces R/W/X permissions across system memory. Code integrity checks are performed in a secure environment which is resistant to attack from kernel mode software, and page permissions for kernel mode are set and maintained by the hypervisor. Even if there are vulnerabilities that allow memory modification, like a buffer overflow, the modified memory cannot be executed.

**Specialized hardware required?** Yes, VBS requires at least CPU virtualization extensions and SLAT, as described in [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). | | **DMA-based attacks**, for example, attacks launched from a malicious device that reads secrets from memory, making the enterprise more vulnerable to attack | **Virtualization-based security (VBS) using IOMMUs**:  With this type of VBS protection, when the DMA-based attack makes a memory request, input/output memory management units (IOMMUs) will evaluate the request and deny access.

**Specialized hardware required?** Yes, IOMMUs are a hardware feature that supports the hypervisor, and if you choose hardware that includes them, they can help protect against malicious attempts to access memory. | -| **Exposure to boot kits** or to other forms of malware that runs early in the boot process, or in kernel after startup | **Universal Extensible Firmware Interface (UEFI) Secure Boot**:   Secure Boot and related methods protect the boot process and firmware from tampering.

**Specialized hardware required?** With UEFI Secure Boot, the requirements are firmware requirements. For more information, see [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). | +| **Exposure to boot kits or to a physically present attacker at boot time** | **Universal Extensible Firmware Interface (UEFI) Secure Boot**:   Secure Boot and related methods protect the boot process and firmware from tampering. This tampering can come from a physically present attacker or from forms of malware that run early in the boot process or in kernel after startup. UEFI is locked down (Boot order, Boot entries, Secure Boot, Virtualization extensions, IOMMU, Microsoft UEFI CA), so the settings in UEFI cannot be changed to compromise Device Guard security.

**Specialized hardware required?** With UEFI Secure Boot, the requirements are firmware requirements. For more information, see [Hardware, firmware, and software requirements for Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-device-guard). | In this guide, you learn about the individual features found within Device Guard as well as how to plan for, configure, and deploy them. Device Guard with configurable code integrity is intended for deployment alongside additional threat-mitigating Windows features such as [Credential Guard](credential-guard.md) and [AppLocker](applocker-overview.md). diff --git a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md index 9a91fc9bee..3fe868fb12 100644 --- a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md +++ b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md @@ -17,7 +17,7 @@ This article describes the following: - [Hardware, firmware, and software requirements for Device Guard](#hardware-firmware-and-software-requirements-for-device-guard) - [Device Guard requirements for baseline protections](#device-guard-requirements-for-baseline-protections) - - [Device Guard requirements for additional protections](#device-guard-requirements-for-additional-protections) + - [Device Guard requirements for improved security](#device-guard-requirements-for-improved-security) - [Device Guard deployment in different scenarios: types of devices](#device-guard-deployment-in-different-scenarios-types-of-devices) - [Reviewing your applications: application signing and catalog files](#reviewing-your-applications-application-signing-and-catalog-files) - [Code integrity policy formats and signing](#code-integrity-policy-formats-and-signing) @@ -32,11 +32,13 @@ For example, hardware that includes CPU virtualization extensions and SLAT will You can deploy Device Guard in phases, and plan these phases in relation to the computer purchases you plan for your next hardware refresh. -The following tables provide more information about the hardware, firmware, and software required for deployment of various Device Guard features. +The following tables provide more information about the hardware, firmware, and software required for deployment of various Device Guard features. - + -> **Note**  For new computers running Windows 10, Trusted Platform Module (TPM 2.0) must be enabled by default. This requirement is not restated in the tables that follow. +> **Notes** +> - To understand the requirements in the following tables, you will need to be familiar with the main features in Device Guard: configurable code integrity policies, virtualization-based security (VBS), and Universal Extensible Firmware Interface (UEFI) Secure Boot. For information about these features, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies#how-device-guard-features-help-protect-against-threats). +> - For new computers running Windows 10, Trusted Platform Module (TPM 2.0) must be enabled by default. This requirement is not restated in the tables that follow. ## Device Guard requirements for baseline protections @@ -51,15 +53,15 @@ The following tables provide more information about the hardware, firmware, and -> **Important**  The preceding table lists requirements for baseline protections. The following table lists requirements for additional protections. You can use Device Guard with hardware, firmware, and software that support baseline protections, even if they do not support additional protections. +> **Important**  The preceding table lists requirements for baseline protections. The following table lists requirements for improved security. You can use Device Guard with hardware, firmware, and software that support baseline protections, even if they do not support protections for improved security. However, we strongly recommend meeting the requirements for improved security, to significantly strengthen the level of security that Device Guard can provide. -## Device Guard requirements for additional protections +## Device Guard requirements for improved security -The following tables describes additional hardware and firmware requirements, and the additional protections that are available when those requirements are met. We strongly recommend the following additional protections, which help you maximize the benefits that Device Guard can provide. +The following tables describes additional hardware and firmware requirements, and the improved security that is available when those requirements are met. ### 2015 Additional Qualification Requirements for Device Guard (Windows 10, version 1507 and Windows 10, version 1511) -|Additional Protections - requirement | Description | +| Protections for Improved Security - requirement | Description | |---------------------------------------------|----------------------------------------------------| | Firmware: **Securing Boot Configuration and Management** | **Requirements**:
- BIOS password or stronger authentication must be supported.
- In the BIOS configuration, BIOS authentication must be set.
- There must be support for protected BIOS option to configure list of permitted boot devices (for example, “Boot only from internal hard drive”) and boot device order, overriding BOOTORDER modification made by operating system.
- In the BIOS configuration, BIOS options related to security and boot options (list of permitted boot devices, boot order) must be secured to prevent other operating systems from starting and to prevent changes to the BIOS settings.

**Security benefits**:
- BIOS password or stronger authentication helps ensure that only authenticated Platform BIOS administrators can change BIOS settings. This helps protect against a physically present user with BIOS access.
- Boot order when locked provides protection against the computer being booted into WinRE or another operating system on bootable media. | From 8b94e572c540946802a3a066bac9edea7a7acc37 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Sat, 16 Jul 2016 20:15:59 -0700 Subject: [PATCH 45/69] added localization priority --- ...-windows-operating-system-components-to-microsoft-services.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 4c01926131..f127fe3045 100644 --- a/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -6,6 +6,7 @@ keywords: privacy, manage connections to Microsoft ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library +LocalizationPriority: High author: brianlic-msft --- From 11d3a695ab9ae7cdce85ba5b35e72ab5cc7fb073 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Sat, 16 Jul 2016 20:22:17 -0700 Subject: [PATCH 46/69] fixed link --- ...ments-and-deployment-planning-guidelines-for-device-guard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md index 3fe868fb12..9db41d44f1 100644 --- a/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md +++ b/windows/keep-secure/requirements-and-deployment-planning-guidelines-for-device-guard.md @@ -37,7 +37,7 @@ The following tables provide more information about the hardware, firmware, and > **Notes** -> - To understand the requirements in the following tables, you will need to be familiar with the main features in Device Guard: configurable code integrity policies, virtualization-based security (VBS), and Universal Extensible Firmware Interface (UEFI) Secure Boot. For information about these features, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies#how-device-guard-features-help-protect-against-threats). +> - To understand the requirements in the following tables, you will need to be familiar with the main features in Device Guard: configurable code integrity policies, virtualization-based security (VBS), and Universal Extensible Firmware Interface (UEFI) Secure Boot. For information about these features, see [How Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-code-integrity-policies.md#how-device-guard-features-help-protect-against-threats). > - For new computers running Windows 10, Trusted Platform Module (TPM 2.0) must be enabled by default. This requirement is not restated in the tables that follow. ## Device Guard requirements for baseline protections From 5796f0c8fae7af25872357b48b8175e0e5bd518c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 16:20:01 +1000 Subject: [PATCH 47/69] create new individual topics for onboarding --- ...ows-defender-advanced-threat-protection.md | 104 ++++++++++++++ ...ows-defender-advanced-threat-protection.md | 90 ++++++++++++ ...ows-defender-advanced-threat-protection.md | 81 +++++++++++ ...ows-defender-advanced-threat-protection.md | 62 +++++++++ ...ows-defender-advanced-threat-protection.md | 131 +----------------- ...ows-defender-advanced-threat-protection.md | 20 --- 6 files changed, 339 insertions(+), 149 deletions(-) create mode 100644 windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md create mode 100644 windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md create mode 100644 windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md create mode 100644 windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..f169e2f545 --- /dev/null +++ b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md @@ -0,0 +1,104 @@ +--- +title: Configure Windows Defender ATP endpoints using Group Policy +description: Use Group Policy to deploy the configuration package on endpoints so that they are onboarded to the service. +keywords: configure endpoints using group policy, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints, group policy +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: mjcaparas +--- + +## Configure endpoints using Group Policy + +**Applies to:** + +- Windows 10 Insider Preview Build 14332 or later +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +> **Note**  To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. + +1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): + + a. Click **Endpoint Management** on the **Navigation pane**. + + b. Select **Group Policy**, click **Download package** and save the .zip file. + +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a folder called *OptionalParamsPolicy* and the file *WindowsDefenderATPOnboardingScript.cmd*. + +3. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. + +4. In the **Group Policy Management Editor**, go to **Computer configuration**, then **Preferences**, and then **Control panel settings**. + +5. Right-click **Scheduled tasks**, point to **New**, and then click **Immediate task**. + +6. In the **Task** window that opens, go to the **General** tab. Choose the local SYSTEM user account under **Security options**. + +7. Select **Run whether user is logged on or not** and check the **Run with highest privileges** check box. + +8. Go to the **Actions** tab and click **New...