From 367785b36946ebaba4baed083db0511c2af89db1 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Tue, 13 Oct 2020 21:40:38 +0500 Subject: [PATCH 001/169] Removed a content There is no need to create a custom device policy to enable PIN reset recovery. So removing this portion. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8284#issuecomment-707356130 --- .../hello-for-business/hello-feature-pin-reset.md | 3 --- 1 file changed, 3 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index f6a0ebc776..13403b0f92 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -66,9 +66,6 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput 3. Enable the **Use PIN Recovery** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. 4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. -### Configure Windows devices to use PIN reset using Microsoft Intune - -To configure PIN reset on Windows devices you manage, use an [Intune Windows 10 custom device policy](https://docs.microsoft.com/intune/custom-settings-windows-10) to enable the feature. Configure the policy using the following Windows policy configuration service provider (CSP): #### Create a PIN Reset Device configuration profile using Microsoft Intune From fe2a13a56101da89ba4d5e165924f5c2a7998ef5 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Wed, 14 Oct 2020 10:00:29 +0500 Subject: [PATCH 002/169] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 13403b0f92..f680e26e79 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -66,7 +66,6 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput 3. Enable the **Use PIN Recovery** policy setting located under **Computer Configuration->Administrative Templates->Windows Components->Windows Hello for Business**. 4. Close the Group Policy Management Editor to save the Group Policy object. Close the GPMC. - #### Create a PIN Reset Device configuration profile using Microsoft Intune 1. Sign-in to [Azure Portal](https://portal.azure.com) using a Global administrator account. From cca539a06879aba6e0276c36424cf5870f62ef90 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 22 Oct 2020 10:25:45 +0500 Subject: [PATCH 003/169] update the instruction Update the instruction to enable PIN recovery. --- .../hello-feature-pin-reset.md | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index f680e26e79..46920d9ed0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -68,20 +68,10 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput #### Create a PIN Reset Device configuration profile using Microsoft Intune -1. Sign-in to [Azure Portal](https://portal.azure.com) using a Global administrator account. -2. You need your tenant ID to complete the following task. You can discover your tenant ID by viewing the **Properties** of your Azure Active Directory from the Azure Portal. It will be listed under Directory ID. You can also use the following command in a Command window on any Azure AD-joined or hybrid Azure AD-joined computer.
+1. Sign-in to [Enpoint Manager Admin Center](https://endpoint.microsoft.com/) using a Global administrator account. +2. Click **Endpoint Security**-> **Account Portection**-> **Properties**. +3. Select Enable PIN recovery to **Yes**. - ``` - dsregcmd /status | findstr -snip "tenantid" - ``` - -1. Navigate to the Microsoft Intune blade. Click **Device configuration**. Click **Profiles**. Click **Create profile**. -1. Type **Use PIN Recovery** in the **Name** field. Select **Windows 10 and later** from the **Platform** list. Select **Custom** from the **Profile type** list. -1. In the **Custom OMA-URI Settings** blade, Click **Add**. -1. In the **Add Row** blade, type **PIN Reset Settings** in the **Name** field. In the **OMA-URI** field, type **./Device/Vendor/MSFT/PassportForWork/*tenant ID*/Policies/EnablePinRecovery** where *tenant ID* is your Azure Active Directory tenant ID from step 2. -1. Select **Boolean** from the **Data type** list and select **True** from the **Value** list. -1. Click **OK** to save the row configuration. Click **OK** to close the Custom OMA-URI Settings blade. Click **Create to save the profile. - #### Assign the PIN Reset Device configuration profile using Microsoft Intune 1. Sign in to the [Azure Portal](https://portal.azure.com) using a Global administrator account. From 852597e9d765830f43498de55255cd51ef2a90a7 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 22 Oct 2020 10:39:08 +0500 Subject: [PATCH 004/169] added image Added an image in the PR. --- .../hello-for-business/hello-feature-pin-reset.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 46920d9ed0..99d61ab91e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -98,6 +98,7 @@ On-premises deployments provide users with the ability to reset forgotten PINs e 1. Sign-in to Windows 10, version 1703 or later using an alternate credential. 2. Open **Settings**, click **Accounts**, click **Sign-in options**. 3. Under **PIN**, click **I forgot my PIN** and follow the instructions. +![PIN reset option](images/pinreset/pin-reset-option.png) #### Reset PIN above the Lock Screen From e693186d6e676e66bbed5999fbdf664386693a30 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Thu, 22 Oct 2020 10:47:19 +0500 Subject: [PATCH 005/169] Update maximum-password-age.md --- .../security-policy-settings/maximum-password-age.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md index 2e2b5f172a..0f92c2bbd8 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md @@ -39,6 +39,9 @@ The **Maximum password age** policy setting determines the period of time (in da Set **Maximum password age** to a value between 30 and 90 days, depending on your environment. This way, an attacker has a limited amount of time in which to compromise a user's password and have access to your network resources. +> [!NOTE] +> Security baseline recommended by Microsoft doesn't contain the password-expiration policy, as this mitigation is less effective than modern ones. However, companies that didn't implement Azure AD Password Protection, multifactor authentication or other modern mitigations of password-guessing attacks, should leave this policy effective. + ### Location **Computer Configuration\\Windows Settings\\Security Settings\\Account Policies\\Password Policy** From c3a65aa995cdc6ea80d69e3e2e03c0714d926808 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 22 Oct 2020 12:44:53 +0500 Subject: [PATCH 006/169] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 99d61ab91e..48061674ba 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -70,7 +70,7 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput 1. Sign-in to [Enpoint Manager Admin Center](https://endpoint.microsoft.com/) using a Global administrator account. 2. Click **Endpoint Security**-> **Account Portection**-> **Properties**. -3. Select Enable PIN recovery to **Yes**. +3. Set **Enable PIN recovery** to **Yes**. #### Assign the PIN Reset Device configuration profile using Microsoft Intune From 63897f673074b4981339f2f71c5cb5410dbb4410 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Thu, 22 Oct 2020 15:37:23 +0500 Subject: [PATCH 007/169] Update windows/security/threat-protection/security-policy-settings/maximum-password-age.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../security-policy-settings/maximum-password-age.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md index 0f92c2bbd8..5eacf443c4 100644 --- a/windows/security/threat-protection/security-policy-settings/maximum-password-age.md +++ b/windows/security/threat-protection/security-policy-settings/maximum-password-age.md @@ -40,7 +40,7 @@ The **Maximum password age** policy setting determines the period of time (in da Set **Maximum password age** to a value between 30 and 90 days, depending on your environment. This way, an attacker has a limited amount of time in which to compromise a user's password and have access to your network resources. > [!NOTE] -> Security baseline recommended by Microsoft doesn't contain the password-expiration policy, as this mitigation is less effective than modern ones. However, companies that didn't implement Azure AD Password Protection, multifactor authentication or other modern mitigations of password-guessing attacks, should leave this policy effective. +> The security baseline recommended by Microsoft doesn't contain the password-expiration policy, as it is less effective than modern mitigations. However, companies that didn't implement Azure AD Password Protection, multifactor authentication, or other modern mitigations of password-guessing attacks, should leave this policy in effect. ### Location From 6b7d09e978538f262ec4c084d1f6b3b0e4811c38 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Sun, 25 Oct 2020 00:35:38 +0500 Subject: [PATCH 008/169] Update linux-install-manually.md --- .../microsoft-defender-atp/linux-install-manually.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md index 3012e87c2c..137db237fd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md +++ b/windows/security/threat-protection/microsoft-defender-atp/linux-install-manually.md @@ -143,6 +143,11 @@ In order to preview new features and provide early feedback, it is recommended t ```bash sudo mv ./microsoft.list /etc/apt/sources.list.d/microsoft-[channel].list ``` + For example, if you chose *insiders-fast* channel: + + ```bash + sudo mv ./microsoft.list /etc/apt/sources.list.d/microsoft-insiders-fast.list + ``` - Install the `gpg` package if not already installed: From b21b9769f4a9cd7669bb0996ac3a0da13debac66 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Tue, 27 Oct 2020 21:26:13 +0500 Subject: [PATCH 009/169] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 48061674ba..583a595d6c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -68,7 +68,7 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput #### Create a PIN Reset Device configuration profile using Microsoft Intune -1. Sign-in to [Enpoint Manager Admin Center](https://endpoint.microsoft.com/) using a Global administrator account. +1. Sign-in to [Enpoint Manager admin center](https://endpoint.microsoft.com/) using a Global administrator account. 2. Click **Endpoint Security**-> **Account Portection**-> **Properties**. 3. Set **Enable PIN recovery** to **Yes**. From d38797afa76784287a87789754c4c4cafab7bc75 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Tue, 27 Oct 2020 21:26:22 +0500 Subject: [PATCH 010/169] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 583a595d6c..fd3f660e77 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -69,7 +69,7 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput #### Create a PIN Reset Device configuration profile using Microsoft Intune 1. Sign-in to [Enpoint Manager admin center](https://endpoint.microsoft.com/) using a Global administrator account. -2. Click **Endpoint Security**-> **Account Portection**-> **Properties**. +2. Click **Endpoint Security**-> **Account Protection**-> **Properties**. 3. Set **Enable PIN recovery** to **Yes**. #### Assign the PIN Reset Device configuration profile using Microsoft Intune From f4e02ed7264059f2bf0d3016946d7c6ab7108980 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Tue, 27 Oct 2020 21:38:08 +0500 Subject: [PATCH 011/169] update as suggested by mapalko update as suggested by mapalko --- .../hello-for-business/hello-feature-pin-reset.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index fd3f660e77..2cc85e4cca 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -72,6 +72,12 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput 2. Click **Endpoint Security**-> **Account Protection**-> **Properties**. 3. Set **Enable PIN recovery** to **Yes**. +> [!Note] +> You can also setup PIN recovery using configuration profiles. +> 1. Sign-in to Endpoint Manager +> 2. Click **Devices** -> **Configuration Profiles** -> Create new profile or edit existing an existing profile using the Identity Protection profile type +> 3. Set **Enable PIN recovery** to **Yes** + #### Assign the PIN Reset Device configuration profile using Microsoft Intune 1. Sign in to the [Azure Portal](https://portal.azure.com) using a Global administrator account. From bdc1d9f2181376bcba919db43e89c0bbf07dbebb Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Wed, 28 Oct 2020 09:48:50 +0500 Subject: [PATCH 012/169] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 2cc85e4cca..1cd499bdad 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -72,7 +72,7 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput 2. Click **Endpoint Security**-> **Account Protection**-> **Properties**. 3. Set **Enable PIN recovery** to **Yes**. -> [!Note] +> [!NOTE] > You can also setup PIN recovery using configuration profiles. > 1. Sign-in to Endpoint Manager > 2. Click **Devices** -> **Configuration Profiles** -> Create new profile or edit existing an existing profile using the Identity Protection profile type From 31b03fd5601b727879b435264e0051c552293b54 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Wed, 28 Oct 2020 09:49:00 +0500 Subject: [PATCH 013/169] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 1cd499bdad..b500ad52e4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -74,7 +74,7 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput > [!NOTE] > You can also setup PIN recovery using configuration profiles. -> 1. Sign-in to Endpoint Manager +> 1. Sign in to Endpoint Manager. > 2. Click **Devices** -> **Configuration Profiles** -> Create new profile or edit existing an existing profile using the Identity Protection profile type > 3. Set **Enable PIN recovery** to **Yes** From 5a7704485c853199dce414bdddff2a53e5d8a5fa Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Wed, 28 Oct 2020 09:49:11 +0500 Subject: [PATCH 014/169] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index b500ad52e4..4462339847 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -75,7 +75,7 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput > [!NOTE] > You can also setup PIN recovery using configuration profiles. > 1. Sign in to Endpoint Manager. -> 2. Click **Devices** -> **Configuration Profiles** -> Create new profile or edit existing an existing profile using the Identity Protection profile type +> 2. Click **Devices** -> **Configuration Profiles** -> Create new profile or edit an existing profile using the Identity Protection profile type. > 3. Set **Enable PIN recovery** to **Yes** #### Assign the PIN Reset Device configuration profile using Microsoft Intune From 00ca5116f571228e0f6379a63128c6e31e21692e Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Wed, 28 Oct 2020 09:49:20 +0500 Subject: [PATCH 015/169] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 4462339847..563ff883be 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -76,7 +76,7 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput > You can also setup PIN recovery using configuration profiles. > 1. Sign in to Endpoint Manager. > 2. Click **Devices** -> **Configuration Profiles** -> Create new profile or edit an existing profile using the Identity Protection profile type. -> 3. Set **Enable PIN recovery** to **Yes** +> 3. Set **Enable PIN recovery** to **Yes**. #### Assign the PIN Reset Device configuration profile using Microsoft Intune From ed200cd20634e30c927396c81e2984ff0ad68a37 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Fri, 6 Nov 2020 23:43:59 +0500 Subject: [PATCH 016/169] Update 2bda9244ec25d1526811da4ea91b1c86.png --- .../2bda9244ec25d1526811da4ea91b1c86.png | Bin 322504 -> 319498 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/2bda9244ec25d1526811da4ea91b1c86.png b/windows/security/threat-protection/microsoft-defender-atp/images/2bda9244ec25d1526811da4ea91b1c86.png index ef1fa517146db52d0ab250c809700493a58ffff7..b2fb4673811135cf88e3bb473b3bb2fe68177e84 100644 GIT binary patch literal 319498 zcmY&<1yEaS7cCWB3$$2pFK)$x7q=E@f#UA&UL1tr!wU^O! zLO`IL`RDWMZDw5-{2{WltfD0H7CI6x6T5abJrx211%m8nF*Wzh!(}(`Z_uohCx~qc z>^CnBB_)k0MQkVjl*6mdm5t+GJV6uAGxvBtm;O>NxA=z<X$FmPr?@9vo&s&-^BI2q|I7O@GqwelGFAl_Em-Y$ zx%U=Eq)x|b46H@QquT*b@+HE%G7qh5xGs#*@x(LFUccY&F;1L=l$N3{ zHiQN@#mNNOEH=c+(2RL}D1r$TNXP7)uJ;s9S#T>#$c0zH)YR3Twg%$3EWxNn>?@Ud zdCTLAAq5sJNK87iq=|K#IBC^{j5EDN+ ze+@o9-zb0OaRm%gxAING@+_$R;>4gXgOwE}?KIfo(!PW8nb-Vx3S{b`$|=r` zCuR`;u`Vbh5ZTWbRkeRs|6q-#Wv;=AJbK!r@&g(rqg^JrPxV~0))qNC!}uioJJ6#a zZzz;#4yj!~)#2Or;c9aP_kvf0)!xOZe$bhV%Uc#wgPU5LMOV&>!B&@!!~lC++EG=Q zg-BJ-^RsS?mnYFTuH=>35BFSSL`lC1-8V5WpJdK}%KzP^mCONxmkZ`gtbWPt#(=;8`Z`LLHZnY08k0C ztUDV)EOC^{A7Ql6713|KV(DW2GtdpemcQEYy?fNvehS2fxHyDdYBmg#hXMy+h^t8(|Co~_q zkG(4 zRr%|)he4*plE10yY5v+~`iw@PBXGFV_DY?}WMxZM%>-?Jb$)QAL6>F?JDIa(vYVV$ zQvPaua#KZ5N6GF1%k>aOh0kL2*ks8(y4g8)1UL>i2+8N>;l<$wEC{MFr|W>NUalxe z1V~RC5~k6coV#cNniFysWWZ`$9@2_%$ZiiehA7pQc14plotExB>2QOaKCyscqebpM zeo}N%LorU=fzed5jk~{if6}f#V!>x`VnL{l7!#?yhZvTjH=bZaU6n7~ZkWOo)i~Nc z@h4?t73k+$J5naTAs#N*Vq=JG!aiCoFN*tqWAUIQZ{oPV=?VJ7$sK11P9D9LiZU~l zc$2q+?(VbcJ8QQj_XEY*FI85N0OwkE!Sz^QPn|qzhG*{?r|9nMeaxZJZo8}VGU1$f z;X})OqYaZzbPSvJr;PK=`dg;5LDbuQ{-!8b!OpF-t6QEFpNvlvco<*5{tzwf$lN%! z#UelG#1p{yusME){D=Y}#Z4tIfC+#=Ain4xo5tn-O1~#7IXSte?PM+Y%_v@bz;3xI z3pQ!O8?Jn0tRRd>-xgY(e;-hZ*eiG0?;d?+83zXkDRIMbBKpP_1$Yz-8XA(HpM4h= z7Q&{f+2(?;f@8p3!IJx#T;3&BALEwaqoO|d(u+ixTO-1hRM7Q26MWz+T zzH+1!NMpxr-&>{Rl6**6K1HSbAOYND&uhW;6Bx^5CCPzMt<}!?*z=lxr8Nbct_Y;A ztLi;Ev0DG`1GxXqj`;Rf-hg57c(%cM%{qNg)L_}!w#gH#dWAI~Z^wSwq?Y~SWAg>% zIG;JOS8t*>N_|X{=0Ro=Yp~t6ZZdqy`AEAvm==CB9BH@BFEDl7Wl_f+EZtbJV(Xct zm0}OIssP1nb9Fw#j`e+wP=!FKauIU&US0#0pja4zGG*2tZIaRybTNvEaibVkNn;$O z;r%oki7u)qx4DpESM+gpBS5}lr++@`vj1&FWru(IBtivmVPd$gK4O3ZK=4E52~LeM zM$Y5bD841Cq30{;syj8UYd~ZiIEq(KIT}Kn*5JS?3(%ufO{ZJqYU{cm;YaLytAI&K z+v0kjx935oEPO{pN=mxqv75EzJf+xnKE%}abiHT>_=rvkU&AH)9?U=y-W7N1nVA`F z@3X!h+YCMjs%*DtOI@aagA8)5^kM_TepHe4;%c`O-Ho$b57bT<9de8$K>-1F#RPYt zu!a*q4oc=k?+{mZb$M2PVpk_Kglj)hjY>*goxqk#>8Wnm{@TWOBMQsC zLYi(?(ajATF;YW$L;8x|h?OHsNE-m(zHA}}QQOU9& zC4Eb(fLo1+osQi13}$la5#Mm8n#NaZS#@3YRzasn*2Et7Q|05cU#*ik9#q$X#H3QB ze+uSmX!+B(ZV4Od2)y2Jir^6?;!wAo^e zp;t~3C{MP(AXHC&HJ&80B+lT#J~HhKxw^$pS0LggP)v}Jvvh|;jn6&uH#MfCT8B2H zU+^l74V~Wj?iVx}a)Wd#$4Mfbs!Yf^3O+23efjczbWb})k6BBsJNT<=F{hC;i&9O@ zHtc(q?~!i$&WOJCI)f|u%9|h8RNl`4oFB9uXrrBPHxt-mOS7f)hFMp1o0A{YQt%uX z+;6k$QMhDAx7farqm0jx_Yeq*GruEtTocRBpmgm1@Wkj}vG1PAXXK#|M5WZIw|uYn zbfC`feo8^YYYS|>XKPUclI_l$r!h}BrqXP{HOMWE&7p{p; zal`T1`}gnh-@nIPu_Z*((a~{samo7Deg$_D)yxsc$F?o4t;k%J{@#acU4a_Ok^))6 zMx&3R4lw%> zGy9&s!WK8;L-06=P*A;6qV>wLqP@54ce?mM;y}SfO|ccg@@Qj{Uy-|^uI54?5=)y^ zh{ruXX|b@Nk_d&YO=ebq_7)&zX`P>+?HyIuQ;f(ec7lD+_C8lkW^Il;osA0nLTM6= z1rch9%wGuC<}6FjY84>lsm@k}>C)zr5bl|ez03B!r>)R)XUW_6TbRk7^fgpny}fs? zjKC?4f!a?&2&Ufl*{$tVh&Rz7{ZO|y9No4xyo|ssx6U8Xp+vRPlbzc2O`WAkeh2r= zYQR4N$CB8UPD~v**o1D%)$Glg+(44{YYGpK8=@)d2zyspJmu6BtjNM)+j3y(O0P4N zU;}J1;YBYQA)WQ2x0Y4xVOM0HdJQF-)D4`q$uQ5*7*_DO>;{B*3eVs;W~Vi4Fe;WI4Ue!+f7N znBI*hvZ!75iQNI_uC9Mm*6m>im-eqrXq%1i9|lmw?DR4-m$WmDvG*e-WhEI4J@@va zsd?B(+2djh8`;Fz(?cPH<0*B6qY&zZLt2U0p&F`8=g2x1nagW^E2M&tWv82tO`t4e z&M1+})L;49r`A8Tuno~s-iqTBr0Ay+!`+sIO_qLYpji2C%dL2D;ntk)PPjvgv#KXJbdM@$V+n$XCd1$dgCXGAbo)~F? zr>We3S0)XlvFy-+PFX|CQP_*enwROB%$zA>Wkq5{r<7+hEMKnOh^+&yfsJ$5;oS!% zT+fTP)^w2T@XkMzxJQ1PQ(i#rActx31MP*5KQV6Wj|+a8m5_U7+^F6_qEv}=)5#e+ z%P%}{0~TD?*F+IhRK%2y22iFc_?k!4G5#Ab424c;A`S#O65kZ#H&H(J|;R)@o(~hVW>1pCTZ`2zxM9sgNi^Mxd1!guzK*& zZuWuEf6T?hZw#`HoWzxz2m849pGn5w?vd8XQ}_>+0yi%f`nSV>tb@-TPJJyu{s-Uu zax@J|>c$bL2%;dw@cnZ1HSwJRA(Fr7PiKLs3K(HX9#;B)yNE)BkzAB0^FM%$gVMH( zcn5D&K~9#N7_rl3x$CSvz~n!D<@YkB!6kAHtblz~`!4*!S%;pD4V$tTdHLUa17Gq^ zgCi!Vt5n=%ds7NJ!}Iaq(HXu8P1?y5&UTLsDZ-b3{q1h=tBF8T4ElR!zuu+_dAfuy zmu2jh|1O8cBsXRbBy{yeo$>;_1b#}_`>64Z@=iQfhGyFO-#tx?VPK>!RYPN>?b1ID zw2kKM)`m)=_!|%shWO*W20I|Y_qfq}&NBTwYVj#<09Xv=teW`eznA`{k!ZldFfouT z95U0l5rkuQ^%(PT>GiKEOpHNuk-8rsP9M$sRcx_KL*N7mohXoYx>L@C(aTY@dpQ;P*Ea{smP=VIgBQRdtN`SUZO1}f{K zoiGowVvFpQ1{p@wx3Av@cBxj_<@O%R=rxWw08B?xyBgcCSU!IIh_uL6M=H?>Uz_zV zWb&=`P;x2gRg7~J&~Pw+*JEpI%YI6c_iWB6W@2&i!T;^Zn>QAhdlQHAwa8Ex$Q@F= ziX)iRjooeq`0LlNribI!`3^r3IDe+>d!AsuP#3;EoRV|Xwc$aQY{KF9?7aiYQ8qB3 zRFQK%Ss5K>>ljI9(Hh&^8#uGW+U}7=^WU0Ab}z)q-H%+NOGKd*!ADLMRw?|PKSn{g zgYV;b{QwC6Y-H^9gR022|Ae}p+{bUsMZ`y~p+~wX>;EqF5c2Q^keHZQh6cB;u1=q@ z-$Uz0H1@ECwM#!XAmH^!CZ_oYn?(!dcp%=sbGp|FC!b6pm*u zMz|nrHxJUrpy*9@-$(cM8_>yDH8pN#(P;4I}LKgC%cc{ri5Nh1;(``1tG#;y2Z~Z(@fc&$~VsW(tE*$4}U$i+1{M3PN z!`UWyFX7E|@ljYW?$kqdHEXNZ$xM8`eERM(!&rsU8cNde>}0X`AhbvhzCTewf%M_MS=8xa z552j2uuBo;^?B<$;%{Q!6g`|4&Dv8p4sTsaS7}e-TBXInz#JER6%xg? z%+Buo)XTvgR7`SNb zl;gbI%gtBd>nW0BMcqKE1fQ?MVx#OnU&Egj8H7lD(GjP>w+lq9ZUZtYxKNTi$fz52 zQ0Qq5vM};>hgr?>#rqoUM+2G|-%1XQgd5^Xupc7v!uR!N6e&}M|7(nyzhEueZp$u* zOU(&FUe}o^`X2h?X57R@?d{pc#dMaImOl@J4`%;rf$e-RGTxy(Doajr7bXHP$0f>t z)E@*@eM%TSEmiihJhgs~qbQ=mM>{KG^RbZmU2d>QbbT@>rfx>>=Y8pxxU;iCYnTX) zq)g8cycIfwygWkY+dQ}y8|_{OzQ1ROlf6%%TFp+;-`+1zHy2}qC#Su5%H9lUU) z@Gy`{D=LcNjCLksOY~-ye%I>{%o?58zNc^gv5;CbYZjyTATPpywTzqUW0ir{lls=!{M&izsSp5^o=*T#Uvf0b$ zPfrS&OJUGe*~uj8Yw4P8Y}`vLz6!8R=q5tNrV6wzh;6Apag<~>!EwwsvL$-BFxc&M zt>Zb2sW`^u>Y{RTJ=|zf#=Y>3r1#CLub8j3pjG3cNSWxnPABVMB&MgsdXGV)!#SIx z(i`Qkp;MGaofscDO$;$XSvqqS6e=1@suybg(3qn9@}JIrY-e?W6;?8gr_#U7(?3O_ zUb(0xe;9|(_<#E{Ivq0M+~~HJPbm~5vrm}bAC+GQ!jndE)(dM1k)l)16g^5M?k<*h zQ^xQJdG&{g)p&hlIE}L*NMo|7y&|N2%oT7lV%FKNSDb{Y8H@wxq|!cB$B$i8H<_^) zsH6NQhRR%Qg+~&p%Db3wq&@3ySUhmcU!#=Eyo+Gf8A@Ehy-y&!a+z^%B&X8m@sB8u z+U(30;!Af}uyH1p?Wwz){$P11GVQV=uAjO$TyJLmrb@tG&~2t8|&(}G+u5D5iGm_lpqV7A&iA_bs`Q*CZNtSgsqG!I@5 zAnRP(V4BAAbo64Luc}|g|5QeN-dQ5k4n7pi64hl?WlNQNO8scu64UO!qXT6MqNr?( z9&{-JScq`8?6ZWKUVan99CWbE=x<46%{=%iy zq>i*q%dV%l3=kV_*vj0}Hov_h`Byy95VTyFHKo^R@xwffOL+X!*H}dFJaq|}6ut=~ z68e++*^WT=VR@m#?2bcXA4hkxigG+gJ8WA7*WhH0K^#0eN}sq?x%to`L@{Dgqtn zca`n;2l}jT6$>;)g@6A>eWnr<$fCTLv7=W~< z$Ma#2y}VHP(fPPR(4oKD?i2WCx`r9Y;re)axXt6jeJf7d+|tr;q0S=EC3Q6;#N=)~h746;w&b<) zZJNs&ZR8;KrYBi;EcaM@V(|e(MTXDln;4OqRKDkHgP6G2%X*@!Q*XHi13yck#F*c? z)6L+=x@vPPVjXjb=pKF~B#|uCW^-QH zDDUwL>~yIw1`o5{*u+f>VC%!=3$7m4nkw-uA{@reDzRtV_B{kA2AkwBNm?DJEZ2Nw z#r;*!vF2}k-gzf;+@|-+&hl41QdSz@_ECqn>2e2VW&$D;6t?5(j|e=pGorP2*POOa zg+(e}g6J8^1>+9lQPLtMW`c;co$jc_TO|CLk^BvlwSC^>eLO$YM%J@^ACaQ{xng^Q zJYq9qOI4eYa)sPzI>>@Mh6(HhC?qntUgG~;hrtM@O;zvOR@ak!`pt0Wp80vGsP0b) zfZRBP&sfB5$tuOZ+b5g8wA_x)vhj2dk8OM+r@O%>XgWlJ4&Y8cVDRMnn3@1aLRG=? zdjWKuB&p;+L^PQXQk^?vDhFI@Pg;0sq=gwlHk({XwRSsw#Ld-a6mzL~Maw&|A?lrd z@+n{92!H~nG4?;$>!*=$VpGu(s~4d)QZmjkLRS%=8%m1SLM& zP}k!)WJE8oN-hkTO$4B$rq8FP ztW*&#(vvryv|>u!tH}A24H!Ll-vuoZ3Nbd>uZYVzVE~mej$cAW*t}@;ny~gq2EqCb zIV+F`@_U3=?XN$uGzSIbdRTvYlI_=Vy+bM?7BoA5f+J5hmEKEDu2kW_;jxsVN1Gw- zm7#2I`r6rTS;`C}A) zXm*$Vfv=AiyBKh3 zWu@6>f7D!qqJslR_-Dh@X9YU04cHAZCW5sktS1!v;>gY~Bb3}XRe?^z$cS29+W|3w zUfC25IhTANj+k{?5;rzB*5|uX9CT7bLXdCc|G1J67ydoC<4ga|zcptJJPKb_mI)~+5k zOu6)*wc!N7jja7~o2}NM2Pxa&G6s`csWF zT$Gw{sHpIF>}Ni4_GBsZ50bQ!?oS5dT{O|K^$Q|n>rj1$NTqA>P+U^X@NtapbqeAD z1%W8~PV&=rW9zL6==bkhq0s7-*<+dzgAKHZmX?n{T+1o5-^nP_SLVjXuJ+ceUfzJK zNs*TciholONF>l0fiC-|2#aMIa3wEPWSBz3R%zbBibUcl<1>_xQa}Du?MwVX5Gz9` zQ>-mM@%o(VRpIF#?3iXdAP+U@xZwA11l0r@yr*7OA|SYre2`j%SUe%1J)1SYfe?r} z%Z`b4=YX8!iBhuKfU{PQDBY|U+s%q z%AGwu$Tre2Sg-2rc0=Kew|p5#f*C8*jK3A^pz09q+&93;Oh>ODzjs2H?8@Ox8mk{n zsH)RD_6?G^tP1Mlf?2n{kS;swQu)d@T@V->ug3jWF9c_oJuYBJ75Mp3R zEHLSy(O^g|Z#Je6tN89nT&zlgbpgI=?IbrD3-IW@uGqPn5wu7A8M0qHJ~3V>YDt%8 zk3%XZkkor73guz$Am5)eZ>R88rB0IDKx2Or%b!5$-j}+$t1`;6UY?D@$(0R{CGN5( z#1rE*+N@Q`jEu6qXXoa3UuZWVed;(e)DY(0r*uJ=Cn!`QQqcSPb5*!*Q5nTwmBB_OxqVeA@I|JE4Z11 zDYU;JRJ(rv>x~Ywr>a-~WVA2Pm&AjAuW~r&#OH+|!HXLFW=~Wgi4f3OVjJ^`Fw6s2 zJP)Th&%kVQt|3$eKns?u_3o1sC^wXfX^;FePVqZQMSb09xB-NM3LnntUXy~EHSRL< z{A>YbowZ1w$%8CkTG#2(UW7z09-8!ck=tSI<}K@_b2mRC{`M{&YUsWb?i>+G&p95- zZEUtYXOh5d7S#h8Rw%U$lrC*37bYO?p4z@v)qn-CcW<MPTa08 zt;e1kpTHz9-ZAhZUbjbBpQD)~;?@DPdlROIQag8xiF6OfDlAI$qnNiyovec{EpVNM zwAl0@$9_n{ygCpGF6M531eq8$&fszG*Lm!ca2zf`6%_a>n$+lF)&@m6m+}l4E<)IC zN8~QCPy|B~R_$>$z7|?DmMO8RyU{!zxd48oA2W1p?y6N5ku+m|07v>dzgYbc_D+ry ziv8Sh7;3T)AK%HI*QdS4Q|%1re!BP+Wdkv?b^BCNy6~f>fv%_IkSwKmS0ILtG?#*R zOYaqTK-b}e@Fq$?9(!>%D7Kn!FpYTfVxaO*-cMUHkGuDioDUubY4e;PB)}n7B{D@i z&QsF5Upbn;rpWLqa30}|GEs@JrP$L1WXL&fb+QW7R^s;TN?ZU6*Xh@|Y945m^R4FJ z>?DiGbeb8IsLCwAT{j&*&V7d#%)u>7m(VY?x?S==%JFWz8J>gqVX z=kt_Ea*=E{pM7}%pS`|){&rk67Mahbn|ZqLf>{SBgGH->-C^Uir~o+Byx%J**J(|L<9!E+(9J(; z19+NC|HB@f0b<6(7mv-z7;bXd3|T&I!di4a>MqTSoLwG$_PcY-tgyuxmLB#Gyu7;n z^5grbx$BJ$!#`zZ`+IwY)#dj3u1!FJIAeS9Ae=z{gR>ZZRWksyS2p;ladj*J5gh?e z0rj_j>U99X`L&$!RT0h-1i3VjjGobEp_@*2;v2*k={Pys`F0<07$y}wj$>ki^Z!Pt z1Kp*`HiSrj|Nb3;zo9oK7K1h@x3Dni`r5Vqy1sH^Zf=03ajDy_{eo0ss`mmoG(3EF z5AFEpj1+}S-EQC1 zoNQsKd?eI$S=$*4n%;v73$6DIgTwTM7*lTUOqHy9fks=7>zVv&_#x~VS)^rp20d}? zyxM{}Nq(M*IzmL_feM6zzuu7Ob%}u!U;8N`e!C;KYo7^`|51cTAfIKC|B7|-M}X1?oXWRiU>xWc`d+DADg3FdY;KIttq4|S@UTJ zDu$^@M_!+*{#8&q2Hb|O0RAu48WOLdIvL=PSu9R&;5WbEqdh}n+P5L=<0;Td!}4<7h{M(ip! zX9#kNAgB{SvsasCXjM}d8_|X1DH}1$!pe8I&D{7!?$>>d4&y|N+!^{>(?!z+c(vAN1U_A@?18i)a#;HwXC`Wvom(p^tuD_nv#$E zY0%Sh1};;GiGl-GL##%j`|ha8p}@4{RicLi8_(YR55did8ny&%?U%$hAnBOr1A$@- zsvzkF*MYd#)Ftp3V2mzpuf$P}vQp>?!>8SG2V&756JdHER)4f{wOuwy!WAydBMH7Y z_9MT@IB>t4F9{jtoPKH^$>a(h>ZUM9(s}rFw)1B+>V3BKq-kWEg18KAuNv^eVj+J$AzV$*9F( ze7+{;IV7UV`OJhc&imS0Lt1arK-+@0KF+t{#JX>Y#bm6FA75Gl=qz(nwGqW@0c+%l zH1faDm!($hsh^s+pTU>}I+1NkNuCwT{xM>LfU2|Il}Y}B6i4)0f@lm3S+vY80(!x;)zEU==qeJK38SMg1FBVvy@~YpX!dmwzWZDOAm9qBbJ@e1Mmnn zW?^uuIX4dta#r<7=f&IBcQEQz{fpjVJD?hHD61NuqpT!jHfqIITYp7kViHY{I5}Xj z(KKPbc#4+gU^eH532|X0oEgYRXL5h8-rY}$kN+CQ+>{$+_IwKXZt~{BjK>rlvD{O} z#LI3mgin>nz_qK}JBG=m0TLXGY`!2=%?{j^!x%Mq`URa|S&%d^5kfCfF03re379lA zeq<-Px#Y0b=HZV6wA_?$CnaS#)UTU-=hmU0m z?=JC3P47A2)!Piy?4Q2>NcAd35?$ewomHOikcRj>5p-7F&h+s0;06ehO=!;nyS5;oAIz%pt~{y{i%Di4taU*U#qK(NQ5=Y`2^Lx1WgGcqH2r*Q>x zyoryGe_E#Z^y^#M_i7i|ch}>k!Rw>NYGx*{ zEEGlRWcyQTG>1tCAbqfHrVo+U6gT{c7epsurGe9rUl@AHpHGozEA^Dw3AZX*k2e}S zo><@-%aL@Rh$8uv>?d@QXq!ku zaD{AO+UnyDFZB;kxS{~NRR|yLA{gSA?M3E;He22+zA^VncledC&z(v?4>!gzqT&?5 zb)uto+k*^`PGK$E>v$b3^2`BOMH7Z}`P?i^TUjy10MAhnR7;e$XSM9M$)DHB_l}Q+ zH?6j_9IC7dk(7n5@Zrfbl+FiAeO!#0C(;G$py zO*&+(x@dP${N~h)n^$H9Y`4h1#UkC9lL%h=&|tIK!n*J5$*!S9m+-$tGv$YfEK^bf z|KkW8SGTi`+RFT0sN>T%7vo|>f}5^h*YES;xu<(3>!UrfnuzWpv^LVp8fzAHbxwSJeIW2AAEz3ACW2Wr81I>P(tl01JWbuL= zH>_)YLV*eYew&OwUqY&fOHOGrQ-e{Vvif zU*7p?;$i!|RBAkwot#0iJ0g?x`c_{aUv|s<8bWf~GS{Z$!Kd4cm7AkJA9xD#-^!8P z!a5%4vi$Cm+ixREPP+?k@0DK?I-bk4ns+l^Ld=X~#`Z%b+4rP*oex(6A0JjTFJ{u0Yy#t*?VQaB-pF0Mc6WkG8(5*~EX(5t zdBc}oEJG3UKR7%*7*` z-EEqx?vL}0?B105Qsl~@OMrz?3{$1n(CshM@|9;St6#&VwbvKjBrue3N}Xmz^OIzo z#hiH~Yj^Zy1(4)vNK@FKAAYU@`wj#cfP25uQ`PT;JHhZonwH&bCV)@T9G!b2;BwaMRFIQ~FzqcY{QIhc)tuKoMb zD4s*%X@2WUhTvTHL;PZ>q{rsA`u?zJsjWT{k~m7gQrhU=7ZE?tLw=R+e2ZgT;`7?R z-Qf2I3&Bnd7#V@cX3jb#KC5)!E0)8j>$2T^nA#l^omaQMsz9*=k1d+mm%tf`XG4$QzA zm#kTqlhfn)|kHUAW)nF|!S=^q^W(p6*J^y1K@` zV+S=8oveBKb~p;=$zWw;28Tpj5W0(V+8zLgMwPO?4{auI(;D;{jRNQ6k&QA~3%j9x zcrn6?{gICIGwKsx=7$b^bR_URMil6WQ$P}fNnD!O-A;f5<#qJk8r!?!UKOHzlT8hv z7g|Qcp%hw-jF>R#NxA-A9$9_?oqb<7`aE<}?5ePo?c0iVvGnZ%FyhY`FDYU-hjk0-{^Z)0KREIbf@v=}Dwd zTk492`%9XKcKkslMEE-dHLiDDZ8Psnem8{Ea+y|lY@cwx1#g2Yh4qo1 z-YV=J9f?7e9Vz7%$(b)WE?-m*6w+sdKz=;R6)TbqnSu84ZCBSH<=C?ON!Wx&yU0TC z_fx)Pq->rq;GMW(Yy1Uv1HU*9I6I6D>?d}_M`RL*_tGAsL`?Nsr#hf>t-U@i#o*_&G+>TF0PN@P0uPMg4edaEtS};Ov7U9}(%(8`XD3q5uWz?9{+0AX! z!^~|oi3=;)MW>{wD46`^7QE!P>H{wW1DQ2>vx+aPCP4{*PyP7*UCP6Q2nMyINRrEP zc&DTa`L5T#V2&$CHZFMMcC@^axw3y`7bFDZ<)r-p9W^PKn{O>Z(Jo5 zecW!@Zd3sIn&@kf=GSk}ao1eBDSs-4hj;zV*kaWLK^cihBe^A~9u6CZE}pBe@!tmq zNynQULtOT2%&xORIp1zZK*v{Jze3PQQwX$ef8rGt?=W+KC0ty`6YK|3LQa8D2nJvX z{B7lTrI3QjT5rp5zU7}s{&4+;j|8>}Z682rNhU=w&;)9o?`;$GU=?`Ks z)-i4Jw~%l>dzQH>w30LSm=1dsFvf)EIZyVYYuF-mY`p}$e4%_RvHXMBR@aM*2ibSj z2~3QViu7;|5>>Z8lA(k+e3>$<(f>ibdVlKYSV1pkp6l;~iADanN5Fq~kKR^QnQiYG zG{l>2toMYhS<{mFvhXL|rSbei9h-xFuBWuerEY9*cP;#fXPdPvw{vU`KiLugTP}IV zVb#Nx#Yh82z!5Hn1_1$oqKHSl6+H*0InX7ngv2V9!w(f^yE+n`qMKV`gQHBMkP1vQ zU*w-er&o#nD!Z5)*kF_RzPE`zW8k8S(}_Vr{cu@Rc4UT7KuU22wfJwg^mm*(SMxuA zi+D{7)R0+(P#tT!dpss2(&kHNBEBO@7SYyaFDO3f$NxMxH|LWt_dYNI+>B3tkvFo! z9^yp(jl*S^F70bdocz9@ds72#qx43Qt%oFvAdEeaBJ^PMVK1sxqj*Q*NOlJ@Khnh9 zQC44Y#{G9WFgLFm6cOA^#IU_ft*l)Y&{m30cz9xb(xA@2_`dHWLuZ8RSC^KMt|oc0 z2|jTp>~Axe?jOUr<`iAFHIo%sy9B<33NF3lt5K5r>!85(*+N#>-~TNWv>X|KKM%(v zm}vS_mWlq@k5ASb;6Xev|I}m@$DcjRk1-)Fo&pb>?h8er+R)58XSIWrpX)XTA2HZu zm*;CgCy+^*kt~Bi+&py~O<1FUvqn^GclmQ`#CWHJ%t@0|N9+R?hiUF^>tv|d51z!Fg#d@ zy=Pup(*BpAhud7pDdf42YhZMU!u2acWkeiDbPaRNkziSvAaM_AAyY+lw`QV324wP) z`Sq&^nQ^M$7(fXB%f-CjQB$^BYu$L;pAFGu zBfXj}$fU28kcBu>PBR`UO$f(*ciwi`mYSU(B9^zgaLqD79KOfUix^Jux?qtMGen9a z<&8LVV!VN3E0Xc3|I9h@ettwmKyf|t>mE0eH1RXO(9sC@(Ms`(5Ds{?~^#8J+W%^7w!;6bBs&dcMjW`i}+KQTRA zojx++JR(EZ_;_YEn8TjXHRe<|b6jLShIBr>V}RH_P5L;ab*$|Q2!$7+!}IfjHjDod zAmPg10V5*{#Y$O2a3;aw{^0>GQ*8fuHzda>ASn2cgi7z_9y$*%y@pq>?B4C>l)$q* z@B**rO_Arooaf7u)M9>99{wJ7LPEmaj*c8S<$=&5uy8jCB`>J>8=T*)YH^mU--Xdq zTQj#fF*r-_8**kRvWZ9T$;->~L!1xL-(a(_xCpk^F1AonR|o$io)TH$ylPo}dA1CKu0>GAfAgY9Er z$0HoPw7~_$CM#_o0Di}<_~GLg*1Nkq<{x!o|0qD!>#aQYEWf(B@xq1S@R$EH{_~3q zSsL6@jaZfZ35H~oYKKj!Z1)XRZ7ArGh@<``G=Fvf|M2#eaZ$Z%yCw(%qI4@DAxL*i zsep8McXuPwARr)J5<_?QNRH%Cf^_H5-JFO0p1uF>_tW`wzW9@wHETWVi94_Ry3uG1 z>ZV}npBdQqqYn%`sz@8YWGN6-tmlz!9 z*B(9*MNLq|U!9MlV*124{>r7zk);`fa1xm*{9cY;#^^6Y=gEG=rk z1NQU)9C}K7l{|zq8K$2=D3X}Zpntopn@|JwZjO4&dE>6)?UEqxs-DHbe4aXXMi4K7 zb;!q8{N&Mtx^ga4!N$>jP0jIEIf~~}QJ;M?t{Cj$Bf5{6A z1l9&1-|zj2f3ZY_)vL%={)onh2%Qiq=YY37u8i=D zc^zLeZN^=5E~FD-1DA|o^9$CM?DJ8z2B*+sL&A6-%Z%$_g zc#j)IhA{DDuCim>m;$L*h+Mv0YpTl!wdg!e7KofO2>%KAs4*Jn|i?`wB^h}F2l z@!A*_qh+9_fa>bp>>A^p%%y>H{ytIu)ZDeh=wqx`(e5P+E;w{ojXc=#4ZLD{_@uEx zrwb>?`f54pUc8%jtWGK)%+-ay>tVpE*M+FUa2a0G>3?OLB@EqJ<%v*AdliNMqq-VL z#4mXrb|_Be#%FU`PpY;Q`h=dh?I7lc={vlyHZbIf@mm-3%p-QFAET{?c zDPo^i>>3tPAzE*qu-aX)VJNbt2-0Sc>1Gf3M5MY~E(;^a1wgPPPN}?F^Wil3-CoXG z{e9Gk^f!84rLq^+S_;?aCBuHQD7yu7hN zvx8yi!|d}cP6wjW>}2f9(6GWG~uJac3qFW41GMVuVX2>Swh< zRc*Dt#Y2cje(6Ro{P*%DovYz>&TPjBUb@Zom&)7oZ#+bq*f%Ck%xqk@_^fD;1AVa& ztFdc7BIn;X`gEEiqV0m*tZZIy5>BH~`(p|R*Fu4er0-qqOJwytYbOH$+q8vvnQJ`O zF|V&z6^V7-*@A9P>KG+Ux3_&70v~!eW;!k>=j_+)jf`FcJQzSq0r%}T2gA+ z>8)8YEdwd-oA+5mg=4Q%K2W+|Y~-E~1__7)3?GP=E7pd-XGx^Qe6sh8BJ$271z5Ne zcjCaYBp8`b3Md-^wK!NHmjD|`+%rW(RrA(7-L>Cu@C5tVc6u84DDQWXS!ME@MfE|S7BoQu_kb_*C6^stM z^b+&gY)$A@6FJAU7pGAMsrK|xU(oF(tln+XHIzzfE%NqY$x&%{LDf%$Nmo}BlaYzd zS4pMqb*=6F6(cb=4$G{`MDT+xnS^iYy> zF2^sBHl^*0UWY-iD}xd>Q()QWbZ+Y+yQ@DDrNe{?opatNhefGz;oBFFX-1f626}&# zR>x)!EVKmeWEZ{U(wrx1hUdu{Jc>o_kO`k-WBwjubh6)bqmpnv@3Xe!6!wcurDxk^ z8g}$K!~{RV_nuX0Q!uMHbGoZ5>tnb2K8;iD9Sv5HUgZ@x(ZP9`fihj8|9D9<*KWK$ z`4`5;l-ruc`^5T#hfOxyo(G}1`}3EA!g_)4hV2q-ZX(a8b#77Aj^A@B{)STv?o;#%aqA&|9 zYd4XKsGc_A48NCatEF4mRXWgQ6DcerB4O z@vP=oZ=CJ}`;Kk1sV*X84L>lm@tWB0O>#1>H1%6zN()U|2b0)AS%pZ8vw-5K2#Wwt4a=)TL z%pJnz)DjJ|-!n1%k7uW#=#YKoxLK@Ku6J+A4;|1dh&Ral_YT1c^%1>ezA{ zd6M1J=gOf)Qe0J2H9VPgF+MEeGIy_sE%>-v!D;akwM^QNhB4@r!D#eXOXPOlvc{(@ zp$Ys>4*>gB$`}0{Y1&uJTpuWTBd?|{rAU^f6a=5f&xlHk`+pF}cpBH2QM!-z@FQN+ zqiw6=s;V@>w6s>P9IULC`k0BQaZCc7sUO^Nv3j~-kO(%Ov)CUb3V4xI zX5lZ;qaHW}`w!!*CHjTiO3;THhF+8VY%b zpbY<{WoRg7Y9Sz^b*+XJ!%$Kfa_S=Iba3|~*^5U6mMXq6KUp6x8yjJwK1Rt6_|TE* zDjxii)g&5gpE1*XJ4%TyY6DC1NkE%aa^-j8Qol+PlrFqTnAC~=)~{C=j!2KW%}mE3 zwUw!Ha#ID6>VSw6Z$23XHZ$BrYdT(+-L=71KVm-DZ-5R+ct=#?=`aAKPVdJgFzfNP z%K9fh#r?M9I5NC2*A}hA6T1NkcqC%hr&jk_s44ZN`wmk*Rxs_BM<@B&8?ub-Ni zUrJp1{_D>3M-06I;f!BIIp1RtzqU4tPEQO>Et3=fR#ZeR94Dz|^>hS}F^5Yq zOqMG(k+UC0y#Aw^(_L<@GoW0@riOUZp_@>p?|a3IyJJj?4?Fupe{qp1%A2%q=l3Y) z;pq79p+A%8X+dF3Wkc5Fz7b{Q*F=XVDR<#SQrmWCRs&D))y<%5+Iygq06oBh%cVu&Z*c{r<%4zHjG0JuaZy$7J~ zmPncnfU=Q6_8Qcf1_AyTKTy=V8esGH<*ul4q#e=)jSW@pZy@G-QpyZnw=!{I|q5DfPo#RZFv)&e; zTW>J4Zbw7!Cn}7dB4ZH0#0`7?UHe_e~j>U#a*>50&@{jd5QGyLg4Al%h9MC`>6mu2WpwtE6- z##>3Z^vBb()<3+$qW+W(DTqc{S<2_%f5SnQwIF+dU-AG^8b`b(Q7d9g$ zyFF4l(`AX6QE0~#I3&M4rAs%O#uMmOxrOdNcX``j;d1DrbER@oj=#Q>&5A3D6Y`_B zF$RN#LRXFNFigh|aeGeJa=LAI1(&&&xfwTU`8nsax^y-5_L)8sJ;v24@6{nzDUXzWLM$9Yk{Zv_lxf%=rWQLMVdU@#@=vO3 zgix^|CG7z6w=BCa3okFzZ#Z<`_AN8E?0rfRjW%t+f3vo8?O0p=qLRM>;d}@sy~a(y zK*;PjBQL7Pt;WJy`rz87R1yiL-lyC*t64hw?Uy`ed59ks14yhwonyDXoU8GBQ9fsQ zq&wRg7mn=I1=u0kpIW!XEYj&wgmuE@BM_@l%%b9^jMs-=J+nxS9Is0VS&%@&Fgv9H+BeK=DL!rNh8}- z9iy8#ze&{{FVskcn$jYyp+vode?su9sh#bs4$$yXS-;hSf+ zY#um>-KOLYAn#t9 zG^ztHjXO-uEOQ}K@YYY_yj*S#enz!6R0mxg<`;{iS$0wiaxSjaW@B&0=DhJr0$pWT zOReT)G>Pg$xS080@Gev7ixyK#K;n8^M5$ud*6J@)+mLu>+YwXFW#*moJ82D1WO&&W zw-!vbcyshL?Nd#$(~>C(!wm3c?dH*kRf-nVE_Yzgd>2!QiP=FR<&P*9%6-DrB>G;( zTN4@|>s$q5dSG_TvX22DSY13J^ot>%INyS95@~fTbwZWi>)M&5fiR7e7h&kpRn3Yn zxsr}dp$JZ^r3sWw5L8$xjTyBtmywfY30chU?QV!0U8D{XU&0T3x4n?MT%_5)?K0CV zWb=$~Q<;^)l6dZ>OZK+fqJ;>sa>sn`8k?>Lw;!wY7V70T3kn$s zBlQvz?)xQ)@IFZ{{9_B_2kNtW=Sg_@+b!2?CuMq_9{v%$jM&V=`nY1~1!Jf&y}=0o zZsyH81CJl1FIh2oyUsC9pf5j;fkl$)Y-(Ilk!)J}q^BCVh0RB&jw8Q^gJa`8SCOm z;{D_Ub+l4X8i*1!Bdv^EHTZMA5u2!Dk7}$+}_sjoz$^nuL%Uat*P9 zgfjs~nUs7U@dsf-KOfO=-AHdHUDD9eX4?ymjL(S8_KEfBB!*j@mK#htU&MqGKfGvY zphvDU6n;@wRPMNBG^Ot$7z zT+&R{CArK92Ar%KC#mz;^2?@)9G7Di>D0#^FSJ_<4*t?*3+0ePnv_1AoMnq+ocqaF zyr1$8qveM1?KQ_j*(WwaG6rpPcx2E))mnNXW4%d)I%kh=*)|*8rd+LJooXkg96x|+ zY_9c&WLvaR@~;Ft+nbL+TNpQ!O7vxC1}oD?g4P-+ zYM1Bn;>w5X&3@aH=OAEfY@=nDs_4?gda#;@MVjS-W?@=YYqp!e1P0#3%mym3!TQj@Xjb>x_~<89RONHnzkmXOM00yF4{p;#LQN2Bk=7HRTNi@~$PxY;%@ zhnOmks=t4lqpb9=xtxy@b9!T=U;qSl5Cl;wentzeThw?OK2&*-?g zxI<$zC~=@(wzWp{nME;s4vvu7GtS@jR!O+1$c&m@jXSEpB;kT^q2Zr{q%}(zcsJM9 z8Uctub!l@e!6zTc1e1A{zaMUu)?$tzl`JuP{HCHB`ZbnHEh|DzRcxmjDNFgqh(?n) zWZS&Tc_=}Y+&f;GoFh03oqps)cz-*=CNb%8wKIQ_EPn4OWei7zl>t(_{{vjpaYm#h z+(4GH2loZNTR*;#{F5K@f&`6Dl*`ojBv>rVw7re(Dj`@^N01YWFt|F@>0gVSyTxNW z4h#`(Q_UfNE(y$mD#Q=;hrP0YB6PCZ=%0#2ew{#7b&Xh(Sv7k6)4`74hAZwRafmJ< zDok3}1GDUbDZKTNk9g`eCI(iORMpyd-&e!P<{GfmjzlVY} z4C_gN9SITB)v3KEAN)Rr5GC=WZI@jO^cuu-(n)dYXw_*d%rYSY)i__onc9!LDzKE= z>9j1>iUo`>Z!agjo1R-Zot34nk^b`6iZ1!nbI`eyCC?V58<6CutE?exc^5UD$R{Wll zjcabE@Xmd<4BaR2h#2k-svSVu1d;#`Hjpg|f{bqXP@X8%Zb?fAU3^t-RTci{T^3Xjek_4Y$?90(ti z_*lIaZ@V3`O^x(`hT!BOg=64}+?4ndtOhMrkeD|lNTM^CiP(-Q+Qj>&W>DQA0XOFX z%t>L&YW>Q&l_hUjfQ>t-N2p$BPnNE*tWZBe&1!S;gP$p(9uL*; zA#2FVL%75Hv8=H_&M)|hD-U@!tJ2R(cik9z%C4*mn@4N*vt%B`#rBj_v7gTm?wg>w zoOq;37gOK54wv{Xoy&1$oyy#voy@u9Y1|ICkE;59_L1T)@!`YQox%uA45gDpeHf0Q zeQ+NOUTzmC;310_eq8Hw^agE2sBz~pNjBm4kOSg_+#=oIj*+=KeV58cN8xzfaz3 zjo%j^Aizsi2!gFH{J{`^`QhhaM=H~4(;Df(j#r3*N#m1j@A19UXI|~j)lXjeW9s|M zhZYqT)oM0Q*4a_OB1p3G^Ucm89LGPFou$E}gAUI1wic7uS=s>WYjc1#xjCo2Gpv!Rrkf7`-rO)Q7#ONKbzt z;3|D?Zw@y#N)RldoNA}}RQu)_(9#q@kO8GZ_Q#mBF3y&Bz&E_tpQ^=`IB_!0T$H@{eY%yQ<32M0`5t>S9l7+df@KVTFiZ6{(N!{uxo% zvD-fphTf&${Qdv}r${n*M+g?kmZb=IC8ed2N{uvamJ_#Eg-I~3&A2cuuB@eJc?^;a zI9?SCuDTgU(7oc+9T}X)2=onl*X?f~&A+z39;S1|6Q302KvT(a+#h9OKY81}+f@4A zXaNH+bM#y-ZVh^p?2|4RkTX>J{A2Gc3OYZ*^G2I8)A`3YM?<^18hU{@G%6CQF7yy{ zt9atWb9m#~84*D;p^|Ci*Yfn*D-nabv$X-T!j^eA3dFVj?BP}U`D6dXxTz;hdc%+0 ziQt1K9tO5n$J-(vq#Ne}*hY`cw%3Ipv#8bUQJhS8H8t#F2fpS`5}wZE8_%%4Ft<+3 zIA3vS9JuV9ankBpEi&5hr;)Ll@YxoK_mP=A3|_`zuFu9i`Xz>b>&b6#&57oBb0R)a z5TOH}(VW)d{&xb2z3;iI#(~xsa>4KY%-oj890@Z^-djph!}i z>|IsDM`GqHylq|p55FVah#s}~<_h1spxkEJ<>Pj};c~n~ugKg>3aJ0hNu?tjvC(j* z$Dq1{WAClxaY?#vOK10`_=q}KKZbffbqi1D0yMEL{w_dxRZ{G=9oMftqC{@4viUj zo;&!!ha6BItcKUpkEeAxO)KV}9h3I{8BTjolN-!lTSUdXE~7c-o%3Y|Stfdq!J&fw zRmW8HTEnu8df#w2AfzX0$Sc$2vm!VQHE624{xj85hIVt_bFAr&D2|yFj7+paxFY?5?+-Nbrd6LIpKj%3IP3*pdA+|ov(PD3CweFW zyt?~sTIX~)*{fVbjzEH!0)y}Rcc}Auk1TGH8kxO!C2?GXrhh#io$IWzLVf!5d>&cw z7r@^EM&$Z+?sCkFO2Q&_Xp$U3Q=M< zYl}^H!JgUBLM>IK+a2z9wvWBEuP`M{eiT0EosHB}|0>p1fzLe3Euh!-=#ErqG+*J4 zsu?$IXmIdn6vg|z{Cq&m*Ro>hSNoKfeon}8igY0VIcJOD@*jLK1>oNPn2XOQWG&6b z#k;EA1mTSCgn=QBj9OYHh{c8-TkN1QcURIn7vcB=Qv+U-th#~+zV}*nnb=X1G@rRr zf7_<{zc&%S(v!;%38jeoRqY|O7PHr|1_T`ddvUUB{)%S7617GxFVR2JizF$ zd-!9jh@$rX`;Py*SxGQ<+#MR@KUZl!r=@@TpTEH8b>#A@xPM*n#7-=`jQ;PDEQWs2 zQ~T!*V66Xd15pvO@M;cv`S-2HQ?cV1W8_1dnwk*&X#X{go$NBt$G~9Ew)p#5`^Yk= zy(&VXJ%5kz{@5|;=l^=CUrqo*bq|o=(LhR0zYSzn2d$X_fj_V`SXc7!Gav%&swRLZ z;Ko&-45qns!@leN_|Ep>?`fD#S#zU-(7a9lpzMqhu{1b5E##xam~(ux9&^kWdGu9^ zrLw}z!mP!5X;2+2B3n*fIl}Dm`j%-{W%F?o_5#dO(zF;QckNr0!Xr(5f(-mEGYXDB zhc%5Af4{!#onqZe;TxNA$D62kLpwTt@dOFw{V-RR4Ib>-?t6mq+LpZPE+#1s>lQq= zt5rO~7Gtfpn@f)$*rwsBRf)_NqzD^mkSo1}iwQFHqLf+|RcfToNegXhlkGA>Pj4d2 zbl5Y8e%jx8`;e4XDy+ev)c#^m(tEr@p62SHQaFR5+_uIl>w8;6pvo&^m<@psZ`GJZ zap@)gUu#sSTs4+$VrV~py_?%yoEWcthI8G_pKw3yqk?gn-UvT_;NqSy|2VsM+o7hl zw%yapReD{71GM9iO(oyi<9RXrf-Pa~jGN%T>(}eXT2`knOLG||SuMMi@Z?=cw&R0< zCCNmW5&0TuLqKJ9E>lU{1xs&lFO&(FF}s>7*Oq)@sb^nvDzX#*Vy&KSoS0HzP^{H| z0y_?Fq`5(VAerMQ-*Lek6qcuM0a{et(Ix`^zSY%L3wd29;-JS*arf>>M?e}lf|TEV z7Ng)hIjDn5OABi(VN4mdSw{@@IxZ~5zah3L4$`;=%t#XXig91D6aP6Q9lXhihCYot z|LG>rw9DUsCc}=tw=~MBsv0v4qr!FKjkFRe%q|5X&*(rBbkIGb3f-{YGK}Wu)uG_v zvhD7gCJ(~ zzn(^HR-9#~D`u*hOq*r@L-6D=&O;}Fu`8^=%S67Vzqnxc4-e)i;OnPnpir;D^ z0hS05z}^9!p^7Sz!42&0SwTb#8N0$X2 zjvQ|J2DZ0h0}&ijBjm&pn30_&ZmE5Tnicl;YL$AdZ~M_76}pahep{Aw=m^7tRxZb_Q`~f%>L2+4`)fC6%0 zD{QokE-rKfsd!b|heioB+xK~5(=CU8Yl;li*#mi|wdV4yr(%75{UvGSGnb7w5K!Px zw1Z}CWd+H|(BpbGamWWC@*gE7m!|6-K-t`Lj3AKS&(6y717`&k^@DG+0LC4#e$n>| zTl51W$pk((mWU-;Rn-q4Kcaxmp`zHajX-3Tlvvj>wYVJ`=SU?A8yT(aErB{cz?}~0 z5bg>V0c5YLx*E(9z~NEz^QXpZyKgi}uND-%p^{Gd1tJk`xQ`AC`-TJ58sNd8NE!u*4C1t@6O4En?@Un%GdR_X)MSw9YIa5%tECQv=~< zBbz`GEIph-b7WsK!wb;a+O{r+RNv4%9rKyb+*y_+=uy4dRDt#=$nbYQ^Ene?VPQEt z$`$Otqd}OTf2nQ(KKKLDJCXb+`1`KJQ#ES!_OHp#ej)?=MepY79K@Y2E-udQND=`0 z(K|;bJ;E&MPfdS(%h7A+tv~mFg1P|Ld0*r~^+QnEkH>fN$DnDi4S+m+d$pY**g0nU zYPb&{K14%916&av+Or3;xm8wEVCzMtrlJdZdkct(iQREX?(FP@QPJ}`tfGMpX#zlm zY#bcXA1JdO{?eaKm8PHQd4Nvad2OMi{4yB9MOkWR)#pUgLoH)8`-$_g&Bj~W#)dPN zI)X)S7(1?1UB+FUO7N!DWn*`{m8oQ)PIDYm<;g+>)K1c7%$Dc1m?dv_TW2q~f=)XK zF@=vMjXCsNHXyW!1?@kF8U&#red*Jw`bs-;adxaANIJqCuBJD^B&7~d`H@x6b4(I& z!UuSKPima^YZe3+7TZd90bFb zQg~fn|WsHr-5+Y5c;*~9)@sfVJChGVo z&Rl#iAZ8V$W9ZCOPWg75gpYtR{j0lsfq&QS*HdHWZtE-v)XrhjPgYW6ndLkNR+k~m7M(a=g*&? z9qIm7&)KcM-Wa=c{ayX1fTdHoUCl?jGQ4&!Y|Rbeu^V%$ncJDn%&eCM$!=Y~f2lxG zP_1+1ehpda)2d4-hTnVrk-ee|oJG+vVLXY@-fBunS;xaB>bt8qu;4+!rTqr)DV5HYjegb#! z*&Y8x74t8G$aI0!NUtpeVqRyoV)o9?PS3;SInNP{xw(_(j9aq80i6-HJE+-UhDiGm ziAd*WMw^q5kKp@A(!1JlqweU}fb=q4m7Zhz^>zb8rE$MLJdOY7FZ%ejwY%gxy9Ms{ z_BN1@-OFD8?5RbPPAB3AtuMoDv^&3a_L^GriO}O3X!A2;1N&%nrQep#L#OSpbtr6xEe;S6j)KS4$kz&kfeqN2W za&}itzPjIL(-@>iL^JOE09#L5wFz#@7yHa)@C1fx98`nH6s{$y7ZK^SeBT4?UqQZd zdRc<4!gdE;FDz_7-WszLh&((Ht7C<;yIz48%Yr0_q^n^ zAqIN{DDpC&ac8N+$*~Qo5&hY=&Z=rQX1fD6Tn07iPb(j#Nd-IRg#;^C84O!9jYN@= z^9u8g2d>1hu_JO9q_z{r_v=XV$2{^q;Vgp7)*Jel3{$ht*DcAhosGX-j!96>ofrrACLN+!4K z<8d{pH^0Sr$x1lqtS+$YfPqmp26zTj30RE*L44q0d=Toe2>0MW^C8@XWr~ilZj3>} z%C*&nW4wtVqkJBjt51Yo!W->B_wQHJa_%D;{mXL@BS)-rYI9}X2T*Eku@}^ z{n8~SH5t~$yJG~87zbO>K`F@rX4#G2o(=2`l21ySHfv4y zk={pHo`A#&ENakQz@}H{#=g!^pV>jMXJ%%aP9`nB5^+Wx9XaZkCT&dkQ~X-`dKqti&33g5>?>`_IaOOWxJtjIl{EH4B=F4w0=$d2Q#~Q{Mq=%nkVGRHsm-o{U!!r}UsZwRYd17Iy zTsO5aIwdOARl9$(?U~v#o2HoA@n=oG@GgD!X^?6Dy^iL>J!~d(lOc61jG%Ksn%e{S zxp8Q@z1{`ULO}lTfl^pqov_<58npESq;A0fbDf4iK?xAPcc*90E5+600*utSB3Sth zvgJc%X+&8PiM`YG@asx0bLiA)JAo<$C$MpyJ4FBh2to=4{Rt5F1 zP{U&C2aEpiW~_-E4h$0cz2+(;1%2p8r*^ix5sJ8nzf%WgEIu(|>yM>81_I+9J%_8> zbEt|HUmCJRMl}_q4>1rvVlVNtcO2Q3s3SAKH*7{V7-%Z1H2t&9r#OJ7ZP#fmk)+2Znzai=?aOkZoT>p*0T0I}YiQkVj%Y^t_VVkw1es4|x?3d| z`d{IbS+no*qlzlP&AvK4(<=i$Mm~fVQWk@Pu{{@HraoSshlWNiL<3phu{7yrmB|=N z2;`pr=vAGpRO$s{*n{dICE67ay)rWHPZ9&<9CsLK%qM7qYi*f`0N#F^Ue1=m06OK+ z`oE5orbmvMb}ZU_c`kU~uJ}x{ORrxcO}< z{`KQ0`$0?KGGz(SqVsG&(&wu@YH!7?vzXC_`QO2);95C70&%L}9*vv3yUYa&m}>kWl&r zUz$ctP8J(5&Dhp!)@d@(_eOg+m@xHL;Iq|zPrxT@{h|1mne@c2spXhIjs(_fM@-+_ z#)Jmwx|jBU6cqUPn$W=PK1fTiqHR2&_-A0Exe8#eT4& zAh>FGw@NL=#IV+y?WH72X(c7aoysI^Db$o1J@JDN-3Lz(9Tt_aYdb~ zg0X9sTn(JUC9b2bi5So{$YBrAudMTRbaqBXN4H&_9|9?xYgDJMsVU{@$p?DhZrWZ& zED;|b*VS$-l;9lJnse^ zWFJVsfX*jAM}H<6e0YZ0!y7I{h>Hpz-mOV&M~5hAB_j^Yph0B-T%Y|m^q;qbODsmm z$uf<7-bO5aOG^`%us^U%esln_gjh{gon7l# z=!9kt4h{-kX9Sw!r=-ON!q@mqWa~03qIH=>)y>~nM-qKf$}bfZl^-7WFug06`JY_} zy5+i;5$CrwZ}!kl%;{D*UkW%LpFPAxmQ@OH2s$!oJ722=pqK&DO-|qorh;e@+b0Cm zSy)vlIDPF*c?AVL#u_0bzDrzyUs*y@5;WEWer9x3)H^dXS};4A`S}|O#mt{a7VDIh zj3y3Z`@C&1;>;HBk(LJKSAAkF&DUoIp1+M*V{h6w24Hb=5eMa>NR4rnVcEvXl5K!Wol4GgoLD z>i0yLCUqrMuh5@6(t>sqc?Dfp0bvB}`dnU@*tNVRHJ7MlyfmSNB!xL<^y*i%fo9Q( ziSJf=-gHIs2PNR^R1tE?cM@|)e1IPOszyv%qn62KM5^b-1k1$o$tH%|PLbK{gIFLG~1*3|Yo@juR< zV~+H*I~lgLe-A?gz}eendh8k_d^jT>Cglu5O&GLG*Q$!9!-0uZR74+$M(|~B_qH}R zIm#gckd8*bmW&|ynYKy3Evv7uuUe*iAK;UL1Pm=VfJKAD4M0}BmRO6&?tpb8Cnv}G z-EzM82wRQy)BwV!N$mEhGqa<|P_o znoy7fO>9?$w%;j!g8X=yKGS%ri;u+L-~wB+tMq`AYBq%VIo(AIOVh+$n*~mG3R}yq zDk@pbEUj0Cw(kS*^hA>zosq@ZaIuBJ!-1VhIKluttf24|Y$)mRFP@;+uZ-C121)9{ z7cVI&!i8S`Iw9e;Yn;JeUW-b=_Zh8410rJgl=ZN90viXHMgQzu){eoakw3Mifns6t zwi~Y%Xnw)l?TA4y0?^;-DM$}~d#h24_2d!Fn=Ns3bG$DZnCzDpQCUt-?xV9Zm3Dgk^0ML8+qVgEIK>gOIvSGT zv;ombWr$B~%_XJmjC*gYcDG~qbfnqi6)i2TbJL@z{)|s~_ zn}g2IxEk~@cJ?d;VU5B2Tim>Y zo|dHRt?BBp4*y3DE{tsu1c+F2*i48s;b*@Tj2s&t!kbWDGqN@HpM3px{s4UxKeRp9=h3v0vii5DS<| zU^)L1LAU8E^fK5i5ynTBTw@8*7=M6zV4v08HZn3Is}ze1P3N3T`ebj%?hO2tY-Vk~`UT}K0s;n4p7W{M{{TIiMx!#q*W{EM ze&8Y`(@Dtt7M%=rRG7+s!_^j*5X z@7}it1QgA_d-Gidre1rXY2m|mrc51+TMn)?T~`n}0dW?918oNuC&+>TtOH4| zCYSLP2Pn$#=<1q3bZ6G^AhH0xOU>@iB0FHDnPFEMhU(~OC+|}|#ih^G827{$)BCXT za)5w8G&k+qCp*V^A=E5>|8ng{wEyOMXs=mkPC%1+`$gPaozAbEvzZOa-A``H!;;H-LR5f5n_Oloc40f(`fea~l2q+wMf|`h$!NB)g7NApKdup6F+b z@mN;#Wm}}Q89b<(8o(o@lPy>F}%RS3JDK~EbQsI zpRBizS@CZCE<_F@By6*ywM>pRDkR|6$A37mDe_WxFEajCOw0%e7$3zND&pb95)PH= z1gvv8uji>-apqQk;lwd$4Gg3p8_f18|$8WgRZ+)!#Gp^55?!=9vs#NExYLcK8Isve&lNq$+gTur1c3@ArT+1S4 znf#ahA6^T*ZqC}4{EtQRif3eFN@r1{t)j?uetN9-wQR(rZ(tH&cA49crAD^)@NvX4 zfOPCn=2TEt#zlWEBUVrl9iJ>|wSE81n?l=0E#OZS6cpy?Psk`JuqG8mr=>+`sQl{d zdx`l3^fv=mEFNA^jz!%J1F(6AoUZfs_<&l7&xwvryf0C=i6^9l?RXug-GHhy&1zkX z+|Kj_=^?P)T2mrd{7N&yCp5l30<%wp%s6M={$-H5?s+t+qLv+P1|pGRqr z_4mImzO0x$rLf-iu_UAlK|#R}1l=RSQUO!_^PT|xNW_VsK#~a5+l$NRN|hmvB`QB& z+aIwL9eaPpXm5IGm9a%dFJcI5|gb^L&e^YASOx zqoWsRUHPo3QUoIyXuE;vxL;`u1-ztJV^{po|LrDqk^ z)0DQx;IKOyf<|nMy9A49MI7$8203g@<$RlJ0W@q_)PD)xw-j& zc{f19A1#6&^if)ZoR$`)olV2f>yJuhI;b?XYdv35RcY}Bcy?fB01>xcpsAz;$yi`w zygDyMBW3&C%aHiRti~opPYw5VXR}(PH9uM3bwUQjPY(OcbHyB3YwKg|>D7py{F2%C z!om+M#^Yn+;17>2?D-(M-F7qiaFjGpL{71Zl<~Kc z2MUs(;_giELVNgosiNHZQ)DKo7y+-){koYVRW;mVXAA-)UtK0o5-F^i6>?SzAQ8u+ zqS6Ltn=iQ>^L&f?&}yvaCU*2>-*0Py&;bVrIMMQ%b3&%P6F-)?fN%JMj0o1?w1P%U z($N*3EToEH*}!K7hw_215ZhUmRkH6x|S#PG9DXFOJf8!{e zo9=iDB-MVtYU0b0YQc=3`t;6Q00m{C2F0zO+i@fM%M#b}sv#B@mY)ch?&*0Gu+!}U z)+An=FY)^_B~pqP?xp!jrR~rQ`-;l-iRL_Z+fTVR=`VVeOCfoA-{^9*dbTEZ4_Bvl z7wzl0Y_95ut|2+jt>q+qq@2e=82jK0&Jgp*RHQBXWi0)RR=b+RB!hCNOEB7^-NXHQ7|({ zrKA*@CSw*>d%cfmpgr1|i2;;z-@bpRT+}z%b8V*VfW@SI|CK2wN%NNEgR(MJgcYm) znXEt>^job7)K5?KD*^wP>}*PXeS^$#(71MZWO!2PEpLPfxLHSMSItux3G5XRK<#X{ z>eP!wf;+@_rcAAIv!Bsqil8?=LwuOOziX5BvzqO1(a}D4773kjG~dWF&In}5`=Q!i z0r0WirR&a>IxW~7z$v@U`DpP*JSJ=D&x*VzjPL!OC?ck$G;QsYYt5<;+Li)IRq1(d z4+M)2)EneC%RzfqTd~dfM-Z?e&W(3fnIPF<1iA?2YWgfta7VPC?JwPRGzCpzGXTOF z^q98;Y!Sd@{dseJ>1!*Ln3N;|V9jP`W*|LXX8!vP=z_XFl!biPmk1jbO#EHD1yE(; zluHH$twJ+`$n+LFo}xSw*75LIhA6F;`SGvu`&YjA;Cz?F z50Q>chC5L3Ur|iEw^mFZ_k|Y`)#sAqG%P5iFU-9i5&qrwj46URsNhYpL2YL2B5X7L zs*>X75pEvz5*=Dw%Z!z1(jBCKpIg58B#hG zMNmOW31R5&4hd-mB$P%{Ktf4L>Fy3?2w`ZXOZwmQo%4O?{Qv)6zLysQGtWHFeeZki zwb$N@deV6A@67@kuThojmxOG8GoIal6S~Wnd$4YB=G&rmnAFwiQ;mUC&bnN5d{#>J z`u%s-P_=_>DL4JMePv^TD9QJi&n>=<-5Vs;R#o+F(EYC3F|e56jInvG^Qd*|rOfI@ zh@4uSYP;g9is>A}VPbb=!sJy|wK(az2y}FsxC^al!rOK-$CUrqL;VnJG_YKa;=;qj zgY8`m!;XNPgbeDa)+_;v(~wWOR5`D8Le*$Iz^2UVV`QX{k;cF5tqWEpculR)H`A@M z4^qx(uMoZ7`}17WJl5HY_vZ1csm|I%xl5vhpVZ9i!bbAf{Qaz64eXt3Uv@J*4hi!w zH+x)wj$C}G7-f3@xJ87nJla%nU3QfM4|X^ntrU}A(P9`2{8wdp>%>}=eq8R3sRqK` z;?4BB>#L^Kvg7xk$hF7N9Nvby9$#Nl(Fu=MMN0HX9$2$vk4N$&-jOm(TMBUI7gLjKiT4;<}7AshfS#PvC17LrZjDIU>HbBW)F_hd#UnI zpWb9*V$$sJ$inNos$?}@B->(*cE)PI{~LGBCXVDZ*k=SZfQ(}E$iuN~t+DctjlLz`e{{*u1z5rmujY4C_nt zBIN#!#^j@vz4-tM+_({U(={0DBEpRY!4aT;pZjLfe`mVSdva zcYxB3i=zU&*n{_>um1BCpn2{@gkSw7MZkT=`<9l-G1Tid#gR6$b($ZZ$6+L6HQ*W< zt~tdgk557?%Sa|fuR4Zu^m{8bUEplw=v4qUz#*SzKl$@qFgV>&J!wsd zgg!hdJ^d!w!*@f3``lGZ9DiM!NmMjZms?g_d(zC4^MBoszXGeny1&+(OAI@%0ly_* z=XEM_n@WWuASMQZHEsi8c0!g@qwEVYX+;P(^|73Q-QW#|hgHD;dD1$)YN%9jrzpQN z%Pb=+YcNlZ3w{Hniz=$BifU@0_mEPg(Bh;7NzQ-()t9c)|GggMhH@H;b91pd(6r~l z%+8^RQDSg9#I8U+2vzXKbd>Dt5ZTPqEHl>NYsBvXi~*{Ib!DpRkij3=H7{cP?A_4& zbk@J8URXh;zCO?|!iGjhktr!JU_cMZW?*(JI67~-0uWVwQu;rz#h>g;;q#56ueo<~ zbM>hnf3ZGrB#aJMdG+cUSX(c`7<}*H!KO85Fxd@XQTD7-qQFC!K`9dRyTQ+LsyaR@ zilVrrqyt95W@leUmtpmJwY4bU{|OV9nV#z<(IaJKx&H>p8f_OFbpbXy2_FT{wX^dn zO!ukfUo5tgG-~4h34Mbg2xwW{iG+g)2x*u-pdPdLO?ZL4XWl-|j36z-Z5Wpj9(nqG zZYq%{pGCJ+R9ohcX8YnW{u|$z*-x3jy&Ru<8ECgFEUF~48XzTObG~Z+8oCbCS4FUe z8sjhPi>tw*JC8p3T`ouWMD`6@{=lprsruIur$dVt=!{o2cU=MV01JQQr}&>RfnM^* z>q-}wR!o1evh{VxD*NTSEILA%ibzRAb#4mrFf>*uD@doUi zW;;ef!5{#P0Ban($p+@_2Y{3x%zOs30!d+(pF%`m>I1*GAt9^Z`_)uc!601yyD1L` z2gj$^>%w3T7=*>T(IC1XD%GR8P~V zJ7kv!1ga)vZGmA!61d1lCt6oU>YU8hF1Z2zHAz0C+uI9rT`N`V zcRGD_J!-kC7h0rR4Z_8HA(Uc6STT~QNq4C~4eLq{ydgb^;{gAIhPWV3{1~7pDd3ue zV@T^M!NQ3YlqMng+gAaQZEq9*%fd>1OBhmDRpJ8z2HuP)cxOsLNvGL+VX^6~aFRpR z^w#)pdKEMaEP{fuKh~>4fQZ?e`}pGfYS)>3BEN+|RldX7;o^+_ay7gIyr#hkI7k}J zwO>ur{FTQ_0G70%;7V=@k$m^kRy53SY}E)f32?aw*C;6uq8p8%Y6y+6U~wx7V0WgI zy+C()(CB3O1=r@$>UlZ@<&zb)@PPsy9Z;?fDCcYb2M!92$QB}-uVk%?L`SOv=67_D z{(@d(g1qI%y{S|HYaWZDL+N@cki)L-J&Jw*-Kh{s*k%XLc|%0yehRAB;q)%0F@5!o zz_CKkKg(>OgQe;8JBNyDQ}Nd&ubUe(jq2KCimKO#_!P1A$8jss;yUKGyxhC1qu&AIM}Rs?oPnZ14S=Z|hH zRblCGjDDFW1Y(2+tUR`A2RWC-i^qlRIniMo>SK)d^l)T2L6QdUo{hzpy`nZ^@7_Iu z&?K`FB76S2t5`v`bW&)1$^i;5;W~;@2KeO(Sp$HC>D}h^0IUV-Z5DXf^yU@RK82|N zcj_QNBso@gW54V`oh2VrmT>B01u%$C0PNai?!HG8EGAJwZY@j$(&<@_u2)-9H61o-j74lErVY~Tck zkXFPJ)4iWasU*E<0|EjDJfVQ}CB^HhwDfJyqbP2JRvG~E+|b9(S@GLr$`vCIEljcx z9!S6-8r;gtO7)nQKw_FW@z(Ew4u*3v+osN zwB2f{g`inXa-oM(PxhN3JKD3e18)VeRlnCK*3(Sb7h+v!F?R82myJn6;)488 zKi_-!^?L@bM5A9d9x5qag9$u(FfA*-)QN{+YrKDLacye$1mNNZq$%wNq?Lb` zS@!WI zl7{o0(OPcv*Q@tN(U9z==iUvW#@%rp*tWUO?z!TeSYG?N_EB4R zd?TYgF#7`l$Hn8cVicDp4PYS4tc);<`M?R(?_g;U;ZLGvbq_jS@w99k@CIyk{te88 zK0dL*XL?QsC*{hBh3omL@PsSoy zalHa#9mA#LGqyTk zI%d4ND0z-2uZ#sHFj2`6)7ldiwcEOJ;BYW`fZf-DU73Jh4(GWT76xP(n&$1{nwnw2 zFXfc`s@2NMih9wk190;b5tfgWv_$(Cw22FzXy6yNLNem6s9l#O#;nw4U9>a}+-To!L| zdLf{D5VC{qx$({d2h4hbrklFcHFEHtBny{W#Dp(8?DPmKqfpPEKNo<2I0OA9uw5!$ zC#V6%%`bmRnSlsC1Iz0+8(Ta$B5n3RteXSas55>nsufL}Tu}f6f&pB^%7@~mn$9WZ z!Sp!}48h{dG6OSaUr(8vB`NdIYB*jXA;H2T#nab<=&Y=0RqF zgjy zSu}o`d!4SfRsQxR{8^}n3j~Sq!ZsXEcRq?vofQG((iDkEB|Cw}i{2)188veG#tOzb448 zn~)^2DYNV}F-$!IGI#e=5PK%>-&2mcMM|KS!gEcnMcIDCbqFRTCc44durysR_@HSa zQpT(0{B-)+K-txVEFO@WK&WS6;cRXC@=VRPiCD16s0&g1dV~)a1}eXDLBzWDkcG3x zm6yNNsbbPvE8iAx4d$T2DxM3VOa|BM`^ZaYCyTK#Bh*A8%C>&lzA`Mgg4m|%dW}R? z{yk{UhZ}v|)FCTBp0%i}lg=IzKj1RK*TS zK^0KS4+(ix#6xIi!XenYO9^Mc9^Kaq;)eXcY@hq08RCeS&N&9W^yiJYbM1ybWi~?yTvvU~v70Dc9w5^Yep) zv)JL@ci_QM>Uj8^Odv@F@hVpHf57{kwYNupt~l;R|NP;?0LRSKd6MPrZ}yVgv7 zMyHt)V723uRZb^+1zb>lyn|!Y=ate%f6PyQ=XpkU_NK+b&;KNn&rSXXIkL?w?v|I8 z#elq+gf7>HI4vyysWUBL6!|AlI@HEvF+$*IrmCjhkgJ;a7h>m==~~b9k1091oq)r6 zLdoFF_*GoN2P9#S#Vj`eOeOCjvX{A))hQOG>D)Y}`>zfr48u z2=wd&ke))ElzCPU*QBTrF|EmeoKk9F`)Lz55VkR9$L%scF(fb`ZLdCDKrdCb!stJ{ zAL484VABQxPJz|GZK(FZR$iX?hx6KOn`CYD@GwQfDbt6K*XaKhabOS)4LG=~Zn7)PpC}VUnt@7AB z0R;BxzZh-`jCMt_eT0mM=ZDJ%%bh#8UB!h~;IHRDwz}?$!y5PUFa0pzdyNuf7&ka$ z;RUn(R#r)|8xSju0LK=m=W8vN&gc1dWrj8u5|JDK= zQ|TpO-sr`(X@5IuIhwIO+DD%U$tMbIHIu)92Muz?ceOSe0zUU4-wm<~dbn;j#QCM7 zg6fUp=f}lBxga=>{1Xy9L#g?Lhllw9tP%rY0$EUl-?MPx)-v)P>7%~DJ5x~kqV~_T zn08wfhiw}UC-Pe8jeCJ0-`eaI-5B`xN|3Sos}*|f=;vciF>KQh45b062c$=2Y%C>l zRSk*~gn5>L2XmCUm<0s1h^;gbz|RsfNPOb?9Oy9VG{)jDC1_`BK76O1N0Qx6BYvS|2#3 zv`tqvHk8pp`IPK(`l{ylgPnsqZ*d^SuHF5&8cPUsiatjR5c$Cx(4+dtuc3g}!;|jI z_^l^pMpp^&)6eCae#gzb==_T`5W2v8VjPf1^KdQyBjzX7<0bZ_SR2@x6|hv7M!&Jc zAPb_sAnGgl#20<~70-Pe`p3>JMIIEN2b{!WkC#1zM5edP1&~004=Cc_!&;j3GmD|Hhz>EG1 zPy=%M9xsG?QXiN!i_L6V}*e;7evOqu{399EwM$8ptJ z%TB56eeb;yHFBcBiu1Ee&^;wiMxqYA-<8W*iEe*q&Tq4{wgDIO_fJV5c5$EzXqvdO z2^H{yfZrec^%XSQ)qi8(-Iz{+ExgdDgHu1#Bo9#FyEa~RdNy#b1H;4qZJ$97^-#X& zjEh*sWo=v<-dy<$>Tv~s+W)>!hbjOU zw^g_E(*vO3?%ccgdGA8&R)~Lxot>R)4N7h(^rbUHN0}9blBKZ%uAK!>Ij22|Y83YI zVEr^hLx~6ow!_UU?JP;Evbb%3--iG;m_c~h(zmg2cDz1=-NbPGy}N+h8}lE{Z}W|f zxa(b!D>YcaYd*{h$|-DL+0J6$m$bB*XLqz$Tc13?jU8eLbHgo2cd48q?uC_ z*cO%r60g40dxhxqR==?*Bw)AoZtglok<(DskU+-eOLp`}q_mx7J@eoB1br}MDRGa= z*K2-N)DkgM96co;N?LCuC6R*;@JG;73f$5{3Wq!5fhj95-vots>%NWq|6=1a5J3BMf3Q*N2+w2qG=UlKb z=H})iQeX)8jeC`UiZ6krL^zii-=E<=2s%J7dV1!3;KWJ+`dR3jdl*DA6Rn1tDQffT zfy3oz-8oK*ckKsAPz|UMfc}gJGoFZ@Y&JmyR2(R&z&NLk)Z3LA(r@O)B*A2~P2GEw zlv8nV6lIo_WPlE%QVUARJ;iqW{dQN!!gbp-a&jVFrrd(yX@7{NOm?(^VjdhUPGi~* zDhxoGQVHAt1M>uMKx;|2S5iW zWToe7eoykxk^;yOC%hvMzU}{_wV-F>{mP2@)2G4cHRkP22q4(H0N_IxpnvRILvQo| zd;mZ%3`ho)jE>rOL`6d&O9_9yUKzXLx$$~H;ChVFRmw$7%qy>E$WMCq#=KLQ9zNB8 zI1IV+VUG>{9Udmc(D$$^Qe>C8U<@;!U&GSF?)JK{n0FIFGf(wN1*cCQ0tIzGQ?;6J zvb&^+b+m_2u+^m_Aq#oT_e>dXs!;1TKKTS=Lsay*!Jx(sa4e)Uq*oaj!u6=Iiwj8HH_{;p z*vS;9D@A%#1D!%$#oRr%BQuebGX8aqmT9@>j+599MdEgQ6IW;%8-m_g|b>CfYYu)BW z4mI0ZBD+W!%FWWV&3|+>FpA~xhFU%jPifBD=J)r#@O4yo+?=j1oi#4dC;jfv7(5}+ z4io1z9v3N$*s#oPfZJSi%N^Ub_vbCGdq%X@*=^87Oh6FtzW4sCW?9@qR@P`iub)wT zb}oYc^=jo6wVc3$A66OzZzKkJ?<+PgYOiGk-N-WIb)Il_-(8|7K6ri$WDmW)=EN68 z4`yVQmC0d70TGP=-+1qZ)Qk)&fS(1Z8Y&@M9M0I@2&T-rg@s}u4a;n%pFe)gGN$8A z2WJ&lRc+SX1||GYgVY(Bpoh1!y8?Jjrm2)U{DC3`WE)T9*Bas12j0y<9~B5jq2mlA zMAFmKGq<>irSxD6ERTMpfqBHni@lT3WRO(SD-z=C>pObZ&-plv_5lha$LSot08?e)c$uyB{q zu%2FZv5aRPwph5~-5SpwYmK`254xz+?nDm2p>*1x#`5E9nB4xjvOAjV;y0yRw{ z758sT2<)I!hKERz!W9FT&+EFW3pR0xZUm&g7D~lKJ5C^qDb??@(4(Z->G#1LVK3gn*zP`2QB##5fS}4DF*-EyR(iNMAUps*%@8jL{LO*C*-QGe`QnC0@Dg<;Kkt4-|{@# zof%Qnxea+QMAAS=-y{y_$bnYoS5i`fY=<5C@X2uTiFDy||NJcS1FH#Tpi@G)YGolN z3om|hfD~eORv$Yg3XYDY={iZ~$DzNuyblR;a{*C0Vr3T43wuM*nidYq#dmj-86nsJ zpPT?(FifCm`ms^l_2vSu5WLjoe;Q|C?x#iN$#xe!0Hk{18&b)W2!%_kCAqn?&I}e8 zzl6mHHe}n8v#m?MT}(N-U1k*-H4(sY+IJdNaQMl^`0Qi%AFap94i`GK2Y;&6CXA$b zcWx>!7J02bHMhvcKGYlh$)~T`J33ZdKj1m^J5e&XqV9W*-OOco-uX3K$tOUY?$}&O zaX@$f;pqcJU&=!(d4BPbV?_~tBuQbdrSQCkgrwQ^22e0W#C7*bo(iA4ZfWGQyZB)g zetwQK8#{}T6x(84j{ikO<3tZ+lJg#Kr&>WhC3)8-&*I0i(zl(HqKAfOw2ty7n{OQ& zNpFRciI!U#&s9>Ak&|~VytmLOwX_q`Jx^#`IXHG(nvsbU+G;f2m>7y~!#q}HBI6EQ zk@>S1$gauUmd#3F?edp@h|lha6SB)}OdnLwGlS7f{%&pVYqHkmg!0Pi7-;-R85^-q z+MM&y32lRh9JKQ;)6==)z=!>tuHy8RSvR~`Kd;_Ri}0DuQY`J7mm0e+#Y8BrXj`cw zB@=pY``aaLHEtprw6pCGeq>iGcNj@DdeDh3_E`&eBdM?!C-KmCbilyOOFC+(Hk!?F z`8>Kf((c6F!_^Cq%vD^3si~D){<}b(41KU$4JVSl8r$sjvH;apxfsSI(E8BeW6JS{ z_nYhN5{vV(=U0i>C#@;7%+f#rzm{q?Gu79ids%*Hv!e8KzTO=58{aI?t;%36T%?Q`2jnQ6bOe2jC>-&Y%G=5m@d8~-VHQjw*qKt0-HhyTdwKRprogC@)2h5@%g zD&DA@4)0qu0EXfOdLTjC@(w$U0p=)_!C-i3Z2p%)3-pFmu2-#6i8>>_>QZ2hTv&gQ%Q#}j*?Y7f6pvNDEGgQTzp>7?d!;~($XJ^ z*=%X%wcHib;uMTU?cr8k-!oqSVFSXrj`nW7-M>$E#q*+Eraj`vPme23R%n(!#B>;` zoxa%~N!eLG5x(W}L^S7mmrkplB`7uG-1mqrwaSB~ccz$c-zJXjYHFFTO#bVCYs!7^ z_AL2_ILGCYW|mvrdYvxq?VV}*W6qpE%tf3o?e8@F83XLuwzhA(otXAX69`~0@1^Wx z(Ftp&Va`tuv_a4!#Y$oRjh2{hq>m-KWo^SMbr{cPI$z z7?v^gM1ko(#)dRL_gRmu{O>akbE<@e_H2+!*OmU>(ESu?!}(~+f%eDV&pI)cK-oNh zh1I#&GkalQZLLMi6qZ7EXnvJXPoIgQ%j82OtLf(7PNVb52?B6uKrFib7ZZNZsIx`O z{g+D|@4P;O>&zdXctB`q=+bn%Y|6SW_wabaT*!`@#>=2FZhK<6p|{EBWn+v=+H{rp zSvRJ7Bd2Mv;6EJTadiAD<7F`4ZuR~8vgn!7MIVJA4h@h`kuA9*ZFj{@6IeK`*0Bq< zav}2FMP|u==e1&Rl%6K;AtU_R3VdRP%jL6CU_H7>OXc@qPV?7_hk_jwx z&oe)&dukJW-+x%TJX%A!d;@Bkj};3f;DQDZzA7O+gc3utw4ZrMUGockZ+yBkPn#?G zR*%~8Nf%??D;JdO!d3Hw4WolFjtX&l&e~b`yUy01vrQOO%#r)Jwdy=R25o9BHAIf34jW+(PB{Y!g=l9_|$=1h7U=7OnO3*~ai z4GorSs7nC)_f=Hi=hGZ&k2yhEt5X)sWN$jZo= z%kC^KfF{XMg$M=iH)xFBW+Bg?soDSq?zicI;cfHIB_?ez5j~!6#O-nA-gVv{WJu8+DVBEJ_!YEqzT`YR zOK$fmEbqMbN|sq__T8N2cz>w}Qja6zDqO);eR{C@S>I{k^%TyGY_%(6)ApCHyz99C zS7LxaDe&Q5^}#|HRRbgIOhIQ}LT9LVb^WChlZfQVo;}GbzwSTPqo^UNPr{&MhOCLb zpxPIG?!7-H_B<@F`rs@{v&uy0R*$JM-#F!~7!Ixvct2Z1s%dD@x(^xgyK98Bu9a!6 z%UipaS8tqFKba!jkiUH8)_q33X(9n<%lcOQSFIt)j+k%SqZ0Q9Lyc3GOLKcqKQAsz zXe-w|cX_e5yK~H4F)~t@>rkt`n6vmv*>lAqrNNKX>oS;+ZEMjawCES9BM~A0^;e$K zHm$k<5iVB50*@v1g~u%U-&xAKx00trk}ZO@Tg31WDfP9U$J`PUVK5?L=kFgA$&gF* zt~h<-2ehrNt^GfLUe+EXxA;0b_N4}12{bvMKjUIYZfu%(@0(PB_zar=NFcv$v?bx?EyDcGj=h+oCT2CGeepVBRgR_OL&bjf0^l35(Zb?(=RVr@G(|2f>T~x_|a9u=(LGTBcn}w^4O~`}4fj`u=6hx;1(t(xjHKX)&LL7=h66_p{AK z%%TYKoYRPV9J?E7goT;T8J#W|H4m>L@F8 zhtUgHVf=qTxqm%CuZXFkp`F-u!2mMQwsO^-@WSMmBCu`)&V+!gdh=rKZYI|Z%)I#t ziPmU=PB@5)e#0(n9jo030pF~i9Iy+Gz;xi~Ld}nIn zpt`tvvKb`V+}}?I{DbXG0Oc$|W2l0TVQZaOVG^`Gsl$jetWhYSZQNJo)-AVVwR}rV z`evb`2hQhladGv)v+zJAW`Exqn}x$TkmiHBb5E%8?U=bp=j{!LsB1nL;s=iHbEzkf zCVJd%Vc1S=`?Gh;?wk+|)O$`R87d!Z-2!D9=!<*vIp~0y`igSCcQK@{<>wN& zT$8_1i`}303$((U_|P{M5F%i60f*MZfs~}S@)F0lwF=8s)g_Huf>V>{vzF&(j(f;9 zqgT^DQ_&WigF7!UKO_B&v{#s8{mF#9cFBl_nxzv9?)Mc(3w__wZvh206uZ6&`@eQ(NXuOneQ+4KVRIo`iG_jD zhzcKWf!vUP{%S|&ZI}qeM=j6k`JiCg+Th6J)-@0%yKXjI+5(72yWu|e1ICWQv=6x< zIf>NpeG{|*^cL{RgU>ApkisyxVyj{8517InIF^{qw{41Qu@z{3L)FC$(S;+7-dawQ71zHd5C)W=HHBsbbtJo_$aP?!XX z_T{h$O$E2=CFTe_zlY`5XNReCrPh2I`kURy=> zaoWu4S-jM@oh(beLM$~z7T!k2jr*?Z)mHp%1xNLlv{@Q|UFI`wg+kAd>(1*cPWRFF z61PJCpL?a>^RhMQ;DT&^xSYk!p?Z!8Dh2#&xWOwT?NI9P=&R6q6%znG|Gz;EX1%?` zSNP0=HShQtVvw6L6K-g~leh-`5$(4cxpdy4RV8-Cu%oZ&v{f9#aa~hilVCl4-PeIh zSq;M%OT-q481{P2osK=Ga=r$SMzNUr{Fxu&BOaIYBxdI4elCWSQKOUl!07+lr4ViT zU5x0|S&Uw}r$!iEA!@?fJ{7$_u!cb9MiOj1o^s?R(e`Q8{z|4IkJ0ACO7PK8cgpbCMM>VzbD+^ty%FwN$TuqGg!wjPWsG9A7O^J2$ZHr z8AopOhD60`WK?(GoHs(S73gT#_9g^Tc1x*plyLjYdPd<-`;#RXP!=!s&YSWPG;yb{ z9(hpaEJQDhsq|^=mHe7g))5WE9qQMk7GZopS9=?Wjqd)%s3YuivyE=Z8LCrhPr9leB$@2iJ5s~G0WF4R^{Jb&vt&DiTm(iU!;s!ekhd!z8hu8{mv8EHTF)yznW-Y!-nN>Y%GImF|b z*ULB(;o?xFE_+(#aa>Va?|WP^(e~{zf_H|0$uD>Kpt_99@Cn=1@HY6f_=A=IcEJvE zOt*M!vE($7f+T1_K_^Ih?Hf!^dE+1T#tIz~hATf7{W$99f>3X_$%P@l=;F-k;ia6N zh51a;*-4b}$CEsiY`rt>&wCe|_<)Sk_ZAmq9 z8^1nn^@UG$q_HGiJ<{k~jY29-@fJl~tIA*OxLG<`jJ*HUChV}Vy`kt6lGiO>+6zhB z=0m36i@dg>7AP%@;VfzIxoI(BgjhzQjS?3T_6z)oE+vWGzA@#J-iSaA|rou9KCZ(qV_Q>jr=6HvU_DIcu&fcCUGox)8sN1fusmwEk} z=r5|i0af3WkQ0mcrE?qIzQ<1Re}y&TSAN^Peq@f$7c*+f>Tp%`;NEaw;D~>;*XV@| z-wXT_+Yu?%!|EM*_^om%^K3Y`%8j)%_9tcF z#@BQ=CgQER)T;OYnbFedm(El{W@}j^=JuEgb8SjX`uT``?x(UM%zto31-L&~y+#*n` zP-BR6_6TJH*nBcigGO)x}`b}=zvMOCAJ)kDJ&BQ%ZV zli#@=V!4+038`YkUy|ydJ&0tr>vDX4z3FD+SRXvwU*nWvTA3;T)&krf*o`+gNVD#0 z_Eq6PKD}xYC%sqPuEM~@RTE1}cvQ}ykv(O(muBT)^uQ?NxmS+5>qwjDgw)Q#(;`-< zv*a8JhvhDcp~uxLC1mO<77XQD$O+GQb6rKtKiw?@J?Vp<@s-7_-?=a*h|E72&6pM! zWQqB!VcW@)M-)WER^|rjzj`fEN7b>hXYwU7C{)6p{hh#F8%=I)Vvk*!d-~?}wi{}D z#(CjUIlr_Ih%DGNvO5N)OwxKqsx)xgS9*f*dh}z1@!Yyvd^?q&Afj-%L&l9FJ6@3> zP^hX_imsasT(FxC3vG46T9b?; zGNNFbYsW#(R^(XOT1M>t>i(b!+XIyv3fA^#1({KWNcLY9IeN;%$gZdOtS<4{65qL8 zJmCvMV-#|!g77^aouCe4#g0%fEm;{Z)BzcYXVn!Ha71UQKeLZ$y!q-_$wY&_N2;cu zH)PlZK4^8cF$DH|#kQ}zI(&^!pLH~{uk(h?s%Ibfv_PnNi}xnDh)jy2S*m8=tw;e) zS;87BT~@J5i7>D3YlRR0@-D*KMgY-*lIiTZsr+^8UWkYN%es=(KFY4fwQnjqEDQ*h zFr~uw(Sk%9gx3m&Qw6cIC&Yjl8E)h7hwF;+la>&+5Z34~Q!0vk#-KLlRBI5gnwTDV z|DI0Rz1O1y+)6KoGaf%8R!hQDs@bJqixu0w#JFntC4V&;b+;fk);CVX?-7KykMo&F zII`$SP@pe zg82UJ6Eaww>!ed^=zDPy*-e)-)LjGx9Hg5f`8r2V4&VhHi#d%>V?<`yk9p&?1+#ed{(8I;R-{SN3qoZ2=|*shwA2-@X%mHLjip*5i?#haTYT}yYSjC6sY~J*5a#iDNz!Fv z9Q5JGAMoCUA}7czN*f#3dRq1K4`1g%6gxw)hIr^NO6e-Do{AVN)=F5jAbx?PdNHff zS@L`7GKae~ghPCXVMZ^lo_6k*Vptgs3HXNJvQjDNFYhb)buVO|{-~kguC7kV%8Y(r z9frwp%aOwwtaj8IFIee$$-ss9o}{6|Kv?dQkDNg1r=j?E^kx>+ks%({hsCK@J3YQD ztMeQ&0cxJPGu05iS`y6lW`v#>(*`v6J}qfSxLCZC&bNrr(NGZH){9)Fjv^&oah=ys zi^&;PcbzvI>AsmF_Kgg2*gUDPPB9pp^AF*6ugqC5e3k}eMffYC5D4E&MeS{gT!bPv z+eVQubRIwLz^*OzDqvde;?jmCHX;%JPY!pPxk4mnoBuw$Ej1+~z9K zqcTJBx8vlzVeyxBA2}VgjQt@&@x5K9&0*{gIUzs}Lz4%T2~QzHjhyD9>I&Nzl57yD zMHP3vmJLcsQ&#i_k0LiR1t%aV$p17Ex!KXniR`< z2qJM;XJekkNOOAssvQdgWhY1(qD32G^x%AtJj8O$z&P@n)1zk%*bmxm9NCc=g2zTf z7+sR0G50YsDnYt($EE6J-d@KdH6O!bfX=bgVW9%t2^Zw{J;HU&OG&~H3>t>pRR>A$ z@a$Ms>z;2cFCTVkyw)p16vCvzZ{<_LPOGC2I*0oZ*?J;jA3t6F9M44{Rc3X^q|smY zJRaGz9}#Q(L8ZW*GUG`3(sr(78Y7o>#t3iDl%c^(ud0Ro@G6~xBg37SgoOO@IeefR z`>=87Bh9o3hfu53w-;%!>yF+9tn@636}&{K>>nD>gi*p;b3g5c?^bHeZ7=8pqKy{f zTDmvVc=5iyZu$hWx|;C4bkNAc!1qEV_wT`eI%lc8LY0r7p~ zX>t2?u9HSMU5}yz(24H@jy+V|C>njwUYP@+);BO=!D5RRRNVw}Se;u9QUB*T1BA?g z6#LOb-Lzm06&al@z=c+D#9MVmjaAf?wgUjnT*btEkS_APQCArEEDZc1NdF5F0bx@s z<0EAi!S@kk{l~f>fw8|ul7XuS<>tmO|7=IeHa(vENcmtDWga-!v3m}MB)NQm#?ZpJ+@nreTd%&dICJVSkWvL8f zt0n%^STCjf#G%x;BC6O!sag5&@>4~qc}m8{Qs0Vx!V!+n>!lr7T&6PjRN;zl(oT^> z85eOwe&ApKtIganEjgSoRf!!r?C@)C51WcmAeTJhRK&AV z)1aVsS?u%;lVm_n*p(|Gd6Sg8)4wBC=9?PVI4B9ZxJuf?rL#`-CDgNpEdWbb;U7Zm zuY8iTePCZ~8=DiOKI~o>rV&*T4yV?zeN3=4lUu?M3G9)ykda?Rl;I_yi_Qtc?rf^ ziCl>F8%0v;*+!b#$YM7_y$20-Do7mH;?#rOBs@1tYQj>_>z$1u2K+?|H9H;YQCsO` zHWJ8e6oixGJ{5+73Q-0mtB(mn^W}y|k!@RreR1lMp}~WV#gB>HfaT^set|&2S(9;fI{ZAz{H@x32*W}E5mrp|eHJ36-W(Q*1wza{yaTIVn>clF9WO2nM1hH1i^v^!zf zx#gGKkE-;o!{XH|RzLTqUL|yiKWV+07<(1;h1k!T zIjoIEhu~S6AkH>0F(J|tmG7q24R>Nhy$k*c2^fuKyG@7!Bs!!-!^!`Y$+(Y9k(+Tq zpqw(U=5pQ2h!gRb<4ao`FKXU?ZaXF;!Y_2gP)~Sa(ESs`m$4k!N6SC=Z~lCg&hv>z zENCkEw$PBIe~Q??=t+Y(x+uMz-HkRu`vb41C++xSBVKvjKs^`$^=U7y{^6Ov#(gMc zOK<*Rw@LFhr43BO_(s$HtjeLhpp46yYC+8>UvH;`(r0>PzRwvw@r4C%m{E2*rL$3+ z!D%7Fcq*KhF7cDd;Vak1v)m_Lgeqz()eUFWi6BW)>iTmBF?@E?=-b(W zB!Fzq0CA?PXgcA9&1#l4A|PDF>-R|MJ~)$7SNO4?`vT6Py)9fqenCCNlpA$XyA$Mp z=@VABhWN85kP}<_oXFwR7(WPVTp{}U@|*yTU#j;DM=w{i%GC94AcrM5JCYKIH5njd ztj2DrY{%Y&_W@BK#?*~RvWCNM^K+V0#TaGw5LsxhERw(T(OF*3^wB;N<9FYFy8Qdk z@5{Bjr9pNl!#LIz3j|tTTOwiygR6g6>Lh|~ZxOKF*0&>!u`=+`Cy>HPU@1KBw>$AZ z|BL&HhE|%J>i#ojT)Ck)WbZ@^gJfE-zH8O({wKs$Ofg3GR`3q9LI2((WkGq|p|s0^ zGOch&IXDSuQApEQ@QG2;0a4ea$p0QJlK$?lMC_(q>!WbGm_NRsz8NX!KTRM6S3%b)h(l6RFKuZ zgidc#E>@wRQQjq3P|0!?OMb~xMHUfzEx{6*EpC_>u9>BjOxb*MK;opMaq{s(NI)$1 ztbg$CWft#YQa}P9Bv8--Lzq&;s3Ui%0H}e`cqSkClxznr0)%<5CQ*o7<&~n; zqo@yX*0!Ygi+!Vo;10n9V#TT*6Y^VQ@mG+}ru$%n0d#2g#P~H6AeL>P}M@|9Qq#{~3l5G?qN7kxc5prQL7NlVN z>*`r=p1jd0WfLJaC8jgKKg=CK22}5jdQ+Oi;a~J4&yu3AL>H!H z%EN`P(T0k$)=I2|sk>P4fTQGM(I-eKxw|@nwBK7rxHH7M+A;`6f9Vkn{K9?&*{GDyL76IzC1%zwpT*$YEZPdOP>$&C2bZ=r3HFNo*M(abzbOp1c|1QXbp; zPVNVD21u^K%&DOd7I=!d={pp%9PRl6`En@!`pc0*-p>zG+Qvs})T^`ciqwfflH}{e z-d|ZkY;sA4tQ@&Z`l(H3%A1|#OVi(mrWXbs=`X8y)?)QHw|FM(Pov-9Oo_|H#IA{XuQD^fV&=hl+r39J3;l=ZJXnJZS02Sp`~bxT`F=QZVhWN8VF1eu?Z~GtK_}bBWlTrqfGXkTTk=o(Y-sk}8X>6KwH?rgwv^Y`Kb6_7xTJz&oea*3z4R?~E7Q*A+^6+RKqg!jztMVILD7q(6R~ZdF;G z5Tl7JbD7xb0`5m;re@5$d1^=TqKSvB*Q6O!nXNU{M{E8`2uPQ7DBay%BA_7M-O}A>a=-6$p8K5Z+SlIv zv0=q;&N0Uv-|rZoyuy{g7z;d3w&>YX=%e3)$UGxOWhf!_tgM`oYJ;7oi!6w zZyXL$e}?qdu(VfFvRv*#kkKwLER97M#cmr^65S(AUg1^0adB~h!=>4MQuRR-0D8Bt zMGEN62O>(eN=|DlnTiZBLVeH9h6iK?_xkq$C8Llj6frug38{U@Kq+)_|vZ5TM<_#RU*s z4Lm%EpO%n~jkuW^1F)L>&8jZa81E=FC=88m?o{b^P8 zt`cM{+fAFAnJQHyoMh$y1VdwvEv!E-Ma(U^Q+-U`WqbQlRMi{1dyNWCgom_y{e$7a z*UEwCtBHvH@WK7v<^@=AD%6mAoKU(*K~BD)nH^W zQ|GM88>JCeK)P_A?PN(+Vb6ln1N|1H2aD%F*c|kCo8)^^Ln@W{rJgGKDOivXWuVTj z=L)jH+lJTSG8+~_8HDRhE+of@;VN4ty3m&0xHo1xjG$D#&P4y&3`8PhOTCF6!?OFP zpbkT-bB77`+s3HWQlZ{Wi#!W;pNI{69(4IJ5JlK|6fFH7M@L83$%X(z>03&Q7$>nf zu=oKB19+@J(W)ekke~|e=;=Y?aH*Y1SUdO-9kIL)Nti6*Zb0HK4jRdFBVfz+xiSA;AhAYMUrJ2*K zRSh3-a9Bu5u7=6Jr6i4@g47=;*a`aYl{JA`mEEk)PbB1?Z`$9aUt3G|FCEgze%wI&e*S*|oW-`}<5L2BQ0Hm3kNsgPo&eTgN?- z_W)NT#)un0k5o3@K#DhJAaFOX>vb;q2PCLQr#H6N&2Ds&8RUJ!kL%*ksq|+s>$Jzi zPrs`^7dO0G!D}{{!TcR1zk+4kPP)&8G5z@;X~x1eBxN^X#2Mq0uBY9YHL75}&l`91I)8LcjFi8x`Ta?1pO06KV-0}ElN)>p-h32AF zsM)ZVNf<7(X>t7|3Krbu8jI?hQkm8c15NbsPf*ZDdeapO$ZjJj8Ala+w4Q)ky_G^&2W5vh}a8#o(tUN1A znh||P=Bp|!-MQ=ZoOt`_^Bk^w_eN)88sZ+KgdMqW{-pQ+T2yFx%-G-7ob^MSDi!%O zh5Jv~3n6??3s=_s8?tSa?Hhl1L^1Q}3Rhks`@@KB%_bs>rbkm!9>*7vG{+hI<=rO- zm^_g~Fi<4s#7ksBdj$_4db!y0(tC@Zl@G_?VtZR>Hf(Z}4{BT7A96VB??f~9{2Q{m zYyI~^wl7!SBY*BmJ8pw5kld4 z=5`b_02p6|J+t}#QmK9l3%dOc2ml4-kOL%nlNFbF$4W}OSDNd1R(GHZ4eN&f9els2 zQvIYt6_BFMKIu1(aWX(QvQ?3W;Qy&kSM9CJa%7=}SlX&sKsNqO4JSM!Qys=>IpH*o zA-A#&dZr`@Tn@0IPkN?8Hw``}qWw?;w7I%L;ffNAk0%`;zJQG8DN3C0PCO67750nj zU;CDp_8tK5fa4?%@plc@dF{<&M+Y2e9vPXOOuYL#XQT;vaxX3{q@%-hbaaS_iDlmU zI&J-?BE>YCC{kmU#{-$I$gXsn%1P5NH0j+&(Q2TzBYz=g^sU)y)uX8( z)a~n^hcTDv)S|2KeR-b)ya^zoL6oAj)ik%W=u*?r^_Qac&m{}5$f-y3^>rrgG4mm( z${k95RvYA{2~+nMr_?tbKI!$<<{ZQ1>RELFRI1!?t&!>)@4U9R&_M|+RWfGXdQKc} zXEI-;_l7Z71UljR#G!s}&*8xw=fAL!;k{<6njUt_QFG`^lmceXZVA!Y3`d#sS16!d zIP)6_QPLn|d-*8!LE+}*R}JrNr_Cx}5sKlOuuP_xjk!+np~ zdF-}_HWcmrW7`O*q-CI?z1E|G{#q#i4r;-}y+FkPaxAEZhs$}t6t04Ox#t5FalQ63 z73eR%3TU8InHoCf^~dLaph@R@Tbod$>6duitv{KPz-|;A5;CUn*PJsfG7=Naq5{b$ zXom+bQ--8g9`74YQifV`qG&fBJt#yrauo|59bh@Z`GOz?bzjU^h0U(H@z0SEst;(DSu8nai##m;`X97pIVqn1 zMYrmrp~_9Lj#iO*y7z#`JW}&MBbcf^@&SEui|A$^{O48XIi)f3k!3vx4F zSk4tDGgzAKqT6JH@oGQApHX5*X-V6$63IFC$R&pc<+ezUF96%=RlX> z_W|hLAAccLd1!&bjIQ4QcmZ^7V}d^F!Vws)Y%p;H6TzSzl=09I;$$WY#5GW6=29F? zde*z3QUMfJLrr`q!7_ZHVKGBxV%jzQgEVdpA%%Af;o@!H$w2zi3jjL6!Rr!m0WK+| zMdLcyG=$e*gncm53%+fbm@3y|g#Hq$5C8+Vv{PZ;7;p@L7445l&DP-wpg`;G@K5JH z7?Nypi!b)XMwb4vV$aj)^{i9CW%t9$sR%Xd!Qo+lM~BGCQc5Dx=;7X;tWV;FY#Z>N zJ&oH)2nF}pNK`ItN-jic#P$PYjr3#{yg*0eQh2I{UtGz8{j|#!1m+dge_WJ)J5k*}}VEBW#-i&)^gx z&Rz*Ygp##F35KF~_dlt}ctJ_s_+)c1C;CbIIB-p83AZLqepda>4uY=%bm!L8FwOO( z_M}+xwnb}bSgB%d)e#V|hN-oF?-D|Ed5f3+Pt_WKX^Da91GqL~L4UR32j6z(%gAG! zH{WvT9=h*O4Q?g!Qw`*QOt$4tX;QPUdjwPB8Yk_c3tR>Or&k3ky zyT8INs5ThSnpo$X`|9+zTo2~vo;wb=GTbG|-!P(S%+K=SP|VDLsCugGHF)HUUQZ>* zu+uJ3j?cCTb!qu2YjrvC8f|v7S4@z(T8atltse9jj#X7&bG#2nCs9?OeYJP$Nz9wctC%4EgQBe<3ZRP&_EL|XHxPk3 zssZ>6jN-sDq5{23sb=PcZ0ruQhVLFsv4#Jw_?f8pfhJt8Qgv8!urnuGK;9&K&jb{q zdrz9p`+|wFxL(VT{q=DbnHvw@*vOrsa)E?0pI8RuElZ1jLGUZvlV*t)Dps6REB|PE zq9S6ygd^hjzBHIK>M#3MYk4t{P2JxLi*fXb-DhK-9o{PuqNB;^Gi>J{wHd;Bb-x#FE>$fyj{^!2J4GG#T z8Oo`+^DcviHIm;ZJllV|E_-R(Q`Fy_Tn7E@0vH$|63kWY_b3V!u7LZ(K(=toMs^>@ zkI6U(Prq?RK&+6yX=$+x&}gl*$$#c}^7pOf+4#}IZLUc6WWP?H+*3s-2|-C{(XsL; zXKJ3zc@c-bkAbKOGa(umygpa@9@9}xD~~jJ6m}yE z#55ZYzq}3>r&+vw8 znfpJU3VZObgAFv**{Oa6%VJ3AG{2A#v zt5*)t7vmdW!L);9|y-2MRK*TTNL^}aO;RGE8q|s0w*l_+3c6E_` zy6@?FDpwnaH3M0QH!&qBr5Y5zdPlLIgnzI&mu!TdoEG?wf40L7f?tmWrcS_%uKaaMyD zHbgfWA1=;o6ruMY$LVf);;z1y^|P zFy2S=es^bY_bUh2m7H#h`^iZYVl=Ta(DP#`Suhd{Zq>|s#xwIqhvJDDPmXVrgZP(k z{J=$MD5no*yt{rC@r({**JlB&RC~{4aSP3nwl|$!>Gn72L3tKly7&XsQ@p*R8}N^=p?j4#sDcn$H{nR1{=0#?p0 zJt+Hz#S9Egr<66Qu+-YMxf_rEA(u&oWLloN#@@*W>R{{M;ZELXSpeDqH|Ww|QN@G7mPVYH(_$Jagx$%(?_0 z8(4L_{C^i30;8oD_~@2qF~eG*B*?p=0XbU=>Y!Gg2YK{F>E9h zNpRY$3^Q0dnU9J(Wt3nceR`D8QY{ew!fP1`bwmIHRq! z6wpH~se#?FsGb;nGVRJS5CB?cR+*~{py5FB1tuAvTDcj=QZI1e-v92}`?%~Ph#dVd z-i+V2v?A;NHa+OpLqHFFD&Uv|D(O8Les@=~+>?zq*Kox}unhQedj5e*=o#6%Y9{!v zdZw7BQZm}`SXCvsRz3C5;6l|gUXfz1q3K;AfKil~@4qWcCATG}5H{ z*~$gD2N`73i`hcpViz5&8Ed?Ufh8Pd%CK+HpMy}Derk>RbC4V8COoT6{b;6a{(Bb% z;xn)W^1&lnAm3kcgB)q1x62_-W~mZNMMm;_C^KFlZ#acQ*(j?I^~b?OC9sZ)fCO%? zpmQwUY(4k#r)WmRwCOUGZ6ZK+fH=j3=ysTa54%ooHL-~Xk67t+-NuD z&2q^gs~qeVi%^}J)u4kF4CE4`xhynX8)vs^*g|TSEDeCHu?boMhH{*t^NrHLuJKFL zsq$yOcVqjUOcf(1cOgDn`IB9MJw0keKRdBC4IB@eBWA!#v0+jBON>cX=$4eCyX+d)mf{VGiCPFuQmxFa6gCsVFqKF8b*!m)BxEi%` zHz3puOcjlD*%#m_(@b*0%X7q4iyn9vSuMj!z4f9(ip)%X&zWfcBLzE}V=i|MPVC1p z0xDc&yl=d{vE?xNE0dHY1oYw8jRF2?$9$Lz4m8U=q2A0k#gba8V2YPiu@fEadCWJP z)0425z=z}R0Sr683r1aQA9}uz+&rg(AfZhRLQjl9k>7he%@Bf?1iX~Ikm^?8GcNcf zq^UHM97Ko)hmDpdPA$O}{tsBUE1@zIZFj%?FFK){TOQh|;9hdyCH7?o1uN$M z*bEGwPrJiCRYcDiE75%;BY)fS{O#O6!Y1tx&fB3YMO!dcK%Cb7>rCco8jeh*;K@9n}a>s;*NBg2%qiOTZaCjd*dVoiB{ zj>DCdM3%4l*e}WpL7vHGgws#SoLKnbLiqdPxC7`OnyZ6LhEX8>@&J=UMDad4`o69G z=3!IH5wpp5 z`4U9QOxZq_g&R z_`kl1lP|U{xyOA~n9#joR1T%6qxI*MEhrp8BiP|V`g0CQyTmwQ;wQRRGj-P1?dP_z zx*(Q^%f~SN3d|%MZ%IQXH5qfbNgaE(|MXxg8AiVpF;eAFFJ15*T{+zrcEWA4%_?mr z1C52HHsP!zpTPJG{q8zV@A_V~BdjrqqUrj9iRTDTIsUt)ZnMX}%(P z05-yKsSQvwbruGJ=&L}=?>~9b+i?4UwKhTcIV3;xjyGrYIbYI6meq`78lMk7_*<+9 z@HMscyH#!jDsu9XM%KhEIMqoo_G)LGK3r$tbLxZje3Z7NWzp$8K0n185f|dOV5J z6M+&-C-ys7_pCW+SKq(Yc3Bt(t+JGS%^qydWfXsePiYTsyQ5b2K0i+J2)jYF%A21h z=^nooxH$UcutXsgI1tKKQ&YFHUPLN!kCEm)flg+(Bh8K&ZI8pB zJ3{L**J9t)t!(lyhL?Z7F4xyQ_HQ43MiA=!**0;=TlS^SJzbzUX?6;dVcf zG%`K@RZrlKtmW*^?x-`$2RFu^Nbm7PFS{)p6=3pU?Z>!j`}`4hkEct9%90EZ>rRh^ zAGPKj4y>0-a_M&WNF3@O(c8`^9z)fvCfB}aUa`2H-L+HUVy;z{YOHX#dm-7id+@s+ z&ikd>e#SyZxj7m;{EQgRpST(&bni~;=7a_Q#!;UY|8X^i7v7v*D~X1#3t8KZ@FRt` z)4h$`!wdr(7h7cNp&M4)=-qaQY+3JI=;w)4diYKksH6Qf*d6#E@uO|7X zY0pOM@a6_72o&85eBfiV~ij zQK>Gx@Rbd+Kl*bM+*yZ1sGPMm%MpU*%e#BF@Njpd`Hu+L2r*L6{q)I5`}?kbvIf#) zW6F2em5d`I*`UZKx>Dhyu9SA);-F6&JTB@q9M?6E&MtyA`!(kDT?H8li_j(hf!878 z(?dTyE9=3Fy2JJerLcxY$W*NRfnMAVVRsBD3IaT-pa(vf7|2NOu}uZ$WP{>GZ#N>i zQvAPPV^PUdEu50|ts8FZUcJF_6$a6PFv2T5titd4-?(aB4F{^w*zBzdf2@h%A93iu zqFeOYk07ET>&(9QJf2*+=W$tO{5VHwu&pf|9P)dGU+)$dIw*F#N=HP_7ZT-lC%m@& zFm-JAcvcUV_Iblz8wxI6x+bwG9FfpxOsh$~z^9=L{s6jM(?Fw4k)6w=Bv{-wo}KUg zDgd#`V09SKWNW!w(LS{w(oDC1;+6;rVP$s&QMdbQ2CEH~16#yukNPV**2+!lL5e|) zPzRWNz^T)HG{Ou1D6Gwr3G;9%{G3qN9|jE$4F$(z224bY+x~1sDDd6b)w1Lx5H>4Z;#%Fn0O z@e%tkvpmmD%*}PbhQ|2xbgPaG!x3xoD=*bNKc41HA!K@I?ntEjiOVcD9vAR38%~Wf z`>vf3vBlmw$)dHLD?SQK{Khie4-P--1SXQNk?01}X52nUASPv`xA)6`nh(FFxFYh< zC=(ZefWZKj=J+anBQA)Fg2zr?SJ{77*D|k{u%9D4Y_2gC;Q!nZ$C^1 zm?0HrTWD7!{XzjD?T;8zKa!H44xopGJd15mXJ5KsSTeA*d?A|%?F7>~juOhfo@L&Q z=j*3zmRRBZzl#z4MnW_gt|~j@`9nnp4CS7r8yp>}qCHj;mU>U4O2q#Op^o6)pIN4g zRpm7PM#3O;=DEb6#5z~!^Rq4oTI3rAYED56I97DLL5(sAN>~U-ek2X2;Img`&QP5v z!uIm~j8IPw4j7v;KEX|ii`rdj!&4WbuOpaP{t=i&gWFX5vn}}0$3%GW{qrme%I)6M z;>wgcy$TcoIZ{pxt8=$6HZk=IHn1@1cq4XYTku2zwy%=Lly6}nD$v*G-Vzg&RC;X? z1L3%Bi~&1bVsvB#xP!67#SK#6zxlz5ji~~Ln&h7oH6p&bsN-WC=>ErGaaleG*JX5x zkU!n5=;Pd+^m~Sykg}!&)0VZ_)FZ6NwZ}lN>K_tJZ@@*g{BiU1vd*VAv=}Mtw(xH7 zjajfeV@wXM=U^kO*b{+&f={gQ2CGK?{*Cp5E8K@;Vv@f*68hf_Z>T0m@DfHZ-H#mT zi_J$##`D*Y9yeWIo_nPFKn6C7{Tss508Q^{gA*A$Tkj~0cQjqr$ZI|1!K5YgG)+c* zm7WZ5$EZtEgUs=&_VDaa@!{x#k#1&!3W7==)AfpwdX7M$cLQjVPcMmD;~AiPUy!E4 zC++%lTufQF6GYvgdAgnFE_JdFwR~eXKJEbd%1QOOp9$sZ?7%MKotyrD*3JJ7Pzmbd zgmVM~A$%q6i)MS(d zaG)2@(&nyjF#p#c-{8OAnxv;%o_08+@Fp;=fS1*<7Hb35j~2Q>DFI6RD=$$j@&DhA z1|((HCsXEYL(3-}l{#Mn``lS;kW`X>>NBC6+-Q0k+)6E=3U7HQ=u-@MhmJe4UVAB= z&Umb(BQ~U8Wrp)U3w@^CG)x-!T9`^hbxKIoESvpgX{QjZgeI4>Diop@U!ianlc1ikP%EB|Ms&wf8!ANUP;sy zV?OY!53IKTJv!7d)tnR(UC=1@rBh$*?!tAtDOlWAai4@$aRU5<%!TN316rFhuL zZ#XO?sc`6iJza+=kLQc@FS*mSiJvIi-WnyPZ0%>I>h>N**M(L6YQnbCT}FiM%^8{F22 zr|aU1zQa*Vgw22qhpvXF;#Q;0C3v0}4J&*tKF{*ZzI|rChhUP(; zlxM-i&+`>gQX#9@2*?f!mr!wU9XQo&dqZpi-2U}- z{6rS5FkcHw+nF!DYvy(~UFpCHsn#l+jq0bw89a6$0C3U3cY+jLX7Czcbg2Wlu>E0^ z3#k27$2X~x$D4lj_Px0z6|OEUA5(TmVHANIQfUZs$uL@c9`FN$n5ky4f-Ky>0 zV05o&O?|!oRt6#wS!PczVR`qYEK8t`)(Dqh_6jOe06f@*q8*$gt2FS=!7|6kj!*Dyg^pkm07fC{j{7HaV;-GBx6 z+#)LZN4DYR{ZAE;PU5GhlU3L>FB@4l1?!Ykbgf=M<~{psuWmk3bYHKqLHD%-$ynMW z88UrvWceWm#?}bu=Pp-gU|0SYL^&F_(-Yl_bw!Vg{GQv0nt2y>7?g(!KJH-M(V0_u zPH8P_=_pUz$#4i2JS;Jy-fkwaG|8r?{_`DD3NeX&-e>I8iuGqJ|KkN9D(JoioGhhR(W4pDSag5-pWkJDkw9&96Vhi`>R$_}jOXKEZmO@X{o`FQ2a$jlO8T zMF@@@yMNbkTldNEwpL4D6BRRMq{7q$i~M#1^KK4|J)W3*``vSg`hCtZlI)XFb1f*{ zZn;dWtSeELMTFDV;QSZ4*JjjWh;QK)9b8z^VVQ2$ZF*8hp2{) z<()0p)dZc}k(tKlTfn%Ea=G|*sr>}Gk0JkP97F|c!xy)hWRkSFz194#+058reJPjx z+waqOJl|r)Koo=XMtpbG(aLQ!XhOJ3vULAU;Swvy$${i|)Yp|9w8`bkeYdvFC^7RRBl1TOZL))x5}L$%63lU%eo5K(v?%7Z_l{NBjntGwLm z5{T6Y&9}%c-h<-6FWKsLl1x~6?4R(ZceUYwENP{wn7Lb#;*lwmls_o7yd4+vFS$09 z;Rr+~Rsr_NgjSt~y~N_9Ul{?gwi2{brif6#4SOW;kOw{ZmZdtXR0hSQqbyw32;nobP0Jts__ryzsXVt@1#wFFj&Kh<`x;&r}6-dR=Fdvz6Z*av!7 z+K!@xJ4TK24fruVJQJ7W9*>3YR+IScmw!s%O$lF9W-L^aupG{0rttvdyOlaqcK}5L zV!OwtNz2WwDAFE++fuV#&o6=nx6MYKt8TDLCf+n3gB7x>@uwva<)E1$Br2ol{?n50 z;M>xt7ebL7<_Gn*b%*;4Q~{N{%QW|t+xA&gx760qtUl$4U{VCUa;%dpDwbOHk`ua08@sKVzuI2P<>NcdZgz3w1MUYzf-qTMs0aWOU z{mN$ML>QV4EB>z2b*kgD^-X0frE9=WFZ`vuU%|-U4IShgEc>$|sb$T$xFVif9K^c; z6=YeSJGfx*AFyR%?%OaG6r**p%0C?+>+75V4kpqmX^v25Vzhn7$lUBEhyag=&4-W| ztf9*vm?`|A1y(=J?TMwz;2~R4*=_oGdD>{*CqG1>?K;2Gdn{{l8+)4P{WfQN>3Y!A&j61E_w~H>#=G0imI|CVbHjEqNuU#9LCqLq){7mF!9Aj{lB-7_C>xn zoG%dNd|P|c*_GhcVE=4N+XrXAlX7s<+O&5|i&Z{+$hL6hMjBTk1W`?`A_nj$)znyX zgr)%c_eWmf?eM;X!8WqZgKI3V_m6x!DrsElP}G{*>zyh7%$>M?HnRuEkN5C-iZA;c zV#M=(jL;NbO2%@L>IrNgB5bsR;L>IWg!N=+VFi z_Bb%F?+UA{s*5)deXNVmu!L4R>nCmzb^pm*Z-Oq~1Zyy9uZr5J7Sm)P7M~>5d!kAq zxSIV&HQn|@{#KxH)h<4ctG^Qha9L6d!%;1mDkVnwf8h3@jh(EqzA^1#qvg)1i+;(^ zk`lfDp#qx9MN%J^93x{YL2R28w-Ruxq~`SHJ~x4f3=>nGBIiz@=~lLQT1#6({jx&R zvA6T%>td|R@*lCQhzZ6nirt&`C%l7I%4$I^^9R<`EvdUr5@A>$s?0vqHD4yiW~B5C zSrD>%xP7+%Qp-#9V#N+iqK7_id>v_?nZb(t;74U+L@miD?5*?Y`0ef*%_dQpyk3jJ`Y&)F9>aZ2nTg4kgTG^2m|YOJCB+9+c+KMyh# z7P9FlZDz$S+%Y`E2V+chD8TZ%0YwT#P(M9kWa!e z;#>AdQ+*??x4{NDEMP(exv)SYktho`(KK&*IjJ;MK~KQ6U$JbB^B0}7TcEU~Pjv%b z5<2(8^qfwJ7jKZy?@vAwF0RW4|8e~|l{EFL^wD9sO-OH|`FOd-+<2WOspXiob1_k3 zgz3i*^?~MSFDutD!-MlwUF$exTi@arU#OPqWk z5*{xs3PXK|ch9v7ON0WU(&#L^?`+li?mY=vFV_fYdv3q6xgeCc-Qz^v?{G!y&;F=f z-*Pq^n{4fI7o2u3s~+5-Wuq$VZq<)TO#4DTC~$dlOX)Ybv%YCXACno^S*xM_vqil4 z%6WoNDz+zrgM~_%J8n_X(cSDoWwnJI`Rvv5X#~I9R)C_kymSxYUs3;_KpxT}f17~* zeX$r5u*Q-dW{?)so8xP0Xh|^%G!u{OQQR&A6k}*XCr`4+F_8c>!@lT#@%*lTTn8sp zQ*QoItDR2gl5R5aw`+ge=q)Jn_>ESwl0=EuEzsx+tCN@Fu;*L1cYfrS&?o#qp$e=( z|L$oVGzIy31(}sfn=Zq0rWGaL-tCPF-_jlWNojn@?{pJ`RER>phlECg3;+l47=72( zRR6il6+2r+W}bZ^6*BX)3UTgj4DHK7b~w~Ic4@gk?_8P+%dc=rZsU=E)Y(X;arRJN zz@{$>&v&>JL?}D#C~gJESTYrkINx)ND;JcN<<;hfg07eoN2eLBx!?RGmJL~o>{|r1 zte@woKE9*J^Pn@B!#-5sh8!B}9sA6FocsB6h?V0jw?}=jS(im^#nR^qRw(62WW$ zU!KM4G0!L$UN@%$Z`WJ=CUWUThCyF(#)38HLbnBG1W^pl*b3_XkfY4{q9Q;#DI?)Y ze{GwDC(q5sgx1X(O@|sa7i5sa81}VH%lzY&Q)JYoAu)t%p#${WFf)Xa)@6bg#E^HL zYpytdF*t`i_CHk8g(^w)Zz#nWhw3vzQwFO1^GGUhimT+L#wu*k>IXx+vvJX1;uPbM z$#WdJX@f(+KZU$foDDdyzd-^GGef^3O~(e7?YIdjh{gDvHhd6E>5N=J`8lW{8B42s zw-tiEyA)T<%%6GT8=Pkae!YcU!x(Zp^hfDM7kKadm!!)(go`HY(LP?6d4p^UG|Kr! zKZ!iH<72&2AhfhsN^N@JK|F%e%T>Xf$P*Xx7x#;Zjhr{L}o;X$+RQ z-kVV=lVP4#QhrQvF|~v^+@x+Jj__#mx;7p){FiB%=T?;~+hH6Jc{X#9Iui*W^a>mH z7szpAX3!np`^w>;LUUd0&L1Y^)yr4hR#g>boU3g}bjEz`pEu+M{gw*+1{!g0D#fL` zSx0I{a9paN2l@A-J59M@jIp*&dbk2QYh_b%UTB#`{)D8CCQ%ycg(hmdaO!)S#QiVJ z$*KSH%$h>lUh2Lke#e6!s(g)lCUrW(vGA_m&Fo)GK|)XAooI-+EP=mhYd`@yrGYHF zZBlqm{Cfc1Td~JQ-!TssZ~601Mn%lpld=HsFNU!uIKDU+-Y1&)Q_-xZTLK?>^hO0` z$qsTXbnU{e0r5SM65^DP70~b=q^0&IKE0QNRff{+ ziUcGh@~3aS>_|7ktmY>M)=(<<;Ts(W0NF)*nx6kWNX+YcBWd1cN(bszsBcb}a&JJ1V^kRMoFD7i9*_xY?vyQ48honfODSj{0bih<25)WqabW}|s_!2QK` zp&E9*(boBAoXDI;5`HElCu8upCbr6#)5{+}T#dl5IPYbEjq-24DHM#iHz4jqy(w^N zL=BY&Gy+DV?GZ^(_1SI=%ZZJS7qN00<86luNT5(?cUR4*jztbqRX5K@S#;KjT72LN zfi+Z5-OkHUaL&{H1FTKE|z4XVQG8txXl^+f|BLV?V}X?tP4}v28;JH$YOrV3bTB zOS|IA+x<{Sb^mQ2JI&o#({v{cqvd+h&{QE4B+QYK_rvK{fegQ)=%?$6&SYqVFXjTh z5|SMNOc?a5Uk@nyblo1d{{bLcqtTA0vi^S(mR45MGBREJu9CknZ*z)^egU~kNi6~J z4is!S(F6Sb5gx!0dX(}hlDVnHMFl|AEi5cdr;hqQ7Z)1~ps2vg`fz`nEc{sr091H| zGNTT`!UXrQPnPdMTTvA>4sa*t^7i;JLuk}5udc2XT(*DuKSLt|tRMhMW3dB}TQE`I z_*eWZ9r9ZMus8uU`V)Y6Q&Lib3;bS?>3P5lAZb$IEpiUSnyu%+r4U5U2!(ztmRPxSLA@)3cCwqN&( zK0s~oq$>bkhNOoFA0QX8KE1|4NN_MR9H1%j>9p6@f(%6jyq4ioby!Z%tR)fh%a<>8 zE}H*uy1pzNVqW8@;h^ehC4Z=GD?sg0BHbVbhKE5 zWp#D6Y5Wa(w?tyw?DRianu)>7=#G^WY-=l#T}O+Y2n%zbZ4ciGobHiiP8WKbetF}? zf1g+Fd5CyTsd=vjryKXttmnG+&i#fli^_!5|3F8hO5UWW(??HJ)~73-oomPg~+3l!t=CIJN^ba!5{T9 zZ#^<|5}Ky^bEG?v6U#5PCfVqf81?>*>Zbl~vLY)*J95y^iGfcy8^!0) z<|fujnF7hFFcY?IToZb@S$|YC>dv<7i5)k`lTUlC#QUAKy%MNcp zW#G#l((1yC@K3=gRrzmTBT|Z5Sb)d3V3-3SU%4Nq#&e2ZTwlBY5DyIBHuj~JUXhx_ z6rUU)2b3VM>BpLY8P9$v{s-F>dM>WoAD?8S=;&1OgMR%Az&~W6dd21^)m5oYloV3)JD8YG!T)RjYFEuqTKy2k9HG4dEefu2E(ACXn*tpENO`+N>_u!8r&6t+C0%10axycKOjHmww)dFjmLrd32oj>s7K4e5eH`E zDQjsBo=@rhDbcJpJdZX>2HoXCcSrATF80HrgF_jDsY$vXsP%IZ&_RK#0dE`FD-hV%9DGajeaXYUp~DC%tIff!0(v=UpCl!xrinLz{CLlO)Y%Cqc{Wj4pD*^ zL``KNKxpW?(;4-BT>;24fYMICJIfc|m}-CE3d=c4UAhA-hB~T2_Ur3wHu%f6C}Gq7 zNHU;zoC4(a6Gjn`q5Htc?6}yUYXs~LcK{XOUqFkc9R+a`z+2>C2UF#G*6k*m0+;hn zCEAU+;>uD0k_Q4DJ^qX1aaF}iK!or)4%cG^pi!Z#Wkh35dI0)PwQUM@Kiza#^1ghc z+Uq@>5T2ZzT-}}i0V`t#obMZe28^@}cvQ}-W4Uyb{|9=8y|W( zo<~N9nHrJGk~K?XWt>|W&ER$eNRqGTJ@)F4uf234-`R8>PW0ndDkfDIv;@**wV>`? z#Wp(?7-AJ_dZXT?K7aNx3Uio0`OWOxotMcqoLp6ATk0t!d)HnY`8;U~#^R=TJ%#8m z*^o68r<*Lu1`~&9c@!N+?GqLe*Hx;niZ~}rO zscAS!^t`Bxh?&2CdK7gNa2WDg6PLO09yl7^;_z9;|DcxZcE}7FPK~gTppIb*m(9}^ zH}WPczuSLR@>3oZ>m@2|yxNeMn@>DWUU(W2@f9aB8Fr_b$ffYb9cVVXwK)9vkq2mW zSb&GW+|!eU;`0&axeM1&%L+eHlS2KF^%H^n-)HuN zE@@-q4c7f4lH~hM;pflh{#>tr9SsRJnIp=RcMU^JdL5U%Y^YJ2IXhYL?7gf=e?>|6 zXi>~e-WX1rdI@YeRx$CU!}~HeWf$0^0Qo~&MTHt1+%t#68(}-D1H;1rZn5mlTgk-# z_L@o-_icqww*aImgBv}p=l~Wij?$#fTvTiYtM{S#E`ee8CxhiB zuOknL?yC;}wrSfaBI7Y1t!5x~1d;QY76vRU+ilzLJT{8Bw4Fzv{mA{%V=dVh8hE>- zr-KF`*q#-Kx8}aRn7XsbR2w%u$Scj+_3&ka0~=x_DeykUkiYP%Vh{8_w>96*xjM|Mkk{#M-VAex$QRV+wYl@lars4Yp?;6 zK)fT-nbNGYehIifnT=Z+o{TIkW&kt^I&DJ$pQ8YZqmx0F(`loqmD6h;`(-%5 zpM<+RNouDB!C(o{eF4(G+~@qw1Hj504eC9_0vhdPsaC(LqM*3CI^>VQDLSA+xh8cv zW(s*<0jkLmNa3!Q0DpV>JnBbH4gOr+tJkmjOh4Dv)+#H59j!CQ33fjG|HIW+Kt;WF z-J66UAfR+e3kV29m(oZ{H%NDPiwFov!yqjnjihvU3_bMF-QD?rc<*=L?_2-1VBL!_ zGtaNiv(G;JoDFQcP43Ovt5=|!_jX^vif((`^4=rt_O!C`U_B!oB*6pB-Un!)U{%z3 z%afOP2%`BR_{CwT;B6!TcK4weETbLM=Ulk3{#3)>-u`^Y#z#t2^eHCa{)5UHXU**O zofLi#`>UNwHj6Pvdk2T=`LAeI2OUJfB@^$#{o4Yg(>kyW;CFeC;6Rw|-}64>C3T&D zIP1Rkmel)PkB<}+cvv@WINERhsT`i2?FS}HEpvJa9VV$>9no?E-6Ss4&ES+=j23yf z_i@gFtL5Pe3`N~8H?lW?#VGLK)C1Q_%dY(;u$~M7o6dKzS1md6OxC$MSU%GEmq$&N zRD*B0duV77-h2J**<{G2Hq_mm^4>eKYwLDZfRMN*%xjtLe(Wt7^=Y)YAfN6TaD&dH z572Y0j+*>y8N)_Sk;LvKr$U^=#0*k@Q=328a9Y^#%=Z`j}qxbtPDu{pM>btL(`ySu((tGiuf`$6pS@Nuvhc=wk^S8i9ajiojN z7+L*Q4=X!c=NB?iksdQ@bH&-=>GbR$^{@5C-L{B3%pp-JiGFb6QoHSbwA$yLe1MZ3 z5tH=lwwNmD6J1x;xQuzFiY6|7xZ2zycjIO<* zL^C#P5S_-|Za3y466c~1@MN1Ittkaem5FsNDVFD+PoZXuwmf!R$xj~d{4K9wal2$c zUY|)-y*;I35WM-BZ*z_@>E^%u>X?d+H=Nt1v299O>K@Tvo$aiCz5r0*GAS>ZwXk}_ zc?yAWyL1sWL1Z~;c`dmBe>=VTh!+q}_WeT#pQeRR1U&YPMB|0&xwlyPam-?9PY2xO z2{4#nB1;506yJO%%6$HTKEY3VJF!=0&B?@Fp2xc{y`k^3q4y)KFna+KdG&FpsOYHm z(J~Y1_vKbZ;hn89-Ek~8rBZZ^UD*Y7UzPL6_lH_U8MUf@2KV?`&X%&*U01#_lSTVi z3y>T1oT%|TYBxx17H94}!Yk+EW$X^TrQ!M;*)a9}At5Lus)v&GWGUFgJp7#a67x3HJChnIZ@HK$!?)uW%|yh z;RJL)?0tr3^~J=h&O7oPboi^%FzQ^R-f?hzJX}a#GOi*zSHtEEu8?%qR?~ zUxkFVS!&d{Rs;4JR_c0@8JC+=0F>=4HnV(Vh1wzTh3&%&=bBSSfFd)2FFo)dd-a9L zy2>|{h_i#w!ASj{ECD{o;Hirj@Ztf6$OW2}7?M$R^z@4$5Vx+_-zPh_TaC9NMldMJ zXv+F#D6p$`SPJC?%pZ_if&Q&D;64jL!^ThsGO*=iyysi=yDuL3J^(vY)r>W;^fee) zP>uz*XFWYVRa=F%`|kDNmfdf9j9IMLigfKQSjq_O9C3jwu`N&X4-(#2aWE$(GRvvI zLHA4xFiF1|85>(XaR-|+2rZ{{`QO)<=MPeRhIpK>`Q5JpMs;0Fc5wwRykJ_J{`vj_ zU9gal&?Ba}5U_`6XljCZ!UnJ&CMqf_2xq&sdjeo56bD<1Y<4tYZel=u1v455Af{Nr zL7nFHYv1c@Pmne0!yaXHmG*j_&2%odhg5H5B~H}3Fvn>-6BIRE(pOlOnGR6|V3Gk) zi3;N2uj1l};bDdQtXNjIW5+oGczAeaB0&|SzzG;wlz&6Tu?1$hfB^+b zJb(@$bCpiy2yOO5Ub3&o=W}Hd4nW^9^g8IG3@--8ahGR%_ZhOR=h3tOp*M#Q3oRB!)^Bgs!-RSOn3-%Xpk2yD~z zw#KaPjpz9e+Q`)ETqWa#PE<>b`AJQv_0^rKHgvdf+ZQ@k!dlY;yY_qp+`Ga#UnhV4 zfQP-$xnNVsow-FHEaYbPPLA)8(*1qE$uoMGMYBBZ9JgW(KS z-A(g+{7;Z1fg5D;Z6aKyQAvQDwp4vy%?g_0gNT-v&PW`a87QRXI2jv5MrS;ilKk6c z;CE&wswh7nm!hFRGe^Nf%Nx~C6ZvGq;$azvbEE);4cG3yf7R<29U#nZsRnO44~iSE zogYk5Qv!;Ka0LWX82fQwGMAY0npKa>F1M) zwhK>OP{k^xKJqPQ0hK}!4a1Cqx6Yzt_4-WXcj}|LjKZv7;quWR$t*z)H^=~#UY&0L z$}1%X@34A-hqHf$`nM83q85%=N^@!S#r3HU*|Mp|$%cz+xFexTcAq0OChPRrLrSN}F)2=>M?lv#wj(*o#YMW@Zb)3;}~96VmP)ghU+H>6w|a zi;FkMJBUEQ$}c%r1GZ=t`ijG=BtADzJ2=aX@z(GS+c3PVrf`DIjOU{gCsy ze6G2K5;{6U6Y)7LQG)X#l9GC%ZxOaU#Go_AZl+wd#ApkH9+R{U!e+~rgp1o16Q_!` z7m|^_NDj}|{E4`=5=lk{4=`3kC+6DEaaU4NIh^;y zv`1J~0zY>jU^6HOruuEyQC`tsS~~M219Up!1Rl2lJ;2q5m137L=EH6;z~tE$t@ zKCb1LPItX7E~pQj!HKzSzf@IK$#$-;th9Ru2BH(#_j>P~lMrh^Gr>o4nRTNDI1-o} z29N7_gyt${cUW?!dl8@`MH&&L?%CRZjAN+#n)T<;ADFYKkKoV~VPIDd@EXzmH`*)4 z`I1gj13=1wy{Fi?k1#kS#NYjE_MM%Y9nT zb?f@()Z3$t30As3Sw^d_uKqJiQdsygo3WN80J?db>r)s@=-+#6q2G*JQHInMh0ImR zFrc2kX-^}m3AE87Vp7C~G)O~7+jC?&OFa*jORW-<>Vy&!2`5Vr95@QJeLI(o1|uRN zoMZ5*=`Or2mDdcJa=wg(zy zp3g-oFCve#Tlh_0T|TEM-*~M;Mmm8b`tR{>uiM&7>DDHe=XDKF&}RTlU2^t7LAn;7 z`BqctJHj2LQ^ogGGKw-%A`mvt9{T=Q^4r8QeN7HPrey-*p*r+IP()UV2LkU$s_UCA z6)!OhDI9F<>ZklAC4)jA7IARi$vloj_;qekm+IVFeT_I)5gk zzB>Iy_Y5SMK(k0aEuI%l6^KJDX7%hr0ozaiLrVh$M>#t?xF6xOvltU}r6R%xC^JPk zv~IkUEPs_RCh;681E)+ek-B@j`P&~g{|!r7u;)p}ef4Uv-UDe;Js!f&UZw}9LBd!M zFC+q`>*dwe{dPP}P?K1T3Sl;E?-@NuT(`BiN2a6%=;4E^-{~$xR#nwEZ?CJ*>NK~f z&YpI5j$2SM%|xg}HcoJUc7bs8YW_7<( zNm0?zfPr`K!R$k(xT~KjLXUjsmr?Ifo$8lAjynZBClX@8|J)v|+?(Kp3`&Lgs4TS& z9YH`argwXNq2+UPVrXL0S>RS!vq^uSjR3!hXWwv^L=UcRwh@)#yt`GDmZBrW*u0qY zWdi~rKM+W!aL#awp$Y;yS1EW|tj^nNNK7pp;_s$TNj`#yORyt^2vzPr6rFE#9z zhoXZxtmU>6%XipCd7mx4D;cS<((%|~r;$ziP9<6Lea}=-JhiX+b3}JEEt}h+A@F&= zH-OB|&)-rS02iN1QXlvROQ#Bu0QE%0f+G*e^NqmtHd;$~WK3*qiNl&KQ|)%?M1|>B zfueD#M(-PZ0Z*>E%dyHZ9v9$vnv5OccwHwaa_phs^yOi1GH+b%UIP(|I42p8Bb{*x zc#HNKm$|z1%QS`)m46 zFrX^7h5IT;mM}WHKkeVGyb~H=LMJaO#*@uPi?HR<)_bP}RX>^3FRWdWow@;{ z6dX_mghFYQ*!jLkQ=taJM^}E?-sBCqu199m@fL^I*H#)Bl(|pp)5z5l25$cPrK;;F zY_K*a^MjD>MPTcPn>39YBV&hyOg4#+vai{A@rVF3M;H8TA_qf!g15bbl9b+B#rpcE z9S$wrr3tHHx;pkXWk>O5nSZ2jY;ZcAXN4>21;4w)-Q5|TCTAfvlR!#yYsda9g1O`n z9)6#|MNq|WPd~y9^s`DFfA@JG<@giJunK`Vm3&g61-hUOU+fCE7}pp9e#f93X!2?XMfttGEuBY+58zLyweZ90E(_rv7^a-niT<* zcV9mU+<88h7#y6yKiZX*lgj)>eosvqjpV#gQXv(AQrX*=s@FP`@Ozy8s;m1N!kp06 zA)|{0GbGIQfqa#LJKq1k&hX8f?l;@aZ&1%N;LZIr9=6q5F|o>nwJvgC%q|Q1;n5M@ zTL#*44wYM*Ty!{aZ5_T5{5A;Ju?(EsEq zkUj&kj45c)@06O+(H4KSNU9)lGB3y~5t82P<0vU6Jup}iH?aiMU+8C6Hz;Fu9N3;tD6NeSe3nz@CANaP>@0*mp3X@`M#fI0t}T7=kH1vLB$ z@N<01X3{S*?sU)F-}5Ly0}1~ttM7PRM_IiX%;35hM0-!dM^W8#{UBYqXN26ABgMml z{{q(B1H_J{1dBpFP$jr0t?XAmf+rJ@#gxp<;X8=RBTz?(PD$wp7Lxjr9Rq@Qe8`xj z%jqFZ`k*TP8w`_-i4g%+aU&z65{`TB3cN9?-rj7zD<7%xKuRC@gb>)uGg`Xc&rUCP zG*Ns^MEUc1u~D9!-|YDepfT4qO_Ugz+1RXQgbOTIAgn1tx`eQ4Ounz1=jG8OVGwtL za8Ad_xC~r7UW1bW!rDO#8nf-msA_a#A`JYkjJLM{NVLS@e<#l5SX|FNxG$?M5;|hu zD7xO=oZa(Y_c0EP+Er3j1$imRlvnO~KRhklhX9cjXxDOZ-WL(HnqcV7E(@#kmIy9{oZiN_8 z4jc%g>3JMM9X|#&?!nwPnAtQM8CMSEPnHVF6;u+I)xjj(w1~gEP5fH{flp6M7)?H; z{}^IsUO-F9mKa=$4Zzh0Wg`M7_EDvnSgidkGb^+7I!8gPKX1=({(#Ss*HrFK(MCvY zjU@y2JBDPU(|3_yE%KXH6jj<5p(cm7?63OJ+H88%H>x3AfrrOec}I? zgY(_p4X3HK>90TK@rT3u8k&jkWRf@iUXF~a$SXQUfZ8RX$t~4tlRmS&*DGoOd};q% zB2%!0ikjfO9#%#;cwwyH%ghlK<>BG!@5}-zhr>57Qdf%Zj0My|W<3168}PWutz0Km zn(}i=zK@ZklB0!HoH-^ZxeZO$BI1)}jK>z{G6ZMJS`bHvM+8brxKcbW^b!hOJe+UY z*=hb#wb6pq1V4mE?xVEGqr5zeuDM`h zD0x+tWNggV^QL|JF6?xIySx?|mnf{G!(?Q%QZ>zlguX8K(OzM~WwhcABV*f!<0l;* zU&M}nR|LhgXNP8ISD*}UwA{5|XzWbezeWA--NQg(YVJ2dF(bH9*f{&`?JvmoDA~$* zQ6qB<5J<360(SE!eKLJd{9XfY;JsL-HQ;;akJ=-D{*=%cdX#BoL>K(g*w_UG#+<@j zQ8+u&bK>`4s(24)lfCGEY7nE;0xIZg6Pw_u(vn>+T9_nEL>YE6T$wl;7+MOeo+~YW zOUWvkmo)4kNPli*V&XEj3rGeoTXL|>n7BB_PoJ71UJKu|+XkIsD}em|psY;Kz;IuT ztDN)Z1q|(LPdZyJPx8R2?+_wC@yAM-5|=;ZS+3gn@a_P0^p3cnrO2Ms%;`sRDfIpsC3)0 zE}c#~0TT4^F%sxF{c44{|AFl8ytA#d69l}r{e{-tf&wZKj)-jPBK2AWB9oJ40GI+5 zfS8z=h=hcmWS3b7Y9D zuDKTEn8&*_M5zOTj4;5V!NFn64vhgwc#ki`JB2khiR|p`K!NU03Ch9ou_FM55=KVU z?Ck9K^bbh>79DvcWn?me*F2a;4>k`G@S$K3Ay5ebE(+8)@6Yv#`v%Cmz=<#M?&DI zRSIan^}maITki=$wU04xA zg;gMbkOB3_oXCeEW`t^4FU#V-U;e-sQ=6_RiH!K9^s;qOURk`rd!g$i+P1_Y-W$HF z!2?2)@V!s3foKy7WIZYYg`HEmBG!bhgOR_B>%}a6o+vwsh-`Ivx4w^RK}E}$?F~-X zSEtF+6N_S;)E>)KB%54#;yYAB5J1|{Z1riR_(Zfy2Rk^uqu+@uDKZCwqmH48zh3jI z*7#UUdtBd%MTT;0*7T}oyR1x_9BaNZ{3c~1PL39zk4I>GjzC%2ASDW`fipZQ@|k#W z;FTJvP9VPt{6oG?yWBi_u&aTRGhr*l%*x7W`{xiyu|x`qydn}xjJk)M89ur; z7H&mWS%^Odpg~#CH%?c9e4bC%B-Jb2+Y&HJ>OB2G#=t;WHo)fI0`%8=LPd zL?O%#t|M&$|JA@G=F9?1DHds>z@rKM-2>3_g%}1ylsjKSGZ={cfYu{>?Qe$?5bIey zmncg7%u?@?0Mso#$PRC?sEag!bozWgxGb2R2`#p1I_N55N8@4Si|2c5w3~ zTvfLmt@+ndMcA4czgAzdKE3C-M zk2S`5bsO^y!cdlntk>Pv`iwnDBtP z#PvL~U{i&arvO>w?Mab;4&(pe60Ts=rli(|_wYyS8gvv)sg|D;zZns%YhYC(oLU|b zb7SMvTM%lne1R?TukZwZ-QiMN`SIkci6C4p3`GJeDYo#b*y_=3))I$Elp&DyE!pH| zq~+mDGMeCd_9ekyz_R_QB-ccacdHfTeCMT)io(>8^i$S--#?In+qujvLeowwWR0<@@hIzFtyZ%SMmG(u@IR1sU zop-^3!ie`LIONgJj#^h0|LjE1!BVV|`m5$IWT@Xmj)0b_Ut(~8z{dkhg=**@kXPSE zZS*T?-(NdDvmvS?i|{o)+7sQ!Yr$$Bg(HgO=W^tmoLlzQAZc^>KM(v(S9kka0d-+R6~_~x8M|Jy=g%a<+>lg-9KQ~<=;ImoVMEf-h#-~rU^1$udg z#cM4lWTx>2)0HLUInuC*3Vu>hN&wO&EmBO3z%q+kJ%kvVKd8gY;}V3A6O|#ja16@I zj*#9;;%h`?B}7FFuHa{l+&A`Mq4YD7=zb=zd%}Q)g7xg_CtPvY3QhSYq*e$RM+bw* zD?cq72dH>+`Rre{Cb-OVxI9QeA|paRD61*ORtgG^7%^RHU92*W!kxj(GDlT2K*XgO zOuEa(0roLU@Xn?d)a2bDy>y*^*==G(xKIMXan%gdbhg^qhV7{k8x^V~wtmTf4u0(s zSWx<`PC}M{wD^<1Y83tJ0+kHJncKF&jp9`M-a?$jqBvTfk_gSwA15++EB0dcQ z{QwZ=%HvL3(}E8xaO4?k9s1^x%%8%JE-Z}p6gWOtY>sR=wsjZ{l{V~t^CEd+ar@6+ z;V60Bo*DgR+u7yNC#<1KL^mP*YbjRj(|^v=lSj>*vFon1Jg*d#U&g_}e9q(o0p76K zbc1|20fQ59oc~ipTBs42=bCMhel?&{9F7J3=cUBal)69DnI(sO!f~VgfBpNEV4>XN zd=K+W9|CRro!;qJyrkoHhz%(6f`pls-1JB_?x6155P(JtO}di6`YnoCqTV`gDS%LPDbS$+bt$&c8?TzkkieVWO;7VMQbf zm6V223s9rAFSM~bY7k-!PuXI@SnsTas{ecJ|9#aUyNMil5wR@i3|hcfM!05BVg@sYJVE(C zXW+bY4e&Mc4jIq z_@t~JKqWa*AtR)~I$PxmlAAjz|A{)%dNXq_5lsuJ0_)&(mS3j$@!S_6BRN>Pblt*u72oEDA3t0)-idKBD)gbZEoH#Q~vy>qp{}M|5+v$ zaas#Q4znY_ppiOhpl=| z|0t(-T+8f@{uR)CA6i(iZYDN}Yq-0Jg*X00>|VZZIR946?q^p;j3^xxdL8fszcmI{ zBno}W)ObnLp~V7f`QP!B&raC*udQsEkfs5iu1E-b!oz&aqI5 zioWl5c*7p=Uu3rHmRk3*8cG^>eSh~e;6v&|KW-(>zJ!-jERM+w83WlqL$-PJA20N8 z=n087H^%rwhSqd{Aa?X_HV5e5PKHo*qZ6`%W`a%yjce*C+*iLI7QdY)Wo{kdO+A}) z4_ZlOY+4GXQ zC*rNN{Qc*TKN_u;keD$Bf}`l3rIV0|WclA-x__T;@X#ABnF91d%(Q10ZeLZ0ukl^6 zSWVy=9I`%CD+tcikJgRFF?G!0vVjMuJ5&8Rc6d>_~($%KZcW)dGlz8Z1q{ z1nT&<6*iler4##|J{OkDYbh|?2@i)UzGwXakIi-;1#pK6&n@B>LPKbae&OYA%$%Q+ zoWaM2r6mtY3-3;SqJg9$U2n~<^^c3ZN@@7-5lD^6S_ef^q@j?nv$OR~n^R@)qQ}|w zw-3T%3Yvuk3DJ09QXY;i#cPQELpe%p=p{^{wU;aYm%|EtmsNZq> zU$^LZ?xmy-W~d6*+1Y8i&Ag?e%49Kap@wjdD1!VNVazX4xvP#&zzt1obRpBRA%+^+ zAGz#Nzo8E8BT`{A+Z_Et>hmJt4Mp7lAH$jtxOrPjtum0W+p<@G@$gSnIJH@$jc&Yt zP0fHkdi^rSs3oO8pb%c>;-jDdce`oNR(!u68!#FmSdZq zv0Yw=5U@K_Sj73X(317(-Fn#A7T5iCc=SPX@$UA5!lv<1brC1(e2nDmXb$rl^Ua%$ zBu;CJBjd*Yo=mc%RhZA~cigd6=OU*&lg)Pqdkss=Tmz2>?&uwpWa0e$+y)e^Tn}DI zU`0|%1jmT@$6C619sb#4>>L%}n$f&i4&MoP*(n={8i3ZXl~MOF1pRFzM|y`tj*3M- z{22?$k3c$Qqr1c*&(`Ny+Ti_HD)M(nH@6>7l~n6b#xzGm>^ z;%+v;^h#YUeP*u8&c376L>AFnCeSzs zMmy4fV2yuYo@2;rhAY~xU#_5_5{B4nhb(lZnMh zQoI)DCd%&=abLy_Io+Z+FR}{U#ojdyka)9jxF2eSC1HTb_Qv`W9ZVMiDxbw^*zxxL%0zmHdCc$iAHM8B9XZ>qKM8n{CJS zhJ#RI`w(xyEY70eVZ&3;mDu;llYg+-Z?GGRHY+Lxxh1QADrHpEQs}>|_+ttB8oU%4 zN*N8xC-FBMf6S;i{qew<$HXn$Ysv-zZD`@4{t$|s;3c_<9Ep+ZuQ)Zx*HL5LXSZL| z=>Ra)7Di*Lj6)_nNA52t%XT|)uVHrloPe}86@GMVfccJf5H|Rp+0ToA+7m`fZ?UOX ze@jDezIoU^9-udG?{+@teV4f1cvUvSSzelF#*WRx{X*ZgI8OUYP}EM60O7pbsy=V* z`U@|AG$1{%`hBh0A_HT3PE|~yL$;ZvdPt##qxL#^vTTWS>nkR0EVB)eKIli=DlQobole z?AO)%lRQHsn*~(ZD@u(ztv|vT+%8MV*jPuT(gYnl-}@9kiG;0gFKKAza1vyfM< z){HH7)Cv962}fH?Bx){u7(o_c$pHf-sHv&x`L9|El&`ijoP;RsGR2bxU3Chscfw?hYSxhNu2c(|hUrejd*p29fDcZu~O7^>9AX=eQH- zp#b0KopyS=d3Vb(ciTTVH0F%s?eqHaW54UwyIbBLa?-_CTYclx#@5zh&CRcaL;Q&O zPkHVo{-9f7?fK4Gyh+MZY-^xdtr?uRkO)KkJn?RgEQgUfqj(UxX{%H2;5>R@u)>V; zkp0$5R|`G5&paouC4{+N$Vz6EecXe=>&EXG6GK5>2dc}##uk!CpR*@y_7=2411aQA zO-WFyT%`+^92M$0+T3x9Swfxbz7Y>E^E=K)a6&1t_8T>|y~T@21$uz0l8%8Pv+3g0 zA-YbNNq3hL!XaxWd4MS7Y5KV9{By z_Y6Av618u8cT2iUjJDB|*@NuQMU`FGeSO}Ss}*bfA@S-RnTxUT7O2|85HFoG0teO*>NRNVcP-L zU}Xjs>poDoobY&EqWhfdHgv}|9*bH}mV}CvUJ-!Hg6p%7+z6ZACI&N-OL72Li}fsY z2!ZIVak2ms#TJN6KtKQiK5=?(iEm!sM-ePbx8Z)=P1^DCl*bJ~@dka%@}fs*g+8tr-)OcfsxIOC%YORb^* zH9TYob);#9_E|mPyBLAjoezI#IO6mXb$uu8<0Ba7;SryhXaeteKC$Ecpr+R2XF`fG z_zBp=zIXMxdvJ7g^dmqBjPlYM$2TrhZwYxZ#oG_4<&Z)m$D~?dsi~fT5K61G`65Cg z3B)DA6b}0?_BC19LksX)47smasIOQlJ z$s?s#uOg&r+!ogcKnk{jWB&|$C6$2$4t<99tUgh zGW{Mu$!%_t2Og>WJ_lI6X@abj!;$2YULR_=JS4`X%Dj#yf$pq7RMNRtZQ+(`xdfJ{Ny?D=e=oUfU3f5WZzBjkAgcq37=t$?MDG$gfR33Vv!LL~mxW0A z)z#J9{6F1uNe}if>$u8fOD7pi)RMs2fyjXAWADfqWwPPd*OPcTxrM*2;7F^hc=)6Q zM&91OtE*y34407~Gl52>rDoB+Ye%qcds@r-PJnsA_M0hV|MoU980&N~AWaA9KkmJs zk>)yW{Q!I(0Wo2BYG+TdJw$jdwpBcrjyV&&vzVB$ghF9sz1Iy@^c!%Mk3NjWjt7pq zXW9hlVF!tT^C#tH)?!_W6WU=vURbE8qS11EjGmG9ZqwXi{|b%Usm4!(O0 z$H$8&t~r1He1KAm2`}~b_6`HLNQBo(DAbZeYCMy4nhCGW;b^@kMR3*>^3g%@F_6xJ zi^dvn=&2v|zA3z2U(XQ|BRG5E|1=;#4BR^-N~%E30s?X~iwwmA%7JTAZhU?b?>_+H zb{77_NL}9c3Kpl6Uxfzi%33;?+6sCri=FcPH3R+ZXZC;;>QA#M5Y=G8B8@^1+9F}i}CSst6d>4XM|Nd#X&z5 zDg}TR{+fz(ZB%vnK_?PPs66h8jIW)#Jah^Uo$9{vjhRz{s~m596nsFXuH!DE)^p}^ z!S80~BNe)Wc=TyROHif4$;grl@-|U$Ozu%+2_s5N;0*0sgNwVXxIIN&l>N@R%OX%8 zDz(`ot+1+%2Z!&yWzpCHi&vrJDF!J5!3sttb_0h2?B-lDM>|vMzerS7qs_uIgT>7}L zF>p8=7g|z*Zf(GLc&h$8;tumN`>Z9t*q19wd`nfAiQ62(7^eZf0%%+voFlJj{k4<4X(R(bY+fyPP6?Krw{hsWUJ$VPkE*>>sBC zjFl5WT#gTOfUp<#%vq8V5v}!39zhE7va>70eVboPw=SP|!((Ehz=Ky*T^*H~#QmiV z95^qb;nn8k|LMD9f_qiRNyWLVDeJ=YxmwaxF%;(=?G8r>Jaw1_QaJ?$ipT`J6={Os+6DR{}{aD=vA(;PV-HZ(l~en$>WE!@Z0C3>0mX@^ZO`$GSBNA_m#!Oh1Y9jA)wJwNr(H8Fq67n zYkLz+QDtc?Zt8}U#6WS`xY=dg)Xi>PCT?$EQ$(VGM$5rQ{*O(%T^pxh+_bqs2zQEv z?e@9k0}#!*?D9xz`@~EwlWu)qgIMKuvM;Y+!j+ddYynhgg}?0BsSYl4z1L%DSsD1$ zu*h1w6o9#l&M$2b9g$C*%83QN6DY;Q6%~lvAP$q8?d_tDI-4DN8b6a0*EURa+t!>M zuG`G&bTDND{lv*UKr-_)DWPM_j*SZa61*Sbl{MC6p0-~)$N!7 z?#v3yh9Jcq5=R$ZF%?`LLA!+24rQ%fqIrKj-Hsjl`S>**At<$w!P1XVnNO;!t>E&2 z;hVCRF7sMFS$mtCSrrutWCG`k0Kn+$2QMthCnUD*P5cLaN*<($Vav3Bw%=#Wm=Pz~ z;%{#`CO2~8eBDjI5D!E~)O?%(d;*@pP|yBL$t=zf9iE<%!HZ1vL>E8DzFrf_sKQ!_ zWlgI)=#GxKN25e)VfGG@_LLfYL{E=0z}0U-uzJ3a?- zKA}Z}ovRgzAmi-regj&I?JBHidJ469xn0+dUajF>Oq&R{Lf&%WP`TBYz+wF96t$OLS{(4F9nxt~BAKGQHDRSz?^&Pj&PvKhrUF>T?Q;7FaA%8SniY2NtmhI8*bg4v z3XT1-(z_b#qgq4-$;Jg}II-=#<aJf!3y?v^_i*O zMg5;>c+6>ZtXXD*_FMB7i-9ZG) zt&JO)cH!i$umXZOng_BeyX1*|Q4&-vj(*YE{eu(5!J~irK+9HytjS<0n3z;%EyIAQ zv`WjY4szvdo^(hSp_Et1g#t%km^HH$rW=Bu%tonL1CuQ~DMXfJW0b21Ee*NXyDb zb{hhHsp5_a_zTxMQsI#|eLPL1gnj}Itz3CV z9{rHSHwmhb7E*BKAe4kG@HPMe=jA=Cu$t-Z)0{#Hq`YvdBgNcOsVsGpB6|8%7Myl# zM77_IhYOhdjv7emm{kA8Tz<$YIc?!ZM<>l8LQ~0UV_MukelSYJH~$Nu9p-mytvij& z-f=-%f}(fm@`PC9_3hqCySOl$47ilutoChB)<@T3PKUvi-}8}nZk-HHP4%u;gyL2` zlgL!~*7{;#i+Y=T3 zf`yHY_xOPUHhv$i%)Zq5bM!)5RH-`_tA zrT9N5{H@?9IU3smYOgZ0R*n1hx>EQu!m6Gn{mcp)-!ihd2dq4J#PMsw5Xw!v+Lfg) zd$I}}BPU)a|D?+$`whQyK9+th$Z5mNW_g}`(JcUKHIglZkXJOw52Do!3Drx;yVHsN z{zF75OxGE)A!F9JT%aXCxX;8=+&9g@)J45Y#VU#;C3q=*R(Ipo;u?@w-|$_oFD3Cf zB`D`_f))f+R5+yD(80HO8i%(!u{t=$V-ZZFK%aT9<2@w-wX4>Wi2BxN>;ZqS3WpRU zcDCm#15*W$(1BdCdDnKitS2;+_9rOt`|MveO3Aal=SX}Vt&@N?{v@!~x1b9|XI$le z{z)nrqhNgI7GZFbM~i9o3{i3u(7dWtayaaI(kjB?BjaPgws>f&vtxoEd4sl%YLhqQ zvE7D+e0Jr>N=hp52RQI2Gc1LhQoFNf!9+_6w}PrCdKaiUE8@FF#37C+1F%k$)fC43 zyn^|o)LP7Jc(XycpePr1dwL%3(?=i$bC|1lQT&_U=AX5t+V88keCG1Uu6FFX7aRf( zFec{7WU<~`aP>rB=Ia3|bE~0<)sELL&$-cvaq*A=>RK**d^LAi$9N_VUGaQ_*$M%3 z`C@R9)n|r#NhLHHvNOl zft^EY{ngHr!L^LvR9)asEv+d>m4UOUP-SRwiyPn800VThT)9%l7iyP`o|`GWZmnTSTC)<<&2aydFS}Jwad%-*^Pe;E}p|0 ziAV0A+!mHT&yEVc1YBI)PYOxAw6!iX!Dc@J)l}rL)&wa`k~7#SA6Ux-E18|)Rj*ZA zT+`?*y&h)i<@6lTx*&Z3Eu_Se881;&0@=}e0~lTlWC~B8ssaG}yu9Cz<$lV|oxRzuzIxDj z=ApaRqK}2Kat* zUq-2k0*>3`fm_}s92~mRuh7wnG7~(G#Ml9^1=aHr7?^HMO6Z%k?BOaG?4n z0zGhgofUu9YXS<1fM9RG`bw~mp@?*K(j?Wu(Gj;2Ap>+&jvl-~gj;k$PE?G$&1%O( z?0FE9y4HBtu6s~D;1dtB)a+gECjPVO`^=*4?r?N&*&h#6M>+01dHGT1(~&VH_$S@) zQS)XNbO6#U#tT>VRXG8Z0I(V;*%nV){Y~YDEh{`9XW03I(0<>V$3yCIy;iqB4D0Rf zADW)-x^%K|+nCQMcH421O|kTWSLNpU8+6Koj%_2OOuoa3XuhLqDbpIU8HH~2FG8tt zfCd1#vIBs9^5*k4Dq7i!=x)Qvm;Q^NzkmQ-Q{#aWy0W=hSWseFrXC-kvI3Tqh~PNr zS;(ln-n1a*cTRe1rAou6gzFDo6(jXIG}GaAPeQ}1c`z|u5fmS<4!|5bM%c2{w|X4y z@yRMZk|2@b$VhplfPkUd2=x@{OjnRF=a_-LHTPlRh1&b*9?dn-)22@ zZE>BC1uVXQG^ap1OoK~kVr%+DRJm{yu{qk8lh@NU&mt^L`Fq$*X=O845m;Ysoq#%h zb8EOj^AR)Yvf~xdsW$}qw~K37#EC#v zbmV9RQsc%}X_%atb^R1owGpk9uVs_WX%m4#S`J-a%k=akWK5EUwE;dko@hN~ueab_ z3?Vq*1DZp^6g_|RBSMDA^`^}XqdrQLGg4ZIt;!4^$=_dKtiT!|gcMIfFea+6@42cr z8AGRr3f1b`D!1c0sG%G^igygi>v`rl)780cGg%V*$@Ir3(WM-&;s;--b%d$Q`vvF(0)l4zO?vcAi>s z!V!p6vgp_)(0lVWkDl*fqzoiQFKKA9_g$w!3(n!hlH9>?vnnvzNiWYl$Rqlo8k%Uf zXkR-BHFpoBjI=1E{SQY;8x6XUoeefv8h@`ae%;b$LfNYjp=fq#I3n2vtTDW+!dl@~$<94rNsV9WAEV326YfX!n~ua>*>PJn zeyUY;kbgyinqVPSSb6w^+;g#g>7eqO@=n9?F(2tT^9hM<#;Xie%U3T0Z}8BBv|)pT zENEzGfOn7whm>UoaFe`(LJ}raT1E!vnLkh%068ugfm~njWm*%~xzn+9Fn>@5=4Ke# zn+JCUD1)6Icw^Gh*+zY*t(qPWM6BqK=D9zhp{0F8XS?8Bd++G5cC=#g{Slab4a_#^ z=$~O>i0`}egBM11{|5ScBkfbI25G*OUs*K?fc??KKR!7#sGJ1-SRxcJdSEb=z}DXi zW*?#Ea14y+FLcoFnT9w9&W*8k)9-*kva`dADC`;bVo1mW=%6_so%Z$lt=|dD%K%jUKE%wOh*fQ;2;?Jae5GHAd zRoj}9`tvz?qy#o0Q8tjD<&O&8HDOI!LN99)uBpsmSy}hDcyA?GCjRr#ki`-4f3*NF z!fA5~=sK6|4DgX2`?VUfZg?hd$96z_-Y6->ykp~qjVwbljWThcUfU36fM_wi0crmH zLN*WwJUAfhHdw-O<=ge#Sytl<8((@IDUnWRFR(NMxVrF8d1W*ZQcW2lT%ZJ@hV=esKe>{t4>Xt*<>wtiXFw1mOe9?%$Sb3$-f?mcv@I(M za3yscb{Upk{1`H1?VcY*Q3>%+NT63zrp68hv>j+tapm*vj82@kwzd7KL?dJ6lCQ1TUTpDiZ2oYh8O;1l}6nsPao<0`v=1QZ0g9Y>D0EPJuozjO9wiWs#OkQ3m zKySTjW>-slO$|MDJVer(q8G3>AVZ(c?52N>S3veWG*UY2{&eY=>~|T+6(2!&+M-c6 zEi6h94vm37Lgh+}S>#yod&fVd=&F4NBooq@z6OrY=^J^=}n+jVz#wNa-Ewp8lV+8J5Mt5)l>mBz#@6Jt;e>d;-!POpQg zeiVh%(RF#n{Rj(t5hemShSym8IN`LPl%FQPb}cOVuy0kim@)?mfHOXMjFm7{V$s{ZTVT z2*lF4O3zw*XO4r#48S$YX2tHNB6Zp2b+UW+V_>a)#a^!@2jnL~xEA$_erZkLDHUW(G&&1yrw9fG&>n*^)k^qEsS%PoCa2 z>$#@f{uedK+2@BdRyo10dz|sfio%@R%MVy8tmq`d1Bb9{Gd+s59H^({&n=K)zEb`G zrNYi-r0vIy9EG4i-X3Fc;vP8p!N&SdZg4Nl%IRe=h26p-mr6)aR~w&mqW_;Qa{}VT z3?Ih;X_XABc|9*h?x(U0+00=q0yqn+<)b6YNL_~P(}h}4je$W3zn>y5m!+lopQa`I z!BN3(Fndq7HnxIY89$)=BIVs`t6j|{Z7vf7m=vxgN)y{ZJj>p5tQ9jA{9r2)7OA$G z%04crtUOWEfE2fc2aCAJQQt79Qf7GDqg@-HfQPh!zg7U(z_b!EQRcCh_)+nHv;h?0 zL~)7?WJ!nxM0S0)5AF8tGJ3>(ms;uh_8~@6gNES>l0bmMuH8^7314Tg=Z}s}az6tH ze5p)BjO6u|!+i+npTcw#+u-;M{HsdNgX0CJ;2Wl%ka}XXJ>;g9;&dXK1H%AAdSQ=o z6r&HAD(svOVV+$5`drQV*;jPTr>uMe12}<9#f7;^-IFN%!ml5k--l=Kz4lsj%{6Bxxu1db%x4@%4xGZg!o*g* zWD{dCnFo$XBqjsdu z4 zMW#_da`T8{h=O<~r0-*t7)4&%%0wNj^mi!&oUpFVm6Qn?qo9cJb$pJLaygN>`R^G@ zWZ5AFOx$x49E`$Jrq8urHyZ1m?-?)OxoB7kb=s*Km}K$f{g(fG0%M0^18vpJMNs-+bjQsgIEyk$fs*<405q&_+xZ*t$ zl>Q^r{BuZ6|89c%A9r_lF1i_`$ww)n7~ftEj!wYU9=J`f{H)^{U!>gCtAq)Lw>0G6 z;6Ck@-uW6D%~d!ONR%{L{0I)J zR^can|cOh9IZb&n7`uH5_xuRL$pRM^#V z|48gwj{R1B6qGQ1zvZKjJY$RAA=SZu|M~I%vx1psX=cnglqw;Y1I8b6OO(D$HH&@R zmK~2>V0`zDkzD`7Xxvpi?97XiuZjH8V(-l3$|ZeX!B`6QpIrGkv@st?N1`$Mq~-O* z)t_;!R#{1z@wa%eugW|dYl^xl!cM+^kvuNfzv3&8Jpb0K=aP|jj&EeK?O&PEkt}w< zaPvBqQ*BMVlWWd8TM~}On*B|mUc&5$uU_n@Y@c!Ch8IczTdlDXzizL%BI?_B=oN!e zbIJ3vi0$IVFT1xBmnrm6sNSdNb`q;|v%hx8vCFal$Jv43Y;a^$SDz?~Eh=33cFdg6 zWj9riMn*Mmjgm*C`_9vO%Byb!vqAdK5D@uK5YPA(u$BUD*S^|54O%uxp|nR#$f zi}FtRcl@x7&tLw`+6z85;eEk!QD9A#TZ6K0P+H?hNS~FS2Se!OZ2f}M(;4U4{TpxE zU;K*3v>9T9eSLS%EB=KKQ<2=p58g_>A5Ya}WIeBLhuA)1Bq?~#_KpO`Hm^)M3dUYz zY*KUm4Pp{{-*91tAr%6xJ~87%oqzb3{J=leFOx016q~ z{$*OR>ryf)CbYA+iS~8h--dER6-BUwWA4KhjP1aE6Su42t?HdOhL~@uB-+Duiw&RH z-CzxrBoGMRo85a~(<#Mt<(rh22$j^}?uxb!fBmfOob2yv>VNam@uS)`<^OHWgFpBg zoR_9CNd3{Ck#)WMbJTHFYx!ecPDq%rlP(J@!~1ypu8YOn8b#e~0wQQdpP@f}(?41w z#TzZ>9oo&G@t3P~#s;tdZ=1t!#M~z8elbWKkaFS@%J=A!3HhgTjZI3mwiE7XF4IOU zLQ~bms+YAlXcZ#Zf=&43HBWvUvTDzZqCrb zrImqPufe~V{r}!0j2*k`4)e-G>D8c%pU?$86eD9}4Ea8QT6H-CJLhN%Gz zm;^QJ!vrx%!bL?z5s{Ffl4^lQ|EM|^b;Tr8P+<*VlTGR^eMMnNSHRKwpqrUyKOCaN7s1h!S< zhqLkV@w8FxFn*~Zl+?Xn0fKrV&EF0VK(Np^Esd65`u<<6-rn9G%A`~?G9DhDL$B`c zZvEn6sE-a`mgcQMar41!#NE@?<2R}QqdP+PRZF?K?l$cVkwSC(i4F%}#I<%hy$eNr z;Z#cxx5i}#E=Y5~nO!J&p4JxZmuGHT>1T`nYOeN7LWo0qM*Qq-kO}JmSrtyw`h{Ii z!MiZ1rSdKY!HYllt$FP6?CX~eUnqyJXM3NCfK97dt}2U3kM=E!@TpxlQt}i~D0xcs zCw)aIPA+=5LJ+_Yynv*^@Y-$wG;FIh4}%(77#WmMH}YGx21G(wERO1kORo^c8gUM&yF~zXR~+`gSr#bc}BYE-o%KL!i|M!tiDzM;mzo6tD0b zIRhW1-^(M;Yt~Qw`0-Lqr=+v9v)Ic@ir*+A7@A42b~fTGZq{$dbOaSFX6Ov1rTIY7 z{OcD{W!~(j%T~kuV|s7^?Aq_&*tcK$c^lpdJP_~?bV*xKqp%_L3rU@-l0Zfks2MOu z1G8&T&UkoGz|duOHVh_uw3MYWUGkNHd0{<0G;p2x^r;Qgj}i|Pq%-5|@yc1XKM6-^p@VMLfgKLMin65@-%esdkgjK(I)OGDO z$)eDp^lrYYvdW#=uQy|Z27_MDa~W|wGR82^rqTT_b&>8*>#w7p*7j z5`f#+lk7q!{T4br7Q-Hdx=1sXDk7kw!gX)GB5XPm|HhnAg#kZqCC5IufIz7Dl!=Fh zkK&{|2?@JXq4$Q>5heyy_>FpH2;%&_bgU_3z0;4R@s>0g^zh~CGy)zJ)H=&Rr8s3L zI2mPs`^vZ05WU~Y7+h$Q(fKPu*#G4gm!@mBlT8rQX6`r~#Ctfi{kt5yec^`>7hrW2 z6|Zf&P-sNMkSmPfgZ1I7yp;=pHY^lJ+?LkY(|h%h7UX=O>l+MRQ$TKz423LC4x{Zo zdVxACL^1fY_wU~~&2EnUHn0Evn;uHStiJZ4A<`v>BYE$SnNOK7KoGGiOEBb)+aP&4 zxnTm!3LYtck%gBY#&#&w4LHI@BNvUQlpBlXVxdXzsB+YtA&CR`)K-;fyyiOR1~-sR)IPXMbplh?1M{PU^Cfj5gHY z+5!K*A`n^s$pjI0_5! zjSU?_0pTTiLiCzie1|hWGfH70@2=KhyJ0avbkS`5y}!zXH$?x?L5mChjj4Da+C4Kf zF6W6_1ndO*=Rs#OG2E>!_h$(;YsY$k0a@rm(8meQj|1$Q-0YkTu%<*^iu+%7G2sjs zhz6?P178K&1I7i}ATIJM)9jF}bJ&7dQfUjV{|VDWGc#rol{nms?i9YzR^)-IG0y1^ z1_eCM&>WxY+1XhY6bdGrw@Uoftg5zlWh(OsgC4@2a9P*O3r3RFdInyUKnV^K@1WiX zpQV~}qs<5v77?MWr1Yv;zarba6TB-FZTjaMBd6|Z6_?t z@{1cT$q-L%bp=|eb{f^lR`~Mb5_&S*dmU~Yl2(wjgZ?#HMbD945Kbd!!KXWX31QEz zhZX1v^tdQAM!JazNwI+UyXoQ+bB)@-*eSd+9)t+Z8aMWVW!kHr*!x4kq}%bQ*Pcj~ zlT}tx^=cA1(k}StzlpoBih=||pmh>9xNilI zcD>j1ogp{${$MTO5Ub|A@92=ZMPj<=BGRPKMK4VoCr5zw8u-g?m;<6z*Z30FRw4rD&Da+$LknG~=~%oP>TE*2t-K^kd+X&Ie^B(~yPP_Q{iTIV8<- z?%EAhHorZtqwNF+UwpjkW?ukx)>rzrlW(-$7a4(4nCvxwIjxWs1k(>!C7?4`S(3A~ zyxy>~`xLq^6`x;iCuza8u-!C!6>H*+G}{#);N7(Kq<99+=w8=3I?1vX$n&afL_N8u zAZia|nUw^NbDjg01 zDDJ^bE}OhDhMLSH%@DJAQhy1dBx6u$Nnx(meA~FN4H#tW;-YEo>g%2baAjW@O-xBK zv9lw93z!~kq=>nBcpfkjby&~t!^dt`RZg9ONuE`?}!^H?n~7 zS3L`oeLEh++my%qAF{C|(ZsW}i@e6;$4cs^nswA4t9Ek3h*jV86n4rn4&(p?!2B5uc!1=(wF(rll5b z#FwWdTkt8+L`UGEgaq1M)Qt^g#s5W4vEh%UrKS5KZ_7n)PS`Pr>fxfj87!j*vo4 zY*M=n3Y^9^OriXRh4*(~#rWnHu`cLv#JIZTq^LbRoUqeTV}CwzZdc$`kq8=Yhv#*L z`JJ7UGnk_XwY070xbjywIzG&7iCH_yiRTdnUHU6o0czSX z5#vF>yN7FYcAw-iLjqrJdTrjG@A}(Y9;><4(ypRNmw}|?SiQrPE56=X$#&?=#)~Qr zDj@_nRCZpgOI;J<*!|%(PoZ=6&15U%^Zz1>-+s5dHWs>_#K_!8$6NY2-_*{#nte+< zsLogXrxKp&;yUJstnGIYIYv%5)bQrPt_F3;vkRShnQYxlG9gm44znB}}^9$c( zY)MVET;JC+%8->q4g9=}!qnsz|D$V_MS)79NYh!wV7(c`t8J;(5-+pzcRSY3c> zh)=)WZa$~^^MneIij?j=DytE2U)}E?AMY}V5Pc*UcL=R;xv)m==w$!M2Ajs`yNVpMO7fIR`<`kpHMfH&$3JSTRcwAzwUIj?sk&GW|$bX_cDne^+p_|iyzT}GA^2_xj7v{kZ#E{ zAY0G4Paac2Zk4ND6R&f=tJBIWPvw1L3k;s7AVN@!*)GZV3_}bgKr5!uY3-R+)fyjY z_FhSO* z-k4fjXMw=^`((?;*FofB>%qT>GXNeF7>}{c?lO5@b=DM zShgct3dI<7iEriY8gpj>t_xJeMZ>Gl*9~lJ@F5eDm@|T;9g=xatg?g`eAp;{@&H)h zE>o{CfwKmhWY8w>;;-Grg>D;&8km6c7AP)<*SPNkXS1cyp!G3B)XC}OxhT+2W}Uqj zoJmPZr=a4I^x;9d{@ibW?mw?~;)Hw3Bd4yR)qg;hPTk zctwMLa_v!n{?EzDp7WlGBq=r2B=))YhG(~!^1LhFRX=7uybs@*Zr!>VtddhIraEdK z@O*S`ZJV{~=y^%cuBv-~v{-3fO2o5#<(g;awihIfo;)1yT#n5D9W4~(u)$iZM;>X*t?eu>EkNua)S`-t zir{#Hvw}jhh_sy@_x5}j9SciHPJXS>v#Q}~8ywT87G|0hR1G(b11Umk9pPr)*I11?g2iJsL#q4Za?h2l6SXc&CC{@^nED4n&A}JdYf} z1>@7Fzy|?%g&-j9=I#y}L#KXfQdemF@b6#QbY#rn{QH{>d}7+1Q6Hq^-N#7}RNCObaBX9xEzl0gOY|CZ^^K6xv=#Q8H6iqRaAq zfJC8pHx#i#;Bi?kY#jmtQWmv5;5=|!PgL7$oB#b8X_^KT3|X<^_cO9I!YsZ=gt+LX zu9|o%H@fAxOIZs>QJUSa(0;dMDmQ^jhi0CAH(*>a(dJbTs&*ZS$Q`KXfmg$^_jXL( z$?M!)RxlEB0hhSpGHYr?-#nJri~!C#XanM2TB!`zBlVmUP~bn|!SMx?DJv_;;)~(c zBh=KD{5q=f*4fPhx7`;IdR)OO0pPPQd--iQy8)s*JQ1=5HQK+Rba;cBv zulqOZfr|w4oE$Yf1POeW`i=g$rtvMHFOFP5h=A9^!nG?Oke74+3Qeu6#qjWOUBy@k z{>;KrUvrXeEJHHkbJh^c>OPNlr<+Lz#ZlB-U=%9ec(DU$x;anw6&F`QS4;7+5 zXx!tF@dg6T&dtpY;6wO?>j0yIj3Qixw;353$sR*)D}_RV5+mp%gN`m2XuaZ53i*w$ zfe{}*7duEC`z{`4n@>1x7?PJ6-kl(9#xH=mKS;gZr)HhP!o0?`DzA*VUa;A9^?n5`6^Ft9?3XC@OT9{aX5wGw;t~^`>S{U z-F{+^;`f8BKgu3_Er-v?253s-t1f%aU|v>wamX-F7Cs5N`+%pTmPt=7`a3lhZub@< zyCNQr%@;lF@D@R^vns~@W=b3Y%J1Gm4Qp2sgFGk%x&wl!`l5ptC8EnZw?f4~!tr3= zxAViN?I>cUh)=RUs>$~|5U|p$d?Qb7wXneg(v(q>4If0Fz9j&J)jB`oC@Sn1Reo!# z8EeHJ8TZdV_Wh#Qe?J(1hJ5ZVMl{FA>ya0sZ^Dk(`7JYhNab>EeWo%5*NUXG!;dN6 zu55PIG3%md z*ye|gcEYO+|Gv+rIY;S>AjUgwBv_wraf3$ec0lo?;2VLLPA|C$Us$PL;Uf2cMHTcg zKn3Ered6|Y4Xua^SbPb=RK11fBO3etbl1W2)HvqM|L;fs`#-jsA*6Rpo~)9^y*4N; z03k9~Y-fwDrBEa6T%L=S!9IP2QV;s^b{_w!HU_nm87{(D+ui%Do%c(IP0d8wtE^9b zUrq+3F~w%y{L=hsMX1k&;}*eHW&0ics4T7K;}umxoP%Rk3yod_W6hd3$;k?P8^f=< zj5j)~OLNg8rjsob{#osRp2lNb>z9KjN{LGj-P#>J^QHu9?d9wItgttAn39J~x4>`4 zwJ|I0)54@295%Zx%&5q?#^u2?a#V?Jzt3$`1x60>V}T1n((QhYG$*y%teu8!1(AL} z5--9jzfC)&Uhq#fC?1x6Ecb1+FU*W|=q_%R7CJUv$G?!kKzgHWhzd z^q1C`?o<<+HD}2?D zzKq&dh+aDJnm9PN7obpBb;9lAjpcI}Bg~6^^+H)tTdO&KP+NboO-Zw6$_)x~QLUuv z!)2YNrS*5KM*oDjzbCS3a6%H7l|@EpivP#xtLs<2?Fhvr8l9hM@&>_6xeYf-CZUOk`Za8rylZapxP?g@i{A&J?}d-}B6K+Wm5QmO!p? zxW$7*$wk)3-J>z6fo$WH0Lh557+p?3BMkvw%tBi()1R3CJD3R}CnRw`W{VD`zX+}# zigW$RX2RmKHS@6BIhz!ptA5r16*6iH7#{Z`=+NNtfyA%`Dejr%&(AFI)hDw7a-{JDLC8UuHStcxxQ~{`DL%hjp-O! zLN;d~MdDLCSH#@;H+WA9#L)LkDOq|_rx2*uPB|FeD;WldtJu1eC1=Pe&Eh{fk*7X+ z^YI-oj#lfm!*!CBK+qYtlNpJNBESn!Qn{=sN5K}xXzQ;3#8I?Twtk~=W5sB69@nN) zLRZn5k3}l~*jZBNHs%SkA5b9Q&-KK>9(#q~s%6%R%gW(u#qd&7 zQ_DrHNSinF%4;fAVl6BzYFuXDKp~VF`ewxcZ0SJjcN|MR9~X2?hK-9;1rvu>om5cG z7>jOxUF3syvuw_(Ln=S}ihoexbvRoawEfVBQ?Ep%$Ve#n!q<5`o$tS&hU&~rIfPK~PAJ99dC&Kc|tcPpp z3Jpf~7vTo~eLiI&FPz!d@QWWBt(8Vibz_N{3-Pw>?AtoKQd0|qb~h|rMn^kCKdWiZ zzyB}(@&~X93m@~7nA@OA2xAiEtxb3`uOI#jojZ7^c{0IAbW7}ZOmaAe+yilwdQ~N& zYSHmu{VKiv!`CTwP?q4y_e972-Pcf7*tF`~N1Zzk&OgV86+G9t;12|p)a1=&d8F>_ z&+hNO1#yJlMofXH6)8a0RT$|1F);Ei(s!{*1jcfSXcfq2xHq^NB2U^C4y;f_US+85iY243vEifH?LIj9^rWsH?m^@d$ zj^35)Yx=QUYsoZpca2Af+1Bjv)C&>1JUQI1`%_34c_s3(-`TTiya1;G?*zE3r9H%S zCO1;I4Pzle3z0{0%w%IMZynjba2m_w$h-8;NTa&&i1O*vx3OHiSm9q6$F@`$-6N#x z^K`{M&j&agez6hgqmoY)X!+k)3Jm{f6JD8E$efc63JDWj0KI}AzkWS5Ha6Z_u;(QG zSW}afn3!l!H3;&zPoF~Vu)vd&(z5`-eN^cD4h~I zrbmbsc%8YJgb({LkBFj;HoK!6EymSkwT<<8byYORznhcqrw>~ieoXX^$~D-vw3zfx zq;dU>ev#JwT9V;@gPT9DOjKsf{lsSey9O1XD_;8sWUF&J^U?IRl%4-<4`03#uiW6& z@<1Z{B45J&TNZ_9Hi3uD3jT8pKgWK`I6GfEbX~y1KR)$>@k1qm2_VVG_y9m--N_t> zrsr<|!b#i?xbeM(%3W1;z(lMLbcBn+eGvXC(fB}bZvzZ@*ZmwBk%3v+fNRv?N&6nG zQepi;S$GEV8V9|2!G+@_o|=Q1kP8S#gV#ip8!ZYokU!5Op;ywp{iE^1QZnI(+2SoCmA|Y9O%x1 zuc9#&IEY;=Vr7B8w*uM^hzLCsGxMP)n)^SOc+;G1uQD^LKU|paX4mv#)1B*}zFWM1 zxe!OxFYR%Gs>k6{rGkM0ArtuUR*+`ZS(&~_yCt5IxC(94k4p~z>Z-;qu9q>+;<_@q z^=&X}&Nx@fC>c0-f_~13a4XMp$zh`?4^mhtxPGj9@;{-id?k;63A&^kHRif2h%$*XfU-_$F3UE$ex9QF=A ziw--vRfTsB^MmM}^!>zyv+q_f1Fd#Muj?K!9zmhW`Ek~%oe=H52jQ<@15g0G?pyjz zU3JkS56i$g@wm%(JoCrWU5&zq)?#ORZv6v%r}dElsPy@Rd!|#o@mR8~nOK7FgPV4= zk&>#af8UbfM71mMVixz&$jHeL!B7a?%n(P8@^S&-WmH!uqGRGcQCDyK^;sE?3EbQh zp8Hx3TEL>2H;Ak9*W(1OYydh_(MHM1$Y6@Lp0^8a0b#xYZjf%Dc=L+2xp_M9C!Sl^ zyzkFZvj_7=djMR~0afKFc+r1{S6+DKaCFTHn&Q+Rf6%;7W~qZBA~2`m`#|@98y*N6 zo`{jaK^MSug-?zy7}9VFqq(y(=U6rKQo}fdZSi1@=u42$zDb0JsiB%yq`3 zZ0{2Mn-B|XHPsjSq)Pp9OrgD~f#^6U@3{1;I_+UqTNJ$fyE zG?(sQpBQm?(=uSi+tppo+-Pgccd_A0esyt7=75zQ4?%_3x;ks;M}BdUV`GZSE@2_9Hw{AU0p(GzY z!T`P9&Y~*;$H~M%$pV+5$jC?uPEwJT!-UMBz9o97yAfe^*5{?6%*vTK>efs|z@xjL z`lFTmP2)5tXqWA}A;>%8A$q=NeU9-GCIpL$-o9s1dkXz#I4_7J6)3%vfWtFl%R#d9 z?CL);rj~-;uBAwFrCsKkV)FTQPYEMeUTu%Vek$?s*4b$lb8>H&8QbMi;WiEmxus9N zrg)ga*-tC#5?i%hUR?u|yXS*!z)tf&B4lju={%LQU-l0&dS&M2kPZq?n37AKe0gHM z3erl%*d|2VGs{{{t>xuT##|iv;}0w!2vd%Gl~N0I%WpI4D&Nr7DvS8~Tm2DUcWAgt zJaHpNM(@yw{BAqn3x%(dQIUb-q^Wg6@@{slbXYu#TNp0RD|(M^7!_CK#t(FB=heC4 zP>P-{&TdWzHVjP{im$!0%W>laiy`f1$6^_=V{8V$gP+@&7n@pk`la$L`+8Q^US{97kC0HT zrx$Dnmf1sxQ{@O@p1%F>JxL0T+Y3D=03~X|D;@*yLJ;AX>ePWF9d4di;SVN`XnzoE zLCaA-1SbRae`u)3@t8bSQS5oJn*g9< zN$hnQj|NF_Ff=OcZUYRS{^7$*fagGEypG%Z%wuNeNQS87>(_@X{5jbjI_F1fz$XO2 z6Y+aYr#=l_Nbx=+%**KD@II79%viu>%w?;cu>w4ikgk#Vt{YrYk)ZMq)EZd>1B0FT zJHb9i8lai}7VHuM^lfWzM{L1AK>sE*6sNMX66R`p>ns1oW^$&}V!pjuHQ03g)!Qo# zapkfv#^#u~c1CG>RARM{J)HOMY824yRk1hHIkh&o>7wyQhys?FoD3UyzMlxkTqto<)Xz<+Vfn zGj|LCK|&7HNo={;2du^K3*_3beJ3bg&p~UZrRe=EIIOT61W9G>TM}*Wz!85Z<7hm+ zCr)->C+s!muD&HSAQcpd(p6_G|xtA9NbPR z@+?!A5155&(C+I|ZnGMR1B64(mw-FIh>hhgmU^irjul(e>2j5P1MiW{vd7aeW&l#c zOGtgfRLKVB(fh}*B0BEx*jH$R6s_sYU%*h%)TB7|a&r>`hbsOF7hmu&h8N!%Nhbw0 z!ojH*0RaI<=x$F2r-K$u`No3Di|M`LK;&jY--GDj;ON*3b_W=M-_0TV?+$wWOD(YH!`v@s@P!>Z zm=0JKaSA<2Z6xKfyVSX$DSwOfV`b`foTv@<+VGPxO*y!UO5H+!)*pLuyUPW^4fMN_965whtS=_HHhe56<_Ogoo_q0o%G< zAX8bNoPY|)(vq#ezaM%U`=^O~^3Z{D-RYJ3{OMEu%I?php~ukAQpn<|R6QjuYH-vN zKRsSZKLsW#FfyM#L!2t%YPl^N&1p4OZmJ8Vji6A#f5&?^&4d+hR|5@CZ;w%x_t!d{ z49v*b%K}`LGykkEmkB(5-WdCqKzpnzW|)xCZY^}_B<0-eW}RM9MQ-REHZj4K9k2OA z+(wEgSdF}2OzTU;KY5h)&{a10&4}Cy=iA&1c;D1o$t4%Hl25f=xal}f&&Cz~ZHy>* ztIx)i&tbftQx0;~phbp_4G|fp+!QM!Q-gtzwA#<>QYu^UPF`{L$znp~k%iu2l9$i% za*SF|%swg8?0OKXVHP8&n+xB@nuv_TBU){pHx+7l)PKq=@n=>TIT#ZF$&sTF_qSGb z*giP+s;0pnWgN%gpN?*~(j-$!Hl-J1$B5aElD%`%S$BdRA$}%+xD9}I8^HEb31epQ zkIcUg7$T2iSTENl^HCVz6PDNt>kUhGY8 zYH4};m%=7*8GaYVjZV0k^V55sZ00t#D!SkcFC=iG`zz0UsTi_A8G9um* zb&oox8%6DU95i%?{h>44AXCDES!otGx%-~QCdVbYAKV`uZ^Fkjl80K9Cw=R8X zfFc~TYt-F{Asx6VOxwg#gAo-t1YVp1=Mz4QAq}2n6v_x%HUboQAajEV{ekX=e$y2q z$>|ny>)$ZcJ_~)h+wqxP&_IJr;S<=U@$hW(+%3KFPi)ZCmN7G1Vs!2&oH2*)BGQbT z?@2k23+Ko2-6fxR(8rtXvU@|}$n$#~_j~E)=95ipZ@Sxj(dG<_^K*_Xg~GgEj;)l{ zMSAF%+2Nercf%4Ew0yHiVg>DwF85e!{BX$*AuaQ5I;ee0W~n81;VFR#Z{jk;Z7z&5 z<@9M4{vcZ`{V_Z;MMuI}r#JWuEz~&5?nRWR4sQhLZd=t;gk@FQ3f_H7DB|FXUQXep zsSuVqK&7c545HHTZ~8`tWuI1KqEL?&!H9R*bZs%Cu!I~w7_!aB53@!|=!MzP8o!#p zSYu#gj<#v~0I4aRU^rx}Zwd7Ol=BKzo-X=JxYeH_t{`fl1 zVksLwGU%iXV2q>v^PKMAUea!JfAj94M|F|iUF`WT1{NM)%*nm2oWW|QY@gEr&?yHGhHx$KzBY#4fnqerB@2aKA+Og=_pk0Iw7L3$^Mgo;FGl(12Y#|Olx!do|D^&*NB_D;Kmk%^`*a>Viy-GOguOkPtz-thfO@zZ3UT_JA@V}Ox6=f7s9=g-xG`Lrts{q z#6(lbKC`pfF%K}NYw6o}DV9g2t=J2#HZ|{9if?7b#SDEl<7PvS!C!Zu7&n z$GP<02KdHF%g7x4Vx;fBK`*Apxfk-iO>~d~c%FzeQF3x}2w&?$zYaQC;6M&Lb7V{I zzn9$&t*v@H?^Dsm<8(R)qynTak`u6RB)h>Teox+#vNM|XWDIQ#`q^h80%4u=+s1cvWTd5~ zbq-hlS-2+t;oDbP_xV4-#RB2m2HbR&G&I_w(vV{!x{pF# z{@^{rz7x=>x9W6!`LdFbP*tE`qoLtPogZVAlu59sJ*RJ4`0IfzG$Y>#!F`WnxT_EC zjknkRVl?~3F8)b>8NVcQgTvi+Ly3L*=* z(o(ychf6N5dvd^Kc&7YD0RIZ$P51R0q#}F+?&}TI7AFIf>Io5VRm;z2?4Yo)>Auw= zjYm=@Bv&_W4NZ)mK6&HaU@jg56(Js#(6_`KV=p}eESlOQ3cN5$?D>MMYM-!#(kZYQ z?d)O@k;c5#l(B_24AtPr*(6g%p$t|yU)d+asp31{VrpZ05`zB z!TuSs3gwqn5AVwct)XdIgFtHC**hAlF`;&QnDy0xH2@D)Xtu3dyDx4TD!URMW_HWh8{siaZbo;t{lP`z<6Ma7uMo$Ora2#`&|xC zMMeJ^ak}gy0%~e0$1dA!^Kf6I>o~7#+hQJF*}R*|gq1P-NLfUmX_t{qz&0(?w+jWd zAB)g{lWGcM`MS4FO%a3cB>%*PE4G_jzXCtQ2+Tz^JPLt(FJAn$K!hPED9R>4F-O~D zQ!<)W;~O~Xea_E6m$To&6lPRR1_I+%AgP%2Pyz19Uf!LiM+#+gj2eK5{sad6$W=7LtvQ!k6$NIb@!sFxnG4xYT z)}D@w>Kb7YH*Q#p~zvgq_@z{zG!KAd47C%!?yY3Q;>z3I=xo< z_8qAr1h(1MFyrljQSd*eXJ(FUI)IL2B0V3UeiyRgB|)y}D`vZ9m|exvy6QC}$}|f^TofdzQ^Z4@l6E zRRJJJ*2HAN71K|?4<0k;? zU-|jj@l9~kTp7$aftUry9q|nZExqjQN5!vDsAl8h>p>6GG+Iu>t{#hTP}iNWoaySH zCjzv@6GF^3Q+vFQAWZ=NDFZqL&4)}gJOMTNz8}yGtnm&#voP!|vZ)$Bf%2b0SXh{h zzLYhjmD)QIeu)U3$C-<7pFkM>=65w$z0fC$QL)H<-zu72O9lv+85tQ!rjJ~EFw1Ak zw;yK?wLJR8%#^$4Cpok{biOI4t5jz@S>np22ADT*-qcj)rEtD~k?F$)QOh+7an0u5 zZUyKo9S(Y*s?E%ZX*2G4fc?u08E&<%_=bd>$ri%dhLyEuC{3&NX)mCpazGNUdW-@n zdawF4R-D5Ah#O(>^YTR|#kIFxZ)9R6Z8Ep6mh{kMy-gRu^VRgq`+)2xYj_<%$C$=W@iPws>9#?re|fPo#wn-;)p}d z_inl|I52Ftz*(o+#N+b69a%WIO>=g=7dtEScuarXI@=aMkD6_b*se#vR$wvA{o=(7 zgrHmjx%$Cog!gwuUk3W>;^0OLI7;=&RwoeFw&S7wWmPdpoL4bVhWJecPDZn{HCFUfuG3*fX5PNE{l$Nr$ z=YjR91`sEdT09wm%%2kzNT)&?=2oV^y$+=mjz&CU;R}kPKmZCD44y9aW%0nq20cad zf!tI;$8*401~49|7H{%fQ5^4Ym_VfQQ^3RlP6{VZc23UWlA^Z^R4R2qjYb|@Dx5+O z8W$k+7Cbbh4ma@)1iL^ehCqw6u03RcNk#De2B)!RV80C)8DWDPBQo*@HLy>^Ets)Q zO#EJC)JZC6M-RMLldkx?K(IwVW30j+A%l)rI<8LEdEe6r&rb)>$gO(x^KSF}FNSL) zWy7ULEb6K{>7rSLlCQwp5s1Va_T!Er-N%!A!$2k%pwJuoLG!CWX=)c`9xG#w{PaLj&hBLMb3^c3N` zWy65{)A92sH2Gb+pNjA0{c=s%nGna{)XMBODUKIS{{KVbDR*Fh2E$z_cqLFi(*8r4 z8yOu1f76eE`F#6!ADWLq;0q*!JFM~5^m4SnK>zNL@p>ArxF zZ8cJ#y_uNMo^V~Dw5r)vU9Z{K27=pt@RkN#bT%VKI}HY8;of9t&xG>>S<+SmCbe$7 z@lO2tvRWNNDnv;2#VMzu5dNV>+li#guC9V`l;{~5VeHLT`?f&sG65ms!Nh)TYno)p zr(6;6ZkF9i1eQLsYa#tkaZiT9Tz&nc_%*G&?m{(U)V7IJy(Fs8ngY+QU36Vv&I=JF*UiL=e4J7WrrV2PcXlM`?j!@|LV z3F_aKtNuw4(DX&P48JR^utY_^d-+;YQRwh{L39ljNE+e^%;~Y6azno0s8}>Tn|DgOx7_>Fh`c-cSpan9FP!5jI<#3_F zJb>3X0H$1zma<@=@2}}IJQDb&zNZFCJD^u^w{^SYC3Hcv4d@!zv0lRzAf&N}9x%Z? z(;Ncv9mHc}pzi@rwt`mW(-=rjsz(Y0_`1~3pM#LV0oViLdJUs*9k7p(DTP=r0}Keo z<^!yNLG6#(UrS0#5;;HFR*$}6Sw5(<2jjvI6BfWP0?abo5X=Ios5b$6gXjX2POxib z;OEG%*&{<7a}ob(2ptz7iABC2wr#}<$m&W7egPp}aVj<8~ot=FA!NgcI)CMD z=a+=^bjPupltF=%A8_Ujz~ckk7n zu)p}Fh(bY*iKqkvh7XMY39n;IplN`MGSUf$0|gr%Cj2k?HkjT5)g}-9%$zi)oxMHK z`fo28)b50K=Hc<=c{uo~S52O>g9#_>Fnl~1e_v_<4c_fTXuCpYXruxE29}N!2fdFs z{cZqmBlrb8T!453u6%hby{A2zQs;%|xivMEK)D@vp6r5~qq&o#P7W~f`j=!Kr?(l7 z^5cNO3+(h=w|_deFx6O7Qv>lGCIcw&&^>a0`9XIJQe2(0t(XfC`(BuvLtBp zOt?D;ZMxOKb3o%2DC{FRc(*9O3cmsNTDyphQKo5ZU8^s`xc&Zx! z0omjHcrptVJ$%To2XmBt|Ly=`+^Q@@ny|HVzV!G*MIgZ|8faBzE_xOkne=oCY; z06!iO3g*9*P0YXxF@gY!>@JrYZBQ&lj!IhGSEnk`k+1pUqr(9I`i`7REP^Osq06Q| zGJpfi3MBqas8UBR*}%OI5tCEzo1bZzAspGp>3ZX0#MhdW)bRZ56j+8dlU1?yFz ziA?mQmzEMQcDhXz=%FL0@S5ljKB%pOorP2XW9m2zc#YA;nW56{Y$7L1c@39E`NTWa(4Vd_# z%e+KbOk>GM4tJZyWGy8M1!Encb2;HMi;K+VKq&_ESOx%m0vNgllOtQJ#XXS3gJ&ur zWcYQHiZFUIH#Y~!1M4&LgSJSzkC~ZvzuT^>et8DdnGXg*@KQutK>_c}moF!4*51&S zL2g)9r0znf*MRdwt`6flA&_s{!#shVy?vaBD>pn2g{a#*=n*1aKp09_*jpiruDwX`WDia}Zi&-Zh97`cgG)viukj+TP(CI#*#V8SbFX>}!wy2G># zunUbepktVtedl?pMJimH5H5)%k;yI_f$zvg4*E0?AX$aXp(}wOgfBp~4L%COIt+Q_ zYE?xe%L5rQn2LvY8K>vwhJp-)Kh900mIaI{E5$1w#-@^;yH;hH34#h>{{{yKv+q9z zd@GkWvhDJCZ1LaOg_wd&Pfm&kE9KtRtzSO>)?OZj%us-kh-Q4PBj!R}ebs9{1YxkE z`e-?)x3U(b6vp5#fuGZE(sO^4`h1fb#bXrDm_w|y9H1?I1O}4(rD~b=w#V8yo4Ocpo%UALO4O zaX{xDM&O?%1CJ5dTtrwfCl6g&z)`-4uWlc5%JYzotzWycAJe#~<19b{bS>R@22gSd zXuQtW*z0Yb)kZ#C~8FbB43g>G@#$`*ykd?t-HhBSp}Z z;P|`!`x?haI?z}d0zW7GTA#E!mgzK)IJ>eCXgXzgx zo4r#jt;*j*>y_K#+gL;!>@2el0aSV;Uzx{_x82!SHd14>yL)v?D7Ii=ZW<^{*G z%}O^cj5+(p^ZbeV6BS%L^|RDA_hRcqI^h@eO*AYHNF%z>|8U>; zzW?~fVBB$WY|cLW*-xys=3H}v;}Z|Gg`Nb#U!S|5Ce(hyq0(R#e*8mMTfq>tJs4le z6jd}iZoEC;qu;o{JGs|al0<2}@4VLsbw{xDWYa7FkNaxC!-RHz(-jZ z43Iu!)5wiaOm{DM-9?t*5jNO0CbV`3h5q>75rNTS83T)Lr^1>kdwOkZE0O=i4#ry z-oxXKwzj~Wd#|;TvB@Xh#dn_KGy($605*ZfCy%?LH#AJw9z4p_`?9*4gJ4))?K(O= z-R&3l5$rKnk1%S$vkLkXlOJ)*v!dpjs+?egoG(SesBj4*-*ZHi<>bbXR3pGWPs+bnWqQ+b>I< zcHHcsmZPBPnHm__vNH}_$<5A=6%Hx-gtNK3y?z+;MnO?Q_JWG18;%$k*x_B4YwS0$ z2H~UzD7*{!8ay7w!QZ|avF~N4;DW3(7mOHm`6UPgf1Lv>oE0h_I#6XVC@5LcTU%=J zMYONDyhE7b<1OIzhj;tzsnj}1!m<{Y?k}pA+u?-Ox32Z8<8Ni(?k#uKUmEn<*S4cum9vmM z!IHr7gM@i3E|{)g^oAiJ)U+e)b}e4)J>ex^LPfL8BO5&nvf3PU6ILBuG4Er?%NK^)b z^06LhRc;V=x;Rz%3N~+3yl4S9`_+}Z8^4W}3jOp0k{syGakI5^K*Pj@rw-lR+R82~ z%eW2zzIMc`0CqYk>Rz#5aWHOPIe7GsrbghvmVg|?KxM?@!Glr&Xb6AkB?l#ng#_I# zkJfI=CO(P>&!?ODr;HU|<#2M28_aUAX$9bRQ)cazW?81)AI~^@d132|7dtJomdN6@ z(YUyAd4#Q`dXQUN7ENr60l<13&=(B~sK@K^CAW)Y@Gm0=8*67oiCnc|h|bPlM^d`E zzIvYt*z!(hLwtJwSkLm<-#%${Rjty4Yx$h&3N0-O@qcs$IpfV@ND_-7Z(-qKE|YH@ zm=YEi=WHf}W?;`-gh$^)UOcPx=_~>(=~oEmfL3p*w&yc(3a?v3R~B$lDh8h%{}mdS z_a?H>F)ZT*M3%6rsji|jYomUSa6k~DxxcLT1-Z`2VP~}6&m;UB3k&tebEHyTZ^jAF ziz9Ho@GN7acHd~yy^<|eOaErH!euy{8e;PDOyH-N*jkQ56qVYgwP}`; zAMf{Gp#=elG~=1y{lE}a+>{1rhiCrG`NF8_`gKQ!<~^5;xVj|8KS#Xj~moh9&HN`=p6lk5_mo{0n z!0&UF0mnNr%`9yMfff?zTEKa=elqB| z)91juxwo^iIYuoOMY|ClEffS4W3W&x&L>%nk42D?z0fXi(a2QJO>e3HqbpJ8bP#?Z z)n6F_bd}_B0P79N=~0Bz|D!$fBJ3fi{3YadX6beCRA{+I)7Ip?IO&P-dqA`3Q*F5w zJtyOCYe^#@tN&A-12171~90qa zN6<3SkcKNZwnhO_Lve8$psN9B`X)WmB3Z;j_E3(=GJ}QGX`q8RZdV)wDq*bV|y zra-4Kip0`jIj}-HnHwX4K78Ao1A-+9YH(nr^Kx_1MPoq!GikPXq)~6Fg+b_(y*(0< zZ2N6YQn5+rp2#Aj>)-v-smxJ8Gg13aAJpu6o9e67s}1PhCd8&S7D`eng5Y#)QK$`U zb4gRPvwX}cGR0~&fk-FoUo$cWK97uqVlx)k!!_22(q!cI5kiQfUJpEn<;j}ZOh^Mt zR?q2{VxoX2@{t;vdOTRqW{|LXo9wbyvIqAm#;Wwb;v`t2kSXVqgi)U*=pKoQTg#~^ zAOHo+4kSnQdM}i2(IBOR68(N?&|o@8K)s`hLRBk9=O}?t3p9x>PhOrSH59wI!VXS6 z?9(6gL4Rh3x6Xd3dN4z^dsiLCGj8|owuygzq{v`sJ1&)X;#b?}=sA9-ll5Vf>r*p5rQolj82dAF6I?PotiLQze;0khpdemttXnK^VD2Xt;*w-coYYi zC!hkNk5^Tg`7aj$-tmn zkyZ`AIFpwbi~!_3X7}+x>5Ox18cn+?5(X{i=!wbF?;tQpUl0V6B8ft^VWOxT#)8s= zzZ{lNuKuHZTQ^hc5xwT>kbAxQAD<-nw~y2Xv}D5ouppNWL7dc^D9I!O1?ESC)NH{B zE{&0Nia-~XgGgB!8BZ0)j7B+M^D(}!{|HE`EOdUOi~UhD5Bya689vcSViignPnEOo z-)tuUcn7E<7XLX_J%xFPQ-RjM%uipy8eqVsp&tkZ+tDO?rIu`IqYD){em1nFSd&1- z)A3jd6%&5`8kb4qs|`H@UE`?$*it?qf#hioK#bPck^6%F`#1Kg7cfsj(#osX>qb z5=Y+*)`f-T?IiKQI7md}$9|qRB`U>T{%w*#(-u*O z{XAWcpayXpHaI}+PGla??v0_5tsCh0&l4T-d{3zqY3k*pOZQ2f@Vwe?1A8UW_q?7+ z5_HYFZ{i3Y4vf{sxK5>yfk~B;C>3Ei`a-smNh=K1cqib*PGuBO{v7P?V%;dBrmeC( zY=ILlv-$Fq;uK>c!`{inbEPc(`KQIru<&z?$*qI6qMXBn+~uB{t?phD(|a|=+w_A7xL|UI#^g} z0+j^JRJ}2OcmAtYHsGOU1K?U5QG#1Z8qNKyQ<|%_G9MXLRm=rqOsNE&Saq`ZljtBA zs=EQs=&f*NP^XTimNVLdT7FXIh*eThe$_duUUN#wX*1JhUAqW8sWxWs&za_2c7}+# zKlK7FFboN=HF{lQ2NIQ(xb1E4xyww=_fSCQ!pOL5bUN5bxnHM-Z^3Q9|9Asx@J9P{ zZ*<&^g-s9ym6cP@eSokdy5AMVbVZ z-H3%(63XgG4*b6Lnca^Ao#?;bId3KpU)smHHS-AX&u%&Xs*Io*03isdd%SlzX-eu! zVC4o(ZgAoe!1BuXyH&aEzNd?@_Wvx19U07@_>~j7;(k5tyt-OPaCoKOa!MGL!R@|4 zVVv9Dy<1k6@8T;EBjMCnO;;%mbbQKM&UwKe2hyP?9v+EQ^F~hFeJhu}h42xwcQAHb zrsNFZf>QV#2KGe{TSg?LtG-H+_wD>fTZ3mziMriAGPYT{3cxBDz(WC9v>Ss3!>j$+ zZr4f9fgkjNzr{cTqX~TOjRod!*gOn1xE*ZyY!yJ&*MKv{eS5l^+lmwTXxJGyCUWaD z$O%;8M)v|cC?l&iGnc(-zEz*pbVn2v+o%vV{$UU(Utd23W&gg7xoF3OF>{;f6gV8A zCz3>X2+sSb=UTYv-I0 z0n2N>KOa`Y0iIeqg*Qn!gh=gTnI2rx6J6A`_Uo6@TKdg(j8T#ZMgJdbzN2+FZlB7a zS=;8&^mHAUgOW^>dj#N6{Oj+{`ffdsx2{xJ`1ECuiA{sObAyKkX`ZFC74qMlW-^@Pn-y4#8qHn})*t*Q%Puw@5hpemdg3SVaqg1o>S@ zD>T4inL&p;W7i6=(M2`(qj}PW0Y$prz#kGL)BKwV)o+-l;3(m*J*Ud5pk3<>UOHR1 zQ`zS^SvbBybZZv&{Qe(pd@b~GK)`$35}HkZ`wCR#Z!i6xs)1h5jksM9FE&j=LM4E# zmFW8Hn3G+7Y7(S#;xDRLd7_e)%1MR*==}xi+h1d2*&sZG&x4pFPA8lE2D7xFPeet7 zzybv56O>_vxY%lcZzsFe_p?@6LMkz4g<7f^Ls+kO-t(U&&1t}#TmLE{#W5w`vR~Kpa@GmFz;#VXG@N7JMxDeR}#WC|6;H zqLHq20=f-n3IYBh2s@fKgQ7WPC`sjvu3ykVC7IC%P1q{b_+#5Zrx;*#KA09U^pQcG zBE+)6!x^blV?`PeX)dst;QC8c#zZ+I?gIKXnOFc=%TUS>|ur*^&>%iT+l0ychA;5VTpxia>hGBpe)K1LU!@#)>V^^R`pKG9!OcK6`~3I>h&~DL%K@`pD^5yD zAifS5JMYLr{su&sc^eym+B*(jF7_sHn*3Aa0z|ukm<>Qh|1s=I;{syf>sQW9Y(834 zxZyy6DRuC`FMUC0`3N#ydTRMPZv5*S?1YR+>x-tzhMw+e+&}`bmjd#1#SAovf@GPW z60H(Yf#fkL7@?hFg05J6>B5gdB)DDgi!)QH=@tj-7n<=hdLS+@lC8#wyL|M-q>4Z^ z2IWZrNbSMe`MT%uGQ4+df4`mQlC(mjpz^q30y2F4F`xWdhbQPz zVlcseLs)?M$pDB|=IAkt?7da36jhdmHn`nsRh&fVkj^N#L^9bgg=#0r&*hBcccfOlXsHCTEQtBA^=X60{J zovTnFU0welDa*tCCK_KEg5W3ydZV@Ym*>uz=8}-D?K?xY7eN4#%o#8nxd#fpa5ISLEU>0>nkevHrxZh@e{JAu=mq!a|vdiVkK;ThHVVgCwd z{zo>`{}Ar52EMJ|#6AUmKBW2kmu|o5ZOH1*s@wcd-AS-Ks|RPlTc8ntVChyM@=R#Z z9iF<3MQSa4W=;BIhR)dS$LRc>t(*o1DLm!ok{v=j_^VRG_pCjq;?2LiB6YB&e~H7FxC}Y!GdA1Z7P*5$}Ks z4r1T&Y_F~oYpMvpn5!vYSYgypr4!Fsm?}wDF{v{xf;Nf3?Jd5jcSc@)#vp zObOO=MSrvyRu8gTSMZ@({w!+B{A%?@R0e^u_8&B!3qKA&+fy|WWK5D^cD-^Cbeiow zL_f{^@g~$Qm4?jy>w0!bjFG$D5hbFiJX>6c#+x90e9)Uwx)YJYjjpc3?e?8Fc2p)8 z8j;2wXQ?vRmfdZMjS%@ygYx?afm#YTUejYNSD zvO+%uFvgS2**5I6u4o0cNq$f6XVwBXocvb^Pi(PZn$;g?bamO@;@qF@m%j%uzslO> zmkreYO?{YU9dVVOw&-UeQ3_g#zLI2U|2f|t1`aPDWJlM+A?nQ*1n%_<1FY-HQVdd1 zGzZ=zbH}x>U!F+jF4GngSgLTwd=f%CS8c&jNeNKwjXs*yy?rFiRkuayJAht0*DcrL zDMURnSSJblN)?(dz8%_Y0IU)>?PEcJVs6DPK|yLdcD%!qH2AZcos#}du+86J=P$xV zew0lMvl56;a)e2RC@QG5hpuM_`upIP)gg2;o7oDyZ{zw*IUu@L*Z(9yFgco}|1|zB z9ew`y@v48)ti$xO-q#_Nt{cXH}&5wzxchfqYJpb%eS?i>R6x3}@Y|Hz> zR+Z*Tlxk4DE+Tn;mRqYfTF!UL$4GtsuU~Ul*2@nFLbxd;A(Y|p78?Kpm3{xxvS71& zZY8EH+a@&Hdz6R#2z;UhHFllju^Hb48nmk}R58Xl$WVM6?9W+*8bEln&fxkQ`G?R{ zTS%!c;7Yicb^gy)<+7;S@j|d>Z>m#38v_IFH;iS=Q_c0Mg$A5f* za*jTKkVODIBE0UlRssacay!L19N<(DayC7O(a0>O!q@TX?Y5glh4Avg{LYu|JW`4L%e9-7|WXMd^Wl z>iA+UVa1h~e*~_c?%)2#v*XtOJ+a#ZUV^pjyf8OT7c(08a`8g^r;CA)5n{9+N_wTw zbjiU~cqwW8Kh$r&g6kn~bv#sQw!Nvh|7%J8!VdpgKlZ z=~tFJQ7iB@RjOlOI9jxbM83R>?8kwmG!MH2_~ zTjdpdK@4f6^YV+*Vu!@1Tig*r8FY5Ozr%P^-<6wLv)Ib#42iSUH=W3~nW$)D*zo=a z71SEAGa94oQ4>yn&Cq-`K8f=Pde}|K?C`4c{{O)NPNi3G;;FF4$fI_>Afi2^ux8&^ z6A`7kpQLe(L`9{jz8VpP4~3R(;NUenL_;K>Ao}pm%E@#1qA&?w;PWkb#f^9!W%Lg* zty22l@T|7CbjH|y$tS&I98kSS*S%ZEG!q!>Gi<$|(EFxvoeD@|e?g-muo)WVsH~dL zflBhu$m(;d<8SV~pFDF~G?;%EkHf#f4}Jt)MiSop!&^uzQ{Nh?FNvJU51OF1>wOlX zU|GdRkc4t;>2_97o=v5xGpJVtYYJY|>G;6q0z2RH&T6t~7N=SX2KQUFFAaVaryl@` zHYE3k$JMpwCE8_Dl^y|@UQT(Lj4@rWFawDe?2=FP7$Nnx-FS=N}p6^r*+vC|P;Tx6|f8CL_PhPOFeO;gR)bw#|C@{V54F^vRGoro%wmgKZPARas0f#Y(crh=UV%JarHEcjFg(FOSj!7p(XS{Wo;^&x91#iVIs)VwGjsrQxfM z*jIddbe0NviJ5IF*&sJzSYwQUTso(){8Ff2iZXWFQq{R-ve7(LH@ryx-ffvMAX$Uw|yV1E8B^j{R-woN|GPR}$ z3*T(*ZRKU3;beZ#_{99~ENW=ZZD;;=Z)2ZwcJDP7hCV)TjNLQFI1zantHmb2N`1=9 z)#iH%a57KWY=qw5aEzI)R-S7A@4Wj*hI*+ifZebMZRKMI*t3gW@VY5YNB^kFFf0ql zkF5T5*6y@&R^ZJG8(!DQTJj5*H3Fg&K-w=>5=2V!ID;lq4M716vASvz{Z^Tc*^zGi z!3^}PuW&$?xkWga2h<<0M7s=LQYEna)vXEgQ_~bYhPN-Z75IZ}A^5z6Q6)6SDFw@bAjf zfT{D?hYWGdY>B`|9xuI1}16Nm2)>Vo{ zK|=&xIvnT;vjKcG3Gj3qtWfS`;7urFrtw^R5>_FBzYdn;GkDyfxZj6@gPBvEv?8J{!1V@p+r6jf}}Nx$vO z-mSZluE*LWrt7<9j0IjCfI09W=L|YS%4bP@&)q_e!rUmFuh~!@S*c(be2Zd`QX9m( zaEa=HCj4yuKPx?Tr_eYal#5!cUQSqL=2V95V>^p6@@q{Mcg3FR%hj4E^Pwo8SbZ?q0Bts}T;L+ZKQdjYUIkr(LR&= zE&C!KZ@wLHhk!sm@^brwB%p&p+=)oG<|pXWe~d+Um%7oOqcy{CTP84U$rttarzXNE zdO%9NG?1W)yiH|@A1P`2VV|zn8V&Wj5Iy++*~`QExzP|t6~6VvI4)qruF$+2) zfjEce;n`2-(dj4nNq4}nz7TE(*pUNiZdxjDziGt3ic62zi275q62;^lz1X@CY(K0z zlZ_H7S4#X|_D{EO5P#C|zB8kv0?qZTJ}i8_iXXr)a>zmqhVJF}%%tk0cr951?4y1u z>Ss5K?$C3e$}~=e; zvFo65HKaIe-?(d*EL+CZrEO^<|95D4X~Xqpc)lGkgVXsFTBakYv^jruX1pGE@O1I9 zi8D4?vkfn!wqW|qrw2>P^PHu@6b<_%(@!9SXX=YV-uFJF^SN9pGi=?ai9XzFy}@&t zAYIOAJx9XWwf&oN4__O2A?`63y>LYt&)9&b|NOrJ&Y|CFI=gzDQIZlxSnCEv!Xa;? zjQp1Bt1${BG|=YjZ*+*{di~n_e`Y89dvp1f#X(}KuV{5UvkX5!3NgZ0QF`hw$^g+I9 z+QkYNn>yCN(?$&XeUa=nmQ1C6ue{ET!?SSpZUdDuC&ZAU2)=<}hJ_69B)Y`rdhM07 ziAvSUYg}Go`|U%3v5g;FsKQoY!O`mDW^JN#1L{qN!k z#AKI$!|*IY0t)#M11V|N*YKqLc^Zh%V@=1>FKI2qSjoWRVDL%+j^FI}MAnv0ah)Nz zGvPbew;Zl-g)H?4EN$KCa~ zOjq(~+^&RR(LgAVPgqkwg0T}qWo{!eqG&q#XzY_2^UH+~`F(v&pU$`S7J)`p)t43+?99HykqK8V|67L%y8`Axub=sDLFv-W_=Dm< zs-liG!?F9qepMhg;H z<3t35lw0K&tBzHxq7*}k{ITQ;qajuF)zX^%5kbbp}zVP|Z)@WWPQJl5OHJ(CMCU@LS>-;gHoriB4OanT1R& zikKtu6Up`Ehqoq+>B+TUmLxip3?DUIza>`mOGuloVJ)x_03pG$E2huE-bL9e#dH#9 zJ=B_SlC^>@VcKy6w&)$Ujy%<9Nfw(g-GRa1WJyM^$|#p%YDE=}Hz+|SSOeAdT35kk zXhip=jesrXG$I`LswilDlW|0pX4mMWqpc52{CDrZB!3ZV{N4@EsgpcTTJ;>m<~;}9 zlk3JLX2-|DRv#3c75bkva5}{ZN-k?FBaUQn`n$u#QYX`wgDt5sqUevdG(qQAtNYdJ z;Q6eIEETStfx;^s(H>?rh@^q}1U{}b+53;M3eBNM5rpx*efsrT=)fYoV~xEAT0)c| zT??zbAd)WB7?Jb2#2R?pIZ9TRJlu>a*zGGGp2$zqWcV)^fEgakK)*N~%_Y!L&?6>z zmt@;~*Pc>abt{f}G}uGapC3JYa637ucrlVb>>Ulq3CA(ss`PC@i}~LSnOuGIvxAu# z?Jmpro!6a?n{TW{ZK_1>>1(0>Z(`qDQ?zZH1~Yta4AZafn9OXg-*e@hoO3LQ8mL2a zP^mqsB!8X05xTjmszp>|1gPmSziaYzjtTVF*2as6vcrOI&-(c61k2Pu!cu9jxCHm7E&m(8OmjvA{fKlhuCvkBBT}FU>hto?2 zB0drBKdt-kzD@qjw7%oj05Y^#uYy}5e`P_PmGu2&EC?vcoA8|G!BIZyjHu3{ze!l& z=0C=!GU|TJEVG9aHEG+K6f3S{&%+C#)B+_e;Gui;9Au$&ZaSp*>v(F1S5A$={|h6UO%l7qZs6&F6m}A7otdEP5V#1~Aets0-%eMJ-7nwhDRn zR>a{&m>aB#UtPEQL`w$D=1V8_Ox`ojS6%u~+Lcz+r<(Ehn1UgLue6V(Vf!|a^c2l* z+dqzAq{KaBGhhD3c9%F3Hn3&4JWT3kVow#~drSVX%R65~94dEBtCtU*U5 zXyoL~>C5$X zr-&g7bwp9l_rJ^IPXN3EIHiEg0D#%4y^RZZpIV9-T0gzd9rVfuw9kAqJC>Mdc&wck zq8{>r!Be$XLa+8`xUpe-#kTxSL^8c{m5mL-(F-mx<1p#}#bR||;Rs|SrQS($KD(3~ zYmp0)^lBAW-+!14a^itP!8_;|@qj~4#zzqK%wmVPh23KOSWRK!Aq4oy3C16SFu~Z= zwn&)s3Rn-Z@A+aEQ4*!V0{Wq{O)l(vG`}s@?5sHubcH&_BE@0kxddCJ0|}Q7vrWbi z90jj6sf=DD)(YnvSwJbu%Bgz>KI?&{xX|K*L1wPEbX%Wf$j8^He$z1!K`MY1K0O#b zsbhLpO%KSQAQ}0wJ*tajYCBu${1k9HffO4c{p_A&IcW=(P4s9E#WD;CFZ10H3p6+H zmhp8(PPR5e{!ie4xKOtoenAi%T%2fUv=RFSv<)q^Jf@#Fy;=r>U2o#}W3yu+($p|M z74eMtk5n8m^*=F|08dV^%A1N~HYi-rh7 zVv8YzKglDpUxGp}J)fPqVufFhK~b!x-B)ql)tzSrxV3BsRfsg+h_dFk&Tr7$_U{c- zR1|? zM|%6I>Y%^2hNRI<&<6`et-=chfK?6G!l3IKG%i({NE^DI3E~cB2-}q6#TGggSA>?# zx-Qw9X45_gVp5q`T_`5fDWFM~NYM9D(ZmCD?N>;`l0!YW+u^fdBW52fDoXKhRZG=e zfI2Dsp<~NQtA~&B-{9{d1k^%TeT_&L^CjrnRl`@KD~d37Cc%}wTm|Vw-dNEA6~j&B z%B<0ev0vBDa#$EhA&?*{VC@|t9sWoXIv!f5exg?A!~x(@iHBmuj+qU=i2i#zMDJ!u zY-qb7tpD9rY8gRB=^Vdzlw&QXq%;vSl)(|UN4D`v8$D8dJLV}pH+tv0_%-PW(+u%R zSpRt~Uu~%+sNUlUb4^vVnuX)=~ya1=@k+X<;DWM=x_p98yVX8 z{Cs$~MSIH1Lo*FOysHXO6)+{^r)s?MD$KsUBX8TQg`=a3M~_W8-HtTA{&!n@ctIV? zuA0U+a_Mf|^(`WJBwT%|}It;~iX*upyL!G@3UE#5c@)0leTaJMi5>uHc!mTw< zU9<3dz1>fukhAdxpL|V8E#LW%@XP#sfHzmfWtS%ot$H{$mxY9{w; zlO%`pLH=DSb+@S_Q z-*Bg^>Um}=Bdi9SC3nKN?Wfm7*vRk+#;&w_#^s_+6}75Ct*XOdB_-( z6MEG%m!o@RG+bq$<1B&EDk#jsOoj}1y9(5-U1T{ya;6xq=gM8bHY~Stv^ox(_nWp_ zTC0wR%}(?)y3WbGm#2HgS8J8yv0;L`N>6>1p(+f8&CvK*s^aXXabMssB> zS1vVG=#xzFaaOIz^U*ODwVBjb`7XZYY`G-{$R%(HfvvhZf|{b3vNEW4+DjLr%#Q-V zq<=d_@B{5%n${nIE&FfN-Bu?PWpHikcVKS(I-nHCk~CE8yF{lU$B7;)=jQp!c-m{D z2$jiVQRKif!uhPyYU`)aO;d7SjI=pmYG_rtAqd^9+19P)aRA;*jn%B5q)hE+U^bp} z{tmD_yjR!qu-n3Mhu7+>nT$2G*oiHT;HlHZKZGOzD$R?L!2S>ZzaA%Oh}G*X$-03#0cQajYU zx$K1l0+?*N1r=5(eAahz`AndZ|_&M2GsLoosj?St%s_Tlg<{H#5q5h?<=Vi z%IrAhKgdy`JoNzQ6>QQ6M_BGiCDc$-#jXLB$y}aIcoIM#%gJ$;%t?a`+Rl`ouGZ~) z!}^zfEVlUbi_Z612)HPOKp|2(v2N%6gWBE@{$jSi#G3Py!@Fh@~xNx@D zl1V@q)ODp(I5LKabSa3RV;$a19d^JV%PfLN^<@g0%>m|B>%bD{Y65XF?}rh7#_g?; zK^2dhb7#pEiL4L2(>J%+>xrw+G3w8Bi@c&{X9;>#;mM=bRRty1hz#%hl)=QRui#`j zf!*Ko#^#UcpEp@f={Bd8o~u|~SoIoIJ8tB|(*gLZ)?|Q=VTyZy5__Paru8d-|BjHe zG0lIO)k)j%ds#wQOx*2t{$l$9(O*>E8?KMP-XyYHbGkGJ++X#((!M1brV(@{b7>S- z3e$eSc-h0nG<&NulrC8_fYdhiYi#af&GX1@POH&@?#2S+yE&m{sb*-Wz9}Ga0|t_` zLH&>N&wMtmL7+hibe%9H3q>z4e<;wS@gslG-m+1VBP#Q0DuY$`zi;wcT_&9`hHn}`}9N* zhEAq*I@2eBJv{a0t4=oM-@sLs+1Rx4M>0obWJ>LF`RuUe&Hr`>^4qHiR!!_L@FzMo zEM;Cvg%JHs-my=ueFFs2L5WAO$XRz7%_p0Lb-p$%(1vp_ACWC==(n&laz!NHShdWjM zn`*@RkPOqx&H(e_Bq1xWq1xQ0mtuTV~C(~XlF?ODC%N7Tes~*af1d&|!@n-b6n$N;UybkeJ1aQi^}+qSka>WjIJ6p}o|7M^>`|OAF|#Q!e^J)@BOnwcD{&p z;Jiv0o1bW3YVZb;m&2+aV$8%>6&#BuP)Ii|}%$iw~ft`3}WT}A=Fgm_;8}3fS zk*yhNHZSjY=UttMH{3Vx4+gE;RZevzUXZsfwCRW_G^=4zsmB}h)U3sK)yq1_+4vOD zOj6k|TMm5O<+e|)n}rs?4U@qVt#I`xfA>Pn+YYiDvxEBkQ93fo)Aoj>BcicTLN@odznA33__dIRef)(_bmn+_s3R8q^ave& zbox((4gRT1wY&~b$cd>OY+OlBSB}PK@x?p|V?^{d0{-rSv0HgYdy7uPOmeK@{{Hu- z%H$q48k9@#KHE{Xql?hO!a0wf5+DxKviJ`i_eNQHQNh~<_M~w>_?9%DD~w8sAuM9z zcuaYM!Wwl*)(;!2ZBe!%dGjKGqd# zF%T4O7_&5DxIsI!41n=IBGt>pmuig^I;WWPdL~ah;u^?Ft>oVyX=5GX2bUU3Pki}i zj3k-_&((zeRwADS#7SIKK*Yr7#SM4f-dJ^#ficTaR$F7oc5_&&dCo_&rx{=CS~K^8bSeZ1LY+(=y-)tg#gx~)6m58Qf>KV6gz*{Fxoclp{h@9jHKuF zyPXXDmkauDvZu9Ah#XJlBx5``DQco~^(v_s3V9hFgul%nP)uutr>tL*`;vIiba3*_ z5B-fUL}uWHPg(Q4b!&#p1bElg+J|4R>2Y+;yswA zC}4dZ4d3x~+saLdc@-o=(N5-bg*y0#X~Wm&+7Z5{xwyK~die_UddxX*^e+7I+}__> z*)pwNKC6@Gh)gyPS8uUG;d5#3h@7pGJI|0HQv1xJr5tRxSJKNJv^9{8e`&^V* zkyzo~{l5n5ws&qYNllh+-HmkC&SIbd#Y7*w=N6Nas&Lci5CB^M~F3l?y80bI@ zWJm9=VdB6|`=6!ZRoA?sDwAg}o!csrAp69;a4dsd%P`M;*=5>3U!7cLPV?oHr2rb@ zKMM!1oAQyLA|FLZ9PasE;Wm4FdmW4&uz9*rRngM}rJumgmmsDGBs^ID&V#7FR^6k| zZJV^od1I5a4+2wbYitN#x(!kVwZ&azF_f$5S!A#?MnWJ1U0DyhTUY1zH*Xhj7F_!V z``Rq3p-D;a`P21`i~>74{FQJ)7c@<)5=Fi+g2jAr$=K^>ftY`i=crl%USr^MVapy0@SwH(U2OP?i?Q#L6ndj=Q71Q~WBM zNgx8Y^}Rk9y=dasyz7FjsVbLvblR%lO)V%GC=AFV2N3f+1*X`{0S9#4BehgF{-{N= zM*!td*3_s_!!c1+(RzuNf`$y#Kp;$930YZ>A&`a!PkgcrJr`pn@D4$1EJfzH5c8MG zoy?rNL~I&MpbNLM;JM#rQ#JNyA+&TyNmcowJ*000^pjv?gh)b^JZ`T0hlVoC$$?#& z6);TzT`z7F!)lGE55)7Nc;y|=56P*P=SGVQ+X@9Tj63Oa^C z8r<-g_#{BJt7GYzPFaWu#e4pkwiOq{MCzfT62RjG)A#2cVW>zb&GIQGTFlZJa8Ca= zqhjic3AB&D#p8gs8D<$oV44#2K^j?jbz_Z{mvi{<-xs;LRI5g&xqoKoVd9F}N4d^8f=}Z#iCVm|wF*-Xbr(+|#?f6@WS%RDy zD8jRtyYK;tgY*R-F>&!E9!F$?Exdq5b@imFVih2Aj1|hdj0xiY|3}qZM^)K%ZM-T9 zqJ#?4B`uxOpdcVpA}!r)x;vz$1(XhH3F%G&=~6dHcT0nGoyq%t-*?U#;~4}0@WH*; zz3#c@n)8~!3%2lE_3!!ldp!m2w)M#tlOc_Vby9G*lxRAe&v*J^Wq^nRom_9`E{dO6Um~C1zdYMh__jyb zZ&Xx7jU`Zl60sTxE+>**GV&(<`HwNqB;Iz`gR`X?lZ4~&#t;rFfcE0QcfFboA!bd? zv2CioQ{CJDVJ5O@{f2{s6AlJyUZR#y+Z+X6C{AcQ0Rai60ONhAWLwYN7*_tAl|4pC zp7y1nK4>G)zI)9ERtJ#dxBZ?#zohA*x0&aEBZWhQbCf0$$gRn#Bzrx0YzEVA#skd} zg!UsbA_h-bthM)gKOvfS>u%4HKFUpi+A3NQ6QF)spx&ETlo;;+l8b1mc134VG3}D1 z`C?O1Mn-1G+53vS>8#Ov;mT_>>3qHULLdjR*Q;|8$m)5*cz)dM-9zrVR6xS#mi&gk z@9JWl=j6aTb#?+=ajUFnf)TAF%_q#4i{2M}5IyHccX420Tr9VR<&p)vd9HTTz+hxk zz-iCV`wBbSxg~}PueSn2LMnQ6e_XrH-3@RMORQIatzEs=L(l)MG#k2%cIGKoIygJq zukJ)4wvlF)46$u-hetW8*Z!rA8CbFUxdvk5EOKeoxU z4;_SXa6pap$98qc7S5GaS1aHU_>b42rq0x*fIF1-WK-zeoZdNACdP>b&>^_0E9Qs^ z)9Z8Nv{)POJ-3$@fL$^>tKii5j{&e|f>*6hpq_&x3kLiXHO66P^4o0*$+6n?$1vvz zE3iDaqHSp5kv!#oSn595#5f>ZKP91|L07yf^q#4gMA$94>JUpw*=R+&9=JstqbK)% znc~VKM@tus=1X}$VrW{;?Amd>B8esw?>a{$c+r|Pu}mosPr7^2v9n8xz&wTJUOUnHB@37Revlq5r znd1ZtgiS&Mf<-!!D{iQ8=0%3)AS@;h;lTJkBl1euBCKdj8;l4-GU(w__pv2i4=80+ zR5vBgZ$gA=dMJVu69bcaQ6K1dZC3BHZhM78Qj_YbM;!I))1N<1Rofm3!NKU-qji3D zb#CJVb-YgJ)X~(omma+p7r!S)23JQ3#KeTX_K%Ur9#k75Hu0x{_Ia+4&>sWMb9R=k z)FrvQn}V5n6L3L$=YL3{g9S%EAc3gxLQ4Tp1OxMx9t*Ym$$8d4*c{$Xj03A$aCfmh z+1e@_o^x)hE14`3aLEg+yD?qSeT?ph?EKH>E_RgXD|4Q!d#Mwk#xTv}x0(<}20mLY-Y7(m-ZjJ@jW7>Clt_ z^J1BZZu_TX@+BtQH{qWH+z*VF0|7Mh>e-2x#svRpsrgaTu`JDhdNtcIN7PzKE=;CB zTzjuq^rY=M`S`!T+UApKyCFr{|M`WSEjMAU(XrcL2CY7&`+p|Dgeh@D1As$Ab~#V3 zpJ=lnJ5p}9bPvKqds(*hacJ|gJr;?ejI=akq{!iYRJ0&at$BPt+nN#u{Pkv{^7(5R%e7_c3&&~~A z-YiuMOS?E%BPgoDE;H7+@>M>Mn8HdCjLK#`8m$PfjD9@a*_Oa6U* zS67bawq{XbMLYx~^(K#}mX@SH7IufK&Q8$~2y+vyX$EMG=94g%1f+F3rTiJxOgu`)X|phXNi`eD9u-GPhBPF4QQGekp1Mfx=pcoVz!+ zq`??nYf30NUx@Q!@{`fuzr=UtZoBTp9Nn}zf5{Bv+<>rjJ43x276H~Fk{a&#awbG% z#R3PZQ&v2LYikZphr02o>gt5xEi&)GTk`I)pcTGfTN^I^W7^12z35leC~?;pd0OGL zwEYzgwR)$=IS9M_stBN-z-<8ieLjLIStRapZ=Awg%^y*jbYI~Z8(HYM&GEYt1N*G2 zzyAqYWF~_DPQV?_W&|AFZT_u#v~+X{BGy(6_wjU{mYA0N3yh~H8LnTCKgAmD8$I_R zy7DT!2cFm$6({-U!)N2QUuI%dVWPqfp)L=4 zObApoTZJc`@tS~p-#=AHQK z7rR_Ce}CdIqb@^zQ?vKS1kT>KD;E$Z+S>!Jp)_r5wtQL^bylPy89VEpsae(5@2NWF zJ|?Av=jXl5R2WF+>-{h@xExL#ub`56D(Ek!2ZpKlmj`JW8DkuZ<6sDz9(Nu#RDmjs zWHh85afcCd{QPw;J3j6}w*j~tBJBWjAqaqITg@haXS`_ro)8Uk@6Vzf&Dmt_{$_MH zwJ_^2Q-~MH4OxFyX!L_zw>#rb{CD%SXdY6aI_2nn{2bK++3)Ai4c@ zl#!Dwv+R^sJssq6@hi^tv0lpXR9q3+$Tkw`2;5Cle@a~xq2|GPmD7*VvAC&!By zdO*r^d7>qQe6Fm_gjZmCd0pS~pn!2GxM2cAND{g#xQ}Vbmpc77HZ~S#?2s>GX$;ln zjAvgzdPULu2v3@0Hj!aWH_^0CLhzx<^dw)Qb}eOXVaE0NJ9j8l)?ii{Ob-iyUKS;J zi8=LitYWv0vBQ+8o7O!CLEA~u3lB57*8Vux`;=cYl5Bx^<{VGt`10tZq3b)91@M5i z19u}xzs^+i5Onf?E0&v zsV3=+aKm*{Z@7o(`sAvpb}VyP%a|#}v^V4PG;6@`G$KO969-!wQmN=MyAjg7x3|74 z-x{V3%*!p)%Fc5&l&Z5xdu5s*!FBLus<*hQW3zhlgB3wnwBR@ObS9ngHwvQBSwqd) z(tq4-34`yWypn?^=QSby++~sl@+4r6OWbN$Bb#Kwub%Qi5f2D(nIzMm@VenhPo54 zEs74uo|=%3_MhVb@#{7(z#p!GtLfR%V`He!K0 z+_2m6mJ1=B3!~GwHP}56y z{?3kplGG1Y(4Uc)atS#J_jHTYYLm+djXdUK(j<^vR<$R_KuU}H=;AnNo@^;736S}# zkRGuGq zip=%uT((vm*;l^b4|qQnFj8D^B_!aqF~6khL?z9Ub~=P&eI`-MBpntWzCXmNQ94%m zX^=@wfeCKd)I>|cGs0p}0Z|DJu;Kj?MwqP{wtmpzzBX7_r1J)H;db1J zBw}MxZ}^B`y-5j`t$P7b=iqmIL!d}~2$-;^vmKU&?Hd(e!*#SL0 zcCe2T=G#zR%ev(qx7Aj#Ia1IFvv%rrE)NGSr#co5AIyBX>M46t)(1s6AR?!%Xpatv zVS6RFhvNMl|MS9D?@3)cr-1|^SVR2Kw{1;-lYe-42M!bXLf{qU>RJmbKDZ`)vrGX{ z%ibQ#G0L!7Esq_jwM#&=4;*jj$9;V-hyg&>}B|lvvFxOSU z+6=~NW2>-$=Oh;?F!N)9rR<6`+EkhI>amTD{zj4>*tD4+Hf-Kxv3YM^|=Fj0@QCkwALNZf)iL z_ua8sXQ}a;zSH(t=j<%SH%n3_mA(u(3HMi$fS9k!b=EM>A1xy99f?37hEj{@cz8_4 zD{In;4ULUCyr)SZ4d@z#UrcSRUA7IsdUb7+uHULNgC3gSGvvC1(-+i_i0X>i4J4j2 zsxmG7OF%7rMhscy?|DkF8t8#*5mXUqf0=&5Tp!80wGkJgFyaVDpM8FTsiip`AUddn z)t5LE_%c74q|Hb`vlR@Vl(gPPHh!TX4;5c-x2y-k3I+zo{DDinqH?!As|A&aNTko@ z%|GANrFxZ8mV1vr>k-sw$zfd6Z~eM;KNjZ6oXi{~;9Qrh=Q73e^YUtqRd3`VW(Vjg z3Uu*2nLDGy&t7Stuf#D^fJ-^>Jb%1=W^GWHOu}4;t?icbk=i8#gFMX4?YT{VE z4vLR=n=d$vx7^62qQ8Dk?40plMX}QGT+Q zcEP-m=@l4snwMDr;V@Q0d-{+I+iS~vx6k0J?dwbsdLG9UUC5HzF;S*|viBPrzo(Y! z?z;i{J6Wa>yY{Bn)bo>eD|E+wahGAFgCZ>kB43W zeIa4SRBK@YF0gC{5@Qw3tW;hiIf&@Er2Evwd)(Y9oyO&y&Q{!IO#79^S5$JjF`&12 zoZI{PUX3{ALvWpfk|F~mBM4prXchH2A)zN@b7O;&D3qhVEE<_RxN}`~kMvm4`C3$z z_^e4UE%G_V`*b=^Nt1pCs5i{+)__q(MYS^lWCnO;e zjWq(hkhe&nL^ee|?0GFscz9Bx{tb|$53zy}{4-(wX4z$Bw{npufoJS^^3Q%tAIV{d zVPj!J(TQCa_?$rO&dev$j!d%Q6;*X+4NT|EEX3VbqP3t*2Rn+h7dOipi%rJ3dwor)Z$BaBy-yO)=vbnL_sd_(9ES5<7R`ayOuj zzRb5RN`j35Xg;7vfItQ2tti#K;*zR7R&n>?55~r*P$`693}WDC^_XyU{xEzHhm>N% zYcnp-Snn>>$VI-O$L-KpC{bg=z`&9v4Z4A|fa9?d5juhfbjS9LkH*!|Imj`S7l`g3 z6n*kK_1DH(%O>JeF_fFldk_`14eI@b?$6_{QcC^V2^ z3(wqbqw>19X9wg`_#|Ai(!&)geB~HNGzqirN93ZhG8=}XkOu)k%bUL>1cbYsY`iZO^j_o_ zN{A}&YX07M@SXfF8`omnrW2?AUy1gT!Oou_BMS@r7BQcoLp7pg%n}!G5&3Hj&Ewww(fPNme_Nz>1RW6R@R5Uuu#lBCFN|WFv9h2 zIgA5raK~134Ez5+hOPmF@#h7btn7%Boeyb~$s0;*G3k2bZEaLg+x?gn(|>$?du>e{ zo?Qqf6c*3}qC5Y#@>2eyH=?0|t!0o%Yq^;Mu4!NzVHF3?iLR7UUn;+$#Pv!^xb105 z8&@1Xz_^p3EQ|v?fs05scGre4SC}Va=p-$5%V?CRb#(MtsrCUjP}N>hhm6EnsKjr{ zcCzK9vHrK{$)&mQy-Z5)j#~k0nob;Gf0l#y?`)lSxa)$cUk8!y%QLN?A zx57M7C(OM~PSCldW&i@b6L5Gn^r#!0Mk?!~;l1$I(;8yIn z@%KXg1G|33zwDY|N?yIj0enY`_4GYHWuhI<5^qR{iy@VkS+xgZI$;mVRn;btarq-llk4=2O>KYl({2Y=imP3C7$fPpopx5i^Yn`| z+6Ko=gN25wqZ?Iu&&Ljuioh@IjJbGa=hwo&156vR#A(oD-f*5+!D48F#BrIc2NE6*Poa4yxl@+=Yp7yo$3`9+|H9{6lc!XolA!w zQ<5YlCr%KNvr~>UCNOfoIBQ;CGxvviC{0*`7k3eVweC-+zz+>yWYnP=vl-B?L!zo*LN`h*7P z2Cs%QWu>))tifdl5gv<1w}HrsGaidpaQb>hvbF9(-Fof*g7^0XMM;ADVKy^MI)D9 z-Zyb>&$US_4_E(tRf+)YzL*y_3Sp^#h^5fgnWuE!}Deogr>7nmTx z_?U<3YYD2wMZ6OIehKaIQ`}ChO{25&$WoJ$`+1?ywMO6tOb1O5Jlm{-Z`Z$$hTHrn zH`wj)RXF22(qZlQ8Hlv3*(p9Nh&JVF^$`;ID&XpGLUu+DDG&Wq=1#VMh9iG>*}aaZ zip$N{V-_FB?gV*XI!}6DnV4D&OTtF7m_mmQgf1&ra8MADEurX5}qv|Z&c~WljRo#&^W+4+7@AF%A zp|o+Z#oSo;(rM!T4^(N1h3mIF9Uz0C>a9f-wWCMXYnOk!YhuZUx5)Izp>}P>i@9xq z(01RE{eg(#N?PBZ{|4z#n#g6(9E9ARz!-cG3k~xoukkk4nwo{RCWQW~Ab_WpRm%}9 zNw;&9BG2rezVMG&0XG2IiM`t{a$(-XnD4Sx-TdXt*V|enPm2qe4UUAnAj`vsnY)8i z;^(iQ9f$h2b(Q&}LwP5I+8OkhOqzAkg~^&*uCsa$T2uff$!7dhy8U@GuN1mHMdsk$ zMM)RO9eynh`sqm8o{{Cdpi+RTEL*bu*>Yp-;Fft&eU!Y{VI(}Y`1_pdOn8riN0n?y z^-Eusbz?osL3~kTx^4os`y!WUtH0cpiHXzp2(jUfFZ3&1UtE0rmfQLv&O+w7w~qVm z++JCQZj7ED#u)C5+`9CnS0H4Ze1`oh&OwStcE|+-tX`y9g~jDn1t92`=WrjQM}+yy;RN@}NnGaC0p@z}?JNr|8RxBP%; zvy%&R1B)jx_4$a>G(E6U?m4*=`Jo6Mqn;(O7lh;lzBB%$ngL(I(n$vAyy->ZGl8;< zj~_buM&9&>J5RQmewPGod`Nriu2}KS*~6T2D`fx1_$hTKc4Ht@uc7hMPOZqLh*H1C z2R#BNwX*2TR2Do|9Y1}A)%CUS`lV&2V+0@f7T|OpE82dC3-`)@)U8-i;r&E@^l6p+Y_{U0AmfB^R2X6S@ht;2A zKP&3E{~J%?|Ie=d-$4cnk1twCqTU?6FKU)GocH2MHq*?;RRfDxm|}c{TVuTDqtJ(3 zaGl-Ae0=b@xaH)!HTCD%Gg`iHdsPf_+45?>q|)P`7~te%mykDM)Y|-3Gey>#{s4l6 zLHUGwtre#_pDVn)2m$Zdj?;G#AJj{&sNglO;7)7bCcY)ZQEs>6#_8&~Vt*WncJ~e) zNdG8%@73kMRpLi!WBd9wRbEb;Oe5`-8^v>~aLk5k_hoW^?fveqzU2Tq@9v#9A|V+R zQXDZj3n2E4Wzy;0;Jg1K+GVa=XP$VYZQPi*I{x9)vy5`f5)1ElPm#*z!;HX;g&8NFG8!yWU78W)}zWuKFr8 zM>ZB)h$-Tbk9V?&hr@)a@aoI!AOG_L%=yW|b=Gx%MstP(N4@l|pgWC$7^#0pV97Y? z*WlI1_U|mQhFor|N(l3bEB~t`lT=;ULDh){>I$$}REX<}44~*)@c3F*Xpn#I56E#z zq!O2MyME;psYi+V`sEY9Dh&~Ljq)q}5JX>tZ$mIxi{?j|QAQwIb-Wi84!5Q|APIcJ z2;AKa`g`67mD{BY0dx=^K(jX&?MORfo{@(R@u1xd)ZPF*56SqlP86cw!iDiKFR?E~ z|H;Eh$c@=$fS6J;w(-0StFj0&N{YqB?V}fue60xoWHggrspf`E(K-=~L{xy?$RD(VBI(atkh>LJo5J8hCp5mTvw`LstqMFm%GpX!3pw(&Ccxrv4T> z@kNTUMur+3tBk$(;yNF(Fgc$zy|(9F+ccwk7zrhU+&fDG6G?>R`vy=hkmclVy5C|e zi_8gEk00RDqmI{Q%CJorbgAkUjX0W`GHDbuz&NE-f1~gLxjRi38PRm3&gzYNte9da zTR^QgN8`ZII=XUhspUuY?6K9lVAcm&8C*g3n|_~gjiXbxTG?a_PudbTS^h6fz#pi! z_P5NVnQ+ig3AYdw#SX$-VYg@{>S8KC=Mw!HBPGmQiJkvvxUgeG4gj(JBD8fVmmu7flyVXtGZ5M&t`){qdJhp&VUq?8WhqJ1h-%DJ9cSfzVHgLT6 z*2KMVN4mG_)7u?Y!VDN~S)SAq3vWKf8%G;|{?7IbyaQ}*6>Axf$zYe?)7*B^$j{%O z+;V&8F5$9sNc4y0sW<*~OVY^nI$i3Ur>q0|D=qeuWlmd0K1Si=_Kk)nHFv{;_})wm zwB0Gl6Pk&fSb7zHWv`(U!X){BuO#Riu}jU#)B+7rZ47_Q>+G|0?3qL>a^Qy!r@Cn= z;{0ee`1g$56PeJnom*gpa#gfO&J}0uDxc&f6{9cd2&@@ z>XkDvr6`IjX!DbL-u$a^TH3`Sz5MCT+mAl14;GaaS<#hES~f%(UfX?WSC&gzH{fNH z(#}aT+Lw-^Nx%u83JVMD8a#Z%S^P(Cg4{!SIs`Yhv&O!bIEX z<{BAVCXQZVh)iOCt8b6!hDyK!=G4El4nCKFDhZWbBUN7Uh*}^LyD2+RGfrT5 zRN7V>m8Y=C*icaBXqMo{%6O2A-3WpSFF{QvJKNp=&(=e-8Lvk-l#z(PB$RAq%fVWe zYPbpK7T6PqsoB=1$!(4)$rc+qu+M{S!n$q3Jn1y@1ZL!o5LgQ_3ZhZGz?Au$c=pi{ zy^U>c6=Vczyd%PWob`hbf@yd?>Ts@1>D9MHqk%Qv=12<5qflwsKkA>)P8L?;=}ncN z!$}xY>ZwD8e$YSi=`qwOO)NOVa)M`Y{%@_wZ*NO=*o9C(k-nFM`1nDRB_)h0R8xJf zZAs>c+DA8;c-hFd!ZCU7V@P^ZUr$weNnhJsjsol$R7pxDe7;%(qnq*#(xyf?r(y4eJ0?l0D zZs0;qiW9YzXf*X-4YV#f=SSf*t4FdB7^GiR#TnN}+Hehg@45}oyQ|v)Hy zVl#$#9rdn;kXv3S^R^P5RHKDGkF&LL)oG^|zEn`ez`_^lCUXR!yWaU2g6W` zmbu@nonHnC-72LSG-YML6|43gxglp{6LTKk3z9l=6Gwb={>~=bCmoUZKZ53lwCRcO zdo(}d?#;C^;STc-vv;5J5hkx={$7aG`%I(H{(0jqzELgKfK%5?DqCD?xfF7mPD`VM zNed^kErWqRhr-zE*c9(3gZS<@pBm}j@!903=<>?xGRd%!pgkpQX#Aw74TdI|7)XlL zp9;8sM)uP5eX=GhQqOADtrGbIU9FA?pA9LMrRVrYH((_42f3Vn=C{%oK3bF@P_;1uMF}f5>p08rtQa8iGmPgTBZqqa65PG0CPf>7X&DCgpJJyYtJ)<%N^-7 zgE?Q<=Vgd3XR;GvXlewx-Y@QywX(v}(3$M+ zdE5&FzKbJ~BH~WQw9^i(WRXcry|E2zjuB9<-XKn|%a6{A<1SS)x>d&e_ zS)L8dmuLicDF2?qitT%9yq=2cM2?UccKE%avaF12b8f+duAI##M0({C-#Y0a_w0~^ zEDY|}p#zsU=1jwIOx*7V7<|GvLH;79zzxn^M@>xa`z~$DA0+S0!T&Hl-ROOT1$Kfq z-L8M2ULrwY0)uC|8GoG~WKusKF-Wf0tJOQ;Nw0j`TcE?9w;5IAtzUgd!T?*U;PqFA zIz5|tLraE|$+59;kq2MCP+%i(%ftkUoILaYX`mL9z{fpZC?jI3=aNEd4*9 zWz}S_1)bp9gnnD1dtg9xnCtKQAf%vm={Ug>dFplX_1jIPT1W)wo#4W1-n18_Lm?m# z1BGCB6MQ~C^`R7mF38>c(s+VECsyiagbA(cL|Tx3=`V#C6*s3nLI=>_Hn#4qJ14Gr zBVfYN)&|BgoS>P9F-Y?>tT!reTMv?WN^DvL8`iWF2ddfl9xkTKdnK3dqO-^{@1RKp z`%~fK;boO|dNw`GDCMPT4**z5|2Gm5b!jQvhbMPjYo_p%=B{_7F#8MW*E`jdBDoa6 zP=kw*>@X_jGq>es0byFau7}69C5q;Nq1ZcF=L-nnl)Gv7;b zD&hVt>?Kd8to+$UlLe+IMjZ7^c{2?RaPe?;%hhuaGkc)j2j;ralLQY?re1Jq05&^( zyU|Vj@&QM!PBsisL&vmGw2OCpM!llG8$i`n_G3O^-!?1zCL0%5SUv(*?oRa4mdHzZ z&8nyEQ2rDcj{groy0!j=CgNV}#4K^BUL4J>81&XBpZQMY?nx(S)mtnYj=qRybMW(t zVl%+8C3=T4#1p~JuI``y_urYQ_0tlP&;q6YJ_B1v_B(v|oH15fBG{pnrC;;!BDoM2 z#I0sg391UuU2UH|dNafEo=Hk+po>Oiq79{*dBH`D#~?-wchRL({qgHP+k2Tn$fYN-t&h1(_ zadt>PuZeUui)DVo+#g}Js>U2URQ8c6d~Vm}Rr!Qe`2=)ZZu`v@MD(-CLjN1=*6how zA~dY(QURc^$wCL=i6GF2S_(w*zc-vp+91kaYwdqV8B89OY9M$gUV?z!e5BBDq(~Kd z!gpXU)@Y>HeRZAqOJSiu*bKmHD2>PJF?CVlIl_p6g%Oh!Cu?GY4a&5+(|%&p?bXGT zZvx<})xJVJcPdNV)!Uz5P!JRxEQQCMIQYwePQB8M57T7u*VKeGC^kr|)h2bTh9iz&|7#EyM_>`(O&gg=Tf zp=09VL87dDvWG7s&4xR_((I8O=D-RA43|Dnt`+-r_3n9~4BT|mE2W=2DV->h{Y(wr zx!C}G=eO(y$)GZO6nq=o`|ydO`U{xM(lWVfp_=s8A-gtM%q=EQ>X&dbM!k>MmkC`X zP=j%EOVdA6@BMEs*UC+KtJinu+1GrmIyt7Ii~^$0ffIHIly0`;-&*BQSr2U%`yN~! z7*f^gWgt-N@^QlROcPTzFPV4hkTnZ+C#o_!)eb6uSK5c$nTl9a4^Pi~M3+_Z&VBTf%QnE^0QMh#Rk&pU?a*?%F+j5||h=R6#tV zgz_MQ)@7*+qB5_ub)xOCBb;HH0<;K(6JB4En3gAsISJ!kRKG&Crm(er$IuX2Jhcm<5 zJUOZA;e8bM+G=AFeRhclAE5_JFu~?UWGJ`!2TqKI^xfvW#TV;&CY( z?PYb8M-14KfX!OFhB-KFWM9)%z{hNPvtOg!F-Xo5RiLRTu<;D*M#(|SCR4K;VK^qv zj>~6*PWhi~>8XUs+!9+Po|$>USec~&KzIaA8do5X$&$jJ@YQ&bfgvd4ki>K7l_Qf4ImDwi2PPX9h@QHKc; z=rBs0XKr3DN_+dytQgp^fgN*S{Ik!er@M;*qJoD%6frRTYfpQ!3F=xl)Hz3M5ch*$ zhP5$bpZe0&7K=l5oxCU=DH_8=Q3d~ z%zmAjCxhW0%z2#UrW$A(-BHzP3{zw3pc1*lgo%0MU#%y%QEnRdC(FrOlgApd!?IMa z^L&)kP>Y3`+ZCJws~5`3UOVI>#uS2Gb(q$iuKH9wGY&!#>w9S;r%z*zO0T}ZAR_u( zyBE^CD`>4GwCONTiQ6*=|Kpum)n?b^Y97n%n#IKxXD*`N!j;)4u}s=Oz--Qz1Wjus zLBO5%@#CdON_hXVGspjo%k_9(Xon=y@VCUS;G$m2Q^n#9NqefB9N+Ej@}L5s(A@oW}H6 z#CmN*BjWyz`>aWWyEwA{4vy?se?DX(SFk<_Tlk~2x4(B|=S0RsI7W#hz;a?}#DwLZ z%BMIzBGd~MJ;A{?+hm1KtD3^L9WG_%wT+FO{0zYuTg=6!C4B*`LE)=M#5@-I6A@Y% zSQ3G;&XUZ<2nJ6S6!<<0YHw~lHxLtwG7VE=kYyvFcyRZ|N8%nn6P?I{V$BfCiF5Cn zt0y43=7P@;o-tUYLLCdu?uq!?Zl87K*aQOSJc&`?=w=^Ni<`sK@gVJ50B; z1zdlb4W-0Y-RR3{dX?X;Kb27_pW6AN7A1ARjc7+6V|kAbvfuw|(tg5mH^L}&uEGMq6x9xoky(}^9jR#w8Clv@gt1K64SOA^X zN$wp2mV}x43_%ej*%gKH%gZX@XG_mSKf5WbQNAvG;Hjw0eQj_FuU@<$g7WlDw_o|L zAod+KHg6XB^Gm|N>+28@$8Inh`X&{v>#IL=Kio1oip}Z}$te3%T-=A^$3tE4xp#2)0mh+T|y0}C)HrKLqt0U{T>-^xEzLv6OFItZvYTNO`e~kBl zFpT2?77ASw>ZuG>ecw*QN(M3i(WE2V%w>maDN`s6D{xwA(!|g`+v|4UUW_@K?7ldf z7Ju;qtSFKvd5->h3OKqKt!FSWh~K#b=j&YxMekbc8zc5GnYYv;Khw$6eEC?8i`#zw zC1;|pIWC`7e4vjl|KTW0Pm@f(!3pC|{JW&yzX$#F zMbeu!noPZOXm(cYEN>ALAvQngn?ae+VDP7>I}-2Qi@e;#$V|^_ ztS%)m(CyxRi4n6Z%On>{b_OK6?oq1e#%LuPqvfyBH-q!y_kRv%re7y8ye_M3phJfT z6K*#7&+Fju011Y#@YGpG`2!xzdwk6gS?m4uUai4KIHyQa?V~(EP;(G)!H6~5oe{a< zYtj9v#L)hu165_JDH_w-TCdfAchdPNW$Zxf4}YZ2#i1<_vGX&)T2kW9p+}DGH2#_r zcX`9Q+tBcEiRs)e7e!2hIRPq6MJhqZJ$DQL=*SKdv%}pM0fah)&kpnzO!seb8H0 zTIE*pF5JvHDKFletb*oBkjauYV;<=R7tf#EySl zpk{qw;te+@QqXlHsM8(Zh7E&}R8ROd59O)978InHmZs`l9Xf;QF-d1;P0dI1B5es} zBfjE>y1>0Xj{Jgx;|t`Vf}#*s^I%X;UP5!;LnCn+m1qlezDJepNC;#>_Bq(2^Qcc=U^e6BSicRdC zdC=c$C_8n0)J>g(c>C_1DE%if`1h^9O}w(TeW*w)FF3Jv|2jI|-EE@ZUm0xP$@_4_ z8ha6R==4y*{oLX*r93DPBU;Q<;!TYmKw)gK& z0zRa2RwMot}S-d36qZ>~?Uh5UzrBn(DdaH?nAkY{ep z{>NXzr_7)(e9HC-E31EwcHKQylqg0fFZcAd(*kinHmt~fS>!KAX8S%10b*)7 z>PH|}j7f`=w6daiCvkUkM_=;)>40glN}wJa4$)ja!A_y$O@|X$$8{@(L`Un(P{mkI z4iEdSao$~8{IU)P^2WXmMUvW9cSjt{TZV01KAJK~Krk0h3tn-}jJU8t-3bg&3Vvxo z|F=7A!Pi$Xmbo$6$A@kArEf-S>xQ|-1eVs+lxd;_LW(^UnS8^YEO9NjZntdz-fyBn zA27sJP{yT5c=ho$&6{DQJipLjTiNf`(^Z`MsB@niD&wt=gC3&Ags3@dR0*%b@>>Y* z-VTy8j^5^9#;%`RFeJ#i-7`2B*lRwzBS#!5SQ*JWDU`DEhh$;4R5)>hiZ`OyI(0(c z)+Y_kI<05;zWK5Dr6*N+?x!;SvE!qPM%V#GO?FQQg^wO#d;BGHpt3K!I8CesYvBw8 zgZmNbbEFa$IiCcay9W#FJA#px6V7%Qj^Ogcct`hSxc5~q^87N-gdM}rhPMw4pl^;g z8Sp^S5WJslH@Q`RjgQM|$#TQHWwKP}JmUp(+dvb`%F7E7u+r%s&~mStt6PGZ;OqHJ zu$B;T-ZX+Fd}G4-y&4nNJrV&gU%qnVy-|q2U%!4drGCvODd!UKAa2@5Wv6TACYNll zaSiG%ALOly8(z)Z6^I)x5BF2~2fHjW3-a?RSVgRdWHreW>b{#05r6z9Rk;4H>Toyj z%rS?ZI52|!U#0v_Un<{l;k3wJygq?%7XEq!x#4X*lvF$q?!FPS`d0-y$HIz#6`R;- z8sUns-{U?GZ}O8=R%T$3Yv!aC5xJ^BB&@kEuA~WKg=B>BAHod9IzL>jgg5oWi`MBw zL=_aCh~uX2B}05~|B497c=OJ#3|&{sc31t#esKZNui75A+~V!x4vvnTjy;B;$mLiU z$j+O!(Vbw!u(R`B3>1a`GCS@hG!M=-gDK=wktHiiaRqt-={C{-gy<(MpF)Y$4tIXa zirg`(bctxQxd@%iuwBuVQ|4BZ?R1YbD^cO^k1i-$sj4UcQk+XHJJRB(bMbG6&&^ba zwq$cO;UJG85Mg(KSzTt(iwe#ZKe;TwriXDlNEfD|HUE><_F7iJ+L#JXPfBpaDrF8m z360%NVD*lX^g3p>aM@Sp(#rgrm27<#={@`Na_W4;`wE9ljQda!+j2FFMv?qyKi7Rb zEeBaKLVg7YQnXITpGugHtA>B}1(VZ>+}mE*i!1AWeHyXiYFZbV@pa76U7NP;74jf` z{EwB>*^Q$0S>DX*1%530dqoQX=giM|(1mW>Up6sTbI7g#tEC)uPGswrSIYMJ?ybvR zI*sFca*M^L&oQ-DwwR$=&3OtcB(o_~Dd#6MjXjmpW+$PnETYOY8YR}#55lK&E@E)C#r08C#~*^3>6Ixl7O*|E&Bwn zQlE~%(wQmh>vR0ck8B59&e)rsRjcc~zA19XjPDG4WI+ZPu|8_JXJ00tK}g%K9K%r= zKNB!WKKmoe@BH}8J95Q!(ssr~z4otg(-pS2n7A?~W=sy!ZvJj(1c{-CtPoG(`R&y8 zGOPaHtQaY?zr=aOGhK6j?m)NvVRDKdu%}*Q$k+Wc+3(ERWZVP0dontY-Fl7#aEzf2 z{Ow_5_q$l>dnVmJ1R+inxGeEnbg|r>te)TnKj>kkc!2Tf?&2GDt==ZBi4Xo~3QF7p zfmA_f_m!yMmao>b0u0wt#3L-gOFsE?vv_sIr^6r z53;ffqo)L_-l!;u8!2!O zNp|HLFAlBTQlQ2*rQpxbLuO(dk~1o24)1i_#gpTtVy5MGp2*$feY6j>Od5ZJP)onj+dl|8hXt7@kp?%iljhQqa``vpoY)xjeed*Vi%7;0K(rF74vJu-|O=~F2 zWzZ|BMj9;SFi+aq=bTHLYY5~y@C)cLq(~@mII;z?Qe*I_5jBO6?srW`r&RqO(Uz$Y(xti@2h*0i55l+0f@4M$peMxcRv5Xk& zUg6l=SNrd66Pxi{e*Rx;);~SU%5>FVqb~p z4QX5^+EKb$!np4OF>O>*oIC|VR^L6>><4>u=Vy$Z?#vX9uWmaI9 z@JFpLcRPLnUxY6-_&|L7jDSq!mka{&6rSYBfjcvc)%IR^`-%T%ciTu)#=I{vPmKS+T7Z?o^l#r%fTCS$eRUI$ zwGQL)9a-h4%*;U9pv})`SlwRFb<=!|f`S6rmbYqZ-+K#YzGPj{h+bg_2P%^rcz@>hD+He1cZtr>a9>wMm)N#PKWRvGX>(95mO4u|A97>AhUhxC&l zl7U9*26e0Rt_j~iyP?k%#31f#DYCOXZ(P_vP&j3J^xtghgNOq@w}ESX#@7U6=TvDq zZ9*e%#?{Io8WV6Re^ncttiV;JDV9fvvuN9%g}IhooqWz=EkX%p`kyDS{jl0 zX5ccoze*(nowlak5pQ`Zb((9nx4jlj1^DP@_d_5n7N2<6sZ3BYrGG$dRi9z3?mHoCvlpWXD_uDz0a&+^BXK^6x)q0sqUWk z%HxFl|EiGQGucBMG%@Q-QW$6;T*5cH7-4DV&=6>#5J_u3{*#uG&p^{IE)&m2Ht1Mh z$v}QQ)R>v*l91D#KcNc1jQ5+oFjxAxA50GC?BCwAXV$D)%Mmr?hOVx#POTHWMNd{W?_K7m!wo?qbi6AK=;GDv zBm)+`iZ`Ft=nMsUZXF++Cv`Qt&WgdNftMR5)wNaoCoui<#p_6S=zXT?5d$-Yaz%4$ z>x`+2`bYJ!`2x9x_|ZWZW2Rv9*@V&0jEo?oYNgkVDy3o0?-O=VMQ2mLdYu^j8&~rx z!@iKG*M{qNJFQ8-O;KUd6j1bh$(gs3-CT_}youNqf`-Nd;5UEg zVC|Q^Cz~hXe&;bLXmd9tRcX+d?sz9CsIALZ=tRs!RZu1HW67+kTWbN zG$y60{w$a;!rK2vgb|2Abocd`4c_a~`g(+^LNM_%=?BhDChI7rd~n4w=7{3YD-fV+ zVI4Q5AgmKPNnf>deDtPG?X^sV)gI^2XKt>0Qkgjm#=8#{1s{Zw&!mY|kSX?@JDH04 zS#f&{ez2|kTZd6m$pguNq!9V?3c^>+)r{nxMkO}x9=qjCmI7x}rZZC#57$O74|1Df z?yb*^yXRw)v8Jbns*eD$vLLRrF+Q|kxF|@9TaRPukae!){y8%0^`reCWbWTD6dCeK zrBk!c1R7((0iLq-Mi~q*R#3KO@iZBwZ6{lIU;m2FWyp!fm@j1rG&D_4`Q?&SY1{Da z>V~T*j1IBq?#S{7k=_YyrLTXR2DbkU_65-ENXOt5ne!%FyP2AY1>x47%T#0Tzh0g7r0V!sI z1YHnvp^JK7K36nyWvR%ekks`qSdGtTkJ8h{%4DZv+-qfZHn*fYGvz{1mHH4&lKFOR%@Fhk`3Y_7oPk4e{m z0=AZo!nz$sstUtF$X{-0K?N|GONJmXZB&Tgm|F);-PJm9dMaQ{OzKY(b6?~GJduhg)ov{Rz{}m^0SDwlgPMweICXlv0<9 z`mKR|m8o6PL>FB&#I_RCc*bku^G4ylLl?6ov}lYQ`OoA8w3Agv6g~%;bBPD`TXv#eFRQrU#Q)tMH+QKewdB{!uNuO-MtbUW%6&LPs`rz7%K!NN2tf~@~z zkIG2z?n=z*DxaoH0|@rNV2-vXr2nT-`R_|R%WDJvm|K=As=Rj*RZ8ytw_4cF2_ln) z3Qz(IR?O=XtvwEH`ZdvB2umz!<~>T~IdQe#+stRSpP3{{^ZCouUorI!L5=v#fI0Y$ z67TZQ!yQb_ZJo$gyGs?+N{@-N&8iJG3a0#z6-14!`MsWj-v8Ihho%hC3r#z+(2Y26 z6!8GF6eA~=ExCwPs-dwEqx=CaRAlz+8h3-5=J+}6R~A`U?;E63m%O4F-Mtr5XFmR$ zYokA$2@Tc5q@I`+%W3xR?RjMUo!ct~2Q480x;~Li1G{CS5y=?L>6>JV^SuPLcU3g+ zL3tnO6TeCNUrtn7`{%8Rl*T|pEc4Z>*weMYH5%Ku)47k>x6{R-(|?hO{LGN?8MAH) z=T;);`TtJd{IpK=lJ`Hau}qzux>oZdB9w++UndQ%D#n7X(1J0r*f@z?J{bGoZ|JE1 z&{B5w=|u>j-{!2#EEto^%tD6umF)i5O$ju`*x&#B>pT4Usho_oqZiSRCJ)~o+3`P6 zccJ-ocHKcYQ19mR*INJL#Si=CIN~}H5m^i!^A@k|AX&+}vbd28RXWuT{Cs>q})*(m>D*i%L7s5EE z`3|3giaf)Tks{wxubn&A8WEeZ6ZC%d?IK@-#BAq+VB){8Gp~MMxWF{wy1FhxiT3Nd z6J3SSPkSB18v0tav>-I|x?l^`Egdwb)S6%IcPS*ue{(u3=-!$>%Lt-=ho4_M^cl|s zJ^tfr9bd#p-J`Geq;>>oy78f3|9c+8x*eRi@T5jQzkcz?CIK#kwABwGcy~hgUgh8Y zrHMJsHrRKqRpoY5$_;gmcDD1HH2L8s=b9?oTlSr|=uN1hgW}JtbECZqI(-D!R6&|R z)owcGQGY>_1qr*u#OEGxp4=4~&eG86Gu4Vr$+IB-FiwxK-xAsk14PS3cMJ&M^;26F zQSg|m)>T&lrco!{-r|vouyFI<3|g=GRKP^b{@?k@ul@9hp`c)HZqUp8Zc>3E>Mol% zKf!Y@sPhx2RBw%y%1NHS->WvFrGk6w`$_Gmg1}H`_83p5!A!v8yr{VU?Ci597dSArx}6wcE~65a>{HgpCCOl(|SP@mjMJ8+~K>q99D zx_S8TGeT!yyE8TUXRa1^+buz|0#D`1^=Sa|EN-tOW**+dGF!g&!@KpcQ3FwBPbwI* zF64CaiKHt*IZSAvv&zb;{euD-Y{vN;J3@E}=T^0T-r}(0)wQYG(3@zuTLG+I&S7bJV>F?BTic@jGX`toXQi zWxkg_OTCGTz6KCpMhmqR5>(<- z&5q1Y56CJixQ2iHX!-a^%}zJIwNe~M;S&=R!)2+$ z0}{hdz`{VA=k&8P97jEmD>Rw07#(u17d+qZAm zw&6N#^gMJ}_@)Yt@I)T#zgj&3DdB(@j>)r>{TCMl&s$|AIi1lSV`7G)FD;lVHIT;F zVTAvwYfTy%*gfePPlq8UVN`91cCpp7XutaN#@z=vA}^cxU03$aLR68q0tc8nLzuK)h#OXTTEnbC!d-rEH9yqhNUculyCS!9REH}>^ zg|@$3cG+72Y7nc$S!^lM@A1gT-ms}xXNCSkP#6>c+>M-cV?-#x?WHKQ4rCeDtJ6v-6W?a_Yl1Hew&GU zCeX^Wn8Cp$74`8O8hVCHE+lJfOF_bGv#`^1-|>*%2CRBLddyw(ubDga+KkOKYky!lGNMBK#W7O3Na2vUGlDB&xjE~3|pc)HjAy*kC; z-@eGW*%M*yIPzWaQ3(;^(&x`612gj+mhTB!1o@1zK|5cSMPj-!S{|qiJw0ezs+bf{j=6FILwju{8Fk!MCjQC zi357N{^nds)|zHX(s^lLv##3Kj*gC1VG=^*z|wVa5T_Z&J-z}Mq@O?M#S=Y4myc(G z`MTSb*; z&s2FoY10_|(xx_;S|(!q5CmtLwJScrfpXkvM)D~n^Talv^;}X9GmP*4;0joutd10r z20|LNE|-=}CnhHWL|`g@5iNYMZ0V-=DB#~j>mAVwUKK$gxJd-I=6vRS#K16rG2k7Z zyjg>nKCA35#T}A0u=wj#eX#g`hi-T-~u;?+Tj(G!)H z!JYHa({kMU{jf~;ZMl&H@MiO~vcl%)Uy&lZx#*lo>+0)a&Og7lHo(q}jYJ_*Ivdop zE<1~-PeIOGlIk|7vWld$3PvLN%!E)A9UhE+q8RHlwyZBs_HO$6_02YNm5A4d6k-_t zm`-^LM2*zSgWd74#r@m=rUG7GXRW5pOi!0ahb4uSjM;jb2F`JzajhvTBlD7TKRgCJ zQ;b%-s<(vVRcu6fr*<%KDSkr8S9tu|nY8INjUL)B;QU09#F4Q;spJ zrHc6mKfjfmBX>-GpXuMQTGFZdn0yM)ckm+RODqdb0~Z*xmx$)f=4#KM)}OB43m=+P zH_Btg2aMG^mc_+IuO&{rt@>Hv*4=^TCsa`j8}*x}K$L+rgG6!IZ7$$G$XaJsRD4|Q zDVYb!U3Co&X!+M%UMTPU$&TDvO11_5%+b$$5h>tmaGLf17QH}P@KuJnYUV?7 zukt0|GlXweU0o6^6Nv0Ri0yo-s;XpT!xDisB|*BUK?{@CwxKj|ebUuH%fhDV*z~of z<)^|z8X{~JRn=By-xE#;M+uPk+Gso^fBN*P9VuG+Ku%TFQUwwk>^{wx6@{h)y9|#X z(-L6L9iDzJE|wnSh7Y1g?!Cv(V>9)>cy-FIeg9)@Y$~_8cY(r(mw%c5y9t%@d(%ZP zsd6*j%MDp?PsBp*F-(}54{&FcaUNc6L4@hvHhgrUOG8y&w*UExc z@(Ev6U&m+8+QU}X?SqLix!mZmFJuEo%}4Cjv*(ndaV!9*3NsWuT|bhZ(K{s`5Zxyc zxr}XoGNK+qJ~5D$+vC2SC^KH=F06l6-rQF9jEhXLEsH5`cfpnd%5;QT^O@qs*yTQs zX`gOKc=dF9cJt9~`I5S{cC>?6Npy~c%yXib`<{~2{-6F*Slu~7NCWni8AJ|jmU|R? zDv&pZy(<0Xj&^a4^#0C{xOw~*r}=+{yP54XSC;k%wcBo_1Z37>IEyg3YEKGeD3NqL z-7$z3aO}3{Ls_?rY`tUD8Ko%kzmdypXaFfxvFBr?EL{xBjkgMS#m1z@oPlNyB!}JO zvL0~lq>6%x1_jRHURPtnl7fP9W@J=g^W78yT~z{|u}(H@tI7Ti|2&IvX>R}n5uOF* z!n_Wi`5Ts0Q7v43YxaWr#jEoZiAZyzz>jVJ-2%oI8X6kDo~4?_1p>8F8j`1ic4U@6 zyWeNMUbq)YE%4*5<;!e8L_uE6b9JelW}LCo0pb^$fCp?S!SRs?sHh;X%zGEL?Ywbs z-^p?9+w}?UBy&st*3od=GK=$7zPQdA-Ob+uxNr~g>U*a_Z|-*;uBWRF)c1-rZpRM} zHfJKNUy=$}q`$oo(N2mO9Ch#mLz@T+K}kT`Bdp6$0%kdXj8Tt&_oZa+nTOORr?hn2 zuZS~Ec6fv&x1L^_CJ7bKNtaAR8KC9o&kx{3x4%&(Z+W)>|^FvHZs2 z?y>-QISYiwFt!NsNt`<&(EHE~iwv=Z$$ns~|tk!@lB z$evP)sFbQ~el)|Iyp`ypf8Z2|%Y9PV%uF>AQe(lo3$Z_+>2TYdm-!jx%5|Z!g;Czh zbtY=U4`h9_?7@JU6Mb7C*#-G)r97?`%6O+gvLvfK8~J5r*zGDR>M-W{Hp`r$z|Ta2 zCaG)rP*pXmz4U;=d6C?`c2n4~wx0E=K3{*|b0vhmu%7SfwSjTZ8naFv6#{~mveY%} zl|i?VH?vRFG^R3rU$%=~AK0}Mj{H94<>07S2XJ^3)Is@psAx)r?j zT@c1SbWKdU$Gqvv2Golc2p$QqGA*>KT zngKypNOn z4VdK&8PQuNTqDX>RY=HxyijX%4y7-@d_iwnO(u2S!C%BiS0pCo&BuLwaUG&|t)6zp z?K{Cl1zA}nU9^wz9`-*`-O>qiWA?N7LlpQ^^IrzNc*?j`39zsju~S3&G(&1)QA*-l z)AFJmanAF@lJwu>k&HRJo1I>7yJ_gvbgk)4dhrbUTq{alrhk?yFpUkx-b8HZX=}Hy z3IDrK}SMI*IdS*+`fNgP#aEw^2x zORTEh%yTETTt$8!bKUN&kAJ3-gor8GkW?jj{T+*e33G62M%muyL%X7|)s%afr)>(5 zpSOO6ZmMV#z3NG$!*sl6Rbvs$(4KprW=rIUVAoyB|3UIfxT>cCrlT6B?ihY1f_p!IZ&3#28If zWijM12aOi9O?#`x>GMRb5-NA?3c;fx?EREW$@|37Of=LiJimZBU5ay+%{jb3P0Z#6 zM{JW_N^uiI&wWL4jeF`EV#Df675jJObKD(!ZtH2+M@oLrVx7&&wyJ3J5jzG>9Bp{EoxkzAX<9Kkf+Yhg9hkI_{()L#>mlVf6% zllPtbyODof2>OO~G;rz>vRe1?{_?iW7sALSk(3{1lPo~d{KIRpipy#AidOhs_0FTv zvk&R1Xp?M;WN>u{O=z(-qMDc=Pmzj>NSKYEq555qk>pSmv%!}Nz~H8ZjqkP>0REic z3@<8@usl@)@NcNVL?at;<{2<0sc-(Ni!@+Eo8~GXtE34%ZXGNd*7^J5%A^m}>>>&?89{QG@BWOJ>&d?MAoKD64w zQs13kj)f z%q2<1xc#lvB^4M{q)9VASg_AvXsEDZO|S96Ey&tBVw!x!iu*RpKoHk4U%h-)MR1^@ zG}LeETEwdT6YA5OFaIpL8WH!#`~l>d*?BvHRf2_u(@Gzj=YQP!y%mkI+1l z1Q9^viy{i1YNZ{vJL)ncT1%~;eWt031&wG22Zya=uknl>I~<62|3ovsyYQ&lQ8QDn zMOfRzGydMgq#~5SSroV~m`(GHr_L0n1HQfWM|>{qYu|g&VI((d%NK_cM#R!nobV3m z_9D&}+tB2NP<`6CT7l}wpu9T4^3Lydta8QuJZ^OrO@gd1tWVhto;}x+WR99|oxHEA z6^+*7U;UWoH*YO6N$bd4z$d*m-&XgDqo-)xy2>-6EK1&%5Lz|!bxfmi+{I2cc*M1D zWFYNOB7UIL9|vVAfOntOLnN8Sg_4U>YHy;*>5+3vJrHm)7V!-%@9-9(xFQUCRB5H7 z#Qv8qEK|KTdDxXvRz{HiIYz0|!q$5JPn3~D;xlC-LK#)AuCWmn?qWY#r)!f>k+rxh zz^J7X%`-F*lzX;~QjDfKA)05s9B{S}prqf$#l;wSqpSTXro_jvZ!EaCyx;jXt!?J_ z zNF(x6&o1qrXmPat@108gvlVr9x%ZJ@0Ln!H8DvSJ?kMQGd}0O`NQ^;?%u7r9RPSj8 zdG*W!Mv-CT?>Vms2q;AzSM4X-o}zU+W6rc0XCm%tyo`3D z93Sw8m{tFUf9x-4zA|?Zy>sx>DfeRcbfKV3Rl1IQ^Ze#Vf_o}jda{%TKSoA^=O=RR z*sE)h736wFuk+=g3d)@rFh?yKa|Bx?jmKQVuZ9Wc6USz8&aQ_ap5{MzuHin@dK2io zD=W03q7>~vSj~U5+LJO*c5Uu9p7uhUCN^r5yS*}A2K6It&Dl)2P*r;*ZN`7;0}<2J zc9gE3b|AAHwaTflPfszxb^9?h(;7`1`l+}mueKJg(?zxm3B<-Ci|iYe#YmX(6tl5; zXe9UCXD)YyCR%Qz`HOkWb$KVU0m{e3? z?>}{LoNatC+f`i+jm3w&ypjOt>?17)JbO3uV5}0{TpZ6UpX+{g1`3$A5{@5kbNW-t zz4I8OD^wrW(M|N9MT8P`=lSe08|6SRDZBB8cSZ+T;qR3T>u}xxmB>i~c10|ZiSA&d)_M(^z;L#<_N2MBb$&y` z$GST0(c;-}Wx1iBzZ7*Y^J3uPmKh>VfdUIW6b>IRGVez3E4mydDP5E-2$1*nSs&dL zDPUy$RqDt~PR?njkPn7gH_`AM7k=3jD7TgsVO zqI+-Agl1k&&-+}FPSL8vQFq48@o`Wj>0(Q3yF#K+6c`%8LOx<;%FW41$h!iM1l&ya zN#HX>0@80;(k$gWdu`HX?M6mrWjG9Ie)YY4h)X6S4(<_O^j}H<1dyAX3uAa>eSMD$ zb*rNu#n8>~KH!V+HqAYn{PAj@f;vynD^mYPkC&OtTfc7ED0aO!I;MMoHZ8z<=U(_yzm zN?4c^VPASr+IbKg$aZ?^p@`)e&bwW+nY9*=mIRwOIr;MIuT#fXDo`Xc4F^_NR&wEq z+}5~9aQ}Xp(XzOe!P(ILOliVq6h-7$36?9RIspKyEN zo$KGBtq^#8w=1&KieqqQR7_KoE+gX`2grf{91Y7T%ffEd>#1A~_kDVhFB?TA6+-an zSH{j_V)-Ry5EPe16)8Kp-m=tE-8i&9|1VK3^xA^9&(y^3M*u@`jgAd~bl|o0j#?F4S~yA;rASjo z+k==^Dgd;6?_vgF1hsiNAKZWig<%QEarSJzUH;!i`)Bo<#hM)3L7x-)fYGtB0a*;N zM4q04%A!#h0f{8VMU&2sDl6lF&vFeW%?=J+vIZGo_t#9@Kt(^e;si+9 z;P9~j+!dN(ZYL zPS*qMkWkE8`|_xI*G+cQUWRL35f1_wLSUBRj+818B(n<&{A9Vl7Yn1YC1Nw{@loUt z$4-U8S?@IFP<{67ol-swjbN2`ON!~SUcMypqg2t- zlB2|juoGKXCjeG~jg5_eoCKi51!K4!iw>&#`jOK%h!v-2(Bq`U2OkCahVE>c$UEd8 zwHx#{UH7{mUEIV+N4YXBp$7}0oz%wmMF;zpAzIK+9|{!-&cc6A079-7=H^enjQE(X z9I=?cu8Zthe@K9fbgFYR>>OI?_JC;8UO%Egjk$0AO~*lRXo zC*M-ny#IaLf6rnwS(93%i5NauySNFF3z6fEkB`64dM}+V_f(Gv8x{5wTXG+a-qFal znR5-z%qX!Dp|sdk$0R3*(#Q?CxrrRRf@@MCzVSAtk{0J=XU>gww1_?Q8I*4NKj zMERvKuMG_kYc;rS>kB@Z#pvvmV!$+(rQ*y}RC*ArmLt1egpVDF{|<5Ic}Nz`GPWW?4Yo*O126&m=ymWb(OJda&wuhv#Np4Wmx!o9DsJkAy*qX#Ys}zLZ^Fv%DFlr6V)|1= zep-oM{9E7VOQPs9PGX$)Vo_bfw+8sC`0PZ1)t*{$+ov}Z6!MJIyzVMj#Um{42QK~- za>3MS+=@8v0%2ls(p4Fn#Q;>UFzI&A<0B^>`t;ez&a*W>a7*kdQ(z`UBY5(JAb>vS zNpo$ADgpkxoQ37F%2vbxstUdoM!59Tr9s|lxIgc1`;y1+4v(d$`Fg97#F+4F9R@a8 z9`WT!5u`UN$I8TB_W8(OpAX)=R731+n%ZPm-7eBResIq5=}9OZ{!&hAY$s~48} zmJ|j~OvgB{N7jmVy7suT1c2HO1nutrN1U8@fv{0O-TgEjwhARW7cVb$56GI}B|G7+ zFpBbT;hvv&f5)ZSTwPtgvhs{XxF2mjMD>5Wwr0i1$Y}ohH5Czd9wS6`-y4LXi6zr1>#RNO%q>fm#$m;@chT!WY8L5y%7*0vy zc{vZ0vafT*-X0eiog6LeHv|o45C;?za)#b#%{aj8{UREOq*qo`Pf)g2+#kEB?^*Af zBQloMxYbu=E#&p1*D-Y2cXj1jWti{wmqXC=g!nPP%_mPdVD_y2o#@en>P@cgPr0!g zOmXMkEAOR^tR`!d?+viFzT$B_{>~kdE)?Er1rBtoy1Jbq%kf_H^i|+t3EsUXgMPJO zfGqka4J07iW%_=Ojr`s}21h=Eo_OKIqKX*(i<6rb#E(VY4*M1=<>O0sI^$B$HZLcA z^FT~KePAGLMeSnE_59)9;pBLo5gsTp{Tx+~ib;+6Xz!V{d!M!3b3lxPW9YqP*2g%) z@{L>#BAmdI^YdYBY=Lpt-}oeBC8y;R`@w4ZsxSl%S%OStn(;Z4Wnj@9#2d6o(&gL{ zCdghojMz7X-6R$J(6gc#&~PbCj)ywoQC8W^_9YDN!?q`;3j?E$O=YFa*e|?%9&0qF z5~yTzNtcmpz7) zlau4ILy?vb3^Fl;-$+Ut{cZq-#3x)SUy1YQx_62EBix znB8q2-mqI8wT8d!^*vd^gUe}csxfjYj)%ZtsAC%(#Yo=7jq<>>d$?vk$k~_MtiJ|} zg=U`1tB*aMcY0QG*)xmWJv}~V_3@{Xdo4tl{Wbt=iNix(_!``T%Tvdp2@29wa}2D- zdP-9650+VVmcEoPL(p*((i?54iLRTN^LBAnW=;1k#R=C8=PmadclOJ79}FV2J3rphURg=No&>TcaG zpku=eQZ>|%A3s*@r)xSKT?LJtomQFjofwKH|Jlvu#zRri#tY2)cBRB~R@V8E;QsA! z>En3)rpSS1iTq&*6A5fS%t%D|oWAe=b;3{#skdCov9tq^GoTWZQgz$pr5LiMXfaUX z-HvDVjMzqYZCwO4=hxTY&mM%wm|swq5DoDtx ztR`cBwnVb7-g#nt5gA9PZBN^1lj4MGLndVJ0{I>T2LGXJGEVY~MI0Cbpf0ysmrC zBIellVq0HD<)^^=mhboEiL~?&=|xWma!Y3WK_p=OtIy+2-z`tDTxBB;d!N71CDexyB+;BJ zBdDVvzO=utN4hdh%P=P z%N#BK{a~SkN?14*63Y}NGlxT#+>(@k6Zy0Ct>3NGbi4}2Kfejs%+$5dOYJ61 zv4Q4Sn@sa;2Z+EV{$#sejqo2^r3OPDNFMn}$*XRYg-gTfyfhKb3ua^c?y#7%(A2{#8f_#))Ojj&noz=1Yk#+XsAPnF*0L!`^8r5b1ArEb`Uz z^UE0pO|G|Y9>&BU9#v=vk%J>MSb@kYDIKs4B#Y&TsxV0U=-IS6%D&BStFLl(a@e0x z^f`!eWhcf4OIWIqXU~=_|4d8RGhOpIJz;yG2w6Dtz-_#8`C3U+S>RCgD-aBMgBAF^0Dssn*Lpo1NT3Xiv`DGo!b7NpJTS% z8r&N6b{rgkysjLG(_)sUxzoD1LsN1~;vs;o;Hyr$gv0yC3GhnrSR#pwn`sikM!nf; zfbK5_9u{54X`MJz??r zxeGpugJW5Y$%DwA4kUX4V^66zv)m?IWRcUK$%xk!4=~ffs5LmzhdT)~K zTbTl^=}`7sw+B(UG}zs`2{$cp=l4jl9o5+QO(>n5uA^tk+VmS`8#9oawy?kHiwhiE zl^{Ub;F(_jHW<@TwQT}bCMj#1wsI>oeG5o6) zy5p>!KRh%xJJ3IU3gaTJrllNZO)TT|5cAhu&=M0@uClDud$(=}wZEM)pcL+l3!~n3 zdJrICm{dRcXSF&e{!6hwi+-aRa~?4o7Q9#C+b^cpx1os)5@u4_QFk_>`F0aSB3m4S zrgY51M7(P^Zz{D#vB8!!=XzEqbb7L$lb>r?ng9oI_kPKTnAFaYMfoGEVZxmq2dxHk zk)#s#ZzoMHzu~sHeyu*hC-?GDiNw5_BKF6MsmmyhkCi zj+rsLLD^^8ZpFj?+o{a)&}YU2sj=hWKqOp-D~8YSdO;Nsa16tisc<7P2jc)~{m=TU zOv!LmVj_DXF0T8a@H9*IAcN-tnE~<(tD1&Ze^FQc+O+TciKN@`Ry9ksTj6eIz=%}m zo;?RpE9kQt@e^n5P6M{B)=iOY(9|-KC!BMtLr3uk{K{p0e4varlt|E&0FR>btMjQ% zR|I({2)u!*QbXzXJ@A4*dbNwo_`L^m32<53@!xEG%kX)o$Rjl^4NQ=RtQyXjq#b!cZ?a+%*X}Aae*&FA^!$qkUV^ysQT7BF!G~d); z(JaqLu*6H@rC{Rz07mYuX6pQx<3$h&gVZaaFlT#oqK56dIRm0=GTeS$NT@f!D8;s^ zi99?fGru~%@1+Y^qCF6`;nFS&850m6cx|h`f5wWo)w*besoItiNkF3^578cfre%VyVu4!6F4nB z%2K9n@LpD}zxuI4Ll}v~L-}0DVAOsR|GtLIf5b zGTj#6ZT5-J{2Y`F$ISXf(LN}GwM4=8)E7uB<>#A^mc*MyZhqe z{SlW9m30Nv@|DEeA3t9Fb*P1lqnl@Hcrs|vfRY+%fB66#)gBu=IyE+U@aX8HUpxC7 zN^~exq0SpL$1YMrOxiXjB?MKLdM}HBP5^tdBE(}Ma%ZL75%cJX51A@2*2i`oFi>vP z2?}|uU~5<3tr(_X`T{$?C!CoHe8Tl~ zo8#u&Zom(lbY1IQbSZb~!-89vCjCA->H|`{=%~a9cXJ*2u=`+5Siwb-VFOo({h5zw z9er4%zdu9^bkIdXzX5`RPQeWnNmw}Ut%z6bP6DY(hr-@O;qAL3_~^f#YT>Ht_R)!3 zH2W(Ka=3u3oh<}y8k8oaKkx??k`*V~&B{rzF1B}YC`%_A2wHXwv5nuhdO_%Kes>r>r70tdF?kIirZ;;IC@q~e!8_-oCzQaU|pYW z*v1!zN8~wB%@L3@jahe2ey72azgDc7wu+0;$Smtk(FD7Bd4xx zZnA952}(u=Y%N7EtKsZpk5H>`PJ+_k!>6Fr*MGwRQQQaxmED)^;<^`Ml8GGdROBV` zfFbtl*NCecUgx!$S^8eN3YX=pK?d05G{oUMbDKP>s;W=H5RR}sxUdi#%)=R&zb!9T zerawxLb?93?ZwS2b=IEs%$1p&{kk>pXhL8$^(MDCK%&R!SvyLBjQSmP)bT2BUbTD$ zz;$Wl79iMxiG0FZAv1^?Xw@0tcCH*r5%dj)+J>sfKC6_^*2?Qvk!Jf+k)VC;6fE`7 z;CNpHKPNz{&M)poJRNUC5w0$hm9{g)&`#Yc1$%#6gT9 zL&cmRm<(!eRqMa}d)B21BpDgMn0^^Z$y2xE7|gWAB-y2)hPj#k0gDvYnLZA5v+42{@d&B!e2W z`__-c8K0|&NzTJdzbYXuO$<^Y7urS{9s+FCgFa6OpWe|+kNh%b1BUXEqWF~5!r@X_ z%cVvLJ-x{z4yfkQ@W=<lfRJn(mkT8V%(b674pNvmsq_1wHZU#8&OoGOQNH$m8uxc-p5gPrY3QlB))7J#Ij zu|vCCe`>P=NcN7|&gA7*#=a4K-_G9Rdy#$-0fNTxZverW7}$LXUmY8AJ7t*`7S^eA z3V#$s?{G110?&VFVxs>**Au+>jDM`WYCYo*BNL7u5Sb03VuDI%LO|ff={%M!ad6M` zV(Jj8kSy}3G*MeZ%`dU`M&&gQ`vL>3x(b#r(V}TowY083ag-;45@0?{Tq&J@V8oIa zx&&0gcR>AhVYg54eUE*?mja-Va;1AW-SgLjwa%#WK!LRxNG!i!0~Z}+VqZquzAwtd zHEPmxkZNpf{M)H6LD*6N`Z-)YGY?r1kLprj%w7gJB4vWc3GN=msZ6T|@n=!G%=>xnOs8 z9M4nvkWYmS%Syw-l43AXWAAKnRvA_GK9WPPsklZnb?qHxr%F!IlO z_faaeaVFkH>Efe6#cdOx96KP27)ZdfTl5SYdZVJKc^x z1w7Yx$4FI@futS0=Y>3eii03}G|kZXxFTeY5EqCXf8q$qMgMrsT~L^#r0k+e7j5b$ z>Ub_q4PvDV2PHAYbaqHnYFL!tmEo-AE1~NhNDin?*^Igf6r`!?vZL&cWQN`HgF$%; zjJN@LPr3L@y11BYOpCp*42d$o`w2EvntmGy^F}9I!flg0;>Yk*J@V6hKx_{HPx1i$ zcUL@$i9TGW{fpYtfq}d>@--);tJYn+0I|HwS=K}d732QIoQo`jq%(4AtDaHO7tx?i!zEDZ>ka`3YyVne04^U(SSYQC=uJN(lYK02U$JGjR5#xBDpBHLX`h|pW9FXz#w#z(TSY9%qAT^fE z8W>%50^{uKDyn*cR6XAuQdW6w>{oU)uu-W8&EIi(sjVUv0WK*$AbmsHljM*K=n9J+jf?GKM=z zNc6>`bBwjXgr@V1Z&n{d^X2+-bK9bevrRDv$B_df%)nrTQ3{_kvGOZN0Tvi|Wz7er59qer zOj+e*P)4#g3j|3=|JekI?jFl;aOt>zbMdcn{uh$_20R3a!cbL@*z zyWg?nC!bf@qMhjjt{bI73#wB?LmX>Kl<0ehhxD#ofnj|T_kPXU{kG!^JSYE2mb|gC zVU`9Z0iY}GK3IR1cE-*{{_BixSHGoVY7aBcZx&EiRu)yt5A6qeX8kJkR85(rz7S|5 zZZ@@7R8)XuUVlL7bLf~YjuuV6U^X4HD#({&Bbxsag>0yK%@2~eQ=VHNz|v7gOSS)f z0Vd{-BN$VxjeC9oedCjLTxeI4jFw2L68P*+Mq&hIb19Gp4X?af-tY#t+t2cVnDn?Hi6AYzK(`7%&FRRga)e$WK_`3P5PzjMkp__sX4_^hp zd1UXnBdOpvEsz;#i#xRT+jgOYHFMf0(@GRZkQiDXb!qiH?RxVbr-R|LJq_ z{9rcW!J42fs6ImYgf^p5xz?`+>-!+22c85|Hh7}PgNN6S)^>|9)+LW3<;c(GL8jy$21 z(6`k8Z0YbdXoi1>lF`cosNm`A|hKC9qxwq^d_;#YH{Z6 z951bheJXfTGOVhekp3x#=W5C874Z@TJy9dcE4QZF+yO_^QL0SABNg}#$R!cyYZ@qq zt!Bz%{uW@KiHLHVDwv%88cb=nORPWKC^z1|QAtk!-TWKnop7l{9_Ksysr-P_EqxzZ z4WkfDf)w;khDXFLKQUC)RGk{PL<+A>MJpc5woGZrkquiLw64%;Yrz8*P3^WFlTZv) ziL<|B6e{}9+f(ySA^Zo*;UK|`{Te*8cZtLK9PUGsC+jXgho`JZJiySq&X#Wh|pv;{CtH8>|nIdg+Fb#x#G z(rxSa?HeHGlShv6cr+BsFO9D7YQ> zj^ucn>LQ*{euG@_(c?#^V`=9?Zohg9AE-g<-#*ld^}*ypkkOmAwi|THNpCd2w`|oH8`qTr>>a-+lHye)TF|j>>(ZTi5@X>ATKq$K9MR=!8 zvp=th03!u*xU#Ij4X6^C3vSrpqv5{y>0ZfzjIFJxOk^q)Sav%-oXjaD9_9#8H%8$i z4o1>98&CWMgX51kv19t9Oad}lzSew#@o}KSD0w`T&QirC73j(d-0pVvMXuLh0Y#w6 ze%O2%cv3IvIcQ#~{``6A%C2=7xvnw;X&yL{z;r4YTfKI>hoa#-ZXinxhFRkISF9UQ z^OQ^Bp|TejjQhc-Nj3vAefL>(P1ciQyElKi{$_h#tVd5C-`y*_yw1xD?>z=dwACy3 zz97UQf?PB>i=k%9#^-njjVKHi%3BD;*$ssYiJsrTKdtdNr`xUxqxqa{z>^%SmOsE| zc=jUhu@;ET{jR3)0XM&g{ zo0PmiL>J&aiiea3q(DGGyxjxUuZ(HL#G*qEtt|x7YscKOVXtz(ns5_vn(g_THnv_P zLPA0E>C=yQKfWRki^i;3n7b{;dtZW9e0|(Ful@YFj1+TFV1DOMP^|dMz@*8oi8MiJXC&%;N&<-66#SI`MCzvM9Ef)ts^hN_XfXkI z;W}loqCtV(9R6FyuH0V~Lm}2O>w}ZU6C<9sOH`S5RK<^qngP0$n>WV*hXXJ`W8?bs za*rDJ+k+ws^yB>4g(v#05&7Y1>Ct` z0s{i>`igVy>t%p#a67}CNyASLXaZ2a*rDCEM2#m;jh^+~-r@1x4Uc~F)yCG2)kRFB zVnRFEVev~Y6VjsMM+UA_UuuFAumM|hzG<$fCJ#`204Ox*7JLYxft*mUCwje1HX&|8Xo z_u7}fob0WzO}?%dc`J|&eXiU$w2dAeDZ{; zXj>T8_v{5WSfAy313hw1YRBkQ;&yNiO8PZI1Rk|~@=KV}^DJqFf3|TbFIiVsNjCl^ zFCX7+Yzn+ltIHoFaAv}0?_Eo;0sXpB#ao{Y-Y;-ERR@O$x8z!tq$`ZtKU98nuQehc zE|Gc^U2-od=;(MFA`*fXP{w7udj{oWy2?Lr*br1;K{;|0Hj-|V?ixFw&`8LNS2tD{ zK=G>m>WN?hk;4xSdu)F9JU$0QVQqb%D}F^V z-sXMO5xD^PgVYw|p{x7e zqDF)}U9Bz3Jb{6Sn_E%do9so}7j+LKhsV!LXK5&67#gGR91DJ-aoKI5rxNvi{}l)7 z1i*vM7qKhB_O~|;ZP*I1vh@Oxqoar^d$lW7!N*rV%^uupCM#w7_dP18EwWxOSO9TD zt^>@>Xy%Bc<6|v7ow)aO0GHaX?2d|%dDuN(0rgr6!}mK zf5f)>#|&pg#QlUGtdLeXuh@0@00T9Mj#rk=?|jT%eC@Tmy81Dm0lda(@N(%{+1|<0 zDJ_BI5uaAHTH9kOTQHXUvrJOUB(qVHnebN9xpOPv4SsWka=Nj(%f!a^^l@v?{e4-X z@Pu~~AA4VqBq3KJ^!O7R;rCC>9kI5$9A{O@yY2@44XOK@hUrf7EmoBYDT$GBn31bP zkLc+$0rloVp=4$2+xWW!!+$k6E|!p>4gtc;1T2Z4u89Pl4g=_Sz!~Eq!4fnA z9@a4M^CwOIBRN4-)I#D{>wl{Oozta7WNdZ0u>G~2qKUYZ|L6;`E69P2i5Sod?x8^q zN7ll@_-6NO(!3ExezG1GL_oPrtNT_&1NttQbh){7ThzK+;weGB9x%IdnbA9^+gCaMdkWH7rqAqpvO-q^l zrmpM{r006q|56C_2ra@FwZ1G*nKWdze(`(yAsCbv!Q@a>sl)>Yy({4#8xSD%Z%d** zH{|fv^@1vH34*b`=NpbdX1J=X+)S;i9@nZe?Q1{Q^`XS2kv8gDd(qhKd+&%`eX6C~ z2`)wigKe1zh5dYa3fu?-l|OuJ+iKxbC{;DolG{L2;|j~GtMer(Vf6#s$7DzWUCo%t zfxrp@kPt`Z9Nr)ffiRSxA?Pl9FzyI;Q>vUI7u%tyvG?gq*PcyWf53wYI+x z)`YB*vRy73(p|*Ov=sz4Q-%EO4m^(EJiZ*d+4B&!cU%}=SYkKkj|IR_cc=Kd*id9~ zvg=0gV=7S_tKQ{sH;-eiu@}$p1dT{CQ%I?ku!S+)&w76!!n&fqQ~d#LU1g~Q4Gr!O zL5b}A?ZHiQ^j;$8LA_fK-D-cv=g?z<;78JrsaZ z4%?JNGZr;CA1614Z5WzP{=HJN&~Kh?agw+U_Hwl{7f9E;YCSO1Cb>h*WhAdf2&A5Y zB4&7GLv1tmc;ur#FJ)b>_OyfxuxD;*b7SM1B^>=qYddD(x7XeP>bFsA*wG4 z-z0W8*6>;X!;%ym(E)vLcEQxyIZoyIH{k739v(R0qeFrL3<@*FZugZ{%dy{+rOJG^ z{Gi7;uWre?xVq}qtfJf=6QvS7rSFOlBQn0So0kg;6hCGOPfk8XNFg_>XU9#xV_eIE zk(4%X^a&LK{_{r*3Jr`b{XD;;xGwL1*uah-{^!{H*$WmL zs+6=D?tpJQ#@A;i2sKAX_ttd>nBYzyMWO`}R$qDVNZG5cot^xKul%I^t~!1k#9SsX z0goEiBO>9Q!R!)760Fy2J7T~bS6)7%5Oc>zJ~b~U$6v~WvcWaT3k|bq(ny) z`}8T_A_mSgJfK2|`XDX(O<)XpW{ZOE+q(CV)a*z~y}5htgF2ufN@YE`MS4qhL7^+Z z`GYs-^~z#YGb<}gURM{DErmBx(iAm%p;t~JYEi*!aZu+h+7Mfm&lgmJNAE{i=K9#W~ml@)b zAcIQu=aqpTXT#7MS)6ijudFr%xDMzvprWO}*U)KNu`E7*!6G=qOeH) z$mVfF9Qw}5p9Ol*Nl_aEz70A;3u*`3!Lq*v&I_Z_;5kBy+xaXJHx#PgWv6yLagTK}XG?^eHbd5*Wu` zBk0Hs2b&Yy^}f3$lkm1dm?}DpPB`jh&>{v&T|YW`aF7#53vbl?h5){vL$c)=PNPcl zO8^vbH6__BCc?Mat9Q{u+LVeSY1^{di$gzy zyH8bJrLC(g%}AtP{_q;Ziuqe(jkjV^HI;{W2& zJJ%a2-77XO&4Z~~=XLrSoGD+zzKo3ia?8%XS~kK8M~G3yCMISojWwdd>cJLfQAVEA zCX^eOR9mM^NlE&%e~OMA2pJzhWVh1J%FBEVqYILV)-v~FH=_|n{EEwC9?wvujT^MsHk-J_4yd0$p$zxtD0nIf-a=TL1b54Ea>%@A9A`N zBHlkZgakVr&6+xSp8^A0K2m=^{xV_%YJU5Ub6m1j+tNN=#FrCyD9uA$FM`MIa=c|9 zfx{=2{P2JK6+kLnaH)lz@p5`p&a+W`3tM57U~28yf}1SCBD%*?noy3Hj~5W)yWH-+ zP2Ie1Ug6A`w-P_2(`$e`Awi67NtZs6oKZa9nm2*@_IfZ-Gf5s-WC3a47Exn2=1y5$ zq+?KOU;1aNQVDi#!vQ$1S@yaZan&~)B~!*e{J`J!pCG2 z$vOe>fVAm*Fm3hs)hj)qV;_4BL2^-jDJKN^pvxHwpghZ#*8Bg+$?tG8#B{}iUIhZ( z==Au&$1x>a>A;ukLenoGD2NY7ST5Y(7KW1!xuuzmt_pH!`1$hXKB%yp7(;IN;Crmj zbbR7@gC2zN6q0zcn{{2u-skq_#QES?+9z4KoG?}O%dhUq*;3~FetuVwihlpFFBt-T zKv+P^cogMh{OlVePbz72sM+fWV7hti%oTjC3ckQe$J2bG*DUN2kRM5$J8rZ0qw!Pz zG-Suu-_$Lm4kW(j{JuM*0$w`sI-TdwOlw3EHV)B#eLwmnu!}2meA-isQW)9+JtvU! zN(Sxchid`GTct!s=c6el%NMKF54f1-X(Q<1-cnIJ$NVo9fu5qbc~?*kSJuOyLZ?aW zm)`rFCbjZl$U}G%PUoI|C+A@$QO>;X`&NnJEQ#b0>g+2;9O8j}2`RzEq@=mP@44rF6vw+6TuWZ|QzC6b4lr$TdoMyw3c_VGs7>>jl3 zHiry+MpaJE7R-5kbdw_y)`kb!C=E#HOi#b)4i~h@WoB$#t=XOF1E2fk;dH=G(j6)9C$)bX>%zNHfFp3LK(Ml`T=ZCB#DRyu4DPjVaJJ-Pheo^E8 z5H3*85O)>lIniG8Dc8$5sK7^@Ue!4Jh&J4`?6Poi(Tj+rla4X*<$mGa&;-pTJ53?~ zbWCZ*{C~Ta7E2?Ti!haFHm3I(Kyrt*ET_%j}yFYNi;q zptqk!OnK7No_G+Y*KENhqwgpFVP_c>de0=KBvriJUKh0h=^a= zV_HR~-R+`*JQnCj-?x1roU1^H0v^X4!Xn6Sug))J{t7|h-AI+!0@>U?(3lrMc7Z-3 zFk+}Cnj085qU$~8Y2WZ(7p6s*e#-+P2u3a;ZZ@p$V;;U1e&*NM-;XtngJZS4e=6v_ z&fKNps|5KjSka(^B5Ow1rPu6y`fh~`v>H;Kw{1v}ot~l$f(AIvXn#~Ou%Z?^p0U}c za%athrU}-JAO$wjV0Pm0q)zmUzj$*@*X*`XN$33zgvRMv(;i#s^E#M3xAM-6`S1bn zHW$`=z$;u|*FD&)`hFT2Jc##(zc2&6kEU(-%S`9&A%!6W%++Cgn>|A!1upwJIB=b+ z@OvVMat8G2F8C@-mmO@rdm~Jc_!t=(k#l(S5SD22cY*8u<{RzDstOkU89X6M5A0+Q zL7Y0Z93z4rQD;Gl{%n!RAMCE{d#`Un0VE?9Ps>409NHG~I9sk9fUYNZT_OUe7`eO= z>JZr`^!+glofq)P!D*wtK3 zZ<*iOWTD6L9oaV;r|gmVN6qg1@yPZataoab@;+apZzqdhC5^4gZS{pi8q^X*afxiBOH36&nKah++KqQ!Y)L{nF;0T zmDmjh!yv>5H&{U$mzF4!Am!y}b;q9zB!AX!&dEV+g7l}w@Mhv%#0RFRG%z}rb(b7& z)iMFYCbqPCy2RAGnMwv+O_v&dIwg;D6qzM|2+e|VbQ9fAlfSN(CFmbS; zke!f{5;?TC1nVu~Zu}j%eRbgTz;9kwamJ9e|xIo3)Fmqg5p z0S%if|Fab`+)=0$dkA5G@|PEmy6isKCAvWgar_VvRLL^<37vdDejnXboMg4c8(Du? zO?<)^k3mDAm>PUSh2nG{g-{cFB~qSH?u(qZc3%}_9aE<>!)HzEB?Qcwz8BQzYt`tB z<+97MRYb5SpJ1cxHlA=U1RN>4y86$^;xp67CroL_?#a{S(y<-RxDK7gTnwHx?sD_- zRqE(&(er9+C@bSrd#@c&d)?dLF9*UkJTp2-?$i{fPTbzmB55X-RT_JB`JSTi>z@>A zUqxLjVfj1^(uAj5HpjFO>y(%GW_?w>xxBJX%g0BVFI}5Age(>D`8o5lukSu98qUs1 zG*7MJ-gJ^S%kg~9y$i3kMjXMD5jn#9wppTn2UFPO?|(RY$Tus^v zZuH)N$$RG-b2LIM@kJXilp`_Gu}8K2mT8=tj#U^L3tku)<$+@7=SfohY7>Gp_d=ut z3^_5ZuQw)5?C~bVR!8IHf#=|Ev#AbrPlaOep#A`kC5_(H$ zJ3ISZL*1QGzA`PX)~o4c=!U?O7rIY`l8mYf2Pno`) z?One7Oa9@7p5bE1n#Kj4pxv zos@#<3r$8t;`CZ_)7$A9Ztqx3CT<3HC!}E*`@7x(4 znAg943>^dliZ$Y(vIc@OAj6K1X}^n!kff#>%tmapH60KWrJPO=&C4VHB10~s;d<%G zyLVXDR#q|3n=WC_8;Wjm^rZheCer0q`R^x6>dJreiA|6{=K69uHC>5IocEC9`ze{; zdDMYo*zAQ?JkY6P;yZWpl_?tKZEK(*m3L9e>gogWtiO;CoRjd$5}Qs#_UbT6QqFh6 zYChgU`&v>`S#HL_$(g*oEbBsCQR`Y0I$i7a`Lh-J{rhwRj1h(1=*BlaDk++*h{@#HF zb+LGR7x6d6&Hf|yFl-&~$xBT@3v9*3438LT5_`IP)z_9HpDQWFcY2#4zLm~!EHq>{ z?qlma(70bPzAoo!IA`KI+Zq_s=s9gCd|Z9p-qiv9q;%6E%r4uV4l}v$rtMq$Xja*t z|F76k3> z@?JM40chdoog5L&50&ZYkAg!&ofoI@z8TibdF$Wb+$7)X>17al6hG;I1mlU%*+x6| zI1y~!Fw-xKN}@T^=#mS)c)S+|+Zw57iJo12>*aJWk2Dg+BZ^#^{4C=bW)S?5W`Mx! zxdhkO^sj~Q?_Z81ny>qsQEPU^VdcmpjAJx{H%9K&ePVWyTzz=*l$D|7LsHVSImF4m z>w}@@0OfpO6I<>g*VotGmb?N2QSc}T$jBB|_)a`U`v(T-Q`pe4CvtUI^VCO6D zhVbk6pBPvMChWhLHB&iZqSoskFO42CJH|tnq^~7Td#eV!`_}W< z!gsH)MY2##`9J8rFrw#|UGq_>`908J*1|MXHE!)#lMcVfDk0%kXF5-7W6}0*Y(+Y> zeY?oJU8}j`HnA#AOtF<$re`v5>flFNqPs+}whvEkaNr&;<->3q^eKA*6C($A5#^A; z(9gO=#3_Pq&Jwzj(W$A-*?F#BUJr5T>P#s)Q~HSUzBg2`vUDh{@6S(Q8+@;?tqrFU ztu@;Ir^abiI~cyCfPV1#RK?F;u0&Tt{$9<7bD60g12^|u_{uu0EEQjCt21*Jw2Tj_ zurt+(IcqTet980ULgcp6(`6Op&NIZ_>oY?-URM1lc{zUFRH4d9z*f9DS168xV3j~F zeQN6G7Zm+~-mW@Au~e*;DPG0E&-S~XvvB4q%hl=Lk_z}O&`lXRVq@ty`%axWDmxp$ zT0eTgQDNa>vrGM~V5YhbYZBLoU*_fJmA@MsMnL0|iR(i#VQAnKoZ7@q9(7T(;)7yG zfz5P%ZMPu}oqAqxo>dSy5&jsrlgUqL7ck-^cC5MJx%h96nl-8SWVS@eyg1v?*m`7Q zHzhfxT;E<+Hh5`wch@hucMZ!OAR{@EX7RZAYhIRfN4%8ZaymK;tWFXy*maYWQ!qyD z^7~jzDHSu45Wtcf%}yD-xjuCBCDUg{O(G{;Z->pd(;~C4{-h2EoBr`+;l~CS{pGkFzB-3 zCCI^%VI=T9tQfI0fBEvEnkkL9pCDB%TKd2$Ik7=Q9Rh(!<>9aHe%XJ#j|Mclz5CzlWR z(Pxw)rdY0wRM_^$guV8_NjC-JVuFenQ+&zE&w=po@(K&;Z}x7QlFgv3fr zc{NJnwCdaDX4&nky3lF+xsh1LO49lP&XKUfXCf1YCBlQ`M7WknFlHT?gVXMv!%&nM zO0ngOIU9dvAL`63;<6n|bW$6cA~-q?>06l=e?9bmmIeQ%^z zd{s4K$tcT|RR8Gh7v16pys5xlqz+TPp9^mI1e7ZVV>6C5PTR;VW11z}kd$0-Hs>b6 zZ8(xLXf}Y#(`IuNzFVY&&}dMdYLY;)o!@e)L&rF?d{CiRf{d!@Muv$Q`Hl)|Gc#N_ z(_?St3UyB7I_2Z|AdSpT_x+9XO})7eYD#y?zWS*S&g|!z|rp0m@KjP-TQ#l<-ld?ZbobCT*%$>Md zgq?%ShjP1_bbfhply^s)@0Y5xc=1swytykya`ud)_|tN?%G&Rd=iqM zeJ0)uuJf4Ni}Ml`>P)a0kLpKyn+djrlRfqo!i>5OZckbXx65*&WT}Y$xSn99&xsNb z1kxX*59~yCUdV(%pUZx&AC=yV7mwJto_KIy8^BR25G60|cJoRu%w8_*+6O-=g}Fxj-^w*W4S>F{|Phf zO!i)>stpbQe)9ABRs!&O@#2LXV`9z-az%5)R(Qr6jkZ6-=u-L|BO~$IwSxv_PL901 zyz-Fr&NLE>iq@b*=Y?|xGT~R}NQirSUv*bkvBX1;nOZhnXiq+m$HqiMl|0Eux)Jcy zrsm)%)qFmWtl0X5rAJA8Zde1d#=zYl@$qf*y#72Cm^LjWtHnTTjGy}hn=2Y(|!o+z+&dk9% zvv9}3VOQ2Il8|_XPgq#J;`!9yd89GE%Bm{&xXd(lJG+CY*=!MX)o-HNeY)NNvbkXE zMaRPOTs+AR?&-0Wja^TlM-bQxQ($37$E75y-Tb7%!@~;>3t3!STYELO5U(ZeRyVX| zIj20E(znt-IGCr|8y@w})Z8UvCkye<(wYX{C85zxq8VdiVghD>x58~!fq_-}tS7rN z`Pw7DW;(ZKC<19-cM>nJoo7837gzGJCgx3(RC;|EWB;|Py876}$cn3Z&kE9uG*YbC zDDMpcOTb&ae4~m=>bW^ZAuB5nFE8H%*}f=b7q0h4zdxFg@m|rwmCd#C5Zzd+<+8z0 z`)PuEgN(v+oTViK^gs$NLW~g=4G zOo^`6{BV?+*$C4QUBmag=}cL{Xpi5lA1{DycxQNatP2(cV11m>V9*F@8ZhH^#v2@Z;w}A0e(|FnNSuq-}^~O-gVpn%v+5F>IKz2UaxgCTL@8 z+f`QfPCDn7-vFv$C&E-4*oI?lakum{D6W4#YD`4e3f&U}U0AqmzGi})h{)E_wr#;V zcU<|6t6;`2(XWRQKa}3Eb@##U$?ja${TamUjgE<#Q;|EP5K#G}O4Y!JDGcXX&OdE& z`vJ6sD=+ks4KQLAaFLzTacCl_a`Wh?Yiior23fVA&$nN;BGrAQ`S*P5H&0kpR1Dwa z#{)S*N#d*p+px2LJ>gGGPL>W9r-)k(o}0US;Bq4RnA`MX3VgMWc@s5HPm(-~r6U}y zgv88f)wuZgryE`WCgzljbj$&j8o$`b&_)okb8?Oh{|andU|{DDuBgCAx|bzd>S!xq zuO%&*p?>*Z*^rYs&w}97Cx)}rEdLZe1A{e$8YP^7kiy?9`xek1?8!U&)Yis6zHpY% z1wKMtLPq;c!`+(SS8QDe1t9}g)~3$yE*mlme#=^57WIUSe_#u1Q_^sf@T#5GFdF;5 z>$LU&^UppmC1uCdDMRDcy=5zF+C-^QYrWF%zk|oEEZp6*s(vlcGkg2ld540{4<9Ip zmR3jSz2B-|0<$v3TJtudb;E7@&-IN=$2SWvVt+SWOWytoHB|won1O+Lk2km6W~&w2 zsB{p$5_KJ3b7hiGUCGhD^y1Ar?#vXMLG80p!14dfOC|bMrU3K0grX0&GYJ-4p!8^T zc&fET67|Q`zsCj?qM8BPMSpf0$s+C_LKU!darv+i&vU(%ZgTN!hGBCE^=*GMZ zYm+ka~5gO1?A!NFkIOS*o;$f5bxR>jnfjU^)VQz@4Gh6ZG%0XVVW=47Fs-cC&i;F4@_E%v?DcC1J+_cU zGa~+Vid+tu_>rgl?jd(-RyZ~*!rpE0h;h2wC}vK&&;LOZSt@jFWAVS}-wf?tcqAlm zwOPVd#R`k)f0_*Z{YwS~4l;UU65Rbmh zEt{m>Kg}?DKCk%J{|?4}`H#kiMgs)&I`yKh4f07eOM(KfoF5u9=y)sJ$(kFD==?8JnLK~}+539qDt(mplH^5rM!x%a!Q{yj1` z(vi>hM9{0@L-p|+#Qv(!<+zD2K^hj~I?@B0^JsW=hD3G|KPQ{dAL1`Akx-GY%$gt+ zZIx)#Hf)a`VC_fN`1hn3dnW&UD>;)(E`|HUYm@Wt-D?qwKC#BDjH`8|f*9(K6_@=% zAM3NuN#mEcFGChacp~l}kdSBpDUk4wyg91zmy>zQrlQif)iVg~QYj`4XPo}W#PiZc zI%T!BJ%F#cg$1N+U(>QCMFa%U&PjM=Rg9V^5D=_yQ!fv|-;Xr$Bm$C@%S=ar>^Rq? zpks;5nG)I3LaVG2`G|8>VV!1Yu6SX!q#jm!#bjU5w|~#`Mv&=JFtHv)^9u5}w%og@ zg)VEg0SADQdE<6AHuh#_X5n1oH&`%^#tbnhxpM7?^&pm4fJX`9hIc?HI2l5;pV!4h zpy~38Iy+1@wp)RilK`Kh-~VdoM~5$G%u4>s!}rRMrqf8P zzQ6gX$^0%da-p-NUc34Ev$Cp&)@_lK@GCoh`n;tdhJ*9r7SrbC&L`J06_tG1KLqX? z{&2fR^VdT+2iclMmu0`VXBwZ&cjQcIhDKM|V}28PbFowfxx zh=9h>phrbT6FkIg3HWj!{^^bNEn0f|Xjr!(c-z?9fvyc>lEC$}@U}`$OM4N;hX|y*AlDiW0$L~>XGKL-VCG`G%MjBBf8#wudH$}sxyy&pPOI!( zKQk$+TxJ+i+c8|GGXbB{JU0*c@l2CJP>&@Duw?n#5tmPkpTU+$O#Xl+3HwjtrlbDT zXNH_Hl(D%HIg@#s>$}(Re*+NjGS&O^y$L?Al$E@2huj%R@pg9PsUNavWeb+}T9iQ; z2Wk(<7p#1IQd*3=)!#i9-RnuIvt>Dn1$F&MiU;Hk6o`RV=UU{x8{YJj=JvY^fL37k$eFQ^FQll9ElBdIJc?6ob4B9^n z-t>)a%AYGPJUl{j;MG7R+2%3Xd*zU2-yb))1!Ey&8@HzjxQ7s@C#4{h$3@1bER-ex zl#^2=r|mE_NF&NlSfcCViSrCnjfO1ybKSa)*)(=xA>*{^N!(-@vrHfO3!#NSMBTv^SA)}HbAnAsh2tA}x zYO1D{|AFNR0N!^+nF#nEAQX)r{zvuBU|#|Nx@>4jozz?=@-MzZpM%Tqa;&Me#= zv(7`Uz~TY_XL;3(&|uKa?G^-AM;mp12whs zCPP6H5;qgB_e=cnpEuSas=2wjpr@$>=uB|*8#>1S`A7rr+N!eSiM70(EKMSY<;%}! z6CcE0kTzWHph1U4m6SeUy1xWind#})wq9vKbnYJ>3hF((`}X(B=WjV_#90zDQ67FI zBqWS{V$lsVVoh(l9c#uW=HzT`d0M2jE%_w}v+O}&zUeMFa|dG3tpuiq)WEB{n!ajC6@O=EzC-N@0BMCTi?c44Il%zc{zwVB9unkZ%o{(lWpcCGRJv8NibfZI>Tf)K)pYFqq+R{y5SyCfh8m}2W=0hq%>n%d+J2{Za+!B*m=b&XFB<}!{FaL0WYyN!en*48HJd#C zm`7+J+;5znt5kDxxPSioIQwkG^l7oR9^r~h@Ve>hFbQ@t`i*L48;TO1r# zHa5s3^y1~&vLiCmzU=Ag*dVcYMskUU(Gd6&vv8)QUp%hvA5?y20B6h8mVo|$!XwD2 zaqmeqY;4e>SLN4)0JpGk%h4A53(}3LEq6(Lyat~eS{N+}=ef(riVUwdB*<)}4(P&H z(=vRoA!C6F85FpqJ~1CP++FF zSz|k8e6SdNPF}q*)MpeGjRNNk*naQ%IjWFP1^6Q$olM_dt@ymIHG~(4M@$}_t^FUt zzoR3w>glx1%(kXlC6FOy*W1D)BRd=`T^A0X86);F(F3vawZm28R$D(O!xFPSIfY$X4Dl;)Kkc@E1jm1Vq@n!O8$0Y?4Rb=m`=18~tS}21)Sv(UtM8sp3nsq$|xig!`$ELnMBw!7juyyITw(fO|2BZ54P~f$uK45lU%fsB`HF=`336>S{>z5 zl!CsVqkb%4C?FsQs^;1`*Un^!YN^3i2Y%40v7umObT2Ye<<76kC*@5|F@~H9xRxYp zjB`FWGO%G^ubVys|MX*x$DNB+M$VeZ#I9l`Wz|2e9mRl?K)}XJ8SCj;8VA`WNE(zLJJYi+#DK!Q>rDH8n8^ZBrDB2g~OzWS$J-=VCGn z2z)p?(%}yvyM;VP1{NSQLKC?b9Olry;_G=$2SPiX>8}qbjQ&}^)Yj4YIlfr~Spdki zpZk2`%Cel?B$p>jNlwe;(=?fv^);lBPb39jY$!vBh4P5%m$JK`Ld7e<&5aj0`%hW- zJsIi|dXth03Qw3~C}|lPBRuA=poOXvdU4CkM?_EhSr`inY#laD{Vak`hO!C@3*W-) zffPY^T<+S{)fIK*eKrmjOJCpnl^v~JDc=IRWVFqZo;c20SXm{HF~#O;v(&m@38)t& zt|UE6NW_N_gc2&60#vImOJ3KFgE!!d33@NbP4bkroGud@&H5GUu!1-PjlMAO1u5N+ zAgnFCZ)LfCpC0)3!AOWo;kaD_K7o?zJ0|JUf|AC>v}rF8CVfx$U;axb)M_eykD2lf zUQu75S-`7Fr^F8ls&X$_U?5J1dAaw6)tcwNrz}v8{O;|Y+sV|kjaOU8!j%9#9?ub; z|5qok|64=|v4!5#6aLjRvl6&FgRt;@m~rGo?TgGyTA)E`jTrn{O+HH7^!-~rUqQ?* zf&A=80NX}nH}eraM+kiwj^<%m7HDH2%Z3l%4i%u~c%0UaE(TFk(VjEL!aP1N2xLDRF?k!GpgVlV`1T3J{V6wEgolJ>`cta z02f#l60B|X7TV-;>(H|M^5x5<(9cBh!*Iy+X&s zgI#0b+mDJY_0iunHFnTsvF(uf?9WUWg}6?Lc2T=k_3NEWIq~yT-e%9ul+&Wi?tVok zLBZ7heWi&fQIIF%<`e0=Y-pK$lH1ibi-yB8|GduP3RbD2jt+7Tt?;so5M(NRkM>_0 z-|UmaNq@U(fN}wRy;#NV`kaVKT)L-mb0B=PH|uX^?|Z;w;9NIjSm&J?E8f%(%7yk} z8C4u-7rQQ781@#77pF~OOHJp){WLBrUw}vWNscqcqFi6-Vgcp$GdeXKQw4nZ*_FEp z-x-!sybUegQPUenb{z#!!L1@g^7CJ=K8OUPx^Su{1zN6V=61bAsdgj^SI{IbS#Gv> zn^X*ZCM|XeiSVUwe#Yrc9Pl1uMv`D*LVjS^`6Cl!XJu7GKbTs)Qu5!RgY>HLdu%p9 z6DWMAoS5IsoJ=rWqy{zouZbkCH`0M0!0y0Bz6(&Pqi^zbAr_$y{!BccH#`<7hEO8# zB`!Kdbav*$bo0#Y?UCAA>AH$>Kw64tTW04dp+QHQo=%G$cc}N9DJ^=$@#uweX-dzn zwACfymw5BfV;)>1ktTP?SGx?nyn&F<{VG5XWlE$sGd08f&6~`I4ExYf1*nyts%?^a zBcNSCP9VX+W9M-GdPl_f22J8%`nAIIC%Nk&v-c|)?8|y~4L>(V#OEyVK%0c0RA<_PZKdlQAdD4K$fk@mIcxPAgb=1bBBBY}`f{b=N7%#HHSzr6z3>}Ga?EV7G;eT8+GW&a|<;$%)3DEZ~;JMk8 zAv|K@HUJqU6l6J2q98*Byvyr)`Y9l1^P1^>&$Z$bFO?aAm^;W)l7x>QB>!zggP{|` zH z!Jh^zczAj|C_Cj^iW8k*06x`N7YGQ@c;c}mE(vl)x8-Gz3KusRP_KNL?mNA&kp6bt zvQ~G_7(*!}tL#$Y7Qf~W~MP?I2F9yg6vvfJsr$%AL*(ttbghZu~_B^QP;nM zP)5G%HC)6oz*L=trT|(e0)kuITvj@nYKLs$JNe@vX39G_|zf}v7s}ud>_McrcT9NngVVG|50!xb<&ueTz$DT6A8B!~KBw@%-C7onG+@=1_L$&`|71ImX|= z=~~Q$dhFU&FjvO{9>81^A~!D&9S8GJ2)nNCLeT4y`&Nu6TE-_P?i&Vg&HwT3m*D5m z(P1tBy$#O=N*IiCztu`1!l&W(*S@R2p8^!tHZ(TCuwFZ9iC9?Crt>oljKUGncvf1; z`~c94Sq?3-?c?C!_4U7y>2(N#29^JQ*MpdVg%eAc($_OIKuaqg6BWe|-HyDL!Rv1D zqYU1$1%g~CQl^e`Z?%ggIaBBpd&*KdV7x&#DEHjrJRo2Crp4h>_OY?e_-jV?*tgJo zqoeOJNpOWtd{-CPPFGb`FE9N{IKn}f!nVFi&cH{X1l$;+fzGFz54SUofRpGM8Lb(s zQ8HG(aG^^By(^LF3kD|UOOqEE5E#^WQ%9G0`Y7Gtzv-EoPr$Rw_mzl1nN=7mTC`U zrzxhXlg2h`>C&g(Z)K!bcP6z*NRtMgsl@JQ3zvB*A_Ypv2BvC5ED#kO19{ zp->0G%Z^XQT_aF=cCJLs4K{+P>p6o~JRYp(`1q^{<_IueZW++=1A0*6tu?Yi346bm zEi!O=N_am6DPOxMjM~H;bk$Fvkl|lcQhb+J$eo>w)XZ@Z3m9 z+kz>$c@?}Y9ma8eq-3O^ab*D?D-s_^+gSfA1-^wD|Lf+@$si{pOT~;>c9xZOr#P|I8?}t0chuEKu*f04y1`5fE1D1$6uT-wMY^Y5)e`lYrOZ>$sUReUS3cC&p+I{ z>CscEHn4UfyyiDD9ZOc<+$@0?k0&cH3wxjMiS?e*a7aifK4}pXD=SiD2jFnB{6`_5 z^7Ho^VUA;i|G$RVzvh@07E7rdMBwk9idX)AV(YN|2lU)|>-!-Y05i=Na&EP|jr^rV zPO(pQS)#9l3A(xhgD_Bk0}z} z$q5jvfi0?2l*)4wpN8%FW^dN)DCgSF1=Ory-Gh4|7uxsjny#WJPyZ|Cay|R|0CeM> zIiK6O4$P464__KTWqGLm;>iv^S?)#ktNqfTY4e==g6w-qEBGbDL17tJdq|B}L6Elu z@D`7U2U!J@XsdoJTdKsq75Iph9k=E1GGq-5#215;IHiCu* znJ{k0RE7_cCQqN_jmSc93=LaRYi~Mj<2H@@yy@W4^=fI8nveC9d-vMzz)<(Z?35sb zqqwYOWs9eqF%^L9@~eK_sXamZXA9Og5fM>Oui{$sZ0E+_nLGWG~cNUQOyu2lC69suqeZydJ(I@~h{X{I4i@)bD zS#K7&n&q6GahpYbvVg_%@QL*u^+RI;jBR~lR{48_oP>s-A30k7i>r;zJE!Zp|9m{} zBq_^*MY^zH22Epc`-9BP@T!&7#;;wD&bgt|=4ux~7*2XMz;%ra$i1wg;Z|uwA(32s zN4}g}i}sQ2V3z9j?#<@SM{^Sv=wP^9x;ecI`7GcJKbT`-i$Jg@cLcetsi|dj^!|{z zPeNIlW|ojEQjl4|+dKa7c$(}(f|4G>3CGLNt1K`7#jPc}N=>u)84OIurJ`CLi^LTh zMKLxtr73MZ;JuxIZRI_YLOVA0duRg~c}z_1ryqBqyMcfp5snpbPnJq`=|x)@p+tgF z2rK!;{M4VcG3`bi>Msnk#8KKs;DUyMMFlVqhCnRj(AqQzz|az9iAO|{NdWM&e0B)o z#oXF()yEIuAAq1vg_9EtC@G+416ezJc5aaPln?S(+>am2IQZpFa-!miQE5NL@97z& z0}2EFKhRM4d1TvaWHhvq|NaZ;u*=J@&V)Ct3zBA zR!*Fs|AT0@Zqsv(t=q7ORo66{|0Pjo`@3E9@{Gj4-{#1H8A?D^q3-~+pCYICqc`w0 z{`-eXYOs--{hmY45qf#kgM&T6Iks`MwSdH`6yqN}iRlgpxd=elXv8B3t+_O-U+2g%UG1#? zu??QstXhydq3HixLfl-%St8b zS^6AtX)3kO=KhCm8b=89c_#ghlI9P8`oyyJxd<7_HeS3Lef8_GB*e+f1x%nD;8~q@ z#%fLNpAXxRU}Iy;s+q8C6MY0B3-Fde?q{YI#rtF#thGB>huG7XOqvL?k8AC=xmXi*-3rm)t8q zA$o+o2nll0dc(eO?=DZkddET;z>BUQTGq9wqF#Y1b9&Ex`mVA8F3c8$yqH1SXhg0A)5tN7XDeEkAu5;J@|TJ zL=;8xhW9q;na-1tJ>TQoc-`fGE`AG7nQ;eIV@u0JSIZMU)6M5F@KKVIHjD~b3pLa> z&rA;(2)$ySX?GtWU zExaogy-@vErM;l5_aE&uP1u)bFQ+`fDa69SAb|TcwuE}}ba!h@1|$-`i0DArwIdJ! z-55s?pvPi)pmZ0g#QXn^1vIZ~JKKl&mL3xdIwM4mcdw28h3^VzoBH}^rBW@8xz`9z zK5KxL-;Lr_JjlSof`DH~D8RMe_WTh%BXC17^YKWzo1?*})5Vqi639Y9w?(4#bn+UN z10>LqxXLY@opBA(J%s~pZ%^T^so?!rUtn0<>wK?y5Pe+2IYY)ucRzNprM*3_Fdwv& zM;DglNAr#%==^REc)$J^EQSrVN&B)jB+$Z7>OfS@*T-ie`v^#_c_CSTnA?*CoNzqR zd);N=%cKr{kBu=W?-VZ*zJKj;jXB6>1F8f}LPC*YcL*4-p1r(hbNC3J9AM!v{u%*A zo>28D#bX60z3q+1?e|b*y*zU)>T-yg<^_^bps0Coj~UkV|A4>1z{YN=vhoHd5774t zyH$Zx;vrqucr~rrxp5;oER4Cng#}jNwd;-+4*$#iL1ne7iTY`ClQ%sE{0jhM!x9sg zkg!!+%8>A3k|nVlPUC%0*U45VudDe}t@^C?@!1JjS80Iv$Qp3uJMR?$?d`Rn7DhBy z_a$t;%uTahPZafxIAk$+7f2(+tNfvScYpZ(?N_MD`6k}xRv$|`x$n|fX4k-2)mSaq zTrD_x0np4q!p1%ZHjyY$<-iEnT=%Li=w|er-gmQk4+mtUka}UmpSJ2zD?z*78Rrn1 zfXA%&Dm5A^Kl4McV)>d_UjH7a$F&gavl^kni39nBU z!tiu;eGT|(Iz+RPT5nTfPsqK||;+~^p=1gk- zIo?an~sqc1c0U12bR399HCoprpoEK*2Bge#uF#4nv@zg2uKo)h2IZgPWqTxGTk zfp3P#!h$}P$ihW%RzQqu+ir0|*FP}$5vA2Y0ZKw2c51cW_#&pm6HAhs;Nzh%ua9?^ z-`!@vFMdxE$H9!R9Bdy=`m813${E*foR?ju130w)c2N+RtVLc8i_d4$(#Vyr$B)3> zf*Y%%s;LS3k?8sG{?7(#MHW1Mp`k7M9Lk5kL)O-eH#QO^qyngccUu%kKO9W0?*WVm zhNEW*>WXpnMF#9)fwg5Rk^4`TRWs<5~<8sJ3yL45&?5o|=L@iO10>pI>raUQ@1;pX-riBD5j zAuJ{$f*fFwyBv&ddp6E`(0s6;k_=%zecF-29}kccz!Bpm)RBiIS}T8xC_qvLJL{ZH zcVmohwLZm%by_c4zcil(n(=AoEy1Lz}b+FV}jbFLk zB>Xr1AJ2W`OtD82UX*dPD>8Il0Wk&r&RhFCy>eq!?@oJ%rUc7Occ(vm_`sVoNATfb zEaGX->j0^4ZchS)2G1lLW3Xx`+1zpkQ;`W5>r3i|BFaC_RmiUHJMYDt*}a_EbxWlt zeiO0OBlYgx!`OenjR)_a8c`%7XWRWiL)EB4c>y`bVAhg;(* zYH+#Zyi4DJAoE##5yh>Rx{|F{?dcH&)VC?pMKfq9NJ1S0NLY_fPO>|R16vexqJ|g> zRwBK{ooEP#qvONx1yo19RQW{pGB){|#I@;QS(@AZ;0chn2;OASk<>fT5=is%;2#uq z!)#>Kr#UCQ{elpUms&pAV6=C;F-K zkkV{P=|$=XHF4TK-E$eC=!YIxqk_?wdcve+kE5bvEDw&HUTV|?O&cx_#oO@J7*Q8F zLg1zpB_SC`RECnQiP(Y7bWQy&MVZ+|Ll3X4V=Xp7KMVc{{vuwvoz~D{$7!{ypP`fk z`Li&-NpAf2kC#Of>UY4p4qVQ;C%J%c?VvGmTsjlwT;mpBhgM1Zu!~d)OU6aiOlTPk zKAWlD{s(a;q>>P;g%#Qo+57m#yQd{NkD*c-NHWO&Q~~SzR3zSf0KC`Yxb^k?QOhF|a-#$PgCMHGS;6)}d4U*b zG4^MRQ0ccdUdwN{4G}~LUP8FzSC76Rocv2vP=IA@&k0>@<(70H0uff6_0 z8VydTQ$MY5!a8!v0;yQLC2>6vZ2Og@=8XUKihatS+;6>0+yO>h``xIvs|TN!yF-BS zBn=?%_OSTJzEpY_noO7 z_kDKnv%LIR*E%Q}E(f4g`a_59lfAvizM(09%}dDr?#nV3@SXpqIN%!=Y=BT;0(^X3 z(@x*6^|`q;JqZ57efthRmv5v2j>v~lh$LN_W-*bPFiJdA66i2<>v{7<2*h0`#uYtF zN9;^>dxXNma|gqp_-?n9a}K6{S}Zw#d;niuyE>xV1HL~lh$OCONWA41I$bfSv=-M) zT29H3=~iSg=q#7SBMnsxKiK0bc)ON$dp4e4ZDnZ{nKbis8)C11T5itrC5|d_o0+&2 z7)HU%{Q4XP+Cduwi(jjgVt}YUV7j_&9v$Ilt)mZP;z*xqp3C;XZ+4$52ZyATl~GJg z#2`R%++z;A%wkf+t(kFv(a=nVUMf1`*DrHim3O3myV)Mn62E@HQ>{{{y{t9UA5y7T<~kQA;KuUuqX zXQHC9Y3shRnE5o!le+5Ar}Q!Nwqx8{E=Zx&snCaK%A}bF&}D7_tNO$QOQHnTC?D zQkw2xTp<3QG#mR|!uB3CdV7+r55tE|W%rYIFX!|S6!k@WuxcWeWn^R)Xc@leWPOgo z=6@EfQ=|%VI-^^})MEE(Q#cxg-Ro**7?~L7uiZ!v#6dDNZLT-PE5wD2SW*O?P@?7-$HkSx1yCsgB|VNUn3gql*FFcdt)f&_#z#X!sBtDjbAg=4DDu zZVRwXOaUc@dXsG*+;) zdGuQ0{Zc7W2-1*pHF)In@L^C;5Gxl~P_s^UyRv7Gp=jY~|G+?NvA(l_r)D+b`M1(8%+&sLn*jRe; zgcqDgcf~Tn5H&_|sIy_q16eL`9DFbI@bp2UQ>)Y^APqNU4NuP0hbRZGEsiY?dL$uj zYtsPu)sDWdtei@KjfFJi5XaSC0t?7trgXky8kXwx?Mkj zvkMx~8{=`_p!iZivty9+1N5C4IVUyATn!U33Wo&sJvkYLx2j=S1SaO;n&khcz z9Fb8l5Wb9*p+Q^&ti%9GgOf}-TzefCMeQXuDyKzwYHHiRf6Sm)LUh=DojnN0KLI{r zt7#7@eHRF4CH74?OaCk!B92vlW|PZ)P$~s>BoKk6E6^}gwqUI)iS2Gbzhfj@hEaA- zJ_REu4hKvNxJ0heb{iS%M}27|(~#p$ak;Rwv7zt!6ce`DE6EQ+0ZAcuVxHQUw6@s` zjnljm($X2fNmC(*vbD7q66zqD#1~!-DB&0xL4%P;Iu|b@cC}TPB{F)MvTqwIc|t*J zOlbdHp6`TNEaM)G;NxcG)RR8KX${J8p>o+-Fa>Qffaywah(S#T<`JUpkB-#({YgMA zz~#q)Ym=M0am=Ifl3L6gvwAvUJc>#@f-VYteQEta4ag)UrOfZ!MMdGvTX!V=iHuYR z76xKzt#}Bzh|oX=YGPudXKk8L@PUJpC|)W*KAtPWE}wI)!4nixdsJDCdy)zOA3pjYlu;=7sG*{$!a34z4yz)T!h<07(W zzzyVkRQ%ESk9uWt5*nCF;^X2nOACmEaA36+w)m$f#RfHg$Cd2J&q}|2CB+C9gF%UF zn}gWd63;nVrW$hU{o24S*$~qMK2ln-tO$yi)m6@rny=kJ5iQOFK>C)e34@bbe1YM`)yuOX|I`D8iI;@LaR?9B8 zg2nP+aK#R#hCll52Y+~ASZkx6faze*L01}(&wxiPf3FtKn2_Lk%dznin`)U?8E-L> zp&Wh@0u4?I5_cE%>hM5GoA`?DMcnfzk039wIm&RMNSydD7%1wg2krEYssS}@T0I2U zlb>ecYPhd`WQ<{wofbTG8k`^5+2|Sl4SJyhap{D#OpHIOt7F$q1bNFoOL2?Bl@FzP ztfLq0G=`D!zQj{P>IvZrTtVYzx;pQclQ6S(lFV4)*ta{yc#JUi$BGEPdVPZqUxQk= z2Yy}+&FDLS=YK~=M*28Rbv4XkfPzDuc!rIh;&FpEb68}uk61>ldAXvdx-i^9;DX7_ z?o!8u#5M(*uPwUa=z)=neW`wh3P@ybmJjEO4hZnz5!0o5GozbF*#DjpWnJ zP^cE9StuW!(XQ+_t&@?RjaTU46@i8Rfule?OG#0k&L;X4{R!OX+LI%}sRZ=MGC$a- zxW_56kmQp1V2U!y{kXiJOHIxDJXkFF&P|$+6Fc~2GFcWXn)gM#AP|nhkj=&Zvv`4u zUa27~AFJ2685QrO&!9=0E^BxURj6I5x~!q$BROAhs67&EZG}Rz7M*f%yM2SZg;%x! znp6S;_?DKdBKhW}fUDle!PPETvwFcD>gy}MzOxNMN?+~J^B+kP68eo{OjdfQ7$TS5V%h_l?p&`%<7G|sjVj^qs9%}Xk^diP z?Fp)h{Z1dfXh)9*TY`=r-QGf+CiH&UP8W{`4uB?*WrORNFP93 z({-p}j|+4A3?3H|a5$_iEJ8-HGHHtH) zw@k5yoK!#{WR?DLu!Rd}yi^Z`E*iO3P8`&9P`wD#>MOPfpMFd+!JWUh9zJ>tcU850 z`}h-stQL5)A+pk&rRTMx4%xHd1lzzDFPw7+*DblWR6nbv_v5>JcxFlGT8(|4GB?$6 z)Mr2MJ-FJo98-#CwP`dgg$3BJ#}GygN&6V(A4)~43b|3X_Mpof%aIZja)DM;s?&#q zg8~78{E&|J>ti7`ro8K?5QCOtgRZ)(-eY4f&OoVqsJ3kxDam-F{qGnLyPKD_q8g~8#m7gwO} zLLSsCD83(UIIePbKl9$b)jZmSu?60H8YaeN^=Z_a8Ogfat3j>AOIu>CC-t-P7PJ4s za$jE>_sPOSFqM#}b7GiYwb-$rQ=t zdx|Oyh4InzN210+aznE^hqDWB*GhRYOuqho@}OQp@?Pu89&^T2ffZ zSqHO8{mCD12+&fU5O3hw!W_DIidWvOp6;17a05OTNobm+hban}X{ zsdhshf5w=+VURG5VYuuT7^hfS3hhN*m*_Au7%h74J7Nh{Mu&{K% zvtz(zgWL0hvwY;b{BdLlJN0qT`^G274GT`$2X}w^?0x6jmoNTtgcc%#+#fWo<>s82 z@_)yF-+U?5U;OwIF?o6#l;}nIhAi)Y4TGsbU{^Jz?Y;23MV$Y11swA68M{sSn_4Yw50oRP$;noW0|w?rsix#5BIV`KIN z?sYVQT>+lt6NeR?r=n0PrwEV^N8WKAyJgtrs*&=H;AF4XBP1bG+&~?f0CX=idG=?h z>IEEjvl5hEjoN3OpBW$D9~`Vx6ZXOlB)BGAuhy~+HD-^IDwK=nC&LJBQ)=?pS`mQs z|7JX{g<9-L2kw`G%Jr-sHdoSuyPTk1ze^r#TLjEUo5Rhe%uwvVy}YA!z`P-km#!39 zGRj+8hHB7ldry`e2aQc&1qu(YIeCO!-34KA#DDS)hf#^r1h2jm|BSDFJGntSuDZTG zX@w=I^|Ea>_6wyXbWa4?1m$Tnw^umaua$%TwX@o>Pon9HcZ1#JXPc8RaJ#GIT}u%# z+mPX)VLw4INTbzvKd4;$y5dDC3H=gB&ex;A*pT)vuSC-O;}dUHK6$}!k;|*yC4vir zXZm_n5PjbA?736n?4xuVRz5y2(txq;GNwOiTG0A=xcOXQmEZdgfupIE`!87K&C2_r zA5VNKjM+~o{R->k9>bowf-b)bFE`dKU0bnm4taBmyte6AM}{i`?})b=a(^ZNHc>8w z_g(p5Vp%biY1~()fd6{=B!ZNZW-n@=+GBqdCsswV^yfF!$rI*(lPzcM%vhxUx=KW< zUucjY3orbdNT&piUg${BMiEV?t~Xom{NyR096OedvnjcOF#?&8yCSXNMM-_Sa|g0D zO5k|aq2f_1JI`c-epX-KlmiuyYQ$1sREJT|m0$)9Dl29cd&akfnw#+h+IOb*d`Cq0 z?~%CAM&;Y4NRU28T1ut8CyDDVk*hz$SnoMKzkuj*;ZeNtg%Q35wR$_whbcnZf+2?HsPav$P^Y&Em zHss;Er>c=nVn)3w*?HNq3*>#VRc&x^gi&rhx3D@}LxOVC<`(Jqpw1VG`b$Z@&l&3N z8)~!GZUwtf5}zGzvYhW^GXJUrIthQr5sblLQE^q)FaSeK$fc_z$<*N6gC6wO{OSI6nv zB8p2S9v2|4(9DLl?fG%=nd?2ePU-pqx0%^nGGrg}mJgiXwYxje`8M13@yf|@^%@YqTB!8zQ33?G&FH=QAqMLZu$4*6%^U8%M~J@M zRvQcvG_V3+7I1|?jg>4VR^zhm)d~~!{(iPEx62JVB05n<-9GM}WlV+&g5m4-558#J z)}IZ30v5;eV#^8A+Q!v>ao4+K%u`v^9usTsQm%et>K`0zYkC;%>bw@$y?KeMPXhV> zHU~r8xp>n|bx8kaX8wmGxsDIa=Jo)9R9IUS3k$SSaNbG`ho;*$BfJZDy|?hU1kA5~ zh-{(U$C0mb(&dzel?Qf}i=>=>;4g`B17EztyDf9v+&<;DJwgCQ0>o7$Z;oyP%6X|2 zPXM6$>4_VZ6`sf1kGT`4_tV^7QVV9yuY68O_)wuZE5VoYz2dB^fYETT^}{a2_lGaE zr!*F7%?5TYpD7{!^dkLzntY9e=km{FSCBn5E-ABaeq^-wYdi|{wY=AK3H(r=c$e(^ zw}Y+1rntz^z1BVjW!^IG4pq(VJm6kU(5kz5l-;ZO9a^R?z9j~Qgp_>W$W#2UwtUyK zoBNvJ!&&qw((Vp5FRx3loiGFKqoml)6bHUOJ>pdF+3BE|uV!2;ti%HrwgS+;`K_Ru zfZ*BOs^GcDzYW`{cQ18Ko1~q8pq9KKDtVFoBrmwNihk)Sj*dfxaelQ7>6~~Wr$U`J z%Q}II`G}T|uIrP;X&<>lxKzRoIZCW9-{22+%g6;`BKh7!DtX~8coA8jS+s+Uh+ZR0 z9{&CN&!~e=Qy@<0O20iE?qd0oWp&v4?gv$Erjfp`WS@uy^FnuLTG0+`Z$9CalMlN_ zy$tgl1?TJ=KH}`m^Z?qz*p8k#D8SPuN&7sXirC^SZ|0@q{qidwbe;6TwxI z&WT?%L6m8vYLZ`_RP#%xalv4W@TIyrCo>Pe!UKCust7S`F`6!h4CZ{ zXZ@j&z*clUMgRD)C@iLbGV#5IGtJhtmm4&`7XP$J5F&7Y5g5+?Sb#2 zp?%q;{cmu3uxmfk2*BVr^YUWdaV0=D@c^KPv>~5&PcuJs=NQ*$GfTLL<3T^#)fFE& zih2>^%TUIgH|>fdHE8nW**pO$=E6@VQ{gvwS|?ImiFZPTRJ44Cg`vo ztB8F~Dq>=S$y1PDGd(f`sWh3tNwshZ227mxeT=NQcFa#89Sh?zX#f_8Z7VcFqA1*) zC&b^&GZ{wulgkTjGyrZ56(S*0S?Lu&F?@u{=*_9oHDQtf2RL92uoNlv`oe5c(v%buPt>7leDCJ|O~`mR0lTYf#V=_>|KuAA4(t%(3C48V{M0htqhGLWhA! z#CPZvd(A9i6>iiUOw;arudx0cE${tHqwA_ycZT49qoeZV;jn0SxXI(F)tS+9e4^sC zcxAQG?GzA*+|g;>8}N&eFhaBzz{9c699aGc)BLpvUSv{%`~V&T;ONBatx1Pc5gcguJxE`JBb%oHS2ALa1Yh55N*a3hpyKAK8KmEI?(NY4J-~o_ z=w?7dKww~L9H-$RC&hsJ9qv{IX0YH1MJ@doVM!Trq4DLuk5VJttUxH4O`QD)08&bd zCP+#49FZX%LOyq*s}BX?KFHMcIO3rzLNp`1T;k(2|Cy^hRBH%w-si>*+@DBvQ7hFY zfKuFt`fUpG@+1+I^QVXkbkQ=h@{yapWLW+KGyVQ5d1)2xkvPF96p~m#%ZMoc-9-;e zF(<>1qTokF^bMn=p^d4pH`aLpzo=Uj$AE_Om|0*a>u0++?KnwWYt3DrRO%|+m$QtG^}eH5gf2SB)g2dh zcB!ee0fDxY*fQH*lVa-AH6}Bg1&Y%EJ>=MU3o=xm)A{*=8pp=8&;}K98;mayf7Ui^2~| z<&)S(7$Y%W7$tXe1&BW3g9nUxeZ6?`XokD>@F8MZI_3VfQEFy!`V-I8+ACz3PsRZr zgKqd=JH)m;L@lB|w3qzsd`)X>T=vzkUNPMVnJP2LRCU~mO-mElm7huZkQ+27$sz7! zq5=dD&_(*-I!$}u8ypeX3I(qg@tCLI;Jr8vC55L@_eIEhntLn~k>JZ~PY{zmdGscC z7s*S4hHynr8AU9EtYy)|;`M7TS{y@WeC0#jhO;w->jw`2SIu!+FWJse%7Y-a)uZu4 z$n4Nz%?igrxDpV=4U88NZqSzkSwAM4uQK`fyV!<)QTAc^RRL}D3MWLxsI!vWD~d`v zaj|~WC|>QFx$+Nez#?iVRR85ak;+F_sb3Q(v3@xfRARsXv>18#P0 z?E_KkWGLDND|gM=wULnt*Jcq&sDrA1Azp$Zr zt|v&8tW-{d5(^Lk(tBAgqB(C`<6kM-m!SyZL}DHkZ&x@Z{}W_xhhw_E%O)~$lj@m2 zR*1+ylUFoRQb*4G(2u9eAjgg?+w+u-Bez|dOa22(sG#E&8bwU~)b8N6Q|j{~hJgEM zMjZ4cV_q}bq!@es<0IWinX#`n%lDf?Z|V0%G(z-est}{qd%QLbaB!jr9k0nl1+MRN z7~wwh4(AUQY};=Al&@M6Zlrak%*`m5mR?a40sS9FpRgOX|5L>Hsaf`IAi$^QCa|6w zHxM9*xPy?vfg!&R{S`TFDMtRa2Y>JQWE~iD~SIX$|pM9^vrcodCT=ovPO>rIP9B)!dormK&kzZVCH|L zJ~RP1xUog%hc7if&UfQdB8FEe<}rv093J}$^X*TeJMQi8f{Ay1-E=V??*=>TDasv> zc9pzJ@N7-Ug886U@Wy82*9aEcL#G?WTOUg<5i7N)eYIz){$fo_OHY3rjAl%kSG1P# z%PVM>;?EvY(vO&@=henr(wy;1-o}RlX2G|ze;MKtirJN%JPlmH{?=fq&58!&)2CVZ zPaZ*S!9D+Ua&$z2izo*1H2D$PZNmRz@AOmV9LyMlzn+O|ub zN~|OF?&0DLlKb_9Cd?6VZNvEt&@~zf_dTd4AB|5q&?$eUh3y$ zWP5>HwV*(-bvV64;TAT0?nDolmx55fJ1{gQrEEk0F8XOr{q7rhR*}lepk9GJ$ol-? z72K!klpqU;Ab5}EaT>}5Avcl?xU2ud^&I&Qeq2J0F-#^PZh=5CfUM&#zI}kYvb5o! zmCo0XAlU+12LAnXOq{AAgt2P3?)Dz2W+03j`0F3J=|Ocj_cUD&iNIo3>vj!SV+qvn znNJxnt!(q!+S)-{iV)>91Bjvo$t+xwcWu>I%kTYK7AmI43D4F@UuF}2p%SkwRnl0R zUz8912c^^u#H&p$T_6MKiIg|-XSpu>Gl&BEQIeOa8;Y1L*Ok1Y0?Zx=u0Ur4Tq$@D7Hh9bz!C=Gl#9K| zhM>KHr$Y7YnK={)`J$zg3JT(ZUIh-cyXini=C1M__$)tatfQkN#gab>pX`o@Ml{8; zl&qH3iFj(!vYUI;DB3EmmwBEQP;qmRjV3q4SOixnq^Jho$&J++gE=kOxL?VtS+RU3 zN}j44lwrVK+zZDB@e>A;IJi=Ov@18voT7anHeKI-{u)R0T+KIh5U_C4$M7-lr&@4?w!3;IfWP zMD!7E8mRPigjz6wc`>2#e(|h>ZOv94dQewXiZw%t1%0IM`u+|Em^2~j9H^`I^9kuY zbx};2{me`?a8?o!oF^Wds@oAEy7q_1e8#ltj%!M80d)x#4q7-2P=siQE0epx<1Q^j zYcn%GIU(8|_OZqB9IZMSJG<9!LIu#|M$3cd#9&Gu4%{V|4qJ)SP49dTusQ`$R-l|kz*yn=GsJplI z_&As*iY|nZ*B@vk8=J%_`9MCXEDT^XV*0J?gbF+UkY<&zeM}%QD|bKcRQD4Uz#D+* zrx2H4u;l@?6t1`4;z?*g8l4&Ig6k8e2lz`XX{vZh6)cpFp0M()wCtYVWqJt-5yOwO z#PApy)W~N`+5^O)@|NoduYjOY?S_zGkU!pqOwKs3y20z_u)_|GiEGdCmyS7Sg>YVg z9tr9%$U)Zx7qHJn7f?0Ki86!&&PgX|PFn9jxWw1+ae_7IPG6L!L=SKB{8XiSF5Ww< z{eyQ9<8ZoA#HFXFY0mj-(cTDh_@J)*38|vXKHV2>40)Y`{p z)pXE^+}heYe%eS4)^4DK*EUHcxJLy8FTRPv^$aa$IqN1oyj5z&`k0TrQ<{B4fgi1K z%Z@J#kpu0K^|C1uyfDqMi%ku5eszd|hC}O&x^Q$j{@K05CuMt*1RPS{(VH6Yt}V0| zVH>kQgAWNSu*HhYY|G6-kdy_eAsQTV-maFcu2IX?6~JZp5%1G@YSVOs{!*#2?)No6fv`E)r_Q-NP>1%O-VRE)-f0rjkA~>x3uUj{!^_A-xDA?2y=wEvED?B zdS8{i3@8J-XiXeq_}C3-p}@rwGo;u-F?VZQZN6$*6grx#6b+#v2vz#~S)h?h`RW>A z0N9<#!@E*FKk%-(`Bo#hw!WENTM`)E z6>FVc>9c8vYD+b#H?i8bdT6t$g3Zl6PV*Gm{p5fN>CF4CS#Z5E17I?!6uLvAs$7FR z16V;4C~7199IIWAbMm-Asi;Sfxc<{sFGY+Xie$vn*)mfR=ZGWA@) zYqCeq)sEMA9=^gkz-#!HdmPK>kN=J?s3uuW*1Ao4K|fM#a{0zDqCGkgmVUZsUID4P z?5|f%SW$FO`I8xIE(YYGIfOyIDoJ`(j+t*LR4hXj2Z5C}Uq;r^UyLH>r)idyk1&pE z@xi?zQ&jK(-ilJ&@2N@peZI1wFs z#weBLrA#fbyygF9NUOR%^=f(6^7?>ViA=FQkjY1><5=2gyyg(IHOMO-YDW{ZToCR&BVMgMi>UiAT%dG5mQ2&w^^=)v?Cw5?pjP90JqQZznMy zwyux+{u$d{o!=hMs@1xq*k=c-GIR#huU1-K(DX|<3PkJQfjoRG;Z0feqpHRFWCR53 zAP}l>ul=$;$#L(yN)CJgcU1Liiqm}UHK+XaDYpCD}hUb<>J_9wy_07;s zOCTP^*6zYFu(nG=8ZHr*8tW^SqYLyJ*Oq;5Zs&OUtsWFER;s-3W0U6(f!kkSYH=y2 z#PxKXdc4da!}Sf40*#@l;KTbu0s@X-d!CPa?C??hlRJBVF-mp!y4%p8()H)?##@BX z?6}Kqg07f%>eRb51^ewWspg)^{EsCOKq>+f0`KA5sMz8PXEL2ekb>7zJ}r(z7*2Y?Un9I^{~8{cl5DEpdRF~Q16q!J;wt) zG);*Xwk?P*KuwnGd+u$=DeBLh!R9VWeEz`E8Nw0#4FXTq)h8Tps^zoKru&j= z8&tf#leOHsozgtFb- zO+OXx{qyEktN0#a%-#uFW4)1Uqraa`;obt!Jzujj>4QT;kvba`>wzfjWNYFZTs=&q zJup1~R%ffU$_QVrzr+#qzE>;P<{xR~xRTRWq{gPa2nps3=#O?6gGSeF&#u34w>868 z+6(g>wB#k_7!3e$JB(GwiKQdHs%IHq#sn`d>1PafpiQT{q*EDLX6Fzf`R@we zKKbu%&RodKgEZ4Lr98)*O6q&uru;a_8IVBbbcqJvgx0< z`fvLlI^u~EZ#`!=cG453b{b_BYk|1O!=i`y8`wC%jOv$8L(c`cgyp z`azzFsrh1cAAkG;haj|zq2Ruq>+M)+{K)&C<2qg;s2uNh24UT@X%rs{*oHb&k?zyS zFp3Jp7_01%A>@9(#9?9V_!W9}RSHyNtb>RIonpMM_*8!VB*O|mIGJ%{_*mnY&;3(Q zL~#MI4lrV4Jx1u?v;%SkO4s2KlIeX-$GGrs9vk7l5NN39JK9Ld1O;RLJ0$NC&KCA7 zT(AAbm)>xurgF}>#~M?%7A21eNopTA6k%s` zJIrGNPqUbrW*^TR!Y=0d&L0&MNHW zBx#*YO7d4sk41prHYiA+LlyQy(94F1Wf-=d6mSu7z+dg!`wfUZi>#ecK{J#az$$RH z#N2O;<0ISwcY|tW`Zw9RE!)8pGBJq3Y%d796=z=`$1(ULXd=%|` z8O~R$6<%p0Ar{3D#bwM-PtQL}dF=5D`62sEO-og2-rDvyH5*$bps+YuN=~yp_w@IN zU_*7h8K(w?ura$Skhg7zef+PouM^w&ZZP&-7FA>LwvgF*yt}QE!Z^hPm~iHmVJPNy zIKYVQO(x~1h$Oj*t=C;`mS_1l3Y?R8&f9ixC^cyBpp7cFIbPqrjteQ9l!%aU{=sPQ z1bpURVXsqhw9d9#Ep2VXP=E2q$>9FTrdG&#OS_|&INhP(!4$5~ZtfsX-}Sx_G*gsws3C49{;AZLwRc-@DFgDk1CLEBGSB*;^6y@3*u(*-h8syfyU|~MFGw~@WV(!a%}h3=g{SX!Q5HXNeL z;Ozsy4ww%JNKSw3*jTvH;vkDi>ROxfJWWP`ZT-%0Bb+ATekT#we?v$5}cztrltuZtjQW_ zpr!BZQ_dS!El|1N7?!{8nY1Cu!_hi^h!;+YnfEG^Jp*(xB61=0$8siORLbaX+-__`){7P&5Q>I{>j*_;s^O4S?hwK%8tJAgr<0nH1lgZd z<3+KVp3shtAN=iYLQ%gl`0iP`xm(~_7)2W`enZs%82QzVUf}AC)Z_;{xZr|)R`ala;g*wjNlffsoXS6{7;6h*FOIN5HVS1raKuU z`vevBuq0M1t+?h%uvqejv}vhXc6PQ~X7&fA^-B;y!<_{x=L{9P9E%G79>c75WeG4$ z0T^6nrr9?)r?BBfSIQ&m0O(#=x>9kSQDB@4HC2cGv|Y@~a#f{WHBy0`v|R5;bJGG9 zX?9#aV`GsYS2RqrL>zEbbNtfkYCZl$aO!-%ntB@n*FToONPx4LyI>_BRivu|H}|%l zvvUHZQBmeZP$DDi8*LsPvA_Q{lC|aF?*1~JG+p}SVI`66V=vOlTK{VM!aqO#V8ikv z?fZ0$T3+FL%mY3NW} zCO(4EjVUqZEw9BM01Xcr%2-~nMV)BZaS!vIOn%fXBppV0 z?fWB9QU9m_7+nYhGz47ro*uOTZbRrl{A1uB7xl(BRB?$m={OM#k6^@pjb+rQb$TPH zmk6m8g`-%3otH1Fds0lP3slMkK5^#Xy`9_sijPu*i7nBb{ud{6*gCRe4GAV||d8 zGeeieu?nfge{N?@!DHV%|5*9s$Z4kfzHj_15iH?Af(u=L)0YM39>8 zAI=h!OM3lPxyI#Z2K@ukwtQy6;udl-sbdz35$)~0q7m#--5(G%z;Dfsl^BXt#d(3CnAN0OV#TW*7_h$X`ZuEU)zOLVf<1Tt^Cw^&R~WF& zG-#cqWTbeWHyxsBp{;I(gqIhpoRZQi*kt?Fa5A zF){IQ5lm5kQc^5Ma{bI~YSe)J>eq@mbv#zS2|vtdCQGA=3FqDw{-DrTqNFjt)o zn7qPynz_GHc3@ODI>Oyvh(1Nyk|~ZsO5;2J`%m05N(70|9$qs@^a;=9v55pKjHSxS?xY9Wvo?|arUytPi$#FEo1tz zt|N%pJF<5XBg(+gfjGD3qkbh6@1UuUC10Om6z4JR;xn#X;^^?+Cs(54`fBSiPz1-P z-reS@eb+9D2|uOp`BA$pZVc{k+Z__BwK0^M1`iJN={jk3b-Ht>N}AUlTe?-beS=`D zrFq=06A$^K0Q-Sq39NjJwpGlDvQVw{0)IhQ)0O2fhmfACMqOATIw9mVD3{t{&;PC> zco(6Vwb~mgZ-rEq~SpLY1b-?tPZuu{Ds$0uObaXCW zOrLMRcEh@@4*Ro(nqKU~Kk3%A=p+IQWB!8-AIiScDj!r@9pVy);z1)Z0#|F;xUo!coph(o zK?{hS>#M!xvN(w>v`qh!E}?TE!1@C5k%`M0#(&(DcS4IPZi6RisG!l1S5Kg*D^gHZ z^-`e{6!+Q{9U8K$kJ34Y?2ZS!PYX1{#d4rVO-)qeN`?f(Rx6Dj9dk_laBpl?K z0&%-3u;k3Da3z&aeSP&`lSq;1%e1@j5UGi2#d}?NPc9GHONp@={ zL!OxDZ^9pi7M}HErO7xY@xJIJId-95>90vKD5bUJjgJ-a+N%mE^>D`;7%!Nv$c{!-wa81YP0qF)mH`ikjBsb$@3VUIANa4eO+8p5k(pi0Rd^GLrPk@8wu&|QW~VYyQQV2q(MoMx|DQFcQ?F?{}}Hl#~ofd zhjX62_u6aC`I|bC@qa%<+fhW-5lto^`3nq)H0d2#O=?_XGrnau6g32ZVOvpS3_XE# z2}N$f1~*M5WYlQ+Z+60>KQg?jk3{`$4)R#Y(K zz9fXWmoLCP-uXLCN%s~dO{FK6`ka9GbM$W0`I`wfwX4Gxk2|ilN{CD!A{E zbjhabZpNdemhyImX02n(Q2(@G)(z!NNKfx2VuJNeHT87?0fau9rO z)MALv(d{k3`#V;w9zJUJYkU9e*gD{ZTnib*@KDUhxam$|Q7!40gQ}F%u+Y)!vQ0FV z)0KBtwsipsl&RawDHHuh9w!Vfa?XSK&$FUfEka!WK+vUb%>=X;+EVpo_LNlXj(ME8 zwO~Zj&qTRyTHwI#A@%t)PMl=I{PBg8oJN`5s7OKlpBH`kpeG(IXM*rsk!&y5w`d>g z++M%KnvCa4BKdmYcnrgJb@s`k}O_b$uLJQp^t{>=f za*OAwR1FUW<_EL8{w*&n)HyuS*O!4oShhPEKLo2NA|pFr)rORpGl41Dj`jET2=$}d z8N$yyaz-`~w?IWM7~UwCj^m{|{a9 z=|P>x66~IjW4hbZ8s7d}hKAkdo{PH>$V(`c%WS0|X0@3S+(#;DYg_UF%2 z@I=+@{{7atRso_*BKtoQFu%-#HC$Dt^v?z`Agv?RiZE3$5FN#VUBbcQS<0wH-?h5g z&KOg*&C~2`eR$07Av~AFQ7q@MMcMk?@TAACRXlosd)cmtk_k%Fy~hY(P6K=9lK$Az zaaI%=ydq&4`+89Q3nwqWPgnW)@yY`-D4fGMn9rPWO&Z}g_B-=l{D>wuDbM~)UH+W% z+UC06WqOTT`DdWX%%5Iz*g7#(N~|(*F=Mx|F&E#UKD^>c%Rc(#I3(wqP&0Rnk9gto z-#W@!BVi+99El*dkl=m3?UFEyLYJ2<1Co7~aRH3;hxhk@Eh+5ilT9^o`Dnk7aiiCd;fj8c!#TF;3W54p`!On zSd#h;Jvj?ag8t*?oU)o2*P7CbPpkN}9~udYMrHJ`d0^jsRU)ml?HuCXa{eVIpji*t zcf(^-K{HYP7(u?`(%09d>Zd4mPSY%c9(iH!jw7h)6wWWFXNhlg0{P{P+Shf}wYZG3 zQEMpqiOH7Gd~t2h6Vo&NyCY3{=PD|E!+MPEzt$rru>U-*VGtM!Jo91RPV)iFaMcy- z(PaBcun_h$7nI#?t>8AJe;ZAx{hH=_{hm1R1ec ze*38(Fk2ersRdF!jS|Z$ihzqTQq?Ea!BO_kSc1pWXqUDwSGLyH!d|~H*k`V@IV>m+ zDhUF!e*O%^FCiObS!@3`rjWP^BsI}#lWI(!2l|O&E>A07nY_iM=?VEQRXvaPr*`_y zoZG-WF6TPi(5u21ZQpvjmeMhp73ts>K9S>ESfUMg1Y8VcoJ#wyA5Jzza;s+$t^gdq zCw_vkWifls67XJ)TEnmbDeHItw#MM*@e}#+kl;Ld_Zt$GB0seb7LX~3En-bDW}9$j zMoK|l=hCz>Lm7wwm$bz{HDkbHSd2?>yfb}*_!5F0$wqZ4ai5jjw&5Mv*{2VQw=OW= zDGAmc?BMJ!ov9U8F+$vJyhhaCx=x;8F|KeqJ~%rxs^s*FIbEJ%0A6}XAiqGfdVhq+ zH8r%uW3gFi-XxHSV^UKaHBUNzaklUIF3NLTtb**)L@0o6GrmRjv{<_)7=knoLbN@k z#NySev!eePN}gT()IITB62$B{6Rb43Py!dS&!7%5-KZCFuoAsS>+JR8^BQfBP=e?r z_L|sM>T@uScKBcfd!xTCeUjSX^s=Vsy^wrFR9;RZhymTMQW%y9W63Lx@3=4osIJpf zL;rI~tHG9gc|v3`Hx>ZiTiXbwfVTdnek+f|2`v{_*865!+8ywXV{EUn^}2QR8CHQ&WO%u3{*ni&fcu7hdv8XQ*bz) z;l4#Pdvf+bDoKIg$cRf4hv8o~XdrcKV2}poCjR@jHn)p&t(%42Tcgx~Tz|)wTZ+qO z-roZ^%kM))c%UIZ^R5UuCSVkE(yo}W5W@?q8c_mQTR=F0@nn@?aXhvI7oGAHoBh9W zaRr55s-HUvg;dl@9c8>Xsi~>7pB75TKq(cj^q7v$QYwXuT*esTyUj1|yLuVae6~4U z|Cx}1clyuRV^l@$F)=aJa`@YoffSz^tBA)#e}0RRVm}4HlsMFaxs{bEx963fKHman zX@u+sy~r} zZsP+j4#?c5YOEK=_Z2l;Y*YA&e;3B}B+9dE6QK4K(j7hYTk%$s1q}fTtF*qT-qOrsr7y8{TU-hU)5L zUxOsolg7K$8y{_t))Py7YPzJ7KbYch!Pp<{%7}_z(Qz2*&hk6_JHaEF_yaON?p z6hCf%2&MGjl8+t6+FM|^Anjq+U@N0!A@zx)iQn%w*4C|=3iNFQDZnEitqkH8iyz&~ z>15(?m%tXjD|5hsW?*B3Ydbv+_yE`tN8Yjy{`a5nudkG&V0d{KQ&pwBb$Nl_a&g9T zFHf4zU^&$48lOo1Fi8({$P2ohEIoN|S{ZSs>?pF8 zJ{tYq<_BBX7sMh>Ua?f4!bwL3KnPJ%vJJxja@`p-xZkoBJrY3wP+bx2u1&O<&~kw- zj@jMQr`vY%)?%VDU6yaEr!BlI=Rx{{Y5+S<M_D7@2pyxfx!Dy8e?JaJ5k`~`QAsQzwHo#r45uDGqh|7DAtZ1o>q`50wNhEOw!Uo)KiZ>N2@YCPx=4`XPRB!+}F#cyuY{{R6NQE32VDj9n{TYM*1e2s-Mu z@cwnrYW0I&f0ougyfDNRp65`-$uV+R)$lz-8s9=aLL?