From 504c7bf68b17b9234de03a4e4e3de33872bcc861 Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Tue, 2 Oct 2018 21:56:39 +0000 Subject: [PATCH 1/7] Merged PR 11779: Fixed what's new merge issue - live publish --- .../auditing/audit-ipsec-driver.md | 4 ++-- .../auditing/audit-ipsec-extended-mode.md | 16 +++++++-------- .../auditing/audit-ipsec-main-mode.md | 20 +++++++++---------- .../auditing/audit-ipsec-quick-mode.md | 8 ++++---- .../whats-new-windows-10-version-1809.md | 3 --- 5 files changed, 24 insertions(+), 27 deletions(-) diff --git a/windows/security/threat-protection/auditing/audit-ipsec-driver.md b/windows/security/threat-protection/auditing/audit-ipsec-driver.md index 4b1c430188..1fb88b5fd4 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-driver.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-driver.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: Mir0sh -ms.date: 04/19/2017 +ms.date: 10/02/2018 --- # Audit IPsec Driver @@ -56,7 +56,7 @@ This subcategory is outside the scope of this document. ## 5478(S): IPsec Services has started successfully. -## 5479(): IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. +## 5479(S): IPsec Services has been shut down successfully. The shutdown of IPsec Services can put the computer at greater risk of network attack or expose the computer to potential security risks. ## 5480(F): IPsec Services failed to get the complete list of network interfaces on the computer. This poses a potential security risk because some of the network interfaces may not get the protection provided by the applied IPsec filters. Use the IP Security Monitor snap-in to diagnose the problem. diff --git a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md index 9edf8ad528..e9388ef13f 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-extended-mode.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: Mir0sh -ms.date: 04/19/2017 +ms.date: 10/02/2018 --- # Audit IPsec Extended Mode @@ -28,17 +28,17 @@ Audit IPsec Extended Mode subcategory is out of scope of this document, because | Member Server | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Extended Mode troubleshooting, or for tracing or monitoring IPsec Extended Mode operations. | | Workstation | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Extended Mode troubleshooting, or for tracing or monitoring IPsec Extended Mode operations. | -## 4978: During Extended Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. +## 4978(S): During Extended Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. -## 4979: IPsec Main Mode and Extended Mode security associations were established. +## 4979(S): IPsec Main Mode and Extended Mode security associations were established. -## 4980: IPsec Main Mode and Extended Mode security associations were established. +## 4980(S): IPsec Main Mode and Extended Mode security associations were established. -## 4981: IPsec Main Mode and Extended Mode security associations were established. +## 4981(S): IPsec Main Mode and Extended Mode security associations were established. -## 4982: IPsec Main Mode and Extended Mode security associations were established. +## 4982(S): IPsec Main Mode and Extended Mode security associations were established. -## 4983: An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. +## 4983(S): An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. -## 4984: An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. +## 4984(S): An IPsec Extended Mode negotiation failed. The corresponding Main Mode security association has been deleted. diff --git a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md index d0764daf4b..1a34ba32f3 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-main-mode.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: Mir0sh -ms.date: 04/19/2017 +ms.date: 10/02/2018 --- # Audit IPsec Main Mode @@ -28,21 +28,21 @@ Audit IPsec Main Mode subcategory is out of scope of this document, because this | Member Server | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Main Mode troubleshooting, or for tracing or monitoring IPsec Main Mode operations. | | Workstation | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Main Mode troubleshooting, or for tracing or monitoring IPsec Main Mode operations. | -## 4646: Security ID: %1 +## 4646(S): Security ID: %1 -## 4650: An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used. +## 4650(S): An IPsec Main Mode security association was established. Extended Mode was not enabled. Certificate authentication was not used. -## 4651: An IPsec Main Mode security association was established. Extended Mode was not enabled. A certificate was used for authentication. +## 4651(S): An IPsec Main Mode security association was established. Extended Mode was not enabled. A certificate was used for authentication. -## 4652: An IPsec Main Mode negotiation failed. +## 4652(F): An IPsec Main Mode negotiation failed. -## 4653: An IPsec Main Mode negotiation failed. +## 4653(F): An IPsec Main Mode negotiation failed. -## 4655: An IPsec Main Mode security association ended. +## 4655(S): An IPsec Main Mode security association ended. -## 4976: During Main Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. +## 4976(S): During Main Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. -## 5049: An IPsec Security Association was deleted. +## 5049(S): An IPsec Security Association was deleted. -## 5453: An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started. +## 5453(S): An IPsec negotiation with a remote computer failed because the IKE and AuthIP IPsec Keying Modules (IKEEXT) service is not started. diff --git a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md index 7adfcddd8c..40aabcd719 100644 --- a/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md +++ b/windows/security/threat-protection/auditing/audit-ipsec-quick-mode.md @@ -8,7 +8,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.localizationpriority: none author: Mir0sh -ms.date: 04/19/2017 +ms.date: 10/02/2018 --- # Audit IPsec Quick Mode @@ -28,9 +28,9 @@ Audit IPsec Quick Mode subcategory is out of scope of this document, because thi | Member Server | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Quick Mode troubleshooting, or for tracing or monitoring IPsec Quick Mode operations. | | Workstation | IF | IF | IF | IF | IF - This subcategory is mainly used for IPsec Quick Mode troubleshooting, or for tracing or monitoring IPsec Quick Mode operations. | -## 4977: During Quick Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. +## 4977(S): During Quick Mode negotiation, IPsec received an invalid negotiation packet. If this problem persists, it could indicate a network issue or an attempt to modify or replay this negotiation. -## 5451: An IPsec Quick Mode security association was established. +## 5451(S): An IPsec Quick Mode security association was established. -## 5452: An IPsec Quick Mode security association ended. +## 5452(S): An IPsec Quick Mode security association ended. diff --git a/windows/whats-new/whats-new-windows-10-version-1809.md b/windows/whats-new/whats-new-windows-10-version-1809.md index 50352d8816..62ee95e835 100644 --- a/windows/whats-new/whats-new-windows-10-version-1809.md +++ b/windows/whats-new/whats-new-windows-10-version-1809.md @@ -189,8 +189,6 @@ Windows Defender Credential Guard has always been an optional feature, but Windo A network connection is now required to set up a new device. As a result, we removed the “skip for now” option in the network setup page in Out Of Box Experience (OOBE). -<<<<<<< HEAD -======= ### Windows Defender ATP [Windows Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection) has been enhanced with many new capabilities. For more information, see the following topics: @@ -220,7 +218,6 @@ Windows Defender ATP now adds support for Windows Server 2019. You'll be able to - [Onboard previous versions of Windows](https://docs.microsoft.com/windows/security/threat-protection/onboard-downlevel-windows-defender-advanced-threat-protection)
Onboard supported versions of Windows machines so that they can send sensor data to the Windows Defender ATP sensor ->>>>>>> 951a08abdd8a55231838c35a12890ed68af95f88 ## Faster sign-in to a Windows 10 shared pc Do you have shared devices deployed in your work place? **Fast sign-in** enables users to sign in to a shared Windows 10 PC in a flash! From df0712bd005c86bcbf4bf8f61295c6762bdea1f6 Mon Sep 17 00:00:00 2001 From: Dani Halfin Date: Thu, 4 Oct 2018 19:58:05 +0000 Subject: [PATCH 2/7] Merged PR 11881: push all the fixes to live --- windows/deployment/TOC.md | 7 + .../update/windows-analytics-azure-portal.md | 2 +- windows/security/threat-protection/TOC.md | 10 +- .../threat-protection/fips-140-validation.md | 7085 +++++++++++++++++ .../mbsa-removal-and-guidance.md | 39 + ...ows-defender-advanced-threat-protection.md | 2 +- .../windows-platform-common-criteria.md | 165 + 7 files changed, 7304 insertions(+), 6 deletions(-) create mode 100644 windows/security/threat-protection/fips-140-validation.md create mode 100644 windows/security/threat-protection/mbsa-removal-and-guidance.md create mode 100644 windows/security/threat-protection/windows-platform-common-criteria.md diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md index 6577188cbc..c136d082ac 100644 --- a/windows/deployment/TOC.md +++ b/windows/deployment/TOC.md @@ -218,6 +218,13 @@ ### [Prepare servicing strategy for Windows 10 updates](update/waas-servicing-strategy-windows-10-updates.md) ### [Build deployment rings for Windows 10 updates](update/waas-deployment-rings-windows-10-updates.md) ### [Assign devices to servicing channels for Windows 10 updates](update/waas-servicing-channels-windows-10-updates.md) +### [Get started with Windows Update](update/windows-update-overview.md) +#### [How Windows Update works](update/how-windows-update-works.md) +#### [Windows Update log files](update/windows-update-logs.md) +#### [How to troubleshoot Windows Update](update/windows-update-troubleshooting.md) +#### [Common Windows Update errors](update/windows-update-errors.md) +#### [Windows Update error code reference](update/windows-update-error-reference.md) +#### [Other Windows Update resources](update/windows-update-resources.md) ### [Optimize Windows 10 update delivery](update/waas-optimize-windows-10-updates.md) #### [Configure Delivery Optimization for Windows 10 updates](update/waas-delivery-optimization.md) #### [Configure BranchCache for Windows 10 updates](update/waas-branchcache.md) diff --git a/windows/deployment/update/windows-analytics-azure-portal.md b/windows/deployment/update/windows-analytics-azure-portal.md index 0d7862c02a..e06fcfd35f 100644 --- a/windows/deployment/update/windows-analytics-azure-portal.md +++ b/windows/deployment/update/windows-analytics-azure-portal.md @@ -33,7 +33,7 @@ To check the Log Analytics workspaces you can access, select **Log Analytics**. [![Log Analytics workspace page showing accessible workspaces and linked Azure subscriptions](images/azure-portal-LAmain-wkspc-subname-sterile.png)](images/azure-portal-LAmain-wkspc-subname-sterile.png) -If you do not see your workspace in this view, but you are able to access the workspace from the classic portal, that means you do not have access to the workspaces's Azure subscription or resource group. To remedy this, you will need to find someone with admin rights to grant you access, which they can do by selecting the subscription name and selecting **Access control (IAM)** (alternatively they can configure your access at the resource group level). They should either grant you "Log Analytics Reader" access (for read-only access) or "Log Analytics Contributor" access (which enables making changes such as creating deployment plans and changing application readiness states). +If you do not see your workspace in this view, but you are able to access the workspace from the classic portal, that means you do not have access to the workspace's Azure subscription or resource group. To remedy this, you will need to find someone with admin rights to grant you access, which they can do by selecting the subscription name and selecting **Access control (IAM)** (alternatively they can configure your access at the resource group level). They should either grant you "Log Analytics Reader" access (for read-only access) or "Log Analytics Contributor" access (which enables making changes such as creating deployment plans and changing application readiness states). When permissions are configured, you can select the workspace and then select **Workspace summary** to see information similar to what was shown in the OMS overview page. diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 6bc125f9d5..5399e86a43 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -394,6 +394,12 @@ #### [Software developer FAQ](intelligence/developer-faq.md) #### [Software developer resources](intelligence/developer-resources.md) +## Certifications + +### [FIPS 140 Validation](fips-140-validation.md) +### [Windows Platform Common Criteria Certification](windows-platform-common-criteria.md) + + ## More Windows 10 security ### [The Windows Security app](windows-defender-security-center/windows-defender-security-center.md) @@ -961,14 +967,10 @@ ###### [Take ownership of files or other objects](security-policy-settings/take-ownership-of-files-or-other-objects.md) - - ### [Windows security baselines](windows-security-baselines.md) #### [Security Compliance Toolkit](security-compliance-toolkit-10.md) #### [Get support](get-support-for-security-baselines.md) - - ### [Windows 10 Mobile security guide](windows-10-mobile-security-guide.md) ## [Change history for Threat protection](change-history-for-threat-protection.md) diff --git a/windows/security/threat-protection/fips-140-validation.md b/windows/security/threat-protection/fips-140-validation.md new file mode 100644 index 0000000000..cdd262ce1c --- /dev/null +++ b/windows/security/threat-protection/fips-140-validation.md @@ -0,0 +1,7085 @@ +--- +title: FIPS 140 Validation +description: This topic provides information on how Microsoft products and cryptographic modules comply with the U.S. Federal government standard FIPS 140. +ms.prod: w10 +ms.localizationpriority: medium +ms.author: daniha +author: danihalfin +ms.date: 04/03/2018 +--- + + +# FIPS 140 Validation + +On this page + + - [Introduction](https://technet.microsoft.com/en-us/library/cc750357.aspx#id0eo) + - [FIPS 140 Overview](https://technet.microsoft.com/en-us/library/cc750357.aspx#id0ebd) + - [Microsoft Product Validation (Information for Procurement Officers and Auditors)](https://technet.microsoft.com/en-us/library/cc750357.aspx#id0ezd) + - [Information for System Integrators](https://technet.microsoft.com/en-us/library/cc750357.aspx#id0eve) + - [Information for Software Developers](https://technet.microsoft.com/en-us/library/cc750357.aspx#id0eibac) + - [FIPS 140 FAQ](https://technet.microsoft.com/en-us/library/cc750357.aspx#id0eqcac) + - [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/en-us/library/cc750357.aspx#id0ewfac) + - [Cryptographic Algorithms](https://technet.microsoft.com/en-us/library/cc750357.aspx#id0erobg) + +Updated: March 2018 + +  + +## Introduction + +This document provides information on how Microsoft products and cryptographic modules comply with the U.S. Federal government standard, *Federal Information Processing Standard (FIPS) 140 – Security Requirements for Cryptographic Modules* \[FIPS 140\]. + +### Audience + +This document is primarily focused on providing information for three parties: + +[Procurement Officer](https://technet.microsoft.com/en-us/library/cc750357.aspx#_microsoft_product_validation) – Responsible for verifying that Microsoft products (or even third-party applications) are either FIPS 140 validated or utilize a Microsoft FIPS 140 validated cryptographic module. + +[System Integrator](https://technet.microsoft.com/en-us/library/cc750357.aspx#_information_for_system) – Responsible for ensuring that Microsoft Products are configured properly to use only FIPS 140 validated cryptographic modules. + +[Software Developer](https://technet.microsoft.com/en-us/library/cc750357.aspx#_information_for_software) – Responsible for building software products that utilize Microsoft FIPS 140 validated cryptographic modules. + +### Document Map + +This document is broken into seven major sections: + +[FIPS 140 Overview](https://technet.microsoft.com/en-us/library/cc750357.aspx#_fips_140_overview) – Provides an overview of the FIPS 140 standard as well as provides some historical information about the standard. + +[Microsoft Product Validation (Information for Procurement Officers and Auditors)](https://technet.microsoft.com/en-us/library/cc750357.aspx#_microsoft_product_validation) – Provides information on how Microsoft products are FIPS 140 validated. + +[Information for System Integrators](https://technet.microsoft.com/en-us/library/cc750357.aspx#_information_for_system) – Describes how to configure and verify that Microsoft Products are being used in a manner consistent with the product’s FIPS 140 Security Policy. + +[Information for Software Developers](https://technet.microsoft.com/en-us/library/cc750357.aspx#_information_for_software) – Identifies how developers can leverage the Microsoft FIPS 140 validated cryptographic modules. + +[FAQ](https://technet.microsoft.com/en-us/library/cc750357.aspx#_fips_140_faq) – Frequently Asked Questions. + +[Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/en-us/library/cc750357.aspx#_microsoft_fips_140) – Explains Microsoft cryptographic architecture and identifies specific modules that are FIPS 140 validated. + +[Cryptographic Algorithms](https://technet.microsoft.com/en-us/library/cc750357.aspx#_cryptographic_algorithms) – Lists the cryptographic algorithm, modes, states, key sizes, Windows versions, and corresponding cryptographic algorithm validation certificates. + +## FIPS 140 Overview + +### FIPS 140 Standard + +FIPS 140 is a US government and Canadian government standard that defines a minimum set of the security requirements for products that implement cryptography. This standard is designed for cryptographic modules that are used to secure sensitive but unclassified information. Testing against the FIPS 140 standard is maintained by the Cryptographic Module Validation Program (CMVP), a joint effort between the US National Institute of Standards and Technology (NIST) and the Communications Security Establishment of Canada (CSEC). + +The current standard defines four-levels of increasing security, 1 through 4. Most software products (including all Microsoft products) are tested against the Level 1 security requirements. + +### Applicability of the FIPS standard + +Within the US Federal government, the FIPS 140 standard applies to any security system (whether hardware, firmware, software, or a combination thereof) to be used by agencies for protecting sensitive but unclassified information. Some agencies have expanded its use by requiring that the modules to be procured for secret systems also meet the FIPS 140 requirements. + +The FIPS 140 standard has also been used by different standards bodies, specification groups, nations, and private institutions as a requirement or guideline for those products (e.g. – Digital Cinema Systems Specification). + +### History of 140-1 + +FIPS 140-1 is the original working version of the standard made official on January 11, 1994. The standard remained in effect until FIPS 140-2 became mandatory for new products on May 25, 2002. + +### FIPS 140-2 + +FIPS 140-2 is currently the active version of the standard. + +### Microsoft FIPS Support Policy + +Microsoft actively maintains FIPS 140 validation for its cryptographic modules. + +### FIPS Mode of Operation + +The common term “FIPS mode” is used in this document and Security Policy documents. When a cryptographic module contains both FIPS-approved and non-FIPS approved security methods, it must have a "FIPS mode of operation" to ensure only FIPS-approved security methods may be used. When a module is in "FIPS mode", a non-FIPS approved method cannot be used instead of a FIPS-approved method. + +## Microsoft Product Validation (Information for Procurement Officers and Auditors) + +This section provides information for Procurement Officers and Auditors who are responsible for ensuring that Microsoft products with FIPS 140 validated cryptographic modules are used in their organization. The goal of this section is to provide an overview of the Microsoft developed products and modules and explain how the validated cryptographic modules are used. + +### Microsoft Product Relationship with CNG and CAPI libraries + +Rather than validate individual components and products, Microsoft chooses to validate only the underlying cryptographic modules. Subsequently, many Windows components and Microsoft products are built to rely on the Cryptographic API: Next Generation (CNG) and legacy Cryptographic API (CAPI) FIPS 140 validated cryptographic modules. Windows components and Microsoft products use the documented application programming interfaces (APIs) for each of the modules to access various cryptographic services. + +The following list contains some of the Windows components and Microsoft products that rely on FIPS 140 validated cryptographic modules: + + - Schannel Security Package + - Remote Desktop Protocol (RDP) Client + - Encrypting File System (EFS) + - Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.) + - BitLocker® Drive Full-volume Encryption + - IPsec Settings of Windows Firewall + +## Information for System Integrators + +This section provides information for System Integrators and Auditors who are responsible for deploying Microsoft products in a manner consistent with the product’s FIPS 140 Security Policy. + +There are two steps to ensure that Microsoft products operate in FIPS mode: + +1. Selecting/Installing FIPS 140 validated cryptographic modules +2. Setting FIPS local/group security policy flag. + +### Step 1 – Selecting/Installing FIPS 140 Validated Cryptographic Modules + +Systems Integrators must ensure that all cryptographic modules installed are, in fact, FIPS 140 validated. This can be accomplished by cross-checking the version number of the installed module with the list of validated binaries. The list of validated CAPI binaries is identified in the [CAPI Validated Cryptographic Modules](https://technet.microsoft.com/en-us/library/cc750357.aspx#_capi_validated_cryptographic) section below and the list of validated CNG binaries is identified in the [CNG Validated Cryptographic Modules](https://technet.microsoft.com/en-us/library/cc750357.aspx#_cng_validated_cryptographic) section below. There are similar sections for all other validated cryptographic modules. + +The version number of the installed binary is found by right-clicking the module file and clicking on the Version or Details tab. Cryptographic modules are stored in the "windows\\system32" or "windows\\system32\\drivers" directory. + +### Step 2 – Setting FIPS Local/Group Security Policy Flag + +The Windows operating system provides a group (or local) security policy setting, “System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing”, which is used by many Microsoft products to determine whether to operate in a FIPS-approved mode. When this policy is set, the validated cryptographic modules in Windows will also operate in a FIPS-approved mode. + +**Note** – There is no enforcement of the FIPS policy by the operating system or the validated cryptographic modules. Instead, each individual application must check this flag and enforce the Security Policy of the validated cryptographic modules. + +#### Instructions on Setting the FIPS Local/Group Security Policy Flag + +While there are alternative methods for setting the FIPS local/group security policy flag, the following method is included as a guide to users with Administrative privileges. This description is for the Local Security Policy, but the Group Security Policy may be set in a similar manner. + +1. Open the 'Run' menu by pressing the combination 'Windows Key + R'. +2. Type 'secpol.msc' and press 'Enter' or click the 'Ok' button. +3. In the Local Security Policy management console window that opens, use the left tab to navigate to the Local Policies -\> Security Options. +4. Scroll down the right pane and double-click 'System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing'. +5. In the properties window, select the 'Enabled' option and click the 'Apply' button. + +#### Microsoft Components and Products That Utilize FIPS Local/Group Security Policy + +The following list details some of the Microsoft components that use the cryptographic functionality implemented by either CNG or legacy CAPI. When the FIPS Local/Group Security Policy is set, the following components will enforce the validated module Security Policy. + + - Schannel Security Package + - Remote Desktop Protocol (RDP) Client + - Encrypting File System (EFS) + - Some Microsoft .NET Framework Applications (.NET also provides cryptographic algorithm implementations that have not been FIPS 140 validated.) + - BitLocker® Drive Full-volume Encryption + - IPsec Settings of Windows Firewall + +#### Effects of Setting FIPS Local/Group Security Policy Flag + +When setting the FIPS local/group security policy flag, the behavior of several Microsoft components and products are affected. The most noticeable difference will be that the components enforcing this setting will only use those algorithms approved or allowed in FIPS mode. The specific changes to the products listed above are: + + - Schannel Security Package forced to negotiate sessions using TLS. The following supported Cipher Suites are disabled: + + - - TLS\_RSA\_WITH\_RC4\_128\_SHA + - TLS\_RSA\_WITH\_RC4\_128\_MD5 + - SSL\_CK\_RC4\_128\_WITH\_MD5 + - SSL\_CK\_DES\_192\_EDE3\_CBC\_WITH\_MD5 + - TLS\_RSA\_WITH\_NULL\_MD5 + - TLS\_RSA\_WITH\_NULL\_SHA + + - The set of cryptographic algorithms that a Remote Desktop Protocol (RDP) server will use is scoped to: + + - - CALG\_RSA\_KEYX - RSA public key exchange algorithm + - CALG\_3DES - Triple DES encryption algorithm + - CALG\_AES\_128 - 128 bit AES + - CALG\_AES\_256 - 256 bit AES + - CALG\_SHA1 - SHA hashing algorithm + - CALG\_SHA\_256 - 256 bit SHA hashing algorithm + - CALG\_SHA\_384 - 384 bit SHA hashing algorithm + - CALG\_SHA\_512 - 512 bit SHA hashing algorithm + + - Any Microsoft .NET Framework applications, such as Microsoft ASP.NET or Windows Communication Foundation (WCF), only allow algorithm implementations that are validated to FIPS 140, meaning only classes that end in "CryptoServiceProvider" or "Cng" can be used. Any attempt to create an instance of other cryptographic algorithm classes or create instances that use non-allowed algorithms will cause an InvalidOperationException exception. + + - Verification of ClickOnce applications fails unless the client computer has .NET Framework 2.0 SP1 or later service pack installed or .NET Framework 3.5 or later installed. + + - On Windows Vista and Windows Server 2008 and later, BitLocker Drive Encryption switches from AES-128 using the elephant diffuser to using the approved AES-256 encryption. Recovery passwords are not created or backed up. Instead, backup a recovery key on a local drive or on a network share. To use the recovery key, put the key on a USB device and plug the device into the computer. + +Please be aware that selection of FIPS mode can limit product functionality (See ). + +## Information for Software Developers + +This section is targeted at developers who wish to build their own applications using the FIPS 140 validated cryptographic modules. + +Each of the validated cryptographic modules defines a series of rules that must be followed. The security rules for each validated cryptographic module are specified in the Security Policy document. Links to each of the Security Policy documents is provided in the [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/en-us/library/cc750357.aspx#_microsoft_fips_140) section below. Generally, the restriction in Microsoft validated cryptographic modules is limiting the use of cryptography to only FIPS Approved cryptographic algorithms, modes, and key sizes. + +### Using Microsoft Cryptographic Modules in a FIPS mode of operation + +No matter whether developing with native languages or using .NET, it is important to first check whether the CNG modules for the target system are FIPS validated. The list of validated CNG binaries is identified in the [CNG Validated Cryptographic Modules](https://technet.microsoft.com/en-us/library/cc750357.aspx#_cng_validated_cryptographic) section. + +When developing using CNG directly, it is the responsibility of the developer to follow the security rules outlined in the FIPS 140 Security Policy for each module. The security policy for each module is provided on the CMVP website. Links to each of the Security Policy documents is provided in the tables below. It is important to remember that setting the FIPS local/group security policy Flag (discussed above) does not affect the behavior of the modules when used for developing custom applications. + +If you are developing your application using .NET instead of using the native libraries, then setting the FIPS local policy flag will generate an exception when an improper .NET class is used for cryptography (i.e. the cryptographic classes whose names end in "Managed"). The names of these allowed classes end with "Cng", which use the CNG binaries or "CryptoServiceProvider", which use the legacy CAPI binaries. + +### Key Strengths and Validity Periods + +NIST Special Publication 800-131A Revision 1, Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths, dated November 2015, \[[SP 800-131A](http://dx.doi.org/10.6028/nist.sp.800-131ar1)\], offers guidance for moving to stronger cryptographic keys and algorithms. This does not replace NIST SP 800-57, Recommendation for Key Management Part 1: General, \[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\], but gives more specific guidance. One of the most important topics discussed in these publications deals with the key strengths of FIPS Approved algorithms and their validity periods. When developing applications that use FIPS Approved algorithms, it is also extremely important to select appropriate key sizes based on the security lifetimes recommended by NIST. + +## FIPS 140 FAQ + +The following are answers to commonly asked questions for the FIPS 140-2 validation of Microsoft products. + +1. How does FIPS 140 relate to the Common Criteria? + **Answer:** These are two separate security standards with different, but complementary, purposes. FIPS 140 is a standard designed specifically for validating product modules that implement cryptography. On the other hand, Common Criteria is designed to help evaluate security functions in IT products. + In many cases, Common Criteria evaluations will rely on FIPS 140 validations to provide assurance that cryptographic functionality is implemented properly. +2. How does FIPS 140 relate to Suite B? + **Answer:** Suite B is simply a set of cryptographic algorithms defined by the U.S. National Security Agency (NSA) as part of its Cryptographic Modernization Program. The set of Suite B cryptographic algorithms are to be used for both unclassified information and most classified information. + The Suite B cryptographic algorithms are a subset of the FIPS Approved cryptographic algorithms as allowed by the FIPS 140 standard. +3. There are so many modules listed on the NIST website for each release, how are they related and how do I tell which one applies to me? + **Answer:** Microsoft strives to validate all releases of its cryptographic modules. Each module provides a different set of cryptographic algorithms. If you are required to use only FIPS validated cryptographic modules, you simply need to verify that the version being used appears on the validation list. + Please see the [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/en-us/library/cc750357.aspx#_microsoft_fips_140)section for a complete list of Microsoft validated modules. +4. My application links against crypt32.dll, cryptsp.dll, advapi32.dll, bcrypt.dll, bcryptprimitives.dll, or ncrypt.dll. What do I need to do to assure I’m using FIPS 140 validated cryptographic modules? + **Answer:** crypt32.dll, cryptsp.dll, advapi32.dll, and ncrypt.dll are intermediary libraries that will offload all cryptographic operations to the FIPS validated cryptographic modules. Bcrypt.dll itself is a validated cryptographic module for Windows Vista and Windows Server 2008. For Windows 7 and Windows Server 2008 R2 and later, bcryptprimitives.dll is the validated module, but bcrypt.dll remains as one of the libraries to link against. + You must first verify that the underlying CNG cryptographic module is validated. Once verified, you'll need to confirm that you're using the module correctly in FIPS mode (See [Information for Software Developers](https://technet.microsoft.com/en-us/library/cc750357.aspx#_information_for_software) section for details). +5. What does "When operated in FIPS mode" mean on certificates? + **Answer:** This caveat identifies that a required configuration and security rules must be followed in order to use the cryptographic module in a manner consistent with its FIPS 140 Security Policy. The security rules are defined in the Security Policy for the module and usually revolve around using only FIPS Approved cryptographic algorithms and key sizes. Please see the Security Policy for the specific security rules for each cryptographic module (See [Microsoft FIPS 140 Validated Cryptographic Modules](https://technet.microsoft.com/en-us/library/cc750357.aspx#_microsoft_fips_140) section for links to each policy). +6. Which FIPS validated module is called when Windows 7 or Windows 8 is configured to use the FIPS setting in the wireless configuration? + **Answer:** CNG is used. This setting tells the wireless driver to call FIPS 140-2 validated cryptographic modules instead of using the driver’s own cryptography, if any. +7. Is BitLocker to Go FIPS 140-2 validated? + **Answer:** There are two separate parts for BitLocker to Go. One part is simply a native feature of BitLocker and as such, it uses FIPS 140-2 validated cryptographic modules. The other part is the BitLocker to Go Reader application for down-level support of older operating systems such as Windows XP and Windows Vista. The Reader application does not use FIPS 140-2 validated cryptographic modules. +8. Are applications FIPS 140-2 validated? + **Answer:** Microsoft only has low-level cryptographic modules in Windows FIPS 140-2 validated, not high-level applications. A better question is whether a certain application calls a FIPS 140-2 validated cryptographic module in the underlying Windows OS. That question needs to be directed to the company/product group that created the application of interest. +9. How can Systems Center Operations Manager 2012 be configured to use FIPS 140-2 validated cryptographic modules? + **Answer:** See [http://technet.microsoft.com/en-us/library/hh914094.aspx](https://technet.microsoft.com/en-us/library/hh914094.aspx) + +## Microsoft FIPS 140 Validated Cryptographic Modules + +### Modules By Operating System + +The following tables identify the Cryptographic Modules for an operating system. + +#### Windows + +##### Windows 10 Creators Update (Version 1703) + +Validated Editions: Home, Pro, Enterprise, Education, S, Surface Hub, Mobile + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.15063#3095

FIPS Approved algorithms: AES (Cert. #4624); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2522); SHS (Cert. #3790); Triple-DES (Cert. #2459)
+
+Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

+

Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #1281); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #1278)

Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.15063#3094

#3094

+

FIPS Approved algorithms: AES (Certs. #4624 and #4626); CKG (vendor affirmed); CVL (Certs. #1278 and #1281); DRBG (Cert. #1555); DSA (Cert. #1223); ECDSA (Cert. #1133); HMAC (Cert. #3061); KAS (Cert. #127); KBKDF (Cert. #140); KTS (AES Cert. #4626; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2521 and #2523); SHS (Cert. #3790); Triple-DES (Cert. #2459)
+
+Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

+

Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert.#1133); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert.#2521); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert.#1281)

Boot Manager10.0.15063#3089

FIPS Approved algorithms: AES (Certs. #4624 and #4625); CKG (vendor affirmed); HMAC (Cert. #3061); PBKDF (vendor affirmed); RSA (Cert. #2523); SHS (Cert. #3790)

+

Other algorithms: PBKDF (vendor affirmed); VMK KDF (vendor affirmed)

Windows OS Loader10.0.15063#3090

FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)

+

Other algorithms: NDRNG

Windows Resume[1]10.0.15063#3091FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2523); SHS (Cert. #3790)
BitLocker® Dump Filter[2]10.0.15063#3092FIPS Approved algorithms: AES (Certs. #4624 and #4625); RSA (Cert. #2522); SHS (Cert. #3790)
Code Integrity (ci.dll)10.0.15063#3093

FIPS Approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

+

Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

Secure Kernel Code Integrity (skci.dll)[3]10.0.15063#3096

FIPS Approved algorithms: AES (Cert. #4624); RSA (Certs. #2522 and #2523); SHS (Cert. #3790)

+

Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v1.5 - RSASP1 Signature Primitive (Cert. #1282)

+ + +\[1\] Applies only to Home, Pro, Enterprise, Education and S + +\[2\] Applies only to Pro, Enterprise, Education, S, Mobile and Surface Hub + +\[3\] Applies only to Pro, Enterprise Education and S + +##### Windows 10 Anniversary Update (Version 1607) + +Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.14393#2937

FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
+
+Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

+

Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #886)

Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.14393#2936

FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
+
+Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)

+

Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #922); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #887)

Boot Manager10.0.14393#2931

FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

+

Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

BitLocker® Windows OS Loader (winload)10.0.14393#2932FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
+
+Other algorithms: NDRNG; MD5
BitLocker® Windows Resume (winresume)[1]10.0.14393#2933FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
+
+Other algorithms: MD5
BitLocker® Dump Filter (dumpfve.sys)[2]10.0.14393#2934FIPS Approved algorithms: AES (Certs. #4061 and #4064)
Code Integrity (ci.dll)10.0.14393#2935

FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
+
+Other algorithms: AES (non-compliant); MD5

+

Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

Secure Kernel Code Integrity (skci.dll)[3]10.0.14393#2938

FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
+
+Other algorithms: MD5

+

Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #888)

+ + +\[1\] Applies only to Home, Pro, Enterprise and Enterprise LTSB + +\[2\] Applies only to Pro, Enterprise, Enterprise LTSB and Mobile + +\[3\] Applies only to Pro, Enterprise and Enterprise LTSB + +##### Windows 10 November 2015 Update (Version 1511) + +Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, Surface Hub + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10586#2606

FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs. #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
+
+Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

+

Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #664)

Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10586#2605

FIPS Approved algorithms: AES (Certs. #3629); DRBG (Certs. #955); DSA (Certs.  #1024); ECDSA (Certs. #760); HMAC (Certs. #2381); KAS (Certs. #72; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #72); KTS (AES Certs. #3653; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1887, #1888 and #1889); SHS (Certs. #3047); Triple-DES (Certs. #2024)
+
+Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

+

Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #666); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #663)

Boot Manager[4]10.0.10586#2700FIPS Approved algorithms: AES (Certs. #3653); HMAC (Cert. #2381); PBKDF (vendor affirmed); RSA (Cert. #1871); SHS (Certs. #3047 and #3048)
+
+Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
BitLocker® Windows OS Loader (winload)[5]10.0.10586#2701FIPS Approved algorithms: AES (Certs. #3629 and #3653); RSA (Cert. #1871); SHS (Cert. #3048)
+
+Other algorithms: MD5; NDRNG
BitLocker® Windows Resume (winresume)[6]10.0.10586#2702FIPS Approved algorithms: AES (Certs. #3653); RSA (Cert. #1871); SHS (Cert. #3048)
+
+Other algorithms: MD5
BitLocker® Dump Filter (dumpfve.sys)[7]10.0.10586#2703FIPS Approved algorithms: AES (Certs. #3653)
Code Integrity (ci.dll)10.0.10586#2604

FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
+
+Other algorithms: AES (non-compliant); MD5

+

Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

Secure Kernel Code Integrity (skci.dll)[8]10.0.10586#2607

FIPS Approved algorithms: RSA (Certs. #1871); SHS (Certs. #3048)
+
+Other algorithms: MD5

+

Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #665)

+ + +\[4\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub + +\[5\] Applies only to Home, Pro, Enterprise, Mobile and Surface Hub + +\[6\] Applies only to Home, Pro and Enterprise + +\[7\] Applies only to Pro, Enterprise, Mobile and Surface Hub + +\[8\] Applies only to Enterprise and Enterprise LTSB + +##### Windows 10 (Version 1507) + +Validated Editions: Home, Pro, Enterprise, Enterprise LTSB, Mobile, and Surface Hub + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.10240#2606

FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
+
+Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

+

Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #575)

Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.10240#2605

FIPS Approved algorithms: AES (Certs. #3497); DRBG (Certs. #868); DSA (Certs. #983); ECDSA (Certs. #706); HMAC (Certs. #2233); KAS (Certs. #64; key agreement; key establishment methodology provides between 112 and 256 bits of encryption strength); KBKDF (Certs. #66); KTS (AES Certs. #3507; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #1783, #1798, and #1802); SHS (Certs. #2886); Triple-DES (Certs. #1969)
+
+Other algorithms: DES; HMAC-MD5; Legacy CAPI KDF; MD2; MD4; MD5; RC2; RC4; RSA (encrypt/decrypt)

+

Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572); FIPS186-4 RSA; RSADP - RSADP Primitive (Cert. #576)

Boot Manager[9]10.0.10240#2600FIPS Approved algorithms: AES (Cert. #3497); HMAC (Cert. #2233); KTS (AES Cert. #3498); PBKDF (vendor affirmed); RSA (Cert. #1784); SHS (Certs. #2871 and #2886)
+
+Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
BitLocker® Windows OS Loader (winload)[10]10.0.10240#2601FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
+
+Other algorithms: MD5; NDRNG
BitLocker® Windows Resume (winresume)[11]10.0.10240#2602FIPS Approved algorithms: AES (Certs. #3497 and #3498); RSA (Cert. #1784); SHS (Cert. #2871)
+
+Other algorithms: MD5
BitLocker® Dump Filter (dumpfve.sys)[12]10.0.10240#2603FIPS Approved algorithms: AES (Certs. #3497 and #3498)
Code Integrity (ci.dll)10.0.10240#2604

FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
+
+Other algorithms: AES (non-compliant); MD5

+

Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

Secure Kernel Code Integrity (skci.dll)[13]10.0.10240#2607

FIPS Approved algorithms: RSA (Certs. #1784); SHS (Certs. #2871)
+
+Other algorithms: MD5

+

Validated Component Implementations: FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #572)

+ + +\[9\] Applies only to Home, Pro, Enterprise and Enterprise LTSB + +\[10\] Applies only to Home, Pro, Enterprise and Enterprise LTSB + +\[11\] Applies only to Home, Pro, Enterprise and Enterprise LTSB + +\[12\] Applies only to Pro, Enterprise and Enterprise LTSB + +\[13\] Applies only to Enterprise and Enterprise LTSB + +##### Windows 8.1 + +Validated Editions: RT, Pro, Enterprise, Phone, Embedded + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.17031#2357

FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
+
+Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)#2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

+

Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289); SP800-135 - Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS (Cert. #323)

Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.17042#2356

FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
+
+Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)

+

Validated Component Implementations: FIPS186-4 ECDSA - Signature Generation of hash sized messages (Cert. #288); FIPS186-4 RSA; PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

Boot Manager6.3.9600 6.3.9600.17031#2351FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
+
+Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.17031#2352FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
+
+Other algorithms: MD5; NDRNG
BitLocker® Windows Resume (winresume)[14]6.3.9600 6.3.9600.17031#2353FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
+
+Other algorithms: MD5
BitLocker® Dump Filter (dumpfve.sys)6.3.9600 6.3.9600.17031#2354FIPS Approved algorithms: AES (Cert. #2832)
+
+Other algorithms: N/A
Code Integrity (ci.dll)6.3.9600 6.3.9600.17031#2355#2355

FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
+
+Other algorithms: MD5

+

Validated Component Implementations: PKCS#1 v2.1 - RSASP1 Signature Primitive (Cert. #289)

+ + +\[14\] Applies only to Pro, Enterprise, and Embedded 8. + +##### Windows 8 + +Validated Editions: RT, Home, Pro, Enterprise, Phone + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.9200#1892FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
+
+Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258); DSA (Cert. ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
+
+
Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.9200#1891FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
+
+Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#258 and ); ECDSA (Cert. ); HMAC (Cert. ); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RNG (Cert. ); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
+
+Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
Boot Manager6.2.9200#1895FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: MD5
BitLocker® Windows OS Loader (WINLOAD)6.2.9200#1896FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
BitLocker® Windows Resume (WINRESUME)[15]6.2.9200#1898FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: MD5
BitLocker® Dump Filter (DUMPFVE.SYS)6.2.9200#1899FIPS Approved algorithms: AES (Certs. #2196 and #2198)
+
+Other algorithms: N/A
Code Integrity (CI.DLL)6.2.9200#1897FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: MD5
Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.9200#1893FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
+
+Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#1902); Triple-DES (Cert. ); Triple-DES MAC (Triple-DES Cert. , vendor affirmed)
+
+Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. , key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
Enhanced Cryptographic Provider (RSAENH.DLL)6.2.9200#1894FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
+
+Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
+ + +\[15\] Applies only to Home and Pro + +**Windows 7** + +Validated Editions: Windows 7, Windows 7 SP1 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)

6.1.7600.16385

+

6.1.7601.17514

1329FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); DSA (Cert. #386); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
+
+Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4#559 and ); SHS (Cert. ); Triple-DES (Cert. )
+
+Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
Kernel Mode Cryptographic Primitives Library (cng.sys)

6.1.7600.16385

+

6.1.7600.16915

+

6.1.7600.21092

+

6.1.7601.17514

+

6.1.7601.17725

+

6.1.7601.17919

+

6.1.7601.21861

+

6.1.7601.22076

1328FIPS Approved algorithms: AES (Certs. #1168 and #1178); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #24); ECDSA (Cert. #141); HMAC (Cert. #677); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides 80 to 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #560); SHS (Cert. #1081); Triple-DES (Cert. #846)
+
+Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
Boot Manager

6.1.7600.16385

+

6.1.7601.17514

1319FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #557); SHS (Cert. #1081)
+
+Other algorithms: MD5#1168 and ); HMAC (Cert. ); RSA (Cert. ); SHS (Cert. )
+
+Other algorithms: MD5
Winload OS Loader (winload.exe)

6.1.7600.16385

+

6.1.7600.16757

+

6.1.7600.20897

+

6.1.7600.20916

+

6.1.7601.17514

+

6.1.7601.17556

+

6.1.7601.21655

+

6.1.7601.21675

1326FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #557); SHS (Cert. #1081)
+
+Other algorithms: MD5
BitLocker™ Drive Encryption

6.1.7600.16385

+

6.1.7600.16429

+

6.1.7600.16757

+

6.1.7600.20536

+

6.1.7600.20873

+

6.1.7600.20897

+

6.1.7600.20916

+

6.1.7601.17514

+

6.1.7601.17556

+

6.1.7601.21634

+

6.1.7601.21655

+

6.1.7601.21675

1332FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
+
+Other algorithms: Elephant Diffuser
Code Integrity (CI.DLL)

6.1.7600.16385

+

6.1.7600.17122

+

6.1.7600.21320

+

6.1.7601.17514

+

6.1.7601.17950

+

6.1.7601.22108

1327FIPS Approved algorithms: RSA (Cert. #557); SHS (Cert. #1081)
+
+Other algorithms: MD5
Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.1.7600.16385
+(no change in SP1)		1331FIPS Approved algorithms: DSA (Cert. #385); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
+
+Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
Enhanced Cryptographic Provider (RSAENH.DLL)6.1.7600.16385
+(no change in SP1)		1330FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #673); SHS (Cert. #1081); RSA (Certs. #557 and #559); Triple-DES (Cert. #846)
+
+Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256-bits of encryption strength; non-compliant less than 112 bits of encryption strength)
+ + +##### Windows Vista SP1 + +Validated Editions: Ultimate Edition + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Boot Manager (bootmgr)6.0.6001.18000 and 6.0.6002.18005978FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #354); SHS (Cert. #753)
Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18027, 6.0.6001.18606, 6.0.6001.22125, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411 and 6.0.6002.22596979FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #354); SHS (Cert. #753)
+
+Other algorithms: MD5
Code Integrity (ci.dll)6.0.6001.18000, 6.0.6001.18023, 6.0.6001.22120, and 6.0.6002.18005980FIPS Approved algorithms: RSA (Cert. #354); SHS (Cert. #753)
+
+Other algorithms: MD5
Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742, and 6.0.6002.228691000

FIPS Approved algorithms: AES (Certs. #739 and #756); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)#739 and ); ECDSA (Cert. ); HMAC (Cert. ); RNG (Cert.  and SP 800-90 AES-CTR, vendor-affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )

+

Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005, and 6.0.6002.228721001

FIPS Approved algorithms: AES (Certs. #739 and #756); DSA (Cert. #283); ECDSA (Cert. #82); HMAC (Cert. #412); RNG (Cert. #435 and SP 800-90, vendor affirmed); RSA (Certs. #353 and #357); SHS (Cert. #753); Triple-DES (Cert. #656)

+

Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)

Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.180051002

FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #407); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #354); SHS (Cert. #753); Triple-DES (Cert. #656)

+

Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051003

FIPS Approved algorithms: DSA (Cert. #281); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)

+

Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4

+ + +##### Windows Vista + +Validated Editions: Ultimate Edition + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Enhanced Cryptographic Provider (RSAENH)6.0.6000.16386893FIPS Approved algorithms: AES (Cert. #553); HMAC (Cert. #297); RNG (Cert. #321); RSA (Certs. #255 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
+
+Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6000.16386894FIPS Approved algorithms: DSA (Cert. #226); RNG (Cert. #321); SHS (Cert. #618); Triple-DES (Cert. #549); Triple-DES MAC (Triple-DES Cert. #549, vendor affirmed)
+
+Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
BitLocker™ Drive Encryption6.0.6000.16386947FIPS Approved algorithms: AES (Cert. #715); HMAC (Cert. #386); SHS (Cert. #737)
+
+Other algorithms: Elephant Diffuser
Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6000.16386, 6.0.6000.16870 and 6.0.6000.21067891FIPS Approved algorithms: AES (Cert. #553); ECDSA (Cert. #60); HMAC (Cert. #298); RNG (Cert. #321); RSA (Certs. #257 and #258); SHS (Cert. #618); Triple-DES (Cert. #549)
+
+Other algorithms: DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides 128 to 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; HMAC MD5
+ + +##### Windows XP SP3 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Kernel Mode Cryptographic Module (FIPS.SYS)5.1.2600.5512997

FIPS Approved algorithms: HMAC (Cert. #429); RNG (Cert. #449); SHS (Cert. #785); Triple-DES (Cert. #677); Triple-DES MAC (Triple-DES Cert. #677, vendor affirmed)

+

Other algorithms: DES; MD5; HMAC MD5

Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.1.2600.5507990

FIPS Approved algorithms: DSA (Cert. #292); RNG (Cert. #448); SHS (Cert. #784); Triple-DES (Cert. #676); Triple-DES MAC (Triple-DES Cert. #676, vendor affirmed)

+

Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits); MD5; RC2; RC4

Enhanced Cryptographic Provider (RSAENH)5.1.2600.5507989

FIPS Approved algorithms: AES (Cert. #781); HMAC (Cert. #428); RNG (Cert. #447); RSA (Cert. #371); SHS (Cert. #783); Triple-DES (Cert. #675); Triple-DES MAC (Triple-DES Cert. #675, vendor affirmed)

+

Other algorithms: DES; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits)

+ + +##### Windows XP SP2 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
DSS/Diffie-Hellman Enhanced Cryptographic Provider5.1.2600.2133240

FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #29)

+

Other algorithms: DES (Cert. #66); RC2; RC4; MD5; DES40; Diffie-Hellman (key agreement)

Microsoft Enhanced Cryptographic Provider5.1.2600.2161238

FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

+

Other algorithms: DES (Cert. #156); RC2; RC4; MD5

+ + +##### Windows XP SP1 + + ++++++ + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Microsoft Enhanced Cryptographic Provider5.1.2600.1029238

FIPS Approved algorithms: Triple-DES (Cert. #81); AES (Cert. #33); SHA-1 (Cert. #83); RSA (PKCS#1, vendor affirmed); HMAC-SHA-1 (Cert. #83, vendor affirmed)

+

Other algorithms: DES (Cert. #156); RC2; RC4; MD5

+ + +##### Windows XP + + ++++++ + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Kernel Mode Cryptographic Module5.1.2600.0241

FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Cert. #35); HMAC-SHA-1 (Cert. #35, vendor affirmed)

+

Other algorithms: DES (Cert. #89)

+ + +##### Windows 2000 SP3 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

FIPS Approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

+

Other algorithms: DES (Certs. #89)

Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

(Base DSS: 5.0.2195.3665 [SP3])

+

(Base: 5.0.2195.3839 [SP3])

+

(DSS/DH Enh: 5.0.2195.3665 [SP3])

+

(Enh: 5.0.2195.3839 [SP3]

103

FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

+

Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

+ + +##### Windows 2000 SP2 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Kernel Mode Cryptographic Module (FIPS.SYS)5.0.2195.1569106

FIPS Approved algorithms: Triple-DES (Cert. #16); SHA-1 (Certs. #35)

+

Other algorithms: DES (Certs. #89)

Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

(Base DSS:

+

5.0.2195.2228 [SP2])

+

(Base:

+

5.0.2195.2228 [SP2])

+

(DSS/DH Enh:

+

5.0.2195.2228 [SP2])

+

(Enh:

+

5.0.2195.2228 [SP2])

103

FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

+

Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

+ + +##### Windows 2000 SP1 + + ++++++ + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enhanced Cryptographic Provider, and Enhanced Cryptographic Provider

(Base DSS: 5.0.2150.1391 [SP1])

+

(Base: 5.0.2150.1391 [SP1])

+

(DSS/DH Enh: 5.0.2150.1391 [SP1])

+

(Enh: 5.0.2150.1391 [SP1])

103

FIPS Approved algorithms: Triple-DES (Cert. #16); DSA/SHA-1 (Certs. #28 and #29); RSA (vendor affirmed)

+

Other algorithms: DES (Certs. #65, 66, 67 and 68); Diffie-Hellman (key agreement); RC2; RC4; MD2; MD4; MD5

+ + +##### Windows 2000 + + ++++++ + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enchanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.2150.176

FIPS Approved algorithms: Triple-DES (vendor affirmed); DSA/SHA-1 (Certs. #28 and 29); RSA (vendor affirmed)

+

Other algorithms: DES (Certs. #65, 66, 67 and 68); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

+ + +##### Windows 95 and Windows 98 + + ++++++ + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Base DSS Cryptographic Provider, Base Cryptographic Provider, DSS/Diffie-Hellman Enchanced Cryptographic Provider, and Enhanced Cryptographic Provider5.0.1877.6 and 5.0.1877.775

FIPS Approved algorithms: Triple-DES (vendor affirmed); SHA-1 (Certs. #20 and 21); DSA/SHA-1 (Certs. #25 and 26); RSA (vendor- affirmed)

+

Other algorithms: DES (Certs. #61, 62, 63 and 64); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)

+ + +##### Windows NT 4.0 + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Base Cryptographic Provider5.0.1877.6 and 5.0.1877.768FIPS Approved algorithms: SHA-1 (Certs. #20 and 21); DSA/SHA- 1 (Certs. #25 and 26); RSA (vendor affirmed)
+
+Other algorithms: DES (Certs. #61, 62, 63 and 64); Triple-DES (allowed for US and Canadian Government use); RC2; RC4; MD2; MD4; MD5; Diffie-Hellman (key agreement)
+ + +#### Windows Server + +##### Windows Server 2016 + +Validated Editions: Standard, Datacenter, Storage Server + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)10.0.143932937FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
+
+Other algorithms: HMAC-MD5; MD5; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
Kernel Mode Cryptographic Primitives Library (cng.sys)10.0.143932936FIPS Approved algorithms: AES (Cert. #4064); DRBG (Cert. #1217); DSA (Cert. #1098); ECDSA (Cert. #911); HMAC (Cert. #2651); KAS (Cert. #92); KBKDF (Cert. #101); KTS (AES Cert. #4062; key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); PBKDF (vendor affirmed); RSA (Certs. #2192, #2193 and #2195); SHS (Cert. #3347); Triple-DES (Cert. #2227)
+
+Other algorithms: HMAC-MD5; MD5; NDRNG; DES; Legacy CAPI KDF; MD2; MD4; RC2; RC4; RSA (encrypt/decrypt)
Boot Manager10.0.143932931

FIPS Approved algorithms: AES (Certs. #4061 and #4064); HMAC (Cert. #2651); PBKDF (vendor affirmed); RSA (Cert. #2193); SHS (Cert. #3347)