** Ensure that **Start a program** is selected in the **Action** field. Enter the file name and location of the shared *WindowsDefenderATPOnboardingScript.cmd* file. + +9. Click **OK** and close any open GPMC windows. + +## Additional Windows Defender ATP configuration settings + +You can use Group Policy (GP) to configure settings, such as settings for the sample sharing used in the deep analysis feature. + +## Configure sample collection settings using Group Policy +1. On your GP management machine, copy the following files from the + configuration package: + + a. Copy _AtpConfiguration.admx_ into _C:\\Windows\\PolicyDefinitions_ + + b. Copy _AtpConfiguration.adml_ into _C:\\Windows\\PolicyDefinitions\\en-US_ + +2. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx), right-click the GPO you want to configure and click **Edit**. + +3. In the **Group Policy Management Editor**, go to **Computer configuration**. + +4. Click **Policies**, then **Administrative templates**. + +5. Click **Windows components** and then **Windows Advanced Threat Protection**. + +6. Choose to enable or disable sample sharing from your endpoints. + +## Offboard endpoints using Group Policy +For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. + +> **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. + +1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): + + a. Click **Endpoint Management** on the **Navigation pane**. + b. Under **Endpoint offboarding** section, select **Group Policy**, click **Download package** and save the .zip file. + +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. + +3. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click Edit. + +4. In the **Group Policy Management Editor**, go to **Computer configuration,** then **Preferences**, and then **Control panel settings**. + +5. Right-click **Scheduled tasks**, point to **New**, and then click **Immediate task**. + +6. In the **Task** window that opens, go to the **General** tab. Choose the local SYSTEM user account under **Security options**. + +7. Select **Run whether user is logged on or not** and check the **Run with highest privileges** check-box. + +8. Go to the **Actions** tab and click **New...**. Ensure that **Start a program** is selected in the **Action** field. Enter the file name and location of the shared *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd* file. + +9. Click **OK** and close any open GPMC windows. + +## Monitor endpoint configuration using Group Policy +With Group Policy there isn’t an option to monitor deployment of policies on the endpoints. Monitoring can be done directly on the portal, or by using the different deployment tools. + +## Monitor endpoints using the portal +1. Go to the [Windows Defender ATP portal](https://securitycenter.windows.com/). +2. Click **Machines view**. +3. Verify that endpoints are appearing. + +> **Note**  It can take several days for endpoints to start showing on the **Machines view**. This includes the time it takes for the policies to be distributed to the endpoint, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting. + + diff --git a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..9d0c4df281 --- /dev/null +++ b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -0,0 +1,90 @@ +--- +title: Configure Windows Defender ATP endpoints using Mobile Device Management tools +description: Use Mobile Device Management tools to deploy the configuration package on endpoints so that they are onboarded to the service. +keywords: configure endpoints using mdm, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints, mdm +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: mjcaparas +--- + +# Configure endpoints using Mobile Device Management tools + +**Applies to:** + +- Windows 10 Insider Preview Build 14332 or later +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +You can use mobile device management (MDM) solutions to configure endpoints. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage endpoints. + +For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723297(v=vs.85).aspx). + +> **Note**   If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later. + +## Configure endpoints using Microsoft Intune + +For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723297(v=vs.85).aspx). + +> **Note**   If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later. + +1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): + + a. Click **Endpoint Management** on the **Navigation pane**. + + b. Select **Microsoft Intune**, click **Download package** and save the .zip file. + +2. Extract the contents of the configuration package to a location on the endpoint you want to onboard (for example, the Desktop). You should have a file called *WindowsDefenderATP.onboarding*. + +3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). + +Onboarding - Use the onboarding policies to deploy configuration settings on endpoints. These policies can be sub-categorized to: + - Onboarding + - Health Status for onboarded machines + - Configuration for onboarded machines + +> **Warning**  These two groups must not be deployed on the same machine at same time, otherwise this will cause unpredictable collisions. + +Policy | OMA-URI | Type | Description | Value +:---|:---|:---|:---|:--- +Onboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding | String | Onboarding | Copy content from onboarding MDM file +Health Status for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | Windows Defender ATP service is running | TRUE + | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | Onboarded to Windows Defender ATP | 1 + | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OrgId | String | Onboarded to Organization ID | Use OrgID from onboarding file + Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | Windows Defender ATP Sample sharing is enabled | 0 or 1
Default value: 1 + + +> **Note**  Policies **Health Status for onboarded machines** and **Health Status for offboarded machines** use read-only properties and can't be remediated. + +## Offboard and monitor endpoints using Mobile Device Management tools + +For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. + +> **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. + +1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): + + a. Click **Endpoint Management** on the **Navigation pane**. + b. Under **Endpoint offboarding** section, select **Group Policy**, click **Download package** and save the .zip file. + +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.offboarding*. + +3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). + +Offboarding - Use the offboarding policies to remove configuration settings on endpoints. These policies can be sub-categorized to: + - Offboarding + - Health Status for offboarded machines + - Configuration for offboarded machines + +Policy | OMA-URI | Type | Description | Value +:---|:---|:---|:---|:--- +Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | String | Offboarding | Copy content from offboarding MDM file + Health Status for offboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | Windows Defender ATP service is not running | FALSE + | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | Offboarded from Windows Defender ATP | 0 + +> **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. + + diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..7536a1eee6 --- /dev/null +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -0,0 +1,81 @@ +--- +title: Configure Windows Defender ATP endpoints using System Center Configuration Manager +description: Use System Center Configuration Manager to deploy the configuration package on endpoints so that they are onboarded to the service. +keywords: configure endpoints using sccm, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints, sccm +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: mjcaparas +--- + +# Configure endpoints with System Center Configuration Manager + +**Applies to:** + +- Windows 10 Insider Preview Build 14332 or later +- Windows Defender Advanced Threat Protection (Windows Defender ATP) + +[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + +## Configure endpoints using System Center Configuration Manager (current branch) version 1606 +System Center Configuration Manager (current branch) version 1606, currently in technical preview, has UI integrated support for configuring and managing Windows Defender ATP on endpoints. For more information, see the [Support for Windows Defender Advanced Threat Protection service](https://technet.microsoft.com/en-us/library/mt706220.aspx#BKMK_ATP) section. + +> **Note**   If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later. + +## Configure endpoints using System Center 2012 Configuration Manager or later versions +You can use System Center Configuration Manager’s existing functionality to create a policy to configure your endpoints. This is supported in System Center 2012 Configuration Manager or later versions, including: System Center 2012 R2 Configuration Manager, System Center Configuration Manager and System Center Configuration Manager (current branch), version 1602 or earlier. + +1. Open the SCCM configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): + + a. Click **Endpoint Management** on the **Navigation pane**. + + b. Select **System Center Configuration Manager**, click **Download package**, and save the .zip file. + +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file called *WindowsDefenderATPOnboardingScript.cmd*. + +3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. + +4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682178.aspx) topic. + + a. Choose a predefined device collection to deploy the package to. + +## Offboard endpoints using System Center Configuration Manager +For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. + +> **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. + +1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): + + a. Click Endpoint Management on the Navigation pane. + b. Under Endpoint offboarding section, select System Center Configuration Manager (current branch) version 1602 or earlier, click Download package, and save the .zip file. + +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. + +3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. + +4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682178.aspx) topic. + + a. Choose a predefined device collection to deploy the package to. + +## Monitor endpoint configuration using System Center Configuration Manager +Monitoring with SCCM consists of two parts: + +1. Confirming the configuration package has been correctly deployed and is running (or has successfully run) on the endpoints in your network. + +2. Checking that the endpoints are compliant with the Windows Defender ATP service (this ensures the endpoint can complete the onboarding process and can continue to report data to the service). + +**To confirm the configuration package has been correctly deployed:** + +1. In the SCCM console, click **Monitoring** at the bottom of the navigation pane. + +2. Click **Overview** and then **Deployments**. + +3. Click on the deployment with the package name. + +4. Review the status indicators under **Completion Statistics** and **Content Status**. + +If there are failed deployments (endpoints with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for more information. + +![SCCM showing successful deployment with no errors](images/sccm-deployment.png) \ No newline at end of file diff --git a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md new file mode 100644 index 0000000000..2209348988 --- /dev/null +++ b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md @@ -0,0 +1,62 @@ +--- +title: Configure Windows Defender ATP endpoints using a local script +description: Use a local script to deploy the configuration package on endpoints so that they are onboarded to the service. +keywords: configure endpoints using a local script, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +author: mjcaparas +--- + +# Configure endpoints using a local script +You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network. + + +1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): + + a. Click **Endpoint Management** on the **Navigation pane**. + + b. Select **Local Script**, click **Download package** and save the .zip file. + + +2. Extract the contents of the configuration package to a location on the endpoint you want to onboard (for example, the Desktop). You should have a file called *WindowsDefenderATPOnboardingScript.cmd*. + +3. Open an elevated command-line prompt on the endpoint and run the script: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + + ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) + +4. Type the location of the script file. If you copied the file to the desktop, type: *`%userprofile%\Desktop\WindowsDefenderATPOnboardingScript.cmd`* + +5. Press the **Enter** key or click **OK**. + +See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for details on how you can manually validate that the endpoint is compliant and correctly reports telemetry. + +## Offboard endpoints using a local script +For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. + +> **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. + +1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): + + a. Click **Endpoint Management** on the **Navigation pane**. + b. Under **Endpoint offboarding** section, select **Group Policy**, click **Download package** and save the .zip file. + +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. + +3. Open an elevated command-line prompt on the endpoint and run the script: + + a. Click **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + + ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) + +4. Type the location of the script file. If you copied the file to the desktop, type: *`%userprofile%\Desktop\WindowsDefenderATPOnboardingScript.cmd`* + +5. Press the **Enter** key or click **OK**. \ No newline at end of file diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index d2cc59754d..8ad58fa146 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -24,137 +24,10 @@ Endpoints in your organization must be configured so that the Windows Defender A Windows Defender ATP supports the following deployment tools and methods: - Group Policy -- System Center Configuration Manager (current branch) version 1606 -- System Center 2012 Configuration manager or later versions -- Mobile Device Management -- Microsoft Intune +- System Center Configuration Manager +- Mobile Device Management (including Microsoft Intune) - Local script -## Configure endpoints with Group Policy - -> **Note**  To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. - -1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - - a. Click **Endpoint Management** on the **Navigation pane**. - - b. Select **Group Policy**, click **Download package** and save the .zip file. - -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a folder called *OptionalParamsPolicy* and the file *WindowsDefenderATPOnboardingScript.cmd*. - -3. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx) (GPMC), right-click the Group Policy Object (GPO) you want to configure and click **Edit**. - -4. In the **Group Policy Management Editor**, go to **Computer configuration**, then **Preferences**, and then **Control panel settings**. - -5. Right-click **Scheduled tasks**, point to **New**, and then click **Immediate task**. - -6. In the **Task** window that opens, go to the **General** tab. Choose the local SYSTEM user account under **Security options**. - -7. Select **Run whether user is logged on or not** and check the **Run with highest privileges** check box. - -8. Go to the **Actions** tab and click **New...** Ensure that **Start a program** is selected in the **Action** field. Enter the file name and location of the shared *WindowsDefenderATPOnboardingScript.cmd* file. - -9. Click **OK** and close any open GPMC windows. - -For additional settings, see the [Additional configuration settings section](additional-configuration-windows-defender-advanced-threat-protection.md). - -## Configure endpoints with System Center Configuration Manager (current branch) version 1606 -System Center Configuration Manager (current branch) version 1606, currently in technical preview, has UI integrated support for configuring and managing Windows Defender ATP on endpoints. For more information, see the [Support for Windows Defender Advanced Threat Protection service](https://technet.microsoft.com/en-us/library/mt706220.aspx#BKMK_ATP) section. - -> **Note**   If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later. - -## Configure endpoints with System Center 2012 Configuration Manager or later versions -You can use System Center Configuration Manager’s existing functionality to create a policy to configure your endpoints. This is supported in System Center 2012 Configuration Manager or later versions, including: System Center 2012 R2 Configuration Manager, System Center Configuration Manager and System Center Configuration Manager (current branch), version 1602 or earlier. - -1. Open the SCCM configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - - a. Click **Endpoint Management** on the **Navigation pane**. - - b. Select **System Center Configuration Manager**, click **Download package**, and save the .zip file. - -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file called *WindowsDefenderATPOnboardingScript.cmd*. - -3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. - -4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682178.aspx) topic. - - a. Choose a predefined device collection to deploy the package to. - -## Configure endpoints with Mobile Device Management tools -You can use mobile device management (MDM) solutions to configure endpoints. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage endpoints. - -For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723297(v=vs.85).aspx). - -> **Note**   If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later. - -## Configure endpoints with Microsoft Intune - -For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723297(v=vs.85).aspx). - -> **Note**   If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later. - -1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - - a. Click **Endpoint Management** on the **Navigation pane**. - - b. Select **Microsoft Intune**, click **Download package** and save the .zip file. - -2. Extract the contents of the configuration package to a location on the endpoint you want to onboard (for example, the Desktop). You should have a file called *WindowsDefenderATP.onboarding*. - -3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). - -These policies are categorized into two groups: -- Onboarding - Use the onboarding policies to deploy configuration settings on endpoints. These policies can be sub-categorized to: - - Onboarding - - Health Status for onboarded machines - - Configuration for onboarded machines -- Offboarding - Use the offboarding policies to remove configuration settings on endpoints. These policies can be sub-categorized to: - - Offboarding - - Health Status for offboarded machines - - Configuration for offboarded machines - -> **Warning**  These two groups must not be deployed on the same machine at same time, otherwise this will cause unpredictable collisions. - -Policy | OMA-URI | Type | Description | Value -:---|:---|:---|:---|:--- -Onboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding | String | Onboarding | Copy content from onboarding MDM file -Health Status for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | Windows Defender ATP service is running | TRUE - | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | Onboarded to Windows Defender ATP | 1 - | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OrgId | String | Onboarded to Organization ID | Use OrgID from onboarding file - Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | Windows Defender ATP Sample sharing is enabled | 0 or 1
Default value: 1 - Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | String | Offboarding | Copy content from offboarding MDM file - Health Status for offboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | Windows Defender ATP service is not running | FALSE - | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | Offboarded from Windows Defender ATP | 0 - -> **Note**  Policies **Health Status for onboarded machines** and **Health Status for offboarded machines** use read-only properties and can't be remediated. - -## Configure endpoints individually with a local script - -You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network. - - -1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - - a. Click **Endpoint Management** on the **Navigation pane**. - - b. Select **Local Script**, click **Download package** and save the .zip file. - - -2. Extract the contents of the configuration package to a location on the endpoint you want to onboard (for example, the Desktop). You should have a file called *WindowsDefenderATPOnboardingScript.cmd*. - -3. Open an elevated command-line prompt on the endpoint and run the script: - - a. Click **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - - ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) - -4. Type the location of the script file. If you copied the file to the desktop, type: *`%userprofile%\Desktop\WindowsDefenderATPOnboardingScript.cmd`* - -5. Press the **Enter** key or click **OK**. - -See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for details on how you can manually validate that the endpoint is compliant and correctly reports telemetry. ## Related topics - [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md index 8babe1f172..1fbfe3d5ef 100644 --- a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md @@ -36,27 +36,7 @@ Monitoring can be done directly on the portal, or by using System Center Configu > **Note**  It can take several days for endpoints to start showing on the **Machines view**. This includes the time it takes for the policies to be distributed to the endpoint, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting. -## Monitor with System Center Configuration Manager -Monitoring with SCCM consists of two parts: - -1. Confirming the configuration package has been correctly deployed and is running (or has successfully run) on the endpoints in your network. - -2. Checking that the endpoints are compliant with the Windows Defender ATP service (this ensures the endpoint can complete the onboarding process and can continue to report data to the service). - -**To confirm the configuration package has been correctly deployed:** - -1. In the SCCM console, click **Monitoring** at the bottom of the navigation pane. - -2. Click **Overview** and then **Deployments**. - -3. Click on the deployment with the package name. - -4. Review the status indicators under **Completion Statistics** and **Content Status**. - -If there are failed deployments (endpoints with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for more information. - -![SCCM showing successful deployment with no errors](images/sccm-deployment.png) ## Related topics From 6ba7e97cc95453970e87d5bbf99b81e424c1e9fa Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 16:28:50 +1000 Subject: [PATCH 48/69] add new topics in TOC --- windows/keep-secure/TOC.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 6d463f47d2..0d946ebdf1 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -682,6 +682,13 @@ #### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) #### [Onboard endpoints and set up access](onboard-configure-windows-defender-advanced-threat-protection.md) ##### [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) +###### [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) +###### [Configure endpoints using System Security Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) +####### [Configure endpoints using SCCM 2016](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-system-center-configuration-manager-(current-branch)-version-1606)) +####### [Configure endpoints using SCCM 2012](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-system-center-configuration-manager-2012-or-later-versions) +###### [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) +####### [Configure endpoints using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune) +###### [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) ##### [Configure proxy and Internet settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) ##### [Additional configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) ##### [Monitor onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) From 1a852d7c04059ad22b1404146ae2e61da1aa080f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 17:51:45 +1000 Subject: [PATCH 49/69] fix extension names --- windows/keep-secure/TOC.md | 4 +--- ...-windows-defender-advanced-threat-protection.md | 5 +++-- ...-windows-defender-advanced-threat-protection.md | 6 ++++-- ...-windows-defender-advanced-threat-protection.md | 14 ++++++++------ ...