=9@ADAh=8QgtlXQZzE@c(0C;2X;_m>ZzHQ#py59%U#@Zl6aFQSWs{-GPM_0_l$NxpiOTNDxoxp#*dWrtn|CtL8;TYoasthrEU zmTwJqY_4w*vx73dcw2R$Sv;y=VEVFFQ|5}7L08Rab#qtGF=v0d?Dly`U*~`P+N^Zn zITav3_1VcOg_F&#XxrxTLB#D@gvCU~@*H^+KjZH{{2DlzbBuH3IShmAvuS&(s(vik z)gc9t(yD0^t~y?Rv|Y60v5a^;@qsgBAYyJMzpRv)rmr>b-F9l-Um+R)=Lw?9VxDJq zYbtURn)sjb~apIZSC|NAhnC^!}nkv;SF{ z^M~#3Xw7lO?g-D#;_-8iVv3!&4z_1k4{kQX;xrp)I_CrNC4;@>^Ap%>;+9Sj?+VBd ziqCp!`VFs#7JYY#T9jm6$I$WPpC5LVPhFkGN!T%4Xx2`&o~O|LGZ?q2cZXtdcUP@5 z>~Tb`TRzmMG}-h-Mls>LElL8x`$0^{7e1&mnuV*@b6P%aX8*LC8$(C+AYgqNf>hu9 z#pZEk>lckDbvrv&u27&eF#b^IRP;PVErJT^?zK)b3VyAk?ZdCRUzI|5Qh7S^(Slm! zslDPvbA71xR*SbtG%msM-mq!{3+u|lcrKShiP2<({|8MrKNQK3^Ya%8NZrg7KIzS` zDJ55*SCnQYX1IG`+`sRmB{}ysW;rCUQrDD;XzMawnEX5^@tND_BZ_mi&)m(#v;2`Q zZtl5exO_HY*x9H}GLpt~RIY5jA+DM&KQkaNY#_%0wHrPBTPMOgpIm8pedAg+Ug#|< zKJJ1Tndz*)DAz*wzGTLLEF*3^W^Q<(b8;BFg;S%}5!Wlcu$6*KtD1la-kVT%tr=;N z5tHkdoAU>==d<{ra31~5*gy4VMHiFBTSndgy99Esl^`{e_eP1+^3*1DsT8;m#ea?) zIER1qRFEO6Ado>i!9)$%zkFbu?a*s(a<#i}%Jq@nLH*-&AXyKyRvB7MccPp~M3;|N zS;XcWrrK#M)@bZ}p~S@9{kah551ly4wz4LV_yw>#oLoaa`Qo)W2*O=WyAE(%|8AcU zo8~;k3lFj^q>>Q)NFD6mv+Pk=+>QR!56SNz2T$7>*PhF0_AHPbUhhJ6$4|^J5&RN_ zW%%}X%Nw8AEI*_ixoTxZd?%nF??|n>!4|$Rkozu?mal?#Y2RfDBA_RP#oG6vILMwP5%S$kJ zX=3$MzxqS^$gf&fDDvrR@Uws6u5u!dwsBBANcRg`cjngO=jkNq3E)!ks|{#^pL@!3 ztZ^So&iGhtGI2c<6JOZ>%T0$ba+rHo6(f36`c@vwXrp6VJcl199*fDAXrR`)dDu~x zasRILZ)_yM>CXu8#-`S!a?7LIrK3h0;2BNerSCIJBJsZ)kOtJ!{m&SzyiYh9C z{SSF(6WxZ^(|;H5e`0TL8u{@AL_e5~Oc_ZD;s(n?oH;JnBGh=<%yXN^7~#H4DOyZU zOsX$03Qqd)i1Q;oOgRA|vObNToywSk#pCq=Fnui%*!EBH z!j7cQxz*g;cLD@ogT%_HlG@6K$a8K|YmVY5zoG08TIw;EVe-sx#(Cx!X~;<*(K*&I zwIqN^9xBqN=<=QsJ9q#CxHHhluF$>S$Y1eEe0+Y!NgdxQH1l3Qww5+L?A-X6T@4i` znIPB49FobS{6-l$a&kt`^O~&;|JlWvzoK_KvG^1F@v|#PlSqO%OCq%mzA3?)$d--!l)tx@8*F^)t5hLsnfLu)j5$- z?D*nElpX1QU7TOYOfiH|G9!unkg{@K(>{*Lqc>$0BGE;>aP^`jaDs!2H8Q6~|AEKX zGGhhV#{%e)hDpD?njbc^9KYMh*(7)+p!-k&eGx%0nyk}5K+dT(hV5qDytRCK&01Iq zB)y%hpIA8ldx5fenB(k^cp+!GsHdsZZ5R0KX0{gn#D&{wn*QNJ_l_}hHuJYeKTHzB z8sr*tS~IF}>BOZuj7TyR`c+&w5;>$1zr}cHTRS%1VE^RgdKT>6wM~W|_-IY>x!~#= zqdsYy?d&EW2uKV6G!P@f{pzj9$Lv8lZhOSB(mDS4HYe`%RTYnzUqnc@Ep-9Q$azea zj93jFzpq!UDu#^U4k%Xr(%Je{fds?P^ZWqwt@O-SDubM4XX^n4V21GB9x%i4b=Ruk zm+SmGtXCuQf_mxqX>-$*e-_nMUrG`G7tiYrX7)`&c`dF-p2WUd`2zeuH(|A8;)`Yd z3>@w{I3LEvJ^t_Ldj$KBxEQ@5+kb+uRCj(bd8!bqhqY@cFXv44JqxW}(rm{Q|0fWl z{$sIKYG})7hs_}>MwgU89vT*VZ9F|lz6KsQ=fZ@nr}v(6uB&*Q9WXcEpx+*?Kf;^3 zq+)Py)m7%=Nl{eAGjSOo7->|hzwG)@qjan}C`NLc;<`p?vxw#!C^Vn@$$o7OPo!-4 zyK$Qv@ANHQei@rIo}?1Lj;=T_JE6ng*IfJvhTp-Dh6|c!g@ojPOH|5ndg7^zlk{2T z)n#WWhvb3X{97ttSngro!PmNg_p3WBo+`Xl-z(g>LL`uD73aG5dybWQsg)v1vg}Gy z!nkH9OGRjJ^JN(r8Mm^UOCowluxIC*o_WfxczU>`|MnGLg$I?0g+fDzd@7U$59P^K zaresZIEmfjH9&5lvM1_b30a(O0b6%koS#aOwAr^Iv+99Q7V>?Y!{=%5@?)_>I2R@j zLaz76utL%Ht;L?W4PnhCC0h0Byzmjp7Ux1s>RZV#y)XMxo+6L$W;f^)WiUxS**2G& z2f4V*8|x*W-|2A?L8tly+`Fkoqh^#dthm-^__rT@1TyB2O&M`NG`KA1ga|7}pQIMk zQ}lq0UVN`Vpu2}xjYu-j^NDxl{5l5{AJ$=xoi;BGqQv4QRu5sr+wxSb7HV;Yq4NB( zP0VL~12K<@yT`pg_%h35XB282Yh2VWP{ns9zons!Qv<0;kaSux9Yr`@VEDijeKtC} z=amzw#D^4;_E*PD`7t0}fjhRXYoo<%Bk!zsSIgAIL`SnVs$!jkcw?D4D<)tKO<2_d zz@s<^&5AXL0moR4c~h99>e(u&rAYCThev$~ev@89L?&x)$H_X|@XmkVj(Fci?>Z1` zD6Z4Fnlerl;mKG`b&*WIY7GM`gGa!{U_TAANrPoO~Oz`GjE)!Sm1AgA=p+Bp4(M=xTn4 zQSWb_JkTU2c>3R%ZN|=zsl?*-XUD8XV{Od3oPlF+#bl?pDc5 zkMgH%?HG(vUW#zg9uBr#p~+!aP3Ff1bo=fI>Czw#s2s)Q@6YU#6$J#10apno;t#$` z+BLpM7fP3p^Q?$`|GF_|k31+VkW8E-t&~Ic?{4tlE+2VPJ%+TVY^O#6GrR`18UqR> z1d43bFf#9lrk`1?%7|hFM1$o6$b!XOqF5V(m}(*p+0{+9336%~V-o)M2YHhIkwA`wziH#Xi49oB%p_7Tmu#A2{Dbbps; zszDDUQ%Fn+rt9FJT6zsrC$)8)&m|DTN4c9dDz<;xNlFmJNXHj88Bf^EtJv0xuN3P2EO!OV^!Wa2{D!WjcW|#uec5AX{B#||B56aVt6L&Fam`SPPUa@*&i5U-2VAKQGB)5$fY`c|1D`~{)EXLR5z^QQsJ zIj8S4(PvE@Cg+|9XW3MqU`(v51S7M^V?Rpi_}QUR0xj>%(ZD0Ly0tYz3IchPO#;2u zP=eI-dpth$gs0*2XulmCP*}=1A|8n&ED2-#*~E%Exp?5MTColf@<<7J{q1^Sp~ahW zFhs3XLjUM%Y4u}y>_qKUe0G0?e+HBPZL-p)rpbE5r~Q&gb53HbzfALO3wAO1&tkr- zOsTWyWYcG?D-Oki8j*h1Dz{D_@=>x}e~QC}Ld!E!w24%ymoCS1Tv+uMcjj6@wC?%{ zl}k;P>9D|#?oCqb5qd4RxWjH~RPA`0Rl9#JSm5Vqt+GD){9T6H_FXz1MwPF?QIG`D0@$K*|9N zhkb`nuqf(#9&ThC1|HFgzBH4~_RafHE);4JcW%3yEPjsSo3cH!pJKXJc*bRKnaVg` zM6mz-K71*-;NitbeRPbncl?WVUlCMlQLm^%v}WXf9~ ztw2yUt8-mH`efD&SU$)J&4#AJ&I%F3#*pz83gt5t(J3`M6*+FNv#4y=)}9=xzk+aD z14EAa~sIhd2*X#^drI=kJ|SW<2Er z22Bh^2CH&T)9B+qFRBrQNcWX!HeS(H(8g?huXLZnLGZfQC9BL*R_t3r_Nk2OscLhR z%;|-Rj2yHM7=W)j^tAy;Oh%7D>&SurbMci%@70gE^A#eX4cxm zEb~XHSArwo6DQ|YD-;)>^r4B$=;myyyHO%ESzugNvpXVJZh!#~un8h7&{l2|HPF= zaN4e5#n&jN_FDOjN25N66P@AEmu|k=!2i5m96aXO-5enG|5^Z7*T>+zh5^GtucLn8 zE5(-EukrBVioCQN!AcYs9v-hSy|&LioVpv2DjN4M?z=Fp9fPRAYip}FXMm0EEvOF8 z9JEI_sp*_Ww8Ib|AS3!rH-CIDEL>Ga$Qj;kKteYv0AADywSl=YP5PQY!d7yZW{^ER z(ehq9Ef9X>;P^P;<-!mJd!eIPn4>irvv87z2O|J-tj^sq4M!OEK(E!M)PeqEoy2}G z2{Q|Gdi@J|>`sxc?-LeJ`t_s9$d9vbKia@YJ7zsCfd12jx#H6yBJ&Vdnizx%1q!ud z52RwCwX$=qgE>Pw`?~?tTrG;X3xeU& z#V91=-OR32yw_Jm_9o^&#l2U1u>EOgxUGyAD_%L9pnIRf6j z#CK|!lf{a_qsQ8-yV=Bz)1H?_t)LyAnDFb`RE*;h_}a9D0nKuN&F2FsZ6#g>`{7mr zD(EZLH+GU@)BmaAe!8@Aeo(Bf-dlJ;qQa2=EB-loZ+iN3c8ZX!-`zAQZl4xW4O#4{ z=>7!Z5iX2(xSV7(cX_Kh$37?5_MK1+&6!jZHj+2JZ*R16FdFo3>)odSVe&`43^J@D z_($r@!?d#70aD$z-wW*6pejG;j!Mz2p9v-i|2k&++a`yM086Q7rE41{oJIpfLnT&@ zjVC~qr>*d`?4BsY$bMhaCG6(|Tc&EhZEqshGwsnh9Cmo)kn`kOmra*h`KDw{<#FJI zS?P7l63dyC+9!5h(q-G|7LyJNNtceRR8vy;(ieSJtd;+orZ1QnsW&;kUVi| zlu!i$G^2x*mxYg>aZEUF(8HE*kXNuS5iNH6J!K$#I;$W%npPS(qUY1VGdnw52t#1*B@?fzAq#oggp|Y4B{=|*uX{Hj5WGG zh|rS~^E_=Op!)#(DLEfGOLOR)a1u+i)Lh5;D~Tc0C1)KW;||d*HN6( zk1ZY5o9r3yO7dC!CfTkZ3|y@^zMiPjGu&F=&bHRk88VJ|#V76VuDE#GRjtcGkoN;J zneA8ihE4#n%nT#NK!{-&zIZ!b;2e2$307o*Hbr#0OZGD^c?lTHP z#0rPJ9&Xc@BOYg0;iz<$XfQ06s%7Jy`St5H@2wpln8CueH=T|WcXran=U^m#b-}JJ zbk5On_M~pI9x;`kee-XrOE87#^14)S4R_{18u!N%`uQM2Rl-xJP&D?Jou@Of5qsPW zw17ybJlhO;^KbFuMVLm_j~|qDJx)?mw?*!cou((!Y%H12naeGhxLu~ZK^(?+dbqT& zx%B96W0CH=i?@F3VX0#i8Ex)AsPNrVR}1E-kJC=$XR#GH&a`>s-)jLP!O1@tTnpbMjqHY=;nK?V@+ z=2&U4-5GBKx2%(=aw?a7IP6>ZZ0mpFlKlB+-_c$bM-^cCjILz6mnyk`L%Bz-(&!QL zi+)MQ8}c3vvMe&qUHF)qd6k>Pc8x(H8LS;KBdMiQeWR{1HQJX%ws(2$cD4TE%&oco zfLpXB-C_qn0})^& z8{_*OzOAu@ueWr#aN_jM+KHL3^SmzO&!uC;ZRIMx?V{3Kns|og+-;2{-jYa`(HEE- zxaqR0;)ufHv76phk&NYgGh8zAgRC&(^XoGc9uh0osN5)!P6?H5FzZcJ=kHPXY|N8tPx-;UPv3m-5O^wa@Q6 zIm?Yj+E}_JSJ1*?;^QPY9F$1)ZfPug8#i3YY42UnhkZOMRduYpd++a$Jx)egqm)gF)|e*#o9hUUkYf&F)EVf(Yvaq7c5?Ax3?A6$2k>gm;y5V-H9^W_U4zgRr12{W=qP~b)J!tD4_ z3m-a)$nn(n`naOh)wV`aM*Yq8D@i$QKja#9+Yez^HnQY)9GItnQ2yu+ZBt+As6Kjq z-hFH^Ua=T-8lys5?*8dzO2U8$ac6#F;QIOc)$*q7uFX^aj%mR^Jx`IkF`jWL_vR!X zUFkS>C=N_1hFJh1zo6>RpMpyzY&vK1tK`PZ?>K}<}DY^Vq@;@ z$W-$_7MV84pST+|K+zwDcG+!1wkqX*_bCd?$gq*imwm^Ud9JWktZ9WjJ^rig0(+~#5 zjDm{V%j-3WAMdor%{Lw!_$h!-+nR1hiRkJXPyFLNIXo;m)rRVJpU-PeaQmX~-N?wa zsJzZiBlDa1SVaIgz(L?mtiarm*xz4T8%=|R01^RcpPa4CGeIIJG+SONr+_xo&3>Lr zre5h14f`EG>S8cieG?!@`VHfRDDK` zUh^>|Oim&~g>2oj|MZs*Rr9>((YKhG`~l2xU(jwF4EtB#4Qj>61XWZho`<}!yZZMM zgk7(RzgtXTt_;xKVJ?tgl%b;rQ2!p#AMUIMBP=LaAR`YqiwexpT#!itR*u%qW82Gq z9!PC|@W=>TI)Wk9Clh_tnBl*P328=by_w{=*k1Y-zzOtb@CAUBm5^s6$5ZECiHfMD zJ1KmsHFIup>9f3Gs|?Aa%E{v#uhz$}AjrFzb_O|QAV?Ud%-KPvK;B`o(mR0+PUiZ0 z7l733z)U^v>DECF^sa$)7Y-p#vyGgP6d;qqDXS`rmKoWbhhjdsUNv2(@!nV!?fl#< zSu{LN$HeJjWq0piI(#u%NyCAi?fvp{i*-!+y&wcS=feofqzy-_P=Gln0Sw;tSaH{m z96)8Dmh=+z4bd6-R>c=?y#FG52bc2Kwl}*>822uU8W{1yQd^w-E-pmSAFjm5eQ&Jr zUZNcM4vKfUuY=uOk-IYRrSLEuNo){O*z;d+Bf6&aQEOHw(d4!(ZS5ZslWAYz78N63xOy_gn8L=0GS zIz!5slcmBIl*cX{(8{UHeJ+n(p!vf$dZHth$1y6rEA63=nI}-Hr<)ahCZ;6@j|u>% z_-{?TvPZSF;QHyE9tZ@=>uXN!VJVK0WI_EqRz}YU3=TU#DP=VL-kRvJn5tmX+GR2B z=a(k|fe996(fZCh_~t5LY@Ubx&;Fv<`RYC&gx$hm;`8ow`0#pGX|tCNS?}qb%d3bk zKqwjSU$}v`0Bi*;NH$yJrs#5<5#&(|7;gh>;H%GtZtaio(u_Qa9IEoU|}fIaNC_$L)K^^Gxaw$yECGg!gC>BV;nftI6g13wzZK$-az3GD-lw0 zc(1OhulaRnr#Xu?4uxbZCrUJ1obf$>W{hZPqdx=(T3d~(wbWXXURBu-yOU|*dmz!9 zD0fF5vzpFoZjQprFPx|_rGwW26G48_022p?l=;;A>M}p2rSWx^RZ~-Qc(3uQDvU)= z6yW)ump6U^o7SiVPzRVHn$V|YGR1XKBX7%=K9{1~KsHo+|dQ6~J6N=7p;;XmM_t$XT z!H~!PBVkmocdh_~LrR(S%%&wK&Iz^9aLz%qD(-J3`9%$sgrwcNH7wlBg8KT%lmn@d z*YK2Ht2vnJX>XdMgsLOMaGs2=ga9vuL%~45(yW6S-aUu?2{(*FVgLAHIg>bo?+G=w zb=mAZgU5l^^m|UqcgSj}SmC~$HfvM}g)(}~DM&rKpt%=#ugC%zf?PduPQn@&%ul`R z;ON(f@AgjdQDY599f$h`fj&LEh)+61x{*pK2+ns*Ihx(ct)l`3`+T@SgvEnZt&WmK zh557_R$emfRUmG{A1lj+GGkbGZ5a@ifJ zJF}(+tx2m3JdE8vJ-RwNkq-jGGrvZrCkImn!78(wYa+_^R$8Ka{%=*$eFx#r7~?V` zE+T@LKakqBe4@kla-z~a;EhI=*}WFYgwmmrA-Ffu7E$F_Ik3TG6{P+VbE~AFpR&|o zC+7)bTXBE^^IMOrHpit4X)rVtseGd}YH9lHb8~b5;lsiomRS&<4f{nFF)(EAR5}1} zSONeY2#N^rdr2m=$ z21hGOg81``pBMo6hQtSvSRqi+2$*)$f~*Xt-SXi^1Z3 zueNRhmlcq?h9SNgy@MyiV;vUO2UT(K!U9IWlC}<rAkFh%U?EH=&72~wR_6K z%IZC}Z3L1$Snq=(yAh(6AK$xGvQWMYDYQ%hA2n#3;NhsbCzZh#7e|wjIckbd9%aMP z3zhsG(+%P`K?Mm7oc}<}Tl9hFxR~nc9q3NLlE<40`g!-&)RHut^8O4NK3@jkHIUM} z6NiIF^)k&i@1RaiP1kS}LCqMDbaCMVY17jF8OKL=R3Cu>P_Qx&4Lcd0O0w4c*#EvH zueqaEqCzGxf8)c&s*VDEtXj8aJQV4^hgSkPbje*6!5t>73f$=bApa4z?>l19536<^ zMw^>fL%^k>qkn@#reet0diut7G2)GPGBFbP3yCGTQxwl1Y0XF68(iz$*NO7}k~7%O zg9Y>9D%qkGGCXOig^TT)$n@$i5+sBZY*IB-6(M;sM#6Wr6wHdssB^|I<0ySpNXg&6 z;X@;n55wx}66FxV7t>M8pI^a`r9pVB|T_iWRN;ANq@eko()}%x=>!_}{_5 zV7rSTj}GEef_EOteJN~v!$j9m-n4b}s162VB5joKK~)Cn*k=o_bJ<`~(kgo)AI;%h zffqvVmvOcB7^p$saF_zmkd>7UFxJkOeX7*3TL8bGiY85Z@Ms;_F$7HlUDuDR6QwBr zyr8=?I(4uF19ny)>WGsQR5SC<^I46u!|NLD{Llt~A)98taWI zL9OTSPjOdEPpBmoGBF_vXF}ItL-KI-6nm07#4Y&6o_wK;&5IWU@9nr#2$m?}4`aQuWiLyzA zV##^wmH5RAanHq5Q zfYVI~TAel4b4y`kr+b}64ayADKLXC&cp-Fg|NIIrTTWh@5Bw; z%lG1})H_ohU?%DCn;Rk;&Ld+`$!e(zq|x0|15g5s$IZPpn%W1y>mW%Wa& z$^GH{=M}(045Y83jmHL4m9drD6WA6Y5YNz}w>z!j)YQUi#nrm0GkxYAl)fNCe2ScZ z_pT;tJy7yxGDvAyd^ios!G}mmO8Rj|$+q6ae0P2W{NE=VRhbxw1=;c`o}-$_r!GD5_P#Cj5WF9yjdI7>*Og4VfgyX52U%;dpe|I2}k z`qCl`&hFq?6A5f_ua^(+BM|fd3;jj*jAAtvCjHj8XD+QV304}5@XETx}!2tO(=Db|79*t|{lyQDX*vVeGeOJ6~SxUsW#GMH@u zsmu1N-IQ?FmCy5Fnms8wIlib?RdDzi2h40hop^}A3(3u&51ZqLM5eubM8_*#UwB?n z4nSs)X020_80(+v3z0uPJ>#{R@fFb|f5%k1M@WN&1PQf4hE4McMQWh;-dzR;&^v+m z1knMCvb>$)mMPAgX%A>=X>I14+6)ZE^z#73e~L;dkd5)XM`MH3KH*8~{Zt-TjIuHN zsm~h*%;M_F8IO17+GtunRw>6hWFR9qo}b+RJX;rLoZ%cS2ges_S3!Z6q?Q&cWZ)s- zSdR8yOqxMh01*F|M9lG7D(yAvHARh8+2`CgZ0~+sm$Y#Bv7bLv$nu^rHtbCI52Eq5 zZ`uM9z1JV*ZS6-HXrm^jrQ`#7_3#D5;lCxc{o^j8g+HU_(@`;W9hZWOwlzxalbbn<`5{yS>gK zH{9CoT0Z@HWeiAXd0;9n0^Z{B(ZO_0y57`ZX}E?82{mf5KRS1YHsak5?4tf6XnC<}gwzpSojERp=R{QqeT_VSvYsNcAi)Gh2cN|a zN&>|#czB`K?*u^JQBq_D4Syl$DAUaH5hTMO9iz!BDhh*Ndg_Oj1i8bMSg^R3>yjnt zYUi9!Oxa4y$fIJ}?y*^EcCpCvd3ERke^l~YLf|uzY^LPo(n?!*y6S4>k&otLB`>2E z(c}I}f>gruBF(tYd=+(;@9O^GhfrXL7MSaIsjyjUib4)|3R~%Wz{*aH_O)E?5_d`|p~xiwW;YfuPErCIHow9};N7YG!l46GyBzA7jH51rp4w z)L+$csvS7>_VfY3wY=1bj-1>Nuq4D3x;-l>+=oXoYgOv>n)S((|5TaZ^0al(s5&q1 z2b^_|5p}HFK`iCC=R7(*oh$GGqgHm%T1u6E8H{3rv_`Fn6dSU;HHU|n0--;|gb~9t zGd=C?caM`Uq=-IvjAlQO-r&5lP6;>f<)frSp=|ldDeKP-$44hv&-`%-33Y)mcey*$ z7ZbtP3i~Ov#X+N(2-5(;UyNbWV`|zOefD!M!QeCQq@>_*-XK8!MLg#L-%@c|Zb5rDmq+KFT{|N)l6|_S;dosMP4+JUOdGxVuy82E|4jsl$x9$yffB*YEceOot zc&L37>~+6jm?}ytYY^$~!M}?Ifif0DII3pW<3+$szhk<4a`0QjtIu;Ous6ca1&k8t zSJ>w6;I)xvLoV>(@Dz~hBbSa~FZ-tSCf(&g9ypR5jyISRaR>2L^FSNBL~9(_Y1sXj zWbKjGU0@1Ut+sz7*t^ZAyr(;LA+Y+u9B|dX^h8PGQMXXEds$1^SDZcPrfK)Fw4)Q0 zy}8>izP+W4n`i+4^GkftZdT}mPqr5;Vy8o|oRO1L82V`V>?4cEE_WLl(CrVdcX>tS z<-J%@TXj!}INIZ-@y})*Gr%ljyLBc`GKd7lJ8-u5rdec}7#W3bzsBllZJaU>Jt$UF zl<*Ls2WpLA(ct{&2B)LUvi<*NFX7^;SEw&Iv|I0V{)QquYS-gZ!(z4;706?`G@l?@ z^bj85Usw^_caHUMuq$bf%4&6cC_qQq zgM+1@#~jqNPR7oTUn26}MV&v35)U`W%+jwIFFhf}ou#~3fti_E1gya@vLQ*5VrF?4 zqLQ6kp@;G`=g}NQddPC$M28BY;%&4@~5d_?~H{X7LC88+D`0Wz~Xe<`ZymR1=GxpE2xRMcqpE%M`S-rn#m9?#YVvsZl&I0~F2?IOK^CE`ViCK80FD4d83$W-A%mo zehed`3rLimx(Tepu$m&$zn%PKiv2x3G-HeL(P&L_t3?&51<(_9tauXZRP);!w8tbjlkWC!|U#7ASFF?D=dpyHbvo)g1iV zkGXq(=O3KvR8By72&cZ7Y=TK8*Sm&-l9FiZr-emtV0fP2SR7k4wlQeNYVkp}ZF-s; z@^S!K2HQ<{>~>8|DadO?HpRlV>Ic?)I@i2Z5Bt)}AB4V|Ab+03& zsW@5_k&ccVwBw+x9`fuF7Ic{d>? ziHdaFXcdg?4Rv519)|u00zWAd1hPM;$u7Y`cCJ%nWv`Be2wSS)e=7#|8@*~z4-fw{ zdH6Rr&gNi54H)}SS3}zDe`5?`Np}>c{5)vL#>9+fQ9>3^NM|8tKM?GwuCy+EKZ_AxkmBFC_r`(AycfveDx%jVblj8mwK?oGmH3 z;Ww7ERSS6~^&e>;`e@dvN2t$)4w^(FE3o4AF>5FnDOLUWET{M}h}5uXRQWm7WTXH& zO5LK}`i#Htgpkq~jPU6BvSH)ljsU!*<7~O~8$0=eiSMQU(BX~l&e>w1#liA>D#X zDUy=X^nrv7;T2G2#I1S*^D|m68qz`$14I=3xWp|~@csOpzm0ltU9t=f|CY85mWUf< zUlj}^X5?a%fvpeZNK37`MZE)(tXwn#=)Q(ksFJTq7H!619Y$fM7I+hYj(`;c+(EDaGO*)KGuZGTR2^!YC!(zosnyL!8Y~XXE0-oMLi}MCmQ+s1 z`(<6yR0L6eJHkvs9TpU%JYm|6dzc<&0j?)odTwsf&9nDQHJdtfdp<>%Nfk>WlOiDu zVoL)xJ+q|R$AtC|5aG{y_-+*))ad|z3X{2h?OGxD?bVW^clv*nq`+Z{P**qc&2PE< z=OS+3Ku?DOvmWzH>Nmall|_%MiN7jQVPJ^MBF~>n;+uM8B-oHiLAEuZibTuCAc^#M zuatJw3Mt)u*Y@YZ!3pwDgmp7#Zd#!trj1X$e|8?f)oj)jg?|98O?Yj* zxcfj1F=^L(v$$ZG8w&|JKX{lU&AY(ng1l~e|7PHJsSNPQ%ahfJ9!JC4dkLO5JR@dr z{T`hIXc*x>U;PSB!H|<(asZLbJpuG@C2BqAAqnDSF|}zj5N7a_kZ=hu!np=bf&##d zQ!i1WuN&TUz35pt5(FAPd+}f7y&-l=t1B81d z&YmQ}rezuu9ts@2@OZ%n05k8rnwks%e%#$fai2wtkx|oyVIZA}%YF(vd(b>GCj~xy z%1fT?LAXGO#NZ7Rf7;b7DN0y*T`lqVP=X@nu7;Z2v_6cTA=k=pX$=AULt)A3*#zrv1 zA;Av+o>vuERV7QQ$;iSYY3};?e#VQU(fZJ{8^;dVFxQh_4k36tEh^t)lqV}`br8LQ zT(4z2!1AE+8;Njv-bU~lcxV-}eY8k=AV{!HRInI5w^E1qz!Qs&sYnxZ-_ot3cM&a~Hr1xdMYo1MIz z{k~gBNMy>3{isVsaMgRXB&0c7#MN1ndsW+$DTx0cOagGvu|MnYe&CHs?Z;|3)6JC*F zf?2A-p6}9{>fe}jFtg6jefsGMAdJF+_Pu&xNQ`KCCvv~CUn8Y|tx5u)N-HEv=sb+0 zhJ5VEU5EYMSHf%~BUJ};1A_yQ2=V!gp^TByeQ?Dl6ZB5)rksHa&C=PKqHYSV252>3 z3eT{u=`p8x6`9t*L`hQaw2l$&+3R5x6Km<4eS5^y=cItpw&GmBAL8QfJvcCsN2Ke% zHcajRL*e|Ii0iiCD~XE_zIX3nElv?Rec;DAW(pV~i#DI$z0FzJB{lU7NKy`&{ghYi z9+f{zrCeJ!wiPaKz3sch79Zw!IyD!+;}EAZZr5VuR*jxAqU4hOk{lBg6RLXfa@ZQv zTY_qOrOqY)?2KqGhAM^}P-xX+D?(aJp{fa4eSK6g9$NiTgZg)-C31C3K+ye25S)z; zkY3}dWG662)E!ZXpVj!D4{Kzt!99&5adZbYIFUC#+rF63JV&#jE6?$qOTt|g}G}RP>OafV#HwZrP-uJ_ zRqnmtG!OxHy-X2?14MRfb}8qnooj&5o_*f^{j3Jek^YWX$OU{7p7}u?4+sxranT@U znu)n{d$~G1LTJAlDKutvnsOg0+e1)=aduiEv$(CPjUCt%0? z7V+?aW+3!LIccwru2xt?1kx+wvRjl9)J*I(H!IybjFRPJeSVFR^)EM=AquXW!Y8(3 zf2FoDQNdKUF}r9Z-TI}Sr#_L-#pf7x`UI!B+B7Uu$7j!;t<(t2u8ItaMHy@AnCdbz z2+h-n?r4+h73qR(W*9P4Ew0Z`6=~xk-v}W~oO01N(a?~H`|L;8OXFq=0g>HtdW)1{ zhxwLZh1B$>-XgLnc`4+=k?>E$is@dtVdjMjagK8ag{wbpdj;Zbmju&PbMcT_iFB0x zR1T&nQ&=NqsZCq{Na__|K(r3s4PgfP$Q7P?8Hd8_`Q?G#@?2idL~`HFt1v+*qc~x{M8yiD^VZ! z*R9Tq8gDTe*CP@RURYQ#@&A15$UXS}xF)fjY2kO82Sf=WoEBES)>c;$snmRw#fiT% zjP$it1I(j&3-pwKGd~QM4T5NE^+LKhMO=+xIlKJA-q#XPo^fvKjOE2XA`@7q_7-v&wSQe4&P!kHWFa^JZVQ71WN6DJEHlRgRCa zSr1uYCrCvL+_kf_`{}4dI!?{x+w9NEDIlO=C*MfuQ82y#YnQ#OkBy>X!IX zZ?CTg%oIiX_@V*PB5m*edWh1p;eI(}+8qmxPbhuLdUq{U1d?UXPK$#UTOt$1jq zbr-QMGrSw#IstxCUCdCDio10zsvHr!kS0@uJ+Zc4g3a`6%?3)2 zjXtjsaiUTt6y0TuC60ITu~H&#Ar;v&m;gTu7*LNr~oJJ_Ez`_AJ6EdWNpKpYG} zP{qPa;V{`;?!qx@NMI$S%@lk^R6aJ)u}nxE&lA(R#P~2mLpLs(0spgJvF#W`HVuib zlV8Ta_p75F2h95W*<=yAO&2caK3K7z(V&|A&zKDg8*K9HKrqC;EztB3`R>jf#N8o#!3VMhZSX> zY~?Ncw}`LhOQ#QUaa_D4Z-G&E1H2hoDmEU21Z(S$9tT0P5`6-#wlp4WKF=DzbCmpPlO zeMGd&4(nsh?mL(c>#6GSkh>w3rr^ ztSz*hax@ht1(<&+II1@j%=9#Wea;8b-0)^>!Kb+I-EV%E>2J@=Th&DI?A_fz8uCIu z*%R2B;M%(Y-lLAZ04oAax3Y7!Tj4W;Iw>sd)|3G=qM%AywzuRadFJ3$@E=w7`vN;S z;_kMlBq#q#6kH?(Ph?2(Y=5@47q_HaS~?FoS?;6BkU{l(<8ZstLxdtG(xSCF=CYY= z5Yj5jL~52VKyVu|vht~-D5Nsps=WoTJ3#q_PF|q z2mni-@IO@-H5XtLm~?0u?mFwpXBE#IacuD3XTF;q1BT9Si_1npS1@wCgpcpMP2z?W z?uv;T542XFV?I%K0TD0fl#*6m$A=s(%`s*oUOks_fQmb)7I%;W!!H2Q@=98F)l(8M zi8-pi)?!HECWp7sYI_=*ne`sFUh+|riAZS^ZftI>Obv;KK+0OFx=3 zFUjYoKa%R6$xiKh&somT4{rwJ^18K(b*rZxmf*fpGcXupJB1{i@#be@P#;}FG-PV= z4|jToLWdW-%M&jCnQ%FMhe-r5x&iTD+7c&4497%IgAYy+6#%kwe<%DI0M&@M7W5afA;%&wM((sGmOK;!bVLJ ziNAM|a{l}8UvtOj#n40cWo5U0S~K>inV5K-kAl>*qMDn@6GFNNC|8 z?t>7U;`d+rUqW-d+OA_i-snRE(IA4`{LCzWVpED8%py|EeWGrEO~rsetOJ>f4>*Dmk(ubD(xc-Oa8RI*E78QW-03ic6Rp*KC8goyg}LTgtROv?lh7- zy`;;_l-Aq#sKxjYlAQN^E}c5_268HQ*@o5x7_AWHzhC9E=EU{X+BvM@fLH& z??q-WOn|QU355o0dN+7Y+eL=wGirO4;$^C{==Bu_yg9jqF?X6^8JYgU!MOBvHERz{ z0Mj>%-OKU?lf|5gfjgP5u*Mu6O}e}&H zNj1Y^&b@ju_Go|a2v^2_@MYI58uf0WsO07m3|J(5xPpL=TFYEtT9gPfPiEn?`6W-J zNXir=e!yoQaQw=-x_0T*r$K)%3<8GUUU(%Ka<8#z*8*VrJ&tp2(5z#}6L3Em82VCb z*xpzEwGHqs;ilK))s}Eh#}up*{buG1zSq8fEG$cFF%Cxd;Kq1!{N{?okTu?QX8a8K z=CWME5&}dSkAyR)EB+&l47a~iHzg;t^eSE{ zt}VyX6uT*LT!S7^wWS_3N?^t!wGpxoWPuT;1om&ovVl*?2W+{ zr>ZvOx_!n3H_@M3Y%nhif&lQp#`hq~GCUjpt6cv5E8dsT0HKQcenrC3#(?b=Jy!-o7q3WwztdC64dFG``4I;t@MSiUNTQB zZhm2Tc9ZAKThQUAa9pEi{zVSMAXIi0COf!*A!A(w1NZHA9jDpq=(Zd@ARK|IhJcq_ zss*s)+tabST9YKE&q?ZFh`sP$%1Fib46Asbtn{Yn{ZJb1QT|+0-l{WI64LaIjja@x z@lnUOrRf3(KfVgMHe@iB?LG!(SC3?b9j#{cxl2VT2Y#_6)!y9Kegeg4pOrTyi+&|% z{!lr%4T+t`W@q1sklR}ZWGx8cWsVLM)M*&InzjxrgDwps^~i+%KK$#llhw*^X-S}=%!oA> z)Y)-IoAu3}{OIWT{7-!HYGH2k1CaUjj;z5gC9Uk*GXUF=GD}njG>4_7I}ja-P3A{g z-W}YxB3n4h$tl?L_H?!oo@a70oG(m_>X>I6J6m8`tFh>Lu?H7N24H`KSuL_Aq17XH zbrasZ^LS;ZrG@2nlu`0D9tvev4@+YIV^ltV_9Q|(viX1|!=Qcmkz>*U=7JzN{R34F z=s6ex!xi&)vf*BhF|-!Rw8*)5w};5%jb~tpcNxH;9(oVTkr}(r9ZxV_W$Nj(_On6) zTiN6R(!JNyFk%U~KFF5i7jt#{W(n`MW`hwMvJ}<8Zo6God=}9+%Q`MTJ~eY^Z1_kZ zW;!3`vfdOM3~KR^-^RyNgEEq$j-^zs*r$XKS9yQ};(V0*9~EV2d-Q}AJ=^@vI7SovURHgcC4z+fLKM({KcNxB zYMSX9??47{V7kJe1tSD0bcQ}0Z{zqjcO-yPKJRYi#JjOAsq!(z-|mpHt*#}vJpGb= z?`d#)MV9)ukTQFSrAEC(7v8+Csh267`RUR>V?S{Y@p3fSHS6Po8+Ro{cBkJeBOu5WiWf`nv^^g&S~gT2*|QC zWbL}VL`vuXt!=6s2#A7!NID$U0G_1lWYhrE3+iRCuj$|JXPv5h0p5wEQSvfcT6ZCd z1}KbLr^&#%H9#22!3_AU16jO0^ni~J@K1Oq!-fx<29%#YJVL=OsD2Pt~Jjx8} z*XJxhDvSp}V`$1An&_vcNEY~9ITA|PuC4tZ4}VU=T!`D{v!w&?Jg8Uhhqm7aR_T8M z_c&uhWjga1(x#bc?V{N3=mAGW{pUcS9{@7-{X5HKAXkVuhs1GketgPJ0{=lJ!a@Km zZe#<@;-7Mk&lpt_7XJo?_{>EQ>n_+m!n=4&MoSF=lm{v<|5PW`+ z2~QDY;@AcY?xLkWV{j^BD@|3tpNPjwn^u4!@~Apc6(untL5`6OVuq{SWZ2RkZ=?>` zDMv)6W~N)ewoA^~R=o_Mj8jbf_m3WO3s+TFu+Kj5BhXkA}pQZCu}9 zXlG{wxx(nkm*YAo^T$5W%NzC+ebMi$^lAtL)J8|!;$QM?*n2Go<-&mn z@e947k9>4cla4zPK^%!&0~y3Vf@GbRtKnTo$j9`AsIjFkCw{Gr10Ln1_!+OA4!bJ$ z3O%KmjwLsUjX?N3b;^Lzfm*h7*YOuX^s?H4pW#FJVEdQ`WCF5@>!zZNOXKlpDFoC* zgMnUykLl;L8r@R1ZrJB9g@9YO2?)3wB|o1f2J;yYpqGZ*i6|1zH6(g^+Tl*1l&0B< z;k2CIX6@1`ok$lb?OyUMKl=+*3Siz(8D%}~P$$yTDqVViD57cMYn2xnsYnH|6IG?f zFMj|1=wrv)aZfdKO4)BMQ$wn{l;93>Gc9xa$g-4V!m8(Mp0FFlv(f7MLV&-#s_At4 zzIF)qUhuGJS$Jf!d{yOX;AFG0El5a7R|BzB&eK%*l^`%{@DT!{_!p8m9Gr3?DBNR$ zilp5e8+V=bOPW0~&-}foo#C+6Ec(r4kqbuQ^QS&A;<8@->n3j)9i~*y{3ulAtv6?k zK||p!$_^HN{3VGUkV++(sSdp^V2G@&$V{w>$VLNpJSgW4<6nq?Q8zTuk&|;|{dZ+f zhONMi?as|j-6;hP3qC^D92+bv8XAOtj3sJT6sXpA$9#9-?Qzotssr;7Q}(-ML?mW@ z!?YdU{9&(KFM!S@QUlR1Ol*qZd5aFhrZA5Qoz7sz52uAERZ&oFGeI)tT&HEEB@byR zM3Hd`NuB2xi4}8*OWVEMdzx#h$0CwhYPdRZPD3e;k`4>Lp+-}9yx2r(o zuy-K}A0^1YD~w7%sHw)Mq_d6CKjS4iIHY5@l)_cSJiDd&9c!o@cwuY9LHi8*xL(Ht zVSd11$0MF?aA0!lL7DX7h`0EUK4R6-t*UD0P2{}oT5S#2w3&O z&*0O(9W9BQ&T{YN9JJ+521yqe2>|QnD-=$-e@gU(s2G6nD-C}1f3N!F11=_~01^)` zdG)_G4b@Ljt^*_kTUKvs-J}&1zcT-UOsprC=Lm zFU{Ah0TGyoMV}cHBrH0a#qaa*RH>?I%zdA_(xXaKb%*a#&lKtwXx+~@ZTWYJ*=lvz zbqvC~fQ2;}AO{C)R)PxSPD)B}9lIAC3?>X;h^nvftSz7Pz$)r*zp@1tEl#+6-n7^5 zO!meucq-R>Z!iP752B>X|8SR!7${q8%c482Zil4b|FgSZ7MbgC;02EIe2nty0|TY6 z;veoa>fza8xo^7(EEfj*-N68LfRfAU*ecL866Wv|VeRPAin^ptNWnhZC&Y zn}fBEJUskxWc8|lwO07q5AYDuZC9t;t7EM`Ns7GcZd&3bQSxQz!;Uqw-|>E{AV-2e z3F=~){t>Dmi|kHIOG}bdBARL>WCZddz9&(i<`7T$Mz;e$KDU`h&Vgg6cy{@10y1CX zXOx&yV})^-N{)k=~^noY;Q0O16O?Kh|WI$Z)do+yiUBNX&ynsEL|)Q2*<6 zS|HUBd#^>btaq?3V_~9Cdm?8=*H{DJN+ohpGQoL`PtZq=fxxJd@0Prf3pykaAaKkL zlehn#VkYG|fla;OWB8=zizXxbfEuUJ^jpTVFK0~IY!4;hBsImg#&`t8oyoLb&j}z$ zy^qKhg(6hh7Q6TbsZB++Z1J&vj^?Lgrr<>MPFUyNmb{ButczO9eU@e2_ zy+=_)2IL$;sPTcF)C~4yRTCd(>{h_b=Yvn9X>|NDJp`K zT?+f#8)DFWK(CjG-vsg?C3ELN`&`bCS!pO*%?J`_$JZnX>GL82!K$jNKxyX}H_T6{ ze@#xdZEv$eZ31VLuEm|5US){fQ{E4pHD&@$Daeyd^xLvCliv2eWbvBc!F}-F5S@MA zvmx34>wmZqAnotixos%Q9=YT<`iSDOt(6tNRIE1z2wn86F+kX?q-7AY8ne{&bd^^UGWvG^BDg?AbpgqR4G@;jWg*O9~Z3fHmyyE89#XC%VZhaMICF0KTv#uRD&E!Km))4J+3I% zs^XR^50j;a0&npWUBCk(ee4qURi<8^Ri9}KB|lVt$ZvppIMUuhEoG!dKt+McBfzJ~ z{g@$56*uO6cz5zO<`eqGaZw{y)fn8E5Q7J-a$5M0er_Bw>M>I<{5O4_txE6Qr-T}- zi1!SJ2o@_I<&*U@SZcj%f65EFP{WGI2<`JEl&|rX%iVKR-B02aV^wK?ZecMdVVtL3 zJwg4Ojb=gET}g!wX?G9gAHMmVTJ_DZNZMNzw~mP z$wCMCB3c;wFWPtvtQW}BzB||D41-|NSlwK)ISK^=dAV~a*mwt~44Ewc&d=E<6Ie_s57uq(upUpYp%HI;*B;_hIT423XQ_zpqq`)cm72cCMa1Nt?z7%-FO+ zTSMKG-pp(UILbnpbAZP%GA9w%w=sV-ak#u{$6?}k^8_Xls&2kroHb{atH$}?yp@4X zU{#S?@46ph%DU&X_b>gTV(JB$wrO0uW898l5ykXjE)RjqNgl*gVG4I#5% z?ni5AiG3wzN;h>KAf&>J6S9@Z(H(wQ*6%?LCw)}NdnCi3q2K32Mw+p zKO%A+TUmg{IO`oUhe67pQ)5G+3`0+=luTQ*iGXUvsWMtDyK07edvOs_0*ej1<>oFZ zhN=v|dFIt58JxCs7GTw6KOb2G`jc^9$3;GXET|1v;@<|x?UX94anpT~i&^i`D#*^1nj?}c=U)Yx2`;eNx%roueam`-uH$mOu$77odt^-F8(haeK0X)j-$Y8z|6lg{}B1Vn3q59RRZ{1r{~)8<|NHiIqB_TO zg6!XH4h@;ceWolSueUi1coC5pAUv-_*!WVnT`0hefs!#k$MrwGt}ceO%*+*df{KS1 z%lX^Tm)>0M27CiRbyP2&@eK5=&6k_caP?THYp6KZ%gcnhsKaWT02agbPVID$0id&yxsvcS-FLE*-!|<02xRxbB7fVec_gU zbKxZ+Su&z+dUi4T zMWV?dsD>?-P<+3hFbcQWtdEgyoz2guy9e>7sj}wn8LDEl&SV$gkkPn653JaVW|=C*&BpDLSUnB|~RK*)NN>Yzr5(P{8w;AD7a6_JEn!`G)LP8_0< z4Dd~5fZ0Ih5R9~^3%rQEap9Vq4mUNO=RoC%RN90^2lsp!1ODxkgNguxh-j==emsCl zm(j@x+w61y*{Q#SFo{!gHWX^Z-8=ciJu6_7OR{*{d!cg)lsK zcsx9G%S*pG*5o^cL23Z-G8UwwdJDrlRF9W&ROuV=9v;Bzl zA5iGSVEdlM%_hfkRO`mZyklk?rk#-}%~ zVK&rKup)s#a(90XuA(?Z5awwqO2YJluz5=DOXB2d2 zz!)@qY$$MK1K~cXtgJ^~6%-VLNdlD!56vqlr6XrZ38<{J0$dg&M7lQJn_9}>p9VM$ z!iPk$X;1X_-$`47S}%wSU6zIm;8e`EPo{_vbmp1}L*5?%-k^tkza7;D(KBd>V6X}h zdptSUrcC&?@88RV$s)v6qoTfd`092qz4Hg)+;wWGn>EIN-)y>Z>v-%8z1gRRixDU+ zU{~U@BH)|ey9tuPEG*!(k4Y#jodcqaYaUiUvd}qvg^H%2sDblIoz5V+s~b=g&?qTd zBXUiNERFs2VS+D(W9*3oGKjM>KEaEDI9(oLetAHPVduZ2!Gk*^>>Uj}Xl=t-1sDWX zN!fC6YE*}RH!mm6H1CG617db_@Emje_3IvEBF4GT(aEt#UJW^nwb({TG`@L?3v(qF zhTqoqLCmr2t(yk}YC=Gunzra`xIR%-Qo_628UrK*i~xgf1n#HX8Vvsb=TG$Eo9vd; z2k}ddReo<)%+eiqTLkWqNVfa_OrUa*i_p&}Lva228yOYle>fXD5gt{?bz!H#L-II+ zg4RI_E&dLA%n8wpl1bmWQN03RU`0C0ACz|MU6u5I4r>fu9*FWM(i_|%lBGF><6oIs&6YxRJ4_~8PnRgLQVHF^+~k}h9<~C z$@prATZ~7=z+m^)PObvst;ZG2++xwa)-BTgU+05KT;#h^#`iGBwQJ*842of59xF}^ zOO4HmV-8Gm5lwY5`xQ#RerZdiJ%T2HsyAG-s*2m;dELCR=`AA%Ls!ZXnBfm#N+41N z07_~Md{TjATyk5xXFiW1E2Xcd=cu0*NDx|-(MI!Z4ql1JQK-gK!ki=@K96p`y13c` zu)ThFUF-?<>8Q2K@Z_Ifu=lAjY)s9z`1DCKz#{6yhq#X)gXHtD#rpsykVy2EiKqQy zCZ?*UmXMW2a=>n3YW&@5$IjL^2@BDgbMK>3dQ>zv3m`R$V{VKVgtca^W#?8|FuNwvI_pP}JoBjUHzqf216PuPcxLKS|Y%bpQhs~Bu%-w!{a`(;I{nZ}y zAN)z$wMyboDJUMd?_$QnlI;s5X{8;;}*Ow~Y zD1lTFHum-h(>U1;3ohc>F)*g@@$@E3lQK0mb#eN$$jA5uwhl?zxp(6YN=6L#v(5wwij`^JFzJkAcbdb4OB%f7d!4ot@kgt>4mjn>FN( zNnVf>f!yj2N-iTF0l|Pqz~zMyk@_hxlkF z@E7DyjOTt9pwRs)Xp)XCfMZYEgJlZM28a_RojylQK6KL951Q7z*h{slY54S zHPwbvSG}kex&_m5vV5qkvp!~9JZ)oQI53|g0395bk;1c@Nll-x=sp1g z39-15H6@`3rMCI`wEMyKS;)&77MSV`P;%zBv`2JK4h-FFHpF%xpPkVfXC@b{>L+5* z4P6;ha7f4M-1G5&eXjfv?R59NN-*%o%kJDJcmMS2!XN$Y9@*C=aqV9`K3k&}hu8Zl zAnuTrm(%&`ArT{bOlDk)ErtF`zeGu0Nugu}Z|`E*@!0P)t@Y{QNejAk;0i+S-6wn_ ze7VI0ZO)I&YWC{^Z||UVlAc{#ToV6l6!y6oo!i^E=`r#m zXh?*ryGY{Oc6vIQBCURQK$60IU*k*ifgVQv<7pF`l$f50o@QU8hPHQ!bO-c>FL4AR z+phRhorxf{l?=V}okCpw&CafJ+!=#24RSPdhaG~mpKCEDbubis8rfLE#nMWYxfic< zKQio6zxT8A;t&C;a%96+w29#Bq0H@Rt?L_7#D&^)huY-^kb9|_HN$_LbAXU}-&F$6 zR`+X+KhrHB=?xF_C$1o}!lzg=**IyF86O!ERtR zn`uEtx~m@G{&7e>vlASaY7kKoKS=HvPYMSamGhB_Tw}A8lrSbS!y$5ZFCaN3#b+Z) zz_qDd4h;qAuDGyI#0tU|P;Br!vvzkRshetNDJQpo)fq*F{?fQ{xv^pZ4k;-UUxre0 z_q1m5Y(Gu5aOBIo=Kfb~%*-WPC3?UA2n-X^+Gem57m7=ufmbmmmYRW5SWI4FVK&Rd zQHx0mNY&2IN4`F{2vE>_MegBo@>9xDPmLVDJVxl3>ftEAdVnXYQoP`+f2Lu6loS+* z#@f5!h`DR-hxOb5XTj3aZ*Q0Z1|NBzr!T<-iF~Q{(#wYRElSC}(O=WQY_I^Huyk?{+At zsttS^{tV&LzPA0^CeqS*BRNBJxn<6ureVRfe>}MRU(ee2{Ltz|kc&#VqE3BwMvX6e7{X&p& z{q$)V#5Um(6F~auTGfcXjPzR$Xn*&O6Lb^7kyhXUWOxFs&F({yZCHx zNdqdUwy&6P18;@tQP$>V3DMXpiv6zOwRn4)#Y7@jjkJIO%cF4)b=XxaJS!<7%%L?B~CGgN>X z=a)!|-22lcP6;p~0i(9yBy_v(U>I#3>op0k*5+pmL=NdgMI!3#=%=|Ti%%vj$c z$JefJ^SI#iWO4mZ4j9&0*>JDfi#u;zu^!C76h7ZMEa&9n8i0Gp;(8OMpupbnRg=*E zLN_e6Rc;L|!0P$0n(14ClB>lP~DDt?jfS#Q$pxuLTTLYj8#j_z(P zEh8EKD?OyUKH~pPtZKqsc8%BjcRXM$*|kap_ZhIt;FmD~=haZ_9y9QW@6uG8eHUq9 z)CSE z5T0CkN$F0;Zj9^M12C~h8W8GJdw3Cjj_cF0xL2ksoqV%>-Fth3vXpHEDNifV76 zJG-)R6ZKP3LlP+8p&+32JGu{^TVY|Y>H)9c8%<3MIHqho_L&~w5R~!%G&0$VV9`_6 z7}(n=s><;^KU-#6U0d;yLTGad^AAG(AXPHbvl}@!2l^VG=T)~*nV%mSR+K@5wpJ9Z z>GP9|57E&uTk!0~E+}?@BkbuN%-wKgp)#>kQ&)xH3Vlb%t&R2n@F^)(;Anh>rFI9t z={`*Bztb*Sz6@aj9WgF3sR|6^2DD~J{4j=fYG`b}uwpR#^wnq-2ST0dmrmN@R5CO*&CMGjDK3Fc zot$C-g99(UPJhi><{)aw;cOyRR*9ueyL|pUq1D7luls#G3}(^fGD3ib%&C!?nXR22 z|Ir(0aDruM1j5PylCbJqjaq*toST=In(?s!YBc~m;GzsqT&9Jo4y_MT&v6MWL;4u9 zvlhl${lh04yGW4(;ATWAO!!k9{d3YiAVBJ?g&k&{){_cJ`*1BHTkQharr#Y%gvg;4@~_r8H$fX&3eMDBfC& zz{v>}KNQvd4z>(WtE#& zCF1aGXWmgoWU8+YYN+sN?!Mx)RU$aC#_@Ik8t9MW6B8>ud*=3ea7v_u9iYq&Z~?HvrXBXXFl>xL9Qo86DpEEyA(9m_NFDo!xKa5+i4_r~m`@Fxn-p zF%Ev$@zg>fo)(`V{ad@nC9aO4AlSVmcagAXiuKN%`llRio5C)STXjJ7E$yJAB_Pf2 zxo~OeIas8g^H~f9?IAVwfMR@4I>$}K=TyOyId_3>i+}dATFY&_0oe;V;{1s_RCIg^ zVrb5Jn+I#6XL~xdwDftp#p^qp^ZmVE^~YssJ#4IPyQljT7cSgle2}U@R=G_LS@HLsYUI^)b{;abXDnVTWLw%f zW<(rj$C()Z$hueO@o%XvxE1Tu$QD;<(W&tK9JD=&p^ITrijn ze&lsC?zn*sLTDJDTH3$A|7GQT|Ju{;&wJ^jeArTqgdLr|KeQri(#x{MC9ME>XfYpR z3&nvlCoUF@rm!Z}!+{KhAoQP(HQQ57k)UXVZM!42$S=VW8i$t_7>171y<#jIPYZ2b zrM0inoo+J*AkqMX&eJXesQ?(0d@MEL&(SRod%(^Lf`KsZ^oF&+Q+Iu=snC(`-*;=l^3R~F}>OA4yEeea^;BI}_t@^_)3 zx5}?hm51BY6+5UBDlm@Dqak)%+BLqnyJbOgf-eO9Tq$o0q9YNU*u+%Hi2|(4gE0<} zxCI(li9g#W*&wGR?k2Azhs1DBp6Bfw?p&bchhqtwe43?h(iUR zKb!3A^iTFvXoZZN9F@5pYa&{jytKc*;!#ox&%lZ2oJf28()SAOcM$y>TZG;2#d=uTFD^KPxJ$ek!P?Ku9Znqnv+xv3q}X;PN|C z1=p|>)6}EM|5zSkED|h2S8O@br457SBsCvp&`#sBQ`-AKyqGC4Md&}d3m2!Nx;n<| z2s_9n=YDo*izjwh3Tjs3ruMd92N-ada3u+=|bAy3$*)D#sl|GdtXs2 z;Sb84|5pe%CQKDa!OSrmTL=_Of19s};4L;B@7=vKfitp%sAtShO48HTNvII92{E>k z76o9J{5@JrlAPAEvK-sQ#N(WRi;1GD?Q!KMGv`%*bwDMny*#{_afBxoL$ei18OF(`IKxh8_7nXs7}t zC5?n5MX02tw78e!@9uE2hkkMT7c|s|Cry;dG>pqOU3@iI+cPb}W+G*Bl5jW1L9~UL z*KEYlT3%`U_uF;!@+D!X+Qu8tG}o1c__ z{=CpYDJEn5-)<*EhmM(!#zYs^6P$_oMQM1ERz5x`2eHZU}0CQ>&t{`-5D z*_6z}+0s%1a?sb<`}g-1gTUQNoIpos+H1%Ru=D>KH|;=Q6D2=T5QTt2cUb9aHnM`i zWi{S0LDs%PK_hx%0X44#86nM#rSOrJj|Ti9C!iy z1oTnIFjWESBd_TIbcFUpj06rQc3ODBt#j~#@n*yh77)D-=uEr7V+x*hO_5F4p~-PB zO4G|&g@>VcJ8&Ot6lU{?iOHy_h$!qf@Z@)pW&?|(t)**-TlqSXHau+4RTcH#A*TAT z5uLP(36Ph~|7l0FskwROk*Hk+UU@)LhRs0vb1U!q_|aItjJ+<$wl?O-uxsl#rO1Q;4tq%Zunv1YOou)|W?okFX3&#qL0}KRC7P|1GY`rLeSJ z+SnKahT=9SQJsbSB(roXdB7drMrGnQ58i9eUqmVVK712Y!=Q2z^mCAa`!7T~U@#gR zd}E5HeJ`exwVFm4lRikD{|a)`o3W#Gu|{Y?866GPazo@tOo~`Lg&5Ds*Tw;o-vKDlD!LgJiK)b4X9g9jTm8rGt7LL znp%N1mVI_W#-G|jO@E&jbLy|u#G%qT9sKr%h*EN;M9{%4o=jmcoL)Spcua$f9-E4* zA*Y9R%LL|qN4|Ss2*YP?)~xyUHk+!YB`tjiXg+X}@etIHv^bPtvhu*gMO-BMe;+*nMLT#VdG3sNVRDeuu=dMJ`;j@8l9Uf&##gidQ!X4?^z@CTm5vj& z0J&$tyFf`xDRJndhPfsZ1Zl*Q5)%o_bak!01PzUh7TT~*-)}m3{*m{WAz&Y)wjG;D z2gRC44T79D4uIKPOP)t0s}qHkFy|$4c8Jk+cKu9R1Xao%R9##>jWn^H){c)~KKf%V-5Ibk2nxYICZ4sm3fNKDo za$4j6`MoQYkL3ON48^IS`zg6D>e|2?m&;JQQ-Fqv#U*;%H98KfZcZc&-Gz!u8WmSU zbgKFPXjVRB;Y%69C(V|%o_Ry#Mu>j8(YHzG<*j~!k$Y6_;d*?cD>S6S&C`TTnmSBN`tPwb3IieqWxA|eZgUS4QfSrd3)6W;{?x2G6z zkbT4PuStYUq5IS5ruW+TA*=A37IP9T0{H&*dgBM$Ihu}$MCM`K*$JXyhU}~n}2VvQCsH}pfX%()uK*FuMfZda~5+~3U^%7w1Xg~ zFULPJQbqJ;u>`^j_h-=*^C&YUh&U@ zm#2d-6s2raRqM@t>y+aOskv7M{tE(`hBD`o^Q%`6!4CKD%z4uNEZEgkKkEJ~^~0>H z^0++l;?OZR4GVfs8q6p0rhF_Esk70yOsYut9sf`<)yBrY_t-hp7B2}5qrkW}ov7%C z5(5*VH`n+vertE{)H=;}(BPEUeUGJOlHCRqN8?g@T=c!!3rZc$*hu}t&J|F7DSvT|8v2#6)yLWaPI=qYsmllOL0(-%+wUE!%-cG7-bJ z#~{GLJ2AXh$>&3u)lW~^W=n!CPv1X9LDV$g@1Na655kRjbc9y=N>;1cj&2X-OGx#_ z)%ARr>GjMp(d%5=#eHuXBHA(Q(%BVceGFBpa*N>EKqM5B(&WPI*B?L|G3$S09f5HG zvIvuu1Zr;Tpg>%7@*otXx0)2GTlW*8TPMUYl1c*d8*X60L?Ha=sG87mi)3t|5Y&K4 z%DtU^Nx++GLNQICGlCuz*5*LP!;=Ze5J))_UE)f|k%Dj=*N*>S@zq3u<9vnvDKWObax6W4FXb90ul;{fJnn2-O|z}-QDo*^WA%Y&Wv+B=Z*dB zz1G@m_3m~M`?%Y^a zyU*XBr5{1N2pUJq5|4Doa=F3>l>Q2^Oy|G5iNESLhP5`DeH&HsBQ~kF66`1+J?sTK zz1(LE3l1zaRO!-ZEYDtFl1AO*C5;lbj4j4XO45Z9D(lR&J-Rqq<=&m!LeqF%vcnE+lPBF(Fr{3jleIY?Q=k7r@2(F_JSjuKQDR-O24&6iD}RL%Ju#To<~e7rAUEQT1V!NG~gtZ#z{ix06AH}GXqWZ_=>d-Au&Yu4W-MaRacKMHSPW`7K$1;J#R7}J*z*d-ahm$+D) zlg({|ct91!;o+Z7E0^Hg}EAF?$m_HKj6a{Sam`)0-JX zUcO4l?MwQ&c)Zd{iaP&GLt7VjOFMq(#39&bUdiI2htozN>NnMzC7H4^CqWScT31UC7U!qEd9uCAH)UMaFE#}SbJ zFg_G)pagX5Vw1P=s{KaI+4^4fU3zk_-3K4h?^4E)%dHz3(r^hSTvbjrZyur!lsb8e z83F2=O+9zyjdSNVY9m$ffQ*tg16AD>Iymu{#`=%zNEJ)QA>fFTqJ9FWxCYJ>3hl?J zM4AAcrHLHfraWN@_A^v@8XcQLmr2;)t5#OGYHHyXb~hxQe(cWUu{)Z(OAY^=x%q^` z+sl=drTILjZw!Y??U~6R)+h zpWGrmigNCh*MSm0ne--yvv0*r_I3c>E%C(1MXdH@wy$nlF0&$->Spr>F7M(&{7#4X zpg`x+|F$PpSjT5~VPw%@GQUw&r$!Bn10e!9jKIiB3(Ypn-i(>)S-#37;0!m@;2#%< z*U{Paubk% z_unuts4!@x)OCDAH=G$lvsFkH<7{!iXfqEO4%6Jb;pY@=0s9%pS}`OH^KUWc&-$v& zBlXzWjQ0bdK^L6~ADfqF85+$GhKOH*ml@@UNNNC7V(O-Bon6Y{@zd8ejzi2JT+!8@LfgID?ESq7g6Bk#~)&O&a?}%Ku3cIl4eu5HcdSEE3^Hft)`jYQJZJzlE z&48{7RT486JBjrhGcz+{4*QRQpp23KcXD@fqHe9HqFrGp5|&^u7~k13l_vI=a^DT! z0crCIeM2-!QyUAnguyskQ!`Vr`XK#@`XS*PXr#bz@F=QxbE5j82EpE$AA$ja^XQSH zr5q`&jra6Spz);ao?XEjUE*GtBJ_km+>hX^%E@_?f=o}~@TDZ$kDouuS-SNDU=I<1 zk@=%@2%d`V&Kf~FuK0}f!rZ)jekn+P02CTAIVlY@GmXrhz|ApXZf@Y`|J%XlPc1hv8J{kI=7 zSG(4~)lm}V{?R`__l7$Ens34cPbIAR{t3jn0lo16BYyH#RN&t-FEggw{iGlqgBk=D zDzpHd%*Q%G$$GA@pI2FuiQJj}wgIDt~e zx=dhIvH~cAg17!RFtgkXblvh{h{tu2L9K9$+8nP)2jpLc0mVB#vGXg*cGVUqAfW%h zF>R>8%(saJW%b~YX2G}bbYiN%{v2SuQLjJ0^4HPPL56**K8=r0msQfl10HaBCE$u2 zaxMZ+TT7T`HQ&qS(9qE()SNSb8H=8g9y}V6V579)*aM-Hs{Te;@F1p%mGz$=@AqDA z=bE+1$UEJ*bsYgodimzR8vdUmmlyy(GEe~;;OEhh8szhFr) z{xCHaZO$>aPD9>voG7+BfjzSG>x^=r2G`0yzXPvtE$7cbjN54?h0@SX#B zHq6JHGhod{`fy(|L`e}s&#~G?;f$xjK{H7$2j4xU>HrWCpO~pmh+ohe;#oZu#@e3k zCK{L&_^+#r#VFHuwhAKENgw(*Qcb2&d=N|R=C`MY76Gm^EF6#X1ek`Oo<3jR#Jcnk z2qnIqq5$5MfHgIjKGC;kfh7fqKsjysI2H5DZs}c;k#x?0<3(}E_b4)I35gJZO*J*+ zoP^WCsNU&xPQ1^U82VnYoG^g9>(t{Bk3$qOwDtvLj**AjpvLeN9m8_2OmJ9^THJ|C zOq4?UJ--VY9yZVJiG>B>guD4#47DTHm)B1UcA}%B;MOUhC31s|D_O<-{w&|!yVXdU zi0w=rZiSNU&Oe=s)cZjpsy+=1pY_rE{NfNN!CzWV-4NB(XvvXnZf@(? zr+RvNSzo?{{!M;OTJr1dzRJf$!aZ>B)oQ4S{K1KzP2J%|)D!!U><;DfU*X?%#+{bB%OAZl%_ZSbJMf3UWTJ%K*r@n zjhy)9sumXI-w1@F!S{khd?I-{Xsx^b=l+BB4aoc>A;AsLgY2a4*jcMM@~d9~vy{J^ zn*o!Q!jXY`Bjhp9J)p7t!QuQ<**F!N<1;&5`v21coF5AD+q2Ph*&<`MlaraCgOZ+^ zx&_ob(?{p*I)DTjxo9%rGLb2TBbOU2%Qx#qMQrF!8t8!7QOP5XZaku_oOLG#IlG-9 z9XwIB+jR-xuDIzgUoZm=;iHzfUYoQGH1cV8c6J6_?I+E?a6*w}v+ zg_wv#yo~ODlEX9S!jUx+Qd(m!k2Y063^z6?PPKrK6cDY|oizlXSnA(XnY07<1-v+` zZ?(VUB~D4)o)LMS9Ib?fMKSV=$0oK}yKmP5O68x|Es}-LNwL4n%*!hFjS;JN zJ>*;v=#!t<8D(cL{;l5Oq+pK%3^)50zuov7FiT)9!6_M&uFQRyGtiPH5W$Rnp+2DHg`zP&7Aa9LJn+bp{!t zL#fw^l*12Wwi-4PdfJ)iEV}(jEyFYYnvylW_#x)8n?{+U4)@XXNp+Sn?OXeIuKrNS zua*8Bn$VVZF{Hnj6Wg=tD?It>?@u>IU9xX_dhVreEB=WFj{zDB3*~fKJ@&D3_|C}3 zle#2Jlz7ab$y3(J&XiSN5xZ53ZE9uno1aJ4Qcaw!a`W^0Ajzk7)*nClUq(mI|Jgcm zs>pIq-#cyOgXha*#*4AKy4v{We;dhw`=?jeWS3R`R0u^ZKCNrAzCy}OstTpBWmbZc z*?Z!dnShwr`&~h2#|^@-ri+*l85!XcbNMyD-i(uwDOJRQ`3+df0G^sv_AN0*k8HU^ z0Vo6*4S?5m$t`2}Ql|nMR4`k6Rv8lhjg&3X-dDU)g?hpka(C|nMXKO}5UETm|M^o! z`NjP!6lvt&#LFx7@+C6i?h6AWJ}z$bZ5}He~fq*_V6b+~%Q1l>=yv-s^Xwg1=sPfI#SF3u2tLAOJF6_2L zI{L9+RriIWs$$#55rjj((%5KWzkP?6bu9Qga zXCpk~TwzA}bX;5+AHN`ks@44;122)^Evx;psNsjmGO{`D+oopeQn7bu5Dy3htJRmK z?pd0JLO&d^ub%`WgNMW7`eWo`pC#p{h#NQy=)tVjj8-d^Y@Rea~$Udx<@tQ4q6w6woF`g@yJ4uG3c z#7cx@Cm>*@y}elg?*Y;VFt@+SO#27UAa0@-Vh#gfW{MIU2(;%#$jAV|K%w)JEgXVb zJG^B#Zd;1VvaVh6l>kqnq+4@Q8nH-OIR##&EgD zngL+J#qC>SeFonnFlZs$Hx3^k;>13w*$~~U&wv8|NHI?AIR<*rlB*z7NB_ffxyK*C zBFImgXZsm8w9SHsk0BHWM+P^4NKw*1!xm$~8A#GM)AO)Z6P&imw!FLv(SJzqaA!^0 zdE9wGX`F*QrI6BhTl?IK`gqul-frAMgM@KF2%&vmBO^9nId%pefkJ4+qOEwnU-D@=_({S`};F#lwjQa~Zg$LG4OoBd0GJEpSde0u%QM9m|oRFppY}D(r#KkMTLht4u7d(R)ACCRel0& z(Xx#`2BLOckE91=YFDpcHYpmYVBUS_1)`5`w*_~6i)aMco&nbnn=Gomc0E0Rk@g&D z7(6e_dm(&N3K%8mP2l((7#Rtk`OFAd&tW95uyFCuUmgoaM>zQ8LlYc|sNcq{O5NQS zU27CVW2AGnp-+m2ow|S z#TD)#ApN&wSyKB7cwboeI(&#(T2rRv`cp3>>7h6Lg`kQkWhSl>7g&MU1ahP9fFSTI z#;@-A;0rkB86S&B=j9PX4glnv%E)*3liKmS03HYHU9hl&hrcKl5-^})2{}0c1<$ zF*6Z3-xL))fZR+8;LlD)MG%UBwxUTq=aso_T0|1d+D~_UDk5c=JIKL!qP_k7`Bg%= zHK-q9u^cIbfDZegjGbOepzjal&sED`>Ym&4gryxg4VFL&0f`~8A6@NcJbE~A;B!kPtOJ+ZYrx9+;ScZE-Z02s8LLf-!#Yih;m=^4#$zUxLl2uGga zLUh4J8s$6_9IfWQHKjJ}_U!<+a-aqMi=%>5pwrE-m+-6tW^1(5yOec1Xx{ad55QZM zj*&4Uw8If}xCMm{Ev8$LkrXd||M+_ZC7vuUD6yx-{6Jj+--8C&PkntB;bKAvH=5m% z&(VOf^__mPY4dwi@Ysf=&sNifvHLzJo2U=;Cq+PE`x)%fq2OVQc{(t885U%|=3R9a zhKBFpKn*zG2iO?RYpzaUlsqBK21`Jc{=2W4gze!x;*wPRT{GwERGm!(lc!T`xg~p?f5TWWIih0g)W(xgaV4m z1NZ?!)Xp31_n|JpPlx>^dJ&O>_u`=IQ+TSn1Q4Z;jR3q}5P z9{yJk!!#GaxT2e?7-6BxIc5FHV@SZ6Fi9`j)9~^dhm}E4N$_wA%194AD;l+jfhPoe z8yQ&ra*b9%z$d+cni{oAQzN)_q7{7lu_ZjIf~Xf91;O!2BrGC=o?nL&Haf9j>;r*5 zXtDuPMR$5B7yKqW`wpn5tu|JXH-k?o#cs(04if56+N8(NOiGW{H8nf7(+3_+dRW1}J2Vb|_q@6)_QjEk+EPKzBBi^S`F{@rD!5tLb!@f}AnJy{_H`NI7usPv-~x9@pBz z&rFsw@TKL`?JKjHwNv=d;d`A)~h zoB-m%zRYWN|9K@^05ID#&XfnaU5HmpO`^kT_-Vjp?2-}q!5IIYeAi#R_u_ZIdY4=WB$`IOB`!rmm;TX?xfp-zYymYIu0^T-}D(e2KvEY%2dyf6{AvC7`+FdbZKR z(mJwO9x9cA1fuRbCCWX++aUiSbre>VL$4%h3A*A!Tj zY|<#xNJ=^JoJDvtRp@*d2=$QadZhw63P6i^G2pW4mfmF5t)ifUXkv zi;9YT3uQ2a&~R~I3Yh=9*7{xjGh8jF?eoq4!yzjCY{WY@hVSh}JYP9DIC$Vug=kbb zki3bS)}xxP3=FZiwCXpN(DD>|ZHPE|Lu|=~r188DTk% zS;*W>*eDNH3O_$*@H@ud8k^0-DskaG)4#N78&4YPZ(R1CC7d-k@YVBb*gCCsZ*(v! zG1hI9kP~~5P3$e97}xSUD86#WFY{ujUW9;B)TZ3&OzB~asO!g!>)WuEi`-*O?ez~P zy*inXSnQlnUP;HN+MDx}Z`fB~ofN;QOj&6_9~+9HR;(OdT!B;;cK>!aPbhD?yidz&E~ICY8cQ0lxZ2vOFajdWd?!yf0#JR2yw4bB zFS@Rqcc{n$UQb>!kL3n*I5b!nUxmyWPa3zkF(#+FfcIOTgpyao!)x16i+56Ql!|5V z;PLP;9DL`Ln2wRkLg4JaE8?=Ri<0qnrvw54M!(%B9Px{Euib=|1QHfcE>?F+)wT8C zHxaiDw=e;>P_BjF!hnbcB|&VKIDx`tz-GP22lBC$t+Q@6hZ@+wb(pI^nehp{rErTk zn>SAGU|Dt3cC+nz&vZ65G%Bi6L?mknoS+be6AU zM;`Fr)>WKpB4&1d#e>YT;KIsO1;Lix0eqO#eV#q~ z^2I`3+#Hcjy??nTJ)uvg*xex)Yf)1xe6Fe{tD#Qt?)L&W)GkN_ulZ#CX+6X2*YnPf zuB_tRumS?f=+1wH1X`N>#3k*$%|4ZA_k)RhE#JqG#&p_dm8!XQJ`4%IoZGn(kw4k_ z&$MFR{b={}+K%Aesl%iB18+~?8~&!i#!Sf;DpHh|{ag1q10~!sak?AHz+)u8-|%y7 zVMsE$Sx-Uir^n;BjA9y`SH~TnU}oROoa=uG)&t5$x zkaZP)#w5X@=#*qb!KEm5oBem;&>HWMSbBl9~t_{;Ly0Q{%)G<)o%zb>l@vzqU*KzhT$w?wez5 z-_w$t__p&;RX$bM@9Z;aPd4IjRN!u)zz@Fu%k_i}dya!5_O)x^Cgp#|yw`uX-zXrm z?}|#zbKa}JK1rOG2!#9b6x(lN=>~U0iuW6-UjybyvbO({i#lJ-Me4wH`<&aBCq={d z$;I*h&47(X=J#V=9@h(mLF3wqxt@RP;n_ws%C$*?SU}II>cwWEI=$MpXU1aV(@X!} z3xd0nIEo5=P3DTecB+ZgXm3%Bf*OqUZNA;==%7+Vkbkb+BB7?1ZT8iotye2qDU@bI zyK|m&Pvhp(?MJfHHetHyYW)Je5FBpQpiSNmgo!6PSO#1g(uf}tc61$bL!<21SjD-#Vn?k?Bp*OQDON*J8bl)=`t1!4o za9_JM^1*L6xrIXfgbLg&#?Qyqz+bkEHa;${=e=7YZ~nzBs`0i+$1rm|wDdPe_X8eM zius3+ZNN0@48BDOMOwTtuoHp~+v2KbludpRNv|L!#^m@sOOH=E}bTIL-;#AXl*RG;_G9eeIxpn#>8^Gy>Syg~SFF=t1{mlO~O z^`_}HLa0;mRla_GV&bRY#ot5#&zFlLzVs6Uhs>v@ncsK>zIqeC3_M67W)S9VO1rJ}soI;sGnZFawcN?(deJsx z7b$!$q{xJ$os)y(<%cDHR@Wo>lUCMNt+u?h-RKxZJp-<;0r&=uda?-emlMN^jV`Hl zv1szq>89gxcMa-%qau>NzpQ)_)@n{3jmqCxO<6mAOqN-)-=_Mdpk`|1+={Nhy>T&)8q))I8z8_`|3FHi!U-uSB%T_$q(y|5N01 zS?Re8#VGCUFwW?@LN<7iK{uf-}9Wp=~#;4TrV$)mwQt>(`!%QdWi~a z$ZN*MA8qJ><-3sI@*R&Iu_yVu4{2wg*M_6kMy_SVdy-Y5ifXgJ#{Qxe+;&t3J6e{ix=v01T6V)tgf1mWn6vREAH)T6BzxFoE(Ty zw4H2-h>J7Ldzvnz<$__nE%xP{Q4nwZhdm#E>La~GA@>E|7%GXok|w7=XnHb5HYyOs z5X#UlarMDUi-F7RoB$%{+rIJ;{g||6`fpA$7yb+xq~n!z_r3w&r&_U&vYy>}=@bbM zLduvVl#m$6$WVsZ&APge7RrQ&i&+G+^M~UYQ`J6HewWqt<^#Skl07ZVblGgNYB(rn z2a9~zy?8Q`?h_jHUsY+&qMVcC$qdS4!-h7GnSd76jW6H z^&Z)rdTtzhE@XeQ6@qV=r!Ohl_9a zvy1=D=lr$hC(vs$`E$^>90e?O2E60LJFBjdR3h)!v>0hZ?^L)Q`POV`T(T9)! z=BC*lG=ZX65pg%GoYZ!)mo%UL^oW3yRvUUERx8UmTzU~;qJcIy6vanjEVcEqAWA|CHNP)%k-nCt(WP=auMs8c46(i({(!Eq1b4ixi`z z)RwoXnD?%1_;4-s@`{Ut9R-X0mYu7)K1E(Bl#Ao@$eWrr_TXjq=YN{Nd&kwygXh&K zCZKR$hpP{;DaDtg+zS7M(Pp21%gd!k`xKjzy^F3fu;KiYE0rs?xA7O1w~yg-wyPMo zS}|fw@7~WvPXpMAF`?&xtN|0ww*>JDKPHWZ@)50$K2w4e(N)H8@k;u_VJQy2uRh;k zcjig`$M;e%CnhG0g)@Pcq3>Kf)lZiL^`=_>hP?A}RL)Rrflgejc{HU&XYv3YiGVl3 znO8Na?2t#tEY)0b)JB2B>&;g^glMSX`73Bdi{>ZJSKGK#ejl6a;Bd`lW~S~9NDQUs zL)~o!$wAX;JvKUKq?hPaD<()DHo^C<8TZoP&8WdQU9A4Gtqul5`~z7HL63R#&Q8Ui zRG#2&T~^SZEp-#dC4L$#k=iJ{I$!Xu2PMQ|YRsD_9~=cQqyD|^-lAdU2_7j-#Eobb z^jc?=kI6KJCkM_1Q6mmOpC*$1kCrs!5c>N1u}0q_)mJj_mY=m^xNFDldWs^1(yz{& z7LQE-knNsbQlr0Zekr42(*1%ASN07g?m$`XOeGst*GDG$J$~=0DMyWiAb$}5Z&L!x zKIVS>Ktb=#uV3y`Ss&b0O1j_mTElVbza{)Rbj$C<{bVp5Fj)a=J)gMBH^zSp5zX7{U z;7t&jqF@MyeIwkH;tYDNz;XESH^YlsuJ;f}^Ei`Ir=uSMR+ul9rWb!3cnwJlcf!+tLhl{E!<0 zkU6}0MMXry6Mk2N0Tj9k#)kF+IuS=UON@{yb?V!04|#gv(mF=Dh>gnmqQ}zGV(i0!S>rojA&_*!Q|-WYm^8q>HyQS znp&S*udS>`Mn%+l7+&a44j&&Ln*KVRjex@%5B=Tl{X5o<1gl$X7EPBz1dkrg9b5=G zA0pBX4FMxwsJL=mvZhZ@H>|svu|zPpg;4n^0bdLpMrihbl{3?Cjq({83YROcO#&SS zd-4RvAi+yR{l{}KIB<2|-R0tMtjK_eBH`oR^>wl;--;kA-yJ`Qy6`!nL`EaAB@2Z3 zU0|1+@A(4%a^^fMsg^0!KS+)(S&Dgjd2*orUzZEsUrs$};3$dZOhkV2&K zpML9+zot;>^GGotY;NDbIBiiBt>A|UA3-xSQ5Ag^6777oY^SNEHL}!fiTav>o5Nr&B71+qeur~>5R-!+Fk z9PnT3jJIYfnO&INv4h0Qvc(9FYQGb4D`w`+iTW6$Br+UNVErrYXP4kWlj6`Z{XZ=L zZ8vwOZ%uk#9XY!?S(K7KKTm3WX;QbWl_D3$O8>z2jf_0)))oa@nnV)7jCZbY zL5CIEKd=NF=!2SCf2&@q`aXQti|ONI2v)p5ERUR3Eh`;%h$C7HzST(cvN&Dz`Q^0- zf2!P>TG1J?n+b5hV91GG;d9%&3Qsyb)E+I?Q&frbJY9W2<$L;I_M*^X-W9Qb7CjwF z$rr>N&!|58=QPu(^d{uLos>=jM-RTa^`e{Q9Mml1R~J(hE!ntl8*$<^*>z8c=o2n> z^IabXT$fwJtO8Tr&p8#9VQ%-fNYbWj>GsvtRmf>Am&wM1QdCixsPO`tk&;*I{~p|e z+~bcgn?p=ENx?qagsJ8G^u>dBQZm`N@3ARbG`lwZGgo}%2|-*+y3-t(NzQdn46QQ=2?Mxv6TA<9ahvE{V>QS177FAJCt2T|{@ zc4`$7VgOHq$--gLxo`&P2Nt=o95t~_xROc+Z^mGpX)-iNl^cJ_>Zjl}BE^@O?` z-N9idP>s=AM%K`e4xDB057$Smdtd!F+5T_d%yWuTMnhg%xiB&Jx$bO7Q*-+deKtsH z(J3~N{VVeP=BA494N)JXZfJDZwzgX56_6xu`O33)hxkqfK%kY0 z`d7Ltl&r1SAH0_W_N3fo#@2qOMir)wry1gOcwtC+KZLh0oU49+Huaxn1ufc-msk1( zdX|&XhOjpZ_H7Xa37$9g>_2~1IGy+0jg%8($Vq|onzq$+Q^NDDBa;e()S~StGngM8 z%+1q5LkQZVseoNHW(F?rVMl%aNu(1sJ43_Y`k2U{yuvj#;J;f}yQC_Wg_CJF8^shj zwAQk5P-=hV4E6PEofAf|(NpKR_*`YehD0Vj)Hh!c`Ifr^rl;!g1wa4#o&j`t4ih?r z-l~#~IbSb4dXM=yzpjWtF%Aj9XyvQ4nEc7Xm#Gt{67kr2)`*YJ<8=9)L6tne4^pw8 zEzshaHlL5cFLOLyRRre<1y$9&%J$Y(&o+>yK4ZOy3L5DM{FxOdHm14x97Y17C6|?L zzwfg}zh86Cxe7jSu*JQ=BBvon&+b6qqDb%gBowu0CU5gB5JVEvAu+hG&iTx?nR3~zI8{%Ri#rD?$oRc6uJODL z;cLEiZe(g9@qOPRyGqPUXnc5d#Ed(|b0@trRE{2tQvChcigdVABneMkX^y-zw9=PO zRD?o=W-Yr}p7rAP&!*|QXx=1_>U4E0>%k|&+2&j7Lv=5hGJv{cN^hvMr)O^FDg+4sx+xF>^sQ3QI7tcJx6j_=s z+9sYEG-}AIs!}A3IcOLdbS$pF!X)7iWgO`TPgq|5)F?P_CZ2VJcz7|sI1@&Jz591y zhV=9~kdu*|o10%OKo6o-PU>OgqrY2kM3r=PVTo@Ki;DK{gq_Tta9d2cQ&++Ex2>0D zVp3$++YggWIJq;vt=wlva7pt9BldzXT5%MOM?JP(7&YZByr#B9qJ|%w7c(M zi9C^A@4p{e!PTy3q)#)&81bTEsQDLF!8)+rp1#Zhqs{Si7>wKP$T@SrajN#(;CHXR%5|z% zv{-srq{A9S4R17Q(Vml)130K0XaQ3dCwt&jJ+(PiK?Hz+AVrlJW#m1Sp?uY4kaj_l zgq^p7I;V)iLDRT2EO_SBz&r~^_`0IE<2?CJYh8R9;(qUk)=ZWUzov=%yn(0%H$A0zgXs-5>Q9HKID%miW^K zDPx?rt0tr0^*UiR-PgcX|g#C{}mc4O4StQayu&%uyD_7 z%x~XX;V@{kE;r>Sff>UQ@q1hBVi7eUQqqFHCsQD`ukUemx?u5LH{IgrO0WT*RHEZ} zbsnNCb14fQ++B!91$$b2ZTVAs_Ye(LLgPLF}NdxPzCo^6VR9D^o1tkt& z&b=NQl@Li1#F}xv$0AYDj6+H7eLwJ83Mc0;zU^~%>$x`DQk*Cmt8Lrdf*-f)jqZmB zjhoZbiPaki?f@Dg7e)T2*K!fM4yaS@=G@SUISS$pkR4ioo-u7&bA?+e1oIN9SB>K} zIn>BZ`iPaBu??vC&q>zXPmmZ(cqV5A9yH%gJr%H1Y}yQ(tSF{tJCsk}d(= z0wZ}er_ZwMlzj}p8diw3&EgBPvAt%htG5@}R6Lf$XrOnzV4zY|RPz;=fY>?nHdRj5 zJTyhcXkCOTY3d7*VlmRuJq-M+#o)ZSY^THaqUGGJ@Nd8>6HGjX>saxOkweG-7Tcq; zzO6qV%2P9KCbJQAK77mYU^1lPR$4X_=v;odcHWWEKxXiz#LhU(BoGjlIiG2+laekR zsOI0EeLvhdqZlU>3on-M_Hs={v!COgP;ElgqD|#wf9S0KB5N;OGbJw zhhxmRxHRpV0w|7?kW2ObnZe5a*$e&$58R={8QrP=lmGSJ2RLV>&G5mr6Dot#!Kj_i z;}=pRTea}#XQqA-g5T6riPO-R&F>vgu2JB1NCrF##=m}#Z5l?#R4BAG-RO7LJsA;y zg?#^^GIw?s88kenD}jZQC(*5^+a5FY#F%?c9O8gmy?sKB7XEvJkG0DGieb!QX4#?P z#twiT`J?hr{w>a?rnCpkeYDJ-O#mEDRe7btWf+*A?nVM`X=yF7W{g7Kn*{Jjvh&AU zmn%mX9T5OY-B!!2@Ax}Fw?Jb0GMZeZbFdYIiLGPtIQ;@i%BVVgAL1W}xd$Y9rN~a^ z+4R!(RR|^(|J&e@7%rDK0)V9Z>MyXzD{pWD4#s9*9(K$}l8D8@IsxG7DO`RmLwTyd zEz7w~PjTG0gaT(i=a+s>nXKH|*PZnzs-2c|QD)6%(lpZl{f8!)D@Dcj$`*oRl1Ya0 z_D>c0q(d+lda5H%uWo}cD%79l7d!T&p#x^^PmwjarWO*--5-JN0a6Rj%g5((Gf(I2 z;_|%C@$s7{IAH$LMAzQg*M)2{4-XHKqsQ53Z7Q*ZJtn+jP$$%EUWjBffkMA~x)%G# zc(DvEF8n<^_Fnj@y=^f8=QM_fVpCPmWMN6fMu)w5<=~(xBoha0sQt^s2Xf>%{Wo8; z$6p_vME+O4!iS8?auifrI!a|TEQ$-jAS$r<1B2G`%#}P`Jg16ANb-uk4hNgR2#wIRm-Wl`X@5f_)vmMoEq$d4~y;c#B*^Sk$uWzp)0=lZ;M z$Bdg~yxOK@`5=o4o$E|i#|S(qU|WI#2XkhHj*uRmm& zN#EyjIVT`Z)j##UcziD*ffk)MJllkmIGNv$8%v(HqT)zfd&c~1@LgJ?>pPMm2Hc2F zQ7`@8FAo+A>NHwU_sno)Vv!SfUt*O0Xnv=;HM{d=;qXOL-9?s#qB zTvmRXd2>pKM3b}Mxty)tr&>I@zi|5j#>QCj?~Q}K@s(P5v|e3S4YZh+xpPd~>U=k> zjb;ijdQp1^YRNB(T0k-YUQR13!-Ee|RJLKw^lOM{yxM3qU3d$*lY}5_6Y}5Z1-B0% z{oZ|=5MJ(2mxY%NI0#tnMW*z=;CDbaI!Wt zRL1PQU(wO-6`vM6V)5CGe}$F};=zn+e$$jwchdLbr-wV>%i74?cNoRL6=t^k85}}@ zvr#c>*i-2}0ne}asBj4XPH`bpR8`K+%EHZQdIH|mYVx$pVT;f<{@R&p9{w8tM5F3v zjtfYgtn7V;alI57S`Av$w?;`35kw{XP*1_^_BV_h;84fAG5X!)-|kB!?+Lx-X1KMI*7m+R$QuC3*g@p0*OrS6X)XCw3a(hS=0;s4$-4UUZTR)mwmPiBC` zF!|_=FK|P_vmIK>lbdxv1alXM_&EVHVGgH668NmxU9Y;*Mz_d(`?g)?IWJn|lzj!` zHxmn+$<8$q>MJ%v2qn^`7|UTy5%IZ~o7*btd78YK-?w|5_pk&f^p17j4)TIMeVW^l zg{y(n+27lmviiBM4zql`r9^yMlBqz48pfCpK;AfAwXt(^55|5W2Ca~DZ8bD;JB^ho z!@~qv6hci9HLurb|A_8AHqdGqTzbm~6tyX0z%2EpF$xHz0=hpqG}PVxqLQZ76qC}R z4=Nv+gwQjJL;&3K!@gGuh6~u%+b=%hr<2X`EprnI?o!&Ts$YG04~|qRRXYmE7V*8Q zot2X8ZF6}2`b$nZhGMwWX@?UbTXOTCreGk}LQq1Y_pfVHAwbI%UL9mh?sq@hai@tc zPc`L>&d#nWRbpD&+ajjfRS%kQTJ~Z)XxwfGk_kBQxc4Z)z^s+0@?UJS0yu^yl^9qc z4{E1%wsK1~>HHz5lWXaji64m@V}*Y(gfi#W(d6PVgUUEWHnjVj%Fn+b) zg}8vdPV7Hd$1~@YDI>jp~>zlt{h%=i@Okl z1|hN;qJDihr;XQC>IBO@8In#;G!*HEP$C_dr(~hk0XX_qcixe?`In)InI?&=-Pu3w ztOLtEpVT;s!R09-fYq%!ohH0KQY>K}TG<+jSIWD18t?K?QL0&gcoA=0OCHR zF;WBy>d%_%DT*Y7R8)K1+z$GzgGJwt!w#y42RW9K9u;a7cg8$QI!&TfOz5Qb*6J8y2~(z94mhROT|CIna? zF3TQ;dkINLwcneTEDRbnn*c-u_+zTtCG!cj0zeCd5waMh=P0-17UQsPF?T9LC0CY{ z6Be$|c)lq+dHy{Y8@g*5ulR0N;f3HC;^RAll_pr~ta7`+@=m7& zQ`?jSqO)V47dW!>kDUF~y&jCQ*e^JHIl?F`=!pqno&$1hUU_{xR6_SsBQF^Xrwiq@ zUJ55vfh#*sg%|JYs2v+gmH$VDhK?>5JkL?~O^P~0k1iZ4%3b84=6(70fT-j{W>U!H zmKTLUeHs076 zy7UDnp@PD~_Rj*KSEi5%mh$kx2A&LJ5KwQMmh}|iHm_~2n=X~nTc_uMtwt&T%?~uy%k3(AHZ-cW6)`c=*GdTsX#3?Olwg7~XneFj|%c8E4~r z4UWPT5PkwJeHj}MOkTI%V^X$!o0lT#bA8Y^5<()V5BR1x%uWQ?&gfohu4U3o=!zg11V~dLKh&oEcRuv zD22NuZo2!4h0SqXET888f_F8;NR<#l7=art)9~i>Q3YNPRB~IV`i3tEMh#}ASGoc` zd8!&KQPXnXa-`^-Hf_9W8N%JU%45mAPUP{7Q2|?Li@KqKft{~`=GkCoVVT<>L8lb+ zmNGJW4DAs#0`DJE{LbwjgU3mGx}h8T1t?miBycZV*B`B4Dk~~7@X$paV^xTr>x>ve z@&J@fTJYNg9ta>>-s;Gyw9OKBlmpMY(Cp9wlRxKX$3<&M1~ek6gv;u;AW#W`u-ea> zVU+-?eks#CV)ga;)OY_np)a$P178b8HIUl%_HK~UhC9z1}f{pKY&9MrvbUh^Y zOG;vl1VSc7gu$(CfcIZ{88-;9!Z#{c*SEol0i$F#hPKfgd-V{;4+G*ThAt)LTg2kF zOu8k8?JFno$tH|qhP^7vs)};qx|*T^M%~C830rh8JG0MB-hv$ZTcHh{wU_U`9(<+_ zwKg$P*JGxW$D(8C28{a?{C76XcqMcubS;LbbFiCn5BqUWZf-(u#Ig&tp4rrpnW$!I z`95)r&wleYj4$tjkc3z#1j7V0R@ORxoNxPg#zsFuIes=uGsB3n+#8+L$_fJ=)bxAx zZ;Ccm>^8|#Kf(GNM$&hjc+)Srxdkq2iMXgB1sE&aeUHha8>|=}>jiF>u&GuL7Vn962_N-0p{H$D1Mw)Hrj)YX``mtY^nmrh;HW zjz@#^2a8u}GMburrOA<YG{JK$kHC{G5m0}g+@D)Gwz|G)IkxS`6fUJ54#WMQ zH8<$!VKW}|_fU``sBR9Wo;!vutqb~)WA(v3wS~(G5iET@o^hUz9H44hg z0ATpJFD)BjFeKKDox=Qh1K`MB50aIqH9$mqtRAkk2+P3}Tj7!WHLB#Sd+`QdF73 zm5ee){i2~e`&Cy#83@QYkaWQ?!Xfn%4M%+p(18QfoTlGuQZYDjF7=I-G^&ji4V92R zEdus(dl?Xl3pW?@F;+Gk5DQ(9@Id+=og!YlTH3tj2nBgqm^CLGeacJli;TyIjxfCF zb-$Rb#!a$Hn}3{`hT@&Ow)_}SS)EVS86v4L{%gFR*SPmymNs~=`{C816YI4ozWywa--jkqT4r?R!g-+ zeGlKBzn9CkvJ94D~`C2|IAxLv!?1VKF^Zl-o>p~li$tVKz}dwd;yQe zZ-fP+POt9A3=WL90^^oUoJ3LslwT))yA`*AUP?+`y_dA87Ddr7qB8qgRPe8o3ZkfN z??(Pn35Ue>S%z?krPB@dkiA{fA2Dv5Rlte7{#37hF8Vz-m)oLPVAGmJ%v!Ke_puL6 zVQg|BAennZ0C$nd937B?&g{{cgSx&xD%!`SL{6VXmW2HXWBaA1X8Giv66?8>!y3-i zURXkM&F(mNV}+SpwB)PBPD3-0jOYCmyT>tc&nf@A<(~fd#$LARS>Rg#w{0yc1daH+5-MJ!lyDR&B(H0W=_9z3X;vfsKeDmh8$UGFBAaOZ`V4MwWi zQZsoJ7OqE_s1;`LL=y`+6RU*;X9wNMQ%MPA>;6>kX|3cex}kDQw#mK{;!dH%rx8(e zRM3n>D0K7c#CnMUZ!Rb5Y`VW_B-%pA)4IIsr)Fn|9kUNhx)fy>74jNCp7%iY@bKUO z=LlG`Dp)GDxx2A#?;}6FE%<&d? z;dn~wen%dU>qgtlZio201yz=yI)t? zy1F#oKIU%pR@uA2oTy$vXf6^YNS*Z#KK#k6mM;F3jj-9|kCu^9SCe%6gL}c4B--y0 zUq5AmIIOl;PD`0pPcNm#oFobK5B7_j)yhRL%F}?!er!~u#7XdbUSV$g>i&cSpv!o8 z|BtG-4$G?BzCaBy02S#50RibQ36Vxpx~03j6$AvN1q2BJkp}4o>F(~5?ryk~bAIRE z=f3~=J)iMz_Fj9fImZ}tjNurLl7DJjZeApRVJYD7>T*&PWl<6YHB-H!|CLh=(~(*r z5E1wEr2ko4e(%47*N+`v+q%=zKm|*i*sq~I+XgM--S3Q+C_pp{MPo)ccXr<0a=WeM ziLXxYJ7^p}08;A1=9rvh9AgNe-xX>$_kERj$hf41j$kg8r-Ua^c)SSU^@Eg3f?n6r;je z_?xVE+dFul71_A(>@i)qzJDW!0lGVubSVlt>AAZabvDQ_$Qq~E2_Qk@@DMbpV8Cf} z-GB*vf&_Rv7zU|Ug+OIiQ$uf|X=-Zvf~j5_`q4t#BF7^n$oyktbHG8NmYW(MmV%`L zvW_>58Hjv^_wl^rE?xz4e--g5r9U>9IJqjlGcom5 z3@ri!q!x?z+~3*ss9{m8R}%E@dl_iRt}J{tk!RJ#{8?KYejM`jdONKIe8S#qD6|3p zH}16i=*-1MMJtX5USF*kb^Ms<5%&0}lx!tOAo8CWrU^4p?OqMpP%SHS2#d*HF9tU; zx-d?c0pa5A{QqeI5N_8EqysLtguF#Xh)9q|+jN9h-J2u>Z!)_4K^<-O=I~iu4hK3L940~5k&VupFUeVAQUQekO7Z=;k?b_U-_)6Fa^kg6YVH}TN%FkRD zIH>_?c?843juJu05SW8rAPAyysLvo3{c%+N+>BkV0!iYI4T8rHvm^3 zRaA`sTgvLqYHC7Ac;<^&A| zbf@(`Lnu@Gg}S#_wXWD%Zofud{{c0qxdHH7#Wli6@N;H|^Q71YkoL|u(&Ex1Bi_Zu z80+hJs%3^;;GLt^w+1=^5ZA!athj|HVTv^QQreMVwBEnv5v;8Qf zJdLUzw;l6=dor4PZw$1(KXx0Ym6Qap4N|ax`bn`Kz7}KBzXNBx^U%B z%_p&)tNAqOIi8B%Ge~Q`l>(eeAkvrph>PR4cO~TFQiT!ygH9PfGC;LjWfJAIwDwCZ zASR~4vgiPSb1N%P^gD8twinwqoVb(TVEa^EjPql-VaCIM_u+jp8#LRVP2Bt!>>mIc z-yC-f1Bnc%BT?|#KgY8C-dih8K)5FW4Xa^M!2Uin;0x{+7XYiQ927WAV&6&$pu1Rs zoGM6blm|L3ARvoNGk>!ClVB?dtU*zm#KDm#IJ5>`y$%T5f&1Q`c5AD$suPwBc|pVM zSd}0i*>bRSEr^28{5_;c8kliu7^Wh&x{9a!F;W*{kr`ns@>@Eg={Ug+M?tG)aNYE` z%#Y9Q#^f*Rd%%hg-eK*Ff#;FB-=d;!cfs zKi=m5+`93S;A!Odu)pv;#HDRP|Ah#{%fHgoZPpLDz=NY!&PypA6RxXkq}Q=;W+tFL zBd!CQ4$!wZ?mU~bC)X`e6SKdiSOnnxioHS$K*^tB@mNZS{8uAc)yED;M;KUGcNjr= ze?7^6Ih&(eg5p!($AE9vlVbuB0)7xE6_+>ws`3uBlyI`&_Qdr*9WGkxqK2+`fE56u z7%o$`MNUT-^)Qr(#bICQKQ1CqE;s6~2oUbp@&660H|R>_B@_=ll9H89dQE_t5?VvEaTT<(qLW+iBLY@)i^srtCjg*vhax88&q1EspwAxpD9{?jpa3$rQsnnLo<9UW!9$QqIc7k#khQ0AEJ=1OhEiBI*V7_&w$1}HL zfoAfZ@XPnh-3jeb6=ddH{Y*{{fNCC25;19sg@GtDz>AuL?`d1e(NaVb?OcSGS(0&3 z`fqPrM$>5uDH(G6hbE9PQ2sbRcJzCOpM!fxtK2>c#?PhdoPbKWC5&#dX3zKCpbjc7 z+>C+566fRUXn+PmXVbcPWO_HxSZJW|7;J18_jci((Hs1+QJk~GCsenun*`(!NE$TC zoiXJw6b7&zW~1mEm=T@y3pse^xAtbnB@JF!P$Fo12h&A=jlHZ;xfccQ>v zGj((gw1YScaW!ry#D+r|Iv`}a^sFl_-F$8Rd4t31c~B<#t{=yU@v@Ug*kWuNd$zA0 z<)yPae{Ak~KYN~nG;{P0Nowr5MN9%iOb@JDhR&_?_Do#xRV_}s129xhMhvtWMhxUEF< zqCscMGT+g{6t_0k|5?)R@pAAT$sgRYTdz+*0`wTFrB5Hi0Hi-Mb5d8whqoaeTuMet z*&z$ON1w!SQfX2 zo&)qW3(pWha3Cay0Zu9q2C|4vY>@`d7F<#|I>(wuwK36T>CW%prB4w)O-yjJ*JYNv zbbSw>a@!5_x++V8vG3+c%HgkgO!0u4fRw8E*uPPS@4_9syUm{sqES z`HqgBfF7n;`>#kernwRgI%Npl6AuYXY4#^ig3VRx@B~o5!w65(?evU1OAY;SvF+~M zzGwX*Fm@dsL%iu!>$}d?K!gK7*&33x4CL151-xBA`){X80F=2rO(%vL2^9b+7*M8F zuSQi3AHP}>0M#pm(?U>nAxyVGahHomj~4L9qm>9lSjrL3YY+hy-^9o0LXR2;ui1W3 zXld3bCjotstXzelBM7imZ8ZV{gu`K|Q1{`}gz`QIS|@a17Lz9#`{eZ`hDEB8RjbI? z)%%3v3xgKgVG;4aB;r))fYZAT3GJM231O%O`-vcE3PxA-miC+1?Q$0=G;N5VCr}ky z*AqasHlHAckIR~&@cO3Lt0D^eN694i*iim)5mBS`->v-aW3oj2naj($ljRzgDRKcI zxttmwESYOv?Qc9AXW;AS5mKVp_D-R?{AW}LY^$)E>{ajMhH{(52UMkZFNML!ZMTv5 zI!rhS>+0O+Kl2iE{C7R;ZtxwhY6HKc1Oy!OXYdtu;{Vm}(_^YTkJy_eB?v)9LDU}q z?B z4vL76glV%b^#6hw2+Ru)$V#0vwWtUvFp!SSMu9bZju_q?w0zfkb=OAH5Z&Nq^Jg-h zz@Wh5ebvy>cY1m(t~FZSO)NEP+@lWx#Q+tA(vK+bY94#;aNtbfTORm)T3C2%pK=}x z!xfTZBp675Lc=^1+EdXlLZqgKDsB%UpcKwb;Gl(G1`Kh!pguwXf|~)@&|m3QF`&Nz z#RQ19Z{Z1GiM_YCwF-+^6vzFHF_LCwBIIB8gW3_q{q-QjWZ-zHs$^_s1qvBWvcFOk z=+GT~pvo}(bQjutSXq(LaVfZ6Fd_#E?DmeXH%b_2=$m2@LR1(nFq5}x_|5L5Cl}zte}J_`y`_8_%Q`+IPB4@e`l=(#k`|i0cfCGNO%V`;2$73N zv5HC9l0Ldel#gB1j=?WV2DU*tF&(?pme0V|#-?VB2e=zK@s!fvA>Y6+CteyRxfblX z3)H%9o#{lXwUR{MUf*oi7+I6A#ID@VFv}6Wsh_kgHgJ<6a}5zmj1XbLOUJdC+HBTr zY8IYq_Nch{lXTqp%2LnC$VgY|^*|el8uWvHk58M=b~_q7?^qXER!QU(&z2*tYS*sMs&9-e=t71~VG3zs&q23<4Mrvyu9q=uZ!XJ#w2bZ86P>M;2@hjaDEsniZqjSWz+dd%TDo(g-?5>hmADeIrf(SVdCr*3J5B zrPJttq5Ir!X!qz|xn|w~dv;dGx+zLb_E&c;u-x^FKkPZaIy9>Lup?MiphAap==*B> z4jjVCB;V@)x*LCTb|*~g4Qe;0HTZjViG9-%vNbtYWu$Bq%eKkBL2;L)5UqKO8mLt! z4r0=9F)WrPq?M1sV;~Wz#7pg3qr$j=%e5XuMns4dH#A&Ebs%+M8&;v+!9=(l(T-ud zC;T-f1Cmn~kO@B-+eh`i#YrC&u#lQhhA|m%$li0-z&U(Civ{mPqKf&G&{j>(mZFLX z;ciI7-8(`Uu7}KF>^1HQc?<&FtWzZwOSTL7D~zCiCsDL$f^>i1NVzq7@eJfnh;&+I)P**oG&RA@Y(VAaNCt4X= zE8@A15@p8}3KUU>QKg;O@IRG!dM~QKOfEI(GC`RI@~Hac=Xo`nyI(z=_-pMpe`jVs zUZ4#*Q!x*g<@}nRgA&yIR<$6vx!E9^>^U`c2Po=cm5-o5CJm?ZjY0g-w~?8ZrOzAw zSGNHAx_2`<(&;|-+}%Tmv@ogXpGwm8&(>xCjE9CsuCRh2_{kAKvk`=W-G($+d2tl6 zl2PY4B;k_GFz62H=v`~Hfhs4pj(Pc%a0_HL32DcU$~z<&vcPa#j66a?QIVA7TZm8a z0SsCH{9TDB-f=J)qrDW+N<3Yyt)$0Eczm)Mqt6UpB2&NZGC}Na?ff}g*=o0p|NLNJ z2jd8CNLu&DpwCus~-)qp}&tzSHIkjSE2HZC!K9w1~Zf0vs|i}<&p ztU`%>kG2dss;^UC|9tby=om7@$?Qrs+X{kAg-ZRSVw)Ny4Bs)Q&=Un}#XmY!r6-mO ziZAgrA$#oWc!kThz5QN-l}GNO2YnJ{tk}%K%fYwK;VS02_S;jOe%j7^2BsTXT(%jq zA35lm zLs}d~LeHFIMMhQ@?a@g~h2hJ}j)@7pEVW(i8Pr_6=$d*p;A_tM_V6^MPXsF z1C&R~LGjh`?L}{7&dk8J?@Ez8c$`I`TGb>~(E4)!{4tYf3Ak z_@~f5AHmn{Y%R8;;o3ao;_vvYOa-J0=eh_na+Q#rpH#kIXFnJSuYI2`x01z3Bkzid zdH82Mr)gy2^IK%d=<(3(=FOK6&@Z&s&Km6RlT|iVmcvNNW}2eM=1vgfOES{6g{s5Y zJV#Xft7gPfL-}#}Y|&0M8BKXdeA-4nZD&qy^G-z)OyrN7KZX5b)%2?htrCva?*(U? zYo1sMi^|Z+4=?cy=&(eWX7pHzw2kO7-ckk*4G-(G$F}Jge#VZG#lRi%=7b@4vGhSO z{}S3uz(H>(Khpr}T$npS$JF&fg7mNC+NVDCZ`jq1-$m#P$&t*R)UEI^!)}75PBwRf z{^%51qS=~#?u(Nx&-6QsbuU z71#jy*xDNYT>kat!!-Xm`Se*3%I)oHrp#i4UE8BNwYK8;yMuf?k=F^UtT+8`P4`B z?qCOaoh>0lOwG^3h}G1v9(|X^AzadM%3Z;-mT_NtUg_$J zi$}D`aJ}i)G>T3v?(E9XUFF8x{LhY`!3?Mt@t+*eo!$%xnI4A&S%XNw8FY^Lf!F950LMlpHc!{P`n zGewq`2@^68U#htKEk(5gLQDfMKh4#%(^Zz@@NLRtgGj>3jZ_vF=us~j`1 zTVBt)z|V#pGX;fjF~0*l3%gcVIfH|blFpE$LmT#OKfBv>>|fZN;GDCnQk_$}@e+Y4 znu&$Uc~=t6_Dt#7nXk81es>4hQxzQ?zybmfeh#Utx+F(EGn>L#l%*uu!$|S~e2&S- z2<~d7f8eg(-q_ZKPyC;dB{D}JiiPjlR0 zT6f~}>(q9ViL`uj`w3=1#}}sITb->#TwccJv^%~RpdWF1&dreI9-KXzH>-@F-kV5S zShyds@cnz-@1ksfjecckh&3y+(j*BNgExe)`ctSlebP$O&5|;VBGvr6xGd7Xq-iA6 zJDDCy=&^)zKQrS|-}Im;50TfM=Z!mBF2NNQsIsWM%6vMrR(-%MPmWrJOQfl&2JH9p z->{`Fq7%EENm6v9LVzNy?a60HDdJIyXrtR z)aDl?XHmn&8lCZ7Y;e?F@Os@m<9`{`c^9e&m&NWP@`%g})0HA!ef#*tnd_6Q+I*`p zU?_RQ98Qjp2m6OR)p&Y-r1vJfKV4~8magp?Iy8Tg_~~v+KUJoE9EWtBu%^_LWZCa~ z0qqy2b~ZKvv$dDhvQ!%EjI8?si$iPnLn8`y2TBhM#wI8&Wd#58S?p|Wm03C!%UFFv z!4oC*IlYoeJ;B+Bu1R@0$ZuRX)4eb~B>-0c&^c1nlPd8%x))0WyU&?X6cmLcW-=}5 zNPcqQgc;xp%Wa#PCj9q7V}l3!-ZRWr1;ysYJ=y1%g8B401EnQVR_?j739jzC5s~?| z?VqmP)>hYbTwTG+wl!eUKQ=D0dH#>QD(xK(W^QS4Ld6*n@dFoPMzAvlRyl-#`(y9Q z%gA=?3u(%O17xVJI353yh@^(MNqp;!nQbwDMavLK`sApDb!e2ClT%Vu`PuB{xiaiu zu=&v`x@)Pa8A8!x%!n404?${gn8O#^=C9Hu7q34FfPJ6M1R=p|*GHgUZ2D*a3SUzZ zd3>C==87Ec)%8l<#pD1x0l({)CqMoq&&#=9oI|%wz~}t&&EM8d^W=fkfdS@zm9OZc zp&tt3Zbx9Sg3@Har`0|+W1=a&lE&84TZ9v8!FtTZ()5Fk39cMQW@a8~WH&P(Uwdh( z()qbR1e1wJI2)fx!)^dx(M|LAySo9YpfH7cBwRZEYj|1ssRJC z+O3dwvbse~i^()Ow&Pg!B(+^7i^B8Zm=GLCcOjsP-}Mm?3Z}FzTa$!B%E~4tmbyDL z(~llWN=o;8rlZ&O%1|eWqz@)jQ>&|~OX$ffDqdd`dvy$FkGgF3qqDLO=`g8-4gK2F0lAL~;vwju=4UMX{ zHf3pL3&dJ_lN9P*C_$X0tb%VVu^UeIumopy+i;ncZrNlQd8WP`6AQ~bQDufR_r&`b zC$e%xb6Y>k0N*g5p70jPrz}J>u(639o4^C3y!7A8jYUJq&4}qRt1T)A`qn8K2Srq{ z7SwvBe~gFn00D_;ZPcoiL^19L*jk5g@DBHPE9>d z0*iyC$gWA(jFz7Mxq6V@W}AR_y#y5Iu;GysXp!UO{5$Ozgmj|5nQQz!hcq!#;q`WAX5>!S%NXx`wT9jh^W2(QoWQPpWUUS{>|$boIDe7tAt zSh}>h6!npF{|0g|2NaC(HRR!9g%0nKtDLq-5_%X}dAw<9z}{3=S-BO=F(p{=KnjY9 zc^3k4L@g|mzvwbYQDgEBf)MZabDH7)0Jjqf#E`6$j5xU&SrVkBV(cX%-6LdTXDEA7 zF0eU#DAX+;gQc&i$Y*;2V>dpc#EVt@mrm|0z1Pv27f->>L6PlfbHZ+SR#GJ9KW9jc z|6AX4lyUQ8j~fGK-2Jmle~x2BQB)+%l*Nq=C?3~VH|tl9P=oVQ0J91uq^K@$12x;1 z)=@6IW1c(X<{^VdJ($1!$zU`H94wcQ|PU<{Ybi5KzyHx5iW+2Al(|EC;B}x zc4>cjL%)d2^EwFo5rVt9iG_}-sbM6dxK@OO*UHO)(OFJG>VyZk(xs-+k+rprmBZMB z;$l`gIo!FGI`?oPW^pGgV$Erfcuq%zq~1nY#p2LyLpS#l?8a5@Ku4;e5Td<$(>gpy09e_4O0SP2<#*>iFAolRWa( z13y2Pqocv0(Gk?$3(m6(4vFEe9X1^3EYSiG!rPF5(p6CUR#aa8xpQd&*5*|CaL?a9 zMmUe&DbGCk;NTEk)}#G4eelJd6zSG+J8W<~Ufiv}5C5{~Rl`o0LG0NXA}IMppAj#> zo&Opvh5D3Xui;((ABT4|n3zkj|HMS#Z-*$NA`rR#Wf|KzLGQc z-12y{DO9^PD|PJFbsmI8tt-HMj4P#X*@a6QFpm7 z3|)<*x!K}jtet+5Ds0IhP+4x;BSX040|EtOP10|;s>RseAWDP%osrWsE6wtz=x9R- zhH<_MW+}F?FtFqka+2X+vyV%<*%!{rriQaY-`2Kr$ja{EMXA-K#N>#Q)_J!$^x&9F zcQ5%EEMtOZu3rFT0PlgCsae)pbG|ltA=*{nfe2p`B?i(#-*y6=GW!EoGNj@IZsrUS zAsx)o%go8z6)t!I$Dqp^M?Tbwx0ousFN=xa?CrhJdz5m?*f3*O$`_vl& zveVy4)^;P$JToTY!f^75k2~+qcK_(F`b20J4B#Z zX@JH&q=)Et`ik?vc|DN)jG(s<;Eb->Ln!BeK2r?OIQ3ND^cbl=4wfCZ4O8HG>zsw} z5yn6dBPclhTZW;b_m)a{7^4E4SpBQ+Hr{JPW=$u67z90{o{=g zveObhVpv+t&cemj-M34nuJ#{eYkTwfkG-96`!_cUz{P2?_33@vGA*l18!_q|@)`k4kAeumQ^GQIMccn80(q`gkI+Kw7#RLyzr`*Q_8b2giF=)%vzE z&It19L3|Y$zktGql!gW{tt{`Tcut#d!>iPSWT~(-+~Xtek5UXFn(3ACI;J5PPsvV? ziT*9ZV~HJ@6(MZ|0pW`>wI_7$S_}>jY?tXbm(PThQcm4x-nKYUNV)u#;Ys{p$=B4g zWdSKggdf3mK4XW>6F>08@24)~YJUKC{L_aJELm(Z-H_<-2p*7NkD@2~Oio!{Pzre9 z%XBXiG}Tvz@;-y}B(aiA%LjKQ`N&g@XS_M5k7rPg1ZMP4`t)0kvkqg zZuW|_=MP-^)(#Onx%_<;xVzg{Ikl2vO2+UCb7ZxM=5~{>aGtn&*CQQo&IEwQ>o`H$ zwt|PlvUJg=3P}$m>a6cx=ezI)oT%rY8){0&&7qJh^4bw(Wgi(F7yz+DN2@xs7?tpP!nz6xcU>g)dDS$S-81s#W5dWgMdYNtGzNkg zg*?3U`!QbE_hAQ7K%_bA^}3P4Idt7*$4~CNhl~t!j9h6 zsx7gX?(z#Zrb7NCK(z2$L!|c8H-a97cMPN{$x>4hEtsd=Y1Ub0!1|nHi zpJBoMeO+4CKhy6U*G)=;Dz#zhc}EJVu-R4UtQ}I5tsG;{Bk>H(bwD8mz`dtvH>Di<_2F;1(K#vrHpQvSZ1xXL8;G zv7KK~92iGw4JBHhu69GA$x>?zVJOL_IgHHuNwt$emr2!OSZDOm~y;A4?i$#M!8<)KY$WIN>7L~F#V96eR6+AW_LZEC5aKAJ5(yDF z=^vFG_mf`Ful@Q99CeqJm!FUlug;xJjK@3Bdp#mYwXfMy8?R0~XxKXcd*Q*MpHeUo z$P%Qd$P3#7VZx!wun2B#cwj>-04n8B$L*DHN@PD4bWpAplGS^pUn7W)lZi zAhC&-mi9K0;;;)PmriPPY^G(v_H*R~9-I(REG3OL_BTFsIh@zyv0cCk<+b$=+`j|e zyrGFpEVkDH61+KwN6#Rl`Z@`RFyWT=04Q&j7)KY*P^esNE2b#&m)&boSEd){ z{W!~^?X*hdY6S#4L9<3urk8YGh~O!{o*udoDUH43F>qpns0jOK?rVu6(FTxF2h9y*O`xZ}J z!qeWWvsXQ#dQ_^e76*-|j;(22?6^y%+XIP|J)kk6IJGQu+THNFqD%H=)OI=K1h2>5 zcmEDt;D0aJR5>rV=ZAG0iW@P*!y-(WrWIA0@ZVx(I_Wo=%x+|AvE@ zaR2q(bq&P*_yTX$@qzB^P6OZV9e19h_wyHhj;NWL&@jf1aju+JPW+1griU+TA1#Hd za3wi`mM&jbU0uq+05L0N?x>v0@n4^&-XUjH)Y6aR`Ds1LXalGaf}c1v7rYiSe$kcC zL$9BSS|knQb95>>SpQO{6Y78J8N8Hm=lw+T=H@RWoXXI9L3`FWFr|Qp4&8tZ{~3-9 z{}Cr&{z*asDQ4kzE&$L$nT(FI@AfjYB6jISN6-}r8{UkkbMQoXl`kTD9oj?oRNjS=k!Fx zw&GvwE;zfFY=K_{Ot!+NC;^_!sMVCNhX-MTbdzC;Zh=ZzQ0KZm_sGZs^fxf)WKJ(? zA;q?_@fhws+EWHdXh1A2vk(|sYg@5PJLNDG2WFOuSPd+8M2*ce^fEaG$s*faMrukgb1eF&_Qc<7vYU)1^gX|ZNdg{^2 zK>1|}xvq|a@VyxtMyn|TV$S_X1*=Gn_j!L1iC_vRXQltKj9i2;O00V*Xgv<=d~XbFqDe zay*r6v7!}E&q31}bm%y9kB?_keDQ!XsrR6ZrMGWt>hjG*jDGCV(UFwzuiH{&+uxn9 zcYlAM_v-Bqq|TYMtIwb7vyyoFt;9>xhiXw;cAQ?7!%5d}{Oeq^K}1Rl6CO7--!PVu znThmXRSq-;$#q^~npLGSpUX7pMI9K$pn}TEvdymXX|w$dXJ^F6Sy2avu-fap5LxRX?&u}v(Ee^yd|nN>#3*B7ogXO3Aw6AoWBMY)@-p9JX?kMGfn zlEOFcb;*aKqbPxDM3_1DpP}1B$Txvwbq^~&p$4rv!A&I(k^%Q|G$$veIq=ZcoUQaeQMX>%f&B_J}*UWL0m=b~~ z!JHmhA^QcK0ASl*&yq;IIUX&*Y8DiaFfq-b1S~4}$JW;nDeKiazV!`Lz-5|MmD=9R zkfXUDY-l%ImW6jOLm{0~QW0={EkN=6cY&J4kix^v460VcBACwaP2|13;8#cyE^vn= zn*RaL$fPdG%E30!C)?WB_h=DaUWGRL?dzo_AhSI@o&eTYO%9zad#=2Q#D)%n@iAX=bD4O!TcC0m@$lI4Pvn@gR_$i`zdu?N5T_eifS3tj`LLQOF}MRgNEuRBsKK zvZ*~9+%yn%)D`6vGjcP3r&R>>_uIH$JOC!#{iq_nZ{rAl+J?RP6EN_~$jSL@ zT0-*ZopP8ATdh&?;{6uZWwl=2<2q74^d(!DkE4sqBhZ2h(aBMcG z8LXR{T61m=DJb{LYKuZG)0nCUNV?7Dst$(gtDNk-2Xd%w@6bMdB!=Du(A(SZSEJ)O z-?f3!Cm^-}id(ejh(XLZIQ7utJ(V!MT-4vQV2gz(D4B9FakH@4+oyQL6PJm z5OvNQNUBqEv8!mMV|j>`mGW~CKf{ts$heyDRm^i;fjCsH+fN8r}KCkvZ9grPqV#xWo|aSgwi>7vH7oOPn-F#ydce_0QRY4B5nb_ z1FY+{x=T?kK|26@urb z7zvO@8CdIvm$uk$Dxn{|GwY%i8lP749p2X>?t4a78Le-v`#h6#denrasHOrfaxaw& z^(dHb&Qax$s?=9Wx&k9Jwg-)^*t@sigD52M)5w`9X7H`WQjIWuaBq@6v$&U6GReq8 zO=S#W$OM$vR1cjt6gYX@!*tSV%Hunp(W+Z}v$z-u^~G&w>vn^|e@J>arj0{^)GTVK zKl0<*LZ7eu{|8oe`) zxdw)(-wkWNy}l}x`?xJF%E5o0OxZ_P&rnbw1Y)+hsYk6}ICfC(i%tEWJMPsL-G& z3a4`{?2o?qLModvu}y9DcRTBiBBr@C|8}4VLNaO~$(L_u8-2K6|2{MW+w)Im*gawG zzfSjV&b9BbuE$tDeysmM%lmER;7s>9AE8K5Y(CGy6YvM$+^7>) zRHXJ{_;5H9&V;s3LVaBpZTVS{v%7qiW070M z(hk1%(xR)Wk;Qh{tasdjG-kKx;SKw#?WFm`NuM;PxX#XM+dTjI%(PHi>ihPgpUcNt zp8W0Ast~^!Yxuo08i^~dwVLc@{;AJ4enT_z@}QGL^<6bb9s^qT9tLIa395{~N^tt= zin3+lAA;7?=e~1JEM+*0Q3o}WT_WGrH5QL(?q4oTVn?{|=*sRa4{R|#XlW#WuX^6v z@GmWN$0LIZ>E`gq##d>~-|?Z+4CrbhUYp0PtarL7c+Y#2jV-97Qu4jR(i5FGSz=;r;Gjyt*C!Nsf`o-;b`ui94*rq))e zF@%SN4F1>b)ZZ^|K$TTQ6z*9BK%}7ZOMGv5Z(70Fw8|#Yh|=<&vIQ)gLNvUWNm9Cu zYE=1?;`Tc6lFS`7=8O_%s0g;>D7*<})-LYgP2%6NuJ)kvb-DAgB7h+6N1U2Yd8t`Q z4?}po8`pF#4I{$qwInH69zNxl>>Norw4eF4xU6^&Q{b4GPryTuh9fUAJ-;d;p#Mdj zT3LbHtU!l`R*T<7Kz{B(r30ngQ=(?m5}W0c**}$qmjTT0+4%5@K4SthZv@~`dgG^l zV|^2o*f)P==#z}tuu?0t0^Rw%W}kg`V&TGm!9a7_T^9N$yChIkJ-h^SN?ph&Bm3| zy@d4RpQ8any5jWHM5%7hM8b-DmF82Mi48wTb;{z}miIMw;unbra3w8(-<8z8R8&ny?3g>Lpn5--W9^Y3v@&|G~vv@kzJYV}WjNIAZy4|3( z+lOR*L{63SpEPOQDrUwHvAJGm^hiZsJtF0cNr3wilFZf6X_MzD{U@;v^)P076!}rG zObf9$rk_B*VEV;oz6;D_5l&9dICWh6yu}cP+9NZ6l9u$MnrJGIp_D|A5y#ln`~why z=4O-L!{^PYwESzd3{}%DP~}>4*L@#6@rlAbp_}{BZRluj<)%IP%`3>6$FiE}WQDLL z1}#Ba)J~r4)5n{Gr^5fI^mz8|VdBhl?bz0}Twxp@m}bv z(Q^8aYwFwfb-(mXj-m=b7mr|EeWJnT68fW zrT`&dbDf6wEAfP?%#QJwkFE9f35ZE@a;W7)d@X%Vq^-xS%*;hi?FYQ>NBxA~r5>EO zHu4nK#pcz!z-#l(Z8N@#>+N4X%EYeyfi>yt^qr&+?(_}j&Qa6qSz^BnH7a=})CFBK zJ8H79G)zI?QXz`9efb_GL0Vte5>Z&LU{W%^f?dqnAi?Lg=^E~1oAq^)UIMGd=D~!v zz_(_aA2ZLWo+$Fs&*JLom;@)Ndmje-s(fkUDkuvt%X=m-KTomhWV^ieLe2E5_@vi5 z+bItH0xvc$bbnu+_i~MRE8WgGB({(Gq2owFqNJUxX&5oT*SEfXJS$CNFbAxuSg#7~ zXh-%?>3&dq(xr9C9S$oSduH=z=7gwSZYVN`C@RADC#~PLzU*HaoiH(%bPe}BcC^ZL zHS&_%olK0^uD4`k;;H!3ZAu>AVZHCpU=h5eaF!5X%dUdDDin?_UYMs|Sg1Z=;LCK;eKnBI+kV7x=^T0?Z`+g?*E6T13)3l3$)vrf z3fwO!n&4=f($IP!@CE@xQ6L{3Irf)uGDl?hARDW8mvQ&ppEz8cAEYsnVIL*;yJRgHU8#RYE9EtN6JDRGHj3 z(cUpLS2QJgU6GVTS(Xk(9Td&ZF0ARPo8;{E^YT1<6X>;CS5X(fh!+;%Z#X3y*8Bl+fv^w5HWH1w!dya6o#&c1F+}c=~P@8K= zVx^A&-uBmVG#t$aMK~Eq-=Ze&$|^)b8ALFpD(c&-YA!FjWBjPBv7s!<{n1B#3egkm z7aP+%r3b^JrDTDmi+0Z=GM%zIL9hG&`|zA%s4Koq5`V8%hAgWRzb+hY`zYm0y}4lD zT38wZurg6nZg)SGh`mrh8)W!=@_4e!h-YGGmw{$nBLvhGFm(8#FH$lMjLcS_xPqwp z-n})+2jbNF)GM}JkYH+JVsfoAIE*RWyi$0OOX*m*a!@5VtcztMXYV-C&EuwvuM`x{ zYoU0E(rX7Bfj#%91Udnc-!aY`EvWpbsaN`iXoWc#Ea9`b`za*5mKWB-aloOX^innrS43c z`%UP$c-b}18cO=AuS(3y@LY~h+2b8qva+JjCzgt3vF+{Fj&a`gJ0x<=9Orq;Gp#yY z&V?QizQ$XC7GS=$msl7TVMzCFDg1*aX-HPF!CAK0mg!MN9Db^S6wa5s(cM?6S!1~r zo|l($P!q85;V0(}bnly{^jUcaN)HuSxjk9Zdgy~5w6o^zR$!y0fPty_D*hAu!hY4( zVJJhj5oq4lkkN_%=L;Z*!Jd%EKJs$P!pdg!95GpCSH@$->i+=y|NR2MeK}VO$rmB) zmhVL6U59@$NAv(>dmx;gbw+ZJG>|s(tLXRjx`xBQib`)ApS@8S={r4a(`UAKI0|dm z4>RyJXBVZ#TKv}@c^R5?{f$PM{vh<`^jSQYU9>*4F#8X|XiQQXInY?heG66kyJe}b z`r=1S*zC(?i3pHCWl-zeF&joEYUT=%W+T!dibp&bex5xpmew0EtG6<+B^PIQH5OFc z=1mgTE&lIiY_$TaNiNoX`D7|=%V68%bJPI)QVf4`%qF86tzUY^(PzynuZRE^TQYz# zt7&y_1w@V8lKnwVh=mj;t?(!yzpy4A_#`f?@$;1>#PrzP%#Tpjxz-R0%Nge#9d!6= z(NEzm{qrSS&*mAkpn&I{L2ZxHQ|RSJmqPL|GYqAqUK{>#} z94e5XnmJLHNvx>&lHnE3k!vE~h@Sw%{szak?6$+4jcPz%8YAve4kfd5M-HT7Y||-D zttS4O+W6T}HqNguhqM(d^?>O0*jwg=#cng7;t|Yq4+~zO_6*AKt_7z_6Ei9!OPeTV zhGQG}p^N5+2i|#W)XJ7Kc#R&j4xd_2bm!!yA=|uUIh}SSns_f|>=Hamf3$bLoMWKI^h;G+J~!x)e7Ay8QQxATa`>?*WF6<(EQNzDCq*Q71I`=z@>$*3@H~bvfX_7Z=HfQeBSY&7_iTi89A+K$oUOCll&gn<~ z%G@mL?@lSK=zx~NZ*ByzKoNMJno>^ma=~X+ykrV(}aY~i$(R1 z>qt(SZ&F))R-Pq0C*4X3|MzK$!Pl9s^+<{g%*Oi0e3$k0HL)m0-R+a{*7m-|g^4trAo;?< z0rM3D48XMZB)lg2i)A_$v^0#cV)d1=3TM%()&U`Aa6e$;hpNibRItu~Y5=jv1|vnP zQnmczAX%*B!0fCHcf$1>9aT9D5X23a9F19E*%J>oYW^P?@qhKa=NUoL8{ZU@bP8&- z%XyGAa@t$-0}+Fem6bBM5zx9QDJ2b?-hT&S;^OdZDm0oFZ?DeW{+l`bf8Dy^M|@mr zKE6LsGjuuxuT9KggHzJXL4dFUl{3}D`v&eSnf|PDs{g+)7KB-t-+so%QxCmKKCt3_ z@@_L{#sdv_)pWfsr(`TmP`f_Nz9h4(exYR`Te2J5R8ml^|G@gQbDc4kkN@3W(293@ zFD}v_2$Rj(>>d`BKD(J0{l&MM%(r?rH1R(L>HkW>Q^B{l^CNr|Sy^Cj^GAj5Ye?|D zd!ToRTqO`PeGLvSEXSd!#cH&4f|+rq)hEPNk0zF~N11S+K(sya#|;k4qO=mg#%tD` zK*KA<95A^wap(dRK9HhF>;y*+Jm+mpC=VL_{~yl&JRZvSeFMi8g>0=1S&E{?PWGij zvRBA9_C5Q)4U&*B9%SsKG9pX%?7P8WEQM@ipBRiW_Vs)9d7gUze&0X8^XiY%jJfaY zzOM5+uj4$9<1F&=^?f%$ROu#{yL0#M=c02#1-k?#KtKlCxPu+p&Af`d?Elw`I6d&% znl2_bGXIrkF3&W>*NVcJxEb^PeSZTew9QTs48K0$vNtrqE1jI)C02vd&iSlv0x}^e}By?&_#x*axpwA1T0MU$`24 z$O>e*paFV(o+x8kHzMQW-0U6ISJy_avPtMASrxb4POF@< zn_C%EsZ&{zaI1n^-Ca(+^G;EP*NmLTpOU_N$+nv`OQ!r@QSCW5NbaqGtc-hKeEC~%qj*VN37G9*`y8=83UG6749Pjh<-$q8NNJ%Gw&y1G&$oKZf ztoR1;R87ISh`#Ao!eLJ1?>a2%w)cT9X7O`=!Sr-<>qG#?cx9?KcC~7%1$dhOmgL-k zSe+b)LOpt)*U+=Jh@O-E5#WDN?KmgZ5O~61FgVuzU57ObD;0Hei}SyiyBu^(LtBae z8pHY?%s2CavNC1X(MS1NWSYx$mY9Lz;YXq@3sV7D)XC04qgG&`ELl(^2S&Q=IRtJw z^mCvuKQZHQ7t7IHt_}!$De0-RQ(3i9wS);x&bUwcrLXAlBboiBEhJyH@hHHe02WkL zPPK7awFllcwXtzsHo%Dap7^9IpKf9z#jBveCEUL4iqm>$3S^}VQ z39*&P!uic_i0PSnoxvUs?~K+LM*&Z|S%3CwXy*N<*j0&_Ax_fmc-q$Yg%x2qQ&?oc zln2ifszg$?%pQ#XrH)jLJ&Qgv%pB6b2OZ(c!X#9!KEyL*MdBqsiP)>YdH@#CePUxZ zH2X@pISV8_1our}E~@*j`@@;@fc>YA%1v30B>$&((GBzU-hcP;<_%Qh973t@iG?#g zS~#!Z7LS}Rl`389`+{;>+9nbpxZSv9n_DGxjIbjbqS2Esd-_8 zyQui_!m}<>?C$VUayW2$;0n1tw`0rJ{%bX_eB3IUkW~x@qd3JlPmLON@f<4xbDf1!7mHy;K+PmK|RXjT_L2qrH z13ZK>w_!zi3rGj`mG&o8Ww^zQzM0DQ_Ovf`?!=h0yjE4!gjjkz)1%xpsXXR}hTc(x z0u?`W=~qGBifNy6cXaEllbAM6b}`Qk zi)9<1`9(CLC3mh~0)}QMMjd`0=NV%jO}PtPxstEL_-CYaGLp>v+&asB=Ssu!JF+}A zvQb}*Xv-OkDtKv7Zd1bBVfy&A*o>tPN6w_T2n4sGVJiQou;PEO`O{Ll&87GnV1oqQ ztX`T!l94Jh?6!`M(Zj>fg;Qw377SWffkuuHR@SykC(yZa{on`^{(v*i%+8JqD6;#c8-o#uCD*6b8E{CkBxPM#n;-} z3Sy+8k&&Bm($v({tRd6!W-#zWCKBBc{KnnD5aHv;kDxCk%hjt(1cE@3ZMM?OIf>2f zZJ^xg^PlGX6Sz3tOC)et&>{Cob7-9DK&w+Pb`|%Hvo6bux>RQR>3e>O(NJ5SXfbe4uTH zu#nILQI?#VnpCUOuhoWv5YUWANJ4_@K6gU1s0L8LUAc1Q)3dzUeO@$YLYJVVB(Rtx zk5qh>mzQVJ$@}*@H_DdN2^(ckj;_W$0_~7?kB%*(qCk1g!$aie&70qfjOsePCM~Ax z`d@Lf@Hy`P7#~*y*9hEz0nx$FPcjpiQGTX9EtWa_0r=iZr*1U*wtxUAv|q*rkqiSH z9}qLY@nQ6X!k_1@IB)wyk^w>2+T>*nI7UAm z8OJN5uGE9^2IOS$M6`Z=bcCEOEG#TAtaxiB+_k$afw0aH#dJt;_xs| z@|Dp9H=6zAjjv2l%ePEiT(3=+O_>B-n>9F_P1(bPM2!=enqKKm`x5y#a2@hW38;L= z*Yx!E3IX)aF|6dg#Lm{1c`CPD7U4DB2B6%wfDIOD4}yE7;^|gFFmY~NKKInrRO{Ad z3*f8QDkw+`8oH|UGIBv^8FBg&pb6?ZamUo2o*uK`CIR7&VgV1Ytw{8#jJy~Z3k(eW zJm`n(4d z3-pt99Oq8!1+x`$^{S=2d#SIZc_G3YwB$B{;#*i`G5@C9rcnH=uw|P+*LES!huo61 z*z4k?3CrXw(veFEW4uCxOF>5BYY4uR)vnhU-<91>RCU7!?vw-`Y}3?Vz7Ut7%AEi@ z?EtwRcKbxK2oGp03Lf~2AL7m<42Az4`%XXir-u~#nh#bVdach+b?3TIR=3=7F#k9cxl&5N-ogZ^nw(L-fVx~^eDVM8 zATBENm9^gvQRcK9O(UjF_>jr}9w(;~`?QFLd-Y+M$=iP?Lg)Ciue<~)_VepT6fo}H z?{tq8`Q`R4&;2_J)uXp{6MSwG9tzz5bA9s{k^jF}ry2Fi`tOKckmLiK;h%RZ&X?cP z{}UH4T!?N)mY$w+s+|LId`>kGtjv!B_JxGb@bIJevZhl54QGF9Tp9{1}PfaFOKbOCK z^6B)@h7fG!9_x6Apg{hI7k__koKHQ?d2lU7QRaq<=ohz(jo->cIE7?Y`DG)l_f928 zF=RZuOFQC4gfcN^IHWFW{dm;sWxOty*4(8)xMnyH5NW@JU;yT0LG%6^OBXGx*`6^qBXyNP@(!S5s_A=^r zw5}cgDXoJngUdhw!g{uv-HT2G_ynHahg+uF5K|d~R`h<2)knz|ukwcXh2f`?1KjK! zL5bFPJOHeHHZ56oW!ww@0Qf(c1wq=6Umr1mA@Q1QscXLI4`;U+XWNgeP z_**$Y_!QB2w+&|GBY1o=b8CgichO>QLle|GapbdUX$bL{JXfMpSyzJ%Zb`}rK4=Vk zIr6fL_*7N31w;~2#*a5H+j!cMsVA7Jyn*qn6_lq}|FmC$W!8jq)3#b!`I3#e-75b4 zAv^C1x>SF#fi?Im=*#p5_drSaUbSO*UKce>s$nP2y^RMY#78sUr>#AH|Lcvmelr2z zY0$-%mb_8mzMu6KE`=lCZxdfv`S0Yv*xSGc!Vh7$==&$eG_gdkWJDO2z;m8AyP)9J zOm@&=2pQ5GD8|8OTLr0^}-x8aWX$-9OA4@;Rh}<3Ts@*XF6wwAa4mkB$Bxok)?R#ZkE3ToOrV%{9F5uDx$7PpPUMzc3iBibC@SYe zeyYB`WUIna7~&>j!&NdxRYX{-8?=*=@L!QQ*!C)Uv2ZT`F1mVQG3_(20N9i>h`Vt7 z#$0Z#D>OF1*(Aaq!n({nmzPvieb7-M`U8>CUi){=_yyo(^y!uE+$wy*tz)PpCfRC7 zU>A%q=?)6q$XvK;ZM;)fjdXgX4pPh-bqyxC347<~EV*=aM}#Hix8urf>%}lRLR?}$fp3ALF*M}mlwRkS53AvG#=?X zSI^b!jC{WUZ-cN(^r>NF+rgK-Nko(^bvu0i{JA47INWFAzO{2h9}gSKDyu83)rW>72umcGpIZ<5HILF5RgL9`?(OnER%V z=_CHKjJ2#?|30Lp{nVh{Q$`cye0El^M|M`M2_XvKpX-)5PfAH4D!&%gvo)S32$MZ$}oKBCMp84Mbm?zr^wB z;IH=FEPJhbxLe?ZX-xZ*KBTkZMD@jJL-QA}C|dlW^=xdL_pRL*PMp)9}0 zoEfyD40_rPR_y4qA5M)_FLtc*uIhI&$?X_8jxUOwER;cgNUNjX$89PyvCCspNN&_# zRq!ED`MVs6x5PmJ{pVOZYrlt3T5frUERDbMt-#a{Pmj75F%NU7S5$8=J*1uRy7g(p zNw0tPEXc#Xxoz9t;6nojRf?#4DApjLcm zuXlIfHK_K!RBHkY2U6Zdrp&--Bq9f7&zZivlm!Mp%(1e*@?CAb5ezHVJ4HUpn~Ni6VcR`Omlapn;Qxhpo7i^yZK`*oJse1em0LCa^`f zJ9ob9b|f`6{p!5dcyti_V0>`Fv3mckf2FW9Vu|yNwNKuCKgF5QwKW@szwLyaIeOSD-rl_(Xq5~y-1bZ zi|X*$xZY1H+>7hbq{?kgRrFoo6J_}@^Hd$3=ORMSJ63u`6E1!1Y0F*T<6X4LrAb?n z6f45VV{pX1L!SDoyppFjwn*x*mQT;92bV6_dds1ae0oA6vMM(WyEBai1_vt(1fTOq z;QXx0m_d6bJ<~?I@k$UH%nTbICKhI7Wr;`NYewO%gYZP!?VWy)&GSh6jpaVJiMk^k z72=(s2%D`1?6v2euJ7L|fUg`6$MLBuEXh2G5KFKm-~~vdp*vXvI8;tINhWA>I<#)1 z`!0pT1shwNuJ2Z#^NL!$S;3*ZOELb5-EGh*ylsMYZtmkm5NcAU(UKA)dm>{b?jo~l z#%zWMBUX+aeiqN*^c~esiLXxed?S55_yMu2(8b{csnS_AX5=L zLcdw&?8l{GDKgRI7gpZq23XvGi@(!e5>+TjI|0ii9v}6zN8~x*dENDM zlehT^bLgZ1lh~4ohUynXkT%WDdq9v|eF_3SW{?|~JXo_Bl(PHJwF*Y>^)B{Q>Bt)) zz!Pc9<+gia@XFrsTc%o|g2b z|BY(ayCaStN^21Ed-YnE?(*3h;8@g$ngsb|FnrGXc4mS?Vm*j2MLeuALgJTl0W%*Y z2^-ZDA1W}|Dr>jR^;5@~lU;=u%PhNX#YbXb_SEh6%h$cm3vhPX7N`Y$>#CR;gd0Qf4WBGt{g6`;Q@d6}ie8lS zg}vK#e2dsWXEHW~E=9b6$t5_5@h$94%CfGp*-maeTK=LcDJR%GaIC`OfPQT2@r~X0 zzUamG9}C0nZrxY1&t|Ir6PP=fByh3_AzIp2&V+QEuLnxtQG9kVLQTi%by~+KBO@Dc zsH=R6?wVFNmGyQiY2 zb{8P*E7$|6#?45r(g2JJy${pr1+=(nA5^%DgppNt!3f>?l0WLc@WYcs&i9eIGfb>~ zhXdP+sBm&LnQUQdAo7B>)J>NpVEd!gf7nx0P*?~h&f%XpX!lQ2?f$nN1YLptGqj>i z2#!$>B@=5g4sYkv|C|47CYJb-7D=hR)o=~nR(H;Y3R?E5NW7Gecwrj{tqAO}LVK#5 z;as-9=yO$FFFs_&lLbdXIjLytlw_n5?8WIutd^2BowoMe@0cbot-zhp;$>`6B8(_D zj51I5vaqj``WGzE@-mk6;>tOh2!UHQau%0d_Oa?zXHlgNX3=U=^o{B-Na6gocCBhQI^nShs@Qh!Zy~ zu4@5`M0Wh{7bqvIHj=5g*B%=j55(!<+#(_;);-~ve&x%EIpnNyfOnby57lFw>Cu^( z7`j{;Q#r!Ai+oU+rx+%8D)`E&toAPl2Y%Cefw0}a-nyE`te;ll@3AQ89WPqN5{6=+CzOKJMd%2m#_3j=JztJL;4544lEpK$Gs(q)cMj`M5HH|3J#4 zZP^v$ksKs4d~x`uBG>f-wO;`x|1M|fSYNdI>SG$68tVWCLdj>g=O5ouuebY{jpHH^eJ z)V2kE|KuLjj;mySjIVFbj~#9~=NA^sB(^|;RzY9_Jq%$nlyqhNvlh*>J6hfu=8$hi zQMl@MJY#XQo1@G~>&D)qk<;a|SAwR*!;U%^nb39z+o09O!?DRd+}W_@^|0=FaV#!p z-jM>GpzU_N31Y+OuUnvX4?rNFu|&PH2gdg8G}4)z8LIu&FW3;6+4Ybkuq3Bz*ax1x z6gZk>0$`oo!X7Kinm6;k3=5~u#v^pxKv&CIm>k;5(;a}ud0+0_WTcMo{Ye|GIk#h= z`0&)LQye!R$Pbm>zSGUAk8J*~{x<%7tgFg&bXM4#^uRxu#Jq*invr?>Yy4O=1N-|T zFFv_oGM+51gmk&pC(P#p-vsjPJ=kxfr+*}L2=kz-=~vk8wd993xHj19M->?y?#DRL z6yDTa5dnx?#|KF!OmJytTNL(0W#r1DD0Y+B;wSfY>f4lz%CCS@zu>_!tz;kKSa3^t zD1mY23H3eQ#8EgpZcU->!_#G!R0+>@vP+hhyX2=3<;Aw#?6zj_v%))UHoP;tBHfCr z@${hhsOcbw7PkM)ABZN_cpdy4e2tAS@HG_i(qs)w{f#JQZc={i z%;75j-tqIBkbAvfQc`}k4xP1drzY+lQM|gT9vw4SZE+?0aWpV^m>v}y!Fr0sXz;PF zu5}P)5aj{@oTMGuqKe>BNfiGi>*p%w#CcB&Chd4cle$J#h1-N7PXGGP2-|s zusBO4oI7X9GkOlW$4$1S-bZIazct^(0p+E!11Viy-FXkcS#9lih(r+(ViGjn+7WmA z?D{|*Km=R4V8xO3c4p=Ra8A+0OO1Fj1IRz2H*)|P>Vm3t8eG~mVAK9{4Sn@AgXhRW zPFv!k4!Z3L^4)JPg&OAH=_WFt?d>fD#|Y5S&6O=J&AA~(fs(=X(}5sa$o+r1B86Vv zy#Cy?d}wgO^AYLjpfxsL9l5)UlA~?1)RO5%pv8f-#;3)vOXqD!2zaCS<=C8O_UyYv zh4~FX^;Q6~uhrxDRn;u(5^$!zDLPV0q8CB^H#0}g5My`5BO)f(+)zY5QMrmN6GQ&l zgwq3<`1Q{=B{L){@yqJD)W5pvR0!MFI*IPie*qGE2**_*o5-3OjZ@Ik(E(ZKZE9u; zwTF(-s#N)-Ie8#Q+T6b@uzo-u9lgCih%R<-N1y?HiL5Qxc64v>?r3H2l_b-SW`#+a ztsW29@}7M20(M0dK;22%rlz;3~*kPmPLo-NS=3yP_! zQ=D;vTU%Z$Q}qlCNn7~gXSxOtMvg;SrKgN0qM!YFPW*ghawhY+{i9DXrbj=sfcC7X z|GqrjvMlJx|9O#q4DJ-~|L4KcN=JA_Fov{75k$T-R7vNjPqP$u`Tfb^jg(`Ke5p zKP4zT=jK)=f#TO-#R>4#K!6XjEaQR5*bE5Wm9u=`E+QX|jT!oRqiEXZL{@%|pK0n} zr=n!=^4MK}y1%~H3AdWP{q0DrS5SV_y6sZ5*n0m*Enpwk@?9sLC(}RtB^I;WMnT*arKD%&yhuGq z+Uvy8Txs(g?;y#5IxKt+loFfGu2aZ;4}3jPBE+4G{K^Z|eW}1D?kr^laFqtg9)A+o zG{X}E15FQYS^P+m4H|*AbFyC?C7J+(>R$v7&WyhFL>$+j6DcnC$LQ$pPnvqFIMVGb zjK{%h)zH8Iv5zO~EV|Ur$*I|EW1hq;w-u@N6Ej$$%qMq#|eCH`0}wSk@fC_W(8AnVkc_ z?P?~K+#$!>y|e0QaI@NmEL=%wZ6I2-P6g6Fa&};I!|Pz${iS%##@QLZv}C}Kt&6m} z(_W-!np;r*4pa%dyHz6}eFRm(XL@?*q7m;QdBMj(%&nGG9;XRn!Un%O+DgSitz^SM z@f;Ywxw*N~%A-oGf((Z1V&oIU=bG21Q8H>+m;YAjR3u0}Z3u_z3n7${v*GrqJE#eM zMKqb>!TRzLbalf2(x@<#?wj@}Aqs7CLsq2*fT!Vu^}CA5(U4H;LxPH#o*vVZ=e|>@ z^@tbPwzI3fs0SWXp}%u*{#WbRn~^rXl!D*@g`)EKvEhnuMcOcoFkc5HLtHZR8BFUB z8xu~ZLJ%GQkEHRbu)-j_^v@}?wjWf+WHGI#7m?O`&uNF+$`41YMY&{a4L(~GIT@=N zk4xpRT!Hv*a!jf4XGl2kQ7F!@P)8{666_lL(SK@8aWuc`ba;&r92gQrVv}?F+0RiG z4bmMl+SY4XY9Pt>T9-+csxmVOT0F3+n;V7Cnc+OzJv4^e2m(6FS?5r0u56S;qHa*i ztl}q;OMX+5G?k?430S+gISgR86rr{d zpKB#SS72v(vaIJv@$VG7zj`o3Q5{}RG9&GqXU^3lwBqm*<-GQ`z5Bh%fSrQFZ-LI~MFN=Pc`cD_k;1NHV8GuIWKNE*aPQ4D^3LeSfDpFuC0% zE$ZR^P<4dT2y=J{mP2AD<(A#ws*RtIRBY{`FNN9%0NQ*iEy@@}+$#GFE{*jM zKK+I;)dlT233_m}p6@WiDqK5%140Xq-mvI2mqyC*%92%?O5eL;87NT=N9kBg zT;AvWg@i_;wBiS${eW12)7=!G+-Cn!;x2bI9(*4l*l=wK2$O=eE3gJv@yv(}QwXM` za@Arw6@zOMbTzhZc;!2D;qt4|@il*Ww3Hs`NJ@oxO+}$fRxGF|7b_%>#QFJVMu-Fp zJfRwj+KB_>NZ%ZP-lvfO7LcCn&nqLP_UL;ge5KpU!!u>uk(+{0~mMr-N;&qV#vd$fPw&d>~1#`7>j;k6TqT@kh>n;D5xLd^yo2!LxyFP(g*&>M;PUy}ZS4=`FmGT`ob^lckC zZcyb$6WPWpow@7dAIovu+0_Pewi=4y;Rt$(%k-zn!p53IM8&E~R{M59`S_Q9NqAhd z9Q*!ERbD}n_1uC{39tN7z4DUmaBr_qT@ol(><7R%=D8TArRb|2E6;n619}${0GxM= z8ZNv<+(i2>wA+3z%Cj`Uy~qsS7xG?(g+DHTceQF#!y$muvNcrZxPPb1M#QmpfuD86 zTqS@9z@`kc>umgu%l?K*-mYji(4&{Kp|^u?q`$=C9vC-(9+*E0-xt(yn&tkpz&4y+ z+3zA~uGE3JurztXdu#@26=Yuh*$W;8E!(7$Sc1&z@VQLfg~-HG*bl>D=ZTgMbg{+f z#w1W1oA4hwh}4P^k&@}e1RstF3GOb-9}2u`zPNU@r!|NTh_;-h+*>`_PJ-<>!Vq_h z>zT(Zm!yMUw@vU)Mr_YW(DOO1uJ{uT0BDVxIBJL;?4Rh~s+#Cp&@;xw5>8maX}EII zPr!O15gIV$&0jmq(s1-cz|9rw09&_gRP|G`E@@ZJ&i^?*mgbD($~qL~*lTn7dL+vM zAz~mL3fJ znt77Y>kSMi!oY?5s&joB@T&HmDY3rzFtTr(7eR|#r*SuH57Ads6~*^Rq|uZG;dZc7v&By=j13UIb2074aCm9O4_q> zS-}k-m`YPbQ#?~=Lge7A%crj~-nGO!2oT5m*a{}g!%PpffSVddK1>?>{DW7QuyZgb zVs{XGESaL7>XlafdT$Dau)lIAu0E`S$^RCPBnhy2q&=~f084Dh{FoeNX#NuAp(WSj zp(XnYOF)rJ=@qsL((+~%`>xIYGl?UavveGq_@DhoBKS?uWRzQs3P!hhJ-=R8SX)>X42YHc`V%7U5R=5J>(5fy zE-VNj!bp1y13Bmjm>0W8r__h6UcjO)mFb@t7^8}kyuUi`-C;%L6lJGmo$MA9XW={$ z4rU7gEenbEqvzWoAlB+ShzpAezn+tN_qqk(QiA6x$hTL6!qO^FSeHEG^OvQTuNnbK zbKU+ReI+!IOG|Ep3{39cLba3(IMc%!KX5=T9GQIR6v&0ZXaQsmMBKyU`$RwpjkPua z)URvj+e&%Q9t0$VH8PcTLLmUA*Z5jZ(ws7bAOQ1JZpm=mI3UU}4T%ydUxneMnxyn2 zr*Ww}_@oP89Dz~Y`P*N(Bt^nA)EX^29m#$Ju2L<(*6$Nxt+zIrGa*;at?bB9UJ~Cc z(#H1B4i{k6uj#jxtQ~=MY5l@I{pKp#{)Iuye4B*)@$pD9hPjk_T3OCNqc(8fJF?}D&NWT`4Xe{jmA`4#JSjAZ3QavhGP)t}~ ze;l^u!k^UM)Wku{*kX$Lh#NIW=FZV>vj1O3mKm2FWRp9mj^bfnAv9N#SjQS8YWBGi z#Za|i!qeY--`7={6rHzVc7KZZh^A!#b>o)J@0S(GWdZ59XY+C>$QF!~tSk^AQY-ei-1D3;dj1m)ZERiBAKryOyi3E7MQCHZ zum|;S;MsV1Kzj*HYA0M&VmtWNLf9Y+qT7fU4PKlNkiv00mSoj1`bPPebEEgOt-~yF zU^)XD9&0N}W(CF`eC-L$X^)pR7XaWXHs-up9Ic`yPPM)al^FtOS&QcQ{Sk8NB$+kx zJ#E#TXNOy+C-=syut8(8^-79;_gZhkvX+;ZIWvL|OiOEu)HF2czyf^p=%Id6|Bl7K zsa$n=2I@KFOyn*V_ye)Ye&Of;F3b*7ehA6^soh)(OLxS66Xy_DzZCrbyl~oLBp(kW z#c3DlR|(o6F42l69Ev0Z2rtOe{P25MEB{f+-A!t2bZL+;@oL%SDeM0*+j}|+p7pIr z9G-?WV8uc`Luqj7U)Qqw&sok$@&+0IQVERr+J!}#Gzx9Ed?$DoGjR z1qW8v3vrwbvGFfC)DltuMmhI5>DaWL6#a&2*p-d0U^6jw{JZ>j0-~*gV7Ff1Rlo}9 z2-k)!8{@60tDv4x3>ORiMVh_qo>Re9oSYl*XL;YlOkVwa(CQqQ!sVr&`sU5v`V!Gs z=z{e(1DRzBII+|=Gl#o9v@V7k(zYg_c-DTC$NY^8{Eu)A&>_K2+~DR)@b)_~ACe3M z#*05CX8P}26sMf}j5x?JUj1VBe`7OeQbSZ@_J8p9?+bwH{I9V1=1r&l)35*IX>#T& zHUBvdg14qK0ewdiH~lJ@yt!v7^yRVZ2fz#1sA&K(HClsA)ULl2Ln7yS|2RyI=@_l zYwzqF4daxlM1yP5Z|K}e#)lXHn9v4{2y654ZE8XqGSWVEw6d_@fd7T^0nhH5Wvvhy z%B_SqA$FoVWwBHA<^Awr?kHAnm@$1`9o>IAIA9s`h03?Do|YjT=dtkTR^Y?)F=Q_j+!A%PhSJT z5?~Hn+)oFLNLJQQ6%~N^^!CAefB*R|t9Za#1uz((cjc%hf#w8#fO5L9u<)BfJw6`g zH2!^f7}&VQ*r$FPvIp`h08740O48QTi@@N3S(>1r;C-<)-6mca2S-@Cp2<(3rkqok z)0JWPFhHee;&vt{r$oD9?WeJF-W?iJ-j1=-l=o<$>p%LRURz0_9XX?Le$g7eB?T4X z>SCCtPEn_rL>)v}*El`-N0Df)-T|ndrlk`z94{;;soX@c^yk;W^j|Js!GHW%5x!7( zFWF{hasSaQY^P)rT9%h_waSxheO^sDIaPDkPf#x7eXxY4=w&N=k1MAd+kIt1%po`8 znV0j`glHu^VbS_G-pu(X@3UO`?|4`JDTDNO0bqrIS6p9T|N3FJMULyO%bZyl5nfBKTzf5Io z>zn^^u~l@fSSVwj zm=Tdz7%eQ8a_#)r-7N-V^j+gXPd4W3jMN*QB+6!jaPh9ZZwe@wyd6AW7D@Xv zy*DZVJ~aG9Mdj=IsyQM1`WU9uGzt~bgRFu48n5cxE}!Po%8I2?dVfEeD;kO{c{vqT9XddSPW%^61p{?gT@Le?^~PVFQJsM3{A zLx8;w9OX)MA1NuF85$ajhQlvLDnd9oKDx<^A z7`U%C3w|ZB!vkg|Gi}dPLG%~3;0WUpAnUZit!mRFTz-zJ+_*enL4H){ZT3%hsUSx^ z-krAfQ-Nq3DtPT2{SKVi%CkcZ85a|h5<-oz!@_i=lx>ap5cU_ND7qFM;q>bLQ_o_| zeI3DgeHp|5rq*!C4z*J{PwLYqp0c^fY!Mf4@wral+ThLI5dn}JEazL))fFez8Qb}l zS=h4yh7Eb`_KrxxV^T^iRO`m&Y4C)oQGvCi#($zKzxTiVtH?-dz>fyBcd#xmMzu@0 z&r^~87Px&_=OF(x7NHi)j8)=`}ALzTMB6tuk$Ya)MD%6#h0_HQxnJ!C6(`Rrt+GA=gh+I zIGTi!mMB8wDJlKdwk)A#B^lX7X4w+zjbzgHe4NQ z;~_p043+xO4VIYGms{sOrH&9^cdb^>XbvN1d(-x<%MA7p4uJfHxAI4FYN|z7{LN3# zZa-31rlvUE{=T}TBo2`8J3FanTp^9vV1D+{!)PMqA;szIP>3O!Zwh)|5tks zJ{Ukdj*ms+n?DM$e)^b`swkzb>-QQxQaQVmvPp+J#W1qvI?~=u6&2 z)hnUJXTS>elrlaX^)h~zr&A&fKt@nG2g{h2p8jIYBO%&QUm3Wy!S781%&9wx7C@DP zA%Qvp*eXtd9*i~~FGql#$mY#?YW4XEc7{;gf0;rNO7X1H>TPLtJnOLe$XG?OkAusP znzgCCDGtd$T!0#Zx(crCQ5ft2fQ}%d%1(9K!k35*geqE(7>b&;ba1l0Z(>&hcIBf1XOwSOjTzswZd1vG$2hWVa@sIoSGde zmY*Pb@oCmi^>~W`idIgRNHZe>EAORniU!O%7R1j|WCllre|n?e2Hit5%iz1x;yxZW zjtE4!C>hc2^>FwLfF`q)*gNHOXGE7c;9i(Wdm;vik}ZOt8j$CPMC}|3xLNX|XYCyF zk$DYob4{dLY&oVhx1OQgymZq|gXW)u{+!oN4pKtThkI5GyN~zQ&qrA|9JQW0-d+j> zhxh<(I;463leACBJM{NW17v-ijM|3+;BiH7pC)PcKQY=02|oMxk*+e2SGhEPAgIV= zBVi49_YPO)Xc{S*d^k+MVT@w8oDb@U+_3wy0KG=k+`?e|f^t_k68L~s=S-{TP z6|9f9H=N`6mn4vCmWkNDVLE>IhE95f{pJ;nht;=)xFtgyHKRN{jA96edkT4deZf5? zHhAU1EOGShi}gb@`^}E-W2$FMFX&6KmPijsIEDFc5vr)?QP9B-x=6XrkI<;S_u!>{ z@~@lR8^<7&larH!zNR~eKDVh(|JE4&TF$=1Y)T}Y`FA6ZV_1Ic!`o;ydN4dr@XXp7 zKXyj>R~=2Us5g##$L(08o<&+;@H$#;tzHVzUwa1Po|j6dDJU32d;y)?KGo#_usfmr5rjrH@v?tYX^<9rX@bhxIo*z2 zGMl%N>O6=UOXftsuF9E&-dz1#Ugky}8=n(NQM&y6{PA5@w`$imb`#aSmN(B|x|D!6 zWuVKrnT2U|Y80d;9#&zzGgDF)I5LkeVE3jNAW|ON@fc}oaa3l~j{D+@V2Zl8(!Iv4 z_I6g=2xWe}(BBlWyLR@YpkmO)un?^e`6=O3rq^+P=^J#PX(TT_tdqSFr+#tQ`qi~2 zQXq6B2g(nQhYf_e8g?6sDf@!9+MlEi6U|KaS<{m*C!zYh04r_i_^nmsjC&8|zeI5z zC}+F6Zqw7VE`}Ve8M71Jy?x&iWcMzMyZlrK%~u5K>ymVIuYfY~Jk1$Sc&Jn39{yUE z!1-7dNGNfcScL$iyHP)tfF379^XZ*LLG^?;b9J`8Mfh0>`kZIXRG`S^lKJt88E{b! zB@gxV@-CR)_?tW21IiPtGqh!ceyq<@(8k(n`Mj#kI*j!+p)aq|5@nLwp^?|9)&qn0 z<_<>|+^NTf1+n&LNwuJ$nq6EK;S#(;$w;X_f?1Hj< zP)O#Q^S<8J>GeYz0XM>=&sXPF7P88zx-;0Fy$IXjo@$RvyA7zLok_K79Sdy8DQH!+ zedT-}C8{_U-&H zL!j@HS<3U9I`j&!1bs!I^yIIu-Jm-Cs>!q=(EKZF_^C8;=O(`_IF@Fw0W;|{1$wtM z^r4IE9<@dO?ks0{@_>EsJI@=XkFW&?tl7bE+BYv8A3EC|5U8->hz2FluL6kse6(%FD|O)>p2RW%>Sk zaJ&&&{Pfo4-+JW>JP)N3PhSJ2&O3=E1>&e&J*h7a5?=mqYHAG0R2PJ4Qh0y-um{56 z$|6SWj*#GI&D>L9Q@Tc*#1Uz4xEu7+9`b4EHZABAc>bbA>f*+hkjAC)5>Wc>Ai)@! zJbC~F(SR{ctSA@io%f~i)cgE9k=6!x>*)W44EMs@`iutGheVftecKlaxjWf+3aAca zWxqz99M=Zl_ma|(%9y3pl8>?+SN!;NYNO z*RxKwGwHz-!N9Q5qE;*@DWsz1!*c;;V4@>P^-5KIdvGLZIzcnX&h9gg(0CLGdL|?% zr*i^HrI1k9@74NKr1jI6FOfVJKqJL@A-A|H&Cxp!jKeGu5<^D^J90UJ`^xlBQ3^1^ZyeEtomPgkqqbz8Z*4s@)l(Cz{Z>b)srX_5 z?Ez1}%jy-d%Y2r12e^$ddA@};ymT4|C)ECwG6=GHYGj*OjbgXoT!Zna*G(sB2(c_cxhYuHy5GicHqb7~|eT`B6YV8urlK??Ru? zMT%1~F)^UO*^|U*%aq01wY&d5DR;@+fF_ZC^`3r%2`dX^ew3K7+o0v5C0^xNOFhN4 zdoeCi`w#vwA|2CmKJLoTayMCrkxfg;*~&uGze+U@CDkxRt9DjY_3+KVvHzZD@2dsD z0$y4hGqYcXwSOiDC#QI{10yfbGdhU@36tu_a?&(*-~a9yZ#rY9^Ut8oAr_EC3}T^w zqAaX`M{t$OmR>%Bz$m1iAUH3}bmvbz01?3fpWpMIs`cgAqKVYVlnU=tK!+50eI4-Z zJ9fH1y)b%n(_snf!{fylcs@VC?`F%jYqX&b#^Hai@(oN8N`wQs*5eVMCqtte-p8y? zM^)!{*-6^ARCU5M+P0tVmzztuc-1pV_(i@1VtHs49LG&+*v!T?ZzhNP)Mx$u_Rg@P zmRq!;O&+H@HDlvaq@oDb-xfHL)Z9Xmq_w;-RAQAr$^v0YE{ud{smg~l-x#4)t zXH`9q&GjJX#)AiAQnjG>%rPtvE{+K{*XN*+3pY2}+{G>l{ci-cD(_-Hu!LLTI&Lv} zd|DpAy-@c0zQTdw*nv;~Xajqz=pAAS3-GBGv)`nH@r+hv(n9wXm8vfL~*(c&}+BOEx^EHNGr2n2?t)`TzgOHskt z_rF_`!HDuF^ue38Cm|xaTIXYVs7`ZGEiD;os2TAz;LMY`eXu)%@>@%ogvUB=c;g+C zNbJ!?U0r*dTpnhQs~x4Rvypc!h!lZe#Lq|ZP_?SMIvOz6AK^b2x?E$4no;Bgam_f8 z>j*D)A*vlq`~6Seqd3nqc7>p?`CR;>hR&rJJt0|tiXm^irE2P-^3EQ3e7;jo#f!U^ zJUj6z%-3~C9x0&w-$s$;DYnh@ zWRKwC3|ghFYaO4Vi{b0((|l?)(&PZxunbv;0dk~0(~miYj zd6EoB?1p1f$r+g+^m+RSCQ&m-#Xuo;NWCMoE;#N|pEhBE(3k1cJDFtw36<$VFV@E2 zofTc0S5!E6RqIgbY89|Zs)W~i2c{EXq+)6q2RS)*C$G@yJrFcxC!ls0^-gGcE@mSu zGqaBNg5NrgD_RO^W=V7(k8Jlh23_j1dP~V3^!f*0d}v~@Z+m?0I_>E(sTzosU$p5_ zOmOdR^@UmDjYz92!H4oE9ZE=4c`p8J5=1MTcl|rl#*cU@8njNvV!)&o_9$yh(1nCIhxd+4 z`mG3pp1Xkorkv~Ked%%?)7gO&)%dw|DYw_4RCoUDso$4`2#b55`v8k2~?&hHH!fhj!YL zxzEdp;!859B61&3H=YDAiZFXmRYwUNtp%I;1Ajzmg2n6vl|0F#u~YAOC78&7J>ljn zWSfAYS7|e(`iys07afB4B4kKME~O;6vAP!A15CL>r%4&2t?B>6+FQm&;dWi4DoO|v zf`C$jNOw0gy^W494&im>0gCI_E z#g4VtUc1$Px{D8cZnGald!oj9H-~&V9Zdw#>zQ*DNtZJfglwj7lw+E8BR#tl<)cXS&vBW#rRaGK!^eH_={jC~p?VX>ULyq|4{E zTnrwo@wXE1F!e848(JE_jE=j&Szb%~SDI}U7!j_V?o-_0yd@){Zm6srV)pQeXayQD z0TiBrYQN5l9O}_E}4z~r}zn~EU2vi;%l*A1@70WW8 zJgDWRC^zHa)(}WVnWg0v4Bn|ph*g;= z?-^*ha6XOdD>mN1zFy?LNwyT+X+7~!FVIp17Wd}3;)egWJ%pQty{F4-LSYc17s`r- z0y2H8sx7_iO`K~+(2v(zbc47d87xgqCpA3+S2RXu$}VX=S=+7(Yw#U@cVEvwum1H5 zp$d7myyUa-r{xyYRSr|U5nk6VT+GEuvi+BJ)*fMNowj*-DzOOTKiu4M7l}KyZ{Fi7 z1(7l6?^HsG@E2dC3Ojmh(0a833k5hwNoQ4BghZT|Jqb6sgQY)Zvyzheq&4~&ntvDb z&F_D67qi(@+_FUCBxR&z*8M_56vM~@92_6{8*m8QhKpWO+@u@jC423sH1upaiFUl3 zy+RGguM$$sWNc&Gt-UjfX`>4YPj+M&ci|(3KmU#-r)$2EfvAl`*wxpD>j$)F>&M1q zlCYC^P^J%;L;ef3(YJGM@~QlRI^D{Xe*$*mo{H>KQ9}OY&m3U3FWZHHz9TB#x~tGI zEZ9|f4ZzLj2Wj^p31A9g0)1StYE~YGH!snW+q*2Clh%Q|~EW;>hNIo90LsK*C@ z8)%ELbUI-5yqIMdi=TLztP#)$GX_mzW&_Nu57hm*pUUtW6`a+s*;qQ`AW zpq~>1N98|lXLMh&Z|DLyepSCD$~5C#kZ=XbGQo=_frSOS9^VWP?XLA*Kb*Z-(V$y8 zxKmp0w7+WV_Ql) z_##FWemKNeBXTVxvbTz4SBPQ5VyR9?TBl@p0>w?1hHKWFM-4}lH}UQ)()Q+P^~hrL z6WX;+y|&IpAI_iUgr@IV@qu;2{ z^WhP$mQn=K%PLXQ7MH(DT#c%T~z}miSbebx-FMe z@>xFB)r1wQ-;_EArz?QDYR_HtxnGat>nrvKYR_1(1zcm_ZodrpEifeBu~ z6e&!SdpK;mHF{V+f;2PJ9wnp%nfO%D-xlLWOk~ytvR3`*%WsYvek}Bsu1cU%h#qeu zK!Peai^Kl2n*qe}EPVbu7jm*(M?vh=!)kA?iIzZwCc3uf2equ&N~b(5$C@ zxQ59i`|K?F^jIkJgRYau2Wf-;2A~|Pl;r4M|L)>)YO#x72)(J8b^G@t_l)N9 zcq7J=@DfX0TpaX_l+HA?T)KV*awmmO|27}FI<+D15NCHb4`~?&eFVWio1pDu+TY9WykXbx7`CBxRuLxS?b2b|7Nfh z{2IoM7R0B(pml&dHnl(%kDq0JrOQ=X&;o=G1dmXy=%uYZNoSofJZ_>1w`#OOr6r-q zhKjS{u*|W=0jY=WZ}6K<6mdDl6}Nk_m09+0I^^yENsB{Z`LJQx$hlw*QenAsaK31L zJZxmrhj+@7Z9E?r!qk&j$zWUnq%bro=8vajBQFO$F8}>(``N$nnOONnQK_&bvZW)$ ziPhVc5((d@W*GjPty58r!hStt(qC=XYX0|mRCbH~7AXIQrFdF+|C?P)crwn+Tx_H=u6>t1!cKnT(21>l6 znY9plOJp%}af~qAze zC-vu~i|>*UDvHGZwY%-~_50JKe9rC`E*B-N6i9Q$`X*SWjI43QqG>i=!WE8Vp?smr zMXP)~E+4;8PqX2?gvh;rm+k8ijHy`s3k6VPhgqWa9iV&PnLW|!HnG(uim(3C7lB~w zK^&ZGMZEjp6-2R{%`{ST3VX>4R1?ft5*%nqRAAD@-9`_pG zrCQs3@9J}p`Gi)-3O{e!OMRx2!U_zwF()J6O~a^}Uf1%%ow=;5oTPNbUW zp#NE}bR_I|q=A9Km+t0!KzFNZT#I8I%g^wOIAz17GD{rGq)SEN&ifA*@i!+pUX2>{ z7tfH{L~mM2!?6|iyS`A~(Gzy?Uo@q0f!g@ip|n^`_RBEfz0hZh2?T9IF-Ah-<430x zC;A|dFSlMboNMLlYxopgjNHR<3+E6hdu8ttyd%QfI3KfE%Jt)H&zzQzlgCY2K@7LJ zuqdg`Jqdhp)VHbMdD1k=m7{tRoNZ_6WsMV%dV-w?MH%0UzNdE^M(s4PbwFs~{i{rh z^)`vm(SxL4gud-njtMWxZ16MH=kINTLVr9~W*U5s=L9^a26noE9Sve2Q>OlU$WxnS zP?Z)cw3k*Fs%T1_2ARuE2nS~SXjrEHYEh!Qn^~_M^nw2Mr$ai;+c@gUzDERDtMOZn zGC322FK1``56>>8D9#}1DpkI=Nh?pSb!VHbuP*DR>O7t#wNZH;_h=CF@%QRZo)ZfR zgA-@CJ9NLoYAy47mcQZna-5GuV!W7}{UhE2vln zmr5wu5D0`*O%=mZ*7Jztje#a4T6lPIc}|e7p!&g{;OGD(V_~(Q8q^erwGq>k>b5(~ zSFJCw+lrmEJpTo?fn1kSTbFUd*;$qB&(zM}zu7=X+jk{8CCzS?4wDX3q7Ks)dL$7B z;-$AZwl%v?0%DHYWH*E{14oF1U6E?V2E3^IJWSBc@{R3fH-ULg3fQ?FVXwr<$l+;) z{57kE3?Wy+UjiiKC0>CPwa)kZaDcOiVGTCk`S^!jn?%K8cB~U_rSIe!jOK|u=PKf_ zye9jp&M6}bG~iD1I>s;($6KRg~i+4KH+3Dp4- zRN)G^_l4?^bQCon%yndsQuzdXs%K10R_uX24>Hz{g=DZ{VSL&DV;OIyPmGFEnXZ_- zIWPl}u$M@#4|jbGL(eJ(pVUM?0YWjzHdYTyu@)#l;M_mzIXfT?LyJ4^#hP-_YFGAAEjLmSDfsJKT zqoI+ZXdOsv)d733F7LbijqLvZfXU+c(H8A=j%R#Pt85wlg{?Gp?ZhK^#|E+l8|PWu>&?KXEZp%FIpcq=M3Qw}WR7m3yN9C6Y65npuyO_oR zlWKhXlu$zidNw^4-=<(bIbIJtsD2c8SKWzQg~6rUct3y5%n*_M$*=35d&)}(f;EcI zX3wy&$#V({p0K^4iFR;u9AML1DcgI%cCV{ZbsX-oVWB_S)&>0EN4pKz6wOgLvlran z&s%ZaN!^TDJ^Ft6u2Q__GA!|cA_D~eEs#JcK&NUtef?d=x0;#|+J+Od zZTTTw$3gbxu;e=^3efm;_*7a@dF;f= zE!?vNzuh-X}pkw%EGvmr0sK6#>WPmK!WiC@OdV8ilL)890 zf(ytd0rtbT4i8yqu6@2k<=N0778*8o|M0MkskGpW@6f~JPx$xm(!Naxt+pfidTpSv z=4{r-=za|Aiiprcyr(Qqs_oQ&W4=rV^EB6m3@(iagVd z2i+(w2g1)to)JG2kbCn=(TTU*@-}pFHi{L`?5Nu7M4UnY2?e8mfe!x;G$Sp-hO?9g zG0KJN*ESy~$Edkc%$^77-56^axcfn4*-(!D3hmoYLT*RYGz z>zJEH*6T|sA0Ao@oAZ9IDF`CrF#b=M_qn-;!Khy#b`465AiQqzk#_!Y;sZ*+cdW+i z4mYseA*|G;%lec3^1xRa7S? zqW`tNJ{}MuxFSUMWdI?dqosyoX=sg-h9)OS>N^%WfBUr4bUWB?Nm8^HEei zdvtSka#*x(?COe&_+tqD_jEtIJ>A}md_w1|IWC6-iU(P&9zpT(>O2-x9hX!0GCcAF zEO-!6FQmtQd!lsaQTyWFi#Lvz%~E$@nLW`Qp7dGdyS#Er2jT@BNlciSm|$aC1 z($A@=Na;!8>7N;?cAo{M%6+FyPSXHT=$^mUb&5eOpVe4r+4Qc*#BsGejmlE=7>;WV)AtRBz>V= z$LWsE`VcO#u=>`#xAkqHwhk8M@NQx4KZzei4xDF}82!sOeZa|67at+F5srYu-~P58 zq{$mJQ$IN|VD_tNN7Jli#ggbMgj)()&u@<79oN<-6!2O$pP&S{J&p?WLAoaT2W_|@ zPB^iAW@fC?-R55cmV+Yb7@}2tH19&5rGocao+rdCSu?wg^f8*)OSVtCM571j&3EAC z815OHhT+akvbn1FP`Z}8x>viLAKiE-1EG^=B4GnJbr=E}Ju5Qk@eT<|+4vAnh?%159RqPE7iY~F%Uyf?VO93(G6Zkf0`|xHJ z-Q&JDYYM0kF$iSBMv*KHj48y3>Wf)2P!R!T^m6N(B!bc&P@K6ldXozpSCOggo`#`M!or+SClY(bp_62FTVbnK(;ZU>0LCjR{!&h zLGW+Ai$=A7V#lNZMF}(4?F#laI4ysR#AW;JUjK^NpE?HPvn(w;>cEGkZ&wFrLiH3( ztm|lzJuHBN3n&4I=`MfJsIk-B_nuAQR_ZxNmBDtm-+=sLT>3XyIu>b;q*kt;kZ=_1 zPaL!{LCcm&7V(lo^`!A39V!06jV<$98KcNeWQRcc~;6ahN2rl}BT65ihM1tK^ZeNTN z7sgDAxR0nESq==WRj6_(VEntw-o;vWcgz|QJJn~j^$!GVt*i-!S%SwHq~5r#E}``-Yu0Q#(@wg_5JF8xi^39Kp_u! zFA61Me?Sl+_P^ttuE>+p79{yw9=~EUs&5%|c4@{x_-vMps1W^m%MJZ55p#K1m+}F~ zG4)3*%JSKMO7@U`eLCck0-`s#4qcV|Mv{+(&TLb1It{8~_`!Y?=VraVa6#A_La$|z zl`N}Jpb3QEh)Ha6lEpTU9CmpW@m-(KZWSjW1zxs1VNDPQIKbM6T*_x>yA2FDq-2Yy zy95za6;Ba=Qlyq-m8$>lo6(2>2`QsW(Q23=o2alFa$ zgdI~Y!cLb7XaT<+fTdwz6=`ErW;1ad67Mw`*)0S18-zLKPvvp5|q za;h)Cjl~BcfnJ1Wc9lDYD7uYB2%B%W;TLD7Vp38R@EkE*FpJ?}yxDG5kDsWUd1?3Z zb5IhKVuO1qSxWT>v!A|Qg~%Aj*xbTkC~@4?)$_(;`7UFeNe)o`c#hRc)b-<+A(3v1 zpT!r=Aua4LC1;Oet8LQ@RpLp{(a%n|%wfziY`)d&_l-yOJxL9S7tZc-V)EBtOx^Yj z<8SqF--*?Y5Ff}Ac%nbUi{8jZnZg(qDjhEY9X-(MPIyBL1>px&_lYO*`{eeN2wr^` zQe=gT=V!|#kRr(sKKB&6!W_Sc2d5!_hju9qT0Dm);4pdoZ`;cyiTBpo&7$9wCI zT6SlTJ0)YG5;0h*LIK7}-KGyqxwETwMz~2Sk_~qc0k!0JBy;}&q@^(J7e7G8niiqB z%{?0vG635+=(2^(!ePwY<0I1bt6YSS0^ zgIY7hr0rY^3+w?G*19e3G<^rwsZ`{SiMk!{;zIX>YIxZMGmrot16@&UpD#WYW^bO! z_plfe+W^ir(Q#V)35p?JfSZ+;l!WDzSuaoAmd|aFD8uo^86EY(k=PXg1%hL?=M(8D ztYD!xcx;f~Y=^>kQ#1d^Q`(n!UHvb0i>P0KTIs%|JEnHw2~y+(p@)7{;g<8&#=Wz` z)YJ=npbT{uR&Oxp3iz?Cv$Lg4D@dZB1qE8$M)d@qxHfjq{=>Rq7OU3tb9?N);e93b zMM=fTcb_~&>Y?0XxcfdtsQkhLA;=5o^gj5uX28bzIClP8tw@L>N*(A@&oj8_F4V?7(cm>^3Znct= zezu}VSS6McwBznU%)cgAcdVAil4OKL=dRPtlX?i8=Z|8RFpU9lN@=Jw<#h59q_Qq& zjZd{neg*Lnmb=*g-W=mO6Hl@hD)XvhJTJ8Lm?|yz@fx#_1?Zj1_;PmHuMa5*SR}Iz zT%qpNv+-9zugyhI9oJ~qnEf2r1*-Jw$AT;+hpNRDJ*x1Ym_8g1;RNUhBh*Qb@iHhk zunS;fU$PE003CbcT+D9FMvk~()iqHl@OEeLuTQg8>5xoGeQ9AQYn`@q6bY=b9^5d^ z)D-Qxrpb}$!eCaXl!lBrp(2e1+1{3V74DX}Ul(?x?gnWIdIx8kRr>+aa+yeYn^kMI zb!+l`d%h00zIlv}{QOG?`?pAla%c?^qHT?;bpy ztq~Ew#&~y#w5TO`WzG z2~%5(5O8*AAkV(DXVAabq4`zwOy=cxfH-jSr_}LLqgWum<$V8Ays>vahh8x|)M8lZ zi$qH$Pci_Qu*x_sUI~UbkeX`G>qX7G1zCRp6P@gE4-B-CmE61hEMNYa!nd~chD!`R z9IDJzB}uwrd63VHvThzd1iuVyIcUKf==EycmsYcC-Dr$Cs{R>4NI#c&+qo6CM86?(};Nw&t_plP?Os- zh)T4)*VX3?()4w#Qvh52RrUByD^)4)aAaZdfToTVkH(M8@?elG*SfAUMFsZ64_glX zSWMUzs@oILR6A&c>kiOiX)2Ev7ak4UzZkjQUtW{xytDNxybbjpjlM9=ijVcK;7F() z-2Q(-a#1=7Y&&iwAK;#TKpD1FzWI6MNnI8mF=f253R4_ioLn4{q2?MzC?EEj_!pI2 zdE)!Tlw;v)TCc1gylzLzw7+0lkp-965Qct`B!n6AfE3<-at~5eocNwaKRZiAfmnUz zIQ^!BNVi%W>T3{aso_2R6N(=pb!+%i-m(c-yx}s$4-v>;x0uWF$Vuv4(wv+GC3i&dB?z)VHLg#jn3Ej2Z`;`AeE?eg9Lu)uvxAz2 z*-c1`8-jx|(^ietZS7nKWb7J-A3sG63x{Ea_5K-$pr8Vj71tlY%+Y)30948S#V;B& zZX%LWH1y0@?m`EYW7LG2fd`|n5ply#T{%sn2awuWxeNz6;!|_kR_e2KlN*?_cFG^bsJJJGN8~@VB9=aa*t1w1Srg_X8}gizvT%c? zXC{o>P}rq3zBq%Zs6JyYVBW z0d7k)%clTP#Sj69ieYvk5$W+Gm-(Z21PB(jpf30Ms67{|x68{EAp*cjKTQIOAvHR0Vh57Edd2!um*5c6j)aeFUCL|vEph~pk$jGl0Fvd3g) zQTAjH7i^A;wt_;)d4fRJ2|$&@6?F4A%vN@DZB>Hk3XvtomV)8N>V#K1dF+p2AcUIV za{+NAxJbb1n@ca4ST;l0+{-|g8DsoT7_h{}{}b6Un%ZI>})_J(PcHGPwB~bX4VH zy|WLofDD7`Q?Bf5aC-4ga}xUq8SE2vGgLYJEt4wK^|km|)@xmKgN=h(;)O6- zv(}J{;p&xI=Wa$Z#=@AOF7gjv@n~pc$N8{P6S~;n1-&)&u@I{8x+$4d)_BGjQdHPg z?m^KTcwv0tP=iI++z)(hDc{nltIfpr42IzysZwPp3<3m4k7B>Bz@R)y0t5$rT-|cv z?7>u))(}xImK}(YF$3F3!IN|*Xz?PH=&C?8yk?YzB9Ov5uc!2#;(n}d#+XW=9$l5B z1?C`^W_N;(ZiZ&Qov^TI|551goW>mluK~VI%al#lx2g;;>Lltsl_? zB>P)j#T-DEQmUlD8`lsYC?ul4PwQMO8MlIlzDm?703>X>d-hM3m$F_*P>AXC_6Zc_eu7^r1qA z^;9}SsY9XGWB+HcJ5Mq$-RQ7j3hhos{fGG703*XB6I@Nh2<#_XiKTiUk(ic}8{KfYKBi=9ZZr0HctK}dH^JOvqSMzED z7FFc0+?Gieu}u(CA(NHw2ZG4@6CnKqiONjAiK5vgOy<-O!rP~V*RcI0^P8y^i?~3h z^y5Rjp;jkZ?&`P{3DXGa%xCtAIWNNTLkGf?1l~UOp2#AQH=;Z^t+60 zvD^^`SgJftUf5Y;-DwwpfPMJ$ND8UHUmLu^LC_EW1xsrIdwI%7VJ&R;GyH4FGkWok z^I)IjM;~q-{vZ^`q2oxBKR-1SusfuaiMAOJUcN&r=o;GF`_`^1=mpUNb*3tlLgIWX zHHP&eX_HF?DroMnI$a3KR+YB4rWg_MZj3}2gPbPEqgz#t;RzVPShd=W`FYKYIk{(e zYMwK9&0)n(eIGI`OkwVSX74eyk-EV@Vdo*wMX`|{!QFD1uk$heO<_dP3bcpK%afHS zB?9RxGJ*vjK{E=M1YfBC`f{k=AQG$cmS5w#{>MxMXBoA7WS@6T#ViBqW^C07?UJ$AMYVR|I}WC1$Hr zKnO82($v6|_KqznG&EC_ft`aRnBD&Y8JT8^5{m|%Mwg^AP|O0u&|-UgA1v8bwO^y6 zqOsFF$GZ2>PbltV9AKbvhue;1mVQ%Zz$ccV!3QsJ?-fu7S0>=#5CGWVxB9X9BzNYO zi8IYX)oyro)(YqJ_7KGjV%(?)|VN@%|o5?RyMxAY`*- zHFZ?2-@lJ^XHhga$Mo^>@illOCubneTU-`jKC*|s!iEJK;SdrMmv$2b97H}YNienW zna0`&>l{elTwP99)+?TbER_PK0`;fFq~9X@230!1@E2J_<~BpT&z0I)sw~PZ2{H?S zh|v^uOxYVbQaz$T zx(J!b%3s&*`iz0{jZJ7#BQN$IKCytHATcqqBuSVfwk4LIIQeH74ECDW@qpA6iZvpT zOslWDm}o%*))>$KuE*6CT^j0~G6CLe%HYy>0$ARMr?t}b!^8nmosx6HuT$Eqel|SO zen^+~W+9R9?Z=Zr)jYL_XF|#ZciGlApQaH}&ID&)9f*&t68v>xQsK2HVZ6voe$R(7 zg_SZ2zCWE%* z%7FvP@&p{skCIL1(x*8U4ZZfRx>^! z1%Y_?`zSP=FwvO5ep~TC``#P_yJ*xdBqOp(OWJ~xEBrZ|=~&a|_%QxK&Met-6A?o! zBe^kww%GeuN&I?0$$rxG5AU3cHqh-Y=X6cEsI^jfef2YE4NKgj4ZAfr2zh3UG|MxY zyA}uCOAjywXxt0Gf4}mDn{qxaPU>!*EKYjeh=t4DBiM@^R1(k-jF-1`kg9@EVxgoS zgyB&zGe6L#OD)|7iAp~^tX`aQmUtGpjwqFnuJgqXOqhT9l3x57!F+pFs1vy(U51{8 zFi>*OOfonrMrNcl?$_Xi_H(YXeWAkY+s5ZsyHNakr@)4sd_r#?>1KF+*~08@Xr4X} zu~P(_)LLr9foGeVt*J~boA|QTPw8Al&W7>)5#fEc6?eMdN-Xg|j8{y}<#3WH_QNg7 z6;aeiXRpXUaI+=9c2oGvo9z)U*1@#}ttFNPb~2Oss1j8w^9kJT-J)ha-p3k7hu8AW z-hcKO&1-j#n2f*8y0)az!hxl)XKCf#?o3Q8yR2Dp6={__I41!-{?y?)qVH60Uw4u7 zpQF4$`oXuW^AbC5qc&hnJJmj?lTr90LhW>ux1G2k`|kEx*M~sn%K$I(#jH`r?)I3D zk`b6i!ApQET%R-NYui5|!xSLNAVHKO2=Ck>o0pLkQza)g>N79e-49375yDrDL<+z$ z+EdR`J*WBGXd%U)F$wlAI-Y0u@Jkso&(jkg9L#+GeOW<4z&~W(m$FA>O~ckNxNthS z6Sg;eAzqq3Q5o^h%9_wz@MQ`$r1+Af++(f<_?-Pen0>phqjwi7WpRBWc54p{t3Tn7 zT2)6;xL>4@3jI!a9=X>CEK#fK5J`OBjaU0$Yf3ruaecaLq-Rr0#v`+K&vBtio{)7(hRMM3^{@lKVzhqV$PsrLh9`j;Y8u=iWhZ zohD+8 z1aNw4uZC`5oXh&#dg8`^9oN<>#;Hc_pyfn`Li!hpzGoAhHTckzI*QHi_mP(%^)8+0j>>}hx`JDo&_UVm80xy+SQTd^o0v@(+-(OYBMy>H83;+c@QJ>dIdiYJH=D)K zN*!(Z;4>qvK(N`7QkMVR578arUj9`3ui5ElW(7~5JzKEPxDb+%0D~e~zSh*FOj^~1 z32s-Cy&>xTW!=C(RuItKL)NQpUOKW^CSTp-7IBi^=dpb-EE6+9AIyBYGD7NQ`90;##{Z z^LLeSSokw-7UzkLRDP}CR$jspoUtXdN+F}!pO<9z>rW~wqE~xF*Mn?CJKgg#>NQ&N zN&0hi8uz<#D)+@2OB6-Az)%XiVSfdovoXb-p)yEA;E28lSwaCM>`(BQYfnArZ5dgG zd50^i!`^{EGfjEJ=Hpe1E`?RwsMXk;#$Ow73XbS&THk)UaM<2Rg)ZlDLy9*!z+0KB zGCaAn?{|;a!i5O!xUQ?|%8g`x-=Un@7k6Px&hzEpr?&SAk~BP5I_3yQce-ov2~2F#z0VdtUP4P2=e8X8i(MOp7r`UREde#Qy|9nNPr_(=fR;>k z&FuTO;AJLAB`y@}>gsB9vLfT99ASyYI7fb&Dns1sU7_X0Uu00>A~{Zec+-q;p=U_C zVfwak=`uk^U726QnO4-zQHwImDp#$WTI-wf%s9gXW6Dw12xoV%II;jJk3ONDbEBP6 zMn-y9wLPch z^gJ~CP~bA^wmmnjp|{ZAbQPvS02*1|vQ!&AMLVfecjHK%{u+HP@kD<>AvtKm_Y+o&ArmWz)Zi*9c)Lc{j`&M#`2(0lT@xNvr7MdY_Oi>fts zJ&$E6tNJ7CaB>%)>w3LA&1}>%(G!Mm));}$@P3}!|HLxJ_j&NgB6q&nKbk3DW5vxC zqN(wjsw#+TxL|5W{s?o-^ z_P(Q2GtG~tAXZ|3obRC5XKG7YVmZlESh?`<{iR<}6 zJ|pOPKA7=mbQIpc!Lxg{a}yar?n;a#RTMe9|4Y4Kp(E;r`E$B(&s@KCSuw-;W5=gf)l}aW-p|@12Hk$e zLi=dTSI$~Tge0Wk6w~9fH;IeAzlv*-U065!hDqhMD>pM0pM|CIJ&oUm>(53bPXiZE ztQpxLdz+i#1Mjxd)s=$gugo8rvxeJPE!YpxTZ-paZDZ29*Q*U3HZNLex@hPC z+xo$Btig%*%>4_sjApsvOA;O{8mt%LwR-}J!q@0C{L$2?&t(iD(Z6lxsdy~wgUXMw zU%&QuSs2K8ALFZ#QgQFMbEjXdtQ7gpSpY9&D)8B8Yk=z-(+Q)wAr(RgUjan{xaNiaZ zSGYo-T!b_e`JbGqyIeT!0#Ws!bm;c1UcJ79&%dHhuhwuVcQefYBfZ zge(w1rZD5O6+r$}&68Aa?ctr3%vGgI>DfOj^6~-04DuDmYR_J8pUtuEt*2iJUG7%! zdDccqQ+UMAUT=B9_koHXTkI!puf33)j(Fyj@lrESHDAH6hEooJiA!+nO&~0eS8}c)1p5!FVwQRz-dYf_ea5q>=y;5S&!4Z)z#Qa zED6sRIo?*J|2PQ`VbyxQ1N(k>L{1yb5!M$LidFJnjJ9INmZ(o?k1ha*Z0=aUI)Nk= zI-5Qnljmnq*f>9mv){g`J9Rl@38^r{>=Qm9-YBdOM`n1YQh4rA&YTraI*%4O{kDhO z=j+)&!ST3~Bha2?6PWW3i3fdvZl`NF^*tROxD~T5tf0#Y1Q}z*Ynf&9bJxPauNrnf zAbR{-%bV@Tg$>aiOd@834d$Iir0BU97S^HN1?x1Tql1l^xgcN9jeGWN1qI9yu&P^R z`Lr|DX=YZ|=OeRGd!7{I56+3=nT-o=A@uQ3AY=gy zPlz58>zi;#Ebg< z6fz+%I+Mly$heS4v*XGp(^7Y>vG~)c^q2cTFSm>uk5_XnWD<3inh;<t=SptjbK2S z3Q%5&RcW;q@{5Jc*9sbN!yPIsmKTf}iOEUdBg0Mi$kRRcm956?ICarZ(rv_?cd87J z1X${g__fWxS)eM#27lk2ED6bMx_c|JzJ1v*9r#NPkQ^#3FL0-)b%kyY7a=ufn114z zzee-XvI05q5`cKGE^EWsSlCGLpD{Y!7KwZgV)&Up2CRwuMKi(Wi$g$Q*nwrvv5Hc@qrwGx^m3TgTKZ+1;@(WjX>-Wf$pnk)yXX0_%>r;KB37t{gL8AUTh6z#m7_uw ziwSppB3*a-fSTj)Wt1^Je`f0Mq-c6S&+n0a8~BYbEon1(q87YQ)!NDl>|&Y7Ww~w3 zqHdX|c-*3n7&DRJu^ATvMRsM(ZF?D9m zijlW&r>B!zS5kgesf&O^_&4sj_h~LwO40F2P4dNdO$4jg8RD`tN!>XkwZ!9A<1YBWb~Ol|JE<-Lj%-ML9Xl88?x= zpooKk2+vqnk2Sg5K!6%%G2{MX#~Drth~((mC0%4?Lj8#tPqR*b|9B#BVB>JVn*gpD zyWrs4K6|Y#Sob~rICY`(iv2`X_uESq_w(roJbKTHZM8ZWg)zG5>T61xbFAohhrTcb zod5CvbF;U|etn94F|RNF<1VQ`4Usw&}V2 zvT(LGZmUm33{qeiI==>|kU{w)^X1n`x;zi!{1J(Z*+ogKtvqh6OOUpCIK_s+1*f77 za++d3E+IWflN8!hZBD$pvka5=Y~?1gUYg$V5Va=tOe2|f0oL{?oSD~twNX!dVxnp<`{dRZ1M@jhWy6kkT;DZu zM50-0gfSgZty$&DT=S`(EmIGQrA-n}A=v!Ni*@*;-Zh0@#EAd#o z_NX&N@2^7;c=jsSVL)UjdlX|c6>R5Tr{c8^DjHg@Dgz+N0ivi)?_RFr6%S~u2xHSS z?+Fk&6pK|+Wnh!fmn&VC#P8>b~dNefP=j7Vx;HOcy_d2|U6czv27`V{JtWAJ-* zY!;Zr>vdYFJ93%h?9HC(EXhmT^u|}SiHp--10jyMLytEbJbrXke2Uc?Fk4-(IK<-5 zj!6(ilbd|P2qx8(b_`Jne9@|QSj*_%h2>-cXWo#&y-{Q^|Lr9(q>O1-nTkS_M})^t zbxtH(WMr3{(z9)XyjgPqmOh#H0d5y6hNQAP6AGw4KA0Me0L@jaA`X!c(lFOF`#ZN2 zoOUO+)9wI6(Ld^z3WMQ=QwTR_qPVR=DieF9nsROLZAI!7D6UEajQ?LY3`M%@N|)V(*rrJ(j{@!b5{^YhW#Q7xW_R3(4!7c zO!hQ;=M)dyiR>$c0Z-%C;R*Toh8@1?A}1J#2AS&T#8J`C`6uiXKbDDmS+llC_}ub! z+4^VYc3>|)WUX#OB>PB;>~|aW&M#d1K8SSb=#s)MCd)6=RTRcm*fm}d<$gWS?GcDj| zjq#9NGd2b#O#^#=8QrTdfXJFse$(+O{VMO`2JwO z_ua7U(*hwNXC?l7GqvUAlX42u#Vao&P9>v>`R%F&p{0Ayrxo{R%BmlbnY^92FZ9HI z0)}PwK|nx2eDq75#aLxh7;kM1pz1;j9!ud_T9QHP=3Q??FKwO4(_^0#`_dc|PB4^7 zMDInKgau7~@Ia+*#H>1rkc#5+M#V6NK8{NO>c!L54a?dI_G{VBp<_q!Fa>UT=i#iX z@|cldv=+$LWW{<#_NZG3bS9Wu^Y4;aDq}ByUfjd%+!p70`(8W^IWW5UHPYb#riIi> zRpgtZIFL_Bwj15Ail?^O;Z9eaAuwp(46TVX2sdRKeF|L_^o%X?T0Y3vE=gw`)oTIv z*F3GMf7UJ4G{ZG?^iy48uYpK}fK|+ou5=CkBwV_`@z-1Lwf9K_N5|*+D|4wb2z7$B z3uZpa_n)yL#87naIbWrx9|zGLT63%m_ghApE?l3?pW&OOs~XNXf9l(r{f5!98Y*tg zC)dRB;{|zsS?%S*!RAEOcb-B@vKI!H-erVPZ+yZ-!IRj~_<#H)K++bdV^xTuKm!}x zEoJ(I4kP;m9*DZEGRqU&k!ZvUNz?w)1znaB%~EmO)9Z~isp}qIA&DnaHtE>-zp?Ey zk$p2eS`~-gCXAzL!x9SmP3Uk_JV70uvA6j5t<%(9{=(}1goR*F#FHpJNPnEJy4bk#3;kUR7go4tiWB_j-J6^OaF|8cbJq&Dj#Og zo7;aaY+-6BW^b9DiuqmJf(KutazQ2^;L_TNg)A0rzdb#TM<+AJXt7cEHcr}m{%Tr^G+w!<|BBM)uG-gBM3j_LoyOGO2_oLmbUGxlCTT6Tlp(Z8DQZZF+De5QLgQJAkZNm7 zhz=ENMa1${Gdi^9W!{^b-|yYO?;rP``vA^? z`$8(bR+tg9uma?hwN7Vq7d4k_@95c%%r3uKLdxcHLrJrw4SD-gwCAO z;QmYf=$SV1dnN<&O-R z0jt!^lwKr5G_4X*_zB}vJ-+~dd~Qp|1M)8lr)(bWm^q5JlN>t_oP&kK0+6Zt&m^LD z=o4hp_cp%4*g!lD*;u>ZwZDZs(l|5?8UW`o6FbB8Xe^(06xe`G#33U=%`O6E@-M1Pqa~ich*ehqWsc`Cky<-fd=XN;D4C7`6qS7OmdVpG8X@i*NakQQXAj+k*MDp1 zHKFz)Z~xh46%tV|fbsO1YT9+gZ&V`IE zhpS{s>{xQ!DJ4p$hwNBIXXTB)&&#TmlFKqKgkvng^z=W+G5Li zwVtZI6N7D7`oFvOiwLtr)6x9J`fna@0p?m{$l-Cs`u*27d&+hBUn?kewPqVN(KyM! zUtuF=tG9*g_jr|RE7g1B-HKwgn?L~+sx1Vq*w_LNEF}kWmuOGbwdaPEtG%8`$2Am3j}I_+!JRxGq$Q{- z+*_a|aTk4)#}pdXhtFm~Seap2jZgTh<0{SI+Z1n_Wx!c7W7Y5S4I$;)#d33%pzk)k=E^TBF<@uQh7Ea z)Xc6=zL!syZAO~sBVq(Sm3v}^EN?TP*$6E)?Z5!_e1clqm=;$K!F8NMl0ofb1{D6y zkA9rJ)P^wh$5wC*oiutIesiPKHFaYOE{9zNFRw_9x8Tlaa?bcw zUxH8WsNbz{PFSX!^XNq^mYYI2Ph$&!dxXlq%e^n+o-XM?AEejtQX!#GOxW4Sucuq= zZ0m_%voo;@!LT}wGn3@rNxOOvuPX`vYymL!?HCVasAV>35FST z+0Lj1j{Do?HLt_s2?uP2<^n5kT4J94&k&EmbDAt!V80TXm%%jb(f8KkO-R}U1yY@K8xM)uHi&dw;D9uQYy4X2QZbGj zlJHJ?2ZJxLqpuD2nfn)DU}xFy`@ShIJiZ+IRwukuC`hvt`?Gc#H|fLo3m zM4A)mR!}+cZIBUfes!jQs1Y2W~{^1wLl#<&h)M z9QK`oL~hRdmbA?5T9nw9qdHR6v2QXAt5OTre8@17Tk>uDi&iu69;H+TkXr*}*9l9_ z=?>yNm)Z0hhH&PV(|x}ybD+df7#F<2RguhCjmT!25K>{9$k$B!`8}|Iu&u(=^i4xP z<|EwsbgU!|yxSWnygwcSrhJ@dv|BH`{SrW*ke{aBI%ksj2E4Ot#6CN}y}Lv%xpgWH zdb~2JK)<{7Gc+m3m%ge4a=o;5);ie!9wA`YnwjUBjil!rmH1?lF3HuLB8ixt@{Hb@ zt{+e#@G3vIdrRZ0R#vG!+hC}e;eEuF8eJ~=HfXKGGzXo}$&Ri4yR*|Pn?H{0w{d2r SdfoAdBn|H3exboBDCIw>83Gaj literal 322504 zcmagG1ym(JmoJLDyL;o(I5h4DcXx-z{owBI&{*TrxI2v=TpM?HcYpo8d%u}^_s#uJ zt(BEjR(6s~YTK`NDpE;73K@X_0SpWbSsEa&0tN=11_lNR4F~hL=1{J1`fmpAq9P>< zRy|2{{PzZEt|e_DFAqllw+sgc1x^44{jVl}lOQ-+BlzuyAWIsQ=wY z;cx!0Ywd6P7tR05A%BAZ@790oenR}aHFVlf$bXk1|1}C&M#}o--wfUnpzQ(%Mn3w-1XAI#)>TPykHJ@4JpZZ=ZC<_&9W3RwaT2QCU{O_gB4 zU3B4><@0I5J(9ME`bx7L5@HJnzm5l4-TKJ9`dy>W>$3gaf1^!sHZ>vEe2fZ(oh;9L zWt?v+#buIxs?(I7nfbw3?Fz{MHB$}_898*&1m8{L@;lUrJ9>iG>gwvRk4g=Oaf{o{ z>be!S*Z@gk%Ae@da8^(p5Cq`==k0H|sNZ~A+%=1cc~h{ZbLGH^$b^O`!iY#mGf-c~Z^yOT1W*K(qqiQw0R&J`P&A6_S(Th8 zFz4a_`$_!g6gQ;cV#w0IY>JLbqoqT9vx2JDgfep!KdD#Ft6B81>frou9^pT!IUxL_ z|3x1fGKVnLGiWl)6^je5pAL%7=r;Jr2iVdfBjZnv078CNOMFX@QngL!nK7<3Ev#u< z>UO(>kCYoWC+2`yloy%|LL2H^849 z0f|-UF`GjRJk>1(fjwLhml`ztKF-cJ2@VH6&0XJo|9R+BT=4B5*$OmlY;0&47(sDy zD6SqJ3=ofR&$m|g_I^_ft(dIE2_R95)$@mZ&IdMj_EZ5)8T)v$w9Qx_@0J22H7^;x z-N>oa``;1=8~e_^`|j~F-?b#pw|OtWrVE_3M=sxcu6@TcPG|;7p&c5ma1XmMw+dXU zxxM;)+|rZUPqoHe*9REa|Ar!6+wFX;$22im8@PqRuJQ*}Uw2MImslpZqGHKO{X(_=Z(rVjuk>3gIvVH2;0FZnxQ%(q zm64N^6C46U-|<{2`C9T-Zl7kP*V5KVwfalowTxd!d%KdVYGH(Zcz=F#PEL-Mt!<~t z;2ocyF%waH@iVeHWpQc>wpf);1*`etCV#Z?)Vx5@ zdUVtc0T6g84poR0L_|I;E8ExBQ2g`gUH_bIHtn@4PHFFO@3%2~Ki`sc`G+-9YgGkO z%&DY9s1<4?VDJvV&8kc=d~(vgvAKzomy+h$`YtYjvFCWdctFeH^$a6$?eYTiiHpGrM(sI~-N2WSl}bJL&x(-C3T-l;2# zN&?XcI&bNCCnjRbj8UfX=^?fBNwBtAgVc`L4UagCc@3E5v!-#2Qqex3c)XLWX{Lhm!*CV@%{6HS?vg5o7AAZ zMfc|3K*j2%s1B`^cqPi-z6Cj8+^Bn9##ewRBoyse0bKek^7tFI_m&(0)Sk+)Wn(X@ zw#~oR;12K8X?TXwiJjXx^;;!n!#>UC`}^u91ANe`sqSd@L#n+9~?cHA8+%I%+uL}hE{#DCw-%A`bI3|m%Rg; zB)_=Pp``3QIuhD$McUqLQrL_zoW){h;^M-=#>O6%4{tqb#p1SH^R7EjRh^Ad#^8c8 zduAfTKT!b(@z6xVevpjewd>pyeJKO0bP zm50~jcSD$kF>#EG@t5%JaBea3pfbXcHu45Q$oblpeRrYc7JxrTwsb71hn~C=-#aYs zmz-^WIkW!L?hZPm616PALK1kHEZ9qkh zRu!2H;L$kVfb?KuoK5qI8<@&u?4}d_s-LDt@59h1%PHhJ=Vn#VBKr_P+ z2!GkG?jJDj#m&dB|DEyhZ~6OIO%nwQZyb)AWn$k~Ns5}5Qn~*17RI2K7RYxs<;SE}&M#OyxvRM3 zRMfevskJv+z#Bb&0H>>!7J+?_FQ={AyAF}Dmd7hoL@kWz2r;UWv@-w7igyAUA*zQr zVL|=D?qurV(WSK%siyatl|v{e2hQV~Ct@}ZjmCy2%S}*VoFJxs&totky54vpwq^SQ zT4G>f?AC*vl00M7JQxZmcMU?f7BX~s`N}mroJ9~5Rlt?SL{8v{0^I*_-GkDv78WuM zu;zQ21Bd9Gj8>|65NOcK!=uD+#}>r6W8a6WujNV<#2Y|%V!fN5m=fbI%`en)O4NjEcoOV+C=dcdyx&V@EQ$Z>-dx7_4 zVRId(Nbk;?h}w*>-81^xY8PtU+H;0n@lCEksWQI2((TJfnKDKQy zQ^IfU-ZPHX1p4qJu9vISbS|7fq*nU_&P%NOc5(XVZ{Zg?SG81= z%UrRDA003XngY4Y{%{8EYr`2Yc+T2%y5Bm`{>+C|lUN1}PPiZPaXPZhh1nX zHf}>zRbOc{ijzT~FT4=7URL&H=~uVT?WoB8=r3kyW4L_&b-Or8>9P0oXhJkx?MZMs zDDBa;k%i`3ec5X5qc@(o5Rm}(OgELdOQX52+z-UizT(GWbs6x?fkkH}j)nCOoMH$5 z&|tgc44+F3t&mCAIaId&*@7XvzasZLa{g;1z?Q|~OV;4M@w{*JXTbTQn3CT)<;_%80!Rv_c&69$))=T|FT! zDxvXkif!$LpsY-6S>X45`XH)$mWabIpZTuHCUvv1;te{}QwR8aJKl+K%`>2{m$&Wu zdRNoIN)@R>Pl4*d`$Hj7)!Fa-?QAKjgEBosNeW;Zjr|t+L0OS*PJzFTO#ZMOU;O|d zvizcZLFq)S#VZ$6*wcoSW#9vj+!#tn8TS}HyCSx^s5gu1{)<=xI~>~`;|5YDlJVjT zl|Sz2h`0-&`x zjSGow*nIcf?$f?KWLy7Om*s$4A$;%5Dy89+ZS%G z!nz71%hS^Bja7TGc_X18ia7i#CwQHccvM5JS1-4GXj$qJgoozaw$_wM zh%QcVS2%YGG0h1ooNYg9{oZw3U6#)shjK*o7@*3xnQfPEaq1m(Bj-27#mx_PhO1kq zSBP(`#fwA59hQ4{Gu%D}TJ8415|jeIcHj%F+tFUuZ!PFLNJg_j0?udy)FpO*o zqw19TOlCEKsV0}qrn}<%_^w+O+C(2CrWZV_B~vu4o>Vw?Rv8M@w%ebNI?f1FdTroPCId__Vng;R~#7grYQ9E5OjyrX?b}yb)QXYz}nlwFMV1o?rt; z+!Y)V5j7y}zz4G>{N036?_FPQ#cM{)a3I)KJ2CqQ44*#hpBZRT2M3|EL?=N0DUuSt zo~kOMLDZHJ&Cbq_bVbsB=~%?={e+&dqT1ZYRz5>08OF?rbYjsD-=lnoy`cklD5)Vz zI%=ZeuBx&shwUApaRe4F8Zq(J46(RbMl9kVH&#PsytAU%G$ZjaotcGMg+X_y0*V~C zxM2`6_s}+O&l9EI0vr|1fO7s?lwUf${=k4p3rTe@${lk1He9T@j~>>GPWu*DM+CHf zXvh^FF08FX;lPH46s{DlUL#xNGfMN*G+@O0@u$@G-pQo|>AQS*^7Q?^a@W}APEh~& zD@8Vn>+E4u_&!~z1w4Xe8D)g$aZ#RGS_c!}$jFEq6Keh2q-veqnpU-jB8!*xuYLt{ z4tPIZv>6hjpD#LpX8s5^*cNZZpr}}iii$>f6OE1@o&G3lCQ9~7OH2%OIh>63%p0I| z)AkvPNHP2HlYCdBga8JK9>r+J6?^r-ogBt~q^{9jPRf9v5+ zMfBG1q+>x@37~WYm^Pnso4d9|xF;WGj_eu|m1h`wcPWGNM`{G{*lTg}^4)*#?#Wxq zNHk)<$0On6+cRd~yeX5<<6@m;X~q8_EdB*;B0+5&(=PE8{tp`DKlBS8WS|Gy*oxgC z9__K%A~D1cjrOZd_eGREVdX!L=9okFwGTUtv6jXkC4BcAt6^3-IvyeTbvh9dQOw7O zUlUp0*{Mi!UEQqI{{&U;N*G0G;mpc^^!4>&k<;|JO~dKczyaQoQBgGyI@T}pp{bjq zp1qiq?OOhEkAH7sKrBp8PoqC%OdOD7*bl&W6{5FJq9wEw;p3O9JuPM)uju^`9Q1pW z17cwYL7__RBa4~EZVj7^45|U;KUVAi3LX!Tf89ec-6{CP+Jy^u1Rn4RVV)EA53>!7 zlrU->b}=zsth0vN;Dh3*d)qJ;Ag7D$*$NBnF#Hd#55md-(@ZK#LKXO8wvVnj=a^InU%7vP z%6@MWLcmO65)oB;=Jq7_VT)=H?{#+a%jF3Yx3#rJL_`St`wLb4`sH-BC6dkWiP6>7 zg%F4O z^-O_8cVyHOnP3fe-8T}x*r8_wY$YJDl}+($LLw|AVmzqO&+r@&vM08asvLK{C++xk z?|}`0`ju_H?|V~4&$UrS&HO*C_)qi}V*QSKr)b-0r4A=+cVoLqbEhbGNOfA0FJHC%t1sl@rZUes*^1si)cK z3nv{wqVfj}M&nX)acRUVWb=8TD3tzni|-N$Vwc)n4!sSui{wJ44eHGzU!o%;m659| zE0MCe>{M>N6OZC?^JZdqyO>RLHj2@&>IzdXPD~*Aok^&VTbYTc_VezYt_D12?wEyg zAD2_lxQnufRzE(fmD}N{H8&687Kl=Fm9F+Aq$S&H7-xS?&7~H5cdffsIkhibD`IUd zM(1Fr8WP9v!PDmfXyl88tkh2pP@iWG{6Q4@ks{hLYpV?=9)J^R1NpNgugvWg0u zed6AeYPihqHHZ|nHUjh;;M)!ULOz zmIsjF@P2V&|8|q!GqBRsGR-6z_l^0`d`7ZPJtS{R;4xcgSUIN?h)HSn23pI1V_EtH*@;KdO^?VEi(zStjW!NHxI)P;dlfJRL-p#ADC?o5G6>H)}()o z@;I31Y|D3sE8Lr7sSi?w^Ye%01NUJfHQ`+0EgE>XxD8vq-U#dZZQ+CZ?FYd~se)Df zA!kYbW77S@|JW3Ey-J3*;y4!P5~e(6fdyx%a{i9uVz*Qyz>=Yf>U-c$~UkYi_6 z6d9i*yLD9;nU^h>B_czL0L;3}LX#9CL+NpC3t^)K!J4Lh09)g`fhy^JBenzv?hK%>{4B@O836@3ikidmsM>H{3(6BhHmZaBhV;|8BOnSzh;G8*bpov!Mmp1Dq z{)GhwU)s~+6A5kZ;!otGTu{6DxM{j-v*`xUWN=d4r>97?x~@qMimjFD07zGIk8WDy zm|GXTbte!pkM~0*hVCf$brVWbiH~X2jgAij;%91NVtx{K z-R^dO`1R}Nr(a*hTJ*k@ZNejq6MLP*W;eP0WUE1IAFBUTzsx-2qP%zlP+aZhdCFff zK<%JqV+(9Dhc`Iwz@qbREiXY>Xe>9EnabRZBD*K{aX``cM3u*B2TCDN(0APnyH;uW zb^RCk99e4U@3kI(Ap@W5!5(p(BGYc+ zIDGj(RHOrMXjwnG#+;$pZlckQiG}&*G&g}7drVk1}zB|CL{B(S?eM@@vX_U z=zX>Y!D!~ZbDGAdyp<~}7NGUX)l{ZO= zqA%ahG$T&F#fs5PA!C+mX7I+_pgBRiTxA))TKQ3ws)f*WZ~X97paSrnTg3q%>;?+j#Mhtn35ET=o%`#s(+p8KyB1k78B!!a6qV^&#>^5P z4JotRG;@BFZ*+iRHkjdf(b;225{NBr#IRg&-KhmFcTl9ItTP{wVCCO6HkJ!D zX2iYn%?m9zBi8zP#H!jMB>aA$RyQ~EIytJ&M1+}MF}0UzE>{xI)ss(DB{QfmLY2TP zvdvXhh1i$snG$1;)rQ*eKxJoUaV97ie5!SH_l6PAGZpCsN{ZTOs1kp8LN2(b2aXQZ1Wl)|`@^MV{>W=>qx9QIWVCJpC$99GFSBY`y&z_A@Ykr$hL zd{|fldKdI`x^Tqv{+itj&fr`+DXJ2I7;7hxK45gl6Bh3kA*OPG#F(8M(@;7^PF{-V zDUHIx(G+j?HQb@?s3!lA)rlKc%Jkrj;;x0`y3ModG#sr_SWX4z_0YPqK^qVmFRtm$ z@WNaBZNr287ZMiwest=&1UMcD{`2+=hUzmv-T2gC(H_rTW6MvEE0u>IM!NvO*3XXl zph;`4IR8aK+$KY<_q!JY_`jy|78<8p%k>Z1yW}fRtfy;@upyC zNJ56F;WSla9ccM4{{D!Tq_YPb9b-rdYAq`RpqHA=iNi!HN>VRWY8Oh14=9e+_}w!U zLvhiUsiCzg_>^Md;7~9y$kG{6&&JI-MXKn~yV=<>O*)2%YZPEfG!^A!XIBaq4BCMj zrUZXUCRrp|B@a1z29hc?lSydEbceBG&zBP4+P5Z>Dv-;-f1w{LfaW&V@oH7Ul6@Px zr@SOq@Vs-{^>TwAp=l8K!KD}$StwM{jSZ~^R1qvOOAx23`(6+5kYO_ZhFebhZ}(XT~mbW-!;=N3*nuAbtLGG%$E5qw(WR+>b0XNWAx_lcg68$`#5 zBFi#AD)brfq%7oT0EN4=oDsIpWaI-y>J>>0(pZc1{8r!HQ4jr}HtJ^ax@nL0gLZYLRI)7+ zN_%PZJ%{D{(o>-?J>hdInua_MTg>+$+xWpK^)d93`T~5anRTBfl-Ud89hc#a#7yOD zLTecvj7}e(l6^Tz8S$^}-}tuRqlS>VYeZ#=f)B&a*=?1$W9wz(=;WMBC~dEZa{Z5y zIo$3|90S~0iI2yEL$cxF!eYV0pXTy5A{v?Xe*PIGy83#-eug{CYxx2(o|!#a|M)9> zo)cpgn(tk?lifa2HRTUU17@htkQOZ8%!b2I5TOQz05cTxgR*ZB(`uUt5up=(F=HOG zCczO91|A<;tK&j}F-Kq6WNmXX@`ann0>fU5pD;Lw>8M5A_<8o(Q7d$*5W!GwT+En9 zF;GIl^+n$g&l8I%he;l3N@n#h>y|7NH3qMY!b5lN~Qj=ZJYJ3vS9j0 zL`WfB^+ED%tv)yS-toDD5dFLs<<~JwN@ZysG+#`plR`749WuYm_2#T0v{QoF zLnm*Byz{2D@tRor>l{9x051)0_Z&{$+>oH|N#ZK!?`7)1snhLKsZz`gP1M))<7iD| znW$t)EoW3%g4dU2R5Z^8<iGHRcGDr=>d66GC?8 zxZvHr@|fF#rJN(OO?*+J#rgSd-OZOYXLj;qIMf#Ra~-*yZ|W1-xN#>3Sq=w$>e*hf z*;ahwA#}{bf*;rMyQZYCc-@a(m&Olg%QD$?*3jLz3T7)eUGx{0u}@#@amV)N7rDr+ z7Wfg?VGY`& z9dC?uz#AVQpR$fl1;EW(I1pR>0*8?A+qV=fL#)1?-6t8fG29ljrVU0qoI&v$GD3Y>yh%8F$e#%Rd@*uqEBu-k$Dct83!Xj! zl(Kz+OToc_ZiM448USX4^Okj`u)GZmYh&Me6M1-4R|PxljKJ@BZUuq3n7F`XW|*~L zU&btZg~AdOPFkqC8T9WbUJjaksjly%_W|rF3O542SId29quyS?>IO@&d~{{Ck`nT2 z78H1=nWN)#5f*p}OCSe@SQ{J#e0JP|#TD8vmD6{WoyKr0j5fi$2iJlQ2Vr#ehiQO# zC|{~*W1;*Xg+KNBN_SCX0k`|F*RK_jXFwjiADKuf(ZV6g*SC~SO~t9tg{O%|$_lU3 zmv!Vxhh7~k(<{3sAk26&44HE^5b9O?)c};Z)UwjLyy&t$br>^}3OJ!y&t@;x7d>D7 zG8$6yeH!cQ^dCCJ3Z0^n4MGz*^sb@9F13D8iLU2rR3YjQVzx)r#-}E|Kp&jHZeah8 zORsbfAzQJRD;nFPEvkeb7HeAl#ff-41>1N;)b%Qr`Ja^)$v2+C40|++zF^N-!kI*( z?4wgjRax9VlN~gi@%m$13C$keHhi>IV;2f`0UXQ6E)-QY0vwg%F8^B_9`*SGIGt;M zUG+w^F`NmpbC()2dIsEHeQco9?W$b7J(8Ax5u;BfDW5xW|AfoomYOwkAA$wtif(v% zTuMDenCbTH;86unfF0~)Ek9LycAvb*R}~wH=Tmm=ZL_Y_m$glhmjdkobUwD$kpR@_L@U6h9EybmVqY2sW}=<#}B89qEuAPq46N}pygh0zF$T|?JPwVjo`gf zdMtSM;EY6D%CD7tH>=_W!yun!Et(gt&q|SAxaL(Xr$yN{Ypgykf73!r^ghAgGx8p^ z#P>Y&`!t!M3AZofAC0_wJWErz<1u%J7Shqz-Wi%soB5M;UzePhaZW}RjHkBQ9%w|a z)*is+CL^RKw&_cz9>#cxQ1~Ku{M0uY8^=aoBo79Arpvd=zrq`5SwEPHs@$pJo(k0= zk?(xG(Cgx#CHPT zH)`PHZTZtt0-yeLpb?{ojn;olaaHabwn6I1XcH8zlX-|Ja)a0RL8_0u)MCj!&Pp`iY5wgr1mCF~KLY-wKlA3>yr5RTmP4?%!*O(F zjb+(}jGF0c{|oaQrCquRJib~}l2*DiaZ%J92}aykT_N|2m0(F-B26)a3BOHaosZSzWfU>_gIv<7kODP)50m*(5VaR&00Xk zEt{3K`6_awx{R%@ZAK-8RIaKZ)!|;@>zWf#3^OqiFLIZYxS|IAky|5K>V8Zmuk(!5 z>-Bl^_f6eZcIaWzC$h13;@jiRmp^c`Fmh*_E2s3+y?(+cT`4U+MB#Z^v$)aT1!(l7 zMND^f9|+C8J_kcXx6f;MqffBUzJ_+{7 zV!lH*%EA;59E`!=+lEl-jC?18Z-)K+0bG&_&coGU!-HkZu>0mJL=#n32%^2cU`1k4u_X`1pC)2 zHtuhp2}$sy%ZB0RH`|wCxz*DPGMm!c%+mV=v!*=rLhn^JqSZco2`1{3p3H~TzUHyd zF1|#-^Evmd66>56z0W?P)}BW)(Eiu31E4>p;}}y5ZMQ6(nP&_3#VL2sbL`DC!v(&$ z8SPtgCy0xaYc}sP@9ARHqYd%01~YJDB$*~PL1k^nZwE6^2||KfD#il6! z3~WW1>Ale!(hC}t1jtHDYYa>t&sj2izVDZ?EW*R=fV2<{5ybljZ4*b8{|3)GVyxDv zqw($R?qZj}rPlaJxY6(IKCfgyQ~)f?J9ob7rOc-jh7bW5G9vjc zc_^d_xKc@b)7CA&nolB$hx2S_w17>{V!l1aN>$L}BH}8&yAbfja~ti)y39<^1_J$v zz5(Ps{^azf<-l&&iyM9Pg#sd->d7;m4t`q@*&+1mx3Ki)YUYYr6ADRApvX-sNZ!{? zkeS0XM8bG$Ak`VJzXbn_C>$STwVJ=fotrC7xv>yLU5rsS7Y#hj7*unbmjH3DfF~-2nK$>%&7S! zGkCvP2u1jR-1Ng;Kl~=b2z{8XdOB(OK&^P)y?)~UL~oe{>@+?Y5&4}yK8*@}^kmdu zK|W0;=ZVIIQZ)!5Rj*J2Z%#iWk|)$`SmW(qc$xL?!9MapmRp6Wg5Wj}1aDUzh7zqU zs1L(d*=tW&-EYB$g+>$aPushvN(P&eDIu;Ix>HF+RYS2YlTsYGW|d2Cd_FIEc|*SO z{>ago6f>XOpv08v_?q`s>b2LW$E!MBi-H2G{}g-T7gQ%@_8eo@nvuUDseYe5b^Zz5;3yTgVv;n#mY^}|?v@5s;iNaLis?|k{4 z5n}2p)cf_YLrrfdLX;H zYkdFhEKcZ_1FcY0Ql+$3qZxGNOdU_{xtl9`*^;z&M1#k6YJaic?822v|LflFCP}Wa z+bzTZ&v=yU{XN&*{R9e!E7DKkGBUtK|2hFGVoP|?NEP2;vmOy0UsWjuT?|{7cD_WA zsLU3Wbj-VSa{!ZMq#$S5iuG(gLxuG+BTpED+BA}#Vr)JD}$Gehl1x0uEbR>ZQ(3`4teagI7gzjPVn@0RXB_fmoo+E{^yC7I|`%yX+bk<6-o0 z+C+F+WhcBc*9&4xn2Qn>)IJF1H)dwspH=`*u-?-10d>kk(@U&MqHOMdIP~(I1;zM$ z#Jc)@gf!hy0lqTueZLA138i#hHZgOHDst>2faj&t?t|w^<&dhJX;)s-V4s&_^p79? z^(H#t&QqGmVNEIaXVJ*8+&DhP(BCL77xgdS5H+?+Qhyoe)Azg`8N1%KC!{AtRZc5p z3+jqBSwY}18$`4!ww81N}9D7frbT^-seJ6=xet0SMLuBGpdAanuVOEFH6mb zJTSay>~{*|UY7MBqlL3_xcyu6ha~d|{$^6psh(D|8M&w}6+Q2ks>gRBcam>aD?Rfh zk!{iGE=qAzRHew+upTBX>rkPkdnVU<3+jEQ*Y_r?rw#?izlCH+Bwr!xu9NQ6sJ_m@ zTE^`agYs=JPaR8nl!VinOTVKqKyZ7_$}#5PMBbiLQ%Q!-JXqZS=mfW%BbCsrHU znkuz;s)TyIwQ=#z0c@zVEiAf~aK}^>%Mwi>&)VG>E03 zkF?(bT9aUKd^lnzqCFkTmWWOq5!~qSrHCF0rR-?l<~Wa*o*1lO4t4eX6L}QE^VELo zSlJoO@^K7@h%9FFOm4d&)(gIBMApXmu8j(7>$}}XJ32LRJ$vgo$8{WB6d$cH0qWzO zLmLPLW0>Q+deGp|#$=`Bjty?K-*Fg>OrqbzvFykH4w@xQ+u5o<|El;S7Rdvdi)|wN zdF&ZwFwhf)Rvbgqb#b>!ewD}SOvKiUJZ&-yA$l>i`@(={$uhOO3qJgN`&XB36Em8S z@{fiGs)W}5|1YT6QiU89!L&h#8b<*i zUv+V3TB-aeobDRH3)8 zA5S15QNW?+?E&5V&EQV^>~3H1U;-ifeRBl$AoX&TsE)-^bTo<+DuV%(xCqlnF3Zq* zEC{C85UNG=J1h)31pmW`;*RnSK2K}-=E9z#RaR*QL40K!z9-e+B z{)h%p2t660j+v^v6&77VWkDCyK&2BGkilvSBly&dx?}jUZ%F%8cy-P;NLgstZepSx z<8?o;nL6$ViX$FXta%D;(?Sa{OEIEAP@GKw7R~;}B+g8vD|S_SL*AN{?=|)H*^Q40 zBW1b=(mZ~FIU68Y7f6!E+<{hPim~<^Y1^SF@iWmk*_`$0Gl zo9k%*57?9(8{yG6?<-P6e=Jr156cRh392ZX?VfI5Ap-{P-OZ0H8lN35Zo#LSj_r|7 zLjR{_Q?2LK(!aD`7!spP57-)2k?!JIUWM ze+KQZMbPv(ljgpESY8Qb$sCQjqvXC^=51kmT>QR_M+g+fz6h)R!3aaQ@ry1+Yg=y*)lBG$8Ql4Ho~Nx49Dux&)b$e!z|F zI=;Qc_w+KgDD?Jz@&ZD$khPb!ttxo>dLa<|%9-s>f3oN%$?XNc1vbkHdLJEfW(a~- zKU2KNlqW zGOA}04QEJ*_OGY}rK6@yf7T!mB5KYUs<0X?)n-L;(DX4;`E7a;zaIeBoIw-AioC&) zrH{KtdKk{OhgU-n{f;FH8c_oKE0hi})HFJ^*Mo;MtVd!O+1P-wf*z)F1}ZGbcTL!f ztTHdz82Da7LId*URY=15!q?_5ksHty)(>f<5Em#=?UBT98Uc343XynS>_Mot`X_o`kM&Nh@aE2_!mxwol2FLZ{`y zj2z6k^Q`88T?7D`1(zVrK7NY6oNZ1HaQ}I6MoPtVr9ho_D*%s_=xRlj)#XEUAOVg8 z#&S=4MtIg|D!*YgHH?)~I0c#wjp99DkMG5k0%XFwB45Sd$<`4hZo+A)+bTYTeeCOJnB$iOYK05LD{dYELHsV*8XtI)WL<)QXQE7G3@@NPhzH+6`%4Gr}Jse z3n}5wQ2vnvx}1|JV;c#2rwk&`d?C={g?%;tN%z16L|C)SuRj45D!z3!DSt#!PMVt$ zo{AXd^hR~cEZsMKM9Xop8Jcsrik8cdZ<9VDWv)&+TRI-_Ya7a7-AQzUiZv3|XHt$X zyD1|$Q$)=C3zeD2ySDAJcaY~#6LMZi^b%&<8vBr69Z++cE;_oyPJi5@e^E~^L`3x` zuAkPG)+JXg(Y0o>(@(1BSmuprlPRVE^t)-pgc4%B4(2b0yG#%djfq2 zEVtQs_+-_1Un&)nevAvHR(>G@ob1Iwd5a@xY;q7v)5tp6PH8OM1Mi4@F+0X|j1gr* zHa}T><&&=rl~RJv9V$Vd7{las)>;kDtiIWcg+HXjoolOJf7>kegSXw`kJUL!lEY>< zI{^VQAG5uqhlDiQS7HV7_r`@aIC4nbq|TE|xY##X?HKs{9s%z*bg3uCYEF+P+^^>$ zgcc^Rx~J0a9SMA|l4cSQ+fC`*445L!`s;-SBSs4FY}KVGG4IFP^_IR-%Vi3b zxYX{6-d`^AfZ?oYLfrA8XqL`EeGq1?SrTlG-I|139qvT6(i%StJfWd4agGmeR<_ta zJN9v9Eu$3Q{5Z+k(iP4M?0Kv8->7&w#ov=r28=piArDbHBm4I!&cx=NR@?V0Cc+1c zjYf+ANmo<(BiIAl8aE2Owk^gz8{hx)WaQO{h%k`IDUiNTgdA>g|9Hy(!)36`+`@wX zi>>Ffw%USQzR__%;0G_Pwhe94FQMR@_o>2zC&H8Wo9}4J9;(VTV_aXptg^sS{`+45 z5>E1A^jdL|qRVJ(qYvw?4GeV>v*;|~6oP+`co*xgIX7X?6r+t7z@@ou`~9_>=((FH ze7dmwc}WQOyji{~!nAPNIg|L+7J-Ks23^l>c1zYtqF;1clUpQQVNZ&0ctc($1F6~I zaA|FN@MY{Gb-yC)nTKLxiE0By`!5*k{)PF_wN_Nn5BedVGQo^eIHuEQ|6+Bm9G527 z8}ACsW(Vw3CDBO55vk9S3|>Sc+$gieYDo%*G>9#5r5D;eo2qjCcIcUk}B$SzB zWqi)o{6F8LLeTgM%Hq(AZ@L~gqC-ML$P1p=Z?+VppW3{SUkan_$(HbRe#}gU=8FdN zxTTXG-}tgnMZchxL`Q7& z!xM-=Za@B)wqCrga%+8fQeH|-0=^y4s(r++hNCtnQ<7vkMS=v()@pX;J!$?VsZl{5 z@LX2&CMF}#4jvq21-^_3{VWJo3oXWV5O~KDd|!1?d1ssxk>lxl)h4R8+De(VP*@ZU zE{E2unv>TgQVaJS@flWoT9c;Y2KOg(ESpI7$q=iP5vE&oa#x|+Y|umTpki~Ge%M)Xwe1*2TD zpW@@+(cR9ec-ns{Yn~4U=e?0A*slj5ztW@2J)(bc5Q_FqMNRsd6LQGq{M}g>@N9&f?+SKAka*sv(q$5Qf&RpRECa-Qbp%Iu!Ej;|OFX5mVGst=mA# zQ5_dDoB_p?R!&BY>${#d4@>wL9^&P*Q?X-f`WYN-^6Xp^AJ=)MF<2cb(%r9|$ydZ= zGoW_LbFpo@^MTK+grmX#hqrf(uB_YEMk}h=tk_0X>{P6ZZQHKcc2cobv2AO`wryK? zz31$`zrDY6>b>{ZZEgNoYqh!N9CM7$r;qvcNJ&r=W#;s?NOI~?D@(q)IZKoHnn-~C zRJo(Y-P~T0nQ37=DYKOGt_%aQwxfzJyz$CG7fSVEXG~_kg<&X}r2UL<-J)1JM+YL_ zo8s0K!)fz%yk?m#%XZIO$^3pQBeN|LqaMx#TfM%zBIV8ALv*_Kk2~(rIsAsB_7&E= zunO}sT)VsbhHXbRDmN?>T6BMB7cS|n;{DlI!Y21++u!*xwT$t4JhI*VAcDy35yQ4Y zOZ#e~3Pm0bcG&~d z@Dci=NjH8`xfanZ70ez7b=q~$L+YoY1Woq_|DwTcaGX`1C!`3Yr-90LtpZ!wz*RQJ zxdMa-rALQN2+8SjhLY*8twi{XO52uvaG7)7blJnobWaENvrF{99o;CJk((Iw$Dvz( zh{mEB^jGIaI_jYXH_E##1tW>WE@dh+ppu$ZbAqrYzR!W z4XfbBaozm^5-sr6KMzSVt;r50Oo`CDGfdV8&Qa?n#9Oxq3RK0eX+yxQ&*zjfntmxf&0K%P%Kd`pXfHXsr(S?;ejXG4P% znFg+}qQF8u!FJ_Fqkb|nHOqzv{mps)L&9*B3ba@Qm(L5AE;ne8>8Ps#e$j?G6Lub! z_4*V&YbU;@2C3Vb&8FY{*`kqzmJuPP_=?>-4s50Ecl!}8wJM)0SgLvH<120cN!C|K z#)|!C2}M@tBHw|}Emz0eWhs;`V@Eg%nN3Y!g9nIMR>RM@WNLAjK7P7QE>CF6;$@{X zq1PJp%=xsCgq#zqCbgZik)`Gw)Gm&DB8E!4ikkE3gdKlIsJnW;55k^hw$oFl_fZ#~ zpn5yIBUMUMTrn#u@Z)9!>$cRnZMm)B*R&D~Z?Hw0JIIs7r)rbi!dr?b-qD()^$!$g zs!qQ{-ApZs;E^WBeIkO$?r zVIJ^3;ObXxv%Ezs8wXg{_j7MOuVe44J`xxG=LoehILuMtTamMD{X(0>PPu*?+I+8D zh)U@qUIkHNU%@46d~%9b_Fm^M>ywNHH^@X8mkIlhy*NL9$g*Wl zJ9VXg4JXm>(v4ix1UzvKDCVWlpO?@HdUI`06b_8^L~yu0!GnZK`*w`qdHPa4qL!0h z@J4^7DEK6p%YXfS=9d5-{RlzUz&a1z4G{9~EaAm6>JB6Eq7E!lBG|~U?~^G_lMpBt zjZ4Dcm;6j56l%0MBtS9!LsAbh-*CTYMcv<6dJnm$sUs(p`UiaxrbpZ{1C`8vnscx% zQEf63qJ&s7rE!#V%S)^6;~Cr0p5mQWXt>A<+(@V8J>7D|R$t~QkTr~u~P zxfE02)=oZ%9wbu4c}cCjUlN5mjDj)5GhHJAsbK(uq+be8zGsW}ZSo1xkFSb|aEkD5U+Ep3e zM74R18FV5S{WYpDm|tL&B;@6%KR0jj0Ls_qC{Vh&)H#ok>twIsR0;hH7)d^LKV zoBIgB*%%}cF7o(XpQp*H8C>xZ9A5~JBs!EvBciPomWa$^nbW?NV{JJW+Jj(ZvgMq4 zKtv^^8+5LfYvRNP`^g$Zw;D3Hex{iZm z6kEM*2rqU>B5t`rGg+E^6SifXmm4edBPBJmCF1j{FN>+to=sm0zB@IzhWV|_f{C|u zKVVUGek&);6&{Wkv#Z!V zfgvyrt?soNzvzA9%=;YcEyPkSc9E^NlbDFx*!L!V>H^zI9;16Si<2M)8SiJtJ;G%F z%$Q3#c8{R$x9Ll;&1kjHs$e^DWza#4P1Gtw4zhFtRA$#9ox)h(H1$VL+HW`3BtCO; zG2xj^5GeRd01)(XAAc~OUKdhM%C_0+Gt4p1C2NWqJuJ^H_8|K2!#2H~WHH(Zb&@4Z zj3pe@sZuXglPY>ewB#?>oQi$Z?DH_|jWfB>MU=R=_Gd7qGe+B;j0`KwniTyAfHx=i z8D8)KOw&7}ykI4K^G>B!Us7ohgU7+!{X%)SY-*yPcN$K-_Eq{k{#{slsLKO~wf&wE zlHoCv+2Kpv4uS%ePVVyX;o^V14SK-`9`JxHEjs@tzW+qqbq}5UalmDs;LL1 zW87A%Bc+~qk-(h9pcD0Ub3h}nHM9!=Nc4x6YcwJNnLw0lpCGbAf9PzZ#Fp=BK{+mc zydHFh6uLMOM$~#It-c|3)(cd{=(AyVMwXW0r@vnm%H5+ZP`Vw;oh~+OA&+dA2mq{z zIYz3t8KI28I;$(bjYpc$Y(S}?2ZY24ya0V_SnEXxPB;dgJn5d2uv-G#NN~U-GOL(T z@hmFDqUlUPndep@=H(DcbP;p^UI6i^slTPL7d;lw{h~pM9yBsv%U97s*ZP;ZkHRc3 zbvp9LQKkt>0xm9>b43MWulw4p;%k%*u5Dc{fV9WhkYeBn{Iu$B?I4uki{{YSUcK#A zn=JjZa3f`%AO--qt7VJX(wXpel8Gx1NWY^&1;0bFN60Yedp)f#T^}i`7y^-?=#e-z zCk$G6s@|V<{MsB+mx7cP3#KE9e#|kLo(@_Fzj8?N4Xhp){p5i8ozQ}y;dC(|-za($ zEL|H3HNywpQ9sMvW)O#K9Jmwnjd|bp*d28E@P*)mS$*QP`x~{Xe*h`E@wEUF^NTL8a?Q)#c{V)zhkL$%H*wN4jf(G z#3sl2*CUn-3B`1-x=c5ky!#<;brdKdXZ-R<^teR5wUX>-<^rVeJ?v=c{KVQy5VbvY z#N>VG>rEa#YCpOiZodv9W52p~+okJ7MOcx!@85xcceL9lg4}99=Ih!+)T@uHHEKMZ&#;N(l9##-No4{r-;W*4cTeIHx z+jw%pz75+nlpF+;;7ka|Q^?()xXO0QayEn8r=>v}ccl|ECuK&qFA#)_1MeAYEu>7< zlgWNYU#U&cF*;VNk+@rNL#46htJO2yycWF}28N&tsqi7UP7ng)mAr^ZvlzZ2SF^12 z`-TWj+{xqM{nXD6{9*{E7=cDqgce3h+GIFLNHoJw`R%RoeR_=BKk2!HDwyr%e@16j zT@D@$N{D?Ao{=V~*SsCx-ef-KZlNSx631!F#UkCp`a%bg>XetUWpxO1g+LFDFW!~T z)zNderG)uyJJoou&g=;A3-!W@tci&bPen1L>5Jzc4FrdFT+q`bQLU5XSTqRhx;1My zzv{3}ndeF2osp#3+HxgQjW{XLj($ILc*wc;;L@T8SIE!`4Re??pYJ2|qzw@5k57gG zNaN=*obi&{#@5&(P!E0bg-ich*oRB&9IwumA3b|wV%hJ%T=N6DvgEb%O7Wo5ky=z2AHQSp9V z8weDYI!$|ijB`n?WtYz6?hbr-t>uYGMGc9+hFuZan8=CXta~e@AX+t;_E++Ef=w_y zcDG9`Hx3$-#Gj8Z>_l_!a$_}VjFA%V7{+3XC?~qCo<}2jhDa>+<+K!#D^Td22}+K> zB>vi(v%kW*Gs#)6xw({_qdcjnwm?I*OX!7wJcKY@$!Gi+qBk|?CYSxJabXJ30>(iz zHlEgQjFqs)8hV|5-GGvP5K{Smi=5Qg#aO}HH%T^z*t!INV?4$xWLf1qN6e{J>VQr} z=r8fe`(|C^YmR3#Z&fNC{EDRO!V4yo}V}z+BBjp|-azpKdX6x2*+v-p(aM z#D_(!VK9xzlml@stK@jrXC<=U%OC~sWRLM)cx+TiN}4bCProQ2cfV8og6$`x=qDWF zPZ9>xoE}ogy|h?M(>=Bd72ojvO&?_?3LION;*%TVO2i=%DP+!5#*- z?jf_e4AC54TU3?kH73#T2-@WvM*&`UIxV$+%QC-;bLj9$#*VzJA0$-!n2}T@`CVGx4C}~*Kco+=jI{FrEE0Cup8|mv! zA8fn3yR8+KZHcx%mrOiW3@(Rs^U^mQ!wF(}o(^Z1C!J6xbGTE7xh8g>A)h%3eQYtn z9+_})imR@musfKeoN692vQ&Pevb!}IZ`py16{f;VhZZz~UW4whj#{SY1{(kb^Zx!n z)C65GkRV%`0bnBlK#wTzHFAA}8oo)zgic?*&~z9Y8`(vSXGUbYQS;abFO@)95t>k+ z$qjcWSOqbZ9*y~KT^(~lGAlQB$cp9@oy2zIhL;BNxbKC5O6=}rd7Mj1vG;!J~=u6-$dR3a@c_^TUU0g6qE+))uWzM*hp7!gUxbLSBKYlB9rdsV1f-1Q%KB!Ksh*_*Ry4< zyQ{ClQSs6!0{VEZ#weUtwW`bOvkwkl;kRgz!V)Ko^KtonR*`0Nnh58r zxpJk{yyj@C+3K7^fx9F2cO(NcA4=Hqc(5C>6uCGfZ_(Tojm3CE-NkR$eR&&0e3|Y) zh%(qmFeR$_YO@J`@sYgHw7TP5c6yr#dJpF3=akr@eR zXr~OtPIwqS)fuTIc&To?A3#%z@-%t~Yur6r;9IZ-+IIaOaE{v7iy8q2?xH5u-a?(1 zkq>|aU#HIc7yD9NMT?jwD@fs;pLZkXiKH3q1-aP`a;_!?L{D+A+gl2h9|l5 zA&ZhKu_R1fDz9K~M!hE9v6#d-05F+XIVTJ)O=`V7?lM2o77_KmqU1#UPGv8Smx=31 zf5c%Nrp<0G+Hf6j^>v*F6;Vc6?VnZ^uMh2=@l&<(b0UPo&Vwfc`qcBM>X(SF&7!c) z2gQ8DXI}~pFMQi;45E{Ek8-V~l+f__7-ioJN+&zY4th^Fc!|ATJp)9FU59(TJE@|(N*XnN;_v_!%aC;t4*wbtS8KBXF~GyUPS zWsSG^L5UdQJPh&Nb#^iC}Bh7LR2*Gv@)J~&%=F7PjiXZb?jynezp*4>EpNHoTouHIB0Hfl< z%kP#tvxO}a&0gwj(x16cf>AZS&!)3MEvlE%Xf-+{g5ZuR6qfJi&jRDBEHXrzGwX1m z_P+Vb!gHlsM&_z;w`^`oK;ttD{gzI%#{Zo{{aPs|CTp{b!RR4t5~)fzizqo@N~2HWSJcJ$&o@`j>)bT}hBqW4^-5KD zuaRGrR$?X-6$L68o#INKW?Pv3UQDLonqNqb?+ukzV-}D?OL&hGA(M~-XIIKL$n)+aj~$Z1RQ7c zy4GiI%p<9w_KLu>)sw#F{XDkq`%-V4>hW_2uZL5lYW0>WaM+77znu@Q zVl&M`A?IjbNp7<7`0m^|@?pyho<&c35@MYjdGER~mXdyv!)x?44X7M!YHO8MOl=}B z(`W2(KFq{Ll@wZK!jx*8N7jl6d`3td#&YMW96xkzc^1lzir0P{xulZM+RJc9DcCr? zLTNKg=sSX3`bGjde9PJ#=W!cA`n%*S>?(laXwl9LWkrkg!6KJUmCGy(_POIE+y+Qfx`>$8# zlGE~-q-z;UWxNY!)2fh#gSz#a(wyipK@X++#Ang|EEHFE(KZqCSMKbrot1tm?6mzU#YGpl@Q|K6qz{LN)yDnwFxof61`b~7ATJcNvlOP-I zl)=JLr1_l^KHo6!=)v(*r$@hAJAO$edquh1S(g*|flbGI1;4|A} z+4@)Z#woW?dTO(!Z>dCJcLVtE+C`qyJzi?9R-M|~uuh|_fKC410#AZh;=IXZf+?Jq zFVHWf)jL=z?0ONIh_HKN$3$9=jsBT5sD@|L!q0455$|U_E@J~MVk_IEn(>z|&0kLf z%2ey6gKlxiXIhRn`T|JB=WsGjYh`qk;jnqcUavUByp(Jf&a(|-B9WiOWpB7r9@KOg1vL}En%qVV|6>TgMp9v6He zQj#iU{sbZ-A`}b^V~~i+A*7*@2i3*O>t%&KZ2yjE9JcW?S43QPU8ha4L;Xh`5`9QM&W2#InBETYKT@9v z7HO%dsL1_vEUPE-0!OUB(Gn1<3KR_PNRXL)FFA=4a((MDjEan`pCh+R zf^s5xzU~V}tuc-Did{fmL01baR=f+~<bws0R7c;m28 z?g#^Mlk1%TvE`1VSyqO?c_WTy=)p)Rb@fYgiM4>NkE`sM46G!yFJ>@JBHAHSc67R% z<5E=Rb@3KD0Zswft^RST0I`P??5$7`dwzM1@bz~-na)+cZfYU4C)JhPk@UA+mCmN- z_Cc8uPZl>=uiB?)h$`8^MNyIv&|6UW?t#AVW6@c&FVupyI}E^42X$ZYdsOog1fUmB8VymyWhpG7K@%XCm5Xwdy=;`GG|xnDN51Zx=D;v}xsiOH zDqS=t&bx;IZ8%ZAJDB4#cWqv#D2MdyvFi%tQ(rgdi7VAvefxzvASF7cl+=KpnOQXq zB_E4p)$I|0uaFIyC&enVSzxpijW5KigB}uA$1r3fkSGoR;FUEew%L(aiT;rfU!&g| zChZoLKw1uV*5fgdWE-B_|2oY*t`^+9&*?q>R9lMW(|;0!Ik?SE3iLf-PzcGr$s z3lsebkqyXa!kvUid2b>3;|m;+TyVd@^pGGp{D{`Ml)oZrbS-+pRHVq!H|635a>jsM z(k`UI!y71t9HEi{xs>8h1*{79nUnz-Ga!CniOD1r3eOr(qNA7w5QuRxJbGCzqUR&3 zg>K3A;r4TD5ihjfW_gc22FKt|88kZD7i!9_8@;}?#d&KEF3SKWteC=~&;@Y!t1fI$ z5hUie2Ee~cK4RG<8HJC@S&=+iB*vYH=0t&5i!@mRITtYrJeAH>bvqj~2gBr3N-k}7 zf-EqxwSFVcV_de!aA0o<#b~(Dn6iz_q=O~54!q%}NxIpW_Hy7)eZCayy&D?`F|xF( zy%|v|e3~)eIMtkr!l10x&uHYF-N<0}K62frCNS!u9~w{|gua3F!#^H~vaT>)1&^Lt|<~FoI^kCIgsqZY~#z)m6G_ zDc`eVcFRaoP2+$)_V=l^2jxh=tmIiStSHyjZs!~Ma#VaNU_9c|M7>S7ns$zXJF->A ze0ZJb)#UO%nY>8U3X;r9RJ(p+)40XtdoOrL$c;uId2pD>NOB$mR~>bT@K>|ke4W05 zf0-oz>PrT_PgP;ogwN@KG_e@mDN}{qgX{FB-{*wD{#3`boTz`-Y(xBQEcKAA}=Oxg>0b>Pv;g#p)f#Pubvi*BXvsSG@&19*62fyxjb9-m^MS>*@Rb6OS5;qC~`# zs5pycd^j5eKEAu2h2yhVK9@C6=7VKl&b7+!pEf&X$fV!Onf0|8KF!(c?KeX6Pez7Xn zbG+BY6s&?^EsWXcx6{vLt3f*%zPCCL;QnzXd*mX;JoB&dqJc(rD|g-4I`kDC0pj5d zxJavCQ?BqSFp`^O&LxTb!+$6R8qNC0W9e`sbw{GYP~e?!Z(5^tRBg$ThzF`xZYtaN z=C9Wro;0`ojPgRB;q_GMN%{zSzWK221QnmmI<_#mEiG)U3o#>mDvXj06VXhhgKW!i zeBX{>$UA5-Zzp3p5xI$SMCfu~J7FH98lf6=jXoV`ZL2WlqUO;lFIC=!m)FTddP})S z^t!6K9Z#j;OMg?LniQVDgus9{BFRz+?w~b`PdJ(no_-o9Fn~DXJ6PF2PIC9!<>>5m z%vyc$4K9Tz+m(o-SyRR|DO@{5j1uJREZ^poY=j@oB!ERzEE910VHshF%R^g;taMD> zqWv1)jK4}MpBnfmX)lqg<^_k(BLWjumPB^)a3mFm&8cz%A?54`ZjK28RUC^K1gMJY zzdl-JDd26|sTGja@~F}I(cr=AEjae3)gdI*qzqBKric^S6J&Zux^TDr6dugCu-@`> zU5*2^6>2r4)Jl8>!J?qSYR*}pU-#f*LQNG6kJ~a_qvd0*o$8@Dsh{xO9Ld#?xqZ4nsqPKx67Z$vfL-ccT;AZt-3)s7SYXsc$Mv&s=@YE2>A}N5+$p zp7u)FX(_-}Mc`4w#P1I5%#hYKobCB?Ur~~Nzi7g4g_CMh*^lw+?*v)qM3=n1dVg$b z;FNG?r`Ozqt)2vM${O9v_>nY?`OAT-r$zx2+~zC15#twY0n!_W?*RMP3L)%ER8XF}7C z>v6Ygmf`dZ)ujN}g<(FR)*KN7e@?9>vRSl8-LYDSZT~nG z?PbA>@G7nIYxT^`b4)9_a)VW7MXBYJ$~8~l-q4U(^I5~n=-8)w0wYvQ2R7?fN}Kk( zMB!u|WX}rAJo+1+z`YT0RfXW4-Cpp%Jo>B<)0cjFMwb2?i3R^Gs2!8KKywJW>|7#C zqGYj82cP#pTjy??oIjdH7?ksKl70tuO80qx>rLob?exW5Q5kF<+gAznIZ@#?9w~^2 zNW`Qc$-QBlFO|o>iTiIc`vg7f1v)8KqM-U2y(rSC%CG>ho&`tu!fEQe z?{akIeEno7?w~*rk5lzIkQ*$elew-fAOL)+#i{gkqjRH7fMH=NyTLKD$KL8os6-u@ z3mXw>tdJQLOA|aCg`~Uy#bCDfrR8@qjGC4}o2skC}Libd!7Gl6S)Bo~V|Mj4=JfN=- z4r@3}4UYn#9qB`u0>!Wz?AA_tzZOOQx1s*mt%|b1J$ie4PfR8jY5sW9Um1q4InicX zY^)p|M6K-KpZF~9ql|UuptKY{@-laC;6_|{QvuODPb)DnZ2oZ zjg|jjS4qWQv%Re?-)?6hVRXzAXd3=_$a+Hqm#b$nC@>H@FR}DfgxcTC&oLQr)s(Q5 z!vIP?{bhf==6BG$L?4^>voBmCe{*9KXf$;6V)rgJtInjy$496#a|;E5mGMlvh6b%+ zXCkbIqN2&v&9gJQ^>tpBY20X-5g#=V41Z6(>uG6M*KgmS1sGQa{(SvSB=*v0Vxir` z#B#Daxnv-hnS{K)pJC=W5`j)MAVoSs$x8&sUl3cOcT&Wjn5r5u=zjbu1mMdL|4WI+ zXosShih}gc&^|Kc5+4WpM94NdAb>@IzTar^=WvPw1?j8iAs&}Yk{s%932W(w{KDTu2L$b<*kz`q^_3!wm}V;_6pIV~J=bbx z7%PIy_t*^m!Vm?&iyNJZy;e{-s*G}+CAe~VdM^dN255wslB6IYAjkz?<~OyVR^Pst zz~|g0XV=rUb)I5f@%%IR_#cM)XV|CPuR%c{q&hW^bt5bGuxbI8&OpT)p0{2Q@HPK`*wv zKu(B;qqL`HNxuub_w-vBsoe+p@R&sW?{8Y9HA-xuA?LJG>W*JyIVhOwg@lAT-rX>_ zfsG345BmE0;yg1=O@xiUE1oaa7IFjWE~cyW1Vh8aX;}D)fK*q3!^H}iB3gN4=fkcS zP`%^s6o~6PTc<7?=K;?zPftr;NlBxDt{Dc8KmI6hcfOw-tIpe>C4TOZGd|oPlJYUA zc+9PXV5ktF$o^r+9+-k=~;4sYVN_DTJsCuETOil_G3W6(Dsv#g#YL6{bIN=WVvA-@2ebUtK}as zFxLg12iDYXS+U%amdbVbG6$lAJHo9n;ESgU#nXg!#mqJ{l6fiNj)PB78#Uo?-9g)r zS3B2#QInvcph&p-d_n?OCH?77Sn1y56;io){*LWhy~ct6vKBqI&-@%VDz%Xqtm1db&NDnIG66OB<=u>ovSsZ?7?%`Hjt|M?K>6^v4<8tbtB{ zN$4CAYjiZ5+e6oENxa@j*)Qq61?wd~F3ytcxZ8&?6)U!< zsy8GeqVCX02qte8Kn~S?b#=vRiZnnWola@B(vYy$>Y{-Qr~Nh10PpbPTDoa#vhY4S!VhkNTS=vgsjfezZfg ztj($7)FxPE*-1n~m+N-Kb^+KuF%b_EQSNOa;p3BuBExNMa!?=U`-NV(JGG6e-Zzy7jpEO80dV;)LXtgpDj|ax!*H=<9zy=3o|-c zn(yMJg2_!ydth83sjQxxPDjru_eI~v?V4Yl7mb2PbS*b_xx#cOoCPLkv--6MmSJd+ zz?;^l^Q}SniuZbm1fw~8NOzZC=nB|UbMJ0JhYbWf{0$zTTh+RG4fb9NG!IbpAJT^!O%_7Z$7Im96kwz!`h;?i6wPy=EKJY| zBokLA4LChKG`%r;ul#ssK+Pg>J0x z|D5;8(DAquUTSl#h3-o*D~yNKXIl;g=Yr!VgleVO?FRE2udc41Cl?Y2CWVWAc0!y< zn2~UwL!3nvS^7+cERtO8n-}^Q{upq{7D5$~!>$C4uepi)JX0R*b>l3qw0!d3!I&y1 zWnvO^s!P352{I0W+Ke?QEJ|*hBMt-u!x`F#w;;8?X=Hrkvrc+@aR&0gYgv`k??b7M zP2Fup^+H_hwW&?` z9B3XP+so=s1loRSY+Z#c)|ZuDTE^A(gw9e5Eas3Z>1ANP2;|2fj$~V>oGFw^0unVO zo7gp4uhGh5JrM%*uXv!wkg~TDUb`U)lHVYR)3)s3EJ9t@T?dH+^ddpNJ^tz$1RL!2 z1CyIlLbjfghT5V;du8uC1jtAE5l7J zC=%5O0Un+(vA(wQOG(CTqq>yY8k@>rG$H|2JTxxRO<=j$XrKrcq zWT2xY29k*JOSvL4S|&g$&q$~1(^|7bVQ4prNW|9(qerq< z3aF|}W05+hTwfxTgG1_ABsV-c3}Qx<+%TePecj9NJr1th6=!9e1a-);AKjT?dpWN_ zYr5p;NePSilU4A$NQP?N1(3O)%t?;`1F^4TbaXVXfqgE=W6_+j+c>Y}%mJ{)^v4)+ z))>^JhS6vwsGiYyn^}DBa4&$Qf@N&rN7J|;8;TerZIviV7E!8Zj5a@jN_NTT>ZHawaibajs3QJ#a)J;(P}Y5T4q_+ z+~{vHKiPX&z;~LO*uQW&m))MNEc6*ct+Q@olSLNo0~<|^v^br>p*E2C(tz8Y`eVV{ z7@K4nZSwtDO9!F5xRzwVgkNq6h7U_NYaKM#o30Qov`at z(iL+%=Y$q&Ck)k*ELQH{;|i5=-#)`90VBwfsopE4hS~Pn`yPzG35M^vvnb&DtdyX;h z9S&?qe5L`Clv?eY_h(CX^tv+zZ{<3zJq`Sm8N4^n9N8TMY4hcAw0D|876MKbrpfEi zP&T-FQveF)RJYz#^b#;-@3nK!o2#pYb8IS4;-lm`>ltmgJ3Pu4my2H+D{Qd2?OQTy zwGW?$mA&^K-`ooa+hbt=I`{PcHZZ~N7`Po8c797^s?-+FIiuT;OfkdY*g<%au(WuQ43rKcXwi`ib z3F7PnZ*uooCIru*E8)OsZ@5S<58N4_Mx}ze72zkJVEXxFj=$sS;uLqn6h07v^{d+f z(`xYOp!gs5=pQ(TZ;ROXy{}(5tmFFXtZ8tRDA(&f<3+$r>jTU@w10zfzDdkLt-9)X zP>wOfxO7d*G4AXW47G6(h+khBY-@pa7Z#DUi7Q;q1zye5>J<6rv~;Ayw6mmy&07CF zV$&J!J26(@y}qZzDbT1~-zLB!bf5EfyA3EdCYz>gtBz>C=TvJnFBbMr!h~{fKD$?) zAVQ%a2#fz^;9e(nfVtNC6U@mTZC~fM0@RX_)oPg(DdD31LHh}~S>7Cf0Ef-`*I&g7 zQa{XXx-v4tNlxe$B;<&|*YsUWLEga$td(hC`XHp;R%t1q{VULP@A@;;3$pL&>EO%l zt)m*Sw}Ft5kSZzTGW-av5FLq)p<#YNP|$M2?5tupnDQ5-)W1nBI*@$U(U-~szcU9B z1NG>;XGaq&q#cVIW|3f@H8AJj_tjkEMnb~QuYie66Dj)CF-`lG`%FzUh1X}n?#|ho^$6HM6I&$McEIom_duf z$(#fwUm7{`G6w3{F}iTcULHQRuVTI}CEM;7?GyxFk2!5m`)LhDcpl-^O?Z~y2&Ve)?Z$TbxTEvOl!xTM1-Hv68*~5U0{BlQbV>v!stspc;xE!`KPXCp zfi`8RT1uhOOk?S|>o+cqQb>s9qe?gZg9@HG4cFj#SCJL>J-_eaIi4jIAcpx2kQ8*kS=JDfi|8c5K| z?)!^1BUS{Z^XTK4kkN8zI(R2S#-BGqEXLk;WWq+a_8tXO6}PkTj2|P>bAq|59EDQvg@Yb`NS6Tki{UudA!;HINTthB$gFTysUpNQ6bF zITVokHz=JsqOUp$Ef{owh6zZ=vj3rnWR)%<>K|tm2*_)mfmf_f2RcP?b7#wBa;sHD zJK&wbr2V@<{ihHCN1h}ML|xG@r(p76s*)4_81#!}um1(9+5{)!k^ITT0e|;BCIUjL zZcR0ce~WE4{)IrVpj6Bek$#>2M4ywCSzojCzr}3-r9FC&8~V~i%8DHN1>FL;~*v$z<0e>Vf;DN<+dp3{I6>I|G@f7qJ1ip7Ur&QK7iQu zao$ke2^z>K1Roz?^Ub-tVHa>qe0;o4;qt`5pU0d)zIk$S;a#vIOL8apBVZ2X6fwEN z8Z;RUEC?a~o56rMKY#Zeynp+jU8p4CU*!@z=-{~wL8REo;OOXR;bLO>`l6x`uNEg0 zD4uos2=5KAw*r2D!r>8vx|%_d+V6i53tu;x>~(iq68SHPA)z7CfnB&rNQCR_>u5g}2TU&0uIj?W468~n9|1bTqwF6zp+|csA=hU7?N_Mcf|6y6d*KQzFBJpXP z@$c550NC^}z{rIg3H|2!dX?>pJ!aGoLgEWmfqOdxGASHv$q^R zd-uLDXJ^p*M?J_c0qVI*f-2dy;E(&ey9DVBP9SafkW1Kzwzf9800F!0cVOTEesQ8M zkVQgF{1@_=wE7OLNpg6-K9UjWEF@RA|IxV0sz58IRl(&{Q%|*Ef~hX#{+zmq!sC*7 zxj!RgVX2qLCHxM|!c`M#)rf&wzpQfD}zpl=JoZpgnIZ6A@N*& zfOG4^m)OM+V+45k1SXU5p-dk4UEsb#GEavIorUMH`{!e+=(<~lxDrRFu%N;eMpL5{2n?l_tBI%gpf5wV@iOX{2N-bn4)7;4>I#6v7zN(e64=%MmL_X$KkCx6pc= z**%%te%B-i=2rBbM;mDJN|qbdllXvUHkHlB8dTY}hoFH!rUxvx9mxDxI;osH?^Kcg zIfsv*pMSd3+Zz>qXJ@BCt=9M+pV&=VS-F`wr}s0ixx1fk)A>pyqscipm0xx#JOUJ4 z%$J$p64Cf;KNN-f%0p;C=aJLsP|$Zg&j&ynxSlSt;nGc&g8ggpoIs`IVrfuTo1bES zrPGFEFeFjMlNViLnZL+=juLe(IOc`KIH0-bGTP+9-y@?S0F+Q79KUe%}Ym;0Kt4XX>wGsfzK8`jCZN;aGU>I510>;{n!0 zR*=zwTW>=Wr|5PiGc4FP9P{2lKMgi52VFVQVT4(ozd8KO*81_kTY^n0P<+fpqKK|> zenB>)jV;s~-93b>hf+5d^@uPM?de(rNod8Kab#!ixvNxK$R24$#b19VfA-8M)5wq1 zz>WY_!1S)he69orVlgbLl5S-RQRtj?l5(a%GD$*00@&$2Pc)j9@8~bA3rhFg3IPtT zt{;(zI}c8j)L}vaM>|jJ<(?o0k?;M7+x;my>Of>{ZmlrmM_NCI5v*Rbtg!yBxXOlE zh~E^Qx|kk+4z4)6`BW(tg+jkZ;K6*k#_(3J=xLAut?@}9!^m1QA-1@@pFT$~K(~Z8q9qL0- ziL!Z+%%T;QiQ&~#%{BZSXC_y2{r`utw+@T)|K0}$k&qS%NeKZ-si8ZS5|NS^LP|=c zYe2d~5ReWDC5MiIp}U)*yK|@^_j&(zzt?_t_x;&j{$k*Ip1GcQo!5QtbD#UP{r&Ay zL_t#-oKnVb68bZ_G1D8Qh^V$>m&GKkGo}qt{83|v3fKD9^t6x__nbyD<9FQdtoBQW z)5}9qV=}=5M2!ZtDs0{QBX3TsV+P=AI)Df_i=kCc0GRMkh6@eOKi-gj27;T)OSKVi z90cJT>gee_c! zZV0LQO@#B!tD-d$oc9o&5c-v~o!DsA_F($4WCiOWp+3Xr{W}LalUEl5_tQBMmreydfYZCG79c z^rn}*y60qLbKql-CM}v`g=<%!MnHP7&%f^dv!G#_jKPF)*#TI+Y20vaN0D9zYar~s z0w!m#cpM#X|JeUYP9tWY8v{npj~zyE zlX%-DsB-Dfr0kT#JQGfLbRQty;`l(-y|KCR6vH~So9I_u3)1-3M3gM&hNsEnp8=;Y z3fAhKQSTxw>~qNY8_zA;jY(nYHW4%fzWx|fjU=y}Mw^1DFt$vB$qjnYcwOoH03lg_SOB z--00<$$gDOOh_2|Lw~KN|Dbm0M}~MqKNg+OUqQ0OqGLo~my6Ux^OvSKDn^hEZZa*; z@c}AeJkz~muA6%DOB^-v2DkWB3pJg_C{^YUjMp>MiarTVxOlmINp1YR-n;8zr&AAi z%Jz*L%*aZk-#On32o5+`-Qp2q97Yu~p3Zv~-O^Ic2VRxyg->T$G(VV2!6nADa-A6& z`eN+m;gp3Xy-jQuxl4zFa>Xr955~~Jk@r#Vu5+Qc$>T&HefV=+!)wN;$+!G!ZRe}x z6=EnX+HQ_b0$zy~XaD}4|2E}XOV%nX()O>6w`JwW)?a?|x2rV=u_m%uMepYg9j2_R zD#H&$mtA#*v~ty$s+yb%2zbABygz@>RS~*uMu{I~bq!QZN4=vJwFn%_w4JT-DVR+H1{Yb&IqQ2ow8!N6!kb0Z zKNV4Aa*hr%nls8|DE~nCSYw$z0bSIS~m`fA~q$;kZz;&%l4$Pzf#TL+O0L z2mc44|BoD^MIQU3c)}G!kfY8dj#QQthUH~0y}@M2I(F>wr{KDvClvGzIl~+0#B)Tm zVNdQ~vWn(>w)>2>!kcfd9968w10@FGZ`0*O)4R4cKZ+=6)t>_geZ0b8TqPI8A5oXf zyRnj!jJBC6&kiqXCJ)^z_dOo(*<=;h#{b2+OU^;$i0e2NCf8}}=ze{JrAy;Mx$~4g z(qoCE0#su|QY2=0KNxBeM9$BUM{gx-aDN$+X~mBei%4_rlQC3l(|su;qFN%{Hy7hw zo+0GDUKm!f902Cbit338-G~itttlxl*Dc|s)MMh7`|!2xmUZMnVz)o?_83ngy}b5o zpoW|l`Sa)RWX(f(`Srsl2~L-V#NG>Lq+`^~5blMS!S59Wb8i_cx4%wmeRj!~Q1&dI zEODX#P?xn_97Wh+61pWs>++nmLC)2Z+5k)Rfh=|S;tHB;o}yqpTz4;0i6bLALi;f& z2vx<3Lx7`wC~vX1Qg*@OQIFDw^L(977$)_ZLO>LFogJlgOIj8&(8V}DGDp%es`7h6 z;+_tI2T%x##>%gsy8lZJtBx8yQn#7fGs%M^uqcX3Ffjo=`>({Sv!h7QN3tz83k}ub zCB4r`NX-1H8GN8{n1pECOANjBR>zHv#zTWV}k@4m~+mxsp(1wCO-lld(7oReZjAmhZ3>FJ4kgo0RmpJ{-? zg$#e7P*l(%kwByUorN?LZ?RVRx#XL+Jv++LxiSX_v-C3Ur@6s|ldSXOl=#&75!XS# zI{lSr$dTJYSf_HNjI{?de~^w5I0eW03SMb}6($=em%cDNb2DO*gq4gD`_NR!xtjjl zpa}CUgs>I)=YT{UX|gy(C`e63r6TmpjA%z;dDKa;`##fGmtEI7W4cqR7Q6hoIx0as zZQ{l-MCk8A){J~}cV%O#ET+FS82gORCM7n`c2wA@HdfG{2(qwDUoWYWci@gllrGiP zGa+6`4AgrTM+ICA>Nq^(pYCL?{Tqczw*0t2lWkpQeW|R5qLkOL#MSozv0Bk8CCA@2 zjCz9J*Yy~6LY?FPt$mq@ichZm2vMzgMCbm;P^s{I`Zf75(Q;f1MjQWae4N7emCU}v z+}FogqcfqgAxX%GrkiF&RvIt&mx=EGl9gpJNSVxPGI2xG5Uj~YraJFvFo}x*FusdB zKbzxD?=9TMB3B{dbKP^e(C7lK{r!x1wCNGHWqF&>pZj*A0vofASJ!CJ3rS!1)D~CM z?$QNjY(nZ8^{!}26K!0bn+7>UqOPI9^g~k{M z1Ixcn23;;Qz}ci>(xzDedUkEC3H<)XFu5!Vr>#G+tRiSrq*Yz=VXULCH-6b;zC6Jy+-yW=hO?!g zBCd-_u%Ee#4%cq6u(|8lH3K<0J%tro9!wxXNo#o6+}!O#1C%`2waSgYG}i& zb>?C~0erB(Tac!fUBXdM^oelhk2jGQoI3e;HJ735|pbRVD7ojtyhtvWhf6{=xGG)Oscyu79aFc06DcbcT;u(g~NW7~_k zqw?oy>NCDAa4H7=F5!12Jh8!rV32nPkL#yoJtyNhh0p`4k8eT_l=Q3TLnEy`TirjQ z-G=--x5yRXr?b@TBTm_cNt`DiL3Vm{xfCxj7r(woDtcD1E1_kdv&+Pms5CAzzqb5MQ02dGA_rxgmnR?i3KN8scUWsa2M zkT5G57^G1HQkn!SEt-R-dEQYA4v@Rd-FKjR&nE75kpRfTt)FkaMn-qJGGQm^_LM7= zU!fGR$+qUItm8KhvLtE&*QAO8MV>Z7VCzPaWu((+h&!I`>n`LYptfC`n3PjPvmDT~As59ETqm+8Y5x`H z)Dtf!Km(*(=T3h=x3X%QSP-`miXGx-bM9ZzTw7>W(rr!H*J2|loqJ^U5L9ev=Zc7t zV63lQsO~&>*m3-}(M~Iunkzm;k>g`U(&xfm1gkMg&E%rS-ovXR#`|g@CFNH=-2`d= zFO>#$BIAw<7S@W$4;bYX^u^pnb}*Z1E|O;^t;}oX;*O$#dR>%%E9Liy(!HSxKYo}-oJ-p}Kg$6TpA%@jAfr6INfSFqz3`_G z9Hw%H3X%{CtS0x$Kg#(s&aC?R+9m!V_zA`r6&kr+-v7qoO;Dr7;Pw+iUUD$detGL4E2Dn>N;%M~yk5K-%)PIJS0Oxxp&b$qA52wJ0ZT`IX* z(Zf1fi@_8v%N(82Vc8IZw?KF`?}??aFzpO~%9xa1xY@v!C9@w=o|c@fn|=4B?j^m$ zZ0h6XN6L|*q1YtrwRUr^_EX3Iy(XfRRrAk{!-EnbI+1aFsse5g}Zfd5mQc z_vi4<*ZnH%aV{ciTwL5d^-KxvQbv^qIvpyoER%%iS>gE-@Uu_T_wDsWSWSiWU>+5*7My>)n;YML0tM%mHp9}ncK9~%!6-E4P z8h^fMlmEij{Id!R(=h;bW^M$L?1>-Ie(%R=xs3{+5cl~SJN*{|UlPK4%rBFCVzwQ0 zWfIQ+aHW=&!b0BTolpzXe$do3|3`jW=V%u3KDY%h6>oodV4zAuQ@50zvETK-6}k+f zFvPexM2TMGi7*+MiZaAcm*}$q)8!@MYYb(}@=>gd#l^**Bux>*D+9Rm?tUAcCu`lD zA6|d}9mJ^R*+Q=yvD|zf#@F_Lmdq&6c8 zH9P95QbQI%&D5vx+q~b(@Of1&AU)J#WyrY&>JAj$?IAJPeLzO^6Hs;O$jHd-`)DEb zHH-!>0pU8J%?{FQkE9g%AU++V6we%`%z$DSscEPUK-+wF9qr1@k{Ju|VSRpR|I`aH z$+54J=4hv3hL-Rz#}}@Kbmb-1$o#4#0v{jE{u3-X(%P7`+}M6M?1XmJCYIOg|D z4^51K)TVjf=hE=>YAxnx=y~Cuy6<%*B0TK}p@jP|hOqk7!5;~OFT$bQhLsjkVwdyC zihn?ZF!4^b)yDV7Sbb%XbLAaCkHjPCBchoBxdw!tXUfQ9Oe}YZ8GY|;CEZWp0)Jwk zs(HOEJe+}QX82s_>A@iZS2tLN<-4a(Lkh2fZ?-`la0?9yH&+ZN-{`_l{}ez9+D^ai z0Ai`|Ma~U!_*GE#9-*&$Z`awos0DKH0JNSDaw`;pmnrI2%Il%FwJ^sEj3Iq0kLtTv z5~tHO#shpib<8`%f4+*_-u5y!&QkfstJm#P6Ly`vq@_wRPRg#`11KWO??g zTSZWr52!}(s};DG)gkM!7&47ZY|e0NvXZvZ@%^MLujIdM5fh|9VSler37QTFV&p~u zs(z;}D4RCsG;sL^AYr5PIfE)VUnD$S#r%3@N=GJxhlj_yg1JJlO4%VA>S9ICpg}*j zl8?36IHy#nSd!yz;bZVMr znt|Pc1e;#y9*{^S*e^7EG6aT{{{$?v%{{JG6xXY#?-@!=b2jeEHlJdQW!~)<@Ve|i zFDX;10igB~{Gpj9pkaXoQ4LUagAZANOW3Cj_f=cZjd^h^EPL~4+`+V<@LA^Z#HBa8>=IT?ZTNaND zBu-{!jxUf+e=3}qV?Jj_Hpa&yzu<-}(~u3wWRXiUK$?y{qFfURWxW(nRD zh}+kC>(VEm3N3-vTwQzi`afB+I&;$G+ymFdvceYiYwb(o4()7>mc74|hQw3blMZUI z&}IG$6j}bl1V|dbP`g~zcVSEY{sf0K4WtT!fm)>^ZCP#IRWVSy9f34Ioc8-B0HRIn z4)d62*@J(G&|h@$U>AdZ@2Wp>t?PE|4Ez#&w|4wSuhG6qVf!!^a1S?}Ty;lXt*M*u zjG0?7Is#sHpX9irgYw$agq^Au4W~kE%FvTMGo;!qqh8K;TjO+kW z#mht^Ql$~+oQ88`{zMJC`Ur+B{S?WRVkN$VaD27V-BnW~0kWm|g3fsj*&Z<=y^!RE zQch877N`j*0C<2^^5GWOda1c7eB#9v^Mu=i%k+-fUz{1B(;)hsaI~`APcJ|#aw7;KJ(`?U1;ABFsZiPj==Y9l%+<CKwwUZrx{y%NY_5%}Wze?VYw6&=<-|ShCK924^l+L~`HDqQy(zE~pouUB zqgjcCu%Ju!;*zqOCz|OHM=_ z!Kz1%D^1+pmVw?}cdR+o%URwmOFb~io&czAl1p0qezLz3WdWDg=O^JD5Q?9bi=Cex znGfk8KU#_Bo4P9ffnA?&2BpwpeL%Pk8$6--}wzOatxumCGXz` z-7Bi5;p5`gQgNzFp!AU%UGslfvk6D+v&94O5$GD%#rEzGcfS2)zIRknY7e>5KHnE! zwum*}9D3QtO^|WsFiGFw*#i;tPt;@_BMwM{X#aA5*6uDyQTQ5|*c;gtZw!nBi*&r1 zhA&Q2y|()}Pf&}xyWV@yWGi#R`}gR`*b=%?WY;mfL`nas6>l^Sh{H&-mC$ViIa}?7 zmtTYUeR#Fzj8HOYoT4E2}AN@8MSvW2k1DF7@aOU;*o!4dCVa(?z zdN-O>-X4dzC5v|lNP0;zLL#&b;QEZtgvrSW04SRy(-h_u{#e?VQ&@_o20c{YbV@Z>8nI3nXmEGAlo=YeNEa;VW9Xvq84Kgg%Wl)(wuZ#F)y za_c`I&sRF_od=^Wjw}N^_mUUhjqI$ zMH1=)G30IcirQQ>1ZcNBQXx{D5T%%R?DqY;(ETZ$d`V~J!ZAul;`p61o@PV(NLz>ks* zapX>Vda!8-ZA^P5S*c{M93aTwK>aIckC>S5`E#aeu;k#Tz^R;~V!twXQz7ngb(I)U z-)N8rnQ?roj{GsMSI_)=&6`35i14S!0c_4JJ1`-RGT14LHPN~QlIG44uHheib?vUl zbXj9J=N!58!`@Kj(~U$XvO2sUE*K3Ey-mwWXs^w{ADbr`eYE`ymgtrBL0lC?Q$6EfD8N68Q7JvF!J|a+XJB2?@_hWHsPk=(y|OiEz-K`R}H? zEoSGeJ69@6IST~Z$YtcfLg*kpcVE|n&Bn$)^pg^_l62Gm5ar?;vVBc-;-!$AJIZxM z>vvPnM@gi9`)G7o-sHUD1 zO^y=0I{FOX=If&LXnC;paNSrcA5#lJHAzoB@NCnTZ(F05DRoB{^4h<5ju*N1mMA z6Uydp-8aN!RLQw|dU{jLS7NdsgD?3u+e!@^2hGGpMEVfVsHv?42@|=&CK@ZFql30$ z#2Yd97?>GH>N~E550y0}g28Wmjp>jZNu@j?TOhKI4%7tD5&LaRai`)c`d^rBz`F^M z=epU>Rmgy1AK7DF{yYsX5p|M69JFpOi%zUW5 z-aOPcIeJBMv>X>1ct^DSa$ja5aHJ@hjBRS65QJ^WF${EmtI8QQd*_7*zvZ=^c|(fF zI3amyRtfQInJEK5eCwP?x?~yX__!;41_15#iIjig)kcz&0OH)?%g+<17d)ncD5NPB znMQzaIIM737_(dYbB7mpycHkJhaS=0(LrIkj`Oh#7)St8CUoC!6P&@&x5LW$jYUYy z!5EC6IOhN#%yBaLgGNkZTCd5%P`09l?_euOdbvHST3?@&LqF68Y9$UfJdkaC-^jiq z5U7)MyobOfK+q_g-)ta0oxq6%htmK@Pj~#*7aV=ewoWxkB}=`yWL8*R#)~iy%KDqX zw`T>CliRzaBA6kAkjE0ehrO>W&uYfZcAE)R4D1}`HO(^l2#+c6;JPwYb2WBFZ4Wjg z8OOR8HI5xTGh0jvVZu>?BI%y#cNAD+vGd(+)fD}=tr zP6X%wW`P1Aq2*h_ho`JkFJ+y{GoV=$Zei%8&zsuR%Vo!-3-Er*X z;LC)crb({9Tj^dp%E)ol7(PvE7;3kc3}oR@n$A}(o+bO8*;l2c5t?95cRblN?}UpR zNAHgWa0?H3J}@ws%rWd6@d6GHR3BgyXZAxjrennalHtV^vK$yT^ei&b6fvALGaajHI_`56Fms~j3K1nZ6gxyS*Y`VYt=LXp zK8X2U8{+XQ=+=)uKj+|>PvJ9LhbhN>aOf;crgxur7|n?ja#N@>$L~0z;%>qVEu$6a z6}6F0uS?u0B;?EKC3eIkeqjoYe-lDK;(O$^#8BmO}|UyFs%c`c+$jCPXX4@$JdwIj<=3MC0e)52CkcI~>() zdS3R_2IzboJOHuDkwU)MZ5*HGy_)0CmJ>DVi+!9fQWbB*5?OD&qBvb|m}TY{x_~SR z$-)&Sc6Vu47k>3>kikz=bKK5RDRdkln#P5FtXGQ|nL`2tlaq0!U)c65Cok2_0=cnU zDtB1e+o{CjVm=E?v?CiicO4@vE)YAOoMP@!Z+zL$Zr}6JbiO*r$NfJRo61glJl-4m z)vVQs<8UF4Une6)(a#w7YP=mln-!px<^(s0b76i}&=4Tz$*pj88wd~w)0^WZ9 zSmnHnP=*nU7ZQC?XYL=eOU3Z7Ou7@hYwVSB$G4tQGW}E=546Nh>czFa>Ug3wEb-X< zA%o^eNkogZihW^3NwxKo9?%g7NJlq?+m_to|40hAVER)O6ThsI{w>py%R&-X&~`U~N2fwx<}izX32Oz03Jm6qxx%3${u`I|7wK#Lg*DQ_>-MiRya9w3U;!aMjK z@w3VDzJbVc#cb}cma^gY5lQ_@FpG-2Lb^H0_2wc$6;@o!p+>q8fnY(o!*UDS>7v)s zFYrMueE=YNeLh=ml8XZfJb)JJQvb!zq+c_i>Ao<|ZVJLB?-jqCH^-%q1`_PtO1i4h zxfgsEl;ATG)7ODpz#G>lHwL?vIWWstQ1Z1#X9aY1;?fdw*^7{y5@x0~U6yQafU+Lt zh2%zH-7nt8(5tMbxGlFxlO(KYQZFB|FFo8JSkQed@MMmm5$)=em!$PRwzTk#OHQ^j znD2L+Syp)Ttn~F^aXB4_qZuZMVH)h)Wa#F5j|}1XLC#QCTdQo_UB0JZDe+HMJh((r zLjvfg$tR*5UCSQ3&}S1E%mG&CG#>Y;ErBoIbzv94rxN)nGfAP=BG1G5`i9U2+k?H! z12I~E6EVE$r~M=#Xvtr6kGPt>6twnrgtZ{xFMthn z8ngOf62udvd-askq&~T!r)10-rtk~87$;UVIQUx4UZIEkLc+CTe-S#FlR1jDF8`t@ z1S==I3D%@ir7f&f>p?~J=G)}sXaUC4+@T7bNLk9@K0CL&4!QO57ds$sV72^wvDByx zD$%F6bS|~haTb-!ld&nQzN4nnN%+g|PP+a7A9sYNX|vC{_ZYG;v%lQ8=+nr2NRTCNAMRP%AHz@{}UC zvnlmoKDelaRN-!+lQ{}IO#10u1gCyY@)OwtwSzpMiK?OLT-eu2lElpf40uEm8>VsU=c{LK zhRaNy#=VS`dDP{Cv4-vFJ&-)w;J2LHkZj^BdO2Ey_87B}@HEzmwzbp3?0e@KEzq-X z!;Sa^`i>=52Keaap&lRHcINmI8T+0W&1zdTBbfND$2#Ox42lS7L~JF-iS&t|L?TI@ zDB51-w2lhG6n*Nr=-C>BqG|eCy&?&7Y#a}yd;xe_D)UX0lW&6TWnhRv*I9n5eMRRZ zIBJv1Y^>PBi6nr&kntIn|1pi*ya|JIqpMvBU1+GzWBhcMfPH3qgkQa1sF{I2fM{!P z>zcbesw%d@k>aPu*>ZAjjPJ--*${pxvggk^0Iz_}xwMp&zqp4qmAtf&tF28@!@@f$ zc+0otmhT|RW6D*|O>Bfe73NHEAhgY9e&1@Yresim>nPm(YkxrfM7@(`#M5q`3Rk)82tiRx@!Ccd83 z0qYsEl4wAPEQ$4e)}jPcUizJqbLbi~2n6C@VvM5aNNYU{Tr@Fbew&oxvvDqYtNjF@ zw5lz&$LHbBW)|ua;En2)%=3sy~KXhCW<-F69pFOT+?pNZK< z$4TxpnsEhf&h!G)*i5_^;u@biYvMZs+bb+OWqJpMUfqR6{@_~hDhf?!V^18YToZNO z$(~c3t1z4s^tCxpJkZy=b{6)a-wp&lP4e=+VE4F;(qTH;HqnfobKPd(b7)k&zaArb zHVX^F8@tbqa@3#djpp2YRVZDKN6TYmS_M}m?CyVekXjbQ#RdBOJIW+m!KUkIiBVQj zbpm_T7(miPa$iD+@;`tTa_P^+Q4{05)??KomRym|O_4b^x9>R$^T%~>R-PTFVfvjv zR9-TV)EJsKZNYr5n~!dS1EnZ)7{(-?`Jxi*}e!a z14?6+!vxMJYCEi0`p9DmuR`(Dkou-vmXcZ=#GKW9Rha7TqGrt=(uUKWA=PaOQEul` zMjOK+lN74I+sp)wr%A_Qe0xJ^C>K)Eih*=tg1t6@ZyWTJD<+j!HsD73rn5Y5 zHLNY}N8YD@N>E{^V7rV22!Q!29o8}^%3FuxXRegQLIvDS*YfwBBC%X4AA{0=Iq+d# z#fV=G#i@^X?eEpxiV&MBGGf{wx#7o|VB@nz)%pI{K2e_4uln9|H-Z0JE-IvK4M>Yq zT|>`TRS3l9$Toip_uNJaH|t+cslTpui_wJ(VtIt83LRyFHGIX(us>q3p_6_Omy*w7 zcu!pTKObAf=tsO%s*aQKF*4qmtt~el`8XguXne^YI=LY{cdc}{(#X%t4)>c5AoaGB z#qmtkugqRw|2sM)iFNn7r0jjzZJs%|jr$^M$Zb=S@!`ZmGsV&9Pb)hb}Xhum-ZN*KCK zYT8%*hI@*ZTx%6kB@Lob)?hU6Rk?htW^LS2YEELlTlc!lkk?T&fENQyX5ey=I(CB6Vsu+_w7EbQjO7waCQDqq9rde|(xwQuo{|@zYYK(% zgB}6es)xI&7O7@FTEQ&}Gl}zdVSYi;py)l$UooDQ)lqLNE!zbV-)}zNbUhQhCT6v6K74tf+Sg;8tMhByj~nr7jOWl*2ZWVILI+cme@tWoRd;8~x|433sbcVASP za94r!lOxhKKu9Pcf&IV*;+;bJuE2g7`2PF*DJ5?_M7-_YU7=nfkV+?(pGcMZ=T;oH|>t0WS?&$MCZB%OJZcC+~)(nv*(fQLi`fD zH)NHR+!j0C=U)Cr3`^?ZhWh>ZQrUkt|pOzF~Awbz6cci`>8>Ql_P-eaHTwthY7C89ge`PmjDD zk-K4g@UvgAoz^0yE@Vn*r|G(8)M=$gJ4LDrFn3R>f#b$|e7Z~>jB5KsS5o^wUH}CE zl%!dJ1V19H?9T^#xKN(pT1v=^>y&P?j7`Sy1#cGMRKV(A~jdQ z@cW3to7C=e5xj%6>BXq3jSF82(Jlcja7f%_aPJ%M_5tho1&2tNSRGT?&4TX_IMcBc z$_4LI!1qNPyVTG?*|YDobEdWw!IlP2IVJI8bX|)YXEFMVtPOkf|M$4`KVfQs4ZWnX z#1@h6M*3uPa5FDQ;!=D|=i!NOZ(+e0z$GUql{AbGLk zJm+SwqHYgiXxjffogc3z+~iRrTlpf5E}(ecXpMr?Y_{HmJu&q&gTxB--u-H~uH=QzFue$lsz|01`#{sl4ZIStK zE$*9;seQj^k$VpiedMXC=bKs-{To)3`oy}J7`is@ih@TMcR}E*qw%@L3zD5k7+F$k zU%&AuExrG9m-wHj@qet*7HY+ie~DTd*R%!Ba!L4!CmCF+skq~UZY+Btf<+uUBO$OoqMn5)I<2?p+&s6W=#x> z(^2Erkn;iIgS*Ju0CH?{x|s)VgG#$iI7~VnZ&J)lb-4CKE^b)xNvvIl+Zbii!XBE> zW@8>?EB|$nY3;@YU&AK$-79f4pa4k?}+o z870y7NX3Q9V)cWKzh`5Y;+BeFj^k)i*XMhJpwwgAWZ%`yhnm?y ziL+zIFOQ`fEYmgJlw8?2$ToB;3J$B6KZgi1En4cKcm^2dPun`L z>DU@no``>0v;G7cBpe1K+^&cf^N$u?ysnqQ&7$z;l`sp&+tN9Qp|Y=a42EA%%m$Z_wj=^Z$RtZ`)k%qbIneg*J_Jm5~vBjF{jfc^s(misC_Sq zD^u9k*0fw&g0(jfE!7x|U=5|?4Hnrrt2}K?mrO*#tB?L{Y52V8_WrsaaWS>Ued0Ov zDk(2sO+ws9)Yp0ie!GT60&eS0dSR5}BLo~aPA-W&aqh2$#~s$4&v_tk=g;Pq%WM}( ze1IubUqH#TVsJ)DR1^Dy=_A|Bq`URreTT*4vYkEf-LsnsRgNT6L67T-Bsjy?k?@O$ zAU8Odyv0Vz{{XrF+YxoDZ+Ap;L5Se`pe)GDry64#*6i=b z%eUl|338Qy*={!-*f}UW0L9gD!uw@H(CN%`3j$aMV}MhJiUPsb_UG}GfGCxH6IxiL z2_e-uzik)ouur-IA0UdI^DuE=etl7Hg4q9NaW+*tc(KmC?6gKHqRvq{+Siygy)`X< z{5O;~W3KW*91ofrwXvzZBQ&foC~JmCyMELMp%1A)UK8Z?7{rLuk(B};2HVXvaLskw zaJg>b>+hq-gS<{G-7acp4TiWiUz6$G}l`hWl*^xY+!!Ayw$B$|4 zj7sQ0(n-^n_>pz~o296QMNCr%q?SjY2_LDrEtiv3407hBMYL*ay=!!p}~1pY$;uMga>qplMDEmQY~yg>=`#oP3|(2uz6|B@2?=jj88D886^ z#KvlD+j4amL@2J5IQ@Se^1tr5F^V`j>XMa%grNC@*{=zm>i@6j0PO$9@(gb-srtRc z4CdH{wLkM0jsE{R=qdKVc^B{1X^_8Iy@6m-L9CsY{Qot@`OoY5Kh9XrMwEOlnrMkH z0Qw0CbrT6hwzH~C+Jk+l1}iNrt1Z2;iJY3}9qsNHTdHphOa3!q`j@l4C#JypUcaP^ z$qAyYwVnL|IAA4!01LurelDkdQhpS31VYPxXJ_N;1z2>R{B}#t?JIYl7Pa=me049s zNYZjMcShje+3ps&jl#SZ3=Q=PvHX$+vrM>I=Avl8ff`F`rY(OKMG_vFlFJot_!@PKj?f zygKLtWI70i#Y*=|*!dp90~)4NUyKjCvF-CtYo9~LKCm1f4I|R_#Om(`G8W_K;{^Hg zezoTiM#p#LwDNSvWN5GUr0|@>C?1ntnM!nt9VL+$q2t~TL4R*j`G#MoD01);4I;Ek z1uFeI8w|XfhIbiD(;26*&&wSK?e*N)$w)qN*I{kk&K)%;pKQ@i9AzLRxlixd%li8k zxN9oY$VnrDhCh+C`3u-nW{!6?7@f7Y4OL%`Hg;680*Inlu>oxD{9xrO|z`#+Mb`TNS>ZbTe(f)q(_;Zjin48 z%^&p&>RM6MNsK3xY@D`YEZAI}Do}3WJ7`xx?kYX1t+mVFU;=l^+u)CG?AqO~O#-Ff z5Ujiz@#S-N^K}_{L>Gf7fr9~e19X{osh_G@)9*aTz=m?sWGX@oy7YA#u#usE#qWfe|zB$5v=7zlFYCPhk?Sbl(&AMLZQg@_$&Er(Wy(I5wwUYwW z>c-Y|p~eRk_8_=-?cGW(QC8zK<*z`s!Dj=1n2ysnt1qySW~agZnqKg*cF`Z<(e5vj zRdWH4c~8~knR*U0F44t*=su`*J=8Dw_U*9Nb#u9-{`R!LUUo{GIGGA#Mi(;OxcIZQ zelw*CP^?*?<-WO%UB={`eojb-pjb?cb9lllFepsgtsKMg3%@) z_im7yS)`N4&$q)l3IVleA&%Qz2t>gGX@rq&3)Gb7MmHHgUK|HG4-%h|@sUr(oFqqe z-E#Q?zMe+TCy4^XDI?xiJ-i`$+~pA-xupW^PjJ1FtY)~brkyAb6JjT}(yizV-BC|$RO>B0ExY@{>5RBbyWbI}vDfkximN58;(-I39m1eg12|V~9 zOZj^*CcGsL@B|xSMISzRO*FJ4Zpqcz=}p;5>XAK~rmn7O(Ti(H>sh)14Vjj08gfd@ z;2~Gt66m|U_Zt!;$2_YSN`MXI&h{%G37?H+hIjV$;I6&Hi`x3q6OkOlqjNHS&AU|+ zC#~y8>=cW|&AI8p7wa2pHqn1;MKT?yvk*t_5uF4ZFpE@(5$m$LIQ}MQWJRrEPfbOJ zYu?^S34PSf#gP>zIKxGXdo>!Q5}mjH1hzI5!Nt*GDGZfz8`!YY40{5JErSZWwohTh zcHcWtQ(@w6c3X&diA-=iI}WwhiySbPiST!3 zMFs5rs3oqtRE#Xy8VH$&y)V1oPcI|rCQl{b4ukb*h48yrlZbnYcgQSu8q-Jjq>*w| z;rLpeUH1rV@jGT^J|{EB8_Bcx+>R7h_l)GcHwORirMgj?&U7^XZa{b-S0*AK;JD(m%dfka2&M>+cZ5QbWhd+9;p-b zC8hv3*`YKt@QHv4yUpiUTk-}redp+uW*xsaJ$c@8jF8%`QZ_|Sav$+MwvkN2KAs~Z zh-hnDuNAmw?plR@-9Rhv!EJi|w+Z%K0IPGVv%fCn+s>RjG)z|fbd(RQU;dq$CiBYl z-S&vk?@=etGI5X&2id7iWD+~~h_YB>3VF|)i-^I9&>+`1S)Sp+*Qakb6Hv_2cK2^G zWsMHHv4XbahF zV^@ZlvFg_*tA1Rofo@mS_L`@O(HjEVDQt)gy9Z5xgeu2Gh)`3n2iD6{oi7rJ4+ZwVCmzx)Ab#8fI2qODg?PO}R5<4xyu zZa%sF-)Q>waHjkJ|8S#Pk<{kcilQ=R4nq!0g}a2?tukTQl5@orb4(K2MncYnq;lGB zhaBbd>llC4yv` zyJd&!UVqjq_*DvpBeN}PC$4$gqgBnNS)x2k%0Ca%P-3ki`(^7(qQR(1H>?xoW@Q2fYKTep*ZL66;JE|j(e2U8)svR3-U&mU`YLlfd;4jj_ zS>xAl~I9$X&fcB{W&UtiI}} z!7LgAuQN$SGx9wH#<0W0Q}d;$dXw7l;qE9SH#|wXnjRgYy>zvVa17j=5?ec#m)@Uc z`9uEP!?Fw5GvrzgwdPlM7G4I%_LNW8~oqVG+nA0)`H* z-Y|kLza?8&VZ{j6{NOQ*`hMWPZ8~`whe~Kw6r<=bJzT{=b*(Nl)&)L;b#kgE2md*J zLcC?BD_YKp_O1n+vo^ilx*Ws`5Gh*=AWw4cgUI3Q45EtLD5GX@LD}7n$GDB;F$yLa z<2_LSJS9K$q^r1IU)FKZ;sR5TL7+!`E(^pKewwG42~)VX*^(qV z|5noPUILP=1YffX%)$8f->B__dfhMNMS5_a=~TRid|iss$+Nq6EiK(@>=qC%h7z9( zRve#lV;R|+XG5g5+tXhn9}h89X-h_@>b~T978i-pmB1i}d%6$N6k~di0yiC!ixpd) z^V%>{@jgGIB&32om=i2S!lIf~n#_6o#6%Szj}bj5yP z=?QjAMoH^daJ=@f)bjVFB45_UajCfX6AWDt+EG+fqXX@jhK^qUpnY6;cjYepgXTSJ zn8Hq|9n(ag^sjt#38{xd;9LFjyE59>>tvXY;ZwO>O(TjQvn@@Ecrk*ZNyf9iftf4a z!Avj|54%K2wB=k%+Uljf5Iwc>dIZnr*q(+66<-JlkkasX<@LJuRvB0PClQNm?9f~6 zd(S8+X4Ldk8}b)=PQ$QAZpiF7orzh>`6VMgo#)*x#{4`=yWCA7WKRNF#|TIQ#*O?{ z+YsvI60~cR29=Uo*5>gYo6aSC;SaTkliDgdS7h1*DH(S#udEOi#TnZ#m5W1rXD7U| zVJm9+Z(a&=uwEi}|0L-hB`TbH8rrpWyj2Z8yDc26c}1^_n`}i=kM%dg(1BFMh()%R zmny?Mon6=5ve2%%`@Q&EFrj(D1IH;bDoe|jEta--t;JloBP6_Rwi1*i^PlU=H*8V&Trac#g^ab z&~H@nmQodAYk?>JZ}o-_BF+f?Z~fZK)#)X6x-;r`=&>H%IzV9O7^kfzdOtSIMSz!y z9(P&F)boTEevIomIOnZ5NdUw;Vk^HyMkb=Kr5U&IPi{A>i4}YOIQF*Eb>BE)cHJ?1 z{j*o6lZr+l{rsuJ14h>|tqDr8zWy~KrjamK#k%`L=@Oy@jnS*%|F$m`+f#2?wrBw< z`6*X`rLIZ)t{*VLdGw6l=mK#)5@_g)VAe^s=ALwc)(XAI?p^PpsDKVB8!z-zMYEvw zk+L__EZ5!g2jOXO4Bb+(acv0Ms;Y4j{Y5^}sSpgoU^=rWJ*C3Ds z^@^?1aY_Nj5patK_&}hWw&4rVv@5TJRf-yivkog zAn|nUj7W5T`R%{hNBBUQX{ucj&-o+ijS|ARb%lR80rE*BM*J8ln#SA}>k{JQwsBP! zG%iU;gC$24JggI!5-zr%XP7=TNfM!Qd+A>`+5)Qb!F-{H?yiJpU zeGrJTDG{6Pnz=iW2yryT7fGIjS5q!e!ipebpl%?DS)36e3RcERBP#4^xvYpSd2v2R(E8>Z->`u$=cNVjYsccJrKhA9ok zvzI-~lQP*-d|i0gJ}5ylo}SFLmIpVhZhLsT90GY#9~VKI3p~C>yhkx+Qp4|i*7#=# z*rz8bu4-_xnUtvVuN6=3zvvb0I2V&nVeakB{GHZ5RhFG3Br8=5 zeQk>}n3Lv|P5yT$(+wB%wXV7=6S z$^l_-p?oLzcYi)V9yqnul2ClgrPp8&{OI;YRN8q+*8L0cHv%AcJ{cwO>Av3>74zl` z#i47Gy6nG+RTpbn<MWe;x#BctD{*_qczy31&`YR@vkE)}DV}UsJ)iwM9{#+th`Y zC%0g7F^&_WChTH1?E{*3>ilWpi(q0a|1P=!on>sJo2FS~ShxS-4=lgl^p}?8%dl{1 zsns-ZOODW-uz;(^A~=&ac`St)8TtB8(@_=f-*>14nJxZxEkNA}?&C%>3S~u{^12eU ze+za;3(RWJ=6*?+dsyvrkxl3{@$sF|e5T*0;FFeHWGv()wp{S1Gt_(lE9^SnYPf9l zrx1SoYHBArq@ZxvWT*DCE)JzQGpHCT+Cn!m?-J!71~bbuws2`2d}Esr8T}UV~CL zZRn?M6!f&>@^wku*$ZA$=(4#JA*$xY{bSZR5P4KhRJT0En~UJgE}x#fj?G5x4TIPT z8xbfVh2K9(RLiI6&?9&MG-^xqXP3_YWG$WL%CQGEJpTHvU1+;9-C(_o?4i0{KvRT# zXVAsKZOc?Gv4DkRyzszO<;%I7u6CuzTKJ>2PCxwj#6@x)8FK0_3Ioa_Si;qG#{6fZ zE82+mq>ci!-g2AZc1MFqTIY9;2~hXY90e^<0MK^Dyz4NSo-rytp2sq3^S~ravvYN> zPQ8fm-6|vRzBU%kkZ0p;Gqs|>HcETBGmS(eHM-pv$h5ft#03}+B26)>bv#{EX0y9u ziYYb?2Ew@ z7#$nhKquwc7r`vVg$0)-TiFww%&SDc2-nl>{MJ)Nr?2VFFxTub%Wpj9K3Pb{B@r}u z?b2RXpvrWU>U~Cswps0(@0NT?MPt6*obURQ2?V_6yeMQVYr=;?ERk6DBT)VGizvLTntDX4yi1n5qlnwR4q&moYpLx$#0|q56RGLsHd}^G{8rxY=!yM|d|zpv8Zddh)z2=AN3? zwt5NrseGMo?$p8VbdnZZEHN6tq@| z<_&kZIQHFfK+N0enskBKpXYRtuS=aX)w2Y?m09}d)^3NBEV)-OTd%~NOa1~b`?mT~ zn4J0EkJemv1Oj~%a|;GGfX2KO+z__dvgt^dsxYP}LhQ2!-p2vGU&L>#W5Pbz2?8Iz z`FPbZO=o-+)0+rclPiJ3%RX2KucgfI4R?DxTFx>a16@Lx{baa=%MT5M`dDeAr9mkW z-6?)R70`x$6~1Z84FR5?d=~6jXwI{e9;Ru2(d53jlpph35`CdlRvqb%icTVJKpf(?M=@q;2&Xu%u>bcq}1)?$c znrxBZ-@5AL*lqN8fWGOF2FCp3K=v5IARO*f&L_pKeBXC9mbRt?l^W@foHMG}fAqlW z0Z%wZX34pj)-N%T#ptL+8qS~Ji>CFKo#FUQzKCEhJcVqf4-77+{|m>*T@Sy5{2sM` zzJ_cq<@0tx4n8vWS4OT`3Gj9}$EU8J(y)qzt(|lL8nF${4s>!F>$KNLO|@d$bdyBa z_N<+ZB+)GGBODk;LG#*Zv7@_jD%zYys$%qG8D-8?-C~D^GTS%xY(}#-s|Dr z$@{>2J1-D&QJkM=e}-I43b_Si*VpkT>F)Yv~9wK@sdD|HX_)2l5x*7AFl z)3L5h2C;Zs%{mV!x^>0F7T(!&eUMS;*r%NpdJPuEXO^xFr#h18GK9ssMB^Uqqp65# zDGcjMlGf6_ZVe89O%BEr0p}_9w}t`j&e1P&vmcI%nRH9G-d`OeEs7dkX5I~5n91&I z-BeY8&nuk-1(WwlAke)rQZ)6kjQ#B2Q13w`@a-;{$J#A$ZdldP7(+s?9G`A&9s`uc z&GuFf2DWQibRIcp9Qvv)8^dl_A|rrhCwYkb#`I?~KxWc%@Odw^c8rLBT#t@fZTE!@ zHAsqvtMfq2g6N-Mn0H3_k}}7q$gEfAMq08wT;n^Dmfmw1Jo>D5>_W_@+dvi)_Ljg< zg4WWSu+;x!h|j;xwEpXkF8_&EKzWhTtuvqg-f^=FM4ru7)!8LWlx>bny?pH<^70J< zd{(1-E-w}&;Tzh~q&t^B=LZL$z}HcFqJUar$k zJ8jShy(c|x)5NcvA0fCd4C10|o7hIpedRILmc^rTehE^BDnO9U4q`%Z1(PbFuR3HF zfLkp*^fv^&5atIYsTRj_r|ekv#m(abYVh=V?RClLEm-_v=>)G>OpGOmACtP@P-520 z$nMW7mXdq{InpAQAu}8mVDeGS-wo>+t1MIcQc%KJrj=~e{0;=7JTq1r0lAjBv084l z@Ow5K+G*^wV~^>{oNT@BlwH((YkYf7kgM~e4HWzi0O$%2jg<{+~aTsuUyN#y?%f#+z?s~kLW2-oWheg(RO11oBbeW0m4ItL$FY7rvd)%~8At;KPz@!d>x zf$oJt91{4TUbjMfb+5yk4MQpF*v1VX?3oH6Y zPvt>$TY;@dK@$hL=FMrqA`h|O{LYqkG-tEjA05ig(Rj7d-u z8GC-j*`ucJ8fIQ~m@e)0+JTT~Hd?5+ZA0gG*f5bP4<4qR_dZ*JeF*h>awL>jq+CI# z9tCaXOe97!SEIU4ML#dlk>jZm;c z`FqBg)HUr)<4>quQl+ks@TUH|r9|T$+eXBk@%jg_fyrTWP&9{8&+C)PQ9N zt05s>=uVQ2c4xdX)d=&FgjifV+C=n>L1OORr7>FWvpLddw-$z?kGL)*YPHKYOYa%J z@L7!0BB30cCq6*xocuRFlC48YhRt%b*vD%&7RH`tb(4C(zS ziw{q26`jU$Hn_J{&qSpw z-KLlZJXv>>J%51u2@RVt!I~G*X|4rupW054Pc9ZwLok%VeN%b-2k~UZ3wYNix6qP- zPA@zh?GNR97a$-L)TTdnJr={hxNOscb^a0jXzEho*F5I1Md26yPc{S1lqJ)xAok9>&RyR*$AjWKO z^Y9VyhI_omcUCHw(V7fJPsb-^4!0DLfPzovjsTdRI2tPt9|NlCi(9vWYn|OkX$x9u z?Fb^Qn1%wAFa9;)O1c=#^ME^a4!+9?z;IF_aY^{QsLFI^QMh*oN7$jkag#6Pe=QrRrLFp9%)K{oj*QB zB{6rAFP>#zh8+*dz3yarR^|jrm@656ijb|&e%PNb4-IB*d^TK2fK&%8%9r>A20%QY zLG3yHK>3i;%4e390wu_1DS#JZfBp=T5drOmg_dKTR@TcMFh{;T8#PYPwIh&!s}c+| z8x>3blU0vtf8LEAwA~KJY|hAvU!B`K}Ves_fQ*jWIwyVKW ztVr{w&K-`3__+6+pikMMwDOjayXb^{Se~)*3|X^3A_9@A0d8OYBF8?l-l!75G?{AA zy=i`wC>Y>oSwdr%X?TL`0W8Y|*lB|Gaeyv)BMrhgN%UG=gp-P>9!>mr-K=aeuLJ;M z=igQLmS>x@O0~-lg>Y9UJ*V>mw}@1#Q502~{UxtRV&8H`+@UDFxx294ulp#Pi5JKodCQ zFS56Qee%NGAW!FO_nK4(?FWdfSA~2b zVAsy_Ho%1P@XXkM&bDluc%&E0!V(NtWH*_{hc>;KEKruJg{5y@hF04hOBS_HD~pTx zI~BKm0PZ7`l(f|uXC2bIxRDQi*v#)RQnI`_HoCjG_azH{rb!|Smmt02F77KDe2mCY zIx2at#3uy>kQ=5Bvj^{=1B@{CYp6nF)$&b6QBhH?e#nOR^OjN`MMRH1ns_4Rs>^7vcR1I zZVGRpQ}p}Y8<=YtmQUpaL!~`S#V3VAupE>SOW+oGnL9G?P(KwASBw)a%)g^aauXWP!Fr9&Arz zez{WHmjxh>(reaf7r{F?K7(){_u~X719N$JRF%O$PCd#8ttq2I;>$_2EY-_DjiTyNTfNL3~*>%NhWT8bqYJrxWyj;oY-)Gaq} zXjvr@6%Q|yTleb>DNe9xpMHV>F4)>&;Yq*hoo-Q-l%VjQT{u! z^ycN%^&SJt7R|-t;mnm1w4=B|KmP9~6}nED?4|u{Fs$dykOO`F(5WGYzEjh> zH_48rhy(a#P>8DxRkGgDV;<%hhAOk9G(5nILTlkaoA_ndR9p4ngrr>KC=Vb4udnpD z4gXDoYKx)p-$nt{jj`~{22^F*2Eq|*HNFp-FN|I$?l;q1qqa;60RlN;xkdF)tU+2F z2JJ4-TR_00ng>lhPYHqm4;`%Y!lT(JvoV^JVcnxroVSgHUSH=GM?-HBvWF`VI4U{#8Js~-T#{M;4m3z(uNzv2`W7-0 zyyy(ChS>+K>nsj9Y<}kLtnU9aR_zrik8ka^ce8%8(ag^GF)XFh6uxbKA0PO=6&RYS zl?3%b=8EdF-tH>Sdq(}7Oxj@NT4<#8EdQD$`Tbb=`k!(~&}Lt2X>9Gkk@JhY?=-kG zkNJFNT$`>)1@lZ`?@T76jKXn0XPQR7CDiRS00Szm(=)pDH$M0>y?*7la_^T~cs=}9 zr|#rujAYj8?tE6+DO1Na%8l$$K*crqBWo_p6&YqdawEi+v9fbJHNmaj!QApgmuRDf zwYi(6CxDN)#W=*>qDgti~^qQ1dKa6AtSyAtn>x93_4v0+`C zZe6Y0F98fL0J_`g)Q^4yRTT+$Z!SNUMuU`nGchiTvtfXKe9Xl<1sOL!8+(^XLkRW0 z_$bCxajty|vFByxTEi&u$)fQ9j?FQyVhM6Plo|aKTHaY0WuhZg=mdww574j<< z_3FVUyU49$`1>MpWGeaR%4Gbh0M@$ioHOJ-1mkVF-HQrAdVT#*b8kH>^epP*?#nX$ zhX$(?<+}Rm^SfVn_Ah*U+!MaoAfWZ$1294Gg01b+_krm(J-A=_-w8OdPKp2e$)n#L zig!kQzd;_j?&@&M#0R7uxUYQ~jl!CB3qbR!J1hzc8lGY(f!BU?Tbx1tY<}ar7AD=l zZUTMXjbbMA{#(_lkL!7{Jr%mWyx1KGHIwEDaeiTZ0;*Xw@d3s9Adl_O55L6^-QnfQf9}C=#-a=E+=u&_fU{!56cUk=&);0Lm z0b=*FjNZ_ArbS{SI=%@$R1d_mAhKlxKBfmkPkWRds&@kbt^Az(hd{FfcjQS{sEWMd zgFf$5Ae$#v1&6aVuN={K?Z3|lT46^aEmuiEAl@9Di=`C^g4P$mJo7JBfRTzqT4|3w z$Iwq7j_bS1EDNrCaE0q5Tb>bQuq`@X#|a1kgqWUJ^%S_eNzVP*uWp=n0*nZ;Tm?$j zJZzuyz&lFA!@Eg+W+K-z?EIJ_`Q_7Sc!|dDQd8b4!KCcZ?{3KE(HU!|9p#( zpWD7$=jQY3_ZD0Rh{Zt!>v@S5Xoxoqxx9@+NP-&tErUW=OWs`Jc@{;AL06cYuxUdV4a7^*(%&qP&%BzpK#hB0aSqPx&o&C3HX3$s z;tvJ581KJam{(V1Ts+4J2pHJe96%nN&28kj?XXS;cL0zzjU-O=DLND5>}ewqCEC@4 z;z&XRu+|)Nb$H>K0G_*TiWR#OIlzoHc)Tw68QZthY4_)pn>0R~n0=bBJk_bc$W|R` zD$Hnq7fYKoNiZ!@@d?mzzjueScIqr9oZ`55z=8VXix_FA2(s2;OO+4-Q4|d{@Lwyv zYX_yyVA=t?d?9vA<2;-a2d2LAy9G-wsgFzA0C+Qsh_x=5b=^jOlk}Sw@Z4+mF?a75cT@-tuWfF60`Zt;2YHo z&r17;f%?PxL1op)FeP}cYOqRA)jC^u08~OdADV($MXhb>xxq618ZRuS55#yO;~vsB z_IDFFTIxS~-sy7U+dYqG1&(=3nujP=E9?!SFj?L0XbX3T0os_8QcPXw{?y-m-iJnNBnhT=0nfxFsBXVa7*42wA zH{V%E5tAWg%dJRc9MRdpIBlloLBRJ2NLrWXLWP7a{cVu~j3+tO?ADKtlHb;LrT2_B zr@yAt)GFd24mqeeTr-%WHD@qN}_|Md1sT#1(+no0M!R12-@$Zs0 zG(E{5T!#Pfn8(K5oMtY~yZq&YyGsaruV2^d8Z>gx4J3k6VN zFO3A4IV0afsP-|m(^`y=h6KKE!*}Ev*@m_sHUE>Ms2bB9smm=s*f3F+?a1A53-646 zYxb`@1WO5gEdL4UqXs_mz3#6K`Wu5*Y2L_0Ew8aby{fhe`B=UGyq_Ii2p75Zf#7^V zPus6Y|JPY$95ir+Y77o)Jr(GQZ|Har#{*;U7JY$k0WZhMrlwL|Qj6Q_KI-k4k2$nHOr1Ecxl;gZ6`uaM^wFS}Z={b+VSf zPi#}py1n6v+ijq(h|5x3*0<6?>+0Dp$h+|$m7l*J=&t|OW+D6V+fD#UcJT|h+tqXQ zzsI%%s14p59s`#)@SZHqVdEc?tZx){twQJlm?Ce-?r*xQb@l6WjghAwvSfpL!&188 zw>MA6Pc@}!*`?GgjQb3k76WFssXCqD-yjw9)tz3&G(RnF-7GSc9^C>AH0w`#P^qrJ z-8`_EL(>WB6196Jf?_rBHsi1;a2(j?J==ADswcUZTT-o2Z@_Gp$(=mzawJNu&Zn&9 zjZCrzm?eEF$859z{Yd(kVYU3I*!|16m@1MdA=i#=RNJdfCj-j6(G$xacIXB8zV~!I z+OY#md1_IWhiV3mscQbq@##V+p*N-HLkMBD0Pb4*7E7gIZb}iImOOgLBu7x)xJ=O+ zOyxeHZt$*r(k%eq)?F}A^FSYy_ndXDfskH97*SLJ1!8;9K9ldt=Q_?fJjsD%XM5%2_2ms8+0hHv4<0q5fUyZgUd8?uRGFZ9TUn(B=|%P<$Y%ZoA00XHPWWZ*RW7 zvn0a*l776_Yk1%f!q!KoY}bn=z!N9>K8d!rWfsF}R+nxG-5%MJ?U)Ky4ZS`kzDO%I z_d(m*pfp2NwuB9V}O$ltOk# zPL%|&;}2dRAn|!;yQNVhPL02#0C2NccC7EnnZ-EpUZb!pAfq7h?e=9cbT7clbe78N zD2c%9!~fOE1*2gJrf`51eBa_2CS#k1BK73}z>c?*Q%sBiXr%~Xh<506i}RtN>{Q?t9)Y}nl4VDepLX7)UzeqbM_z6 z)52bPj@d<{(l|#?+1%B3kUv>@KF)fJM+XOZa?~o)31J~C4$A1}YRwpuBy@Lh{%=L0 z7(iG}IS?NeuYJk52i=Ls9f(2n$d{l8Ofbb>aekvxh&nIY=#7D&mfReoR=ab|zNwr-el~N1gJ%(Gr{r9&P+2eI- z{?(hb-S(I97J5j0p&KT`+j!D3WQ(X`7W**d5`ceH0kw6Y1*e`{gi81kJU!#PeW6uT z&HU2-sIOrNiW{vc6Yt>VZF1?-!{b^dy`vO^y&BpK?Lz&faK$G*x;ukB_DH>4hVO3Q zqT(d4-FLw6NBd8`_{m4#P5VFEz~}Av%bdbcxsH5;TSZS6BOM6WtLMYI7O7pfsqjVJ zxy`15nXTG36R5Z2cH4+u<|%*PVi{sQWINh~4L>oF5HhQ2{Z5y=lkn>vpG!u-O~9Y3 ztMBsh1k8PP<64dPBTP=En_ps66oek`WJBKRt_Bva&p*!KA~F@=KYga9>#ipGfhoNTK>&HP z*AER+S~d+$);$Cpw3(Igk}~-tbHM68fH5TRT}(=*Z>CuFcU>sXjDDjv;2GR+`aS&i)w&1V_gO}nqHL&w~oZ*jUWfrmF>xHJ1a`{k+g z1j7}@I_k|Y$*&|@bu8q$ytNdU%oKlnK{Bdp)(wk{CI|`&bKTaOx!NyeFeQzF=^5gS z>7_QE@!g(w0y13xOQ~i!&~%vaDMsjvdd&=Px};e@hoyeB+EGhjqxI9}2D>v_=L4ic ze8Rq13!*PKB7Hhtu=jpugQ>y5U{e*1=aT;9N{BG$W6I<>Z#uYbDQuoIpOKVRHq~76 zF13pt^jf9Mq0X=EM`?et-Y=e&|1VXwU+>gQ3rl;nbsSdPN@BlGvX;;FwAEL(`A&Wf zx)-9h6#@5uz;#by#_C_pctc1lnp_d^T>@nRZFp5*mLYm&Y^Vu~3(0G>$v>6x{gV4b z+2Sq>r&Z5KI{OPv9Qv=gz`ePixhKGcewkMeF5W@mGh+(IEC2ke^Pejdk7<`~ttI=@ zpSU=P=x#o39_aSqC|zlA4h(4@FK?=RroV|*7uNc)&~uh@xh`O54k$g2j&2FlMj>g4 z+*MBGRxbd^aiw(Sz@yjx2znd%gL=m!&S`KAC$+C;j3asMeMH{`gYcjD zLRUp`2Z{ixF>=A{k6z^bh!ppoa=sm$=Yr6bE7|WO3hJAbxlK~nQ1_?H&@ek;MvBu2 zQ9^(@&;qiT9o4yksZ`kL0PPyL0xA#DR+}%+&`;sW@*)VmFblP&D@t(2@R)#ZWI^_4 zX*6N*wmh>Tho{KSmB5+Qm&X&zEIsa>fJq5%nKT2oz$L&f5>;x3xwqJJgU(-1f+l+> z&u>d`X&}&M!~GLL&nU7ImDNJI5Mq9{*vx)SVhzsotrMcbfSwW` z*Jk#d`x;^plWE|)Vero@7n1!(KSU#~i58!XxED}p8yUO>QBFY_IMdYY@#v~0XIw?T ze0`I0$7tEeeg4+>1^Z~1HJk@eI3&gp{T43)<8V?v%6^SWJz_o9ScuS4>d_qKLeeAz zS`+FgM5RKS@Eq^RJT2PnY-f@dANRDjn|fNu+DpOR&3Dk*517ZIL_zNKhQJj`+Z72g z@wIhYTsCT<3A*x-!k~s*U=|lxj+i!6THH5LBEy!7Zt#9X?X5^mfDCU`dfWrlkK*L9 z97|Ki9EDv3-TJDq_Cvsx-_zVM@(|CMP2dB$ijiB_0| zPCFE#kL@7;$Y~CPn@>;1QpYR%t^8yMDh3XX#)0*WK{l+z-66i1OK(zgC7@EAlzd#nd}J?uWF z@YtyFi)0LWNrVjBhhc_m(0hE-TqKCmAQ=0hEl{rmGD=t>*Rr~0^gRew2W;=6C z@$2XE-(Jo2OE;2~>e`iP2BBI{V_4oYemt>SKe_p|n(Ds39)(SY^Y>@5LQ|@=?JFn- zbRiG5B-;#fXe;=^C_r`2*%`1s$0*2*fGZ*YRb5z)*mMln>LN7q>(QKET1m&yg=O42 zXH@f38*7<#VS0f8AnBqP*Tf#^Y?M3q@Ig4-{jj4rdri z=?8S!kvBA5zo%a#|Kl*wPE34iR3CT@FfEX3y=70>66}f1{DA%=?QA>hRa20ZzE68P zmV~?DF@GAfX9)b)m!V#7D1aAM&C@d%HGSRo$m&~~s)JAqSQ?yWwfWx(n4LhJx)-b= zI9*5cAkjxZc0JBIjV%TWQnUt=#a7vIlT9}s@nf75AzG~U?RGzu?V|#%@GhGZL|%@! zPMb~?`c~~F#1*BN9m0r6>1(9oSrJ09%swc)L${CYe6nvqgXTB1)AM$|zeC3^3D*r6 z^3A1VK~~bC33FA!X)w2Phpz|!kvMT=rB7wqE%+oc;;K; zcgqUe0x7`$ADerF*Wu9Z>_+&*vgoQke-}ZbYbjcfd&ENP7qV|%3o90!DhwkjS6O4l zxZdSB!-;ijfw4lEQT_Ip7(-2qqpznry*ls#kbsWaz;-xZbs-j&!olJccHO5jcKh?J_Zz^-#w ziVLjsBT$OmcL$hC&V<)|+?d&#maY#e~}Oal~yL3AwI&TKkLm})dxSxI=1Eg!E?B6!28KRMET zqfedP6#-ZvmjC8n4Ib=}xyv)r?Oi6cNzWN$yb92;UF5?m%IWS3KmAfPKnH23uROpYWBAfX~`YVnFW4SP5w~Gswz5xHXM|O>Qtsqr(R9nFPj;CVMOBl z`IFl!@wTAZ``9WB7uK`cbOx|%UKStm#%AA~jlxJX5eD{D=lx0!py9`Q9 z1+YDe!(ni{u|sp*GGJ1G1u00K1abOgE)eAD+*c6p3&Ha1M5-nP5Ik-JpjmB0{-4Ea zQe4GS7FvlI#E`-YF8D8IG>S_45Aax)zIPit!_@M6 zlgq-1Q+ObkGCQxn7si=cvZs!J9R!&Luo7cngzSNL-eh<$HO#|p;l5oOfUQd;-Qg_7 z@?LATx19PTMMu>Gr1Y$dxCypZM;JXI4x*FcBfVps^exja(7n%df;f9ZW2FZ7N?_N= z{w%b-7n(8hBEp~aG9rjKn%lK-ISaYm^Ns=xA=Gvq03gYHC$1beOm=gO4xr@*@E2_t zn5MK&ExbP4sM7>zRSe-s25u)?F_PE=pDa~07D;#mK&EsSJj=SvtX|fvUe5!__MND8 z%^z&R(UjQUcW`UW2kW%T_mY7txSIi;T5Lltc!H)UrlG`+`u0I%j0fUf>nT?C6Jv~P zf4O0mok^N$D9h*p;L=FW#jwxowmVM(?EX=fR7LrgxL2kEcsl%n?=wY&W*x~;0GB3l zmHCt&)IFE0^@A=92e#PY#Lm0Uj`_f!Y>&7A7*?G{e(q7}K5ztmLgi!l{nP(2T$;Jj>2yPd` z@40K?<>Acs`!dx*cKBVXbU=GbldX@-8`clBo)xU2B}boqhJ^A6SfsyzziWk$#2-JmmY zJOJDb$A0bvZ7P9xmO+QMUVmMj=VSX}o=rb#G*7ly32 zL(tPuE}3s+R4x<(?%gP5kqI+0b9Z0?TWD^MbvO%Xa2_WGQLpDKCe2Y}s}6^H_DkUE zs_t^+`~XS16Y;-t$rL2uSgPez3`HSr6}=x4g#Uw1!zZ&gS|qj(Q5v}M!Ga-IqQA!qimv19z^atx*W2u@i(0fzZK@$|oNo+h?hxRrq;>3?LlIOh4c6R{-p9L5ZJv zCNhfAf|qi-MsdUdVW8UtZ(lkBo>sjMyAj$h1!!CM1rC{?B<498nuW=4O_Z?Zy@uVJ z$67@9Y;Iy0<1dT~w=AiS8L7hohyrw3QO)S#H-!&*%_Q&$Y7e2%Idh%>oWN8FC&#q* z=)fe@@*yo&6_Sc{755~0f4C}Di){H_iKzRRdZ6Bt8m0Yg1O`CbfU9SBjB{l&8K5^4 z3DjFKhAgi?$BZqrO$pQK1vFUO$WYc0G@xhB$U(YfUpo{qC`6bO5_QkRd&Tx<(h;dy zxm0U_PB0n-I^%sxOxH#5^m8xMF2LB?8-Cqc*uS+?Enra(b_=1kDVH| zmB*gjBPu#CY|#IRcEwD*KB0N;b>A~@+|-Ve^^ZhTTx14csF9bRn0_X=Hi7Da^m={A3a3C~}%I@_|sR0d8=K#aD7}6033E%bp)`AMo zYX!=$VTLyKSZiJ(WVB0cudyctP}OQvT${wI0OSc0lZy?T(!imyXAJrjsA@em6p81# z0e$*jFrlHOkY%M>9N?r6-C4gYKLDtYgq#rWzzGP8iIOK60`A7&rP06Qgr;|!MtzjY zfFnRETms5TS9q8bYuAKw$Gi<^2Q(4}bwAQBi<*UMo0Rw;36H=7{Z^nLHT5rWF?B<> z>~v&9TNS0G%SeKs7dQc{VBsG7!1j zd7+2ewv$tx9|t)H9#y{pyI*Vk=4H#+S?3;WJ#xptM!bkKDuIp8tHP3}2^GR{ELgBe;5P3H*IyZ=9*ec|jiU0Nl z>J%ak2m0`fq3BQra>TO2ljw*#_hq1yHT67R;~M|OaG=7;Tf>-B@h2;yJM}+wW!W^! z71s#~^=;|Feu-aA$NwK) zZygoq)1_+%55Xb9-QC?K1R5u}ySuw5Ap~#SCAhmb?lczMU4ld7e)>0azHjE8dCx!e zqSv#!*Q(xCwQJXXUwa`6Dwtg$;xY^K?ttpRFnk4elQfT5970nNt6!a?MTT=F+$0Xt zU3Ql#t9=g%ifwQXAaWVJxQ}8LVvC^knklmF=GA|^DCs_`rXgp%8L2X1qA`RL$pW8V zcu4zZhv{!LpxIQu&^#?~8Xgo2v0`hOaU+w78)g=P;0ZM=ES4zV%b7)itovXeD@;|_ z!@i71s@6cMKdc7)f(w}tUE-|-zUj7S39Yd!6YoEjC&McmRAU;fkJeGpI@jnN**XN5*U?8PaOL!Om^}L3Mla={`#3+26;buA`7TjuR+|2v%K$7$0CcL#OC{v4Bb8
D7X2?d_(*%aW?{eI24)tQL|`bX1ZaStw>O=%v7S8 zdDx0V5Ilmjp$90amE2?^1AIMJoOY1VElF}D9qyU@8mBfd>?y#u{{THYuI4Cq$F#U6 z@(Usk8u(CDdlSJO5XqP))>@zjdgpO0+`zsDf~GV-;NELL{;s}9JFEZk{l)^_xVkpl zY;bAu2*ZsZT4A&=G?j>Iv+eiqZ}#bj&7l&7=KGm*+0c_`FDQNQhH^jnc93H}tcj3- zhb>WLQd>m^%7iy^lYxeuPVaA{wY8yEN6ZIg~aDCiDd^qAMRq2q5YqY zp9oENfv009{|SouuKb%^xVeOZ*d|lzAb7%`a3{<=jn0UO&1^cY+}_Uy;u>ujGkmO_ zp$MVe@S$PjUM3IP96~&up5W~mHp|=>evr$^mC2w~#yfAQnXwAXRE`R% zg{oI~qqW(q(NKmW$gXULiwV@8=vO%I1!8$UE;+-gAiZQhjWPtPR(Nb~c|CSgGP`^F zZGx0p4>90!eP4$rHlH*&vFpFFJJ(POfWa%dUeIn{tYG+-G#ymPuQZS!?jpv#N=;~G zh>2k;!-Y7w*n)wh=QFy9-nT+ODJBO^0^^Dej<_cYiVtJm{r(z&Ad9gmC?~3PbvJ+T zIcW{DF8GxRJD>)SfN!*HuGcbcB9O$>ROnOX3qBADuZnTny+e!uXoic&c4hO|I2!~J zx7&&49RcgV#4BM0C9){4NE+!!-)3hFCe9-*I-51^d59_J@j>j0O;k}&U zV0<6HA~8X6sZ=NQvFB;pq1kf9*J6FWOuks{zgPd*h?nJ*#~PM8#~7-hcY)I+OjnW* zqi)$dP{zifu=#ZEpUpgp9pR&BSENfyDZh9FDEwj;?+Ge3e~I7~_+qr&4=PC!P-Ri+JyKQQPC>n7-tn=h-u5(XoCW1!92Q&~E)zsPDMo=lPB$91r%bTr z#37Y>%|#pc(HpYR=EUVQx2G!^uo35%dHm18^6?i$lrh@DnQkijVcsn2k!psLRt^iRJ3UTH+wD>uRauk z2N&vcZs3tfpx0Cz(TmC2ce1A`fe%jC zR@%%{VUzKAFWcfqk7~8rEyYk7!B{Cow3oj&=AmWz%2Z!F4(Ua-7;=AP23?91i-E`B_Gd z@zNCr2{*g7H~PW}Z&Epa==*m+JP$A&AC$=<#P@uToARvC#tQ!NK~8fQcN14Z{F??{ z-Q~jW?Kl1BH<@%o%R`>_qO6chU z1aQ_DE{P5FNQC1Y4p0)0gTQx^Bj|KB>B)rdy4(0WBJ`qDP-cr~(;k8+yJH}J*|!=TMzu$vF~-ep`kM%GN!YS}mDUD91wO3M&$S1+b6cB2g`%F-SL9%fbe=KjJw-eQ=Y)VOFUi?GI2-*589} zBWv!VA}AqmC_;KiVGF~|pmy$j0IHa1f{MZ9I!62U3-=K?tshH--Pw63K-%cc&(ASp z#4ol5;r&Owl!Kbg!^OPJV?n;U1b%~>u7<{4KBB0&V`Sf;`fvVHxb>z+wN`_h?+V^2 zb%qU>`3sNx`a)2O6qd}TiM@({n=|nzlzl4sfLn``wD5q0iOBV8y+6ELw+fz?FN1K? z65%8X^G=J2Br91>q7T-~ogQxM_+T>B+d%%*8UhV}>0F8K@5VDlich!;@6oynp}^2X z#UO|EID>Z2zRu#-UAInb`_UeIJ5kEk2N#|MGJZ#4Q?ov z0bS6qw{Z@*pL1QtTa-^^V_)4!eTW7-#2z2Qm`@_ye(V{@8RmLH2`XHi0#LS~35*i- zdWCPWqSR*;%5a1tCr!tdaU-p&d1jf%d4`W$UOAx34O8{?y?)rWdxP4)(k4O7_{T5U z(x-{{Mt}-5XSfQ$zRf+sjBc4c~9K_mwTJ4Gtv^VpHftTmqy+pEF@ zrRpyiXkAeEde>O`zSX?VEIQ3gKjK zy34I*c7bxPT235m?#|1%*E@%K=j*ASr>lQ-$x#kfCmCUPB#fawmk*l*kDJrkE{J0L zw+cb$GtC7uIji%+ESX|pZkBaC{42q1u0I$99d2ce&Cbe8d}3hhGDk7pbGRGPb%m8$ zJLR^cx|wMKIN5`5C;WI(jZFcG#Miy;?Y6qGQdundjkD{{ zegB6dQjwWbCwZ3p?WePpHfB$({m0LY<(&DDIC zjZEMWgnK3FfMiXWMOZQG#hs+ZMbY>EviMQ4wBa9Sa3OiOQzCTL`}f@=y16ljF<6w` z%^uR8s}`kV_(e(l?`sdwoPsD$mup!nxBdheUZ<~Ak*r)Y&5G5{=p|RLKvKdYJ|qbZ1{LQeo^x3$4G^Ile#JD!xx`C0caIw7bf&sj)fB z@oX5^Ia-`}Hot2-A!@VLBZfWc*j+#^MzgzmQq5VK>$d}PL~4=(`CMhjFNej>uB?Vvi(wupk38S#6sj39uEnqq2Ny$~u{JYjI|B#5|-kQ^!9UjD( zs<$@hsBqS_zs#A)(I z+(RlT?|HwulZwQ35o@WG#|E5SJY)277zDUm_3*2IXcOx447-EftT@Lv#)-ddw1WuQ z-a1Y_t`nY^s6kyecdl-{k=6cxz|(0~IXSP-%7N8eI?awRomyV(cimy=N@6!LMhb5i zJzcWR{!bY;2J5ZnnO;l0ZS`9EaQ-v7ryVhEx8rM1>U^TpHOL^=fS$YJr?XZj5%0H- zX#EpQbbq@#G46ocjbb-87DGN%w|lB^nxU{TV*9V=jP$v7P0P-Wyn4J^c8sv)L?Mk2 zDb;?SXSVaVCL(KDcX@myuCiC@StdS5p#N9gMui4rtWVc>@&Ae5^El=!KqJDi?<``vHTlDq6hhMKGAR)95#cSZEN}D_p`}w;p`ex9z=gSn$ds$sQhNO+;A9t{mj%^ zz2(H~P#@(s(bdx0`I79!mof5F2c(`I_FLOaZ&79ak(=$$fOgBt192O15$kVn|=WF5+D z`j2sDmw#U|Nd$gyLWYQxzjQ8H9;bt9K`uK#*44lcI7iyhu>Efhi2jSGJ^1aN-!EdE zRgE2RFC^&K6)A@@42G@nCy?j3^*%H)*?GBE%b0OvZDlraAK5$H&*;n+eT^lvUUc0(h>`}XTohC$Y7yF>Shb9$`9#`q6p%ngz>+`pr zx7kIX9lk1Mz3f27jy&=(LOsIDEqE4Va;A#GPsOygCfuv*Q zwskO}51Q2|utA$NOrsbHdhC7WOBw8b?w?O$ynVrLl6;q02Ff_4A4M+~IYHcALsNJij7+f)EJj9Pbd( zYwV?xqnfW<;Z#zB2Ebq>Y6k*MzNCZt!j^ubBV+6lQkCq9w!8A}1H5;=9`*kG2RsBq zfn{ai-!6+ctdnBJUZV89Ud)%8Y#J+&M)Xt-SsBP(WDLXro^+0ypRS<(L-4)_({4z$ zSm`mK`wV_v|#Ut8z$P==GR_GGciuxQn_*t{?Yc()NKE%@d0h?%ko6_U8)(-YG0 zy1~kBm_T(Iqu=f#GGyT(h=xxgllEAXMbqPI_Rwooj~oo(+~9XeR_NMcf-Hl(WQ;=1 zFQ2{459ZMzf7Qei;>~F3M?@@Fqsuy3Sr`yKMHRz*qnY;%2iM}gw3rECe*{xpNJ|DE z&>ZZM;sx1RXZ3qD2)ZgyJd91)oRutE{jXt%{sDFI8Y z|C5+XaX5ApLWqWNCy36qY&qngA{$R>WOhAcoG77p%)Z!}{5rv(zSAK$+O@Ba;DYbN+A`r0uaSd=;?IsM7w z0<&U6U?kviBGX0jXE?_4Q0|m0^7*XHbga|R?=BDWuX<+;fW7&@mwb#7e)Kl6apsBu z(GP6f?2S3Y;}eNXZ}$nlpS=F!vp&BL?}){P0owPXyE@(hz4FIEPZa%IU&G^#X~$DD z5|A?@0_!{nC@*iWw2n~_opHfu#2W_azt2UUP`_z; zBz^1=OT)qD%)v`s&6JJnzlJk=$L<>y*k6GO!h`Bie&Gu}Qwj3V|1gJlU9)E8tQ57qmF==^gd zEyn8*AW78$NS7ojtjHqfJxESc6o%>>biivBAt@**b_LPrUQZb;yy!5MvJCvs5$c9o zvz)Mj3a>k4Z}c=YG}xr1tl{V+&~EgBI-PeN=cP0sgA)F8{{OcT{lDYu5G~%m)faAb ziN%1_L0V(<9_^eNhGI+ZU4nR31$}(zn0ef!2KGt-|IZn@5#d%OeD;E5osUzLlm!7u z5i!wW0sRDkA#*Q_!kSX??S8+kcG{9UK9;?2N~1Cme#$Z&_2I3f*s+m2+4oO9GcEb~ z#GO-(kNIEIY>lz|i&c^@{e1i+Ui6A=jUVY}ntCr=3pkg=$T0&LwWQerj?320oHX-_ zbL>~XK0c**?#Q$x<^;n!^_U8TL64-cpHlOs`j zR`2K*#zXB0Fpk^*nd-He7rkl>&mz0$aFYwdR+j@C7<8Abq@hHm6YvGjvb}fY8K6m+ z;dQkCyOe98)AFEE(j79@8)!Y?OY_KDn!J&w`c(B7kx)O zp7s@gC)Ce??0|Q9OxcvRr~f5XXJy`d`Opj4qvV<-4I*zT#dia$A%WWu4t%ZBev{fU zR#!>spCyw;ub2wl2@(bsg{FPxyRtEwBAY+xAK@o94TOx>@BSF!1Jj*%(L`h{&@Y`` z@975cnLg;QLFS#LHjl)+v$QSyg%^an=*~o(UpiZp@oP_Fq5}Ty4s4AAKQWrKoZIM0 zE@goH%N#XPM3#M_xNVtGAb=Zd7xF&hNbvpWUWc|@GPwtY=SJ!4r>fo@oq>>+-}|mc zhm^*X;~S~eo=Fa**@F){UG)_lFq_O?dm*~`F0I8y%dXYGFRhg0E|jJ_Td+3t&l+ST z(|PfQnk%cdxcr0$PS*Z2A=qS;2tIHSH@FxYd2V)+6o!7sv4K>rFYMOJLYyDQ`Pt*W?A!Y5M>qW`hf{OiK=qZJ~=%HYhf zlBIMCCn55|m{Y#!C|#F)TN@KOI z|IE74ui8Cu9AFl`H@J7x!7=BTYKn++&q?8IbN-}-U4!uRp%iCv|nsPx?Dwb zoy|}@gwnWF>Z>Ncqa_VI7kn_Quo60ppgxH=D}|grf5ImGNZ%PK3Yij_>7QIE?$Jwj z!MsC|=NoPtZ*Sl?Bj&A%T@?)g!6V+=82bLqCf6H; zXT@Bl>kNB=;j8DFK!y1O+HWMVOyq)`i%XjSDbvjH6WnV0DsAR&Lc)(WcF&uY#>)F8 z8~KpBp#KrE|83*cw}kJ^?T1*L6>3<$*Z%@9i;atmJDL}UM8jMWc7K20P~r(p*i*TM zzB|$_5!S!4(G~L19)MuaN5!OtP7Fx?`;&dC^Een4zE;6B;lo0DI$>!=MRI69_8~D5 z%`3T;eC`)bY*0R-IZd+Hudjt18iN{hbJG;uvW{7Tn%g`1iPtRU6~NgUooy6JK3+!R zGDD16Rf^*2dX=1N_g@i-f{AM#=OrgX&I&)!&S=(fwyCLyjbL8_3K75ADLLkqMf|1` zlG6^yq=_d;z>qySS%q~dRPVVc6dwt&%5CXJ9)gvC9)j{q$7X_ucH zV6ev{HACl{@h|(OPNUZiH4K>F?=i>16OC^nkZw;b4U>aCJe#Myo)929adPE4BTRP% z9Q$(9Rq!qzE_f40#Jqn~w7UXvZw02Bat&AAMU8?q%%OMDn~UPcz3AR_14SahN_;yU z9tpr;sw9xa&?9kC8jCuEKLNAc`9G7S|B3_WG)#8W2TmB9IeoqNahXvOF|Y!92%OVz znKrZrkE-+rL=uvLiMKfM@mO-Vyt)BB)uiO?0BuirEFYwgZEyZpIB_iqa^zJTb$WmW zddvwQabbvOnI|}ujy!GL`oT%u-c)L1`e0~!m{63^HVwx1*jb8RJ#VD(I zmpKCbr|${;lOkYm!wnChVjNr$;(WHzo)Ja7tkra~SPg%?y_ZqTETLJo!TR##o`SY= zJ4zS10C>9X`Ktbvv00gjjq1m3d{D@E(kTK%9k^0*R{uOX?avPILcVK`<7OLB0h7bY+2qOXbneMr9j_F#2c&HQzIT7~ zZ4Y^fJV(DY3_aT%F3F9mxdc$s7*r9>&j6mz@pyE5 zW!NJe5+moQtQ@}z6^#y7`kCygQi5}JX%9Q!rjQ-{J~>~*>13v5u^H@`?pFT<6T$PQ zBedqQ7)dN`Nj(lTIR#emy`vOrO34Jl9)_Q~a($ex9(&ck3#XhN;U6^QtAQ~?n120_ zbKU>W>!7jlFF{c9@@}zn_~-iw#2y9C*0N;ylAo~|jgFs)$z+8e=T{y=#lE|?s3+A_ zN<{VB5+wFT)aa)Azo=+1hIezCE_70H28>!anvx4V&;Ir*r@UJd>!K05C7qol>66@j zie3B7xW3VOUv#n_^m#;XaBOijZ`k4`Qp+Cbj9IVjf9i?ZrXeT$`1sg6ZNd%llcN|O zRZez|AvxFX!t(kSG$!WEW;Xx=O;h&%TdMYW-l!V zzur^|PLmT%pP(Mw#_3c+mx9@!;K4At&9%Ssj)oNP=d5XBo6m&bbMg@;e+pqWCHP>D zeWflmWAYoZfCa~_ShMxRXRga)yU!$oUkW`*W=E;hhGK}xcm6c7sdrJQU`XC5B0#*g zm7i~-V{;A9=wpLCk{Qc_?otF?uf5B3P5TFafD<-AdZMrHB8l5{dqW!m;+mBk6ndVt zJgfZ1LTlSXr5*#oBt2@E1&KyT%Uu&upkeiPS=Ng`~P&W86DH6I zrf}v-*ZFaLBoR(1^t?!b7!vSmc^L^>1)pgEmdmc}v}HEs<;RICOsouQlFb+&yE5^s z?GEs1ipz5ai>lp*V)7o9>eBZ}Hq7SheRt3qenj^Lz1e*Dr=Tri-n#G*Ig^ zV=idYUAx8f@J`*Uz?@1fvWleHRQ62r4DT3A5tsJv zyNc;X2Meh?5+$q*u#8IS>^mk^8F`$wzL8|8jhYh5Jg$4s;48Cu}ii-DJVO_4z#!4k3X+&AHC>#V+jl%Zyte-jN=pWuhD zoLOmOQs}?Akuk*!k!$r_Vh_dm8_1ciRW;EUxit>Nru)z?Yw?)GcnQo0;U-Ubp_ugX`d62wE9Y_o$4AqFI`9j7f7^a$_ zS*F@2zNFcPrTalG$0R2)*Y*>D;0F!YPN2~M&ED7O8-v`qB5Yxl^{Iw}+@t3Dviyg> z&E@1OGGwdv?5xDNOE=gdsqUwNpia8*m?8$i$?;A(*evfGErlrd?WYZ2=b}|UySi1_ z?*hnX+p6z@Ie`lb*BeDS^>%Ok?G7zuTgqk>9BT}MuzWBd*lo691k%z=6G(x>Ot7^% z@4jDSWVaX%#u6~w@tsKuDDamwu5>X)ybG$anS*$hY-~Jv(*#Z#i0y0DjW?AO9eg+m z_Lt0s9b%Yt61Hj~>w6x1X{c+%9dfN)7k4q*@T}F9|F0b5|KD>ONMHqVd-=0=$Ya9w zDTx=nvsIl%hLnkAT!aT)=F)t#^KMk@ssx2A$6fG_$~;`YD%mONQ8%}Ce$Wr=vuWt8 zOipR({k6w6&C%2h@AXr{N`DtnpJzgjzHV5jmQc_@PXu?xy9LTX8`8vwJ&+1UVjjWG zq~#`}O9eAl0W*QN$TwHhfRi$3cB_vXq3VMt4mS@C#1O%a#tVek_=bE%SUS7*mt>c+ zUlv%|HL|qlV&1TxSmaKB*1HZ^|3qv*-u%)c+upOoPO1qAn4mNeEeXOPh+6RVexBw_ z^J?HvBc5w*?uMA&`sIwerSiv)Ek-eznXi^eaQdAUL+*ltD(F5d{TSLwgx{Z@)7x$I z!aX#1qv(Obj#>z)cT8+0pSQ-7xVfgfTZ5(%x#B?@lJ&=dsd2FzS^YR`-izi1CJ@kp zp|3muqVw0v)wb0BFF4gN1mvw{w3a@$(05?zGXPkqD(CC5TbMX6< zE2<~fbvk;uWIDgoYLiTa$9f|XZ%qntFu-rH9Epn#WTy8P=v6EHRJ^3S;eMUrNi1|r ztUAEeoa{H2xfpj#td#F6LM&%xDqC$i*blfN{igVSr_FEwv(7ueNR117+V#5)m`K!; zRzJ^UX19atS>Bco{)dg#SS^ND($7vdvwfZ=m~@Vr!toB6e!l8m;dNUoEPj3KVf~yD z<990A4$h`u9F>Fmbv0G@zS*8@y@w(7i(fqGi~!I8Slx0u51K~GBo8=(c<2_SRVob| z8Vbljm;I6WqL)!?5y{{KKE$kI7IKNb z;u=3HCvEUfVemIK@92fiDbs_x%|8XM=7Kl8_pOI>q@>x{D`wx!3r|wYM(cdLCvv6M z$>si59)-a01NgiPLcP(WyQ!{K_zs{S`=zIEs}euXHSFl3@smY*%pw6QP8xEI+e>J+Rf&WkD)eNcu6^7X3 zKZbxFV=?6j)Z6&qLoxEmv<{KKBBYm8XzcXrhT>Ok7S5u8jT+<*vW)H11Y6&{!3z#4 zaN!Ai?Hes>FHr^swZlj#3nA*`U*9(6?rD*b5dMx766XXY#@QEB$93g29~boDkkC>W z*aRh1CEX z0@cXJaubvu9BPeekeQ4I_lgApu*N=|<4;-GC0G1&m2?jOCE1RZj&f$Pw@j=Lhy$4% z>?-1NEA?WfVnp-P@R6(j?Nf`Y_;l0(-=iQGM&{oALSU?Mb`qak zMJvYl%|VRVNpSqVUk_d^+5tn<{46*iHNh5wZ$Iwjqvr7O(ze+15Sr5;~&WkCV_;&*-5O#2Lvhs{B3qZBR@u|WO#Y9qFn$D0H!sxSIA zM-2_!00o6_G+*PldENg`p(H{J9wlvZD*cWAt3%_^q7#EgrKq#tcy_Kz>B_kc$>25pf>R?~&(icqvsE4cE zw>L*46rb{TwT|!n=cPb;Ir^?I^C?f;$y0Dd=Ed@j%+sx5IqtC+;WyI31$$Z_l(DJW zf5zh+0wy16e1K7Df&>Vz+`%765(gn}?)u#og7NR%lAB?!_hAZ67%D zLI249$1bIp#78PpGHrq};tbJTN39HwKepiMxuHp$mCk3)_xUo-B1lU7-67?|^Mgviw8kZp(KvAuU2l!MJ& zDJvSh3H$71w{E}VX`;vTHv!4njO?S-_76~0crppwi(U3JGQ6exXPGokNBm*2OnI!x z>T09D+a2DcsRdxBwjxrSA!E7)XaNA z5mLS?O6dSAgC1vcE}rxm!ZFB_p(Hp-IeB@a`R08oTidd+G_K;jVXjGGDkyl%rtc1X z83KQ)9Q3G06Y=(ZAO@Z;l+UP4)_%K;4NCMo@6gh$)Gd5@g8s)GEBaWnyT8w?cjnIo zOi0*kTrd=zs1w4^W0mHtC@9qXa0+PX6`fJjkfVaPW3Q=$w0(ikC^NYWDo_ z@DOsp6N|F(zgGSf6d1#;i;{Qx|>D&XbRuJVPAuxVb9PH~JCo z-z(V(!%=T21l3f5)w`~NgQ_WCOsCYL0dcLfIInW> zEzZxYzNxjQyPS*&b7>87wC$)L^Qo?^jIW7_Cq&vgh{jojtmB(>JeplYbQE9 zW6G1HGys@FO^1W5=2chh!pur}cY-_=k+P>h6s`F?Ah#^pYY8)baBr7};v}0eU=AOj z|Ee8ls8XPo*D>tW=E-p=0w)ak!0*ytJm|plIsrO!sduDn4f0IB%mUjHHO|zmR)Sc~ z0-KF~47Rk7UcN2$2TuLk>1i)MYE2x%oBKokyR^*Gwv5cmu0~nw0}Lq{(*n(CCPwlI z2^a0~IF1Ytv71)eIFm*-smvmukJ3vf&DHff>o}{Q6GTBwM#lE`kn_d>1Cu#5 zn>0E)T2NDii4)^#ZyjluxmPii!?&XHcDXZTvDN$C^|-QGPDLdyj`(ycPbxsMs`=!^ zUgV%wl#au5z2D8WxNKeok&bKwk42Xn+TA&cF311tdf=0ThSP@ojN+LNp=cLmlnF{^ z%&``|jgDYE>UueKlB?nLeEq@y%eHB9!z1v3my$LrCBQ`CWT)0_X!m!lC=kkNmoeMz zocNrdeoRG4c`fuNu=35pIl$b!U>)hKAYmc(}Np zN-yesR}r*>C(jc{PRy>gZ2dnR^f>?JvZAF4Ym=uT((Hj59i+L>LtP!2mU;QhE#S~F zbce+-tX{!who))ZSo_y=y8KwZ*%12SpWor4FGJ_iIMTMHr>qY4^DRmTendE6Yg{vV zCnIS06(3AqUYgWF#Ihc$Ls!qZ1NfEutk^o`);)9r4$n~L)VpMK#xGIX*uFEKtKx)?-7p93rFvp&RCsyTJ&dD1v0o>ZW&U4(_l;&$Q&a3jG1ZD}k^ zKEJy3Q>ElUi`%O*+vpeN!G2iY7iX0DqR|6a4?t6-iV zna};7;@#@Ww;*6n%5RIt`0{(QCjbyby^9!J`p)Hqf;!=2@z0TyB@vsQ;%)4JZ_5|5|Vi9oyXI8d^v8fXOzJ&cN^8W=+tOwC8(m#o58^D zr@KB^l&(niTcuQX30X~`d2~cXJk(mic&YG-?Nf!Y7ke!kbsV7o_H0eBYchjRd9KyJ zH~2W{B8=?413}Ak7>4LnU>x!NoK zQnI2OUK;_nLcL9`20j6wO|zdC3zyyb1M0p0r4AKRjsg>7ckhaPr@!-|7zv~);sc?s z^1It1yvN<6ZgP`o2WZK>UdV`cp6KOm4o?1a(0g&t;1zF7azLM$#=%uqJU040SXpI-byg z5>hfFbXV)M(f-F-7-jjX{ch?CbToki)>cF!Pw4Lii0QA^1ErOSMWSvU#l@VaL+)y+ zkjxK5eHKeMkAG!FdT)4xPk}iZEKbia2pas@%K`1pOzRTl6UA$u)$V}55rLX^84(%t z^g3iDD>~0`uz8*_adTkNKO~KQ)q&(gLb69AJ1V+XBb8pFxv7asNyEitlS!*53avYx z)plK!SbQTk*so@EO7SI&{AqztFPu&j<>Z-%&1=sgGri+)t(H5TLwF;q>jFm~_nA7$ z6U`+3_ui?4Glyf3BS*_k?B0bU=J3>_cDfnZ&9r$CSv>qog1i)Ge*;cv9c$NniXgV- z`9f0fdi>J_c5qS0b`mRcZ{R8g-Hp1(F?88#<{TncEPC&W+?^+gnDi%c$d$hckHlqe zDIx@VC2RG(d96K0bK1>U`d)=5V-WE(thrucPC9n_gmzk|BhM`ugb zZu|%C9jY-=N&S+0^lOG#OTcl#)!hQii*dWr!4PuSqSy{am^7qg*rPE=LIlxSuX3S_`F0KJ?G~I zI`p5Cv6&Jub(CbttFsjs7V=c=`=sopzCu#EhM}k8y{&LE+_JFNEI=;s{p-`lTh%un zjWKGM2yli|XXyed^#Z_hCNym28#VuvblpGSklfP3zxKuc4*G1T|EZmk8gUkRo7Xuj zH05h{e^RLx4t)0Rh!7t@z*#Yg`sY}p!J+u|)vN0%3;VJnRui8(z4hEBLp4BgI@O$K z#P5~2CZ}AhdY%ZT0b!}$D%LR;iOgRm!p89q&&XfZi9N1lzfpvKF8g zv2eGW#qRqsW}8f*HQaxRYVUKrrSHIM83LEn| zwa^iMGx+vBdI0TP$hGdGJ@Y#l1xCLo&R0!5r zT@AWc8XivAQ488^Ozoz|2xDLA*pt=RHZ>0L)kqWpmwLQhZ?X%}xZ|wt`1%V0V6@tQk4cWV zy?NYUm<*DYjH@nPPdw5`A@!rgH09JeUktnY+R{?bU)4dOH|@xB*@)lc(lo{sn}LDh zXhR_qMG0LNJMotZW3~?6Df9NuPGc2^*`RgiS?whkKo`47-G1gQ%;SP7*1b$i<<@~hu zk^ZcEHNY4?0S2A-E+?&{9<8B1SF+2_;Gy7c(xRKdDOX8Z(R8NAMZm=-G*zzcyq~KM zEG*mW40tNj_@Qb0_OG(|DgeB9^eBh%PX8W=^yT#~CwXnt1nP@@OFH*IK>pOsFFYY& z;mo3RN&Lm=fZ4ONW!XkIb@*7{kVx$983j}JnLv2d@V()Bu1p*)bmddg^JX-3C#jc2TH6VE1QjjgPW6CYI&8 zG;yVLu_Na}H&l!2*I~WhEyCC1#ZzB``@N270##O(vRsPi0VwaW8<%trr=2$059hq% zuxl#%{?Y8)MA)yiEH?&rt6+A6Y0%^>fg=r7sobZ$07X$mPC)==ejbpOG1zs6$Jhie zyC!Netpz~4&aH;+dmT?fH7Kd-FPqds9bFna0Uk;0SM(t-bkdx(#O_ugc6W2$p)Lz= zO>uqLf@`OKnFW-DyB3txh$|Im&Ek1&8wMbirTbjpGtm1Y-r`6Ar|M&M4Qp7j;Z}VB z>}CrtWeXOf(C$eoz7M?^xeZDw#EV{01bouIaCpmhaqh}uNo6++p}ECL?~zYoOL}d_ z|I{l733%QIuRdLv;mewC^T++AI2Dq$K}O7~fyuh&X0(rGI4b_t4%q{ z-90?<4)j89#ET>qE-n}HF83w5Lqr6(x4;1N*P%#pOyZ;&70wOk7i|rECm98)aP)bz z@Ne%T?8;&yf64D=w>zb*`Q1uA_!B-^fBZ>877=?FJk5@lfQcw+;YC=xS~2=p0h1Yr zE~+o$I+(E(<->MVdcefzH-8D!EZjBS%-GaNj1b25D zchA?)`|fAUIr|&uXN}P{YIQBCwdTCy;q!3qX zm|L(}%`t+0u%{xFc;$@2LjXfEMzu{luY{u$)=3VNxB+=5Ki(5o*_e$mHLT=>Svp@Q`ZZ*v4Yz{FSJ6; z^^O3>y}Z@y&Q{mSlQ#GliYUMSK3765bB#;UXp_86+QcjgJBMZ1{4ejzXa%9m=7jmt zUtd=X*4tWj6G`4Y)?%U)-c2iTOhbDlqkZ^s+$6onj|Cc}{;ff0Sq+3iq0H8H| z$BYP@h1Bz7JrDp#gcM{$UdHNbw+`oW&i8H$&ZKh#(=uE{)Cp=>Q55qsdigrUlTQEZ z)JJ@_`PZKZ8UkL|9NA`%ukhcm1?C!sy-PbB^~&ATFR;K>vMVAyRoh)`|loadI13XFi zPc*hC#~q8L+|Cx>iEh6`ULBJboPG?%nWWz!Yb^ko*sWG+hl%|7B}Wey(JA%h!4I^@ zT4@g%A`RpyNtx925n4Gxx+);n!gBU=IqPB*0N@EY%!_^FC8NOZ=QsP~WB?DWda za&&wnz

BbWvAQ%BF8{_y`laB7b?gnXUIW`p^}2e}OeVFKKx4?eTg7mGTdN59>6m zfE-+7*agdKAuf3UGZxks6(658UthnlsXA?_V&l!(yawp36Xsi8KNM!wfJM$NpHU=k zZ2>9- zAFbB6a_p%l?4bmn{0;DX+2?M1pjwqe{Gzev)SC}R#DDoavP_X15!TS|QO@*$*5zki*<|MsiYzgDP!Y=MKO{ev3EC1e!bpAIe_a z6bQgQLE@p2)5eUEl;9(MZDz&DQSmx<6xoac{G=zlwy)+}q!TXIKSRUzGoc5C5`F!4 z@1~NH)$kaE{9v}(y4pzlLFIm_oaD7>>o{ox8cfRlmC^Po+wUyQg#w5dF41u|=lnx1 z^t~wum}Bb{OPVq9wl+C6{B(36wPATJ`k+O$CwUz#`b1LC19CH$9)6k!V?i2;yOY(J z;uQ4WpwJ^ztbxDa_1FC0ur2tzZH6D+tH)iuC$&wX=@uofEIVv^rqAd zfd0M4fQ(OH=RMFzQ03Me6?sQfQ|S6oNZi$CIWN%fRZL)HcY!wiLu2jRC%VXz*8~5B=QcCa=*nHHhD?m@w<@V zH6zPKh5WIB_kWr;Xv@lj#0EaOpNVi)XuX-(@x(%V16GVqNDwKUps1R#hXeZk3le-s1E09q>0<&2)x&(vGb716kLPWy`Ic z2IU@bg5Z)|sJiW%a&nXvBmiDMK0d4=QR+|c)L#9~7iy@K(C2~fwvNln2?YMPTiY$j zKIxKCP^lKqwS81LP65}T{`Mg8r4gL$Ks&Q2{wQ^JQI?NwFe|Sh- zzUGMXA8wHQF!EAS$$8!$S6tKpY3P6`5L9_pDGC7YcTXsrv9 zfPc7HrwiIZC7!Kjy%R}`xhhVkYL*6DIkh|R%B`ljcm37%rXyXh+|HIjZ73pet*v4m zs3DJ)!M*053oQ?&#FA(3C1R(mFC0q*07=cVk)q~Cv(fZYZh~Y&dxFtNpgG9gULG3X zZI4hE->;-nw9~koUh7X8y5C-IEPslyC(fbiP7JM@$BEP=yL^fT6a;@%D+gqxMDJ@t zvCjd(M@%Q)A$NH!DHcP0d-iC4f|Gcso6F;GkI#;mK&%`SLrG_ zaF;4i-0uP!4w^P&V69hHi3e$hclHq%1%>GBhp4IKu$5_dBa^8-P--y5f=y%;^vdUx z=f=KV;F*S30~OSqT)HXI&`KDj?--7p^``Dyx3|!M_n}pd(!iS$DQkm((~dX0>?~0r zd#7$7*49cr-~by7YX&v-K5l_J)^|VM?Wn#$gVTn)$dY>8I{Jxb*%kb2wJD?I07_+7 zgi!jA-8T7v5}gc%(d`}ue=%vd^Kf&fHUI67`G;$ELtD(RRqFjr;r?57_b~$8IVD8$ z5B(RZ(CQWK<)Uc%XWa6Sy%5AA)ZoCb?K3_S`^vzZt3D3*b21!L);DG;Ui$fEodiw& zp8I7@J1iNBM$eaED~kd+Fn`w9)j(m*Do@ z=mJ$cAtRNt32BI`e6u7)DoMBM>{rtaFo&$7WXI-FiS#1utdn}bg{D}ZdE1KA;{7JuN~56gWcT1}Pgoz-TCNcv=6GWkF~Nn3epqeE(sCas$D9^TYS42Mi<(A-UJ@`kui z?RwT_s*S1H*8?|b=*wmlbXD}0nTcucM(eO}2jdZkgy22;{wLiZgs`A? zh)F@FIu-Yjho@v5t2~U7d<~0*TTXv+LTp9#ENl{1QJwi}7f<-_d9s+LNKhhxEw zc7f%sPuuD2rcjZECF_N%6?TJ=nkvzTYd7WlYQ<@nqYs6Z_})>W0#B=2B$1}NYlwlX zuw>LyTU;JhnKbye3MEdUB0g~$WLt0N1B?;`L+=j!EM_>qr? zN9yYPOlg#d{LZUPO*6)k6?hH)&2^xgO&%7lh=_lQFWTo!`GA9sNW6NH8eVw8(b{AD z-yNAH`2r%%&}?Ic1j7AH=vvG!>|}RuSu0yFAuuV`-FEBYyF!8c!Pr=VmGdQM8*U+r z{>(7no7F z4X#w3zbr-pk4FUWOK5-o&FnuSC0{cJ)lTGm*%IzoxZzk&F}Lb+j4G_0HY;(l=;%Uu z6Ut5VGuISxVi~~a0smVdwzlAm1H~1qo3ZCC?K%2|OiA`K{=Nz*kPmfhmb{qh01OUI zM;jN=Mq*kEER%f9zTu@x2a5uUdlv4u+D9G_i$`x8 z(;t40HQuL$@?6A%Xjnhr?BPVeqmnltbcyKuhsE?CmZHwOaG1*K zLn%MWqMMIX#3+t{)(RJ7{U|wireXF-?ET>FxTVo;WIZxI7W#Zpb_^#>;}4GG5q5hlP9(%Pv>-Ylh1h8t82GugNI@QNLV}mm z#Xlx}y7)8{tPRd>R#6=Du1CL7J473;=g1aP{mNhM&~&5=x5ylngsHd}Rg9y1h2ldYR>%Rkoztmt|nu$D=}O5LeEJzgjR ztfmCtR13^k?=9V}EN`Lw)*5h|>)KAVIq$?n}nSJBQo{_8<&987M{NwE>+)AA-!cKme>EO=hX z3;;+)-z4q`8IX|h11sDstdYFv6`m_}Ww#==oIkUaxsP7*w55g8t7S-%e0#o_P#poi z>bq|udR&ch3;i0$#fLjZj$th*{A5Re{-d+m1>(H!v74X~Z|^o?mHD3r*$Nv3BHsYf zkyPz-Qj9)**%GRKO^tG6s!NI;{#0oqY-MK^|3bz#pJx_J+5ByOP0Xi2_X3{WrutON z4yuuH_DrUs)g>TVbb z%juZM;P+|Xrp@U3Vilf-64pC7o}zJR1n)_%FndKh$xILDI8Y27<)K!%g$KVlVi{ka zTg-sWOkbWJwp^mS==R!2+seX6`Ips=M>W@cQoPdSZYC@y)^ws^?A#j*3qok_fII5N zss&RTcJWzNDnDrOGO|{%QNG^IsFK{>oZ9e?5YBI|WjvYfnR#R^K=YXT(pk<0VJUA# zlfWyVDfn;rOdrxSS36p^fL?(^bjE*W9qb*D&%GzsMd&p>azn0=Yk?OQDbhZVgA?4s zEV}nPj!oD&g{S+lcaINwZ)OV;-}$4Gcdn-e1i+;i#dJ^slD*p%PR6?SZ?SRtDE+#UlHY(sbP?zA9`>sPWyMO|@C&bzr* zX8(f({3N|EeKj%yA(Q#yRPQ$N=vev?9QO$fOME1P&FPqiq4j}{ODb%b%oEo!cu3(i zei=P@zgXH5M{}bkb{rg9hF*n7<@UMVP@a1*B!-eDbhcjfTv4_C_JHmA8HFd9*wOm? zWb3xWoQaMH8kY@UDkC53CK9yX?l`umN?V5;e+q*exu|tZcMl=${|ZQ(;N~*+Vbt)i z*K{&8^aF1)&g<&P)vbd~&GIXmhI}wRI1Gy{uco4<44-K0(s{mdo@_LEOGCjIk*b11 ziuH3C=9qB%{EM|k0bIk*b-jxc_L`r5bnb`2d}{$AtBehyg4x}lyu6;aS`2<2nF@}p z`L}G={-P*827YyEV$l`UFf6-ZVS-yxh*W)@vekzq|9cN5y@%E3250TM2Ls=n2v`}4 z9YOXhjnWD}mIS(eLEKBs?OvRp*BQ`?g4y@prYdBj&zmrePz$4JlVQ6{Wf7ca%POvk zD1JLfph`b2Izvh_QR3MSm&g9(*%xYx_#tavxJ@<2BZtoWr|uk@N$tP+LCn1nR#*%d z_*l}4^ef632l_%AAhz5mP{zCX`w$a-DThlP7NAkz5S^41zuWq&h`P=BHh}hab0K1mjn+R z6_^}9(`Ocy!~@GWAYF@CR#v3qm^8x6b$PYTGsLNGl#&P@mMju_!I z*?Tq)2}3e}|6jbD=e%T{Z0OiSx=}$q>RWL?i5OxJT)@B9JUSMtv6c)f7hi% z<}oIZij+FIT=l?&Gqc{=aWZga!{EJ%?WJ}&UQ1ND+qEpszaXeyQO;w`{QG|UNQw>J zPM))Q+IMp{|1lr`xBmqL{XWS%t_j6$vNPK+*{`t}&*G^ijO17oqXTNMR!86X1c|)+J37F8BAF#lO4!KiNS4y7DhY^yi{VJbal%%b?8O zgvPiS)q!l3MtX8}A9m9djarY6ED4__D{x_$je0;J^GkGC~5H+V9 zA4gxunXq-Z%aBdH4ahU50SUFMSe7yz+WM5+AVKU1DLb`3Sy}2;a@j7W{*S+Z1Bkrw zrtAeF1Bq0}^uOT>&OeJ}jfI%fC*(GxflI=$hNKs1T+EKl{m7G9lt6of%f{+ z)$9@Nw~974Of?x@)*)ssqNS017>jA-7gw@%oSb|NfTvSHNqtk=%U7e7G~SvAX9>#^ zy@$5eR=LSlpdypL*myz3X@siAe3;cA3kRhU^S>I?i6hyG-GQ?Iq}I3vs|o*~sqVk8 zgi$egM*8c?uKK=`PZEB>r6eJf_!UiM!3l+oOlbsZk?H)J2Io1QRbydbF;fMlkSVeN z%LFBn z92Wj|$9_tmZg9eeOMZ*>x*0;nN~;N#=7E)Gb`NK%f1Vg|-{G|r+3`WW_tG&P4af%n zOO?3~AXn7ZzCsKi>}LB9q2fP>#`x!r?&FiD2bNR91>-*(QOfGcOfGf!jNHECcKvo0<>;| z=W-~}ptaJxLSm)Bg&4|Pv`Np2dOa$@Hk2`AdVW6XI9=|>;Nc6E`V1aisN_L)^$v3l zL+xZ==f-+>&9dGI(X>Cds_t8oViI2cdS8gHYdiG+oD+#;za^&TT@@ESWjL)_$CE6r zN_wY-4!pGle?^%Ti>)|P&5mdh6!!K^izOkw3G(Yq2PjoLfT2QUD0NeB$zPRN&^71! zm|Ibvgr8A|yBrgpHW0KmRgk06Ap(v|ApbeXqygu-P(+w_*7*gT;i~LvyG-`r(S$`n z%#drF%;@X;T4S?q$?LI&9Ab@5!0O)kj)YADLiJ5PKm&VFU+51Ef$Qq~%T4~up(UK~ zULi6?zP>&g53OSGMqqGcA~gIc=y z=Rtv5h567gsyq=t;Li7Ed8*0EjezHxujwq72C&rJnG}0c(%^pRck=}Zl0}yK1?NgoAIjl;3SHN_ z6Qsx{?#{CkMK3Sai58TmScl3~s^C!KCdndDMf}VPG7~Fd;juOWt)$O;Dp)Y0Efp2& zB+vbEQ-X{{xP*kJ!%S}Uum&nt!@GO8OggszZQ1*$br2tp83AfP{vq1f+^QPD-yfP3 z-J#9dXa}RsZSNtaY28-xfR${jDjSZZt>=u?MKs4Iy5_z6`7im&GbI0yijiwAcmPR_ z%6sd89HYWG-`G7qJ^^=RD|$V_g+VBxjlVuXI0~$dQ3Wd^f<-*7F)95 z_d$@!l&Y_Ur@+$#@S*$Xd_@dSxDYsqw3Vq)MInRVpA0a1)^QWo`qXbg#go?tL~wju zUjL(jf*KwJ>6ec|yjqLDG4~pWump0PBD**gVU1l!uQhto0duES3EF(7`P{kp>A$R% zo{{mo@}M9*z-;bQ+;e5}cnU}PNkxa9AW*sTUzdKM-$m{-J&R(x>`K$1VlRm6bvt9C zi6&LwdQ?3^sas_I^Yu<(TJRr`8jfILm-iX?-DliLnQeUrE+r8i z9OiLTgSfQ~VQ8-^K7ggFO=@V!1CR#I_WGu{Ps`E;wSAYD4QWo(O#8h&NeCbLo6i_E z6iN}Kl_*A zax4;p+^_@W*7cX)4Z^A&OgK12G@TtHymAq(tPcjlhB0#>L|6WqA+81rY6Wx_wNIZ& z{^?g0c0!JiR}0IGPP%`3;7ICA{IA#_?@-LftuWJ)V6mRqz}tTuoSX|9KGK}9qsb5|QIRS&IWF`TuTYk~{}x7-|+A}|iEo7~epb=_|M z08MA<2Dq;xPVB@DL?5`3#`G~?YN%R_PM}mJBL_I%pUl5f zv^3ZyuALhQHoDP-?DM^}p9k`S11^W$m0rAwpVPLRsiitZdh)Q>h;`7hnnljNe2?Dn;x~h*x5V8dWRg9UyqIwx z&=g4z0lhsaFK^zF&>`KPDh6>1(c(E?-+108_CWS zaD+SB{dlkYFG~RPcfU1;HpPN)%?T(CCA|bfQ{J|6qwQm$k5Ez~C}hQ2f3lF}cL9ipn|F%MOs{QaYv$j5Fsni`co7tjZugEkhqz0*Z zRLA4&OM5tEeE;mC(!B^Dwmdz6l~2q4K5Wmj7*^yX?zDL(HAE76DQS+l|yEeQs#)S z{l9+0^*zUp|1FsZZ_Uo*V8AYARUpzMLHFQezs`(;azf@cN$SamogX&rxY+z90V+(U zL#y2n355h)<~!Q|VJ?alaOrN3-!X1xB!u>Lx_#U`d_K{wW`G~Q5N#hKq9Uuo#nbzx zqzMQq$`6a_0#G!GfM6v?ncn~Ge8HXw^k zIkZe`qS@;e-sOabe%#p4hApC1JwDfCcO{p&(Zx11mI_SKS|H?op9&OCl+IkzzVG{| z75Jw+oZb7LbwR@=W_v(kFgN;}hJ0b+$br&4rl2>?Nypo34h#K_x2K4Mnh1OpuQ%_Y@RR^C)y%|$dw6I9mcLPr93r@qw zTCDplL&L&;d+0LPqZR5(NE95e)M+%k9v(B+{F_R?@eO8UjyirLS5nlZKvv=n?w>5Q z$KeU-In+|Vm~J{GZYk9yf6cQXR3&tb;Z^c;M1qrD$}hA@3C)!vA}cfX*`|H{oH7Y% zF85~i$y#_Q8cUKyKd_SWSa3#n$uup9mEc;!Gz?zTO9Dz+4YP9Qu>-Ss6{&u`qZwOn z^=&GNw7|Z2+nNFo7mx>+_%Y(AI+m3NW8xS@y~yTGsKMOG^=&E3p}1d~N#(~m68)urtEA!Hx@&%Rs@F#;#fIAfLJnvOOelPJBz7s$yr)8V!07lEGA4T*%fl3*TYYj2~TGUkb$T-1XtvPSqeLcg_%$`rEXgaQqpvz^A*ZWtmr5o8lu_dky_Cg@RBmakOVk?dky~+d*-{p%xoWJNtNtoI1rUihSQVx?T_!$Sj4C-)viJsPbgszah_Q&Vf2t@yXy(xgY%HG2bK%- zt8=I|tOZ2A=y;_`hQ74KWG7@(dw(F45kad(RR6xmsj*9!b|8v4u17LT%GNgH9WlG+ z^Yb&udRJhuaMahsnivc`OyA=LhoO;?xEZKvcw*3evS4E@q&t9OvE8Y`8G>8+b}YTc z!HMwuC%fKlEk-DD>wv2G2X3WeZX1V0yoW~^ zYKiXBw~XS2JY{q2ud-DNHL1v&UQXMuxFUs+@H2raIVR@f;*I^nqv2s;4si%qU||%m z^WR?#@dJ{Zj~u#PsHpO#i*9Fa_A0AM`dv+)R_a%xT8r(E-D`RSI-^2Er+_pn$}TO` zy>2#*yj?iiCt_4td@v_!R;w$5D+Mbw?yFF zw*~!e_N@naHnajgl+^=^&OQ*9vpKA9;roX+I_XrQx1O3gt_yj4kDr#hxS09z8q*a= z=O^`dpAHg&<=IWMX9D`;tSac+sLeh-XyS}{$S(7HT3RnQ?Rpz|3;*d-<+`= z^rRp{K7no4fCBmIaXR1Iq`|TZz8mu+`Hz)~h%^jHW;thr?ZN%GqNy`sNoonZ3*gwH_Pn!DPE; zSOsZ6`VJAKqDXX)|CW5S<9Mj8+yzgdWt9W>R#|&oUay#6T2Q6@oweb zP)5gPjy$A{ga$&cl5~nk1wUQDEq@qcW<35Ma4;L@hDTTj8A&7#b;ZDrb(Tm7_ZwVA=*WWDc9dwuwlf8)(hGW^DAP-r?yzD3Zm0({`a}zA|SZuurE&{Njd<3_4JkM5|p00S* zxc%`>5%7vyf$BA>eh@w5F};3JU=IS3NTtM5N)GDSb>!~Yuu3uYKQ?syQ4!RtQiS^7 zSO8&9=m#`*6CQXw6JONypB^8Ep@MbVMJ?XTJsrDkw+3~I2>b$%*ZVD*8X-DRBH3EC zxf{#lMGxtV5C{Z{74W(R;bHJ>+cvJDP>@=EC2yJyUuU z(Bn_|T~8;0It?d^;1Z3A(-PngNm4XT((S1X82069IMszvZFk7(`&eh0TV;l{gz}_} zayWn-G+;~CkQ^plYqPS`T&=+FK&Sd!i);+kcn0%j*fs6v3Bb?oc!^S=*)2}2QK^#< z-b{GIW-YY{K-|CyD&1w6r`2zLT?{`-#UNd`XL33}$K-|SF5?fmhQrWd(5MU==9XHh zyj3h}khGRxLcjq&5hG05{CN#D=N3V!uY+*YWw*Mm`^K2HFa25VOt)NSj4}BDWS!%L zaM6Yixqg6eN$oWGiJ7#gpyaSg?hd>9bVmH|XOGKE-K<;0oB7c-23Ss()TpB>p_nC@9DqN2XMm~Q-fD@>TU3ZLipUV0}!}SbW5s1o>zOF z^43oXJ5IMqr!uN<2vTXb;G`0Y-;yVbZC z4^23USa0#Sb-|hs16{U6SE|SR0nWQ}u(lK8D<)g711|xZ;N;bYKYm#CU5#IQE?ar4 zJ)CmNmaDXuzpVDsu(Rvl67$dsVid$6=r_6(9KD^}j#e~yoI>*+~7K2hAfZt>>H>|aM315YTp zI!-EcCjz?#fHS^9C z9Ezhpn&$PoJ&jv78;kcRbL+SntF&rU-K-&@cV-Z-7==1aclQ6>d`fv*1FF4ILF9AV zd-t%vZlIpSdNMHA_eokJ*AnW^dd?w7^kc3&)NA{oq=S(8itCTBIJlhwRP?|?p zDSX?LYjpC_A7I|X!chCjCu;g0j-)Iw)0F^*+dxB$x!*Z9j+ zu?v-Uc0TKji0f^ZKOPOMK~Vp~krN$G-|Wbe4=W*tlh{Q2_veN%6Bb0#;&` zcU-5Ou4!C{p`TJ7?AV*)Ou({f4(ty7Lv0xV`D1|miUVw5Bo3mhyM#vcRDC7b!8 zavz%zO%o1wRWzUoI_{sF@)hxYyPo3_vlfQqsjy@EWKYLXuaoTE}_|xj?JHh~g zt9nF2i|MbCtS1Gc(QBcBGsRD(su5zyVzrc)QIg-{i5fb_Q9_Z$ zZl2UQlr}^5ku`yjxZ-lQh?!h2HGj?gf+OP)2{d-Jpa**-Y`Bw#j+^%uc%+5UN}Jfp zx`^fdSxik&mX9^aJ}ABgkoOc z!+t4Bm$0WUs^WMmBMYJ(a(}KOg)P@kx!@*{DV?2PBXXay+&^kL8?VMn!k&CW&47^;O>KiSTiE z45=SE^+VZg6&4wNeWt{=LWfO_F^tok=+D8T$0qU!3gH^TangDH+!kJ%Q2WmaY5Zmd z;et0&x!6ZHt!{nWWh@6tO~x+W%}p?Y_mOp7ZEov_IrZ!ArGnjc?G7(?0}AW>X+0nI z26>Nlct~#2AQRmETLPNj1k)XCwvD!le(`^uaK=2;_o6VWhUqE@yui$btT)_nh7jHH zV5N+#U1b|e2W-w^k}|=S$1we&NawM@n9KE5$O4B#vni64+*@*`=I~0 zVIrst^y5Y(S!iahoXq`EdM+sY+2o~cDjZhR;P5PEqeM{+WFo zDGG&x3G-S1&&|Yx^R!d+PzKYr964WRHE%FdTHQUb&Tfv&tX+Qkz^~Vf=Y1H?qX|j@ z-_tZydtCe{Rc{()e$jo9gVeaA5i#qArn{4C!g137j&^)lO8Xw{#&ec#TwUgGS!x;y zBb#ldX?;O=`GG>0@_3o?J;kN@1tnVnLcZGed~}&oEm0z*Qn_oQcV=4vfERniz z2tGWhD2%k-2^{Ch>=!L?dEGMB^=VQlc%RC6>hLuYjeE6madF%6`%vN=<^Rsr;l}HV zSm?2NfLAT+mhh93vCSS>#|=lL@Cg;X#tEz?)DvqAPfWYJg{!N*AABG&wqrBjfH5nt zl4b&MSzZ@4Fx#Q+Bx<&}24X9Mga>TySJVx1TSHcE-r}L2Z}cU?gu_J=U>V~BP|e1ck$DJapz9KaR3(H?Z5Wc{h?va=`U z0`ss{w3bI{_5Stifp3mrwM8x&4%UO$vwMYS7-VJU$j{t%z3B_8zm%MgcXlWd75z$s zeFkP-xZ$72pJzNmmK3GcqMerr2Kp3cytk4yQB6``7mzGYqZ#Ok&?(BVIE^yHf%=<7 zBKOColWSgg9{U@isN*)z3Dpy1e1zfe=YA$>WZ|W$ANHl8r=?5Z+0vcz7_-49QCfQW z3tgUn2}I-%HXVULj2yPT1ih{{+WdkfzC}6@h~~ex*>|rp{nlY(_ntsEnDc$LNqaxe zo<8D*ir0cF!Mgi0;T6Pgdu+b{XS|h%y47w{7c(LSb@Jt&f^=-$^`cXsOS;UZO+kJiN-Cfd2>NQDHc ziTL|plXhzvdjh9IX$-Mn$iW{-sc2B8sZM^QfFi=DSe!VgsCd;Wx;fZ(aN@B&sJe-~ z3TrzI*ED`7aI(R1zlXKmwmp{d6~j=q`)%G7qHs;{Td^Z)NnKN!x{Dqr=!b3!@~q-I zV3R?yaw;zmK(j!xN8yQ4eiTaOjzl`E^Mq-8LAq!67W_cI6gwC${uP-9`3GRPXUT85 zXK|eAF~s8uoy0k`42m1rD~QcSx$N$t)SW7|#_Go0BFrO0IU@=08fbl+$`5nm%I(;mkZ(C}m&DBsbTMi!M5!_L zlc|{{kau~&hSAj+s07h@mYV!kxYj%v=9`k=S#N zsUo&pujc|5WNYbShd=Nbt6*06)}_1H5dAU|I87TM;>QAXFJT9VvQ{c5>i5#l;f0Lr z0uH9~m z?X#A(*16wc6kQPQjf*owE4=VHv|j`TiYFs?xKn;os8ozLj>bV~b?<0nJ0m6#vW-Za z+gV&yR@UX|9~~(@P(pXkKawOD>0mrHHSsqeQz@o1)Uq67_~hf zbsSv)I+nCmc+fG@F{2*{!FO=`a4!zyo|$s)j!yCeC8Yc)@aYL*?JN%~*(P*^;#%H$ z4-p&pWRH$X2#8)Ed%p-GNd<&(^Xl>lX(9#jleTWlcck+Y zSy5|;Wu^E21?Um6kRaA(sY?jgI#Hx8&eU+i#KU7#9dwAnVEm?V@XSCb7tXKa-N`hF z>y(f27tM7X+KF*1Im=U{?Ev}EI1|{*j*#)ED`~7x3eC>ua;rPah^rA!M5mnW z##fv~yDc$WnT{@G#wYXqUt;IXxGRPuRu{Wu!xh@U)C*)&H^hJAlAdG1ljT%uHHegR z_w!@kVX4{t>zi$eV9N)GxAw_xnrR)^8X;A|k2bA&$?|lmZ7Zi*!Sg3g1Bgq{oXV13 zky59Tv!*OZo9lRnmNoMGq#rp73g6jC6Q!ITxQ`%IjbVM#EgKSQEH_ z!ol6V>fOn*NDhT46{mnCn%TZgvIG;_+4|6D*ArQO>W9yTtL@_;n^inE@!hvKge%}w zs-};9X;b9mp-cCO%@2nkles7PbCFzPk%@c$URnJiu`r=KADhL_JatD3*~}=q3rk$& ztPJsU64{6*!prFd-!pR+{M$0DO$dvfsI!b&{ZMNOS2vql-Ev9SGWllv?lc%q5DJ6#L>nG5P3?CoA_TC> zeAE5c;5+pKX;JI%02=X;5~f30nV@AdIYnm)JGSyE9fMNUbAc^u)&SLo-COnVo839= zTGbC(R>AJi<28Ehiiqacyi;h1(hX53fSV16!(@C)FBjnVO$%dBnWndcoSt^RN)}CN zbM4%xd^Do-J6i*ozk8fl8q3RdSabdram(|ob*{!^VxD}pE z|1rWhJSl&FM3{s`F7{p7$i0(OZNEQQu%a~l=LDF+Hvf@hItV@F6w!{T@CS>cCh)zYO%0tXjr*Ah*?uN^?KjM&1nQu>w6EhLdX23B-L~|82n0e$|ul~%>vEfIVIoQ~_H(xB` z`XJ5}Y#GlUV5bp@RZ&vm;v@TUQDyE7ST@;3H!hX}!oU=;HRoQexhs0x-bTemKU$6y z>)y7cg8}khP8PInM?OHF0@15uhpzBemxn8UUFou{jP+nNu;FYTP886>%3J#}pnwaK zn4^1`@-gNV@b?tcIE zivGSZcR`TVv~>yYrJhMenXyoRS{jBcE~k%4{V0S3?#YX!FMH*@S=@NBoL$&_M;8;K zI!9~dGj428h?5bhm93S&x~AsZ!6DYU((jP7HE+1to)q7kZ>y&_+J6>ObK;rPQriCi z|D#{0N5Y`{Uz>j|IOJ?j&Q#78^>tvXDUbuh~5v5j|1re;?@o?$`f0-T%*pHVf>Zot+)hhPA`R(TL7j8bv)l zrcY+$@gxGC94%L2(+^uTh*%#9s7ex~9Y86nC0V+qa5gDnC7d5qh%mNT5>i(xb#s$T zCuXFBJSiHKHWv+SSTU?hIZJrSXjS_T`7Y38VZ6_#P zzeN}=tfiF#yc+$)ZrmU7m8F7=TW?AAG=5uc((&3k9-;XC=k&J&;&e%B>YzXO${^%Q zm!W;jqkz1rj=E7p+aHL<$9^|arFl$+&qE*r_|1h zf_mxkq9I2;y+|T?A=+gw+nCz6Vr6Zu;?Rehyqt5tUm54$N#o`{cjMf6QKgsTSJo(%Nh})AarAqUzJX(|1@`T zdvQQTVBB%$bn6jxqVKhC1H7w$s<$Z;bZO%Q7IMrap0wXES4?ZR6x3$3Xm*A?KD)n6 zv-Cj*mVKM%ldPN^ytqRqc-E}E%4qB*qUCJVnp9^KKq>8B^fxY^p3Sn6QL)+rzI8`* zx|G_ICu{*P&r}o?$|Vd8d7?J#^b9w1t~YvUsw`XDH-K`c`2#bX|BtY@4y&qLyN3lq zHX_I-L^?Ktbc1xbDe3M8LApBxLAtxUyE~;py1To(`IgUn;yveif7kb?*QLUmYtFgu zdyH|9F+Ne@G{6e@s)YkwRs-35&2a?az$zkcI{~jjZ|~&f6N2yFe&zNJL4Q6(!+2cg zL$k|OSUBWoKukp@^zS1X6Yi8NeALyZK4II6_OBsHY-ypzZ0gL@{N#T*?QeT3}xR9i^RBMExP>_FswT%t@vsz~f z&@Q#>G4k>*`+u9@v|96a77-E^4+?N3h03i)+xLVLIy};&_%O`=V?1 zsLFpVkbJJQluXSy&_OIQPAyxNt!gyO-96VqL`2*F=37SV+#F7@>r{iYc%mvwj$!{1 zx65Xqg`2`$R~JV)8xIdKuE$Q!oSs5Zi_#|=;k4stI@ct4)UuC)II1T$Tg|D!YQ99t zlq(gTmPRyNl3^<&Qw}Zs7+f~s^dMU724n#|tkW{ZEn;UB;TF=4z!Z&vmp)Qha?le1n31 zkx_F}UJd-ePU7@i&v%$HU;%KE^Tp08bZu=-mpp}pi`XwGE9(&9Xc)n_o*SoJip3|A8B~S zYw^>i{Q>{ znE!bTF@jM30);1)qYlNtBw-i^d*%m9ixUneGB|3cfm55lnhzrKzqd-T4-&s3uaN@l2z3H@{go1`PN}Jog5Q{Em0>3f) zJTp04BO}!tzVNr;EC&U50-fPQMs~?w7Mw!X{;f=IPkbP@J5Fuvn`V@H$X>8lKqsB<<-8 zfTQ-_hdZ}K@7`BFd7++H=>92mje=f0Z=D`vrdmDSSux@2CasXT7#Zk;kMT(TSvN3OJY@53>OF&VHu-+5vYzXQkd zfQ7LG1zc**697>XXM@#^?ib>{x~8TD#JL{kJ&g3rHM)FI8AdmWaopWf(@cotplclG zFj${r@JGG<-bA1O)Kc8R`CJ(xtKXOrM7G0bxteRcIoWL+3Zy+eY~$sJe% zC6|fv)4mTzt1iVyjAA(&V*aN!59j6-HiZxaOOY_4hda^T-7o$jZ({c5K4SWQro~%9 zEA@L#z-k)?w^y#xv;lDl`s5K(koR!%^1AMPEjv~#vK>dmbzlc9DSy?FX{M~4cRj{U zFxLBZ2^aJWN=J96?O!?7W~{dp#_zR*hlW-Jdue%Skrfz2`|)E0M5SkA)c4roIJUL* zp&{kC+WBcR)g;LQN^xH}iI8DknzFblMb|`%-W@v0Fy9+fJijpG?~lm1UPD2tYMB3` zdE3ir7U{2wgU&P4S*h#kaW`UMQ8;(t(n~$LkqCF5RkguEVic)T<3k(ttCs%N!r#um zr39#|t}KXe*FO!E;a37mH5K03V40u&`68e$Fs*MtQ#iE2Py2wnse@-v&ha8eE>-OT zT(~=}wDI8#D?C<2b5CPos+O?!{D2P1ct=bb??r>KM&(nEY8MZ&$w8U_7&IIQ1w$5O znr@xU-bdP%r(Rj6X#@yaL3Dq4?U>E!0J6Q0Ab-%eHN1 zX7&h=QDY+>8Hvtf?362>$~vp?o7?G2*Kxm%gvsSXCXuVnk+e|{yNX6}4L(PSS{RC8 z6w76PPrWd4LVU-}!S=%1f{<;_+fK`&b+w*gt78gk`j2I2cb2&S!y>Fu!yFmi7;UPu zJ5fpj+Dy{gAiNSRL%oG%~Okg&!wm)1qte2MpJhYG=fAmpoY}6Tsp~* zekNG8o?tw`uQ|cjN$$HyxNo+GZKebXm+U+BYZz$3BbvC~S#(?dZ!al8-t-?h@T{I? z#Wh~u+rhx_V#>+gp}7qVSJQy1&E#)3o07Oq8Xk`7wCa5kIv@yEyQ&19s8zF4$4mG-BL0701RBrKgBnx zRr7*KX6z-xMdXCrx1;7r)MZKM>pf!5$#bVC7s8$Ua`6tjfUK4pc{66-1Ecgg&(kb2+`$IT0^AmO7KzurJR~&baoWh5S@iQeZ|`55LX?q8RS@ROqE7Cz z@WCCXxhN#`9c*5u)2|rf>venhy_tA}Bsi5vW4C7q7f|v~Lgc^y|N6x8&GJ*~aox0@1$I8zZE@jn z6%p|gJo0wYW4OMd=oR6y?*#1+5d#Ow-L8li)rEC>S8v$UkAp{0UF$P1xz-+KTir7f z^FPb-E=B%$b>*;aCeB~gxmT~Qk?GH5BPkNMga|~8IMgF?noX{=fB)#l9r~$##eK-ri6%`nTIo8?J=blNB%rvatF9E{`x0YkA=e`!NH3zCM{C9dUI09QLcf zsbM0yE$e1Ax&A1@X;4SplFgOYUbTtkRjh@EMM=wi)2*W}&EwfGljGC1dY5@R^L4}q z%QP*`Uwyct_L`@A&X;-Xn0w`^W(U`=*H71f->x~aT+NwyWO9=f@&2Rf!!`RhthY=GcTDCNb zTJUtLROwo0nyooe9Kl|h!%{fE=rTUh$+2#0L<6Haz{Y++hcZP`A^BY#>Gm%we`xufuywUp3;2Kn&(?tITV z6uDXl_nw=7ws76QLsM%hb2^rdt>)f5Gc_=!GizB1 zPePtjvgOK?A+ zBsl~8WEGx(n4aFbYLjF>Zk-Oe?Nf0N1Qa|=H`I16 zIXMl`RzSoV)fI@lS_jc=-3Dv(3 zOTw45s*5V9u%M=NbH$h9`ID|l^-`Aw@_)_&rNS|F5iY!ZV`zd1JO&#Wx-)wUkBgsj^~DoCouOR z{sL`icG_`Dxc4^f7*3aH3{n2D^Ek3ejr1jO?)4uWblB{VriG!`111ngs|{)Xw)5)P z5#!2SZ3rCH{wZwmR1|Gvb9jN?G;*-kLBUovtn$T8-Ir%N>=7$;^{|uH3t9_=Hq-*c zFC027+}w-)?HUcX;eb_f{UJm+#MZs*Pj3ir1Qfm{_?q3IhVt@q>v^+UM1WU;K=!+= zNj$j+sJe+W;_FfKgQN%CO*tf!IX1m@Nm8$mm+5?be3mdYCM*>dW4InK#!EB>1iS)S zg=U0qfS;1TvAvB%Fa}j*irv{U@()!C1Y-_6Nq94gMuW@1RVr9E_zb$vL;btVyxm%|p$eM!^sWx13ugw^&xpVd6^1i})0OIN`J_`iO=y!DOwKHqx($_e@p&8! zW#_&>sH|{0|7w`;Sqy@0`1=`OJ$&E{?~VIh87+lPzF+|!xm=m%J3^B;iu~-9To-!a zfdQrB=%wZcB+&<21ym2PRC(YhpmV*yUODX{bXcPjV2pWxLx_IM>2hUC-qzjO39^6h z*958oH7bjj;fF_?DeH}}O`$2vpC2F-p{@pWjj*2)%6kJ>jw@m2e;__$s4hySS=$qoOJl^`d> z;>+uZZV62IL=2yx(h#0X`I;pfY-y`~rM&z!v;nUH^DBuhA%0UgP$+wX1`h z+rgqreV>NwkY2+GSpk2fqOz$4563b5n%DnpsXY}1U+`Bj?0fwrQ!SKyBO?R$0=X1_ z(GiV@D_p@X0Cy=>Qmd7BBNo_f4?ZZ@8ovCg;P^O0JKJIs`e&w%pv9x4()z|R*rd`& zWc`ncGKbwBDHsf>h&-9(=r+TJ*TsG5-p&R-e+|){Q&Am_V4!%#fz3uv+tb{t#vQR zU_>W7i}l+a92B1|)A_-5x05*?oi~V6cF^XLkhcSbGCBbPT@v!Ig8p{aXof}qA57N6lu*Nf*J`a%}- z8NWTe-wjKek*+prK{oO4A#gcJ2z9A`1;smFZf(7ARc0&@KE`UI>R6+;-PMHO=`3$B@G&W_hmt=~DVD}gZ_|W@ z;75=Oy2Y-~b=Uc=M2wAFZy43+6L4fS!EO%C=Zf8X-%QclCI0x=3jVX!TFD`{l<+ZV zp=YbEqnmuEI47^JSjrA}!PV(Iu`D%QQ5a`iz%EzT@YnOdLQHyeEyy>sJeH^q*LP&f zk%&OA&((i!x1BAw2_^b?UJEDs1i-2Nb!tK)(@{gTvx^e&J@5Wk8T5~v+6W%5B)<&r zJqD%wlV`)h0BEq_dQws8i|XRgJQubn&Li8%7jDlh z#6xDB`eYY=U9Q&-DJOb=9r}Mh&p)UV9&XrasIqJqi9IU27wLGnL>0V_&OoVQob)+b3$-ki+FPFAKrQck*g- zkjGcZk*9KB*@@?dm$fAI38TA?n<+L8a+B$U2qCZxyez8EQ=&}S4GmuyQ4XSI*2xCW z-eQReI>qC@Wk__cN*`WZgPpCn`w=h#Q{r)Tzw~oIqnvJTD$8H(!+*B||5~fR_D`Fg zcpAKqfy_M;Z+>xMbVQRL<&oPQmrlpAtS|FMdpY(LcIs;x0xupa_dBPB}|lh1G10n^9&B?hbF#V*c!#j z@1JjkXy_k3h8CI$#|d%7_HmXz3wn8ZC6}q^cHGp7GU?CkobKHoko%5Z4|LRO#-z9* z^hU)yd`o^oK}#Lxu`@Jcl#s9}HTi3DkN+HeK-Oz5Qc>=wmTn zk^5lPH%Vd!ZFScS@i>kFK@6!BcVEB`MUhOZRgNRqHkSA43M*nFJ(BCH%R+Q2{0%V& zb~~py{0>3$y_mj!71u-OG^s{015e!Z&kI7X1wkH%qq)!bNKpiCuX;P@w|bGDpXsuR zo}*k(6PIJvx}~C9UjFRwOEQhW?nfG{9Ola(w?nft`}gHgHwQN)VkMdn3}-iZ{QAKh zD*)B6gHt8&E<~QYV}kwfGs+y#7x;SMBj5+V@h+)1YOlXS>~*PM#cDV(47lZA37Q^d zC}*_n{fH&gWIRiv((0V=y4m-vq?qSn?XFq!loU32!3^YItknA%b#5A0_xhQ{rfErL z`q*P`<{DHAu|}eXJvuU8AF(NCrb1XaoJs2*doOp3vZr9jH*oR9bBcH0^ zKrFO})oeU$Oh~Sn7^z}yG8G4bmg@XXbvXT{G}$SkB98l9Hx(&NXR6a;LH3aB4>(W2 zl{vLP`p3P!*q2Zqr24?$0y|93W%V#Xw*8g4(oIB9PIN1 z{M3TXDTSYP9M5 zK{*mG=Wubi)70D4Y@$;|jpbiUoyGtg?^~(AD_p35Gs4ekd-6hwru865|Le4|>j|5f_@8N*PD|L$RJeHL13ox0s{evTB@JEKoQ z(<>tuv?r!2NOU38WfxTuAvg5q$9C6kPg1myo)?YTmw>R#SypyLrq{p2nl zqE8TZb0s>2>$EywS|_re;l;J+K4Lb&kwi-_wIQOqCy5okK%3r-H&Z*%%oA^;9zrlA zy?X1NbvR2bGivssMxzODrcn)rkmI9M13psl&6R(J4E!!PXRV(WE-!lQF#hAzeU@q@ z*H99>9KcGBI+K560*=*64q4kaMvS-wjXW|6%9w|5$s+tvK!GvhNMNm}bL_|@b?(_~ z{ZRxlgE8;&u~rMZK8lja)D|U@=k4FRx0}A%XAAv|PEK<5rh`Q>L*+1IwKi23J5z#F zMe{{iaq}YgaH*V;C0m_EbpKlae_yn9-}w@ONO-o##C>=Py6d$dAuxiNbtu@HOHVD5 zD~9s|@561++k*Ft{4^iDK5*(4Cgm44Z}8de`KsqG=e@)cS^0tdO7!yMlW{yhl&SB& zE_jN2`Vl4}ZTMVHu@p&(jh<*kMUBV^9juXSlUF?Iv~z9OdGKN}bo13?quE`cdyzUJ z9FR4;@lUz*B_ib2>AK{bM|=#7nU#8{NrV~{pr5Nt2PN^iH9Re+la&-GKIa2N>!==& z4o9ld9TAL(C~v|>!U_#xx>|dVsc-n!*5(>^)~nE2&Q1uC^yi5m)saU$OolaE4Vvv( z3`sdUq@GUV-#ckL`r&cM&=9)TsT0&$lt6{N*#bPdUIWyAY-eYuP3kZvCT2uzEIB@h ztx?q?5JH;;^bH9QY(=9SvGeU#o6Bi8H|J|?=YN1NAP7C#WC;Mqm3-CTF5pK;MnZtd zDJ}jI2%-NZ>4sMTc%Z)<_T+gqc$TsKa92ucNOlD*G3I-TVY$+y7ckuH` z@`nrHE>>^V?0)dyK(Xikk2V&6W!k=BMR3g?HMn#Br~8GNl{z_AxpXxDi#f>?G3QVC-1OgBAOe)3eyD{ZTMD%lbIPKiR&W4qcd@Xz8JhYJub8p&f9Wcvk+6$tdRia?J z1BT{87$R)evR+qpjn&Jo!!mRnmAYS20i<-6_s^dkoqtlfAI^t?0P&o>ai4#B0m$Jz zif15u(Ua^($0Tz)^hW@pLo=F$pu**wZng~o^623DllOf%S8cP#=EbCYW#N8~8_!`^ za6jK^GCi}t{QTrlYXbDVCHT6)7%=C?qQi1D7$VdQBm(YsE_uF0NZHo~a7JLT-QuqZ z!7ePVC?El`(e1eP`H5ZTp78m`*L1N#;g1V3zu!=Qzja4NPuQzr9$>iZ-TCoifkI&x z;E{cHp8BkAUcVV*Q#6cRAcb1w@qE85_Wbn78?JpkpUchmU!VAuIk1scC{Q*DKy)Y9 zKfP(L866WcBYk+emziR0LRoz@*<4*S>S^W+zJY`DBO6fkkdizCAkT)6_L_v_Ms-m` z$=RQ+Gt3Jk*9{?^5oq&lqVMY*zdRM>UF=S2ei`edG|;ZTz^+7T|ZN zR#0G~09VrbUAB1i3d(Rdl|S`pc+pA}%z8oNCl}vyra$btJ|^R{Ns;ON&Grdfr4}M* zpMxKHgugzdP+C-A1uHJS;&VJ1&~H3Vw~mPsE4no*S0W*35bO;%9g0POLp>S};@IB) z&9#URlP7G5)PZv-@VP`i>iVui7`Px+c|C&$A!FsABLcnLS4@)Dyr=6#wW0ex| zb!~b@a5#P4{pNJ)55SU*jiw7#i-ImT{B`Blr|{n#%5M(@w*f|mQ--iS+Gus&yzw`; zGgkI46DOydVu|{0jZ`A51PP$+NfrmyHQFDdk%Ry+(LU`LB}K*lwXQ&o4NFJIn;sGe ze`PYtoBZ6A2JHsu9Uxh$b9b8-cn(?*ZeM7&-kYGndVJ`Gg!X#DBW(b1ODvG!ICA(j zzx=cXrw3jBIVA;U5TM%^=nV-7us#F?O)N@+Ug&;e7bJUh9=Bq*0P_7%&V!mfU8Dk8 ze%NA5mKL|I>X}T``ua7eNTYEI@gkB;!g}EkBthtQ5xxLGpqeZIAM&3S;0gz^WqN_F z0{Nm4e6=yVMiiBmC^s#xQ&(*0UctDmf|Y8kUlLYK$zD_u6T}h|abmA|2GEj-dcTJE zr+nX9X_-zvN;jF?Kaezoi-Sgenm}Y7#fO53R-~D!18rZmbJb8Gq0sCNGvs_8$mgL4!&qb1AHi8wkmz;>wQnJ2ksy9CS+#ExjA$0fR* zDZhkR;)6ehyU5<gA=SMzP^sw+Ub9442GwgH>Uyi#~_h-iI4T{^# zH~Xko@R3oI+k6QSmsR9OLX^xZTs%lOxwDV!2sHM`^0%>c_euvUGq z&ljq%QY{#%^De4iL++Jmix8y?VzXZg!2+kscJ#+{o(1CdpLUTQW3T%-QjXyqNwQqB zNqY}D4DaTe$i)DuwSwi+2XrCZSaX~Y!C}p|kM8lA8I^xPIdgSb1005dE{-o-`FC8e zV%3V>Cyc#XRVipoBWLQQv9JdP3kNWzL~>G&Z8{aWZiItzKGav+-W@c^{YCRS_ zT$XxV;y-z9SKR^@3dd7*(sVITt8YClWrm@AS|!?*o}o(O8$VW$H% zeV*@(M&6YSX#7S%?Z1U2D|f^r9UY8XQx~|Ym=Mb!;9jL;eJ(ONfTC$_y8WrYw~vy{ zAto&0%KQcLn}pd)-v7?=-A=6Qa~sjD?MYf^Vcmm|FG0jhgz;<*^#g_T$WH4F_-q}IIaF=>9LUwer>qD=L`edL zq?BqY z(8;hWSywXRzEfFp6%-hD6%jr%5}~seL1S%o|lWJOICs47Jb_ z3&lOCs@Qz*nV9lI*Em?Lf(p$Z5$TPVw7NVJae3;TZrBJG@p$OlE}_?YC$|z4#Y$!0 z+g#!WT$Z6W#KgoyBpv7?{=I^Hm#muN;sY$?D^uE&x-#@I~blo`;S>~a;s?{?qoCYM_W=f2xhA^6K`vz&8F zWIF^u`|}qil{)ia)A3G;(NP)7H%X@D(c1X!vCb{i(<#BGCF5AV)Q-4%QVhW8NjyhG zEEm1a4!aogG9vK`%Hgz3$o9K@<#jp@g}f34{`U-yp{gd@Cj9f@N6tp~QyUaH!VPre zc7A?WdxF8cq)sbrEg_A;fh0j^yg>4BOUq=@+8 z9W&C}1K&Tqg!hahb@5Av-ji^wzYIeCy*(R7{5i?)vy4o5VBH_vjLLcK< zY+z5X%5;B%46Ox<^UkOdiQm7wg9cqEMlm*ax6 z4xydvK7)g6aybxT7#PfX+%#T(=54UG9XzVMT(kIJDizNuK<5RCQCp5M6B1g91Y16} z-EHEA+ik}Dwiasr=LZ!<5J1VybWp0l>H<- zpXu1?5~0k*bv=@-!a3=S9lYbt9UL>MRMI!3cTTt6FD1E3qyWhVy6{z4ZOlQ`ui0B! zMa}G`--}83ugsccd2^j%X3-eu5U@#41;WgJIy$2z{R+0-N=l2C}k!g2iG*D!jS`1elZ?H{!o#iJ2MI(S0=MWLHz4 zc2hU%w^JespH6&fo$XiJJhvkjh~3vhgWTZ#_scr?$__^}ea|tww_tVNX&LZD5;(5F z#EOLOXm{?tL_pcmpaMrkM65w)fy5nwr)!VrX%!xAn9)XuW2ARK(&lodQbPs79E8Tp4D81$oXbKB!>+)=XjbYO3WzCdr2cf-1sZ^6Nk?P*h>nr|5`xT-lRH_nL@_Nao6#b-p z?)xba%#IInO;_2^&dA$c{@bU#IFt`Jn25bpy1M0dHV6>Xkhc{B>6zz2fmaO?L;kR8 z6&H}}uA6I%CNkjx$$<$5J%g;J{)a>*t>{mf7&(P(+f;t&&uwP)`SJ zfGd>=K%nO2M8@ER%hbG&c1hCm~gYCXy!iK82CtsLSddn5sF`%au9aJ`{QWs9JMlo`mW4`2 z2$knv;loHAz0+0uM}Lqxgi6suF`QGm!R~NPq5eScbH~X@`seIoReX&v@;U22=PH_s zWo~6JXQvm&X5K?V=-A>NZBnYh!bM)~JMoQ&ZYwQn9iNr|rBeUjAnc{^N&?aVG3JffbNAOc4d zc^kDgO1)E%Nm&&eA?JeJvjb0J#%u?-s*4)@M$*r8bBi|HMMCh)p`jBeF^xwJg{%0} zeN$36`K~mv{@*>C&s$=eOsW49I~S}81T z?8AcQwCj^;cKcu0`@cCz8nKnV0x0qzCVzYuy*~YN z)wf8okk8g}^AjA}!ztXfnYZmf02qE+(t3r^t$DQJ)00DfVM)ZSUbm=$OgX^UM+4P2i;GSmkMi09 z+fi#RPlEYwMKq&4>ny7Y(a6v`7$7=1QM6EA|A|hmF>g=rULM<5GiO zZDkjcr$%l_9~v(DI&DsL9@aU4cPdEJTFxIgnuIj2IIN?UNB^B!Pz5?P%$V{fqK?x( z@>Bru;T*U*T~B5^^my9#Xz2X({4o4XEr?^r3?xJIt1kgE12MlTb@3oM4Gp&vY;d+d zUTegfpyGIp`%V3vOak)nz$~5_?-lNyecl=AMKLo-z+@#(dPfEwy=EK06R@}FZg2gNXC!byx z<>f{3;Zxl!hrq!j7{iu8*@Tj5wY8sHXwTTW*TYUS$rI#vG?4zMSjIwMSx#8}{OU_9 z5BH|X6hmJ>Fci&xzqqXlb&Rt;n&2l}at`dw%WeLfY6IYi>#pEb<(0R@bex>(4`kDe zH5%>D##5gr5F;6Itg2jZt#2EJtaXE}_KR!#!PN+L5o`X*nL@#65v@c+=93>s7aJYe z21ve_?;^EZ%vF7(tw29+1;k77ydF={;)fMxs3u^`+ugb9Lb1AE%F5KtO6tHM!3BV2 zg8D+aPGdm|H@~{(r)E027@Q7f%4s9Gn3%=|6J7SDzI=(GQLCxbbFOazE>fY{p{}39 zu3IvFgS}Bz-1)|yqf)YKYx+`G41H4@ZsZfMU#{B41r$Hdk&7xjWgjSry%`$4XD%O$ zK3TsRis$}3WidmF9}&55x`juAh7I#c84`d+dnfH|dt4wO7WKOCvhVa$iEm|yvG>{G z_KCwmSkbm)IJM?kcn|?Q!0T|64JegNX8n*E%C*f4U@ufGot|b$=%f_V&B&0SVc#Q3 zx<2G35~WmzY`K;>#xK}h<5$?tqll((%T-jRCZXq&LeX&uxD#m5$wMMP3@D0(nrmbS zldY?jz+Rsa|JcaHEYyFfW4LP>wpM({Kia-{PKOfoUEjBawATwZq3EqlfQhA+rkVu`RLn(>9%bHQLxA}NkV4Vi0s=j9 zHRidLa~J2(CA5ORJE+X(#vAz*yt!H}lpXlj@7>pNm&1B{L+`y=eSq7hxGFF(x(~f) zpb=>)mOglfih{y!dyFPixQ_OUP{d&YoB;Nwz(X&hE1(T{!xQ7C9>J1O2e?LinRTlj zH<8P5)IPbnh)GFs#TA4PyTiCkRvk^`X9`i~*86Sk6&Pc4evR5sG%_5m^~RbUhCJm# zsnNNE>CV$X`+lIUDOMckM7qEuZdW|k%k{aK7v>z1d7x5>%d(#tvAgt8w&;;l57MuKw+x`6Vl-dr}MzoTq z6|99EDv3AG!^tm6d3WF>CxwYu9kI3EN>r2h**~rwbJ=W(lWTh1tol{}P#-p8sm^Itd#%kk*!zFzjwYPR%!9p2{T=*wBHx2-tbdbuzVOFKv>|DDK+?MLQhWI{Z8B9P17;q(>~X{+3^6HkMzo;@gqr(X zzaLO%c0&mdP_=(Qa1pmq^qe~vjf=sLr9NGdpG~Qq>yKt!8!RSN4=s7FzspKVE7<)4 zC~#eO#k8W>ZN9SIE|~kl_tbn5T-3y=cDS*OY2x-sUnqdJkdP=ALfkg?whpU|Ug4I` z>4^wLRi{sTgEOPWGqSVM$ZU*VI(BHB3(mzd5OMT*>`MP7Y-`?r#4T6c6SqbiHIZz! zO{6zbP==pjwtIaNp6To^SeIwm4fwY?6Krjz*j|4A{9{r5<-^OQx&@hL8NCbczWRR0 zeKvFZ7;JWO$%gZOWTV#qydD1ONcg8fFTsVSA)|({5<}6F@p9k6D2o#n*eeY9x*OxR zK}P#cg&$~u(PueeY8kzQRv6U^Y1F2}8&UGT+o})NM%e2aD8lnV>q8*0p}%=6+>x!_ zgm4~Ng8QKC5M%VA<>vi(iFtNdXTi(%50R-h`;?1s@Z^53eXVIl~ zRzN)bOQ(%+VYpBeIKz;)0yhJ6tp_1Uy7WDuQ@m3bKpAeHLU2w9j0%Lj)MdkhTLC6~ zS)J~7bCX{TJ%CfoA^b@f!MZIAR?P(0dWfg>!)`?>)k;yw8@;t7$=fIDnu!IRDNhR{AROY;35Rv zyV#g3Qr{xH?CR3uz30SeHb;sX5SaX4GFx&_3nxeBK95K$D~^2^>xtrgIgO&9!&e`6dapLpQWK1wIYG{kK3%${s|6kXO%thEdiydtQ0IPbrENST6c; zOQ+d1^C*pg^meQ3lrK)J+Bh2bhu)eBX&s9Bi5A}H<4-l6vchk0txMGEmbe{iT=0wS z(ckhq9@o2ZIqi75&^rD`>NJqjzOvVB3eM9l4Z>j<-YAfeA-u&e8Ps`kKBE`P-u|BRjW>YEbbfV5 z%>XBY^}dC^4*~@__S@WTvJ6u+33X=jbQCBpC!*gs*DSFfhl9*WvcZ$(No`v{KAHrO zPn|7P#;vgL8zNVI#tQYx0v7*ya|HmPqb_E zeAWkvaQTcQG0*zXCelM z_T)%VKScPA-S$p!C5M_n(1rZpYr-c7s>&-1+VPhTct2mLL}&Q;-BFa8My8G1`NC4* zqb|AP8|aQR!N3eP5oo+6-78J36$-zuB|gT{6b04>CV4&{H(#d&=5-audAs`M&Tyjo z9|(?-bd2$~^bQWV9Qn_sfSPr?UXw@h0CNSBAA9a#==7nQ?qz{QUhnVU3`4LPqTL;# zpM-6@Z0c;bhs^P|LPvhj%zPwzl2slDUaUsMuiO;penD#V>cN`POkvK^cqeDw;_DrT z4BjcgFHf`9-|AygbVq_;gJz3seIRppO9pV`n)8OwX?D^)I=h{N2uh`CKZECQ~R(xAdw7ciyr!95NCpOs; zZ%@>JBKIKZ#O>(2W}Iqn)s3KVB26Jtb@K%YgM>c`iI6csGPvzj*xV<9{={J(*nuMJ zje~K;#cl7vNl3W=(>E1|zett)T~D7&c<#(VC-N|)Dc(9UK$h2y(QRWrKon4gyQp{_=C=943m(!o=9gC*ZpXdUomlERQwwk?uxy$!U*BgK4 z<3Tzp>HLa|U3 z^0#Ga1F5rnnvhW6ONP?*`-OnQL7|}XP_8pSuG3ERp~To;RT5kO!LCd!i?80(IT&;e zfjn+vdh>4k%vX4$QE+x|xd7*zF+PzGdk*bh@Y~)SITy>y$=x+fsbYsFrY*l0pG3RA zBNw?jc|<%Va9&dtTXdX7M^xGa*M&M2EL&pPU@QL8+vl7UHUXOetkuVFS|b-zZF+Lg z_TPp$^7m<9?E9?J|L(E;;8Wio2y6I6yWUZoNSFQ!>j`mluew{SD7~RUh|XFI+c&4g zp8-&2EhZaDn2kqVesXW|aH!r;ZgFF~U`suAcX3Z?tL721Hyx_1HT>6Q)mBYDl0h(l zOyf&OOPYKBI=n(zPH1BtGVj?EE#j)xn#<;q}k@b<8~#>J*?0;1JWHh%-m9d3GC zwv5Pd$s}z{?6#J31e;kHw@%!XZpyA}l`Q{kxd9%RmM!J*f3!HBxRGr@Owvaw-p6IM zEPH|nPR8pY_A{Sh-q9>hE!IN(@!{0F>>yk=p{LtE3zpsGjhKv^Gpf>j%!xp>wD5(S z(PfrvNr0krSy&WPG8vpS`TzKO%dob(EnK@el;Qs#BN38=7%5 zH35x(OMnlXfpCGTgJN-W4`F2{VzqMVK2I7KEH0mZlo!tEovxs;I}RZ_&uXeJe)_^HNUf@{y*<1a+e2Ko(TIm# zdzhDyO1}N2U2MIZe}iTI^usdv>pBX%?IX{8y-C_I5NDO85(vN~6{4co;~V~U`35E; zYd*9+=5oX7RV-nZL!(FbMgi-xtDWrknWoflYOaSJJ*9GS*~`-GB7f5qGlfI4icg05=GM34?3|o@4KRGUb;{c~?{4cE=Q8U6dP+xzII5Zm4?o*qy zBimwpQ7t+z(2OIqr=+;}{cXP0x)a@JO;@YIt(|{%XGutJ7H99e04iYki5v+IIZ#5v ziuBGE$!Z01xir`AUUge`;$mzZu#lBN-}!lTJ(d#err!sdysc@o)RX_luY`{Y9Steg%228$GX=_{KCNK`kJY00{s;Kks6dId| z1b_TuvG|VG`1@YXN**MnGeL{{LgL*vPm&RSk+<{FQiBwcREw({B+y8fe?h7=K{13( z=ic!N$`rn3khE$q-m+cY@(!(`T<$8E>0j+>*JR3Yn2-${xSxQb<#k-MzblvBr~RTJl#at(mV|F2D*h8JZo`IiI}vJ9sxNE9o|Kweing6h z5`}i^0)lkPmgxRG)0LU?NHAnGyeo64XZj+xb}qhVN1f<=vcRk(imI6YQGYOlMmA{^ zel20ZvRcyXGLd& zRV9$=bGHP$;jK~(H~+RTxo~m5lFX2Z>v~^OK*jSz#LUBi#Y(k(xlf#C4Yn0 zSD((di(?ce76WSUJLn|4{f-m`5!T=ajjYKMzENz1bNl1rZs){BwuZi|`~)W1tI&Fk z!JyrNY1Ja>gB|9DAOKI3d^!)@uC&?Sg=dQ0HsEf$>O}))LlKtW9=u)Av>MA;`7X~m z9&bE_%=KrVJu9xx{yq_Vwzq-c>d?^G7b+GuO3Z)*J{oG*mAbb8H%LCF9U_1Wcz@eG zw_~;Xv_?&1;whp~sZ}R>e|=ODKnCSZw}_E1(J7F+v7#7R!E3RI3D9Zv^2ePoW4pmT zS_Eoofum-@_EI!f;A`LluL%rMNO4h@pk@%s#^)#pLZB#~*J!fRi+^XV2MPz+0I4c< z8wfmUxfYFM$~~SUo#Q{!;3%jx{fM?=cV3|q><|c&icv~2c6o3*GVbXgZT^UplWz$p zZG?N4j-D_9(3`DX4dLM%IA|bNr(fvM^NZ2_;JScwcJ}U^>Q(4)V0a?czI~g;T)h_B zet&-)yZJRd&9S|my<@r_#Ye3q!cQ|5s{w7)Y!pp;Ltk;PPTDwBJ=RPVbfWx&qeKSz zu($5Db>j#69}%!2$iU+TEiR)Bb_M-_6u}>GA*&xp_IaeIRe<7eU|Uf9*O=cWC5!Pf z`BeM}#_ouye_q<26ZMm&#|IEY(`fWs9jMB+xu~vLc!U7oR(sfJWA#u;QZ)RpxZzp# zi@zQoh7*$T2tm@hy+ie5*4Zdr$F92IFNn43jd=%-1sWXb85l$@M9(RwE&+B#gb!BH z=$~G^wjF7XZ;D8Nqobsgv$9+s&x;YP*ZJjh0HOGd8VFFHhUss5pmOpmZ4`VP{`n50 zqzy6LBxstsHS@-Hx(k~T<_!GVhCOIqAhFG-n#_LFiL6XQ_RE@~TKctmlp`@QF>}>7 zy;wRH6s>l8NA#VfH|#Gy0O$R3Nct7WH|P!941o19=4+G`)rDtBm1SDv93)&{ch$Fr z1x(3E=?n7*`!{na zsH;zWZMd@tt8N>MgaNU*FxxJeR!wq4f5hag5fS`9(C!9g@MKESpsmL$6mOPjq3h-) zhfNH2<5P;5ER*IZuX=4=i(vVgMA+#2@9ejKwKqmG`LO^pC`5uk17OYsqWEo9{v@(; zaxuS5(=rkea?SlqU&o0=2tEF`E+AllM2q~sK3dkfzd1pnqElDzgf(XsQm7OK&)$LF zIIE&F;rgjzcb+~9Z_j%RG7E~Zc)c=gCMo>`L-)v{q85Wga!hhwPtvFUCU7=6Be+qg zsC&8G>p7nYANLDjNSaoXzlf?Bqc|mdn53R4(@-Re2T?@}U(-p88>lk`i54uuiQ_@2 zV-?IR<7kN!*0$)>Y*t+#D$Z{@1xo^c>g#uKT>cPhfea44Y2`Mg__Kr$pc#~A5Ch_> z?rUp6RWe$d@_sts{{F@Ov-cw!>ZL|*_-jp&MTby_4BzB=ME?B1x|otP_CP=4h`o=4 zjEoBYr$GhWbO2Dx84|TTTBCX=gMU_EMmrqxO-!V%|MQgxHZN<7Y?e@a>f4IS1GV89 zQ9U=@WRO4+{4~AVXH_)5H=72WuDPX3C9euV@r}3uR&I;AT=PKNcu{8A^A=~;h{@Jq z-1rimMnf;hpOl{kCMG$i-y6M|G0=z!fpX=`aE1smER>c0RFjw4w!p%kL+~|&)!i?f zj{vFVdM8|3}x}V?e=A&)C{ejyIz>X%9M`2N|CubPD z@f)!~?_-H3x7}$W;;GJhLj;0PFG~p7a&^N0SnxjWVz*}Ny>a>o?O**vBD8c@+urt= z$0FR6-jBd#80}*?0S~e-5u{dZ4~Zm>yfF`ZL(U}~ssP#*ba$HET*5*0u>Q*9w)IiZ zNTE}gI)x&-DuYWxGU{E}HG;aHJgl%;f-CGLAci(MP>h;EyW7JL7i6fQ_N1|S9Mo6t$ z>|y1<`T>w!LbBs!IE|OjR$*8OBT79~V}kX~wjnN6>7NvAN4j^TV1Wk|=cu@=FyZwq zc{J}?QE4VrZhFJT+F4u<)-_atzKQDV%u~|4=!O&CEL2Fz&w^81x!4$#*8N1x;TFJ< zOvDk5wOaP&KgsdUbExSp<41Bt>~}F$i>F*qrjWNRK%qWPBa?kN>o8xRMwnDCOyub?pZT=eaM3f+T^Ds{)CnL zzDs079a%!Rc*U4T3D}0D1T#j+{0s`fS8yWOWEYQx^7z zE-eB#-QhBHB^8Ja=a|eO2etS2V)ROCls6Jwe8ka zcUPg2v1EY$;qviTaPOCEjD`ffo`&i6N*NO0@duX5T>~egjqtcxNyr!QVz3=q)o?D} zfqLcmVZ{vR)f4?J^PnyAL9w7;p9A^ubJaYYf<~oHO{;O;uigdM*gak!;Z+N&-AG9W z4S$PSQCM%unP}nP`E`wn13laoSP;n>x-By=%^0QVRy=UapGZWsrKM9bvs`kk7Z z5GOw8OMC70docrmjh5+|C~l@PH}qzIS=LnVvtxbK@+Y$+^vyFK<#vUaJu*R18rrvo z5+xkPi8Pt7jX%~~Yz3+AXp*Wb&1dh|>_PLrLnVrDZy^oqYyCB_Hqw=0H}`R~g!+7& z=~kO?^G-%L=U_NKQ*Rj0`CJo8(!)G!P1Ap$4U%gh>O@wqS6rF@UW*=J)EMK}K9-2; zA;*Ntz=0UKZ#gO{2fv-aF^gs`6I&%$I%;JZV-6-hba+M!T#Wy?y1qw^8Qz2#pML0wo+$1iHYb|Z*_ zD-0lrqfC5v^5XR>x+skG5M9NV|FL0qS$YO2DKhx5eA3*OW!>!6^0<-I>HAViJJr}8 zt7=%xq*+}YI^YzmX!%DHjSAa0o$#rUTdd#+t~>JR9rcTJX3c5r#dl(w>9e+mz$23G z7|Yv*Up~=?b=Ir;r7GJ;*MLuEQO3^B<$+E=9AABfPTnm+-R?NP^yyA@ctR4PJLRwj~D1ts@U}H`EpT$Mjes= zB3CAjkbEVLR~A0zF*WS_f|io}(+Wyme0|nC>agtIk^Hr!J>+aZ}rF6n8^clKklXgBxUN*Wn!{R0i$e+s95& z-*z-D@#v{<6N|D;>KEaX^$9#HkQ_o>$2L=a9P1qVWKz72)EZuw_~f?QLjbpoCo`M! z4IF6RQKNG%>j&7<_oDPqSItUy?KWq2>f{_VJeqwxXLckaRWjSKFtj8R>!~nhF4~ET znCo*1CVQ%J0<%=c@jyx78ACuEQ~u&{DemzjC4) z9Md=uXd-{Qc}{H6C8#UO|CJzamd62oihyhFv(JNFZnZK791Np)`xa4zUG4MPL1p!0 zeClZ0ue*KbD}WNq7kZYmx8&H_UZ-A9xq*o&>gow@I=n!FA|7-nMPUW`VuyK~N$n*T(a4XBA*m!6Krg0)R`mNKK3|{7>ZOQ1MaB@fP7Q~Udj36{ z{IjyWtAHRWSv5s_Y+H0qjh^K9!j-YH>tk`AgdsUZDcr;Ztp(&}!iD!r>OgXX#=I-S zgb1}?=Uh(YibUql~ES?P>Ov8@pJ91WR8N>b zU>xysE$3ks+O7E}*hu3#cs1}mEHgYkoa|YH#b8q6^g~D3!pIZU5C!4b%sxm;q~WOS zlzbTKz5lUVPxy`eFzMaJ9GlS1X3q`!?Aua$qR~xxs`T4h=JtXzTavxyQ8$lq+seZ% zXe2Zg5_;BnnAGg`$-M*jw}7NtEPoaP3~ZdNn&HN3&y0}vsJ0zfK4WvbrydXcNJYue4wG9 zH}=!cLiX!aNSY^TYuC-N?J(xcFk)8D& z=XK`&3T6XGLvX`Iy<1S%uBZ z@CFPuOCb^KYDD{taAtW3cC=!ivVH+ecnO);lAnQH+dpm|3pPAqpk^UMym4(Imhb2JMOqOmycXH7 zn&oQoTR{DOvXZirDZX-9P)Zmx<3G}=|Gz&;WblNUn#jtBP;w^Gb+pO=DvE@5PlSRt z9-XK|U6vf>Bbpp2HccY*=Md+*yz3vdl1e(Wg4Fo@tNpG_MU@2!hb&>x!{ohDE%vdI zVeCwClVZ1I00Gr8&_O}!m;S#}y8o|hu=$4Fyw=NZYJe6cjR+>8GLg_y(FZYdCKRX` zXhae<#I}uiswBIM->43fV83UyOrdYj)x;mm;%x)PdsS+EFmsI9p{9~uCNO< z1IB6x+PoAcGzVZx3urKd=V^Np*xvtoG?Sip`upig%UeA}Cqr|mG{>;RPYku)Xy+q5rvE5_}`t224? zXnjxB-yO==#|ydnpB{`?EwlN)lkO(58JQNB#Wg#TZZ%qa8tA+2jH@Vrk-`4dZ~kM6 z5&=0f=KP!;?KNgBCnLeo2AG@o6XA#)mY8GiY8NtYfEREZ?KHp+BJbD ztMT(2H;8emF3TyJ_b(}p2ZTn9JMLYf2uP|3IOr$)e~92Ct(zgiDl__LqTxY?_?Jn2 z>vcZR!@^U$!Nv!7?@=ZPbiJrp*A4Owe3 zA4@9BVf~>Ir=P{HW#|+&guhuZ%-OP|Ynl%Kifx{qMKfCJMEDwfQeo3&3Pmid_`* zxbD*i?r;R0v6+Z;gm|xG>|q{1O^cplv8j1MZMg`wMP%pczN(qpd0q4G>5lT|cg9S{ z%Sz8HcSk59xdi_2@QFCB!rJa14NNwshym<;U+ii*3QoGd)!L4-)7Y6Q<76cRo=`Ag zKkI(DV|fu^Ij%q?U|4Rka#|CS<&p7*m;-0Aad^O1V`$@p9Kk=m0IsL5U`~RRnJfCB zSLfUm6iQa@4=8q*YhFj*zpHD`cZSCY_Rcg0n;ENO1u1-i*bn#j^y?$MzZJnG#;`gY zQ1!>aLPGe~JLz*Vinex7kL?BG&Ya%coO(gKX~(94bS(YgxmM-RB5t&f`-R5MSQ`ol zFpJgqY`EC(m{Z4r8yCTjdAP7-#5GGzgjZh0{nF*@^~S2mm!$V#kNey@jep$yT{K@q4+v}#y({s^ zJgv9-_o@2V5%#zLZa*P{z6I8}pLlIQjY&ndper)@XO{(NbPsMr#%=FHUwTDW^*^Esimx`Q;?+a@qv4J**yiI+cfUHpama6LNl;j;xVa8blG4VNh z+u%;YT=9!!;H2?T1NX22`BS8^30YEPS>j-#ym>zDeZHe4P&sGmp(jiB&D&96m(Rtz zZtKkfdTRup-5UmT+}TT`vGLKwKX{e6FRuV9h`#N1XCzuJr_?mHo}N$JquwuKyN)+E zUJO0H^L|<%R83UZ=hc%?a%OP!?VNwFAvGaB!Z~wXTtaoq-t=AEghdMT?%vzyq^^sIYz)MAQy%kBy6g)9XCOjI&2$1Nwc@7*X55Jg2t`0B?_ zudkIEBeZWnw;JHAU9`70b~_m+-J&25@?Z~eShZ^GcwZ)}sm0U(k~_bdTSuS>_snL& zRIv!bw>5UZ=iT+o{(xCOz1E>VOh8A5qx6F{<0a?vSXi?%-6_vPw^er|_BPs9nN*?S zlTm?*)Y}90(6v!#PeKSHyLFecx>n8=%cDv?&i`21|B8cP->sGTbs^CvrqETk)FO)4 z5>C~?sUU!OTl84*>Bv{Wa=EzfGIA>9ytXzRA*#aIqa7-G%H?P~+6Yu}3kh$xhij4Q zMAWhnUHQaRW~)Huc>B0W5@*D$Ld*>foTXdL^b9bH6t?R{LD6*ZEp4ZVCZ97D%?^L- z<2|LQZ0-!D1+NhB1l|Qd&h!XXc#BkryBK$_X5}k?BW#5ZBAR)NHrR+8*TYQlhotHJ z-LHx0$XQd+H@FlYAD`5%#yU~}Rbr6J>aBMSj7cNPhCHM{4{)Rzq-pBN+d%x?=YEYO zmtmCw5=etavvRqXL^jMD@-y-*I7OYZiA)a<`JBG+R zu4*r3i9R%WT(nxOd@=waBM!=q7-o+Z8iET8wb?cW^g>Y^TAu!O{Ql?a{MSkQ*N3_` zhAFig+TYYP;-#gH`3D6%h{Lvwq*FEEsG2dWoI{())te)6NmA%IDRQ7c%i>QTM>Y{Y z!?2#F>gxE9L{G*&soT{-(y@$HnUwZFI&u(C1%+?H3^AVB_ns$LyX%4iT7#1+F&%x? z(bB?h(ta@lF=#Iz4D9jLy0=we^6*V=5oP&4D^Y!xx4kC=oZKt)JrIS7`;)f&a*`m$ zvwC8yq`}!0#MbcHb&W@{98bjdI9XYlt>xLwIElK|X{Y+>uYMvQX7jw+(9!l~ia~K- zx7pT`qNVBMCoV1Z`Mf_IvR)6=2G#{+LIS1R2;Y;@pLCw(PJQc8)8|+x3q8amf^4S} zAHQ-nfSYj7i;$rDj5~4{!i)Z3dL>G}JLSkYeXyYu!V35#_mC}<;>kHROMj+V7U6VS z)Uk^qJZT)zLGf$#ZoICmsn!v)$$^!u{+}!NUmNwmKlH6afVWhE(LkAYk_*Qk<+w`6qp{KGL%ILuF+p;velCwDb1|&<2B2U*HvfMUlev?-Q77q$7U?A_RxPZ zY+Rate_XGgIK>LUK)t7D_BABV=eV&IXdE9O?M~k26ULpw=!#&wzrFuVN{VpKFSQE+ z&-&AS*HL6;B@G@j?eF%IRwDFsDC|zLKMw$Z$gje4A>{Rio;U$yVOS62lXvfgz3eoI!nX4?Wx%BdRoa486j)r24&ri z`w-5!wb))qfzXnO4>^Y&kpT`)U)(O5_mKM}4!NeLOgqV{d$VusV7`pFzX1O8Qe21B z(ruvh?<7Q0Sal^cf0C;+j%5Bsv6+rn!d-%|{gb7?a8s3#O^;Pt=6Vtk;``K(&03Q9 z2j*9EtiCTUONofFY##L__sr31&H&t|Y}g#sWpY?4%+QZ?Smm?ty4J{G%#0mOmzmt2 ze%m-9KMf47s3=QHU2tP*-PzcM20B8*@hp2Gt&Y~ar3WqcrK*UbGyzBqAp z;0?!GaEs^WuMKm@sfmt9T-oJ4y zaFRqdvK=$c`)0c$$DM&XcYT(5wUz1!@1T4_sf@^6#+oADh(a)#tS(FQA7nc+wpF z@gdvgvvS&R%i=Av<&q&|gHG%#&B}_B`0jH5EU47$P?$e~@Ge&{ljF7bJr|)FR6lxr z`N1A%plCK5eu2Jxu`u+}vGFYSCQ-+*r%3wf5H{Ep+F z3hTznTm^HKe?k=wHjCCp%d@3gIiK-w{#$APjl=mFi}_=d%(0g&SZ;PT!dxGd9ht zO|-J(o`Kh4uljK_#e4lYM|yB{G-1&StOYZZnTY5gN+2IzeK}*j+ZBEe3-@n0FEe<_ z>h148c&5OHz{HYIxI{RAbh8u*s4-WNIKOrC%*VHA!I%QfOIr99&I}0&34<_=IU}sq zEmRSCu`v*v2g0)RIL&_hW0ICE%YB^&e4Scm%RLFyYO-oya-7Y`Dz{YNh$~0cgmN5rgc)8fVHfCYzLdC^n}^zmtMCQ-!j` z6%N}YTPI#`VU3q3Rev?mt6|>l4TyH#hb05M7T_mH^w97yM?p;=^O1T3hTV8V20)$K zVN6O<#Fuc7_KE^mGpPWMfDTd@mXCSO3_M%kh+JGKQ*J7K{gdy_uiiwQ90Og;3jcZG zzx}dwYWR^Hk+L!p?8fP7&WSoHXI_t6)N@KTnXHxe81k-yW0=dH|scTl2gywY}eUWf7`iz~`x z-!_7$gx0Fp#==?^)3oBI@ra;6v*CGB;cVO=0X5kQS+~OmT-cAdQ+VEAf_!{l&9^#d zG3hnJgNfkJ<`-X?SMcr6R#gey8VEnD0g6AYG@HcJ23 zfqHpfS>LOJM4TKj&hI4GP4MgNvp$AL)>{IC($7m+u56lf+|x^dM^{~b$AhVIid_la z4UMSAcALi#+C>ymdig%C2V;-t0hC|Y9;5^Wg$Kuatv72dWaK0_$8NuTARuQ`TTB50 zO6e_&zJI1j|2la)c;Ly-&dxfYHkQ-Huqet(hh7)t@}S71xX}yPiVTIxgv71W&*q=@t-z?C%k=Eja z8k`Sjy@-F8Bc&JQ50H7;k_IZg0qFyCCR&Y>4~4W#tNfpIy!kKIBj5)ISraNrb4BYv zNn@0=d9=41OB{&O6%)t5^19C8v|H26BoWADEo&qJIn{il2p8O1<(M7L6q~mL)QKqg zI4H+ruoj1v%6WX)%4?L#&1&rUeZSC!@J&_~L0@I1s zBcSBty=^?{6jtqc$asj?-TJEEoGjVxIF|0pZndNdTy9fW;kK0Y@`oYSLW1N2`D^5$ zsJILDeiS)Ggv8Xt8s+gi)?nb^m`(j(Vx+YtnK`bHA4P&NiI~#3EMwPuf_@&Raak*G zv+b@03ZT^N^|T+ZW+4mI8pC8(COg4(`C<=F>|RUwqv|m1APoTlX+g-k;7D+yCiLUZ zpG}CUkaL1W7dizY89^&N^7(L!41BIrMdqz6=`bfP%uC|?`Qv{~F%4HLJzEy>d zmO70#eYD?UqA9?`!+YzDJ6wNyYdT{=#PjtP)8||h%8iph?d}|jZ(@$JJg<=&<~18V z3f}r0?)JTkI(xie-M`;*W}Tj6x_kG+{qn$1q^{O_)vKbD#OMePZMj1)SKy_)le6UFj}gRpcT7(c%QGSS zc{9&@#V7?D+atcAgFt%#UtS^}(!`qZCr=L{^Oqh7fyy~zm0tm5Cqah&&vgmP^ z2G@t9#}TgRpmaBj*NRHUxja8x=Jny7H2hfA^RHPPIQG{9WvT+46^NNuD1uh>>gBmk zfJu9(#lKGPiD%y=R%5@&-iT-#!?xYi1}UGgFSywpR>_zX)fwelO$t^4e9i7n#tk79 zuV6Eiu}XCI)FKCo@d*QL*yU1DWYbIVSdV)sVK{=ZC10+3NomyDT9Ryvb)g?I)vI2v zHpz$5!57L29Of9q!SvM+K_vIzIUlq~U=P9Z8^-n>H7N1jLu4B&YR zPq9fNd<`#R>bA!3Z`9D^k?Hx2bhpEO9FrrasP!Y=r#o53DA8_CUx~(}u$!kpiWEb_ ziJ8Uj8qw_87qko*C|OfbIL_USc+c6Lp!@F2d-t2exId*zPM!#CW~{qo6Uc;Ul^t%c zr+x`0d=&P}4~sA#_zKVu>a<5ZQ=?9NvNz@y$Minf)m4VUd-vIz@lKey z_a!WWu|W8Ku9+Tx%gOsFXl3#-@2C5DLR@?oCMG7RtWa*oCB#}=`~3kI!^+Llll;y4 z5%}LN`+vmR9-@dHZwnmf#_sEg#Q=$vIDN^xY zCLJ_>t6l49+Uhv*GON_FeW+!3RIv(=rd-v8F&k?u1eth+9`52o?Y*0* z%)}#4BNIG>r4s;sYs+vFE=9zS&6dQI_z7^CEMU)xV801DFR#G@dV7 zO2hd-&;S*jDz(YCjCWBD_ya=^{QO*SD#^ZJxOOADDDc9yqFb|CtIyk&FIu&0yQaB&^* z&QRfF6-+qsP=gU$%Tvqv!biKG|oBCZn}_^K*NBFBxZvgHXEUu8r$Z{;<|gq zs?}=cLFiA-l=9VTG+Q-Usa_uEXLx#M`oJN#no10Y)|6LlofHPrJUai`==)oy>w6L2 z1vbIr?=;e}4(igtg=2^sW`qK$JK?<(K$#jW87L7+2VB0j7%NF?)G#AiwR4$Ln$G$! z@YJ{ktJP;9bzR20ZO7ZPX=AUk=!+S@F7mVdJXa|A0-`Bh&0`EF$ds`Q2qBK;h%t6> zQ>f9_H71Og(f`KlWy39FC|A5-9Pxe*Sg5$ixEbV-04KPxA8iYoJDmM{pU&U|{G))q z^hDzLUFr&WetuqwZIyyr@{K=|MEaEf8UPOL`G5%%oLrfPt|P$5d3D1$OxCw-gwXn0 zQIXE`11P)MgbU5b)t5Cf8cr|=)2FxMMVt$|hC(o>iN)Gf)Y> zE+fv_$eLyRI*PDlEhjN$T-Pr~+!0C)#p@re)N?o9hLn90V#p{dUTLupQO{);&VuhG8Af_`i_p`ImtbAs67WcUsZj9%J27H@kBMU)}?P zQi^SQPrn^_AL>Ig$_sw-3kayG#9G7z0ulEENl8fyX2=!zm-nx+Sl{skCZAU!v}Kzy zvOl$$#|WHpsh4As{8kLz4H-a95j3yVwon>G*!3f(RL)~0zje}&%)6xW;BmIWN%xa>oeElgG2Bj^5KC+U|GaF04`)y)l$sx= zGKTS&=+{Yz@JrahH;ON77{saxmj#A*zh0he+D<2iOQ%dC