+

Other algorithms: MD5; PBKDF (non-compliant); VMK KDF

BitLocker® Windows OS Loader (winload)10.0.143932932FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
+
+Other algorithms: NDRNG; MD5
BitLocker® Windows Resume (winresume)10.0.143932933FIPS Approved algorithms: AES (Certs. #4061 and #4064); RSA (Cert. #2193); SHS (Cert. #3347)
+
+Other algorithms: MD5
BitLocker® Dump Filter (dumpfve.sys)10.0.143932934FIPS Approved algorithms: AES (Certs. #4061 and #4064)
Code Integrity (ci.dll)10.0.143932935FIPS Approved algorithms: RSA (Cert. #2193); SHS (Cert. #3347)
+
+Other algorithms: AES (non-compliant); MD5
Secure Kernel Code Integrity (skci.dll)10.0.143932938FIPS Approved algorithms: RSA (Certs. #2193); SHS (Certs. #3347)
+
+Other algorithms: MD5
+ + +##### Windows Server 2012 R2 + +Validated Editions: Server, Storage Server, + +**StorSimple 8000 Series, Azure StorSimple Virtual Array Windows Server 2012 R2** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll)6.3.9600 6.3.9600.170312357FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); DSA (Cert. #855); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. #2373); Triple-DES (Cert. #1692)
+
+Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
Kernel Mode Cryptographic Primitives Library (cng.sys)6.3.9600 6.3.9600.170422356FIPS Approved algorithms: AES (Cert. #2832); DRBG (Certs. #489); ECDSA (Cert. #505); HMAC (Cert. #1773); KAS (Cert. #47); KBKDF (Cert. #30); PBKDF (vendor affirmed); RSA (Certs. #1487, #1493 and #1519); SHS (Cert. # 2373); Triple-DES (Cert. #1692)
+
+Other algorithms: AES (Cert. #2832, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); AES-GCM encryption (non-compliant); DES; HMAC MD5; Legacy CAPI KDF; MD2; MD4; MD5; NDRNG; RC2; RC4; RSA (encrypt/decrypt)
Boot Manager6.3.9600 6.3.9600.170312351FIPS Approved algorithms: AES (Cert. #2832); HMAC (Cert. #1773); PBKDF (vendor affirmed); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
+
+Other algorithms: MD5; KDF (non-compliant); PBKDF (non-compliant)
BitLocker® Windows OS Loader (winload)6.3.9600 6.3.9600.170312352FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Cert. #2396)
+
+Other algorithms: MD5; NDRNG
BitLocker® Windows Resume (winresume)[16]6.3.9600 6.3.9600.170312353FIPS Approved algorithms: AES (Cert. #2832); RSA (Cert. #1494); SHS (Certs. # 2373 and #2396)
+
+Other algorithms: MD5
BitLocker® Dump Filter (dumpfve.sys)[17]6.3.9600 6.3.9600.170312354FIPS Approved algorithms: AES (Cert. #2832)
+
+Other algorithms: N/A
Code Integrity (ci.dll)6.3.9600 6.3.9600.170312355FIPS Approved algorithms: RSA (Cert. #1494); SHS (Cert. # 2373)
+
+Other algorithms: MD5
+ + +\[16\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** + +\[17\] Does not apply to **Azure StorSimple Virtual Array Windows Server 2012 R2** + +**Windows Server 2012** + +Validated Editions: Server, Storage Server + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Cryptographic Primitives Library (BCRYPTPRIMITIVES.DLL)6.2.92001892FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258); DSA (Cert. #687); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
+
+Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#687); ECDSA (Cert. ); HMAC (Cert. #); KAS (Cert. ); KBKDF (Cert. ); PBKDF (vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
+
+Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
Kernel Mode Cryptographic Primitives Library (cng.sys)6.2.92001891FIPS Approved algorithms: AES (Certs. #2197 and #2216); DRBG (Certs. #258 and #259); ECDSA (Cert. #341); HMAC (Cert. #1345); KAS (Cert. #36); KBKDF (Cert. #3); PBKDF (vendor affirmed); RNG (Cert. #1110); RSA (Certs. #1133 and #1134); SHS (Cert. #1903); Triple-DES (Cert. #1387)
+
+Other algorithms: AES (Cert. #2197, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)#1110); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
+
+Other algorithms: AES (Cert. , key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Legacy CAPI KDF; MD2; MD4; MD5; HMAC MD5; RC2; RC4; RSA (encrypt/decrypt)
Boot Manager6.2.92001895FIPS Approved algorithms: AES (Certs. #2196 and #2198); HMAC (Cert. #1347); RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: MD5
BitLocker® Windows OS Loader (WINLOAD)6.2.92001896FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: AES (Cert. #2197; non-compliant); MD5; Non-Approved RNG
BitLocker® Windows Resume (WINRESUME)6.2.92001898FIPS Approved algorithms: AES (Certs. #2196 and #2198); RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: MD5
BitLocker® Dump Filter (DUMPFVE.SYS)6.2.92001899FIPS Approved algorithms: AES (Certs. #2196 and #2198)
+
+Other algorithms: N/A
Code Integrity (CI.DLL)6.2.92001897FIPS Approved algorithms: RSA (Cert. #1132); SHS (Cert. #1903)
+
+Other algorithms: MD5
Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH.DLL)6.2.92001893FIPS Approved algorithms: DSA (Cert. #686); SHS (Cert. #1902); Triple-DES (Cert. #1386); Triple-DES MAC (Triple-DES Cert. #1386, vendor affirmed)
+
+Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4; Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
Enhanced Cryptographic Provider (RSAENH.DLL)6.2.92001894FIPS Approved algorithms: AES (Cert. #2196); HMAC (Cert. #1346); RSA (Cert. #1132); SHS (Cert. #1902); Triple-DES (Cert. #1386)
+
+Other algorithms: AES (Cert. #2196, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); Triple-DES (Cert. #1386, key wrapping; key establishment methodology provides 112 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
+ + +##### Windows Server 2008 R2 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Boot Manager (bootmgr)6.1.7600.16385 or 6.1.7601.175146.1.7600.16385 or 6.1.7601.175141321FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); RSA (Cert. #568); SHS (Cert. #1081)
+
+Other algorithms: MD5
Winload OS Loader (winload.exe)6.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216756.1.7600.16385, 6.1.7600.16757, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21655 and 6.1.7601.216751333FIPS Approved algorithms: AES (Certs. #1168 and #1177); RSA (Cert. #568); SHS (Cert. #1081)
+
+Other algorithms: MD5
Code Integrity (ci.dll)6.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221086.1.7600.16385, 6.1.7600.17122, 6.1.7600.21320, 6.1.7601.17514, 6.1.7601.17950 and 6.1.7601.221081334FIPS Approved algorithms: RSA (Cert. #568); SHS (Cert. #1081)
+
+Other algorithms: MD5
Kernel Mode Cryptographic Primitives Library (cng.sys)6.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220766.1.7600.16385, 6.1.7600.16915, 6.1.7600.21092, 6.1.7601.17514, 6.1.7601.17919, 6.1.7601.17725, 6.1.7601.21861 and 6.1.7601.220761335FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
+
+-Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4
Cryptographic Primitives Library (bcryptprimitives.dll)66.1.7600.16385 or 6.1.7601.1751466.1.7600.16385 or 6.1.7601.175141336FIPS Approved algorithms: AES (Certs. #1168 and #1177); AES GCM (Cert. #1168, vendor-affirmed); AES GMAC (Cert. #1168, vendor-affirmed); DRBG (Certs. #23 and #27); DSA (Cert. #391); ECDSA (Cert. #142); HMAC (Cert. #686); KAS (SP 800-56A, vendor affirmed, key agreement; key establishment methodology provides between 80 and 256 bits of encryption strength); RNG (Cert. #649); RSA (Certs. #559 and #567); SHS (Cert. #1081); Triple-DES (Cert. #846)
+
+Other algorithms: AES (Cert. #1168, key wrapping; key establishment methodology provides between 128 and 256 bits of encryption strength); DES; HMAC MD5; MD2; MD4; MD5; RC2; RC4
Enhanced Cryptographic Provider (RSAENH)6.1.7600.163851337FIPS Approved algorithms: AES (Cert. #1168); DRBG (Cert. #23); HMAC (Cert. #687); SHS (Cert. #1081); RSA (Certs. #559 and #568); Triple-DES (Cert. #846)
+
+Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.1.7600.163851338FIPS Approved algorithms: DSA (Cert. #390); RNG (Cert. #649); SHS (Cert. #1081); Triple-DES (Cert. #846); Triple-DES MAC (Triple-DES Cert. #846, vendor affirmed)
+
+Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman; MD5; RC2; RC2 MAC; RC4
BitLocker™ Drive Encryption6.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216756.1.7600.16385, 6.1.7600.16429, 6.1.7600.16757, 6.1.7600.20536, 6.1.7600.20873, 6.1.7600.20897, 6.1.7600.20916, 6.1.7601.17514, 6.1.7601.17556, 6.1.7601.21634, 6.1.7601.21655 or 6.1.7601.216751339FIPS Approved algorithms: AES (Certs. #1168 and #1177); HMAC (Cert. #675); SHS (Cert. #1081)
+
+Other algorithms: Elephant Diffuser
+ + +##### Windows Server 2008 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Boot Manager (bootmgr)6.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224976.0.6001.18000, 6.0.6002.18005 and 6.0.6002.224971004FIPS Approved algorithms: AES (Certs. #739 and #760); HMAC (Cert. #415); RSA (Cert. #355); SHS (Cert. #753)
+
+Other algorithms: N/A
Winload OS Loader (winload.exe)6.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225966.0.6001.18000, 6.0.6001.18606, 6.0.6001.22861, 6.0.6002.18005, 6.0.6002.18411, 6.0.6002.22497 and 6.0.6002.225961005FIPS Approved algorithms: AES (Certs. #739 and #760); RSA (Cert. #355); SHS (Cert. #753)
+
+Other algorithms: MD5
Code Integrity (ci.dll)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051006FIPS Approved algorithms: RSA (Cert. #355); SHS (Cert. #753)
+
+Other algorithms: MD5
Kernel Mode Security Support Provider Interface (ksecdd.sys)6.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228696.0.6001.18709, 6.0.6001.18272, 6.0.6001.18796, 6.0.6001.22202, 6.0.6001.22450, 6.0.6001.22987, 6.0.6001.23069, 6.0.6002.18005, 6.0.6002.18051, 6.0.6002.18541, 6.0.6002.18643, 6.0.6002.22152, 6.0.6002.22742 and 6.0.6002.228691007FIPS Approved algorithms: AES (Certs. #739 and #757); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90 AES-CTR, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
+
+Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)#83); HMAC (Cert. ); RNG (Cert.  and SP800-90 AES-CTR, vendor affirmed); RSA (Certs.  and ); SHS (Cert. ); Triple-DES (Cert. )
+
+Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; HMAC MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping: key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
Cryptographic Primitives Library (bcrypt.dll)6.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228726.0.6001.22202, 6.0.6002.18005 and 6.0.6002.228721008FIPS Approved algorithms: AES (Certs. #739 and #757); DSA (Cert. #284); ECDSA (Cert. #83); HMAC (Cert. #413); RNG (Cert. #435 and SP800-90, vendor affirmed); RSA (Certs. #353 and #358); SHS (Cert. #753); Triple-DES (Cert. #656)
+
+Other algorithms: AES (GCM and GMAC; non-compliant); DES; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); EC Diffie-Hellman (key agreement; key establishment methodology provides between 128 and 256 bits of encryption strength); MD2; MD4; MD5; RC2; RC4; RNG (SP 800-90 Dual-EC; non-compliant); RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant provides less than 112 bits of encryption strength)
Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)6.0.6001.18000 and 6.0.6002.180056.0.6001.18000 and 6.0.6002.180051009FIPS Approved algorithms: DSA (Cert. #282); RNG (Cert. #435); SHS (Cert. #753); Triple-DES (Cert. #656); Triple-DES MAC (Triple-DES Cert. #656, vendor affirmed)
+
+-Other algorithms: DES; DES MAC; DES40; DES40 MAC; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC2 MAC; RC4
Enhanced Cryptographic Provider (RSAENH)6.0.6001.22202 and 6.0.6002.180056.0.6001.22202 and 6.0.6002.180051010FIPS Approved algorithms: AES (Cert. #739); HMAC (Cert. #408); RNG (SP 800-90, vendor affirmed); RSA (Certs. #353 and #355); SHS (Cert. #753); Triple-DES (Cert. #656)
+
+Other algorithms: DES; MD2; MD4; MD5; RC2; RC4; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength)
+ + +##### Windows Server 2003 SP2 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.3959875

FIPS Approved algorithms: DSA (Cert. #221); RNG (Cert. #314); RSA (Cert. #245); SHS (Cert. #611); Triple-DES (Cert. #543)

+

Other algorithms: DES; DES40; Diffie-Hellman (key agreement; key establishment methodology provides between 112 and 150 bits of encryption strength; non-compliant less than 112 bits of encryption strength); MD5; RC2; RC4

Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.3959869

FIPS Approved algorithms: HMAC (Cert. #287); RNG (Cert. #313); SHS (Cert. #610); Triple-DES (Cert. #542)

+

Other algorithms: DES; HMAC-MD5

Enhanced Cryptographic Provider (RSAENH)5.2.3790.3959868

FIPS Approved algorithms: AES (Cert. #548); HMAC (Cert. #289); RNG (Cert. #316); RSA (Cert. #245); SHS (Cert. #613); Triple-DES (Cert. #544)

+

Other algorithms: DES; RC2; RC4; MD2; MD4; MD5; RSA (key wrapping; key establishment methodology provides between 112 and 256 bits of encryption strength; non-compliant less than 112 bits of encryption strength)

+ + +##### Windows Server 2003 SP1 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.1830 [SP1]405

FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

+

Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

+

[1] x86
+[2] SP1 x86, x64, IA64

Enhanced Cryptographic Provider (RSAENH)5.2.3790.1830 [Service Pack 1])382

FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

+

Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

+

[1] x86
+[2] SP1 x86, x64, IA64

Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.1830 [Service Pack 1]381

FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

+

Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

+

[1] x86
+[2] SP1 x86, x64, IA64

+ + +##### Windows Server 2003 + + ++++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Kernel Mode Cryptographic Module (FIPS.SYS)5.2.3790.0405

FIPS Approved algorithms: Triple-DES (Certs. #201[1] and #370[1]); SHS (Certs. #177[1] and #371[2])

+

Other algorithms: DES (Cert. #230[1]); HMAC-MD5; HMAC-SHA-1 (non-compliant)

+

[1] x86
+[2] SP1 x86, x64, IA64

Enhanced Cryptographic Provider (RSAENH)5.2.3790.0382

FIPS Approved algorithms: Triple-DES (Cert. #192[1] and #365[2]); AES (Certs. #80[1] and #290[2]); SHS (Cert. #176[1] and #364[2]); HMAC (Cert. #176, vendor affirmed[1] and #99[2]); RSA (PKCS#1, vendor affirmed[1] and #81[2])

+

Other algorithms: DES (Cert. #226[1]); SHA-256[1]; SHA-384[1]; SHA-512[1]; RC2; RC4; MD2; MD4; MD5

+

[1] x86
+[2] SP1 x86, x64, IA64

Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH)5.2.3790.0381

FIPS Approved algorithms: Triple-DES (Certs. #199[1] and #381[2]); SHA-1 (Certs. #181[1] and #385[2]); DSA (Certs. #95[1] and #146[2]); RSA (Cert. #81)

+

Other algorithms: DES (Cert. #229[1]); Diffie-Hellman (key agreement); RC2; RC4; MD5; DES 40

+

[1] x86
+[2] SP1 x86, x64, IA64

+ + +#### Other Products + +##### Windows Embedded Compact 7 and Windows Embedded Compact 8 + + ++++++ + + + + + + + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Enhanced Cryptographic Provider7.00.2872 [1] and 8.00.6246 [2]2957

FIPS Approved algorithms: AES (Certs.#4433and#4434); CKG (vendor affirmed); DRBG (Certs.#1432and#1433); HMAC (Certs.#2946and#2945); RSA (Certs.#2414and#2415); SHS (Certs.#3651and#3652); Triple-DES (Certs.#2383and#2384)

+

Allowed algorithms: HMAC-MD5; MD5; NDRNG

Cryptographic Primitives Library (bcrypt.dll)7.00.2872 [1] and 8.00.6246 [2]2956

FIPS Approved algorithms: AES (Certs.#4430and#4431); CKG (vendor affirmed); CVL (Certs.#1139and#1140); DRBG (Certs.#1429and#1430); DSA (Certs.#1187and#1188); ECDSA (Certs.#1072and#1073); HMAC (Certs.#2942and#2943); KAS (Certs.#114and#115); RSA (Certs.#2411and#2412); SHS (Certs.#3648and#3649); Triple-DES (Certs.#2381and#2382)

+

Allowed algorithms: MD5; NDRNG; RSA (key wrapping; key establishment methodology provides between 112 and 150 bits of encryption strength

+ + + +##### Windows CE 6.0 and Windows Embedded Compact 7 + + ++++++ + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Enhanced Cryptographic Provider6.00.1937 [1] and 7.00.1687 [2]825

FIPS Approved algorithms: AES (Certs. #516 [1] and #2024 [2]); HMAC (Certs. #267 [1] and #1227 [2]); RNG (Certs. #292 [1] and #1060 [2]); RSA (Cert. #230 [1] and #1052 [2]); SHS (Certs. #589 [1] and #1774 [2]); Triple-DES (Certs. #526 [1] and #1308 [2])

+

Other algorithms: MD5; HMAC-MD5; RC2; RC4; DES

+ + +##### Outlook Cryptographic Provider + + ++++++ + + + + + + + + + + + + + + +
Cryptographic ModuleVersion (link to Security Policy)FIPS Certificate #Algorithms
Outlook Cryptographic Provider (EXCHCSP)SR-1A (3821)SR-1A (3821)110

FIPS Approved algorithms: Triple-DES (Cert. #18); SHA-1 (Certs. #32); RSA (vendor affirmed)

+

Other algorithms: DES (Certs. #91); DES MAC; RC2; MD2; MD5

+ +  + +### Cryptographic Algorithms + +The following tables are organized by cryptographic algorithms with their modes, states, and key sizes. For each algorithm implementation (operating system / platform), there is a link to the Cryptographic Algorithm Validation Program (CAVP) issued certificate. + +### Advanced Encryption Standard (AES) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Modes / States / Key SizesAlgorithm Implementation and Certificate #
    +
  • AES-CBC:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-CFB128:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-CTR:
    • +
    • +
    • Counter Source: Internal
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-OFB:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +

Microsoft Surface Hub Virtual TPM Implementations #4904

+

Version 10.0.15063.674

    +
  • AES-CBC:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-CFB128:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-CTR:
    • +
    • +
    • Counter Source: Internal
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-OFB:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #4903

+

Version 10.0.16299

    +
  • AES-CBC:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-CCM:
    • +
    • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
      • +
    • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
      • +
    • Plain Text Length: 0-32
      • +
    • AAD Length: 0-65536
      • +
    • +
  • AES-CFB128:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-CFB8:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-CMAC:
    • +
    • +
    • Generation:
      • +
      • +
      • AES-128:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • AES-192:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • AES-256:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • +
    • Verification:
      • +
      • +
      • AES-128:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • AES-192:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • AES-256:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • +
    • +
  • AES-CTR:
    • +
    • +
    • Counter Source: Internal
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-ECB:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-GCM:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • Tag Lengths: 96, 104, 112, 120, 128 (bits)
      • +
    • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
      • +
    • AAD Lengths: 0, 8, 1016, 1024 (bits)
      • +
    • 96 bit IV supported
      • +
    • +
  • AES-XTS:
    • +
    • +
    • Key Size: 128:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Block Sizes: Full
        • +
      • +
    • Key Size: 256:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Block Sizes: Full
        • +
      • +
    • +

Microsoft Surface Hub SymCrypt Cryptographic Implementations #4902

+

Version 10.0.15063.674

    +
  • AES-CBC:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-CCM:
    • +
    • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
      • +
    • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
      • +
    • Plain Text Length: 0-32
      • +
    • AAD Length: 0-65536
      • +
    • +
  • AES-CFB128:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-CFB8:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-CMAC:
    • +
    • +
    • Generation:
      • +
      • +
      • AES-128:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • AES-192:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • AES-256:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • +
    • Verification:
      • +
      • +
      • AES-128:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • AES-192:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • AES-256:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • +
    • +
  • AES-CTR:
    • +
    • +
    • Counter Source: Internal
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-ECB:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-GCM:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • Tag Lengths: 96, 104, 112, 120, 128 (bits)
      • +
    • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
      • +
    • AAD Lengths: 0, 8, 1016, 1024 (bits)
      • +
    • 96 bit IV supported
      • +
    • +
  • AES-XTS:
    • +
    • +
    • Key Size: 128:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Block Sizes: Full
        • +
      • +
    • Key Size: 256:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Block Sizes: Full
        • +
      • +
    • +

Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4901

+

Version 10.0.15254

    +
  • AES-CBC:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-CCM:
    • +
    • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • Tag Lengths: 32, 48, 64, 80, 96, 112, 128 (bits)
      • +
    • IV Lengths: 56, 64, 72, 80, 88, 96, 104 (bits)
      • +
    • Plain Text Length: 0-32
      • +
    • AAD Length: 0-65536
      • +
    • +
  • AES-CFB128:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-CFB8:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-CMAC:
    • +
    • +
    • Generation:
      • +
      • +
      • AES-128:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • AES-192:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • AES-256:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • +
    • Verification:
      • +
      • +
      • AES-128:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • AES-192:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • AES-256:
        • +
        • +
        • Block Sizes: Full, Partial
          • +
        • Message Length: 0-65536
          • +
        • Tag Length: 16-16
          • +
        • +
      • +
    • +
  • AES-CTR:
    • +
    • +
    • Counter Source: Internal
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-ECB:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • +
  • AES-GCM:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • IV Generation: External
      • +
    • Key Lengths: 128, 192, 256 (bits)
      • +
    • Tag Lengths: 96, 104, 112, 120, 128 (bits)
      • +
    • Plain Text Lengths: 0, 8, 1016, 1024 (bits)
      • +
    • AAD Lengths: 0, 8, 1016, 1024 (bits)
      • +
    • 96 bit IV supported
      • +
    • +
  • AES-XTS:
    • +
    • +
    • Key Size: 128:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Block Sizes: Full
        • +
      • +
    • Key Size: 256:
      • +
      • +
      • Modes: Decrypt, Encrypt
        • +
      • Block Sizes: Full
        • +
      • +
    • +

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4897

+

Version 10.0.16299

AES-KW:

+
    +
  • Modes: Decrypt, Encrypt
    • +
  • CIPHK transformation direction: Forward
    • +
  • Key Lengths: 128, 192, 256 (bits)
    • +
  • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
    • +
+

AES Val#4902

Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #4900

+

Version 10.0.15063.674

AES-KW:

+
    +
  • Modes: Decrypt, Encrypt
    • +
  • CIPHK transformation direction: Forward
    • +
  • Key Lengths: 128, 192, 256 (bits)
    • +
  • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
    • +
+

AES Val#4901

Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #4899

+

Version 10.0.15254

AES-KW:

+
    +
  • Modes: Decrypt, Encrypt
    • +
  • CIPHK transformation direction: Forward
    • +
  • Key Lengths: 128, 192, 256 (bits)
    • +
  • Plain Text Lengths: 128, 192, 256, 320, 2048 (bits)
    • +
+

AES Val#4897

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #4898

+

Version 10.0.16299

AES-CCM:

+
    +
  • Key Lengths: 256 (bits)
    • +
  • Tag Lengths: 128 (bits)
    • +
  • IV Lengths: 96 (bits)
    • +
  • Plain Text Length: 0-32
    • +
  • AAD Length: 0-65536
    • +
+

AES Val#4902

Microsoft Surface Hub BitLocker(R) Cryptographic Implementations #4896

+

Version 10.0.15063.674

AES-CCM:

+
    +
  • Key Lengths: 256 (bits)
    • +
  • Tag Lengths: 128 (bits)
    • +
  • IV Lengths: 96 (bits)
    • +
  • Plain Text Length: 0-32
    • +
  • AAD Length: 0-65536
    • +
+

AES Val#4901

Windows 10 Mobile (version 1709) BitLocker(R) Cryptographic Implementations #4895

+

Version 10.0.15254

AES-CCM:

+
    +
  • Key Lengths: 256 (bits)
    • +
  • Tag Lengths: 128 (bits)
    • +
  • IV Lengths: 96 (bits)
    • +
  • Plain Text Length: 0-32
    • +
  • AAD Length: 0-65536
    • +
+

AES Val#4897

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); BitLocker(R) Cryptographic Implementations #4894

+

Version 10.0.16299

CBC ( e/d; 128 , 192 , 256 );

+

CFB128 ( e/d; 128 , 192 , 256 );

+

OFB ( e/d; 128 , 192 , 256 );

+

CTR ( int only; 128 , 192 , 256 )

Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #4627

+

Version 10.0.15063

KW ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

+

AES Val#4624

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #4626

+

Version 10.0.15063

CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

+

AES Val#4624

+

 

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile BitLocker(R) Cryptographic Implementations #4625

+

Version 10.0.15063

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

+

CFB8 ( e/d; 128 , 192 , 256 );

+

CFB128 ( e/d; 128 , 192 , 256 );

+

CTR ( int only; 128 , 192 , 256 )

+

CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

+

CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )

+

GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )

+

(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )

+

IV Generated: ( External ) ; PT Lengths Tested: ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 1024 , 8 , 1016 ) ; 96BitIV_Supported

+

GMAC_Supported

+

XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #4624

+

Version 10.0.15063

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4434

+

Version 7.00.2872

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #4433

+

Version 8.00.6246

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

+

CTR ( int only; 128 , 192 , 256 )

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4431

+

Version 7.00.2872

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

+

CTR ( int only; 128 , 192 , 256 )

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #4430

+

Version 8.00.6246

CBC ( e/d; 128 , 192 , 256 );

+

CFB128 ( e/d; 128 , 192 , 256 );

+

OFB ( e/d; 128 , 192 , 256 );

+

CTR ( int only; 128 , 192 , 256 )

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #4074

+

Version 10.0.14393

ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

+

CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

+

CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

+

GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
+(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
+IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
+GMAC_Supported

+

XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #4064

+

Version 10.0.14393

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

+

CFB8 ( e/d; 128 , 192 , 256 );

+

 

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #4063
+Version 10.0.14393

KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 192 , 256 , 320 , 2048 )

+

AES Val#4064

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #4062

+

Version 10.0.14393

CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

+

AES Val#4064

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BitLocker® Cryptographic Implementations #4061

+

Version 10.0.14393

KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

+

AES Val#3629

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #3652

+

Version 10.0.10586

CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

+

AES Val#3629

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BitLocker® Cryptographic Implementations #3653

+

Version 10.0.10586

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

+

CFB8 ( e/d; 128 , 192 , 256 );

+

 

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA32 Algorithm Implementations #3630
+Version 10.0.10586

ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

+

CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

+

CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

+

GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
+(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
+IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
+GMAC_Supported

+

XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #3629
+
+

+

Version 10.0.10586

KW  ( AE , AD , AES-128 , AES-192 , AES-256 , FWD , 128 , 256 , 192 , 320 , 2048 )

+

AES Val#3497

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #3507

+

Version 10.0.10240

CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

+

AES Val#3497

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BitLocker® Cryptographic Implementations #3498

+

Version 10.0.10240

ECB ( e/d; 128 , 192 , 256 ); CBC ( e/d; 128 , 192 , 256 ); CFB8 ( e/d; 128 , 192 , 256 ); CFB128 ( e/d; 128 , 192 , 256 ); CTR ( int only; 128 , 192 , 256 )

+

CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

+

CMAC(Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

+

GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
+(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
+IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 0 , 0 ) ; 96BitIV_Supported
+GMAC_Supported

+

XTS( (KS: XTS_128( (e/d) (f) ) KS: XTS_256( (e/d) (f) )

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #3497
+Version 10.0.10240

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

+

CFB8 ( e/d; 128 , 192 , 256 );

+

 

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #3476
+Version 10.0.10240

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

+

CFB8 ( e/d; 128 , 192 , 256 );

+

 

Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2853

+

Version 6.3.9600

CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

+

AES Val#2832

Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BitLocker� Cryptographic Implementations #2848

+

Version 6.3.9600

CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 0 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

+

CMAC (Generation/Verification ) (KS: 128; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 192; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 ) (KS: 256; Block Size(s): Full / Partial ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 0 Max: 16 )

+

GCM (KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )

+

(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )

+

IV Generated:  ( Externally ) ; PT Lengths Tested:  ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested:  ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested:  ( 8 , 1024 ) ; 96BitIV_Supported ;
+OtherIVLen_Supported
+GMAC_Supported

Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2832

+

Version 6.3.9600

CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
+AES Val#2197

+

CMAC (Generation/Verification ) (KS: 128; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 192; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 ) (KS: 256; Block Size(s): ; Msg Len(s) Min: 0 Max: 2^16 ; Tag Len(s) Min: 16 Max: 16 )
+AES Val#2197

+

GCM(KS: AES_128( e/d ) Tag Length(s): 128 120 112 104 96 ) (KS: AES_192( e/d ) Tag Length(s): 128 120 112 104 96 )
+(KS: AES_256( e/d ) Tag Length(s): 128 120 112 104 96 )
+IV Generated: ( Externally ) ; PT Lengths Tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; AAD Lengths tested: ( 0 , 128 , 1024 , 8 , 1016 ) ; IV Lengths Tested: ( 8 , 1024 ) ; 96BitIV_Supported
+GMAC_Supported

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #2216

CCM (KS: 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 12 (Tag Length(s): 16 )

+

AES Val#2196

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #2198

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

+

CFB8 ( e/d; 128 , 192 , 256 );

+

CFB128 ( e/d; 128 , 192 , 256 );

+

CTR ( int only; 128 , 192 , 256 )

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #2197

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

+

CFB8 ( e/d; 128 , 192 , 256 );

+

 

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #2196
CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 – 0 , 2^16 ) (Payload Length Range: 0 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )
+AES Val#1168

Windows Server 2008 R2 and SP1 CNG algorithms #1187

+

Windows 7 Ultimate and SP1 CNG algorithms #1178

CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )
+AES Val#1168		Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #1177

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

+

CFB8 ( e/d; 128 , 192 , 256 );

+

 

Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168

GCM

+

GMAC

Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1168 , vendor-affirmed
CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #760
CCM (KS: 128 , 192 , 256 ) (Assoc. Data Len Range: 0 - 0 , 2^16 ) (Payload Length Range: 1 - 32 ( Nonce Length(s): 7 8 9 10 11 12 13 (Tag Length(s): 4 6 8 10 12 14 16 )

Windows Server 2008 CNG algorithms #757

+

Windows Vista Ultimate SP1 CNG algorithms #756

CBC ( e/d; 128 , 256 );

+

CCM (KS: 128 , 256 ) (Assoc. Data Len Range: 0 - 8 ) (Payload Length Range: 4 - 32 ( Nonce Length(s): 7 8 12 13 (Tag Length(s): 4 6 8 14 16 )

Windows Vista Ultimate BitLocker Drive Encryption #715

+

Windows Vista Ultimate BitLocker Drive Encryption #424

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

+

CFB8 ( e/d; 128 , 192 , 256 );

Windows Vista Ultimate SP1 and Windows Server 2008 Symmetric Algorithm Implementation #739

+

Windows Vista Symmetric Algorithm Implementation #553

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

+

CTR ( int only; 128 , 192 , 256 )

Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #2023

ECB ( e/d; 128 , 192 , 256 );

+

CBC ( e/d; 128 , 192 , 256 );

Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #2024

+

Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #818

+

Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #781

+

Windows 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #548

+

Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #516

+

Windows CE and Windows Mobile 6, 6.1, and 6.5 Enhanced Cryptographic Provider (RSAENH) #507

+

Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #290

+

Windows CE 5.0 and 5.1 Enhanced Cryptographic Provider (RSAENH) #224

+

Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #80

+

Windows XP, SP1, and SP2 Enhanced Cryptographic Provider (RSAENH) #33

+ + +Deterministic Random Bit Generator (DRBG) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Modes / States / Key SizesAlgorithm Implementation and Certificate #
    +
  • Counter:
    • +
    • +
    • Modes: AES-256
      • +
    • Derivation Function States: Derivation Function not used
      • +
    • Prediction Resistance Modes: Not Enabled
      • +
    • +
+

Prerequisite: AES #4904

Microsoft Surface Hub Virtual TPM Implementations #1734

+

Version 10.0.15063.674

    +
  • Counter:
    • +
    • +
    • Modes: AES-256
      • +
    • Derivation Function States: Derivation Function not used
      • +
    • Prediction Resistance Modes: Not Enabled
      • +
    • +
+

Prerequisite: AES #4903

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1733

+

Version 10.0.16299

    +
  • Counter:
    • +
    • +
    • Modes: AES-256
      • +
    • Derivation Function States: Derivation Function used
      • +
    • Prediction Resistance Modes: Not Enabled
      • +
    • +
+

Prerequisite: AES #4902

Microsoft Surface Hub SymCrypt Cryptographic Implementations #1732

+

Version 10.0.15063.674

    +
  • Counter:
    • +
    • +
    • Modes: AES-256
      • +
    • Derivation Function States: Derivation Function used
      • +
    • Prediction Resistance Modes: Not Enabled
      • +
    • +
+

Prerequisite: AES #4901

Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1731

+

Version 10.0.15254

    +
  • Counter:
    • +
    • +
    • Modes: AES-256
      • +
    • Derivation Function States: Derivation Function used
      • +
    • Prediction Resistance Modes: Not Enabled
      • +
    • +
+

Prerequisite: AES #4897

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1730

+

Version 10.0.16299

CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4627 ) ]

Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1556

+

Version 10.0.15063

CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4624 ) ]

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1555

+

Version 10.0.15063

CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4434 ) ]

Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1433

+

Version 7.00.2872

CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4433 ) ]

Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #1432

+

Version 8.00.6246

CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4431 ) ]

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1430

+

Version 7.00.2872

CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4430 ) ]

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1429

+

Version 8.00.6246

CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#4074 ) ]

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #1222

+

Version 10.0.14393

CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#4064 ) ]

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #1217

+

Version 10.0.14393

CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3629 ) ]

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #955

+

Version 10.0.10586

CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#3497 ) ]

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #868

+

Version 10.0.10240

CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2832 ) ]

Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #489

+

Version 6.3.9600

CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_Use_df: ( AES-256 ) ( AES Val#2197 ) ]Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #258
CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#2023 ) ]Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #193
CTR_DRBG: [ Prediction Resistance Tested: Not Enabled; BlockCipher_No_df: ( AES-256 ) ( AES Val#1168 ) ]Windows 7 Ultimate and SP1 and Windows Server 2008 R2 and SP1 RNG Library #23
DRBG (SP 800–90)Windows Vista Ultimate SP1, vendor-affirmed
+ + +#### Digital Signature Algorithm (DSA) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Modes / States / Key SizesAlgorithm Implementation and Certificate #
    +
  • DSA:
    • +
    • +
    • 186-4:
      • +
      • +
      • PQGGen:
        • +
        • +
        • L = 2048, N = 256 SHA: SHA-256
          • +
        • L = 3072, N = 256 SHA: SHA-256
          • +
        • +
      • PQGVer:
        • +
        • +
        • L = 2048, N = 256 SHA: SHA-256
          • +
        • L = 3072, N = 256 SHA: SHA-256
          • +
        • +
      • SigGen:
        • +
        • +
        • L = 2048, N = 256 SHA: SHA-256
          • +
        • L = 3072, N = 256 SHA: SHA-256
          • +
        • +
      • SigVer:
        • +
        • +
        • L = 2048, N = 256 SHA: SHA-256
          • +
        • L = 3072, N = 256 SHA: SHA-256
          • +
        • +
      • KeyPair:
        • +
        • +
        • L = 2048, N = 256
          • +
        • L = 3072, N = 256
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4011, DRBG #1732

Microsoft Surface Hub SymCrypt Cryptographic Implementations #1303

+

Version 10.0.15063.674

    +
  • DSA:
    • +
    • +
    • 186-4:
      • +
      • +
      • PQGGen:
        • +
        • +
        • L = 2048, N = 256 SHA: SHA-256
          • +
        • L = 3072, N = 256 SHA: SHA-256
          • +
        • +
      • PQGVer:
        • +
        • +
        • L = 2048, N = 256 SHA: SHA-256
          • +
        • L = 3072, N = 256 SHA: SHA-256
          • +
        • +
      • SigGen:
        • +
        • +
        • L = 2048, N = 256 SHA: SHA-256
          • +
        • L = 3072, N = 256 SHA: SHA-256
          • +
        • +
      • SigVer:
        • +
        • +
        • L = 2048, N = 256 SHA: SHA-256
          • +
        • L = 3072, N = 256 SHA: SHA-256
          • +
        • +
      • KeyPair:
        • +
        • +
        •  
          • +
        •  
          • +
        • L = 2048, N = 256
          • +
        • L = 3072, N = 256
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4010, DRBG #1731

Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1302

+

Version 10.0.15254

    +
  • DSA:
    • +
    • +
    • 186-4:
      • +
      • +
      • PQGGen:
        • +
        • +
        • L = 2048, N = 256 SHA: SHA-256
          • +
        • L = 3072, N = 256 SHA: SHA-256
          • +
        • +
      • PQGVer:
        • +
        • +
        • L = 2048, N = 256 SHA: SHA-256
          • +
        • L = 3072, N = 256 SHA: SHA-256
          • +
        • +
      • SigGen:
        • +
        • +
        • L = 2048, N = 256 SHA: SHA-256
          • +
        • L = 3072, N = 256 SHA: SHA-256
          • +
        • +
      • SigVer:
        • +
        • +
        • L = 2048, N = 256 SHA: SHA-256
          • +
        • L = 3072, N = 256 SHA: SHA-256
          • +
        • +
      • KeyPair:
        • +
        • +
        • L = 2048, N = 256
          • +
        • L = 3072, N = 256
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4009, DRBG #1730

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1301

+

Version 10.0.16299

FIPS186-4:

+

PQG(gen)PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]

+

PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

+

KeyPairGen:   [ (2048,256) ; (3072,256) ]

+

SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]

+

SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

+

SHS: Val#3790

+

DRBG: Val# 1555

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1223

+

Version 10.0.15063

FIPS186-4:
+PQG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
+SIG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
+SHS: Val# 3649

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1188

+

Version 7.00.2872

FIPS186-4:
+PQG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
+SIG(ver)PARMS TESTED:   [ (1024,160) SHA( 1 ); ]
+SHS: Val#3648

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1187

+

Version 8.00.6246

FIPS186-4:
+PQG(gen)PARMS TESTED: [
+(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
+PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+KeyPairGen:    [ (2048,256) ; (3072,256) ]
+SIG(gen)PARMS TESTED:   [ (2048,256)
+SHA( 256 ); (3072,256) SHA( 256 ); ]
+SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

+

SHS: Val# 3347
+DRBG: Val# 1217

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #1098

+

Version 10.0.14393

FIPS186-4:
+PQG(gen)PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ] PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 )]
+KeyPairGen:    [ (2048,256) ; (3072,256) ] SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
+SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

+

SHS: Val# 3047
+DRBG: Val# 955

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #1024

+

Version 10.0.10586

FIPS186-4:
+PQG(gen)PARMS TESTED:   [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
+PQG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+KeyPairGen:    [ (2048,256) ; (3072,256) ]
+SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ] SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

+

SHS: Val# 2886
+DRBG: Val# 868

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #983

+

Version 10.0.10240

FIPS186-4:
+PQG(gen)PARMS TESTED:   [
+(2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
+PQG(ver)PARMS TESTED:   [ (2048,256)
+SHA( 256 ); (3072,256) SHA( 256 ) ]
+KeyPairGen:    [ (2048,256) ; (3072,256) ]
+SIG(gen)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
+SIG(ver)PARMS TESTED:   [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]

+

SHS: Val# 2373
+DRBG: Val# 489

Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #855

+

Version 6.3.9600

FIPS186-2:
+PQG(ver) MOD(1024);
+SIG(ver) MOD(1024);
+SHS: #1903
+DRBG: #258

+

FIPS186-4:
+PQG(gen)PARMS TESTED: [ (2048,256)SHA( 256 ); (3072,256) SHA( 256 ) ]
+PQG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+SIG(gen)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ); ]
+SIG(ver)PARMS TESTED: [ (2048,256) SHA( 256 ); (3072,256) SHA( 256 ) ]
+SHS: #1903
+DRBG: #258
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#687.

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #687
FIPS186-2:
+PQG(ver) MOD(1024);
+SIG(ver) MOD(1024);
+SHS: #1902
+DRBG: #258
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#686.		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 DSS and Diffie-Hellman Enhanced Cryptographic Provider (DSSENH) #686
FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 1773
+DRBG: Val# 193
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#645.		Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #645
FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 1081
+DRBG: Val# 23
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#391. See Historical DSA List Val#386.

Windows Server 2008 R2 and SP1 CNG algorithms #391

+

Windows 7 Ultimate and SP1 CNG algorithms #386

FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 1081
+RNG: Val# 649
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#390. See Historical DSA List Val#385.

Windows Server 2008 R2 and SP1 Enhanced DSS (DSSENH) #390

+

Windows 7 Ultimate and SP1 Enhanced DSS (DSSENH) #385

FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 753
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#284. See Historical DSA List Val#283.

Windows Server 2008 CNG algorithms #284

+

Windows Vista Ultimate SP1 CNG algorithms #283

FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 753
+RNG: Val# 435
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#282. See Historical DSA List Val#281.

Windows Server 2008 Enhanced DSS (DSSENH) #282

+

Windows Vista Ultimate SP1 Enhanced DSS (DSSENH) #281

FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 618
+RNG: Val# 321
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#227. See Historical DSA List Val#226.

Windows Vista CNG algorithms #227

+

Windows Vista Enhanced DSS (DSSENH) #226

FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 784
+RNG: Val# 448
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#292.		Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #292
FIPS186-2:
+SIG(ver) MOD(1024);
+SHS: Val# 783
+RNG: Val# 447
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical DSA List Val#291.		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #291
FIPS186-2:
+PQG(gen) MOD(1024);
+PQG(ver) MOD(1024);
+KEYGEN(Y) MOD(1024);
+SIG(gen) MOD(1024);
+SIG(ver) MOD(1024);
+SHS: Val# 611
+RNG: Val# 314		Windows 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #221
FIPS186-2:
+PQG(gen) MOD(1024);
+PQG(ver) MOD(1024);
+KEYGEN(Y) MOD(1024);
+SIG(gen) MOD(1024);
+SIG(ver) MOD(1024);
+SHS: Val# 385		Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #146
FIPS186-2:
+PQG(ver) MOD(1024);
+KEYGEN(Y) MOD(1024);
+SIG(gen) MOD(1024);
+SIG(ver) MOD(1024);
+SHS: Val# 181
+
+		Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #95
FIPS186-2:
+PQG(gen) MOD(1024);
+PQG(ver) MOD(1024);
+KEYGEN(Y) MOD(1024);
+SIG(gen) MOD(1024);
+SHS: SHA-1 (BYTE)
+SIG(ver) MOD(1024);
+SHS: SHA-1 (BYTE)

Windows 2000 DSSENH.DLL #29

+

Windows 2000 DSSBASE.DLL #28

+

Windows NT 4 SP6 DSSENH.DLL #26

+

Windows NT 4 SP6 DSSBASE.DLL #25

FIPS186-2: PRIME;
+FIPS186-2:

+

KEYGEN(Y):
+SHS: SHA-1 (BYTE)

+

SIG(gen):
+SIG(ver) MOD(1024);
+SHS: SHA-1 (BYTE)

Windows NT 4.0 SP4 Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider #17
+ + +#### Elliptic Curve Digital Signature Algorithm (ECDSA) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Modes / States / Key SizesAlgorithm Implementation and Certificate #
    +
  • ECDSA:
    • +
    • +
    • 186-4:
      • +
      • +
      • Key Pair Generation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • Generation Methods: Extra Random Bits
          • +
        • +
      • Public Key Validation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • +
      • Signature Generation:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • Signature Verification:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #2373, DRBG #489

Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1263

+

Version 6.3.9600

    +
  • ECDSA:
    • +
    • +
    • 186-4:
      • +
      • +
      • Key Pair Generation:
        • +
        • +
        • Curves: P-256, P-384
          • +
        • Generation Methods: Testing Candidates
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4011, DRBG #1734

Microsoft Surface Hub Virtual TPM Implementations #1253

+

Version 10.0.15063.674

    +
  • ECDSA:
    • +
    • +
    • 186-4:
      • +
      • +
      • Key Pair Generation:
        • +
        • +
        • Curves: P-256, P-384
          • +
        • Generation Methods: Testing Candidates
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4009, DRBG #1733

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1252

+

Version 10.0.16299

    +
  • ECDSA:
    • +
    • +
    • 186-4:
      • +
      • +
      • Key Pair Generation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • Generation Methods: Extra Random Bits
          • +
        • +
      • Public Key Validation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • +
      • Signature Generation:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • Signature Verification:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4011, DRBG #1732

Microsoft Surface Hub MsBignum Cryptographic Implementations #1251

+

Version 10.0.15063.674

    +
  • ECDSA:
    • +
    • +
    • 186-4:
      • +
      • +
      • Key Pair Generation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • Generation Methods: Extra Random Bits
          • +
        • +
      • Public Key Validation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • +
      • Signature Generation:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • Signature Verification:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4011, DRBG #1732

Microsoft Surface Hub SymCrypt Cryptographic Implementations #1250

+

Version 10.0.15063.674

    +
  • ECDSA:
    • +
    • +
    • 186-4:
      • +
      • +
      • Key Pair Generation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • Generation Methods: Extra Random Bits
          • +
        • +
      • Public Key Validation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • +
      • Signature Generation:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • Signature Verification:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4010, DRBG #1731

Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1249

+

Version 10.0.15254

    +
  • ECDSA:
    • +
    • +
    • 186-4:
      • +
      • +
      • Key Pair Generation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • Generation Methods: Extra Random Bits
          • +
        • +
      • Public Key Validation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • +
      • Signature Generation:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • Signature Verification:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4010, DRBG #1731

Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1248

+

Version 10.0.15254

    +
  • ECDSA:
    • +
    • +
    • 186-4:
      • +
      • +
      • Key Pair Generation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • Generation Methods: Extra Random Bits
          • +
        • +
      • Public Key Validation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • +
      • Signature Generation:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • Signature Verification:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4009, DRBG #1730

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1247

+

Version 10.0.16299

    +
  • ECDSA:
    • +
    • +
    • 186-4:
      • +
      • +
      • Key Pair Generation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • Generation Methods: Extra Random Bits
          • +
        • +
      • Public Key Validation:
        • +
        • +
        • Curves: P-256, P-384, P-521
          • +
        • +
      • Signature Generation:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • Signature Verification:
        • +
        • +
        • P-256 SHA: SHA-256
          • +
        • P-384 SHA: SHA-384
          • +
        • P-521 SHA: SHA-512
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4009, DRBG #1730

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1246

+

Version 10.0.16299

FIPS186-4:
+PKG: CURVES( P-256 P-384 TestingCandidates )
+SHS: Val#3790
+DRBG: Val# 1555

Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1136

+

Version 10.0.15063

FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+PKV: CURVES( P-256 P-384 P-521 )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
+SHS: Val#3790
+DRBG: Val# 1555

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1135

+

Version 10.0.15063

FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+PKV: CURVES( P-256 P-384 P-521 )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
+SHS: Val#3790
+DRBG: Val# 1555

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1133

+

Version 10.0.15063

FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+PKV: CURVES( P-256 P-384 P-521 )
+SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
+SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
+SHS:Val# 3649
+DRBG:Val# 1430

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1073

+

Version 7.00.2872

FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+PKV: CURVES( P-256 P-384 P-521 )
+SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) SIG(gen) with SHA-1 affirmed for use with protocols only.
+SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 384) P-521: (SHA-1, 512) )
+SHS:Val#3648
+DRBG:Val# 1429

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1072

+

Version 8.00.6246

FIPS186-4:
+PKG: CURVES( P-256 P-384 TestingCandidates )
+PKV: CURVES( P-256 P-384 )
+SigGen: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) SIG(gen) with SHA-1 affirmed for use with protocols only.
+SigVer: CURVES( P-256: (SHA-1, 256) P-384: (SHA-1, 256, 384) )

+

SHS: Val# 3347
+DRBG: Val# 1222

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #920

+

Version 10.0.14393

FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+PKV: CURVES( P-256 P-384 P-521 )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

+

SHS: Val# 3347
+DRBG: Val# 1217

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #911

+

Version 10.0.14393

FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

+

SHS: Val# 3047
+DRBG: Val# 955

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #760

+

Version 10.0.10586

FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

+

SHS: Val# 2886
+DRBG: Val# 868

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #706

+

Version 10.0.10240

FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )

+

SHS: Val#2373
+DRBG: Val# 489

Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #505

+

Version 6.3.9600

FIPS186-2:
+PKG: CURVES( P-256 P-384 P-521 )
+SHS: #1903
+DRBG: #258
+SIG(ver):CURVES( P-256 P-384 P-521 )
+SHS: #1903
+DRBG: #258

+

FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
+SHS: #1903
+DRBG: #258
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#341.

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #341

FIPS186-2:
+PKG: CURVES( P-256 P-384 P-521 )
+SHS: Val#1773
+DRBG: Val# 193
+SIG(ver): CURVES( P-256 P-384 P-521 )
+SHS: Val#1773
+DRBG: Val# 193

+

FIPS186-4:
+PKG: CURVES( P-256 P-384 P-521 ExtraRandomBits )
+SigGen: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512)
+SigVer: CURVES( P-256: (SHA-256) P-384: (SHA-384) P-521: (SHA-512) )
+SHS: Val#1773
+DRBG: Val# 193
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#295.

Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #295
FIPS186-2:
+PKG: CURVES( P-256 P-384 P-521 )
+SHS: Val#1081
+DRBG: Val# 23
+SIG(ver): CURVES( P-256 P-384 P-521 )
+SHS: Val#1081
+DRBG: Val# 23
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#142. See Historical ECDSA List Val#141.

Windows Server 2008 R2 and SP1 CNG algorithms #142

+

Windows 7 Ultimate and SP1 CNG algorithms #141

FIPS186-2:
+PKG: CURVES( P-256 P-384 P-521 )
+SHS: Val#753
+SIG(ver): CURVES( P-256 P-384 P-521 )
+SHS: Val#753
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#83. See Historical ECDSA List Val#82.