-windows-defender-advanced-threat-protection.md | 4 ++-- 5 files changed, 18 insertions(+), 15 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 0d946ebdf1..33111e697a 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -684,14 +684,12 @@ ##### [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) ###### [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) ###### [Configure endpoints using System Security Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -####### [Configure endpoints using SCCM 2016](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-system-center-configuration-manager-(current-branch)-version-1606)) +####### [Configure endpoints using SCCM 1606](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-system-center-configuration-manager-(current-branch)-version-1606)) ####### [Configure endpoints using SCCM 2012](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-system-center-configuration-manager-2012-or-later-versions) ###### [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) ####### [Configure endpoints using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune) ###### [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) ##### [Configure proxy and Internet settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) -##### [Additional configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) -##### [Monitor onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) ##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) #### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) #### [Use the Windows Defender ATP portal](use-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md index f169e2f545..4a37f932dc 100644 --- a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md @@ -21,6 +21,7 @@ author: mjcaparas > **Note**  To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. +### Onboard endpoints 1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Endpoint Management** on the **Navigation pane**. @@ -47,7 +48,7 @@ author: mjcaparas You can use Group Policy (GP) to configure settings, such as settings for the sample sharing used in the deep analysis feature. -## Configure sample collection settings using Group Policy +### Configure sample collection settings using Group Policy 1. On your GP management machine, copy the following files from the configuration package: @@ -65,7 +66,7 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa 6. Choose to enable or disable sample sharing from your endpoints. -## Offboard endpoints using Group Policy +### Offboard endpoints For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. > **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. diff --git a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index 9d0c4df281..72fa25d9dd 100644 --- a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -31,6 +31,8 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre > **Note**   If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later. +### Onboard and monitor endpoints + 1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Endpoint Management** on the **Navigation pane**. @@ -59,7 +61,7 @@ Health Status for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThrea > **Note**  Policies **Health Status for onboarded machines** and **Health Status for offboarded machines** use read-only properties and can't be remediated. -## Offboard and monitor endpoints using Mobile Device Management tools +### Offboard and monitor endpoints For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. @@ -70,7 +72,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days a. Click **Endpoint Management** on the **Navigation pane**. b. Under **Endpoint offboarding** section, select **Group Policy**, click **Download package** and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.offboarding*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATP_valid_until_YYYY-MM-DD.offboarding*. 3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index 7536a1eee6..c4ac346a95 100644 --- a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security author: mjcaparas --- -# Configure endpoints with System Center Configuration Manager +# Configure endpoints uisng System Center Configuration Manager **Applies to:** @@ -24,8 +24,10 @@ System Center Configuration Manager (current branch) version 1606, currently in > **Note**   If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later. -## Configure endpoints using System Center 2012 Configuration Manager or later versions -You can use System Center Configuration Manager’s existing functionality to create a policy to configure your endpoints. This is supported in System Center 2012 Configuration Manager or later versions, including: System Center 2012 R2 Configuration Manager, System Center Configuration Manager and System Center Configuration Manager (current branch), version 1602 or earlier. +## Configure endpoints using System Center Configuration Manager (current branch) version 1602 or earlier versions +You can use System Center Configuration Manager’s existing functionality to create a policy to configure your endpoints. This is supported in System Center Configuration Manager (current branch), version 1602 or earlier, including: System Center 2012 R2 Configuration Manager and System Center 2012 Configuration Manager. + +### Onboard endpoints 1. Open the SCCM configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): @@ -41,7 +43,7 @@ You can use System Center Configuration Manager’s existing functionality to cr a. Choose a predefined device collection to deploy the package to. -## Offboard endpoints using System Center Configuration Manager +### Offboard endpoints For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. > **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. @@ -51,7 +53,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days a. Click Endpoint Management on the Navigation pane. b. Under Endpoint offboarding section, select System Center Configuration Manager (current branch) version 1602 or earlier, click Download package, and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP_valid_until_YYYY-MM-DD.cmd*. 3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. @@ -59,7 +61,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days a. Choose a predefined device collection to deploy the package to. -## Monitor endpoint configuration using System Center Configuration Manager +### Monitor endpoint configuration using System Center Configuration Manager Monitoring with SCCM consists of two parts: 1. Confirming the configuration package has been correctly deployed and is running (or has successfully run) on the endpoints in your network. diff --git a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md index 2209348988..61c7f401cc 100644 --- a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md @@ -47,7 +47,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days a. Click **Endpoint Management** on the **Navigation pane**. b. Under **Endpoint offboarding** section, select **Group Policy**, click **Download package** and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_\.cmd*. 3. Open an elevated command-line prompt on the endpoint and run the script: @@ -57,6 +57,6 @@ For security reasons, the package used to offboard endpoints will expire 30 days ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) -4. Type the location of the script file. If you copied the file to the desktop, type: *`%userprofile%\Desktop\WindowsDefenderATPOnboardingScript.cmd`* +4. Type the location of the script file. If you copied the file to the desktop, type: *%userprofile%\Desktop\WindowsDefenderATPOffboardingScript_valid_until_\.cmd* 5. Press the **Enter** key or click **OK**. \ No newline at end of file From 42ad97dacef62abc76f51a7f8fb76b7687ed74a0 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 18:24:44 +1000 Subject: [PATCH 50/69] add related topics, update table --- ...p-windows-defender-advanced-threat-protection.md | 4 ++++ ...m-windows-defender-advanced-threat-protection.md | 4 ++++ ...m-windows-defender-advanced-threat-protection.md | 7 ++++++- ...t-windows-defender-advanced-threat-protection.md | 8 +++++++- ...s-windows-defender-advanced-threat-protection.md | 13 +++++++------ ...e-windows-defender-advanced-threat-protection.md | 2 -- 6 files changed, 28 insertions(+), 10 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md index 4a37f932dc..60cced9f5d 100644 --- a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md @@ -103,3 +103,7 @@ With Group Policy there isn’t an option to monitor deployment of policies on t > **Note**  It can take several days for endpoints to start showing on the **Machines view**. This includes the time it takes for the policies to be distributed to the endpoint, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting. +## Related topics +- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) +- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) +- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index 72fa25d9dd..1b027dbcf2 100644 --- a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -90,3 +90,7 @@ Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | > **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. +## Related topics +- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) +- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) +- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index c4ac346a95..d4cb1cc475 100644 --- a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -80,4 +80,9 @@ Monitoring with SCCM consists of two parts: If there are failed deployments (endpoints with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the endpoints. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) topic for more information. -![SCCM showing successful deployment with no errors](images/sccm-deployment.png) \ No newline at end of file +![SCCM showing successful deployment with no errors](images/sccm-deployment.png) + +## Related topics +- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) +- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) +- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md index 61c7f401cc..ee77bcc824 100644 --- a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md @@ -59,4 +59,10 @@ For security reasons, the package used to offboard endpoints will expire 30 days 4. Type the location of the script file. If you copied the file to the desktop, type: *%userprofile%\Desktop\WindowsDefenderATPOffboardingScript_valid_until_\.cmd* -5. Press the **Enter** key or click **OK**. \ No newline at end of file +5. Press the **Enter** key or click **OK**. + + +## Related topics +- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) +- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) +- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md index 8ad58fa146..0028b5478b 100644 --- a/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md @@ -28,9 +28,10 @@ Windows Defender ATP supports the following deployment tools and methods: - Mobile Device Management (including Microsoft Intune) - Local script - -## Related topics -- [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) -- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) -- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) -- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) +## In this section +Topic | Description +:---|:--- +[Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) | Use Group Policy to deploy the configuration package on endpoints. +[Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) | You can use either use System Center Configuration Manager (current branch) version 1606 or System Center Configuration Manager(current branch) version 1602 or earlier to deploy the configuration package on endpoints. +[Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) | Use Mobile Device Managment tools or Microsoft Intune to deploy the configuration package on endpoints. +[Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) | Learn how to use the local script to deploy the configuration package on endpoints. diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index 668883a264..3cfcbb1cde 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -36,6 +36,4 @@ Topic | Description :---|:--- [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn about the tools and methods you can use to configure endpoints in your enterprise. [Configure proxy and Internet settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)| Enable communication with the Windows Defender ATP cloud service by configuring the proxy and Internet connectivity settings. -[Additional configuration settings] (additional-configuration-windows-defender-advanced-threat-protection.md) | Learn how to configure settings for sample sharing used in the deep analysis feature. -[Monitor onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) | Learn how you can monitor the onboarding to ensure your endpoints are correctly configured and are sending telemetry reports. [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) | Learn about resolving issues that might arise during onboarding. From 503fcca7068431ff5392fdfcf3db2e8baf2da72d Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 18:37:45 +1000 Subject: [PATCH 51/69] fixing anchor links --- windows/keep-secure/TOC.md | 2 +- ...ndpoints-sccm-windows-defender-advanced-threat-protection.md | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 33111e697a..9275942925 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -684,7 +684,7 @@ ##### [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) ###### [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) ###### [Configure endpoints using System Security Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -####### [Configure endpoints using SCCM 1606](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-system-center-configuration-manager-(current-branch)-version-1606)) +####### [Configure endpoints using SCCM 1606]() ####### [Configure endpoints using SCCM 2012](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-system-center-configuration-manager-2012-or-later-versions) ###### [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) ####### [Configure endpoints using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune) diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index d4cb1cc475..0def99f471 100644 --- a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -19,6 +19,7 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] + ## Configure endpoints using System Center Configuration Manager (current branch) version 1606 System Center Configuration Manager (current branch) version 1606, currently in technical preview, has UI integrated support for configuring and managing Windows Defender ATP on endpoints. For more information, see the [Support for Windows Defender Advanced Threat Protection service](https://technet.microsoft.com/en-us/library/mt706220.aspx#BKMK_ATP) section. From 61b75109aa088eb6cc5aec05cc7dcc760c149566 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 19:11:25 +1000 Subject: [PATCH 52/69] fixing anchor link --- windows/keep-secure/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 9275942925..75bdcca63f 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -684,7 +684,7 @@ ##### [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) ###### [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) ###### [Configure endpoints using System Security Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -####### [Configure endpoints using SCCM 1606]() +####### [Configure endpoints using SCCM 1606] ####### [Configure endpoints using SCCM 2012](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-system-center-configuration-manager-2012-or-later-versions) ###### [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) ####### [Configure endpoints using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune) From f25776cd8bb71c6bdd4189c9b5f871405282eec1 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 19:46:31 +1000 Subject: [PATCH 53/69] update anchor, update toc, update title --- windows/keep-secure/TOC.md | 2 +- ...