-gGp*@epQ##EmE~Y) zS=6_`zWM`yPL{bm`vnfre$*0rv`IYlZ%N6wGc9H`BaK^%MHLDS4~aTLW)>xp#WExf zK@9w*M09h!tdr?-UUgcmpwgXIYKXh4MhD@V|N7AjcMsreATE&BWTDP^!OXpy&tUq2 z{}LIzSo>QWARwT-Xh#m&#C-aZ z!t<@I?S6sSZHZKPA6jHk#>N9AZOHu}<;PtlUoIGs>VvERtCBXY0X`x_?CmbhZx;j` zjrN9_1z8To2)DKANk+*dme`3e6rMp(NO-oU z)03&0WlSZxp3}yvc3b&MpOjBo+!x%d7}8d};YiE(`Sl+)xXO7LT)|q!0Cv;Ex3I?M zl(?co{+4|P`S@7li~s|rO;A|nO@w){7{f)vgHy+~<+-L6c$~O5hM3&f$+T<=-dy|d z1*&1Ot|$A$$xIGDXIbPMQ{ZK0i4yNfCkK9M&Yg4P1{pf^%u!aNTE2m3{>?V3a*SlrPMvh>W~s%jxwrB+9wAu7a1W_h_WRm6(BdG5x+Y z$Vq?gO#I8W84zRH$xLTKvpFg834Fr8*!=wbEECl_Ydw0AcxLC})ui=54?Uz0i8)~w zP+xLWIn&7&j{BBWnHZ-_WDC8g3-sWt@2K^daJa*c%@s+}mV#|-CJ{Qt=06L}hX8{@ zjT)F4#R=4{GtysO;>G)DV~xHT=5%D5r)4HKcIyP!PqY8k>03J&``YF6oCSs7>ic}q zVqWCw=h2~Qw8-=S)LCryDQtX0w;ORMJDP5hB)Y>J34}k7WirN;CM+D-4f3_&_Y&8o z5raMUnefAVN#Q>9=jj`WgZ8^qXDUcTQp0Ls zEK5|hb?J^;F9RHrJ-CTQcrH9`U~k5DX#*%Tmj2~w^CUbeDXCn)RUf7kXFxl%mH8Sc zSBPTbC7SaWI9)QDWF^AE$*FQAmBXOL>8Lz2DLj!WsYLYyP+YwE-lt`?c2x56$f2=9 zyIlclvb*(d?5dfWR}`}OuwA#p5#{`WJmWS!n@18>AhB2lOI5bJ)z;0E{Y?e0XGlp+Y$03)YbDdMV-XKuj2>WFNS5>{ zLc|=Np`g9ZGyi?4$HHgzBe?O;*TY9y66w58>BB~PmdyR9A}c?3DGE|#X#^>@kKoOf_mxp^% zumP4`A^-}G9tMa{D+#k|Hmg;pa3OJVSjI~W*_>8e%q5o^pZGj`(p-oqmTQ8wH#Q9m z?Bj%Yht$ns^RJ>4O^U3fF1OXcWG*YUnnW?FZ3%dffp`$0x_Sc)<0h4SI)oKkhFtVU zM5Th6{pZ%l(1-|;b74hZn^SD*BMc>lRuFyUdp0>tazO_AW=DR6US~GYhd-?jv{Qe8 zqzffOt~bY?6LW>iZcZmb$sprDAbg50^p94=fYw~~sQ;3R{r4?@<6DIbPnfP*$P{-? zu-(T?(XBh*KaQycCE^A-wBKWa*zgLwHxu=n$Ut!kl;}S?8S%H(1hPN@=e+oFQ4+5V zR3&)7o}v;7dX<9yB;aq?TC7{}de~rDjVi|H`gxQfi0=J_QXwqIjo6SK_7Fi_9afJ! zA}y%clD&qxO~%J6>}*z9B2%tlqeD)H4&=c`)y>wM<~KEp-J8xZbW&JPVFP1oO(FYC z0@Bl4g5x8F@aPQfJ2}K^-2CR|*I(ZDO`u-Y5OggT%2&Gt1OUI%u`0L#)jea>zMLe% zd|~P7%0T@S6FVKlWqO2gsoeD&Xwi$ejFN*bS7|WkBt7ZoUFLd_CYH)w=^$Qg`nc3e z7OyOYn1IsK zScNDOsbkt;M)t<84;d-!PM4@O-LpP1m6d)^NY%~T{ZJF{1-Lm260@k`%>U5?`d8P} zgA=2oBVI3#H2So< zoO*@JHmz+}L!I%b1)Q(&2c{`HZ{NKqqok1tgt^dAhm!IQMmDX|qVKjb5<#M+t2*c> z3Um~)hg|JmqP>}`gl^(Vc;gEZt(0s~4KF|&-5w)@s%T&P-@PZGG%28QIim8ulWwqo z2Wp&F)9}4z4ECEVbL9irxnIk|!DZ5;q&2#^_OK&{?Qi75yX+yCqF9>&adtLyUeCr< z+mKe}H%p`0jHSH`43hHO>zQ*I^-?duP^Zh>Gmm8bBsYhNG4_sQG1jGi!VPhu4|%wO z8m|v8ADV(5EtTPL_(yqXJQJajQ`PV@wL%YXqj@pnZRX-)G$a&ycTiTT_PGfT0wb-k z{ItYDlSL=MZQHJAb)y{}uUsssVa&z_MH`zKA-B)I;~NDs9!qd*+w^~wFTX%|`e;CL zNx`jf3&nmdZMnFFR=EwB>T`wF8heN2Vr#V$K1Imaf)4X!UTMw$PZdH}9C4|yaMx(g z-l%cRR{W_3^>bZEp~?ZYG)GgQ^$KCSjm7Vp}kESp;zbaR`eh}LM;3J)QP;?4~ zCkkf5x4i5%B%-FD^YB;A?e7EXuntjS{sbm7{8c`4=fBJi=m&-q@`A62^@~G1YhL*1 z!l?5Mw}#BPhZbL4zo?HcyWbER2z&E7@yLJgyh+9F;yAu-3<#8v(YH#(?Ya2T&V0u^ z&%SwWEiI>;D+%_3jU4KAstlUaTJ&q78@5Vi`LciCP{aN`jZ2D0``~09R~=#+YCS9Z zg(;P}1o~yDp2%6+ur+F9_k?w^$s(rULijCciNorpF+fUOM#zwsjr%39N%X+=SL;oF zz3c&#YSAjgHbq0jx73R3krthL-r2%}(y@bS<|vhfHJ zh!f@csej&hTV3DG!XwRuAdkU^h~V@abOO+?OUDl>?tOF0=QlqxlZYmZ=;7Laj`9gU zw>4v7JxHc%n@hfMJGZCmw!PMP@pbA{Nf;82vb zSwgHr!y~N-^1c3uve4DYg|a6M;TO1mj^6geGgF$KfL|NwWeeTy`aP$(=-CfesURjI zrPa{o#mG-?f(g$mELN&zK8y7fi0vBR-Eeq+aXf7oz9pZp{+?2<&8PT5&(mMmdr|Ow zV=|h4|1t8xi>dzCT%CP5Q_77mZVLi(bbLawtZd{2$WZIku4f4nrRU8JS-fQlRD>%U z(RGLQ#p8f7RMwRB#^dFO3n@ih6<8U#TlDhyB68{k;y=E_nfe_}vnwuH=NFInZRwj5 zN!`)v%Vj5s-J)LG?eQwQ6PaE}E-0e;b7N8Ew9_J21rppbtMk%>*nEp^WJJa%d3bpL zEdy^?al=i#?G^Gz-O%0STPGzA?&3fxm=EXHe5X+P&u#LjM`zG0yOwbuN}2m7C@YrO z{xY2XT}cO5!5mT2jO+X@j6{Cos=9$e$}as`WT@8RWJcZVK8~D@mw$T*1}K1H()bjK zj>?6H`JQT578jd-NZd3u+Pc>H?(?{eKpe(S#9kQ?hCE8eu0ame$`0i3kPS{mmK@E=uefRb=%EnhYFapHZymj zJ}1yK?E)R01}ytS9?=EAzW_s8DLf_RufI5FTCc5dUwO>b*L$`c zzN$eZ{^tbhzXNC+IPC0f2(fdr0TS81M*_MW6SbT+vyXTM1FJ*Lda3sFC&T$|wl}f% zW$3^^*)dA{D`lO}@APV1Fb6j7*uOuj+ilz`t5Y_e%t@$s31;&ZP9v!g;>5C1{6N@l zpUs-R&xms$m}{oH;E zzNcqW2jqSg=j9(n50)nZ()}O8-ZCuCF5A{la0~7(g}VfIcPBW6;O_43ZUG7iu7Tk0 z?(XjH?x)`O?C#xty07p1#Z|wcidD~=bIdXCLFs%-Lu43JyI1Uw%ZpWyD;prLoaPIF zx^bx4yY%-C8-lktwdA2mQ>RZWOTnxAs+JI4Wd<_Qbdw+xo>v!h5|PE>yD$<64RZ&F zKdr)hr+}9CILPA7CfY4T}E6s1$pd< zS38F!*?gios4S`xomJE?>t#tip*~s4tytElN?WCB8gS|SXe^xzqI}_XvFm7kj2+PF zrGF;Dk(K$RWjU#y)^NWtH$OaXov|zW%uMd*p207*u$$$*xB0&ICy*0CCK~O!4f;dD zI}r!*jD{QF9N(_^%zxjKZ82T-0gBO?a@2PdO`>=pTRPdSm>i^Od>A&!b$3! z`sh#5ujvOH4Gnw&59A32Nk+ijN}G2LaFDYw==5=DVQBm}Uh?-sH8C;sl4o4U(>hwL z5xI><1+XnwSp`jUE1}y84PNcSjaRv|K-i~lLH?PjPzA(T z)Y3t~=Z13u7ea*r%P_i5$AI74Z)wld8)^Tu5#~qa1fDc3OCzbX_VUA5Pja_k)b@m5 zkB-B4hX)lOwUC+hD2D=UR_TmL`?A(j=lkoC-wPl>WU8%oI z=={S;Jr1d9MrYJkjo*CJK5Z<6?4VUCW~-{Y&q ztSLdF#G9L&ho9&=;4eF%zOk0JB5bSggiGB_m{^O28=b9Ii!jSfY-wmloUnej?#gc@OPXz@yomc{&2N&x)YOhSk z!EIjX-uGo2sn(ypU8)MTbR&6ud6&1@OGge~c77OG{x?U~rJCR`IS_v|T@m>49ZzWf zS<>qOeQ08pu?qz@!P5&%QqJvD-X%0E>~8UWTQ7LNNq?7|vbrwGUlIjPP7(SZeo8r+ zwg4+#YNZ_+`bbe^rMAt1Tdkj&6^osTcU_p7A0zWSz7#V?FTh_jH3c_I@pHDQ_C2&p zc%d7vac7(oi_}}k2S9u#&*=$<4XZTDvBY+k5g-5TQlDe!Ka6gtWR9JrH-UZ@{l!oA@lr`ADtv* z#!NrfJ3KuT7iv3Nqg>_`W6&Z;3RFR9V=4-KT0bnkq}fAjQ?04N#}!>Qef97l&#`_@y%QurmRR|@_a)ZW8Q?7+DPeTe3(I7 z$_acr)C*-kTWi9w|0eAu+iJDcsD&tqB8Ox+KGa74VxfuOow}mA;m$jAlM=*bzl@aZ zY%LcpI?z8z` z_F?~TkCyG<2}z!!W)4qY?rR4THaVkKHT%xq>H4&oHHVuU>l^k66(s%L44AY_kUIV9 zB**lCbLC6jBBi`QMnW<-?CD~qRL7b;h86s)02ha*-n*rtG!t5E77!y~X(bUXHxkuG zneoF$tc4NsJKpSn%rO4F&1W!&U?8rNA#+#guGR_z=Aw}bz$Z@;r3wi6PNl2%p` zowQ4&4(U+CXAduXc;;E1qsM||Wwk!jKh~e)p7(#fdjG{s`q!iXf3zVGJ>jpe*0fk^ z3kY;IO{MHt-ogXVjVSARVm45@rJkawo7sp)fs1xI!-NjU*TPPAMWjO(~COR zy4Lm2uoey#S5``(8uCP2(f8}`dAO8!0P_YO$Yr!&+1gPrLwP`@3*KQYnf4>z-Mj-F<=($@M zlH(ZvWbghyIG;kBS6Zrth|fvv{c>;Kbb?m-@pO7K?N+VS{?Yd0Oaz;~@v()1!|IVF z3uHP+yMvF608mn@gJ|e3%k92=F99ITx8(AVn7YUJr}4K3X;AID7o4h>B0=OXspqq& z79JfPZ&{hh<7DGH4D zp4+2iB9i<*`Qm*2v1qDCr`5r%hPu6-uiFyDI_`Q@9cz3ThYpK?z`678xb!o6q5+io zYFU0TJ${V)&(5H80m(m7o{ock`?zITe>I7XCfZ#3_TjE)(Zng7L~xsesZ#>XyXy7H z^zYi$Uk1THBH~$wE*Bn8emW~~sy97JUKS{%?VoRiB!#s}U@HP{m))!c?_gmEG+DlX0Pylv`hV^hJTY4=rf zFHa(ND4WnzC(G-40u>V%uC5|AA>r%Sx`a>-kmV^utydxj-@o)HC1Zu~*UQ1Jo_y~X z(Y3gkswMqYhD-oAx7Pk>8YMg?LkcC)M0Wzjh$*SVi!^=01sE)xrFX#ZJ^ZquPsYE#?r=GYqKgFhQUZ*L4#y-SA{s3bUMVy+ z3aE`zW`Wf^YWwLUCUqN$wLhI$j=#6nVK!U3HqiaaPKX(xUI$f*K-P z#3*NoMe%??d#jRE*Sx?BvIvnI{H&D=y`r0 zp2%_YI%nJLo-0*50U%hKfVfA?<6P@H4?47`3r#(stS*t~85+jQO*AY$&JFKQP`)+t z&B1|SV2BT>L@VE5=?geX!?Ipv+}RPsz8^Cjdvc(^c^i759`daq_pK#)nwU^)M|y1E z(FyzQ_<4kY%+uz7?*n~(2!<>wI7&j^r%R-Wq{I8R0+9)&gjvfdr$c7xAKbU`ew$_s zvDC9wKVWpsAgt1K&4PaW{(bps#eTBAqwp8$4hVuB>ZhSnHTB`tw&}RhzP?|%2xz5= z*Zl4lJv7xa8V!Ln#9 zuIFB}7*A^=v4coHAf^uKf>23|6l}&G?YDqh+2qjoONlev^VTOt1%bd#h0NGECPzuu z@dyBt+WbHaQ7XuYxoi4yL;GYmZ{>cp_ff12%KfA#{t|n{c}^8qPGX;#nMk&zSgia6 zM5;D@Z-tb8bPM=HYA)7&@Zs~~>An-)00O#yAV6M`KG^WzaqVnl<5o({1gpsA(bMs) z!k^Ry3#S2Sq{fjX;}!W$F7=^{ zB}c4JGx$1gR7qCIj(}51KNWY+Q#Wpy*8=XkH}g=ZSGBT*lX}wL$1MrRcm$} zj7+GTCY-Cyu2?p=x-*%%*E~Cf_sRtKiPRk8 zj7X~7whGkuKA{)&#=W?|PWvIPa0QFzSdI$EHQ=y7-w=oMT8@K}dnx$&d0*`r&+gDb z+5B)!rYDg4n0eEaiI!HP)ZR;4X2h?Dq;F3os_VU<1RH=yvi+^uR2&*T$tr7Vpw0 zUZf*?pOZ`^!F|F>{&nvU5#3ZBPgV3A?*{CF*b5Sx*@G=NX7P0{!D~<3<cF_yl_I#dO*qE>Dajv!M8^9H~klZv~U}=TMMq(t4+ug^uZ9hwA9N2oU z{}&xN6$=bYtU}5;s3^5kwBdvrv|OdE@a`k=Tk^ZCrWYY^lz(MGCtwF$_)F<@1q$GBo z54hwawr#(PD5dRyMs@H1GLsyJ&+JwFy6x*j0Rl^4Jssw0mg=om8K&}H=3R`8uX*l{ zHLS;j0-q$glAK*vT_R<(edy7Xp^XP(G94Z`I&y-hI`n-oc8>`)tDVwh+Z|9P|I}oY zDv@aFLVl$g`~`+=Xeb_?^#1lD)Pw^~8(DVu8gkW?T2Jha=-=sn@s=hnFD5Q51uvZ0 ziyKacsi459S#@o=RO4Cs`sh#O=eJgPHRF(1pgi4X%TEd03@?f`R~BVG+4;GY#))zT z$c`Utw7=%MhWNuO71b9|ao&7`S?9CqLrDQLI<7RxD1v!R{`%}e%Zt%Oho2#8hP%(f z;z2cNX1mmCoS2VrxKKV0_`HmEPuxn79bCG5w&FT6#-UqOs*~`I$K`z9-t*x+=PET> zo#tw;!`BuT9!V*fUacBHQ6g#LJzfcw58B??2C|YDbkI;rttX4T$tb5vk9idLwzw*M zgGY{$Lyd=fLSGC<5YEU`G_qN*)-`l|&pCKvFHdBN+iY0l7U8g6trepe4?_yqLY=Fs znj&6~2`GL@{71y+NDu2#puijJG8 zm4ZZa+6lsng>!$Oe&w?Lu;}d%p|!&E?J)^xu8yf_CZ8cJN}YbgUupQq`~#|)y2?Q>a-L?Glv4)Q9H;fsPNQq4gF|Dhdg*w=K^ z=ybHI1P5=2pYvxu#!xN;j%Ewo4==e|#}&{b6?5P1=5>ZXUWd6$J2U};lo>&k>lcR= z-36;WHgnLahM`~_2z8!DRFOHi#YHg$MR?8Z|7P)8{LW^cXBiaauAFdU10Ev*#z{gV ze=x#>2lfg+iy30{W@+1+XK6$*yQHKzej^X5$3_OFiX7Xs23MP4uw`G_8H`q1prLp=D$?c(Pi$d z2&VlKX@EE!4|8>;IGxseI5F`xXHv0Jpk6+HDw??H zqLaj&e>87?bco*;feZXBw`6lN% z<%(&!72ZD@Wq-!cpM4e*be>)|vXp;N@~=D73ZzBD#4$hX#@vL|Hx^`V7?*bLxw5<; zu=@;Dv1zmaVwm_M`RD$0ioj^}ySg?qUwnMLRw@KR2hkG&5!iODbC%n7C9yQFU_#Us z_xVTMrJ-*93^p?K(D3=;$5yB><;j9=+=d9s+h6d>1ETX%@ggFdmgCZ)>l6LA*cvHi zgR9N=w^4Hg7~~&+a6VDbwzx7PM`WK>4kO~|cks9Eh8z{~rkAidC5?^+vhx|dL2ZiW zruqV=5rxutz6)-osAcFUayr&It|?#mAc|}cpE>kGH6Y=R3ijI%VI>7YLtg#Y?-Pt?oY zC>Ur*4E(W`R0 zA_z{OrbT908pH92n6Fhr-|gQ1vP;A=E8Eyy_(knbnD@BL0Yo|z^Jhm1qX`1{tQR)e|sAH<<&@!B27^PRrW2^%W*qxjm0 z^^`axPl~@^-a{RCm&=NNeW+N*TwOP^&i^9Df&zp##q5jht)u6lMZ}0%aWU*{-_&Dg zU+|0vW8&6+O5--pjVXJn+Simf$Y;!0&LUklm+I!gvsMG_H|9j^vy-a31X zVqf1oZAi=grD3%@6we*Q&@;ni0KIB>AQ0_{p42Ttosbd3EK*o`#5YU}^G z#`S5yUfaoq=IY8uD(7LvhrW2ZRwF>+%n-hpb8L7N`4B0zUrXPulQY*iEjcVf8eiLM zsJw3FYzUt%z<+~=H%76-ag(>Z8B;xYI%*0@&^Tm-fn6#-^n8pL7`pI%@O1!x)z$a^ z-QV`$RikNL3cf>R>xSUV1ezN)Ii^0(@?SmXJ$oO2F4*e|3!~X2hYi}PAtoSD z8jPNSa=a>MqJ0>%!|nEYH6I7xKs5b;%xs>(@r+-`1WSIZy2 zUj>lioTXLn<6S{+wry|i&%&(knvmlX+)ic-t4(O?Hz9?T=b+h2Z=G%n#N8mdl$02Q z6w?Dl)Z5El{L&w#&Bof=@6`ent1mF$@KwtaI-9RTER9d@3C2XKeczRIn;7Z8_{!$m2icYRAcr%4q6>9KX305wd{VlsGTW?%GhaQ42 zOX}XC9q`Q^8jK$BlPZ0{@1lf6(ad(O9qk96ZJS6gLF)uG65+3#qgiSxwb49@F9#FY z^m0V7&%g_MnvfP(nf_L!5{v9lF2_FsQim^rNC(9dtcJ27=_}NLPCmYsW6zkyndYEy zs+Jy(G%OU(Y_vat2B->zDhKMRfgCSeR|Ns-9R`j2NAdFHUn5l}Kwh#!43LfHe>Gz| z+Lj6yT^K>oCZMC?5kK9#`o?TC?h~R zYJQey%Bbkhrf%e3mFGA*#@k&HcqVc`uk=kSfajk@Yabut+vA9R)t&#XMKSSlh5~%L z^p&4+uJ0#Gqq}>&+JD8~3Ma0q@ zR$S$0x|MA{dKVtqANR|)iRvTonOQyDk|`L9h%f+>1W8g;sE{=OA+Cd7o&!q@Gw~pt z@5oy%$}?+f4d-olCt2sEGezSCH%HnVAL>#Q*bD-1Q?39WO98}5uUq2yadN_01JhgL zgq3Og0%-Md2cX@wW_LGu&1D$X(>2G3k_E|SN;2lqB#I&V!J*L8=9>E67G(!XW!t5I zvaV(YSwV}?$^h&A&;hUemVY7PV;+(-)MgeXH1E%|u~Gv0-@&eY#0p+V8Q1F>j6?9g zpvD!66O)kGVoO8eZVJS;$<(Xx&g0KSEbqB$BywxPZFYIz%NGPiP$UM!W9jh(*2m+5 zlFmg?Hbo_4J}svbguZ{?BEf!2FIqGAUOHDko@Hl?%#LkuyxRq^I&I=}l4l(awTF=>^V(8bxA& z$o!e^qgEB6;TLRe$Hr`hhi!?X@e@BI{%(VNiI5|HwK}L8*5&IEC6+@tXK^*(Ug4>L&WL`Zi>7;(_!bTeH&`xoL+)xQ6i@EA|N} ztL?Du!xM}`@%ovBf?Ml^r3@H+#)KGDNkTBr`)v=y8(sP7J@;~AA-vnn&@k|10Od4N zvkymWTvkRD5Xmz?BG? zK5cWM<5k1pLsCa}NBen{@8-!k5%6c*=t8{VUT2#mP%*C6Vu0=!Xw~ z>-#@ydk!1je@%CHl>@GORlm7n=x4SN_Y*+RF=EDxF+RKB?N`>x1%=?i zsQ34cSCkk5#ingxVdA)#L+mG~tw(&M*W9resRq|}rSV&gFmYiV zpGmhWj(|IqJZY&ht?1!(LU)!uQ>g81<52akKjqw!wzdj2l=HyyF%&kh|%z5hTslcC|DE&Gm4KHn&9Kat7NXF; z4v2owF9AY1F&lWpb#86Nvsj)B1BpY2&(AXc5Ul_hNW>P2kT9FhNH~j&Ceq7nc5?&J zs@>n9?W{NsyGYHi1QRR5I^Oj^5ZDKd?e<}w_7r@nzN%r^86YL@);ir1(OiX7S38~z zRQo=#;~)s}lTeFwcas6w8ICl9R`1E}ps3?<_Up@=%hV^E z%`eog4$Ay+6X-YlYYu3lGsQk=2B#tF<1Fu&q8XrHD9@sGSP@GiMg$grR(M>(KpJHMm?L70l5)@eu?y^ma9X=qx*bKgN1 zv_PlZfUf-pc6q|P+Bc`RXGhX7^2&3b9Dv4kJj~bX8#|ij+OkW?6D8$&YWvPD*B1oFxBYpN8(xRo>`~M?Mk|)=+!HmqBzVhxvSNi zHW)T5_LrJENsLp68Fvq7uMkz(a(3T80+R%(CdT*y5B#r?oWQazHkg!wE#3-Va+(QU zyP|v{;`ht7g&@SUDzu`Kxbw{%PmkF}slQC97`@cFiCAKHM>YFGgFZU<=c~EGHwTjv z20nz#I3$s&{N*pxiu#lf{MV48;rQ{I4RlFA7a^YP`YaRJInh>BEkS!7HEx(W46l}7=5 z9{FK<`+Be}cTA`WVwb3UIIcnWL~Gga$Z{0*j?DW3$`lFZ9f5%I{Pi}$!;iXh20XvAbaGe0Y{_WpRmW1*8X{1+!T6+qm7#DzAqS0Ml;-+SI_X( zCUe?+(Ed*0edGWckA1taa=g9ADzfDPH_jNYD?)`wj^Enkp7plkUVRr^bciXlT{w+V z<(m8%g>1(%e6B_$&2dQX`5{)DfRP@3-MOeujgDtN&6oF;YTE@$JGYIXg?&JE z>BCUSSK7V2WLwF3|27u$WjSRe30E-S7>?bKi)W*}i1qBgaI}Y!h<`-bxq`j=w5g(m zZkVH|{$BkF@%U~}D#(!XiHz1mq1UC#`p%Vy&{F>*x4I{&n?8@GV&9=8TSEP&eQEJu z;uj|~I{oC=i)?5yLUf^9fj=3EnPkC43^(a)l7obH;&2v9g=>5jgKFz$rHlR@(ruoIP`olQILj?(F+wlDS<UKwL*DpT%9zrL~)_Ql@ zq~s?u3 zV=Uw->y@wkJHo>(V#Wfpw@S*u*r;7n(XR+%43`X2fqv2`^U!FoirE!(j8g-^#vl~* zP({=C?E>8FE}+5uTD|%2cJKh^&wX@8a5I{t#!iHyqT(ZozIOy+b%wJ_d>*f=)WZS{ zJ8@I8SB*>pSOJx>;>t;>7-eMXKb-9i+V|O6Yuq1;?bD&#FuPeOkMNj1cvt)Pj-BqW zt`dciyCPBinQf=|SgbMehp=y~jOcCs9n;Vr?DgH!SZk6Tkjx96 z%CxEuVSriK;i887OY(slau%~`do78F;b9o_^1b#*b|Oo!n&PWTEp)JcjPdJkS^}3> z6nBwkXd+a|casx?y#A5Tvbm`l-WrGHCg;}%QH}%-znTbwkAZoiB+ahU_wj)&07pPB zjY(H9F#KoK4z^`HcSaj?;O!=YdX&VxKi|)(7QJH&CjTFD7|*aXRlVeZA1pne!bTFm zHXHIi4~qI$!Akw4=hF};h4&ap`I3$$M>rZu$Z8M)w|zn!#X9n=)pk0~l5#dP0fX&d zmg#3qr+-!%7Y%y#AO8g2zXGm@zhfg~h6M|TI4JL{mQar+_opjgUBN3hI9!~2c~#-Z z?Ekvt4422J30_*shbLv79a&eKa2uzBGhtyh38>JCSVI5C<*v(-OQv&$Mu2-HxL`*a zWYBC+9dXSJsXcED0iioW7X|z!lDfjuvqVjR9DU^TzAnHRxcE|GwF1MzO2Kd}{tDT* z)A6z8JLGBGmOq7wo}js8J~MYNg<*8WwvWAn{I!eD$Y$hi(;+7N+^9MK33zTnG`rW% zq}PL0VT^gsI&c;$D-h9&ALz*jIWVDt&|I9^&99}c<+RXXMvaAhxGLE`CWYjLJO-!p+55;kNbZ)@wb_s zpTrI9kO`4PSH5y^F<3{z)qk1mqnR(g^soS;JK%&1nL2_RhCN7Vl9YPkk=9FCmOk~v zYAvcsZUw5tEUofxI)zEKN+lF{?UW<85i8r9nQs#^=cAM7i?Xw!Fc%udiTlBb}8tu9o${owYo$s&uO`_DZ+ zfXj^YN;>;Kck`%?wr%h)mq;*40XqZ48V$vVrwqdfd-(okP0Fb%W-k2)VLRycnZ|7^ z^#{*90jg}ZGIFfG#hWeq0GdJVToHjcEgiVZfN5OnlJe9k5mW%v=5@Vyj{P3yx2?7n zdYqCe2hIjr)E~m+q-=joYwlwhxZKJ`p^8Lv2q_NBE#gS1ryQt?L=(_R0W@@yz7Sg* zQ5gU7IsW?z_P0#!`~*LOyztA7okLYx^W7(04yRz-UbhbxBZ2x)^&?~u87Y|&JLmdc$e^>*<*tOOHb35nsys zgg_f)bg!xTp%sP#{Z3;I;`vmRxoiB-5v22_^_^>eZM3(u6Dw<-*pWlbi4wEqzykW| zWq0LQ@5}V>nv{eK9Cb3q*+sJW=%j%=feh{sJjAQ*RUX+!2kL`8uCfVfJ2Q+;WAAKn zDt?dY_lQyo5lP8-NJHIeWFD|1nbjwX{-VLqQfk(TUahneSrOR`E!7bKP8fA^Anr$^ zOkw&+mB8ljivM!h{{E0ESip*sr#|Cj6LgLZsxa_ghX)OOnMN?SmHl>rF3!cI(zH1^ z&(D*bX)O@>Qq$zm72`<%LD%or&QI<2z+!Ic?3()URNvrS1Y7IkG!l~MtUNzSVweyB zz(w3EoR>ce(q6!;SpC#NJVa|7-_Vde1XG?Zz>j(Q@?h9`v@R;2q?-4}p7xbQ_ud3! zcy_A9?q>_|R6-%ChhB%KonMc|z^xk49|B9z{}O{)0`J3{LOu{$7U_1d1(ws|=429p zAQh7`Uyr!tUaUA=dQ8qvszDJW?Ju*gQcuK7f-x73iiJU%C|)=SN)r=Cv@f^9W3IuRYDu|o(%4kUXsV;mCN6P)7Ve2Fg#*p@qVEv*XspS6KYBiIR z`H*sQLm~t*VorC}6JndSzNlyEp9R~0oV?CCxy^1(v{ds~^wbvamHgbxKj~eB>!t!gp>%!8K96fYo-$FAZ`3qx`v#_ z7azDrBB7uv$!^0~v6yqh!`-rLr&rP(rms~e(@OHFOy}de_L-XQck-C$wGp(aQAD$| z+;2OrhT&&|rD|yT9R#|v-?s7n`|MmEtvdJk)U(*w+;xudw0+Q3tf3CWyLEG(1x>_LxLD;|TvFv79xeaf!bTE>*5L51BwBECQej~wG^8}~g2(zsYcz6|_zv)EyR zeZ7-w#Ld50nlUx+#>DxL%O`l%_`Bq~U$<_UcMQ{~B4Oj0 zaZujY=axe-qdPU&JcC3@7k+j#1?xw2If2Czq)@r8@irH&VG+}qc7JI#T3^gE#&g{h z{$#6S%9JPPwvwtFb-E+S8NWjEK2IXRCBB^}ycee5#8y`;WiOW5904jmO&n^mM9ndw zmPXUqM8&(Jc^xEMc^}5vODe3t4X}L_uEA5H=S6an^9w^>xX*-a*9fw)2UZ+&pK80A z`5EQf{#}0hJECkNX{DCgF?^1g<^Sn7*>*X=D38e<0d?p18}s(ztJT zIXf|9Q@a#WCauAV1$Myv{p#jnX2^Yo*_`R+PJ9K3{NNSr-Lh}bIRoCghY$U-E!w6F zqy-aLf60qo5B9c4Sj9>~yq$PE)E%#Db#0SzAGhcDp*;L&a?)qOO;@^OVWr+{jccmr zCSA|=#q`DSU&}H(YZT5Kt7EvBwQG+`VylzmYBV#eqomBHI~Gs3MtmBxxYyxtSN_V< z4R)&1arwf${BbAL^mb1kLQ!jJYV=cG{4Cz0N#(0LR6WqaT}PgU8g@BCCI;25&;6L1 z4Sd@C>uGsl_G)s8>yCwj5e?_T&oURr=(5dRnkJrD^3pBF+hInsomhn^Sj_QV+$0-# zc7zjYNjbUpEUQya+#Szbgqlo_joi7J{KW)3z5_IXyp9_wewyuHzCg5{{6|3boVW4f zCg)N!2a*zgCd+5ToSo&rzs;M{$W+wS$-Yky#@ES=eAI^Gv9k=+-S4+)*;2~N0le>r zf!8DYA3_!u7OJ&-2Wy~2KBM*34Asj$s4riluYKR|aGH(^(;NnJSMr-nwX$ADMy98y zNt501F>t8;{Xbv#8X^rxBohr*8M>pQ;|CEftQbGf4pnc~Hyy0beY`(af^5h-Sw6>A zS==Y=RtXpvZHxlXT>>Ds=+gD}NTrOCYU6t`4jKV@iuyBtsIm8L20{+Hs`Ik3o5)g8}-%FO7i1QR5GLULON!7S)%D zV_XC^^jgYP?+Je=P17{a6K_L7dPKT56qPUQ5F;^4rbd*CbLq_zr7~9te+D0Px{t@)B@cy!9(>%Ay1q|;tM(W{iO#qj z;O35OAmH>L3`dlLflrj~HCNPF_YeERoeNDaF0H480UZ8a{U*r2YW(|WF{88td}*x! z+)U>2z6cN!=o8geTw$5=CJ{-FiFgddS+cUsGbbfsnuF%u^}@hwO6WvO@v+i;(KrfZ z!q%LmzFyhGBmYFo`Y`rChYw}*fOxHa#r58u>gy&Ca%2HSh;Q#1UP)paR#$mTas>%6!Y5|rmqOnURnLyk6HLMu z(3>xs4iH77orip2Vmdx{Zo1#|a!FNJ$A@?rrl#VnO)q@XzB;By;d1Fv$tz@YOZC~` zUk%-7(!Adj2Hvz1RG8g^CV~Y5g#80e4p&X>kQ*4FjB4Zt670~RVlt1j=UDQuTsUB_ z_r4>=2@YXa%}E0b zBX!&T6SnwPOQj6E^}A@_vKYJ#WP|SGx^3c1O8>AT%sPpX5DnW**Z4v+u7D(DKUzC)%0vh7+#AhmAzCvznOt=ESLuC=s_s|S1<2eLMO4_Mv^JFT_I4T2| z!vvk8`))xFWDC6I6Go)-%4`yd#9S|pS8JYp|6g70?%{Y zj(Zu6{ap{>uFdKnKzJnFZOs#p3Vh zS+YGw-l{m9{`y|B#j7mjB48xQ3SB_~=s&^Vyq&uR#7$)hlOr0Vi7~R5Treo^clP$e z7a4Hnk07D~(H=Dae(O5aV6Qn=yI}_D;QCrx6+c+|MqrUGsi|(jW4ejN1p8$#?+<$( zh9-QTcrfBcwoupVOta~lOsmR6!(3r1Hl*yfstJSj_a}H(9I_X`!St&8hK065LO^t0 ztvb!G6;RvxsA;dIxYnFZo zNqKbi!7dTaw zE@C-sl-8rfn+|MX?vR}~+)i}81fB(NZQ`f$BqYVfxt}Lyj00z&rN*mtFdiahhCvu( z@PssGQONC%&NMzwJ_2Fq-*Bt?KF>GLhP~NYo=V+U>C;^DUC&dY7g*;9?QhU(kNZfK zu50cs^%M3E`Wpc|83Mej>I*QC#_xk&hnx|^_&ZQhFYgn5!~JsFfQ~9HZ; zACKW)&h857YnZYw<=xRwd4!~uc0qx>{>9e6x@c6ut_#=!Z9`_@Ra;R3pT^1H95*G#d3H8XsLevzWn z{#YB+$4`!jgb1MF`YOEch>Q(iX5Xl@RFy$>?Lzg|Q4wQF=GlCMr#6QImp8Q?>GF32 z%o>&b3G70o46Wt89(rUP+?Cxd?P=hgi|t?KPopq|d?^esF2g$C%l$}{A2l)`p3(4b zIL$D3;4kob>YPDnlh#iJ`D(~7k9ljGw``oM+G;=`j8b}TNlmol#Mx1|=5|gbu#CbBL7F#l<4OOwRGazg)-D zX)!72P8Qff34C-rfB>xRVD{d?{DQ(_@CHmU*1jb!M-yS}v&pND28+7Ku0HK3D%6;} z%JyqWjDeFAJhl&aw%&`|TOm|je7Z_dz&CfeZIgM5xMCC@kJi9?z^iY6oSgtRhA?v) z*o}19CVDD06{F~=Bw%%zvE#ZhqTJ~s>$i~zaUt0gL)euU-xGKzp6%~A0B5o7=MIWp zVFBoer{ee?BV6FR|D(`%I$*bx*3DP)o9K*&!}lvLg5GRxkD~gUNc}fNn_~}*mr!Gq zL4t-2D3`VClZ|(!hB0mj^ol#DCi8m)Z~CPMmBC2)lL`7Z8LYO;>9Xsg`b<;|@8_2c z29NtRXEwYmiWwvPUaxlBpIv;P1u&VQdPI#wi`Ve}wFN2#>a!B)SMu<^~v++{ncMn%lHIqIkFsSnPjbHrgl z%N&$YmOY{CIe`hn(#=!YAtSXR;DEO>jFwR3YLd z*=~IO{fn@0Q%-YPWs2p|qO-!9?&STB_zde71VlA=0{$=~EY8CK3@x0wxGxP%nWG1^ zS&hd*Xy;XvBx87#RQVa41i9SshWJ#(tos2!IGUPClO+&fLjmzv6d!5m3?87zzHe_M2P|d9{f6a0;pk5(GN; z=fHcsiA<%xTz`DLa$Fyu*wUId18W>_cIOt>zkTLIW-v5G7;m@t1rAtc+oH7-9ZI`G zY<~~iS+lETH8H&06k2BWRSXM*nQ4ML6fHt~N&9#&C=XDacmpMDW7)$!#Qv!FG{{De zztC{Q(>qwZ&i=TAk3RWM(7r$ZxY|%P@c-7BsMvM}X{_ouzn+Z*Y$~3M6pk4V5Vf_% zHyx0}5U%1&(@kI{>K!QMf8d>H7eFlyjcS;ni&=}{IpBETwkf1Ks5rJfK5ep?fm&lr zAwX|aU(g71`%Rty&ALzOdPSoThh54SQk2xH+j)ByC}zTMe_!$0ke|gdmDmdG24NRL z>xE@txi@J8o)IxlY10JH$7Qxdn?ixAoTK8ZpLa;$;38Bt3Ol7FN>qUCz=J5J@3&C8 z4NkD0B4K>`TlYz|lnUv@l^s_x5sm(XAI=b3HX{SA%vxd0XrA|klXQE3;pr)F4E5Ls zB>cHg2AQ3oSQyip(I-BPn^DK47&yX`q&x;^`y6m<&YMya4NBYN?{gB9Wa#KfIg z4RDVeT7w(LNCZJ;j-v-?9tu_nuQT<{yrB3Bb#ZXhNI%4`aIVxaJftxbeYuNHuN*ZV z&-Zr{acon`j-60%^=|!Yv%|CT+}!Lt6rad3Z7?c(8cNitPUwEgFPo2DnCmmqF7)Uc zF@u%e@-Q%vMVN&e{s2X(Z8Y_|cdUisLoFoLI?+O?8CopirU=-YBz-N+p zKIpDhX#8Uf@%5&M0TC@+%lw??!&Nn_Xp~0;SOh7!!*b)oy5Z7Qh5FI5$?cO*MlkRfs=82V_nS@ zkW7D4`Wu;D&9R=F(6D62N`{<{@5YAVVgwx!Sw~NLf7)qBZ|cw~Cq81REZU4{dZf|) z>WI&NI;f%jw}+mTUZ{=)0{vezMm-)(x1a-6LX#skgOLyA(OoMz1wmh5A8VKD>h&$g zHyH9GMgnQHKWB?{TyY!pVz*N^pVNCguW+W)7ezg{N7Zt1<~WS%W<*a+9s2$O%cJI0j7sdPS)(hcwPv~t9=p;7KCnUU$;BP zpZg<{FTVuJezo4F`ChA<-*TQWqEP-e-h6uyP}p;nLjZm-K&TcK?GIf|DPLCvxdyoG zb#N#`k>GAZ;LgJV8xI;y?XY(-3AgrBt^7thadxH&x4IG7hpwZgmF?u0@b)yHrkM$_ zKKUI)qDMhrhK!`S_mM12SWHt4IZkwzJ!>K~-g)1z(P!eMRi0bijl0!f*SNYWe5%PkCQi(n8A44Z$p~fkewg&Ya!5$P*o|sbmymLZ7jyqDT7F)v z{5({_VNVqFz*%cPTszT8)%iYs{Ui+In@`+Juibd;6PLtK`h_F7ab35-ef@c4Jvwe>pt2d%ZVa&H>&H3sxekBEaH z=+FF?7!DT8ZWN9U$WE!ppU1qh8OCzD?^fiY_-C2tuK7{YzqDZQn_RXnx7ZrQ@UudU zH6^+))|l4VZT3ii>eaTqHn~1ScfZQq1U)ZdP0r(_n!V*d)sXS-_PfRmsuO*p1my%><_QTH8`sm<&O7vdc99lC;A2w^hv4J&wBESn)XWcLE=5Jj zn*tk@8LQ3oK8t?KG~fn6oUghHxPXGFB5d`E`8Y^cA;mF75n2im!o!Jwz#fFLh+4E1 z)6md5?>!Og$h|mk@Wc#xs9uE1gsy2Z+kckU+?L=_yzj4`R)Qj z$L?W*OlzF(61?s3`5y2#aUR;m&muJ+Sy#4Dy5Yy>o6s3fUCPXfRtn8bv>emQ$QFN= zwmS_OIXeOe`VK6+>@SD;=E&JQGItae{hA5wCgvk^*??Mp4V;<=s6IH=M*oc(8bHDL zcLkk>1Afz@RDob|kdWvT>_rCZPu*3v+07~7o=19HI$zw;Aq;GfUdLN}I1}oL}tYMa3ymmL}BNeiLOd zod9_Qm_hB9C|k=*S`!V6Z1tm?JKK&=fe$~I{Aj-{K(i{Dj8qu8pOyDs-Mr?R^gr=% z{#2)jCI@MH->1Uq!VvBOlxMgkjWV)v@7E*cEH-YDbm^=IxndHNKL9YDty|viFO#r# zxb=;h2Nk-Vic*|tm~!7a(a_HizvbGc@lnaH1KPgaH9R`r1}0=U3Q>+TO=zA!viD)Q z$RYIiNEefl^|I04sL9NUOmZQmX7ezkoWcnbX~xG$m!>`s=}eK^o!hHDLx1B3y)r4c zcn37(&_+RE`fv^#DbeqO3po-EN6GBQGI0*Y*>p|SKt1*}GpSvjs? z1|5#>jZx!cuN6GaxHHD$R#G`ITBY^W|AYQxiiLs!-KA>h@ks66tV+^n;3ahm`C*scevl5`9E_X|9Clke=CgEk{_pv&*HMk(I^%AG5{2s@4@AFknXZHK?;4hgz~h} za0V(c`I2jF@SKju3&xP=?syhgjyEr%Z0tQT)POwqc1VJ{aZbPfJZ18DNaQjY<6Est zsKq0*Codm2HEfoVJ+VHIs5uN?b1abhavH-QuWkNo*tL@fiD#8OFmsRL;YZI|6La2; z$ZfkS(H8Gcd9;4`uoK^9`xOA77ss3@ZshPQOh|E&x-ET)6WlqOfIqV`w+nR4m*5?( z-t%=8tXia;`h0c}10L))wtWFuU$UG8gdiWA4q^Tz@;>lcMHyFGhrY)I4)ol&^Mxct zE8<12Jey%-Lw)N2y1`#sH?BeWwI~Exnalk37Uv)W_Ziof56Y@;^PUR= z3ZON$?0C?7tuv85*3w`W5qa-`dzsH4AD=e0POxX@qzd0~-*`D&{eyLXD1-k{R5d!? z$)H23ultiMQ2kdvnK`LVOK zt7RvL()4mFWM}{V5;9C)CXPf{TyirEe@Hk(kovI3;BsHZX|?VRQpBlFO3EWRA89z& zSR6&rilLW0>aD4bS?1SxI-7TKa_hqgOsbMVuLz*y|h@I%E8Ztpf0MWu?93%J6_eHZb$ zUZ*1{r1uBKwRVywd5HkbQequ#|(%hZj9T}jAt~_hl?lGZxCnqa^{DoFw zkj#yogcSqI`Q<3Mn+ty4+w|35OUn}J9r-hz}M5-0)GPTubPz~mdGh7 zhd^k@&N#QuB~kii2NM4%$L&MPEfvGXK+hW$CN}`>dg8}%QyIay@4k}NoO7V*nqzxH z@sM$r#dCXmv={}mHF|VL}f}Tkr+A=S2*ifMGi4cuio9|6Rbd3a6)R?&9 z>&Dbu5URL#EdQWqcz5?;0s*fLLSLE75MP_V*@P}tBcnSUghRp~!dVs7M4?bZl3uYG zb$hEf0%_Hv5nc}*(k5DMyWg=n=;*`n77ztR8yq6r9?j1kl=-=38pdDm&etfiJa;VM z+U(J>@E9A{I#gWF7wE{uq7n)_FL^J!!$gf7ey%tj6QKT@AIU#t?{;n%Xw+@HLECvz zm9%zF@_MxGj0v+;iq*uSaqW&9lj$L~euE)~5okGtC1He|!mz9-G2DOw7N8&20D(JPI8Ry`+{mxct?{nGS zEB8pPb;Pwo!0*u%j~;3`<#x_35R$3;0%|R3TLZNk18q3dok1`ob&mipBV0Gn<5)mm zD!^iX1APrda<#Er+AlhXwk+{!v?E{Q6?|&!mdw5*;wW>E9qs=RKuZUP%%i6@78Xjy zKr}o&g+B&TWH}k0imkvxq5=cZ?)ulL*ir>OvP{IqH=tl=x*>X9lelHUn z&*z>;B~{gO_rz|yc4a6Rr()=9TSaU>N|oFN9+%N?y5g4)zci>LKZ-~S!G`fq8ZI=>%n z366*0LsTf<=O{LEC4JTGgnRcoHj5Kc4Vj;q`zMLX14llJ*MYyabybno&pe!OKN3zP z#BX^ug%SZG4f9O)8=~S9KTJjeF7ql{GO}Hvp+mYzR-;>>xp4JmvCN1=M&kW(MD@a3 zBYW&jQL{KdBiM5DFH)iKT$)BLFLau>&h0i}+8=6+b2=zI!v#Ao*k@Gpnh~-3WS1vl zeDElV;NYRrLMH9-hj4nk#OKKEo#mA+WP;UGR}S*NP8>YYaF$+oUN@#;@-QULY&)T| zE+kMS16|`>@tzF%SgnVgK(#Z*SJ;upODD}N?oU=@Dh$-4>Hro>8WaAtl+VAgjEy#% z28YNmTKl?L;TLKr{K25L@3&+a`c2W=Ysgk9pX}Fvxdv0{n+hc_` zHDgmJjo(gQK1(c0;lOH6n1+$ISM1nhWM^j|S+3-(oW#2fD<%#dQ2lonz@SFOT*qOZ z%hFw!@tq&^a3JTH^PtfhG;_MmQRpBJ79{nVyRd-kEH6EkqwgYNkf?bEH>9VRF@}V+ zEZSPx-xYWN4XCd)K~-c|(J3isMjRm8T9lOb^|_xhsw zt>pI^YkyFGRE9G%489t0F8#s|^3GhQ)KwH$6S|K?De1UDD5A*^UGcw*t$FNnHe)mo zjB+3&AWZHf-PUt$5<|~^l{wo-Pm_-+M!Liqv-{FY$~Z?XmW_{wUEyWQ6)(SIhPc`l z<9nEf>R1}fe^@a7t;L@crtr(xIZ4DLm}k2gELJ-lkHhSp zl{O~_DQ?vC)HCq!cUJ3kG5oKx)U@=85>0vfkJslL$u@q2r$0ZGLnf4P#&FsjVJv(h zZrL8&ofswTnQd0vvE!0&e@#gW412KqM+z#D2Mu4Rg69= z#WkXEMn%nK+OE6g6bziNbnR;#M);A0}yU|FHR>+AE65tw;FFaO#Y#y2liXxke*j5($r zWeG{y&aOJ%-6gY!m*lcHfTS4N*3g*n=H?1oWH4qIVFXD;63ZN^YwDGF|JEF>c6i50?dCD_j^yKH;4}LIv(3MNO?g@> zyu1>e0Omk&4{(;>;^#9TaD-c6qWo#xmWiOd{%;$oe5>g*2yf_e7Rd%Zk@d6MAHsX{ z%e#Mu_!KbBd^KRv6JddVXx*}_Q0e?%j@2$W9RjF|P~+y-R>ZCEg=WOUjVJaru)!kT zSSwUmK_Ro!9arkO_bVb{ilgCGj%c zJu_ub9m3<8mvZ#fPwpy^4snuAci4_WHOSrYqDJiup_TRm%Mh-(D zSO}&->iaq(o6_Sr*3%Qj>y+k7FS&aMW#s^esqRJo|9dC<<0pQ~e?F4!B=2p!mT;l~ zc7;AypHEb&`0Oaf$&r)`Yiidp#x)t?N>(};`_aTa=L^0qw^miaUPWc(PLK$3?@n81 zd`z0q1=bHNHnYKn zdcUPNuPdj*A+A1(~V?qSy+i6qFq*-X@yy9ZCk2(`$Q>s(R2;Y=7w1>wbawYgFyj zAli(8&CVnY5j_t2mEX850~!>3YYVeahVYCAAMiQ|92f9<|BeUa_`UtfLTPrGdl)}) zi?`%G;a#cY}@;vHfJTGDy7wEy{? z>gYqk=xB6w*e$O8XBUQ)%m!wx^bdV&UCm{L0ae&HT61-AGsCk`;@n+bVG`Mfk1#94O!z$rF%3wg1rb>d|1LyEYt&++4a0yR`GQw<7Njl!0EKdcEzO4*F@w zWpoKPI()dD{B48fEFT@cWkJ zKVox3hmeAD@YW+&}Z{7lnnTWy0W~1eQs2*{@$>{j0IDsJeS=F!POdbq6k!lapCm=X&>E zF^h7ls!32VFyWn@zVhojYC1X~A<*F9UEIx$6FeMT?9~;*<@I$!Z0ts6ONIRxX(y*d zgkJF&Gig)PAQ2G}kR&HK`ugE=yGY(|5z!IcX-kSh9~TrDu)O!c#l^L=P;IOQFwVV5 zPfX0;_79A95j{FSo)o`%bSacSE?QO2{#9kw|Br7QoNPnRKmfFhiN_{ys(=Dfl`m5$ zd0y6+DFxy~{)(}@7@ra-mD{r+^B5fq~uSD5vd8(xO#s9vE{Aat$kN->{i@#sfrUnVIK*6Bo+rXIVS1B1UndRM%#N^~5 zd7mrB76PE?rt9SvcYZ^|$F15*P+|KBo^2bo@4f4~T7E@!R&%AdVY%~feQX@}%ixax z<$j9~p)R1|;=H@L=>tzrd2~21q*E9^PP4GpCmPX`oW6Pcnn@XK<^SqL%4hs^^2p*m zH|9|zy6@zz8&&3YOOh5Hm)tiTKi|32TUI`H(>eB zCa*A__dnM`P$=$WhqE`}ZXKx(K6ETe+ZQy{#9w!@f<$U*7 zSIIykU!A=*9>g=tI8a5W?P8O?V@&TtJ0Fp9cDe1h#M@(bP}Jsye0(|%xE2!*~93=)LyTqFz@;qY=E z2j~3^0wg~@K1z$Id`WJ_pAhWM0YR*o&R~<1eHdIs>2=jnRTpsZNQme5T)L*;tT_IC zW>kEKctJiNK%zM?#ii`byS_%;0rJ0v?dI^+tS9=p2EdWSgM7K3YhbbFERldH=eAZ~cR*~I8ylS`@8 ztOUx1MuVgFh&`oq*H$K)$n% zb7pstW!Ge|N|D8D#x30Oo_!LYH=e{~f#edc42JWQf;%b-c zf`dbYi2HUhz*w{WiLB1EaKQKi=xD=gy`* z;e*fdpqHCD+66%Z@%uiFGIBd+(o#zXSd|$GOL#l&#;q3r`U^MW;cnnYUaf-G8|&+x zX)v#ujpGg(TqsJfZ*M1wJh{gB5H&wdk{Pui4ZM3{&383acZYjhi>2`K2nxMAg z4mzfSS@)hlMfI^&SHJCifA%dpNCQPKsc;|ju1-eQJv?{5>(fvq($by3r|;4}1WcUvGAvSBOxzwYV(HWY76&pYUm$+$W6!rul* z#^L)JfD413V0d#a4GpR<9&I=`8?j~opH>G))+Bt;YvF7_6#zAG@pc7$6BCM=RG^ejJ|K8lxp}~_hack|QnodTtsY=XDJ_zoJc33Sp z=q@cSncQbW*7&~rn2@6gYp*J)sC)*Uc0U{2412{)=uie6)OS>^tRlnPmK$y7ThhK- z57>(|@%>uxoR)Pox!M_`A-?8hO<}iLf%9v|wN^X$`~x#)6_H>RvuJzUn4E@2%DACP z9^X<_6uKr|n%D-rWDvv@E5g06p1+CT5e-fqd}xVqAKeToVkksz!d2U3H}?BS2kTPMHfv&(6iW=si6fX;lO zeSDPnC1(2;0La(+kNo~g08D?6MoXyaq!c5$$3jOZ-Rtc-X2i0xo#DK_QOPmtyz|`$ zZZH7V(Ow{EJBe1kBxMBtVQ;)$^Xe)ZRL_))&=|vWRYj-YfzOPIck`GR!-pWqp+wpD zJX`5QJ~Tv)j*IKpL{G%wWj+MTt=%c)f0d_`SIhYd2ZWAZ81|HF!bV5WMZ?7>LIhA! zP<-=Yr9?0(nt$!Q*jhlfY4fUMGOd%2A9?P=(y(cypCfIM>fm3^|mU+V1XXxRGp zfY#nvnmW>4=_KgL3mlHz4I%VEeSQjOn(AF%*8WJ>Bx_`Bta@|SOPl{JSiSZ?y^7iF ze@c^(Vv(Q$rXJ6dMgu0)L#y-z)?+r5QB7ZFM%3e33MDMo2oJwmbMe}v$VIk!y^>oD znoy4~l7M*9!ui`zyks;in;JeBVU>fFc=J8=GvWBVf>*=Woe7?2zCyo9q*H}zU>SsE z2@?IdEO*))_2L&8o5lSe=~Ji8;l*D)NImI*Iy_^Dq#E7~5fYL(QL z%d2tT@7}!;Nw2FigZe)(dip^|z1wM7Ho3{P&-o&GAZW zBZa8${}&_@2Zxr&3`bhFdnGsjbESi8cji%v$nRL zz4ek2OtG%p5I3DOP8)YAo7mNvXeQuDC2X`uIKFOvW~p$DhWB7B)EIp`z&Fz#=c^(z z&*hu5A2`0*Udgh|@bn#T81Ha+!Efyyvp5#I$2WH^j35IpYaev{zH3vGomE7$%8Bu8oFGL>#Sdte9iMOr^V|hqb6_sB&0re0j55MG@KiESR;3c#pzCTb(oguUBvvw}PpBPbVWbHql zrCmp5U~Q~CIAMCCP#;OBL#po}Qjty!Kr3*EP;& zNFap4ZWY9Wsn{}Kd2!1|B_ONIhsLRw)HS#gBMd8h;n;b>2W?qXb{x02J!4O7a0Czt zrcO|MC<%~v<_L$BFdffqqZ0gT+aE*I&Dbp)G3Dv7TOZdPzgq=xx1L&^^SGX6_<%wf z+m+WXM!bpAx!PQhni(Alv#kI420YADF?=`aT$ecC+hHqKz5}17R1zt$LEwk{=-j`- zqrdLnet2O5?U#|F5`)5Rf!<$})SBMj|>bbzfA-Mw&F2wDD$7w?UdR+=TUu{2k{Uu1Ta#;+96@U* zGaNpz8mZ>u?%)Y>++ZlG4)Pi0X^J_#AS3$66M9uPf~mDha<*Fn7OF{M{{Xqp7>3~A zXT3o+&bFCc57elA;vs|nsbs`j`YZ7KlxZH`w|cl=spJNbrQ1?S7Qg=SKlnvZbe*fe zP6F09AKt9R)02D!n3lK+nC+RPuCFJ60K+RvRFO;WDPQyGs%PyzVVy9_p=}6zVDgYlNi9yt9umZ91eQ$@C)Vdr= zDcM(`g$s?k3mW83Ruv=WF4XvHJr*ArsL>Wf6780m*fQ|3O?OjifUTE6!p`t>Fj3#$ z!vn|rsd3z0H1zC>77E%L9{ic|(U7gJH%LNY0VP#GV8fxL#7!V{9Ka&I!L5M!tlLN0Z&!&p(XW`VyQBG7;ri28pIJ&SNGVROTB0 ziNL92`+;L7SLdNt|HLZ=iT0$3Jf9zWlkh)-65`Qu(5X-Dm_Q#$D(j}oor$wMn!{2Y zZ^M%}n92lUk=fOw6_s1Yv#+my7WDIbxXi<_sbHX{t@O)2320;>QwKo-O7p)zGk2_} zB*Gi9^zGd)Bkm>_OQNHDX$_uEbSPpVqaY>1lf^sNeu~@%)0rm6y1m*=rn@;Lu~*Dt zG1h5mt2fI^6b`++y^II>s->({LfhJ1I#=AUsjy(zbX^5(vRI{#(zM8P=@pijn`qVV z%&|+=naIes_T-5uG~G>W>|HCk=BVh_*<2%`pmo|f*0NsfTR?M4=N*bl?P@@RCVYgR zUiP6$LtTp8z_&93;YeBe;kkX!9(@`0+L%8i0fzgpxAN*`C=fopfzOj(b8(v13E>!uL&>w98~S4oF9wC6Xd3IvGsZx-{JWT1-VkgytvKE^Jh zggZ6~U2nud)ECa~YJ4JWGPF%_B`rnrAW>(BgKu$f3J$qdI{BrNXD!yFqNj-c*x^Ix zwp@|;=8@Y9elnkuN`&le43iML$wK-NMYq*BB8ghOb9b=RN3>BBJH6iNBqQOI*!h<%JCM~|-8R@R z*&7}7yEF;@zV+Azpf}afpvh@aePJD0fLt6Yv`wEu5$^V&72Ehu@%u+p1PcEWsUfOy z2$F0q&i*@a#Dt( z^@;OrQo5`wkFQibo3_Gcj*9LXOdpNU5@oOw4v+HE+^!B(;6vba6x7J3fynWF3rwkB zDP+Aivl&Xu=6TG-EPfC1U^AF;rMqAIYk1{0N&VDXGVP7VclX^kw6Hi9IT1^c!Oft6 zE~vkHX()aB%RWcWWv0RdN(x?jT zxm-~n3$(Ei)AceuykQOA6Nz(iafu+(nf80@P|{JP%wxsKula>WY7a|+aRcxckFYQ1 zeA}t+emg-=<)INJV`%c0i0!oDHlIR;7nu>2w&WH$5_owaW5KD$*_}nI@!DkwLqLg_ zBvT$gSkL?uV`YE^4a)l9#)N*5&^JY5&~ikCQ-#+4*By%V#!XsPJ&9-L7sj7W)^Cu(0UZ zk4@1LQZ)H3HBxP{<|{CTm09nS7M2wu$Fu@GBsA>Xf$cdRXr$%GpZVzMKJ-X5${E3j zL2dJRJNR}8D$5)SLBUX-ZIchn86u|J#k^1Yjmqpc&Yb{GFtDb6Tt?v~=c_}ubsolg zoi$tzGTz3j^RGb0acKZtU7UvkH-~7xcGlW-wqz~>R|l2#TG_N$C%f%Lo}b;N>9&~v zf)5!$oA8cPpbSb3vDf(Kb!`Fkr0|2+?H!taA4?N{-P(~|$BJ=N+!A*f5e@gn;)FZI z!H07Z72KfL>}+DJWCF$1%82Ww6$vjZ{iuJ?BnNmP(&l+!=sPYrIVwKp4~$FX97j$D z20fnaqv((T*9ktZ0PZ-!lZeP&I8IPi)93tPA-KzKD2ehKcj-)NoXf*x&e{+mV!klx z=+`F_+6Wn7zSlM}m@y`i6c3q%EpH5xQ_!r4gFAh6YyTEAu$;>}Of(2tkG}Iudwl^(RDgY^H~RCdR&>acQK0Ed)F~^HvB)*ji`=-9$kv z{4+(rw6HNfzQL&jdIE91Flt!zjkrw_3dO2rP+GI70bFvli-_4xULfhXf8$y|w%p-^ zvVV1LbPtoQT+Vh1d*MyR#BSu|phT2?$pJ4&kX*+K$WZM5*JLLH7a!f>?U%&@kT`K+ zJUdUCM&MO$*x3N8pN~7J9Zc;_Pdtl5Wk|A&Sk6J$+53OdDgQ0-!6r56xe9^<@sk^3 z#Psx*K;4(*3%y}TsWfeN=<}+Vbf;{%Wf9tXUo)A*&IS{(7cQ^6y{3FsJ4bc70lMIympYID3dzIUYOLS}>z3_jcd$rt__q%)`$e#`U| zQy)Uk{@3c-(X(fdz`+7TlK_~BQ)_q{YbeM(hSW+W60 zVq2o6rKC*vMlIsgf6_riCvEx3Y|ZVN?a+8iQZg{QU<oF!~2wLgP}{tff}xsaGHpq_k?Ub|xY zJ(wWoKlt6;s64*$`v}9JNXCI6c(%}9Dyl(1yXU>MvvWD9b5dnVTZ>6iKS9jsqT10| zM9kB&*2zGLALu?0ATXah0O{F>K`li2A9|`#C?HS#i)1NT`R3gJ zh>J`52>K;r0)|6M=LHp_1C_bt=E`0*zE^d&RDx-$ZpJ%s&0FAD^|QNwCovRUV1nSF z-vZ7(*=KLr$THn;SFW86NE0m^UjbH`h>t7m{Sgxp04%R7iV;jqtWLIb$ zMQm$j3rieD2s*FFw~pFF#q>UM#@$B`e%l4*Fi)%t*pj0xg%2LhU3RRxE|Yhka@Ous zRMDBkfqAOEtX7`isa9q#lUKcr)-vvZoYrj6-w|doi>MVqw5))v-%p7D@qsTVsNL^} z>5t0k6;X}h+oLW919g9eI0^x9wMYB*AN>vc&nKx4<)9D%WYav3n-Ry|z6Xb@MGz&| zw#9p<4DjT8`Du`8eypTy;EV~jM(8;cdNfEDY?^-+Pkyd;3^eqxZND{heh;`8ue*94 z+6OPLD1soOsKO6<_x5q_pD%s=vCsc>uw9~FNeDl#$N!Z4T_L{+^^z7Tr1`QNmPjqF zezol9)7fY`HuS}+^?XJt_jyMp*Y_DicZD@pw5T>&5mN3%+oAXZ#r5PVqe=8v+XvDsQ!;}=ps%HZynd;xksym>pbuE^V@b^F|5!7;`S2Rz0i%Qva9vd z{#!(SFV9R%4}(pY@I0MQN5`pL#`PH$o&T@l`)fQOV3Wc7bz7XmLi_LFCBRES zWt|xAhS=&E+^*xt&#8J{}o5;0hVJ#6lJepwmR}Qagug25T4C8)IMRaj2CW zKkh1DtTi`>a;(&AXPKwXZt{J91NUjyZNFQxgr`HnVIsZ)jz@$Jxzc1|Gw7tOmo9Ib z{V`d@0@F`-U2~reMI)QDXdg@31X5;su@K;qhx_#3 zgP-`I^Am786&bye%U3*{F>dtkaNu8Lh(^#(0v)6y{9!)*^-nsBgCCQdPyS4nXe6}! zwp^mh5!+FIH6DLo64m2AL!tCG^M8-U+a1+Klo%ak2>Y^CEtD&G8v%p_WKG!FO~#<4 zVpMJ_`>NA4)FzlpZiL?$X%d#f<(#%{#)j$$+{9j|w+$Xz#!)OOWD~52O3XJiYBsPb z=VIy$S>+#)rVkgJ>o=Bfx<}`8<(8wXB}+6)2KZI$Yiva?=PU@f(v}D>w~8CD3!8?$ zB9iu|vW#54^QYzJBWDqn&sNQy2iOIKhdzn2?AG{^T4&DI0}qp4wm)pY{6t ztNW|#qY0&@w$AhK>G$qpMoHS0zS|ydCB~Jz>O&}& z4O0|TJ8Xbt& zRp86KkOm*IkgVPq;2^9kq-Fg&KO=y#!hAS*2F&cVl>f2Zy@1qA=4Wk36`p66ck7@X zaePI+M4Zr@4u$yjqBo{A!}Um?fYV{jRjiGGbKN!!lfN*-;Ux@o)a1jE1J&c2!OiyzvKU~Bb#iMj%+0wrf%gtt@pk!;=SK#wyq4`V&(di* zKEoix7K(}bw*5_U!iWreZ4rcq@mWS+M<0=Cc7dERqt#D*Uf*VIkt}9w))=3kJ75Vb zT3i+>kPA+0hnLsjz3-#g*MbCOqkMEJnag>IZ3QS{j~MI1GY3Sgy`oN zol{}UhyHVhrlRizUBfXxc5~sBndui!&a#7v?^nJr%9*L)gIosh-fCX&vOXGB28PbB z2immMqffV|1g-mA6%yNXSM4$4pK7&j+R3Jpt>etStXi!bkNUP_qTTCRVi&HOukO=q z+jXPbU&oJbl;w0v-M!xfVs;FtPnR1@&%zRI3e&w-q`sza6mSc{5crP9=^yigl>!Ro zDxU`YrqZ1o*PZ3ruBtYZ*mj=qY{Tl!1^gpD&pIr3iI4dkd2VkUXL(6l!84>GC3yFW z$V%Q`pH${`JdN3?r{>_pKU13H_DANYQBf%)@?C;EiM;B;(tolW_|+Q&4%o>dhV zLQSbbXSfuJ;d6}wzi;(nZ@0FVyziRx4?h*Or!hOa%(biIf8qP`R5YqsyPb?~VXP;?~sb_Tb7Q=7`E_6<$yG6?w&~?-Di`hd+WW!wDQnu7CqD7u;M?sKq0J&gK2;u7+wLwMlS~f*rsX(uo_a-@gX2h(&wBl;pKV&z zghM|3e@vZKT$KG6?PnM|hL&!XlJ2gdy9A{L>Fyy1kx)9MJ4CucdH@|zI;3Oh?(V~T z&c*rPK9|quS9`DZ-Ak>L>dMg4lzdNs!`6l)@G&ekG4687VaV%?K%im^zPVcL^FGin zUq`$5T2r@7T#mq{(7T9E&K?TW2=MA}BmNLm;4rx{UjiqyITm#W$*IxmLt~5cYNX$b zQz!vG*l|E!s=6_>&OQVcA&w=0sJWPE;_=@ZG4n@f@8GD4w(Gj`GMk)0NxVjR zAic0F2}=(T9)u12vAWpo8Y<@f=3ArbI+0wZ+?t-;I55te#fLrB8ukF{KL?5+_a1w_hOHi-!RB#XXcuFjd zSOp36>}?S#QAeSfXS$|TaY;o*Ibb;GW zl>sY8PK_TMS)%PkE;RA9tmh9GPifHw7uCeZ>c@sPiM5VtxaAwt&0!k(QFilX*yfHi z&+hI{|D$i`UFWCe;iW9UrFW676e!eudP+esM*=YcQZ&g4#Ss2QTBlZ>LbO zyTeqljSZJ$7B$D zCvTXmHSeaf`!%kt3PhlFe~1>VAXgoW29JCU5PO1O7qoTqx<(iC-fWcq`<(Y1e^{i@ zp6=GQF|b<4>9kIeB#1NM)6olbGa%u)nbn$#8kqq9RhQn(sE1VLu;^Oy%&Qs6UEjji z`?5VEL*QQyOn}+q($-a-t%nC{T1(-9>I*Io{Y_)p>7LBaQ4RigT-QK#6+-nV>jwX` zq2~Th;LE|(HW04(+IbRD0Q9Ki3Y6T!085!KCyoUc~3{X?x59;m{I~?U&?+M4M2s}Sg#7b-gKZ{WI(a{oGeKVjj(>M6ndEiEP!}yocBSKT3fGwBgOHiaav5lFvnUu&cXSFal=r^Z$8uP zY$qX%(Lh;1%)n{|o|n%~yZZMR>?7$Vjx7!pzu8pu(d&08Moz1a(XtpLoj05F zZoa1xtP$cR&L4+?&0qI<1V5URwF*yzmK{ll>BRI^?O3M=yaE8x zzk@gV9|fI@0gNvqD!jBBcsPz2RF`cN>8kwS@?bPYPDbqp^3Ay{j65!t>X*bXi~YW} z>_amr!W1}$KM<2RQSF5kR^lX@*znG9~Qgkh+Xm<&MeaGh!V{k?8WnTspZ$N_lA zMP{(s0}%V_VH>JaH!z9r$FUQa(38gUyj`H z7#5WPc0tcfvGS}v2P1-%tM^^+&w7gf5aJ5f-?q`^Ch@l*<5I0V*6-5h4^=3BaE(Zc z@ksB7{Tq2a#1O&fY~LO)Gk~?5^uF^yxF{@V0*mp>*qLuCFf<$JXOR^i_(r#{0=V&q zMbDCvvv_qw)8R>oxz_nAvEnyUdxN^fum9-awP2(i9eoD7qDhOwrWKSowJ^TyBWHTK+hQX6SL%zP zMy6olt?qF*{)hzM#{lyo5mPH*O}$rtR|}7`iKtImCmH|k8&53c5h>5~i15KWd5M!8 z=Np{&Svp<^Q!TgrOJi)?k8jM z?b7sG;3@l+n!`rA zs$KuOTrDbY7z`@h=2TyhzN?}Yk2NiA`%L{g?j{p=T=9G?PS+B*?KipoQA}Z9(V#fP z)Z9VSUT1-1-CCs~U(;7FrwRB(a-Hd@O%tX_UVQU*q>GRv%45hrU3h1MdWpu^@XQKf z?heuIT2R+er9xY(yqJ*VXi(6oq-TcpTp@-{4iBsQf(OUI{_NQ};lRoV2_~t`X?oAs zWCQijcBp)p;Le9zU z!rb|uq@O`DA!IiZ>AOQ#QW z3DrTZ|9d+cI$(ePpdzBb4NQKo(n<%bX+Pu&54nNB821#6=XeL$aQ4mh9Og$}TJ zchr?iXfZcxbGI}bH1-W1!hk`S930mPRZ}oU;og>z{v3F@#Dte)V46;sV5C{Ra=mcI z^;T2j%#l)ipeK@$=U2`3#4Cf}hgD9!X~7)Ped;{~%WU7EfEi^%{iZV65_gU86CIXQ z1n!U9nQLZZ;qxnsl5D+2=yb=<%WYzW;F`kZT<6_BX`q=@FhrkkJw~kKum+$8iIKRx zPNHyou!CLGMTDTe1Ynx^Kd9U3d2Nq!;_ezS@$SGKLFU>o^H9j&@dhX>43+Jrb35h+ zobK$4b(~yBnp$2&)sc4eDN#~ltf8bjM{a8%Na<^B$glkmYaP5!iVe^sXC(_$zpIg= zE!DfT96V5TEVTGZ;8JRj7p$5_y1`YG3e9$N_;)r?u@MrNR>B;wQGFKx51L=L4%-d0j3om54l1hOLH3(+v`$pF#>NE86;Fowc&;vW?(@^Qvn zvrnj$&d=9a!8WQ!_xz-YIJPnw|r^7rSL1@`j?t@8Y9-4t%9YPMwPohMQ( z@Q#Df&gSSA32Nco%>d#Myn7&J2Vpl0OcwboF9ahz)V>+{4GU{Vl1f~X&oT0932&4h z@G1DVuPctv%$nKN)?bi$WXIxjlmhX_#d^}nx-nsCl#~tHqD%A*sv~leoKjn-4dS`^ z&A==dh6i)ITxj`+)kphHni>P;=Ht@y8Ao_$Ic+j$pcyvE5Nth^lX=!|aIQ=^gyrgb zTxYAg_VRSuFxPb<0c+pQ_+n?VZB78jccfspHd8%vsXVXP7cWyWPcPVoN-f$+_u@)Fd?JUAP>i(I=ZNxbcNH+xtOm8O7{QHq`rEL>IuDGOlM9k0 zT+;-1k$X&%A2#+K^3aaF#h|S*i=Exh?0akV>SnafW&{}#^4u(uK#X?(lU`OHrowL;={aR#l_f20#|%}Un8hz7*B<&6`%SA;mHMER-**~vsm%fQI&NDbA`_x zSDt%w0zit3%p`9uKqd@Ug19ZzM9@}#?-LlNKlL{4S6$P5-Lx|kDcg(=ZC-|3w{w*> zw1`u|_m}(+YGpe!;=p){4yWs74$in#4-NFeJwKD1*!#84mW2}?7z;wmr~@_=?<(FM);GOhGsZYf!n*Ei`C08Wk1(Wk zxc||`%Dnm<5Ft3djcf1=-dXMp07wIrAu@X67`JS`Ey5qp*BVDfMmK(~#SXhc@GZZS z3x)M|K%7?D59%c^#Kp4ETVB7xf(l7>+i8HE@)ch$b5!F5vvvBr_wX?oDEtb@CKv55 zGQP7O&Pt*WPK~D#i3J+(k}aKqk-6S?A`cD3Wy|-6aZqHtz)4>GveokHt0=zKPQZ_w zp6|iY+NHf42Y#NK=`u&H5(OO+5fO1>etH7_!wXru7$xB2cZY*B>{AZs`9dfh@=_kW zDCYiGxXeQq5k-zYQiv}}+9p$eevu*#>c?X}hU^t`UwOXgvTTx;5On-<=55m!1ZSVD zx!R7GZVOZU?(!}7>+aQiVUF(QQ1DrQg!otSxpX9*_1_2Vrf<1F`i)3jNv3%$ofRAf zx~Ma9jkQMWj|YkjjSU6dH=8|3ZuAXsX-1u3XR~}CsA!v#0EqXY*?gvnxQQ3>QP3EJu8FJ zgTtKbX*_IqAmDP;@sw{^vWb{+NsHAZyqluGEorfEs>#XR@_Oe(a;*^Zap>3Q*VVmu zDy)N8=9d)2BsDGEH7o!rm6l~2^cMuJ$*0+S1>XjiH~fjM^{-No_Ll#@I*|7r-o=H+ zQZhuJ?gT&E;!?7-HLW;Mqz+Po$T_AFMi+cTM0c>0o-K9w>8*hr(cjE}8i)t-vKA~9 z*#ah?!8E2OaZOd}=##F%qa0w7BhB9<>(a^LbTKZbSpa3SRrq8WVc08D4Eh9ZYgMj7 z6A}t}>QN5HRc0wsW-oj~rh<9^;d3g+Y^fnAkaZzK0YX1|Sp!G`#9oDs55(6BBVB2xA{%=T6K=?C4;M9jAQPC!QknC{R z@#;by`yBcx(+BJ4OzWS3W(bJ$tF0S4Gg1fj@A0+M;9>h-CqTgZCBZQS)_U6qx5`TH zAHbKq{?W=r5^P5VyOxeO>ILu)!|@ZQaG3y`?D;tMWU#XmshgnlYL!vEynJ%Gr!bM^ zV3+w0e-s}C?hKYza?ZgC0F9hs7vnT5X!i@&FYaC7C}UI*^;#*w2QcQl*Dw6@h4dW+ zrXy_tf8n|)sP_9UvNYlHQ^G*}EQd5HI$^v)cATVOr|8xGL=S;Ws&qnScOORl56z~W zufhr*2|IAGw!YV)_fd0C6AAnF$%_@=`Asp;r&-*xgN=whAbWj0G28y1kJ>ckB1u zWSlMcWzn2ghEewRoYMJtp|3YdExUptC}7H;!KWpUsV5{KOQc|=aF$S0t0X10@M@bo z^csF)X&H@|$UfS(gRI!_kKGs;Xi|4Aw{uh;!~V3}Q^-F<9t&m};sV`L?cTP>W!tkp zDBFU=&C5{D!<-ptAI&%mY4$X;RfH!91JZ#=PIww0&?UlEl0-PmP+wy9KCVToEpahk z(P52}|3EXpqz;|;Er_Et-@9gh4I$ZiCt{XG%#;`}XZ^g8rA0JipJl%s@Eh^#I~-0G zxgeeMz$-w+6}Fa18!7TBubn;g8vt>V1vrF>Wq2AMr_%C4^8iU}PoX{R|e(Tdtdq?fHW4Jgh=X)uCF97te9Q*ZFp=J&+G<6h+=+d#0rYZ zv|`}(5824k=D&gy0_1~~r#+Uqf>WDrsBo4mVkNxw{^EjFER`SEB=!`ZYfz7*P$A*Z zz$AoGn|wpc#Y_jn_xAi9E0?Lilgy`6+e>L-g9!Pjic0Bsyz~Bt{>c0+F<%JJ>*8&* z$kI1iyt_P{Q?6+JU|)Xb(f2FTMEbZ?*A@^5_K%&81YTEIrmefXRAt$WXkQn}Y@;Qq z18+I~$bLAQFolwK2}Rp<%r8uGqDg&mzHsJ0p~CCyo9naC!_HwQt}x1S-^%iOKVDj4 zd3biXi9+yuy2>aih`Ca^-&O-(Bc68N>#2uNdaxunP;$9&h*}1*)*V4NbWS1dR(BZ} z+}ci*&!ryiwKY?y7`E>((6_LRpr1&QSHX052par&MoU8%U~4R3)i2}rsKHdJ>Cq-a zv@N+#T{81I{-2RTaB4Vi$7u>p=%Jp%jQwAibDsJP{cpc>3OjD+P1fc>4{z*OqmmMHsMiV( zL{7I85xV~U)(JPBQ>+QjjlrY8eRre)9gAtsd#C@C?a6O%q( zJ>YQ>`M5umgnf8B>N1Rn0sn*+5*D`Rc{U`7-?uWEY$@&5`mMI@F6VCIWS)rH>ATq0 zCmMF|2Kbub!Vj;%ln(jQA-qDuPCIPA^R4DKIOZ)a@f_4XR=<`XwiiZ|-fv}CIWe&} zCOkvX@bO|*-rsnXWqlfC@D_gaPtu%St8<2`{>8X}!?j9i{=}CW!M8fG@n-TVU)@}8%eB)}<05|thJFUrisV#1(6&|JMC{Sdxesi$&5IcL) z*e->A=%G?7I1oEv4PN)!Vy@@skop_?I)|ZLgNv)(9HY#=p^>RvhyS&Jxa6YXHj5A{ z*Gy={*mC^91(oYUxMzl;=h_iA>oMC9R!;JSb# z3A`~?$j9U~-?h$cQiqRrz);4V0X*R*jMlUDT#vm<`y?>kE$$vg8aKmn*w~;jkrU?V z!BnMcLpcxu#5BVMInRuC%RC`0q5vxAlR;rTZ@yyxyp)F2aPLDDf!70R-~1QxkH7XA zJO{^~#h@C5B;c0#qs)+fM1=te2I|>lza==|Lpc5vi_inMbVezZFd7zl3sguChI|nI znaw^Za_8?*-}A8`Y*7wl?fIf9+HhqMb&2!ZpoJui7lsDcAqikLCvU_$h{t-j zFErZIoFA#)A=G!jLvREd1gXPb!l)CF5+7pIFbZPG4}F*3y)x;E2eGk>;cgo(zKF$F zSlM>1i!|TD_Ao%lp)9_qpJ42d`}CZjdt&p6VN zZk2g_$8wZ-@J5t8z%Q<^i$qikFKyZ)DGj1YTVBfg%ED@-Q9UARGukib&P+VX|#AG3p#HL7*^>z9 z{{s5kln)ES!9Xu7ROYG=ihY%qhiZO*LZkaG!P2py@moIYeH!IpRuy5~V`&fI_&er> za^J0w2BuW4vRj^2$^L(up9F3toDhSap6@3_1}D7-#}tc*GeTqJv|gT;R}Y$LmxvY^ zVF?EjoRY+m<9CS|tLk;#Mej7&@ey%DQj-|bh;!;hhbS4S}z8HY2Z54zfB`l}iqnF}p`Vn!Fa_-RA5W*`9KtW(L9G) z7voSvV&U|Df%dY<(`In`UFC-Wv0oZr75gL-94eDF7&9xGOAUTqkFkp?=S))-W}qJq$rg1pVSR@iKm8=vnIvS4wnLgRy6htYt`JoTLX=k(t%h6&iTw>a zZaD930``^eHmbQIFMSNbeq4hWCUY;&_$iOWuwzQSz)$ZTzR}3_1%Bw6*Z~j?4MQim z&MEfrBVa9?DYf`P`rd*=b*_il=)6|cQDIF6t3EAf%b(c7afcFz_ z`@af}1XcD)zKGE0ibtg13}Fp*#_#sE9`FAmOYHPSU(?;}ImO;JbC3yfK{GUsy8IV6 z^}l|>;NK*9lgfnM!j9zIdmkYoEPr*#$8>wlA7@YRdtmYjv~a9>+q2^|ZW5MMXA0~J)EyFblhA*OH2T|WYl|$56dsFWG^d31-`=#7kil`j zimx$s{{pm(6_Dgg^deZS(dCW(-&4lI$2NIDw*7H8Ns*2g2v!b=L(dur(amc&o`{{g<6E1`k!pTJy7v;aA%qL=0OZc+<`b z7c=vR!z`)@3Uhf9@z6LRrlGXhSR~V0z0+ef5pu0aIf?K6lo&Z8#-0kMhx<=OUL{lq z(k-UMI|0l_72y&og^M2rf95d9b+6v{D&m<`SrKv^GJ~bSV20D zU-1=+5|u@+Z30ZOp^b#!;yg*9_~)f#zeK{#dj601Ms*hkIsY@N*=%OLVlevd=wk)0pkW@ka$M6 z;3)xueyDb>P9cQvYT9G(Ywr2B&?w8>KDwzd3!@85@4wYP{^>3L_~$dJWs4J}LgnG- zCkzyVCY(>iaiJgT0Uft!(ml%GpS-^*$)N0`Q4_!26Eyol;FC= zQ)Z@3($F~F=rG*N@elf-;JvoEh4RDgwJhsqMB~4Z?|?iSAM*G$`W`=D2&p&D@u2^D z-;((4C#jR1UZRbOjVvB#n9qaUUd#v1B1`(2r22na6jbdtLJ0z+_l*iDY#8TznSuXa z2hhu!1plEg#S`Y~FZ1a1c`rDh)hp*sJd@CU0}%oszZKA)P5L{oF!SvY*}|c^Uz@HD z7x~WU*J#=gauhAAtRy$wE$=UvHr+VQ1kOI(RDf^37tbfILbRninX5BYp$Hc-)We^5 zIrft)Oo`T3BGR$LK+j1!c)P4MsZBxGn3axjtGuP=m(D~md|#1~F*PYFIyD1VQ#1zK9k9~oi)oQ}#3wfbLg3ZaWNp?l@;NqC!ip&~S|cb2r7@Q3^W%~Fpm zvsj~TT!ntAS7TxsJ2~KunQRM_Q#l*91{UozL|9UiTFu)$R;YWQ$yF)m(Fp#{%>?H4 zcA6N?IY@nnXzCRh%F`dbv#@PKp-=6VK5@+zN#gDrG#;ef&mi5f zhe1;l9O_KYd5iBTL~B*(qe`(M;j4mO8h*H81U-^c=BCOFVanyK{3Tb1vnSs_cP7}r={kw?!Uc`koqSLswp*;s zG^yz5<~C|9bEVOWRy+VhPnBlp#j=49MtQfusU`@DRN?r>gWWw!PNYtXLT?*IggY&p zw26_lJSy)oK(EOk6!bzt%GjnIz^<_D>F|AW#^Y*nwPPCc*)~pVX1QO9zd`e()UFjt z<+%vsOv6LsK()s4YTk^y(cdyebO;u;&u9WDvxwg!nVr#^oaXnBD^3JQsP{H9q@`n= zd?<&HdCtpK!N_OsyXAUxNAWIYAPOfN=);2JZ2R`=z=SKxOBCmG{n*{$hu=qusSr3d zd5ffzs{VaSPrlDc&a6*DF+gKS6fhSpj$XnsrXvqvYtT0REpa*XYS#r2v^(zO2`uW* zWFf0@DuGFbQ@Y9q7U%=K%H@YCe%k-|Z)p~hR>iNW5fKNR05Jug*JC>1>$euGb8$4Nr& zS;n5T+AN0EZ<%XtN#iyn$j=U%773r&rd0-d@BG4`8yTa6i7J^;upv+1Xy28}B@;rk zYMs5hlk;Pe&2btH?~wTR`-Jox*L#q#Y^vGQVNWtg*4NW;Q0)5r=1X9#l8~#k;}beq zXnQG*xR^G;bDKdf^lfvv?swecqhHZ-vBG98i*=0C2$624lo30uX&iJZzLoIw<%VEsLT z77jlO{KVxflINrf?HyqzAC+aFQWAwj{?h;FMH)?s_%&Ah~M) z^IGfxTaifK*=Tb>U+G_{yeST2&5M+}vKFM6SaXqi4cL9uFqPz9o($zSG3+*qHYl@q zDzI*%72a(TF{n|EAKAFEV(jt^gpiFm<;1=j);v=Id)!(+b#~MmU*cCTD1!eGzQLxx z4ur0|zD|`_j5=h#6SQ44OpPvSVv%$qxLz_Kbcx7f5Rrm>ginG2XG;@BFuV;1s8M+yb76&SJcJ0v!cZgSeh2rOo((-uj` zc-!atNl?91gE|e5x6C0HqzCF!JbIL*ta37s;J&;%2~EF#0%}MDEYyXC$C<`{Zy1}l zP9CB=eCU0bC?xoh^nfc8%j`Y-F=CxejJ!g|q}6#MPwp7F*KIsa=AL_xVy~*q{E5OW z$!Y2_N2U*lv;8H$Ya{yf#{-s{r5yjmmb!~3?~8w$(qd7|fF6LjZnw0$fA2`n~Wv;xT zHu8c31NmA&9Lo@{@^r`mW0rW|HtJ{!%KfQEg3X~mxfpKI!YPf@sZenSN~iCiMAYYa zQ;RFU$)&hPELYa9m0j!{*J?~t(!9jtWss(j{{s7OJL?J$;PJVLa+9QsiJQXO< zH1Y~mcw>?SB>5tVZkQ~&+lFa9lFH&5=(_k^HQZ`N)31RSE}Yk5g)(p~hx{RCZh|b) zcw@=9d+x$&PgaOI1_-(dE160`c?K1C@6PjAWF?z%lz6fIw+lr)DrNCoMpb}EN_ zie-FMIjP!g`nDIeh9k!AXg0;%9%4o#3AKh`XXu9I4jA(^NxQ+KTPlA92NhKVUPqd8 zxYL*vHFATcb=r5CLw-b#>h*ig7dIcyNFwYX);XsC81A8n{O;bO@hup{dC+Nq+Ku+- z`xbPb#9dJYJMP`3SY|tD1$>D(iMezg2LQS%;(uG!(U8h7{p=cxc*W`g!DKgkt@$TP zsK@Oe`2;$igj`jUO~I=Wmg4pHxLV#L)m@rp3NcID=n9P6)q2s2Q0yREX9rW`M@`EG zQ&m^8c)hQCzMbk++9S0wG;v`8oBJGlS}m!#3dFJFn-?_!W!o)MX3Lag>9E?7J83XijGp1py}^=pP}0*b_lv0zooFnm`4Wp28gj6m4OzeEiRRJR zuQE;I0pb|k(J|Jw8SoEuIb1cMc`bDDr^A~j`9eB4^QLuDm9~G)1q?;p+ueY-c*vR0 zxS6`wEG+XoQNvRPFzcG2&fk2tyH4n*EB;;AL8$|uWJYC8tb)!ci@{DW{e^X#v5w~! zQplzSZst{am>1{sv2je+=|>ePY2-)k(Ia1d#ByExdH{!cyFo+(|0o;Gg!F6S><4}Sf;C20#5wt=4OvBh2itGsT4(2H0ErICM_Y1>r70!%txWB^}J=U!N@?oCNNqc+jE#Etv$*UZDXdGtmKU zYy>y#bg@*zbTqE^4>cegedKz^r0()rvm6j9+!q5+X|0ezvp0tx*cnbAlPQEy8b0Ds z)wH$l;h^k!+^Cg7T|zwsE{k#FCE%WU2yhJ+r^VPwXUP zth}@QKX;#(D$p+_(t_~rm5TRbXMR=Xe;>IDrI|SI2M&L9m9rijC;_81@9ADW-LUUl zEI!{A|5+05H?-hyf4UJ$VClIZ$F;k@qB~5z=n?Fx`!>oTf4b4Q;C}OQr1@UMRNmZ6 zq2Sm|<-8k9^j7-<1!|Y@oyNG<@@S^)&|O zlW`XIa`p0Mj1$t#?P<3&W$m5GsUrJnyX4&hPPzd(oNKF?qkI`c_~%ypShm?YCTrX5 z0t|0oXuCE|e|FzmQay>fW-0xq=PJ3c8Uk$Vy1{eh;@4xdB?GPhCb$g9m_KUx?#>E3 zR%mVpnlAds}kh(3T3yzV1;?5NdQ8oPRs^sL+}#P}zJV zS;|aZaH(8`*KIi!^`CEI7B^MxARD2-$N^Nzcz7333v~XQ;AeL zxivdbondRk0bn&Oi+CEt+%-Ig33L5vzRK|z+MaHI^=EVl5!%sIa zx4&mE=_BAGsLzGsqZfDf%{me;Ie#_miAl`ZC6p1rGshqSwt0H~F-Z|1)sB!Q9kt{S zi%^Sk)%3pRii=%e-Z|^Gjs{Ba?dyHG-rC!_%~4gq=vtdpl|ZDciMWmqGQJSZ_zjd@ z;hchjM{rS}<*~GKgg(S0C?GBw0L@-At!i}pF*UcCp{jlme8n*QR{MPr@VJ2Lam z=!N(vo2EE{7bYaUGS72buq!yZ^PtXRI6%BV7!EaVGj4F$;1g%+amEWLZLah`rD2+b z_0>kl@hx_au<=ucr0R0ECDtKXWh{nOeM;(sctt7~RfhU1oR$mo*&{3kOvzvU zw)wljUbB@vW}dL7Wu~~)`tQ`&24Z;IbRP9(e*8mM)%G5Ino7SdXl6ToMzYq-E*uAr z4yruTYHGhx+B_M$bXDb8b?$8K+K!%Pm)}v1B%sB#bhfrVK2%rx4?kTU=`McCKrvGR z-aMvsURgA*Kg3PU+>B@Las59D_n1Qmo{pdj8@p+464qs-xB%hLad|K;UBP?PeGZ-t zrPFD*_+hoLs~6`01JblDDiqhr7td}3dOX*>I^BMtXGxat0yZc}owCoiMNEU0i#fUa z58nnYKQJXFsbS#a)L#RDsR4GW|ATysKj~;YTOfNBG~L01#jRMlFIxbIAC9Hbgjr#!m@_-)t(j`YxMB8Ta3k#X_Y9kd7GR z0O02xDVI$Bp;yb041QWRC(5qVD1No@Yd0_SQnTa>=wtNO8%JbeT$Zy)&`1cI4EK&3en!5=PqJ-SjgA_dByQyLOS;>Wta!|O7# zb)LM}b-k6Q7ScRu3bOYY8J{P$N2DvaxUHTj+Ax#nruNC`fVDjODb0%=gqxTAs}?P&u#oq_*4 z%I|W{juI6648(rlL*G~xB@3bf-i(M7i~r-2Zmq_70|E(sO_sz62Xe)2Bb)@WkIO8n ze|h@Qe*UPT8mtFjI_<1JyZd)@CYK_WNl!;FVlBP(` zyx+j^;MVi6yIa9my#US}9H_6|X`xqNz_Rna6R0LG>k3OLK%0vEYUcWfN0P6>^k5Wz zGAf+K{mj&-S3SMiuS<#JU#r*r^9CIR;e`~pHF*i&Krl!J#?h7v7X5(wHc+?!%Oh`zv?Ki4z}g#Qj@;jzrva;{x(^Op6EGd zUPCcJ)1wy=P0nWO*pHp(UmeQU;wVVr$nP?ln(nxVom-Ed6@s7v>FPbjWgQy907Dc- z1Jl4jugmljeH>6$79~dfLFe8u&~@mq+~3FEk>Es;^NkfR7HXU2VmI3(%^*+bQ-Ic8 z_z#?#emgY79BQW)K}2`R7YWdtKpvP^#0IU;`Hw+n^(HZ{PtNqqZ;p3207sW!?*a|n z7sx2zOyL!dCz|T{E5AlRzONT}FCI_>@=YmV$`kyvzdWy!6xt z>trPnK8vK{-Cwv_JaMnc@2YG(hrJwU>kt`TWkCVi4q0qh5yq4R?OkP!$|ldIa*neX zPcBc_bnY0*#^b)9l7hV)c76#bpZ*(tD8}#2^~K>1oTu^W%Mb2#ryayfzwv@?_$>Pi z`Cg|8liyA*3@Kd!FPqs=-0{SQXZLCx9qOqcH6CGHf`5Wd*c<-gtv73<|^lAr|J+nf$UFS4oVpZlA;15@uwP#u#NZfwo1{ zuGD#dA@o=`4gds;x-N_NLyCyGE#9-#&qIn9;aZpSANbbq!pDC1lLQJ$g8eMTzXt44 zq4P*nZP)nzX@ma!Vm#r#wA*G}55SP-=p0qtOAA#L1WU_!GDnnF?Ume-J2Lf{bFzXT z=bx^d?Yn!zw6FH;K68U1FTe0+-k&zucSVkB!$5OmqFGeGVFVAC*Ux;#x@$oP@vp{g zpy0Fi*RCl=vsw^%h1l7})sr^ao6;b1p%(A$7eHXI5g7sio45crwTyFjz`7IBF(DQj zGMFDg@~}e&`>Z4?J>400G-7QBqO zC(>J-^Dk}n!7qrluhanCwph5`p}ulYG-{u{8Pjjk%{NUGRDKQ_ZkP8yFG+Mr@+(u_ zQOtNy1E5JvTIcCRKU9;;K|31J4^$L1l%Tv9WAata9HY)&!s1p!r5NpH5J2ej zlWIY%GHz-1*9iFdTOX?Y%lJ?r?C9d1=)U6D$Azv>)&>A%rglVgR61se)&(p)54q7>vBQv- zJlp?;{8K7oje##-GxtVXcg)h8CsGUTz35A=bRzWg&#uSx=s^TDqEZDYV-P*kKKwae z_;+;MI+p8EUrHuIMO@=$AVMwcdp9G3$`F$Qgc9-|k@y_)1mVVOpKh-AO|z zL}IyEHIN4S+6UeZ}CkzF&>^-7mMN8KBlw1`P_m*EM_R;+xG(kk&v*{$|O- zM1czpBUZb%`(=6mto7#k0pEf;8U0;yp*%W80+uE49m15><&h}#c=I{nydzbNc0S;ad7k4*pX z010Y)N{nW7*P~+#Bq`L~iNC}dYiseOkCxPOQEHFPiOD1UjTydhYd^O3%vzr&=Hn9U zG`1K2gfd-!g~x~_(-B6|U5;)E$=+oC9auf5z~lbDM5tQP#?>y+_qt{2{VO6EMStiI4)glxAh2&LrMc`5JanRp` zrtW!(RcVR37r9cD4mamJ^*zvQ6;T@MhO)GJ*q~2Ow|OA&^nJa2Fqg@#>3H&eu(++D z+bRw#2B7NICrT4K-|Yl(c#Xff%Tl7hW_Z9mF5jj1d!s!oz2R1^vS%cyjyBV{>z^_|+7Xd(@JO;FzZWud{-(N=+-Df!bf?V0nS>pQs=+6V3fE zZ>unUW4kOE9L^{Fq6{83^J>N7)LwSAhH_hoJ+s;|kMZN>-X_3#(N3sQD4AdHoX{3tp*-<@sABW*T4meg z!DI2VU2^#e*;`uZjRVzu%C~tT@mUu>C-nHGdi}7lYQ1|3by) zGp>lQ`6=>qoa&{xS+>XBfj{DYfoW>yWM_tN7=h`Oi<7Nb#uY1huWZ&s72|f0W0^OCpv6O@s%2P; z1-(BZr&0>0ww@{PYl1dCXO!0bYDPHp(cBilVRI;fV~J+mT&t&kYfN#ub@F-;Kc*|E-mg>q`12~p=hDS zwa{XP;sh%Y+}+*X9hU#j?mO>(gEME&BtLoX>pn+(gEbCFFRs3f>x%!@kc0I3Ixt;9 z<=-o=1_A-CH@?y;;Wdbj@ZE2-FKBrQ`OZCBvys$LEomW)3S(4&0cn=12pzTNInFlz zn1vFfxSq+w)ycO3nvM)}5#|o*q@V}%t^bHGA3IlQAn+OxaTi(Qv0oOwHzfNqwpNt3 z794>Y@#?wX5@ivx06^NEvpW_91Sgr?%{P9N{E;T6(_Vax z-RZSe+6Cu+kQ>0qTA)oVNn>#oU-q&RxZC>eidGIDyXJa^jI#z~tdAc64-%G+V!(F7CxSR(D z6AJFC#Z@yrGqqon?e#|cy{}g+bh>q1zS#0WDvn1tR+eHz&)GVBB=3_WA*LoGaXXJa zYOkmojg)YGyHex~)!WK>1c*MkZ}oNko_E{*%#HU)&oZBPlYY_shZnl?cs#7UiT%6v zTZ-zcMPP5O_@wDD2WeuQ(id6YOYVxo<{!2dai$U*5;CJoNR!~_qihs;3^b``AUgB! z&xj7W34OF*Da32MR5A(I?8lNM*nS_3eP?SmCq3RXfE7thS+pE~K+Lw$>OcdL{c+wL zw!l*cA}-?|cZ*f^dK@1tms!^Z@mroiA79+5d3O2-E@cF9RZAgDnBs71K(||C%+DM% z2KpivuAk?_(Bi`%3sJTmn7ou*B*ryjukp&fpceefsj)&;6h=wbwczPz;CR= z+#Q^kLsDTy)))war|no@_3o}3-$dCRC2@XjFOd5)dY zy-e6nmJ+=_01cHMmg(}xvMdn@vG0g4HNc4srjX@tvK1a%8TNdQCb-Ao) zDE{~pN9IOv=&o2a))9(X`On zlc2pMU8x&=s#E`4`LmFULvd#Ji}Gf+yRP>rYd;!hP@h>Yo(i!*sp!717kosYUR_t5 zaHSbe8QaA$1w?mlg#NN}5{WSe>k3f^BYPKXm0@u5jO}!mS=zc)r`e`FRwYOg)hTW5 z`~(ivLt-cEg+PBsYOy&8t+H(?0P$YQEntI75ST-)Uqc+cCUyQ4MztB}_aZa>db>KR zbXM5JBHEB}{Yg4thTv(~Oqz&&Hv{M{9QxY-Deqg~{Z4_&@Fh~8LK=a!M3dKQ01Z#~ zLj@=GJr~ z7+5jgW%i~_RFp?mep$Ss0=fDH^x>=})#r_8do4GFj#yIW<$~rg(GK<9ssmfEXM{+6 z&~2tx)2xYgLF4h2?xO)%Frk;ahifM`!_MAOQ8A9)*kw5HlBVq8)7Z|Tw)rNW_Z{j& zuKbwzm`jUYF`c&V-RoU{O>_)B0{Dse204zFTdesxdDZkl$fsl%&W9C?yI>|;sWU>o zU#gs+gaFZ57Bg5i{e}%c^)3a9`oO+Zc zjNOvBMl;L}r=;4}Pm?%ADG>YorOy8PWm+LGk7c}XMUzXK;*PBY{lOGRINEr9EO6SZ z3w+A*|Hr{dUy(@~F093iOwvtd+A2tU75b)D@Pd7+VaW>a;|}KN@d(!TKXvs+@C1IY z4^6ZkO6HEgBz59FsHt*aC6fP&0@&|UxeIaXJg^^*HYRq)$_ISO3zYL{D(e!&vMgc3 zimxB<;b-dO*bhZ5%_8U)+hL0Ww(Tued3jtV$!$IL5@r3efUOWb^l1NbbCn+}MxY)e zI*V<(@5aOXEhU9SuXJ8~jtftDVfY7P6uI?z{IafE>hZ=b&OYS^Jqmp{y!qjJUetlm zO-F*FmQZ}{**&?i>)tkM^bNyMUKu5A?+mgty(gu0H1hcWCC;;He1JJ;8bf=7On49B zx|!HRX&0VhHhE-bDr&HXMsL9f1~2q@BKp=;Mbe%)O&K79c|5Twzr^}7HJm(c1TuJ0 zmeC?XZi*5+1Xm&7a*B(Ags1?SvBE?!KevHuq%PBn02O5(6m3`7wbGrqQJo&KOWUmL?y51W5k}rP@g^wMY)+aw4nuxM3Xm zWyZ2kL!W|BW%@M>|v`-Io> zr+M)Z6hP5va9g(L5><$~KMSfNEo~T@4NNy1KavOuEg0w=Cbt9s3bz$31o@aW1TZ+Y z?2BGg&4KJyPD3OMJMZ6H-28?3rYFl@Ekp8d-{8|IygaFkx;-s_8r+wr7&glyg0A_S zj}aPueV)0|k~lUt>aL*JrRf>t*7`Vx;eg8r10Y1~YOIkPZv5MM>@JCCL7hl~EX*c> zn26H;ZQ64JXsYz^0Q{VY0-=|E-}Tju;HYjuQuT;rtseQ~+wV4H_AGtEw<{7P3xCqr zC0AsKZ3}OIS^fzTtRXHN9ObYC*6u)BgVrar@vR8cNvx5Nv!3F{e64~UQgvaD9A8-` z*w|bYSoE>iZb|EF>9OtoOLBJN&kL^GDq#4OH22n;qhP&23aH47ik>l|_QiV}vkYN+ zJer&{XY)EuwJj)Wv4+>Gx8BQBjxkqdMzsL1^$1XfesSqz$iqs6K@o95`h!s3U1Lmf z(}cuqaWhyWH_8@v-r8`(ieksuN!;z~E4%GFiEHl@f@7TK+kWS159@wo8AdK1DZ3|0 z=h6ryFh)j7=XD*iE%XA0@q_w7oGC6ZJr{bRss_EnH7%XQ0Ch-(rveY?SWKUIC4g|Y+{!A<`*d0C&x}P=C@j_%buK=+#?&-y5lb<{X9svZo zCJ=SggJHK(_DGOSindkuJGR5-!x#9?ItPbX4j`|Kw+)uKY;I9;o)lpEJlMnke4}_? z?o`TTcA-}g)Ztkbddtr}zA_V#R6XG}7qewV(H#(H!Rk9}*R3|QNs;%~Ox_`HQmktt z9hB=kaQ-8(=Y+&v0}^p>P9I}LYZ>5H{qvOI606kcuJr!#Vtx)v?xv@h9P|{G`#uqc zpA|B9e%LG(Lm3yc+yIGVf$G+Fm{U`PXJx);jR#J zWKVS2Xf(vq!Ap|sCbZ=*^-`xMYESmn@sQ$-h^3G8G78UR{LN-Ni)ZH63CSe0$U38v zE6>*R&H<$v%ZsJ(iS-KZJQ@2Py#;+rAU{0)U$eMe+gwBq@c=)OUwwdI7vHvxNU{3& zPbhN#YXJ<>spMph&urCRAyZeyJ;BOs#5Z(57Uk!cM7vkaJThDD!ANBsPv#IL)5iIh zcC*ht;M&|N9u5xnRDW(%AfSQn&`HXpRiD{jcY`pqO{=C>Uv}G{dG9s-Zsr1ZQ=?{> z#>c=0S>%PX@$w6<3z<<@;+v8Ubp~c*A&(`-f>sMxV{(4uSvr;v!cR12IA#a>?HH@tU5u+Kyga#O#B67+?LEM(~~IlUSfEQ~Xn)EVr= zIq*GEY2vd>fp?VPahnAn;OsvQZvHF!k)!>brsr*by}Afh^D0tm_E+33HxWUfM}MS; z&>s;99lY~DcfI-RwZ~IXE`VO)Fk^hJ9|!q+-2q-V?dkOV6M>zj~E<@bG`af*EjSdBJ_0 zu`hboIW-dv1*gs3om`Jct=6(l(KCh88mSH;coOhOPta(nlYKAqEO-Jw5qrAPA(*^= z;PT+(hhkzt>Nm-l!p4uN(<&qmU-c2;LEcLrQO6QGcX}@Y9}Kz!RHY~b)BnxkxBje3 z6>Ap?uVK*tGqvBao9a4j{ahfu<8|J&B!yy?=YOF9%F0^<1&$zta?W*Pkr88$s&UqP z83;KFUzS1c(341mOB9X}~vX+_4sh3#Uj9U&E;$b>LiK@o`4Z$0yd@ z=jHOJ&r?=o4RX@j^Tx}?Zt2{nOKfl|_=%;TBhgIPYM81jR7Lh1KQ$}iX9+5Gij{pB z%&ZChYO{AwP#YHoxI-u2)Qugb&PnA&v@#U_0-pL-I3-M29J<{;9k!|(Q_q*aNTZ0G zhm;6-QNZXxCdEz~pZE$Tufac`J9*^W+Cbk&#?TcJw)YT$2#opX>_7# zFtY8YeTHN4@P=Y2hG}25YuaQ7F~1_Q1%7`MR6;#1{nA%Y?MRq%&&|K4G)-~K?vw}& zGZ47=y953eSLJ-HUBsFnufcEL@lSYpXmN1@*XjjiME+j-vjY!uT@U5^?GQGD(5RhT zzezEgR;?lTt8827xx#7Z(iXUbuiohq$wMD;IDy2z(TXP=zKf& zm%4mGtR4ZXh1*a9?yf>{c}zrcBz;9LGjO5De9-K>%UX`K2&A(;&&~#FE&_MKQ=;~` z=sF3#bOx!f7!g#Cay@5eVR(6P^4?K>a6unpF2D?c1py_fLn;;-AsF?K z6A1ymiYz0w@#$9v>41$?ocu-KFhq8G!RC8CK83^;0!BXGGl^DG?_NmqcUopVsKJW{mEx=7=2acvdS65+r05j= zb502SHOLRNybfFHG7x8Map(7yNuNNHUT4}t&6eb5%EMqUeR}XBqPv@9vOxmFp?}zY z-e}k#lc87~E#{)sp&-BY_V{!}&Vgi%dRAKW?+j88j2V+$+? z%50p3`RPsKk=rp(FKHIABf$dLoLii(h+G;w zOr8{Ll(fwg(8Oxlp_+aOo_jLU;#jR1_vADp6gW617g#%?K2+9nA6w7ugtJ!e4qM4y!hsgm(j(UM!wmp#;>5i3`&e zW1QE3kF;d2@#8mnxtc3Vh`LhvhXO`Ds!U>@2xG^Po~Xg=2uZ(-KU8XB>8&nQJDafe zqhk`x9v4QWKEkJZ%l?*ib`fTepZ@a~K^c!TOI{8&^~uHVyocXJ8%t_+2xj0~5JaC- zL5&cj!VB5QJ*N0-o^Gaw7Oj<1wJYqe{4E_tPiOXee&w&lsb1c)8V!E&aT7}vvn{f} zF~(t@;AEU)OL19$wKndV+DJ^Nlkbbg!`p%W4asfqjJCgDl-E0VxT22)RjkilWz`>4 zt>)f?9i&k_(gPc-YUjPSA5cZ;R>G|L8P8mnk}%IV^3I?5wAx%ue}paycj~xX3RH)_ zV`81A_&@M}y9la!O$NcJWC*VVucDNqW%?d&WTpAz)$3huyE4r$;#rw>q?(v$b8a@| zvB`C_0#@)<7sHpSYh!7=pwy&Nbk>quudm31E}J=}zE^uWh@|Z61#wk<#}G21`q3^w zhP7TYF3xyuTO5XHeEl^l_4Uo@5k>@Ese3#b(3lnYZ5RdI?R8%|^FaQePVP9&SF=ADCQbToL8mT_2g)%|h~A`AC3 z22sVrys2~TZyS@9P~Ip&6b1l^i@2KJzBw^AFA5Vz-GWlcx@MX8apP?iS$>~oA^9?l z9aO=VZkFcvBQpW3TqlYgmBk|48LJ)aKBVW=#tdr}@(V#Px$UTJN68}?!c?J=NsW({ zEuR_?Ocu!@>BKkG4isqYy5Uq~1VM3E_|u;=i(T;E(`~3vRmhKZVTsUwY?>SRfUBo! zH4iI!jCv>(BH)P0pZcLg*QLf;K98c!op@G`!XaBDu)sCLwkqLaD}!VE3R~o@ zgMtYAJhlYLxfhIBP%e|Vj)zbco5Sfe24EYIvJ-_?ylbf5`->f1^|FsdW#E${8%_vRO4 z;kd{>$Z2gl-eH=-Y3a+k*b6ho`Vd^v)$!keV6_C=J?7tPCj&GI#7VUr3t|i7+j4EAmncmA+~0m=1@hb#O#zo9lpW6A_H$pNZ$WXJ30RJI{6r#lK&u>+;Vc zsUh?J@PPG|vhLeyInfNNz=puLBfI8<3{uYQu$$!00~f$&@q5NwRsBGD`oK8>&xllW zRkzqABY>!C1s+`1u*V1R+{MfQ-jgbr8uh7(Wuh+ebjHjTw0xWlz+{A}*ShM>z6oW2 zq65jYFJiI+Pnw9z8Z3^5gfI!XuzJM=s4(G#s=4XOAfA{>2|IDoYAsZu(O!6m>Rps|X$Z-eVF1Iz^ULd~yhD4lfD>W={j1@gkv~ zyE&~!qHLVmQrlU*aXK>5ql-L z*CuK;#5_W7V2PJ#_|$+ph?hiozqmgsrOoN*dG$!$g6Z?t$Jp;Ssg7K1>|36VD;J^i_K2j##2jPV3#a(v&tL==yd&P1 z+*AQ@6zm&xiL3?@YZ6fKGPND0Rlus)%3hj+r&+xw&Sh>cu&)<~H8j zlgp!ttvA_^E7L9JdqO67p2^`jqkIj;7x&mN6ircZZzNwIYInJsleeli`6&;V<*I&# z<`WQ5er=5qw1IOxp?2keI4q0bbX&315Lq~X{W*t{$@nd*FjwMIQk7Cxkgy$KjJw&_ zBr)pxGs?@#K+Hf*i^ZFI1U;s1=&Pi^m0aZRklF)Cd=}c>kn4U&>-Fc?YV)9;-OzP{ z=-NFMPBisJHn=u&5)X|sOZe`*w~3IyaBG8KJhd>XOU^e1LFMssEV_3B9k{ z3H)*dn1u-zV@0TX3e4e{#wX$#H49rfi0U=)`@ZwFv8bSldah-z(631UmEY`v@q+?0 zc4CJ`s-zfg6YH1b&QLa~`wDv)p)sUM%Cj)uXXA}fdkVp7i<$UDPHo zYFokDJ|U#Cq81;|;%i4XP@^i=rbeU0mUcakjpvI2WSU513}TRRP_~OaQ47IQA2PY`$%J zj_`sHWT0*BtwaY%stzT)g)%LFGkY`e6o$_d{0Z<+h1W5~=fuCnCLNi@0CZia!_c}{ zMJ(m+nx}qyVpKSCJOMD9vZX1^!Lb!`i-89f?WKRhfc(6_G#T_e4-p6rvd6IOu;U`{ zFt|f(G&OjRo|8QkY;$jS5vOHj4Xa~@~mRlu3e#3qhc0oDEIJf&)fw{PVcX=)i zfWKo{>=s|$u{NdM$xM+G1cPJFw*w%)l;NWbF`psSo0gg9nJ;*htFcONdhw-)$MmOd@C3Js}HH0QyWh78l zfO)(D?Ta4X1I+``&jWVX`e!64S~#FpYG;(#2&Ew1acv7MWUuIA4kN98oA$LXtj#qZ z)4>@Dtl-S+E+`^{TkP6&z7%4yvXoLDNPNyo<7DA?UX{-T&(0Ud174l@+!w|ju0Kh&T?G1J!d3MYk6vpe>%|o^RT=qwXW+o zUvN{jrGMbiIL#%w@FE*b-!XvEWNVHk51AZS!LC(;t;t_5 zo|cHOUo^=|NCw`U40NQToC3a%_WS-!c62_n)P;5jd5l19tgY{EMZ|$z`b(_ z8&_))Pvy zx*%tA-9v(WrF8giJAq5%nFY-n6qUr2vl5lFlgF#je{t}1FAx;j`$YK#s`Gl5jjZbq zQ=2*IQA*p=-(vrGOBz%wAvVJAmK3bm9`nqZ@^7A;5$*zG|bCKYEmpWa^1YF^PtVC zx$Z^xqiH;Ycw+AV7E`?TN?cd)ZV8=nju!!b=Kwnf+Zn0#zkUwh%OK1PMm`O@ zS!D~k<_S1y30!^ahGCHS;iMSiI3KhY$xyz7kH>O)U(@~?bh82)7@+CDR0+Q&hsRe} z_f}hPy(LFs3QyGkSu(6VIyB$F)$%4H?jHI56*@hx{aG@7fk=gdVitb8;-};7go^sH z@n6``>NCg5MDWlKSek(zov?5WqUQl|9Kvz9aB=B5;>AOLVQ$WO~0M-<#gsAoaI; zmzJ_T_o3&M{q@T+sm{`VmqDGw)(SuK3t4?XyQuMt(AdkYu0a%Zg|al zho=^I(nxo?@XzKxu(wAQhrs>kna}>!kUJz8E5)EXar8jCYlG-SS-RH155E&e!m0^SfYvLNP8bVf4Y0eW($=BwrH51 z`#(2Tc(kjTJk6c14HK|j4R=iqMv>cqLEk7M?W?UV@S`;-v*EmVA3zJ{(mvd%>`oi= zD(L>6HQ4`l%`AmmY`=nqJ`2V30}{IC6VEwJ@5kQ;y^kFr(`uX|dI{UY_lDDg$4fsf zgqGsVh^PUpl+K=QPZ36r4vf{}LVEfi{%9LC=X`at@3^Qq?A~vg#fx+J5K((wthwzS z$MrqgU(y9uX}6x~=9JCcBm30owp;Ho8a*_M`Da`^3e`o+P{M(N-|r!{<-6}lJ@{FD zWm;nSBCtwEG{@Oq=$HDh8YX>cQH%3QIVQ0}^-Pe-X*BZ0vtW?@w(ByyRSbB~Q)63ldf{FJn<$dmivt&snlQWV*Vj9qkvI7m@OpHLqK! z=O-|Jw3Lm~(^5=$MDXu3|Me3>N(>g9L}GTI`a@TgOsE>kt^nELZJFQL zDtL$_+oaLSLe6*jR)PO$%ot|8)o6~6tCZ^UFYT)DakT_07qFXV-j3@VQL#Pl9b8Yz zMgAE{xmGY~)FUF@l(i!u#^EWchIPTuFzn|U09G$oOtNjFC6Bq_py1Q>1*?TFPb8cz z#vYU}{N0+m3Mpdwk?nGB(`L3+K*Z)V|^Co%EX!2W(L>1-TXgaH$A?00Y{n}$`Xsl z&)62v`|=jQ-Ou6T8m8#BTC06_mvtur0k_)St12xzJNVg(S;~l8hNG|Gr7u3xJ4$+K4bZX*%zdl- z(^MG|@j1P@Gic9%ayz+RdkK8=?a?b_L%i5F8EWqVI-(P6Ef5p;UZ7WV9H0|p5m!k4 z_|x9!cEafuYxcL1PRO8^VU%Nl^kBwG#|mu(Ym?P!V3`*qpEo^Iw!fc$4&Vv@sA_V? zd9hKoN$=2F?{)3<&ssu{?n`GsITO2V2r&YAC|n=o)@N0`gm=zqtbg4eRtkl0`7M|q zeaj8n`=3XH9y*Na6CppM{1HapyXY8-?hyhrKw}%E|4qpe*u`-QyZ}gK2t|;X%sG`)+Y5 zy-MGr8c879cK$*u_S8@pDZHXix7n;iP~Uj{3s@0u4|z_&;ei<_9{a7#+dCmy7xZ)= z?{$pLwNZ)NOv`ed(Ie{r-M>UR)9etNqG6={u_t{}Swn_uL}3H_{lS zrCai9m#`FbE0*ZP)Ul9r$A+70B7qBMOc=2$*XLn^K6-H_iyvWF0n9zur1iQ_i)Vjt zA61vyeb5N4!o>hbckM5|?M;&k(@2jF#-W(q6anA6fpNrN z{UP?RC%uA4XrmKZ#Og^3CdwI~tw5S`bQ`s9cguw*;W0z$tAHko7z(fB6>Fp*7QNH6kc#kRxib`|1AEchYcD2#KwWB?6kV=YSz8@HDZgWl&JDSXfz2$uLLCyQ88V< z)~j}`b$5Qfis}{hCpFLg?`4DfTBjq2+IP*)ZnEHXy}0CFSA4APGcG_b8A5c9ioo_t z;PdMYNT337OW7y|1y- zc9-^ZNwE#J#NCdY<7w?(2k|JY%2rF8R+x^G>m6Lv*?x(>S8O)FKxfU9QXUX7(l~Ye zGpcw|yHafx#@r-WQLV^x=~}8$lG9S&C4O_9=E}V2IBmycc+kX^fn3>?Ts-(goJqg7 z@o?cwUbwq)gL^0XC9HHZ@0V~XQ;UdDLo8jtT@)tHm>ElOQ^a&+7t#&!J^z*2RaM|= zrE$~N%JXFV!LosD72UA@Vv*6wzM|(J>0g}Nh8O2Ff&^F1Wvh*KaEa+IEuQvCUY8`7 zxJX&50v`VekG$XFT`dJNexhG2esN~#%IGYR7!s+x<8v#%9(h?7T594d=`tdDB>#Vl zA{|v=M_-YVpNDGz)8fvqT2ZfftPVy@N@4<7#4ak;`44K2b@xxJ@lli+VhsVHNWMN) zQp(+Bxy94f4WVY+M-iq=*0&*Y1Kp*Ix-zwgeN6TeIEw7D;5UTPt0L?MSN;}6hF5zB zX%B|(_#)g?y+>c+ud~zk$`-2Qa^k_9$Pl&osx+0>W3yt+K;q7Y~qGv!l5J6pLtCLumO z>=u{O5YyAgH8qM!lDs?9SWV-RCr@`K(^C0M`5{RvR{fs)D4^B?S>TT;W7i- zX7@XRe+VmVYPqEoWfPi0i;dvx+DA;D0v^K?PVos9fcAA7GwgsJr8j&q7rNq7U8+C9 z&@i?B?e$1_vc>z2UHVEg+}vz zv0S!gazG5E_#|ZC2 zrNW8n&#?T7AuMEo4=3AQ+#qc8hkXdwDr|XRX(GftBOj->_qK zx`&kS+hgb@lzZD)71D^#+3?QsQC!a`-{qD$exLX9fA(jm>%$tA&s4g~h7V#w&b#0@ z%li3lU*a;0oR#N}%;C*!+CXJ9D`%k;#zJ-X-@;oi4ujK`#q zXz=%5FpRixbkBgTJt-v^GURasGV?u(0KKn^g-upv;GF@s$;DTQ_m&Y}13{3W?Ryh@BtY>5|iM_6-?D!3`KMj(22 z)Id1QUwNjp9qg&lau;_*;fa5=8YIu*qqFF}W~%QQz2>0uoTO(MrkzT2p)b-GCy>db z(NQw)m2@P(Q0Ut3*8V!o^r;^cSBfx+8LPkZY$42(D%Zaq50v8>5bu@;BZh+7BL|Ce z=M;K`5n72!%kePD1nt+Q@=2h>4>n7eG+Z|FWNUnP`fNXjV5M7+slMRxC8gDm4UoE5thTH zymbqseb=mR!@g@W&Vl2VrujOX$^Llot$|UBWD-+@QmN4_T`UdKjUC)KPTJ0uQaw_g zzp9|ye!rk(KvM;Rsw1#daNO-w73HDeguq8Vor!HU+W+2YwUcH!|G8z0z;L?tChB!W zb5^TLuh-*{OFB+irJ(Mh88O}f+0b~`_-dZg-wS%E6MKpi%J!ei z7WG;3*ca%Sb{LahS@tsO`pJTEB>J28mYjcR`b*;8M5Uo;E28irYnIp-v^=q=%h$~f z1mDZYss2JiX@D4j}Y4?H>SCg_fH+ zLfhbDlw4KUez;l<{&Z%e%8$!oll?x3fNRbr5U{EJ+*?_E1yir@$=h%^V!1Hnt0Jb}1V2`@Qr)hZ3Ej=#ic~nI9VYX4@ z4bsB*(FPH3c=S@_-QfGAj?<^Jn$+X%o=+_OG5b4?pbi9(Mi5|)yxv_3X-c#GfQz(t zsIxnlrGX9tD;oOz?jTUHeH!6<{%fIJaZzY&0!nZmluXF0rE!1&qx)5JMcs?rSQB3T zWaaOuY7b&+2BkQW6$v(^&2FJ6f3e=7L}{V5mn_XZHn~5|MmQF0AhWgk4s^Ef5JJun z<(;XPD=@nNup#hnB4aNma5A_kHiY&8SqdE9N9FGKnvG%(m;&)f6gLR)&&68LzXB@( zM@&7JJqVuUc#UrI0g==ho;<@2D^M*;a}iMHx*XtN#hXIOxVPv-OYK=YW>F93fF@YHX;F3Gwv-r!p{I<Iq~cK}b!M!S{t)z^hMKlM#=k<5Gni@j~gg z!yBlcP;xOee>t2O`UF?>puAE{%)Rn#8af^JWegmQT;(oY{WcWhG#pL`-~=Bu+Fc87 z;@rjfj*T2IrWmfaiKyhjDUNFgx67Ye*mV0DG@RD{f%oqBm4fq+&B_me;OxNe?mqDH zHXQo6%iN`(H#@C%2CMPtFypHad)tl+kKf@uOi+}3)P%6TUd;IMMv~CHq2+bH8i=*1 zgASHJ<351Znb0wPy~x@seE*yq+$nH@eM754f8M+D?a2Q~$a(CoY>hPmfvz%LINXc< zN&@7aE8w(I#0c|(5bdx9t3Wh{%!tjktMqnnPQ*+tNc2=l6R9qVSnE00wO}a0MB+yV zr~akQBE_CL9%a&OnC?amW+~8*Z)}Jx2!h#id&1Ss@%dceD#xhBF(uv>f_TJjwqp5Y z&TJ(E=iFa+x%+W>s_HW-yZmBO6S?87MMse1YW3ufIlvggBnNNT6$gmBp<@VF-pW}{RMC+al?#fgS)3kG|Y7rTjTeF+lOzQMuS<;1Fp)yMLFU$G&xuQ%4 z^|f6V-*`D1EV{!yucV3_V_|YbN;dhk2-+_Sm$+_1o3iS~zuyfH1Wj&gBO}W66;< zj)bfS=`SoZD7|WQLNl=}nS368H^(}yp5K}CjdZwmxJ*uym%7hlsWvOT#GGds&r8M8JjKN3pu6TUrMXiuOynS*Qm++PCwE_Lr0v?-yvt+Lua$Q!2;tC0o5z ztFrV1*+t+)``sN2Xy)~%{RL~bSxQIer=gF^Rl{<9eA#lwHX4Ta4LOpYAI}Zbe-7#X zbEdggl>~Q)pv+@C(E;sMw`;JUH$$3`h!chr)%Z7WE^61U4*GP)`IaI&>OA!5TYHh^ z1rZhFZzK`_c*o~xy5h@F)32GMZvOjI8ei3$(X=eInD*kk5GmlXz|459g}(HT!#k}!9sv*tibK#)rli23%Oc6_68%yO69H zfTW9*7s`%$5kE%+UyAn6l>EkudJo4Ad3RpUShN*2!EYl@;m7)fWt=2h zq;x0vR+Lk%n@hqu27n9J#@{5=wC7M>OKNtTb-cWRI|8Ko-52jp?#m+cSyQ3|;B(@= zY5P2aB^0kW2x-D|H&PeJSe1_^o?7%@f<4*q}%9=I~l>g&m)R)b1E zfCiSY6C_cm{_}dtR-(^Q{+dH3IJOri=f-x9*n$KLx@g+Q0)(37$*)syd|O1Ef)oG7 zrZaMVx;S`2nL79m$Q`UwjXaf4{`vr7Fv9iz*NB+ceThEi)ehL)mBr!{rE+>>NJlN- zq4@iFXZvEwiIa;PUPTBGMD4C;-yARQB@W3t?quEb?mS$dm{ox|K~s~C-v8*^F3F!F zG~j)xS2b>PQ90b6q-&NpNyOPYQrg~qq=iZVC1)y^_a1H!t=4Jt=+|}s-6J(ea8V+Y zca)Kjy-U!74gf3q@SLNcY=xi@mz}2ZE{NB;;*OCe?aED{;dolvhMr}{?NG5}u%WlP zoYEGMK~+9~a6+y5x0s*%p}G4$!vd99A_iF9S2d5$xU&8EdXN|K{4@Mn#4P~sJO{C( z$R9u@uF;{sg^1G3S#qTwL?iW!h|=WReRR_K`3AWo{A5&&?;k73djkcF0ju$8snq&d zum;abaiGIH0-cP*zBGO|d%O)7FhQpg9RK#w6?s7n(T-IFb|r&t6B{|$T={7if_+fp)(5+;?g7Y{_S$Umjn zTERGfTBnf<_1oYG7F$5cODM0VC6V~&_x(QA=O4%-F1?aF?42tqh|G*9gV(XNI-_Zk z-dkwSHoTKiJmDS(Kvu|LoHL{_hS7x^Nq=JT$6MPK2lQUHum9uc@66SQ$vo3#{d+$H zpRX?2iq%$J;<#59qJN@rVgp0r_AVWNd%okq(#8u`pjb^_8No#Vr>enw1w&SE@MK9r z192Mz=GQeAAW1U|B~9oF_W!Qf$@SRW_r_oyUA)QJr%<7l2mH2Or|sV!^_RcmcX%w1 zcHtV;Y;r942;4qIO2W3HHpRG}Gw+8-m6Z9$kTyY_*@9z^TU^2+79^3t+%>B+kZ{&{ zBsquupJ`y%09{2w^L<@xkVG!=1T3Dc*q^U)_Vtp*Kr9|72y{bTm{di3hZop2MwCW& zBVxo`?N;8fgR*ehW{JMW4i!E65mF!7%#7_*;Q8SXqJn_m4Ejr_Ak`dBxEIg5BXW;q zkm=pgY)RB`govLz9+{HCWAb~Q`5sv1hli4!oeYwUGKTafvX!DLK`+bfGsi!w>L!#y ziF(01$BT8<{{_uJGQTk}Lk43G(Ze9vUSkO!piO5re_~9he=r32@q!#-zTBC#OKX@` znmdwhhXDp-`Wpi?{Xp`c$S90r&uP7g3}tR-o_lW8FncccPmBV;L<;<5fMo_Ei@Ut} z3!1|9&DVi)ge5xrq%B7p%z(>)zl583`FH;$kKJLiBp$bW2wNNUnoLNPfg(dVi{WEl zbB7P^mJs;XLP2<8a6^DF;UiG`c%Jve>D;-~u4DPWTBH`!Rt-FUbDKayQ7o^4j&LW+rbt$Oa?)Ixea7xz9w&rPpt1)r*CWWBBTcZ@z)ZzMHKP^4Lo2h87VMpR_P5E7GEN>lVgT{oySGj0!yAc&@V$89oWgt*6WIH-Jekk96^rNC z;W#74{#u^a6|IaL0_)v(x$K!#Jp%~M*0`gG_RFifr6%YCRv%v{>gN;Q&q(8MMZ?sy zDMsr_6W(<_`wdk*?EkLNAQugIzI-wD9@_dmey*SN4+;wOpl_K>=#R&lZr%A>3j1AG zyhs6+@#uM9yK!4!L=bzNdcuc!^X7KN3P(TO#JAp~U@Q!~syU$y< z)ix;v#fubt966YeIJa+Ha$rR6G zMT=OuD8@cK1n*agt7HH->mBOh*8zTRp{*!ncm{Kg-+&2tu=#{X4jxx41yBPZ;6dc` z3Db-B$pRVgPVZ=fXMz0~(=dUl1SBzigic^aMyjX8T0FNwkl5`6KZTe{B0DMln1P&`#%l z$OsWF!Efu=Z_dao{0#XQ5Xg?_Ey$c2Jnypeajk#6x1o85#Jj% zs_$NWVYJ=z|1e%XZ@@$JEorX8A>egZBOzYi;R2{i6f=5YVDQPneF5YF4+mS=FN@A7 z{|4--vjL-_1Ar%hFbQv5fFJ-Ecsrarb!?|{6edG+HMAy%HQVMHPv^xm09hnFxdE>S z2($q_C1eMHD(_sDVSt#h=mhWx0Bf{_cjUVD8*EGgFn1Ry3Xnp~RlJXpYo4zFTADV_ zlnr*2pWO!(0hFST;16~`kQigumjU)+*Ze<# zOv}V$fF-*{@6H|DTif%=;l=9?cr*gcKxd34n>KGVy0LQt5ESoyKtsm0@wMuU9N-;* zBgQTXZ^cqF0z^x+v3u9f_Lm}F03ZkOgAY9~!S}Rxu%w{5cs@#ViOyq@R3j4 zAJDJ28G7FTXo3O9gj69sl!58$Q`XUxkDeGU0k)4BH9RB6{v?6x>m(QP{QheCY}Z0^ zpS*BDVxFT9eEj?Z(l_aUj0M!!d%FXUBX2OKB9jjuJY>cqWEdbU@q(%6I)R)sXV0?` zHBA~dH2#YWg#n;S|M`B07cm-Oz?mTrY3g_V`c2hM;SrSJ!-53^`G#jc#wtAf8K2PW zyo_+@?kiTUvELXWnD_1o1Z6G_^2lTI>ucq?ML<6D9{oee3xHP)f#G?Ha!7uj_jTnR zWI?LrIALuta`GP6SYKq9@UZ3&dgDoqS1{ux{0_X%P9fUj%Ok(=cQ2b*Paucb@d6FX zlnz1{(NByo60ER1QL#+3r+Btx6-1i4`ETkO;%=Q?s*tvo{V=S;9 zYb3Cl@yB>WQZNtk4#}6pcdq5uUz&`KSF~n=e!&?1*2Pz;%p^rAV_bXxIQ*R(}D^HxSUumI#!*(;CS2K3^IOJX5%V9!o@ET_6* z&%ffPeg2Vv+Zz^Bxmu0d7CNFwzh~Uj6%}*%>SdSMs=YgY?658J!gYxD9k95p;xDt1 ztE+FcY$)e1$mW6)0Rh5BQyO`hToEi`ws# zAMY&NaKI%UOmTP8l`lMt5-OK=Bl|SFZQxWu1VH=7=PO;O z<~7{OGnd@%LuXu3)t|Z-FIvz&*RQ!daO|9$v23Rs-Yd~Hts7@$%w4(L0O#jbFQ1O5 zTy*bFS?lV=mv>_awG0*#%KyzTR@uVuHzPZ^63X*Y69E3iIh$S6dX-(PhE*RmyV(0N z3j8D~z;;L!MgS%j?QA1FB~LiEN24^bwUk)7fC)XjcQ!=>k0k(Qwn?*a_lY$Ch994h zE&TaJEZeVU%#vbI*y3KIXkZWoY{e@JAPeOLr3%^IN}hZGPbiKg6se(u0`F*_Cu=L`z^rp;RnkV1LcCZ!)QN)$!f zN&9%8Pm=%bzoU#nE4DGy27oP;N6Nqp2k$7h)&es6cTi?YC{e5!;@Q%@bC<$()RLFi z9qR{_bo#@W%kwCl00OiRk3&2qKOFz5#S7*+yq5s~03PrVB!%C%?<(-uoZ+ZG38D)VCy++B0RZBDChJU;M>lfd(;la78W=|EMEYr z&Yj!abN(OJM}T4gJS6Dqm3dn`={H~|39t*|01^NsbQ4fT+W^Y}^Pq7!4khmZ+CiIX zGiJNKy?PiAaA*`>#(1v+1bN;xTBNgSxIXYQaj#k99u+8z=N#(|91*UmY&_toE8z`L ze4lzsnNV*j)_}eAH|s}G27l*1E@`p|Z~qX7XJ zbG~l0#q$W?@e<=X5>*EL3G*b^X%7Ga+p3=*Jwl*gY1@9!b?S?v4{tJtIY^eJ2UsVG1<&*7Pi=QcFw z&+{zrLO(pNi%C`jSoP}B#rO>a0{M~1)AubpPZRCrV2eI7xT=6l#_=^dm|&~`R3T0` zKo=l5-tq0)wluG1!VAzwfFD4qaH1^0J+_4dsN$6k&mqeIsPTODKq~x>$8p2@^$h62 z0ANOn^!9t&@k#qI4g#WKu z*X|hFUsU&yIq*6mdyuKjZLA?!OJGESrpOJvzA-9L$8f#K8{VUj=tI^~><}WX6><$8 zBAgNH1b(xFf}Jwt>3M_x0L(=u-P0ecCp%C|N&es^PJS4(r~?Kp3_1-YKWGQC9$7|z zu%?NZ;g>Km?0})(@Dm|GFt+1W9Iu@U^bup2Nxo%^=JJfrssm%p!x?~jQ6_xm6M3@M zA;GVB@H5{rX8qU�DIv-h7X?qt53S`;1ZG=SqPe9as)LJM*{-)tU+nz3$HM-(Udm z*YdP2TB@SEekmoxIu}V~1~v!x5f8Xs=bk1k*pj(m_7n>@!J&B!cCKAg=nB3Qz9KD6 zi;>gGb~xVX7k}%{%d0k@7R4M=ho>&yxoiQvt7nfM-tT%SJ}_Rm97M;2ep|}oM{obT z8#d+@_nUwGKMh#UFHh?Qv%YlOwLM|hT1_;GT3RN*=#EXjG{NFTzT+;%t zxLdnok=wO%iR)UF_iTjLjQ~LZ`px-rxa>r>??n#wxpU;2K~NM zS!ERW`ni{W?@E>`;|NW%e&rIySRUeP)UI!Bh5q|??J!zq)az&d1tk%W6HA)V*_s9j zfn^!Rhd#j5>QU3#3s>FA6ooJ;SKMved(zcQ2;%o$yKzUrCkF<|qa^LRt5&IuVvyz2 zVp9tWDPy;^P`-5armG%T+7&9032soIUhV6;?rrP18B2GX2kw}DE!6i<8IXEZ;4$N- zn%>K=g>yKu7$}fGj~h3*l`C1ipj*G=xLYESxSK!ZmkXU~i@JCDgWL*Qi!SD;uxiJ9_t~+HmFSEo(!;0$Mc5^BAS^ zn!Jf=XF}yNSv-0xl`rlplz~pk8Nl+M!)Nr)x1!tA?!bw2u0hQTZgAH|=Gi=c`UbaV z+hJF>WKnHv`o_%>m|RJ8E?2s!^&{;KCv~kU!AFuWxKn4ZxGEJ&8YoS@ytg;cq+Yt_ zPM^Ch8WnPJC+5Z7isebHQx@YWc!VqX@Z--+DZuzSuwQQjHBb_KN=T^YmabT3iWDAED4w}> zc%M%w_<&S^t^gu{8UR+rO=Qa{u_vDyI?xpN9y$P!n8JA30g~Ze3=qc{3@4NfyrNL% z@Rq~-3%~}`Hn!dKs~NKeerbLe?YyFyP(9wZ z_yXhr$U;}PhVuSD7RfC}Ctm1hAEi2F*s#Wvd3j6zma^g{t{p;)pUK!uXZ zd(@xs4FENtC{`qKqItfUc4<*>l=8>~z`20pM=p7gO9n{^7UQACv=dHg?QNwQHsTnGdCOYdf~`87$BekP;Bw^Ahou z@sh)19?)RcocRVK5lB?j;hu*WkPA^K|!!54cq)(9KHGmJA1GKA+yD9PkMTd^eJ1>#2kSz$?-w-~2{ z4gt8ksr5FAHo;%?eLL~e^qI3YZYmm$2$um6hqpFc)=}~?P~asDV2&pl_xtthWnOf6 zWde+JXy4jEX1v^{$ZHKRT6loa4V35UXcb8R2XF)sCXe!KCU4A1UrsYQ0&vRs!z&lr z!CIX7?EsS~{QztLs*Jmj6@!!U<ym0dO#L)_nK(fA~$tSb$DrpC9F>(a-WmC2zuG z3?3wK8h*7t4Ax$Zt&|z(-1{GDY-()PuUp5(tDlM#Eo`xH$4~g&p7+2tc|&jFs-|cR z&ozwze#dRmS$iYxts#&3iAb#2@rtDphf?x8y#pC69@L~Y7zu~s>F z7GRtH8LH4s#L6c&Ir4{45hcZ|#AQX!@GgKLVIGbj|IG9{WEXWdPfXPSV4e^_oCQET zn5%dOPjt5MW5}c(?Ajsh3H;#sMz7oV?BpJ8=Ur$Az(<@|LMb3W{M-Oo%G`ocV4waN z&(w*~G^I;-FnRs4`iz8^Fm<920lbkTK4Hw6t{nqQm#;LBR%9rlSCE|mkdwuGMT!&( z!hLA0BI_9AgcKoM5WGgckeh^+!1#lK15aqKv)cgA=RJzYOqd8_j5E)(`w2ba&fPoa zLC?5Ub8YM)Q=w<`#HKO?CuWhw$XMuxA&&C{h<9F4I02rn$QfiO;Z=w?jXVGtM%G|_ z;XVhoGM9by@kFa5YX(A6(03Cxm$5s9@s3tbr$xsjL~G6^V8;wipY2dUdy$#;o7yKgP7C3VFS+ zk-_Y`bgFMHY)b$_=hqr(y5w0wld*u?7(PqN`OnjZJm~A18Z#J?2qy!N+I7_pUO?9- z-ZOwd{A_Yp{Y4&}J%AD8J;_|kp|1!<(_ONRbpo=OaYO$xC$hFtgREWtAM4)|#cci6 ztZ5S)kNzG;+4-U|ai0O#OO`Bd`C-tRsBzC6#oXGzPcM_D#Qy%n-~Ek^SD#1hGe&`5 z0tIq4Yu1eQ=@Urun#hySRjt#`ojJC{-M9*{8!0&D!ID?;&U8Rusq)p`>BF*;$xE5= z7Zs{$(CXUdbI0YqtZf()LeUb|BZML#CLrD=0k%w3wpfr*!28)2n-SlA_zA*6u%Nt_ zb|p*pOtkzVz>6!UGGHj)B9@n)48U3`RT6ypzZeB7xNvubI?yfO~{qh~$UJT0WWI zSo~jq{dL!?SFguX03IisH*K*=xQvu9w#3pl+K6`-hk7v4v}oQ;^nJ88FIcnJ9XXlm zy0@wAzL>w&z4~lBS6;y9+HFS-)CH_1)C1|Ip>14}Je!woJm@Ow`V|3^l>dUfYomG6 zPFc9!z}lCFw6Rb2WSL({Zqc}TMuO}%_webd%mxN_aiTfN7XDpuIq*1Ucd z^Xh(U(rQz(3Tcsk_ClI#)u^iL(z2F$JL4roc#X5EX|8Qzb$kB(sq0*#yr&7*@%h}% z0;o#}wAT&|Dcipu-rnjqe#QoCJ0}z;pS|pcbZeC1aqa6I`~3M(0FRNdN5q3_E)k=J zb`euj9`x+vx_|lV4Kp|uj4)PxpZxJELBWbl$W9MJGWU`29K&l6um)Mn982=|`3^V) zh`>A*c^~f>l;06LXbS)UaO5vaRzBQdib0ff0(Wqk*>~ zU^OS(*Q!|~Wmv<;88aNYc~ z^ckS5c`-(*2lsh4Oe=mgv&zzObKQ&j=-1UvyKB=HW( z=K)W^gLqcsE$S0MvzGz>TC~r|{NOJVZSeJ={(Ofnlw~v!VB!;fOdX*){memi>?r6V zBS|!w#khr+Fdq3eUr-O${ytZQg;7}m&>78AJ4g_ps$2?Z=oy{Bi)X$anee+vxKOe}?bdSk&Cg7^S|X@O|VC zdLD+KaGuniaX{Tj%U7;;3Dx5T?8n(}{vjXwmQTHGpuE2ceUM?u9ZzfSMH>t3a=>T; zI7mpJ<%(JR>MP?i_{z_BnKF#pOAFGqDg}>`Z@LO9K z346iec$7z8fV@5d(5gE63)&Xc?XH2el)>{iG|Av;%rjggA+Vz*CT7{>?0Ep?04NR? zPgy~HLWATn4`sk-^7UcSuGO%upXo339=(}E}PPF1aSKe%^A@s$AyeEp); z?dNulczL#cSdFX}AD>Zu`UD_h!^Tavh(U1=Pi7ep=I{$%$AqjP)I`myllpPv5w=1gru!QyoCXX5>;SKSRAn(@i3O+!RvB2kbZt?m9kRWP;287GlBmjHY zq00#;6wUDtS?af!zr9s_&d*dz|KF(=$AQ-+E&M*8uyZVrK*gK!RvTJ)dzi^q+)?Yju_H^X= z$oIo_0>n~qxNx@jd=I}L*>*oXT`Kd;==F0Mt6Ew0)4Ob6NdO=3$o<1;MtxE|Ryu95t8 z!X@C9h-WQv$$QFM((|i-hUeLZFjd~3Z1?xPPXBTU8xAaZ>P05Nw0!vPE^2 z!V5)S+|9>sytFP z!q>xf@nr#^c@WKC<1@1Tk?%(S4!_Iy@cqcK70UC7-!0ucbR~=l;{KOA7&|B5WZ6 zj)0};dVrYMZrrj^2zc0*$2p~OUX_9$YcT~J%;v8qRP2RRw71{!z8P9BZ27sC|&LMfFiU)0jwn2Png?&)@ zcwt|cS9CaWpRgA@_9q*VO*o49ilyxlfM0;?mWo?U9jQBYJ96@Z#^blHe3_zdP}hcT zvOKu~#Ql5W{4ppHCS-kb+YBVkt&}7zOU70N@#3 zd0|kBxohO`q4z%gn65-BQjaOyST;W~3WRy;Cswssbsi%HJUIIpv%GIsT@?!9`y}Fq zzBqQY?eHM%NOnLthsXWRt1o5&E&*;v3>*A?ihbZataoBE@quLeSw8Tj`xb*R-q3id z1AbCoEZv_1-rM>9PsQ&3P!x!*6MiU4$IAIJDDVVem8j&;^d?zp! zkL0uq$u2GRq$?X&&lM_BR$GXu)^`>f!%&mImWe|^S1kSfDB!m>VH}8-*j|P=`J*g= z@B-Mp`-B5*1PtbPafNgsWCJmN^XAb(kBYy1Tyc%@@a5V-#X3$CK%0`PxXfoR$t(A3 z^TusdtCDLHldMXYx9?N|@*0X2!98NJHv$4WjcrcV3 z6%>~kkLIRz;w)qXVIhcBeEM9P09(okyp#zsL82`aW^N3%O<_|6x~|%KSRTITW!24X zUd4oW06;yVwg3j7lc(+}c_8D3Oqh=|3LVjwf^2 z19X>Fd}2aOgcJ1vwB>#S0mZzxP+refD`bt4t;cMeH()n$rS~5_=bEU^Q1BbwBt9YD z&j8kK~JgwQq@tt{5V*uEcbix2)X!y0B*{={AeBY3COaO5ng}2~T@8GZq z%7lh|QVzTaUsV-Y&LND17y(?rsPH3?!f#=E#JU_@jXwSKJD7JZkYvC_Ib0#bN%{F7Pr%TKyi<)k1KW983&+6dR_W=v-{*Q z7(8f@d7HOvS3KaRCNpO#u55l8kcm@SzFaxm=AK<1Kh^8UPn@)EzQlU`Ardi1i8Tp- zv{lSU47u5P5ay&lzHgqC*HF@~JqCQ#NT?RII<{q-?fy}W@csp2c&=KrPIJ-M7K^i= z;xhuM%vapdMxuNDD70s8A@s_*^XKiLq63GHxYgocjVgI%6;r(Bt_JF@Uc15K2jhAA zsA>I%P4fOPYk*I*yoiU&L36~M^@&5FILL{^w4x>2K_6iVVk`01Z96UQG1q4)qyuqw zi9t$iX%6nnX<{2TeU5k8R>k4vz&;M7d)UOGVe=O*Hm3o2GErWd95fcq3FLlx(?&et zvh(J=-@E>vtuf`j8R>D(ed?2)hn;_)XQFw-`ultmKm5zd)9pY*Pj3#AJw^7tn9d*#ZNY-dcga-&^?R|z?Qha06@yy*S?hxtSfZQQg?JSdM-tvQHCU$#u(eB$%rP+oRMvjdg!N?hv83VU=wywb8o zuzS!yd%sUYAZ*Y%4#ZmaJF#ZZSzuv|`YIke30Y5=7-BT%q>c0+d_tW#T<%MS&EYHn z&W!k4yHq)3GaT#se)Z!Xc_Gh<>m8mO;p=59*66H;);XGY*`d2>^EP=(w~Z5w_3qg{OT1$0LCBLG3g6L1hwVNNU50Znh}DlLAUjZqtxU}SCy|)%sB=!o0Cix_ zh8K+y#rM>c^Fg|I?ab}Rp3of^i_eG=j)A6M-ySxfMk|PLJG194&~Ew*7DBaY@c@TEMkeG42ft!u`>CaS_Z~df8p;dr z<~4Wu{Bd_B^6%U+1C)ap$ns>>!Y1uvvYtC3&*cN|#J)9pSEnN*?PDoMfuA4+5J+qx zWIL8E_Qb14kDsuEIyhmO_{s+l9hN$m%azcg^4$4UJIxz`{;=t?yo@=-j=01fbdVcf zzP;Mjb#8m#9R?`Zmj`dORHBFu$dE@b ziBJrHs^m3w(Kdmvm0e>2(&0oLU=Frp4h$y_vFp*MjzUQ6cc0GL>{bgP1~3I|E?ZJD zzaqx;Wr4yRKA73I1Z!LU>J{9Hl#2%PYK`RPDx}8rB}oQY*Qr+C09N4DS<83nFG=8S zHJ4E3-oxCHz{ne~Y{ zsf;tg1{5owxE?K`i4<`ZqrNqhbC;m>Gw z0&t3!!fgzHkM?Z1P2um+o<&)VOn@ssW%qu#AN;eCd2xC>3Uj}{y-YdZuyM10G|OkS zys|vN4^_$fMzJTuDYDG)y=dQ~mF3&Wflg-y?)nt@?7aDl-QK+i{B8RT_aXW0-o4K? zZrH#L=-1m~_HqCq074G|6Wey~G7ut52KvG7sKZi9dh75c4&s_QYo37={YAIp#f#bj zNAMUtO^U1+*8)Dw>^H96FCEgso9DH@38!$rsXCAkdaqcyCgTwd6Q@sOXw6LFci`O# zit!835$tvgb`LT}({v5s!-F$E2WS@NH?Dg*;GaP`H3eQ5Oo0tGlXtTlf4*PI2axqG z9ngny1G;wU)Ip%d7E{uFIpMbWYkWrLPyA#KrwpesAB3+*w$0x|#!XWwi^!DS^Wo>R zt7rHbz5@~+IC#jdUb8;q*7?*_t#glN{N~I3@}VB!X3xI;4zFwudgU;{&%T%YVk^NF4vrXPLA z!FGUtojSF1O?60O*dP*q*5?E0628v(Wp1_o_v(T95!}&+! z*>IlW@34P(EW$70bsf(}rF&?-gkg<2jZiMc17}W&G}?sA%q~x^hv^vkj{l9p8pAaP zjjC1S+-LB$jMmZ8tU2@CE$x7Yb{*Qa6^?O6d@B4yhbChHAcfoS^TjoU z4rNLdu>t0!@U5#CGWi3@-_c3?|u8+9YyRoeiIiP;Qr z?XQRP<~#A9NA+zUdD#u^5eV$a8_iX3{(K_z#EXhi9hr#P%t3`d4b>rlBo5YlSqJx# z5(<^EL;UCmJex_z7Xqd_HcxPMs|n}{H1H|>C(kj?<#h1AmB3I*s&C&z|V;Scn{W1_X^_#^eNM3+JYR<3as{Q&*pS` z4iLhdW0t&q*p{9wU`c` zO4B*FcmDyGPqAPJ_UmJZdD`e0ujr%}>+$i8?=guU_Jm(rWs&Af9 zD0l#X0Bd#Y)G|Y+U*xhrYL?hUGChx*K69RVD*?uH(m6DlK4Y#9I}JSE@WSF$`V9iV z&ZL~R>o;W(ZQQ7V@;_t;M?t&tn#)M6MdwJtcHiaFp?`bI-#8`hVh1L*}SQFg>Y&+3VLgKI5uur-wt0|xoWKe7M0^F z=`fqlrtHm}Jy*tnE1D;ByPi7Wrli2sWdfx*JPXe~yn(4C;D}e8=^OeKUf_EdfmP6K z;i6@(apMNoHtLBdFX6^^i?;OP=#kIr6#27mk?PNUQ%a}T59;5?bTGBQ=2~V9$apgoay#06vWsO6Uh~3SBQH?}j)&eLmr$k5i2-@H!47i!B_v7M% zJm<(G2#|oo(0Yp>%P6kykiq?ozWmc#@o#6&o@eV~#s+-KT0+HUNhng}&-Ul!>!)q} z(67YlrT!%P4G*5V^B0-NDbEgnc90o!R;WMriZ;wk4doHtRvtch^t5Z!%EsSZ@jsqe zcw%qbyj5Uzar3&S{lqWF+l~XZF}ic$+@Jw{Eid|(gAFTJjx)s`pv`+o0$9?&^l4eu zb%1ynUWGR)8&6ggPx4jts)UbzF`D0IJk8S-Tx-*Q#m!NFC}Z|31CC+q?Wz zvt|v|<6B$*ArBZg#3#lxu8P_W58Tptr;p){!2|mlptfi4J{vbKXbXnzuf5?JmR3I_+M`%Bw<)l>lSl zD-wOgt{QliF|$BB33~PDZ1qLfFJ8Lbj5~k;#%mgL@G87;=*Ur{1>+08TDE+pJE1Yd zoCFZfT(@QG4)OF67aw26=->~X2iymI)U+Uv|2h^w_o(I*o(J$mF4YxK5AR`!@kY3s zq8sxlUfYcAN|HT3A*%sZk+}dZfD+FR9q3BQDTekT`_W$-)Tg|*CjV$xisnN4rnO>b zw~(A?tav`!rm?m~@|ymruRaFYBi{uY(?^e=w4DNY{&LX$uHAdh@rHMy5k?1$%>a-K zmn?Jbw9{yn+D-d7vjA|bn&`sVLVg35<4sH3ng6LPa<7m0Fq$_$#%B8XwO7Vvcqp@T zf%Q4_*o;|oP4{7az?{dSt9bJ6J8;mv-|TIo+P^7Rh7Vl zoE_@8RQyg~F(;QTTiV9NRne0}8HWt&Z{_3>9pHu4tJk{&hYlO9TWjZ7y?S-*FjCfq zw@g;j&po2yUZ%7d*yThyMU!DHpj9DEpPx zmy8?Mm(Z!R3_Qp|c>cYe28Y!`i}K~m z%0TzD$pGquVV620dvKgXZq`@dVEAPX$D9ov`t|8)nEONerw;pwbmu#U)32Igsf}P zJkk1y!${dNkxy+z7L(vR)&$5U@W>X;n%G)){f5Ay0X{4yBfuPa-NR$_3m`p4k~3${ zNk%M}%)g=Ws5wIGnd{;S<^$H|7?Rl)@r?9@gK~B`rgeswd*qp0ZDcJ1|6_2V9>|^B z+OeIO*vMope;0B713zJ9;5evEre zz8+MjeCk`NTnY0)<{qFjiN1>~FC|?IJYqicJEsYdVYfn)Oq#dNE!AOzJrtW7fIF6A z6!^JN0J*t+XOeqUo`8RO>wWkBho9I&6_AR>yZ1Ced0|112LfOUi^g$dgE*p`5)YV* zXTsR$M%ep!VX#Of;W>=*2RPhQ+o50m)eBmz0tl{md02O7$RVTWDC7bP;!ES6vjrL8 z21?;V0Y=0IeMRq~2mm1AS+q}Ovgie*L}^>Uag)85P+eYO?b~Y0e?Bb~cUzu-!7TD> z)ktuM1R4OAv88;s7O>9=TpBZaxGmOE0PzS!d2cU;9ECEWdNl)60aO9@00gIgHOoLq z>Iz7KQipO^v{(`MD_u*JvNL6B0MG;ephP}9WT1gD`vlShC4 z-Sf{4cZUvgn5zs~V@8-VL?7^XTuLDdz?5k-Z1GAwS3n>7imj)BT+J08V2uE*Q}RxI ze)I_Q@PuwCA}dy{5%5#r{p!Ur3hPkE`U$WTAe}yC+ah^G+h$E0OQET2;Sf-M05MQz zeFAjB6KTZoAqFG?Z~~S9-~iZ>0IQ(^3OL(0*;dIsjR6D2gEDgoOh>6k`P+ZsaE2!i z{Q>O&w|DQ^tI#OT?fJ{~PadGZ70e6Y=9-O~mvC7Z%PND87vvq2xD?I`tm`C`FOyTR$qh8%w?)CqC z%l+>^zG2D+-ZCgkjEmZ}YbXZqC~MPE0kw>?tpcZ@;fQAk2VS`1KY(ae1G za}v)248n7i3!PE)P`bt`UqCT{R8pl171Z~=-6VM~!yk+@{!l(=$S?w!_QLa{tSpqW z<{Br|pFUFNrf4zt2sZ&JmY^|kP#_MT@#>j#JoD`zoeu+QrfQxh)8u!v>iB{ z=nC3{lAKTc`ig*zUOl>)!GbXYcupFneCkMfT`Qi!I94M;JJ2K};PIIX@zGv@2Yi4- z0stl8zp;%^Ka@D(zh zayxZsqZ~Z17L`FQQL?_a$wUl<$Pc!Av(0%7yej%5!zmN+c*L_qT(>SA%{T+EHk3@n zH~)12_V@f8BQuyQpPrcJHu5b;I;QKX3S%R z8>)5y=E7gLrq%itAZ_#3?V1yxaW9M+X>A68Vyv>WbDYLH;U17J$PYlPnwk^oGx!@B z313&QUe$H((AJEF@F+VtnDc2X02~SM3Hi)817yLF@aoGi*nA70M@xV|7-b^EUZC#) z+Tk5pPDWC~NSr)*O8KX_W~xs@wRo#HW$oE_&^*W4Ndiy5^ulun`T$ImFrbdr{0UgJ ze*I=Md~hAQ0p2p_1IPm|GhYTeBM(THh=#}#_~VtAUa+;yLK!YFngSTvt_`)5aSqM+ z1ZaY{-cX;u`OXK{w*XS?s@=P9zpW3L&*8<3>MQC2K+ZM#c&&hTc2V8Db<;IyP}kzK zljnSa$n-0TdMy;s0|47PNW6tX1sMZa%KT5?#>G{#c_n}T0w%}(m}E@^SPxJ~*a760 z>~UsvV9kcn10y@-vR-4(-Xu^L-h-D)Yb?Ms0D~C+Fm@G{5ylLYR>Q3SoRe2QvXt?} zoQEs}v_q~i7vf0dqURF>5uSSog3FzyQO#2HJV6AoS+6~K|d7rQ=BtXh_ z;v0B{KSFr`9wsI2Rp^l7Hcso;t82Sepg$p^nkP0jV+nE^V}DV}ZBKhXSwpgx!?29Z z^{G^;5(bF+-{H@G0!DWv?Q;M6zy9bx82_mm1h~%{9GQ!3U~L1fkkvC3(hh!NJTz)h z-%Xw}-R4B*B@DsHu&vv77%dh|647Uhgs&F()zy)fOMyIFMX`H!;M+o6wbc9GSaIe8*hH+6bcx#%knG zSnjdTZy>`^jhfZX_>o`w4{H@b=)r^fDrCwg$+=+t1dRwi#2okXi_a^}Uki=tr%dj$ zzGgj+!vOt)5#xtSnWnQJs>E11F$(-bD1epu^5shsR9^>z|Lz@AI#4{Y&LX%_;28Y3 zHBmEJ^G<0An#Y|Q*QwxK;tNF-MFE8tWze4*o=`nLW5LSel!Yt{NxZly6XiR9zWnCJfpwn+JW3~u44x)< z*RilekwhuMYjE21SymSm50;_v_ZKWwF#)7!u;Z(}B<2Pvw^4mFAw+!WUo)uo=aZcL7GY z#y01*8#WriN4aq|E17pU9;^UhczQoAr9KQ~Qimc%ikK2Y{du;E6h-?kWgHJQ+Cu(# z&9Lb99ua`PEPPRb004Q0zU(Lv0nbAIs#mLGU^C^gI6pEw1v}=BS$m9H0u0}j0ipD@r%bPp0+3) z1N-+j57vZg)vO+IaY5KDJeB}C=sQxP!2AOOts2&^XW%A%(n>%CYaEn8#uExG${LAr z8y6R6z#YHw0`lQS?r43~P+$e12F4JSeds`&%azk%z(y~HMd;Ah5rf?LOZ4|~&DkDI zdkUxyjLQJP3IIPqTZ}3I&-|gRVGII@+Nm;#ol4)s2S#^+HRMlz{P8{tA8~L=fS+6g zzyk22PmvXj1NsxAIXoUM0nU|?*E^vpC@=6(zGeV?AS3dbjKH8o*~m7OYLsC-(Wo@k%CXaeZQ z7@=(PXcnzOx`tK*V| zAcx@pwgMe8cvW)?eU0~Oo;-W3uG9@0!RG*ro>$5DfQ(%jSMVezVTdA6Ay zMDY@eFPb2l1acDDUm0G~d`_Yazt*Kq&>z{x+`d`!0N^BmGxdpUwy}`~E)*G}DU<)s4#t?uVJcMxrU6Xm7b0Y8*#_J#Y!2g^tarW$4 z^S<{WI^Lh~2=8LtEi3uL4uGOh6}A4ROzJ@%0Iu*4^w`Yy51C3|MJ8lBYfpe! z=vQ9zDeKR|g@f@%+c4s?Lxnt#3Am;mNitY4KLNlqZmARXr3_>UaeJwoH-JzsvNW$` zRkTDK{@Z{32Z639+zzeP-hS^R(e70n8?|cIu>K^}PyvCltdlP&)Efp~>epNb1Poz- z(C`^+LBh3g*25vma8=CaE8<>z3Lx_^IKUs!20n^H9;;84%9Tv+QE%oX3=GH>+s%;P zkE|nE7vH)2jr(ZAL|fYe7?a@j|MCyNvz=~$=Qy+g2s3_dEhIx5siZ!W1S(e-Fi*cg z*8_66!10A=86V6)7!*#NNH!-K48p8Kn4jv^yKCW?*r7(MpmkI5&LtZk$awf2U4pTd zFMUk&EMDQP3v3>e{PpK~A)5iVr)rLR_k)jZ4Fi8*0H^OURFl%KUbQu48OiS-B4v)0 zAELBa88Hg{f+%oD7O2lY{Y;Cc(`r>NDIH~8&t5&X*vV~+gt@b4+cp&zHobZ)u2VvS zJ1a$y#Wn)>VH1lE1SU!b2`hS;GNo*S&XSiTuvh%U*O|QWG-BdzATNqank;gX@PuF+ zQbh?Yw!JceKCXoFLA?;vvGnK^@C)rn&ncEei~>I_1z7a5@L|zQLQekiPj8xX%WoF* zB%bq&a6VZO`|B*8S(Kt+`Q$yF{WC09i8Tw*82}vL38*WetzJ?i1h^Gb+au!|Yr>@sUKn z9Bf41B)~CKI)kirC6_$|oQE9s036C6?Lw)>E0688cW&RcGFYAadO|zuO7dmekMw^c zY3rZ$wC6FtqaX$zk<>f0-Qo9X-(>;dKH+TzILekxly?*iJcaO{2E0URN1-AQ7RZ2J zk>xVah7;S{p*7of0WSz+K;pej-U)tZUVq9!5sbb*QFflZ0pO@tO?l#;Z$IBr@_aJG zgxX@@;HgvovU%kK?r_Ko$|Ku*PfO`YKFNB)*DC;F3Kl9Lp-Dh>002M$Nkl40cEpgi$tU8q{&~ILZcd_ z^Fm(Bi@X7du4q2?39th`WSc4=B%uuY^z3Ge4&HR}RjXzw(Egn;ov335yQV)da6ljT z_PZaNqJ;8EnSe$;7EsPAjhXP568g>Pcs8cZR z?Wg@i9WDs0@QF2vA5Y$UjQ98hsI4nSb*Vfw>&WBV=LOI44u6Enz#zo)-Q?ZMR$G)y zKlZ4X?@OMcjqp9R4j(RxtYR(4GxVc$Zv!U?4a57~E3N|>)2;$EXHweJi)%iA+QxVO z@CpPtW7mZdS@#&D(GnicctO$^02H(VFc)5C43eM8Q~|?mFZVLFfMg{GAzy!Am&kD& zE)&l_w%8LAf>1fEXK0J38=rtzDBskVL!`<-Ed!5@Q^sr_1EGAQR5jx->IlE$+578P zU(E3u7GA}x7X#;DjbFwjo{B!^|?N?~4Q zKJtm|;8naheM0^qdq}?DX|Mkc_}xk#cI-~UvzDDLfMj*VpC07kS!5dTd0LYf?ZLAS z`3#T*4<9;oG+-GO5tf617w{FdCm;F;ppcyizFz1rc$O0$!6yTEl~-xWEkGJG-syej zTE;f{0fu@0@$XRyKlZpr8GyHd<9G{VWFg%TEMskeQ4>BQQExn-0g=MAu$$aZ{{mfn zeaN3@SwDD#ACD1Qi5SPwdFAT08D8EriRbY&1pLFuMq-}BBQ;(I0?MIn%zJ=hfV6tW zWC=!G=4;({8(!cdVs{izE;%@-Z;dN7M)!QJ@L+apEvj2_wLO7+;{KH^vrZNbenU|0W;=+f+C^@m-V9zTdLw$0sq_YW(zK~F609`-nGsCUQjs{%u?GMotEXe{Sw8^h9nvW`Z~na0jY^sy@6+m^i?=mD>m4+(i2C`m zZ=BtMHjAG{?&*L29uFjEI8d$MAD?x4 z>e>D-4UJ$YfAzDo6J){IPMa8Op`oj&vJ>Vdm&iE*!#N49s{cW4ygTew7EepP}v z&cGx2U;gH2x!LjX%30Q>bGzK!2z8t5tWZqHh38N~l+r|j$(iZ+Eu(~yDDS2S97nkc z#Cj#oXGKYRBqBr{QxmNcvNM%(QAmUz!MC&~-y?;?=3Dw#t`~tNN^eYf*BZcbp-SUt zg93k^6rePUOt|{m8YcS z*cJJvFBC`l7&V}Pyo`*45*^}uAd%*$clzG3*yqFXM?Q;s5M9QYC<-=XK}2%%#wfo2 z`dg}uw5=vsWG=mYzT~F8(!lrQuh9?+}rY7hQ5? z=DKABJF+fS24lxq=@9_`rT{^%igmi*z~xj?;$Y4F?G-JKCONX=0YUx0fPpld>iq|W0BHgt9bs5TqB%q2?_0a!Ma@_`yr`L2|NR zzwI-xdU@|1k=tJGQ1TP6b&516^)i(lk;XuO>*>en1=2P(Z5r2iN;;IjdbVH(YtGuv z+}!aQ+4OJ#b7)yoHHawWDDgQkM5L+|4rG6i?oA%`g@#x4SR=g^*ycCSec@BQjL}3~$-mzvy zrx_FHAN|@sh41j{hYM;l0th{7)R>6+7FoP_jcy;jddU?@f9W|CzjLIXtStLV?R}9e zINrx$C(^A%M{~DY)sVnrQ$T0oafX?!YJ|1-K z7;>`YL-*Z=A+tp%eiXFw4w1i7zW~v!p>4MAn~{J{%{cb&Xgud09@LEGh+zk3p+*h| z(WH1&ROmrNBPVREqe2UGG+xolB2J%*bwm#0ZL({-;Ja(CyE$bm=L>l*BGH~DI{b~- z-%R=k5pa{KuYVDZZkP_fGe)PE*;_caA)f<_@sUvqK8&Xl`}q{p*BH+TJa7}qv7{Hn9-bQ zx!=J4*&jS^&jH*^`%nYYKFD|Jm;LziE3eHIAQK{*6EH^(mJ%=tFzFiLa!OBD3fyZDPD+JGn(RsYgLpIxR%T-xpvx2aU04ejYjO(9|nAMKm8Z0s6N+lo^*<_ zsTrYgt-Q@>^+f2xe+=H#^vhV#$NO)H{e0J*cgpDLZcRHS_Ck@;a!_9uMM2fRBG;sgp+^ISr%s=d{Elxfx%}!_8;```Vi#XIoL>Qm>zk(k zWEmMGrJ2(fWQaLnr$~R{Gzs49+qZXZJubf2{ba3q7BTH#eJix|z2F26sEpbU`B8#q z3QeTf&}WhJbO|Rs?1|UjaB~Lg_zdrovAL#$SEU*IHrpzlI(7QTZ}SBR6tmLeKaA37 z4GOGi3NWA!hzR1IJ!_G1U-$hVL`2w|^TIQ~?uON458Rm>%gZm1i=)P&q_$nBT6_JD z)zgnZR85=mTJ_q*3DqYnuTibH!A4P-ZQ~`I-dB0IC=rT{BQJ!PT%tA(My}&#ia%Iy z6GKt6>Esd4*r2t$LaE{*1YpQFIm|>xBBCC0q30wvdLHOj8&!*z5FO*zS3y%IxpEe_D!PsfE z1_c@v_?!adRBiwK{IjL~W~j3@}=xiG6Av-6wwF0di2Pn(LgrNH!_NXCVGXDpzuoV$lkjNiipUhfOQVT z%yqyUK!xM#a?(-6d``wOBBaW2{T5sFNu$q^f8YQhg5l~o8o+?8m1obf^d8-sqHpbM zpT~2g>d<#774(UsF5LyApMho^atC_n(oTu!yW)C4OZ^6pqK~Mn+2QOIRoXxDAkw#t zDT@&Wt(`t$h*FR#*o;iz10xm?U_1;s^!HOgjoBR83zD93zsMJ$6-8OZj=YJEMWTUg z8BDHqynWWJIWf0uXD(LJSmw+zd(Jk{zRj=hT&m< zY9F-A=f_@%Z#Y)<-yY|45nu}3SWAxS>IZtFD`1B)z^Jg^M85#z@g9104}*x&Zhqvi zLnDzmvtt|#+4lnkV%z|;7$SY*K86>k2IJeafu;KFsJ?!S4)Z*;XQ-orVnp~JUzrb4 zZX&hZx7{{d$MtI`0D<@La$uDST8N%!aG)1{(TquisiXXOfMJQ(87Tk|!2L?GUOZ>L zNbw+osjMB5OvbLS=3UXe5*3Y?ts683>~FDoucWQD$3fjOB1hMW=vm`JcdbK*4#5NK z=QHqxHKDm*j$%Nf-#NTRZQ*?YXV0G9@;dhz&!(L_XTD_oo9oK6f?oL0*u5X$1LfPb zi^61)qtN`yLy3<7X8;I1?`SxqtbKc_7n*`sHcb8(Wh`P3JvapDDL^9zyC^{XP~?ks z0K~+9d4xP12}7fB4}N!zd3H1$IAm?$b)Vx0d}5t(L>NQLh?pPF4Gu1RNDf$YfCTeE z&KUz*x76@6Spl>lE6IV93JAY*vWO%D{@_Pz$y~laZ(bhh6@^AF2q>Tn0_6(OVNbz> z0IbsV*&O>ReNj!O_WpuQRnXeK<`92rqKkov_{2T+b6K8k4voDOAd{P3ni_yFUQ)~x zO#p}h2FI#Jh;g2nmzJ9Af%W*soJnnh59qRF52L)aoD=+2cs1VP-omSj&{`Q9lPvX{)kKSj=Xr<4ff2N0oW>?t)~jT0~-4}k3WaaPC`Yn<#tAN&GLMeFX} znsUwRpEXL(0NMua7i%=W|D0EAHC6BvI_5qQGzExq_*p~N3z=_iTNC<(XT6UdK=v3v z8DWod934M%hHW2tzVSI{o2Yy;6PP4L0q3W=_8e=5j1X`Gupx)gfc)qlvKo(@4?w#$ z*wWnLL3;uj&=m9C)U|7l)m+K14O#$3^$WYk^U;}YR9i#uKM_ga(Y#C(bh)gS%Sm)hK}lX3TSeYs z{V2^EApeaOZ*&WtXvmO3NxRgE;yw5RzuAlRg;PUtmQ)M$I`jHYtT}5!R50FU>)NBq zcCuGaU+c5*3*Mk}`l(rG=E^gAgxtVK^fxJD(2%^qV`Qe^H8LOQuU3Nj1-?H&W^C4+ zm>=?nT*ye~xUP3EdP_JdV!cc2WFCtg&xh6hM_&N299f<*a6nDZl2(T^1TSjl4z1}l zWFFq77oe%REAu1G+9tt!c-$U?|7OQ}uoh~O*3wX|o^!2V_{RLxqtJ_U&R*iVxrYXg zYI|k7nmh@Cr{v+Ffuvj(MtG6w71xcmf&J1Ld>c(3{q~^}=KK20MRN?Yi$F)p0-j z#}F88s^=cRzqS++Rg`Buiae1| zlY((wc&P|V;Iito1Qey}!i%q{hQ+bdVtjh{v;cL1%JOr*9vhdOWL>*)DOxG$`0Kf+1vyNd&kDf`6Os zTTO+r(#oq;n{?lyYSV6=SPZqJd1WxGtQuaecV||!r@a(jr-kY9E#H-&i8;qND~0!= z(Ha!^zEOZ@YW0t2SD(%PxH=+$(cQKw5zujD<2A>Z+E%?fty%r#r+-m>65eDW(FSWP z;PG|&IdWNrQZ)2{L2>N!x;VlUsW|%dOpjNI2oY_@`)-3O3Y4D&iOsA4%e?%I2;MM9 zNqEM1e>r^!9v(l@Cct68*Z!?iEeeN_^~lSs)x4^50oBIDJL+1;%01hWEk~I|K>3`P zo{}fx!QVWdt$9?xZ}Z*gPlEyt3N$FtpunFu1sGk2M()+`s@X3^jqSGU&bfCwc3Iyz zbshI~^xXd4XblQ1D+TC@-?q`Yw7xjCa{MtzE&-KYd(e;rGKzm`_kG>(L;yD051#^} z59_1SfA}N*^Bkcl=oJMjqp-j!Hu+a=9YJB~l@$OM&r#@0UK zu!EP_^5wea^;6V&qx~=`;3UL~Xx}2R90}zESYCDYw$7Jpmiq({Cdu}HUYr221@ofP@0+j1B8+gXrL>|z7cgxpmoB%jzKeG*x6a3d{?z-w zJZbTDp5^GqHhp@e(!27?-Ktgg+9fv&&-!%n(OdkuO1~}R6a1~n(&vQ%T=!KPU|QvP zVD7$gY~|O#JwLpbhsLp|H8P)%Wb!sANA^ZVMmx21Y^}9-sT%F(=FxB>0#yuORscs%OZx{W+=^~a z;EW&tTI?I|$NSgGlQMEFej81mS^xlWsd;k*6K|Bg$@h+N;*n)-p7B8(19ZH(zKIqR z1?;HgvNTTFQXFSlu3w(l*wf{5v`;(fW6y4hFF25k6Zy;DZ+~}OopV_#EJsc02rV^y z@M#>yEspGRjpOhf)6IFke7`I|rD328&w+Ud8vP9Y&!87KfG%`pW06*Yu4a83d)$`Sf7$vibT9@yF3p6r z0A#?FI7#$TJPVQN5YiNsJwv`>HmbE=fM+Lt?ES9skDOK@S=y0uAKoBG<=vkU`z<<3 zg}}M2*#});(^;Y>K}3YgFRsZytq=9G#UAMzYs9myXEr+9y)>yU@fG^Hw_lt}+>f0M~T*n;L^WQr`b38?k zcMTbCf06&&JIffzVyR5Dk!Z78UmVSC4W?Lf`iuYhv?`f%jE#3c3KlAP{8{5*}!8lVK z0O%*5T%p;D>i^REwj#c>2`!Ht%Y^=#A}%M z^UeEz|NSHKd5n%_X;K|ge96(4+THg)kN})W)#cgfHj1LiS;#4+x$eq!OZ%yaoB9FrDc3hSil2Pynar76|9NY_ z%RxIX(m^@K+ETms{)bW@C^-^ay5{SCcKKD;MS-c8(ztnb!o*7Pu|6>$a%z6v#z?s~ z3hl@ts3=*^2WE%oD@dhQo&%&9@>hzg3X>w&>>bL#2<&j_O=bd-o7yQ(w zdOHfPsm~*CacR;*y!F?c?0xK1jldqf1`E?XNSOGq3P#@?|x7>DTIs)i0 z?giHAKj)>QYokU#pLvS``%+B;_NGmro<)RnKMLB}t2is@Db^r4qp0BT&bu)ANWg%3 zf=QVt8HUH){F(Of*{`s*?w>6 zkKQj2v~_0xcHbk9J(0h+7MZV*9oe!|6z`=s;fMR;-)fQG^3lhi$al$&OqTug&wmxR zd6xi4H>!U5t8>y;M^EFDi@&*JSz*+NAALN4(ABbVCOw%RE?|vLZw&^WPv{oCKCuBP4#Tt@EY5kW8X zoEiLg+nvJ$7inK{7||K-i#g^Hd_B^gJ`nY?1PcO;rG)|>b7qc?;6eK$tVaW=|8tB( zaZ9@i&*Jly>Og9r7r@u={;k`7{c5c^9`Qzwtwx*Ho|i9)|CDFwf0wS^s-cG+SFO9= z`XQ`7OPbwt`*qdZvu7>2E_%CU?9FMBee&SN^HTa)K3CNl-O4*%n$L*qjqQihjPIL7 z=zLW=H1{^wM?xsdSKmtEllspn&x#k-H~rszw_TQer1(W?#lSDhO982EJiKip0SGpm z$fl79-@lfcja7pE`ep-f%{yOzUE}u#1sW9i^Pqq|OhK;`;@F=CJiIijGAm95U>+N% zD?a#OL8Z!jQN%?G0HY|0_O`O0Qi3UZ3SN<83dWItq9;^-C%e6iymQ}}v7r>kvlMk< z4ETOX;1U?xd3$6T63+4lKD7KrBJ>VMa_LRR0`>a7#B|j*tc2~A=z`! zUDE(i+=U_!WbrPJJj%Ocm!%-f#EFyg)Jhgl3F9lDSwGPD-TTIdG4S_)_p>FAKT%1g zQLI&9kwCyD zz$xC?B`T?_xL)5xadDKFXy$&~ZSa$lmfSbZY77lrebA?y0V`ws|1V{Y~x zAi&ugLkr&6Ap5Kjj1TW-K#Y6!)vEnE>t>;_*1*7avDXeg?x>79(yt3IzC1xV`}pjf z-`XC`kmraN8KW-@uX*$5CBG_qqrDVh{Tpwfai=use5Nmj7x47+V_wX^6>k%zR8K48 ze=dwH1vN#T6@bQEjd^ig6wPzYw|g2(96sh62sk;SfEeo>0}MFxW`y|k-pA2(>0=)y|7ty5; z3L@_p#m5x-dOY~BeSpG>ViqHn{2>R)I=oJ&L@!{pb@_VGa_qQQGI$_5xOmNcmgBd^ z$R`E4@E7B`=!5_hJPwo*dF8pH+sUF20z~N(^aY{-gW3lu!nuQ1B1wyZZ=9T>PSOEV z%v-+*cCa2>YWQsHE&Eodo_t(>{nEHs!y)ldwRO;TN`RXp)C5A93m^|3Dv@0N&Pdka zpTh6t%}X(MvdcZ@iEQD(L0fauH|X!Q2>|Qakn4D!TtjbTRe0}5r=661SNaSr799(u z0EU|@{IA(ZobpppN-;=%;Xtv^jDF$8bgXdr_`H5?qW?<)irK#u7Az-e)GnDkWlG8| zpb8qzin+lrInIzjZK58+=-`v*0!*{+I1cP9BCV~#4`Yv2q|MsOBAzie@`W5xOXb7( zsTfvkps#n5t*4)ILXMF`@2&tOw+_CsrtpCADgr3Vk9|<0iT#Zyyt~W`*)=Za_VamZ zo8z*VObMQ{zuSMzh2RyAQ1d461^R2>1wxT^1?+j6d3%b1!a`KO#ewI1yfqwQrdjlD&|7zjbYw+F2(MMw=pNz># z&ou%|FlL{Xap%Jq{|8MDJ!I$-Aot<`2mwoq$c+tq%zCy@+ONo;F0qyYSX%8==%OXH zH@pL%b5<+LSaO%sImlvByy#gRG;htCl?6SmYxqRrLqF@Azl&bOL0sRAsa#*~2e{$C zGfzJ`FC}OHaN%VMQ0^5qeo6#rc@8;&Mu$gjo>ENk#sJ*yQHqjUQ)iuVN?vX(zxefe zIR~7fCmwfnC7KtA&l%M(0;>)==z#L*1P19#){=i35OmSPPcl%7Q>4fa`<6NL_w?yA zQf{KDqNG~|-=BKY@k^fD{1-Y-_i&P){i9Qxf0evTe(kgO9!q!tV0>@XbNKO@r{&so z6W!K&CSL)eCxkwr*#|ER=hOZJ`{!E74;TN(eB;v{BM6L~qNmz>&piF4T*vqa$h+C5 zn+~i3RR3JR<8wOP&wlcw+z-gn>u#014ya9|W7^zuz0Nr{A4*6o=Hg0>CasBq3KV&rdzybR#*-!8= zN2_Ar>PQub9Ke~3uy5+q@O$r%8d5vQ?=?)$K7Hri_f}_|dP1%v{Xid}GKWO537#4G zT#nZsNRE{LxW2yCuptlD9`e$dSY;b|S$LR<; zx$Qk?pH*8g`d(xO+5AvAS^5X>d>)zGTC!HM=-X<94lN3muI(Ll;Y7^1Vi{kUP)v>4k zwAy}W4F5?re_kB%3j-6=5}q4v(m6qEMrUb$@6&hd>hz!feKmgEi`CT^pHtm_!xdGx z9-CKNZnI-7_Jw)>MjLmk)(qg+d$d(Up}_#{1IS%F3g>Pyuc1iJs;;^8-0J!({*W8!c029?`OZFg|5|IWn|=5KEf$YQKUNL_uK|#Gyfi<} z;YJ-hhq2u@4R-evy2iCujNP~z?N6Hm1onZ02Udp+Js>yqBHaG8N7d+kg8~f-e3uj; zM}SI{$>+nU7PYWLC|f|0F=0GV{MHEI>GG?tO@J66bm1jeOyPBywfq#K{>A#xQ62QQ$<*QDF5&WQ%?F z*4yr?L}vgU0KX4E@_3RAxUK)92QIzhngktJjuTrH`bDuPt4=L)g97L}|2*&JTkj0r zV}1falv#j+YxJLiZ@=WoOWK6O%b?Mp(LoP=%D%=pIdkbl7hiT&^y#sr*%MEVOd~-D z0qS=Szc>2|w0k;~Vv!uLyfUF0@$h5$dGr4;dI1cK0nvcKqvA*vO@8O_`vSafp9adU zVI+066p=NAoDsxL00Hpag*7dr?dbZBem|1gCp0 zzU0b0UYzv-0)U|VncJChWERNh*}w~PU{2qj6ZZvQyzt`K9IMkh=Az7pd2&>?06KIo zQJ=R2&!COIKl$`C*+18rZ_ftu-+TXq)rR2&nKNfj8bkWhQe&6`+R(>5S`%Ar-YbE= z+rx+|?f&RHa9k7|o&chWlDR$rJI$Ow@X(_Xq_9o`(~e;mP{2=sh%>u$;@GB2vjoRvoNqlFfr&$1L~f8-bE2DHZuVWQAr}1 zfKk`qbW7fUckm;?RlhF1^4c`|=7!v2Ji1o2+vLg9vM92#-4~Hjcvh75@OvJ}wR2PS z4Hz6EBS5(+$ulB4r9#QRN3@i_1JTgUdRqwSCl?~fB^CVmFTMr*YIyI)xKDdN04mNe zeZ1o88$!mmi?ul?`ZYD}CP2Y!K@R}llTVI}h{2~but4OOhE6wy90R7|1@qvj{8iV+ zyu=&<$AQRXAuw|6*q1Y!i~({=cgK31ojh%<_^F=W<+}Qx)(;-=^Q{2+MMwhg z$VU7J@DNovbLOmyjM6;U@2*25N1&%po0dF6{un!lCg%cBZc5CLv6J;rJ@s7jK7P`F zfFE8ffiq;cNMP%etR}PUP3Qgo;z%hpF{2Z&4S57?B!?8jMw1uEz7!{99!R+j6ni=3 z7e~&Bc;`I@dE6#cq2=8F7ot<}$qv08VWY=sA;;1g{+Gy0+^ zxn^E&2|hv>a)Hd}%(yIQy?UF~YWqdVGEP!pr+%9kdIEWd53UUUl^%tRAqT7jfiVD~ zk>OfmwDlQ zy)gE5^!npxpH>$|k#uvS59gkLQ36KhK#_C2Va+a?i{K9dI(zTAdpOVgXaDo%t^9{P zjOj{#B2T5HAiv%Z`I7rwoHpSY5+TkBuce%{?-Q{WRWxf~K{)r=C(MKP{PSZI9HrY_ z5hr8p0oMMdmt7Nlxmu28LeQLEwY(a>EzQ~;9JK+g9Zn8`0fkn6a&+U1mxCW&Givk; zxyNx>1nVT$S~{Eep=s*>C<=?T~zb;JMYX5c|1Fu19Q^h;dA|RLYe%+x4>&on$qZ& z_0iVeFA9720DbkZG|%5>uibNw>5BKpX#~zw`xX$KLxO{q?z8ibJLDb)RJLBpW^38} zX^+HOkuqbez%vmt|;^8{W6kV`ekrs%)V9!o%F_Y2rF=lG6OlFjg&0MhOGXrVpu(8KAx@_iXc ze(@ds=R1p7ULND6L^7E0t6m!OTt?*Xu*;rR#{h?S+h_l3^2ArG!3Q0g zpy!$q0d(^nB|X=mSE%R$P<1P=?~UUW*!ySJ$TQp z)sRDvt-5yanH!R5#k- z*s$7r;E?Ky3x1W0eAuz4SCc1=ueRQ9mx$zOs`iMnJ^Ik_YS@t{RU3EglyrD?+?eX_ zTd%41JMi$T=jL0+I~P`W+;C-V;L}r(?6dzt8KHc`m465zT@KwpRuf+tn+&>1=dKCH z1E(j%XZjDE2Vjei8X0tW`2IVq!;U$%dNZE)@O^j0JGP2`3`%;q)&gr2bF$`I;gPyN z4EiY(t6|5T9tv>#py8?!75-@T)FW}^HI%tV`_rXBOULW}bVt+Zd4mEC3VhcTpd`%- zMU=r{U!4&~`F;cT&TdgSGXgCXN0FGKB!G_HyESEmhKm4a)K3aK=hwi+_ljz@moo}z z$|4Eb0l*#kNJG=k=npb&;J*7L0O|dJ70RuDqVpVS7MZYDMAS(Iz-aL{!K{TfRYVJGe$Y|=r8~QiY4Vx6xq-rgYrIx0cDYKA?IXK zvOQzNh>)WIi?CyuIWBj|K?f!PENV1?o_LCT0JuOWpzt2M?UIp{Jt6|@fdF21-DRhI zcD``&e?0%xla9+VJ{d*}<6=Pny{diVAEo`6qYlp~Ebn#K)4?yyahzb*ZKA``e`9?VqlimTAzW3g|baL;r_wK3Vxxjr4GIRyrGOhqEjv`9q z|4X_ZPMsWw80*Zhr!=f4?w* zJfI=a{_w+wx-FZrO4A@34o_*KEjNle>e9J$M(dcX)k4ofGyGwE#Sn142Ux-T=fvbCEqj4Iqc3v_K2>+7(HbSsVQkUs3M{^G3sNCY(FOe7H_ zPSh6=AHavdIE+Lwiasp?9=><|z6173P_dSn=?(6C1(PFM!(23a!M4fLXaF4BDeO8XhBV+lrf0z=H&S-ofy62^uZg| zp+gVM>j7%kF{h3B;w0%2vRX7Jr^Jv0_s{i5elebbg8E^d?LTlpL|HwSV2t?%O!Vp9 zBj?)t3y|dZmKqyEw5cdZzy=UeWE#NL(P78q`)=MR9RmaQ*(;BGi_GTK(VyPEdL~$G z^^$LU2Ut<&=Yqv20nmK*>;O<>4T$Unl!#K~&^hApgR@(}<<}!3IoLGjD%MswkT~V6 zRT0&jhvUb-FnG{_q&q$WYNJ%0^;=X?_x5LKX{0-)JA|Pd1Zj}&1_|kAK#?v%y1Nl6 zX_U^PySs;>hUVpYzSr}^`yZTZpL6!wd#(Ha+=v-^J*t%(0#_&`DT8e}KpQ~I1C&rB zrmm#AkBnrB7PuzxN*e46^g)QQN;ivt8@VsWCb!;%MrM_uB%bdK8iRRmnv$zn{OTxQFFcY#lIKI@EJ82Qe& zCN@b%C7JuKB=B+aAJX<%CE8ZU%>su+>Ns-V2Ny+d7nl*CM-(+XWsXjiEvp31DehTE zGr!$b*K~-YYF<@mbK(wD9eDDN*ZKsuEPV%X3H;hzL?){?IoJ*33-(YtBi~^`rCpp6 znaepC#+qBFQTvuqOhFAE`>oK0hfT&muh~E6>1Q7-_)>G$#Pv8FVuJ-}J|w(ta{h}|6DsotjVB z!zg&Fy9ar0IXbFD$wnBBw@rSUBB=u1hub&qrObgL+^lZ%VmD$9DHyHpC+=AvJW&49 z_cV$7ypcdx^<|}yy=gkNP-Bh74__neRRUxbf>lEH)^vQX3X!EQ6B3mjKch0yp)Z_h zBkqR^D8#voPI1U;xmQtwP7-EnLD6GLjTM`g?|VPswNx)+82Af{ft?#&UOMpe_Pbrk zfmt5TX7^GuDEn*b{fRh_anF}bv1jJ@58>-%W@qxVrcb6Xd~W%p)j0uIAxDV-iI6Ts zXL72c@Uu4n@1&!2CVJcDnW0(n2druoO!1=DN1U#zn+16HQ414wxy{E+BT7%r+K*0k zkY^cpshmsbi}q`W0dq(Xj0E`ZOq_|eahHgCrexLtE)zbv zgD&8+4MX^qSO}6S1GiI`FNMN~qg`Xma5NRN@ht!{H$i{Mr>xQ=S@vi za)rxCoMJUTMLD*9vNZK+A|u>jm%QCP7ywI!_wt0qR$d0dB>0AJ z2ZA4hb@5Gtc7{mnjRD`u70i^{L=oIuH{>Z6^73)68=>_Tkuy_<~<3oAk}s{lE>x z#n`)=%-Wh9zsJ80>VWfb3QsrB7h}O)lHj|pXGd|2Zgyg?LV;J2k>vlWjntXVa8`w5 z^6=woDNhSOkLW9Cbe+lH;d&1Tel*8^AO+`9^xa@eewPR0lNuUiMtDtu`FuZ%6-=}{ zUW$upEtYs7rhp|1l2wH_(^lM3PX*0B$V&Up5eN5cJg8U6F_=(KNAX?9M=MOmW1$=N3HXG= zc~73*kio;QoZ;TqFMx>$=F~()DBoC6Ij{aDKrI;V2prd?IB7$NeS-@pa`7V^o?XrDvW=$V8yij zC_O-!qc&i!K18^}v^S3@P2;K26lhA8XK4T^%7BKjzUu(`k)?WIYKj9im1OWOt$d=G zD}dqxCT3NK;SU1#6zF0G890e?x5$!!6RWGpPJ0ep-XM{^GIM()-%d2YeyW6un92R! z>>#e(W37BOOz)vIBSSS}=8WeJ9lXr5qGuyw+=|s70MrSnl;G2X z?-%eqIr}g*ImP=LU(1b*fvj~O>I79DK}VH}h+De(5`k{q8!DBcdD7Z06GM8Kktzek z!MT@L8z@%{lm_9%5Q;q_eY`h*AqfbJ+oh5SEQ#-|CEaU$;3e~bg;B5_=x8R)teYO> zI5OoFtLM*gUODi}BApH~Q4(vYL2Rf_IPR}h3x9VqB8Mj{@;zPQtUg}0eMx5ghn+5~ z&NJR&NKopF5(Jn%+GTm(?@m-BIvJ((EQ@?}~g%ovJh-BODC z@V)UlkyMj0#`nwTP=P7r0M1ei<8SSp@Km0emn*97<1Yh%-~t~VFt7$y2=EEK;}bT@ zM^x@~B^ZB?x^c{hE$fIak?euFR(E6I_{xSGC<#R6&wXo8oaG_O1yHir{OiLt5Hmw> zo8=`<_PFb>%6!2kMIQIv=X>C0IiOsKthfM?m1VR#AGl=iGt+nw)-&YiQMVS=zF?gi zRF{G{80R=4Ii1_ib^C*UxRthaFjKt4&pP;A!JdMP46MWkg-lbxY(x(A-d(Pkh-SA|3DC+VNc$mLxO(bn~tC5Y_J5R~)je zNeCctoXMULJ@8x;)VIBKJr`}^T&L!+XC!0mIOb!5rLJpbmyV$diOH!l&X{k$%GLV- zJUh#lOa}o2lCtMzul&~)6&7q7XZaMWyjiRm(MbVpKM_iY$z3{0)gt_qr0B6#+_Ww! z9_pqA-DsxkK1Bw(8|9;B%!vq9lVZgyVQH?PB;6Rofu{J9rU4;cu;9zRrF)y;O}%L~ zAPVW5_S?`^3sYJ6*PbsX7dYF97m)U6|4<;TF=RwQa8 z+_GWC!{Qqn^+|NA7jre9yELFL<}chZ9C`M*S60hc)4)tQcV|mzk|gT zp2V;;suzBrh-3UwBv1bbEyW ziQa6Z&7pC1r_Ilw4XX0pq}}Y8uwgItvK8X%XybVn{HQg{0$$7sY^uU0^OAmRFaySN zmSQfX6!DB4T+g31?>Yt}g}8t# zzR(Wx%*D2HW*;>5R~ud_idFzgH_UQ21gKd{mKg^BxtINI=-Flt7@zcb`8i@-BtFY+&aZTzxLgsRlabfHIkM+L2D`x@NY~7oL z!ozF4#dhX3LFbc$qiR5|;PDz;{0&iY5lLg6ZQmbaZLO{B-2VQTfAwlQZBVf?KU-A_ zeLwq;o^z&8GVI?LXU`)_yl~X~{{K?S%>=-l6g$DXW9k_m5lhIYLD$!=p^th#TdQU% z6bT_C5S4FbE}??mQF^Z@4U_hKb6c-hh>s!i<0EJ@{zpQnqVxvecyoc(n%c+JTviq& zUJ+@Bdo4$8J~2Zl?ogf`0Cj($nP3hYdj?`HiB2$L(X9iumNEZaq^mPraJC}#U#`UdL4$XG>J^8Ql5Opfdu zh3$8(ikK_zPnO)goI49CH-#y0X*AyL_n zIIcJ!tJSBpMJZ6Un>N>R*T3ud@+co;KFTcUQ)F6m4nX6;DhM60dEmy){J0R$fY^M?-?eTG5x^k73l@WYuyphX^5`qUtQ~?bAzl{bm z(s#;9MGdYCs%j3(bgnin?<`ycg~H&J#l%wK>qA|$%X0t$Ji94Y;6X_C-cR@PcWVF# zp;a(r8W8a9eZk5J`3-&IOgE|HdrC@L+Xtjub5$YUNhD^3iKg%fZ80IY0fdKY)3B_2 zsIdrMC`xhU)&My`;<%$q#f-fZ_ECk5L<1_>RvH=)(22`LWFIn3bgSX&j_?=7IbR4c z0jFkq9sbz%#9GY%Aa(w*0fg?2&bqDksvVlxY>Y%xplKtgIs;nH>K z*7)Uww1($>96s;RT2+1}+S~}DECO%z?<>-r2A3m5-yde)=TxBRRDsLSapyq~L zznZNClB?}pm>G(Z^?gJgT4#!f+sR+M)+3U1!OGn=aFJ{}j@j21-sNf!v_)b!zV6sE zzj_0BpCbu+c(kM)Q5D(!wjwk0$8Igg+^@>kA6sneCk$URC5d{MAoChUyMZfV`bIjh zGVp1VB>FiqbxBK2EYtDNOw)O~Cy3S~KNm&4yv4hhKEBuzi^G&uLL3qMa^zNRN_1~d zBwJ`1M6u12_fZ4*`CaqVbkzq)&%im`aZb;dmyL%GOR+Y!vzre|jQbxDJ$My-Moms# zgz>|XNM*1|a{Cj_jPKgBO3r<26P)htx;DAj{AM>bPOf2n6%4qqwr?itu3}v;^ zbu7ML{!DsY6gYReK!ZSYQ1$%tz4+XUl9Vp*VEgpXL!fFANRF{AbaV&l$oD{smUuoU zINo;nr&L{Y;!wZ6ityjujq8Rt&Sx#?zjQRC|#hcUJ2Am6A|1>#^cl z_+z0$szcDP+uEpi#hW6&4cT*bT;%moWj;a816RzUmXB)c$tzT{kfhX%M;uro8{Lamka#oTXb> zoQb&euJ#TxDQGk0z;sE60#2>>!@SK3AA@H2;&s~21i0yyO;JJ|IiU<+ESP+?tschP7k(37$sER){lx-@S)zp07~G`Et~hNgWK6X}MXdaZQ$T_iqKAm>jwO}osGri-!^ zeD!y#^SoY=X?zT8Q#itSx;Tl;7Oc)8`C=-*U5HFA+i+>k^PE~ite`M^254+vX(AfB z8dips0;Yqv^YV`8*(^;5%XVyY0~i3;0u?1^9hJnn)cQ{3&`-VRU+6?UTi$K@9$jBjS*L&o^GI&kXn^w{Ljn&z~QmPtR z>*xY1?t=-RXL^=DSBGtONE1L*3fvrabmRXW7}h1w6SQvrSUYig&Q!@lIgSI@cUt3# zxI`MY>Yn=Tu2&&5f{2_Rx4JALz+O&@CzK^LZU!jRHwj|o zR48Sxt}$*6plxkdU!saaAw|ZsL^43gC5?|!Jd^;0Q(R%9YWT-Ew5(CIAXTw+qW(!h zBqPx(@MT_?q#O7lcg@X8*q$%x?cy*Tfj_`aih+)C$V9U{sgSE=86GlhhG-M%Ba0u^ z$xkAw_`0D<3j&a3ifjQSn0krZ7qY^HjK9B!vQyJ?tMD+tWVCvzxGM6;1b3TX9=F5* zz~q(?vZL2?)^!$K#swH9dVS?y?y5Bi#Fu2XOm*J*t4O?oc7BX^7bP(<79e)M(W4xb zuF6xQiB>TxclRb)eE}KmJL)-AMpHabGz0H^fu7vN7ZQ)?K{c8SE%TFj|GQnJ`biaM z4QO>diDeq=r*B-Q=s^Oh1?eOX^`Y@{QoMeE^%x8=2RQUgK9^m*_*|r8h=pV^wmCb3 z{b*91XS{Fs^u@3NaVY78MbN}Bi?}2{{b@d4JQBA$-+4QtI(@amX{YX#{q#(OeW-lF z#(l2{e_rb`X-q-q{#Z01fm7@yZ&uVn31;p@md}g5lWs<)4ocnt z`59kJq@T+xr zy~4TmQ4wpZh_x3{mDCtU^k*@)rh%tk-7r9@I$xzWr*H#v7u%f@$%kypt0Pr4% zS>AKbQK3$G;ayvg&09HZU8F=bG9f%NSqhEDya~?WlS~kkLlQ+r4NqDb(<+518f?F7 zcZnk~;8(qfUg52sQY8@oXL?Z%j|`O2wwYo8*aMhAVYVlH^z@pOEQE(Pqoo~T^uWAA zi3=ck{9_*-ycMO)oMV&v(f+y0K2PPc-yF!VU}%<5rgQwN?sr?FAF>hM%FgWbE|}TP z)@6Xb%C?7+Wcyiv%CR)gIO`GaQ-e7Fxxf`45RCdO zZ>N{egC3=C^ttSex6_+ulkKP7SI}LCm$9nebpejUpbDaodV^=WKWyc0mXn5%wx>tS zgQg({4ggmsn;0pqH;x%vbqxWg?V0$c{15dlso^&&4@LpN1x-<6G-lhjWLa>3R+3(u zkFLadL)P)$=7h}mUaDr3^P|!?dHSfgfU>Md5`R8d)92v%L@o~ketu_3GP5r)Pxqzl z6A~BLu5Wx8-A`>_t9UY`PxqNIX)@axrZfmRUW;USP;eaUxM0pycyv@P1^{~7ZwqE@ zYD+|c@0H%zKy^0sa@>yp4Z#ZIh1hplK~7vhQ3jXTu&5VmLt-)_EFUEy4c@`O52hXT z25lawGem}F>8%!pk883;zv;#0&r)U`$92dj};c&#SD-!*4QL zmKHI)xD;?-fSBOl74oo?v*AL+PWIl#CrSKcS1Dp*SU827*%3yT8$FdT`!$&(O1JZv zs|g@{66e5w@Gq(je=Dp2V>LollKk>r7~V5s@&=`NQs}=%RWTt#^_{3^5D)*BdF#}l zUvfpALi__V!9qR|?S z6)Yj}4)R{n=w8KA{8dA+J_(_SrLbUYt)8hhm2liPw8Pu2KRTMV$%JZjfOf+G;q))& zB!bFLbrUQpnKw%;X#8CnVjOX#{bB^k$rNMG{X3{wBArXVkU;#$9pKSosf*_#G&tR! zBQ91OAHL!%LzJ}4J*6QkPRA;H))*XZ`RJ%tGtwx3h;eDU%~{br`~Vf>YV)^=*V z>T%sSI|Jx=5!MWdiEf|#wh`BMre*9g-c?fP`Diauc@}+eP@cr7J&<*ugyc*dAS6N8 zoJsf82TG*c83p{47>=;Sn_t`_m6|x3uv9H?I&L=H(?A*aKAtS~J6Kz;)HU_X7k;RH zalBs6eX-n8&q?Y2?Lowa#L@bBj^pQWbP&9DHb^G?^^gVPcH@*F=)-KrTBqq`8@NO$>(wavgbI#>SE$Wmj2o~*d zz5x-FTfbK(=dx4JlL|pW?nFSI5{i5>*Ec+{e#6Z3R#!Vygo|!VI^;7kp5eMzA$iqK zumI)fq2rU-YyS@=glKX#Qe%dWmX4>Fd+t+@zSqIcuP*hx4~`J$)61#aUD(-0 z)t-c5q5jkUJ(HhyL!yP}$Wm2e?Ur6eu&pChFU8TI6<#^P-TIU}=cx?2TAV*sTU$m5 z>>Ro@IJR`m4JKW;rZ!AaslKjjgp53Np&Ltd?MGiU1Uy?qS?4)UnR@=5sM!InI*yje zD|!$B$8Y11uzp=nM3h0@WRbd&?EaNAxy2&p`|{sUt?8_rLf@`3c>>hS1WMH%FSTB( z?!BA50-pp-Z~Vnnj%uAwvv)Hd*K8I(%RK&m7=8*0%6^`Q6N6E;UrklNzYFY?G-TRL~!O1oiAMPB|g9}h6QZH*|<2gsht}oHj zcDl7^R5}m+R?D9CIVNkKLD%z5H!Y3^eyT0r_VAyMpJpJtlc}|>T{UHOfk|+7Hsh4t z*14Ly-;I+?fu`?k=6q@!AzkDCox@_)hfAjK<5D_bSfNgbK}??D1y#nXgPRUu%9}17 zgou7HrQkB7yS?AKoDwAVvG@J0fl^%OW?dFF_`K{-b4pYXPg3)~ zY$FVi?>oFd8pId<1oQYz0LqKU#(ms#Q{Pnr} zv5vXKj-K(tgXuJX6`^?Ii+9L()~7K$u&HA#ChBQdS+;)l2O@t18^EZ@eO?WQ{0q^H zYA5#1HjNxS^?BU#_8fVBz*PBU5VE1*-f0gQ8Dp8cZTs(EL1Hv+`V|P1{?|>Ty1s2%Zv9pQc^)wmIX^Ot;r?ssA}h}iH|zwo0nd`Lymv)ao$ z@Da|x!Y-xG`TEqWcR4aJ)-b4prTa(A#sEe{gG=n~>R`2?$yc8B)?MK zg#uE#P$tQmAM=yBvWKz9){+s} zsc-lzh5Tp>@Et@hFD}w4b2%qvs>ujGBTGYnH1};zxu2X8G4Pl8tY}EZUmjcw|C@`B zqSJW^dbGBO$|(4ZPu0Lg=k3SV6RDrmpKSH*=d#!lkcBp%DV8ow1Fy9)z9U!FbOh~J zsI-;2VH-QmaX$}Gk5>|n1~+Gb>^*|ozRXwCvBGLUUESC@6F<7cpqE@bv;JCS}EQ4r29&<>8W$ucQ}gq>(Va;c*$s+FI)_6i;mjP1^036>oOq2 z&dC+<_u2~$;JW}1H&^}A>u_G13RHfG(J&q{evu-IZ+i&|=gU3$z(lcHFd1;TtE4b3ZDUVFNX#m3#l4%IZeDBP$Wy>4X}Y;eU2Qn&JM8>|d?%}Ej7 zJ1{p*3nzDO=eV>T34hYbM98d_7x$7QOI6UCfVVEhs|wu=4tg4}xqf;v^7Z0s-HGa^ zKx)*{caiKg^F&N3ZrT4%?lOi@WBLwR{?fK`KTomzU))qDW}Jm(F%DE7k1wp}O4<19 ztV~xqBsNfiz&^=suP~m-YCITOrZ!q!B?8T^Wx^cuqA}xg&I&EPu&nY){U{-4wM_xo z^~5H3KmOA5u7$W&S7~%RUWC`3l&Yje~>KE{V|Om2Liu;7*?#GD^!3xKoZmrf~Lp3i_RR@lScI8 z+<4u6c6d`1GEDNuQ9vti71?5!T_7DaJCB@oYG*{3SK2#n!3>wI7?vxdZZFVgmzOM@ zmUtHo12&WcN<%qSJBZxz@)<==sl=daBmH2f9|d~a$LBnrbnA6-*YhCXSfjoBheGCF z=7BDwRW}gEaPoHNC+3=AP(t&qLTPS8@8m(tT;$47Wq*6Qe|}uVKmS*^hbM|Ct1Fh3 zpg1VhCGv?ebMdCnicSmC;d2wDjCiY@0@!{ z8&+d^{ulZm!4`qk3b4+fpPnIjJ!4cb zrY9zpcZ2I`;_ryAn}sOXd4I|ZD@!4;3zo<`{%<3*Q#aFR$va5<2kN%!ui0{JUh&iQ zoQfPM+WMII2{}W0QBzfRxY0r(CV7g0$wG4WtIe5?k#b1+{UDK2N5=@v$d?}Vq+XZE zOpEy=4<3kS7gfinsMELh;bM(>NhViAvaqvUs8*6>7e12FUMP8T??{T%Z;YO-@x3FS zcK->Jq)WNFm|OX>-^`zDN}t7bu$viPh%AG&Dpq^9-^Z*&Ae&z^MWTaV%q%^%BFPE? zjQi_~4VKsL;r-bc(NOSScQ-9!jjWhocFOGT_<{%r_6$(E%aQ=6Q)8ANBpzL*LX%^f zr_ST*k|Cq>x3F3r09T)(I67h_|Kld9_2=TQ`|sm98vR8i1xbhpTH==!eShX+jAqbF z{si~Zt62fdLo|vXV1tQ=OJBcZE4j8j7n$UH`+6THNjv(qcLa5Y@pSr>eA)}q0=t)= zOLQWFQyr^{1?X4FCi3pmj4Y}4WyvTuJ~RXDfZjP{pistLvH-LM=E-Jp?`*gs6WLup zvsPf7TduF*zJgwb%`0mUqZQQA*xb%`T)TjlWj$T}CEbP1;0z%>J!0%{&F11_=xE<}W9 zZb1$xGh@}#e!0E3g8-FW@u!{mp`_b#A@S!Oo5Tx zQIBBzUzgmg-#t3jH|gS65fQ(x-1phq>w9n4B?M9&GGQTKtX!Z6fxb?{xIt6A9%7^K zmkjvjbicI;K@eMY%SVpfWqN>SRQ}JspauiB8x}y(onS2mHF~*yr>>;udP1pzSnX}w zDDfS;6Ow^qp#?QV(vvnrRfBXY*D%cN55VtyknD7Ba6kF@IG7a^^P48%^X5Obqb`FB zk!&g24*WO~R`CaRbTjePOYcur#$!hQsObi#%QRgvFL{D@R>r9|qu2hO5Ews5GDnC- zolM`%gwRMJm#oEPC%fzEjFQaY&?OKtE~&o%$N1#!#p)mD7dw(SNKKP>K>Ai zm+Mota!@MuQb%d7pLA$1I)XQ}Q~&Ji4I(I)FbYw4x=TEwp~z?d)-pcAvw~#Jw&jL^ zu;Xcb^Ml%DTHfb&x%~HGNWp$Lhl?+nUtJVr@ur_pvC)iSAqLR{7D!Bv_>@h~!%W31&oBlmeSf3c zqfa>1U#Gm;E5y&f{V`HgF^)E&yV?B8hpcdFUS*AX8)WqK9ICtx9n+k5irR7tm(RC8 z-hKtw4MJk``BjO-2>)XoT^XrqIV)k`DlI#>28J#nR$&Pz)6I43wR?Yf4S33{56N?5BjsgYi&R+ck<#3r{Hp1^;28JjNoHO8YDZkIb0QNPCqYmm#+!I` z(kLzt46sZp&6<|Hd?=fQpt_)rS*(9@UE~`Qa?{d~Ne2*UioS#@SJXp9Ij)Uc%25Fm#q4#-@rK%vMhG=0-_Bj2CmcZhzNCcZyalt zHV$wcNAnV0fxNCVeOid;6IOFcK7)frB{$W*LYOn*o>(-!hY86<_(1*p)2S9ep=86^ zei08n2`o09){wSm;5(9jR;y?_ttb6!Cl%S%0&bK;E-r8?JzaHE zJy~ey25k)`zRA%1Y{T()ym`i0?f z>m^UZH33#sZsihi3&`c|KJSAKU@B9sTU@SbkW|=Sy#4A6U-eQwxA?hX%HR4bNVv!$ z$(4?CTV;fVOJ#TWg;OJsVUNI9NojhDhP2$q+Q|WQ+aI_b7N~ND@>sol@j= z;m*ctiV5uy@`w0hZMu&xJcnz5%C?dzmvz^Mn2XTM^fSHZTG=ffFc|# zeTL`0a)HRVNo7Uk%f(Ji&^`sQNR+VqTVp;+Jaf50BfOM&q||FRaZ{GYzdha@V}r0y z@M3XN{}vlOAqMaYJJ-$%76@9y$Fp}t`Gr-bK00oIpa*z}3ERX%0-&!2?TfX18vH|x zdZz1%b}nT)#-{%FkD=o&MP5hHC@Pf`emB|1;bNLU7$EGl=zWN?M{eR zuZCZ|$yAZEUxA@3I0FLV{U6@qCBfx)xbhgzlSq2r^NHiNnWNyy=hJ zEe1C}uqbE0UF4dZb!x^@Qy{#vF&X?6aBRP(?1;ajk$75sJ(W+!OtJa=cjYFU$$c6(b=jFUt;u)iGI^NH-xy?bB*#B2jVd7*zwZp?{xZEGn>X93u&8xiLV2{W1=4xh?y7Y$_RxlZA ziw@$gMD=}d8k~GVVm?+;(+|Lnp|&^;sHV4!^^Wi@f)lJULXYN4)&om?)jI0CZEt+$ zZ*@EC#}CnR4yi%6m8QA6DzO~_{~VJvskdkHdahP2E*GNbR9d!nu9euhD&`FQ$5x;) z&*i+`f`pb@NDk@K8vC5aRo_0XsoQZryB)E2?a>+;c%~N^*%k!F$N6yyOD8`n=mD~ds6+W=d zWhYc({}E$)sMQiMR>@HUJFdGCT@ETwx6KpofQIpKA)hZw0M44-aexHPGk{dES@-+W zP#dbO1y*ot`weZc+8p?t1w_w8SE z2gqT~E7SBh#WL7rnkwn>eO+%K|g)a^9ZBG1BJi>)sV+I4R{ zs?RZ%p7h3eZ#+=qYM)AZ?wcKa4|4JGLYn^(CgsRfwLo$oL-gu_67hiHR5XjHWrKtD zO>gcl*dIWoV{asJN>Qf?k(52K(;c&)Czgp@P7O&otQmG@cm?rwzz2T6eAB5X{``^( z;mQYi8U1-3$C=AgF5r?^|EEj(A113hID_%W5u{pUtpv&EVj@CeIsz#of(US=*~C&6 zclKcjkk@gSB2r;2lZZM8Fb1T7v7;D^<6r@9vLc9FvhG(0lN^P2C^zeDKhJFueDXi? z2?Npr%uocRc__wfRGBSGxi^rPWG&`I<~voIS^R#4I^N>8&wdIXEiYriFXkVZSn}68 z^J{4X8(yn&Un(MgM1Od{zJ_sPaX|4lkrBE5t!FtGT`oy?T+$8pu3iIE;b%Rt61{?W zY9b#UKIODKLj#o_(JBM_x5<6q{+OBq8H!`81fF&%RZy@A6PfM~A>vtorVB>l(Jybb{wmUAOu)qp2?tOFwDS+#j<43R!rg+}Un*V8v89L2riXpV@d5cM6 zxNw3lWfFhkw=T&S|C2gpvY&?G^&9s>Z^sg@UW2^j%g05xlVjWv-8RzKfQ&p2q&ca^ zUsOV^{ZH%s5#FN*i;+As6hzncM@XC|<4>UhVz9gRpOMrE{6rlV@8fB-N8E^pn_&wd!uOTU4)(Ze@Im*8%U9H6q@Nr>% zbzJ*dqNI85uZg_VKGOKzZ)tRcp)LC%0Qpy_JN}sGD+Qxuvw7|Ql-{8_Sl&dOVA7nc zHw%6^%?2oooK+ha7CY$l3zaJ#4{t<3Vm-9*^MIx#n#6pb9H0xSavCtAtQK%?M-)9G zr@{W}dLJWLQTY!x$#lZiZ8 zx&S5ex+3!0tP?UjOrQ{ev61SLRh~B6hL( z3ctS{$;~1?#P?FfZBPa;!dKvu^5q4H8#yNcM#EYcEe}eY8_2MXqII*b}ywu1jBRd<5^1)Cp+!nL&#|hlIKVA5skX%LIV!%{7pxr@jxS z4{?Fy;BUIBVt2R6S_Pu8G|$jy3GvG-A9%qL4y|n#fgQS^UU*n=75QWqfMOgU%6Kev z3vd%uu(AOPg*+6PyPIr_J@l`kBt*?&fL|9o56iR?i#Kfl*^3u3IUt1-4PnbQ~S zUuFwA{ST$Gpict(*??uw+Gxth3eZ_lH5nH;{sHlkDBrkJ%usld<>5e!>`>Wec1kz zFBn4s5}tl53hU)dk#>UM3FcOEBCDn3qxy{`gm! zPlog9fh#E0Uz9A#5Cb71mw+ z?)3Zhz|gHT)OS*!r9{EZlIyp@LA@IZ$cJ@7})?{^Q}g+_B1A z3UlYD&52dM7+Dz$jTGB9-SI&v-7nD3lS4Z|-fj$=sth(r_3u>HGeUcYU?4%DsR60- zT_$EDr=N$T(rW73W9`dx<_yM)LTR^*PfthjY)I{ zBN%51+L8C{0{kZ5m>$(HK#|@L#zAp;YiK3ypLXU%i$J!Ip zugMnDwK%r0OD?P4jypeY4_dtS9m~L%SVZs`$O6hl5859U3$Mlp^Z_;cA7viysu4#_ z!_BZH?~c{0zd(4kXprvysS6Py{~G{ zfGEBmw0{bC+7faG7|_`mmGT70H8;%2t~j;q?!6HWpy-bAJ(?-EWX;+=;E=JZuQArL z&*rsukpIga;CNauTEY7E$0WXtN>3&oo90`^r zztD#Et~O^|D4Um#n(lRVP>HSZ%3+Z3M@aUvn%cT~Yip}p%jZ;gFA&p@Ay6bks4VW= zC`INUXMXdqsV&-IJd%%k%S2Pb&+a#i56chVo=#nYqrW-C_KpaNN0|M?;2TjY=ewc0 zajVsnOqLqH2p!ufD;2hepNYvgNF7M7@c@vSQtVKV-YSx${3z($doa`A5YoZou@fob zT2J_Zc|r2XW!O0tMDiz`8wc+`IX%?_1-IrAe4{Lj~zmeaOkM>zxjr~q8 zWJnUV;O!P+u-rH*saB!vNMJ=fgT`El0Z|Q>_UuR89sQT`>0|EYBMB?le5{7W++)~h zLH2u0A=hdopI?69n}JIrx-{zoT$hh432xV9A2sFhdJzx><1GInY(+t7`f28wndYTh z%GsBzDXxr9fa=hK?t7S8koh+hStMT`X4`V!UWxZi3@A?v7Tk3*1%da6vY7kD#x!HJ zzi39&KhjLz;C3*>WOjTG3~W4+q6VatkS1MPoQKE-Xq6Zhjo;!EB>xoe_6;R4BM8{@ zo(Q*(_sHhwmiyzppVMI8;?UgeG}67Sf?_BpDUN)qm51K$B>ATC>gG zdV!(-Se`tF;aX`cUL#dnBU`iRGEj^wjO3`VSK_J#r|G?08G1!YL}g}teA6<4s>`{` zfeAmf8}K1nTbn)7NgoVUm$D;^Gi1VJn2Y1pyhG`rnQv)>F__c1<%E+J~=$T zqZcpir|^$+`SLGYVii=n>~%)qQ7L^D@-6cSP z;Ly0cI|PSdfk3dvJ-E9|<4$mQ5-hkAAVA{{jYBTq`Tl>Ld!F{&+GFiC_NuBmYt90k z|9ISB_%c(`lXV(=bmoH2xT#Tn>tDVmDfU|QJ_L=JDN=Kl3S8CXM+9-p*Ifv18=gwL z%Laq({iuSe`7v+I^B+`n+Vm6{jOX*kmHRvAk=0!D%8wnP72 zR+^pmge#EupRW9;$iSIx|G<5PoULjr>$8Zsr3*0cgXG36BU`sR?R8q8`f$NIRn@YOo+C}yYEk;NA0Dw>k4QTyHF{AXH*7p)uZ)8RdE>2Zc z+Cu7(2SmGv>EVDshN@wOFqU#VKi7K%TE3*;5s13WJM`I#*o1G`XpJ!q-SiHKF?^*A zb8ow&?6DpHF5~mCyGrP?I`o8yt>>RNke0@h!lc$<_4)z~C}XE;Tk{D0R>_*ebmZwd z%Mp;NGKf%K+iH3?pfv4$#&cz^qhsN7h3%!NlHTwq)($iJ3Eiys*L$VOzNeyEfL(uEz)P2SrGjTeS@#4&4 zv?no)$}3CNcm)QC3L(S?(YuAy&aU}_RDG{P#*;60M&8?FaZsZ|;U6ZH`GBQpoj;wn zLT2$+BB?upE1PDcv`)9xQY^XI0zdLNvcHSJ)Fk-B<6Qw$d!qdw2N6-@;+3@G#LZ9 zh?-H3c%dYsv7|py7|>uALfpz;p*&Dg^nW5O(wF2m$WyqQT}7jzCJ_Lc10o!3oU(2i z=_ZS7i2#gg(tC}z%V4i;%kMn#@b3|MQkTWdlhxT1(h~+y_YsB>7zC9QSOvJYPp5ol z(pHFnwpD$UOC-7cU?>3!xTy$q%4x*f5j~|=1HWAw0C5m=>bS+MPhr&>s=va!wFGyG zbbvR{&P&OK{}A#F$F{A;Xi!)%OO?`X1xD~7bAQkohLIl=6cdjD;lK(9lNO+;Y~1h@ zuQ)t-ui$8hA~)anQI=kX_STmPg47uD_+DXu$l~cU83h^=4*+}p=o{GW&A3`jTa&OF zlKD0;!3)^|U=&&t#$u5uyFO#yV31~Vx8kLTz}?PpMC$lVv$~_M$bc8xB2gRr2kit0 zfoWto;yH{JUD-l&RBC>20K-A`O``;1S1@NX$YgFCtI$`sfn6XA9#r+~^))wvKKI41*7Ll>YSFBdzK;Cg%IIPv+;&^8q3yhsB zKCH@C>1Cc68-k16dJ(QoYCH@c)F(jv?qf+0>1>GNY~X1j@AHrltylv#>N$N2bt!)e zDuApwE=yr&Yw&e9dWJ*w;uOLcPO*$=4TpF$>v=x`0-QeDQyGw1L=WsE$Z)d#Sl4k_ zDz!mvT|GWL@)2JM5vZCJy(S1Ay91jIAf$=IRw~WX5?55n-s{x6JH^p#T?S!7;BUb_ z{i(hEJ(P45O$E;0y&=0UztAygVrWl0%rwPH(hu|H>FR@`(4BX;)gf4F8yA@v`>%He zfj7);#s^z3o6c)Xw`i*&Hfn0q0PSZ@qDiEO1To}0_(!z9ECn>C((yz^wOg*)gH!&Z zqGikji(|g~OUgUhI_Ak?J3PO+Wku7qS8#y?5LG$#-lWgVe93Csn|j_O5y)UFQIkx( zOb~Wo5WcD0(ML!~M1ppoZ8oNIZYkOSz=}O1z@&Vi;}r}yqK4ecYEx)>AMb^r9aT?u z_D}TiA^&8fs`fCF?~hr~S|*{uLRW!WfIGHC*3SU2sSt2#Qau-S(~5S9cJ4?TotRT| z!5gDlohELv$W1qMMoGVC@-04w0oAV^@gcBmSN1;|CB+rc-mu32>k% zcZQ{jP`pboi{#V%NW=V~GyxudXtd8-#&Ay@;m1{>P!4nPl%pPiT}j;0-iCfh1~Qsd zqGANimC9ju1cgnA)9_`{?P5cbYy{E=WTI=Q`IFqk5AV$Kw{doKA9K~!v2ib2KD@AL z(0FVj-61d~u(92)HpfSIS zUpZpzw&-gr>ucMwGNTv1opN_96B9%B;$Vrn->}!7&6gKB*uny_FLHRd6ZY?G+#Sp* ztdNC<)C@`N(3yO$7VAN+Pw5UNO4c-@O3|0(cGKKk3hAuS9}eiTf#3mf3g`cN0dV!;%GpXG^X#m*IDGfN zo~tMMGOEn4tWp8?y-i!*<_m#o)cXF4qjGi}-4=g{eea4HI8h#(sDnXfcs`x{HQnZ% zg-bwI2$5sq%?{13A+SvnCA79kIx_PBWh;}#jn;{#UDK8K9$f)zdIm1bqh{IngHBU$ z9~O~j^6zPkm;r<*baKV;*W(C+L?=9B|MNUXI&4sOB5 z8C6ou%GWkDGs&vsjrj&&3xc#9fHn=0AQZDwmUxG6$m|pe^SD!R$e#g~MXnO5bLxZI zGoO($P>6}Zkk3UA9(p=@O2KMuiA))4iEow<{~SuGO7Vv^6J2^8A|AAgm*k_PCX=ZZ zTof8{hayR-5L*KhgTROO=u9LUh94dfT~wByp8}ufQBfcoHSZP-t8Q&~92D14WXWE~ zD`UuEp`sx;!4yFXt8KL#Oo8ocU~0tQyS~&Gt?>J(p@%qG)uHB$2aUSXbFV{ieRjoS zmxUlm7BR=$%)fi=6fPO+J|HR4t!VZP?L68>mIeavq_pWVHcpxt{vPyqvP+Ochs|wV z`FYhsumGY>l=~yw9oH$T`;8gkim(`4eQIEw9)fUdfVyvOcOs+OvjNIL9@AbtGQOzF zHcs377_)6p`7AB`$wA6O0=YevG`I1*aOP81P#+fn6X&fuy59b*EHAFTW{lxlE*dl8>CWHKvee!N9s?kb53n*r7=;k_bYq6N!8o|uK zZB_)j$wpJ(XtpOl-@ad)$G)Or!j3{2Ct{k?_$@^?SCI*4eISvaOv7@2H6MZVsSH4( zo+qjq@UVhU)Q_Xfb2hV&{8CVmk0ur6VWp0jng=pS>IdZnM8yve}JqCu`C> z4+b65XTID{*!|*4^^^C8taAD%3}T^U>NVr+Bs>uVTSOk7U$$Ruz7d%SfYYv9#n5nw zIxEiGcDh>7XFf;Ku7y6qIjeSw-aRW9rQ!Jg6Rpuhl-!h>y0o&HNKP!sXtNmc~g)kF+6Q(QD5j)Bt$MbzCmXT2gd4uH+B zD6bFG5h(46{tJ!wUyqB>{;|#o@o5IQF>b}FnR+U}`8v(Xkt!rSYicjl#K*O$&b4x> z-dhC)_*gN7FJ$fN%|P+dnrurb(a6_C@6k`oztwBa8v+$HHhNzdBWnw0^?l17w3*jr zSkm9vg9Qi!v7VNSp2x-h>rfZm@}$7cX0%u;^yW z99Vbv!`f7}as9NPhU5G9$jX0LR)0M(abrC((3A@*@=dMq1y%mctJB15CIbKc`P})3 zQJeWe_=d`Bm?MP-?g0%CKTF+yR(OlD-SwISt)O8Sl!EqWqH20%E8=s(1g<5n+Zp%q zQ&&YnGnzF57ZhtmgcQW8utI+&ZE1;CT;Np}*Z3UFB9DuSn-GUGL$L*~d2B@-VMz*w zo{PBrm}t*1^O3%2UX=@5T3R&fhHp5G9PWDKtt-V6dw)@J4$rL6NIwNTViD`swa+ zSGrUEN?DhQ_jP9rW(<10oSqWPXtNl>p3&gABC!i%OxbIOftWL&Nd#P4o}cv-)~(TJ z-s|aTBow?p3pkGOR`_Z4JcTXyQ-hS0mDK}t+L74~blm{c;c(6S9*5IuLLO>?l0wTL zUi0X8Pz4b(@Zph%x-auwwdP`yBcgAUzxIxqoCc`A@8sZ#kzflH96xg2;;8(5VgD~Q zLkIe)VQ7j1kveL42PuoV&Df=PPQmInG}9{amoj58galP0n*d@#XHXuK9pdqUBswO( zsk=XmW#)8f-q$REbR|VYv1kQ7&}S4I4L|IE+LS~C)xZl8v&M~vS~0^tAQd654$+`_qCSLD zPi0r)BjO`Z?xRb}8hhlO>iR$ANRqc9CR(0luh0_8_T38`ch zSW&^;UkoLCk8!X(m2ZElS(@M7+79uBcB+|5ltx09@GRzA(YGejFR(&2SUHaj#ApX& z?;}6GMq=6b!j9;T(s3N7ItHSe3Ij^&=kGMzQ%C?s5)A6}1udNZ>Sj)Mct~2PmI?e7 zuCv&!YZ0;`THlwXY@e4(0jw5la{JOrg%GcknN8NNIi z0joGwlB&17$V$h#)&_$ajzp#jA;>FyrLZ6w`=G)VV1tN~-h{^&2O5Z+c>6ubf^e+q z(4;U!AS!5dagri0NuNVs3A1O9t*ZFBi%)Mp;k{6D(7J&|_KEJ$r!gxXmfJ0r0vU@o ztmb1Cu`kQsA1!0-cc{<(ut&fABeLM+?EA0um7%SqZqHY?holAbL0f&CT|sLSo>V%p z>gZsna~&7 zg3nspYWsY0EZ=~E%*;fAy4cD9@2iOW7jNC z-!7Kd4LiR!^aI9=OFz~p911++{0q<>xfj)~Rq++}d1Z&Mx|nCZ9h9imewMniZFd#P zrA2I*bjDpzY4%WIA=-~@CX#0LT9Ucin;&rJzxMsm^)fc1JJPx$?p-Rl4AW=yOFb>p z3_Fu8!eG2O$<4RXux!w`fPs$C?G|QG7Mf}uN)!Wv5HebFlkODN#!1N8b9vp(+|CxM z$_OoVR@)45|_xOt!Lipf$cz#zyq@V2NE1u3;Uhg zR;#xi>LeEb4$;jSjq&Yz$(>9CV?kjpEoui-hn+j{-B|7u9Vlv%Kyv%da5gAljDKrD zAvfbmH0?LUumF8*%u5)CJu=WJeFI z(&z3W4I;f9ZZskWw?D7Ss~vjY#3;mD31I4%q;BtoeL=lwB+$q4&=dHYd#o;2$W=_Q zo%%u=;YNL3>;5pbb*b2_KwY*!`anH={M%b86Ffs2d=h7Hj=7P@cE1gESH5IK{*Xa` zB_*hy5&CB+YQ~%!OxunTh5$*gru~2#c+e^k$AUT*&zJ&OqBSV2P)>kD+(oLgpIVaq zC(ejTvVfz()~y<%B|#?X1VDsYJUzVHUS6+VY&S``2G3kPQ27bnO27Pc_tqoIb#+{Z zr%O84yxsnYI5{+cMO z*lA@}oxsX&efvkCFhZjH#tB!sDeCOwfc&+pLuB{@ET1MwvmGUcuV(~tKIaZeK_LXS zc=BfdEzm7vBjB8=c+qU2)@pRNL0&s>r@9LpN}~)xc^tDh6Bq-nNR7*Xm89Rk4|}a_ zx9A(jH;WI?obE>lov=f;11D;@-I%!CO_*i;<$BgOw54K65JaE4)etd%A1Y(!q{&$P zimIOz*7hSO`)t1Ou;b0eZA7)FiUp0y^8-L*#@{cXyvML}hUb(QcUkPNZ=*o-EexTs zRa^@J@s&{)T!{&1vvdp(Qz9=sUQxMStf0|P)K&HbsXJ7Fw-Lm-uWmEaNu0}pI17Gg4F;0XSebFi;?{{wCO&i0|F7-%<6Q+ z38^=yyU80|%JF>1^W!hZKmDTMv8;KaH(wbtiDsFhKl|D}z8itop9E zrhT7MlKygJaFFUc;a>Q8h(0x`5KwD(7xFIT2TO8H0e~k2c&K4A@EGY=G2w2VD`B1d zsPhVDEC&YSe!bBLIrm3J0hsCD`4^45Pn5I5yOEP&@Jhd|9Csyl3QSD%slaS#xx)cq zbzcw8XKus%4RUw*KI!y5WaW|L6mNwl8JN3zL)hNewm#aj1~fDdg6S4>Z))M+cf_5T zvN$q~`F$)yk(H4L2UPlD%W)DZ9Cu|s-yAh+K`2-T)Ww@2x1!sf$PZ2X9oiY0&45SC zC*^S> z7@GDdq=~1EqNJnJy&soJi^M3P>}cDYG`no>;T=c$A1L8Jzo9zL4(X!H{gaog+l+F->Tt93XU@@V;#8_l&ZBa`Wl_5F%lRc* zw@&o6*lU;Fz7=L$crwZSB^oR~Jm}P!4i&A}8=z0eO-)swLHDVm(VVb^K|wtv8bss} zntY<1QL9rw!GA61|2$z=W`YRIb%kh{AO2WGA^O+#UGb!af)H|nCi$3;JYNjlNxO?j zUZ5qRa7K>q(YrcV-QMvnuV1>wtIsfd=y_H_Bq&;8-o1<276|yGZ%JqHYgE<7?)}=| zU&d$Iz!NOus}Ux#i#1rzPl0SW1@9KK^P6ns#3Ag|7KbS!n1ge}BBtw!mbd7_RpCfN zmjK$uSAP#h0Oxvf?=W#r=I~&j*T`h+QXdyT5V-aKoPgAv4X0s`x{|d{>IvFdnd5O$(JC?`fSExvB{s~vpY80aW%9S?<5x$a10EzaWGgl7+qF7H;Wxg78oV4 zf;&-Fnw3gAOQ>WH1gzGqwSDncKF<}G;gJ&yQ&k5IhKN3`Ry`D!_Ws-Q;|RjmEDVjB ziNsno+Nn4K+dDXlJ3X{fIp7zU*yY7co3+_gr#etgL@SaV1jMjL(t><|v~vOAX4;+j zqsG9;&vu)vAio|Fr;(-d0$Phy zA}+#El3u-Gz2k%_(JRS{!Wf4mgar3;|4lH^M#BJLp_h!%rbZ~)%~9@WKs|~Wm5Zw~wG&j!5k9VAvtDz9 z>_-z-<~)n*n4hGPW%(r{)0^~KrpaEHn`tv;IDUPq-IV;flHtXCPY_%LCcdvTXdMly zD>OsWPQM6UXVazCE-#Wso(e;=dXGai0I&a_PV8xTf375mf3SMgK^JbAG=~7LC6SR#a*} zJxC%T!djpC!6@v(-KfQiK@#1C#Gl`0qX+fk8|a+sE^^Co9pv(T>3&~p-f3BuR8233 z(OUSHGXYHLFNx0*oX08{*FyM9`ZQ-)eJPaO*4}Ha$Mpi_jvx;KS!^C?_DD+>GH%p* ztc5Ym_C(98_g@&jjF^-)gi(kD41nB?a2?-`GM`YKrSj5`WKca1c|oy$KOOVjERs1) z*Q>a>)E6hw{#O3_wsNSUcCN_4R7b>R_(?|akV3?^p|eyg!SlK<;T{Q#czr8oFf^(4fB~At$dQ< z<%$HSm*@_}5+ZL+9j2@#5RXs%c1`C3K8``l>I2nBQ`H(JjlEogV@ZLl(>~%p58`ie z?LQ@Ne1BR9+~lxE>bV+yrl!U1^R8c1T(ubMKPv`C84TRg<+^oy0O^1`O&CpZ)n~_8 zzHkg*bHV}!I;9e(1IiFZn=KR?;_dlDGb<&zEU}>!bum}SvM{Xa;3j$2>*!I^~l1pegS_BA( z0@&A^R8Jm)lR8P2vWuY+fY6{wg~)}Rz8$L}d_w-PYZ*ou&6=72gXa{Y)Rz<1Mf%c( zV#cYsDBtU|JL}M7PaK;>``X$w9#b@4I!Ao&xE)yl*Zva=;}Ws`7EUO~b>PdL>y$mC z9ts<-ilMQt=J#6EV0d)CL6K6br`b9?l{HeMRQph;P=(F%11mguDK6cTH0g~`FvE9@xyL+_|hm&G^n)}cyAxv3U4iX;C=g`Un53)$HU8O^SHn&1uWc<2@HH4 zSx(I)w@t^#>0YBr|K@GzP?F=?IpBtfJ?&Epi|W1|T_+n5pNZ10F+ECQNfB^aqr)Ff zX#M=qL2TAqn6j@V-U3{B@0^f_Y7@-hZ>|ev7#}DM#P@vOjeN5dY8b4;j`G8M-SW)F zmf>DT+kcV22DbUmPXqLZ^!|QZ<2v>$ktZ_FzY#%QZT&1jQl#32Ly#iAMzSPN4k3@* zVCY|qye6K!ERtRbv8pgd-&gJsaN=k_$>=Re5mR7(A7h>Hhj?dHyhJX(!M*!_{$#%L zj^E$7F_;G7rJUyx`lK{}nB{w0X=mQ>YE39Q2Hbc$LR1OBf#p3)*+-hoMuc!@r-zP{%wURC(n zEKuKpyY3CHV{h!!zyEo6Y(lLxK4vd6C!aM;TH1T55`r5ZP@TN8uju1IzH%{OWefUn(XTFKco&0 zz`G6rv=e##-3wg*qQB;anoBA2ZQ{4m>E+M3gzp(o7hT3_v6}PcVHQ3QF7(Q@LbNjJ zRl*ky$(@90X~}i(R2A4#ixR)$F#p*0ZLY-8q?2+hlG(rbRYk+Oe0`%Yg$_k7W9jY3 zaW7R=I<)|~m4`uzr0lx>B7M=TFTJy8^sD}=_$b5p6`7c5Wu`9A?`uI`)$E4F@aLKtH^33VN7 zs@hoTAqvkXp?Arujw0NLx2t+C(4bVzs8S2+N3GP}?S@1SMZ$_7+rm@hpT_U@nBz&4 z-eqAtVD0AR=QBMB36-nJQL2iwFW2!Bx;7>^mx^_|f@?I5mcHoejelGt!eg1ueWHC+JC|6(zMFLUc4mt*yX?!ciK}cLDB}N&DN{LHURU(V>K0g-8jHu&UJydlPuIL!`vSdDm z!v#v~G-JOcpuy=t7#^8!X&IOlFD2~eL(#CeI%rLgjc*tqsrE&d)86&Oi5?11X`Cvk z2uhlH)i3*Cy;TP9Mg{b56~8%?5%INlM!PEeZ5G4s(Ja%)qBs*f;KQ z5+?4=7Kaq4R=^%W?>%5&%x7-QQ1U}5coy~Q9b=MVWrIH9EbxBsf`rQ4cjtSR?Z4We zb0<+xcvYV#WeVgZ^J~{>a*sVWQi@xtgN0spV|_mOZIz8<~`x zM33^VKCSLnPn#8+jiLhHZ|%%)f@|*OdujDv)YrBjxwq~s*Cse!ytbR1NTHDv8~?7B z$*wxrwrDaqpZgJNQe*RK9=uj*9Bx(=c|Jigbk#oNq%&UI?5(9Gr|7frx^^g|m`69+ z{1!HB{TfVw$-X3dxS~w+B%#NAgttWQ*_ZoFSGm$^N(8!zPo6a8c`0AFzG+u{MA)X8 z0=_ET>YmSM3`OOS+|2xM{_xiQg9XSuqSO_YqIy{y>ReXzLv9vQa|DL%J|K%w1yAhl%D)Gz(M0`j`>yxEj*hecCp7X5B``;U{ndh_-z?&43^4 z7_AaR6R|Q%SL*&t(RJQz^wAz(#RY}rPPbp5o1MS_a^+Yh%V$TWnEicg_PGvC!k87p zFuZLfAWpAj$d085Dfh7|0&tvF%Pkfp2*VCDxqLZZ*S+$EvfIY^)*KM)Q+5R8`r6{}SSJ*X7+ z(jbu_6`=h^`66#Bgpvh>9-zdI+tR@W{&f|5jM^pH4{3*gLSHxMjfpy9zpyV*QHcHV z8dpW(WVJAA)o@$8=;+g+{$9pbrGO%L=@Hn*xRN9a`}tkYR*q$qMsNVCj{uiQqu87eVO8czb;7qTg3+J#o{aVlySO?`krS&a`t;dY9mtZkq3@v z9)oUJZC-bZk7ci}gQRteVpKoniLldL1Fx&Su>H@&^yQh?pzvl&yZb9NRn3yQ;JKY;a(re0#T^;MF?uN;y@g zt9bMV4BfhW)v-1FY;3pgt}$+vNn?*>kP|z%w6ug>7**D-xsF})OtcjjjWl^3;H|dX zc8K1zUMSWjPh$HYtZSJY)4TRUTY6WRm3(ajeGJa{yqq=}sC%wEOJUN6xLoG1k9Ujp zTykc%Rh+~B7Xn2F8p#s4h?cD@2=RA@fZ ztPd&@>5PM+8Ua$76e6-QyT2#3V79v4B?L^8VFP8cq`X>xS%rr29^!I-WRiUWSNYQB zHN>DoErrC{v=l5uHYjzH*V5BZN<9-$Ik@mxc02i`u%Xw}Jd7-rd;i*)>afMlAF?GPi26r)5? zjj!`EspX46VHp_QLEsT)nX=gP{d2Hw<<{REyu zFf8?4?40JH=RJ`%$$uYO*<;pmt|;jgXrIg%B^<6GTydSmbc9YcD&OB-r**&dkE=RK zYMfj4xjh@O)B}FKHGDRB7m8Z6eA|XU!#9>9VeyHqO1;plHDjL!i0fZd+qe{uvt(O_p_jeu1re(!VBMikcxj^s@2c!U`pFq_GsjxQ44G@ci0Al zQJZu7tE9VfZ=GvYv9funny4>MXo{NhJl20zb@q)c91eJ`B|Rbe>?OH?oM$CAuyN_9ytEVpX1My1G|zJ#FvZ zz-=EMJZhQ2+h30!!Q!5vFw5SRFEL`QVa6G6F5~15@xByz0jtoozjnWR68$y2c?|~} z7YM6q{ELp8H-=c4m)LKBrzYa}_PuKJm;&sXC2S#Rcu%3cW^*@(kN@UoHjgX!iJc8zll}67JhKk#ifgx#SN`X34&N!GSk5n{dqni!{ zf06ug3YebS65xIa!k#*(G-eQD)J6L%Ncz#M*lDv}PVo#aTRuDKcg|8}wgi4CrMf;p z0!GVu`yQ5QvdDfi0l}Y88UYMwH_!wxN=#dRCtE(~Nv9Uig_dXMbcQfLe1&S|T5&O* z1%XQ+qG8FXHId*pauJ@NW5*BRfv+9JSDv_nW0D{q7;uOAMUh99@-Ui@#ga0@Um+W2 zq@>vt4A_(<2YD)GH}K__?FlK-x$1pn*279nInAjqRcZ4bv=j@9yiOdHVn^JkN0VaK zW3C8wmmJ;I{!Yi=FtbvreCnfGSzF!g-c(9?@o93aN)L{`g~IP6m`wQ}ZT)mAScD%b zjcgx7iU`}{Sx*zM$tnN3&ZKqC-{>N{1UBb-t1IO21~Bd6w9#`=~+OwL0WYK2Mv0K`94N23M!M>xCv53O@!p{($7PQpNdAA zys5m~<0E*;!{``NJ=f6;45HT&O-H*MSxsmr~%{r&%r+Y+tmZKjcRaxX;q?Q zcj-GBsf_A(k>e#?I~OXKVviWH{Q3S~fL0AZt}ULH`~>}|%l`um5de#HpO)S34vF#^U?14khfKK+UA$OHQt zXVT@C)S6%bt=U4?LLez!G8(>U9W597JNL5}k_0!=!mPp~P~&J}EWim7_#CY1W`*xw zF4IQ`NB6?EFs3CPcp{YCsxGPW+qOkaMmQbUK&|jJf+75Vm^$x~5c~`9kcr)#{4+I@ z8sW}azs9BOz;^vmZGLVcH3fWc7wd3p|Czw1eEXXn6CQmO$M-*;HIj%l?v zP={T^(ei5`@`>mo{KoVV6CU3Ig#f~`)HtRv|7ytNo7yWaw+=ydGSWCedC7|=d2|kN zsiRac*r6I{!)Pc`#|^_x`;n(y|2`kR1^7a>j&zs(dl+w8l5)~_wwf9<$M>>5i=1!kbBtvw^#pl)La+)(Huef_9lo` z;Ai@7$!OK%{l^E$k3g1$mmBlg)7QUu|4i~9VSSbJ-p#Q(?%so`Sz3J7?az4Y#!TszG1=S-t@to$JcP;_t6oC4A&D;_TaHzKQ%7 z*ya=qseL?!s0M`0n30y#2-%iFd9}`wm6MF-OBE-&x~WkeY#mEs8V-}`H?Zuf+Vlxh zTGlE(iZQj+^kvcCx2k5|LOXlA!5`+o5R8tPerdHXk}&y~k_={oGM$PWPI9248uN7X z6F4Ro-{LvBwD~c@+|oamLa=lz8im}t#uC5&{+9nEg-h#mKPp8szNO6q4#I{_-Av7hs`MwcrH#SKH(hlZX3n87T0m z6HQGT5;Y#G8j|C9VI0i$61oXr$}ze{83`PmTv80qX1+A`^oetp$8OlsLQwPX@>~Oc zDdc>gxbROn5SFWaTsv`{a{e*RGoNgQCX-Pr-q@VB(yfKBq@feTk~g)8NT$30t?$J? zO6Q3J9rG$iiH8R2XPim{M>$Lflf?CBEPHDc`p|J5Zya|jy6rAWBMmKTc%A;y>tcQI zM$opN-^H(qyMZ>#417ADQMqw1i>lhQ2&|e$Q~nE`{!c+Cxie^3cP)s{6^)xTS0z5J z?+I7&PS#nSQiCPBvU6We_Z`|qR&sg%Bsfd)S#9oxzL*4@pL5OBu$BC9aRRO7e|Rl; z5y%pR$z_RJr9WTxz4mOlT~qFthsGYcG-YJKG;n%RuZ{9SW1uzyTxez!*5u?zzwdIo z5?tQ@Fm+)J)qzcG-r#TU{{F=^#yu)V#!>NgG3cA$9#wx#37>vks+%oy6DpslrB+{N zMgSk&QVUur9VnoK>C4$xyS^2i>U<=TjOAoXJF7|mL7c|Ay2|oY{opWfAtrCLyk%6W zh1b$rtGxB#{T+8iY$lZXu&SvCx;0-!2cUTS*d5o2(KdwIJl5)h z()v7is0g^LA;X8S|FzE0mDas&?qRSs-{y1t0+SnklVGb95ZA4-8hW8K0X6QQ>%ys&>12~a`S27i@|8-}Ia_$>2p)|(ONKh;FPo=fT zqk4bzy@_(s%JN7c`B0-jynDdrdhbK?J)5s^J?FyT!V4)u^tt~~jZM4v17itSrq17c zxmx^pyKnB29wSMUsjkp{G}|Bj+lM)*eDePy_NC$d#7aL^G0AD39z*H-SE3}+i3sKt z52m)^0_6U;BH1C6*ugXUgu@{nszU*E9Jr6?TN?jjnjHO0*2FUV^(JKqhQh$>7nU>w z(>-uZC>nS!-m?xuzWglMt_;c~C-~D`&7%3m(;+A>&QUt4Dqx&mJ|RO=$fwC>$jI<= zfV}Mno6h?s+eVMbi8nb}+veYv*x!=aJ17HVNn||B2PEhk;rCy{R(}?!E{{2H&}*l+OJY7)}bSJ+y08Re2!d7Nxqmj71hP> zx@7{F^hoxjT`84Oqu~M+GFXfC&gakKR8>2_rk9P#`-$~qpnRQq6^6Bm(gxn_@M)7I zkmfsA{f_4}z0J)ooN6tx-it@%`D9(kn!fC`%B-BaP^%T{l6OyK`=9&`t^HDL9vKUMzH9 zrG@=8ZLzKRtMBm8NJ-~8u_o4}b297Ju6mNl5eYFWb^6v?S=aHZX>uW?!5qq?b(;Hq z`HX*Ftl7MnjkUzu!zb)}-@GVw5qbt+PX6UjRpp*0-2hEtT%bWM zTEh}apEQ%P^+J}t8$ox3{Ri~x%r`SEVmN!vGRQMb9;@CO+5 zy<#c>uJ_kU<>fTw|H0AGC3lkRNuBhdfZaTKF3)~IPD%R^HK^fSeO2GITcAAS5=8hy324%gFF&ti3+PLUb6Yv zHC8pbu%r{;vRP;RW|57THvxT} zcjn>a`mLa?aGX^p>-Ahs?UGu*DW2m5B@1W110_IYQGi*|xyydmX{nu~zFI+?Jd&fWYl%v&XBnYfZl8UW`-*lr$ z(qMdQ`<6K0y;Y^txmaCw`*3nU-QSzCjj8Bx=LEd{w9IIN%S-h9Aw(zG-%Ph%v z0oUIy#rmGuG%-_wYe@XH`~=?|t#%n!_fA6dv(mh_jBBJX#a;!4R*M&l4+*=m zm!AE?trd@!Sb*llpUUnMXyS&b4Y)F6l{lQEw+mNE?v0@}4^T*)NG!mqVyI1y<(f`P zSU%PI=#p<;P1YfDEbjkrw~12DQfr$F%+_hH)NN7np}Vke)sle?{@rRPNFAts^t!{& z%XpCLOA>w=FBZ8^ey7Hd@YVYj&gah^yUlbgu2yQ!r^!##%QdAJf-tIps~6AY(&3NR z?31UkDh~05w{bnqDP#Ln&cEdpv^~0>|BNuoX-GQ~AC!_eQl;hyhiHc3HJB``zCYuk z5mTfYJ<%~0QvwwaASGCH=YFVD$OqZQQ7pY^#7MKDKe3 z7C-vPAA`WPp*wcC>E^k~t3rs{2j2xU43aLJA`+RYQ7!S#L}gES{U*8Te`VQ|)H;)y z)rARS)|I`3(on~jU|T88ygccy(n#GpZ#ueLNFE zi!sdqn=|~MmZ<;fjQZ~b0l+ELh%xlFr9}7a{pgX9x`OHm6Mg)ZNqmfIqPS9(1jCPy z%aerz_+Jae-P<`!^&+0{oqo&y{Wc0UvCc1WMiTom6(v!@mUbl>c1mx7leCz%5Vg=} zNEBE1qo-tO;gSH|#^Yhyl;`Ua4tn9zda)FbrS@fit(Ce+>e()u*0RoUg@WDqw1{0i zAA*nnmo_99>0@%-IeFb$LpkoicK;lIUBX_`d$J@?09$C=+| z!d}DRkq+K-98yjxcSQkiDziEz;-@$%VRPMPoTbz|Y_&p@sxRHym7w}Q`kUSll4#D| zrHwN|6z3Uat~TWy`#IpM9TC^rvNxlwh3n@UzUG#ouX3!E`70SsL5N`|&93zy zJbCYE!{_l1$3hsy7zf6`)-Z@0^qMN3(z{PB?C!3TW_{Np4d-)oJY@lM5z#~#Q^N|E z(c0!UJLD|z1sj-0D{Qy><~~LD@?c<;U6qERIa1a{ zu`12P&N{!GnqT|NQ%m!<@x0jpQr(tQe2zyn)$9e}d>4$x7`t4*4GyLkiCs87J)Q4Y zP=!98)K9rm`>BY(dM7~3XHcoueUz^EAkw!AdK1*S&TVo z$BWrLUTMTn7m)d6xBR8GD@sS!J-y0FTJK$A3^?NIm9o@P_c^k$m86&m52t`(T4l1U&2m79QYzm7^2IXjL3i zelMUlw1u*=%3Q(JKaIALcApi6YG{SqtlSL?&=2ndb+afi*f&O&17NtwmWD)GxBn0oeS{`LBr`Vyu)E$hUvxod#6ZbH1pYkISeT=azN#q# zXVlg@P_^ViBvgQ(VS%?lrQ4yPP&`z(1Jh^AyIo9&Q`a?RrhQk)78YzXX-syCiYa7*Vpfw=hi8C>Zv;a zM}_j;I zJBblzaby)0ag~0S9>(EsD`0X`%Ut06EHRa;)BR=xU&LzC1&gy0RombaT0K!XaF-C_ zECkwGkrHjvN?nU0=-K@1vP#H5QD;$ zs>tJ^uVQ&Ra`{%@dHrX;#p!U0i5Dw6w#I@Lp-R5K^zK_6>B5+xFY8reYzAF11B(D9 z13C)g;F^FBg)70Bh)f7@*3`u_rxJHT{@)5L32JX%C}h5iUhHS72&itjG$d0G%Qt!S z7UOd0NTT~a&r_4|=Ws31v5V}z?rwabXa(mYX1-eoCyE6{5LG=BDFMvt$(TmQB&iSmoKcWQx z^a{G?0)?`tr>7^Rg9?lGMjPQ*fGuhE*R=*eVK<%mT+j4US#92FGd3cK*^aktwb<%l^x6C1M3UX!?cc<48p5R^RYwWV2P@3<(Ur8ZuXUfZq zmLxI0pGKw^4J~c_-QC>`WnAz5mfh@YDlRb_7@48snI+TLr1~paXMlmo-hovcGMS$S z*SU@;YYGOF*-yc4=J1(biKRL{S4dDx7Tbu_#SLJ3x}?)XlPh_6v?3Dfk(V6Tjk?AR z@s5nlA?MA&<}NONplGm5-0D-j-|aZ;b%#C>dxOa!FapS81?EbdDu@ZS(;>y(7px3$ zmv|}czRLcUt!&0ZYrg4ut`whbS6HBj&{F!YMk&lPASPLIaOxl}Cl{A?Y$+{$nvjz6 zL0U>G2DTxfxU3@4Sh9_rgxMhU5Cgs7S@O%VL+ivrq7v6#zkh(E!60+C=IgkNK{?Td z0c`lw?^o10i7%t((N3!?74yN%4NNSu9(8;)JYT~$*WHY@yU-@=fVK@sO zi6-T{@LQ+acPg#&O`28&)i>RE9wq3D1sMG@g17Ne;ov`Ux2?U-46)=a;YOM~CkqYMk$H&LB z=G;F+0G-jHp&AWW4isjL5n2jrarg5}oI@+;KE%;Jry~-m#uk@7!3g;c9r6Kkt|LM6>Fgj~lVtSqV9OH< zjS7KAYIlC)ezlJ)t@=;fMU{fZ@l+ACvDkpej`zEJ(xReyVx^`b|HbXZ_bWs2n_za^ zn0uFyJdbu5`V~G2oSs^Zr+OZYArajr0$vjB?JqT@oQnJSbOIF;p3i-SfGZm>k%;(Q zlgI-e5V`jv)0aB~CW|qo9|@V|);$iqkMO26k%?@Ro`RrTK;f<<{H|kY3Eilj#sd)o zW3~ROcl8}Yml^qDm#0nRag6Iu!3oJ$Z$yxoxC%}3SG{JC(i8-Y|(y;1-ioGFq|Ismw-b67LP zJIFj`8G0@#Hx!1%8C#0_EwDCz5GLI;^f9Q^(J4>xoP!U5D)CZ_<}USnC+#MxnjO-K zMni|3I4QM_K{YnMU7Q3^Btwh!PUI3`I3+kOl<7bAfB#a5ul4C>s(tVvKW-GQbo(qh z$GgC6Mx)B8!{bx4npG!bJ0K5b=g$V_8>?aq zBQ1}F{N?1O75rAjJIe(6DyBs^ z7feX4QANhlD;5}eS8K8)v!vIkE)h-BsJh1Gl-B+Xl)QR~pGXgDW?%Mbu+3IO%~JcD^l5j zXW>%Sc`f?uAJdn$Msv8*YIBaCK4rySh>jBOEFAzEF>VoAKJc`GPJZWO{r+PAMu!H| znJCC6i|Xrddgu25Lk(B8+z~XBB8r=EjiYIUWa-PP})zqs5P4E zaliCMzUu7{`0f`Qt6Z3b%vc0Eh1ENUW%{VDp-~vm??Ip4x<3&Jw?IKl=6D7F+gnP3FkxP?VWBY+lPIm33c zK4zHoBa=z>Jo;ZlWk;8d^;hyIN(gN@Udx;H^e}HdLJdH<=U5^u?j{!AeaQOV`~A=G zwNe3!0i3y0V0lL)y9uurY3?6o{6NUAA@up(KyHZGs}%giv)tp2i>{kb&*R{ZwJFku z;9^zN!ObgyUm2X=>ZWu(PV55XvemllJ$` zcm=4a2JVcPm_kiowY9aAs1D#79Sr;{2>9G4$9v3&!N->LHKa_2bpQayhK7b?1l?i{ zNO~1jRbx})4e#eW=j7lWl9Z2Rk6%i}g%o?2;5R{kqEr4MdjFI_Bw~B%P}2*N5X}f^ z_?0f-uAX;CGBT4w1~@o4`$TX!8Tqm|%A}&xSDd@7&t~T4cyEzN^wrc%p5w6t*|VGM zHf$dq_laY}{M(nc&vOQJ&NehFi&EH#l{p*wc@xShduy1l?s2AY>hP8eD79#Gw zy0m1GZ~Oi5rw&9eb}yDl@_W=FYgz^djw>8q`1ifS@KGqR>xR4o(1PYG{miH{#St|l zo9D!_j036)KE$B`PM?-~%tJ1SFZGqqF1iBFUz`5-?MZ*TJv7^(-usRR5*UpSs5RD- z?ugvsJY2+y+-3*knT2omc^mWS_CLHtk_5sa!0?2--%Sf9Qwi) zv=Ot6I`~3BKDfi0h?&T0D(*l~Tp3`@75(2V^xqMON^B^BPil z?9g**Et)#Y!I%0G;lPv^3+sUlW`!EVH!s2r^u1gdhZ|;|0O}NBc$hg~Xbt~q7sT`D z_~-8n)ZXUrdKG0Xl+h`Z#Ac%4X^-~~?oRX*;ufA)XU5N0zHxW%6IcF>aN>x6WW@DQ z=5BewSMF91d4rK^YHG?6>t1<4HqkpeDmOGl8}lQOD->4O&k0jwCH&W)>2!Nc68j;{ zk%NGrEzo25D5(g{owOs%GV$o~NiF7@&*UNz@Qv z{LMb=O~7U(92OVbo)n$nz*V*V*~PjOBY(5iF3)a94DTS0mk0=ONR(r}DRLEO3%CLf zj((e)?sp_YVt!Ic-3xQhH~vxg0e?Pnzmad?OC=*%2u@%Iy!j#jMJ+IH@TqPKgilASgsncPtA|YzaRUf?)swsob3@bpybHVi!xMkxb@H>I~;y$fTuEuxj zEKf$(Y=f!=)6<-!B2h$wh4c7m*ogqwo?alA&r7opPsuHR2i)R%lN}NN#v{gYPPNi3)X7XHiu;Et0v7?;<4GLR4RNs>b<&r7#19GdQ&Y^fzUPFzSzaG^L;;|z1RE_f zyoHKG%FLnobAPAc_h}YNE`?B+-5}4Di9E4)_N*_+ciOntDl`c z!9o6WP4kb}-OV1>O+l43b|xY{bGRrbJwBNDW7f~{1)OYEJC7riA2sp{bhQl3mL7QMz6A}B6e}njZ6h2K8~D&!N9Wgt`A>U z&N?HmGBYkAgNA-g9)cNRDNLmKY14;0Cv0oB{tHe*rn!lg@RX9e+5j$Gc~N}*4dT)9 z?A5};kwA;YCdd2&E_g47MdhJif`jAA&fn36YsJJR@o?}kap+54rwdvwvuy=PIM+Oy z_U8bEpvNv9Lg8;tS79dSS(!=TcCHCe3Ij4SGHLj;JA-9aNp-3dC_N*JULv_{M7Fc7 zG}`=3vYn6FKs}$^9niwn*Ij(6wfglrn7gHqw(WZiL-;WiT~AG*kMfbXIWv|&sXe$vVO!<0d+K!p=BNaBMD*CEq>5bOO z`fc}v`(xnZS)*o?8`(r%vkkgem3Rv2=k0Hl%U2cOOda)B9@m#BmQkJt@4~=MOif!> zS*_|#?iE`m%U`+v3K;tvO#OWUR?pFhn}I|=ZpLX;u%+&{dREOgA&LxXO=c0;l1ENr z`t=thfaG#0RYt`{+S4izt>ZuyZ*Z?qKC-sVOEyGnK0s+^-T9o1#nQUOXMy+?#%v^t z9&ayFGb^de>qHTZqG=x^6C`jN_(+^RE^C78)iy%38~L9fCPqm~t3!o)5FI=w0sx$t ztogQGH*!mLPU+}Bai#&%%h*2m2ulWy!e_Hi$OO#8Y7-TbI=hclJ`8 zr4;(1x>D!jL>=^fl2M5dKg3d*EQ08sAM(K4Zgu!Qd4S7bz}v>6NQsJO=F`5_SM31I z(*fu>*Ib(TF0VoKk~+xX?nzBjQ!z#*Rb^;WhdDp<$hD;p@e=ESui;(sx@YZ*ED3JW znzawzK>k|CAqZYO700lMY!=b!X%;zoq#)OIP)I^VIyu4Vsl*q-`yYxF%pb)&uTF_% zY{rD873AXuWD-F8MIcf#iO6^h&UMmL8=LtkM!{>mK5nJ2*@|uYr_W!P94Hpk({y(O zPz2+QkF#nGx4^4uD4?)kf?_jTM%}rge4|;K!)A@)b!Mgjj1~pG-yh!0CAFzq*Y`l< z;bwAiYvj8dcEpK^CC8B19Xvm3R%(DFVGTNz4PcK`(+=Yec|;edg6Wd_jk_7wa=YoS`T1p+qo+ z4&TDEIQij0%>DFnAd(I=1$d4B(*9U$tyC6uGwN4sx#T}%%`gZ%%_5vQSaS&nX1Rju z;$o(*d|&r`lYd^XCnn7Luo&IAQKVuI-Qd}&syvBOw9ggkgzmYYcQEA1P!0y$b&*y` zrkM`R%exSka}vI;N1H75qL{uO7qBqVY9=v0Nj1HumQ=x@5K+vSuTyrZ6|h3xG=X** z6A*nD@BFB}&n~lRYP^MjBO5PuyV%Hy(ld5(!)tq2PY8;`Lh3fIF7>*)F!uTbVwH@dHJVC$=C|>@W>E=`w625m`g3upMD(ufOe$3+0<}iQ-^y1S0mR=)Vu_la%dP3E z;u2e5QxxidP{+P*+U%6ubzE&hONWFf9k*hUC3W$cx91m8-jvdH{)Lvy2S*gxA+jL7qOJlm5Kz3md?}w8R zum%{hojdP=^gOjI$6H>Gk{a2fyzMwWY%E)BsTd7e@X!5JE1%ep+As5N7>gp~dhW@{ z^^r)&!4RZW_UP==Sf+9xLKBUGlM}|0y6N|rhF!W21Kv%Eta(OlOwW~C+=eDiPT8xu zM!154bkqmZlyTT3VUAjtj7;<`g6DkGmQo}EQIQ7WY+gr){CxR?7MQnNxa-{Uv5K=& zo1x_~K-9ft8fO|q-C5789ett+_fu4BOBFO6TVjQdLE!j`X;*Z~EzItdpEu@yo7~cT zr50V?ftNBpztJsUq>83)g|jXDEt?Debz*m?=-iU;>&C%w;cZ#O;F{S)aJ!+cp!xGxIU)dgaCE&D=$x!X+To6y zp4(tut9mJl7AK8DJs7zxv;RXXziGPW13}fXh4vp^K=&c+)C?oL{3Ezx!=7a^UuI2R{ zLeN5os5V~XoSX0k^vWeFYoZ+#Z((OstR8M#7B)ULU<1yU1p*3|~trSd`%a z?J4)amchNvD6W>By40^8Ozs_WUWzxQEsDz$OIYm^bD0>I62v8{`2 zo!RGVtBjHfo_pg3HJcNJ7HV^vgJz++Jc*uythL&DuYOEJ`11(AW~hIrg~HA7nK?b~ z^6J_nDluhTsn#i6w-5IMNrIZ*9pVW%M)2LH`!+cSCHD;H@3lVrRmnIyrv0j*UNCeV zNKC1$aZ(yTp(yzLbpX17dq`b3T(se~)CIt}@iO0J8sI^5PK|;#j3G-^8tqUDnrn#-cy$YTZW6f-Umc5X~{1KlP}>!=mZ)v^r3#wobt*k5BV60A{$DBw%!X z`_Xkl#?dIEoMwggeuG6L2>T|vwV!Mr+k)unEpRfY>xlcm;-}ya0wjL}r)ybc7Y*}K zaB1L5UiZ4AFbgw&T5;1*8X%u(7nvM9VvJ~^lb0s52wztJfGrTfvStv0jLQ*|NQ?m4 z>vYLcKv>TO@OPmV)Nhi0fFPS+j+%O#2v#D>q*kMpUxM!rz zPh449mb2<2j{8+esyLP+63Wi$3lp z-?7&kXdS*!ukahY{e@=gu~mtZU6(f8O3q3{yZohJtCWA?v41uSZ7^QyM`EdU3w-ef zT}{L#vLCij_^Jh5@xRVnsuL0=o(piv=gw)Eo+f#lIb06v7u>lzSp~a)YyuZgfZ50K z?zAA^yE90>%IkKFSE3Z0dg1d9$X}S&=;EOX)Ul;WCfZ4>+i_x{-gTZGp7G}QXW(tG z{~TA7m^T9vLZkH=XFYc+$ls6)SMI)bbe8D48a3QYXl3;0N*k`dvXyRd3CsvjQe*su!Hwc0yV`uI z+*jcfl^^;z-Y&^#Y<~#d{7QWAC zhsokl^ky}k7ffY0CXG1&nrw{iUsv7){_B2dGez7qq}IbuTYm4qcmG0Q(#rBS{?BQz zl;8Bqb+_5kn_CjdhS8_Tlp4|h=Cy?-uf*aK`_D=M4=?Q5csJ_tY>GbRlb55ne?Q^@SKqBO9p zhs0`-S>R|FmzKxO6K76}BVQwE$~t=xrKP9G#HJ!O(Pb=>(JM8sdsBgXJAi#uU+uV9 z{O4Gw={O_Gdka&?i$dYrJHt*lS%sK4UPiJJ;qZKWWd9;`zsp}CoxMP2#?{9KpYPCv zc>(ti}f4{zKsZes5N)i%_T$9`A~n)01*h z%^4gn=r%dokkmH%C^5e!%xdYfSc-yaTD>QI%@HH7PxDIUdL7UoYv1hZ+O_*RYL7BX zW1Tp)txg}bVb?fZ7D_hW-L2O<%+ynIvarxpFud64e)$>>P&A!vY;>9BWHVqIAIK~^ zRa#!=-NeUZtxy&?dnj|?AUidz52oY%zs30byig1IeWSPtt?y+LL#OlPXZX^jCR1GA zfd?^0g@r|I-sbi$4t@Jm;`z?6UwRnL8k*|TM3yKns~%+*p~||dHuk-}y<-qztwP&z z+alne>GBAti3{sr`Vufa!K!!I60LBxL-j{+IZ*T%Vkr%AhuW#y_(M`fL?w zZaKE0(SVGEAlG07oH>n*Cz_^H_#Seph<*u1puzpfJ9RNJ$o1l87+;T4V0 z+7FBq%n${dtNcT;{BbOA;YVA#sj%tNbrXSo!mnWmFK6z;@OlB=k-8itf{fT3PbXc% zMk*}m=<$yr95nCR%}TS>&6q%2UlG*$Wy_+Zx>q;dz)_ucD$Z!;a;-jPQb zj7$_?dT?vcleu5f34Dvs_vJ_6&vcG*NmF&Cb#Gsy&bz${GFsXh{Ohx4&)B$(KwZ~W zYXjH&8!6gori?PXA0;#9`Qnn~wyh4V_~=65^kQB?1Cm9_M{2skzRp*en$tr1!HF?( zF)^;Er>C*b!_U0v+dImnpWHQFQLY@Fb~^;%ax!5N>T+^&mg--nk~g1!gwE75%9C!4exh#Q_aI0183}m-aokc$(3xrX8T@i z4vvjWl+jHeB!=zHm1!Cu#qGu14cC6_rV78~zbWy&cmM(0EP{u5;utnvC-mFww|6b- zWn>Z3Z`|jHcNPqMN7T@h-(znzaIQ-v@S`tj<4pVXbuDf*%jGvT=2Y0O32$w6nx@HnYqe0$wpBI5ZPq_sdRVw`=CsDS?xT5UN~$Pw z%kOzFo5J@szG!%?nTHXnv8-%DMrbW?cGjewB5}^cN5hPAJ^6%PiZ&`BI4aHRhZI+Z z+3FuH&+ij~mGmZH@7t}rL*um)u>b=y;5lGorws5IcjT$3s!vuyown)NVxlaA0-VVP z!FXM#gPPPXgY;*9HPmt{=xBak2}w5aS<|y}b6cc?YBrmLpLr4~i`m|LFT|QXd36~4wM;o0DpsBmJv}7#_4S{uM@>Bxtf~nqa~zC}+M(u-v^pHQ*}BKa zhB$1PZXOB?H83>Ng&$%5RHb+Oqg9)jnfX}tj3!|ebR)ukR%-RUw=GHH?`mE{M6{v_ zb}E>to;XQjn*Ycj)fEA5L75`Z%gWpd{qy6{P$7|{fnCS0?cXajVm&2GNa=elJ&&X2EykVJ5>;6jNKcPlj zi?ax_i}q7@OfPzL`6jlhuuY&c#g*S{PPB)WW}B7zSufU2a)N} z6y7SArA7O=iRf6=OATfahlBP~nI1Q{@*F#qj@B|*wIBH~6z~He76QHk`RBkXgXOiu zE}rJqLcxQlIs!awJCF2WgRRAp$e!1K_p^ljj$i{55))Gus%N+#kH=$24ik4lH$hTL z1s&!Sc01E7-BjlzZ_QjUJP)F`S>Z+xw>& zBE0oAp5<;fP-gsE^S*^v;UOXlLs+UM>CNdr@A-l&yRTR2uEOfXUHQ17rJh1Ar@Wx^1!$6l`_{#;KA&@i3! z)EZ2aeyW8Y9aD$dO+*PzEsz>AFf+>o{aBzEc3NrKDb(RE`;y1K9ypF&Kf)C3yNjZ) zG`iz5j5Wa-0L7yBfxuKeHBArI{{mm&5O2*O{Wb zgR2^u(C&)M+cDG_^4zY~0!C$qWlR<+QBor4vZu{1#eOkxNt26{Nn*40sn}_)-Wg_C z5no(FBZ@n}@TwkefBk zMsNola$^3+vg}U7D_k=Y3>l&aX<0WZ?B2NssZyCZbxAai$2dClzK=g z(LXv+yx%sR0TZCU6Jq!u=h?P)#|GuAOni!t5?1Zge*d2FXB6*Q zVhlGS02B=(Qc+=*dsj_ZbzoKe%b{(|4Y%~z3FPKM4>!PGpD14ze5-|2`HK0&tO+ii z{d>pGnPOh?msB{*J~C3%Gc?EUW{?g`A%pFQ4~hdf3ajB!xu2ePy$5S7zZ)TP=#Wj?ShE_a%9_+qfHT=lsZczthprhIpjvQN0n=UurF9vX@f4=x){ z_~L$gHPK_lYi!I5j9LSv0_YJJ3uEP4YYGjSls1<>q|Y{%F<97-&H6L}&mL`)BsoXs zT{l!JzIgtC*Nbxs>!@zX?AI{0j|vi2ri}v76gxRCe_u zdBco&&5*ol(wz=Y083&I&QeSBV`H1#;?uNUwvaC%8ZKvN8-oIjH>vmOUZw+HVH43m z`|cz7Mmz-m7{Vd~mhPis2naqUR_#nNfxiyD!|z^a9)i}@Q1QH63Hf2#g-nM z{AxY;R6>) z7$2C|wUzX?Nn|eJbAq6qx9(o9rFYvl-(dC8`N*$a?#)g_5MA)ExWga3zvAwUcO%O# zBz&aMIN~P-Nd1oF`Iyqgmcq4kyU9sSxFs#LpW>5Hft$|9X@wJx2C;DV>_1LV&w8B{ zUss`Ko!K$nL}}vLr5N-ZhY?#HPF!YkbH6-Vib)AQ2b=>@UT&U!%|&Kl1n=4To)Yc8 zm*pWD=aHc^WhaKMksu-=Zw95i<~EyfOGx5RJCaK4*q8UTRdrG4oLZDDde5n$=+bE< z*sMbz92P_M>BhvQ&<#+gVc{*SZ2Qa4pU!kn7IN0B(Vfh%%zV2ykwbD|zlaKJOmA;) zDCkjRwEBRLo&0r!|CY6+wX*L#3*7gLR6$1Jy6G6U^J~P?v{rP0=ek6Inwskusq>>g zBB^Sx_X-EaB?bnKj+t=Noa^=oBBp2We#*v>tB>K9f;Y!t&xm(d)65VtF-cG(=ajt= z4BLO=!MV?XD?IN6p*{3>6j#t>mk%OmL1e4`l^R+o>dt8BopeDl9w&+5enP`c_McDd zqfAH;n}Hf-qK|ledorh_o8Q}{(Yr?UI@5$kgE(=l@&@Hg5V>m8Kht9)& zYGmh3V^X`fINzKhBJ2%@xi{Ktjdc690m8-yZtAC|-zX)m_qI$+7~OZE>_~zhKPu!e3f2(z;d;h;o{Z`2uQ#|ml#}zoAFagM<6DpBKHnrPw9#l@L!4D%_-(W6!ChiM za9DiH$xLN`n7_aAff#@e{-ra7UwV+H8!PAq^cnZ49o>(^?BmJeR;;w?PrA?=nBSp- zW-(BJo5~zV<9ps!Bo{kRc7L9zlglW&o-~-|2@=pqA{uZ7-F2lHjPss*p>m`D0s%_^ zDUF0IOn)AagT0$g9_*AlL+t>$3Z=92a!FrJGNbr9=EXJttfW%uZ6&Kku?wD-6XWd9 ziPb>^w#g%bSx-8;!iRZdSY~&(F3!1?jUrE&MO%kC9n>`1l=KW^)?*>0zxcXmZcf0D8qruXC|KGuNsI&=KC^j z@J%;{>*0~pD_WjJRt5EUUkHDlUkCSMxMENmTQ9lbsT3&IGH4ZJ_AaYxSK%zy-`7I7 z;qD$^KI!Rx`Ye72)>bUYQWRI?ZA9HIb(pnPGouqk3BS$O_W`xU>=d{0Vo&$yO)-2g+V%Ajc}u(H)2VD1_2Ys#!}>R^l@!wE(*AAP|vZDZiRevpN55n+j`>f<&i1FJf%TEJ8v8F z?Il-P*Bd$j(i=U=3NJ>dE+(6>szO*N->yLx3u|C+my}fNk5O(mJPDsIg`|4R*RyOj2fdBe!bC2V7<9*v&)MB&S zBSrqHKfuV~4F9a?Kh*VTppX=pAuXo(E%n1$p79~*D6)Ehgx{Awt@MtBg=fm^wq7H> zo0Wz`o5qNY9QID?Vl}utF7nWt%SPn0{_6P-N7aI{$nK^kfd63ob-7jqdw)g)<0-2P zchLw!&ju-{>ejo$XC58^)}b$R!}{4!Gd$QxUJaJo*;Q+9WHJ=1{Eu70M@{X>BN`Qb z_g&W;@`7drfEB~T4y!zP0#-LC+3Iq?imp-374yKfQp1iy4XTquaI~Nc`EB#nBP+El zqRKnHAx(=6Cb@n?3DR3}V9xVm*iEOQ`~a$dlKW_}v6_ih(A&1=SPMvF9-d*|AIE)i zJ4bGh(r-e#c`pJt?aG`PyBYR3DmHR;YEj%6c+gB?MP!E2UDChTRJk!b2p>TqN0Pv8$H5~kn^rk5tx)dl3&xY=o_+$bRO%%$cA zQp0B{kH_J1S-;QE&_jWOwfgMOHZ|-RkOV$ald#2coL(00>PabMQQs zxoDOzQG2ILUW^d&2~1^ct!QQt2{O4{7=ITRzYy>ygiX9{f$sOCck3FbVDkBnT}Oz` zweRl^057_3VbPOrCtpQN5GJJY5v|QPv_<~`9?Gn+K{9>QefIHgTP$xq|25pIL>!TXzKIO)pEXk-CLay>RwbwF84nlBzqy z`JMgeLcd=ZlW*2NZn;?j6+!dI`V}7g9H4h!KJ_0K+y4-gaU(wuvyMcybyGIT<1Q0HH8wq$jcC+SDLpU>54; z`r5ZmU;o?7ti*xxU$}+Mo$r1NUT?deeJo*h`;v#>!1Ap^fF(aKPiHa%>)GmqGDoV%6LO1RSgN@5The<+U!1n z(O4yEep@&ZCtmH~+C*9>;*y*|__c7*dgR{9SS@H@es=%p72o5q$;B^uuSgdY z=NH$_Ax zp;imjwUw1{AP_iY%tk%$#P*dC2Zvd>Zq1hS;F#M3$r}J^UZF65&lWO&!NbeD5;)|M z1wD%Ea?;@B=*YyzX0i^35}2Kg=V~n-+cLfaA+{e603uep>5l?!zwX1m&L6FA8TsQh z&hPK;wsI5&4f|Vel(Em`r6c-*JGT#~=>s*nTo_i#rhPQ(BUCi$rW?|`<`lWQ;4mIp zgG@c@^cPOjxibQAcPrgKza4F_;goXG`!ztu%W{AQ?tA=Y_y&=LSTiPEO)RKv7IF-@`PMSJQQ z0NnZ?+(Mwh%?JVw1a#)_=oAi8GR{*StG!l|R2BH(5?C`V&AUCYk`~4l z@P5X{=bs@rj@ZVFUZ=Z8iD!C_Nzq@Ybn_DUPtWXct3Ug1tG{|>ZH@kI+6+`XZoh@8 zy^T%9)MV+_)+dl)>H@q1zk#U1nt%3*fHydou`qeOEq~9>&Yo(hEo$vez@$ zy~1ITN4HeKHnmJHHW9)C$mod}WHPB>*|p}e-fLD`bxy9(Z1gRMiFDP^{ZRCE?N%c_ zkg^K5FOi$i8o>oh1ZvCk!rSzh3oN9u8Xgu(1K$ z&Kp0U0{|yZ6=n3pXX{Ddtjl)Qd3hYP3B$jb>3Da&aF~k zI6yQqrF#)cPh3p8{E*BLwhq*VFgXRC1~AgSFIbYlnD75S)Aa6>#yLgs_0U8RNRv9* z>p70s7j!4Bder8wPN;{DWz~#FoA?74){_!UEA(6;%V`i8_T7qqHFng~y(f0DX84&l zEvJ@s!X)VFfmYEu->uF0h{jUEw46V!?a8W3=|NW&pM*D%fBXOd@I_>*uvY|k)pVi% zRJr7%o12urbg|Y-r9}XK%T@NEABjshlOxb=l7s8q;MNP+nXVO$wu#gDfE)BD?$>Wp zr`7zM)X|1(P*^pWcSJSFsA3OZH@&q_^TvI$q%QA>Xa6uSB2IA(4YFwGDVe6h>SXK}%OKi~5p-sBQ*MCu*n6dioTnD|f97Kld15?=}39m=@ z{ZoZ{Y2q#Rdj(CdT8uX3jo47GHb~{IX-@Y^2FxdPoM5f|FfO^Mj*DkEM?RdvqKzG( zoU7w~V%Bf0nKtxE;C=(jm<4UV;w2?qYD1GlD_u;Hu8G?RmbjhKd!J@C2J=BuZ(ISp z4K@F~S|&g^-H)P;XX(qSD{mtI(F88l)AEC3f1eWRDM~h<-Eo#5@@n`4;*#4V_jVlW z6J4Iq38U`#EjVzCwT*Ac6tE4vnpSVTkrR{fwM(XTBz(@|Fn)z3Uw@$;mFbl~3BTC) zvsC?=K|MD;1P25#r9wXZRW1z!_9HEATiEB5<8wt(x-|&(p(h(TYdDJRTD^ofR$Z_CBQPP8$&L4~F_m=v+zc77V` zv&MXQY9X|HIFU~S1_kornPbU{t%rr3Tp>IL=1G_jd{lpW4TTR*_yKEoqgGspbK`+Y zXvutM=)4U)+P;DHkw53G!62jqTpN8dzq~JHecF?w@v|qH?~QlzP1yWAq2_YEzjoh2 zC=rO3VECT8`taRNa^~LN-adAzABeu~eHhR#jlnkkw-lA_n@rvI)L+7a4Jq(d+%R$cq9Mq8C$-D6uH{VTf0hLV^2%RH5nl0<* zv0y$=1f6FVrL~NpL)fCnpW@0MkRs3RD}+V=>;(YN#GpRn=YozMkw;I}uUDAn%R^G8 z?(tF4JRM9nV*S+8oBwjZ1Ny0SfiJ+IHgC*`tpO9=ckma=L)6d%ZmzePb36{Bjue$t zy-CNJ)&WjYvt5S&h+@fmC{rwRaJIu{C!lea(q+pUK8T{!?zV#SqAO5 zuwhCqiNmE6XC^&Y~x0_NDfEEXc0fQ#NJw{2pJdH#|5!*^7>n_<*G{b< zerBdVm%0yh(`mD5?V6miDuRLgDN?z92Ye_T+#;j#&q0V}Y3a}pvEs~q)*Mh9mvvamAou~|ojMn*Ct*aS(jH)gpO$e*uJ4tzdA(Jx`*D`Thlh& z9orq-w#|;6j%~AJ+v>REq+{Fecn2NZwvBK1dGF^P&wWmx@7FuV`mr;{&f0U;s#&<| zs+!#R9vA!;4MeA$q;ULnJtsBW6wc1lw0ezTt4e7vYtPSd*(sr0c_1t=Yu?Weqm4K< zUnNW2J8VxaSz?>k+zD)K@UB(@waCI;qN6t-h8>|hbqa$A;kDSe9>SGt)eX=LjcR4! ze4b>$5%Bm!f`Z)4wPLlJ>_lX3@EWbx2)~R)9~|Qd27wJx$YlyySj0p3SXqvLKSuww zYXp>L$@e)ILjH43L&MWOzBi#iYC*L<7$z-4#zX{5CL~A=6H{1Zq?o68DD7vn%g_;& zgQo#+6l(dP(JSq;P&Uy!NfW1y7KjmleRu5`jRwP(lD*6$o5RQDMq8%bvmO!g0!>aC z54PA15on+Du5)_SJ^sg=I!di3h;$B{RJf!Dwh&dqqQW2A_9c6Js$X62H?Cv(gOZck zz3ev_udZt2lar&;ZC3);d7nKONSoK{OW@Kul5_KFVPfKu6V+5Urx8~|ft0tGr|_c9 zuQ8ITt40HJk2iOB=_7|L8ML%|n$&|Y5X*Kg!(f-s{G5cF4WmIz*`7N@Dyp-oRj}j( z7=N|{*Sf%Ly!}0lv*(dizeb&ubTwpdPIY=*SlW$2$I0uk5e+XJmL$l_0de|2e@Cyp}mT!Zw0Uq_efW3`$GEkhFcRqu}uQ8q(TusN}NkmX|9r^cFOF`gYMG# z9d9`Cy&r^b?rx=dqE(GejZ>Yz!U5A2eT~?v(n>ZVC*VYzl5c0<&~f+2*?=r2N!>wN zRYu6Y5pft=myf4Hy1Kgb@5}~Y9g)YS(+(JXlzxoKy4dpPoyPB-2TJ1&djCT~{nOBa zo@6=?*KQ4#c1GX5v-`-ZelF_IW@a-B{9tD24y;?wEJnO$D z*=>lVPZQODL3NE!#TW>(MBy%JQB#sP17rFxVRfXuU&-XwGr)Zit=aUW&O$8CA3?G1 ztxpd>19mSR-h1_l;@%}<)&J#we?3+;BN%^;K9C`g)p#M{rY#o*cN>8|kED&c&YVH^ z$NK~ElIjKUJz8~q0s@X>&%^wFLlMn4%P3DisD_Z-O#r^zs+@8QtzG(BMdWMX=Ig&! z&d^e;K%Axmg_m`KB}ziGVO3GleiCkeS(wDX=q$RiuuRa0Vbv6bW{0Yzg&5!O_h=Tp zGUl7*mm?nbwr4mg{tZCf;6_WmjWB`dHA<*O&i)pf`^IjJZs#XYo%Gy>y^)~cE{MOa zd~Favvg=>@`RA~MZq+g`BJ|_KiWW`I>+IxI85ikKFVU2xrZ@qfY_LJyDhv#U)WT=y z$Vhp{b42*NNFhpLhUq%ZK?R($S<9IDi2=)o9J;?*; zD1>ceyCJPwOq827YPxL&O^(I=0c$bbaCi0HmarVT=Jmj8=eh|W5ay3vj+WJO-B=6l z^!r^GSJZI_QrKa)woon>INoW1g`}TO^6x7r*A~Uppqe}1TP?b=-DdXvUrn>Y8nKs- zUO)^Q&gS)1^&s!S@fkQ8wZS^WYuJ9yGSMYp?>uRWtZp1X(8Trw_SvrI)}}ARB_$?? zgq-^&GeZ_{R(}3K^V*B_jSBi<93+*qGCk{Wmh}+sJ`=Yfpa&mChqC7xpOzUJHbj|G z!5tS+<1G}$rnH83<30ir@Baq3 z|3_rn*&qaZC|(u!bpAUEdNkT{kcQuC8QGbQLDqK4$%d%c!V=3(3Y)GLh6oK&SjbfH z`|b6X6PFCk7qCb+&4HVief4WuT1m(p&Ag4M;-Mq7w(?6)QBZ3d*W(ZkWwH?~;VqF8 zh^m%4CXmn*m!M`IV2UT-x3KUann^JqrUL*+AHUk6#2t%UeG7 zSIw&!V#*^EJ`u0uf(yr?PqrQQ41J?K9JTBu~%-R|~Dii@QsI^AXk zMm`Aw?`7S2uJN!Gw9Wg6im}^0zRZMat_W-B>WK`_2(#=LD%;Lex!?SP!HYQP-0Y`a zL>aP+`OZrWARC7xY0LpS+)b4_POY3iA&wiF!=?+Af$!dq{3N;60+kzxcagC1q28L6 zU9Kn#aQIiP9gAeYlT2R;i)=VGeBpGs`4B-y+azu8y_|V3ZQnWKmSoei2sWrWR&L~V zd+Zx?*Juh|3Fk?hFKBcL9Qq`mmd5SOY~!_O0F;_aen`gVTA&!HXwLm%wVR#m%17V%84X9Xn_Z9U?UDq$KX1`3oi@J*A08cOBV5ObA!(Pp_ z;dI#fQ0oYbgo6R;DMLGF+x&6;d40Y2*Xy~_*b^NlKDMZ}bpUjY?@R3Zz$W5aPjb2) zOH!LHv|&o6dLV()bps9}Nc2xz8k6`;wK0 zh;fDSTj#>7TT#u==tq{+ z_S5~*(!Zu<@U4uLDN;~IgdJ2PLs&d)o8uM!3U?V6;ldUdvS&`G|p3BH0l&cQFl z`U@&b@&(buWCD|1ONYr5592(p`Na}63oXBM?o?lpr+by(XnzWk|D8z6_kuTA%(fRh z9cyjg-klWR+?2=lQR&RlKZF!k$f>gtChzZEcqxJ{IC2)wxmv|HnD{AzZeDqMRgD^x z3X6s{Y4?MlAvS;w72!h*!@8Y&(W9?K7{Az2#1T$?>TbQrq95njvd^jOn5~~UI6uE_8jou^Dy*OY(F#+6 zy}$jsZMOc-LrPYZmtzjiPjbp!e<}u~!l`glY{b5u2&7$$2#d%>!q-V;*Edc|*}{|D zNXO2L+id1;21D$ddGlZx^id5gF;+-GA^e@!g7jdW>!1wRhj~WEi?Z&BmkvR#<60KE5umQFq;J|AFCq z4pN6nJKAfjgvT>89bsuEvcW%&eMf*%$O&9(tiu5_P)Qq%OKs;yJq|OOSnH=A#_a}`vMO!DzxW=1nFzd&~SjdmK_Vqn@o*>1qMZC1>T6V}f=|YQU`zx|Q#m(EMz)Q5s*TGH1g5Xek zkcWX$U>^fMI`7VlC;k0FyuxCI-r2Rm>q|PNnJ7@^+#g?Q)=V>Bcszcs3fQIocYOQ- z96hR=7Ge}dUn-)+J84jBAYR7<)X?OzbFESH>rA#VkRf|mlws1l9}}W%Kf2`ueHaX^ zy({lRlJjRuRq1ww*lId^Z4E&VC5heCH`RocV}E1M3=e-z8k!`3B>1u7x%);QD zf46unbG9lQskyF%{2|3PLF-f0krIoyMB;zV{?gX~o;=7taY>Wu-A9Gr|W z?J$iB8b{>4`qX~4k}x&u{!@mFga#6Eq_Z%jZt9&Aa1-=)dEW`2t+MHJSYx-91=*!f z9lK2iHNQ5oq`D1c))~%sWXCJC>rl6x_v;|~jDrnhmmjD-U>hKh00(6Q2@oHem#CisT%z0;iD;GZfQRErNab@@2_CIc`| zfZ-xM_EZ0puGP(p{u?*Frl_l9A9g5_h!Hkb#A?+lV_KP~&#eI~M0wIIP+Ht}d|Eb? z@Uw`O6_Ofvtk2{@NNF68Gpek&5X2;_psyEp5nTFgo(@}9Z#x;MQTCPXWTp|}atcL6 zOYGnpNDrF6SAS+ceq4GI(o#sZG%5ki9_{B%?M|wq;#G{1N6n$5Q(0g!`;cl+!EE_x zq{{crU}V3ts+LiOgG)!^u5~C zJCs^f{F9$8 zYRXd}7B()1K|d4xVKBq!VMVPorb+Lak3X^Wtaqy*ENQ#mSwc;`47#N1CT%SA{xfN+ z@5|+2jn#bRBO~7U@21jjaWLE|^pf^=?YB1qws+6Vcu;begDzu9NlBsqlbB8=TfDtH zo;%+6{-Zady85rK0aaMda9oDSOJ~*$Q6cK<^xF;+L&A?cooZIC%koEc#B2C`+NiUi^7l9c6m#j_TJtC_7hLM)p}KS zXR-tJ61(+-`Q%Ga!dm`A4p-WPFrA$-33}=g&jnj;4K?_~7KbR@&lgp-`q?5L5@oS( z;xtKYn0in+K(faLl|u}g`U(hKGRFP>MBCpgebq={^fFXt1_RhD2w&O0f8Z)}Bk|xF z??ty2_gJH5RXr229EU0S?rbRdL}!LpIXI-i@x(nLOQkY*2oW&f?WCM%b@wb{yjo>Y zuQka3(x&!yv5zY`4f zC1fSW`F!vt{R-<2AHg`p#AE*8)5Hv;n&BaAXuMiV+ddG|6F{^Nk^_8!gp10pVE4IX zSZ9hv;4biJ>u4Ch`Ofat5qC>+y@BvAnUuoD6KXT(Vnz}VZi=PBX?}SH!y7lIe zjtlBHmJ}(TD5&~5Z^|zK1kR`Bu>kMwr6Z!auj3<8m9`4->UdMk`Ksuv(_<xS*HZW+J^$QU0&KWE{-Q4zU;-cBfEVOxElM3RYw<_jz({@^< zN={W5fh-*zCMK@1-us6q2#84m#;}-i`Y28v6wXkh8N*;YT9D{y*@LsQEaZ|7g1OC> zCV9y)zL*{ZiY)hS5!S|AS@)CNcqXs+5Gr%qSE8vw2hp?Tv+-P*Q?h{Jg;D#esUs5B5VB!g4+R}h?rsuDjHHP_{yq0`|QCOC0TlYp6%FTa9+`k(> z89_l<65PhRMLB`(Y!QAT!=OsJyo5<3flq9lVV!Hba0u{*Gh7kBe#H+n%r7iNtpX=2 z6sL6G_`X~?E0e9v@e!VqSr>mB*$|;P9&=_ztF$=y8Tx5#iarneIAx!ZoVqutQ4!@z zlXRzXG=KE8XSxcXCAYb;hO)|La4p|?in=eb2|*>d!0LmAB$J!FJlAiu{VR0+x`3t? z$nplxR3n-+>@*|q7W2o-kVPOpCxMQ-UP`lXhbaXI$js_rGjc|Op-783R=fX_V>jvl zl&ss{cphcpfQ*G7l043j8p6OJ$C3M3a-`Z4YMwpBo4o}!9Nhf)mW8cfwgOMcsU?!TAMFS6rwJMxnIqwTSW2l~CLkFiDcavyT6}*#fRmyC_eV zpB(yI5DuMrLn2xctaUSEPj1{e$pCy`OLdnVg9vHp@U5g+WEtBmzI1|Z*!qf94Tf?b zE|x3vD$kRDn%5PT4)c`OU}~(S5%rQu#5zxo?k^N}`zk|S8_1qr-zO0f`Hgy$R2f=F zcRJ*j#!-gA%zbpFO_j~FeY=n?ME5zQ0leASsYHca{89XyRmxtGA&@Mk^vNbgcg%qN z$Jq%UJJCZJz&TUJ`1lQ;<_d`-X#~B6!g=;>OnPVK6i3=VG^5I(Ib>`}M6)cfse+-G z4krQ`%M=w+eiHDQ`1eHPuZ_H+39P#5MdDBBB!bXGTeC^9=hg;|f`Y!*N@RXlHjt5 zi&Z2H9!E8J?|o+va{G-gSMpv_8agJobY@`VFGeBfji7LGou3L?mSF5nQDyTmYhSZt za`pbeq5jK)ecte@n@Pip%~#lH#h9etQPpUl*mX?9AJyzBe@!&X%a8Zzvvun`on)LQ zdH$9hvsFS)VM&9KW9PP@GDSQCBYmv#@?eDs1Zb>AbeBHoRkkdHHPM&Q&iM@R{J5Go ztBnjixDj(BepOACu6Xuw;Y47c{wh#B^pi!OepyV>i!5u4N}AN1O?RtJ%wE<9 zG|QAmXL~-A;^xykW$|0)ln=U-2Uwk+mS3M@*{3>uWfHAY;W_4CZC7o zBA_R7j^e{zw1D1gY3!eD#NM2e67~dA(LJHPXJkb-q0&NQ3T)_rLr4@e(uwJ4tWA9z zgT}Zk>1$KcP-4qx)a#0~Rnhi`xuQ=y)W3WSSFzB`)obOjE436~9@C_ctHwO$Y z*#GoXTv03h@-1;co(NyH75@uA+gI@o@B3#xk`V)h2sidt`q3_7y=p=aOWYQk3J*Ef^t?;;nHMJ7G%O^7NaT)$$(&uLlw?Jl0LcU#7kwD6VZ(K_ehrTEzl1# z81B2>{~j@R-_mtobsPh4ygC-(w~8OkR;DHy34vIyT1M-(FLb(Cr`~E!wZ_jw_^Bt* z{<-~%Ek;)Z*RGq4&nIx-Ac4QHPi@_Z%PnkUUo{fkD%lta5@xvLP#=3q|M>1M(`yXO z0U~cJ=*J9;abJY4{uunK3;xcQCPVv6#tA;!>?OWqCesuSE7QK2|2$kMQW@$>ppT?ggO)iuBKg?R=#|nsc zeRrbgS6$XNe;E7c`}^JBpuY*Lt|c)cZ3YKND%`_{2oF z9>Jw_X9Z0sQZk6s6zk{i+&;>x;sCWLwEZ39%|<*9X?a!Ot{qs2=7WALt|B16M@jix ze0;or#t9%YCiQK!^2|1aXWma1XS7fNY693l@rRf%)#>*f3b}DuT?UZW2jG-kw6`7k zH?+gULm=iEI=K7OrtMtJdd=fy>s0E{6+2*ZQo)>HX1H}%0Y|uXX}l|oSOPczMJ|h4 z9C#j2P@9Iit%aD7P!?9(-3eFSkeY=ga%rhm&3iWy@6|;SGAgRgX92f|;-EhG2S8wU zz?a@b7BlJs*D~cL_XhztJ%ip7#7u3C~-;vmD)fpl` zkrOjB3y)vswcY{GsmBNr)o5qr=GJ^78{Kke4jJA3=I&+?-+vtvf_ov+7MHkVJTuQR z^7;g%%}|_*&|+d@iYhxrrio~I?xTUbVg5-XIo)2!zyi4*KlHd!548G^rb~{_OJ`^g zry9F;emF!#X-1rYp9_@bW3I&cP0K6FR#uVqfT7l$cZY)`TvBrR3U9Fw1N1$ocunWs zWmO%)3_foL3%#T{$u8Jc9hWgT?k?$;raCH&{QL-f9o~hO8iBhG7X1!|c_?kJr@$IS z6qYS;CI#xz+uc0_p@{J1)s@s&=UWNzI{2aynjaP72nhJx0n2vF{zNSdMbqJTF$g~g zer{a+LSzCC97>vkb^{(Tbh+_*|C{mCtUNG3vKKRMD;gAdOU z&n~=s=dX4hH8qB$adtGRg4?_FrthV@+Z1w;a{n@tsv88T2JM3UlyXjQuwIvudZNuL zN8jVv2<%4#TxX|}4f{uu3JXLf9df}&-t5(AqN`k{9dv9F8?Bf81_n%VIo-gH=gL`6 zX*0%|lxQY7e?31ZC9GTmZ!*h>#Hj8pr4I-d0x6NgSysTV$><(pUL;D_!8Kl znnr7|xve~5Z7LKSedw}YPp>6pWs`jXBvVF?@<;e-nud6<}b0P((mcS`@q;L+mx$JN%>UcZNUZvxU; z3cBmTKa=u${|C0Th`p4|DE>6+Kgn(H{kl23WOnLae!hIFxJRcfNqZg?8VZiU7VB}| zs;{T7D6q=K%1S#sZm_4WY(w{a!wn>z3LMR9YHGA{Bn#hn?zFskdO zX5*O2`pe4*YUvzc{1aLKEnEM7nr>f~Ha7v!wLf~~--)oGzr}B$2^~j1?~nfH_jjt@ zz=0aMHj(A}=X~%lAFB!U?nV6r34icmfBg=yBBKj*Ws&!F`ZT19JDaUQgWrh2#4>$tWb#&z#fX4gXIr=CAPyh-iiS=vbtWFsX58pZ}A>Tu9Tc z@80Uj8~cC$g)tHY=&7OL;l(5*hD@rqt{;)`@ew3*7(C(D|MNKiOPc{9z*R3Q?51Ap zZoqJjwP*8C{MC2q9}o~gwO%}UoPJfq8~2aIkP#IqGc)0MBU;Lj6>m5$Q3eZ#{>!_X z3QqgRz$uZ(T7p_yzy_*Ga3uap_<>uxp0wh5 zf^3rCbiw7F_0!QxAtE7j8Q8zxd!r^D5Hona${4PZ|I)M-xVr=m(5Fl@sliDPuWwTc6xgk18n|HZFjg-b%xb>(}$@>{UKHiWZWx5^5a{8DLES# z`rl(mZH2EZ#6RuSDIxyzNytKJBC5@TQB2CLS0a6nOl&ovGs;=vlsKnw+80M zaK98ctEDau*|eNI2>6=~fjHm4~!*Q&eo+4C9bEYFpR8 z<2zfgLhN`TZ#E7ish^AKLE3S5j-SWiB&S~9U}N*Qt*i|{E1-7V3V_{&-O`AZDF=#!BY;IbxRktb~%kiFZF-^L8<@ zavt{15AuA|>XFSYzlwpy>f6!9nEnO8&|b9hynTHvF4#3+Rce^lRo3jo@3jW~-y-)1 zCk7fPe=miMy%*$3Mnx^%C@DW&avS=3m_-6csRQb&3KZPqW2D9N`07Q9;e2@zvG6q6 z;Oo>39CY$Q$ptUAo_LrHtHbz7PF#)(nxC6jpE*gJ>!p#j={^B=&6Z{S76mvXWJ*4) z)wH0o-Rcx`&Kn3z!IRgK5w3QYfSIMYI+Pa9{#XaX-Dwxsry^|j(%_8{gB(>1Kf}O^ zlN`^^(v#Dxoz6p@$-Q(G6JuO=)KkEUu%~Rb<0FCnr!1kM6vt!>4XKRWQXmTOg`nyD z(Gf5SALhanl(^bGB*`1g$2shdy<)N~go`tBi0&(xT^roJ^}vP6%xCS{xz=L7571-r zfOQ0t49Utf-WLm1sX83zL;N~U+07wk0N+IEU9!d~v{AL9G|cOZC;2k;#6=|f&E!#g zE#aDtbl%hbT99qaht){N|dGFJ~0dRQBCuZ?SZMKzJuDem*88Ofe;4oX! zQ8TCc#@&Ncf}S_jeZYP$!7BojT2%|+Fc<2T{s}IYMsiD&jT;q$0OpGI{&cY z-7-L9nI$P3(?AH$3YK+LNE9nx>d*kA0jl1#Y(njD`vPpWfEYuskjuiHrWv%lt!xBL z%1$6A3D$M_et?EXv6WL{PUjHVLxh)|V86{F<>&|2@b#M&HQ8usWLRZs24BD!a?$}Oo~}19o`0` z##_0hr1$gyKe1Go=R40+jV#E1AO#MoTl7ze5_a1|+-@dlEu$YE52;{%G}6pKEGlZ6 z&1ULz-gz(2H)Ag0-nE1;bmVaBwbbjtp5|)dDgWS?)rx z{#p3U!fy|AveKmL`2GCQUJZ_q>S8RtJ9P^+6<|8veWpHGR1V}hjh0jnlcuP4eEYyz z+^HYb1Par4vgT-q2ecqdf50qg-3e#EPV3q6FQHuoV-XQWUM0qoL_11SKmSSDBTn0~+shS_+Q2U5&^8>m=wY!ED)j^*h^B3^U#p&m!d$6pZzS3ilGZXBMCJic=R|bGPUR zQelT%6*6G4>dp{RFg0PE^^V_CF~@NWFf}lY0KvvO#rFoCOe_e{qdy8A#ZZUt;jv(X zb<0wAYlJLA9EWN5uCAC_Y zEAS<1#_a}(w2^2e{1hF&RVifH3UqRkvJ{i?a>?=1fW_)*ay6bd$T>Z>{P88iELGw@ zm!}W2kea^vHl%q5Jvct>O0D<+x#02Q5xkGXRpOT4G<^Ec{XC@-u5j2>-Dx<_G2~~;;-K?n|FlY zntvTQS7&nEJBegE^D;`V=JmO6@n{u>Qcx)56T!y%Ic(euof8k$k!3)DsFR zDz}Ho9NB`?h*g7Gn+_~PVn`8rgiOlw?_$;_q&-RzCHr*lA`w~i3mR|+ST7nA@75Yo zS-bSKxen}ThGnR$AZ?Yco7*wDnzo<{SitrOk3zu|*E{A&ECm5H=~cyj4I^5sgavJF z&jbAU`bHGQYnl+SMrh(zPrOoo35e+p*dv@$K1^A0AuT|f4Ivg$S~DjTD!Zb1MQ4lL z-FSw|F9WEYIVmh7_vC}^wYOhl+$&LcYl_@Pg*(SPK_)cBKBgJ6zs3w-4HT%gfO>BT zzVGI|DqLncXQ;t5`%(=&`wS77iEvj3G`!dn~nDph>wQ>kEaUln%>AAq-bEiCp*I+88=~n+>o5RI6$jFb( zpx;lcg3VYDCxUGES^(E&l?*BU(Tg{zAm<=wng-N}l6=NR*p#4Pyes)|TOIb-Tg zXWV;RxtL>7#-=w)iMLxVJkW^c`D8`#b8zy$?N$^LfJwhc-P$Y4kr{gdbE? zyrB8*(X0^n1}4v>1+juPSZiC`X}mao&F%4gEZ5EWxSa7vidZPypOy&h=PEn&F9 z!>{Tmm7i3R$3wAh(b%ZGly<(t4hogu1iy6wSPLg*gk~_7R2BS8Iv8+MB8QW@wR)FT zE-+bqJBk4^dJzS$t<{kUAY9-!1Kqt$nFUZw4n)0}1Jr#^5hEEG``RH~${8krsK5Y@ z`zU{2%1%YvGd}?)I&y8^gX}@?xhfnu#FId;g(e2Hvb0m381P3cDozPrFdD(t$4Yp&$jgliLT zM0F@}miDETq`2LqD?p zmP400?}inON&J=}Hr6m2Bb5$!Tci*?%LbTiQm+AjFjgs=RvoOEIC{j8T$~uY%|5_X#uqYdo1a%R%cw51Uz+FdHWK90{=MZ3SHGkh9V#)^0;t-ahz{$DOA@zMLo`e?&(5+vOilN@(Ct zY++S?5ATmu_l=6=zKm;eqK{Pxfk}(Y*n)q5^liZF^b}zLb_h_?!0tWrh&5R+dx77- z&6fNGydfp8zgMt{PY01h%f-AH$=}U~9~2x)Ts7~I@PsI#83;f{me9&YVF*hhRfhmA z*sIa8@IZzKuJeu`z=aqVQm?OHScg&Yi~?;I-Cd(D!1~U4z}1$;PFUYvTw02IurJJX zvH!rw*HQh$PmdAYIf_F!Se0l+O8QojRaa&<_7ATRxE>j>k0o5FLK;Teb6{7OOuM3# z<)4W!LMbb=w~>VE#0Xet)3xnoWL_oDCApCOibC?Ihqzu7FnDk@=Ks2FNLBC`M?H& z=W4Sq4>_S|j2)6JFU{Gqn8~<`Uv;3TtwtAZWGwOQPA_vRPVR;uK2U>8iVCSTveUwttE#D4>FDUpO*xL|se{Evg4Nb%SUGEq zBoK+#UErF^0?!Ok7Z)$`Cez?^9^3r4z8A#i$9C{9yr>p=gke?OupBfG^ToHaYJ*%6jjP0y3tC6`^891G`N7bBaP9qKvO5|Y$>J@d8A=f8>SKZv2e%r__^Bs;G+!8 z7v-pOV6dv&Wf-N!gmIMV>eFTD&7UAVgGOTJ2n=LDIT4+0Y(BT6s3TT#v+;t?MgUE* zuwO5AzoDj_f(*Qf&K_i_XUzPHvO-Ma=Zp((RmC)-MB$-KChza4)|6)AdD>Pm(W+R2P3FV#MFqjGDB{`*Gkn*%MZkc6{p|`N%8A-F$SIZryCM=aU>zd= z+-OTZq%`o&TgK33ag+?nFCWQ~;VzxpR5YbKCNDR4jgmZ+$dqDJ9srziPhQ8UmA1{8 z&OJStHeq2Ff7sn~Vi>Unpe&SFU6}$Q;zjD_%7$XjD*4i~k2IOK3kd$O*wxgx(V~!D zL5j=Cn-IKSN+?lB2X6W#0(shtRJ<*hYT8AcS@L7~SO`p1KTdEh8{-WUB~a%e?e800 zn;p#DY?H&1BIQm#RsWUd4JO0a^Ra@ldTMSivsR}F#ig0bpn}iBoXcOAHETQG3|cg! zH6m`zhO%b2j(ASt%Y(@p8Ex$T7Zp7<+K)a^ij)N@Oe}646c8*)-lmsgeLa|HW{1CI zh+0Zour#_F<>m7R`vGtV zNqe*oNB~W+ng?90TCScW^pjccDR|eq5jnGW z(qRGs@wjzKlfw8u`A!p#f4DwdKlhzUfY3sy$ECh8M;2Tf2Ytfnb!P4+a;tKQniIb^ zkE^ooS`dOozB`XO2J$|^?iCVXBLSz)h4?oP_;C0X(G5JYE8KJ>cH!(3YaKi}~QD<)1yM zK!_Q0!EV?y6jrch{@ZTogMrAz86-Or)FxfO6750h$eFVRFJMlkvP@CwLJY zGP;)c7^WC*ny~tpvu%tDnMF+&6eh2>9BB$9lm-${CbCazJ!miP2b+|&J0AeMk>^B+ zN@rS;o&5Xrng|o~5hGG=9lg(=FsS@J@YVir%runn;r+hkJ$MgVc1-NQZRkK`w_h>b z?bR#cxdVbX(s0Yg#({^)5<*t^qMFZ&Nv3*6EXdieW_1+$p79-l?~(~m>;TeU|2s05 z0oLftKmhSoMEcx9UctQP>yMC+AA&Jil3+AIJWRoSt>IG|09>K87QWZVwmefoE~qC(yvbZF z>8&LsCcd}UDX$xK$ZnE)oFtz04&X?F8#)l0VO-jT0Q7y@;Dp?CQ{!ooPw(J}wY9R(GUE}%!Jk|VbqsU-euk#2g( z7mFjnqw``7hzjjFPlA?V%^>x7*n-L=7k%WW4_U8VGWYE$sth#FKbMV}%;9SAH zdbWZ?pF!F@9K&VK;*Jj&)>gUL=XpNa^=4}GvMfFbFkZuS_J+2y*ftbr7` z3%#4eNk55J(+kMS@UxfcLl!=-adowA;A?YPIMO<=hQxnUyBjUSZ|Z}*Cvs}p*o>C> zEdC#_xPgLv@xCzp=zI2XujTU|)gp>IUHvzmJLdu6*GhYAdqjg7p)HcnZp_NUw=y@c zmP|Oxv`v*4c&y*$)aDq8_0DyoO7iUCxjtt}slb(5jBUEpv@#nZ{%6V7Gg?PbbpM7Y;IlGUp=EYFzrJ569Syjj=y=B&j_lRFFfp2Q zzzHKOi`jSDb|ZMZ2({@6uv!rgw9Qc@(0BQWSM`H*cfbtpB=qg44xi-nsjhjvilr0n z4d+_|5B15!d0AtEjbyr}j^UtI!d=n2U7gWB%8=n_J;2N7Y~&4NPnl5@HYccvDcl&G z*cuxss)i2ueDK?v1CN8HVvyCRx*P#0kE`6tgu$GM=Mmin(HNk@S+R~97uXE_f{$_Pu zmkZ;oADS1-j*o1R2i(n`RomVM(kqbfaP~F7ugV@Qo5ZqdzuG(V+BJKut-zwwHI(h? z+Em&30FSl6Hc9`Y`ekvXQ^c8gL%HF&BRpOSn@c&pg`(5PJp=?_*tynCcvJqlZ8Ww1;~9I$z=;lF=cX!((8nO_Zm>SS8tOuXD&^Z(U#-r;a< z-5-x$5;2J$q9!5HN%RseY7i17dK-k%jWUcbdWncOh(t*t!sy-TjL{Okw~3h14Tj<8 z{_d~b_rCW%f9>;}=RD^*yREf8>$~@sw(%2+neLaq0a$pNfGrx zu~whYl?u3}Y;D=F95_Qjf&G@6MC34`goT@>&5jXt?~X9@&Lw(zq3-)~IU$4GvQ-!I z8L7ye9Kv3Aq?ikhVexdf?4?Lg))m{li9PsCH$FPM8g2dL5j;PjT}py%$47>2N%oT? zkMU4~W8u*L`m$$tzRq4#N)G=iCy5nbm6cz|Ao%FD#PlvtB6$5k({KKb!^BK9Z3q&z z?7Ol=@-1LkJvKf!SYK!TL;$9K({#Ml&z+pj4)X4KT#ImoU4xeVHLf;@bw@N!jmMI* zv0hEogYyRZ4;TL(&ZW6ua&mgKayPQ&Dudr2k=?p-r4Xs(P-gHc8m1z2cLEm`le4=f z0~PY_b2I#u8UM(w0@b2&P@kcxdZd0YaWSAkL8UX0Z&TTGov*96f!R*zj>{Z}%7So% zV)WiHLG-P<=qyJ<>O>;zp|FrohRZCy6D_-(Q+ZQmU&}#}@bx?S#=e#h4RxzF&{=T-_-2@aw{)p`JYUVWps% zWwly7Pvb@{h)3sx2L>>xsAut)`<8l0IG1lHo4H#}D|o9H%}h5K;xbrWN{jd% zSjz=#A=bvb!m@#7HDaz8NANV)g^fr;`)}&gAK6;6@lnU;t`_OlDy~qpR5ik!Tgl&v zQRUZ>Fn@&u{4?nKd8@?45l^{ayVyGxQjo}luP&G$eRjH}Yl(2&JWb8nbUF?*6k_|R z_ZBWuBByd4qNtGv%XYkAZD9EdAeJQh)e^KT|&~I}oR)m%q-Lh2Jo3mHdhPZ~pP>pATXV z{ZrYR^KDm=EDUzDD=gxtUVZO$(~YnNqE7`p>^^`ggiOj+cPJg?WsHI8nQ|<8o1kX z_wylz)(Ei(TcDt}a6(0vrmQdC+(e<&R}#^@sfZB^4S><;fXE+5J+T z65Gv3+do$v4kO&}19?vCH;~RQZZh#X$;D$z1yXX(1`(d6l9s_!Nw=l#j|lS}VDWFu zVZo3f@mjRh8p8`P=9i6ZMg7P))FWc9E-=x|BL&QEX0_nj8i2dsNFdq7ko0;KUoObp zsK)(BW`}>tep$GhF@2B)cOATaG`Zh;P8PW#(dfR?kqN0a%N(8w)jwEAMAFb0x=tUk zh#U#|K?i!0A2mqv-CFQGdW|VUpXcYwPOL7k$$jA(7PbWE680SROjzch!^YU{eTFi9 z(`DT!P#_@){+0;{Gl`dpbTBTX_*d)qm-v^DIV>oILf7V9;M^44k)m^@t*4HZThIsI zp^nMFIC<8%k~H(4_SU%dre}q?bag{R|NGnqj7=O01o-sTT2$8e_w&sytjZhbBJC^k z0egkbr(15n64X82rq>5^CEhtm?6rt&L$95);o2sBkv*ut{fINP29}-Wvo|=WEiu4;;#qU6?i-Qlf;8d46~; z-i7V%I2~%_@<$=M1}qr8n2lv#>ZZz&=CA8gjx?6h5L|>0g}Ei$WfH?tND6i~Mh8>G@8)5CU3v9exCcy2 z`A)v<(5o*lp!VgWEjH@41A9053D=%viRr!-^-?zXn?N1$k5e;tb=@)fEaMOU=0E@c zt;jRdPoJgdBwiEU=N`&eoLEO@*)5!)KH@g?E-GF;e=eoBmMiPW%>r*P*2!|ERq$x7 z_Vt;m0nNaonVf<(PSlpXapDgB^prz$I|d5Y0~x|mPyB8!dsoxF$q=>z9+fq+#$&q5 z=+2RsTQqOM*p%5uBQ?v=R5io4Uq1jHdX1uC8Dq2c_ZH|W5f=e=)dU}xau5jP%|2+c zTlGR!1uUz&-U|6P20bv(c=Y}@A#Ftp*D(RHPJ9NE_djP+-2Beh^mZoD0GB&Bhx_Vh zTjTWPK0@0}Ala8RjCOvQi`O7ojq@m!`ksIxU<-?_Nvbi*A#0>;<(qqFoae_B@;f05 zY`yI!P$iiej`DT_iPDWTTI6C?80Yti9JlZDae(Aj1q6VoJiDG-8*Apvm4TbT@73!# z1@bhu*r?oy;;r1*S^pAyp5!Oe0Y*>Lwj0>K#!gqzn09O?ECi9>O*zea!*Re+V43))MECp*k_SqHaPa)Fd|8)#Kw5kmIG-oB&~O+dajgm7HGJyj4cr zN5*cX{Yyvvfr9Z%E3_f@mLu>N7rI18DXT|eKTB_hS7Db5f~n|%se50p*{d3^!`3`{ z!hs$QGOF*0gt5o$lKZIscxIGsWH+ww3~nG{`5|pj4cDYC6|Xy7G4B=!}CEZT zu3q5RnLOc2ce?hGho3U{-;;3Wh_|u%%=^Sp{rJPifOblwOb$TR!9Q~0lXNJ3Z+wAQ)MgIo8ewB*QzUD3)q%_MX@3FIF<}gZitS-8@^!;xlZB z5Vfx(hfekr!8qi7CMz~>v7r*{+hM=v{5@Ld{Kr7wX|guX(wRQcQV-Clh?`1Ym5uz3H+Me?ZJ@4w z7`YatMNO5Tp1wnMKHC~q^OM?rjk$A8CZk@5>*%W0vD`tWH;Jv-VQVtXL z$?dFDIqbXBIayC*ld}M*OalQLDE5Ks7)CBr$;zaQF~i$9#gGYy{aae44A6cGn?$7o z{Pwe>0Y6CDP2znk#hFVL_6PF$1hum*eB-?g7K`a}>x-56Ih?l%5UI|QD5%*PYCl;Z zwi)BObH&@x@n@84JN@^z$pDy4;ldkJIPmi5h(W2AMYY1ZMxU<3C)?K3ngDM1XbeK} zL%=h|EADpGjlyzA31-&G!RDWa{ZEf8I(AGH?9vu3%!$6n@bsEPuhuXe_$feFMSk;| z$)B0k_1GP1DF-u5Bh3HZzoG1PV73Elt z06FWmByk8z&T*-oZ2#p@b=#NaPfzm|t}gFglbx7d#V@gj?=R}u0^YDV@&={l4CQ$d z#Gb@$34U^SR@f8}uG3$9?k@r#8Z$XdA@a7e;sEIeF^)r`qrepLy}P~5(O^C zK8N(j_Ew?Zzw7mOs%;lN$&LyZ*+0?H?vMRhPdU?`)y~sOaePd}b=uo6b~Rm19^7^~REaLVOguBCkR; zURKVNz&9?me#**0oa^WMM?Oi31eJNZy~=V>F-`BlLAwou93 zUE3P0N5O44U#AP;nw#41EVhH*Mj)*tx;jiDbhw)kzirB(%pT4M$y}u{ zUCleoHQUV=Dx_;L-RC_2(dYH&pxd$K4*_vRXQ(vQvW{1@a|d?GV*#!nOLbSCrg`u0 zBVlyOMTlpo%hPoPp!?|chfxAzTv{$b`V;vcFMo-TLZA?^A2W_?B>rZ)^j_rCjH%Wt zh`(Qtk$_We^8z>b_tN(S(&Ul#Fsx9yn9oSl0KbG9&%f5sU+O9&>57_hTYKp4+t@WZkE1o^H z8x%AYVtVzfLmOk}H#BFg7V>M>;6f;~DLtTaiPo=!hsB8z``iUY5~Ka~$LyN{=4$_% ze)ubae=kL;KlE{2y^%6*pjqBx{HkX?v#&z;?ATM!rWrxJI;)ktdQR}8$(pw=z3Hl; zj<`>RBZ@ahX3#9Z|%a=pj0B$vtEf1M5%}ujRy9wAN*T6 zF8+#|5&nkprIRdL)7Ut(yqkFm7gc&A4~Y|~M|EABuhAQSPJZ}K4HENfYQSfk<)so7h@>dutQv_HH z^>sV&AE;S=uo~aN47dy$A%)bve52xh0pB;H~7E-Y&qqy21x^>S?4k3CU^liUxD~g{^ z#4{e!^cyr^@1mpnP}DJLQ2JzWg4S=VYh2T$#Uxzj zBJOURaOTZpg0hv>8yPW$AcNyrBB+p(C<_PYS!hhp&Exf}>xai#J^l)2iwX| zcd#Oij(*ScHt+H9D#hWV6BHJ93z|aP#C*YfHRRs3o<5fxx#r3pC`c>~Sp1!RKZsA? z1k4eouS|0LT~>eCCzwXzVh+hR%zxCN$T|MWj$x!HUo0tJr8RZ*O*l~X)O}1#6y*`c z5d*V|J^kF{A&4sH5r%$ppvGzjnPvGLw#X~^aG^31J~D4Z)>~-Lv~~-=x$fya_#+Mc zmnrtoaum-ZnQp7_tVV|M5VQpv5}@X{JECFI;vfBciJE6oZLN(sVxf-gi`ZRY+@Nzz zp{_@_cSc~m1&1mSxb#HGz#L5Axss%*Bynws&5D_}3(ILE(|c01Gw{Y#T`7~Ge`Sc? z7`_=Gkb51!^xR(;Xcd&J#ro#ASJQ&xK0WNCElH72z;n7}f+F%iwsp@F zR67o7cV*hWCs~V?iJA*rg|(*SBuPV@yW6rVw-u@!TjhGS60t*O%jyoRZ5y9oc<&9AY3YHH;n*ca+HtVeU|U58N|Im(8EP3-%%SxA|#ObHBstf z-M7Auz?y!nbR!N?Izag(#F?D5AbUluzK%4GpXuUSH%+8%(m)iMX{P4WO={|~uc@Cagcm5d5dM*XV7erO-$d777lhnRaC^$y!7vNm#~y z(&P4$Or2+$$`WM{kEbtpiNP_-@d9RZ0f_<8^$3AmK)jSg(vU)s>n^n1m2?{qPLS4J zr@HK^8KGCU9o?q7g0tROe4hCCe#pKMR1uSIX&(M9t|DB(@>Q!($9t*Ys>VQ?k8h?B->xTGbc>K*Q#FYz z4(r7@-cWtW+>oEK(0Iainw8bvo)E4c0!u4sdpbAZAbd2G>}@|#fl9Z*r}ABai=0l< z&^NK2+!*ZT0W1f^Z9A_Tp54eud`dJ^ajivehmoZv5yveuLW;-Zqi1`nd{V#5jTkGf z{JRR;{w5`TG4huDr3!~RHFV$_ZtsDbtt-8oMX^_Lct0ATbU#uoJ~Nyj{)&!3jENyh z@Cv<*CZ^nrdV7obbe>H(P}spZBV>B*fv(8MNslLSi1OMf>!zvzYburYuFn92h*CS= zPs?@rNg4K2NoFbS zo&1N!;!Jj!BjHY=C5kIQOST1lf4pFARAy*&D*JIm?UPmAQ-u3uYz2Vt{@T4o7fhr! zngN!xxKaHSs9-2?7{yITX3WbhJCeRERQq_?;a)XeP$~%1X@$RQxERfh!V_szp(uP~ zRYM@X{c=g_yjzueXn2CwI9&h0fsa1;K4O$SLPtd2SeZV0Bve^^rtVw}Mf*~kFc&*H z9~gmFJuMTO>^_Q*ZP>k(NZQABq2<-DL1#JbWUV{TQ7!{o^yA__IP40I$?sE13Juzf zw^z3H;`+`;i{Gwq{nH@yh^6{fKBgT+^e|}m2Bnx|77Z(Ssty)58zyfYVb6qZ0DFpIm zF?RV;)iP9&C7@3SGWbAYB?S_A=jiZm3KwixZyGMOQS{H&Jf>|;&swB+t^qMw4I4 From a16ec0f709295939de0352c440ace6d7a1f26e29 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 12 Nov 2020 16:13:56 -0800 Subject: [PATCH 017/169] Added Kerberos and CredSsp policies --- windows/client-management/mdm/TOC.md | 2 + .../mdm/policies-in-policy-csp-admx-backed.md | 19 + .../policy-configuration-service-provider.md | 66 ++ .../mdm/policy-csp-admx-credssp.md | 964 ++++++++++++++++++ .../mdm/policy-csp-admx-kerberos.md | 641 ++++++++++++ 5 files changed, 1692 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-credssp.md create mode 100644 windows/client-management/mdm/policy-csp-admx-kerberos.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index e875d5d3a7..a9c36e49a0 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -179,6 +179,7 @@ #### [ADMX_CipherSuiteOrder](policy-csp-admx-ciphersuiteorder.md) #### [ADMX_COM](policy-csp-admx-com.md) #### [ADMX_Cpls](policy-csp-admx-cpls.md) +#### [ADMX_CredSsp](policy-csp-admx-credssp.md) #### [ADMX_CtrlAltDel](policy-csp-admx-ctrlaltdel.md) #### [ADMX_DigitalLocker](policy-csp-admx-digitallocker.md) #### [ADMX_DnsClient](policy-csp-admx-dnsclient.md) @@ -191,6 +192,7 @@ #### [ADMX_Help](policy-csp-admx-help.md) #### [ADMX_HelpAndSupport](policy-csp-admx-helpandsupport.md) #### [ADMX_kdc](policy-csp-admx-kdc.md) +#### [ADMX_Kerberos](policy-csp-admx-kerberos.md) #### [ADMX_LanmanServer](policy-csp-admx-lanmanserver.md) #### [ADMX_LinkLayerTopologyDiscovery](policy-csp-admx-linklayertopologydiscovery.md) #### [ADMX_MMC](policy-csp-admx-mmc.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 8ede74a7a6..8604b2c6e6 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -61,6 +61,17 @@ ms.date: 10/08/2020 - [ADMX_COM/AppMgmt_COM_SearchForCLSID_1](./policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-1) - [ADMX_COM/AppMgmt_COM_SearchForCLSID_2](./policy-csp-admx-com.md#admx-com-appmgmt-com-searchforclsid-2) - [ADMX_Cpls/UseDefaultTile](./policy-csp-admx-cpls.md#admx-cpls-usedefaulttile) +- [ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly](./policy-csp-admx-credssp.md#admx-credssp-allowdefcredentialswhenntlmonly) +- [ADMX_CredSsp/AllowDefaultCredentials](./policy-csp-admx-credssp.md#admx-credssp-allowdefaultcredentials) +- [ADMX_CredSsp/AllowEncryptionOracle](./policy-csp-admx-credssp.md#admx-credssp-allowencryptionoracle) +- [ADMX_CredSsp/AllowFreshCredentials](./policy-csp-admx-credssp.md#admx-credssp-allowfreshcredentials) +- [ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly](./policy-csp-admx-credssp.md#admx-credssp-allowfreshcredentialswhenntlmonly) +- [ADMX_CredSsp/AllowSavedCredentials](./policy-csp-admx-credssp.md#admx-credssp-allowsavedcredentials) +- [ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly](./policy-csp-admx-credssp.md#admx-credssp-allowsavedcredentialswhenntlmonly) +- [ADMX_CredSsp/DenyDefaultCredentials](./policy-csp-admx-credssp.md#admx-credssp-denydefaultcredentials) +- [ADMX_CredSsp/DenyFreshCredentials](./policy-csp-admx-credssp.md#admx-credssp-denyfreshcredentials) +- [ADMX_CredSsp/DenySavedCredentials](./policy-csp-admx-credssp.md#admx-credssp-denysavedcredentials) +- [ADMX_CredSsp/RestrictedRemoteAdministration](./policy-csp-admx-credssp.md#admx-credssp-restrictedremoteadministration) - [ADMX_CtrlAltDel/DisableChangePassword](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablechangepassword) - [ADMX_CtrlAltDel/DisableLockComputer](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablelockcomputer) - [ADMX_CtrlAltDel/DisableTaskMgr](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disabletaskmgr) @@ -128,6 +139,14 @@ ms.date: 10/08/2020 - [ADMX_kdc/RequestCompoundId](./policy-csp-admx-kdc.md#admx-kdc-requestcompoundid) - [ADMX_kdc/TicketSizeThreshold](./policy-csp-admx-kdc.md#admx-kdc-ticketsizethreshold) - [ADMX_kdc/emitlili](./policy-csp-admx-kdc.md#admx-kdc-emitlili) +- [ADMX_Kerberos/AlwaysSendCompoundId](./policy-csp-admx-kerberos.md#admx-kerberos-alwayssendcompoundid) +- [ADMX_Kerberos/DevicePKInitEnabled](./policy-csp-admx-kerberos.md#admx-kerberos-devicepkinitenabled) +- [ADMX_Kerberos/HostToRealm](./policy-csp-admx-kerberos.md#admx-kerberos-hosttorealm) +- [ADMX_Kerberos/KdcProxyDisableServerRevocationCheck](./policy-csp-admx-kerberos.md#admx-kerberos-kdcproxydisableserverrevocationcheck) +- [ADMX_Kerberos/KdcProxyServer](./policy-csp-admx-kerberos.md#admx-kerberos-kdcproxyserver) +- [ADMX_Kerberos/MitRealms](./policy-csp-admx-kerberos.md#admx-kerberos-mitrealms) +- [ADMX_Kerberos/ServerAcceptsCompound](./policy-csp-admx-kerberos.md#admx-kerberos-serveracceptscompound) +- [ADMX_Kerberos/StrictTarget](./policy-csp-admx-kerberos.md#admx-kerberos-stricttarget) - [ADMX_LanmanServer/Pol_CipherSuiteOrder](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-ciphersuiteorder) - [ADMX_LanmanServer/Pol_HashPublication](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashpublication) - [ADMX_LanmanServer/Pol_HashSupportVersion](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-hashsupportversion) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index a1a8db3a83..570858dd4b 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -332,6 +332,43 @@ The following diagram shows the Policy configuration service provider in tree fo +### ADMX_CredSsp policies + +

+
+ ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly +
+
+ ADMX_CredSsp/AllowDefaultCredentials +
+
+ ADMX_CredSsp/AllowEncryptionOracle +
+
+ ADMX_CredSsp/AllowFreshCredentials +
+
+ ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly +
+
+ ADMX_CredSsp/AllowSavedCredentials +
+
+ ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly +
+
+ ADMX_CredSsp/DenyDefaultCredentials +
+
+ ADMX_CredSsp/DenyFreshCredentials +
+
+ ADMX_CredSsp/DenySavedCredentials +
+
+ ADMX_CredSsp/RestrictedRemoteAdministration +
+
### ADMX_CtrlAltDel policies
@@ -576,6 +613,35 @@ The following diagram shows the Policy configuration service provider in tree fo
+### ADMX_Kerberos policies + +
+
+ ADMX_Kerberos/AlwaysSendCompoundId +
+
+ ADMX_Kerberos/DevicePKInitEnabled +
+
+ ADMX_Kerberos/HostToRealm +
+
+ ADMX_Kerberos/KdcProxyDisableServerRevocationCheck +
+
+ ADMX_Kerberos/KdcProxyServer +
+
+ ADMX_Kerberos/MitRealms +
+
+ ADMX_Kerberos/ServerAcceptsCompound +
+
+ ADMX_Kerberos/StrictTarget +
+
+ ### ADMX_LanmanServer policies
diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md new file mode 100644 index 0000000000..12d2fd54c1 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -0,0 +1,964 @@ +--- +title: Policy CSP - ADMX_CredSsp +description: Policy CSP - ADMX_CredSsp +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/12/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_CredSsp +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_CredSsp policies + +
+
+ ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly +
+
+ ADMX_CredSsp/AllowDefaultCredentials +
+
+ ADMX_CredSsp/AllowEncryptionOracle +
+
+ ADMX_CredSsp/AllowFreshCredentials +
+
+ ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly +
+
+ ADMX_CredSsp/AllowSavedCredentials +
+
+ ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly +
+
+ ADMX_CredSsp/DenyDefaultCredentials +
+
+ ADMX_CredSsp/DenyFreshCredentials +
+
+ ADMX_CredSsp/DenySavedCredentials +
+
+ ADMX_CredSsp/RestrictedRemoteAdministration +
+
+ + +
+ + +**ADMX_CredSsp/AllowDefCredentialsWhenNTLMOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via NTLM. + +If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows). + +If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine. + +Note: The "Allow delegating default credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. + +For Example: + +- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +- TERMSRV/* Remote Desktop Session Host running on all machines. +- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating default credentials with NTLM-only server authentication* +- GP name: *AllowDefCredentialsWhenNTLMOnly* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
+ + +**ADMX_CredSsp/AllowDefaultCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved by using a trusted X509 certificate or Kerberos. + +If you enable this policy setting, you can specify the servers to which the user's default credentials can be delegated (default credentials are those that you use when first logging on to Windows). + +The policy becomes effective the next time the user signs on to a computer running Windows. + +If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any computer. Applications depending upon this delegation behavior might fail authentication. For more information, see KB. + +FWlink for KB: +http://go.microsoft.com/fwlink/?LinkId=301508 + +Note: The "Allow delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. + +For Example: + +- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +- TERMSRV/* Remote Desktop Session Host running on all machines. +- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating default credentials* +- GP name: *AllowDefaultCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
+ + +**ADMX_CredSsp/AllowEncryptionOracle** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the CredSSP component (for example: Remote Desktop Connection). + +Some versions of the CredSSP protocol are vulnerable to an encryption oracle attack against the client. This policy controls compatibility with vulnerable clients and servers. This policy allows you to set the level of protection desired for the encryption oracle vulnerability. + +If you enable this policy setting, CredSSP version support will be selected based on the following options: + +Force Updated Clients: Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. Note: this setting should not be deployed until all remote hosts support the newest version. + +Mitigated: Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients. + +Vulnerable: Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients. + +For more information about the vulnerability and servicing requirements for protection, see https://go.microsoft.com/fwlink/?linkid=866660 + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Encryption Oracle Remediation* +- GP name: *AllowEncryptionOracle* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
+ + +**ADMX_CredSsp/AllowFreshCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via a trusted X509 certificate or Kerberos. + +If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application). + +If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). + +If you disable this policy setting, delegation of fresh credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard is permitted when specifying the SPN. + +For Example: + +- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +- TERMSRV/* Remote Desktop Session Host running on all machines. +- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating fresh credentials* +- GP name: *AllowFreshCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
+ + +**ADMX_CredSsp/AllowFreshCredentialsWhenNTLMOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via NTLM. + +If you enable this policy setting, you can specify the servers to which the user's fresh credentials can be delegated (fresh credentials are those that you are prompted for when executing the application). + +If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of fresh credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). + +If you disable this policy setting, delegation of fresh credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating fresh credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. + +For Example: + +- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +- TERMSRV/* Remote Desktop Session Host running on all machines. +- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating fresh credentials with NTLM-only server authentication* +- GP name: *AllowFreshCredentialsWhenNTLMOnly* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
+ + +**ADMX_CredSsp/AllowSavedCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via a trusted X509 certificate or Kerberos. + +If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). + +If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*). + +If you disable this policy setting, delegation of saved credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating saved credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. + +For Example: + +- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +- TERMSRV/* Remote Desktop Session Host running on all machines. +- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating saved credentials* +- GP name: *AllowSavedCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
+ + +**ADMX_CredSsp/AllowSavedCredentialsWhenNTLMOnly** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +This policy setting applies when server authentication was achieved via NTLM. + +If you enable this policy setting, you can specify the servers to which the user's saved credentials can be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). + +If you do not configure (by default) this policy setting, after proper mutual authentication, delegation of saved credentials is permitted to Remote Desktop Session Host running on any machine (TERMSRV/*) if the client machine is not a member of any domain. If the client is domain-joined, by default the delegation of saved credentials is not permitted to any machine. + +If you disable this policy setting, delegation of saved credentials is not permitted to any machine. + +> [!NOTE] +> The "Allow delegating saved credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. + +For Example: + +- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +- TERMSRV/* Remote Desktop Session Host running on all machines. +- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow delegating saved credentials with NTLM-only server authentication* +- GP name: *AllowSavedCredentialsWhenNTLMOnly* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
+ + +**ADMX_CredSsp/DenyDefaultCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +If you enable this policy setting, you can specify the servers to which the user's default credentials cannot be delegated (default credentials are those that you use when first logging on to Windows). + +If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. + +> [!NOTE] +> The "Deny delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. + +For Example: + +- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +- TERMSRV/* Remote Desktop Session Host running on all machines. +- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + +This policy setting can be used in combination with the "Allow delegating default credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating default credentials" server list. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Deny delegating default credentials* +- GP name: *DenyDefaultCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
+ + +**ADMX_CredSsp/DenyFreshCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +If you enable this policy setting, you can specify the servers to which the user's fresh credentials cannot be delegated (fresh credentials are those that you are prompted for when executing the application). + +If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. + +> [!NOTE] +> The "Deny delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. + +For Example: + +- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +- TERMSRV/* Remote Desktop Session Host running on all machines. +- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + +This policy setting can be used in combination with the "Allow delegating fresh credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating fresh credentials" server list. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Deny delegating fresh credentials* +- GP name: *DenyFreshCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
+ + +**ADMX_CredSsp/DenySavedCredentials** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). + +If you enable this policy setting, you can specify the servers to which the user's saved credentials cannot be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). + +If you disable or do not configure (by default) this policy setting, this policy setting does not specify any server. + +> [!NOTE] +> The "Deny delegating saved credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. + +For Example: + +- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +- TERMSRV/* Remote Desktop Session Host running on all machines. +- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com + +This policy setting can be used in combination with the "Allow delegating saved credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating saved credentials" server list. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Deny delegating saved credentials* +- GP name: *DenySavedCredentials* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
+ + +**ADMX_CredSsp/RestrictedRemoteAdministration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. When running in Restricted Admin or Remote Credential Guard mode, participating apps do not expose signed in or supplied credentials to a remote host. Restricted Admin limits access to resources located on other servers or networks from the remote host because credentials are not delegated. Remote Credential Guard does not limit access to resources because it redirects all requests back to the client device. + +Participating apps: +Remote Desktop Client + +If you enable this policy setting, the following options are supported: + +- Restrict credential delegation: Participating applications must use Restricted Admin or Remote Credential Guard to connect to remote hosts. +- Require Remote Credential Guard: Participating applications must use Remote Credential Guard to connect to remote hosts. +- Require Restricted Admin: Participating applications must use Restricted Admin to connect to remote hosts. + +If you disable or do not configure this policy setting, Restricted Admin and Remote Credential Guard mode are not enforced and participating apps can delegate credentials to remote devices. + +> [!NOTE] +> To disable most credential delegation, it may be sufficient to deny delegation in Credential Security Support Provider (CredSSP) by modifying Administrative template settings (located at Computer Configuration\Administrative Templates\System\Credentials Delegation). +> +> On Windows 8.1 and Windows Server 2012 R2, enabling this policy will enforce Restricted Administration mode, regardless of the mode chosen. These versions do not support Remote Credential Guard. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict delegation of credentials to remote servers* +- GP name: *RestrictedRemoteAdministration* +- GP path: *System\Credentials Delegation* +- GP ADMX file name: *CredSsp.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-kerberos.md b/windows/client-management/mdm/policy-csp-admx-kerberos.md new file mode 100644 index 0000000000..594a97bf72 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-kerberos.md @@ -0,0 +1,641 @@ +--- +title: Policy CSP - ADMX_Kerberos +description: Policy CSP - ADMX_Kerberos +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/12/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Kerberos +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_Kerberos policies + +
+
+ ADMX_Kerberos/AlwaysSendCompoundId +
+
+ ADMX_Kerberos/DevicePKInitEnabled +
+
+ ADMX_Kerberos/HostToRealm +
+
+ ADMX_Kerberos/KdcProxyDisableServerRevocationCheck +
+
+ ADMX_Kerberos/KdcProxyServer +
+
+ ADMX_Kerberos/MitRealms +
+
+ ADMX_Kerberos/ServerAcceptsCompound +
+
+ ADMX_Kerberos/StrictTarget +
+
+ + +
+ + +**ADMX_Kerberos/AlwaysSendCompoundId** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether a device always sends a compound authentication request when the resource domain requests compound identity. + +> [!NOTE] +> For a domain controller to request compound authentication, the policies "KDC support for claims, compound authentication, and Kerberos armoring" and "Request compound authentication" must be configured and enabled in the resource account domain. + +If you enable this policy setting and the resource domain requests compound authentication, devices that support compound authentication always send a compound authentication request. + +If you disable or do not configure this policy setting and the resource domain requests compound authentication, devices will send a non-compounded authentication request first then a compound authentication request when the service requests compound authentication. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Always send compound authentication first* +- GP name: *AlwaysSendCompoundId* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
+ + +**ADMX_Kerberos/DevicePKInitEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Support for device authentication using certificate will require connectivity to a DC in the device account domain which supports certificate authentication for computer accounts. + +This policy setting allows you to set support for Kerberos to attempt authentication using the certificate for the device to the domain. + +If you enable this policy setting, the device's credentials will be selected based on the following options: + +- Automatic: Device will attempt to authenticate using its certificate. If the DC does not support computer account authentication using certificates then authentication with password will be attempted. +- Force: Device will always authenticate using its certificate. If a DC cannot be found which support computer account authentication using certificates then authentication will fail. + +If you disable this policy setting, certificates will never be used. + +If you do not configure this policy setting, Automatic will be used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Support device authentication using certificate* +- GP name: *DevicePKInitEnabled* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
+ + +**ADMX_Kerberos/HostToRealm** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify which DNS host names and which DNS suffixes are mapped to a Kerberos realm. + +If you enable this policy setting, you can view and change the list of DNS host names and DNS suffixes mapped to a Kerberos realm as defined by Group Policy. To view the list of mappings, enable the policy setting and then click the Show button. To add a mapping, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type a realm name. In the Value column, type the list of DNS host names and DNS suffixes using the appropriate syntax format. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters. + +If you disable this policy setting, the host name-to-Kerberos realm mappings list defined by Group Policy is deleted. + +If you do not configure this policy setting, the system uses the host name-to-Kerberos realm mappings that are defined in the local registry, if they exist. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define host name-to-Kerberos realm mappings* +- GP name: *HostToRealm* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
