From a4baee6cbcebacac045409c8d15f3fabb088976e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 29 Aug 2019 14:44:42 -0700 Subject: [PATCH 01/23] updates to indicators --- .openpublishing.redirection.json | 7 +++ windows/security/threat-protection/TOC.md | 1 - .../manage-indicators.md | 56 ++++++++++++++++++- .../post-ti-indicator.md | 4 ++ 4 files changed, 65 insertions(+), 3 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 16a10bcb81..97a456c86d 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -631,6 +631,11 @@ "redirect_document_id": true }, { +"source_path": "windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md", +"redirect_url": "windows/security/threat-protection/microsoft-defender-atp/manage-indicators", +"redirect_document_id": false +}, +{ "source_path": "windows/security/threat-protection/device-guard/optional-create-a-code-signing-certificate-for-windows-defender-application-control.md", "redirect_url": "/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control", "redirect_document_id": true @@ -15314,3 +15319,5 @@ } ] } + + diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 03328a26ed..a245fe1b42 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -501,7 +501,6 @@ #### [Rules]() ##### [Manage suppression rules](microsoft-defender-atp/manage-suppression-rules.md) -##### [Manage automation allowed/blocked lists](microsoft-defender-atp/manage-automation-allowed-blocked-list.md) ##### [Manage indicators](microsoft-defender-atp/manage-indicators.md) ##### [Manage automation file uploads](microsoft-defender-atp/manage-automation-file-uploads.md) ##### [Manage automation folder exclusions](microsoft-defender-atp/manage-automation-folder-exclusions.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index a5f617c624..48bfb2d7e7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -16,6 +16,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article +ROBOTS: NOINDEX --- # Manage indicators @@ -25,8 +26,32 @@ ms.topic: article >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) +Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability is available in Microsoft Defender ATP and gives SecOps the ability to set a list of indicators for detection and for blocking (prevention and response). + + Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to. +Currently supported sources are the cloud detection engine of Microsoft Defender ATP, the automated investigation and remediation engine, and the endpoint prevention engine (Windows Defender AV). + +**Cloud detection engine**
+The cloud detection engine of Microsoft Defender ATP regularly scans collected data and tries to match the indicators you set. When there is a match, action will be taken according to the settings you specified for the IoC. + +**Endpoint prevention engine**
+The same list of indicators is honored by the prevention agent. Meaning, if Windows Defender AV is the primary AV configured, the matched indicators will be treated according to the settings. For example, if the action is "Alert and Block", Windows Defender AV will prevent file executions (block and remediate) and a corresponding alert will be raised. On the other hand, if the Action is set to "Allow", Windows Defender AV will not detect nor block the file from being run. + +>![NOTE] +>-There is a propagation time of several minutes before the blocking policy for a new hash is applied. +>- Trusted signed files will be treated differently. Microsoft Defender ATP is optimized to handle malicious files. Trying to block trusted signed files, in some cases, may have performance implications. + + +**Automated investigation and remediation engine** +The automated investigation and remediation behave the same. If an indicator is set to "Allow", Automated investigation and remediation will ignore a "bad" verdict for it. If set to "Block", Automated investigation and remediation will treat it as “bad”. + +In the first phase, the file hashes are fully supported, while network addresses (IP, Domain names) are partially supported (Automation and Detection). Stay tuned as the network blocking and more IoCs become available. + +The current actions supported are Allow, Alert-only, Alert&Block. + + On the top navigation you can: - Import a list @@ -37,7 +62,34 @@ On the top navigation you can: - Navigate between pages - Apply filters -## Create an indicator +There are several ways to control IoCs: +- [Create an indicator from the settings page](#create-an-indicator-from-the-settings-page) +- [Create contextual IoC](respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) +- [Import a list of IoCs](#import-a-list-of-iocs) +- [Use the Microsoft Defender ATP indicators API](ti-indicator.md) +- [Use partner integrated solutions](partner-applications.md) + +## Before you begin + +Creating IoCs must comply to the following: + +>- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). +> +>- The Antimalware client version must be 4.18.1901.x or later. +>- This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time. +>- This response action is available for machines on Windows 10, version 1703 or later. +>- The allow or block function cannot be done on files if the file's classification exists on the device's cache prior to the allow or block action. + +>[!NOTE] +> The PE file needs to be in the machine timeline for you to be able to take this action. +> +> There may be a couple of minutes of latency between the time the action is taken and the actual file being blocked. + + +## Create an indicator from the settings page + +>[!NOTE] +>There is a limit of 5000 indicators per tenant. 1. In the navigation pane, select **Settings** > **Indicators**. @@ -69,7 +121,7 @@ On the top navigation you can: 3. Update the details of the indicator and click **Save** or click the **Delete** button if you'd like to remove the entity from the list. -## Import a list +## Import a list of IoCs You can also choose to upload a CSV file that defines the attributes of indicators, the action to be taken, and other details. diff --git a/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md b/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md index 53cae96485..10fbaec373 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md +++ b/windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md @@ -29,6 +29,7 @@ ms.topic: article - Submits or Updates new [Indicator](ti-indicator.md) entity. + ## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Get started](apis-intro.md) @@ -116,3 +117,6 @@ Content-type: application/json } ``` + +## Related topic +- [Manage indicators](manage-indicators.md) \ No newline at end of file From 64f7adf622ffee7eb6770baacd9ecf8fa4cd026c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 30 Aug 2019 11:09:20 -0700 Subject: [PATCH 02/23] fix icons --- .../microsoft-defender-atp/manage-indicators.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 48bfb2d7e7..75168ec4e3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -45,11 +45,14 @@ The same list of indicators is honored by the prevention agent. Meaning, if Wind **Automated investigation and remediation engine** -The automated investigation and remediation behave the same. If an indicator is set to "Allow", Automated investigation and remediation will ignore a "bad" verdict for it. If set to "Block", Automated investigation and remediation will treat it as “bad”. +The automated investigation and remediation behave the same. If an indicator is set to "Allow", Automated investigation and remediation will ignore a "bad" verdict for it. If set to "Block", Automated investigation and remediation will treat it as "bad". In the first phase, the file hashes are fully supported, while network addresses (IP, Domain names) are partially supported (Automation and Detection). Stay tuned as the network blocking and more IoCs become available. -The current actions supported are Allow, Alert-only, Alert&Block. +The current actions supported are: +- Allow +- Alert only +- Alert and block On the top navigation you can: @@ -73,7 +76,7 @@ There are several ways to control IoCs: Creating IoCs must comply to the following: ->- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). +>- This feature is available if your organization uses Windows Defender Antivirus and Cloud-based protection is enabled. For more information, see [Manage cloud-based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). > >- The Antimalware client version must be 4.18.1901.x or later. >- This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time. From 977634614fc2fe9309df31d08fd4ad88bf82cb49 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 30 Aug 2019 14:17:09 -0700 Subject: [PATCH 03/23] fix note --- .../microsoft-defender-atp/manage-indicators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 75168ec4e3..b7dc5ee01e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -39,7 +39,7 @@ The cloud detection engine of Microsoft Defender ATP regularly scans collected d **Endpoint prevention engine**