Windows Server 2008 CNG algorithms #83

+

Windows Vista Ultimate SP1 CNG algorithms #82

FIPS186-2:
+PKG: CURVES( P-256 P-384 P-521 )
+SHS: Val#618
+RNG: Val# 321
+SIG(ver): CURVES( P-256 P-384 P-521 )
+SHS: Val#618
+RNG: Val# 321
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical ECDSA List Val#60.		Windows Vista CNG algorithms #60
+ + +#### Keyed-Hash Message Authentication Code (HMAC) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Modes / States / Key SizesAlgorithm Implementation and Certificate #
    +
  • HMAC-SHA-1:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
  • HMAC-SHA2-256:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
  • HMAC-SHA2-384:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
+

Prerequisite: SHS #4011

Microsoft Surface Hub Virtual TPM Implementations #3271

+

Version 10.0.15063.674

    +
  • HMAC-SHA-1:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
  • HMAC-SHA2-256:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
  • HMAC-SHA2-384:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
+

Prerequisite: SHS #4009

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #3270

+

Version 10.0.16299

    +
  • HMAC-SHA-1:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
  • HMAC-SHA2-256:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
  • HMAC-SHA2-384:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
  • HMAC-SHA2-512:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
+

Prerequisite: SHS #4011

Microsoft Surface Hub SymCrypt Cryptographic Implementations #3269

+

Version 10.0.15063.674

    +
  • HMAC-SHA-1:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
  • HMAC-SHA2-256:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
  • HMAC-SHA2-384:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
  • HMAC-SHA2-512:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
+

Prerequisite: SHS #4010

Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #3268

+

Version 10.0.15254

    +
  • HMAC-SHA-1:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
  • HMAC-SHA2-256:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
  • HMAC-SHA2-384:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
  • HMAC-SHA2-512:
    • +
    • +
    • Key Sizes &lt; Block Size
      • +
    • Key Sizes &gt; Block Size
      • +
    • Key Sizes = Block Size
      • +
    • +
+

Prerequisite: SHS #4009

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #3267

+

Version 10.0.16299

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3790

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #3062

+

Version 10.0.15063

HMAC-SHA1(Key Sizes Ranges Tested: KSBS ) SHS Val#3790

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#3790

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3061

+

Version 10.0.15063

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3652

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3652

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3652

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3652

Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2946

+

Version 7.00.2872

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3651

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3651

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3651

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3651

Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2945

+

Version 8.00.6246

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3649

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3649

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal# 3649

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2943

+

Version 7.00.2872

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#3648

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#3648

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#3648

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#3648

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2942

+

Version 8.00.6246

HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
+SHS Val# 3347

+

HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
+SHS Val# 3347

+

HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
+SHS Val# 3347

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2661

+

Version 10.0.14393

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val# 3347

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val# 3347

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2651

+

Version 10.0.14393

HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
+SHS Val# 3047

+

HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
+SHS Val# 3047

+

HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
+SHS Val# 3047

+

HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
+SHS Val# 3047

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” SymCrypt Cryptographic Implementations #2381

+

Version 10.0.10586

HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
+SHSVal# 2886

+

HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
+SHSVal# 2886

+

HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
+ SHSVal# 2886

+

HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
+SHSVal# 2886

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2233

+

Version 10.0.10240

HMAC-SHA1 (Key Sizes Ranges Tested:  KSBS )
+SHS Val#2373

+

HMAC-SHA256 ( Key Size Ranges Tested:  KSBS )
+SHS Val#2373

+

HMAC-SHA384 ( Key Size Ranges Tested:  KSBS )
+SHS Val#2373

+

HMAC-SHA512 ( Key Size Ranges Tested:  KSBS )
+SHS Val#2373

Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1773

+

Version 6.3.9600

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS Val#2764

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS Val#2764

Windows CE and Windows Mobile, and Windows Embedded Handheld Enhanced Cryptographic Provider (RSAENH) #2122

+

Version 5.2.29344

HMAC-SHA1 (Key Sizes Ranges Tested: KS#1902

+

HMAC-SHA256 ( Key Size Ranges Tested: KS#1902

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 BitLocker® Cryptographic Implementations #1347

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHS#1902

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHS#1902

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHS#1902

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHS#1902

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1346

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )

+

SHS#1903

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS )

+

SHS#1903

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS )

+

SHS#1903

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS )

+

SHS#1903

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1345

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1773

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

+

Tinker HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1773

Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1364

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1774

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1774

Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1227

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#1081

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#1081

Windows Server 2008 R2 and SP1 CNG algorithms #686

+

Windows 7 and SP1 CNG algorithms #677

+

Windows Server 2008 R2 Enhanced Cryptographic Provider (RSAENH) #687

+

Windows 7 Enhanced Cryptographic Provider (RSAENH) #673

HMAC-SHA1(Key Sizes Ranges Tested: KSVal#1081

+

HMAC-SHA256 ( Key Size Ranges Tested: KSVal#1081

Windows 7 and SP1 and Windows Server 2008 R2 and SP1 BitLocker Algorithm Implementations #675

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#816

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#816

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#816

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#816

Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #452

HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#753

+

HMAC-SHA256 ( Key Size Ranges Tested: KSVal#753

Windows Vista Ultimate SP1 and Windows Server 2008 BitLocker Algorithm Implementations #415

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS )SHS Val#753

Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #408

+

Windows Vista Enhanced Cryptographic Provider (RSAENH) #407

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS )SHSVal#618

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618

Windows Vista Enhanced Cryptographic Provider (RSAENH) #297
HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#785

Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #429

+

Windows XP, vendor-affirmed

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#783

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#783

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#783

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#783

Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #428

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#613

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#613

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#613

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#613

Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #289
HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#610Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #287

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#753

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#753

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#753

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#753

Windows Server 2008 CNG algorithms #413

+

Windows Vista Ultimate SP1 CNG algorithms #412

HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#737

+

HMAC-SHA256 ( Key Size Ranges Tested: KSVal#737

Windows Vista Ultimate BitLocker Drive Encryption #386

HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#618

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#618

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#618

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#618

Windows Vista CNG algorithms #298

HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#589

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS )SHSVal#589

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#589

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#589

Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #267

HMAC-SHA1 ( Key Sizes Ranges Tested: KSBS ) SHSVal#578

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#578

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#578

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#578

Windows CE and Windows Mobile 6.0 and Windows Mobil 6.5 Enhanced Cryptographic Provider (RSAENH) #260

HMAC-SHA1 (Key Sizes Ranges Tested: KSVal#495

+

HMAC-SHA256 ( Key Size Ranges Tested: KSVal#495

Windows Vista BitLocker Drive Encryption #199
HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#364

Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #99

+

Windows XP, vendor-affirmed

HMAC-SHA1 (Key Sizes Ranges Tested: KSBS ) SHSVal#305

+

HMAC-SHA256 ( Key Size Ranges Tested: KSBS ) SHSVal#305

+

HMAC-SHA384 ( Key Size Ranges Tested: KSBS ) SHSVal#305

+

HMAC-SHA512 ( Key Size Ranges Tested: KSBS ) SHSVal#305

Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #31
+ + +#### Key Agreement Scheme (KAS) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Modes / States / Key SizesAlgorithm Implementation and Certificate #
    +
  • KAS ECC:
    • +
    • +
    • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
      • +
    • Schemes:
      • +
      • +
      • Full Unified:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • KDFs: Concatenation
          • +
        • Parameter Sets:
          • +
          • +
          • EC:
            • +
            • +
            • Curve: P-256
              • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • ED:
            • +
            • +
            • Curve: P-384
              • +
            • SHA: SHA-384
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4011, ECDSA #1253, DRBG #1734

Microsoft Surface Hub Virtual TPM Implementations #150

+

Version 10.0.15063.674

    +
  • KAS ECC:
    • +
    • +
    • Functions: Domain Parameter Generation, Domain Parameter Validation, Full Public Key Validation, Key Pair Generation, Public Key Regeneration
      • +
    • Schemes:
      • +
      • +
      • Full Unified:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • KDFs: Concatenation
          • +
        • Parameter Sets:
          • +
          • +
          • EC:
            • +
            • +
            • Curve: P-256
              • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • ED:
            • +
            • +
            • Curve: P-384
              • +
            • SHA: SHA-384
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4009, ECDSA #1252, DRBG #1733

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #149

+

Version 10.0.16299

    +
  • KAS ECC:
    • +
    • +
    • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
      • +
    • Schemes:
      • +
      • +
      • Ephemeral Unified:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • KDFs: Concatenation
          • +
        • Parameter Sets:
          • +
          • +
          • EC:
            • +
            • +
            • Curve: P-256
              • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • ED:
            • +
            • +
            • Curve: P-384
              • +
            • SHA: SHA-384
              • +
            • MAC: HMAC
              • +
            • +
          • EE:
            • +
            • +
            • Curve: P-521
              • +
            • SHA: SHA-512
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • One Pass DH:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • EC:
            • +
            • +
            • Curve: P-256
              • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • ED:
            • +
            • +
            • Curve: P-384
              • +
            • SHA: SHA-384
              • +
            • MAC: HMAC
              • +
            • +
          • EE:
            • +
            • +
            • Curve: P-521
              • +
            • SHA: SHA-512
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • Static Unified:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • EC:
            • +
            • +
            • Curve: P-256
              • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • ED:
            • +
            • +
            • Curve: P-384
              • +
            • SHA: SHA-384
              • +
            • MAC: HMAC
              • +
            • +
          • EE:
            • +
            • +
            • Curve: P-521
              • +
            • SHA: SHA-512
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4011, ECDSA #1250, DRBG #1732

+
    +
  • KAS FFC:
    • +
    • +
    • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
      • +
    • Schemes:
      • +
      • +
      • dhEphem:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • FB:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • FC:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • dhOneFlow:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • FB:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • FC:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • dhStatic:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • FB:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • FC:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4011, DSA #1303, DRBG #1732

Microsoft Surface Hub SymCrypt Cryptographic Implementations #148

+

Version 10.0.15063.674

    +
  • KAS ECC:
    • +
    • +
    • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
      • +
    • Schemes:
      • +
      • +
      • Ephemeral Unified:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • KDFs: Concatenation
          • +
        • Parameter Sets:
          • +
          • +
          • EC:
            • +
            • +
            • Curve: P-256
              • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • ED:
            • +
            • +
            • Curve: P-384
              • +
            • SHA: SHA-384
              • +
            • MAC: HMAC
              • +
            • +
          • EE:
            • +
            • +
            • Curve: P-521
              • +
            • SHA: SHA-512
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • One Pass DH:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • EC:
            • +
            • +
            • Curve: P-256
              • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • ED:
            • +
            • +
            • Curve: P-384
              • +
            • SHA: SHA-384
              • +
            • MAC: HMAC
              • +
            • +
          • EE:
            • +
            • +
            • Curve: P-521
              • +
            • SHA: SHA-512
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • Static Unified:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • EC:
            • +
            • +
            • Curve: P-256
              • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • ED:
            • +
            • +
            • Curve: P-384
              • +
            • SHA: SHA-384
              • +
            • MAC: HMAC
              • +
            • +
          • EE:
            • +
            • +
            • Curve: P-521
              • +
            • SHA: SHA-512
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4010, ECDSA #1249, DRBG #1731

+
    +
  • KAS FFC:
    • +
    • +
    • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
      • +
    • Schemes:
      • +
      • +
      • dhEphem:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • FB:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • FC:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • dhOneFlow:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • FB:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • FC:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • dhStatic:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • FB:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • FC:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4010, DSA #1302, DRBG #1731

Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #147

+

Version 10.0.15254

    +
  • KAS ECC:
    • +
    • +
    • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation, Public Key Regeneration
      • +
    • Schemes:
      • +
      • +
      • Ephemeral Unified:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • KDFs: Concatenation
          • +
        • Parameter Sets:
          • +
          • +
          • EC:
            • +
            • +
            • Curve: P-256
              • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • ED:
            • +
            • +
            • Curve: P-384
              • +
            • SHA: SHA-384
              • +
            • MAC: HMAC
              • +
            • +
          • EE:
            • +
            • +
            • Curve: P-521
              • +
            • SHA: SHA-512
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • One Pass DH:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • EC:
            • +
            • +
            • Curve: P-256
              • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • ED:
            • +
            • +
            • Curve: P-384
              • +
            • SHA: SHA-384
              • +
            • MAC: HMAC
              • +
            • +
          • EE:
            • +
            • +
            • Curve: P-521
              • +
            • SHA: SHA-512
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • Static Unified:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • EC:
            • +
            • +
            • Curve: P-256
              • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • ED:
            • +
            • +
            • Curve: P-384
              • +
            • SHA: SHA-384
              • +
            • MAC: HMAC
              • +
            • +
          • EE:
            • +
            • +
            • Curve: P-521
              • +
            • SHA: SHA-512
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4009, ECDSA #1246, DRBG #1730

+
    +
  • KAS FFC:
    • +
    • +
    • Functions: Domain Parameter Generation, Domain Parameter Validation, Key Pair Generation, Partial Public Key Validation
      • +
    • Schemes:
      • +
      • +
      • dhEphem:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • FB:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • FC:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • dhOneFlow:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • FB:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • FC:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • dhStatic:
        • +
        • +
        • Key Agreement Roles: Initiator, Responder
          • +
        • Parameter Sets:
          • +
          • +
          • FB:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • FC:
            • +
            • +
            • SHA: SHA-256
              • +
            • MAC: HMAC
              • +
            • +
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4009, DSA #1301, DRBG #1730

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #146

+

Version 10.0.16299

ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration ) SCHEMES [ FullUnified ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ]

+

SHS Val#3790
+DSA Val#1135
+DRBG Val#1556

Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #128

+

Version 10.0.15063

FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB: SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
+SHS Val#3790
+DSA Val#1223
+DRBG Val#1555

+

ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
+
+SHS Val#3790
+ECDSA Val#1133
+DRBG Val#1555

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #127

+

Version 10.0.15063

FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB: SHA256 ) ( FC: SHA256 ) ] [ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB: SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
+SHS Val# 3649
+DSA Val#1188
+DRBG Val#1430

+

ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #115

+

Version 7.00.2872

FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhHybridOneFlow ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB:SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
+[ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FB:SHA256 HMAC ) ( FC: SHA256   HMAC ) ]
+SHS Val#3648
+DSA Val#1187
+DRBG Val#1429

+

ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256   SHA256   HMAC ) ( ED: P-384   SHA384   HMAC ) ( EE: P-521   HMAC (SHA512, HMAC_SHA512) ) ]
+
+SHS Val#3648
+ECDSA Val#1072
+DRBG Val#1429

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #114

+

Version 8.00.6246

ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Full Validation   Key Regeneration )
+SCHEMES  [ FullUnified  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; &lt; KDF: CONCAT &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ]

+

SHS Val# 3347 ECDSA Val#920 DRBG Val#1222

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #93

+

Version 10.0.14393

FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation )
+SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic (No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

+

SHS Val# 3347 DSA Val#1098 DRBG Val#1217

+

ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

+

SHS Val# 3347 DSA Val#1098 ECDSA Val#911 DRBG Val#1217 HMAC Val#2651

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #92

+

Version 10.0.14393

FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

+

SHS Val# 3047 DSA Val#1024 DRBG Val#955

+

ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

+

SHS Val# 3047 ECDSA Val#760 DRBG Val#955

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #72

+

Version 10.0.10586

FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

+

SHS Val# 2886 DSA Val#983 DRBG Val#868

+

ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

+

SHS Val# 2886 ECDSA Val#706 DRBG Val#868

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #64

+

Version 10.0.10240

FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation ) SCHEMES  [ dhEphem  ( KARole(s): Initiator / Responder )
+( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FB:  SHA256 ) ( FC:  SHA256 ) ] [ dhStatic ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( FB:  SHA256 HMAC ) ( FC:  SHA256   HMAC ) ]

+

SHS Val#2373 DSA Val#855 DRBG Val#489

+

ECC:  (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG   DPV   KPG   Partial Validation   Key Regeneration ) SCHEMES  [ EphemeralUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH  ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]
+[ StaticUnified ( No_KC  &lt; KARole(s): Initiator / Responder &gt; ) ( EC:  P-256   SHA256   HMAC ) ( ED:  P-384   SHA384   HMAC ) ( EE:  P-521   HMAC (SHA512, HMAC_SHA512) ) ]

+

SHS Val#2373 ECDSA Val#505 DRBG Val#489

Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #47

+

Version 6.3.9600

FFC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation ) SCHEMES [ dhEphem ( KARole(s): Initiator / Responder )
+( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhOneFlow ( KARole(s): Initiator / Responder ) ( FA: SHA256 ) ( FB: SHA256 ) ( FC: SHA256 ) ]
+[ dhStatic ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( FA: SHA256 HMAC ) ( FB: SHA256 HMAC ) ( FC: SHA256 HMAC ) ]
+SHS #1903 DSA Val#687 DRBG #258

+

ECC: (FUNCTIONS INCLUDED IN IMPLEMENTATION: DPG DPV KPG Partial Validation Key Regeneration ) SCHEMES [ EphemeralUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ) ]
+[ OnePassDH( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 ) ( ED: P-384 SHA384 ) ( EE: P-521 (SHA512, HMAC_SHA512) ) ) ]
+[ StaticUnified ( No_KC &lt; KARole(s): Initiator / Responder&gt; ) ( EC: P-256 SHA256 HMAC ) ( ED: P-384 SHA384 HMAC ) ( EE: P-521 HMAC (SHA512, HMAC_SHA512) ) ]
+
+SHS #1903 ECDSA Val#341 DRBG #258

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #36

KAS (SP 800–56A)

+

key agreement

+

key establishment methodology provides 80 to 256 bits of encryption strength

Windows 7 and SP1, vendor-affirmed

+

Windows Server 2008 R2 and SP1, vendor-affirmed

+ + +SP 800-108 Key-Based Key Derivation Functions (KBKDF) + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Modes / States / Key SizesAlgorithm Implementation and Certificate #
    +
  • Counter:
    • +
    • +
    • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
      • +
    • +
+

MAC prerequisite: HMAC #3271

+
+
    +
  • Counter Location: Before Fixed Data
    • +
  • R Length: 32 (bits)
    • +
  • SPs used to generate K: SP 800-56A, SP 800-90A
    • +
+
+

K prerequisite: DRBG #1734, KAS #150

Microsoft Surface Hub Virtual TPM Implementations #161

+

Version 10.0.15063.674

    +
  • Counter:
    • +
    • +
    • MACs: HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384
      • +
    • +
+

MAC prerequisite: HMAC #3270

+
+
    +
  • Counter Location: Before Fixed Data
    • +
  • R Length: 32 (bits)
    • +
  • SPs used to generate K: SP 800-56A, SP 800-90A
    • +
+
+

K prerequisite: DRBG #1733, KAS #149

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #160

+

Version 10.0.16299

    +
  • Counter:
    • +
    • +
    • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
      • +
    • +
+

MAC prerequisite: AES #4902, HMAC #3269

+
+
    +
  • Counter Location: Before Fixed Data
    • +
  • R Length: 32 (bits)
    • +
  • SPs used to generate K: SP 800-56A, SP 800-90A
    • +
  • K prerequisite: KAS #148
    • +
+

Microsoft Surface Hub Cryptography Next Generation (CNG) Implementations #159

+

Version 10.0.15063.674

    +
  • Counter:
    • +
    • +
    • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
      • +
    • +
+

MAC prerequisite: AES #4901, HMAC #3268

+
+
    +
  • Counter Location: Before Fixed Data
    • +
  • R Length: 32 (bits)
    • +
  • SPs used to generate K: SP 800-56A, SP 800-90A
    • +
+
+

K prerequisite: KAS #147

Windows 10 Mobile (version 1709) Cryptography Next Generation (CNG) Implementations #158

+

Version 10.0.15254

    +
  • Counter:
    • +
    • +
    • MACs: CMAC-AES-128, CMAC-AES-192, CMAC-AES-256, HMAC-SHA-1, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512
      • +
    • +
+

MAC prerequisite: AES #4897, HMAC #3267

+
+
    +
  • Counter Location: Before Fixed Data
    • +
  • R Length: 32 (bits)
    • +
  • SPs used to generate K: SP 800-56A, SP 800-90A
    • +
+
+

K prerequisite: KAS #146

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Cryptography Next Generation (CNG) Implementations #157

+

Version 10.0.16299

CTR_Mode: ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
+
+KAS Val#128
+DRBG Val#1556
+MAC Val#3062

Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #141

+

Version 10.0.15063

CTR_Mode: ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )
+
+KAS Val#127
+AES Val#4624
+DRBG Val#1555
+MAC Val#3061

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile Cryptography Next Generation (CNG) Implementations #140

+

Version 10.0.15063

CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA384] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

+

KAS Val#93 DRBG Val#1222 MAC Val#2661

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #102

+

Version 10.0.14393

CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

+

KAS Val#92 AES Val#4064 DRBG Val#1217 MAC Val#2651

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #101

+

Version 10.0.14393

CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

+

KAS Val#72 AES Val#3629 DRBG Val#955 MAC Val#2381

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #72

+

Version 10.0.10586

CTR_Mode:  ( Llength( Min20 Max64 ) MACSupported( [CMACAES128] [CMACAES192] [CMACAES256] [HMACSHA1] [HMACSHA256] [HMACSHA384] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

+

KAS Val#64 AES Val#3497 RBG Val#868 MAC Val#2233

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #66

+

Version 10.0.10240

CTR_Mode:  ( Llength( Min0 Max0 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

+

DRBG Val#489 MAC Val#1773

Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #30

+

Version 6.3.9600

CTR_Mode: ( Llength( Min0 Max4 ) MACSupported( [HMACSHA1] [HMACSHA256] [HMACSHA512] ) LocationCounter( [BeforeFixedData] ) rlength( [32] ) )

+

DRBG #258 HMAC Val#1345

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #3
+ + +Random Number Generator (RNG) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + +
Modes / States / Key SizesAlgorithm Implementation and Certificate #

FIPS 186-2 General Purpose

+

[ (x-Original); (SHA-1) ]

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1110
FIPS 186-2
+[ (x-Original); (SHA-1) ]

Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1060

+

Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #292

+

Windows CE and Windows Mobile 6.0 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #286

+

Windows CE 5.00 and Window CE 5.01 Enhanced Cryptographic Provider (RSAENH) #66

FIPS 186-2
+[ (x-Change Notice); (SHA-1) ]

+

FIPS 186-2 General Purpose
+[ (x-Change Notice); (SHA-1) ]

Windows 7 and SP1 and Windows Server 2008 R2 and SP1 RNG Library #649

+

Windows Vista Ultimate SP1 and Windows Server 2008 RNG Implementation #435

+

Windows Vista RNG implementation #321

FIPS 186-2 General Purpose
+[ (x-Change Notice); (SHA-1) ]

Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #470

+

Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #449

+

Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #447

+

Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #316

+

Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #313

FIPS 186-2
+[ (x-Change Notice); (SHA-1) ]

Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #448

+

Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #314

+ + +#### RSA + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Modes / States / Key SizesAlgorithm Implementation and Certificate #

RSA:

+
    +
  • 186-4:
    • +
    • +
    • Signature Generation PKCS1.5:
      • +
      • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
        • +
      • +
    • Signature Generation PSS:
      • +
      • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • +
      • +
    • Signature Verification PKCS1.5:
      • +
      • +
      • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
        • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
        • +
      • +
    • Signature Verification PSS:
      • +
      • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • +
      • Mod 3072:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4011, DRBG #1734

Microsoft Surface Hub Virtual TPM Implementations #2677

+

Version 10.0.15063.674

RSA:

+
    +
  • 186-4:
    • +
    • +
    • Signature Generation PKCS1.5:
      • +
      • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
        • +
      • +
    • Signature Generation PSS:
      • +
      • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 240 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • +
      • +
    • Signature Verification PKCS1.5:
      • +
      • +
      • Mod 1024 SHA: SHA-1, SHA-256, SHA-384
        • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384
        • +
      • +
    • Signature Verification PSS:
      • +
      • +
      • Mod 1024:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4009, DRBG #1733

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #2676

+

Version 10.0.16299

RSA:

+
    +
  • 186-4:
    • +
    • +
    • Key Generation:
      • +
    • Signature Verification PKCS1.5:
      • +
      • +
      • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • +
+

Prerequisite: SHS #4011, DRBG #1732

Microsoft Surface Hub RSA32 Algorithm Implementations #2675

+

Version 10.0.15063.674

RSA:

+
    +
  • 186-4:
    • +
    • +
    • Signature Verification PKCS1.5:
      • +
      • +
      • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • +
+

Prerequisite: SHS #4009, DRBG #1730

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); RSA32 Algorithm Implementations #2674

+

Version 10.0.16299

RSA:

+
    +
  • 186-4:
    • +
    • +
    • Signature Verification PKCS1.5:
      • +
      • +
      • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • +
+

Prerequisite: SHS #4010, DRBG #1731

Windows 10 Mobile (version 1709) RSA32 Algorithm Implementations #2673

+

Version 10.0.15254

RSA:

+
    +
  • 186-4:
    • +
    • +
    • Key Generation:
      • +
      • +
      • Public Key Exponent: Fixed (10001)
        • +
      • Provable Primes with Conditions:
        • +
        • +
        • Mod lengths: 2048, 3072 (bits)
          • +
        • Primality Tests: C.3
          • +
        • +
      • +
    • Signature Generation PKCS1.5:
      • +
      • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • Signature Generation PSS:
      • +
      • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • Mod 3072:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • +
    • Signature Verification PKCS1.5:
      • +
      • +
      • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • Signature Verification PSS:
      • +
      • +
      • Mod 1024:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 496 (bits)
          • +
        • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • Mod 3072:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4011, DRBG #1732

Microsoft Surface Hub MsBignum Cryptographic Implementations #2672

+

Version 10.0.15063.674

RSA:

+
    +
  • 186-4:
    • +
    • +
    • Key Generation:
      • +
      • +
      • Probable Random Primes:
        • +
        • +
        • Mod lengths: 2048, 3072 (bits)
          • +
        • Primality Tests: C.2
          • +
        • +
      • +
    • Signature Generation PKCS1.5:
      • +
      • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • Signature Generation PSS:
      • +
      • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • Mod 3072:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • +
    • Signature Verification PKCS1.5:
      • +
      • +
      • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • Signature Verification PSS:
      • +
      • +
      • Mod 1024:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 496 (bits)
          • +
        • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • Mod 3072:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4011, DRBG #1732

Microsoft Surface Hub SymCrypt Cryptographic Implementations #2671

+

Version 10.0.15063.674

RSA:

+
    +
  • 186-4:
    • +
    • +
    • Key Generation:
      • +
      • +
      • Probable Random Primes:
        • +
        • +
        • Mod lengths: 2048, 3072 (bits)
          • +
        • Primality Tests: C.2
          • +
        • +
      • +
    • Signature Generation PKCS1.5:
      • +
      • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • Signature Generation PSS:
      • +
      • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • Mod 3072:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • +
    • Signature Verification PKCS1.5:
      • +
      • +
      • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • Signature Verification PSS:
      • +
      • +
      • Mod 1024:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 496 (bits)
          • +
        • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • Mod 3072:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4010, DRBG #1731

Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2670

+

Version 10.0.15254

RSA:

+
    +
  • 186-4:
    • +
    • +
    • Key Generation:
      • +
      • +
      • Public Key Exponent: Fixed (10001)
        • +
      • Provable Primes with Conditions:
        • +
        • +
        • Mod lengths: 2048, 3072 (bits)
          • +
        • Primality Tests: C.3
          • +
        • +
      • +
    • Signature Generation PKCS1.5:
      • +
      • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • Signature Generation PSS:
      • +
      • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • Mod 3072:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • +
    • Signature Verification PKCS1.5:
      • +
      • +
      • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • Signature Verification PSS:
      • +
      • +
      • Mod 1024:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 496 (bits)
          • +
        • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • Mod 3072:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4010, DRBG #1731

Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #2669

+

Version 10.0.15254

    +
  • 186-4:
    • +
    • +
    • Key Generation:
      • +
      • +
      • Public Key Exponent: Fixed (10001)
        • +
      • Provable Primes with Conditions:
        • +
        • +
        • Mod lengths: 2048, 3072 (bits)
          • +
        • Primality Tests: C.3
          • +
        • +
      • +
    • Signature Generation PKCS1.5:
      • +
      • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • Signature Generation PSS:
      • +
      • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • Mod 3072:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • +
    • Signature Verification PKCS1.5:
      • +
      • +
      • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • Signature Verification PSS:
      • +
      • +
      • Mod 1024:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 496 (bits)
          • +
        • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • Mod 3072:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4009, DRBG #1730

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #2668

+

Version 10.0.16299

    +
  • 186-4:
    • +
    • +
    • Key Generation:
      • +
      • +
      • Probable Random Primes:
        • +
        • +
        • Mod lengths: 2048, 3072 (bits)
          • +
        • Primality Tests: C.2
          • +
        • +
      • +
    • Signature Generation PKCS1.5:
      • +
      • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • Signature Generation PSS:
      • +
      • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • Mod 3072:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • +
    • Signature Verification PKCS1.5:
      • +
      • +
      • Mod 1024 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 2048 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • Mod 3072 SHA: SHA-1, SHA-256, SHA-384, SHA-512
        • +
      • +
    • Signature Verification PSS:
      • +
      • +
      • Mod 1024:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 496 (bits)
          • +
        • +
      • Mod 2048:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • Mod 3072:
        • +
        • +
        • SHA-1: Salt Length: 160 (bits)
          • +
        • SHA-256: Salt Length: 256 (bits)
          • +
        • SHA-384: Salt Length: 384 (bits)
          • +
        • SHA-512: Salt Length: 512 (bits)
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4009, DRBG #1730

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2667

+

Version 10.0.16299

FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))
+SHA Val#3790

Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #2524

+

Version 10.0.15063

FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#3790

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile RSA32 Algorithm Implementations #2523

+

Version 10.0.15063

FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e ( 10001 ) ;
+PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+SHA Val#3790
+DRBG: Val# 1555

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #2522

+

Version 10.0.15063

FIPS186-4:
+186-4KEY(gen):
+PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+SHA Val#3790

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2521

+

Version 10.0.15063

FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3652, SHA-256Val#3652, SHA-384Val#3652, SHA-512Val#3652

+

FIPS186-4:
+ALG[ANSIX9.31] Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
+SIG(gen) with SHA-1 affirmed for use with protocols only. Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#3652

Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2415

+

Version 7.00.2872

FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3651, SHA-256Val#3651, SHA-384Val#3651, SHA-512Val#3651

+

FIPS186-4:
+ALG[ANSIX9.31] Sig(Gen): (2048 SHA( 1 )) (3072 SHA( 1 ))
+SIG(gen) with SHA-1 affirmed for use with protocols only. Sig(Ver): (1024 SHA( 1 )) (2048 SHA( 1 )) (3072 SHA( 1 ))
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#3651

Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2414

+

Version 8.00.6246

FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val# 3649 , SHA-256Val# 3649 , SHA-384Val# 3649 , SHA-512Val# 3649

+

FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e (10001) ;
+PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val# 3649
+DRBG: Val# 1430

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2412

+

Version 7.00.2872

FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 4096 , SHS: SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#3648, SHA-256Val#3648, SHA-384Val#3648, SHA-512Val#3648

+

FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e (10001) ;
+PGM(ProbRandom: ( 2048 , 3072 ) PPTT:( C.2 )
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+ SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))
+SHA Val#3648
+DRBG: Val# 1429

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2411

+

Version 8.00.6246

FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 1 , 256 , 384 )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+SIG(Ver) (1024 SHA( 1 , 256 , 384 )) (2048 SHA( 1 , 256 , 384 ))
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) SIG(gen) with SHA-1 affirmed for use with protocols only.
+Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) ))

+

SHA Val# 3347

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #2206

+

Version 10.0.14393

FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e ( 10001 ) ;
+PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

+

SHA Val# 3347 DRBG: Val# 1217

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA Key Generation Implementation #2195

+

Version 10.0.14393

FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

+

SHA Val#3346

soft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #2194

+

Version 10.0.14393

FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
+SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

+

SHA Val# 3347 DRBG: Val# 1217

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #2193

+

Version 10.0.14393

FIPS186-4:
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

+

Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

+

SHA Val# 3347 DRBG: Val# 1217

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #2192

+

Version 10.0.14393

FIPS186-4:
+186-4KEY(gen):  FIPS186-4_Fixed_e ( 10001 ) ;
+PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

+

SHA Val# 3047 DRBG: Val# 955

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” RSA Key Generation Implementation #1889

+

Version 10.0.10586

FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

+

SHA Val#3048

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #1871

+

Version 10.0.10586

FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
+SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

+

SHA Val# 3047

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub MsBignum Cryptographic Implementations #1888

+

Version 10.0.10586

FIPS186-4:
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

+

SHA Val# 3047

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub Cryptography Next Generation (CNG) Implementations #1887

+

Version 10.0.10586

FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e ( 10001 ) ;
+PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

+

SHA Val# 2886 DRBG: Val# 868

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA Key Generation Implementation #1798

+

Version 10.0.10240

FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

+

SHA Val#2871

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #1784

+

Version 10.0.10240

FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

+

SHA Val#2871

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #1783

+

Version 10.0.10240

FIPS186-4:
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+Sig(Ver): (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

+

SHA Val# 2886

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #1802

+

Version 10.0.10240

FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e ;
+PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )

+

SHA Val#2373 DRBG: Val# 489

Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 RSA Key Generation Implementation #1487

+

Version 6.3.9600

FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

+

SHA Val#2373

Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #1494

+

Version 6.3.9600

FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
+SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 ))

+

SHA Val#2373

Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1493

+

Version 6.3.9600

FIPS186-4:
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))
+ Sig(Ver): (1024 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 62 ) )) (2048 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) )) (3072 SHA( 1 SaltLen( 20 ) , 256 SaltLen( 32 ) , 384 SaltLen( 48 ) , 512 SaltLen( 64 ) ))

+

SHA Val#2373

Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 Cryptography Next Generation Cryptographic Implementations #1519

+

Version 6.3.9600

FIPS186-4:
+ALG[RSASSA-PKCS1_V1_5] SIG(gen) (2048 SHA( 256 , 384 , 512-256 )) (3072 SHA( 256 , 384 , 512-256 ))
+SIG(Ver) (1024 SHA( 1 , 256 , 384 , 512-256 )) (2048 SHA( 1 , 256 , 384 , 512-256 )) (3072 SHA( 1 , 256 , 384 , 512-256 ))
+[RSASSA-PSS]: Sig(Gen): (2048 SHA( 256 , 384 , 512 )) (3072 SHA( 256 , 384 , 512 ))
+Sig(Ver): (1024 SHA( 1 , 256 , 384 , 512 )) (2048 SHA( 1 , 256 , 384 , 512 )) (3072 SHA( 1 , 256 , 384 , 512 , 512 ))
+SHA #1903

+

Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1134.

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG) Implementations #1134
FIPS186-4:
+186-4KEY(gen): FIPS186-4_Fixed_e , FIPS186-4_Fixed_e_Value
+PGM(ProbPrimeCondition): 2048 , 3072 PPTT:( C.3 )
+SHA #1903 DRBG: #258		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 RSA Key Generation Implementation #1133
FIPS186-2:
+ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: #258
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256#1902, SHA-384#1902, SHA-512#1902,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1#1902, SHA-256#1902, SHA-#1902, SHA-512#1902,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1132.		Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Enhanced Cryptographic Provider (RSAENH) #1132
FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1774, SHA-256Val#1774, SHA-384Val#1774, SHA-512Val#1774,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1052.		Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1052
FIPS186-2:
+ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 193
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1773, SHA-256Val#1773, SHA-384Val#1773, SHA-512Val#1773,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#1051.		Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1051
FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#568.		Windows Server 2008 R2 and SP1 Enhanced Cryptographic Provider (RSAENH) #568
FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
+ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#567. See Historical RSA List Val#560.

Windows Server 2008 R2 and SP1 CNG algorithms #567

+

Windows 7 and SP1 CNG algorithms #560

FIPS186-2:
+ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 DRBG: Val# 23
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#559.		Windows 7 and SP1 and Server 2008 R2 and SP1 RSA Key Generation Implementation #559
FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#1081, SHA-256Val#1081, SHA-384Val#1081, SHA-512Val#1081,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#557.		Windows 7 and SP1 Enhanced Cryptographic Provider (RSAENH) #557
FIPS186-2:
+ALG[ANSIX9.31]:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#816, SHA-256Val#816, SHA-384Val#816, SHA-512Val#816,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#395.		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #395
FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#783
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#783, SHA-384Val#783, SHA-512Val#783,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#371.		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #371
FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
+ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#358. See Historical RSA List Val#357.

Windows Server 2008 CNG algorithms #358

+

Windows Vista SP1 CNG algorithms #357

FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#753, SHA-256Val#753, SHA-384Val#753, SHA-512Val#753,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#355. See Historical RSA List Val#354.

Windows Server 2008 Enhanced Cryptographic Provider (RSAENH) #355

+

Windows Vista SP1 Enhanced Cryptographic Provider (RSAENH) #354

FIPS186-2:
+ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#353.		Windows Vista SP1 and Windows Server 2008 RSA Key Generation Implementation #353
FIPS186-2:
+ALG[ANSIX9.31]: Key(gen)(MOD: 2048 , 3072 , 4096 PubKey Values: 65537 RNG: Val# 321
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#258.		Windows Vista RSA key generation implementation #258
FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
+ALG[RSASSA-PSS]: SIG(gen); 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#257.		Windows Vista CNG algorithms #257
FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#618, SHA-256Val#618, SHA-384Val#618, SHA-512Val#618,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#255.		Windows Vista Enhanced Cryptographic Provider (RSAENH) #255
FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#613, SHA-256Val#613, SHA-384Val#613, SHA-512Val#613,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#245.		Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #245
FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#589, SHA-256Val#589, SHA-384Val#589, SHA-512Val#589,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#230.		Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #230
FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#578, SHA-256Val#578, SHA-384Val#578, SHA-512Val#578,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#222.		Windows CE and Windows Mobile 6 and Windows Mobile 6.1 Enhanced Cryptographic Provider (RSAENH) #222
FIPS186-2:
+ALG[RSASSA-PKCS1_V1_5]:
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#364
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#81.		Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #81
FIPS186-2:
+ALG[ANSIX9.31]:
+SIG(ver); 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305
+ALG[RSASSA-PKCS1_V1_5]: SIG(gen) 2048 , 3072 , 4096 , SHS: SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
+SIG(ver): 1024 , 1536 , 2048 , 3072 , 4096 , SHS: SHA-1Val#305, SHA-256Val#305, SHA-384Val#305, SHA-512Val#305,
+Some of the previously validated components for this validation have been removed because they are now non-compliant per the SP800-131A transition. See Historical RSA List Val#52.		Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #52

FIPS186-2:

+

– PKCS#1 v1.5, signature generation and verification

+

– Mod sizes: 1024, 1536, 2048, 3072, 4096

+

– SHS: SHA–1/256/384/512

Windows XP, vendor-affirmed

+

Windows 2000, vendor-affirmed

+ + +#### Secure Hash Standard (SHS) + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Modes / States / Key SizesAlgorithm Implementation and Certificate #
    +
  • SHA-1:
    • +
    • +
    • Supports Empty Message
      • +
    • +
  • SHA-256:
    • +
    • +
    • Supports Empty Message
      • +
    • +
  • SHA-384:
    • +
    • +
    • Supports Empty Message
      • +
    • +
  • SHA-512:
    • +
    • +
    • Supports Empty Message
      • +
    • +

Microsoft Surface Hub SymCrypt Cryptographic Implementations #4011

+

Version 10.0.15063.674

    +
  • SHA-1:
    • +
    • +
    • Supports Empty Message
      • +
    • +
  • SHA-256:
    • +
    • +
    • Supports Empty Message
      • +
    • +
  • SHA-384:
    • +
    • +
    • Supports Empty Message
      • +
    • +
  • SHA-512:
    • +
    • +
    • Supports Empty Message
      • +
    • +

Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #4010

+

Version 10.0.15254

    +
  • SHA-1:
    • +
    • +
    • Supports Empty Message
      • +
    • +
  • SHA-256:
    • +
    • +
    • Supports Empty Message
      • +
    • +
  • SHA-384:
    • +
    • +
    • Supports Empty Message
      • +
    • +
  • SHA-512:
    • +
    • +
    • Supports Empty Message
      • +
    • +

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #4009

+

Version 10.0.16299

SHA-1      (BYTE-only)
+SHA-256  (BYTE-only)
+SHA-384  (BYTE-only)
+SHA-512  (BYTE-only)

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #3790

+

Version 10.0.15063

SHA-1      (BYTE-only)
+SHA-256  (BYTE-only)
+SHA-384  (BYTE-only)
+SHA-512  (BYTE-only)

Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3652

+

Version 7.00.2872

SHA-1      (BYTE-only)
+SHA-256  (BYTE-only)
+SHA-384  (BYTE-only)
+SHA-512  (BYTE-only)

Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #3651

+

Version 8.00.6246

SHA-1      (BYTE-only)
+SHA-256  (BYTE-only)
+SHA-384  (BYTE-only)
+SHA-512  (BYTE-only)

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3649

+

Version 7.00.2872

SHA-1      (BYTE-only)
+SHA-256  (BYTE-only)
+SHA-384  (BYTE-only)
+SHA-512  (BYTE-only)

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #3648

+

Version 8.00.6246

SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #3347
+Version 10.0.14393
SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)		Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update RSA32 Algorithm Implementations #3346
+Version 10.0.14393
SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub RSA32 Algorithm Implementations #3048
+Version 10.0.10586
SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)		Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #3047
+Version 10.0.10586
SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #2886
+Version 10.0.10240
SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)		Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 RSA32 Algorithm Implementations #2871
+Version 10.0.10240
SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)		Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry RSA32 Algorithm Implementations #2396
+Version 6.3.9600
SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)		Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #2373
+Version 6.3.9600

SHA-1 (BYTE-only)

+

SHA-256 (BYTE-only)

+

SHA-384 (BYTE-only)

+

SHA-512 (BYTE-only)

+

Implementation does not support zero-length (null) messages.

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1903

+

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1902

SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)

Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1774

+

Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1773

SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)

Windows 7and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #1081

+

Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #816

SHA-1 (BYTE-only)

Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #785

+

Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #784

SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)		Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #783
SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)

Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #753

+

Windows Vista Symmetric Algorithm Implementation #618

SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)

Windows Vista BitLocker Drive Encryption #737

+

Windows Vista Beta 2 BitLocker Drive Encryption #495

SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)

Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #613

+

Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #364

SHA-1 (BYTE-only)

Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #611

+

Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #610

+

Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #385

+

Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #371

+

Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #181

+

Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #177

+

Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #176

SHA-1 (BYTE-only)
+SHA-256 (BYTE-only)
+SHA-384 (BYTE-only)
+SHA-512 (BYTE-only)

Windows CE 6.0 and Windows CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #589

+

Windows CE and Windows Mobile 6 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #578

+

Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #305

SHA-1 (BYTE-only)

Windows XP Microsoft Enhanced Cryptographic Provider #83

+

Crypto Driver for Windows 2000 (fips.sys) #35

+

Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #32

+

Windows 2000 RSAENH.DLL #24

+

Windows 2000 RSABASE.DLL #23

+

Windows NT 4 SP6 RSAENH.DLL #21

+

Windows NT 4 SP6 RSABASE.DLL #20

+ + +#### Triple DES + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Modes / States / Key SizesAlgorithm Implementation and Certificate #
    +
  • TDES-CBC:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Keying Option: 1
      • +
    • +
  • TDES-CFB64:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Keying Option: 1
      • +
    • +
  • TDES-CFB8:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Keying Option: 1
      • +
    • +
  • TDES-ECB:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Keying Option: 1
      • +
    • +

Microsoft Surface Hub SymCrypt Cryptographic Implementations #2558

+

Version 10.0.15063.674

    +
  • TDES-CBC:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Keying Option: 1
      • +
    • +
  • TDES-CFB64:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Keying Option: 1
      • +
    • +
  • TDES-CFB8:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Keying Option: 1
      • +
    • +
  • TDES-ECB:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Keying Option: 1
      • +
    • +

Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #2557

+

Version 10.0.15254

    +
  • TDES-CBC:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Keying Option: 1
      • +
    • +
  • TDES-CFB64:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Keying Option: 1
      • +
    • +
  • TDES-CFB8:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Keying Option: 1
      • +
    • +
  • TDES-ECB:
    • +
    • +
    • Modes: Decrypt, Encrypt
      • +
    • Keying Option: 1
      • +
    • +

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #2556

+

Version 10.0.16299

TECB( KO 1 e/d, ) ; TCBC( KO 1 e/d, ) ; TCFB8( KO 1 e/d, ) ; TCFB64( KO 1 e/d, )

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #2459

+

Version 10.0.15063

TECB( KO 1 e/d, ) ;

+

TCBC( KO 1 e/d, )

Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2384

+

Version 8.00.6246

TECB( KO 1 e/d, ) ;

+

TCBC( KO 1 e/d, )

Windows Embedded Compact Enhanced Cryptographic Provider (RSAENH) #2383

+

Version 8.00.6246

TECB( KO 1 e/d, ) ;

+

TCBC( KO 1 e/d, ) ;

+

CTR ( int only )

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2382

+

Version 7.00.2872

TECB( KO 1 e/d, ) ;

+

TCBC( KO 1 e/d, )

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #2381

+

Version 8.00.6246

TECB( KO 1 e/d, ) ;

+

TCBC( KO 1 e/d, ) ;

+

TCFB8( KO 1 e/d, ) ;

+

TCFB64( KO 1 e/d, )

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update SymCrypt Cryptographic Implementations #2227
+
+

+

Version 10.0.14393

TECB( KO 1 e/d, ) ;

+

TCBC( KO 1 e/d, ) ;

+

TCFB8( KO 1 e/d, ) ;

+

TCFB64( KO 1 e/d, )

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub and Surface Hub SymCrypt Cryptographic Implementations #2024
+
+

+

Version 10.0.10586

TECB( KO 1 e/d, ) ;

+

TCBC( KO 1 e/d, ) ;

+

TCFB8( KO 1 e/d, ) ;

+

TCFB64( KO 1 e/d, )

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 SymCrypt Cryptographic Implementations #1969
+
+

+

Version 10.0.10240

TECB( KO 1 e/d, ) ;

+

TCBC( KO 1 e/d, ) ;

+

TCFB8( KO 1 e/d, ) ;

+

TCFB64( KO 1 e/d, )

Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 SymCrypt Cryptographic Implementations #1692

+

Version 6.3.9600

TECB( e/d; KO 1,2 ) ;

+

TCBC( e/d; KO 1,2 ) ;

+

TCFB8( e/d; KO 1,2 ) ;

+

TCFB64( e/d; KO 1,2 )

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Next Generation Symmetric Cryptographic Algorithms Implementations (SYMCRYPT) #1387

TECB( e/d; KO 1,2 ) ;

+

TCBC( e/d; KO 1,2 ) ;

+

TCFB8( e/d; KO 1,2 )

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Symmetric Algorithm Implementations (RSA32) #1386

TECB( e/d; KO 1,2 ) ;

+

TCBC( e/d; KO 1,2 ) ;

+

TCFB8( e/d; KO 1,2 )

Windows 7 and SP1 and Windows Server 2008 R2 and SP1 Symmetric Algorithm Implementation #846

TECB( e/d; KO 1,2 ) ;

+

TCBC( e/d; KO 1,2 ) ;

+

TCFB8( e/d; KO 1,2 )

Windows Vista SP1 and Windows Server 2008 Symmetric Algorithm Implementation #656

TECB( e/d; KO 1,2 ) ;

+

TCBC( e/d; KO 1,2 ) ;

+

TCFB8( e/d; KO 1,2 )

Windows Vista Symmetric Algorithm Implementation #549
Triple DES MAC

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 #1386, vendor-affirmed

+

Windows 7 and SP1 and Windows Server 2008 R2 and SP1 #846, vendor-affirmed

TECB( e/d; KO 1,2 ) ;

+

TCBC( e/d; KO 1,2 )

Windows Embedded Compact 7 Enhanced Cryptographic Provider (RSAENH) #1308

+

Windows Embedded Compact 7 Cryptographic Primitives Library (bcrypt.dll) #1307

+

Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #691

+

Windows XP Professional SP3 Kernel Mode Cryptographic Module (fips.sys) #677

+

Windows XP Professional SP3 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #676

+

Windows XP Professional SP3 Enhanced Cryptographic Provider (RSAENH) #675

+

Windows Server 2003 SP2 Enhanced Cryptographic Provider (RSAENH) #544

+

Windows Server 2003 SP2 Enhanced DSS and Diffie-Hellman Cryptographic Provider #543

+

Windows Server 2003 SP2 Kernel Mode Cryptographic Module (fips.sys) #542

+

Windows CE 6.0 and Window CE 6.0 R2 and Windows Mobile Enhanced Cryptographic Provider (RSAENH) #526

+

Windows CE and Windows Mobile 6 and Windows Mobile 6.1 and Windows Mobile 6.5 Enhanced Cryptographic Provider (RSAENH) #517

+

Windows Server 2003 SP1 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #381

+

Windows Server 2003 SP1 Kernel Mode Cryptographic Module (fips.sys) #370

+

Windows Server 2003 SP1 Enhanced Cryptographic Provider (RSAENH) #365

+

Windows CE 5.00 and Windows CE 5.01 Enhanced Cryptographic Provider (RSAENH) #315

+

Windows Server 2003 Kernel Mode Cryptographic Module (fips.sys) #201

+

Windows Server 2003 Enhanced DSS and Diffie-Hellman Cryptographic Provider (DSSENH) #199

+

Windows Server 2003 Enhanced Cryptographic Provider (RSAENH) #192

+

Windows XP Microsoft Enhanced Cryptographic Provider #81

+

Windows 2000 Microsoft Outlook Cryptographic Provider (EXCHCSP.DLL) SR-1A (3821) #18

+

Crypto Driver for Windows 2000 (fips.sys) #16

+ + +#### SP 800-132 Password Based Key Derivation Function (PBKDF) + + + + + + + + + + + + + + +
+ Modes / States / Key Sizes + + Algorithm Implementation and Certificate # +
+ PBKDF (vendor affirmed) +

 Kernel Mode Cryptographic Primitives Library (cng.sys) Cryptographic Primitives Library (bcryptprimitives.dll and ncryptsslp.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2937
(Software Version: 10.0.14393)

+

Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
(Software Version: 10.0.14393)

+

Code Integrity (ci.dll) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2935
(Software Version: 10.0.14393)

+

Boot Manager in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2931
(Software Version: 10.0.14393)

+
+ PBKDF (vendor affirmed) +

Kernel Mode Cryptographic Primitives Library (cng.sys) in Microsoft Windows 10, Windows 10 Pro, Windows 10 Enterprise, Windows 10 Enterprise LTSB, Windows 10 Mobile, Windows Server 2016 Standard, Windows Server 2016 Datacenter, Windows Storage Server 2016 #2936
(Software Version: 10.0.14393)

+

Windows 8, Windows RT, Windows Server 2012, Surface Windows RT, Surface Windows 8 Pro, and Windows Phone 8 Cryptography Next Generation (CNG), vendor-affirmed

+
+ + +#### Component Validation List + + ++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Publication / Component Validated / DescriptionImplementation and Certificate #
    +
  • ECDSA SigGen:
    • +
    • +
    • P-256 SHA: SHA-256
      • +
    • P-384 SHA: SHA-384
      • +
    • P-521 SHA: SHA-512
      • +
    • +
+

Prerequisite: DRBG #489

Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #1540

+

Version 6.3.9600

    +
  • RSASP1:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • Padding Algorithms: PKCS 1.5
      • +
    • +

Microsoft Surface Hub Virtual TPM Implementations #1519

+

Version 10.0.15063.674

    +
  • RSASP1:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • Padding Algorithms: PKCS 1.5
      • +
    • +

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); Virtual TPM Implementations #1518

+

Version 10.0.16299

    +
  • RSADP:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • +

Microsoft Surface Hub MsBignum Cryptographic Implementations #1517

+

Version 10.0.15063.674

    +
  • RSASP1:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • Padding Algorithms: PKCS 1.5
      • +
    • +

Microsoft Surface Hub MsBignum Cryptographic Implementations #1516

+

Version 10.0.15063.674

    +
  • ECDSA SigGen:
    • +
    • +
    • P-256 SHA: SHA-256
      • +
    • P-384 SHA: SHA-384
      • +
    • P-521 SHA: SHA-512
      • +
    • +
+

 Prerequisite: DRBG #1732

Microsoft Surface Hub MsBignum Cryptographic Implementations #1515

+

Version 10.0.15063.674

    +
  • ECDSA SigGen:
    • +
    • +
    • P-256 SHA: SHA-256
      • +
    • P-384 SHA: SHA-384
      • +
    • P-521 SHA: SHA-512
      • +
    • +
+

Prerequisite: DRBG #1732

Microsoft Surface Hub SymCrypt Cryptographic Implementations #1514

+

Version 10.0.15063.674

    +
  • RSADP:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • +

Microsoft Surface Hub SymCrypt Cryptographic Implementations #1513

+

Version 10.0.15063.674

    +
  • RSASP1:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • Padding Algorithms: PKCS 1.5
      • +
    • +

Microsoft Surface Hub SymCrypt Cryptographic Implementations #1512

+

Version 10.0.15063.674

    +
  • IKEv1:
    • +
    • +
    • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
      • +
    • Pre-shared Key Length: 64-2048
      • +
    • Diffie-Hellman shared secrets:
      • +
      • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 2048 (bits)
          • +
        • SHA Functions: SHA-256
          • +
        • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 256 (bits)
          • +
        • SHA Functions: SHA-256
          • +
        • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 384 (bits)
          • +
        • SHA Functions: SHA-384
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4011, HMAC #3269

+
    +
  • IKEv2:
    • +
    • +
    • Derived Keying Material length: 192-1792
      • +
    • Diffie-Hellman shared secrets:
      • +
      • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 2048 (bits)
          • +
        • SHA Functions: SHA-256
          • +
        • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 256 (bits)
          • +
        • SHA Functions: SHA-256
          • +
        • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 384 (bits)
          • +
        • SHA Functions: SHA-384
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4011, HMAC #3269

+
    +
  • TLS:
    • +
    • +
    • Supports TLS 1.0/1.1
      • +
    • Supports TLS 1.2:
      • +
      • +
      • SHA Functions: SHA-256, SHA-384
        • +
      • +
    • +
+

Prerequisite: SHS #4011, HMAC #3269

Microsoft Surface Hub SymCrypt Cryptographic Implementations #1511

+

Version 10.0.15063.674

    +
  • ECDSA SigGen:
    • +
    • +
    • P-256 SHA: SHA-256
      • +
    • P-384 SHA: SHA-384
      • +
    • P-521 SHA: SHA-512
      • +
    • +
+

Prerequisite: DRBG #1731

Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1510

+

Version 10.0.15254

    +
  • RSADP:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • +

Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1509

+

Version 10.0.15254

    +
  • RSASP1:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • Padding Algorithms: PKCS 1.5
      • +
    • +

Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1508

+

Version 10.0.15254

    +
  • IKEv1:
    • +
    • +
    • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
      • +
    • Pre-shared Key Length: 64-2048
      • +
    • Diffie-Hellman shared secrets:
      • +
      • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 2048 (bits)
          • +
        • SHA Functions: SHA-256
          • +
        • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 256 (bits)
          • +
        • SHA Functions: SHA-256
          • +
        • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 384 (bits)
          • +
        • SHA Functions: SHA-384
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4010, HMAC #3268

+
    +
  • IKEv2:
    • +
    • +
    • Derived Keying Material length: 192-1792
      • +
    • Diffie-Hellman shared secrets:
      • +
      • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 2048 (bits)
          • +
        • SHA Functions: SHA-256
          • +
        • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 256 (bits)
          • +
        • SHA Functions: SHA-256
          • +
        • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 384 (bits)
          • +
        • SHA Functions: SHA-384
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4010, HMAC #3268

+
    +
  • TLS:
    • +
    • +
    • Supports TLS 1.0/1.1
      • +
    • Supports TLS 1.2:
      • +
      • +
      • SHA Functions: SHA-256, SHA-384
        • +
      • +
    • +
+

Prerequisite: SHS #4010, HMAC #3268

Windows 10 Mobile (version 1709) SymCrypt Cryptographic Implementations #1507

+

Version 10.0.15254

    +
  • ECDSA SigGen:
    • +
    • +
    • P-256 SHA: SHA-256
      • +
    • P-384 SHA: SHA-384
      • +
    • P-521 SHA: SHA-512
      • +
    • +
+

Prerequisite: DRBG #1731

Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1506

+

Version 10.0.15254

    +
  • RSADP:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • +

Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1505

+

Version 10.0.15254

    +
  • RSASP1:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • Padding Algorithms: PKCS 1.5
      • +
    • +

Windows 10 Mobile (version 1709) MsBignum Cryptographic Implementations #1504

+

Version 10.0.15254

    +
  • ECDSA SigGen:
    • +
    • +
    • P-256 SHA: SHA-256
      • +
    • P-384 SHA: SHA-384
      • +
    • P-521 SHA: SHA-512
      • +
    • +
+

Prerequisite: DRBG #1730

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1503

+

Version 10.0.16299

    +
  • RSADP:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • +

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1502

+

Version 10.0.16299

    +
  • RSASP1:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • Padding Algorithms: PKCS 1.5
      • +
    • +

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); MsBignum Cryptographic Implementations #1501

+

Version 10.0.16299

    +
  • ECDSA SigGen:
    • +
    • +
    • P-256 SHA: SHA-256
      • +
    • P-384 SHA: SHA-384
      • +
    • P-521 SHA: SHA-512
      • +
    • +
+

Prerequisite: DRBG #1730

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1499

+

Version 10.0.16299

    +
  • RSADP:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • +

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations #1498

+

Version 10.0.16299

+

 

    +
  • RSASP1:
    • +
    • +
    • Modulus Size: 2048 (bits)
      • +
    • Padding Algorithms: PKCS 1.5
      • +
    • +

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1497

+

Version 10.0.16299

    +
  • IKEv1:
    • +
    • +
    • Methods: Digital Signature, Pre-shared Key, Public Key Encryption
      • +
    • Pre-shared Key Length: 64-2048
      • +
    • Diffie-Hellman shared secrets:
      • +
      • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 2048 (bits)
          • +
        • SHA Functions: SHA-256
          • +
        • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 256 (bits)
          • +
        • SHA Functions: SHA-256
          • +
        • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 384 (bits)
          • +
        • SHA Functions: SHA-384
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4009, HMAC #3267