+ + +**ADMX_Kerberos/KdcProxyDisableServerRevocationCheck** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to disable revocation check for the SSL certificate of the targeted KDC proxy server. + +If you enable this policy setting, revocation check for the SSL certificate of the KDC proxy server is ignored by the Kerberos client. This policy setting should only be used in troubleshooting KDC proxy connections. +Warning: When revocation check is ignored, the server represented by the certificate is not guaranteed valid. + +If you disable or do not configure this policy setting, the Kerberos client enforces the revocation check for the SSL certificate. The connection to the KDC proxy server is not established if the revocation check fails. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable revocation checking for the SSL certificate of KDC proxy servers* +- GP name: *KdcProxyDisableServerRevocationCheck* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
+ + +**ADMX_Kerberos/KdcProxyServer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the Kerberos client's mapping to KDC proxy servers for domains based on their DNS suffix names. + +If you enable this policy setting, the Kerberos client will use the KDC proxy server for a domain when a domain controller cannot be located based on the configured mappings. To map a KDC proxy server to a domain, enable the policy setting, click Show, and then map the KDC proxy server name(s) to the DNS name for the domain using the syntax described in the options pane. In the Show Contents dialog box in the Value Name column, type a DNS suffix name. In the Value column, type the list of proxy servers using the appropriate syntax format. To view the list of mappings, enable the policy setting and then click the Show button. To remove a mapping from the list, click the mapping entry to be removed, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters. + +If you disable or do not configure this policy setting, the Kerberos client does not have KDC proxy servers settings defined by Group Policy. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify KDC proxy servers for Kerberos clients* +- GP name: *KdcProxyServer* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
+ + +**ADMX_Kerberos/MitRealms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the Kerberos client so that it can authenticate with interoperable Kerberos V5 realms, as defined by this policy setting. + +If you enable this policy setting, you can view and change the list of interoperable Kerberos V5 realms and their settings. To view the list of interoperable Kerberos V5 realms, enable the policy setting and then click the Show button. To add an interoperable Kerberos V5 realm, enable the policy setting, note the syntax, and then click Show. In the Show Contents dialog box in the Value Name column, type the interoperable Kerberos V5 realm name. In the Value column, type the realm flags and host names of the host KDCs using the appropriate syntax format. To remove an interoperable Kerberos V5 realm Value Name or Value entry from the list, click the entry, and then press the DELETE key. To edit a mapping, remove the current entry from the list and add a new one with different parameters. + +If you disable this policy setting, the interoperable Kerberos V5 realm settings defined by Group Policy are deleted. + +If you do not configure this policy setting, the system uses the interoperable Kerberos V5 realm settings that are defined in the local registry, if they exist. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define interoperable Kerberos V5 realm settings* +- GP name: *MitRealms* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
+ + +**ADMX_Kerberos/ServerAcceptsCompound** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls configuring the device's Active Directory account for compound authentication. + +Support for providing compound authentication which is used for access control will require enough domain controllers in the resource account domains to support the requests. The Domain Administrator must configure the policy "Support Dynamic Access Control and Kerberos armoring" on all the domain controllers to support this policy. + +If you enable this policy setting, the device's Active Directory account will be configured for compound authentication by the following options: + +- Never: Compound authentication is never provided for this computer account. +- Automatic: Compound authentication is provided for this computer account when one or more applications are configured for Dynamic Access Control. +- Always: Compound authentication is always provided for this computer account. + +If you disable this policy setting, Never will be used. + +If you do not configure this policy setting, Automatic will be used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Support compound authentication* +- GP name: *ServerAcceptsCompound* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
+ + +**ADMX_Kerberos/StrictTarget** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure this server so that Kerberos can decrypt a ticket that contains this system-generated SPN. When an application attempts to make a remote procedure call (RPC) to this server with a NULL value for the service principal name (SPN), computers running Windows 7 or later attempt to use Kerberos by generating an SPN. + +If you enable this policy setting, only services running as LocalSystem or NetworkService are allowed to accept these connections. Services running as identities different from LocalSystem or NetworkService might fail to authenticate. + +If you disable or do not configure this policy setting, any service is allowed to accept incoming connections by using this system-generated SPN. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Require strict target SPN match on remote procedure calls* +- GP name: *StrictTarget* +- GP path: *System\Kerberos* +- GP ADMX file name: *Kerberos.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From beddf8c3beab9bde045f8e0c5f16de59f4421772 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 12 Nov 2020 16:18:26 -0800 Subject: [PATCH 018/169] Fixed build warning --- windows/client-management/mdm/policy-csp-admx-credssp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md index 12d2fd54c1..d7b0960bb2 100644 --- a/windows/client-management/mdm/policy-csp-admx-credssp.md +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -194,7 +194,7 @@ The policy becomes effective the next time the user signs on to a computer runni If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any computer. Applications depending upon this delegation behavior might fail authentication. For more information, see KB. FWlink for KB: -http://go.microsoft.com/fwlink/?LinkId=301508 +https://go.microsoft.com/fwlink/?LinkId=301508 Note: The "Allow delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. From 5953293f7b571410871ea6e32729f2620bd1fa8b Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 12 Nov 2020 16:28:37 -0800 Subject: [PATCH 019/169] Formatting --- .../mdm/policy-csp-admx-credssp.md | 121 +++++++++--------- 1 file changed, 63 insertions(+), 58 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md index d7b0960bb2..264813691b 100644 --- a/windows/client-management/mdm/policy-csp-admx-credssp.md +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -112,13 +112,14 @@ If you enable this policy setting, you can specify the servers to which the user If you disable or do not configure (by default) this policy setting, delegation of default credentials is not permitted to any machine. -Note: The "Allow delegating default credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. - -For Example: - -- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine -- TERMSRV/* Remote Desktop Session Host running on all machines. -- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com +> [!NOTE] +> The "Allow delegating default credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com > [!TIP] @@ -196,13 +197,14 @@ If you disable or do not configure (by default) this policy setting, delegation FWlink for KB: https://go.microsoft.com/fwlink/?LinkId=301508 -Note: The "Allow delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. - -For Example: - -- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine -- TERMSRV/* Remote Desktop Session Host running on all machines. -- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com +> [!NOTE] +> The "Allow delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com > [!TIP] @@ -273,11 +275,14 @@ Some versions of the CredSSP protocol are vulnerable to an encryption oracle att If you enable this policy setting, CredSSP version support will be selected based on the following options: -Force Updated Clients: Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. Note: this setting should not be deployed until all remote hosts support the newest version. +- Force Updated Clients: Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. -Mitigated: Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients. +> [!NOTE] +> This setting should not be deployed until all remote hosts support the newest version. -Vulnerable: Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients. +- Mitigated: Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients. + +- Vulnerable: Client applications which use CredSSP will expose the remote servers to attacks by supporting fall back to the insecure versions and services using CredSSP will accept unpatched clients. For more information about the vulnerability and servicing requirements for protection, see https://go.microsoft.com/fwlink/?linkid=866660 @@ -356,12 +361,12 @@ If you disable this policy setting, delegation of fresh credentials is not permi > [!NOTE] > The "Allow delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard is permitted when specifying the SPN. +> +> For Example: -For Example: - -- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine -- TERMSRV/* Remote Desktop Session Host running on all machines. -- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com > [!TIP] @@ -438,12 +443,12 @@ If you disable this policy setting, delegation of fresh credentials is not permi > [!NOTE] > The "Allow delegating fresh credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. - -For Example: - -- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine -- TERMSRV/* Remote Desktop Session Host running on all machines. -- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com > [!TIP] @@ -520,12 +525,12 @@ If you disable this policy setting, delegation of saved credentials is not permi > [!NOTE] > The "Allow delegating saved credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. - -For Example: - -- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine -- TERMSRV/* Remote Desktop Session Host running on all machines. -- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com > [!TIP] @@ -602,12 +607,12 @@ If you disable this policy setting, delegation of saved credentials is not permi > [!NOTE] > The "Allow delegating saved credentials with NTLM-only server authentication" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard character is permitted when specifying the SPN. - -For Example: - -- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine -- TERMSRV/* Remote Desktop Session Host running on all machines. -- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in humanresources.fabrikam.com > [!TIP] @@ -680,12 +685,12 @@ If you disable or do not configure (by default) this policy setting, this policy > [!NOTE] > The "Deny delegating default credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. - -For Example: - -- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine -- TERMSRV/* Remote Desktop Session Host running on all machines. -- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com This policy setting can be used in combination with the "Allow delegating default credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating default credentials" server list. @@ -760,12 +765,12 @@ If you disable or do not configure (by default) this policy setting, this policy > [!NOTE] > The "Deny delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. - -For Example: - -- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine -- TERMSRV/* Remote Desktop Session Host running on all machines. -- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com This policy setting can be used in combination with the "Allow delegating fresh credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating fresh credentials" server list. @@ -840,12 +845,12 @@ If you disable or do not configure (by default) this policy setting, this policy > [!NOTE] > The "Deny delegating saved credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials cannot be delegated. The use of a single wildcard character is permitted when specifying the SPN. - -For Example: - -- TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine -- TERMSRV/* Remote Desktop Session Host running on all machines. -- TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com +> +> For Example: +> +> - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine +> - TERMSRV/* Remote Desktop Session Host running on all machines. +> - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com This policy setting can be used in combination with the "Allow delegating saved credentials" policy setting to define exceptions for specific servers that are otherwise permitted when using wildcard characters in the "Allow delegating saved credentials" server list. From 26468ce82ecf0593685955f7874a2308ac4596e6 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 12 Nov 2020 16:33:57 -0800 Subject: [PATCH 020/169] Formatting --- windows/client-management/mdm/policy-csp-admx-credssp.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md index 264813691b..4b830deeb7 100644 --- a/windows/client-management/mdm/policy-csp-admx-credssp.md +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -277,8 +277,8 @@ If you enable this policy setting, CredSSP version support will be selected base - Force Updated Clients: Client applications which use CredSSP will not be able to fall back to the insecure versions and services using CredSSP will not accept unpatched clients. -> [!NOTE] -> This setting should not be deployed until all remote hosts support the newest version. + > [!NOTE] + > This setting should not be deployed until all remote hosts support the newest version. - Mitigated: Client applications which use CredSSP will not be able to fall back to the insecure version but services using CredSSP will accept unpatched clients. See the link below for important information about the risk posed by remaining unpatched clients. @@ -363,7 +363,7 @@ If you disable this policy setting, delegation of fresh credentials is not permi > The "Allow delegating fresh credentials" policy setting can be set to one or more Service Principal Names (SPNs). The SPN represents the target server to which the user credentials can be delegated. The use of a single wildcard is permitted when specifying the SPN. > > For Example: - +> > - TERMSRV/host.humanresources.fabrikam.com Remote Desktop Session Host running on host.humanresources.fabrikam.com machine > - TERMSRV/* Remote Desktop Session Host running on all machines. > - TERMSRV/*.humanresources.fabrikam.com Remote Desktop Session Host running on all machines in .humanresources.fabrikam.com From c2cebed14d7fa6d77ca39585c18f5ed41997d0a1 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 13 Nov 2020 11:07:23 -0800 Subject: [PATCH 021/169] Added WPN policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 8 +- .../policy-configuration-service-provider.md | 23 + .../mdm/policy-csp-admx-wpn.md | 489 ++++++++++++++++++ 4 files changed, 520 insertions(+), 1 deletion(-) create mode 100644 windows/client-management/mdm/policy-csp-admx-wpn.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index a9c36e49a0..e35b1817cc 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -234,6 +234,7 @@ #### [ADMX_WindowsStore](policy-csp-admx-windowsstore.md) #### [ADMX_WinInit](policy-csp-admx-wininit.md) #### [ADMX_wlansvc](policy-csp-admx-wlansvc.md) +#### [ADMX_WPN](policy-csp-admx-wpn.md) #### [ApplicationDefaults](policy-csp-applicationdefaults.md) #### [ApplicationManagement](policy-csp-applicationmanagement.md) #### [AppRuntime](policy-csp-appruntime.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 8604b2c6e6..d85775baec 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -812,7 +812,13 @@ ms.date: 10/08/2020 - [ADMX_WinInit/ShutdownTimeoutHungSessionsDescription](./policy-csp-admx-wininit.md#admx-wininit-shutdowntimeouthungsessionsdescription) - [ADMX_wlansvc/SetCost](./policy-csp-admx-wlansvc.md#admx-wlansvc-setcost) - [ADMX_wlansvc/SetPINEnforced](./policy-csp-admx-wlansvc.md#admx-wlansvc-setpinenforced) -- [ADMX_wlansvc/SetPINPreferred](./policy-csp-admx-wlansvc.md#admx-wlansvc-setpinpreferred) +- [ADMX_wlansvc/SetPINPreferred](./policy-csp-admx-wlansvc.md#admx-wlansvc-setpinpreferred) +- [ADMX_WPN/NoCallsDuringQuietHours](./policy-csp-admx-wpn.md#admx-wpn-nocallsduringquiethours) +- [ADMX_WPN/NoLockScreenToastNotification](./policy-csp-admx-wpn.md#admx-wpn-nolockscreentoastnotification) +- [ADMX_WPN/NoQuietHours](./policy-csp-admx-wpn.md#admx-wpn-noquiethours) +- [ADMX_WPN/NoToastNotification](./policy-csp-admx-wpn.md#admx-wpn-notoastnotification) +- [ADMX_WPN/QuietHoursDailyBeginMinute](./policy-csp-admx-wpn.md#admx-wpn-quiethoursdailybeginminute) +- [ADMX_WPN/QuietHoursDailyEndMinute](./policy-csp-admx-wpn.md#admx-wpn-quiethoursdailyendminute) - [AppRuntime/AllowMicrosoftAccountsToBeOptional](./policy-csp-appruntime.md#appruntime-allowmicrosoftaccountstobeoptional) - [AppVirtualization/AllowAppVClient](./policy-csp-appvirtualization.md#appvirtualization-allowappvclient) - [AppVirtualization/AllowDynamicVirtualization](./policy-csp-appvirtualization.md#appvirtualization-allowdynamicvirtualization) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 570858dd4b..ef13b92e7e 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -2839,6 +2839,29 @@ The following diagram shows the Policy configuration service provider in tree fo
+### ADMX_WPN policies + +
+
+ ADMX_WPN/NoCallsDuringQuietHours +
+
+ ADMX_WPN/NoLockScreenToastNotification +
+
+ ADMX_WPN/NoQuietHours +
+
+ ADMX_WPN/NoToastNotification +
+
+ ADMX_WPN/QuietHoursDailyBeginMinute +
+
+ ADMX_WPN/QuietHoursDailyEndMinute +
+
+ ### ApplicationDefaults policies
diff --git a/windows/client-management/mdm/policy-csp-admx-wpn.md b/windows/client-management/mdm/policy-csp-admx-wpn.md new file mode 100644 index 0000000000..863f094564 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-wpn.md @@ -0,0 +1,489 @@ +--- +title: Policy CSP - ADMX_WPN +description: Policy CSP - ADMX_WPN +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WPN +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_WPN policies + +
+
+ ADMX_WPN/NoCallsDuringQuietHours +
+
+ ADMX_WPN/NoLockScreenToastNotification +
+
+ ADMX_WPN/NoQuietHours +
+
+ ADMX_WPN/NoToastNotification +
+
+ ADMX_WPN/QuietHoursDailyBeginMinute +
+
+ ADMX_WPN/QuietHoursDailyEndMinute +
+
+ + +
+ + +**ADMX_WPN/NoCallsDuringQuietHours** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting blocks voice and video calls during Quiet Hours. + +If you enable this policy setting, voice and video calls will be blocked during the designated Quiet Hours time window each day, and users will not be able to customize any other Quiet Hours settings. + +If you disable this policy setting, voice and video calls will be allowed during Quiet Hours, and users will not be able to customize this or any other Quiet Hours settings. + +If you do not configure this policy setting, voice and video calls will be allowed during Quiet Hours by default. Administrators and users will be able to modify this setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off calls during Quiet Hours* +- GP name: *NoCallsDuringQuietHours* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
+ + +**ADMX_WPN/NoLockScreenToastNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off toast notifications on the lock screen. + +If you enable this policy setting, applications will not be able to raise toast notifications on the lock screen. + +If you disable or do not configure this policy setting, toast notifications on the lock screen are enabled and can be turned off by the administrator or user. + +No reboots or service restarts are required for this policy setting to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off toast notifications on the lock screen* +- GP name: *NoLockScreenToastNotification* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
+ + +**ADMX_WPN/NoQuietHours** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off Quiet Hours functionality. + +If you enable this policy setting, toast notifications will not be suppressed and some background tasks will not be deferred during the designated Quiet Hours time window each day. + +If you disable this policy setting, toast notifications will be suppressed and some background task deferred during the designated Quiet Hours time window. Users will not be able to change this or any other Quiet Hours settings. + +If you do not configure this policy setting, Quiet Hours are enabled by default but can be turned off or by the administrator or user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Quiet Hours* +- GP name: *NoQuietHours* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
+ + +**ADMX_WPN/NoToastNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off toast notifications for applications. + +If you enable this policy setting, applications will not be able to raise toast notifications. + +Note that this policy does not affect taskbar notification balloons. + +Note that Windows system features are not affected by this policy. You must enable/disable system features individually to stop their ability to raise toast notifications. + +If you disable or do not configure this policy setting, toast notifications are enabled and can be turned off by the administrator or user. + +No reboots or service restarts are required for this policy setting to take effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off toast notifications* +- GP name: *NoToastNotification* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
+ + +**ADMX_WPN/QuietHoursDailyBeginMinute** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the number of minutes after midnight (local time) that Quiet Hours is to begin each day. + +If you enable this policy setting, the specified time will be used, and users will not be able to customize any Quiet Hours settings. + +If you disable this policy setting, a default value will be used, and users will not be able to change it or any other Quiet Hours setting. + +If you do not configure this policy setting, a default value will be used, which administrators and users will be able to modify. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set the time Quiet Hours begins each day* +- GP name: *QuietHoursDailyBeginMinute* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
+ + +**ADMX_WPN/QuietHoursDailyEndMinute** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the number of minutes after midnight (local time) that Quiet Hours is to end each day. + +If you enable this policy setting, the specified time will be used, and users will not be able to customize any Quiet Hours settings. + +If you disable this policy setting, a default value will be used, and users will not be able to change it or any other Quiet Hours setting. + +If you do not configure this policy setting, a default value will be used, which administrators and users will be able to modify. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Set the time Quiet Hours ends each day* +- GP name: *QuietHoursDailyEndMinute* +- GP path: *Start Menu and Taskbar\Notifications* +- GP ADMX file name: *WPN.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file From d25dda17b076ba546fec6ee2f78655299c0c5c4f Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 13 Nov 2020 11:31:35 -0800 Subject: [PATCH 022/169] Added SystemRestore policy --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 1 + .../policy-configuration-service-provider.md | 8 ++ .../mdm/policy-csp-admx-systemrestore.md | 120 ++++++++++++++++++ 4 files changed, 130 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-systemrestore.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index e35b1817cc..98251b87fe 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -218,6 +218,7 @@ #### [ADMX_Smartcard](policy-csp-admx-smartcard.md) #### [ADMX_Snmp](policy-csp-admx-snmp.md) #### [ADMX_StartMenu](policy-csp-admx-startmenu.md) +#### [ADMX_SystemRestore](policy-csp-admx-systemrestore.md) #### [ADMX_Taskbar](policy-csp-admx-taskbar.md) #### [ADMX_tcpip](policy-csp-admx-tcpip.md) #### [ADMX_Thumbnails](policy-csp-admx-thumbnails.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index d85775baec..365e5a94e6 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -522,6 +522,7 @@ ms.date: 10/08/2020 - [ADMX_StartMenu/ShowStartOnDisplayWithForegroundOnWinKey](./policy-csp-admx-startmenu.md#admx-startmenu-showstartondisplaywithforegroundonwinkey) - [ADMX_StartMenu/StartMenuLogOff](./policy-csp-admx-startmenu.md#admx-startmenu-startmenulogoff) - [ADMX_StartMenu/StartPinAppsWhenInstalled](./policy-csp-admx-startmenu.md#admx-startmenu-startpinappswheninstalled) +- [ADMX_SystemRestore/SR_DisableConfig](./policy-csp-admx-systemrestore.md#admx-systemrestore-sr-disableconfig) - [ADMX_Taskbar/DisableNotificationCenter](./policy-csp-admx-taskbar.md#admx-taskbar-disablenotificationcenter) - [ADMX_Taskbar/EnableLegacyBalloonNotifications](./policy-csp-admx-taskbar.md#admx-taskbar-enablelegacyballoonnotifications) - [ADMX_Taskbar/HideSCAHealth](./policy-csp-admx-taskbar.md#admx-taskbar-hidescahealth) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index ef13b92e7e..6431d07b97 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1885,6 +1885,14 @@ The following diagram shows the Policy configuration service provider in tree fo
+### ADMX_SystemRestore policies + +
+
+ ADMX_SystemRestore/SR_DisableConfig +
+
+ ### ADMX_Taskbar policies
diff --git a/windows/client-management/mdm/policy-csp-admx-systemrestore.md b/windows/client-management/mdm/policy-csp-admx-systemrestore.md new file mode 100644 index 0000000000..8e49043225 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-systemrestore.md @@ -0,0 +1,120 @@ +--- +title: Policy CSP - ADMX_SystemRestore +description: Policy CSP - ADMX_SystemRestore +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_SystemRestore +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_SystemRestore policies + +
+
+ ADMX_SystemRestore/SR_DisableConfig +
+
+ + +
+ + +**ADMX_SystemRestore/SR_DisableConfig** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. Allows you to disable System Restore configuration through System Protection. + +This policy setting allows you to turn off System Restore configuration through System Protection. + +System Restore enables users, in the event of a problem, to restore their computers to a previous state without losing personal data files. The behavior of this policy setting depends on the "Turn off System Restore" policy setting. + +If you enable this policy setting, the option to configure System Restore through System Protection is disabled. + +If you disable or do not configure this policy setting, users can change the System Restore settings through System Protection. + +Also, see the "Turn off System Restore" policy setting. If the "Turn off System Restore" policy setting is enabled, the "Turn off System Restore configuration" policy setting is overwritten. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Configuration* +- GP name: *SR_DisableConfig* +- GP path: *System\System Restore* +- GP ADMX file name: *SystemRestore.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From 673715bdf5fd87363ed7a1d54a6fa96bdf77cb37 Mon Sep 17 00:00:00 2001 From: Stefan Flegg Date: Sun, 15 Nov 2020 12:33:59 +1000 Subject: [PATCH 023/169] Update vpn-name-resolution.md Minor typo in Persistent section. --- windows/security/identity-protection/vpn/vpn-name-resolution.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/vpn/vpn-name-resolution.md b/windows/security/identity-protection/vpn/vpn-name-resolution.md index 6ff26370e3..3b6a776b1e 100644 --- a/windows/security/identity-protection/vpn/vpn-name-resolution.md +++ b/windows/security/identity-protection/vpn/vpn-name-resolution.md @@ -52,7 +52,7 @@ Primary DNS suffix is set using the **VPNv2/*ProfileName*/DnsSuffix** node. ## Persistent -You can also configure *persistent* name resolution rules. Name resolution for specified items will only performed over VPN. +You can also configure *persistent* name resolution rules. Name resolution for specified items will only be performed over the VPN. Persistent name resolution is set using the **VPNv2/*ProfileName*/DomainNameInformationList//*dniRowId*/Persistent** node. From 81b2787d1132155b27fc95ea7efc32b99615c5b9 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 16 Nov 2020 17:03:34 -0800 Subject: [PATCH 024/169] Added new policies --- .../mdm/policy-csp-admx-windowsdefender.md | 434 ++++++++++++++++++ 1 file changed, 434 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-windowsdefender.md diff --git a/windows/client-management/mdm/policy-csp-admx-windowsdefender.md b/windows/client-management/mdm/policy-csp-admx-windowsdefender.md new file mode 100644 index 0000000000..36fb917d07 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-windowsdefender.md @@ -0,0 +1,434 @@ +--- +title: Policy CSP - ADMX_WindowsDefender +description: Policy CSP - ADMX_WindowsDefender +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 08/13/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_WindowsDefender +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_WindowsDefender policies + +
+
+ ADMX_WindowsDefender/AllowFastServiceStartup +
+
+ ADMX_WindowsDefender/CheckForSignaturesBeforeRunningScan +
+
+ ADMX_WindowsDefender/DisableAntiSpywareDefender +
+
+ ADMX_WindowsDefender/DisableAutoExclusions +
+
+ ADMX_WindowsDefender/DisableBlockAtFirstSeen +
+
+ ADMX_WindowsDefender/DisableLocalAdminMerge +
+
+ ADMX_WindowsDefender/DisableRealtimeMonitoring +
+
+ ADMX_WindowsDefender/DisableRoutinelyTakingAction +
+
+ ADMX_WindowsDefender/Exclusions_Extensions +
+
+ ADMX_WindowsDefender/Exclusions_Paths +
+
+ ADMX_WindowsDefender/Exclusions_Processes +
+
+ ADMX_WindowsDefender/ExploitGuard_ASR_ASROnlyExclusions +
+
+ ADMX_WindowsDefender/ExploitGuard_ASR_Rules +
+
+ ADMX_WindowsDefender/ExploitGuard_ControlledFolderAccess_AllowedApplications +
+
+ ADMX_WindowsDefender/ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess +
+
+ ADMX_WindowsDefender/ExploitGuard_ControlledFolderAccess_ProtectedFolders +
+
+ ADMX_WindowsDefender/ExploitGuard_EnableNetworkProtection +
+
+ ADMX_WindowsDefender/MpEngine_EnableFileHashComputation +
+
+ ADMX_WindowsDefender/Nis_Consumers_IPS_DisableSignatureRetirement +
+
+ ADMX_WindowsDefender/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid +
+
+ ADMX_WindowsDefender/Nis_DisableProtocolRecognition +
+
+ ADMX_WindowsDefender/ProxyBypass +
+
+ ADMX_WindowsDefender/ProxyPacUrl +
+
+ ADMX_WindowsDefender/ProxyServer +
+
+ ADMX_WindowsDefender/Quarantine_LocalSettingOverridePurgeItemsAfterDelay +
+
+ ADMX_WindowsDefender/Quarantine_PurgeItemsAfterDelay +
+
+ ADMX_WindowsDefender/RandomizeScheduleTaskTimes +
+
+ ADMX_WindowsDefender/RealtimeProtection_DisableBehaviorMonitoring +
+
+ ADMX_WindowsDefender/RealtimeProtection_DisableIOAVProtection +
+
+ ADMX_WindowsDefender/RealtimeProtection_DisableOnAccessProtection +
+
+ ADMX_WindowsDefender/RealtimeProtection_DisableRawWriteNotification +
+
+ ADMX_WindowsDefender/RealtimeProtection_DisableScanOnRealtimeEnable +
+
+ ADMX_WindowsDefender/RealtimeProtection_IOAVMaxSize +
+
+ ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring +
+
+ ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection +
+
+ ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection +
+
+ ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring +
+
+ ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection +
+
+ ADMX_WindowsDefender/RealtimeProtection_RealtimeScanDirection +
+
+ ADMX_WindowsDefender/Remediation_LocalSettingOverrideScan_ScheduleTime +
+
+ ADMX_WindowsDefender/Remediation_Scan_ScheduleDay +
+
+ ADMX_WindowsDefender/Remediation_Scan_ScheduleTime +
+
+ ADMX_WindowsDefender/Reporting_AdditionalActionTimeout +
+
+ ADMX_WindowsDefender/Reporting_CriticalFailureTimeout +
+
+ ADMX_WindowsDefender/Reporting_DisableEnhancedNotifications +
+
+ ADMX_WindowsDefender/Reporting_DisablegenericrePorts +
+
+ ADMX_WindowsDefender/Reporting_NonCriticalTimeout +
+
+ ADMX_WindowsDefender/Reporting_RecentlyCleanedTimeout +
+
+ ADMX_WindowsDefender/Reporting_WppTracingComponents +
+
+ ADMX_WindowsDefender/Reporting_WppTracingLevel +
+
+ ADMX_WindowsDefender/Root_PUAProtection +
+
+ ADMX_WindowsDefender/Scan_AllowPause +
+
+ ADMX_WindowsDefender/Scan_ArchiveMaxDepth +
+
+ ADMX_WindowsDefender/Scan_ArchiveMaxSize +
+
+ ADMX_WindowsDefender/Scan_AvgCPULoadFactor +
+
+ ADMX_WindowsDefender/Scan_DisableArchiveScanning +
+
+ ADMX_WindowsDefender/Scan_DisableCatchupFullScan +
+
+ Scan_DisableCatchupQuickScan/ProxyBypass +
+
+ ADMX_WindowsDefender/Scan_DisableEmailScanning +
+
+ ADMX_WindowsDefender/Scan_DisableHeuristics +
+
+ ADMX_WindowsDefender/Scan_DisablePackedExeScanning +
+
+ ADMX_WindowsDefender/Scan_DisableRemovableDriveScanning +
+
+ ADMX_WindowsDefender/Scan_DisableReparsePointScanning +
+
+ ADMX_WindowsDefender/Scan_DisableRestorePoint +
+
+ ADMX_WindowsDefender/Scan_DisableScanningMappedNetworkDrivesForFullScan +
+
+ ADMX_WindowsDefender/Scan_DisableScanningNetworkFiles +
+
+ ADMX_WindowsDefender/Scan_LocalSettingOverrideAvgCPULoadFactor +
+
+ ADMX_WindowsDefender/Scan_LocalSettingOverrideScanParameters +
+
+ ADMX_WindowsDefender/Scan_LocalSettingOverrideScheduleDay +
+
+ ADMX_WindowsDefender/Scan_LocalSettingOverrideScheduleQuickScantime +
+
+ ADMX_WindowsDefender/Scan_LocalSettingOverrideScheduleTime +
+
+ ADMX_WindowsDefender/Scan_LowCpuPriority +
+
+ ADMX_WindowsDefender/Scan_MissedScheduledScanCountBeforeCatchup +
+
+ ADMX_WindowsDefender/Scan_PurgeItemsAfterDelay +
+
+ ADMX_WindowsDefender/Scan_QuickScanInterval +
+
+ ADMX_WindowsDefender/Scan_ScanOnlyIfIdle +
+
+ ADMX_WindowsDefender/Scan_ScanParameters +
+
+ ADMX_WindowsDefender/Scan_ScheduleDay +
+
+ ADMX_WindowsDefender/Scan_ScheduleQuickScantime +
+
+ ADMX_WindowsDefender/Scan_ScheduleTime +
+
+ ADMX_WindowsDefender/ServiceKeepAlive +
+
+ ADMX_WindowsDefender/SignatureUpdate_ASSignatureDue +
+
+ ADMX_WindowsDefender/SignatureUpdate_AVSignatureDue +
+
+ ADMX_WindowsDefender/SignatureUpdate_DefinitionUpdateFileSharesSources +
+
+ ADMX_WindowsDefender/SignatureUpdate_DisableScanOnUpdate +
+
+ ADMX_WindowsDefender/SignatureUpdate_DisableScheduledSignatureUpdateonBattery +
+
+ ADMX_WindowsDefender/SignatureUpdate_DisableUpdateOnStartupWithoutEngine +
+
+ ADMX_WindowsDefender/SignatureUpdate_FallbackOrder +
+
+ ADMX_WindowsDefender/SignatureUpdate_ForceUpdateFromMU +
+
+ ADMX_WindowsDefender/SignatureUpdate_RealtimeSignatureDelivery +
+
+ ADMX_WindowsDefender/SignatureUpdate_ScheduleDay +
+
+ ADMX_WindowsDefender/SignatureUpdate_ScheduleTime +
+
+ ADMX_WindowsDefender/SignatureUpdate_SharedSignaturesLocation +
+
+ ADMX_WindowsDefender/SignatureUpdate_SignatureDisableNotification +
+
+ ADMX_WindowsDefender/SignatureUpdate_SignatureUpdateCatchupInterval +
+
+ ADMX_WindowsDefender/SignatureUpdate_SignatureUpdateInterval +
+
+ ADMX_WindowsDefender/SignatureUpdate_UpdateOnStartup +
+
+ ADMX_WindowsDefender/SpynetReporting +
+
+ ADMX_WindowsDefender/Spynet_LocalSettingOverrideSpynetReporting +
+
+ ADMX_WindowsDefender/SubmitSamplesConsent +
+
+ ADMX_WindowsDefender/Threats_ThreatIdDefaultAction +
+
+ ADMX_WindowsDefender/Threats_ThreatSeverityDefaultAction +
+
+ ADMX_WindowsDefender/UX_Configuration_CustomDefaultActionToastString +
+
+ ADMX_WindowsDefender/UX_Configuration_Notification_Suppress +
+
+ ADMX_WindowsDefender/UX_Configuration_SuppressRebootNotification +
+
+ ADMX_WindowsDefender/UX_Configuration_UILockdown +
+
+ + +
+ + +**ADMX_AuditSettings/IncludeCmdLine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines what information is logged in security audit events when a new process has been created. This setting only applies when the Audit Process Creation policy is enabled. + +If you enable this policy setting, the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied. + +If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events. + +Default is Not configured. + +> [!NOTE] +> When this policy setting is enabled, any user with access to read the security events will be able to read the command line arguments for any successfully created process. Command line arguments can contain sensitive or private information, such as passwords or user data. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Include command line in process creation events* +- GP name: *IncludeCmdLine* +- GP path: *System/Audit Process Creation* +- GP ADMX file name: *AuditSettings.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From f374aa2abb88c2cd73a27a237219a6b144832664 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 17 Nov 2020 12:03:45 -0800 Subject: [PATCH 025/169] Added WindowsDefender policies --- .../mdm/policy-csp-admx-windowsdefender.md | 2068 ++++++++++++++++- 1 file changed, 2055 insertions(+), 13 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-windowsdefender.md b/windows/client-management/mdm/policy-csp-admx-windowsdefender.md index 36fb917d07..70f168574e 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsdefender.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsdefender.md @@ -346,7 +346,7 @@ manager: dansimp
-**ADMX_AuditSettings/IncludeCmdLine** +**ADMX_WindowsDefender/AllowFastServiceStartup** @@ -389,16 +389,11 @@ manager: dansimp -Available in Windows 10 Insider Preview Build 20185. This policy setting determines what information is logged in security audit events when a new process has been created. This setting only applies when the Audit Process Creation policy is enabled. +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. -If you enable this policy setting, the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied. +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. -If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events. - -Default is Not configured. - -> [!NOTE] -> When this policy setting is enabled, any user with access to read the security events will be able to read the command line arguments for any successfully created process. Command line arguments can contain sensitive or private information, such as passwords or user data. +If you disable this setting, the antimalware service will load as a low priority task. > [!TIP] @@ -410,15 +405,2062 @@ Default is Not configured. ADMX Info: -- GP English name: *Include command line in process creation events* -- GP name: *IncludeCmdLine* -- GP path: *System/Audit Process Creation* -- GP ADMX file name: *AuditSettings.admx* +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx*
+ +**ADMX_WindowsDefender/CheckForSignaturesBeforeRunningScan** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a check for new virus and spyware security intelligence will occur before running a scan. + +This setting applies to scheduled scans as well as the command line "mpcmdrun -SigUpdate", but it has no effect on scans initiated manually from the user interface. + +If you enable this setting, a check for new security intelligence will occur before running a scan. + +If you disable this setting or do not configure this setting, the scan will start using the existing security intelligence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Check for the latest virus and spyware security intelligence before running a scheduled scan* +- GP name: *CheckForSignaturesBeforeRunningScan* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/DisableAntiSpywareDefender** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off Microsoft Defender Antivirus. + +If you enable this policy setting, Microsoft Defender Antivirus does not run, and will not scan computers for malware or other potentially unwanted software. + +If you disable this policy setting, Microsoft Defender Antivirus will run regardless of any other installed antivirus product. + +If you do not configure this policy setting, Windows will internally manage Microsoft Defender Antivirus. If you install another antivirus program, Windows automatically disables Microsoft Defender Antivirus. Otherwise, Microsoft Defender Antivirus will scan your computers for malware and other potentially unwanted software. + +Enabling or disabling this policy may lead to unexpected or unsupported behavior. It is recommended that you leave this policy setting unconfigured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Microsoft Defender Antivirus* +- GP name: *DisableAntiSpywareDefender* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/DisableAutoExclusions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off. + +Disabled (Default): +Microsoft Defender will exclude pre-defined list of paths from the scan to improve performance. + +Enabled: +Microsoft Defender will not exclude pre-defined list of paths from scans. This can impact machine performance in some scenarios. + +Not configured: +Same as Disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Auto Exclusions* +- GP name: *DisableAutoExclusions* +- GP path: *Windows Components\Microsoft Defender Antivirus\Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/DisableBlockAtFirstSeen** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certain content to be run or accessed. If this feature is disabled, the check will not occur, which will lower the protection state of the device. + +Enabled – The Block at First Sight setting is turned on. +Disabled – The Block at First Sight setting is turned off. + +This feature requires these Group Policy settings to be set as follows: + +- MAPS -> The “Join Microsoft MAPS” must be enabled or the “Block at First Sight” feature will not function. +- MAPS -> The “Send file samples when further analysis is required” should be set to 1 (Send safe samples) or 3 (Send all samples). Setting to 0 (Always Prompt) will lower the protection state of the device. Setting to 2 (Never send) means the “Block at First Sight” feature will not function. +- Real-time Protection -> The “Scan all downloaded files and attachments” policy must be enabled or the “Block at First Sight” feature will not function. +- Real-time Protection -> Do not enable the “Turn off real-time protection” policy or the “Block at First Sight” feature will not function. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the 'Block at First Sight' feature* +- GP name: *DisableBlockAtFirstSeen* +- GP path: *Windows Components\Microsoft Defender Antivirus\MAPS* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/DisableLocalAdminMerge** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether or not complex list settings configured by a local administrator are merged with Group Policy settings. This setting applies to lists such as threats and Exclusions. + +If you enable or do not configure this setting, unique items defined in Group Policy and in preference settings configured by the local administrator will be merged into the resulting effective policy. In the case of conflicts, Group policy Settings will override preference settings. + +If you disable this setting, only items defined by Group Policy will be used in the resulting effective policy. Group Policy settings will override preference settings configured by the local administrator. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local administrator merge behavior for lists* +- GP name: *DisableLocalAdminMerge* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/DisableRealtimeMonitoring** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off real-time protection prompts for known malware detection. + +Microsoft Defender Antivirus alerts you when malware or potentially unwanted software attempts to install itself or to run on your computer. + +If you enable this policy setting, Microsoft Defender Antivirus will not prompt users to take actions on malware detections. + +If you disable or do not configure this policy setting, Microsoft Defender Antivirus will prompt users to take actions on malware detections. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off real-time protection* +- GP name: *DisableRealtimeMonitoring* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/DisableRoutinelyTakingAction** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether Microsoft Defender Antivirus automatically takes action on all detected threats. The action to be taken on a particular threat is determined by the combination of the policy-defined action, user-defined action, and the signature-defined action. + +If you enable this policy setting, Microsoft Defender Antivirus does not automatically take action on the detected threats, but prompts users to choose from the actions available for each threat. + +If you disable or do not configure this policy setting, Microsoft Defender Antivirus automatically takes action on all detected threats after a nonconfigurable delay of approximately five seconds. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off routine remediation* +- GP name: *DisableRoutinelyTakingAction* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Exclusions_Extensions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you specify a list of file types that should be excluded from scheduled, custom, and real-time scanning. File types should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the file type extension (such as "obj" or "lib"). The value is not used and it is recommended that this be set to 0. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Extension Exclusions* +- GP name: *Exclusions_Extensions* +- GP path: *Windows Components\Microsoft Defender Antivirus\Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Exclusions_Paths** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to disable scheduled and real-time scanning for files under the paths specified or for the fully qualified resources specified. Paths should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a path or a fully qualified resource name. + +As an example, a path might be defined as: "c:\Windows" to exclude all files in this directory. A fully qualified resource name might be defined as: "C:\Windows\App.exe". The value is not used and it is recommended that this be set to 0. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Path Exclusions* +- GP name: *Exclusions_Paths* +- GP path: *Windows Components\Microsoft Defender Antivirus\Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Exclusions_Processes** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to disable scheduled and real-time scanning for any file opened by any of the specified processes. The process itself will not be excluded. To exclude the process, use the Path exclusion. Processes should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of the path to the process image. Note that only executables can be excluded. For example, a process might be defined as: "c:\windows\app.exe". The value is not used and it is recommended that this be set to 0. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Process Exclusions* +- GP name: *Exclusions_Processes* +- GP path: *Windows Components\Microsoft Defender Antivirus\Exclusions* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/ExploitGuard_ASR_ASROnlyExclusions** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Exclude files and paths from Attack Surface Reduction (ASR) rules. + +Enabled: +Specify the folders or files and resources that should be excluded from ASR rules in the Options section. +Enter each rule on a new line as a name-value pair: + +- Name column: Enter a folder path or a fully qualified resource name. For example, ""C:\Windows"" will exclude all files in that directory. ""C:\Windows\App.exe"" will exclude only that specific file in that specific folder +- Value column: Enter ""0"" for each item + +Disabled: +No exclusions will be applied to the ASR rules. + +Not configured: +Same as Disabled. + +You can configure ASR rules in the Configure Attack Surface Reduction rules GP setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Exclude files and paths from Attack Surface Reduction Rules* +- GP name: *ExploitGuard_ASR_ASROnlyExclusions* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Attack Surface Reduction* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/ExploitGuard_ASR_Rules** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Set the state for each Attack Surface Reduction (ASR) rule. + +After enabling this setting, you can set each rule to the following in the Options section: + +- Block: the rule will be applied +- Audit Mode: if the rule would normally cause an event, then it will be recorded (although the rule will not actually be applied) +- Off: the rule will not be applied + +Enabled: +Specify the state for each ASR rule under the Options section for this setting. +Enter each rule on a new line as a name-value pair: + +- Name column: Enter a valid ASR rule ID +- Value column: Enter the status ID that relates to state you want to specify for the associated rule + +The following status IDs are permitted under the value column: +- 1 (Block) +- 0 (Off) +- 2 (Audit) + +Example: +xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 0 +xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 1 +xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx 2 + +Disabled: +No ASR rules will be configured. + +Not configured: +Same as Disabled. + +You can exclude folders or files in the "Exclude files and paths from Attack Surface Reduction Rules" GP setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Attack Surface Reduction rules* +- GP name: *ExploitGuard_ASR_Rules* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Attack Surface Reduction* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/AllowFastServiceStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. + +If you enable or do not configure this setting, the antimalware service will load as a normal priority task. + +If you disable this setting, the antimalware service will load as a low priority task. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to startup with normal priority* +- GP name: *AllowFastServiceStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
Footnotes: - 1 - Available in Windows 10, version 1607. From 4dc4089511dbbfdd6260b835f2449f2a4b39ccf2 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 17 Nov 2020 16:55:19 -0800 Subject: [PATCH 026/169] Added new policies --- .../mdm/policy-csp-admx-windowsdefender.md | 1192 +++++++++++++++-- 1 file changed, 1071 insertions(+), 121 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-windowsdefender.md b/windows/client-management/mdm/policy-csp-admx-windowsdefender.md index 70f168574e..d935313482 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsdefender.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsdefender.md @@ -116,19 +116,19 @@ manager: dansimp ADMX_WindowsDefender/RealtimeProtection_DisableRawWriteNotification
- ADMX_WindowsDefender/RealtimeProtection_DisableScanOnRealtimeEnable + ADMX_WindowsDefender/RealtimeProtection_DisableScanOnRealtimeEnable
- ADMX_WindowsDefender/RealtimeProtection_IOAVMaxSize + ADMX_WindowsDefender/RealtimeProtection_IOAVMaxSize
- ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring + ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring
- ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection + ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection
- ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection + ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection
ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring @@ -194,7 +194,7 @@ manager: dansimp ADMX_WindowsDefender/Scan_DisableCatchupFullScan
- Scan_DisableCatchupQuickScan/ProxyBypass + ADMX_WindowsDefender/Scan_DisableCatchupQuickScan
ADMX_WindowsDefender/Scan_DisableEmailScanning @@ -1290,7 +1290,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/ExploitGuard_ControlledFolderAccess_AllowedApplications** @@ -1333,11 +1333,24 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. Add additional applications that should be considered "trusted" by controlled folder access. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +These applications are allowed to modify or delete files in controlled folder access folders. -If you disable this setting, the antimalware service will load as a low priority task. +Microsoft Defender Antivirus automatically determines which applications should be trusted. You can configure this setting to add additional applications. + +Enabled: +Specify additional allowed applications in the Options section.. + +Disabled: +No additional applications will be added to the trusted list. + +Not configured: +Same as Disabled. + +You can enable controlled folder access in the Configure controlled folder access GP setting. + +Default system folders are automatically guarded, but you can add folders in the configure protected folders GP setting. > [!TIP] @@ -1349,8 +1362,634 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* +- GP English name: *Configure allowed applications* +- GP name: *ExploitGuard_ControlledFolderAccess_AllowedApplications* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Controlled Folder Access* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Enable or disable controlled folder access for untrusted applications. You can choose to block, audit, or allow attempts by untrusted apps to: + +- Modify or delete files in protected folders, such as the Documents folder +- Write to disk sectors + +You can also choose to only block or audit writes to disk sectors while still allowing the modification or deletion of files in protected folders. + +Microsoft Defender Antivirus automatically determines which applications can be trusted. You can add additional trusted applications in the Configure allowed applications GP setting. +Default system folders are automatically protected, but you can add folders in the Configure protected folders GP setting. + +Block: +The following will be blocked: + +- Attempts by untrusted apps to modify or delete files in protected folders +- Attempts by untrusted apps to write to disk sectors + +The Windows event log will record these blocks under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123. + +Disabled: +The following will not be blocked and will be allowed to run: + +- Attempts by untrusted apps to modify or delete files in protected folders +- Attempts by untrusted apps to write to disk sectors + +These attempts will not be recorded in the Windows event log. + +Audit Mode: +The following will not be blocked and will be allowed to run: + +- Attempts by untrusted apps to modify or delete files in protected folders +- Attempts by untrusted apps to write to disk sectors + +The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124. + +Block disk modification only: +The following will be blocked: + +- Attempts by untrusted apps to write to disk sectors + +The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123. + +The following will not be blocked and will be allowed to run: + +- Attempts by untrusted apps to modify or delete files in protected folders +These attempts will not be recorded in the Windows event log. + +Audit disk modification only: +The following will not be blocked and will be allowed to run: + +- Attempts by untrusted apps to write to disk sectors +- Attempts by untrusted apps to modify or delete files in protected folders +Only attempts to write to protected disk sectors will be recorded in the Windows event log (under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124). +Attempts to modify or delete files in protected folders will not be recorded. + +Not configured: +Same as Disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Controlled folder access* +- GP name: *ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Controlled Folder Access* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/ExploitGuard_ControlledFolderAccess_ProtectedFolders** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Specify additional folders that should be guarded by the Controlled folder access feature. + +Files in these folders cannot be modified or deleted by untrusted applications. + +Default system folders are automatically protected. You can configure this setting to add additional folders. +The list of default system folders that are protected is shown in Windows Security. + +Enabled: +Specify additional folders that should be protected in the Options section. + +Disabled: +No additional folders will be protected. + +Not configured: +Same as Disabled. + +You can enable controlled folder access in the Configure controlled folder access GP setting. + +Microsoft Defender Antivirus automatically determines which applications can be trusted. You can add additional trusted applications in the Configure allowed applications GP setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure protected folders* +- GP name: *ExploitGuard_ControlledFolderAccess_ProtectedFolders* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Controlled Folder Access* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/ExploitGuard_EnableNetworkProtection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Enable or disable Microsoft Defender Exploit Guard network protection to prevent employees from using any application to access dangerous domains that may host phishing scams, exploit-hosting sites, and other malicious content on the Internet. + +Enabled: +Specify the mode in the Options section: + +- Block: Users and applications will not be able to access dangerous domains +- Audit Mode: Users and applications can connect to dangerous domains, however if this feature would have blocked access if it were set to Block, then a record of the event will be in the event logs. + +Disabled: +Users and applications will not be blocked from connecting to dangerous domains. + +Not configured: +Same as Disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent users and apps from accessing dangerous websites* +- GP name: *ExploitGuard_EnableNetworkProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Network Protection* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/MpEngine_EnableFileHashComputation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Enable or disable file hash computation feature. + +Enabled: +When this feature is enabled Microsoft Defender will compute hash value for files it scans. + +Disabled: +File hash value is not computed + +Not configured: +Same as Disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable file hash computation feature* +- GP name: *MpEngine_EnableFileHashComputation* +- GP path: *Windows Components\Microsoft Defender Antivirus\MpEngine* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Nis_Consumers_IPS_DisableSignatureRetirement** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure definition retirement for network protection against exploits of known vulnerabilities. Definition retirement checks to see if a computer has the required security updates necessary to protect it against a particular vulnerability. If the system is not vulnerable to the exploit detected by a definition, then that definition is "retired". If all security intelligence for a given protocal are retired then that protocol is no longer parsed. Enabling this feature helps to improve performance. On a computer that is up-to-date with all the latest security updates, network protection will have no impact on network performance. + +If you enable or do not configure this setting, definition retirement will be enabled. + +If you disable this setting, definition retirement will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on definition retirement* +- GP name: *Nis_Consumers_IPS_DisableSignatureRetirement* +- GP path: *Windows Components\Microsoft Defender Antivirus\Network Inspection System* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines additional definition sets to enable for network traffic inspection. Definition set GUIDs should be added under the Options for this setting. Each entry must be listed as a name value pair, where the name should be a string representation of a definition set GUID. As an example, the definition set GUID to enable test security intelligence is defined as: “{b54b6ac9-a737-498e-9120-6616ad3bf590}”. The value is not used and it is recommended that this be set to 0. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify additional definition sets for network traffic inspection* +- GP name: *Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid* +- GP path: *Windows Components\Microsoft Defender Antivirus\Network Inspection System* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Nis_DisableProtocolRecognition** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure protocol recognition for network protection against exploits of known vulnerabilities. + +If you enable or do not configure this setting, protocol recognition will be enabled. + +If you disable this setting, protocol recognition will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on protocol recognition* +- GP name: *Nis_DisableProtocolRecognition* +- GP path: *Windows Components\Microsoft Defender Antivirus\Network Inspection System* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/ProxyBypass** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy, if defined, will prevent antimalware from using the configured proxy server when communicating with the specified IP addresses. The address value should be entered as a valid URL. + +If you enable this setting, the proxy server will be bypassed for the specified addresses. + +If you disable or do not configure this setting, the proxy server will not be bypassed for the specified addresses. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define addresses to bypass proxy server* +- GP name: *ProxyBypass* - GP path: *Windows Components\Microsoft Defender Antivirus* - GP ADMX file name: *WindowsDefender.admx* @@ -1359,7 +1998,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/ProxyPacUrl** @@ -1402,11 +2041,17 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the URL of a proxy .pac file that should be used when the client attempts to connect the network for security intelligence updates and MAPS reporting. If the proxy auto-config fails or if there is no proxy auto-config specified, the client will fall back to the alternative options (in order): -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +1. Proxy server (if specified) +2. Proxy .pac URL (if specified) +3. None +4. Internet Explorer proxy settings +5. Autodetect -If you disable this setting, the antimalware service will load as a low priority task. +If you enable this setting, the proxy setting will be set to use the specified proxy .pac according to the order specified above. + +If you disable or do not configure this setting, the proxy will skip over this fallback step according to the order specified above. > [!TIP] @@ -1418,8 +2063,8 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* +- GP English name: *Define proxy auto-config (.pac) for connecting to the network* +- GP name: *ProxyPacUrl* - GP path: *Windows Components\Microsoft Defender Antivirus* - GP ADMX file name: *WindowsDefender.admx* @@ -1428,7 +2073,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/ProxyServer**
@@ -1471,11 +2116,17 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the named proxy that should be used when the client attempts to connect to the network for security intelligence updates and MAPS reporting. If the named proxy fails or if there is no proxy specified, the client will fall back to the alternative options (in order): -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +1. Proxy server (if specified) +2. Proxy .pac URL (if specified) +3. None +4. Internet Explorer proxy settings +5. Autodetect -If you disable this setting, the antimalware service will load as a low priority task. +If you enable this setting, the proxy will be set to the specified URL according to the order specified above. The URL should be proceeded with either http:// or https://. + +If you disable or do not configure this setting, the proxy will skip over this fallback step according to the order specified above. > [!TIP] @@ -1487,8 +2138,8 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* +- GP English name: *Define proxy server for connecting to the network* +- GP name: *ProxyServer* - GP path: *Windows Components\Microsoft Defender Antivirus* - GP ADMX file name: *WindowsDefender.admx* @@ -1497,7 +2148,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/Quarantine_LocalSettingOverridePurgeItemsAfterDelay**
@@ -1540,11 +2191,11 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of the number of days items should be kept in the Quarantine folder before being removed. This setting can only be set by Group Policy. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +If you enable this setting, the local preference setting will take priority over Group Policy. -If you disable this setting, the antimalware service will load as a low priority task. +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. > [!TIP] @@ -1556,8 +2207,146 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* +- GP English name: *Configure local setting override for the removal of items from Quarantine folder* +- GP name: *Quarantine_LocalSettingOverridePurgeItemsAfterDelay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Quarantine* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Quarantine_PurgeItemsAfterDelay** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the number of days items should be kept in the Quarantine folder before being removed. + +If you enable this setting, items will be removed from the Quarantine folder after the number of days specified. + +If you disable or do not configure this setting, items will be kept in the quarantine folder indefinitely and will not be automatically removed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure removal of items from Quarantine folder* +- GP name: *Quarantine_PurgeItemsAfterDelay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Quarantine* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/RandomizeScheduleTaskTimes** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable or disable randomization of the scheduled scan start time and the scheduled security intelligence update start time. This setting is used to distribute the resource impact of scanning. For example, it could be used in guest virtual machines sharing a host, to prevent multiple guest virtual machines from undertaking a disk-intensive operation at the same time. + +If you enable or do not configure this setting, scheduled tasks will begin at a random time within an interval of 30 minutes before and after the specified start time. + +If you disable this setting, scheduled tasks will begin at the specified start time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Randomize scheduled task times* +- GP name: *RandomizeScheduleTaskTimes* - GP path: *Windows Components\Microsoft Defender Antivirus* - GP ADMX file name: *WindowsDefender.admx* @@ -1566,7 +2355,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/RealtimeProtection_DisableBehaviorMonitoring** @@ -1609,11 +2398,11 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure behavior monitoring. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +If you enable or do not configure this setting, behavior monitoring will be enabled. -If you disable this setting, the antimalware service will load as a low priority task. +If you disable this setting, behavior monitoring will be disabled. > [!TIP] @@ -1625,9 +2414,9 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* -- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP English name: *Turn on behavior monitoring* +- GP name: *RealtimeProtection_DisableBehaviorMonitoring* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -1635,7 +2424,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/RealtimeProtection_DisableIOAVProtection**
@@ -1678,11 +2467,11 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scanning for all downloaded files and attachments. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +If you enable or do not configure this setting, scanning for all downloaded files and attachments will be enabled. -If you disable this setting, the antimalware service will load as a low priority task. +If you disable this setting, scanning for all downloaded files and attachments will be disabled. > [!TIP] @@ -1694,9 +2483,9 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* -- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP English name: *Scan all downloaded files and attachments* +- GP name: *RealtimeProtection_DisableIOAVProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -1704,7 +2493,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/RealtimeProtection_DisableOnAccessProtection**
@@ -1747,11 +2536,11 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure monitoring for file and program activity. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +If you enable or do not configure this setting, monitoring for file and program activity will be enabled. -If you disable this setting, the antimalware service will load as a low priority task. +If you disable this setting, monitoring for file and program activity will be disabled. > [!TIP] @@ -1763,9 +2552,9 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* -- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP English name: *Monitor file and program activity on your computer* +- GP name: *RealtimeProtection_DisableOnAccessProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -1773,7 +2562,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/RealtimeProtection_DisableRawWriteNotification**
@@ -1816,11 +2605,11 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether raw volume write notifications are sent to behavior monitoring. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +If you enable or do not configure this setting, raw write notifications will be enabled. -If you disable this setting, the antimalware service will load as a low priority task. +If you disable this setting, raw write notifications be disabled. > [!TIP] @@ -1832,9 +2621,9 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* -- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP English name: *Turn on raw volume write notifications* +- GP name: *RealtimeProtection_DisableRawWriteNotification* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -1842,7 +2631,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/RealtimeProtection_DisableScanOnRealtimeEnable**
@@ -1885,11 +2674,11 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure process scanning when real-time protection is turned on. This helps to catch malware which could start when real-time protection is turned off. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +If you enable or do not configure this setting, a process scan will be initiated when real-time protection is turned on. -If you disable this setting, the antimalware service will load as a low priority task. +If you disable this setting, a process scan will not be initiated when real-time protection is turned on. > [!TIP] @@ -1901,9 +2690,9 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* -- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP English name: *Turn on process scanning whenever real-time protection is enabled* +- GP name: *RealtimeProtection_DisableScanOnRealtimeEnable* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -1911,7 +2700,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/RealtimeProtection_IOAVMaxSize**
@@ -1954,11 +2743,11 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the maximum size (in kilobytes) of downloaded files and attachments that will be scanned. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +If you enable this setting, downloaded files and attachments smaller than the size specified will be scanned. -If you disable this setting, the antimalware service will load as a low priority task. +If you disable or do not configure this setting, a default size will be applied. > [!TIP] @@ -1970,9 +2759,9 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* -- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP English name: *Define the maximum size of downloaded files and attachments to be scanned* +- GP name: *RealtimeProtection_IOAVMaxSize* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -1980,7 +2769,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring**
@@ -2023,11 +2812,11 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of behavior monitoring. This setting can only be set by Group Policy. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +If you enable this setting, the local preference setting will take priority over Group Policy. -If you disable this setting, the antimalware service will load as a low priority task. +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. > [!TIP] @@ -2039,9 +2828,9 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* -- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP English name: *Configure local setting override for turn on behavior monitoring* +- GP name: *RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -2049,7 +2838,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection**
@@ -2092,11 +2881,11 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of scanning for all downloaded files and attachments. This setting can only be set by Group Policy. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +If you enable this setting, the local preference setting will take priority over Group Policy. -If you disable this setting, the antimalware service will load as a low priority task. +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. > [!TIP] @@ -2108,9 +2897,9 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* -- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP English name: *Configure local setting override for scanning all downloaded files and attachments* +- GP name: *RealtimeProtection_LocalSettingOverrideDisableIOAVProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -2118,7 +2907,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection**
@@ -2161,11 +2950,11 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of monitoring for file and program activity on your computer. This setting can only be set by Group Policy. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +If you enable this setting, the local preference setting will take priority over Group Policy. -If you disable this setting, the antimalware service will load as a low priority task. +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. > [!TIP] @@ -2177,9 +2966,9 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* -- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP English name: *Configure local setting override for monitoring file and program activity on your computer* +- GP name: *RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -2187,7 +2976,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring**
@@ -2230,11 +3019,11 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration to turn on real-time protection. This setting can only be set by Group Policy. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +If you enable this setting, the local preference setting will take priority over Group Policy. -If you disable this setting, the antimalware service will load as a low priority task. +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. > [!TIP] @@ -2246,9 +3035,9 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* -- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP English name: *Configure local setting override to turn on real-time protection* +- GP name: *RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -2256,7 +3045,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection**
@@ -2299,11 +3088,11 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of monitoring for incoming and outgoing file activity. This setting can only be set by Group Policy. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +If you enable this setting, the local preference setting will take priority over Group Policy. -If you disable this setting, the antimalware service will load as a low priority task. +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. > [!TIP] @@ -2315,9 +3104,9 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* -- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP English name: *Configure local setting override for monitoring for incoming and outgoing file activity* +- GP name: *RealtimeProtection_LocalSettingOverrideRealtimeScanDirection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -2325,7 +3114,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/RealtimeProtection_RealtimeScanDirection**
@@ -2368,11 +3157,21 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure monitoring for incoming and outgoing files, without having to turn off monitoring entirely. It is recommended for use on servers where there is a lot of incoming and outgoing file activity but for performance reasons need to have scanning disabled for a particular scan direction. The appropriate configuration should be evaluated based on the server role. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +Note that this configuration is only honored for NTFS volumes. For any other file system type, full monitoring of file and program activity will be present on those volumes. -If you disable this setting, the antimalware service will load as a low priority task. +The options for this setting are mutually exclusive: + +- 0 = Scan incoming and outgoing files (default) +- 1 = Scan incoming files only +- 2 = Scan outgoing files only + +Any other value, or if the value does not exist, resolves to the default (0). + +If you enable this setting, the specified type of monitoring will be enabled. + +If you disable or do not configure this setting, monitoring for incoming and outgoing files will be enabled. > [!TIP] @@ -2384,9 +3183,9 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* -- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP English name: *Configure monitoring for incoming and outgoing file and program activity* +- GP name: *RealtimeProtection_RealtimeScanDirection* +- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -2394,7 +3193,7 @@ ADMX Info:
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_WindowsDefender/Remediation_LocalSettingOverrideScan_ScheduleTime**
@@ -2437,11 +3236,11 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the load priority for the antimalware service. Increasing the load priority will allow for faster service startup, but may impact performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of the time to run a scheduled full scan to complete remediation. This setting can only be set by Group Policy. -If you enable or do not configure this setting, the antimalware service will load as a normal priority task. +If you enable this setting, the local preference setting will take priority over Group Policy. -If you disable this setting, the antimalware service will load as a low priority task. +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. > [!TIP] @@ -2453,14 +3252,165 @@ If you disable this setting, the antimalware service will load as a low priority ADMX Info: -- GP English name: *Allow antimalware service to startup with normal priority* -- GP name: *AllowFastServiceStartup* -- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP English name: *Configure local setting override for the time of day to run a scheduled full scan to complete remediation* +- GP name: *Remediation_LocalSettingOverrideScan_ScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Remediation* - GP ADMX file name: *WindowsDefender.admx*
+ + +**ADMX_WindowsDefender/Remediation_Scan_ScheduleDay** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the day of the week on which to perform a scheduled full scan in order to complete remediation. The scan can also be configured to run every day or to never run at all. + +This setting can be configured with the following ordinal number values: + +- (0x0) Every Day +- (0x1) Sunday +- (0x2) Monday +- (0x3) Tuesday +- (0x4) Wednesday +- (0x5) Thursday +- (0x6) Friday +- (0x7) Saturday +- (0x8) Never (default) + +If you enable this setting, a scheduled full scan to complete remediation will run at the frequency specified. + +If you disable or do not configure this setting, a scheduled full scan to complete remediation will run at a default frequency. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the day of the week to run a scheduled full scan to complete remediation* +- GP name: *Remediation_Scan_ScheduleDay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Remediation* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Remediation_Scan_ScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the time of day at which to perform a scheduled full scan in order to complete remediation. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. The schedule is based on local time on the computer where the scan is executing. + +If you enable this setting, a scheduled full scan to complete remediation will run at the time of day specified. + +If you disable or do not configure this setting, a scheduled full scan to complete remediation will run at a default time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the time of day to run a scheduled full scan to complete remediation* +- GP name: *Remediation_Scan_ScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Remediation* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ Footnotes: - 1 - Available in Windows 10, version 1607. From 7e0e79d0c793c8062e02938fbedc1d76c4f34a4b Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 18 Nov 2020 14:15:38 -0800 Subject: [PATCH 027/169] Added more policies --- .../mdm/policy-csp-admx-windowsdefender.md | 1369 +++++++++++++++++ 1 file changed, 1369 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-admx-windowsdefender.md b/windows/client-management/mdm/policy-csp-admx-windowsdefender.md index d935313482..c1aaa52eb3 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsdefender.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsdefender.md @@ -3411,6 +3411,1375 @@ ADMX Info:
+ +**ADMX_WindowsDefender/Reporting_AdditionalActionTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the time in minutes before a detection in the "additional action" state moves to the "cleared" state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure time out for detections requiring additional action* +- GP name: *Reporting_AdditionalActionTimeout* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Reporting_CriticalFailureTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the time in minutes before a detection in the “critically failed” state to moves to either the “additional action” state or the “cleared” state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure time out for detections in critically failed state* +- GP name: *Reporting_CriticalFailureTimeout* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Reporting_DisableEnhancedNotifications** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Use this policy setting to specify if you want Microsoft Defender Antivirus enhanced notifications to display on clients. + +If you disable or do not configure this setting, Microsoft Defender Antivirus enhanced notifications will display on clients. + +If you enable this setting, Microsoft Defender Antivirus enhanced notifications will not display on clients. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off enhanced notifications* +- GP name: *Reporting_DisableEnhancedNotifications* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ +**ADMX_WindowsDefender/Reporting_DisablegenericrePorts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether or not Watson events are sent. + +If you enable or do not configure this setting, Watson events will be sent. + +If you disable this setting, Watson events will not be sent. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Watson events* +- GP name: *Reporting_DisablegenericrePorts* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Reporting_NonCriticalTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the time in minutes before a detection in the "non-critically failed" state moves to the "cleared" state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure time out for detections in non-critical failed state* +- GP name: *Reporting_NonCriticalTimeout* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ +**ADMX_WindowsDefender/Reporting_RecentlyCleanedTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures the time in minutes before a detection in the "completed" state moves to the "cleared" state. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure time out for detections in recently remediated state* +- GP name: *Reporting_RecentlyCleanedTimeout* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Reporting_WppTracingComponents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy configures Windows software trace preprocessor (WPP Software Tracing) components. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Windows software trace preprocessor components* +- GP name: *Reporting_WppTracingComponents* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Reporting_WppTracingLevel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy allows you to configure tracing levels for Windows software trace preprocessor (WPP Software Tracing). + +Tracing levels are defined as: + +- 1 - Error +- 2 - Warning +- 3 - Info +- 4 - Debug + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure WPP tracing level* +- GP name: *Reporting_WppTracingLevel* +- GP path: *Windows Components\Microsoft Defender Antivirus\Reporting* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Root_PUAProtection** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Enable or disable detection for potentially unwanted applications. You can choose to block, audit, or allow when potentially unwanted software is being downloaded or attempts to install itself on your computer. + +Enabled: +Specify the mode in the Options section: + +- Block: Potentially unwanted software will be blocked. +- Audit Mode: Potentially unwanted software will not be blocked, however if this feature would have blocked access if it were set to Block, then a record of the event will be in the event logs. + +Disabled: +Potentially unwanted software will not be blocked. + +Not configured: +Same as Disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure detection for potentially unwanted applications* +- GP name: *Root_PUAProtection* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_AllowPause** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether or not end users can pause a scan in progress. + +If you enable or do not configure this setting, a new context menu will be added to the task tray icon to allow the user to pause a scan. + +If you disable this setting, users will not be able to pause scans. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow users to pause scan* +- GP name: *Scan_AllowPause* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_ArchiveMaxDepth** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the maximum directory depth level into which archive files such as .ZIP or .CAB are unpacked during scanning. The default directory depth level is 0. + +If you enable this setting, archive files will be scanned to the directory depth level specified. + +If you disable or do not configure this setting, archive files will be scanned to the default directory depth level. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the maximum depth to scan archive files* +- GP name: *Scan_ArchiveMaxDepth* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_ArchiveMaxSize** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the maximum size of archive files such as .ZIP or .CAB that will be scanned. The value represents file size in kilobytes (KB). The default value is 0 and represents no limit to archive size for scanning. + +If you enable this setting, archive files less than or equal to the size specified will be scanned. + +If you disable or do not configure this setting, archive files will be scanned according to the default value. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the maximum size of archive files to be scanned* +- GP name: *Scan_ArchiveMaxSize* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_AvgCPULoadFactor** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the maximum percentage CPU utilization permitted during a scan. Valid values for this setting are a percentage represented by the integers 5 to 100. A value of 0 indicates that there should be no throttling of CPU utilization. The default value is 50. + +If you enable this setting, CPU utilization will not exceed the percentage specified. + +If you disable or do not configure this setting, CPU utilization will not exceed the default value. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the maximum percentage of CPU utilization during a scan* +- GP name: *Scan_AvgCPULoadFactor* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_DisableArchiveScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scans for malicious software and unwanted software in archive files such as .ZIP or .CAB files. + +If you enable or do not configure this setting, archive files will be scanned. + +If you disable this setting, archive files will not be scanned. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan archive files* +- GP name: *Scan_DisableArchiveScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_DisableCatchupFullScan** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. + +If you enable this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. + +If you disable or do not configure this setting, catch-up scans for scheduled full scans will be turned off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on catch-up full scan* +- GP name: *Scan_DisableCatchupFullScan* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_DisableCatchupQuickScan** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure catch-up scans for scheduled quick scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. + +If you enable this setting, catch-up scans for scheduled quick scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. + +If you disable or do not configure this setting, catch-up scans for scheduled quick scans will be turned off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on catch-up quick scan* +- GP name: *Scan_DisableCatchupQuickScan* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_DisableEmailScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure e-mail scanning. When e-mail scanning is enabled, the engine will parse the mailbox and mail files, according to their specific format, in order to analyze the mail bodies and attachments. Several e-mail formats are currently supported, for example: pst (Outlook), dbx, mbx, mime (Outlook Express), binhex (Mac). + +If you enable this setting, e-mail scanning will be enabled. + +If you disable or do not configure this setting, e-mail scanning will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on e-mail scanning* +- GP name: *Scan_DisableEmailScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_DisableHeuristics** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure heuristics. Suspicious detections will be suppressed right before reporting to the engine client. Turning off heuristics will reduce the capability to flag new threats. It is recommended that you do not turn off heuristics. + +If you enable or do not configure this setting, heuristics will be enabled. + +If you disable this setting, heuristics will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on heuristics* +- GP name: *Scan_DisableHeuristics* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_DisablePackedExeScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scanning for packed executables. It is recommended that this type of scanning remain enabled. + +If you enable or do not configure this setting, packed executables will be scanned. + +If you disable this setting, packed executables will not be scanned. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan packed executables* +- GP name: *Scan_DisablePackedExeScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_DisableRemovableDriveScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether or not to scan for malicious software and unwanted software in the contents of removable drives, such as USB flash drives, when running a full scan. + +If you enable this setting, removable drives will be scanned during any type of scan. + +If you disable or do not configure this setting, removable drives will not be scanned during a full scan. Removable drives may still be scanned during quick scan and custom scan. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan removable drives* +- GP name: *Scan_DisableRemovableDriveScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ Footnotes: - 1 - Available in Windows 10, version 1607. From 0c7a4df372f1329b73a2e4fc0f4b52dc823d2184 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 18 Nov 2020 17:09:38 -0800 Subject: [PATCH 028/169] Added more policies --- .../mdm/policy-csp-admx-windowsdefender.md | 3082 +++++++++++++++++ 1 file changed, 3082 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-admx-windowsdefender.md b/windows/client-management/mdm/policy-csp-admx-windowsdefender.md index c1aaa52eb3..5e550c9817 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsdefender.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsdefender.md @@ -4780,6 +4780,3088 @@ ADMX Info:
+ +**ADMX_WindowsDefender/Scan_DisableReparsePointScanning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure reparse point scanning. If you allow reparse points to be scanned, there is a possible risk of recursion. However, the engine supports following reparse points to a maximum depth so at worst scanning could be slowed. Reparse point scanning is disabled by default and this is the recommended state for this functionality. + +If you enable this setting, reparse point scanning will be enabled. + +If you disable or do not configure this setting, reparse point scanning will be disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on reparse point scanning* +- GP name: *Scan_DisableReparsePointScanning* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_DisableRestorePoint** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to create a system restore point on the computer on a daily basis prior to cleaning. + +If you enable this setting, a system restore point will be created. + +If you disable or do not configure this setting, a system restore point will not be created. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Create a system restore point* +- GP name: *Scan_DisableRestorePoint* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ +**ADMX_WindowsDefender/Scan_DisableScanningMappedNetworkDrivesForFullScan** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scanning mapped network drives. + +If you enable this setting, mapped network drives will be scanned. + +If you disable or do not configure this setting, mapped network drives will not be scanned. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Run full scan on mapped network drives* +- GP name: *Scan_DisableScanningMappedNetworkDrivesForFullScan* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_DisableScanningNetworkFiles** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scanning for network files. It is recommended that you do not enable this setting. + +If you enable this setting, network files will be scanned. + +If you disable or do not configure this setting, network files will not be scanned. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Scan network files* +- GP name: *Scan_DisableScanningNetworkFiles* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_LocalSettingOverrideAvgCPULoadFactor** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of maximum percentage of CPU utilization during scan. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for maximum percentage of CPU utilization* +- GP name: *Scan_LocalSettingOverrideAvgCPULoadFactor* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_LocalSettingOverrideScanParameters** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of the scan type to use during a scheduled scan. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for the scan type to use for a scheduled scan* +- GP name: *Scan_LocalSettingOverrideScanParameters* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_LocalSettingOverrideScheduleDay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of scheduled scan day. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for schedule scan day* +- GP name: *Scan_LocalSettingOverrideScheduleDay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_LocalSettingOverrideScheduleQuickScantime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of scheduled quick scan time. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for scheduled quick scan time* +- GP name: *Scan_LocalSettingOverrideScheduleQuickScantime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_LocalSettingOverrideScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration of scheduled scan time. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for scheduled scan time* +- GP name: *Scan_LocalSettingOverrideScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_LowCpuPriority** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable or disable low CPU priority for scheduled scans. + +If you enable this setting, low CPU priority will be used during scheduled scans. + +If you disable or do not configure this setting, not changes will be made to CPU priority for scheduled scans. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure low CPU priority for scheduled scans* +- GP name: *Scan_LowCpuPriority* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_MissedScheduledScanCountBeforeCatchup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the number of consecutive scheduled scans that can be missed after which a catch-up scan will be forced. By default, the value of this setting is 2 consecutive scheduled scans. + +If you enable this setting, a catch-up scan will occur after the specified number consecutive missed scheduled scans. + +If you disable or do not configure this setting, a catch-up scan will occur after the 2 consecutive missed scheduled scans. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the number of days after which a catch-up scan is forced* +- GP name: *Scan_MissedScheduledScanCountBeforeCatchup* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_PurgeItemsAfterDelay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the number of days items should be kept in the scan history folder before being permanently removed. The value represents the number of days to keep items in the folder. If set to zero, items will be kept forever and will not be automatically removed. By default, the value is set to 30 days. + +If you enable this setting, items will be removed from the scan history folder after the number of days specified. + +If you disable or do not configure this setting, items will be kept in the scan history folder for the default number of days. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on removal of items from scan history folder* +- GP name: *Scan_PurgeItemsAfterDelay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_QuickScanInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify an interval at which to perform a quick scan. The time value is represented as the number of hours between quick scans. Valid values range from 1 (every hour) to 24 (once per day). If set to zero, interval quick scans will not occur. By default, this setting is set to 0. + +If you enable this setting, a quick scan will run at the interval specified. + +If you disable or do not configure this setting, a quick scan will run at a default time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the interval to run quick scans per day* +- GP name: *Scan_QuickScanInterval* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_ScanOnlyIfIdle** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure scheduled scans to start only when your computer is on but not in use. + +If you enable or do not configure this setting, scheduled scans will only run when the computer is on but not in use. + +If you disable this setting, scheduled scans will run at the scheduled time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Start the scheduled scan only when computer is on but not in use* +- GP name: *Scan_ScanOnlyIfIdle* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_ScanParameters** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the scan type to use during a scheduled scan. Scan type options are: + +- 1 = Quick Scan (default) +- 2 = Full Scan + +If you enable this setting, the scan type will be set to the specified value. + +If you disable or do not configure this setting, the default scan type will used. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the scan type to use for a scheduled scan* +- GP name: *Scan_ScanParameters* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ +**ADMX_WindowsDefender/Scan_ScheduleDay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the day of the week on which to perform a scheduled scan. The scan can also be configured to run every day or to never run at all. + +This setting can be configured with the following ordinal number values: + +- (0x0) Every Day +- (0x1) Sunday +- (0x2) Monday +- (0x3) Tuesday +- (0x4) Wednesday +- (0x5) Thursday +- (0x6) Friday +- (0x7) Saturday +- (0x8) Never (default) + +If you enable this setting, a scheduled scan will run at the frequency specified. + +If you disable or do not configure this setting, a scheduled scan will run at a default frequency. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the day of the week to run a scheduled scan* +- GP name: *Scan_ScheduleDay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ +**ADMX_WindowsDefender/Scan_ScheduleQuickScantime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the time of day at which to perform a daily quick scan. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default, this setting is set to a time value of 2:00 AM. The schedule is based on local time on the computer where the scan is executing. + +If you enable this setting, a daily quick scan will run at the time of day specified. + +If you disable or do not configure this setting, a daily quick scan will run at a default time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the time for a daily quick scan* +- GP name: *Scan_ScheduleQuickScantime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Scan_ScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the time of day at which to perform a scheduled scan. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default, this setting is set to a time value of 2:00 AM. The schedule is based on local time on the computer where the scan is executing. + +If you enable this setting, a scheduled scan will run at the time of day specified. + +If you disable or do not configure this setting, a scheduled scan will run at a default time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the time of day to run a scheduled scan* +- GP name: *Scan_ScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/ServiceKeepAlive** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether or not the antimalware service remains running when antivirus and antispyware security intelligence is disabled. It is recommended that this setting remain disabled. + +If you enable this setting, the antimalware service will always remain running even if both antivirus and antispyware security intelligence is disabled. + +If you disable or do not configure this setting, the antimalware service will be stopped when both antivirus and antispyware security intelligence is disabled. If the computer is restarted, the service will be started if it is set to Automatic startup. After the service has started, there will be a check to see if antivirus and antispyware security intelligence is enabled. If at least one is enabled, the service will remain running. If both are disabled, the service will be stopped. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow antimalware service to remain running always* +- GP name: *ServiceKeepAlive* +- GP path: *Windows Components\Microsoft Defender Antivirus* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_ASSignatureDue** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the number of days that must pass before spyware security intelligence is considered out of date. If security intelligence is determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default, this value is set to 14 days. + +If you enable this setting, spyware security intelligence will be considered out of date after the number of days specified have passed without an update. + +If you disable or do not configure this setting, spyware security intelligence will be considered out of date after the default number of days have passed without an update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the number of days before spyware security intelligence is considered out of date* +- GP name: *SignatureUpdate_ASSignatureDue* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_AVSignatureDue** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the number of days that must pass before virus security intelligence is considered out of date. If security intelligence is determined to be out of date, this state may trigger several additional actions, including falling back to an alternative update source or displaying a warning icon in the user interface. By default, this value is set to 14 days. + +If you enable this setting, virus security intelligence will be considered out of date after the number of days specified have passed without an update. + +If you disable or do not configure this setting, virus security intelligence will be considered out of date after the default number of days have passed without an update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the number of days before virus security intelligence is considered out of date* +- GP name: *SignatureUpdate_AVSignatureDue* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_DefinitionUpdateFileSharesSources** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure UNC file share sources for downloading security intelligence updates. Sources will be contacted in the order specified. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources. For example: "{\\\unc1 | \\\unc2 }". The list is empty by default. + +If you enable this setting, the specified sources will be contacted for security intelligence updates. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. + +If you disable or do not configure this setting, the list will remain empty by default and no sources will be contacted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define file shares for downloading security intelligence updates* +- GP name: *SignatureUpdate_DefinitionUpdateFileSharesSources* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_DisableScanOnUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the automatic scan which starts after a security intelligence update has occurred. + +If you enable or do not configure this setting, a scan will start following a security intelligence update. + +If you disable this setting, a scan will not start following a security intelligence update. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on scan after security intelligence update* +- GP name: *SignatureUpdate_DisableScanOnUpdate* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_DisableScheduledSignatureUpdateonBattery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure security intelligence updates when the computer is running on battery power. + +If you enable or do not configure this setting, security intelligence updates will occur as usual regardless of power state. + +If you disable this setting, security intelligence updates will be turned off while the computer is running on battery power. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow security intelligence updates when running on battery power* +- GP name: *SignatureUpdate_DisableScheduledSignatureUpdateonBattery* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_DisableUpdateOnStartupWithoutEngine** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure security intelligence updates on startup when there is no antimalware engine present. + +If you enable or do not configure this setting, security intelligence updates will be initiated on startup when there is no antimalware engine present. + +If you disable this setting, security intelligence updates will not be initiated on startup when there is no antimalware engine present. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Initiate security intelligence update on startup* +- GP name: *SignatureUpdate_DisableUpdateOnStartupWithoutEngine* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_FallbackOrder** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the order in which different security intelligence update sources should be contacted. The value of this setting should be entered as a pipe-separated string enumerating the security intelligence update sources in order. Possible values are: “InternalDefinitionUpdateServer”, “MicrosoftUpdateServer”, “MMPC”, and “FileShares”. + +For example: { InternalDefinitionUpdateServer | MicrosoftUpdateServer | MMPC } + +If you enable this setting, security intelligence update sources will be contacted in the order specified. Once security intelligence updates have been successfully downloaded from one specified source, the remaining sources in the list will not be contacted. + +If you disable or do not configure this setting, security intelligence update sources will be contacted in a default order. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the order of sources for downloading security intelligence updates* +- GP name: *SignatureUpdate_FallbackOrder* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_ForceUpdateFromMU** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable download of security intelligence updates from Microsoft Update even if the Automatic Updates default server is configured to another download source such as Windows Update. + +If you enable this setting, security intelligence updates will be downloaded from Microsoft Update. + +If you disable or do not configure this setting, security intelligence updates will be downloaded from the configured download source. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow security intelligence updates from Microsoft Update* +- GP name: *SignatureUpdate_ForceUpdateFromMU* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_RealtimeSignatureDelivery** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to enable real-time security intelligence updates in response to reports sent to Microsoft MAPS. If the service reports a file as an unknown and Microsoft MAPS finds that the latest security intelligence update has security intelligence for a threat involving that file, the service will receive all of the latest security intelligence for that threat immediately. You must have configured your computer to join Microsoft MAPS for this functionality to work. + +If you enable or do not configure this setting, real-time security intelligence updates will be enabled. + +If you disable this setting, real-time security intelligence updates will disabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow real-time security intelligence updates based on reports to Microsoft MAPS* +- GP name: *SignatureUpdate_RealtimeSignatureDelivery* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_ScheduleDay** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the day of the week on which to check for security intelligence updates. The check can also be configured to run every day or to never run at all. + +This setting can be configured with the following ordinal number values: + +- (0x0) Every Day (default) +- (0x1) Sunday +- (0x2) Monday +- (0x3) Tuesday +- (0x4) Wednesday +- (0x5) Thursday +- (0x6) Friday +- (0x7) Saturday +- (0x8) Never + +If you enable this setting, the check for security intelligence updates will occur at the frequency specified. + +If you disable or do not configure this setting, the check for security intelligence updates will occur at a default frequency. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the day of the week to check for security intelligence updates* +- GP name: *SignatureUpdate_ScheduleDay* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_ScheduleTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the time of day at which to check for security intelligence updates. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default this setting is configured to check for security intelligence updates 15 minutes before the scheduled scan time. The schedule is based on local time on the computer where the check is occurring. + +If you enable this setting, the check for security intelligence updates will occur at the time of day specified. + +If you disable or do not configure this setting, the check for security intelligence updates will occur at the default time. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the time to check for security intelligence updates* +- GP name: *SignatureUpdate_ScheduleTime* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_SharedSignaturesLocation** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the security intelligence location for VDI-configured computers. + +If you disable or do not configure this setting, security intelligence will be referred from the default local source. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define security intelligence location for VDI clients.* +- GP name: *SignatureUpdate_SharedSignaturesLocation* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ +**ADMX_WindowsDefender/SignatureUpdate_SignatureDisableNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the antimalware service to receive notifications to disable individual security intelligence in response to reports it sends to Microsoft MAPS. Microsoft MAPS uses these notifications to disable security intelligence that are causing false positive reports. You must have configured your computer to join Microsoft MAPS for this functionality to work. + +If you enable this setting or do not configure, the antimalware service will receive notifications to disable security intelligence. + +If you disable this setting, the antimalware service will not receive notifications to disable security intelligence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow notifications to disable security intelligence based reports to Microsoft MAPS* +- GP name: *SignatureUpdate_SignatureDisableNotification* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_SignatureUpdateCatchupInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to define the number of days after which a catch-up security intelligence update will be required. By default, the value of this setting is 1 day. + +If you enable this setting, a catch-up security intelligence update will occur after the specified number of days. + +If you disable or do not configure this setting, a catch-up security intelligence update will be required after the default number of days. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Define the number of days after which a catch-up security intelligence update is required* +- GP name: *SignatureUpdate_SignatureUpdateCatchupInterval* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_SignatureUpdateInterval** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify an interval at which to check for security intelligence updates. The time value is represented as the number of hours between update checks. Valid values range from 1 (every hour) to 24 (once per day). + +If you enable this setting, checks for security intelligence updates will occur at the interval specified. + +If you disable or do not configure this setting, checks for security intelligence updates will occur at the default interval. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the interval to check for security intelligence updates* +- GP name: *SignatureUpdate_SignatureUpdateInterval* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SignatureUpdate_UpdateOnStartup** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a check for new virus and spyware security intelligence will occur immediately after service startup. + +If you enable this setting, a check for new security intelligence will occur after service startup. + +If you disable this setting or do not configure this setting, a check for new security intelligence will not occur after service startup. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Check for the latest virus and spyware security intelligence on startup* +- GP name: *SignatureUpdate_UpdateOnStartup* +- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/SpynetReporting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to join Microsoft MAPS. Microsoft MAPS is the online community that helps you choose how to respond to potential threats. The community also helps stop the spread of new malicious software infections. + +You can choose to send basic or additional information about detected software. Additional information helps Microsoft create new security intelligence and help it to protect your computer. This information can include things like location of detected items on your computer if harmful software was removed. The information will be automatically collected and sent. In some instances, personal information might unintentionally be sent to Microsoft. However, Microsoft will not use this information to identify you or contact you. + +Possible options are: + +- (0x0) Disabled (default) +- (0x1) Basic membership +- (0x2) Advanced membership + +Basic membership will send basic information to Microsoft about software that has been detected, including where the software came from, the actions that you apply or that are applied automatically, and whether the actions were successful. + +Advanced membership, in addition to basic information, will send more information to Microsoft about malicious software, spyware, and potentially unwanted software, including the location of the software, file names, how the software operates, and how it has impacted your computer. + +If you enable this setting, you will join Microsoft MAPS with the membership specified. + +If you disable or do not configure this setting, you will not join Microsoft MAPS. + +In Windows 10, Basic membership is no longer available, so setting the value to 1 or 2 enrolls the device into Advanced membership. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Join Microsoft MAPS* +- GP name: *SpynetReporting* +- GP path: *Windows Components\Microsoft Defender Antivirus\MAPS* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Spynet_LocalSettingOverrideSpynetReporting** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. + +If you enable this setting, the local preference setting will take priority over Group Policy. + +If you disable or do not configure this setting, Group Policy will take priority over the local preference setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure local setting override for reporting to Microsoft MAPS* +- GP name: *Spynet_LocalSettingOverrideSpynetReporting* +- GP path: *Windows Components\Microsoft Defender Antivirus\MAPS* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ +**ADMX_WindowsDefender/SubmitSamplesConsent** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set. + +Possible options are: + +- (0x0) Always prompt +- (0x1) Send safe samples automatically +- (0x2) Never send +- (0x3) Send all samples automatically + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send file samples when further analysis is required* +- GP name: *SubmitSamplesConsent* +- GP path: *Windows Components\Microsoft Defender Antivirus\MAPS* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Threats_ThreatIdDefaultAction** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting customize which remediation action will be taken for each listed Threat ID when it is detected during a scan. Threats should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a valid Threat ID, while the value contains the action ID for the remediation action that should be taken. + +Valid remediation action values are: + +- 2 = Quarantine +- 3 = Remove +- 6 = Ignore + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify threats upon which default action should not be taken when detected* +- GP name: *Threats_ThreatIdDefaultAction* +- GP path: *Windows Components\Microsoft Defender Antivirus\Threats* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/Threats_ThreatSeverityDefaultAction** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to customize which automatic remediation action will be taken for each threat alert level.Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. + +Valid threat alert levels are: + +- 1 = Low +- 2 = Medium +- 4 = High +- 5 = Severe + +Valid remediation action values are: + +- 2 = Quarantine +- 3 = Remove +- 6 = Ignore + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify threat alert levels at which default action should not be taken when detected* +- GP name: *Threats_ThreatSeverityDefaultAction* +- GP path: *Windows Components\Microsoft Defender Antivirus\Threats* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/UX_Configuration_CustomDefaultActionToastString** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether or not to display additional text to clients when they need to perform an action. The text displayed is a custom administrator-defined string. For example, the phone number to call the company help desk. The client interface will only display a maximum of 1024 characters. Longer strings will be truncated before display. + +If you enable this setting, the additional text specified will be displayed. + +If you disable or do not configure this setting, there will be no additional text displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display additional text to clients when they need to perform an action* +- GP name: *UX_Configuration_CustomDefaultActionToastString* +- GP path: *Windows Components\Microsoft Defender Antivirus\Client Interface* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/UX_Configuration_Notification_Suppress** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Use this policy setting to specify if you want Microsoft Defender Antivirus notifications to display on clients. + +If you disable or do not configure this setting, Microsoft Defender Antivirus notifications will display on clients. + +If you enable this setting, Microsoft Defender Antivirus notifications will not display on clients. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Suppress all notifications* +- GP name: *UX_Configuration_Notification_Suppress* +- GP path: *Windows Components\Microsoft Defender Antivirus\Client Interface* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/UX_Configuration_SuppressRebootNotification** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows user to supress reboot notifications in UI only mode (for cases where UI can't be in lockdown mode). + +If you enable this setting AM UI won't show reboot notifications. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Suppresses reboot notifications* +- GP name: *UX_Configuration_SuppressRebootNotification* +- GP path: *Windows Components\Microsoft Defender Antivirus\Client Interface* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ + +**ADMX_WindowsDefender/UX_Configuration_UILockdown** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure whether or not to display AM UI to the users. + +If you enable this setting AM UI won't be available to users. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable headless UI mode* +- GP name: *UX_Configuration_UILockdown* +- GP path: *Windows Components\Microsoft Defender Antivirus\Client Interface* +- GP ADMX file name: *WindowsDefender.admx* + + + +
+ Footnotes: - 1 - Available in Windows 10, version 1607. From 49526d679d9e4e2949fedbd95943bd660c23fe6d Mon Sep 17 00:00:00 2001 From: hosebei <35492544+hosebei@users.noreply.github.com> Date: Thu, 19 Nov 2020 07:56:38 +0100 Subject: [PATCH 029/169] Adjusted Link The link used before was not working. --- windows/deployment/windows-10-subscription-activation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index fb1755d660..84fa27310d 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -91,7 +91,7 @@ For Microsoft customers with Enterprise Agreements (EA) or Microsoft Products & For Microsoft customers that do not have EA or MPSA, you can obtain Windows 10 Enterprise E3/E5 or A3/A5 through a cloud solution provider (CSP). Identity management and device requirements are the same when you use CSP to manage licenses, with the exception that Windows 10 Enterprise E3 is also available through CSP to devices running Windows 10, version 1607. For more information about obtaining Windows 10 Enterprise E3 through your CSP, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md). -If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade benefits for Windows Cloud Subscriptions in CSP](https://blogs.windows.com/business/2017/01/19/new-windows-10-upgrade-benefits-windows-cloud-subscriptions-csp/) +If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade benefits for Windows Cloud Subscriptions in CSP](https://www.microsoft.com/en-us/microsoft-365/blog/2017/01/19/new-windows-10-upgrade-benefits-windows-cloud-subscriptions-csp/) #### Multi-factor authentication From 7415a8e65206ec48f05eaf9099b7ee31b64a255b Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 19 Nov 2020 15:28:45 -0800 Subject: [PATCH 030/169] Added new policies --- windows/client-management/mdm/TOC.md | 2 + .../mdm/policies-in-policy-csp-admx-backed.md | 19 + .../policy-configuration-service-provider.md | 67 ++ .../mdm/policy-csp-admx-devicenstallation.md | 842 ++++++++++++++++++ .../mdm/policy-csp-admx-devicesetup.md | 635 +++++++++++++ 5 files changed, 1565 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-devicenstallation.md create mode 100644 windows/client-management/mdm/policy-csp-admx-devicesetup.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 98251b87fe..0e6ef2c11d 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -181,6 +181,8 @@ #### [ADMX_Cpls](policy-csp-admx-cpls.md) #### [ADMX_CredSsp](policy-csp-admx-credssp.md) #### [ADMX_CtrlAltDel](policy-csp-admx-ctrlaltdel.md) +#### [ADMX_DeviceInstallation](policy-csp-admx-devicenstallation.md) +#### [ADMX_DeviceSetup](policy-csp-admx-devicesetup.md) #### [ADMX_DigitalLocker](policy-csp-admx-digitallocker.md) #### [ADMX_DnsClient](policy-csp-admx-dnsclient.md) #### [ADMX_DWM](policy-csp-admx-dwm.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 365e5a94e6..fe0e5fc17f 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -76,6 +76,25 @@ ms.date: 10/08/2020 - [ADMX_CtrlAltDel/DisableLockComputer](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablelockcomputer) - [ADMX_CtrlAltDel/DisableTaskMgr](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disabletaskmgr) - [ADMX_CtrlAltDel/NoLogoff](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-nologoff) +- [ADMX_DeviceInstallation/DeviceInstall_AllSigningEqual](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-allsigningequal) +- [ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-allowadmininstall) +- [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-detailtext) +- [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-simpletext) +- [ADMX_DeviceInstallation/DeviceInstall_InstallTimeout](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-installtimeout) +- [ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-policy-reboottime) +- [ADMX_DeviceInstallation/DeviceInstall_Removable_Deny](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-removable-deny) +- [ADMX_DeviceInstallation/DeviceInstall_SystemRestore](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-systemrestore) +- [ADMX_DeviceInstallation/DeviceManagement_RPCInterface_Allow](./policy-csp-admx-devicenstallation.md#admx-devicemanagement-rpcinterface-allow) +- [ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-classes-allowuser) +- [ADMX_DeviceInstallation/DriverSigning](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-driversigning) +- [ADMX_DeviceSetup/DeviceInstall_BalloonTips](./policy-csp-admx-devicesetup.md#admx-devicesetup-deviceinstall-balloontips) +- [ADMX_DeviceSetup/DeviceInstall_GenericDriverSendToWER](./policy-csp-admx-devicesetup.md#admx-devicesetup-deviceinstall-genericdriversendtower) +- [ADMX_DeviceSetup/DeviceInstall_RequestAdditionalSoftwareSendToWER](./policy-csp-admx-devicesetup.md#admx-devicesetup-deviceinstall-requestadditionalsoftwaresendtower) +- [ADMX_DeviceSetup/DriverSearchPlaces](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces) +- [ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_1](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-dontpromptforwindowsupdate-1) +- [ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_2](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-dontpromptforwindowsupdate-2) +- [ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-searchorderconfiguration) +- [ADMX_DeviceSetup/DriverSearchPlaces_SearchServerConfiguration](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-searchserverconfiguration) - [ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_1](./policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-1) - [ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_2](./policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-2) - [ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-allowfqdnnetbiosqueries) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 6431d07b97..b1a2a67b23 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -377,6 +377,73 @@ The following diagram shows the Policy configuration service provider in tree fo
+### ADMX_DeviceInstallation policies + +
+
+ ADMX_DeviceInstallation/DeviceInstall_AllSigningEqual +
+
+ ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall +
+
+ ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText +
+
+ ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText +
+
+ ADMX_DeviceInstallation/DeviceInstall_InstallTimeout +
+
+ ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime +
+
+ ADMX_DeviceInstallation/DeviceInstall_Removable_Deny +
+
+ ADMX_DeviceInstallation/DeviceInstall_SystemRestore +
+
+ ADMX_DeviceInstallation/DeviceManagement_RPCInterface_Allow +
+
+ ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser +
+
+ ADMX_DeviceInstallation/DriverSigning +
+
+ +### ADMX_DeviceSetup policies + +
+
+ ADMX_DeviceSetup/DeviceInstall_BalloonTips +
+
+ ADMX_DeviceSetup/DeviceInstall_GenericDriverSendToWER +
+
+ ADMX_DeviceSetup/DeviceInstall_RequestAdditionalSoftwareSendToWER +
+
+ ADMX_DeviceSetup/DriverSearchPlaces +
+
+ ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_1 +
+
+ ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_2 +
+
+ ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration +
+
+ ADMX_DeviceSetup/DriverSearchPlaces_SearchServerConfiguration +
+
+ ### ADMX_DigitalLocker policies
diff --git a/windows/client-management/mdm/policy-csp-admx-devicenstallation.md b/windows/client-management/mdm/policy-csp-admx-devicenstallation.md new file mode 100644 index 0000000000..c52d3a4656 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-devicenstallation.md @@ -0,0 +1,842 @@ +--- +title: Policy CSP - ADMX_DeviceInstallation +description: Policy CSP - ADMX_DeviceInstallation +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/19/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DeviceInstallation +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_DeviceInstallation policies + +
+
+ ADMX_DeviceInstallation/DeviceInstall_AllSigningEqual +
+
+ ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall +
+
+ ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText +
+
+ ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText +
+
+ ADMX_DeviceInstallation/DeviceInstall_InstallTimeout +
+
+ ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime +
+
+ ADMX_DeviceInstallation/DeviceInstall_Removable_Deny +
+
+ ADMX_DeviceInstallation/DeviceInstall_SystemRestore +
+
+ ADMX_DeviceInstallation/DeviceManagement_RPCInterface_Allow +
+
+ ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser +
+
+ ADMX_DeviceInstallation/DriverSigning +
+
+ + +
+ + +**ADMX_DeviceInstallation/DeviceInstall_AllSigningEqual** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to determine how drivers signed by a Microsoft Windows Publisher certificate are ranked with drivers signed by other valid Authenticode signatures during the driver selection and installation process. Regardless of this policy setting, a signed driver is still preferred over a driver that is not signed at all. + +If you enable or do not configure this policy setting, drivers that are signed by a Microsoft Windows Publisher certificate and drivers that are signed by other Authenticode certificates are prioritized equally during the driver selection process. Selection is based on other criteria, such as version number or when the driver was created. + +If you disable this policy setting, drivers that are signed by a Microsoft Windows Publisher certificate are selected for installation over drivers that are signed by other Authenticode certificates. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prioritize all digitally signed drivers equally during the driver ranking and selection process* +- GP name: *DeviceInstall_AllSigningEqual* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
+ + +**ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings. + +If you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for any device. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. + +If you disable or do not configure this policy setting, members of the Administrators group are subject to all policy settings that restrict device installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow administrators to override Device Installation Restriction policies* +- GP name: *DeviceInstall_AllowAdminInstall* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
+ + +**ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to display a custom message to users in a notification when a device installation is attempted and a policy setting prevents the installation. + +If you enable this policy setting, Windows displays the text you type in the Detail Text box when a policy setting prevents device installation. + +If you disable or do not configure this policy setting, Windows displays a default message when a policy setting prevents device installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display a custom message when installation is prevented by a policy setting* +- GP name: *DeviceInstall_DeniedPolicy_DetailText* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
+ + +**ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to display a custom message title in a notification when a device installation is attempted and a policy setting prevents the installation. + +If you enable this policy setting, Windows displays the text you type in the Main Text box as the title text of a notification when a policy setting prevents device installation. + +If you disable or do not configure this policy setting, Windows displays a default title in a notification when a policy setting prevents device installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Display a custom message title when device installation is prevented by a policy setting* +- GP name: *DeviceInstall_DeniedPolicy_SimpleText* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
+ + +**ADMX_DeviceInstallation/DeviceInstall_InstallTimeout** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the number of seconds Windows waits for a device installation task to complete. + +If you enable this policy setting, Windows waits for the number of seconds you specify before terminating the installation. + +If you disable or do not configure this policy setting, Windows waits 240 seconds for a device installation task to complete before terminating the installation. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure device installation time-out* +- GP name: *DeviceInstall_InstallTimeout* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
+ + +**ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting establishes the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in device installation restriction policies. + +If you enable this policy setting, set the amount of seconds you want the system to wait until a reboot. + +If you disable or do not configure this policy setting, the system does not force a reboot. + +Note: If no reboot is forced, the device installation restriction right will not take effect until the system is restarted. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Time (in seconds) to force reboot when required for policy changes to take effect* +- GP name: *DeviceInstall_Policy_RebootTime* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
+ + +**ADMX_DeviceInstallation/DeviceInstall_Removable_Deny** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. This policy setting takes precedence over any other policy setting that allows Windows to install a device. + +If you enable this policy setting, Windows is prevented from installing removable devices and existing removable devices cannot have their drivers updated. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of removable devices from a remote desktop client to the remote desktop server. + +If you disable or do not configure this policy setting, Windows can install and update device drivers for removable devices as allowed or prevented by other policy settings. + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent installation of removable devices* +- GP name: *DeviceInstall_Removable_Deny* +- GP path: *System\Device Installation\Device Installation Restrictions* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
+ + +**ADMX_DeviceInstallation/DeviceInstall_SystemRestore** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent Windows from creating a system restore point during device activity that would normally prompt Windows to create a system restore point. Windows normally creates restore points for certain driver activity, such as the installation of an unsigned driver. A system restore point enables you to more easily restore your system to its state before the activity. + +If you enable this policy setting, Windows does not create a system restore point when one would normally be created. + +If you disable or do not configure this policy setting, Windows creates a system restore point as it normally would. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point* +- GP name: *DeviceInstall_SystemRestore* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
+ + +**ADMX_DeviceInstallation/DeviceManagement_RPCInterface_Allow** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to allow or deny remote access to the Plug and Play interface. + +If you enable this policy setting, remote connections to the Plug and Play interface are allowed. + +If you disable or do not configure this policy setting, remote connections to the Plug and Play interface are not allowed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow remote access to the Plug and Play interface* +- GP name: *DeviceManagement_RPCInterface_Allow* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
+ + +**ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies a list of device setup class GUIDs describing device drivers that non-administrator members of the built-in Users group may install on the system. + +If you enable this policy setting, members of the Users group may install new drivers for the specified device setup classes. The drivers must be signed according to Windows Driver Signing Policy, or be signed by publishers already in the TrustedPublisher store. + +If you disable or do not configure this policy setting, only members of the Administrators group are allowed to install new device drivers on the system. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow non-administrators to install drivers for these device setup classes* +- GP name: *DriverInstall_Classes_AllowUser* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
+ + +**ADMX_DeviceInstallation/DriverSigning** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Determines how the system responds when a user tries to install device driver files that are not digitally signed. + +This setting establishes the least secure response permitted on the systems of users in the group. Users can use System in Control Panel to select a more secure setting, but when this setting is enabled, the system does not implement any setting less secure than the one the setting established. + +When you enable this setting, use the drop-down box to specify the desired response. + +- "Ignore" directs the system to proceed with the installation even if it includes unsigned files. +- "Warn" notifies the user that files are not digitally signed and lets the user decide whether to stop or to proceed with the installation and whether to permit unsigned files to be installed. "Warn" is the default. +- "Block" directs the system to refuse to install unsigned files. As a result, the installation stops, and none of the files in the driver package are installed. + +To change driver file security without specifying a setting, use System in Control Panel. Right-click My Computer, click Properties, click the Hardware tab, and then click the Driver Signing button. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Code signing for device drivers* +- GP name: *DriverSigning* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceInstallation.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-devicesetup.md b/windows/client-management/mdm/policy-csp-admx-devicesetup.md new file mode 100644 index 0000000000..d82cda8513 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-devicesetup.md @@ -0,0 +1,635 @@ +--- +title: Policy CSP - ADMX_DeviceSetup +description: Policy CSP - ADMX_DeviceSetup +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/19/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DeviceSetup +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_DeviceSetup policies + +
+
+ ADMX_DeviceSetup/DeviceInstall_BalloonTips +
+
+ ADMX_DeviceSetup/DeviceInstall_GenericDriverSendToWER +
+
+ ADMX_DeviceSetup/DeviceInstall_RequestAdditionalSoftwareSendToWER +
+
+ ADMX_DeviceSetup/DriverSearchPlaces +
+
+ ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_1 +
+
+ ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_2 +
+
+ ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration +
+
+ ADMX_DeviceSetup/DriverSearchPlaces_SearchServerConfiguration +
+
+ + +
+ + +**ADMX_DeviceSetup/DeviceInstall_BalloonTips** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off "Found New Hardware" balloons during device installation. + +If you enable this policy setting, "Found New Hardware" balloons do not appear while a device is being installed. + +If you disable or do not configure this policy setting, "Found New Hardware" balloons appear while a device is being installed, unless the driver for the device suppresses the balloons. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off "Found New Hardware" balloons during device installation* +- GP name: *DeviceInstall_BalloonTips* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceSetup.admx* + + + +
+ + +**ADMX_DeviceSetup/DeviceInstall_GenericDriverSendToWER** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Windows has a feature that sends "generic-driver-installed" reports through the Windows Error Reporting infrastructure. This policy allows you to disable the feature. + +If you enable this policy setting, an error report is not sent when a generic driver is installed. + +If you disable or do not configure this policy setting, an error report is sent when a generic driver is installed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not send a Windows error report when a generic driver is installed on a device* +- GP name: *DeviceInstall_GenericDriverSendToWER* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceSetup.admx* + + + +
+ + +**ADMX_DeviceSetup/DeviceInstall_RequestAdditionalSoftwareSendToWER** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Windows has a feature that allows a device driver to request additional software through the Windows Error Reporting infrastructure. This policy allows you to disable the feature. + +If you enable this policy setting, Windows will not send an error report to request additional software even if this is specified by the device driver. + +If you disable or do not configure this policy setting, Windows sends an error report when a device driver that requests additional software is installed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent Windows from sending an error report when a device driver requests additional software during installation* +- GP name: *DeviceInstall_RequestAdditionalSoftwareSendToWER* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceSetup.admx* + + + +
+ + +**ADMX_DeviceSetup/DriverSearchPlaces** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This setting configures the location that Windows searches for drivers when a new piece of hardware is found. + +By default, Windows searches the following places for drivers: local installation, floppy drives, CD-ROM drives, Windows Update. + +Using this setting, you may remove the floppy and CD-ROM drives from the search algorithm. + +If you enable this setting, you can remove the locations by selecting the associated check box beside the location name. + +If you disable or do not configure this setting, Windows searches the installation location, floppy drives, and CD-ROM drives. + +> [!NOTE] +> To prevent searching Windows Update for drivers also see "Turn off Windows Update device driver searching" in Administrative Templates/System/Internet Communication Management/Internet Communication settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure driver search locations* +- GP name: *DriverSearchPlaces* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceSetup.admx* + + + +
+ + +**ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Specifies whether the administrator will be prompted about going to Windows Update to search for device drivers using the Internet. + +> [!NOTE] +> This setting only has effect if "Turn off Windows Update device driver searching" in "Administrative Templates/System/Internet Communication Management/Internet Communication settings" is disabled or not configured. + +If you enable this setting, administrators will not be prompted to search Windows Update. + +If you disable or do not configure this setting, and "Turn off Windows Update device driver searching" is disabled or not configured, the administrator will be prompted for consent before going to Windows Update to search for device drivers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Update device driver search prompt* +- GP name: *DriverSearchPlaces_DontPromptForWindowsUpdate_1* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceSetup.admx* + + + +
+ + +**ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Specifies whether the administrator will be prompted about going to Windows Update to search for device drivers using the Internet. + +> [!NOTE] +> This setting only has effect if "Turn off Windows Update device driver searching" in "Administrative Templates/System/Internet Communication Management/Internet Communication settings" is disabled or not configured. + +If you enable this setting, administrators will not be prompted to search Windows Update. + +If you disable or do not configure this setting, and "Turn off Windows Update device driver searching" is disabled or not configured, the administrator will be prompted for consent before going to Windows Update to search for device drivers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Windows Update device driver search prompt* +- GP name: *DriverSearchPlaces_DontPromptForWindowsUpdate_2* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceSetup.admx* + + + +
+ + +**ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the order in which Windows searches source locations for device drivers. + +If you enable this policy setting, you can select whether Windows searches for drivers on Windows Update unconditionally, only if necessary, or not at all. + +Note that searching always implies that Windows will attempt to search Windows Update exactly one time. With this setting, Windows will not continually search for updates. This setting is used to ensure that the best software will be found for the device, even if the network is temporarily available. If the setting for searching only if needed is specified, then Windows will search for a driver only if a driver is not locally available on the system. + +If you disable or do not configure this policy setting, members of the Administrators group can determine the priority order in which Windows searches source locations for device drivers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify search order for device driver source locations* +- GP name: *DriverSearchPlaces_SearchOrderConfiguration* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceSetup.admx* + + + +
+ + +**ADMX_DeviceSetup/DriverSearchPlaces_SearchServerConfiguration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the search server that Windows uses to find updates for device drivers. + +If you enable this policy setting, you can select whether Windows searches Windows Update (WU), searches a Managed Server, or a combination of both. + +Note that if both are specified, then Windows will first search the Managed Server, such as a Windows Server Update Services (WSUS) server. Only if no update is found will Windows then also search Windows Update. + +If you disable or do not configure this policy setting, members of the Administrators group can determine the server used in the search for device drivers. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the search server for device driver updates* +- GP name: *DriverSearchPlaces_SearchServerConfiguration* +- GP path: *System\Device Installation* +- GP ADMX file name: *DeviceSetup.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From 0c6e72110a34a29ba0d126976ba964d3fa058a6e Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 19 Nov 2020 16:21:06 -0800 Subject: [PATCH 031/169] Added EAIME policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 12 + .../policy-configuration-service-provider.md | 41 + .../mdm/policy-csp-admx-eaime.md | 971 ++++++++++++++++++ 4 files changed, 1025 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-eaime.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 0e6ef2c11d..90fe63842c 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -186,6 +186,7 @@ #### [ADMX_DigitalLocker](policy-csp-admx-digitallocker.md) #### [ADMX_DnsClient](policy-csp-admx-dnsclient.md) #### [ADMX_DWM](policy-csp-admx-dwm.md) +#### [ADMX_EAIME](policy-csp-admx-eaime.md) #### [ADMX_EncryptFilesonMove](policy-csp-admx-encryptfilesonmove.md) #### [ADMX_EventForwarding](policy-csp-admx-eventforwarding.md) #### [ADMX_FileServerVSSProvider](policy-csp-admx-fileservervssprovider.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index fe0e5fc17f..3822a4815a 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -125,6 +125,18 @@ ms.date: 10/08/2020 - [ADMX_DWM/DwmDisallowAnimations_2](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowanimations-2) - [ADMX_DWM/DwmDisallowColorizationColorChanges_1](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowcolorizationcolorchanges-1) - [ADMX_DWM/DwmDisallowColorizationColorChanges_2](./policy-csp-admx-dwm.md#admx-dwm-dwmdisallowcolorizationcolorchanges-2) +- [ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList](./policy-csp-admx-eaime.md#admx-eaime-l-donotincludenonpublishingstandardglyphinthecandidatelist) +- [ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion](./policy-csp-admx-eaime.md#admx-eaime-l-restrictcharactercoderangeofconversion) +- [ADMX_EAIME/L_TurnOffCustomDictionary](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffcustomdictionary) +- [ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffhistorybasedpredictiveinput) +- [ADMX_EAIME/L_TurnOffInternetSearchIntegration](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffinternetsearchintegration) +- [ADMX_EAIME/L_TurnOffOpenExtendedDictionary](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffopenextendeddictionary) +- [ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile](./policy-csp-admx-eaime.md#admx-eaime-l-turnoffsavingautotuningdatatofile) +- [ADMX_EAIME/L_TurnOnCloudCandidate](./policy-csp-admx-eaime.md#admx-eaime-l-turnoncloudcandidate) +- [ADMX_EAIME/L_TurnOnCloudCandidateCHS](./policy-csp-admx-eaime.md#admx-eaime-l-turnoncloudcandidatechs) +- [ADMX_EAIME/L_TurnOnLexiconUpdate](./policy-csp-admx-eaime.md#admx-eaime-l-turnonlexiconupdate) +- [ADMX_EAIME/L_TurnOnLiveStickers](./policy-csp-admx-eaime.md#admx-eaime-l-turnonlivestickers) +- [ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport](./policy-csp-admx-eaime.md#admx-eaime-l-turnonmisconversionloggingformisconversionreport) - [ADMX_EncryptFilesonMove/NoEncryptOnMove](./policy-csp-admx-encryptfilesonmove.md#admx-encryptfilesonmove-noencryptonmove) - [ADMX_EventForwarding/ForwarderResourceUsage](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-forwarderresourceusage) - [ADMX_EventForwarding/SubscriptionManager](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-subscriptionmanager) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index b1a2a67b23..e068d6a883 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -548,6 +548,47 @@ The following diagram shows the Policy configuration service provider in tree fo
+### ADMX_EAIME policies + +
+
+ ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList +
+
+ ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion +
+
+ ADMX_EAIME/L_TurnOffCustomDictionary +
+
+ ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput +
+
+ ADMX_EAIME/L_TurnOffInternetSearchIntegration +
+
+ ADMX_EAIME/L_TurnOffOpenExtendedDictionary +
+
+ ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile +
+
+ ADMX_EAIME/L_TurnOnCloudCandidate +
+
+ ADMX_EAIME/L_TurnOnCloudCandidateCHS +
+
+ ADMX_EAIME/L_TurnOnLexiconUpdate +
+
+ ADMX_EAIME/L_TurnOnLiveStickers +
+
+ ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport +
+
+ ### ADMX_EncryptFilesonMove policies
diff --git a/windows/client-management/mdm/policy-csp-admx-eaime.md b/windows/client-management/mdm/policy-csp-admx-eaime.md new file mode 100644 index 0000000000..3cd05e398d --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-eaime.md @@ -0,0 +1,971 @@ +--- +title: Policy CSP - ADMX_EAIME +description: Policy CSP - ADMX_EAIME +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/19/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EAIME +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_EAIME policies + +
+
+ ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList +
+
+ ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion +
+
+ ADMX_EAIME/L_TurnOffCustomDictionary +
+
+ ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput +
+
+ ADMX_EAIME/L_TurnOffInternetSearchIntegration +
+
+ ADMX_EAIME/L_TurnOffOpenExtendedDictionary +
+
+ ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile +
+
+ ADMX_EAIME/L_TurnOnCloudCandidate +
+
+ ADMX_EAIME/L_TurnOnCloudCandidateCHS +
+
+ ADMX_EAIME/L_TurnOnLexiconUpdate +
+
+ ADMX_EAIME/L_TurnOnLiveStickers +
+
+ ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport +
+
+ + +
+ + +**ADMX_EAIME/L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to include the Non-Publishing Standard Glyph in the candidate list when Publishing Standard Glyph for the word exists. + +If you enable this policy setting, Non-Publishing Standard Glyph is not included in the candidate list when Publishing Standard Glyph for the word exists. + +If you disable or do not configure this policy setting, both Publishing Standard Glyph and Non-Publishing Standard Glyph are included in the candidate list. + +This policy setting applies to Japanese Microsoft IME only. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not include Non-Publishing Standard Glyph in the candidate list* +- GP name: *L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
+ + +**ADMX_EAIME/L_RestrictCharacterCodeRangeOfConversion** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to restrict character code range of conversion by setting character filter. + +If you enable this policy setting, then only the character code ranges specified by this policy setting are used for conversion of IME. You can specify multiple ranges by setting a value combined with a bitwise OR of following values: + +- 0x0001 // JIS208 area +- 0x0002 // NEC special char code +- 0x0004 // NEC selected IBM extended code +- 0x0008 // IBM extended code +- 0x0010 // Half width katakana code +- 0x0100 // EUDC(GAIJI) +- 0x0200 // S-JIS unmapped area +- 0x0400 // Unicode char +- 0x0800 // surrogate char +- 0x1000 // IVS char +- 0xFFFF // no definition. + +If you disable or do not configure this policy setting, no range of characters are filtered by default. + +This policy setting applies to Japanese Microsoft IME only. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Restrict character code range of conversion* +- GP name: *L_RestrictCharacterCodeRangeOfConversion* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
+ + +**ADMX_EAIME/L_TurnOffCustomDictionary** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off the ability to use a custom dictionary. + +If you enable this policy setting, you cannot add, edit, and delete words in the custom dictionary either with GUI tools or APIs. A word registered in the custom dictionary before enabling this policy setting can continue to be used for conversion. + +If you disable or do not configure this policy setting, the custom dictionary can be used by default. + +For Japanese Microsoft IME, [Clear auto-tuning information] works, even if this policy setting is enabled, and it clears self-tuned words from the custom dictionary. + +This policy setting is applied to Japanese Microsoft IME. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off custom dictionary* +- GP name: *L_TurnOffCustomDictionary* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
+ + +**ADMX_EAIME/L_TurnOffHistorybasedPredictiveInput** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off history-based predictive input. + +If you enable this policy setting, history-based predictive input is turned off. + +If you disable or do not configure this policy setting, history-based predictive input is on by default. + +This policy setting applies to Japanese Microsoft IME only. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off history-based predictive input* +- GP name: *L_TurnOffHistorybasedPredictiveInput* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
+ + +**ADMX_EAIME/L_TurnOffInternetSearchIntegration** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off Internet search integration. + +Search integration includes both using Search Provider (Japanese Microsoft IME) and performing bing search from predictive input for Japanese Microsoft IME. + +If you enable this policy setting, you cannot use search integration. + +If you disable or do not configure this policy setting, the search integration function can be used by default. + +This policy setting applies to Japanese Microsoft IME. + +> [!NOTE] +> Changes to this setting will not take effect until the user logs off. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Internet search integration* +- GP name: *L_TurnOffInternetSearchIntegration* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
+ + +**ADMX_EAIME/L_TurnOffOpenExtendedDictionary** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off Open Extended Dictionary. + +If you enable this policy setting, Open Extended Dictionary is turned off. You cannot add a new Open Extended Dictionary. + +For Japanese Microsoft IME, an Open Extended Dictionary that is added before enabling this policy setting is not used for conversion. + +If you disable or do not configure this policy setting, Open Extended Dictionary can be added and used by default. + +This policy setting is applied to Japanese Microsoft IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Open Extended Dictionary* +- GP name: *L_TurnOffOpenExtendedDictionary* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
+ + +**ADMX_EAIME/L_TurnOffSavingAutoTuningDataToFile** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off saving the auto-tuning result to file. + +If you enable this policy setting, the auto-tuning data is not saved to file. + +If you disable or do not configure this policy setting, auto-tuning data is saved to file by default. + +This policy setting applies to Japanese Microsoft IME only. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off saving auto-tuning data to file* +- GP name: *L_TurnOffSavingAutoTuningDataToFile* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
+ + +**ADMX_EAIME/L_TurnOnCloudCandidate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the cloud candidates feature, which uses an online service to provide input suggestions that don't exist in a PC's local dictionary. + +If you enable this policy setting, the functionality associated with this feature is turned on, the user's keyboard input is sent to Microsoft to generate the suggestions, and the user won't be able to turn it off. + +If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on. + +If you don't configure this policy setting, it will be turned off by default, and the user can turn on and turn off the cloud candidates feature. + +This Policy setting applies to Microsoft CHS Pinyin IME and JPN IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on cloud candidate* +- GP name: *L_TurnOnCloudCandidate* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
+ + +**ADMX_EAIME/L_TurnOnCloudCandidateCHS** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the cloud candidates feature, which uses an online service to provide input suggestions that don't exist in a PC's local dictionary. + +If you enable this policy setting, the functionality associated with this feature is turned on, the user's keyboard input is sent to Microsoft to generate the suggestions, and the user won't be able to turn it off. + +If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on. + +If you don't configure this policy setting, it will be turned off by default, and the user can turn on and turn off the cloud candidates feature. + +This Policy setting applies only to Microsoft CHS Pinyin IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on cloud candidate for CHS* +- GP name: *L_TurnOnCloudCandidateCHS* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
+ + +**ADMX_EAIME/L_TurnOnLexiconUpdate** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the lexicon update feature, which downloads hot and popular words lexicon to local PC. + +If you enable this policy setting, the functionality associated with this feature is turned on, hot and popular words lexicon can be downloaded to local PC, the user is able to turn it on or off in settings. + +If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on. + +If you don't configure this policy setting, it will be turned on by default, and the user can turn on and turn off the lexicon udpate feature. + +This Policy setting applies only to Microsoft CHS Pinyin IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on lexicon update* +- GP name: *L_TurnOnLexiconUpdate* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
+ + +**ADMX_EAIME/L_TurnOnLiveStickers** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the live sticker feature, which uses an online service to provide stickers online. + +If you enable this policy setting, the functionality associated with this feature is turned on, the user's keyboard input is sent to Microsoft to generate the live stickers, and the user won't be able to turn it off. + +If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on. + +If you don't configure this policy setting, it will be turned off by default, and the user can turn on and turn off the live sticker feature. + +This Policy setting applies only to Microsoft CHS Pinyin IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on Live Sticker* +- GP name: *L_TurnOnLiveStickers* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
+ + +**ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn on logging of misconversion for the misconversion report. + +If you enable this policy setting, misconversion logging is turned on. + +If you disable or do not configure this policy setting, misconversion logging is turned off. + +This policy setting applies to Japanese Microsoft IME and Traditional Chinese IME. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on misconversion logging for misconversion report* +- GP name: *L_TurnOnMisconversionLoggingForMisconversionReport* +- GP path: *Windows Components\IME* +- GP ADMX file name: *EAIME.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From 473f10c9a902fc4c24cefcd9d31dc0a6e5347d1a Mon Sep 17 00:00:00 2001 From: Chai Wei Jie Date: Fri, 20 Nov 2020 10:50:46 +0800 Subject: [PATCH 032/169] Update prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md Fixed typo. --- ...h-installation-of-windows-10-with-configuration-manager.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md b/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md index 4dd8344c5b..116cb87a9e 100644 --- a/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/prepare-for-zero-touch-installation-of-windows-10-with-configuration-manager.md @@ -129,7 +129,7 @@ In order for the Configuration Manager Join Domain Account (CM\_JD) to join mach On **DC01**: -1. Sign in as contoso\administrtor and enter the following at an elevated Windows PowerShell prompt: +1. Sign in as contoso\administrator and enter the following at an elevated Windows PowerShell prompt: ``` Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force @@ -389,4 +389,4 @@ You can create reference images for Configuration Manager in Configuration Manag [Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md)
[Deploy Windows 10 using PXE and Configuration Manager](deploy-windows-10-using-pxe-and-configuration-manager.md)
[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md)
-[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) \ No newline at end of file +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md) From aa96b6d2f12ae8c24261592399ddec66050c231e Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Fri, 20 Nov 2020 14:54:18 -0800 Subject: [PATCH 033/169] removed deprecated policies --- .../mdm/policies-in-policy-csp-admx-backed.md | 9 - .../policy-configuration-service-provider.md | 27 -- .../mdm/policy-csp-admx-devicenstallation.md | 223 --------- .../mdm/policy-csp-admx-devicesetup.md | 447 ------------------ 4 files changed, 706 deletions(-) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 3822a4815a..fb21f97424 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -76,7 +76,6 @@ ms.date: 10/08/2020 - [ADMX_CtrlAltDel/DisableLockComputer](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablelockcomputer) - [ADMX_CtrlAltDel/DisableTaskMgr](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disabletaskmgr) - [ADMX_CtrlAltDel/NoLogoff](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-nologoff) -- [ADMX_DeviceInstallation/DeviceInstall_AllSigningEqual](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-allsigningequal) - [ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-allowadmininstall) - [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-detailtext) - [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-simpletext) @@ -84,17 +83,9 @@ ms.date: 10/08/2020 - [ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-policy-reboottime) - [ADMX_DeviceInstallation/DeviceInstall_Removable_Deny](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-removable-deny) - [ADMX_DeviceInstallation/DeviceInstall_SystemRestore](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-systemrestore) -- [ADMX_DeviceInstallation/DeviceManagement_RPCInterface_Allow](./policy-csp-admx-devicenstallation.md#admx-devicemanagement-rpcinterface-allow) - [ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-classes-allowuser) -- [ADMX_DeviceInstallation/DriverSigning](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-driversigning) - [ADMX_DeviceSetup/DeviceInstall_BalloonTips](./policy-csp-admx-devicesetup.md#admx-devicesetup-deviceinstall-balloontips) -- [ADMX_DeviceSetup/DeviceInstall_GenericDriverSendToWER](./policy-csp-admx-devicesetup.md#admx-devicesetup-deviceinstall-genericdriversendtower) -- [ADMX_DeviceSetup/DeviceInstall_RequestAdditionalSoftwareSendToWER](./policy-csp-admx-devicesetup.md#admx-devicesetup-deviceinstall-requestadditionalsoftwaresendtower) -- [ADMX_DeviceSetup/DriverSearchPlaces](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces) -- [ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_1](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-dontpromptforwindowsupdate-1) -- [ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_2](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-dontpromptforwindowsupdate-2) - [ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-searchorderconfiguration) -- [ADMX_DeviceSetup/DriverSearchPlaces_SearchServerConfiguration](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-searchserverconfiguration) - [ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_1](./policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-1) - [ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_2](./policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-2) - [ADMX_DnsClient/DNS_AllowFQDNNetBiosQueries](./policy-csp-admx-dnsclient.md#admx-dnsclient-dns-allowfqdnnetbiosqueries) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index e068d6a883..83c2c8ba65 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -380,9 +380,6 @@ The following diagram shows the Policy configuration service provider in tree fo ### ADMX_DeviceInstallation policies
-
- ADMX_DeviceInstallation/DeviceInstall_AllSigningEqual -
ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall
@@ -404,15 +401,9 @@ The following diagram shows the Policy configuration service provider in tree fo
ADMX_DeviceInstallation/DeviceInstall_SystemRestore
-
- ADMX_DeviceInstallation/DeviceManagement_RPCInterface_Allow -
ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser
-
- ADMX_DeviceInstallation/DriverSigning -
### ADMX_DeviceSetup policies @@ -421,27 +412,9 @@ The following diagram shows the Policy configuration service provider in tree fo
ADMX_DeviceSetup/DeviceInstall_BalloonTips
-
- ADMX_DeviceSetup/DeviceInstall_GenericDriverSendToWER -
-
- ADMX_DeviceSetup/DeviceInstall_RequestAdditionalSoftwareSendToWER -
-
- ADMX_DeviceSetup/DriverSearchPlaces -
-
- ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_1 -
-
- ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_2 -
ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration
-
- ADMX_DeviceSetup/DriverSearchPlaces_SearchServerConfiguration -