The same list of indicators is honored by the prevention agent. Meaning, if Windows Defender AV is the primary AV configured, the matched indicators will be treated according to the settings. For example, if the action is "Alert and Block", Windows Defender AV will prevent file executions (block and remediate) and a corresponding alert will be raised. On the other hand, if the Action is set to "Allow", Windows Defender AV will not detect nor block the file from being run. ->![NOTE] +>[!NOTE] >-There is a propagation time of several minutes before the blocking policy for a new hash is applied. >- Trusted signed files will be treated differently. Microsoft Defender ATP is optimized to handle malicious files. Trying to block trusted signed files, in some cases, may have performance implications. From e055d2ad4dd2931761ec4045edbb855bff0c8652 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 30 Aug 2019 14:31:51 -0700 Subject: [PATCH 04/23] remove file to fix warning on redirect --- .../manage-automation-allowed-blocked-list.md | 68 ------------------- 1 file changed, 68 deletions(-) delete mode 100644 windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md b/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md deleted file mode 100644 index b30f739163..0000000000 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-automation-allowed-blocked-list.md +++ /dev/null @@ -1,68 +0,0 @@ ---- -title: Manage automation allowed/blocked lists -description: Create lists that control what items are automatically blocked or allowed during an automatic investigation. -keywords: manage, automation, whitelist, blacklist, block, clean, malicious -search.product: eADQiWindows 10XVcnh -search.appverid: met150 -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -ms.author: macapara -author: mjcaparas -ms.localizationpriority: medium -manager: dansimp -audience: ITPro -ms.collection: M365-security-compliance -ms.topic: article ---- - -# Manage automation allowed/blocked lists - -**Applies to:** -- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) - - - ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) - -Create a rule to control which entities are automatically incriminated or exonerated during Automated investigations. - -Entities added to the allowed list are considered safe and will not be analyzed during Automated investigations. - -Entities added to the blocked list are considered malicious and will be remediated during Automated investigations. - -You can define the conditions for when entities are identified as malicious or safe based on certain attributes such as hash values or certificates. - -## Create an allowed or blocked list -1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. - -2. Select the tab of the type of entity you'd like to create an exclusion for. Currently, you can add a rule for certificates. - -3. Select **Add allowed/blocked list rule**. - -4. For each attribute specify the exclusion type, details, and their corresponding required values. - -5. Click **Add rule**. - -## Edit a list -1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. - -2. Select the tab of the entity type you'd like to edit the list from. - -3. Update the details of the rule and click **Update rule**. - -## Delete a list -1. In the navigation pane, select **Settings** > **Automation allowed/blocked list**. - -2. Select the tab of the entity type you'd like to delete the list from. - -3. Select the list type by clicking the check-box beside the list type. - -4. Click **Delete**. - - -## Related topics -- [Manage automation file uploads](manage-automation-file-uploads.md) -- [Manage indicators](manage-indicators.md) -- [Manage automation folder exclusions](manage-automation-folder-exclusions.md) From 0c7e6fa71527963f8b8120632e0e070e1c93e505 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 13:46:59 -0700 Subject: [PATCH 05/23] update advanced settings --- .../microsoft-defender-atp/advanced-features.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md index 38d679e8fa..6b7a24edb1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/advanced-features.md @@ -53,7 +53,7 @@ For tenants created on or after Windows 10, version 1809 the automated investiga > - The result of the auto-resolve action may influence the Machine risk level calculation which is based on the active alerts found on a machine. >- If a security operations analyst manually sets the status of an alert to "In progress" or "Resolved" the auto-resolve capability will not overwrite it. -## Block file +## Allow or block file Blocking is only available if your organization uses Windows Defender Antivirus as the active antimalware solution, and if the cloud-based protection feature is enabled. @@ -71,6 +71,19 @@ To turn **Allow or block** files on: Once you have enabled this feature, you can [block files](respond-file-alerts.md#allow-or-block-file) via the **Add Indicator** tab on a file's profile page. + +## Custom network indicators + +Enabling this feature allows you to create indicators for IP addresses, domains, or URLs which determine whether they will be allowed or blocked based on your custom indicator list. + +To use this feature, machines must be running Windows 10 version 1709 or later. They should also have network protection in block mode and version 4.18.1906.3 or later of the antimalware platform [see KB 4052623](https://go.microsoft.com/fwlink/?linkid=2099834). + +For more information, see [Manage indicators](manage-indicators.md). + +>[!NOTE] +>Network protection leverages reputation services that process requests in locations that might be outside of the location you have selected for your Microsoft Defender ATP data. + + ## Show user details When you enable this feature, you'll be able to see user details stored in Azure Active Directory including a user's picture, name, title, and department information when investigating user account entities. You can find user account information in the following views: From d381096f71d49027f6b8359b4dd33f4406633d5c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:02:25 -0700 Subject: [PATCH 06/23] update indicators page --- .../images/rules-indicators.png | Bin 0 -> 48703 bytes .../manage-indicators.md | 148 +++++++++++------- 2 files changed, 90 insertions(+), 58 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png b/windows/security/threat-protection/microsoft-defender-atp/images/rules-indicators.png new file mode 100644 index 0000000000000000000000000000000000000000..570609f803adb9644b2adbe542fb5ed7961c14e2 GIT binary patch literal 48703 zcmeFZXH-*9)HjMEA|hY`QL2jcrc~)7QbO+~G?fm99(qv_P!y0FIw*u5niMG^3QF&g zgdP-Wp@bF!guom9>vP{P_tX9KtaZ;?K+c|hW@hjC?J|2#c%!eYPIr;zA_WBn9YEu; zAq55190kRhkPGL@l#%4pLh>IPPYnwn3X1F8zkkjE4DW7{iPXLT9aZWD8cOD~5&%u% zkv}9=b6;h!ud|0YMQLTf2AOopmrQ!>;A7|Q;_2(+;ZAXl<~A3Ze(^V5#lthu+r`P* zm!g89UzSXz|3me5c>0_5mahxQfkKkNKtpb!`Q2jV;pprC)Z2l=+Vk``JMEv&U3~1G zKP9tzQ#5|5OCXak{3e?{^>%l0ccS>hx)ejEQUCWm*xSy50)HC0_K!`)0|at#_odkH zPeYJt=YO*qyZAnLpeWfK<)xswMFDuMY#fliJ{xFd0zT>5_MghPGvFz@p89OS*|kv2 z{Uxhwfy*Ov_kxdcOP`&T)K$8MvmddlchULqqYXY8dd_Hmr~Ae|{$4Yy^X*Nh74W^@ zcK{N}i+S@Rv&@C5wZnj|%Y!=#7@xt#pQP*|!Y*8xpMN!zJe5D!i`(vy!u^eD2w3SK z>GSHw9NdzrxB1#X%8cfPR?5FOPi~#X{iEM_{YCEI=ks^A=>L9x@$!EgdowATeN{78 zo8L0EnhT(=C|hYXd5B^LUf7H2X(>z-bs14QD$ljG zAYAw>wm!$q`!6kr-G(}u)eqIZ6<`C&t79Evp+V-;N~wz3%%v|_M@p{(&__KjDZBt` zCzrKil1Y`91>raReqZ_=DM9lJZex53a@-ba$9~~d{&B{T;d@jj^%X-yGSFXe)_PE5 z&(&@b?!b(msfK;_P&RqhDzNa~x^Qk=3*H8SZBks>xLwrA%Kdzfirg_-zLCuB6XVEH ztmJ#})_`!FrwF=Z+>I;XX zRi6iil{?BSneZna;kVi>o}e?P#*kk`&i?Jrod(JhAiWW$&Yx8HknXg+IKPGR^eFaN z#by7ub^pFzjGBFrU>)jHbRmgY4e)jSd-Q;c5BVkd<*ux4Ce_TD|9C0*cs1+CwV&vx z7uo}+Q>yJ=wHKV#LOt%BK<4NCO*W8@MYt(BB)6*WVRN-}KD~xcPD0+K-?~O6M zOm**{0qK_*(zR08y)j-E=$Q%wXdb$8k`8;H!LKf=yr0x*)5htJ=YO{D^|5eQ1e;Im zv7`36@%XOEx007u)()<6X>2+AV?862KqoDW%hrkepZ zxMsRK&JA%CXK*8CcTDBpC`An53{po_4h$smC;aD5+G1BcCCObD|q!g4Hx6&7c@m++bFY|+e%V$FC-7E3NNf7$(Dtg zC;<*-^V&?bmRcPY~OYp_-MD%>aKDUBT^j^R!HeCWbMD`Xolja&Dk z50mBUkK$G}yHj=uI!Ie7iLu({8TE6&IP;(%3QT+M0!*^XF>k|-?cb`Kz>^AFg`m&# zV5_v(_LkGfcHS?zdo32uvB>DsWTZ(&Cp6+!M)j5*Wc|#i8$=DDYY!Cuso~QoU8~lP z+i?=Af?>Rnxk!-TtXFP3z6c+ze(F4FE1Gcg;~@TGg5z?Y`A0KIwsBj;xX;{GoeOlH zKpdtBVM9wdRxqUQvj4_+!2Gk0wWDt$;;vG7_#q%^v-U*r(4@)i#AG&M)ePCZp_h8G z0p4eO!YvHn8CuOWC`P1#!T?`Q*p6mvAv{&|qd5vOu6VTJQ7lN7Nzxq8_GxaH!EIl| zZ5XZ_4sZI&EyKNM2CEuWxz688l4FtfY_=-HGD`T|Q{K)Kk{{t<`sQg9m&)!iyf7vluEm)LwgJtxX|9O^ z4Btn0HJzJfKTsIes#)l0-M=-I?Lew*-V|DwQLoXW_%{u!S+du>Tl(xpCY?p0LNFRz z@7zUke3n$Il~T0P?Tz6jzE0B9Fbu_CsD}<>pHjG ziJIHh!u)m=#?0(PQjFMri=*dxi!DJq*z)e3ofAS?b0auGp`a!KHu~U0sl(2HP`>_XpL-iJSYy?$%w5upM01R&saHa&*zDg2sAcd5#pEMtx~nbrhbZL1fF*T(S6hcT&U8e6j=o-a{(e8--O z4hfd*G8Sovm@roq6d}0~4k^+F=%+z^hNi9*-#qQ#nMw*I8p4zoHxz%Z9YczRF>~P% zfz<4MSHiGQ@^i zbFs)VJ2M1{sM)Pqq-B_1LXHjTp^qYYGJJMZAX&w&&y(Yy1M>kRpuJyPP@9M`<)GG2 z_-TJ9m(HT(G|~_UYClp0Kjwx)FQ9~oM!Us)Cr{FLym#$SB$NTRH~c{%KhOb%CoJrD z0lgS$lcD{r5+w2B;B0nA1@ankWs-(wwEGHn8TR2gL9#$k9iQ`Ab2>rJs^t@JeP|CK zDbTv@u2K|zuo~Wdyyq{Bz6fLYS-n%N$P>H2+MQ-%BeiAr>HaRhG3={%7IXcxP<*gk zl*A_0fMR-a>ouHn=a#=jhmp96+{y@1zL68L4L*!Ybq|}hR z7V6rV)sQ7XhNuPV2w72;pMNU~9B&Mf8elT6e_vEKZiYAr#d^yt3!1?TQtWsgYEklp zDkEDwYjmj(x_JD9#rtEyAoq4$%@trnLuHzX&Bt%EJd1#xsxjpRrC-;vW)IPUQ*70m zpRQNwk9z&dPCD85oGrdV1=3Ay|`5 zZ`V8dYimJO*gvVs6=MCa(L;ErE2`*ikg7a%o;X|eFE`0QaM#k*Y(}+(5^Fc9HG5li z3gmQ*V+#kx_gCw6b8F}RSwGZ;usI90Tws^hJ?TkEy#pw#>IzpGX8)_8-it2@mS0na zK-Pr#MIupdWn0!^iuG^ffhyOQO(oO~Z+p#Gpz6I&WqRrk!5}m34j>FGUj)I<=Ks$y zGpRp+mECJ^qBBDJcL-7WvwyTvXdkc81s?(oZPG>)Ku9@SjDeHm-A(&PDmO8fuWDgM7`#y8l)pW?-~;_313 zoyMlqHemDEX(j9MU)0S*qTc=QP`c+>w^Gf+At}%YB~W**2mrlaq{ApCpuDsO+B*=6 zk^p@i$*OFLx^rW=%QDx3rXaSBdetYB&tCV44tverqRWZDaFvhS9s*YXgR#ci>Aq%4 z3jHq?uMF5Fg};aDAQ}@~9)H)|DK`Y1mR0ogjE;nJRG-?18Y+S*$EH8cQN4t7@lwMC z?g#!3fK7e+d2lNwg({A!X)(71LKySA5#Iz# z`&=9V(NuE-F@F5qL9dst`~BM7P1zq7ijr4Sr4bHz^2ZS#IOKQAy~v6Y#ZOfIS{*N1 zWf_M?J<60aXesduT6-;uL?V)1#(e26dVG9e1d`x$htyUwRtyj&ls}z{YHpAjHO8(7 z?HsOZ9^ApS&4t*f@+e>oV87|+>U5dm=7E*!2X~akKTew;F)3IBY?%u%5N&dPk)2ED z@ys^Q6BRQiX7vKAcn6wZ+v=XE*fpv?jb2|6VYTOVuIo4&$&#;kfW>(by~{V;%W3l} zUm1vWdAVS~wm6db^mJ{A4El_;2a8E}AXA%1)7F3sgTs?n!5u{bYr$fTk6+r zo){j%)%Odyk86@XGHQMiYSQe`R}1k3pR`eKV(`l`FR-MrwGpbm%y}~({gZih08P!ewd*ednipd4f%v+XM$_j&jR=ngrNR>D zjJqT=LYEk(iDj_PiAr^t>~{PK+irYq2-ZJ0>14_>c}}5tn0a}1;2<#Q z{$6&QNOE_cMKR+2qsX%gRfD?2mH9cEazXt&c)xI1*xc<4AQ&s>-u``}RHV*`2$(b` z+2T^CZFF(!@SgLV-~n#{zfqb-c+GS1h8h^j`Xa{BExec~{0fMnEsJa-`J&J8A5>1) z)pN!S#yBhtJp1{TshmLNG49hImKEAV%;$V*ryD~w(Cf=){JxrXdR%~uExLYP{;ptW z>iT{D$XWbLon}XAaGPU;8}|5#u*KM1(lZc2%s2JCBnpBd!Z7a%&iK^DE|2`q?M*2ccm-e3F#;Y(S{8j+xBy`ogbwPSURX7n9p0muRVvLeIEEnW5pRLzsyEnWP9?^YZ!F z23Xcw>WsYtQLT1V$8c6uF%4j7->3n0UllEF$^?7Md_jXHpWxT9Rwjna>d^l9%(SG6 zYfCm4TaAqoxY3@_L&Kc-pfa~~tVv2{{iWo}m1wOzvX%^w+$QBkziYaxxjy%g$z%05 zR#NTTi!01DJZdi0d}H&WDUMc(hU1e_GGe9V?%L3jj#izlgej+NN-fQbqF$f2jzl*; zU_>Qb6H-`}C7?68S}pW2F?_wsWe8_{l>VeAMMy!cFn?Tg0V09&HtwU0(xqZxJll*Y z)X*wV>)!;?*N?cVxq9vy(@kYn*2GcLPBvbGy*7PKda4>OOh(4?j*f**RdSpKjR(vS zp~SJ<^jwErfU>XM1hsUd@kNHrYF4jTW-0F8p_QXA=w` zI*Z~fk}L41Xagdv|L}{KDvVcHjE8gYMn#uem`pRIt=mF1AmRH^%u}owk9qk|$5M~t zxQhul@=xGgOd%?+4!mwa2v4S?Qi6GCK;7#e8JNXJJYb!4cQRs{bYdQGAl;WzF|2D8 z(!4yFK}g#-GW9j?W<(1M-<(2HqC5;yqJOWhp0MAKMq1yFMnyZ&A)(6{+KU zg_y=o{8g5AFuW$PEde6D4WRv|cZs;C*KCsQ7w=YG=&W+6cw~gQ<)@X>$1|m%jdO0CP5kM z_P1QYS!#sz5-!9>6%A!q8Cr#*eDv!ZEV1)x-%;7q%&kpDyf$EXv@y+@oZHvs>r~7U zgA30JUZ1P0BGCu9N9{)!xvjNmF`jN3bHmI_!#t|SCOYT558{4uZ(&t`2fDgD(sg)r#q4bq5xzUO9t*L=blS z%F-fiS|p;CGCbWCY%u{g{MvmMGc?o~BcjF^hkmk^Zl}p=XWCv8f6+xCCWhs=q!a;a zasCvI?_LBY2dslmDlp~YS|s#TJMy8 zL_|#Oq1^=cT_)c@T*O(HZP?zJzzHT{NMB>w#Pv9N+A2LW>VimNjWkw$rpuIquiqOjQL>KRWwWl1uV|ti{*~upgkTU{mb70lZSQb-nF+ zMq+q2T*&i zl@Q)VH*OoDl+<13znM&hZB@swYv~{VTAi|)_!g_WMXcvGQ}o&pfU?O~Y-p*u?9T;n ztPNOpuIl+*P4WKC9jyLFuC`EMfYBFWK+-h}LA(LNN!9Vc`Pb0=7KZxpW^~?nTYLLKljQhTfoDiF#>CLclAayp-`!R=14gl+sM>y`G}LF-8cDxdN^G+FV=hHHqmd z)1zz)o3llZ-2L0vQ|L`&oL%s{gTzeffm+=Oi;1>Qvd4N%`X!cFQh^q&yH&EGvz5+- zUG}zyZ-?bn;3utJ*MgnMYtIwpt@%D}K#l6R;grN4K5`-U;W zl?ap5t<$lY6(OBa|1`DYb9}ztA#gFzm$^Af+<=|nlD1>W(C7+NVA3(ucpJhd*sicW zG(MIYiK9S<-qreaB5S;)m1H~cBr3t85OPFieF{j8rBFTLHU(H;bgdu+2S**jJo$D< z4!EIk;V5~`H;zjigofQ;Wo0)@o2Cm#=r>;JPL?