+
    +
  • IKEv2:
    • +
    • +
    • Derived Keying Material length: 192-1792
      • +
    • Diffie-Hellman shared secrets:
      • +
      • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 2048 (bits)
          • +
        • SHA Functions: SHA-256
          • +
        • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 256 (bits)
          • +
        • SHA Functions: SHA-256
          • +
        • +
      • Diffie-Hellman shared secret:
        • +
        • +
        • Length: 384 (bits)
          • +
        • SHA Functions: SHA-384
          • +
        • +
      • +
    • +
+

Prerequisite: SHS #4009, HMAC #3267

+
    +
  • TLS:
    • +
    • +
    • Supports TLS 1.0/1.1
      • +
    • Supports TLS 1.2:
      • +
      • +
      • SHA Functions: SHA-256, SHA-384
        • +
      • +
    • +
+

Prerequisite: SHS #4009, HMAC #3267

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

+

Version 10.0.16299

FIPS186-4 ECDSA

+

Signature Generation of hash sized messages

+

ECDSA SigGen Component: CURVES( P-256 P-384 P-521 )

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1284
+Version 10.0. 15063

+

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1279
+Version 10.0. 15063

+

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #922
+Version 10.0.14393

+

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #894
+Version 10.0.14393icrosoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #666
+Version 10.0.10586

+

Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 MsBignum Cryptographic Implementations #288
+Version 6.3.9600

FIPS186-4 RSA; PKCS#1 v2.1

+

RSASP1 Signature Primitive

+

RSASP1: (Mod2048: PKCS1.5 PKCSPSS)

Windows 10 Creators Update (version 1703) Pro, Enterprise, Education Virtual TPM Implementations #1285
+Version 10.0.15063

+

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1282
+Version 10.0.15063

+

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1280
+Version 10.0.15063

+

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #893
+Version 10.0.14393

+

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update MsBignum Cryptographic Implementations #888
+Version 10.0.14393

+

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” MsBignum Cryptographic Implementations #665
+Version 10.0.10586

+

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 MsBignum Cryptographic Implementations #572
+Version  10.0.10240

+

Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry MsBignum Cryptographic Implementations #289
+Version 6.3.9600

FIPS186-4 RSA; RSADP

+

RSADP Primitive

+

RSADP: (Mod2048)

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile MsBignum Cryptographic Implementations #1283
+Version 10.0.15063

+

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1281
+Version 10.0.15063

+

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4 and Surface Pro 3 w/ Windows 10 Anniversary Update Virtual TPM Implementations #895
+Version 10.0.14393

+

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update Cryptography Next Generation (CNG) Implementations #887
+Version 10.0.14393

+

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” Cryptography Next Generation (CNG) Implementations #663
+Version 10.0.10586

+

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 Cryptography Next Generation (CNG) Implementations #576
+Version  10.0.10240

SP800-135

+

Section 4.1.1, IKEv1 Section 4.1.2, IKEv2 Section 4.2, TLS

Windows 10 Home, Pro, Enterprise, Education, Windows 10 S Fall Creators Update and Windows Server, Windows Server Datacenter (version 1709); SymCrypt Cryptographic Implementations  #1496

+

Version 10.0.16299

+

Windows 10 Creators Update (version 1703) Home, Pro, Enterprise, Education, Windows 10 S, Windows 10 Mobile SymCrypt Cryptographic Implementations #1278
+Version 10.0.15063

+

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1140
+Version 7.00.2872

+

Windows Embedded Compact Cryptographic Primitives Library (bcrypt.dll) #1139
+Version 8.00.6246

+

Microsoft Windows 10 Anniversary Update, Windows Server 2016, Windows Storage Server 2016; Microsoft Surface Book, Surface Pro 4, Surface Pro 3 and Surface 3 w/ Windows 10 Anniversary Update; Microsoft Lumia 950 and Lumia 650 w/ Windows 10 Mobile Anniversary Update BcryptPrimitives and NCryptSSLp #886
+Version 10.0.14393

+

Microsoft Windows 10 November 2015 Update; Microsoft Surface Book, Surface Pro 4, Surface Pro 3, Surface 3, Surface Pro 2, and Surface Pro w/ Windows 10 November 2015 Update; Windows 10 Mobile for Microsoft Lumia 950 and Microsoft Lumia 635; Windows 10 for Microsoft Surface Hub 84” and Surface Hub 55” BCryptPrimitives and NCryptSSLp #664
+Version 10.0.10586

+

Microsoft Windows 10, Microsoft Surface Pro 3 with Windows 10, Microsoft Surface 3 with Windows 10, Microsoft Surface Pro 2 with Windows 10, Microsoft Surface Pro with Windows 10 BCryptPrimitives and NCryptSSLp #575
+Version  10.0.10240

+

Microsoft Windows 8.1, Microsoft Windows Server 2012 R2, Microsoft Windows Storage Server 2012 R2, Microsoft Windows RT 8.1, Microsoft Surface with Windows RT 8.1, Microsoft Surface Pro with Windows 8.1, Microsoft Surface 2, Microsoft Surface Pro 2, Microsoft Surface Pro 3, Microsoft Windows Phone 8.1, Microsoft Windows Embedded 8.1 Industry and Microsoft StorSimple 8100 BCryptPrimitives and NCryptSSLp #323
+Version 6.3.9600

+ + +## References + +\[[FIPS 140](http://csrc.nist.gov/publications/fips/fips140-2/fips1402.pdf)\] - FIPS 140-2, Security Requirements for Cryptographic Modules + +\[[FIPS FAQ](http://csrc.nist.gov/groups/stm/cmvp/documents/cmvpfaq.pdf)\] - Cryptographic Module Validation Program (CMVP) FAQ + +\[[SP 800-57](http://csrc.nist.gov/publications/pubssps.html#800-57-part1)\] - Recommendation for Key Management – Part 1: General (Revised) + +\[[SP 800-131A](http://csrc.nist.gov/publications/nistpubs/800-131a/sp800-131a.pdf)\] - Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths + +## Additional Microsoft References + +Enabling FIPS mode - + +Cipher Suites in Schannel - [http://msdn.microsoft.com/en-us/library/aa374757(VS.85).aspx](https://msdn.microsoft.com/en-us/library/aa374757\(vs.85\).aspx) + diff --git a/windows/security/threat-protection/mbsa-removal-and-guidance.md b/windows/security/threat-protection/mbsa-removal-and-guidance.md new file mode 100644 index 0000000000..1c121d6b6a --- /dev/null +++ b/windows/security/threat-protection/mbsa-removal-and-guidance.md @@ -0,0 +1,39 @@ +--- +title: Microsoft Baseline Security Analyzer (MBSA) removal and guidance on alternative solutions +description: This article documents the removal of MBSA and alternative solutions +keywords: MBSA, security, removal +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.author: astoica +author: andreiztm +ms.date: 10/04/2018 +--- + +### What is Microsoft Baseline Security Analyzer and its uses? + +Microsoft Baseline Security Analyzer (MBSA) is used to verify patch compliance. MBSA also performed several other security checks for Windows, IIS, and SQL Server. Unfortunately, the logic behind these additional checks had not been actively maintained since Windows XP and Windows Server 2003. Changes in the products since then rendered many of these security checks obsolete and some of their recommendations counterproductive. + +MBSA was largely used in situations where neither Microsoft Update nor a local WSUS/SCCM server was available, or as a compliance tool to ensure that all security updates were deployed to a managed environment. While MBSA version 2.3 support for Windows Server 2012 R2 and Windows 8.1 was added, it has since been deprecated and no longer developed. MBSA 2.3 is not updated to fully support Windows 10 and Windows Server 2016. + +### The Solution +A script can help you with an alternative to MBSA’s patch-compliance checking: + +- [Using WUA to Scan for Updates Offline](https://docs.microsoft.com/previous-versions/windows/desktop/aa387290(v=vs.85)), which includes a sample .vbs script. +For a PowerShell alternative, see [Using WUA to Scan for Updates Offline with PowerShell](https://gallery.technet.microsoft.com/Using-WUA-to-Scan-for-f7e5e0be). + +For example: + +[![VBS script](images/vbs-example.png)](https://docs.microsoft.com/previous-versions/windows/desktop/aa387290(v=vs.85)) +[![PowerShell script](images/powershell-example.png)](https://gallery.technet.microsoft.com/Using-WUA-to-Scan-for-f7e5e0be) + +The preceding scripts leverage the [WSUS offline scan file](https://support.microsoft.com/help/927745/detailed-information-for-developers-who-use-the-windows-update-offline) (wsusscn2.cab) to perform a scan and get the same information on missing updates as MBSA supplied. MBSA also relied on the wsusscn2.cab to determine which updates were missing from a given system without connecting to any online service or server. The wsusscn2.cab file is still available and there are currently no plans to remove or replace it. +The wsusscn2.cab file contains the metadata of only security updates, update rollups and service packs available from Microsoft Update; it does not contain any information on non-security updates, tools or drivers. + +### More Information + +For security compliance and for desktop/server hardening, we recommend the Microsoft Security Baselines and the Security Compliance Toolkit. + +- [Windows security baselines](windows-security-baselines.md) +- [Download Microsoft Security Compliance Toolkit 1.0 ](https://www.microsoft.com/download/details.aspx?id=55319) +- [Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/) diff --git a/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md index affe0ea030..4320d8ddca 100644 --- a/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md @@ -45,7 +45,7 @@ To access Threat analytics, from the navigation pane select **Dashboards** > **T Click a section of each chart to get a list of the machines in the corresponding mitigation status. ## Related topics -- [Threat analtyics](threat-analytics-windows-defender-advanced-threat-protection.md) +- [Threat analytics](threat-analytics.md) - [Overview of Secure Score in Windows Defender Security Center](overview-secure-score-windows-defender-advanced-threat-protection.md) - [Configure the security controls in Secure score](secure-score-dashboard-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-platform-common-criteria.md b/windows/security/threat-protection/windows-platform-common-criteria.md new file mode 100644 index 0000000000..86b6688059 --- /dev/null +++ b/windows/security/threat-protection/windows-platform-common-criteria.md @@ -0,0 +1,165 @@ +--- +title: Windows Platform Common Criteria Certification +description: This topic details how Microsoft supports the Common Criteria certification program. +ms.prod: w10 +ms.localizationpriority: medium +ms.author: daniha +author: danihalfin +ms.date: 04/03/2018 +--- + +# Windows Platform Common Criteria Certification + +Microsoft is committed to optimizing the security of its products and services. As part of that commitment, Microsoft supports the Common Criteria certification program, continues to ensure that products incorporate the features and functions required by relevant Common Criteria protection profiles, and completes Common Criteria certifications of Microsoft Windows products. + +## Common Criteria Security Targets + +### Information for Systems Integrators and Accreditors + +The Security Target describes security functionality and assurance measures used to evaluate Windows. + + - [Microsoft Window 10 (Creators Update)](http://download.microsoft.com/download/e/8/b/e8b8c42a-a0b6-4ba1-9bdc-e704e8289697/windows%2010%20version%201703%20gp%20os%20security%20target%20-%20public%20\(january%2016,%202018\)\(final\)\(clean\).pdf) + - [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](http://download.microsoft.com/download/1/c/3/1c3b5ab0-e064-4350-a31f-48312180d9b5/st_vid10823-st.pdf) + - [Microsoft Windows 10 (Anniversary Update) and Windows 10 Mobile (Anniversary Update)](http://download.microsoft.com/download/1/5/e/15eee6d3-f2a8-4441-8cb1-ce8c2ab91c24/windows%2010%20anniversary%20update%20mdf%20security%20target%20-%20public%20\(april%203%202017\).docx) + - [Microsoft Windows 10 (Anniversary Update) and Windows Server 2016](http://download.microsoft.com/download/f/8/c/f8c1c2a4-719c-48ae-942f-9fd3ce5b238f/windows%2010%20au%20and%20server%202016%20gp%20os%20security%20target%20-%20public%20\(december%202%202016\)%20\(clean\).docx) + - [Windows 10 (Anniversary Update) and Windows Server 2016 IPsec VPN Client](http://download.microsoft.com/download/b/f/5/bf59e430-e57b-462d-8dca-8ac3c93cfcff/windows%2010%20anniversary%20update%20ipsec%20vpn%20client%20security%20target%20-%20public%20\(december%2029%202016\)%20\(clean\).docx) + - [Microsoft Windows 10 IPsec VPN Client](http://download.microsoft.com/download/3/7/2/372beb03-b1ed-4bb6-9b9b-b8f43afc570d/st_vid10746-st.pdf) + - [Microsoft Windows 10 November 2015 Update with Surface Book](http://download.microsoft.com/download/a/c/2/ac2a6ed8-4d2f-4f48-a9bf-f059d6c9af38/windows%2010%20mdf3%20security%20target%20-%20public%20\(june%2022%202016\)\(final\).docx) + - [Microsoft Windows 10 Mobile with Lumia 950, 950 XL, 550, 635, and Windows 10 with Surface Pro 4](https://www.niap-ccevs.org/st/st_vid10677-st.pdf) + - [Windows 10 and Windows Server 2012 R2](http://www.commoncriteriaportal.org/files/epfiles/st_windows10.pdf) + - [Windows 10](https://www.niap-ccevs.org/st/st_vid10677-st.pdf) + - [Windows 8.1 with Surface 3 and Windows Phone 8.1 with Lumia 635 and Lumia 830](https://www.niap-ccevs.org/st/st_vid10635-st.pdf) + - [Microsoft Surface Pro 3 and Windows 8.1](https://www.niap-ccevs.org/st/st_vid10632-st.pdf) + - [Windows 8.1 and Windows Phone 8.1](https://www.niap-ccevs.org/st/st_vid10592-st.pdf) + - [Windows 8 and Windows Server 2012](https://www.niap-ccevs.org/st/st_vid10520-st.pdf) + - [Windows 8 and Windows RT](https://www.niap-ccevs.org/st/st_vid10620-st.pdf) + - [Windows 8 and Windows Server 2012 BitLocker](http://www.commoncriteriaportal.org/files/epfiles/st_vid10540-st.pdf) + - [Windows 8, Windows RT, and Windows Server 2012 IPsec VPN Client](http://www.commoncriteriaportal.org/files/epfiles/st_vid10529-st.pdf) + - [Windows 7 and Windows Server 2008 R2](http://www.commoncriteriaportal.org/files/epfiles/st_vid10390-st.pdf) + - [Microsoft Windows Server 2008 R2 Hyper-V Role](http://www.microsoft.com/download/en/details.aspx?id=29305) + - [Windows Vista and Windows Server 2008 at EAL4+](http://www.commoncriteriaportal.org/files/epfiles/st_vid10291-st.pdf) + - [Microsoft Windows Server 2008 Hyper-V Role](http://www.commoncriteriaportal.org/files/epfiles/0570b_pdf.pdf) + - [Windows Vista and Windows Server 2008 at EAL1](http://www.commoncriteriaportal.org/files/epfiles/efs-t005_msvista_msserver2008_eal1_st_v1.0.pdf) + - [Windows Server 2003 SP2 including R2, x64, and IA64; Windows XP Professional SP2 and x64 SP2; and Windows XP Embedded SP2](http://www.commoncriteriaportal.org/files/epfiles/st_vid10184-st.pdf) + - [Windows Server 2003 Certificate Server](http://www.commoncriteriaportal.org/files/epfiles/st_vid9507-st.pdf) + - [Windows Rights Management Services (RMS) 1.0 SP2](http://www.commoncriteriaportal.org/files/epfiles/st_vid10224-st.pdf) + +## Common Criteria Deployment and Administration + +### Information for IT Administrators + +These documents describe how to configure Windows to replicate the configuration used during the Common Criteria evaluation. + +**Windows 10, Windows 10 Mobile, Windows Server 2016, Windows Server 2012 R2** + + - [Microsoft Window 10 (Creators Update)](http://download.microsoft.com/download/e/9/7/e97f0c7f-e741-4657-8f79-2c0a7ca928e3/windows%2010%20cu%20gp%20os%20operational%20guidance%20\(jan%208%202017%20-%20public\).pdf) + - [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](http://download.microsoft.com/download/d/c/4/dc40b5c8-49c2-4587-8a04-ab3b81eb6fc4/st_vid10823-agd.pdf) + - [Microsoft Windows 10 (Anniversary Update) and Windows 10 Mobile (Anniversary Update)](http://download.microsoft.com/download/4/c/1/4c1f4ea4-2d66-4232-a0f5-925b2bc763bc/windows%2010%20au%20operational%20guidance%20\(16%20mar%202017\)\(clean\).docx) + - [Microsoft Windows 10 (Anniversary Update) and Windows Server 2016](http://download.microsoft.com/download/b/5/2/b52e9081-05c6-4895-91a3-732bfa0eb4da/windows%2010%20au%20and%20server%202016%20gp%20os%20operational%20guidance%20\(final\).docx) + - [Windows 10 (Anniversary Update) and Windows Server 2016 IPsec VPN Client Operational Guidance](http://download.microsoft.com/download/2/c/c/2cc8f929-233e-4a40-b673-57b449680984/windows%2010%20au%20and%20server%202016%20ipsec%20vpn%20client%20operational%20guidance%20\(21%20dec%202016\)%20\(public\).docx) + - [Microsoft Windows 10 IPsec VPN Client](http://download.microsoft.com/download/3/3/f/33fa01dd-b380-46e1-833f-fd85854b4022/st_vid10746-agd.pdf) + - [Microsoft Windows 10 November 2015 Update with Surface Book Administrative Guide](http://download.microsoft.com/download/3/2/c/32c6fa02-b194-478f-a0f6-0215b47d0f40/windows%2010%20mdf3%20mobile%20device%20pp%20operational%20guidance%20\(may%2027,%202016\)\(public\).docx) + - [Microsoft Windows 10 Mobile and Windows 10 Administrative Guide](http://download.microsoft.com/download/2/d/c/2dce3435-9328-48e2-9813-c2559a8d39fa/microsoft%20windows%2010%20and%20windows%2010%20mobile%20guidance.pdf) + - [Windows 10 and Windows Server 2012 R2 Administrative Guide](http://download.microsoft.com/download/0/f/d/0fd33c9a-98ac-499e-882f-274f80f3d4f0/microsoft%20windows%2010%20and%20server%202012%20r2%20gp%20os%20guidance.pdf) + - [Windows 10 Common Criteria Operational Guidance](http://download.microsoft.com/download/d/6/f/d6fb4cec-f0f2-4d00-ab2e-63bde3713f44/windows%2010%20mobile%20device%20operational%20guidance.pdf) + +**Windows 8.1 and Windows Phone 8.1** + + - [Microsoft Surface Pro 3 Common Criteria Mobile Operational Guidance](http://download.microsoft.com/download/b/e/3/be365594-daa5-4af3-a6b5-9533d61eae32/surface%20pro%203%20mobile%20operational%20guidance.docx) + - [Windows 8.1 and Windows Phone 8.1 CC Supplemental Admin Guide](http://download.microsoft.com/download/b/0/e/b0e30225-5017-4241-ac0a-6c40bc8e6714/mobile%20operational%20guidance.docx) + +**Windows 8, Windows RT, and Windows Server 2012** + + - [Windows 8 and Windows Server 2012](http://download.microsoft.com/download/6/0/b/60b27ded-705a-4751-8e9f-642e635c3cf3/microsoft%20windows%208%20windows%20server%202012%20common%20criteria%20supplemental%20admin%20guidance.docx) + - [Windows 8 and Windows RT](http://download.microsoft.com/download/8/6/e/86e8c001-8556-4949-90cf-f5beac918026/microsoft%20windows%208%20microsoft%20windows%20rt%20common%20criteria%20supplemental%20admin.docx) + - [Windows 8 and Windows Server 2012 BitLocker](http://download.microsoft.com/download/0/8/4/08468080-540b-4326-91bf-f2a33b7e1764/administrative%20guidance%20for%20software%20full%20disk%20encryption%20clients.pdf) + - [Windows 8, Windows RT, and Windows Server 2012 IPsec VPN Client](http://download.microsoft.com/download/a/9/f/a9fd7e2d-023b-4925-a62f-58a7f1a6bd47/microsoft%20windows%208%20windows%20server%202012%20supplemental%20admin%20guidance%20ipsec%20vpn%20client.docx) + +**Windows 7 and Windows Server 2008 R2** + + - [Windows 7 and Windows Server 2008 R2 Supplemental CC Guide](https://www.microsoft.com/downloads/en/details.aspx?familyid=ee05b6d0-9939-4765-9217-63083bb94a00) + - [Windows Server 2008 R2 Hyper-V Common Criteria Configuration Guide](http://www.microsoft.com/download/en/details.aspx?id=29308) + +**Windows Vista and Windows Server 2008** + + - [Windows Vista and Windows Server 2008 Supplemental CC Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=06166288-24c4-4c42-9daa-2b2473ddf567) + - [Windows Server 2008 Hyper-V Role Common Criteria Administrator Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=cb19538d-9e13-4ab6-af38-8f48abfdad08) + +**Windows Server 2003 SP2 including R2, x64, and Itanium** + + - [Windows Server 2003 SP2 R2 Common Criteria Administrator Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=39598841-e693-4891-9234-cfd1550f3949) + - [Windows Server 2003 SP2 R2 Common Criteria Configuration Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=4f7b6a93-0307-480f-a5af-a20268cbd7cc) + +**Windows Server 2003 SP1(x86), x64, and IA64** + + - [Windows Server 2003 with x64 Hardware Administrator's Guide](http://www.microsoft.com/downloads/details.aspx?familyid=8a26829f-c177-4b79-913a-4135fb7b96ef) + - [Windows Server 2003 with x64 Hardware Configuration Guide](http://www.microsoft.com/downloads/details.aspx?familyid=3f9ecd0a-74dd-4d23-a4e5-d7b63fed70e8) + +**Windows Server 2003 SP1** + + - [Windows Server 2003 Administrator's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=75736009-59e9-4a71-879e-cf581817b8cc) + - [Windows Server 2003 Configuration Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=a0ad1856-beb7-4285-b47c-381e8a210c38) + +**Windows XP Professional SP2 (x86) and x64 Edition** + + - [Windows XP Common Criteria Administrator Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=9a7f0b16-72ce-4675-aec8-58785c4e37ee) + - [Windows XP Common Criteria Configuration Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=165da57d-f066-4ddf-9462-cbecfcd68694) + - [Windows XP Common Criteria User Guide 3.0](http://www.microsoft.com/downloads/details.aspx?familyid=7c1a4761-9b9e-429c-84eb-cd7b034c5779) + - [Windows XP Professional with x64 Hardware Administrator's Guide](http://www.microsoft.com/downloads/details.aspx?familyid=346f041e-d641-4af7-bdea-c5a3246d0431) + - [Windows XP Professional with x64 Hardware Configuration Guide](http://www.microsoft.com/downloads/details.aspx?familyid=a7075319-cc3d-4420-a00b-8c9a7068ad54) + - [Windows XP Professional with x64 Hardware User’s Guide](http://www.microsoft.com/downloads/details.aspx?familyid=26c49cf5-6159-4197-97ce-bf1fdfc54569) + +**Windows XP Professional SP2, and XP Embedded SP2** + + - [Windows XP Professional Administrator's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=9bcac470-a0b3-4d34-a561-fa8308c0ff60) + - [Windows XP Professional Configuration Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=9f04915e-571a-422d-8ffa-5797051e81de) + - [Windows XP Professional User's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=d39d0028-7093-495c-80da-2b5b29a54bd8) + +**Windows Server 2003 Certificate Server** + + - [Windows Server 2003 Certificate Server Administrator's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=445093d8-45e2-4cf6-884c-8802c1e6cb2d) + - [Windows Server 2003 Certificate Server Configuration Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=46abc8b5-11be-4e3d-85c2-63226c3688d2) + - [Windows Server 2003 Certificate Server User's Guide](http://www.microsoft.com/downloads/en/details.aspx?familyid=74f66d84-2654-48d0-b9b5-b383d383425e) + +## Common Criteria Evaluation Technical Reports and Certification / Validation Reports + +### Information for Systems Integrators and Accreditors + +An Evaluation Technical Report (ETR) is a report submitted to the Common Criteria certification authority for how Windows complies with the claims made in the Security Target. A Certification / Validation Report provides the results of the evaluation by the validation team. + + - [Microsoft Window 10 (Creators Update)](http://download.microsoft.com/download/3/2/c/32cdf627-dd23-4266-90ff-2f9685fd15c0/2017-49%20inf-2218%20cr.pdf) + - [Microsoft Windows Server 2016, Microsoft Windows Server 2012 R2, and Microsoft Windows 10 Hyper-V](http://download.microsoft.com/download/a/3/3/a336f881-4ac9-4c79-8202-95289f86bb7a/st_vid10823-vr.pdf) + - [Microsoft Windows 10 (Anniversary Update) and Windows 10 Mobile (Anniversary Update)](http://download.microsoft.com/download/f/2/f/f2f7176e-34f4-4ab0-993c-6606d207bb3c/st_vid10752-vr.pdf) + - [Microsoft Windows 10 (Anniversary Update) and Windows Server 2016](http://download.microsoft.com/download/5/4/8/548cc06e-c671-4502-bebf-20d38e49b731/2016-36-inf-1779.pdf) + - [Windows 10 (Anniversary Update) and Windows Server 2016 IPsec VPN Client](http://download.microsoft.com/download/2/0/a/20a8e686-3cd9-43c4-a22a-54b552a9788a/st_vid10753-vr.pdf) + - [Microsoft Windows 10 IPsec VPN Client](http://download.microsoft.com/download/9/b/6/9b633763-6078-48aa-b9ba-960da2172a11/st_vid10746-vr.pdf) + - [Microsoft Windows 10 November 2015 Update with Surface Book](http://download.microsoft.com/download/d/c/b/dcb7097d-1b9f-4786-bb07-3c169fefb579/st_vid10715-vr.pdf) + - [Microsoft Windows 10 Mobile with Lumia 950, 950 XL, 550, 635, and Windows 10 with Surface Pro 4](https://www.niap-ccevs.org/st/st_vid10694-vr.pdf) + - [Windows 10 and Windows Server 2012 R2](https://www.commoncriteriaportal.org/files/epfiles/cr_windows10.pdf) + - [Windows 10](https://www.niap-ccevs.org/st/st_vid10677-vr.pdf) + - [Windows 8.1 with Surface 3 and Windows Phone 8.1 with Lumia 635 and Lumia 830](https://www.niap-ccevs.org/st/st_vid10635-vr.pdf) + - [Microsoft Surface Pro 3 and Windows 8.1](https://www.niap-ccevs.org/st/st_vid10632-vr.pdf) + - [Windows 8.1 and Windows Phone 8.1](https://www.niap-ccevs.org/st/st_vid10592-vr.pdf) + - [Windows 8 and Windows Server 2012](https://www.niap-ccevs.org/st/st_vid10520-vr.pdf) + - [Windows 8 and Windows RT](https://www.niap-ccevs.org/st/st_vid10620-vr.pdf) + - [Windows 8 and Windows Server 2012 BitLocker](http://www.commoncriteriaportal.org/files/epfiles/st_vid10540-vr.pdf) + - [Windows 8, Windows RT, and Windows Server 2012 IPsec VPN Client](http://www.commoncriteriaportal.org/files/epfiles/st_vid10529-vr.pdf) + - [Windows 7 and Windows Server 2008 R2 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/st_vid10390-vr.pdf) + - [Windows Vista and Windows Server 2008 Validation Report at EAL4+](http://www.commoncriteriaportal.org/files/epfiles/st_vid10291-vr.pdf) + - [Windows Server 2008 Hyper-V Role Certification Report](http://www.commoncriteriaportal.org/files/epfiles/0570a_pdf.pdf) + - [Windows Vista and Windows Server 2008 Certification Report at EAL1](http://www.commoncriteriaportal.org/files/epfiles/efs-t005_msvista_msserver2008_eal1_cr_v1.0.pdf) + - [Windows XP / Windows Server 2003 with x64 Hardware ETR](http://www.microsoft.com/downloads/details.aspx?familyid=6e8d98f9-25b9-4c85-9bd9-24d91ea3c9ef) + - [Windows XP / Windows Server 2003 with x64 Hardware ETR, Part II](http://www.microsoft.com/downloads/details.aspx?familyid=0c35e7d8-9c56-4686-b902-d5ffb9915658) + - [Windows Server 2003 SP2 including R2, Standard, Enterprise, Datacenter, x64, and Itanium Editions Validation Report](http://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf) + - [Windows XP Professional SP2 and x64 SP2 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf) + - [Windows XP Embedded SP2 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/20080303_st_vid10184-vr.pdf) + - [Windows XP and Windows Server 2003 ETR](http://www.microsoft.com/downloads/details.aspx?familyid=63cf2a1e-f578-4bb5-9245-d411f0f64265) + - [Windows XP and Windows Server 2003 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/st_vid9506-vr.pdf) + - [Windows Server 2003 Certificate Server ETR](http://www.microsoft.com/downloads/details.aspx?familyid=a594e77f-dcbb-4787-9d68-e4689e60a314) + - [Windows Server 2003 Certificate Server Validation Report](http://www.commoncriteriaportal.org/files/epfiles/st_vid9507-vr.pdf) + - [Microsoft Windows Rights Management Services (RMS) 1.0 SP2 Validation Report](http://www.commoncriteriaportal.org/files/epfiles/st_vid10224-vr.pdf) + +## Other Common Criteria Related Documents + + - [Identifying Windows XP and Windows Server 2003 Common Criteria Certified Requirements for the NIST Special Publication 800-53](http://download.microsoft.com/download/a/9/6/a96d1dfc-2bd4-408d-8d93-e0ede7529691/xpws03_ccto800-53.doc) + From 4cc084e5ca5d9af37708581104420a6f6d245649 Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Thu, 25 Oct 2018 20:00:35 +0000 Subject: [PATCH 3/7] Initialize open publishing repository: https://cpubwin.visualstudio.com/DefaultCollection/it-client/_git/it-client of branch live --- .openpublishing.publish.config.json | 16 ++++++++++ windows/eulas/docfx.json | 47 +++++++++++++++++++++++++++++ 2 files changed, 63 insertions(+) create mode 100644 windows/eulas/docfx.json diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index d9934af08a..224abb8ddd 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -34,6 +34,22 @@ "moniker_groups": [], "version": 0 }, + { + "docset_name": "eula-vsts", + "build_source_folder": "windows/eulas", + "build_output_subfolder": "eula-vsts", + "locale": "en-us", + "monikers": [], + "moniker_ranges": [], + "open_to_public_contributors": false, + "type_mapping": { + "Conceptual": "Content", + "ManagedReference": "Content", + "RestApi": "Content" + }, + "build_entry_point": "docs", + "template_folder": "_themes" + }, { "docset_name": "gdpr", "build_source_folder": "gdpr", diff --git a/windows/eulas/docfx.json b/windows/eulas/docfx.json new file mode 100644 index 0000000000..ff3ab96c92 --- /dev/null +++ b/windows/eulas/docfx.json @@ -0,0 +1,47 @@ +{ + "build": { + "content": [ + { + "files": [ + "**/*.md", + "**/*.yml" + ], + "exclude": [ + "**/obj/**", + "**/includes/**", + "_themes/**", + "_themes.pdf/**", + "README.md", + "LICENSE", + "LICENSE-CODE", + "ThirdPartyNotices" + ] + } + ], + "resource": [ + { + "files": [ + "**/*.png", + "**/*.jpg" + ], + "exclude": [ + "**/obj/**", + "**/includes/**", + "_themes/**", + "_themes.pdf/**" + ] + } + ], + "overwrite": [], + "externalReference": [], + "globalMetadata": { + "breadcrumb_path": "/windows/eulas/breadcrumb/toc.json", + "extendBreadcrumb": true, + "feedback_system": "None" + }, + "fileMetadata": {}, + "template": [], + "dest": "eula-vsts", + "markdownEngineName": "markdig" + } +} \ No newline at end of file From 2e17ac9c1505777ca66362f1929813299424f4e7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dani=20Halfin=20=F0=9F=93=AC=F0=9F=94=A8?