### ADMX_DigitalLocker policies diff --git a/windows/client-management/mdm/policy-csp-admx-devicenstallation.md b/windows/client-management/mdm/policy-csp-admx-devicenstallation.md index c52d3a4656..5f9d502f36 100644 --- a/windows/client-management/mdm/policy-csp-admx-devicenstallation.md +++ b/windows/client-management/mdm/policy-csp-admx-devicenstallation.md @@ -22,9 +22,6 @@ manager: dansimp ## ADMX_DeviceInstallation policies
-
- ADMX_DeviceInstallation/DeviceInstall_AllSigningEqual -
ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall
@@ -46,89 +43,14 @@ manager: dansimp
ADMX_DeviceInstallation/DeviceInstall_SystemRestore
-
- ADMX_DeviceInstallation/DeviceManagement_RPCInterface_Allow -
ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser
-
- ADMX_DeviceInstallation/DriverSigning -
- -**ADMX_DeviceInstallation/DeviceInstall_AllSigningEqual** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to determine how drivers signed by a Microsoft Windows Publisher certificate are ranked with drivers signed by other valid Authenticode signatures during the driver selection and installation process. Regardless of this policy setting, a signed driver is still preferred over a driver that is not signed at all. - -If you enable or do not configure this policy setting, drivers that are signed by a Microsoft Windows Publisher certificate and drivers that are signed by other Authenticode certificates are prioritized equally during the driver selection process. Selection is based on other criteria, such as version number or when the driver was created. - -If you disable this policy setting, drivers that are signed by a Microsoft Windows Publisher certificate are selected for installation over drivers that are signed by other Authenticode certificates. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Prioritize all digitally signed drivers equally during the driver ranking and selection process* -- GP name: *DeviceInstall_AllSigningEqual* -- GP path: *System\Device Installation* -- GP ADMX file name: *DeviceInstallation.admx* - - - -
- **ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall** @@ -613,75 +535,6 @@ ADMX Info:
- -**ADMX_DeviceInstallation/DeviceManagement_RPCInterface_Allow** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to allow or deny remote access to the Plug and Play interface. - -If you enable this policy setting, remote connections to the Plug and Play interface are allowed. - -If you disable or do not configure this policy setting, remote connections to the Plug and Play interface are not allowed. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Allow remote access to the Plug and Play interface* -- GP name: *DeviceManagement_RPCInterface_Allow* -- GP path: *System\Device Installation* -- GP ADMX file name: *DeviceInstallation.admx* - - - -
- **ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser** @@ -752,82 +605,6 @@ ADMX Info:
- -**ADMX_DeviceInstallation/DriverSigning** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User - -
- - - -Available in the latest Windows 10 Insider Preview Build. Determines how the system responds when a user tries to install device driver files that are not digitally signed. - -This setting establishes the least secure response permitted on the systems of users in the group. Users can use System in Control Panel to select a more secure setting, but when this setting is enabled, the system does not implement any setting less secure than the one the setting established. - -When you enable this setting, use the drop-down box to specify the desired response. - -- "Ignore" directs the system to proceed with the installation even if it includes unsigned files. -- "Warn" notifies the user that files are not digitally signed and lets the user decide whether to stop or to proceed with the installation and whether to permit unsigned files to be installed. "Warn" is the default. -- "Block" directs the system to refuse to install unsigned files. As a result, the installation stops, and none of the files in the driver package are installed. - -To change driver file security without specifying a setting, use System in Control Panel. Right-click My Computer, click Properties, click the Hardware tab, and then click the Driver Signing button. - - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Code signing for device drivers* -- GP name: *DriverSigning* -- GP path: *System\Device Installation* -- GP ADMX file name: *DeviceInstallation.admx* - - - -
- Footnotes: - 1 - Available in Windows 10, version 1607. diff --git a/windows/client-management/mdm/policy-csp-admx-devicesetup.md b/windows/client-management/mdm/policy-csp-admx-devicesetup.md index d82cda8513..77264647f1 100644 --- a/windows/client-management/mdm/policy-csp-admx-devicesetup.md +++ b/windows/client-management/mdm/policy-csp-admx-devicesetup.md @@ -25,27 +25,9 @@ manager: dansimp
ADMX_DeviceSetup/DeviceInstall_BalloonTips
-
- ADMX_DeviceSetup/DeviceInstall_GenericDriverSendToWER -
-
- ADMX_DeviceSetup/DeviceInstall_RequestAdditionalSoftwareSendToWER -
-
- ADMX_DeviceSetup/DriverSearchPlaces -
-
- ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_1 -
-
- ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_2 -
ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration
-
- ADMX_DeviceSetup/DriverSearchPlaces_SearchServerConfiguration -
@@ -120,364 +102,6 @@ ADMX Info:
- -**ADMX_DeviceSetup/DeviceInstall_GenericDriverSendToWER** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. Windows has a feature that sends "generic-driver-installed" reports through the Windows Error Reporting infrastructure. This policy allows you to disable the feature. - -If you enable this policy setting, an error report is not sent when a generic driver is installed. - -If you disable or do not configure this policy setting, an error report is sent when a generic driver is installed. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Do not send a Windows error report when a generic driver is installed on a device* -- GP name: *DeviceInstall_GenericDriverSendToWER* -- GP path: *System\Device Installation* -- GP ADMX file name: *DeviceSetup.admx* - - - -
- - -**ADMX_DeviceSetup/DeviceInstall_RequestAdditionalSoftwareSendToWER** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. Windows has a feature that allows a device driver to request additional software through the Windows Error Reporting infrastructure. This policy allows you to disable the feature. - -If you enable this policy setting, Windows will not send an error report to request additional software even if this is specified by the device driver. - -If you disable or do not configure this policy setting, Windows sends an error report when a device driver that requests additional software is installed. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Prevent Windows from sending an error report when a device driver requests additional software during installation* -- GP name: *DeviceInstall_RequestAdditionalSoftwareSendToWER* -- GP path: *System\Device Installation* -- GP ADMX file name: *DeviceSetup.admx* - - - -
- - -**ADMX_DeviceSetup/DriverSearchPlaces** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User - -
- - - -Available in the latest Windows 10 Insider Preview Build. This setting configures the location that Windows searches for drivers when a new piece of hardware is found. - -By default, Windows searches the following places for drivers: local installation, floppy drives, CD-ROM drives, Windows Update. - -Using this setting, you may remove the floppy and CD-ROM drives from the search algorithm. - -If you enable this setting, you can remove the locations by selecting the associated check box beside the location name. - -If you disable or do not configure this setting, Windows searches the installation location, floppy drives, and CD-ROM drives. - -> [!NOTE] -> To prevent searching Windows Update for drivers also see "Turn off Windows Update device driver searching" in Administrative Templates/System/Internet Communication Management/Internet Communication settings. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Configure driver search locations* -- GP name: *DriverSearchPlaces* -- GP path: *System\Device Installation* -- GP ADMX file name: *DeviceSetup.admx* - - - -
- - -**ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_1** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * User - -
- - - -Available in the latest Windows 10 Insider Preview Build. Specifies whether the administrator will be prompted about going to Windows Update to search for device drivers using the Internet. - -> [!NOTE] -> This setting only has effect if "Turn off Windows Update device driver searching" in "Administrative Templates/System/Internet Communication Management/Internet Communication settings" is disabled or not configured. - -If you enable this setting, administrators will not be prompted to search Windows Update. - -If you disable or do not configure this setting, and "Turn off Windows Update device driver searching" is disabled or not configured, the administrator will be prompted for consent before going to Windows Update to search for device drivers. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Turn off Windows Update device driver search prompt* -- GP name: *DriverSearchPlaces_DontPromptForWindowsUpdate_1* -- GP path: *System\Device Installation* -- GP ADMX file name: *DeviceSetup.admx* - - - -
- - -**ADMX_DeviceSetup/DriverSearchPlaces_DontPromptForWindowsUpdate_2** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. Specifies whether the administrator will be prompted about going to Windows Update to search for device drivers using the Internet. - -> [!NOTE] -> This setting only has effect if "Turn off Windows Update device driver searching" in "Administrative Templates/System/Internet Communication Management/Internet Communication settings" is disabled or not configured. - -If you enable this setting, administrators will not be prompted to search Windows Update. - -If you disable or do not configure this setting, and "Turn off Windows Update device driver searching" is disabled or not configured, the administrator will be prompted for consent before going to Windows Update to search for device drivers. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Turn off Windows Update device driver search prompt* -- GP name: *DriverSearchPlaces_DontPromptForWindowsUpdate_2* -- GP path: *System\Device Installation* -- GP ADMX file name: *DeviceSetup.admx* - - - -
- **ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration** @@ -549,77 +173,6 @@ ADMX Info:
- -**ADMX_DeviceSetup/DriverSearchPlaces_SearchServerConfiguration** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the search server that Windows uses to find updates for device drivers. - -If you enable this policy setting, you can select whether Windows searches Windows Update (WU), searches a Managed Server, or a combination of both. - -Note that if both are specified, then Windows will first search the Managed Server, such as a Windows Server Update Services (WSUS) server. Only if no update is found will Windows then also search Windows Update. - -If you disable or do not configure this policy setting, members of the Administrators group can determine the server used in the search for device drivers. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Specify the search server for device driver updates* -- GP name: *DriverSearchPlaces_SearchServerConfiguration* -- GP path: *System\Device Installation* -- GP ADMX file name: *DeviceSetup.admx* - - - -
- Footnotes: - 1 - Available in Windows 10, version 1607. From 144f8311ad56b1c5e57fdb876307401d6efa8b31 Mon Sep 17 00:00:00 2001 From: Chai Wei Jie Date: Sun, 22 Nov 2020 18:55:02 +0800 Subject: [PATCH 034/169] Update windows-10-poc.md --- windows/deployment/windows-10-poc.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index a956b7fa4b..9d18365b39 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -214,7 +214,7 @@ Starting with Windows 8, the host computer’s microprocessor must support secon 2. The Hyper-V feature is not installed by default. To install it, open an elevated Windows PowerShell window and type the following command: - 
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V –All
+ 
Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All
This command works on all operating systems that support Hyper-V, but on Windows Server operating systems you must type an additional command to add the Hyper-V Windows PowerShell module and the Hyper-V Manager console. This command will also install Hyper-V if it isn't already installed, so if desired you can just type the following command on Windows Server 2012 or 2016 instead of using the Enable-WindowsOptionalFeature command: @@ -542,8 +542,8 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 1. To add available space for the partition, type the following commands at an elevated Windows PowerShell prompt on the Hyper-V host: 
-    Resize-VHD –Path c:\VHD\2012R2-poc-2.vhd –SizeBytes 100GB
-    $x = (Mount-VHD –Path c:\VHD\2012R2-poc-2.vhd -passthru | Get-Disk | Get-Partition | Get-Volume).DriveLetter
+    Resize-VHD -Path c:\VHD\2012R2-poc-2.vhd -SizeBytes 100GB
+    $x = (Mount-VHD -Path c:\VHD\2012R2-poc-2.vhd -passthru | Get-Disk | Get-Partition | Get-Volume).DriveLetter
     Resize-Partition -DriveLetter $x -Size (Get-PartitionSupportedSize -DriveLetter $x).SizeMax
@@ -551,7 +551,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 
     Get-Volume -DriveLetter $x
-    Dismount-VHD –Path c:\VHD\2012R2-poc-2.vhd
+ Dismount-VHD -Path c:\VHD\2012R2-poc-2.vhd ### Configure Hyper-V @@ -712,7 +712,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 
     Rename-Computer DC1
-    New-NetIPAddress –InterfaceAlias Ethernet –IPAddress 192.168.0.1 –PrefixLength 24 -DefaultGateway 192.168.0.2
+    New-NetIPAddress -InterfaceAlias Ethernet -IPAddress 192.168.0.1 -PrefixLength 24 -DefaultGateway 192.168.0.2
     Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 192.168.0.1,192.168.0.2
@@ -749,7 +749,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to netsh dhcp add securitygroups Restart-Service DHCPServer Add-DhcpServerInDC dc1.contoso.com 192.168.0.1 - Set-ItemProperty –Path registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ServerManager\Roles\12 –Name ConfigurationState –Value 2 + Set-ItemProperty -Path registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ServerManager\Roles\12 -Name ConfigurationState -Value 2 10. Next, add a DHCP scope and set option values: @@ -886,7 +886,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 
     Enable-VMIntegrationService -VMName PC1 -Name "Guest Service Interface"
-    Copy-VMFile "PC1" –SourcePath "C:\VHD\pc1.ps1"  –DestinationPath "C:\pc1.ps1" –CreateFullPath –FileSource Host
+    Copy-VMFile "PC1" -SourcePath "C:\VHD\pc1.ps1" -DestinationPath "C:\pc1.ps1" -CreateFullPath -FileSource Host
>In order for this command to work properly, PC1 must be running the vmicguestinterface (Hyper-V Guest Service Interface) service. If this service is not enabled in this step, then the copy-VMFile command will fail. In this case, you can try updating integration services on the VM by mounting the Hyper-V Integration Services Setup (vmguest.iso), which is located in C:\Windows\System32 on Windows Server 2012 and 2012 R2 operating systems that are running the Hyper-V role service. @@ -917,7 +917,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 
     Rename-Computer SRV1
-    New-NetIPAddress –InterfaceAlias Ethernet –IPAddress 192.168.0.2 –PrefixLength 24
+    New-NetIPAddress -InterfaceAlias Ethernet -IPAddress 192.168.0.2 -PrefixLength 24
     Set-DnsClientServerAddress -InterfaceAlias Ethernet -ServerAddresses 192.168.0.1,192.168.0.2
     Restart-Computer
From 7b653935e4bf100e3c31ac18eb1f687f53695bb7 Mon Sep 17 00:00:00 2001 From: Hiroshi Yoshioka <40815708+hyoshioka0128@users.noreply.github.com> Date: Mon, 23 Nov 2020 00:18:46 +0900 Subject: [PATCH 035/169] =?UTF-8?q?Typo=20"**pass@word1**"=E2=86=92"**pass?= =?UTF-8?q?\@word1**"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bold with escape characters https://docs.microsoft.com/en-us/windows/deployment/windows-10-poc-sc-config-mgr --- windows/deployment/windows-10-poc-sc-config-mgr.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index 87baccf225..040e519e97 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -283,7 +283,7 @@ This section contains several procedures to support Zero Touch installation with 3. On the **Network Access Account** tab, choose **Specify the account that accesses network locations**. 4. Click the yellow starburst and then click **New Account**. 5. Click **Browse** and then under **Enter the object name to select**, type **CM_NAA** and click **OK**. -6. Next to **Password** and **Confirm Password**, type **pass@word1**, and then click **OK** twice. +6. Next to **Password** and **Confirm Password**, type **pass\@word1**, and then click **OK** twice. ### Configure a boundary group From 20e961253826447df56cf7c09fe8a46d46242295 Mon Sep 17 00:00:00 2001 From: Hiroshi Yoshioka <40815708+hyoshioka0128@users.noreply.github.com> Date: Tue, 24 Nov 2020 00:05:35 +0900 Subject: [PATCH 036/169] =?UTF-8?q?Typo=20"**pass@word1**"=E2=86=92"**pass?= =?UTF-8?q?\@word1**"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bold with escape characters related #8689 https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager --- .../deploy-windows-10-using-pxe-and-configuration-manager.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md b/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md index a5ea3f78c2..bbc562e930 100644 --- a/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md +++ b/windows/deployment/deploy-windows-cm/deploy-windows-10-using-pxe-and-configuration-manager.md @@ -51,7 +51,7 @@ All server and client computers referenced in this guide are on the same subnet. ## Procedures 1. Start the PC0001 computer. At the Pre-Boot Execution Environment (PXE) boot menu, press **Enter** to allow it to PXE boot. -2. On the **Welcome to the Task Sequence Wizard** page, type in the password **pass@word1** and click **Next**. +2. On the **Welcome to the Task Sequence Wizard** page, type in the password **pass\@word1** and click **Next**. 3. On the **Select a task sequence to run** page, select **Windows 10 Enterprise x64 RTM** and click **Next**. 4. On the **Edit Task Sequence Variables** page, double-click the **OSDComputerName** variable, and in the **Value** field, type **PC0001** and click **OK**. Then click **Next**. 5. The operating system deployment will take several minutes to complete. @@ -99,4 +99,4 @@ Next, see [Refresh a Windows 7 SP1 client with Windows 10 using Configuration Ma [Add drivers to a Windows 10 deployment with Windows PE using Configuration Manager](add-drivers-to-a-windows-10-deployment-with-windows-pe-using-configuration-manager.md)
[Create a task sequence with Configuration Manager and MDT](../deploy-windows-mdt/create-a-task-sequence-with-configuration-manager-and-mdt.md)
[Refresh a Windows 7 SP1 client with Windows 10 using Configuration Manager](refresh-a-windows-7-client-with-windows-10-using-configuration-manager.md)
-[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)
\ No newline at end of file +[Replace a Windows 7 SP1 client with Windows 10 using Configuration Manager](replace-a-windows-7-client-with-windows-10-using-configuration-manager.md)
From 4e6e9cdaa7d939250441c427a5ba8544bf99d371 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 23 Nov 2020 11:21:59 -0800 Subject: [PATCH 037/169] Added EnhancedStorage policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 6 + .../policy-configuration-service-provider.md | 23 + .../mdm/policy-csp-admx-enhancedstorage.md | 476 ++++++++++++++++++ 4 files changed, 506 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-enhancedstorage.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 90fe63842c..f48b6b25c6 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -188,6 +188,7 @@ #### [ADMX_DWM](policy-csp-admx-dwm.md) #### [ADMX_EAIME](policy-csp-admx-eaime.md) #### [ADMX_EncryptFilesonMove](policy-csp-admx-encryptfilesonmove.md) +#### [ADMX_EnhancedStorage](policy-csp-admx-enhancedstorage.md) #### [ADMX_EventForwarding](policy-csp-admx-eventforwarding.md) #### [ADMX_FileServerVSSProvider](policy-csp-admx-fileservervssprovider.md) #### [ADMX_FileSys](policy-csp-admx-filesys.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index fb21f97424..89cd14d38c 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -129,6 +129,12 @@ ms.date: 10/08/2020 - [ADMX_EAIME/L_TurnOnLiveStickers](./policy-csp-admx-eaime.md#admx-eaime-l-turnonlivestickers) - [ADMX_EAIME/L_TurnOnMisconversionLoggingForMisconversionReport](./policy-csp-admx-eaime.md#admx-eaime-l-turnonmisconversionloggingformisconversionreport) - [ADMX_EncryptFilesonMove/NoEncryptOnMove](./policy-csp-admx-encryptfilesonmove.md#admx-encryptfilesonmove-noencryptonmove) +- [ADMX_EnhancedStorage/ApprovedEnStorDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-approvedenstordevices) +- [ADMX_EnhancedStorage/ApprovedSilos](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-approvedsilos) +- [ADMX_EnhancedStorage/DisablePasswordAuthentication](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-disablepasswordauthentication) +- [ADMX_EnhancedStorage/DisallowLegacyDiskDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-disallowlegacydiskdevices) +- [ADMX_EnhancedStorage/LockDeviceOnMachineLock](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-lockdeviceonmachinelock) +- [ADMX_EnhancedStorage/RootHubConnectedEnStorDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-roothubconnectedenstordevices) - [ADMX_EventForwarding/ForwarderResourceUsage](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-forwarderresourceusage) - [ADMX_EventForwarding/SubscriptionManager](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-subscriptionmanager) - [ADMX_FileServerVSSProvider/Pol_EncryptProtocol](./policy-csp-admx-fileservervssprovider.md#admx-fileservervssprovider-pol-encryptprotocol) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 83c2c8ba65..19db657bac 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -569,6 +569,29 @@ The following diagram shows the Policy configuration service provider in tree fo +### ADMX_EnhancedStorage policies + +
+
+ ADMX_EnhancedStorage/ApprovedEnStorDevices +
+
+ ADMX_EnhancedStorage/ApprovedSilos +
+
+ ADMX_EnhancedStorage/DisablePasswordAuthentication +
+
+ ADMX_EnhancedStorage/DisallowLegacyDiskDevices +
+
+ ADMX_EnhancedStorage/LockDeviceOnMachineLock +
+
+ ADMX_EnhancedStorage/RootHubConnectedEnStorDevices +
+
+ ### ADMX_EventForwarding policies
diff --git a/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md new file mode 100644 index 0000000000..4e1cf740ae --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md @@ -0,0 +1,476 @@ +--- +title: Policy CSP - ADMX_EnhancedStorage +description: Policy CSP - ADMX_EnhancedStorage +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/23/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EnhancedStorage +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_EnhancedStorage policies + +
+
+ ADMX_EnhancedStorage/ApprovedEnStorDevices +
+
+ ADMX_EnhancedStorage/ApprovedSilos +
+
+ ADMX_EnhancedStorage/DisablePasswordAuthentication +
+
+ ADMX_EnhancedStorage/DisallowLegacyDiskDevices +
+
+ ADMX_EnhancedStorage/LockDeviceOnMachineLock +
+
+ ADMX_EnhancedStorage/RootHubConnectedEnStorDevices +
+
+ + +
+ + +**ADMX_EnhancedStorage/ApprovedEnStorDevices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure a list of Enhanced Storage devices by manufacturer and product ID that are usable on your computer. + +If you enable this policy setting, only Enhanced Storage devices that contain a manufacturer and product ID specified in this policy are usable on your computer. + +If you disable or do not configure this policy setting, all Enhanced Storage devices are usable on your computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure list of Enhanced Storage devices usable on your computer* +- GP name: *ApprovedEnStorDevices* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
+ + +**ADMX_EnhancedStorage/ApprovedSilos** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to create a list of IEEE 1667 silos, compliant with the Institute of Electrical and Electronics Engineers, Inc. (IEEE) 1667 specification, that are usable on your computer. + +If you enable this policy setting, only IEEE 1667 silos that match a silo type identifier specified in this policy are usable on your computer. + +If you disable or do not configure this policy setting, all IEEE 1667 silos on Enhanced Storage devices are usable on your computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure list of IEEE 1667 silos usable on your computer* +- GP name: *ApprovedSilos* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
+ + +**ADMX_EnhancedStorage/DisablePasswordAuthentication** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures whether or not a password can be used to unlock an Enhanced Storage device. + +If you enable this policy setting, a password cannot be used to unlock an Enhanced Storage device. + +If you disable or do not configure this policy setting, a password can be used to unlock an Enhanced Storage device. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow password authentication of Enhanced Storage devices* +- GP name: *DisablePasswordAuthentication* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
+ + +**ADMX_EnhancedStorage/DisallowLegacyDiskDevices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures whether or not non-Enhanced Storage removable devices are allowed on your computer. + +If you enable this policy setting, non-Enhanced Storage removable devices are not allowed on your computer. + +If you disable or do not configure this policy setting, non-Enhanced Storage removable devices are allowed on your computer. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not allow non-Enhanced Storage removable devices* +- GP name: *DisallowLegacyDiskDevices* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
+ + +**ADMX_EnhancedStorage/LockDeviceOnMachineLock** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting locks Enhanced Storage devices when the computer is locked. + +This policy setting is supported in Windows Server SKUs only. + +If you enable this policy setting, the Enhanced Storage device remains locked when the computer is locked. + +If you disable or do not configure this policy setting, the Enhanced Storage device state is not changed when the computer is locked. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Lock Enhanced Storage when the computer is locked* +- GP name: *LockDeviceOnMachineLock* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
+ + +**ADMX_EnhancedStorage/RootHubConnectedEnStorDevices** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures whether or not only USB root hub connected Enhanced Storage devices are allowed. Allowing only root hub connected Enhanced Storage devices minimizes the risk of an unauthorized USB device reading data on an Enhanced Storage device. + +If you enable this policy setting, only USB root hub connected Enhanced Storage devices are allowed. + +If you disable or do not configure this policy setting, USB Enhanced Storage devices connected to both USB root hubs and non-root hubs will be allowed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow only USB root hub connected Enhanced Storage devices* +- GP name: *RootHubConnectedEnStorDevices* +- GP path: *System\Enhanced Storage Access* +- GP ADMX file name: *EnhancedStorage.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From 0994f74a6ec435bd52e4043d30c2718dccd5b187 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 23 Nov 2020 16:32:24 -0800 Subject: [PATCH 038/169] Added ErrorReporting policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 29 + .../policy-configuration-service-provider.md | 92 + .../mdm/policy-csp-admx-errorreporting.md | 2202 +++++++++++++++++ 4 files changed, 2324 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-errorreporting.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index f48b6b25c6..559f7b27a5 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -189,6 +189,7 @@ #### [ADMX_EAIME](policy-csp-admx-eaime.md) #### [ADMX_EncryptFilesonMove](policy-csp-admx-encryptfilesonmove.md) #### [ADMX_EnhancedStorage](policy-csp-admx-enhancedstorage.md) +#### [ADMX_ErrorReporting](policy-csp-admx-errorreporting.md) #### [ADMX_EventForwarding](policy-csp-admx-eventforwarding.md) #### [ADMX_FileServerVSSProvider](policy-csp-admx-fileservervssprovider.md) #### [ADMX_FileSys](policy-csp-admx-filesys.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 89cd14d38c..4d5d2f3728 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -135,6 +135,35 @@ ms.date: 10/08/2020 - [ADMX_EnhancedStorage/DisallowLegacyDiskDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-disallowlegacydiskdevices) - [ADMX_EnhancedStorage/LockDeviceOnMachineLock](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-lockdeviceonmachinelock) - [ADMX_EnhancedStorage/RootHubConnectedEnStorDevices](./policy-csp-admx-enhancedstorage.md#admx-enhancedstorage-roothubconnectedenstordevices) +- [ADMX_ErrorReporting/PCH_AllOrNoneDef](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornonedef) +- [ADMX_ErrorReporting/PCH_AllOrNoneEx](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornoneex) +- [ADMX_ErrorReporting/PCH_AllOrNoneInc](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-allornoneinc) +- [ADMX_ErrorReporting/PCH_ConfigureReport](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-configurereport) +- [ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults](./policy-csp-admx-errorreporting.md#admx-errorreporting-pch-reportoperatingsystemfaults) +- [ADMX_ErrorReporting/WerArchive_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werarchive-1) +- [ADMX_ErrorReporting/WerArchive_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werarchive-2) +- [ADMX_ErrorReporting/WerAutoApproveOSDumps_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werautoapproveosdumps-1) +- [ADMX_ErrorReporting/WerAutoApproveOSDumps_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werautoapproveosdumps-2) +- [ADMX_ErrorReporting/WerBypassDataThrottling_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassdatathrottling-1) +- [ADMX_ErrorReporting/WerBypassDataThrottling_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassdatathrottling-2) +- [ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassnetworkcostthrottling-1) +- [ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypassnetworkcostthrottling-2) +- [ADMX_ErrorReporting/WerBypassPowerThrottling_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypasspowerthrottling-1) +- [ADMX_ErrorReporting/WerBypassPowerThrottling_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werbypasspowerthrottling-2) +- [ADMX_ErrorReporting/WerCER](./policy-csp-admx-errorreporting.md#admx-errorreporting-wercer) +- [ADMX_ErrorReporting/WerConsentCustomize_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentcustomize-1) +- [ADMX_ErrorReporting/WerConsentOverride_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentoverride-1) +- [ADMX_ErrorReporting/WerConsentOverride_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werconsentoverride-2) +- [ADMX_ErrorReporting/WerDefaultConsent_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werdefaultconsent-1) +- [ADMX_ErrorReporting/WerDefaultConsent_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werdefaultconsent-2) +- [ADMX_ErrorReporting/WerDisable_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werdisable-1) +- [ADMX_ErrorReporting/WerExlusion_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werexlusion-1) +- [ADMX_ErrorReporting/WerExlusion_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werexlusion-2) +- [ADMX_ErrorReporting/WerNoLogging_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-wernologging-1) +- [ADMX_ErrorReporting/WerNoLogging_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-wernologging-2) +- [ADMX_ErrorReporting/WerNoSecondLevelData_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-wernosecondleveldata-1) +- [ADMX_ErrorReporting/WerQueue_1](./policy-csp-admx-errorreporting.md#admx-errorreporting-werqueue-1) +- [ADMX_ErrorReporting/WerQueue_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werqueue-2) - [ADMX_EventForwarding/ForwarderResourceUsage](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-forwarderresourceusage) - [ADMX_EventForwarding/SubscriptionManager](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-subscriptionmanager) - [ADMX_FileServerVSSProvider/Pol_EncryptProtocol](./policy-csp-admx-fileservervssprovider.md#admx-fileservervssprovider-pol-encryptprotocol) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 19db657bac..9a2bc98925 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -592,6 +592,98 @@ The following diagram shows the Policy configuration service provider in tree fo
+### ADMX_ErrorReporting policies + +
+
+ ADMX_ErrorReporting/PCH_AllOrNoneDef +
+
+ ADMX_ErrorReporting/PCH_AllOrNoneEx +
+
+ ADMX_ErrorReporting/PCH_AllOrNoneInc +
+
+ ADMX_ErrorReporting/PCH_ConfigureReport +
+
+ ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults +
+
+ ADMX_ErrorReporting/WerArchive_1 +
+
+ ADMX_ErrorReporting/WerArchive_2 +
+
+ ADMX_ErrorReporting/WerAutoApproveOSDumps_1 +
+
+ ADMX_ErrorReporting/WerAutoApproveOSDumps_2 +
+
+ ADMX_ErrorReporting/WerBypassDataThrottling_1 +
+
+ ADMX_ErrorReporting/WerBypassDataThrottling_2 +
+
+ ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1 +
+
+ ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2 +
+
+ ADMX_ErrorReporting/WerBypassPowerThrottling_1 +
+
+ ADMX_ErrorReporting/WerBypassPowerThrottling_2 +
+
+ ADMX_ErrorReporting/WerCER +
+
+ ADMX_ErrorReporting/WerConsentCustomize_1 +
+
+ ADMX_ErrorReporting/WerConsentOverride_1 +
+
+ ADMX_ErrorReporting/WerConsentOverride_2 +
+
+ ADMX_ErrorReporting/WerDefaultConsent_1 +
+
+ ADMX_ErrorReporting/WerDefaultConsent_2 +
+
+ ADMX_ErrorReporting/WerDisable_1 +
+
+ ADMX_ErrorReporting/WerExlusion_1 +
+
+ ADMX_ErrorReporting/WerExlusion_2 +
+
+ ADMX_ErrorReporting/WerNoLogging_1 +
+
+ ADMX_ErrorReporting/WerNoLogging_2 +
+
+ ADMX_ErrorReporting/WerNoSecondLevelData_1 +
+
+ ADMX_ErrorReporting/WerQueue_1 +
+
+ ADMX_ErrorReporting/WerQueue_2 +
+
+ ### ADMX_EventForwarding policies
diff --git a/windows/client-management/mdm/policy-csp-admx-errorreporting.md b/windows/client-management/mdm/policy-csp-admx-errorreporting.md new file mode 100644 index 0000000000..5b37b35bbd --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-errorreporting.md @@ -0,0 +1,2202 @@ +--- +title: Policy CSP - ADMX_ErrorReporting +description: Policy CSP - ADMX_ErrorReporting +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 11/23/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_ErrorReporting +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_ErrorReporting policies + +
+
+ ADMX_ErrorReporting/PCH_AllOrNoneDef +
+
+ ADMX_ErrorReporting/PCH_AllOrNoneEx +
+
+ ADMX_ErrorReporting/PCH_AllOrNoneInc +
+
+ ADMX_ErrorReporting/PCH_ConfigureReport +
+
+ ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults +
+
+ ADMX_ErrorReporting/WerArchive_1 +
+
+ ADMX_ErrorReporting/WerArchive_2 +
+
+ ADMX_ErrorReporting/WerAutoApproveOSDumps_1 +
+
+ ADMX_ErrorReporting/WerAutoApproveOSDumps_2 +
+
+ ADMX_ErrorReporting/WerBypassDataThrottling_1 +
+
+ ADMX_ErrorReporting/WerBypassDataThrottling_2 +
+
+ ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1 +
+
+ ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2 +
+
+ ADMX_ErrorReporting/WerBypassPowerThrottling_1 +
+
+ ADMX_ErrorReporting/WerBypassPowerThrottling_2 +
+
+ ADMX_ErrorReporting/WerCER +
+
+ ADMX_ErrorReporting/WerConsentCustomize_1 +
+
+ ADMX_ErrorReporting/WerConsentOverride_1 +
+
+ ADMX_ErrorReporting/WerConsentOverride_2 +
+
+ ADMX_ErrorReporting/WerDefaultConsent_1 +
+
+ ADMX_ErrorReporting/WerDefaultConsent_2 +
+
+ ADMX_ErrorReporting/WerDisable_1 +
+
+ ADMX_ErrorReporting/WerExlusion_1 +
+
+ ADMX_ErrorReporting/WerExlusion_2 +
+
+ ADMX_ErrorReporting/WerNoLogging_1 +
+
+ ADMX_ErrorReporting/WerNoLogging_2 +
+
+ ADMX_ErrorReporting/WerNoSecondLevelData_1 +
+
+ ADMX_ErrorReporting/WerQueue_1 +
+
+ ADMX_ErrorReporting/WerQueue_2 +
+
+ + +
+ + +**ADMX_ErrorReporting/PCH_AllOrNoneDef** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether errors in general applications are included in reports when Windows Error Reporting is enabled. + +If you enable this policy setting, you can instruct Windows Error Reporting in the Default pull-down menu to report either all application errors (the default setting), or no application errors. + +If the Report all errors in Microsoft applications check box is filled, all errors in Microsoft applications are reported, regardless of the setting in the Default pull-down menu. When the Report all errors in Windows check box is filled, all errors in Windows applications are reported, regardless of the setting in the Default dropdown list. The Windows applications category is a subset of Microsoft applications. + +If you disable or do not configure this policy setting, users can enable or disable Windows Error Reporting in Control Panel. The default setting in Control Panel is Upload all applications. + +This policy setting is ignored if the Configure Error Reporting policy setting is disabled or not configured. + +For related information, see the Configure Error Reporting and Report Operating System Errors policy settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Default application reporting settings* +- GP name: *PCH_AllOrNoneDef* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/PCH_AllOrNoneEx** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on. + +If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show under the Exclude errors for applications on this list setting, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. Errors that are generated by applications in this list are not reported, even if the Default Application Reporting Settings policy setting is configured to report all application errors. + +If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. If an application is listed both in the List of applications to always report errors for policy setting, and in the exclusion list in this policy setting, the application is excluded from error reporting. You can also use the exclusion list in this policy setting to exclude specific Microsoft applications or parts of Windows if the check boxes for these categories are filled in the Default application reporting settings policy setting. + +If you disable or do not configure this policy setting, the Default application reporting settings policy setting takes precedence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List of applications to never report errors for* +- GP name: *PCH_AllOrNoneEx* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/PCH_AllOrNoneInc** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies applications for which Windows Error Reporting should always report errors. + +To create a list of applications for which Windows Error Reporting never reports errors, click Show under the Exclude errors for applications on this list setting, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). Errors that are generated by applications in this list are not reported, even if the Default Application Reporting Settings policy setting is configured to report all application errors. + +If you enable this policy setting, you can create a list of applications that are always included in error reporting. To add applications to the list, click Show under the Report errors for applications on this list setting, and edit the list of application file names in the Show Contents dialog box. The file names must include the .exe file name extension (for example, notepad.exe). Errors that are generated by applications on this list are always reported, even if the Default dropdown in the Default application reporting policy setting is set to report no application errors. + +If the Report all errors in Microsoft applications or Report all errors in Windows components check boxes in the Default Application Reporting policy setting are filled, Windows Error Reporting reports errors as if all applications in these categories were added to the list in this policy setting. (Note: The Microsoft applications category includes the Windows components category.) + +If you disable this policy setting or do not configure it, the Default application reporting settings policy setting takes precedence. + +Also see the "Default Application Reporting" and "Application Exclusion List" policies. + +This setting will be ignored if the 'Configure Error Reporting' setting is disabled or not configured. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List of applications to always report errors for* +- GP name: *PCH_AllOrNoneInc* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/PCH_ConfigureReport** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting configures how errors are reported to Microsoft, and what information is sent when Windows Error Reporting is enabled. + +This policy setting does not enable or disable Windows Error Reporting. To turn Windows Error Reporting on or off, see the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings. + +> [!IMPORTANT] +> If the Turn off Windows Error Reporting policy setting is not configured, then Control Panel settings for Windows Error Reporting override this policy setting. + +If you enable this policy setting, the setting overrides any user changes made to Windows Error Reporting settings in Control Panel, and default values are applied for any Windows Error Reporting policy settings that are not configured (even if users have changed settings by using Control Panel). If you enable this policy setting, you can configure the following settings in the policy setting: + +- "Do not display links to any Microsoft ‘More information’ websites": Select this option if you do not want error dialog boxes to display links to Microsoft websites. + +- "Do not collect additional files": Select this option if you do not want additional files to be collected and included in error reports. + +- "Do not collect additional computer data": Select this if you do not want additional information about the computer to be collected and included in error reports. + +- "Force queue mode for application errors": Select this option if you do not want users to report errors. When this option is selected, errors are stored in a queue directory, and the next administrator to log on to the computer can send the error reports to Microsoft. + +- "Corporate file path": Type a UNC path to enable Corporate Error Reporting. All errors are stored at the specified location instead of being sent directly to Microsoft, and the next administrator to log onto the computer can send the error reports to Microsoft. + +- "Replace instances of the word ‘Microsoft’ with": You can specify text with which to customize your error report dialog boxes. The word ""Microsoft"" is replaced with the specified text. + +If you do not configure this policy setting, users can change Windows Error Reporting settings in Control Panel. By default, these settings are Enable Reporting on computers that are running Windows XP, and Report to Queue on computers that are running Windows Server 2003. + +If you disable this policy setting, configuration settings in the policy setting are left blank. + +See related policy settings Display Error Notification (same folder as this policy setting), and Turn off Windows Error Reporting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Error Reporting* +- GP name: *PCH_ConfigureReport* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether errors in the operating system are included Windows Error Reporting is enabled. + +If you enable this policy setting, Windows Error Reporting includes operating system errors. + +If you disable this policy setting, operating system errors are not included in error reports. + +If you do not configure this policy setting, users can change this setting in Control Panel. By default, Windows Error Reporting settings in Control Panel are set to upload operating system errors. + +See also the Configure Error Reporting policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Report operating system errors* +- GP name: *PCH_ReportOperatingSystemFaults* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerArchive_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the behavior of the Windows Error Reporting archive. + +If you enable this policy setting, you can configure Windows Error Reporting archiving behavior. If Archive behavior is set to Store all, all data collected for each error report is stored in the appropriate location. If Archive behavior is set to Store parameters only, only the minimum information required to check for an existing solution is stored. The Maximum number of reports to store setting determines how many reports are stored before older reports are automatically deleted. + +If you disable or do not configure this policy setting, no Windows Error Reporting information is stored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Report Archive* +- GP name: *WerArchive_1* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerArchive_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the behavior of the Windows Error Reporting archive. + +If you enable this policy setting, you can configure Windows Error Reporting archiving behavior. If Archive behavior is set to Store all, all data collected for each error report is stored in the appropriate location. If Archive behavior is set to Store parameters only, only the minimum information required to check for an existing solution is stored. The Maximum number of reports to store setting determines how many reports are stored before older reports are automatically deleted. + +If you disable or do not configure this policy setting, no Windows Error Reporting information is stored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Report Archive* +- GP name: *WerArchive_2* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerAutoApproveOSDumps_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether memory dumps in support of OS-generated error reports can be sent to Microsoft automatically. This policy does not apply to error reports generated by 3rd-party products, or additional data other than memory dumps. + +If you enable or do not configure this policy setting, any memory dumps generated for error reports by Microsoft Windows are automatically uploaded, without notification to the user. + +If you disable this policy setting, then all memory dumps are uploaded according to the default consent and notification settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Automatically send memory dumps for OS-generated error reports* +- GP name: *WerAutoApproveOSDumps_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerAutoApproveOSDumps_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether memory dumps in support of OS-generated error reports can be sent to Microsoft automatically. This policy does not apply to error reports generated by 3rd-party products, or additional data other than memory dumps. + +If you enable or do not configure this policy setting, any memory dumps generated for error reports by Microsoft Windows are automatically uploaded, without notification to the user. + +If you disable this policy setting, then all memory dumps are uploaded according to the default consent and notification settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Automatically send memory dumps for OS-generated error reports* +- GP name: *WerAutoApproveOSDumps_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerBypassDataThrottling_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) sends additional, second-level report data even if a CAB file containing data about the same event types has already been uploaded to the server. + +If you enable this policy setting, WER does not throttle data; that is, WER uploads additional CAB files that can contain data about the same event types as an earlier uploaded report. + +If you disable or do not configure this policy setting, WER throttles data by default; that is, WER does not upload more than one CAB file for a report that contains data about the same event types. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not throttle additional data* +- GP name: *WerBypassDataThrottling_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerBypassDataThrottling_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) sends additional, second-level report data even if a CAB file containing data about the same event types has already been uploaded to the server. + +If you enable this policy setting, WER does not throttle data; that is, WER uploads additional CAB files that can contain data about the same event types as an earlier uploaded report. + +If you disable or do not configure this policy setting, WER throttles data by default; that is, WER does not upload more than one CAB file for a report that contains data about the same event types. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not throttle additional data* +- GP name: *WerBypassDataThrottling_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) checks for a network cost policy that restricts the amount of data that is sent over the network. + +If you enable this policy setting, WER does not check for network cost policy restrictions, and transmits data even if network cost is restricted. + +If you disable or do not configure this policy setting, WER does not send data, but will check the network cost policy again if the network profile is changed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send data when on connected to a restricted/costed network* +- GP name: *WerBypassNetworkCostThrottling_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) checks for a network cost policy that restricts the amount of data that is sent over the network. + +If you enable this policy setting, WER does not check for network cost policy restrictions, and transmits data even if network cost is restricted. + +If you disable or do not configure this policy setting, WER does not send data, but will check the network cost policy again if the network profile is changed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send data when on connected to a restricted/costed network* +- GP name: *WerBypassNetworkCostThrottling_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerBypassPowerThrottling_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) checks if the computer is running on battery power. By default, when a computer is running on battery power, WER only checks for solutions, but does not upload additional report data until the computer is connected to a more permanent power source. + +If you enable this policy setting, WER does not determine whether the computer is running on battery power, but checks for solutions and uploads report data normally. + +If you disable or do not configure this policy setting, WER checks for solutions while a computer is running on battery power, but does not upload report data until the computer is connected to a more permanent power source. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send additional data when on battery power* +- GP name: *WerBypassPowerThrottling_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerBypassPowerThrottling_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines whether Windows Error Reporting (WER) checks if the computer is running on battery power. By default, when a computer is running on battery power, WER only checks for solutions, but does not upload additional report data until the computer is connected to a more permanent power source. + +If you enable this policy setting, WER does not determine whether the computer is running on battery power, but checks for solutions and uploads report data normally. + +If you disable or do not configure this policy setting, WER checks for solutions while a computer is running on battery power, but does not upload report data until the computer is connected to a more permanent power source. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Send additional data when on battery power* +- GP name: *WerBypassPowerThrottling_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerCER** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies a corporate server to which Windows Error Reporting sends reports (if you do not want to send error reports to Microsoft). + +If you enable this policy setting, you can specify the name or IP address of an error report destination server on your organization’s network. You can also select Connect using SSL to transmit error reports over a Secure Sockets Layer (SSL) connection, and specify a port number on the destination server for transmission. + +If you disable or do not configure this policy setting, Windows Error Reporting sends error reports to Microsoft. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Corporate Windows Error Reporting* +- GP name: *WerCER* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerConsentCustomize_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the consent behavior of Windows Error Reporting for specific event types. + +If you enable this policy setting, you can add specific event types to a list by clicking Show, and typing event types in the Value Name column of the Show Contents dialog box. Event types are those for generic, non-fatal errors: crash, no response, and kernel fault errors. For each specified event type, you can set a consent level of 0, 1, 2, 3, or 4. + +- 0 (Disable): Windows Error Reporting sends no data to Microsoft for this event type. + +- 1 (Always ask before sending data): Windows prompts the user for consent to send reports. + +- 2 (Send parameters): Windows Error Reporting automatically sends the minimum data required to check for an existing solution, and Windows prompts the user for consent to send any additional data requested by Microsoft. + +- 3 (Send parameters and safe additional data): Windows Error Reporting automatically sends the minimum data required to check for an existing solution, as well as data which Windows has determined (within a high probability) does not contain personally identifiable data, and prompts the user for consent to send any additional data requested by Microsoft. + +- 4 (Send all data): Any data requested by Microsoft is sent automatically. + +If you disable or do not configure this policy setting, then the default consent settings that are applied are those specified by the user in Control Panel, or in the Configure Default Consent policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Customize consent settings* +- GP name: *WerConsentCustomize_1* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerConsentOverride_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of the Configure Default Consent setting in relation to custom consent settings. + +If you enable this policy setting, the default consent levels of Windows Error Reporting always override any other consent policy setting. + +If you disable or do not configure this policy setting, custom consent policy settings for error reporting determine the consent level for specified event types, and the default consent setting determines only the consent level of any other error reports. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ignore custom consent settings* +- GP name: *WerConsentOverride_1* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerConsentOverride_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of the Configure Default Consent setting in relation to custom consent settings. + +If you enable this policy setting, the default consent levels of Windows Error Reporting always override any other consent policy setting. + +If you disable or do not configure this policy setting, custom consent policy settings for error reporting determine the consent level for specified event types, and the default consent setting determines only the consent level of any other error reports. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Ignore custom consent settings* +- GP name: *WerConsentOverride_2* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerDefaultConsent_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the default consent behavior of Windows Error Reporting. + +If you enable this policy setting, you can set the default consent handling for error reports. The following list describes the Consent level settings that are available in the pull-down menu in this policy setting: + +- Always ask before sending data: Windows prompts users for consent to send reports. + +- Send parameters: Only the minimum data that is required to check for an existing solution is sent automatically, and Windows prompts users for consent to send any additional data that is requested by Microsoft. + +- Send parameters and safe additional data: the minimum data that is required to check for an existing solution, along with data which Windows has determined (within a high probability) does not contain personally-identifiable information is sent automatically, and Windows prompts the user for consent to send any additional data that is requested by Microsoft. + +- Send all data: any error reporting data requested by Microsoft is sent automatically. + +If this policy setting is disabled or not configured, then the consent level defaults to the highest-privacy setting: Always ask before sending data. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Default consent* +- GP name: *WerDefaultConsent_1* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerDefaultConsent_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the default consent behavior of Windows Error Reporting. + +If you enable this policy setting, you can set the default consent handling for error reports. The following list describes the Consent level settings that are available in the pull-down menu in this policy setting: + +- Always ask before sending data: Windows prompts users for consent to send reports. + +- Send parameters: Only the minimum data that is required to check for an existing solution is sent automatically, and Windows prompts users for consent to send any additional data that is requested by Microsoft. + +- Send parameters and safe additional data: the minimum data that is required to check for an existing solution, along with data which Windows has determined (within a high probability) does not contain personally-identifiable information is sent automatically, and Windows prompts the user for consent to send any additional data that is requested by Microsoft. + +- Send all data: any error reporting data requested by Microsoft is sent automatically. + +If this policy setting is disabled or not configured, then the consent level defaults to the highest-privacy setting: Always ask before sending data. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Default consent* +- GP name: *WerDefaultConsent_2* +- GP path: *Windows Components\Windows Error Reporting\Consent* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerDisable_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns off Windows Error Reporting, so that reports are not collected or sent to either Microsoft or internal servers within your organization when software unexpectedly stops working or fails. + +If you enable this policy setting, Windows Error Reporting does not send any problem information to Microsoft. Additionally, solution information is not available in Security and Maintenance in Control Panel. + +If you disable or do not configure this policy setting, the Turn off Windows Error Reporting policy setting in Computer Configuration/Administrative Templates/System/Internet Communication Management/Internet Communication settings takes precedence. If Turn off Windows Error Reporting is also either disabled or not configured, user settings in Control Panel for Windows Error Reporting are applied. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable Windows Error Reporting* +- GP name: *WerDisable_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerExlusion_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on. + +If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE. If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. + +If you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default. + + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List of applications to be excluded* +- GP name: *WerExlusion_1* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerExlusion_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting limits Windows Error Reporting behavior for errors in general applications when Windows Error Reporting is turned on. + +If you enable this policy setting, you can create a list of applications that are never included in error reports. To create a list of applications for which Windows Error Reporting never reports errors, click Show, and then add or remove applications from the list of application file names in the Show Contents dialog box (example: notepad.exe). File names must always include the .exe file name extension. To remove an application from the list, click the name, and then press DELETE. If this policy setting is enabled, the Exclude errors for applications on this list setting takes precedence. + +If you disable or do not configure this policy setting, errors are reported on all Microsoft and Windows applications by default. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *List of applications to be excluded* +- GP name: *WerExlusion_2* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerNoLogging_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether Windows Error Reporting saves its own events and error messages to the system event log. + +If you enable this policy setting, Windows Error Reporting events are not recorded in the system event log. + +If you disable or do not configure this policy setting, Windows Error Reporting events and errors are logged to the system event log, as with other Windows-based programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable logging* +- GP name: *WerNoLogging_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerNoLogging_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether Windows Error Reporting saves its own events and error messages to the system event log. + +If you enable this policy setting, Windows Error Reporting events are not recorded in the system event log. + +If you disable or do not configure this policy setting, Windows Error Reporting events and errors are logged to the system event log, as with other Windows-based programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable logging* +- GP name: *WerNoLogging_2* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerNoSecondLevelData_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether additional data in support of error reports can be sent to Microsoft automatically. + +If you enable this policy setting, any additional data requests from Microsoft in response to a Windows Error Reporting report are automatically declined, without notification to the user. + +If you disable or do not configure this policy setting, then consent policy settings in Computer Configuration/Administrative Templates/Windows Components/Windows Error Reporting/Consent take precedence. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not send additional data* +- GP name: *WerNoSecondLevelData_1* +- GP path: *Windows Components\Windows Error Reporting* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerQueue_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of the Windows Error Reporting report queue. + +If you enable this policy setting, you can configure report queue behavior by using the controls in the policy setting. When the Queuing behavior pull-down list is set to Default, Windows determines, when a problem occurs, whether the report should be placed in the reporting queue, or the user should be prompted to send it immediately. When Queuing behavior is set to Always queue, all reports are added to the queue until the user is prompted to send the reports, or until the user sends problem reports by using the Solutions to Problems page in Control Panel. + +The Maximum number of reports to queue setting determines how many reports can be queued before older reports are automatically deleted. The setting for Number of days between solution check reminders determines the interval time between the display of system notifications that remind the user to check for solutions to problems. A value of 0 disables the reminder. + +If you disable or do not configure this policy setting, Windows Error Reporting reports are not queued, and users can only send reports at the time that a problem occurs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Report Queue* +- GP name: *WerQueue_1* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ + +**ADMX_ErrorReporting/WerQueue_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting determines the behavior of the Windows Error Reporting report queue. + +If you enable this policy setting, you can configure report queue behavior by using the controls in the policy setting. When the Queuing behavior pull-down list is set to Default, Windows determines, when a problem occurs, whether the report should be placed in the reporting queue, or the user should be prompted to send it immediately. When Queuing behavior is set to Always queue, all reports are added to the queue until the user is prompted to send the reports, or until the user sends problem reports by using the Solutions to Problems page in Control Panel. If Queuing behavior is set to Always queue for administrator, reports are queued until an administrator is prompted to send them, or until the administrator sends them by using the Solutions to Problems page in Control Panel. + +The Maximum number of reports to queue setting determines how many reports can be queued before older reports are automatically deleted. The setting for Number of days between solution check reminders determines the interval time between the display of system notifications that remind the user to check for solutions to problems. A value of 0 disables the reminder. + +If you disable or do not configure this policy setting, Windows Error Reporting reports are not queued, and users can only send reports at the time that a problem occurs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure Report Queue* +- GP name: *WerQueue_2* +- GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* +- GP ADMX file name: *ErrorReporting.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From bd72e91c53680ab17b9443e579760e4333f4af45 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 23 Nov 2020 16:39:28 -0800 Subject: [PATCH 039/169] Fixed build warning --- .../mdm/policy-csp-admx-errorreporting.md | 58 +++++++++---------- 1 file changed, 29 insertions(+), 29 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-errorreporting.md b/windows/client-management/mdm/policy-csp-admx-errorreporting.md index 5b37b35bbd..1cad07a317 100644 --- a/windows/client-management/mdm/policy-csp-admx-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-admx-errorreporting.md @@ -115,7 +115,7 @@ manager: dansimp
-**ADMX_ErrorReporting/PCH_AllOrNoneDef** +**ADMX_ErrorReporting/PCH_AllOrNoneDef** @@ -190,7 +190,7 @@ ADMX Info:
-**ADMX_ErrorReporting/PCH_AllOrNoneEx** +**ADMX_ErrorReporting/PCH_AllOrNoneEx**
@@ -261,7 +261,7 @@ ADMX Info:
-**ADMX_ErrorReporting/PCH_AllOrNoneInc** +**ADMX_ErrorReporting/PCH_AllOrNoneInc**
@@ -338,7 +338,7 @@ ADMX Info:
-**ADMX_ErrorReporting/PCH_ConfigureReport** +**ADMX_ErrorReporting/PCH_ConfigureReport**
@@ -428,7 +428,7 @@ ADMX Info:
-**ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults** +**ADMX_ErrorReporting/PCH_ReportOperatingSystemFaults**
@@ -501,7 +501,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerArchive_1** +**ADMX_ErrorReporting/WerArchive_1**
@@ -570,7 +570,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerArchive_2** +**ADMX_ErrorReporting/WerArchive_2**
@@ -639,7 +639,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerAutoApproveOSDumps_1** +**ADMX_ErrorReporting/WerAutoApproveOSDumps_1**
@@ -708,7 +708,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerAutoApproveOSDumps_2** +**ADMX_ErrorReporting/WerAutoApproveOSDumps_2**
@@ -777,7 +777,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerBypassDataThrottling_1** +**ADMX_ErrorReporting/WerBypassDataThrottling_1**
@@ -846,7 +846,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerBypassDataThrottling_2** +**ADMX_ErrorReporting/WerBypassDataThrottling_2**
@@ -915,7 +915,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1** +**ADMX_ErrorReporting/WerBypassNetworkCostThrottling_1**
@@ -984,7 +984,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2** +**ADMX_ErrorReporting/WerBypassNetworkCostThrottling_2**
@@ -1053,7 +1053,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerBypassPowerThrottling_1** +**ADMX_ErrorReporting/WerBypassPowerThrottling_1**
@@ -1122,7 +1122,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerBypassPowerThrottling_2** +**ADMX_ErrorReporting/WerBypassPowerThrottling_2**
@@ -1191,7 +1191,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerCER** +**ADMX_ErrorReporting/WerCER**
@@ -1260,7 +1260,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerConsentCustomize_1** +**ADMX_ErrorReporting/WerConsentCustomize_1**
@@ -1339,7 +1339,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerConsentOverride_1** +**ADMX_ErrorReporting/WerConsentOverride_1**
@@ -1408,7 +1408,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerConsentOverride_2** +**ADMX_ErrorReporting/WerConsentOverride_2**
@@ -1477,7 +1477,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerDefaultConsent_1** +**ADMX_ErrorReporting/WerDefaultConsent_1**
@@ -1554,7 +1554,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerDefaultConsent_2** +**ADMX_ErrorReporting/WerDefaultConsent_2**
@@ -1631,7 +1631,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerDisable_1** +**ADMX_ErrorReporting/WerDisable_1**
@@ -1700,7 +1700,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerExlusion_1** +**ADMX_ErrorReporting/WerExlusion_1**
@@ -1770,7 +1770,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerExlusion_2** +**ADMX_ErrorReporting/WerExlusion_2**
@@ -1839,7 +1839,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerNoLogging_1** +**ADMX_ErrorReporting/WerNoLogging_1**
@@ -1908,7 +1908,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerNoLogging_2** +**ADMX_ErrorReporting/WerNoLogging_2**
@@ -1977,7 +1977,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerNoSecondLevelData_1** +**ADMX_ErrorReporting/WerNoSecondLevelData_1**
@@ -2046,7 +2046,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerQueue_1** +**ADMX_ErrorReporting/WerQueue_1**
@@ -2117,7 +2117,7 @@ ADMX Info:
-**ADMX_ErrorReporting/WerQueue_2** +**ADMX_ErrorReporting/WerQueue_2**
From 82609ee37dc9717083f5188d3aa24d791e389058 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 23 Nov 2020 16:45:10 -0800 Subject: [PATCH 040/169] Updated the scope of a policy --- windows/client-management/mdm/policy-csp-admx-errorreporting.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-admx-errorreporting.md b/windows/client-management/mdm/policy-csp-admx-errorreporting.md index 1cad07a317..a220ae0692 100644 --- a/windows/client-management/mdm/policy-csp-admx-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-admx-errorreporting.md @@ -1159,7 +1159,7 @@ ADMX Info: [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] -> * User +> * Device
From 0ddd0680a8d51c6585cd7c50895068e37e229292 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Fri, 27 Nov 2020 22:58:34 +0500 Subject: [PATCH 041/169] Update windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../hello-for-business/hello-feature-pin-reset.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 563ff883be..635c9794d1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -75,7 +75,7 @@ You configure Windows 10 to use the Microsoft PIN Reset service using the comput > [!NOTE] > You can also setup PIN recovery using configuration profiles. > 1. Sign in to Endpoint Manager. -> 2. Click **Devices** -> **Configuration Profiles** -> Create new profile or edit an existing profile using the Identity Protection profile type. +> 2. Click **Devices** -> **Configuration Profiles** -> Create a new profile or edit an existing profile using the Identity Protection profile type. > 3. Set **Enable PIN recovery** to **Yes**. #### Assign the PIN Reset Device configuration profile using Microsoft Intune From 51b02368410101d8d2d6b473cfbfc70a8f1ca539 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 1 Dec 2020 17:39:21 +0500 Subject: [PATCH 042/169] Update hello-hybrid-aadj-sso-cert.md --- .../hello-hybrid-aadj-sso-cert.md | 78 +++++++++---------- 1 file changed, 35 insertions(+), 43 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 1df6239643..fd03a08fc9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -532,15 +532,12 @@ The Intune Certificate Connector application enables Microsoft Intune to enroll ### Download Intune Certificate Connector Sign-in a workstation with access equivalent to a _domain user_. -1. Sign-in to the [Azure Portal](https://portal.azure.com/). -2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. -![Microsoft Intune Console](images/aadjcert/microsoftintuneconsole.png) -3. Select **Device Configuration**, and then select **Certificate Connectors**. -![Intune Certificate Authority](images/aadjcert/intunedeviceconfigurationcertauthority.png) -4. Click **Add**, and then click **Download the certificate connector software** under the **Steps to install connector for SCEP** section. -![Intune Download Certificate connector](images/aadjcert/intunedownloadcertconnector.png) -5. Save the downloaded file (NDESConnectorSetup.exe) to a location accessible from the NDES server. -6. Sign-out of the Azure Portal. +1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). +2. Select **Tenant administration** > **Connectors and tokens** > **Certificate connectors** > **Add**. +3. Click **Download the certificate connector software** under the **Install Certificate Connectors** section. +![Intune Certificate Authority](images/aadjcert/profile01.png) +4. Save the downloaded file (NDESConnectorSetup.exe) to a location accessible from the NDES server. +5. Sign-out of the Microsoft Endpoint Manager admin center. ### Install the Intune Certificate Connector Sign-in the NDES server with access equivalent to _domain administrator_. @@ -639,47 +636,42 @@ Sign-in a workstation with access equivalent to a _domain user_. ### Create a SCEP Certificate Profile Sign-in a workstation with access equivalent to a _domain user_. -1. Sign-in to the [Azure Portal](https://portal.azure.com/). -2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. -3. Select **Device Configuration**, and then click **Profiles**. -4. Select **Create Profile**. - ![Intune Device Configuration Create Profile](images/aadjcert/intunedeviceconfigurationcreateprofile.png) -5. Select **Windows 10 and later** from the **Platform** list. -6. Choose **SCEP certificate** from the **Profile** list, and select **Create**. -7. The **SCEP Certificate** wizard should open. Next to **Name**, type **WHFB Certificate Enrollment**. -8. Next to **Description**, provide a description meaningful for your environment, then select **Next**. -9. Select **User** as a certificate type. -10. Configure **Certificate validity period** to match your organization. +1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). +2. Select **Devices**, and then click **Configuration Profiles**. +3. Select **Create Profile**. + ![Intune Device Configuration Create Profile](images/aadjcert/profile02.png) +4. Select **Windows 10 and later** from the **Platform** list. +5. Choose **SCEP certificate** from the **Profile** list, and select **Create**. +6. The **SCEP Certificate** wizard should open. Next to **Name**, type **WHFB Certificate Enrollment**. +7. Next to **Description**, provide a description meaningful for your environment, then select **Next**. +8. Select **User** as a certificate type. +9. Configure **Certificate validity period** to match your organization. > [!IMPORTANT] > Remember that you need to configure your certificate authority to allow Microsoft Intune to configure certificate validity. -11. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list. -12. Select **Custom** from the **Subject name format** list. -13. Next to **Custom**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate. -14. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** value. -15. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. -16. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority. - ![WHFB SCEP certificate profile Trusted Certificate selection](images/aadjcert/intunewhfbscepprofile-01.png) -17. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. -18. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. - ![WHFB SCEP certificate Profile EKUs](images/aadjcert/intunewhfbscepprofile-03.png) -19. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. -20. Click **Next**. -21. Click **Next** two more times to skip the **Scope tags** and **Assignments** steps of the wizard and click **Create**. +10. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list. +11. Next to **Subject name format**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate. +12. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** parameter. Set its value as {{UserPrincipalName}}. +13. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. +14. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority as a root certificate for the profile. +15. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. +16. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. + ![WHFB SCEP certificate Profile EKUs](images/aadjcert/profile03.png) +17. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. +18. Click **Next**. +19. Click **Next** several times to skip the **Scope tags**, **Assignments** and **Applicability Rules** steps of the wizard and click **Create**. ### Assign Group to the WHFB Certificate Enrollment Certificate Profile Sign-in a workstation with access equivalent to a _domain user_. -1. Sign-in to the [Azure Portal](https://portal.azure.com/). -2. Select **All Services**. Type **Intune** to filter the list of services. Click **Microsoft Intune**. -3. Select **Device Configuration**, and then click **Profiles**. -4. Click **WHFB Certificate Enrollment**. -![WHFB Scep Profile landing](images/aadjcert/intunewhfbscepprofile-04.png) -5. Click **Assignments**. -6. In the **Assignments** pane, Click **Include**. Select **Selected Groups** from the **Assign to** list. Click **Select groups to include**. -![WHFB SCEP Profile Assignment](images/aadjcert/intunewhfbscepprofileassignment.png) -7. Select the **AADJ WHFB Certificate Users** group. Click **Select**. -8. Click **Save**. +1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). +2. Select **Devices**, and then click **Configuration Profiles**. +3. Click **WHFB Certificate Enrollment**. +4. Select **Properties**, click **Edit** next to the **Assignments** section. +5. In the **Assignments** pane, select **Selected Groups** from the **Assign to** list. Click **Select groups to include**. +![WHFB SCEP Profile Assignment](images/aadjcert/profile04.png) +6. Select the **AADJ WHFB Certificate Users** group. Click **Select**. +7. Click **Review + Save**, and then **Save**. You have successfully completed the configuration. Add users that need to enroll a Windows Hello for Business authentication certificate to the **AADJ WHFB Certificate Users** group. This group, combined with the device enrollment Windows Hello for Business configuration prompts the user to enroll for Windows Hello for Business and enroll a certificate that can be used to authentication to on-premises resources. From 100d52533ac403847775b07c99b9d4088b797ff9 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 1 Dec 2020 17:42:55 +0500 Subject: [PATCH 043/169] Add files via upload --- .../images/aadjCert/profile01.png | Bin 0 -> 148568 bytes .../images/aadjCert/profile02.png | Bin 0 -> 56028 bytes .../images/aadjCert/profile03.png | Bin 0 -> 39460 bytes .../images/aadjCert/profile04.png | Bin 0 -> 22987 bytes 4 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/security/identity-protection/hello-for-business/images/aadjCert/profile01.png create mode 100644 windows/security/identity-protection/hello-for-business/images/aadjCert/profile02.png create mode 100644 windows/security/identity-protection/hello-for-business/images/aadjCert/profile03.png create mode 100644 windows/security/identity-protection/hello-for-business/images/aadjCert/profile04.png diff --git a/windows/security/identity-protection/hello-for-business/images/aadjCert/profile01.png b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile01.png new file mode 100644 index 0000000000000000000000000000000000000000..46db47b6f00fa41afa58502726713d3435db0f80 GIT binary patch literal 148568 zcmZs?19V>D)-4>{wr$(C(O8YuIBA?ljh!@UY};yVCymwEY3$tH_T29~_aFZl!FciP z{a|6PIoJNGq9lz7hX)4&0)i+jBcTQY0%-yQ0`3k22E2m}vjzkF19ef876Yl8Bsc7&N$1gYT`ZQ8S1I@BV5A%1LE&$|zMkv|$<@VZaa$lNTVDy76|gQE&Hi zwS|N%;ks>#&&B;|-0<#u=C_F<7KFb4zaR1(@)zN=+%03AP?P`s>~{|)(DCe1bN|r=8zFj%F zLP$(`Z*3l)5kzb*u6@GNJ6O=9s?D7jyJ$OcV*aZAW6Zf2$ey zPXXp(ZAJnD6Z#`4%p`41G^8P*i?-OdP;kx;csIZpCWa zXYQTr*S&?%Ori)Kh$?x>f^c1Eo$$F^=QtCg5?l=hM-@f&vOMsA_U<~{Oob7?Ct0c0 zG{r*zs$=uEZ{;F0g}4JVHI6}FMw%C{kHrY0SfhH>+AoMYk%TM{o=CGMI^aJC_vX^@ zi33Z&?4iinN!)k9Z7e;X1tF20L$=e1ic#fKrlyIbT)omqx){pUN4;AYcD1*+F;>(S zu^!fQO6)(U|ET`~=a2|TCC}?9s?oN&{$fANi{4X6SQegs#uBM;eARbiXP7WmiPQ4l zo+g}vqPPh2`w^q3P+(QE0`x-D4YD$UKL^f+CZWBY?y>!EIN@DFMNnrbI;rc~I!Fv` z!+wWbIN`KFiuV`-Rca3w0tr5Z!3n#NErE z&u7ZE8Iy|94i)?9t>~RTBfjcN^cSMWA9FVAoD_TV zgEz~!q^C4quKEw=Rx4MZ@|g*J;xF(pxS5waBXB2!vPaO?qKpX6!TxS>Lr;$yvM$Yy z|Ewf)N4TojZj>oP4n8q~3K^RaB_*dK3ax5a3+80)*9c~!#0BXYv@(n9Tjpj@$tYp8 z;9de86|w!xh{HC)AG0j}lMUjFaz#7@DNhw`XmV%B&>ib^W4mG`p(DN;%D1YmvL>yw z1CXh7a>+HUY}42RXmJ>57y@X{D^fN29<{>H$(N@_Vwe8B`%QFcZ1q0Jd86AdbT_3A zOftgkmZAIwj8#$fTT^tc#kk$>`;ANqH92ZqH_nXgtz9wgf6pWhp$FWuUQLRU@uoq? zHV(Yv*h;%4+#YyrWV(m zy7O?~XqG~-Yp+P&q23g7jHbch?qEDg2{!w6FWD8&^VQOizshihn7a!iVl=CFvIdSq z)b~hT^@a{OQ_ zBBAD&=|g^^BSc`dUlkcaNf5vxTNduA65R!}!fnb)#9Pwv$_;eJIBPvQKD;+;oe+%B zZ01CfII5?Ei0udlLW;+{K%yl!%@+GO74^7H0C-rM$xf`!yeV9`&O0Ip1ZEAL@LHb9_(Le3y*19NuR(1Q_{}n3<>h=a5NFSlkpcVRbRDE9kE?@wL}xFX z593FVzl0A*#CtZDv64>rW^Wv>&z4||&0b+`Y5ajDf5ZGw-q@GVVSkNZUG~6!HFb7o z7jtv1{OG6P z1x+)%qxG+VkU%C3X95n}fF?5$5Qw>%c*%I_SB4y;es|-v>JU@w3y8%bjPYR+5RPC~ zC9YLFh}>G*mQH@HheM0Eri!m7pqUT5$_A}TXNUV!VcA*p4L&olr9m?Ay}#7-V<0p= zQomt-+QK$!xlB$>OTbEwv$50#@#lqz{|>~D>yzEFkoAALGI6Nond;5FC4xJ6IXonn z>FleBK79D=S@x%%e8@jxpE?nt%D(kj&Pu{(RP@5i$vkj#zRsZ%e#euyk)Z=+Rudw_ zd!I3HIDenU^Qn{Cnk;lg6JxS?MFtx`o1|qP{Z{mBqWrrZm(SwX_$O#;=^e`p^fN{{ zC@CtprC-S0yNIWV_cx3tDk9Wew2euH8yC&JVHf`5fm2U|4J$Nyj{z+8x>%1zN%3C| z-x?Zxls705p000yHA$lGe|JP6Yhttnlg?0ld$rYld5Csv6?=MubWKp7BkETCaOZIt z!(aDA68~5k$>qc%X4rDmY*djb;N+$X7{7YyaJM(tgER%^aCUXta(Bj*SGQtG$5rcA zJbSfUeCY&SXQV7q%RT2PxyZ?Kvn2nxyiY4Zfa6GaPs59`8_fa&PgU( zW4$q2b^S98@xM!H7&ZOPJlaj%7*J1>rosSRz<}tcx(Obe*Dd@I%7Bem#$YeSO1S%M zfau}^zJA$~RM||f0@W6LDPbzNG8=henf*2#rC9l!gs00{^~(upZM6R_Id55gQ9UDE zlvX3#Y+*Qh#)nw@kD9$5#(^(&WZSXJNjs#&+Tyrz7=HHH&9u4`TAL*~6{%nH5>t&n zcmHyxVfyM@TwVT!Ce?7TiQbW{slL?DFDX}^Qk{av9+b6xjM)tOXWgY&w#vl1wxJEE z+g?AVhP%0RhNB!V{XsaZNN4Mjmgj}dzN8{tKV|WG3%b`dzm1o7hI7bAc2ft4K@%Ku zTgG+~t@K#Y!ZlsYBRzwZu9z6Rz15fci)p-hxyA_G!=qy#8HLUVvi+eQQd21_#Nhrj z;}0bM!(qGcuZ*@LA@MJKbg+#rxHzeeQf7bs&4r~|GafM6^lJaF-M0tQJkuVaTZ7{9 zd`wT~zH;4AR(qwrQK9JKa!s_BWS;XbSIc2d*(|=!n$j6n$rFRbuw>wYA%RtZ$%?=E zC~g4xyZMG;zh*uROY}#3UH%#1k56o-G26yEmobs~ALv3y>=ER6tDGxAABy~d7_`hq zeB5$y_Dm;pi+}#$^I6Yr6*lYiwW=qhq~OOe#mZ?Wg#rDyUW5k_`0dnAo5mkJ;CylhWV1&xt-IIq;TIKw!8niYjSgFp!JVInlnCIqa z5$@%7P!ng1RqiTzIs30p!dHHuf*RxPh(bbXls73mB9auDBIINSD7$O=haAxh(IDcI zMQn5WVr?l_*LS_F$c|^rqDESz>J-VJG`Kx3tki$%Uf3(Z*+6I37=DeVx(07p0^+qw zhVKTo81Je21VVRioGp#8qz1^-r}uQM>imRw3_o`OTLdJ$(~%vi%82Q!+1Tg`ZBF+? z_xx_5lXyrgzChm`qR?i@W3IwF`p`44ApE|U%1WEiZG1+bmVR<#=!xpRrHT=u0fb}M zY_MeWfR4g^r^37^6|EUjz;l<mZ~_+DC-LU%=xYk@2cR^_lrn2=eby8 zB7{20*>o{*ma_f?%Sx^;0^K1nxy46p*1gnc4Uc>Krj4oRN`-}BcSOSWxLOAV zwc{X{i>Fhhip~{}-~)V#MU(-rp>lO0ViYKy9kobAX1(_}H9Aoc9oQrq3$07LC#dMz z%*))5S)Nb1H*DF?W4=m4&meo{hOpl-i~SK@=*bOsBk4$%v)TCzjTFANE8Dm9EpHuaC1X z?O4#ERa;pdLR`M`s^gvX`C(4(v(XM3o7mIlVsn|k2C6Ra<&UZN- zfp&#n=q<@PC3-xM71?zj#wSdw_A$XEMgl!9W8Mpc(wfv9Pf)vN?0nex?O&HQ;I*;r zL4K^8=i;#u-47yVuG$g)ki<8D;H`y8mywjf<+_QV zAW`2F4DMm)eAYj8TB4bVc-JMFl;sn72>8|a>=U7h6do z?T!&H*P;wq2XuRG_I@;`F`axQBXpS=^0&Q2diA5>dK*e4y9E>5`7$4H$nlC z)xq1pFqmMd-$Ra268f!Raoa(Ja?huBR|xe*;oQvQ#oAR&PM47%{D#E$@!dqGw=XXC zO%76$n$bpmx95S)q@I4<)&OE5c#^^4rlbnNuzF`DiM{nr{Alaj-V~yT$O1~ah+n3h z1I%kjS#-~wtoa<4c1*e+D!7zxwFm16J#(1aDqT+1 zca@9nlzq=<#f~&`(mN`f-(nj^Fv>;rFNF#UvVEJ3GXfNn8B8VGy(nh4zgL4Pu{Yt# zS|ymJkX*%CI|apagF!i=A2Zf00=^A6aW61_xlKOG6f4|IaG{G8Yb z7IQV`D@E*+xF-lxkW*B$9tVsG#M)?g{FR#$*^btGW?TwQx&|O|^z;u0yFPG9XK^p$ zQ9;=z&Xll^LQlA=TUE`~oAi?8+WJ1djjJ2E+hv;0V!X?z4XCGW_^_3AHBNz(n2Od# zPe6oe;0|O{vB;4W5Anm!e>!n`LzTr?>=nUIr?_bu_7tUtzHuN}!P8iVJlK2=rTTU6 z@%dT|d5E9sp(%Wyh7MD}KBu{HVGkdx>FsrI;s;NHJbO^6EFHBbii6Cqwgz~nx?NsD zQbPmBvbP<2r$VYxx{`j1JMP*$%c!tGZ9(Cf8RpgcYPG~W9@bB(HsGx9 zH)5aS9#j|RlT9`~DE(|yThvfr1Huc0&!ry=FNVH!_30Q`!{d$#m0s=|^xpBK&hA{v zZzC@}FC~%3YAQg@sVGhGqRmd4Hn$oouv>Os|-*Uk9*HzSf5z5DFUPG@Qkfzg%O3X@7X7^pB5#USUpWovQ} zfRqqfur^%5!E@FSJ1%sckib2Zk)^FWTINXA1ApiYmzR^2DH#f)F%qH|Uk7`1%NfhO zj$U@6&KsW+%17#G#l~q~ zIBAOht@f#n&w%b*GIIg;73t&4PpFOYo<-<@=1F*JzmbLN5#&vJvmHf2fc@krv-q2h>lji^v1k7l_ZJT z@-UHtdg7$x<*LveS(!!X*@`=JuzHGD6(QA$3-rs@v3s9W8TywMjIY~Vp2 z0x!3Q5ao@5hFsWe;FSnP3=ngmYYhN0i@v?`D7TY3b}b}(nvlmApJ>CzK=y!sM0-Ny z?xQAx_e0MNjvFa`smJe>HIpl({urvz^Dp$Hw1teW7tMhK*FTsVO<5 z|CCx0baRE!J#_|j^w=}S(KxDeDKUdqtZj14<73#fF7X%8u+v}}pE1arp*WJ}4m#~9 zW!&(;2rZbm!_w`hf$JlOM=L9p>udP?nB}U0aNfqoRVqF-RlxG42MhbDTQ#YhINK`! zU-$WL`7*OL{4n3s$k?vMb&ag7)k@(u_otf{*_sk z`#k{W+vthCQ?r8-@&EoF`^5r9ghnq`W%X+72O4u9`iM;&`|e09zQV>%<7D?rprT1R z-@+&^-b=Xw7EO*`tG;aUASZpQ3ypRgPYm!$vz>l@%b7G^$hWVm`MSvk7GTzO5`%n( zMFCo{>uTE4&=C>63U1~<4Uyra6oS-TO=U))cgD6_E{;nC;)VD~-CmxuhWj@D~Con zI-|DV%`%(^r<+4;kAK4|!bHl~vP>JyHXR$-)v#-{PdqGYuTZSSP)vxQ#;9!Z$p9w5t&Nh$THMT_*_$Y3d!rzM3Jc4j@ef zX;H_P<1hatgzmA~&q;6IQI|iFqsw-ySC-NTZ~lQuu81XZhg}umy016&(6(~tU zB!W*r;Gvlwr76hLP)OTLx6f_2?+Q-tKuWJRI~rK=q%VgJ5eLZvPWj_c%!%2iaHkk8yz|t|jS3R56a(b&&iJm7Kp2b_dB55{xFg;Vhq+|( z%w5#z&K6_UF#zr2v6*<34U{!>2a`HAY+3k{rcw1wQg zsA?@mStp=Q-TLqV7@>90s!^2{pORL6J4(^jPyfX6FwzbIlwX+eC%GpcYhO`ry^?%x zdbl|v@RsoXc8r51rWIW^!SO~*d4~uXsws19l#?6{Hi4?}L5FPz13nfaovds1{E8IO5Bx#D498!#f=9Em? zQ)Udayvcl0nmlf1neIF}PD@E~Jpa}V+Rh3=E!LLWcR zjHRw|@42$de+g}*gUzeBx{ro-%ujSbX;K=eu7F6bEr3&67LE-tsgnXSfc@AvjN$6* z8v`(Wn7{b&F_xvJX~1#?QUn~x^V9u--#Jh~4&RaFvlV&p<}2%#0h(hac55r2#*?(a z@H;okxVM?gEudcWN1RQz4b_s5a1Z;q;br)x0NDN*T4o#`My8#a zZcci%XmZ{Yq?=n6bU)(#M{v-;1vGG~Q8qcNMn2E7tC3`FaNweR0>BFYF6htSE-IPu;fY{zJ2(~F*3+9P#{7_L7Z?6J#_RWf!%>!<#E>O z?oBYdi1)u56fnED>r21?nn_>y|MMvh?*C|If7T-fwfgU%{;e*)hwGnA@^7sl|35=} zo00SL$wqoujA*T$)zsAsEni~&-Q5R*MgBU%F2h44L(42G<*!X!U*9vKwF$r&eUw~X zKi+|6N&nbYoXwWT$d>Gs%p_#Vq)RMzb1YiqRNFb{q5k74!TPR?Cmb+ZlqN(`xNyb`7w<- z#0n#hj1wjN8Fje&&wy4iK;HC9yeUS*RHptnT^2R(zz|HqmV<&E({6S-ym*S3cKY88(OGKwH@4ydC2e@24+8L8;`2J*-7c8Mg!LGU5} zT%H#=r7kuhpNCJs`eB`g{oi~xyIyy(a-os^Uj9x{A6^Ge0)qC>9pHgGTyy^3?hE6z z{mErL3vqrhm0fLE-(W7ea&Hl(9fj|3;NvDqyZYgdaymK>qK1(Kyn;mp;S| z!N9`$UF|x_$wh2Ug^!0?;!r{VnUhS!L)2^N~dZVRY3RhwTC40C>8@rL$u|4yXZE%o<=Zp#}+J~ z(xqkScvI!@h$V5s1bp?UKvl?<1M~}$wFFFUfdhAowCbey7B}O@FzGX0PJVZ*i-QB| z@OhYSvW||9rurIa0XybvB^#7>wL?#mH@KSE{ z(~i<8BCUTON$*AH+A>WbG>BK^c!EhD6hnz7o5y1EJ1X%z=j*vI8L^NLkN?|R(nzB0 z>mX=Y=9u6Z)SM0PyrI_JoW?}KO+=JQ0#YHrod9&T)Ld&~FT2c~|MkUAp z9n|(`6`_zR#oBSNC3ALrH%n->LHkO(_7t(-!`pQ37b}8<{H|ulO{p&JDt#*14XXP! z?D670F0g%DF>iL!$tmI->nV;A0wgDsUcjoh)_-A&rgjPANL0&?(EIApCEM~sKhI4- z00s-s>?!sw;`*_4oM(>G+N~f2V~?WX5p1?V=KM3o0|2BXaxs!iQBBq0Tu|a*@)!i( zW2$=Tn>t*bKs5u=3TU2*rBpFm>YMH3$J$P|nW8JAZ#CZYA}ISwE2&0QS!z-Hf9JH0 zo9@V{gNI8x6Ue}YP4pIPzna;4K17f%V20{OLD4m~rlq%O;+wK2=@D7(^?;KU)5Mj3 zw+wV8ND+KKISOmacr6@>@Y)t3qev3FMZ=dHm%%d>FE2xw0t(J8TW*wq=lcs}LN*+^ ztJKU&6ny-4(}Am2mxDNK5IT=nq_v}IBNU;lDV7qg!YK!0nt1J)Z^&vpLg zKX9ujr~GE+woH*1U9M+C%<;;I6vKc$+muSA*82iUfPEa47ix+DSyFpGM#X|ggV~?q zzNgaEx;)5bs)PLTdb&SLbD}g3KxdK8Tc0UfY$?@;l@Vxp-`DslkTM^awh~JA0f{7z zp4na{6%V5~AY9@jBJb?WZ8l2+x(bQn?X|kpFa~3Hv7?ixw+3sr6PrZgTP%%b)({Co z*&`Xl(Y@YwFJ!dUa#PRDh?Z0v=cz`u?X&>bkHasHSdFw1^0U7|=99l+c(OL;J{zhh z&lnww>YfI~hf?)^3TjrBCHEv&W>B9m2uJ~UGtkzHf?#bF2S23^!04wlF$|dfwoq5o zu(yCnRIu#tNCNkT23v}cp|iyF+}uqMT*A(110qwtTr!R!$xA=41BLJ_P04SVFYZ53 zdOiC}`ZS%^p?lkj5Tyoa3r4jDG=p=4wxf#je<1XIWVUvOh+Qk+GH!q_J8H7myFcAP z^auoll!_vFT>Ophf4a`^`xNEG#DvfF=J#v2blC+^QBG7JnB~R9Ozjj92vSl~K7Ve_ zlUW7}J+C#BUaZi`{Lb(!zcR7>co|RreCORZk@4P_#!5s~9-GZ`bbfAPYAUylyKftq z9h_Dji^pjLQx&`3ZwUa!3*)(ZVtv8SSMtkj0uueWQB{s!!aRm$vNj-Pr$E%toq+SJ z6s`5QGM0_J%M}qb6F6jK&}aBq0Y89wjD>V~H@zeao}`o;cE>at_@SB#N$NHNU#*iP zpN*5o?!c&D1$Tb4rL%tl@M@2id@BO{P-7-?MgPd7*G5t#H$nJBsC<*NnO z>eSTKJyR^Y(~Y)^Kx~F1(%ho!g~^%%{{yFFpXk5Zd2^~(#R+w$U?ATs1%-lVLg=at zkiD-A3b(6iqDBpAmoFi47E3wiv6-8 zI^Zsd#?bgVoX?*$AFO~4Rb^HJ@$%zS#c5N9xub_9#&KcQ6C6!(sP0a6IfutY5_17_ z%RG5md+>(|gqb?~!ZUKoj9OAg{||N%OGk8LQRP5vm2|;mqzpj$EcDC9p#cG&{OktL z9jXKas-PF&oA!PdyUe(S%tN%y;&LlMJY!M~WI){tj)Ls0r`2+^x4qd2Rs-5_6sGTM zI?Pb@d+^sLkmO3;LEWid5@Ec#9s0*v=)PS_XJfR$8#B6YU8r~A6R{E~;7!8XjU^W!h6DMVy z1p4J=c)QOEnsF5ulE>#E?&hb6jf^@kzqRB>r#H9R6GxK$n*cXlsS29h!BwF=1~)Q` z$GJYD1sEF&Nz~T6z{_(67@9JNL!%AjD!uH~CXvtpPK^=zXLJuoH>+^;gV&C_!N42}?kg2=Cj zu;6{ND-tJdD{$Bvf&HvkGi4`LVdbknfk0R0kJV;JYQ^uDV=Ijf0q?gbi{;wh3_2Y$ zYpTR}*c!hso^IDWtmnp3nPp*yO4X_R`Wkf$-0#mbCo}mfKXefs>zn3{gW+Rhx&eqa zo?M!M*ZG5J{umo6DQPURcb{tA#}TbcJzHxM7dVt$_}q3lJfA@1 zHB`)CK?MW@JVcdO zhNS-iSI`DyG;}mCPUY)R%;Wa{M21*+?8v7Q^uznN&07}_qrIISaAvhG|M$0X+&NYy z7F`;I?f0ua7@w zd-;PD9!hz>tFv}@M(?V>AJQ1j#3T5;gT?YoDd0my7dBosa=ol~0L=%Ej5pj9=n*08 zjIcEuBvZJ#(!<%sK6n9Vv`o+O1h^BKXpC^0M!a!1I<|82ZJ~B>S_C#adrg(G{=zsN z2-(t8Ie?gOC(F;nVoC#6*79jP&*weHt8B)YK5%Co!y zd8I5q->30qBR?JOdJ9H4m0~4>{!AWgG_TbLYjEb6i>?!+8e>rzH8r*CgT(>ymnTGg z)cYl)A?c_j`z>Td%d!25Jf(-P9Y_cTi;J4&T8wH1FtD89d(*xPqwv^FIY0BI{bPf2 z-RFv@YMPp))biM9AwTbT`990MQpKfatag~cKev9A{iZ`~*`n$Tvw$gX5ZUOsnME;5 zK}A)i+v*Giz2TMdal6YcQUK;lCJo4^%$Mk>bA*R$H#@Al->rE~fkU_R@{7luuiiXg zsK(a`>*3yEyV_Yzh6gbj-k&(iSRPavOz1WIC=_h>$QJUIBU0vc6c+;n2j8aAYqFz- zhDNgqb&t;}OQumZ9UT8g6V=`>T|Ak|Dx-pcv43Zed6%wUtW>4bi8mmno-<)BLe^o& z_cei3JR=v$$Jh5@DkE$|TGr37i=YqFekorXISFECH&)PFMHlX?jnX%^ZwRvHqe+FP zJ0g9$I-^=&ES4sRZL=~~%eAZHc<3VOcIakBf3`%N3J9!ep1X$2FIF3%3pneI1cGOw z^hTd=Tn`z#F6Z`14@TkI8t0sWk7x(Vv5Usw!u%ynpkB{p-r*C(uVJMYo7e7H)V?Px z;^%TY4fmH>K!lo-pPxh7Th2WCH-l@8039GOA*Ow~CZ@b`WnMJf5Bcxs!#TL=GmM_I zs;RoTwt~{-L3vrBgD)qgMQXlCY^zNGFBnQhzfS#bsPclvyzDcqOpLEKOhoE{5`Nu# zeep>vj{Ls-tylbu>ubmrOS!;3Dy8cCn#Te=uKVfbSH)6OKymeRmupFY{RF zBlcE|jz@KP9Ri2>^Xm4tP(C$=NDvOu{weB61y7X)qfvS)E0IdMNAs|-c@|%EcdfPl zVx#lbcdjU-xue5jQ#3j%I@)%z6g;f7^fVuqr!V?gJX{__9@LF-|3eXiY?7!f5+NUq z^erBz`{^3z8HQQq`d^n7&iWb*d@7_e$F4rivF);~5!V~rbE4}aPni>hs zYwgY>BRBsUTtYK%Ix<^$d%Pgd2P0s4_r1;Sg!JWicT8fXC?&C}>ET&(Wo2bnmsZhx z7&7rJ6WXxT&P7I>$3+=T3XMWK)Q5ax z7z&U);_sb-4R5$lp)Gv6@+h9_v8L1Pv>|lmSso=h*4S(G+Eqz3s=w3`AV3B-X3ASy zoL6^jN-WkfL-gm1Xd0LyLWQ^*bx5~^q&{o27bl;=MRqO}LhCnnm2X+!+p|~^$anJxnt{Rz zWCL?lrF9@4QCAYAtGCs9Z;0zKLl6kkSk`R?-KxE6OAZl5Q17$_9J^BJ%gTaM%Oxuf zvRE4tY?1Z*rQ8sB*`2fz<~8;-Lt!P{uR&1^3{RkSQ^Swoy(2;$iFshKAz+E>(#A0D z2g~^4*pI+3IXH>fL#rI=X=yx3NjfMwZQ_B{xlle?!o?mt>)tmQ z&`>Pw+|s{3K|nxscvt^I7tjHp@IIQ|RN2akVNaF7DK zhY|vXze**y7pL=+NVGPuyl`Lc+tcj{KKEN-zW7iK;E5?AiTTCF+MQBvJUO#-Z!kSQ zJpi2(ny*!<`}&MLy*PCWLlx_-+5EqyGQNn<9EYX0bpx|qfV#dw+95(VE+;Ldi%vO*1 zU~5a93dF5gdMuHk&-wMs$Q(6k59zd}ilTnHprukOQ?J9W2HoL7`CNnqRB zfW>?O2O(tt#|6$LFqKJw9QFA1;B-^bK4fEl4Sg#_U|MAQjDW*4z2MfN(XNHW0N03n zY`V=U(x-{QYcc*|;^KIrv3?&TX$&g&1HXqyEWquJg2Sz~IGG*Cs^{(Uqb4!v)Y&dN z5c0WeJd{WinT@3|iiaXB12xiC&lkv>B|Nm~DJ>->B{BT7M@Lt8R?R&* zhu>kdE4u1vIlp~%t#z8(alL~U52k_Qhp@;e^RHq+_Fy(7h$&Xi4(;%j7enkH8iMXh zI5RS~v&(a~4)q<0waAf~nW(1cM6r^}$R)ygko#mV@u|jc0JMfFNm5XMT;3e+(8~72 zzgR=2wyus&|HH#ot;~9xTWa+OouVi^hnVi}?)K-hyR#K0gE|QEFtA@jJ zEh%YFy~V5R!KA&d?Fp;dpu=YE^~)nXx5EZtcrhqs88!9vQjT9cJ39w3_wiV`xx=WS zhMG5$^b1sfhelCOPe2Hk`o^KC zv~)2L8rttqmpcz)9VRC&EGz&5!~6cNmMs55#V0!48wG(#APtLfH|-msgD7lJyn3V; zqyI4|ghXBi1qFbhuCsrR0g%G9lJiguk!tCptk>n%_8hhHRvL%b=(I^6oo3lb3kM`l zeojfJ#SP{Dm6bN@ImfL4_nR?h+oL`=JeKLj;tM2^My)qL(W>75rL;R~&znQlAM}lU z*9-L8K=!r#Xm`rx=y!iENI*z9Ge1qFuExG3q8;%N^VIX@S$7gWK4`7m`e)RdUb921 z-)s851Yq116(3XZjEsQNJUdYZ;>lhlprWf#F1fC@mUR1|Z*4rvoyPNWD{wzBS}QNE zxx>NtAud_4U;scUU6mDs(2$TbZ}2gNgqRf?c*EJk{;ke?eoxjvvxMJB_$PrXAxqF( zPWu`PE(0UN8+|wG-}VF_AphGNTD84rTv(!3qS+b~aA@e|E|3vg+7>zI!`g!D;IJ_H z+wwFV(JyRVPafdLC7P*wdR^w^ZEbCn>zUS;-v0jYtinG250|8nip->>+Wh1C50u6x@2$`H@>9s*T-JX|5}w(Plv_%Q*XN2@`-j`n)`o*}?~V zZt`E;@`F2lqwzSmMI>Y1Z&M#cCCuj=>(jvK!foWP#mIALr%3?&ayuF6qRhqZ$8;3W z1ERlUSGo?zaG|^85Gi!NK116C$GXq+x)(9BOYX z)6f@2Es;_$QpnXl&&|zsa5-ptY`R@yHS^PHcW(?Ex-{ua=eFgVnqVXqRaxk=p9@W) zwp(j48BH1iI2;5dBq`X=jt=+pwe9n+h^F?%P%udNS)uEO|fO3{4Z>d~%lFxbo@ zWz=md0J^%AvrbowrvMJ?J>KQvGB?{VT{Z)0`g3qiO-(YrHbBBaV~TEFNXOo3H&O<+ zz17v%pDfj)?|!sg28y(ejg3POBO{|=i9~=2Fv<$hokn8X(WldnUp4}=>dz{JxjIRB z4xu&>!oYK@z4_UNg}pxL<>DaGO5MhlMn`1mbl-=XTtLPU?_|+fTia*SuL03@7)hY? zzCX&}yJrxFR99C&aG2zfw)hqNm4+o9^$ZsWC;Y17L)T0HS9A+K`2$`>E9o`MD3qnp0R;_^ z5C`K#h;xfeHh~BeEpOG9CuvUXHws?Dfr7$oLG?%RUEF&8C#;Wvm6lp#PiBXyLHn+j znnwzCdJ|sW1OrKJf4z-2GGkDb9ZF0Jp8j*tCWo2({X9#NA*`wgSDd*^C zkq_SqpE|Xti2kU0J`XBtY6%QoQgVDefbf^6dGd2tvOfR!4CEn+wRlBs_MWAr2kj`BLC~e0-BeH7ZYnK~r*(DU3rggkgRX-ILk2RB(>P zgf74Pxw9LgQLU-u>}9SF>5qQdM16hz1|vA69K*?s?tnX233p67jRNf9WythNGtP8h z*)O4p@j?_dHhrPd`uYa4$P(s@Z*?(E6vc7 zatCw;V3Pc1G5|dDe6dWkJVAmz1RmS4?&Hx$r#})An}nU-_pv0}$n6HV)h4A(K6M#m z2L~a`stgWk4HN@*%k#C$)g}Obe+$|Ju?lMmh$LJPP@x(Cz>SEnRz=1=K{P~C zV7L6UqBc0k{2pfxb4Afs1J5fn#v~-e3M8IF$YSbJ(t8tAk}U6pv%AxBV!s*487C&0 zV$(4HJnc?(|3$bbh<-h~9_)siPe;krlYn5*MJ%Ubs_yf&(J4w{td_f z>Dl-bkJBoE<`*i*1fl4F{~&=sJsDQ=z%vLz`3a#8UP1L+mTAmz|2jl~0f2zQuxv&S z6C-C+_i&Z{F3|IB0%ANhKw>hp6QB4@__H>9cxw?&K7w(>*~stod)11G^571j9P$E z9c=$6M*UfSofMWmL@|*x4`VwD5&CL_)GL}~Bz19NQ9;qRLd-A8NX`m1eC_gafsi;c z0!{{lw$s>7Z^&2zPf`p4ghbi@o@_-tCVr3XMR-@YzU)})&w|h3^e!hrk9<;t&yi)1 z>U^8k&M_hi6sfYsM=IkqyRbhSCPfI;G8G2pMX9N&Tb6$}&t!I_AzH+OpMRhgx#JSmoJ%VdL$&#k-6TbEgBao6!oe zFuZ`mU#jjOy!KxBhjo@f2Tu$eS$#$okxgSWcdj-R^nX5E9Ev3dbVKp*>+1s{pmbSk zw6zoy0}C1N6Vda2ed7Gr0|JwkpTyg8TL-f4;ro0e)xK@0-g2Ro&8OH?7nzopCg^?F z(q65WhG}YRtJkhXC@nn%@D>1(?s2g(K->a|2S9LbwO_ph=que1ACdsTuC(3;0J$J> znAG*)(9o*)vt~v;E_lEFL|IwcR`;{x@4WTN#Swp?u0l+_HGYpov8gbhPV=XEOiRRJ zMesbmo{W{=T99648%>4q>Ik40=>Jf4mSI(PTid1^1YM*wh>PxSkQQka1Qeu8y1S)Q zq@=r~8>G8Sx{;9X{w6;A+3)^1@E^#%?pb484SH_f-hE{EGR7YdII9i6|7NZod!72gJh)mQUBGxc%{9a!F#d zYPJ{0YjoU{$i@{YwlHfquiD>Wg}>LS8BP}DHrm&clar$`<~lmxn*$`q3d7|%D=Vu; zt<~tF@I@ShhB9`qGbJ}ZV8$i}23}+LVxqO&RePKzR$ZRF3@T5GXZ~;xsyd@eqduuu z`q9zRKoH%r-&Hp?Eg*kf9p8vw(!1jM0Ppjc;{>>JTiL`d^~1J1+GnZhJ8NIMM@AwW zt$xkSULhkyzC}n>mI;jJLBF@dwi(YEln9;;8h@s9-2^FNbxvulA@c@v`PTWw$H!;6 zL@OKZ`~4#cuu^s%$ogr1b8x9<>Evgt_(p$R?jwU53(JYT(dS&2=8KJWQBgSB zW22*Gm6d*O9_;iZqWgT8!eOq(nHVpXrAzD6c$4looa zbB4R|1Sfdf(VjgEMNquS%*a?>T}5a~jy^y4p{K$=&P`y?W{2dwxl^j`TGux2*eFxG z0wH)3*WH^61yClba5+olv)|p>*%?!VvF}`5^jJ<4MM6UI3DW(hAl`TofI-4%erY8r zD7XUm_z*0w7bTqL(C!k5HCNAQu5QGY$~l)5JMHYSE~eO-pj!3#(OgHW8BQkJM&q*% zh<;`T@9OOm#AyQ;n_N)u-LCF`HC$vb$!(pidLU%YeQ5C@@%DUh&y0)1od?;jM!8d2 zdb;krci-k3oox+=1CldN_r`NYeUZSATdDNDCZ&-NpQk%JAbeO$O-aegW}1z(F%Z)< z|FI0K@1^*yFp@JpO5VGReuGI~tI5T_&1rglT_3C~T>7^_*3hbr!~tJ{Pe}Oecd{ZP z%yFu!s_ge>?Oo3H)tX$wZm%9VaVWnPhV%n4ZMNEs+idC&_vc0P`5*T{OvultjiXZ| z64KLe55UY``9~<5nVNC{^9`sbvkey!!smZbF)CzA4tINwHMH(mGzDWLoff3L7 z187vF)1!lSOOE)hKnb)x5KGwQ6va6qAwjJ~3$e;_BrV-1@ntcXD!qNU{lnh{=gK~H z=a1)5Wr@k4L7n zEL<@3sNjV^cLe2EurDmuJF|OwEV!KQh7t3kg_XuMS0Rb2iMtAW+`dy#XfYY50V20= zyTSasEb)ch5_3HVA7K*zsdfw7gT;j=&p&6!_5MQHnw~cnNkiK8@7}#rBv=Lc^2z-C z^1Bw@PkXafG61sSH#nx=nlwHK@CMlB1*6T_Vc6!#HTKEr>MDQH)q#!hSJ@}oSZJBe zMqh@61%ipBBK-bh)$Uk!f1U|QnHn7Saz77w%* z0V2gMtt`bt2gcZRkQrq-tLhdhe*=GpuF$KPTD%EPo)WyzV z_fx6X{(iIdpq1JP4+8eh%cHfHBJJly*NcM|q#l%3xZG?0=)b`fr(O&N8E4m%qBfo@ z$cXztk>!?6>2vbn|l zB1^$ri7PaCY5Tl(!E))mO$9P4)XJk3M##Y7EjMrzayYFi~5M6pnhIzPT{cjxrJ4&MnxgDeOr3| zuG}d~Y*klRcRW`)~ucN#E(P|EaG}5UGVLM9O>1%E-)=xi?f& z*ZO@Ga6C_Ldt-yPtn0Yqb0zF1Oq3Y#4)OLfjcP>wV5#Nh7f9t^6jh*91d;!_C=>L2 zLoUASKM(*4ZxFxpF|{gYrx$)JkalnGwnpEU>L0bU_Vu`!UUP(EbMTzeP7?VaJZKC1 z4=E$P(5lyGwG)F1Kcjh5^uC6vw~7qLj|($;18a=5^nH!qCp{1sPFs0-JbZ}p zfA;p6bsB>VXX-v7_lf9oL`FvbaM&Z-(Q=~of6x8-JHI2>Bks`A(J_$99nn<)7#{+| z>q?VnG@);uGt*giryl~yDu4Z|1q+gpU~3JFNYFH^FT&B3kl@o<>h3i16QUrRY`x`~ zHLu*?hbz!uwA;fun_W`)nVF+&TaLA?NZ2rezmj5c?y^4p%#^MTP7nXSGuqTWnkkj- zj1x)B?_hT?P!k#XQT3&$$8Ng8h>-D%RHNa(uk<0rN(6hJA3=Wh?E$VW^<-d(sut%P zhm~ioTe%lQSdzH^S;De|)lS|g>(y+FA-uC-xz{KdC(b|HvAs-R3ieCO-JCijSnuu~ z;}>U6w^7}FO_yRFEhbm3MN>t8HWVR`S!ckZeAF2QH==Afc)i``kM3l3YjNk|&p0?~ zz19_$FZ{;ar6@Od2{6F*XFHq2r8iqE?SifjG5g#urx#!o&g8aP74V^y2woPg2620F zvZkoV@-pl!CC+dZy?P0qRxQiC*CHhm;q&((iqzDkaF?SmoU3W7wpc*2$J)@U>my0T zMeJH*K9v+`%b*7I*4{)NI~=)&fM+H(&=fVx?FeakM@l{JmmUrYFu6%%K_EDt{~ozB z0Pf*p$rD8EaEMOFm)5WJ*Jn8k(}TV;XxI$=vZkS-LA0}{S1o!(x|=&B@xZw!#fY}E zjfm7d+idX{Az-jc<+7;1jMhk&8Y!?h^P`|>3iAYn9@zCqE}gKY-mB#)!e(yoFEjwP zIEigT3X^$$Yj58+^>>rYMFEhVf`Ncl!D*(Rd1QSCLM;GzOLA!*Rq>*E)q{`|bpgR& z|Dr@Yi?_ynd!6euDWjKEx!hLqVjF*#f=Q9J z-Tfly|5L3%HQO>QEDZ3()E4Hp~Sp;9nwVFvroKUbD}h@ z4~rqg($#G`BTPhqbH>r}!g#DQpL`O56H`+YZFaw=Mue$mNhA0(Ei5>S4TF<@6i2yLNeADWBIY{NTh#Q|w6rU^>NFJAIMJqAc zAQf=sHWJjoX#LVPQYLtk)pmrHo>q7{vL4qD?d>Gm_|vs9Wi}>bJ>{{R3$|j?C-Iw` znuCa)tfxb$g>l-64&C2QT{;mAT@FNb2(+HF524L_Osk$IwB=fBI|I zerK8Y*Mw@dC;yNY6^vi4U+zE(zeA+=$4v#{!31`EwV#vw3$Et3?#~1T$sTr@*P;Ed z+W_hM$UbOZbha=%FEm$Jtx)FSf!cDqPc2$pGnl68>grG~NY>Q}{i`__sY%fyZDK1IaeK*@r0Pe zxF<3_<4wjL4EAV_X!*RTCfo+yp&B`Hz;+VEuxEF=6x76!YX*4m-&$iLPW%A>x%-KH z1qk0n#c3#xPPfO!{LwK9`BY8GFWu7A9)4BK_4F8@C)b4~aZr%p5)ctN>`lp6qNwI8 zS3P*aX5d2@O~*xrx=3AJV_w0J+>IF9w(8I{1-6c=l16hDf*qRugKv;du441)7a z$p}eF9i5ukmse)b2wHeuA0h`4+cBB&aDSUl7M$(P4Np&Bj4gTg!<)`s?uba%o{hMG zAOPfrA;#$C$Wm!I};`1`#(iy zT%8b+u!s>lL+72?N;EQ&ijmN;P`lcp#5@mo7ZN-``=4yousyOSi=}@%G&O~X1@#!A z2N^ktB9fAm&GpR%z+tAzlphI)xz`oux$Gr0RiI{Oq64K4MnfKJalBwcl_2l1UcpFVlF|HxL7Nj#y;ZYJU+vjOMZ;_?HS$koSc@k~bB;WFcjtGbTLu z4Sb>}smIv-7x6HJYOja<9 zgQ8o|VhKrJjU+K@Rzg143=e`-zp<$)&huGiy3^59o{)uU0>p=$_?wQt zv2rkLbyrqKN0oe_Bo=VvpWp29*%K2Bx%_@Yr(O`$Fm~b3%ou(d+l3q(bu9lX4aV5& z_Iu_6LKN|a&d)HJxcZ}E;V)mlQ0qS`g^1(9P#y-14#Y76^{nrgx(@#-bpHoGJTsv)UN~Cg@0^(GzP4FSZwd z_Oh7^M-7mW$Skgd&eID-J2Onkl?TAr3$m_ZB0YsT2fNBLrTNq+8nJZRMBz0Q6zQ_A zd;;#*>z@5zMUBKm!fdVMxSG%5MM$;C+mT>Xe~A+MybhCRGjc{fj32B@_`OL}OhW?b zjn?dM-y#O+x8yf+?%hThVB%U((b5RP-pHiWSPOC$-U=fCMmzrb#@bdD8Wa>H5(w&w zEpaMx{*qhs`I$fs9tb4BJV9aknD$n@At0PFC^l`bwXd&FbX$kKCnMc0cP&>TegBHJ z5(AUf?r4oJXl#^*X$D`3YGXO1)gu{wltgEwA$)M`9Tb!a~czAZ0nmjKn2S+8n zIs*%fqAosCH=6-uKn>KeKw{qgxu+}aInpU8d>p1fDR}Jx62$?}WQJLkpP@OM<4K95 zGx?$UDumCjW-84LRJLDGaI~*8%-j&MGIGkV2>wPsKxd6$He8W*yEtez0M)~M&0i>K z*1SADr2a?WF4wo80cO<>_oIo43>K|ZwYrlqP4oxuX9phvrHf-UP(URhAi$y8xvAUt z>My#&H7J&VjyKRpL$mrCc~`8B<1?-F)U4)F9F;dxx<8CE8ZKR>)#xgh#Vk-f$m!^I zymE~IH7ylRAbNvnN)9l}Z4RKxW*5TrP00RS<2I>CnH|KK@5-i=E@8V-)FLOCs?y4706={&<93cmT63A6)l>Kwq_VqVH{T>Lk`DlH& zH*1AH7lXZRIQJKL6sT7Ma9Ipa6OSNTy3e8P-bB8NQWW6<3*CNncH=2Y(7~K73@|CW zFg%7A@uga4_3lzvX=e`s0RdUeo!y<;rdlOMSnuEKDvO(k25Xurs!!5Bf2_P!I`w|& zR;aBH&#k!t>hE{nPxYmx%!rCKjEsZh}Y$|rJZm)T5~wS)sW;ObA^iCTg2 zY_2@J;uyom+>kE0;aZ^$t)4=@`NQSqu2aG+@kdqX&o8N)LNj3)s9R2t z7_!NeSo&GbgRj%Yuba$L_$;o00f)0T_)0yc!pl9tEK^u#8IAUmQp%4Wv=*iuM*1u$pQ0p z_dqNFuBhbEkUV=SAI-!+Hh)R@l#F>mRuN39qq`f&%Q%rR#3;$4qGF&~*jx`J@Y?>y zW7O0?$&rtFsnAy@jP|IQ?g#$$Uh61kx8(FKTf}|M%E`*k_Ry!Y`erv`J>}0pEYUEG z8$IGe3Tr&_gQ5wq!DDY0oH^`TQgqF@EzT!7$Lt#+c9;cv*|O`GZUkGq__WFhkBFAB zN4zC)sM)*y#d13DaH?7#`5EzA_nYctA0q+SaXszsvG9a3X+YH?V-Z#Uj%aERjPROX zT6&o1jj@vRtRa{1%w720(}>`iP3U;k^6*0S~N=N z?n>tmZRNu*_h)J7QxXyq@>JT7AIh_i(X3{2_Q!L?>Ay+$Leg2a1Ed4`)O{jz*mLHHZ!O;B0t$T%j*Z$1*;pk>4ydo`hw_-s<~=P zr;d}0i;JE8XOllOk@nq>H2*qhY3V}{*&#+fg&=LOIbgpc^JVo)e^;L6+g43J zgXK|mm~;ZtL5yPQS&n8TDAk80d^$&XaKfRYpg=(le5I}2RbK8e20TlAN`nK)s8;~& zQTc-IQQ7_vrJMVsNFa=s>b==vSs1zN&-M(5;Sek=tUF{3>I<+d<|w3|U!O@OrLNRH z8xESQw#+^Qbg^n4_4EVCgR>4fKLfG})U;Y*H*$U4N-u}eCf54m43Z32^6!A@hp6Z| z%FJILs5g@`YA0823zy-YbaNs(AD`^Cu}<6KcOeW^#=C)p@iC*Li-V=lGmWUG@Rji( z^G8(pYd_W#uO^)&{+?DpF(9a<_bHHaca^H*#|QvT^h`S69GHMT>s@qol+V_@b>3 z{w!VOw(Yp!4C(?nTp@)o`!404_CN3v$cthxq*O(cy70e*1}o3ki`}m|{2tmv$7hDt z(4l$FRj3!wX4t=T1)rYZejg*yZcPCMF`L3ze{Fl`17y<3!}=OdzXq`rHbnWy;lEEm z5{7__Io9FvY_`pPvyjrjsMEML{b71AL9h_u84L9e=@FW+0<`AB{07L z?AX`C!Vl)xcNYK&@~IAx19PFLtp>jQXN|?|$o)F-s)NEHn_cnp@<)Lg*T0U$_67I2 z+R}G`12O5l?u~hQbG}_+aAFus2n>N+xv7TDZnWkb@ zZVgfnOYH>B7lW&}SGLbyzWMdTLvVd7B|L>Me~vcIa-kli9vvfMeE=E4JJa7o7Rl++ zL^eR1s077QK+U(gbDVY45-2I83gKEj%Rdgg!y@JR@#)4P8pQd{AU0D-70{?Oj+zJ# zgw|Lt&R_ga^%17pQoBX}@BvX}`K5Bb-FC@BeY&G!6nMffEhZqP7hyEUiK&Vk@UXkR z{GfO7f`&%#n`qsOQiw|(<{k&bpCv*{M0C7AW7+h54|AovR=;J7#Q-(7WepKIEKCQ1 zpv7FZ#4v#06lURo!2uL8$-}+^LwJ?h5~(g8vnI5v$Im~2>BIdA5R5BZ#{cE5tN^`x z*|*WZdW}-aD0_c%@EkZCW;uk?XrGp`vOXcZe~vT~@q7rl#~vMHW1>OA$N=!|jNmOu zUTOT2l|?;&Jcektl?HSjEU7n^sl8xRS-1HInk%Do<#Yi(8d2YtbeJ!OQmyQ$MF+iF z;B#t84c}awEcNvtA!i?dc4)V?!v~a*FD@=^ea>40BYbI%qM45cWmJi@xmzB4I=GiK zH0BHS1|V7l0<_ECET_}!K7?T^O2DFxl=vJ13c~F*~u?jiL%D z1@PG3Tnz-{KirhE3fLc9s*w9a+b#Czfo2q>?e%*(N4~|I3GD(_K|$4GE#T~Qhak}x zRN|(lrVdGY-F{6@B97uSYN3!2tOR0^(A`T_7{E_&qQ1VY1rwe1wqN2;_5H z%*M7s;ZxGxZ?JmM5g)7L@k1$Af9}>E6|j&bS$#~7wRKwI3{xv%x66;41B9woK)@Wh zHTinJ#5pqJGIC)!_+5UF*^t$FjJkkleT!tnABmFS4S{N<6-nP55VkTL8y}Uos4A>J z24MIFnic$h!!1CeGOo||R7x#LW@||wYCccnxtKfEnwQFZRg>_Vssi3f>1p{YCNWRi zhn8k}B5qPnQ))*0QKVBg&F3pEWP&at4+oMFL@$VXgb+h-K^Y<49kA>?RwACEujzC^ zyoE)~)GWTF)^C1P#pq4y{ZV&*Y!H~Gcc;BEuy;39`7(eWc=bv| z2T)ZqF}WSxF9&RG#qFql3RC#)Z>#O;=g}c=;meomkDdX}oynpL)JX0BjNF4`2GaHO z=g-bgTwPGc8fn(%XMNq^U~%Lc#FvqyxwxGw4K^0wkMSO|u_m0Z9;|^PVNDRdXtCJ{ z#+GjA%KgY8p|=sd;qG!FIevFG&06nA2GlsCpRBG^Me1)D^VOo(vScnZ(*pV98LSh5 z(k6OSX*`;&iGi$X4?J-eb5&;J)y3FBk1^%&Ul#j__na!yE}harF@mkAFW3X z>Z>SZY+LT}OkbiCZVm10)#u`JuAr=%kE&%;)O4!)t7*5obmq?Wp9+61diV% zbM$t0O4Rei?5vi#oUOi)OEZq*M4(X8z<>L8y9ikzei(3OLQz2<60=w1D1-t zJKIza=2vzO`^{$4`+(M>b4yf$SEGBoJ(gYgjh6V(^7igRCWb~uXJ>09y?uw%Y@WiOVLT>H38mX7EbQz!aGxZeN2uhYEm&9zdA9nHb%oMu)ndm!fGUellPj}Ed8PDdMywAc zD}dA-G)A#IMMjXM$hWnAu7~kwuI0&vcB>Df5~7yGb*5z4qvx=)ArA(xO6Ks^A7{?Sg*bKmzIUsy6kT|(txzUui}SkC7(HS2@5>b61u zD4A9c-+kkyX5U|WP}3QkjYC&{qaiI5!bei$fyW04m*niAgFWDiD5_~IUVb6I>8P9c zPB@``XkW!>0(p>=F|t(oc!(ua63;LtWM`{C)Xd~4Unx+0)zag~VoS@%uQXN7H&xck zhk^}tbmwV$1e+(;TO+N`mX-i*9QgC{jv!zZ=@t=BYuhpzH%)l7*9O$?w^cG9)8BZ1 zLqZ@c1H4Y~1bM90_I2NeaeJcSrl3Wy2#g)ZaneQkWT`nplPRuD+rwhUk8+VKr@BUZ zM5N=~tk(no-Y5gsQxRxM)oV5~7c%gAW!i^lp)&qU*P#B=qzX)%pY3nu4Kn+RTf-l1 zeQ+D?x?`fjDC?!l;0SpnFCJ3~OVDcMwa%LDAE`)Yb%$ICG)HgJPPC5YMd3}!-(JR# zKekT#c<9KFEe#nBzrW@XoC(ZPUM#$Pc+pJ#B$45%iKkz`f z3RO9tfdn;Cx~;sH{WEFRG+SlAv1H%R0f^E^jR<_xa8np7-)h5engvds_t(heJUpDa zUpr#Ld9u-AzvtSs3N`7bq$$3?6S@slImmo)F%vLT^xiQTTiYhR!Y}*Ryk6CoV z{{X$=0dyF6T+Bn{cUIXA*6Jen_=zoM;KRl=q#Zmq1?!~>8YUiNzwd4_|A8|Q>uEZ- z#PWa{;sa8QuN;2N+Xh<7@5D@-4&Ba=4k@LQtv|@@!Ofz`F@&}!JU;9((y386`D0Ds zL9*iUnj0F&M?_MALdX_Hfwaw&tvh!PMM&#?{L>RGXDyQYvY>>h{3s7o8`;yq%L{AN zFs=ycmWcI;SGA>nMpVUq^)wQ%i9DF`9}Ow5bznTb5#QE7H$vP};P~5w%mx>{renw| zd*CSp6~8$GrBnz$zSg!K1_ngy@A&=gMz&e#Z;sGtL=iKc_VQWpiA*()%UHn z=-v>07gAA0H*+`H^5sz?cx~T(M0n|p5g&s9pHkjLflckr(Yyf&HmV_vFo!NF@U z=w#Dx$caC_936J#+In%nt5X1H(Lp2kH2m~L`18{3$v);i0r<36MUUfG5&EYZ2XZh| z(bX3xqog$LavF4eZU~eLF!=xXLz{G%-fL3=zL`eT>?lNGE@V8M&QFqp7 zY;4}2O&X_lL%4GM|NiPaX1N|!1!J*! z*SDPb>T)?Ec(;y;d|}`nad9C99m`@~j3Fmi!$LnxNp1amSnb+@bIJb3VUcZy^ zL&XhfVp(-{7cU0~pbH3T-2BHBhT5$$Ws8}cd_Ch`IKv_7o^K% zRtJlM8gy637PFOgp90S#xs6AbfjJUb_A-4K-&fmBmuN!*dNJLa|A*y0<^q&wRu8U6 z@2qzv=)&~m%NK>VrE%-cxC4roTm{OWn|%u{3<(?`qi9f1)X>mqRVvZqMVCWoBZhhK zf=RZ{f1SWaePy!w+W5dqwN$4GBrwdFz3xY=OYYa_={|9c@24gwQkdTst1ukDMrj%95;uv))18mR0jEy zKSIHMbZ1EVj`+8kQdDwz6%}@#v@1ZWQqV@X>lzwLUIED#@VE-QD8^Vma43f~TkuYV|)m&a9QzD1S+O$nW01yIPH*6|R6DKD#jj-QCk zRa+Dn6}h>&;W6sCo%Y})UVUhGb4G)STXdhKLs=P$O(5ss;Nas!!!o`cIWe(@)ipIW zw6MVJt=t~JImekIzvZyavC@FEsi~-X_8Z?T-h&wtKgMkN3jT5NoGi5t4-a=5XuW#n zw`^1isAUfj(^r{Ic8r#ZyK-b&i7sYELbamNtjU>_BWWnnXrs(w7lMc4zJ?thA3tU9 zge`@}f7Jz6pEPgy&NA3i0z}KFt8{IVibU_c0g$jN(ifD6jnw(R(JAU%ex-bQlW3M= zZ)d#<@=C4e!FSamY0-;xGDHOjFC9hRSFmgux;Y~%%Ge^r!F7J%<)rPseDNYXCwmxO zx*z$oO#urK&SzTQoSlEzuFr0o|vD z5(MQmV8tbT#C<&9w=A}``NVRd;nTuVRQ=N8=6?Dng^Lk@PZ{*s*Fu$=RXeJj zWveh~IuZLrAmPToy*d_jIh8hl$I%mTw(E~R<6Rk|R0>QIlc39hCB%HK3)AvslS~l! zp>`%E>duXYok0Icr0+LT=Mc?z*Y7#7Nb&J)em`ZippurBW*O;y;G@$!h;ik?682Ob z7+IIs??_eHABT0+)63XuB0DBhBF9-R)Vn;y;izemR(ig5xL>FqrR_EK02&Se3^d&t zq1NvAJ_(xV*^U}VJ_G7mrTKQH;hrV})3#!P!jjOc4m{{ZgyYiuZ3rx(D7JNw@)xT$ zVEF+uvxYg}MO5@arwLqE_KJmCNbeG51uh2tUptd78$#lbI{&)NOe$wNz;os+zu-wT zaoxX|FSEs`Ud;ymWMcTmk$TP!lgn^|()_3-!!a=2UR-V{N<0Sd*8+VfEf0*g`}+)P zT>w;pA7o@;D0=nfX?1lq^((3%+;|^|o}L~9BO|bWrc(uR!Hp?R0|&AWTtQl1s^g!D z-rsc!SkOhNE(qNBzICyrise`!SX&>p;;hW=&;N4yO~&Vn+;a599l84}|FkuNUvorQ z2o>`X_lKre5NW?l*%2v(4qrPbI9dK;+Mlr9o4|zpm9dbV+6*q%A&V+ZVq2v7ep zM%PLv5ldUl)K_&dPzn`z^86y9lVzDwN}{hEO=sZz(+m5QQ1Tk0aH2+>5Iyw{No1;u+nWe z!sA%~l%7Mdd>Z^oK^$LYM)9dXPPm=)8`@<$&hl>zOi^#?ln4Yw+Am>)e6$p~5Yieu z^s_I5D!IAu?i<>gXfVaUz{G7sAxPGvI9m{DXvXFkoiEFdWEzB3gIEuh6GN%&P@3hm z=|@C!{dXU&Su7}w-j~sQ0SNv^mfRTE)oXolV_u%jZt4zaszzx-Uq!uKNRk_UhtW4; z?|+P`1D<$!m|;ZR=k@MJcL8C~r%Jm|?DCbfL8FaH0MNVN2xhadt7QKNUA1g7vabQpJd84|Fl1H(z8hzh>gh*?V{8hI;jIz!$e^qpvN*MQ2Tj2cze z7flGWj!$D>vJ_0zSsueggtedT+Z^!0lME4+g1qA+2p)ySY_JA-II0#vQsCZcj>WmKz9h9 zmz1nY_{&GiiZFx{Vg$7M2Bryo>I#+cUcoj(GloHRaoLyBj;)}nirnF`S(mQOkJr}H zrVuSn-|bLJFA3SE8)0dS>H!`IlMNI--14vPyo=r4fk;R@8+A+1G&1?nXfr)O&)15I z6N!hrNWo%Ee{Qkxg$XJ-CWTGdlLsUG#1LY0p3FNz+oOGA{5G%;2a2fC-Pxr?Mb3Yk z)A+`e{sp7JKC|D;x}bpXV{S%u7vSU5WPn+Zjb#gxE8Ha^CWf3kc)e5P zPmh)TKw>6YPbM1Aq>X6O>_#Pp@vC#ow`)}fB{@6VHj!&>q zCE@8BPsmuT$k|@hz$q#|=Qa&`4ID&kn_LR!ek@nheH}DFLicdJ!9oj|h{YruxsF7n zlP)a+VOwTv8aX0tn#?SuDvApN>yIZWx61~@A$f{*#wLkReaOel`$cVJq?6F*v?mH6 zd@6R-A&tvv_IOsHuS5oZY|TfJ6)+s$Z$zhmhU|+ReB>Eb!@+n<$D-&QVZ4+?xwFqX z=u4f%L3dG))Dt($Me{kNvfZ%%2(-&e)(itBc4W~#k_*YY+!^xBVghg&7 z9FlA$*cx3RG|lZpQqqv(XfQrY3s8P15`}2IMW=uvdSvV)C|T5pe-lJ-NvFthNB*m+ z!7)xA6}%CgJ=Yk;_%{K*8vUc+5qqTl;7N!GDQ?QY*URRcSupm_THNzK+IPACwZ`=_ z9sUS6a#X_1@!cenrZBJpZUx)T0TA$sq|l+nVI(pV1C`lT1fGJIg_U*G(2)=NW+XNJ z+NHL^Ofgwe^yth3z8T7XFO>dZdiUC&!(^LH)Z zO+otwbbC4H6GTMpLg2jYqj?JXdEsB0o&5sBwJTQ6oMwX5^e9u3@H^5zc`BAY2-ozQ z{dcE$N~?q``0NwX45Z~he<@z+k>LPv^oK%ofe#jEuPJk<8du!2#@i0WX zd)!tyA!CGS6K@l{pfJ|P%&4y~W@AoZPWSJJ|0gVMH-@1r%md_jHDf#H*hq4^ldug@Px1Sj4(EOVa6bCih->Su*N}kED{FIW z3k=2Kdhas`QaC8|1-(Bigr|k)QH)-F5e&K*WJ@IUhBb~5ainhN{s%-d#G zz>ps2OZFCcykqn259khXFq^)7edSIo5WpcR)T@?5tBA#vaZ1f(>ipuQh`((ht;^r37EV9y}5!s`bLG<6iRYcc!mZpR{SE7ZZ6tvt8 zCM<~pHj8RoM_NoP=4a&T(z0w&V)>l5*PGkWh}|t1wjEY0mI=<&x0M>v;1JQ#qhAr31cqZ=BD6F$0C6HACrV!x z$ac&e+d-i=#?MYaf)iEyZujy-WEx9l2sP>?qh^#t8Tl9r8t8Y?%)^6;f!T}k%6Dnp zw&hnNI9AFDydfA;0W%a-8?LX!KU2D;@YzG%w9JVmo1t&tNNs$yoGQ8kbBp}di7Dxx zhU5TTU`-A8Ak~N>El1+JOW?OTJ$M+^Rv@oGt&xs2+~j%*ExEiJGk@hYM?~_XA_#O$ zl1ogUm{8sR>wMB?rNI6xTci@+qW+^-Mm~hSk^dU=?VGWYk<`iq)pD=L{jIZNQrsj# z9^c3e2R#zT$=OpJ99Gx!BGhLzU;B3OLPJqJnBd?)M42!*j6{9j>3Z}S%UrLa{$FxQ zQ>p|kHh(}H`o9|C|2F1N@Si4PaYpE!m$-iTKvv56x8XW5yrmCdg22 zURF*$_9!70b=!>mekA;8Vy+`Xu5uM(Cp%(W({2TK|9AoCbI9L&tUus_ITsTz<0)`; z!Rr5CwPY0Iv962yzXoWHzoj+ffK2`GRR7U%STHjG{<;+QG`H;VBJV8L7v13!{8nwol0hCzgQ1AYtGVq)`))^6W1)yo_T{4YK>_M*CN+{nvhMg9?g8v(*;-Lp~2D@OPNk zS$PliEUrVurE`u}JdTbI_SQJQUu=l0HY!cV&p{Aohih^zaFGDeczAgDXg5kU*#jOY zEv+8+<8{=e3@)f7hy=227_U}$ILLPcmV4<^dj--3$Gr7*b<6DMxI)ot)4MI_Yg;WA zZ!^2^3)GwHq0`^zN2D~U-n*!KE6AwKO3ffXzWe{0&oeQBlvAu&Cg$W+yZlz~=TC3Y zno}M1)7L0!f?0+vg5Qu0q<8bQy za;Iq7*?Y2T#^-;yv$#AO`XN~E#sshSc10KcEApuZ9@wQ2!1uQf(hx!8lyo5lXCdDJeUSNOl%}F$ib z`=^VEQSMQpoo}NMK@K!}-1dT8$x-7#jm1>#I)ZT61BD z+|kocqrt?m$jCWJm69~3uHo=^PTjUwu?RDwWWWwcB^zSo0!6C$Js`>lEe>pGXb41> zMZD<2X$Rd*#kNN>h38{Szcq89MK1t8K@Be+vI9lTpNX%`b)lF7o2Q};nEd%#Xa+6^ z``WD5h*_N?&DPe|K&ru;3(QbCP;AQE4}x0YIc1ZiD@sQf{)q*&L2DR7J{33wdW$2= z-^sIbLb^aqfeKngDH+G$<2E&`DkL+8Q?04f+!6g2M4Hkh}qVXQjm)9<6jpx}s{F zJ2i8ISKp$r^ReG=4+U1yGRYnks<3?qhzaPG0#p{2GWN-UzCCr24VWB3!OfONba7(8 zS6_2RbFG0sxzTjrbL%?k;k0`C|IaDcB<7`9M-aXDrth~h#8rbSIcXKLV&2D zqynA5#M;G{T0Ae#7v?~pl(aN%U`54(e3ugPK5HpCIdf-n0yPoevS1u~CmZ1xgAalP z|7?_F4__d>pyL#%4L{;jsHjf2owg33uaupgos-igsMsFnY6e}Q&ez+Ub%kzA6aIu{ z_Hzmlayo=Tgwgv36oAm@+<0{{#Jbqg^OSlYTTA^2(6`Asvt(@IaI$r?W+)DS!oufK zkFlVA2|`qd)>W3HRVkv-BDR`N7KsLO;OA>G;HGJjXN5u{zly%1aMa2!r=38D?Vy7< z!Cm%>pU=>usAtn-FzG{k(ec8`I^dP2JZ9c&yr2!GgxE?x<&Lf>yw|UT+k&L$M8)^V zYEhUaDY6K^j&`aiwy^_u&n$5q2aIB+$^HF4r#%P|O%or*!foJ-;x z93X$jGwnhDd8vK2I*&}|3J4tmEJxkl(UAr0YruTnO3~UG5|1sm-fslr8z6Hl?g)$u?qy#R!AA%*mfV|DWy;z?PJV@6+q`a?_@mBL;-$^fF_&+~Z{ z*%48M%VgwQF`4BNY@u<8kx^~(QfczWmcof!{-velacLzHe*HGFt{>`jdicz!@;QeFxBLLsYs*L5rEB4Ij{rmSlh!K*ibk8}Ck}8e!#(hpt;0;jg z(TEk_E-OOg%4NTXiM*Tv?$PcyDRgg3Fb)8KCC%h>uBslaI7BMwssobnS+qbOR!TFd zBicMie~JyEfK!l_DBLkP*4moyzU%3Rliq}E*7Vb4FEv-V49^X^8BcvHdN_U*NQxlOFL3ycmO~ zSimNxm2;}*lzQ3ZgY~4Eh^t7VipIFSvj3fv-J6RsK^urgR$T`*liWykOIz{Zo_hB8 z?{*C)%@PX<4f|hW#871^Q1whbhAZoA;6!B!MLGS&4q#A0*J_Q5O=^>g+9ROi%ILO> z-vW}P#|?1SgoHTT^q%N}g(y@{?s3Ay!@W!4B;p8Yr2w5m=p_rotlR(+9qsGafEiC# zpH=DI_Jsq2rlMx`=Q&B;G!wAQ(IsAdt`^q-G(E`<=Bx$KZh=Act)dr2>DyA$3DU|Z zjkP;_dto*nmxrP=X@_5+jqaG1d9Sl9Hw zPEU@78><-vpkx1{GlDUms+R9;{@)kLnZ->~-e7aZW@nC}S-@|}7x%ek@+=CnvDmGl z$(+0*3A;Yc9@safIAdui^D14{>f`#S+nBcqv?{C86;5APsRtNlE5YnCc`mAGETW}< z+;DN=+YV>B_)2AQYSSrdbZ~QR&6l(ZRNa<`52>&R#+M3P$6$XB`PZ-g(ozGf_hvzI5G{*!_W1APRM8CB4^-)lnJY~Q zC8FSpN#$2gP2Q)(oV~jJ3OiQxKDVTtGO(Q2(NR(dItJDb1}3J`5Uq*_xX3o<}SeQc*olKbdShF|`VzDitL)5ukWtHU_LC~u-QD59eO(V288F0xG zvFS^{yoRkVSV5H=X9N;{dogBX9Zc`OA$!{-c2~UYQnnv9WG2th^&QA%KJ#_3v2bJ& zLMJYPSH81mY4-H*FtEf-p&QNGDF#InPE-ZhG>Ag?H2jsn%rW(;+~I?OPd3>jC>EVo zUIm*rz2rs3hT&V0k*tiW`x5VqB>LQ@npsVr^8$8GIy%|6HC|StR7gnIpjhf7g`43a zWWN)!9uyLi#O3Y+YIQ{5W&mKeTL7)^G#bD01?a}6TX3yEryhNHxE8u=Kzevz@6hCHTS&P+Xm;p``IryD z{+m4c4^_!Zej`GwlH-0i|n@+pceP~Yj59o ze<7T=OWjxK-~TMnR2Vr_JAfYE`HIbLd;E?F`FOWwj-~ktyy2D$$tJ?6n&8F|YfCsr zwM&yJbCieqn$JBW>8qR1K<#^7LRrtrgmRS#nOZDbGVFOs0LCjNl&id_fNFLaaGOFG*^?fAhpmr>hUbr$Jh{4%8iP`k-HD6|B~P=(0+Co&1=uY5%sP)Z z9y`3VphO|E`B?oL(S@Y+zF42Xh2=$V%IxMY!xPxXD6xR8TUMgn8Z_Hl0m$OI1uzJ2 z4e6%cE?xe13Bh}_u5-~ptCZRN(iK)DpU-|j+P{4CHLN|CKe$Ap%5njzR~`Cc1z^Gg zasQ94w~p#Ei`s_i5Ku~_TLh&1?iGT8U*Q(?(X>Z z&zX6i=UwYtYu5ZRtbseuz0W?^zJgX0Y)pzxev;V1M zL?E6~c5(TO>iM?t2nm*l7VRLfpEH5=T!xBKCSg;?)X8bx_FzPxav4py z&zGzDl^Ezz8pG|?)YJ?NXmvZIwu`p=lti{PgLiT07De zQi+*bo<`i!%(u4DLi-T@#-s`3EkxX9VU>A$J*3xmZ zZ*v-9#l&=xiAD=Oa8;2=`iizX*Aq9~bDFB)yodb-%R6y1ejH>q&ovDHnl6V_ORDJhr%ugF=Re_y}4EPvfM z(-;xb!jXBj;_a_$7d0~zBxx}FUlwhnd8UTD88@nXxVedbMEGG?A;IIdZP@B@s; z*>yK=OrFJ;<(a2k6|V6aB}AWI@G@puO`b9aT)*lK_h$C!3QE}C=4=O*2z_`c>MTpw zh5HdME*{+nKJQsD=8ZczNt>aK4S0D?c2ec>?{N;DiVB6%5?SLP%^k!@EPUnz#4MVh zwd4HEu{$Gmy1Gn~PU%@HqB(Sp>R63wpOsm}1qPy%VS#B%0>#u%T^E8sPKO_NZTmS$ zg8ZT)aO*=zX=t`KHgxl~9Z^r(!VB~&={rI5kBRL`C&0uceO?2ZCYXrf4NZj;Fgdq+ zMdc9Qc)%4iZ7&T^%l**gjQ5g{Z5(wI1-{3!f{ch!7m% z^x+P<3;jB&-+x}^FbcA}bn}X;s)2cL!3oWL6|Y)r6B85DR|r~&ZMc6dm?&L)j}A|L zKw{3U50YzUagT=Cp2HkCx*M(XE#*{X+N;|)pWk@B^OjWSd5j%;3$@@?6XsD{_=WG{ zd_5j^NO*X@zS5_uN3K9X>E0MG;kb~HvWDX^cAi>3$^IhGM8ogqgkdZsnv-jZ)^+C6 zdbT?fFk_bsmRudq&r_i&?;gmZi7MF*Lq*vCz^)NSEpQHo7cYAgKXZOYz77~eixKKP z`*84y-@G;|GTrMp1;MWeqGrxX=@Q+jh20pvnk!)5FVgF2Rw=HmtnA=WdhB_CjEXt1 z6gan#`pDU7^T{`Fkf#Z|Y~#D)|GTgsX&kb8kU2gS5^<+qHg`l~Ir}7s80yGE z12WZAUDoRXt~qHL87dJwNiSWZ?nKXT?!76ngtN4WqR@^pgG0bn11kCTS-_t@8B{jh zF2Q*Qox8TyyC^7(03_<(OX|;)PgL}IF!8*Gp6i^EV(1u~=uRa0!9|t+u(VXC%jTay zt6cBjW3XPiYMGfan~#9phH18dYMiA2W%U!1@wMj^&+oUf4ptqMCoQN_ukxAkTVG04 zw0y>#v6RK?DJ}KwQ2(l3_5~yX#>Br%On!nTjD4hUnydMX3B^vCy#Z-{;s6KQxACvcXsP;XA(@TS)6U@AqRG4EdP1UC4sk+QgWQdWDofXTylQl~fK=}EfQDA`EJ5k%R?EmSvmE$yeBMb7f&EhOJxiv+&-O7% z3?}yvAeaFqlX>|MP~d_>1z)c!_6YQ;+pe46tn2TvF*g)@HMN5JWk%`7++VQqf6PiPPxrUcipj{C4m&Df$hCyVlcBL z(tWMRcpYyEJA*s$5NpbqmY=_`?oEE&L&U7pc*VCP;aUs_rkKggK%I-U{fxas3|wYl-|{wDbMl$PF-4ab4j z|6r9bLHO0D3QOd9aC;r#`iz@CdCmMjx;Rh9*nRzEAhPLH*obozHAHK6qt(^bDIc4s zBmaB!CngT47Xj`AcMcL<2BSiqKmj}<#ita2MjDHNrFMVFpSA^YfXYi-dV8&B8j$&M zyqF#;o2hef6pocyTqoz>zN~c@=o`xu7P7&je$zn&P+zHzopJD1b@i>3O?HdLzT&YX zmnQ>*gGB6RjNX@DSuG4mH=;Sjp2#aIX4{{7a|KP_sn5Ke9%xbh^yHQhVHO68coq*d zn}nKpzsJVFeA@qT+n=P?cqao;A_wp-pn(!~E!^{@x8#OLVnU)uflf<%yUk1*9ag1V z*;#|HzkItWK2nzL^U~KLoWU-q`yD_$&pbNhrV&3cpi58gfi}eNeZ8V zu#QSR<|}b)J$dz`UU9$kpExk?iT1*zGcCC++zH`D0kkG?u{%)lENgRpN&Yuh9XTA{ zJw7608H^~zzyIJxVObpj_RVv^4!~UbTTM1X%67$N%rG-@2GPAK3XHvXQbUDa&>~HH z46*`kbF~V>z@S?NA@@74YqPWdm`lAW8)Lt;wjWete11CffE>Z`EzwgqnYVaF}K{d4yRILto}!|DLu9Se(Ox&e|EA=r+-*qM`ZkkciJWsSp= z2$1<2K{Xai`1l%Gh%GkS^8c`d!k9~!Ssl@vZlj5v@~gTqvg0wlS4@m9 zRcz)`RWTDB!ik8xrvcKJ@e-47+=>L(6j&P4l{tz{xN}&(-<>GM%vb$M!koh#Z+h_5 z{;6E^;}F7T73TcX2rLfy<5i=CnB2qg!r|krJ|xD z@UuGHuP$qWY4QH9`n9)%0B@T)58Tr%L=QrfSO1C|5*F-nv`IA=A+PT@Keu{q3&0%k zK#@fyR4`X}ko;a?SgxY7TDxrnf}O+ALMr5P z?DJO8aIP8hD8cL>&Cp_`Kv5GL?Ngk7tVHM{8?EFA;fcxq_9&p-*24vD3lwCiJ5fzxgdFv!utnY2S03I9?PGE)4gmot+&YEAK!q#&YGfYAHk74h4^u z!Y7(q|%!3JOP+)ArnvsTjYrgbt<_gzy%y|3OK%H*1*md zM0xl2hFXR&43e_vSQvkO)v{l9$#|bj$oA?M0NVk;%gboyLHd|X*j#D#u_~9L<0;3O zyHp}U8TJUr!J8R5a5UODo2pITXNjMoDPS4{|9`on60g!V3Tr{lVx5jZX}u(B$c zIQBixMR7wWG!FPKA>TRoKw288 z4XA}wrR+XVEkNK<#sP09N7W9iZ4|NpzF!6;Ke}51-q9i~(zoyC`Da-cL zBxbX8n8kl6Nnp+qJJ7B-%=~?wf0^wxC#_F40DO`mflnLD=RIG!a`Em{lX{#Hwe*QG z?eC)O`8t(GZ9TeJ9)}Yr0}&BF(A9IlUe~UZ=}l3i5;RkMYxBX7>u)}%bi}_zY=zDA z7dcNrg(m_ikzzRpaOp@!tRE3fR@kC`xB+xb1_pZbD-<0mQdb*ApdU?DIm#RQ^0Abb zwjxi#Fz6!ypX?^QIE;ZMawAiw!Bu1Z>L_>;$ja1-@dcFzM!L$XLz=GvNLEr7gtIsG z<|g+NjV0mnUHtfFPT>~&8l36j+fwwph#SD_AADEi@2WqxZ~UV1`SI*i)uCIya#Iy@L};HJk_p5vjc5?m4WT1558qV*DDB=Y`hs0Q2IiaBC33TJT_hhBy4rBvlk9siu}_`x|18g(dbF2p!Fy zIzmH(JUUid1a4Q;JcK%?-3ES69rgCDXEqD5h-&nvgQQ)$!JUN5m8kKw<$t6p zW_W*R_qDZAHBJ9XxS-GU`^(+1-OK<*k*g@mo0GS)Po9u~O39<_znmzab882S$B!RF zdLq!aYiorA5w7NSv`DD z4;7`PTiRy+LzlG8kc?9gF+itKe|UKwWt3Cd#4fRxs3H^1J}{&YxAvS!0^ zt#9^G#s?(j#EL3|S&4xYY-91+Xske6{j$ymF`D?Smg5&&dW^va+kiT2zWq7x^&cw* z9#6toFqdgeaQmeBW;9_X?@8lS4N?Jp*i0`jh(VQCbai!s{bF~p`V0IB!7c*4b3n)I zcLe$%7x3RIb?>DPK%j(1Afh38n)d5n&35_s?*-arZ@tBQW=0YbdJ@e#54dirQ@@~& z$^XkV()trKOs;lMyU#t$lE{6O!i9yZlT43FgIE*2o&=a?63GKs(6c`?xZ$DinfyneM64RFPy+^8h2RknWlobWyxm?i3wDCm;mimA@E%_S?|i--#nhCt5F`x^4b1B< zDI$(4-0I9}eUCln-(;qx?0?l){Uu0Jgj!}KILoIvEz^<*G>I6pZ> z#C7-b;tWE0usJ%)Kvz@T=atxnG=#sf6hmorQU!4?t^Mt(ey`EE=3E> z&z-hLRm&`HzIycv^fE{T3mE*(ff%*!2ZElf#%tE&35g$m@?N)b3=Cio0j%{)Tue-L z^_jf4w|Ew{c8bp*5a59|*JHt0KZ=zrZhIzA8{ZS{_SOq5U_Mx=74AUl3;2AzYuH#@ zI|FyYsB&w$T`;vIJUoPfDKr8u>l;)AWO8=@)tiJuEX1~@Mxvg0MkjZ>+wrCoO>mgf zL8L;*P)Z=~UPxAloT6gf|L$dR-~(P=6}C22D>LnNF*6B~LwBA~M!tP}x{{*>CQ9Mq zAs=|w?m((&NDLDgx2q6u?CkAP@Huq_M>AAAtlSMoyw1fubZ@`^9LrdZUGTD&X+J+AytKmZ=3e)#=8Uyk~KA^OR+n<+xBVM__W6B3{`5-hV& zue4jJKH8iUzavEdV|u#&W&Rk<>IMQ)`I{~fN!<}-s`Yx4WP>>&d76HHeqPC3WIw>n zV6w_JCIIO(^k6TBa-%DTGF-nch+a{Wk$rggZnxeF%t0SSc3qTY>7GLegw-MY0eEkR6?6@vnMd4<{R4@hr3-);iLITa{E zxZnc2Tx1B2sDq{o0Q6BmbV~m4VFi*&+4ZZqfqEwiFhmc2&cePY7)*zxMpldrrIIwOdwIfQ^~3LcB~ znY6^*%EX6EIM zas2vQ9Qz0R5Mi%ZD~*@CLuWlL;<23u*8v59!0&P2;0O)BS<#CRT;1R*(U+FKg)+`QqFdD&Ghy6cNE^6umXP4 z8;!`J_PiXxU5_g&G<|)Qx5C51mQ}zL6?C#9&CLx@i&btLQ<0LISy+r!*#1dNOY`yZ zS?Wd1iJui2G(s#TIK92z$&i}>M7}?H^4;%tJYc)<9q1Hdt{7uPrYJN5Q-gOeY0wcOmm( z`l`ff1JEI6^#6(k=?3gK2||7qbx+-Tpw=|NtRtRH*TTYLb#wD+odmk9)7IF*Uhfrx z-(B6dYSdy}$-FL8WO(5=mO~3_OQ8B+U-}$3(imjJuMSMg-IoB+B_7up|9jc$;6$^Xr8lSsp4y`RM`~*K!xV%K~0{!yh zV#g%D-uCw8A18ZogE#ML0PvC85=z3RQ(6K0tZXvk%d{gs|4jJTGXXfr!&ahxkt3Z5 zg?#GU)9GhZkv<(ivqV#jmmK`AE!-2M;MiC;yTga+0}hekNF86O+&DIt$T$Yid6w*f z_rSeeK8yKw-G|PHo0Dxib=1hE4tCmy^{IurwW|~PYml%3$%b5pbCQrqp(F7r`*FOJ z4YP^<4{B%Y@KqkL*?jfuixdvgKHfff)vpefv=pulD<%qMg9ZHV{(qIkkPEpN*zH(z z?$|3@(%RZi-C%F980znS3fv9~zOP4zhi^tYI?P+UQh}ngd^b~APfrh|G}e7Zvk)ZI z-PJAUvfL-$dy%q9O-({llP478xP9jz4+Cgp|FIwDK!U$<`Km7_Wd0<;FrlWY@|&r5 zGFK&p)#go1!iWJ(KRqoTUz>-dus|Vti5PYQ3ZidDCkP-0;9vc^wUL4g$8&yS-bO^# zhGQQ!V&URd?#T0pK7c*Dg94_P6>vra)f5Hq>!B?3L2zvJo${^U_9P(Oeg7ku;XVsQ zVz~q5%rCVgz7XCRIDom&uH8F^Dg%hlUvC%dcb6(*`VsdPQhxmYeGEY>N1M|``ks%L zQU&Z=-?Jsbo;Cx|(c(rV2(e+Ze{fZx55$+}+}7V;jXaSBwlu9cX+Xe){B;3lDoILi z8w2pXfrSfa<&V{lE$YdsLaqwPyNr|W`>guuKMtwJ;}q|Ja!R+zK!hBBgVSw@`6`}+ zPVy`*PJ>lHLZcrL>`UdVaO$TII~g- z)~1b*Ft(=3a1_Ilpf^nxex(7_v@1cc4A?|MN!X!T&8qm@-Tdnph3LCGnx1KCb*I)F zob29g6mJ9y`b4p(yM@JFVqH{EuwX!0TwIiHZH4a=e7L?SryD_m1UD^h_>dYJG+}$L zc*}`pZfN+l$UvM<>HzX(9l`JhQpEj4BmJ&Q8880qNkuW=vmhS zcF)F0xiv7gZNwkm)%eQoxLQgz?#y5Iy3%5yv!a53R)SgzGEwd0*%4{Xn&;m1!FJb4dRgt zE&uM%T6ojQk(rl!dTv3fg`QEeo%v-I>W8W9&8NN?HR zE}D-emId<~h%lk=VQ4SR%zQ3(v>;y(j+ihL{{m*;us0vuPp5*pb*hl}CqmrywufQGQ z#D3{rOicefC}fHXviR(O2YxZte{n{{37e@fBQNij#mg$__i5^AgiSh$J%wu_eNd2} ze@5l(aKrNTYl!w+URd~5WSIF$F|i9;U0?{oFp{B%fs^OK+F(wvKjw|r>MAHLzeh*I z$%V(3J}6yXUR<1?kCookbD$t6wVM83=6Ek>W$@GC^5{2MDU7}2X_lC{q{^^=?q=kl z9&Vg1_h(X1R!`UNc^~$m)8^4{U8Q|WOVhdQi+{WM;JpUvtAT0@HSHB`1CweKjn&Pw z_kAY6I&Y$A=vtPe>|JbKi!;xDE^+eZ^DB$ZYgLR>WrPGb3A-vXY3)wDQ$4p%HHZByxf?5! z+BPyWUvS%Yo3kK0l0Z)!a!pNzuaa|?4tB7yt*qWqyqv7+eeuF*roj=~1%)Ktv{&0N zX*Gq1Q;Q>76({*4eH;{4^_BQP`ru1o(S3(?i&b^O`^+t|9u@f;nR=7f9^Xx~C}h8T zvY=;IRn3|6c|^3*AQg-3_j1738be||Xb(#kQ`|GYFBNa-7mqhJvLJ4^lx$nJu*WU> z00*Q#^j8ILd_7FEw2?)^9MO&L&Z#TEm zz)@kj?|E~Pq_U3AI%ww^f5GD@9a1|8oERT>UwQcR8V*kSV@5H>{Brv+vB&gQCKhiO zSR{C&p6ckl&QI=CIaph}gMHw-Qnq4xDgU|oqNn6)vdFOZ%jb}n1c~wUA$L+d{)FE? ztx?ccNNk6rQn4Fa@t(;&t+>b2Mt4Jo7AlugrYr4ptZAk}g(Y$|aV1OXV+OVbnvXE@ zGz!#iVy>3lwOl;08ZFU^(^r2y?eo~I*u`z1&tIg(I6y&t*zRUYNeRA;`n0y4f!9_C z`8Cg|OO(%CKLZ=6(9=7ytR%R#o$|$3vd5lZy*Kqbw|X?IKhS9-RJvFr*Ozd^%jH16 zntC&!6swiu`NO=YobVz8bW|Je`d8k5N!aty*$Z7}Zg-(`qD@Go|=lS`<36u+y@^V-=FEO zVX?%w9(|J=<}LEvqH}f(QB`@@Kf}DY^|FV%GCO)cWcpINj6%Y8JTwXaq4@-S3YUMb;xWG%bKiX*XtcBFVpIS`!bm{kU~!~ zRAlM(SU{WE(e1PT`c^MFAq|;h-jy2%o?o6p-D8Q!4R@t4v@Px39a6uXHqTdsZBMZ+ zd}%9vZAEF*CEt(Dx@l1&(>0STj(#h8zVt-6%E@kJY}97+CI3VHoXVEG8(*@+r3=uK zMa2;7tFLP;K#5W5$rf z6cQ3SJESA2GeaDH0AbI?@Z;&>P8@Bckw7@zb-mhJd>Y31O=rBtiGu8 z@TTUo5>k+iPI#dt_Xdxm!1e1Ow{R|Tmp0lgp;?9-9pwX41sTV#90N2=%t!T$=7c1B z=<-B_^LK-$gonq}0x?2OQOIfHk*)KqW{dXZpJQhtcNH5;|OK$M!&lJ6WP2U7g&hfG$J^0`zkWf z8RUlTC&f40hzWvfymAF@vvs~_35E>PVLp#U7#=l2BEk!L;*UkB;5K5UFvLGEUzR8X zKT^a*Lu<$ic)1*epAN}e+T?#^)^k2R3CxswJWxuW{?Xsxe>RF^mEXyuEK~Es)ahwp z)0h&)-K>bU^-CU^(38he9_D=0Uy$0nmDSXSa_1UFWbR5n@^As&R^i$Jy4-%{@#$f7 z2$D+l9j~*bs#K0J%b{9GF18_a6C<4GGCicBjqTu4c_{FDJzXqVDv>)fZJ1MmHfV}X zujysk_3L+VERL3jH+u7hRdq~%8%&+bOoCXa;&44XqWzX$pXks!rkjl!wOzNWcblys zGCU9oR-|uEtz92%!l;F%J-<0_jH-4?K)@BTZL{Sa3-M~&R9D4-!B4_$@^d`i48FW( zeL@EfR##`c3tvh(2}~~h5<=ALfm3}ZL(iKV-{+*wb^^zooppS)7MEw9 zEh%G0+uac!km622YN|{1u5Y9ERC673DGO_& zly2FNN3)i~lqf6Is&QI`5mpHY+u3-KUm}+Q|H#EWiM6AyuA-%`qi+7rdCYV934Hsd zo{+FG1-TQ2J)!~G`R?Y{p__ldBKQ}H`ECk~VbcvAX6}^tKUWRPyuL{uBv|`g{xxR# zw9|O`wC6q1gQriQ5}f?NDZv$gPYB48$VJzK)gZChBbro?jA8O+)z2+B!L;v!Xs)Yv zL^m^%SB{zcUtmEz%wf;NEy(sh-}1gXTV%UxPTyqy_YYUPfs__yO~z93Bd@>M)-d6? zZ%)pg9&~hc&M|%014P<&T-^I}8}_T$Q=_2jJ3c)HQurP?G7}2iUih~2r|oCrJ@M3Q zZJtL{IJ2T6CyZ=tc#mm6>>kHT{`taa=Kq91rj@zvUgM2xq}~sIDjcH5D`4L zqtf;Cri68M{kBM>FU!8)VMDAeM6s~WYC zX3#qv9`Ca+%?9ygCZ~I%Uawpkh+;0V#0(8*e|jG`y(+A`cJxCk^zt;mz8xP);q>Ff zD<0=fO49S35~ap;BRD!DP<(tR(q(a}*jFMu3nvSuN*o)kZK;!oRTP77@Sciaye?>?P? zs5}yf#>Bj-@Nagqw=5mZ&IokCb8NfMuyy&sMifN?%UqazEV5x+)NF{fQPdPeZ={ll zdb3p+$J>d$?%COu6D`HJS^ui4*gMs)?s`R>kcz*2`3V=V;Z6Nfoo(V!`-5H~ygxL& z^<29qLrCHlVPXP|*vzb~9*3hV`c~tgPN*oYDot`W_Kd=3YgBDW)1Mux`n}rMGELn@3b+%4u)*VwXX@;9F= zj8&~_|Iu1PEDUXtnUxhXGBTD|$n(JvatY-d?ZoA*9jS4-zkcA|ufdVtt=Cgp7mFye zT*k|No@DNEDbQw;5s(VlG1kz0eFi%GWXP-yQ7W(qNh&qh``DH`%)joYk= z<+%mM(xRN+carZW{kG#)?6_G;^3O6Vy&X=?a6Dt!yX2Q_BV;XN?YpPNxbINf0Xe5^a)v_bnZ1`-Wz7h z@hGy(PD-NqYP9Ezi)8rtv7N=(W|-%hEiO5CZb=ED`O~TO_1A1FKMhsxDvrr!WMpQS z!WQ(b%r2X$Ea`jwe|LW$?jDO`=)!QV%@g^FdRdt|k0ZZ6Z_3(anYNp}LaN9kFP)jz zDLq*F^fBnPZ32RKExK2Ez%U9JU+*L_P=G^hQWuBBxK)>wr2+#7VmE5{{iih6G|RWr z&r$qxa+Ws48D=27>B{+msa?LfOh(J%jZ&uD+1Z?)-%3ij>um{FA)VGWmq@PYIChk1fOC&9%3wFs3AK zIC;18bwV5W0R*>YzDJsgvP8ehc`SOy+9ISjf2xZ+qv4Lftjdxu!a&d|fhwS|ds~yE zFP!~)~~y7V6X(8z0LfY?X)X-26J%CO? z;U(tr!GXMz(n!*1@OHDcw|{A0nqBcT>JL^$FApqk58Z0@81t)BTij8f&Gt+q$yP__ z#I!4QefF#Z4y>_~>Ud9GOMEB^9oZOv#Xm29jHZr+%~cp&c{j8l(S1l@RnC>} zlZtF}^%ESwuemNqpzt%SzNw`HmAMs&x&Z@KJb$CI!=4FmA!=~!)EEg;`+xeeo^AP)`60AeP3E<(NeYRhrnm>n$7 z&uSifKji0uwwi|$ED2CBY7(W1bVs^sj5f;HyLW^yjQ(WF?)raqQ@*6q-w>0|jkl)J z*QzuqrYBLStBa-SKt)x&r9kj^E3?Zs+i^v6)GPStRxLQ^QLPl8mQ)oy{`25V!l|O* zb+$Sh@q5S*NnUzuTil%}y7NHE7=p2-{S=~X17Ok>s@c6k<9&7U=nXCb-F{bsfNGd) z08Dc8lrAa-D(5)E#Q6n4Cec`;J{DyT-kW-QDJ~mmi-HO|#)cw4#fqM$=vmb=k(N^- ztB`&UOiFrgX0{CTjN9$>-*GsI(3&m%py(GCriO=Lyq%b!On#aL;CzUr?=I|vsAO`r z#tVMoZxiwa?N4!gWFzj;6aKS37x1$QN!zIQ_N=AajBf`#>>0GO_p()Uwk`Dbdx-Lm zci}F1tY1iyD?Je}?|MhWr7tH#nNKPz!(d+dErrM3))=qVo_(pS^Mp^aA1})}-8sVA_uwl2=byGL-ip?}&_ zvb>xNMb6%`=!0R?s}yNMeEhzj`SGvsnk)Uh8TIDO0BK2r;%mG$%Yht)5jfH=S5ON?P7Ad_&7u}Ip&^>>RF!Cihhi9fC2 zoR#wK9p!J)KI86s>ff{Qx)E~mE%*)-Dc)yFND#(z#D74+f&)%$9C|RT1az1matt!? zB6fG}NVn(8f16cL9!|ael4e0c0ha-C&{r%m zN5Z*3w^1f?(<&}bPeU@rSv8te`}KD|D-fIFhc7KHDReR)LrAm>q2VkS4_@{V zS6cqP6Gr&d<8Nb|39^KI^84G&McsRQ7+3bSRFX14CwqwObAJ9W1Qhlc=Ci=ae7`lU zGrVJO->M%QwCDJf$s!30vG_;G|F^v^;8jsqUjU`)4$tYz_eFt&Z{1e#n7D7P^*)pN zWBj@Y@m}v$(}*{YJ~-N6`|OHE$EN7ybQpk1!#PT41OVU0v^F8_rF!{u#=F!6_vJ~B z(@Mg>aEO^aH96DVM_lE6V&Dt3tjvBWrCHrI4^DQ*r$2C_wbk6eNX6T2*;!WJ8n1Eh z^yQzVWUoJwZEq^K2^65q4~CaA;$Hu~mbQgAhDo^8pix3=uK)K=;3wp9Y7#H|&ab8< z4xh`VxsQ>td(D|Hj-`ukjxNj%yVa1{@K{rkl_J4Rb&F!jrxj;`x2^8jBd5tmCosv6kb`#_Qve4<|I#@0P(1 zHlMEx?Vze@mz6_o1=-#$Z;xaG1H?p(nuGhQ+ayqqcAFWOW$wCY=IfA=P-7TE1Juxf z+$u?ad3j0WwQt+5>zuFnB%0?svx>uzhs$lR%SsP>e;s|&X5iu2$Q7?_{vdfE#eMRb zpdI!Qy~v37gm=NMr!|7?-e-@q^+wq&W-qBkATky@s zN^_vf&XC?Dzx@Q$w`PTH&9XSO0G zH~lT@S~p@La1?*IY_U*=mq7AvSz-e@mQ=JdXSelGh*46OgduF}A561y8Wo}`A9F`u z*W#mdBo2Wc&fuy6f$sGdzi4ApNM^SCyB=QsU7P&gK2g_ibd3eKw+9>_`_bS?qQpRu zN*REOH4^^szoR%+e|@Mdlj$Xb6dldT&(F`!KHSRb`+EZ}FL64!yu4hFPEndqnPsmG zqrvG@lvv2(XH#IqpWMpI}BBFJ)PsfSB@>(QEl<+VRn0Xhmj#ga$eis!q$aEvbN?-~IOChnX(Ga>M0OcgMs3{!I zEcs<5r8`AXhNIANf|H}8XBQU_-N0;S$m2th^^OcOD@y1oI1-h}($R@{9j*(&xs*HT z&6_XNJYvyCMt^3cJhHA`zb;)|mV0n~cE;gp`hghZKCqHrmC*Q>DG+SDp|JA7mw9aW zR?cwdIu1@M1k~j^+S>M`goz{CLkAmNEUZ4szpMVRk2SYM1?K@NcIDgL2P)5>-&;EM z#=TCHnp7$qfIpDV!pyN_a*}(kSInNdCK#whvj*!k0Yw5<{It~M_7x3E}7ZS%-$EtpomBrf@-0xygw!-Fm zjH`FEJ0T+KyV#p7eom=>e`C1R+1OaFFpj9Onx!lzMVE`0@w50;#)kgc=;u`)ZWY>6 z_#yYZ?tb|2K}j*`a8dtC5C9EDN!b_5?zAh2$(n61;(2Fvi{1KKxjM<8WU!uDX-WrG z99#QE?~g|(JVA~@QXR8Gsv(vtDk4eyYjO{rFXaKN5`qbsmz&~0M>D{=l0JnIP`2lZ z*nD^MzR=(3y_PBn&b02i0R0P)xm|10?;)mE&qYTTjE z-}LCO%kC3M8u|Zei#&5V+uxe@p5egQ9Iw|80DLr>qo&BS?Rv7V`{9pbz%j7F~>&*#)ca)|T1g5hYQr;Io^&zwq$Pc~`I2XkPMJzls zFDIaZP}3M$AlAPe`5ZbL7%yDqOt!GZecWnQ@Z=-Et8dgx7+R)RV$o@`L4yqG73 zE7y>>w1jf6BBqKs0RK6;;q9{VOA{=?Ou}Y%SX77D-@tvYEKP3}%h3F~aeJ8udc<5? zG&zX^sv(@9!?E;>7dG79VMxx0*{fAJ>SZl)JaDstJ!&P#N) z5C8W?hkKqK73wBUl&99e>eb_K`uJ}51IeNN>B-Tcj%eH9;5SpHCZRycf8v{ZwmVd6 zuAEK66!j|ReOX`Lmo<^!n!9JcyD!Rb!Yc0?FZ=nY$^CG7Y{lR*8!kKsqcULM5gzy3 z`txc|ql+8%d>=U~jgJ+T|5n69W8V-dvYK297_SHP^z?XnUW5^J@B}IB7N)LF8|`5WJ`_BxC>SghZLhq#NDe5? zNPhPdFs3IX0*4N(I(q6!c3JB?Jf>Uj97{pFnIayf=DUM#m9e`yp1v11Mp8H(5y zNfc&-vAPGD(u8O{ii|AnIx+8QR#jFu+I@d{bD9#r2xg54_>0!dVdxx#%{yTMkRsJV zr*hluuFqe;o-c`(2TVAQq(6Fd2U{#!nIP5@Mw=W;3VzSEk;K1z;?H5su}OgO{TLlr z1DnhPnT+Sy4m7J2Vn0#3RTfCd9$7E7|E~3ltuIci9Lmqw8eDi7E*BM|ypVTQYH;@L z8l5JUA{m2^xx?pABuihko3t3`-qZRwFRS;5t*}PD+Z}Dt#~s>Y#oF^4%6*zQ@--TB zIlsvouXc%gB&Al*?PTG$JV{b5xZWrT3ZkTRPHw!cUQLVgl*dv@arIl5*-%{VccTawg z;w(KjcK-i?*CtzD-TAjgUJOwfr*eXUwx%@)?6uwA3++FDHn~Cv(iLR>dS-Evgn-Ny z`q6F>zGZnL*53K8@|Hn3UniGj&NqX`AFWP)%-&~|yJjeg zX52(JS}}j&83U}D$wx7~7~D*!wv|dYP5aAJkLH=j=eLW1Fn&|bwpe15o|fi@&GKIO z+XxcFXD-i-CDDSgVU5bYKr6Zm4>H7RFuS@}P8qda%Vl8@U1`76ZcVi8+emYDIKGQS z#cgJwZDFBhj@`rbkf6tXLtQH+jk{d}m7p^hx$>oX@d>K5pn#ym#`-f|)ur*hoWKWs z?mB#D^+KqH^#xVm3(g$h;1;f}|E`RA6j|`G>i1C)y1)HujOxylOgCCmuK~H*?g1TZyU&aMjKHXNHSbsYPiIKd83WLSM}gV#Ryo|8K|rv5NVggqxU=CT zYx>={H@Dhan}0vhj$B1MyrGu5pf0!1u&In5h@Tj%(Go4_Rq2=)tC(6?cgoVyK~Ma3 zMeCaz5960kH{~8^GvV;w4Zy&uVIoFHcXz)I?2%)5MW+UnEPH3r@LS&a)1TEM9;BzC zF+8u&{%H5y{si!d=FlXx@@teXIBvp%f=s+t@J7}8V%uoS_t?q#tj-(6Q5WvvK>h*j z(G81yl)rf9IAvESMde~gNR1U_WS{qupAj@1A1zO@R4?xah_lnL%r9@ZqVhRy&f6qK z4o>u^6inhKIiDV`&dn^(EKYoWW$NC>{AS7yrw54fH@CoN&9Fj{%)6)wZQsJyw%EeO zeLbO=e!9kd(DNwVpOKjv>ysUPsbw83+n<17z`;zTL>o_b8Fh77t|aDH$H_%c&nl!) z+PKq7As>YvOX~`!Im_|7KP~Zk+C>Jla72`mk{K7!-WnNEsw-w_3pjT9kQzzN$HGF; zX(}Ztc9U3wIh!Yv!3~&uH&dgK1O#=XQ9Td9oW-VOs;E4DX*;?pH{wKwLXzKU{dbXJ z6J1abj3L<4==!XHxv@G4xP`c0lusy>-4lgE3+5b?CJ*JNHpdZ?)s^3`iD)unA6C}K845y9&PH-e-zX6e z8OZFN%=%4FtWF>F;%IZyi8qlu_L3;r=baGX31X=Gw0^~O-km?Pa%CfEYw^>jk5)HK zrnbNk@#Juaipw~7(VCI@O_!3So@$QB=icb3yl8ld6GVOa*IK>vzjAO!U=39-_(-}E z1RS?I1eBuZ7t@H}kqHv#b9(qx`9S|7+1-KX{1?CeQpHAd;7=aM6@i=HV^3`gYRCm@ zIXnNzdZ~N&7W9map2cUEKkWw(;dV-4w=lF1w12RQKD6Z3MTOO0dHu>3?+yF#pd~@Z z3@~ap!_MxGn?Z)SKRV=2C9?58ypM~MI~t}>V>FyKEJ>hg0Z9G6rWL~zN#m^cI||9c zesUu?K^Dn(a-P%*(27m)?x&$=#VLrrcpo3{?(W_s3{z?DYPa;__KvTtHGMM|sHU-O z%*=4qg(h7j0fxc9y?|1o=ERh8#l$dK#G4<^(v*@c;)yX2SoPeWY3ax?T1hc(tmx*! zK~M-1qt@=XB>gQ z=Vb$5EW+HHA-$y#y>*$SlWF(ny(yZTgeU@bN;-8qVTMCgTNJx2D6qP8{y)yXGAgU+ z-IMMHY3Y&%N$Cy&Nl8IUx~028x)GG_21)5|3F&T;l$2)ntN!o3GiyG~8a}dK;BfZY z`#jID9%Rb+RIkOx!}`SoJFa_rtT-sW9!!xNLgFo0D4GG7**7&Ey{Y&5b6JJl``pU0u5JGc*qx}GH3;h}UR0DR2kDA(qK6{3p94nNBu0lau zCK|`GEAg3{B-vl2SLkeUg4pf5o8zAPNmpM8!lD5xb27R@`ep5Tpn1o7!^#H?&AkeQ z?QFz*PD{hX#gHzS+@B);S`uyKMIMyGmU%OnR8|QS(9pfW9zpr_0vsauWr&MK_ekdn zxYPTHjGVqccv}Mw+d~@oXS7?4IiO|=s`b@*_uz*ycJ$d-Xkgp-H=dA7#C|0rFc@vk z70x=psvI3={TewAJ?pA?<$N52nT*z!y`M!w!s~$W*$4nY(SX>tSq#b0N=Sp=B>!Bo zmp3Xl2KQyvq^<>E8s{dv6BE@e-e%hG-{Y-38L3;>C>|`mg>#4R9QIF?yeM!?O`QQZ zI=4@tCqk3z=M+gPA_e78(@Z0k1O|=Fv2CsmKsxlEWU2Wfo1F@2cSx*!<1oFpVJ-@o z4qbtco9=P566JsK%$s-NZKVzNTrvko^_L7^jE_3$A$}_^0S@qzyUWJYH3ExTq-J)- zmGDKzwn`N@Bhji)1?{1hYlT*M(&o+SE&^cr(^`BD!fJFpy zMLucK7sTM$fwq7Do=_x9#_xyo*yC!`>~WJ}kD^j~8NuJ>3&^=IcJ$t6|8lR#D zX?c0sw01?3gw*oL`+G;}2q-8DGt%g8RN}!xE*hU*_NZiS0laJhw;P*G8OmKlU7 zfZV7O?`9~6`&U|ya0aA7DXG5le}g9L*_SvSGfRPNEg~7Xc*zcJltwaF&thV=ruY^} z-nN(;uGyhI&Kg!c&bniSrHip-Sem~?4e~XQs~Vsx_xlGT?8&T{diVyuc0D5*)oJBQ zdAbI#!1YVf4@>9|sQ|z?(cPKelS<6h2%c>vTc6~I=#?&+3E!Wh@R&n{}B|b3Sm&R>1_0|C}>v9g^*D+TM zglezbIpDr{fdSHhNEGARO;rA<{TBB8*{*gXI9%(O%XQ(Jh8v;qZZ0{>R=C9;w@IgK zoyhz_?2_sr4>X1IENfy_ej9!kI{=twjF8K-ZXdJZ?5~3 z7L#vN9=Ft&_72~(S30i#PGWl;+D!3olmYBC(2|7 zQ#kIP?C%%)Fsb;300J#FRV(3=KF{0mo@n3vZhQy;q+-g)q&HvulgX%|L=rVC`PDC{ z2P5v6(9-cR&h{>QY+4cYR_lCDVIYX=VE~X{*R2zZC2&+bBU9#Wejg`kzgqWk%mjy<@k0tR2#Uh5QOFSfPJfmG={e zhUEYl(Q~pdhi>ArD8GjNhbv7wtpCC6I|20j_wPUM` zfUIhQXzbW%=+? zN#s`xD>k9J%Tud#tM;pcij5k4$$_L`2-x}On!qO={(O>Pb*lBQH(%u8R`2wLyhffa zQSbenTMMhL?qSAv(q|N!IRE3%N&J<^MTAoBzeeTpQOG{R-j4iq(Sp|3^s=F0&TtpX8lbD2C$jwuEI~q`=o82LZ`P`m@BF zx^?>^hXKZo6g|h@qV{Vy++B3Mrh|P2Z&SQI0_xv?Jcuhf znTWcmytG+etu%VbvU~oUO2B`#g+NYb4(;Ms`*^j5JNjKVmi;uCfRT}r%U2*5K#A+2 z-Ne(xlCihZ#_IoBSS=m%$c|1i5ou)&CSy1q^FSI}+T^6<0S*Y#xiBPnxtn`p*M4|# zPl#)uI1f446fxq^9c2L7x62A8*QPoSuZu7fQ!`gyd(y1ug9PV z@CV~Gki*no>$8eqPqqQ%@{A@&F@ASDjM)mk%(TJnBp%SGcNU#6NTWaQN@;O&;Bd5` zQi$K9Amu%w#AsBcgHOfVy#KA41!a%-M}e zy;)A~xb442F!U_U&%d{4B|q&iR0xlWNg2p$EFyGirg1;3^!@zY zj8&a-nyIpFZ}X5El_*i~Wp1}%Gw9R7t$%P>5kyjaE!x2;lJ5HY!^y$(F>#pBW5NPY z;oRxiF=qd~R$hJvkI=urME~GiV*sIYB_*68T2hBHzvj)J4J`$? zvK&=ag&IETHb(>#u^<|#bfga3P-weItB%oSo5A?rc$2GN>j3nMCKtibCAI(_XI6(q zy%vv=FSt$IKmbhb5Q5$ezwNJN9^xaLWp;OUa(j6!6Etl#!!TNPi9H`X_oBpQ25bA- zv&_ynT3T0!uB$6Pi#9ltL7-g7vXn8o2p_ZL6zOkTaGP1e5B`{Gu)y*1fB%OF7gr}* zZ=LCk;hZnXZDcM7eDi;=@OrtxyIg12e+3dXUz$R%sd6BjwVGOZnqQhtz(CNvFdqzPvYr07!(E`$xlPVroR3p zy@w6Um*6UaCIm!ydjUiqd|5(E$_yXLD647Db90@19p9!iixB^0#YjR(K>c@%#Jb4l z_9F>43n-B7Zq5BPBf%=lWaraz5c>A*b4m02{fTB*yN_aP+tZ7Lb9!&ryVpYJ+4Qy6 z%+9`jScH25ce~`JDrz7iGCGY0u2B26&S~d|Cm_%l?9w15?WC+|@T{fcHRc1vGI#;- z1;!*0cD;AsbRCH^>0t$sCpBG2ySVn*7F3t$BU9e4Oat>5c+7UEq%H!yA%`XZ-* zDlS>FbISh;2R${2QOKhy+z~zqsRn^rS@Yk`ltc3SAdURU-Ug}As0l5PD1e$cRB0f7LK;X9(BkkGQw(z>6L ziY?l#s6Q|Q*14VF%tJ%V0i!=NEFyRaL*X2Qh&Op)%-y_(5=9=}9kkt>%4{h-bc{t{ zOwS%0e;$@Ka?C`3YFA7!zl?mA`aWTQ#=F9owA2=jt6n0QG2+!-v&*-?^(5LuJTh1 zk|U>xg8*{-erQt-3%#qbK+(y?MLaIU_o(UW%1t)I+XW0q4Pn8wq4vZYI3^zGHt+C* z27?D0mN@YiXfRZ2`+VTIrx!9vW>+7@JMJpWo_hPVi|0(w^f!nBIkd?yq%0XZKx@0L zi2{9@ESSt}?*bx^5x@66wT$@gVT`X?6NU{8Px;{^qHjE!E>Mt=u-NoP z5HQJ@ZQ)mT0TFS~z>Q>)3GsrsxwwWQ9}+Ljq9-eB-21?JmcTj*_IIo3sb7uquI~KE zO!x`wy2N3$(SsaflI%BMnVEx`OYCBIw`faB9^$Kh;p$DoA)3^N)r@h6M`%;i5v{;sMfg%r9#2Sv+;U6QK&uoj4^!yFQ>nJB9e z*VxqT&>&6%iZ}C*KjDndG)+y^ZI^YNUhA%_`W%!x4RX+h!cEVeEM@{ZG0yBUx{A>AlS!pPn~uI z&>R~L?Q+X?R*r6|3PRsys(d+#b0}-_RLQ%yH-7*YL%T=gr|9o{b6PZZl?cOJZV#vu*P> z-Nde0S6kvIpz<)v>Lk%cV?(X#W7rAJUHop)U;WmNt4D{o~YbP zRRlwgWOmku8%z*h(u{o5Rirnf_Vdhpf0P#+ms`9wFHKb^kGr@mp5zNBSFnD$uvJo= zyOS8J;)m{yx<4pmXE*5^_rA9KVcZ0WxNpUBdMF8?nOFd=#y}%oJ3f8{`qfZCDJ^W_ zee^)U#e2s>Wxd!&%}f6q=s|KudEDLIjr${?)U|ngP50Z+)e5vNKyOpY9AV{{fdI`| zJqi)8E%qEaFQMI#w{LO@!w}E`eHO1g6ayO#_|2TJO(0yjm!3vc*mmhEFHaI8%Z$aU z3&crqz&|&4n-)6?i+L@sYXLnYMmd%#5_6@TUkQ_Fw^*;3HcOgl2)3~53Bt**Ukpr4 zYTRi+*KyuHncm#g)Jlen`;>ci;brjPbPx^D)BqJIN;owg&(X!Mc@h>IKd=;6Imy8| zrqH6P8q8z80iGxt8`cx(qkO>DxK~RSct*({0j+ynibCfdU64KC=Rm|{Hc=O_nGXwu zqmLZBkZ7)wM))$+Hb8OB6X zDm|W_OaETxRmur>U2XIJwITZWVMw0qo+&^UYAWsb=bPV{>iu{3q6UPdZp{JXI*duj z5p1nNWO(2yQ}_yoOIoT@a}rY#jeg?CwT(D-q9fiySvbRx1f5~4e`wP=JWvx8`Rtcl zmQXNreKHLHIHry$OI7?ft_$MO$8NG2Ct7woZnY0HWzhE1w+$g*48RHs4j%3gFDqj{ z7hp*0k%5y;xI&Ta-iLcZ@o^IAo}rvZl7P(t;w#jr_xm6SGC^ANZ7>4Hr*i}cp6X8# z*wBjch*D;2FWoRwd>1j`+cqX;)e@WZ08O!|n|emDMa_}hPb=%{L=WLg&v-VDw!Fy2!^Qe0yQu*fhs9b2C$Zu?0 zD(FO3`C`_b6C|jL3}EY^$=m^cIFY|@7*&D#yQ;ZaAj2E#KD4xy$=aEvBpM+z+bwa7 zJuRz4$ADG)EY`6?)D^Pg^wI>M1n{mr)x6nr7(eWMV+ioI$Jjmj9a5ftV zze+xclBCHZv|m&r(e2(UCH%(R3L{hDV%XY@v?O3GNf>0eA^>a}ull}{5Pl%nxqO2RxI?_|UepCsyj{*GCycHqJCW7J+ zh^^hE#7s@CVVuRFl^ragxq25~iEuaJ@AcxaVFFt4moy@xK8rG%yROyPoElh$+73d0 zsT)K%LGBB=Q3=^}HM`t~k@o>#_e)ui9xMhGM&TP+c|v{mr^fsjdVs6-E7!#Z*_ag( zx9B5uZgnTCe5_efr5*WbWw*3JbeZ9&?weK+=bTz?oDB_P?ycw8yLU69cvIgA*I=u? zE|5F@_`E!9zFr)_bi+RBAPfYap_NKYkV1-N{f3h2!b%uV5;^89q-IX~mJGE&_}J#Hdg6!k@tg#Mc{%2n95xki;1d@&AH)%a;wm_>@{ zx)X1BoxVHI@LmEQFmn~?xg-_W`?f;}j@c~>0!dGa%#IYS6dshNzw6q8lJ+Dn zt6?^-J9Kz>c=}uS%*xxe>jCMb1af!Dcc;VIJIC`-uU~j*j~c@>aQqYi$t;aL{8FYS zZChh4-jLhL+(tWhCOkXmN&(s*8`z9>KCYPMENZPU9(C^#@dZ5KiZKs*`?$BL8qig< z1#pAyH(A8DX8axk5itf#Ui4_b#Jk9n=n)VVzqj=T?lw0O|IZ)O6Pitj--W{>u8=Y- zdDfy^&tg+cQy5tMeP(fjbc#&R#w)kzvS`9))~MX!OP+h*pl!KL4n+qJoB%J-26}%V z6FTwwaJg#KR zeKF0hTV`Iaoxgoiy*K4=?~1`}wU2*R!t6*cZ*o#s=0%L@@QMl>ikoHT{ex!_F5H$`sBEyP2~w;9JZs0`RrlwjUhgi^}V>+}P&iERF$3af=Ut z?B+Ixp}Psgrl$G+A>zsAak~Lzv1+`t5_>Wfk1rxPo>=az0o^w`UK(0YsWRzq1Rz{A z%XMh=69xJB2o>|B>fm$`4g-($3~VcV!R{g<R)6uo7bh{0#-$6@y4qW7dT!wHZ!mwj) ze4F@dkGA>obcb>ef(}lBWtwrSrnlKo91kKB7KGP9KR(%mW!tUWnUb1 zD6Q;j3U&D2^2C>%+nDeuTpNa@GJnz+=lBu#ABQl)bokD<{ks6~^PGnV!$N~7nVybP z-GGKd{Cz8+s!H58dUd~nV>Xze5~Jir3HQ1Fxy!(tHlE$mVn&!m93fD9BJC6_oWf5U z*{^Yz0(tWjec!0_r1<@OHppnzlT&Cm6mnpk+O5}kdNE2%v`ysdC8}UjI0PW&L)?Ex zQRF`1uk{PE8X8Gp=0?x#ZsESG(n+8pV*gfB2-f7DmT%t+VqWJ>0AN!TxndlSO5FCZ znHO^e1k`d>o@~anJ$Rr-V`D|6q7gwDuMZGO9)R5s-U6OOEne;5x=#tof{2)ydQAs* zlEVUMCgE0P$eO?)x5uB~ed|mk=pbP$NR&}#;0H`$_%Q%{Ke_Tp2R|^2y38Ayob5?& zW9sv2`S|P)ULV`X37$ktffdm8Z$Uv*9->rmgDetmR~6sBc9uGbd=X3h0Q${;T&6KQ z5HP<9=MQjS>?>sP^XGp+*T2|(YAx8$|KQfi^}jnDqQL)$=KuW;A;E;X**AJfa0~?U zyM=r#^&ePYD+Eq1Trw|FpJ_}Cw>m%RfFOv1BA!iA)=&J?Z27Ghh(KUuVveHEQ*$J`e#6+5n5ZWAC6NGJ=)Zk zCk7!i=>En*#PT5Yt(5)9)CHW;wT1{^jnb#_t^+6@LawmI)m2}>D)V)tOE5g@`2g#J zHa7OZmK_MO!r#$r4x!j^-V~S<+uGU!ij@ctFYnqn+GdmdFjC@-3ujl-a(DLb@Clcl zyga8ZW0NMRoM>QQ8F_Y7I+F4(x#gB90S$b7Y5h}RSj#c9ag+yYoBHZS8v}z$g+GML z60ib5-UgToxxj`26bo8to>2Y3ZOL@B6PupCIlWj~y$KUEw+4u(&d$!gg03hOS5wn% z5<6yORLt*~aS9(f;Srj4s*!E4h`@2~GJUsI^2Z?aPjNeW2}A&0jWzES%fXqc&ye~p!lS{925cD?l`Nej?7a>w_q}eh29cascH%~D&OQ2sIp$v4vgBKApSYl74HHhZL=(#{L#%nHF4jQXgr3h0V zvCP+|Hj^11Y(u&43B#}`9n7FLW`h1rot^EWDA*7wAsp~qt zqZwsYq^P9oX6VpYlyW2)P4yM?<$VXwi;(!HoTrReQt^XT1+SSN)byB_7&%Wh^v_OZ zuP;VH0))Q#IbmnE6Oh$5P0ej8$kioh#PayxVnbFZZ?uC6;#&b}uxXD!I%@rd=+3IU zySjnyWKYs4rAh6q2z%E)5jYcw2m6BsVhe z2Nj^S;}kDROf->I;Oa03U1(TXWRUA3NS>>=`C=~FIsRGLI|Q%K=-Tj-rl(&5HVF7j zDA?r8VIw^3Lr8E2U||vY`1wC_1Bz+3&E0}({PD?u7W$2$fxn#9}(iUi`6afxIk^xnLg-hy#5GB#3(G!bfy zYg@U!04*PPdo-|!zO?FI-r}kDZ%gygFmC{DGgl&hWd_7fUM0x!jF!JQkF^Ntfpw3& z=R;Lz`-aF!M&Qiw&=Afw5C}*}NGvZcStrVHM?~?oQ*n7jQfw{X-HP00SIZ1E|EL8~ zImrJu_9fH-bSl2lK&ODmIpLg?Q37!9aDzU}xJ(-MIUT6y68iEtp&*!YGkIXS;Dz1t6ww^=G7Sk6R+SD3vA4Qu? zaOf#0I;0n)fk>-qW@qF>m|t&1(2Q_>I<7`LIk1jv%3nhtoIxZ5%RY}H2P5A7HhzPXeT@_S@agW9xz+zEpW?e|mRT_x&)c&X>6a#00>QlJ&F}0AF z;9fnmw&OA_7hBGuj1v05WL4J_RLl9FlLbxxyw$@~TQ3}apNf~>btm%YDKro88X{tn zvNy;PN7TJ)Bf9vK29j-(@KVfGpEBfe?%DVB^`wqr&Kg(WU3c8HAV+9fA!^@Xgx3+x z@=$eHz2YDq=~CKav?3Ge;Es1jR5hJ?gZ9#M$lB5Sf|rna(zri5n+jwiC$df3^B$4~ zF2JMWm&l<2ixYl-l6CGSGgoG?p_0==57}0-^4U}S%u1kKGAV(dO?dNoOU*DS_eG3+ zii(cT1yoOz0SZo4UxKIS#DMw%+}qviFM@|rGs`h+T1nmT7#Okj!T&btA<+|@c-#68 zk`6QyKJztz2wg*26+WA$z#rwGd;aVqeVV!-SbuAwo>ujkEc?Ic391k2J;fyD8#htt zxfF#3E6xDb0&Xl26YQWPl}U~3eha8G;z|t`qM$qw8Z}02l!ny$tf8dr1BR1}YVRUu zHOtI_8TQjF5J-G5$8oK?JmRU~{WA33z4i4>7Qc-VrsGQ>Xj8p$NGAJR;+fS^+u=da^J z{Ut;9!YFrmjAo`Qp%gvnKjs4Hch~&!dBpxKPdDB*2=E~U4LoLjBg0qzF#bY( zslua$U@t?{P71N;Sb(vPZwSH=LZYFPDswO2mfwK`bxPcJ>OB}IPbK4pr$E2()mKDKok%kuvdxtPZN@`LW-1997*bHnSI;mtJMVP4I=C6x*m&7g15FX= zW(j6dHPL4=Y%S#GWkmZ>%id6vfLKCl6sWh~bJC8Ej>d8E@r9lG-rv)~-=vNfR@)dI zy3{~NI!S&}d3R5WKDB(ekX^Tp3FiQee;>NP;Y%NZ(hkrO+eYC%F76AIisaO8U*^_x zIYZMu-nUg(93A@ZyjnaD95}NgCHv;Y=QB@P*|wB3M1h7#PW8zwb;&p`aemocvTo24?t`d>DaDLWD>jd@A-XfEi{YK&nRk zAHt8^aAUZP&*(p3QzFR_L!TOCGTeNtl71_z8H%|4wdL3P?1Sm{tEuFd=HH8oio(3s z;k5&+00)SD1TYLR@75)Z)K)Tq!rSXUE!fxVbddaq3?)+6tJ#WHA@d%fCh)$!j!+7c zhvWoVJqjq`+^+w3v8|QHC(T}4+Fia(`k-?VtF>3vIAEwrU-;j=&)2;h-jew{%EnQOFUe}xbJ-&2tHk^tXzc{X#{@GCIC4@ zuZ_5hVH~r~?rOV;E5k0~pSZLE{Qo=SpS_&(ucL8%GI7oka1@R4+>^h>Gq+oJR$yuI z4en)gr|AeqrA0eR>~jp+TK4_Fk{9dyAIab-8tC_(JFKA+?ZY@~wOa!B+)~@W3u31l z%dn>qCjItp0Rh?m%Iy}|H9L+i0iEA=(iabiO9_0-3>Xj(1>jaoMyBQvI(>q#OIy|| zVNQysNy+hldo1w^vNU1ow<5hseNQn+jPl~ZoT)~`I~i%|2YXh78H_bZ2oN`176bTV zVF`vkS!XAb+};0C*i?o~NSKx|p@&vGPNt_$|y&}|gJkm!}Ii7~R0DM0S6VrYB1wOuW`|p)oL`<@v+?;6|jK$Lg_Pa%(h#?I_p5&3=JGP(P2!ekJf-hdfM~HX+Rm;Ma`y2*l#RTwu z48`2Q=;Z>pmft4O33%{Bt{c#-*x0haViPD4m*}$jV&z}j;cDFi z0LcC4c8ZgeQ*Lg~Oqo8l75cdqbcXxRPYD0L1#)+USA=7PZWw~tPapp>(KzlW8?+#7 z$Hc+cADGVk+X)%ktw7{bc#Gt85eVXnCM^aP+jEHOU(vaoucG}i*zejvTj1u-Cs?wy zJjO0i*!!l)h8qkb|Ni|uCK+FBN(y~^4pnzd_*XFR;r13xB||ZbYd{3)H-cbJ4Y!Re zV8QqRKa&^2vjCO40mKq-Gp!!#r81k-(-%QOi2x7Z8HFz^FCQ5m)&1RK?$^4!t%zp5 z{@+Iy$)~|8GY3vJ7cB#@m^dzi%rxD=jUg9|@Sx*DrBhK@_=? zQgmoxAu%`K``x#oV$;gru+ao98XX_s+~A;G%kL%6N=Jh)zyb^m3fiP8G~hh2nN&m zWSVl|xfFaSYPQGwF7#1LmOwz54z<{w?eB+f$T^B-1nv#e>eJu_8`v&?2+b{0P17*+ zV{8!?;2U9zNd2$WqO!dNEE*>%#ala3IA z*i@pGWwT_qa-g$Sz4KpZIvei;|8d@OfSGdwi-O;e_C4=&g|zeW0C?0zYd*3!I4iGI zzq^cm2s7U-OAl#_H5Z+ZT9Cty*D?kZ)j{uRrJe%H*8+Y?DVgCQWm3=+{vw+UGFqdv zcwob0eWeg@WIcB!)ttt^NMX*w<#+ugbPE8;5CLs#a@&^?ul;-J?9Ao`9>8XFw#PhP zO&n$Vh(X!Pa$!9q-JQiC#lUl7h?+*975XBzW+BuZ#mG; zPM4y+*a4jCeJ#>1Fgl_w0jWA5iK}_|;So_HPkR9OTMp82KMS zAL@YTOpI;yTR;2)z4y&|TnfXe?}eXh3;=v=t7>scEnwVokG5w}j~BscqYW?tqu0A` ze2F9Ac6I5ZL$_IB2U|2i;;exI_^4~IfH{BxqAm)ZWL<{wGzS@dti1Y~37K|(*8zL) zU|HP8d8LTF%GNd1tgan!4s?!u<>=50=XjiBN;+JMl8D7$x#AjQd{uD;A|r>xzB0Y z4Geoq=GBy=b;5Mpm0@CJ3FpQG_p&-vmD~(FUgEzUN_>VxgsIk((n{#pJG58KrPPRo zikiZiiv}8li45R#3)a+FGU0{;15{{0OhXC2#MAupSZtbDkian1i0qd^7h{>*jE;$! zvZYJ{0A72o(#kHKR+>bJwG2)u%SVYQV~fhblIIpvEG#SY8C^VZ8G*nJj?Cmw+3EL) zv^POGVlhKXQlgG=Ys%y!wEb)iwn@nE8Pz03iIj1W;*>M%+U8`7+I*~7223L~p`FnP;4Ag{1+w_`Zn(_MG~QHDkvRN8tH-+)RGgCJEp6Lz?qVVX2(Lgg7* z+j$Jv2-sFkeOhkTL|I>eVjQB3Jh~}~X!hmYvSe*^uD0NsnO@+QT%VoAbg8-Vz-(5L zMt5{_I!Ar52@HinlZBvX2BCw6P<#M9>YbFH0ejp{=}n`(;mBO|I26df3?YNbK7B^= zib&8lYc+Nb&0M$Yt)YVT(*DH6crHrJ)%bIO?y%?!g~fDfF&BDFu2XtWPM%E>4>0`$ zHWVaJ0a=zMWaA4f#&~8yEL#Io)Bwuzfw6_7h%%DS_;8X-%fRYlG62|fYDMl?MxQ;; z#6mO#*_I%4jZ*!~Uf#>kJcmDl2Y}>zd7Kvs`!~sm@Tlp$7dfb zW#gZE(6(MzTTYh%lnpM5gjX1N9$PW>p_CC4;l%HI-ogE(-}OEl<-I(g-PJkdq7%6f_1wV4?m`vvki zJ%CJ?oS2xATo5kd&B4otwejtY^8LJQl-IU z#P|sAN6zP((Ak5e8s3|wFAI8Y8Apk!celNkebF0N7W|c2$S7@;TBBBAz9U->o$lLy zy)u61Vz}`!{?+N}%FR*0qOarQZv68~nQ!EtVcqsKO;7hM<3LsRl&EI8+PfJ%Mcc@eK7i(m5nWh3}($R z6cL?_*KK!~J2mSOCt8MH-sf~nu5luTu$u(o)mK0x;dvV`rX6VEU=x;lvn^ zr7ST|$axc(6Y*WwTy!KHSSp{eDG*5dJ%MwQ^}sSAz{jr`!OSX{f+SJT6h|GAg)mVu z=)yP6eK&{!7~#h(#B(Py${tkY_Y1lBa>SqR%wcc$8NeeksdxIq(6}a>zi|TuM=GN- z!h0)9Jtvk7z(b#zx|~-3jv1WOB|bM&^=aBZ{IeD_BWa^%{zxOTL*bw%ZE)|iPxx$K zCC6b)byr-@VM%9LKa~_DsxAK-kFhd2`Q8e{o0o_cOwRef$ZNcdsr06tgM?sVW3>j| z{^PIH5S?8!qPg+PJyTAGf_FQNBR`53oLsq+ljpz0#$HOJ9?6W)PY-+AzMdBP;%au+ z=qcmV=Stx9*f7ppQ9G77bkma*4p~y~oeW7vmR4sIWfu_hGZhAvp>5XwNap*)O*E{B z?Cpph*Ibbjw$fn_?*K}V85^#e3r)H4Ih10N5cT8S19YL#Kc=~`R7mQ%R(12h{ zr!a1F0IwVv2oSt~y!#;q(FO@^kicPTa|QH-)=Q64i!z?4?Q~DlJ$VF}m^WOWxJY5& z)r1k40wIB8l>nO#OZ?iKPu!)r*<~KGx`0`mYG}PP%>Zmiu}S*VPXz-nZn%nJ`&UOytEpYE9-hh?`#oj&fS$81!9en z1_G_|rox86Tx#{#5&Hc~^_UV~0G*wAx_LY^0#Y{2 zQ{7U=$&8JS|3noNd47Hli0LiE56{b#w}MI6rFa7~&=AVuJ_Fn;!+<>xbg9&Gc;CJ$ z?QsMl4T#G#y?FYRl!Uv3GO#%Q4ahwWT%{eS&-PY^B1+UCVUTy1G*>;bYrF2tL%G54 z9!~!9<$3%-8M_=6>U8bg3k63ztaEe_Vwf-?N0NfZ$1k8;S}F8r37|WupB7|!@kM=@ z@xdNc8rKFjXK($X!1!Yt8g8m?VqG<#0fq`Op# zL)MBc%qEKoNUhVv6)4r${4G`C^ZwdSH-8RBIZ@UFnR7 z_2CGxnL35Gl9Iwgi3RCl@0KidU%tjn8|Y!JbD5}HduQy^4U4|QW&v4#-QfadckM`aqaGyM2?8?F z^0p3D+2Szs!0wD8`4jabw{2x{@7^Tkn3CYMKDMa0R8s^Ju?O}uDe?wt36ouvFC02- z%G*ROW<0?MAuTXByTz25Xd~z~rED>Yq}N0>Hx~OfgHYyhK&pYI+C3oW-rDUKexVf5 zD(AF%voRMF`A~X&Rz;7BT1&1I!d?2Vh1%8X3|a+;JMb0s_lCU2o*W&aBH}8(YZar8^2B(EtpPOPg6`#}_%aB}d>)Bcr&F{gD`xkU`3fGjmi z^F@=YV$l^`k5qxJBf4acc;~-124^d9k!#7f*`?jm zcC!d&6Vd*jB&F=X6Z+=f!~CBlxd`H`(yc9%1b!9J{SI)$pfv$~UBW6iJG9*$NN}r> zBQg5g*k}&jhrH)@(ZCaj4lLFKUJVdB1`)Be(;PbO$5>3jJss|N+uS)kO;~Qh7r7ES z7i$AEj1mz1h4z7d2m;IQbcP!~!(Bah#8n2j1v8Wjdus2;z4puK4_fJW=3ToJ#%}|~ zlJ4JS2+8H$peylA1#*H6Q3(|06%glAlvZ+}a747oZF4ZKt~t7aUTgsG=jkYR?@DbY z1<#4)=asEZgYuu(H;X?;9Y}V(Wg|V`w{yE6nW3X*dG{E6*}&O4wY=;NhQZ}X`sN=@ zu{Cryta>r&qNQfFqnkvRM7^9bsjVzC&8OX<*ka5F`VE`%2kWegZ~Z^$Sa2+!{_2T| zh*$=B5Fo`*u!-v##FUBiAF;##ZpwVmc2lUcO-*Bg!EU_*s>Qjv#&>BZL9tAM7iML- z4xBtcz(MraZzx;3sV?H1@h65$w!dJKZ@9JElO9{Vg6a?FUEc6lcmSeQ@*M`hDi~vc zzNsc;Qb%*&lo(ulm12 z-2UPnTHukt1pNSA!Y6pFHFI-uagpp{j_VKtfx=s}aN8h-B-Xrx2CpOw%P}ul3HyU% z9_L_wwXDiT(_;5z5S)f!!fDauo>;n8Vgs%Dbg^1ykM^0tXx6<004@S+8>!M{LYLh5 z(q`lvZ*FwOm(}T9;T>mJYi~T|G=}b86EqZGMX3LSP8-lPCMm0WV1QoYlyWY!J zsFB#}GyHe0jo-Jvyb*W$8sxjW{rJT7t5zvI_T=S1!G#`nz4iRT^r96AA6av8a42>v zT5LLFLgxIj49>*(>CJqYIp_7s&ck;$Iz;W{Xz z@SSMv#Hkk}FJ`YdCzXDbqOXu!k=fV%fEB;ZX#t@?orL&B-KsQ^vMk;O5Dd~1B)BLeJIEd(dH=T&~XT=x9;&(~JSo0s+YWjdkj4LG$ zjIsCm)%gK*Rv+yG1e*TpJa9_-7s@MQYd~-{F0V9*M=<-A8l5hgRM;tp4;JYv!D68- z*(&Ir_Nj=vfHh-9d8^(VU1uVh(fpFMmnrsB`d`n-x=OyJTqFMv@-zdiS>=j8T}VGj z>~;8)a$vIw!fZZj(0{3Udlwc=mz>ew?rXAzx)Z|SDA`6wZXFDQ;Fn!j8-WrQm;v4j zOUaBHq<@031L`4=`r`qsD*6e~x!RjpxFlvjc0-T{ra*tiMZu=N)Dsz0+=Onf-D5fF zF(P4jASEROneanX1dq1%H)GWe8{Hx45XA}GY@mEv$*>u%3k+s`J4yvpk!6Xvs{nF@ zgZR3m76wUUW1Ek}y;&*>{nmv5C-Sia6CGrpa*`OZ;7n+uh=sd-X|11xsi-Jw4_lrk;NP^mX7kU`QFbxs|8cp;!gYA0+qXq-*E# zER&!Ws9G$=KA=l1gIh1ki025r^Gk$dLcd#<=6Hs3{klM^6~N9Sv~jbwjp67S_bp3H zd|dQy20stlAP*$@{blC2K0r|$I8DO}z+F-*aGM&;hx>@Y%&$QaD%^YD8m_}4+DZ!VOoOVJ}-ZmA;1kj!x!p2Rb5JVgr$Fm(# z)h2O#)!3qbOz0bhfx;6nPb zBJd-R+L-`~;g8>1LN);smI}BG3(O7$lml|}vHF0jvr!qM5r6kwVI!-Y5I+kzr>WV7 zm>piFANb!j&u07M_!s%!rh`bB?|}beX$%&%>UbXn9nL&5Y$t#R;^i2a@DSy#9PHuh zKrGON;5)9=2&r*ly5Wn7408@|k_7|~Cnrb4dHHn^LGJmh!ygOa`Wxy`c957YvD}BOwQB(iz&9D;+l;CjI(fXujdDxJLrPP7p?0N378k$R#sL#(&aY>V(^N(GX@u<;0vhHWaoU4PfqYd zk*$Nem{Wdk?^T%}clJylTi8V(>M;jg`p;W)nolw;l5qfmHp7>VZ7hielQL*+F3WO% zGO*aHjwV3|JvQhO2rWL5#mH*~-XLS!;o8x{-s;vo^{r1SYREMK{TG0Us;~i57Uvc0Kjdao^wXpgaXG}kUe0Kr3${#GTj zi^iL!oClvkju~(o8I4{BPIK`K9uyZAP!`Z}!aDRc!m!6eqRDwk90BWKH|_(HS76Q* zUKdi!sj5OyUd0359{*9a?X*>-c!ke5c{J9-CHMmi4KbBSPwFMafSQYu)jxes z%dkvMc{mY|^iqY9l9HA!$T*5c$Q22R!Y(X%r63Y+0XYz#$2r3ilDwQ8KL0O}O@Xgi zrqgt4B7tAmdnwii=zy%(=M=f%^plI_?(x%1Fv!BP%+_mB>|0$Gq2pnFVJTdJCm(FZ z1rd0t27svbEW@Z-nNpaRz1Op9>gss*PEZf}01!MNYMHC@@di6Is+}#TuqpF~`lg9* zR-L3D9_uZB(wB6!fb28ANIULTT$^Z|)y1KfkD)46i>NccOe~GhpwRy+T z(@AbwfXzn}Jt&R<9sRa9y9<~>kZqd8|8T@@?@GwrZ@@) zDo)jni1pd5`;YOqSXNux?LoS`5s(t4ky1obN)S|(25F>21nKS+2?=RI z8U$&O?v{{{4nayv`rME1{k`vZ&iQj+*OupDvDRF3-eZj4xQ4K{>2D=+cgZA|?C``E zi{jMLgy#9bmC!SO&ifL4h9$(;{AMs|wht00NAXY252dzha8`u;*u>2BGc+PM`6iG! zKTOJcVyWDmNIm2T4n$AbFz56-BSz*}&EDpSVU*~C5#y)_YS|~>R(gK3!9F}4V~fpO z?2MAjNpXpj@PzZs!Lb7o%5wqm{OC3jKS}un;JqFxX)9G3-|$}Y0nHSv8Wxs=w4wK} z4>g1bvtH>+R7A+&3*buh4gnZ=nDwDqSMe)tk0SHgcl65V>d#EiUT&<;-{G1&c~M_m zGr@a-^aq~m4r$|PCRuaF#VT>JOAmy&*?S6c__NnTjHafmK#RseKa@Q)O-;E6bv&*A z8(WI7X;e7^d-aNS{livdD48Btjfudq7E}4ZaKx}+84sfT+nT6jm6ey*-O(YtV6i{) zjxmS2a&$KKUqW$veoC?2ht2Saub3t4vwx2l9~H;-;ysruM|w(B_A+Qx4bB{?`1w+f1WE-g=%zH`jP?kJE&aMKPh){=qHFT4*Wi zghc%Q<|;QkCWH4fu&yG2ohATn8~V?nTALu_lo+b^_gQ z35+_I5R?D%MVx>j5-_5T`@edKH3}sLealY?eyUAA=QKlJ(#&WBrvnOVM3Ixo%j%(_ z*SVRQi_0TQjkSB%8!nY^s4R2`WbCf|B-T2eqOlG31-fa zhap~;eo=?=fNE~IqxZ-#`3A!tTC022T=UREcT5{audiV8Ez3J*C>kmZvJmy|LGli! zwI%{*$%pI@A%ytfa&`bX{4^B*t0W4oi`5c!y1*e*F6Xx_6GCBKC#W;9#!qpjjws`d zSAJM1dK8~}Rg6_ZamxANuo;hItFEptIhmF~Sy{l`7F1S9jU=1=rP^Y?cmVBvI|q>z z8@LXr<)ui=x+i_N>(#1{$hE&dCLTUPI0>Gb>h^K`9?g-Rz4O#9kTox7Yd=1opzdQt z;`VIr@kOM$coRAZz`q8Td-#9D&Ot3X@1CiPK*daWiOpvSsP*W*=!>s)_B=$q06Lw)&0e?OR$tdUishI zLb(*;*K_~)Qz5sIRb}gJIMk)s-t&pA!~=ObErh#3_32Zc@o&$^9XBoYABP#Prbg5> z_eY&Mm(J@=Lu~E;BXFZLi$?_p2DW}hZ;Ve*8H5PeA&)>LH1sWcuB| zhHv{iNCkEka9|Bn@WBfk1gmJ4PTGWTK-wgxGOaQeMv}kD^^8HU6AbK+p2&GsC@QH} zm_K!sys{8RBczM{{LNvKO+#rMxttN4naVtx48m<4!HqvJ?pE%(65I>UNk$W}$=^7% z@jUf2`^y~3x;p%p_sSx_cl%XM1wI!}uTyi>E~21mtA}qvU866Lp4; z8>!!}H{eu&g+K{ZuQ?k@PklTr15~kXXMs4Sp&) zYtwN$cGKBp2~2!U+ZKBdBjl2;BjQ#uT`lEl+wO77-4D5&w=Ch@O3?lpBr}UAe}q@) z)Y&X&-aU*0%q8MzFpex*@*uVIHI3gA~Mac%rUs4T4v z>cUmnWXV@p;w9VLTRYuOVJun%{_GpUw}WtNb;QE2R6N<><6F-;QpP7>zae;5q8ks4wBm-KDS)@VTiiLN&yL%joAXMGP==A}T7EBXw7D4a9OgChkVZpP0ZS~L%wa-JVE3d5Em3P`FPRV_z5OX;$#1Z^6BuSu%RbXGQV)&ar?=jQHS zk1o^6Bcb!{Rp2`P`ppPnFwwDHEUuN3EK@pc#~e*N40P&=8muBAdr7>1&FIi^xVb*X zr|3kv4zCw-D-RG8zth29l;87Q)+0@*5Dk)irS&Wu^?IJ+wDsaP#Y}+&@$vDswKN_^ zq;s68Hq1OuP*8M0jcSpu!Zo|vrUkUPBRb)%C?FF=DO}~d)=Vq?%#aG3>L&~Y<>ck# z9S%q0sz(I&7 zAfD4zHXQRy-QCmkqY~#>s}}^$u24Nhv`Buq8poM*AD@NCE0zM$g=BDzNTlZ zTe@&QkwEz_fVBrt+E=$QYxsdtyg~GufZQ0dtXKtJ;sMruIm~L4KT)%C=(zF0C9&*F zJRkkIiXYb-k9>u*K)$mQdcJHPFawN0Kd;TQ^rhQI%=0 z5~?-cvi>`A;u&K3^-oS`iG)@0H}tE**~G%iK19<1Y0k^(KZ&GSr?t@qN)ZzdKfq$x z%E>?s#%b#eYKH7(XRXSnxI*gj%$n7^e88WZsqxr2J7B;L3O=C-N`L{{JN9;8bd7RR zaA^xWZB4@sS#T_mab;WHrvAXh(o#FK-K@9ifjStmsG|`o0`|*)(2nhN|2s12ikVtt ze$N5|e{jeY0vmARY=M@cvNU))`e*!Z*z?Lb)55QIJnm>ic2-F6M9&_S)V- zRk7-TdVj0CTj8x$H)+eA?!V+je0>u8!siHbqIOB&YeY8`K*-j93}s?qVBTSN)>2SV zu>8r4@34~>Pe{*QOJ>dpJEyBxUosw>Xkmgh|6yw~+a$R!nRmu0HSL3b+4WKbXs|IN zr6GYzXgRDtr>TRZqsZXk6d3XlntWAuV1SP4KkYeC`gLXaS`$u;W_@raOPzg}T0E=o z(XBe10RO8t$*UKF~gIlAB zO2!}fA$sqvrZG$4!U5OQ#%3EH@ru{B58yZ11qu$Mh(Kt1Ss9Sy9Y@J9^i6`0vN_XGVfL0H9MFlW!w=~Oc3UUsmU=JN@(pSyt*ML z5h!HzH3i}|$r!SjLk*wp2PEw)G7rUvQ+K&9EWU~2AU@Xsk#FAq8CyM(203rWxZr~rm=RfZKa70kju=ziHO7;KF zWWvu)lmU%pNmb;1U2pN{tokqiRbm1YytzS^j@e}=j|I!soV`1N?z6^wX#ENdn`r;2 z3oD=CL?Tf+8(`S%O8`AO7LOm$_U6~kE6?6(a8bRg6%lWtUnnlA+2rZ@KIe6!x2Q{h ztXkk1Ck@%xGb?;-p0z%bJkjirc9sJ*Y4I^}Xn3Jhl$>FQrT>W*To+eh=6 z4Xc;JJ6m3KU@dm(Q=_nY{b=xB>D0iYpbSptd2#1?3I8>HuxkqtypRGrdX)CM?MEQ{ z*L*0dsX6>*-15lr^=PC3@kt~T#q6|B;)Q#xGuDe+{{)#dQH6vmZ#?-B&Wudm%Yyrn7V(bYQo@hfN3X)>NNAR%~K#s=xN8ICl2vk=Mjd!r|Ua9o` z&ZQIZ`u1jT1B33nYREtfVpCnCrd`j#SrLf+&8V7q zP{_};TySqg)Re0^6jR1MAT-}b#%|+5kvVE$O~aee*ZQQt9g>8$EB?A2AN9EL@$nhW z6Cm=x#3QH`!k8Ef7LTvqY)1I%%Ne>J__+74Fg~ywQgW)=j$4xxN+ z#`v)qKJC^fs{VXiqB22za^fu{|Hf~NHRFwU3DS)U%YJvHKaMFw=B3WIgjN}uDyytX zmkhW0s_&iqjj}Fjg)#@55tx_T>8X?2CZ^!kCVf09>-DDN*{a8}rPw3aCj%P{y}uhI z%|kw%db);0322T=-{L}@L_Lt?FMqG96nVc-4$VJfI?Y^}=&jrtcLTfA<`|Z}QTd@< zuvK-%*q|P3Yh${sX-ufWVhu{dQI-0N66$%z9)07kKk6?1xp2ooVLsdO&ZF5I`3_2& zH+XwxQxD`Cw=mDo)T!Put*Bk+p7TP{onEhcG|yx63e&r$fvs`V#L3?NKh+L46Tkf% z8^v%h{`SxE9d0Ts{b`_mw}GvGN=Cs>7$Pi}@a7F}Fu4gT`k7#fd!XHc3I}r#Aq52u zOqsuScV01&`LlJQf*$Jn)dLx{X9!~3$v)L%RZ6T!Yn{9Y49yZ|LGDrqk{{!2&fq<3e11hFIpGo5RMv zeWDGgyTsFMSc-gdb26`0ZVFSkX1bcHJF!)hUMSj;Vc*cmR1HG%kHp*f$f|_Nqd>5% z*5DBtcmMa``ydmh(WUhItl-2ivlmbH#h7MTZhvLu7S^S4_5Dh^8Fn*)|Ef5r?KKsq z((ECZ+{CgMXbydEumkGZI;fOxn%r`pqu{c?9fd0J#-x(9a)Nr0fJF0$tXsl{?OLhb zjCWo%78->`77?st61NwaVr#_N&|gY^axU~1`IJ?L?(cVVTCMU}xXD{aYNYGjvhdsJ zK}F6tCAkMmDZCD>9JW=vrj+F5_#)Frm`J}6=UdOLmH<3%cJ^DrNHA3k4Z&SB0E;8! zWB`C8RX&v2A6B1L!t0`sYU`!BitZGPN72w(nuzIHZbi<%L`g!cU zcyErilkdkHak`!Zsr9N_C?7tgYN;6$N~R}0xn9~GRh%euQF%!k(wfEGhpgebt5f}8 zU+B&Kr4zSz{ORJnDwH2HGn!PDzG&9tj};T`XztAHx@hSTa5cf|u{b-fi8VCr!2VVV zhr?WOmIRrI5HDJwaYo$|&*6M!qH1f*%l#slt<@s`j0N=y&gq5%gQv0Z~95 z%q5DR_ukrWY;3MDErtwR&=OFTjYO}|?&O)N7%MK7fGx0-LKmWqUZ?b_Za#j(4~QRK z*>@qlDLKshuVzWKQ$r8S0Yrb{Y)B%2ejIW!QKCz(RNP=a-Xtg$)jR$Dy`z4)XQY;U z@^kYoF|BVsA3yP3S{hoXFme_M%h8<+UpIK0qsVl5&W$H>BOyNP_TlZa0L>xpKo1=x z6{%~9vvR&46TRBVWlk>#YU-G{_hreC_dIyN40mF3HCf$zh!JKXzNFH_jvAWCNxc+g zvdS`ISSs+7_jjR=6VRGe@yMht>PoJ8_UzhQP{=uGq*vNyhU3k~&95|F4LyA|@Ghi& zRt>jih$nB9vCrBESjcKN#edu$ty5E44WsPO4|B4ZdzdeQzfeEz@&fq|uvGy8VE|AE z5F>*i0mpkBEz2BC3$f#u4i2{l`X8!fL03U{BIa!)WFK<3*uhp_ACjjLk?ym{nLRT( zXh+I5PCHXh1e&jA2M=_n=|!eqPsV45I>k1K9e+4bKE|sV`cc`17TB*d_U7Fq6_r7# zWivI+cfbn?4e|Uv9|*I3kRHC2cpiTH@q{jw5d^cK;PBW|BpL+NI+^G)(BT-czTH7y zin@gJY2LnJMDl??|0L<(LDvlFDnf}@E9Jk|G#U2-oAP-jtI_?LLZuoHvy%Kt1*BIq z7Fzw``wrwW#H?f9bsSV8<-dLwn^oyK`hV$`E{bZnmu)_C~^^~Vt9P_?@nnsAPVn9}tFfB}E1Y?MAKe(Ub0;Y4)P)KqOpFfRnsOLN<#D?6 zvu%A*sQTsR5Smj$r3J;bQO<)r`rm7TZxm{|8Yin&+;^NDoN#bl)u*9su*3iOpfz}* z9%|nd9z1{*xXmIQuV%}gwzojc>-Hfe}?!qo4Ihx@~`^e|P@;@Iiw!*5#6rdm8qyj(~%=v>hB`EP~g>8xZ@fZY-uvf5Jja z*0YQFEuOGZ@_lj%atpd6_k|ekuF1Q6A>Pf&H;Ue1Zf|n>{Fr!tQ@^Tmgope3+b5SK zNP>fvJddw2X)JM%{Iru_d8BTESAXI9 zU6kc0;37l4c1xx(Zr6U3k*e!zP|MPl`jTt(chWT;q_r%0d^r!U-QPlLNke+OZ@(Vq zs*a9RAW(~iCn$nw)y8!^F7^6z#I5R@*Z+O1HPy)0b_cYq7rW~a_3s7q!LstfM5*D* z9ws=fAoIbFH;5I3Xm^F-&>QSPT*kFeIQ6atF}pE`2=7oFMsu2kuQfg<51RlA+TQwR z_InzV}HkzbJLsLv5r^o&Dk+s<*E-SZlSS>372;HTCwMG=tZE>1qiP^bH)o_dOUx(SQIx5T2(~n<=v#Grw=Y3Qm*`Y`E~T@ zlRkJci%KuT9QnB>toQHwxEqgB`I8C6KCOu78r9}Y9>HN(*2%r2@ff*MLS19|=VPtm zw)q2Y&%t3~VM}4_*Y~}Oi)~-_T zZf?QS^)@yxj9OqFiaxDuo32!c{PQ+}8No0=5WGw7HAR^j;R~aq9{{-#I-wk(7sT z1ClU-zP^6CW)4HaX`^FVN;<0OJ!9-?cthqjHKy9_ zhP>IyUB6@eF#VT8RG?O0{^jVCtNGXUinE27czA4~zXc3%(J7d=Uqm5*&Z!PZ&5qh_ z){hCG_m(M&qf;*|E?#qkC3+-BET4tP{%9tBn?oxgt>OGE=k7h@rOxP}%N7E$>4_GKbeX(eo&3i}$ zBVg&rh{2M5xc9hM{!B*usiJgi!GeKR(Ju~XM#fep%xagvL*w={@5IE!uR50vd;O1Q z-A}C`#>~p{=S%rTMO=Y_lWgX}Arp{0dOAB3_>2{RLwn?LUh((;`Ix%eXmYR)R3EL_z|bumcIxck;gZ+vZY*o>ZVjg%Z==EGxJgrKn`W^5yjF*N^K= zjki^BmNQhy6r->rPwG_3_TRv|1mP6GQ$H&U(2hkuW^@WJ4!L$4QB;Wf&PW0C#dRps zEj%ys?&0)E42^16@%SCKV$S~cUf0R3i#AWrgIaX0&z2Ia2*QT4*s+mKyDlPmcP)^| z?)ca7qoIv^mzEIwt(&%SqcW%O$IyTjwNCKK6#N=i?YMB6qw)#%E&ew8Am(@HMaY&bV1R>? zz)XkuhluZf8w8yh1K^ za5Id{+ge*Qkb*q-JEOrXsrkvI58NNw*e3~p=hd{+DjDX?+1NM)QeF39^(iusPl{ph z+D$Ynjq-~c^KY~eFH(XoWlhUFO>LnRP<=&~QW_fiV29gR*~kQNKaX)7Y}sybp4*Og z%hJ34-0q22(#3_s3U5)FP4ivMeP<^MYcHvzV*y)6gNgBig`A- z>UoyF*b5TbQm=Y0VQpPRj?m7d@&gftM%Lg5f3DLKon)c@4$urRM=Dr@&Dh+1MsDr_ zLM>S^cJ(_;A(c$&$H4Tu+5P84DMUeAkZDA~)%11_*I&g#aec6-a2yPeZJcfw-%Rl) zzq3hcXnX^{a0mt3-sWObY%JOl(6(AyS{|WQMN?p-bU>pUvlA)VZE`ZQCM&!(Z^0MX zJiygj$~G^&>0=-jF&UgpIQ;NWIS&E?I15BOxIf@(3c|&1yyqb_OS`k}d71z4=%dj| z*gMR&-QJM_5Qo^V%O=U&wH%B?_F<6%1><7e^L#y876j|xJFw0(V}e|6HC;j{0c$XX zUuFCzCnsSWX4Zsw^r{oRk#QYFq2SJB1{4>E&79Qci*cU~B15_l0-zr_&AKlFkfbg5 z@bEBzcw!ia?Cn+PZtkbzh4(jH_E=E>uTgq#M`vscerdb8o%PMwq$DP^0FP+)vJEwQ zzwe@lS$1qq=z}O$F3`GKHwK0ZtUr%>>><6pviO4~!JM zU`wxep(d)6yf>d z7Bq=3)9qt4^DgbPHVnhU^Liv2&G1({qiF!*@7mj@D@sPvW2A22K4d$CoRqa-ze|bt zF(LYQ|9wMR_-z!K+A+HcQsnI2Kqs8J&wUaR@$%Dtc+d>ZArpz3*XRVQ?pOzriqjsNHaPsw#-;Ud9~>xyTg51;jjvjVCaW@pr8O9A87$Ji1(I#1qmrBYN#ks)yk&D&mT4+ zqCas`S59el69yrA*F5E)u<(A|_0ApPkRg0lB^S9HO&Wq6Zy7=vE`a<>_~dPpulCAc z?_c)gDMCifL_>o`1T9hbVShh(8@%tr4n8U?iy6x4{|c)_vggU(NTP#rklyPyZjt;* zaV_gS)7`jY)d_EMAkbj=UUivMs9loL9>kui5|3-q1q1}vgpW3Roc9VVZK~$ci6k$} zjJGXkKXdB;5TT-S1*$^oJ;N1Xs6w3!E*_ryZgxBiYfbO|{-vL?htcuurLL;#{#s^a z|Jls8%l=w);i(SF+HCoY5!Y>2Ko(9y7spTsohyi_-y)%Ns#-yU;^Uw4dIp{Hc{RK{ zgWJ@Q#u}B7YP9$QVH|_<7~U%*k9hDXMP|~uc0zIp3E%)y+w$)=0?O*R< zAM7*;?a|CmE70k$)|9NxW+w(l3Cey~e7OyEDStN~KQqwUF&~b;x@b7OF4{P&QnfS7 z64+1WK^PJBIq*MH(}>v^@GbI-Pg8M<_P7t7mopxy-j5^^NTImU()t8HnuR5{V&~q@ z5P@w_RFq(*2Q_jI$v+=Jkv|jptT-Mis&3=!9=y-BUc}i<0d6YJ|UK zcS>KhRY{KKAEj#eF^7^IX3e=EEg)AJL`1Yeva=)n^hiEYQAVb{?sf6gXV1(p;y&Cy z8M6LcVP3P${4&EBIFsSG9M@wCC#6@??&Oko|EWLkB!&Sord2?B0xfyc{>>}?vSdZ; zHT-*#%}ejR$b$g6M4UXDDTRN0i|DI6d*JYhg3=^#lBBZZxpbAjOKem^xTV3sqn#ojLnqmj=ALNztfEQy zN*O4!v!C4qrymhTM}q-LQ$1;<_e8;>k&cAP@!e@RJEEUHfhCH<{_9<}2-Y*AZ%9t3 z@O~ADq!PkF&9$f(yv=gQyg?oZXn=42)avB53w}I@yCKctzVWDkcU~x2JeR6=jrwb> zEgUkPyz)Y9*V~SoZp9+BFypy64`>d57Dv;YB9c>3z67%yL`nIWr?vO#r-8?CJ}sYn zHU|T^VHd$_EN^e`RL={l{=`{gGi2Jt4qQ?)w6VK~>BVWHXluFu=q~&u|Eg`!^$9wd zU^^!0Kabx$xd(VcD6(@E$#(U~=XY{Y$42eF9jvz2i}UG+UtojT;IyrKj*4uNX1BwGu<{!^ zXB;G!gQ3>xWg%}b6Pr*!6WjO-(e!$jzt83RloBmGqddl&kqfL@R{zwel`|lw%y@WD z#}aP?Hv;@`V~k(EKiTse?NC3KK1SF}IwtYN#IrV@)Hn|6X9dn;u&)qfI)NINk$f^0bfU!Glra)w14Ba(h=(q zGUcQ4;z84UhI_s|QSVwQ@2Q6gz2A? zD2O0i{ecHro*9QWFHz2{Py^NM)+N&wrHjm+y6?9b`S`Bg(;aO?cTRx5^SeMfT@h-L zi4lz9nrsYT-KDAB?B^aRuG3aqRWa2*bC1s%siNVSZk^*2v#R?-2QFdV*9W6V-(Bgq z5Ob!~Z$}{9x%4G!1y?@R83bw(y8xRq|*UxRhzwNa+nec}Qc_hwIs3X#Fx>qQW8&7oTG}wo1;GS%2?=_SeY?LW6nVx> zN*<9XBd?^yrt_Z_C6f_dqek+R+Zvrh1Ob;q)xJTvLc$6_U!4?fQfTSq-Nsk$=Aj6E zzX^vVJ|W|jT9KAkC3$%|J|j%Y^lJdPWokcCcG$l|L}D|?CX8@tI7o5ry!G+lkE5C<@hfDE07p4~xO`B=G5F&XxW-0lc zxB4x1@$6$u?GJFENYWkw*GS!W3y-Vz!NzTMzC+B`AP+eh=pobrG!YKLj ztD7ozboN~{2glmHd{$j#UM40zuTs&Ai_-(4uzTE9%daF!t`!4=v6Iuh_I0#&p3N{R zw#5;OPk}(Z7hlpDk@w2kBP40Wv93!mRUnIqKhoFtZm3szdIhW1JrIuA)`lG?yppsX zJntSGzPK*iA@P07Y5$-~U2Syc(XIZt?D+ZVPg*%MBd(_hWkO7)T~M?}c6m6p5J1Gf za_6T$zmvubc|a6C8Tk-Sch24kG0lx0oRQ$=~97q;n5!>D+#bU1ey)0V^8J->7#J! zI-BbjSjnV`ea)HJmJ&xT9;SB3@xF!7#rN@n0htzsynG^A*%l=4tEc=Z?9^3Cdi4W>XMAqq&Oo8S>)N&DF@(Z8_+xWZ^lVH^-&KxZ zc>go9<#XOgwhe}@S7EZPN{$1Q3}4aPaKx)h$BwHWE{-zD-5w6YrJ*@|V`PdqLATf* z9*FX-DLN?$rQ(E&q~!AQcz~15tKn{lmlqPLqNJ5#tN6FU&w0VpWPZZ=S4@qKj}Lca zn~~mn!c<|9gQPI~xg5TwkTZ$OIHon#fjId>1x9FB_8l`(%tw;tVO;_h-rCmcvk zxjvE~)7l=GC|Q?Mnmyj@(Z4e30Qo;+zdZT+ucMFD`cRjG8d=qULIq1$NJJbj+NsU; z(6rb3U-FkuJ`h^Y5{xDGp!c0+A}K#ip(Ya$6A_u3fj;_Kk6ziE^8z-*DC;#=+>>-*L>c4_h$X_yyj;tH(rbL`ShJBF>$2l zd+~8`2r)uJV zQ+orV80l=@$9P(rJ{&$~%3`8;rd9g&nYcm4+_(w6h9}$}yEt|zPw83->Q51<%K5{C zgUzX88wm+--tK|li*>IJT!C1579q056Y2Y29Q(HA1m|O75|tZWXzKY@_tOM9Ijy#) zZ}U+G@4fAyF`LLwIq~);PkD&wz>TsXQU z8mB*UPPQMrJm+irISmOeuzG>(TfYTYZ?2cuhS6d0vl+ed>*o3O^$@rD1Tise83t@7 zlE%IY4a*&NoV-u3M_9|>^D|985o1PGMFZ{>CQ+6RtOUBg>Krn@@lspJ=k+0-at5Y2 zEfF)H-DMT*6$0$;2cK6y@s)dG_THs8e`MiE%FyDPCxtxTrZ=|j?cU4peM3SYSG< zP{tq~4lK#i$%BbPfBHLZ2ZZgF_FF`32ftL5Fs?6lj;(2y%mh(=I8=*oY0nu4h5d`0 zg8V~#hNRO_t5lp%orO=bfd`t*Zvb^*=LOvffeit4zf`mAi2`1ZoA$5cQpzDRYdr&#d2w{LUh zX(Bm#;@ysne>yq{DUwR)8%cV%!rYAQrsccYn3B%UXr|~>4EAT8=4eXh{xVN#@g_jt zjCqFx98NrZPwj9-f&_7Ft48nQVcdesv(=R)bX3$Ycv7m3YVR0GK6?r|nAn|L8#%Wj z=syz#Jcq>VPB&VpwjMou#Z?lZs1k^>jIiVee?!_UsH>x8`Fa*7&I{#=mIFCG=o0f! z9jQ@2;PhU9>*-@RmUmw<5p(ku0KTyvr!5a%|AdL2!utezjHHr>-l7Xab@N zkjgWGa9LTqL3?RT+>v^EmQIbzZeMGeYP$pXE49q_&BX>>Mrr=)TQs3<1``gq2jAy1 z`OL}e+Um`3NlIc>1eN~OloX9+Bm=Jw7LPn4Bf^rBe#S~Oz>Q)MEF+%&XxRIPuPw!n#^{Ua*bX$bo*Y;Niq zbZ(zK_Zoz-BoI?9c9?ub(O7TS>?K2)(a_LfY@B^*3gnT4FD_6I{JA)F-VVu0Q!}wM z=?fInzU`~C0Y;T9@J+Ego-KYrXJA?WMBjhOutjbPFA4BsP&wO;db{PZ2aVTqYl8|qaxWw5vYzIgz%w$Hj?Fi zUX&laywXC86n7Vwhlb`83aPH1Qq1N?pLajZetnGdk2%wAGBgHg#&9f<57M~IJfC*# z@4x&;bA|Svn;e$0d{7GB*7i32gcuG|;}SmWg`4Kc4Mr z*JhsZyVz|0InA68n}RoTG}--7`V0!?lOjzdVyP;dZgnijrH+Zcr5EhA2rFl6-v&BiPg@BgQ*Wjc!!hXYCah#{bUJthPP#hh-d{Xi}6)I5U zr#{Q)p0#?ptzJR~(LS6l7s=KzS*KUP} zg`HiTPB&gGbDKHUyY;O{jm%GD0Yfh)qZ`_UK20XwJc?$LU*brt*B=E4OK2qK%j~1*GAOY11;9 zVZp>HNI+O-P#Su8%=R^Xo6Az;$SC0@eci_TMc@o>Sc>si3ZPL5JG zDTm@|8Wc8}&R*;^UfzD9`(nJPnQ2>u-;a@79Nb;5l0CN=urzQB7=Yu}Q# zQETxhor?H2Cw~+)MC)tU4^-c~wfPz-jq4*0b&aQanPSOY^~`TrKY=s&`=4eX0nZqS z$do*h|3lI#SXf9^Vt?EUQm#-tBBn^(WpbFpi*)sH?jhT`makItYm&`g4!Np#TTC zP9nFd#-1Pu6A%WcIz22_dKes$Sp3t?!u}eFQWC-$8JRgsuA0+lET)LNZ>9{)+kKY` z`uIS5sJlKly`TZJH1RG0-qhQ=rn1Sv*{B+1_I^W1HV2RD(@zT7Shjyn@+O-Ts9KG)g5{Wryc_VRyX z7KyIppP2!*@K@kUPD&~|(DX(ZaY^_Fg%)s157@>Ce=Sx@GO-Dk6^;f!etK73L%CDG z@ggGl;`V=HzGs`_7e9s{2)%6F>Z_l{s1Xspy@c*K{bMojei_Zn41nj+K;$g~xR2%+ zjf!oul_wxxg2i1BXh>hn-R@o({nlpP)1v+UOloe7k)akMq5=-rfOG>g31TYbvXeWi zE!L4ZP5V@p))xH5xvV}gY$S`nxxw@x)-IuQh}DdWNWmU)=S8h}3DGt-oJlJbIU+=1 zR-kEn@2q^^zI+?!0HzN)`tjY1t#!=JsRyC@LI&9_!tuwKC8PK8;nWUEr9~2A@T>mQ ze-qA7puT&rKMK~Z?T{uvJ5{uj(km+f(| zK8~LqsK+GvmSr>NK&dQ>e-o8;O!F6-s{)Vu4o$}+f# zqPUe66|@^@?MX!-V9Ci8Eh>ul=`P~eVGnAHw%&iq_=xF(?=6VM=5lk+09`%MsdmHi zYMHD$&bW^gt#Emc#1Q`<>GvMNniyq*^fLys1qRk%AwdZTh*8(?2)9u!40}=*M!#PW zi`wsrl1nXOWD6F}HEBvOPH8K?BEIZ%C0>thJWEVg&-f#S-^s!afAS6Xu15l@Dw>Mj znQuCm#R-YK#~z9|Hoh@eu8JO8Quz30ElEur^-*peRC3+;xQ~~OZAh#a`y?;Tn)605 z!~F{9V3yc>IQ1UML>ff}t^AGME_gTfp6b!sK2Wr1D`Aaia8}w!a_{*P{w8Vq-HD%z zzlynXxaPN)N63&}f`KJus=T!r*G945q%eQ&pb)f~B;{Lw zcvl(5G}?-a1)BKJm8|g~$5?WlO)ebhANT_&#&JQ~?Q9CF`dIT+BveUa!PXCLL&l^i zY29TN$dZAxE*4+|f$;!dk0@a^Fl87K%U=;G%xa{SuN&@rd!sOT7rucEk>N7H3&Ady z*K^NpX$M->VE}YtzHc@f+hPC%&fteshhY_VdqCCupqyF?nVypf%6jHG&aNp)w8myj5^dr(op?nox*CwgA}73-H#2gdD~a)67t=b0h_f^En_EW z*Iv?>x!82xYD&%Go!C_JME{+v$?k{VN=`0|B#@mb93?*}D;1 z$)t@B4oBV>y64N{#LUw6oV|BW*bhG4^b3^VyQ$bfHh;bvLFB|hrof*1I12kkUn8!D z^o(Y1G%KIMF7d{cQknRNlV5XgOP%_!J!3*?pyc;c#xbXjl=UWo#AUocGni~xojx$X zZIq?`!`*gt&^%*ebfKnXViR)|67@8yrXtF!j}_G0o10;)OrW+{5*xrhF6ai zRlX=P)DddFmS+!BFem+3m*tt_8{5bHEvq-%?_>K1dsOeQHP}5F=WEJ&~fc-%-bF!Tg!;tF-vCD#8~HKL<<-D^d>%ObhD=G)^^KHyz*J z6h1Sjl%#HLqQNtZd3S4Za7OYmUOovdXcXi>st4r{HpU5%ouAo0%!=8B)`=R+gA95% z9lQBCJNd}4lJ&P&!;&H?dCQt~)#;EFLqgu<&g=Us-Enma7)OmkvV3wbV66suHo~>h z{P+uN39p@24Ek2Od2bYqbd^2MKqc0P$!wDNLQL-{d@lyCIrrj!N)4u7#`~^?*@Jl6R)TN!})G3Gc zH@~i#J!0e&hWR~fZLSaQL_yhwMs!xD3hLZmPYmVH9A(d%1tT=SA^a*P0c~`p(O-fi zRvv^=5uYEQ4Bh)>H^M{}`*giQEu-Hph|69$(yNN5uZGV1y?e*QO|}9Rt;3<3cQ!i3 zRoW4PL2j>u$2n;lO1@t8qH`l#2z?xSM!TOvMkbbIhmq>m?0)oPG!f$sa>G+QieEnt zH}mMt?NxFir|Yu9on}E~I7m{r(;Rv-D~pNylPj~)+@WqAcR$UXP%5DXaa`mQ9=7uT zs$3bjr6r1sNn?Nd>u6T!WvKY}@lWVB0SL96<=3ies<%E|>IWB?X_sX2#gD#3D#*zt zAO1EhkvJGfkK&Sf7*sC2_fn^`P*0W3!1=dCpf80PxwF%WEWV(`=2y{x=l!{!&xY7~ zyJ^rAdcnOa>KMXLnpbDB`cQy_F*ltNafm9WtbWdEImTRYjOl-%ECCJ|gqrdNdq=D6Q7|ekQ@QA!JyBjl8FH!w#tfGstz=ZG(udEb>`h+2U#C zAz9%7XVa_Pf?pKgDINtyL-<0d4W?3_4cJHxuSR!xT)vIwKa)QRz}qN|=T!~veu?5{ zm&1IWMke(9{G9#fP3BNTmFc?I+!-T$y;K%ApOf9h#4*m&E*N#H zdG)iz3C93wGLBP=RlkT6(VXqi!^z5ey2m|u&cZU<*BcoBriMo;+}$uHa0wk9pSIj) zwgFTi#xM`s)AooYnvx%i>-9>jSlHN_^(LDiA_X%^gpP*fx;o|JuaoqQ+)933gKtZ- z2RqTmgF}%{w7zlSIs#s2r(DuHC9Dlz*L1-d$#@<2di%AP9{i|jtsAGhk%x~=NA9vb zq5J;xdp%B)3lZ5^^Y|!p!Q3zL8uAy|wjU?lJ~JDVi`+Xc09vbuhX>D(kdQas+*V#U?8Tc{(QpW?uwQLO_Mbkq`~q-PjY&d<-Mss5yN)HB;;EJ#Ty9$&{;U& zfWr7BGqVB(ZrV*TKl=VVs)R@2*%lHNg?hEUzi=R?koojfA@L?_oSTyhQr&vR(fhsp zMNID*M#(eIZm+sQ2DPBbNPdA*L%6miNk#7)_kH z(#JD9bZe**vc`jRzY&wByy4T!if;^SX>#P zQp_))0qzWiVK5V;S0SgE;K5(=dJzitDt#FE95e5H+ftMwdWb ze;+l^1?g&B&g0*|84B7<_W3P(q^kP}d~`3%JLoqC(@}^I)IK!jL6?IYV{iNaq3x@} zs!rQ}K~hOUK)PE%5T&K1q!Ezr?vU;hP)ZQ#4ygr5w{%EKH`3j;sQoORnRoX4?Sp-= z_Z*DZrNmn6|HOU&>c;gjlh^E%=QLf z-qU_1RYfM{% zH_Ni17>K)&5U)Ku7Ib)R&lC`_mhSTmwjlL)OWHc5eH(!yz~jqgTkdgEer&mQvC`bm zv;qC_>?i2Vr`!a&gAh%RmR-S%IeXI=k|H{NQoq~LS)>FWa_BK_P9kE$W5{?K)ylnA zH^g>Xg+bbrD_#rBL9gFUwn#Ffb}4=VmZ7aso!J02MX|rqcI2+lP%fY+Ra;t>qOt1`g&um zfkU|-4wZN;DA4;?N-g%U$7-FZ^K6#K)^Yf(MI}i>!Pe`HEaKf41$N8d4SmSRe2yrH z1#_h(9ozn8Y}NuJa0E4pkF|IGep;8_)Ynv?DrU!EO^R*F>vQ!h=)c~m}HTlY*&f19+pRnt+{C#B6N zrnuPmbLm`|JeQU)tf9WWUeD{3kG-+0IN)k_Gg|g}L2>;Zg%IGA)B5MXf(Udx&l}Ha zX7l9J@R(n==wuSy2QMx1dX1}JfTQ*FZ)s5bbMRgdnj3a2m}kaSfV5mdQ(2qqmG1!; zeW8!f!O0r6aVR;tYnOxaLJ0;Ib`%|A#JR3XXM(A`R)w7aOeXys^LWBq^7cX~UWVYL z;rivi%-+r<-G#&UHnOQ@)6L<|hy4QG>ef=# zi-F{?#U&-?E|<(*+xSn00<~7NB3}sHP8w=Hdj=-NrMaC=!QJ^D;Tlis+|Dd4S}^U; zk=@;%6Q>z_(Y=l0qBU-MmrllAcMyd|-iw!lrsILZ%FI6xYFn9K4Q|sL2$C`$H>VRn zqqz6(IzwqnP4PGdFGrQrO!tMLSQ2Q>Y!_shj(~-X(e*lIduEcI!y=aR1M-+((Bo_< zqgm+l$GfShG5Inc;58ieB9DibPWa}~=9qDrV|W$o zZBs0UNh^kE5J`NVm8(ccEO#2}sGu($}4mE$y1@L@pg0~G3TSI%d zDy(ZmfN0WV%c(!%*(7GH+Ku-@s3QrTFBfZslehP6C@y`jTng1@05Znb@V73m1y5>4 z53t}O+uL7%D(yJxgEZatJ}o-vp}$MHSQLAE0ms|ez?(r4C=(_VK`s~}v_IcCR*vd( zd;Ak8nCUTs&y3%jArfL@=FT<@Z@XV&7nj`zcoluRCO>L+t7fo$3p8zNkzP=saZuG? zjBr07EZiCN{qowhhR4Xx!Qtr5-1SN1AqL4nUmKaT@GeaU*%{H$Oc!xUlLgn;$}a^P z_dP0DrZZT-JxAk|ytr=p*OnMC|F9@#eClPpdoe?gA|oxAI-TO^=Iq>`ur>W`OgHY$ zt&O~tn=>wdPf+#jS7rLsAB28zcW{T!DcLgdtV8MIMJ;(ZO^a9HcIs_+y#R)5MQoBQ zw__bo*CQjEg096EWu|dvdsA5<*$A<$Z4WeN&7+VAqqW0l;Kk{ip%#~+<%8c`+B-XY zvjb4}nsxcKu-b2VU0C_uRCa@)1f0q3v%dbLMDX9fn!#5DpjFz4Y_YwR`)7o>sXdU* zi5WYuB&F@%mK5dItywvLr0u?12=IjD^JsDd5c6^O1fMNxmbf<3+UK|t+ zz%Qd3D8BySKfS{44Q4J?nV68hj75`}{{GZYpm0>r@3YbBRv|)ki8zs{xfJ7v_@}-8 z6D;}@z8D;dzIIu`_kUn8Fnmg{RnC*^Re|4K)F@7R@GtMhuV0Ua-x{B?-KA8n*W*@> zRX#VhqLn*YD=W{!L%iq*c5Ai5SAh811~sraL=DX0&c)M zGBqNYl0+S;-$EFk@g|rUxn_~2ZE?n?-g>j#m;=XeYlC@GUE!yA_{SU{Jlw<1NY7Q*ei?)m^& zEFNxba0Bbxki5|52LwbXJ9vR7Q_kDAT8LuLSQd&6A2l=!ke6j2!Pu;3xi$jmMrC;%7+k-=kr>UQco(C(AD`c5Exv zJ!nY>5l9wYMOM(gcJgYnl475jD^IiY!$wb<*IEcNM!jv{a9?w{N4%a{RV2Mn^}xn{IWrDPSend)S%XkM6F=qC(y|@9Q)? zrV2)y-n+M@$_)+Gnb&|LVH&#!uBSxAtA#S_Vk`~q1c`%nkCMi_&ceaeuiszXHTea@ z-@~?d&TCJ)0eX@W9&P8dlg<6!#O=_-j>|IO=ypEv@`VwuG#`Ryx$eJmy4Pf_0|rO(@r?$`c4$sJOK35tTY+9ruh z&xQwzVPBYix#*6#@+;%^Ebu2RO$+vY?QdZ}2=_lf2$uTNJ_o+=_df?>|02=?pv3*H zn^!lf+rYYnO1Vzx^j#zW<%dRiOLA+U-!%cjJ@5kns5yiCuTu#CoA&bmxmGywBOYSA z1pN6K;D^7rgf*1JF&d3KKddt`Ggs2&fhljKj{6&N z%xY%#^kAuJ*T0ihQZf)15BjVUi8lTB`(X#Q=bn_~4{~mgGpn`FcXQrXQIKZn7GTXa zEF6`Tm5;S=T_(Z0src>c18>Ou1?(gExTYBi9FIT-?D4BT6b$5?J)ANH-{G*C6EF8M z;&vS{dfVHDv@r4wyn4xRU}VBC8_orHL;xL~?vCWZcG4Br#lq*ixcGP(C@A|oXZfJb zcQ-4CU1asoPd=}wdgTIS6BF;zBYuG!c}dSjpaE-p5VLx7K2I#TcL#bX3Z$4p!L&y& ztr!A$jahRW?*0xogZv9m>->@dS4%QVR6}@-@ku&a)RFY z{A30J1(S?FpVabaZhpSmY8ak8|Dl+O$S;uNuj+XKk0T!&_kEX*-`(lfe*y;wx5~)I z?-Sb*+!C0i)_gNCV$RMESd8$JC!5g1y$0{Qy6QGA_}%V|gaAKJjmv&UTkzbw znOzU14{wpV&^3?V-$1gGz@W+Ma;=Ik00JEEYu9d32Gb+L%5q0Ab*jFTR87 zs8=pIs??86z=K3U164m%RYfH>K20c73~9acuVwUS6VS`nlL_x-i0b;>jO7n!*%q6w zd9z+DIk5yZZ`BWh1VGblH8VP*JF}! zKlSnM199tpDp}*Pk>EsceXPX`NH}EI{MDfyvWa^xgV>mUAh;)r5eKg9K)5C6YD0|IdiMK-o&Ig12eY3AkscCe*W->&?PgZY5FjX+53EE;gxKn(=Eg&l}gGX*LRHg*mjk401pd{GC?N&({i>3^Ox^xzcxYv~e!c&zsx|CMX?zn`VBt^M!29=6s4|2esS=V{r?|CPuNUK&yO znp9jG!zVb(;#hzZIKx_Ccz88Sk&+l-#|%QX*A)>FslcWTOhy15v4YoQ4}@{Dy4-2$ zH*eku3Hf#d{JYk-qOz&9AN*pvd=JbUvb#f>+I-<#r1&+3>AiSV7md)Kg;Lt za8EP!Y5kizXZyoL0Ju#krO^Fp^1+EDslq4>Wrj2)fBCYqyZezruD^A3^b$?y)3eNG zX%zGtN*-DygI*jO=+zaoK0^JloGmkW?)AZf1AL0zu5+7qU9*^V{zuTXWi%zA?Lk^`{p6G`ldFODVaJ*`9!FcbX ziMxtL^bPw$Jx z<8hYU2~{g4uN2l)kK|v0hC+GxcJ)h{kJUuH^ zwtGH4CQJ39(GAxOL6=J@cocL$RO;KWWn$-y>9$I=3oW}PERIf;+WYhXu z=1L5bX{^j10P9{GR*=T*gX@`<6*W^@n*94n0A{<3ODrHe4N+%gWZc}D4C@d zS9)-|q{_LkW##3&2%mtk1Sz>Hbt<;1eO%a95;fu8TH}Fjul9bwZz%FoK0hN5J`fJF zXq>z<5NZA5A+h|9JQPstlw1pevN`Y7*FLjM_EC1L68uGHjJcMKL@>RiG-7Pb$fcjFf+Co?u9>Q*bwJ ziDoyZFDgXHIC#eAv_TPLqTuA_RtteZ@F#{RnfgKlM0|bgd@1P|QIpu#DDB{|c1+1ZHJnc`M{-`@2tYN|ps zPJ8IdvB>x@s63fNU=>$slUUa79~oHfW8b`$iGDV#?%m!ozh}q`=0__MzkV$nKVT=h z|NJK(B|9UFb;gnU;%6{72X7OQ12La;gFXd_V*5VEiOvBn0u^J6sjtx_smo$iL(T_> zXCu$Vc+OC>xF1$^#n8&cC@WD28njEYBd^-rOAHE)@^hGs)SwV2i37#Md!emX&e+Uk zW|S{+aE_Z4jEwA@oR31mPQ)W);Z%di@9gU8*F7LI((8=VE{WCRFegvaH@Sj3Z}Vym z!*80EU=WWp2fg^Yn?iAjEbimvzE=VUi5|FD1SNQ1Xwjf4D@VV# z0Fk}wR4g$OEr8MKtwm1ItP;W-=xa3WOdsD;Hra=c>b@}R`S8JMco|N8GS7wlIYArU zr_4+RHqP+Zyfu?R4E1+K>!1kFb}v;FOzFOr%1td!NH}=a&c3nG+zfJ2HS93SzScNS zE^u6Y26dHG9Y4vd&pM6nQem=-jp?&rCe;-q1RjXkJB*S^djn$4j-o@t|4Kzk$sbNS zHVYX>Qf`7I$dpFD@KUrdG7^>)Pn|ZN(zJ$yP1*m(*Ab79kkLA5=U{;*{wNFm*^ER4 z5mMemcq3sU0juf+n`6W!6|##n-;qe1{(k=tfGX)=D$^4Dn*BZWSA;w{5uq%NJ_3rP z0~HAUpY_B&>$Y*7o?S#r_g%FM%@7u35%dW3@Tz}<*K z4|4i<#enXLd0EW_ekxkn1u7HxI{T`KU#liU6*KHbh3!>v0?t z!dZ#@&X{q)2TXiSq52*tguv4_awcuTpTgYU*I)X`%TzJ`b0K$kAoGWSIL*go#%MLC zA=~%vq?6$HuUCj0BJ1n{B*$HAMdbUJp`qa?&5=QkO zEUGCm4^pCeBEP5HasASg`zh<(KUsoAq{g4Ir)N#yUu%1Rs}XR6r4Kj`6e|&A;rU-B z^p{La>~p}Iiw4};{-ksnG5ty1+fSb_9I}x623TbWxL(pEZJjVixqt`jvNK7EDVUj& zk%2Mr1e?8WIs|TPq1u)_@t&G9OxnbWek3)XR$Xyk4#&yq7DtTOxvWB^M;3W-ax#jg zKH0u@3LF*I+*fPkj_{r*c6-5?q`?^Q9tiJj(82Sq2MsE$3Jm{f-1qrwC;|@;k8zGM zlsp7CI56n@VHJ-kA2qc$KmIDQ5IXOwS-_xVN2PLanS^>{${s(1cEdvk^c^yWQ1`{r z@0GX`m}6GcZiokkfT4Y1r4H$^_LF9LEgPrCqtO3@MKcPGj^%BGI$}2b7}L$i*0uW_ z8xo<&@afeL*4bIC^_#tKl3iTD`zG|g;$^0U5ANZ?vsD&MnscxErhf()Kj{aUKtq!N z;mY=ScOs^|cyGgDb?|d%Y3Q|0jDaGg);;6J)ai$FhvtB&XRoCL`c?q6QgWC!AK#9m<)#> zlYH7O=Pb+n9uxdvDNx0XsOIOQOwU1;UM&ra^kmvzcN!dn{Q%Lf#%IKSk^I&;jx*)c z_9bKD%1Odk4>uZiM)$2)(1)kX&TBPH4%U_Djv|?2(~ov_nfAoc#uyB`uB71O286XS z(HA1GYvBd<^FM@rVtSyf0WKNjuS8p{omsp!lB03Kg9LJA$*KrYc|t@hoiu0|0J}Xm zGNfWAp4;{GC!J^BR-+q*Vmz02j!qXaW)W1RgBQ_YtW>qIu=q`9A>1n&4}{hIBR_y@ zROD2D2SbuT+d2n?^H5L-tqcm<-8WKw=g2J?sP&^IWUyPZdj0OxXDQ8XBP&qaa0$B% zQr`K5rCdG!4w}Q;n|+@&ZhMh%zH9(#HedGJ+BDz1W08Y(9zPoa4s%MP#!hIW;Vj57ej??{Pu2x&Vl;(STL%wO@n)1Oqm7w>a1V8r0z1ZG!67 zhxYg@e4PEjw`~k(*&KdBlIfHhWsj8C2=&s@K`1O(TU(R!xGwuTJRE%9yJCXmhkq2O z@eielUVf@sd2tq*$}1jTVgAhRi26)*$Ti9l@%tnbiVf&B4=!35%KF+xq@r{L2ozvmYj!*X?GJq2AFFM;!SM-!Bz$QygKs58j zHD1_tE602qV?&_!72{rUI1zbBK+bjsmS!0{JHZU^UjrYK(O}(WFn{BaK%1F#!QicH zK|#yBsyEchE$LliK5lFZH$2u0iSssbyV7SIBVc%)Sa`Kw`L}Oqk@&aF&)*bl7vayv zZ6KMpzmJ|cZ=654nuL9L;F+TQ0f_E%OgFi$;Xb}R{E>5sx9dWFJnPb6XuP|sQGnY5 zMq)gQQ@l(10kE4E;IRjxE1ww{SXcmPBJKT4{6-r0+A$DTE^a~>zP$yy02+gUFEmsH zE3}7gABhbOa#uBcL?43+a&;nrMv*NoI+Zol-RMc1L1+aRRr*Bw1iDJ-D=xA3UJ#7*fSx`s0&tXZa0!ZRI`W9CW(JY+(kc>0OJG zIqla8HZpPP0`OFbsX;WxAi9E)n4~lhK$L=kfuS*-&uz3PZLRlQ9j2O-5cKHe11O@v zWQDu4(a1cGY8z2^EzgDzFMYGK+rg;T1ixmVyW4=%X9Q6)jZdPYzQlg68hYXbCV10A zd|&@nuHNxveupHbnfb20Jv{t%kkx)slTb>yS^Dk3EW>q~n}`^f`gzB2Ke;U{^K;gi z%y>UwuCyM(68Lfn8kN7Qs+u@|fByshCE#f~7wQI6VAIP10Tu^W@B)-0p?~^q2SpeT zmdd$s?MFvQq_9D%;@W`HB%pU7Ct5_Y2po2<2aDI&)G;p|M)N@@M1}q6QJ`TC4QXqYlqca6%gq5BKGoe>J5Bd)} zSK}VUazE$Q_$(Nhf-hsFs*3-iU9nq8X(aD;!t_+VqqYgDJK-eB!-r)a=d3*0^z4+v zAN)*?>mnJTCH4ES;5N-J8`_*@WHQUm+z9P`2VOQ_NhbYSZVqMtKzggz)4R-jlQg0T z?y&(DKly_0iq<*{@vcbIXHUU-?Dj}kOKWF!)z~f$o|Ax#MTN|HGHNEi`R--lZqN32 z*z3upq@+B$)+O->Kt{Z-yIfr-kH$ejsF&eAI6aN?LkEJ8Wf976-gCT@jL2;chX)w> z&(Q$WX{fw(9s4LpSZQd@%&kK3$yBxN!k02b+7tj4cXWb&e`q(8Pw277rhoMNCeb@@ z5_i`86O`y9lEzPziT^Q)aN|4bi zXqZ98@T&**e&2#>tbdftyj)r4 zy}uoU($N(u^Ekp@+M!$@wWX^Ih0wZpn~>drrosKRR2<9Gij55dN-h~rK0e~l;e-tK z`W6MVVU&g%)2(%<1pNF%_v+v6#g5@eMU3b7T{@=2yQj;BbCH>;;u2yH^!CO$Q9v}V zPa%%`wWfib6tIdWxuMNX!2N6p3`utw2H_oGJM6k69vGJSxL<4jWZCcjT$|0m-WE|# zSu{e4(BrXJ+m$%@)<_oqVo;-jEWzL@