-endpoints-gp-windows-defender-advanced-threat-protection.md | 2 +- ...ndpoints-sccm-windows-defender-advanced-threat-protection.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 75bdcca63f..634f47eedf 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -684,7 +684,7 @@ ##### [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) ###### [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) ###### [Configure endpoints using System Security Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -####### [Configure endpoints using SCCM 1606] +####### [Configure endpoints using SCCM 1606](#sccm1606) ####### [Configure endpoints using SCCM 2012](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-system-center-configuration-manager-2012-or-later-versions) ###### [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) ####### [Configure endpoints using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune) diff --git a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md index 60cced9f5d..2f8fc98460 100644 --- a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security author: mjcaparas --- -## Configure endpoints using Group Policy +# Configure endpoints using Group Policy **Applies to:** diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index 0def99f471..d33636f939 100644 --- a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -19,7 +19,7 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - + ## Configure endpoints using System Center Configuration Manager (current branch) version 1606 System Center Configuration Manager (current branch) version 1606, currently in technical preview, has UI integrated support for configuring and managing Windows Defender ATP on endpoints. For more information, see the [Support for Windows Defender Advanced Threat Protection service](https://technet.microsoft.com/en-us/library/mt706220.aspx#BKMK_ATP) section. From 3ae5868b0b944fd20678c733413e25b743dd9acd Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 19:56:00 +1000 Subject: [PATCH 54/69] fixing link --- windows/keep-secure/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 634f47eedf..4847d00389 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -684,7 +684,7 @@ ##### [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) ###### [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) ###### [Configure endpoints using System Security Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -####### [Configure endpoints using SCCM 1606](#sccm1606) +####### [Configure endpoints using SCCM 1606](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#sccm1606) ####### [Configure endpoints using SCCM 2012](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-system-center-configuration-manager-2012-or-later-versions) ###### [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) ####### [Configure endpoints using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune) From 21fba964ecf0d96ad25481c6bb68f3ee7f310f24 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 20:02:43 +1000 Subject: [PATCH 55/69] remove old text topic --- ...gure-windows-defender-advanced-threat-protection.md | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md index 3cfcbb1cde..942dfa02ee 100644 --- a/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/onboard-configure-windows-defender-advanced-threat-protection.md @@ -21,16 +21,6 @@ author: iaanw You need to onboard to Windows Defender ATP before you can use the service. - - - - ## In this section Topic | Description :---|:--- From f6c56953a10819057c3a2ad897e489655ab086a4 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 20:03:56 +1000 Subject: [PATCH 56/69] fix typo --- ...dpoints-sccm-windows-defender-advanced-threat-protection.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index d33636f939..fef8fdb284 100644 --- a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -10,7 +10,8 @@ ms.pagetype: security author: mjcaparas --- -# Configure endpoints uisng System Center Configuration Manager +# Configure endpoints using System Center Configuration Manager + **Applies to:** From dc779d17515afb8f4d424f428a11c82cd9ddd9b1 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 20:18:02 +1000 Subject: [PATCH 57/69] test link --- ...ndpoints-sccm-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index fef8fdb284..6c7eaeb7d1 100644 --- a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -20,7 +20,7 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - + ## Configure endpoints using System Center Configuration Manager (current branch) version 1606 System Center Configuration Manager (current branch) version 1606, currently in technical preview, has UI integrated support for configuring and managing Windows Defender ATP on endpoints. For more information, see the [Support for Windows Defender Advanced Threat Protection service](https://technet.microsoft.com/en-us/library/mt706220.aspx#BKMK_ATP) section. From 6234a105d3465fdf03f088b3a3481f56f634ec31 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 20:30:16 +1000 Subject: [PATCH 58/69] fix Related topics --- ...ows-defender-advanced-threat-protection.md | 47 ------- ...ows-defender-advanced-threat-protection.md | 3 - ...ows-defender-advanced-threat-protection.md | 3 - ...ows-defender-advanced-threat-protection.md | 46 ------- ...ows-defender-advanced-threat-protection.md | 121 ------------------ ...ows-defender-advanced-threat-protection.md | 4 +- 6 files changed, 1 insertion(+), 223 deletions(-) delete mode 100644 windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md delete mode 100644 windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md delete mode 100644 windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md diff --git a/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md b/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md deleted file mode 100644 index 93d466aa32..0000000000 --- a/windows/keep-secure/additional-configuration-windows-defender-advanced-threat-protection.md +++ /dev/null @@ -1,47 +0,0 @@ ---- -title: Additional Windows Defender ATP configuration settings -description: Use the Group Policy Console to configure settings that enable sample sharing from your endpoints. These settings are used in the deep analysis feature. -keywords: configuration settings, Windows Defender ATP configuration settings, Windows Defender Advanced Threat Protection configuration settings, group policy Management Editor, computer configuration, policies, administrative templates, -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.pagetype: security -ms.sitesec: library -author: mjcaparas ---- - -# Additional Windows Defender ATP configuration settings - -**Applies to** - -- Windows 10 Insider Preview Build 14332 or later -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -You can use Group Policy (GP) to configure settings, such as settings for the sample sharing used in the deep analysis feature. - -## Configure sample collection settings with Group Policy -1. On your GP management machine, copy the following files from the - configuration package: - - a. Copy _AtpConfiguration.admx_ into _C:\\Windows\\PolicyDefinitions_ - - b. Copy _AtpConfiguration.adml_ into _C:\\Windows\\PolicyDefinitions\\en-US_ - -2. Open the [Group Policy Management Console](https://technet.microsoft.com/en-us/library/cc731212.aspx), right-click the GPO you want to configure and click **Edit**. - -3. In the **Group Policy Management Editor**, go to **Computer configuration**. - -4. Click **Policies**, then **Administrative templates**. - -5. Click **Windows components** and then **Windows Advanced Threat Protection**. - -6. Choose to enable or disable sample sharing from your endpoints. - -## Related topics - -- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -- [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) -- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) -- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md index 0c31cc5832..27177d0829 100644 --- a/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-proxy-internet-windows-defender-advanced-threat-protection.md @@ -179,8 +179,5 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover If the any of the verification steps indicate a fail, then verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs. ## Related topics - - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) -- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) - [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md index 6e239a2aea..f019d14fdf 100644 --- a/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/event-error-codes-windows-defender-advanced-threat-protection.md @@ -242,9 +242,6 @@ See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defen ## Related topics - - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) - [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) -- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) -- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) - [Troubleshoot Windows Defender ATP](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md deleted file mode 100644 index 1fbfe3d5ef..0000000000 --- a/windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md +++ /dev/null @@ -1,46 +0,0 @@ ---- -title: Monitor Windows Defender ATP onboarding -description: Monitor the onboarding of the Windows Defender ATP service to ensure your endpoints are correctly configured and are sending telemetry reports. -keywords: monitor onboarding, monitor Windows Defender ATP onboarding, monitor Windows Defender Advanced Threat Protection onboarding -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -author: mjcaparas ---- - -# Monitor Windows Defender Advanced Threat Protection onboarding - -**Applies to:** - -- Windows 10 Insider Preview Build 14322 or later -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -You can monitor the onboarding of the Windows Defender ATP service to ensure your endpoints are correctly configured and are sending telemetry reports. - -You might need to monitor the onboarding if the package did not configure the registry correctly, or the reporting client did not start or execute correctly. - -Monitoring can be done directly on the portal, or by using System Center Configuration Manager (SCCM). - -## Monitor with the portal - -1. Go to the [Windows Defender ATP portal](https://securitycenter.windows.com/). - -2. Click **Machines view**. - -3. Verify that endpoints are appearing. - - -> **Note**  It can take several days for endpoints to start showing on the **Machines view**. This includes the time it takes for the policies to be distributed to the endpoint, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting. - - - -## Related topics - -- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -- [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) -- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) -- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md deleted file mode 100644 index 790d75a1dd..0000000000 --- a/windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -title: Windows Defender ATP service onboarding -description: Assign users to the Windows Defender ATP service application in Azure Active Directory to grant access to the portal. -keywords: service onboarding, Windows