= Date: Thu, 8 Nov 2018 00:26:43 +0000 Subject: [PATCH 4/7] Merged PR 12678: push to live --- windows/deployment/windows-autopilot/TOC.md | 2 + .../windows-autopilot/user-driven-aad.md | 54 ++++--- .../windows-autopilot/user-driven-hybrid.md | 25 ++- .../windows-autopilot/user-driven.md | 23 +-- ...system-components-to-microsoft-services.md | 143 ++++++++++++++---- windows/privacy/manage-windows-endpoints.md | 8 +- windows/security/threat-protection/index.md | 4 +- ...ows-defender-advanced-threat-protection.md | 6 +- 8 files changed, 188 insertions(+), 77 deletions(-) diff --git a/windows/deployment/windows-autopilot/TOC.md b/windows/deployment/windows-autopilot/TOC.md index 315115e706..19d3896e66 100644 --- a/windows/deployment/windows-autopilot/TOC.md +++ b/windows/deployment/windows-autopilot/TOC.md @@ -6,6 +6,8 @@ ## [Scenarios and Capabilities](windows-autopilot-scenarios.md) ### [Support for existing devices](existing-devices.md) ### [User-driven mode](user-driven.md) +#### [User-driven mode for AAD](user-driven-aad.md) +#### [User-driven mode for hybrid AAD](user-driven-hybrid.md) ### [Self-deploying mode](self-deploying.md) ### [Enrollment status page](enrollment-status.md) ### [Windows Autopilot Reset](windows-autopilot-reset.md) diff --git a/windows/deployment/windows-autopilot/user-driven-aad.md b/windows/deployment/windows-autopilot/user-driven-aad.md index 6da9e99b33..b63517060d 100644 --- a/windows/deployment/windows-autopilot/user-driven-aad.md +++ b/windows/deployment/windows-autopilot/user-driven-aad.md @@ -1,19 +1,35 @@ ---- -title: User-driven mode for AAD -description: Listing of Autopilot scenarios -keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: low -ms.sitesec: library -ms.pagetype: deploy -author: greg-lindsay -ms.author: greg-lindsay -ms.date: 10/02/2018 ---- - -# Windows Autopilot user-driven mode for Azure Active Directory - -**Applies to: Windows 10** - -PLACEHOLDER. This topic is a placeholder for the AAD-specific instuctions currently in user-driven.md. +--- +title: User-driven mode for AAD +description: Listing of Autopilot scenarios +keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: low +ms.sitesec: library +ms.pagetype: deploy +author: greg-lindsay +ms.author: greg-lindsay +ms.date: 11/07/2018 +--- + +# Windows Autopilot user-driven mode for Azure Active Directory join + +**Applies to: Windows 10** + +## Procedures + +In order to perform a user-driven deployment using Windows Autopilot, the following preparation steps need to be completed: + +- Ensure that the users who will be performing user-driven mode deployments are able to join devices to Azure Active Directory. See [Configure device settings](https://docs.microsoft.com/azure/active-directory/device-management-azure-portal#configure-device-settings) in the Azure Active Directory documentation for more information. +- Create an Autopilot profile for user-driven mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. With Microsoft Store for Business and Partner Center, user-driven mode is the default and does not need to be selected. +- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. + +For each device that will be deployed using user-driven deployment, these additional steps are needed: + +- Ensure that the device has been added to Windows Autopilot. This can be done automatically by an OEM or partner at the time the device is purchased, or it can be done through a manual harvesting process later. See [Adding devices to Windows Autopilot](add-devices.md) for more information. +- Ensure an Autopilot profile has been assigned to the device: + - If using Intune and Azure Active Directory dynamic device groups, this can be done automatically. + - If using Intune and Azure Active Directory static device groups, manually add the device to the device group. + - If using other methods (e.g. Microsoft Store for Business or Partner Center), manually assign an Autopilot profile to the device. + +Also see the **Validation** section in the [Windows Autopilot user-driven mode](user-driven.md) topic. diff --git a/windows/deployment/windows-autopilot/user-driven-hybrid.md b/windows/deployment/windows-autopilot/user-driven-hybrid.md index 6f4a760dcc..88e4a87f15 100644 --- a/windows/deployment/windows-autopilot/user-driven-hybrid.md +++ b/windows/deployment/windows-autopilot/user-driven-hybrid.md @@ -9,12 +9,31 @@ ms.sitesec: library ms.pagetype: deploy author: greg-lindsay ms.author: greg-lindsay -ms.date: 10/02/2018 +ms.date: 11/07/2018 --- -# Windows Autopilot user-driven mode for Hybrid Azure Active Directory Join +# Windows Autopilot user-driven mode for hybrid Azure Active Directory join **Applies to: Windows 10** -PLACEHOLDER. This topic is a placeholder for the AD-specific (hybrid) instuctions. +Windows Autopilot requires that devices be Azure Active Directory joined. If you have an on-premises Active Directory environment and want to also join devices to your on-premises domain, you can accomplish this by configuring Autopilot devices to be [hybrid Azure Active Directory (AAD) joined](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan). + +## Requirements + +To perform a user-driven hybrid AAD joined deployment using Windows Autopilot: + +- Users must be able to join devices to Azure Active Directory. +- A Windows Autopilot profile for user-driven mode must be created and + - **Hybrid Azure AD joined** must be specified as the selected option under **Join to Azure AD as** in the Autopilot profile. +- If using Intune, a device group in Azure Active Directory must exist with the Windows Autopilot profile assigned to that group. +- The device must be running Windows 10, version 1809 or later. +- The device must be connected to the Internet and have access to an Active Directory domain controller. +- The Intune Connector for Active Directory must be installed. + - Note: The Intune Connector will perform an on-prem AD join, therefore users do not need on-prem AD-join permission, assuming the Connector is [configured to perform this action](https://docs.microsoft.com/intune/windows-autopilot-hybrid#increase-the-computer-account-limit-in-the-organizational-unit) on the user's behalf. + +## Step by step instructions + +See [Deploy hybrid Azure AD joined devices using Intune and Windows Autopilot](https://docs.microsoft.com/intune/windows-autopilot-hybrid). + +Also see the **Validation** section in the [Windows Autopilot user-driven mode](user-driven.md) topic. \ No newline at end of file diff --git a/windows/deployment/windows-autopilot/user-driven.md b/windows/deployment/windows-autopilot/user-driven.md index 1aa1ad5321..4fd86ef3b5 100644 --- a/windows/deployment/windows-autopilot/user-driven.md +++ b/windows/deployment/windows-autopilot/user-driven.md @@ -8,11 +8,13 @@ ms.localizationpriority: medium ms.sitesec: library ms.pagetype: deploy author: greg-lindsay -ms.date: 10/02/2018 +ms.date: 11/07/2018 ms.author: greg-lindsay -ms.date: 10/02/2018 +ms.date: 11/07/2018 --- +# Windows Autopilot user-driven mode + Windows Autopilot user-driven mode is designed to enable new Windows 10 devices to be transformed from their initial state, directly from the factory, into a ready-to-use state without requiring that IT personnel ever touch the device. The process is designed to be simple so that anyone can complete it, enabling devices to be shipped or distributed to the end user directly with simple instructions: - Unbox the device, plug it in, and turn it on. @@ -24,21 +26,12 @@ After completing those simple steps, the remainder of the process is completely Today, Windows Autopilot user-driven mode supports joining devices to Azure Active Directory. Support for Hybrid Azure Active Directory Join (with devices joined to an on-premises Active Directory domain) will be available in a future Windows 10 release. See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options. -## Step by step +## Available user-driven modes -In order to perform a user-driven deployment using Windows Autopilot, the following preparation steps need to be completed: +The following options are available for user-driven deployment: -- Ensure that the users who will be performing user-driven mode deployments are able to join devices to Azure Active Directory. See [Configure device settings](https://docs.microsoft.com/azure/active-directory/device-management-azure-portal#configure-device-settings) in the Azure Active Directory documentation for more information. -- Create an Autopilot profile for user-driven mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. With Microsoft Store for Business and Partner Center, user-driven mode is the default and does not need to be selected. -- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. - -For each machine that will be deployed using user-driven deployment, these additional steps are needed: - -- Ensure that the device has been added to Windows Autopilot. This can be done automatically by an OEM or partner at the time the device is purchased, or it can be done through a manual harvesting process later. See [Adding devices to Windows Autopilot](add-devices.md) for more information. -- Ensure an Autopilot profile has been assigned to the device: - - If using Intune and Azure Active Directory dynamic device groups, this can be done automatically. - - If using Intune and Azure Active Directory static device groups, manually add the device to the device group. - - If using other methods (e.g. Microsoft Store for Business or Partner Center), manually assign an Autopilot profile to the device. +- [Azure Active Directory join](user-driven-aad.md) is available if devices do not need to be joined to an on-prem Active Directory domain. +- [Hybrid Azure Active Directory join](user-driven-hybrid.md) is available for devices that must be joined to both Azure Active Directory and your on-prem Active Directory domain. ## Validation diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 865d98939f..3ac0a072a3 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -18,6 +18,7 @@ ms.date: 06/05/2018 - Windows 10 Enterprise, version 1607 and newer - Windows Server 2016 +- Windows Server 2019 If you're looking for content on what each diagnostic data level means and how to configure it in your organization, see [Configure Windows diagnostic data in your organization](configure-windows-diagnostic-data-in-your-organization.md). @@ -43,6 +44,12 @@ Note that **Get Help** and **Give us Feedback** links no longer work after the W We are always striving to improve our documentation and welcome your feedback. You can provide feedback by contacting telmhelp@microsoft.com. +## What's new in Windows 10, version 1809 Enterprise edition + +Here's a list of changes that were made to this article for Windows 10, version 1809: + +- Added a policy to disable Windows Defender SmartScreen + ## What's new in Windows 10, version 1803 Enterprise edition Here's a list of changes that were made to this article for Windows 10, version 1803: @@ -99,19 +106,19 @@ The following table lists management options for each setting, beginning with Wi | Setting | UI | Group Policy | MDM policy | Registry | Command line | | - | :-: | :-: | :-: | :-: | :-: | -| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | | | | +| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | -| [5. Find My Device](#find-my-device) | | ![Check mark](images/checkmark.png) | | | | -| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [9. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [10. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [11. Microsoft Account](#bkmk-microsoft-account) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [12. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | -| [13. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [13. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [14. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [15. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [16. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | @@ -142,6 +149,7 @@ The following table lists management options for each setting, beginning with Wi | [21. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [22. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | | [23. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [23.1 Windows Defender Smartscreen](#bkmk-defender-smartscreen) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [24. Windows Media Player](#bkmk-wmp) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | | [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | @@ -202,6 +210,63 @@ See the following table for a summary of the management settings for Windows Ser | [21. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | | [28. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | | +### Settings for Windows Server 2019 + +See the following table for a summary of the management settings for Windows Server 2019. + +| Setting | UI | Group Policy | MDM policy | Registry | Command line | +| - | :-: | :-: | :-: | :-: | :-: | +| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [2. Cortana and Search](#bkmk-cortana) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [8. Internet Explorer](#bkmk-ie) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [9. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [10. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [11. Microsoft Account](#bkmk-microsoft-account) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [12. Microsoft Edge](#bkmk-edge) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [13. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [14. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [15. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [16. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | +| [17. Settings > Privacy](#bkmk-settingssection) | | | | | | +|     [17.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| ![Check mark](images/checkmark.png) | | +|     [17.6 Speech, inking, & typing](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | +|     [17.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [17.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [18. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [19. Storage Health](#bkmk-storage-health) | | ![Check mark](images/checkmark.png) | | | | +| [20. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [21. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [22. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +| [23. Windows Defender](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +|     [23.1 Windows Defender Smartscreen](#bkmk-defender-smartscreen) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [24. Windows Media Player](#bkmk-wmp) | ![Check mark](images/checkmark.png) | | | | ![Check mark](images/checkmark.png) | +| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | +|     [26.1 Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | | | +| [27. Windows Update Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | +| [28. Windows Update](#bkmk-wu) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | | + ## How to configure each setting Use the following sections for more information about how to configure each setting. @@ -336,9 +401,17 @@ After that, configure the following: ### 4. Device metadata retrieval -To prevent Windows from retrieving device metadata from the Internet, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**. +To prevent Windows from retrieving device metadata from the Internet: -You can also create a new REG\_DWORD registry setting named **PreventDeviceMetadataFromNetwork** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata** and set it to 1 (one). +- Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Device Installation** > **Prevent device metadata retrieval from the Internet**. + + -or - + +- Create a new REG\_DWORD registry setting named **PreventDeviceMetadataFromNetwork** in **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Device Metadata** and set it to 1 (one). + + -or - + +- Apply the DeviceInstallation/PreventDeviceMetadataFromNetwork MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deviceinstallation#deviceinstallation-preventdevicemetadatafromnetwork). ### 5. Find My Device @@ -608,7 +681,7 @@ You can turn off NCSI by doing one of the following: - Enable the Group Policy: **Computer Configuration** > **Administrative Templates** > **System** > **Internet Communication Management** > **Internet Communication Settings** > **Turn off Windows Network Connectivity Status Indicator active tests** -- In Windows 10, version 1703 and later, apply the Connectivity/DisallowNetworkConnectivityActiveTests MDM policy. +- In Windows 10, version 1703 and later, apply the Connectivity/DisallowNetworkConnectivityActiveTests MDM policy from the [Policy CSP](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-connectivity#connectivity-disallownetworkconnectivityactivetests) with a value of 1. > [!NOTE] > After you apply this policy, you must restart the device for the policy setting to take effect. @@ -879,31 +952,13 @@ To turn off **Turn on SmartScreen Filter to check web content (URLs) that Micros -or- -- In Windows Server 2016, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Configure SmartScreen Filter**. - In Windows 10, version 1703, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **Microsoft Edge** > **Configure Windows Defender SmartScreen Filter**. - - In Windows Server 2016, apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows SmartScreen**. - In Windows 10, version 1703 , apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **File Explorer** > **Configure Windows Defender SmartScreen**. - - -or- - -- Apply the Browser/AllowSmartScreen MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on. - - -or- - - Create a provisioning package, using: - - - For Internet Explorer: **Runtime settings** > **Policies** > **Browser** > **AllowSmartScreen** - - - For Microsoft Edge: **Runtime settings** > **Policies** > **MicrosoftEdge** > **AllowSmartScreen** + - For Internet Explorer: **Runtime settings > Policies > Browser > AllowSmartScreen** + - For Microsoft Edge: **Runtime settings > Policies > MicrosoftEdge > AllowSmartScreen** -or- -- Create a REG\_DWORD registry setting named **EnableWebContentEvaluation** in **HKEY\_CURRENT\_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppHost** with a value of 0 (zero). - - -or- - -- Create a REG\_DWORD registry setting named **EnableSmartScreen** in **HKEY\_LOCAL\_MACHINE\\Sofware\\Policies\\Microsoft\\Windows\\System** with a value of 0 (zero). +- Create a REG_DWORD registry setting named **EnableWebContentEvaluation** in **HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\AppHost** with a value of 0 (zero). To turn off **Send Microsoft info about how I write to help us improve typing and writing in the future**: @@ -1793,6 +1848,36 @@ For Windows 10 only, you can stop Enhanced Notifications: You can also use the registry to turn off Malicious Software Reporting Tool diagnostic data by setting the REG\_DWORD value **HKEY\_LOCAL\_MACHINE\\Software\\Policies\\Microsoft\\MRT\\DontReportInfectionInformation** to 1. +### 23.1 Windows Defender SmartScreen + +To disable Windows Defender Smartscreen: + +- In Group Policy, configure - **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure Windows Defender SmartScreen** : **Disable** + + -or- + +- **Computer Configuration > Administrative Templates > Windows Components > File Explorer > Configure Windows Defender SmartScreen** : **Disable** + + -and- + +- **Computer Configuration > Administrative Templates > Windows Components > Windows Defender SmartScreen > Explorer > Configure app install control** : **Enable** + + -or- + +- Create a REG_DWORD registry setting named **EnableSmartScreen** in **HKEY_LOCAL_MACHINE\Sofware\Policies\Microsoft\Windows\System** with a value of 0 (zero). + + -and- + +- Create a REG_DWORD registry setting named **ConfigureAppInstallControlEnabled** in **HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen** with a value of 1. + + -and- + +- Create a SZ registry setting named **ConfigureAppInstallControl** in **HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SmartScreen** with a value of **Anywhere**. + + -or- + +- Apply the Browser/AllowSmartScreen MDM policy from the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) where 0 is turned off and 1 is turned on. + ### 24. Windows Media Player To remove Windows Media Player on Windows 10: diff --git a/windows/privacy/manage-windows-endpoints.md b/windows/privacy/manage-windows-endpoints.md index 721814aabe..c324f877dd 100644 --- a/windows/privacy/manage-windows-endpoints.md +++ b/windows/privacy/manage-windows-endpoints.md @@ -145,13 +145,9 @@ If you [turn off traffic for this endpoint](manage-connections-from-windows-oper ## Certificates -The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. +The following endpoint is used by the Automatic Root Certificates Update component to automatically check the list of trusted authorities on Windows Update to see if an update is available. It is possible to [turn off traffic to this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#automatic-root-certificates-update), but that is not recommended because when root certificates are updated over time, applications and websites may stop working because they did not receive an updated root certificate the application uses. -| Source process | Protocol | Destination | Applies from Windows 10 version | -|----------------|----------|------------|----------------------------------| -| svchost | HTTP | ctldl.windowsupdate.com | 1709 | - -The following endpoints are used to download certificates that are publicly known to be fraudulent. +Additionally, it is used to download certificates that are publicly known to be fraudulent. These settings are critical for both Windows security and the overall security of the Internet. We do not recommend blocking this endpoint. If traffic to this endpoint is turned off, Windows no longer automatically downloads certificates known to be fraudulent, which increases the attack vector on the device. diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index a83dc7afac..028116204e 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -63,8 +63,8 @@ To further reinforce the security perimeter of your network, Windows Defender AT -**[Endpoint protection and response](windows-defender-atp/overview-endpoint-detection-response.md)**
-Endpoint protection and response capabilities are put in place to detect, investigate, and respond to advanced threats that may have made it past the first two security pillars. +**[Endpoint detection and response](windows-defender-atp/overview-endpoint-detection-response.md)**
+Endpoint detection and response capabilities are put in place to detect, investigate, and respond to advanced threats that may have made it past the first two security pillars. - [Alerts](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) - [Historical endpoint data](windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) diff --git a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md index abe99e8194..6d9b834f75 100644 --- a/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection.md @@ -11,7 +11,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: medium -ms.date: 10/26/2018 +ms.date: 11/07/2018 --- # Windows Defender Advanced Threat Protection @@ -76,8 +76,8 @@ To further reinforce the security perimeter of your network, Windows Defender AT -**[Endpoint protection and response](overview-endpoint-detection-response.md)**
-Endpoint protection and response capabilities are put in place to detect, investigate, and respond to advanced threats that may have made it past the first two security pillars. +**[Endpoint detection and response](overview-endpoint-detection-response.md)**
+Endpoint detection and response capabilities are put in place to detect, investigate, and respond to advanced threats that may have made it past the first two security pillars. From ec1d8ca0e63ed5c664710a2d839da635ee294d79 Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Sat, 10 Nov 2018 00:06:25 +0000 Subject: [PATCH 5/7] Merged PR 12741: WaaS servicing white paper from marcom --- windows/deployment/TOC.md | 1 + .../update/images/servicing-cadence.png | Bin 0 -> 54411 bytes .../update/images/servicing-previews.png | Bin 0 -> 78290 bytes .../update/waas-servicing-differences.md | 106 ++++++++++++++++++ 4 files changed, 107 insertions(+) create mode 100644 windows/deployment/update/images/servicing-cadence.png create mode 100644 windows/deployment/update/images/servicing-previews.png create mode 100644 windows/deployment/update/waas-servicing-differences.md diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md index aa375d690f..00acdc9318 100644 --- a/windows/deployment/TOC.md +++ b/windows/deployment/TOC.md @@ -215,6 +215,7 @@ ### [Quick guide to Windows as a service](update/waas-quick-start.md) #### [Servicing stack updates](update/servicing-stack-updates.md) ### [Overview of Windows as a service](update/waas-overview.md) +### [Understand how servicing differs in Windows 10](update/waas-servicing-differences.md) ### [Prepare servicing strategy for Windows 10 updates](update/waas-servicing-strategy-windows-10-updates.md) ### [Build deployment rings for Windows 10 updates](update/waas-deployment-rings-windows-10-updates.md) ### [Assign devices to servicing channels for Windows 10 updates](update/waas-servicing-channels-windows-10-updates.md) diff --git a/windows/deployment/update/images/servicing-cadence.png b/windows/deployment/update/images/servicing-cadence.png new file mode 100644 index 0000000000000000000000000000000000000000..cb79ff70be87615b9d11ac3e3b2b69c9f5209705 GIT binary patch literal 54411 zcmX6^1yEdFvs~QaBe+9w3GNO-LV~+nkl^m_?gY1>3GVLhF2UVpaff|3|D%f9T8eAu z&gq%y?uk&8mqtS-L@?@0Dvw46X7lCXcjP;vWLrXbKfxr~IEs=NN#TbPEb%qn+mj>vww z)8ezwA>IbqCzq8W-`IVeANb)okszU_`~U}s-Jj(&$#;lKaYIW-aKnvQY#PE@H+(^t1mx(%;7lbhw& zOG-YX*aK)xX{R8J9~#zbZ_TFhj}~PN_I|E=Y#)fK-|gjlTLOVYE-Qt2B3U}f?Ygc@ zk?AolR$;X&zUYXlVazVi$ju5O8fC-ErbXAYcAEE^xbJ-*eEt}gZVg^RYn)xV7~hG# zEkAhKc^<1O#n_-q*d~B1$Fs40c?35cck`Ui z(!wIr(ZD0q!lC%k2VUyz;qg<+qT^DK5>gmTy-vDqcW^=>vO2-Y;LJAi>c={NZ1}=a zj#fx!5MURebWL6$EL28aS6ElrNVI8Hd++mZ-oI^s`)1r5Ji?0fZ(-r-VccW{yf)Oh zbQ(gU|t$8UWoOlXb@^Pj_eWFd*;@j4SJX8stConsLNVKns_XP%l=yF zNyzBaH7s9&U9D@zb8Qsx?kOpv!Rf3|$WTLmIR|Z@z+bJrX6tn93K!1W)Dqn*K{*#E z*%|vXqss{&a=V2Mh~;ng{_EYz`#hRT?sfSQ^db8Sv#yo$5@%1Rmt)wig9qiZqwvPR z&f-Td6mX$BCZ!h7RCte{_RN0ZiNws~hQKrRJ*w*@;L3d;|99p3+ub__Ebq8;J)0=% zuGvfFW%nyd9OA|9x8*UcpTOR^H0`n6eS-rX7GrJVSsxNe2)B#okekQr%|qvTsVi-#J1J@D!Uto$Bt^du`Te)K`c;73yo;bXQ zxi@85F1$p+>CVaNDaqz4Ri6lU7grl^yOQr=e88V+O)$d ztZ+c@NKYY8j;j`o;Gi+SKJN{I2l|fmyI)cq`} zMc9@~ZiXsE`{mT!q;ig)8KfIS}zM#+*+Aenp=QzV6&K^()vO^?MRUdcdp z!RBrL9yESuzJu2Lm=iICV(@dRNsA+D)egzBF^fery<8ig5l+S)Yam2LTrzq^2#HQE znO+YOWMybn4m>QwmG^s0(?Z4$`h0LF|5XAjihso6zx|LylRG~zN7BeCcM~CvL!@x* zyH>hq7W5!jRUj`IM~g3rL1!v5c_-bXfQogw-$ z-8~wBfSr5jm{*yiHKTg-pUyd6#c{kTFLUZRobSB0F2uv6wq!TE9RzC|Ad`2IlfGt` zCVwp?TS2 zBRC|T(89(ex%vJoEXaAfLWM!FL^-}cwC=xp4}4-%p8u`46qP$lSeiNE({SFw8kZa4 z^>1}97^KG9+OI3eSjqy?O;{q6#8h5jk!j$ONeCqpSFo?HARuMU>~MOhpglH_5Zor#T4r;e#4t zFKT!h#jl+rJ;w&b=f^|2U8^y$H2!y-c4@|VT+v} zb^qgNp7T)@@d*meSgh<~Ix;VxG8qrK5=vsj+Ijqs`cVvnyK!~HjGNkk z;Z<0SEqnFG_G@@}HpSQ$a~ft&0O7ZX>lfcT@3D|TPC2K~UJ$)k{8J7B4&c%zXGKHL z=#~ykcRRUFrj8_qCIp;BnQmhCpO*?>GTgEQ5KOSsH}ROR(Qqqe)xjNF*HY_iZ%aA8 z2Ui>frvFZmy!ZY5!2O}Jder_=e;F*mshF_aJSX?p(IXWu(#$vd7Dze(xTwp*z}`J7 zHC^p4sovGR?Ek*G_mvB%5l&LV0@hsWv-{VIUlY%o+GI{2?OcTTqpfNB+xkd~CZhfmBqAQQChWUsv-^O$+Wgg8 zQRaxM^v1do)EzkCQ9yj~;WM10on!S6<9K`Z!hS!6djK)^@78s7jCxH9gMrta@H2X? z@mwP+g@!I~g~lmt%JbaY%id&ItYYE7-^}1={=1nCf3okZg&t5oq+=!$fHjDEY4VbA z6ZGC7)M!n>6I(4NC?Kd#LgZIZTr%7li~(#V??M?{)1%GCef}TV;LAhEbh8+f)RNaRX?i&zOd$wS;b0y!&<%N3X$lEq{+_yZt0zZ?WQ|4OBR; zl(x8Gf#U2#*A?QMH_OnxBAYg{Z{7lccn!|AGd?tZOh8UYtxI0K%kt4ig5VH?7QnaY z1T`Sa*`_+mUm;q<$4~UvT+U zEN6aW+N$o^)G!B~ODcS;prfW1hjmN@I{B3_WHcrlCjI0Y#9aiBndzH zu%%cQ0ysIP-S5xGF0_N*gSsai7oYX9oh;lmIF-I(rK>Hkwt|O{+U=85h7*sKvksmO z^{Kd@vw?#|SJu9!cn@?5OD9s(f(}M7AsYH>ZZ4~n!he2mJy%*~c%@jUsC*9$fZmt% z5?1s!&r!!!C$QjVH)41Gx8eUv=*=g1raP|(jpX&GZw|uf+B6^7&C3m!p%>hp)s0eT z;v~CmzxTc<@Ed@*;k0OS7{diqypE{}j{TCBIT^*-H$>hBR|%_K%$wwNR*>opH!GAS z0zp7F>2*Q>oBAd`6E4EiIWJ8-p#>ytSE_UdC^s^^{U@6%b7!TYn~Mm`tHX(=g*@}W zWM5DbS7%->ifSEp{|LUuwV_qeBrRNNYR5?zdh|EClUIHYc!ovJk3G~b?@-Sy_%-4E zXiM;0PiG|nTEK~D57nL1~hm%$%G`kwAE zn1HKfydW(5BRtz=JukiWS+Q7+V^&R;uK79U+mM=C@s3}OE#~^sw-C*{6G+p^ogd`t z{!e+2CHQVL^R7x{uF_%sZfXy0_|R^#7-D7Pd0ix~i)qHw_w;_4dyHV4x-&Jr+XAV3 zKJO=|K!ow-BlfY;qVkzXn@xK8RxnKaxg=TW*JGOzKa#qQS;lk~mR=o-EEV>k*<4iD6P1hDs0Fq-jq+#m zk4Nq7yDveWpYHtL?hkT)qu)y$QJjmYm*}}y4(%qcse3bZ{!nHuV=w?AquU@;cfNm_ zL^1t7753R<8g_YFIH~F%(!;Z?AGl#~oODY$pDc2+%b_M+dKu>FM_#{DUmtb;sw#3p{!w&rr7A~k9`_6 zWuo;(4TCK+{l8cgdX1#qW)fdP%MbqA0EZ7#S*?7^sieDn1wnDT;eS(a)u~eiKI&`tCc~%W;b*#}9g|i&d zQ$o2pvX0|FulQBTm3Vg@N28;Y8T%hLIoA=poodT%4vq*PydVYi03X)Aa{`4EL#YuA=_UfGo&x$y0lW|hn5rsnZlCLj2BZ} z$WgUS@e;%iE9Wj*OKpp>I^%r7n=kMvM$GjtT4SfJhj%yNUHQ}Q2m9o9U$|b}Oz3MM%V9AvfmTRFqFeXfTIvLFeOC5WM^^NkMBMhJ8Dn#wb>#mmkZh-|E ziw1|Gnw;(ZH+$>5QQY}jTH5$CyKTxO@825`Evj7bes+LcC&VB`Aj~R>!0!x)t6~3- z))8Y3X$AgnmfjIS8A!x1-8@mWP~&D}8Kj2aCaVjy2y*vSFNDPi1Xp!Y?>+z#Y$o-^ z-pbn_K(7zF9#nr2oG2%EF_1RFol389Toy@z!|9(zsOU2Vm=Vor9L)zxcLyP;L83}kq zLrwpdu@+OWk{s2o)9#(jse^(YRjzv~1EzjjiQHju9L zO;JXiuVkh^x4v4`JWGj4NnQUSMVMCZT>a>DKLVNV=sjwH03M3<$H`CeX%B;gPA`Pb z=YVE(ecqb!b0g9?Cbr)GTV~oZ3mYgb1{yO>t$Le(liWKE zku{jN4m{XqhY~$KQKG+{*Fmh~yVc8VxVJyX)U|IkKS+(p+KPZ;!H}IzCvONIg!I^9 zaw!NYkTcg)mty#06&@Xa=;zWx9py_byePFyi>{`or25U=5?5ooQi!4c)|GIl`TJXS zpqYTRK=R|V`A1$OUx#i z1J&p)?HOv_%wSstgtE>;5DdOy9@_7W}_v?>+!b(|C0J^iV1_Lvj1& zA?WoS@9U(#&cyn&LsViX=2YMvX5wIk2Boj=FDw?{mC{}udp>=+Hk+fLElP!bWTL?U zmjY?cwvG&w#vL4uXZTB2jd}^g^6}-=0So%*)XYA&8sLF+_OM(nQfL{DY00_&`%nqA zYTKBEIY#(USZH@9lC>u%rJ*M$Mao_L<{}UGLMIdmYD=55q5{4@0$l7)i9V?RK zHMF}|@dz4_U**BF``76qF7M`kStWK9McG8Dq&l^A;p&dr@F~zNwL)9TmFuv951oRk z_?x=QNxzq;9>0E;H<69C*ayz;ecbp~+SYg9u0IYWlnQ11x{*jab8Q( zW*|)ab?0TtW*%Rcc)lccuQC6>KJ+9kha;EXMT&fssS&B$h{GFNzYZwrr}rZv$5?b@ z(Sa?vM|^7o!6|r77>2*&Xaoos$&Jpn5#FSX(O@CD=e9eGi~|u@GkH`hFWXCP-k_+U zYac1}bR`_m@TrHx+*1dktF`bOA!vZ&q|TaH!fvV(N#qD$VrxdpqXq~L-_@L_K!JjE z#LS*UE#MtF6^hJh@T3EP8(JF*)Nt*g6I;)D-Yf@Zihkn{hdG#?3R{o9X0S8!yNgJ# z;v$`Vh@aU_Z_Lo*Myp0$ZD@f6%Kb&9*QbTjz zU7-vcD^T#_=j#)cmcY$FhT*`U+v}2sISJepW%%IML6miys;1JE{L&pK@M;>vJ3X4`%y?oZauHP44Y*}FCMByr+;{3AP2 zSxevAnh{%ub&L%aDrvA;E*|Bl-<&{UqU0xfUZJ-Kx?`*=z05Dl#9@X052tdzAr1Ks zKE2XKE5Dakw3%J&r@^vmBmZs8I#7k$CXpln%}b98#3&j3F1jGDG?+8aSam9O{P|e` zM|KTp7QABHm3iKqC1p}p*_t-qfSZ(#7|NOFBktgC+dVlw0jRO&voPKVp{jfo=Er`~ zZ6QoP9dPCEl*-Okr-H&h(Jv%ykFXy)MSxH^&tbBM0Q|kVv`nN`G->Y}cJP$X@>iU;dAvG#NBSa;&u|9DiWI`NJ>^p}R z3D}P_!v;-wo&k-kw?P&D*C$yejPvNWyuEZxf`NrW(kPz= zZmz7CV%KkaWfn?Vs2A_^tZZN2pz&Zxx^inMcFC+}?Hzo}Z`<6TdNr4^w1iI7|85gY z@bYOoAEBSWviKkS!;-VTd(~|(kKL>uNPWW{7{MDDyPW?fNttuKnK^Lsix#RVg1_!Y zo6Qol6bkDB2e>_!(ZEKoHqPm>A4%<@qg$Q8o*1Dxy%I;ietI8QsrAemdeG3l!$qvA4eN8Ehk8eS&f~6-4~JYz@J;Z%MDD-H-+piDeXZ|~ zzBB&svSDeVIj6g#%kBDY!Pi^FrQ}buW?!-v6#3x*KS&yNXNGH1>L7;vVhU+WKZ)M7FIn|>!s zek>o3K1)O|Tdy%|f;U0EFY<;+sAF6_pisj@-8x#>H2oTaXEw+w{K27Fmf?9I@zoxs zGowy~47X2Yv2dnI*YnTNo!@)50k9_pdZN?0u9sF3 z6c@8ZLm&vB6co~BGj+zQErv3;s!9Wx)8yu#$#`xx&?=O3+iUq zufNk~TX;)Co}Z0vbwRE$1YHI!p)4EAa>Z-3S!0mHjQW4l+so*w<=54Km%1`SudNob zil8kc*KP-C|4a+6YTARLFXjQ0eHxxQgZ*=k9?pfuHW3c|}3vNu{M9?re_x7}I5rb6l= z!1o5DUHJs&H?M%MnWx<>z6oRqFwvm!2~nT$UV(ca%G@mMF*O)Y+in>6fhL*e5#{~w zuRp)RgI;5&(I@%$y$mq=pC+u{TnkW(Wgr+vmx6g0zmko32|b?=Y*_zM>0o)~Ea`@4q%?XiR89>QIzH%G6I?X;or$MW1I+fOmK(4>}42#)F*_P=p zxoT*(d6vMd%Jl(>xnj8pP*lRcNUWqBVR-dZx+evWbheYb93DSj9v%U+S7&7VN?9fbzj?~nli)%o2PFvJ(SH*G!l6-EJ-~X- z5iD~=V-|-c^?iW+O-R>U5nI4>y48~d!Z6D|Cb%9ey)xz^Y)X(jbjtAH#mVA$jUPU= zrWduc$-*K~Jbs-gYl?2O2*{yPqgWPwf%wP$4{fDvtgNifa5QjH2NK^d5G`Mv3BLQJ zVh%nq)4C3|IZfSO9@B<}XVn!D;KL(6YW^1N3ys?`H+=k9Y#&CKQ~|W9_5FT8if7uB&kl%5;N0UWINrQ!v58+n52oAl*wrFvddq~Llxho z`4hBjsSQ}!5H-2(9lQU_`j0%EH$!L6B;PakC3hqZY4?Q{pm%?i^?FmM;B-y15 zgJrdazjL#E+=mHGE?U6)h?QFT6j@4?P6}77xpcUn4)g+Cpi!7p{58P70#cVhrawy{ zoPQN%2ei>%J?SF#mXIjD0xI@<4Tp-x%)kPP)YJEW!6dF4axOxZ@aM68v3H9N)YpTN zL;Ml?NepHOp>jMjemo+P>6=J&_;sdXOL?IDOHg;Z3VEL$E3FzBIDB3`<_bqh*z)^v68U_gTiSolV&oJt4@8buV z`;!);yeMQyquUs>hxR`Dj`trge=cHwEB|q$w{MDOU#J7@mb9_v*2<2wY+993pN_S2bYkl5jU%}UL`Z{ zXfhk?_>$RL4ODI_n}1a{EibtJc2IHfksoJ6)j2w!6ADQO<<=}n9KV~^T8fp= zv#8zz{)=Ho$3O%8t9LB~e_E*II0mZO#@hvWn(u&NVMuesG6QdL^skZI1$sQzz6O5* zS~u8^XH*>B@?njM57K^}-Y%xH2KDahJt|;(QH_0qwv(0eveP=Jz~H(`7b{Y6vzZC! z`v&k!y2Ixd3XKiYYEPGu4|#Qmmm;&GgNVG-!cMP{26BatI9SoF$;WIv=VGX1vC<>M z{(07!9rq^%9aSJ5CcLlne4P}m@FuV9bHh18%O&>lpFw#MRYA2XzFMmrU0;g&jBar? z@@5c_B|#X^s-MHrjHj4-PLI^_Hi!hXuaQt-(7_Hiu`t*|f-PTvd0Ie}&S>l}nlOaJ#rS z80eG%9c0Y8;yLsJy#U8!HdP?&R`U$Vw$&hjQ!dn}*KMP<3q- z5r53W`sBe>0cNzODFE8MA=!&aOLNH&ZzH?dV)S(94KR_z}p~^}6A3n$lij!{wt3%TplMDJX z=Jxy5LUSN-8Ue+VMH#Y3?SmQ8^&!wR$!nRn^{k}2fs1M;m_}?`0A}cAA%6>I8DN3q zZ?HCpf*uG*gXuy!uQGTfej zNO?m>^|tRg9;yZ=FyczW=K-#!7GQ*p6%I(6RghV#e~)&bk{`3JCUjIS$Vp$M!jVn) zZiq+Z>HgTL#qqa=T7j+Xth``Ur755WmQWN(g(`7jOQ`s|2;@|;2P3tP?!QG!egg_` zw!0?9Vk2i`WOB6YWd`6&kxnCPVmKW7f(i4t402ZYp1|S#VVHUkCwn`5 ztuGg-`v9@xqlSV|rRJUxf&p*l?1%P zZS}j2d9F(_#_s7i-$!H+++i`qqbNR{bl&Wk(|(y8o@ADzX*4&HxsQ0tTLqMcMsF ze~mkWL0o$TTKL55GoUNdpeh5DD3O#!fQfnG`05lUsrMKD4%*+wCX~fsyhh3Unn8%*>!5U~sQq^sy@IOZR`w^psC~%iAb>H}z7Q3Pw>8@Ah z1xpbH3bTo*#kA(Me63w_qqVtv~=1_amg?5L*E~dN=Up6FbNf5oMuC)-?_cp8A|Mw^o+ii zmdD?WtG0J}0IJWmA0sA>x3*`jK?1>{XQo6{x*6ngycte+E^0C{GxxrI+Pr})v*?#% z{WEJ|?h$jTFJBB}4?L9En%U_RU>@JrX(acq*1oaa+CQTS`Cz>%?%=qrFKwtw=ML+n z13KwY-*r^ zJRN>x7jt!j+$HV13<3!uEy=^Fpa^lfDQ&0VFTNDibUd)C7Fs@SU^W&%DgZ9NAXQYc z>#csYHO8xQ}@h z#ixJLIy>!%B>sAL6_+YqY~jp9X%n2qZtM{54&Xfl-1LFuHzo5UOHq9)R7$io-J9=) z)g#TuM&2T?Kpuys?y5ZvqoQ_3sM6+$CeAC~&Zn3v36AvLOz?QLP5;<6am;`($DPn< zIu(;>8iBm?(B*dQp1|tP(2Ny*^ic@&q#Nk|0L3AD5X0(uA>>^8;%CLipMbUqZHYA> zsn-I;o70Z8q?S`Wk_*-OQAgFZ$n0Tcdz}hz8A&Rp0 zT%H&k(hlBe19!A1(=0qx5-JwG5(aREd?>o58X`yA!Ji>5eMI*oeF zy4bWZS94Il|DF-He#bz0;V0U9JyRNL0dPgkWA5er*nRQL%To5fYM2W=XEr+TmFH++ zZ6*c(lv^JiGlsf>k;_m4IsOSemVrZ`-k-e<-+4IDy*1 Ht%6$|j(^(?xrFa#||x zqhW9!u&`m>dZ|lR&4RKJoe?p4_wu^hHt~BOB=Q}w`VX& z`h%gZ`%O}iB+7SF`cz~<6%+!O7`wQvlA6sA^6+?-H9j4&V`egj;uI~#!X=ODl*Si z7pG(uaohvtqE4oe5&T-p@~f;W2cJII33%QxwxMq_zVJz+X+-mzw3`#)3u9{tZ_NFxRfi)kpn(ju|)Bt?$(US{tPx?0C+r zDq>bWv!jw!KmUsI2^xNH*bZ|d{d$t+wcX&Xoij`bNK$5!UxtI3TvZACrv0D$?nse< z-TE`~qYr{Di`uE_1OrK`4re8CjFuT%qB1DfV4wX3@&5 zy!I8q7J2yU>^ucN)hN%)&MR!xp?)4pR-9S;@kjBS#t|C-JkTsoZ~XW zmlXf}$iO>4d8Gnq1>-hLbh13O`!%Lt>EkBT0LtL+Mb!7OsE(%`p^_*TI2+WdtpzCd!As7;p6(IZ+^gwLHcMm9O^Xhl}O~V8DaXj23xxnH|7vg=3m_T^1e+nzK^zA z4lbK5s1?~M0FmswoD#v5alK@1f={ftsn|nmI#1!19wqVvfJ66R3-TJv4ZQl3W~Znm z^_1A1GZXb0p^d`DVTaCp`st|{vCr@*Zx3cJgf?LpDWuJMk=Dx&6~l*bi!sAVd`gMb znfo{2i=2lvv{o5Bt-B-F) z4>n~%#I29-Svcu6bn@@<0)3qKsvEsAwf{=(kI$qJ4CGO-y%K;o+3@YH=_|v@GklI> zSXIX#z*|?$4F#qTt%9q?RFl`3;W0=YAqR3vJS+pRy&v}~r&~CPD4@f4Ex+}-w6$-# zX+%b;VS6iE`AD&vB!eG}35Ght4V}E>SpWz%AijW-QWn=s$`<8E=)Kb;JTg!a5_nms z>YpSiCFca)o9`ksm5fmI54-}Rf`+D5BmaL$<@2O<9jhkN=V-#e-wtyv@br%`dEcYa zm9`y%H{HsD+Y%Lo=6_?g!2Q%imuAUXOmTf}6mptij+vvWTlTWymj1PIc`lWX=lLX0 zzM7!N>Vv*U?~>E=cg3{jwbW9wHu4nOs9c1K+zaqgH+5)W%66&)y1afK58&)~ZPh{z z0v$ow;0rqJ`D)qJMVMI|{WO}I_;4iG+R-w1d@C=DMokN?%I$2P>I(GKvN|l23>Vd! zB>mHS2VuQy(E=5pJJ&z>ufIGB-^Sx=kjk830&d0lQ^XG1Qn?mYMAxu^=^2}S?&zer z8@z6&?)5^Hr|`&Yp=`!@=U;|de$P{@^V#c-wc5KtJtR*cG4bfkbz7E=%P%_&JN>|&_|l*8vzY?rp442_M5 zONegL{bt#mEsAAZYX!L@;WiKoh*|FMFq>qZ8iRWDk4w47&9R&2IjZk|ex6TVetrV9 zU$1=vds$@vwa%#q2?&0x2@$+kOf35wsPh|00piu~v1J33MbwgNp~+(*zi)m&&2_A@ z5_0C*DRtNtW1;*USpvXM47vWWSChb!w2GhI8`CgZrsw0d=52)FpUR&H=ASd4&gQ<( zdXY(_<;3!H{CACx3;2YiX%8IGxl48PBJiyW=7uc z-{4BivjB>J9K*Oy9%!QxsR#y)lX;ddN&^059$8K|qPjd0mmU6qT(YFbNpvOR zh@;W{5N@QEpD(%z$GH8cT}Pyc&Kk33IJtxad0@@Cc@d6u{XqHT3jr)Vl@-4xFoW0!cgd~@LGpm zA%vvk#>M|4gu-jPC1;N^U1q>UwD<9yG5FfY)??`vpZ-Py0sSk5VQRAqzns_llq8f9>2UbeRKi`8C%6(g&~~1Fj>4^g9K?z9CT| zS~LpP`m4gp7L2aSS}Q;j-D9<7OLE)tPZIUK8*8>UVSeuhP(U;!v7^TXgKrpj%Lnd< z`GMW)fJpTFaOM!TwjxLS&MwHp>>2`A4EE2&cP&B{^nz95DI! z95E)UxqLEl>D%@y^1E2{4;5&$iQU)`2+VMJKL&gW`)bbo#2qB?R!(6>MSaTZR>9^i zy!yh_s)BqH_)~J=DmyM4!6F?$D(S=}%i1lA-UrAt$NBi&sQEQ~AuKmS+Q{^G#y@P6 zQ3<{5yie887{VHyFgCUKf=1$ca~tM{@d77&|c zeBq$9U=4(O?AT;4*-s=p!>WdlVJ5Kq9uk_2v5!YPR!Da+geiBO$Cj zXz#|KC7dZ=DCM%`;ZGn_MF5{4t-niSXmke~@fFre>|fLp}6CZ%z6c z6Pk&VcRY*bJ5Bwl5(c26mbDXtJi>eq@)F~_E+v7%VC{J89d2)rhtW16oDjN%dL8(q z=+sm0wl|i?h^-DDj}}aMvB`>F!i47W1bTp`#fy;)0pNyr@eMEl^4%77*-n`--8G1Ad^`kff!7;x zPNujG2qe>i*Xd${{{f29R8)#Gb>HKA6tDxw#LJZ8mPw@!_Bbk^q4REgZpl%38E!d~Nhiw;bq|Iif5I4iP00um%=RcPs1d)?VU^+7`0K>Iu3 z4{Wo;4yw@l=?XXPgZ=toHnIW!@{2y8AU9?wvzPd7Dln}ypqFTkG(lFF1qfuShEK)& zGCn!~^=(4QiU^21zKVI2BsAZJlCF*n?bm&z?w5O_W9>UKl;U+*1m+SAN(rqp<(@-x zPKtAy(&Yfo^*@oEifDU+Y37vWgv5e}vDMb_f=!#oTpw*d7Aa&E|8&z_DA|8}5C6rM z^0LV+^%U*TCviVQHbJ!H8g-5vBxFR2HeasvLc;RI+l(*r`@J(egXi2W8BQ6h= zh<$$9mYM}3dD65< zRu~v&%f+0fho#BsmD^yw~~S>CRC9FGU1NdB`$)6WNZxzlJ**2>m@^?%1>)V z%&f@~gowQq<((qr)^-6+OaZZidf#Q;B*@{Q`W_}bjLcI}M_>B+(&l~x7+F1#kTHb1 z6lX_80mcv@^=e!^8E1Ki?ctjM*KO~kAMO0#XIgg?$KOY&P2X)t_X8u!&(>f&dwR7n z6H%t_)QL*+PTF{gC&auY%JxET%>bMLe3Mm{Ct|p4+yA@x{tMtgGGw@BNaE>ZQRU>* zO!h4L-4He2_bDw4c*$;DCB`E6mERamnUvBmX)k|AuxtGK20+E z>k_gb7mGFxfSA@sUtzlW)($N_yh*VUb)*ELPLW4?bT?V<&?LwAuBE z{#n#+Wvhdog2Coe@qLS(TGBL|0hxf*2>~MNb!yj4f|o+nUkAv%K3QG`_mvbE_M)aSkrcdoGv74|GIgH>n4|w`;RCe&anQ>0IFu-VvfVxbZP!t~`HS+ho3_ z9^~3gzrXpnNdHv}^?+3M_ND;wkJAZ%UjPVo+QR$|*qeA46__7}xYf-NR;iMNPNhr4aP^Xh&t;9$VqS~)#=oa5(}aYshmehdPR84mP z#fHLi`;CXu5P_Tkz({~CyF#=-aTpji`N@$DFqqhHz=RTjg~x>Hv)bRM1FUEF2ivik zofN+@5~W2!@Bny13gGFJx`0wd=hJ+1*Y_b>-Yct_Kn)BKH}4}Z@DI3o3kDhOw0OTh z>CR}XTXE_T)1WLn7XDfwc3?7BW_5VR>;F1eH~e0%o(c1VN0ae%B;h_BO3lZ%UPABh z#)1t@#>#}c4vQ#m2`mcW@%;&R?i{FDG84&b^aM2D8p_Sib-Fp5@L1J#tBWfZ4!j#` z+|CGR6FYZ|tkJ~7ugl~{YxE>~rAv#Z>&`T}<6GaqMRLbibjPlNovzXW*XLAf?aGCu zgX1CxlG+XtRq&KFM%PHyk#@&7nEhVWkt4$`Z!i{Jw9p@b)C(}b4&4WIfR@KB*lBDx zfMXZG((_P@5iuwuI+T*>j7i#dNDAQ%3Gbm*WED||FA=%cBt>2aIyk_*(mFD4R9`8p z^aLMeA2R8?;#mW#$|Mlu<__?KC@=r0d${OQ;RjT1$7;IQFX(50Dao}xK`Xc*^myAO z?I13j&@<4tX{7T;8}qpC>iMHTI)quj(#{0yP6U|L>lAGWSa4SxTJ!p-cUO6y7Z=|1+C%P_` z1`MoPRYkyU5qCj&c&rr+kW1auln~;CZxv$|;{U4>b`NuYr_G|xhC&Q_TsoV*O*_8? zi=F5BRijsSDRKg(t>49@I4DCqR0*^k%AyFooxsV9`W2EP(&U$rgl&BNFICXBaB2@f za-*hNZzF(uEvlaA3@D5}Jp`b#^Zw}iN}Bn9&KWrc!eaTXT?xKOUj}_zu$;N}*~ z+wbWo=|C{Z9XIEh5hvZC#a00~OXROj`oKB4ouv(jWi0 zsOD@)pHN5ecB^gA6hPj-)ce4DEDluxj|CHwIk`vazr6F?j*F`ylL*Ro8sUSh=2&AP zu}@y;cvMPW!>n@id!wfrEd38VeQ`c|&H9g83oDYIbm^k_n-Iy1s1rjx1%s(7o(-7# zc)&;x_^dN1RINmJZvxq(IqBHCl)3V;d*k+a&p(Ym)cXlv2_72){0syMSP;NvYKEPCk^D6S%b>lWdp&D=R{;Hgzqc2+Ck z2~gknhhFWIBM(UCC|jeci});pO9mclF8f?iIU(jPOiEBzLB%OXoB@gARvqc;LA`