P21gEOs96}|+yT`mvj~mPqB%5s)UM5Ju z(SrVGF+s*1Bx;R8?}2soSyBcx(>yeof-9etl{iM8{Wx+5sn4kbU0}y2USsi*d%JR! zFAo7d&Os-w04)#UgXjn?26jqzDT}}lpuPj(j|8s<+$NA%y-x)jeC-r9o9fX1nRxNi zI!-ct@Y^TR1&@H7c-Qw7d%$7lg|+dM004OxBBb1_L*Arb*%aV?e%h4ku1qlloe=^S z7~x-AV}<03oR^u+J66e}Zn8$O&85aBR)fDi4#1Ba%YGjPnjAQ`jtHF<7UA}#!CjFFtz3H2%_2ItMg6)JEU zgW>~i2BzcrxTYSN4o-5m=IbMH=N>0hu&@+&U}7)M(}E%uO}Co7+Oj6R6=VF8grcS2 z*xj91jhQAeO0{?EO(7LEbqC}XIRTK@LDM#)-Ha>ioT1z8aH>aJ`U zBx={l``Pu5s{^rLLDWElDFo4Jw0l$l#AB`S_e8ppz+eMFBt)E|YA|xlDXy^xW7N(; zl628LRU-JZL$Wg4yWcM@)r807v980Lr`?bKJUJdql zc>*Bi^tRWEFFP0IKb93t%#wK0P8qG(OdIG;Pf2MHq(qeLS0wneV8hV;`K^hU2sZG0 zh9-ll)XbNLmI;oVjg5^9S`F%iZu7{fz82&OPSSw18uPPtxY!L|=s!F?O|e_>I?@y@ zpSqHref9A1EYVBsCQkD-gJgm>9OWxCn}P>0QtOWO9R{5J&6aU39J4-Z$11 zZfR>1Ri%4{S7Sm+xzgGS!-qM${%~aGJsUn;^aidq5+RrebubY0=5=Ia&-MJNASF$+ zLVC_L$`MreZmQWwP-*AJYyceR1i87rkjE_|$F}z`q0rv_({9@vyH~`N*|h0y3fI~Q zBh!l8G?s<5mUoG3E?}ZJVBu&s{QdyPBjQ|3u&5wZ9+!)Hf`)H3aB8{#g)WIC23|5U;!?5T;bHJ)PUuWE*>yTsI$jyh5aM1Bd0fi= z>eR*7bL$;n)>siKEllUwNvr*p^6t37>h4pcgw}TGK~F*A`U?`T?c0{jW-USfnk;D- zvc|RXj!S+W37uO0;)}7gmH+9@G@k&-7@XG6Ogr6NUCpHE-r=d->KhApiq6%$-L9zK zc#8`!6i#=bZ~7ku+cLdsvR5DRaVgvv?7X5*Cy<e%evKy;<y znJiANZR8Y9;l;a3n8bv1p9`4uqvmTt#dz#R-E|J*@2-9GnOb#tODBTemDOHvMJK)~ z5@Zax7O+Zn;qhYF82hoD;YT_uMeyVK^E4Z?aRPx={Iq@fWW{@hneH@RDu~oM{q_!J zYW={~^s>IGcJwk%=|`u!m~mr+*6y%qd&$2(ZX?ev0m| z?ti#nk}}gwm0_!6jz>b19l5_ABzo|(loIZIb7tB3NSB-sgZy;^ANM4-Xy<9WJ4|2+@fM?!zFgiCaicew3h=ud zU@ZfKD<0LEILLFC9qfhOItY03(BR*>p4|u-hom;)cj_*CToz%4M=^*OQq9kKwep*b zcuJP-UV4;>ObVBLTu}W%IE)c=d;3DS0*^!+l|h%Ndj~yxnc>5zN3+6F%ZMj;TISi7 zTs$@VRlTy3GUuFNReZWxMS<`$IoP}k|Hm5g1-V_hCM*6TiaL1~9`|G4^Us4K?+F}^u z2;-s%Dc(mW)$$8a16Km*Dw+Ag*iQ`j`P;AL@=FXxQ6QOSt~3~R_EvT=s~=lZ^0inP zI(A@iFjFOiB+c^j^5OwC>5;wM8l zXr+%;B$6)d38{HBPx^#l`B=J8FZ&TjAq89z7W&SK)Sgr{!D8$lYf-XuysFrWuN<~x zlx3^$z=#;@!Jxd%tzA;2QHVxtP>bV|c22IDsmk{uC%DR%P@#|Q@vpWsEPC_sek9To zkaz%~KT&1Y#xsijIy=(jjJ%f;IINJdC*%be6*C*xMUHQH&HLcS7?RMGPbic zC&v@0u(4|&>T1kzJ}(}!DuHiQ)jSpB2rmw~scU`a-TdfbeSrdbt3W{E$*0**%U5o5<5>vzYJ8*Bf{_Or zr!ZO$gY!rM`4C=h4!jPQj;KIA#J94RR4V(vA~ud_Avc6LEh>t8_ppls44(x(^RsHJ z(8pw~wV8Qx598+*l8;-mLCHBp{UE~)m`gaAhQltV=s#m~3H`2Crx23`Jl=sO>Os?; z_hAezh{5*iN^zNY9DFZ$dl)L0!e@!Y5*fgQ5=mCZ2ZA;6*3vEd1e0&>M8)ZW6jp9I0hA^ou`hjoZWyg73iU8}Iy)?rg^NdHW;i6#; zZEQcg!9~l4nZUwBa7Q98TD%c2d#3}NC804Z9Z;*)Vglw_-IbOv_6eT7dKmPqq<(z7 z8&&SREIb)s@xE_&t_}p-%A#sBO7usMa&DK2CHL~d4Bx&+J7zu+)BEv@<*imwC{6MS zYjk7I@v{+ctd~Ix9klps4D9D@2Kg$N>y^DA1;k?(F(zD#OG`_D3KhJ2k6-<3f8W-1 z52;!Z5CwFXZ1RH}JJ!pu1Q;01P7^Bu$DbUNjP9nZy8t*s`nN_&0v-|7)z!7!^nOwR zSJasgjgr+78p5o`ffYKi=8J-jZGX8xiQMx*%?o-m9J9sv8#lB#J05Jlu5SK#)m&Cv zTML+gyNj-c{o1RNs3cqWjfv*zDr?JP=l0C}{0%mr1p6!NYJC|w@6#U%&w!p|zu~w_ z5{QtfEHfF>Eq*j+0a)mE#;HZAp*exu$p#G6G`SV_lX5=4yd zdtYfvW=4QX2tKD{Y6`Om=L^k_>jW|3pnR^)7jj{2c3Fhu*5k@uX~&qL(*_r9&SxB7 z-SgSttm@MZ3RYUJq7ML2XX!Y8px{x+ z@xk{Rh0fQYwnQsK-nXT$>ee+m@Pq|xxKUZ-eu39jYqUtcUA-SWqsKY{#ui8mzlDaZ zfK$2RQiwPYj{aU=+xJIs-%M7B?2GAVt;}ETJbZT>yID3xgnYx`zP(geNpmvEw~teK zUpm@3Y^Ko?Dt$x4|Zwo&-b*~+z_W!v3+0bo!8+J0mrsr1ws;y+4c}}n+C7$U1rtW zW}CUX#_Q^Mz#P0_rnGl+?>zOodU?L{4dhE+COk8}J%#v?_3)Li6w~fM(cW6!M6$gD zvbcS)cOwO5)0&n9iGlMv?WOfH-^tDS!v4zG=7Q~$2Uz659N`nU|6Cvhlbr0i`$=M@ zrRiWoxWm$XwdKTKf@vxc(+7B6o%LVni90z}yyP`#?*{(8j;{VEOib?2c~$`-$yUEp zPBp-+L6f;yTyj9`Jzep|WkLI_Yx2uBr2e)NysnWxRBF$dk9G%*gdGcu$ z1f!SidA`*wL}8F1MwFZG8g5)Xlc}{kHe&S17JORzDVF=mY1Bm^+$yM|$jfl$rpenl zpP^sxsgiSdYNy>vdm1LCzcoYChfOl?A}{iTn{{oGbVf{ zwnJ8?hteK-tj`sUz3|qFmlAeBGI*ApE?C0KdEMmOYA3J=ZGXedUt^;HC(Y}j6=n%$ zVeCAw_d`x1{XocvA5r(D6%Pj|Ch804ADm8K)CNRt#__!o0F$L>$_ztZA9Z0AyOH@p zAZ&YnamX8iGJ;;vpM;x)F=$D%R@>p>kID9ifwjz@;G@71)x-0#GcAP2YZLwQ?WNDT zQz!2YrQvh7ht7P|hT~N^Ray5P*=q3$8 zqGUt-?F*xBY!U%Q)w7eI@+c^}&sgZra^lxWFV=(rUGSRAVy0?0S2hU;$D}`*=NZ2z zH;MD4XAiBQ*SF;vJAlXBj2Hlli!A5>SVG|Lt_S#h4zC2S^+7jy(HXm-I-I>dVJt4> zop66a;^MPPb5&+!$=h#rd+^=<6Gj?hz%KfuqHDi?{}#pPlsVhysHdxk@fgxnS2C4B^}Cte2{*?b2U?r!n+gcc|Yl2L|I%rl@*&ycgjZN!_s zB*CIXxZV{7_$jC$Q%U)tP$(JSyVv1K8?#@JSK}uz27S)wTwcC>d3!r;>AX8#z3*Tg zKT=-DUL!%CGEzMArrF&NDCOz*W@~X7UFO}^vzpzU_L6zdXT2u)_8UH4(OBlD*{{Z_ z^_o@!`Eb1M{J@jrIhV`h^*oqu<$7U~{iv@5BgTarqRG`g16y1xBge~9)*L<{Lf7r`e&ac2SXfx<<#C$)jVtge)yl*-@;Qt$?D~qjpX~UB zQ9#7RpW)B~+zj@rYR&$kqxzlvnM-O6lvGBsBqHV9H!^_hh8!dj-VFM@fT7v)>h!1^ zwR9Va#I|+!IW((n1UxSenr}}BA)tk3-nSS#3M>ZflfL zS2yk5t`&s+`1WcaXmHagmNUg|uR%Dv%k3|MX?SKy9uV+P8?SS(GR@ey2dnNuy!N}P z!{x4~*>7D9<%{XUT;QjefA_zvf49qPx7c!h$%u`4pRkCO?$0NyRrE&(`pieD3z+GE z@C_QCA-Vuu13*~qVLspRF1|XzvY50aPkDVnDpV=}88h*4_8V}oFAXiVq3K**`NAWx zHlB=tWP~0pi8(%Z6&ss9$7i=AKTIAU0w>Fj(%D* z#*E$ub6Iv>JMfyXc5SohWb001WU$3E-+h6hS%4!b189lXx2TGDPL>osKq|W4WU_=L zJpLq^h}2rAG7fx|c^QmuhOyb|9%d!5Ij<~e;E&l)plbPB#>$Eet7AUpYX9qRE=u6- zaYtvxZ<-=huS$NWDG~i`1BhZxgyDvg;r`%{bFsbGPUn9}O9CVS#5^1{g@&EW(uuSa5fwW-j*Y_~;@8AxZroG6LJ1Iz0E_l- z#CO3XKxRuU*f0?fhNCIsQuh)6NX!MBCj@2|P_5C}96YQ-`7iWRL*VjK0&r{3$HS@H z$r>_Aem9?Xw{WnvKS0mH?mab<12l<7UvMHtW4J-jd6bMVfs2a+N-Ts>?gF3DuW4sb zcxgX4Df-La@B609IC>z7I}A|oQBm(_zvqn*(ouYPu~ zwPIP1deIqSB=Txhh60LEaZ_!@Xj*lo*qgU6lF&Lf>0fSOjAsopcZ9B*nNB{Tl@9Bk zRQ7ku>COGn6sIDdt+a;Lqr)59eeA>DqjS8)^02J}L6zci2;vj;E!45#$#8Xmu#SQ_ z^@qkflkDLij8KPDH$Nts6k!A?GM8q)L#T#%j+%})VN8vc-JzsqzKDM4ZP-0&`WD3i z4KL;Vy2m9_k_F$s7MR-vs>1*4u{a2;H`{23F!LJu+;;rMG|TvUNjn^Y%mHeF-`YY- zt!Q8b04m{6^n(8FQBhHU2t7#@)Sci4&2&7is48i?jkpwQNIzxjM7!Kb%0c?Uh{T7-jK!3j zm`^$5KTqe%+S%Cw(z^n0GBF{vT)`Nne~hAZ{V(EN=TTyGbjg!hAURZV1FH!&>(tJI z0zrziQufAD zxNq;e*uBW{k6`0@#(-qJ#DufNs$KU*nNv}7qrZ(%tK78=m_E&vF(Ozz)wywYSC!J< z)2DjkIDa<|IIaQc%MIVdvl0g1LCiBH1t%xYR)#rGsmGk%&mjYA;Fdn%u~4C|VE7l( z9fj7~t(dj=g%Zvd5#IFzmAMOV>GtNz!`+=JO%-03z{B+soHw6V<*#1`f#K|7Z@|M4r5x4xRt03iZa`g#gAX%)@Q;AB6_OuW!59Z6^y1=DkAjijVFmVu9sETm zWr)0eitGnG3(}iU@n}EC#!^^e{h4wCxc)|Z2-Cf9(Gk;9b!bBJVq%EsuO7=y``Kb~ zPHJKJze)o2=!nx$ZuO8sXsnaDz$lu2HpN`7H+K|_XcRKii_0iKVCfJJiUxrfpV5#f z8=^?Ex7oSagob-v0o+hj{x15-M{ChCl-5S~)AD$OPCYUWJT(Zq8l%yPn6{$JoEO*G znL~o$!vTaYGPP)^*5a>_Lx$FQ+KebmvNYvvMEMF4ob| z(R3Rvmr_=<`P_M3+)XdJx8L|C!GjCaeo%mVF)~zncYhy?)=tLL%d5ED84>wih{m_9 zd*hHoLm-P2&lAuK04XXl!Yz;_@?=8x$52}BjNI1}=vabgq|$b9CmRbVui%UmEazxi zOaqir*0E(LfOeF7@S_E5lF>x7Iy>cvlB&fr!7oJuw;qvpP}!L)2<`yG&L|bgJWmv~ z^{!e_`9hp6Of(bB-2w3M@8%NXD?AN69b`iZJ~ZUk;Cfe`t8~oM$L_Tghc|Vo^<8qz zFgu9x4Z7G^LSQwx=w1h0XVXIsB3KRb7ZI}Jk3bLKB)ipGVYNMKJhd`hM)p1^IM}BD zM_?L49v3(F<6HHC>IL_AC+(DaXJr_ypA1&=c?}E=(B%yCF ziC-Y=n~UkLFXpH*2&W1CV1-c~&5)pY;`LMPWzrpZ#uzyEm zg+(xp9WsQPkJ@VSr6tM$_r3PQxjScN1;UFq5BL^Oah^|oNLJpg$+a|k84WJ!FWlg} zdS02CYcbuyT!X-PQt-7{^!D!2@zIu%zy|My1p`I<+EF zr`i3qK!&w(1z3puB)l$$GUD!RS3%T!B%7&Oem;ZlNhg)!y>&tT@h2Dg+=!+o$7}u7 z3*Pl02qgABM)S??{&Z#ibzHpe3xa}`B@K`PbE790@z_^01?%O-qFVFq^A*L}1s(Uz zGfL5PU^LpFw9l=BE`Co2DnpX#dY63^!cE{jVwM295PY(iTGEQo>wbkX&wHF}Px@|A zdjSv*Ko;loe8@|{kp2m1(xf7@%Be}n$wPR<8blVdgV&T6qW})*a8#JW=W^S8M;yXX zI-v!OTiS=;!z>|<`1)T?Je8DyH5-Fh5ICr;PN$x3+aVOqU3Ls8X1x;5n?J%NTr)1O~ z9P*S;HJGJcQ%k&@IV5BXY5+A~YbCqWNoJ%t#59UW<{W*gEG;JXpl#Xk`PXp+7eOk5rlc(b~? zS|G+~{D-+|X$8`gqYITWx$^f?zxNYe&q-i=I}ORmgmwlbLZ=p^V1xK(6!Ju_1{1kjJDDJoL#;sc4_+NQi82hJ|}q=14(%Y2X# zn>ORg`FZtJ19vghkp&ljwBxJ9j^cWs4lxtDcp)?5)WfIQLK*WP2y|Qz?~0*5!D#p4 zDdIl`;z5zs?ty2q7Uxva2J%%z^?>OR81GI#LP{9CX0|>)>WemLq8Tdar7zW(v+{;`kor2VZjRlhQ8vIL%5 z7Buk3|3l~Nf7{eXR*q40T$h4EtR4~)*4oVR{&7KPQ#v?0W@XapLplcGFAoK$*7CB= zzN(&tkVS+sv9O3!8L3dc=zdJ|=2wsbXy}z5J|@9^R@|d0r7MhR^24>Hyj&@hLG5|0 z*c<$@DiEb0HHt>;YtnPHKcUN|0zVAM?R=4kz8IMbwm*3MO{_$$`w{UupuDD#|?Jqw<$*D$5HD#}4P0Zh|@UvnGFaeqD{`D2090ftR;opu}~U=c9+#Nc~wIxigy`? zQrbKGzC>Pzr{kr3WzRm}Mm~fI3&sP?Jjf3MH#d{u0niqGE}fr?6ScD%wevMx+-m9Y z4=?PP!%V{a0fGkqq;7Fi%npO>i3%|d!0noa%v2O0I`X$IIfwUXs+=hu>|Qy>H}72 zqQ)A02#T&h=rr@_RHqOY0?z0bGf-mWP)T(H+!5Jd$u7iTRE4sy@9O(cq0@)I@}ew4 zb_bMT)N$l(bXF6Bc>Ims&5qON`5Ssx19F>LhI<@d(*^06s4}dZQ~l@Y0LJa^?d5Pf zc~5ny#h(LCMh(f3Cj70vR;}kqOqpb#!oE}lFMqa2UWt1G)q-liN46zH$KwYA)g)V1 zX*sEfreqObV1*84w5{Zm)!ax#kofuHR|n00YB-zr2eMBqR0h7h3~{GrOcTK60FkU! zDz{nGG@~`#b8*9g6h4&DV2wV?iYm^Ux=y{+Y>J}h`E=zHcE)@9QYhdk+{`or4XJ{E z3y5$_{t{JcHcTA#P-Z7Z>kXpAo8)Wrmq7xHAD5lX9%_PJF$cUuAeqh!z-pjquHwR{ zTSp=;is@4tlc@|?mhMqRgc|_%cF;DqW#CVroUd>*SnVTSnMTQ$ z`a|AboukVozx1fO^+FaDZ2lp-|2fs-gc#*QX$AzAdCD__HD7-_i_dLVio$^)10boS zn@a+)$VZJDfMnA$B#FrLeCjH<9td=0Kg3S?ZiSDKU8J(`YoI0(Yg)pNW&TpY|H@<| z-4N9ky!0v=Q*wUtwj2?Y3Gvm3#|fXSu;=gL3@f&d#gn;#)I<`zhvNaM(?DkiRI{gz zOyzBP{#=C}vMsw0A)-7o?u%QVRm3IAj&wt&IpeI41Z~_7Y%a~ zq*cL;SEw?({s94sPFAl!jD+%0ts3*J0hGw0&^PJxhZFP-Ke-A`5rdfgt&yB?Itw&W zq^09KfOn<2{*pSaSn$h=xXSroq`h@mR%_eFNrNJdfHX)eptN+C(xD=uAR#5Cl!SnU zsC0v*NQctWpn!BEUD73;GS>t8?)|+p^UWMH|9b2VJnLEOURRvw?*vU-{TFW`=F2y| zzYvVp-YHubEmD9HYTH}Kx%U?@f@pn*NQzjXCL^e1(VW*Tu=ahj-{2M$LgBIORr2q6fjL@O$c8Z29{I@c)Dap+1mWf z=%gyR%X;e~zOOiV`)I#R&1vM5a8U_5h^HL9<~0-V2I#85PH>29x&nMknqJL z>%1|u%MW+6e2Mpk>3vVY=zljpN4&~r#9N<25g%)XdZ@<31B;gYT-9wcfD!!U6blU# z({Xn#M;k5plTF6meErarCVlik2m>E)NkJw@R`Scb;%kByj}nh1Fty=M7aSdo4-&=p zLNZjdD^3AsSGLT&bT2K@*HOEtUV@cws;mNqpzJ5q_%CplEAIG#DT(Tpdq^EG(}$VS zsbQ&P0Uxh)S-HSU(XrUnw^fU5d@6aGjWOBeNn?*0upd>?S@W2Z0bGa~@@+L%rZyg$kZ=AI`S}~I!LOl!0P7ajTqUCar!-3j=AT*Y%|VhwmC3 z(W=v|s}D>9E-t*B9l?)F=4a#Jh`c3#D1_P^omiEMwMERt%z86|ez;Hfy0q2OAhRMS zD{CN0)l2=}m@ij&)Dp+tG&>WlVlVrCx@14n#-*Oo9uuEswR2M1E`9ceH#SI=(u<@s z2x1t%n@3rAd3pn!*FKGD;4fGx!Qa{3tf%sNK6I<^y5#+f%D4NI*L(ZZFq*WmFRkDv z;xpBCULm1=M?5-Td+^fY^$lH@pQT1pPpzHMYpE9+yCbfGqItu60Fymq6I9DA*a5rN zb}L#oU2plT_opl2Ier%S$|Nd;JYX2DdOJN)tdlh9%AxTg651qcs_MzTH%h9ha6mix zx|rU3R87`Z0Agvi?S&txaU_L!uN$aXUyDnyDBpgTXY1J>W|8NQ`uI0GpHv*!?_R&z ztaLMXD00{FsTaN}y@a0KC_Gete6mMz6mruj-)rvL0MhHoJ>16kAefpxuGr}B);t?W zw--{sR8_yPXLNhHC97vCmW_Ry2i3X^*)^sBbEAI%Ua@$~jSR>lBrdcu$&VM_ephT& z4-GSZo>IXbEQPUAY-oQmENmzq^#Xh!K2}Rjx#If;HVWZdrawh7^q4ACTpj5!y24tN zP#t1TUrmi@h~c!Qzgf6Bh+^;~&XXyg#n8-V^l`Hl+9AcZAiP7t2XM*dn!~jPmYr)w zLKsz*b~?f6ZrMJo$<%5o*)kGKw;qQfp+3A7f3FWE?)R^J@2on8vOE8vKg${pz^MB= z?DDj9-B$S811pTDT}%sK44i-dEFE{p++3*3zknO*P+liaU;oyP1O?MwTe7~sPqW;$ zyM}QJX||{HqiPZXbP;}n)4EC1E`xncS+ZP84VQSLG2LQaF&JNGXJm*Iur#a66{&d3 zj0l(ez80|85<=}5hU4?xDtIfvrEP{>os)NzHm+*dky;8J-Sut`^*t8Ok1R%gSpL`s zR7#LE4TRS_%LMTmS)xW3K1qj`{Vi;FsRd@X@&)Z)1WLVi zW>sNnKIJpA+(~)oksZbsrM$vj`@)q)JYZ@puYF-8=y%vW@Dxev9nZP(3iV1{G1!M9 zt{A{5s$T7hjTUDgRu$<-LYT_iV(iPQ|VePRc2|L!v`!s&KkO@Gk6!qaF2v#2{<6h@y|3f`cw^UkV)e*Y4(# zIn2EE2X+Sww>>t><`*O|{_=?kHq|0)bo!_nJF{VjbrBEDJPRUW=wh*Hf-NL54L=dT zksUJ;oMy52kO4~B%xo6$Qf>#{4<{4{Abg{PZ&#hgtOw7F%au zys$>9jC)5wZ&Q)#jD#FV{wRzTS_@dPt4TGZu1^Y~=x4t$SP042V>d)GP~rP{#59AU9I`Wai!G6WQk_%nxMmm zY653C^I(2k&`De%>C89rPe$HGOq_nG{c48xJrkai`-PysZ6>53A{r9G59rXuc|R0D z^mBuZVE5NAiF?k`UAMqEYF&OW#e=8|Ssj~|I3o1pC)G0WXLg50L@+81-m^IjCV1A! zj$9v?6UHyY%*Vrf=^J|t7a2QVP~Y*!6~oOoO27E~S@;W`SbW|VI7v-le6qL7AGK$O z`FBqbi6Q}u^6OerFl{J{#8QbCR4KMJhYvknpG`6DGk&t3^_+UN1RRp|q7GTSvoSG` z2w6J5!r56SLu@pV_u!hT94{-MYuLd~L{BJXikL=O!%A1Ocl$MxNe<%Dli03qe=y0wvQaFW#?9bJ;(ZZ~*(V=@rx z2Z_nYTA7as>vF#EKcPFC{IUsxFy%XU>IYd|7G|2>t&bKXFsO}pF{(*77`^hj{agA( zcgFmr_7%VKTY^tgcl1t(oM81}I73lgeqLOhX8y;dq=!E~eZc=V_;#Vt?>l{{OR+y& zoNZsQwT4*r&gA%QgOnVuwB_#7fLrM0HrdIsl8?G9BMa|hYh5JQ(4P3ZCxELIzn@gZ z23sIfg#Ypn0*m(#EDS~Z{ZM092tm*6!g{(qI7SNM#10qugG95w#`%>D$c!Nv+{`;)%@UaSx?=6>unnaH`9^1|(#9W?x^9JP*8O6+WM?MV{Du-H^;K&Zf#&sEj zx^|Q2J-(eS3V(7rCKmCT<|Hg%&gO7?F}7Fi{lS#~uwXG>PG;`S8so0kkKG!c8!as4r-iv|q{3?%n-tnUI?Og3PbW6ZfD?5ZJ$k?K1GM+Fx z<1@WX-PWSERej!TYwXA*)!l#8(ah5KMj}Rt89ljfCyaZZ-)`(GJW^>2_cD*Pu5K4B zAs}B*tk1TK4)&x!PgM$;oChB+bS3L#yobg5)_}p0$$WnIw6-wEvVikOtGj+xu>fM# z8S)bMFYh+_0I`rPx{mlMDmkPjB~R-Q(1@7sbV=?ULo)ivmrv&Mdzi&eaeU*{V*=uc zoHoQJvqoey1NJf7{3wsdqv(okSv@$5ss?cKad6>L zE=L1`gsR{@fx;k753^yIovp~5a>pXY#>_%CGp-~tCX?84K5k`wKI@<&Df@VI(z90W z4^v2*fS9<*=@;Qjahbiq%nYx57|Rp2+B#7=Ib06gsqXr=+z~`?ukcnP) zwWvnmo}W}4Oi90?;Mc!hVRL4<{X2pxdc3(6R7Qfb*cq0cm}s-L@LCn*vZ!f+eM zoRr<=Dv*iD(?oWzL`dG!xPfHoTjF)I8J98G&n|5t@J2M7Ru?}N*fT{SlNDkHNlLxw zVd8u}Qa;L$8m@#H9o6A*=IbE~{iLW@u~{dwf&AccEO|VodJ* zFzB1A>ZQbaiLy^7fwYP`DZF+L;yCEPOof{DUAXLxL;mo6&%+zfAe>NMQ)!U$teX6D z&F67EJUlo#Ie9Z-RHIjVshSbA`g^~?niuua6c)BJa|2eu{^?(J_pY^Ha5wMsR*=i3W}p9M4|sC>pI%^)>fEbF`9$Oh;R0}t&o-liz-18bw?mce$%)D zjH?e#r1ezYG$m#)`!3y{J_p|fa{>59*DnKGb+Cpf@Q2A3BVGC99#KBsPGC7bifA6G z-0*C#c$lv&vhA-WPr9eSEhmRqwv5{-&>E#Gv*h7;V>I2}5!rhqUJ=$SrR$A2BK{bM z;`wc&o)$`*JWhL{7gy0#K5b#u-UgzMw{h-_-cr*~c>D#7Y+@K(0P-Y-s!0c~6`RDq zwvCSQ1TZhZmiAPij1=HN#|_vgJ2~2;fw~X?&Y>JCp)k;N-C1H}bqSWSlX$o>S;t2s zB;;N0@PudQ(hJb$WO&)F`oOSAMpjnQsNNH_+`+mV^2X*OyEfh3bK1Wu2G>9A1fwGx z=eC!4F;hZ8vn!6|LQhW*EUs4$@fsg!Tn=}ZP5XZlg{mbm-NTjB6PdcpYv<`5h?f5D ziqHU?F&Yk*9Kj&csQXVZLD?GWmqlU%(P2b4g@qAfXE`OU3KZ5*f7z}?hq(6ar?P$M zt8du)6!?A2ANP^s_%Eg65Qw|dtHsJB+<$ct8mtRM9ciScpS6hl1?jFv9;-U*YV|l^qtPjp{m;Zf^91~GeUhkmu6nc5&G`iey3N*Vs zg?k_U15Z=GQlZFwox8Sd{@&hD(krr$I4KGC-jng-pWW$;sPBoUx|8gII>{_k37Kb} zrUgM!2yZYz>{fOB@S-V*XbDy`J?wB_Vl>HFdJPPSnaGXIQFU-H^BV~$VL1UaX8yB8 z+m3mk443t&(@uPOp$xWpyQFJS`lEm?=CN^^Wt0s6$`pE;nc*Ap_w9R;XC<#Ls9>%T zB-W_;+v#Gc3v#^qxn6_!6XV3BO`CVg2SuK*Uu%^M@y`Ea+-p97fbcKS8^E%!9??cR z5%8T5!Lfje>q{N?4!LprH`kG*ToCq;;-`s2>89#tbtS zh1kt)V%gZG#FA@KN6512hg8asYtP%|WGqr;vm7jY4Gk@q_#cWYL2>ZT@ACFgPSh6Z zh1yrlL3<&LJUo5J1t+>@D+>HY7_lA4c`w6~aF|CO6Jz&1+c&=Zwx@qy3~pd!pXEsr ze)cGqjp~8Cyu3GVjZ!xGGfBE1nsWc^aph=+?VlzZU!m%j~b>M4(?O~O4aydXRMN)i9pqjeX#~^<2$+(rl(%$V^cn0-T zNhcuEgpM;LDRsdf?P=Ts1rY|U_`GyCUIVh?XD-?b0bh;U`Xw`~KKZI0cCzi%1z0Jx z(7l@Cp;J{;OLn)dy|SXmVAsb~pb^71FPV2y*9mKxl(p-2g}9N5AcN!TC~JNT?NeFV zinK3C!}#o(D7WwB=-?dAJYAF&(Wj2yKJX3$Z%D)?U zVbs%P(4@J!?5X9m`1$xSFff5LpxMEA^sqH3QHqv{Pdj~};gu5rPw4Y8xxjA)qEW69 zXXsbu3-8f0k~#o~(mVx7K4Gx9ybV?xMDRrj888%^7gXO&ZcmlMWT1~??4jrGDJ(sZt>R94ex9eHxM=R|T=g4hNdrI^ zgpvOg+Uqw{Jjshd6SNea(7gbrIIAvyw*u3kbiyk!Sl{6`Nhk$kXoG zQlUcN8CpiWqxg5I&6E$hSyuM2F^@{tu}@%_IMx%8u4HB+Hu(Quz5Y`~{tZn)^M7H1 z$>DRSO|+AL8(c#S|Lrs@r){oW*eY0pGL(k~@qAr4H^w$QUj^tP=<)%ImJZ=OYFlj= z=+Zva0e~7!fhY;q|kh#ZlAXM;4?G4L_(+1$AAy`OY_o@W1FVBd*7{1KpscijtC?ES*3e!h?`B za5scn!Lo4pB?;=C*u>BjnRtx*y72R%YJa}6vmzf95TmW5!={!dbt!K5QEa z3n6pr3itak>8b+c*$B}+*!Wuqzoa%(eT5P}l2o6L;+yQyCmBd2sdE|eYZXp-yyjw* zRaJg0F4@Nv*eKa-fbh%|D37~v^LOA8k*)FR5cfX3f9DMe9d6wfX$#)Hx8#T|kgT_e zP`qgxVj?XeA>m)&paNr!>q7ugvA4795<2D+gkgGkBS0&Ko-Ktx<_}KvcnsSHT~M*9 z9PaO%We!Yvg3c34o8q$Krd!Xl)QOoGm_U&Bbn^>V-`4}7E0XfJf$jr_`0)c&ZDq}b zT)`0@BYf~cma#Vr#ee*I=1+?)1WVoA920X5f*mDC@Jde4sc6F>Gm{XVP8-6fAdLza z7dH~10!fJR_)zWt*t3O;TWM<#gqDu`5-K1I2-;3dU)Wop5G!y6>%lwe3v`W$2%|6E zIS^r_tTh-fY_A>2gAO`JhNMLMjBhgpklfV)X1TZJj@z;Q+01{dVo@^-=h5^tv;3L2K%T}b;yC4`osQ!PQUC@e$hzN3Zcj@wKv~ z(6aXWNR#D$BwaKw=#7$$7`jDb%1z+P<3+spLOtd8dxob2a3In@Vxj1QiCZ5ihNh!e-u=hT(|IL-7DNS5|tTf{Yg0~im4T6k!tcChFK z`g)aPTlCMxD~}vUk#F*5djQu8PUmJ`uv$Q%Ob=?ZU&DzU6yx%x(mIjX^{>~LZLvU& znlkkP$-&b6+f0s+4``qi{7TM|J!w)80Iekt@Kjf4=S-n!M6o6TzSt~m9J&Y0_X5v_CMiJ}FF(&Tmf-sVa>kU3)8p zZv*2FHX6c=J&}@H3+6LYxn(#h@tni>^ThGqtr>w(EBQ-6V36EXe-4w;vR}iG{E|8) z@!q-X1`c|!;ql$xdo5C*MXDi^wC$2*N-PY#ln|x&$5_|v-oEbZHVMjEf1%b0@A*DY zFHaW2<#i%L#=<&f4|9iYANkgSwmYnApQ#c9bOv8rZ0s(o^d^=#WBUjWe`)yv3eCl} zb}31pBJnd_^WhUTCGLbtFjYY~=103d_k-z~PgF-o8cj+gnL!iTnVByOB6I0*=Vrkw zg;##Sw9@?&gaNdmH4m760swkg4(S3PJi-cf-eBxrw8ZlkUXzu3qxMNED2JHDVBPR; zWgBDblg!~5>6Dm%U9GyEbbY%l6qklVFd6v~rjq2s## z%A*qLbzo~e?k4SqtrSpFSV)o4+v2#4*?eq|xE8)q$mqY;2;*BV?g5EHn)FbRr*MM= z*@vr1cfInc9B&m!^r)q@wK$Agzr*?bLlp}(&KJg)w%kz2UF>J&!4kw480n(5$0+V| znf&pt+>xhp8Y)H_zS-SIA0OC3P+nqL2zlwb*qaz>txPwTSdmamJr>V(Z^yIeOR}j? zCFLi-_ID~12Ps%(15iR{g$=yakuM$3zRP(ty-u0Nk@f`hQm`wx8FX?3 zc7oEmmOe^jvhq!wrKDy3!P2DS%uyg&kxk^`=Ah@?dTQj;BNTLO9NC zz9jPt=YwXs{_DONLT)rPiLf4DzH3FS%hC}ug7mN&T~anpz#~lR{B1F22KbcsFE(2; zncRo&>VMkG`D)lby(7HSr!lDKm=O6nB#HFJANAzugQUTxT;JzOzb5Bq4yy;j!x$`d z+0y(lQK@k~;*q<=PHLG^@Q*i&5qBaRs4zYyIgZB0WTtDdwe69p`?UFK#!X!bI!WAg7MahUu2hDQRog-FZ38=b+AWWA1aihbeHb`Y=-F{ zUH2J%p$4&{amQS8Pto=d8Wrt0~ z=5WSi<+pjm-uhQJO{a~I{lCf44^6hadT3H-ZbdnxsrEp36UTWxg8Ht=r5#Ui6NXWY zV-piKDJhaNJ4ps@&GLSqb0ZD3X&F!DtH196E4Tn{bHV!qR@4*CYssq7%$>&s2qM!q zjAmDd%Qf`<#Vd4P)V+GHAz;P=Zzi;NKj9pPspn?13$)1)($|%5La#{kNZy0_^O}{{8Yd5r=1%v}RZDjyn|G7rNLrCgBhorZ$U}&A zz)SmbUb|$0`KO2r(J?wZIV&rpRIeXM)I)#fw~2i&g5nx4djFY|%1g^)-r~WD@z&P8 z*M6aEdZ(PG1_C^^38i;lOEnoiEf7A(I1-eMtMze1O9`qY^VbPRkC2>ir^%#$Pjx(l zA-?-<2SQ{7#TSpSf9$(B(i&UaXOfW6_|OzPh{>dJf!&8D!I18Q$-x$FLe&h=)rMg} zZ6GWn!boKm9UPt3)8O~2)del7a5degOO;Q82wp!)4n^LPKxS{uRjWb(AiA)D_g`4u zB=ON#wBrxU(MxLKaeE*E{d!R}+2Xwf-7HnHW$L(c$KDByhfnoY>TUwFQZG7I@Y_HT z3G2g>>rE_t(XU`C^D{$}5`!nJmw!^yR^DNgul5CY-}wzw^fBira}j#gg(n{nm40UT z`f^4t4nk&Wu8zC<+x>ozZ!dFpk&{S`GG+14lY}sXeKB@r9aNh++xeUJCX{QXXTc2| z5ZC>uI(I0JfH((FPoxm=v)Ca&u}FAx#!+8byEO}wY7_FSH&mTA1VlB&DB0GAdmWEn zkIf|J9A%32u(1^X<_l%)nVwB0gZl+n9Pz<cmJSrzTL5?Un{*4(MVvdovv@>9j!~RPNHx zcI%=AXwDFLVG&_r1{vfL*p>6U72V(b*7$91cGj$kyuOPV+yseW>Lw0JNPv?2hW&C0 zxKs`u=AT%m)G7mzu2OA|I*UE z#sDJ5Q6MQofrT5dUKR`82aw^FRaJx2Xl-CbcYEK^m`CMG8P zPV+0Te+>+I=xkQcrLnew0$5#3%kpqufL2PZ*(+YJ>Mxq+-BBsw@L@wjH%8*kej zop*jBW{)+gJSj;$a0unCZ+a`3cE$@)yAe{C3Ka75F}Lgc%5wdl63G6Mnch+e@J;tT zAr$|hYS2e+D6hHL{mo=1iPeSEI|>O*;!aN)2Ja-C2zc;p!qf6$6vynS`izrmWJAAz7?yIkKu;v zueq@J&wBemvorayEugAHiG6T%WbrG}Tj&TN7B63p74LVx^b3a6fv{Ns3YRkico@p; zN?{Sy5lA^0g2;pLa9F9Je8EhS4nek&Oowso3O;!H`zM`Kw$Dp=ELzU%FMmT*2XY9+ zhBjDcuCw8i(=agCUu=TZ*y12p9LW%bU4*1GHDLFN!6`iFc?R1-8Ud$?QU2U9GXv9y z59~h3+EgXBqYhqgu;qE%QIWgWA9{Y%uj(oRi>Lf?YnyEvO?~>2_j5dmoo|AjeLFuWHt-E&y&I{`jlJm~qPwI0;zs zZ+J9HlO=|@u3dS#{bj8J+f-YLSEtH6qRs!w#$jKnZ~L|H`bu$l{~F?^Jt1gnnY+D- zgR+i7jdIKwV@TWC2J89n-7pUSdd(MG1S)A;EENBGiWZ@GW-cV__X4Z`5Y>}Bc-~e* zIA%{iK6hWL6IR2IV7XXavRmfiPU|eBFX1V~S~k72y*@F~+uJ+G^Rm$g&3QAx&a~r= zhSJBL_D-i{OpYQFTU^W?$&s@WcfT2kAOovnyAhARlo+{$KDESPh6BScrb$Vj(3(y6$)44|jUnj7zWsdJnVcKJ6|R9;E=*TT6VT zGN0MiXrRR>Uo;bOrMdY+HZ5JgNsDf=`CYp2rhSblRbSD;*{<*p*sX(VG_W)J7o~0z zsO)ze3|U0HlBd5KkG2&a@z`iB8jKjCv|poI7w zcG4pGu|F~|T5wocFBq#9UbdC%CeG_?44z$vKP%IDEbGSem=lbTvfi-n;!9lrvAu11 zn5b;{ymXQeq3Vojv+QNZ^w$SVQB2|WIG5xkHSr*UEk(Q%dtIR${QUePB5vTA+Z28d z4R&arc=FPP+?VNDQOI%CzrYH+pRKM4ve3w^hL~@^_Vxxlb*T3~kQjI}a3JYobg{}&r6%Sh zqqc2f<=oXy_!WF%h1%bfo8~66Z=I7an;DvP@)Tu$r+sGT*@l7Q&)!t&mHT%dzO61# z6vtICcNI$O^!dz!Fwy&IIl3Q$kKR)l6!6w+#e0teV-#?!UMsLtg(wxWaToD!!0IHx zyWyuH5gw)?Xr|0tT%wT&<+Ykj^uE2J!uD&N^E$prmY<(K{?rkf*ssdvf>`t6@A4lX zCG`-K@uy*6Vx23(>iv0Rg z2|(YICREJ^ItOjd;7WP2vG^RZ1y~H`%3Qq2tIP1VLOVG*BSW5?#=Sb{2XaE0qHV6C z#FAZo%PO?XebbZ@mN20*K4w}B>FZ5!&%ZZsQP1r(|iv6 ze?>Nl{7ng7II}zYrgf}t&cQDgGRqQnRzq~a2 z7NL$f?)y`I=-4FUxg@0xz%+916xlOF=(uL5r6%qwA`+5B&;9DH{~C)wpHDu?#^z}u zL!`qQIBlKedB4rh^6Kq3y~dV}pK(je_K30Rz4P1^1%$PoL$V9if(~9fAPDh-^d`r2 z5O*y6Ka9oyfXrpHEG$~HvWm|td&C6X?#!CIjCRFp!gA{Z&v)g!Uxdj*;^Kr5zH+I| zA?-ZfWU4X&akroIkGgTy)WT-(+9T%0@R3Ln$#;8c5O^Xux+r-5W9Bi>evI=xUeOc#tctnWn9n-1 z@xOL=-$91af5y|p5Ptp@Cd66*r~H*JrBr>5o&9Y<%s^4tdidrXQtnH>kb_W`4+j_N zeR$~puZN?vgouH2a6*EWJ2LW1@B$@8A(HnH)C2z_*s>Ac6sB~`-L3`?#=eav@h5R{ zk7ds{DHr8_I)56~zy6?tIAAW1+_|3u|FDNqCJ{?WEpH)2GUBIVZul#QxRMKpBUC;z zgmD$^J)~)OaVZ~UXXP|q`TSC`F@5mT6-!@-I1|(l(u$ggkew%^24KOvQ?xfzsmL^6e!Q)(-AlkQwa6V z%M*?Gve!yV69uJ2qM-G#vfHt~k`j(jv86I<6X#VCBiI+zBi!hu`0AwTbZXA!HoH&^ zR=BheyEeVK|NcDz0C({<+*bdH2`r#NfOz|_N?)T~wY9bXJrIT(6H(9cIP`Da26)~a zrxT7}((!kWyYvK#4}E_pUz}G5qb^p!_ch67I0DUbvmsgwA z=!JxZ5rHlP{U0eUgqKMf z1#F*I6*p!jS$qD8@j2(eZ>?V7Ms#5J0r{?u5r>0);lfP=!~@fOz_4zkAM{?N2>R8C zbCw^FtZkrz9kOZdbcQIzbjT6~eGI$xPcTn?HfcXRT+T0!$G!EB9Kde|^CK=8$(6Tv zcV%e>1j;@;&IA28+mb@y6jy&(?raV_1QUOO6r}M_Fsi`g0r@Y6qvi{}j92&cN)kW2 z^k+3U%d?^nPwKxW{6Og{FutLeJ8cD?O7v`e;DM{2BBM%wtf}z;yMAC`U@rYL<90>) z;1y6!;H^+&1?k|%NMOrf6?X@zgt_%AHmnjl+Qr?R;`_!T9nn_n*YCVP_P^&}ajD{$ zY)I)7KAj6zjEWB#M%~fGfsUt)Zz)Cgyk2L1ghaDCH9E0DNn$Lrs&izP0`_nD6okNYeD>NjQP zD}RNm;0#WAk;k$!kV%zX%~h_F#q>jsS5s9-d`0cP<_zuCPq#gAkc~fPM5Ifl#Hwbh zH(p}xh?SCh9l5KirnX$`{_Gv?)t!hph#oCDlpaMK_lNLTJ9z^%+{}xHLDvoA`rXEOiF;|;LX@`==d5ai8I>1v;tRX10Gi#1s1;$0 z!h0}tQ4!hcdp4-|@u!2o&S(5M0Vi=cxig>pM1nQ`i- zOrRVB_iJB*XH|gZyC;3y{ADl9(?`xXE(8Op7X3N=mIz6d|C@8&6s=5peZUM32=Mtl zDzEqjQxA#Qv`l|p*alZ0Y*@Tt+tV*L@9Au=L-`550gI-UR3=Ty%io{fu)>#Vu;WF` zmz}2?TK5z&Sd$=$dm0k0Qdm9KXDM+m)pC~gI*Bq^BN(B5;|3&(gglpR@`CcNP23)< zSU(3{GT-tT-)kCN-z}~VUE-G7`6#O{Z*dm*g%}%il+T9hGjRxw{BAPR(n-6U--G&5 z?03^zKHrN|{ZYABm{xc#{8-hge`NS_)v5Uh&ZXTfU111Y{G#$>`{OZo+)5V*PFjMh z*r{Zm#%!fR1Uh+^*44nV-MzbF?Pa zbbWIu-ou&qM!}cu0rQ#LpmXdoys7d_ip)CVlKxDG#5?i={*d;YZ)1O(JWY?Ic7CdC zQu^}CS~Z2LKq!6{ctV38mf)bF|GLLq?;x zvfaTo>`J>mH$m6cD`&`xd0bOfSrJb`-bSmlDOs%1|1xK_TBs;Y+JgA#r&d0{+Fd!e zu#ynMTXQQEQ-lD8nky;49c1l_UD+QPm~RgTiqwCy_6iG+h)kXd*?{*+VU#NhcLC8@ zP}_ZR2^bv*JGc%Nl@w}~D5Q3HDSiGh))z)e#`+8s43&VqWgBL(na4cgnq5cPS|$zm z6@dbv!0#9L(nkZx$#`NtDaXhFfcoRY;KPFvlZ~G%^$wEr_ET{*Ybot9)-IFZ$*C_y zbEm9J;VnoeT4;~6s2Y0rVoWXUE{>Uk5)gkJa+qH1GZjrB@0wtz=sN9`U4xA@|Mg01 zbEHb^{rNf9EE6l|xVbtuZ+Gs)2Uk5k57cmMna?(9KnSX3s-SR5k4lS0@tMH zwYa-ER+qRe>D`pcc3-^PcayJLksIj zPva{Qu9kTIjrK}-{elZvSwWf4<8c^imD2`oy`d@5@KZdebv{#U3{1?1>Q*pvL@@T+1508&i(? zN(Fal))q&)zr;l`J*IImVP)O=Rh9EKcXFB9U|{J11xn9+3nxav8&8(U1yR?(KjqK3 zeDjAiDlTiWNs?U4wFH*2cz;g^S1hTI+c&W&R**}_pU2I*+5a*$j?M}hr`Ez}NJdj* zSi(kWW?V$_lctVi>()iQ!`L5ndwRBiPKtuJmue(!A+!tZD{lztSp5nD2u&}c7N9vw zhN_Jb{@}jkk7GyddVzLu`s?ii(nrQOKuBT2IC2qX|FHNL@pwjnL9vyoy1jh36 z9*X>);XKPYk2g@feS2owMD$l<*k;*L3JMk5nmfbF`ns4$odxNmtI*acccELHVe@j_ z9F+c9evr~F+yt-clvga(oc&|i0YIu~pQezcymwJC$I>@o<|CqIS39JR?jpqI&{Wus zi{qVbJjhe}4u$-IwPbXgG%3z5proJg$ z*@B5Ro4bFW3t{K!iBCEy48LaK{q1JpnnB3L*%RD_Y(duns`_AUbXbw>HM%^qaP45G zJ>O;E&!6u%XdWGJvv~gzW z&T|6(KU4kT*PI6=)Stz(A^wuI!ZR7;|JK$bI;j7ST=?(M^F5#c?0n9D;@`0aT!AwI z@tE1#4%YY1fjqWc<&&wlCg!Z-zv1Mz*gSYy$I>xqSbz3qA#Nu%72@ZPoGmDPHT_WbHU~C%sLahRzyaZ73!iDe&9>DsmOM0z3{eRkuz7#} zyo96_mS^Nd-0b}Pq{e_9FGBruA0WPAcb;VzG^&w-l3T7NyOwXCNhNU{?{<9BFfF=y z!DsJ8mH%^+#6R|QXb2+8pHb99LpTVI7a+w!whg?-4qtjgxGl)&p+XDib={?GHpAo~ z?_&udIS1bPES#0Vh?K5h4qm5Q<(0A&##9ZF8$C~-I$3PJUY1krEV|ZO_2R4kKWLAYBdm-=6asao_yzl(McG0 z5a;&+%D!(XrI4oV+$$INS?rYlJf2pd5Yb0BLWTq^*1jX_7cIPnp{zWOu#*jJe&CbN zKJx};Z#QCN(;A5JEM~bb8TM@cbWhJc4v#P%)5e5_p(3x;9NTq*atN#|z^pnnGBO0k zUkElF$3+Tnv1(Bhxr~>Vcr767nn9*((AwEW7IGD(0~mX}h%K?&AVQEBS#wo26=VR4 zHSG@jyBX<~pO8gvlW@wWRGSZhdUbE9e>t~w;sO{T$ROJZ-a@x?>Zu=HsYLqI!zV)8 zHtYFaS|)NfGC_RhgYi9#2S1BVE!+jPit~>h;)aKV0+su<@6w29Y5mv=ogR+8`oZ+~ zmX*wtpFiXxJ@x?7uT%03NsRJ$ZfPlhJ-mVTwztCv(GYpB0X7{%u8sf+%?z{dHG%d9 zHv0IUox+g907@mPA=*@Ze$R$WoS<;zsWkJH0t!$lsUIy8_hTD`FQ2e5QS@XH+`C;c zBZpXRyl=GlAXJc*MCyh@jQ7DKm{a(6BYRfD(*aU3bpotyNQw>@*MIyF^}57`*;7 zC796C<`mV`ahZO1nk6Ra@~Na`H?^J!YcM|3`oRM?tqtST?`-#r4USeD?s5m+ zu63Twum7xcM?P3#9iX}fz(JTMgN5ezAX?CLiJ7^TJgprZ+yk8q1?5BJ@qKphr!P@C zjgY}2JN(i`RT{?2UDtmCYa508;hl#M9rrsoineg)aj^5_(vWaA62Zey7Y`y(2ril!^nb8V`&TTN(9JWX2O6Gnz z)QLYo{{kidq%G=lWis ztfUvsL^NXz!*vy8{XdD zQ)27;E1$s`eRy!Nvpk4L&ZeyGFNb5`0=I@HiRC-y*^%wjcHDB9E;UkE+5aJPx zF{i635a;*3ZPd&2x+ziuv`nh`Yy4O%z)IFC2A=3x>C;5A^w+XTkz|p#Z7^8Y!A7Q2 zE%B)96ofq($lh9@w)q@^cyR%^R{n2;=k-ZLi;L&sSe8XrR;x-v9`;?joDT*rKYlzK zbO>LS^|(td4Z?cJq%`aMmDVFl$W*LLF*V-oq0DAOTk5 zxXt4!_C$f?s`rS1-W$5MS8_c&?q9e7(*nl8c7vNYZh#O+>kC2}pDcyRqM)pxCSz)B z+#Y|0`H%uT{OH-1#=2-TCjl9(7i(y~hma8vB)boaKfSyQkJhK5KOzlM=2%QE_mn#* zK1J&0xqW?o&DFmR^k@+^UbB|yN%C}W%Ik_?Yj+gIE=g_r{6)f{!YUHPhv(4VK1uZ{ zzW zu*vQy1}c6^cgN{6iauKtHtFn7QCPiWQ_Le&36t@#TETq-8K#X$fUkPH>oYD#k^2Gt%cpMOZ4-|nFsk=N*&)EXw-sM=&>m&Pjh{|EP5F{}uXI&pE&X7~u@o<+sV-{uhZ0*5_H z$Y&ZV445=7AspAWG*fjc7?IBbX>Wqq^> zYxv_t->=e%Cj`s_2c4e1M9<9$Bx6w!|E&)8KNpbB2o08VXHIIdvGjOs)9em&y7>&z zUIAxBK^cD)N+E#rGK|1tmA$yQ(C+8OxNoV?|8j^EYF}MfM!|mY6q`tr{46i7+oYL? zz;xN|H<6GwrILzGLBP-tZeBvO;L6HMKY%PBy(fSS98IAv`C!}OBC-gP)t$j){G%NT zzP6KP0~lMgBkU6X4^RdLuU-`a@z6?VP3=JGQv=LuTX3S^X)78X)n#|Lu6-c8sMDx) zvuKD%+R%{U4wkLh+3F`|DkE-w2#qDNrg!q!7?}xyE)tTou!6LNCjAVRC4KrgVoFrZ z-{n`h=i1&^{Su=nptAw`{%SN)Grp&f>-NG;5BH0^SO7uzl96GylXc4fvs+H?9oerH z?#`m86Z(zuXy(bffko6{r!YA-PH&yL4u7r=Cp2-AQc?(26v8){jcDLy&u+wf1}WXU zO1z0l>EFIpdS<0aG4FX84$Z2r{_yo3M2zX=RQbLFV=F*j#!onT`DITG*W@Gc_T2V6>;FHW}ILpnP;Wbe%_NvVH| zn_msw0Ph^oRKdv1!_&I8YkWH@YdUxnlyGL^NNNgwVv+nc#7JQbf$gj(>Uk342Ep$7 z4ItjXA&(NLja+4tNkB+d6s9EA_P^pV|LYi8V#&^4F{X=OjmR-IF zT7A=LNyG|uY76|P{G@1BU`9}7$=Yte?f(GLCYIpWbk|tWuG22`XL(8MKi(z}Mp0-Ed=p## z5Gj=YA$JrTZZiYAae%rRCl&4W02h%A;w+{`tQQb`6eRLnz#5+>flEv4zHwtZv81=T z0`dHvRk-zwY+xh34xuKN&8se_IMjNeQa3X*gH7OL>oIMoB7AFoRn@KsPiu%^+0@$0 z4b-R^r;0jo*NUDV+dF$8A3}bhIc5$mCl72gDgybQNZ$8j6>@KFV+hZRI>2@OrWURoN#=R?3zB za6m{Rus-I>{)yR6q(r{!S?|rV`yL%)$ z{PT4!m2s!iAZ}lT(a@3^xc-Ijjf$h~BZOS2Dm#Ik)%U8FPOXkReO=e7PJVCx40Q*k z|4dWR)n6ch=oH;*L&Y0C?bA@HE`A&k8-SE9e8@s*i)9EkNuPRdEzLLmaf|5fu6zRD zE09eU>J@C!K3pt+)65h5Br3*MBFh0VQ*qlwd!Xyz?=N?jifFAH3Z8SEuV*^AJ< zLCrdZzkek5o6cRxX>V*#5`+bd9sr*QTKos%;X9D&q`I?tEq~OZS1CozvN;$QMl~f5 zk=NKCdRFScd}A??b2+;}?j8oGr@4YA$;GeA#I|pDcHhB+Xn`hrYqS|!A!nAi;lM)& zN<9E+>E2Yg7zTj)`$@#JNPtr*6(0sa1Z@hixR6ZMQ+5|t#;$}CcC@s-91#Xbb3i@e z5NbAqc~DCj4PtJKV)*%yyN|cxPpZ6S{tyK4PvPZ>y5R8(G;p%hT6VH^3$wB*_JB+Q z?GYCsJJVAq^^Dby+h)%9CwE7zA($o9Z$3frS;hR?mt6I?7{8xeuO%Nb z-3exSu?Td%RDXkaG@R%=%Oj;J(`n9Rzkx4{jQkrk_Eh!FcJm32DqBr-`@v&@DqZ0PuE3+`bxtSiKmt=K+rosKOc&8l0w6L^-un^>U|C_u0x+M(k7|+ zMLRXW{i^E2EntvuZ>c54i@pHRS3N-Deb@%82Y?iUV{UPCT)T$NddSa12r#=%jmrGk@vd9UPKW%sGusau_fM=ZzZ39#&*!kujVW>U8{ zH}s>aoc+_>aRMiY?|rbIHOmxyI4ehEMa{i?D!ua5!}Y$fIr=5v)AiNW+^@N01JdH< zELC-;oF*&9vfdUP(YY5l_Bh$t1g#DO{8)oTUyFn<8+?Z$UXRNKT->#lvGTMuG~8WS zDz)aE7NT0tWo~w$zJfkgr|}jF>K6)G#>ow^3{Rukn87y<1Zd0%FQK<^?wJ7yx>^-= zHwPsniSDXTvFg=s(w90zu7l!JFRD5UwN|z45lv6`&|^y!jM_`m1ami#%bm_AIBwhN zG0HYAIAd%Bmjgca9nNoncs?(Q?DYpuQ4^?m#N1IHh@E)eEB=Nn@@&;8u-xho0>NC$JD3`0+9 zF9;~5@{OYqSzmxY%MBpX=&MMBh7~+}{C6m+8q=g2q7j+b`KdPU*9n?@@(^`sj9GtT z(cv9{o?LVPWRyJERYItr+ZVn*^?*6ti?Iw8T(U1jUBTgyGGSlK>44T@q_BmBkB<*1 z9JqkI0JdaU*3HeW*V;KgHTDY&3{2;m9x{I}eJ|>BX82Qx-Bhz@fPS-32~=q;JiMs0 z^Yaw=cEGp-tK19_vA=DEsLot`PtP67)bWGgn%hjn7;Q2s6c9viiRZ|hwJmkKAGQh+&G zyBnyh?Jdx=cQ5kVM|%Lfr@#Le__i=}FD!a*rsaRo`2JxRAw!GxeRM*CnJY=F?W1?< zDU$oeUc%sN5do}W8CeYN-_Jhqg#bC8-Ny1Wg^UL$V0@En zg3Evvvb0~Kej_0+4jC{_LjqFP3YD{QDep2Ktwr6zg9WTkraiGC6hFX{7^g;ZSHfaZ zM#wx(@*%8E4640JRE^86*){6#A=ITIs{>&*42^w!Q=^Ou}^BNLvwoZ zOqT0>!rS_i5RFB_tBSL3P3<+5J|F9^^1BZ&uwE#ILEU>r*MbYz!Kmo(2<(l2+8ZBt z)MnRiUhS<-vg^&(N?F&Q!67=kgVM#yWyq7;K55`{4>;Q=51unXmvwvK5&O^vd#UJl zrtI3lKIpMsH=;WJ1;%xCXdv0I?aOpcjNFr;!Mi(8w;6VB_;k+|o3J+9zO+ zp#Vxku#H0NRT8WaL01h4E2v472|!63~IC%WYkLcsBAKp`i7#rTLsG1O@OumVu(I5o&HviAlV!I&w0l)VBHCMo8V7ZF8*}!fAbx|5C3)^`OhzmzWJXo@$YtZ-|C;v z5^{g3=0MIM3{3e%;ND2T4l35@Q$Dp~c+mW=|D&xj+|T*1-u|D_LADJfyd0cUT!sJ4 za4i0OrvD~QKZ7vd{_*_*Z#MKDM43)scu9KhVeyv^Uk3MIM`?gy6SXYh1?(+$Y!&~1 zu*Co8Q=*sunJhuhO!t9MTg zzIr)Vc*{)#%aOgO!$-IH@Y<5yAawXZ&*{okJ%YdmhOoLG>J_IZnYt1a(r#*xVeB$v zt?Y~Hl1@ikb&ocjDH^FZoK)6D`DaGJvec4}%?Rz-=wsef2Jefk#XLR+^R;A9)X zryE;9hNo(B1bfn*8h-Hffufie9(}gxK972Ot*Ipk?jjTKOTAC{Wq1A)O9Zs{ zQ))kdFnga4NP+$XkX)x`XLaP>$Nb~g9SHJ(O^ow-oRxAOeW4$(hY&h?<^h}NZav9^ zHk?3IAP_iopWOlNs5=m}O=tLU0z_?cXB_80sGhpPz1?Fqdv@ZXvv~mR+Sf0T+uUlP z2euayI!%X;v*+Qac-U{@^(Gfsx^%m49F;%b)dCd`pO$)@rZ!JYMv|n!x9_G7GL8)` zw?2hC9_j+Dqb~q{{!W&Hf+DO@2$Z($j8|3<@J+|BQ=h*E>~B_YD!`eT1iDGq(YOC; zLR!r>$eBt6?e229NolDn)@z5rbOxBz#(CH9)5+4aq-|=cK;9fSFx)a6qmGbF#~)hI z{e3ar%oRt*?+zVP$K^Mafb;uCjhFR`26>k9K3C9|=onUizp z*A<=Odx%Xp`x6}^3(2u2m8!>gLYiKlN4f5*ZJZJTFF@R^S`f+B)Iluy!oJ2H^W=*2 zaB6XB^>wg+?M3#UiW{%w4)gTmwUzx|v3OBYlTBu|%Ba!-(>6BK_w6d2pjS|JMbFP=vaiRX?rEGjB@WET)5@OqTYvMdWUS-0Y6ZSjInogzI5vU6 zc8s2Zp#V75+~1tX6+V^AW|W)vmM9<_uM5Zxg~Cx62)%!rLn~gEYlvGzcl#G|KzR#X z3*JwZsQ+hdP*Ae#o>Ew{nCi8!YkgX-xHUF1!sy#0U=G}&z?~BVJgdMi{#mE4H=cH% zi0VSws~9rI8}(;;IJWlI`mjIu@JMusX<_?jCu?zWgJx_48^YZ`7Neyx00|N!TXIh)Ge?Zubl1-nQ)`i6nb>eS1#%AU zRz^LMFi$S8PNJGa&YECeO~@Z0Q|QOneBye{2)$+?b&)s~%OoGDx zL!0y0s^8g&1d)sNkwP{}Lu`Ed#8e)WVr-uRPNbV#H5F*8FEV0nck) zUaT>)1s~rxMYlY}q{~v^_eKX&)6$xP=@)Q@w!X1E1%k~v4!{uy(0F}sXK)+PqP0ii zF9Q;r-x09j5)||eY+X# zt_P4vYCZ5v@(mgi21Yq*I!*`xmg77z`Sye@flDz&?J#@ zL4Cfust0Bq0Sb6dW=YI+dS7AN3uBt-4a>|&ORrpOsYa84al$}o%Eh)LtBTSz;QjP4 zh7~?Ql&G=8+(3d10;uYTT3vn-IW}vf{+YX-mPvDL6k{Hq-Q&%cEf}1&_>%)`5G-+$ zw#$!lAhY)QF=-36;HWg>yAebLXSTA^>kHQe$$jW<^$8wdhA=2Hy>(6)(-53O@i%b4 zX)f9!-VljUCU= zn`zHk{dR}D&DfhCsIj>cC3EGQ^3l~R^eHd*os4KMZa3ZSN3vve-N=Ua;F~Qrvr}1W zlPIfw1Mb2WS#+7(%o`*La^e_041TDA5(JWAyy{ArU!tipHM1SZQvRRB)PAH7w_&_B z{7HZG3-&u=BoU`dHkbf1v$Jb*pRy*(SiD5UJ4#%a3I+-xHxCa9%vv!9l}yALQzTKp zPB5K@D4$Fq@ss!r%u8JzPp_8I%M+j!btbSue#m1csVxgzIVlr2tPn6Inr`+WYzGhY zPx6xqnwJ_C+CT`x)K5W4sOuuDxlhTHf`?DHJsdC*$B7Z`!iVW0(?<)h<_ye|E#r2; zK&0rHkk=Pr!+%7wgQRa~V!i$2$UR`*zDP`gGEawwKU(K8>2icP^>gP(voRsfGGixO zBvIvzhULUYLg6G-;z04eP0yh_nL^vfDx6h*v-k^P2D9vv=e}j9|eo^t(Cai%=J@)#X2NfAJoA}5aQcP9Sd#> zZFoBj57)YY3?}6v=OkAT-Ib{U?xoESS{6|m{DnO&=SNZAHLZyjhct_PEaVj|z9D!# z#|z{arR~8`*|8YVq5K!N=pdssqt%w3Q*ie=4J&00G8q)2$75VG`p`JM1iq-0I=b$= z=E2=^>qA$THgfaz2>75CmLB9-Eh-GY%TJQfLu3o}d~HyWF{8)eHuewha(zC-`@UV7KrQ|?12U|DHY=w5r;bRu!9ifHDMXFF z9C3%Z(38P9n;5Ia`gOa_#RibG?gh(pftgA0A&CdfiaIs64hWN#NwE+eFRH9I?TrOG zmaXY36GYts&=`qZg9-8tVIy8o=%I@nX*-UUR<$c9PQgoQ35Hicc)41VfSRVq6@m{N z+A`vCf#fzY43m-0iq;Ik-Uu@-#NG*-3A0OL`=F>`J!1&Gk*!a=Qj# z=L+xuKK%kp{@imVUC_~8U9@d@K6f&KFnJ3#vnxf4P!oUAxgfe1j`QFJe z_7Yf%$ckZ{q@YVM+ylpxz!ZL8JZtYdH_~yPZ8vyJXa_>1i+Fw5ANw-6|BJbtiy5Pf3OnmrV&!x zDutVGmz;OO@@lFdK-}D6i<#=(LV^U*h`v~{LBF&PP5BBWud`(7mU({$Py?JkOE`;R zNlv$8H`O6NTYUQuVv~zx!^pEaRDPHGljDme&2Z0@lYB3c5Z`>+2eERi9=ZdFxYj6b zww*57Da7!H*f7yf9Iz;CY^H5XKLQ|;d&Wmn=uePE@rcJ+SUgX~5xlFnfJMV&x5xuI zHZ~PW8}Oa$0ZEDCX2q%U_u^TPt<9&e8ckP8e9{*@+x$>sWzhS`ddY{iQ0zz8VLw?ieN*jal%^^;Yq!6vvb{XoPX z<{sJgca0DA#3FcnCKvTR3^;h%cpo3r1TVU6=Jv*62gd?Utx9xMt@n!=AX>7r=p5?j zJ4%g-5es?hbK{tGd?5zab^6|`F-+`MYnw@uyh7lyYP;#EFPT|hjv<7_Uki61oi60@N(9}jY_F6h zjNKss3T_x%9O{~qH=%)U%jt*vV!b`=4F{j3G^2)z z0$9a~tvSlLPb`BPOE8rSZHF>iS7w)=45tDOA1sd4};AG<4^&dFyEFD-R3IdWXp zSudak(c!9z5$~sGQhy>WAi%>DRcSO3cB+Kq7v*feK@sdT!3~ty}R(6KN{P?QYGo@4M>Q$2ktk+skdB@{8yBfp>XW|OXOlQFINZuS#q`ny ze3TJ*@u|^70t2YCAZ?B_gkVex;r*)al~rk?ZVl1Rv+!S5Oc;e9{rwwBQQe+q;?E#@ zaTF;yYY=EF3iGL}smX{C#1!%vpUvgIW=SG%ZFkp`3a=>p$^fgc6c~;1Q;HWI9sP#< zan-=o)JLK)Z|*W9!{m@0wf-!YxkA9B^uk(lD78JnwphSrxhp%CrWc%U3|;02WH&ax;Q7G$l#$C_qDbW|cyztFD61|jR!r3AXLjTXN>OofEWv~h z=2qE9@g!Cc{0aibOv2pqNTxF0pYjQGfzgo&`afP4GKDuIUkWrXH>CnI1Yq>~QIP5h z8PWc9zIEzBXmaRYs(aIDO2rFeGP0fPW4#>ONNG*wf1tOqh#Ia%3jmD@$ zrlzLa+r{7XQ?HWJ>ekt$1^(>*k&5A$Euae=r>`z(M78<|VV40*GAt^JqRL~EO^c84 zxbl&1fg(!4R##RVf?(B>a#T`%eA?U61tC!)x>M@$_+DbvERd z)MCphibJ6R9$ivc2?qytQ!I`y85|tUCaXwD$YWjI)GA<$ znt2E2B9b_X*MgTgK*JnrC)z^|6N_wp`(p<4)E$P0EE4bYlCOEZEH2c!R7dgE@oE>a z&xyY5ULA}T9m^IP*Vei!TVcCLtv@eW7qjOZQ`0H97Qg$l&vrO8XB_B&9#*{1he$#4?sULV5ld z1Lz$JK*sjuRWH|6c!Q#u3mO~UFG{tzXhb(u?EpI)avi3SZ?LgaGh5`gZeMDf{K<$G zzk{nVr1_24wGh~py$ylZo}hqV@}L&NE%Sl=4df3y*#W+|7wmD=KgFy_{LfDZ0QPFE zm@X{wnKx+|#o+`n zDfL}PJ==2qCnCmyA1^6{HZOo&y711`?O||;kS|R&UtX{A4FBO3C)ERh0geA56Un?& zR#y-50;8Apqm<0jJsHoI>7I{M1-3Y91i!`R3+;FYJqmR)Em1g_i%qKN~)_y?l}uuXZ-Rs8RY$tHBt)bQqi&h#`s9 zujKQFa`Wazp*R{G^Y_jg8Vd!pSQ+UtV5J&0y;)?^VMBqwwgVtUFmZ4w3hkc=Xs z#Z~UeWf=$-9vcqW6!i2_`3hx<8X(BR@{7+#oc~Bs&i=RBBvBQ~uwDPgfRaRK=F~C; z2I*##uZm#@DI!UJAN6pJg`!XKM%imXY#trsCJ?-olgy?LenyoBF--Z_Az?dc^{cp~ zb$89UuScb&q&jXA6c7AGinM+6#4x^tlaSDW0GsNd!(?Muk7ib_hj zF`fxBlai6`@mnv4MLiD-3!6S$mUhdq=^yM{;eg(*1#QFB-_nU_j6q*N*m%Nw0M%h8 z#LG1CzGR^L;e1||sBdj;JsneBrc>9m%s}B2{wwwMIESiHmYmU%XyU6K7j#p$X1)bX(&yH8)}^6tG*nbSVpe2Ye46-rJ=i9r z?rN%Q^cvW(uQpO`4G*5Dz9JHECM$J8diJgj6|4m6(`>E>NkDd}$#2Na#-`y7=RP=W zC+qI6yiPxHB}d_+j(t zyL4om^NpI`b{3Ac%bYM=NJlXGPb~?+VEMB_l)r{tyO+16(i{$JJ&&CB#U0D_*Bhx3 z5F#NC~d?_--!;ob(i6L+Vj zUL5Xa#f6twAGUhkf@#v9?M!LD9G1lV!DO2SE{@h>^Io_rRDQ8sClZ{L+E zzV7saoLkw{E6n=ohkO3LM}5bKrKrsZ{V~25M~er^%(V3M8$iLpZ+9drO;k`?QDN|H zPhI+>1aD7)Vg@-0$y+kWRZ4?ux;navI|96!oa`LnRJ<0ACB6rlQO;ZLo+Gt4x}YDr zbsRnvExxaF>c1&Ciq0$#x)c;AyQ^nJauu&`%sj`2W!ccNSh4F>GeEANA9 zZaksymE2?o(|P2ODSaiv9#1~8)2eKO@SLw-fn{1GcO;MeizOvvT3)Ys&F!dag*#WP zLVflpJF>aqSSDku$}t5Q?p!|Ik)SbPlB1B(Q195-b}-jMfh+^YM#te*BH6vU8FvWYCN5)cv}4OX%D5tCFkyTMEBbvk3Jcj z*w&Ae77~V0YVISAJ}sSh+x>k(6!9f%SkY)zLf@B@Wm1kxlc3zf)FLw9g+gIqTTN>` zEyFntuY%*xY_XJ36IK6>|dh}hQg3Sq)n1}V#-`pS>$|Fnuh21DYD0{ zJg3+)^VyGl&9NFfDoW0sSKBheJ1y;5oiaG;_WdM9UtY%!YvJeqK4n3&xc@zI(ulfs zWtLk|p?w~_un0Ub;%(CF6dX)0)pj$Va{8jF4`Izq%^Rqn>(McfZ^F?bVp8LN5pO7# zE?fO>;64DkQ+a3Hh5WZ&5a=YGJ!~Yd_gtbLcJo(dVg1P|9G07Q^LoZHAMdXp)OS_U z8wfZJmwdrO^b!g)3H0}$!=nEb2RMo^Vy17;7eMupCue|+f)bk?8X5|KfMRyiRNzYm z6adej;VG5?V%l9=1`V$CN0Wh_alTKRGvWnf4R%!2_9zYGYNG+HyEk5uHpV?8P{EeUMahVJW zcbA%h?*yOYO}H8>4=eh0$pyBOmYP;A3D=r4O(M8`t(Y>rzCB@=ZgPw;dGtMo%_(H_ zn)zxCiX=f&kfDhmO{iizS#S@>$z3%-}L^11`G%EJ@ zLgk%Kf@YOM4}&q#S@T$7`(@oZ`4y}I+aGi?Y_h}vne4r%iSgt6pVR0+zamXG)I1?} z+ZOsXn$^L6fF9tE|7ful8cO+lW&5(vncpOa>Y0eHmx5L-itRbhsY?9yfJEI#+Gk$? zCL<~AtcgU;I*Y=|C`WBTzBtL%g_uyl-qc!$@EYa%hY>He;!rVhwuURcG_AJ7+{Z(M z3_J|@K7*Fkc_D_^iTrOvQ2opa{X+G5DMzcFp`_x+zeumWlBOk*EJvC;zPH-zMr*Ww zZ#|SKnch017O8?2fYUrryVD~6=Br@5m>e~tq&S5oT};l6i!|CwYV%6^7H?(7O!oP3 zFwXTsobrJ+TUFb(q@wNM7mMK{Rb1=IQmwdzw1{M6TzYNiSnQXGJWU3Crj^&+$})%F z0sZc9sY}bzZ-MR>2#4=gyuOU|NM^i`*}C)+^_1}PV&W&bpD@z-LfT>x(Qb*I>Gx*!q<3Su!#nOp(xqrG zIA-7Ou#3umA;Fq?&2@}mJ^AzU68{s)wWy-nfN7-m1S-K&`iXm<$+`0W5qjQtoz?ppKZJpB0O)WBpbR~Ch7C6(ivm6fORwiz|M)J zXT{Jf#jvKxT5hMtps#)2p?}N5~ehumPaY zbA`;JfEQ!UwFE~N+0k_^%%YmaPt4cQl;GTd=i4x>r0yr_>s;OBP_ND80c?*?#c?@8 z&w_-_nRxE@CWC~nr8(y;m}b`FYtx*%qHWU@Qq-U;FwZ120jN3X*x-+uQFv z8^ucQo(M!Y#QU#EqVMHoXQNZ0$G4cBn*WwrQT3n^d@EY0<;S+S*$ zffQJoOLYF4$O{^vtz^9jcx;Od;t@DT@2C*)+1)GJW|I-e56v`2y2jN#FDXHCSd(JPkDjP1j(D=N~@R&zJpP^rcLxj z6N2<}E+!gL;zHW4+@-QILxxsiCbEz|o_X&4G`|yy{R&it+m~v3S7HrsCQ*LxHZ$bp zF|Fw|MhS=^BJhW==}D7@AP+AY_c9CWsFb7PMO$Z$&dl?qPwy=44N@pbK+D1;m@chG zsggc1#mb?_xN`g1yxjV&@ccV>Hu=@*WvFBh@u+5SFC78&nfC~4f`nr3;rnTqbKJ%I z(RY#k54y-z(C?ec#VRt(b8>9ebi~gF2-)i?k}SOU9I}r0XV<&>o7(RRKxf?c1Ge&F zUF@5&S>%;;@5b#V>hL?USnx0H`Z^~r7ArtL7=yG?crwpn3bYwu7UX)jOjY>HTu?%Y z!Zg1ZRTv2sHT7c3WJQN=b~LXdlvla2!M79^`o~}%-;KixMN!<7{ z^rMzcy(Au%Gkz0HSJ+D2h3^DNv!@r= z+qKC3ywr1lePU50JsW?R?{h^czV@$=~DS@8=tT^4S=-wLzEbCiNsG zCO(DU(s=VGw6D+T(?~Pb#oqLLk`2-3i84KA{8kVo1}P=U-1PeJ_|w)8J~&6f9=0+1 zV;}HK={|mZ(AqB2xTJ~xfcQJyg-CA}Gc9%w)NU+&xSv0b4{5?wCD3ZF9w)Wqpdh8N7P(dh4SEXj41oLco!ThaZ%R18qtSd$$l#H zxTI91kP}1)p?1oIxVIEi%=eBC8p8KyAWaiPZgecq$@+$?CQ($FpI_^~+z)#b&GLPBd6g*nl<|JAAd?g7RzU{@EwsRt89WC^6I3#^&z_TGd1W@bIZE|g1#ra=8{79`k%M9`PZTGe?2bOehE6i zrHDF{$Tiy+6x+a(Xsgwxsy3w>1{2d-9 z^w{~Q{Z0b%{jhr|McvA+K~%Gp!*j4o)+6U}=HXetBzRq@pYcfXdH7hTiSO&3Ys1}i zHg9r58teTOD2*Ie5B#^%PjwZb6)dno+ch2&Yu>b&(tj=T88 zC7oaQ`P)_ZKeh6|aO(RkR0@Kr{ujKTa?k;^o!@@YTU!ViD;hXq5|C!K3cdIiI z4PWCybI*1Zjnc`^V}#ep;vd8z^uCRG3dug)7t0|+NlopU&w?(pw4|gH@Hz*?En{Z2 zjE*fgqDLNt86)sJ;4{E1w7m>90c2H&*AU@fP4pD5$=RQjBM3CH_y?M}cF*$a_{a5Q zg%C3S>)59>+1vgPZ}Sge`(HE}^1=^)0Ol!EfD1fZg9hxPDTFSt=NIBc0VYReSChCn?ZL_lH z0T8W5Qrij1S6GL<@PG|~Iyk=|lo3FTulz7FZb_rb-qWPvGxriFoZprD@8+PTW%ecg8 z@5S0*qtlt6Yc<_BZlj`Zo z$&4dXKEBwh03n;?E^&9@75cxB_8E}Hmkmzac3rC%9XNGAhsZqauQk|qSAx=8O+xsF zm}QLsPLC7z`tk02Q?DOIQFOo!M`Z1o3Rw^9^~3SWzVZp7(Y&Jmj z{DX&a-HK7Q)wP)Vw%+IQ2GyYkR+^o+-e2gD72mCws?Cv_nMuM^1{8FR@(#4xk9aIfmKb4@#X#OCv!qL7+=(%w3f_lOV_A0q*x^q`Rh=!ZNB9F)f%De-_U}CijPbMUsHzp%;Am}!*&CBVA!|nA)C2bzw zksSjczFGlT*m!@k*sgHDJD398YYTJpP@NXMMq1X_)A+CI5XoId>pYCm9<6^5nQr*E zt9%C5H4j2jQqX=UOkec*&dqDh;K@T2yH?Rk4PW66OB3jD4wA zvo_anzd?{p2>^CV%mJ5;O;Uy?sI)AqGs*ONMw|xoft1oc>rVM(4(0NeXHqqUGV6xL z55rj!AIvgR7_y8mB}ROJ7dsL z)eG1Rn4{YHm~2D47WQ1)#^y5`joEj|O83u7Q;vd5;q3}$6ga`Gh|J<&_OXdU24xqK zuPh}3>_z2}QSy&=zt=D(^1xtT+YG&Z4j-2h$izl52sVxG70Hy_KR zi^UMFURuKADr;?j1cMNOy#2V5;uH4n^b0@~G)s}y1 zlczYvMmi)suwsBchb9L6sZ@DYiaw%la?v++V@{a~^3>7!$s)GphoyJWy)nqOT#>1w zO;?E~akf9{DV3aa(O!h2)y_1(OPVr#A#i#M2qNJn2*jV^00(O}!co)rk+6rf631w~ zKU2lt{urFx2wV~n^?6MYK}4~>av@=66q^3x!`r#5V@q{PVLU!m;&F^AI}wj^8{ats zc7-5ibZA@eTmOuR!?5~9N@O-Ru9%+e{4l|KQ6OB#DGDgQt_g>?(Yr$?LbSOX8Oz0~ zY@)iCEDyEM#Ky%1gt4ln27_$Mb+0kuKckr&OvvuH_LeH`0l;RRYGdfnad+O)mhz2J z!Z?Tu!pMZK_4_=AfXGaW4!FeN#=QA#`Pb(^r}&n;>bMd?p-&mM9-?H)1DF_{?{%IZ zU-K%|A<=4Tl*8Z;{rY9cr;;1b@0iZ1U`e?=Y$P$c*%;52uCTbk05q^7z#{6r!S(c@9C!9t{KtOkcr)1Sc1i_e9IjLx|RgLuim^Ny_kSXEJvj?8@_ z`XPV>V28XIY>4aGXHANAW)@~&H#s0qaQ|6jciIvq>J~;5v|neuENHE)wA-7q=a4hB zW^~)bPGo`tT7;@_)HdtWeQTEB#uNe8&)r>JeOY0$aSSw@O-+LFHj+Hc62!KY$l<5g zryDz}-zUp-LTZOmo=*X1>F_BHn43ba14cR@5cpB#;3JB*b3o99wna=xSWtn!3fnXLRR4bn^lTMoefucvlx zMqTFJCTsB!smD|ZOZa;s1F@5-etCz^OAJ(8Bgw&Zq3$yw+z<&HQh(L{ni?Y+F#FQ> zZqj`fcnq+>{r7L66OAgOvHFqs+fuoNeMQqfK1eV<(YZVj>mk!-)jrE6x3zNI!RO5O z^j{g}=2Gv6`*0Xp9UB)%XP!02^c-L5*a2CICpoFlXF-h&PPcpxT>W`VNsM81f+y6Q zgK3DWN*|K}sfcPh{VRqe$#LRWT$o1DkKiKZNb-!qeQxt_F7N;FfXQ~nsOiv==6eer zVq|2*C>4PyhH%MnpdxF@KMT*lH~(E44nTw(0~xkoD%)LFb^Pyu#FQ5KS$A_F(fG{N z$4{SN&uIY0OwV8e!hQyScpbRe-cI~Ev7^x!Fir=vbrqmb$LNJSzKICzr;3QGwo`n5 z%RBXvh(K+>x9z0?(zfNFqMq_L|B(bXCgvWU3OtU1wVbZ7q*?hK7xZiRUjG^TEnKw0 z;rm=&>>cQg+CQW6tNv>Q_|55-VPF(nyW$Tc==gM~b%{S{x!5u7R)YEdzvPEd-lhiL zI1B~gNnvACzWz1{m~lXA<$p3pU148t0GIjSq>ze>vwDd5F9Gqd+?*gfy}LwR53Wg3O%$ z>ueXD_-EiS7iSqRbdUUZG5*(J>hEAx2#zWWxf2=ADE_YU|N8!4Zg<)U|9XZY)15!; ri~pxz0J3cV>0JKxB|32=um2J8u{W3?&TGOH3jC9mQjjbcH}wBMG~bNf literal 0 HcmV?d00001 diff --git a/windows/security/identity-protection/hello-for-business/images/aadjCert/profile02.png b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile02.png new file mode 100644 index 0000000000000000000000000000000000000000..215b22ec23a3ef8cf27baa9b255f4182d023445e GIT binary patch literal 56028 zcma&OcU)6X5HE@q6#)yqD zc<(0eKeo)yrMQn9&Z;sJcoicwo4A|X=I@o>#I*J;UD;IG#PKbVh|=APgJNb0utUKyuscT{F=WjI8M>I zr|g50tQ5@uL+wMb>~ALS=W$*TfBZvle~N`ALxVtN%!B9m(B2{N~rgu;*9p znFyDW=Ap9i<5cH8O25S3rbjqV{X9uq~-F6FP*MlZNV`5^K@Oy}l9vs_~ug;V4mp=Z- z2#-6PW(Cz15ZlK#lZJ)>6J8tsX2UzkXpo!s>>NDabuw7-t!99laqp+s%Y zg^~Z|JSFoF^@WXoHjOvj+}qInp#ib$1y?)|3E3Gc*IJK}qSEFsLzMt`LW zv~bM@?DcQYF#Mgj`0?snFCI>o*{h2=IuYT?gOrp(>RaNuQn3#3!p!{QWcZzO-G&{D z@sT`hbC{ihVyo*ObfC!9`o57?=eIp=r6}ppKXU%IHq_gjkVw+fh6YcRexg76H_q}4 zOY8AdOK>NnEkf2S$(4F^-4bE$P3+UqxLfO6hSo)GO}8DZ(dyQXhWEO-dp$Dz6g1uQ zXFV1^ZBMkGF%R8TQdGnVF8t(#n4DuF{%$Q6?iUys2vS`f52Vy$_FWx|&}xQ4q1Bun zzuD@IZEcs|dWDA+56BRRWliu}!wotB7>AwglM^0Czd*^#ndN%;1`|81Gz`62DC3ZS z!h-U!rD;<|hr_n=!^i_lk%_6PY<75~;)<6Kp%neL7E@g{LB*z#d*w`4%(96I33DLd zeF;s}9Ox!8@1qYEc}f603Vrb3GDM~zrnG`@OjES9yJw1eyX~XDoY|$k&>+8c3z{t% zG&LpZ6LeQRckblO?8FCcX{hDA`&AL?Y;sw@u2BI32|LN$uH1lF59-k^8;YSWAA7+S z6%{W}_c^0w-@b(+Q@LU*MBMkvnsg*7M9hYN5Q~O~&NO;yjAn?mGLCfQZ6Va5E6lm$*Z1Zum^E%yNY3i^0S(8)Yvj$*K zsn4H3j~1KYQ)LU)Sr4U>Jk+JAvz!aPcAan5`lx9*qIZX#$#zhlZjj*E)8GbU%OAyE z;Cj@`v`ck`fXI^<1;yy(Jc(8)_QbJvMXd z>v_wOoUc4g((nx|zH54)?!~5h8_+ni+ZaLuiRl4LA7Z2%YtL5$-u-GtdV03Sdo!NF zzL_r3j*C-ovbNlq3+KNvp2;U|z>4Lldmlz-tJi2(ym~@dQJ=@8G$v7?DM>6v+|Tyl zbb{P=W?qB6Dp|Q?Bh`PSy=q^7`VX~pJNCs1{e|+#;5tcfbe(#}OJ%?Hn0+AHQ;YD+l*_MDtNk#ujD{WmIJ0u+Afn$N zRhO3$kF0zaaf-q7^f96XBCC@7M+S7uy<-T5yP)psYUA9N&RVu~5+#jlM?wo#TE1Dp zxkC`{EtQhmT`p(M0iYc_@#&$qhSX;*9@h?-!M2Rjod8WKKbQTxO@dFK#*UfvmRqYoW(-q8iAqOF`98G&@l?o+A~e$*y-4+A@e=mPlgY(D5xvHv$-~ z#e!(e*p}OyZSOAi|9uAy5=KvKc1A9PYY2qAK?_~>3Yz8GWLE^>1Q8{K7IiKiQnbws z%<4FOBFWz2SXK@OREE2yR~^V0mWNuZ#1d_p_gEWa-y}WsFj!SEOl`c2Vrbk~7iI&G zC3xCZaJHkW6M!95`VpMMIOAw0K~pt1YSK{3Wixf~R4&B$VrQDWqj!gVXd*XtEW%TY zo`(&Z2D;c*+J_`@6ijdKgRk~3@3klb?eCUDrCUPn#A`9ul@nP0y(I=u!%y#@UiRF5 z$N9&Yd5(%xFS!rVwp?jd0Qip=|S7=2}OGqCB)nc`AT1 zun_>g_EZJcLq(k}GFNcx8LdrW_2P79#WfeIht5R`KXudVp$)*7u&pIi6QUXZFmmR4 z(*s}GGFPFK4&y(xEa6<>YAQ2 zCthpdh4tX;;P!Z}dz`5SZ&7qOZ^ej5MfAu07Aa~8cqY!t@W_AQa;t^1a-&#lUsO|* zZ_xRhrT^Y&Hs+FhK35@#h!#|E@Cod4YXVF~6)`$F$)^i*r9Iu76B1Ect%`5OlCaCk zg%FNW5`p!HGIN32-%}m?|@|6NP<-Jws+_`*WYHyLCkoCNIOhn+6;$R4i(=AWr&)`*IQQk=HHe=K)f`Q%I`!Y*UM%LuK zrY>I-yD;ehfA^(>bY*3q2`T%?dkv1A*OqZ>0(hCO`^UsiC@bbVd&e3WBIc4VZIyyR z&9bull4AM-bL}!gmpaUwr-qwHF(L}`tTRL&JvvTn7CuWx@Ku#l8eXN@Ava{rok~Q~ zlP?<{gBs8afiq8q0&7Bt-!?@sHLWL+FVotX?6KjO!;!WDLQ?b&tLY_6$}7FF2tl#4 zC)k89;kSG>E3RGjPjxo2;g+2}{syUhJMzuSiZ(_-YquWTBA>Rno^N!t6@|O=4Q7b% zVRvY~-gOA5op1eix%zR|hq6?u$P^(1u5e!9dBNj)%P}?uu>;-Q9kz%nwhO^(hm-;* z6{XB=Pe;Tn`#?1^1EedyVQW}3Z7%+0E84_-FHYVooCcfF zTYQ-|S*Q`exou6>CYonndPzQ|a0uBZM!0%*W#qRNa%dbg{Vwp(b0|VP0)s0B$1`;3ArZE-3JtwP&oq@`o_0+sOG=M z%W=-QakNFXsA=aO^qjzv7zd4W$k?I+KvW^p0t(Bh9CK?MZx0ZSHS?)qIqI)iAjLK- z%aW_HO$rb6G>9~(*L(>*I9J5HKIF4DRWyfcoBVvoSBnRb_^T2)3QzQHXg)#T_RmhNrlX|VRG+=8Q*Y{*4z zuB=r)dB(wm4(GQvUZ2k)(MGS&zax7`d}*aaWEfVgR2LE$Paflf5(^HC0-Wo$fnKth z2mpt;Za$gM`EGm9V4vTfgZ(S^IP%STZ5){epdg}tFF=!Zl)Wq^DM|Q8y9HHt;+@-o z^F@5BjPmUVu~&4=b#yOnY!>aPa8Cp3%tUGEFQx#o+a6<1tSap+l0T zJkqP(UGHLgg;0a(8{9h;>K;=Yf~d1`SWn4WFYmB4mvFjnWC?<+jTjc{jBFH(`v1-x zh>5Kr%DhIy_^q!DHyzUH`j9_pj|VgH&nE>C6|*@ZMYlwx*^5Rv5@LF&HxHe$Y-Y`Y+!--wEAk0e&S+C6 zp33&SQ(4;V>Y1oLkFLLB_=Nyy0amlr+8UV)LRiJlqKcZLZuAkH6#ex+jaSO3`t*9d z?NZ|t#Ply$$&jNGyY;GqKuTw8n0G)n8 z#PkVqaiiGKRbprRxq)|?I@+%i>#U}sqfvIl?rKFoztHkyFLp0u$rW%ms~1v7&A>y5?}4v(9mN|v)abSCD!E$2q1#we{E&IeOws`41?_CJ9p`ps`S;B_CW4pK zXPXWpr~QyrI8CYGnx&$Tro)=dwMXdCn$dYEtGai$i%(r~kP|plrjj?Ft=s{Vw3V() zTEqCga@0Wi$JXP?viZ(+0i36A0kz=cBRyzY0KD%EA|MBC@=9IpGNn}FWa)>YgD$7~ zm$k2~8LE&2DD}$huDxKG%d_rAnNg{-&|RG8qN8dYqixI39Ym}Gk+mN++z2D*)J0S= zM~lX%wxe|!Wno*1sqJK$tBc*c)W%-i7HjgM^aoEOTG@5$EZH}q0~?!kFCn5Phn%q$ z?t5fugXi<}*ft;0<4mj}n)!4;jB@?0rPJO-ZL2HR5a-$FV1fOI=FZ87V zwQ8-!XYWlZ0;ly#KM=KA>W4|Lsq9FD(~j=fE=$Q6@0UW4Qz)VHbt2C$8aYRIzFN60 zHY$b9r>~&omTaGI3VbFJGlRSjg~@|`yxf@bs3ooD2(uFAD>%@=oGGRO)MiyVqbsZZ!tl{~PlJV=-fH4a@&_B3&C%KpW1=eZOfHQw zg(g5y#oJxW{!3KA>eo~I1Px>r75#1?gQyN>0=T7b!NUtg+4Q7`swl#?S6_mQe~P%sPUDw;$emlO>_C6j!DFw~X|ScQe@>3@K!m@38ToiWHgZC_keAe7iChpsggW>3Jav`SK9y4XT5BpOV&a1 z2uPQvxhX+_3-AHYSwbpuG>9YNROo97ZuKh$mDi*9Fmaz+uYJ9Us`n6;TEyH>EwMnc zxkmR$BHEd?IiQ1@+u7P~D^q^{+Dn6ST<)m)4R?Z@SMQOLU&c19uM6bc$~QRQqe}O& z_*#|cncfpfKOxhTZUp&H7HLguXW#Yjb>4Yx5h^Qz@$`Tui-DHiPO7Io+}=RNmgoFC z$Af|8nSiE^Zc;rlDogpj{5`B_{3D2p<+38=Q>N%=eveAb8aiU+v&I(NLZ0JWV4 zyIM6YDWBmLMqPVrXmanTF{$WfQ3(_#%0WZftJQvXnC`m@KW7d9vojdr+As)Uf9ILs zm{7IHbm8%=XR2muWG4Fyo?v8i6a$gHreJDc`y*aYyIqhcpj4|p&vU3gij?Gm7CL(# z)MMmHtol<;8N;;u;F-Y=c@1-zXf`*Sronu?(|hHXhskXs9)~;0+~n*!wWq116Tt7P zr-Y@4V|MqJVkf#?Hyi3tJo7lE+%C_mlM%no9gxG*$D;bpj&LvbN@Le8PEec7bqlz+ z1x9`hn&w_-N4s>}*#ht3av(~Ym4k1O zUs~P*bT#v(n%|4$gdBcQHTLpCx42r@UspY~oxQ?kiuCRR+Z*Ig+G;Zk4XYMz>5>84 zt()3>&(9vaWCsKX?=HFH6NqY4P*Wpr?{V_*1zdD(rupL%R$H6EWHn+N`Ma;s^KBAH#WR?jcf12OG&(ROD@rlm_0zGc#S+LieF zDms1A8{<~I8Kvbbdg9o)sqNr~4dk@o(4c{x2n2l^A;KU=QLdR~LM(Lh-I13|oKOmE zxSy{Pi@hrIW~Uv6(az z

xS80acM`0>_^cVZPnq8!XT#Q;z8+}g}4Smti&aNrk7Xg+*NXF@5#6+m#6=$0g z9I^wuvRX#BfIF@l#f{A_mnh6*+3u$_>W8%%?Ff3dRY}^L!^v%BCEhBH=+CrhEV95? zZKq>-^AM*-{u&o&Q*~e9{P=)s>@aP!B{q7m612sW*SLZLmL{p|XKzt!!gA*rNK_I+ z%0+xdrd*=ubAVF#q8DHFmL_hZAGV*DT!#H@C^+NDTt#TfEeD(-YI+t!wDuIdh#Xyk zJre`Hc?jEue z^4_;dUJ@;-h}Z9re%X%{8`g2zrskRy5R*1O>>?y0SyL5X51EHi2#buriEQ0H+s~u+~qc5&J8sxRF}-nRNSHm@T_2@i$z@ZzG! zLDmoe&kMxKetvY6tGb~fV5<_liUcvXdWjk(fb~eDa;TM^<;Msb_Uc*Q9Vfn-@Yv6m zd@UFy#N3for)~030LP+uMBJ?s`uCxL6N~UXO6c$3C*1)A7N@b_#8X}X(UwM%nWbef zMt)r1Ysr;*`SK-QWt*L?39M9$Q@71!Q`JjXcU(oxn1P?C4tPoptu&f9f9*Za`k|J- zQ_y?y2#CF$-#NxEDzW~@ihV^mjX9#(?@gh$WoLRAv%8)4=@2kL1IGxiMQWy^Xw!`V zm`%EZ`UhiqX;H&$@SikOS}sP;R$LEQsQx{cl0rx3JKGnrPKuG*zg)CRKvAY|xw>)v z`}UjkH?xI#V1fjpkePGv@vT6~BZ# zT?-rxwF5cK4_o+T$NoJx$|KTbB1+@*cxxPMYw@9QiU2#nPY!q>CUL<0{As< ztp7uh@Wf&8Wy_%qvNpw*RM)N9e5KTey8NP|gS~V_Gu)}-t3ivGfZA-C^#2?jucd3p z_&uuExVur({{yh)H#@6uc-tZ_JR-vL{@?Bkj*>?I|6o|2#eZ}R{)4;l@HYM* zS&D1@za0I4u(8M$91=1BffU~Hk{dE+{5zQVau5k&WC}%UM0mJ`|MgNBr}R%6mWID* z8XgZocI-eln~{!FSn*YDmxq)tUJ&%%Pv&Jf@`HqVA# z=EGDyG51P%4dUj^d^<> zQgwfeYVo@L-IZ66b=ShWHD?2v-oxkj=pXM+Y=L)4Egj@oFJdC1_e4e}tBhyQ=NpkP zXbVJ#tZ$|WU@yi{MoURsFZ3oqaGRfvH(Z5Ei_vfpRaf}z@)jFJHSqAxy0=Be*Uh#T zrqRvM{Y5V=(xP&*i(5S}j>GwsjZxkWn9$UK!xrMt?K&|mSMw)2YAIcoRP_8U+i$W1 zgb}Xz#qY*L$uB&+3N&r|OlQf3K2M_>(#J>W$$o4kDyxLle^GX+^gb-kCv6pS)yF$@Zr1d`6#c6w1sh&_lEyQ-B9dfg z$QKIFf15x9kX=D_`Otd!4#K`;7tvVR)+SQ9{qopr^Bt@~1IK{-e+)4HuP`NUnLXUi8hhRjPn&XFNoER#8da6>|>?A_g6>)_G&v4=GJZ~DW6wpjP)7(0ai ziaUZ5os(T%s$g^y(%%vElx6?D#sbXf!ZozAoil|`nk1x$)DRS#uuHASS~n&>^?oW} z)u_&+4c=3KvwqpgXrNbspzPe%1YsVm6e?{Cuh76Dg*bH9>tv&Id*U zP9FcP7G73JNe~I<)A(xCJXDgX07&B+!2cfw9;v&{&CMWfwo0E1_&^x;WDDt+z-iEm z_Q|9hG)db?%K;pvqc`eK_LPUDq;hZFy% zho_{#uI6Hg?5<9|mTx|X9Aj)V>U|3G%F4>pgsl(lbwxZE>03hW@&7$O>OXGwfj?q& z_5fMO4@3e8DCd{^n*vc^5vUbLoOV)*Z0RC<=x17)=vcBaXQHQ zZeOO7c%0D3;*0s!>GuQXS^g>3=-s2Y5Ywrw?|!tR?_MoOj7|+GOTRvK%Y)2hMeEfA z9;Z_C22~hfKY;GyB)%|^WfV%+E*K)c@eD#}i>UAe)rFgxE!LDdH7g;AB+CPl>>djw zXjA43C8WdgyJ~Tw-Ny_Po=-fycY5IEzmNe(HCwj;52L$ z;$q9RpAdJ7#8M4aJm~Wkj_rFFOgz`m4-!4!3GyGl3z(8s9>=%8 zl(`CeNGS%kR@YLMSfSJtroAf&a9J227;nZW6C|YJ^Hj(^r^|mYB1?RjPWL3%a+A+= z%Y%9n>a+Jp#f3%D`5Rz+!rAM+1AcsJk(KJ^I73YhfOFIsY7=Fo==F2IjGHRbmlNIh zf`ISo{KZ(PN_Di%fbk4jt^e(2M7er`RtR-}&iZ8xxXWtsqJAHZkBuA7}CbX@vfDz^%s$ZH)y-R?e}MZLH73 z-mzmX5l$V+VSI}9OS^xxf>6GLM5M(?rciVj?aug`H8JG7PSdz%L8`#1rBH#9OnYs? zixhv2bLk^gI4xT+_PKkpcC9BYlSXNUb|^#CM5orJXxU-nD5Q)=S03^B!__>A7h`aB z+j3QzqKi!TGVkZXL8a6VvP8}VF#W#GbO`SdM20={4arPvD!*uitl_+ zxV5eg$6uNDo(KKTTR%+s5wbmV4r6vx_O3C!fsRdA5tRw{!(fYrrNFE0I6vgqa^BgF zvAT``3oA=(VgfmAsOG3-&~$ax2Y)y4QicH2tDnSdU-~SN5K`I~gNAlpPpdcA5t9Z$y4P2E#<#^*v{>IT# zO-)XWs@H}3cFiFqh98|6mY6;RWdP4?no`b#$kbb-O_Rxk^jy~CsXPJ>WjT@%7*4{{6E4y0wMJ^^BZO#GjXmw1Te9;ds@V~26XVZuHLmjW= z@uNo{HKNEEdFH;sxAn?Zc?g-AOr=as1DNvD5%JzSlwLa2p^531p=2{*@ZIdq?nKmBIX`tx4^0&?H9KGW5I8om-#d%UpnCRM@5WOWAY|_ zv@SfPqsF8|?EKq1@DXi}v;PQ0K3H22L&&^n_K@o0ZX0Fa+v5rEm!@O2n=_Bl?X0t$ zjwXGM^!_x%>do+_?p4~(L4>crOdw=kzh`!Y6%sv{<(C5x{`h@8_w4!#l* zLAX8en@le*rOwJ);`C>2af!YKrPJ~R-!YySFa`tt!4cqE`AuC?M3}t7kQI53Wq3wB z&7>X|-=$Dk(xV;$C~sBD)7?y7gIVxMg|YHmi}pR_g!gb=etv#ztlIiWx@9uiT|%n7 z8ISc5+ApOoT$D>ZA6~8GnX(!coSneHuD4I0vtOS@G@Y^noJVn1v&nF*^OfKNZ!H9>oDhzRAKeJTTvRc_sThh)^5pY?XNC6u9L?4*Dliw6%Kzq;@0!gXXY%R zULmVR-$Xw<@n)kdmZWL;0Pkrtq2cE z!j<)oQ#x)tH`!sGw+>6{^OkCT#7yf%{=?K~q1f*`^6!IJ@`F573^9ej0arYn{MIp~ zldFe z150EosQK8=pRt^x4aJ>5PekdOr_k7!qp2&aW}aapw8+%A=eg|lX8fm2iy!Q)`4`PD zm1~R9ZK@uCKCljOfre7>yRER}JppeA%nrXHW`QA9TSC$hEo~3swS00JqBfsLtZe4f z)UkdwmmE)TXv@*#b1=A~5z;}3EUUGvW%lPosi}(|& zfxRDXl57_m4zG8!6Hu7#>G}~Rb(Ir`ZS{GV=V(`P{wThDk`<9tH z@K0i~;wuxJZTQxkG!*brRaaY8o-=Ghji)?xH-Ks4OiE!+^2gkSS5o=f z3&^LD9Z5f)!tl}Fz0N_x5;nGtl(rk=!QY$JnE8k)*dNlo`_6n9Ey4K3~=J=5pR0e>H6D@%*F7^t87Vx=aR)U zQ)@;QeM~R(9og87j`tmZnLc_UD&T9u=N4v}lS_ABoc+SzuW90_PDhN zd&lmXi8tI=*tz$Td;0$RrB;jHS|1uh2&Z|`(FfElfM4e>zCShxi2*&&$3y^=dGAao z_CC;U4ySKCHdB0}S_l512>`CW+KqhCW(7DxWp~@CZcqZ)Iz)UdY9)<5Nak}ARzeny z)V!Pp>d7E&f6o)#$WmAd+fG8pqPlO0R~Oe+(`GWXJw^3 zcKQsyfRNMS0~47u-|NSS^X2->pHldq+Qyy(ZjQ)O~bv+HNA_-mbYiPl3}Y;g==v(PJMhO88h>>e622)FhCU zKb&&m{>D7A2`g;0oAcVGN=^Mq2EbJxM)Z1(wJ>oyXaOJGH@Pu^?sip}yQHLqK4Rjc zzc?JE+>!KlJFjHn0a2iwDVTi%A+oZMjmsIhO*^94q=gV#@rMc!Tci5a{7g3@g)@JM zdn4ce*RSIP{XXBe$D5aKj~|hsgj8JoLNe`rfWgU+!h}v!A5{&9#6LmNd}(CIN;gns z@ASP(3X`m4f_kN%S!XrdU98MzoZ_$i_S8AxsUQAoaUFy0dpZ+6Y@a)2l0V44;e6=$ z^fdXMtuV$&J*D?EI)$Y|P<(gAHuo98T8zZWem7n5jgOd1@5kb;k2gzMuHv)C`#N3m zp5epd<~CY{Iyn6!l8tH{OX78*JV47anONP}GWK{n-pKg(bZdjw{B>yudmqr)A{W|` z6-YD!ShvA6A348bw z06buLI=rGhiR$V?F>wmEX7CD;xe*1wN2zd9u32%FQmC8Wn;YvGT*)ufwfF)*Hv zY$sdMvY)&vs&{s6n4rmIz-@Qm_cAhyMW4?suab}3$6P}yk^ZGo;Xs|;d}Y@y{tu@L z4+v5dXQFrPwQS`p_7esFX#a&(Y>u}J&(%oVayx$p+R~?RVN6={<&zd|g2YY}kIM!v z!N2m2l+!0}6oRN2ep1=U{^QSWzYvO5VKB8s#$z}yC4PJqY4$05qY~qk+-_jO$w4O8 zcjn+gI$|grF2d2fu@h&cQ((d0=_(t)Twb;rf!Lj#q(+VzXv2#R{ z-KO3@bqlGxh=??dxbhh{-w&rn{TNECl6O{{2#gj`;xvEj?6PS>;&ty*H^sWGaV>#o zgLHkpn6}88AG|SDz=RO$_y`dNQzvfteVWjKgGbxrgL>9~vuE0@zZA@VKqX! zM2=^Vly6l8T-i`{;A@BaJ>+rS?^!xDIF$kCL37Py{bkrY)?}2nt8RAl?HnmK%xs&= ziV;Ml=3$RZ`4?GN7Li+=t}WqemoYi9we#j`=$Mmo?mi;w-EvbZKAc!Bc;ap~_t07D zuCh@n+Tzl&;{(b5nE@kT243J(W7@6Xx~K09UuPyob-nyLs5}c2jqxr!*ugiJ>D$dwrA$rvD9SMt#> zvMDtpgneOU#5onHbaYSqpZ$wwin5u-LR5^fsbQuOU=x|5D%9h7{`~&qn)(8ngR7KC zk~MZ%jk@CK%lfmhE6hQ|Hx^Vmq}FoEkfKqTEH(@mDf0-HtV^&3x$(RFsnYkTljlD3 zLFFHOnRS{emFy8`*yU0`@92i!>bg>mCv#k48tfm@p;)1H7iP-TS9OK}#`(6Mk)tM!^XQ7gDMeXHj>+Izf?Xav&s+wKy3T4Mapzl+fW z5K!7QeP-$?+8`fRJHyTsr`viNKqo6oby)4&I$RWKCZoS#ja$f;p+#M!-s;{b~AD@YGKGT2`)|d0^eg^F=Mb zz9fzp(DuC{Q7^Su>v`!KVqiU^Cqnb4jC!%Ze>GFrUs1%Qh<1Hg75mVmb$y@P(@Wom zi|g27qnmmwSxOA`=926{&(H#12sKeTLqeLR)$=hkB#j%#W`VEt!~-n z_Pu@B21SSQq~;=XaeNJN1)4`#@9mLqMG_ z-eZ5__c!jQ#^p_gjM|UNnm|{IQbw6IpG=bN?K>Nb0=RKebJ}%A(|P63;KxqyTLE-8 zgc{jhE6(F-rMId#oQd5uE?9QHE=P9}o_vIw1p?2~?v0<9P@L|9@J~7q1 z;epkNqvP%6+_{)JnMl2+ts$lDD_{NHS^kFWDf^rA9|rm_*im4qF7wKtCpuK1 z&C-P)B;y?8@H*skcB2{2o<+Jc-)-lb^ga|^Bx+Gs@mX9xn~qE@jV5xbDyVjy`0B=9 zYG$wDFRt{mBGW!?GBMBoh;H-Uo*$%Lb=Cu0w9^jb!w(Vj&{WyMh}K+8^i2fJAG+)J zD$Zw2SImz`08(Ja*2niUjL_>8Y4Ql&93`kioQrJ9&2$Xx_o73x-t1CAZ=2ouQ zfWEEL34*=|ACozOf&R$0l8jzr+?vx>mpreNeFz1q&f^f6Y09sYpY&U(HHKaDY{s>( z*=-?>Mbsg39qqX<0VH+Dqx(X$ZX?c=jd86(u|oHn9qV;LUIw3JX{R@J zfa%n;O}W{09zdU*kfd|rH{YOkgEiigOm)S#yLme(5U+%zh1|S*7xC`Hlr6sT7;OJX zYs-0n^0FAw+&bGeRZVm~z5xR6FJ>W4hDie@+6qxET!}Ur)91+9-T522_56Y3_wbq-8_f<{!=IK*EDB zyedjvx6{t)8*Cy3;HUYf(PF@BRnB%pjd^#sUBZ;5ukWEI4fb<~*2<8x#sJ_>nMq+= zcC*arNIY_6t!ES8-R9zA->yOdB{f1j_PtVb%w%ajb-s~58fHBWcnv9Hx35q%z67j9 zE-JL8gC9Ia`P)vnFg}}yTC)1Smj+cH=4!f{@fd4*tORkah)VvU1KqfQ2irxD<7CwRGbTQgd{6ge2xPg5+;$FMyrR7o91pxE7 zevX_FjL%HMy}#egh8g%9?aX;@^1S&26+q{!z|0m;u8-o)d$xu*I#i5?gt&Z@wCA3u z5h%f-wi^k?xvZ-RIcLC&OGsMi+` z1vJLjYjKI&f}j2r7vKp~;?8GMP$k88*yXp3Zzfh`g+!a%r3ko9Z8+}Ve<}oQ_8@eromFfh}E`JeYyg!iA zX;RMiz5j{{{ufLMmy90@xKpovKJteFTvK_6k#^ziNYXVlwEO(|BiIzqw`)f#^3nDp z4eBwkMp zL5q&H%vBCu{TZYr4aS+Iym!vI8?%zMw*2IRCO_E|Es_2m!UAxjJZ4PH&F*ds)6`Vg z=BSHo+`&qmWt75{ubjmq3pO4Xh>&B~i>d-gcM~zK*J?Phqt%v-tJ5SO#1XZ7<~(#H zmtoqoeagl@zIR>}DELmjoP(vMC~s#t0xeva)!`V_z|NKWmzel*zB}C`d`s#^Tk-jH>15KrO&VJjzs!o5x=+1;gf80tWVCN6Md5ssChP^kV-FAHM|97!0 z)=qxjHa4oOb43UpDAHv7rTjvFJp2yMo~}QNmv@ycjq_q^*JXNjn>73nyoLn)~|f zoL*zt0|i|2`s9b1WlDj<&>*2+RfXkDmwUx`T+%u(m)SBYp2() z{e_~1f@TImdYv(~&Tri=P|Oe1D+xRQ{piPCZe!OvFwYjVR-+U0$YfCR`O$Eiqdz@& zZ|3cC^}yrc+^#R{+SOmy+rQRU$sH9j!Wb|9N*5PV>u)CJD99@~KRB8!cIuX%7!XbqFb^ zV{_Z9XVkHgRIaN;-b=4U=_b)Xdf-$X&d8Cd5Zw93f`mnvxuqu)x0#a z4O2O}`|JnlrS6Pgdj9LLsGmsy&9fZAx+r#kXZ1H-m^Xj4b7w`Fd**wEyFFy#&2r`b3 zXa#R}i?qom^cZ{bAm4)_iED?3O~#Na@b9yCtz2CXJY2#f*aDaTaVTtvvy~n8o7L6O zS_37I`{Ka=iik!%HWG7g(24v9wd25LA)6BpEqKgFHU__soM|EFpuTz%E()E8V;n6Kq9N1#9j9i{LQt}FNk`hWL}0sq_L zfZDM4CR&NpJ=cS>VqPb*i+=bZqS2_C2J7{WcUuB%)`mczH+>V!KV)#H^RfiQLj!v& zI9R-v15fQiT%C2^?uPglvhYd+M5{ZbY}(lqbND{NTmPURCqy26iZMbZ9o&e)qX+$? zx}U0S z>nujxOuy~zk;M}|Z1ZTW;@M`b=VU12>`j684htQ@8;ll}4pux$A{I9V+AR4h9J6uf zVJ~oX2`cy6%*k7|JdTSS<~;I8EY#ifzC2D4?hEC=$F3tfP+Jyvr~PJ1>D}EhDl0TC~LrVM3v~rMJmWVb&d#H3D7*}dUjbn$6ub+*D zZ7sfKaH_hi3&wUNOI3MGSpJjw(I$RkRP|hByY>6TW|V5=ex+yz?7)uJaEBHUszoI( zNl%|u93=&z6Si1bnEpg=@x?7JoNrYcOi7Z)QBgs>8h=1KQBjh6a(Zk1L#;QgX!J}E zEqXQQ;apw9E1_ltGDgo8xANE>dZmxa_=yZ{TOXDc1U*cl4VdQ}yP?#>Lk;uS2S3%? zz6ZWmre1?Q#S@poY0=dGpzJNfqKeusU=$UQl15Ubq@`Ps?uH=;>F#b75CH+np}T9O z8>D0Ck{r6b8@_`+@B2OPzwbNOkw}(65j~`pf>v_G- z85ioxD=8zvS?fOze+ZPGTy7JO__}5)H7n-e8@zLOKJ}i&t{NG%YdLljmB{}k|IN}! zJHNJKX8-M4{y`t;rTo*d;nT4s@eK{b*n0-D#Zephy_KOlYMgl9<#*Z3*YL~Dx!bid zx= z_*V3O*2^zj3rIh6kQCBp7Du{$5SwC-&pmM#4Rt*V9Moeq1C#{X4D;PHy(8ac9n^D% zBV-cyR~#IRi*Q~j;&bX;$rNp6^n}e|e=wO%%TpZixfR+2g9=*lEe zW&wXNPRo>6#NH?1{@P_>EL0=hw4L9{5Yb1?w!hk8`sNgU=yYH0NL+YuON^}_eiAJ{ zPw6Xuah65VwXTrDH-ao^2N%G^#4Nk(?fS6b6>X=Omgx}4jO5wL+1#vT!|0W8s6yGD z8EBP^GjO|1DR4G=p{N}oH9(hnP~WJ+6k*0c$)Vhccylf4{;v8A1+DnL({v%!&5!#D zeChW2;l|cgbz{jgGS7^)Ke~nD`h&H^O zEKfi(+R}7mxK3DYkQ%C)@3iACF@I{-Ur;U;HK+LJL3MBSX*aVSp#4j_}nCQI|>*Dec( zi7ZKfnNM@_VQUxtNX{eX*|JpyG=i%sa*3AoA10IB`_1f1+dfa3Pkx~}X9AtF0b;+x zQ|L=U+2YV%+GMI1weR>Vt9Em!!VlHXN9eddH55l+dop(V=buK0&i*28qU>=cU#do# z1@XCef~!a-iR~}Hb+t=Dh(H#R#CU|C>f||>7Ab=IB~&wWum0Etu1tC(n7!}K~^)=85I243Xf&|!HJcWIS8lgttGn4e1i*~lSCRya9`}^@>-iOu48R;x&e|~p# z{AO({k|kVu)wwUyx$?#qO2U`1hXGc#)~LDnOQbr$j|I$4X7Z~}GzfNsRp;nk7pB>B z?&k{TOgk%zT@TdAqQi<_)G;bjVIBNxy0pAg#~8hq*zBXf^BBF+bWmm3Z?-?cWpQ6} zQ1Uo=f{>4Try>S9H_f{CJY%m~Iph18B9NH9`MNrBQ87laYa+5fC?ImHZP;?HU>vKt zP1CB6JIdI^^4wzVJ9Dy|yy%Vi1GknrDC*zI4HWY>aD{!0vbR$%VUi(`HmyV}DGNe& z7$V|AEACcRM!6JwZD)6XyhUHGwD}5bmewdNaBQZBVgjX@^a)}r=oB>DTULFEw+ zQH#a0`u^HoWo;q}+}-l~lp+3uKif~In$akhdNi+aJSPR(bsqHBj2uOT??b_Qc5Lxv zaeB|Q9K-l-7}jEz7yXeMR#)GMa~DhCWr*K;>vC2q52?DUVoFZ&M-0PFVtxsXt&OMU ziCW|$CXwJ)@fDG-8E4E3DJR_X;)pA9!*JpZ{?iijAyhSxV7`^%d_ zs|$m8A8)_p@~bHCT>8=JtG>)?+Y8Sxf?OO{SFg&7G>(*}u2cAa^}~H%``mrk=c9U| z>zGUYYpL}#L-lmePu5$LaLf})oh+#1cm3(Z(9PO)zFj%TSB}397JtsDTrf3d0(7V` zbT_glV`~yz#v`y!Xz%z9^*fL+6zEP*x}zF-`zuAMI% zFxlnV+$W#o*QA~5DX}(ygph6voX$b0qZqn+PS^N1GUaOA>fXpdsk^AvpMAPW&&K)4 z@7$NK;WX7_Nn~}`@o}*o@_hv=-r9(&9T;m5=S1J@m~I|zFkMqvU%Cet#2Yd1tcgYy z^QU}Otj@a=3ROixzOD%^589t))!CO_z1E`lDthRvnwMLA=Or7vQI_I5ci~#RjCUCE zYfR2W(YF3UXIL+PB>aI1T$g9po8vFQ*6_-NbuYoYJOs?3`)3ogx>qR?2?+{g=Nh_M zFX4*KZv<$;wJe1xOU2#%R>?{3D=4g-+zq!qNTuyYYmcu7k2>cJKf1r047!oS&1vDX ze_{Km^fIj%#h%<6EjRrQX3oB^K)YmIB-)w!qa?g8iPCF3*?=?6F{tXoOfQa2~IDJM?3w|w&#@_~KlD+JdI zO5Z=MyNU@k0&hk)Qufqg!4TXCX!|Jja=Y!`t~?ub7)frXC_*zohk$W*XKG7^yP|-? znR@t;Rzm0iRvLT|j#VH@Berg*P)$H=lG z4f({TM3ZJDQA&m%rl{xaA-}yZJmNO(wHI6`RQ*vNhv7oSpfUN=dfMZUq^mJjcgAwd z8yOX^jit!3*ys>(vtRhwm4$_0J`m2#XAch<17~C%01_hhj5OW4x`FchMz0ChI-RwC z`o+B?Y^tTrD|c;JYZ%AU;zQtZZL-0H8Wu{)j7(h6TNkHpgSKy)yO~;QFQ~&gFqspo z*@#-)JuAKYeqr!Lz=eS+LG6cjkmTZC%|b3@!RJCRPa&oGayiuFWIfpF2j_DF<}GZN zDP*~$_9OmTyoPt(!=94Jvue3EP^JKZ6m>yEJbG+8pS?0W>B1KOzU~ZHV5JCLmx_Dv9!ckaXJ{eHPfb-6MEINvtm09PrjTQp zoQ~k1`O2G<`m2kU310!#7zY8zTF;^P1MTfrsYZ;VtQpm_${X>#Tmgg)NOsl8jvFO- z6_!N?{`HhBd^4bH1${m)9#iSKDT;l3$^L-2U+|B%BB<18OQp^^hpVcoF?frHazfC? zPt${5_IcyHO@c27kC+NMr}*7Tqy?xk>NSj&P2T2Uc{&Wbm(`CJWwL0;!da)rb$RJ$ zt<#&dyk$iDZ>akjOtZQV?ea0@*`+E<8*5iM-6k~pkvs7n)b`Tf%fbmuOIQ*M8$lDL zdNSiP45f)oPAn$dJo7Pqath8PsVar)`WxaEV8h9*{6Otb`P=({h`He4p^O#0^=a7_ zsm7ACxle%A)md=OR#zjKX{T-pykrnk;T>348!Iax?N}tnS^r(McE=gXDjRL|6k{~7 zT1L`LQ|Ma81r9AYOv!q%)XnADw>G| zrx;puWqIyd8$}u-R+oMKnNX!iC(z5W&WZKSwFc_pJgvWkN0~OQ)hDu4N8!H$D){l; zv~*2Z$(eIOz(qt>zw(top4U9zZRqvBdVTzW(4n)->kVi3tnCA#B6#(T>L5d|y&(UF z1$)4@q%hhjhd}5@KKjCQoGT8ZNxQN!D|H~*9`v5ysB%#X2ze@zz@j+aU^h=zKH*vyK#~2Du14A>IyuVc`H~ z^`!f@O-p+75kzE)>ramaePgHYozOdCGo>r(jaKrWvL?8@{IeW+*_vDCZm4MbE_cc?F?OI=%Q zNYF>>N^@k*jlfk=UOH2awpT7z#s{v)jDhD58WDy>BOa^x)-OVj&&;X0M*RQZY_Id{#5 zXru=I80*R#=k`I(%7Qyozl{u;HNNC4xQ+5+w7pQ`kIjWmJRGT%JR>osomETQB#NBN z=T(>Z`U2Dv;m!Ur%klS867U}3U-)>vjX-&H$9tv?e8O>y)K3r0eKAUBJtSUkt7R?h z2tRBWe{sJPY>Ks_)HP~^&$Q8SpAiJb%HoJrkGGT@XLGO>W~la@u+U;LFO=}+In-(< z_wt)*PZ{VYk;e6DzF^|d7DB5;zPyW+w$U2Do?NX^=1SqByp7Y`qD0F83?6UM#)?>i zqoN|3Z!~6WZ9q~WRdX{GfUXQlX zKoZv@S&}cw1r}XCe-opu%v#CcC?P&Rt$Po_IhvEIG-X2_>PQ>G(PH*5yC{7R5=Fv zr5^;cWv8~~$UiS^U7WhHZcNjmC&R#$A3)T+A^#>Tv!Ut~}Lh^5|YvPvnNdact zs!NGEnJZ@bRI)(#H}0PEo4S%;$g^_Zd1hCVV;l^jsR#ICw?-m!C_3WiS!-nc3!%k< zIkp)G+W9lIqfA~wBLV%GQ3BmEdzWn)0q9eKOuk;a*Jt0Irm9cXe~ypbo6R1)o-{x(V^w->v)jym<8} z{^G!!pCR^Lx7=p0#ewb=h{N#3AmWJfJxAaaAEfFv7re^I(n1Om1~CPKZ^{*{Q{^4C zRLh)weWo$A(l2L3b+XR~+k1nvg1My>G_YT!8WQDW0}Pv`h?^$D|!3L%d~h&E=nXrGHSF!5@q^Fay2h8als4`t3O zU6E16ztHX|(!9=aZPt>#Wzu+tWgsiQ;e_Wig2T4;u_r2iu}tM`1vE=g^5)d2B4gg# z&75N!PO!JNbv3T4IP$xA7Fn($ zT9Q_Hw)d$>lMs$ik<7?6PH5ytUVYa$Gw_NgIT&3&Y-;v)0;I1_);M2bHWUyL0E4h_ zr;=G{o$j_)WYJ@OfBafN+?%ODcMW#9Y7N~r%Y?KHe|g*uE0r}1Ab=F9gLPIU41Jp> zvU^%>mXS*poOSueCW)8B=%jV3&(;i2qoQr<^P#%-3sb8_q%zcj+Kl*e9Ugv9R=&)n zpI#UHdsAip66Rn6=k09Qdr@O!s`+oWy*m@IutawA#ZS%s;e}&T7);sw#0oZtzhz$$ z`2$bT_i7E|wBDZ}=;iw9(-yU`b->fvifkmslcx>t5x^!AYOU9Zy%N45Bl*Mi`(=ux766DCpCZ$R zPQq7b$MWt4e6~M3H5R=+joLe+`ph**&a%(ImD?St=%BGPrhw@X=EV1A_nzq}<7(PC z0B30yR{F~8re9Ws_wHg3%%WL=Ei5Q4CzpLyr`O=xSo+>#G+R=z^k#CY6TXz^E}lfh z{n*reyG`zIxj(v$z=awjB2QV=p^8u$GsYyHnTiMLG`H#&d+E)0aikH{3PZBemY0s@ zyG*QvV+h5_O#yNVT^sQ=uICCpjWoCxVi&H;VQr5=x}84!V4(au$NKHw1TDoqrYCiq z`VShztI_9Sm*|SW)aDOMh~*3nGRg_G)dBf1;KkC%P^cM`vP{XmWadr@G)fo;aLSfX zsH!@eZSm zAga*O&^=q8N-|XK99TgDS!X#4yWYx#0Ua6+0L}%flfVwdz2NOMk}2NET z>wD02;Y@gAbEkozwO@F=qp=(_FMElp3QPo=vL%PUqY1_%PmmmMZc0_f#d)oscGP=* zZDHXY{ZY1>%AvV(PJsT*H0Gm~5JrZS4>~_TXG>sYWsUsv92n)PCa;SkXmj6=jGoP| z)TQA7g2xF&5fm9Hf^^1rv-;dnMbPOhBX)hUe|O{|3!XG5?OQKGo7;dcyF}$!FApK6 zQko#{RHC=l@tqIpXsh(N#KY}iaOczaP0~%6X^RxM>jgN*$+HM$nK3v=hzWGgsr;ny zcks&=l^BrxTP`~2_l3qoaUk%!a?g7Q6Igw~YrYJ)lbNjb!N)3nWE~|wT0Ja(xW6t|Irr%qxbXn)9WoHQlQXy{*GBYCQv3J2ng-{t*o zxWq+r-6bLD+Zcc10;ZoW(*Nl+TQU`d2Zw}P?GP~HbRMlDoNaGUJZ@$(GBVf4Fcwu+ z)uA*Ya#B)KLP8#gG4bR8UT04GPS%}AfS$?4ohBTE4sDbdgiKGQ=j2c4$QoOb}nE=zk%l2 zjE+Tbc4m=oZ@<+#gUHHaEAwjk`uy-s z%5Zf2>s+7s0T`F-x0IBCPxsd1qVSkw=2IpeU>BEqg@cm?6M!d|r1ibC5;{{&$RQ(E zNJ}glm5Bc3xPmSM;j~g-2qpdXHl!lGRN(8j3mwt)i{*@W)nB@75b_y_G63}?kJV&x zAS%Jk%nZ2BF)(+t+Gdtnr&?|&#wfED-pH=OtCpmT228p2nuE8BEq$#+{|i)^m`;X) zDmVXPRZ#_XgysV;W^nNHr2pogBv^ZNi94A^9_o%?oY3ecYcuR~cAD)Oko5rPqI7A| zkZ-0-D-l8pQc~$!*ARVQl$S3vA(h^@mq&n+#|~D;lSDp~0Q{R|z;9swd6r~E>1{hG z7X2K+<*^lmjWSX?T4%iz&PYOsL!G)pCt|_C`J-@q2IBP>A&3iUsQ=-W2*>71p0)kN z*{d5YVcr5;>Chn-P{?7ar}62cGu1FcC5AlmM&uto1PC~ohT>WMyVm352>}ZezGPJN z;UDH==6ZK{U{>_0l1k$;f{Qu|JTnXiU07ZEre*Gu1^`)13wyDzfom`xGMl|7Fb-DC z0Dzh$>~%^nH11oTEC9hKV*}eN<1ofZ|^3aU)uXw3zg}d=~bzxs;gVdP3C|EOVU}T z<8FOl?D+ofN=;&q2VY_ro7WeWXi#_CB9BlV=c#PM#t!r89eY zan27SCIN)u@y5Hy`U1jZqZ207xiH{wKfmz*KeZXcNKFa+ z*B7ydm`xj(b!*Oiu#GdeJlzIiP>{bVzxnVknU^td7gHXt^mZH z0H5Qro9-%`e+cHC+DpdBPnYnXi>iQS(6pnDqe9#VNE%KTAwqV*hEEFobNc+ZkB8aA zH;tR4Y$_VI>7H~f?CFqBlNVQj$u6v~67%Fggf4fHt(45bpSlVxvH`La$520fKbQQ& zpa3L4y?1?=b_Vbge8sBG#$_pnX4=Ot03vf7g%(^r1u1C@4~v9XsW3E-KIgr8BohML z*oR}#);+rkfnDrtLc%_>L!TWz!1@5-*8OjId1(2EKtAA5w@w$__01asi3KF;-n=YU zl%c71dGs7%(BYJc;?-3xjsN$KQ@IgFva#RAcjcAIF)^{RaS%w%7%YTs0W@a+uxT9l z9w3wcog}~%n3~9BNsNiJY{4B2r{UnT(%t@Tso)rI)=|AlY{*F&`+(U%!KA4#WjbCx^vFY@_pr zwaduE#W5G88Xmnnf{pz%;<|kgf-!b~(GmnDoF>&%9}lgic1O=E;X!6~*zu@i9pJW@ z%v|*DM9?ZKI@WkZw5N^s>)hp(6+j7-*7{=}4J6xpC@li!zQbLWBg^WNi*fMdx*9Wo z;;xqRbcAG65v7IA`*Y*yPyXhs$>3#R%z&!v>BrSSl2jT$=v66Io&NmTI$@U)ZY%Vj zD)#TfLs%>uqZD6YX55+UT1-hH@OjHp4od-yKCXm7s4{A873KXGP_nRYtkkRy_g!j? zuJv`~Fbzrp$_TR_1v2WvbHkd7ml-YEVRd+<&#i&0=?e^be|V|;VQ zL!>Fj)x3v8lkwN*bCcX!Ds;#G++Bf=>d~fiyAatKq%t zXz9YM(UZE#AvES4&R->G$Yo`w1woXJdh0Fksh8aZ;Z~!6FiGSVMmU68e~rwDG+eUA zGzF?#3kx0fhews!#E`25Uho(YTu)1xkMKOD^v1;}IT)c*t}pKhH%_1ole8Y;_T zFAinLX-12Hjc&{%o@QQnj7+#|YJk=H+MJR!*5dTEznggWf{Flw0nsNB^G>`E-e?A<3lrj``uJ|l`KnwESa!$64WAGJbyr0*fk#5^j zIv|6Qr%y0?<~XCIi1qx8pbR|jgQ(pzef6XjdW~m$8kKa`+KzJFVJ-{x>5a6TTpqw9 zLm#-1L*H6L8U&qUZ*)IYHY6qRLbqT&9u{q7Ih0|V38Z7?`s9?9D6B+PyJEL&UKy{6 zM0|41JuCpb6b4EY!~yN*IgsI}-+h&V0OmGFFS$7ilp(-Q(a)??)@jS*si=r4Nom4a zei&XOZa+Oh>=~677}g#_zrdFLo8PYKz)6*t;F&f9_fbElt66lhG3fcpWRp`tSBp_z z0;!BTT`gke=jqRFB;U+?P1AzgKx0Zm+HM@%#>Te%4sbNkRcmdGw?lUOb_stje+VLj z%*mMF;e`VckNeNRW*vIz84w@XK8}Kv;Ub{{G1sfCW5~|c*7El;gVKtcT=P4AqV2Qw zpMphPxoY>wQAw}LKamiZa+zlj74kR~C)zX3VtyMUTM>@f@_SGF(5OVV%ONPjyL`0$ zWvEdSgN$Q%M5nP}KqrS56nHD(qdjeIbN&nk^UV#uoyS{>C3q$4s?>P$$6eIc4g`V^ z$O1w>Ln;Pn8J67z?*lF?>}pyh^(l77IEPbmrUE>=C@a?o`1mc8* zMNyhmsw-*4M(Y_EqGJ$Z{bO>2c+hm+-=|?>3AsD&$X%P6aGS! zlJz^J`9^$CyM!b)_qt1SB`IT>1pT`BE@pan;Y|^(P>a_Q|1Qh-=9K{yg2DJ<@2}$v z>%DCEFG%$#S{b|= zN=3Wcr9E$5wVhk;{Q`)}NaR0Md&r$1*Z8X*27gSyUky1vnQ6N1b?a83+D%%ZrC4o0 z7{a-(+`lzPJ|Oj3xL=DsBBmLpy=qU9Trtx^RWz5nhb3W>@Yl1ar+Ic;sMU{*YOW2( z3m&mW47rVNPy-U>5mZI~;;9{yGpn@f0mmne$gu0H2i+z=gyjdnAZA6q=^ z%ZC{U@F-fzBaO(*u6NC^U);q=>r^(shKHegbMu&uZ;TwVGVIz>=YHq+cfE4sYrgH> zU%rzQ(LhGh1LT5c;@%kP!QTJ1I zWVbTCbKrjYULgRyC;zHN!#LFHlcC|_MQn@yxX30o{uXX)O}J5i^I z=j5_(-q$%2zqeNeS|{i7Q^YI}*g||0>C}ozkK_JGIc1RzmS$OW8ueZJszm!{NuX1| zo<7|y@5uKzZmT@H`#~k)qnEr#E|xPqB$$4+8j>wKN5Uvi73CT?m_;h30A}_15LPcu z)##@7Hj>a~TgocRb^ZsRbO3GT!mS6+O(NmzGyC`gc-k|?aa z-#gq3T+><@e{c*T2=i0oEJ!J83RD|aFytMbPBq@Z8;vi#dREY6W_cyM%VWG-Y1?q# zv0#G5{o$?O%v1)RUAuZ?!Q?GR75nx~coTQU5><$hio~qGVCrdo(GV{B@Koc?enS!7 zWQh(z?r=2|@!O+c#f@qgP_F>2@!J?9172Ju2O_75si}jthD+0}hNn24*!&eU4aaZD zw@wDBxCHjU^4RJ=pZ~!6UWv6p6PHQN;h6&A%m56biqh9?mE#JgqbefgtbU8gvh={U z0p`2-jJ8$6!!VSu1DcT2;nZ5^<(1alr^m>8W%@GT@`Z9}aGLkKFwH7fJr^bO`#OL9 ztCkJUD|Fg5M#QHm7VWYDXuH%jHC#+r8{cOx>%5X?NoP zARQg;gd((XOlYBVlue)dp>sj|eA-B?^s+tyo!Li;vC`jly4zQV${}E~ zlZw%kEuI2fE{}=fKX*Z%-r))lJ`GJX&iZW@{e1nbrh*rTqo}u(;&Z4WCz-*2=@1K8 z3nOX@yheX9&83wtbWQ@yTuczZt?{W7w5B!p+ zwm?^A*TK?I-#w{5@y^YV+oYOJTA>07k};8)Xx|wp@N4~}KsEEu;>bkCZX|Ex%Db_{ zl@R-%O=gp;@@^>*TeJmY=&e;@LR}6btCtX4&azC>&CoB<-D+PnC?X}{(+8K8^~3fX zL=tzaiR`#LDk^GKR(efu3g?~vA|O9X>vEOW0jqG+j%{TU*7cs{PseLTv>3IchBGU~dd=Or)Pq=1fzF+z7*8KQBmXci* zZh|8y`$7&y@TWIN+n>!K%n$teY~Jb7F(0xvpvM`D$2Xkb(V1rhN|uJAD$Hw#Lt^6D z>vl$otXI85;I!0Xr~8`Kh^sCFfZXLB;-oN@vp4|9tKB0w6hqvAg1xr<5!dY@mB zIiZGk_NN90_y}Ncfx%?0>+q^xu;Hb+mIp~j#xYjM(ww#O{&OXrHYJWT1B1fil!Y>Z z7FPG6*IM`UyB*MG0dv*?^|KWh^%u4737s}qZ@0Z|Kg_cV-U_==@}V)&KJ&H4tv11g z!ff@j(=@beC^~^jyq1E%_i4dn&06bjpm!IrJg7@Rx}e@Xew{~Gblp1uF&R@-#SRXb z<0T+~3aBfLM!u*N8XH_FIaRj$e8LgxM4`WHs<=53Ag@pQ>(oaJLhy7vo%Qw!J-Yol z(W@$Is_@3`VUUUYb}H$v2P9>hwEQS}jel^mEkfQn2s#s!oZ`o=ALsIBThr-5wP+A9 zI&mV|P2)CGUGJL8GF{SIYb>l9@=P_4zY_3)2?>wua+>c zofx|o0rxL=Pren;4$Ky%pA8Jp&9p{YFH}Zy^$i}pyjr$vX0`A1I6Y%zK5i)AMcPfH zkhZwLqI9@rQi0*9oq6ScjcnSHeXUbXh8uKRl)o%rb*>m){lDuha&=IMJN%#p@+u|m zGPJg`zIY4?1wmy^}Mzb?i8kd6Hd? z`$Ji{0;T>%D8u{KH0@ZGbGu%$#ZOtsu{Gl}83+FJUdtyr61)`fA?D)j_ zq70{n`!t?QX$}|Hbs!gNW^nXSHFtGahp{mk;Y6~LHfr(CFLeC)nfhI7fiXv$k&0Ds zHi|-uJ0fTz$+9Gk=HIdBQKz2!qyQlzwv5$xkvOp#C|l~8kXSet;8I;}%^}hq9%}{y zNJ6ish1?qs{CN4i-zv`6DLd&RGPT&8(@Ju%T_FkCpF)c71f^KR_z*a7Pybb-#gkbp zXKxVF@w=ynLR@xgze&>jNG_(TaRq$fcex-~=#ZxI;CUm0$RY5LWi-s}vvOhtN2hFF zU?L8)pCpvd=|sYB+6O!+=Iz|zsKn>YgdwW*2xL!wYyz|&%K8l6-+vu%Khr+{|E~Z0 zAH(_o=JSl+KuYn+E!A}`mHx`Yhl`xF$Stny9;`mX3}Kreav-)fwQnd5Wg9eJz$9T; zsR&hH_3OW`BeXaJMv6d9;Nb?A>w8fZ6%7py1r``g%0r7+PqQvYZ8Bz*xq_NmB2{HUx`V%K- z050dPf9z%|uIGig5F-Nw0(gp0TTARaPT;#HI=^NKg?Mw9jE0MO0_2G{_G5Q(JC2yIpAVy(m6$XQ4LiVeV$%~^IuASzuWh=9kb+_iB(K2IPIqG6-rtSn6z)_qzYa3%l= zH7QG}?t%5G)hsoryZ#d+bN!sPi~)^~MAHlQf(^Vs*OWCVb`~z(ht74TTXVMhxp!a@ zW#tGm_H@dfeiY@b2CVB2gGh(w1lxE1eg}d}x?9M3CEIBwSMsecs^`{RQDBucY8hj- zPC}*qRwvAmf1w0>x;IN2oK+maCf`ZLtZYTdRY5o?Tlj;CspIQFGT}y+t*fO`;}bRc z6uz^ZBfI;WF$A!kfMeD=pe4*%_{R%FIE)9dcE$CW+|`(DT_ebbZLG-#B-rGLjkaZX zu0&-5zd4CU%TO0P_z+LgqS^^lh7YUKKkaD=&7;IyGACn(o2}xTRy>OM*3{zas&QOS zAS)b!h>e}y>7mZ>^r!qh$7p6~7h8|q#Z`i_as?7bDyjO`O(Fm|BW{c@Tai2pTe#ih zhq3t`zbjP8{9OpYjdI;WJ{(2db_h{FGS(n|3ygJ%Aey-7((>~nkDN+nMqqAoqg(KQ z{qFa}U8LfTY42eOZ&ys7bY9@~vGRhN$}pJ&qSk5Qn`LWgVhL*{aUnK2x!-li(f-9l zhDp}sx3s1ykPBALNP@p0$}L!Mzb~`>tvlA=u}=h+83+GtU8NkjPr=t$v&(c9A7OgRD9hGs4?rm!@Hn#n{*Rj|{aTEJ>e=lT4;?2fuwoX3(-P)G9o35a*2-_-VNUB0Q zxtorwOeSONG4XgC?4FmIm1N68_R(l1e{;H0+4^r2KX;29;11-XX$_ zX_3#o0!+n&+(Ao?9J(q1@dv1PSD1)8^+DhD#{2MFhj|UHju}&nJD293noPY=!XYP5 zi%WiUF0QI`e-g3%mTP;-;~IX7FvoSu5*2C@RA%PH8dS9qpdU)bKu+{^LwWt2b_$9L zVQIX(-WEPml0Rr*Zo#aYt^#q4DaK4OuPM}mhHCJvR3ZxSNdKHadD2EV+;JU9x7wCd zIP^j4;lpP}y|!fzqn)Oh4$_SbpFWNsHGjv>eGb?oHcXv+Q)kt6&zq0NpEkJm(d(I? zb#texXbcVf4)S&HPfkv@4hpNCyw`68o2j_zLl4^-N%Fq29IP;y8c}=6I)O9mFUp}L z@fMUU>Ye4FPS%{JYbs;#%0E93_g&yS(8JJ2HPEIs3^*l?oVh>S0*m}wM-bo`p6NVE z(8(Ojsx~cj6$`~?ukZ-2ccm*+WVvgR?rT&#Isui-5|A)9ocv1(3AlzaizAM+(9+T- zdG3YgW)Ja4BOI)Ccm#M#a@f>hUT7qvGKJ36&+j}Rh}XlhGCK%ZW5C@I$@>Os#{bvl zA3%CDxT3O>;|?@*t5FY>kj9V`$o0U17KBtlVuAB9CL_#SG8sHe?X+zH`1elW45n-J zkJt!aoK}DMV${J~Uvth!CCB?On;91H(bl$eQTek(&s42~=oLW0(7yb|v6gCZCgh5@ z!=CM*O$|j5aP;u7&TJT0J4>U4el20T@ys>q_Pn!2er%F6U`b=XoU4#>ZFqMF{#VX~ z!|5*zIsB3B{OsQ`L4fWr`S|gUbcX+?8$VKsfb0KPS(E>~W1ZD+aD9$kLw|N?sAl#N zkVO^Cnu`~C|J&OEu9SMxrYz#g{%M?(QRr7iJ)szn(3q&Xr~c4~u_!KZz0Gg#{}6l4 z9nl<}oII3~$nPfE&d!0P-E^#1;PcKL!xf#o{?4ait1p zpA9>&t*wo~#>dslv;_g)hv#&ek!0E5Cmj(5)J5S9#8icDq|_;={}_IYh?s#||04$S z%3sAllP%-l{eH}1^4-P=sNLv5osvj=9}LfTzc{|52UI6nxN2^3)FNf+m`85$=(R8urO z>@hke$iq9;lvrV9!Q)q%paBSOcsum^LUuEd<#DwC4Q9GSQChP(ern*yc|)z5=1stB zqL*YS`rqdwgeCgY)yvM}4>{XF%Zv%|MyT^@d4j+%*UFD)SP8D-!EpH^Hs315@YHupW|d4mI(7*Rsi>jfd>tKAn*(8HMxFcDvhPD*Ww)XhF^U zKAm?YUu;!JDwsl3S>Oaqg%=g*cjvH7h!9O%0;hj?BdQY=WaJe~}G4Q|C#Q<=vSidnood(1cQ ztSU>I |eCzAli)+tB|i3*Q4{m28oNx{%KhZ*UQ3z41HF7ajoEa*+v_GhMwY(Mrm zyT92{^&q2)&wIIsD{q%Qrkk4U`cC0Ws~XH8->$%@bq_tAOL zxjjjDnojCt;$&B|+$(onqt=(~nX@f`y44?A=E1(L zVX8g@Ol`bV@TEWQ8(x&iAQgk+%+B0*;Da^4L9!8q=M3z zQDsKYkMy$%$!$+^g?JP5r&IWK%Yb}4OO#8MN?+-xNBQ;+5mc%CZk9f(WZ<2mFRH~{ zNiFrhC9iI~{R4^!AvEMT{xtPbIIq0d^mH+{C0v}_N#caC06@fBea!B?R->bn+#hb zw<1}eb(FsignS=kN7dWc_|X_t@l7ZGsLDm$-)9xeRqwSVAUszmcw{62*COk%mus1p zD0;n%xjJh~JRtCzDgRDTuk(Xk2;TNJXEEt%S<^YQDg8~Tg)vaHlvhg{U$CQiAgbgm z006d zcfLV(I%=sThm?v#1Qqol6oW(l-fgF$^6>WelT*jv2(HqUr-1xndRyDbKiS{)uyhfi z21IpWQYWYv+9ftYERUgd2)sDtGIFzhXC(WDR z4TIwL_(s|u?k|MaauN~}f`X8AO2j)oMz&A%tbQf7(_rFo^Rvn9HJVG7%b2I8u8}hh z-isHTQU{%xR@ksFXmxB}5^L|GZTC4jGnm0$`L{{h2fevmG2zzA4i$lP&01N<`1Rz} z#XGax1Jq)3*3?Hw0!f&*^?RUZKCO&9LVuMWYJT_~ve|+&jvQvlTnY>jpL=jZl}`jiaJ0sMcu76Ce-L=5`yW^bk`CW(NQuEce5NT2s_5J$kS z|NV!1q!^+8II?@!o(;vpB-dx})smnn|JQ zE5xm<&PI{m&|nj&FO39HKH^{7{#M_5@i!AnMY_o9z!AC8bKF~3VuXaDlQ#Hg9dIb& zaNT(g#>oysBjPcW6d4ccZGVC8d(nv@3%ILUsP07q?Hs9krwF~P;fv% zM7lxgMp{~>yE~6vFhI})0Qr_;9UG3^Pdw4~#i9{U?{w-_HX z>!y!65v^-bgb#j6zBbDkRAPL)sdmC?polt&oKj$@(~l<(S!;g&RCw_p)}@?h&sFPJ zKQWr;b{USI-Nnune}4YFhX1?%v&>xCW`=Ux^2#tNgd~fE05WpDMpP8>iWUx;9`BAxPJV+5yo?&I97gt12TbDqhTac{|*G*V^bXVtk z>YnUF%*Gsg9qheTM2DCXT9{O)++U%#lP5acXLz%Mb4&>!&v-33%I8MEurP z4yOo=%7ZieHsSVsmF`J@_%5S9i1}_Q4<2S6>bwe2Ul!Q$^z5PzUOI91bwf`%!&yir za>lT2wJ!wL-ORkMKXZn#HwnUYw+K_w*|>?52`T?yf~@0K^I9~MR#4FRnljc!vs zv{ylYyKVgXzgWUtcX1HryAmP*u(hFNN~#;nQK^>Ukai)(&ud@t%L_oZ?r2HR^B321Jt&tPcw)0-C%q%(qC1)0>WY)61vC(Svc9ky z?=j_;OjLVN{4jNrvqt4;Yk6XA{r~}tWI`&%QM3L*@3ZJ-B+p#j7QnO?2mZJO%j31y z8?YhFspj0zSs!#X556i@bD8;4dSPl_e;5IgDV|ABwExY;*wJIZZZ$tXQx-7MY8;>~ zNpcH@yDL6W0PCfF{0;#eH=tLshLKr_WuKLthxe6%hD}L+n!srJ z6a8)l7E!jK&1eHJ*amHH;`VTTz$iAKaei)5;eRY>(#ivQXFO$&zd)7Hh z8{EkeVr}`;q$yjmMeg$-JR`4XzD_0Il6z>mdeL=WR-u2#OJbGFb@M}EmCs5A!{IPU zw>zbpSN1=uUwMGG3%{3@-2y(`vmu28XDhZzG3v|OvI2A)ni~T|i;)l;FIt(VK&Opz zry&p3g>WufWIgL3^ZW6@2xvX}iIe7?v8dS4iZGV)bs0#}JcSA7*#cA`2vBQo#vksh zA6cs3KMXZIZ~Ck)`NoClMqF6Oif&m&X(E**o1wB)EzA8t3|b`^0ra0S!6T}@x>}=q z4RQa`ThUYk7@%eSn*36ylsl$cDy>zk@PcH|5C|LY+92a-D9I^C1^t4dBrjZoeA!F* zXv?aA@=Zd)T!4wnI4?cgvZ^eoY~{@7R+HIcU|!x9Y;D%J3mTsrTM+U%^Dn7&}q7oL`A+;;syoqK%8H zYztgH6Ci|_Kdmz+i_Vwo1_6XNZt*ZM$}o{17@cVQ?W&pJHwLhlgdH{)*S{Mrz^jap z(1V9!9l49QY`&}V5c?T?lfe6HlYkQ7U@a~AJ=kU)Gsh~T>)mOP}lB!JY8(}S`WXKnd_?q{l|FW{RO->qdc)q zG{va|o#wCQQ$L~?g*Q{A&P4^6J7%>d`-TG#`IVb$b!|7vSn&oHihZf_Cx ztJ?#zab|OZDA}!CZmP`n2P(A)^g@~SY#j{$kqimQ@HYh9zQ%-ixj#hF0;+x8BoBy-!Y(G!XAl}7V`G@lHX*#(^Bui4f%YFo1vByW@KWAz` z9>Sx$j`^sb09$mh*&x}DaL=R@7xXLPxh~y{+^7XcxR;)kO9Ks(qB9EIUVrnw%iJ&Y zo=r2oQI&*}WDd>DLqHg6aO0sUdIb?Zz*p*+vnw~VLdTEC*R;@<)D)*Kle=ns3S=T2b7WI zPU|^^rv7c}1dc*V6bdqHgZLSeXVfcPih{t9(jHy^`3CbFiRnRlch%m64@S3>7WGZa z*RU=2Tdy6P^YQi$Hkk}wzdP@M7R045%N$9eLVCJfzdU$jje?a(>%2dxvTyG={^QLt zB6{v*L@-;MLzC` zoBBouhaH93bpnfu5qJV8HW3ap@1|{!mk&{g#qf}GdA&}7s&K0uYzH4sxfLg#6$42> zs(NdKdHj>YMPL@0C7M{DOoTn*yz4L7SP77gWpA89$^un%e=OpPelY~i-Sxt|Ba1gj zXa{Qv6&9)=Y%#prRsU;%gX4HiM8>VBR|^ds>5r}4A=YMl)Eymv@9VAE@b2#JjM%(9 zf#fAiv+g>+6-*rr#?*Y1z%&4WK{Jhk{2ixb z6qi+yRZ3G3_8jFRoJ;SjI2P-wzyiKM;nF z9b~{P;EwCi_WkMyeb_uz_mAd?6L)2w)Vsl^mVS)7!qng4+6USONs{zH29591)paE$ zmC>3JS=_T`I6ZfjjQcIj4?rVL-0R(b+{8ejuKOfi&+_oPx}~M=1yH9jy(n29Phe}` z0M)R2s4C0vDAYAVVTDJdC##kmXK$4s0?gL(CM{^jfwZ|~EK<&!5>qUuq^MQ039TME3Yw3$Kcg>AJtVUa#>x=bYs=yl%Ydh}h1>tk%69 zng=}$R#WwAnxe5HmPEM~z9?aq7k^xobpMiYFRwiP&cHa2?f9&DLY5N~)dn@|{V@{n zEq4>8!IDP12i=1KggJj-veo2iM(535U)^_0^+c?!x^He_v0~63qErXN0P@$( z1A<^AHJtn9)6Ap|sjhCx;KiFbgmnzB3ju@nziY67ez@i71g-IKsP>@Nzjbu4Jx!mH z?h|%{`8o2A*&Y8d@#XfE!6fPB59^F`Vzuks(E`P}YnG$uIa7iIIXIz|*Kz?MO`T)> zO`>3f5iyPCh7%`#1y9MQ9wYQYJ8wBzeS+CxiZ-_TQB(`kn{&@rKsy#s5o9{|tf8xB^18`OwU3@J2z?zTsVU*{bL0zUDzt(D+hW?qkv-DU*&ThDZd;u&??Ti)P$yR- zq`KuM0BR&#k4%a0c5AgZB7y3T)^&rt#`#$^Fq?sNHOkY#QCmLe^6xPV00FPz&)lQW zeZ4Mt(o#;fABe=VM}9Yski8jm-k8gJwow&kQ{Kz`T)vMjo8V{V0RfIx>WT7tU^c<4 z;%$P!PS>}N7M9o4#4zB%xZHe_-*1o*?MS)(PALnzS(V$9lMJMg1v#HKGuJ)gZ&ALup!018Ulik&`vH9Mf?ZrWb`-#3c^c(Yi_UYT?J zidEDzL3V`|kH!KGA5!OHZm_vdmcM+QC>v$5W>KwVPQe#<-amYsrhk>M_;K?Gm%67( zJwnExDCXP-s?03Fp^Cj(TX96V#f%xQ z)K+XxTE<>HQoClSuo9}&vzPr&Be1~)+KdciQtAbD%#3WPzfJ^8MxIq+@4KtKx}u`G zqNe&g_CP6IT&rnzVfojV!Y^DKikV1@FGXf*_3@);lXB z6aDXW8TY=@TP~bEXF|qBSQ%*x8|^5XJln$)CUc^Au5wD-y0!> z*DetWlhHF(bR4 zpZ#Efcbue&=Vw>ST2QdVPm_X%ipjV)`LreBm4W?Je-G3CVH-i%gH%FKR0dH%-M!k-MUa8peJ@S1v=QNFd{Rp zK(4bBBlLO3I&9$$jvLpaM1LKwr4=$GopaImswx30?P%DW=@A;P$mA^mW?#ddW^l^&4(pYKEO53^zFnSfp zWvWa4%_QeOIG5jRMAADQIspm1YA0{TO59M*?wrL};IfS!_GbHb<{y@WBE+Q*D!-pB z0`paAMLMgUfpXNZ{#~6?5Mc6PbCG0g8;|IR95rWmuIDeW-tLBO_$J+*ogL+dn^vbp`!t$ii0OoP zznR1vqWp44U`wK&ufue1-284J*FZAvcU$udG2xwsLtDe8b;HQ@=aJuNI^Cy>ogSc) z_-zdx%r1|XlHwl()Qsw+4EYUJ=lKUZbOgMz&b#Q^@QmkR7PTEBOx~ojEs&(F|G3G` zVHUglWCc5(gHt)rTT)Fe;6$9mx(HGFWq49AkOWPH;{zYTvEH{UPt&^laLI$y&b76* zRoALSbGQ5{ZapWoNhP9eexD!hVn+ z$LCWA#-!(L(QZ8SA$p*5Rq<}jo&XFRVfuBs-wamUW`iCQ`}P0B2o<9RHS5LTl^sQceWeDL!`SG-czr?@#;$$^ zT&5f9r;Td7UHAG||Ndlmdf-7B`**FPfG7QK;}6ETs!2hMSEGYwDLZdass*PjDxE4R z=bhfO*eqmmzJh>}?*^7TfX(1XFz1iBMOPdulYlg$=|KWagVk9Y2Kimk@e$#no?VRE zQKseEJXa zvBkkxo4(4Uz)%ASHhC@q$ZyLr;nNF8D|1FCJ=<+^4QWV=yL9L2X&FpZIWL1IhP}l9t%RTFvOCX9 z|90miCLZqR2~Qsgrv$lNs9LXN>xq~{i1SbXw4S0-;%{~64${|6N!{McI`z?8vrd2L z8(0k?tni7iZcu(E&35poV*KR<`!hxbmlx{#CY1(rnA1Sq1Xf-UNX+eiLEJS$jHuI` zI#r<%-tWzP-~BUk#?QtAHj1js&`g;Sr4==b-y@zng)C~?dG@TU*PuUWEx9SEh838+ zjnNk7H|=1eZtJ?YB3@3HsTeA>Uiy9 z&7T^0vHpHh$1&PnNt6Csa%#sC8c|<%C;7y^*C1OlZllsN*$G&_{VWy^hj&* z`d<|+`>=lk1FZCGmw~40<&hE4-W@GEMU~XtJwdlAZd%bmk`fQMnOpcj!N&-;vxqCz zTG}6D$u8EyZKPWfFdEN0kRH|D7p=|0$SUagldt14+NHQWXU~a~V=L!-^4rRb@5w%w zWyy8tN1qJeFTGK-Oj>>t>GWEe%%(sxShCZ;17TphwHOx{8$9(Ccm!CpJ0_9=Y{hwu zBJ54OPWYMKZ@q+d)Su7q9pgGCoV5;kk;CFP>y?S>n2Nd(9&b|9iWqq5vr~q-V?ieO z9$Nntr`=e5`E|5NtJE?!+ULiH%uICn<7Z~}lpW?D8j5z+Zi`f#jYWDIU{EPmzq)!v zx{G#}SCr1961C(&WxBFEgQP#Y*!RL^CCBC!0 z_Gkh#dr)Z~f9zTws<9_-JJ5kC-*DK$)`aiJtf^gM9f@b=Qc-7tg~+V3gFRniw9r)H z$F#jO*HuzWqP#ezDS@0tJ9zI)T{&M!405l{n4m9 z=2dPm7)(c{6W4Rz07*Qoxj1RCoD$R-;Z4(MN^=J}kJPaqlyXL=rsffOpGns8$gF1Z z^31(nIy#dxD|cF9F@Q4DZm3p?9%qd5nT*)Q1L(hCnQ+_;#T1xwh_Kya8TcIc%6g^f zw%IRG&{JKs-9(kyUd2lOUdS)XzYMc7IuR@FUSKrHHXnwB9vltzlTQbcAE6!(p{9!5vY57de|-a9Z+&$AR^nk_K*~9` z;FO^qEh7AM>6d?Kmn+}bg%(P0hVt}RXA?#QwO{)26s>@ZOw@B|`K46_UCUo*T(o zp&44a_y~*3f%tqYkFQ0L>etgFUyM#?2O^`IipgrPSfz$I!<^+-6qHI(N6ukG^!ON8 z(BnmMUQtDqVs7yhK^5q+W^V*LQ|grK2c5oiCF_w@IQy#6lb?NitA+(TkN8e~pai8* z3UyBRxrY-AeT6x^DdKmywc1kYEx+Pb!qv&^oocG|Jr@^KD57xN^(Kv4K{oa1r$fPl z_hdT*y7y%~s4>TgB?e#$yy#=K!0wSdTEFVF%+FVLN0df%*}E3ANWm~0>Co@Bg6veJ zTXydcQ*S#!S;v>f239BY>U`8t=-N?rEGiv7@MihJM9hL1J6%;TYib2?*WhAi(L9L? zks8z=CmQUfjn7p7;84vvbTX%fvO=#}?6m7jM>z{I(+=np(U5Z}QVj0b^|)y2+=LVJ zNrm!D?NuAsx~(o#5n7^8Qk#n=PRH$iRP2DK!W?*^uOFezuU4h^bs1>QD;KtD!Uknb z5q~V?JQxDr?E2!eH3epUG8UH|>yZCsn!nj~_K!F!y&UP_W`#4Yo*5KS8^pPa+4?sq zu=mUTT45B+Kc$oP&dZ6;tP*TdozuPec2>@#!K=9W_Q5p|%(f!ce&X(jz)7dak2LK* z&SxN)8&}!V5BQp98OHiRJX&T!$6xg$IU9PH)WxVc#X1L#5F_nz$(zd#q)A6TrQSQr z6^wm?+Xre6BkopKK1KV&zL-IwSXFlJ4lpf}2ai>@WMpK5Q&V;5PQ!|lZQTbXQm`~3 zv!AlZ2DXVwNds$JbqDf;1O5CSoi;Qebi{#cU+0@lYwqo(I>535ZAv}%pW5sEDLKm* zzJOdO6)B~6m(stFwrg^^-mnGQL1Cf6r5;xaIV`MHFo3*b!oxWl;taZDI&Cp)X%JMl z%P53J5l>Z4JDYv{f^x@p?tqel8TyoBv`Y2bLl3cy0s!ypO3ykpE;tNEVVowrI|T&59th-qX#ux7N3d8aGVP z>J|hLp{ca~-h10{^FhJHUQVzJl*fx(Y?H2{)#kn1>)LheN0>uUxyMLW*GinydSEZ9 zA{UJlRAQ;dzf$ytUbiQ6y#P_hqR)VuDfif{J6{`$x`o^Ou)H%NJd8RvhiAi0*@+GS zMzWE~#X`&og=S)3CqoFUMFzrX=7Lyir$7@utUir{*})fjUsTAj48Za+85$wf2>1m)VKU;=X2uy^LgGEXj6<4ErTE zna&VD?;9bg5)|{qTxrajX?*0B_`~NbQa?1Czrtd?NS~qGD2{N6l&I&@C1dk3^Y4-8 z^R$Vvt>Y4*W8&7Q)*9xjwf*MCS7%n}O%xo$^7LuiyzYLRl14=xOvBul*KK#oNNZ0f zYG2%1ac^Y|@ZUNX`}@x58-{KgsXR^RlzRKQ(l9OfhkWVAa#0Wfeu;ZhH(f~(Q0KZ= z4warP6C=T5twkB9BGF`P){glEl8nIm}nNE-A+f0Jb70$ByYaLhZO~G0`Q# zZzp|3BVNTOk~}je9K($^Nuf4*C_52rAw`}6x2pe)P`#{7d+-3`r_=V2CeYKOSpCm$ z;^1`4OQR>N6=G_t_D40av9S$qRS^UP2DVP?a_osM;N!2t){jB~pfelr6byVIdqfY) z+%VkJw}T(V*Kdz7t6R^Jth5erkoV6 z#JnP+X~9-VohjXwpIs=(LTfiKQ)_S)*I=P_x)tp3>Jy%Ty57>DG*P?U?#>x(s9gn@ z55$+Kup48C%e0BtH@r+pPQOICqV$M&Sbz~p+#@5XU(tHR<%}oI9;uzjXNkNUb&Dz@ zYjoGYUw#Dq9IxAOi9(wRLJ zbY$~>mCU!GDydH%Xs z0@PO+()Derf?a5SRK1U)eLl&YTFZ)*g^vB6=sxwmZll6e-PWTwGUCQG9D1=#jvHSL zbYqm?*Ym!k5_7}hRIm|jn0bs@RT{RjLjZ~8o{BIRV=+*Egw6@bi=@iQ7iQfg;xO;; ztxXK+Pcgy$Z9A6P*3$9hgFU!xK{Jl^WOzwZ!cxj~!$eIkDzfj`;!r%+GyddFWk%8V zRCXiiLHcyug7D|**@G7PHg-f_K>|Ku##E-6f0dYPZY-X_sS6oD{o!oFa74 zIxIv>b9mn%yNG{$cF4akuNueHs@WcA6(nt6S2E09y}Br`eJ(wPca;qjPN!#7cT^x1 zDFF?f>nESxN?K~?@E^UvnQvfG=|J*@ZyX!$Iad9OA+kzO}XF7bZ zc;1lwMMh{=qqd#0oP?LFN zF6mK9ohd4PTRpGQ)jn)RJZmez?Xu~q({X?gOt@nfXXzpQ_$ck&l2uVcm0gT$rXZhn zS0-Z9_NWxkaaN)hW6IMcS>F%Pipn~-pG?;1c7Woch`q73Jj;shy-A;0A`I z#-6LQ4J!(kGC}4;niL>|MBJ*QsP{iPRt5Aea*;-b!7~Ls&Pj_KED!f zuTKpkae2JEzN4k2pd>evVVfhzs|i~+0zs9OhNDyzqhpIfP8-J_ z#NE@ZnSGB1`OVu`7og%!t3r}&vZI|QpII}0sX+&3G7vxeCrncBMlUpVlb1y*?W5*fasw(?0_J;&9-{VoXVU98WPil3OkSAV;#gqN3BW;OPKeP%S@%m8e!=Ct1m;nq3-z4bAW;U!LJN?G&q+3&h%E{f*A zdDNf^Mad2YPVNIA(7A@~O_h5u3M$r;wJfPY97fPeuN7;P%0MU<>_F2ZZ?~gS+p3tq zEL^37)G@hFD?Ec(y|29N^yK51DH=O|Xv$}QhqyWg%W>htB%FYnJo6@i@pZVHk6Fr` ztq3K$xzU(K&#nQsa%ktmert_-?~a=cDt|hKf@7Hhv?nHlTXhnhD?FtiR(Diiu{q{C z)%0YgQPz|lHc0Zhz2*s2xvt4{s~OG|NH9`?ie|L+HPPa3PJM8$x|Ux@0vO7o+wiVr z4L&hJ7Gvouvza#_F_ZoonJ>D|=;}YX)X}@++Lp2|Ul6lq`K=wR8g*s(7n$$3_cY6f zX4SMeKb{X5PTA2*Yiy!xa6TiK3nU?_vy04R!ebLP%i?Y~?PJ{0rQSp3qj4=wjIbp5 zyRm_!YZF81ojPS13)Tx@SH9p`8-mM5-*kYTP!FYBp~;`(@tv=&x3*Uz`cxFhUT}xv z-E%sN5#GV75j?W#X{R%Id&%Lqt>RT=v8B4-_+0tEGTs1pe;pWk>_))XqqIW>I zWO<|w{PwM%+ow-y+Q4W3+RXGo)9%w)-=@rIE9JRM-C>;X9oDlNqp>VHF_@B)U2ze# zn_nilEmyi&jr%G~fPO7K&E{ZH*+(tJu~4xFdTTt@pgmO~{HSFA0ttS@^D||rx{rI2 zgM;%PYROsi`XXbEgxYj+V}pOEEh4I~Hx(YiPVJCH6r?xxE>X)QF66I^F*zRG)^oHTgr zlO1+bj%m$#q1k6sG9j7ub>|LUg`+Ad6sM`D5-ew*dObqfIp8{Z+9gtyy{>Ku5eGNO z(&0Rh!pyl;it^UQjiIDVwa7@aI%YTbBAFF8_^#FE3{AjJgR};(mGdjj0}Kj%8lFC9 z_RqNshjV&So3J zzPV>?J}G>`bNXaLV7W1qM%`Q_>Qa2Jmr*v)?Vpp-qfiEduCc|nmFYm7=QAF*A3J*Q z>PfuF5~F%YHBf9+U&Uc9Wg<6lcw$WV++W<|^67rSD7p_x@yf);{PJ7co5Pk?CLN+= zIe}xGy>(jQQjbrsU&|iCF>n2AaDY!S|DWHCvcS+SN*DGSSSC5)a%sg0D1X!H@V9GtVos@0gNnfPsg0@T9l!2 z3CfUuQhoR`eaNlNNu?OCrpTIYa$tSN6hO$ARnu_R*146b8c9I#eDKR;dZEi9Iu;p` z`IK9{9n?QnbNbD|rD&(2>ZiS-p67|b!U2Uss!vSK{rN#SmuU5cWBvhO=ms*CfCi77 zt;4Rg9@4&~>8NG1q`{$@strMCzQJy>XcMW=JK%XmIAw*w`xt9;^bIl}QA!W?btvvm z;IPbgdWT5I8Rnl({1bU<;S8E`?f6MmUZCmtac!L%KQ`C(Y-dJzgCCvJs4iWY_$Mc^ z?khh!S_@2X6j;!`TQGgw`W}={_+WvYy`~PfY%b|PRk7iT7H4q5X_dtVMQjfW>WoWE z)gdmr@}06*4u{pWrdd4O-a~~igJXMEjpzGHTa#VJKu=%G6{J!#n%J#k&Sy&ov(6Dt ziPow3qoc`s>L*7YGt*)5ry#beK$LGoX#!Bwo zx}VTwCdnR0f7FWUaS~GN92F~SmQR*>tK{}*H+ zUNG4qFOaPQRy+L1s1j*_Zyfo*XK0Ozz@rq zmad8*{(I{W`~d3{(f{0mT+un-c^EP2f&{D0=~~Fmv!nEk41>Jm>yYxldP*R?1y~m# zs3iSQLFNC*UHzX62C^0~mVYedzkK=4!mT4E)fLZaqz~RroH-L;7de{sjAW2iR#I9C z_V@P(=9>(3HxSEdYO)-V1cHls*l1}**MTs2p9#39I^aYtrm`}ZeRDu^pijRGs`x!h z)?xFukn|UoQOO-$T@l2yQdh+UWuyhm;y5bjyPqFaQaAaiJfO<38sU8qt#yTy0ln!_ z5^nU!qS6S&rd5?Q-7ult`{`(Fc&QDgdIo9C-g2w58c##GAg6P7^#DHRnzBcL>qBWe zDQ(S#p146*E4$`qMk%1hK%xeA4otC$@vQ|qS&NHH@K^FsD0mXYu4_dQJ-aHEW@7+6 zt+bPUuXn(&=`n3W3VT$ZWn)FYGeTg0m0~wvY;j6Iv@Pf>o7LsC8$$d&CQ@-F0PFy* zIr`Mv66W9oexBmgHsXsL0G@cVISRh_Ln9@+VMhIrcglhGDLWnau7_9)2C!RA71b$#!I z%b-zo?A0b3*Ie(do}q4-t|WD=q54nwCseDIRBmKI?Uy*C=gi&vPMaLZ3MyTO9K$|G z`-qRsQTp8JzCl5OTJh{NYwP0`Z~S4+ZXud2dMG}p-S^JYqV7q;8FiZR=|$3x^`jA) zkI+KE(y+9{(g(J^*JnUSU*4b+eg(`&B&H-Vs=wtoM?p7yMT&prRjZl^fvt4H(%=)& zT09nhLGbwq4gGS+(fE%)VD&`kfs1IB@|U>S!lW`GrQ#Pfl0y+%KgR^65B@QjrbGM= zAV`6@LX`V`oZlBc!>c#5`7Wc$YP>LxUqOiI9j~;IpO=8Pf9h_dK%xDm8Ne?>CNXr_ zD<+Ac_{`}qAID_^C@?R|YXuP$B*3)_B=()a&0binbkC zeP#=y`HaxF5~F+XW+1t2WaBg4Hbu0wUA>l+_o_`oRx6JJ#CDrtMQh@>3{gQoDlzGa z28!=3h_0ZeN|TXQ5b|YqU+Ptw?JGcdN;r)5cid2k)pAktE@19j zc|dL;nOh{RGjLDDseH;oD#nWz=`e&9dZU_+m1gbj;~4tGu|$6vk7l)w4nBI1#HoZ- z5Wn^Zow32C{53xrq^jT#%_hpIvbRwqEUc-?nEz)MNDNX=0CO8InsC{JK71(JTg$AB zq7Wz`Wji`ft=~o|adSKGOJo#P^~J9O9Gazjv%+Yhtd<$*a`RQc`ejOm7PH^aN$Oe$ zIV5l4w6Qc5-B_?-USLmYq!v3dr$(9oS{WC6@gqGG40qhm1u%(qex3Df)B@_tT(pYR zp=54Lqez3PTm&k8tyTbr|HfZ>G-o1v*@&JZwE}(|WT)4pu(LF=Fpm!2-l;aW&n4#V zrDm{dIPSAxWo4dVmT}~M%=e6Oi2H+R-Jpt@n&q!^qSgEwGY=e>fC%*GtgC_$UUvt< zdUMae$<{YA_WN!8m-fz663Jcc$~uIf)~HXECbe=XjPjFh2b54AM@CEk)ZQEHcU!;+F}L;c5@5*vhYBVsU?h>q*_N2v4RuP4 zl~1d^;`VA7$&3^Krefh&6;l77yuiPO5x{Z&|L_*y0=em!Y?O<{qNG?hYa(1SHLb2* zXTWR<@Bq9uK$}+tKjypw{6hUzR(Lg~J7^FXa`hv?P6~f&is((OSgI2OnZwWgad)Nl z&Gg=PQm?zZKqN;odwvaQQgH0<-d}#w&pzLnlk)C`PHeqI%knRRH5c0)Aa0Oo4N5%u zacq2Ejs(2G0B7$i!m_c%Wg=-NXwb0qvc`S};zH-kTCplY1cYD1wcQUpf#-zv?O`a< z1M0ynmo)7oT0y6-`3SFAUd!pdi<(47_ODzPLu%*mu(L*kRye0~p$xmtg^4pCIF+Wp zINE$Yb|EiRT7A>baD2=2dHaLGE5*vz4Ztx4l}b!&ork<~SO~*1yRbnvFep$zCL-!D z)mbO3hrzgH6Mr70Wqz{%@Oe;&R0emG`cc0}3wDO*N$Vt`Hq-Zv(dn=dgi1cKaWQsO zQ`)abHI{&nPc5W6H!R4T2z5_79Wdu842-UzPOH^2-;I%Vs7odz&wN4inb%R}fTFZB zgWjl4Da!rL4T!o*y}MWxNaEhw+x2hb1KTddJ32kFQ20_qa|l!q-29t?Wn$G9&3880`dLPvN* zZne;ZzAUFc;dipmkofv=2D2~$Ac}S!Xjmv1i-6UfE&%xNuvf$hZl+d`dq|N^O#f`I z*s70QS2{KB3#wN3tTZ!r6z*X>>BU}vLr9=|7n6|sX0=_4L__YBNj5e%LWX^!HjlfL zOQU*N>#0{+-LQM*|1&086hr~`zCR%@@ODC8O{THgNvevD2wLSWCgN{Eg{6Ntw2nhf z#>Y8)?MRIk;`w-0!?8sP027U|=PGvCu}_#Woy`!q{}f?Mwt#rf>{lX$1S0r#{LlzylnSo1~)FKL_B~w$Y^Vk%&=*I1a?+a04SoE|Ez}_&} zZBCke+}yajHMwqYoT&?&l}EsdHiOJNd8u?^$~B%hh3su4!`{6sOOx^HFldvS)-5y( zOh9!+U;FSaX|1Pn8Jk1Mrlv$8dyzv0tT?TxHvay(jM6HfbD(dhEk{#8e#Ppx+`S7a438HTath6n;}H zD(Qgh%goDYl5Xvm0C`GdQlK62KgVJpz!aL zoM`-=&FeNG1)BBF3{mH0B21s(yhyZe5nA&jv{Y`s*U{o_)v?d_(mySq^jkV%sE zJ6wez0Klmp+B9y{qJJ;{)^(^-z9Z#qZu181zwed92MeYU6lFG!DBbtpMsR?K9eJ1l zAss$#x#8k7px-+q0L~O$R@6&OO!^*n!dr`aDwmD;+XpsSjij4R%w;^8p)&n(P<3T0@6RnN6tw&fsEbCmBow1q{qtPOd2Y1m9~&Q5tMtH(`GWP$YqsMPe8)jg`KjK42*$V?$Abhn63d`4$54|<W)wS_8 zDVP`0&SY$GZ#gfZDrOqfyU$qSZ2dsoDDNBdm9j3u>Yz<;#`#!oS?BE8C-D~9J(JY} zm`66lsNn*WV8{=bOI|0g{3QH-sDQOw4BzNK-tE7e~=#lLe4>Z`MPn%k)--aDHQleJIx z4`EEd*!{#6`j`9HbWb&H15H~zU}orC#@nyL_8Up#-6zDKB|`xdk9%$6Z+i?t*g~Qx*`m3dhmJ6(l@JIpxdhHy z>tf*(_~*})m>3!J3!(~ppUxZWmrV|`OE)Na|26Vb4|jVy?xS4wkJis!jC{K>a-eTK z7_c)~s&T1oKG;scT`rnE&tSHh@9i!7Z^v zlKKSAXKHr4@oswuMHGswab_b@x{;~r!r{N}N=ixIAC$5r94@*wzDkR>%O|TDIZ!Ki zLXJ#WFllTSP?43Uz3z-Bdjc9_`S6>q2s98bsGyzhU{O)=0ZH38f>_g3-&7MUM2ACl zH8=CLKB&0R80j^WjQLYp%1-;N=|LhWfW=S((h=cjkQuM3HkorRbnZK#wTrlgYL%`qs}Q2G1=ad<)yYfF7Gdfqn$-^wxZm~ zQv;Qr`#+S9*!#w&HrSpOuiU}EbtH4Q=w_W;<12#{L<)#ePz~M_A{)}aXab6r?Tbfr zKy1zGA_}KE+fY%*yX8od&tE4o@xQlnkdmO2dHlQ(hh_8Q{q*^RB)2m9}1DiK4%L!$>(HCb?OmWApi@lMsN~ewyqv) z9F>I_8SdnVv~rHUTDLYqmiy3Zd}l1^8@6sH`F#50rkm@2%Rd_7Ck|zRJ1qx)aPx&L z=j4HLD&w7ilS!ikqQXD88`k;bq&h66DG0lcI`E9}`Ks8t@urz&Kdy}5W6r#%9*OM| zu2Vzh=T)pc1*rvJ=SL^3o1RO{3}r)-1I&>!*frkP_&-bEp9E~UO$7IV^QFrzhRQ8Z z$8xF(s?cB0;p4vzAetIQRwrH#Z-1$isHqDJV&Z=ad$wZ?dK9>aiN`sxQwxg@MC^+e zs7K2#5ig}?E}-<1A_-@Kv3sHlP1KSKB+sg9nY%6fI_!;C)P)sURIirD4_rTTzG`ML)l1l{e1GMCRd(f3O`TbM z)GFE$IS7J)$e>az2sFqtAR#JHYAK|m?2vSjC|Xtn1VTa_78Ow_OT{7(7DIqQKqRIt zfkAXskS!ocLJ}lkfIuP%Awagi;7rfyIWyC|dfuTV0`4Q3l`)u=V+!j62iQKLoYg zWpP4atd;p$0T$VCW9?#Lc7R~RQJqwUDMx{8X$d5xHiLbW{7K*CqGgx zwRe;|VAut4{ry{=dF=GJ9Lhwf-SB;2DG&g{zWOxY@DB+^;2{5tI{|T+Ia~fow)?nx|Noi8RPXrjc)}U}43Ac>0Y4Bi*Fvwg4r`YSvJG0cx3;Sv%>EBa zUA1=&I;!n#VNoB;>Egc3n~)+9h)){YWKVzz8wWqay_-Is$DI6}5F+fl1udmZf%+_- zCn|a2S9q?mw4Z>l%Oc=kkDK&U`Q--EP&Tz?d~+Y7&Lk;n{BM+>5(8T?(h($DP3uMG z1&-W%D)9ABfUI}JV;gj+Uc}Z4H5<=!Trrr=H)50W5bdy)7~U!|St@;w{Fh7t9dhNWT|f96^2ZA2>i9=X@}qfU@$ryFK*6hJ@~+@rv4Ae*2PRFV}yP5^0e zx{hAfCwkn`LrnPl`kTq@-+!c!HTec$?YIs>0cZ}GTTE*$2z}IO6E+^aN*HT0@y(zz zly~n_wGawXk3LG67XK_T{u?kUsgV-8aUuYnQ=Lw#*l)Z#$Eo`G#*;s0>H0))imD^2 zHkb_;F8rlGvmU@1u%jWJQ=vR&idJ-_@Wz zX=RdCo*Id9iUx)~oBXh|;LjuK4;#A`3#TUhvX-OdYV6|sLCitQ zGNvI02BaxNE{WlT*Rbj6$0A^=G6uIcn9pcPydw&4f0db0gIgUet#o@kDA9Ks@`uqq z54Md`!ly_qoAQHSIzw>M#J=~@qUUexzWry;44n$LwsyQ27Ofl++s^VkIlNS8v{8*i z*GbQFL&H_c;K6<2vpRL;xQdLuR8o{a9)tJuGBvz$3sm&$j!L8eb@OA$Y4 zw>h&6&-KQ_RcHT{2_*we+Yy8ceKs_-(W zL3Lt`Hkja@_+*Ul1Q?Vio6El63FVV)!j9%>N7P+Ca+W0Q7}xXYK1m#Di+pc8MHCHW zvvzE@+2|H8en-jiIm}z;8~AT}-P*+ac5I`w ztd0sfWlG5PJ*@|OoQU$mZEkE%jk$W#h@#xT*6X<+@7PBvJ}NrFdec`Rrum63kf`yT zSG%;FfND}sYM%j`LSXck$W2Kw)YQTpDC&Thy6?#_Q1LOcl3lvg_vUMk*@xGO-J#8< zG~A{;@5t=lxikrg8*;e;clE|5Bbu_(xQ)c`8twn-%xC~n&y|qZ9Q}ab7P-9b5_Uj5 zn4cpoZWQeDMuj;m+-s56!C3UZI1Vp;X<@*Ku8sXtx_WYqCQO52S00RCnab4B zN=YdT44aXK9;)x^3F$Vo%EaNNcN+%%Vb^*b)j(MO?%#Pkp4a+?q23>%2_1~#4SkDx zjv;5(t*3E@nK%@2962lcUV9IT!+`AfP2m4dQvpi6^cDL6BL+Dt)3wN~7?fx1XbLX+ w`Hk9|m@h&B3dsTFwpae@6JRpYom1`De*3l+`Mb(iV9B4(dHA@K&;F498)I^|IsgCw literal 0 HcmV?d00001 diff --git a/windows/security/identity-protection/hello-for-business/images/aadjCert/profile03.png b/windows/security/identity-protection/hello-for-business/images/aadjCert/profile03.png new file mode 100644 index 0000000000000000000000000000000000000000..91dc9f58bab5107e4db76398a710435e3253e962 GIT binary patch literal 39460 zcmc$`2UL^k*Ds2daTHNOQ4mm(s)B-mw4l;!=tzx7lN#v~0*oReT|hb^^bkT(s+538 z?=?WE(jk=42?+`3)tUdyeD|Dn&-&K7-@0psMP8CT&-3p3+rPa-u$HD0!|$xW)6vl} zs3^L5(EYB`fDqnN*LSWi))-lDC=UAG` zFCI%itzi7yho^3KAEh(~CLW&{{bMvLtB1H%kO#r#l~uuZ^VSJC;_$ZbXr6IhRRQhG z5YZB6?29)%B6Kh-X#e@pt5ASv@Pz=6{@s}5qxtz*AyH0QzcwuS4f@3U+M z|9S_ZLxA67KAj`vVGf`DjUn-(gP@gW>hp0%Xx%h#Ox;ltW3JB6Pw6o#urA)2VfwX2 z0Ja=^kRzWhtryTLz^uTKMy9OPZiA0>HmUwpqc=JXdL^wPm4BVVUd!;!il$)U6Yasr z`E}IhTo>6Indncyf3nXv2zG3|_n$Q@{9L!|l%+4B^87a-VMP6k)?1v&fQ;NX`oo6} zFWq9y`EF2u?D41nE^ALXR`$Y5*Y6_o*FCb<#P0X&s_pLEIK|j8vZV3Z)5W%FMw#xE zYO}fHs z+TmOnUFO&>@)$I%9lO3WtHLNl8mT!5#b6+X1x96iP5KTjLXd;jn9z0jkErDJ1XjCz zgGg*>BuW0K2J|4qj8L+liAnOiXlYNehw?+JnSy3jw<+7$-P~F)p~e1~3|1urqTPhw zSV37)O@Hs_hVDE!y%PKMsT)`wAN-CYHE?@TA01qaU-qK8sPCTbU}TqmiF_=YZiD-- zED|E%J?}TU9OR|x`?7nWr|8*sf0BnYmb5k69@sPGa>Nz2mp7<*D_Q?97338;^nE{- zEQU>2+z2|)4x8Dmw7;d}-~dsP0->?F%oahr5A;5epLon|=?cxpNIH1big2VBc55Qa z1b{8UsgAk>QO()+%Hq$m2<9Tcl-Lc5PLXp|Rqcfc`TEA?XL0Y6^v~kt^4?4(WT=|> z`%ie?da^`c0j^xJjTAIBU~1FMGsrjE|K4uM;qBTNxt?;xNKJp;Yx6G+5>|99U+UXG zwZ47Xay-Zpt)v?c7Ldrj?M9sQ*_x~wE?etMAq{pU?++##)NQ;?(rSC6@LQAOZR{zrR_Jcrpu8k<$s`7 zBwri@IU6@L4hTy2t4wK}KpDEVIW!FHkhI#Nyh4_0U<}7dyexbJ8QFZ7ignZ1wKZIf z()ar6M9yoLsVZDHb4wsPBV)E-=BAGL)j!;6+vFA8es|p@rbOCB=F6_5;V}MQY~Q>L z+Asni05$VBA*HVvjyNnVR_xnT64AF(*V+qgs{|2vvb?(l;83{zY*+1M3ls$eLd)c> zTD7c8K-j-@jaQ)>;oIhY5cYJ3vA6T;5=P?)}UNLU7BXJcob^IzRW4u~oW2 ztc6a9lK^*KxY89xRngBD(SRDJY8E(eT~x*~5>v!b_AXs{Rm%2T4tBd8`#tb2Ksmwr zxdK}(9zNHQRmS4)6bZ967i$_L>BY;<2}Pub3iQ#1+ZrarIH-B{%)lXe=q$q4v+;bI z2AtqHT3qXlD7YLOb+TV$R}v&MJc70~_u8~E_Z>UvF7ZzC2KyO~HTN=soMR8GPP@Qi z=CXB*v;Gu*!}JIxZDvtEwfU2xNfjr^e!*a8$JT?Ht*0TB8Q0_?J-yFf>k1tD)1n+^ly-lu`7o9!M ztiKgP<*JmevCOL_f06~=^PZlk*c{#x11Z!#&Jf>R9y!mhl@dj6Fd4jn^%&;h4M~{x z8xXL&zuvb?OsRZcH@(n*&}?lUz%*7-?m>88l*>IV`xWkk8U5@sy_0%bx2OUWnQT1p z+L&Vr?nQxDcWp)%%DUDLIG1e0b*VL+=)mdZO~KWXtjNLmZht%$=o>v=j&DSnu4I94pr&Y>RgIZXG6b6oMhLi3L)rCE#M2yZ{r83jX*s zHErhDqN;E(Iu3R$;x2w~A$h?=LI`)GSanOsJAE(K@DTGr;C^mcmW@98jI3R*5iWns zXHr#v*>|sviXeP;U;22YWfd&>e&?yM=*yM&NcD(0PJIEEt^|tun;y_TQv*kXl4lYWlx$W~weQYPBnkrNz;aY3gQq|-!)&$?<23#_QLGb!p~sysDV0CRq`O zV$xB;;`TLcA-6Q)#(s}AJjFl`MWXO<*VBIo@>VkbV!^(~x#8q{DR^?)u=(kI z`??%Z;XO-%Fe3RN48&&6Jr32HCG0>OO?ma~lr&DqbMoRahmQWc3mpP)r)GDn zkfxFwHA!OhiOG6y?Gm3)_LRc|+cIPbm3vUWvbtIxM8D;XZf6lLpL;j$z`D$v+7)-e zaGKhc)l!m-l4or28(CeAqt_^T)gmGz{dFFf|I)a*RCQe@X!j4%88;-29d|^U+6BzL3NGqK*2ltTIuN@un?h-S|{0lgOI$_&tA$SD{GV#C8+YG58y^ddJ6KzGmmxjrn3(3fJy?Z%@mDO`ZmVKp#SM-O$LA{NDiI{8F zChj;PTfDfj=s4qLGs5+?37BU&IgrI362-hAPwXx9W@Zfg<9T`YvsY{n?hS)RvFCfxCaKw|{|WL5c_0SrhTEyrT0ofBlPhw)EcF zSk4Rthp%7Zfd43WIXEAX!IyVkEj&SA`LjelyFI496c%1uvhLod<|Of#Yz3I-{XE|J zo<3Z)QWFim%kPag%c5=yc>FGQ8UsN}wkW^VDRFXg+7rhlW&73+-nhGu;c~9BBy@Sn zK6Gif99Wd5HXdf{+RAvW$cR7>mcu9nFAh)dSo`n?v$EkQ&S&f*+HUwi(fQ4Jxew7_wMvN-M$VBP{G8qPIFi2q=*;1QYl%e`Sn1z zN?<$t=9mdLuH@!^@ToEXS0&OuRf#fN&U=)Ufo8w&U4?$h5;PH-Q^?-U?T0Y0MhOTV z-(@y6^?8}k&Pb=DGyE3t;=25t4X<@2{{TM)Nt2gibkWWP@JMq3m9fm6((sS zNb^dFX<>hqUI^_#N5>yE%?n6P9DL&v5Y;cr7ZqQ{{S3;y zEYkY}%Wlx>{l$uL5jh-X^j0>M@D* z?vyVBp~80HPP&lXwqmL0>rszsMEG9MV|<{_Lc&BHrPS}sksWQsr5yjY@n7J}=I5NjsEt zy4N6+Kjk7z^+oR(6pWF(uWd8loU-_tK5fw#4|Bu`N4w=FgU`u8(UN<{gm810b@@m= zb0_qb*DcIW?cl+r)IloeVTh=HkKj?0NQd4%)A9_PSWOM*WEMyvVmDOb z$aP=NQ;Perq|zK-9H4LnE?Wo%=lPMx4WJui9<)vaUtJ@s)^G>$GY5`i?LK78*nEHtZ8%@bAu+Ry#d2r$Hj&cX<1Ba`x!N~M%+{KB z_MZvy+L_KnRd{Rz6al-TU7f9|0{+Au!UXp4In6*qgDNw-aFZy+4>|gw=F^=-gIKtQA_B#2P<|zoF zMQ1TvI9*k1?<80DuY!6+i9c_D7hrqRU-UHcN8a9_}aTdyOA`82vD+XEm$P z%q!rppx7UPS{3(AE@BJ@{bEK`FaW*KE+X&6zrM1Verv1uxa=3dP^m2=@0rn$sjFL;5}$amOG^YR3f|!sDw~mE zl%WNTp>j18#5Cao-V8aUo%SzhoqTqj;wG^lx(!`*f08l}vZpk{TDP|NVmbA!w(6Xn z2Xe#*^O1t&H1fiNOx@4gQcp(`fbdjA-Wk!3MMN$rmyI@G7_`_8`68JVdMVC$v%Y14 zy8TXy>nF4F=SH1zC5zbVUO|K`rCX8`xb-Ii$Bc{I?b4otos0)MKg!uXSF6%HW13ybFX$<ie93 zZ`rG)XI>noVvX9IZ5g|+|Ht2-UOFq&r5W<~rLx&Yyh_yHo1<5HNbZECiuG~oH|Io= zNng+R6;}K89X8jUL}Tn;npKEn*M^6N#6(5g)GZcNzILKFn4dFa8v0S7NQieOUogc&>d`syz$S!K}_8n#5)^E&y053@ifbfG^exrQA4fRfHEw`Fl z;&)cpp#?s}f@+tLdOnpsUH*DypQNS^2QA7=x=q^>U0y}hX>^S#yrjS^tV+n9kMNEc zpfC2!wf3X9ctC;3m?gXfI4bVT0HB~H*~ME!RsrP@ltOIHs=&CFf3YSw}T7k&dQ z-$>|3;NB#5y+P3wzV%eQwxna@C%eDH`OBDIMrGiegD;$!iODwX3-A+CmY-XF>ZB3) zJ7oa!qJp!8s|;2zKfQ+i+!V@EN8K9}jsZKvUE}5?s?QUj@BY&>aB zK}6&JE$R$MnAif5)q9rWJQJhAQhqp>HoSWUhM8;TErECiq_3^C-Za^W(5Q&K8#d;X zKXc^h+|A#DK*aU^YnA_lXZ(-3+}{f?>BGrwZ`WjvzM9$m5&f6{DsFDtjSH2Vi!EH! zpQ1J;7yrh`{+CZOUqjLkQ7d|{$RkcG0MFe)G!kN@8N~Jr<3*{D=9+KfPbE zpEUTqc;JXA)pNcMO3CE~`){`mWD0bFZOLHbSRre!P2Lx?J4%-GOAlhJt(tQ&S9P>` z2OdBED@Fy+#DvJzL4g&dW`7L(yAb>jXY^{3hTV@y(Aw>M`xM?M7m*)ilZfiWbYMyR*DqJ)~tJY50$+FyB4dNxge_g4~&q1RjRX*Jr)-Bd+Oa8;LgG z9b6HU9N;Lsc&FIq+;bo}p-U>$ZT1?I3#lQjOBk1<&*@yXur-egb+h5ykwK>RQx&kb zQj@~ik7k0XqP3$P^a?G!MT!x=_TZf=&7((NuQ9*JO<^6% zyhao$Rg@z32dg12;P-`~HB8m$^`rUO1!p_ZaG#5|(CT=_4~ilB5p0<7un^=Smdqzb zK&MOrndq@Bq25p_e+uW>l*vo$AL8QO(!kghKRw6p;X3jy)AdtweofjuPsWIy>`S}K z&2uMWcX~6*3X*QPEN!ikJZK?mXSS7 zd{?T-{Lsp}@#S!^rA>ah$=SSg{MqY%@TBte%vn>VZ4T@}qWE(1jC**E!-Rw#KC;F^ z=?S5u2n(x`*}BFMZ>2qYxOiWD2}rCvnH-I%Duk22*ft4yR8zUpQ-vrfej0Y%5c$+= zliwqzQ#AYbCck>2yu}|e9LD(#p+#l0#4{bq*4iBGWnLHdpDL2IHZ>9cVjZpyxC2_(IZe6>*0NjkdUDb3=wUwnNg-@Jt>i+)UuCOm=XIlZKg zH?)BEdmrp>-*HRMsdI&slVi#>G z`W-jgwZ%14>ar)WCC-#{KIh0j?4uRZ9^3JX=h!4?JbhU*IPW%C*WJ10`gYPW%VxRU z8(dNy0G%?ISzKo;q7ddicU$Wz$qa^k3m&T`qT5&Sv=2q*K4ba%6k!_TI*{H^eR;r- zTg}?J0V){n+wwnJ{a64sV2_%!$~7XU2jnH@U&z#g>%4_dZoBF2Z?#VV7mMz)OZUcqFZV=yPsn86 zip*nmSzA55oqaxu6M5y{reIN<1&R$>B}Lkc{j&UW=|eImS>r815EKZ?y)vj@k+a2c z1vul_Eerm&KhHSsH?vQiI6|&Z6#3D*VuEf$%>ZgyIN*yFUf9Kn@ zZ(A_RLhXK!1)Di>BEE?B#ow9>X3A5~_`KDG^3{*_b~ZsA8MkFOsI|0<6;)b4p+@aR zxUsW41yu+p*J#zQXOvhJPITu|?Dsr#8)^sfH5Pd?14R`7qP9>lm!dgnW`R4MsV=v! zH-q-1I-V_leV~MWaTV4FA3<}DR_`d5Y$%qo4~)DkO&D0E{n#}&oP3xG^KlEBn6AX) zE}asJUvnpzt(w3yCnBh127QE>X~A`9am>N_$0dOgGHP>DPk*;DrlZp;JZzlIQVMC$N`9caGdzA@>J!A!Bigtv3%JG1Ekpyf3pM z1;wC<6*G}am|{0Fi-9E0)OH^3=ThjgGE8oI%s~BjOX_ z|4#JAw4AMPtrC>F`xL~3(DOrU(uMW~2NE{vcaKJO>Gl4jBrkM{_x9UhODvIrQ*5Vw z%n(m$42c8-Y>MBFuW56PRLi{NI?7-z*=EdGpRZ{Kb_9ZR%2M)&wy30{S|!#nrJ{m+_1ZROqm zgqNY=y2x2po3;YqHpNMqP%v%L^DuJV9W_21vtJRW1ozq_$aJyqZG&knmo6cJfX}FK zOPBLD5O;w3<7Ke7%C|ZbD0qH&?T61CX=&}%1K1Vhc)GuEP<+ILF~em+@VLFXbDeH_ zb%!j>oahjj-vksy28%r*AsxcYSnj^ZHn*0$3bA$pz{;+uL`mB*<@fuLe)a5Br$nk znuSpaD?_rceL3HZ`nnaMS~L?wa}8{Fp~d$}Ty|WOpYVM$c~<{ITvaI8j3R)L4apYR z>sc@ko(0b5?_#+j4$oHX$~XE*!SnJ4NN}t708K8=qA5?x8jZPF&Gz$Gn2Wb}Xd8xCt>;uP3_cu@?XllcfcH!8 zTuvtXD7nt(vhjACd5loEHR4Bs=mr}roAes;4jNr=`R)wNV00J6RbOXCXGPdll}Dniz@qX$p3#X-?_Bmqp%&Vi`;ikDEw7PD`t=$`VHKXg;{D$ zBll}|VOGKU=a?1#LCWna&icjR70u1w^v9hsN2)0|r|xE6;`wZS`lh;^zec ze|QY$4hLXA#7VAC2I_Q`cq(hyI0CJqKJi6G14G(zUJUZA6u_Aq2%@W0^ncIcnIsdmR;s|zJ7o|Z=6-JIJxmIMEQNUnx>8`r)t*DX4~!TN;gCpsyO_5Z2US5 zZM&(mwzD29e+RG-=iMKK7*+ZGT56T?Vt7o8Q_|?sWa3!)Al{A*dH5+?)!@8c{&kr~ zeeFApx8>oi(vI}^qGRaY9bdmFlx3^EA1kkFh#coSvzD=_bT!~7xcc}$)yy{uyVwQD zs1)n}Bs*vEJkjj+^LVpDzdVwA;dTJhc`PjlwKkIF*WP|p02GcM=N1uQ(9iu17xU^V zutiqT75?9DLuJx=4voAjHTa=jSc`QNXixa$qs4ob)4{P%${(;4-yIYFAla?Yby=_G zp2;M^LQ`G1- zk(iaz5Xl)`*(eUR+krrL*vcW=RS*fqfIS1alzj^q$M3m4;mPs+TW8| zv%MtaQlX&{-TU@yw9*!7&dm$pHOr)`*=42+a=`+{Q3+jny4%F7VU?1LN?i#Bfc2cy z1d1(2bN_=>afoh#7g8oWr>@RozDQH7!dzN5-LEW(R%@i=wu30)^m|1tAJ+enRBfAV zeCtjSP_iGr)v=tveMUrbGNCcr$EXdE;?vwjWRj@$Td z5>G?B%CzMd1!Y4TmsH^W#}pH0y~bV-O!|e7hd)wt@4e(_`pE+k6qbSlFu`*zp!9Nn z?a{PvZuY>J!d3w_c0jrL8*olyW(H(TATs;Y^pR_$8F8)cHy>=OD8w&OU(-$@Z*2c2 zJ!YhP z$_5J|RN3YpwihDv;h{iWr|*kG2Eacqjt0giTiq4sL5sN>bxxGc-|e%wOT_W=vMe`r zcx{_6wYn98PF2793cg53_bn}s4`fyc!_RfC42iRc6eL4T(5%uG{=<02sXDjWJA}o~ z3Igtuk;H9Y(6Y~(daFy(!QAaDvXi%i!RG2Ab>ulQgMkTi-w?;^zKXDyLMJ!B_152z zP8J8@J?;U`z)tGxI3zs7sAEjw^C?@Dpg0J`2Ysu{Vi=cc`wA4*9mStR8B@h#}X*p<%SSiORU8%Uk5;HiJI}LDh&iZX zLi!TC{^D?znUS@79grp1&|#;DZ&$H*)O@k)2hF?Z_ZO;uq=%@u?zYX{x}z-bT?oPx zyL6u#R=B?{KD=(t6eX7PLT4Pu+cYN`0G(VB|7X1+BHl>8t^Kj~U)*pMALy7b`2WKF z{$H}ve}`1oAnu<02`eT5wt`MM=47VTFY5B=knrQA+gG`NF_B)Ufy@5e^?cWU0>dg1 z;OZmK8O63=P!j>z@*fXX?yJ84$z`vf176Hhd8;k_6Y;s*0#`RQE`_ATpIQ z%PGWJZrKu%*ml>XT;1Sw$gO{FPws*ciKfRuL;5 zgp{_cN6h=IQtPZI|J>7U>goV3v)Ve3*(bdpKmVlOPbys* z$zdwc5FRk`xGX0iz{7yfjr9&Bz58wXZ?VPjf$oh;F1OqP$z-pu07Iz8QJoG&Se`qJ zc?G@4+GslfSp`JKYcITq^IhW-F5kJMw8CAN@X$(KKhr3GsWfMFu<|T!GO(m-o+#sm zT9WJkTg*J#@FcVS1~wKy*Fz!MI=98{%C@_ZT2q7W^cP{3>sdNo3GHT{M$;r_d%H(! zdKXyD&^l3VvVDQVPGVOZc@c=iK|M5Y%AR@2I3ff5w`BPe*XiVHq+ zkp8Hp8T0c3SCOoDlv<{iZCjhNM*?B()oQ&{h`L6m$=b$(CC$E;f6Jx^6syWNm&-SA zw#|PP$$UAe)6AWxXG!cPSydy#X0`k!@HZLMFi z3uUbWgLD`!#J=9lkUmZK2k)hOr{&uIJjrXdk%@aF);D6h(orvO2bCpWcQtg z$fZK$1JnwX)VZ|??l66#p`kH=0vDmto7>SqcTGSE9khChjxJxhlrO_s#$Bb{`k`~E z7@r0%6-xb)>2b#`Zog*k@xRU~82!6|ToB{7J=~-EF5?{)_iHJec4Kk^kJgfCiK1hk z`3G}y)mC=q0#Z%Qx658_&9w=ip!?%u@D+tm!C*v3JO`%}!J#CRK~;AQv`VOwhYOsz z6c+ufWg*4FFPJ-b3v^lS6iNYk&b~{`hyznwTbq-kXw#X0OT^5KaMSAw-5)>CstzY_ z@O!oSmCaQo+wbnk5-GWumCSf#%%|P0G0s#<_$0A%*0$DWOx7K~7ZnM*f3_O5WLhzu zi*Lm%;uZ$!gK(pqreF1Kc_Wi{J@ri6JbVAqg`keJmR*8`<5K6EjSg?zCT_)s6p!K= z9Kq;Tg&WNjIFy9{uAFWYGSx3lXyKihG!YD~8g*#)!H5GOV<9BbD?Q&LZX#k;uj~DO zs*h(qhrZ>ax?IaFbO?J3nEI`pn9%Glxi~~V)ChI{YInd3&4b2rAE>8Fpzp7rQhdKk;ogUi*&Jp87}>3!lcI@73^+VXhQxhTrYd&k2c0fkc>&UJ%0@69(shc<|wq~(rv zM>Evc0J=ns$M@Chr-?ypwVn!3k1{ciNI}D3iWU-z8L`@|CRRHcoH4Y`vw@rg5IJRmGfxFI-F1P4v5>k*@I8s)O-yL`mjrFXJ+3ki9|0? z)nZ-zJ8h95@&;O<44*VVbyd&4uOaKTL-#xO|;JX*;bVz1<~tiXN{mRRCio+iPY9rJ8Xeong# z=%p@mdyY=Tr^Z=+@DYPq01@X@?bmUv*eSZlw~d*##aK>hVkzGq9I@SSlq8ta!m{!` zD6;)de%oUW;RRa^7Z}T=$2?VPy@}t0dTL(|Xlue@xgKUgPHxjmwC@@1j;E-K|1z`J zKgNB;GV8mU8mB^r0!#t^mizDZ&iT+kKO-A9w@th^czOE`zz~p)|Mv_8 z6q~|PFCSc0?Y>Tx|9j#8XKLFK0Ifmob-6_ztNfKOiL}xO(Sq&Of9K2`!_8$HPKndV zU;Sq*_9y&2o#;K*&5(NX-}xGL83~fHoU*l9jk%VV^)JK%G;PP;TwzPXy}PUW!f-y} zW@=w-xQ)@oZ5i<#)gDm;bW4lgx-eskWB&CuQB1-8m6zq&(u8C^RD9x^;oy5toxx0r zYB5Ujq0Fs2|5~6roXQDx1V#>Hfyf9$4LuZn~Dn$WpN`3RyN!> z4hDeP9k?)>|2MM*Z7Ai*iF-R*ua#Ok{=t$1C8W}|#~mo!)eQdq2Rii@6l(=IGdL4UT2GofWpH1S?sZT)aoI|}udF#9i5ui&@G zADtF$!^^#QN$Z>G6Jc$8b^UCzorx#F={h!I%Y^!Hypasr<4y6R|LmXBO4`vU27t>4 z^QC(WUcKKGdT6)Mar13W7XIO7SnCZjGq6ig9*6kOoFYqP(YwxWR@Z-^cR{9G&0cF7dT$%J2 zWcg36@&Ch?>KUY+?k{4At|^ipsyVKujSuNzivLtc?wrWI>vmMH%RV651}(B@gD_1+ z`tN+}5ijkW8r^Fk@OV{{4;I}R&8UONjIQy;{Uc8m_ub{G2`p-JqFWiey&gnZ^xGaN z;GG01!JiWUh2OI_?S}E)6N`TA6gM>!RJGN5c}XMhPU^o_VnwocA68APqsWyFhwdn% z5pJ`An>e}MUmaReTk*QXXJDvC3T94u$8BqEoyPZ%9Rjrzxx$O+y`r}`hVrNG*-=G= zsRR1#nTrVa?Hviqwoj;)v4LP2z>dCG&x^VCNeFPm=$Dw(`#)iuFw2s3jWg{nnMpW4 zWKHBfBO7Fb$E|63q}EEaYf@8WqSChhU6HwSIlk|+qvtM1_0`s*G0oRN-|^EI!}DyC za09u;sH(tiaWP1=Qb->LGNT7wrEybEzWj&}nd5kkv z*1oaq?D>_p_Yzz|e$?skwZ%a+yZIx+*2C8neJ?g| zKLP?v%gijnSW@RM8fp|0>+6EAH}a;f{w!vU;CUn4m>~$%j^eS}BL#sGiK+HS6jZnT zzernN@DRY-Hf7&#j9NE+F=?_p!X1P?+Es>sf81v(;@9}Oqo~?ng}QLhM7#(_$hiZ^ zT+|k&qIEE%+aub^DhY>s5H|UV$3(tf*XwlH3Sg7!_IL<|xK8D!bFJsy;Td*kL#k3F z!SLhl5degVZboU`tDAJ68U7**#dzH|CaF1MCmK=^GbStO@vxKgC^m|Gl&bmKRm}&w ze&*QL^0=_m+|RL?lNH5g_Cr+f)k_nxPD*A|pS5iBfQggsx4wHvGu8arnHJMs5#DI!dUGOnyz37wh?+jx3Hi)g?{6`F5rtJf0tVoCRZGFiu3(mNJ4 znPXMHwAK5##Cvzp#SlGjNE+trG#0rs>A&`2rloiZvLNam=Z=XOt$xo~?O+zP=BSG_ zcF!bOR_!;}HuJ2%i!x{5nH%Z0oAWHMsb=y)R>78rk>hvVl;TXqR|%-SMl9+iR?>Yv z-5;WX>AcB+bzL2__X#}EaiiYdK6kEqhBa19;|?7+z$GODjy}5y85Z|vrfkQtOi{-m zDdaKUKebW0*%m2Bt_4-bLk;Jz#(dHoG9XndgOd+uTX+$n0E3auyK|{cd2(p{-t)&l zO=rs!SLx9_j7vryJpQnqgRAwJZ*FixAb|duepg}PI4Ul2fB2%f5Po>578+&meel5n zH6-rwun0-swTK6g4&p|?Cq(+-QDF?c7}}X73y!VX{nO^Ur)W1Dkv)P%VTXW zFyMMHrd@^T!qH zXO1h8NtLnnbKfq9T*#57Y%aSV`MWmNHt(e|nXisikQ8HE2pUBZji{H4odft8uf-8V zkFpvEcMo=R_}az;weu~tD8OO5aT?dX4^HlaA5-sWLnXOT&SfpqTZK3cm@Z~Mg4dc@o=;U`i#lZE0@ z`RY1jV5Perco$mYcd6kq*FE57%3b5(xeGQ?;tu76bSk*o4HMXgM$9{-6(Hnbdu448OJ7on7?E%mMUl ztj67O=O|Nx{=yDngp?(lBkHOcfIXiRxv?c7Rh<+cE;=24q)V5j@Ta8m0uUHR4+4_@ z=S&@?2XWA!G9=VvM=3s726z1GK)6PQfGzx<^)m^alBifrBr)H<6X{PxwwMP;-($)+ zeRa8;d!fe6Z2Xba+&q(gQu0Ivu1hUv!gbAKcrC2`@m2^0DQLDd_l04in~1X`0BCD%<&k^JY1WD(x0 z?JdT%DJ7FZu!*Pf5Mx^~c-+Y&Teg zlrQmPC5Xx0SmsBy$F2nBtCCRZQJr+JFI+g@eEwGS%n_0_V%8X`#nn+A4kkmKH|j4j zZrc42DQa85aE(_hOq5zyKiLs2S3=ycsVBwnr@1wIl*6mf4h(;2HWbfYOLo3?lzM3$ z*T6aX!a#JNmUy~q9v4gbexxhso_E2c>~P?;mJT2U00E&T#D4dt%~!_NCEyMNl{6EO zU9?i^>z5+Hl2UE@JU(l!$)3wvdJp)Yb%cUpx3=)S*xOV4a<5pXe)-GOO%?iFezF{P zD`(!nq+onBb(@y7ZSF96T#C)cOa?wUXTQsVu9LQ}Cm_m?X}#D>-fxyMWruH1Dj)oY zTua&0y}srXr>^w`(;jwos5yqezfDLV9@i~kbx(0{PN-A$B6h!*0HPXceYJqhq{{#< z80^@&?>sl?;lz%ZK9(XvTY2WyGv82DtG0iT6E0G;3!=YN9ZI^Gry0N$#K2zh5~{Sp zec{wh44%^Z#Z62c<8QsDWS|f2JsS)@0htpudW6sj_6=WC;XMbvpU^!ZF)L}3I-!uT zqB+~FIuhy+c7b^`ZqiZ34&xr$+$zL%yec>{)6XAX<#a2D(Qg`evaUOm@c=5pZgXZ5NRZQz; z-bAVCw@LzL6}N3rAe(h(6TLEHPVv<+oGg7_MvME9^2?^K&6(Mo-VKDDVLgTQup@qNtcRAhOS6BxWEAtqaQg6ZpR#UZ$kZ>=E2dY?6ei zly)=RZfF44>PY2}a&2<*{(FchpyaSPb zFmj)eG;B2qmAqC;=4S+^7}n3FiO`@?ZKu|F6xY|IsSR^b=4j>-_p&3qx=8F$QwT-_#dS z`u%r%Vmx;6DvN2ne~SM)8MWKvW8Zx@A6hZ6xA>O4*LJ6ytmbU$u4!;0@7D7zsf&nlc6?>_Q- zk<$fML~`a@%9Z;++c}zMgdFYzuB~)`QJH*ij`rN`(7q>q8s}ovATW`A*WT1JaM`=X zsg;?;lU`74`$ku=tf1?*2AMNQgW6t;l18e~ZcOn4(bw1KOL($HFYjP>sJ}L7mb5%j z`+CbdD9k=rD0H&!?vE$6>#2sxGV*f{Y6t$m@eZa&%=@sePsON>zxeI%^ITb>x| z_MnP=+~mwm)*9`p33PItnA6c&w2W?7B13Ym5% z38^3}((GV+f~ti)GnToVqJ8vcua8fyB}rmC>YZ9rf7|e5d(H$URguCk&UNP-ZG}qd zWco6YrIR0b7HG86rSmZu!;bfznMLXyTZ#>X!GgvD+Gwk(FB6&QsJ>K@|C#yD9L!?NKF zZCrKihzgJWkr-LkvAil=iA-I(a#$yEHkJU*ZX)jJSVqwygXWn&?4`gC=NW^D@tx0 z(Hme4Uy~jU8Xl)~IZG6SdNkxDq|RNE9lkxL zuw5RZyJ9W3YOmqlUzsl;`x{ zLyr~~*1I4hJaH#g?}jtr0@--3 z2bPrqhTH?5D3>jUpG&9b+da5j+Td|KuHIjhMthXmoJM=Ls%ru)9NSk7}E6cG`sA6#(|a^884_#dl0 zGfJ5bRkjM9Y( zyjasS)SR~xV)bKUE*X(#RJ%#Tx8tfV9db2aeg-Deaa)<((ciW4wsO$&r7gyvBQ+N5 z1kT71z0FU@E+%d3F58f$Pe+-?ePT|)AoV>I&_>ZmqaSnbE~u`MdRUDV+%Qj$mvLGV zpRsIpXLQm}-&AlrbV_M-?s92x$l&0&oN%!eqkU5$kU4lLJ>g$DF6-T>@2I&KEeV>PoIeo`f;J$lS;*$3Fwo$<&|T#j4Pj#m@&^2_{1o(=vm6kziNtVeopzF$9xi zHKUZ_l|H_hN7K4m%Z=`|JH{#5EgNg)#zwkEVu_(a9p_YS_g@z>jde;NmD!bN_Yh79 zm0si%cAx>oLs%<@qTek`fC1pUQi5)P zU4n0s!f9UhZ|`0bFmS0_J?6N2blcI0eBy`~KN%BdJxAWtwpHnspUyq;#_!P1@8Yt2 zzDek6Z*Nsf zCFKNHm2)@1$JFmoSJV1?a2MtQ*(CecPX|)(F&0LGTfuR=93%Ja#td6?4_C^}B!%cO zNtnzMQ4w(bgl%57+MP}?xO4Vw@StLgUhm);!kH@n*JC{Dw6kC{B#(uTSsrp0+j>rl zmh@Ix&C_~B2Rdq(Y!d3;xbUfi$N#L*f}%u{-u)#Beb{;J`XhV4@>SrO;ErqzZOWrLeMo zWM2!B049KOUvlgKW^ycFc)&#`M3=(@un+ar?$V*W<4$MfEu}Sfoy;(iZDCs66USs3 z=@^JbT*cTi)9@$D)?r_a-z}TqT7hF>@JseEK0Eeuum=^az{X>{I%Va{jc4DF6vKnu z{t|UFSu^r+&BJB%Y}(cHjVH1^0sck9jcK}69Q@1JXQx-|*^MdHFv84uLvi8})aa_Q zRdis2qh7i5vU<7Sjyleti(9e&Bdt@SnL88a<(}IveVYrx6CAT(eC`=e5{<*_r8p)# z57lIKVHY^ZK$1w!+$jpqf2|N!%OBq>HRk7nPk@)2Ly?DO6Ru5@h>#k80pJ+4z$ptTlQN5^6^I`$1CXnUA}51E z%trO90>*7Hq1;ejB$Y-+^_&rC@F%|G|3I>YY8uht_LKUK|HoO?gwD)+QhZFcILDzI1SgzK`*Y0~|Pdxg>=xZ!~M zmX#3^$K%pfVLL^in?=tzF{<5XZ(al!<1{_yr^Jn^f9XbG0^hKAN|tU@Xw~PUlujJ4 zo6sPg=f-n6>981=EvMDNY_D(*N@VKg_=EQMc7{|5UwdVh#7blsRW&ilf`@eA+&BspZDChY7a#U z?(sm(An+U!X6`xI^j*BP-SdjmU2b>zyCkmzvotZ;1Hy+AX00`a1%Gv#cPGeaeP5i+ zq}`l)Jm@$EjyDacv=|o=H&%flhY29q8wyspdTGl}`p8i{0W2K^`tlLPn9Ed{w#{ zjoJCOTW{}gTvL98Scn?3sPdscQd8?~K4&Wn+O;A~Vpm*svB=qH4HWyzb%g6}PS~=3(j-X*r~jNV|X~eH%TLQzAdZh&~U9pAm1?rxZFxS zXLmk)1n9b|cWHJI+2gkVT!80cIt3#IO?iVHxoVtmQ#th>EmeKcdDS;=jm%0X2 zwsDDvjpL$vNKpon&{3PqsE2=P^EpY~^EaTRP%y@9)p+-|s-_Z7Wzc_dnH28pj&r0b z-@XqNWn;DbSk5jS=E^uD#q7Z>qrWG{~91`jOs#UtA^cCAB{nUYpk+ zlVB|WH3uZLNa>*2qVQI^qn4au^LluOX*Bf~@>H*6=%o`MECAkrn}55>H)QG?gU_OM zcB;DvKy8n8@MeCn3PWF;hH7g*js`$Xz}@_8bJGJ$;^0;;Gge`O>PxRz`F58m6PSx(Y)k^RK@i-vF!f z66yVfyGR&b-=x3+te?X=KH3D2#-e%h&Cb0l(Pu7qzP+J-A?Pi`VGr;qO1Kx|gskjR z?Ts+itvv9B$;bCsC97^0?-px@Fo0ZDQQY-1GRk2S2@TeulRKsH)-(g&4d_#e>e~UL zqG0?1{=PPLXPi6s*nY-l*JSER@9c{Ea;QMnGb^hohY7$C(|gg?6Lxb;N#coV#Z|Ly@yA-a|wn=s=eckXJ&1;Ay*UtAM!rG?n0=!QB-ZA#GVRFKFk)dh0n1D`a#r1lZJ;J0F17-hP>$`m^r!u%Z?KK|U!*d|R z_{E2oP;C|du@)DwYNOxo*uC4I=dcy`sk~uil|jpLQC`H%M7^z*`VL`;tEkLML(jCn z7FYT3isc|C6?G%#UQe95`Ch|!YdbLo?|cl5p34l`6f20l@G3*epav8iu7W_lY?bbFrZ^gEtq>#}Dc{rlUCPm6BC)J|XW z2^U_MZF60ho$zJ8&ICtnd~2pcQuOH+%1W)?ldxtR@XNzur%>s0{^yKOOd%n@5;qI& ztY^Ad&{?;Q`HSceFt2+^dYfo|b7qDYvDZ^dl;Cdcg5t78JbR}-oe`PQLf)F<$j}mV zJ4aw0lK!v`ywI4_6KCiFs2@9?M&TZZd@x(OpV||Mj5XVORbH#rl1gKu&Aa%>op?eO z`{nRj1RwN_Y?HwE@5T4SM=bEeQ~cm*VVsN(aS0J#x)k1CzY?)-a9rKe49xlachB`^ zV-(JLmzNfKnNvSAHuq7fiUOx@nf>m{sAJv7#99bs0BczjG}=3E^=()l%yn3i*G_O_ z=rgn*+*P+o_!12vA2_y7W|ywy%vUaMxlL<^jk)S)&i)@KHFYuf?>w9ck#OU}E9!A1 zS#gSP`mEZ2XoO|b8sqRj!J+#4Mf%#XuW92|;T-Qb%gPclne4F8d2T?0FUMX)=&zKvPezag*+nAUD5#aT7U`2`R(9TJXm7(Yz%S1@8$F zLZa6au@T(he>cGFmRF#nV3x~a3Tdzsua!!8OkUO^pj(tEtUlWo_bC`jI`IgaXSS7b zA&6bij+95>WTlgtLr-T7U})PREL3~Qv&3l^>*QJYCc|kRA{sAw>Wc)xSNc!}brS1M zBF>DqQW!lYIbKnPL}7u)jw;PFXD&;IgMHR95nf<5JD*JtTQ7%=?pm|cNVf|l{}qXT z+>sU~v#3H+7qT(&O7IyNRI~e4&;_AbTkFSSF077tu?}09>Ll>~(ux%Fy5~4@(U~4m zJvp1O2M7e$;{IL(Vy8)WA}3N98uMk6qqheWpm;$=Cwvuo7R87j@z;9|Wwh>}S@MIM z%6N=6(R6~5J&ECM@k3b;f)mTuqfzRXu;+4Zx3xdXOs7%lIg6e_rO8Ks;In86V;{p# zJ#zHEe&XG^OVm>e;hotBP6i(h(qiGPm`~G{<2Gx0y0jYkR|@)N6<5e_t=p-=C&Cko zb)Ez8phfL%WY-0d3A8y6jhLul1~SW1Yk!fPI6maaCxdVi^k%yd7c#iu4Sc8g>l*2+ zYtYAc*c|bQx2meU+|-Q%5EaDJFQ^`#xHCrUL^nCWUaMPV){WVIDv-{9o=k8xq{Am37lXFDxcr6_!p;w^I5rqf4Fadrw;H( z3`bl8&aopFS$~8_|M~rDNur9@hnkYaCvX3G-~T@0CD68VQshK#{(Z(NZLTCy{eOU` z|Bu={AzF;CkoQ^h>}K?`6>$B?r2I-P0PkAYadw5>(jS)WBL975?u%k z+twPiY&Om~Je}t{>b^A*f_dg~Fc%Y(y)(cJuvuZtGAFr_EO0&O@y32yLiD$xmTrH# z2(R2sJ9E%it5Du<33E+f87Rl4jE}lStvVOwt8=uHpAbvPh~9j#h?r*9;4^J}mlaVQ z1byOqGK@d_4J0AT26&2d7gNR-+z zuGe@S8hL8813djA0uYkGeP{k?%yHDYV6lDY1M_UThwYR%ZaV!b$E;A_MoYc0;beG% z3_TKnOF%ln1VWo#-^k2r?eBlz0n^83lB*l3*K>_=z7L`vTVJAh{`PbAcb0wXjX8xE zjS^Q{PQJMLe*#i*sR+#t)`$8?JW zo+?lgs?U5&qO?+TU-5LeWx(hCsjlk*4TDh}&U)@^J<7ahY zaOob0%*wZ_pWcA3PTjjRMmwICbnPO@JFb(2YW>b%o!pI9aeG>{$YX;VF0Ed4qYq1h zr^V9U$Fc(wM%{{OyJ;?ADfedMb`P^+(k%jaap#dcC*=i%cz- zB>T?~?=}7bCZumbS-ORIjMJA|c5oCai7*Apy~O_OKb}meZqvFM24Y`b`UB=#=ea{9 z6Zso*_qyM}Lz}}l!gvw?M%uOsx$eMsD`1FS zNgcu*lp6Q-R?5FbW2!{CAt7Uf(vp$c7I>^lDt`w)FBu_`&`^#0~_rd~4 znutfn(WZ3*-Tt@I4r?K9`{BV3OH170x1A14fulVR6vHT|qtSeL9&88VAgzA1KE&u* zu+zxUPrpAo^p%YFYV`l*kv3@^XwkwKlpY3`89la_5}CDg)Fq#_<6$c~S^pK1s;mb% zef4T9VbqoY4Gys2T==JdV}KuoOonfKiSvc6*L;BA8p~Xm?BGL8?7a@*9JX1_JKy}( z2OK%SS&t|9kv@CQ*Edr9nPe@mw36)9nDs$1pl*t4)79RS97RlA*P+Y9^O! zZ)L`vFaV$WXg~R;Quys1+l_~%AR+(vHU|P8zQc+^!((?5yLIe4m1EdrYdx#-jI4F< zvBRe+$35^}I#8@fU zQ+Qpj0d=A076tOK{NSwew9M~S19HuzZI;Nv&Rd=nO^1NKPNn4NCyJ<|i5&E16a3?I%0{r0sG>HB*-`dhJ{FGkiBMuKv(yS1(J*U(8IuDZoIkrgG%D)trtAtZI2_c1$?M-27m+INoFCd()`2 zcAm$=7o4C=ho>jP^9Xa*1`zI19} zdCF{YfEQZ4jS8t?WXD5a`{T8a+w%)S(zwq%YYbJkb0Pg#)wVPH2u}=8fqNUSB~`=& zq2jRSJbtjZ!1kJ-rLXD9m+OB#ei=ElY_^{gTMt)TJvQ22fmeK74Ch>;Q7_lzs5;Dd zI$YYyC)^IJ_z|2;eXlX2m}rp`uQqrSNb>z&Rlw<^vl7});b?#!9R`OS*$y`(x^J52 zEx8|MRCa!PZr6j`E=02l9UZ#|73vEa(>7#gU-=R1d==xHwdIg`S6vVe7%=fq_p&p1 zDUXY?%49EnwQrGiF#EPqsP*y8?dPQT|2T*V*G;?f3pJNY?*Q}EFLXN>=5Etco&bXa zi-JCG?1 zr|&B{rQ!3n?zqH&d(}SI!lUoOX!bN?fV)}FhuxFS?CgUSK2UAh-p;;e|M>nN=ROF) zC4UQN!Lz~i+wuVqD=#H}FU-LcHK*QuifOosZ{-LC;4THy_N# zyl_gpNr9vw54Z(6Y&>$_muIQbM6#(DaE)Aj>cboOQmo7_zxfVy+XBE$K<6doKm>m6 zP)Gdo;esJa$vLf$b%$?|dc})=Ih`dB5EC0J;2?aI^BHTj8RChHL*8!PprO3;+I5d< zhrSf>4ON;Q3s>%xOMB|_eVB82>Ro7LGhz?eyN3vEEyWt>0r<9Rz`<%N#>m2%IoZM{`-A+fsHB&{NptyAuMZ z8!oBxHVvF(%#`ALd)6q5kjl|sY_0I6;zh;6&)BJ4_GIRP=#tR6PosWqkZOXXXKLT& zLP^D{lg-*M#+v%yXX&rgcPB>rc^1rIy$v^aCqCKOs=0l2bO8!@2KT`@HuF!YYK5&l zx@D5IYWKwZ5>vq1#x)u(kMl&R^QM#O6r*3pOy3&au#w3%j}lUrw&B&g2BmhbyY}6O zOphT%m(K=atN6{W`^NCO#0Loi3G8ZM={+^*tb?53UFz5bp+2fX6EK=MK`~az<$K0L zS^1AnZ#L)X*dw@lJuKZsE@CQ05;3)?wX$m4m>oC(04ANgfK)o4Dnyk%hoz9Em{E>n zexfSvg-vy&pyG9wLYy96NNcuu$$5`ho8+kNUw zX_|r*4s53PU;T4vU%eXW4F$S6?F6F(fX#a7O-9eNbxNA=iI3tp9eHd0HrIw#i^2n} z(J+>FD_Te>fW#SmKK_LtUEv0p-U@J8y2Qv8^N}Bl7!n9EfnP*2f9xyUUncSaYm2 zX(4YnQFB|<4HKv1`A9_2Q?N{~&O%>Rn2`i5Wfy(~J)M&3Q<5I9;%rz_k@eXI1G^RM|xqeMn@>4b!g z3~c$30?)rLTUyOM``Ay|c%TD17$#W?jz(F&G{9W`d-z%FQIrR9IQzazn7hmBT4c~y z%@yk6C%YTyWNUxy)*E+Tp-dvJ2==SUEqALZCmrq4)a!;>3l;L}qVn#GvD0-SpQHAR z1w+GCY)g``B9y_ z!t)M~X0CcyX*nI#p!bb7!jOJ6*=$RW@pL}zl9n)j3s1&sg0{y(JvQ)~7k{rXw)GRm zaEM24)$`R_YbPg1x+!?}ejePH%aD5j=5yZ1sDe)h4uZerjye17H zCi6f9n8$EJ&s1=nW^Gg|?6QwA5qx;X?VPAtvxtY2e;kweA)|i~eC0Z8mcmxX)*Cki z{2wwFKo};o7RA7@fQ>t%s@iXt+%DWun|(>C5$1XDM)Gv*k^zH^!xl`hm()@YO#qIu;LF8sECh(Taojqi;1DE%CN{^_uT7pX^ z$%+(?Wzy@cW0w!(Q&6gba4>XK$Pv@NbR`6r?}9bcz_s<0h~HccXwY-u`C5nGAkM@b z!@9OvzU`apP%;v45dNZJ=GDOcCj~EgfY#7>Hk{Xk|CD&GMfD6h`+l2S8c39gVNti- zdLgtPY+m)@Y+l2g@pd-5l)~24re(eWn*m->rU^!7kBSCbf{-3Z>bnTw7+n8yRs88w zo_x)q&aS81bg*^ah)3?RDZ60qkc|01mW<6EC|v%{)BKOw(HCAIF6<0q$vr5AVw3m`FWsN%gS_(I|~ z#`weB6DVC+Ex=PUc7D9-_N$x36S|l2n$K}Axrh8T8pGwy?4{b~CRKMrB{ z7h&k~C*7mu*68U5v-dlZJXD-|5e?tJ|NCK=Yv%8G?8OwyTWd}8s9^{V*2?%#xvn)I zsb%>hQ2B!IYNUs0eWR)}JvD6U@C!M z^)o1M{npEYqcRf0`v{ew<##$kh0DqNXrXtLblRf;eGpB;m#Y z7|%Y=ThY|q*y^~QMc_5l;n&YlZdUd%raZhpDdY)vylIfr^iBMv>x?BQ)-UKXS~N9x!2N>Hr)j^Ev5 z5$$#{&np}~GhOR_q&6Vccg7*3dVF3X(~c;SU3{7S_%F5LsN6v49yO@ud3l;|e#L*q zBwmr0%W!2PPH_5E%*)U%-EXU3#*^ZDifsIG8+CFBU*CB)cnL9-*;V6Z1ge)&))HPc)cR@ zls?u~adkS5vLj4i5sT|w%0Cm@DiNzhYtoW#qo|b6+Q{3}v(xomCc>bq?4^jaiO_h0 zYdk^wcO4#*?g;Va8&1h80BO^275j1drKx!y?!&ESPN1U#im#3aDiiOnN;0`dle+p0 zr`+R-+jJwui)c+O)_mHmd`*b87F7ul1+EioF$!&{<*hg3Ca;&Btsjc}HY+>&zgOvL zFsZ1pZ8#M}=qg=i7iw?&Hv6_{_u8cI`1DJq#?W4h;ci*Z6Lc=y+*9aRPeFjR=-jv@#*=6Io_t}P)?iKR+b3-+m&cTVTc>g1y-@RZo>#<1-p3X?|l zH{%n4p6-}DGgJhTbj0ZtuVX*8<$f?MZ3PorTDB7(6LiZ^r|%n_ACKm{M<2BZRsNBg zkcwGf&brE-`d-nvjH)VBPl@&_7wg_}Xte$8jm-SY)bl)oTLgg~cx%mXSjE3eH(goh zV5Wc9!g&n$WXdAU)N?DZPOO8#vR@Uv)t9MTkd)@03T1TO+jhY7~+HN-BkfR zOIG*CItQ~QuNQQLw)!BEu~1(3r(sKK0g4WJ0JbYdErh$W zqz8ocK~}q`8#<)KEe>Pqu_cS6eRX)s9B`?uUaY&IF1HJS!(OWCIP*-0kmAnh;pY-joSnQ4G@6btGyMi7a*fnwa>=Y2k5A6VN19)vcRr)}z-VCU}A%uJ;qX zGj;CrcRnd){>E(db(=5|6`!&LsOkynQ4?Ai6_sBd`Nx^KokA37~6Mmh$BLAq60 z_Ih13KN&sdhxVxt5FSY0a?tK*; zjCYinniPq_Q3&jmQSP8SR+W9{sA=EOvtVTa)z45qy=?4qjfijj-K}xyvm%JyhUp?o zuH2#1-rGuGx$I@-j~aipnHBUe>6D@=l=)2C)w7Xt9)jVCG7wt#rK-GUSo2!XB1NV> zfTe7}@I2Bj_^)-=PtuImhya&>*1EdeFvu2f+ zZHvUOn@*Nk+H;n*LRpPbeHK=TZp#|m;a45HO|-~(<71oGaEV|J`^$1pw6Y2ICR=>F zUOIaF0UD;aMUqj@(Pv(8eFbiZ{9S0~lKq}|HV#)Jvb&1gcGxJYK@Ltw(8i3+KPON!I-NHJq&DK~9U1qv<^1Tjq&&+Copw3TDGTsF zK^6jKDQ|1|R_7DgFblFEgd=lmnPr5Mo5kuSQmdWzzj`71)o?_Yvd8ze7 z3-Xf=Jl|lg>w|D&B#N&>ef*e!80V^Xv2|u!J*Xt`;w$8a37sGbGfqmZt=rIz`$f&~ zF<=H`ur)^Syyr<@HRYN3QR3)u%-Zd^@3r_&^1gQ)Qg{DbgGcGIVMk@AhoW;)`Q0ke z6H{&#GOG`pR%v#=2ZA2XJ!SbNAM~tf32D{Lry1tlXvv=9b3$W+u!{sQuXl|5T=J=^ z2GOA6B}uBnXiOc%)2aP#2L9%G=rJo-#~UXL*Sha7j>aU{?!89dm>_?9_xGx~gsc}{ zU#L2$=CnLI4vEgS=D$gHg_i7|yKD8#NlYFmn5TD?{v-qeHU zGj3B}Sf;VFs5;BeDe}j~Gu92(49x^t=qgncT|SOl`b33Wj{a5E0Dd!2pYC35jbXoU za%FtAW-Mo~3wD$q$89jqeX_~u4`Uab6~EOx1s~Z=o8xvzwmt7SjUMGKN2T3t z>=0n}XJL2@z=4~38b8|nkU+W+t66KfzFBg;?JNP&^Hui`CE|jKmQZsCa5|Ep)DEnDBmx2TpkLf z;%qhqHB=t`t<`n?XJiaH%yYyYn7;Zp#w#{9HXV-CQ&pXuWd>SS>cJ{xgUsL&wG%-! zUw!?J)*f{abngXArC7mF^FDPQmi$qL6|*ODV?c`?1j-(L`h!SmM#_CO{nhv#AqZ?A z$b&ey{^*A&OXS5{)Vx4vvV_F0zhGDv3C&!q?6qkgES;T>x9z<4^4oL^YW11>ar$(} zYDU#~`o4x%d`Pom{#{v)cwv_Upe5HSej)%EgWZ})FOHf_A8MDPjYy}_bDf!IUIY|$ zh9B2LI~)7fvs`fTAX$k3B1!I&Vd_x};~-awGs*EUrqa)&HJGl=FWnQ(Gq=bKZqa0& zV}b6G&3_H=S&~JlRGW4|V3YkP%9r>yU=YpC%#7+=*|>W8(&%kXPT|SizQhr5lN_n% z+M~PiT6<$@NZfTFn?9QugBz(Q@3#0F939=B=W2X>nC4JEWO1;ojq$MDk?{;eJ_tb@7aKR7z1t0w;fYW;iDb=3A{%2BXxZ4`}W{godh`%2y705&yERwbhPQ? z=0v;fw+2UF*5GhIde@(`5Y6tnt*Fx?WL^1rZayovWT|nv=_sXY|)%WnPC!l0{!WF3^f#4#7 zgc&V~X~{FZC_OeTkh2HOs$qMv1gBTVlQx5ZgGFr3y(Rp);q9XR5vd^me2Ws_El$L$ z-qcP7jkxi-l`(ug3ZQHna5FBjBJ5xhWBI6XZr;RPPkW4qa=fqoj}p` zlb!eA6kaF!kLCJk%5!Ia%9Kc^floLOU%hRo@I(!=FMnHJ0U@|Eq|#^XtDDh0Qi#ga z*dxb?*P{OJhq<7{;9828M92r|o+*mqVJI;%ZYfXc>eGnaws4o>KgY0BTLCO!Fgm?Ty2Yy<_P}kg++R zbM&;2+uX5E&)xO0j?jAMo1f8;=oiS~8d;XN5NI92JAMogGwjRf8$v|~#M-Wlucw0G z0;umfD@&saS}t%2-;6`2b%(sl^1R@T+}ub2?sB~W<|AXR4;3|uY99iX;VFa!Cz8OanzfLJe;=p@Z~Y|#tCehL<{j{Uc7~=;zx-N$NU}Ps04%<;;%bv7yo&5ngXfVtLSKW->CQ*{tf8%jFG&p zSDI^a;1ne4)-~vDznNIT34LbOiJ4~yWe(r$xqlth{xaq_U$*n{==K5}IOC#-Unx#mN`!l_ zw}Z)jYIQceBPste%~Gwrc}RB(SCi~_4BaPaGc?tws`OS8@^K^TDb<_#=Htl zd`eh7`;Q+FTrVH>N!)2~7g2O_Sv$uM_fe7;Ly=Pp?#{hk>Pe&h+~Z-$!LKFax9jW+IQh_ObRGHBK90_#%cCy1$V;tQbFZ%4LHB$p`j{y z^}b`M5xYirI> ze8=`K6`kiMfkLT>p5$=#VWKGW@u&stw#{p**NFr15CQvUGf9_w_Qc~RLOZ*2@N$x% zxo~oqoeFMZhKCtJg=co38KP3EVlgm7?Wz7*Yi^tt{(V4X{CfqD)}r!vJeXKbM&{qV zD{8cO=)5#X<|uBcRH9&%lWF|aBCDZt;ZDt@8{;#>&xHb$lkv>?;zn8-{0-E%K6$+? z7uMYAnk&4RdOkZtyqRw~(ZXK3_~~492HCAouJ_JKBpNv|wU;^{5Gy{iL0a-G!zB08 zNuZj?r%q2VcZu-K;*IDBxP3a4zHPj`P$y#8Rdk~Y>iG?3zPokG;Mz6l%O81z($q4b zWR-MBBE-h~l>Ia3SVm#TEyBv=Q#O^!#g|0hG=3;*e9n6>TVt1SSHsAEC?STFEVPfh z=`QG`KwErrm4$%otM-RuHy7R#KRAHULeI3h_fnZ&-j_U!qj&-raJG%;yuEQm&se3( z++jz#nL{(~Z9kN;e0p|*-m=nEK8oV#4JFoxAn2&DUBn%)k#~aJ0wL%3qcX!Il{5Mb zeHXa7K9NcVxW1VqrQZH@4sIv?wJSdbwsnrwFGbvvFJFT1COZMZ`>YJybK)I{-Af8B zXX1aec0pjk&n@0e@XAeTu8;}3Fc+~3!?h4@`!6EURN3h1y6_h5$P*LGr~>#88uop z_s)CNh2lT&xa(N9W*6C0q&DcD$xLqE?+Ons)WVe{l}ghJ(QPsfb90fPch)=J?Na(x z8w33Ti&xede5LdMVmruf?Po}(rP0#uSmb2B{&@Uc!@o7E!~-^1DTGIktoSmiOyYel zI{n%A(=TkL5htXnpOrb7)x-Lw-E)&(dAHElLHY*J$DqcG^^r$`yEC56dS+@e`q~8f zi|W_d(*Vc+i)x%T*Wd8{HM@Emo%rre=;P;p=>1+3P&S2tc7hxrIDe9^Z?oz#fJ$VTg9JBH#f0nSjIdPNcb#G5)gE z;3FuO@h7u`GxS#i?`D8X8UcZs^ELc4=QRGA(*Fh?_#drCGW$M$)j8yZxN+0$Mbx=x zotpoA{0}_G|D?jne+pQcXk8!L0KWQf6bI840VZx2qs$*g!~fxeJP1?e2LbDUl~|cN zNeKM+C0PDb9sIGT%ukBGyg5O|PvK66?mtx2{6ARO=HJ!Q{|5~}Q~o3Wtd@xq6S=<8 zOL6aaWsutkDyU3F4Mkc|>gMjx%8ANq2G2m`E=CkCLb*T`8skME>sXNXU;gJuV*1V{ z==IPS$~(*`Qh*l%C}xqW7Bvvo113o3&5uI!+7WsUsGWs% zP-}ymXG4B6U5%mgCK*La%1ULZ=157hxbcBFtPWK;Q@$)14I{sWSWwgKC#13>9kSP_ zJb()JcNMB%iV`pdlTZJ%BHrb+d+YPnL3Fc%u_c_P*1eqqWXcD6QI|)Zr#~ihmpD1- zE0rvVkFT1W97QC5wbt+J(h#XG*6d{is=H2oo#S6`jN z8Vqy2B%=f?AK(`8EMY(uc7Fl`%@DyCW>9{+M1lTBP72N^pIC1C$S5 z-f&k>c^wj~?fJg2FxP6RPrQM{d}Sdcj^ARgR-4>GkWZ18*IwHl6&Jk4#@N6)+JmwA zP{6TQ}aeJi}#2&`J)%Hxi!`X3aJyaUNNMUHbJyS^o3 z!~dRsm3ow&8&%f)ux6%=Q64n&zR|r_Y5{w(pw!scTH?NA6V!t|v>fDj*8<>F!$0`I(#a z#zh!S^qebYdCCuY|LrE)RbZqYkB#QAw(u(pR_0lCidzTDT=$1E>^R>6l4 z9B9n}5cwGvt|xh`_?+h>J59-~cP*YwRNJ|%P~ zHI*CB|JtW=$2CHt7DvnT@S# zZ5AlxOEm`gjN8xWemJ{-sP4>@7zZ^_7s$@RWLE%hjc&-3{TW8vi3;m%0@4kvUI^LX1p{@}uP#@-Wuvfu=j9&rubXGcL+4pyFl zRheNCgM7epkp1vw!~?q*v1(TPtk9?EsZZb(y2J<$AyDtp2TLJ}2>AEvx(=1RfP5nV zFU#x)zxZE`B7g&&US}=-zirOt2cdO8?~JH2+{abSC_M?(hB9O_h_J~FkNlUF)fJ*u zGk6EJBum;&$G8dZ`Bk?h-rxl2na|N-^gkb z5ZtgQAh<4l>pJjFS(6h4__*exsqmVhxQ~7vX#4|_R+R=$Mcg@mPYAScJHF9(As`@a z{qyfyheMtP0fGKIMOkTW4-*{bj?aV9pI28DAMbHrbCvs%S3}P6I_&95rrC9~TO)7K zJe0)FE_dFXv0cAks`Dja`I=lB^xjA4isjQ!i+0L#Y)_G|Gj5UnGajrbc*p9Ikq&nx z!L^>No}NiVcj36l(vQ;cHjnuseaQ)vo5HI-wk_=J?Ee6Ldg~pBOane&agnoJBOrKp zU*kT|V*UR?!ylxrou{bfE6ze17ZjaawI0a2xQEREYr(Je)$i@?Y2~V=h`7kB3ER)q zSP$ncEG)D$6A*kjeJ80DOHXkn^44i1)M{ug)K;D&|CSgWIad|MTPEJm)nkW#-lB=F3>AANIjx!#sbK9iiGI%%&jO0da7hCOx_k!r9mh3U| zH!B1bX?U_O{|udEU|=+cqXm8Pa$6fn2l^vqHznXOYeZR#Kp+@IoS%w|pLcVVXv+Z) zaqCctnJKSd^f*bN>QzIYybDjWnqqEn!iT?yG9E7d_;@4E*j;~AQNyw~&G&RYzo1xi z|Ick%V{sTC_^We0U(^Qu^Dg4@#KO>1m*d~>PyDJR!sQ7w`GARM$TyA=_cZWvc`Fc+ z$ErYUA*erD!%XD1y){{(5W!fq&{7nGiT#>-gAlkE zK*kgsfuYnjO2;1l+!mhoSo#%2QSNyBdjX-Aa=sA2)Y8(z-F)sW$n-rc%VMcLtetRP zGk}!A3%_lrGCqK^n?Bl^o6A*aDyAnQ`2I1^xMaD>oN^(I!;ODKL{nAwZ--St$%KBe zr-wML%P}IuZjeTAO#RW;dADcY!SxM$4imA9h|g4_BSwvpk!3^KlfVQvU0t3%Q%!uj zzZhrgi&Vl`tdy7Y2~xb4mHp-5yPuRU6VQDH)Btr)#VL!Tscct+ZvmzT$0Toj3rkO&`zPL_i^!WkkM#B#8Hl5@UixBw>KJWB$C zAB5OX$2P*IloKI4>%)zhBFqjshpq!BsO_~+HFk2aOJdP%i6UB|apA7PVmuukQylV? zz&MFoDxV7%$tUTJE5GejMxj$%xd>WXT56w`>Q6J@q-26AG%LixvlS#jO)Pl*MxTko znZ=4W&kDQ7Fe>*N8M}mG$>}j3jkz^jeFcs?vsmA=FE0&IM#(;Dp3 z(qTj(9GwTObLjTXLLo!F z>j9PC;?h=MoB7r8xP-(rF3+orxUckvwclTHy|DFM$nL)nX~Z85Ba4JAB#+wFK%D3~ z_naPsvV+L&K3J~GIp)eXNYzimTV6BsT%^BAmoqMn3#HB=>Vod&*Xaxk4>OVgo5l9m zA*LGkW^?zjB(cidY54cEU!AH0hZ-g`vD;gc7Z+svvscPT~ev;$|D`T~_;?4X|7Rt?%#pbhNcmQc-ocxZ|eacnr+T_`QmeH?FF^@G1VO zu(0k}WWinfm%smPAaW6JY)=A{@3FMbL_KV$EBe{Wm9s%kqh)X6N$P>V%N5@5YP`%` z!JNZx8iimfzpyE;ZD$J#3_R}lyQE-bWOQ}75uv<|(jX!r7) zBX*O5>2gO=7)kh*LqU?S_^gU*Q{st&D|MT{7-qW0IScnQ-X_yb{;ncr%Ord`%ezp+ zSTo?jfnAbkY-6ibs(zt60CFL+F!e?`?(vemf=JwQo%)x%Ruvi^7D+l&@4Sa~BJG%4 z;l=+zX=z3;(ks28u8nSC0`@bXBfBROaWpxMsqx&$!q1M@jRQDBi+?GF$}exo z$0E*r&|K9IS)5Bkv!(GuYffF(faP_m3W;Jc@JFN}S;LQ`5G(9Z)|#PnkV9<9dBXFl zdyYOsBjS&VXS)XLZpf`h^7K6Pv0W%_s>Y)vDs(n~5OeN2<0kdF>*g%no<&)zUYIA1 zn(?wSe=)UkiVN5zFRi_7cAtF@yU2AE0avv7F{JO97;TlFv}N>A%)hQ$r%VtySqUht z9rnX46))e`4;Q7Mv!89KB}a=lU7p&|e8u)A;kPRK?J;#AL|s>RZ=#?U|Ko>o7+|fv zRl7QyyNbPvi;F`~;74^$Y2I(Az-C1}et)-BViiibgWs9s*-t2ZmnBc8FC9yV)Q)m` zI~J*01szqo`LcHHV0{>X{7lXmG0v{M+%eba+dI|G7r23R8Haitij+aL^Y;2zI{UXF zm{6OZ6;^SX)gb`+tZa3Gm3hCWIvv>dWWcu1bJy6LLbnBJsru&U#gLX9kG5W1Z@&FT zCmI+`kVsUsWlP3Ur#*#jrq^F;W(t47*nzt4f{o_6v z8l>|W^%9TNUl7fzb}Hr^>sx3!{T)TZg!QzK7+E|Erq!>DNU7e=BtbLPdZK5f&Z}an z^K_-#%gsB&FAk#d?0Kda8@dtoZ5TpDxeO|;rcp(qSy2CUnJ|v}uvzKc;ph0}V2@oJ;y%fC9uS(SMV)p#@ip^(spC%Ggse;-#ove{oliW&Th>~pq=t!R1<``hKHTOYLqZZ)W;KUNOvm>0C`<7L*B%4fp z>%t590C?Ad`{J*ltMgT<_Rex18Vc|$fm1;^&92jUv9Y{xmXU@U5$hmr6tJgq(`Zv7 z_tuuL0M9L|-a-ZKOhaGgRrjNj#Lb9+;5!yd&5})5a-XY}jzLO8H8F%eX)5AB}VSOI-*T7oM9QF;oESX4+axRBfK8w}frnuq#?2z`L*_1V_B;Hja@S~$v=nh?pkSZ-@{;~7kci$7VY4?@XQyKW;CM^5Ze; z@C&{rMLCd@F$bzqarsTk2>!`>pBA4Tj`#%P2L1d%lAr|}w8gdis6=6w2RLwQ)h48Sx z?gGQ&DwjD5*x|Y_{5W0p2x7_QJo9_CI!+)^D$nEp;6lsm&a4mTs;7#3PJ-jA0MHp? zY6IetJPvGT)i zBWO;J(a~<13#uR?(Xoh@NoqXZGJiFmLU^{xv=`{v{Hol)J!Jm#V}E2N$|}P3JnP}F zjcgm-(FZi&#^fsxTPBWo-RBk@uOe-(KJMTWpop5Du>8(P!dV9UG=_M4vzB~jkWNB% zUovi1+7ZsQb;_I;^+EN^6ex41KDb(K-~xyqtsJ2f90^h`W$|T2j+?0D_1kE9l(^KA?kXQk3gv@6JN>Z(SBdizyG3b;JW69c z!ZbyaY4Uu-VkOwR+{Xke#zlLiT%E6Klk}$eva*lU@avoL%~h4FcFTVhI*gL|F%w38 zpT}tqfgenpK`Y<&YkgRgYw8P&ThE(a)krEN3ex+4-}3H2h<_l>JMFx$OPS!?>!^q3 zImR2I2eRgxw*6gd@w=~t%~`P@T_f>G<*m7R-4}b({j98(VJ~ugK*k+HI$z(U*eso% zlPeF6(puotJ02+S8r{0ZChI+h5w z&Q3>D*rMJFb$+E)JR-9XX@rm*PHD*~3?f|DhZ=b{!!=@gv#Vpl1wMOb^;QLXsLqNY zVLtKqeagjpb_`+Jkhx!5gQ+%O>0RV`=$zt&W*DHlg8Fwbrsl|Trf4WR_nDDf)>JSs zIV2MzvWn#Vip?Hv52F}Y4t5qcV^Je0+n6Rcna~vbP!ja9;Jev6*IW%oDP{3B5nW9b z%JQpACGEVssSB<;Xr}&C3J0=;EgzY=J6-7;)c;g*F`G6>c(jpKIpE zZf4t%r=Y0J17H%O9_VOjq_gsnoZ%=mgBfSAwGHj!xL}7>J-cKEpi4iKl}nZhJHcrP zjd#kd7r-t~CW?C%bKooG>0`9lqo#lG1lTyqOmQ;=e^8MUIvy?7)pPefVERt{j2M%7+}smD9S1V?~a%KZyVZpjiD;2&$&mv za_=>gRv-|oQ3*&ydhdY+-&2;b0|8=gA{%n0#lZKK!Ofm&QJ&EZtjc7n;=?xo*XY2q z-F7>B21~g(xX)HH4tkT|Lx}dM#?Y=oo!b{XeQqWXt9XlWl`d5Sts1u^cS9)GqA)!{ zT>Qw$2yVLIG(Jul%piEv_S?$FP^7sQnt4WSC$8Z6r;J$^^xHAUmVqa%m#80&Vm?bj|5gXdw2o1vk)-+bEE z-437zA5A)@cXx<)rw+D*atUuvepFWX^75jz9_oxN4^Jez4*GI5c?ZLHrz$O>ETTcz zEQY~rhdgtj==VvD!mL=9r9i;t<(rv1Y1UejA(gLTPs;V1tuxDc=7d&UxAybpyS$eq zhF>w9%t2Chw4|-nk3Zz*^%wluPd<sN2YG?O&v5GG?Z8o#N`28M>vC6_tj{FVV<)osL4M= z`WA+xcCLxd#v;w$nLQ_hOKL|eQ@G_mM)4*7_&~)qP>qd^cnrK)&SN5E7P`?^cK1zM z>UZ_^`^!78ywufujGwd#gYMF9gmEfr`C%%IH$I1=mKw^l`Z$c(Z4J_rS7p0!`uuI7 zM3r%0ebkOrlpLu}Tvh6HxOz}wf~m6^hI_Y`M$_GXLsT^jvT|rC7=O|p*yR32PIz~~ zjsdgfP*h}ljQ#TG8=<~;`xm6 zB17SNOlo2x`<1TT_T?LW=D2+3NAce@h7PUmKXOfWI`ZQC?*V|C#==YC5;gYBJD_eV zyQxMtbdN!7U#U{(Y<11zK1eJ5Snxhr_25qVtBa6?yfn7wH?kpb^`x%JFzu_R>VMmr zfyC5-*9W!gC(Hd)@8Dlj6ly@N-~Oa6w4_98xsnt+RLIv8tsR;Y-Z&C^io?sRR#&>g zU8*okW-sT5z*${$SC{ybrqldn7KIG#YdOX7_QR7|^esaLoqQL&94 z=3<5_L+)FAFFaRVI!gy_alX~6TE=(jZuL}~=zdmL|6bf>n$ckFh2mU#O}~^=M~AsT zzZo$KWJ5-z6z!kb8pfrr`R%G!J;B7L!YL}K3mlPQ zW9t-ES;Bl%-bEk0dl+8wpden&C6KFj@ul%}`>rSDw&_hB9nRiNk*Ox@2K4&z^ZMXs zjEObo9mz%kr#8;2-v{0jC*-w#LfF4+;8j|POiST&i9Lgf+} z(oFY>hbltjl635~-OaP;YL;oNo!5u5|Mc)T+xoGU{_DBarbfSQG9euLcW8092J>dy zH7cCgBTzrseux&Y7$%DT;HfNzd|!W;cMNaT1$C`ZrQRU6pX>xIg5(EoVU2@%p=MQr z!-AyVIz5SnLrBeF+e3cq-n*+-Fwg8h4_pk{X3qn>W+t6Fm6wiU7o~x2+8-YPPdNju zSvyFq$BW-aip^Edr^hKA>y-Ru1N(fTru2g!Tu;;t#>7(@3EvT-Eh~UHidIO2$4Qe)d2*D45+1E~~H){YJ<+%P> zDI?uxtiiLZDbd$XnBa#@lV^AJTfxs?gRj{OxL#e(>@EaciE8NNV6PDfK5?^BSO6{GTkz|G}*Mf2^TBr!mC)jN841Jub0;D7?08cL{g+XDA51yyH`f z^{cS#TR!vZXlw6iJ8E)Bkf9v+*X&sA!gI|QV}XktfAUeXL@ZmL`$DCczfoT`Ewnb5 z9J?rGv6oPQ<F#GsAGfXpCAZW#4x}y>vhoRinnV&*=Jpb%a&#j0YbM{_fe*m+^kcGPlw{ zNEe}Aw^QbyWDGfUtA==OoRJP}ZgO+zA$U18#;PUioAgTFUXB`S9e%FMoLdu4@dARe zS2y0XE4eE&x?Er(&ma@9nEdyg4BdlMY)reV)qF2^y$fT7Vw1MjgRCDgPUcwG%)Bn>>=at~ zIXyxwrtan1sfuIfGX5HRUNrTAOkw-}s%k_Q$+lUL?YQUf-#_yw2EcEiFgw{<&^uE@ zA&a5RAPu`p_x7-G=cc49gvPU&V(W<6IsNI;xiET8Sk3^*R};H1B-5c5oD&;AD5Jf@ z2~1M!yS;Kc@<|c5so;p&tLaWECUFs0=q&ky^EM~-3BOk59jC=5+sX29UX#KHeznpu zkjaDWvWua8xyk3XeGqRsyr~`tK_ETtii`Be6phn@WQW_KEoe|fg^FwQPmC?ap;m2! zHOB>HSNJ5udvz0RKWglm4cd}$SL*e@$IToXB)m6kmX)Y%sc_vyRX$XXF@m70 zANRkwJC(D-u73(3gPUesY*XQX7lvQf6gN5FRRv3X>fAPZ*!svsBi<{;)A2oc)a;+!p!3e zT$?K%*(?yXculKP4YGLt8m$d6DfO#rt~_{CCZqGVisX;!3#qWYa?^5JkJKD57Ca*1 zb9dY3A3GgAcWo@4D3dkK_RQ*W3FmQ-jkSITzG+>tUxe%x=1C}_q;lv?-cOxvD3KSQ z6aBs(%W`MTSIgkk_%eBQPJ88&^EMJM;OEkJ=cLWq&%L4cU03>-^e(>7!K8z?&0LNQ zlZ+LD@0jSvKt_aYJ-NI;qY4OlEQ)PYqY~da6&Y7L2Nay!4#(Oh=8OIr>aR$)NvzWD zdduxUBoa+xSvu~spW(}l=z9yi(I#GXXQ?O6>g%It<0ujD)=X`?wxO%_Z1ZWX>V?}* zmdTA_XFuC#6y_d1OjJ#_HsCboI{|%8#6@)c<*VNU%#!=ba2SV=Pppz6;f#JPxYHKM z*X)Bd9gpc7(tU_fmDAyZXi>YqhclbP!$Qw4-)FHGXQ`&ql=Q7N@x$M0miR{a+&j#r z>^~f@*O(Mry+{Y*AKc_yYdD&|4*GjW>%XswD(^^?b{KytRCAaaUz8G zp8`(j@yA{M4be8bvL`tJD(A!ghyMH%0~BW`6Q{0to&FJ|r;Bt0l&QRn^HPFYD(dA9D+tH2be*yYy&K z@-a;FFRemb8;SuHZ*{8bQcZAc6G>sCJ06Qi_uQb7Ku=yeVKj7JiajaR4S>&lI1JHr6mlMlRhp4p9iRjFOYz$`@s?GSIc z8Xq0?-dGce1{+qM7O9hVs_=cB{F47IS;4H#pcJ>KB+(bt zX5N;~hw!oWq~BZ3JML#b7U;1lU><7pQl`Pem>~=M0)ZZ!LDh@tSV3eGFGP`npYQC6 zLt3(>_m~Rr(lwAYb`S_m+J%IwQY6#I6BhdX{tYa25?Cm5)s+RI=$@&ztUS&1R07T?Uz7o2DKY<-@P}<4XI9y>h zw6)qyFrDh4{G9==iJ>2XThE+MY12Sh8i|-bX7#PuGh`0Xb8e+oMwZbR_`Cxj^FC+q zv@e`VXGSvcWIXqk-WZpstaQ6g{--5De6a6e_Ko#zjYYPZ;xw>u_2opm7hG4B)cdkD#n_hJIft(Fz6* z?5B{o#XxffN+aHrn8xwO-&?%~f}(}dT_`MV4s=SJ+*Mw#$Nqrm!A1?g4LkV28| zO-nPzH`MKVE?*ytNl5byKUJ&7J~T|8e2#Wu2`lqDw<^iQ|3iuBJcjXkMt-6TB(PC>}qudxq!kLja4My1Fztm{{W4+x%)L@{01VX+ zx%E}1KS1$AZex}4--D38;1WH<_NRj;gecXy%0B=_h3z}Np2(D_fC(SJrQ z*VK&VXXxgK@i6UPfu}5jNfsRN5JoDOfT%U4v_1rN;Dzf+Fj?mu|29X$;5<(@UZf=^J)`DU&u&&s!)j-oXmH{B{U--%1Cv~P zfPABvpOb3>~Sicz&7%9KP+R9(`a;+lTcuo;ov|(+a zJ5_C9zqy=}Ry6?4sd})9U&k9}o0oj#X~LB@CX}@iE_OQNQ%nyrq=00>1knC8st4TM zD)X(jk?Gk)duIL%ohL5?2CFk$?>ha zJTj~5)w-k%??1!S&IKoB98K1TU;4)i{_7KEyE4&n-eNe(lb)9@W$+=cXFGRknm=*j zrp(5EGIbya_oG%oMtm9LMun%6%2Xv%HYz94NiW5G61+Pqd3P-p?Z6Xuw6M2fl5xwp z{bVz?#`?=|PPL(bXpsW@EU{lGXmPiBHOgUGZIwkGNg-49bJO}t+mN$Mj88Q!Z`&S7 zx5%R&mG3%I|9WolYpm5?!aQ02xxU-1qwU0Ws2PKich5cb?-QK0RXi;y} zn)f5n91hsOhmQ+0GG42i*jmifJrn&$>T^ZAr2b`_3$8?@LmoI!nrDL!L4kcMM!Pzv@U%<_O@${Hog^>Awf^|1H7&pTX*X z?wJRCN}|~I_6|=6Ku+7Eb)4)N&u>B%{Z-ivfOvk9j{)Gv2?(T;^1WCnhFnng90K;y zb;#GicRzmo^*vScj9 zeb}0duE>*Pb2DGH=R}*5aNy<`CZ$hxF z%KVee7xyhc!$R7tyj%UWHYoPmeyn?U=YUx>y2)cQkY!(UdR>H%Mc6uwmoycTrBn1( z#qweduMY`Ljd-4zklkHHFJizc*d3<_>EnwkxN9d=_G>~m+zl@O(PTXBZXn=_jRyLp zMc7W}8^s|wa=M&rTMeobQp!W2Q>>a$$0=|umrNF&VcKO_@2&9gTA^IgYmZicZiadR zJtI*j=|`x93@V##r#&93*eVzT)AIMFx;8x4(y5DmF35|#!P%~jFrph@jd&QHpYN`0 z2<6ZD@>h@(GB?cl%Np01V$sQ4Uuekkq6N8-!ugi6FTCXa= zt16pfl&VtoDJQzxSbC*67|h z7Nex|C-lEr;l5k?SQVYP`m^?P0*V<$v4q;-^SVU4t$*b?{&Y~WWzhE1WN#?HIOg%x zt#V$9J8{HGsI*jRKfsTw@#gT;D)-(dROX}~yOC(xyP$uKP2gnj}2+gWQ_#J*uhCLtUuMS*@uH*T!GMl!tjtc=IQd zFC~0pudNTu$xAi*&(t@p@<20NQ?xzL6}nPgSim-$Ln)b|&Yt{UXMZUCKVqInJa_v) zV!E2!Ly0skjjc`7dl1ExTw~G9sd4UIjogo4r$Avv5%FMK|vATRH2v}AXG zaP$guC!jGB7{}iuUtn&COq6SV(4ZRyNPh(RteKzg-nE+lq@egGxipXJdHxsDPhWbyR*kR7URw@U54W4qM{N$!hB`XyQwg<`Ofedy>Yb%V3 z>i75gXKV>arysMK7(o1&@|aOkmt)W$m^3;Mj3O~&Q0S6&32|v=)8c|pY(*t-67%Zm*5`jGwsNG<(~?3EP;V>mwGky7jAy;D&rBWY;9AXpCbPX21<+^b<82q4b>2!Za1($%xjdATWXB`>9H;2z!r+A8pJ(x$0v4!LQI>m|3f4st;4TWw3DY>l4Pp!2{szXWaYh* zI?BNvMnmROk;>u|~S3~#~fo_}xNCYtTfClt(LQNGUfys<<> z@}5_EZtsUB#3-Xaw~nOt$>SqCE$^+Fv$yLeQ3VAGIyRFIfxXog!~8gmXO*&an%myb zy-7$|bz-jg@injQ0zx`a5EJa;OOI;4?2{zEv7v~zvn@oZ#5lg&<2sS}+GRwzlsb54 zzhdv2mrlvv$^4n42P1wUiPRZ(B7QKnF}m{=-^8cH-s|PbI5Qs+c;zl3ZgZke1pjb- z+l5CRj^BUF(KWLmNv{s~Y}kfw1{fXWsyiZJ&}49W3u4>=G=mD@&NBWYE8ylg<+6?Ve4zH(sZ` z>#=o^>C!AhMKHFm^!jaX*`zryl8|Yh-gF;E?IFyERc$xKu@D z=dN4k^V6Z5LZZIFDNjAkgpHA>hodurnNJ7G!*QaiGOoPLr7WH`D}N*ZJ4w}%mfGk}i}al_ z?DuwPw_mz+vZ$@z9uAoY*NzK0ugEW%3~!%5Zw?up^Y<@P_S`v~JT`Qb0wm)s2x3*M zNCer+!4TAv#H3h)+d%7D$28bz;rzYXZ{>U^(`}&&QOT4- z#?3hS;+{QaF5~vDZ2c+2lZx^cXuvEz2PPs=(u96PUpEVfn)^_`GP@cE6=`?rxwlNf z9E_11~BX8GdVM@fU@nYr+t+y!> z`VEliLoYn!2Tp7Fu>S^{K{2SlIhx0}R^Y03j0l?fBjJ%N$QRykxb_vk%=jR9ve| zR)pX!%A5Wv&^tr(4E#6gI1mqRyM2gq_;9Pe(d~qn-+7{(WUmMbKfs}7n%tn`t3^-< z?Ln=KFXI_~W_1etMJbDJO+<_8h0spZw4gN8b3Dq-iv&HVrHNiTMA5im7`D&!8Ox7a zb$k4})aU*=aay#lB`!yTBRsrGUrTJVGnA;cGZY!@xg;H!4}#o2@S>i>)+kKcyuX}D zkB~}fqh0ltx&}AkPE;nYOo*X8Jy_exD2m%iPI` z+z;c-p1plR`l8cYS#dBoiSOn*S;p90PMQ(7AMbWTTp^2XBk~%b=|vI3ENy`Vvc zLxy6tfoh%A@~$bx*q^>dBpycjp6i638eitmz6EhNC#9RbL=ZZ>=rmvTbQ#n3rN2OC z?2WQE?A|H% zJzCy?s>jeHeOJfqL2lw6GsUN52T8ki2nYXD<`kdmy|3d?#Fl2Gte}qSS^3ZKaWARE z%~W?{p9OPf<0dBm<3I#cfZ7R?Qz}4oDu1)<*5i3Li*O^4l);5v&6R`m{aaByGK1b| zMryyvo%#H<@0R_dG@<1gb7KX)OgY`xt$!9169u~$AeHWeh@yOlC4)*fCbh&`^)`?8 zU6*Y>xzQ4OQnFQfUnUKJlV_~tha^|p&itMYPyXHO;~ zG43*wuO6p8rRDtCR{6ZG>>Pe5|R3mOI^%hC+9TVv!nf;!h#r84tyqGJ@QBQ=q;~? z)$ZLrhY06QxF1)&tBQv9s!Lhao9Plk^NlQVADHd%1_KUa8UHh21x1 z3|<|CUZPut7yW0e@jBT7{mv!5b-P7{VS|?vP_H{pnG-)v2pLDkrLuvo5L%)06xX$N zQS}1bT(isH5AD)sH8@!e+;WxstI2&-Uzx5GOdF$#IjTB#<(EbD= zslvXy?mL8Vo2qahlcu}THttx{QJ%){Ji*^HiuXO`wmdjmFVeLXzumMso=9L8UTyR{ zH|6>Ij>zMOHzT{FFW?DoF*5LO6pul3l*$cyuO3z(nV`Dp9#oQvr%k@mZ>-OqJ9 zCQ5B%Qc+3tjSA+K|K9j`1M=0HsnOV1*t}Ylj0d6=Nqf2P_jy=eH*5jXyj7krSrlJ+ zG6;=d=gCn2c5R#BG{~!6GB+ga19u&iE+zrXQUHnRc-hQ<+@uK8!;2S;kMvy(DTItX zG%KVfjNXy`SgY?VN(Hu6aV85pnYB)JKX@#c>G=7U^MhH?@{*?8NUTJJ2I|*uINvSgZE3gs*+JJF85ns-$pbloF2&pj&@~-?|hpoUD*wRh2RZ;d)HJ^zOvb zRNr$ba;7jyEc|Ixo0xL@GUNAv8YWVCC8@zwY@=c5-F3Rcb#qAY4tA!5T56R3k)z4T z5|dg(o$3kMOiK`H|J|{N<>PMH3W;b*@bRE(0YwJlf-peW!)8l*Cu1IHck#f<|yW?LO zJ(2ukLZT&i8jgk{50ia=lF*{+L;=0eF(_}zM6oqCBbq}}1my%t*u97xH=V43tYT%n zEAvlk+-3G#H+DbIn6C3p;Jx7_L|f|TLNX~^FFDayQGo`0!$>4twcRC2zOVV-r6{2< zDX^bxKAR}c56P5R+|cFuld&prPqyo3aX8VR)R_Utd;bgSd^LZw(d7670qqyrcdvkB z^1f(*+|!nmC!~2e@Z;Y~Tp+0XF7#3t=+FNz%8N%~F|Iv9At|NZ+1QPb=JvMd9^Mjv z@~a3Q$A?C(%oQf^pES)nmF+r}HSQQ<-?q7>kCb`r!9%JGM1YHoN>${#p48Gbry1N6 zS#E1~IR3rEahZG{*}W;NKM1*UX4C>C3W6HPgy5)pNkc>T=|HKwLA64BdsBV*P}MNr zZe@na2v&Sx2vE`KyBqt+ysynBjRx_6j%nOx#J0Yohm8YP>}9Fl%>aNpPIVQ?5snGH z{vqIC|O6zw5MwJF7B-3yAZ3j}0)& zcfn3v4%(NZx4mr_EXVcX7+gZ?Y155^(>gS<4*0He%%NR>G0zxBjNjpy_Qm(@HQ`g$ zToXWx8h8byau`Q-7&V_vcF`O$WarC@*1MGTS~iPb;8cMMz1+O!D_*-57&Iu|^ zC)D#hObKSqJ~MlQo4V(Z&nxIhn@UQ`+oe!-qpg!7nH%KPnz#^7hU=ub%J z!WDIYZU`>I%!yz@cO$lvhlI;~Mq^XVR;P6LilWo}&KV1`!&Y+6w9IJz6;Rf++|>i@ zeC4VhzlEw=`l1;boVDuzls`W4D-fD*jjaFWIsC->bG;t(v>T(iPbs^QD^1jtF(j*F}P zKFj#zo?R#Z-OniNS|uu9P+=eVL2h5(?GhoXqIMYj1cHf2n3X+fBZdvNHM3&kvGz^N zHOSfYm3FbSNzXjn*Y|)uj>mF~Bj^t&JK~u~v08XFgWGt_u zQ+o`SCRW%nJDi;c#~({)-J|7P6&an}wlk==OmRG15}I4zD7EcA|EZN&ES&ViXd8KD zja1o$!9Rx@r<{dW`3g!I^KiOz4(eJnKHpDX3Q5TZPbnryPi^_wK!LJ)tc`yg9p7q0 zuJBI5U~e_4RUNqNQ`KBdtZ$su>WMI@R!aHxhD7gN^8RbzvY9jn2W~xQw)a-$J>N5A zTt7`DUyNCfM=pNSrCOn>A~7^U&wj^2f8I&pNXpG()ibi8E}B_jmzu5wC*|Y=O5>}~ zKoTLUR@0}>u?61MsP)y-*6M72jw*cZsjNp&R$S_K6XbG7%j@v6%C2wrHyg;X?7+`! zeFEhPWSEN~$A47LFiiu+{*3zp{yftLlewKO=`P8yH`_zEM3&PZuI|ft;|=F;O<7u` zb(kvFH~mg{|NJ7Ca`x!eHy4&C(U%7sS!zlAH}R*vmAyfJ50Swf*29qY0{*%k6{eVx zg1IM5vKQ8EE*FRPBkp)0CB}KHNb0EGVFUYx=v=K*5ZOjslTMNm$UWJAGUd3{QnW@oHcK%aoL)F<4@7qqe_nA z1|`*W>BSNZ@aP{;|7HaLzx&TR3g-Vy$=Jw^N#7h9Rlr~y`Si#s0#zY^EdvTmphgAl z>Ut}N1NTI*?alxb|KV$^Yl(%~r_RntLVznF@D58<6P*LrA0GZ3akX8o9vBif?(o=a zo!&*;U!~)y=eTz2MTyPm@o}wtQL`4wnb*cIT1tU(u!BP$T5|T`hcShW>U!agVdIVX z0)tyKVL#+R+OeOwM!g}Rg>h#u?O3)q>h3$uzOtv9JC|pb{E&Kf;I%bxQqZ+gywS0M zmbFKR9TUN3S?I+*u*a}Eh$wDG-{6Z@c_)<4{&Y3mBqun#(1=%+DyMDDEqPtUD+MU5 zqGFEnTJAUEw0wvV10T3RhBcVcRto@-WTrlLj8s?r1}8;nZ@+goF*PTvi26l|+$WBk zlKq70cfRtUNS$%I z37^SY5iK~*VOuk}7D8W=9kPzMx&4-VYf^ZywgcAqP8sjev%mdbCErhb^b>Xw{G`1G zwhjnHeP&ngvOT{F$=iXvk{@mBGZ|T_0oMa+|CB%|ZQM(_7r!bhr>kTleLQAOZO6qH zrC%s-0XEMtoT_W8y;x*7eVlc>oXyWNnAU3>sMC8UWqM5+Pf4i_doYC3sSC{$Kp18uxiD1Kfy`mwCHa09l6-qm@}yEp62Wx?YlqRv z%a%{8pd`5#BF{bAkuqwRu_5Mq2PN==`AjjnsU3pwlqbus=%lD$@y-8}hZizbtDq>@ zBf%~)7hf?m`|L3qD>?p_X|)k873-$VsPSz#F@N5pw=sjMF&wfsvn&5~ZCWeD%m8n( zEiVyPtCQW&Il$_A!aw)oemYtbZ9G|Y^9hC*Zi|*D{H0p`PWj?!;C+b?du}$wl-!XS zY1>heHYM!|V*)lPvo^Ix`H;0APSezgzZKc;9-U%Nj9FFn`lYg`)49InU7V%clVzu` zgM(TXO)=YqpVcMA6Ak(EjwL^CS5qHA3j_@piL_He+`IRT6wM16r3^ShDW8<)Gvb3p zhMUWfEgu|M$xtIOGP}ObN^F&jC`Q-O@Mh02H-TnB-ewhix~nn71@O;*v~m5_WiC}L z^3nI!5yhp&EFH-;{$qmsBP?RT47}vo$k82YxHt-RjdVS$UH+3Sc`oi7%eKCcS(*}l zJCp<%Do2gelmD%nGmUC0+wypoKDD}pLJJWUkR>Xp3{fE{0!bAz6d;qzlweR1kRgOI zAwZxM6$Au9re=!FGl9qyLPE(PLVyTD7?Kbf!Vm}`5W<{y)%T&^>h9I6)~XNP-_E)p z&b@1&bN2b)y?=Xu75(1vo1|}p-v2Gt1$dqP)d6!hV8Brxf`x=Mrs;*Z3cn@G{syN5 zoR+`nwK5COZFDSy_D=!1rlLnMwiCc7k%9peZD1;_ZYpL~D#b8+xCgAqNaUBfN>#^z zy>E$3RKZ^G!#q!`xbdt+`)U4tv@JiGaYNRU3z+HQ4?Q)uzKnAI!0o?}LZWpSLvB-| zt6C`msCM_r>mSzM^ilT>CpZ0!Yp+hnpx81A5uXq=csG>1C63rS`IHe`vZ!I=pL7LK zla{ES^CoNc;QKH%*9UprnRO>=P>i)piRbG)R!!QN-@-K9$(4rfkD6-fYX}XAt|t&w zNZAopX$l?Vi>{fH5gQFxN_GP(r=aN5Sf@FlqLc6CZlKjWc zd$SBVY8S<6BsK6&UhU<1%@^85hIrHEHF04F64+3a)Fo$p$-E8wH%ufFTVu{sY?NYE zi`Sr5CMz}HK%hDJW1j|ll(3-!E~JsX6N&Kk-yq6!z(1ng(0G_Fd3TCL7d$_d4#Ge0uUC{i2hk&V2qtfSsmSioXs8aB8yeeq;hb8@wT1zsqq z5o3kw$E?oV(dq?I9^5v4rGGVX{WGWTHFKF;epfd0B__?X8%Uj`t=W8BG{&`GU^~4) z$oI}?hDGgrXQP7&WhTpGv_EIe+|77oiS=8c@c@s;W04Fx@JV7J6ReF64SXw*3IBbh zIM?qiy(ygBUM{^Cb!rcw|F%8VD$dPrgf4@cFNej*+!Kra3PAb%-yos>Uaso@^=$X% z1_`#WfRpnJ^2ygGa=`Gl=HE~c@Ym7Yf7$Wd`DpJeH&QGc5jt&H0BzsOoY$Q}Kh0dc zKz)%W!RO$$A=^uiN}Zkk+h@z|SEeYzoE;kc{+F(8^?&>$E+Jl>dd4Wr^|D#A3#-gU zFCB_nc>QZQ6EpLA3gq_ZLUcd}?U4-mJzW;NJFo|3-zIWWSi3_r|s_z;nHGF+#NBJvO|Q z*NR?IEvZ*5P#HR`$<{LH&Lo#&x)!Q`GrQu?WlD?5thXCfz~w_XQ6P~3Mc4J8D?ZJ2 zKmKJA`&|>aXXlrjb7@eP_7apkPE@?Y$xCWe3{dI(K)#?36sE2*vv{ye+2PiX*H>$@ zQrQ7aRI_w`KzXXq&I3x>@&&`p-A&@|mG{dzZ^wN5t`*&Co0s8`tUv^D4}u5g#z$sY ziD_>ogLtO6DF9El6)e^NB#dH|7NW~jM|@(cnqLea?OteD6s8(RAL6NZ;ua*O*QU5_L_GGhRcFF^PH+HwSjFWp_ve#N~&J zfDszYdMk$*6QKcoUV2Mg?*t8cRDn8i00&1PmRrIPHihl}lADK+Lo`*LK{XxXr^S67 zOdTk;*T)VY5G~D~Iq2X#_#71WGo!S|yvKeJoFsxX9Z!kmKWaK8CO56r)ZRqe9c8n5 zQ|eIjU?fH)-X7<`0G_aN#wX0SHk)d$g!UbC z!So+ZTQBBz98C3~_xSd*gUZtc_hv_-y(4Nmjiee2j((MJ=)ASsehGOXnE1Ykyhwrn zFufbDH}9}zLJe46iQ_ocR9CV5!%SklrOFVeL$9E{Q{FGV?>Uc?q}d{eiy6S3mO|W& zNjM-8p)1^34wph!cqREK*&JdP#J`O9ih`h7O;6Vj6mr)F2G&Q{96*|J#PM0a6a^}_^zzsc@+DaVDr$FB*~(hFk2qGA4Upo*ny*uOC7s7fibD@BJ(NR7xma>u-C+gqOHqSw|A0gr)Y56=o=iHg={myQ9gRZfo#N zkylvF)lTu&f-;pGM0%MCua$Rw!_U!)ZS8J@pI2X%reGhR13YNrfNNr+gAve-&hp%w zPpArtZ6wH)9)&ko3p9`Re^*Xp68jzv1S>04xKn4I6&zNgjdrLrZa=OdHqP`P?yWan zEMT-0CQql}>`!``dG?JJ-jXNSdJIJQwJgjWcNE(Dbq%ZBXAvrnUO}w%pkSPk?U}?n zj1d76sy}dzde?%~MR2-*x@`RR=;nl8#t7zSBo3-i#;D9cN1eQ#1iG7vq8NGhgwm|s zzH12isNNKM73$u#-Q>(|#Ag+mgcJ2Uj*z(U2{GgA-%2^}&(-P)RaFgD0b!Ct42n%i zD19)Ja`}k?1mhSz-K2w^Bu0*%CSWhu3M#b;Fx@rS#F36dD#Yh<&c>3*iKKbRCIF=$ z4v|uYXhu;K8}laZvaVK6R7O&$*e7$Xdz>;yNShPq2O(HLNuTlg4)vg4neS3)B6@}{ ztA2J8u5g=>cL)o&xN7imt3gw0D;AnB@N9q#1>5*Pqy%}xcM?Cul3J>7X@dNLYDRMl zl^&vadZQ=5pc}4ml3R_lDrx9m&Gr>u1QzqmKv?3D@o+A5GE3yUzf{`Xr|l{zX4+g-JE37LI}jbClGma0tkpNOh+XNofHLti_bjCeCygfjZi zCdwT>^zkgn;lo;UkLLUq$*iCp&$m!vRGb85cV}30unvd&V2#PT%3nx2GCtRWe<&mM z)I6msdz!70tEzl!;X;YK_t>Q{yLDoD60VaFtR$W}apdSJl^s0dS}k()wtb(+UD!e# zU%~ng5DPFq_zga7&RW+q8`CLCWm}s)T}yFwg|4kjx)*%^@L~HwAnw2oS^XNTO!%J_ z+z}mjStxKLJspff5K;IvQh&$kr1nx5;KqNdw4U<4Dm&;wa|sTbEXtd*qCbcY z@%bgf>T?!IUt;#(l#1EZ`%%i`E?0GX7P$4*EZ^pS0dg%>_Y?nmq~O2lSsZmp1WnG` WI3iZ{$QzjVJ7WWL{R+LikN*kl&7P+K literal 0 HcmV?d00001 From cc0364cdc2779def4975a6fa82910a63f1f08af0 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 1 Dec 2020 13:13:20 -0800 Subject: [PATCH 044/169] Added DataCollection and EventLog policies --- windows/client-management/mdm/TOC.md | 2 + .../mdm/policies-in-policy-csp-admx-backed.md | 22 + .../policy-configuration-service-provider.md | 76 + .../mdm/policy-csp-admx-datacollection.md | 114 ++ .../mdm/policy-csp-admx-eventlog.md | 1588 +++++++++++++++++ 5 files changed, 1802 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-datacollection.md create mode 100644 windows/client-management/mdm/policy-csp-admx-eventlog.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 559f7b27a5..5bfb5277ba 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -181,6 +181,7 @@ #### [ADMX_Cpls](policy-csp-admx-cpls.md) #### [ADMX_CredSsp](policy-csp-admx-credssp.md) #### [ADMX_CtrlAltDel](policy-csp-admx-ctrlaltdel.md) +#### [ADMX_DataCollection](policy-csp-admx-datacollection.md) #### [ADMX_DeviceInstallation](policy-csp-admx-devicenstallation.md) #### [ADMX_DeviceSetup](policy-csp-admx-devicesetup.md) #### [ADMX_DigitalLocker](policy-csp-admx-digitallocker.md) @@ -191,6 +192,7 @@ #### [ADMX_EnhancedStorage](policy-csp-admx-enhancedstorage.md) #### [ADMX_ErrorReporting](policy-csp-admx-errorreporting.md) #### [ADMX_EventForwarding](policy-csp-admx-eventforwarding.md) +#### [ADMX_EventLog](policy-csp-admx-eventlog.md) #### [ADMX_FileServerVSSProvider](policy-csp-admx-fileservervssprovider.md) #### [ADMX_FileSys](policy-csp-admx-filesys.md) #### [ADMX_FolderRedirection](policy-csp-admx-folderredirection.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 4d5d2f3728..a866b983b9 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -76,6 +76,7 @@ ms.date: 10/08/2020 - [ADMX_CtrlAltDel/DisableLockComputer](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disablelockcomputer) - [ADMX_CtrlAltDel/DisableTaskMgr](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disabletaskmgr) - [ADMX_CtrlAltDel/NoLogoff](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-nologoff) +- [ADMX_DataCollection/CommercialIdPolicy](./policy-csp-admx-datacollection.md#admx-datacollection-commercialidpolicy) - [ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-allowadmininstall) - [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-detailtext) - [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-simpletext) @@ -166,6 +167,27 @@ ms.date: 10/08/2020 - [ADMX_ErrorReporting/WerQueue_2](./policy-csp-admx-errorreporting.md#admx-errorreporting-werqueue-2) - [ADMX_EventForwarding/ForwarderResourceUsage](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-forwarderresourceusage) - [ADMX_EventForwarding/SubscriptionManager](./policy-csp-admx-eventforwarding.md#admx_eventforwarding-subscriptionmanager) +- [ADMX_EventLog/Channel_LogEnabled](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logenabled) +- [ADMX_EventLog/Channel_LogFilePath_1](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-1) +- [ADMX_EventLog/Channel_LogFilePath_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-2) +- [ADMX_EventLog/Channel_LogFilePath_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-3) +- [ADMX_EventLog/Channel_LogFilePath_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logfilepath-4) +- [ADMX_EventLog/Channel_LogMaxSize_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-logmaxsize-3) +- [ADMX_EventLog/Channel_Log_AutoBackup_1](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-1) +- [ADMX_EventLog/Channel_Log_AutoBackup_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-2) +- [ADMX_EventLog/Channel_Log_AutoBackup_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-3) +- [ADMX_EventLog/Channel_Log_AutoBackup_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-autobackup-4) +- [ADMX_EventLog/Channel_Log_FileLogAccess_1](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-1) +- [ADMX_EventLog/Channel_Log_FileLogAccess_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-2) +- [ADMX_EventLog/Channel_Log_FileLogAccess_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-3) +- [ADMX_EventLog/Channel_Log_FileLogAccess_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-4) +- [ADMX_EventLog/Channel_Log_FileLogAccess_5](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-5) +- [ADMX_EventLog/Channel_Log_FileLogAccess_6](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-6) +- [ADMX_EventLog/Channel_Log_FileLogAccess_7](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-7) +- [ADMX_EventLog/Channel_Log_FileLogAccess_8](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-filelogaccess-8) +- [ADMX_EventLog/Channel_Log_Retention_2](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-2) +- [ADMX_EventLog/Channel_Log_Retention_3](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-3) +- [ADMX_EventLog/Channel_Log_Retention_4](./policy-csp-admx-eventlog.md#admx-eventlog-channel-log-retention-4) - [ADMX_FileServerVSSProvider/Pol_EncryptProtocol](./policy-csp-admx-fileservervssprovider.md#admx-fileservervssprovider-pol-encryptprotocol) - [ADMX_FileSys/DisableCompression](./policy-csp-admx-filesys.md#admx-filesys-disablecompression) - [ADMX_FileSys/DisableDeleteNotification](./policy-csp-admx-filesys.md#admx-filesys-disabledeletenotification) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 9a2bc98925..4a90062fe4 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -377,6 +377,14 @@ The following diagram shows the Policy configuration service provider in tree fo +### ADMX_DataCollection policies + +
+
+ ADMX_DataCollection/CommercialIdPolicy +
+
+ ### ADMX_DeviceInstallation policies
@@ -695,6 +703,74 @@ The following diagram shows the Policy configuration service provider in tree fo
+### ADMX_EventLog policies + +
+
+ ADMX_EventLog/Channel_LogEnabled +
+
+ ADMX_EventLog/Channel_LogFilePath_1 +
+
+ ADMX_EventLog/Channel_LogFilePath_2 +
+
+ ADMX_EventLog/Channel_LogFilePath_3 +
+
+ ADMX_EventLog/Channel_LogFilePath_4 +
+
+ ADMX_EventLog/Channel_LogMaxSize_3 +
+
+ ADMX_EventLog/Channel_Log_AutoBackup_1 +
+
+ ADMX_EventLog/Channel_Log_AutoBackup_2 +
+
+ ADMX_EventLog/Channel_Log_AutoBackup_3 +
+
+ ADMX_EventLog/Channel_Log_AutoBackup_4 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_1 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_2 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_3 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_4 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_5 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_6 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_7 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_8 +
+
+ ADMX_EventLog/Channel_Log_Retention_2 +
+
+ ADMX_EventLog/Channel_Log_Retention_3 +
+
+ ADMX_EventLog/Channel_Log_Retention_4 +
+
+ ### ADMX_FileServerVSSProvider policies
diff --git a/windows/client-management/mdm/policy-csp-admx-datacollection.md b/windows/client-management/mdm/policy-csp-admx-datacollection.md new file mode 100644 index 0000000000..06baf9787a --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-datacollection.md @@ -0,0 +1,114 @@ +--- +title: Policy CSP - ADMX_DataCollection +description: Policy CSP - ADMX_DataCollection +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/01/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_DataCollection +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_DataCollection policies + +
+
+ ADMX_DataCollection/CommercialIdPolicy +
+
+ + +
+ + +**ADMX_DataCollection/CommercialIdPolicy** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting defines the identifier used to uniquely associate this device’s telemetry data as belonging to a given organization. + +If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. + +If you disable or do not configure this policy setting, then Microsoft will not be able to use this identifier to associate this machine and its telemetry data with your organization. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure the Commercial ID* +- GP name: *CommercialIdPolicy* +- GP path: *Windows Components\Data Collection and Preview Builds* +- GP ADMX file name: *DataCollection.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-eventlog.md b/windows/client-management/mdm/policy-csp-admx-eventlog.md new file mode 100644 index 0000000000..97b2384e47 --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-eventlog.md @@ -0,0 +1,1588 @@ +--- +title: Policy CSP - ADMX_EventLog +description: Policy CSP - ADMX_EventLog +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/01/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_EventLog +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_EventLog policies + +
+
+ ADMX_EventLog/Channel_LogEnabled +
+
+ ADMX_EventLog/Channel_LogFilePath_1 +
+
+ ADMX_EventLog/Channel_LogFilePath_2 +
+
+ ADMX_EventLog/Channel_LogFilePath_3 +
+
+ ADMX_EventLog/Channel_LogFilePath_4 +
+
+ ADMX_EventLog/Channel_LogMaxSize_3 +
+
+ ADMX_EventLog/Channel_Log_AutoBackup_1 +
+
+ ADMX_EventLog/Channel_Log_AutoBackup_2 +
+
+ ADMX_EventLog/Channel_Log_AutoBackup_3 +
+
+ ADMX_EventLog/Channel_Log_AutoBackup_4 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_1 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_2 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_3 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_4 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_5 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_6 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_7 +
+
+ ADMX_EventLog/Channel_Log_FileLogAccess_8 +
+
+ ADMX_EventLog/Channel_Log_Retention_2 +
+
+ ADMX_EventLog/Channel_Log_Retention_3 +
+
+ ADMX_EventLog/Channel_Log_Retention_4 +
+
+ + +
+ + +**ADMX_EventLog/Channel_LogEnabled** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting turns on logging. + +If you enable or do not configure this policy setting, then events can be written to this log. + +If the policy setting is disabled, then no new events can be logged. Events can always be read from the log, regardless of this policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on logging* +- GP name: *Channel_LogEnabled* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_LogFilePath_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators. + +If you enable this policy setting, the Event Log uses the path specified in this policy setting. + +If you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\System32\winevt\Logs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control the location of the log file* +- GP name: *Channel_LogFilePath_1* +- GP path: *Windows Components\Event Log Service\Application* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_LogFilePath_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators. + +If you enable this policy setting, the Event Log uses the path specified in this policy setting. + +If you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\System32\winevt\Logs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control the location of the log file* +- GP name: *Channel_LogFilePath_2* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_LogFilePath_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators. + +If you enable this policy setting, the Event Log uses the path specified in this policy setting. + +If you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\System32\winevt\Logs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control the location of the log file* +- GP name: *Channel_LogFilePath_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_LogFilePath_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls the location of the log file. The location of the file must be writable by the Event Log service and should only be accessible to administrators. + +If you enable this policy setting, the Event Log uses the path specified in this policy setting. + +If you disable or do not configure this policy setting, the Event Log uses the folder %SYSTEMROOT%\System32\winevt\Logs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn on logging* +- GP name: *Channel_LogFilePath_4* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_LogMaxSize_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the maximum size of the log file in kilobytes. + +If you enable this policy setting, you can configure the maximum log file size to be between 1 megabyte (1024 kilobytes) and 2 terabytes (2147483647 kilobytes), in kilobyte increments. + +If you disable or do not configure this policy setting, the maximum size of the log file will be set to the locally configured value. This value can be changed by the local administrator using the Log Properties dialog, and it defaults to 1 megabyte. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Specify the maximum log file size (KB)* +- GP name: *Channel_LogMaxSize_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_AutoBackup_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled. + +If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started. + +If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained. + +If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Back up log automatically when full* +- GP name: *Channel_Log_AutoBackup_1* +- GP path: *Windows Components\Event Log Service\Application* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_AutoBackup_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled. + +If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started. + +If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained. + +If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Back up log automatically when full* +- GP name: *Channel_Log_AutoBackup_2* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_AutoBackup_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled. + +If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started. + +If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained. + +If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Back up log automatically when full* +- GP name: *Channel_Log_AutoBackup_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_AutoBackup_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size and takes effect only if the "Retain old events" policy setting is enabled. + +If you enable this policy setting and the "Retain old events" policy setting is enabled, the Event Log file is automatically closed and renamed when it is full. A new file is then started. + +If you disable this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and old events are retained. + +If you do not configure this policy setting and the "Retain old events" policy setting is enabled, new events are discarded and the old events are retained. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Back up log automatically when full* +- GP name: *Channel_Log_AutoBackup_4* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_FileLogAccess_1** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. + +If you enable this policy setting, only those users matching the security descriptor can access the log. + +If you disable or do not configure this policy setting, all authenticated users and system services can write, read, or clear this log. + +> [!NOTE] +> If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access* +- GP name: *Channel_Log_FileLogAccess_1* +- GP path: *Windows Components\Event Log Service\Application* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_FileLogAccess_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You cannot configure write permissions for this log. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools. + +If you enable this policy setting, only those users whose security descriptor matches the configured specified value can access the log. + +If you disable or do not configure this policy setting, only system software and administrators can read or clear this log. + +> [!NOTE] +> If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access* +- GP name: *Channel_Log_FileLogAccess_2* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_FileLogAccess_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. + +If you enable this policy setting, only those users matching the security descriptor can access the log. + +If you disable or do not configure this policy setting, all authenticated users and system services can write, read, or clear this log. + +> [!NOTE] +> If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access* +- GP name: *Channel_Log_FileLogAccess_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_FileLogAccess_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools. + +If you enable this policy setting, only users whose security descriptor matches the configured value can access the log. + +If you disable or do not configure this policy setting, only system software and administrators can write or clear this log, and any authenticated user can read events from it. + +> [!NOTE] +> If you enable this policy setting, some tools and APIs may ignore it. The same change should be made to the "Configure log access (legacy)" policy setting to enforce this change across all tools and APIs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access* +- GP name: *Channel_Log_FileLogAccess_4* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_FileLogAccess_5** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools. + +If you enable this policy setting, only those users matching the security descriptor can access the log. + +If you disable this policy setting, all authenticated users and system services can write, read, or clear this log. + +If you do not configure this policy setting, the previous policy setting configuration remains in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access (legacy)* +- GP name: *Channel_Log_FileLogAccess_5* +- GP path: *Windows Components\Event Log Service\Application* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_FileLogAccess_6** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You cannot configure write permissions for this log. + +If you enable this policy setting, only those users whose security descriptor matches the configured specified value can access the log. + +If you disable this policy setting, only system software and administrators can read or clear this log. + +If you do not configure this policy setting, the previous policy setting configuration remains in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access (legacy)* +- GP name: *Channel_Log_FileLogAccess_6* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_FileLogAccess_7** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. You must set both "configure log access" policy settings for this log in order to affect the both modern and legacy tools. + +If you enable this policy setting, only those users matching the security descriptor can access the log. + +If you disable this policy setting, all authenticated users and system services can write, read, or clear this log. + +If you do not configure this policy setting, the previous policy setting configuration remains in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access (legacy)* +- GP name: *Channel_Log_FileLogAccess_7* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_FileLogAccess_8** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the security descriptor to use for the log using the Security Descriptor Definition Language (SDDL) string. + +If you enable this policy setting, only users whose security descriptor matches the configured value can access the log. + +If you disable this policy setting, only system software and administrators can write or clear this log, and any authenticated user can read events from it. + +If you do not configure this policy setting, the previous policy setting configuration remains in effect. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Configure log access (legacy)* +- GP name: *Channel_Log_FileLogAccess_8* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_Retention_2** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size. + +If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost. + +If you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events. + +Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control Event Log behavior when the log file reaches its maximum size* +- GP name: *Channel_Log_Retention_2* +- GP path: *Windows Components\Event Log Service\Security* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_Retention_3** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size. + +If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost. + +If you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events. + +Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control Event Log behavior when the log file reaches its maximum size* +- GP name: *Channel_Log_Retention_3* +- GP path: *Windows Components\Event Log Service\Setup* +- GP ADMX file name: *EventLog.admx* + + + +
+ + +**ADMX_EventLog/Channel_Log_Retention_4** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting controls Event Log behavior when the log file reaches its maximum size. + +If you enable this policy setting and a log file reaches its maximum size, new events are not written to the log and are lost. + +If you disable or do not configure this policy setting and a log file reaches its maximum size, new events overwrite old events. + +Note: Old events may or may not be retained according to the "Backup log automatically when full" policy setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Control Event Log behavior when the log file reaches its maximum size* +- GP name: *Channel_Log_Retention_4* +- GP path: *Windows Components\Event Log Service\System* +- GP ADMX file name: *EventLog.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From 1d464ea3686bdfa9eb7f09facedade47ae51ebd4 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 1 Dec 2020 15:01:48 -0800 Subject: [PATCH 045/169] Added SettingSync and Programs policies --- windows/client-management/mdm/TOC.md | 2 + .../mdm/policies-in-policy-csp-admx-backed.md | 16 + .../policy-configuration-service-provider.md | 58 ++ .../mdm/policy-csp-admx-programs.md | 568 ++++++++++++++ .../mdm/policy-csp-admx-settingsync.md | 706 ++++++++++++++++++ 5 files changed, 1350 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-programs.md create mode 100644 windows/client-management/mdm/policy-csp-admx-settingsync.md diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 5bfb5277ba..639e9356c0 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -213,12 +213,14 @@ #### [ADMX_PeerToPeerCaching](policy-csp-admx-peertopeercaching.md) #### [ADMX_PerformanceDiagnostics](policy-csp-admx-performancediagnostics.md) #### [ADMX_PowerShellExecutionPolicy](policy-csp-admx-powershellexecutionpolicy.md) +#### [ADMX_Programs](policy-csp-admx-programs.md) #### [ADMX_Reliability](policy-csp-admx-reliability.md) #### [ADMX_Scripts](policy-csp-admx-scripts.md) #### [ADMX_sdiageng](policy-csp-admx-sdiageng.md) #### [ADMX_Securitycenter](policy-csp-admx-securitycenter.md) #### [ADMX_Sensors](policy-csp-admx-sensors.md) #### [ADMX_Servicing](policy-csp-admx-servicing.md) +#### [ADMX_SettingSync](policy-csp-admx-settingsync.md) #### [ADMX_SharedFolders](policy-csp-admx-sharedfolders.md) #### [ADMX_Sharing](policy-csp-admx-sharing.md) #### [ADMX_ShellCommandPromptRegEditTools](policy-csp-admx-shellcommandpromptregedittools.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index a866b983b9..b04813d319 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -482,6 +482,13 @@ ms.date: 10/08/2020 - [ADMX_PowerShellExecutionPolicy/EnableScripts](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enablescripts) - [ADMX_PowerShellExecutionPolicy/EnableTranscripting](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enabletranscripting) - [ADMX_PowerShellExecutionPolicy/EnableUpdateHelpDefaultSourcePath](./policy-csp-admx-powershellexecutionpolicy.md#admx-powershellexecutionpolicy-enableupdatehelpdefaultsourcepath) +- [ADMX_Programs/NoDefaultPrograms](./policy-csp-admx-programs.md#admx-programs-nodefaultprograms) +- [ADMX_Programs/NoGetPrograms](./policy-csp-admx-programs.md#admx-programs-nogetprograms) +- [ADMX_Programs/NoInstalledUpdates](./policy-csp-admx-programs.md#admx-programs-noinstalledupdates) +- [ADMX_Programs/NoProgramsAndFeatures](./policy-csp-admx-programs.md#admx-programs-noprogramsandfeatures) +- [ADMX_Programs/NoProgramsCPL](./policy-csp-admx-programs.md#admx-programs-noprogramscpl) +- [ADMX_Programs/NoWindowsFeatures](./policy-csp-admx-programs.md#admx-programs-nowindowsfeatures) +- [ADMX_Programs/NoWindowsMarketplace](./policy-csp-admx-programs.md#admx-programs-nowindowsmarketplace) - [ADMX_Reliability/EE_EnablePersistentTimeStamp](./policy-csp-admx-reliability.md#admx-reliability-ee-enablepersistenttimestamp) - [ADMX_Reliability/PCH_ReportShutdownEvents](./policy-csp-admx-reliability.md#admx-reliability-pch-reportshutdownevents) - [ADMX_Reliability/ShutdownEventTrackerStateFile](./policy-csp-admx-reliability.md#admx-reliability-shutdowneventtrackerstatefile) @@ -508,6 +515,15 @@ ms.date: 10/08/2020 - [ADMX_Sensors/DisableSensors_1](./policy-csp-admx-sensors.md#admx-sensors-disablesensors-1) - [ADMX_Sensors/DisableSensors_2](./policy-csp-admx-sensors.md#admx-sensors-disablesensors-2) - [ADMX_Servicing/Servicing](./policy-csp-admx-servicing.md#admx-servicing-servicing) +- [ADMX_SettingSync/DisableAppSyncSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disableappsyncsettingsync) +- [ADMX_SettingSync/DisableApplicationSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disableapplicationsettingsync) +- [ADMX_SettingSync/DisableCredentialsSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablecredentialssettingsync) +- [ADMX_SettingSync/DisableDesktopThemeSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disabledesktopthemesettingsync) +- [ADMX_SettingSync/DisablePersonalizationSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablepersonalizationsettingsync) +- [ADMX_SettingSync/DisableSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablesettingsync) +- [ADMX_SettingSync/DisableStartLayoutSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablestartlayoutsettingsync) +- [ADMX_SettingSync/DisableSyncOnPaidNetwork](./policy-csp-admx-settingsync.md#admx-settingsync-disablesynconpaidnetwork) +- [ADMX_SettingSync/DisableWindowsSettingSync](./policy-csp-admx-settingsync.md#admx-settingsync-disablewindowssettingsync) - [ADMX_SharedFolders/PublishDfsRoots](./policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishdfsroots) - [ADMX_SharedFolders/PublishSharedFolders](./policy-csp-admx-sharedfolders.md#admx-sharedfolders-publishsharedfolders) - [ADMX_Sharing/NoInplaceSharing](./policy-csp-admx-sharing.md#admx-sharing-noinplacesharing) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 4a90062fe4..8a993d4783 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -1740,6 +1740,32 @@ The following diagram shows the Policy configuration service provider in tree fo
+### ADMX_Programs policies + +
+
+ ADMX_Programs/NoDefaultPrograms +
+
+ ADMX_Programs/NoGetPrograms +
+
+ ADMX_Programs/NoInstalledUpdates +
+
+ ADMX_Programs/NoProgramsAndFeatures +
+
+ ADMX_Programs/NoProgramsCPL +
+
+ ADMX_Programs/NoWindowsFeatures +
+
+ ADMX_Programs/NoWindowsMarketplace +
+
+ ### ADMX_Reliability policies
@@ -1848,6 +1874,38 @@ The following diagram shows the Policy configuration service provider in tree fo
+### ADMX_SettingSync policies + +
+
+ ADMX_SettingSync/DisableAppSyncSettingSync +
+
+ ADMX_SettingSync/DisableApplicationSettingSync +
+
+ ADMX_SettingSync/DisableCredentialsSettingSync +
+
+ ADMX_SettingSync/DisableDesktopThemeSettingSync +
+
+ ADMX_SettingSync/DisablePersonalizationSettingSync +
+
+ ADMX_SettingSync/DisableSettingSync +
+
+ ADMX_SettingSync/DisableStartLayoutSettingSync +
+
+ ADMX_SettingSync/DisableSyncOnPaidNetwork +
+
+ ADMX_SettingSync/DisableWindowsSettingSync +
+
+ ### ADMX_SharedFolders policies
diff --git a/windows/client-management/mdm/policy-csp-admx-programs.md b/windows/client-management/mdm/policy-csp-admx-programs.md new file mode 100644 index 0000000000..97697da52b --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-programs.md @@ -0,0 +1,568 @@ +--- +title: Policy CSP - ADMX_Programs +description: Policy CSP - ADMX_Programs +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/01/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Programs +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_Programs policies + +
+
+ ADMX_Programs/NoDefaultPrograms +
+
+ ADMX_Programs/NoGetPrograms +
+
+ ADMX_Programs/NoInstalledUpdates +
+
+ ADMX_Programs/NoProgramsAndFeatures +
+
+ ADMX_Programs/NoProgramsCPL +
+
+ ADMX_Programs/NoWindowsFeatures +
+
+ ADMX_Programs/NoWindowsMarketplace +
+
+ + +
+ + +**ADMX_Programs/NoDefaultPrograms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This setting removes the Set Program Access and Defaults page from the Programs Control Panel. As a result, users cannot view or change the associated page. + +The Set Program Access and Computer Defaults page allows administrators to specify default programs for certain activities, such as Web browsing or sending e-mail, as well as specify the programs that are accessible from the Start menu, desktop, and other locations. + +If this setting is disabled or not configured, the Set Program Access and Defaults button is available to all users. + +This setting does not prevent users from using other tools and methods to change program access or defaults. + +This setting does not prevent the Default Programs icon from appearing on the Start menu. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Set Program Access and Computer Defaults" page* +- GP name: *NoDefaultPrograms* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
+ + +**ADMX_Programs/NoGetPrograms** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from viewing or installing published programs from the network. + +This setting prevents users from accessing the "Get Programs" page from the Programs Control Panel in Category View, Programs and Features in Classic View and the "Install a program from the network" task. The "Get Programs" page lists published programs and provides an easy way to install them. + +Published programs are those programs that the system administrator has explicitly made available to the user with a tool such as Windows Installer. Typically, system administrators publish programs to notify users of their availability, to recommend their use, or to enable users to install them without having to search for installation files. + +If this setting is enabled, users cannot view the programs that have been published by the system administrator, and they cannot use the "Get Programs" page to install published programs. Enabling this feature does not prevent users from installing programs by using other methods. Users will still be able to view and installed assigned (partially installed) programs that are offered on the desktop or on the Start menu. + +If this setting is disabled or is not configured, the "Install a program from the network" task to the "Get Programs" page will be available to all users. + +> [!NOTE] +> If the "Hide Programs Control Panel" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Get Programs" page* +- GP name: *NoGetPrograms* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
+ + +**ADMX_Programs/NoInstalledUpdates** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from accessing "Installed Updates" page from the "View installed updates" task. + +"Installed Updates" allows users to view and uninstall updates currently installed on the computer. The updates are often downloaded directly from Windows Update or from various program publishers. + +If this setting is disabled or not configured, the "View installed updates" task and the "Installed Updates" page will be available to all users. + +This setting does not prevent users from using other tools and methods to install or uninstall programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Installed Updates" page* +- GP name: *NoInstalledUpdates* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
+ + +**ADMX_Programs/NoProgramsAndFeatures** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from accessing "Programs and Features" to view, uninstall, change, or repair programs that are currently installed on the computer. + +If this setting is disabled or not configured, "Programs and Features" will be available to all users. + +This setting does not prevent users from using other tools and methods to view or uninstall programs. It also does not prevent users from linking to related Programs Control Panel Features including Windows Features, Get Programs, or Windows Marketplace. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Programs and Features" page* +- GP name: *NoProgramsAndFeatures* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
+ + +**ADMX_Programs/NoProgramsCPL** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from using the Programs Control Panel in Category View and Programs and Features in Classic View. + +The Programs Control Panel allows users to uninstall, change, and repair programs, enable and disable Windows Features, set program defaults, view installed updates, and purchase software from Windows Marketplace. Programs published or assigned to the user by the system administrator also appear in the Programs Control Panel. + +If this setting is disabled or not configured, the Programs Control Panel in Category View and Programs and Features in Classic View will be available to all users. + +When enabled, this setting takes precedence over the other settings in this folder. + +This setting does not prevent users from using other tools and methods to install or uninstall programs. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide the Programs Control Panel* +- GP name: *NoProgramsCPL* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
+ + +**ADMX_Programs/NoWindowsFeatures** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from accessing the "Turn Windows features on or off" task from the Programs Control Panel in Category View, Programs and Features in Classic View, and Get Programs. As a result, users cannot view, enable, or disable various Windows features and services. + +If this setting is disabled or is not configured, the "Turn Windows features on or off" task will be available to all users. + +This setting does not prevent users from using other tools and methods to configure services or enable or disable program components. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Windows Features"* +- GP name: *NoWindowsFeatures* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
+ + +**ADMX_Programs/NoWindowsMarketplace** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This setting prevents users from access the "Get new programs from Windows Marketplace" task from the Programs Control Panel in Category View, Programs and Features in Classic View, and Get Programs. + +Windows Marketplace allows users to purchase and/or download various programs to their computer for installation. + +Enabling this feature does not prevent users from navigating to Windows Marketplace using other methods. + +If this feature is disabled or is not configured, the "Get new programs from Windows Marketplace" task link will be available to all users. + +> [!NOTE] +> If the "Hide Programs control Panel" setting is enabled, this setting is ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide "Windows Marketplace"* +- GP name: *NoWindowsMarketplace* +- GP path: *Control Panel\Programs* +- GP ADMX file name: *Programs.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + diff --git a/windows/client-management/mdm/policy-csp-admx-settingsync.md b/windows/client-management/mdm/policy-csp-admx-settingsync.md new file mode 100644 index 0000000000..42b649433b --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-settingsync.md @@ -0,0 +1,706 @@ +--- +title: Policy CSP - ADMX_SettingSync +description: Policy CSP - ADMX_SettingSync +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/01/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_SettingSync +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_SettingSync policies + +
+
+ ADMX_SettingSync/DisableAppSyncSettingSync +
+
+ ADMX_SettingSync/DisableApplicationSettingSync +
+
+ ADMX_SettingSync/DisableCredentialsSettingSync +
+
+ ADMX_SettingSync/DisableDesktopThemeSettingSync +
+
+ ADMX_SettingSync/DisablePersonalizationSettingSync +
+
+ ADMX_SettingSync/DisableSettingSync +
+
+ ADMX_SettingSync/DisableStartLayoutSettingSync +
+
+ ADMX_SettingSync/DisableSyncOnPaidNetwork +
+
+ ADMX_SettingSync/DisableWindowsSettingSync +
+
+ + +
+ + +**ADMX_SettingSync/DisableAppSyncSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "AppSync" group from syncing to and from this PC. This turns off and disables the "AppSync" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "AppSync" group will not be synced. + +Use the option "Allow users to turn app syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "AppSync" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync Apps* +- GP name: *DisableAppSyncSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
+ + +**ADMX_SettingSync/DisableApplicationSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "app settings" group from syncing to and from this PC. This turns off and disables the "app settings" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "app settings" group will not be synced. + +Use the option "Allow users to turn app settings syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "app settings" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync app settings* +- GP name: *DisableApplicationSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
+ + +**ADMX_SettingSync/DisableCredentialsSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "passwords" group from syncing to and from this PC. This turns off and disables the "passwords" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "passwords" group will not be synced. + +Use the option "Allow users to turn passwords syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "passwords" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync passwords* +- GP name: *DisableCredentialsSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
+ + +**ADMX_SettingSync/DisableDesktopThemeSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "desktop personalization" group from syncing to and from this PC. This turns off and disables the "desktop personalization" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "desktop personalization" group will not be synced. + +Use the option "Allow users to turn desktop personalization syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "desktop personalization" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync desktop personalization* +- GP name: *DisableDesktopThemeSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
+ + +**ADMX_SettingSync/DisablePersonalizationSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "personalize" group from syncing to and from this PC. This turns off and disables the "personalize" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "personalize" group will not be synced. + +Use the option "Allow users to turn personalize syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "personalize" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync personalize* +- GP name: *DisablePersonalizationSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
+ + +**ADMX_SettingSync/DisableSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevent syncing to and from this PC. This turns off and disables the "sync your settings" switch on the "sync your settings" page in PC Settings. + +If you enable this policy setting, "sync your settings" will be turned off, and none of the "sync your setting" groups will be synced on this PC. + +Use the option "Allow users to turn syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, "sync your settings" is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync* +- GP name: *DisableSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
+ + +**ADMX_SettingSync/DisableStartLayoutSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "Start layout" group from syncing to and from this PC. This turns off and disables the "Start layout" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "Start layout" group will not be synced. + +Use the option "Allow users to turn start syncing on" so that syncing is turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "Start layout" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync start settings* +- GP name: *DisableStartLayoutSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
+ + +**ADMX_SettingSync/DisableSyncOnPaidNetwork** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevent syncing to and from this PC when on metered Internet connections. This turns off and disables "sync your settings on metered connections" switch on the "sync your settings" page in PC Settings. + +If you enable this policy setting, syncing on metered connections will be turned off, and no syncing will take place when this PC is on a metered connection. + +If you do not set or disable this setting, syncing on metered connections is configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync on metered connections* +- GP name: *DisableSyncOnPaidNetwork* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
+ + +**ADMX_SettingSync/DisableWindowsSettingSync** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevent the "Other Windows settings" group from syncing to and from this PC. This turns off and disables the "Other Windows settings" group on the "sync your settings" page in PC settings. + +If you enable this policy setting, the "Other Windows settings" group will not be synced. + +Use the option "Allow users to turn other Windows settings syncing on" so that syncing it turned off by default but not disabled. + +If you do not set or disable this setting, syncing of the "Other Windows settings" group is on by default and configurable by the user. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not sync other Windows settings* +- GP name: *DisableWindowsSettingSync* +- GP path: *Windows Components\Sync your settings* +- GP ADMX file name: *SettingSync.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From b2bd84c7a89fc81a53887155b9036e1502e29ce1 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 2 Dec 2020 21:39:51 +0500 Subject: [PATCH 046/169] Update windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index fd03a08fc9..6855688598 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -652,7 +652,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 10. Select **Enroll to Windows Hello for Business, otherwise fail (Windows 10 and later)** from the **Key storage provider (KSP)** list. 11. Next to **Subject name format**, type **CN={{OnPrem_Distinguished_Name}}** to make the on-premises distinguished name the subject of the issued certificate. 12. Specify **User Principal Name (UPN)** as a **Subject Alternative Name** parameter. Set its value as {{UserPrincipalName}}. -13. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. +13. Refer to the "Configure Certificate Templates on NDES" task for how you configured the **AADJ WHFB Authentication** certificate template in the registry. Select the appropriate combination of key usages from the **Key Usages** list that map to the configured NDES template in the registry. In this example, the **AADJ WHFB Authentication** certificate template was added to the **SignatureTemplate** registry value name. The **Key usage** that maps to that registry value name is **Digital Signature**. 14. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority as a root certificate for the profile. 15. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. 16. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. From 2b6d30b03dbab94a9086e0569c22e3d06db1fe39 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 2 Dec 2020 21:40:06 +0500 Subject: [PATCH 047/169] Update windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 6855688598..03d0b013d2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -667,7 +667,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). 2. Select **Devices**, and then click **Configuration Profiles**. 3. Click **WHFB Certificate Enrollment**. -4. Select **Properties**, click **Edit** next to the **Assignments** section. +4. Select **Properties**, and then click **Edit** next to the **Assignments** section. 5. In the **Assignments** pane, select **Selected Groups** from the **Assign to** list. Click **Select groups to include**. ![WHFB SCEP Profile Assignment](images/aadjcert/profile04.png) 6. Select the **AADJ WHFB Certificate Users** group. Click **Select**. From b3a265a4f386127da605d632a60240c23a048c23 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Wed, 2 Dec 2020 21:40:14 +0500 Subject: [PATCH 048/169] Update windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../hello-for-business/hello-hybrid-aadj-sso-cert.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index 03d0b013d2..95638c7735 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -659,7 +659,7 @@ Sign-in a workstation with access equivalent to a _domain user_. ![WHFB SCEP certificate Profile EKUs](images/aadjcert/profile03.png) 17. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. 18. Click **Next**. -19. Click **Next** several times to skip the **Scope tags**, **Assignments** and **Applicability Rules** steps of the wizard and click **Create**. +19. Click **Next** several times to skip the **Scope tags**, **Assignments**, and **Applicability Rules** steps of the wizard and click **Create**. ### Assign Group to the WHFB Certificate Enrollment Certificate Profile Sign-in a workstation with access equivalent to a _domain user_. From b934aa913d7a799d5f26a20114ef0bbdd254db52 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 2 Dec 2020 12:12:37 -0800 Subject: [PATCH 049/169] Added ADMX_MicrosoftDefenderAntivirus policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 93 ++ .../policy-configuration-service-provider.md | 284 ++++ ...cy-csp-admx-microsoftdefenderantivirus.md} | 1407 +++-------------- 4 files changed, 569 insertions(+), 1216 deletions(-) rename windows/client-management/mdm/{policy-csp-admx-windowsdefender.md => policy-csp-admx-microsoftdefenderantivirus.md} (78%) diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index 639e9356c0..d30cc12164 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -202,6 +202,7 @@ #### [ADMX_Kerberos](policy-csp-admx-kerberos.md) #### [ADMX_LanmanServer](policy-csp-admx-lanmanserver.md) #### [ADMX_LinkLayerTopologyDiscovery](policy-csp-admx-linklayertopologydiscovery.md) +#### [ADMX_MicrosoftDefenderAntivirus](policy-csp-admx-microsoftdefenderantivirus.md) #### [ADMX_MMC](policy-csp-admx-mmc.md) #### [ADMX_MMCSnapins](policy-csp-admx-mmcsnapins.md) #### [ADMX_MSAPolicy](policy-csp-admx-msapolicy.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index b04813d319..f2b1c25bd5 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -232,6 +232,99 @@ ms.date: 10/08/2020 - [ADMX_LanmanServer/Pol_HonorCipherSuiteOrder](./policy-csp-admx-lanmanserver.md#admx-lanmanserver-pol-honorciphersuiteorder) - [ADMX_LinkLayerTopologyDiscovery/LLTD_EnableLLTDIO](./policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablelltdio) - [ADMX_LinkLayerTopologyDiscovery/LLTD_EnableRspndr](./policy-csp-admx-linklayertopologydiscovery.md#admx-linklayertopologydiscovery-lltd-enablerspndr) +- [ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-allowfastservicestartup) +- [ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableantispywaredefender) +- [ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableautoexclusions) +- [ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableblockatfirstseen) +- [ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disablelocaladminmerge) +- [ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disablerealtimemonitoring) +- [ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-disableroutinelytakingaction) +- [ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-extensions) +- [ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-paths) +- [ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exclusions-processes) +- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-asr-asronlyexclusions) +- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-asr-rules) +- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-allowedapplications) +- [ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-exploitguard-controlledfolderaccess-protectedfolders) +- [ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-mpengine-enablefilehashcomputation) +- [ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-consumers-ips-disablesignatureretirement) +- [ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-consumers-ips-sku-differentiation-signature-set-guid) +- [ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-nis-disableprotocolrecognition) +- [ADMX_MicrosoftDefenderAntivirus/ProxyBypass](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxybypass) +- [ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxypacurl) +- [ADMX_MicrosoftDefenderAntivirus/ProxyServer](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-proxyserver) +- [ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-quarantine-localsettingoverridepurgeitemsafterdelay) +- [ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-quarantine-purgeitemsafterdelay) +- [ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-randomizescheduletasktimes) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablebehaviormonitoring) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disableioavprotection) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disableonaccessprotection) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablerawwritenotification) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-disablescanonrealtimeenable) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-ioavmaxsize) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablebehaviormonitoring) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableioavprotection) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisableonaccessprotection) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverridedisablerealtimemonitoring) +- [ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-realtimeprotection-localsettingoverriderealtimescandirection) +- [ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-localsettingoverridescan-scheduletime) +- [ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-scan-scheduleday) +- [ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-remediation-scan-scheduletime) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-additionalactiontimeout) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-criticalfailuretimeout) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-disableenhancednotifications) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-disablegenericreports) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-noncriticaltimeout) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-recentlycleanedtimeout) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-wpptracingcomponents) +- [ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-reporting-wpptracinglevel) +- [ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-allowpause) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-archivemaxdepth) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-archivemaxsize) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablearchivescanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableemailscanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableheuristics) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablepackedexescanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disableremovabledrivescanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablereparsepointscanning) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablerestorepoint) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablescanningmappednetworkdrivesforfullscan) +- [ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-disablescanningnetworkfiles) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverrideavgcpuloadfactor) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescanparameters) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduleday) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverrideschedulequickscantime) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-localsettingoverridescheduletime) +- [ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-lowcpupriority) +- [ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-missedscheduledscancountbeforecatchup) +- [ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-purgeitemsafterdelay) +- [ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-quickscaninterval) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scanonlyifidle) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scheduleday) +- [ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-scan-scheduletime) +- [ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-servicekeepalive) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-assignaturedue) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-avsignaturedue) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-definitionupdatefilesharessources) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disablescanonupdate) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disablescheduledsignatureupdateonbattery) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-disableupdateonstartupwithoutengine) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-fallbackorder) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-forceupdatefrommu) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-realtimesignaturedelivery) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-scheduleday) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-scheduletime) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-sharedsignatureslocation) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-signaturedisablenotification) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-signatureupdatecatchupinterval) +- [ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-signatureupdate-updateonstartup) +- [ADMX_MicrosoftDefenderAntivirus/SpynetReporting](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-spynetreporting) +- [ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-spynet-localsettingoverridespynetreporting) +- [ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-threats-threatiddefaultaction) +- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-customdefaultactiontoaststring) +- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-notification-suppress) +- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-suppressrebootnotification) +- [ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown](./policy-csp-admx-microsoftdefenderantivirus.md#admx-microsoftdefenderantivirus-ux-configuration-uilockdown) - [ADMX_MMC/MMC_ActiveXControl](./policy-csp-admx-mmc.md#admx-mmc-mmc-activexcontrol) - [ADMX_MMC/MMC_ExtendView](./policy-csp-admx-mmc.md#admx-mmc-mmc-extendview) - [ADMX_MMC/MMC_LinkToWeb](./policy-csp-admx-mmc.md#admx-mmc-mmc-linktoweb) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 8a993d4783..1e3e29a308 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -940,6 +940,290 @@ The following diagram shows the Policy configuration service provider in tree fo
+### ADMX_MicrosoftDefenderAntivirus policies + +
+
+ ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup +
+
+ ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender +
+
+ ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions +
+
+ ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen +
+
+ ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge +
+
+ ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring +
+
+ ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction +
+
+ ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions +
+
+ ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths +
+
+ ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes +
+
+ ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions +
+
+ ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules +
+
+ ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications +
+
+ ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders +
+
+ ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation +
+
+ ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement +
+
+ ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid +
+
+ ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition +
+
+ ADMX_MicrosoftDefenderAntivirus/ProxyBypass +
+
+ ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl +
+
+ ADMX_MicrosoftDefenderAntivirus/ProxyServer +
+
+ ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay +
+
+ ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay +
+
+ ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes +
+
+ ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring +
+
+ ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection +
+
+ ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection +
+
+ ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification +
+
+ ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable +
+
+ ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize +
+
+ ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring +
+
+ ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection +
+
+ ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection +
+
+ ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring +
+
+ ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection +
+
+ ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime +
+
+ ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay +
+
+ ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime +
+
+ ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout +
+
+ ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout +
+
+ ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications +
+
+ ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts +
+
+ ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout +
+
+ ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout +
+
+ ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents +
+
+ ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay +
+
+ ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime +
+
+ ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval +
+
+ ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup +
+
+ ADMX_MicrosoftDefenderAntivirus/SpynetReporting +
+
+ ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting +
+
+ ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction +
+
+ ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString +
+
+ ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress +
+
+ ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification +
+
+ ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown +
+
+ ### ADMX_MMC policies
diff --git a/windows/client-management/mdm/policy-csp-admx-windowsdefender.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md similarity index 78% rename from windows/client-management/mdm/policy-csp-admx-windowsdefender.md rename to windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index 5e550c9817..a582499424 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsdefender.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -1,344 +1,305 @@ --- -title: Policy CSP - ADMX_WindowsDefender -description: Policy CSP - ADMX_WindowsDefender +title: Policy CSP - ADMX_MicrosoftDefenderAntivirus +description: Policy CSP - ADMX_MicrosoftDefenderAntivirus ms.author: dansimp ms.localizationpriority: medium ms.topic: article ms.prod: w10 ms.technology: windows author: manikadhiman -ms.date: 08/13/2020 +ms.date: 12/02/2020 ms.reviewer: manager: dansimp --- -# Policy CSP - ADMX_WindowsDefender +# Policy CSP - ADMX_MicrosoftDefenderAntivirus > [!WARNING] > Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
-## ADMX_WindowsDefender policies +## ADMX_MicrosoftDefenderAntivirus policies
- ADMX_WindowsDefender/AllowFastServiceStartup + ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup
- ADMX_WindowsDefender/CheckForSignaturesBeforeRunningScan + ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender
- ADMX_WindowsDefender/DisableAntiSpywareDefender + ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions
- ADMX_WindowsDefender/DisableAutoExclusions + ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen
- ADMX_WindowsDefender/DisableBlockAtFirstSeen + ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge
- ADMX_WindowsDefender/DisableLocalAdminMerge + ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring
- ADMX_WindowsDefender/DisableRealtimeMonitoring + ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction
- ADMX_WindowsDefender/DisableRoutinelyTakingAction + ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions
- ADMX_WindowsDefender/Exclusions_Extensions + ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths
- ADMX_WindowsDefender/Exclusions_Paths + ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes
- ADMX_WindowsDefender/Exclusions_Processes + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions
- ADMX_WindowsDefender/ExploitGuard_ASR_ASROnlyExclusions + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules
- ADMX_WindowsDefender/ExploitGuard_ASR_Rules + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications
- ADMX_WindowsDefender/ExploitGuard_ControlledFolderAccess_AllowedApplications + ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders
- ADMX_WindowsDefender/ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess + ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation
- ADMX_WindowsDefender/ExploitGuard_ControlledFolderAccess_ProtectedFolders + ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement
- ADMX_WindowsDefender/ExploitGuard_EnableNetworkProtection + ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid
- ADMX_WindowsDefender/MpEngine_EnableFileHashComputation + ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition
- ADMX_WindowsDefender/Nis_Consumers_IPS_DisableSignatureRetirement + ADMX_MicrosoftDefenderAntivirus/ProxyBypass
- ADMX_WindowsDefender/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid + ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl
- ADMX_WindowsDefender/Nis_DisableProtocolRecognition + ADMX_MicrosoftDefenderAntivirus/ProxyServer
- ADMX_WindowsDefender/ProxyBypass + ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay
- ADMX_WindowsDefender/ProxyPacUrl + ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay
- ADMX_WindowsDefender/ProxyServer + ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes
- ADMX_WindowsDefender/Quarantine_LocalSettingOverridePurgeItemsAfterDelay + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring
- ADMX_WindowsDefender/Quarantine_PurgeItemsAfterDelay + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection
- ADMX_WindowsDefender/RandomizeScheduleTaskTimes + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection
- ADMX_WindowsDefender/RealtimeProtection_DisableBehaviorMonitoring + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification
- ADMX_WindowsDefender/RealtimeProtection_DisableIOAVProtection + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable
- ADMX_WindowsDefender/RealtimeProtection_DisableOnAccessProtection + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize
- ADMX_WindowsDefender/RealtimeProtection_DisableRawWriteNotification + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring
- ADMX_WindowsDefender/RealtimeProtection_DisableScanOnRealtimeEnable + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection
- ADMX_WindowsDefender/RealtimeProtection_IOAVMaxSize + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection
- ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring
- ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection + ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection
- ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection + ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime
- ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring + ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay
- ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection + ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime
- ADMX_WindowsDefender/RealtimeProtection_RealtimeScanDirection + ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout
- ADMX_WindowsDefender/Remediation_LocalSettingOverrideScan_ScheduleTime + ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout
- ADMX_WindowsDefender/Remediation_Scan_ScheduleDay + ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications
- ADMX_WindowsDefender/Remediation_Scan_ScheduleTime + ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts
- ADMX_WindowsDefender/Reporting_AdditionalActionTimeout + ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout
- ADMX_WindowsDefender/Reporting_CriticalFailureTimeout + ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout
- ADMX_WindowsDefender/Reporting_DisableEnhancedNotifications + ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents
- ADMX_WindowsDefender/Reporting_DisablegenericrePorts + ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel
- ADMX_WindowsDefender/Reporting_NonCriticalTimeout + ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause
- ADMX_WindowsDefender/Reporting_RecentlyCleanedTimeout + ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth
- ADMX_WindowsDefender/Reporting_WppTracingComponents + ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize
- ADMX_WindowsDefender/Reporting_WppTracingLevel + ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning
- ADMX_WindowsDefender/Root_PUAProtection + ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning
- ADMX_WindowsDefender/Scan_AllowPause + ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics
- ADMX_WindowsDefender/Scan_ArchiveMaxDepth + ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning
- ADMX_WindowsDefender/Scan_ArchiveMaxSize + ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning
- ADMX_WindowsDefender/Scan_AvgCPULoadFactor + ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning
- ADMX_WindowsDefender/Scan_DisableArchiveScanning + ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint
- ADMX_WindowsDefender/Scan_DisableCatchupFullScan + ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan
- ADMX_WindowsDefender/Scan_DisableCatchupQuickScan + ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles
- ADMX_WindowsDefender/Scan_DisableEmailScanning + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor
- ADMX_WindowsDefender/Scan_DisableHeuristics + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters
- ADMX_WindowsDefender/Scan_DisablePackedExeScanning + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay
- ADMX_WindowsDefender/Scan_DisableRemovableDriveScanning + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime
- ADMX_WindowsDefender/Scan_DisableReparsePointScanning + ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime
- ADMX_WindowsDefender/Scan_DisableRestorePoint + ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority
- ADMX_WindowsDefender/Scan_DisableScanningMappedNetworkDrivesForFullScan + ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup
- ADMX_WindowsDefender/Scan_DisableScanningNetworkFiles + ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay
- ADMX_WindowsDefender/Scan_LocalSettingOverrideAvgCPULoadFactor + ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval
- ADMX_WindowsDefender/Scan_LocalSettingOverrideScanParameters + ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle
- ADMX_WindowsDefender/Scan_LocalSettingOverrideScheduleDay + ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay
- ADMX_WindowsDefender/Scan_LocalSettingOverrideScheduleQuickScantime + ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime
- ADMX_WindowsDefender/Scan_LocalSettingOverrideScheduleTime + ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive
- ADMX_WindowsDefender/Scan_LowCpuPriority + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue
- ADMX_WindowsDefender/Scan_MissedScheduledScanCountBeforeCatchup + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue
- ADMX_WindowsDefender/Scan_PurgeItemsAfterDelay + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources
- ADMX_WindowsDefender/Scan_QuickScanInterval + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate
- ADMX_WindowsDefender/Scan_ScanOnlyIfIdle + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery
- ADMX_WindowsDefender/Scan_ScanParameters + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine
- ADMX_WindowsDefender/Scan_ScheduleDay + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder
- ADMX_WindowsDefender/Scan_ScheduleQuickScantime + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU
- ADMX_WindowsDefender/Scan_ScheduleTime + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery
- ADMX_WindowsDefender/ServiceKeepAlive + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay
- ADMX_WindowsDefender/SignatureUpdate_ASSignatureDue + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime
- ADMX_WindowsDefender/SignatureUpdate_AVSignatureDue + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation
- ADMX_WindowsDefender/SignatureUpdate_DefinitionUpdateFileSharesSources + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification
- ADMX_WindowsDefender/SignatureUpdate_DisableScanOnUpdate + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval
- ADMX_WindowsDefender/SignatureUpdate_DisableScheduledSignatureUpdateonBattery + ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup
- ADMX_WindowsDefender/SignatureUpdate_DisableUpdateOnStartupWithoutEngine + ADMX_MicrosoftDefenderAntivirus/SpynetReporting
- ADMX_WindowsDefender/SignatureUpdate_FallbackOrder + ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting
- ADMX_WindowsDefender/SignatureUpdate_ForceUpdateFromMU + ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction
- ADMX_WindowsDefender/SignatureUpdate_RealtimeSignatureDelivery + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString
- ADMX_WindowsDefender/SignatureUpdate_ScheduleDay + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress
- ADMX_WindowsDefender/SignatureUpdate_ScheduleTime + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification
- ADMX_WindowsDefender/SignatureUpdate_SharedSignaturesLocation -
-
- ADMX_WindowsDefender/SignatureUpdate_SignatureDisableNotification -
-
- ADMX_WindowsDefender/SignatureUpdate_SignatureUpdateCatchupInterval -
-
- ADMX_WindowsDefender/SignatureUpdate_SignatureUpdateInterval -
-
- ADMX_WindowsDefender/SignatureUpdate_UpdateOnStartup -
-
- ADMX_WindowsDefender/SpynetReporting -
-
- ADMX_WindowsDefender/Spynet_LocalSettingOverrideSpynetReporting -
-
- ADMX_WindowsDefender/SubmitSamplesConsent -
-
- ADMX_WindowsDefender/Threats_ThreatIdDefaultAction -
-
- ADMX_WindowsDefender/Threats_ThreatSeverityDefaultAction -
-
- ADMX_WindowsDefender/UX_Configuration_CustomDefaultActionToastString -
-
- ADMX_WindowsDefender/UX_Configuration_Notification_Suppress -
-
- ADMX_WindowsDefender/UX_Configuration_SuppressRebootNotification -
-
- ADMX_WindowsDefender/UX_Configuration_UILockdown + ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown
@@ -346,7 +307,7 @@ manager: dansimp
-**ADMX_WindowsDefender/AllowFastServiceStartup** +**ADMX_MicrosoftDefenderAntivirus/AllowFastServiceStartup** @@ -415,78 +376,7 @@ ADMX Info:
-**ADMX_WindowsDefender/CheckForSignaturesBeforeRunningScan** - - -
- - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage whether a check for new virus and spyware security intelligence will occur before running a scan. - -This setting applies to scheduled scans as well as the command line "mpcmdrun -SigUpdate", but it has no effect on scans initiated manually from the user interface. - -If you enable this setting, a check for new security intelligence will occur before running a scan. - -If you disable this setting or do not configure this setting, the scan will start using the existing security intelligence. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Check for the latest virus and spyware security intelligence before running a scheduled scan* -- GP name: *CheckForSignaturesBeforeRunningScan* -- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -
- - -**ADMX_WindowsDefender/DisableAntiSpywareDefender** +**ADMX_MicrosoftDefenderAntivirus/DisableAntiSpywareDefender** @@ -559,7 +449,7 @@ ADMX Info:
-**ADMX_WindowsDefender/DisableAutoExclusions** +**ADMX_MicrosoftDefenderAntivirus/DisableAutoExclusions**
@@ -633,7 +523,7 @@ ADMX Info:
-**ADMX_WindowsDefender/DisableBlockAtFirstSeen** +**ADMX_MicrosoftDefenderAntivirus/DisableBlockAtFirstSeen**
@@ -708,7 +598,7 @@ ADMX Info:
-**ADMX_WindowsDefender/DisableLocalAdminMerge** +**ADMX_MicrosoftDefenderAntivirus/DisableLocalAdminMerge**
@@ -777,7 +667,7 @@ ADMX Info:
-**ADMX_WindowsDefender/DisableRealtimeMonitoring** +**ADMX_MicrosoftDefenderAntivirus/DisableRealtimeMonitoring**
@@ -848,7 +738,7 @@ ADMX Info:
-**ADMX_WindowsDefender/DisableRoutinelyTakingAction** +**ADMX_MicrosoftDefenderAntivirus/DisableRoutinelyTakingAction**
@@ -917,7 +807,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Exclusions_Extensions** +**ADMX_MicrosoftDefenderAntivirus/Exclusions_Extensions**
@@ -982,7 +872,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Exclusions_Paths** +**ADMX_MicrosoftDefenderAntivirus/Exclusions_Paths**
@@ -1049,7 +939,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Exclusions_Processes** +**ADMX_MicrosoftDefenderAntivirus/Exclusions_Processes**
@@ -1114,7 +1004,7 @@ ADMX Info:
-**ADMX_WindowsDefender/ExploitGuard_ASR_ASROnlyExclusions** +**ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_ASROnlyExclusions**
@@ -1194,7 +1084,7 @@ ADMX Info:
-**ADMX_WindowsDefender/ExploitGuard_ASR_Rules** +**ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ASR_Rules**
@@ -1290,7 +1180,7 @@ ADMX Info:
-**ADMX_WindowsDefender/ExploitGuard_ControlledFolderAccess_AllowedApplications** +**ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_AllowedApplications**
@@ -1372,127 +1262,7 @@ ADMX Info:
-**ADMX_WindowsDefender/ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess** - - -
- - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. Enable or disable controlled folder access for untrusted applications. You can choose to block, audit, or allow attempts by untrusted apps to: - -- Modify or delete files in protected folders, such as the Documents folder -- Write to disk sectors - -You can also choose to only block or audit writes to disk sectors while still allowing the modification or deletion of files in protected folders. - -Microsoft Defender Antivirus automatically determines which applications can be trusted. You can add additional trusted applications in the Configure allowed applications GP setting. -Default system folders are automatically protected, but you can add folders in the Configure protected folders GP setting. - -Block: -The following will be blocked: - -- Attempts by untrusted apps to modify or delete files in protected folders -- Attempts by untrusted apps to write to disk sectors - -The Windows event log will record these blocks under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123. - -Disabled: -The following will not be blocked and will be allowed to run: - -- Attempts by untrusted apps to modify or delete files in protected folders -- Attempts by untrusted apps to write to disk sectors - -These attempts will not be recorded in the Windows event log. - -Audit Mode: -The following will not be blocked and will be allowed to run: - -- Attempts by untrusted apps to modify or delete files in protected folders -- Attempts by untrusted apps to write to disk sectors - -The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124. - -Block disk modification only: -The following will be blocked: - -- Attempts by untrusted apps to write to disk sectors - -The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123. - -The following will not be blocked and will be allowed to run: - -- Attempts by untrusted apps to modify or delete files in protected folders -These attempts will not be recorded in the Windows event log. - -Audit disk modification only: -The following will not be blocked and will be allowed to run: - -- Attempts by untrusted apps to write to disk sectors -- Attempts by untrusted apps to modify or delete files in protected folders -Only attempts to write to protected disk sectors will be recorded in the Windows event log (under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124). -Attempts to modify or delete files in protected folders will not be recorded. - -Not configured: -Same as Disabled. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Configure Controlled folder access* -- GP name: *ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess* -- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Controlled Folder Access* -- GP ADMX file name: *WindowsDefender.admx* - - - -
- - -**ADMX_WindowsDefender/ExploitGuard_ControlledFolderAccess_ProtectedFolders** +**ADMX_MicrosoftDefenderAntivirus/ExploitGuard_ControlledFolderAccess_ProtectedFolders** @@ -1575,84 +1345,7 @@ ADMX Info:
-**ADMX_WindowsDefender/ExploitGuard_EnableNetworkProtection** - - -
- - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. Enable or disable Microsoft Defender Exploit Guard network protection to prevent employees from using any application to access dangerous domains that may host phishing scams, exploit-hosting sites, and other malicious content on the Internet. - -Enabled: -Specify the mode in the Options section: - -- Block: Users and applications will not be able to access dangerous domains -- Audit Mode: Users and applications can connect to dangerous domains, however if this feature would have blocked access if it were set to Block, then a record of the event will be in the event logs. - -Disabled: -Users and applications will not be blocked from connecting to dangerous domains. - -Not configured: -Same as Disabled. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Prevent users and apps from accessing dangerous websites* -- GP name: *ExploitGuard_EnableNetworkProtection* -- GP path: *Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Network Protection* -- GP ADMX file name: *WindowsDefender.admx* - - - -
- - -**ADMX_WindowsDefender/MpEngine_EnableFileHashComputation** +**ADMX_MicrosoftDefenderAntivirus/MpEngine_EnableFileHashComputation** @@ -1726,7 +1419,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Nis_Consumers_IPS_DisableSignatureRetirement** +**ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_DisableSignatureRetirement**
@@ -1795,7 +1488,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid** +**ADMX_MicrosoftDefenderAntivirus/Nis_Consumers_IPS_sku_differentiation_Signature_Set_Guid**
@@ -1860,7 +1553,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Nis_DisableProtocolRecognition** +**ADMX_MicrosoftDefenderAntivirus/Nis_DisableProtocolRecognition**
@@ -1929,7 +1622,7 @@ ADMX Info:
-**ADMX_WindowsDefender/ProxyBypass** +**ADMX_MicrosoftDefenderAntivirus/ProxyBypass**
@@ -1998,7 +1691,7 @@ ADMX Info:
-**ADMX_WindowsDefender/ProxyPacUrl** +**ADMX_MicrosoftDefenderAntivirus/ProxyPacUrl**
@@ -2073,7 +1766,7 @@ ADMX Info:
-**ADMX_WindowsDefender/ProxyServer** +**ADMX_MicrosoftDefenderAntivirus/ProxyServer**
@@ -2148,7 +1841,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Quarantine_LocalSettingOverridePurgeItemsAfterDelay** +**ADMX_MicrosoftDefenderAntivirus/Quarantine_LocalSettingOverridePurgeItemsAfterDelay**
@@ -2217,7 +1910,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Quarantine_PurgeItemsAfterDelay** +**ADMX_MicrosoftDefenderAntivirus/Quarantine_PurgeItemsAfterDelay**
@@ -2286,7 +1979,7 @@ ADMX Info:
-**ADMX_WindowsDefender/RandomizeScheduleTaskTimes** +**ADMX_MicrosoftDefenderAntivirus/RandomizeScheduleTaskTimes**
@@ -2355,7 +2048,7 @@ ADMX Info:
-**ADMX_WindowsDefender/RealtimeProtection_DisableBehaviorMonitoring** +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableBehaviorMonitoring**
@@ -2424,7 +2117,7 @@ ADMX Info:
-**ADMX_WindowsDefender/RealtimeProtection_DisableIOAVProtection** +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableIOAVProtection**
@@ -2493,7 +2186,7 @@ ADMX Info:
-**ADMX_WindowsDefender/RealtimeProtection_DisableOnAccessProtection** +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableOnAccessProtection**
@@ -2562,7 +2255,7 @@ ADMX Info:
-**ADMX_WindowsDefender/RealtimeProtection_DisableRawWriteNotification** +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableRawWriteNotification**
@@ -2631,7 +2324,7 @@ ADMX Info:
-**ADMX_WindowsDefender/RealtimeProtection_DisableScanOnRealtimeEnable** +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_DisableScanOnRealtimeEnable**
@@ -2700,7 +2393,7 @@ ADMX Info:
-**ADMX_WindowsDefender/RealtimeProtection_IOAVMaxSize** +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_IOAVMaxSize**
@@ -2769,7 +2462,7 @@ ADMX Info:
-**ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring** +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableBehaviorMonitoring**
@@ -2838,7 +2531,7 @@ ADMX Info:
-**ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection** +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableIOAVProtection**
@@ -2907,7 +2600,7 @@ ADMX Info:
-**ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection** +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableOnAccessProtection**
@@ -2976,7 +2669,7 @@ ADMX Info:
-**ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring** +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideDisableRealtimeMonitoring**
@@ -3045,7 +2738,7 @@ ADMX Info:
-**ADMX_WindowsDefender/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection** +**ADMX_MicrosoftDefenderAntivirus/RealtimeProtection_LocalSettingOverrideRealtimeScanDirection**
@@ -3114,86 +2807,7 @@ ADMX Info:
-**ADMX_WindowsDefender/RealtimeProtection_RealtimeScanDirection** - - -
- - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure monitoring for incoming and outgoing files, without having to turn off monitoring entirely. It is recommended for use on servers where there is a lot of incoming and outgoing file activity but for performance reasons need to have scanning disabled for a particular scan direction. The appropriate configuration should be evaluated based on the server role. - -Note that this configuration is only honored for NTFS volumes. For any other file system type, full monitoring of file and program activity will be present on those volumes. - -The options for this setting are mutually exclusive: - -- 0 = Scan incoming and outgoing files (default) -- 1 = Scan incoming files only -- 2 = Scan outgoing files only - -Any other value, or if the value does not exist, resolves to the default (0). - -If you enable this setting, the specified type of monitoring will be enabled. - -If you disable or do not configure this setting, monitoring for incoming and outgoing files will be enabled. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Configure monitoring for incoming and outgoing file and program activity* -- GP name: *RealtimeProtection_RealtimeScanDirection* -- GP path: *Windows Components\Microsoft Defender Antivirus\Real-time Protection* -- GP ADMX file name: *WindowsDefender.admx* - - - -
- - -**ADMX_WindowsDefender/Remediation_LocalSettingOverrideScan_ScheduleTime** +**ADMX_MicrosoftDefenderAntivirus/Remediation_LocalSettingOverrideScan_ScheduleTime** @@ -3262,7 +2876,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Remediation_Scan_ScheduleDay** +**ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleDay**
@@ -3343,7 +2957,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Remediation_Scan_ScheduleTime** +**ADMX_MicrosoftDefenderAntivirus/Remediation_Scan_ScheduleTime**
@@ -3412,7 +3026,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Reporting_AdditionalActionTimeout** +**ADMX_MicrosoftDefenderAntivirus/Reporting_AdditionalActionTimeout**
@@ -3477,7 +3091,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Reporting_CriticalFailureTimeout** +**ADMX_MicrosoftDefenderAntivirus/Reporting_CriticalFailureTimeout**
@@ -3542,7 +3156,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Reporting_DisableEnhancedNotifications** +**ADMX_MicrosoftDefenderAntivirus/Reporting_DisableEnhancedNotifications**
@@ -3610,7 +3224,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Reporting_DisablegenericrePorts** +**ADMX_MicrosoftDefenderAntivirus/Reporting_DisablegenericrePorts**
@@ -3679,7 +3293,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Reporting_NonCriticalTimeout** +**ADMX_MicrosoftDefenderAntivirus/Reporting_NonCriticalTimeout**
@@ -3743,7 +3357,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Reporting_RecentlyCleanedTimeout** +**ADMX_MicrosoftDefenderAntivirus/Reporting_RecentlyCleanedTimeout**
@@ -3808,7 +3422,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Reporting_WppTracingComponents** +**ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingComponents**
@@ -3873,7 +3487,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Reporting_WppTracingLevel** +**ADMX_MicrosoftDefenderAntivirus/Reporting_WppTracingLevel**
@@ -3945,84 +3559,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Root_PUAProtection** - - -
- - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. Enable or disable detection for potentially unwanted applications. You can choose to block, audit, or allow when potentially unwanted software is being downloaded or attempts to install itself on your computer. - -Enabled: -Specify the mode in the Options section: - -- Block: Potentially unwanted software will be blocked. -- Audit Mode: Potentially unwanted software will not be blocked, however if this feature would have blocked access if it were set to Block, then a record of the event will be in the event logs. - -Disabled: -Potentially unwanted software will not be blocked. - -Not configured: -Same as Disabled. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Configure detection for potentially unwanted applications* -- GP name: *Root_PUAProtection* -- GP path: *Windows Components\Microsoft Defender Antivirus* -- GP ADMX file name: *WindowsDefender.admx* - - - -
- - -**ADMX_WindowsDefender/Scan_AllowPause** +**ADMX_MicrosoftDefenderAntivirus/Scan_AllowPause** @@ -4091,7 +3628,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_ArchiveMaxDepth** +**ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxDepth**
@@ -4160,7 +3697,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_ArchiveMaxSize** +**ADMX_MicrosoftDefenderAntivirus/Scan_ArchiveMaxSize**
@@ -4228,77 +3765,9 @@ ADMX Info:
- -**ADMX_WindowsDefender/Scan_AvgCPULoadFactor** - - -
- - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the maximum percentage CPU utilization permitted during a scan. Valid values for this setting are a percentage represented by the integers 5 to 100. A value of 0 indicates that there should be no throttling of CPU utilization. The default value is 50. - -If you enable this setting, CPU utilization will not exceed the percentage specified. - -If you disable or do not configure this setting, CPU utilization will not exceed the default value. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Specify the maximum percentage of CPU utilization during a scan* -- GP name: *Scan_AvgCPULoadFactor* -- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -
-**ADMX_WindowsDefender/Scan_DisableArchiveScanning** +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableArchiveScanning** @@ -4367,145 +3836,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_DisableCatchupFullScan** - - -
- - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure catch-up scans for scheduled full scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. - -If you enable this setting, catch-up scans for scheduled full scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. - -If you disable or do not configure this setting, catch-up scans for scheduled full scans will be turned off. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Turn on catch-up full scan* -- GP name: *Scan_DisableCatchupFullScan* -- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -
- - -**ADMX_WindowsDefender/Scan_DisableCatchupQuickScan** - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure catch-up scans for scheduled quick scans. A catch-up scan is a scan that is initiated because a regularly scheduled scan was missed. Usually these scheduled scans are missed because the computer was turned off at the scheduled time. - -If you enable this setting, catch-up scans for scheduled quick scans will be turned on. If a computer is offline for two consecutive scheduled scans, a catch-up scan is started the next time someone logs on to the computer. If there is no scheduled scan configured, there will be no catch-up scan run. - -If you disable or do not configure this setting, catch-up scans for scheduled quick scans will be turned off. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Turn on catch-up quick scan* -- GP name: *Scan_DisableCatchupQuickScan* -- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -
- - -**ADMX_WindowsDefender/Scan_DisableEmailScanning** +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableEmailScanning** @@ -4574,7 +3905,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_DisableHeuristics** +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableHeuristics**
@@ -4643,7 +3974,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_DisablePackedExeScanning** +**ADMX_MicrosoftDefenderAntivirus/Scan_DisablePackedExeScanning**
@@ -4712,7 +4043,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_DisableRemovableDriveScanning** +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableRemovableDriveScanning**
@@ -4781,7 +4112,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_DisableReparsePointScanning** +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableReparsePointScanning**
@@ -4850,7 +4181,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_DisableRestorePoint** +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableRestorePoint**
@@ -4918,7 +4249,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_DisableScanningMappedNetworkDrivesForFullScan** +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningMappedNetworkDrivesForFullScan**
@@ -4987,7 +4318,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_DisableScanningNetworkFiles** +**ADMX_MicrosoftDefenderAntivirus/Scan_DisableScanningNetworkFiles**
@@ -5056,7 +4387,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_LocalSettingOverrideAvgCPULoadFactor** +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideAvgCPULoadFactor**
@@ -5125,7 +4456,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_LocalSettingOverrideScanParameters** +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScanParameters**
@@ -5194,7 +4525,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_LocalSettingOverrideScheduleDay** +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleDay**
@@ -5263,7 +4594,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_LocalSettingOverrideScheduleQuickScantime** +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleQuickScantime**
@@ -5332,7 +4663,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_LocalSettingOverrideScheduleTime** +**ADMX_MicrosoftDefenderAntivirus/Scan_LocalSettingOverrideScheduleTime**
@@ -5401,7 +4732,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_LowCpuPriority** +**ADMX_MicrosoftDefenderAntivirus/Scan_LowCpuPriority**
@@ -5470,7 +4801,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_MissedScheduledScanCountBeforeCatchup** +**ADMX_MicrosoftDefenderAntivirus/Scan_MissedScheduledScanCountBeforeCatchup**
@@ -5539,7 +4870,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_PurgeItemsAfterDelay** +**ADMX_MicrosoftDefenderAntivirus/Scan_PurgeItemsAfterDelay**
@@ -5608,7 +4939,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_QuickScanInterval** +**ADMX_MicrosoftDefenderAntivirus/Scan_QuickScanInterval**
@@ -5677,7 +5008,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_ScanOnlyIfIdle** +**ADMX_MicrosoftDefenderAntivirus/Scan_ScanOnlyIfIdle**
@@ -5746,78 +5077,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Scan_ScanParameters** - - -
- - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the scan type to use during a scheduled scan. Scan type options are: - -- 1 = Quick Scan (default) -- 2 = Full Scan - -If you enable this setting, the scan type will be set to the specified value. - -If you disable or do not configure this setting, the default scan type will used. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Specify the scan type to use for a scheduled scan* -- GP name: *Scan_ScanParameters* -- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* -- GP ADMX file name: *WindowsDefender.admx* - - - -
- -**ADMX_WindowsDefender/Scan_ScheduleDay** +**ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleDay** @@ -5893,80 +5153,12 @@ ADMX Info: - GP path: *Windows Components\Microsoft Defender Antivirus\Scan* - GP ADMX file name: *WindowsDefender.admx* - - -
- -**ADMX_WindowsDefender/Scan_ScheduleQuickScantime** - - -
- - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the time of day at which to perform a daily quick scan. The time value is represented as the number of minutes past midnight (00:00). For example, 120 (0x78) is equivalent to 02:00 AM. By default, this setting is set to a time value of 2:00 AM. The schedule is based on local time on the computer where the scan is executing. - -If you enable this setting, a daily quick scan will run at the time of day specified. - -If you disable or do not configure this setting, a daily quick scan will run at a default time. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Specify the time for a daily quick scan* -- GP name: *Scan_ScheduleQuickScantime* -- GP path: *Windows Components\Microsoft Defender Antivirus\Scan* -- GP ADMX file name: *WindowsDefender.admx* -
-**ADMX_WindowsDefender/Scan_ScheduleTime** +**ADMX_MicrosoftDefenderAntivirus/Scan_ScheduleTime** @@ -6035,7 +5227,7 @@ ADMX Info:
-**ADMX_WindowsDefender/ServiceKeepAlive** +**ADMX_MicrosoftDefenderAntivirus/ServiceKeepAlive**
@@ -6104,7 +5296,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_ASSignatureDue** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ASSignatureDue**
@@ -6173,7 +5365,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_AVSignatureDue** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_AVSignatureDue**
@@ -6242,7 +5434,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_DefinitionUpdateFileSharesSources** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DefinitionUpdateFileSharesSources**
@@ -6311,7 +5503,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_DisableScanOnUpdate** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScanOnUpdate**
@@ -6380,7 +5572,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_DisableScheduledSignatureUpdateonBattery** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableScheduledSignatureUpdateonBattery**
@@ -6449,7 +5641,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_DisableUpdateOnStartupWithoutEngine** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_DisableUpdateOnStartupWithoutEngine**
@@ -6518,7 +5710,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_FallbackOrder** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_FallbackOrder**
@@ -6589,7 +5781,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_ForceUpdateFromMU** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ForceUpdateFromMU**
@@ -6658,7 +5850,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_RealtimeSignatureDelivery** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_RealtimeSignatureDelivery**
@@ -6727,7 +5919,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_ScheduleDay** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleDay**
@@ -6808,7 +6000,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_ScheduleTime** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_ScheduleTime**
@@ -6877,7 +6069,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_SharedSignaturesLocation** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SharedSignaturesLocation**
@@ -6943,7 +6135,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_SignatureDisableNotification** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureDisableNotification**
@@ -7012,7 +6204,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_SignatureUpdateCatchupInterval** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_SignatureUpdateCatchupInterval**
@@ -7081,76 +6273,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SignatureUpdate_SignatureUpdateInterval** - - -
- - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify an interval at which to check for security intelligence updates. The time value is represented as the number of hours between update checks. Valid values range from 1 (every hour) to 24 (once per day). - -If you enable this setting, checks for security intelligence updates will occur at the interval specified. - -If you disable or do not configure this setting, checks for security intelligence updates will occur at the default interval. - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Specify the interval to check for security intelligence updates* -- GP name: *SignatureUpdate_SignatureUpdateInterval* -- GP path: *Windows Components\Microsoft Defender Antivirus\Security Intelligence Updates* -- GP ADMX file name: *WindowsDefender.admx* - - - -
- - -**ADMX_WindowsDefender/SignatureUpdate_UpdateOnStartup** +**ADMX_MicrosoftDefenderAntivirus/SignatureUpdate_UpdateOnStartup** @@ -7219,7 +6342,7 @@ ADMX Info:
-**ADMX_WindowsDefender/SpynetReporting** +**ADMX_MicrosoftDefenderAntivirus/SpynetReporting**
@@ -7302,7 +6425,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Spynet_LocalSettingOverrideSpynetReporting** +**ADMX_MicrosoftDefenderAntivirus/Spynet_LocalSettingOverrideSpynetReporting**
@@ -7368,81 +6491,11 @@ ADMX Info: -
- -**ADMX_WindowsDefender/SubmitSamplesConsent** - -
- - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. This policy setting configures behaviour of samples submission when opt-in for MAPS telemetry is set. - -Possible options are: - -- (0x0) Always prompt -- (0x1) Send safe samples automatically -- (0x2) Never send -- (0x3) Send all samples automatically - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Send file samples when further analysis is required* -- GP name: *SubmitSamplesConsent* -- GP path: *Windows Components\Microsoft Defender Antivirus\MAPS* -- GP ADMX file name: *WindowsDefender.admx* - - -
-**ADMX_WindowsDefender/Threats_ThreatIdDefaultAction** +**ADMX_MicrosoftDefenderAntivirus/Threats_ThreatIdDefaultAction** @@ -7513,85 +6566,7 @@ ADMX Info:
-**ADMX_WindowsDefender/Threats_ThreatSeverityDefaultAction** - - -
- - - - - - - - - - - - - - - - - - - - - - - - -
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
- - -
- - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
- - - -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to customize which automatic remediation action will be taken for each threat alert level.Threat alert levels should be added under the Options for this setting. Each entry must be listed as a name value pair. The name defines a threat alert level. The value contains the action ID for the remediation action that should be taken. - -Valid threat alert levels are: - -- 1 = Low -- 2 = Medium -- 4 = High -- 5 = Severe - -Valid remediation action values are: - -- 2 = Quarantine -- 3 = Remove -- 6 = Ignore - - -> [!TIP] -> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). -> -> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). -> -> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). - - -ADMX Info: -- GP English name: *Specify threat alert levels at which default action should not be taken when detected* -- GP name: *Threats_ThreatSeverityDefaultAction* -- GP path: *Windows Components\Microsoft Defender Antivirus\Threats* -- GP ADMX file name: *WindowsDefender.admx* - - - -
- - -**ADMX_WindowsDefender/UX_Configuration_CustomDefaultActionToastString** +**ADMX_MicrosoftDefenderAntivirus/UX_Configuration_CustomDefaultActionToastString** @@ -7660,7 +6635,7 @@ ADMX Info:
-**ADMX_WindowsDefender/UX_Configuration_Notification_Suppress** +**ADMX_MicrosoftDefenderAntivirus/UX_Configuration_Notification_Suppress**
@@ -7729,7 +6704,7 @@ ADMX Info:
-**ADMX_WindowsDefender/UX_Configuration_SuppressRebootNotification** +**ADMX_MicrosoftDefenderAntivirus/UX_Configuration_SuppressRebootNotification**
@@ -7796,7 +6771,7 @@ ADMX Info:
-**ADMX_WindowsDefender/UX_Configuration_UILockdown** +**ADMX_MicrosoftDefenderAntivirus/UX_Configuration_UILockdown**
From 10c9e4a62e5ad199ee047b3288a0750cf495000b Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 2 Dec 2020 12:50:39 -0800 Subject: [PATCH 050/169] Formatting --- .../mdm/policy-csp-admx-microsoftdefenderantivirus.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index a582499424..f01f693b6e 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -1053,8 +1053,8 @@ Enabled: Specify the folders or files and resources that should be excluded from ASR rules in the Options section. Enter each rule on a new line as a name-value pair: -- Name column: Enter a folder path or a fully qualified resource name. For example, ""C:\Windows"" will exclude all files in that directory. ""C:\Windows\App.exe"" will exclude only that specific file in that specific folder -- Value column: Enter ""0"" for each item +- Name column: Enter a folder path or a fully qualified resource name. For example, "C:\Windows" will exclude all files in that directory. "C:\Windows\App.exe" will exclude only that specific file in that specific folder +- Value column: Enter "0" for each item Disabled: No exclusions will be applied to the ASR rules. From dc3d2ee64ced0a08d1eaa5f74f61aa66743b525b Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Wed, 2 Dec 2020 16:53:27 -0800 Subject: [PATCH 051/169] Added desktop policies --- .../mdm/policy-csp-admx-desktop.md | 203 ++++++++++++++++++ 1 file changed, 203 insertions(+) create mode 100644 windows/client-management/mdm/policy-csp-admx-desktop.md diff --git a/windows/client-management/mdm/policy-csp-admx-desktop.md b/windows/client-management/mdm/policy-csp-admx-desktop.md new file mode 100644 index 0000000000..11256a18ee --- /dev/null +++ b/windows/client-management/mdm/policy-csp-admx-desktop.md @@ -0,0 +1,203 @@ +--- +title: Policy CSP - ADMX_Desktop +description: Policy CSP - ADMX_Desktop +ms.author: dansimp +ms.localizationpriority: medium +ms.topic: article +ms.prod: w10 +ms.technology: windows +author: manikadhiman +ms.date: 12/02/2020 +ms.reviewer: +manager: dansimp +--- + +# Policy CSP - ADMX_Desktop +> [!WARNING] +> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. + +
+ + +## ADMX_Desktop policies + +
+
+ ADMX_Desktop/AD_EnableFilter +
+
+ ADMX_Desktop/AD_HideDirectoryFolder +
+
+ ADMX_Desktop/AD_QueryLimit +
+
+ ADMX_Desktop/ForceActiveDesktopOn +
+
+ ADMX_Desktop/NoActiveDesktop +
+
+ ADMX_Desktop/NoActiveDesktopChanges +
+
+ ADMX_Desktop/NoDesktop +
+
+ ADMX_Desktop/NoDesktopCleanupWizard +
+
+ ADMX_Desktop/NoInternetIcon +
+
+ ADMX_Desktop/NoMyComputerIcon +
+
+ ADMX_Desktop/NoMyDocumentsIcon +
+
+ ADMX_Desktop/NoNetHood +
+
+ ADMX_Desktop/NoPropertiesMyComputer +
+
+ ADMX_Desktop/NoPropertiesMyDocuments +
+
+ ADMX_Desktop/NoRecentDocsNetHood +
+
+ ADMX_Desktop/NoRecycleBinIcon +
+
+ ADMX_Desktop/NoRecycleBinProperties +
+
+ ADMX_Desktop/NoSaveSettings +
+
+ ADMX_Desktop/NoWindowMinimizingShortcuts +
+
+ ADMX_Desktop/Wallpaper +
+
+ ADMX_Desktop/sz_ATC_DisableAdd +
+
+ ADMX_Desktop/sz_ATC_DisableClose +
+
+ ADMX_Desktop/sz_ATC_DisableDel +
+
+ ADMX_Desktop/sz_ATC_DisableEdit +
+
+ ADMX_Desktop/sz_ATC_NoComponents +
+
+ ADMX_Desktop/sz_AdminComponents_Title +
+
+ ADMX_Desktop/sz_DB_DragDropClose +
+
+ ADMX_Desktop/sz_DB_Moving +
+
+ ADMX_Desktop/sz_DWP_NoHTMLPaper +
+
+ + +
+ + +**ADMX_AuditSettings/IncludeCmdLine** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
+ + + +Available in Windows 10 Insider Preview Build 20185. This policy setting determines what information is logged in security audit events when a new process has been created. This setting only applies when the Audit Process Creation policy is enabled. + +If you enable this policy setting, the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied. + +If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events. + +Default is Not configured. + +> [!NOTE] +> When this policy setting is enabled, any user with access to read the security events will be able to read the command line arguments for any successfully created process. Command line arguments can contain sensitive or private information, such as passwords or user data. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Include command line in process creation events* +- GP name: *IncludeCmdLine* +- GP path: *System/Audit Process Creation* +- GP ADMX file name: *AuditSettings.admx* + + + +
+ +Footnotes: + +- 1 - Available in Windows 10, version 1607. +- 2 - Available in Windows 10, version 1703. +- 3 - Available in Windows 10, version 1709. +- 4 - Available in Windows 10, version 1803. +- 5 - Available in Windows 10, version 1809. +- 6 - Available in Windows 10, version 1903. +- 7 - Available in Windows 10, version 1909. +- 8 - Available in Windows 10, version 2004. + + + From b998faccc7005b45a562178805e8551813a9eeab Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Thu, 3 Dec 2020 14:17:40 -0800 Subject: [PATCH 052/169] Added Desktop policies --- windows/client-management/mdm/TOC.md | 1 + .../mdm/policies-in-policy-csp-admx-backed.md | 29 + .../policy-configuration-service-provider.md | 92 + .../mdm/policy-csp-admx-desktop.md | 2006 ++++++++++++++++- 4 files changed, 2115 insertions(+), 13 deletions(-) diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index d30cc12164..3c50425e06 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -182,6 +182,7 @@ #### [ADMX_CredSsp](policy-csp-admx-credssp.md) #### [ADMX_CtrlAltDel](policy-csp-admx-ctrlaltdel.md) #### [ADMX_DataCollection](policy-csp-admx-datacollection.md) +#### [ADMX_Desktop](policy-csp-admx-desktop.md) #### [ADMX_DeviceInstallation](policy-csp-admx-devicenstallation.md) #### [ADMX_DeviceSetup](policy-csp-admx-devicesetup.md) #### [ADMX_DigitalLocker](policy-csp-admx-digitallocker.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index f2b1c25bd5..39282f0498 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -77,6 +77,35 @@ ms.date: 10/08/2020 - [ADMX_CtrlAltDel/DisableTaskMgr](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-disabletaskmgr) - [ADMX_CtrlAltDel/NoLogoff](./policy-csp-admx-ctrlaltdel.md#admx-ctrlaltdel-nologoff) - [ADMX_DataCollection/CommercialIdPolicy](./policy-csp-admx-datacollection.md#admx-datacollection-commercialidpolicy) +- [ADMX_Desktop/AD_EnableFilter](./policy-csp-admx-desktop.md#admx-desktop-ad-enablefilter) +- [ADMX_Desktop/AD_HideDirectoryFolder](./policy-csp-admx-desktop.md#admx-desktop-ad-hidedirectoryfolder) +- [ADMX_Desktop/AD_QueryLimit](./policy-csp-admx-desktop.md#admx-desktop-ad-querylimit) +- [ADMX_Desktop/ForceActiveDesktopOn](./policy-csp-admx-desktop.md#admx-desktop-forceactivedesktopon) +- [ADMX_Desktop/NoActiveDesktop](./policy-csp-admx-desktop.md#admx-desktop-noactivedesktop) +- [ADMX_Desktop/NoActiveDesktopChanges](./policy-csp-admx-desktop.md#admx-desktop-noactivedesktopchanges) +- [ADMX_Desktop/NoDesktop](./policy-csp-admx-desktop.md#admx-desktop-nodesktop) +- [ADMX_Desktop/NoDesktopCleanupWizard](./policy-csp-admx-desktop.md#admx-desktop-nodesktopcleanupwizard) +- [ADMX_Desktop/NoInternetIcon](./policy-csp-admx-desktop.md#admx-desktop-nointerneticon) +- [ADMX_Desktop/NoMyComputerIcon](./policy-csp-admx-desktop.md#admx-desktop-nomycomputericon) +- [ADMX_Desktop/NoMyDocumentsIcon](./policy-csp-admx-desktop.md#admx-desktop-nomydocumentsicon) +- [ADMX_Desktop/NoNetHood](./policy-csp-admx-desktop.md#admx-desktop-nonethood) +- [ADMX_Desktop/NoPropertiesMyComputer](./policy-csp-admx-desktop.md#admx-desktop-nopropertiesmycomputer) +- [ADMX_Desktop/NoPropertiesMyDocuments](./policy-csp-admx-desktop.md#admx-desktop-nopropertiesmydocuments) +- [ADMX_Desktop/NoRecentDocsNetHood](./policy-csp-admx-desktop.md#admx-desktop-norecentdocsnethood) +- [ADMX_Desktop/NoRecycleBinIcon](./policy-csp-admx-desktop.md#admx-desktop-norecyclebinicon) +- [ADMX_Desktop/NoRecycleBinProperties](./policy-csp-admx-desktop.md#admx-desktop-norecyclebinproperties) +- [ADMX_Desktop/NoSaveSettings](./policy-csp-admx-desktop.md#admx-desktop-nosavesettings) +- [ADMX_Desktop/NoWindowMinimizingShortcuts](./policy-csp-admx-desktop.md#admx-desktop-nowindowminimizingshortcuts) +- [ADMX_Desktop/Wallpaper](./policy-csp-admx-desktop.md#admx-desktop-wallpaper) +- [ADMX_Desktop/sz_ATC_DisableAdd](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableadd) +- [ADMX_Desktop/sz_ATC_DisableClose](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableclose) +- [ADMX_Desktop/sz_ATC_DisableDel](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disabledel) +- [ADMX_Desktop/sz_ATC_DisableEdit](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-disableedit) +- [ADMX_Desktop/sz_ATC_NoComponents](./policy-csp-admx-desktop.md#admx-desktop-sz-atc-nocomponents) +- [ADMX_Desktop/sz_AdminComponents_Title](./policy-csp-admx-desktop.md#admx-desktop-sz-admincomponents-title) +- [ADMX_Desktop/sz_DB_DragDropClose](./policy-csp-admx-desktop.md#admx-desktop-sz-db-dragdropclose) +- [ADMX_Desktop/sz_DB_Moving](./policy-csp-admx-desktop.md#admx-desktop-sz-db-moving) +- [ADMX_Desktop/sz_DWP_NoHTMLPaper](./policy-csp-admx-desktop.md#admx-desktop-sz-dwp-nohtmlpaper) - [ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-allowadmininstall) - [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-detailtext) - [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-simpletext) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 1e3e29a308..84380cee7e 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -385,6 +385,98 @@ The following diagram shows the Policy configuration service provider in tree fo
+### ADMX_Desktop policies + +
+
+ ADMX_Desktop/AD_EnableFilter +
+
+ ADMX_Desktop/AD_HideDirectoryFolder +
+
+ ADMX_Desktop/AD_QueryLimit +
+
+ ADMX_Desktop/ForceActiveDesktopOn +
+
+ ADMX_Desktop/NoActiveDesktop +
+
+ ADMX_Desktop/NoActiveDesktopChanges +
+
+ ADMX_Desktop/NoDesktop +
+
+ ADMX_Desktop/NoDesktopCleanupWizard +
+
+ ADMX_Desktop/NoInternetIcon +
+
+ ADMX_Desktop/NoMyComputerIcon +
+
+ ADMX_Desktop/NoMyDocumentsIcon +
+
+ ADMX_Desktop/NoNetHood +
+
+ ADMX_Desktop/NoPropertiesMyComputer +
+
+ ADMX_Desktop/NoPropertiesMyDocuments +
+
+ ADMX_Desktop/NoRecentDocsNetHood +
+
+ ADMX_Desktop/NoRecycleBinIcon +
+
+ ADMX_Desktop/NoRecycleBinProperties +
+
+ ADMX_Desktop/NoSaveSettings +
+
+ ADMX_Desktop/NoWindowMinimizingShortcuts +
+
+ ADMX_Desktop/Wallpaper +
+
+ ADMX_Desktop/sz_ATC_DisableAdd +
+
+ ADMX_Desktop/sz_ATC_DisableClose +
+
+ ADMX_Desktop/sz_ATC_DisableDel +
+
+ ADMX_Desktop/sz_ATC_DisableEdit +
+
+ ADMX_Desktop/sz_ATC_NoComponents +
+
+ ADMX_Desktop/sz_AdminComponents_Title +
+
+ ADMX_Desktop/sz_DB_DragDropClose +
+
+ ADMX_Desktop/sz_DB_Moving +
+
+ ADMX_Desktop/sz_DWP_NoHTMLPaper +
+
+ ### ADMX_DeviceInstallation policies
diff --git a/windows/client-management/mdm/policy-csp-admx-desktop.md b/windows/client-management/mdm/policy-csp-admx-desktop.md index 11256a18ee..3cabf5f777 100644 --- a/windows/client-management/mdm/policy-csp-admx-desktop.md +++ b/windows/client-management/mdm/policy-csp-admx-desktop.md @@ -115,7 +115,7 @@ manager: dansimp
-**ADMX_AuditSettings/IncludeCmdLine** +**ADMX_Desktop/AD_EnableFilter** @@ -152,22 +152,19 @@ manager: dansimp [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] -> * Device +> * User
-Available in Windows 10 Insider Preview Build 20185. This policy setting determines what information is logged in security audit events when a new process has been created. This setting only applies when the Audit Process Creation policy is enabled. +Available in the latest Windows 10 Insider Preview Build. Displays the filter bar above the results of an Active Directory search. The filter bar consists of buttons for applying additional filters to search results. -If you enable this policy setting, the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied. +If you enable this setting, the filter bar appears when the Active Directory Find dialog box opens, but users can hide it. -If you disable or do not configure this policy setting, the process's command line information will not be included in Audit Process Creation events. +If you disable this setting or do not configure it, the filter bar does not appear, but users can display it by selecting "Filter" on the "View" menu. -Default is Not configured. - -> [!NOTE] -> When this policy setting is enabled, any user with access to read the security events will be able to read the command line arguments for any successfully created process. Command line arguments can contain sensitive or private information, such as passwords or user data. +To see the filter bar, open Network Locations, click Entire Network, and then click Directory. Right-click the name of a Windows domain, and click Find. Type the name of an object in the directory, such as "Administrator." If the filter bar does not appear above the resulting display, on the View menu, click Filter. > [!TIP] @@ -179,10 +176,1993 @@ Default is Not configured. ADMX Info: -- GP English name: *Include command line in process creation events* -- GP name: *IncludeCmdLine* -- GP path: *System/Audit Process Creation* -- GP ADMX file name: *AuditSettings.admx* +- GP English name: *Enable filter in Find dialog box* +- GP name: *AD_EnableFilter* +- GP path: *Desktop\Active Directory* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/AD_HideDirectoryFolder** + + +
+ + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Hides the Active Directory folder in Network Locations. + +The Active Directory folder displays Active Directory objects in a browse window. + +If you enable this setting, the Active Directory folder does not appear in the Network Locations folder. + +If you disable this setting or do not configure it, the Active Directory folder appears in the Network Locations folder. + +This setting is designed to let users search Active Directory but not tempt them to casually browse Active Directory. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Active Directory folder* +- GP name: *AD_HideDirectoryFolder* +- GP path: *Desktop\Active Directory* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/AD_QueryLimit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Specifies the maximum number of objects the system displays in response to a command to browse or search Active Directory. This setting affects all browse displays associated with Active Directory, such as those in Local Users and Groups, Active Directory Users and Computers, and dialog boxes used to set permissions for user or group objects in Active Directory. + +If you enable this setting, you can use the "Number of objects returned" box to limit returns from an Active Directory search. + +If you disable this setting or do not configure it, the system displays up to 10,000 objects. This consumes approximately 2 MB of memory or disk space. + +This setting is designed to protect the network and the domain controller from the effect of expansive searches. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Maximum size of Active Directory searches* +- GP name: *AD_QueryLimit* +- GP path: *Desktop\Active Directory* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/ForceActiveDesktopOn** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Enables Active Desktop and prevents users from disabling it. + +This setting prevents users from trying to enable or disable Active Desktop while a policy controls it. + +If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. + +> [!NOTE] +> If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting (in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both of these policies are ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Enable Active Desktop* +- GP name: *ForceActiveDesktopOn* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoActiveDesktop** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Disables Active Desktop and prevents users from enabling it. + +This setting prevents users from trying to enable or disable Active Desktop while a policy controls it. + +If you disable this setting or do not configure it, Active Desktop is disabled by default, but users can enable it. + +> [!NOTE] +> If both the "Enable Active Desktop" setting and the "Disable Active Desktop" setting are enabled, the "Disable Active Desktop" setting is ignored. If the "Turn on Classic Shell" setting (in User Configuration\Administrative Templates\Windows Components\Windows Explorer) is enabled, Active Desktop is disabled, and both these policies are ignored. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable Active Desktop* +- GP name: *NoActiveDesktop* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoActiveDesktopChanges** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevents the user from enabling or disabling Active Desktop or changing the Active Desktop configuration. + +This is a comprehensive setting that locks down the configuration you establish by using other policies in this folder. This setting removes the Web tab from Display in Control Panel. As a result, users cannot enable or disable Active Desktop. If Active Desktop is already enabled, users cannot add, remove, or edit Web content or disable, lock, or synchronize Active Desktop components. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit changes* +- GP name: *NoActiveDesktopChanges* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoDesktop** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Removes icons, shortcuts, and other default and user-defined items from the desktop, including Briefcase, Recycle Bin, Computer, and Network Locations. + +Removing icons and shortcuts does not prevent the user from using another method to start the programs or opening the items they represent. + +Also, see "Items displayed in Places Bar" in User Configuration\Administrative Templates\Windows Components\Common Open File Dialog to remove the Desktop icon from the Places Bar. This will help prevent users from saving data to the Desktop. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide and disable all items on the desktop* +- GP name: *NoDesktop* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoDesktopCleanupWizard** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from using the Desktop Cleanup Wizard. + +If you enable this setting, the Desktop Cleanup wizard does not automatically run on a users workstation every 60 days. The user will also not be able to access the Desktop Cleanup Wizard. + +If you disable this setting or do not configure it, the default behavior of the Desktop Clean Wizard running every 60 days occurs. + +> [!NOTE] +> When this setting is not enabled, users can run the Desktop Cleanup Wizard, or have it run automatically every 60 days from Display, by clicking the Desktop tab and then clicking the Customize Desktop button. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove the Desktop Cleanup Wizard* +- GP name: *NoDesktopCleanupWizard* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoInternetIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Removes the Internet Explorer icon from the desktop and from the Quick Launch bar on the taskbar. + +This setting does not prevent the user from starting Internet Explorer by using other methods. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Internet Explorer icon on desktop* +- GP name: *NoInternetIcon* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoMyComputerIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This setting hides Computer from the desktop and from the new Start menu. It also hides links to Computer in the Web view of all Explorer windows, and it hides Computer in the Explorer folder tree pane. If the user navigates into Computer via the "Up" button while this setting is enabled, they view an empty Computer folder. This setting allows administrators to restrict their users from seeing Computer in the shell namespace, allowing them to present their users with a simpler desktop environment. + +If you enable this setting, Computer is hidden on the desktop, the new Start menu, the Explorer folder tree pane, and the Explorer Web views. If the user manages to navigate to Computer, the folder will be empty. + +If you disable this setting, Computer is displayed as usual, appearing as normal on the desktop, Start menu, folder tree pane, and Web views, unless restricted by another setting. + +If you do not configure this setting, the default is to display Computer as usual. + +> [!NOTE] +> In operating systems earlier than Microsoft Windows Vista, this policy applies to the My Computer icon. Hiding Computer and its contents does not hide the contents of the child folders of Computer. For example, if the users navigate into one of their hard drives, they see all of their folders and files there, even if this setting is enabled. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Computer icon on the desktop* +- GP name: *NoMyComputerIcon* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoMyDocumentsIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Removes most occurrences of the My Documents icon. + +This setting removes the My Documents icon from the desktop, from File Explorer, from programs that use the File Explorer windows, and from the standard Open dialog box. + +This setting does not prevent the user from using other methods to gain access to the contents of the My Documents folder. + +This setting does not remove the My Documents icon from the Start menu. To do so, use the "Remove My Documents icon from Start Menu" setting. + +> [!NOTE] +> To make changes to this setting effective, you must log off from and log back on to Windows 2000 Professional. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove My Documents icon on the desktop* +- GP name: *NoMyDocumentsIcon* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoNetHood** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Removes the Network Locations icon from the desktop. + +This setting only affects the desktop icon. It does not prevent users from connecting to the network or browsing for shared computers on the network. + +> [!NOTE] +> In operating systems earlier than Microsoft Windows Vista, this policy applies to the My Network Places icon. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Hide Network Locations icon on desktop* +- GP name: *NoNetHood* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoPropertiesMyComputer** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This setting hides Properties on the context menu for Computer. + +If you enable this setting, the Properties option will not be present when the user right-clicks My Computer or clicks Computer and then goes to the File menu. Likewise, Alt-Enter does nothing when Computer is selected. + +If you disable or do not configure this setting, the Properties option is displayed as usual. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Properties from the Computer icon context menu* +- GP name: *NoPropertiesMyComputer* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoPropertiesMyDocuments** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. This policy setting hides the Properties menu command on the shortcut menu for the My Documents icon. + +If you enable this policy setting, the Properties menu command will not be displayed when the user does any of the following: + +- Right-clicks the My Documents icon. +- Clicks the My Documents icon, and then opens the File menu. +- Clicks the My Documents icon, and then presses ALT+ENTER. + +If you disable or do not configure this policy setting, the Properties menu command is displayed. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Properties from the Documents icon context menu* +- GP name: *NoPropertiesMyDocuments* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoRecentDocsNetHood** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Remote shared folders are not added to Network Locations whenever you open a document in the shared folder. + +If you disable this setting or do not configure it, when you open a document in a remote shared folder, the system adds a connection to the shared folder to Network Locations. + +If you enable this setting, shared folders are not added to Network Locations automatically when you open a document in the shared folder. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Do not add shares of recently opened documents to Network Locations* +- GP name: *NoRecentDocsNetHood* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoRecycleBinIcon** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Removes most occurrences of the Recycle Bin icon. + +This setting removes the Recycle Bin icon from the desktop, from File Explorer, from programs that use the File Explorer windows, and from the standard Open dialog box. + +This setting does not prevent the user from using other methods to gain access to the contents of the Recycle Bin folder. + +> [!NOTE] +> To make changes to this setting effective, you must log off and then log back on. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Recycle Bin icon from desktop* +- GP name: *NoRecycleBinIcon* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoRecycleBinProperties** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Removes the Properties option from the Recycle Bin context menu. + +If you enable this setting, the Properties option will not be present when the user right-clicks on Recycle Bin or opens Recycle Bin and then clicks File. Likewise, Alt-Enter does nothing when Recycle Bin is selected. + +If you disable or do not configure this setting, the Properties option is displayed as usual. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Remove Properties from the Recycle Bin context menu* +- GP name: *NoRecycleBinProperties* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoSaveSettings** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from saving certain changes to the desktop. + +If you enable this setting, users can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Don't save settings at exit* +- GP name: *NoSaveSettings* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/NoWindowMinimizingShortcuts** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevents windows from being minimized or restored when the active window is shaken back and forth with the mouse. + +If you enable this policy, application windows will not be minimized or restored when the active window is shaken back and forth with the mouse. + +If you disable or do not configure this policy, this window minimizing and restoring gesture will apply. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Turn off Aero Shake window minimizing mouse gesture* +- GP name: *NoWindowMinimizingShortcuts* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/Wallpaper** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Specifies the desktop background ("wallpaper") displayed on all users' desktops. + +This setting lets you specify the wallpaper on users' desktops and prevents users from changing the image or its presentation. The wallpaper you specify can be stored in a bitmap (*.bmp) or JPEG (*.jpg) file. + +To use this setting, type the fully qualified path and name of the file that stores the wallpaper image. You can type a local path, such as C:\Windows\web\wallpaper\home.jpg or a UNC path, such as \\\Server\Share\Corp.jpg. If the specified file is not available when the user logs on, no wallpaper is displayed. Users cannot specify alternative wallpaper. You can also use this setting to specify that the wallpaper image be centered, tiled, or stretched. Users cannot change this specification. + +If you disable this setting or do not configure it, no wallpaper is displayed. However, users can select the wallpaper of their choice. + +Also, see the "Allow only bitmapped wallpaper" in the same location, and the "Prevent changing wallpaper" setting in User Configuration\Administrative Templates\Control Panel. + +> [!NOTE] +> This setting does not apply to remote desktop server sessions. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Desktop Wallpaper* +- GP name: *Wallpaper* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/sz_ATC_DisableAdd** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from adding Web content to their Active Desktop. + +This setting removes the "New" button from Web tab in Display in Control Panel. As a result, users cannot add Web pages or pictures from the Internet or an intranet to the desktop. This setting does not remove existing Web content from their Active Desktop, or prevent users from removing existing Web content. + +Also, see the "Disable all items" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit adding items* +- GP name: *sz_ATC_DisableAdd* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/sz_ATC_DisableClose** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from removing Web content from their Active Desktop. + +In Active Desktop, you can add items to the desktop but close them so they are not displayed. + +If you enable this setting, items added to the desktop cannot be closed; they always appear on the desktop. This setting removes the check boxes from items on the Web tab in Display in Control Panel. + +> [!NOTE] +> This setting does not prevent users from deleting items from their Active Desktop. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit closing items* +- GP name: *sz_ATC_DisableClose* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/sz_ATC_DisableDel** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from deleting Web content from their Active Desktop. + +This setting removes the Delete button from the Web tab in Display in Control Panel. As a result, users can temporarily remove, but not delete, Web content from their Active Desktop. + +This setting does not prevent users from adding Web content to their Active Desktop. + +Also, see the "Prohibit closing items" and "Disable all items" settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit deleting items* +- GP name: *sz_ATC_DisableDel* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/sz_ATC_DisableEdit** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the properties of Web content items on their Active Desktop. + +This setting disables the Properties button on the Web tab in Display in Control Panel. Also, it removes the Properties item from the menu for each item on the Active Desktop. As a result, users cannot change the properties of an item, such as its synchronization schedule, password, or display characteristics. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit editing items* +- GP name: *sz_ATC_DisableEdit* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/sz_ATC_NoComponents** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Removes Active Desktop content and prevents users from adding Active Desktop content. + +This setting removes all Active Desktop items from the desktop. It also removes the Web tab from Display in Control Panel. As a result, users cannot add Web pages or pictures from the Internet or an intranet to the desktop. + +> [!NOTE] +> This setting does not disable Active Desktop. Users can still use image formats, such as JPEG and GIF, for their desktop wallpaper. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Disable all items* +- GP name: *sz_ATC_NoComponents* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/sz_AdminComponents_Title** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Adds and deletes specified Web content items. + +You can use the "Add" box in this setting to add particular Web-based items or shortcuts to users' desktops. Users can close or delete the items (if settings allow), but the items are added again each time the setting is refreshed. + +You can also use this setting to delete particular Web-based items from users' desktops. Users can add the item again (if settings allow), but the item is deleted each time the setting is refreshed. + +> [!NOTE] +> Removing an item from the "Add" list for this setting is not the same as deleting it. Items that are removed from the "Add" list are not removed from the desktop. They are simply not added again. + +> [!NOTE] +> For this setting to take affect, you must log off and log on to the system. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Add/Delete items* +- GP name: *sz_AdminComponents_Title* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/sz_DB_DragDropClose** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from manipulating desktop toolbars. + +If you enable this setting, users cannot add or remove toolbars from the desktop. Also, users cannot drag toolbars on to or off of docked toolbars. + +> [!NOTE] +> If users have added or removed toolbars, this setting prevents them from restoring the default configuration. + +> [!TIP] +> To view the toolbars that can be added to the desktop, right-click a docked toolbar (such as the taskbar beside the Start button), and point to "Toolbars." + +Also, see the "Prohibit adjusting desktop toolbars" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prevent adding, dragging, dropping and closing the Taskbar's toolbars* +- GP name: *sz_DB_DragDropClose* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/sz_DB_Moving** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Prevents users from adjusting the length of desktop toolbars. Also, users cannot reposition items or toolbars on docked toolbars. + +This setting does not prevent users from adding or removing toolbars on the desktop. + +> [!NOTE] +> If users have adjusted their toolbars, this setting prevents them from restoring the default configuration. + +Also, see the "Prevent adding, dragging, dropping and closing the Taskbar's toolbars" setting. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Prohibit adjusting desktop toolbars* +- GP name: *sz_DB_Moving* +- GP path: *Desktop* +- GP ADMX file name: *Desktop.admx* + + + +
+ + +**ADMX_Desktop/sz_DWP_NoHTMLPaper** + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Windows EditionSupported?
Homecross mark
Procross mark
Businesscross mark
Enterprisecheck mark
Educationcross mark
+ + +
+ + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * User + +
+ + + +Available in the latest Windows 10 Insider Preview Build. Permits only bitmap images for wallpaper. This setting limits the desktop background ("wallpaper") to bitmap (.bmp) files. If users select files with other image formats, such as JPEG, GIF, PNG, or HTML, through the Browse button on the Desktop tab, the wallpaper does not load. Files that are autoconverted to a .bmp format, such as JPEG, GIF, and PNG, can be set as Wallpaper by right-clicking the image and selecting "Set as Wallpaper". + +Also, see the "Desktop Wallpaper" and the "Prevent changing wallpaper" (in User Configuration\Administrative Templates\Control Panel\Display) settings. + + +> [!TIP] +> This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). +> +> You must specify the data type in the SyncML as <Format>chr</Format>. For an example SyncML, refer to [Enabling a policy](./understanding-admx-backed-policies.md#enabling-a-policy). +> +> The payload of the SyncML must be XML-encoded; for this XML encoding, there are a variety of online encoders that you can use. To avoid encoding the payload, you can use CDATA if your MDM supports it. For more information, see [CDATA Sections](http://www.w3.org/TR/REC-xml/#sec-cdata-sect). + + +ADMX Info: +- GP English name: *Allow only bitmapped wallpaper* +- GP name: *sz_DWP_NoHTMLPaper* +- GP path: *Desktop\Desktop* +- GP ADMX file name: *Desktop.admx* From 875568eadfe78cd14ab87461f0013a8fb97165bc Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Sun, 6 Dec 2020 00:33:16 +0100 Subject: [PATCH 053/169] MarkDown syntax highlighting, whitespace cleanup As I mentioned in PR #8704 (**Format of resolution for "The TPM is locked out."**), "ps" does not identify as a syntax highlighting code keyword for PowerShell. The keywords "powershell" or "PowerShell" should be used in the current implementation of GitHub Flavored MarkDown (GFM). The syntax highlighting added in PR PR #8704, "ps" translates to PostScript via one of its filename extensions (.ps, .eps, .epsi, .pfa), whereas PowerShell can only be identified via its filename extensions .ps1, .psd1, .psm1 when not using its dedicated keyword PowerShell/powershell. Secondary IDs like filename extensions are discouraged as long as known keywords exist and are valid. The Linguist project here on GitHub (https://github.com/github/linguist) for a complete list of syntax highlighting keywords: - https://github.com/github/linguist/blob/master/lib/linguist/languages.yml ("Defines all Languages known to GitHub.") Proposed changes: - correct the MarkDown code block syntax highlighting keyword "ps" to "powershell" Whitespace changes: - remove redundant end-of-line blanks - reduce the spacing between metadata and page title from 2 to 1 blank line - add missing NewLine at end-of-file (last line) Ticket closure or reference: ref. #8704 --- .../ts-bitlocker-cannot-encrypt-tpm-issues.md | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md index 7d66ced22c..121d7cd8a1 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md @@ -1,5 +1,5 @@ --- -title: BitLocker cannot encrypt a drive known TPM issues +title: BitLocker cannot encrypt a drive known TPM issues description: Provides guidance for troubleshooting known issues that may prevent BitLocker Drive Encryption from encrypting a drive, and that you can attribute to the TPM ms.reviewer: kaushika ms.technology: windows @@ -16,7 +16,6 @@ ms.date: 10/18/2019 ms.custom: bitlocker --- - # BitLocker cannot encrypt a drive: known TPM issues This article describes common issues that affect the Trusted Platform Module (TPM) and that may prevent BitLocker from encrypting a drive. This article also provides guidance to address these issues. @@ -38,7 +37,7 @@ To resolve this issue, follow these steps: 1. Open an elevated PowerShell window and run the following script: - ```ps + ```powershell $Tpm = Get-WmiObject -class Win32_Tpm -namespace "root\CIMv2\Security\MicrosoftTpm" $ConfirmationStatus = $Tpm.GetPhysicalPresenceConfirmationStatus(22).ConfirmationStatus if($ConfirmationStatus -ne 4) {$Tpm.SetPhysicalPresenceRequest(22)} @@ -69,7 +68,7 @@ To resolve this issue, disable and re-enable the TPM. To do this, follow these s If you still cannot prepare the TPM, clear the existing TPM keys. To do this, follow the instructions in [Troubleshoot the TPM: Clear all the keys from the TPM](https://docs.microsoft.com/windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm#clear-all-the-keys-from-the-tpm). > [!WARNING] -> Clearing the TPM can cause data loss. +> Clearing the TPM can cause data loss. ## Access Denied: Failed to backup TPM Owner Authorization information to Active Directory Domain Services. Errorcode: 0x80070005 @@ -81,7 +80,7 @@ The TPM did not have sufficient permissions on the TPM Devices container in Acti This issue appears to be limited to computers that run versions of Windows that are earlier than Windows 10. -### Resolution +### Resolution To verify that you have correctly identified this issue, use one of the following methods: @@ -90,7 +89,7 @@ To verify that you have correctly identified this issue, use one of the followin 1. To review the TPM information for the affected computer, open an elevated Windows PowerShell window and run the following command: - ```ps + ```powershell Get-ADComputer -Filter {Name -like "ComputerName"} -Property * | Format-Table name,msTPM-TPMInformationForComputer ``` @@ -100,7 +99,7 @@ To verify that you have correctly identified this issue, use one of the followin ## Cannot prepare the TPM, error 0x80072030: "There is no such object on the server" -Your domain controllers were upgraded from Windows Server 2008 R2to Windows Server 2012 R2. A Group Policy Object (GPO) enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy. +Your domain controllers were upgraded from Windows Server 2008 R2to Windows Server 2012 R2. A Group Policy Object (GPO) enforces the **Do not enable BitLocker until recovery information is stored in AD DS** policy. You cannot turn on BitLocker Drive Encryption on a device. You use the TPM management console (tpm.msc) to prepare the TPM on a device. The operation fails and you see a message that resembles the following: @@ -121,10 +120,10 @@ To resolve this issue, follow these steps: 1. In the script, modify the value of **strPathToDomain** to your domain name. 1. Open an elevated PowerShell window, and run the following command: - ```ps + ```powershell cscript Add-TPMSelfWriteACE.vbs ``` - + In this command \<*Path*> is the path to the script file. For more information, see the following articles: From a5138b7534fb0c94df82070b29037cb898e1fc38 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Mon, 7 Dec 2020 14:49:22 +0200 Subject: [PATCH 054/169] add link about AD config for BitLocker https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8621 --- .../bitlocker/bitlocker-group-policy-settings.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index d9658a3113..91bf628e8b 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -37,6 +37,9 @@ Most of the BitLocker Group Policy settings are applied when BitLocker is initia If multiple changes are necessary to bring the drive into compliance, you must suspend BitLocker protection, make the necessary changes, and then resume protection. This situation could occur, for example, if a removable drive was initially configured to be unlocked with a password and then Group Policy settings are changed to disallow passwords and require smart cards. In this situation, you need to suspend BitLocker protection by using the [Manage-bde](/windows-server/administration/windows-commands/manage-bde) command-line tool, delete the password unlock method, and add the smart card method. After this is complete, BitLocker is compliant with the Group Policy setting and BitLocker protection on the drive can be resumed. +> [!NOTE] +> For more details about Active Directory configuration related to BitLocker enablement, please check [this article](https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker). + ## BitLocker Group Policy settings The following sections provide a comprehensive list of BitLocker Group Policy settings that are organized by usage. BitLocker Group Policy settings include settings for specific drive types (operating system drives, fixed data drives, and removable data drives) and settings that are applied to all drives. From db84674324f84163081a89c3c1287ac77e7ee1c0 Mon Sep 17 00:00:00 2001 From: Sunayana Singh Date: Tue, 8 Dec 2020 15:32:24 +0530 Subject: [PATCH 055/169] Adding VPN configuration details --- .../images/ios-vpn-config.png | Bin 0 -> 67699 bytes .../ios-configure-features.md | 26 ++++++++++++++---- 2 files changed, 21 insertions(+), 5 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/ios-vpn-config.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/ios-vpn-config.png b/windows/security/threat-protection/microsoft-defender-atp/images/ios-vpn-config.png new file mode 100644 index 0000000000000000000000000000000000000000..6b809309ba166d83442edb38584ce1790ceed6b3 GIT binary patch literal 67699 zcmeFZby!th*EhQ9?(Qz>?vQR!N>YhUNNl=ON(4bdx=U#Uq`Nx>q`RcM;ahmeb3f;M z&U?Q1y3Y6Ci{QmtYs@j{9CPGvtWB7@svH_JF)|1QLQ{~JehC6WrGr2){)q6v9b|F5 zArJ`H$W!x`^GjnlN_$6$xs?r=(%HivObK?kG6#X&XD5?&9ccvPWgfqM(1YGI79=De z^hEf6Cp4|VL@Q%vp{4&AmxxWI>V|L>BHTJLBmTHm?{}mjxyP0;wflAQG**t>;Uw#J zdc^$!J|m;0OzPqRx0%AtAU0hsTI%NPCINDKPEOx5P=+GbjktU3Fuk|CzF9S9?bt<$m=iltGhleYTo%L4-0*Bx8`L|S2eeul>FJw$S`?? ztikIUE!Qrpp7*Me(hoO31fw7sG&4=;O%{?8&8&xO3%6xZH~8z?OG>vy_akcJ?b{jmBo0w05}23mLS`y8(32pEE{<{TGWF4KL>nzZ?y=(5iZUo84a%T3#_ zQm^mS6`#Dl!xyXB;&pcszo*~mfwZ{qb4b!MPY08#Ca%DHExP?w=9CNncuDA{Jn}7F zk2G3D++!8b&c-S?R!DGu%s`PeGQ$aJq;`!65<1+=VE-0%UfJq#AmMhY`A*H~V6g-f zZt1l{Hd~^OW@}Oi*O!)58Oe5^tr8Ka2lu9l!8d~eF|JT|E(ZjBlyE6zR9Y>;VkTQ3(( zm}0HxKKzkx>TAavoG`|Md|5l$WLoAe$@{ALf-K#aeR*+udOM{NT-Jqk@p{%p&~-B} z2TH1D^>%HmW;8~c&Sv!wea-||<=?y^a;X~YA#{@EC$e-b>${GnVJ@vYc~(?feM4+* z*Ke_9=(=EgDS9DtoC~9z>N&e(k!saOByT+PLCbo|_GjadSrz^z$6ec+C5J7GsrCk2 zzvhR);$XL_)mWyqX|c-g7t^yntnZd{87<6MHYK`KxFnv-Z46$1a?;$4;})k@c|je^ z(*IHTIT20pj3f)c_vV4l=0izi-S}fkV^_;Ss>ZJeajq@-g+q^9si{bJJ8>c}mn@TC zI16r4U;|_>$3+oWi43CCa)X=R&WXdV5kuC`V34UOUA_Y>gGGq;K(p5@{ORgNB#-?j z(>3(Vo>y}8Z1nWvrg5=D@AJNXN$KjtEt<62sCGc+wsXn&7GJk^C@|1%RmsX&>k1Ez zp=5aHHUd8Ro@aj(`7N@~pQKrqmPLL34%yq{irblI-^{ql$izVE+pfv`qO-Ohle;%|w8CRSZe>3T@ZWw6 z3z~PUS+9dbN>qLyPZg)@lr{vZ2yGg(_u|m)>Qorsu3p`n@ag8AD$DoV;*Hz*akjNc`GN4*(+h$hb7an{k$~SEijAq&YiK zRg_VRGpE}L=iyDgxQXWoW1@kRsVQ2h9R{V#Fghmg@b{42Vp`XA@2 z>~VLzfk$9ZM`np`hxJ^D^E0!=fCLwBeP3c?kkb^vvP&nq}S}n2c%*marO%&+{O`;W3ha@3{w1ZX5Pc?@KtejTk@d^Sx1AQu?J3 z5PNjTw__D07?H;yctiV;Rzk=PkFD!0hGP7wzC8P#oUY1iz7HUW3Is>TQgD zHlzJo(C}oO80zH%R6q5RYQL!-QCzsR-tv^Ab(Xr3A(QO15uvK&(RPu#*mt^zGi5eB zQwUCAeoOa46DKi$z%Zb3nUol#kaau7!%8R%3mZ<4;{6!0)nVPM&dkUSZw>?}%u@MV z)lJKVZ;3HMg>T8I5!sp5c6{94AJ1L;Io!NAD~ad5>b@j>miGpsnjgyNQ#S0)bInoS zwzY6=;VTJhq*D>1RH)g&G16ylS$<=Iy=b|#g`ewTT{1g#1qGDO+NYX5o8KdM*RGO% z*dx`#BMY3BvUDKkqNl_Xx}W0kkJG0LsW>RdZh{hCQJBz`KKtQ{dh{CQEGzgTKhN~I^ zQS6c4g#BRPC*MH^3Rc!JHgb_RV*GqnQ;_{9=xVx5r!al|B~#pGTSSX0U$T4AX!k-f zyNv>I&A>ub{{yw-0!k+F_%d8?;X2BdH>ogFE7Lb`K^|ESFQv7Oy?Rj>WD&w9IQVLl zp50$M+*;UMQYa`9%7(p3lH$+)1)q=c^=EW^DB~E00CcO!m}x70@F?UW6rG&WCK*a6 z{+QfrobB0pkl5;;47JNx8eEhdrLOu_Z!QMZe#|z~q|6jS8SjVwW8CaRS3@$(_kukV zJTOv&CEb~;XH*{&xqd~x@H7jYIr+})s?t&fRpkxVT<** z9lN9vuArdF6uS_cgUGRo!I8KahI8c(xZmj=sBlm;d5_TOg@18q2ZR*9SBjwdDwHa= zW>j7Fvu16KBQU77da46f1_R6PDi^t9AOCyoPZXz;EB9Xl??SyZnotA~KM}$!ohV`I zC+hfzm=EhAPL(AnD}GCT%YYxW$Lv2EUS{;(cv$Q`>ggHB6baA!O_W+cqvKGN@`r&* zusZRAUw%}tR4$efDr!-oi2P3Gjx(IGbbi{m=zwfjWnwHmHFBgky!);45cQ}5#%8YB z9-Dlb(XzDn=1R~!b9u4sn!$=JZm~?CLQk+XPF=|4kt&jqy&shuuveb(a*X;cL!`~J z_j?kO`PY@5d4UQ->% z^7aTDQlDZrMSSs1xmiW6uu`Mca*VHlYmYLBHVIXP)1Ea5S`}Gc{R37K7ubzZEtxn@ zW0SLYrE~9%29lJG_raT^ZD{c*7pcp2f2BU;fG;<`5sU;xcz4Ee!!8n+&!hIfm9wL; zWPfpBE6<$g(|c1$$mm**);F)KRcX|dXGk?PMC8xyF5Ta7F>0xs8$m~$7tJoRA!V?> z{D#mnCX_w?oVvll{skt=Fucl(Hg#NmNG|4QontwoFUCfRrMU*v?89F8w+mV^e=H5(ap*?OkcZ*oON1Im%<8t)U-WoxnPgmD zv2;{5&m%%ajGH})Ot$Q8Un~(>-OjHWj}`3iD@8I9yUgJoU`mpW`aZfJbO(3Em0Dsv zRi`sSK2b34J4@N)J!;!~xKWd5disqYO z8wDuS)bJ3Nyb|7=g#yc?<@VQ+gh<~|iK%NduF= zha8kI5fl{Wb$m!%X_IZB+$A73JNonmAERnp-*hr^nJ!DO2+WYp`l}5hvka3Y#zJ-W zPIVDowlNX+e!{e1h}u&jtAn$t_bD2??vfoK@HLrvuYo9aeDWrU1+F5%SokFt(IR=Q zgcRE`Y<;mZ{#tyHj(fz1=$0Ndc3XlgAz>?39~Ca8ZwK$#LjoulnF74Al z>t_j@Uq;DQD5#`zKd1M+iRW8IW0r@Ivh<~^E6dNKeHs7attbwa|9QKYI!q`81WJ0? zn?q5DVj4uXjb<=`vW;P|m;4;CnP>0;No%f3lyE+#>8H}IV_MG7uh7H+NR-k$%<$Ro z?mp#vm-lNvo-to2S(bd%O#RVZs=@uje{xpH(Tj+a>^m>>w|7IkN3&8QpPnVf#!Kq1 z^OW<~_A8?q%hd!*O&cOZ@|oV`1oKSU#qf=OA%`c0C8-^p!$bm$psKvVJ`UZ^$)qk! z?WeCuQ)Xjz*<3(NmO+S7#)?cw5jA>$i)%-C_H|=ixLVr!r3}6msdF_dOHtwrL#5l@ zF~)XJ(b_$_;n;P=^f0AF*^T@XOB&D#DT7jP$p*`2F@k;q6C4o}A!n^Hb1y}alYPf zRO+CGV--%HQa_vCF`fxi#!ZtobNt%vHc4Q^x2|{+OFk5x;W#|T_E=c}iqA|xi^~r{ z(k|bvB^2dsW!^(w3*3Z>AUQ!!T&sIcz_&l+_$xt5V=j&G>iiYcJeDF-fHeYWLrh&) z_nr>Dodz4d^hJt$XM~`9&Lt8wrM{w`DS8>D2Z_!YAU0iX zUJjl18w=qf^Ci}8%b%rZ>ATk1$(zvin2=QwJvN3PD6k2Mu0PMVp=X~9oniUov`t8d z4wxy$P{&l=_Ih|l+xGDur6HLz#OQs&q^n?(Nng(zU15WUPvtvAj3N(%h`wv7xkH4r zPd<+XX}b{lA$y6Pqk%8wI-}q34(IJ%gQ)@sD&JO7x<|-XgXL*A z%0g6(ki2{(HSJe;QKFvyoWtc^qi5j?|3LahE97rUiAxf=EUD=Aj`s5cawYS?6!C4)kLb~G%ZWXF{F zYxYzaZ@PMJ9G8+LODVcv)r#7=gf}s*ors*)4y~Trn9vlC>9@wEzrgiJZ|Z(!e>qu7 zA6nW#_Wa@Q5Q?N`(`{w9$iXFH>lm5*cv`~Kp!)-yS|Zk4iUbvF?L%32^4-Vg9M|(t z7%UG20vM(BDBEv;0nlTxm6Vjaf|S%>NF#tRrusyS%6CW*hAibPhHH}UQI1ndxnQDX zQ%An+qJG6_8>~&H%yu70kEZY;JZD+Y{>b9nujSR^qQD|b#0P%?K_RAk`LHFrV0_L+ zhxrb#rCY~KGD@BzWnM3OkXB`cGd0`hNs-Ai9u=%rBo#HMhMGBkUNlC78y=n+(snKKcG z#8)gX-{!lDZN7F+biR<8WPIIQS8TtyTCBZW?4$P3uKrxV&pu5X7Kw!_3|G4MYtFl8 zES;9q@|@B6r?sJeKaaok(!~}*%SOWe$dq)vTlPC@s4;hVJFbG<6|hJ!_do~*-5^n9 zJh#+Sy&wd2H`4lf>UcW2b&p}^Vu4++Q4Gzs6;c=Vk+1Ah z90EKfpqaM@vhS2C2GadCd4gtdj~Efp=(Vu6(00&#uRn3HgyDzoSp0P@6$%8xw6Ox9 z-&ZQiLZ%Q~He)l037E~@)*gU{K_C%vcY9+~Yp^q=3E0BQPL%qvp@o{#%1o46hgXF| z#a;?*X(jLJ2-fga)im|AHWf6Z78gSnaTfv@*n*vnDcx;t?3{$$MX7)D6#{;Ly3I~a z`J2SqT9o>giaMnf#1Tx%!^XqL!7Af!<;q1ZhD<5qXl5?-Qd;&;7QmG#wWYJOy%0OQ zo0}V(8#f!o(Sn^*P*9MagNvPuixr??b@H%tHg;#VbE0`-@dpoSu#>5ymA$hS#E$Zb zr?Cmd#aWb^8hB3mCv)Jbsf;^t^Un#Mu79(4ayDaE04{id{Qv~)TpSz%tQ=gdT!QTX z91lEIQTcncoztIE1mwx?Zfwua$;QEMYx{2_oSbD`|25x#9O0x1An@!j!A=ktM^mtj zE7;DN=AV<=+qgLWb50j0@YAi|>$Wj7X9pJbd**+RkyB7n|9i}n7%i-9?SGGWqW&kP znd#qj_AZV#ziG@&*}*noTVNqh0B6pBqkrlY{5|5|_Ve`Qe_M#XCBzxxWC^kV&tv|6 z{J#wZ*7=`@{3Yn$oA`YoLedaZm#5V#NQ+WGZB)n%Vrpe3^!rzCb53(E9)4q16H{Xz zRvu1%Fsm^)pD8PtgO}5c&s5MDY$o^*Rtk1b&c=48;3rl9b2cl0kBJG`*c@zP%nBCZ zF=gf9GUj3x;56lDH8m3u;N#&I;1v|)`UeX&M=QXDjBWn8swY-v04rW@0b_n+Fb}J_ zIhcc$hlh`!)x=ByU}bL3&&|PUE+`28V>M3)DD+%iL6n+{jpH}--*?n)jGfIPj<$eZ zTG^RF+?@XPNYly|tl@0@BsNYy4t`*#9K0NYe4HFSy#FH720Jui{B6aJ{=)xV`s3GBN+G}a0y%-TpX+%f~?#enw(rh+#Euj z0>8il2x`A@`ub9xDQPbX(b4+XRT zn#uozPUH_gmIuZ{96kOqR0Hhr$JHM$&c^Dus3<9ayA>g0(EG$yEWuAY_oO$RT&x@dnw&gBPv0EW zf1Ea@2>X-A{%f})Pd-gWMd+XM5P9->LJCj%so`R8Z({{^{C7G1r8oaCbpIItr;h%A z4gV+EAETup_8x$7TRN+`+5MN({|CZ9I4E10g6*6j|JBm}jYQt3P@C7WrRHMA-k+ zOn;2{M_>hp{&5co*g*Ve|2qNrgXfbS|KI%jQ~UpKPC-feKa>2o`A<=_G+W0Js2eq9i8`dVKnq+4LnA zxPxRbuj>Q?kpT!YSqPM2HckL=6Tw+QMFwFV6%mmIIlf|J90Z~SDM&xpbf4Wzb4$gQ zxe3kqmEI`aAl$)5gsb*E+cOgzmNOgStN07)kzzOUY{x~WXYdjBo1F!T0wWqP)N#4Z zX$e)~;KH8KS8!K0#9GwvUdoM}4eqg(!>&zUuKAi--0l>X9u(ByMxk-Vrh)K6z=$X0d>W!;-W$s# z6r*YOoN#^l>7IB$QSc|Y{cP#G!|cBp)|Go@nwNT>t!W;;qw(kXW}-%Vndl|e^~}3h zitC~B6`l4}&o{ljUdsQyz#(gG4oS9ViA@%*VUfQ1$6(AUP7hVwAqJ*Dc7V5}Ob$hj zi6|e95iGTS=f*|wS)GTKR)*?B8@YU+!OGt&iJF!UyxMJV$rCl!JmLS4>LQs5?BI#X zUG)()A)=ym;F{BlgDVSPHm0P`D`L%)x<58)bgaMjJoCkB4m0}rFgpl4FFe@M*s&|) zPZ8oRk&-iw<;Eeh@?X;+<4EDkY6LHxT1*Eu8Oi@8McdWDw#=%`Ra=Y?^x>9AkJ)~k zf`9LDz#8uB%Cm_(ZA6(ORi$AKn;qOI*#awrkeA{4<~Zln%wHf(AvsAg>N*?H6y^W5 z>?sd9D&kV-S7tJ7Z%PC|*S*?XHKh%HW&1bhKI?0&mu)dGh=B%S@S8O0&GyRuZ!v%E zYOeJ$`{Y>OY)mi5b}f$yi&&psyd|)(|4SAy!2>~ON+MxMfK?)5R@N?Ya=xv`b%>Qo zGW~dN07~&X#mCJ%CD*iJU3?W7Djpt{N0-gDX!&2iesNU5gW4p@-8D4c(qJi1u*_Ul zJyQplL@Y>N=UZWiNn3s`ECeNM>-qZlh|VZimkSr>ztDXVHd=jngJzYPg%^_ej3N|R z;g#(=9p=ZWSOp8vcCC_}>rOe!$}Go{-=pY?I-&o`iDN3;wD~{+bW9j6Z^>KB>3UYX zGK88rjYJ)+E}9rtBC?|4KIa%S>aN-E)<4UQVaUr6=A8F}cBheXq~p(@>Ds=<5AE52 z#`(ZpfX9kFi<-g771UvDSNj0pe0w0QU234fNZN19$AA>tKJPMZD9^N?@x@}05<8L- z&5FR15dLMdD4-**xm5(2oJO>ihbTOhC7S2#vQFG*?SB0INEkMA#+CYpV` zpaVb!n#fVpQntDHElW|D@9YJX1xWJ?3qNQTX&(;@AKKp?_h`I$@thW$3KJ0%5f(AD zLpfa}iPN+jbad$Vm=aARw|eZJDD1`tgMdy;h-!0uLx&mOBmZUmYn6^lOB*OFZ@9aJ)dumM7{&z*CZ@wWjt2=$c&VF8H@K9;MiRR8kMLHbCxIE8kTDz6;ScMifvSr%p z4>g!Bn!;;6HCk#Y+(1<^!%|=BG}?y12|4htcitJa$nY_*WJ?Gi%aL>HA#*!AXgK7u z9HmStDJ%QZ*q9oKA(nW3x}~9o_hzB~J7^o7Y@*ywRw%7|$JwzJ3gM`)UCq8hYTz9$X zrCYVFq3!eSL-Mb;LN32L%Z)p>msgx}LQuw|f*m$=0qZ(%aGG_xY`FV1FP{5l{ zOqYxLj?u~V_5!3Lr-R%E_HD03j4%THCkt90ZgxSMSIp6gA2Tf0A!DCE6N^|{amiQH`GB!(z(U`kK$(kmx|S~DK+EU>>xE8L@X z(Bh&;zh_9~v7&ydn6H|qXW|Sxs9i(v@AvuBZv=R$`j?Wm%U3H=DTs5I= zb?!qly*w?p`#kxbuXva=G}Aiz)|!KSW%-FFC338ms~Fs_S@!5&9nx*;LM%@o3KJtc zv)n{g>Imc|36<{0CaLHQW0tsvZuZ?o794L{LE6Qy+E%;5_iJGM>zuY$9qT}0J^RLs zch?}mOhz2@H-149>B*x~ddR&3vZO-oF6bA0E*GZG6_5Wi81gb};vLOo3CdPLTY5fG zNy*d4o^8(rGMClH07f|LGx!0I`D&UbioX+UQ0`>)_~0n zhv1iM0}?E>yD0gf!TQ_>yaA}%y@~<(FB+DTJ!{95L79cw*eaHkwCJHY86$E&Rpd-` zGd3ZBjwJ#|_kqo@e);ki%5tWH4g`3m3Mm|3m93Ky@+^UjsO^7|lTN^0LKF`jgWUXv03C`Bdk++UZ+xx)0D69Z#^ z5o`FfdXHwzF`Z(Q#kd%Gf%eRL{rU~mZF{>b&`vlsqx9d6CsJk;zb4ZE1?sq?GL%^z&9eSL1o!fU^ zuo&?jA_w1J?SFX+#x>o-q(TqK;tLIKTR*XA_L?^~5?-5+=PJy*0B@u(!P)PBpQh#s zSbANZbV4Vrg7zyTp<^YJ4_kKPjI7=lQ$W#;D360vddv(9NM3?iY{EuajQ9|7N7y-_ zm90v;lEnSQZue^_${J6Q<;Yxc1KzZf_fJkuJ$cY?CSAy4S4UEfcKqjKj7iENKL={^+532I~wnvD#hboc-HqRLGydL$fHs*6Y)K~h2CB$t!@PM6TRewy-;f6 zc-1rlGL^j$Sz`X64?R}9P-($QT74`KV*sCuVLp^B6Gbix*r=;G_eGg$5{EIgVZHN8 zZmep*iVlyVpUQ-5?~pe3y=>O~iEY-dP?&pa-{pMZ^cs`Zw5{!91_uQOnl`&GMbax- zi-Y;Pr^sWG?h!&0B@*N4Cz#|6-@&7hr-3SHf_S;)Ck|=3=Sy-s`@L_C(1O`hk}pA}cwFS+fPp-@SA-WxS} z#`NbN-QJ^;3VaHHK^V6#Gs=BQ)X#j9ftIaPW@HvIXg+Xx?Opt^Y3+O2uoNv%TYGmh zaJ?Lektpay->_dzGHu|6#*pF76(EthJoQ%74{d@2@YcfXb~uuhql&X?$YG_s+x5fq z9;ZLceMQl~n1;^1#<|`%4`P()nnUhwgkyd;1Rr0j>m7)N5$|OS_%>8R4*!}Z-;`KY zp)kN&M@wymgtWX%q!)kUanj^tw+mo0pWc08{vvQVOh^W zn%g2$Yr|o4I3_WMxLH>p2DwNg3<8-vBWb=*gKMhWq6cW+c|zr?vAJYwX~$VFC(VIi z&9$Ls?Z&O@{wYO%#BJoE!^8UwXxqyITs%Cy#C!!Au*{gn=S1DW4)0qk|i*7}bb!lD5E9wAgb#0?=e;9a7RM=ykDvM}MF+wGRBP-+`e5CP z=99mBsOe7`uUa}g^`&+hqnos)&C@IDWa z+r?r*AWi4^Wi1avJY{2)!;7IMDpVZNz6khsauvVgSzI{BvFJtYwy%SvU_ zlu=ir3T&hpdvoI%ME~_j$3IA!Zz6ZBZ(z+~&C#P;y_uFgDq1lw96zC+iTQM6Y8tnH z#B5wT=f$l+#&qc1nw9Il+u6-ief*g0ZXFbh!8RHsfgE5(7<`SHHIwH1z^yXD!ml-E zA!#|M=}R5my6>vLH5+o1GEVzh(KK1sZs~hTunOcFQ>F6Pfonra8oaB?tv(I8nZqj` zW2N^oC76y6TvmFJJK{I^`@)5P){EZUSFbh2$p5Gg?;sg&U%iR{sE)5PV%Q_x9aV*y zq>Zh2WuuYNyaT6@)&DL-*$x>a>#Ajy&`y}v%|p$sh;6;B;r^;JYl5e98BgZ$_N6pQ zi5Z*})WFB^If6^+xG(>ze$7vl|0pVflJ>FSY94yrze*>4Q)ecAT_bbb>}L<2jV={M z;9qsA{u=LRHK{)aKWd!(pO)tMGS|+GMD)PxQZj+wJb#t_kfcYX(__Xzv4V^>B|aq9 z>Q^uM=0h7eJbo~q=KnS85HM@hzh>22;aBAM9I*9!lUB}{V(?HatF7|aeo9UwC3y@2 zy^-sjEw~cAviiI+WdsTSmKJ*1hMYW{lB`v6braq@7wjaIk?J1BzZV2kcJkMHwEjAc z#{M3S_sZ(mw0|;rMiKSrx;EBc{E3x3d>QPa>7$-_K^xL9_f(<-d#W+COXfjgR+I7V zDqtM`@+qpDEs;4oY9$`qYWzL_5Nu}7Wm7M5PHZ>dv9MnAA1ogd`nF_6g!w4~2RozD zDOQfD_|Q`1*Bc=mINyghwZu?9e{YKQ01yBa(ooX zFN&B|;#(O6DM+~CHX#LV2W@A~+*Y>9{N*gei!2u6Yu zQv!Dj=9*|1l8hNX8QZu13m^4?c0-8?Nluco4SMUp7&mff!t+`d6M<`Ov7|Jn^5h3~ND!3apeQasrJXPdF3DKH+I^q44N7EBA23 zT2)mzj;0a1tVpsLiM>;U8QPIJ)%@A`f&gCBZIS*LkRlQ!AMRf zzPUV911gXt8+aP)WqTp}U&BN3uk~MtCh=M-qK5_osYmjU>beJP1zK#T68)A3&F^1t zUd*Xc0~M0U<(?BFmB3A6PC;SuvsxM7+*_SHQh4a#!`F6(`XNT0wXtZ{Vf>as=`AE->hZ9`_ZPiU^T zx3#fqLPQfhM1m*oAb2!lv!>`rFkRg+-;**pZ)xb8G4zR_t>f7Cwo4-fomVe$9zA zxjI^ruXMj$rr3H2?l68?5Vznu<-~*-ELm*SRNr^O`ViJ*5+rHdzA|ba<*}2Oz@Z%I z%yl2`@qpXnbB7L8xaQasD>PiqEAn56lRnar9?*LXZDem)`vq33N|)2f=j3{Gr{&wV zd^-vbxSli!LeHhTS_y~!LMmtftM7-1D|!GPJC=|G_1y~kpnLD?ZUDZPr4(eyN1O3A zvh|{Z(zGtcegCQPPrrczzsH9wZ!y#k#ubeMS{!-Nw)Z)U!@mEs|Wqx`J+&3uS> zs_Zp}1W0`+T&2M49KIY}JGj&rgyeV|n`-T6qvcalj~%<{t;DiuKYbvrDbAM-#R zJRDA2oVg0mV%vL(Rm8-B!;=kBrcX)fu`Qo1`+83|Ug$Pe=yrU{0B$z0cKrE?e#d#X zaLPP=NtsV+YdFoJ&cM|Hfx?@k&kWihk69al*Iu>wiUMc+ElRh>j%;_ji~$$j|y{MT(rrXP>{Qkj3xd&=gC3?D7`jN&$)TkN5F7mvxOgFKv2+My)eo zNZ?o9cT;nZWy=f0kP7vYHx;CNk+qj>#n->1slqiqp6DI1_+-d~w>Fjqo6(Rqo6}9r zEKG^En=KLz8!di^Rsz-;v>9i6-MdPrdHr#{gK-k5!|Ysg1;t`jD+kyb%5M+6;);o< zcs`m@_f4pYt0c7yib19Zv5|vEc|JB>EQa%y=wqRW7GL8qapo!TS-&BKFEER-7Z^Nf zxh3P}odiZ)Du(BL9d1y>o`s7#`jm-3Q!XYK9* z1uQJIR#3a~_>QyPiMELu8Y*{q^w3Lv0;<^Ia-Fg!%w*mVpJYZLLTU7*=o5utX1(uk zWoWU#8Nq%4%fzTtlrWGEPc{ss16U=n(me^Bj;e!_XkNtN4$3UK5%R|&n?v6SDAfd``A=!0*c1G*%L_S)HeoekiIQ||`fJ_-^ zM%TL?s!o?0?u=%^NFrvBd4lNG(v=Mj)A~bCnKyZjPxCr*+gpM*D*E-=srI+OV_zo2 zKtGmmI`f3Og*RdnLmxd}^7?My@|%sb#APTf-`rb{Qk}K|pLo+wagc$!U3f|3mQQ8cAH12kY^Rc_Za*P_l3uz+Bo>NCtnwov0FE*%qr_R{fSa%iNi3_DaEs_ z0B|TED6?$b-hnY;w7k1{0R{fxvi zM$)YjVWC;{sy+c~164j}*D%)PhqJ$xKy5f&Q{A1`!Ox!@pykJcs5GaX~Ovw zHUvn`FZN~xb?|d1m_4K71k4qIcj}UzZC9s)j>ex^y4;?_+CgEQQ zA3}$T2zAd|qCC^-EeD5(k6bPL*X|Lh z?Yi37P4NyA8y{II$>f}_EVaepYY4X9k!0an?t4+84TRd|PW-sI7cL!1kZL3k>L|@L z$8YZ#b9`+c$}oMJkF3QG`RIFipbmEu^o7$jIwm0U>dCRh=UW+gYm_qU(|m2A|!0Zx9lW`$?Y_$oq7N z-&K^~b{4TUoV^*bb#JE91856U@+0reR5E0#zqc-J3YmWGH6)gA5k>xET5hM_LTAx^ z4Gr{glF-6o(uo+){#td(*T>_0QYS2kCPK&o_fjPZx)ms)>W;ffI4j_#LQq!#F9)}L ztvhnsiKF(@)_%$7a;8OG)D)gsrxbR1ElPYfj3FIBA;epE?D^h4c305L-ajB~ml@e+ zSgiL(18S*C%KO3Vpbo*msI>k=%l$rtFr>|6E3M~z`gK&?(cNh!@#Ow-55>s$7eS(z z^RaL!`1YGg7AJ$;BkJ1P-8!#*WrWh&dGg2*Um6+?F_$%V0+oG_hMFi`t8pkKa3d25I?$EaHEFeR!WAi{+ z9vs?@P~RypZkf5rq)akDYsDN?Fyo!lXEzuID=>k$BbAdA3ovC_r1^*$?n9X9Gp1QfbS9knBgHXx&QljbR5F1rOi=r4icz zxcJF`0e~#BT@A?ukJVT<+_ZrYZz!3s0MN2x1YxN8Br4N)l&^GvfL0j1M!xb&l0|x! zTvU3h$7Yhq*{Bpq@;(iTd-4#0I4yWE~< zmJjYH6iBczq;7Y|)tsq(`%J1rJG6@)Tec$PBj$5uo$PcdY(Y`tH@ycDQ2Amf?4XPJ zO6F-pH!>g!G>Gce1CUqAjrfV>TK)ZTRH|ctAAmzY+>ZI}EVYPhd{G5=zQ+;)tOyiA z!XIfyZR`Xzi-4dK^3CR_#-%79<(7)4A#xD0qIn{ zNXthR?~bh&%OHGY-O^TdLNZ2dzQ5iD=-{Yb3E72m2TZfrBY3Ix^3w0~Qnj~8ov4T6 zV%4dgu(4kB!qD&*B_`YRp++VfQhRi~k<_sK9{URt3@dr|JAO|Otw@9l^=U9{X}_xc zP}mOJ7vHE3DnwR0aa;|5T{F*M9h!z^qkhi}rR|Zj7o1`Q(DH2?S1G-rV-in(@pX$Y z(1E}Tldjz)9vHfK>dgUm+kDnk8F1*(`-uuP|JVux(u6O<%wOKliGpw4ag1-Ac`_6M zL)E*D4InEBLH~~0-+`e|W}w9(0erN*dd_YwPD6F&^7d|#_`Z=VMFEGwVcwyK6Y$97 zUVEHI9_Ly>_vXWBX5q6pYMM(9J!zWS+S$88fLj89)(jvhW#mK(eEM z{&{A@LV7C7P&69-yvbzHF_Y01{RjN!fF}H&eMf!xayd72!Lv7?${i+Ty|TXp zCvNkz7V68y*!KK2-;K#6L8?PHk-Lu(0Oo!FK6OBjfKJ@m8HS@I`wYk|X$VpE4yvzD zi9|hlfaC&xIWrLbnbqkVl%gR37gv;xB-Ol|5U5J%J7tMXqG*@kFJ%R@2B3ksl zwPh9&pRVKaemEI(%#r=rPo%#KUdak2Uj@{_3}_Q>*GF0rPd$=|lvlWa_QDxC1-vmQ zD$MJosOHo^eOc4*U(%l3xXjI}-U9g~j`K^=J`-rl< zlkT@>Lh!0f_*diX4fYAKNq#h_!U#R&2r-5i=p?rvbAAO9M0=Kw%SiD}%)QfeaT_H~ z9H%W`*G=SxGM&KYaf72Br=t?7Z^1rZHsa`O6*;9D>}w)oH2TYmswSbJb)MU({+0N$BEp+Qhcn-f&DamA0=qZp}KJ1SERK(9~RnY^57D`a8(G(nzWuP)VDXh@F2C#YwQ zDq8;2kU3CjIjiX@cD)d9ks$J`T7BYK@ezIa^{68x$#D0Z0cOx z-&1UU9|zzet%5qVqgtDx?h{jaPo^#xsF*+@UNl4 zk#%i5iDkDVG{ony)?%%keLfP%JXvF^J@^%N+g$4Y#aV9nN?iI%X<$39u}S|UWl$u& z^E-^Y0L#OrwS5QJbt$Q=FmG%CD;Oub&q#upbe_&yS3+IQEj@I9)=@2w7@Nc)78+8z zo-ey*EC&K9_w=>?Mrb<~@K(b4`FWnJz9k)ApPZe`!F;gI)M{lC3jmDDA#I&ryYC(M zU`ie}Eco^aZl!hro;JK^&G@;b@!~;xkh3vTHv5UETNiF0E=BvVmqx^`oKS z;)~T99o^Wgh-%xp@j4{}uhIf{&fMO8t;wUUST+1rN1+rEw`M5{Zgb^W8=&~Jz0~nN zDBZbbR~nu!(dV}&mjz0H7DFL7Hl`YZ2oI-oqgwkc(ec5AhP*9yBDGmNzJ!4;z*%_# zv&$YXHaQ3s53e+y4g(>c=l-63#-im|KW=1;xnL>tc_0TWOw`=z+||Pa#_8PWD7gtA z%N@ec{MC%SVhMK8Iz(n`Jp37fM*?4yyvV-aMznrAgeym?C|Z=65S1~lPfZ0|ilHr# zNT0%wHa^eo&?W2+3&H8cUO6*m@k#o?Z*knQ!=AIl#xc}RF4c14O^BAai(cBi`PP7q zz_dGc0La00Z?4DT$*f^u;wDZ<#35=|`Y+U}BBz;>Df16u-Xj!!vQBG{14T1s5Hl%;Yho8OiNU|^WL%y|ZYbyZ8 zw*l!G1OcCCY!FR+<-5UAx7C-lkd75fTy&i9uG-T`VUmxj#8dj~5d%Z~c+(99x{2K* zuYJv&d#OTstOie@KtSsQcqhb!ct%#mqztVh1E_{@ukL*d3kwn917Y7iC#{#-sJzY? z?pZsd=2C#}>SlmhQR1gc11HKh>Ryxb=n(Z`*ufCoaoAu_Ivq+lCB#D-HqA_%Yah_0 zrcW9-F(|)~p;>V()E(^bf5ONqz*6(@Ai{w#4q_R&Olnm_TApWUE$2-#i5++1xQ1r* znbmHkd%XhQlt35WlM2-Lq@w-nB2@z{QG*rPW?ZF`LxRlx$`n%VaM=#-d+M>JQXPDf~;`v4QXu(p;ZeY#*sFews#Y46wJX1Kp46j@r|k zd$C*f7rFs+`yM;!uy^zm0WAsjOiY~hf@lm z3k5i}4M1f~=4&04(}X_HR9ZN-!I?hw1NT%L#=PYN<;zyX?(RgrfVXsJY8_}0(Aiux z>K5!&#pKae9NnlR!TyO3| zK!m~<(Ai_|IMbSq(9I4(SwMqR*Lqk}jO24v&u~xXj-7mu(t;h)dxL5uQZOP-^SL+r zOQ``fhmu#Ylb?JJwS$TptGtmk-<@e!ZkL$P$t#z*R{0-mF^!>q^P_#Tz zC@yZ#DH+#FQL}|(=5j`K*r}Gul59S2);!b0?>qBtE!N#K^(Ax)9ZsOk%Uw=1Q9e&r z#B{;Z|J&tgU7)as-D2so|1ZY=_l122woaEZt7zHOF8Q}W9J{ofd$EV_Mlx=wPfq**j& z6i!@*NLDVjzIcH`{MYFl-Es{tETy+|a&kg%dVRHQqXQ;3n{xEWk(4+U5WhECGq4X* z_%+@UTgd*FrunkdvAJL!bYZ@$PKawgM@q8E`Ic9@+uj3?!NQZhcrCAab|h)8WWIgO ze^g?7TwUvn&Ke2NRE9NVlzV`cGb;KL9H`E!4oo+>3(QSTpHl7ueFi2B}I%>8`is5~Dz z;oFzh?S46`i}DuR`}UhpoDOj-S(A6)-dDe`)?a>3D3FSeN#@<@cXySiJ8V~_*m)j# z%d~Km2c2%%Z2#6C%ox@OF2^86OJ<=PcKtJ9ZBZv(IxXEyOfD@)Y<>Io?RJ*$?h6vy z`8Hd~JW82U$~SCZ7KiOGu2rjjO@!&$43q0?!+v>?0g`chf;%h%6}?%h10SiR96Qc) zC%1^g#)VytKvGWF9ll*mhz0w2LCd6=4 zM?002Q&nBhR*yWoM-;vO<>B)26>|qxujaM-E32ps1D>$qk;pU(a31F*E}bXrCuj?8 z_I)#&enYghqu()IyX1o)r)BsqfirxM-pH$*el7Q{WIfC2gZ_<>JzJ}c`I=f=)%7P7 zw!g^Ctejlvu(i2Ey}_GcPgbvu;zSO_ESYwp!z<0nFXuLU8K=GI>`ab{a$TFQ3vL|w zIJqF?;*n7A;!0FrTTV8VfbIA%q|ocb?cb_&!?1+1+d^H_G;N51)J{FyZ- zV}kavc=LjzrAHk`hNAc-%c3qH&QbKfWf}2Dn^AYBy#MHwweW1`rQwdsv4Yd)OQz0^ zybtpq1#oyc1&qd>B2Od~%XK7tw?OQ|Ww5g!ax31x0g^<5-|P6E?lAqQKj&K{)>h`c zbtB)n?cK`!ngu7b&)?)WrX4|ES)7d21MI=mW9G8uH4erE$*q5hr%~lMIODwkF3hF; zl;hp|Fv;UxeBgecuYo}}0UjLfT8e_?kN)yYdyEyy421mMeZBs~&G2JLhm3;%56#rY z&C2nw^Nq{hc#kd~{7Z`L;hW^BNqN{I%%68un#Jb%Ywj1aP`&K6XYg-_^QI&DlcYkvrt*pK|PpZxt_|1W<1 z|L(Qb{`IZ@FTQrtx`fEmY}mT|9)To&#wKSZrey6`>~^H=j?ZE`S~QZd26+EkE=EpOuX;A^^8!Ou^@H~LM(aX6Iex~Rklf+izS^1IJ$ZJbK z{s?mXDl?Cqh2-I5`54?T|HnL`Vq(%9tl!d-(Zx&NX_=?Dr%^yLrBT;Jg6TrY!j{vG z0@1b1nT(EUeV}rI^)lZ5*!g2hJ7XVfGU3@6#dIrtf3!jq`%T=QcudI;eLmv1FF+2I zpwN_yyRt*WeOWIU9Z_mJ0eXEl=DT8Bv)gX``+fepl_QdIlV-%|+~#4~gt-Sy?r;#3 z$ER_=|Mq-a|AN*-l@yqfo`i;4Xz4Opf4rF8Mt*3oG=2&>&~0f%`ZPQ%dHFFA9Elx{ z#^c{h8*?pOV?CC3BwvX0t?XY_4XnMhjp^gllQcG8Ps(ucEUa@a2!&L=u4K|9?L6?~ z4vmM$W@p<_ptIYfsYg$f-x%EXCJV1F58#p9cC{yb<)*k{&(NAkk+idGB8En5!rRy$8 zSQVY5Pid_1Twi7xYk5^&+#Fy~bIOd5u(ZG|Tk5gxR;ylK_O%L|FJHdkt~1zt?z5Zh z4(PC4t`ww?Gv=#0S;?SaVR54ECN;}u{mgJ|2-!M!&0-^JZR={D#mC!3wI62+<~RLn zK$6_F^z4r%6JR^_oOL*tq}J3T?=eW@&4DU~4ONxf;s6bo?z~7rhAOyNaD^6iA;~&N zreqK6{IHG`u@y}w3{IT?D5#;I8GMx&Hod-v^E@Ex9UMM zBNuwB*i%$Bo4wlG_hS6nGdpu&xppzHww5(GE?{^R0-9& z^*f8lKJH6-+%Qka+$bOn-Qerfsm+oG1ivU)vwl8g!B|LCJGR{By0#c$oU;}7)cLGr z!b26ahYhlgb{N!=$>Bw1Ub3x>iH!uM#*brf-#7aF zn8YW!u3JyH+IJ*f%m2O~#-YdU?b~5+;w-zmH?vj2-JKC77i?o;PU1jB-{Y69ZDR(; z+jvge4%z|VB@@&x4Vrzt*ALlS7S9Jn{rW}y2_EN&8slk;7K`~`Ri(+x_)>J#e74#m`dOQ|baS)B}@S}2XXAkI|X ztZ?y>ifX*OSgex4Rv@q2g&unD+C~WNpMp!Hfh&29K9S1@()j?q#H~kvjazr4fM#Gw zY(Ld$Q~gTz@V+nA)kOLN%PvupWh_Ye$M%L10SvufnBktmu=eFQhee*9UVn#`mMuWf z)X$J$mZUdv?B%>K($kGW*BZ8EC(Uyl!X&JdES_3E4u*aaoUd9ct7Tp|iwwolz2;>? zJ?W->AA;efz!HYZ4dz*TdmzZ`hev`LiJ2+QtF6qs|Jp>S2nw+N zITvDWRz^mUe(}6%okZaey8`Xpaa+l?-!dy}{?UdfQ!|67mwOhHZHF?pZ+Lm>)z9)h zJ@EB2GzuIP95)wr==6b+OjTi(nJG9t+`uE&usrCwMTf)F z)=Nu2WaJSdm1362)IKn;@kZlj#w;y~+Uc=JDE*jO#4si)pm>6@@I_LV^X`>~)*M4< z&5)=!mxvK_1fI^m-V8{%7^K8jsB@{+{t7p{9|NB^AWrC|SC{#(zCVO}3mCGaI-G}R zME6?OLF6t>TlK{D-S>8$s?agcX=5``i&P)PaLwwlEH&zJU(R-0RHNozF^>ui9+(h& z+Wb-r20j6Zm|L%8xbiAf>N#TAMDU9fI*8hrE(K+bDF^A(b%$e-DP3RP3#$J>SHWB_ z(5$)fLq}Pu#q^Y90%Xp|pg`hCu2Cm(OHUogHWM0*7b?A0C^ahsJf4FeDHW#RrsX&J z;%-N555;@_YSuDnz?fy-zeB0fxc`$f)U8(Wm0vOtqx`TNOpoXAJFhL$Xy=#)j!J~) z>Z+s!z(%-RxsjIl>eZ@53(=S#ugin3V&vu5%H(xv0zOJ9Fr19m;8f%cy|&O*2$fP@ zc>J~0MNQ3$tjeID^Bt2WP!^7aD2Aw{z=vU9dgUd#;WNXXFoV#qR5C*pS(?p{ePO^!Bo~<%I;tNlDfa#icp= zv&zcH$>yPExDuP`%Rf&%S%W&s=e|UF(AO}}8Um{AkVO9S#4<@e)zEy~``t*vW+-Ms zRaI3{G$vWbFKE2b$^eFq7*S%a$MRf4a`MspvNi!X1*0kkrs2$FZgZXNzT!%hGH*^h z;J!3o34cR1iywJapdHEQ(Q4qyZx**o10TtG_^zFQl__9Po_}%DYC8tbRAumw^);)_ zTKdk6@NcG=R9||UoL_T9p`2H^_x2{8*HXt&!E3vOy6h-DO5>cwYfZxScD{%H`T!dN)lO>!QusaB zHhS+BjsaRDZ@U@Rs_%Nhul#=Nn920dLQD)s376SxRgWuf|AbUH2rm9A^u{8jQF4!J zskKw@VEHCc2B`b#kphKTZFJtaVyB&Gd7s~&fqDhz_=1AuvMY+d8k{D<54nqOF<{R0 zr@iE^7@BzuXZ5cS0r@}tZwM3LsBUM$t~Oq}P8RDneNx}4Pp8vTh$%R@bZzch7?;l1 zQ>|Bm>V}Rm1)ua-*^DTP^rs*RKMhW~g$aq_9?wHG1}j=6>udChPwd88LTqbk%ef23 zzhJ={{BCsN+4*qGD;|p#>6hPbydA_ScGCJs%>z37osG#7U*1_8(ViML#)$ZQKaeL4 zg=QJ?{K&3e`vkV>OS%rf^U74pVrwbW&(d}GI8-uMxLc{)touKy>FCJ8aZv8J&YTi$ zQ`EIaqwjQ#J=TdY$E@@oA(Fv!g+tVC_&q*uEh*=r7|c|BP-tRj!^jhh?b8cRH%vZV zJ2~IIyZ}vZM`B}D=abuJ^h14I3lX4_%eYBn@qGI>y;jsBM3vyLD>^^Kk8^Uqn`_Y}Sv_FMe$Pt|kFW6h%8c`9>d0@m#bN5| zq?1=qd$#9VC}2(AvDu59*+YP=+;0y%-K(KG&o#b zo9$})6De{5*O}aB4LY5NPHf(Irf>#Eg#jO$*rbAjt$7_XJteC!+bc!b2sJl1gX+9~ z{W>_u!g~8Nr5>A5!)||WcyKGDm;-jQUYmTKx7W9LE_WOhys3RbFv{dtuMFhD)w(b_aceCXgcAS((c$tv|Q^zX2*K69wvua4JdYG#8VM}wfs;c1@ zzVXu1W>b7dvwHFHs{Y{hC<;c=hHMjh1`0o7_pDRreCM~8@0VV+Uya;~yc$GclzhLI zkH0__;JGFy%s`R$^2XVu$B4#U9sKGX0C9&D>D%lDn>!+GJ#V{=B9xNbObWUzV?A6% zrO$F6f0RjM59&MZ3l}gEDKkIKt+W=_!xP^&ifFJGuJOC@mZoP zSxVd*J2lVRgUphpAK{EwzFl!H*2g_nO;&M#N+L?dCW}HWy9yErba`D4Vkop69-d)U z3&@~pk;X{ouK4l%viO3q^z=TqKUc3p=4 z|8<`NLsj`6sndc{HG#Kx+EOT2@sh)|q|6s#+?dQfE^0w+)`eYe%S0g*BAmyMW4n_&Pfzcw=$s!HNH26KNfG5djH0B%47CQ4 zLap_c12Sv7k6&sM6b&W_24hv-U67Gu-M>}riuQKHOahcCr(%7i(_U(M>Rda764StQ z^}sfUTURrb6533zN6NGA@1EE@u;ONrslQAz4oRcnxh1Mcsw5yAY^7lMifNx$RUUFK z2{xrhu8NVui*pPUPrtk^d;`Wz_8(EgFGLILG zSxc5b_)0&IKXqbvhg50U(RHCV<0x9+wqAX~(yxrxx=D=$(v)%% z|D?zs^8u;`Vf|G}Nf1!v6qJD8DW^zxDLrl)tCB@J3}k{|yjA;~N9F=c2?t~1YJUAJ z<;d%_*@ci0HJQ<;2Ym=?p19v%XPgZi@K+zd%Nh5u@I$EDpq+K?XsQNZ>#!8)c4X=$7^S&2rGY?gU`2mt!-9;+7! z1i(NUrkfWw6dP3)azRpMsMghHAhgx`+ZjK;8!bxLvN*65vBs#hy=-Y55dav*|5M(V zMG8w-;7Js}m)JGC!;g5`W9&F#R(780uIQgau+#egIy$Z&V@HUrP%f;Lt2$Yjs~p!EY8H>42gJWAIUmL*qjx;mroCs{>E z&c6p4H#%L$h=JYIWcnV9CRi`UV2wJ)DOP)nXWS3{dr7rS~`fk`BK6NT`@aD!OQ=_1S8tHtYUuGmm(Ma;;hR$kxN z=K6&2>cNvgHe*`&EG;dac)g34{BBMyT@8MYm%aJ@b*$7XK|t+;*Or+L!>yBK_`~K2 zZw3nX8?CTv^u1;uLm*6_=0uewb+P4tG0(HxPEwT*vA=g*nG>&OBcP<(yt%b@+Ll1?&XW% zc#W6Y+d1OnIqqdO_y;!^Jfo6(wQHGk1M7~f)QYTCT|?awi>v!=2KMij{jg_jVNQJI zxrptAgsp9zS#1PAyR}yt9rh~(_YXh%Mk_cjy0lRG80w*4cD5Q2yn*|i0ax|4pP!=; z%w&lWz<>Mvk8cIy%{l1n{66%OL*eSf%9gIvQg+NHL%;>z`o$jM4z=xXL?UKt$6{RO zD=i%v-nOnxjeKU!&p$zEPTL*lQ9vGE9eSCGcuV+ucG7L+WNXDTwXXM-8*aOkmYnM( zO5GuT>i4}AZu*VELk$8I`E( z?4;+>M`yk3q}Hk8>Vgerv)aam8Kji*o7eJ;CW|9kFGz|6PW4X?!kcMS9aa-<*KiEe z*S{)+S*2?-tAmjcK&7F1lsaH)wvqqc>b%%fF`+o+sFsj$M^Q8Zg(HdlL*HJNl#qey z(yQ-pzkDh(Lo2yFPI*(1UcxoD?o;3xVCRvQHL~@Up&mj{$&p|Q!9Z*n*CG|M;C;-{ ztN1xoS2!IgL|70p{Fb48?8~^W_xXIoo^^R=k8B^G=G*Ii;z)qL7aOSdZT5Q2K z>#^Fl=Rum9r-<*|>zum;LaPS=uiZo)R(7Lip+b~R7LLyI;oMm3&v)J`S59@P=wI4b zI(Q+%v~W27Jf;S!hu)dR29(&`LUC@{PmX6C{J65nljx<=_=Y*g#a1+Cj_I?N`Q<|o zPi8&Oq|(&v$4328pyth|R*6R2>JxczUhH`diL;4@hc3{j=2YvqL`C(>xnC>#Zhb3q zwv}9+Ek)+-0d7K)N>Sqor~@{*1C>MAlsS$a8-PD838tr?KYudJ9iaWuYEm7x(W~rG zr0Egr0Q^}6Fq*uHiQMR}mmI$^l*YfSM$?IaHXJXuo{WDp+tD;C6kJ)oG-us@0N#?D^bBtaWh^9d&F#oztw7xUuU!cG|Qo7LXTwLEc_xXCP%4ch}7Tu$TT zH-AhC2hfz3_pFzY#nt(xrG39CDEYgW5wy^){Ah3^k}JO?^xdYMJ1rgCEBYq7dQ`7m zd3rrA?YhRL2?Sp?We>ARKi{jHN4=6rQJu||Yt{1w@B2O9cAIXlTMaCI5&UL?STm2k zI`X#d=6I*hSHwTPyCy*O&djyaJFP96!A@$CYI{jYFVCdf6h6VU7%7LFM2YkIQgdd?w2oJN^xt#_!Q;>Us1`a6-uo{w~BWXsyaKb zVBo5MsXjjzv)rEA!uMn9APQdZ^5;!Anwm6n?8m~2@90V0#@)DzlB_a4Q{(a*^R{Qp z_r?lT1n4Rz7gAz|+chN%aU=mJ@`Nb8Y+%ew`~oI$8m5I?Uyh|TBrDU4Gx6M)C5DOU zXD;0Cxa?it*OV)YWrpUhNP@6r#kH)a+47P`IeT?0`_WvhRQhAA`(3U(4lyU6Be&D5 z%ua8b94;}KZTC}uwQ1tie0kPe-9cf7piPz$31cqTL%T{k`o?wH9(_|}^Zd@2Vrd-K zP2GPxfbDUW@%4l{cd_+yiSUty>?ax*8PX{wn?zoA(Te+a>94!3e9w9-CR{njs8u)+ z7*yV;RGiX2Ls!X5uAzy6nOvLD7$Nys_;Kq>s(R@1`UJ6Ou)xB3RKNeUMfaw25 zB|0~^fm_0(F^QOp7=~Yw7awkZNwY`t_qT2q^Cd-;k50wikk(3Mg3^uWBF*om=5A6} zX1IB7(QiGY=cIY$d_wh=JuMLowORH(cVsLK)jJ3xi;u$FJHj?ON-z8Us*?!!i+(I3 zTR4{d(PK30ZKM9gCZ+_!#HMJi)(u|@g1_8Yqw-sF+cUeiXLj9VV#ua*TV0u&2oFy% zn{uShGSSFsX(WXJX}b7Zgw(o8c1}*PIlTjm_uk5st#Q}Ip578x;<{95^0Cb8=>GfT ztIPZMi%V~3DLdl5SDImirpleY(%W}1;m`m4*n4yEU*Ai6DQsu?&%gikuYZL1y_i%f zUhg?ggV&?uaw0E(rjv6;N&N%<-N%#LnNT^NSiMx6wpaR|5v90&-=BAUz{QO>_}kn6 zd4q?&`~Ld=>@U3GfBrqI6E649@Ben4|MdOtk1ZDu=!PNMz(O5h7|E8F_QRoY%1PX& z#bb0I!o_S`E6tBkHH7B^bWZy?@8s5$B#jVl!Suk`W7$8-Q%JA zAzH-N32CLzH8m2({XTntIH}VxgkP~acHlry*7fEu8bj#F0KO1*m%WifRw}#)jX{*6 z=BF-|x}7lw;wo@_oI$Da1F={pn)@qbOYY%e%<_>(p7&rPR$isZSz$D|K@BinK@*2N zhxZd8G(7QRj`hOMg6&kmBC`5`7C9?*!1P>e)N8JQ^E`~FTQkh+(=_Q-#HW51udBps zzN8cxOP}B}SUb?%teM(-zal=`-C@r}{?G=mvb}P09m6fJ#6ZCwtqxmdKgHKpx+kd8 z9wBc|v)DGDK>F6cTfzs$oep|<-Uj#tnw|@3ckB#yLgyPwc9ldzBO5uLz*El^BNo)r z<^mrAg@Sq)hlWVo(68V9!Tk%%SzH0;0{$6eWT--;Rm?b_C^fP&Q1nkZp{uxVueit|6Y}obAsN55M=L9fKL_4c^6n?7UtZ`Ex(~J$ zUiBkR#gfv`50(1`8-IU2rVVBQx{LTir#fp$)tiDNk9f88PI*^z)4$KP*y1GKt!E6-(JvbCvTpPz%dhw!gDJE@Ci8_t8$ z=X-Q^v!*6SX+wh=a*cJnc#23_15(HU5M4XWhY*Q-!sPKg6XY%W0$tH}KNW|p)Pwp2 ztLIidC9(?;8y(T^r44Ka4vqXl|)OFO!%_g1Zu+4 zv|8LCv7zgmb3qimXukb;w99C!fK~VYa^8mI@%=kucJZu8OqQ-wJioZT zw1@OIaqhVffW2+%<-!xWKki9!-`)2j*hxS+;l+!4OcJ%vZ?xu+d?&QDwD_ozf)-z1 z<#qelm?FuV*YSwrrZTlVl=``ACT_--tta06*1Av{w1t52x+mhiC?C$RnX&bjQ^ zdRKg|DdgwiV8e461yb-3+sC`9Pmg9tW?Yd0Mct_Uii}p&Zu_0nY*?3I!F>YH?Z$6~ z3tLj@uSJ?Bz|oC%BgMcKALq~uY!yt}V(t!>>tg3Lm6gkx$Gyb%em=V^24p-mir||) zB{5bd$Ikl5#I)1W2)QrK8ufixd814A*8ZunnNU1~fnqaa+#PlDn;~&26e; zhzzZ&yw0*p3(yUWzVzGhYql|G!_2+0@NfI1893Z1T4N<#4~k5i;#LX7x?HEz&&=#@ z(u9hd_HwH_3RQUh42xBIvbj)4XKAN*ZV1r0 zN(#TvpFfNKSi;tHR#Qu>v2^_a7(NjIgu5D=?!h%-9$MwRbKD%b1hR=B^ zs#3+*bAWza<=faOfLh0uCpHuxMDNPQ);*K1(Iz^=F+m!|>v1prgO?`If%{wWSB=Okw5F!+fSA@GueLnx zB(4-E8B@A4pi(PUN`s~y3ARK0w1PLkcRx>D${D4Rz8A-Nklbc%v6xoUjTLR!_HNk{ z^~=S5?u*>veU|SGsa)sB4M!S|8XFro9Z%rkbe-3@^xwWT|l;VsS)7*%q2BA9Lzz z&(RZ`h;*2%c)(OtRJWQn?*ikdDx8HDs$1`hTk%} zMyROV0=q2nA;1~Mh}tJVyGkh-b%OXdXh5JtHSW4P6%^1jX!!+_Zztq}!{7>kpktC* zYer18{Uyf&2jT~?x;a9u`X<9T{>7^2PGn?c@o~HYsM0-;&8Xh3}swC;Mu1 zMN(gc(3y}u?JBwEw1dKr|9~j)vB&CGeB7+Io3P<-R&GR!ha)uf08kf+nIBDKp`xM5 zF;Y00OlWvsZZ+JQfBe38P>reCNW-3y#v#6F6&j$Q(NWF<2Z<<@OvY7@_q=W!CuGhU zb^I3CoFo?z)>5C&`{-=1L*X&5P6}+!9q2-M#4Ni04hT1qQ=9FC8Je0lr@r`25nNdg z8Rs=u2qd2Pu^n`$u6uV7lNCeQNVpvm;o}REi>&tj=@WO`i(Q2Zn6~w%=hP;@dv_3~ z2twp|oBG_J(Yi@FWpyqy1cdF?PY)`s3nc(2p-G7#Ia$8Yqm?Xi+cHlK3$v}h=jy3( zhi!LG-;UsqGaCGQj8M28dj8UUakOE1hDm+A4`Q8rtG!|+>iP$xtc(V}9Kb>vI??6Y z@S=VPmS08E`UTq=6|%fhoejXVMIk8weJcxq^oXr#?-Ii@o1C zlD=@6JAC;zQS6&WU!8qZ-dC`YfH;_{s+yr-48G+OQ{CX^5nuetwKO{-b7=2-%RKBe za5~?|yEP^%Ql2|^4tX-Ok=9IRa3-mJ1`ZAs0W>^pR6B`6aXMn+Cr+H`i?Yhixmt#f zjs*Ysm2uMIbJag!7g|clXlmjkXK8z%&@D+$Pxp=y3s_jpyBi-*#9nz-hZ=SkIwZ(K z_DDK0hmZLY1T{6=vJwDqKRrGgaHm~a1{UiN0Q}&l4xG@<{fRdMzeVL$cJ+E=U3|P1 z7+sNpfupH@QZzgsG@6=-%Rm&E8jK1+4+xe!r^%EXM~hq57TiYL^Va!(_1k>RnKVaz znBs69Z6Ly{eOkx5tX>t!2{Wh=MU3-08t1J+eO~17ZXJ^t-gx_#@B_nxggpj~HTX=| z)>GfMccn0NH~`ZxO2oVd5d(H%I4*X zmzNe|A1iK>+YnU)Y%1Klnz+jIZo#UDhmC}G?rnPHeDp6|_6P6$=Q!=Zz-|8lvp!~4 zsjhDl@HPCbb3l5#^-V8e;K)Hf(W|`< zw>&eN+r=gxof z-~l;e@S#fyp~-~30dmM_RS&mXk--H5mQqdo-EO~f=WiunvbnI9nfI*O)k+p_J9@MS z%C*`+c^@xCQ{&$E&sQcKOGy&_&9>|aV?O6^Qcv6V+6!tddj=&)Hk(GW0meNE3qu5g zAEW;0SgRGda^0C90k#McRKW8?U!CodRr;~s{K=h7nb(?LsB&q)zU}YdB{lLJYk0zC z+{asGS093@LYs-3SmI9SS)xSu@G!TigqNIPuDX)fv{*M(T|>CaR)HY(5F{iesl8^9j>G_ZB7g7<-u znwiYo^>@2saci-rfS%X^aFdKe1hDNMNGbUAt6(YmylId4X%4D$QIB7yrNyIFsWw*_ z^*QvVCEp4sqPf61Oh$Yja2Nt~5?8ag-7V8#RJgqUe52v`cWWwYWD(zy`coBTF#jsX zvXn9^uHC|v*7>~KsEcPDwVK+%e5t>`d_rm~8r{u#p>ZY}KYY(g@kc=lN64)9k3W26 z#eq!`;){yl_uO~x+I8}Q?C21n^_@+Ak3&Mr-&rTXD8a;UrZRA!ooNVI{8l@Gh|xi? zr}I4{FVDtrDqbF8<^W-U<~7%@MgjF6t->yJ84Mika_kvgTb{hu_o39b!$L?^CqJq_ zp>qGuE%ZgTzSq~SX~hdNW)KLYzD+{1pxQrIRj~-=Z6S3Gof#@sV%>j6Q&Xui@y(kj zAjW4t?Bd~doxkZaKdy+HWHhnxzd~^Y#@88Re_E$8yHhm^oFwnRH_9yT^y^GHs^5lp z)|BnJ5L#S@#Tj!dV^SA;)g>b)nCIpYz)!OKxcYvUP7s@^taP5r(mW9Mi(=#+EW+~AK zOh3x|_feIs-3-DH?o&=0b{7q0wRya=GSs2I?_KLdvldIzFtEnUGl4#p} zFw~=Z8f^P_xXg_zV_8U02=48$a!gWwJ62G;IAm}e^&9S$ipr59eOLm*VLR~wJsvt( zqnoUENKlqE{S*3L@Nfexp)hlq752-}tGk9>6qO<*RP**X$4DqnFlu*RN6kdn0np1z zKm-7Ek3&N%;Gn31XQM7Dd_D=j3y8b&!A#1RE(w!T^g2=ViZNKU~xi?>JPCIqQ!&!<= z>0JQI6jgnFQhcnAJ&r5EtS%Nvh6c#?r19sy0Jf5~!u{mvUBM_CU5nPB4+xP6K0P5d zelz`gkh@^`8k+D1G>$xBQd&9uuh=#3I7q#Jz|0hnx&v}$#QE1Qb31D#@@T4zmkyL7 zkCG4^rl!Bf$rQY;uuFgPhrmCB*9CK;gIJW1)dyas>FMd;lb%w_U1o%PqV#F2l>_%G zhi0r{>Du(#Z84n7pd`Al+zKXVwab_N5h)&Mk`vScU8f#OQn*OsT2 zSLfOgoi8(rQA-yauT&3cNuOtl1D5k!}>=E=*_kkB3;hbpn?sqawD`T3lT-)JfdqeE@qk zU)7f{8=qy{IJSS`{SWY)`zDp3skvk8jbARs9R4ovU2<~hF#>{;+eR5v#zZ3`bW$hn zWt!VA5~aBBf~46OTxs4kym_!L?m{?sOoX7t&WZ{jcvDE%2HPfDJ)gYZbXMQV(2~<4 zMuo<9Nb&+-#LqBYOU1ES%aTRv_lJdq!l93p{QhA}hS)W!gEUm0x#n^*kk4(mf&G~| z>_&ZGbrr^KdjE!S;crE@iu0l)Dc27o1aSHjy%kxn*Dmfv>wY!?%g(2t0;9gY(p`9y z-&%ewFVnpzA(;TH!!@hl^PfN~d04}EM+Z?5n)bO-nk+loR8lC>B6hew4-cQ%A-(-L)n8r!$6iFo<5d&ni{@IQ zF#7iTB{*;_{y_n<+KExNrXQAQ_&01o5A5_c10zfC^HyNjQR4wJ>htLqs#hV7o(o1P@B8eR^oz~%u5 zG#@O&v+_UOV?DZH!o46(+?z#h&Ik&GkF&2Lk13`HXqVDk|jWzMu&y2bvZ5rg8eM zyuXntOOe@G)@`ImZ{Xo9+14gPD7_b%tfrwM3w3b>Ei+*+{u%696t-d08e;C7?#adr zShSOu_Ef^R0aE0LFTF45kO5M7bO$Bdt+7|0gP~|`6T{8|IzS;QEp6v*P?{hG7Myb{ zSlLtdft5Gro1(m{U{V*m6Y=({?rnUYzx9{?;u!qqzM09iw(TWK4VD?{P=j@FTbbe` zv8-rM5tg3L1u-EaBEnnx44Q{lS$Q-bvsdChc&#Ck#L+0}Rr&pmPgt9}s_v4MWP(Pj z)?N0k^{^O{!DM#I#x`n(n0Hj_<=QI9>aBa2iX2(%17S2tmOq9X5#^%~v~T0lrc^4b zrXXz_Tiu6BY|x=$ScP<)vmo>KBGugMFRR+iyLJk0LPe2d9{D(O`BiFaS+-K70O1_^ zTbkx%S@+AsEl~%>E5FyPC(F3X4;B!oWaTJ%F6wg2yqSjcGfu#N_bTF%fDKEDjYNN~ zy2riy)^RzXm^z>#Ro!goPQfJZ-}`qkR>ya%uWwtkr2dQ9h|&EwW@ERS zSr^5YZS8ZtLvPmK#rz*L7d(GwF6=%J6y3QUSIHFh^;cgjzs=9H`kwCln1bo$RDZch zNENQR`$)6k1N)goz!1GLt}bt(b4-=Zy9##O4u0Lx8{@d9jPx=BsaQg@ zZnjmXF2Tu(-sL}7su>@25Yc3uMy=9M`gw8PCe4#*mDVKp{)KA7J=qTcB^hJii4@pw zb~RDtjK%&Tl{GbcQZk(U0|NF4cd>t5uf3;GW}1^@H{v%tVoM9Y63eH({Q7~f{^?b{>)v}XVOPCX7pa?sm>y=DEx2Y$Hk04SBO@gE~;bnoF4>k$} zyTpLB&S@jz5(>YZ?rV3CSgcz!ij!d=VymLOy_>!TYB06F^S}XcBcH+zTDZ5rTU+WQ zNk8;f3^3~(_J5j7*DDM|6|bf?eWD253jlYnsmYk#S)zV@xkN#^@t*t<%>J6$QG3ZSlc^Tnb?H|7wb_)Ye00RZ z5HCVc8}rCdu@a$NSANr>*DVj{aYywlSH6CY;K$AnZaDCyk)_%4JW+goh2cweY5#Qf zGRmZjI#&*@r2y=Y&od`?!BMu0W)OUCISg*JAfkl21R}wT`GNSkhY-ZooHlG94`^+- z!G5~!zV{=C9KA+?D;do5=dpEbbJcd{*EN7(?R4y6g*C^EmOqwM)#sQ>+-V)V@le!W zFGVYJ7p?g3>)a*3AG_RfNF+*)Ce$PpYegj!P=k&Q(+DqPi0y}eG1Als zE64*zF)Ua&;UVDn4{(G>qqR6N3hX%C7yDVDxp=%$R@~RXif!I_MP-WvPtY4T3N#Ar@GJk= zKc%5Sw8@{(P+xz}5@v!vf$D|H?L-IE6=@)Vyro%+^e4|K9PPX1G|AU{x;Tz8aOuX7 zBc<%&M=~WC$7(V5;!N!O?EqOGXHZFi(1rf z%w&?gWC;DC)azK(y^H*nsqy9go zk*4pG#A?@ZEAV=7`2^KC45uGIcC3u|F)1Y`7tk$iewEQugymyqRK^&#UGDs!Y7j)e zzrCR~8hj}-`3x7S+b1_b!3MjD&QRIIiiUlH3=~6W#0;vlfdikrFE^q+7}Jv{Zs%bF z3f<#Zju(CmLSnkGXEhdUeHQFNkE?#3S-)y3(}Y5QU4+gq?F3yQ->qKF2Xv?W(Uk3? zYSuD4qk+1*tw!|@77uqAs%j!n86gZiJ0^4+Hh_m`hY2*5!Qy;@Ypa=rP4MU@Bt@Hx062b9%eCEEhcQWR5kPR60|Zj>b*i3g}5SylU|rl+fCo{G*Xf(xhy z!G*f*=C?nfcJAK)9=#IR>BotW4~@-_dF?nzd-N*{*D|Ov`_)^9yM%{^5&+u6qqw*_ z^pA_#nO*Sh7&uI?T`v5{^1=Eagkuk$K+cm5t@& z6#u`<_RD=GJ|;TQj%f6MyLNl7Gs3opP|w$|T$0N-X(0*yj1S;G(>nJ?l=A*&9DR_S znCJ~n{1-8=uz_3BUT$3w@TZLx^tHA?WeqXo<(EgI<$J9HwY9HZR z0DF>n|4Mh)_RW0X7aV*H4?@Y>i9i8tsTi4L{_(vIuE1Mci0$@p3?(*?+!987I7umD znwKd!rP~}od<;jPac#WhBy0!A+T9isF1Ng!GQU;ll;>h~48$FD z`K&?_P4*7GeKDkQ$`{H=@Ic47xMWqS&|~&aJO??0lga2u1`-Fc;ov_Md8Fp{l=i?N zlK+r&UX`5caQEs>DmfO0AW}eY8fMAa$(}esvxc`fgla`n*kK`<9di`1=!iXslpDmU zpXe=we1$UhRg>^J8C5DMuJ1`bzvx7EummxqT1)O6TTuUp3a?9>oW_ab7dJ|yIjlfC zV_An+`)=!)oNCjimZ+Gnd&ma})Lfbr{+oh7r?p%2&rsOSq}Mvqy~;qAtn9imuS40e z&jIz95!&Hk8->b@aNs5~1Y23)qkRsd4IF_tvLz`ss!S^R?*Gu~Ba=^}5hj_-!bD(= z>4lhHoanF>ZKn_qc)au;>gCR-u;-vDj(^ug;ZMfb1vh_8gQJ$pbV~9kE+D~`C9{E6T#dQsX3&%Fy zgpIq*D;!}*o-h+=C6EYNWPDLD!E*&Ok}U+fdW@T`x?|kl=EDAJuC|OX^0ZSOHiT@F zQ-#l6YD7%m@j>-~XzxajypCc=-=FJ+wZ4S)KH<^oEG($lFN{B5B?Cwp4b2}(Rz+i? z-I|&d&eyI}F8}(HMEACbGpFFA=ip*r88y8O+GgdKWA>)nb|IxavPaj*pp);KV4v>jCQyzrlAQ3UM9HmGou2^A=+G* zCOzuv{s1+|+n5!GI&5eI`W`pLPSjd723?OJDJ!C8mL6-dc*>vRpxG`qxe_%!&4=s< z2M-SpJ_%NzLmMghmMdh!#14Yujuzob4BF!(4QdI%612~UKb8mDQ`e~;ojut22Gt|< z3%ur?_C9la`%{SLgBG}-mNu!bwY8!G#qtEDG{fW(rY+!H8^Ur=K0s zMevnw+~>zfnIY%HYe&K8Av08~r_MNA2H^U?2UBMh%7;>b{wbKsc|U*s8n2s|0SI^Z z^r20fn(FIlIDiABwvcGKXX)urc2G_v;iMyg4%f+IKNB5N$irN~w{8dr>0zi*=vej~ zd+Sblxltg#emi2U{KYOY!6rIj^Gb1)=HzVPdnO5+{Nmor2M9*ClO)rAgATipr+YAwTon8= ziF9aIQS<(e3?^7T!iW;26dIfaTcc`JxTx_;Vx$1VS=I+{qKJ{neKxDF4IqP z=%7|^begG=BXzZgGmcYTV;0FfE(H1$yJyuosEo&2Hlnkdzgl6{AYAX-r5-0B!%=b51HWtR+ac->i=xP}O4(Kg$Yr5H{|+ zwYys+WG}bs!1jx>o0Ap14(igVny}odq32&{ea~=Ei4Na@GoE#SnSe4pe5g~2XHGN< z+?PF^s=P??#zY0sP{I#}0d&q+a2MObB3u6A@4&4qUqpqE@Qee?3POT}p49@^lm86d zY^5HZP0a08`vco@m9=D=bn;20K{WqudKRKcQI063C z@Bee>Kq;HTYA}J`m&HsIVt>{SOfvHpE}F(CzhKF>CilYejOWgmhURd3@BQ(8^98-% zxPragjs)!bAG?A-R~)pnI{P)(d6kb@C-z^!8u|*arrY2nr^_HTdYmb&bvIf z1u55dSaKd6pm_RLjHlMjXeF8-2WYo&xgKSOm-hZMQKiYtv*sn#!3*1nR4ym zRsfl*xz=FTgXxQk0~A{DZX+WM2VE45R1jA7?7#0zJNKP#`e$oX6R*R#@XlQU=8c20 zI0W-UZA>9B@|>C=UEnnxYWVf;2JYXZSu3CncQsTzw0)@TN0u6+p9}_vv#ef*2jN}9 z$i5uex?5+=Hw`x-uOr5x8BEK+Be1D4S|U#U0@6Y^oa*uJRYoi{Fu0iL{OP#M;lHzK za{RydI)iTX)2y}3V{SP_%C7O*4Kr6kzS7rsB|lPsb?8Nzyf`k6q#@-JkCCK6ux{V8 z`cX&|24Jv~fqsiNrlb?(u3+QS4pYr6A*ra8C>6{1tOIeAI+|C%%pBx*`gIl6=fA7l zDqD2)hS4nRR@s(foRGTJc2K-BDO~>?fk3!kBC!AdvpJd^dz}FB4?}c65|E0D0+1OM$ zS4zr<*U8DE7Mm$|`fT^{O66q`zIBk2y}P`~xeo4E&uM`!>wV%#!-3h{cD2HP;A`Zm zfR~v}m=`McKS?~WEAcH_7Cgo&X0{EA?2qEsch*S=rF4HDxi~;-t~1AnM&G7ipO(>E z6`koRaTg)JX~fhUgxw(ig}E3!trjHq0sCuw{52sskri6)VXs~M8Dc_e%Ttl6jo>Yta7Aaf9cQ(s9yj^C6Vs4@{5G}PFOEjy-;n;qN=-xhZC3H$`f zL!X>lQNQSDN)Ws&aLv)4{9y{)wu&Ex89L7M^gFonk{_{mixN!1ou?Pds2oX;iBo~?@|T- zP%eW!p7|l9?$)=2|5E000>e*8%IB1gYGPLfe0+QmBUHpqwUelgmFP*4++5BJ&yXLN z7L6pCj2{Kd-p?>F!Oe;v;vB|Zi|9W&+*K&#P-rw+wPyx!48fFq^m`wM5g(`%K0eLc zRlr>RukzN=f1(RF^a8d!p|&>!N@S)*|DcaAOLJrS(5-<1tVYXeq*p{mVpK>*m9@D{ zAwcFB^mK_maJ=NBY0gQz;kTp)NZXi;!cXY#BnyBtj)Ma_{W2=m-O&w(nk+Q5P_>!) z6DW8!Rn0vt`Q~mq zcvTvUmqo~wqUJYS=0$z@KztJJS&8F%ouFO98;k}*Xw3si(HgS+? zOkPFmlBEG!-|V{jC@Sha2h}xnekYrq=%PpUyY!GG_I5iN?IWqZoNoZ*zI+Ki4sS1v z3RHz%SWN`MdslmbElB#nz4tQ?4&^4b8R6$2&}H|2KeA$YDx!J-XCdzk{6zAVaYZumN5I3+*roMl%n~er_)H0Winp&OsMCt7`2USg?&6qZq zgZ2QHI1m?hqF|s?FJj&x%S-*Z@-cBZ&KNP7FArJnZs6eNPSYApj*>@FD4;P{Nq@yr zk|OU)n(Fc^zL)fU2#>mD=h&*P_rO=7oP?YO)Cbbpg0Lf1F|RwF*tB)!4ubhOv;=l9 zT949T=m`%WJ*wC(L=HbhHR&W!N;ailXf|K}AHv=Pn(P04AJ;BzqexMaJt849GBP4r z*-1wBo}oyJ5JHlbkd=_V$_z6DIs z-@aXNk1L2cY;)Jh_PpmRv>v!4uYE^*1%m%bf`jFMD(Y&yBttACvu2)!{>F;H4nI%N zU&m!FEc{yQ0)S+qJX(srdQd{~Xll1;NSk4N?43(Q*+wGu@qt_ZwIK|bFoc5I>Guv8 zi0JtGnTFH@G9Ym>`s`yq<3GUo%lr2uE0ynQOpc^C?J2Y$7tTq%Pj<$yP#xs8FS8C{-P+Xx7t;mwYAoNFQ+mG1|*zrS827Yb` zx9QKvKhwJ|8p;1n`Q+HU$~!!402b{{9i8ed1Dd39+oB#qU(AQq@#56B{&aDCDr2w6 z#^hh#5(c`3tM9^h-y|C=(cf`g@z~4rPv38RjAfJwqW2}fK7HdD)r}SAhMmOMPreK3 z4T-ernwk!zlVxYxefTMV!9|x{Qh{50hZ<596ciZP*!fCTy$r8+yrcA~} zGk78TUPoK#jGkWTby?X9LPGu~ZRM~x;(_!{EYv`#&n?dnBTn_XUw^#KitlTBS6iZ- zd@Ho4sI1DE`z6zxFL$nn8QAd?OoyuPTs&XT1&+DP;;G}5os|;%w}Z+-W}cm$O@NXN zAixeConB*j+mH75e+j-ION5a2tg@r%hA8u&k=E4K)>c(ioJm)e z)zJ8Lqk??u7E56$9xP-U z5pJYyY|e*s=#CI{)GaL`u!9D@Pe0$Pe9ORp{&Q3neDiqWfx2Ex|f zkvHvXKNgksB)iiL7Z^=Q5i|9Bd9M}}6co>t*FUG6=W-~@{`$*euh;RCt)+%$w)UJ~ zKsyhgYLyE94Kz?H%pm-}doUf2M_}C`X~FuYEX!lt-C?@dKPibpBRv4=C#S>Y?FVj~ zd{)1SaBp8KD!jHgr#*NNC$)^t%+DLaQ~oyViN#*Y_#m8@neLk|f`Z+%OH2J=gXsPF z5jWX6FC;81jOUDzIUhCBmD4r+zsVh>c`$QML1>X|$BrHFT|~d-JHhha$7i2Pin2bO zeGgG@a7zVJlMf2)eDrybde{}$rRQt?1$5Gg)&6O$2lskC8X6LZ>oW?2a|{fA01e)@ znKT)5o80!7ye2Nb8!v{VwBy@I1J%sj+%2QH&xWm2YUBeThX;kGz8e&(ze^1@;R{Gso|X>Y3+g)PDc2 zDp79611;Gw*THz!emv0=ehHPXU1mHGTD2u6b(%S-%Zr5(RJ)m7^LvMUHMwd`8dBMC zxGk&|Ye=bwy@RXI_8BsXFD4BV8N6ibVfBXD*!sA7ibIn4V~adJ?$=s%uZ!6^Sz!4o zT{q#$a$9^s@==j`zUS0suP?ExUk_G0T4-SOvn9?XD~tP(bcn$|M^=nr+wV2SMnm|7?j8M2COMVWk_S_X@kzhG?^k%V^3P}9 zB)Mzz&v*R$qW*P-yZ?Pr|GL8ezNmj+;lD5H-&gp*{A+xa2TK;~L0UWr54OTC$^zDU zLh_TN5oAD_uId*VNktzrCSq_8m#nJ#^F{@b^PrFrFV$39-geLM@bH7}fbgd&zL5yc@F?$=$}Wxvcxsez)nxbQ>J%LR}9I5BVHHv-H1Vqi_y_hA0; zxpU{P2QOq8N6}rl&_6cztkaBL)o$m`ov(0Kc6O?-wljXsB28D7dUQZgNC-ARdkC2k zkYYk3J%mA_x}`;F=prFJ90AvY+pOd1%*^Y_t~_W#-`uKt$J$RWf%Oiyt1Hn=J;%P< zuh)y%25dDSgA&+3G9vll!D%9pMTgP;up4iEgt=ja!)xy$imS%Pe?&AM+*7YM$+??( zZ*HOGS_d%fh zd2{-nI{l?fA@DUoW~g0#jrcoq_C&YrJ$haA-JEn`*bA29cu zo11ZjpqG9=oxemUu*sNCNT}p`;o-fz7!;z#lUm|i#)9acxo=YM`dm{(BOTmoi^K*m z%sV#rEWt1Sxnz93?a6mg?k0V`L?-AcJ;w1-%~}uZy@%la-PPrDRQQzw91<}^j??$; zdxKc~X?uI1^`H(dAK&iC1`U%Hs`_UyUfiU1&!>U?DkEpNHj5w_-r%Ur6A`50D=SXr z<>mYL&oHp2ozFIEybG%a!7V2bJN_u<69{jpvfwqzOn<|L3g>EbON&a=SWD7TxAmn9 z!otxwZ9>s4xa7XE9TXA4us4fUpDW^(;HoyA^jq}82+4AwNOZm1@?{22&L)Z2yZZWL z@Hl{$#}Gpj1fi+MQCRR4vRitWl1GTWkpv@AvyO{$^rR>J_N2DS;K(8r0YvZwq9X7( za&R%K515tTU-c#?pIKb2sHxfaFgEt8m>Bc>Q7kKCZZ6CnGHHD;idM{8x3qLE#L)s^ z06)hfJbv<|l$_il49n9;F^l8r;KRoahPKjWO~wQ8lhH#H`#H@vF;C6sDM9}6b}36@82gPjK4fpYIULeZY@lNxApryA4Z#RNMsdO*e)+x=zi<$?YC&k7b7%JL~FSbj4k#qK^WutcR_Q(Cz` z-DqT4@?I`KYqN(dg7q@uTOgO zBR7an3qN@L^=mZ|Y&ZS!Xai;kYrtLG@9F7zT}DPSz6sFI?OYhB4ea&>v5;WS2H!pf zad9?m0c9h=JWftdR#V;TdyhQuR7w45_2-A^=_3&`q2*S#w);M}xBFmqMEOvUUjwYo z=P*fe_!Rfoli7EWI6>6)$+SJXQMl_x%vQX(B+pKaZFy2zQ{(qR@X>FY$E@{EE-uGu zXnelJCQ16c!d>t(lx*8D#1xBf0@LihN-8_T3w|>&Jgj}!DV-;y8zZg# zdykQkm4CXQ9l`V09I2e0ruh4AO+mEU_Z}Y4gu$j9y=@TZX@5yC`6SvaR}Mrr_{t|4 zf#He)8O~U`it*LggDc_QQaw=RhlV`p1PC4A*YoIaZLD4o7DwYcSu>BC2sE(0*i9xa zR!fuW#yR|_c)pRAL4i0^O+|{X0v#=_SD^4~+1s}%7RN826%;%zBBJ}`kn&D5^#!?*kYU-A7^#yzRR9=D5SFM))6z-E|(MgMCw5RG>oDim^jq0z68C~vc z{Ak&?{7SA`VD9v=aO#a{>H)X&$aE&TAYy$)R(zC85m(Jvvx&hg0}hb2UV5ryA#IupRrc~=aP7yJIQ;dfbJ+;^0^+_+dL7Vde^ox32t*ouJ6ge6_cu=S2R9BMmwWlZQitPvy zXfpycv$N;u>7NV@-Ge4X21N^{i2G@uqcrEBtf=xkx$C3-gzCWHAkGCk9-b#)-jAGo zGheS_?k`CS=|h6Yb`6$0HIkm&tj_f<)D`@#pUF<=SSSi zr+SK>1_n0Lq~#IaOpqbJrKIG$Y4}H8pC?j1|KsNmeRnc%&y`(~8N^UQNky_r2iIrm z{DhMf2j_g3rO%ZID{4n*gq2MKpU^$(oUGOlTm;WMdZ?CR9e&@N6c>N%!Nbql)9czR z?y8!O9D!+qrWiS^d(^hk$x*7XBP35JwS}J9EuhaJPwQ&F$W^2iaGB zi^9=3h+c3fxLQ~q?4x#i$f>V$_R1B?D0!bwv+ACnlG|}Cx7lK2UB@K7PHx2Tmi+KL zcP;vyfIwsjLm)1+%z9-eqq0&QAb5nJGZ!^AH5$x>^mTE(4W9@t4smK*HKD-9!3D1B z_~)KbmUbt&4ggVz*DhM(C6Dn8leE@0;1#}R-RQRI?5ktR74gF)2e0XpS%(!uWN6IR z|0v|o*3XsQtv&zfcbTthYSlfi^sqh)|9&714$IkxY`V}XAC+XmsnVJ0l(Pu?P zQd>^>0#j4ec?oZRxHvnP*$W&ZNXjaoSpt1{ubR$({P^W79$QC|xP=3qC#9eOY2%AA zx6R6o9K?@@h(99%V(X|CHjhdg^ta8DyJpW5ZV>HfLl`uw6ITi6JI;1cNLBhcF`{9tpD z_s|*smqMM%3{#OCr{j_7hJfZmhUn<%EF0cRZO7_3%V9#w5 z{-hSBw0{bG0R}-mJ#ueyLX~b+^MWYz_!~mqK1Ff&`Twl(|6k?w|9TOPWe256?GHAmck4qZD`ycwV71?;}^ggA@|3Q|NEOO4L{R$`^b+9>y>wj zOGrQ#VYf8hSFa#)rvDkk+FT9I=$7HR*4U>MM+Wxwhl2&&nE3fe%^* zx0YU~OIDP7*Tei3Mc95su)4*FT#L;xDeAEs4i2gXRg@GIUt>kDp%Q=XVz%(-q_O}6 zmwG&r0A{fAI9-?I%y?MhrOIN3v)f+RqiSAR9i?gGLm7wm&rw9_N`%$Xp<2?@BJNuI z6`WtZdi5C^UxEObE9(Fb%Kq#|p5Lg_ZETvgXMec6ySKujS=g;GwFVJaMoVk5FFIF> z=C5B;5-K$h;)kpP(z3Gank~vXCYQm;KOF70G)B@=aIaRZySsbJ=@(p}DN0=I@mj)V zAHYF&XrSsK5ujr&@@TL^ni6Ckg|{D&f?CSn-U|24^=XfX6+RxDn&#H2xrMW5daonx zL&&f!>v>jtkB*!BIbt3VJ##QB-hW#XbX%jlWK`;?84dOCVRiOC@+BD3$h0IbH{&%0 zPz&w+4D*To*9nzBjBNpja#B)`QTU^Hq9Q_GItqU#KqyG-oFE<{G!SUq7DP*9xNm7j z1`6{(WYeTxZOp}~n##t+6hz}8__-&^DI%I}ZKB*|;P*T^|V_-r2d! z>*6VYRA<`$EnQua(BihFb-E?A=2pxsAN}0Z<5lfHKb6E7%ji6j&tv@KDUw)nS99PR zaHMdH5YM~jBQGv-na$=yJ~vJX#XJi)Q~=1mcOY0jeyq$GEYHDV`QX6=OOx$#Z4SIQ z<(8(8dVswrmNL{YdCEr>-YRi%de$R>!mZMz0kSw3wm2<8cpd=SgVsY0BL|{4B{i{DBVuEJpP!zQB-`^rr=&bn zUy4w|z!&TrblC7R?(yy55iBN%G%uVVpkBNU%yj?J3?!%Qc<NeFGagtnPqWjFAD} zc+K6Q5O1SI!_KCAqK|9x3!FyaTo&ju`6DjoirpUuyZ{_G{lCA&tSq))+nA{kzI@pC z?M#=Y6d!7O_l;R1oN9?~>j5bpco0#W>&tO%<4^tl>3MncUPj0BqaJ?0T~tt@nD@c7 zfRvnEq9!0}c42|p#*H8s?8rRm?!L8sxW6FN>W8t`ddT{+hbL5l0}~U35#|k%mh#NA zYvXMd>ZK3Z;^OoOQv!zT+uyrY0YtW+5RSJVyq=<(UY(*ck$m$U*~5oK9#0Ot1^}q{ zf{#pduDJl(B*YIhGHCkyFaI#Hhq_9f?JPQJo{^E#Zueo7bKuLDbLi@vl?-?gjS`pW zX7Viq{QCQas7Ap{Z^ql^iA$lu<238o4}#M*NNE(wB4%c+@Uc%~VmM$E4dU=oKet|H zm6T%?6pu49js^wYP&WDwUH{P6CW4v^^Ix(pdg#O1GwdgFZ$jFJ;`IBI!!hw~C;DEv z&3xGhq1Fi?J>R1QVBW&DsD&@_yAhw4cl5GJ>(yXx#P9z8e$fP(P~Ugi>e=g<)*^-F zSu8j7eQhx^StXTcxu^Y&noh)LL`TkuIp(AK)y0*cA1TDOnK+Ln%s!`>)ymv+Q(2kR z#>R%=xP}!}knFKIu}m>oT~ha6v61w|2~|3Iq$xXhT|-2SGpPTmRqUiAWOR{Yb-=Gd zVmFJz(`#3(?!=5o0u53#-*M6W7qE{{BIL}4TQzJ}%y^?`R$kpK}^ z`AC!0djIHX<52B%Q_jRZIrcSijOMO9NnVXfAZ zAj`YhF&KDsC?ULhaBAv1%=A!x9;)LoPCZUR@esiRqdZb(UJhmO&QpcdR^mA-6*-)l zD#^RTQNkUK!h`rz5*-aYyY7h-U&?{eqBSFr@+^~trRZ#^^EYNr&LEjk=3O_FO5|ekax9GD&TbbmWapJ-M4RFAi~9B7Z+Fe`ZASvIe0;u_dBz0WVU> z?)O<|MmtiCXc)1VKu%4GPSwas$uex9-*eN`b7v@6<-aa`Se-w~bo_V@*;TA(Wl$pm z>Q^tD@-WkfNbh(FUcD;zj&dU`9j=4#uu2>Y+YzM*VYl4+901fxP>`h($*eD(Y5Uk7 zqhD0N4d+80Y%<%-#_keV1=KY=#`bd}l&Oqp7s%*A*hTv=LOjTs}bCQiu1z z0$h5>%fDS^wgtIZK^N9;_pf(r_!D$78?UAy^EI&wlapVFqlW z2t?%_(66|sY{+Jk!4WNDw}#8O)}EU?ckK$j5vldJHC~Ei7~FY>E4j||YQ6xMlXID5 zdkbfyx>t@^Zs3W$@0dSK#d8Z5!lZ4y(B$>oxL5fu`o_d~WG*u{=vt2OBI2mN7z~xdqYOc|9*rPmITNpgaj%*F(VR!SEnp^cT2Damav* zyJd_JnHRSa3`s}_2|>QZMMxZjl3o~iW7)mD_%s8MMM3L_G*tm41>VuaJ9~S3R|h#% z4jfFqj=?2kP4T>;%qochtE;L@^lNx}Jv`U}ZYQ}cTDh<2iKwP7Cf;ZLt|QSh#viNo zdeijh^E=bM+sUKy(SncY;(7;1V?2fi15bkg&r3K;H3V2wJ;oMYj+|LrRanpHG&8Jt zV!tr4obLi&E;YK4XC&h@J50yhOg}IE?aMz+CE#G^ZYp-|!Gq`Z1-Rl&+oPG;cK_i5 zj2;Qs-**zw$yOQ(5VPFjl&aUmRR@AwW{8D zZjX|PK5=nzSX#HwZ{XBKFAR-808}!I{Z#V?(!gAYan2E~EOnhhh7teG0iK9MQI3h6 z&U3EcqSg;&8+laD^k1tlIgKv&e&Eee{A&`7&cA&-6hI@AIKqbZ6HI=_+9u9no%_*A zv-db`*VXPx5J)>7*)VSN%`lrh^8TWW5Km-DtDNoN!z_5m-QybZdphwjo=#d~&CAbJ ztUfFIx>_jR{nn9UPgXVAVA=9KS(|x`RPr!vne=2F#g+MjWrt^XGQx zDgfrdY$cB53CRqCbFAzqrP;dFe}1%i|L3GIqV?Q>U&ck-5oJ_5 zew}9Y?Cb$AU*1!hNs@QVyB@I^LlUi&6ws1Ay88rMp|Br}f@prX>-zl^e;c2nn0Z&i zj$i1Ak5Cy;^X}}<%167_0Ti6ZQNA)9?nMMxOphx9;)&||`UwR$9Ni|;*RP+wc<~qx zO`w+Zra3)r&yX5;C|jwn#!?Co~uP+yyjDPF;{@zV)z&H7cQVd$O|y217yS zU8RbBsjLEuWRzZCuHL+P5nyRQeCrXeJQ00aLT0*sF#`oo6gM(-+z7A-bo9)ZC()uZ zZhD(Ao`g|Afp@ny0&kKfJdHxFC_O*2Y`ZeU!M>{sW1b{3+DT8JzLjQ<-7MJ{ZQ0$N z9bVOb`iNA}fs31KLf_%iI@jX*8Xbhx^v9mP#C{jDJ60@4G7?q^FI#)=fw3_KP>VJb zARwg)4^&T=xQbNb@&L`Py$gm1Vld8&ESuphE)_Yz?sZi)0NgX$&;l|v^wNyr2pb#7PL~oN$axMW{rZD@L=OKa;%UICqI$Be*LQAJ-C6^ z&JLC}ebAOdU$*s^w|o*yGaIk#(jnxA)y)ZhGfPW`l}|@0uVk&zuMF3RQwl5@kdO?_ zmpKOm(w5M0-QyLBY;Z6{;Y8-0FAQiO!2Yxm0;Rpctd;4ezIer)1GLVj$)kiV3#4`B zZ(cm_jY0GlQ4tWktqa4isSg`Qi!Mqd{YXjgO&rRv7ch3&A`y%eB5*$-f_?F>c$x-I zv&UJ~*oP~h>0<>wqjB%hlvxgUjo3`JI%N?m7&%%ph>iu9;Wt^d9#fQN7G1pjj*@i@ zpeFuk+{6X=#9CZQzoaTYJ)GZ zfNOl}{{7@b)PjWMisT^%CO~3;icF&aTZ9sd4bm5{_-1p8WSl;I*34tEQFlP}t;A)w z>F+x-**IPQp#pEid3!VBf{w>__45hYO%la`aa1M_b*(0D9+zxG#@ z{m3?=DP0>sNQ8Ahu@NB}s$T508oQX_UV`x|N{MpJ znUvI2RD|nHMkoMrM^y1%nrfu%ldqA#sBYNUkYEphH_nDi@JoF?dd=b1Gk0bODL^b1 zPi=!Iu0A?)(k^YDt+ zDzpoNE}DcU<}=VB?94h97nf6D8pG-AIts{d1W$S3HaFkPx{+Qs?Y)MYZw16Yn4VKQ z()z9xY|+a($)e)Rt)Gk@jiF&NQ<5(OM3#zeBeJ;dI+dINFBQ=a$&IZ`BJoY{Abl#| zo}8Dh3OKc0lYBdq1PQR>df@iTAS-@F_JoN6T^h?WAr!Qy!0Dr{=R!d^lcaHe=NFM6 z97^cjoP*8Lih^+2zhKdB#me0M|AU$I|04lK-%ZvLdV^CuRP(_e-Gy<58Uy zeQG1==l&vefxVjktTn}=?@{U|2*ACfqGA`A7mHUepYk^m;o!(18DzgL{i|p5`*e{K zpU7nZKR9Gwt_w|#2%cXVwbiuoP*zp~e*(L9*IX_MM2G8ICl)ud0anld)SR9f@N2xJ zS00HW$Qv6a_NP$a+C@7Xeq8I<(L2F$Iy8MALDbTei@QS&7l#EdNL{O8{GaCII$>=N1yWu zixygk=hE7Fn%|+kaM|lGUDtq5rgPUZJdl|tse`rOn>ke6&3teA(4Si94FQl{ zo3JFIp$U|vJx-?l=-|okvvn*Ssk6Blx%=V;G5lg)Uy%LzBSUvuV4T5wUg^#qqPRHn zdZEVNbZ7CikCVj3u3bZ??p9RCm|aTI!lnxKgOC1ep%%C{Q`>ysc5g`>q@|4nkLkd_nwOM_D+nih=1!z)eKMxR z8OL(B46fqyzf1>P^}Y6qRDhP~yxfzwBY%7A1a!B)sA#^&h`82lzO!=wRpNRQA&Plf z&^2%5_?I#-n`sj&KC5HsGZBzR82T_@zGMWUYN?wP^vP98G3;zvR}^D}k7nPka#79b z{Y)FUz{0r&)Wv#Zg%fy$xXJh;IrwO2&^dd1zs1#0YyMBXTPKbWdr@%_5fQ_N!cys% zO~!C~qQn$xNZF-BnmD6rN+jB7NqKR^E^f-OU6_Jfm99#-LkJBEi={Wnh zrHX(gQN?ZiyHIHmx*4!XX=TIG-T^inpM~~Y_RgJS`ZZfL2(yt8g3e79wX_ON$o9TW zVdQ21Q()G47v%*SgNJVhMl=}qx>}xq9jV^Wv@2+g+t(kaoMS~nLdacicKkJ_+O~$z;X&L>NyDl3$%&K5ErjY%*MD zKVE$gpLh$UaT21zu%$_ks`FwSuNKb}%@UWA!X0Xho%A3ZVpEA&1xqgX0cOAgBmg#W~SRbqK(&h z69{vEmb%(twIXpW3RG+LtdZ(vwK%a}di_0-x`(L+l_M_pvjIW!@(Lwq`N<4Y)%%@{ z;O^F))HPE>tFbj70VfHqe2L(jaGN@8usYY~+hklgRs@fS_$-&jy&z?~lBcV>$~s_r zw0fP;@{svi)sA*z_pPlR5Qa?np3YFqc*F(FFI*o;eI4>9Jd)X2MSh3Lw?s18hRaMi z5t){@9zA+gmt~OJc6bAn{EvlSG_9;YW*Ilx3|F13VS0F%XLMBzFS&J8r_e5;8JanJ z(vR??Rzw9(b`@^F2`=V7N1{T3!oD1@-xK+jO}kKr0ITc(gnC|^N4sb?s_&JQ%={|+ z`k67$OwldxMx;ZXFZo1OGv9!t5wB+mU9G|3#dOtrWHGC=HO1^%K>tWjo=o~#4L8%j z&1oK^QO~frlRNUu2*|?7e$*9vibhg-7d=W2{bQ=RkQv`L!$h zOJn2FhagAd=l2)rujm2ThF-t$QaQapWS z&ad$C2GTvNtqpbimNcq9U0_73GZo9yvh|wBY{!}_vy{mwOLQ6&Z#W-Rr@wFk zt$EQLi7o&xiE_^H1r2x$U&!g9Jf8fqqIQ#(denDBK#mQopC^MrsgmPiX2uG}EjiI><2EMJO@M5o#5oq) zW>Fvfpx}=EAJjI#zXnwh0Z4fTPAC!sU$@Z@&hPAEaJ6svtmU-N&KFHP3=R)(CFRl| zf65tM#whr~d(@wbX?SQTwr%7}VR$$%jT^VFHc3yv)%#HkZ%_7M)OuEpLOH9O%Pmlq z(k}e%@&O&ON{5tMC;RL8XXKge_c;VVqt(-&m0};gUuOhUK8bT-g@G}^x)`-%$p=$& zyo>(4zJQzYk~i43@_*a(5DG3Gq2iCjT92ieYu;$0>$P}>(B}chGdq@4&-CN6Plc$l zu>`6^m7z`V$B#+K+g`#sf>xT?_wBKhCuOf*J?s0HO#ObBVRniq<%tuLW@!`bk>0%X z%zt}igGUt7`+mkQI?@ciCWH?rCOJ&7Be9Lso`(PV@n`l>y z+XX$Yn`=3Erq|56^A&q;%EmLf(}WSqjJRtxcdN4R6xjGnzP+=n4A908kVC^if`+73 z;-cafmaNpbXD&A`3TAZ3afUWlMc!)_WYyb)Y{srBNf!QO?$?!%ZtF(~Fd)%^1JCgC zJu#x0qa_C<<;jlB^bYg*Yhq%pZeqT!d3b{o4p!V03kL4X9+D4S7yeXXaX}%0UM48l zWuO>Zg0bg2Ii;>O45COVMr)grJL|&fQg;46}Z`~L@O?k!U<(h}F zF(V9pn7GAna{)Vf7(|=l5xy{)O$%OVf%$al-6~%wJaCrPe(@5SZBY=hnj5kv6k+Wj zdg{ZN>f&6Ll3G%G%!t5#V`{Zgg+D4t;g4P1(b*z&0(08hKkCt;ThS`EnOPH^f8Q^i zPWK2gv1Bk^+Rurio4LlbXX!&k)3rjwj4VgydE?Q&dipe9>SeBHSJwboEeuFo3~K_m zo065fHUdv+i-<2QEveQh;`siSZ=LZGNIzgeLX^g!a(CHfZi?qlE;`%4r=ei^jfv(e zMrSDfB`+V=NSFWHrAp=-+u(EB%6d4>=L@@*XYS;Ice8KG7qu z!(K#JU0rQ6P-*QjwGp7Ed!`0>!L7up>K(fXOs#$Kj3i7<(vy8<;k6-ssuf^H!RMi& z*!f^>T^0xy4VXOm&H*#U48ac2e*6Fn1Ul)T8xfC5EK65kYkYQbUC)2_1pWt*~wy+G?o``O%A(rI?fs4FxS#?ryy2Ivf}1f1yt)wR&X5S zqkpd~$O|zXnmwxTXW5`h8jY^W{?r4zJ;S&->_oLAC2gP*pp?_Y4rvN*je42E@ zievio*;$$EY;Hm1d#d8j)*FzLNbm4}d-kMBzVXY6Q5*7olvyEmr#r~^l+g9Zwe{;? zJjOWI^jG$rYV(Ft{B_0Huuiy1;!VL%lC1J9CvEjRLfwNa3QqpG zJahi7#F=su(;%U(-D4t^`ZK)e?^}4B{O6UP%_mJi?emc^7jL}V^^92*sI)S zt;wDSyb%#r`cZEEmAEE~^6Y(eC4=38d+j-LtQ?7`NJ~d%S>~JW8D{4?&kFkQ2lN?e6L%=}rNv})&O z)>Zj>F3|aHj1o^!Y4AHpln;EGE28zQe9u8~>esSDl>qlAj%SLxR{U%sb|L<;J?U1r z=bPF7*-l%JhN|z8W{vH*x69bf|VEJ>x zo<&kltVee0r0h}mC~Z4SK5OJ{=i~1#eB=G}acj+H?LJyh_ud(*k%jw#gX2^=oQRF=g=`$X(Dt^nAJ*=;s&jINb{h zKI{`J0CVs;&+#4ci3*~Pq2=da<2d=Isi_HiH;JIO7*+vf1OuDPMg+ZSZSAVs0R?4c zG6g|SBEPEhG6G+E6nVZ9bDeTxC1V!x^||F(F5J8c-?&A*gC`U$eBv zb1rB*rcS>*8|~@ZX~v`2d|>Ls&wz$!y5Tq9$Wtc2sWbDZ)3@&!8}EE^HEP-XhDYr8 z$Pd(qYcq!jx;V)?RZE2~fG3;WU`TuZyr*J(^dLr$B^otS@7}!|de>EGnP1QyfHrw7 ziKfZK9>oF$F#`1;&+o^?q6xpPtu0ss!0Zpg@1?=83gxEPm*2OD5|fgGqM~H4 zJ`_Q^jN^Q8aL|iR8lG)XK>gDu@m!xs8vZt{MS7^p#v9myoUW8)3KCzykaK{`G&$h-AqJy)}}PCqcUOfqDaV zBs4T_TaY?~dQN)gj8{_9J{=vMaWT(5_d!p^@-Hqf1|yvI>{$%q1HexVs06ShR7+#Q z!jTO!CMKs&`R|2zu`2jkU|^t0lBTmIcH8RmVLB$JXLIjjdxQSN1yH}Cc$U$!U-3uY zA@R(x#+9dU%D6;5FZtwo@%IE7QBbr#OBy_JGd_W4?z{1)#G?EvsDK(UXJ!9Y_&2`? zVJxKfF-XZklXZ1PKxO}$sb7KK+3m6dex4fkgic;@e4J!UtvIvR<|JSqosP&5aC z4ABIl-033%$kiErk*jiqyn6Mt$ASS0Lv@FNzkeIh-339k>Tc~2fd5wwkc~LIrGu&s zM%ZrfHt-JA)gz!I0ITVp!?oHhxx07Iv#6$tg`EMo~ z6B0@^s$NZ+wcme=2LgwPdV)?3nm;j!BY^M#;6{;wpP_hofK-Qpg(X$4QR|dT3ALl6 zV|P!_?99wrMn=LoAh;3{e~uMZAP8((>mjbpgrx0_{JzXg_*R5qJLP&caSA z`dnSn@hd;Ixb2G-Cx->T#CCgwoZcKSbrkgVU5Njx6NNKxKr}-fOoB$N<1Y^c9ar4e z$e=?TfQ9MMqkS4P@RWfMz7(3(*R`}x`@V$~WB<{kMp)|MkbyU7kt zkB1_b$0k>1NeQMS>rT*YyzTLETFE)s(mNN{6@7SluVcIvTG z!PD7?YV#~}3f`EUe(U?7Z;`x#pFVM4W`oc{J>O~vfsbq2J_TU{1Sa3MHeD&XhA2^! ze#FOvw5+1B;o<5?&0wVc+j(Q%HK1@^xH)R7`@jyl{XXUUSqJF)$-eYc+#ED42^;h- zpZcEv^?lLB)bptyKYZB5cl{e*fAz7Ow$@XJ_6~LQ)1Q0v&em>CIJGDxdNj{N*)d3- ze@wo)M|`tbH)EtKRY^fbNI^v;W=%*f%Du38?2}+)JI&Ti@!Hy&-PY`*I@t&}1E+!5h@Sji-a&?FOeAPaS1YDR{F-^m!XGz`bGi_gd^p&CMiLg9obaaymyRWjE@unx?atZDi!YaJPI@Waal}A$(=w;+PIpS<&7; zWD%wey3fSL%+1Z$+A_jS!J*?{Y*kXx(t3OLYjSb1+)oYot$MV#m${cKqkShF9Kg+%SxE-fX zvuWkuhUddOUteFlL4RJxpzD7MCrT4B%l3oSilci=WISwU7nhdC59+QguMKmAkNL6) zr%F*fgPbbCKV58VklyxI;$RLWMr}WTj@!m)zP)U!np#$-8!-4MJElZTP0PA~y=aoe zZIH@?qHW@5Q&Suq{*^k-hrU5_vG z63O0M%}uvySotlaa{LV$Y~1Y@n53JbcTv&SPQT5XI6iLD(*PiBgqD1G>P4?jrxs9o*OJ` zTN(s<$_Z9J9fs%?#WSvxQlH$`9q??fN63}27tgc=zbl&FlEOS!mQ(&ISy{Kx6nS|* z=sj1&^YcMZ&j)S%sh$^(e`T6Oj!7qI)BP&bp zS9MQri%msQkxBo#hK7dS_U3YOL4kBmP7eQ6{-7OnV|5y-zkdDla_X^3NsUZ{gSKYv zy_A`L495Et?HZPuSP_$^W&DyUjfS32@aGZR>&wUa2CTK!%+1qZ11s0-+UU*dOv8Vk zXMaHRMkgI1r`vyZr~dQj)?`l}VV)jwWIV2Dc)j<<4dvDN$S0)~LPA2&&ED(3Y(Me*%0I#$5*Bu%AyLNkSXlhV<`(G(Io*9XxAHJMQDF@1=)wN)~8cq)YRn%@*?D zb-GyoThZvojT?m%9|UrMJL`=)FJx$LIfEb(c}=ppbb12kz@5L3X??AqcT?A%IZtKW*{VL;_-ypUAtyL$Fs@Q*!&pWD@w|nLWrT!3~MSl%NJT@&H zn@=7w4X7fyHWG(j(9qD}-BkU%g67Y~0b_1-!&L7>9PL|mcm28Y979~9Jq)wPF${t- zYt`)2yx^&ll9ILhGA%}Fmp^en!-dhmerfnrx;Gl=J#T`FP{&Dl-J`qTqpznYefq&@ zmqwvo@`wC^?72Sf&$RE~V|^qhW@fF6?YbP&DQRiS z1_lYIYnq0`b>l$hz8NrR+?Im3njl*ii+^d5t&YWee`{k9opqiM52+je&b`{vww9K3JO1>oE%(I*JJZ_W#_Yt3 zAoA#^@iRFV5u95(k*_AkhI7^E?@{YmxJvj+-qW!RpRI8a#xo7NE)Ib22{xzvW}B{? z_pvQZRD-13Al9!N*m@zrS*R zWf}OnFJ;G!!8=HeE26d2C?+2KCg%M%zY6Um1sho=M=1n@S%R)lk<#=n=ioHyv8g}$ z$*P}WajrhY7^40;H(j`2G@&ECILzTeIDkIF_to*{zC)9ZZ>~s`+HPo(h*q$y6O`%vXWva}f%{U|$r-~x&Fb>=pBWQdC z%ekttq_-t8X=?3fUTMPHw|Ar5*Tyg^nsH;@nEd3)2^@t8ctP+Q83v;|C&q42o1u4bR6-W~bYn*B2O|47WU+ zo|e|CqNYulYBDyxy=7?LF|&Sd+r9h%!~K>-|6Ky_;&G<|?(>l~iy<)^`BssKsiNBl zs*I8o6D9xt{hRWhQO(|dQ8g49;ZhUj<{hXNIp%Ynn*P94)WQ1_2Yh>MfMtBV; zb(~7AiZHBHZsKRU5>kB=Q&anIoHgT_HL6esxDw|PhWUPSn(a*a@O|1A7Njj|rE@Bn zI~An?K9@y)e`MicfWQ)E4y?ugpsmr0C%@Pdvn8$|nCbqttPfLp*1kKIrWY2j2_;fG zM=y_p0@((aO@SdtG-lfSw*K-Wi6UmO{Mp)ST>V^~@UdZR>k|FBIOt#EG&`@NsygMk zS~KWX-$q40b3ukar0{Pp%@{_tw%_3Gc^7F>C>?CK)M+#Us|1e8Jj#ZN6M;23Hp3bA zn~U4(c|A+lgy0Pj{0{!lYRi4wvDEG>qCXw@Jj(}D7V`v@=PLqFFS%1UX4+J27;e5N zZ5m%vYkhfNP34_kceIC6qIRl)&d=hvlqMQQN;)=Xd6ci$)|duu#`AJiwY9a8>9k;e zxr!REI_AbkV-Ob(1C_&9+AkcsmXn(+!}S{Cyj%-6kKZ3B=gQq5;!N2i`mwRj63&h` z+G>cuI9p82x)bW^QqILcDJ>Pg%*%Vf`Q7XCfU(|Qot(Tp)A82(8 z!xO=b+*}@YmK#z064S-=0Wh7btE+o58Te;xOi@!a629%j&d~$2EACPUdU|@WM4LHl zPRE1kml~&6L>MbwHE4}5J{)1eJump?$&B`j>@T)j%L!(>O?JudZplk(px$AQ}?H$?WSfTCCkw!wNS zuII?O{lxhAEd_-@&?6Htg;Mv!1S8Us^mG-hP9H)33ZKy==AV>2+oFFdTjEVyR~a~U z3j&^}lnLqfOSIXz9NoGT`(^sKbsE{PoATe8_xl%SmGCohY94*#w4N`tEUQ~6&+%*d z|Eumiqng^XI38pal?NG~cu0@7QM63Pob3P|WmQvrnlQi4(v9ws3a z14xx90a1Yff^>)!=@5h<9i_~5=DoFiI?h@%Yv#k;Pxr%F`~1(|=brn!=k9Y(+Ld<& z)681Qx&hJde&3;na`#BTn(SN0BXrVcLO#P)uLw!8YpW(Id@x@780_sVzy)@B4}KrG zH8Vw7WU;<_dqc6Sh3S+|(>eBBm#()GlHVHY8_vB!ZCa*Y2yR?pO0tV1EqA-LRgHFH zmE=ovhoW8<@Wm|eljONl+gT3zC1?33VaIdp*7@PYd136*cEsD~p549c_uN<5LTlO| zQe!5lfgL#&v;4AIsNeXazKyN;OF{9XZx&3;!8JV5i4OkO9&C(=T z&3+8g_~DCy$m^eP_zCZ?Rh^5qb1~q)RuY3C*3(3FG&ghmb#8N2%hP$WTPj<-3C*oC; zJK-Y4JFOa>S}rqLAha>*ygfQD(CdnzXC2{&V*RwB zCeBw)DM5uYF~=WO6!( z8N3{90IJ_aX+Xm>O0fNV7sa`a%$M0#(y)`QbL}+RfEhXzZ7=OgmR60jw+WGNIYz_a z5eQd~+ZS?1Hxa;=t4zjb&l#CBI8p{pO?)^%^p@7O#lhS)Y{?u3XJlSxS&nSwMLxOg zxD{i&TWJ=4$=@ETc83jgDs*x};8GES5msq+P1Ft_w~{CIX;89D(3OLXd2{Gy@2tbn z*}9r*OB@F{grmzi$dhd59;_j`7;TfLf&8IT`(fvj#l;)O*J=m1J;NIF+fY`vACTc& zhS5Tlv=Co>AlcKDpi!u2b+sX#74Y3XksTfQ>-iK$IMqzpWHGJMyz?F=uHCprX2V4c zvT^H<`PdDM1Il>8ET(?@^j;I!P~)K$>$1ccSgN>DRg2@Id?^Q=)wO!nYhw?IahYm_ zzxLwc(b@x=qE!J3@q5I|FE}!gH&Siu3OQ7})LaT7K?J?0>PB>M$=1tbI5uc7=sm;@ zoqX?Ugwjf@*)XTnwhCNQ*?Qw+oFiV6EL>}aO zYA(B1r-04hO|od0-x5<$Sk+P~??v$ia1ZhM02?BmQ3Q#OuuYb!nxCk9RLHH_8=LL0 z3Ec?|%&V+fsE0d?a)X?-KX&e`k7Zz}vOhQE494JLx6=Z<-SxAVgEcs!Mz+fK9q+ax4WyAz7OOy z-hex0`Wx@H zq}O6{WzQIShPU+x1y&Wl3V>=}>$8pSlVX5JX3D8&Em5+T(eo12oS8b!RE!V0FwAGb z^|;MeWBw3oiuqC4_E1K)y}lx~XpCxyyb%GD>o<#@S)Se}CgSvT_GXY@^amQ0hLeY` zr`42^+N^@NIcxnbYujaw^Z%NfiVAx@ zP?^Eb;uU44IlKqc`PO7Jw^F`KD`)#N+2!RJqO#6Y?Y3!zh4rKORtrCeAp#{|f#JEq ztEkIe9bm9fODQbVN%CLi6kJ=4g^3#I5-ly2y^$%`4V?w;*8}l!n)>pYBG=b~dWoTX z1CjtFz+4ZAbw4okZ0ldJkXltfB$LTIIB%lHpKk!`TOQdr#uDQyP77G;kbz6Btz^ae z^)a&E*{)6$SWyB)iMs|tIg4Hkrk%h^S3q>_luVQ7B@o1Lq}5bSoXT`$l=|CqbB4wV zHKr}mWf|F3LU>9P=FWp2KWMb&q{{k)!3BZCZDd{jZ2Ra$!US*n z3sy2V+V!mu*_+;(*QQ^-+A7(r=HA-=0&1$3)!jcYRr#CwB6?B;ff~U=P^IgHt>%*JxR#m`4cS*@7XNh8}#^(e{Xws`4o(bXz?A zySYx!3G6&Bfb5|H6N(GZ^qsHp&p)3gTWB~}guFy(SxFet5<>cwWU^W=@R~7W9m2??A9BNAgC@!EIjZDjgPiU;39mFXNsE=!$~# zq|2iiKUKJe6#?mG5Hq5}UnryCpPH(uTRGC)&G~>!x}a}`%aeXnB0(M&>K#O)I+#7S z3#y#!T2A9ln5_cV*L0Yab#ooba?9vWcO^we@_vi8jA7zu;V2f-Q(tBn!NYf8nz>d% zhYJ<>J#IMaj*^RdR+kC8^X-9{;6yN@cVMJwz9lt9u5cA>6_V)kShhrOuA8Xux^d;B zEfk-bS6ZgDwKwoq3d!w9cYX!Nv#C>vBj{a=fP(fj28_NuW6Xz{!hOXvUMWm3^H&y? z%z^IGrIy(TY8p~ z3n%8If^OZ_xh`OGgYcFinyH5IZ47j5a~bU>jl5Gm z%Yg#Y>IlvjLWvTui^Xb+MKtnuZ#(8G(9_yI=Iq{8J|-Fjux4c)ZS)AUPD+1XWz5sjBs+V6H-1{a@bWUxJ>R}v(MSu=)RZ!)s8 z4+%jP7xctZM45|k`SYw988Lx2_y!sQl76vGba-Dp)bhFY)9ffDCF}zh9y&IeAvOPg zMLh9L9yOdp^setKkBH+n_xcyY60YP`p)WNI#W z3KfoQKs6K6>Kf`7ul{zyyg_a&Qc$7Llbdk9!mH&#oSHd?xez4Sb4hokqVGOUa!LTh z#q)gktfhsLWt-dUhWIAGzjQ(h5!f?6ZQ{c z`W}dWZ0#E$`l`CG(Cc?%`X0Uhmu&VgrF?<6AE24@kv}2ce`w~1P5$1we+c=ira$xQ zzvKOX0=_?#@?-D+SET%b&i}6+f#vU*|9z)jxy6_Qfml@abuL=|ccS^dhko2Y|I=vR z=B5G1ZMc%BVsjw7K*}U^3(`=EKH2(fJq}jlKn6}`iQgafvI^L*9Z1f **Compliance policies** -> click on **Create Policy**. Select "iOS/iPadOS" as platform and click **Create**. > [!div class="mx-imgBorder"] - > ![Image of Microsoft Endpoint Manager Admin Center](images/ios-jb-policy.png) + > ![Create Policy](images/ios-jb-policy.png) 1. Specify a name of the policy, example "Compliance Policy for Jailbreak". 1. In the compliance settings page, click to expand **Device Health** section and click **Block** for **Jailbroken devices** field. > [!div class="mx-imgBorder"] - > ![Image of Microsoft Endpoint Manager Admin Center](images/ios-jb-settings.png) + > ![Policy Settings](images/ios-jb-settings.png) 1. In the *Action for noncompliance* section, select the actions as per your requirements and click **Next**. > [!div class="mx-imgBorder"] - > ![Image of Microsoft Endpoint Manager Admin Center](images/ios-jb-actions.png) + > ![Policy Actions](images/ios-jb-actions.png) 1. In the *Assignments* section, select the user groups that you want to include for this policy and then click **Next**. 1. In the **Review+Create** section, verify that all the information entered is correct and then select **Create**. @@ -62,9 +62,25 @@ Defender for Endpoint for iOS enables admins to configure custom indicators on i > [!NOTE] > Defender for Endpoint for iOS supports creating custom indicators only for IP addresses and URLs/domains. -## Web Protection +## Web Protection and VPN -By default, Defender for Endpoint for iOS includes and enables the web protection feature. [Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. +By default, Defender for Endpoint for iOS includes and enables the web protection feature. [Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. Defender for Endpoint for iOS uses a local VPN in order to provide this protection. + +While enabled by default, there might be some cases that requires you to disable VPN. For example, you want to run some apps that do not work when a VPN is configured. In such cases, you can choose to disable VPN from the app on the device by following the steps below. + +1. On your iOS device, open the **Settings** app and then click on **VPN**. +1. Click on the "i" button for Microsoft Defender ATP. +1. Toggle-off **Connect On Demand** to disable VPN. + + > [!div class="mx-imgBorder"] + > ![VPN config connect on demand](images/ios-vpn-config.png) + +> [!NOTE] +> Web Protection will not be available when VPN is disabled. To re-enable Web Protection, open Microsoft Defender for Endpoint app on the device and click on **Start VPN**. + +### Co-existence of multiple VPN profiles + +Apple iOS does not support multiple device-wide VPNs to be active simultaneously. While multiple VPN profiles can exist on the device, only one VPN can be active at a time. ## Report unsafe site From 2d26392f0ac86aec91def4ccf5d274972721b5fc Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 14:24:06 -0800 Subject: [PATCH 056/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index f5e542e2f6..ecaa7bcca5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -14,7 +14,7 @@ ms.author: deniseb ms.reviewer: sugamar, jcedola manager: dansimp ms.custom: asr -ms.date: 11/30/2020 +ms.date: 12/08/2020 --- # Reduce attack surfaces with attack surface reduction rules @@ -26,17 +26,17 @@ ms.date: 11/30/2020 * [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) -## Overview +## Why attack surface reduction is important -Your attack surface includes all the places where an attacker could compromise your organization's devices or networks. Reducing your attack surface means protecting your organization's devices and network, which leaves attackers with fewer ways to perform attacks. +Your organization's attack surface includes all the places where an attacker could compromise your organization's devices or networks. Reducing your attack surface means protecting your organization's devices and network, which leaves attackers with fewer ways to perform attacks. Configuring attack surface reduction rules in Microsoft Defender for Endpoint can help! -Attack surface reduction rules target certain software behaviors that are often abused by attackers. Such behaviors include: +Attack surface reduction rules target certain software behaviors, such as: - Launching executable files and scripts that attempt to download or run files; - Running obfuscated or otherwise suspicious scripts; and - Performing behaviors that apps don't usually initiate during normal day-to-day work. -Such software behaviors are sometimes seen in legitimate applications; however, these behaviors are often considered risky because they are commonly abused by malware. Attack surface reduction rules can constrain risky behaviors and help keep your organization safe. +Such software behaviors are sometimes seen in legitimate applications; however, these behaviors are often considered risky because they are commonly abused by attackers through malware. Attack surface reduction rules can constrain risky behaviors and help keep your organization safe. For more information about configuring attack surface reduction rules, see [Enable attack surface reduction rules](enable-attack-surface-reduction.md). From d3ae0137c435263d5e85e9d4a028c7acfd085748 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 14:33:41 -0800 Subject: [PATCH 057/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index ecaa7bcca5..46951dd11c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -109,14 +109,14 @@ The following sections describe each of the 15 attack surface reduction rules. T | Rule name | GUID | File & folder exclusions | Minimum OS supported | |-----|----|---|---| -|[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | `01443614-cd74-433a-b99e-2ecdc07bfc25` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | `D3E037E1-3EB8-44C8-A917-57927947596D` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | `3B576869-A4EC-4529-8536-B80A7769E899` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | `D3E037E1-3EB8-44C8-A917-57927947596D` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | `01443614-cd74-433a-b99e-2ecdc07bfc25` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | `d1e49aac-8f56-4280-b9ba-993a6d77406c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | From bf1dd1f078d9209b452fc11ae5b7f13b851e2d8c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 14:35:43 -0800 Subject: [PATCH 058/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 46951dd11c..e0b1a68177 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -105,11 +105,12 @@ The "engine version" listed for attack surface reduction events in the event log ## Attack surface reduction rules -The following sections describe each of the 15 attack surface reduction rules. This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use Microsoft Endpoint Configuration Manager or Microsoft Intune, you do not need the GUIDs: +The following sections describe each of the 15 attack surface reduction rules (in alphabetical order of rule name). This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use Microsoft Endpoint Configuration Manager or Microsoft Intune, you do not need the GUIDs: | Rule name | GUID | File & folder exclusions | Minimum OS supported | |-----|----|---|---| |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | `01443614-cd74-433a-b99e-2ecdc07bfc25` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | @@ -118,7 +119,6 @@ The following sections describe each of the 15 attack surface reduction rules. T |[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | `d1e49aac-8f56-4280-b9ba-993a6d77406c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | `26190899-1602-49e8-8b27-eb1d0a1ce869` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | From e66d6381b38f28f20b88652ffe5d178230ca6520 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 14:37:02 -0800 Subject: [PATCH 059/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index e0b1a68177..8acd90b68f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -117,13 +117,14 @@ The following sections describe each of the 15 attack surface reduction rules (i |[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | `D3E037E1-3EB8-44C8-A917-57927947596D` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | `3B576869-A4EC-4529-8536-B80A7769E899` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) | `e6db77e5-3df2-4cf1-b95a-636979351e5b` | Not supported | [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) (build 18362) or greater | |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | `d1e49aac-8f56-4280-b9ba-993a6d77406c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | `26190899-1602-49e8-8b27-eb1d0a1ce869` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) | `e6db77e5-3df2-4cf1-b95a-636979351e5b` | Not supported | [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) (build 18362) or greater | + ### Block executable content from email client and webmail From 03600bc363aa8c36917be87c4dd185eb3af0a20f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 14:38:05 -0800 Subject: [PATCH 060/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 8acd90b68f..0a1b17df14 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -117,12 +117,13 @@ The following sections describe each of the 15 attack surface reduction rules (i |[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | `D3E037E1-3EB8-44C8-A917-57927947596D` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | `3B576869-A4EC-4529-8536-B80A7769E899` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | `26190899-1602-49e8-8b27-eb1d0a1ce869` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | + |[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) | `e6db77e5-3df2-4cf1-b95a-636979351e5b` | Not supported | [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) (build 18362) or greater | |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | `d1e49aac-8f56-4280-b9ba-993a6d77406c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | `26190899-1602-49e8-8b27-eb1d0a1ce869` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | From 146f9a79bf75a88dad2af071012c3112c0b7d370 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 14:39:16 -0800 Subject: [PATCH 061/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 0a1b17df14..946f52908f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -108,7 +108,8 @@ The "engine version" listed for attack surface reduction events in the event log The following sections describe each of the 15 attack surface reduction rules (in alphabetical order of rule name). This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use Microsoft Endpoint Configuration Manager or Microsoft Intune, you do not need the GUIDs: | Rule name | GUID | File & folder exclusions | Minimum OS supported | -|-----|----|---|---| +|-----|-----|-----|-----| +|[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | @@ -117,14 +118,12 @@ The following sections describe each of the 15 attack surface reduction rules (i |[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | `D3E037E1-3EB8-44C8-A917-57927947596D` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | `3B576869-A4EC-4529-8536-B80A7769E899` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | `26190899-1602-49e8-8b27-eb1d0a1ce869` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | - |[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) | `e6db77e5-3df2-4cf1-b95a-636979351e5b` | Not supported | [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) (build 18362) or greater | |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | `d1e49aac-8f56-4280-b9ba-993a6d77406c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | + ### Block executable content from email client and webmail From c1cdaa7c498d5384b3ff48e91c77b68467549992 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 14:40:26 -0800 Subject: [PATCH 062/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 946f52908f..eb9e2bead0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -119,9 +119,9 @@ The following sections describe each of the 15 attack surface reduction rules (i |[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | `3B576869-A4EC-4529-8536-B80A7769E899` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) | `e6db77e5-3df2-4cf1-b95a-636979351e5b` | Not supported | [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) (build 18362) or greater | +|[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | `d1e49aac-8f56-4280-b9ba-993a6d77406c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | `d1e49aac-8f56-4280-b9ba-993a6d77406c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | From fa2360cd600701b4866e3f6e7aa39e507118d779 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 14:40:59 -0800 Subject: [PATCH 063/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index eb9e2bead0..a50eca6244 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -120,9 +120,10 @@ The following sections describe each of the 15 attack surface reduction rules (i |[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) | `e6db77e5-3df2-4cf1-b95a-636979351e5b` | Not supported | [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) (build 18362) or greater | |[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | `d1e49aac-8f56-4280-b9ba-993a6d77406c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | + From b7061104398b40c1c4c0601fb67cdf568ea87e0e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 14:48:28 -0800 Subject: [PATCH 064/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index a50eca6244..ae43672ba2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -105,11 +105,12 @@ The "engine version" listed for attack surface reduction events in the event log ## Attack surface reduction rules -The following sections describe each of the 15 attack surface reduction rules (in alphabetical order of rule name). This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use Microsoft Endpoint Configuration Manager or Microsoft Intune, you do not need the GUIDs: +The following sections describe each of the 16 attack surface reduction rules (in alphabetical order of rule name). This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use Microsoft Endpoint Configuration Manager or Microsoft Intune, you do not need the GUIDs: | Rule name | GUID | File & folder exclusions | Minimum OS supported | |-----|-----|-----|-----| |[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|Block abuse of in-the-wild exploited vulnerable signed drivers (NEW!) | | | | |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | @@ -118,6 +119,7 @@ The following sections describe each of the 15 attack surface reduction rules (i |[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | `D3E037E1-3EB8-44C8-A917-57927947596D` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | `3B576869-A4EC-4529-8536-B80A7769E899` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) |`26190899-1602-49e8-8b27-eb1d0a1ce869` |Supported |[Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) | `e6db77e5-3df2-4cf1-b95a-636979351e5b` | Not supported | [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) (build 18362) or greater | |[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | `d1e49aac-8f56-4280-b9ba-993a6d77406c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | @@ -125,8 +127,6 @@ The following sections describe each of the 15 attack surface reduction rules (i |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | - - ### Block executable content from email client and webmail This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers: From d73ceb1d037b841ac58a4c029e427d6ae07c40d9 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 14:59:41 -0800 Subject: [PATCH 065/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index ae43672ba2..79f641e58b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -110,7 +110,7 @@ The following sections describe each of the 16 attack surface reduction rules (i | Rule name | GUID | File & folder exclusions | Minimum OS supported | |-----|-----|-----|-----| |[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|Block abuse of in-the-wild exploited vulnerable signed drivers (NEW!) | | | | +|Block abuse of in-the-wild exploited vulnerable signed drivers (NEW!) |`56a863a9-875e-4185-98a7-b882c64b5ce5` | | | |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | @@ -126,6 +126,10 @@ The following sections describe each of the 16 attack surface reduction rules (i |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +### Block abuse of in-the-wild exploited vulnerable signed drivers + +This rule prevents an application from writing a vulnerable signed driver to disk. Vulnerable signed drivers can be exploited by local applications with sufficient privileges, to gain access to the kernel. It allows attackers to disable or circumvent security solutions, eventually leading to system compromise. + ### Block executable content from email client and webmail From bdd276ef6bf647dd8cc781a979284a29b144734a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 15:29:55 -0800 Subject: [PATCH 066/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 38 ++++++++++--------- 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 79f641e58b..96c3a4434d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -26,7 +26,7 @@ ms.date: 12/08/2020 * [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) -## Why attack surface reduction is important +## Why attack surface reduction rules are important Your organization's attack surface includes all the places where an attacker could compromise your organization's devices or networks. Reducing your attack surface means protecting your organization's devices and network, which leaves attackers with fewer ways to perform attacks. Configuring attack surface reduction rules in Microsoft Defender for Endpoint can help! @@ -126,6 +126,25 @@ The following sections describe each of the 16 attack surface reduction rules (i |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | + +### Block Adobe Reader from creating child processes + +This rule prevents attacks by blocking Adobe Reader from creating additional processes. + +Through social engineering or exploits, malware can download and launch additional payloads and break out of Adobe Reader. By blocking child processes from being generated by Adobe Reader, malware attempting to use it as a vector are prevented from spreading. + +This rule was introduced in: +- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) + +Intune name: Process creation from Adobe Reader (beta) + +Configuration Manager name: Not yet available + +GUID: `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` + + ### Block abuse of in-the-wild exploited vulnerable signed drivers This rule prevents an application from writing a vulnerable signed driver to disk. Vulnerable signed drivers can be exploited by local applications with sufficient privileges, to gain access to the kernel. It allows attackers to disable or circumvent security solutions, eventually leading to system compromise. @@ -381,23 +400,6 @@ Configuration Manager name: Not yet available GUID: `26190899-1602-49e8-8b27-eb1d0a1ce869` -### Block Adobe Reader from creating child processes - -This rule prevents attacks by blocking Adobe Reader from creating additional processes. - -Through social engineering or exploits, malware can download and launch additional payloads and break out of Adobe Reader. By blocking child processes from being generated by Adobe Reader, malware attempting to use it as a vector are prevented from spreading. - -This rule was introduced in: -- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - -Intune name: Process creation from Adobe Reader (beta) - -Configuration Manager name: Not yet available - -GUID: `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` - ### Block persistence through WMI event subscription This rule prevents malware from abusing WMI to attain persistence on a device. From e3a8eb5cc0bfe9e7fd82cc237cb1bb411653bfec Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 15:33:16 -0800 Subject: [PATCH 067/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 74 ++++++++++--------- 1 file changed, 38 insertions(+), 36 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 96c3a4434d..a1f9ff2328 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -144,11 +144,48 @@ Configuration Manager name: Not yet available GUID: `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` - ### Block abuse of in-the-wild exploited vulnerable signed drivers This rule prevents an application from writing a vulnerable signed driver to disk. Vulnerable signed drivers can be exploited by local applications with sufficient privileges, to gain access to the kernel. It allows attackers to disable or circumvent security solutions, eventually leading to system compromise. +### Block all Office applications from creating child processes + +This rule blocks Office apps from creating child processes. This includes Word, Excel, PowerPoint, OneNote, and Access. + +Creating malicious child processes is a common malware strategy. Malware that abuse Office as a vector often run VBA macros and exploit code to download and attempt to run additional payloads. However, some legitimate line-of-business applications might also generate child processes for benign purposes, such as spawning a command prompt or using PowerShell to configure registry settings. + +This rule was introduced in: +- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) + +Intune name: Office apps launching child processes + +Configuration Manager name: Block Office application from creating child processes + +GUID: `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` + +### Block credential stealing from the Windows local security authority subsystem + +This rule helps prevent credential stealing, by locking down Local Security Authority Subsystem Service (LSASS). + +LSASS authenticates users who log in to a Windows computer. Microsoft Defender Credential Guard in Windows 10 normally prevents attempts to extract credentials from LSASS. However, some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use hack tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. + +> [!NOTE] +> In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that simply enumerates LSASS, but has no real impact in functionality, there is NO need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat. + +This rule was introduced in: +- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) + +Intune name: Flag credential stealing from the Windows local security authority subsystem + +Configuration Manager name: Block credential stealing from the Windows local security authority subsystem + +GUID: `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` ### Block executable content from email client and webmail @@ -169,23 +206,8 @@ Microsoft Endpoint Configuration Manager name: Block executable content from ema GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` -### Block all Office applications from creating child processes -This rule blocks Office apps from creating child processes. This includes Word, Excel, PowerPoint, OneNote, and Access. -Creating malicious child processes is a common malware strategy. Malware that abuse Office as a vector often run VBA macros and exploit code to download and attempt to run additional payloads. However, some legitimate line-of-business applications might also generate child processes for benign purposes, such as spawning a command prompt or using PowerShell to configure registry settings. - -This rule was introduced in: -- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) - -Intune name: Office apps launching child processes - -Configuration Manager name: Block Office application from creating child processes - -GUID: `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` ### Block Office applications from creating executable content @@ -325,26 +347,6 @@ Configuration Manager name: Use advanced protection against ransomware GUID: `c1db55ab-c21a-4637-bb3f-a12568109d35` -### Block credential stealing from the Windows local security authority subsystem - -This rule helps prevent credential stealing, by locking down Local Security Authority Subsystem Service (LSASS). - -LSASS authenticates users who log in to a Windows computer. Microsoft Defender Credential Guard in Windows 10 normally prevents attempts to extract credentials from LSASS. However, some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use hack tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. - -> [!NOTE] -> In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that simply enumerates LSASS, but has no real impact in functionality, there is NO need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat. - -This rule was introduced in: -- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) - -Intune name: Flag credential stealing from the Windows local security authority subsystem - -Configuration Manager name: Block credential stealing from the Windows local security authority subsystem - -GUID: `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` ### Block process creations originating from PSExec and WMI commands From bc44d9d509c5a8f2e84552e9573a7ed6d224c5af Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 15:34:16 -0800 Subject: [PATCH 068/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 50 +++++++++---------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index a1f9ff2328..260513eca3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -206,6 +206,31 @@ Microsoft Endpoint Configuration Manager name: Block executable content from ema GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` +### Block executable files from running unless they meet a prevalence, age, or trusted list criterion + +This rule blocks the following file types from launching unless they meet prevalence or age criteria, or they're in a trusted list or an exclusion list: + +- Executable files (such as .exe, .dll, or .scr) + +Launching untrusted or unknown executable files can be risky, as it may not be initially clear if the files are malicious. + +> [!IMPORTANT] +> You must [enable cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) to use this rule.

The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 is owned by Microsoft and is not specified by admins. It uses cloud-delivered protection to update its trusted list regularly. +> +>You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to. + +This rule was introduced in: +- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) + +Intune name: Executables that don't meet a prevalence, age, or trusted list criteria. + +Configuration Manager name: Block executable files from running unless they meet a prevalence, age, or trusted list criteria + +GUID: `01443614-cd74-433a-b99e-2ecdc07bfc25` + @@ -303,31 +328,6 @@ Configuration Manager name: Block Win32 API calls from Office macros GUID: `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` -### Block executable files from running unless they meet a prevalence, age, or trusted list criterion - -This rule blocks the following file types from launching unless they meet prevalence or age criteria, or they're in a trusted list or an exclusion list: - -- Executable files (such as .exe, .dll, or .scr) - -Launching untrusted or unknown executable files can be risky, as it may not be initially clear if the files are malicious. - -> [!IMPORTANT] -> You must [enable cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) to use this rule.

The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 is owned by Microsoft and is not specified by admins. It uses cloud-delivered protection to update its trusted list regularly. -> ->You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to. - -This rule was introduced in: -- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) - -Intune name: Executables that don't meet a prevalence, age, or trusted list criteria. - -Configuration Manager name: Block executable files from running unless they meet a prevalence, age, or trusted list criteria - -GUID: `01443614-cd74-433a-b99e-2ecdc07bfc25` - ### Use advanced protection against ransomware This rule provides an extra layer of protection against ransomware. It scans executable files entering the system to determine whether they're trustworthy. If the files closely resemble ransomware, this rule blocks them from running, unless they're in a trusted list or an exclusion list. From 485dddd1c66c9cd61a59118e75676a7ed86ec05a Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 18:56:42 -0800 Subject: [PATCH 069/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 36 ++++++++++--------- 1 file changed, 19 insertions(+), 17 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 260513eca3..93847cb984 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -231,6 +231,25 @@ Configuration Manager name: Block executable files from running unless they meet GUID: `01443614-cd74-433a-b99e-2ecdc07bfc25` +### Block execution of potentially obfuscated scripts + +This rule detects suspicious properties within an obfuscated script. + +Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. Malware authors also use obfuscation to make malicious code harder to read, which prevents close scrutiny by humans and security software. + +This rule was introduced in: +- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) + +Intune name: Obfuscated js/vbs/ps/macro code + +Configuration Manager name: Block execution of potentially obfuscated scripts. + +GUID: `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` + + @@ -292,23 +311,6 @@ Configuration Manager name: Block JavaScript or VBScript from launching download GUID: `D3E037E1-3EB8-44C8-A917-57927947596D` -### Block execution of potentially obfuscated scripts - -This rule detects suspicious properties within an obfuscated script. - -Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. Malware authors also use obfuscation to make malicious code harder to read, which prevents close scrutiny by humans and security software. - -This rule was introduced in: -- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) - -Intune name: Obfuscated js/vbs/ps/macro code - -Configuration Manager name: Block execution of potentially obfuscated scripts. - -GUID: `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` ### Block Win32 API calls from Office macros From 2b89caa6029ad823779b0565950d37d6bf06f995 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 18:57:37 -0800 Subject: [PATCH 070/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 38 ++++++++++--------- 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 93847cb984..cbe1e8f611 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -249,6 +249,26 @@ Configuration Manager name: Block execution of potentially obfuscated scripts. GUID: `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` +### Block JavaScript or VBScript from launching downloaded executable content + +This rule prevents scripts from launching potentially malicious downloaded content. Malware written in JavaScript or VBScript often acts as a downloader to fetch and launch other malware from the Internet. + +Although not common, line-of-business applications sometimes use scripts to download and launch installers. + +This rule was introduced in: +- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) + +Intune name: js/vbs executing payload downloaded from Internet (no exceptions) + +Configuration Manager name: Block JavaScript or VBScript from launching downloaded executable content + +GUID: `D3E037E1-3EB8-44C8-A917-57927947596D` + + + @@ -293,24 +313,6 @@ Configuration Manager name: Block Office applications from injecting code into o GUID: `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` -### Block JavaScript or VBScript from launching downloaded executable content - -This rule prevents scripts from launching potentially malicious downloaded content. Malware written in JavaScript or VBScript often acts as a downloader to fetch and launch other malware from the Internet. - -Although not common, line-of-business applications sometimes use scripts to download and launch installers. - -This rule was introduced in: -- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) - -Intune name: js/vbs executing payload downloaded from Internet (no exceptions) - -Configuration Manager name: Block JavaScript or VBScript from launching downloaded executable content - -GUID: `D3E037E1-3EB8-44C8-A917-57927947596D` - ### Block Win32 API calls from Office macros From 54caf7a6057c09e89b23686073aea776d1423f4f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 18:58:13 -0800 Subject: [PATCH 071/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index cbe1e8f611..1c6113b283 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -267,12 +267,6 @@ Configuration Manager name: Block JavaScript or VBScript from launching download GUID: `D3E037E1-3EB8-44C8-A917-57927947596D` - - - - - - ### Block Office applications from creating executable content This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk. @@ -314,6 +308,9 @@ Configuration Manager name: Block Office applications from injecting code into o GUID: `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` + + + ### Block Win32 API calls from Office macros This rule prevents VBA macros from calling Win32 APIs. From 7664f71e2fc5125b730cd5469ddc0b7c812b7344 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 18:59:04 -0800 Subject: [PATCH 072/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 40 ++++++++++--------- 1 file changed, 21 insertions(+), 19 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 1c6113b283..7142e05183 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -307,6 +307,27 @@ Configuration Manager name: Block Office applications from injecting code into o GUID: `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` +### Block Office communication application from creating child processes + +This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions. + +This protects against social engineering attacks and prevents exploit code from abusing vulnerabilities in Outlook. It also protects against [Outlook rules and forms exploits](https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/) that attackers can use when a user's credentials are compromised. + +> [!NOTE] +> This rule applies to Outlook and Outlook.com only. + +This rule was introduced in: +- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) + +Intune name: Process creation from Office communication products (beta) + +Configuration Manager name: Not yet available + +GUID: `26190899-1602-49e8-8b27-eb1d0a1ce869` + + @@ -383,25 +404,6 @@ Configuration Manager name: Block untrusted and unsigned processes that run from GUID: `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` -### Block Office communication application from creating child processes - -This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions. - -This protects against social engineering attacks and prevents exploit code from abusing vulnerabilities in Outlook. It also protects against [Outlook rules and forms exploits](https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/) that attackers can use when a user's credentials are compromised. - -> [!NOTE] -> This rule applies to Outlook and Outlook.com only. - -This rule was introduced in: -- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - -Intune name: Process creation from Office communication products (beta) - -Configuration Manager name: Not yet available - -GUID: `26190899-1602-49e8-8b27-eb1d0a1ce869` ### Block persistence through WMI event subscription From 1f2925545a996dee46c4527106688ce68da3f703 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 18:59:48 -0800 Subject: [PATCH 073/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 36 +++++++++---------- 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 7142e05183..0ea54f5923 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -327,6 +327,24 @@ Configuration Manager name: Not yet available GUID: `26190899-1602-49e8-8b27-eb1d0a1ce869` +### Block persistence through WMI event subscription + +This rule prevents malware from abusing WMI to attain persistence on a device. + +> [!IMPORTANT] +> File and folder exclusions don't apply to this attack surface reduction rule. + +Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden. + +This rule was introduced in: +- [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) +- [Windows Server 1903](https://docs.microsoft.com/windows-server/get-started-19/whats-new-in-windows-server-1903-1909) + +Intune name: Not yet available + +Configuration Manager name: Not yet available + +GUID: `e6db77e5-3df2-4cf1-b95a-636979351e5b` @@ -405,24 +423,6 @@ Configuration Manager name: Block untrusted and unsigned processes that run from GUID: `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` -### Block persistence through WMI event subscription - -This rule prevents malware from abusing WMI to attain persistence on a device. - -> [!IMPORTANT] -> File and folder exclusions don't apply to this attack surface reduction rule. - -Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden. - -This rule was introduced in: -- [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) -- [Windows Server 1903](https://docs.microsoft.com/windows-server/get-started-19/whats-new-in-windows-server-1903-1909) - -Intune name: Not yet available - -Configuration Manager name: Not yet available - -GUID: `e6db77e5-3df2-4cf1-b95a-636979351e5b` ## Related topics From d089263968e2480e06633e890c1dd73185924b7d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 19:00:29 -0800 Subject: [PATCH 074/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 34 +++++++++---------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 0ea54f5923..8d6ba4c1f2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -346,6 +346,23 @@ Configuration Manager name: Not yet available GUID: `e6db77e5-3df2-4cf1-b95a-636979351e5b` +### Block process creations originating from PSExec and WMI commands + +This rule blocks processes created through [PsExec](https://docs.microsoft.com/sysinternals/downloads/psexec) and [WMI](https://docs.microsoft.com/windows/win32/wmisdk/about-wmi) from running. Both PsExec and WMI can remotely execute code, so there is a risk of malware abusing this functionality for command and control purposes, or to spread an infection throughout an organization's network. + +> [!WARNING] +> Only use this rule if you're managing your devices with [Intune](https://docs.microsoft.com/intune) or another MDM solution. This rule is incompatible with management through [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr) because this rule blocks WMI commands the Configuration Manager client uses to function correctly. + +This rule was introduced in: +- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) + +Intune name: Process creation from PSExec and WMI commands + +Configuration Manager name: Not applicable + +GUID: `d1e49aac-8f56-4280-b9ba-993a6d77406c` @@ -388,23 +405,6 @@ Configuration Manager name: Use advanced protection against ransomware GUID: `c1db55ab-c21a-4637-bb3f-a12568109d35` -### Block process creations originating from PSExec and WMI commands - -This rule blocks processes created through [PsExec](https://docs.microsoft.com/sysinternals/downloads/psexec) and [WMI](https://docs.microsoft.com/windows/win32/wmisdk/about-wmi) from running. Both PsExec and WMI can remotely execute code, so there is a risk of malware abusing this functionality for command and control purposes, or to spread an infection throughout an organization's network. - -> [!WARNING] -> Only use this rule if you're managing your devices with [Intune](https://docs.microsoft.com/intune) or another MDM solution. This rule is incompatible with management through [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/configmgr) because this rule blocks WMI commands the Configuration Manager client uses to function correctly. - -This rule was introduced in: -- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - -Intune name: Process creation from PSExec and WMI commands - -Configuration Manager name: Not applicable - -GUID: `d1e49aac-8f56-4280-b9ba-993a6d77406c` ### Block untrusted and unsigned processes that run from USB From 100a71a76311e5582389479daf7c1e542a149ac1 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 19:01:10 -0800 Subject: [PATCH 075/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 32 +++++++++---------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 8d6ba4c1f2..7ec2e7d5af 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -364,6 +364,22 @@ Configuration Manager name: Not applicable GUID: `d1e49aac-8f56-4280-b9ba-993a6d77406c` +### Block untrusted and unsigned processes that run from USB + +With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards. Blocked file types include executable files (such as .exe, .dll, or .scr) + +This rule was introduced in: +- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) +- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) + +Intune name: Untrusted and unsigned processes that run from USB + +Configuration Manager name: Block untrusted and unsigned processes that run from USB + +GUID: `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` + @@ -406,22 +422,6 @@ GUID: `c1db55ab-c21a-4637-bb3f-a12568109d35` -### Block untrusted and unsigned processes that run from USB - -With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards. Blocked file types include executable files (such as .exe, .dll, or .scr) - -This rule was introduced in: -- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) - -Intune name: Untrusted and unsigned processes that run from USB - -Configuration Manager name: Block untrusted and unsigned processes that run from USB - -GUID: `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` - ## Related topics From aee396ee5b7dcc4c63afc32bae55e88f3b66f726 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 19:01:53 -0800 Subject: [PATCH 076/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 7ec2e7d5af..022ded468b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -380,9 +380,6 @@ Configuration Manager name: Block untrusted and unsigned processes that run from GUID: `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` - - - ### Block Win32 API calls from Office macros This rule prevents VBA macros from calling Win32 APIs. @@ -420,11 +417,7 @@ Configuration Manager name: Use advanced protection against ransomware GUID: `c1db55ab-c21a-4637-bb3f-a12568109d35` - - - - -## Related topics +## See also - [Attack surface reduction FAQ](attack-surface-reduction-faq.md) From 32870ff648a54e7013e66ebe0c345c619f27fce1 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 19:03:11 -0800 Subject: [PATCH 077/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 022ded468b..a4b6de8412 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -110,7 +110,7 @@ The following sections describe each of the 16 attack surface reduction rules (i | Rule name | GUID | File & folder exclusions | Minimum OS supported | |-----|-----|-----|-----| |[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|Block abuse of in-the-wild exploited vulnerable signed drivers (NEW!) |`56a863a9-875e-4185-98a7-b882c64b5ce5` | | | +|[Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (NEW!) |`56a863a9-875e-4185-98a7-b882c64b5ce5` | | | |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | From b5963c80a5e67dc11f907fbb98b6b92fb515dae7 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 19:05:07 -0800 Subject: [PATCH 078/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index a4b6de8412..c5af8a7084 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -126,7 +126,6 @@ The following sections describe each of the 16 attack surface reduction rules (i |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | - ### Block Adobe Reader from creating child processes This rule prevents attacks by blocking Adobe Reader from creating additional processes. From 808a5d8aa56125f51f92e4caf42c4c96cbf64961 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 19:32:52 -0800 Subject: [PATCH 079/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index c5af8a7084..5c8ba4c01b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -52,6 +52,15 @@ In the recommendation details pane, check the user impact to determine what perc Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would impact your organization if they were enabled. It's best to run all rules in audit mode first so you can understand their impact on your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they may perform tasks in ways that seem similar to malware. By monitoring audit data and [adding exclusions](enable-attack-surface-reduction.md#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without impacting productivity. +## Warn mode for users + +(NEW!) Prior to warn mode capabilities, attack surface reduction rules that are enabled could be set to either audit mode or block mode. With the new warn mode, whenever content is blocked by an attack surface reduction rule, users see a dialog box that indicates the content is blocked. The dialog box also offers the user an option to unblock the content. The user can then retry their action, and the operation completes. WHen a user unblocks content, the content remains unblocked for 24 hours, and then blocking resumes. + +Warn mode helps your organization have attack surface reduction rules in place without preventing users from accessing the content they need to perform their tasks. + +> [!IMPORTANT] +> Warn mode is supported on devices running Windows 10, version 1809 or later and [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) or later. + ## Notifications when a rule is triggered Whenever a rule is triggered, a notification will be displayed on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. The notification also displays within the Microsoft Defender Security Center and the Microsoft 365 security center. @@ -214,7 +223,7 @@ This rule blocks the following file types from launching unless they meet preval Launching untrusted or unknown executable files can be risky, as it may not be initially clear if the files are malicious. > [!IMPORTANT] -> You must [enable cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) to use this rule.

The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 is owned by Microsoft and is not specified by admins. It uses cloud-delivered protection to update its trusted list regularly. +> You must [enable cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) to use this rule.