Defender Advanced Threat Protection service onboarding, manage users, -search.product: eADQiWindows 10XVcnh -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -author: mjcaparas ---- - -# Windows Defender ATP service onboarding - -**Applies to:** - -- Windows 10 Insider Preview Build 14332 or later -- Azure Active Directory -- Windows Defender Advanced Threat Protection (Windows Defender ATP) - -[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -You have to assign users to the Windows Defender ATP Service application in Azure Active Directory (AAD) before they can access the portal. - -**Manage user access to the Windows Defender ATP portal**: - -1. When you first go to the [Windows Defender ATP portal](https://securitycenter.windows.com/) and your directory does not - have users assigned to the Windows ATP Service application, you will - be directed to open the [Microsoft Azure Dashboard](https://portal.azure.com) to manage user access. - - > **Note**  In AAD, a directory is essentially a tenant. See the [Azure AD documentation](https://msdn.microsoft.com/en-us/library/azure/jj573650.aspx) for more information on how tenants work with AAD. - -2. Ensure you have logged in to Microsoft Azure with an account that - has permissions to assign users to an application in AAD. You might - need to sign out of Microsoft Azure and then sign back in again if - you used a different account to sign in to the Windows Defender ATP - portal: - - a. On the top menu, click the signed-in user’s name. - - b. Click **Sign out**. - - ![Azure sign out](images/azure-signout.png) - - c. Go the [Microsoft Azure Dashboard](https://portal.azure.com) again where you will be asked to sign in. - - d. Sign in with the correct user name and password for an account that has permissions to assign users in AAD. - -3. On the **Microsoft Azure Dashboard**, click **Browse** in the navigation pane and then click **Active Directory** to open the [Azure Management Portal](https://manage.windowsazure.com/). - - ![Azure Active Directory menu](images/azure-browse.png) - -4. You might need to open the **Directory** section of the [Azure Management Portal](https://manage.windowsazure.com/) so you can access your directory. There are two ways you can do this: - - a. Click the arrow icon above the list of directories to see the full list of directories in the main area of the portal. - - ![Azure organization menu](images/azure-org-directory.png) - - b. Scroll down in the navigation pane and click **Active Directory**. - - ![Azure active directory](images/azure-active-directory.png) - -5. Click the directory that contains the Windows Defender ATP application. In the following example, the directory is - called **Contoso**. - - ![Azure active directory list](images/azure-active-directory-list.png) - - > **Note**  You can also access your directory by going straight to the [Azure Management Portal](https://manage.windowsazure.com/), clicking Active Directory and then finding your directory in the list. - -6. Click **Applications** from the top menu bar. - - ![Example organization in Azure Active Directory](images/contoso.png) - -7. Click the **Windows ATP Service** application. The dashboard for the application is shown. - - ![Example selected organization in Azure Active Directory](images/contoso-application.png) - - > **Note**  The application might have a slightly different name than the one shown here. It might be called **Windows Defender ATP Service**. - -8. Click **Users** from the top menu bar. A list of users that are in the directory is displayed. - - ![Example windows atp service users](images/windows-atp-service.png) - - ![Example user assignment to the windows atp service](images/assign-users.png) - - > **Note**  If you do not normally work with AAD, you might not see any users in the directory, or we might have created a test tenant specifically for a single user’s account. See the [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) section for instructions on adding users to a directory. - -9. Select the user you want manage. - -10. Click **Assign**. - -11. Confirm that you want to enable access for the user from the notification bar. If you click **Yes**, the user is given access to the Windows Defender ATP portal. One or more progress bars will appear that indicates the user is being assigned a role, and you will see confirmation messages. You don’t need to do anything with the messages, they will go away after a short period of time. - - ![Confirmation page to enable access to users](images/confirm-user-access.png) - -12. To remove the user's access, click **Remove**. - -13. Select the **Disable access to this app for the selected users** checkbox, and then click **Complete** ![Complete icon](images/check-icon.png). One or more progress bars will appear, followed by confirmation messages. The messages will disappear after a short period. - - ![Remove menu](images/remove-menu.png) - -14. To remove the access for all users, click **Manage access**. If you click **Complete** ![Complete icon](images/check-icon.png), you will not see the Windows ATP Service in the list of applications in your directory. - - > **Note**  If you want to give access to users again, see the Manage access for all users in Azure Active Directory topic in [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md). - -15. You can continue assigning roles for other users in your organization now, or you can return to the Windows Defender ATP portal to complete the service onboarding wizard. - - > **Note**  You need to assign roles for every user in your organization that requires access to the Windows Defender ATP portal. You can assign roles at any time by going to the Azure Management Portal, clicking **Active Directory**, and then finding your directory in the list and following the steps above. - -When you have finished assigning roles, return to the [Windows Defender ATP portal](https://securitycenter.windows.com) and refresh the -page. - -Follow the steps in the onboarding wizard to complete the onboarding process. - -At the end of the wizard, you can download the Group Policy configuration package which you will use to configure endpoints on your network. You can also download the package from the **Endpoint Management** menu on the portal after you have completed the onboarding wizard. - -## Related topics -- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) -- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) -- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) -- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md index 5cb5400bb0..b9baeb947e 100644 --- a/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md @@ -436,8 +436,6 @@ Log in to the application in the Azure Management Portal again: --> ## Related topics - - [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) - [Configure endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) -- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md) -- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md) + From 2a590e99160f488b3f89d48c1f4777321ca11fb7 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 20:40:33 +1000 Subject: [PATCH 59/69] swap description and value from table --- ...dm-windows-defender-advanced-threat-protection.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index 1b027dbcf2..a06b2c7212 100644 --- a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -50,13 +50,13 @@ Onboarding - Use the onboarding policies to deploy configuration settings on end > **Warning**  These two groups must not be deployed on the same machine at same time, otherwise this will cause unpredictable collisions. -Policy | OMA-URI | Type | Description | Value +Policy | OMA-URI | Type | Value | Description :---|:---|:---|:---|:--- -Onboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding | String | Onboarding | Copy content from onboarding MDM file -Health Status for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | Windows Defender ATP service is running | TRUE - | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | Onboarded to Windows Defender ATP | 1 - | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OrgId | String | Onboarded to Organization ID | Use OrgID from onboarding file - Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | Windows Defender ATP Sample sharing is enabled | 0 or 1
Default value: 1 +Onboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding | String | Copy content from onboarding MDM file | Onboarding +Health Status for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | TRUE | Windows Defender ATP service is running + | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 1 | Onboarded to Windows Defender ATP + | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OrgId | String | Use OrgID from onboarding file | Onboarded to Organization ID + Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | 0 or 1
Default value: 1 | Windows Defender ATP Sample sharing is enabled > **Note**  Policies **Health Status for onboarded machines** and **Health Status for offboarded machines** use read-only properties and can't be remediated. From 430159e5140f2b40603bbf9d1e14879f038f5889 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 20:42:02 +1000 Subject: [PATCH 60/69] add anchor, update TOC --- windows/keep-secure/TOC.md | 2 +- ...ndpoints-sccm-windows-defender-advanced-threat-protection.md | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 4847d00389..aea7299ce0 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -685,7 +685,7 @@ ###### [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) ###### [Configure endpoints using System Security Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) ####### [Configure endpoints using SCCM 1606](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#sccm1606) -####### [Configure endpoints using SCCM 2012](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-system-center-configuration-manager-2012-or-later-versions) +####### [Configure endpoints using SCCM 2012](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#sccm1602) ###### [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) ####### [Configure endpoints using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune) ###### [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index 6c7eaeb7d1..a46848c5fc 100644 --- a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -26,6 +26,7 @@ System Center Configuration Manager (current branch) version 1606, currently in > **Note**   If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later. + ## Configure endpoints using System Center Configuration Manager (current branch) version 1602 or earlier versions You can use System Center Configuration Manager’s existing functionality to create a policy to configure your endpoints. This is supported in System Center Configuration Manager (current branch), version 1602 or earlier, including: System Center 2012 R2 Configuration Manager and System Center 2012 Configuration Manager. From d2d42ea05710513e32aeb27117cc023720841e4a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 20:45:36 +1000 Subject: [PATCH 61/69] fix dead link --- ...stigate-files-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md index c7e1a14928..5dfb3959f9 100644 --- a/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md @@ -121,7 +121,7 @@ HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection Value = 0 - block sample collection Value = 1 - allow sample collection ``` -5. Change the organizational unit through the Group Policy. See [Configure with Group Policy](additional-configuration-windows-defender-advanced-threat-protection.md#configure-with-group-policy). +5. Change the organizational unit through the Group Policy. See [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md). 6. If these steps do not resolve the issue, contact [winatp@microsoft.com](mailto:winatp@microsoft.com). > **Note**  If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. From 037efac74643b5c26a0c2d26c0168054be6b57b8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 21:07:43 +1000 Subject: [PATCH 62/69] remove extra note, update file extension --- ...-windows-defender-advanced-threat-protection.md | 2 +- ...-windows-defender-advanced-threat-protection.md | 14 ++++++-------- ...