{1u+Q?Effql7YE3dv+oum+BSe$Q zO|z7DGoYeH*q$PzjWsqc)VTziA_v!>@~a+u7on3p+d}rX3+LR{M{+LKrpkG(cgfrK z=ALu=l5$T$#v%49u;0iHpy{>QXuld9^Qdy{guMq#Q1|#gYrS-?dNXTD>ZV6^Cx`WI zNpLm=%8;YTJ_D=RdcG>sC3d0p%wp-g%fHo`-`f29{0m6j-=On&AT4cXrWhpD5#8 zj5;^_XD7|qP6ykzDK+FKwfQ)KS0)SqEq=4zDwGs2uGVOaxbpuO?I|w$bnu$NHyWmm z;Xz>1RtLkrgNutxri9B!5!<%)I*_}26ZhT6Lu zl|zceewVDgup>YpM06}UM^>QF<(jI(wbJo%%Fdh{e^5sLB@o$TQf1ZjG5nN>30l8z zSHvwBe$rZ``^F?DKBtZp$$&4nC26|2aISiI^bZ#zv{4-lN)>`;l`9*KbEA5PN-iCp z=VraS*n4|=Ol@p(Z-@Tt`O8wYV{5qo_Qy0hsbOblXS^A_cD2!eV@eWqf<`d1pnzAd zTq!dyO%gCJ$#)#cEZ2e**MX)@ty}zb0s{k&ekJSe?TyWXmvj8F4b$#M1DW-E-CT(K z^A-O_;M2$6#ED+I`TX?cB{j!zI#A?_nFSN`l_;H{WrewtKXtg-cxZc%-j#bf0RPRPrC~@Cq{>#gt zS59@#x&N&wc9G`Vc%94ZOlc2yjTT8al<{%9G}Db6<|}^SH59T8 zc{=`*l0TC}+L|!qlfZ-6(M%-%>qnnWT4J%qaR3;EEv?kl)*fE$gXEyB;oc_bN^2h* zKYUrG4g6<4Jh;p>HP4ni6t{4Q<{*4o7wP!;c)V4Wc5!jBY2#n<;~`*X>kAQ1m@6-CQGms(b2)_=`5jghGKlu{{)?&<6kBf%cs{*tAWJhTGbx*y#?zDZ zQt{a@4U-acWyC2d`C{nDRKy+&Cpj*3e-$|oS!gIM zEOgtLZWLV$qqsNxfBTVOPJ_Rvp!o-WxH)U7n>f=oF`a+!0{mNxnKF0LHF}B{1Bs%d zsbFSz*#V9+LzMM@%`a$w@2lgK-Gz?>(jezuz$UqZ&Rrh={eo+Mhg|EMOy>*#BFN4W6AY?O(YxkYkCO^%VEmw9?6x zFo1~KimX-srx}VbIv=c10n!=TERx=@+76dkiM4~)&CWZ&%#5477sb|Z{^g^H67;`` z+g%z&rc9W_PL^4q>q*ZrO5`5f@dT#Jk!R~9@AOzbX^$MaAfI8}Z<)(Y2Y~yAlA>)7Op~C`d&yxFN%o&p zsdbiurj^FXG7|@}jBy-8C=-&aw{2+Ltax>j!$9}zPg=)Mez-{(VGfg@LRlI#|CM_D zb}L-!d4MfHwc$peDa>lM-h-?x7V)6Eu^Nst()%<~+oif3;faljJOeIub1a70o1>#0IqFsguQYpRhiuYfhO%kkfi^t%?vLA)buxR^42}=Am-b`RyyQ6@}wt;hvo%c zm8a2v%j*wi3@bGUXZv%fi8K+O^I5OEsn zM64x092&T!MI7Qu2ArP!#024yF8dC2tWx6(ajb$0Bs(f9sz8MV4uzlzv{|LqWT{ev z9YY{loZY=tka0VC-ZJsS5Ft{Az<{XT48y85n`x3Ayuyul*tRf?H@hTMt^mU1hNK`aI z+If%+GRk?WhKHfX#te;My;sq$9nl0@;g?r0>;DONLnPu(Kg4yeHSoi7z>jt+=w04& zm4M(za6AJe+vK1fS${!btZ^|ou43|68(Yi0QxYy5?2l}jRpT~>0ZkCZS==7d%xU8# zp}kT|U;lk3sWKyX;|i1vWCH}}fAEwRE;u_GMK$5^?f#Pr?`r{#4$7wl#Hp}^{^ncq z0{pgZvhn_o1!{2|f?^c5bH1CSs>!?v!}VK-WZ1q<{cdAQZi3wwZOwNXvoX;a`Bb*ZRrTLst+9YiN0=ZKp24L))S z-TLas&BHSRfkL6Hkqiyx(_?z9LAkTJVL&o8D;X3g+->*2Qcu^1PD>Go8e%S!JMxlE zASX4Gkz=`o3vY(?g>BpV$*;AMy-|*wpGNJt#VK~(3|JdbGZr}25Kf-|EQjlZGBUnD z20iBAPwf%Q(B5AxH?16}WKhhHrei(wrDG%hsr`~gYRvRDa#gE6=Vw-7Rr*_oy*H-1 zYhd3PS{T{p6jcp|Ibil5chZnHJUk}C{e%!d&248)BY61u zGi`nWXI`ciK%|7qCmEK?B%&R8*FDP=(dwAjS(n-m%bap0*x*>R(k-K5}kCnd(NQ>T2n)xOC;c^~x z(*TKpG>nRc64r%zS4%QOOsw-1uFbdYASN?wcCtkjmABx9N!M&wK+=F6xVaFaF#s<7Lqz>C!5njbG}wpw<+>(w2gII8-A}h|! zN6Y5zf@*ja6$m40pu^UW5prNNBgp5L#s+y2L}oF=i3>_g$z&vL+3kQWMASXp!)6kw zNUCT^`^+8=-|>b&3)hwLUC}@6C07OBHo-q`9vundXVRD3Hp2~jsoyu|T zeX(q&mI~#;(<{L++W=jfxJ_gx%0I|jsibrE=!1IwRq*mKkteDT74NlicF{yFq$C=) z>a%vf%HWbqCM()n9P43-62DE~=Tqn9buCW9GW=3{m7S=30ZRjNDUPK!ps+6{nP!Sn z9C+K?|7qU?)$E%qJNn!zwC!o-`_UO#(+-E2y+c=p5E!Xz&Yj^-|CD@Xiz8dz$%L5N z8}XLX%n=ZItx^(wI6>oSdeCU=naIuWreAFlr;&R{)5}QwM)or*O!&<(ls_}H_&myN zoYZJ-d(Ac+dZjNMrH7uRB&T_r=piLR)ztbzEtA=eTG#nE9+KZ)%m?qEh?ivZEittG}}NHag;qHIslY5o=4U zyU3t`BA(|OHRpbfEtliByy(vaxqWHfyt9!v*?r>kI3y?HOWPF?qmco0H+ILkSUp^( zV04|()u95}nK$LMhGCW%pfw+?kdAv0n z35>loWcsbeX>TH3o$04-KW#Du+JsxeZf;=?w!-a(enT`gEEV6<#rb~CshZ6vK4qb} zg&}*i+xFoSQ3wBG{+BA9A(d)2q5{5bqH(@uWYc))sehSMpa;P|Z8N}3Gn1|4x>`L= z%9kjv;FKx<{HtzSR|KWY8E&>Atd`<3>u~pVN)SkygOfwqI0?PsBIf6utgb5=9J}@4 z?W`$hn~zRs?`8U8yArO!t??g@tvu6hyUrmP4RJmd9$l za@MCU;*Dn>PL?s{qoc>`&S8?h`Ijc4{HY&)=$EaQGl6%o zlmgK&v7w#`^uHJ@rsYM97aG&8_j`sTs`Z668jpR+6R4-Btq+$0<&kIC(dpt7-&$Q~ zQhgfY5HKYa+SVZzRlgiy72~&{(187hm%q5r-pO@lf^)|RE(G%f>n~evm!OT7Q{#|M^eEiVx;UrzljuC_2_aC#B&twNGww@I?wo9< zZ-kNc!+FB-A>=?;-ETc{RUJb(*zV^5J+OI4NN4TYKb1gJqf~o(j5iJ<5cO~FkG|tu zM#H&RY}9FU8n$=Br`Gh#l>M_Vp2P;UHQS&Wut$FJVpVCQUhcA}`QW#C5&?rwnti)J z+HWxWLb?N}^-*DMA8}h6H zTGxc3w5BJlhfPkBdHtj84Susz+n&eRu%nnA{Ler@b7AwC_9ih!khzX9b}{yOa4}H+ zDDuwrlM)q$Uuly$8v(*5%6+-z>vQ9W&+*m)fHx>kuBlmA_oIXjAZ6S9@_m_Q#*kO>$(KOzdK8++KId47X6Tr?Egt5n|A4nu;+j3PBO@_s~G6@Z` z2SX;N?Jba$l~p_yBSfLkEQzHQgc*;x^n_~V%|1-R&c95=SGc>drP`qhRsYW5S@m59 z=Z%b)Q+e`ZwPH@6I@Q7G2scJmlLv3HwC z*Z04X^s%^~Rfl1D(N^uyM*rDQBA{@ex6wyX(&uYOsNoR@%!pI?Qd-J7{`v$IRF{@? z2us<2Ge(7kEEg8DG)Iqfjz^vuMfu2#dbsf|&(QS9tLXex1EPcZ<&u-jLaB+)U-~~1 z?*fjbj7rN2&WI42ry{|Hkr_uoM~B=rU_D~Up^IqT0PK}VOh8)+m@SCS?tg%z+axinc}zabuQfjOiwesr z_)4odHXp~F>Z7i@$aZ1~sH6!;bKCyNI|eFg(~mMF<4o5BwZ62t$0NpSYlsN{DM7Cx znK+Xd;H+ERlHFzpbwcd5l|yskYW}UnPib_t0ux1@+(__5=f*+DSxI~I_qvVcPiSuF zk^5SdS`l%;4ULUsQ;`kLg;;;S+Mu?j&sMxzUyl5^bsDUx!yVczFF%3UGc-$wRn7zB zdYVd^z|}gj=L1wApz>rnZo<4!?N=mX^wK6v?(v# z(mV>P6-P4__AlkQ4osD%YF$5mIa}(AY)i#QhH}Mu9#>lzq)yeP3})ju20jDPiMpJQ zEK&HH^N-l;-Wh!CxL*d28+nyhI_3Xu_rBQN+vI1@*rw?88_x_bFMb0qgtedVx~1_o z@aAY2%dABEcBGl79Nw?Ha4)q0kEyfMeyEl@P z#U9TN4WMhBDjUy2jk$c^)IO_Sx6Q&1=@ULTY5GhKdWRn!Kf~H9Ay*9?zSmcWv#;$5 z=0O4-NiUT0U(W-NLKrNdn-=RF>dyk$ES^qxh_$y9SLmiMyt`DqAvFCU0qfaUSf9Y- z#ZLP1^zNGv1;Afo&!8(;?l3pJ^HD15yTCc^e51?l`OS=F>85E2<(??S5G0*!5;HRK z-L)Z{S0DoH?~Gpc;WE~6#a#sIE{xGyn=Y~GWUl$dCO9;YZ>88rX+}KlEmBVu#}yry z;uFYO2gk`GY(KZ=UH7T`YE4JvE80~Rj>iC1?jLb9@c6HulwtZ0cXBET1w{Gvw&i`jHV#W(^p1{IC)&U7dh78lJ4w9;kePiPa zjV+>m2g;K$oX~{`>Ce;rT+ONpElk8!)eQyy`jT*E!F?-}bsuG2$)TLa8ev$z14!#g zEmRq>_6d)B)X+`Zk8K-=0Daq@-L@nFt%Fb_DvIp8!DO73y;k!#ujXA|=8mPJKguI1rOmf<^gjzRm)T5c&A)3Y*BumJq&REdbeD%+2tYT0ZjgxX=CLX z`pMoix*MN$<Te`%uOSrsI*V?5s!{cs~;}r`rh!NV?Z0!M>3-4w9 zWE)guXxT8<7j>?QZnYpLXa>%HG!y&~@Mt7$xfF5~BK*EJzQVJ2vmV(#G+D82@PUQ% zQxEs>XDd(zm#WBfavb~d0a$FB_T^*fWJo>U+z!ohtLF51mi~m-tJjGIz)t=VP2 zz{Z3NeL{!!Wp2@~9wD*&3=m1X$(^}zIYm{X(^T4b7a#GiEApk8R~+~)?mgO^4uE^K zm3ijna>$uZI|cWIG*ZpFB_R7YJSHA1EY3Cm_@EoUyk0*53+Ii2Lq51a4X&sXhnU4_ z-D(@zQpLhM_Zv}Z!dX9$-=kevr$!$Zgy|;-L7b4Yqk@0#XtSCFDZ!xYD%3Y_COxm4on5S85?3TVs-+6E=dy z8ckUvM$(88jc@itooOud54A^IFtDU)Yd+aAf1; zT{scldHmHIAxb6Y!^X*YuyQ=4S?7QcPK2Mn+e~*Pzx9=NeW#mv*xgVNOtH3*iBp=7M*A=erSVBu?Z&-& z>NFvtzL<%Kpc=ImcAPn3Y9Fj{M#ApMxwH#J!w5X8?Pl?nj$inb&#cJ}$Gkga1I>u5 zj9vmK&>H9C%ZUI0Z;RkP_t#RHZYv*xp)eUI>wSgtPmZfK!J!Oj+lktlt}vMr6LnZh zsWwFWVITFZY%|8qbW&Q@N572pXDc+E5a$GM-i@18mU0E;h$n0E9n5CwF z0B}h$qS(Jx#n!rke=~HqU&)`J2LAgGKDXOBEKqJ>xeUpIh|oJVb)eS+FDd2Ldm%iB)qAUTPggWPMNlQ13PR zYMcJ$JUQ;=SJjD3Zc8^OT%W=Ovy|#-3nuif<5W@9R8;6bhgZ40xg75&Fw`L%#R&}R zmst3hk7a#Nl+qVHD*L2{IzPX&-y5jn+$b>1^&Sd2g_6HTqb^%f0WbAchiD{Kt}F{e zgI+xQ%#(=U{K69Av7g*5+Ly9uwkij*-cQw)5GSV|iQDw~@+E}VidhGrrhjTSZgGZT zjEw?@T<1PDa4+6vM=}R#sC2}YcKAD2L9MiZN+eG=e}glRe^OsPAryvGqg<+NREv2n z#m8V^;>(@yK(S74Et4e4a#!-E&)f}ozR?I5*$2K=oLWcT5pH~MqMiC&`JttufA(2; zK+o`;q#-UqkMlV!W2xsR%awJz&-te8Yca#_n`fS?961x`roSbkN1XH`h|Uo|eQy0lN^{4>U((9`O1N zmh?v5Uu!;I{+7(_JP*L1!^mhcDc`@JM*PWN-p|s{a#;wVR%a08`brv^^mBdQ$j@bj zMS-=z)IbFpq$8-aCFK-BS-iHG5B%ik%4Fu7SGjyfO&JB-@b8#65Vpb9aIZAgp2L&i zUJUKcpbt~^tyRKg@bt2TU=)L+(~L6Yq3o+SpWtwS(B`E1D3`ySo`AF z)QKxhFl70*oJ7cTUS#j27cJGSwYrBa0%5u)Yeaa|$xRNEaTNyRBt`y!JKJMJqjn58IC1l%lzhRBW~0_8{wtNX zi>`;38ApVw&0+F=iD6)XM8F9(cXm~Nw>mDR>{K%@wF=H_E!~_C&(n;<2}8bb#eO9p zx6n&YZb*(zo4i*fjeLlQ$E))JijH}1=s}BU+C=K<6sv|;=oi(=i!n4 zH)cd-c>&9Z@X>R-8akRa%oC_ig1ROsXqs0~XL`kINC9N$KQMeQYU=Fns+(lTDt-s|T4|)P`XdAiwSa1gQFc#Vwnq4$qm1mKK@vPwXc+3i2jTO6^;CfhEK3ZzTl5r5X zN$*j{oy+kqxMvO_B1!(T+b_nAgep7s!=E;GpS2gCqxK#&*_T<~kS<%~vHunN={$yW z<|MNSzMbiZY;Gb$(ieR#!8J6QTn<>`)%5B69i*$UdR(mJszBq(MtO?{ae?>%F%+h`SbAm8a`)%n4SVzRcm?CAI!sI4N`49m3pE_U|$M*$;6uhOKD}``%ccH+Szz zoL(th^TgqD4bbODd8ehY-Az{|jM>i3_A!Ylz1aETowhW1q$ysDF!N71?PEOJIGdo-)bvVH=xO$?m@7?ZKF^1 zh-aX$`&dcIqL&hQ>n<7x(G|L4Zy|E|FIZ`H?5*y#w;VyIAB$LKHm-xp`Pv;m&a9J` z+IhWTHb!=G)k>#xuDlL5*rM3RRn8iw{<4i-%{=(Q>?An7X8$Ci%;jWM2;a{vf zgS|9Cle&5VJzv5;h6+MEVc<-A6E~FRKEOnHy<-j5;Zf|CkAph8`i}M8_vQnCQU@ud zdabr-P!9Swa&{OhHNK~?+|qE{>iFzW`8(27&lwb-Sw(QBQHKpe z*<+t@B7Z)$21MjmUegTAT209SVnbRzRBO*;i6CB4%Ymd|$O z2Uq8ox#&OO3T<FFOwFJPWbM=CE<^EJqhsw!0MUEdSW zURdFxPD{LpCd}CkSDtamX{|kHd`%(cn?RBtgT}jO?Ci`-eHt>f1cI_wpaiQ2Zj$?t zH%+xk#De?I&1!WosPM0qysAz*^;nNSkD+OX$SvN^WBekTBe{}$+?~S`u&!RZl)xgt zoBSvml9v10&%b=o-ALIY5o_W*b$hqTacxQ#CSKMuT&UcTL*A=!Mjvk3B9HvtEbu-T z^Ble18rMUs@GZO0^Zs($QrMErDXGsTTeFj~m9|F0LFf1ZJbg_XNyjM?6|r~Nc+5;l z4@p~AgKIf{)g&y+Kj2nR#2T0tB_0no&=QUxZ#v!6b#m|M}2O_HDOw;1cVJO zH^*)Y(3V3VYczcH|Mui;QK zN3ivBFllTsXw1y@%*>6aGF?C&$K+dQ)2%Pn6dw9L72F;w@Y|=BXe4sS!kgl!9D)t+sP5D_?L(`AZ zGxj*(>w^ONhzTj2_!?Tdw--J^1O7Y{8`tsCPM$txrt-~N;!?LY?cy!L3Rf%3J zI!o`xW`c}IYa}g$VpLu@K56n?ApXJDjQgcPJ8revbUqm(DN0(F!TlVO;!>MIv-jBf zCs8n6p=3tdr#v2172y|avZ80$egv*k*fb?_&8E(NOU>f=S{^_XXez6yrttZ)`8K1J zqVrDXDU@>JVDhnxuKmkZLro*+ ze}K~8uq*h+tlKvF?R;ikP_ednYPS205AXcEr}WE?QW#Y#^>9eVRZf#er4@I@CV}e9 z9?O@M_hV7UJTQW;oBA3rws@<3K778ObtvnNC_M7(q`^VcWkyoQ-lsKbBHgbaGT$bLEoge=)9kB7`wEy# zPMDk2WUXrOR9Oh6)JM=RC!6i*1*!8iLrfnce?eJY%B*Gvt=kpuX#YA&>G?L9He~xl zrwOG?MA09Z4dg~Xy7`0uu6*$~8YfGwH$!dlE8@=?gT}c!=-)cIAD%x(Ni2TYl3S{$ zO!r;bMQ@!Pp)gNHG*!iK{e+~)>FUaL?(p$ldSj+3f6}XxTDe zVF*}$EFQ5G^{fYqyS#2c96CHiy?`Ckx&H1mvsp5GN=?nB&$NgW*j0pk-$}p4WVoQ{ z@lm6V-`b{Z{It|<-8bb+N?m}ybulG(x8-NA;H31%j-VEy%CEDLLIgU|Hb=dB}{4Vok#}@-@Tb>$}bfCEamF= zqb+EfX@PPVcsybstw)YNUcP2~)D;(BWe^ZF_UJey>OF1fos;*w^w&%B#Q5PYlIBje z|A(`;fU0W!qDK!QA}NBXNGKpB-Hm{PNJ$7tm(txWq5@JX(hW*TiF9{KOE=OT(*4%C z-s`=;_uhE_G2R{ykaPCgdw;cJ&bhv`)-e@$dB|kEiYvlmMFYiolRh-ImT=2Ac6#q( zb5x^$>v%!vVrOjti$|bZ z9xnElW2baU;#rBT?}+eT&dqUqj)SU2j;SAW6nVF8%mrSq?+MH@@?+m2^Q()&#Az#oNzN&jTEe+{QPaiF+dW;-Hg;VZGoU3`ggwdpBbPO~g~BDG`p=^iIi z`;YuION=(jN_7es{iR3gtLSMNzq%`}6Yh4DG7_7cdelEQoZ~Ce?G@Sd%_Xm;6^rt= z+f>Kfd^ut-7dWs$$F~t*s}nP}{i1NvEk%WB#-ew!m243`|Fe?M22NRdwze-mg{6OR z@cOdj<@eZeLT&?kQEo&in~UQv9##>-VFq)wA_$SQSJPEzyj!cRyk~CfH;uK+{1T1o zx7sxLwlEP>SZ7Cj)$avN5ss%7$Fru@_9ZxGtnIFNPbn#FAI+uGoe*!>KMEe?E<(Ra z;f}S~*IJd%#7xFqU-I&NNK?e@2yN)Ha=^1;4CSNmTZ3~vk`+eWdlDb|2{!Kcad&jD z3;70!P%M@0u*+pOdoNfjj4&*}&~S_6-*7|QC|+M4m3Am`ON@J3D0@=Av*CP>eXCDm zb6iD>d%q_*(M@Ay)F6)kwHyA#>yU)9i$2!48`axa&xGtyuV@`Gw4^0?en;Mi4?_;C zUWfK)Q+?J2*@)b_b%bL`dH3XlP%6;cI`D+WByWyt@kms$FRpWA$l*5g?EMNyso51C zieB|zJ|T?!w$6dL*VpxC`uzFc#dY28xbzvpr0B_hvXuM9FW!ZoUBDQ3W4D=gs}<>X zJEFqeXi2PJiFkjmEhJf1+)U8a&eB@=exfaX$2V7zZ;A z`LV;V{roH|i{|Aw3b=>9v&gS^%*Z)U>=I7dTpVD&)O;nj-fjV9Y;K8en4IA0wgE@g z@tI`voZ!0Hxu=t(r<)(Y_#s9`q7Gfhcuv*(fsT$J9q(6g{SNLt-#@z;tlF>Nj<_%~ zF6*^KBD}ZgyPt5q2KsK?OXTcGe_`W|w-e>EW>V6@^U4|hmkqo7j@lZlwhJdKMYypf z!Ax4?n3R;squN$D2|~p6D2V-;pyToqzWd|D5er*2<*K9+H>b?`+k&lS&m1VRQN&+d zO)VYmiMFb0>z(MyX4f5~a{iPOhK^Hr)U4SB}CJq_YAQ>i!Rbab%$b9Fzz z*!ghpeWf%x(cD4t+`*Khq9Ua|J=W`Ad4%!!$A5Tb)2YnD|v;ymF_Frh<%~^sKCVb-$iHejSp}_e(3SSFdyRDY3&% z91LojoR@NGp&z?`7{B}6<2TyW%u;tv$Nl!Y##LcCO{!dce{}X>rbC7I?gzH z?^8(%zbP)}A;P)<|0*ggZDw1Vx!aHrafgPIjsDWeH^T1lxO+8;2t&h9(x~+tRpo?j z;Y_|otLVhcntpZl53X~Wa&lV@V_6JeN>^scbf}Jvep|4EW85Z}crauWNX}Iz+uZwD zC*)eZm)w}s&!3bZ!