q7#*Z}u4rEflcZtMj?gKV4~!5(@zkK4y!ZEA|5Xr}Nou0#`Cc#}98jL(RSt*ysORwj zGV{NtuUT^0sQ%}YTi-(8r~aFX)?1ah;s0altmC5Gy1z{$QX<_T2nf<8F{G5Vbc-O} zIh3>@Af3{Uq$17G($d}CF_a9=yU+7`|39AtGWYCz?QdM`!5eGm{PFa2BlYA9-+TW` zh1)iNFW0@7d*ZWBH8JqLai;y1u8-}H;BB;e8?`w7cyq-5F$eql!P0%+|Neml3+dpE zcnJ7cO+U@>Hk2HhQJCT53`gH06bT?5SLEVWd*%Uzvg!w4pu38P=jBlU>#{W>WC;Z$ zh%nl$Ssfgv9mQt1K1GI-H3ufqgzmBFPhTNvnBos0C)$Pgrq_MD*!nvG#uTwHt~IfqprxjM)2^E3c^QRgj*Bc`h$XHmwj26SRth{{mD9 z9}u*TkJpwIN+Ij4s4v_ucP6@hxKLt|zSn`762uIDPX&^-|2KJuU*Dpk9|j1iKd)o7 z!wD3KOm4pQ<~Ay#A8-I#W*4zB7bo)G!BfKimF!oCTmOAjz_ky`+tecEL>3i*UXm|b zQ!OzW3=~RbBdzzJg2#=ieFEeSFBe$?uRnQS1et6#)vep04zLuLpQqTTxus^@AV|{l z3%fr45Y{;$@^g`SlD7{{j5}Ub%bA2$W1Gm>`3@`#iH zS>1?F?y@qHl&sGW2q_HOpI%@Q9X322U@qf&s~>&VQoA!QsGI8h1L+!Ey&)kb;Qug@ z2W=#6`pw&TIlA&2bI!HdgDVMg8PL!FQj-X{KOy@1wrIKAT5iW}TEd+A`)F9EY|{P}Rvn5Ga5aXaw}=__eY#CJstS;5p*JgFls~ z=dF6u+9EFm*7bM&veu_h$w#>QnZG_JZ(jNImD2K0Cx$s2iu(VWRSYHF2Pf~1WM(RA zC=4Z`P5t;?WGMWY#AdyN}#uo=9)Y5%_VRK9fn378exVwV7#MBqDIrbL=r#dKsOr0WE-99ke(PtycT>JYk24r5%TA8@%P~>2`Ng% z2xg*xZMZ`_^K@OnrJ6460}Z~Wj^;37OrIth=ZbC2DI~6v=D*3S#VH&+8;3adbosYx ztL78*j=p7dVu|O-hxVY-kjVpi@mGkcoe4Gsp7I{x&?$A<}8*^4gH1^B) z-L-Ma?uX)sj8cbVMrr+JrR(KkM9rZI3*}nMn-+3TWUAK2v3S8W^Q5{l^Mmulxzv{C z4iFySdp)O$$ZANwQ1^@2BZrY#jakhsR9$#ocOGsxj=i5GH0B!ViE^qwJ<%Z7v-o?p zyzp}C{TkFCJ}(*_{UDY&xpodF=gGlP^8>!^xn_ExIf8K@eweg;uF!OwqN{fm=8Mdd zt+L|tx+0rgvgaeTLzI#b72Sa2Vrc$ce*j_AT3l$nU}xN<$32y9^Qh_Y^>Rwke1s${ zA2GVb14S}!em1s*yz~tvv}501g|e$%a@rmP3xDaAjE`JdTbed1?^sz8^M)B|@8Is3 zNff+AC##>53EgK*2~u;{pPM%k(|<_Z2j;R>EZNKdN+vbVEKM44%7;DXq=bh2Sg#II zV%|=L;%!3fmCs$vAeXk%ojvUpW5x%`P%@hHFB|#W_E1L=-Kvvzje}#1J^#xy^I#TC z9r$3bMPG%aGjz0m6_T{5^R9q$u1s)b_IMls;s7W4!1rJDUCe5!ZmsQqGrbX@79443 zOB566nss;a&pg`~X?daMXI1ZQFS2C@%#*v}mBcm6N*KBMdUW^xtV=GEa3E=q2KURi zHGGn}j)x+%{n*_L_qQUQ`Ydla(~1SS<)1ZhHWy9=;gebjj>N>Nn3feTJs#rRfvRX}S@|2`!JUWKTRQuOuT7&$e_qyE0R_ z2T4iB`LHc834;sjnvpHSe60m4@*1_k93~#0sDg_($>Q|YgiLQf;$i~dH1f>o*(iph zz@Yl#C`R|x7jT;_F@tf@U};WX@d_WmrgtQ&x`dadzaC70t=IVYZXB|_TB2$DH3akU zB&p%$#OX>!ih6T|T9xp)7xnamcEM&bJL`$x%8(|>XfgEq34#?zue|Rt|uQ=wsURnV++0$)2C6$wgw@LuHO4{ za$=J8fF?|ct%uFNfijDRv&vuwOFt1O+59;+A!kI24!@UmN~_K}ykvejUz+Zm{!r;O28g}3}lxmB~_$Yrb@d4Acy42?*| z49aBN*Y}c};h|cXVHer)E&IM=hY5N=-{owqMFG{Gf0=dDWf6t*dNc6W{s@9tYBO^5 zxoWRY7Yg0Qqxu6^6ooGeIydv#u9)aghT=Q-Y>ODQ{dC7zE+gq49+(;|4xY&%*h`z} z<7@fg<^Z?a^^>A#X#r0|9C@SNta}YtW`?ueq9KdMJUf1AIwkwPSuxWY^!S*v87Q4Sw|1y4Mf&yuHfD4NOe)%VL7jxDF+l zCeqxlkhKkxOF%>k;#5rZQ2D>)?bP(AtzUUV%M0VyW6ACyH6U{O^W#L?UCD;mhw1<@mWeqp0Qd?SMi83z5}VV9%R=KJA2(<(%ulCuik+sQ$kE<8yod?^}`3 z*mF%!WBU_E2~Pj)9F{Wvbsw$JqjR&q);VJ+-L`zN3*+uH71lmSP-B)XKa9yt1KnPZ zmdP^g1(7HL;}qZee&Y$d0oG&a4?EHO0-jUDj_;WiYD^jKZ$m$#)H1LRBVHz~<|G=` zRj!}EvZu=|zzz zuV=#?0{R4guGgc43KadjDbz>42=h4LJ6K_ZHE{6 zDkxGU#QevqN@0GrwkMSkZIFVuLe1U&RzmaM?D9DsVf*6hgY$#=Ya|_T|Gux$s$H`> zzP9xKBx&GR)<5moPxP93^N3fk3$$2(#NwBolS(d0qU{_!6m=DbsYaSUvc<4KkLi#Q z=!>sSS|U39+ZFZ>RwLfFpo9-Y%*L^ak+>Zh>@ zC3%7q{Ssn0<=~|0(={fGK`tlfGtHkn=s9VLhVPj}+|_sPbbl0I>M3Ipb1t$>B*zc& zov{jc2&;v|xNuO>$oj&}5*yXyr$qR{Xj=MoVIKESY~IJ}HxZ?{h;H|VDkAj5A^j%3 zHOkkUqR=tE=nyh|Tq?fiQ7%(@di-K1LNye`C&xDZ3kgG=_hvcFP4D;i>wsC2?e)IV z!*e==#Ualm2kFtrrg%v{So6&4M^OW+SGvY>Ba2G(-A?E!PLAntL}E!qUy64U^wr9W zQdwaBc3cG6^7GW~8-wb3ng_pjvAWt}9aLge3S@qBsesjHsMoCN(H=ALHL+1LLgO!0 zOG~JCm$dUz-C!u_){I2bCmgQwtrBz!My-ZnO*G>AsRvpkcxJ6WRSSdQ9>mnXwRLb0 zk#Bg$);tU;!x6~<<|EZ5c_(j-|1$}6<9g;uheki(QN*lh_!RV9V>@8WTYk~`nsT`V zZ`R^*FcPl9fMVoOe*ZnY+>cV|s~*cmjyp>Iit zCs$Qhg9@t#k07wzt0@AlEqNwi4DNtn7l}}m?-!v^Q3TdA0O|Qc+aKx*9KXCVT_l-zvc&89UjDNj_T#sOw3UJX}-!zwgm`Dnd*Ua)>9k@ zm4_r9tt(lz$?rybSvKkTq!LI!V`CLpZvp882$GV|4VCG~7frnq=G;zH_Q16y7p;SQ zl;CrD%4||VwZvC7W*U-qa2nm$E1Hz0Q_PFm#V(K9v?dw<27g+d$~KCZ!;AMLsO;-8 z)M=yieURM*g$|mAy=9Q(k5`VEu2i+N+3Q&U_Rvz9XG<{`6J>(BNPXfCPLVx_SrFQe z%ku3}@<%-p{5O{3pnce?UjEw3l|~fxyZ`Ho74O{D9eW!zy5Bu-zI;gA8<5z`iE7_s z;k;|(k*VF1>Hy3qKU>;UgQMv3^~;v}cibeHJ3)g4Sbk4TA_&+I8{={HJKYx1)r0-wn`oBP6ROnY*;e<=N zD`H1hkqOP|{5tI=f*=QCA!`nhK5=G^TbbA&KhYGaswtev#1xo|@W2TiH*Yua2bp~q zg%iF822I4Uowyr8>H_@qXkfMNtL^`8;y<|qs|RFDKami~$QIUhyWQKngZd=-;%k}^ zb3Qn^gpgFRDh{IoQwY_hv6t4AKMcd-6g*x)1=y|gqx-zPVT`vzm;1Qps}(m z_BsH(MRHy+VZ^b=df|K1f4H}6HVn!5HBZ%nS!=})LpqLpm1~aZiTHxAC?skOi-x-n z;9`qfF&oXJE0Yd_$$hiNh4VP^iz)``A7-@x3*S{0>r)?iMPrwXs$so{D#;n92U3RU zb_+LB304Vy2@Z%$!q`jfH)a3O0V2zX`z?j10=f95E*=GM^+vzg#ckJ0twE!{NcM9q zvP>oV?rxkyPla1aE$Z`by#LCx-%So#p0CZh4qCY6z@W%5w9&qko>fp*Rrm}@D6c#> z#X&*^ltOOmsnah0>Io3UteNF#tF1rs^Pi6^`kmjtq)hs^1OikX%4(}5tT8jy4}a)P zL8i!xtl`RlgXqdhj=~#>1skSKXxXn=w+MbVxLrw~U*fcgztn`$X_uDK-A|2}<8tXh zdZMpc1Gbqlp87B5fswHKi%1vc`xTp}E2+mp0sg%Od4+L$lo0H1?BJSj;tA^Kopua?fI%Eh$*+C8uU@o>l6 z;yPPf)VQ;Ie+I6#VvAUH0FX+Cfj3E;jYPly+$OO#H|8JZ{F4LDwdmFJ(pJ8vnzh!{ zhEDK?UbMm|e~wOixNXS9Nl>+M3+iTAG~5qpgd(TD$gL%13pci`d$rr>Cz|c$9rYWJ zpc?8{_zX=v8p2}Iq$gSb9>F>hW*UOTOyiElZ=(*o>uaeV|K18RS^PbdgEBc1`uJX| zUaTj-Y(1=_G9ueHY{o*6RDs2ef({5f6CeL!oN}~!!hA?w)I`SaMe;uw0@zj`D^v5% zGSooYy8>cmbZ8mCi4KOW$cC3#u|*!(qCaI$d7x$m`AOW6uAeCUHmvn459`Vy|1z0R zb1*PK%ZGw)5F+M1a4vCq{e)nNINnd}Y(Rt*`bUfw__82VW3Vztp2fM`ji6qFgGB#V zrU5qhdejE?Q&Db3T!=tyHl{9@37S#{7IF}v@0K~1ep|G$j+}BfF|22mfpEvZ{MJvRN$B?K zy{XTyaXcVzqjJ{jLQn!^^ebW$XvF^^UEmHE6-F5h3n zg_tf>%L4E;16*_NEWy|P=Nzq7w!f>CJZ^{F#y0Z+x3YmBLF3Pdcf^ScDM>o$i>8g; zXPS6eCh{s1Va zOI)rws`?3AfU3@2_O>Z|n|XmvEFL$#;WNQMbiCXwz^`<7Zz1E(J7@a!8j;0-he;n5 zuRr0LzUcrNLc`bt$y91to)8k(7b6;S$IM}||5U&*ttI%6Jv4r^u5&Q#JcQ~berg05 ztWGa1WlySN*e&GVAuY?m(e~Gf98mmEkSpF4CuwU=&VnyONlQr?jh;F)+EV~noTF|z zIRidhgS$V*)k8D1u{G{*hq*6YNNSL$c=3&RPmACPm?$%RWCg-UwLI9PlA7F2x|xxC zt)v2wRPJ28P<7nktdvclYWtm7QdoUyCM~t!Z@$4j2zl5ghysF8GFh>S7S2*E=EQmS z6Ca4GfM@n_+N80$4E0CmYOs6TrANk=a4=u3D6%7?n3kf-9V}u;+M~Chly}zDdi@fh z`^4?l^U5J3V{-ffBSUhC`zMDi3Iz4z@uw}t3La_5-UEKuG>5G$ zm2l_)xYdc8F$6w<-eIR8Qzj=%6$AUI1H6TyM6XE?uhZ3*4L867ygWazn+n;Hj}+UhZ6(TGZ81n=Q4COnh#xwfy)(+?ik6FXA!I5 z{^jSVs?m&2;ZNrqGky{OEhbjzBB#h_T_3ZTO6wbFL^@H|ekYw>LLPEmR~KsimDlQH z9n|S(`8F4?OO0*QgWb#*ZvA4=F`I_NV+B{+4pLvDz#VfV;S(aONR z(l=3EZtBw~Y5Wog9zl~B(phTmS8r>)Q+ke_KMb~A`@Sk$x|wt%o=|zS zV3O-<+P7z`7-OFL)+;QV)(F(3pPD_pB;30F4_^1%n$B08_l22W-g+2gVHvJM6qTAz z$FXzq`QUQ)EVzgPPTt2n%cH-jyvKlpB!EhOx$OPx!~37jc)xPh)Xe7!Gp|5hC5xfv zb+=H3M(3itw0oX$7w>Wj0`~$Hr?#|s*@|4nr{ZM=W^Rfut+G^ZossiyH&)(sil9b2^D7*pgjEG zU&q|?dCpFX#3^%!M*HcF0x`nFx3e?mYS}AAEK+<=10a$`=&SO|N`F{7BogV@`o~B; z7T=g4kXD=398>I)R|qC&sox$E=}-z#4gD)%hpL-{%0=&DImGMpf!m}d;*M`pny>Qj zi)!aI!En!0KfqwfUO2l?RIApk=~c2ok)s~`mzv+y{$e!?MEFIT`?WK_*>7(~qF?Fa zAE4i-!YyUwLC^4Z#4nik5H_9-_d^Xm|5(tlWv+qLW-0Toy*a$si{Og2HJebT2<=5Z z0nRC^JZeK)s}&Q1D5J4ao$*IQcn$F$F8ISdIbPQ@e0zrUHncr)>O-h6P@gLJ1w2#N zR@bK&t>RTEn2otbB79i&BOOEIvlW3K-cc1F7RzT)uhoJM|Gxl zs90Di){PUVQ`9o`(W`L&R9z|_i4zM~_b>Vq0ot*JUKO?;w#KZK6#`-XAA!XeM%$m8 z7$XN@fGUtmiE7})L^K_@2r8b48+x2TI(?hfJ+>8Oj3R$5*oD2+U$GH}786;YL!=-kb}3G7?*W&KEk%-CgP{*vc2Myqt=?TU8`&aPxckh)My<*sowe9 zXz9J{HmPY$hCq3T9Ki`n8IU$w7q%9RYub7=yS8Q!J^A; zyR+q|K%=rvFa5#);qK<~zAG}j{>SQ;;<^3_ho-tNebYeYd@@a&+9{wm2T$PdWYNfZ z>}gFsmVdtWFZaEFygvN|QpbjkgMR$VrD4d#lt+T6zLI`yb5ZyhqnB(lEDq+_<+R2h z1W^XqHgiZ`f`_b6$lQdtY*Ge^vRg`9Zk^p%wcBrIL-INcsvD>pfRY)h>SVct z=ljKX%LC zu(qmB@JXB8!iOm8IjBufl1HWWonU-b#GH`(5U3*n80X!ramZs=+E^>E__lyN58n-- zMSYfkAJk1ayhRH$dYZsj3^UUX3Awx^)h3s40e5y5Ltln*i8d6PM_?`hLh0#hph2NU zB(+%bt;+4qixVTRfX^#gKej!VJ`;lt4XsFo24&H0um zwMhJ(#12PPj4Q!pPBRtgIh;#RKqv%~F8^`3Zg20D`E`d^7#`S(~Q7XHw3v!a?k94!V3| za~+nCM4g8DMq)574m?fk8gxIx1(T8AA<3WgG7XNi#b4<*cz7mv?*~NSh~I#tgC21)skN&T;LXaH;-1zl z`5TYoo|gY~59bQ0OWapo3M_YOKMI>m91gQ6ECaR zX?*FLe=SA5z1+D4&`wc@Q<^Ow;hYSiT;KbzvT&H|bzd&pdcE&r@3C`snNU48A|&Ie6~UKuwRgNIy{vgx+Ie zPNoby60}Y>KruuOa`!Oe#K?a$*B2b<7?%79I!MU3wIFT>T1yD5MfpoGK$cLWJ%Rww ze+k2_I^ILYOo0=l&; zB;*Pi#M|1R?4V))Y8ns|Mkhg?iUIPor>BaLYLy9N`CS$Hj%v}y8iJYwB9B^GzN`=} z&YX-^-&$GFGizGY>3!9^U-Nk1Yv6!Sa)8+ylR&Hmc6PAmc>IBrz9WHCH_Ah*qOf@1{oaakI;1 zlFb;26w`)UG`0tCgtoDG-N@Hu#zJndDTP2d^DsP~zRyAS#<6HdY3q*Bn2Z#Y-luvm zourbcHLtFl$X#@Vp`PTC?4%SF=EVC-ZrS<48vr8qn3jjEk3pr>jOZA6l@h6Kr)A`; zj(&W2bkq`eiPb8n2}KKeS|q5~M}tFWjdt+J!R!Rt^9@`Yv#opcL8l`ObPa{C!~Z^7 z+3{8>sVigA=kKlhKo_9s&z<)^5x-dRXe{YH{5emJeEVBnVlaV-e~1ZW7{DtPPDu1a zCxT+(i45@!+4ft4W{uRPAaPGaHjMnL=f>~s1DEKW9!$%{ja zhO;SUi2MRLJHyXGFLr)OuVi*r9G>et>6_@-C&|9#*!H7~$}gk5$*q|L*(fBa_2&Bp zDoCZ}=&M&jO%2IQTn_JiVv0fIllfx`1?{ThV@9buzB`egJBykjTR zUzHtw`5ab#yN+>|g$%6$_dA)zILz2}n=bGz1bS52pZ*S~v!{FNVX@mDgWaUwWkUdT zj{oQ=6>y@CLB6XjoDJ_{cVN0-GhJ_%;#sL^9lCIhcuFGi=qVHk0|k>pL)P;0$HBLZ zGM^1bKeOj*RR@Z%-GYR_Yy$P8NCL=wEqS$&)we^eUj1TruZ71z>*u{`!w+2EiKL6L zgGy=5d3M(Jhu?^G2V*Zw;0)@Up{;aLq*A?}cVlW>8YMmVQ>V5;5o14eQlY7TLilvr zg29F)?oZahIZZ2O>|Hi4>roCJ0H;`of7hLPsFiv378Dep^< zCuhQ^@BoZQ>oT6}_w+=2xb%rbf(n={a zBa5-z4w-aoRAUt%tkABM@VTN;H_y-B%B(k{yv2J?VAnJRy%;Pcl;?7pENeGcgKjISiOme)iy1wMw6qm4GcCHY zSF4dMm7YG2=lEFps8?irFQ&d`d^zBRZ2SN{rqjP$U6T4TYA~9hh!3zE}0C_ z$i0psjF*z(;gvBlkTitnu%G{%73`}!_ZU*<6-4S0R}d(keZvUGR{1fH1xs8GVl8gr zmuEC03UGVz+89E;jd+?kK16SKo{1 z6;pu>afOC=ws|&&S%XA$5Bx1B+Bhi4Y6R)-Nw7q$!MTJ|-5x#C5BY~6u3^4+qFX-B zDrNcgf|~*9?%rNxqa0x3+f~=KV9WJ2bY>U`Q+1J(*S3L8@kxGa)EKx&Z+47T_+k8F zc@vPF{qIaeDJwpwJ%6E}RZwn4m;dvJ&eO39F@7a9ej|Oei@u|Sr6;@!%unY$5d8JozowRbRy}@D zs*Ca2fN)~T%=e-!+WL}3E357F+Pz|$1g~=A7sfj)D?3N2z>42I2{*XwHhlZ*n9t@t~ySJ!m-!YGRPi zb}8XY$?IcovlULw8Xmn*tI=`*igLsueZ}P!x8sIVo)SLuZKc>+KZkFr+X;j@XF;^F zpQDUliodxvEr@B8kVWZDifX@cfqfb+YPIFkRTru`XX)`X$nAr~He?@_2j%^e%nBm}1KS)#B}`m>1X6-HjzzH2e%rulPlWo%%f z`)q^8U^hQg6^nT6h*f6p_*dN&GsvmRFZ8f?yf6p7K!XcU*^iNkPI&>o|kLz_^ z<7j^4_dJ1HH265t_gZUe6f<2GQ+}tO^3z+87ERBpHhh{lmOvH204Lv}{%u8m>Rj+dMfO0paE$0Xqxf-hci};+o ze*KH*M&6()!Nwbs-hLx5E4z=eCnHM~WkaTXbN;mVu;{VK}XP}f~!{`+pDLf;S#tPrtq zLi{mD=FqSnUH- zSLw+~a?2?>nJkf&A;_PD@xac5$LDVM-X%rLa8w0|q~oIFU7lCQX|4+vDd^SC`l(l6 z%aO4zX-;KZXS66*7n`r<1qz%1C1hREC2yY48bUV7ud^;iD?>HN@3OD~T=lfG&j;=p zpuJ^A;dwY(n6in~M3VryWE9ekC+#6dx(V?=lb4#VUXd?LTRjsA9^*$}MPZ!v`Om}U zsJ7dyu6n25Xoq-%zW?ItAuc2%)&txU*3@Ts)tJz+K?8-g@#vAUvBLGmOOC8E92^JC zHnp+8;W$klpWQV^I2R^Q&b&+wkpY{q?JDSs85CnH+bpjqxlRG?c$#Cq1R4X)_lH9f z95>L)NW_~!I3Q5EPz$MnV|)CxQt-tw>APg?aUpLY&Cz{kOeOsi7-+g1u-EolU44Lk zDsHD92-`QIjZ|AP2F!1KW1__0o#_`h+*!~A-V0#C&-Z^`F=hlNc`UGw)kM7b+Y7le z?QYT~Q|bXml&YR1lk|g~WHYUbi-D?V`Vpx8HCPBTpaSOJLO*Nq!rQtE*oh(j!u-?| zcc}obEuJ|XzIvGJ=cq)Q^~35Du)qU7R=?^wurykYE+%Z(R+`U(E9ldAdy3?Mi8tmN)eeDQS=xuTrYfRsVhGK8Ybx>p({WS?A9OcPpe?Vc7WB$ zQR|7Te-@;xr=rK~!t=YtPo*XicY&7+@QhHwf{FBInvfjwltca8|2qOUKu$@C}%>RrT)?}3S(A2z`an6bR`Lj#^caoBuknapG z$vh7i6bCfvT5d!tiNOl2T&i`|o#x>I!IOKi84Tj-`vn_M@B(wZ?&xWn&8q!+i|?c6 zG?#q~8;482L|L?m%w>M1-L52?3qfm`IJXE7!|w)EEDe&Hp|6Qoja>@CI5;$@HIi*y z1P}?%DwwNj`Cl0iOw1KdMYU;u!d7ODXu~ADiHr2l>5)OB9zb2z+n{F$0H$_ z^DPA=7tx!ZEU6ay-z5#-pPAo*)CR4I1XC~^Swme5~3SL^;^ z0RNa>#{#r@7qMFJ6sE&il3(`C?;GIS{nwT^K6%0g@AO8E4eiVAx%KR_>oE59mF0!r zyDO^soZ#)@1OPZ~Itf!x%DRspX1f!zJ>fI+xcu`E?gU-VheV+V=aARKuX10^4jDrJ z$)0*Vw$^pS%oEsDAi>n%2acY^>5PHux$qZ=yV_{_$g{{zE=MH%+QVDU5UHAiL?MSX@{>%`#I98 zC>*w04GIChl*h$ja6jtXkwyA9#~iRf>#Aud0wa~@KlyJ81n|LVvvG$GWjI9YxexAn z+i(^3H4;B|;)+CZadqAX;1hg=d;wIj& zyc1yF;{-H1kmnC0cL$*&u(Il@cziRD-Z$v(-J81@=o4~8Hb<}fV-(+~_bUYOPRdi` z8yUY>UfBX@xAY2)Yx2k7?zNMpz0Q`1esq=B>gdCXTVat_`ENdbADp7Wcvhg9=qDtC z8b{~Sb8mv4_(Wo7THeKAH|YUc78hC-S=Aft+_;A`_XlS``*!8v&%(XW6Dyq7$TDkk zC+S7&_xy^sQ7heSJ*Ai^$5OMV72W&00tjsV{_YC!W{z|s zjDJulmVT2xme(kDqo`<#P*G!;UGjGnxO)DMun^ypx)B#QG_TlArNbwVE#URk#`u^2 zEiEp^1zgww+8EBKvniS0g(sCi1?pkHC$2~lZ42g{Ke&smzk9B*$Z`yQi*I*8(pvSO zxzi;@a}im$s+_Y4i)?$4$Eyajk{go25lCTbY2Zf?Hw{i*WqE9iCkc*5>}0M_`KlV- zHEHuG`j^?bbW!pHxaY+aINXLvLld{xLMozSuTAo)YPd{0h;5b8@s~H3J`Q4 zwDRMX4V>G56{@S!%`Y2Qw{@|7hg*!J6=fxev(vL9SZ;e& zF~#ov|1C`7fs{4=EG>JSM^5O@0>n{+lIxQ5K53~t_z<=6CXNc7e^J$l8fh&9KCME} z;WO${N#I&2Nk9(#v()B4y` zdKpIJ|HPsc`VmzyBb#78?@W<8S}!|2Dp3KAevmUMH0B68Ffm4?IQW~-C~9qhg9p6S z{%k6)e3u?0{yngyS^8t!9(+Op*6rk$`x6hcb)_B>QGe`S% z9MuSEfPzYK!7mZ;sbKm|1=9n6@m4tBe_o~1Q|H{L5g0i2t*ujb^$3uJCBMHvlu!X| z2;zT#4uqYGqYjhX0#6~xcbbWKg2={K6WUY9=`Z)bZy$foKRY?3HJ=34-ivbq{+(eL z$_bbIaaai%ODr#=V&hym*B9-VW#JQ?rR<}GDEUEDDieH1t;VpAWlw7fu2riOak-pR z2~=JegHC&#I>0jkKqpr&)Kr$@M4=PUnq2_1X1bIpWp;c8Ygg6k3Xj3M!1!QMde#^6 z z2Tc#1(jt9_n&%%qFOsLpz)XMx-ZNtA$WlQI?|QQ4n0QT49rkJ09bWKNJl z+&RhWNuTNW|8{1Q4)lP%W{dQA1#i_jU{KhzK8~7+Iu$k^)`!1jN-5HkqZM|58f8US z>H1z^o-QiJbwpn0<&40(=zxpYa?_r6~%f0}j1gaI!L`AU#>V0(sMA1$Ygraiu zK)nyQ*ClSG@2J(6Io&c9@Q%UC=^gP!g&`IO$6=3Ig+7)h#IU_2ZcQ%>ZM=w>#LpdX ztmQ1dNtHSs7xHh&`A+IErIkLD+x^i0imitY`g|Rqwo{#a0W;r56;g^68CAp)ybf^j zk}=iGuK8%gB%A>$NM3j&NTsd-jWHN1Wo^u+qY(~XJfJ}Hb?3ZIRjoZmii~q7Jr31{ z*ejAsRty-Hj2VOethN#l6G2WFmjh?|8XUyK-{R?T1_o^vJ5rPs*rc*Fr#(3-|0PI1 zv2{n;uou$mdlGliSd zA5?IN{$!5-yKJ>}s0UkEL(+jZd5UC7_vnWb3KF!p4oO7Lyt#BsOd|XJ!?xX^<*tHH z8XO4Ya_xEc^KINt-!%|DKr{zq!n4ifK-bWI*1wEs%Ke4s&nnVtvC{SGw=xE#ze3i* zx4$QzOoNwY9Q&*L;q}n zkY!9rhcPJRk@HKVv7^D87y~0o!v; zv@zUzH&kMn;Zgl53wB~3M4kPmki1dk-Wl8dcOwe@aAPf5uHaE903O8QBmVqRAgfJ| z)b48eej%6TV+=4p;I~>OY`2#+zh3NDU1o@aKfdq`ao3PG`czKwlx^#|9+$r6CtV^z z@ANxq<-ajW#M%Tg9`K6iJQVlpWHD%o42F3>Okb$=nOXZ`*Yjf*6#dv))VK$J@!Bav z0I6^^2e!WX&nSSt1RLmb{o6b_qkhkn_WbM;nrL|GZ~WfeusFvFm~ER9dYR4+iEfjB zsjZ5^&Qg(SLw0W}z0u5640 z2vB$)K`kuWp=@fI(wA;QOVjG7lU77&{z@{LF-H{q_D>_r`5Qr@XdTBMw4X|C3yhB2 zu)n}4$e(rtM4d2rTt4EQt*Ld1>)CZMy#i3(u)`WCSAk3|h=wzxJ(2xw zl4v?AL7rRSixLWm$iR+qD-tf4uxe%~F-pqAU?!M;+?7;C(Ld@(b;7hoXTnJ4f~C*GrF#&q_tlcyc?hTH7wz|Ngg;(J@BHN0!!#7vyO6rK%a> zCrj01dpbK5U*&-Vm9nf<)}dJJbDYf7XUg)H2$9xH{0)w98!X#>Cv3vSCMA`Yg?JKt z5X`2%1~!d37rV_-olDL)z5XxC3l?J0oveNg9Siox9wg3wJ#5{P5-n9sWc*axW<$C`uf8GeOz#jq!1pulESby9s8A@OX%K8?5Mu;}4nK zWhB`@6$)8z1kv4Z!P*+|3Lc}G=dp?*{VPo2K*{$akbLrrkN7wA+lZ+oS5@^sSs^Dd! zDc9@@99Y2lPMFYXeCYu@0fLY)xhn{%fi295Z>-ng%aG*h$Dg5Ya39^5VU7@2X^bUq zkkju}C+iH`s&UFM{}CK(3%ZTm*^g)~kXO3UZ7j;h9dL%JDjG$4S+CF1M&PskL;RdG{@DC_zKWeLp)8}8ozVi(P>~OQa&*ONZaXBnnNhR2s zzXx49Wcezu$aIhiKw;Y+H%`ba=$w|Hs`nf70*A*+tObAx1}fgKWj`pvArgA|+QE-? zChVow$Go@8<^uOkM&Bsb$)m-7*-5=+rirg;`cGTUm-Q{vlam(w~1*FE&Tf35F5nvwR9OU4M{w>MZ%FCUqdGr9;-}T*d zlx7CC9kT}Kc92Ez+$8EC(EJEud%BF{@l!GXar>VTMO7ewbCl~Bs3F{0PLFB5F95$) zMutxjg8E>nF*cxrw2#BbstK$rcz;Pjuk@7UzFK+7zFN;ddZpen`r4`ISzypP7Ngu` zvGq;zM;-ouj9|%A^9H$1rYQ@OV(u5_3^tak1B0BnxP=?n2=9+M3!c{!igz$&uu282 z`KD_l$V?6DJAGR7+Wf;nVdt+UAzJjX_2!eHD0!Z1-T!btfmy9#aZiIv(<}m_x4Uo4O z6^w(=i9ONyE!c!Si}PAV&fcUsZ%-#>drXd1G@&4D&?V zX*ZLk&=;QT12i*0G(-1Qef0>4pPY&1!8=;z>ZqBv`Rojo8nphpVtKrSqxv6J;~m-o z*%oH?(TAyVo(fWx!#9f2yc}<^dP?>qxYnQUJQ=E!`K#vZ)2Lj%d2OHX^pfPLTx7MlH$8UGwFi39Uz``?81E5({{Z3W` zuYg2Z$g&>4cL@5*RI%`K@xW>Xf260uP<6$Lm;5j4s}o-~Hcud@r{#Q9Ni~KR3?Xlz z&!Rhy-I$~kd;k=Ro$KLu!r+BRd=1=BN+hkHy)C3by78XaArN%GM|%|yVO##53e>0z z@mhvj-BLuoDp6t}2Ygk#uUfCAt)pzP;YAaK!);E*e9|E?wZwSKx_VO^aBgf2i?1#tAyt0W|4pC12M&o2K2l8wC08>bFSee zzk;4uyk_xxQv-g?qT(Tt|4MP<5CTCnA+>j4yuicmKjqYYwv(NR{&%%BLptIFyU4yO z&MN9*vwE4EeE+Pde58e76T3S5aRN~214ks}glWrwocGbO@%Cnp77NW+O%t1aK^ux1$U)Isg!tu0gV~{7s;<;U?O>Y>>@AG$OQ09 z>7A`(7Gn2w2*^spwBG9xwYozdvq*LDK=xN7`3Z>mq++ZKRKmDZi^}Yn%{Et~&>@LIA%J@7@bviy zncqNF>#I5z=FS8XNaK+cb{k|aXDjTTXak`4u&2xNbiA8u;5GO=dOdASM4OAxxKM~? zns~R9`=~$1H{y=S;=kPDQb;iT^UV-cmsfFTo^`y>+6{M?;n1MPLP(lew)0yBSV&^x>*A0}&BDV_j03Bt-sVQ1! zA@dO${Kefv(T!ZiwgnUIG?*}Ze4*$=Z5KWvL;*(GFt5krB;i;F3! zg4msf!*<$8la=fras}C#4vMshsFiJ0#AvLLCJ>|$)zuZtpUrch*kx=C9ufHE<7AfP zXj27{52m*l>R%Hk7)Y)Qq2?NDPQBIGV45WzrSLUVBLn*2|l ztA8ek5$Fe%a>?U%Zhe4XReI-rc#N!znvU4&lG0J|~2<>CKc|_35u`R*cY> zbA%ij|EjWjFd1zF;F%pq+{z8e{CbAPUB0?@5!VefaflXh*(&*A?D4R_zWmZ5R9im- z!&JB36Y&H6SuocXEUNa#KGGV3T&2zrMvAJD=gs+GKkkv_?f^>z0#gX);#&Mb=zZqO zhShM=3At&UEko{`)1}|HWZ8Wni^9_mA$Vbb-mQ7)h@1bDgL|$@z($v|8EP86ymV!- zRKdx*A6XsK8vZO*s5@MJ@6b&IBJTo5L@eoohUuZquE&vm+{zmj5#E#d~}h7V2iR0FRUYaObs7|)2;Ya z!b~rwGL8gKRhui)-c*?PerL3vo}_0khHr?CNm^rk1!>d)_$P?jNXMVoyoms_03G;7 z87gRVe6G+JJZ(7V=mGMTY2in%MA|z9&|8Iz8I)xxlgcELs$6M(FJ9N~`ZMoXZ_#x9 z5{RPPt_CYGFmLiAY+M(8GXX{3bZ67iJB4b)FJMOJ%*uKhu9VBVVbig)YVCeWn>`VJ zGK$Ko358oZUs|J0YQa*b8fI($0N{u#JQ2>A;};LtV{&2zMdZ2q<~Bnf-Q%=o?Eg|N zOgGvdfi%~5IREQZq0a{FamX@^?_7}fLRHhPLpsPq`_RfbX$TNyz29iVkY1Y%(|W$) zF}>BBS|{W;8?<9*y&U8`PW6-*2a`#Kfnz8SvaTC|!;{reDEhQ#c2`Am$Ht}3NhhDK z^9}>8E!lv>5f72gGWIXBT>=Fj^NmPiH~3g@U?=vI`BK^U&{v?tqW1K0U&iGzHr<*I zOv)H{5U5GW`RfBA-KL;JtBdv~3Dx8;I{3(nHd1p@bbjf;_TkDFTE{7|@+2Lf4{hc^HZzZ^<@HH?;VPX`)SVwK zj|lx`E`b?(`rWhcpW+0zxgroOn#+9;myl(xBBG)&M-Dk!XeEc0gMo;QQJ7n<;{R4O zTyy6fP=;Dz=MWbc3M_J}h_$V|X9r^u@X-Rv4IW&H|Hr@JX&4JUZmHDz0IQGx@yI@_ zHfhYN{@j=FPwL*8{%h3>>6>nxd(}sL;fCxCR1!aJ&&r1EGf3YA=7Z&h5s_|gO1@dX zUw%qy9wKHx^i^F=Yd~IRb5VoEa2XpGlsRd==bmBx zc?ls|Umnb!&Wq1rbn{Rw;4>ZSVs*GhKnBD5*7tudzk{KUOf-fFvNrK34xUQ{<+=9p zy}Hxcf}v4<9J@gmJE``2dKe?NyTkp%S4Vv%fz4B;r?b07)3LeM0)teY0G^=J?|2h zHS4wB1`9}y2h0#l7YXSYYomhDu$8FSwk+>$svB zn~E@kY?@nmeCLz#k2wKTsTCr@)~hb9?J0_=g6E*J&n(5632aG>Wf*X1^HGhUKUBsT z!)Vbqvhk%w2%CT%cL1*ajP^OZ6Zn-)C4&H!UJw6nKD!eUSCxlD*&1} zPO6KIPc5^}Q`0J|cg}i+fzhnJ$#lhfscM#I@qV2-C`if zph`7Pqh?UiRtj@-0po*ziabf@E@i6fpptC7A-zD)$lIr2Nhqa-2_ZLTkNWq=hq?)I zHDrKY@+(pffAIi{yN}R%8+M68my^ooNJ_{A82g~O zH9i2`@qFF|Wv~9pT@cAq+ngr^9K&dKv=l63Rj}7104*9sQ zCG^_&9-%KCj4e+;0kP-fXMa4i0E*e(uqZ;58tZvj$0JsRYonwRWi<-b%dkkLU+U)S*#b#cQXmUDXs!d#RScf9~?Bu5iuBg!!J+*k70 z`K6$8YEqGA3Q&Pf`pZ&cmDq1rdsDHL!PQ_519E^dI4^(>%Yv7nY->*as>;Sxz#(8A z_-powhi5r~ssKGSFYg`9^(R+1UF_e@=E=9tlF`p;dS!-qbcufx6y<5DUxO4vi9S9c zJ1?YOVLK*#n@&hQ{`Y!886W57&?8~vW<#|{2ia|#MY)d&kP;P#Pn ztT(o+LnWOV>^k+FtggbbE4l9$_?9T`o+A7sI-1V)l$}3nHjiW~l7NRpoN9uO)aHK} z$Tw=CT!fk&+&6*QeZ*-|nc#-dcox`Yf<1wymMaw>`3LJi*H66HxtZGA#0U~8Roh}M zAlWoxC$A9Wi^;DTnEcjYa42m3)>>0nqVcvn?FG5Xw8~mj1NPq&nW`ig2{`jrta-aa zpt`A%7o>0MOR?WT^cqQU4sq!PyKFnxY-?o5Mng3>LLmlNHL(fGw!NnR0ugtIQKfo+ zAmwA2`KfP(qpn-d-vXb}mMfTs?(3)JK6bbNq!X>$vQjx|bq7JFpevuG^@Ns2a+$^z zYVn>)^LZUi7|@L$AP--AxMn>gX30T)>)s9l#XWc*a<4VHu0Y0bRGs-@AKvlU!#*v$ zE-N4e<+_gqIlfq1nJI+BpLIC|3PYx{eO?n^?NleFzIiA80c0hX3Jw)#bY!bL8hj&{ zzBG(s`CX6UHE{=`A3+E)`f_P%i1S@X0hc94nADIM*ye-x7ch{|N$+&TsiQ58|KR0g zYozBuAJVlwZIvTC!p|WJalm4N9k1|39ZqOJg5Eu>PqW$A@4ZI#^CTNGPSWO5%uu7e zcR1A?ua?HZ&Im(sIPQ(#1|;8Ry3#<^M301pe2Q7l3Tr0W zGo;YH1shH2oO2Z`*5}h}z%hQdA9U60zJjk-eRMM*=LNk)gOkA_NI0BY&>GQ)Qm`#FFcWoa^%rs20;48gZi2eC2~LT z002MM?*Y>&_`q8fEn_0VbrnFbe5zA(m;Z%Y<9f*LbSmY>9e?u&D$z9UrAMepJeM9bd z0X{$L>D!{LTv2_DW3;uam(gGq@D@>wduE7p1&!bGy1LE}&ulN4^h_0+N9P2nyr#~g zr7@CDavWM=BuHbC*VeET$kLCrB0YRMfxoZoVBJ`~FaBA^<+9S(yytx)jfNC)}>>v1X73eL2k9ZB2_B{g&*!Dk-|TCT)l z3s8Ho;nq#?sZh(_8GQw@Od|+2L|Q=Y-fYY|dNF{A)L=j%a0Oh;V5=rkdjW&Sl3N5& zYTHTiG@(F-+5Dg=0JqPxlZxHh}=E=8V zhXH9aG`egCJC#Y_Rjbe;2A6Pt5HCDDA0#)j<_|c&Gy?{R#g? zl1=(lju`^X?zZRDwD`~c&dVAUI4JmWRF0_BG20A)P^ek(22}2-8VSL}^)n$9FU>+z z(2)YM#2&Ns(3lQ3BzF}oT7Ys$tQ}Nr4(Jj!4f!YVf)7v)+k#yBEk4y= z_%6s;T-P}Y)!uxl>P-9%&*7EhLuIDE+G*|;>r3@4J;%u1?V)!$od0lgK>I%j${&de>N9j}7Vu|7&sdnpxkx5&h58nG0433B}shY>SZ2EeBJXj@mMq|K;ACnHNo^_>{yI zI=6dxc?^_azCtX@jc1jJEpJLcd<$Cuw+0{MNmYKb-*A5iG`)4d;;S^eXd7`x(Tf3orTrd4{80E>1LhUn{e+3r zzs>HKY&Yl`ER6`l^+?e@FsIEYpbP`BUDa`Evk52*9PR2!4-f3r?D(f$un(*L3h>mQ zK7Yaf&&7WgrJc!s7acKc#|Dgs*X# zHHt)glTp-S-@uF(C^C|&{vUezZ{GIcj(rX{?O6orzF;^H7qP|vq9n|mv(D1Bb?au~4+th2CYV1E3!x#QMmxNy zMl%pnKkBTX_Kqy;u*OvGj$|AtNq;6}jKkpR3qUJ2O$gLx_ltxZXF$ZtHP{U#xyoYH z@#-HGj5YowC%zX;jmiUcpNZpQ^SAne_232EW*x;g1P&L`U_{cPu!|7FZ=bm1A#H{n zLx?mO_6dpw-c)7bHQ626|DBgsQ{A_1ft)r8gqBgft|L=t_d!tu}$UpO)J=c3# zoarc|Q~5m=d+^}~YU(okeqwKezU!li0HTi%(QCcJ0p^`&g^H;wJ)xWsUYx~o9ZIBk zbT?Uk(_dxRj3_(m+DENw6Yaah*Rg$QNoD38%TwXJUnuPmO|hM93h%NPHEyH|eO&Rg z=wH>T8Kh1ay)7|5H<7!*xOHz3^KcXzPBREpLCeYt!y2YhPOzX_lB27OMIpF$DW znI3cb1sw;s7$~hZXv_eh&lK5a>LE`nz+g5P>N_o*ELpY`;qrs zZ{^q1(Euih{%eUniMR2Y9Gq(!jo8eya|0GbB>4euROzti@YRU6iiYORo* z0GZuJJ#RJNv(RTS!TF=R>L0NL{h1sH5$pp54_OoVNC1_$0M7$j7#6R()~Eb>RXsJh zP%o^xInQfri6{G~wGCbC1v|vq*yjXi^YVOrc9r^OsdHHr;RkFTw2P@fty83g7Mt zIzKcyjH;ETB3L~9MW(SMkf3AmF7#jhueq)>a#JPf@bz-dp@VwaH{>%Aofi}q4p{6~ zGl7h@sZ0gI&ph#X~j+YW>gOWhJR9x?{DO&-K<~z%>b89VvW(-j+id#^$ z7f%Jrv)e#GN+BP@<}WM7kmq!ltm*A+p1F-S}Qr7t4+*3f1U8id;xcQa% zZah1dH%E%|+ znXqqUcfPY$MCAH4^67^axbJx`z)u=-+T;OXpkS=Sd(N~6TH;#*!5I6K7s_LJ(}!4H z^%aXZ?d|?iV?IK4%Y~?YA>w>td0E=1HYe&~rdE(I`2y#g~kF6DM;`&c;#0ZONX>}GMy`2=NhkOfO4rX zo6)~twdf5z{eSN%B|&!Jj|~i_u{Q?+D9XYb(62k&Dscc^4?mYF6IdNWkE3u>$?@dwehC1l^wMiD8kopEq}G~ zDTf;U&mAC}6(%uV14nzEj44szBN$d1jEr~r#;JtMhu#mMUbqLmZ+@;KxaQ23(&>6f za;+J55^5`d^I)>6+Hf${JMvMyORH%e7Ml0!VH~9j-auvUBTOfTk3@wWWq$IT z(nW&&8&J2x=%VROp}|d_0~J+ih8IbU`_$ltbPwAr(tsksR|tFrk#Xb-2Y|;|$ovaz zsCGHdd^#HH)Yc}^dl`)EuL0iq7Wx7C?oOffgW9s=MriiAklr;&vUT>R=U$U%Q=!0&P`xK#nZLbJ{I3z*Bs{auHbL+-GRhir&sB(?^G*l_>Ecjdo@lMLZkO0=7v=8;slEht_=}kNn7Hp2k3sjpd*$zNilGCA zKu98Q>v087QUIz0tH?tt4zv!h3#>V4q--3@=aV%LT9@rf-YfUNbx%Z~u-KUnT; z(t+5ei`RA_`l4%e`D~myC*r>S)E{gAM0y`Sxb0~y$> zPKR_Dw1;UfmhohoDvj5J&TBE+bc)6KKp)r;TEmy|XPG0CF$y@)X;4iB533qhL>J99 za+7q(^`dhOUBb|)qQc`{$5`N<_Y)b`fd zW6+`v%Ywos^0ut9?997qwz-=q9gneX#5Oj1mavM&Isk(|8(^BgZYM&Lz^Q~TzDKCE!rzN36>00}#qc%SkKlT=My5>!`^akpKr&F-kKQV|3)Gp8@!Z6XV|DejRQ z)`5bO?Of@HE41E|&xdloN#AmhPH^#AgQhkC{ObjoE)1S!Y%n*wJxM^gV97=aNLSfp zMd^$%NKIj6svNf7kY+&*^<9OYwG$&7`(`|?03AOd7Nj0j5$)yLYVTUq*&@_PhPxbM zj*ZH|XwsHhr4OS)VTtIgfH?wES3)W=&6M-twS7BpYHu5aXaI{f!_6V_YQ!oUl}8?t zx8vFKHuUpUhe6peN+VF;Oe`VP4PY9tFO0hMU2tE{;~+0!>Yh+Aeuiv(+@(TI;~nY~ z0!4+u=b0(6$iH`tOt?J498?B)i0SGanZfgoZOo8!V_OPnR=lz0>>cxFQll{8<(R&I zl9S=#V`fZ_{oxu;?#!`u+JO2muO8H;txiy-s44qndwiI%=w4B;KxWL`ZG~dZ+=bZF50eh3nmoD@pnWI=;dXO)4vDh%Z;vVBRnV1un;T)7^R_)bg8mQW%+cN=)q zulKXk0T5}^Cu8AVtjK!k9;OxfV|sd;mg4Lo1ZiQX03S2bPxNE1ZAE8E!_85|#IhI9 z{})Gbc7o{yg|9eNO2kEk=)D)rT(wf8AyWz4eWLzar|8|JqXPGEiQn*>18owP;NYLA z7aF+|*)Hts!2T~>{-Te7Fb9`D{Ksem$o2QjwU=P*$Tru7K1x`RFjGeU1$CPOkH4`d zBjp2>@g%gZCu!RA^x~%l4|$n;*s#L|iN;$vB#^af{x!kuXWx790JowV1C8OoVH0R} z7q54k?;^Xl0H*^S(D=(ye7pqU(>#>9I)RbjORL>VSJoV?jSS&qaxN&8SPnt7vKHXk zD*+KVAIrWp-=bAudR&a+Bo|i~H@^8ggk0MOWeET4&T~rD5rYr9vbmR}>I5}hxgeAZ zD(Z^%_*BQ&1k?TXmNMbUrlXZ9Nwe1M?_R|gXM1okt-`RZ?d=9z`0o(xVopuvbf4W+ zF8y|x#V*eqYye^_z3T~?$eV%8Ar6OdJAkn7`bIRe=jK7M8r2a$PXgQ+XeZYcXlT@d zXD5y66?TU@DZGUvKp$)+@1o*Jl~cgxLQ zHMTu}Rj;QggG{kIx`SVHz4^ym)}-~*+||cARl9n$&MQCs-6V44MyEL|XOeb9gsf?Q zLU*$7;l1rxK>bxXb5+?{64pWdWgFz}HZi=`F938f2bae%vp!bVDEh8RQ1M>!_O%8r z=DpLCDid33KL2u9U|!AVrpNI72uDgZ=tr4vax=Q?c|G#j0GKKrybISCxpq%=R}ipl zn&nI+LzVT{=UzC)yrm{}59$&ZGO3 z>8H0xf&a4d87N~=2n4~uR5faB&U;hi`^`?A`svp6PbG{EA?L-KyTvr8Vq-R2I~|zC zOvFDYt=UzPwi^lysKSVt&@%)K8-F5ZU;i;<0bs;sszb(J{*5%e^Q2Ap=^^fy*V!Jt z9wXsbtV};D71Z>9DQa;8<0oqq3=(;``K0aPH0S%OT0||aDb=p}qU^YD*Kr^x=Jw*G zp*rXeq_v8ACpn&c+W_&df&K6;Mo_wQU>C=*7}pH%{~IBa zC=z&7Ke(QdN<<$al7$(&Y~>t6`co`)2c8JYXeFpLR){`4FRH=WP%qpqWVR1g8XDE) zW1P{`28ob+-?whlC1Cam4Cl6#4sj!`;?dQZZ-fYkTy1zKuy)*tdag+hzpT&>HWwwM zek^pjL_8vw!0j$V9M}4li0rar_RuXL+3YhNl{)O&-#d|8(Oht|G8_(k)`%RDarc*% z&0CKDOBA;yF7-kDGHLMzvuvPRi_I1d4d{koJDB`w1m+n>xkbh4n`w<%M zFVG7ID?lH{@Oy4FlU>!8kKRATjEO~M_2LbvQFym}UPYCHW%f%rG@pFFmK~0+>wxwK zm9xBEgssD@;0IiT5MGdfJmoaFuV!p|5)X<3V5RVO-?F`$9zUOO>G#J5+QoH`oj(+x zjF-p-hQho|AI}TA9K=pvOk%*-?_aDpSJK#NIO(LwJR!8e){qc8V%3rjs<5aV!6v+s z5fQ_`#>0F@!(os-rGV)a#)qtsBMNY!l!QyGoJ?Qjf5Y(?*@h!dhm*^W8G8B|`ah5w zA1zz#t%qSkwGl>J51ZX>YiWGH3BHQj69STS?@-<)hffj{zzJ4MC3mwzLGr1Xj`vs@ z7jR)*oD`10Y69?JngS&{rt?T2Zp8-ADIMh3Lw%+l@6fO=+AJ*1R0KZ8?R{|kH2IVQ zbc9GP$QshjduP)rZasL<9~55M8sFc8>GwU_?#`Dm@VqNwe4zaE$7m`gGStO>^BUu)Pv+FQ*bVJDhJTP_&ThROeki^3g9*ci0a5@|!Gi~HazlU9?Ap&!kLXE%Cpaq*42RvVM?H_2=iHda zXd|Bs?yv92MuT}S#q8v&MeQD9h&3Z@xZ5aYqu(<&E6b+biLE`hNL{y8CqrtrtR0Nn zgv*a4NrFqy4!TU;i6kB>HNPU`nFb0NjNrPb4~wTl+f%L5wpn=8p8Dm{I4IcMx!K-D zme=;*Ij*zlOqYo#=9D)Odm8zOAFf3c7I>+U2jn8~bxaGKaSl>`p@08>Iy11`@XWXDXQ+}advpEsEGs2uni0+wT$|;C3sBtZBGX;B*&B|wiPkG;AK>66Lv}v-mWmLV zj+VU|y5(1Ou$L*}Z%t?6O=`y_WYCk3=t=Jj($TF>o!hVlm^qu8nkx_@zaE=LJ4ozU**5dAM_k#a^LM$&|n z-QT0yVSH-wo^w=CKOc;FJ91yGgesl{{ovQyAZTcmANiT`vhh(ziAKd#0dD+FN&ZmH<3*!}U(#um z{&mTF*|$%OQj+fH7VfuOZX<(jeFmmusr_~oCT)b8h&tGGaZ9vC5g!*Cu%lvbU>Ki^ zMF!j7a!!%()Ii>QHX2%39K5a(COT|2uzF^bfVuIj7$e?+e5HT1)%|T--M>X$NeK%J zzvUfP)K%LtIOkq66hRS6g!m;|owAp>25!EzcRy^lYSN#g_UGzr38F7(F_JZm1jj$; z_=F1WXQnqM1T|#LnEG=~253{pw6#>0BoU|`@plW0Cx@dJ7DwJmQ)Iqccrzi>$Zb4X4xTNsoN6&wmLSdt1Y&Bg_dgeOY6y!>Mxu105d0q~ z3&gvbzSO$*FP4QAfD0P4W_f-U_vy`t0y-M4P{zO<=Wusu`@SUgvyRbdmpZaLZqui+ ztAweES}*vZ=Pk*NF|^?l@9`rH_OzTJ*L4obpfjP~TI0Q4K9}Cp83cAB5#hfmk8vkR z5@j*JEbe74w-+n6n}5eKwppe1jju}xt58%=bARF@)mwY!_)EDZK#|HUq-?t*e=x_{ z>^Dpm31eWS!p>pVOO)nV6Y)bwiyNor#0ha4qh!Oo*ZWlj2@C49avu9~_>1!FvkC1S z-~#p!sEWpH_}uJ4RQ4rqecYahlZ{RT3IJ@-kINf1*SnOvJkP8K~_BO8&DaSi?)D-!IUM4UuLHzxJ8uGL_RApPEzb=sz`ga-K*`ieZ*ZA z^TG*W6Ov&3|N2HmF;*N47oXnhqp%M^BuM?>eoUPOoy?}>G_P%LH(;TM-c#5SoMmRPP!KRH&z$St*%YYZU|V3zxdo_5+-T3Jy$67=QNC2Oa>CK0y+P|vJq>QF zy!Eum8_}gL9699GPE*ZOp`YuRA-N%cZA&C4B`qXwALzwcP4waO%_AaXFx=PYv%Xi# zX1!3h-sBDB9uo6e{@zBm5m*aQj;xj9G8wS(D0rRaE2m(d8F08`TOP6{#Z`b{A5y8P z`{rl!_o55gfN<4=v8XRo6z6}Yk%vP{Uuvb?+JB*m3>G=;A*vqq*xb$cPwaLLdWSS3 zzd655{$w39n?!%8$1K(bC)A4y$Y8yZ)CpJ6_1#(C`Y$G7A;eYWcD0I%XISit0>u@@ zsP-cZ8)%swYiRwjvx5*L+(db~DSNv){oIO$EXNv*1*oH!SbjP*#AnI3H}OwHXTO;r zfAiBwg`ocb^XY>deX7MX=Q=Nb6jtDp!FRq&?NKEUi>%bhNolD^c8BP1$iyYoe2|MT!4cnB@icf}Zv$2jKU_U~Fk8aLS>`3LpiiN_GO z0vRGq#c^Z6YM{6YH}>Usx0Fw}m`U^MK&hPiyX34BPR~c1orE0Bo!%iH#Tg|1uF69t znaQpw^DmqVUC73X+DzYFkV6~6+oM``8eV)|Ak6iEedtm0TclvxW8w1Gu*l}mMIoy{ z(?fiCEKk1qrrBa1(o4$g*m&1kzg>U}m%Gn~Of#f+qi<h;b!h=bH^BhnlXDoqn;Ut^{d+-~kc9m77#qc6X72go&LysT6VvXN-2@OT5270! z9Dbzn!2{+8HhFQb0D=$LD&{8b<#&cUOtDJKd9RyeD= z0tQmrjgwt(UgNr@)v__JtQgS<>lcZjrYhxOO*XO!YwD*!1df!A zgmr0qid2F=EP1LTyE5Q z*g@E`Mz&yQl6P^K@wUQ$0bd=*|2yb8wM_YE#$Avo-4BJ)K@A8`2GJM($^L6ZMs!))%JNJMP4?)I&!G6tynq2@JvSeiiP+a-3iy3bG9q( z#70J#PTDkEr2O;FO@10Afk9l&K5k6w`aZaEl+jUO8)+?KG`V1r>t)V0rZV=#NzqEk zUI9~rz1A?G{Og2Pw67{2N%3ooiRq>;#4t7NlO)>P=$x}Tp1W_T$o2`e>{jFpnRsi`jB|78GM3mb%(1cOQoT#icz}j=M|v01fR$Kj*y}DX6bZ!!xgy| z59j^7=c}mf-!fJMOtfh4mmIF#BEtJls1#O(I;w65C`U2WdvB!sQ2~Nf>h1E?M0@zx zpuN1kjR^<+XQwB+*CnuR$4m9w2QhOfctFI~hXt6q2Z-Qz^L(K{`e<>H#cUz{Cv;hi zGvxB__1*BfFIAYVV|#)QBw_i$t0kIj5*JC#=G&iAETJi*qq7e!2$%uaUKI79#1e{E zGgCj1_(s{`-`?{0P7F1xZ|5rBX&ZED*fZ1*u&M29Vdm&LY3a25PNSkS2fjk4$2*PI zO>aFi>2lGFIztsO=D_}zz}s6cq6lHI(P&lURc2q9W!1r5TZP{eCL`-!cQunGyD%TBwL_kYcP$FCFT z-C|2%n~Kd7Pgwjx$M|5&gSTJy!`(D{)+bvW;Uncj_x&ZcKZSZ}UD4lC2gXf-PcHfU zIPy5|45n8bR^L(d=g#%;nL`*b4vmbig>`PUFzmXH9YG%EbHl@Qmc&E{qc@8#5CrBJv_Cx&}*Pi2=%nIjVE@dp{5oNS}vq&?iT` z!{gukb?CuW{%kJ&YDKcLvG*uCf2T7i)SChK?|H&iIs3Wx(9||t&7j2NZ%so_!sa5* z{zg#IgnskQM|v3gh_>Pp=^H%6F}JnPt>d5w6VH%p#lMYUUV;sg_XcOqvoNh#fVNV& zNzwPulqW5MPmv|2vwcD+suZ7g-#(44>i2TcT!<2)5}v3C$7z=g@+}7zG@^qe#S#Y! zcIIVmTILO+1}4K&iSFhaPAGZ@H0GnL!gjR)f*+f&l6|qZovv#k!YWd1{vHe((?+Ao zdZS#=-BPKW-mfpevV@c-dQC_sPTfIa+`ELNb+d)@P3R%vdhi`G3_Tu^2sY*mRS$Um zq$oPHO%ENy2v4ry#Eova2CX_|@mW^O+RlbHcg(b)@$0id8REz&gqhC~nUKn zet^8fY%MVWr6~$KaDNhx{oU|gDw)!C%DlL{E&`m>QjZOv4^(!*AbMqhgP~`kbRkA8 z$`!(JRNEilkxH$vMLEUT^foI`!{2)Gn?8J01T70<59UU6;Y>Cfblincf*wDIM2&!w zR(_R0E2NU6P5)mp*RWASzjqp!<_js>2gfFMw@4H&MU`Jm(kv6*Oi3IT1(Py2KV|bS zB|_v)7Z(5rl@T1N7+|O0=F?jRTf2AI{iJ;p^QvAMsy`N2JYVjChr!v?n}wj^=g))< zYJ+MvZy8%bo;N2u=+h$P4g3!ePNlC}PW$q<245#d#Sl{9-+C6f4EBfZOVg1e2Q@C^ z>7;C{51u5Dch2qIJPcSH)gaY2 zE_Zb&?U@&9k+hmv92ia@H>~8%jd z{}UJ2e=Jj*9R53pi7wfbVzXpR#gV*Iq54JM#5kGsS#IgV2s}^?{~jm-gvOU@)j8Kq zyP5ozFW{C=8T-MlvBg=-i4Xk{y5p~3?N=(B&1i?mIT&sQsEvC9o~#_q;;Wy_2mk7Q z-d>SsHC`Hxx~=?