-windows-defender-advanced-threat-protection.md | 2 +- 3 files changed, 8 insertions(+), 10 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md index 2f8fc98460..9f63869e32 100644 --- a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md @@ -19,7 +19,7 @@ author: mjcaparas [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -> **Note**  To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. +> **Note**  To use Group Policy (GP) updates to deploy the package, you must be on Windows Server 2008 R2 or later. ### Onboard endpoints 1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): diff --git a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index a06b2c7212..4d464268ea 100644 --- a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -29,8 +29,6 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723297(v=vs.85).aspx). -> **Note**   If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later. - ### Onboard and monitor endpoints 1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): @@ -44,9 +42,9 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre 3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). Onboarding - Use the onboarding policies to deploy configuration settings on endpoints. These policies can be sub-categorized to: - - Onboarding - - Health Status for onboarded machines - - Configuration for onboarded machines +- Onboarding +- Health Status for onboarded machines +- Configuration for onboarded machines > **Warning**  These two groups must not be deployed on the same machine at same time, otherwise this will cause unpredictable collisions. @@ -77,9 +75,9 @@ For security reasons, the package used to offboard endpoints will expire 30 days 3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). Offboarding - Use the offboarding policies to remove configuration settings on endpoints. These policies can be sub-categorized to: - - Offboarding - - Health Status for offboarded machines - - Configuration for offboarded machines +- Offboarding +- Health Status for offboarded machines +- Configuration for offboarded machines Policy | OMA-URI | Type | Description | Value :---|:---|:---|:---|:--- diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index a46848c5fc..2fab49e4ef 100644 --- a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -56,7 +56,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days a. Click Endpoint Management on the Navigation pane. b. Under Endpoint offboarding section, select System Center Configuration Manager (current branch) version 1602 or earlier, click Download package, and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP_valid_until_YYYY-MM-DD.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. 3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic. From a1772b7bc300ecc680ecda8f740f1d1e65eeba02 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 21:28:46 +1000 Subject: [PATCH 63/69] updates based on Naama's feedback --- windows/keep-secure/TOC.md | 2 -- ...indows-defender-advanced-threat-protection.md | 8 +++++--- ...indows-defender-advanced-threat-protection.md | 16 ++++++++-------- ...indows-defender-advanced-threat-protection.md | 15 +++++++++------ ...indows-defender-advanced-threat-protection.md | 3 ++- 5 files changed, 24 insertions(+), 20 deletions(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index aea7299ce0..c34ebed59a 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -684,8 +684,6 @@ ##### [Configure endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) ###### [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) ###### [Configure endpoints using System Security Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -####### [Configure endpoints using SCCM 1606](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#sccm1606) -####### [Configure endpoints using SCCM 2012](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#sccm1602) ###### [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) ####### [Configure endpoints using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune) ###### [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md index 9f63869e32..d8db5694c4 100644 --- a/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-gp-windows-defender-advanced-threat-protection.md @@ -48,7 +48,7 @@ author: mjcaparas You can use Group Policy (GP) to configure settings, such as settings for the sample sharing used in the deep analysis feature. -### Configure sample collection settings using Group Policy +### Configure sample collection settings 1. On your GP management machine, copy the following files from the configuration package: @@ -74,6 +74,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days 1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Endpoint Management** on the **Navigation pane**. + b. Under **Endpoint offboarding** section, select **Group Policy**, click **Download package** and save the .zip file. 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. @@ -92,7 +93,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days 9. Click **OK** and close any open GPMC windows. -## Monitor endpoint configuration using Group Policy +## Monitor endpoint configuration With Group Policy there isn’t an option to monitor deployment of policies on the endpoints. Monitoring can be done directly on the portal, or by using the different deployment tools. ## Monitor endpoints using the portal @@ -106,4 +107,5 @@ With Group Policy there isn’t an option to monitor deployment of policies on t ## Related topics - [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) - [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) -- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) +- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index 4d464268ea..410e537b06 100644 --- a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -14,7 +14,7 @@ author: mjcaparas **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Insider Preview Build 14379 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -35,9 +35,9 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre a. Click **Endpoint Management** on the **Navigation pane**. - b. Select **Microsoft Intune**, click **Download package** and save the .zip file. + b. Select **Mobile Device Management/Microsoft Intune**, click **Download package** and save the .zip file. -2. Extract the contents of the configuration package to a location on the endpoint you want to onboard (for example, the Desktop). You should have a file called *WindowsDefenderATP.onboarding*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file called *WindowsDefenderATP.onboarding*. 3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). @@ -68,9 +68,10 @@ For security reasons, the package used to offboard endpoints will expire 30 days 1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): a. Click **Endpoint Management** on the **Navigation pane**. - b. Under **Endpoint offboarding** section, select **Group Policy**, click **Download package** and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATP_valid_until_YYYY-MM-DD.offboarding*. + b. Under **Endpoint offboarding** section, select **Mobile Device Management /Microsoft Intune**, click **Download package** and save the .zip file. + +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATP_valid_until_YYYY-MM-DD.offboarding*. 3. Use the Microsoft Intune custom configuration policy to deploy the following supported OMA-URI settings. For more information on Microsoft Intune policy settings see, [Windows 10 policy settings in Microsoft Intune](https://docs.microsoft.com/en-us/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune). @@ -85,10 +86,9 @@ Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | Health Status for offboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | Windows Defender ATP service is not running | FALSE | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | Offboarded from Windows Defender ATP | 0 -> **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. - ## Related topics - [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) - [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) \ No newline at end of file +- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index 2fab49e4ef..1c057d851f 100644 --- a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -15,7 +15,7 @@ author: mjcaparas **Applies to:** -- Windows 10 Insider Preview Build 14332 or later +- Windows 10 Insider Preview Build 14379 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] @@ -36,7 +36,7 @@ You can use System Center Configuration Manager’s existing functionality to cr a. Click **Endpoint Management** on the **Navigation pane**. - b. Select **System Center Configuration Manager**, click **Download package**, and save the .zip file. + b. Select **System Center Configuration Manager (current branch) version 1602**, click **Download package**, and save the .zip file. 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file called *WindowsDefenderATPOnboardingScript.cmd*. @@ -47,14 +47,16 @@ You can use System Center Configuration Manager’s existing functionality to cr a. Choose a predefined device collection to deploy the package to. ### Offboard endpoints + For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name. > **Note**  Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions. 1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/): - a. Click Endpoint Management on the Navigation pane. - b. Under Endpoint offboarding section, select System Center Configuration Manager (current branch) version 1602 or earlier, click Download package, and save the .zip file. + a. Click **Endpoint Management** on the **Navigation pane**. + + b. Under **Endpoint offboarding** section, select **System Center Configuration Manager (current branch) version 1602 or earlier**, click **Download package**, and save the .zip file. 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. @@ -64,7 +66,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days a. Choose a predefined device collection to deploy the package to. -### Monitor endpoint configuration using System Center Configuration Manager +### Monitor endpoint configuration Monitoring with SCCM consists of two parts: 1. Confirming the configuration package has been correctly deployed and is running (or has successfully run) on the endpoints in your network. @@ -88,4 +90,5 @@ If there are failed deployments (endpoints with **Error**, **Requirements Not Me ## Related topics - [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) - [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) -- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) \ No newline at end of file +- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) \ No newline at end of file diff --git a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md index ee77bcc824..eacde8021a 100644 --- a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md @@ -65,4 +65,5 @@ For security reasons, the package used to offboard endpoints will expire 30 days ## Related topics - [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) - [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) \ No newline at end of file +- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) +- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) \ No newline at end of file From edbd2654237e9127c4c8308ec77614dfa49f38db Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 21:40:08 +1000 Subject: [PATCH 64/69] add or earlier --- ...ndpoints-sccm-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index 1c057d851f..5a35bad778 100644 --- a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -36,7 +36,7 @@ You can use System Center Configuration Manager’s existing functionality to cr a. Click **Endpoint Management** on the **Navigation pane**. - b. Select **System Center Configuration Manager (current branch) version 1602**, click **Download package**, and save the .zip file. + b. Select **System Center Configuration Manager (current branch) version 1602 or earlier**, click **Download package**, and save the .zip file. 2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file called *WindowsDefenderATPOnboardingScript.cmd*. From ac5820fcd75a587fdeb7648322c0522d76661b40 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 21:46:40 +1000 Subject: [PATCH 65/69] swap desc and value, update build number --- ...nts-mdm-windows-defender-advanced-threat-protection.md | 8 ++++---- ...ts-sccm-windows-defender-advanced-threat-protection.md | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index 410e537b06..ec376fe348 100644 --- a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -80,11 +80,11 @@ Offboarding - Use the offboarding policies to remove configuration settings on e - Health Status for offboarded machines - Configuration for offboarded machines -Policy | OMA-URI | Type | Description | Value +Policy | OMA-URI | Type | Value | Description :---|:---|:---|:---|:--- -Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | String | Offboarding | Copy content from offboarding MDM file - Health Status for offboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | Windows Defender ATP service is not running | FALSE - | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | Offboarded from Windows Defender ATP | 0 +Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | String | Copy content from offboarding MDM file | Offboarding + Health Status for offboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | FALSE |Windows Defender ATP service is not running + | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 0 | Offboarded from Windows Defender ATP ## Related topics diff --git a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md index 5a35bad778..3f7fac27dc 100644 --- a/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md @@ -15,7 +15,7 @@ author: mjcaparas **Applies to:** -- Windows 10 Insider Preview Build 14379 or later +- Windows 10 Insider Preview Build 14332 or later - Windows Defender Advanced Threat Protection (Windows Defender ATP) [Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] From c9fa2bb11b6b34a8350161c716906e6159924465 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 18 Jul 2016 22:44:56 +1000 Subject: [PATCH 66/69] updates on style and remove notes --- ...dm-windows-defender-advanced-threat-protection.md | 12 +++++------- ...pt-windows-defender-advanced-threat-protection.md | 6 +++--- 2 files changed, 8 insertions(+), 10 deletions(-) diff --git a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md index ec376fe348..22692ee168 100644 --- a/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md @@ -23,8 +23,6 @@ You can use mobile device management (MDM) solutions to configure endpoints. Win For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723297(v=vs.85).aspx). -> **Note**   If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later. - ## Configure endpoints using Microsoft Intune For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/en-us/library/windows/hardware/mt723297(v=vs.85).aspx). @@ -46,8 +44,6 @@ Onboarding - Use the onboarding policies to deploy configuration settings on end - Health Status for onboarded machines - Configuration for onboarded machines -> **Warning**  These two groups must not be deployed on the same machine at same time, otherwise this will cause unpredictable collisions. - Policy | OMA-URI | Type | Value | Description :---|:---|:---|:---|:--- Onboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Onboarding | String | Copy content from onboarding MDM file | Onboarding @@ -57,7 +53,7 @@ Health Status for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThrea Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | 0 or 1