^0n;P9fgKhhre7*^F!RH8G=P22x#r{NQNt zXq&U8rn!?;P@sI}o%T0FdVPZhe-W0qAr}$KPoDU;Q)FzMTn=^VI>#)#Y6XY%FSW{pKyH3GIzCF`N zOw|`Rx3Iy2vEKO1)6-ZKo8;zAiz0bwH!Iy`E-qJ_D3e4|YxmWpq$ErntOl5s`lckc zv88tJ6TC3(o_BqF7-8@wFONXjmg3c`R}aIX#mGJyS=jI@zCKI)XC;(rjra89vO4IV zdlFFyy){uv$K3S3^O_$?Ju}B z;~~rjbLzLds$YC+xc@2bv;SNe6h^~ZEKp~Hh9y0wdsnDu5HpE&>(Bit>5DH_z$}Hi zq`w`WO-wHjljD6p%S8;ITFMUT%_-fFA3xrrc`gy7RKqJx6RNj1;_x_ghMKP}21nM| z*!Z$fzeEaw!?l&mtaLS&9&>ZF1VlvWuf_E8Wh^Y1c3g$RnKUf(1M{1iBiiz)1a87K zBc6N0aP@5nnWTgS|Mxa|b@T}j504&0W3eYs!e+}b2h9|fKaLyR*&isjn#{38{b%eH zLT0!#p1%^Dnx~gV9GBMB*ELPeE+kNioWCn+*Jai1iWhR+H)0A4;ER*<4Z*_7${|$D zo}FDKlHnvk8*%1rU4CXTkMaI?tJ4mZwT**X%t)t5!s`ok%`oGN??z|F?AsQ(fcD2i^7QG-f5ah z<(+}d*7p0U5>!Pt3hsiYJ6wLzoCGkc2z6R1E|_s44+4mPZZ(r%wfo8<|M2TW{Oyx% zmRoQ;<)1T`xlAY#xA^!P*B?3>1q1FWc{~pZt zlBzt3v`P$NEu9l4#ep(3^&^EVmI?uXEUI66z60;3r%9*1YJrcRrtXyY%l}M-9*dBS z=l`DTr|Ac-`QPIjGMN8!w7k}YRK`w*aGXEZ!26$rF=lzDyj8zG2T# z1~1g=vOWxV+9~(RtZv(}=a0h!6Y^3e)53`i7Lee=_{YuS*PA@A4u1uYU0eUYV?|Tu z09OJx7T{IS92`>Yd`39l$^Xpu2_>bIvbJ`xRn;K|8ynl^rgfKRbB9Ke*k?tl@a#u2 ztH}eGp+OGvaM|>##~!1eA^cyxMD+EaPpR4DH9ARaw0Au<@~dd#6!PPt_@G*YuZ4JGIf;aX4=$e*={~q7bB9#3TLs&?}{P=`uw%rcq~XZ8TS=g8NQ7^;&`n z1K#$>7whqz$zQ%;K|5FtTQ1{JaFc=+y|dC0V$>1c@4OP?^)Z$sTgB}CM6>pzOSi+i zB`;h!u^eiA6&wM2bD6hq#bC*g+lv-ett`yV>7O1ssO3NBns1MP9T;dI;MNfPZo1{f z&Txg}7gAL6kSJ>}u9UlG05PBLB zk zMf#qDwYOJ4*gY3kS2&o+2v!Oh&6w$PKHVK`C_5bQ7Q!TBfys9J_U#h)!*3lm#@gD< zj~+d0=!)T&V=8^#C>f$Z{B4eR^X%e7Ik`Nykn2Gb=Hq1-OqOm;PZFJ-ojHn#&+n(n zrPY^iFR;4&B7z1QvvbIv;kDL49b3aUUp(>#7Ec0$9^%i6{!WvluhTD5G)#E#sg*mD zkw*(Y{YC++%Wk1d50vH1Li@!x;j~YmCjH4sQ^^F2;<@U6y%0s2{skdsMQk*~Qu>Ni z*X(+WdoX^s%3a5Im~on^agJgOzK4QW=E#@0$)CXIo?3y)ka+EsBFC814W+dn~p*d0msIAOjj~Rv}ITA-ueh- z!rtm+wA$ybp=o|DKfMQzKV_SUzv}v=$=v+zw)m>&oA!;aU%x`H3!C%K+PavP#qt&& z#A4#&zK)29P;+c*kD8to4aS^%bzBY8ePUwb0}*|nFhdv?OkTgh!25ll{HJ3sz{mv! z1;LbJCvI#GXcHF~C%8^Tw?w)|55qSF>ka}4g)6JU;PYX8Te?K3g;iy8TOqtf-1~8; zx3cEeizkQ-&}JG`7UKA_RRa1x8m^8<7}%Y6I`&Os#cGE6m3;=oFaxDLv=GR=^zmUD zaB5Bz(Dkr=qG4*f!)w2J3y(~Y?rD`_>ksY?)$4q^>Z*@S8Q|O>KYrwy&h@5eXIm&8 zBfYJ8&yxN0J~l!hA@f=BHsnFDe#Mg>-!iM0h?vFZ#@~c$-C^933;33&p2HB^Pp3$- zS(p|Wp2CdL<0K)&$g(PgE>js5a38YHdL(mSHi#T7<;a+&*=VaFyR(~HN>UO^RaF(U ziHHL-Ov-i;ElcsdXPCpo6#*+QxUI#>m4_ICVF@~~WQ!!9 zjk==aV7+TV31@uDAXjBEQp#lS7slRs!fsd*etA_UnpIM#kCS4fu)T*O|gr7fMk z4kp(i+tngyTYUdl-ZiN0adpyN$!Ad83oSlA{$Pe;@>NwC$$6z?Tt7J><+8S*pdiff ztybEEsU%EH?Dw+>J=S;~x%(BdW8>E#$Jk)MfWC%l=pbvfAw`r&bkV7^i zme%_-yZFoxY|4dFO+2t7A3qw}RIvOZ{nyR+v z6*e{wYA*`R$=yuw4WhD9GH(d*18dq$OjHDl%_|?6h5QZ03ujKf8c?MpcV(*8Q z+r%hyKp4DaV&cr8#}^$Pt*Py`F;Ur*n{Z7~aBTjaf4UDWkgaZU{GXxn!lDiiTrWmx z7x4;$#~7HH);8}d!H2=V5T6^fU&n#k%L@n_eWt|S0DIlXy3HiA5JMCTZ4-om+0;MV zhqR^P(A3?-BRkm9EEkD_q`X80KdB!0o$yCDB74&7k+d`$_yRg2EX`8e3x|iknghX| zl!4To_;d_JSZvK6U-&zwQj@_&as~Rel>N)ns7jo4&_JB#C)4%Fe!a& z%me`hRc?E$1YX1vbOJ{>m-gi$>Y*;|`;<-xo<@sXG*>aBVNt%Kg>fOgW;i|RhU6-;_KWI6oi4F)`G zqh6d?vp;L@t4%9NA@!rb6`BnqAqoVeZGKD@nV#HYfgMlr10r>r(4Y8T&IDE!hpBDa z-U5e*3kRq9U5OPHV|R856pkY?Cb6-xtzr@dy7`l*<_b6=HPeVAsAAfciQ&eDOdVh# zGY_Fni5KHtUGiBXra$fjM#0{X!~h)pSeI2==wrYiw4bl9EYNz=MsahI1YBb=QT-AH zRyz?82zI_0v7~!m6clW}kV2(M1RTrCN;ScheAhMyPR04`@Y=h47D@K^F#>Y4PLQW( zHq)SM+u80RK@g>s_oQ7*y=k{YTeIRhyfvANhjKoBYA|(0T_#DBixUf~YFd7{{`D){ zLDmk3J46Z}=ETU2dQUp{Xl@rcg|ry5D=UALUJrq64NpW|>|#w+uMstwKKOuT-a^CV z=aP21mt@YX*v6kLDicAf0BeCa%ZHTXR71h}IW5f{e-p7RA+uRqz7L^FkDc=5G;@9@ zmoARGuZ(P+o^z6H9j)YoOZ^KasH+o`ioFd9^g({D?h8P9GInJ5_~pzUCZb}9uD)i9 z;R!gtW?LWQI93|^4@T~&`QweWU8=MvxpU(01j?OjxRga|eo4>W-F;-7Ms?s>+wlfP z&E1tjDzkcwKr(^Oxm`lOneVvm6T?zN09*guk}g#wPmdS{(fGYX>@YW zgP)_6zXN^?gJ^B}>koA;ZV>FsK+?d+cRZvw+jJmPRfvS*1o1hZcQ%ZlIn9h7Sv7XO zWlb^}coRg&BI3_db$|**sssz658=xIz)}aSfOid8#_s>{kxdM1^!s-#o8fsT4FVDp zhA5{_m30@hHR3&%EROS7BNI+ca#F_d(kE}2F26kHc^brHb9TbF>bfC>sQK_& zn&27_MWx$5212vM8fD|;u#4C8h8=S(%vBMsXN@wHQ4YbEEnU zTfZu8uI5)aYsJUYF`i($o$v9uAI?Q=?(Kog&%a#l%qA!#v^A2Mo18c$j;Q$(b{FLy zP7M@)p4XLctT!}2c!2cw>(%F;jG6~@srMyQoHizmO-<{tyF`3Z&@gm|Hh&(h=$yTj zB=>I=NRyNQM+@+SHvS$2oyaU^an}|7!iAqs)ovK?32DZ@E6Md)T)22qBhD}kY4b5( z@YZ!seEM>~kK-Mx|q9D_cvb{KQj<~mSg0FpAvH3$fvypEaUF^$s@4|b< z5Z2&@DvPJS;-lpMVHx)5S&vC?kINQ+T{har%Z`nc8wv{e(@{nVjq6(Fn|rCU*9Dzf zX=Dy=AZz8R&#SqNO^@*81-GbCiBN{h_pNxn&II4!k(uUqzQh-4$jq&JsaO97=}jJZ zC7dDWhi9258EjP{-kNqNl4m0V^D%m2Ru)dV)0!Adi1x#W&RErFx#xA`PLo07qgGqR)u&gfB;QPfaXUCZMnjOh8nYu3KYzY( z&cgRJ*3V(K6>TJ{1f<`zvj*Uq*sWljvMa& zxRVG%cXi0-q1>6*Q1v-QB&==iN>>!b8+?l3A(w4y*d=A!m%_8=buNo;O^vs+^N~F` znEUqwo8?7L`}k--{%$vSk}^Z%d)N7P$pr$1u6zczJZZ^_58DSasqv{A=o8{^Ui+b# z>6EgpR~=hwR=QplIoU+(^mHMve}h}^cai*Z+y2HRg*XO&EzhJ{mz~Gbk2}h$s-PO4 z)9)TvmX^k5U|@LczC*`w_wH5)&tzg!5;>J*aKR0nYS&$cD&E}-O@TLjrlx8?6bZ6U zqYx2$zM}C#`E@h29PdW*D}de+Q#s}9bsraviLOyJhRQQG!hhQn&NCflDgOi1m=^QP zyE-iZ$hzo<4055jUi$j_^74=05IN}%1OQcZ-sJQuY*f?UY*+0?JgAW~<4>FLg61xE zXqt?TLS}Zr+qclamA(%Grni>PPbuQv_380EH&I|S9e#)E|J+J_oPU!!wAH#xXn$%Y zxB5+0nYyO7j!p=Nk=*E*Wp^S1hnyX~IfSCQ|E?<6s3=3&NV22>{dFPG(%xlEV?nG}97hsc=*E_I$4i60gw_Joh zRfw71HWyEN24rg#-E!X46|9^#LA>kZaUA1C8db=S0sz>_I}1}~wVi!fu{9qvlxHBo z85LFHdCFf`SGPH`l1n8xw%0xk*1t(;f6V9nG~xV#xVR8(UxRcC+g`hO$6OZTa)k8$ zodSIsu276$a)+P4Z2YQbG>6u&?HaTTi@QJQw-z#6V{d&-&(}P3$eK0Et)54L%puE( zKdMZU0Ku|x7WaesA51fO^ofFk!hYx0e*s6!>(2kO29&n9G5*5={+}Sx|NUr^Kv@~e z{aM$9a1~z0?Y2^s;>0_Dnovvu7jCiOba%_hjJfyE%YAwP{k$LDEO*oW4`Q0`Bj+GD zRr$=r*hpFW{_~v3(=mYXnN2SK8N~61)+hf`m42Enb5s*79Z~Dc4F7qx3^(|HnYqNrGXR)(41?D9&fhO3$0yc%?|Waw((J+e=PaOP$-VjhfAqNifd)`-Yc*p~YG%wF`)|0m4sbrmU@gMi zei*xIvhuO84F0tFmlEAYx4i0n@x>kKa50F2A;YH=)O-c$Gx=5b{q6l`Cs|oYq6^C= zbXg%N-61aia;%u4jLg&?GlY@lv>9{i13K8!*5)AE_GfV~I?g$IJ1GI^b4Q zC`b&kacfKeo_1#cBgH;7X*2!5h+b_*gXqpi_qfBo`CaUk&DRP)29^u%cq#~X#)%m9 zL;--Nps4r~;4$LSA+v<;H$vr3(jx$rG8Ofj7Rn_MB2>B#Z{}7%-y#;%kPLvRs|5hl zh={xEqdTrxGJ{=FLfB6hx}*op3e^MFR>!eZcQfjm{nz@J?18~(0wU*qd^pWhBMX7; znQOt44i}l?X#4_>OHKJC|T0(arrzt)WsoTA;Wr224Czh$sYtk=e__ z*6~Krbl&=Sgb&2?;+g$`(Ccqhks`4Pcorll4M8#@yVkDP5&0PaKZxTv;C}Ux1=@@P zLk{?-_*UKwoLK{LbDS{GKUUy=pGT>~6cFyWx$fLp=H&w1qC_)0*hhv2t(!!qV>rSG znk5y#@nCBU@#4!D21Jeb=`p~7;y9_OHTAt|;u*@*E$>5MF`)oYnG?g|#0-QXG@R+> zIm}_8cVF}v-v{gu9UreKz4yJ8f&wI#@6jy*8j%i`oq~>qJZZWLwrYE+kRqYMXlE}6 z@CiUGZw(q7KX6AD-R0yY@)q^h7eYJ+umO|@#q@(me`Aq|TcNFqD$V{V9zV-yAafej zW{#LahFpio8rfYVmGJgg-JfERl5Le;f(XAUkSrjYq_Ts18DcM$qZ`Q48-+aYtNE~P zz_y6Nyv(aNZ{CWi{>?{MWGFMVa#80wAC64po{KK9+&3Q}*L<%$rBc_?dXkBx5fx?#I6iF5RK6Xi+ z>>beBfyE)pyh3Po=&7WrbO*)L?*Gm|1JjGd_aOlTCY#N)&)CqE^8>-r0H)|M4AJ8Z zWn{``(wi#E9HD_bHENdN!hEc8o6#Hx3mY3$B}hz|g@vWn*vjc6Tmu?yKJo1;WWxZe z05KU?Bm$T=+J+YbP|QOcQwUlOEry0ti&6iWw)A70@)|dd!=t0**6vp@38hHz0nqyK zLlKyhmohZspdDaqv0!$#W(92iG9gF(Jf?Y~1JP;lsyRqQ)IWv*jta;CNGp1hnTnuC zrt9&yllo1OCJwe}t2N~_8XY9w>uk-N)-O-#@g7M01&E0P1m^(eNd%KFeJi?D_2tVq z-UwV=TyDvu(XwkVVp4uVe~o@zZv==!hTedL^_uNSOw}dbfJdLjV5xy#N7Cg`3Oui7 zdUEoZUerV-+4-09?M?x*@WZ6iVZ9q66O~%ua?ei|MDW@)t3Ai{qJ-rHBXT{?E9=>{ zwYA~JGW%A&8%Dw7nK~lA&pc1IBz>R7mJ)Z`Yhs(subLQJpJ0sCc>9os+su~<*sY43 zEtbS@R6Dt^l9LDP1g@?%xH!rM)L#)fI|!|3AIueCo>?28)Qfs_{ukBu*2eo=p0vly*aMSpk7_`BeR+CkDZ6`aSGb?lLPT6H;{Jzfw<9PQb zoOsVXezps3wA=70HAUI+LNMn03^`uuW+hr*qKZDW%{^|;cpv?NQEDNNL*OQ?-)TDY z+iSiiUm^h?1BT`@F*gRS$T=w>TMZ7sA*{cM)mFn4RDf^6-4weulmc?t@}4TsWAvO7 zpsRU07s)j<7PE!>nf*nnl2HPKKlehDlQ)0*9v(~wu#9kKeBl868i>z_G(KF{ak>qk zkBl{e70{$gVW()ohPd?Wdo zANT}?$d|zT-$|I!xbv5!D7Nu_{rt0UoY5L%?Ei!-IsI#B8~0X>xBq75?Gn+lm-JpK z3_bdM<>^gseQ+%LQQ)-_AJb*!xSixlvgy^K+fV>|>c0Y0^<8W%D!`?0zhm8(jmCuV zLnekKsNvHm?x6H|K^H7n7v~{dO@ZF3y{{^{G#rE*RmE)?3d2A~@!B2XR2;cDe5YG~ z;*SiwY5?W}&`exWpYlrR2Xna`EVT)2g;1Jg`AJ~_ywr#&LSVUUsa03+34s!aepq`k z5Y8t=i<)0UiWNX%hNnb%di>)~fW_)(4$2>YUq}{0 za?IswzS9QHce>P7ugn|jPQ}BpyB+3aT*}lrL4$8GdG$Hqn%-`JR}I8J#+H^%8eZ;b zVOOsbj~Z?ay?OZ(KbzTWCB#at!e8;J!tH@-`z=bTxH?anL8FZ!nqh4nt)M4&Rdtu9 zAE*`DUfAjHUo>I3%aBE`AzJH8yil(-T*gvmW?DCLE?4X_PMYnc;>54I&g|CAz4cT# zXfvv4&)vFV#}&IPVXseoZJ~WT^;>e?^7e^J-oDGchj?6Lwqge_mLWsfBSWK&f-+`q z$N2ih)OU8}*(t_^5Ns-rzyU?bhNh?ATKT4xU*FKj?v1}QbJU;O1e`N;Mgp;xhD~Q4?35! z7CN#Uj^FSHXk3`caLf4e1+|<17wESoK%G=8W+K^*R9!_!>$5e#5c-X|O2l#i?V|^5 zD@a=)arOa#SFTf-QU2lO73B*Xo8<%~(kwyAgd%vu$g2;iWX4%&1a4a8>AF}_=&kyBL7m2|(fPiyNRjnwH- z)_~2M9zRtG_9c(Tk(ZaZ87|E?vVmQ1x1NfQV<+(3F9Oxcnm#bpq51d_rgn_&K;j1Z zMy85z5UAP^Un4&rs@brCjiFAE29X>Dz?_`0kMM6H7W1%NWW%sACv*k~Ou(fPgoS12 zj&%H{saQ#ZKFs|MVu1kfsd>I(t72v|C|7ik_Xbo?h_GHaK6KL~f87`m@s~Pe4;J)8 zd1q2XiDnH&@cx zc}2rkR#p~NH_`pBFxC8oJ&yDbJoXFAEyio3Sh{W*4zZ$NxR?TdBt0jmDZM8pJ3Kop zy(Y%00t2!6Ymaym{QwNd)2C5L#b~UD8{6|$wb+vrJH$Q3=|}hF;}{&@L^9AFTrQue zJPiM}k>G}sA`v11GZqW$7n}Kz_3Y{>HiFn8(()$vbDX1{JdsvwB_+ZM&n^7)?9+%( zYxB`DF?l8i#NXxP3wY&3_ku0x_}#A~5+9HGT+>mvD8xgkZS62fO-06XAnz>Vg}2Zd zA2t^9?Ad3(C^o|LlUcu#_LJzSiM#VF&pYBR^2T?T*sgQAa(;6%_nD4&YgE{)^B|+B zMn}7dTbCO2^ty;As<87p!qn{i^T=IXIh|#Cv^xiztZ7ZfpQiKd^gyi?$3$pr!QCVGPPHWFgZyP#e$A60Np$5^v{V zQ_a3kEC;besy(}h3g)Y|S36o@qF}BvU8=GguDAh2ZlYoaBkBe?@kuW$qT<|iI;;Id zWJW)TjfK}_5W*z(=od-AJ->UH$&qe5TMwqsv8m`@zu(?_$p@X?Sj}>JvzEp?526d| zJ2~jLa9cRJxRR_Ug%8@|we(pVRS>1+>}v&^J39^OJ$iI^?-shQgGczfQt9+QWBA3H zuy8uesEJCi#G(zi`b80MorB=>DUnx>YP-e}sWzSfJl3cdOArF&jV%E_!$ zAPLzU3js$lu#$t?ZWn(3B+yUH{Fbaarm}b$^9FbOvW<47?bY%LH&qj zFxpQ~Pa9`gnMNm@CEJe~vsjo;+n6^Xc-O;4r`W!7dI#_Z^Wn$CuxH9L0^HMQ1RshENW*rwwrYXLk=jcL3-c$~4?%Q~C@=~t?Yern$=%(( zC8Tfrq^uBZ1rT|47K)0Ockjda0#ynM(FVcgi+dZAGVM66=$&nZS2W{;=YA)9w}-pH zLPK)f_n`04FUvoc{y{fbWpKUv%y*%sF+Yinzf zmeV=p>eZ{1wsl?I)#n}COq%(Z-V-7UCRE|-z>W0jlOft;(j@NPyH`HCvuF^KQXPVS zbbO%OfJVjYdE#vI%FWps9okxMF80`I@b6gz<9zRh*ll4i3_Oxou=Q#3l0+p~PGXI?k-&{ z)`65rjr17@I6#OA*c;dyADN&gOQBSHi%8Qqets<;vI%F{GJdfyU?KQW-ur3q8nF=_ zZ9TtpgNRI+QR?aR+*%Nfi~c=E2=e*{2WNs{1GAVtg9$;dZ{OG(@97LhvgvEQdZ7(b z#)FBa^)FdjM02$A(>#~jsM|Vd3yBnWA`^@d&YQIf8XfO9aC-Z=?wNhLAo=Q&&1kuN z;;#D9@v#P@l}B3=i=b?k4%RcX74?f@k-0oi><_*k44^y2UjD?$z|a802n1X}XB;F> zu_8`#?q&}zgVU)x-P0%^%uFHL9~-6L-Ba!qwi@{ks6X08yn;g+R(T%uf-0_OYuoFl zg${)(A$+dO$}-SkWXuM;fMVrnRxzfIB#&N0%4;p_K!pr~a0F84KR%Vu1zKaUua7-M z`M)>+rGY^Mu_UM=erwn7xJ;Ru?toOCXrF%8!inp)YQLDM)g~ z2{njdzPhxjKtTc!p0z)PH!8N}Ad@_#Dp$?bW*&~nCb*iqUQ)l6Yh*OCy0*6VHLzCK zT5TR!6}WSXfsh#NY+?L)aW)37tzg|3`2=CSHg_PY z@Y;Co#*cSb7Vbw;kU?H5=;qAp>GC6ror#Glcyy-0W3hxd5tvUnZ~Mm1ruB)8^*rCY zjL-n8)cktc3Ntdz?b&j$vgGEs3?U?3;Jm_gTg9 zzLQ#NUS5x0)Ow9Qb#lJ9lOCs@se0LLX+)(#46pZ>cg4fQ1TCqd+5F#cPQ-Z(_Mum5 zhwKCveu(W8J2TYdq_^fcFu%*%7f+B`=lRN>P0W-;Qt%o3&f4fT2x&0O@?;jTTXSD# z_{g&`GeZ?z#&a(81@rNc7XCd_hiV8Z?8?hqUbS30NH`yUd2-@|iG?Nh*!rvC{nC&S ze3}z;%5dSWPmPBIs;U~AxiDowJ~0_)a7eZn7iCXmBPSUyDXTzJ;c(|u z4T0j1?lpg;E_&?6WoNwWL@yvnAI2GoToAnWa{1*{Z7rl;7gM&LPks7Rg`g%=z`#nD zXUX4Vsu5{L75L*C@Fl}Cs#E}Kf#3$<#)oG}ghx7@vC(^9;R@msRk$`GZZL_7wO`#VDDRuH(T=7N0IyqMETb93E z9q1eAubZ6I5sW~F-Ld2XhVwu4WX&VJcXG1WmeJ4XXs1maQcg^W z!XH>#2A5=gOGY)4OAxiT{@TC$`E!C)r_{;xXJYz*^i!~gHItJR39$c8zp})9f|8Q3 zuyBd%9D^{^p|Ylmva&J9W=_e1HZ&(-kco#UP5f|bDYZ!0O0)3<_r}kC9Np7x%QKht z^rGEm~n=AyS4!eO^i*C4&Jg5dv)=mCUOV z8&Fg5Y_3D+Ae2^KG^h##Kn+9zMs=~}_{-n87{JxyWNB|`IFv}2vH*8dSAPq56aoR# z4`lsAfCC~sC3$~!*dYHDS#L8$BXWKjsm?pgdd#X2JpPXs;4eH6zW(4L>JCVLY)tzK zvk6X-S&lG-?32%1qq-hOOsC^rp@5EN=h2&rE|pdg+=o+t^C!! ze8{>hcAI(BY4;%!`A{LDiFc1QY7vs4tMa*G&mQn0^Y}?>#(D_3$R7DmF|RsM?