%DG~#zm5)cljz!4(aS4bb;Qbs@jh0evxr+jsc_|+y=wHJQIPCj@A)p#N9`fGkSW#pkF z7Y_5Md;PWN08Doj@i`e>6zzF+*SmSMH;(>I4BTOr6=31j)G|&U4a==#eg~xv(x8aw z(ce;3c)SZ*zu3;FK`gCAd5^SR_sPC$!s24Z!?fdUNY!9wcuoxViBP?618x1`CEbwM zHI#R!rK6eY5k!^8Y1xE?WpusAFAT0%;p{y;;S$82Uh8!o=sQX>WVAWjC+}v{Zfl-< z1x|$*zRI|$N%D$jnuaF9jgX0tH_3Bu%LKaX__>}fN9ehhZrk_}TsH<$L1 z^lL7)0VAa$JKYHWA@-6170nrdRaeq9aS)q)sT1P|{Y3`X_7V%{I?E-sY*$a|b)Cfi zgqm#ZaT7EbblMY>bkUY?COzEOA~JP}tP75Fs|-B>W{b`b8ew>GcvfvoeX(=vpLx=S zzWsJ9`L0%Rv}w7ze`@%Kt(;#kIP)au0=4_>G#`wt>%<=+b)7cGaPLa z|K4njVA1o))&IwKM~^^3 zHgf!Gb=kic6#rvh;j|TH3wFx4p06*Ew71%P@Te#-j%RpB!T6rxeZWv5SZyFfvsq^} zKW~tZi7$cZpP5myf?1go_({INRMX@cK=BL= z?*ka$GmHpyxPr zJ1#U_D>b*;!UMf%rfG4XxZAW~N7a;6vL`Qii1qWo4#QnVUNt5`FgaE9$BwF#_nPaP zT=Xg6-xh24RiSC~In9w<29e6n58MF3U?0`}6!^KR&6_VUF3(Zn=}%oDp1x9?c1V5h zL5p15Wp_Tw_9&Q+XL!%R_@3c?#-JhF-}_jlcc1^un0cx$agSo|X4#Sh)o1UwRMtBp zC4LlK-MtEJ*DbNRL}^p#x-9l^_drh|B&qA%ov)j>wQ_uta12)!fXwV;-2W1WyN7#- zJBdVUT%r*7c2}OZqOOy#vS70Ls<{$_aBJhLj`fLhtBM~FR|{s(g+&JJf%5wLl2o~b@)BL z;Gjo2y}i|q&KiRY`9Y(}!wblEhadC<;zt4j#+sN+3bv0MY^Q%_L)oWGN^!@yN=l?y z{hTc6&WjDjRW^Rs1vEPDc|~m}QZA*=$q%wb0uK$(4u_N|?YYa9h`m;uzpSS7PFdTjd(D>xCYi?3)aJEx`1sZQk#Kr?y}n?F zE6~>AkL)+52?5TKlB=4PDS=2O3%Wr3O!NINRn{JmgT5U+-X*5oqSz9 zAk^1q?(iY00+$a;^N{`~yRXICtFkCu8^|Pt!Z)FyLyba?zRpe-=91X$O#5A2-1Z+WtQwqy0~mP1S?;ijrRFRG2aL= z5IpUxr?+BUBH5@0_h(PO?rwP-KLw8m?kaBkQ0(jvgpiQo=^z!TZE~v&9*bkhK^eyJ z3?mtg?->|k0yv~6NS5zIzFQrBs`x=40~uscPU&#<)HS*C1;%y9>*j2deZ8g(^glXY z00ZZZ1n!53AI}x4gW=b&SC{|1QMUR>4YYWz!4)~3p2xr&$=~pvK&Y+L@AUKrLu5k6 zpab!PKM4kgkqXB53=D4?z8+G;wV;Ab8b~{+p1WBF?jOZfY#pCOR`-GaY3KjDxXcgV z8Q&b=AO8!of-Xt;aU!Wii$BiJlBFF|@4wo3r@XDM+3ocWDa2nGOu;iS3Yh}_t<;K&RllPh*O08-=sbuHz^}Y&< ze>K?^1H(uL<9h~%SB!zo^pafVa0fIkZjs6km3;W7VcYqJ)kkZV<*0t$ESr@n0V|K^ zCIEtl@dGS85AJCr8wU?-QSGVG6Vk*2KYX_Q(aa19uDd)}h3~NaLc^gO`pW{-BbB|b zdGIm#*b#M?7{N0zyjn26XJB~k7?iqRhR^(gkh?qB?(m!KKAp)^+vE}|ZFkGt&J?s9 zx@pKbS-19B?YiS(TYsW1agTCNmTd0kA#HY+Z1G+t4&;x*8Sv|oTZYpG&37x>gi1TE zf@_)V;YD%y4&iU}LSS^x!0?8__@05`tpMe}fh>r>4E*C;h+)2DDD+a90RscWD*@ws z28Op9!;?Li47`DC;MtdWBVU7of#Jo$_@04*fq{YHeaGX+{}1+e6`9T?^@bI&`m zW9_x}iBSC{i-Jgq2mt|sA}=SU4gmoTf`EYh0uKfJXC2)b75D?`qAn`|Q8h_?419q3 zDy}RJ0r4vi>CN;5@EO5T?z0O71WDMxU&y%qYjX&Qzs2%W;+mdDXB}ZWn(|$j?|--- zg)ciivRy8{a?;fxF-S;Uh`$ocl3?*G!q&l?P4YAHA0m?+(H>^GOir)620!YzW#H-$ zvFA_EJNV&MEVsFzE3}=|F`obZ8cM)vF`g2j>{9Z6c)INSG!hN`18EeWiQ~(l?aXq) zA*XQv8=Dgcsrg{^@*_8F)OZ^ED=zF#y66$O;%m~JRQYi_#)zv;Zb8T27y;O%iH@7M z6?UfuOZ)q!q*80_jm8}oXovM*mB!yq$l16w5o36=jMpv8d+YylegTFQ!Vi+R7*F%# zezmpkF^6D?@b#7`AxJJQU!|>Bp;aIp#B_O0ynUs57Jf9-yBw_FxeWTf$e15<@mL{5 zX1VX%*1O|eMzfGS+w~UZFQ|33dd&Os?%GpLcl*r=r_v3h^0hoL>?&o$?1Ch}>n#!; z->#G;l`_5+!e_0zm3YNdG({?GkWpbeF=-PGhdWxU;nRG*N~}_OJhmJ<_1IzYv8@qX zEC`rrD&c<AE8_(by+NNss=F_Z z*;S>S3*~eTFnUzzT)=ue(FjdX>_(YVW6cW_+47U}?c zl^JvoOh(m9b=V_kbHSX9B9{NXffLBis|mli#zuuGkQ$Ch*?gdjdKZ-mk0E;phL?-X zrn{-EN}_OzU9S?8plGp|;ej)Eh5hO_2=C*}5O!-L3$8JcrIkNnWnUBqj<>Fh^M9x4 zn^zccG<9&aSh~L|8Ox6uB3o+StgdZ0@V=6`p4{~!67H8F-m9$H zuCAehVsr9_)-6E|)QXjWhmqN%hLOhLM-q>5`4DI@KO2QgDfdO;7^~no049G6DNjmb z2D`8<3?yX+CCTd*4sM5gj{>IKx?Ul4U3B0qMMD0>*MbyVKGeTkJq{!p zy5;eT1Wx|DLjbp^F6ggidPmmjE%e$}I6a(L9;L8_*^2~)Jh(>AD3-PX<~him2c}=j z{ig>OMureL%vQpJVhq?uzQ45>roN1|2|7Hw3j#CjHd9KN7ITl)VD0eMZN z@zHvad)8@XqW0_0>q0X1#8%+hJ9* z=<^bx8Uz?D$TJ%Xdr>?~_3MegAmR~jI787Yi1gQ?bcxIg^NqN2@bR!WHUxH1@5}W8 z>GKtJI`4CwOccRsG-z;~Jf??|(*oAqvQl)-M1}q<>`>DF1eR3@boHzN3k*;5MrD1g zdh1``8Ndm6o1>ISLW*prBb%~__F;4b7>2{I*1&U3Ex}e!5#w=L6AB)R`-)7Q&d!PdrDixf z-IS2<#B}yEpO!9fM$*!wP|LZQW6*77WXB;QZ)?<2TLc731#!q0w7~sDus&WORYi7) zOHZJc72*Iy$oD%+7e+TriXM!t0?AdMDcnGE=s?1pAN7R+IE%47k4h*i)=`^bF;3K+ z7ExpW*#Z0+8Iex1MM<%Pf+{;^#)2Pb?eX}nzz=<#Z_hXmx08}SD*E1E>_1ew59>BL z?vW^%n0Z&LY93AV0JBFwkEX_=;ZKs9kua46yL1{l9eABj3?In($JIC&eNnyM4&nZ{ zH2tSR6EH#Dz}MZ{^c2$1{u6R?7Ki)OGLGB1hln1eQ~H;*5?FrPk~$cKS=h4FT=R=(XRvYd7Y9WeYG82-ao zWZZQ2*FO*2lgU5?Rc_;Ib3Jm?8)~SbZSqM5ykx00{D|;Ft7A`pZ06@-Sa3RSv?{h5 z`G^>gj+9k3&!6`JE!Xbq;a%|sz-PC{C&zbsR#2Bq_sHMFlHx4;!{^Ybdtd#!^%l^ z6x{Y(#mmLmN? zQSL^nwv_m(^dsE7ngu!~MI~1h6hpBfxbH&PYmfeoUWcEJnFX(#VdIqaw#D2sK_{2X z;O|tN7RKxUtm&cQJiF0aNnm}NKRsdd8(qo3vGza?XUMAG%_83+Q{BOPzaK5WGS#02 z8@}|kG;$$APqFA`H%?E`V(Xsm?d1EeZT{H$sNl@RaR{{XdICcF!)Ko{i(IMDI3T0t zv+Dx;b9)XQqw3Qop(;Y0w&8SPzApaPtlo?9*bMvPl>o#ZiFL{cGJE0L2KNL74aqiH z!a|9VB7E!#dSIxORAry%f9k=o`IjGC{~Imwyd#>Azqsr&sXx;D-Dqjmh;h}W1j24L zE@kg^*k!43-0nFoEv-}PF1@$!1E@dfp%CZTW6h-z0?kCs#82sygWW4NsnR)>z>uyn zun)PQ|7;NMwas0cTX=4bbAXY=H{tiebInQ9+=o*`>5A+T&t*i20^wu9d7D*W=mRa! zqpPEBNUp}+UDLM#<-6B(sJK@xmBf_~`;yAS9Q&KTM;Y6|&}3}?vP{S3pQ>xi3-CaM zH){wN-`dAbH_C4jZ>^Fy`leO)zxn>Mj4QMsCq$#)*m2JpuIn=Lr!QjX`GJR4 z`vA58lCLPiKP$Ua%Eh3$Nk6ccR}kME*b1eBq*?WK))7P+p;NbgvJAr~D?*SV7oLQPqiV@Ur^9El1wmsGQg@PY-PUMHgYW zfmZRDMK9J@)0<-J7aEGA&URdsaI_*$=(Z%LyF7 z7%7qT+?-!F07}2gmju`45ML9(z(%MAWy|XW@aw|s?vD{Vs56kbiel~Hat3q zAGQ3vx5f0UmEJ!MQJ&g>EIff2n*M!tt2sl5=ZU=P{&%**{7ozU`5BTAu(!DknuMhS z^$X$I5SLjj9*ksk^$3iiVRZLP18mkH3$}kRLlT~xJ^U#HqVrN;xu_qK+Q45+Y4^{Z zyNhMxl`nuprirMODji`T=Kl0NHE?-&#`PBd8H@4Yit=e9L@G3T9Jw3ta!z86sqrM< zH~*FciK6@D^&ZSmZZwz!s|*1^sG zvkknw^KTz|YwEqXB!6wpb4u)m6KE*17M>WyzZx*Qs6jH*+K{hsuawcxU_? z;U|nnYfGZ#U65#nG8RaSz>@VHA2tYG9F@|uHoxsSO*s6xi8&vRc5bxd!NQu`!7OLe zG`MS1{g%Zn^rxA&($U0ohuIo5JZua3&!&-908B_Q0R5->^qX+H!yvPe6wMeuI3mJI z&8ER6cH}G&U(^22_xtn#Xvxc;VWwNdw%`9@c%xHOaiC_vBw=a---`7F59%ms+V5sM&0E&}-V2Q6653pFWG#PIzU_}a)SHCDA zBFDQ;xc?-(ent9xC3Bhe9x2iHd^+OWcDmn{&Cu=8QD>}Jk?q3c9qyF+ei-GLDmsa~ z_2`}}MEnDFBa)SFz2T{&#}MRGdB!U0e17?3q(LyYtHr(Qu4>` zM`&}s7`2$JgQa(iEeCI2Rafecl13B5!+UF;GU{5joiY}i1OKLo`e5&;qs!|qSpK{f zV%82S95k?+;*m8#mv9GgfAskV{ND_Lah*k`rfowc2MI4v^d)Q1*plFDL-0pp)Q>%e z98qv7`nM7sg4eH4yM+CyUv&h#u*?Oe(z61!1>k`R^>&mx!&CTX{0`kbG@75WIYhJ* zefz#KVDt2_>>y6A`H{X0?UB37AdpUa3Uba2uUrJgSS~K)2gi!N9%;?;lSI;;^M5#@ z&H*GKmZccE9;9Jeer})S;EFdVzxneAXdB)n*tZ3LUUh?SagomMGq;7Cu+J%!{-BjaYip6b)|m$*Y8ju+ida=)W=J2@~X1i zJL0Wwengu*J0r}Zyf0bQ#iOco_=mXskmgPmh!ZVq6=D617Xip9T^A|i(RocL;LV{!kBtf5 z(U7PSHty~K*@q}O_u&`oWgsYkerDY-vVO{c+j0_HUOh=ZeXV7waCKA~l>;yH{;SqI z%e3m10-$4IlJe3GdMdv>$wiyIq)61=t(FB2R>^~w$L3?1javS4OhM_`-A|%Sob>i& zJRlIy$H)drM4t^G^tsYw9yx}fpw;kkl^l_Psj7RlTz(Bk+q{MQ5Q+F732Yqn?r<=Y z`WB+zX**Aorh2f3IpTT4+=bRTmIxMOg$&S#2n24vJ4BtGZYw({4_YnON(+T=257a1eLsdCs;E%e)TnoW=gb1yetRSc&B-T*b*f;|wao2d|Ryz9&t#Cfckq;~&VtR^3Uu+`Hd`}tGY)YVDF5%?J6a`}c+39MV zoAy$kkj(E>&kD1|ANY2p{rFBj))T*oLDPxU97L@AT@KI0dj+Ln4gP42rQXbsWqHR? zZzLVMJDzoG58lf%XbA&d*`tqMnscI*mjpRbiu`L#qFXvroFoA^Q5C}{3iNBc&CkV{ z-8Ay|J0eqq+Fiocnp zO8Ce)y5i0PrOFxG_I6}~h2+jp3l8eRQ#Dy%IC>G!qo}4-U4`!8Va6&X9ElH895V^+ z&yI|J{W2$Shvk-;BecoPv%9p>MEF872T874&$4VUCA!^II#i~OdGiu28pn#<9L!|* z4%cW&tb~E3Q+iR_ee$du3xBr(3_=aOWAI@(hM58uOhn^4U0io=onzFG-w%2OfCtC2 zhVf8(#PfxJIOK;kHV9E92a!Pq5dF$O31QV^qQJ%ndDqwca51^K;sRj!CJ-kxW#`7n zug1cre_n`a1(c(Ve-Dkpgq{mrV4$P8swlPBtjuw5HT>0kP`PbVvwQrtVc38iUJP!p zY1h*zt5m0Wwvz&TG3Jb4-;pX%=^)c)izo@Q`R`m)ys^wx2;neOWzDzCWr-T35a}2T z0iGXpb)I5}pa2J7!)hL1n%dYg*&2F#k94XH2^<7aBZn!Cm-49hN@ z2+%@S3uw*Y5F8flp&0qNp*H* zYAYdWeEc=cgsq0XVn}zZHc?Bz=D&0O zaeZcEqbCzO1 zedLUUYxLZ2-Kabv1ACw;_jKGZaC9evv$vKsJ~W(z&X{E6*4j2I$E#_Ble9P>uAnvz z5Ur&6)on^D^y%8kwAMLFCP?&;Ss1#P0I`KC^B2N2_VDtlgzfv%2`g#g_Fy-`cSICED z+SwLx%`Ym`cjhcuKF~`a*jJA{_FCvWHISN~iK4-tV1-$vLJVWUhPK1Vv4kYZjKy}< zH>PiBRaf}ymondZ;&(O%rCWMY?k^PmW7T5{#KR>-i9iXfnv9Q<>2Zaq? zX#UBi`kX2`%;x%O|B4o^R_xCv?y@XPiV{6nrQhsCj@dL3M18p%l+pVXGyys>2pdI- zegVJ%e@)U!7*C|Z(R&`yV|TO){?QOolTD14tl3Ic+T~nDN>k(1`}dVDINK%O7k@uB zU()qZ+Jm)!cP-L{$t+)MhbV9w&IrL$zuy{c7ili=llO7nv)(clQDZ`OqfnQ);5y-S zT#2H6{qqfuBjxigK4-SzeTbtB&uefU8Y z%w35kw`#Z1;>|xEl&x^Q7QJD$sSzNzY-k!DB`UU z110RzA{`Na@@_0$i@2j08zv%x9Bk+Lhj0;8b=}}Y+6Sm8#p3VB*&|+l)7_i(6%t6I6c6DlMSU^}0isN1EA=cr$F$YWLkSzB z?bAk_b^Ij+_tje6p8H!Tx^9;(YF2)WH!IVQru{v<>e=uBrU`-5$ho&CXP_%D6v5xq za9rG;ygYTj?hwG=0&6MAw>IiN*guvhl^@Hem$&H8u29*X(@3aB5y`~CB)x%(L!?s$ zlf@_r(^N1+q#L{mxgK)EIR4s!--DzdXwiPvn8D|_Vr&FYpTOpclC!Nj{6G|d1qFS% z@$kVNNbchZ$*|4lgu{IgIyt^mn@L`awlFgnVk zr;-@~`I$b{b{*>J2ErWqzg0w%pG9=*w>Kkc5kxrhZBJ6Ro{Q<1r};-1iProWzTx1> zl?<>1M)L?Ir2ra)aZw{x6!^FfAg`By{NovN9RhDCx|Z(s+nr~s3YQB}DCW$TtnI&K z06`CQon2}HF=tJ8POkySvCdqVc83ZJ!@D(4f+|Q#Q$L#{Jw2`fS4%(!%n;anRhkr&<*9&eVh`wgMpt*Wt?hk*2zW+ z>wEOb%tdIBt7pGqPSPq|Ej7_8AN-TKq@C9g2GKzlum@Nmhvb2fIWw*o;YmhV(c zMJdXVyb?7ifR~g7Sp?Ou{5|&HD+(gra`mcy0w@xfO)m)DX97i zh6%V84V3jf)dt4#)H!YNFcR zjs#`qGI`-a$y0vCMI-OQn4@ojMfmf23{`}7G`*v4by-6!g`_KmOFrs&=2`b9iV7lE z?uKzA)<3;x0%(svqG6o$gh1Vu@~Nz1b+F0%aMnQb3Vj#|{2k$J1ktJ+s(Onpk!Mw@ zL-0N_bYD}a>TuY`MSB0$sW3JtDI%Y2*Ih~iI?HPZ7(*Exp)*oa%SeV@%M9KHI(7kS zR zb|1~x=}`%)pRmAyO_u@eGq45gNDYO{cmip4&X)rhuP}KEoPpt`zX((78cmJvve3n2 zxd?gbhG-3`_yEc23SIXQ+28LXLR6mW4En>AL2Kovp8JojIS=p;s466U#xQV>u)4nJ zn~@(2N9>QmMyOUm{mi0c336^2TUVgc?{&x4s?ZyJH(nA|wk68cR94VJOg=a&R(H%1 zl}&kWprXrN%<(glP34YOObU>urdLOfj-vX|KoveV5nd8QY9@sx78exaMm5acj!&-D zQ-aXa5rA;DzXlvb!j)!$T$%v<-#cbs@a)XS6ptn7K@H%#mN!?{w3xW<5-pbieZkmX zvXiWPupHT_qS>!zsuD5S^Hs0V4V&)dJ^8hp zWHe$SS-n*a^~_0v2>%1h!sS=QZl%%XkU`~j%mC~)XkqbBA1x$zM+3HC1(eYjx%u4K zo56gJw5#^JIQwrEt*xjMStd+xc1Kw-(vT|K{1>RL!tSq}rWmf~ehs!JcN4U+HS+0* z&7p%h%0F{n(JYz8RXAMOvzB7W)vEUp-KcZDiU9q0TiZht?j zyiJSK9eE-HB&VLTQv+vvS?-`=r+CSQ+r^1B{Pxbs}kpJ6O_7cf1Ue_7s_mm!0JWN$FAi| zbgS5a8SGHBCyx#ydE&R?uiN-TkI%T27pDf&!yIp7Qj6q42E$D1#6==h4OXLD4Ag=N zrz$K2+x#5x{IBdmXG*YCNh+FWo`Jr`i^)8(GuF8TbsqnyW?r7hZ1u8qc}8N#Hl2t@ z0%dr+syhZk+914X$j@lu;)PHXG-)jo6#4d7ITSDIFYr6uE{Zma*xVn*^J4(3y zmL%{-t{-7>drLY#JgSKZeC+s=j)C+a%#@?iL^QnXN2ARfXwO)XrY`@ za0kAyq4yjdbN>j+7akTZ*{in7>Xd?OU5km=1oza4h~vIqs)xu-B5#_XPA&I`$l09i zemL7Pf!a@tI%5EFPYYUU!5UBN0pgv{7b;9QzUo)jzdOlm?$o7%ch*<{OJB{1<@4uy zi2GRjJ+^67r`C#8X;Z)SA?ECl{i2k831;2nsE%c!c@PqHBn@Z44qRC z_4nWHQ@S9Ye-PCJzhhkMUov6MdCXXUAD#s3$GriqcYPm1>613v*t_@RA}xJ4I}@r)pG{DFhR$iREh#0g>9Kqgpz zpK~UVG)j>M6#9DRtoh#?wAs^Kc`Dmj!hX$NGMk ztd=n``}cTPPlF%`bodb~t5RqW?nkg!QbN*ui2i*|*@ySWrBO?V9qYx+;eOz`JJvgA z;%dZ7`+aLyoobG2BP!TGUK7(((6h3JI?&sy*5spQ@u?Swr(5d(-;kEjs15Wb7a6)0 z*Rl$_IAtwbPhWju<3#>aW4X0BO@HlU*fl8)0*yT=1KI(C9x^vsr2RJ|E@KWC?1Fr87Z=vX;%}OQi5M{$+%K$k z(ssZr(?vJw@J363R@B}yE+|~92Fj6fNuu|Z;QG! z_qXO0MIcv+MXcT($Z-T@((Cd)3~xf)#5>H^y^?EpV89Gm zckaG++;1bs!il(zx#9l$y!wM|dr^2H(C9Up>InQBsL$A9BFMjf?|qe$s8`(k+}q<{ z3xr4Z_}_Ea9stqGLMg-=F*&trZ9D%+7=3mh0NkCIGQ&ZJXZJG3@rLSSAt%odR@xtU zk+^r%2M;(4F+jjf<{D4k;{1cIF+DZ!I?OB=)3*VdS9rK!9J5ksO%xg7VF?sBdd1hYjfqR_Wt=xLwl3L z<`^8OJgGElQKYf*wTBIPM!blYnsZ`ZBb+u#pF6TylKj&aE#@B3@`8D2ZMoZ$>c--M zU{3kpoD*^coQ{7gx@REqLGca~g3xOb(u-65l$17&EZe7p^C{Y}*QU8Gb>r%{fw=R* zZf&^kA(@fB+TpULcb`W{^WA%j6l=~GDNEc3Mr~~FqMM9a-k7`@2D^4cxqexr{S*cO z*N6H*C&TYu|Awi;j0#ibILsBJA0D)akLI{&np|;94Jz(;j4!g9R9Kvd`_T&WijQzg z!kmTa>1qt~SkCuPN#4Gii=x!W1St>dZgJc?j|V#U2U=MByVcFy^mQU!6(Y!^_V6l| zD9H4kgu1TurAIeH2syjB$8J5JQMT_o;RBj!zK6npto zLoNu27n^74QOFVx6m@_!Azq(|`B`2qL7aN72@i1tk!WM1E(8FEt^U%B1I;Et#DHpO znNpJNI$Mj<hXKOw z(N`4!x1>x@91T=5zZrkx(^ru>T;>uIYD~Sk*rBl{C?*B<)lP0i3=a0}4E7|f{CNv} zs9#&$YhO&-%h36S6Su>d8;ou2!zA*~^?3G9oEzY(_}A6t?_DA3uhlH7C9-cf)7I1@og!qy0vlA&q?A3y1=l8q#XEw~m>3J!!u93zD| zhunm6xIakS`E)7iJEk+s0Rd~8nZ4;Ujx%Jea#;emq`HuM5~P~2MZP54Jf86tG&Iy@ z64=1Pf4VLOROM)fAKg3j3DD=SsLPm{Dx!1*(sYFN))}l$wUFafR3J4s9JZv2z4b)O z@GnRmtjWsgFLALwKo-2gbPMg_3~jH}kK?;*bG*+iOSReE@?R6th*h4}X}l9{#x2-# zrNhBq(;T;3`zaJMDHMb8TBQ+grDbkM3Yn@J(`h7huUEM}rVcje2K<UTA%{N+x*Yj zaagM?Fx)`D*vnY8XJVLVP#e576gOIASYzq$8#UW2)<|^31fv-s;Ueb;FxMUY^=~ET z?^4khNM{xTHo3;uKFsWI_!}ViGR)==d!<*5P=qJmliQ|bfV*8_{=uf4f8-j_~*UCNT``<^J9)CeLx2ooDDml$G zfZs9|+&x4=b+t)M-Ij&*d=t6u@*2Fj3SYm#Y{1BaW~)UqMj?fI*M+HuK>H45*W3NA z!f`F9kG9z<@-5`pufVTZ%6*%BOiNClnmhp`0%6;jn#u%Q9_2=+mg+i=?kzO>N`+Up zq@CdkuI%f4Shzl>%?qM_D8nnQzU&Wg?2PMlf)JiBhxoNd0^FP&`4XmL;Bbrwpi+MH z(fW4wsdztG9h(T76q^FO2GYy0{M3-mTR5hn_1|1?Jt9>!`oOiu)Sci8NO3sgq{5Gz; zpj3Z0i-?-!PGrsK&VGQ0$s&o|@4tTl=j#e1o4p_wWM{PIC}!LYLuKG`8OMuLXY!5q z(^oeeeoa6#n5dNv6`2skGxA3IJnj(5bS7s*%tR1hpATUf)w^1vxkIBJ(;Gw?9C*jk z039-VYnlwSyi{(i1!guaE$5-nZrft3bx4f$7tysl{H)pDwS$?+ZR}qzdx6 z8DybX$ZS$qqNbuqhtnsSa54D3w)bKDu665bHWN*Hh}A+jS4G&D;~FjQw;coq#L&$0 zjHykPY^>NZxPC7oD*A(f5kCWPpCdSKp{+esIgj zUowqvWXyGH25OdSt^|S{@7bynszUZsTroWjRf70?~i$M4aUZbjnK-gLwP#oj^&t%KiXs+k!W`|86}s6`p{)q zzarhNs%zLl_bJ$mj0n4MuWoD38rgpzW<|xYfkfYuSb6S`!AQg*Ld6gjl=+zrO{@gV zXrHh@^T*YVd|2o&fIifWO1eV2?J$x5IOit#{mF|>jzs8n( z^^FC{Mb|yG*}Az?Qh-N(Y|=oZf=fd(p{n(dgp-Y#??U3?^Wi1@8uTo)3hkfogBu*b z!zT&rQ4OuelnHz}m59ZCa_$HMt>}@Y%_hxAI3BSFU_*u??_>+e34pW}t`i$Yu;>9p zT8+q(H@x3eJdcKrrs&gx!}CJ2(ziS3Mxu_r8NLxht1m_fkfC76Lp5xJ(qZP&D&rud80WqosQ=j(%i0>xB6QH71&)o~FFzpRqh_P2#bSQR z8lgLtK*~8`-2kWkVS3R!uh&puR8`S@dja%vP=b4lx01duzedGZ+Tx59()1cLKDNR! z(V7jQx6$~|K-;IiLXNkY1m78qIN0oaxw}cpeo!}u8+Brhicr~ciH`@T?wkLh$#q-$ z1&zEed;L_ZZERm-fi9w+vQELYgRLVY#Pmn|>+yyb?a-7PX$2pk?aMFB7G%(+Xkj74 zNqzqFlog$4NG5sRFXhmOzVAS4hjeA`OQE58?>VdF0ru=4iA9a!JLM2cIA3ZP%03+% zj}JSGi_;<8bXboDBemahzKOK%be7VPhInZ%zS>{zPN%gt8fNIRU2zomUAlD)?9VFa zn6+9U#YM9}niC31c_!VFve5R;S%1BeK8E&}-eEY8=Q=feV*ys-lOe(V&h^UU{62UL=KA1$(!buCTNl^IbQFB`=bt6~dhsl_D$17>^q z=rT`F(VtK4rH z&s5hV&7-oQL^`+t%B1SvZ+{-byfin4pY}f`C_9L$xvPlkrF`5Z*-E4g$D-tuaZ~t^`!_nQ}l( zRF%y>L>0ytmO_6N-gP$`bML2$*Cx_j8E_!0RBNw`Q~4XtP;G%7H(Q(s`(h_4{@PYY_!V=7iXLiS7J3#OC@gth|!5+y;ty$ z&Q_k+)y-!XkRUb(GmaCZ)i4JkiFgKFbqx~lZS1BSd*6%rs3!s1k^w=iP2%vi!Xp(Af;MhBr0`^w2B0G4@&hvGuif0<8>Ob40k~|#s2vpE6i)$WyztcFd5OK$rcEylUaxXnz}tX0_erSTd3U4~@ys z`JVJ^i8S@z0dQYrY#w!A)R!cCd5H@)YIFWY76;h-=~TlGxB#o|sM-9Hvmf;F5dh)Q zvRU1VH;2i3!R(NQpX+oF{Vnx6JY z-gTdwlt75jbv;_E6d^WCncq?6h(OI-f0}rXN4+w`-{$7>_nxctEez?@s@epgIyJrS zr3*Nc3GC#UjmCP%@z3?*ofvTy{>WWIjj4-i>jJauW_irv>;M83fceIjr*F;XtnIx< zRo1kB10DwiTGtN!XO7~IX8(F0)v7GcXVo$=vb=Y>w=-5nt|&Umqq6WGP7{`0rq`8o z1v*w68|R|aaQ_|7KK?JCqhg_Uz*9nS}8L+Y-!dM8^G(8Z4VeXwt7xel?;^Ha|Bsqc#E zV_IcO&k9MzdCTSQFH$MmlFN@m0iMX`ecuMDBH*x`qn3A4-S3QIb!_(wPc{t7%xo|I z#J*FNCxrf*{#m6lW&Myv|1_WlI`{}Qj>U=F<>{!gF@M}n_OJVD-`=c~nL2(jgwHft zO|Llz+|AM!1RHAJMe@yg;JpVR;$s9nCE}n3cpgbyr+;lQT{Z;7jl|lPic}mwtjdLs z=LoGS`)k9F-EVFY8CG9s~<7S?2)GS!s;!KbI%E2+@r+5hDfvtxwL|Isl2tMh$S zc}_c|{LuJ#W>XJBdP%uCC12rfe_{p@@c|vVl=!L~%~#5;M+CSeWNxN{+YS^O8g<`~ zynx$Ix0Zca3h{7;fj@Mb(>n{b1rsSOur37AOU)af_W-c%mAnYn5$51|UVPw@OqlF_ zxI4Oe_4q(Kgyp}>BgnN-rM&$RJZBT1*7^Miy=(Uk?P6*p+?OMhXxX6haH~%OUd^N# zFXDc_!ahAm}7;RR8kp0FHWLEf+cUJrm`>OkVCvYTqU?#sG^G2 zkG{GM1B^?-t3zN^tvaWZ4>Vl0mezpw6!*!xC0E(>trbWDj6{eZnG2N-F<*)HZTZJ~ zF*tgEf4WMW%RKac*z#8Y|JGfPG@2kLB@il#Ro>NS1=EwA6$Q9f|Zb)E_^q09dbTtJZ?g zD||19|JWj6bso4UPVG*>)i|c6gLHlbp!|R8s6v~%sJe_Fuau#V%r7T(vOYh3<=@D0 z53^uo+oTrroFaBA_;rU z|D@L&v*qO^+o;am6>slE=@h3>$Z|X`g4^&t1+EBRx#KfI-}~AULZ<2*<7fAedT%B8 zQSmsvC48EwO;1%krl7j+7AOTuqzxiG;(qmAr3Jgun;vlR73o!~K%?WO5O^r1&Q~^nl;;;#-lFb4_1YFoV~6&GP)kRt zy{qHdgoMR?eSyzU`U;92`3r)-^@Wpar@#s2dCAl%XqV#Kt01Qx7>xFug@zA)zbWat zsb%RIgZdUQkcxIjIRnAlt=h3`tcZ<^B*-yOxPX!~<^y?J5#DPi52sSB27%kL<1U|! zwQnfVO(`4P6`Z{G^9+L*If(~Fn+r8%=?+IKWnCCtGsLnMOX7|<(R}F zGbjCm(8ijmiX;)G?8idWhYJ9ad&i2(2OwWfC~y2aUH&u)K0OR-q-XLE%8`c8LCW|t zSOTj;^XC}IXrckG;dts1r@zJ|O(i%eAy;KjXiH?SE`QHYkNJvbs?I9gU^R}4P8d`r z(Jr*}5!N%c926VSbo98$JRNQf(7NsqAS+JPTbLBgaeLQQq3?w0kEe8AyQe$fxZdQF zYp&Cfm8qP3E=vE0lB%YW9?jcJ=|FI!&G1cj=T^{!)q zoUQGo+Lyxm;SBIN80A!&3bww-t7E@E1%&FVib%PHEvEwVM75RtvtL(pgsSopjzP&Y z7K2$U1tkfrz@D)$b31*pN#55h6bgphw|aE;t+V5E@F#S;9;ewMrqWIufeWi;S}Fm4c(cqcd7UjtP>vMq1_k(+ z_+{VlaK#JyW;-?HeXJCASmh&!-QaJ13I`2KV^V33Hw~-dq6{Xj6GNz9&(7n=u38H8 zg9Du?P2&Jq!&mqt4~_aj9SakkK0-?D4<&cJ_M>zA4nwZyedM7(e~FJOSWnD?_s_nu zQd6(khY;&XwcVzqUmYfiVSF7|l@r|QevRz9Z`Qayr$#bKr7p)TylO##ve=Y03j`+4`ZlIfE(?eX@IYmoXbzG8#>;7~bvfFs&MCdZz9DJFp=clKrem-pVg34;+YoG3!1*P#CP^78TJT)i@xC46*LHFp;{R`C{uftLLk z#xGkb%NAe^&*s0yH2WQ?$Y1YsSh`HgI;1E?u&P%R+pm*nV%>3Y1?XR%657&ylO}}4 zF%a=H0`9w1k*Ql@!um7mPUBs%bcYku*P5mmct~P0gedr{k$&M$dbsOV zZVOH`6big}g*qK@I92i%?6p94I~m+qD-2?CbT8%P4(kSrqihi}R8Y9;lO(N?TwUoo zBg}e2rKAQL6<&P86{L>%n$}B1OMi%2P?1lL)(MjQRg0?x9XxG8`Pf2K~easjX7zPEr zfDS^Hj#-`q$@FuB^c$RWw%i((wLA>h^!!=wk#B}iiejG@M7aF3rHr4h?lE(jS)f4a zDJ!a66BNUMworkrYsxx0Jor^XKStD_g8p6xb+wySr)l&yT-g%btQhQ6don0#iC+$0jqGZ*IZr)^2o)n)tNt^oeVV$G~V+Uy~{>uT^HVo9T4EuAp-S% z@xI1lfK}yKOmIz0RrJ5bx*hzPAAtbRGS-7-bYl5eQy-?&=GKj@uRW z?Pj;;K~DEJz|p5}-v@t$hEfYZy7)pU9jc=Ss|*Tq(HJ7H@r6V)Yg9I08bw^ z=4o7?P@^!mC1eVGi_H0B=ezi{f-lX|e>=7*rVS?RTjI&%(WXqEV}j9~eZWFmR>oC_ z2ql|N^|fIW7c)dyhOQiVIJw^iYRv@-)hf>zC1FC%LaY}#G?}s9XMTR<85fH+qi#mY zYbLp4XrM1upFZQfK+QtN6`29zXkrB?heu(y*auIUMaFzZLzXW0Y(9k8HrBrmH`7Ay zox9d*Urp0BD&|YyicRV(X<57OmooSN>dTBWRG|+*2^oFiDb%qOaJ>k9of^m!CJFV81J?e}Gk`(lDWHZ^K^s z67xreb5bTaO{{>LXB!Ce;)X|jJ09*5`vuEy|L%t0{`_5eL&79Xdu)kcq`a(U%MLUb zt&N!1vzo&gRc2=Phl@rxP&HvB-MgH_L8D{(S0s#p>lLedt^bQS-t36tAJ$Y|(nr#1 zSTpVS1_58et0~;@E#UQC1SJ7=6k8uf#4K>&zxHcp zO-t`-q%JZ?ZA3+GhiPIIm7((o-zNXm2iLtxVcwm*oe{LUNb(0PLmibrbj-4MD-&~t zW#kW$Mz01SGF0E=GE~Whx{rm*b1f`V`{u4+x`K|7B}=P0rGGQlna%4T-H8XT>L$GW z-}#X<=NvKpyGI$9KcS1;2Eu#=@6V!RxYiP9s=y8(h!M=rKat&B6!jt0yP-Oo?2|KA zdEh5>C6a%ICnlds$S8|3F9Lx#i*hXHEsv9|>@uSZOB9)fb?spMRa)&K8WoYq$$Kypmeze7wXXYFGFXB-@jK&MQ0fchxvYWk=7L=?Do zX1TGStb8Jd2Tci`5Nb~C{vGY&LYj+-!w1{CX9=lb-T4yBP{;K%YV8NiqO-^d+$9!6 z-n*;W`+2@-E%pm0@tEyiw{khrFls?-!fJ@z9~y!ork8^;Gfth0S$#2oKFnq)@|_U0 zLiH^QEzJuoof32oro{*+FZON4rUZwRJkDNDQS2zH{A5J4`8A^CI7nM#Yb7{-!D}NAO$_if+hru9G;biJ z_)#VeOWWDK=T5l+kzbPI)3>{_59KH~n5Oc8?f1^fH4?!wg@MLV{p$I1-uQ}w`Y6&q zP5N_jmiV9W)OB(fxt|U+Gbx-gy|NdMZ8|+mp+4=Xnq+6b&!@TvvV_G$9Z$`;RD;wK_x_kwzO#R4($FoOx_6ezMa z4l&tLeaA`48@Xq6WpCWAzC!ymVqV_lE`Qn8WvbAorCiXu^v?L<3cu zvca#xZJJoS3!Lx#eX(|J1SWF=n_<8BWL_~p|AT0atMP>QhRr{=%Lyj(8hK-|m&;0s zj~NR~z$St9Dj!-b6Sj^rDswveNpp>*%`gqH zK*HmXFmN*agIsgi(`aHg!PBz$c3|jASx8^!Eh+SpYEkh8n%UR$gn27P;?ZmivEf$` zmqs2fr`LWa4hX&?}a$6(W`8}yW*PnWSHsUt~wIO`= z;yz&AmtEFw9MltvmcF`Yx)f8hocyQ;O|mNuh6~-W%ESlndQW~ZykiKHvtm}|?InTZ z_lkz*@6^4QxT<6v`AT9ESbGY`ue2VcaK2n@N6Jg}oICP083R9`Qb0K5H1Xp0uO^6{ zNe+_qUzN&Do$rAp%aL|O;OZ)D~hD3CP(jCrE+nH?ezga!5Pf4i8o}ltwV%O-C#JJ^B zcwirdzavE8uQ(~Y{CZwCE+*BOt?l-J*zGvp>zaIWk}+-oTZsjw`o-(VKiJ9z2qAQ@6Yh-gA&kOwMh^r-k(44Mo#Mtt-(Z% zC-#v!vD%wZyzi<*idJW!_q?1v^QSb3i1<3W1l~IKIl4rnIE(QNCGb=xl3M%ZLE9oO zEPdPsjHc~3t_Bh*cDySV@b#ldhfKGGMUDj^0aDMNgT`PLCFM@8e%;wpH_PSCf#*~- zq2q3(66q5o$?bzeXIP>d$conW$_o8rwoCRm`EzhmZhJkiP)&P=u`lm6T$TqolCQCD zoZ;Ve(lhiCZ8M0FN@s9%#6n%AEBR$=&_?T{=sFiTwQFC*fwzFExm!`jwbpf~NYbXP z_Wd%F6;}<@AF#BnC^%j~Nap#w^dY^oI*vNxpXClKB;ti5>sXG=th;0!heny&yNf7* zl&S5f&zi2Eo`by}KS0)N8n@z_3wnpNSz(zetb;uaX2?5T_1weUZrb}Ox^5vFqIVP! zSb^_I+17~QCK6#F>auLV<5QgbDNv`*VujKi!ZFos z<4MuU@{uG^V46ZHxaDv{C z((ujoCpDHZ!F4xF2xgXR{Vh9bDmxkU=nBC$AK2aEEA?JTb*|t;nW^Q10IW1$Z689k+*bR^+>A#iUt z8-#mfZ9#tX191{t{V~PU&9U+$ZemAu@5)I=VKr{JVeiXFAr!yHPn@CPmyg{5% z+pz6H+^bx0NG}Kp?qn;!I$Wc??P3RoM*!y__QwFNAJ2O!JM7VLMe+o!*msv_q>VW1 zP;fw%#-QBNz@$I@*Vu$Q8B0FbDRDguH746b@|vk`-5&&@R80GTJ{DaD0cS~KWsITW zEwqNgQo(_`(2Nm&y~gEz7wYPA3WW)|9y8<`xhXsC{NWV{!2dHhM3T9)rK zdZhZmU8k>6S*}aK?iV(ja&S|j*>TppRt&l;?+AMx;4ZXXbd7vMq|Y*UNS z-3Sc!Pz~w4(3f==DmT92E(xn8YyTx?PKNTzgpEr;n>zWKp=kISg3t(Z8%n%N1n)9JfUw;`xrJvGwcOix6)dgrn#EkH2Mz9>uvcn?cnYvo3cP6mpy+ zgROa?JoTQ+$8MaS1a8v59pX5|@fWc$W$f9o{{3v9+XyO_8=7hRw)e~74i$0UD8*l8W5fC6Dqe*U19(7O7(v3AFrPFGTRf8 z(d4EBGVWXd@tX9^>>`L*GunE3OU0gCh44>|qSkc!Y>?)u=11&OP5*qj&}OL|D$itO9? zDaYD6f+@5gDL`rzai)zVeux&B6{Q-wLj;8C=Bdb_0k^sTUOLsrY{F8ZOvC^f0cq(9 zFVg#*Y?*&^fKqCi{ITMOn5EUC_*qq4D0Fpv$lyBN|0Xu#@N|iX?BI;hPO-xGAlrMC z%_K)NVr+ervJ{4;^O}nm)1UQZ@?#Ck{trhTvg_7G{yuNdlPO?DPGoWign1BuV8$s} zZ9?R7iqQTl{NQNvaQBFD%dC_k&9U%{x*c!LnJPboDF>Flp-##t1W?8DokVVmr7J83 zXUPB|$lpdkkAhwZgwU_IYmBeHyiwWTAbM4}b!lSIUJk#oD9KGVb(K@zN%iDut+Qyj z0KvA}@C#cMxv-AOz+sgySs>m`)Uc4i*~3RRX08JKe2U?_W75tGr^}O|N6u8~&M$WQ zg>v-A9=%$j{41kz%DDYq>RKFAID{UQdjJ0Z`jizgxoLxpyXDZ)UYpoO%0b%@TV`-$ zl2w(8y5Go{E#wj}Qj4pFGO@q9NR)B@u@0&In{n{!6#J0Xr6e6_%_!q#*Yw|~osaS3 zQ;v)pzME$TBk_G)u;=JU7{mibqyM}6$rOJ6LpD;pbM52Tt;MtZX;Ar9wXUn*Y5d;sG(MWvJJVWT zl*efqgZB{AU)VE8!Ooz%vPEY}bkOx*>*9dBi))%Mu9cw>S_n(+;xx4VY48lKN#^2wue@Q}QnCyaj&0Z&uf6yD zdrgPKmn%^Sdr(p2%!%@a)nKdvi*qDb;rGO2V~^Qj({(7GV5egP-8ikEhvQtT#ic^- zhggd+E$(Bd-Y?BqD^}<@od%k{DN=ZyfD55wtv$1=2mWJ1xcyf@D2Mn@-Ne=Y!|m-d z+-xLAN69pt(dJBta?3YCn(hQ>6vX_CXix zji)3PJ~B0!MEY1dOr7lerV8y2RazSIGQ>_O(_GS@?3ew7E#UnQc^RK*x~~gHi(%%- z(Uc>vqm%O{q?1D~-%z0Kjq*T=d9fc8@7Z{q*QFOQ5LpT8G1^HRsD` z*RpOJ)z;wgzLmRx<-y1jQD4#;P%;2HAo|R#9Q)>dur=yE(tS^@-JE6QQINNY8!+d7 z1t2|0F_cv1)eXnuaaC1?UGSAQsV%KPLEWE{(@5aR?rMrbjQ2(R_!C`LjRU1INB$p{ z3`3_BoZ;J<)pk6vW~bNr5sadgGAe-Q#&8+Ci_-Qhtfm3pKumeg3+b?bqHE7z(?$c# zk}~i7x4U$ux`UvEMy?jT*WXQxet$Lwk-lB`TE8lv-D>j)3?ZZ~ba6t4b@+o!Qn5QZ zd%PxO|2L{HT2j1$HnZpmkgS_yR^~a3d z+@2(B8MXt>{^2N6aJmRFT};?0iJ7`+9V0x8u0e6OQ##@`Q(-ri?JX{>H|A5nz&8*G z5QESr+!S_G2||_$i@EmR=$+u!ElYuX5pgm~KiP5OF%?~SwuWW$20p^bz+qdJ&Li=C z7Y;W$;U&JdCw&deD6R2Rw2z4QLSLam?OgW7Abm+qBPy3rY7d-MRFiF)g(89bd!cl`>= z&c1=2H7KEcHf{M8hIPL$?Kc(R+NJ=+(@zpZAVJ1mP=&q%vLyP%B)sVn*eg%aVDtUv zh`;B$;4ge&#q;ZVM3!fmT6OT0$xK&QqxnOIvkp;^!)VZ?)6^H&&9XB0?NOB`NN)+@KC6GA3k7 z(C}_C=v|QpBh5h(FP&;k6;~w?j;)fb#kDqPZW0-2%*My2=YHH&6#R=sC08(-J9sb0 zDyvbODOOSzR2(4L~!0AOl~v3#$-Qk>?~OrAvY%{EWYr zem(z0MJbM{?}IZ3O+fizCOp*D1x=h!)SV;j+L z@WGbr(-=Cv(nXI70zuW10fD*l&9B}qSmrXN)O3O}bRXS~t8N4lvrVWGFV^o1|EPl6 zlFheJ07g-8Z?X$z-g;F#Ii^~Z3-70}B%GQA-GR$QZD$8nz(J;Y3`%_*0OK*tL2-BB z*w12~Ii3e}U2IP0Y96OC#E>1FRu>KKS$+-R><0VQV;DIJUwj}hYD$jZayK^XrF!+$ z*^VDbUQRnDZtfTK(~3f(mCdBYd$f+3co;T(0>1gqn;b{4A|_O#=h^;b^Ml>??VdK?|%tmU*_tT&=8 z#VC8esT+6>bEft5sCi4PF*ja#`kttWUm=-77S>+O;pA_npX039;ljm4;A%1zMj8c)LYB#`O(SWVmhx={WKA(gRkEr$(Knz)ljF zw9nA7!msn>JX9l`fL7a0uZ{kGMCbLZ-nR6MRbo7-FFHbRqo#bzZc$WFr{kv6r3=(* zB#9PiC@qtV&ywUO0dU`AaW+CE(@yHv$Kgpic=>4->R?QT73~=cf&k%TLuA`|Mv5?I zb+~?Kn_KH5fS`_y@$n?xkD;SSW+0(UD6esK}U`jEfAV=7tRNGNKqA@$6(#%PPy;Fb2Ho7P7x2nCZE%a zVboCPo#)h!t3q7m;9SVc?lOgkz)N}vFr{LJi&ow_hpLBH%hQP2k>*~tk&70_!^Jow z613DGu!(sGAM{C1Q9@QxlhE9n7LCbMaHlnJtTrwYmYmfJ6E$Iar=)c>Hp-C_Hd;}) z;KKsVcI|9cODj4xGyppE%AY;&+3v90{9_m?35}6w^2+wOOde|4G_DnJvM6=RKexWr;WVSZD5 z%8%KN*g}J)>eCOHm4`o!>TSx_r8+)ZQ-^-K1cDhLq_v7QpH1ogp@x$#und;5?Bs8-sSTLb_8rilkYDu%YX;)k4NwynOtjQM)xo9&9 zK2(?XNOWG;Sa!iE(G#fbWtFt2!eC()^gSDnlu7@gSrz-puMOQ+z8KZO@;(lt{v2M! z4)(f&i-C9T?N($eI4$sJ9Q41ow*!ACa&c*?_Y(;?V7lAm6CD2nKT^?14_6!&+40W= zTf`Hl2l7m11h=0tPRarNEa69j4z=wQ{!C?0iVPHj$-P63s!I49>h=I+(0xb3IW(1R z)B=h`FW!H_)S#-#;C2)b3!a01Unk1fe4^R)nVV0QIG;^pL6rIU!~N%ikRgEo*{YFHOyV^eG>uS?!w}gM=V!i6HoBpC!)Mvy zksgfoeYPdDE4S7jLm`$S1Ub5Q2M8`R-tV;c69Z39WD1jQrzsY`hVF(p?2vY%#A9BZ zhyQF*F2sOjV#)Et#roPGx96p_vFh%EunOp9v0=zv44MnHd5cVqyC*nEgA0WA>t0|? zxRtlIxPed#F_z=WLT`$&vZaImz;=R=BJoKgesLlN6R5TUn8Zy;dcG_N+bL>@LH7|G zalwvIeu(t%%|89g-N9_0V;_Rg-^1)a0r7vJ<6g3@ft8FTehbA);Q5ash(~R+gY1je z&iV7=bwtw^?GBG)jNUzNlcJ*!g)y2NGTAo1ZHU?*x%!9?&t)W1ypTo8&dNno!QomB z=iVc0r71~gD{+17uP+|;$G{(bJGC$CJdv1-RLJCp{|!ftS596##)UYwF3G0{p=m?29jZae(q6o0g#CV- z81e7zQyz`)ZE{D&KsE%JN5sS#=jX(BKAMjG?4B^%W#yE~0>5B-D$W=|QkXRDesi1T zE@BO}f%w~b0S;FTLvK7KSY+(l{t{wvx67Aiej2=cOyqxsbigk((p;w5{-#aZHRY=Q7|W*ekz z(Va$C;xHO0m4O@nfs6%@dt{fXzRs-{u)`*D%u4b z9A*_O^P$6XnSl6NVO)2SMdC5dch}WYp#GAn!1-SS+lr{IG@aSq;!i?=A$LKk>t6@8 z2c)$R9K`)j?=%s5cT%A~X#Gs~;9I~gQz`#e#4R`@Vz`mKHEXE5Wr&>L-tSU+$y%&; z*g`WXBv0PUw#sur4uk#eHfk;PCwid5mp_R1W&%((U=WVd#Vj}du+;f-C<-45LLs1p zR+971{>&Pan;4Q7((DReaGS#lq05tPL3cd~y32-;36G0*c6K+#?$?*C#o)fF@`kSv zV(^Ox1f3F#Nf{sykK2gzcDjMB^}b2&=gip)M$7y>OF!@o?L+hizxxgmlDj!sa)12! zl%C>x8xYJgM^rI03--(Azfu9cg>g)T$j_0z!U(e*1wAcYxs)Licq- z(BprGs){o06(DN$LttfxVjI>RPY2SvGSGh3%3V&2!j>opU69gTz0fR>-wQ|$FYczb z6uCfwR0GvE4MKA#nKV1P6}fOyOOrqK)q|s}Z=K@GDV(dNi_OZp-nxyea%=0yToPea zlma~$&FmFE^tG-!9re#l6)44RtBwkf@^FFQNw#*?5FFg6-V%xhy6)2y?rECHtOD;V zA!tgU#%Wwr9Zm}ne$!n?P%_w!i3J1O(S*RnjKCyj>pt6g`~5XaoJv1rLTC{DhftRp z692D$-Hm($GrrT>VgP%v2_Uw53x_4uD0 zq0;^c_ziSBej?(wS0JQ95(*va@8x}d)Uk`ga7K~Zoi)Oz)acMl82Y9J2@U(U3x{We zNv{v{)b@@4P*NBZo@YIyfqQod%h_Fn3muqXsf=EwpB710>I-=y-B49NsP2 zB4?ebhZIIw4sm(AX#Cz#)e*5X1OWHh^@NLG$Q~#V0gxETW9Nmc25K!}vZ&Cz1#Eh( zuY*hro~?SugIni`FQBF>F25O=@+C8${!#H(Sa7F9IwkVN6uJwddY^NoiZg0LXVs6X zRO&r>k;`Hj_^C`z-j^WTeBOj)i* zhlg?|YXDIQ_3s#|-uS8FbsExs;kLvKv_9%Wxc`~iWt{0MlE6r}_>Ab`n8&WN>MlLt zIWXvVL_)UjZb$w9?xEP=O|2*Qp6ZnGYt zq`ah>?&*p$#suT{I^vq5dTBsjL4l$!?#|4lw;}ZC&=kY%!9RA70TxYbQMR>N`m}s{ z2~0Gnp#W^zf0xp*w_O$09SZNZ1G<`*^9xn$%wvcTZ{dBM!oBoTABS(IisurDbLvkw z9sFR^(a|M#j?q5D>V5HxiwE)Y%Lwj0$5)N{JdaQV@B(auJmX0R?di(dw){w^=oMle zcgrBZBK=aY-1(kig&3N#>qGAvSM*E4#N|z8emnvu!UjOb=WfBm*QRZ+2u4qI?$8Nr z$J_COfWhuWOt}jwqoZl`P(IJ5&8>T^qh>oEF%PG)yVQ=+x-Ss3!o#* zmdO&+?n{74`CHMFzfqF#f7mFj1ug8%En3BGA#1s&2@1Wh<;;FJ3VOCSKhFzcqAv5HqtjF|qnTuiDWM9XQLx z6Kvo2_C|uAKV^RFT8U9Y2}$1^X#B$Q;-pPeN==RZ((b(Nj-AKIX=?b{yR}d0A*cXP zmIeUjqJ*;EzruqpCJbRJS);a{Y`J4eYR#4)05o)gl?Y$Hy*+SkXWhSB)r8u$4$*k; z>^o=OoQz(_^>qg4cB1Jk-6z-R*M<09-)Z4*N?Mleih+YFUHz6o;%zam8odlIph++X zpp|RH*JdQ1g)uPf{}sV)?$@b$7%AlL7_kRE=pBsCzl_#!f+4Nf-!@@dDfO7AQKU06 z0iQ(*{Iik*sd@}g;v?Y1A4*64B;30~U1b z%(yiYItTolOQ(O{Ae5o&2PSO?KIw$lF53CnVITtWh?#Is*WOm&V(v`r_Slxjbkb=7i#QM_$92i%(b-6w|cJ$T?bZm zg-&SjN0tMa;iEqBRQ`#l!+y;)zjgOL@U85=yheR&^Ok4PJTg3`nM4vF1gs*s?{X|-JRpqB_oNO>PR+9C$ z4Ci@OxIe6L(VgU`#9NngMO(S^i6a3)2j1t+%yPlVOX#<@No^Z7#&?Ap6wuno*L1(q z*=(n6w@iRPT0ng%BYB8fiyRWeEZC58J}D_?9!XhEF@qj!A`iW_CNXhVJ`RONLK{di z`2&s}(7QGvJJ!2Ud_0cBdzyz^ueYl}mZ;)d0HkfER-K_n>Q4el82=>x4Fj4Er&{Pm zW?9m|CS*2~Sm=c(9C>opA%5oZgqej*K&JssE@aW*J#ZYw(Z2ez9MlE4PJo2}%&kw+ z_?0FfM z;bz|1t=xe+if)U=$8*BlW4FmY3jV_N#7Xqna9r{(+I$L&Xni=kb!!duSLY2JK`?Lz z{deVjiZey!d9KU8H__t-SE&P?{bEKOUR@~`7|_M+|Bx?Fm>&{!?%CcN0#$@G>LWC+ z0az9@bjZ@S(mpL~tqUy)z9%c0+1px4QDab-1!3<_>1>d41kdkyXJ}#CP)tWc%%9oO zhE5Qx-MRQ2I6@Nma-g`zG4?Y1+9qiSU63TECzObO8VUVub5^7G`dJo~V{_y-;~@;k zo5Z%S5QPl!3=rvi!erlnIdOZxyF|s(!x!QCWW@oXp%Kt?G*d6gqI}$3i)`~M8+r+A zS>HYpVSjeN(iH3aOMJzc*;1DD_>RIFj_Mc2N-+|1(2$$-zZe>Q*67TPLuI-U&##g6 zy{uYtDggp7Wgmqr*jlidHcM9~<=QrtG?v8*O@Fm$7~MFDpRu0}uhv+Z$Q6Mw_n4Rujf|o zqq>h&Yq@oOp=Fnw1~<7@_uF6vL$i2g27cNj7uu&Z_gfexw(mG-hB&Ygx%NowwPq`y zWm~V6IYd&QN5IMqR&Qq{nI*mOEK-y|k@uNSRoWJo4~ga!*u!-9T{2C*E^+rJPnyLZ zNEF>hj^gCjRv5O>q^jE%bV<#u5vxG9oQpDgSjuC28iRhTMur= zqWTA>e(J73uM*{>xPVitG47LL_u;3P)^5%5SFxuns zVg||_I#+y&VQN9*ksv>kj*UF2ibj?T&)W97BDND1)1-Zkh0II=rAh=$>`U2EM>P~}m-lon}(4~zM){}5r!-i->2((Bl*Q2CBjm7jkFZY9+Eqn?Y4IohkBXkybf zD~>(9%`J*f$bZM|ZRdQC)&pJ-pwL8%`4mu37O5PHYp7i7Mg8R?L<0|+=7Um`^0*8a z;pM?CiMox(_Gs9@`SrBop;OD5+vyG5Hn?KFT-jexy3OzgaXvBz`S_0A@vE9#F2UnN z_tfH%4TxMfk#8ue2+YZ2zkRd2hkmp~H%P!`*!WdQR&ZZ)u_(O5l}a51OZ3((W8Ov#EYg&r} zn=G1&vohATW10;hc?TAjfw;-Zu=?_b&N{?*r2EhM6Ylp40=p!=YxK_DAQs##K4^q; zx${HRNgY*ev--k(;Y3)i(Kl`NVNX`NHczed7fd8_eiPz*MrFuE$P-*phuI$OE1YN& z!Q9>y)Zk+}$?+pQP}tuSGOYnRG}u$Or-6H2XD;CRW*0Cr{31rJg)j2olRGFNOt&($z2b#-t$r_=lceQo*PWZXZt}9 zf0dtHveNgU$D4bQ(}=(&rBw4Y%Esm!0-q50VfI(>=45dCUhCJ%7I4gn;Q$TBl#vv- z+0r$J8;nog0uA(J4aYfD8t|j2(nxfW~%BOK<`a z`48qzRH%h6B+*E-JaYkixbgghZCPU1$kk&o+ei*v0TW<-w-X5MAFEIpY-c1((d50& z#^vlRX0p_3@KaG*(3U9|_NsCN1fb??KyWae_7THoGB`~q6u*eqseLjc?}Vc%7khD5 zvt0T3%<60JIk>cq)2Av2S7!zl|H^r zq`>0K?}rMREuY?(->e`BEyzU1S?~TFNJF+t;-V{_q5q;T+HqidQvtv@;F)^(OI^f% zaUa&sEzE_?0_1LmDkMb4?i=!vBa;psbVx3N4fCu&2s`i>G_F+C$vXq@aAXo}E-ZOI z6ncd#QuPkX8P}-{#;=fJo5hXbFgPN7bJqU0(9%Bh_ zm-Ug!a0k6M=)9uKEs69yr=>VMSzi^+puP0H_J0>s{;4WO0%~g{35?tN1j1=61$#!ucLhPDomj$gM~fmr^EC zg{N64jERlN=WB-Nlw`>}Npu{$r@?Q)R~>a@n@?m$Bu|$}dx`q^;FIMUim~#jOkgTC zN!QTn5t`(PGWFj`3Ylf9Ik~j!-#IVrY$r%12e!9?t3Be_49ymYQt~gl>EER8VNe<- zhr{wR)@1UKf;k7nhZ|W>{Tg;p%rAm)WSttzc$@3ac524s3m90X7@2bXs<` zOlMqD*mBZ}nAuWnw`6EF?OrfoCny?