Default value: 1 | Windows Defender ATP Sample sharing is enabled -> **Note**  Policies **Health Status for onboarded machines** and **Health Status for offboarded machines** use read-only properties and can't be remediated. +> **Note**  Policies **Health Status for onboarded machines** use read-only properties and can't be remediated. ### Offboard and monitor endpoints @@ -85,8 +81,10 @@ Policy | OMA-URI | Type | Value | Description Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding | String | Copy content from offboarding MDM file | Offboarding Health Status for offboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | FALSE |Windows Defender ATP service is not running | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 0 | Offboarded from Windows Defender ATP - - + +> **Note**  Policies **Health Status for offboarded machines** use read-only properties and can't be remediated. + + ## Related topics - [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) - [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) diff --git a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md index eacde8021a..37cff93fb6 100644 --- a/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/configure-endpoints-script-windows-defender-advanced-threat-protection.md @@ -31,7 +31,7 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) -4. Type the location of the script file. If you copied the file to the desktop, type: *`%userprofile%\Desktop\WindowsDefenderATPOnboardingScript.cmd`* +4. Type the location of the script file. If you copied the file to the desktop, type: *%userprofile%\Desktop\WindowsDefenderATPOnboardingScript.cmd* 5. Press the **Enter** key or click **OK**. @@ -47,7 +47,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days a. Click **Endpoint Management** on the **Navigation pane**. b. Under **Endpoint offboarding** section, select **Group Policy**, click **Download package** and save the .zip file. -2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_\.cmd*. +2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the endpoints. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*. 3. Open an elevated command-line prompt on the endpoint and run the script: @@ -57,7 +57,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days ![Window Start menu pointing to Run as administrator](images/run-as-admin.png) -4. Type the location of the script file. If you copied the file to the desktop, type: *%userprofile%\Desktop\WindowsDefenderATPOffboardingScript_valid_until_\.cmd* +4. Type the location of the script file. If you copied the file to the desktop, type: *%userprofile%\Desktop\WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd* 5. Press the **Enter** key or click **OK**. From 552aeed362b9adcda0ee4891cd7e7e00486c8ad7 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Mon, 18 Jul 2016 07:02:15 -0700 Subject: [PATCH 67/69] Added new Mandatory tasks and settings required to turn on Windows Information Protection (WIP) topic --- .../keep-secure/change-history-for-keep-windows-10-secure.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index bf5a309fca..34c8880202 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -16,9 +16,10 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |New or changed topic | Description | |----------------------|-------------| +|[Mandatory settings for Windows Information Protection (WIP)](mandatory-settings-for-wip.md) |New | |[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |New | -|[Create an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) |New | |[Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) |New | +|[Create an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) |New | |[Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) (multiple topics) | Updated | |[Device Guard deployment guide](device-guard-deployment-guide.md) (multiple topics) | Updated | From b9cb066d7e176a543ec0f77851b247c369bc9e41 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Mon, 18 Jul 2016 07:04:57 -0700 Subject: [PATCH 68/69] Put wrong file into master --- ...ange-history-for-keep-windows-10-secure.md | 1 - ...reate-and-verify-an-efs-dra-certificate.md | 90 ------------------- 2 files changed, 91 deletions(-) delete mode 100644 windows/keep-secure/create-and-verify-an-efs-dra-certificate.md diff --git a/windows/keep-secure/change-history-for-keep-windows-10-secure.md b/windows/keep-secure/change-history-for-keep-windows-10-secure.md index 34c8880202..4b25f1edc5 100644 --- a/windows/keep-secure/change-history-for-keep-windows-10-secure.md +++ b/windows/keep-secure/change-history-for-keep-windows-10-secure.md @@ -17,7 +17,6 @@ This topic lists new and updated topics in the [Keep Windows 10 secure](index.md |New or changed topic | Description | |----------------------|-------------| |[Mandatory settings for Windows Information Protection (WIP)](mandatory-settings-for-wip.md) |New | -|[Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate](create-and-verify-an-efs-dra-certificate.md) |New | |[Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) |New | |[Create an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) |New | |[Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) (multiple topics) | Updated | diff --git a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md b/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md deleted file mode 100644 index 03d72f1d40..0000000000 --- a/windows/keep-secure/create-and-verify-an-efs-dra-certificate.md +++ /dev/null @@ -1,90 +0,0 @@ - ---- -title: Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate (Windows 10) -description: Follow these steps to create, verify, and perform a quick recovery using a Encrypting File System (EFS) Data Recovery Agent (DRA) certificate. -ms.prod: w10 -ms.mktglfcycl: explore -ms.sitesec: library -ms.pagetype: security ---- - -# Create and verify an Encrypting File System (EFS) Data Recovery Agent (DRA) certificate -**Applies to:** - -- Windows 10 Insider Preview -- Windows 10 Mobile Preview - -[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - -If you don’t already have an EFS DRA certificate, you’ll need to create and extract one from your system before you can use EDP in your organization. For the purposes of this section, we’ll use the file name EFSDRA; however, this name can be replaced with anything that makes sense to you. - -The recovery process included in this topic only works for desktop devices. EDP deletes the data on Windows 10 Mobile devices. - ->**Important**
-If you already have an EFS DRA certificate for your organization, you can skip creating a new one. Just use your current EFS DRA certificate in your policy. - -**To manually create an EFS DRA certificate** - -1. On a computer without an EFS DRA certificate installed, open a command prompt with elevated rights, and then navigate to where you want to store the certificate. - -2. Run this command: - - `cipher /r:` - - Where *<EFSRA>* is the name of the .cer and .pfx files that you want to create. - -3. When prompted, type and confirm a password to help protect your new Personal Information Exchange (.pfx) file. - - The EFSDRA.cer and EFSDRA.pfx files are created in the location you specified in Step 1. - - >**Important**
- Because these files can be used to decrypt any EDP file, you must protect them accordingly. We highly recommend storing them as a public key (PKI) on a smart card with strong protection, stored in a secured physical location. - -4. Add your EFS DRA certificate to your EDP policy by using either Microsoft Intune or System Center Configuration Manager. - - >**Note**
- To add your EFS DRA certificate to your policy by using Microsoft Intune, see the [Create an enterprise data protection (EDP) policy using Microsoft Intune](create-edp-policy-using-intune.md) topic. To add your EFS DRA certificate to your policy by using System Center Configuration Manager, see the [Create an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) topic. - -**To verify your data recovery certificate is correctly set up on an EDP client computer** - -1. Open an app on your protected app list, and then create and save a file so that it’s encrypted by EDP. - -2. Open a command prompt with elevated rights, navigate to where you stored the file you just created, and then run this command: - - `cipher /c ` - - Where *<filename>* is the name of the file you created in Step 1. - -3. Make sure that your data recovery certificate is listed in the **Recovery Certificates** list. - -**To recover your data using the EFS DRA certificate in a test environment** - -1. Copy your EDP-encrypted file to a location where you have admin access. - -2. Install the EFSDRA.pfx file, using your password. - -3. Open a command prompt with elevated rights, navigate to the encrypted file, and then run this command: - - `cipher /d ` - - Where *<encryptedfile.extension>* is the name of your encrypted file. For example, corporatedata.docx. - -**To recover your EDP-protected desktop data after unenrollment** - -1. Have your employee sign in to the unenrolled device, open a command prompt, and type: - - `Robocopy “%localappdata%\Microsoft\EDP\Recovery” <“new_location”> /EFSRAW` - - Where *<”new_location”>* is a different location from where you store your recovery data. This location can be on the employee’s device or on a Windows 8 or Windows Server 2012 or newer server file share that you can reach while logged in as a data recovery agent. - -2. Sign in to a different device with administrator credentials that have access to your organization's Data Recovery Agent (DRA) certificate, and perform the file decryption and recovery by typing: - - `cipher.exe /D <“new_location”>` - -3. Sign in to the unenrolled device as the employee, and type: - - `Robocopy <”new_location”> “%localappdata%\Microsoft\EDP\Recovery\Input”` - -4. Ask the employee to log back in to the device or to lock and unlock the device. - - The Windows Credential service automatically recovers the protected data from the `Recovery\Input` location. From 71310e481808cd79d6f110e0ec5e37ee84fcf764 Mon Sep 17 00:00:00 2001 From: LizRoss Date: Mon, 18 Jul 2016 07:18:36 -0700 Subject: [PATCH 69/69] Removed incorrect topic from TOC --- windows/keep-secure/TOC.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/keep-secure/TOC.md b/windows/keep-secure/TOC.md index 83d4e0b32d..e2590ac099 100644 --- a/windows/keep-secure/TOC.md +++ b/windows/keep-secure/TOC.md @@ -29,7 +29,6 @@ ##### [Deploy your enterprise data protection (EDP) policy](deploy-edp-policy-using-intune.md) ##### [Create and deploy a VPN policy for enterprise data protection (EDP) using Microsoft Intune](create-vpn-and-edp-policy-using-intune.md) #### [Create and deploy an enterprise data protection (EDP) policy using System Center Configuration Manager](create-edp-policy-using-sccm.md) -#### [Create and verify an Encrypting File System (EFS) DRA certificate](create-and-verify-an-efs-dra-certificate.md) ### [General guidance and best practices for enterprise data protection (EDP)](guidance-and-best-practices-edp.md) #### [Mandatory tasks and settings required to turn on Windows Information Protection (WIP)](mandatory-settings-for-wip.md) #### [Enlightened apps for use with enterprise data protection (EDP)](enlightened-microsoft-apps-and-edp.md)