(A=g z!iL(^k8#IZQiLs{XEm`FdZHl~0a3zjdYjL@b$xxXAOM>PR8xhdVR2#ZK$dapx%Dxa z;;;5w$pa_bc(xVCM@Rn03=E77q4LbdypBJk2L}fOp2^ZaD=a!oNFdF7_yid>UqA@% zAA@X0pij7`r}r`m|M%rj;h>Xq{?$51$H4f}z3J{fbCEyY;y3DzH;> zULSwgerl`j7SEGI`RVSJ`0d;*9a@Z%xKlwV`}1n8t%6ynaS&%D=H`T-;1PLNTNfO! zWe@(W_ti*FVbWQlOLZCN=QP^7~fmFL12M1xI1 zdV&Ctrf+(^mvr&PZUNixJPHjFNWw)DMG{248wlj?moWK&l-{dY7od=Y$gUG;62z@2 z!(sOrP&BhWWd2Afu@{3eyY{(|Z8GFAZ|+2BaM>}n%;3unqaUIr8eeYE%E^bwa?RkV zevY=Gu?XNWQH(8Zwp>u=I6v(20^E=0LA$&NpRljf#L|K5xJ%j$Cwnn_f4c*1@QO-m z^p^EJN}sq=2M)R5klqc-G7ru*DN*3)U3ZtCZC49p|A=EA1i2qhB^2c0$2haAX|NN<#G1j>xbUA}0u$uFxytnPbie;Csv^2VZF@^h$ zQ0w~d@qe!B_y_X-f2m^u(E|W7p#0Yw$0-I;2rJYDK%Js!WMi2olKCTFU@X2g>jP0LQJrnwlgE5-;fK8CX73(vpK4 z*tiSgVE9O{I5>VPvnGe{Txoa)zNv>ex|31e2 zp`|Fd0G9vF&on-R=Y);iBRNg302E2>JpmG3aAGgTk`~|2U-|bjpU!c6JNf5+Pi1A%3WAxPl$$=XnraS7w0JWE%Ndr% zAs2CQgf2fgq`C}ttPK1`(^3bAU;B=kGU~uj1_f_6i&LUd z1}8NT^}VgF@r0L4?um-NXRP{Ib$0AQ-63EX^}r?)aG4|<&Xyk@vI?n+X^1e;y?`1} zD1XKEsl9b0Y-6zmT`c-`uU)<1*`J}CWnN!g#=r!f9i*y{J(AQlRe)cr_r;ZLIM_n6 za8T+1nJtnDP00mK_(g<%%@Zg;*{xP*Qpt8Ff#3>gI8;QD)g%plDAbiGG<~eqy$1*^ z9Mrp5-#AI2AP-p`0k;5Q2msi~NkmPX=0}G5H$;QP{n(*IB9DQM0EQA-n-JYD1N;i; z6cOrZ-5DA5`lGMb;8JW%(&8SKh62B(-mhK{b6g#t*L!O)NziS-CAK&dDaSBFnM zl$I`bC6~FBp$G9Kj1VPXC$NA}28b*}h1mkyqb&79PGsR`#TI~yydFmd&cfNBzu4Go z);TCNXF#2w#+Z|mn@hn>4@C=%Qk@K1@QV?i1By88#(9jOSi2tX+3@E%s7Udb< zy!|2zs#u;b89@WC`OHE53-z^NQ72Epp8^`6`AwB7)W#nuo0Fh>0M@t`}fgdNMU*)l}@R$K}G2- z?Cgps=OESp&?@$f{RS$=g&~|FC`b+e^o^~*yIYs5x&i{P$B!>VaZ|%o@u4Rf8%Yon zM~9s0wh)u-H_N{Cp6T=B!((Zh`)iM&HsAp6k1SbTk&#R~KAyyd1z7ID$It9G2=()S zA1!1hPo~E04Ud84m9o~rZ1CFcSB0z6Ui#7%$*1&T?-T7%#j{La#W76-gBd2vAOmr6 zvCVb2a`WKne|0BiS|uH`U;d6ReL*r65ok^<5ejukV!4AI`YdmH+Hue(^EXpRor+jCpC5eSEdAo2C-#F! z)|wLfZG_|!goA2oZrK3K1Lzd>-r1VfhxeOe_dHhym_F#P#tXSoA9jQIAS@~Ha15EgDGTgnv8Cd|c4yEq;@Np>kt&-&%02A5$lDL&_4_IfY z28c0aSA|Il1XOI!paMf&Fev{)%_|`|Sr>yf&$oy)8**uOOH~W)aRH$TUco0P;?v*Y z2a;Nq-v3i)f4@)L@|yEC*k!!CjgpQTeOgwsuFa4gRyG2WOe6aWOb--xcBh5NeAqK= z{qPxz@|bd1n3x`zRv?DN#2)c<90fXM}i(C`JmEtD+xazg^B zC8iIYp*9NAHzaY2pnuPG}| zp7P|90M73;tMgYVUe2{{8WP5k6rh{y?}~M1$P(=~ylc8|e#I*Sy+p z^t@{OtN1~?ld#VHMJiT12?nI)^{xMDBY1^yy*@)J?L@fS42Jm8#E@Ud=g;~AFDk)TfOy{rs|I}ZOTSItg=glf~Z zf)MwkVx=e2-u`tYulV~rl_jY$5}#C0o@={1@{$gH)f1xJA@B|n1944=e{5h%TahXN>&3l}e0S+5&`~Ifv#(kn&RZw!ymfHJV zDew|5?vuc!Y{g$(7lZ1r#GMYi$q@Kgeq*4I@64?&@Q)qs;ENI#HeRhV=Eh=;pP zV~#Pu&Z9M}R+R&92y40sfdWt=aA|2tA+YpxZ}h4`tlS*;u`TneV>x_k@TVUE)yX#| zoda8UcfM<&qTG@Edk=>k?7jbrtA0_@{8t@y;^+V0Qd$vc>YwH3*Af!>|NQ9Un`vv_ zui%@MRn|$CQ~yy2xHL8h5GWwNsWCe5yr*dW(8e8ui=ChUKGK>3IjkumCz!+m4~jJX zd+6qAX~ul7q}X(i&{))KpjLddRjppLpNyzAriK2*4Pq`Q%TztR5^#;VX8JYuSJ!@) zo@d4NP*qeoS@rhKk!#4a??qOxTMN2Yb_P9<8Diy(5=LFuigT0OEccH+#}+{lleb#> z+4!6KvtHR$54zE+Ck;DJ?*1pAb2ps5w&1##2Tc>-ty@j38=OsamYvi6Iyl212{lP5 z87!aJK=E^{;*^|+q&`k-o|AE#UkB~y%>Joydak6Ko4{G7JvNl;O%94& z)^Zeh^yn?{d6=#~C@EYd6(`@V-W14sf0_&E+B!J7@KD-q$Y6qE(&M6@p59QI$HlT$ z$BJJo5lPsCw`sT?G1VV&aw4Y?7VGo;8%CY+wFMhqI^06w|Mpytc6=WzXnO|-;{p8l zmcm~p^TBf!8t~lj5EAO;4sMx#KAPhp9ofmwMMAAfr!s@$C~u(2^x`1E#OEQ|0_LI{z8n3%-frjq@Z z{pSa)a}f>hCdaP>u3a^#`gME$*PzbbCg>o#rh}D`D68s23ATAhilRAdULpgDAkvKM zGi_Tp1RS&UWmF?<@xSL*t4uiQbT&Sq=sZqWNFhQlNCW5NweJgc5i5r`;Z^vy#j6H& z%|S|mH%2%K_BCzyaeoB~LhqK3#lr`u@uD+1s0e z4Q|qA*dSYdBe*12)$@8qFx6pr4N3;Y9QP;@HO4_085~BSz2c{tSPHNEYpLc9nv{vel7AE`&td83!k8E@HeaETCR`(;v6 zoXq}ZrEhIZ_WHd|S7LcRNfE3J)adY)qIE+yGha;%E`fxy(e=}nTR+eULQN>ts}3~x zUc73F0Yecf^CXg0kCNfL6DmT{sQunvT_YHSt6cs4h!@ezrWGanApbCEyvclJPnO=F3#xAcj)U%y5t%q{)Z$+xl$<@`X?kxx2IB2bCZro+k8g=!lohch! zT5tFgp;B*IY;by{YQ0r=VRj)~RMTBBUh{*`q!oRb$F+|m1HT#<^t~!NoU~L%CU1K8 zF0F3=41{G4*wpH6^S(+2@_pMuhthZ-+KAby8gCLqBbJvEDWXzRY}3=z3JO(9ns;$` zcMrN$2Ll`)_M&thzb`l|D6mKBxnsD)r)nu=nkUa(@0s`R4wc7WTXLPMmo6ibf!!G{ zVEWd31h)_6-)yhJdb8Q=mVBJquPxnN5}wHx z(?QqLML1{vNqg_f6E`-aPEGKT%1_pi)(dgZ&W;cqB>5%V`f-fDfq^>9;*`>i8&OeD zza1j?K@oemSm|}JsaLVPCjjuhH7}`Jc@buev~(ULk1C^*vYHF#Dd<0)Yj&4Ih*1v zoXk(IJ$yQvtk5$jxcSyz)yXZ2|5OKmptpa`Dqkj|ZRbf&QPIO%SBGUTdq>Cbcoi7l zAbL7WmjmOBy0);Yy-^>t&|mB`_pM0zY}-!mqnl}n`Ul3tk@C&C(_J zx!4LyZL`w;7Y=iJ_yUH_$qqF^5g`LOX%TB1sl!zsk`df4iriz`SLC*LYYGMP0+z>c z7rEy}r>Cb8Z93@0UnVlLE=P&=+CVFs)pSvHb+Vb(khjZBNKH+xt*`qEmvp`fHAWrE z^wGqqUz!$!l_dOmwwqclG=YcK^&aQZ=#(r5?IpKFUGUAw=nY(^y>u%@tsw-LJl_PJ zsU0a+%WbT)L!98*UZ%W-sm!7n92|@i6;W4?xo%2>XT*?YYH%gu{ck%F*ssUk{k7mI zqZ07yH@@O&Nk3qKBrKMhv^#_YSyzV}Ba@7xOd!0}eg6EKwziJgC=|T2v#KM@9Fx8* zxNJiuwuXiVmgD-S(d}m`5--U&pkQ^h4GmGIbsoold$B0Fc^=`ll0ai~8T z{3f3G86e^YZwv6bX@8k%*(RSL+D(y0mBK*sQZc0(uGT5SGFTm?b3IkpMnr;>F|A!; z8K}O2vgl(}R1ER*0cX9tx}rx{gD*O4F2|OQx_)|a1!iI-ecXT3YS{e2efvz_m!T(L z0V%XQmlIx&){|hPZj?6gFB~?z*D!Oe~E*)--d>Y5K8EzFY;pCk<@#7&#x#`n!V=qGfIGVZ-MV z%5NTFQTf|y|0y`Ar@s>yEqvxgLRt>?ddg52oQC-{CzEd94tjqxl;rJ|>(7%ZIRcQl z*5?u5QcTgq$)Nl-kE2U9}E56Omy;@jU{1wO@b`NQf$1V;F?fkuOcg3W-;=hNZX%X>BDU)DG6?Ra#q&0bk3X?HNS(_YfIdXU{~3g z2%ZH%0exd^7)>Z}-YjcRn!rOuc618JG@Q$jp@hvasG0mBl_!fwf@28kA8{R@IN|%u z&@ETFGTLpv8JOgO{!gYF0wrLfcwm0rpkXe61bc3{kEzm?N7_A4)GdVc;ZT$VNy zLFa=#!bqvT0)L)@z0do%X^)heZlt-Tc^ye-Y6GdZ z!_W5iLs&g3Ak?%R0TYATE&`q`Fh~E^6lFl zFVLk!K3^zIjv+ueg4LAhSSezF^Ov@FG#Njt_84HJ zTE_sSsAoDRiS%jUv<64GyUWx(>x(cF{_^0 zV3Bbt??Ol}PL#TxVibB8W#!~N?^MS$8v)p&ONl8#AnwLq4_I6ClbFkbh6pxx_6Ef| z#8-XgOMdZJ58aGwNfOx($iF5i*yTGRP;gCLvDujhj$Ct#*~aehKkxc( zK9n|>fttE&!Oeeo>5KmEv!Sv49R+=yVWHe>;|K}g^*Md&i8?@For?*n{CRoK+cU;N z@g;J~7yuWx5`g%qg>ERuMmA;QPB9?)bZ~Eu)8>uVP1yo`y~xDbPCidG|5YE#p@04iBxF?GK)H% zciMWM_XQ(*&8V41!O?q87~tY?045Gim@qIv-5S>&8I+fABfTgQmHXN*!)`Yi_SR>E!I4trub+7Uvkix{U3p#0K2$CL{<5>O zcY<(1i}s_Fhj$DJ1doeKN|Msj$RO$AwttSEK9y0#;@4HbGXkW{%*>_FCwwf*F}qRx z2A=4WnM-WpgIX|dXBZb?1G}U!?+A>OP)_em_yp-C8S3Q4IOauiQd*E8_~wiV8|fjStyfQeJKzX186;68HA@ zc3#|*q_X|5_NZ*h%hY)7*WwO9PZY{&b*&FYJ4*tK%+Jq%ve)E8a9pHkKlMlNn4Sa$ ze`%MT%c^goJxitR$%2DXL9fl^{25S=$J%=fY~e@PKE1mG1BSVp-1!rVesWM$h%grh zF!`Jy&vR;JQO1n8!@w`?EEr76b`@3`jEs{Ck_^7i{ZZOkPaHWE=`0B>7={ksO6!CsVKjtOh4tcb>k8_&V9q;od)Hb$;P< zIwyne*3qL^=@}YP*>cb~32$-VLa-WM$}!^66FXDW_y(t#X3sRc=cgoi9~U|qyBvk5 zJZoHYuwY}CyQtl-O{6AQkvDww>F7t-d-Ovsr-&*Ew>DQd^|_jxkN>zcr=t#ES;pI3 zzo(<)8y0pt{ihlHOHNJ(g1Ye@Bhqgn{2=U6Las?xrqS-Jc?-l>;wY)Ys3=W-U2yIM zxH{(qdmNi%L{v{6zEV_Cl=XAUkt*2@QnpGFV(cM=&NRt!YC9pAzTo~)lXC;i85-4z z@imuSDyB^Y_4YBSWfxOjbW*Df4B*1r4&w6nyuqde#+26rIBhLK-Y+6s<1_zank0o+ zAJK#V=YfZhJ=D?hikyMhOXeB^mRS<)2}r;66yo6*O$yKYAtm*Mi68Rv<>SrGDto-h zkAe4;*UBT5E??nhD%^Pc){P997m0Qi-A*4u%TsYW^8PIJZ@%j0nhFfEg*ML|aD zK~U|($B)H$AD5ojNzF0n{I?kQ7*{~q4vr1;!{uMQj}p{d!2eM+sdX6+g*$s#6Rena zm!z9wgRg`XLeh2gnKa2zKNgc7)5DRme;slEIeS&Y6E7V)#$5-Ch>6M3k&l7E6ntvm z>_olz;~ONtpu6f#yx5T246_1>mi|;)8Keh?mp-|^YnihPD2Ev8HE@KVu zds231Q{&-6-H{6Z*G6;$5-(cS7 z_+}Arubd)f#!N|8Y|%R(Ja1)^j`O6LlRejLBv5SG??aZVvRXbg(}}!or(R&8pW@cq z)bvU_OG8W;L@lDWrBiHy7pO<&jqqLSe7N`@dh)tGXpe|#l_QTHgb{iR`h-?@f}b!q z^FX0kLqbA`dOPC0K{t0(d=+AyVtua|H~6GT6&4s&pmDLHBT%itmxev&3oA+Mv9dC^ z8d8xCM~6@pv6e!iQ1Np-!e{fuL>Rn}6An!?ClrDFiF%=#VvwZqIXE&hu*lrE))B;? zY9+obxeTQhn0TUJ!{ccJakO2?0QB#}ayB+g_x@upluhf{aCT7H)%Guq*pq0oa%@EilC!`%L4zx8Q@o1&IJ z;3>-S8`XMI`|#gQQ|C9@T>9<958XmO{Bdz{KK%L~dqpTejn5DLAd2RLQg(7GK{b^~ z#PVecKj5FNeoGE6hHI%i8jU_}@Zb~p5w5lqJ}bqprmKI+o-n}@r40EW)ZdeM+t+JZ z{w?eO=dVTLO_PxTi`%$76xJR?44nT&83Ga&zd?T;aG`&m zZF1`9vp@m_u@Yfrfv93)YFhTm0i2DMGGoH}$RAJvNB(ng7XdRY+5T28--*`F0_BI# zK+6h$PvouDVUV|BKX}K#?d{F&6(j2?{M!cczTP9kn_O}=*#%EvCK&GYQ?_9ipL+=4 z+?XG&P6jj^)l|=0^|-!eQV6wHM-M(`VKH^rodMH7lnoI#3%Qb2c1sQ(|cz1J0&z);kc^Y z&y?FRqfpT~2|Ds$*PTmxEw0;boCJY)d3wGVe)P-aNNqNfw!&Wv{1B)XXPZ%CeE;c% z4SerwIP3Z5mS={Ny09YYy%zPbVs`7Et$1Z*4oukbshPTaECd%%lzUVbtA3*5tNRN= zPQjCiY_h-DQWjP1mYz9q^lO2!g~yz&zP<s=ZE~kco zG>p#9EWeIcS)+mEz}(jgB$ugfhdsf~2CMOfnZxuzcPuRXXm@Z`S;kMZrkxp8L+cc= zo0#JHW+W7L$R@a`l#^hs$%R02lmf&$6~eCid#pULu4n-8Mn!W8%Tv)GKTZkVIAKs- z{j77UIfg^YT{V9H6k=qc4DP}C$R{)c#sz$D`XK{T{g^1pK#!5g-eDwSumE{9niQ00 zqP-JeECol1G*NV)|CPrmY84wL{B*STv*NDs2P+w63nuVW?x`2(3%5S&d*``LtGT+k z#dyPPT&QHn$POeM41_2b6U!IJ+A9T_mZZbDt(E6KS&BTu~c9=l`6*ZD|LbB>Xd zpIb>5-I8O-UXAL8>kel`Muxy41d*V&#Cl(ppUrk!_40fG7xWL}p4%JseDel$d@32f zJM3yRfq+LrDgS}?(a^wGgCaZ6opVazGffh;>eTpm^nGE$uCcBRbwIgS(5Sn>9k{g% zHHEW2ndO*7np52)=%u<9;RbK@J-UBCAZ~&#kt02?^q0BnJ&5)!7#gyga;>AoH!c7= zgpGD+?NUsnIDz}akA`LRmqAR1q9rdxCjlhL#uoCJV&RkmAwVO7d!X2o3+nj{!P0ZT zTL92P?>TCqv=b8(Kxtv>aQK36S9evEvYVAs1AOFmUrke8*yX^5bF0eb9L0(J#&N#{ z01j{ot=4hCM<@>;Uwww2S8%2cVKF)7d-irVRg&eRz_tK(JR`h>aqdSh90Phdy2Ah% zmRr{o*5@)XG0%coHPJT#Q95?G}aiy(I~~d z?9RviLe@iKd3P^Mv8@lSr3{jo#>2fC){n%2Aq#x$J1UIn`qClT)y`Kqi2lVV#+#0zK=Z`Qn_bn5u z4w$X0_UM7w*KQB@W6yyroG&v>)!9*7PDXSpK~9I2#4`6BDSc};gG(HN*zcVyO*oGP zvXyUeo>>WG;HD;SP{zPsZfkFUdH#rZEkN3ET?2b_7)5p+V(oVdbtDT|+1Za04J}KZ zMdVF>{yd^*ukl$tTRnl$=hG&iP*!#vgb3(_tOg#D3wl8BN_GQ!=9}u%r@^WVVd&gI zq$JC&#l86s_IEgGtk*Gdu(YWG+8=X!qom;a}!N-CE^=@7ua)rf3@E45i zMo!W73!!9kQGR0`>~&F>%tJwN+PjDtR%U>)bV4o9BJM8iO_j@2FF@m2S z6e~v8T9td-m5Q?GFXI_lQcu2`0DkPkW{2?1p;uwt?yJqi7r?CYV-}$dP>PgMUFt}7V1W@|AAv^B7Zn%#MCI_hzinxu?8VMBi+H?CESh^p zrK+6jrq?*+T;SHPVJlu5p+JI0ZYWL_W+-eeN+nhvd5{qeJ<`x|BNc{3yeKW*G(Y?7 zVF&o>{u&o)q-o%^2c9b^LO76JNqLuUu64TS!-stkzkK<>DeIpOicV-#8EZ4`h_E%GRyT zTZ%pmbo3jd$5OhidSo(WKs+KZp5)XhH>ylQ(pH-dX8E6#z1gLInnuRZOkAqDt%!U8m1 zV%7v!)KWn#I}6Dy7L5F2tKkbf3UU0>^y=yb$T1FO2vCQx2P*VNt4e%JQ5qcmC<|6Q z1R~V9MTjWif5>>ZHY@mU)p;Aa_s5nh!$2C9+;9iE*v9Ymz1mhB( z2D@e0V@V2eif}F?67At?sRM}u*5i`49c%-3t>U@;3osugYH#eu=*7!+7Xi(@J}ACjlDECRmg z3CS9oJUV;+vzm3w+SWGnw&vk%*YcmUHGGdiyCV5zv)l5HmdZPJNX8o;U)!YjTtgdFw z)FI^mGVXb<3N!(-#3WPCZ?7zAs&p`k+gx; z0)|>}P|%x*ZhBx2Z+IWS0~_>G+V{m+O0x2bijTGx#rD6;53y@GI1T+=bnT%LL5Q)C zQfl-MG^PxEe=Uovt!KS)Lu-Kc%W?9Z09^lvA-woru;M^z)l(R-pFQ*Kt-b#=1u3`g zb}XlW{l)Nuk6&r8iVs-|p99Es52UM1k<_j4_s1DdCuC>eUHe|xKcD}hMoqPCAI8&w z6Nfpu&tXZ>rYR-rU%O$K^YeK~grXK!>upM;!m4c@KtcmKcrE(ZbN%|gUx8-?>iMiW zH}hFc6B?MUu@s2(PqSGsL7}7u!UjX;*IY1aTPGCc<;iY->ADglV9X2JFJeg|=$Zb4 zm8q$ex_ajedDlp@wJCCYqi-oc;C zB(_FPG(=XRpzCOyJu%Jm`R72FAH0swo^A==a2fMN%Ze8+`qR=F4-?Q}2Je6kJA}^P zs52`X4ajpE0owK*U8i)Mc{WBc;c0uHL%soF)F<4>`|Ey)1`skR9ANKVcbw-WvN!M; zA-C}xn#*!EB_1kU(CAWxYx~2ZXy5r2UPbzZ2eL!pV$%#W^yEJR?=_MoI#));FlJbIxE% zw%yYoZVi!fBaf=B!1zCTq&5?6H`U_Z!9_*onJ1~Yz1-*gxon3cAX-RN+zkdOjCQ_61F!=7wXyGVkBvHOcZc!X3e z5L-e+jab50ENS;ws0RGpT ztH6Qv0YWP4Z{vdAC)~XBtDtob?bRS%713}zAJ!X}&s1IEJhd|inNV;Z**MsD9+Z>7 zm3k^1hFXWb1-jbNTtMhruWrv` zhaN4;TchW^a4u}d#2`>t&AP_8(j&DN(VskceMN{P^Bv9pb2XUhXb9=X~uY$AhyQ2W=%=^6^EDOWT{`1m} z+$at8f~sNueE5hlc zaF7FlSOM-uAVo0SdBx`IOq4J-`r_rw4HvyhZbeuG1_acDvBBNiOvip~h5SUWNwDj< zeb3omwFa6DWt@T5L8exTNjvKP?1&ktq2MMcgne%SAiX-pcMGfJebjovRz!1QRqpdo z2m#fu3_NDLG(eUh(yI%NMG~Pk(7eX!VsJ4+oRFFRbkTht8}1b}`X#Qvk~1p}Bsn{E z0rzF!a0I$l3V8b8N>01E4p9asAYI#%M9KxzEn3vEIjH*DTB6c?nxTppHG6J0?`e&s z{y~VMxw8_2x3O6k(!pHO_CkiJ89Ia(`~`!a!?J9O7U&uKc-O=v zy=Mz}>*?Vtr(rjSGiT0>u7V|w7($}a27g<2Vh6kAdO7kL#+Bx+n3+Ryf^srOM)cq> zonm0%!;9b-Hhml35K}?YyYSX2{5%03i!m*q=bGg27NrO~TI}+kFMZX!UG`+Vy(csE? z6_+mN2wJ^byY&?thj$nU1AMj!n=R*eOvBIiaXDz#-`H*2B0biBzx>J$0o=x~y$gCj zp6L2FO0Y@3^1NKd=(M$BII(`@=;iuSD#ZnVJ`$n94Zed!M!SiAYdV7w=@_?OLIwUo zcIQmvT<-98+vMt0D>2*qc=>`H{}H0G9b5G`quE7o!Wi1mi~_EkHg$|3pvUNfA_S^7 z48!Z1ssbS3V@sT73|=;o6+-Ovduj!asxbCSFyH%3jj(Xbnta2?JqgD*u#F-30G&w2 zx8q13s;CfsY!L|C&lurqcZv)~bq~=l?)?+5Cw(2pNJUOA4UxnjfX}~BN z#uRAh{^v2>&B|V_Yo43d62;G{;FLJ$FFxdLb(@$F`{yAjXl7=XuuDnoiv0Jn<@evs z^Z)yPUjO}8fd7$Soi6@pg`f^juBZS{@z1 The same list of indicators is honored by the prevention agent. Meaning, if Windows Defender AV is the primary AV configured, the matched indicators will be treated according to the settings. For example, if the action is "Alert and Block", Windows Defender AV will prevent file executions (block and remediate) and a corresponding alert will be raised. On the other hand, if the Action is set to "Allow", Windows Defender AV will not detect nor block the file from being run. ->[!NOTE] ->-There is a propagation time of several minutes before the blocking policy for a new hash is applied. ->- Trusted signed files will be treated differently. Microsoft Defender ATP is optimized to handle malicious files. Trying to block trusted signed files, in some cases, may have performance implications. - - -**Automated investigation and remediation engine** +**Automated investigation and remediation engine**