The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID `01443614-cd74-433a-b99e-2ecdc07bfc25` is owned by Microsoft and is not specified by admins. This rule uses cloud-delivered protection to update its trusted list regularly. > >You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to. From 00a45c74efca525a2ece151d6abc9e10c9abd6a2 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 19:34:09 -0800 Subject: [PATCH 080/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 5c8ba4c01b..21528e4f76 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -59,7 +59,7 @@ Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduc Warn mode helps your organization have attack surface reduction rules in place without preventing users from accessing the content they need to perform their tasks. > [!IMPORTANT] -> Warn mode is supported on devices running Windows 10, version 1809 or later and [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) or later. +> Warn mode is supported on devices running [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) or later and [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) or later. ## Notifications when a rule is triggered From 4b09543e092a79668803673823cc84928df9d32f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 19:37:01 -0800 Subject: [PATCH 081/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 21528e4f76..c626505f1c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -59,7 +59,11 @@ Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduc Warn mode helps your organization have attack surface reduction rules in place without preventing users from accessing the content they need to perform their tasks. > [!IMPORTANT] -> Warn mode is supported on devices running [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) or later and [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) or later. +> Warn mode is supported on devices running the following versions of Windows: +> - [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) or later +> - [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) or later +> +> Attack surface reduction rules that are configured in warn mode will run in block mode on devices that are running older versions of Windows. ## Notifications when a rule is triggered From 91b2f9dcd4daa90b372909a08a6b819c914903a8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 19:37:33 -0800 Subject: [PATCH 082/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index c626505f1c..2864b35d75 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -54,7 +54,7 @@ Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduc ## Warn mode for users -(NEW!) Prior to warn mode capabilities, attack surface reduction rules that are enabled could be set to either audit mode or block mode. With the new warn mode, whenever content is blocked by an attack surface reduction rule, users see a dialog box that indicates the content is blocked. The dialog box also offers the user an option to unblock the content. The user can then retry their action, and the operation completes. WHen a user unblocks content, the content remains unblocked for 24 hours, and then blocking resumes. +(**NEW**!) Prior to warn mode capabilities, attack surface reduction rules that are enabled could be set to either audit mode or block mode. With the new warn mode, whenever content is blocked by an attack surface reduction rule, users see a dialog box that indicates the content is blocked. The dialog box also offers the user an option to unblock the content. The user can then retry their action, and the operation completes. WHen a user unblocks content, the content remains unblocked for 24 hours, and then blocking resumes. Warn mode helps your organization have attack surface reduction rules in place without preventing users from accessing the content they need to perform their tasks. From d5f7ee335630bb348d0c04ba54e08d4a3073b658 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 8 Dec 2020 19:47:49 -0800 Subject: [PATCH 083/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 2864b35d75..1d817cfb03 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -123,7 +123,7 @@ The following sections describe each of the 16 attack surface reduction rules (i | Rule name | GUID | File & folder exclusions | Minimum OS supported | |-----|-----|-----|-----| |[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (NEW!) |`56a863a9-875e-4185-98a7-b882c64b5ce5` | | | +|[Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (NEW!) |`56a863a9-875e-4185-98a7-b882c64b5ce5` | |- Windows 10 Pro, version [1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
- Windows 10 Enterprise, version [1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
- Windows Server, version [1803](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) (Semi-Annual Channel) or later
- Windows Server 2019 | |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | @@ -160,6 +160,24 @@ GUID: `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` This rule prevents an application from writing a vulnerable signed driver to disk. Vulnerable signed drivers can be exploited by local applications with sufficient privileges, to gain access to the kernel. It allows attackers to disable or circumvent security solutions, eventually leading to system compromise. +This rule does not block a driver already existing on the system from being loaded. + +> [!TIP] +> You can submit a driver for analysis at the [Microsoft Security Intelligence site](https://www.microsoft.com/wdsi/driversubmission). + +This rule is supported on all versions of Windows where attack surface reduction rules are currently supported: +- Windows 10 Pro, version 1709 or later +- Windows 10 Enterprise, version 1709 or later +- Windows Server, version 1803 (Semi-Annual Channel) or later +- Windows Server 2019 + +Intune Name: Block abuse of exploited vulnerable signed drivers + +Configuration Manager name: Not Applicable + +Rule guid: `56a863a9-875e-4185-98a7-b882c64b5ce5` + + ### Block all Office applications from creating child processes This rule blocks Office apps from creating child processes. This includes Word, Excel, PowerPoint, OneNote, and Access. From 92779ec0840a7b397e3f1abc7e37964ccaf05f17 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 06:41:34 -0800 Subject: [PATCH 084/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 1d817cfb03..3b653eb7af 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -123,7 +123,7 @@ The following sections describe each of the 16 attack surface reduction rules (i | Rule name | GUID | File & folder exclusions | Minimum OS supported | |-----|-----|-----|-----| |[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -|[Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (NEW!) |`56a863a9-875e-4185-98a7-b882c64b5ce5` | |- Windows 10 Pro, version [1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
- Windows 10 Enterprise, version [1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
- Windows Server, version [1803](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) (Semi-Annual Channel) or later
- Windows Server 2019 | +|[Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (NEW!) |`56a863a9-875e-4185-98a7-b882c64b5ce5` | |[Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | From b6d3059c29c6d2aad1df0a842034642b1c10e6da Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 07:50:07 -0800 Subject: [PATCH 085/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 3b653eb7af..1143c590b6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -17,7 +17,7 @@ ms.custom: asr ms.date: 12/08/2020 --- -# Reduce attack surfaces with attack surface reduction rules +# Protect your devices and network from malware with attack surface reduction rules [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] From 03679ef55061c9adef8c35fd7bfe1515eaaf805e Mon Sep 17 00:00:00 2001 From: jcaparas Date: Wed, 9 Dec 2020 08:24:30 -0800 Subject: [PATCH 086/169] Update windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../microsoft-defender-atp/ios-configure-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md index cbca86da05..bbb45a75c7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md @@ -66,7 +66,7 @@ Defender for Endpoint for iOS enables admins to configure custom indicators on i By default, Defender for Endpoint for iOS includes and enables the web protection feature. [Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. Defender for Endpoint for iOS uses a local VPN in order to provide this protection. -While enabled by default, there might be some cases that requires you to disable VPN. For example, you want to run some apps that do not work when a VPN is configured. In such cases, you can choose to disable VPN from the app on the device by following the steps below. +While enabled by default, there might be some cases that require you to disable VPN. For example, you want to run some apps that do not work when a VPN is configured. In such cases, you can choose to disable VPN from the app on the device by following the steps below: 1. On your iOS device, open the **Settings** app and then click on **VPN**. 1. Click on the "i" button for Microsoft Defender ATP. From a9192908d3390ac7a6e62a8a5ef6a424b846c497 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Wed, 9 Dec 2020 08:24:39 -0800 Subject: [PATCH 087/169] Update windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../microsoft-defender-atp/ios-configure-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md index bbb45a75c7..7200eb8d20 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md @@ -76,7 +76,7 @@ While enabled by default, there might be some cases that require you to disable > ![VPN config connect on demand](images/ios-vpn-config.png) > [!NOTE] -> Web Protection will not be available when VPN is disabled. To re-enable Web Protection, open Microsoft Defender for Endpoint app on the device and click on **Start VPN**. +> Web Protection will not be available when VPN is disabled. To re-enable Web Protection, open the Microsoft Defender for Endpoint app on the device and click or tap **Start VPN**. ### Co-existence of multiple VPN profiles From dc9c61f71ffe4b3a7ab935226a4a20c4c6904b1e Mon Sep 17 00:00:00 2001 From: jcaparas Date: Wed, 9 Dec 2020 08:25:11 -0800 Subject: [PATCH 088/169] Update windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../microsoft-defender-atp/ios-configure-features.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md index 7200eb8d20..a5e183572d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md @@ -68,9 +68,9 @@ By default, Defender for Endpoint for iOS includes and enables the web protectio While enabled by default, there might be some cases that require you to disable VPN. For example, you want to run some apps that do not work when a VPN is configured. In such cases, you can choose to disable VPN from the app on the device by following the steps below: -1. On your iOS device, open the **Settings** app and then click on **VPN**. -1. Click on the "i" button for Microsoft Defender ATP. -1. Toggle-off **Connect On Demand** to disable VPN. +1. On your iOS device, open the **Settings** app and click or tap **VPN**. +1. Click or tap the "i" button for Microsoft Defender ATP. +1. Toggle off **Connect On Demand** to disable VPN. > [!div class="mx-imgBorder"] > ![VPN config connect on demand](images/ios-vpn-config.png) From d71aad7c7d42f1800fac43fe95fcfd290c1d342d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 08:25:13 -0800 Subject: [PATCH 089/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 1143c590b6..45872223b0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -17,7 +17,7 @@ ms.custom: asr ms.date: 12/08/2020 --- -# Protect your devices and network from malware with attack surface reduction rules +# Use attack surface reduction rules to prevent malware infection [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] From 262b0e754031dbf1c98974f59a292dbfbb529354 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 09:26:05 -0800 Subject: [PATCH 090/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 45872223b0..9d66ce2298 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -14,7 +14,7 @@ ms.author: deniseb ms.reviewer: sugamar, jcedola manager: dansimp ms.custom: asr -ms.date: 12/08/2020 +ms.date: 12/09/2020 --- # Use attack surface reduction rules to prevent malware infection From b6eefa3718a41eb4dcebc2289ab70d5bcdd413bb Mon Sep 17 00:00:00 2001 From: "Trond B. Krokli" <38162891+illfated@users.noreply.github.com> Date: Wed, 9 Dec 2020 18:43:49 +0100 Subject: [PATCH 091/169] Update customize-exploit-protection.md - MarkDown table restoration (the table is broken on GitHub due to non-standard table divider indicators) - Whitespace formatting corrections (end-of-line blank space removal, redundant leading whitespace removal) Ref. #8765 (md_cleanup / follow-up) --- .../customize-exploit-protection.md | 168 +++++++++--------- 1 file changed, 84 insertions(+), 84 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md index b75194d814..964158b256 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md +++ b/windows/security/threat-protection/microsoft-defender-atp/customize-exploit-protection.md @@ -10,7 +10,7 @@ ms.localizationpriority: medium audience: ITPro author: levinec ms.author: ellevin -ms.reviewer: +ms.reviewer: manager: dansimp --- @@ -46,44 +46,44 @@ The **Use default** configuration for each of the mitigation settings indicates For the associated PowerShell cmdlets for each mitigation, see the [PowerShell reference table](#cmdlets-table) at the bottom of this article. -Mitigation | Description | Can be applied to | Audit mode available --|-|-|- -Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations. It includes system structure heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] -Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Block remote images | Prevents loading of images from remote devices. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Block untrusted fonts | Prevents loading any GDI-based fonts not installed in the system fonts directory, notably fonts from the web. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Code integrity guard | Restricts loading of images signed by Microsoft, WHQL, or higher. Can optionally allow Microsoft Store signed images. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Disable Win32k system calls | Prevents an app from using the Win32k system call table. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Don't allow child processes | Prevents an app from creating child processes. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] -Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] -Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redirected for sensitive APIs. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] +| Mitigation | Description | Can be applied to | Audit mode available | +| ---------- | ----------- | ----------------- | -------------------- | +| Control flow guard (CFG) | Ensures control flow integrity for indirect calls. Can optionally suppress exports and use strict CFG. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | +| Data Execution Prevention (DEP) | Prevents code from being run from data-only memory pages such as the heap and stacks. Only configurable for 32-bit (x86) apps, permanently enabled for all other architectures. Can optionally enable ATL thunk emulation. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | +| Force randomization for images (Mandatory ASLR) | Forcibly relocates images not compiled with /DYNAMICBASE. Can optionally fail loading images that don't have relocation information. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | +| Randomize memory allocations (Bottom-Up ASLR) | Randomizes locations for virtual memory allocations. It includes system structure heaps, stacks, TEBs, and PEBs. Can optionally use a wider randomization variance for 64-bit processes. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | +| Validate exception chains (SEHOP) | Ensures the integrity of an exception chain during exception dispatch. Only configurable for 32-bit (x86) applications. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | +| Validate heap integrity | Terminates a process when heap corruption is detected. | System and app-level | [!include[Check mark no](../images/svg/check-no.svg)] | +| Arbitrary code guard (ACG) | Prevents the introduction of non-image-backed executable code and prevents code pages from being modified. Can optionally allow thread opt-out and allow remote downgrade (configurable only with PowerShell). | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Block low integrity images | Prevents the loading of images marked with Low Integrity. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Block remote images | Prevents loading of images from remote devices. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] | +| Block untrusted fonts | Prevents loading any GDI-based fonts not installed in the system fonts directory, notably fonts from the web. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Code integrity guard | Restricts loading of images signed by Microsoft, WHQL, or higher. Can optionally allow Microsoft Store signed images. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Disable extension points | Disables various extensibility mechanisms that allow DLL injection into all processes, such as AppInit DLLs, window hooks, and Winsock service providers. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] | +| Disable Win32k system calls | Prevents an app from using the Win32k system call table. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Don't allow child processes | Prevents an app from creating child processes. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Export address filtering (EAF) | Detects dangerous operations being resolved by malicious code. Can optionally validate access by modules commonly used by exploits. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Import address filtering (IAF) | Detects dangerous operations being resolved by malicious code. | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Simulate execution (SimExec) | Ensures that calls to sensitive APIs return to legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Validate API invocation (CallerCheck) | Ensures that sensitive APIs are invoked by legitimate callers. Only configurable for 32-bit (x86) applications. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | +| Validate handle usage | Causes an exception to be raised on any invalid handle references. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] | +| Validate image dependency integrity | Enforces code signing for Windows image dependency loading. | App-level only | [!include[Check mark no](../images/svg/check-no.svg)] | +| Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redirected for sensitive APIs. Not compatible with ACG | App-level only | [!include[Check mark yes](../images/svg/check-yes.svg)] | > [!IMPORTANT] > If you add an app to the **Program settings** section and configure individual mitigation settings there, they will be honored above the configuration for the same mitigations specified in the **System settings** section. The following matrix and examples help to illustrate how defaults work: > > -> Enabled in **Program settings** | Enabled in **System settings** | Behavior -> -|-|- -> [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] | As defined in **Program settings** -> [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **Program settings** -> [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **System settings** -> [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | Default as defined in **Use default** option +> | Enabled in **Program settings** | Enabled in **System settings** | Behavior | +> | ------------------------------- | ------------------------------ | -------- | +> | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark no](../images/svg/check-no.svg)] | As defined in **Program settings** | +> | [!include[Check mark yes](../images/svg/check-yes.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **Program settings** | +> | [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | As defined in **System settings** | +> | [!include[Check mark no](../images/svg/check-no.svg)] | [!include[Check mark yes](../images/svg/check-yes.svg)] | Default as defined in **Use default** option | > > > -> * **Example 1** +> * **Example 1** > > Mikael configures **Data Execution Prevention (DEP)** in the **System settings** section to be **Off by default**. > @@ -116,10 +116,10 @@ Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redir * **Off by default** - The mitigation is *disabled* for apps that don't have this mitigation set in the app-specific **Program settings** section * **Use default** - The mitigation is either enabled or disabled, depending on the default configuration that is set up by Windows 10 installation; the default value (**On** or **Off**) is always specified next to the **Use default** label for each mitigation - >[!NOTE] - >You may see a User Account Control window when changing some settings. Enter administrator credentials to apply the setting. + > [!NOTE] + > You may see a User Account Control window when changing some settings. Enter administrator credentials to apply the setting. - Changing some settings may require a restart. + Changing some settings may require a restart. 4. Repeat this for all the system-level mitigations you want to configure. @@ -127,8 +127,8 @@ Validate stack integrity (StackPivot) | Ensures that the stack hasn't been redir 1. If the app you want to configure is already listed, select it and then select **Edit** 2. If the app isn't listed, at the top of the list select **Add program to customize** and then choose how you want to add the app: - * Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. - * Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. + * Use **Add by program name** to have the mitigation applied to any running process with that name. You must specify a file with an extension. You can enter a full path to limit the mitigation to only the app with that name in that location. + * Use **Choose exact file path** to use a standard Windows Explorer file picker window to find and select the file you want. 6. After selecting the app, you'll see a list of all the mitigations that can be applied. To enable the mitigation, select the check box and then change the slider to **On**. Select any additional options. Choosing **Audit** will apply the mitigation in audit mode only. You will be notified if you need to restart the process or app, or if you need to restart Windows. @@ -140,14 +140,14 @@ Exporting the configuration as an XML file allows you to copy the configuration ## PowerShell reference - You can use the Windows Security app to configure Exploit protection, or you can use PowerShell cmdlets. +You can use the Windows Security app to configure Exploit protection, or you can use PowerShell cmdlets. - The configuration settings that were most recently modified will always be applied - regardless of whether you use PowerShell or Windows Security. This means that if you use the app to configure a mitigation, then use PowerShell to configure the same mitigation, the app will update to show the changes you made with PowerShell. If you were to then use the app to change the mitigation again, that change would apply. +The configuration settings that were most recently modified will always be applied - regardless of whether you use PowerShell or Windows Security. This means that if you use the app to configure a mitigation, then use PowerShell to configure the same mitigation, the app will update to show the changes you made with PowerShell. If you were to then use the app to change the mitigation again, that change would apply. - >[!IMPORTANT] - >Any changes that are deployed to a device through Group Policy will override the local configuration. When setting up an initial configuration, use a device that will not have a Group Policy configuration applied to ensure your changes aren't overridden. +> [!IMPORTANT] +> Any changes that are deployed to a device through Group Policy will override the local configuration. When setting up an initial configuration, use a device that will not have a Group Policy configuration applied to ensure your changes aren't overridden. - You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app: +You can use the PowerShell verb `Get` or `Set` with the cmdlet `ProcessMitigation`. Using `Get` will list the current configuration status of any mitigations that have been enabled on the device - add the `-Name` cmdlet and app exe to see mitigations for just that app: ```PowerShell Get-ProcessMitigation -Name processName.exe @@ -164,7 +164,7 @@ Get-ProcessMitigation -Name processName.exe Use `Set` to configure each mitigation in the following format: - ```PowerShell +```PowerShell Set-ProcessMitigation - - ,, ``` @@ -179,34 +179,34 @@ Where: * \: * The mitigation's cmdlet as defined in the [mitigation cmdlets table](#cmdlets-table) below, along with any suboptions (surrounded with spaces). Each mitigation is separated with a comma. - For example, to enable the Data Execution Prevention (DEP) mitigation with ATL thunk emulation and for an executable called *testing.exe* in the folder *C:\Apps\LOB\tests*, and to prevent that executable from creating child processes, you'd use the following command: +For example, to enable the Data Execution Prevention (DEP) mitigation with ATL thunk emulation and for an executable called *testing.exe* in the folder *C:\Apps\LOB\tests*, and to prevent that executable from creating child processes, you'd use the following command: - ```PowerShell - Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP, EmulateAtlThunks, DisallowChildProcessCreation - ``` +```PowerShell +Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable DEP, EmulateAtlThunks, DisallowChildProcessCreation +``` - > [!IMPORTANT] - > Separate each mitigation option with commas. +> [!IMPORTANT] +> Separate each mitigation option with commas. - If you wanted to apply DEP at the system level, you'd use the following command: +If you wanted to apply DEP at the system level, you'd use the following command: - ```PowerShell - Set-Processmitigation -System -Enable DEP - ``` +```PowerShell +Set-Processmitigation -System -Enable DEP +``` - To disable mitigations, you can replace `-Enable` with `-Disable`. However, for app-level mitigations, this will force the mitigation to be disabled only for that app. +To disable mitigations, you can replace `-Enable` with `-Disable`. However, for app-level mitigations, this will force the mitigation to be disabled only for that app. - If you need to restore the mitigation back to the system default, you need to include the `-Remove` cmdlet as well, as in the following example: +If you need to restore the mitigation back to the system default, you need to include the `-Remove` cmdlet as well, as in the following example: - ```PowerShell - Set-Processmitigation -Name test.exe -Remove -Disable DEP - ``` +```PowerShell +Set-Processmitigation -Name test.exe -Remove -Disable DEP +``` - You can also set some mitigations to audit mode. Instead of using the PowerShell cmdlet for the mitigation, use the **Audit mode** cmdlet as specified in the [mitigation cmdlets table](#cmdlets-table) below. +You can also set some mitigations to audit mode. Instead of using the PowerShell cmdlet for the mitigation, use the **Audit mode** cmdlet as specified in the [mitigation cmdlets table](#cmdlets-table) below. - For example, to enable Arbitrary Code Guard (ACG) in audit mode for the *testing.exe* used previously, you'd use the following command: +For example, to enable Arbitrary Code Guard (ACG) in audit mode for the *testing.exe* used previously, you'd use the following command: - ```PowerShell +```PowerShell Set-ProcessMitigation -Name c:\apps\lob\tests\testing.exe -Enable AuditDynamicCode ``` @@ -218,29 +218,29 @@ This table lists the PowerShell cmdlets (and associated audit mode cmdlet) that -Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet -- | - | - | - -Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available -Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available -Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available -Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available -Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available -Validate heap integrity | System and app-level | TerminateOnError | Audit not available -Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode -Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad -Block remote images | App-level only | BlockRemoteImages | Audit not available -Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly -Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned -Disable extension points | App-level only | ExtensionPoint | Audit not available -Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall -Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess -Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter \[1\] | Audit not available\[2\] -Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available\[2\] -Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available\[2\] -Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available\[2\] -Validate handle usage | App-level only | StrictHandle | Audit not available -Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available -Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available\[2\] +| Mitigation | Applies to | PowerShell cmdlets | Audit mode cmdlet | +| ---------- | ---------- | ------------------ | ----------------- | +| Control flow guard (CFG) | System and app-level | CFG, StrictCFG, SuppressExports | Audit not available | +| Data Execution Prevention (DEP) | System and app-level | DEP, EmulateAtlThunks | Audit not available | +| Force randomization for images (Mandatory ASLR) | System and app-level | ForceRelocateImages | Audit not available | +| Randomize memory allocations (Bottom-Up ASLR) | System and app-level | BottomUp, HighEntropy | Audit not available | +| Validate exception chains (SEHOP) | System and app-level | SEHOP, SEHOPTelemetry | Audit not available | +| Validate heap integrity | System and app-level | TerminateOnError | Audit not available | +| Arbitrary code guard (ACG) | App-level only | DynamicCode | AuditDynamicCode | +| Block low integrity images | App-level only | BlockLowLabel | AuditImageLoad | +| Block remote images | App-level only | BlockRemoteImages | Audit not available | +| Block untrusted fonts | App-level only | DisableNonSystemFonts | AuditFont, FontAuditOnly | +| Code integrity guard | App-level only | BlockNonMicrosoftSigned, AllowStoreSigned | AuditMicrosoftSigned, AuditStoreSigned | +| Disable extension points | App-level only | ExtensionPoint | Audit not available | +| Disable Win32k system calls | App-level only | DisableWin32kSystemCalls | AuditSystemCall | +| Do not allow child processes | App-level only | DisallowChildProcessCreation | AuditChildProcess | +| Export address filtering (EAF) | App-level only | EnableExportAddressFilterPlus, EnableExportAddressFilter \[1\] | Audit not available\[2\] | +| Import address filtering (IAF) | App-level only | EnableImportAddressFilter | Audit not available\[2\] | +| Simulate execution (SimExec) | App-level only | EnableRopSimExec | Audit not available\[2\] | +| Validate API invocation (CallerCheck) | App-level only | EnableRopCallerCheck | Audit not available\[2\] | +| Validate handle usage | App-level only | StrictHandle | Audit not available | +| Validate image dependency integrity | App-level only | EnforceModuleDepencySigning | Audit not available | +| Validate stack integrity (StackPivot) | App-level only | EnableRopStackPivot | Audit not available\[2\] | \[1\]: Use the following format to enable EAF modules for dlls for a process: @@ -254,7 +254,7 @@ Set-ProcessMitigation -Name processName.exe -Enable EnableExportAddressFilterPlu For more information about customizing the notification when a rule is triggered and blocks an app or file, see [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center). -## See also +## See also: * [Protect devices from exploits](exploit-protection.md) * [Evaluate exploit protection](evaluate-exploit-protection.md) From 11f0faae52716f09f6ec1f828a9101ab5fd73bf0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 09:44:42 -0800 Subject: [PATCH 092/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 35 +++++++++---------- 1 file changed, 17 insertions(+), 18 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 9d66ce2298..d577b90969 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -122,8 +122,8 @@ The following sections describe each of the 16 attack surface reduction rules (i | Rule name | GUID | File & folder exclusions | Minimum OS supported | |-----|-----|-----|-----| -|[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (NEW!) |`56a863a9-875e-4185-98a7-b882c64b5ce5` | |[Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | @@ -139,23 +139,6 @@ The following sections describe each of the 16 attack surface reduction rules (i |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -### Block Adobe Reader from creating child processes - -This rule prevents attacks by blocking Adobe Reader from creating additional processes. - -Through social engineering or exploits, malware can download and launch additional payloads and break out of Adobe Reader. By blocking child processes from being generated by Adobe Reader, malware attempting to use it as a vector are prevented from spreading. - -This rule was introduced in: -- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) -- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) -- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - -Intune name: Process creation from Adobe Reader (beta) - -Configuration Manager name: Not yet available - -GUID: `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` - ### Block abuse of in-the-wild exploited vulnerable signed drivers This rule prevents an application from writing a vulnerable signed driver to disk. Vulnerable signed drivers can be exploited by local applications with sufficient privileges, to gain access to the kernel. It allows attackers to disable or circumvent security solutions, eventually leading to system compromise. @@ -177,6 +160,22 @@ Configuration Manager name: Not Applicable Rule guid: `56a863a9-875e-4185-98a7-b882c64b5ce5` +### Block Adobe Reader from creating child processes + +This rule prevents attacks by blocking Adobe Reader from creating additional processes. + +Through social engineering or exploits, malware can download and launch additional payloads and break out of Adobe Reader. By blocking child processes from being generated by Adobe Reader, malware attempting to use it as a vector are prevented from spreading. + +This rule was introduced in: +- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) + +Intune name: Process creation from Adobe Reader (beta) + +Configuration Manager name: Not yet available + +GUID: `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` ### Block all Office applications from creating child processes From 95910d97fd5ba84010b5cf2bd85877d62ec0cdfe Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 10:09:00 -0800 Subject: [PATCH 093/169] Update ts-bitlocker-cannot-encrypt-tpm-issues.md --- .../bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md index 121d7cd8a1..8e005347db 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md @@ -116,9 +116,9 @@ The domain and forest functional level of the environment may still be set to Wi To resolve this issue, follow these steps: 1. Upgrade the functional level of the domain and forest to Windows Server 2012 R2. -1. Download [Add-TPMSelfWriteACE.vbs](https://go.microsoft.com/fwlink/p/?LinkId=167133). -1. In the script, modify the value of **strPathToDomain** to your domain name. -1. Open an elevated PowerShell window, and run the following command: +2. Download [Add-TPMSelfWriteACE.vbs](https://go.microsoft.com/fwlink/p/?LinkId=167133). +3. In the script, modify the value of **strPathToDomain** to your domain name. +4. Open an elevated PowerShell window, and run the following command: ```powershell cscript Add-TPMSelfWriteACE.vbs From f8147a96a8a4103c56ef39af34146d7d92d223e6 Mon Sep 17 00:00:00 2001 From: Sunny Zankharia <67922512+sazankha@users.noreply.github.com> Date: Wed, 9 Dec 2020 16:04:54 -0800 Subject: [PATCH 094/169] Update md-app-guard-overview.md --- .../md-app-guard-overview.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index 74a41b6ffc..54bbdc6774 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -49,4 +49,5 @@ Application Guard has been created to target several types of systems: |[Configure the Group Policy settings for Microsoft Defender Application Guard](configure-md-app-guard.md) |Provides info about the available Group Policy and MDM settings.| |[Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Application Guard in your organization.| | [Microsoft Defender Application Guard Extension for web browsers](md-app-guard-browser-extension.md) | Describes the Application Guard extension for Chrome and Firefox, including known issues, and a trouble-shooting guide | +| [Microsoft Defender Application Guard for Microsoft Office](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/install-app-guard) | Describes Application Guard for Microsoft Office, including mimimum hardware requirements, configuration and a trouble-shooting guide | |[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| From f4f563de441c1322b9cd38e07d53f3c78d5f703f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 16:34:00 -0800 Subject: [PATCH 095/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 35 ++++++++++++++----- 1 file changed, 26 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index d577b90969..a36f13ab7b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -58,12 +58,26 @@ Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduc Warn mode helps your organization have attack surface reduction rules in place without preventing users from accessing the content they need to perform their tasks. -> [!IMPORTANT] -> Warn mode is supported on devices running the following versions of Windows: -> - [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) or later -> - [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) or later -> -> Attack surface reduction rules that are configured in warn mode will run in block mode on devices that are running older versions of Windows. +### Requirements for warn mode to work + +Warn mode is supported on devices running the following versions of Windows: +- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) or later +- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) or later + +Minimum CAMP release requirement: 4.18.2008.9 +Minimum Engine release requirement: 17400 + +### Warn mode is not supported for some attack surface reduction rules + +Warn mode is not supported for the following attack surface reduction rules: +- [Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (GUID `56a863a9-875e-4185-98a7-b882c64b5ce5`) +- [Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) (GUID `d3e037e1-3eb8-44c8-a917-57927947596d`) +- [Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) (GUID `e6db77e5-3df2-4cf1-b95a-636979351e5b`) +- [Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) (GUID `c1db55ab-c21a-4637-bb3f-a12568109d35`) + +Attack surface reduction rules that are configured in warn mode will run in block mode on devices that are running older versions of Windows. + + ## Notifications when a rule is triggered @@ -118,10 +132,13 @@ The "engine version" listed for attack surface reduction events in the event log ## Attack surface reduction rules -The following sections describe each of the 16 attack surface reduction rules (in alphabetical order of rule name). This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use Microsoft Endpoint Configuration Manager or Microsoft Intune, you do not need the GUIDs: +The following table and subsections describe each of the 16 attack surface reduction rules. The attack surface reduction rules are listed in alphabetical order, by rule name. + +If you are configuring attack surface reduction rules by using Group Policy or PowerShell, you'll need the GUIDs. On the other hand, if you use Microsoft Endpoint Configuration Manager or Microsoft Intune, you do not need the GUIDs. + | Rule name | GUID | File & folder exclusions | Minimum OS supported | -|-----|-----|-----|-----| +|:-----|:-----:|:-----|:-----| |[Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (NEW!) |`56a863a9-875e-4185-98a7-b882c64b5ce5` | |[Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | @@ -141,7 +158,7 @@ The following sections describe each of the 16 attack surface reduction rules (i ### Block abuse of in-the-wild exploited vulnerable signed drivers -This rule prevents an application from writing a vulnerable signed driver to disk. Vulnerable signed drivers can be exploited by local applications with sufficient privileges, to gain access to the kernel. It allows attackers to disable or circumvent security solutions, eventually leading to system compromise. +(**NEW**!) This rule prevents an application from writing a vulnerable signed driver to disk. Vulnerable signed drivers can be exploited by local applications with sufficient privileges, to gain access to the kernel. It allows attackers to disable or circumvent security solutions, eventually leading to system compromise. This rule does not block a driver already existing on the system from being loaded. From 36f1406f051f08eccaebbdc3dea96493e20e2cb6 Mon Sep 17 00:00:00 2001 From: Sunny Zankharia <67922512+sazankha@users.noreply.github.com> Date: Wed, 9 Dec 2020 16:36:10 -0800 Subject: [PATCH 096/169] Update windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../md-app-guard-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index 54bbdc6774..636b12a48a 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -49,5 +49,5 @@ Application Guard has been created to target several types of systems: |[Configure the Group Policy settings for Microsoft Defender Application Guard](configure-md-app-guard.md) |Provides info about the available Group Policy and MDM settings.| |[Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Application Guard in your organization.| | [Microsoft Defender Application Guard Extension for web browsers](md-app-guard-browser-extension.md) | Describes the Application Guard extension for Chrome and Firefox, including known issues, and a trouble-shooting guide | -| [Microsoft Defender Application Guard for Microsoft Office](https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/install-app-guard) | Describes Application Guard for Microsoft Office, including mimimum hardware requirements, configuration and a trouble-shooting guide | +| [Microsoft Defender Application Guard for Microsoft Office](https://docs.microsoft.com/microsoft-365/security/office-365-security/install-app-guard) | Describes Application Guard for Microsoft Office, including minimum hardware requirements, configuration and a trouble-shooting guide | |[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| From dceb30e4c68e788afa800c1ddfe3a13ca61374ce Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 16:38:09 -0800 Subject: [PATCH 097/169] Update TOC.md --- windows/security/threat-protection/TOC.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index f9ae070935..79487e7cc2 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -185,9 +185,7 @@ ###### [Report on antivirus protection]() ###### [Review protection status and alerts](microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md) ###### [Troubleshoot antivirus reporting in Update Compliance](microsoft-defender-antivirus/troubleshoot-reporting.md) - -###### [Manage updates and apply baselines]() -###### [Learn about the different kinds of updates](microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md) +###### [Learn about the recent updates](microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md) ###### [Manage protection and security intelligence updates](microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md) ###### [Manage when protection updates should be downloaded and applied](microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md) ###### [Manage updates for endpoints that are out of date](microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md) From e5686c79e57da2aed6fc8d1b70e75d971ae46e06 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Wed, 9 Dec 2020 16:52:27 -0800 Subject: [PATCH 098/169] grammar fix --- windows/whats-new/whats-new-windows-10-version-20H2.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/whats-new-windows-10-version-20H2.md b/windows/whats-new/whats-new-windows-10-version-20H2.md index b5bcef856d..f1046db593 100644 --- a/windows/whats-new/whats-new-windows-10-version-20H2.md +++ b/windows/whats-new/whats-new-windows-10-version-20H2.md @@ -88,7 +88,7 @@ For more information about what's new in MDM, see [What's new in mobile device e ### Microsoft Defender for Endpoint -This release includes improved support for non-ASCII file paths has been added for Microsoft Defender for Endpoint Auto Incident Response (IR). +This release includes improved support for non-ASCII file paths for Microsoft Defender Advanced Threat Protection (ATP) Auto Incident Response (IR). The [DisableAntiSpyware](https://docs.microsoft.com/windows-hardware/customize/desktop/unattend/security-malware-windows-defender-disableantispyware) parameter is deprecated in this release. From 2f324dedd1f35b63694716c8f260717aab8bd94b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 16:52:59 -0800 Subject: [PATCH 099/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index a36f13ab7b..e10bf2816b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -64,8 +64,11 @@ Warn mode is supported on devices running the following versions of Windows: - [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) or later - [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) or later -Minimum CAMP release requirement: 4.18.2008.9 -Minimum Engine release requirement: 17400 +In addition, make sure [Microsoft Defender Antivirus and antimalware updates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus#monthly-platform-and-engine-versions) are installed +- Minimum platform release requirement: `4.18.2008.9` +- Minimum engine release requirement: `1.1.17400.5` + +For more information, see [Update for Microsoft Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform). ### Warn mode is not supported for some attack surface reduction rules From d9d0388a5901654d0278d9f800aa2dd44fb46ded Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 17:01:26 -0800 Subject: [PATCH 100/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index e10bf2816b..6319fcee8b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -68,23 +68,21 @@ In addition, make sure [Microsoft Defender Antivirus and antimalware updates](ht - Minimum platform release requirement: `4.18.2008.9` - Minimum engine release requirement: `1.1.17400.5` -For more information, see [Update for Microsoft Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform). +For more information and to get your updates, see [Update for Microsoft Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform). -### Warn mode is not supported for some attack surface reduction rules +### Cases where warn mode is not supported -Warn mode is not supported for the following attack surface reduction rules: -- [Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (GUID `56a863a9-875e-4185-98a7-b882c64b5ce5`) +Warn mode is not supported for the following four attack surface reduction rules: +- (NEW!) [Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (GUID `56a863a9-875e-4185-98a7-b882c64b5ce5`) - [Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) (GUID `d3e037e1-3eb8-44c8-a917-57927947596d`) - [Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) (GUID `e6db77e5-3df2-4cf1-b95a-636979351e5b`) - [Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) (GUID `c1db55ab-c21a-4637-bb3f-a12568109d35`) -Attack surface reduction rules that are configured in warn mode will run in block mode on devices that are running older versions of Windows. - - +In addition, warn mode is not supported on devices running older versions of Windows. In those cases, attack surface reduction rules that are configured to run in warn mode will run in block mode. ## Notifications when a rule is triggered -Whenever a rule is triggered, a notification will be displayed on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. The notification also displays within the Microsoft Defender Security Center and the Microsoft 365 security center. +Whenever a rule is triggered, a notification will be displayed on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. The notification also displays within the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and the Microsoft 365 security center ([https://security.microsoft.com](https://security.microsoft.com)). ## Attack surface reduction features across Windows versions From 6085c05391a266f9106c57e06c2a417248bbf80c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 17:21:39 -0800 Subject: [PATCH 101/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 6319fcee8b..6e9d5e5bfe 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -52,6 +52,21 @@ In the recommendation details pane, check the user impact to determine what perc Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would impact your organization if they were enabled. It's best to run all rules in audit mode first so you can understand their impact on your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they may perform tasks in ways that seem similar to malware. By monitoring audit data and [adding exclusions](enable-attack-surface-reduction.md#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without impacting productivity. +## Silent auditing + +(**NEW**!) To add security value, a sample of attack surface reduction audit events are now collected on devices that do not have attack surface reduction rules enabled in either audit mode or block mode. + +By default, attack surface reduction rules are not enabled in audit mode. Silent auditing is a new capability that collects events for the following four attack surface reduction rules: +- [Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) +- [Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) +- [Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) +- [Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) + +The other attack surface reduction rules that are not configured will not have any auditing events collected. And, you can disable silent auditing by disabling the rules. + +> [!NOTE] +> Currently, auditing events are not viewable in advanced hunting. + ## Warn mode for users (**NEW**!) Prior to warn mode capabilities, attack surface reduction rules that are enabled could be set to either audit mode or block mode. With the new warn mode, whenever content is blocked by an attack surface reduction rule, users see a dialog box that indicates the content is blocked. The dialog box also offers the user an option to unblock the content. The user can then retry their action, and the operation completes. WHen a user unblocks content, the content remains unblocked for 24 hours, and then blocking resumes. @@ -140,7 +155,7 @@ If you are configuring attack surface reduction rules by using Group Policy or P | Rule name | GUID | File & folder exclusions | Minimum OS supported | |:-----|:-----:|:-----|:-----| -|[Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (NEW!) |`56a863a9-875e-4185-98a7-b882c64b5ce5` | |[Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | +|[Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (**NEW**!) |`56a863a9-875e-4185-98a7-b882c64b5ce5` | |[Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | From ccbddd6847d80b675c6d40bfc3e606ef73174122 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 17:26:39 -0800 Subject: [PATCH 102/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 48 +++++++++---------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 6e9d5e5bfe..6a73600f8d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -174,7 +174,7 @@ If you are configuring attack surface reduction rules by using Group Policy or P ### Block abuse of in-the-wild exploited vulnerable signed drivers -(**NEW**!) This rule prevents an application from writing a vulnerable signed driver to disk. Vulnerable signed drivers can be exploited by local applications with sufficient privileges, to gain access to the kernel. It allows attackers to disable or circumvent security solutions, eventually leading to system compromise. +(**NEW**!) This new rule prevents an application from writing a vulnerable signed driver to disk. Vulnerable signed drivers can be exploited by local applications with sufficient privileges, to gain access to the kernel. It allows attackers to disable or circumvent security solutions, eventually leading to system compromise. This rule does not block a driver already existing on the system from being loaded. @@ -187,7 +187,7 @@ This rule is supported on all versions of Windows where attack surface reduction - Windows Server, version 1803 (Semi-Annual Channel) or later - Windows Server 2019 -Intune Name: Block abuse of exploited vulnerable signed drivers +Intune Name: `Block abuse of exploited vulnerable signed drivers` Configuration Manager name: Not Applicable @@ -204,7 +204,7 @@ This rule was introduced in: - [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -Intune name: Process creation from Adobe Reader (beta) +Intune name: `Process creation from Adobe Reader (beta)` Configuration Manager name: Not yet available @@ -222,9 +222,9 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Office apps launching child processes +Intune name: `Office apps launching child processes` -Configuration Manager name: Block Office application from creating child processes +Configuration Manager name: `Block Office application from creating child processes` GUID: `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` @@ -243,9 +243,9 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Flag credential stealing from the Windows local security authority subsystem +Intune name: `Flag credential stealing from the Windows local security authority subsystem` -Configuration Manager name: Block credential stealing from the Windows local security authority subsystem +Configuration Manager name: `Block credential stealing from the Windows local security authority subsystem` GUID: `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` @@ -262,9 +262,9 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [Microsoft Endpoint Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions) +Intune name: `Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions)` -Microsoft Endpoint Configuration Manager name: Block executable content from email client and webmail +Microsoft Endpoint Configuration Manager name: `Block executable content from email client and webmail` GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` @@ -287,9 +287,9 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Executables that don't meet a prevalence, age, or trusted list criteria. +Intune name: `Executables that don't meet a prevalence, age, or trusted list criteria` -Configuration Manager name: Block executable files from running unless they meet a prevalence, age, or trusted list criteria +Configuration Manager name: `Block executable files from running unless they meet a prevalence, age, or trusted list criteria` GUID: `01443614-cd74-433a-b99e-2ecdc07bfc25` @@ -305,9 +305,9 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Obfuscated js/vbs/ps/macro code +Intune name: `Obfuscated js/vbs/ps/macro code` -Configuration Manager name: Block execution of potentially obfuscated scripts. +Configuration Manager name: `Block execution of potentially obfuscated scripts` GUID: `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` @@ -323,9 +323,9 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: js/vbs executing payload downloaded from Internet (no exceptions) +Intune name: `js/vbs executing payload downloaded from Internet (no exceptions)` -Configuration Manager name: Block JavaScript or VBScript from launching downloaded executable content +Configuration Manager name: `Block JavaScript or VBScript from launching downloaded executable content` GUID: `D3E037E1-3EB8-44C8-A917-57927947596D` @@ -333,7 +333,7 @@ GUID: `D3E037E1-3EB8-44C8-A917-57927947596D` This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk. - Malware that abuses Office as a vector may attempt to break out of Office and save malicious components to disk. These malicious components would survive a computer reboot and persist on the system. Therefore, this rule defends against a common persistence technique. +Malware that abuses Office as a vector may attempt to break out of Office and save malicious components to disk. These malicious components would survive a computer reboot and persist on the system. Therefore, this rule defends against a common persistence technique. This rule was introduced in: - [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) @@ -341,9 +341,9 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [System Center Configuration Manager](https://docs.microsoft.com/configmgr/core/servers/manage/updates) (SCCM) CB 1710 (SCCM is now Microsoft Endpoint Configuration Manager) -Intune name: Office apps/macros creating executable content +Intune name: `Office apps/macros creating executable content` -SCCM name: Block Office applications from creating executable content +SCCM name: `Block Office applications from creating executable content` GUID: `3B576869-A4EC-4529-8536-B80A7769E899` @@ -363,9 +363,9 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Office apps injecting code into other processes (no exceptions) +Intune name: `Office apps injecting code into other processes (no exceptions)` -Configuration Manager name: Block Office applications from injecting code into other processes +Configuration Manager name: `Block Office applications from injecting code into other processes` GUID: `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` @@ -383,9 +383,9 @@ This rule was introduced in: - [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -Intune name: Process creation from Office communication products (beta) +Intune name: `Process creation from Office communication products (beta)` -Configuration Manager name: Not yet available +Configuration Manager name: Not available GUID: `26190899-1602-49e8-8b27-eb1d0a1ce869` @@ -402,9 +402,9 @@ This rule was introduced in: - [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) - [Windows Server 1903](https://docs.microsoft.com/windows-server/get-started-19/whats-new-in-windows-server-1903-1909) -Intune name: Not yet available +Intune name: Not available -Configuration Manager name: Not yet available +Configuration Manager name: Not available GUID: `e6db77e5-3df2-4cf1-b95a-636979351e5b` From 3fa1f0577656d6f052b3d9e2e44448a3999d2fef Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 17:27:58 -0800 Subject: [PATCH 103/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 6a73600f8d..8a4e322ae0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -420,7 +420,7 @@ This rule was introduced in: - [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) -Intune name: Process creation from PSExec and WMI commands +Intune name: `Process creation from PSExec and WMI commands` Configuration Manager name: Not applicable @@ -436,9 +436,9 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Untrusted and unsigned processes that run from USB +Intune name: `Untrusted and unsigned processes that run from USB` -Configuration Manager name: Block untrusted and unsigned processes that run from USB +Configuration Manager name: `Block untrusted and unsigned processes that run from USB` GUID: `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` @@ -454,9 +454,9 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Win32 imports from Office macro code +Intune name: `Win32 imports from Office macro code` -Configuration Manager name: Block Win32 API calls from Office macros +Configuration Manager name: `Block Win32 API calls from Office macros` GUID: `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` @@ -473,9 +473,9 @@ This rule was introduced in: - [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) - [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates) -Intune name: Advanced ransomware protection +Intune name: `Advanced ransomware protection` -Configuration Manager name: Use advanced protection against ransomware +Configuration Manager name: `Use advanced protection against ransomware` GUID: `c1db55ab-c21a-4637-bb3f-a12568109d35` From 1b38d3de84c4b910d88cef2a82ee8b8d8a4547cd Mon Sep 17 00:00:00 2001 From: Sunny Zankharia <67922512+sazankha@users.noreply.github.com> Date: Wed, 9 Dec 2020 17:31:54 -0800 Subject: [PATCH 104/169] Update windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- .../md-app-guard-overview.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index 636b12a48a..4152b07ee4 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -48,6 +48,6 @@ Application Guard has been created to target several types of systems: |[Prepare and install Microsoft Defender Application Guard](install-md-app-guard.md) |Provides instructions about determining which mode to use, either Standalone or Enterprise-managed, and how to install Application Guard in your organization.| |[Configure the Group Policy settings for Microsoft Defender Application Guard](configure-md-app-guard.md) |Provides info about the available Group Policy and MDM settings.| |[Testing scenarios using Microsoft Defender Application Guard in your business or organization](test-scenarios-md-app-guard.md)|Provides a list of suggested testing scenarios that you can use to test Application Guard in your organization.| -| [Microsoft Defender Application Guard Extension for web browsers](md-app-guard-browser-extension.md) | Describes the Application Guard extension for Chrome and Firefox, including known issues, and a trouble-shooting guide | -| [Microsoft Defender Application Guard for Microsoft Office](https://docs.microsoft.com/microsoft-365/security/office-365-security/install-app-guard) | Describes Application Guard for Microsoft Office, including minimum hardware requirements, configuration and a trouble-shooting guide | +| [Microsoft Defender Application Guard Extension for web browsers](md-app-guard-browser-extension.md) | Describes the Application Guard extension for Chrome and Firefox, including known issues, and a troubleshooting guide | +| [Microsoft Defender Application Guard for Microsoft Office](https://docs.microsoft.com/microsoft-365/security/office-365-security/install-app-guard) | Describes Application Guard for Microsoft Office, including minimum hardware requirements, configuration, and a troubleshooting guide | |[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.| From 9ad86a573616ec14810c9b9b576ee5ce9e815a16 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 17:34:22 -0800 Subject: [PATCH 105/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 8a4e322ae0..b67df3ca92 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -44,7 +44,7 @@ For more information about configuring attack surface reduction rules, see [Enab You can assess how an attack surface reduction rule might impact your network by opening the security recommendation for that rule in [threat and vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/#tvm). -:::image type="content" source="images/asrrecommendation.png" alt-text="Security recommendation for ASR rule"::: +:::image type="content" source="images/asrrecommendation.png" alt-text="Security reco for attack surface reduction rule"::: In the recommendation details pane, check the user impact to determine what percentage of your devices can accept a new policy enabling the rule in blocking mode without adverse impact to user productivity. @@ -54,7 +54,7 @@ Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduc ## Silent auditing -(**NEW**!) To add security value, a sample of attack surface reduction audit events are now collected on devices that do not have attack surface reduction rules enabled in either audit mode or block mode. +(**NEW**!) To add security value, a sample of attack surface reduction audit events is now collected on devices that do not have attack surface reduction rules enabled in either audit mode or block mode. The collected events are throttled to 100 events per device By default, attack surface reduction rules are not enabled in audit mode. Silent auditing is a new capability that collects events for the following four attack surface reduction rules: - [Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) @@ -69,7 +69,7 @@ The other attack surface reduction rules that are not configured will not have a ## Warn mode for users -(**NEW**!) Prior to warn mode capabilities, attack surface reduction rules that are enabled could be set to either audit mode or block mode. With the new warn mode, whenever content is blocked by an attack surface reduction rule, users see a dialog box that indicates the content is blocked. The dialog box also offers the user an option to unblock the content. The user can then retry their action, and the operation completes. WHen a user unblocks content, the content remains unblocked for 24 hours, and then blocking resumes. +(**NEW**!) Prior to warn mode capabilities, attack surface reduction rules that are enabled could be set to either audit mode or block mode. With the new warn mode, whenever content is blocked by an attack surface reduction rule, users see a dialog box that indicates the content is blocked. The dialog box also offers the user an option to unblock the content. The user can then retry their action, and the operation completes. When a user unblocks content, the content remains unblocked for 24 hours, and then blocking resumes. Warn mode helps your organization have attack surface reduction rules in place without preventing users from accessing the content they need to perform their tasks. @@ -136,7 +136,7 @@ You can review the Windows event log to view events generated by attack surface 5. Select **OK**. -This will create a custom view that filters events to only show the following, all of which are related to controlled folder access: +You can create a custom view that filters events to only show the following events, all of which are related to controlled folder access: |Event ID | Description | |---|---| @@ -212,7 +212,7 @@ GUID: `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` ### Block all Office applications from creating child processes -This rule blocks Office apps from creating child processes. This includes Word, Excel, PowerPoint, OneNote, and Access. +This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access. Creating malicious child processes is a common malware strategy. Malware that abuse Office as a vector often run VBA macros and exploit code to download and attempt to run additional payloads. However, some legitimate line-of-business applications might also generate child processes for benign purposes, such as spawning a command prompt or using PowerShell to configure registry settings. From ecfec7b56dc664418fc3cf0e4c0af9cb105b87f5 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 9 Dec 2020 17:36:16 -0800 Subject: [PATCH 106/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index b67df3ca92..9cbb770158 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -232,7 +232,7 @@ GUID: `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` This rule helps prevent credential stealing, by locking down Local Security Authority Subsystem Service (LSASS). -LSASS authenticates users who log in to a Windows computer. Microsoft Defender Credential Guard in Windows 10 normally prevents attempts to extract credentials from LSASS. However, some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use hack tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. +LSASS authenticates users who sign in on a Windows computer. Microsoft Defender Credential Guard in Windows 10 normally prevents attempts to extract credentials from LSASS. However, some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use hack tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. > [!NOTE] > In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that simply enumerates LSASS, but has no real impact in functionality, there is NO need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat. @@ -373,7 +373,7 @@ GUID: `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions. -This protects against social engineering attacks and prevents exploit code from abusing vulnerabilities in Outlook. It also protects against [Outlook rules and forms exploits](https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/) that attackers can use when a user's credentials are compromised. +This rule protects against social engineering attacks and prevents exploit code from abusing vulnerabilities in Outlook. It also protects against [Outlook rules and forms exploits](https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/) that attackers can use when a user's credentials are compromised. > [!NOTE] > This rule applies to Outlook and Outlook.com only. From 8d2c3cf2051b31922d411b86285b6c3fec94482e Mon Sep 17 00:00:00 2001 From: Sunayana Singh <57405155+sunasing@users.noreply.github.com> Date: Thu, 10 Dec 2020 12:17:06 +0530 Subject: [PATCH 107/169] Minor fix --- .../microsoft-defender-atp/ios-configure-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md index a5e183572d..9d819f99ad 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md @@ -68,7 +68,7 @@ By default, Defender for Endpoint for iOS includes and enables the web protectio While enabled by default, there might be some cases that require you to disable VPN. For example, you want to run some apps that do not work when a VPN is configured. In such cases, you can choose to disable VPN from the app on the device by following the steps below: -1. On your iOS device, open the **Settings** app and click or tap **VPN**. +1. On your iOS device, open the **Settings** app and click or tap **General** and then **VPN**. 1. Click or tap the "i" button for Microsoft Defender ATP. 1. Toggle off **Connect On Demand** to disable VPN. From dd1e87ba6fade6496022039ae50e60043fdfb396 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Thu, 10 Dec 2020 10:30:58 +0200 Subject: [PATCH 108/169] Update windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../bitlocker/bitlocker-group-policy-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index 91bf628e8b..f6f72e035f 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -38,7 +38,7 @@ If multiple changes are necessary to bring the drive into compliance, you must s Policy settings are changed to disallow passwords and require smart cards. In this situation, you need to suspend BitLocker protection by using the [Manage-bde](/windows-server/administration/windows-commands/manage-bde) command-line tool, delete the password unlock method, and add the smart card method. After this is complete, BitLocker is compliant with the Group Policy setting and BitLocker protection on the drive can be resumed. > [!NOTE] -> For more details about Active Directory configuration related to BitLocker enablement, please check [this article](https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker). +> For more details about Active Directory configuration related to BitLocker enablement, please see [Set up MDT for BitLocker](https://docs.microsoft.com/windows/deployment/deploy-windows-mdt/set-up-mdt-for-bitlocker). ## BitLocker Group Policy settings From 802643f8051f33b086187571d4aad21c73f25095 Mon Sep 17 00:00:00 2001 From: Sunayana Singh <57405155+sunasing@users.noreply.github.com> Date: Thu, 10 Dec 2020 15:27:16 +0530 Subject: [PATCH 109/169] Minor fix as suggested --- .../microsoft-defender-atp/ios-configure-features.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md index 9d819f99ad..6c50645b1f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md +++ b/windows/security/threat-protection/microsoft-defender-atp/ios-configure-features.md @@ -64,11 +64,11 @@ Defender for Endpoint for iOS enables admins to configure custom indicators on i ## Web Protection and VPN -By default, Defender for Endpoint for iOS includes and enables the web protection feature. [Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. Defender for Endpoint for iOS uses a local VPN in order to provide this protection. +By default, Defender for Endpoint for iOS includes and enables the web protection feature. [Web protection](web-protection-overview.md) helps to secure devices against web threats and protect users from phishing attacks. Defender for Endpoint for iOS uses a VPN in order to provide this protection. Please note this is a local VPN and unlike traditional VPN, network traffic is not sent outside the device. While enabled by default, there might be some cases that require you to disable VPN. For example, you want to run some apps that do not work when a VPN is configured. In such cases, you can choose to disable VPN from the app on the device by following the steps below: -1. On your iOS device, open the **Settings** app and click or tap **General** and then **VPN**. +1. On your iOS device, open the **Settings** app, click or tap **General** and then **VPN**. 1. Click or tap the "i" button for Microsoft Defender ATP. 1. Toggle off **Connect On Demand** to disable VPN. From 9d0d547de74c7302411eeec2d90bb66ca43e6464 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 10 Dec 2020 19:45:48 +0500 Subject: [PATCH 110/169] minor corrections did cosmetic changes to the document. Problem: https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8282 --- windows/client-management/troubleshoot-tcpip-netmon.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/troubleshoot-tcpip-netmon.md b/windows/client-management/troubleshoot-tcpip-netmon.md index 7f7855bca2..672e45dae2 100644 --- a/windows/client-management/troubleshoot-tcpip-netmon.md +++ b/windows/client-management/troubleshoot-tcpip-netmon.md @@ -19,7 +19,7 @@ In this topic, you will learn how to use Microsoft Network Monitor 3.4, which is > [!NOTE] > Network Monitor is the archived protocol analyzer and is no longer under development. **Microsoft Message Analyzer** is the replacement for Network Monitor. For more details, see [Microsoft Message Analyzer Operating Guide](https://docs.microsoft.com/message-analyzer/microsoft-message-analyzer-operating-guide). -To get started, [download and run NM34_x64.exe](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image. +To get started, [download Network Monitor tool](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image. ![Adapters](images/nm-adapters.png) From dbaf7752a9c1977980c877950e24be0574adb404 Mon Sep 17 00:00:00 2001 From: ImranHabib <47118050+joinimran@users.noreply.github.com> Date: Thu, 10 Dec 2020 20:15:05 +0500 Subject: [PATCH 111/169] Update windows/client-management/troubleshoot-tcpip-netmon.md Co-authored-by: Trond B. Krokli <38162891+illfated@users.noreply.github.com> --- windows/client-management/troubleshoot-tcpip-netmon.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/troubleshoot-tcpip-netmon.md b/windows/client-management/troubleshoot-tcpip-netmon.md index 672e45dae2..ed2dc15ba1 100644 --- a/windows/client-management/troubleshoot-tcpip-netmon.md +++ b/windows/client-management/troubleshoot-tcpip-netmon.md @@ -19,7 +19,7 @@ In this topic, you will learn how to use Microsoft Network Monitor 3.4, which is > [!NOTE] > Network Monitor is the archived protocol analyzer and is no longer under development. **Microsoft Message Analyzer** is the replacement for Network Monitor. For more details, see [Microsoft Message Analyzer Operating Guide](https://docs.microsoft.com/message-analyzer/microsoft-message-analyzer-operating-guide). -To get started, [download Network Monitor tool](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image. +To get started, [download Network Monitor tool](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image: ![Adapters](images/nm-adapters.png) From daf4cb028fdd586c2e18fd70569c53b3cb2954b9 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 10:00:48 -0800 Subject: [PATCH 112/169] Update md-app-guard-overview.md --- .../md-app-guard-overview.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index 4152b07ee4..03930690d8 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -8,7 +8,7 @@ ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.date: 09/07/2020 +ms.date: 12/10/2020 ms.reviewer: manager: dansimp ms.custom: asr @@ -32,18 +32,18 @@ If an employee goes to an untrusted site through either Microsoft Edge or Intern Application Guard has been created to target several types of systems: -- **Enterprise desktops.** These desktops are domain-joined and managed by your organization. Configuration management is primarily done through Microsoft Endpoint Configuration Manager or Microsoft Intune. Employees typically have Standard User privileges and use a high-bandwidth, wired, corporate network. +- **Enterprise desktops**. These desktops are domain-joined and managed by your organization. Configuration management is primarily done through Microsoft Endpoint Configuration Manager or Microsoft Intune. Employees typically have Standard User privileges and use a high-bandwidth, wired, corporate network. -- **Enterprise mobile laptops.** These laptops are domain-joined and managed by your organization. Configuration management is primarily done through Microsoft Endpoint Configuration Manager or Microsoft Intune. Employees typically have Standard User privileges and use a high-bandwidth, wireless, corporate network. +- **Enterprise mobile laptops**. These laptops are domain-joined and managed by your organization. Configuration management is primarily done through Microsoft Endpoint Configuration Manager or Microsoft Intune. Employees typically have Standard User privileges and use a high-bandwidth, wireless, corporate network. -- **Bring your own device (BYOD) mobile laptops.** These personally-owned laptops are not domain-joined, but are managed by your organization through tools, such as Microsoft Intune. The employee is typically an admin on the device and uses a high-bandwidth wireless corporate network while at work and a comparable personal network while at home. +- **Bring your own device (BYOD) mobile laptops**. These personally-owned laptops are not domain-joined, but are managed by your organization through tools, such as Microsoft Intune. The employee is typically an admin on the device and uses a high-bandwidth wireless corporate network while at work and a comparable personal network while at home. -- **Personal devices.** These personally-owned desktops or mobile laptops are not domain-joined or managed by an organization. The user is an admin on the device and uses a high-bandwidth wireless personal network while at home or a comparable public network while outside. +- **Personal devices**. These personally-owned desktops or mobile laptops are not domain-joined or managed by an organization. The user is an admin on the device and uses a high-bandwidth wireless personal network while at home or a comparable public network while outside. ## Related articles |Article |Description | -|------|------------| +|:------|:------------| |[System requirements for Microsoft Defender Application Guard](reqs-md-app-guard.md) |Specifies the prerequisites necessary to install and use Application Guard.| |[Prepare and install Microsoft Defender Application Guard](install-md-app-guard.md) |Provides instructions about determining which mode to use, either Standalone or Enterprise-managed, and how to install Application Guard in your organization.| |[Configure the Group Policy settings for Microsoft Defender Application Guard](configure-md-app-guard.md) |Provides info about the available Group Policy and MDM settings.| From e6014e57d457a27f6f650f46bd47c76afaef60a8 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 10:05:34 -0800 Subject: [PATCH 113/169] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index 5498350b55..11a0785946 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -15,7 +15,7 @@ ms.localizationpriority: medium ms.custom: - next-gen - edr -ms.date: 08/21/2020 +ms.date: 12/10/2020 ms.collection: - m365-security-compliance - m365initiative-defender-endpoint @@ -39,7 +39,7 @@ EDR in block mode is also integrated with [threat & vulnerability management](ht :::image type="content" source="images/edrblockmode-TVMrecommendation.png" alt-text="recommendation to turn on EDR in block mode"::: > [!NOTE] -> EDR in block mode is currently in preview, available to organizations who have opted in to receive **[preview features](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/preview)**. To get the best protection, make sure to **[deploy Microsoft Defender for Endpoint baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline)**. +> To get the best protection, make sure to **[deploy Microsoft Defender for Endpoint baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline)**. ## What happens when something is detected? From dd00929c5fb4a13323139239f1b6341ba4818e61 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 13:31:58 -0800 Subject: [PATCH 114/169] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index 11a0785946..ceb116cea0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -81,6 +81,10 @@ The following image shows an instance of unwanted software that was detected and ## Frequently asked questions +### Do I need to turn EDR in block mode on even when I have Microsoft Defender Antivirus running on devices? + +We recommend keeping EDR in block mode on, whether Microsoft Defender Antivirus is running in passive mode or in active mode. EDR in block mode gives you an added layer of defense with Microsoft Defender for Endpoint. It allows Microsoft Defender for Endpoint to take actions, based on EDR detections. + ### Will EDR in block mode have any impact on a user's antivirus protection? No. EDR in block mode does not affect third-party antivirus protection running on users' devices. EDR in block mode kicks in if the primary antivirus solution misses something, or if there is a post-breach detection. EDR in block mode works just like [Microsoft Defender Antivirus in passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility#functionality-and-features-available-in-each-state), with the additional steps of blocking and remediating malicious artifacts or behaviors that are detected. From 9822f130a862bb094c70d95f73cbb8d11b6b1ce5 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 13:48:26 -0800 Subject: [PATCH 115/169] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index ceb116cea0..0372ef6ab9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -83,7 +83,7 @@ The following image shows an instance of unwanted software that was detected and ### Do I need to turn EDR in block mode on even when I have Microsoft Defender Antivirus running on devices? -We recommend keeping EDR in block mode on, whether Microsoft Defender Antivirus is running in passive mode or in active mode. EDR in block mode gives you an added layer of defense with Microsoft Defender for Endpoint. It allows Microsoft Defender for Endpoint to take actions, based on EDR detections. +We recommend keeping EDR in block mode on, whether Microsoft Defender Antivirus is running in passive mode or in active mode. EDR in block mode gives you an added layer of defense with Microsoft Defender for Endpoint. It allows Microsoft Defender for Endpoint to take actions based on post-breach behavioral EDR detections. ### Will EDR in block mode have any impact on a user's antivirus protection? From eeac52a8eb5b05446a61c9b4e4727dccd7f892bd Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 14:47:58 -0800 Subject: [PATCH 116/169] Update attack-surface-reduction.md --- .../attack-surface-reduction.md | 43 ++----------------- 1 file changed, 3 insertions(+), 40 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 9cbb770158..fc88435234 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -52,21 +52,6 @@ In the recommendation details pane, check the user impact to determine what perc Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would impact your organization if they were enabled. It's best to run all rules in audit mode first so you can understand their impact on your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they may perform tasks in ways that seem similar to malware. By monitoring audit data and [adding exclusions](enable-attack-surface-reduction.md#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without impacting productivity. -## Silent auditing - -(**NEW**!) To add security value, a sample of attack surface reduction audit events is now collected on devices that do not have attack surface reduction rules enabled in either audit mode or block mode. The collected events are throttled to 100 events per device - -By default, attack surface reduction rules are not enabled in audit mode. Silent auditing is a new capability that collects events for the following four attack surface reduction rules: -- [Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) -- [Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) -- [Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) -- [Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) - -The other attack surface reduction rules that are not configured will not have any auditing events collected. And, you can disable silent auditing by disabling the rules. - -> [!NOTE] -> Currently, auditing events are not viewable in advanced hunting. - ## Warn mode for users (**NEW**!) Prior to warn mode capabilities, attack surface reduction rules that are enabled could be set to either audit mode or block mode. With the new warn mode, whenever content is blocked by an attack surface reduction rule, users see a dialog box that indicates the content is blocked. The dialog box also offers the user an option to unblock the content. The user can then retry their action, and the operation completes. When a user unblocks content, the content remains unblocked for 24 hours, and then blocking resumes. @@ -87,8 +72,8 @@ For more information and to get your updates, see [Update for Microsoft Defender ### Cases where warn mode is not supported -Warn mode is not supported for the following four attack surface reduction rules: -- (NEW!) [Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (GUID `56a863a9-875e-4185-98a7-b882c64b5ce5`) +Warn mode is not supported for the following attack surface reduction rules: + - [Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) (GUID `d3e037e1-3eb8-44c8-a917-57927947596d`) - [Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) (GUID `e6db77e5-3df2-4cf1-b95a-636979351e5b`) - [Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) (GUID `c1db55ab-c21a-4637-bb3f-a12568109d35`) @@ -148,14 +133,13 @@ The "engine version" listed for attack surface reduction events in the event log ## Attack surface reduction rules -The following table and subsections describe each of the 16 attack surface reduction rules. The attack surface reduction rules are listed in alphabetical order, by rule name. +The following table and subsections describe each of the 15 attack surface reduction rules. The attack surface reduction rules are listed in alphabetical order, by rule name. If you are configuring attack surface reduction rules by using Group Policy or PowerShell, you'll need the GUIDs. On the other hand, if you use Microsoft Endpoint Configuration Manager or Microsoft Intune, you do not need the GUIDs. | Rule name | GUID | File & folder exclusions | Minimum OS supported | |:-----|:-----:|:-----|:-----| -|[Block abuse of in-the-wild exploited vulnerable signed drivers](#block-abuse-of-in-the-wild-exploited-vulnerable-signed-drivers) (**NEW**!) |`56a863a9-875e-4185-98a7-b882c64b5ce5` | |[Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | @@ -172,27 +156,6 @@ If you are configuring attack surface reduction rules by using Group Policy or P |[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | |[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater | -### Block abuse of in-the-wild exploited vulnerable signed drivers - -(**NEW**!) This new rule prevents an application from writing a vulnerable signed driver to disk. Vulnerable signed drivers can be exploited by local applications with sufficient privileges, to gain access to the kernel. It allows attackers to disable or circumvent security solutions, eventually leading to system compromise. - -This rule does not block a driver already existing on the system from being loaded. - -> [!TIP] -> You can submit a driver for analysis at the [Microsoft Security Intelligence site](https://www.microsoft.com/wdsi/driversubmission). - -This rule is supported on all versions of Windows where attack surface reduction rules are currently supported: -- Windows 10 Pro, version 1709 or later -- Windows 10 Enterprise, version 1709 or later -- Windows Server, version 1803 (Semi-Annual Channel) or later -- Windows Server 2019 - -Intune Name: `Block abuse of exploited vulnerable signed drivers` - -Configuration Manager name: Not Applicable - -Rule guid: `56a863a9-875e-4185-98a7-b882c64b5ce5` - ### Block Adobe Reader from creating child processes This rule prevents attacks by blocking Adobe Reader from creating additional processes. From 423558a767557cf82ff659b6de501ab668f43e83 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 14:49:49 -0800 Subject: [PATCH 117/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index fc88435234..3456c7128e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -14,7 +14,7 @@ ms.author: deniseb ms.reviewer: sugamar, jcedola manager: dansimp ms.custom: asr -ms.date: 12/09/2020 +ms.date: 12/10/2020 --- # Use attack surface reduction rules to prevent malware infection From 792cee0b921da14f53d254ec41f7b0ddd50e4001 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 15:05:43 -0800 Subject: [PATCH 118/169] Update controlled-folders.md --- .../microsoft-defender-atp/controlled-folders.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md index 272d1480ec..ae6fe0d261 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium author: denisebmsft ms.author: deniseb audience: ITPro -ms.date: 11/05/2020 +ms.date: 12/10/2020 ms.reviewer: v-maave manager: dansimp ms.custom: asr @@ -44,6 +44,19 @@ Controlled folder access is especially useful in helping to protect your documen The protected folders include common system folders (including boot sectors), and you can [add additional folders](customize-controlled-folders.md#protect-additional-folders). You can also [allow apps](customize-controlled-folders.md#allow-specific-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders. +By default, the following Windows system folders are protected: +- `c:\Users\\Documents` +- `c:\Users\Public\Documents` +- `c:\Users\\Pictures` +- `c:\Users\Public\Pictures` +- `c:\Users\Public\Videos` +- `c:\Users\\Music` +- `c:\Users\Public\Music` +- `c:\Users\\Favorites` + +> [!NOTE] +> You cannot remove the Windows system folders that are protected by default. + You can use [audit mode](audit-windows-defender.md) to evaluate how controlled folder access would impact your organization if it were enabled. You can also visit the Windows Defender Test ground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. Controlled folder access is supported on Windows 10, version 1709 and later and Windows Server 2019. From e5ce0046d22ffd7543e4c6d582387ef1f820d3cc Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 15:27:07 -0800 Subject: [PATCH 119/169] Update controlled-folders.md --- .../controlled-folders.md | 69 +++++++------------ 1 file changed, 24 insertions(+), 45 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md index ae6fe0d261..b6163d243c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md @@ -40,11 +40,20 @@ Controlled folder access works with a list of trusted software. If an app is inc Apps can also be manually added to the trusted list via Configuration Manager and Intune. Additional actions, such as [adding a file indicator](../microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) for the app, can be performed from the Security Center Console. +## Why controlled folder access is important + Controlled folder access is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/wdsi/threats/ransomware). In a ransomware attack, your files can get encrypted and held hostage. With controlled folder access in place, a notification appears on the computer where an app attempted to make changes to a file in a protected folder. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors. -The protected folders include common system folders (including boot sectors), and you can [add additional folders](customize-controlled-folders.md#protect-additional-folders). You can also [allow apps](customize-controlled-folders.md#allow-specific-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders. +The [protected folders](#review-controlled-folder-access-events-in-windows-event-viewer) include common system folders (including boot sectors), and you can [add additional folders](customize-controlled-folders.md#protect-additional-folders). You can also [allow apps](customize-controlled-folders.md#allow-specific-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders. + +You can use [audit mode](audit-windows-defender.md) to evaluate how controlled folder access would impact your organization if it were enabled. You can also visit the Windows Defender Test ground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. + +Controlled folder access is supported on Windows 10, version 1709 and later and Windows Server 2019. + +## Windows system folders are protected by default + +Your Windows system folders are protected by default, along with several other folders. These folders include: -By default, the following Windows system folders are protected: - `c:\Users\\Documents` - `c:\Users\Public\Documents` - `c:\Users\\Pictures` @@ -55,13 +64,9 @@ By default, the following Windows system folders are protected: - `c:\Users\\Favorites` > [!NOTE] -> You cannot remove the Windows system folders that are protected by default. +> You can configure additional folders as protected, but you cannot remove the Windows system folders that are protected by default. -You can use [audit mode](audit-windows-defender.md) to evaluate how controlled folder access would impact your organization if it were enabled. You can also visit the Windows Defender Test ground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. - -Controlled folder access is supported on Windows 10, version 1709 and later and Windows Server 2019. - -## Requirements +## Requirements for controlled folder access Controlled folder access requires enabling [Microsoft Defender Antivirus real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md). @@ -90,19 +95,21 @@ You can review the Windows event log to see events that are created when control 4. Navigate to where you extracted *cfa-events.xml* and select it. Alternatively, [copy the XML directly](event-views.md). -5. Click **OK**. +5. Select **OK**. After following the procedure, you have created a custom view that shows events related to controlled folder access, as listed in the following table: |Event ID | Description | -|---|---| +|:---|:---| |5007 | Event when settings are changed | |1124 | Audited controlled folder access event | |1123 | Blocked controlled folder access event | ## View or change the list of protected folders -### Windows 10 security app +You can use the Windows Security app to view the list of folders that are protected by controlled folder access. + +### View or change the list of protected folders using the Windows Security app 1. On your Windows 10 device, open the Windows Security app. @@ -118,39 +125,11 @@ After following the procedure, you have created a custom view that shows events - To remove a folder, select it, and then select **Remove**. +> [!NOTE] +> [Windows system folders](#windows-system-folders-are-protected-by-default) are protected by default, and you cannot remove them from the list. + ## See also -- [Evaluate controlled folder access](evaluate-controlled-folder-access.md). Use a dedicated demo tool to see how controlled folder access works, and what events would typically be created. - - -## Default folders protected by controlled folder access -Windows system folders are protected by default. In addition, there are several folders that are protected by controlled folder access by default. You can configure additional folders as protected, but cannot remove the default folders from the controlled folder access protection. See [Protect additional folders](customize-controlled-folders.md#protect-additional-folders) for more information. - -Here's the list of default protected folders: -- %USERPROFILE%\Documents -- %USERPROFILE%\Favorites -- %USERPROFILE%\Music -- %USERPROFILE%\Pictures -- %USERPROFILE%\Videos -- %PUBLIC%\Documents -- %PUBLIC%\Music -- %PUBLIC%\Pictures -- %PUBLIC%\Videos - -You can use the Windows Security app to view the list of default folders protected by controlled folder access: - -1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**. - -2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then scroll down to the **Ransomware protection** section. - -3. Click the **Manage ransomware protection** link to open the **Ransomware protection** pane. - -4. Under the **Controlled folder access** section, click the **Protected folders** link. - -5. Click **Yes** on the **User Access Control** prompt. - - The **Protected folders** pane displays the folders that are protected by default. - -## In this section - - [Customize controlled folder access](customize-controlled-folders.md). Add additional protected folders, and allow specified apps to access protected folders. +- [Evaluate controlled folder access](evaluate-controlled-folder-access.md) +- [Customize controlled folder access](customize-controlled-folders.md) +- [Protect additional folders](customize-controlled-folders.md#protect-additional-folders) From 3ca7c1e48fea27de53a415d1eeea584992d1b7a3 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 15:31:10 -0800 Subject: [PATCH 120/169] Update controlled-folders.md --- .../microsoft-defender-atp/controlled-folders.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md index b6163d243c..e034c4b032 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md @@ -74,7 +74,7 @@ Controlled folder access requires enabling [Microsoft Defender Antivirus real-ti Defender for Endpoint provides detailed reporting into events and blocks as part of its [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). -You can query Microsoft Defender for Endpoint data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use advanced hunting to see how controlled folder access settings would affect your environment if they were enabled. +You can query Microsoft Defender for Endpoint data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use [advanced hunting](advanced-hunting-overview.md) to see how controlled folder access settings would affect your environment if they were enabled. Example query: From 5372f7c669a3b4de919b62e387111d50b8242ff1 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 15:46:11 -0800 Subject: [PATCH 121/169] Update controlled-folders.md --- .../microsoft-defender-atp/controlled-folders.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md index e034c4b032..7919059f93 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md @@ -36,9 +36,11 @@ Controlled folder access works best with [Microsoft Defender for Endpoint](../mi Controlled folder access works by only allowing trusted apps to access protected folders. Protected folders are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, and so on, are included in the list of controlled folders. -Controlled folder access works with a list of trusted software. If an app is included in the list of trusted software, the app works as expected. If not, the app is blocked from making any changes to files that are inside protected folders. Apps are added to the trusted list based upon their prevalence and reputation. Apps that are highly prevalent throughout your organization, and that have never displayed any malicious behavior, are deemed trustworthy and automatically added to the list. +Controlled folder access works with a list of trusted apps. If an app is included in the list of trusted software, it works as expected. If not, the app is prevented from making any changes to files that are inside protected folders. -Apps can also be manually added to the trusted list via Configuration Manager and Intune. Additional actions, such as [adding a file indicator](../microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) for the app, can be performed from the Security Center Console. +Apps are added to the list based upon their prevalence and reputation. Apps that are highly prevalent throughout your organization and that have never displayed any behavior deemed malicious are considered trustworthy. Those apps are added to the list automatically. + +Apps can also be added manually to the trusted list by using Configuration Manager or Intune. Additional actions, such as [adding a file indicator](../microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) for an app, can be performed from the Security Center Console. ## Why controlled folder access is important @@ -48,7 +50,9 @@ The [protected folders](#review-controlled-folder-access-events-in-windows-event You can use [audit mode](audit-windows-defender.md) to evaluate how controlled folder access would impact your organization if it were enabled. You can also visit the Windows Defender Test ground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. -Controlled folder access is supported on Windows 10, version 1709 and later and Windows Server 2019. +Controlled folder access is supported on the following versions of Windows: +- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) and later +- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19) ## Windows system folders are protected by default From ec1510a6960ac6c68a40bd44553e72b61bb50a69 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 15:47:04 -0800 Subject: [PATCH 122/169] Update controlled-folders.md --- .../microsoft-defender-atp/controlled-folders.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md index 7919059f93..27801e48ad 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md @@ -56,7 +56,7 @@ Controlled folder access is supported on the following versions of Windows: ## Windows system folders are protected by default -Your Windows system folders are protected by default, along with several other folders. These folders include: +Windows system folders are protected by default, along with several other folders: - `c:\Users\\Documents` - `c:\Users\Public\Documents` @@ -113,8 +113,6 @@ After following the procedure, you have created a custom view that shows events You can use the Windows Security app to view the list of folders that are protected by controlled folder access. -### View or change the list of protected folders using the Windows Security app - 1. On your Windows 10 device, open the Windows Security app. 2. Select **Virus & threat protection**. From 4d545467ba94a4463f74498184a84d778a7a184f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 15:50:20 -0800 Subject: [PATCH 123/169] Update controlled-folders.md --- .../microsoft-defender-atp/controlled-folders.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md index 27801e48ad..80ec62a312 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md +++ b/windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md @@ -28,7 +28,7 @@ ms.custom: asr ## What is controlled folder access? -Controlled folder access helps you protect your valuable data from malicious apps and threats, like ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Supported on Windows Server 2019 and Windows 10 clients, controlled folder access can be turned on using the Windows Security App or in Microsoft Endpoint Configuration Manager and Intune (for managed devices). +Controlled folder access helps protect your valuable data from malicious apps and threats, such as ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Supported on Windows Server 2019 and Windows 10 clients, controlled folder access can be turned on using the Windows Security App, Microsoft Endpoint Configuration Manager, or Intune (for managed devices). Controlled folder access works best with [Microsoft Defender for Endpoint](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), which gives you detailed reporting into controlled folder access events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). @@ -101,7 +101,7 @@ You can review the Windows event log to see events that are created when control 5. Select **OK**. -After following the procedure, you have created a custom view that shows events related to controlled folder access, as listed in the following table: +The following table shows events related to controlled folder access: |Event ID | Description | |:---|:---| From 3b7c523096c9671083fd656ddcfc6da580cdb9ed Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 16:02:47 -0800 Subject: [PATCH 124/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index 3456c7128e..a512161c89 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -80,9 +80,13 @@ Warn mode is not supported for the following attack surface reduction rules: In addition, warn mode is not supported on devices running older versions of Windows. In those cases, attack surface reduction rules that are configured to run in warn mode will run in block mode. -## Notifications when a rule is triggered +## Notifications and alerts -Whenever a rule is triggered, a notification will be displayed on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. The notification also displays within the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and the Microsoft 365 security center ([https://security.microsoft.com](https://security.microsoft.com)). +Whenever an attack surface reduction rule is triggered, a notification will be displayed on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. + +In addition, when certain attack surface reduction rules are triggered, alerts are generated. + +Notifications and any alerts that are generated can be viewed in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and in the Microsoft 365 security center ([https://security.microsoft.com](https://security.microsoft.com)). ## Attack surface reduction features across Windows versions From e005e8860f8dbefc1b992e0861b6ccd5ddb9ea78 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 16:09:10 -0800 Subject: [PATCH 125/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index a512161c89..b1e863e72f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -82,7 +82,7 @@ In addition, warn mode is not supported on devices running older versions of Win ## Notifications and alerts -Whenever an attack surface reduction rule is triggered, a notification will be displayed on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. +Whenever an attack surface reduction rule is triggered, a notification is displayed on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. In addition, when certain attack surface reduction rules are triggered, alerts are generated. From 3ddc1b52199709a15a64aa29c69dad5fd96138e7 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 10 Dec 2020 16:25:01 -0800 Subject: [PATCH 126/169] Update attack-surface-reduction.md --- .../microsoft-defender-atp/attack-surface-reduction.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md index b1e863e72f..a0586d3024 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md +++ b/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md @@ -88,6 +88,14 @@ In addition, when certain attack surface reduction rules are triggered, alerts a Notifications and any alerts that are generated can be viewed in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and in the Microsoft 365 security center ([https://security.microsoft.com](https://security.microsoft.com)). +## Advanced hunting and attack surface reduction events + +You can use advanced hunting to view attack surface reduction events. To streamline the volume of incoming data, only unique processes for each hour are viewable with advanced hunting. The time of an attack surface reduction event is the first time that event is seen within the hour. + +For example, suppose that an attack surface reduction event occurs on ten devices during the 2:00 PM hour. Suppose that the first event occurred at 2:15, and the last at 2:45. With advanced hunting, you'll see one instance of that event (even though it actually occurred on ten devices), and its timestamp will be 2:15 PM. + +For more information about advanced hunting, see [Proactively hunt for threats with advanced hunting](advanced-hunting-overview.md). + ## Attack surface reduction features across Windows versions You can set attack surface reduction rules for devices running any of the following editions and versions of Windows: From e677c22cc87807790efe918f9bb0ad6d59748f39 Mon Sep 17 00:00:00 2001 From: Ikko Ashimine Date: Fri, 11 Dec 2020 22:55:55 +0900 Subject: [PATCH 127/169] Fix typo Micosoft -> Microsoft --- windows/client-management/mdm/get-product-package.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/get-product-package.md b/windows/client-management/mdm/get-product-package.md index 7f75857534..662580acde 100644 --- a/windows/client-management/mdm/get-product-package.md +++ b/windows/client-management/mdm/get-product-package.md @@ -1,6 +1,6 @@ --- title: Get product package -description: The Get product package operation retrieves the information about a specific application in the Micosoft Store for Business. +description: The Get product package operation retrieves the information about a specific application in the Microsoft Store for Business. ms.assetid: 4314C65E-6DDC-405C-A591-D66F799A341F ms.reviewer: manager: dansimp @@ -14,7 +14,7 @@ ms.date: 09/18/2017 # Get product package -The **Get product package** operation retrieves the information about a specific application in the Micosoft Store for Business. +The **Get product package** operation retrieves the information about a specific application in the Microsoft Store for Business. ## Request From 135f0882817e1737c676eca4d43864311033eb09 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 11 Dec 2020 10:06:51 -0800 Subject: [PATCH 128/169] ltsc name fix --- windows/whats-new/ltsc/TOC.md | 6 +-- windows/whats-new/ltsc/index.md | 12 ++--- .../ltsc/whats-new-windows-10-2015.md | 14 +++--- .../ltsc/whats-new-windows-10-2016.md | 16 +++---- .../ltsc/whats-new-windows-10-2019.md | 48 +++++++++---------- 5 files changed, 48 insertions(+), 48 deletions(-) diff --git a/windows/whats-new/ltsc/TOC.md b/windows/whats-new/ltsc/TOC.md index e49aee21fc..a16525cda0 100644 --- a/windows/whats-new/ltsc/TOC.md +++ b/windows/whats-new/ltsc/TOC.md @@ -1,4 +1,4 @@ # [Windows 10 Enterprise LTSC](index.md) -## [What's new in Windows 10 Enterprise 2019 LTSC](whats-new-windows-10-2019.md) -## [What's new in Windows 10 Enterprise 2016 LTSC](whats-new-windows-10-2016.md) -## [What's new in Windows 10 Enterprise 2015 LTSC](whats-new-windows-10-2015.md) +## [What's new in Windows 10 Enterprise LTSC 2019](whats-new-windows-10-2019.md) +## [What's new in Windows 10 Enterprise LTSC 2016](whats-new-windows-10-2016.md) +## [What's new in Windows 10 Enterprise LTSC 2015](whats-new-windows-10-2015.md) diff --git a/windows/whats-new/ltsc/index.md b/windows/whats-new/ltsc/index.md index b1464088fc..09f32c39f4 100644 --- a/windows/whats-new/ltsc/index.md +++ b/windows/whats-new/ltsc/index.md @@ -22,9 +22,9 @@ ms.topic: article This topic provides links to articles with information about what's new in each release of Windows 10 Enterprise LTSC, and includes a short description of this servicing channel. -[What's New in Windows 10 Enterprise 2019 LTSC](whats-new-windows-10-2019.md)
-[What's New in Windows 10 Enterprise 2016 LTSC](whats-new-windows-10-2016.md)
-[What's New in Windows 10 Enterprise 2015 LTSC](whats-new-windows-10-2015.md) +[What's New in Windows 10 Enterprise LTSC 2019](whats-new-windows-10-2019.md)
+[What's New in Windows 10 Enterprise LTSC 2016](whats-new-windows-10-2016.md)
+[What's New in Windows 10 Enterprise LTSC 2015](whats-new-windows-10-2015.md) ## The Long Term Servicing Channel (LTSC) @@ -32,9 +32,9 @@ The following table summarizes equivalent feature update versions of Windows 10 | LTSC release | Equivalent SAC release | Availability date | | --- | --- | --- | -| Windows 10 Enterprise 2015 LTSC | Windows 10, Version 1507 | 7/29/2015 | -| Windows 10 Enterprise 2016 LTSC | Windows 10, Version 1607 | 8/2/2016 | -| Windows 10 Enterprise 2019 LTSC | Windows 10, Version 1809 | 11/13/2018 | +| Windows 10 Enterprise LTSC 2015 | Windows 10, Version 1507 | 7/29/2015 | +| Windows 10 Enterprise LTSC 2016 | Windows 10, Version 1607 | 8/2/2016 | +| Windows 10 Enterprise LTSC 2019 | Windows 10, Version 1809 | 11/13/2018 | >[!NOTE] >The Long Term Servicing Channel was previously called the Long Term Servicing Branch (LTSB). All references to LTSB are changed in this article to LTSC for consistency, even though the name of previous versions might still be displayed as LTSB. diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2015.md b/windows/whats-new/ltsc/whats-new-windows-10-2015.md index aace786788..0fb947167f 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2015.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2015.md @@ -1,10 +1,10 @@ --- -title: What's new in Windows 10 Enterprise 2015 LTSC +title: What's new in Windows 10 Enterprise LTSC 2015 ms.reviewer: manager: laurawi ms.author: greglin -description: New and updated IT Pro content about new features in Windows 10 Enterprise 2015 LTSC (also known as Windows 10 Enterprise 2015 LTSB). -keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 Enterprise 2015 LTSC"] +description: New and updated IT Pro content about new features in Windows 10 Enterprise LTSC 2015 (also known as Windows 10 Enterprise 2015 LTSB). +keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 Enterprise LTSC 2015"] ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -14,15 +14,15 @@ ms.localizationpriority: low ms.topic: article --- -# What's new in Windows 10 Enterprise 2015 LTSC +# What's new in Windows 10 Enterprise LTSC 2015 **Applies to** -- Windows 10 Enterprise 2015 LTSC +- Windows 10 Enterprise LTSC 2015 -This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise 2015 LTSC (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md). +This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md). >[!NOTE] ->Features in Windows 10 Enterprise 2015 LTSC are equivalent to [Windows 10, version 1507](../whats-new-windows-10-version-1507-and-1511.md). +>Features in Windows 10 Enterprise LTSC 2015 are equivalent to [Windows 10, version 1507](../whats-new-windows-10-version-1507-and-1511.md). ## Deployment diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2016.md b/windows/whats-new/ltsc/whats-new-windows-10-2016.md index 63e15a057b..3b3891912c 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2016.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2016.md @@ -1,10 +1,10 @@ --- -title: What's new in Windows 10 Enterprise 2016 LTSC +title: What's new in Windows 10 Enterprise LTSC 2016 ms.reviewer: manager: laurawi ms.author: greglin -description: New and updated IT Pro content about new features in Windows 10 Enterprise 2016 LTSC (also known as Windows 10 Enterprise 2016 LTSB). -keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 Enterprise 2016 LTSC"] +description: New and updated IT Pro content about new features in Windows 10 Enterprise LTSC 2016 (also known as Windows 10 Enterprise 2016 LTSB). +keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 Enterprise LTSC 2016"] ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -14,15 +14,15 @@ ms.localizationpriority: low ms.topic: article --- -# What's new in Windows 10 Enterprise 2016 LTSC +# What's new in Windows 10 Enterprise LTSC 2016 **Applies to** -- Windows 10 Enterprise 2016 LTSC +- Windows 10 Enterprise LTSC 2016 -This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise 2016 LTSC (LTSB), compared to Windows 10 Enterprise 2015 LTSC (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md). +This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2016 (LTSB), compared to Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel, see [Windows 10 Enterprise LTSC](index.md). >[!NOTE] ->Features in Windows 10 Enterprise 2016 LTSC are equivalent to Windows 10, version 1607. +>Features in Windows 10 Enterprise LTSC 2016 are equivalent to Windows 10, version 1607. ## Deployment @@ -71,7 +71,7 @@ Isolated User Mode is now included with Hyper-V so you don't have to install it When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multi-factor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name in this version of Windows 10. Customers who have already deployed Microsoft Passport for Work will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. -Additional changes for Windows Hello in Windows 10 Enterprise 2016 LTSC: +Additional changes for Windows Hello in Windows 10 Enterprise LTSC 2016: - Personal (Microsoft account) and corporate (Active Directory or Azure AD) accounts use a single container for keys. - Group Policy settings for managing Windows Hello for Business are now available for both **User Configuration** and **Computer Configuration**. diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index cee461354f..d04340e9a9 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -1,10 +1,10 @@ --- -title: What's new in Windows 10 Enterprise 2019 LTSC +title: What's new in Windows 10 Enterprise LTSC 2019 ms.reviewer: manager: laurawi ms.author: greglin -description: New and updated IT Pro content about new features in Windows 10 Enterprise 2019 LTSC (also known as Windows 10 Enterprise 2019 LTSB). -keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 Enterprise 2019 LTSC"] +description: New and updated IT Pro content about new features in Windows 10 Enterprise LTSC 2019 (also known as Windows 10 Enterprise 2019 LTSB). +keywords: ["What's new in Windows 10", "Windows 10", "Windows 10 Enterprise LTSC 2019"] ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library @@ -13,15 +13,15 @@ ms.localizationpriority: low ms.topic: article --- -# What's new in Windows 10 Enterprise 2019 LTSC +# What's new in Windows 10 Enterprise LTSC 2019 **Applies to** -- Windows 10 Enterprise 2019 LTSC +- Windows 10 Enterprise LTSC 2019 -This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise 2019 LTSC, compared to Windows 10 Enterprise 2016 LTSC (LTSB). For a brief description of the LTSC servicing channel and associated support, see [Windows 10 Enterprise LTSC](index.md). +This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2019, compared to Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel and associated support, see [Windows 10 Enterprise LTSC](index.md). >[!NOTE] ->Features in Windows 10 Enterprise 2019 LTSC are equivalent to Windows 10, version 1809. +>Features in Windows 10 Enterprise LTSC 2019 are equivalent to Windows 10, version 1809. Windows 10 Enterprise LTSC 2019 builds on Windows 10 Pro, version 1809 adding premium features designed to address the needs of large and mid-size organizations (including large academic institutions), such as: - Advanced protection against modern security threats @@ -85,7 +85,7 @@ Endpoint detection and response is improved. Enterprise customers can now take a Some of the highlights of the new library include [Evaluation guide for Microsoft Defender AV](/windows/threat-protection/microsoft-defender-antivirus//evaluate-microsoft-defender-antivirus) and [Deployment guide for Microsoft Defender AV in a virtual desktop infrastructure environment](/windows/threat-protection/microsoft-defender-antivirus/deployment-vdi-microsoft-defender-antivirus). - New features for Microsoft Defender AV in Windows 10 Enterprise 2019 LTSC include: + New features for Microsoft Defender AV in Windows 10 Enterprise LTSC 2019 include: - [Updates to how the Block at First Sight feature can be configured](/windows/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus) - [The ability to specify the level of cloud-protection](/windows/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus) - [Microsoft Defender Antivirus protection in the Windows Defender Security Center app](/windows/threat-protection/microsoft-defender-antivirus/windows-defender-security-center-antivirus) @@ -239,7 +239,7 @@ WSC now includes the Fluent Design System elements you know and love. You’ll a The security setting [**Interactive logon: Display user information when the session is locked**](/windows/device-security/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked) has been updated to work in conjunction with the **Privacy** setting in **Settings** > **Accounts** > **Sign-in options**. A new security policy setting -[**Interactive logon: Don't display username at sign-in**](/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in) has been introduced in Windows 10 Enterprise 2019 LTSC. This security policy setting determines whether the username is displayed during sign in. It works in conjunction with the **Privacy** setting in **Settings** > **Accounts** > **Sign-in options**. The setting only affects the **Other user** tile. +[**Interactive logon: Don't display username at sign-in**](/windows/device-security/security-policy-settings/interactive-logon-dont-display-username-at-sign-in) has been introduced in Windows 10 Enterprise LTSC 2019. This security policy setting determines whether the username is displayed during sign in. It works in conjunction with the **Privacy** setting in **Settings** > **Accounts** > **Sign-in options**. The setting only affects the **Other user** tile. #### Windows 10 in S mode @@ -251,7 +251,7 @@ We’ve continued to work on the **Current threats** area in [Virus & threat pr ### Windows Autopilot -[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) is a deployment tool introduced with Windows 10, version 1709 and is also available for Windows 10 Enterprise 2019 LTSC (and later versions). Windows Autopilot provides a modern device lifecycle management service powered by the cloud to deliver a zero touch experience for deploying Windows 10. +[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) is a deployment tool introduced with Windows 10, version 1709 and is also available for Windows 10 Enterprise LTSC 2019 (and later versions). Windows Autopilot provides a modern device lifecycle management service powered by the cloud to deliver a zero touch experience for deploying Windows 10. Windows Autopilot is currently available with Surface, Dell, HP, and Lenovo. Other OEM partners such as Panasonic, and Acer will support Autopilot soon. Check the [Windows IT Pro Blog](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog) or this article for updated information. @@ -265,7 +265,7 @@ IT Pros can use Autopilot Reset to quickly remove personal files, apps, and sett ### MBR2GPT.EXE -MBR2GPT.EXE is a new command-line tool introduced with Windows 10, version 1703 and also available in Windows 10 Enterprise 2019 LTSC (and later versions). MBR2GPT converts a disk from Master Boot Record (MBR) to GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool is designed to be run from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS). +MBR2GPT.EXE is a new command-line tool introduced with Windows 10, version 1703 and also available in Windows 10 Enterprise LTSC 2019 (and later versions). MBR2GPT converts a disk from Master Boot Record (MBR) to GUID Partition Table (GPT) partition style without modifying or deleting data on the disk. The tool is designed to be run from a Windows Preinstallation Environment (Windows PE) command prompt, but can also be run from the full Windows 10 operating system (OS). The GPT partition format is newer and enables the use of larger and more disk partitions. It also provides added data reliability, supports additional partition types, and enables faster boot and shutdown speeds. If you convert the system disk on a computer from MBR to GPT, you must also configure the computer to boot in UEFI mode, so make sure that your device supports UEFI before attempting to convert the system disk. @@ -293,7 +293,7 @@ For more information, see [DISM operating system uninstall command-line options] You can now run your own custom actions or scripts in parallel with Windows Setup. Setup will also migrate your scripts to next feature release, so you only need to add them once. Prerequisites: -- Windows 10, version 1803 or Windows 10 Enterprise 2019 LTSC, or later. +- Windows 10, version 1803 or Windows 10 Enterprise LTSC 2019, or later. - Windows 10 Enterprise or Pro For more information, see [Run custom actions during feature update](https://docs.microsoft.com/windows-hardware/manufacture/desktop/windows-setup-enable-custom-actions). @@ -332,7 +332,7 @@ SetupDiag works by searching Windows Setup log files. When searching log files, If you have shared devices deployed in your work place, **Fast sign-in** enables users to sign in to a [shared Windows 10 PC](https://docs.microsoft.com/windows/configuration/set-up-shared-or-guest-pc) in a flash! **To enable fast sign-in:** -1. Set up a shared or guest device with Windows 10, version 1809 or Windows 10 Enterprise 2019 LTSC. +1. Set up a shared or guest device with Windows 10, version 1809 or Windows 10 Enterprise LTSC 2019. 2. Set the Policy CSP, and the **Authentication** and **EnableFastFirstSignIn** policies to enable fast sign-in. 3. Sign-in to a shared PC with your account. You'll notice the difference! @@ -428,7 +428,7 @@ The following new Group Policy and mobile device management (MDM) settings are a ### Start and taskbar layout -Previously, the customized taskbar could only be deployed using Group Policy or provisioning packages. Windows 10 Enterprise 2019 LTSC adds support for customized taskbars to [MDM](/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management). +Previously, the customized taskbar could only be deployed using Group Policy or provisioning packages. Windows 10 Enterprise LTSC 2019 adds support for customized taskbars to [MDM](/windows/configuration/customize-windows-10-start-screens-by-using-mobile-device-management). [Additional MDM policy settings are available for Start and taskbar layout](/windows/configuration/windows-10-start-layout-options-and-policies). New MDM policy settings include: @@ -467,7 +467,7 @@ You can now register your Azure AD domains to the Windows Insider Program. For m ### Optimize update delivery -With changes delivered in Windows 10 Enterprise 2019 LTSC, [Express updates](/windows/deployment/update/waas-optimize-windows-10-updates#express-update-delivery) are now fully supported with Microsoft Endpoint Configuration Manager, starting with version 1702 of Configuration Manager, as well as with other third-party updating and management products that [implement this new functionality](https://technet.microsoft.com/windows-server-docs/management/windows-server-update-services/deploy/express-update-delivery-isv-support). This is in addition to current Express support on Windows Update, Windows Update for Business and WSUS. +With changes delivered in Windows 10 Enterprise LTSC 2019, [Express updates](/windows/deployment/update/waas-optimize-windows-10-updates#express-update-delivery) are now fully supported with Microsoft Endpoint Configuration Manager, starting with version 1702 of Configuration Manager, as well as with other third-party updating and management products that [implement this new functionality](https://technet.microsoft.com/windows-server-docs/management/windows-server-update-services/deploy/express-update-delivery-isv-support). This is in addition to current Express support on Windows Update, Windows Update for Business and WSUS. >[!NOTE] > The above changes can be made available to Windows 10, version 1607, by installing the April 2017 cumulative update. @@ -485,15 +485,15 @@ To check out all the details, see [Configure Delivery Optimization for Windows 1 ### Uninstalled in-box apps no longer automatically reinstall -Starting with Windows 10 Enterprise 2019 LTSC, in-box apps that were uninstalled by the user won't automatically reinstall as part of the feature update installation process. +Starting with Windows 10 Enterprise LTSC 2019, in-box apps that were uninstalled by the user won't automatically reinstall as part of the feature update installation process. -Additionally, apps de-provisioned by admins on Windows 10 Enterprise 2019 LTSC machines will stay de-provisioned after future feature update installations. This will not apply to the update from Windows 10 Enterprise 2016 LTSC (or earlier) to Windows 10 Enterprise 2019 LTSC. +Additionally, apps de-provisioned by admins on Windows 10 Enterprise LTSC 2019 machines will stay de-provisioned after future feature update installations. This will not apply to the update from Windows 10 Enterprise LTSC 2015 (or earlier) to Windows 10 Enterprise LTSC 2019. ## Management ### New MDM capabilities -Windows 10 Enterprise 2019 LTSC adds many new [configuration service providers (CSPs)](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) that provide new capabilities for managing Windows 10 devices using MDM or provisioning packages. Among other things, these CSPs enable you to configure a few hundred of the most useful Group Policy settings via MDM - see [Policy CSP - ADMX-backed policies](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-admx-backed). +Windows 10 Enterprise LTSC 2019 adds many new [configuration service providers (CSPs)](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) that provide new capabilities for managing Windows 10 devices using MDM or provisioning packages. Among other things, these CSPs enable you to configure a few hundred of the most useful Group Policy settings via MDM - see [Policy CSP - ADMX-backed policies](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/policy-admx-backed). Some of the other new CSPs are: @@ -519,17 +519,17 @@ Multiple new configuration items are also added. For more information, see [What ### Mobile application management support for Windows 10 -The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. MAM support is built into Windows on top of Windows Information Protection (WIP), starting in Windows 10 Enterprise 2019 LTSC. +The Windows version of mobile application management (MAM) is a lightweight solution for managing company data access and security on personal devices. MAM support is built into Windows on top of Windows Information Protection (WIP), starting in Windows 10 Enterprise LTSC 2019. For more info, see [Implement server-side support for mobile application management on Windows](https://msdn.microsoft.com/windows/hardware/commercialize/customize/mdm/implement-server-side-mobile-application-management). ### MDM diagnostics -In Windows 10 Enterprise 2019 LTSC, we continue our work to improve the diagnostic experience for modern management. By introducing auto-logging for mobile devices, Windows will automatically collect logs when encountering an error in MDM, eliminating the need to have always-on logging for memory-constrained devices. Additionally, we are introducing [Microsoft Message Analyzer](https://www.microsoft.com/download/details.aspx?id=44226) as an additional tool to help Support personnel quickly reduce issues to their root cause, while saving time and cost. +In Windows 10 Enterprise LTSC 2019, we continue our work to improve the diagnostic experience for modern management. By introducing auto-logging for mobile devices, Windows will automatically collect logs when encountering an error in MDM, eliminating the need to have always-on logging for memory-constrained devices. Additionally, we are introducing [Microsoft Message Analyzer](https://www.microsoft.com/download/details.aspx?id=44226) as an additional tool to help Support personnel quickly reduce issues to their root cause, while saving time and cost. ### Application Virtualization for Windows (App-V) -Previous versions of the Microsoft Application Virtualization Sequencer (App-V Sequencer) have required you to manually create your sequencing environment. Windows 10 Enterprise 2019 LTSC introduces two new PowerShell cmdlets, New-AppVSequencerVM and Connect-AppvSequencerVM, which automatically create your sequencing environment for you, including provisioning your virtual machine. Additionally, the App-V Sequencer has been updated to let you sequence or update multiple apps at the same time, while automatically capturing and storing your customizations as an App-V project template (.appvt) file, and letting you use PowerShell or Group Policy settings to automatically cleanup your unpublished packages after a device restart. +Previous versions of the Microsoft Application Virtualization Sequencer (App-V Sequencer) have required you to manually create your sequencing environment. Windows 10 Enterprise LTSC 2019 introduces two new PowerShell cmdlets, New-AppVSequencerVM and Connect-AppvSequencerVM, which automatically create your sequencing environment for you, including provisioning your virtual machine. Additionally, the App-V Sequencer has been updated to let you sequence or update multiple apps at the same time, while automatically capturing and storing your customizations as an App-V project template (.appvt) file, and letting you use PowerShell or Group Policy settings to automatically cleanup your unpublished packages after a device restart. For more info, see the following topics: - [Automatically provision your sequencing environment using Microsoft Application Virtualization Sequencer (App-V Sequencer)](/windows/application-management/app-v/appv-auto-provision-a-vm) @@ -546,7 +546,7 @@ Learn more about the diagnostic data that's collected at the Basic level and som ### Group Policy spreadsheet -Learn about the new Group Policies that were added in Windows 10 Enterprise 2019 LTSC. +Learn about the new Group Policies that were added in Windows 10 Enterprise LTSC 2019. - [Group Policy Settings Reference for Windows and Windows Server](https://www.microsoft.com/download/details.aspx?id=25250) @@ -579,9 +579,9 @@ Miracast over Infrastructure offers a number of benefits: Enabling Miracast over Infrastructure: -If you have a device that has been updated to Windows 10 Enterprise 2019 LTSC, then you automatically have this new feature. To take advantage of it in your environment, you need to ensure the following is true within your deployment: +If you have a device that has been updated to Windows 10 Enterprise LTSC 2019, then you automatically have this new feature. To take advantage of it in your environment, you need to ensure the following is true within your deployment: -- The device (PC, phone, or Surface Hub) needs to be running Windows 10, version 1703, Windows 10 Enterprise 2019 LTSC, or a later OS. +- The device (PC, phone, or Surface Hub) needs to be running Windows 10, version 1703, Windows 10 Enterprise LTSC 2019, or a later OS. - A Windows PC or Surface Hub can act as a Miracast over Infrastructure *receiver*. A Windows PC or phone can act as a Miracast over Infrastructure *source*. - As a Miracast receiver, the PC or Surface Hub must be connected to your enterprise network via either Ethernet or a secure Wi-Fi connection (e.g. using either WPA2-PSK or WPA2-Enterprise security). If the Hub is connected to an open Wi-Fi connection, Miracast over Infrastructure will disable itself. - As a Miracast source, the PC or phone must be connected to the same enterprise network via Ethernet or a secure Wi-Fi connection. From d8be4c67adca40545b40b280aa796b71ba879b85 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 11 Dec 2020 10:10:58 -0800 Subject: [PATCH 129/169] correction --- windows/whats-new/ltsc/whats-new-windows-10-2019.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index d04340e9a9..abfe43e940 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -18,7 +18,7 @@ ms.topic: article **Applies to** - Windows 10 Enterprise LTSC 2019 -This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2019, compared to Windows 10 Enterprise LTSC 2015 (LTSB). For a brief description of the LTSC servicing channel and associated support, see [Windows 10 Enterprise LTSC](index.md). +This article lists new and updated features and content that are of interest to IT Pros for Windows 10 Enterprise LTSC 2019, compared to Windows 10 Enterprise LTSC 2016 (LTSB). For a brief description of the LTSC servicing channel and associated support, see [Windows 10 Enterprise LTSC](index.md). >[!NOTE] >Features in Windows 10 Enterprise LTSC 2019 are equivalent to Windows 10, version 1809. @@ -487,7 +487,7 @@ To check out all the details, see [Configure Delivery Optimization for Windows 1 Starting with Windows 10 Enterprise LTSC 2019, in-box apps that were uninstalled by the user won't automatically reinstall as part of the feature update installation process. -Additionally, apps de-provisioned by admins on Windows 10 Enterprise LTSC 2019 machines will stay de-provisioned after future feature update installations. This will not apply to the update from Windows 10 Enterprise LTSC 2015 (or earlier) to Windows 10 Enterprise LTSC 2019. +Additionally, apps de-provisioned by admins on Windows 10 Enterprise LTSC 2019 machines will stay de-provisioned after future feature update installations. This will not apply to the update from Windows 10 Enterprise LTSC 2016 (or earlier) to Windows 10 Enterprise LTSC 2019. ## Management From 90051194a0f8d1763be12f77330764e0bae17242 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 11 Dec 2020 14:09:39 -0800 Subject: [PATCH 130/169] Update microsoft-defender-antivirus-compatibility.md --- .../microsoft-defender-antivirus-compatibility.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md index 355486f404..72c13de8f4 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md @@ -13,7 +13,7 @@ ms.author: deniseb ms.custom: nextgen ms.reviewer: manager: dansimp -ms.date: 12/08/2020 +ms.date: 12/11/2020 --- # Microsoft Defender Antivirus compatibility @@ -78,7 +78,7 @@ The following table summarizes the functionality and features that are available - In Active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files are scanned and threats remediated, and detection information are reported in your configuration tool (such as Configuration Manager or the Microsoft Defender Antivirus app on the machine itself). - In Passive mode, Microsoft Defender Antivirus is not used as the antivirus app, and threats are not remediated by Microsoft Defender Antivirus. Files are scanned and reports are provided for threat detections that are shared with the Microsoft Defender for Endpoint service. Therefore, you might encounter alerts in the Security Center console with Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in Passive mode. -- When [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) is turned on, Microsoft Defender Antivirus is not used as the primary antivirus solution, but can still detect and remediate malicious items. +- When [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) is turned on and Microsoft Defender Antivirus is not used as the primary antivirus solution, it can still detect and remediate malicious items. - When disabled, Microsoft Defender Antivirus is not used as the antivirus app. Files are not scanned and threats are not remediated. ## Keep the following points in mind From 063e30cc429762a1d3828a623882e408cd1ff469 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Fri, 11 Dec 2020 14:19:20 -0800 Subject: [PATCH 131/169] Update microsoft-defender-antivirus-compatibility.md --- .../microsoft-defender-antivirus-compatibility.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md index 72c13de8f4..bb9e88a2d6 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md @@ -104,4 +104,4 @@ If you uninstall the other product, and choose to use Microsoft Defender Antivir - [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) - [Configure Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection-configure) - [Configure Endpoint Protection on a standalone client](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection-configure-standalone-client) -- [Learn about Microsoft 365 Endpoint data loss prevention](https://docs.microsoft.com/microsoft-365/compliance/endpoint-dlp-learn-about?view=o365-worldwide) +- [Learn about Microsoft 365 Endpoint data loss prevention](https://docs.microsoft.com/microsoft-365/compliance/endpoint-dlp-learn-about) From b05d1d1cd24d7b3d4772f0a4ce93a11a157c1694 Mon Sep 17 00:00:00 2001 From: Ben Date: Mon, 14 Dec 2020 18:18:12 +0200 Subject: [PATCH 132/169] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index 0372ef6ab9..68186e67eb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -43,7 +43,7 @@ EDR in block mode is also integrated with [threat & vulnerability management](ht ## What happens when something is detected? -When EDR in block mode is turned on, and a malicious artifact is detected, blocking and remediation actions are taken. You'll see detection status as **Blocked** or **Remediated** as completed actions in the [Action center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#check-activity-details-in-action-center). +When EDR in block mode is turned on, and a malicious artifact is detected, blocking and remediation actions are taken. You'll see detection status as **Blocked** or **Prevented** as completed actions in the [Action center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts#check-activity-details-in-action-center). The following image shows an instance of unwanted software that was detected and blocked through EDR in block mode: From fda3bc6f9afe2918232d30af06b75cdbf4acde62 Mon Sep 17 00:00:00 2001 From: Ben Date: Mon, 14 Dec 2020 18:20:13 +0200 Subject: [PATCH 133/169] Update review-alerts.md --- .../threat-protection/microsoft-defender-atp/review-alerts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md index 28ce3b1696..d32c73580f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md @@ -46,7 +46,7 @@ Clicking on an alert's name in Defender for Endpoint will land you on its alert ![An alert page when you first land on it](images/alert-landing-view.png) -Note the detection status for your alert. Blocked, prevented, or remediated means actions were already taken by Defender for Endpoint. +Note the detection status for your alert. Blocked, or prevented means actions were already taken by Defender for Endpoint. Start by reviewing the *automated investigation details* in your alert's [details pane](#take-action-from-the-details-pane), to see which actions were already taken, as well as reading the alert's description for recommended actions. ![A snippet of the details pane with the alert description and automatic investigation sections highlighted](images/alert-air-and-alert-description.png) From 65c0aa67f3ae30afdbd21ca091c5cb97d46dc911 Mon Sep 17 00:00:00 2001 From: Ben Date: Mon, 14 Dec 2020 18:25:16 +0200 Subject: [PATCH 134/169] Update get-started-partner-integration.md --- .../get-started-partner-integration.md | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-started-partner-integration.md b/windows/security/threat-protection/microsoft-defender-atp/get-started-partner-integration.md index 143d90bb1d..f0151a49db 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-started-partner-integration.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-started-partner-integration.md @@ -52,16 +52,12 @@ To have your company listed as a partner in the in-product partner page, you wil 6. Include the User-Agent field in each API call made to Microsoft Defender for Endpoint public set of APIs or Graph Security APIs. This will be used for statistical purposes, troubleshooting, and partner recognition. In addition, this step is a requirement for membership in Microsoft Intelligent Security Association (MISA). Follow these steps: - 1. Identify a name adhering to the following nomenclature that includes your company name and the Microsoft Defender for Endpoint-integrated product with the version of the product that includes this integration. - - ISV Nomenclature: `MdatpPartner-{CompanyName}-{ProductName}/{Version}` - - Security partner Nomenclature: `MdatpPartner-{CompanyName}-{ProductName}/{TenantID}` - - - - Set the User-Agent field in each HTTP request header to the name based on the Following nomenclature. - - - `MsdePartner-{CompanyName}-{ProductName}/{Version}` - - For example, User-Agent: `MdatpPartner-Contoso-ContosoCognito/1.0.0` + - Set the User-Agent field in each HTTP request header to the below format. + + - `MdePartner-{CompanyName}-{ProductName}/{Version}` + + - For example, User-Agent: `MdePartner-Contoso-ContosoCognito/1.0.0` - For more information, see [RFC 2616 section-14.43](https://tools.ietf.org/html/rfc2616#section-14.43). From 6c4c19be6022ac27f32d2a140e05eae27b6ce54d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 14 Dec 2020 08:49:04 -0800 Subject: [PATCH 135/169] Update edr-in-block-mode.md --- .../microsoft-defender-atp/edr-in-block-mode.md | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md index 68186e67eb..f519113f0c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md +++ b/windows/security/threat-protection/microsoft-defender-atp/edr-in-block-mode.md @@ -15,7 +15,7 @@ ms.localizationpriority: medium ms.custom: - next-gen - edr -ms.date: 12/10/2020 +ms.date: 12/14/2020 ms.collection: - m365-security-compliance - m365initiative-defender-endpoint @@ -83,11 +83,11 @@ The following image shows an instance of unwanted software that was detected and ### Do I need to turn EDR in block mode on even when I have Microsoft Defender Antivirus running on devices? -We recommend keeping EDR in block mode on, whether Microsoft Defender Antivirus is running in passive mode or in active mode. EDR in block mode gives you an added layer of defense with Microsoft Defender for Endpoint. It allows Microsoft Defender for Endpoint to take actions based on post-breach behavioral EDR detections. +We recommend keeping EDR in block mode on, whether Microsoft Defender Antivirus is running in passive mode or in active mode. EDR in block mode gives you an added layer of defense with Microsoft Defender for Endpoint. It allows Defender for Endpoint to take actions based on post-breach behavioral EDR detections. ### Will EDR in block mode have any impact on a user's antivirus protection? -No. EDR in block mode does not affect third-party antivirus protection running on users' devices. EDR in block mode kicks in if the primary antivirus solution misses something, or if there is a post-breach detection. EDR in block mode works just like [Microsoft Defender Antivirus in passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility#functionality-and-features-available-in-each-state), with the additional steps of blocking and remediating malicious artifacts or behaviors that are detected. +EDR in block mode does not affect third-party antivirus protection running on users' devices. EDR in block mode works if the primary antivirus solution misses something, or if there is a post-breach detection. EDR in block mode works just like [Microsoft Defender Antivirus in passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility#functionality-and-features-available-in-each-state), with the additional steps of blocking and remediating malicious artifacts or behaviors that are detected. ### Why do I need to keep Microsoft Defender Antivirus up to date? @@ -99,9 +99,7 @@ Cloud protection is needed to turn on the feature on the device. Cloud protectio ## See also -[Tech Community blog: Introducing EDR in block mode: Stopping attacks in their tracks](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/introducing-edr-in-block-mode-stopping-attacks-in-their-tracks/ba-p/1596617) - -[Behavioral blocking and containment](behavioral-blocking-containment.md) - -[Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-antivirus) +- [Tech Community blog: Introducing EDR in block mode: Stopping attacks in their tracks](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/introducing-edr-in-block-mode-stopping-attacks-in-their-tracks/ba-p/1596617) +- [Behavioral blocking and containment](behavioral-blocking-containment.md) +- [Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-antivirus) From 7855a7fa32f450dcd3a25e30421f687b6b3cd9b5 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 14 Dec 2020 11:23:43 -0800 Subject: [PATCH 136/169] Corrected misspelled filename --- windows/client-management/mdm/TOC.md | 2 +- .../mdm/policies-in-policy-csp-admx-backed.md | 16 ++++++++-------- .../mdm/policy-configuration-service-provider.md | 16 ++++++++-------- ....md => policy-csp-admx-deviceinstallation.md} | 0 4 files changed, 17 insertions(+), 17 deletions(-) rename windows/client-management/mdm/{policy-csp-admx-devicenstallation.md => policy-csp-admx-deviceinstallation.md} (100%) diff --git a/windows/client-management/mdm/TOC.md b/windows/client-management/mdm/TOC.md index eb36dff859..d5168b9828 100644 --- a/windows/client-management/mdm/TOC.md +++ b/windows/client-management/mdm/TOC.md @@ -191,7 +191,7 @@ #### [ADMX_CtrlAltDel](policy-csp-admx-ctrlaltdel.md) #### [ADMX_DataCollection](policy-csp-admx-datacollection.md) #### [ADMX_Desktop](policy-csp-admx-desktop.md) -#### [ADMX_DeviceInstallation](policy-csp-admx-devicenstallation.md) +#### [ADMX_DeviceInstallation](policy-csp-admx-deviceinstallation.md) #### [ADMX_DeviceSetup](policy-csp-admx-devicesetup.md) #### [ADMX_DigitalLocker](policy-csp-admx-digitallocker.md) #### [ADMX_DnsClient](policy-csp-admx-dnsclient.md) diff --git a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md index 309fb143c2..8771145e8a 100644 --- a/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md +++ b/windows/client-management/mdm/policies-in-policy-csp-admx-backed.md @@ -150,14 +150,14 @@ ms.date: 10/08/2020 - [ADMX_Desktop/sz_DB_DragDropClose](./policy-csp-admx-desktop.md#admx-desktop-sz-db-dragdropclose) - [ADMX_Desktop/sz_DB_Moving](./policy-csp-admx-desktop.md#admx-desktop-sz-db-moving) - [ADMX_Desktop/sz_DWP_NoHTMLPaper](./policy-csp-admx-desktop.md#admx-desktop-sz-dwp-nohtmlpaper) -- [ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-allowadmininstall) -- [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-detailtext) -- [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-simpletext) -- [ADMX_DeviceInstallation/DeviceInstall_InstallTimeout](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-installtimeout) -- [ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-policy-reboottime) -- [ADMX_DeviceInstallation/DeviceInstall_Removable_Deny](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-removable-deny) -- [ADMX_DeviceInstallation/DeviceInstall_SystemRestore](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-systemrestore) -- [ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser](./policy-csp-admx-devicenstallation.md#admx-deviceinstallation-deviceinstall-classes-allowuser) +- [ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-allowadmininstall) +- [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-detailtext) +- [ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-deniedpolicy-simpletext) +- [ADMX_DeviceInstallation/DeviceInstall_InstallTimeout](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-installtimeout) +- [ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-policy-reboottime) +- [ADMX_DeviceInstallation/DeviceInstall_Removable_Deny](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-removable-deny) +- [ADMX_DeviceInstallation/DeviceInstall_SystemRestore](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-systemrestore) +- [ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser](./policy-csp-admx-deviceinstallation.md#admx-deviceinstallation-deviceinstall-classes-allowuser) - [ADMX_DeviceSetup/DeviceInstall_BalloonTips](./policy-csp-admx-devicesetup.md#admx-devicesetup-deviceinstall-balloontips) - [ADMX_DeviceSetup/DriverSearchPlaces_SearchOrderConfiguration](./policy-csp-admx-devicesetup.md#admx-devicesetup-driversearchplaces-searchorderconfiguration) - [ADMX_DigitalLocker/Digitalx_DiableApplication_TitleText_1](./policy-csp-admx-digitallocker.md#admx-digitallocker-digitalx-diableapplication-titletext-1) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 6483b2b718..2efe519667 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -651,28 +651,28 @@ The following diagram shows the Policy configuration service provider in tree fo
- ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall + ADMX_DeviceInstallation/DeviceInstall_AllowAdminInstall
- ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText + ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_DetailText
- ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText + ADMX_DeviceInstallation/DeviceInstall_DeniedPolicy_SimpleText
- ADMX_DeviceInstallation/DeviceInstall_InstallTimeout + ADMX_DeviceInstallation/DeviceInstall_InstallTimeout
- ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime + ADMX_DeviceInstallation/DeviceInstall_Policy_RebootTime
- ADMX_DeviceInstallation/DeviceInstall_Removable_Deny + ADMX_DeviceInstallation/DeviceInstall_Removable_Deny
- ADMX_DeviceInstallation/DeviceInstall_SystemRestore + ADMX_DeviceInstallation/DeviceInstall_SystemRestore
- ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser + ADMX_DeviceInstallation/DriverInstall_Classes_AllowUser
diff --git a/windows/client-management/mdm/policy-csp-admx-devicenstallation.md b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md similarity index 100% rename from windows/client-management/mdm/policy-csp-admx-devicenstallation.md rename to windows/client-management/mdm/policy-csp-admx-deviceinstallation.md From 383591b44cb0bf0c64e321ba470e79d15fbc5e0c Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 14 Dec 2020 11:28:58 -0800 Subject: [PATCH 137/169] Fixed Acrolinx issues --- windows/client-management/mdm/policy-csp-admx-eaime.md | 4 ++-- .../mdm/policy-csp-admx-microsoftdefenderantivirus.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-eaime.md b/windows/client-management/mdm/policy-csp-admx-eaime.md index 3cd05e398d..433116e5de 100644 --- a/windows/client-management/mdm/policy-csp-admx-eaime.md +++ b/windows/client-management/mdm/policy-csp-admx-eaime.md @@ -419,7 +419,7 @@ ADMX Info: Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off Internet search integration. -Search integration includes both using Search Provider (Japanese Microsoft IME) and performing bing search from predictive input for Japanese Microsoft IME. +Search integration includes both using Search Provider (Japanese Microsoft IME) and performing Bing search from predictive input for Japanese Microsoft IME. If you enable this policy setting, you cannot use search integration. @@ -789,7 +789,7 @@ If you enable this policy setting, the functionality associated with this featur If you disable this policy setting, the functionality associated with this feature is turned off, and the user won't be able to turn it on. -If you don't configure this policy setting, it will be turned on by default, and the user can turn on and turn off the lexicon udpate feature. +If you don't configure this policy setting, it will be turned on by default, and the user can turn on and turn off the lexicon update feature. This Policy setting applies only to Microsoft CHS Pinyin IME. diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index f01f693b6e..69f2c6624a 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -1462,7 +1462,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure definition retirement for network protection against exploits of known vulnerabilities. Definition retirement checks to see if a computer has the required security updates necessary to protect it against a particular vulnerability. If the system is not vulnerable to the exploit detected by a definition, then that definition is "retired". If all security intelligence for a given protocal are retired then that protocol is no longer parsed. Enabling this feature helps to improve performance. On a computer that is up-to-date with all the latest security updates, network protection will have no impact on network performance. +Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure definition retirement for network protection against exploits of known vulnerabilities. Definition retirement checks to see if a computer has the required security updates necessary to protect it against a particular vulnerability. If the system is not vulnerable to the exploit detected by a definition, then that definition is "retired". If all security intelligence for a given protocol are retired then that protocol is no longer parsed. Enabling this feature helps to improve performance. On a computer that is up-to-date with all the latest security updates, network protection will have no impact on network performance. If you enable or do not configure this setting, definition retirement will be enabled. From d7b37a96848ecd758d484564e1dcdd9e912f4c0d Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Mon, 14 Dec 2020 11:36:15 -0800 Subject: [PATCH 138/169] Fixed typo --- .../mdm/policy-csp-admx-microsoftdefenderantivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md index 69f2c6624a..5862dadff7 100644 --- a/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md +++ b/windows/client-management/mdm/policy-csp-admx-microsoftdefenderantivirus.md @@ -6747,7 +6747,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows user to supress reboot notifications in UI only mode (for cases where UI can't be in lockdown mode). +Available in the latest Windows 10 Insider Preview Build. This policy setting allows user to suppress reboot notifications in UI only mode (for cases where UI can't be in lockdown mode). If you enable this setting AM UI won't show reboot notifications. From 133936c6fbadddc60128f1a6768e8c42e0e713b5 Mon Sep 17 00:00:00 2001 From: Shari Kjerland <30906736+SKjerland@users.noreply.github.com> Date: Mon, 14 Dec 2020 12:00:22 -0800 Subject: [PATCH 139/169] Replaced microsoft-edge-faq.md with .yml file As part of the FAQ-content-type pilot, I replaced the .md file with a .yml file that uses Google-defined schema. --- .vscode/settings.json | 5 ++ browsers/edge/TOC.md | 2 +- browsers/edge/microsoft-edge-faq.md | 58 ----------------------- browsers/edge/microsoft-edge-faq.yml | 69 ++++++++++++++++++++++++++++ 4 files changed, 75 insertions(+), 59 deletions(-) create mode 100644 .vscode/settings.json delete mode 100644 browsers/edge/microsoft-edge-faq.md create mode 100644 browsers/edge/microsoft-edge-faq.yml diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 0000000000..f66a07d2e4 --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,5 @@ +{ + "cSpell.words": [ + "emie" + ] +} \ No newline at end of file diff --git a/browsers/edge/TOC.md b/browsers/edge/TOC.md index 3314f77577..0f0c4989e5 100644 --- a/browsers/edge/TOC.md +++ b/browsers/edge/TOC.md @@ -28,6 +28,6 @@ ## [Change history for Microsoft Edge](change-history-for-microsoft-edge.md) -## [Microsoft Edge Frequently Asked Questions (FAQs)](microsoft-edge-faq.md) +## [Microsoft Edge Frequently Asked Questions (FAQs)](microsoft-edge-faq.yml) diff --git a/browsers/edge/microsoft-edge-faq.md b/browsers/edge/microsoft-edge-faq.md deleted file mode 100644 index 632905e3cb..0000000000 --- a/browsers/edge/microsoft-edge-faq.md +++ /dev/null @@ -1,58 +0,0 @@ ---- -title: Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros -ms.reviewer: -audience: itpro -manager: dansimp -description: Answers to frequently asked questions about Microsoft Edge features, integration, support, and potential problems. -author: dansimp -ms.author: dansimp -ms.prod: edge -ms.topic: article -ms.mktglfcycl: general -ms.sitesec: library -ms.localizationpriority: medium ---- - -# Frequently Asked Questions (FAQs) for IT Pros - ->Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile - -> [!NOTE] -> You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). - -## How can I get the next major version of Microsoft Edge, based on Chromium? -In December 2018, Microsoft [announced](https://blogs.windows.com/windowsexperience/2018/12/06/microsoft-edge-making-the-web-better-through-more-open-source-collaboration/#8jv53blDvL6TIKuS.97) our intention to adopt the Chromium open source project in the development of Microsoft Edge on the desktop, to create better web compatibility for our customers and less fragmentation of the web for all web developers. You can get more information at the [Microsoft Edge Insiders site](https://www.microsoftedgeinsider.com/). - -## What’s the difference between Microsoft Edge and Internet Explorer 11? How do I know which one to use? -Microsoft Edge is the default browser for all Windows 10 devices. It’s built to be highly compatible with the modern web. For some enterprise web apps and a small set of sites that were built to work with older technologies like ActiveX, [you can use Enterprise Mode](emie-to-improve-compatibility.md) to automatically send users to Internet Explorer 11. - -For more information on how Internet Explorer and Microsoft Edge work together to support your legacy web apps, while still defaulting to the higher security and modern experiences enabled by Microsoft Edge, see [Legacy apps in the enterprise](https://blogs.windows.com/msedgedev/2017/04/07/legacy-web-apps-enterprise/#RAbtRvJSYFaKu2BI.97). - -## Does Microsoft Edge work with Enterprise Mode? -[Enterprise Mode](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11) helps you run many legacy web applications with better backward compatibility. You can configure both Microsoft Edge and Internet Explorer to use the same Enterprise Mode Site List, switching seamlessly between browsers to support both modern and legacy web apps. - -## How do I customize Microsoft Edge and related settings for my organization? -You can use Group Policy or Microsoft Intune to manage settings related to Microsoft Edge, such as security settings, folder redirection, and preferences. See [Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/group-policies/) for a list of policies currently available for Microsoft Edge and configuration information. Note that the preview release of Chromium-based Microsoft Edge might not include management policies or other enterprise functionality; our focus during the preview is modern browser fundamentals. - -## Is Adobe Flash supported in Microsoft Edge? -Adobe Flash is currently supported as a built-in feature of Microsoft Edge on PCs running Windows 10. In July 2017, Adobe announced that Flash support will end after 2020. With this change to Adobe support, we’ve started to phase Flash out of Microsoft Edge by adding the [Configure the Adobe Flash Click-to-Run setting group policy](https://docs.microsoft.com/microsoft-edge/deploy/available-policies#configure-the-adobe-flash-click-to-run-setting) - this lets you control which websites can run Adobe Flash content. - -To learn more about Microsoft’s plan for phasing Flash out of Microsoft Edge and Internet Explorer, see [The End of an Era — Next Steps for Adobe Flash](https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/#3Bcc3QjRw0l7XsZ4.97) (blog article). - -## Does Microsoft Edge support ActiveX controls or BHOs like Silverlight or Java? -No. Microsoft Edge doesn’t support ActiveX controls and BHOs like Silverlight or Java. If you’re running web apps that use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in IE11. IE11 offers additional security, manageability, performance, backward compatibility, and standards support. - -## How often will Microsoft Edge be updated? -In Windows 10, we’re delivering Windows as a service, updated on a cadence driven by quality and the availability of new features. Microsoft Edge security updates are released every two to four weeks, while bigger feature updates are included in the Windows 10 releases on a semi-annual cadence. - -## How can I provide feedback on Microsoft Edge? -Microsoft Edge is an evergreen browser - we’ll continue to evolve both the web platform and the user interface with regular updates. To send feedback on user experience, or on broken or malicious sites, use the **Send Feedback** option under the ellipses icon (**...**) in the Microsoft Edge toolbar. - -## Will Internet Explorer 11 continue to receive updates? -We’re committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it’s installed. For details, see [Lifecycle FAQ - Internet Explorer](https://support.microsoft.com/help/17454/). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge. - -## How do I find out what version of Microsoft Edge I have? -In the upper right corner of Microsoft Edge, click the ellipses icon (**...**), and then click **Settings**. Look in the **About Microsoft Edge** section to find your version. - -## What is Microsoft EdgeHTML? -Microsoft EdgeHTML is the web rendering engine that powers the current Microsoft Edge web browser and Windows 10 web app platform. (As opposed to *Microsoft Edge, based on Chromium*.) diff --git a/browsers/edge/microsoft-edge-faq.yml b/browsers/edge/microsoft-edge-faq.yml new file mode 100644 index 0000000000..830ca09109 --- /dev/null +++ b/browsers/edge/microsoft-edge-faq.yml @@ -0,0 +1,69 @@ +### YamlMime:FAQ +metadata: + title: Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros + ms.reviewer: + audience: itpro + manager: dansimp + description: Answers to frequently asked questions about Microsoft Edge features, integration, support, and potential problems. + author: dansimp + ms.author: dansimp + ms.prod: edge + ms.topic: article + ms.mktglfcycl: general + ms.sitesec: library + ms.localizationpriority: medium + +title: Frequently Asked Questions (FAQs) for IT Pros +summary: | + >Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile + + > [!NOTE] + > You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). + + +sections: + - name: Ignored + questions: + - question: How can I get the next major version of Microsoft Edge, based on Chromium? + answer: | + In December 2018, Microsoft [announced](https://blogs.windows.com/windowsexperience/2018/12/06/microsoft-edge-making-the-web-better-through-more-open-source-collaboration/#8jv53blDvL6TIKuS.97) our intention to adopt the Chromium open source project in the development of Microsoft Edge on the desktop, to create better web compatibility for our customers and less fragmentation of the web for all web developers. You can get more information at the [Microsoft Edge Insiders site](https://www.microsoftedgeinsider.com/). + + - question: What's the difference between Microsoft Edge and Internet Explorer 11? How do I know which one to use? + answer: | + Microsoft Edge is the default browser for all Windows 10 devices. It's built to be highly compatible with the modern web. For some enterprise web apps and a small set of sites that were built to work with older technologies like ActiveX, [you can use Enterprise Mode](emie-to-improve-compatibility.md) to automatically send users to Internet Explorer 11. + + For more information on how Internet Explorer and Microsoft Edge work together to support your legacy web apps, while still defaulting to the higher security and modern experiences enabled by Microsoft Edge, see [Legacy apps in the enterprise](https://blogs.windows.com/msedgedev/2017/04/07/legacy-web-apps-enterprise/#RAbtRvJSYFaKu2BI.97). + + - question: Does Microsoft Edge work with Enterprise Mode? + answer: | + [Enterprise Mode](https://docs.microsoft.com/internet-explorer/ie11-deploy-guide/enterprise-mode-overview-for-ie11) helps you run many legacy web applications with better backward compatibility. You can configure both Microsoft Edge and Internet Explorer to use the same Enterprise Mode Site List, switching seamlessly between browsers to support both modern and legacy web apps. + + - question: How do I customize Microsoft Edge and related settings for my organization? + answer: | + You can use Group Policy or Microsoft Intune to manage settings related to Microsoft Edge, such as security settings, folder redirection, and preferences. See [Group Policy and Mobile Device Management (MDM) settings for Microsoft Edge](https://docs.microsoft.com/microsoft-edge/deploy/group-policies/) for a list of policies currently available for Microsoft Edge and configuration information. Note that the preview release of Chromium-based Microsoft Edge might not include management policies or other enterprise functionality; our focus during the preview is modern browser fundamentals. + + - question: Is Adobe Flash supported in Microsoft Edge? + answer: | + Adobe Flash is currently supported as a built-in feature of Microsoft Edge on PCs running Windows 10. In July 2017, Adobe announced that Flash support will end after 2020. With this change to Adobe support, we've started to phase Flash out of Microsoft Edge by adding the [Configure the Adobe Flash Click-to-Run setting group policy](https://docs.microsoft.com/microsoft-edge/deploy/available-policies#configure-the-adobe-flash-click-to-run-setting) - this lets you control which websites can run Adobe Flash content. + + To learn more about Microsoft's plan for phasing Flash out of Microsoft Edge and Internet Explorer, see [The End of an Era — Next Steps for Adobe Flash](https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/#3Bcc3QjRw0l7XsZ4.97) (blog article). + + - question: Does Microsoft Edge support ActiveX controls or BHOs like Silverlight or Java? + answer: No, Microsoft Edge doesn't support ActiveX controls and BHOs like Silverlight or Java. If you're running web apps that use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in Internet Explorer 11. Internet Explorer 11 offers additional security, manageability, performance, backward compatibility, and standards support. + + - question: How often will Microsoft Edge be updated? + answer: In Windows 10, we're delivering Windows as a service, updated on a cadence driven by quality and the availability of new features. Microsoft Edge security updates are released every two to four weeks, while bigger feature updates are included in the Windows 10 releases on a semi-annual cadence. + + - question: How can I provide feedback on Microsoft Edge? + answer: Microsoft Edge is an evergreen browser - we'll continue to evolve both the web platform and the user interface with regular updates. To send feedback on user experience, or on broken or malicious sites, use the **Send Feedback** option under the ellipses icon (**...**) in the Microsoft Edge toolbar. + + - question: Will Internet Explorer 11 continue to receive updates? + answer: | + We're committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it's installed. For details, see [Lifecycle FAQ - Internet Explorer](https://support.microsoft.com/help/17454/). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge. + + - question: How do I find out which version of Microsoft Edge I have? + answer: In the upper-right corner of Microsoft Edge, select the ellipses icon (**...**), and then select **Settings**. Look in the **About Microsoft Edge** section to find your version. + + - question: What is Microsoft EdgeHTML? + answer: Microsoft EdgeHTML is the web rendering engine that powers the current Microsoft Edge web browser and Windows 10 web app platform (as opposed to *Microsoft Edge, based on Chromium*). + From 8b9615cbda25ba0463eed6623c22bd0889c70872 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 14 Dec 2020 14:27:54 -0800 Subject: [PATCH 140/169] add note --- .../microsoft-defender-atp/configure-endpoints-sccm.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md index 38ec7959c3..aa7a4c498f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-sccm.md @@ -50,6 +50,11 @@ Starting in Configuration Manager version 2002, you can onboard the following op - Windows Server 2016, version 1803 or later - Windows Server 2019 +>[!NOTE] +>For more information on how to onboard Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019, see, [Onboard Windows servers](configure-server-endpoints.md). + + + ### Onboard devices using System Center Configuration Manager From 40a0800099f88755a4f244bdab4eda45a1af4ae3 Mon Sep 17 00:00:00 2001 From: Shari Kjerland <30906736+SKjerland@users.noreply.github.com> Date: Mon, 14 Dec 2020 15:21:20 -0800 Subject: [PATCH 141/169] Update change-history-for-microsoft-edge.md Updated file extension --- browsers/edge/change-history-for-microsoft-edge.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/browsers/edge/change-history-for-microsoft-edge.md b/browsers/edge/change-history-for-microsoft-edge.md index 2529a88fea..af27551fc8 100644 --- a/browsers/edge/change-history-for-microsoft-edge.md +++ b/browsers/edge/change-history-for-microsoft-edge.md @@ -60,7 +60,7 @@ We have discontinued the **Configure Favorites** group policy, so use the [Provi |New or changed topic | Description | |---------------------|-------------| -|[Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros](microsoft-edge-faq.md) | New | +|[Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros](microsoft-edge-faq.yml) | New | ## February 2017 From e3711ba7bdcac9dd396404ee577a587a9b83b077 Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Tue, 15 Dec 2020 09:31:45 +0200 Subject: [PATCH 142/169] Change product name https://github.com/MicrosoftDocs/windows-itpro-docs/issues/8758 --- .../enable-cloud-protection-microsoft-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md index 0d113ddeb4..2dfddb6de2 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md @@ -56,7 +56,7 @@ For more information about the specific network-connectivity requirements to ens For more information about Intune device profiles, including how to create and configure their settings, see [What are Microsoft Intune device profiles?](https://docs.microsoft.com/intune/device-profiles) -## Use Microsoft Endpoint Configuration Manager to turn on cloud-delivered protection +## Use Microsoft Endpoint Manager to turn on cloud-delivered protection 1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and log in. 2. Choose **Endpoint security** > **Antivirus**. From 3429575d8635b71b09b230c891b0516067c34453 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 15 Dec 2020 06:15:44 -0800 Subject: [PATCH 143/169] base updates and images --- .../images/autoir-action-center-1.png | Bin 0 -> 29810 bytes .../images/autoir-quarantine-file-1.png | Bin 0 -> 25900 bytes 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/autoir-action-center-1.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/autoir-quarantine-file-1.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/autoir-action-center-1.png b/windows/security/threat-protection/microsoft-defender-atp/images/autoir-action-center-1.png new file mode 100644 index 0000000000000000000000000000000000000000..bc928cd15779c56bcbd2316f1c5fb14dcaf8f1de GIT binary patch literal 29810 zcmeEtRdgLou$?Tl*kWd8X0}+en3V`xl8@vsS!>Rm zo?bIO-CaFZyLMHF$V!XCLSaGy0Rh2^iwVgC0Rh|oDKCBp|8tfb>2mw?_sv0G^e0f| zB=*Ul3s4gQDFGm$nkeXZJ+MF5khWrK4nRO~egFKv4cQbM0s%QfhzkiQx@uo^KzJG~ zxgGK}&TX*ryg0{6?OL*?xz?TCJ9RoCa@`o$Nv};w*C27x+K0GfMC4;g;l=jBIU@pj zTy;D_J;M2cLaPG(=T^iLHGl76+X!QUGp8J4>l{;BE?RD)op1B0^J(Yf>Pt?O5*=#NjsMYQ=kXkr?DtLW9lOI}cs^Zw zEW$6Zc5FA;;b3oApPQkssI2$tD2caQf4o;a&-bS<^p}X$ZTTp`9tfXi=f*bj-=S?y zaWjJ?-JNc2FslB<`#N)Q{n56wf;lu`(gomq>DwA=&{v{InRYJN+3KK+eyXcY)ji$o z%RL#=`Pih}ate1jJxk*9ljPM*r$S=?npe3l`MQDZUyOuM!1!kpU%U@@(Am4-d|uA@ zq(u%Pu7|STi9C~GCLp|b*{0jPJwPui^f4n_j6x?>CcqRxEXPZySNQ^my!vjJTl}Vc zc8{ztmTY_;vk2%YMI}8TFwG?qJT9Q1EXe#N`84lYAe$Po)@qS|8T~V3hi@rC`rGwZ z6wlXhliOZ=FI#fzY5`{!hM0!Jecbfv$AhsDYE>kM^$LLWR; zZHfF;rdX`#+}7Nk4ynGIlGWDf4J?MjzHE^z2~I4W(vH!a*@vZd<%G4{YB9?Fyg$>k z^=5-;xe{LU3;vsSw-k_Uef1t+A<$!cbpGm^TM;m z*O}S6ULG-EbniyT`?IeJW+p_vaOvh1jqelSn3F_>riV4r&hp{u=tIxOsB(Mv92oVv ztu+SyaX$136zJ81PzJ)|ePw_bJL_|^^acENZIab&v6A)GL8m+5yr#P`Py-_4dHNNT z=#|E5cHHEjVUrTSWWui37{Fz{4&cRv_ayaE<=3wkS3yklS7i(D#m|B!rhvcSMuEc& zK=^#J-K6e&W=eIZR&+{UXmyi1_zHg%RFOJR#j}3gWi61RruWHQU z#WkfEJ$w*NcU_rq?Vd9U5B9cgSA9{R?>5`+`l!3wKEQY{Jx`J+UGIEdP-qv8>I>n` zN1fq#35h)Zbe+foM|sGSBJkmHO3yyL__IEsI$en&2`o6~bCY{R{k43L4EN}dKu6fT zA31o@iyzlfA3u1XW3mRwyx*E`_9w8h`PP#H{(jnS;ht0A)}_1Z+o)R*UqtHlhM2*9 z39Rq8LBPiQSTj!Ysr)y$I^t#~y!T_n3RYkWSA*P%_&kDS;fn>SFS?Y~^D)kA-6Rkq z+4`N2W)xj`uQy)-j|pp4zrvBV`ryItg3Hyik>Nk7O}D*Ym%d;uda9x=pT=$!`0x|C z{JUg|VTm`x+%U6VOMd&lE$jFk!4ieK?CPBL4f#+fZ#jgh&YNbFl4N{9Q(TbwJX8@_ zFFqb+#uZMbzYw(Na$`tw_cQt2W)<8=y&q=jax@bdcv13F(s+Q^Hm)^^Dr7>ZkKsK( z`2=GwaHGzf7ekcYwBf;|KdFQs{pO+JMPjx!;eE9r$JmTs>n;G_9DHBuddH#Y`npcrYNz6xQY7-0Qh$W$q(K_Ad`k3v ztB~pX{d)qmy=>uG=8Lv^eM^f9vT)O1C2ZUS2T0v=w*es%PD!UulGt|g;+ zQE;GajnTaI9CYWa^jG+hZk=QxO+|RUHXrv`S$u7heD8R&ELKGYQ8%MUKEe`j(>7jk zuW#W%G|mAVjJ8K();_Fz%pgzuN8U1{S0>&UchwRU-z@tMp54q=m|QvX;^g0(VAhAe zp4H5de{HLmb`SZ1Uw&y*!4+(VIXKG{RIQEM;?r} z8@FgT-$pdw={p}KfKSgX)ci$)$xl%5mfPhD3D0ID0qH$HFKa3`JSxs<214E>rec%t^zy49 zTh?{d_uFSaZ+tg(WbjLIyw7uZfYlFf=zSw^zG43Sh|03O6U{k? zY#*=YR1Ku_JaoCv*=G3u(JktY`Q^^=Tr}7?bi?O&lJ$Oiz>oPCX%b9#M zPH%2TVr+!Gv|^Qci>GdFt^!X0NRlyiz4RnfmsYsGZ!}URyJPi@mNWZUdPkJwSMM$V zEE+EB02xcO(exJN@`q#Sk^$?u$b`Scz0%Wf))|#y=?speYr%Q`g?^0cHp@_M4WZD5 z6{NZ_o-4VUL>oRy-M!m~p2|G(i{{6F8^4K0hUC_M&@?JKgff9#&@eeJ2V>NQkP_ zc{YV4xbTB2{s$bK3lF{8h3i_-_&+j+xkGg$2CtMy_3xFYd3!oiQrRa5wnAY`W+76XP?Lp>A#v z-8aS)@l_$-2ACq(gNf8ywwf_oQw+z9-K;yHF*F_w8hXIiqrxAmQ_8BUhK?&@+>UYC z@{hGOu?$a$0SGmGkNZKxE4d0haWUJ{Tt6MML=~M`IJvlHW;DZX-uF}(YA%LkwHPpi zRJL=y#6p^blPX2>TpVGNx?a1kgR(xU5z8QK_v>=V8DOUPo|r3#j(Tc9%B5I$+|4QF zcagHk4L(pFq!^No|fyM$zvcw)uR|VE-w=i(Pl9gNyC?%446AB za@!#{M;G!vr$ml`W?yF^Af<*$eSqCB5H+wL^9Q*irER~aB!!`!C)F9~4n=vmN&2C} z{=3f$Z?;OSe?Apg$#B*EXo7v+Vf!{rCdYFA$GU$|f95y3_XC~nFYkvm*PDT(n{x%7 zKArc0F8;lBLA_-)Vr95o(pR_lzNRXDVejUBL*vFu=RGrrX68$*L;9#@&IV(~MH5p_es zn4&B8_`74tVKhmek4aNalR@tbT9(j2eY2+@sZxEInQL;ryzmCs=8MUQqw8x$s_l*QMDe0i?-9Xj0h#veP zmclg~+JW!;_YXs&&zHL|h^fGl9r(h337K|`f0O|;i>{bgPzvX5UR4RQI3vcbS(SQ`qhoV zcN$#R7z<)iVIp=$Jk}!VqI2cqsbAB}Oak64s7NmDfvIWn0VqebuVuG0%*BJMCKQty z9vE^IZp-=iUQ3w0Q#@hMv$)u<735-YePML%-_@L9+abD7O?e2z)<9mwU9T^?UYLkk z$03UTqHMj*^gr^zg&(R;yI9`X@}H~sn_pHnogi!C6a?vVz_KzLd0ve>sy;b{kNQ_l zEq>PnaS14?RL?IUCZr((@pp-Q4*b4$s;$ZHf*>gA%jWza4MP$9cdDwBPw#(2X?W3iN6KC|A8_4uguy_H@LNr4_+G=*Yd`O zQH?4!YS@52j|fk-ufwv{w2f7->2%${l{L6|tA;9pP$(m8_#k?Um`P2&*o*CxYlIJ>)b z2iI49>V12TRuN^tlPw}%9!vnKKhnR}Drd}q$#%sk%x0$hVt26R?0Dt7G-BGB#WDwC zSETOxV&BPK-#Er2sw2T+x;e8S6B2qNmR4f>8rpkYd?20aF7R%=dVo8AclrW z`+vX%Isj5@GZ5SwPtQb0#84VZu~g4;HG^E*8yAB{VHvx)HzJ?%-uY-J`hggB9rq#!(vs&PBr zfKyxRHq*kQAz#eSazQ(}-k2lXLnB4Y@=+DwSUc}=RTbzq6QEUP$|TL|X7!L5scp0U zE6MM7VzBFvsoxL+&C8e1i>)*RdkzD0UBR`~Wo$#{mW7|o^p4k{q$RM4c2?;2>ZY{g z3c<}$f-RDxy|1bocUq~zAy1NGm|7_cdN{(0w4-yHSm6UH669lDtbmSYL-V)(LmuNq zU4gAN#X}M6a@<+mkz*WnrV3pC4wpl`w7d_hR%06d`6)y9#Rz zrZoYkr{Br27OIT55Z-?^$IIt_3}*9Qp24#-{LThft0crb0qeg85aO_g`#*6o_y5Pi zw*M|Eg8xdL{U5{={%6f4yU_3kLB{P7p=YW7o-iLs+zj97z**MH+(z625q+y(!C_~I zlm27p1AauUbmR0MtwDZzH)E?hk&lc95wUx*1=(I*&UL+^Y=| ztm{N^CNI;R5%s^|j&!q5*c|fh7YC+w=Z4O?!n*{22{y zU_^W7o=>0m`|h~9mi&P7|A(3fXgNh9n{hY_uXR;cJNYqMh3p@mFEgrKrX zqQo5~7uK@_>3X>wY+VmWCrYZnVG3B$4agb~iD+ct;PIsi!dn|-N?thilf=`rvj?4% z#OgVD+h)oxtbuD3-BYrunb!E-`e}FmvQBR$H^j~hKK1zx820#@4vqzXHS&<&`sPjxi;}BniGa0dL~eBzw01FQE6HFlu{N^V zHHV$u#t2InL?&+ggpP@4&+x$F+@`N3>2YMX*%>#n)HsySF~uFe<)JT{08P-I$mLqktX zEHn>C2Ua;;ZV9a9WeFb>6r;#H6CUiUYXlnYwJ%?_aRCbZup*zJ`y8swv3!ymu!gJ8=R|Dma#e@uTKyg7pL2* zj=zaH$ZUdfg6F4(Gv+Q*nO?(c4qI}8?$gGwuL%yrl8&&*hA#d0t)ch%@5V{MUQ4g% zpn#)#MhBEC18?w zdF0g4LWd3&4`M2ZIW0xdAXW*kpZ4gei?GGCu?E^rp{eaKiYm$iG1=LUOr`q>^Bjo; zTqL+o{^}I)0zTf1sjn)&8#MFt@%&s&0Yy_#`y7`->42I3x`T&9pPhtY8%$({m&osHrj{0f4}`YZf*$+( zaXS4%R(KU!lDt}a|3{DSI4CQonZ!)3ETMj*;J@zcvuksq+$6xjMFDaNDZ#UYxZ`wY zF<38%jHTe&Syuvf);x)a0D`!qyqfkONd|Y@XooiTKMq#x4Ot)c-O9ho=(NK%NNY|x zj#pIVH2$t6JE+P(D=9ov6D)iwtwrW2VVu9G1A9VM#h?*A%STO9U@^tage`21)=2kv zdUC;g^N4?LOqyP-=$+?h!UPn<;9lgCkfCu52p{7p=WvSx?n+3O)zgIZ#3@*Ak%nWa zchE6^i}Yi#_JCFWG9S-(3r9c`TTvwxI@-7l;*3lF;Z@Y z$hn>QKyCvYs&kXs#mq^S2H!%>!LJy*u0U}XB-%YWuu~E$mZ!sscw2BaTJ8218uJ=x zv2GMis2KNtq-Z)=>^E{yz=*f-*mAKIM^e^Ya``#ygR0fY4VR_)DX<0RmP?;st^M#m z;2fkdHKh>~YzRH&=;JmX^e9D0)AG%kp*Ov^4-7=&? z#}#W9?8>`RhThFa$EypG+-4Ls)T9G{!|~*5yFMn3NuHs`X!a|0-!B{@YH3FB;^|0k z*_#Q>Y)8JI025gZGq;$g7!{P_p+ts?kC*ALP|3^jOh4p|NmRm*7>;s^&uLbnspzAR ziVMk<(9G+u>nwmUZUPgQi&0$z8SjHFHplh%)(7^dBocO|3J#%yTo-U(s_{SXKP$e( z`wPHBDMuhb&=%5l(l2sXUEAbKg%A~^|WXbAv0g066 z^5SIgTwJ!z z2>gG=q-~!B$AQ&SwhEsRTSyuoRlt$<5__b9NdI{^b|Oxeo3|EPq@2$DZTM zKn~3Vpxb!S(s}vbwc*vFW93%aA(Ya9`_8OglUk#b)cgi_3Gc_(s;^{;MC1SkB?7~9 zqq^&!E9gv+B;vaM|;B+||*19S61-lCp0J1~ac;E;!rhBaAo3R=G1IKs8Hw&e`x1ix+n zc!TgrKCcqK{GI3-gt-C+c5F&3BpgMbqbOY(pPZS&Z|+=a*!p^EFS{RWgu6EFEmLJ>C*RSqO1ASG+q@R1|U9arOYA>hfn^OvuhSjqGk> z1tjOYTb9ERb+n_*8A_mlH6*8|^rh}Rb~>Ak7JtU)R#n7~E`1002qU1g5>k<4wGRv0 zDf&%8!3}HCYD7#?SF-p`Fye*$*cjv=NYG|3hZn30iFQlaTO&bhRnZ1C&;X)(c_pMZ z2fW}xLueqOYp15$$hE_mrsv|W$BI$h;bn3W<>dB*;f7+~nI$hrD5SYxe)*jjy&*0* zT&BBy20qIBn;C=IvALC?rAW;@d^0!ibNJmboop}8c$nK6cdbS-X$CkBO+~WW4ByW? z5$qN@4Mj+W>UZ4KL%EGbNm6_46LGc}jZJBs80dnNk>jk{?5Yk_@Fw^;8WOQs62hWZ zf2c2B_cg5SM(pk;7XQ)67=Gh`rBVSAN9J351=*Q-K*Wn&yE_RKRA74Uo4`39t}XzE zUmt)tI<9#?X``#O06;!PpLIZ)UVYTl!Tf12fh(-yJa1S;L?IA)X@?W(Pj+Z48m>-~ z=b{g_!2-LyKAn@Bn|6MPpxCiMuOQmS${ySz%yoX27dLOC_;}i5jX|=Yu&8dmbhgfMZ?H1_n?0Mp zL2q2<#|TtDnLj(hjMWG$|XS)Q_4LT*@EX*3u#-vG}(-SJb04 z6sV^1{9!&30R`*>CG6udCpk@y<1sHJpM{HAJr zIM#@Letv;KgLz-hROs%wD{+yLuA%qc%;HAV?-k2{1teGTgJ{3R1}7$GPq<^4UAGj2 zarvXg zUOh7(Qgo*!s|mW85FLhJokuK)pYpw#fJ_~P`o=~A^y}-{1T$$x8_Z!+SL6&yi?Z{} z;aP)_KAeQ32S{^U4KUlZ*(mK}Jio|U0y|0e-pLhdO-LZaC5E;UKa(p{(jnjKWC3PJ~J24l7o|21Ncoz z;m-Yu05flRbUtpKKET-jS~7Hbx;%Td-v2$ixFdJH90hNaFo3jq%P`%lL4_nHG0|O4 zdkritoP$VH_o}gU5b%~TBdc560vtE?_$QC9{SC5SxQ)HN$v(?g6c3pZ8*ghtrZZRd83phUG55dAQ2Z03hI@RfX=)?# zf=L?C|I4I4Jl}VNPhL27>(BO?ZyNuP?CM=}db}?JYgovCzZHD|Jo4W%Re%3~S-dxe z)w~wq3Yvgv+5k@4fN5JGF34!*KI29hE>*(N7cfcFsvM$Z~`vaBVFlw+qW* z86#RPXwc)K&V7K$gpB|(eZ0|+2L(n>VZPHmjy2bWR!mf|tqfTuM-<`tKSZ`mFE!S8 z#F@<)d#pR3aBp?2cQ9@?NX?+BZi?u7A2DnuNWa*2b-Sy!>SWs%VIy}3`xeX{cC0;! z{TYUhbdi4|r_e?|Y?h=>j}Oe!c9VY6wdMqBJu0KqP@CAHv5eDd1GwFh=G-ieTO zAtDM&!mt9ltnxxQjf3uHniGsZad&fT@JkEFvZeD#F^3g+@sV+{1M!@3Q@3QsSgSLf zgTozt8i%@1m89b#Z4&fb8}G9wTqp#NDJ50^_BbUs9OKhGTuVmpxJI#*ee_LJ_tlf$ z)KTmxVD6-Mvl5TDDFV}sYT~Z@%1JCsU=?kvww^W*zX`oegbJJR`MSAyTuv>&_S`Nu zCZ`?;!E;qbHd7leLp)x<1YZX2KpbG=;)0iWz<`Xr)F*u>gweESiQN2LP3MPZev}Re zVYTGnfrHmx-?iJ!joaj?xy#<~{O)az){!<$L)p`t29zhuH~eC)+ze}EYdd-*4jZ|I0~c-=|gFN zycjEoHOtS5lP*^a%~x~#*>6a44#J~t*{M8_p6Od0l`-~Z=yqgf#*pAfAku;o$#IUw zS`}16eG5)~mGg-zjw4P-&sqK6lflwe zY$9Jpc@1u^5XN2WRZLiAl4vV$ZWp^#NA@}Luul{JPf(y-+^{x}C#H`lXk=;P@U=v1 zFn9kOWqL#jcVci_`djB}=y2;&f==`F>o3N#M*^0N~-plqtv8##^ zN=%(qGI$o<*<(Bw-rU~HE7t-M8e3nG6JMyyXiU8s{^nxe@0$DkeP?&FdH71M=D$ni zppm2bK?oLC3jADC?S8m{Vk+@D7k_Ja!6=c-1B}XmDWr4FG@r{GG)rboU}2)DFA79_ z(z5KrtyXn2tQ71a;EapsAP><*DlnTrQT0a&?zXSoOBRnx3QG%MxI=)`&u@jrhE1LJy~OLVi%SU+TvBo%TDw^?l7h$Z)kCAg6g>84<* zoa8#4$cqaa{VlQ(89vWk4;!9sQw^~ZQ9xd5?e8-MJt0O{Xxw0%>XeL*6VTHfxHxKQ zh_=*g>hP0oE8;vH#u2tmZ%tc7MT!Kow2hn`UAU4EMXQv-QTZ@i&o(nW6vJQxM|FkS zz{3f1PeDPks&PgHP(!Z~(qCrH#ZMAC1oXf(Q?|YA-f?ml8OmQPdp`g zfmT1e0V)Ev0zE5pa6SO4qmPn(7?egDMql3=g{sb9c65%OyCa|`5>c@MzDKf9_S`|n ziva2tSu9pqcjbIwR1EC`&&tCd0e6j5J=8v0YvoVS+dE%`nBQdir-=bHrUcVeEKqY68pmZ-0Og_~As-N^TKgXeX}@tF zP`TIC6%Wa?smX^zd;D;U5VRf!#KvTGH9NqI7;I@Q#x!cInZ*y(if{!R8DTU0ksKod z3_?TZ>RAFZSD==KMv7=g+4;FRYl=ggQl!%6eO|rgZ~6Et_foytK5P!R)(Om~MykRx z8X%|U7Bi|UE|L!mO2;^uK?$pIZ(v)!?P_ew*@b6Eh2Dy%WWrezAGOI>3E}M!T)9@N z$%DIxte(=GGEKMmbys(L(@bZT9la^C;(!kK-__0dTqu&$j<5RfbK$I^!kvrx zHjzHK8sfB1%LZ8Ny867%(oS-)*!7qr;hY)h_2815l8$T-6S5~`d_6M9*W(nPr{vVx z--DK)Kyw>B?%d9DohUH5uG?}laeDf9IfXUh&=bjIW8(tC&w;6}K?xORAk`f2j!!VN z$?G80C_;v*^T8MSXQ-V-dR^6*GNcS)BR=X1+24=cOXX*ZGmu-$b?vnDo`sL~?!tdS{iBOQJVd zirKNH(dQ}SRpNizpiITC=*>nFHRbOveo9QGs6Cigj1GQhG0&CFEdOdgaCFPYp%&Kj zf>=ZYk4dE#RM6m(V2qVp;Rd=8;)8N1)q{-;Z)bpK1X)X~ZhZpELZ#CT7S_=rL5$nW zzfH_*2ZVNhGaMW%AVNV?XuQ==U!))5lWoBby<%^ol|CzH(JU|s+<6J>eY7?DnBCx zd)ye zCP;>ntJ3KWM^xu94A~Wu9?D5wS*hn%j-3;Dv>dkz33ZT|DUdri0Va;&RkdeHkgh zVK?%MseTD!Oi(51^pdPDL5@C&SduC;@5#n~Yj}m9)=Bg$q9fC@E=OaCnMo#eV3k~> zkq8q|Ri;Q3d5y*{6Ur)usH@u}j~^n`hyfE8AUOn_BH&~JZf3j#bfS8<&$%TI?8t2} zetIaO+J~J@DQ#vkYyn${RcCMo` z9}MoC>9|8uJ^Yp~6ixLUW#8F;Tdpr^*|cS$#7T+D=_`TiqS=D6Ye=D-rsU}Dq8h#70k646=q}G z0S$FtnITIj(N|VTZ|(TOX#SlHqIG(aAsCSE8nB@#J5(enqDrj(78H$p zhgqAZh>Q@Nv)%2@KD>~IsuWygv>GHT%by|bcE=6}?*c+Zp@{#Ok>>jHQ+y?_C*c^YQleXV}aTzM`# z6PT2OyLr$=F_m0)r|O+ z>WZJ!1^(=??F+?32WNQhIW;m`VV;{~g1qH$MDAUKHNS%!FE}bIy<$w*xCF`sNXmjK zvkQDq2|3z{qIECRtz2eY;3#ba^Ve`GmnAX=9@!Xc4vb25y+fAdGH=r;=nOfK~p zj5w&XZy9iP;3ya|-}9v1g)9n;xQnBY@=6+EZl7V2KRlL;K8-DM5vo4c=7y9uvPO7#wj^=F7H+l<9rU)6B@K#PnOfNAKtOc`_4{_TpotxQ6?Pxf0wFL8273uVp znBYGS!9!7Q$WJo|VzzM04MhHI4OsJ6zFF=)b%oXzFYBJ%!FBd)l69eIzQ!CRNYeVf zxZhUg>(FM2ZbKosuLP#-bT=%8Z=fw7Y07v=l29NP-0I7^knVWKq=OI`Un;E{fh9Zj zOFpeIsI&w*x8U_mutcv+FMDdc;Uxc}y5B5t7T-e+f>`!Kk4yPbIvRBPB5Y90OtTOULfo@16%*rJHpua{V!4TM=0(25%A zk^ZsvH4cseDCYAz&x34s9IPOuO?YqKSf>Yau748tg{+>!ncuyyUfeWeMYfMMou3*M z$O`+HQ*j`8+2D$iN~9)5HMIEDOVu~$yE*#F_YzU_J}SgQ+k|jR!H{rJn%(Y5X|+Rz zjm4p8hbzU8ng~b`ZaBP_iHJPawR1?}!QlNHO2nvadUkp$@0$Qa8h6o&I^o=>`zEZG zvSq0;bIhQ1iNFEl%>ASC*(~U?M9_T=VI|4vSfVb147>VyGyFK8rVb2~S~=jfj4-3A zxZ@A|J7GF+sHGkNSq0*u`&r;xS{)&Md&J&KfWc3TKfafrq8le;Y#ak;QJi&xyCs#F z>xr9Y*n}t!MuzV<6nn(kX|B5Pnn%oh|SP3#;L9Jj5^_K%W6z3ZA8?6G8WdWmseH_ zaw$eMR~sgeB-7GP=vC(gk19ZwcY49FCFSNAAWMO<$*pt$PAnf2i$=>Wkq-$kr5%^! ze_n+SnWl!r*G3IW2}CKctkM%$2q+6#nGL?K912f;w=5nkluJjAD$Nv!afv6Ws)w{f z85u4+^OxZZ=@-J_EcTa>-#4&w!Z-ssImR0j=4F2i%ZqS*v8NUZ(uj$U2MziP4wr>O zmLjr^6KKD_SDU{#*VVZcwbW!RL{q707X#1W6mzlxDaCr7QOF3I9|t!TIkP=zSfXd2 z_XTau#Jr$XUP8^*)*PG_g4d@L&8z4DJ6Wondyp2CHiKqG14KLWKtelu@7Jn2hEL|z zv5I2)S`0^sNND4r0@9+>W1;;mAjbS*i!IOj;ZypLh-z!N`TWMQNjR}aqkm)ts+reS zj@W0PmWt@R!yO)yv#X{9xOXTSi@hXAX!~R>z%F!X6VU)SuPp0*Ac18aIp2JdpXZ`HrPIPv2o{eqa8w3i0#np75-vVV=l4p%X7OiA zJ}wbTJI7b z_idQLRos8-uH^_{(td@jEyfv_H8wEyM2tAF&o?^KA2Stn09lw>fn`q;jlsnW8m#n2 zHZIC>w#+C8;5;CA&#M^iEZiOCXH)SsA>Y*z4UfrZx7H^EH|xb48Rphj;;!77Rfm#; zLlnz&hA+_x=Mw9PA5?<7*L}PVbg$T+Zw=rH#hH0n`(!rc)?>|$;nKHSot{Pd<~nD*#a?Q&RsIN?3Bp&W#o zw8%9&4;Z5+e48)%sbSk78Ub!Ss#^;WZt+`bwDx)=$Pgi6rKsLSP1HgsX1|Dutbqqg zM4rWbHar078s>SCL#8akER5oyRf4I}B+jkdbIRl^ z2WX}6eD%d7hWRD`KsA)yJnfufzSXg;ko zk2@%yl$|xZJYkH8(L}lP*Z$*D2+6z(vB_Z(M2!3rC$2+?Gm6!7z*@1egA{LN$0M~m znXw$E9Y#Y(Sa&6ef!CkS^c+#HBq@J_Ho*3PZ-AL~vr}VORu(3u{pM9_=jg0#;5-owvV;o7BtI>h;nlz> z%-Es@0-~CH?$1pD#}eUXE1QviQYD~|Exa|sv#g%-hs2;uP@;0TfQpW$ENU$!h?DT0 z8%1Z_Uzxq=pe|J?ICw$NkKAhMi1a&$**8SVtMI+OZ>C?7dZ4GpO|Sx4R?o=0Whakt z4Yer5Dfe&BhFd!`Cs#m`++37ROtgFIrm{WY50fF(Ov&1oC!g?2Q}(o zU(?(eTDWUj|2U;*V24f-aw8kR*uDFZ%|QpnP%C6eG0Tvn9rp^9r4+Uv?pW{gm|b4~ z-Avr<5B(Id)DifaOT9mQC%44|!=^Q~`ASV3or9T~+Gp!ScE3hiA8*9Z((&6HihGvH zK~`?d&!_{8^a7Mo-cW3UuIH8&Y%Wo09+_03I);!3#6%-YP{n}^Lxl|djEcT3KghWp zB;=-s-1@kGn4byU7*$tQF{i-+RAhs>R>1&&iXz%NDMUs+L;Dc7Zn)bG)}h({0N8qv zB*)1WaiT>6d7*4tNTj{I5ekhiQxGmC%EDwSr`90#G#?#{pKe^4m9To1;|DMgIJBJNT<<*+p%?EdoH1hS|-eU%Z=lv^V>4W|{RI{>x*;L5UuJOs1nxVA2uOM5+T}Rh2KCUVCNCZ9z zTcB4}7}OAF?Ov}fk>6wJnTzLd^ESGaUM)Sk@dCXKO zAtfuv{dtmiH@FC%;{~>xNYxC4eeG(D=mm5 zTx%}>ryf=6t)h`AYg@oQDyrazmGxWeREi@?Qf|85j#RdqUsO|+x0s6U6}S24Z2gBu zqEzB&fJDE!M6F!sPvQVOy(1`%dJ_q4Q5Wt|COM!GuShSLTB9g=9^Gtvl1bptB1DsY zK;$qvD?ci2kC25;U+;x559UOsm_jG-)agJ49cUMc2uMccK-@W2eRxdrB7a{57KfWF zF6>Y(ksLQvo0i>xX+0g~KY_S9PO`iXMrSwH!ZsL0&1aYf&3Zz=t=e;Z0OwBC?C=Ma zz1Rk4!V3cl`KRmImmX4X`e0}q#<(g%8U4?$AKnZv5JY|5JeoT6~LWkcE z)2>41O;>nO%0p@zQ9?Q-s#1@}B z7jpZKhCozwt51}WyBKoJUgM>S#O)Go3z#u}1WQY3R^1&{i}>!54XTmipkRO*J(YmY zKMe9#gegI&Yoh`b?oH<_^3me#^cho8P=oy}>wC@CRu7+Be?i#h_=j>QMp_qY}) z*v3X5piT|E+X)KB95+>24IPzA4HBIY(=bzU z!G}N#HnpEu$DOhX2aKpd4-F;m;A+53gwx4(n z`+g#BjTp#=DM84Jk_&x#M29ii=rbRZ9`5} zCkL#e$b3jgv}9uZri6~vcArQ)3HTyIMS@h>y9cey;*Sycsy2FZ0iJ%#c+!F$@UH+j zD(Z{JUCC3P@&&P#^}@(p^|liMtubZ>Mhle&@;RC1Cy*S)K?CV^ja%=Rh9R6g1G{$| zN|9~l=m$b~1zJ#=5_SS&`9p93ZrrKIN&eOs>lV_+l{dxqgYSx(kTw_fM=PkmB8r1(C-C6qVlauq!SsnR$spvy1CZ7FH8q+lC4Q9|`^y2)Bs?IIOw#>J?- ze!{yrPI#*bHMKc1%k*e}VgT``{^|?zq+sF5Xn?JUN~3#BhYj`npdQHbv@1cx&|}Gh zRQ@7`dq+Bol4xZ*4;3ZCy99=ek?3{-I)%frMQqM(?lzr;sc0qgo1fds!dG3y7V-aO?AU+j0v zB1r3%gMpLfY7#_}{~{PUx3* zMjK?csr#V!7{5Pt>LAVpr)5cq<9uSQ2<=dQ(7Y||4PR2L8oX|Jt6w3ky(&dcg(33i zw*;3eJ&9f+bYg*JdQA3t2XOHX{Hy8E*cURL+h*S;A{_D9?s$htrz`8i068TJ2z0kJ zV8ljH2uzS14XUAMXE$vLc~@uiWVe*SFmiox&lGF)gs1dCt#R;y%}5v$4(#8B7w(iOH|7N3UN4X9k5;isB4O;< z*Q@VF@3DfhekE1E?^j-H;3dGs_G8{OKo0}E!+ugr%LWt>BUTI?C8Fmo-%9EsrN_(& znOs8rVo5Vt@;DKuf8qP7iP+~y6Wq7qucl{apLB^bax=rmY{Eud2Y(~TmhM3p?LykA zrjT}fTdR|__+?jK8-4z`u~TCs7AO2V8cHE=9x`m5yuF!Aqn3)I;&HaftRenaSjl?4 z>1ku-(JHj{-`7pg^+JZe%e+o!3lFA7JqsV|fEP8HI`%*)!2WX~+mz(J3rRf=N(6}z zzb%dD`&v?S&r^OH+)lvjtC)1DP)E&A^~fdX+)|wHr2bix9>$N4jMbo*HPz~yXg(3C z>ojq}Cu9b=YhzOqn&N+5sQe&e^yOf0;oK}0TP@oOY>4aYZCxgMrrR>;e%V5Ekepw# zXyMirID+L~okcYO+BJ?Y*$tS2IOPdF9ujjXq3mR=yZ zeAm~ngwzEZzfY;eP=RBbO9aF~uYx_}T+?US^>+Sw{Ac{~YOmkS#J4HaH(SS4#ev0l zeGkQfp^sagIRD{BZ7}-oA}NPV3dp2#Y%drrU*G?1uoq7d_I%PgC9T0sZ}*>`)dr&k z-Gr^a|7NTjXew9!XB?67{~gk-^tI>W8mXi5dF*lO{?|h}miFggk~OYGW4>qn z-#cf&%#N1EzVHw)krtTxFVbr$An=LCt?*2Xddc>GFfXxdHSGU>wU#I-&Ien!AH}GDywA_{=(Cm#B7gam zMV}iiuF$ccch}0oUPB+mKkk|qoZm9p z-MGHh_LeRoIe_EFqtpC{e+~j~wz+Y1e3H_ zx*6HL|IX@aQIolo0B5~>#OIkY>sH&5<51UNvJ(H*ayRlXi?q-e@bK_^3WC>9Qe@?J zK>koZBd}~hc0v3{NA-LYy~w5KYVqm9jdk}=yD}N=QF~q+YipWprQ0Cnuw?u1IX!}w zS)}T%##X{-Je~FE?BwmH6B|V`!ORP8lg|dh^WPVaH?z`$dp$(0=dr8Qj4X@_`GP-L zBAuFWaMvV#EAnEU5syEX!gOB8E}IHJd=#xd5!$UsnZGjohqGX}rJh}7WHQ^Yw2pOP zJve_S0bLI{G}rqnP=tJPem*pKBI4Dw9qWYS+;r9bxHzY9YwIGe{E}g~XJk1f>b?kiZeh}|AF_YIGS^LVWGpmE zlpG9pfBIXSe6x~VC z1TY#-$RGM5mee4p^9?THL)m9avuV}W2@8!l;wYk}j~1g}W9l#ORE}3KKdL;7&uPcO zyKsNu2F|NwsXA+2lr{B4K*^~|FQam&6Gj&<;X$Sr;y7#yELLB7ruL|;Vi2L?+N8?dpcOJ zrcsEa36{foj9c&PwdF5~i$n#s6>(Z3=38)5f^9e|WMLGaD|lP`6mG-UeWSr?H-xp@ zb^ISuB2OQ@rx z;Zyr^V) z+pf4nHm;&vI-v&&eDtB1GtP^yuUFA)@q#zO@g+B>MmftvkF7`tnj^sHnUNDs;YX2d z9N8RcH@ zAS)kFxWEoNIero07b8}qxfq6&=~}x|<9)HF7C&Zb${w#E354N5dI4d>9X@&hCiy&? zSjdUOq}y7(*d~s>oB#l&c?D4i*CU8Z3HM`QVxncX3_0Ju&M+<&>y?UtZ@ejHIFzd~ zm3IkddMaD4|L$wkSVYwbCb!{^Dl8Agr+LPFuR}!OFG;u<7e+>TA~SPB=%wqTGF=;@ zUngs9OV4(zi}XxLj5k&KI@PhF{L1u;H829PLbd^omjB*F5+6qnU`ry%hkpTWhBrqW zFenVs(sCfZx5sJ`Vk%INmiy0CnRQsMA@cTLsi#;wzrEsp)f!v`Z z(c8B<}FRy_|LpM+W8$jB^g`8+fZ ziJ7Q5pAN6go07??E*u63szVIxv}51>Y2rGhzaje5mbpZb@a9d6bvjZ_->YOJ(qt1~S<&hkmX%vz_83$o#C5eQw&kQueCh_zMqZT4+ zR;2&{gjGNn+E^otSqDLgfzunjZjuzXy1n;CfFwd9UbqE}t9Io4+Z#b`Vw|`Wjxoi_ z`*VoabbrSxO1>?!;0++$yfeP~1|)Ktvq4S`!RnS+icDDnZ?t(3HwP^wMH7`yYf*cv zsd8{xV9DDAa-fz97*Ty!kl@VD$_lSKo{rCwCLuWCJ+>%EmQRz#0Apyt`>i%746+bQ) zo#nSwx}L?RtMG$wm(Ca3w4bnV+a->3Uqm@kIciVJFEVEr5uuOzl0N0%i0E_oJkVHY z3H+afbe>dq_CLl3@PEl^0w4qs^76}#we@f0ZxL4WJ(u%6kefgU_Zyyr8^3~6c6k#e zTxykQ4_F=6&{lY(bX8k>7K}& zGaIwON5Zp8HIK_7bTTu8gD7)lS8udxAxsGpmcCK8@UXQnlkB8C^;X}8!Ni$Ee0m3p z^irJ!u51qSsqb?-$y7m{IO(;_1zgh9Fang7dvg50PYd8|W983^e3%pg*8FF)#^#V% zZgcq=8R@+NZX2HZm070HyYv0_H_J5nDB*4o+2kX0u(WtKMZi& z{s#5SNf}k4@rmbIGlD22zN}C28i3LLlKnC68f9Nw)M*RIH+MrKHa0eV%D;SPO6j~h z%*v{^?3FJ^_nS*$RK{;m1wdqrn<^T5eKH`~Mf2E`3GTw;Qryf60y1+U`AuL5l|8#& zE_oYOwkj&(O|L&j`zmI6oGTf~1ZHaV>h=iy>XOpdL0cTSIE3b_zs-Z$v z9g3}sFAa^pR>e%iB#>PW80w;rTgq$c0k=Azd)htO0o(_7@3SjrGhN8eon&lus4AUI z=5#DWL5p-gP|tFX8UZO%PYjb8AA+mEA1s| zY|Dm3YxU>2QtD1ILVCzzr>{J)eMz(fIPR}Kz=kMKA9(xt71psjJ;;XuUe26a^!#y8 zyV(TbtNaLA{_s0WUX>WAyi*oo4Af{teXR7=%^c;ADCeD)u^gk2ZplCJWeyz`kJsX_aZPhb7xG`54^@om?I^lr2qAPj_MCl-06$5 z*Jro*v&_Al-}4)jT(QjS)8KdC!e*Y={`#9nIk|mjEyP*1ggMsfAN4XxqYd5MtfT_)1VApv-bimD8++q zO+2gSMsKUWO#uG5nQZFFu6buAW(E`2d=0R&^vYu%u?v~$i9CQ%g5O%gT=~_8J*zRe zyJ_%>KI7@e`P;dV7gD?Q{rkH=^RCDuLQ+hK+q;XuCi7R7^s^@dXTGN^;&_@SEr$!Q zsq($ogZ6%2S>KB>^VxzqepkUIP>O>6)2z-S5`W3&OrQT~p!!de-QQR^CWm)7%fwxnbSUxc#jkHi%Q1w~v{wT%vleWLF1R0C|yWVQ% z*(2@!b8n!-k*{rA34SwjvYl%ZaFI6-`5Y-_>>4rqVzM@iY-cu;V}WY5%~5u?@QCpc^}L9lw2uH5wZv=>Y7EgsGU}5MCmW@JEn{)*P(yCZmlzfN zfG1Qd#)0ib51Q?sMD<}itOkdC`sCHPkS$GhE^rAjbz!{!lY!7#uh%{Vm`M9@wU>yr zLCj`)etym}l~h>$`L%eOJ;D%B_{l3WwAuG_-&yfrC-2aw?K{k0KYdGN(Xaa_;y*_r zC3~;$T*&ON1+`V0$D}c&b450g9^FvBsIXHDu8qV}U_r@{JI`1eBZuD5Nsw!v% z3)|o*g7(HN)gRXexZ^~l4PxtInNj+c8RLPse*j2hb-5SGaP zvP4;q!Eyma)$9X+M8<)W>!KPK!gc^8`nYD9`O~}D$zfD~$}>m{G6*E_c5}hLV#G z*OTc4f$XE(`7x_XJLEc*Q;)r_D9FZ`LOo!gS4u+C3;DPJ@-X@}Y&*sv**|+=Ih)h3 z#hq9>z=I%y@>%5Ja<48~ASvY82_=*C;!R#i8+(2$7jL-JT%C;CoSCsT$NNuZqrIZ_ z73PEEzgbdv9RZJ7y9Dx$Pokr6HyhCAd!-57f74Qvo|k@?S=gwtxE^(qu?mU=sF9%J z^+dR?Ic1%4pbiO#7jTGo-;Y!y(wyG&yPX-P5ZIuX7lGgpBgf{ z{O@iu?=3_x)=dV7l&oCk6E1#yg}k3sa9Bpqx%$#@?H826Z0o0+h7mQxT=H^4F1i&O zyZaHcELZ(C7ZN)@!r;A>Zs|uZ4BxMJy|qn%S{mF5=6pW27kHRKqi^Y)SuRR?L1Qa1 z@8Yows%2Dy6>gsZTDhbWF=BPxSbfD@2*-XIj9Nl z(I*3e*O?NE$Ebs|DKZ|kDQr2 zTK%3QPH?Avxz@@ZL?JpxKn9$leW)lK&C#P{lt9X@^!L&S(Mi^kk@GGCH$`#ZD*mHc zX1a0RkWmVzXVWeE4>7aLPBdWHK|41$rW#Jjpwl-eT9}FyzYzaj*3MU?80KK?jLnCo z#=}z}XWUL@%MKD*Vge=_zC;X)ZD1$J8EXP+x1s$fCuF(VNX1GewtjY05vL7^6GM3C z3%@XcqY^XzB`&mjYsn-^SjJ{|~PfRopy$<2hO9#<& z7NYCg2B~O36*YpWhe7EtJZXG&7s*9Z$VB31U-edOGzjHpd>mK|Rg(3`A+$&+e%i$G zcj8zCvY#cTkmarR+qsGInMUz08%Gv5c?k%;EMdVYpX`{#$G^^sia?PRB@Vn?2+MUx zImr8N1ez6jF<98Ai#`C6s+Pm%v$=Pi3@E*d?*0BAsv*Xl>6x!lhrPHay$=cs8YvFR z-y`lci&~kmJnY_ie$;vKok#hI)u!ZN+A&xv8mkFY#PGAcZMjXIk)!2IF zS!-jQfXGOmjm=jm=4#gN6DH5I8WRlmB=CxMa;%QH?`p`$b2B=Bx?kG|^C}%7z?1O4 z0#``rmOA1NyRd@=XQ;%k*e$ZiH!1W<92H|Lju6!~`Kdgea4ba(X-4{eg0oRI57)yx zjR!HWmd%%JY*5OuV&SKl-yv>s;x*&pm`pI492U&cQO(`VJz|L^hOy-_xv}#T2S@M~?Kw zr)o2~4Wl{DvKbq0@=LYsv_AnL> zX#DgOWk|9D(-n9mc76jrB{5{(bCqFXUzqzHr-Uk>duK4W;z)$bcx}>_*Iht&{dp;Y zTCSzz@*71AgO9gCV3%sSl@E1rxLel4dQ=t^3=q;~*umP!(rE_lq{e!z)Spx&GQwk_ z(nb;pNc@8CNXLJHsahg){)6HqO4t}(esWH;Xtg9^B((qSm4}uM8t37 zYsYXd)`YbU^OTPcB?vul=L}4sO)=I^Zw&FtQ=?NC$&1qw{g(~e#Q{WYd>@Uit!F!M zc}!hN7-BB^<=0(&XBaF50y3S?XWLYCYOS8H8DyX%jC>5D6;Yow{4u5e@ z5q-li(2h0O028VyJ&cA=9w6-U+17*5ySX`I8C+Icefp4!Qxu$%lWlP}hu)Dvn>8K+`(++1>6&u$w=kp``*E^t51I*hofnpqce zR(CI3`zGS?4JV^PFj$_RY1pAbcH*fEw>+v7xGwWtL)yCGvSMV>M|b&ks*OqVg42Q! z|JjDexW2n5d~uPunv>JU#go#aQ}Ny{62b`cevt-kjOF4c=!7Y+t>;d(D|UmRmrr4%=eKeTz|hZs zhkfzMDI?0uAzy6hJZ_&R{BBN02v5>Yq@-=C26o_-b9ukyC1fQ||ic=y$k;D+Tlyy{=eqv*rlNJdLy;G@7 z1|(v~+txRrM^}uoOsUGsdZQu2yj5U_x|U6-@~gU&dF1(DmHF4)WQa{Su-2?F8xC>zy(mE{a&CF){2fQ+kk3aq4%1+jE5YKr|v=^m+uA zBP(n*pPH2Cq7>Jz2x__|&7%za>8!7>208@7&kueqb7-ET;K8DJ+#^qMC4Tm!=n1yi zIP1i14g^g$1NK33qD>1g0;V@W@7*&fT^r_(q5qPeh_TO=_v~0P86lS$mA55@?bG~@ zRfvk0m%*5g>1eq)N=wVsGQ*uTb1&qE{`FCW$VUtAw*7HJscMExYyEh4h{d?}!@Y z*9m7HqFa^ST(Vo3(}>*sVjQpQyI0a!X6CW9?c4|X!*sGTl-KWd|L*M`_o?aH^t4Uy z9pbI!asF5;@he|b%Y~uiBX76x54f%k#u(tl#|-{JUhF$L(rOsdQ`bz z&q+Z%eQu_N2xMYB3H^}Mp#;>ucQ3jl`{|?78rt<upjFq+2sGm@W_BC-i$^&Lq zUeDYNlL)awOypN@(ySI(-2mKIu+*z8y$aBUsjhm*>M9#GD~Wwii~ zu(!pnX}a{dzDG_VPDY*ryPo&AEWXYTPDLW)Tx6whYLX^d`!}U;qUBb=N3Ao{2P+<) z3qk%z^OwyL*r6YAbU_vTn=iAKbgZje;plRVHL!gNo9g?3M#QzXSAQoB+D)oq;;)9-kYOxk;nDCqF+gtsc!IUj#h860-|rA zQiR4la#R5J_iQ3?;AZ;P;Tvx5^b%WiG9z%be}BHZBJD-@xUqa)Lt3;eeMirHp_tO5 zwMp^qlLR4-gm<0=sX=L!c1neUs;cO`Zt^UD&pSzV?mTP4BDS(R?(q;~r^%m#@;~P( zW%kneG<2g_#X^&D{S%-MW4?Qu6U=&yXDI;%G!56+01>nP+nHQN@0mBC=W_yTB4kC7 zkV&LNy$AyOYmlMXo|UJ$c*x3|mr20X-K7$io`-I%gn1^`$-A`~F>JwiL&7;8Luplj zS}MkmF~n(p;#ArHdmb+Ez7^ylyQv#{)x+w{RgO4dOUjf{wmxorCLtK5vLg(FFW zXe*@*O6x|=?0>lL$q*wxalLO9N>>|7Wc76^Th#5!H-)fU1qw_B(e$eSac01@SK0a31 zAwiEH6jqX)KMo6@!M6uaV!h#Gmc`7KZ-A0@p`%LZxGUTiH?pr`Ig(>O4aORNlTr+* zvVi)f+tZ4Qk~0eC@)!>}gd%;L9cxkKp}(Xgm!4ZjL1J{GSKL-QrDK6137S|yBlCTn z@pSRF`(T62yhy-nE(;dK?#OhK2T?wrzcq>UN7*n36PJ1Pr0x43V%7wk_f6?=2PfVi zRJi60$1NmrCC#(CDZ2U8aiOUC?*dxRw6pNB$h|{Z8_5`s^=$fSn)--J>qH72U#N8 z^d*$$(tI{qs3#m-HH_U-!0zF5_u2!^%_7lPf2~(W`(j%QC0t*?c(!HDPK36fqcL!L z5S#?DQQL>ocA4L86~8bcRgKIn}diJ0|C5FdnLbz zI+*8*1TdNA!KQl)5;l6uT~geoL)l9mA&EEugY%%m56r6NvLA8`b68&oaoD?7TLR)s=iXIddXH=Cbp-@-zO z2;WWsinv5J29ma-UJ5WLQVFB_E2I(eAEJ{{d+4DNTxW8s|7ogZpm>;VJK!-&E2wVsb`^2_C(q*zR|f5b zGZ4vf`OJJ6Y1pQ9+|~d^&np&ttcfMa%_o)#yq9GUf6smT->=^Fp=t)cl!P@=i*|PZ zgB<-wZvXn`YKYcvYRS5&{~IlJ-}m2bHY5EV{+B+RtY7}UCHKkxCNR-3`O+u!m8znq KLam%t=>GvI;yhpg literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/autoir-quarantine-file-1.png b/windows/security/threat-protection/microsoft-defender-atp/images/autoir-quarantine-file-1.png new file mode 100644 index 0000000000000000000000000000000000000000..64feecb7e55891393d7499c8b62b44a46e26509e GIT binary patch literal 25900 zcmc$_Wl$W^`zD&;5?q682yP(+4;tLvU4lDhYAAy{yC_u$Up1RWS4SaA1ke*535 zt=(I?aoBKE3sf@}{sK(G>35PkKkCKmm{1Q9q!b&}R`ef0{n_vQ9_(6QM3)hqLE83|E! zFT=x3WOc1&|DCkfLUS&QadS(B!go4}<_b!+mX;NCiRPAuh7cci&|&9t+k(qs$2BIJ zEV4@6S9k>VILp`g5;h+tL_hZjlB3_HKi)cHUbDv@TpB(%jvj9=x$Fzy|Es(9eD=S8 zfUHqNAFp_~eV~txzQ+Pk+?1~K3XxPt@Hu2#5Bd=5dk!(U8F-#K*@514`E5MwR2z5q zEN};B2>ECpt+mj4vS?Qun}mnOF>6(Zn-GUm!ceTxPd%YXp<#^4&ag+$pWq+3O<(Zqey^*WMLp-&YMg{ z-VV@CR=&mMt%=O#wG{RNgei_FqJfgXmW)G?#NIGW8H;}ZMK!~B$;kw3YejiQMPD{M zU5f^n&-#B*k%XR#Sqp>28tqqEnjBUWW>{HOYrxqK>`W`$63$(MzBkGXT}H>j!-pt-+3@+;rA`OlBH;t+jcTKC`i zYd$(vC}jXuiK_yqlaN~YIK&)*$^P>toC4{?ze)b+64LrwiY2RK6Y(^@+}QzD_5H7h zV?Of8*vQm0U0s}zO8C2QgOBVQh;_iY^4J)?UK?&6ZbMUf3TwJf%|1Jo>KdAYHN=6a zxxhaf_W$vAkei_I=*XeP`?9p@>a5NRLLnnBKl}DM2(=DuztXH?3CUuusHjj?R;Efz zOXI)SGBC(w(XE$`A>)IQ+Y=8&!qQM+l?H8F>ClJ5hs&;~g>A>D@h(R2DG``jLqlV2 zEfv1-vz@hdTu)EWlMU+gh0?RSn3&ks$wqH0#T)De%7=Ail4Iz-4_K-H1p3$pE&}!D z^Ex{_w>lm!HLSe_{^0k4Y~jm|_A?_-RnM1QDchr|qYt;|+sDt3UF^?W*$;Rn<>ePK z-lxV5k4sgLKhc^Xr<;QX&CNG*5ajz$6B&GYf!BGIk3-8ess;wE_t(b@+rhyIs}Q4J z4nr1Efu1BKDUrJ`(<>|g>R? z`N9JM&!Z%h-q2ysu6qMiEUaTslk>B)i%&380gv*nzkf#xV4s^%{qi{Lk@SRdZW+p2mBjcIT^8q*+_&1)L9`351TXl086f@$0aUSh@NPSj~eXbL^=k5?5 z4Sy3j)Yx^(`xN>R1U|uXYbh&}>pagq-sKFplavf$Gn0JEem)0pY58w!xe4*`Xv`!e zCDDNo93NS4AED2Fw;j-Xp=jIlzvHctqQ*u|{~b^NFOd6}FL&S<4{aWM-Zy$=7P5T2 zyKJR230BFIvS~-zb9@+Z+!Z1h@>aio8+vMoT1u6YlJa%?X#)$qYrh8{e}4#lvcH`( zdems~e{4k~8>IflVcLgcaD9J-{VgMdEFvNz9{dD(Zqe1k#=*%MyoEyzCtVmH8j8DK z^HI8HU|=}td_JLk3VNsmUqQBD{gK{eu&_8dO)A)J$FZN%LVz2suXZFd7R78cw#+Z1 zBzKmfwKc=rRp_IE5alQv6O-&U^$5J^*5dWl7s@?;H5!-7Y)m8UnVFgGe~WdkQA4%D z&M*ms!4aM}n~QkrqJkd(erT>gKS7_{fWL1=;tmHGv?oYwO!9#9<>h5-%uw~jZTJTG zA@*6NqSj(Gr6fcWOt&uVO2)>rZm9V4gN*+fqj>D zp~wxhjkVq9{z0Xf#wB?@H#@s~x9r$eVS2~@)Ze9yesQ^Aq;*Z&-Rn+?!X~)Waevg- z8pAB|gUVs4UIvrw)34Fz?XCx++eL_fA)COdDJp5`=|5o5&l*!?3RkVP^xZ4z8{CEg!Sv|Ecc`S zChQ2vG4pmtw}0hk_O)c-u3q>Se9GVPbYA!85Okss9ib+IK7mZ(-+r68s|@d05gpij%K#Ao&&7BiyG4%3_ z5yj{eIvUI8@-Lr_!_kRIRB~hEQw7Ol3&IElv?+6s_s>Wr=Rs5O+9htUtE2B9!hkum z&k27Dxj&5smmgf@BxnXx>=GJ_IPi}B;1pj#1z#UO8QeNPA9mSzzv=b5LNLJgla-ad zKprg9tWZ4&M~k^RT^4!I&aM@Z2gRORXW-Wk{tPBR;t~nkKpu;ak8dS!N!rC$B zGvzts3h{d2t*fc2c|78N{LxMy6B~OBRvT-v>z(VD-KyZ(ldPY}6ewDN3ID3AQ(M?u zzMv*2gOHl7aUpjGT%AHTufx8%M;PC;s|;aXox|H_1DDRPYw>JHi_e+)KvhYxdKV7A zvBMmWoRVrnJTN-siYEaej#ToOyEj<>KX3b}zkXrohuVML$G+;S?q70btBP-VZ8F6C^YkJyE6M zQ3C0z!ClkNlB7YW-(~KK8yH@4AB2P_u?adILpU`&7Ux@8r2R5+DSaFiwx+phVfu^8 zuxpy0XAmMQdTG=27}$qTk(j1)S^K_Cr8K5dCKhktbB?!RH^P*cp&*{tO?4KVM+51BhArY@^6OT z3cXVaT!Cd*Z{>TMA3md_`Bdy$4u)O)yPW<2z{?^6F6alI6hm%S z7-vMLrIkaKcz!7xA*9z9DR?8x*LPPK=I4b92`MS>?yn9LFD~2+zDQ&tO|Y}Er2sep zq}R#61IbPu89_5(V`opDm{2r$qKP3ZNi-Xb*>lm+(NUhpWkEut5nBKqwg2OH({0qu zn(k_zuc082PeO8}G81vy^&r$O^EheF#KfhrK<8+sld;Ls zFttsnN&Qm`1sqD72ma8VJE}LP^GcViUMxmbx^bYjAUjZ!8pwreEuSqM6}HX}4R_d# zoN~Ry7Zx=2Q#Ogfx9PKg6B+2=y&KRw2)f)Ogk-6~RY9eFmlaG%NJv%!@r(t>fcL4kufdBdYS|wvE%8Mt>G|RQw z(Emab8yi0g#kxAIwK6Wdx*F&2Hze|@w%bI=P^T^@22pQ}cDmz@dn z=sd4$hsFJg!ro#(X`8F3_Ure zE|W{B%#c6B_^gNigshK+Q&`c1=ulNu96OJ8LH0btOtl4EwPo(;-jn*C+)B^=xwB*Y z=tf(IfRHI|uf*k8F*d2$ttuKNwZ}lfe|Yude@&VFD+*LB?7pmftU156c`t(noIW$6 z<6Rf3HiPZ8zf3+qpj`- zbc~EL21goYJ$I|BEPWhSB~&D?f5+lg89s%ydB|v5rj+F`s_Lrd4$}7xmNh%b%fu%t zX5it%=Fp;IVx|w=>zhXX847{&?Xovb9})9ivu47>+4xdJOKbEGr`c?@RQY0~Q#Tv| zT}(Hu0{|=n?6OM+`r-I+x*HOSww~_p!@;PV1xG_T!((HU4)EFY^O|WwK80)S%QLDo z>e#W(W-^X+J)0!o^Yh)k$IiA#>FDWoboG1VTAlM8^x8Zs>a6dBx#PMKoQ>BdM;k_o z%u`%bd9^Y~>am+ESxev z^s>_B*fseRC$;E;N$=eyQ|R`#MXmdRrcS3_+IMSrh3N0u;IS+rAG%)De5C}u^U_kL z;gOL^cNSfV>75Ikolb|<+)>ZtwPY`bc|q5uuu96MGD=uwvjg-8XkybaMTAj{8P6FgPG9;~d}GWf$ojsO@!mcwKzUW1Ez1< z;ZA#+RcPBg9X3+=)lb!5UoCKPa;g|ipjh!4ZyOT;MWT4F*?W$OZ$|=a6paX1YtgeP zFPDZArw=H}w!YeNWIm@bNu9cPV%KIRK~P^zqD~I=0}g=Re(3KO>!e63x%% zP=0gF&+ENDiZ4PH-m?kcp`fmAHD&OS1~SxSN8 zioeM_+D=+FX)Nl);{M8GSjROTt$m&k8zV^(WfyAhX*)_Qm6+m;ds-aWQ0!ViVS78( zJXdecy|#+-^!yjB%9VzAdu4idHhOyRGI|5objoDU#DKcyBD-JWOId&TocfWzy1vSg z2LT?=D+zOegM4ivz{lUMX>QO~_`Up3dPfm1H}o@&vNi~XAvZJ*MnP+wUr<`A%Bl*J zD8{k7gG>E%a0V>5rPwfyh_+|}CEZCEI22B{t%~%Y`Z)^`LPc` zZUjZ!_k)jnLe9CYD+`#towyyp%XS!*tEE8fA7rP*^XCQe|)obj)0@pQd3~?QR~A2dh%dI z4&_bDc*D`COJg$c%+6&$%Cet{IKIx`PhvjHZ#^G7p=>S`;N_K;r>Eb|3IIIm=f>+Z z{`|Nj84eA*sSU9Bp8TcjUCMIZE6=7}7gMGA8vK1B*cGZh+=1VyA@#J3k;T+q@i!GX`@kr=#W~q7$`l^-SfactKGUB3TQk4sti?kx2jdBCK*XB0n!O88OFa-g(r z!By{_gJY@)rU)aLZ0=#S+dkWHvNCt*RGo&&P(h)=&C^pP{*}`kf-))*C6fIE_uKOr zAKdPI7p^d89h(xg-*x51`jNx?X>r-x-7%-ViTTeu2qUj=<6Ai;8U9?)$mn8sKHgu+ z*xOfdj5FGpvswEOju_1&M>+yxUqW&kbr{yd{?;>no9Fc)=ZP0Op`n{o;GcE0qnSrc zoPdK4SG^~etE6CG7j3bDc_9)h^7yz|+iigeR+{TOgwv--!wrG`cv|83pZj0Qk7Lk= zj3CxCvQh3NIT>;S9IjOtE)1vm03p7Tlv338+Uhtg6iw+m9jJgChI4-X6H_tJfu^ zB<*s6VB8!c4;N0c!a_pX3YEu3P$jUjH%frB>lvb6p87X ztUlNOrnZrf4AY3S1-BfHDei4rJuXWnDh-$y40@ZOsP?wDW#;(>SJ3p-5O4AcRQYs7 zbat9gqJq0<&od44omBpw26EZ26m4!;qN-AjjNIh?-KFv#j2~@4yQnnDe7wA08tvBT z-tO7x>ZJX9R91-ox748KfxlJus-8b`f4w_MvA%Y0=@-o2jquHVEV)1_0k$oYoEl=U zMx}yI8kfZxT}fHl%!sC@X6Z5sDd~k56Z8DuzDCa1OqWAz1_XJuSnO)7(V~2>rthMz z=Q4|p_O@LXy-&HhVvAdS7fE>TmCk<-nOPZA0A;8Fu7zUn3Ng{l`W3%`z}DE_jLWZ5 z+1e)inFA+KKF;^Z8^L(niX9x?4%~)i`2^s(FReg5j{%&5{ zF7SvnI;_&XP=c5k4}!bzkM|dMMXQ&nB{D|h^q9A0}Gj1R!)15@3uil;p{P= zkf5*4^H@5yPV8eLo$YoX?4b3}Ho{KaSh~O$#f(pEHYKF=B93iaE!a4~1#|p8gYMiM zvc>sdmIit4ojdye{{6oy!^M3l#u7J71fNz8SoJ>IhR{>o$=4|IIXt#XM0c&B?!Y9` zGpRgFf3L$$q;bn#C8f%knzpkTHA?Is9GGip7vt3{E;hQC6&{AW!Y@=tC`USMJlrz< zd659!BT!u)Za6#G%Z;FSa;wcMSFL8)b=8x}KMNahHuei~vEX98sLRV~@loF2YlT!K znOa@CtR^$3lr>kmIM-(jF{i!V`?{SV)yP0k&(CR}khFy{p~{x+F&pg5onWI)~PCmM(1nUDJa}J*JNMS3|{k zgi0X(r_r5nWuKLGYK$tV%HIg{t+ZN1syEwf|InriCrd#!t+p6_XAtXQI=Sj634ttk z8nEL2>M^UqM%Faew~Io<-l-NE)-aCYTQ4W;dppnfx`2{(__1SCUu|e)Ox;re)axxo zWNSUu1B`hNvsST2h=$ysq~vY=K|j^4#&`#5=N*&bsZUPiEIelcZm(ehzXn?`sC~Ea z2nq9Bq<&F}7{Oqs7oD$PXC3sBjm97u-(Rgf-3uI%kOZRz4D@XN6y8!37w^C;LKsIj z!d_l+{Z$k2&@Slt?6)9gH)_MNa!O84PC~S-{a3%o!m8!V7s(R(w7>cmEdMg>7nyF# z#Kh@)SFs=o0~@7njuUUoeRZl&+5!A}`aF=C0M+)DC&c#{X);rkv0iKu=DfJWeI7xj zaZEpM`5qeCx)4F5Nmgm$W}g2Pt=lHWOm;+`j40Zd96T2FhJcLeeG0mts$F3VPh%01?1ZqIkN%Inr1h@?)*^R_S~2)ock%+Q5h*Vv7)>qRj>D$hVcJI|2%JnFwb&dGM*r?# zFKBhS{Fxw0UBB%<55c1r|5nWb0hlf^|{3}G2 zw|oo^`K0J6!U9K1$CS47JkqB}!cM24Me(I!bcAV05vd|aODYVu`jvdX^}^ZyD7xOV z&DJ=xsKDNB{s<}cuk83B#WfilpB%T4kimI;XteN@=}yl~(=v<%pCm~AS{{`0LCPOg zYrG-(0*SH*KFAGK_wG|1q+2}2I0s61|2E^#oI>Ia4lawZM z>~}2jdPigx))N{)30nEvhq@vDYH>cB!tpJq*v%&*x#6Z)kDJvoe&TCl}e0G9xt587R_I5y+l_53s=w6tQ$olC%z(`0fYA- zX<QXD2u7u z!+%Ggf&YzuyqnyuAM81UOg%AbZ8&E-hdqvv5r3K&$?Ed&C-aIj5=CC-bpow70;nq$ zIns0e&T5&0KnC2_b;OQ*blrr^CQ?h` zsMF8q#0@9}G=X@1`$dEjBF2xyL0J$ihv#w8iF0^OT21-&kMkl`b(x3othfN4)xIh1 zMuklo;ZnaG5P$DR&5iajdx5wJcoHwCP5`^~1^9XaS}1UqupJQ5ULH2&5UmIBFCzO7 zD&7A_ARGsXkq0}De$eEX$9pC*sG|<7h(k@n|6{zy{$JX!FudOxlk%n_Ni80SKbtP* zPKy$GqEeHsXu<_N{>A0z(*geCbt6J{7#3xza(9k+SbkofcxsS>r)QIdl$5NYVV1hO z`q1UUg2ig9``vY!%hf*}KChEsO;=kVK7N$7u_41A7;^8taQyFI5-=n~fTYpRsw4&AVRH)$kgd`Hpa|yI)=uk@ zl6C#lZ*~&RKKQ(}w6rx8PrJ4>Ivj+Ib$1{N0^Oq9*iBDQf57sSMz??g6jqn5Sj6Z0 zC^;*OLV-O)1Z)@!dJ8x_Tv2~YHOf9Dz8?bI+n9@9&m>3sF1-=Ob--I{t+f38F<#WkL`>==pQ9(hW)^eQ0 zU}9oo-WSV!qbDRGE2|PBASkH+(eBUsAqb!33rRA&oV$C&M`@$b@Nks3ybc*FU0~?) z*{I!Ott4Xbh@f_-N>-dC`1s9K2+vvHu)lALIF15?+vmgIikr0Xhz+q?QPiA9bkq7Y7rMI?n_y^dq zIG^`Lu_kfMc?G#H8w)!^Sm1V(Ihj%jcr%)}ejSG)<IHe(fI$yu7Q}j=y>M-anFtkm+*9J| z8Vb{?v$Qe1cVZz-gRHc;^03q=kJk`?rm5Q(wg-}TuO^s_Cy{Y9^JnY>1VMU zpY>M;uMU?lbytuc30l_%^TAXs2af=MaNf`Nf? zwq#pn(?ZwL8Rx1naXB-l$=5<&p)|8+sDJfwxN1;_#DgL0Y$Q2VNDks+6 zH=Xla_0y1qM1UD2Q-I;P{XB-S7Ffe&UU4~nGKeqYDn*z1Fs|P(^-oN=&Z^kOuk09D z?Y`jGxcP2uZqSmUEQeA07l$lBCmv6*LDlCwkcE_3WT}964o3{a!cXz{h2Mw>3HP~@ ze}0c`lfElK2xm`@M-%Y9ajNjzdL8n!M{=7UqpItv6|D%%ftipPF}&WDrIHEMBjoZd z2wAMNvVBb#jq)qo;V8R()7x&-dkdK$39XwS5@hweu1}+Y>wbq;TU{!6I;{PKng3)A zo9!uqu&X)|b6T;J-Jn(dIv%XPUSl@+wV>cE-ss<^Zhm%q(Xfz#L_Egg%N>;Tz%KWx7?PypnQA4 zBz=U$_)_^Lz3z+Oe19BHXYeYCdW7CR>VYex}rO~nv zi%-y3A3k0~7tFjA^V4@kAGR28w@A@v4UVz}b3|#naD=W-1*PGy`?w3T;PR3$7p08m}M|;0LT5Vmm;^s2t`?K8GXj#K#IccF7}(WdPoV%2Yp% zD2sIL@jf2%^}u=IMnU%mMfJQ4d!UlPiZh5}D-8N49xF-mb92p-^*@}v-%9;PHVHiPei_^1ccN(dgH;H2ya?GS zw=oFT7x5S^1X?F${45+#*oCPq1;~BtZzm^JEU`^VID?~oFIa6S7#{Nj+C^V+zQPtL z*Mj}7{xzm*RdVlUe`AwZu7U*M>s#p-a2Bv!aUzEk8EmNsF7q^YEIG#+^Xt9UU!i?S zla$Q)ZG2@W6fg5zSXY?>i4Y%a3OtGb3XN??MaF4RduKy=@&PTfL4tm#HJpx>3M-^u z*{kGJ=ZW$z$oexnsdc3q2ctTQ%&!885K(i`i5;yWC7N(Znph}RqUBkTtM%)M#K4&M zYVW_*tDO$92Pce-wA42XlZgk=8g)J%I@*T7)`r;2ada)A+v~nZsc`b5NPUDk?<%xK zS9s?M2qMIWE^$7bh0Oo#nW&SH?yd^&q(}IGtDktE_uCaSS9DF85r>2X4~-v^wIdHN zCP@w5y{9wCk1%T?It%OSi}>s!vVuI%ajkg58uPneIRYfL!W(cFj7=@Qg*9l}54@T> zi`?Qh=j*fJo#U=wFvB5Q7Mk@ZXFZ&6o=`t6QtGqsW;l{v%Lwt3c0+n+N$pe=U2K!u zP9k22eUcz*3>1o7l>EepJPIdai)lx}VXVpsubK6!A14pRqqC^<>-A3Y@AeH|JpZhFW>H~HLy!K8K;2Y)I34N{hY7ckzX7|w!B{+}DGo$2M?j2>%A1t`!6B;W%0$d7Q>e`MUf!H4Br0&Q z_xe5w?po!?;?8wCwHH2a@FbBU8v2g$p%aS}210~ipQL0Fjd5E1M~M-3vT$UA;E_T2 zvx--rv89O?^5%+al|{7~99GcK^w;&Qf}u^8;dr7&T(lJ7G}oUuiW2Tp=t8~)iXrAu z#WRF^{F0P{57LH9L0yp0#wK}65M~l02pf^2-tju4^yMt7P4HmisNi3&{`fvhU2$5* zUnQI|NuB@qBdjxg5ZU&1JcH6OQCEBpjcT_w@ep(0NRy@4$Nbmm!B)XTwEo)recfCO z42oIkAW2>8o8m1&tE{)z~G=D)zKd6iS5Z9GNe>PslE4+eb5$!EuIQ7j*BtO>uEWK8g zWEdURqq|M~q`Cl_U`fP0dpo3r5ObiG#aNcaLxNb@FO;AN%&X0!=rehJV(u*gi`j+X zm+XKum3r`J=0Pt(6#kG1I3-b0x+pCorbb6l$5*N-_EPp^${0 zuEJ0N4A+s<%dNf%oz__d706Uh&&_RD_<_9qvJw(#ij=ai8U^1rIYLuPM`T~&G^4VE+AKPqaz)%7VWU>!+fZt~Uh-7@=qm1_JBLUnos2PyWeQ5S>(6b!RpiZx? zZD%#g`~`0H{5$p*xVqFvk@HGj9jzYN6Y%|$h(n+h_SKe(A*Ke>UZG?n{`&nV1D6Nh z@{;}j!$Z>l$yZcWRi);Ai5Qr`v=?@hAZql1v zZ#K98CY05Urm)4Iow)$%*0}M?N)ZfEqQ0ap^Tkdft5Bya8uPZOyjF8RY_4d+2l4)fDwN42;V)92!(q)LN5AZ-Xoj|BSkot09KoP?;h;QSE(v5mwgm ze$G1R$ir_`Q$XrxqmAkf_4}tA7TGFncIS2&N%l0%p;K?2^W8#SJ?YBA|6%Hj_ZTC? z519!`L%g;0JCV&)g{tT0hyzpiD0_0~69oE_zad0+N{Qz=W02uL0+JMMNFU+QB_}p(>Yc`0P#%C6awmx^{u(!7t-!P%7-)!93 z+K?wgUck;f5KCH=vIT(gOp8ydvU0NKOZ6oa(Up@#3@8=s;TH-tZUqJOF2G>AckQM2 zO^*VSse!3sLWXPQb?oy#`{fVR&B3;VO6Pf_G`R)#{5hSdLBO5YwYfFvEx z_#W*K;<@Ut;463AgEgaUhsDnpi6QBafk|z?4BM2+)nQXT{CSH?e7=VrU4xr z3Xzy?bW8UUHMjq&s{piwm1#F~Js);O~x-Lf?>|ReONKX=zh}gvT>sNK= z_*9nWzkQsLmI-ts7UddA4y_6_wNdQ&J|PkCQ~S@==CPa{W(_(Z>v^Hy%MnT_N+7Ye zk4fi5YFWwtq2q|12`hkB2|?E~U>QEuFMK%`0)-g)tKy-gyniEaw9fZ!oA2c1b(o^Z z;vaw&uK`5Q-t?Zl1l|9~7G(o@9H?%gczs2WF@J!V{z2gXdAXy0A`W_K63E1s`U#XU zpl={02?0zpJ=pyx=+Fux8yhVEGzZ8@q0lNIqxV%7JEh8J3d&fH|6sEZYTkTvEM#`~ zfp2Mc%l_6>mA7yxi~YwLceLNSULiEni;U&=ec5=N$WD+_?8jej?OBS__*fBN zBfueiF#`DcmpX*9MPH|J`=orx7QF52y~wt=o!LVQfFsu)B1TNN|A&Qt-7R%Y5v7-)8u>%UuKX#?lKDyVU87NMC%P+_lwJoHXAF| z!ZL*lX)HkUWafaJ&qYF$MUP3vc44SI%}*`v&goxM*DXfJ8ZhJO7<|$d9h+CkDFG$c zwFRHxFhLT1XLN*M)Ij&RG^EB`<43uEr+jKO5jw1|ZqY#f{rTUq`QaWaZf*n8HuLMK zw8|?1=$&iCcYRtOp1Fy1={Ym6wV5J?ITuk{zsAS%@A|&_cY*vyx#K9pqjJwZJ^PJ^%Yj zjz_AflEV;FOcA+0sry&sRb14QTRvW1%QRq@80-jbTQG&Iy;GQd64xh1L#en5b~Y;j zEYpE#a@K7Ni(1zmOwd8J(I?v~1#}`;*1-WO0j+jrN&5)qsBp4#7FT_sO(Zjnej&nI zUq6aaQR0otsI*d|Mh zTASEfaFt;JtI#}~4J#|72Z2SqW>gw?;qXI?Yx|EVB18)lpe5z&tMQrL;hGN|hMHse!hZW^X74yjUk`R&RIUB$Ex7@T~VB1=8eAhl>brhzm1q>#;nT)XE>Obx zM_B{$cIhU9qotDEZC5CWOHvU(%{AlcFS!8P%F|q{V-0f`8Rg#*6xf#_K@(r27TNGv zH6;WNd`z<9X{pT3_g$Tmw(VX(uyQblA{j75zEbz>=T6$mFaBb^481(q>hN5f-xFcr z(+UqJuAGq%I-bqzI3F*q!6&^fzX2HpDe3-fnZU^9h^Q_ZfmO(U{9NcXdCeo1wE zY7AxW;XJobZH~4NNuIE*eF2+Z{y$qGwhvN7%0KfC8VsUfB`rqXT~7KYP6fBc!hx_hK7` z4d!nZGrwxuVt57>dfuZ*>$UdZVV4$;8xSanA zIS^f96uRUswG-9pycyd1^tm{JvQlq$pU!;WQXUguHDF0Mgj@$=|da7D)3V zJsKK1CCiNPDDg^8*89iZgMm&{l z7~F&m+reky3t~q6*jQN@Hk)J;>7aqV-gnXZO$Gg(_&#aXO4q;HAT$+%Hu z9$bZ%U3n%Mc?x^!Zb+{l8fv%;(gJtX=SxuDB=$Hq-Y97b@o*%QnsmK z{byGSX!}6_z{uWA?2|{l8#d7bqQ81pQoUlA`CDS5YonuS_wxY^M>(h?ZCx!F<*i+$ z5>g%wEzdaMHcYaEZ~V-=za5VQk;RJTXm+eF9oF~n<8E#~$>=sIie&oedJzg%1)SL3 z-t9*sIj!SOU9P3F3`EigQ!*i=Q#`TzpZ*N4I=at@FgmCki!I)eks_F)bm0BCk5#`= zsgsu%Iy*Zn?ch+ECGw-$u*+Y8xFIZns;5Wn61g4(0^LFPZeq4SVjExiJEH=)gnvlrDHa()nBfK)0i-^9J zhb1!ka3Uieo{F{F_*t~PxOnn#VbwWYLA$vAMGZ6-^DVb3z`v^+aWoi`zm5L$0~_4Ito7tlb8t87MNVV^&+1( z54<_UR!5JYPeCKc!=sJr8}E&EAAOL_sP+YP{rrv&1CgThu%!{tkcb{W>~d~l(_--L*v652d1MycCaQH zWc2YQ1U`f!lCWBSGxGdmVdZ^WMiDL!MP)P_EG0R)VEda(Klk>%RZPwX6v%FPV*=*FB)eIt-$RX^%iwv& z?Nu5?Bl7!qbz?@zEGiQA#@#?9LvdhuKRyvrSqKtyc`s_Wl-92pa)ClZ0=WJnFKrQ^ zCvMg;>>h!x68inZgw7F`i&y|gtoe;*_B$+~q5+GI6OovidoH4c-6>*1>_X(%7jtLF z8}rCOjBvsQ5T7xxHo8ZB}mkd?IMA9uZ{qXM0~-dskLLPRhG=p!ZLX7Zor(yMfK~ zq#BmTYaO)!4QwsY4!W&Oxaar{7u5NV!BLsB+X4eYFwo=JgCb|f5%NK9B$9WXB|D3*Y!K5gq5(%{pG`){c4)&t47?$d%IoKv z&w~>5?h1^ivbsXL94Rq=Lb2p~ZP?BMV1XE)g0nE+w4TDILqi)1&YdS_d+q0}>m;Z} zaBXo>lwCTvB@RYoqfVilC%*S85zE=4M^B+l!E?T)VnR2F96PNa(GJ%J3uMv{88?Je zvGZtFpw0Arp`;>YOcB-4C}^DTuXNwx59kHejCn=8*{}A0^d`_?!UlzYn_h@;m-{Kh z9)zSkS##kOS;OR4jaf}n^TxTm#_O#{L0w(1fY|JJ;`fCagRh#1GQV{JoqGEdoHvN@ zStJv!o<}F8XBw(gOADES#ISc*_~O4z@{S2o8~TOBNeD+Um#xRJ-w(`fwV3w98!%pM z!!A$C-&&imt+d>YIj7rTzjee*O=H7Eh;#YvDrIc*P$Tws_w`iXJwi@?`E-|}&hG=A zX5#=uh*!;v{!AlPbBb6~cb?HX1s{w?J?5Gc^K2SykD@`PRjEJU6JEWp>h#8@&tQPH zzyH@U{Ru0xSi8;4yTh^^M5#aTqZStz_YHyetrX&eD7ZF@QA@vWQE!{^xBe83%?BTO zc=oxRFe~`>T0onHh0EDVkvLA(#Ka(EY|(N=up(9?@`SZC{ie6@*3|D?5$uBi*KsF` z6y6)!s*~yPLn%rv2c!7OTA;Kvs^VhO2?B$Gpt41e;y32MxNbpwU}rV*Iy5+s8bKnF zO9p;vQn?C){LvqfH0Ej*_{@^%VC!jI^+XnPO%DeL2Mx9;n5H@W?ES|MIprpMYRI1^ zyiS1;$R?`)4M%I8WYoJ4`2ZcQVxs;SU1&lqMM)hLJq;pNn8o$Y;b|_5GhNu+ekv>HfEV$jPJ8z&Q$1D!Wm_Vx6TR41?g9 zEn(>=NoEfX0F7C6n?GxYRLpiKMyI9&=2>o7T*vj%@>lw`;|_L!swGV)n7Stq#**jt zUPH2Y)NnHqhcm{rW5{yy&|}F?Bl3$1WPN?h+wZT^YaNd%(f}zd#xzP}NRSW&TDIsr zG11*UUp=di6;YRS?Y*P>4?TwNDt-CdzBv$+a(2d*Ic2w(AZdsu8MaP&HHBR3`X%6n zhj14v&E>4`Or%xJAFS}zxf$Yb&IR)MJ{@O2MtCd;Dq%~E82+MSGisFp;BWmYc=K{W zUp%{F+x>=t@&F%kV04rlRMHbHXg26uiUl5qg#evtq+EWXuE{uk08`yJ(r$FCQDm-m zdJ=RO`cY>(vK7(F4$$SW2PNrnHRhO&6+R+BqiC=Q9aePPG&P%DGEcZiU?@dBb#BG- z6i~)an=vhA{w)lMRmuSv=myknk>4}sZWc2*2Fl>qUa5&sR&%b1B>qrA0_2mC^0XOu z5;Vcoz8kM$fU)Xu7s}eJ6Z_`eOzXSWH`gMz$8 z8A(45omt4aVG>vd=c{1gOSHN)wo0Yg;|;`Wn7ul2v#vf~IZS^T^SXVRdCri=3cXn_ z(w%bAzw|L~4r5GKEd&HdE-6qwmm~cmUH?<(8vfMbBHFNnl~FYYrRf%NC!T?rC-qIU zlomHFuZ7C!xYaiF5Re1ZbAHEJ%PCC_K`yDwmZoPe(^6OZFL_DvAND+{H(J-8{j~*O zMzi^RB`<<5&S7FM}h9rBO&nxKETIXDm&SXDM=sAAv z9iIKA{p5w`w#QL~N&)A$*jyv>yr@(^=HMRqy_q^{N|6e6j5{mkXYRJ;-wT_iZ804w z>@Tq-B?o}i`k*h`r)H95|BI7?+dBzws?&XQo3_vKG4OR=1ht~Jb2BOmMhJmcidYM1 z=3N5?$TrHh!{wIC-Z|j0zOnvabM0?)ReWtU=Ev{t8ijL3>uau~@_!Q3;w#U~IMB%* ztC%y1;rvo@CJZKqCsM?;zWFr^Kc=GC7yq};&N?c}x83(jC=ybFC{iMzNQVeROQ)dp z&>)fnLyXj*bf=UIrF4f#gGh%UATuJ}B?ALU$G&;r-#+V{v-V#5tn<&nS_AV8GsFE{ z_cuNdwH7-Op2C^uNvR0q+J%q_+3Nx1Uci?9!N3sm*m6@fC(d}*lll$g8wQ~iSJa!U z*3_Es?(9}@UggE#piFr{N=^_H1P{_tN+wGfQB*7&3-+5#8J^~f3m~~)&1J!I%%~`X z%ozOKQxlb(K=F!_ejVi&l+hQUYSm=8J>qy;$A7F%W=|GDQF{x6Sll-MebDsFAWGj` zXmF2dRDU-fzuZ65buRtNXje3&u&n9N@2>Y#Gp0oj{x;QDFKvpa(9A-ZMNBzQ-UM44C z^5W{BQE86mGrkGFVD?L8wg}fn=CYIB8qB0r9W_I>Bl@CZj(ZlA{`L^2_$MKUQ**$> z7_YL9_%m6*8&~`8owLbYnXwmi*4f;Y;64h7D^pXN=O^+=&HDT%XnA|S=_$pp>oUto zaB@2j{QPC#SN1mPVLJMt<%HpkxFdvD@q9;7>Zf__&Bk!XL+?^EN~YWS7H!voa!_`)t#jYVL(=RHPQccbM4*BYh|y?> zd~d9Is4Z|>kgdcyLH4g+S%I~xU+5;1ZU7?~6cn`Xu^S~cqo}8&vnDDzsTnt+;X}d1 zRE`go_BUFNAa3W&kYaIncb}dgZLjSC;093h;P0?R;h2GOyLVrolEb*}qJKiv~-RX5-)ICa3QEb-8tap5SlN6W45gZxy@ z7dzCUi|@sRmNdoa$gyNMUI%-77@dCv(T;bGI~D~`L|UBdQQvG7zHiVlrt)MiNo_J@;EZS)%r)dq;oOiMH8e4$3pk=sCsLcpmE-vY|I zebTwSQlTZEL zLV$H55CxKt*xfTH$o0)!Dl6e#2C@36NL0Y;VYe(CUPTNGKZ%HCvGe4KmIkf#clg&) ze{0o2gO_C^Azr9uwcw$9txGfPV6VsjXjfQ+Ao|RQQ~52JcEWnw-@kV!w6n&Bj*0e^O#vK5-|(IiUI> zB}uSrcyzS3h#=@|ma20V*VtnUfzgGen^T)E?f$tbFRK3Za$#kLNAwIbZkBw}pk0tN+;FaM!B;w7)9>7wO-}LxupGe9jzT z7J}y}ePnzNV=sVzZ#K6?R`jA(4O9xy-|68sC*jb>-;S3?Kd+;7K6a*Y5+Z&A0CSW04V!*utcKFh&-eK4A`Ps>F?Z!7k zQJ2YJVZq33*-N0oo?9Tw&K5_T$r$*jom?swgFF|!!|zk~6NBk3(lH+yA7)`fZofl` zdyYVMa6qlsREWMeS1Lh_S#`#dDS(FTEgBjC4S-npE%r|9w)3?Nx`9Ub=fW3O3thKh z{dydWKMP-g{hWeEPEv6@G1LN+=jG5XG z4<}B2>f&EZNZB;c9adu8s7pJL$tzKNVn{%+10t&pK5YiUU@sbXdMchO?3(A~y*>Mm zareg=_&9BJ*1N7)fpYLAI0-DFn%v>wJlL`IU1U0Tc{u^3AB1T>CO+1E{ZTRM?jxIY zvnL`V{ozafR?Crhs(ep8+>5UwM1+K1D)@=17iI~Q)WJu~{ zR4NgmM3i)N5+zy;g3z30ccd;qiqE`> zgxacWZ*8aTWUIIaa0vcriO{or@9p)t|HK&d7nXQiE+lRk*J~pW1DJY%y7j<)LBUv2 z2|y9jiC*=9*^C;TRFdj`=_@1f40UzcAM0`@H#KeUBxIiIf0%UHyNpKsodql4r3B>B zPxgSHUxt_j;c0Ig4R%7`4)%>;y`Wq&7S;R)_tDTxKN@UVwAe0IKapF5bi)W>OSS3k zID*aD?`QJXL54vfWh&tCtJ_PGc6M{3mW_u;H;5cOdau+WK3fRx7 z5=JqP0K>wZ$?pN-ARK_sHm**yPT6O6Ut%|Mc@>`%R@T&v8Q4p0YLfateYN+RrX@!5 z^!Y`ZY32h~1=8did-N&^MP{|r41IYk4^Vs(ZAbIOBH)q4f37n%m1E)BBVwBg9V(~8 zF-TxDNM=8~Cw07yZ$M4SGCZthCquh6%?)1f*neRVI^<}^z+|wc0(R>G09mv+b^w40 zXN6>DY>bX}Bb)jm=fyanx2YgaGKgO>6LI>7*!xbNj1L5ntgv}cJSi-d$Z-;&W%CWp zNvr*CZJj%^ST<*bN>5LRAC0g@1sv9{Ecb!bybupS%yd(Ji@5%8q2R@fPyehXmC0n_ z*uH_=qjZ;dT`pChm{tT<{=wT(Age4u$p5L#=gcYab&v8V(<^!qwdlJf&zZmZf4K$H zMhv4w(I@E1=Pwy?2^<*?(<>eb6ImY=w82eTMK$8YX5^&7xxP%J!T6j2zPYGeKXTaL zUT$pflr##UUdO%Yg)}G-h68=KY7G-R7F1x|c?e|IW?9 zyM=Eubaqaohw8je>)etOJ?(?d2_j-S(#6k}pL%~$2g7}?YbJCPn*^r4-Wq$o-2LZK zRcLrd=M-=F6HhIx8wkL#4iYi8L~m1To&c4hjJgNx<&SWt zXG-X@upevcroz!|Y`s{FNkV@{XGo3yF}868mBB;q?Y*R?5iJBbY9i3~ADcV5`~uq8 znWk}=jt7L&Av8Lv8iMF^#5^=J{ub1yQWz1DP~CX^>P|aVv+sEm4{J%su#PdeI~Zox zw#}!U=(=VD`3{u$Ql${lgML*A&3d`O@+8pAwE9qeDyzqpti>8!Z1g?nc?9hsqWe!A zi0LSeG!W2;C27|0sbxHs;W2IbLjaF1xk-}9KzLLIM)7IS6Lo~cyrs>Amw{+f%0qR2 zez=gN2_~l8ls8ICi!+oQJCzV2EUdkSCg;}A`sl&MB2xz0Xh#0EtH<7r|DCJ4^sOym z-6C_U^4SN}SC@N9i@Cwq3Q5Qkqo*2$HRPz)zkS>LwO;SK)E7n#KijkY*Iz+!maF3A z6fLJHU-VT+SGR|g<2A|c0ZeZOXmdhj9O6Ngp!hFlm2>Bhf#6;f$zV~NtXvjlzpwW} zA853?WezPWQ|DBFYB%z(d7ceV!fBO=+AIm@=k^|j6N|>7xI|F1m1n;|<;tv!RJ7Hv zmH6RAC6{J{<%9$Yg_!Ze+bpW<=m%!}Xi=OvHoDbkG1TeBu$yP(Yjn9Gn}o4(!xUd+ z+l>Zh6KCus(4TVA%)AP~13|gh$pU;=K98X56IKVnW^|iJXb1ZVsC_U78L4KRvj8v9RZzC7iK z$CMk7p6yW%e&9DYHpini14#wldC(N^eczk#05nGHJ$Hi_#fDSXqUGI8h2PlwbQ;*d zbwAi{!}kq{Tnc&Y{lg$Ql<6uM$r^pJsLyq~jFYY9vIys1D%<}47kc$$XU%>mUxefp zRcq{>DU{H#hOSTW9V^jgs4MhUiG0UlPhTQ@IL}fzvU^93VEAxn+k!C8=bnB@07C%9 zO#+hPe2hWHyA43@jQ-#2N7Qm@vS0Z~@ntoHrN;B!!SZH`kkw%Ljs0h4(qMr6=lG;i z^J@hPe!vWtn#n35Az}KoWW4y0W-xi~a%}l@a{GoYC=+3fyuBp1Ql}6T-d@Nfk&o~8 za+h$eQor4riUqwIx;WS)T+8H|iRS%2;ULEKucJ;66GXawAg9^tLxQr`IvoTXPYM>aqS z{c*+wjl@&cZ|0Wf9cOu8Yh(Dav=Mk?-t}#{Dlv%^J?hH8^;)eocon*r2^{eq8GZuZO#GG6`v(Ow%8G80@l7 zct(@y$XzDDP*C)94l_wB>U#Y7C6o9nLHJf*nzg29>dh(I9uVux$;&h3X6Ufaq;})_ z2=bIb%__%0e*b&`;D@6N-ridq`(CgVK?Ux4$vd|b>JE9*D|wD|(}$z$OkA|$03d4p zU=ws5b4xydZhdFAm@_{mAD^6De2_H(MLLc*DUbI1f)4*Q!;HuSsF9KB^w)+C0-*W+ zu$Fr>9^VOHbS`Ba;>gk8fEG_r;UD>I&t7#5r6{_8(4>*+G+cLgvN=|lAoXe_;x^6t z5BKH+Z#Euw!%;ui+{n z!5atr`$eld^)?0@WC4ndNr_24XzsMXjeaBFn=_vxp$CFyDx2BQ&MZUYUnzwAPKp1x z6mSZ`cHE+SwWV`Ua?8`)|L|VcTPK$wQSS*|8ggRZ#6;p}o%Sw6Z~en*+J438hm{Dv z#wMw!ecmZZoHNkkLNut*-=;5}S6<4ZV!idKcVi4M%b%(h<{KM)SVspkP^AL~q+^5H zU;Sk$D#Z&N2njvyVZXh;DWZR$Na^ zJu^zrI+jHg1fNW11q3XvEEOv4PC>}xHz(0&nNe_L^yR&G{Q%EGOKMVnKv}_!J6!YNBD~_ zVfH1zf+=(%ECV3U*xv&pT2{|S#AviSMur3lqU>2a8q=>NDB2c2;;eAN*58jlujw_N zceHbG!-#)8(9_labGMtPS#e>PU&iOA8OwYN%7uo=1u{=;yL5imz&k|a(edYP@tX!L zCy9j|TL?%BKSJDh-Tr#j_&O)ErJTTPr%Pgzk3NlepQ`bax_jcmXG1dxG4Ub@GI`xh zx^8hTna3oa3W4R}usFcZyr6vcwL+z!hlmbmVZ6L@aK>f763w9T{Fs20Uxv$R20PrR zMkvQeAszhYne#z?cvR<$RWhSsnqV_3-o$%XpQ%yA??>MhT^~`ktmI)aDb+Vs)TESkkg9$5C76HzfUB@ zsQua7dVR|g{$Vs4jI7&>FPIl+j&mM3Itxs?vd!$I2dSTn7xqiMynIc8 z=%V+M$I!mRQPUu`Ap^v}(JGa_I`6UA$MFf(>LE%Ke~1Mw-l{Ut)a%NRtW>#9e3R8H zpwJS%`&0JOSoqr@13kU+GFF<{aD08eNVRBp`A%s*UwaC@yDqZ&cqcrCN-xd0^ex77(;x}$y6A(*cD`3y=LF1d37 zJIH*`q|_qe)Rnpp0M{KB=jNO&^n~wpD6j0mbP;K8uEv4kESnT=T;0bFV&iji-~DVo z7L`i7lxH5T%*Ky0$A(ODOkct45y0)7{!VxITI#c|LF@cTKh)J@`mtN-Tp8|bzZcqX z-$yV+(mzsrvr<7>imaU`Ib@vY!uD3LYlHdeLS!3wZ8gkjv{uO*ziAT6{wZj3+h*0R z3nFS4)q67@O(JJ4cS^xFV@#0b5+NF`qQ;hW5hdASsZqB|E$8DBaVC;=FM{59xrCjI zAuE2mc>=Q)IGYHGQwa5`yScXem~v$}IhgtWwT|z;KQud^;B{N5voxVJeM(rb>38e5 z=OouXy;dB#;EbcVL4X$#s&JKpM>I-AV zA1?MD-8ZTGz9@`goq6lcPBt*(3P9Mtl*@S~j1%01Z%y!m9StN;Vh-R3TEGOaib11%QqCmUvFtdwzY;<)Q|K8kh{fdr> z5exUT2tFB~uxtT~dP3Uma$^5bv+aY8Yfh}jL@ji8y7W2;aBN+$zfs-0?zcP_Izip} zzZ5tq_rlhJZeyY&t8wkLVH$wJA6oKM1JCro150;5W(z$p;Ox>{IS)7)nX+VMr|&WY zd!0KY57{|YmWR?)w!mer8@{@~%`1YI2&B#0f{~Oj-0n@GtSW7m(VQ@Jy zFtYNmyLZqkNZuqjWlQEU{uvj0J)lkc&LcXyo>3+kR=&F8b@rmrvXT)ZO|2)LSpsaUhUR`BZi~a0_m!lwll^ z^q&%A-)ZRumAx-1QCr!c9ueiFyXrZ2>M3USsGnr{`xwgxB_I37++klh@!F-;^JSiN&u@igF{;|J8bHK0C;z)qQKh1q4_h8ynb=vQMVZ0VmuHg_k*4Oi$Xbnv6 zRww&V30_a%_&iJO9|N%u+tt_lE53Y!jbwFpMl6|4$b=O~CgcPt!{@pPdmRT7+2mEN zRNHCCec`o#Y}Zt&ldS)a+mS^ec$0d3(99(cP8J4;(Z$oQp~;lt(6$2Ug#w zh2i-J(GF!3ToDnps_3|uHfz;1RcnJ@fm8#&7kSI-V|9Qu{yz3kNfgkJ0=$p06R^Hj zEmo_^U&CTnkY}}iJ2*uukOsEsq*wCAtP!x)UAdM%-Q#zO(ni`eVw`(9VGHhz(KsGoQX^CSIshZSGbOcmQf(o>Mhu8K*$?h1#lHV=tLB!} z!0Gc&$E~$yyBc?sjrVJWqkn%b<@S%A$#+mx+a8VXp|&OFs7z^i1w960=My^N=f|F@ zb-o`b>s+779~ce^OCV*2@z(0lEYz+XeZlKwRJye6wOdn3@yk?q(j?HTiRN_g0@X~9 z#-TKtB(CC@>Egi`5c@8-bQUh}4c$~R>-a(GuGsy7ztT*s?HPiB%`hzsT&LJD3SyIF z2qSt#jV&=~HsqEw(?9r?@|uAM=_pq>==EhXjG;O<>aHl11E!)Dnhb>r&cJ~)%4O(!QIX2gVf%r*NhHP(=bG+~k4W1vPq$zZ(7SfO;q@F|IvzN`+z>PR z{a%^cy-#_W@6PU8felaS9?P*4pOC3Tl6>Py$z&0lGga@Y=AcLB*p<5Pes#;_ORGVj z;D7gZYA6hxT7UCM9C-i4b7=gX*S`SoTH_}{@V@`Bf45NlMIpw1%Ofhfnra9t`AOGm z;Yh&%VV2&Ma2{;}bRxwYwxZ|bdr6uk34RMyg2QCY{sV}%4zap{Mvp(wG4IDaoNZIB zqeZ&ksz&yc4BWfTM85!CYw3+mVT(p8u%l%LQY-_rKg^+1pL89}(fFbeq8@g`irpt!ef@03<2KT5feDA+O#n`L)Kw`GuhhUjx zdymG+#4OK!#gmb)r>b^h<*YDO6IPE~*zT`-OlP&XIV9bYLloJU%J zJFFZ*|K?m7NH3mP-W$5W)K^V z1HkgN^#H_T&1EBUfI7+a#hxl@> z+4`~$e}1~LWg~U;xOS8E%)v=frUeP_j>$=#v;+Bwol&NX+;iGECd1uLf!2JZsyEpv zJEtU2dN_k$f~&d!hy%xU!;8tH*fpW@_)sOVTsn!@v`8u=82@_F-gPvr`KSSD>`zhV zd_vg6@|u%Zzdz)c??{}e2*BC7%iT9 z?B$C+#s7G?)U@Y%?MkM5jM|xV!WnV>&w5MptCN7^=BP-KvR-Fn(cN z%K8&PvtE{}9W#ORaR%F^pDe&62`w(;ouR>>5#Fs@0*v!xbSf-PGgFcqglo`eq-UK6 zgKvqRWQsp>baXsU=bvF^Dk$<=e&z};iy%$JD+1p1NSp0Tb7w)P^HSq{MtO80ccVW4 VEv8)vT;b%3vb=^|nXH-re*l3hE`I<3 literal 0 HcmV?d00001 From 601df53a55f9f4017af3e45a75be9ee59fa6b461 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 15 Dec 2020 06:18:42 -0800 Subject: [PATCH 144/169] draft --- .../manage-auto-investigation.md | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 501b9ea75e..e3d24311a7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -97,6 +97,37 @@ In Microsoft Defender for Endpoint, all verdicts are [tracked and viewable in th 4. Select an item to view more details about that remediation action. +## Undo completed actions +You can undo actions that have been completed automatically (or manually) from the +Remediation actions that have been taken automatically or manually can be undone from the Action Center History page. + +Supported action sources: + - Automated investigation + - Microsoft Defender Antivirus + - Manual response actions + - Supported Actions: + - Isolate device + - Restrict code execution + - Quarantine a file + - Remove a registry key + - Stop a service + - Disable a driver + - Remove a scheduled task + +if you’ve determined that a machine or a file is clean, you can multi-select a list of actions and undo them all at the same time + +1. Select the actions you want to cancel. + +2. Click Undo at the right-side pane. + +![Action center](images/autoir-action-center-1.png) +For a single file, you can roll back and remove a file from quarantine in all the machines in which it was located. +1. Select one of the actions related to this file. +2. Check ‘Apply to X more instances of this file’ +3. Click Undo. + +![Quarantine file](images/autoir-quarantine-file-1.png) + ## Next steps - [See the interactive guide: Investigate and remediate threats with Microsoft Defender ATP](https://aka.ms/MDATP-IR-Interactive-Guide) From 2f11e48f564852ce231c4ebcc62715212253e654 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Dec 2020 06:36:56 -0800 Subject: [PATCH 145/169] Update manage-auto-investigation.md --- .../manage-auto-investigation.md | 41 +++++++++---------- 1 file changed, 19 insertions(+), 22 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index e3d24311a7..0891731c3a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -17,7 +17,7 @@ ms.collection: - m365-security-compliance - m365initiative-defender-endpoint ms.topic: conceptual -ms.date: 09/15/2020 +ms.date: 12/15/2020 --- # Review and approve remediation actions following an automated investigation @@ -98,33 +98,30 @@ In Microsoft Defender for Endpoint, all verdicts are [tracked and viewable in th 4. Select an item to view more details about that remediation action. ## Undo completed actions -You can undo actions that have been completed automatically (or manually) from the -Remediation actions that have been taken automatically or manually can be undone from the Action Center History page. -Supported action sources: - - Automated investigation - - Microsoft Defender Antivirus - - Manual response actions - - Supported Actions: - - Isolate device - - Restrict code execution - - Quarantine a file - - Remove a registry key - - Stop a service - - Disable a driver - - Remove a scheduled task +if you’ve determined that a device or a file is not a threat, you can undo remediation actions that were taken, whether those actions were taken automatically or manually. In the Action center, on the **History** tab, you can undo any of the following actions: -if you’ve determined that a machine or a file is clean, you can multi-select a list of actions and undo them all at the same time +| Action source | Supported Actions | +|:---|:---| +| - Automated investigation
- Microsoft Defender Antivirus
- Manual response actions | - Isolate device
- Restrict code execution
- Quarantine a file
- Remove a registry key
- Stop a service
- Disable a driver
- Remove a scheduled task | -1. Select the actions you want to cancel. +### To undo multiple actions at one time -2. Click Undo at the right-side pane. +1. Go to the Action center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. + +2. On the **History** tab, select the actions that you want to undo. + +3. In the pane on the right side of the screen, select **Undo**. + +### To remove a file from quarantine ![Action center](images/autoir-action-center-1.png) -For a single file, you can roll back and remove a file from quarantine in all the machines in which it was located. -1. Select one of the actions related to this file. -2. Check ‘Apply to X more instances of this file’ -3. Click Undo. + +1. Go to the Action center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. + +2. On the **History** tab, select a file that has the Action type **Quarantine file**. + +3. In the pane on the right side of the screen, select **Apply to X more instances of this file**, and then select **Undo**. ![Quarantine file](images/autoir-quarantine-file-1.png) From 65c260ca419992190cdbdb8492d97c2988fd14a4 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Dec 2020 06:40:02 -0800 Subject: [PATCH 146/169] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 038fce62dd..28ec738f87 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -115,15 +115,16 @@ if you’ve determined that a device or a file is not a threat, you can undo rem ### To remove a file from quarantine -![Action center](images/autoir-action-center-1.png) 1. Go to the Action center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. 2. On the **History** tab, select a file that has the Action type **Quarantine file**. + ![Action center](images/autoir-action-center-1.png) + 3. In the pane on the right side of the screen, select **Apply to X more instances of this file**, and then select **Undo**. -![Quarantine file](images/autoir-quarantine-file-1.png) + ![Quarantine file](images/autoir-quarantine-file-1.png) ## Next steps From 97ab69db292c8228cb2f16495085d6c5272cdc02 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Dec 2020 06:58:13 -0800 Subject: [PATCH 147/169] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 28ec738f87..04f3a39dc6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -113,7 +113,7 @@ if you’ve determined that a device or a file is not a threat, you can undo rem 3. In the pane on the right side of the screen, select **Undo**. -### To remove a file from quarantine +### To remove a file from quarantine across multiple devices 1. Go to the Action center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. From c6e7c5f14f0a56101f0a13aad3fdf7d392d23897 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Dec 2020 07:11:43 -0800 Subject: [PATCH 148/169] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 04f3a39dc6..a93b36c298 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -107,7 +107,7 @@ if you’ve determined that a device or a file is not a threat, you can undo rem ### To undo multiple actions at one time -1. Go to the Action center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. +1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. 2. On the **History** tab, select the actions that you want to undo. @@ -116,7 +116,7 @@ if you’ve determined that a device or a file is not a threat, you can undo rem ### To remove a file from quarantine across multiple devices -1. Go to the Action center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. +1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in. 2. On the **History** tab, select a file that has the Action type **Quarantine file**. From 574aa0cabcfa5f1176e8e9594f0cdbe02874a211 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Dec 2020 07:42:50 -0800 Subject: [PATCH 149/169] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index a93b36c298..b0ca7217c9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -99,7 +99,7 @@ In Microsoft Defender for Endpoint, all verdicts are [tracked and viewable in th ## Undo completed actions -if you’ve determined that a device or a file is not a threat, you can undo remediation actions that were taken, whether those actions were taken automatically or manually. In the Action center, on the **History** tab, you can undo any of the following actions: +If you’ve determined that a device or a file is not a threat, you can undo remediation actions that were taken, whether those actions were taken automatically or manually. In the Action center, on the **History** tab, you can undo any of the following actions: | Action source | Supported Actions | |:---|:---| From c7f2ac583862855ddb60d3594e32b3ce347ac885 Mon Sep 17 00:00:00 2001 From: mapalko Date: Tue, 15 Dec 2020 11:23:50 -0800 Subject: [PATCH 150/169] Fixing hello PIN reset missing image link Removing reference to an image that is missing/not available. --- .../hello-for-business/hello-feature-pin-reset.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 635c9794d1..e4e7af1253 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -104,7 +104,6 @@ On-premises deployments provide users with the ability to reset forgotten PINs e 1. Sign-in to Windows 10, version 1703 or later using an alternate credential. 2. Open **Settings**, click **Accounts**, click **Sign-in options**. 3. Under **PIN**, click **I forgot my PIN** and follow the instructions. -![PIN reset option](images/pinreset/pin-reset-option.png) #### Reset PIN above the Lock Screen From 8fa2680c62c6564809b0c4f23d176aee3537ca8c Mon Sep 17 00:00:00 2001 From: adirdidi <68847945+adirdidi@users.noreply.github.com> Date: Wed, 16 Dec 2020 01:17:52 +0200 Subject: [PATCH 151/169] Update get-device-secure-score.md Add US Gov API note. --- .../microsoft-defender-atp/get-device-secure-score.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md b/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md index e14a6859a7..b06c301776 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md @@ -23,6 +23,9 @@ ms.topic: article **Applies to:** [Microsoft Defender for Endpoint(https://go.microsoft.com/fwlink/p/?linkid=2146631) +>[!NOTE] +>If you are a US Gov customer, please refer to API endpoints listed in [here](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/gov#api). + - Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) Retrieves your [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md). A higher Microsoft Secure Score for Devices means your endpoints are more resilient from cybersecurity threat attacks. From d964bd716dc34301c8533d3b53e0a6e03815a4d7 Mon Sep 17 00:00:00 2001 From: adirdidi <68847945+adirdidi@users.noreply.github.com> Date: Wed, 16 Dec 2020 01:22:08 +0200 Subject: [PATCH 152/169] Update gov.md Add API section. --- .../threat-protection/microsoft-defender-atp/gov.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/gov.md b/windows/security/threat-protection/microsoft-defender-atp/gov.md index af348b95bc..ddff7ba6a2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/gov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/gov.md @@ -40,7 +40,7 @@ The following OS versions are supported: - Windows Server, 2019 (with [KB4490481](https://support.microsoft.com/help/4490481)) >[!NOTE] -A patch must be deployed before device onboarding in order to configure Defender for Endpoint to the correct environment. +>A patch must be deployed before device onboarding in order to configure Defender for Endpoint to the correct environment. The following OS versions are supported via Azure Security Center: - Windows Server 2008 R2 SP1 @@ -108,4 +108,8 @@ Common URLs for all locations (Global location) | ```crl.microsoft.com```
``` Defender for Endpoint GCC High specific | ```us4-v20.events.data.microsoft.com```
```winatp-gw-usgt.microsoft.com```
```winatp-gw-usgv.microsoft.com```
```*.blob.core.usgovcloudapi.net``` +## API +Login endpoint: ```https://login.microsoftonline.us``` +Microsoft Defender for Endpoint API endpoint: ```https://api-gov.securitycenter.microsoft.us``` + From e83b43d3171de86637b2d61fe9ba106c13e4653e Mon Sep 17 00:00:00 2001 From: adirdidi <68847945+adirdidi@users.noreply.github.com> Date: Wed, 16 Dec 2020 01:56:09 +0200 Subject: [PATCH 153/169] Update get-device-secure-score.md Fixing the Gov API link and the applies to link. --- .../microsoft-defender-atp/get-device-secure-score.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md b/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md index b06c301776..1e76593b6c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md @@ -21,10 +21,10 @@ ms.topic: article [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] -**Applies to:** [Microsoft Defender for Endpoint(https://go.microsoft.com/fwlink/p/?linkid=2146631) +**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) >[!NOTE] ->If you are a US Gov customer, please refer to API endpoints listed in [here](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/gov#api). +>If you are a US Gov customer, please refer to API endpoints listed in [here](gov#api). - Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) From 8efdb0a237bee0fe88c864d2c33930e7775151b1 Mon Sep 17 00:00:00 2001 From: jcaparas Date: Tue, 15 Dec 2020 16:10:51 -0800 Subject: [PATCH 154/169] Update get-device-secure-score.md --- .../microsoft-defender-atp/get-device-secure-score.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md b/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md index 1e76593b6c..7b6d923818 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/get-device-secure-score.md @@ -24,7 +24,7 @@ ms.topic: article **Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) >[!NOTE] ->If you are a US Gov customer, please refer to API endpoints listed in [here](gov#api). +>If you are a US Gov customer, please refer to API endpoints listed in [here](gov.md#api). - Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) From 58dfa1011e20126d36d1dab037708ee8218d13d6 Mon Sep 17 00:00:00 2001 From: schmurky Date: Wed, 16 Dec 2020 12:39:54 +0800 Subject: [PATCH 155/169] Update review and investigate alerts --- .../microsoft-defender-atp/review-alerts.md | 37 ++----------------- 1 file changed, 4 insertions(+), 33 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md index d32c73580f..4ad850c886 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md @@ -41,13 +41,13 @@ Clicking on an alert's name in Defender for Endpoint will land you on its alert 1. **The alert title** shows the alert's name and is there to remind you which alert started your current investigation regardless of what you have selected on the page. 2. [**Affected assets**](#review-affected-assets) lists cards of devices and users affected by this alert that are clickable for further information and actions. -3. [**The alert story**](#investigate-using-the-alert-story) displays all entities related to the alert, interconnected by a tree view. The alert in the title will be the one in focus when you first land on your selected alert's page. Entities in the alert story are expandable and clickable, to provide additional information and expedite response by allowing you to take actions right in the context of the alert page. -4. [**The details pane**](#take-action-from-the-details-pane) will show the details of the selected alert at first, with details and actions related to this alert. If you click on any of the affected assets or entities in the alert story, the details pane will change to provide contextual information and actions for the selected object. +3. The **alert story** displays all entities related to the alert, interconnected by a tree view. The alert in the title will be the one in focus when you first land on your selected alert's page. Entities in the alert story are expandable and clickable, to provide additional information and expedite response by allowing you to take actions right in the context of the alert page. Use the alert story to start your investigation. Learn how in [Investigate alerts in Microsoft Defender for Endpoint](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts). +4. The **details pane** will show the details of the selected alert at first, with details and actions related to this alert. If you click on any of the affected assets or entities in the alert story, the details pane will change to provide contextual information and actions for the selected object. ![An alert page when you first land on it](images/alert-landing-view.png) Note the detection status for your alert. Blocked, or prevented means actions were already taken by Defender for Endpoint. -Start by reviewing the *automated investigation details* in your alert's [details pane](#take-action-from-the-details-pane), to see which actions were already taken, as well as reading the alert's description for recommended actions. +Start by reviewing the *automated investigation details* in your alert's details pane, to see which actions were already taken, as well as reading the alert's description for recommended actions. ![A snippet of the details pane with the alert description and automatic investigation sections highlighted](images/alert-air-and-alert-description.png) @@ -55,42 +55,13 @@ Other information available in the details pane when the alert opens includes MI ## Review affected assets -Clicking on a device or a user card in the affected assets sections will switch to the details of the device or user in the details pane. +Selecting a device or a user card in the affected assets sections will switch to the details of the device or user in the details pane. - **For devices** the details pane will display information about the device itself, like Domain, Operating System, and IP. Active alerts and the logged on users on that device are also available. You can take immediate action by isolating the device, restricting app execution, or running an antivirus scan. Alternatively, you could collect an investigation package, initiate an automated investigation, or go to the device page to investigate from the device's point of view. - **For users** the details pane will display detailed user information, such as the user's SAM name and SID, as well as logon types performed by this user and any alerts and incidents related to it. You can click *Open user page* to continue the investigation from that user's point of view. ![A snippet of the details pane when a device is selected](images/alert-device-details.png) -## Investigate using the alert story - -The alert story details why the alert was triggered, related events that happened before and after, as well as other related entities. - -Entities are clickable and every entity that isn't an alert is expandable using the expand icon on the right side of that entity's card. The entity in focus will be indicated by a blue stripe to the left side of that entity's card, with the alert in the title being in focus at first. - -Expand entities to view details at-a-glance about them. Clicking on an entity will switch the context of the details pane to this entity, and will allow you to review further information, as well as manage that entity. Clicking on *...* to the right of the entity card will reveal all actions available for that entity. These same actions appear in the details pane when that entity is in focus. - -> [!NOTE] -> The alert story section may contain more than one alert, with additional alerts related to the same execution tree appearing before or after the alert you've selected. - -![An example of an alert story with an alert in focus and some expanded cards](images/alert-story-tree.png) - -## Take action from the details pane - -Once you've selected an entity of interest, the details pane will change to display information about the selected entity type, historic information, when its available, and offer controls to **take action** on this entity directly from the alert page. - -Once you're done investigating, go back to the alert you started with, mark the alert's status as **Resolved** and classify it as either **False alert** or **True alert**. Classifying alerts helps tune this capability to provide more true alerts and less false alerts. - -If you classify it as a true alert, you can also select a determination, as shown in the image below. - -![A snippet of the details pane with a resolved alert and the determination drop-down expanded](images/alert-details-resolved-true.png) - -If you are experiencing a false alert with a line-of-business application, create a suppression rule to avoid this type of alert in the future. - -![actions and classification in the details pane with the suppression rule highlighted](images/alert-false-suppression-rule.png) - -> [!TIP] -> If you're experiencing any issues not described above, use the 🙂 button to provide feedback or open a support ticket. ## Related topics From 15a4b4c989298d4cd0f3b0aa767659749a25edd0 Mon Sep 17 00:00:00 2001 From: schmurky Date: Wed, 16 Dec 2020 12:40:15 +0800 Subject: [PATCH 156/169] Update investigate alerts --- .../investigate-alerts.md | 68 ++++++------------- 1 file changed, 19 insertions(+), 49 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md index e9ad5814eb..a18c5676d8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md @@ -20,7 +20,7 @@ ms.topic: article ms.date: 04/24/2018 --- -# Investigate Microsoft Defender Advanced Threat Protection alerts +# Investigate alerts in Microsoft Defender for Endpoint [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] @@ -35,70 +35,40 @@ ms.date: 04/24/2018 Investigate alerts that are affecting your network, understand what they mean, and how to resolve them. -Click an alert to see the alert details view and the various tiles that provide information about the alert. +Select an alert from the alerts queue to go to alert page. This view contains the alert title, the affected assets, the details side pane, and the alert story. -From the alert details view, you can manage an alert and see alert data such as severity, category, technique, along with other information that can help you make better decisions on how to approach them. +From the alert page, you can begin your investigation by selecting the affected assets or any of the entities under the alert story tree view. The details pane automatically populates with further information about what you selected. To see what kind of information you can view here, read [Review alerts in Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/review-alerts). -The techniques reflected in the card are based on [MITRE enterprise techniques](https://attack.mitre.org/techniques/enterprise/). +## Investigate using the alert story -You'll also see a status of the automated investigation on the upper right corner. Clicking on the link will take you to the Automated investigations view. For more information, see [Automated investigations](automated-investigations.md). +The alert story details why the alert was triggered, related events that happened before and after, as well as other related entities. -![Image of the alert page](images/atp-alert-view.png) +Entities are clickable and every entity that isn't an alert is expandable using the expand icon on the right side of that entity's card. The entity in focus will be indicated by a blue stripe to the left side of that entity's card, with the alert in the title being in focus at first. -The alert context tile shows the where, who, and when context of the alert. As with other pages, you can click on the icon beside the name or user account to bring up the device or user details pane. The alert details view also has a status tile that shows the status of the alert in the queue. You'll also see a description and a set of recommended actions which you can expand. +Expand entities to view details at-a-glance about them. Clicking on an entity will switch the context of the details pane to this entity, and will allow you to review further information, as well as manage that entity. Clicking on *...* to the right of the entity card will reveal all actions available for that entity. These same actions appear in the details pane when that entity is in focus. -For more information about managing alerts, see [Manage alerts](manage-alerts.md). +> [!NOTE] +> The alert story section may contain more than one alert, with additional alerts related to the same execution tree appearing before or after the alert you've selected. -The alert details page also shows the alert process tree, an incident graph, and an artifact timeline. +![An example of an alert story with an alert in focus and some expanded cards](images/alert-story-tree.png) -You can click on the device link from the alert view to navigate to the device. The alert will be highlighted automatically, and the timeline will display the appearance of the alert and its evidence in the **Device timeline**. If the alert appeared more than once on the device, the latest occurrence will be displayed in the **Device timeline**. +## Take action from the details pane -Alerts attributed to an adversary or actor display a colored tile with the actor's name. +Once you've selected an entity of interest, the details pane will change to display information about the selected entity type, historic information, when its available, and offer controls to **take action** on this entity directly from the alert page. -![A detailed view of an alert when clicked](images/atp-actor-alert.png) +Once you're done investigating, go back to the alert you started with, mark the alert's status as **Resolved** and classify it as either **False alert** or **True alert**. Classifying alerts helps tune this capability to provide more true alerts and less false alerts. -Click on the actor's name to see the threat intelligence profile of the actor, including a brief overview of the actor, their interests or targets, their tools, tactics, and processes (TTPs), and areas where they've been observed worldwide. You will also see a set of recommended actions to take. +If you classify it as a true alert, you can also select a determination, as shown in the image below. -Some actor profiles include a link to download a more comprehensive threat intelligence report. +![A snippet of the details pane with a resolved alert and the determination drop-down expanded](images/alert-details-resolved-true.png) -![Image of detailed actor profile](images/atp-detailed-actor.png) +If you are experiencing a false alert with a line-of-business application, create a suppression rule to avoid this type of alert in the future. -The detailed alert profile helps you understand who the attackers are, who they target, what techniques, tools, and procedures (TTPs) they use, which geolocations they are active in, and finally, what recommended actions you may take. In many cases, you can download a more detailed Threat Intelligence report about this attacker or campaign for offline reading. +![actions and classification in the details pane with the suppression rule highlighted](images/alert-false-suppression-rule.png) -## Alert process tree -The **Alert process tree** takes alert triage and investigation to the next level, displaying the aggregated alert and surrounding evidence that occurred within the same execution context and time period. This rich triage and investigation context is available on the alert page. +> [!TIP] +> If you're experiencing any issues not described above, use the 🙂 button to provide feedback or open a support ticket. -![Image of the alert process tree](images/atp-alert-process-tree.png) - -The **Alert process tree** expands to display the execution path of the alert and related evidence that occurred around the same period. Items marked with a thunderbolt icon should be given priority during investigation. - ->[!NOTE] ->The alert process tree might not show for some alerts, including alerts not triggered directly by process activity. - -Clicking in the circle immediately to the left of the indicator displays its details. - -![Image of the alert details pane](images/atp-alert-mgt-pane.png) - -The alert details pane helps you take a deeper look at the details about the alert. It displays rich information about the execution details, file details, detections, observed worldwide, observed in organization, and other details taken from the entity's page – while remaining on the alert page, so you never leave the current context of your investigation. - - -## Incident graph -The **Incident Graph** provides a visual representation of the organizational footprint of the alert and its evidence: where the evidence that triggered the alert was observed on other devices. It provides a graphical mapping from the original device and evidence expanding to show other devices in the organization where the triggering evidence was also observed. - -![Image of the Incident graph](images/atp-incident-graph.png) - -The **Incident Graph** supports expansion by File, Process, command line, or Destination IP Address, as appropriate. - -The **Incident Graph** expansion by destination IP Address, shows the organizational footprint of communications with this IP Address without having to change context by navigating to the IP Address page. - -You can click the full circles on the incident graph to expand the nodes and view the expansion to other devices where the matching criteria were observed. - -## Artifact timeline -The **Artifact timeline** feature provides an additional view of the evidence that triggered the alert on the device, and shows the date and time the evidence triggering the alert was observed, as well as the first time it was observed on the device. This can help in understanding if the evidence was first observed at the time of the alert, or whether it was observed on the device earlier - without triggering an alert. - -![Image of artifact timeline](images/atp-alert-timeline.png) - -Selecting an alert detail brings up the **Details pane** where you'll be able to see more information about the alert such as file details, detections, instances of it observed worldwide, and in the organization. ## Related topics - [View and organize the Microsoft Defender for Endpoint Alerts queue](alerts-queue.md) From ffd10a882360db6234d7979d8d2382e63c4d2aee Mon Sep 17 00:00:00 2001 From: schmurky Date: Wed, 16 Dec 2020 13:05:18 +0800 Subject: [PATCH 157/169] Update 2 pages --- .../microsoft-defender-atp/investigate-alerts.md | 6 +++--- .../microsoft-defender-atp/investigate-machines.md | 2 -- .../microsoft-defender-atp/review-alerts.md | 8 ++++---- 3 files changed, 7 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md index a18c5676d8..541f45d7c4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md @@ -37,7 +37,7 @@ Investigate alerts that are affecting your network, understand what they mean, a Select an alert from the alerts queue to go to alert page. This view contains the alert title, the affected assets, the details side pane, and the alert story. -From the alert page, you can begin your investigation by selecting the affected assets or any of the entities under the alert story tree view. The details pane automatically populates with further information about what you selected. To see what kind of information you can view here, read [Review alerts in Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/review-alerts). +From the alert page, begin your investigation by selecting the affected assets or any of the entities under the alert story tree view. The details pane automatically populates with further information about what you selected. To see what kind of information you can view here, read [Review alerts in Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/review-alerts). ## Investigate using the alert story @@ -45,7 +45,7 @@ The alert story details why the alert was triggered, related events that happene Entities are clickable and every entity that isn't an alert is expandable using the expand icon on the right side of that entity's card. The entity in focus will be indicated by a blue stripe to the left side of that entity's card, with the alert in the title being in focus at first. -Expand entities to view details at-a-glance about them. Clicking on an entity will switch the context of the details pane to this entity, and will allow you to review further information, as well as manage that entity. Clicking on *...* to the right of the entity card will reveal all actions available for that entity. These same actions appear in the details pane when that entity is in focus. +Expand entities to view details at a glance. Selecting an entity will switch the context of the details pane to this entity, and will allow you to review further information, as well as manage that entity. Selecting *...* to the right of the entity card will reveal all actions available for that entity. These same actions appear in the details pane when that entity is in focus. > [!NOTE] > The alert story section may contain more than one alert, with additional alerts related to the same execution tree appearing before or after the alert you've selected. @@ -54,7 +54,7 @@ Expand entities to view details at-a-glance about them. Clicking on an entity wi ## Take action from the details pane -Once you've selected an entity of interest, the details pane will change to display information about the selected entity type, historic information, when its available, and offer controls to **take action** on this entity directly from the alert page. +Once you've selected an entity of interest, the details pane will change to display information about the selected entity type, historic information when it's available, and offer controls to **take action** on this entity directly from the alert page. Once you're done investigating, go back to the alert you started with, mark the alert's status as **Resolved** and classify it as either **False alert** or **True alert**. Classifying alerts helps tune this capability to provide more true alerts and less false alerts. diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md index c08d0c02f2..1a47eaf935 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md @@ -132,8 +132,6 @@ More details about certain events are provided in the **Additional information** - Suspicious script detected - a potentially malicious script was found running - The alert category - if the event led to the generation of an alert, the alert category ("Lateral Movement", for example) is provided -You can also use the [Artifact timeline](investigate-alerts.md#artifact-timeline) feature to see the correlation between alerts and events on a specific device. - #### Event details Select an event to view relevant details about that event. A panel displays to show general event information. When applicable and data is available, a graph showing related entities and their relationships are also shown. diff --git a/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md index 4ad850c886..aba99637cc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md @@ -37,12 +37,12 @@ Quickly triage, investigate, and take effective action on alerts that affect you ## Getting started with an alert -Clicking on an alert's name in Defender for Endpoint will land you on its alert page. On the alert page, all the information will be shown in context of the selected alert. Each alert page consists of 4 sections: +Selecting an alert's name in Defender for Endpoint will land you on its alert page. On the alert page, all the information will be shown in context of the selected alert. Each alert page consists of 4 sections: 1. **The alert title** shows the alert's name and is there to remind you which alert started your current investigation regardless of what you have selected on the page. 2. [**Affected assets**](#review-affected-assets) lists cards of devices and users affected by this alert that are clickable for further information and actions. -3. The **alert story** displays all entities related to the alert, interconnected by a tree view. The alert in the title will be the one in focus when you first land on your selected alert's page. Entities in the alert story are expandable and clickable, to provide additional information and expedite response by allowing you to take actions right in the context of the alert page. Use the alert story to start your investigation. Learn how in [Investigate alerts in Microsoft Defender for Endpoint](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts). -4. The **details pane** will show the details of the selected alert at first, with details and actions related to this alert. If you click on any of the affected assets or entities in the alert story, the details pane will change to provide contextual information and actions for the selected object. +3. The **alert story** displays all entities related to the alert, interconnected by a tree view. The alert in the title will be the one in focus when you first land on your selected alert's page. Entities in the alert story are expandable and clickable, to provide additional information and expedite response by allowing you to take actions right in the context of the alert page. Use the alert story to start your investigation. Learn how in [Investigate alerts in Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts). +4. The **details pane** will show the details of the selected alert at first, with details and actions related to this alert. If you select any of the affected assets or entities in the alert story, the details pane will change to provide contextual information and actions for the selected object. ![An alert page when you first land on it](images/alert-landing-view.png) @@ -58,7 +58,7 @@ Other information available in the details pane when the alert opens includes MI Selecting a device or a user card in the affected assets sections will switch to the details of the device or user in the details pane. - **For devices** the details pane will display information about the device itself, like Domain, Operating System, and IP. Active alerts and the logged on users on that device are also available. You can take immediate action by isolating the device, restricting app execution, or running an antivirus scan. Alternatively, you could collect an investigation package, initiate an automated investigation, or go to the device page to investigate from the device's point of view. -- **For users** the details pane will display detailed user information, such as the user's SAM name and SID, as well as logon types performed by this user and any alerts and incidents related to it. You can click *Open user page* to continue the investigation from that user's point of view. +- **For users** the details pane will display detailed user information, such as the user's SAM name and SID, as well as logon types performed by this user and any alerts and incidents related to it. You can select *Open user page* to continue the investigation from that user's point of view. ![A snippet of the details pane when a device is selected](images/alert-device-details.png) From dd2a871f780d22b99ff9c119e2f92f5142c59686 Mon Sep 17 00:00:00 2001 From: schmurky Date: Wed, 16 Dec 2020 13:09:44 +0800 Subject: [PATCH 158/169] Removed en-us --- .../threat-protection/microsoft-defender-atp/review-alerts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md index aba99637cc..ebe2923713 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/review-alerts.md @@ -33,7 +33,7 @@ The alert page in Microsoft Defender for Endpoint provides full context to the a Quickly triage, investigate, and take effective action on alerts that affect your organization. Understand why they were triggered, and their impact from one location. Learn more in this overview. -> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4yiO5] +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4yiO5] ## Getting started with an alert From b82c0899b4481aae6be519a8ebd689b93775a2b4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20Sj=C3=B6gren?= Date: Wed, 16 Dec 2020 17:07:26 +0100 Subject: [PATCH 159/169] mdatp config requires `--value` MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Thomas Sjögren --- .../microsoft-defender-atp/mac-resources.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md b/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md index 11549d3a62..b62abb198b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-resources.md @@ -13,9 +13,9 @@ author: dansimp ms.localizationpriority: medium manager: dansimp audience: ITPro -ms.collection: -- m365-security-compliance -- m365initiative-defender-endpoint +ms.collection: +- m365-security-compliance +- m365initiative-defender-endpoint ms.topic: conceptual --- @@ -90,7 +90,7 @@ Important tasks, such as controlling product settings and triggering on-demand s |Group |Scenario |Command | |-------------|-------------------------------------------|----------------------------------------------------------------------------------| -|Configuration|Turn on/off real-time protection |`mdatp config real-time-protection [enabled/disabled]` | +|Configuration|Turn on/off real-time protection |`mdatp config real-time-protection --value [enabled/disabled]` | |Configuration|Turn on/off cloud protection |`mdatp config cloud --value [enabled/disabled]` | |Configuration|Turn on/off product diagnostics |`mdatp config cloud-diagnostic --value [enabled/disabled]` | |Configuration|Turn on/off automatic sample submission |`mdatp config cloud-automatic-sample-submission --value [enabled/disabled]` | From d679d931a0f0ea9b232908091ec7c2d73602c99a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 16 Dec 2020 10:29:18 -0800 Subject: [PATCH 160/169] Create contact-support-usgov.md --- .../contact-support-usgov.md | 43 +++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/contact-support-usgov.md diff --git a/windows/security/threat-protection/microsoft-defender-atp/contact-support-usgov.md b/windows/security/threat-protection/microsoft-defender-atp/contact-support-usgov.md new file mode 100644 index 0000000000..4fefe095d8 --- /dev/null +++ b/windows/security/threat-protection/microsoft-defender-atp/contact-support-usgov.md @@ -0,0 +1,43 @@ +--- +title: Contact Microsoft Defender for Endpoint support for US Government customers +description: Learn how to contact Microsoft Defender for Endpoint support for US Government customers +keywords: support, contact, premier support, solutions, problems, case, government, gcc, gcc-m, gcc-h, defender, endpoint, mdatp, mde +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: medium +manager: dansimp +audience: ITPro +ms.collection: M365-security-compliance +ms.topic: conceptual +ROBOTS: noindex,nofollow +--- + +# Contact Microsoft Defender for Endpoint support for US Government customers + +[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] + + +**Applies to:** +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) + +Defender for Endpoint has recently upgraded the support process to offer a more modern and advanced support experience. + +## Using the right portal +In order to open a support case, you will need to login to your Microsoft Defender for Endpoint portal: + +Environment | Portal URL +:---|:--- +GCC-M | [https://gcc.securitycenter.windows.us](https://gcc.securitycenter.windows.us) +GCC-H | [https://securitycenter.windows.us](https://securitycenter.windows.us) +DoD | [https://securitycenter.windows.us](https://securitycenter.windows.us) + +If you are unable to login to the portal, you can also open a support case using the [phone](https://docs.microsoft.com/microsoft-365/admin/contact-support-for-business-products?view=o365-worldwide&tabs=phone). + +## Opening a support case +For prerequisites and instructions, see [Contact Microsoft Defender for Endpoint support](contact-support.md). \ No newline at end of file From 1996207706b189166c6bfda64acff38b9a3c48fc Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 16 Dec 2020 10:32:44 -0800 Subject: [PATCH 161/169] antivirus updates per doc bugs --- ...rosoft-defender-antivirus-in-windows-10.md | 11 ++--- ...fender-antivirus-on-windows-server-2016.md | 43 +++++++++---------- 2 files changed, 25 insertions(+), 29 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md index 3b56a59a48..23c85194d0 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.date: 11/12/2020 +ms.date: 12/16/2020 ms.reviewer: manager: dansimp ms.custom: nextgen @@ -20,12 +20,9 @@ ms.custom: nextgen [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - **Applies to:** -- Windows 10 -- Windows Server 2016 -- Windows Server 2019 +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) ## Microsoft Defender Antivirus: Your next-generation protection @@ -56,8 +53,8 @@ For information on how to configure next-generation protection services, see [Co > [!Note] > Configuration and management is largely the same in Windows Server 2016 and Windows Server 2019, while running Microsoft Defender Antivirus; however, there are some differences. To learn more, see [Microsoft Defender Antivirus on Windows Server 2016 and 2019](microsoft-defender-antivirus-on-windows-server-2016.md). -## Related articles +## See also +- [Microsoft Defender Antivirus on Windows Server 2016 and 2019](microsoft-defender-antivirus-on-windows-server-2016.md) - [Microsoft Defender Antivirus management and configuration](configuration-management-reference-microsoft-defender-antivirus.md) - - [Evaluate Microsoft Defender Antivirus protection](evaluate-microsoft-defender-antivirus.md) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md index 0b7e4ccdd6..86b682c59e 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md @@ -10,7 +10,7 @@ ms.sitesec: library ms.localizationpriority: medium author: denisebmsft ms.author: deniseb -ms.date: 02/25/2020 +ms.date: 12/16/2020 ms.reviewer: manager: dansimp --- @@ -19,15 +19,13 @@ manager: dansimp [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - **Applies to:** -- Windows Server 2016 -- Windows Server 2019 +- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) -Microsoft Defender Antivirus is available on Windows Server 2016 and Windows Server 2019. In some instances, Microsoft Defender Antivirus is referred to as Endpoint Protection; however, the protection engine is the same. +Microsoft Defender Antivirus is available on Windows Server 2019 and Windows Server 2016. In some instances, Microsoft Defender Antivirus is referred to as *Endpoint Protection*; however, the protection engine is the same. -While the functionality, configuration, and management are largely the same for Microsoft Defender Antivirus on Windows 10, there are a few key differences on Windows Server 2016 or Windows Server 2019: +While the functionality, configuration, and management are largely the same for [Microsoft Defender Antivirus on Windows 10](microsoft-defender-antivirus-in-windows-10.md), there are a few key differences on Windows Server 2019 and Windows Server 2016: - In Windows Server, [automatic exclusions](configure-server-exclusions-microsoft-defender-antivirus.md) are applied based on your defined Server Role. - In Windows Server, Microsoft Defender Antivirus does not automatically disable itself if you are running another antivirus product. @@ -52,7 +50,7 @@ The process of setting up and running Microsoft Defender Antivirus on a server p ## Enable the user interface on Windows Server 2016 or 2019 -By default, Microsoft Defender Antivirus is installed and functional on Windows Server 2016 and Windows Server 2019. The user interface (GUI) is installed by default on some SKUs, but is not required because you can use PowerShell or other methods to manage Microsoft Defender Antivirus. And if the GUI is not installed on your server, you can add it by using the Add Roles and Features Wizard or PowerShell. +By default, Microsoft Defender Antivirus is installed and functional on Windows Server 2019 and Windows Server 2016. The user interface (GUI) is installed by default on some SKUs, but is not required because you can use PowerShell or other methods to manage Microsoft Defender Antivirus. And if the GUI is not installed on your server, you can add it by using the Add Roles and Features Wizard or by using PowerShell. ### Turn on the GUI using the Add Roles and Features Wizard @@ -74,7 +72,7 @@ The following PowerShell cmdlet will enable the interface: Install-WindowsFeature -Name Windows-Defender-GUI ``` -## Install Microsoft Defender Antivirus on Windows Server 2016 or 2019 +## Install Microsoft Defender Antivirus on Windows Server 2019 or Windows Server 2016 You can use either the **Add Roles and Features Wizard** or PowerShell to install Microsoft Defender Antivirus. @@ -121,14 +119,14 @@ The `sc query` command returns information about the Microsoft Defender Antiviru In order to get updated antimalware Security intelligence, you must have the Windows Update service running. If you use an update management service, like Windows Server Update Services (WSUS), make sure that updates for Microsoft Defender Antivirus Security intelligence are approved for the computers you manage. -By default, Windows Update does not download and install updates automatically on Windows Server 2016 or 2019. You can change this configuration by using one of the following methods: +By default, Windows Update does not download and install updates automatically on Windows Server 2019 or Windows Server 2016. You can change this configuration by using one of the following methods: |Method |Description | |---------|---------| |**Windows Update** in Control Panel |- **Install updates automatically** results in all updates being automatically installed, including Windows Defender Security intelligence updates.
- **Download updates but let me choose whether to install them** allows Windows Defender to download and install Security intelligence updates automatically, but other updates are not automatically installed. | |**Group Policy** | You can set up and manage Windows Update by using the settings available in Group Policy, in the following path: **Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates** | -|The **AUOptions** registry key |The following two values allow Windows Update to automatically download and install Security intelligence updates:
- **4** Install updates automatically. This value results in all updates being automatically installed, including Windows Defender Security intelligence updates.
- **3** Download updates but let me choose whether to install them. This value allows Windows Defender to download and install Security intelligence updates automatically, but other updates are not automatically installed. | +|The **AUOptions** registry key |The following two values allow Windows Update to automatically download and install Security intelligence updates:
- **4** - **Install updates automatically**. This value results in all updates being automatically installed, including Windows Defender Security intelligence updates.
- **3** - **Download updates but let me choose whether to install them**. This value allows Windows Defender to download and install Security intelligence updates automatically, but other updates are not automatically installed. | To ensure that protection from malware is maintained, we recommend that you enable the following services: @@ -162,10 +160,10 @@ To enable automatic sample submission, start a Windows PowerShell console as an |Setting |Description | |---------|---------| -|**0** Always prompt |The Microsoft Defender Antivirus service prompts you to confirm submission of all required files. This is the default setting for Microsoft Defender Antivirus, but is not recommended for installations on Windows Server 2016 or 2019 without a GUI. | -|**1** Send safe samples automatically |The Microsoft Defender Antivirus service sends all files marked as "safe" and prompts for the remainder of the files. | -|**2** Never send |The Microsoft Defender Antivirus service does not prompt and does not send any files. | -|**3** Send all samples automatically |The Microsoft Defender Antivirus service sends all files without a prompt for confirmation. | +|**0** - **Always prompt** |The Microsoft Defender Antivirus service prompts you to confirm submission of all required files. This is the default setting for Microsoft Defender Antivirus, but is not recommended for installations on Windows Server 2016 or 2019 without a GUI. | +|**1** - **Send safe samples automatically** |The Microsoft Defender Antivirus service sends all files marked as "safe" and prompts for the remainder of the files. | +|**2** - **Never send** |The Microsoft Defender Antivirus service does not prompt and does not send any files. | +|**3** - **Send all samples automatically** |The Microsoft Defender Antivirus service sends all files without a prompt for confirmation. | ## Configure automatic exclusions @@ -177,7 +175,9 @@ See [Configure exclusions in Microsoft Defender Antivirus on Windows Server](con If you are using a third-party antivirus solution and you're running into issues with that solution and Microsoft Defender Antivirus, you can consider uninstalling Microsoft Defender Antivirus. Before you do that, review the following resources: -- See the question "Should I run Microsoft security software at the same time as other security products?" on the [Windows Defender Security Intelligence Antivirus and antimalware software FAQ](https://www.microsoft.com/wdsi/help/antimalware-faq#multiple-products). +- See the question *Should I run Microsoft security software at the same time as other security products?* in the [Windows Defender Security Intelligence Antivirus and antimalware software FAQ](https://www.microsoft.com/wdsi/help/antimalware-faq#multiple-products). + +- See [Microsoft Defender Antivirus compatibility](microsoft-defender-antivirus-compatibility.md). - See [Better together: Microsoft Defender Antivirus and Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/why-use-microsoft-antivirus). This article describes 10 advantages to using Microsoft Defender Antivirus together with Defender for Endpoint. @@ -185,20 +185,20 @@ If you determine you do want to uninstall Microsoft Defender Antivirus, follow t ### Uninstall Microsoft Defender Antivirus using the Remove Roles and Features wizard -1. Refer to [this article](https://docs.microsoft.com/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features#remove-roles-role-services-and-features-by-using-the-remove-roles-and-features-wizard), and use the **Remove Roles and Features Wizard**. +1. See [Install or Uninstall Roles, Role Services, or Features](https://docs.microsoft.com/windows-server/administration/server-manager/install-or-uninstall-roles-role-services-or-features#remove-roles-role-services-and-features-by-using-the-remove-roles-and-features-wizard), and use the **Remove Roles and Features Wizard**. -2. When you get to the **Features** step of the wizard, unselect the **Windows Defender Features** option. +2. When you get to the **Features** step of the wizard, clear the **Windows Defender Features** option. - If you unselect **Windows Defender** by itself under the **Windows Defender Features** section, you will be prompted to remove the interface option **GUI for Windows Defender**. + If you clear **Windows Defender** by itself under the **Windows Defender Features** section, you will be prompted to remove the interface option **GUI for Windows Defender**. - Microsoft Defender AV will still run normally without the user interface, but the user interface cannot be enabled if you disable the core **Windows Defender** feature. + Microsoft Defender Antivirus will still run normally without the user interface, but the user interface cannot be enabled if you disable the core **Windows Defender** feature. ### Uninstall Microsoft Defender Antivirus using PowerShell >[!NOTE] >You can't uninstall the Windows Security app, but you can disable the interface with these instructions. -The following PowerShell cmdlet will also uninstall Microsoft Defender AV on Windows Server 2016 or 2019: +The following PowerShell cmdlet uninstalls Microsoft Defender Antivirus on Windows Server 2019 or Windows Server 2016: ```PowerShell Uninstall-WindowsFeature -Name Windows-Defender @@ -212,8 +212,7 @@ To turn off the Microsoft Defender Antivirus GUI, use the following PowerShell c Uninstall-WindowsFeature -Name Windows-Defender-GUI ``` - -## Related topics +## See also - [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md) From e703de61e2be347117c995e48740b3ae3fa66b3e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 16 Dec 2020 10:37:36 -0800 Subject: [PATCH 162/169] update URL --- .../microsoft-defender-atp/contact-support-usgov.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/contact-support-usgov.md b/windows/security/threat-protection/microsoft-defender-atp/contact-support-usgov.md index 4fefe095d8..8241f211f4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/contact-support-usgov.md +++ b/windows/security/threat-protection/microsoft-defender-atp/contact-support-usgov.md @@ -37,7 +37,7 @@ GCC-M | [https://gcc.securitycenter.windows.us](https://gcc.securitycenter.windo GCC-H | [https://securitycenter.windows.us](https://securitycenter.windows.us) DoD | [https://securitycenter.windows.us](https://securitycenter.windows.us) -If you are unable to login to the portal, you can also open a support case using the [phone](https://docs.microsoft.com/microsoft-365/admin/contact-support-for-business-products?view=o365-worldwide&tabs=phone). +If you are unable to login to the portal, you can also open a support case using the [phone](https://docs.microsoft.com/microsoft-365/admin/contact-support-for-business-products?view=o365-worldwide&tabs=phone&preserve-view=true). ## Opening a support case For prerequisites and instructions, see [Contact Microsoft Defender for Endpoint support](contact-support.md). \ No newline at end of file From d94c12b784c6559a0ff9b194ba5595e9154cdb16 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 16 Dec 2020 10:40:25 -0800 Subject: [PATCH 163/169] Update configuration-management-reference-microsoft-defender-antivirus.md --- ...ement-reference-microsoft-defender-antivirus.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md index 2a0313ec61..0b62bbc7af 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md @@ -11,7 +11,7 @@ ms.localizationpriority: medium author: denisebmsft ms.author: deniseb ms.custom: nextgen -ms.date: 09/03/2018 +ms.date: 12/16/2020 ms.reviewer: manager: dansimp --- @@ -27,12 +27,12 @@ manager: dansimp You can manage and configure Microsoft Defender Antivirus with the following tools: -- Microsoft Intune (now part of Microsoft Endpoint Manager) -- Microsoft Endpoint Configuration Manager (now part of Microsoft Endpoint Manager) -- Group Policy -- PowerShell cmdlets -- Windows Management Instrumentation (WMI) -- The Microsoft Malware Protection Command Line Utility (referred to as the *mpcmdrun.exe* utility +- [Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/endpoint-security-antivirus-policy) (now part of Microsoft Endpoint Manager) +- [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection-configure) (now part of Microsoft Endpoint Manager) +- [Group Policy](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus) +- [PowerShell cmdlets](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-powershell-cmdlets-microsoft-defender-antivirus) +- [Windows Management Instrumentation (WMI)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus) +- The [Microsoft Malware Protection Command Line Utility](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) (referred to as the *mpcmdrun.exe* utility The articles in this section provide further information, links, and resources for using these tools to manage and configure Microsoft Defender Antivirus. From e84ce686e509adfbf921ef7c9d3f0eb05596d460 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 16 Dec 2020 10:42:43 -0800 Subject: [PATCH 164/169] antivirus doc bug fixes --- ...t-reference-microsoft-defender-antivirus.md | 18 ++++++++---------- ...crosoft-defender-antivirus-compatibility.md | 1 - 2 files changed, 8 insertions(+), 11 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md b/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md index 0b62bbc7af..756111f940 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/configuration-management-reference-microsoft-defender-antivirus.md @@ -34,14 +34,12 @@ You can manage and configure Microsoft Defender Antivirus with the following too - [Windows Management Instrumentation (WMI)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-wmi-microsoft-defender-antivirus) - The [Microsoft Malware Protection Command Line Utility](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/command-line-arguments-microsoft-defender-antivirus) (referred to as the *mpcmdrun.exe* utility -The articles in this section provide further information, links, and resources for using these tools to manage and configure Microsoft Defender Antivirus. +The following articles provide further information, links, and resources for using these tools to manage and configure Microsoft Defender Antivirus. -## In this section - -Article | Description ----|--- -[Manage Microsoft Defender Antivirus with Microsoft Intune and Microsoft Endpoint Configuration Manager](use-intune-config-manager-microsoft-defender-antivirus.md)|Information about using Intune and Configuration Manager to deploy, manage, report, and configure Microsoft Defender Antivirus -[Manage Microsoft Defender Antivirus with Group Policy settings](use-group-policy-microsoft-defender-antivirus.md)|List of all Group Policy settings located in ADMX templates -[Manage Microsoft Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-microsoft-defender-antivirus.md)|Instructions for using PowerShell cmdlets to manage Microsoft Defender Antivirus, plus links to documentation for all cmdlets and allowed parameters -[Manage Microsoft Defender Antivirus with Windows Management Instrumentation (WMI)](use-wmi-microsoft-defender-antivirus.md)| Instructions for using WMI to manage Microsoft Defender Antivirus, plus links to documentation for the WMIv2 APIs (including all classes, methods, and properties) -[Manage Microsoft Defender Antivirus with the mpcmdrun.exe command-line tool](command-line-arguments-microsoft-defender-antivirus.md)|Instructions on using the dedicated command-line tool to manage and use Microsoft Defender Antivirus +| Article | Description | +|:---|:---| +|[Manage Microsoft Defender Antivirus with Microsoft Intune and Microsoft Endpoint Configuration Manager](use-intune-config-manager-microsoft-defender-antivirus.md)|Information about using Intune and Configuration Manager to deploy, manage, report, and configure Microsoft Defender Antivirus | +|[Manage Microsoft Defender Antivirus with Group Policy settings](use-group-policy-microsoft-defender-antivirus.md)|List of all Group Policy settings located in ADMX templates | +|[Manage Microsoft Defender Antivirus with PowerShell cmdlets](use-powershell-cmdlets-microsoft-defender-antivirus.md)|Instructions for using PowerShell cmdlets to manage Microsoft Defender Antivirus, plus links to documentation for all cmdlets and allowed parameters | +|[Manage Microsoft Defender Antivirus with Windows Management Instrumentation (WMI)](use-wmi-microsoft-defender-antivirus.md)| Instructions for using WMI to manage Microsoft Defender Antivirus, plus links to documentation for the WMIv2 APIs (including all classes, methods, and properties) | +|[Manage Microsoft Defender Antivirus with the mpcmdrun.exe command-line tool](command-line-arguments-microsoft-defender-antivirus.md)|Instructions on using the dedicated command-line tool to manage and use Microsoft Defender Antivirus | diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md index bb9e88a2d6..a51058e86c 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md @@ -20,7 +20,6 @@ ms.date: 12/11/2020 [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] - **Applies to:** - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) From dd3475c9697b77740af8ef0db151c4ae0b77648f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 16 Dec 2020 10:49:18 -0800 Subject: [PATCH 165/169] Update microsoft-defender-antivirus-on-windows-server-2016.md --- .../microsoft-defender-antivirus-on-windows-server-2016.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md index 86b682c59e..1f0746dcb5 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md @@ -36,7 +36,7 @@ The process of setting up and running Microsoft Defender Antivirus on a server p 1. [Enable the interface](#enable-the-user-interface-on-windows-server-2016-or-2019) -2. [Install Microsoft Defender Antivirus](#install-microsoft-defender-antivirus-on-windows-server-2016-or-2019) +2. [Install Microsoft Defender Antivirus](#install-microsoft-defender-antivirus-on-windows-server-2019-or-windows-server-2016) 2. [Verify Microsoft Defender Antivirus is running](#verify-microsoft-defender-antivirus-is-running) From 73f976d35a69412992eaade9620dcb1f5893ded0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 16 Dec 2020 10:50:29 -0800 Subject: [PATCH 166/169] Update microsoft-defender-antivirus-on-windows-server-2016.md --- .../microsoft-defender-antivirus-on-windows-server-2016.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md index 1f0746dcb5..2dd55a5ef2 100644 --- a/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md +++ b/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016.md @@ -15,7 +15,7 @@ ms.reviewer: manager: dansimp --- -# Microsoft Defender Antivirus on Windows Server 2016 and 2019 +# Microsoft Defender Antivirus on Windows Server 2019 and Windows Server 2016 [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] @@ -34,7 +34,7 @@ While the functionality, configuration, and management are largely the same for The process of setting up and running Microsoft Defender Antivirus on a server platform includes several steps: -1. [Enable the interface](#enable-the-user-interface-on-windows-server-2016-or-2019) +1. [Enable the interface](#enable-the-user-interface-on-windows-server-2019-or-windows-server-2016) 2. [Install Microsoft Defender Antivirus](#install-microsoft-defender-antivirus-on-windows-server-2019-or-windows-server-2016) @@ -48,7 +48,7 @@ The process of setting up and running Microsoft Defender Antivirus on a server p 6. (Only if necessary) [Uninstall Microsoft Defender Antivirus](#need-to-uninstall-microsoft-defender-antivirus) -## Enable the user interface on Windows Server 2016 or 2019 +## Enable the user interface on Windows Server 2019 or Windows Server 2016 By default, Microsoft Defender Antivirus is installed and functional on Windows Server 2019 and Windows Server 2016. The user interface (GUI) is installed by default on some SKUs, but is not required because you can use PowerShell or other methods to manage Microsoft Defender Antivirus. And if the GUI is not installed on your server, you can add it by using the Add Roles and Features Wizard or by using PowerShell. From 092152b7dc69556812578742ff03e547865d2cfc Mon Sep 17 00:00:00 2001 From: Shari Kjerland <30906736+SKjerland@users.noreply.github.com> Date: Wed, 16 Dec 2020 17:37:07 -0800 Subject: [PATCH 167/169] Replaced hello-faq.md with .yml file As part of the FAQ-content-type pilot, I replaced the .md file with a .yml file that uses Google-defined schema. --- browsers/edge/microsoft-edge-faq.yml | 15 +- .../hello-for-business/hello-faq.md | 173 --------------- .../hello-for-business/hello-faq.yml | 209 ++++++++++++++++++ .../hello-for-business/toc.md | 2 +- 4 files changed, 220 insertions(+), 179 deletions(-) delete mode 100644 windows/security/identity-protection/hello-for-business/hello-faq.md create mode 100644 windows/security/identity-protection/hello-for-business/hello-faq.yml diff --git a/browsers/edge/microsoft-edge-faq.yml b/browsers/edge/microsoft-edge-faq.yml index 830ca09109..e6f27046bd 100644 --- a/browsers/edge/microsoft-edge-faq.yml +++ b/browsers/edge/microsoft-edge-faq.yml @@ -49,21 +49,26 @@ sections: To learn more about Microsoft's plan for phasing Flash out of Microsoft Edge and Internet Explorer, see [The End of an Era — Next Steps for Adobe Flash](https://blogs.windows.com/msedgedev/2017/07/25/flash-on-windows-timeline/#3Bcc3QjRw0l7XsZ4.97) (blog article). - question: Does Microsoft Edge support ActiveX controls or BHOs like Silverlight or Java? - answer: No, Microsoft Edge doesn't support ActiveX controls and BHOs like Silverlight or Java. If you're running web apps that use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in Internet Explorer 11. Internet Explorer 11 offers additional security, manageability, performance, backward compatibility, and standards support. + answer: | + No, Microsoft Edge doesn't support ActiveX controls and Browser Helper Objects (BHOs) like Silverlight or Java. If you're running web apps that use ActiveX controls, x-ua-compatible headers, or legacy document modes, you need to keep running them in Internet Explorer 11. Internet Explorer 11 offers additional security, manageability, performance, backward compatibility, and standards support. - question: How often will Microsoft Edge be updated? - answer: In Windows 10, we're delivering Windows as a service, updated on a cadence driven by quality and the availability of new features. Microsoft Edge security updates are released every two to four weeks, while bigger feature updates are included in the Windows 10 releases on a semi-annual cadence. + answer: | + In Windows 10, we're delivering Windows as a service, updated on a cadence driven by quality and the availability of new features. Microsoft Edge security updates are released every two to four weeks, while bigger feature updates are included in the Windows 10 releases on a semi-annual cadence. - question: How can I provide feedback on Microsoft Edge? - answer: Microsoft Edge is an evergreen browser - we'll continue to evolve both the web platform and the user interface with regular updates. To send feedback on user experience, or on broken or malicious sites, use the **Send Feedback** option under the ellipses icon (**...**) in the Microsoft Edge toolbar. + answer: | + Microsoft Edge is an evergreen browser - we'll continue to evolve both the web platform and the user interface with regular updates. To send feedback on user experience, or on broken or malicious sites, use the **Send Feedback** option under the ellipses icon (**...**) in the Microsoft Edge toolbar. - question: Will Internet Explorer 11 continue to receive updates? answer: | We're committed to keeping Internet Explorer a supported, reliable, and safe browser. Internet Explorer is still a component of Windows and follows the support lifecycle of the OS on which it's installed. For details, see [Lifecycle FAQ - Internet Explorer](https://support.microsoft.com/help/17454/). While we continue to support and update Internet Explorer, the latest features and platform updates will only be available in Microsoft Edge. - question: How do I find out which version of Microsoft Edge I have? - answer: In the upper-right corner of Microsoft Edge, select the ellipses icon (**...**), and then select **Settings**. Look in the **About Microsoft Edge** section to find your version. + answer: | + In the upper-right corner of Microsoft Edge, select the ellipses icon (**...**), and then select **Settings**. Look in the **About Microsoft Edge** section to find your version. - question: What is Microsoft EdgeHTML? - answer: Microsoft EdgeHTML is the web rendering engine that powers the current Microsoft Edge web browser and Windows 10 web app platform (as opposed to *Microsoft Edge, based on Chromium*). + answer: | + Microsoft EdgeHTML is the web rendering engine that powers the current Microsoft Edge web browser and Windows 10 web app platform (as opposed to *Microsoft Edge, based on Chromium*). diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.md b/windows/security/identity-protection/hello-for-business/hello-faq.md deleted file mode 100644 index 8d7088b7b7..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-faq.md +++ /dev/null @@ -1,173 +0,0 @@ ---- -title: Windows Hello for Business Frequently Asked Questions -description: Use these frequently asked questions (FAQ) to learn important details about Windows Hello for Business. -keywords: identity, PIN, biometric, Hello, passport -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security, mobile -audience: ITPro -author: mapalko -ms.author: mapalko -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -localizationpriority: medium -ms.date: 08/19/2018 -ms.reviewer: ---- -# Windows Hello for Business Frequently Asked Questions - -**Applies to** -- Windows 10 - -## What about virtual smart cards? -Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date is set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends new Windows 10 deployments to use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8. - -## What about convenience PIN? -Microsoft is committed to its vision of a world without passwords. We recognize the *convenience* provided by convenience PIN, but it stills uses a password for authentication. Microsoft recommends customers using Windows 10 and convenience PINs should move to Windows Hello for Business. New Windows 10 deployments should deploy Windows Hello for Business and not convenience PINs. Microsoft will be deprecating convenience PINs in the future and will publish the date early to ensure customers have adequate lead time to deploy Windows Hello for Business. - -## Can I use Windows Hello for Business key trust and RDP? -RDP currently does not support using key based authentication and self signed certificates as supplied credentials. RDP with supplied credentials Windows Hello for Business is currently only supported with certificate based deployments. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). - -## Can I deploy Windows Hello for Business using Microsoft Endpoint Configuration Manager? -Windows Hello for Business deployments using Configuration Manager should use the hybrid deployment model that uses Active Directory Federation Services. Starting in Configuration Manager version 1910, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/windows-hello-for-business-settings). - -## How many users can enroll for Windows Hello for Business on a single Windows 10 computer? -The maximum number of supported enrollments on a single Windows 10 computer is 10. That enables 10 users to each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we will strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available. - -## How can a PIN be more secure than a password? -When using Windows Hello for Business, the PIN is not a symmetric key where is the password is a symmetric key. With passwords, there is a server that has some representation of the password. With Windows Hello for Business, the PIN is user provided entropy used to load the private key in the TPM. The server does not have a copy of the PIN. For that matter, the Windows client does not have a copy of the current PIN either. The user must provide the entropy, the TPM protected key, and the TPM that generated that key to successfully have access to the private key. - -The statement "PIN is stronger than Password" is not directed at the strength of the entropy used by the PIN. It is about the difference of providing entropy vs continuing the use of a symmetric key (the password). The TPM has anti-hammering features which thwart brute-force PIN attacks (an attackers continuous attempt to try all combination of PINs). Some organizations may worry about shoulder surfing. For those organizations, rather than increased the complexity of the PIN, implement the [Multifactor Unlock](feature-multifactor-unlock.md) feature. - -## Why is the Key Admins group missing, I have Windows Server 2016 domain controller(s)? -The **Key Admins** and **Enterprise Key Admins** groups are created when you install the first Windows Server 2016 domain controller into a domain. Domain controllers running previous versions of Windows Server cannot translate the security identifier (SID) to a name. To resolve this, transfer the PDC emulator domain role to a domain controller running Windows Server 2016. - -## Can I use a convenience PIN with Azure AD? -It is currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN is not supported for Azure Active Directory user accounts (synchronized identities included). It is only supported for on-premises Domain Joined users and local account users. - -## Can I use an external camera when my laptop is closed or docked? -No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further. - -## Why does authentication fail immediately after provisioning Hybrid Key Trust? -In a hybrid deployment, a user's public key must sync from Azure AD to AD before it can be used to authenticate against a domain controller. This sync is handled by Azure AD Connect and will occur during a normal sync cycle. - -## What is the password-less strategy? -Watch Principal Program Manager Karanbir Singh's Ignite 2017 presentation **Microsoft's guide for going password-less**. - -[Microsoft's password-less strategy](hello-videos.md#microsofts-passwordless-strategy) - -## What is the user experience for Windows Hello for Business? -The user experience for Windows Hello for Business occurs after user sign-in, after you deploy Windows Hello for Business policy settings to your environment. - -[Windows Hello for Business user enrollment experience](hello-videos.md#windows-hello-for-business-user-enrollment-experience) - -## What happens when my user forgets their PIN? -If the user can sign-in with a password, they can reset their PIN by clicking the "I forgot my PIN" link in settings. Beginning with Windows 10 1709, users can reset their PIN above the lock screen by clicking the "I forgot my PIN" link on the PIN credential provider. - -[Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience) - -For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. - -## What URLs do I need to allow for a hybrid deployment? -Communicating with Azure Active Directory uses the following URLs: -- enterpriseregistration.windows.net -- login.microsoftonline.com -- login.windows.net -- account.live.com -- accountalt.azureedge.net -- secure.aadcdn.microsoftonline-p.com - -If your environment uses Microsoft Intune, you need these additional URLs: -- enrollment.manage.microsoft.com -- portal.manage.microsoft.com - -## What is the difference between non-destructive and destructive PIN reset? -Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once on-boarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provided a second factor of authentication, and reset their PIN without re-provisioning a new Windows Hello for Business enrollment. This is a non-destructive PIN reset because the user does not delete the current credential and obtain a new one. Read [PIN Reset](hello-feature-pin-reset.md) page for more information. - -Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. with destructive PIN reset, users that have forgotten their PIN can authenticate using their password, perform a second factor of authentication to re-provision their Windows Hello for Business credential. Re-provisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. Also, for hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services. - -## Which is better or more secure: Key trust or Certificate trust? -The trust models of your deployment determine how you authenticate to Active Directory (on-premises). Both key trust and certificate trust use the same hardware-backed, two-factor credential. The difference between the two trust types are: -- Required domain controllers -- Issuing end entity certificates - -The **key trust** model authenticates to Active Directory using a raw key. Windows Server 2016 domain controllers enables this authentication. Key trust authenticate does not require an enterprise issued certificate, therefore you do not need to issue certificates to your end users (domain controller certificates are still needed). - -The **certificate trust** model authenticates to Active Directory using a certificate. Because this authentication uses a certificate, domain controllers running previous versions of Windows Server can authenticate the user. Therefore, you need to issue certificates to your end users, but you do not need Windows Server 2016 domain controllers. The certificate used in certificate trust uses the TPM protected private key to request a certificate from your enterprise's issuing certificate authority. - -## Do I need Windows Server 2016 domain controllers? -There are many deployment options from which to choose. Some of those options require an adequate number of Windows Server 2016 domain controllers in the site where you have deployed Windows Hello for Business. There are other deployment options that use existing Windows Server 2008 R2 or later domain controllers. Choose the deployment option that best suits your environment. - -## What attributes are synchronized by Azure AD Connect with Windows Hello for Business? -Review [Azure AD Connect sync: Attributes synchronized to Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized) for a list of attributes that are sync based on scenarios. The base scenarios that include Windows Hello for Business are [Windows 10](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#windows-10) scenario and the [Device writeback](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#device-writeback) scenario. Your environment may include additional attributes. - -## Is Windows Hello for Business multifactor authentication? -Windows Hello for Business is two-factor authentication based on the observed authentication factors of: something you have, something you know, and something part of you. Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN). With the proper hardware, you can enhance the user experience by introducing biometrics. Using biometrics, you can replace the "something you know" authentication factor with the "something that is part of you" factor, with the assurances that users can fall back to the "something you know factor". - -## What are the biometric requirements for Windows Hello for Business? -Read [Windows Hello biometric requirements](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-biometric-requirements) for more information. - -## Can I use both a PIN and biometrics to unlock my device? -Starting in Windows 10, version 1709, you can use multi-factor unlock to require the user to provide an additional factor to unlock the device. Authentication remains two-factor, but another factor is required before Windows allows the user to reach the desktop. Read more about [multifactor unlock](feature-multifactor-unlock.md). - -## What is the difference between Windows Hello and Windows Hello for Business? -Windows Hello represents the biometric framework provided in Windows 10. Windows Hello enables users to use biometrics to sign into their devices by securely storing their user name and password and releasing it for authentication when the user successfully identifies themselves using biometrics. Windows Hello for Business uses asymmetric keys protected by the device's security module that requires a user gesture (PIN or biometrics) to authenticate. - -## Why can't I enroll biometrics for my local built-in Administrator? -Windows 10 does not allow the local administrator to enroll biometric gestures (face or fingerprint). - -## I have extended Active Directory to Azure Active Directory. Can I use the on-premises deployment model? -No. If your organization is federated or using on-line services, such as Azure AD Connect, Office 365, or OneDrive, then you must use a hybrid deployment model. On-premises deployments are exclusive to organization who need more time before moving to the cloud and exclusively use Active Directory. - -## Does Windows Hello for Business prevent the use of simple PINs? -Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. The algorithm counts the number of steps required to reach the next digit, overflowing at ten ('zero'). -So, for example: -* The PIN 1111 has a constant delta of (0,0,0), so it is not allowed -* The PIN 1234 has a constant delta of (1,1,1), so it is not allowed -* The PIN 1357 has a constant delta of (2,2,2), so it is not allowed -* The PIN 9630 has a constant delta of (7,7,7), so it is not allowed -* The PIN 1593 has a constant delta of (4,4,4), so it is not allowed -* The PIN 7036 has a constant delta of (3,3,3), so it is not allowed -* The PIN 1231 does not have a constant delta (1,1,8), so it is allowed -* The PIN 1872 does not have a constant delta (7,9,5), so it is allowed - -This prevents repeating numbers, sequential numbers, and simple patterns. -It always results in a list of 100 disallowed PINs (independent of the PIN length). -This algorithm does not apply to alphanumeric PINs. - -## How does PIN caching work with Windows Hello for Business? - -Windows Hello for Business provides a PIN caching user experience using a ticketing system. Rather than caching a PIN, processes cache a ticket they can use to request private key operations. Azure AD and Active Directory sign-in keys are cached under lock. This means the keys remain available for use without prompting as long as the user is interactively signed-in. Microsoft Account sign-in keys are considered transactional keys, which means the user is always prompted when accessing the key. - -Beginning with Windows 10, version 1709, Windows Hello for Business used as a smart card (smart card emulation that is enabled by default) provides the same user experience of default smart card PIN caching. Each process requesting a private key operation will prompt the user for the PIN on first use. Subsequent private key operations will not prompt the user for the PIN. - -The smart card emulation feature of Windows Hello for Business verifies the PIN and then discards the PIN in exchange for a ticket. The process does not receive the PIN, but rather the ticket that grants them private key operations. Windows 10 does not provide any Group Policy settings to adjust this caching. - -## Can I disable the PIN while using Windows Hello for Business? -No. The movement away from passwords is accomplished by gradually reducing the use of the password. In the occurrence where you cannot authenticate with biometrics, you need a fallback mechanism that is not a password. The PIN is the fallback mechanism. Disabling or hiding the PIN credential provider will disable the use of biometrics. - -## How are keys protected? -Wherever possible, Windows Hello for Business takes advantage of trusted platform module (TPM) 2.0 hardware to generate and protect keys. However, Windows Hello and Windows Hello for Business does not require a TPM. Administrators can choose to allow key operations in software. - -Whenever possible, Microsoft strongly recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will have to reset the PIN (which means he or she will have to use MFA to re-authenticate to the IDP before the IDP allows him or her to re-register). - -## Can Windows Hello for Business work in air-gapped environments? -Yes. You can use the on-premises Windows Hello for Business deployment and combine it with a third-party MFA provider that does not require Internet connectivity to achieve an air-gapped Windows Hello for Business deployment. - -## Can I use third-party authentication providers with Windows Hello for Business? -Yes, if you are federated hybrid deployment, you can use any third-party that provides an Active Directory Federation Services (AD FS) multi-factor authentication adapter. A list of third-party MFA adapters can be found [here](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods). - -## Does Windows Hello for Business work with third party federation servers? -Windows Hello for Business can work with any third-party federation servers that support the protocols used during provisioning experience. Interested third-parties can inquiry at [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). - -| Protocol | Description | -| :---: | :--- | -| [[MS-KPP]: Key Provisioning Protocol](https://msdn.microsoft.com/library/mt739755.aspx) | Specifies the Key Provisioning Protocol, which defines a mechanism for a client to register a set of cryptographic keys on a user and device pair. | -| [[MS-OAPX]: OAuth 2.0 Protocol Extensions](https://msdn.microsoft.com/library/dn392779.aspx)| Specifies the OAuth 2.0 Protocol Extensions, which are used to extend the OAuth 2.0 Authorization Framework. These extensions enable authorization features such as resource specification, request identifiers, and login hints. | -| [[MS-OAPXBC]: OAuth 2.0 Protocol Extensions for Broker Clients](https://msdn.microsoft.com/library/mt590278.aspx) | Specifies the OAuth 2.0 Protocol Extensions for Broker Clients, extensions to RFC6749 (The OAuth 2.0 Authorization Framework) that allow a broker client to obtain access tokens on behalf of calling clients. | -| [[MS-OIDCE]: OpenID Connect 1.0 Protocol Extensions](https://msdn.microsoft.com/library/mt766592.aspx) | Specifies the OpenID Connect 1.0 Protocol Extensions. These extensions define additional claims to carry information about the end user, including the user principal name, a locally unique identifier, a time for password expiration, and a URL for password change. These extensions also define additional provider meta-data that enable the discovery of the issuer of access tokens and give additional information about provider capabilities. | - -## Does Windows Hello for Business work with Mac and Linux clients? -Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third parties who are interested in moving these platforms away from passwords. Interested third parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml new file mode 100644 index 0000000000..d4db9fb009 --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -0,0 +1,209 @@ +### YamlMime:FAQ +metadata: + title: Windows Hello for Business Frequently Asked Questions + description: Use these frequently asked questions (FAQ) to learn important details about Windows Hello for Business. + keywords: identity, PIN, biometric, Hello, passport + ms.prod: w10 + ms.mktglfcycl: deploy + ms.sitesec: library + ms.pagetype: security, mobile + audience: ITPro + author: mapalko + ms.author: mapalko + manager: dansimp + ms.collection: M365-identity-device-management + ms.topic: article + localizationpriority: medium + ms.date: 08/19/2018 + ms.reviewer: + +title: Windows Hello for Business Frequently Asked Questions +summary: | + **Applies to** + - Windows 10 + + +sections: + - name: Ignored + questions: + - question: What about virtual smart cards? + answer: | + Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft will be deprecating virtual smart cards in the future, but no date is set at this time. Customers using Windows 10 and virtual smart cards should move to Windows Hello for Business. Microsoft will publish the date early to ensure customers have adequate lead time to move to Windows Hello for Business. Microsoft recommends that new Windows 10 deployments use Windows Hello for Business. Virtual smart card remain supported for Windows 7 and Windows 8. + + - question: What about convenience PIN? + answer: | + Microsoft is committed to its vision of a world without passwords. We recognize the *convenience* provided by convenience PIN, but it stills uses a password for authentication. Microsoft recommends that customers using Windows 10 and convenience PINs should move to Windows Hello for Business. New Windows 10 deployments should deploy Windows Hello for Business and not convenience PINs. Microsoft will be deprecating convenience PINs in the future and will publish the date early to ensure customers have adequate lead time to deploy Windows Hello for Business. + + - question: Can I use Windows Hello for Business key trust and RDP? + answer: | + Remote Desktop Protocol (RDP) does not currently support using key-based authentication and self-signed certificates as supplied credentials. RDP with supplied credentials is currently only supported with certificate-based deployments. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). + + - question: Can I deploy Windows Hello for Business by using Microsoft Endpoint Configuration Manager? + answer: | + Windows Hello for Business deployments using Configuration Manager should follow the hybrid deployment model that uses Active Directory Federation Services. Starting in Configuration Manager version 1910, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/windows-hello-for-business-settings). + + - question: How many users can enroll for Windows Hello for Business on a single Windows 10 computer? + answer: | + The maximum number of supported enrollments on a single Windows 10 computer is 10. This lets 10 users each enroll their face and up to 10 fingerprints. While we support 10 enrollments, we will strongly encourage the use of Windows Hello security keys for the shared computer scenario when they become available. + + - question: How can a PIN be more secure than a password? + answer: | + When using Windows Hello for Business, the PIN is not a symmetric key, whereas the password is a symmetric key. With passwords, there's a server that has some representation of the password. With Windows Hello for Business, the PIN is user-provided entropy used to load the private key in the Trusted Platform Module (TPM). The server does not have a copy of the PIN. For that matter, the Windows client does not have a copy of the current PIN either. The user must provide the entropy, the TPM-protected key, and the TPM that generated that key in order to successfully access the private key. + + The statement "PIN is stronger than Password" is not directed at the strength of the entropy used by the PIN. It's about the difference between providing entropy versus continuing the use of a symmetric key (the password). The TPM has anti-hammering features that thwart brute-force PIN attacks (an attacker's continuous attempt to try all combination of PINs). Some organizations may worry about shoulder surfing. For those organizations, rather than increase the complexity of the PIN, implement the [Multifactor Unlock](feature-multifactor-unlock.md) feature. + + - question: I have Windows Server 2016 domain controller(s), so why is the Key Admins group missing? + answer: | + The **Key Admins** and **Enterprise Key Admins** groups are created when you install the first Windows Server 2016 domain controller into a domain. Domain controllers running previous versions of Windows Server cannot translate the security identifier (SID) to a name. To resolve this, transfer the PDC emulator domain role to a domain controller running Windows Server 2016. + + - question: Can I use a convenience PIN with Azure Active Directory? + answer: | + It's currently possible to set a convenience PIN on Azure Active Directory Joined or Hybrid Active Directory Joined devices. Convenience PIN is not supported for Azure Active Directory user accounts (synchronized identities included). It's only supported for on-premises Domain Joined users and local account users. + + - question: Can I use an external camera when my laptop is closed or docked? + answer: | + No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further. + + - question: Why does authentication fail immediately after provisioning Hybrid Key Trust? + answer: | + In a hybrid deployment, a user's public key must sync from Azure AD to AD before it can be used to authenticate against a domain controller. This sync is handled by Azure AD Connect and will occur during a normal sync cycle. + + - question: What is the password-less strategy? + answer: | + Watch Principal Program Manager Karanbir Singh's **Microsoft's guide for going password-less** Ignite 2017 presentation. + + [Microsoft's password-less strategy](hello-videos.md#microsofts-passwordless-strategy) + + - question: What is the user experience for Windows Hello for Business? + answer: | + The user experience for Windows Hello for Business occurs after user sign-in, after you deploy Windows Hello for Business policy settings to your environment. + + [Windows Hello for Business user enrollment experience](hello-videos.md#windows-hello-for-business-user-enrollment-experience) + + - question: What happens when a user forgets their PIN? + answer: | + If the user can sign-in with a password, they can reset their PIN by selecting the "I forgot my PIN" link under Settings. Beginning with Windows 10 1709, users can reset their PIN above the lock screen by selecting the "I forgot my PIN" link on the PIN credential provider. + + [Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience) + + For on-premises deployments, devices must be well-connected to their on-premises network (domain controllers and/or certificate authority) to reset their PINs. Hybrid customers can on-board their Azure tenant to use the Windows Hello for Business PIN reset service to reset their PINs without access to their corporate network. + + - question: What URLs do I need to allow for a hybrid deployment? + answer: | + Communicating with Azure Active Directory uses the following URLs: + - enterpriseregistration.windows.net + - login.microsoftonline.com + - login.windows.net + - account.live.com + - accountalt.azureedge.net + - secure.aadcdn.microsoftonline-p.com + + If your environment uses Microsoft Intune, you need these additional URLs: + - enrollment.manage.microsoft.com + - portal.manage.microsoft.com + + - question: What is the difference between non-destructive and destructive PIN reset? + answer: | + Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once onboarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provide a second factor of authentication, and reset their PIN without re-provisioning a new Windows Hello for Business enrollment. This is a non-destructive PIN reset because the user doesn't delete the current credential and obtain a new one. For more information, see [PIN Reset](hello-feature-pin-reset.md). + + Organizations that have the on-premises deployment of Windows Hello for Business, or those not using Windows 10 Enterprise can use destructive PIN reset. With destructive PIN reset, users that have forgotten their PIN can authenticate by using their password and then performing a second factor of authentication to re-provision their Windows Hello for Business credential. Re-provisioning deletes the old credential and requests a new credential and certificate. On-premises deployments need network connectivity to their domain controllers, Active Directory Federation Services, and their issuing certificate authority to perform a destructive PIN reset. Also, for hybrid deployments, destructive PIN reset is only supported with the certificate trust model and the latest updates to Active Directory Federation Services. + + - question: | + Which is better or more secure: key trust or certificate trust? + answer: | + The trust models of your deployment determine how you authenticate to Active Directory (on-premises). Both key trust and certificate trust use the same hardware-backed, two-factor credential. The difference between the two trust types are: + - Required domain controllers + - Issuing end entity certificates + + The **key trust** model authenticates to Active Directory by using a raw key. Windows Server 2016 domain controllers enable this authentication. Key trust authenticate does not require an enterprise issued certificate, therefore you don't need to issue certificates to users (domain controller certificates are still needed). + + The **certificate trust** model authenticates to Active Directory by using a certificate. Because this authentication uses a certificate, domain controllers running previous versions of Windows Server can authenticate the user. Therefore, you need to issue certificates to users, but you don't need Windows Server 2016 domain controllers. The certificate used in certificate trust uses the TPM-protected private key to request a certificate from your enterprise's issuing certificate authority. + + - question: Do I need Windows Server 2016 domain controllers? + answer: | + There are many deployment options from which to choose. Some of those options require an adequate number of Windows Server 2016 domain controllers in the site where you've deployed Windows Hello for Business. There are other deployment options that use existing Windows Server 2008 R2 or later domain controllers. Choose the deployment option that best suits your environment. + + - question: What attributes are synchronized by Azure AD Connect with Windows Hello for Business? + answer: | + Review [Azure AD Connect sync: Attributes synchronized to Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized) for a list of attributes that sync based on scenarios. The base scenarios that include Windows Hello for Business are the [Windows 10](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#windows-10) scenario and the [Device writeback](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnectsync-attributes-synchronized#device-writeback) scenario. Your environment may include additional attributes. + + - question: Is Windows Hello for Business multifactor authentication? + answer: | + Windows Hello for Business is two-factor authentication based on the observed authentication factors of: something you have, something you know, and something that's part of you. Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN). With the proper hardware, you can enhance the user experience by introducing biometrics. By using biometrics, you can replace the "something you know" authentication factor with the "something that is part of you" factor, with the assurances that users can fall back to the "something you know factor". + + - question: What are the biometric requirements for Windows Hello for Business? + answer: | + Read [Windows Hello biometric requirements](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-biometric-requirements) for more information. + + - question: Can I use both a PIN and biometrics to unlock my device? + answer: | + Starting in Windows 10, version 1709, you can use multi-factor unlock to require users to provide an additional factor to unlock their device. Authentication remains two-factor, but another factor is required before Windows allows the user to reach the desktop. To learn more, see [Multifactor Unlock](feature-multifactor-unlock.md). + + - question: What's the difference between Windows Hello and Windows Hello for Business? + answer: | + Windows Hello represents the biometric framework provided in Windows 10. Windows Hello lets users use biometrics to sign in to their devices by securely storing their user name and password and releasing it for authentication when the user successfully identifies themselves using biometrics. Windows Hello for Business uses asymmetric keys protected by the device's security module that requires a user gesture (PIN or biometrics) to authenticate. + + - question: Why can't I enroll biometrics for my local, built-in administrator? + answer: | + Windows 10 does not allow the local administrator to enroll biometric gestures (face or fingerprint). + + - question: I have extended Active Directory to Azure Active Directory. Can I use the on-premises deployment model? + answer: | + No. If your organization is federated or using online services, such as Azure AD Connect, Office 365, or OneDrive, then you must use a hybrid deployment model. On-premises deployments are exclusive to organizations who need more time before moving to the cloud and exclusively use Active Directory. + + - question: Does Windows Hello for Business prevent the use of simple PINs? + answer: | + Yes. Our simple PIN algorithm looks for and disallows any PIN that has a constant delta from one digit to the next. The algorithm counts the number of steps required to reach the next digit, overflowing at ten ('zero'). + So, for example: + + - The PIN 1111 has a constant delta of (0,0,0), so it is not allowed + - The PIN 1234 has a constant delta of (1,1,1), so it is not allowed + - The PIN 1357 has a constant delta of (2,2,2), so it is not allowed + - The PIN 9630 has a constant delta of (7,7,7), so it is not allowed + - The PIN 1593 has a constant delta of (4,4,4), so it is not allowed + - The PIN 7036 has a constant delta of (3,3,3), so it is not allowed + - The PIN 1231 does not have a constant delta (1,1,8), so it is allowed + - The PIN 1872 does not have a constant delta (7,9,5), so it is allowed + + This prevents repeating numbers, sequential numbers, and simple patterns. It always results in a list of 100 disallowed PINs (independent of the PIN length). This algorithm does not apply to alphanumeric PINs. + + - question: How does PIN caching work with Windows Hello for Business? + answer: | + Windows Hello for Business provides a PIN caching user experience by using a ticketing system. Rather than caching a PIN, processes cache a ticket they can use to request private key operations. Azure AD and Active Directory sign-in keys are cached under lock. This means the keys remain available for use without prompting, as long as the user is interactively signed-in. Microsoft Account sign-in keys are considered transactional keys, which means the user is always prompted when accessing the key. + + Beginning with Windows 10, version 1709, Windows Hello for Business used as a smart card (smart card emulation that is enabled by default) provides the same user experience of default smart card PIN caching. Each process requesting a private key operation will prompt the user for the PIN on first use. Subsequent private key operations will not prompt the user for the PIN. + + The smart card emulation feature of Windows Hello for Business verifies the PIN and then discards the PIN in exchange for a ticket. The process does not receive the PIN, but rather the ticket that grants them private key operations. Windows 10 does not provide any Group Policy settings to adjust this caching. + + - question: Can I disable the PIN while using Windows Hello for Business? + answer: | + No. The movement away from passwords is accomplished by gradually reducing the use of the password. In situations where you can't authenticate by using biometrics, you need a fallback mechanism that is not a password. The PIN is the fallback mechanism. Disabling or hiding the PIN credential provider will disable the use of biometrics. + + - question: How are keys protected? + answer: | + Wherever possible, Windows Hello for Business takes advantage of Trusted Platform Module (TPM) 2.0 hardware to generate and protect keys. However, Windows Hello and Windows Hello for Business do not require a TPM. Administrators can choose to allow key operations in software. + + Whenever possible, Microsoft strongly recommends the use of TPM hardware. The TPM protects against a variety of known and potential attacks, including PIN brute-force attacks. The TPM provides an additional layer of protection after an account lockout, too. When the TPM has locked the key material, the user will need to reset the PIN (which means they'll need to use MFA to re-authenticate to the IDP before the IDP allows them to re-register). + + - question: Can Windows Hello for Business work in air-gapped environments? + answer: | + Yes. You can use the on-premises Windows Hello for Business deployment and combine it with a third-party MFA provider that does not require internet connectivity to achieve an air-gapped Windows Hello for Business deployment. + + - question: Can I use third-party authentication providers with Windows Hello for Business? + answer: | + Yes, if you're using federated hybrid deployment, you can use any third-party that provides an Active Directory Federation Services (AD FS) multi-factor authentication adapter. A list of third-party MFA adapters can be found [here](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods). + + - question: Does Windows Hello for Business work with third party federation servers? + answer: | + Windows Hello for Business works with any third-party federation servers that support the protocols used during the provisioning experience. Interested third-parties can inquiry at [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). + + | Protocol | Description | + | :---: | :--- | + | [[MS-KPP]: Key Provisioning Protocol](https://msdn.microsoft.com/library/mt739755.aspx) | Specifies the Key Provisioning Protocol, which defines a mechanism for a client to register a set of cryptographic keys on a user and device pair. | + | [[MS-OAPX]: OAuth 2.0 Protocol Extensions](https://msdn.microsoft.com/library/dn392779.aspx)| Specifies the OAuth 2.0 Protocol Extensions, which are used to extend the OAuth 2.0 Authorization Framework. These extensions enable authorization features such as resource specification, request identifiers, and login hints. | + | [[MS-OAPXBC]: OAuth 2.0 Protocol Extensions for Broker Clients](https://msdn.microsoft.com/library/mt590278.aspx) | Specifies the OAuth 2.0 Protocol Extensions for Broker Clients, extensions to RFC6749 (the OAuth 2.0 Authorization Framework) that allow a broker client to obtain access tokens on behalf of calling clients. | + | [[MS-OIDCE]: OpenID Connect 1.0 Protocol Extensions](https://msdn.microsoft.com/library/mt766592.aspx) | Specifies the OpenID Connect 1.0 Protocol Extensions. These extensions define additional claims to carry information about the user, including the user principal name, a locally unique identifier, a time for password expiration, and a URL for password change. These extensions also define additional provider meta-data that enables the discovery of the issuer of access tokens and gives additional information about provider capabilities. | + + - question: Does Windows Hello for Business work with Mac and Linux clients? + answer: | + Windows Hello for Business is a feature of Windows 10. At this time, Microsoft is not developing clients for other platforms. However, Microsoft is open to third-parties who are interested in moving these platforms away from passwords. Interested third-parties can get more information by emailing [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/toc.md b/windows/security/identity-protection/hello-for-business/toc.md index 8ec19c126f..3913ea8734 100644 --- a/windows/security/identity-protection/hello-for-business/toc.md +++ b/windows/security/identity-protection/hello-for-business/toc.md @@ -63,7 +63,7 @@ ## [Windows Hello and password changes](hello-and-password-changes.md) ## [Prepare people to use Windows Hello](hello-prepare-people-to-use.md) -## [Windows Hello for Business Frequently Asked Questions (FAQ)](hello-faq.md) +## [Windows Hello for Business Frequently Asked Questions (FAQ)](hello-faq.yml) ### [Windows Hello for Business Videos](hello-videos.md) ## [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) From 6d992ebbf491e2b1b06dd6996f090bd2820d1971 Mon Sep 17 00:00:00 2001 From: Shari Kjerland <30906736+SKjerland@users.noreply.github.com> Date: Wed, 16 Dec 2020 17:54:44 -0800 Subject: [PATCH 168/169] Minor fixes --- browsers/edge/microsoft-edge-faq.yml | 2 +- .../hello-for-business/hello-faq.yml | 13 ++++++------- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/browsers/edge/microsoft-edge-faq.yml b/browsers/edge/microsoft-edge-faq.yml index e6f27046bd..2cf801b44d 100644 --- a/browsers/edge/microsoft-edge-faq.yml +++ b/browsers/edge/microsoft-edge-faq.yml @@ -15,7 +15,7 @@ metadata: title: Frequently Asked Questions (FAQs) for IT Pros summary: | - >Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile + Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile > [!NOTE] > You've reached the documentation for Microsoft Edge version 45 and earlier. To see the documentation for Microsoft Edge version 77 or later, go to the [Microsoft Edge documentation landing page](https://docs.microsoft.com/DeployEdge/). diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index d4db9fb009..92e87082b1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -19,8 +19,7 @@ metadata: title: Windows Hello for Business Frequently Asked Questions summary: | - **Applies to** - - Windows 10 + Applies to: Windows 10 sections: @@ -64,7 +63,7 @@ sections: answer: | No. Windows 10 currently only supports one Windows Hello for Business camera and does not fluidly switch to an external camera when the computer is docked with the lid closed. The product group is aware of this and is investigating this topic further. - - question: Why does authentication fail immediately after provisioning Hybrid Key Trust? + - question: Why does authentication fail immediately after provisioning hybrid key trust? answer: | In a hybrid deployment, a user's public key must sync from Azure AD to AD before it can be used to authenticate against a domain controller. This sync is handled by Azure AD Connect and will occur during a normal sync cycle. @@ -82,7 +81,7 @@ sections: - question: What happens when a user forgets their PIN? answer: | - If the user can sign-in with a password, they can reset their PIN by selecting the "I forgot my PIN" link under Settings. Beginning with Windows 10 1709, users can reset their PIN above the lock screen by selecting the "I forgot my PIN" link on the PIN credential provider. + If the user can sign-in with a password, they can reset their PIN by selecting the "I forgot my PIN" link in Settings. Beginning with Windows 10 1709, users can reset their PIN above the lock screen by selecting the "I forgot my PIN" link on the PIN credential provider. [Windows Hello for Business forgotten PIN user experience](hello-videos.md#windows-hello-for-business-forgotten-pin-user-experience) @@ -102,7 +101,7 @@ sections: - enrollment.manage.microsoft.com - portal.manage.microsoft.com - - question: What is the difference between non-destructive and destructive PIN reset? + - question: What's the difference between non-destructive and destructive PIN reset? answer: | Windows Hello for Business has two types of PIN reset: non-destructive and destructive. Organizations running Windows 10 Enterprise and Azure Active Directory can take advantage of the Microsoft PIN Reset service. Once onboarded to a tenant and deployed to computers, users who have forgotten their PINs can authenticate to Azure, provide a second factor of authentication, and reset their PIN without re-provisioning a new Windows Hello for Business enrollment. This is a non-destructive PIN reset because the user doesn't delete the current credential and obtain a new one. For more information, see [PIN Reset](hello-feature-pin-reset.md). @@ -193,9 +192,9 @@ sections: answer: | Yes, if you're using federated hybrid deployment, you can use any third-party that provides an Active Directory Federation Services (AD FS) multi-factor authentication adapter. A list of third-party MFA adapters can be found [here](https://docs.microsoft.com/windows-server/identity/ad-fs/operations/configure-additional-authentication-methods-for-ad-fs#microsoft-and-third-party-additional-authentication-methods). - - question: Does Windows Hello for Business work with third party federation servers? + - question: Does Windows Hello for Business work with third-party federation servers? answer: | - Windows Hello for Business works with any third-party federation servers that support the protocols used during the provisioning experience. Interested third-parties can inquiry at [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration). + Windows Hello for Business works with any third-party federation servers that support the protocols used during the provisioning experience. Interested third-parties can inquiry at [whfbfeedback@microsoft.com](mailto:whfbfeedback@microsoft.com?subject=collaboration).

| Protocol | Description | | :---: | :--- | From fc5ce1e0f586ff8ef5e46eff8bc639a509c51de6 Mon Sep 17 00:00:00 2001 From: Shari Kjerland <30906736+SKjerland@users.noreply.github.com> Date: Wed, 16 Dec 2020 18:03:55 -0800 Subject: [PATCH 169/169] Minor fixes --- browsers/edge/TOC.md | 2 +- browsers/edge/microsoft-edge-faq.yml | 4 ++-- .../identity-protection/hello-for-business/hello-faq.yml | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/browsers/edge/TOC.md b/browsers/edge/TOC.md index 0f0c4989e5..bae1f59877 100644 --- a/browsers/edge/TOC.md +++ b/browsers/edge/TOC.md @@ -28,6 +28,6 @@ ## [Change history for Microsoft Edge](change-history-for-microsoft-edge.md) -## [Microsoft Edge Frequently Asked Questions (FAQs)](microsoft-edge-faq.yml) +## [Microsoft Edge Frequently Asked Questions (FAQ)](microsoft-edge-faq.yml) diff --git a/browsers/edge/microsoft-edge-faq.yml b/browsers/edge/microsoft-edge-faq.yml index 2cf801b44d..751f40f4ea 100644 --- a/browsers/edge/microsoft-edge-faq.yml +++ b/browsers/edge/microsoft-edge-faq.yml @@ -1,6 +1,6 @@ ### YamlMime:FAQ metadata: - title: Microsoft Edge - Frequently Asked Questions (FAQs) for IT Pros + title: Microsoft Edge - Frequently Asked Questions (FAQ) for IT Pros ms.reviewer: audience: itpro manager: dansimp @@ -13,7 +13,7 @@ metadata: ms.sitesec: library ms.localizationpriority: medium -title: Frequently Asked Questions (FAQs) for IT Pros +title: Frequently Asked Questions (FAQ) for IT Pros summary: | Applies to: Microsoft Edge on Windows 10 and Windows 10 Mobile diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.yml b/windows/security/identity-protection/hello-for-business/hello-faq.yml index 92e87082b1..aae7b07f4a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.yml +++ b/windows/security/identity-protection/hello-for-business/hello-faq.yml @@ -1,6 +1,6 @@ ### YamlMime:FAQ metadata: - title: Windows Hello for Business Frequently Asked Questions + title: Windows Hello for Business Frequently Asked Questions (FAQ) description: Use these frequently asked questions (FAQ) to learn important details about Windows Hello for Business. keywords: identity, PIN, biometric, Hello, passport ms.prod: w10 @@ -17,7 +17,7 @@ metadata: ms.date: 08/19/2018 ms.reviewer: -title: Windows Hello for Business Frequently Asked Questions +title: Windows Hello for Business Frequently Asked Questions (FAQ) summary: | Applies to: Windows 10