The automated investigation and remediation behave the same. If an indicator is set to "Allow", Automated investigation and remediation will ignore a "bad" verdict for it. If set to "Block", Automated investigation and remediation will treat it as "bad". -In the first phase, the file hashes are fully supported, while network addresses (IP, Domain names) are partially supported (Automation and Detection). Stay tuned as the network blocking and more IoCs become available. - -The current actions supported are: + +The current supported actions are: - Allow - Alert only - Alert and block -On the top navigation you can: - -- Import a list -- Add an indicator -- Customize columns to add or remove columns -- Export the entire list in CSV format -- Select the items to show per page -- Navigate between pages -- Apply filters - -There are several ways to control IoCs: -- [Create an indicator from the settings page](#create-an-indicator-from-the-settings-page) -- [Create contextual IoC](respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) -- [Import a list of IoCs](#import-a-list-of-iocs) -- [Use the Microsoft Defender ATP indicators API](ti-indicator.md) -- [Use partner integrated solutions](partner-applications.md) - -## Before you begin - -Creating IoCs must comply to the following: - ->- This feature is available if your organization uses Windows Defender Antivirus and Cloud-based protection is enabled. For more information, see [Manage cloud-based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). -> ->- The Antimalware client version must be 4.18.1901.x or later. ->- This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time. ->- This response action is available for machines on Windows 10, version 1703 or later. ->- The allow or block function cannot be done on files if the file's classification exists on the device's cache prior to the allow or block action. - ->[!NOTE] -> The PE file needs to be in the machine timeline for you to be able to take this action. -> -> There may be a couple of minutes of latency between the time the action is taken and the actual file being blocked. - - -## Create an indicator from the settings page +You can create an indicator for: +- Files +- IP addresses +- URLs/domains >[!NOTE] >There is a limit of 5000 indicators per tenant. + +![Image of indicators settings page](images/rules-indicators.png) + + +## Create indicators for files +You can prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file, you can block it. This operation will prevent it from being read, written, or executed on machines in your organization. + +There are two ways you can create indicators for files: +- By creating an indicator through the settings page +- By creating a contextual indicator using the add indicator button from the file details page + +### Before you begin +It's important to understand the following prerequisites prior to creating indicators for files: +- This feature is available if your organization uses Windows Defender Antivirus and Cloud–based protection is enabled. For more information, see [Manage cloud–based protection](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md). +- The Antimalware client version must be 4.18.1901.x or later. +- Supported on machines on Windows 10, version 1703 or later. +- To start blocking files, you first need to [turn the **Block or allow** feature on](advanced-features.md) in Settings. +- This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web. It currently supports portable executable (PE) files, including _.exe_ and _.dll_ files. The coverage will be extended over time. + +>[!IMPORTANT] +>- The allow or block function cannot be done on files if the file's classification exists on the device's cache prior to the allow or block action +>- Trusted signed files will be treated differently. Microsoft Defender ATP is optimized to handle malicious files. Trying to block trusted signed files, in some cases, may have performance implications. +>- The PE file needs to be in the machine timeline for you to be able to take this action. + + +>[!NOTE] +>There may be a couple of minutes of latency between the time the action is taken and the actual file being blocked. + +### Create an indicator for files from the settings page + 1. In the navigation pane, select **Settings** > **Indicators**. -2. Select the tab of the type of entity you'd like to create an indicator for. You can choose any of the following entities: - - File hash - - IP address - - URLs/Domains - -3. Click **Add indicator**. +2. Select the **File hash** tab. -4. For each attribute specify the following details: +3. Select **Add indicator**. + +4. Specify the following details: + - Indicator - Specify the entity details and define the expiration of the indicator. + - Action - Specify the action to be taken and provide a description. + - Scope - Define the scope of the machine group. + +5. Review the details in the Summary tab, then click **Save**. + +### Create a contextual indicator from the file details page +One of the options when taking [response actions on a file](respond-file-alerts) is adding an indicator for the file. + +When you add an indicator hash for a file, you can choose to raise an alert and block the file whenever a machine in your organization attempts to run it. + +Files automatically blocked by an indicator won't show up in the files's Action center, but the alerts will still be visible in the Alerts queue. + + +## Create indicators for IPs and URLs/domains +Microsoft Defender ATP can block what Microsoft deems as malicious IPs/URLs through SmartScreen for Microsoft browsers and Network Protection for non-Microsoft browsers and calls made outside the browser. + +The threat intelligence data set for this has been managed by Microsoft. + +By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs or domains based on your own threat intelligence. + + +There are two ways you can create indicators for IPs, URLs or domains: +- By creating an indicator through the settings page +- By creating machine groups + +### Before you begin +It's important to understand the following prerequisites prior to creating indicators for IPS, URLs or domains: +- URL/IP allow and block relies on the Microsoft Defender ATP component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see [Protect your network](network-protection.md) +- The Antimalware client version must be 4.18.1906.x or later. +- Supported on machines on Windows 10, version 1709 or later. +- Ensure that **Custom network indicators** is enabled in **Microsoft Defender Security Center > Settings > Advanced features**. For more information, see [Advanced features](advanced-features.md). + +>[!NOTE] +>There may be up to 2 hours latency (usually less) between the time the action is taken, and the URL and IP being blocked. + +### Create an indicator for IPs, URLs or domains from the settings page + +1. In the navigation pane, select **Settings** > **Indicators**. + +2. Select the **IP addresses or URLs/Domains** tab. + +3. Select **Add indicator**. + +4. Specify the following details: - Indicator - Specify the entity details and define the expiration of the indicator. - Action - Specify the action to be taken and provide a description. - Scope - Define the scope of the machine group. @@ -111,10 +145,6 @@ Creating IoCs must comply to the following: 5. Review the details in the Summary tab, then click **Save**. ->[!NOTE] ->Blocking IPs, domains, or URLs is currently available on limited preview only. ->This requires sending your custom list to [network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection) to be enforced which is an option that will be generally available soon. ->As it is not yet generally available, when Automated investigations finds this indicator during an investigation it will use the allowed/block list as the basis of its decision to automatically remediate (blocked list) or skip (allowed list) the entity. ## Manage indicators @@ -131,5 +161,7 @@ You can also choose to upload a CSV file that defines the attributes of indicato Download the sample CSV to know the supported column attributes. ## Related topic +- [Create contextual IoC](respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) +- [Use the Microsoft Defender ATP indicators API](ti-indicator.md) +- [Use partner integrated solutions](partner-applications.md) -- [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list.md) From 1059e4f13ceb44ae3fc2264f9de20e11c1574a0c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:08:27 -0700 Subject: [PATCH 07/23] edit url section --- .../microsoft-defender-atp/manage-indicators.md | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 540520a737..bced83962b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -112,12 +112,7 @@ Microsoft Defender ATP can block what Microsoft deems as malicious IPs/URLs thro The threat intelligence data set for this has been managed by Microsoft. -By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs or domains based on your own threat intelligence. - - -There are two ways you can create indicators for IPs, URLs or domains: -- By creating an indicator through the settings page -- By creating machine groups +By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs or domains based on your own threat intelligence. You can do this through the settings page or by machine groups if you deem certain groups to be more or less at risk than others. ### Before you begin It's important to understand the following prerequisites prior to creating indicators for IPS, URLs or domains: From 38f78a8e8461f5714ae5f8fbcbbddc6beabd4b0f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:14:55 -0700 Subject: [PATCH 08/23] fix meta --- .../microsoft-defender-atp/manage-indicators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index bced83962b..29eb827d0e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,7 +1,7 @@ --- title: Manage indicators ms.reviewer: -description: Create indicators for a file hash, IP address, URLs or domains that define the detection, prevention, and exclusion of entities. +description: Create indicators to allow or block file hash, IP address, URLs or domains. keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain search.product: eADQiWindows 10XVcnh search.appverid: met150 From bb50ea3bcc7aba9f530f4cd9b578970697c1206d Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:16:58 -0700 Subject: [PATCH 09/23] typo --- .../microsoft-defender-atp/manage-indicators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 29eb827d0e..fc5b64d8f4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -116,7 +116,7 @@ By creating indicators for IPs and URLs or domains, you can now allow or block I ### Before you begin It's important to understand the following prerequisites prior to creating indicators for IPS, URLs or domains: -- URL/IP allow and block relies on the Microsoft Defender ATP component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see [Protect your network](network-protection.md) +- URL/IP allow and block relies on the Microsoft Defender ATP component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see [Protect your network](network-protection.md). - The Antimalware client version must be 4.18.1906.x or later. - Supported on machines on Windows 10, version 1709 or later. - Ensure that **Custom network indicators** is enabled in **Microsoft Defender Security Center > Settings > Advanced features**. For more information, see [Advanced features](advanced-features.md). From a6d5d46937d1a94254fa41b5dad45e436c491fe4 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:20:47 -0700 Subject: [PATCH 10/23] meta --- .../microsoft-defender-atp/manage-indicators.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index fc5b64d8f4..2fc4728d22 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,6 +1,5 @@ --- -title: Manage indicators -ms.reviewer: +title: Manage indicators description: Create indicators to allow or block file hash, IP address, URLs or domains. keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain search.product: eADQiWindows 10XVcnh @@ -16,6 +15,7 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article +ms.reviewer: dansimp --- # Manage indicators From de8308df34f6092a7c8bc0bcf16aaaafa4e3776a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:22:52 -0700 Subject: [PATCH 11/23] space --- .../microsoft-defender-atp/manage-indicators.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 2fc4728d22..55c7c34653 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -27,7 +27,6 @@ ms.reviewer: dansimp Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability is available in Microsoft Defender ATP and gives SecOps the ability to set a list of indicators for detection and for blocking (prevention and response). - Create indicators that define the detection, prevention, and exclusion of entities. You can define the action to be taken as well as the duration for when to apply the action as well as the scope of the machine group to apply it to. Currently supported sources are the cloud detection engine of Microsoft Defender ATP, the automated investigation and remediation engine, and the endpoint prevention engine (Windows Defender AV). From 41e4dc584aeb94e3011231d4df638c304280e236 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:24:08 -0700 Subject: [PATCH 12/23] meta --- .../microsoft-defender-atp/manage-indicators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 55c7c34653..6c054349cd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,7 +1,7 @@ --- title: Manage indicators description: Create indicators to allow or block file hash, IP address, URLs or domains. -keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain +keywords: file, hash, ip, urls, domain, indicator, indicators, block, allow, hash, alert, detection search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 From 3ceae8d5c5250a37f68cf7994839b50c169d7e13 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:25:12 -0700 Subject: [PATCH 13/23] fix link --- .../microsoft-defender-atp/manage-indicators.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 6c054349cd..526ca1187d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -99,7 +99,7 @@ It's important to understand the following prerequisites prior to creating indic 5. Review the details in the Summary tab, then click **Save**. ### Create a contextual indicator from the file details page -One of the options when taking [response actions on a file](respond-file-alerts) is adding an indicator for the file. +One of the options when taking [response actions on a file](respond-file-alerts.md) is adding an indicator for the file. When you add an indicator hash for a file, you can choose to raise an alert and block the file whenever a machine in your organization attempts to run it. From c673cde8b3132facc60d6df09c1bfd608ed58c9c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:27:21 -0700 Subject: [PATCH 14/23] meta --- .../microsoft-defender-atp/manage-indicators.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 526ca1187d..50339a38c4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,7 +1,7 @@ --- -title: Manage indicators -description: Create indicators to allow or block file hash, IP address, URLs or domains. -keywords: file, hash, ip, urls, domain, indicator, indicators, block, allow, hash, alert, detection +title: +description: +keywords: search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -15,7 +15,6 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: article -ms.reviewer: dansimp --- # Manage indicators From 86cd8ae7b33870c16fb2f483ed74750cabf5b697 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:31:30 -0700 Subject: [PATCH 15/23] add preview --- .../microsoft-defender-atp/manage-indicators.md | 10 ++++++---- .../microsoft-defender-atp/preview.md | 2 ++ 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 50339a38c4..7dbce08628 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,7 +1,7 @@ --- -title: -description: -keywords: +title: Manage indicators +description: Learn how to allow or block files, IPs, URLs or domains using indicators. +keywords: indicator, indicators, allow, block, file, ips, urls, domains, detection, prevention search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 @@ -22,6 +22,8 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!include[Prerelease information](prerelease.md)] + >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionlist-abovefoldlink) Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability is available in Microsoft Defender ATP and gives SecOps the ability to set a list of indicators for detection and for blocking (prevention and response). @@ -105,7 +107,7 @@ When you add an indicator hash for a file, you can choose to raise an alert and Files automatically blocked by an indicator won't show up in the files's Action center, but the alerts will still be visible in the Alerts queue. -## Create indicators for IPs and URLs/domains +## Create indicators for IPs and URLs/domains (preview) Microsoft Defender ATP can block what Microsoft deems as malicious IPs/URLs through SmartScreen for Microsoft browsers and Network Protection for non-Microsoft browsers and calls made outside the browser. The threat intelligence data set for this has been managed by Microsoft. diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index a18bcddf2c..9b1a96f339 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -42,6 +42,8 @@ Turn on the preview experience setting to be among the first to try upcoming fea ## Preview features The following features are included in the preview release: +- [Indicators for IP addresses, URLs/Domains](manage-indicators.md)
You can now allow or block URLs/domains using your own threat intelligence. + - [Evaluation lab](evaluation-lab.md)
The Microsoft Defender ATP evaluation lab is designed to eliminate the complexities of machine and environment configuration so that you can focus on evaluating the capabilities of the platform, running simulations, and seeing the prevention, detection, and remediation features in action. From 0c5b22e94d881931c889122fa4812ba3371b0178 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 3 Sep 2019 17:32:59 -0700 Subject: [PATCH 16/23] bla --- .../microsoft-defender-atp/manage-indicators.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index 7dbce08628..ca531ec4a1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -1,7 +1,8 @@ --- -title: Manage indicators -description: Learn how to allow or block files, IPs, URLs or domains using indicators. -keywords: indicator, indicators, allow, block, file, ips, urls, domains, detection, prevention +title: Manage indicators +ms.reviewer: +description: Create indicators for a file hash, IP address, URLs or domains that define the detection, prevention, and exclusion of entities. +keywords: manage, allowed, blocked, whitelist, blacklist, block, clean, malicious, file hash, ip address, urls, domain search.product: eADQiWindows 10XVcnh search.appverid: met150 ms.prod: w10 From 081d55f197bc9eddcc1cc3cde2a94f93fa270b12 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 4 Sep 2019 15:46:56 -0700 Subject: [PATCH 17/23] Update MAU config for Intune; minor fix to JAMF documentation --- ...soft-defender-atp-mac-install-with-jamf.md | 4 +- .../microsoft-defender-atp-mac-updates.md | 64 +++++++++++++++++++ 2 files changed, 67 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index 44f2ed7150..554c07f40a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -198,7 +198,9 @@ You can check that devices have been correctly onboarded by creating a script. F mdatp --health healthy ``` -This script returns: +The above commands prints "1" if the product is onboarded and functioning as expected. + +If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: - 0 if Microsoft Defender ATP is registered with the Microsoft Defender ATP service - 1 if the device is not yet onboarded - 3 if the connection to the daemon cannot be established—for example, if the daemon is not running diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md index dde9d19622..af5f8b3577 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md @@ -116,6 +116,8 @@ The following configuration profile is used to: - Enable the "Check for updates" button in the user interface - Allow users on the device to enroll into the Insider channels +### JAMF + ```XML @@ -135,6 +137,68 @@ The following configuration profile is used to: ``` +### Intune + +```XML + + + + + PayloadUUID + B762FF60-6ACB-4A72-9E72-459D00C936F3 + PayloadType + Configuration + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.autoupdate2 + PayloadDisplayName + Microsoft Auto-Update settings + PayloadDescription + Microsoft Auto-Update configuration settings + PayloadVersion + 1 + PayloadEnabled + + PayloadRemovalDisallowed + + PayloadScope + System + PayloadContent + + + PayloadUUID + 5A6F350A-CC2C-440B-A074-68E3F34EBAE9 + PayloadType + com.microsoft.autoupdate2 + PayloadOrganization + Microsoft + PayloadIdentifier + com.microsoft.autoupdate2 + PayloadDisplayName + Microsoft Auto-Update configuration settings + PayloadDescription + + PayloadVersion + 1 + PayloadEnabled + + ChannelName + InsiderFast + HowToCheck + AutomaticDownload + EnableCheckForUpdatesButton + + DisableInsiderCheckbox + + SendAllTelemetryEnabled + + + + + +``` + To configure MAU, you can deploy this configuration profile from the management tool that your enterprise is using: - From JAMF, upload this configuration profile and set the Preference Domain to *com.microsoft.autoupdate2*. - From Intune, upload this configuration profile and set the custom configuration profile name to *com.microsoft.autoupdate2*. From a3ac7e1cab13741afb9ee73af026a8d6c793df05 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 4 Sep 2019 15:48:05 -0700 Subject: [PATCH 18/23] Spacing --- .../microsoft-defender-atp-mac-install-with-jamf.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index 554c07f40a..bf8a1373a4 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -200,7 +200,7 @@ mdatp --health healthy The above commands prints "1" if the product is onboarded and functioning as expected. -If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: +If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: - 0 if Microsoft Defender ATP is registered with the Microsoft Defender ATP service - 1 if the device is not yet onboarded - 3 if the connection to the daemon cannot be established—for example, if the daemon is not running From ba8fa891256426057b6cda38cdcf5eb4e1d94366 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 4 Sep 2019 15:56:17 -0700 Subject: [PATCH 19/23] Document option to disable check for updates button --- .../microsoft-defender-atp-mac-updates.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md index af5f8b3577..8ef53f69df 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md @@ -86,6 +86,17 @@ Change how MAU searches for updates. | **Possible values** | Manual
AutomaticCheck
AutomaticDownload | | **Comment** | Note that AutomaticDownload will do a download and install silently if possible. | +### Change whether the "Check for Updates" button is enabled + +Change whether local users will be able to click the "Check for Updates" option in the Microsoft Auto-Update user interface. + +||| +|:---|:---| +| **Domain** | com.microsoft.autoupdate2 | +| **Key** | EnableCheckForUpdatesButton | +| **Data type** | Boolean | +| **Possible values** | True (default)
False | + ### Disable Insider checkbox Set to true to make the "Join the Office Insider Program..." checkbox unavailable / greyed out to users. From b98bfc64abfc69e35adc4e8ef1e906de1e42fb62 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 4 Sep 2019 16:13:54 -0700 Subject: [PATCH 20/23] Typo --- .../microsoft-defender-atp-mac-install-with-jamf.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index bf8a1373a4..ef76d78529 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -198,7 +198,7 @@ You can check that devices have been correctly onboarded by creating a script. F mdatp --health healthy ``` -The above commands prints "1" if the product is onboarded and functioning as expected. +The above command prints "1" if the product is onboarded and functioning as expected. If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: - 0 if Microsoft Defender ATP is registered with the Microsoft Defender ATP service From 3ec6f29488ec738e5032e956f976b40c7aecd346 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 4 Sep 2019 16:18:38 -0700 Subject: [PATCH 21/23] Minor tweaks --- .../microsoft-defender-atp-mac-updates.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md index 8ef53f69df..50267f26bb 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-updates.md @@ -34,7 +34,7 @@ If you decide to deploy updates by using your software distribution tools, you s ## Use msupdate -MAU includes a command line tool, called *msupdate*, that is designed for IT administrators so that they have more precise control over when updates are applied. Instructions for how to use this tool can be found in [Update Office for Mac by using msupdate](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate). +MAU includes a command-line tool, called *msupdate*, that is designed for IT administrators so that they have more precise control over when updates are applied. Instructions for how to use this tool can be found in [Update Office for Mac by using msupdate](https://docs.microsoft.com/deployoffice/mac/update-office-for-mac-using-msupdate). In MAU, the application identifier for Microsoft Defender ATP for Mac is *WDAV00*. To download and install the latest updates for Microsoft Defender ATP for Mac, execute the following command from a Terminal window: @@ -88,7 +88,7 @@ Change how MAU searches for updates. ### Change whether the "Check for Updates" button is enabled -Change whether local users will be able to click the "Check for Updates" option in the Microsoft Auto-Update user interface. +Change whether local users will be able to click the "Check for Updates" option in the Microsoft AutoUpdate user interface. ||| |:---|:---| @@ -164,9 +164,9 @@ The following configuration profile is used to: PayloadIdentifier com.microsoft.autoupdate2 PayloadDisplayName - Microsoft Auto-Update settings + Microsoft AutoUpdate settings PayloadDescription - Microsoft Auto-Update configuration settings + Microsoft AutoUpdate configuration settings PayloadVersion 1 PayloadEnabled @@ -187,7 +187,7 @@ The following configuration profile is used to: PayloadIdentifier com.microsoft.autoupdate2 PayloadDisplayName - Microsoft Auto-Update configuration settings + Microsoft AutoUpdate configuration settings PayloadDescription PayloadVersion From dcf696c83bad3d31666f40ecd933ef966f0c209f Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 4 Sep 2019 16:54:41 -0700 Subject: [PATCH 22/23] Remove redundant line --- .../microsoft-defender-atp-mac-install-with-jamf.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index ef76d78529..9a52b56369 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -201,7 +201,6 @@ mdatp --health healthy The above command prints "1" if the product is onboarded and functioning as expected. If the product is not healthy, the exit code (which can be checked through `echo $?`) indicates the problem: -- 0 if Microsoft Defender ATP is registered with the Microsoft Defender ATP service - 1 if the device is not yet onboarded - 3 if the connection to the daemon cannot be established—for example, if the daemon is not running From e6f4ce3cbb7f03f993cd9dbae1f7d260078c515f Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Thu, 5 Sep 2019 13:22:20 -0700 Subject: [PATCH 23/23] update support statement --- windows/deployment/upgrade/windows-10-upgrade-paths.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md index c1cf90e9a0..c5cc2c3ba1 100644 --- a/windows/deployment/upgrade/windows-10-upgrade-paths.md +++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md @@ -24,7 +24,7 @@ ms.topic: article This topic provides a summary of available upgrade paths to Windows 10. You can upgrade to Windows 10 from Windows 7 or a later operating system. This includes upgrading from one release of Windows 10 to later release of Windows 10. Migrating from one edition of Windows 10 to a different edition of the same release is also supported. For more information about migrating to a different edition of Windows 10, see [Windows 10 edition upgrade](windows-10-edition-upgrades.md). -> **Windows 10 version upgrade**: You can directly upgrade a supported version of Windows 10 to a newer version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information. +> **Windows 10 version upgrade**: You can directly upgrade any semi-annual channel version of Windows 10 to a newer, supported semi-annual channel version of Windows 10, even if it involves skipping versions. Work with your account representative if your current version of Windows is out of support. See the [Windows lifecycle fact sheet](https://support.microsoft.com/help/13853/windows-lifecycle-fact-sheet) for availability and service information. > > **Windows 10 LTSC/LTSB**: Due to [naming changes](https://docs.microsoft.com/windows/deployment/update/waas-overview#naming-changes), product versions that display Windows 10 LTSB will be replaced with Windows 10 LTSC in subsequent feature updates. The term LTSC is used here to refer to all long term servicing versions. > @@ -34,7 +34,7 @@ This topic provides a summary of available upgrade paths to Windows 10. You can > > **Windows 8.0**: You cannot upgrade directly from Windows 8.0 to Windows 10. To upgrade from Windows 8.0, you must first install the [Windows 8.1 update](https://support.microsoft.com/help/15356/windows-8-install-update-kb-2919355). -✔ = Full upgrade is supported including personal data, settings, and applications.
+✔ = Full upgrade is supported including personal data, settings, and applications.
D = Edition downgrade; personal data is maintained, applications and settings are removed.