`A%=lheEPAHQU97xD<~YSpkM$T2vl;8e6zS- zJ+FFYS%-8s;u;5-jW#B3dJ-&lz=#USUqtoXjmsZ3%vp&PuP_+Mx~%s(X=fW!QkGjc zKQ~2$fug}RxV2@Wk7z&33MzaUBl1sx;hc$=7~6MBq`XiZ3HWvk-B85zJqV8O@F;8g z2{vaE>(O?%2CLz@KZRl4V;+%Aos{-+w#0OK2{uo*W!yp>8zL(R{EC%cV(!j|e1WKe z!JesQpTmgpPIaA@5;#ueI*Vb;!wU!8M3Yi)pMCkQw;pWE!1)50G^rj(0VK`l_DkSk z$cANb)=Q$4cQBlCc8p(<{>rB6+MjX=X7x|SuR$Ib?7sxeN!0VD zr~}}Nx?;rnhiN0H8y(|~@`_-iDHHr)1E3W6GW6!BHQfUn+HHqgW84-!JQA^nYt@>c z?i>`XSRY0u=Hxi%fBM2uHvDVf2$ydz^e=4e;1Ox&zShaDb2xpU_iXsNhzAP2eL_i= za?0Byqern%xND@4GYgJYW(?$N_etKWz*imZ^VZa1RJ--v#{RoT`2jGLx|)g?d;9>a zN%*1Oavc@GHoW3Zij3(0k$UV#%gxc%FO=dAp?D@8GKyRgnA-Zm@L={j`8K^U#6na0U26{2TQI8a~fw9=UL%p;OfAWRY_Z`QeKLS-Z78wh-}8e>!8;BIPmWEHF{ad@esZnH>I6brbBiRK=4W-IL@wxOn-*FVkV#+k@ZyUa~= z$;H1*(!;P9=I_GAc@Eikrd{BFzR7Rn=(MTU;rM%~z;SA=c_a%}$98Ic$p`ZPW`-UO zO=QE_wlhPU{%LUu8=l5(wD+XRD1}CxuJT}?tkwRtH%H_C>e~}Kn0)o-Ja57?7$U{r z&Dm+|Sc8-)m!DpQBr{R-dr51&1GWr(b@OJaY6Uf|TG`1OzJ0Pef4!Cy!$#1gbqmM4 zbg`@Ya;l7Vf&Yxe0k4%NG)=#^-{mpx4Tp8z%GIsN4H-QXH&I33?T)c}^xs7(aQb@3 zToCAcXzb;R1ujl(eZJtwOE^ze0h-C`hSeZ*-TN!4>LmSl;?`op5#A0)4M+zC9@_SP z70|Jz1{@uZfS2?-tVvZ(PLx8pNr)$LsnbRB)7GrhQLA;E`eZaTsl|XkXq98r`~3zn ztC}reW&ecmt7XSjtmS!J^vS2d&~&8Lh47N@(-qd=A7>Pwlw4EXZX^`!^(X6rDt$0| zA;G=IHYg9D92n8VUSL$@xyKXb4N90%zB=jk{)G~)Wt2~BXFY|FlUgv4c=MBxah^WM zme%)zX6zpdG_*r&k!4%YNo~aBtWJ|&544&FEOstKpOSH|JD3#8N@O~AIhG-f%`;eD+^Sc4*p2}_Zee(mn?SK6IRbcQYe&dcyQyOV{TpveIQyHc5liR`!J@xCO+=oT zD-M()X-I>+84E$!r8DpYwpcBQ+W@;qTf`UV-E0JM8Im2`{K`I!fAf zPQd0Gh!@LRs)r`up$c)jN(*kf)viA)3M2*?%|+NYm$>%>6c_(4NK^sfr0s)NEB@Mz zM;-&61EB;j_#@mt z5n*$0u^P-PF#CfaV~Y~_J^;P@A0kQQkSlWgZEQ#c?Db(=U^@nH;uDa*HiZ?nrd|DKc+(AE#tZ>A&%{WG*L%56VOX>vpge_av0fbC2^y*@4D?Bs*^@zl zCa+Bs!pyW#0nZerpq1x3E)p?^ZxlT1<~CpK=;#px;+eF^^L_!rPaAE#|K9`pf{UWu z^H4xJ_#rrS`1WutmUI{9*;fu&kGQN(_9!dLPHMv53fmSKw)fMG{Y~1T?s1Qa5HIJH zOTgyy1&8cb8b7zxqiz{D4N>Je#)zhHN7}_PVdKjCZ`A>%$=~mNvT5HZ0Ikg`aw<4o z0={yCV&#QIZXc(&%Cf83tqoR`+y8HLTcXT*+^*Mds_mmA z90bC8V6wp9QO?Pwun56L%gRDto_vtP+_5{APx~zXbK!LJwLPyEoEwMDG`*uwcM3w{ zWJ0gzNG8Z~qw<1=PcB{N^6bR4mBgFp^acT29y%A2rOe#!$t&it7T{-|NgWJ=2BF-> z7alSsfI^wR}ECq*;};B4@@^p>$xkf1kH^{{kB z(4Z)hp9Fo|MH5$NMv0<|8P=j5)OBoxWAGq)4e|(3Fn#Qcymibl zm+doYw!;F(c7{8h^$|Wm*?eDn>tt_p3wXcRj*q-2T3^#VYV(;<{+)q~YOQcbGz2B_ zb0cPakePN_^wS@MNG1=sQMO^1ZnpC?ewUC87o{v`v5(iJmB0ouUF?IDw@7jqSsdiL zC)EmkvoZWks9QNgE>e3`zP7X9mabM}#o)jx+B;|bH3aAbhYnceAIR?0K&y=leU!6O zm)QZ4b2+bly*>G6;;a7h91_Zv{IOkJLW|mTd%o31z-|Uz=%xEZ1)NpiSMa4xCrXQ{ zPj(YK^u)@{@0sx2_(3z%h1no?}z@XR-}Z$EiWw@_iFc^*&9glqk+N zYcsb>i7LfILJSx&J^uznSjq(ZjhCZkYQ+35{XYne>ZIRh@OyczH(i)sUo!AiQ<5h# zTUv~DizV3KJv_&%@}kNfTs|LG#$$v^k{btf7F_hEIf8qa_I;()Hx^@fG-6`E&(k&elN_UHt zNH<8Aba$6@OLv#FAl=>FaOU@4oqgq%;%2QG;~nD}>hudz2x&(YiQ|pU$r2D$hX#B6 zHWh+p*y8|Wdz!speELU*6?j=nxJU3GUi*aaJYrO?kl2BY*_pOuL}C_(?+Yx>c6tl( z0DQ&R&I%LM&AWr);A2-?mLm*(mzhp@jmHOsU#QKt6yqQ)@n|X`dPaa2J127w^t6u> zNw{1@?hZALM9?M&W<(WqJbS!@oK}rwTC~`2EdG&Q-FDAhXT%(66se=?EoFG(kaO76 z7`fuUv9Q1!5~D|OlRJdd7er{V1Z)V<$ZXk)tI7>Pqf{!7^H?74TG>n+D^gQ1whwD;Y+lQ4{BsMmF!P4i8I`>LxMDi^_LKhEcY zlk;@1${1b#Q{v_<(u;@{$U7WYdS)nub&7ik^V~1WM9$SaIL)N>Fu?b|jAo8$eafuO zzcB*a3#|bQ6_YRNVlRnF zHp$zOYQQlqQF`QqmosqR+>086pt`Q5%8YfPB@|f<{^~_5AcpqZOD=pjCAJClor*Qw zhN=|k)$iZA(Ge6+wNRK!O(!(HT~%|ewkC2(v*^S z_jP#dNdZ}G$O31#;1GXEqtM|Ia3yzmyp+-m(x2L4w49n%KgwtR_xs*#vi3Mz=n1+y zN!n@f0w98y{B2}SV92izoA-oB!E2C}wkoBW>Lc_T9MH!9zl*MDh$+@$_4>X+| z7wM-*p*KJ=yA?X~vieS*Ni0;DVEQ-2(fUGOJ2}PxDm`ni_}Aa%LnQ2bcka>LS~^Wn z8?&M&D&)Q|MAFYFEX@?Ea+IT|+rQ)7y{jvyioPvG?Ww#no{kmCfFG^WY>Db)Y=dwA z>+pEgRPcHp(+})|GSXm(Y(@SqNP5{Roc9ScSXED4vRg(EiOimoeu30W26-tE?S2*q z3v`<^IX?PGW4P~dn1kT)=ut4725hIT_*S zRwZ(vWiIk}^fY6x42zzZnJ8Ly5nICYoPHD@Mxu3YX`p3XhA!C`>=5rSr8>w8$L2QDfHA*ZToKF>3ccdhUa%Si-Vn}HtS7<9&c>Bx333uzabyta zz+fcY5@-1fnp>DcrCt!D-*=b!RY0ba&1xd>O*XQ#6{8TA^}zNyCu<*ZP=pjOdpGlM zQCsMTzdb zahMt2Dh9?6AP=BR(cLSuw}?T!GoZjK&DNLYbq&>%8Gd&$eHCcgjg*L6im!$|G;+Cn zQL);LY-(R$5@7dq(N>wuYbe5t!l|G&Rz;$HLLGSRaIq9V-u{P~K(rVF54_TI1xzN8 zXq)d3kRv0x=kc8>jVG?2uM&k#RucLEY7Ni~M*WeCD~_AlYMJvWSYYn8t_Oe!RBx_U zlyFW+^#jW#-xNxaK2`ru?c3JF+w#-1&x!jhS&lR@Wc|y{;oFBT=~R%5_fkazij4^I zeQ!U?5ksP>QSFsmk1a?)-4&t`@yV7U27dY8_;tHwbKE*n8d78F>iKO6{8g_Hn?5v- z*stL1`FeBMDIs6E<+>%x@8uf;2HsL6F#Uv&^6gvR!oV{~UNQX%GD`0cM~T^MlAu{rQq-hUu?pX`EETq zUMo2YC>Q;zxX2v^_azuH{6Gqto_FoXG?RsMVf(r^mV3WuanZTe>unD1j5tmj5*JIs zFN)=3l_Eu}KSv!u(R3<}BB8%tBu0aJgOcZo}jBnm@L4)>Bx`F^4#U3W| zacX@>*1#=J13!=ow93#kJ2>JI>E$<)BV&-j(6$}p5mRdjHzIPwPAYusTdDn(KZrGDsoGaWF8P8-{Vn6il|rdK>N&TJn+y6`*QJ$!S4&vBFzs-MFsU zC>H7KFzYhPLzF^WiVcC`4a`s9eWhL^1OqydRQpDD0;tIO_I}9RDD!V8A&>C{GYpQRMvZU5~)OV};Suv*`uM<_fjgVPqijDS8EA~{|ykT zMdNgiUU}8>D$UbnR<>v*1EW6}MRu?-S=ji|S}>sIJVA0rG`S6)Fdl4EMS-Iy@a^41 zG+GsLtMmt|v5&vd5GJAqCN1+3-$MuW7g+U}o&r3>L9SVN$Ea;g#h3sRtXdTfai8C%9!&~?I#NQ|i(hg@d6HbGTW#MF z&)?uHPAH7x!~;w$iOkmk%irChY(f3c4Qf#8*{?#IjC(_VHG9Xu$O@|cj{L;@D zd3ff5M;0125!64Mrb%2FTSzCHs%P{3q7n?^wM2jFON)5d*fW@urHi^k_{(xXa!|rQ z(FrzN)AT6DqPgCm%C@^2V}3se7izHn7$gi0HgQq^ zx<+&?+~?Tm2o-I1gBPQl#)6+dliA8XL+r6|zY`=vZ5#vPAp{cZ8$HVjM1AkUgm)d7 zG(kY>82GFC9fV_cq+Z>dBFen1hkv+)E~%UAe>cqa&~awy1+f(Z=iGH6q;O#0i5`Lr zrf&al&z7>Cy}~}n*O24+o{AiZ)cCEk^02yzJzq62GFO_je~;XCM30S za9CBsGXCBz*;|~#6$b?0+S9(C5&wo{$nL*sSjB9E4gY*KK6MU_2aK)u1+_BA#1G-$ zuJQB-a*f`NNfNF|`~bx{^GlCr0uJ+9j!q8&;G(|{!5=j{*P3MMhp-S5RtP|kdf)al zmUlBl1~jYqUz0$;`ah~q%ks!^-6`NOJ+tisf;X;#{eQ_qgo*(Jb*sz=Oh5H# zoUjlZfEGWv(M1Mf3@l-ocBs#ggHGldEw7Y7a>t{P-W3}K!K7jJ>B<^fa0ak*Pd|f$ z2lL4Dq#~kIb*VYA&tOc$_x!k4=N+e=b&f6a0UFN}nBUc=TgBO)k=J6lzv`Q+Y*Ae> zz%bN=F{`67bfC#Xbvn3icf1Wm+WSy2i@PO(ARq>26{x)ptiW@-^-fGiR>jH}u%nZqJ`M}?QAdyN^Hys~50rzJ zAY#PFSW^DjCUdQ6nO(_&H#uZzn=n-YKAv|JbxJ}pmqwd_c;t4z!$_b44WvJ;-_&}; z^)mdD%Nq)3Iz>U`kNZ=n8`a0G*n-`zdaGe`WWcO_S|l}OH1^*3!bV~AE~p=u$Lmby zFVarEna)*h7unw!gAKFCQ*ojQp1(lo49M65)bJpWFubhFsolOqd=S!S80kt~4GPx@ zRd(wCfgx?(-%BL4cO>)+oPV4eag5etyRson<$im4S#5(MglJ1Yu;?Vi;)5iquZN$= zI{AyN^q$3505MtU=>V3#_ge5$_A*dtTFP`}%^N)pyDT;kC?0;3zozHNoeSBj5S zW;!G~4kV3D36{{I+qeG&QL&(yt+)>T8|o*5rC4LkfUL7WCj^Y!v3v+b7DV@2Gn)Iv zzc;9UBE5njA`(oX2v7_~8=16aGe+Ytr$A=!SM#>~51biHH;+~@Di6uS27(MQDV^Jb z&CN!hT(u?rGoUMhknK2#3sL;EgQ-Rk0DQfHvqwJ_@+V+FHTZ&asmv*?7?S(FN28m7 zn4Fr|Z4jaetTPqjk@?LL0NvX$>?kI;sYA`Dg=EZAz2_fRh8+>R?p-1SxE!|;-&_gf z%8KM#@99q}*-aZs0wSLB@P0_|Q|lL6ExvgFb$zCWH^RKX;JEpt;0p9)f2n%+>%qiH z>G(7FaFACu{Jh(E9S6DJbBiLdqgQ3e`Gbu=?uN-s^gk#|cfaO=9IVyX74fbZ-7yWW zc8h*gj(O`IFlQI`^H}6_)R;*}x7*f=w3daew<0K=%c5c_xXak}gPXwvo}5p+`q ziwU3_{W6DKuyht1%;R-9{*7jhulWFDAv@vk4dEp_22Admj<+rGjC6sD_H>z^BfP)A2IpC56c&09bizuZ}sfLTn%LvNVXu60_pyx5? zmyw;u0#!$f%~#U4W5Nkc8IZUFFsWgLTK$v-pgE7Y&x*Q*&H{b^gJln5PlUYWA4JBR z^md*!I403R1PU7%USj4f*eyI~Q}vr|WnQC4U@`lmOua*qpu0?xNG`1VH(e(FLVJ}z z!R0<47$r z(o*&^`Zy>Gp@bZ;Q+HuY4;*Vgr>D8atiG23L2HNi7Xhhl^|!*BylFfs568o*ckE9F1cBJXTe0AtB@Vfx2!&IL0Dxh_;udCyODClXt~G|N*v zl6~cPa!m(!i!YyAB16B9e6*LJR$OKOReV#hMBdZYiYf{R9W+Rh{%!2bNe-cp0 z1vJ9VE5tdjN3Oyo zZ?}s$(b#wd$UOHkfIZ0$P6U!2*qI>IAr){U)=4|X zR%ymRnXuilB5uI>!C8)sRjdv0X-Y&uCLKd|v0sV=0`DNBzbS06i7gJw65%e?pLORT zTAqN1OAMey$VcoBNZy!ODN0Dp@PJ!(wrSWAvdFXlq(^(ADN~QK3jXmw4%^7O!+(7X zu}Ai2(99>17;1Xr`iFs|Yhn2fbk@R^J+aNE4>Xj1 z^E9*g<*|F4;vMD^IHhki0wl~ub8T>vn}&RzAfe~d0^^6yRaA#b=Tz1TI~`BU!J4YL zeY3o~%0&r5{#`O=F-O9Kcol2?m1D@jX%h)6D>nOOh8ai#%9eJCgJZ=`?7_J_(lo^yLp9$f7Txh*jRY-LJsq`_ykfbj*6+{cn?+dU?I`>rX`U|Gw((d}4aE z3z$fi9X$WK)1)Y7*DZRcdNSpf)Ae2)>{J8~+>C0OTAp7)pPJs2IZv`>%IhZ$3hAom zzwa!6i;>H=*C|}l6+DLv`5&Y@=h9CY{-YbYCJ@KdQ)<0U@}uq}NsJ07^^f&cA!pbB6|aE{J5a59AZqf2)&+tbGe>i{& zc4ji}6H(O70)LBr!O-FL85Kt#o|OaTMRY-0vXjRL6mIYn{;)NoTtN!i8UHovXD!<- zXB(4nKonZ|+=E$)rbaF*eRjX1{Pk`>7^2$P(op4Q6v#?S550b?>I!Sp%NB7AFT1Mp z(N5`~S4(Y|nwthvtwS6F{%GsrxbPQX?%zggN)Rnw8vcr}L43^A6TJ0)5DuKfVY>qu zI?!=-V1|FA=mcsFZ-2i1!Acow>FZD+Hsu_DMKfXOoHWIkb}-YcH#;zWC7^Lt6k^MvBwYiRdwdrm8rMhr4FlrV1D2dfD?&~5gY>>Qt zd!wdkh#9L)M1y*tVbCl5864C**0IK^!WjsdS)Gta4_}k2Ev)IPTMa7JaNsdi=g*Xa{=>Ln0~f-4~MJ{-&O^h09aHYNUSnMN%kuyx(k|M#nGxYJ%Is(X@|L zD@v(K)}r+M=XM{CdDGUU(xtNPzYBzke-pmN+xJy!-vauegCNtI@A^Km;DzJ)yt5Q~ z%D6|+N|k$f5a<1bD) z@H(yhY|3;7iX%&Yi~WkfW%qw*5s%8b6q^J6LHXItA&NsGUzo_62W=!0`)^gBc*MJ1 zq8H|P^a8G~I<>Z_Jz?k#L zVolT3T`^PI7>T~c!De#->3Tt&dKC4Qi3DB6*b;L2bZ3Fc6CD~FL3S?Nk-=pebfh!QWj++>*ihdNJ zeTVs!`)Gnb#T)arTG?(&y})a&+T?6OoNLbG&z+Y=V!mBKD_^5of*Ei*f$voLgcT5t9be=!Hb%=$inc z?j$WIHieBfl|WyW0#KGd-KCD_&~n1R zFd2aF_XtWnU_xRcE^+_T0Itc|G4Xc|2bPhbkO&MPqw)>r94D^TO|h*Gv&~qQBa&T^ zVuqqHO);)Os4VE@!04KdII$sGD_~Kmk((a?iY}8;?R+ALspg^ZfNuwkx07KZyU->{ z@AC`d@wMC#x!%}^5$1dVjssoU?t)wT@QU&DW$xbVkRrjcWz$%J=bh#Qf;xc;X}`gQ z@Qh}HbLdCuAN130EzTyK4>_Z4uB@AQpcS|!WGHI%fB!jb)ft~hJnsOLnx5d#B9Qza zxSe<&AfC$mpAr91FwTLy)Z;5w+9->Jx@%BYaj3Q`ZxvK1cwr^{I~ftGH$GUnP@n$- zr8WQE>AlWxe8>==F=>2UGGQJ%@&MjHKSNfR&%6nB{6FV1-|O@$^VRxS&?;%?kQb`4kz5#0wl01i8Nv zIfIB+PF`z%eXk7ByYR%8XfWo5XC?9c`zIzcZ-t6wC&YAY72_t;|o3Sb=0F&{iNZv2Q=Jc zjNzEC22w88UFo1JBYQ5_O2y~T7#B){{-}$j&FdHUFOSx_8HTcrYNfwo)|Xv<_cD<* z7Lfq~kR#{oqz+K|X2-_dgi`J%B+~hjeC%;?=i*o^Gj`n?_3jtaH<~DC58RVMUIJXe&cl}LDK;%v7r^Y+ z2^Jc?2$&Oq!?tZemd`gkG!!t}H({TlZh#}MqucRA?71fvqOK{h(Ks@|i%fb4Yy-Zo zRKkj%Ey6iy8tKBbfY_)()IUgfcwh5K@Tt2DT*EQ24srR38jxx}RZ=j-Xx%(JO@9bP z?O54tE&2-!Vlo?glqw=yyiouN)~lWH1`a2fUmHKuoJKOXhJ4H3%a*}*)7*#sJYMu1 z6xzm$LVvKmF||+p9hkQzih(S%HhLi~4eX86{jkG9eZ$4bVv9NiAXzQKUkK29#u}Vl_(g})^>-e?~j0FmSO-d zmpPNC!xTpC5BiQsUwn(_){P;6_KlYV7Tl z)hhVcWqKEBy+>}d7E}KCUYFy2J01mS#QY@k4dz~2W3vYcv_T$+I!Vw!P>mkpdcJ_z zH*t)O`T~ozK^GzX2%Gsr?k5S-1Aend2MS{#LVupH7@#@KPnO&DOhta~#GF!aoQoMV zGG>3Dza_(zWx(pK4=GL66v+UKY{ph7H16?{H`*j@o!*#CoXT|0Z14K{u7qAK`FosCG~_4?{$82BDs2dE=bL zSzBHZ53d5#vcc=dRP^jew%|4X4_r6h${MN=&f$HA#`=exfeoPP99(ya!7VX@wUaEy zCRfImn7I-tYj$71&^O&PR!Zd~yQvo!HD#Ve*ni)%$T!mg!oV?zCWM4Ke|DHq7?SBW zfILW&2}sr-uZ3NiHp>3EdPdw#(MkdJ2FO+it|?tsq4}q5r=djMV&EXFf<`sp&f0V@ z>x8AYm;K4i#U;8iL!Li$Ur@4qhg-VmtHr^ee6i8-UnHq1gaq-Zz}qb$2~z*kUEo$_ z&)9Lvp3%55v0&SL?%ihPSzf_;4 ziXF(y=S2CIj1(E*d_=);KAR!8EN{>vu5gOfZe~`5yg0oM*Bw9yICV{j+F5Mrwl6F} z4naKuPz2f@_ymE>F++n&L;vaGo>V4}4humQ1K(7R>~N&aA%}Q2`)z#VoNtz?JWpvjOx{8Z1*7RCRy{2{gA^ z9BD>v z?Bd!op|?PA6d2S)zO*YE(=&quXX)%nnJIZ94*GwPtsrDE9nrDvwB&8qDcpLzYeu2c z#(Nt+tyKnK-LvPPfvZkgic_HSM*xmq(zt7v2p*sS_2mmwo{%M@QV0N%*S~=a;L3ze zTqmpK05}g8-%t=BaE^oKfI$x#o~}sR4skhJ?&%=Maa3vNZEaQ8tv|8eF#m0${m6Um z^XgsZM_;3lv;wI^W2RoT{#=o;{;->;r#AKLr}d&+;18%LBP-5m2gU+{piHLVb}?Kk zyYj=YPs6IM#|&*c#xer+E2yz#n?Ef?(>H(0ew1d8ldv|&40p>Ar!$9R))tf)C@cz> zYP;c%W%H)A3KKW|XYXo8&pv6vf#+%lZrnktHCDL+rV*3$F(d?vYy8g^7HF8j#McMH()_aTX z+i9u}dR;~}Nf4b;QQueTMK~#@$am}E6i4mUm5yB+AnQW=Yi-zPNty5@z*8`)>jbCh@`ajO zM{Z?wwk3J^H(O3%rP-5PTszxs6K)5gk`sk_E>twl+wMr6aX%$afo32l6P_4X(mhYj zuH~AfAQXsAVwGG^eC?j;-*l$z87g>Bg;%vjR~61C&RpAz$c8-8+JPB9slwa$+N8C> z@;kJ@=hjJW^{1hM}}3BK3nY4Y|&%!b6i)mSb_&@vOv=>{&bu6cs2KV=NVGW9rjjNjargenToE) zGBDs*wxAe`S2ILdxSPv3Ahvtv>WD@mD!G74OMq!4>;N;>D@BSMZkSN4F{G5R0Y+J- zAyWl1{bH^?rCqAtT*f|7CLJUxsgS@G|1> z2a>_ta=>S*N=2nectQl&sBy`GbYN(5oY1qkm2oMk@QtJ8kvyD zgW7Ucv={*CYV`g$-{>X;Zs-k@_lN&trPy*gxoD`pUqlg|h}5=hC*IHl37hWz`gnW3 z`VdgmlKN0Q>bsW(Y`GNu4WaUxIdZQQYTaV!l=xFk6>cET(S%UZ3+IApNP^Qy)f}vF zCJra2qj;9suFD)Z#Sz;7vQc(lIG+L^wB>W#_+;=Bas!jF6jyzAqj}5)3Xj?OqRQJ$ z4FhR(XY4T_QFtXCU%B22rcC$WRoq3d_Ov**GTgpB9K4MNuRT4Mtra zw$wzb?Jd~JB4s|CCGYC&I$1v7p>yb}@=2g--*S8K1{%j;eMoI~6SsDH>ai zr0|d{>FgUhV);|12W)ESn9SWy}EG0uozyDI7DtK0k+Y$6?eQGv7-p-e<0#K+(!YGYNM(UkCYPC$p&E16gP5OJ_*PWIl-~0k@RgAGM~2gnJ6v0c-0GyUrwgS z1%StD^W@d-0*C`^4E2{CKV7nmQ8lGLNN>KcCB7tdm4-lD+YqOPw+w2k8Rbn6X6(W8 ze!kjydzAW~RNp6;_T?P6GvWA0lvRfN`{U=ZQV&7M^H znD!->ZC(nV4{ADPgOXZb-v^V`C1RErElHS(5B2*tSzTdivKzD?A=9BO+X>ch6m@Yo zv0*VcRQeW>Bo7nh9Brk^FZDB4eEb4@7{f|X0W_~Fnf zR09|to_4>G*4#+Yl)!pA)Q5dhgt^nG=ibnvOoS{jea_+y24NwMoGI56$P=3(7|9h8 z`DURG&yu=`L;h}ed_x$8Bs^mOl z1iR2rNzTL&OM4t_f1Mkv*hKNfictjrrGfGl8e4y|>Ntgc2cIsCIIK_cqiA#nv!j24 zjJ6be5yAD(z^{C9_u+cNp=!dn_1+Xo#r*fOyl~sQoWI2Ds5C|qN41%w7*o*tyt218 z`yz}6cds`vr<1feT%}uoWQ*4Ocu%F*63|hJN_`%mDlkkP#uvDG-a#z!LovD2rB)M> z&JSX0iYhv?m}Uziv7F>(=>@7>yK(risnhk`dE974?_ZGqRT7#Ea&-{TiJycq7{6pZ zN^*+i-lPK+MSH9F3j>-MOto{=dbUI*Qk*}RJ7b0!4o1wNCE~S-HFPQAC~2GCY2H*< zcHZl?5K(p+xRVPm@@aYV?qLLyl+tZ_sc$1IBK`=5YbxM8YWat*EcLrz^ViI+_|1T( zut`59wHnwzLuWIR0)7A4Uf4fki!Hxrz8EZ*hAd#o(-cv<6m?1YYij!E>-Hm9TYkR; zh4L7XVMnlGdz{g-Kh=2& zDLY;?7ITsu5Kx>NAn=Yg=nYrVg%2c1^UNm^B-LrbpsiM<-Ju1>SIsW){wn`@?1+<~ zZ=PO!5ESPSCE1coBbafIeI$+MYkCc~h6o;Q_@ZZ(z*4@NI*jAjx*Nc2;{7X4OqLeP$MxU88Ul?BKR1ER z^WE1z=LQeQO_=TlZTg_v+y$saNtg|5)^xDo-`2-DrN8JP zm3Mzm(KL$pw}vp^vPB$=bHCu8G0afpy4_7WiXmyFhNP`io+g&Zlk4~>oqYaxgGN*7 zz#v(#=kvetgz%6d$!mP1oj`AF|n^_*seyJHpgvVk`84eph}E8P0)> z)f-_FWVPn}X$M1_SkP>BqXQDh&l(-xNF?ory8f4s(!=ZeE2ZGFQzYS;55fd{Ra!o?`&A9lkxhp^5uMqrerEc^p%ABtuXwOpL2c;<`kOyI7#O-IkmmkX(&ImT1S3-n0To(7h*20 zAD!%_4FCE86*a?a>OH7&_t~NKh*Kbj)x4GcLCLFyN3A>_^xkVS2;Ed>)&q9B+P(PF zZG@~z{AQ4nF5aHUiTKAbCfo>(*Ub_Ed}QcR(%0C8@KmJ-8!y3qPnY>NJx(v)kbA$z zVxN&_4Cyh6eJv5C2(C7~g-f#e2OPLEzC3xaO;r*tZ)7~b9cH`*l<+?%x?413G1J_~Fmd^m5y>R}1s<47HH zF{0f|tXRoi3^wTWj;qYec1Z`R#CXm~hq3`4xFO=*Vbr<`_|yQ>1R}e=ov zLhzt$sSU5nw+M4}R_b%}TY6`>W@sPV>Ju}p(bgRgoPO;7sKJor{1cp}^Hz0W^9#Ty z13Z^M?4HMw2BO=?bKKK>;>KiD+xd7MV9-9N&U|1>$6XS?+?8S$;Jk`FCcduC@HMNU z>@yKNNr|6$M&YZvNO*Ruul|i6CNo$`Si=~eU^^oiSFS4QP?E}7o`Zuv;3c>MjZ6bR zJH&|nTV(BpZMsm7rPGSbNpQ^<`;d>0l#7|3{JHV*MY}dPO=d9e z%JYWA#EsCIU&`M9_ig_7b)I1mx8{52z(}iC5_Dwj^jl-sqe)vzq5ExdPx%dh{IOQ; zeOHs`uALp6-ekbY$*P;k7lg}Riy)+UdT;gNR&vRq|A{SO1UH_r_um5wZ-P)+t*oUK zZ^z1m(>w*Nz4{`Lo+tGIerYuW_=v<#hReizTauLoSdysSW_()OlQwTzm8qOO&}%81 zDksoP@fOw=Vynda-n2PSpdT@*HLk^AQq!T@%*{8kdZcQe_npt=^tVH%w}UvZo6rvW z|NcGx%*mj^__uvRs&Iafo$qw2uTJ@c>dLIt;5GL|$`o_B&Fu2a7?pYLkm_h>nz-HC zAE@h}sIcXea>$H?2p!UrijH$2MRfFFbVgTTLb2Y{+5#J~rKXol4>Pg+tGcZUK}5Vy zCdj zI6?RsQD={67&$=x{kM zNv>;?{<}?IK9aQzt(>kDQ{JPbgYbkw+^AYX*RiC>nzZ2NRZ4xosE_klos=11Fwm;& zn@EZ0NB^;^J-Kh{E*=hFnM0fuqp=t|49&p{?`G%)%>!{hj{=8RilSoHqu+T7vJ{8m zSNvc9>J`an_F7x3$xrKDxB|6b9Kh-CCBISBS?t-*d`7>@)Kh=_)+537+WDeCS!(YK z)0sIB!t|lRs1Ej&ioY|ol>X&oWzFO2g;}AuYzdj!>uY?ASfugw9~GzP7jh`t-^P89 zSt#m{#z8jK=52`f`^05sM{MOrCW$k|A+lyX=lM*hl#5m2tRG@XnlpCXX_oe^A7B4F zxVb>qES=YaALo2?74s-1!QN<)L;L5)gu=<6>hVdY1$rB%4d{!@v2fo|t#JO-Kic8o z;$W2-B{1g}D9=l){g7o^(@o6gLp|B1at3}^JXZ6&FuZc|8opefSNEcAZ2Wq0X1LXg zft6q!eKGr`60M9_i-VO17ysHLS^E6p^OpNKqHLQvU2Ri%gavl-cNQ+pF(hwGWF1J7 zEBqM0FO;6|La==V;v3#fXzz;d*I$<38!tpQl|J#a*!O1=C-i891?8SVdG8v zyZey^p?P5T;7+t8Eko%OqZ+4DWyeEeQYiwYak-|0oD=3 zJjhmx3(dpOqswyX+>ox=Tc>39T;-U~>K@aG80{ALlOD7Hc3e~8?e#?Kv!%E${2=q7 zue|Z!vcuCT!M&>V$)R=N@DZ2A>V=*P(j1y`C1#nA%Z&IPw;C7INII=hH*z+B5FgRshr zS0Uc&x3{U%!W_Gf>fdD5>D1Jfcd>d;lzGRyb-dyR0_*Hz7qt5Ob~ znjP+64k8h1!@%vd7=FT8_|Y@OIfAzc{o72Xgp5D40X_I%DYHsmqCncU{2C1ZhyU7h zMLdx6-<1a_vnq=_zHgcA&a~a@LBZbiSt~~Mt6A#7a?O@~fNnY0?mlQL4Vg}AT72!v zx=3PI>|8BK$(XJFJBb7bO%P8MOVkR-9jPCdQ5w7L?{_|SD#-rb+<=F;O||_^JoTus zR(MZN*}XeE8vi@;@EZ@c?Kits0g>9SF`P z!NR&zKA@Y*0pX@2mdL0)Mtg{32*H#<5X&;LIYB;oXf3CS*Ht9f1+XT}sW7f~5e_>u=YfrWw#&bLg zW%Q50)_uPM`aiw0+NPf2aelmpUlb+qxGRJ4KEFtoY2?miU6K(AI0A!qFr1qP63qjm zyDtQd?W)3`N%yibl2&AG5!enDYzY}jly6e#oUNtO(corWtO(@$@>WDgg)+!F+=+o`_qC0pV%M?H<}!BpUC|XmP6!ZdZ1~q zk5lBUkmNPSXP#1pv5(IzRbQ?qT>HYeZWc5p{MYwHvgsE+D{&B=w-E^{yfD`ASWXm2 zjwZ?o$}BX0_ltCO)o*zt+j9>3$0hi&(y=_!03L z`BN@~2NTN9CQUt*B(xm&Wvn)B=c(vyk?+6ngR0&>^nzHb?jnsex!yTV=56+ROXgYi z2ASqOpRJrHgC0kcevZZE&J(O?!u-ia|JGiq`Rv?adRNoKB3A1>*0bi*YE~EEQ!ef= zP%LGoU8(>+)kW1ZzC&%%L#4Yn@{C_imvIOeg9-y47PQq4x*Ml zc>Yo*(P|JJtrK4yDavo}WRTKYxr-z29DDYw7o74)Nk2VX8s%aC)SHdnpeb15!Dm}Q zr5_@%oW$Jp%~ZPmxr~u^-n-zGtUKKWq?gU2;{VQlHdi#P++pf%= zcUW=6hQlq@&f4LmOXx-W-A8NFCIK7V<5@RMA+V%iVS{aQw8u>QULM0viA}BMwNz!F zS+~>FQxX->{d%DnjIUD;7uCUPK9!^Ux1@P;n0Iha0)@g)l84iXaf)M54kw%h+A2jk zB$|=t{_os++X$Y+z(t)ur_C(M7*VbKf`iUxEC0nt(uB``@_&CGYQ6i%6yeu3hnhGgwltVXEPn`DL2b^B1Y0-{9tkD2wp4Y)Nix;KQ2QOu_6TKf`xfN6oK8A( zp6A*p1T6ixFkTa;r%_1c|$?sUEQh6nUE@c8xqOm`W+0Du=g} znYWC0Ow1M3;o>HYXRR^a?~XQ`I1WbY+LMXQ-V;pz@lf~jOMT7hMK{b^jXj#mqY~8X z(ac{!2wiYtKA2CB^99dwe`ad?rA821^9AwhSEsw=ftrn?)sXxy@)THT0XsD`~1;4#Xx3PTubP>m6R^lSjs2}g$asD4b#Ya2mk zeSLsRCK&9`Zu(B-ZTBi>(4EFPvR}x5;cFSaSGYwv2tOK(M}8#hYs_>rICH3Rl8=cX z$@H)G6@|G#|Da;oG$tEN@r$*`oX7(4;+%4RBWXlrb9)$xpJNRe`d++oVJ#d zoPNeIe^wPpt*9hp#+&MVd~m}QEN^m1psW_}r^LuwfW=1CwN%Gh9sNI!uEDL(uMe*+ zF5AX(E!%F{#&RuNL$+<#GM2fpY}>Zodw%a9@V&0@^*rbKocr85Y6KTI{aDL6mQ`#d zX88OUV`+`+`rUL*zt|@B6R=s9FD7Uac79Fr8fO4-#$Ss=3_v}R!t0CD>cn*O+)SH? z4|;i_WtviW;XsUokI~9}*mOmAlofwP;+toU`_~^fn3C5CX%>HiaBki^{>%_7JhT^& z8F6qW!|(k;&+S6~WXVA={BojN{j_uWRpBVJ&^dT0=t;u)@%yN5l=Wj;5N$p~^#)~< ze8GwM8LD^;d6i^Tz^K2k?_XGh;q85d9)p>ZO)f5i;k2^vHFGmmGos|)%~~7s@ie?b{w4x%VoN~Lb4!NN;z;pNlxoIn-T>J zSOZ+phQ7`GbPY{3#XP>@A5d^NeH;HrF{o!MC)$RgIraoy-?1s1zd&-ejGbC(GUZa9 znaAk&H;sIZ+q|qTpFCqP3xU+{Fm^P~@0#aahiB1$!_%1OUqNgRqXj?`!eQWeF%5XW zErVU+X*4O*YlRx)24g0|1#v&TujDWEzTDw!h%1J;??FQ8LOXT3Zcd!+y_H$mi*~d4 zE-T7kSj)_z#sgdYlAEZ7LmJ(KQrQX3tS>Ltx>H3{3Pg=srri(gv&1W(Dy=bjxtHzn9jb`!^q4)dXFKPxB#%OLN z0>(5x+S`w0yCxAyXBz3xSUeM`{{r%OzmGg1G{7+|R8rBm2ot6>T^!p=e;AHyZa3-% zl(i9D`QYubNr8y(3AIj{2A+DICZs%H<=c1$BlTxM5^8%6cnC*bMOB{DXh?N~@r_6~ z&~yx^78Qf%JZ!jnKv+%WW9%9vqqux~g?k#a(=gal;1_C}_i*;G6XPK2a^#-hxaaMj z2XO2eGIrV3(95FUbwUel#AA?aC^gNVl)1sC3Ru<8#GEm4QO=SUubH)!|FUM_#rbEx zp;ITSKsh_2^|}a6XicV2Qn&b$#-S55po^!{%p*DT7?bYz8N^L=N)Eb3u?O{>iCF1C zX(}xfw;#Gpi04blwY<;RLuL=z$IkGX>BQJh_@f=uJBS%(W7cqkYA)+aJlSoyvMoa! z{PkB)>ZdPz?g6RX`yy`bdS7;YD8%2y_Hz7*)f+#jO6DqhuoN-0T%0KO0X_4kZr#Mp zFWafi_VM|$aZ-1ZBuI$wCiitNPW($P{~v>&dY)1lc*?%=e>p_Ba__6H@fF`I(T}xS z389J$i#ue{HX?u_q?DhvoyC`O`AI`6l;Xxhoml z^4a|9HZkSk!JzEtve46Ge{ON6;_|gc$c+nJW$_dcQ>ZP3Z6k$lLPqG9Gv+&)iG66SjIS48n_&c1-j+Hb zeKnMOMOXXS3w!DQxCp@uWKaM0V>`V;dCh0DL^%ro}8$TG$hgPlnj zW%iT;*33{=k!zqp*~^9n>7ur?s;0TSv)9KRG|EuMkIbQ;2U+j0LUPHYj=-@xfg{qo zh%j`5(hh}P9MCv$p-UHqsfyTq#9wM&_#E|UwsfoVS*=YANww)(8>^0~&~pB0v{CMV z7_}uO^>HFWOIB`j6z<)`sF18L+YH|2`VR9IM)n_%&Y-odRtjSom-mybRwiECpb5un zB6N$gpgysPLQXCG81#1_9JHo6NzJBmjVeR*rJf64^_l zNy1giH10zY9KH|p?h?2JD__TE=fh!_wX3IinYdjhx&4oUb}Al{Z;>Z4oYe(LICxV40ulS_ z!bb%6O|k?_v6Jn5qzL72VSvVj_bB`%pcO|^X!CI5W#tH`ZYe3HORZ#(E?fK|Yt z_+00(j2XE-!vd_XpyH-NJxY05dmH}PtyY)iRep(`CJd|fzYG<+C?aqnm6rGwm(HO& zSFt8V)p59Q%B|im}n0aGPm>uR1 zG?Rw%M*qq_L7?|dV7l>29*xAQWK6G;>Zu>Bmtf!Uc7Gh_iH%cjbk0qQy|k+_!&3Wz zx&1^QP-MVnl7w`NAje=MrUqoGh>AuSbbs1iH2GPVvbxW;+-Ovf&G+xnFAp}v3Vo!R7qudFlJZeWxfKtB$58d2AgdIuCwR=At9g}}@t~UvZ z(mTo%X7Z;5onwGJAPxiL`K2lVw`-KD9;rhH%RD^^xAm^8h^;k-mPerPF`^swYn115fFX)AkGxVm@QTjeJF|G(DN8- zOQX;C=X6HKRrZyG6dkNnz}zsJ*w^3%l(|4VKMp*~_h!t`w(ZHxJ;ktBQh#+Oh=~QJ z65856m0yQ`GIe{p2QT;a%}4>SBcV0I;u_j7M^3o5%)J%E&@82gO~xUwt!~?%TGnLB zB~|>0o}K{+U7PF^Y*(_C8@*nVb!)^l$wLAbIOhH~N1yiUl&Z3g9iV%L9u+fJy|7Sf zKWPt+k>O*2e6u$>XGJswheD2u#os7&JV&uzxr?rZyjb%bPA98cfU}ryTZ*8H2Ag}a zutQe-7GWL6e(EF~JqII_eL7Pb3yzP^l29dcX`mR^+5RKRQUSliD}Z+;S?U{$nQx z@{Oq(TUmD*K`x<4yB91$6va!r;!C5G&7f@V1e?|ji*Lx<_0>i043Tj(zkcs;SS4j; zUpA$j@rv4;qdjzSjewCqCm-WN%74WX=G{zS-u*>$^@1f-lGeC~gjHVm4ouUo9LJkZ zs%=Y_Z+A)Fk#uW+X-gj;kgk=mUj3eP+@_0mQm!-&^mz^pSGsJ-QkK=18At>xQB2c$<}KXUs*(%9P`X zA+Sd}9oRDKhMVZ-ZuYhqwuo9qsu(7AWDUU zDZuu0i&mlYvqguGeAW@ij&M$_-QydLm0vmoD+B-UAh;7iC+5Cc4PkaOE2T(DKP&_v z?g|wa^}1%pzU;{oQ`R@!SfM9a zb2W8{MB)hogMNFBqko8j1LRTG8f|vg@TpJW)A0%_8bs)I1`7pW2Jc@z^xlYXa6W(; zPCv@Z6(Y_D{)_=iVTXUAtC_U;IAOyFC^%=|+nyOlojoPX{M03|46q*(TtZwVYThr} zq?TD_a9#a2ddhj8A*eBmvl5dT1Q(+Vu|1b^Z4w$mnH#XHvqjZ9O%+!a*8`tu)z{*F zy7IiEzqQhp$dWu5bwwT@Gm`F(ShZ}Dbgu}`bml7NaY)j9h~M+z06}&zt;q8gLmkXN zeyPDTH)DC0KeU=tmO}~4!4&@>BCG==DPC$?^)$PBAbU^tiO2;CvUana;S6X_8;vw4 z&^wRT;tA*vhkuBfeC*G!bEG&{I`Qn#Ws|qw5Ag;VE3i0x|1i(kcPk73u}WR}^K;=W zo-9wTt@QiWevF?lgE8UzdmW7J!FS+ZA*7I{rdACU2S}tM<-73T{Q?O~6Xms8i^gY^ zF1HDVSn}Vja%3^rpfSVF{`vWHB;!j-lx~`m9#2G$|8h06|6D691dW|^c4|1?32cCU z?A<(hw^sFIGMbbpgu>7&6BWAPvAW4dm@%*{TBM6Dq1!j4(g(X@D@lfcf0`I6plku9 zI_cL?+OyLQy~%4gX)>GWCR-8qGX6mf%AikTNd)M;2{v|q1I)lKlz9mg-lX=!R21i1 zYeqgd7VgS&`QxeLD?Pb@ynsp1o~0uU4VEfR`v+C}QRw>deZ<{7g+mh9Rdx&iqf+k8 zQq&QuDGDd$mKOZAQE&|~zQ{*|;p_4J1oTv;;y%+3OuSu8#DN884K3^3fiKTZ!c@De zNW`rw5oMC?DuP_`@v^^6*4QMEy-D^uPkt}|MpZR=mw*?$sd{K|+R8rUTS=s`?#}bA zQljz~gkW6#cU-p{qdF!NdsQAs<+T(I#C_V~N$;(tJcT1?=;jhr4zO51Aq=>r5A86s zsqYMnTx$a|q1-l2XnlFM$F!9Ik_QLeZ~IvI`*mxegX!zlU?itM<*|IZSHW~dHKnjB z2Z59XdI1N~=7L72qOvlhNbcgIz4Q*hdl7Am&7fabqZxC-t*OOdIFb}cAPqU%u2Bis$$#e|4-2J2Wmr1%A|vDS-s{6T62F-rwCMh|IQ zKd4tBXtCCiUA?Q@oi>ZM0_x9hC+ikPy)VW2|Kg22mXZ2dk z-Jd+{Z~W1hEmiJCi1yZozpzm6{rJp02b0U;I+S)1iEJvFw8K^hqzubfn%3-9!(ILI zs-02hM!(&qK)O}b)F@~|QkvcO;E&>fyByNqo3du&`4fe=C9$P&tJLVMzF(+*zWpvl zFF;442CVR}K%p=t$Kr>K+>iY`cr91=`GHSMk$133*>)&h&^loPxHpEvx0hWNLhf!t z|MIZ#LIUq2|1j?$CJzI?okh6j@-*jaWJ60Ddd+iT4w%m5(jCB(y9xEx>G8OYk`;+A z_hA(;J*Y5!z&w=uXJ~Jfu;)Z4=W7!y&rx90!-Koh8uLX3nQiE=94)gV*``Yy;%%b7 zrJKkGsNNGz=&5mi)FVSSa5NgWlukBzuDU_6WV%SxoC`Ty6qS^gZW`X-mW@nVwP(K5 z7Q5=CZrSRhwv6PCKL>Ez7FW|zVMF^Zx!myvMgKUp-z{at$3vp*2CZVmPN8eb<+{|3 zkg+PwQWF*N4uBn2S?H8!b`?o(CrHdN;*j}e0doVENDDQTF2GM(?!FVslYSF&g;ekR z{e{U=L}MiuGWpYpUub4kPgY{1=JGrCv5lp*n852notX0eKmM)0{XTWL&K}?mf25#& z1(2sfrC0jlr40S-Hs%pns+lolR~|kLvwQY_L`?B&i|^Gln;JhIhOAq#VZr;48JNdIJ2p%i z!hWX*1Ji;@*N}*-y-c36Rx5OVA>ojB2$ngQF>bDz*Cbdng9);#-+3z_cVCW6`+UuU zmF!eMsR{xofTc8V%`FBGAht!zRrbSEoenC7r0K~FBB|bZ@{c9VdUvnOFH()(r+zC7 zSfD@bO>gEOAJ z0SInL-=$OKfs4=9y9KNk)thM1il4_dIco}--{r=PbMo^|f_=AWBlpKxdnY-=mH<)( z-h^L$+PRS~jqm?m;o2&OqAyOU(0C<|z%gc`TJr~tLVYuN-`phGbkvW4K5kKX(w0A_ zQWR;KbFTD5E=dbM)P&VoS)M|qUy^@Dcwik*Mzfno_=BkBgM_UG(QgVSea~;-?`ccl zg#jj(mEH`nTnX}#8WtyN536Omy*YFk!1H8Y=$AB|NXPA7)a>-*3l>dX9#iOO^(%VW z@DSN2He2Ujy;c!9gZA&&SYyFE>y+4tM@`NeO{q4TAp-|`TQm-r50bala>SiwLwsIJlvF@kY4kSh6l}|s@E5c+N%&C z&QyqrXv0Tc%Y$r>DY@-YZmer5^v=?WJ}DiyZ5x}Z`C_g|U7!tOEdr`tBL)pE&K9r_El7s+DX}Xly>0P1FXcR3jnFsFH+<~ zW)Zb^NO)@o3K(h)ky|=HB56k9i#5~Dt9EKYgTq);?93EWSnZCCFOUB8qHMD;SoU2G zyj$^cx%{wUbk4t&HvMFupP^52@N?4p*nLh(S?bWb#yzGZ4s4)gKc*s&&>76}}+~ zeao?owz0B2R)4jx8?U(zQwk+Z0vB)&w=0Kwfc@zTLH1Ljwc^(ImXCS_VQfELubY&( z3&*#XLQm6yDY&SM%Y#2Rg;rcfX7GV5 z54(4cEG+{3soFHM30}Q)9UT7P@5^g-(CnKYa?Xa*^fkat#s)sjxogbmS#y!GHg%(g z{QY%?KR3~kYn2E1q@Ns>hM9^rb%m&>`@&iaf%MMUGI1bWEpXAQUqI=r^O1MbCy&E3 zI>TAk&KtFUS89?;bWr~){~-rNvvlbqd|5rm{???SoJ*Z7eP-x~1$I6fn!Oli8gRHw zo9Jm1?4)a|;nJHF`r1a%7leaE+bp{2#+X33tlpz@|Idcu2yIIo!%B2s)bSk~-mHrW zDa``Dz1n=4S*k{;2MlHyeB@q9MimV+_5IN{d4RtEFE(aYY;J~&;rP=@-t^1}SJK)h zt|IPHJ;O7?>c(SmCO%E1P%PIV2?U$%JZiIi3>X%xaNX~(kjOu%fIG0t+wW;J7rfaz%W!z2`Ui%iPmWpt<}vr6NsOFjcvu z)w#~~q=>vy2|RP_b!*~Adxka4r>~Ukl9r|4Wy6o{dTeO5{?g?KrLGD{Ypb-K*c4<= zAd+#b`0$)Mfe7PNl0*RB92D7OZrZAi5hz21le;%kI$;Nzfqcr>;~23*~*?D zYnl0e*8@pQ<$06TRx%s?5mesKG840+t>kqirOtyXWI}Fr^pGGX`i0sO=V|N91?{!} z>a|!Fg+hkKXgcKje$#ZiOP&`V&Xe96mq%ECjZT<(FPlxMM$h9UBP!YKY|-O|W==wp zv&?^MsURZgelD(e#c!Lh6R;u`KZ5b;rmhS22W#cZJVJwA!Z{#&Y_D{!oU}5x!`1)A zFJikxt?TRJw>+k=+&}N7#D?ycM2um;!_Z=36C~=(|NF7{B(YDiEM5s{8ytFJTREU~6QKT>WAVPFOWWYB#7o%n|^Vb2K#A zze<;TgNWy>Zm9f}?x@d_>FkugNQjyR^qd{W#Hl5~%|z+BbErdLaZk_#8ZnrA6PZu$ zpz4mQbWC{u765#`a3PreADh1b#XJTfOPZ;O3*0A~TQo+lZBoEl?!djhO`WGjtZ@@v zjwx%=5f;?B;k>Ay@pF3SsVNBC?@G$zlzgD0st7}D?|N}UjseVrtN>bGTosTC|x~=pG*`3w0ut2<j zJq%Cw;UyJlf8N?&@hy=URZl=p1cvDkCw#qvgmlNaWG{Q+o&v)YNqXrY;(}qpl~AMt z9^VEsx0!b+Yyb3$?)yW3Zp-AlhPq!^k#AQ9GP2cf&z_V6vKL`C*bO06>3!8T2c5O1 z<};lNz?9cvTzFvW&!oN6ia>224$e^fqgCg;wE(n_g9x7UNVfT#uu%v5{}UI*&L%H| z)#fgx%Wn><)c@^>B2HlcAd5=3EtrhTl3BVkg~48Vus+>}#FvAPTd8eZ(rl5aDdR^3V39s`X*_CFRSz6|31>)=ifQ~gu3_1_SO zA7s~$E${MhA?&eCDy9k5O20CN#x@Fl$>rokjER#UZ0^|}oSc_vf=DFzJZ3E`F)UX& zAQ^IUs~-yv;(k%r$47lJ4vtk&z2<<7F~E5qt^ih~%4M-KLBh75y7UKVP<`JF5Mhs%)kK8(6WiN#{zBOV9g~@3l8oQqjU||WCx&ez+VZO+=uPa@Ofn)!euejBfV&Fo zVxiPqq+WAtzh0|YVEznvay&wi?f6u%qXdU(cQ_m*cN#aevwN0~f_uyJ*r zHx}||+eHY*i`KAWqh8w*po(;fblph)P3R2XR+hD=8pOgpNWE=Q)m+5`@w(bbn_joe zr8L@Z>QYAxt)q9X>CKhMa!Yvg_<7gg6J(QN>;`}m@)esqldJv^V)%Yfu=WR?^T*%^ z&{p!%0o>c`dodH|ln-_^#pjC9Oad{Ta(2CKcApc**Fn9yH)Aai)(p?rSO9yJ3=LJ? zp0!rMaZ9iw7k%t-M~0;nitbA8fg^{M#6Yv=^ji`n>QY7!e57EhTZ?La_5>C3M>-*&$b2C2Hroe|_s#^x>X?EM#qyiI(d$@FB~dYxnP>6$7=AKlz{?>3h7kL*3@3O#_%Hvrz!7 zczgu$1jM{VOt~I%Ukw-+ICKXVG!VPdoev-2{X%A(wNIL)dL2(GmU}b{Ztbe2oN2>-bPM`fTBTih-LO&A(j~IxUcIPX?o6k0fZ>6rYSdm6>nk1>PBkAlvqYv9H$Q5SHY*6Z1+PRDtmEj z#g8(TIrU7AZ<8ntfVH`xp zXGfS+wGZOjdm6U6untiY*4M4-wnLP@%59Yz^|!Q=pRT2Z>`g?HlvrSWIuFHlD&|j= zQwB^TQC!~s$zAjPQL$rwSgWW>-3bg^U}TeY z&6ukkcmn|6|?F$nBxldM5&&x-iy<7RW1`3!= zU=^C9hoN|bs2vHUU2mO;IGp&3V}TKf{$VhCyKHLlqg7SQb`2fxn!1RdYMygU6)(fnmyS6*UA{|fer212r zaom@FJ-Mt?O+1hJr@|sj^`aiCOujrB$Wlh#XFYW>A}pGt0Y9F;l!nZX=U&qqW6*@fp5&4f6Slx%)9ljpJ%=`4h*`GH~kXw!+%en zlz4`8-E!O+)T%}LC^>Oz9R5-JT}$@8z`OXfu}f0jYoiiiEJ0hcbL+l8=ub;7;q6_R zkexpB?@GD0A%|RiP1Xk9j)y#xg%YhER)0Ugy$%XV4N;%9oWgDL;G=Pxe^}pj#}X6V zG;8_`oymxW`bxK}^X#L8T)iYSZ^wY%6a1-%06)`bnRawoN9eqKseq+*Xr;0KZ6)i5 zw#{1P+x?64XWM|vNdEF}jk_(Kw=6-HS8F@0)5M-(_O(#k-WSw&2O;&RS~7cY$77z+ z;}x^Gq-^E4dZhEKP6b;sqM}8c->Nm21SSN3zg*y;hE1su-I-58(%3z~1v3ZtX`F7; z73=udp@sF6Jo~?tQ_A&c@DF5|hOe#=rM|6sv1%yrQlLjwJ%^514{5~Lo?CM&o%_^; zdTP!PqIF!=+B_|FZd7uoJkBM1qKsjJ8YL2@P0BN|IdGtA_vijcyl(E2X9HY;I2oF^ zAA2_e;T#5!5{A`At%1h~pK6#o)^2O~qzPi+d#uZP9daoi-DDO{I)g6k%C zBMDuF+Zr|O`S|n?OuiAaHR^hQT(g~Dk*(C}0eQf?0A1dfSU#kQd7rXqAE;Ks3gYkD z9WRQnzI>;qqWv#;uzwoZquUy;pU9y;PwJok`6xzpZS*a^4o1TsCQQ>ibMfar$*!W3 z6qatt$cfV}X&81+b1p?&Fs+zq=Zck-4u-sXofel{bub+;W=L`NpiBR>sHN#xWtw9- z4aQz3py0i1M1uPjErp`A5d9dTDaINu3AtKsR{QSaZ9^)j9402s9nx2MPQZvQ^{l5p zmkHIm63-*lYtezy-G4{Jx8b+_#HHAvR`BqOQ-!n1vI%oZMF>(OJXR~XkZt1_x4J%l zLZAO~H~L;L%$4P%Tr#j-=r+@}WQZ4h2E2h7jd&bq-|<<#rph{T17*HTf-k(;Lzd|?=~z(l{fNt@+f>MI3S^(pq;75<#ZC6gqM$QRe&IL#0z24(~6{r<1M z-uPaHxDc%UFkO(SQxlbDl__7$sG~+9*fHQvqr5|gPE;%-jvIvZM_|Pe$Uf{SDe{K? zBkk;OjC{f34AS>VpZ|PohD~vb@JGyeh}2lgoOy39QiiT**7BYBOlSjZPK7S|7hSO78S>1Px;5*Fuv&_S>$bKfXv%enhf57u3yZHiN!Wl zveJ`P(F!#zDt7VJ%K)naY)j69k;B}p!B*A5hPwZjHX80_eV-DEGV(NgWEbpvOT<5X zm5II7`=Ann0IUckC|V5nTN7liE)ZdtR33BLcy=%!-ZO*|0KI4qKe>dTN)E3D!~GHL zkJ(=AG9#+9By(R12cA=7{tQboU$S+WVKfc+S~I5te1VU&tNjsSrzQA{a8&W{0QWt! z#2xx$XXau0@NcTUgtZI#?8VqukZgEN$T?eAe{1usb_q^|BhE%>oeL;1ziXI>_CkYD z^*d;ZKayF~CxQl#g_O)8X~w^{Tz%`se-ew$(^rhsL~xI*lxqOzTO)%#pAi{)zw}j{ zrMTZwa^UQsm5ThQN%OX~H7^8}kB{6*Lk<~)?tbGQi86Jnb#-naoND_7&p(}x&2q#;$FmBiN0FnkSXm96j50-5mCU}vfj{wguR{_Eu&<- zDR-wPfnB#1IsQE4?MQ^@T*OMA9PJQI4(J1UnLV-oxcYfg+2()N60@3EI|T ze5hGqe*4fh&-6(3_p}NGlQzhjt_6C}i}0({Z(_mKw1YiZ)G>hnH(}yY=;6O}S9Pb6 z+H=1iWB+0p8To?Go2IDWqUd%Q_F2c|?8zyUwq;9UI>&SK-+8mo zf7b^4d?@UVUq{mnV`D>OPT>hp{V@44mL>+%4G_dSxD^kSJ=Eb0CS*iO%1^(Jf4t^? zy6Nyc0$oSK4!mM=F&6zOGnP{La~ zu$0lcwY`(5@eS%^J@Nm z)+$m{RiJDF_dB;1!o`0W5yJE5oIkAh4%H%t5CPs6O_4swIyo%j#}ZEJIUoG=peU5E z`}$n*c1o#0iyw;G4E(g^qdgU^{_=P@QzA#tcdKP!TY0rsz``#D9*eiL%;BZaCRhSZ z*~Fx%aZ%&^DCQQc2ojTvDakoJSf9Du@R0}4XVo{>dXdq>l)~FPvd-NGVV27SU82>Z z)&&GOrBb)&A}g-^GO2vSNp+SURkvtA@FGUI^$f)p1W^dH%suU~xzV*i&*=QRI(PE2 zlU5%ffqcA^gpZbkje7qMD*TgxjLlnRn^wOk#R@p>?ft-Op!5r?)3_CgtFj0jBy<^$x zeqgpl`(cXtb*yUlchv)0C0rjKv0Af(@Bw?@zl~g-WN`W=mVPeKkk{S;SwcX)W81DS zN0@7jXNJPG4epDO%fRsMihLq=gdN-^S-2>=!5rC=YD=w$gT=5w%2;J99LJuGNMIk7 z#owVs{OSmmQi0g019gIvv;upxgQSTHv z#?`31L>={vR;W+4CP|pSMbpigtj0MN5KL0E*hrOpJ{2_h$o>KDGUB_f{0{RqrPj|u z%2yK9u|-#?_$hS>`WkDjfLvRS7U6!H`hkmfrRpb~i5A6NAVLQVYA!R+@_wNjsT5}u zy<0Z&-vXXLMb$*e2a?U1{{GyBbal3MkGA)lH{;!@!)RpiJ(%57rfbJNKDQZ68H%`v zycqbeG*}Mk+x^bfuqn1IDHrq{J25OB>C||MN7`Nqu;0mJ-OHPa*KYr$^`{UT+>OMj zMw_H-*X~pP{3xjp{K12%;I|a0J)4nL-uog_Uz8S5dN!Fpg=toYHS)`y_V62hi+1=T zP15lf6L$P0$K-?xUuVz_wK<(XM}86QXs}itIpFQi*$*p@99$XWc*@|jZAyk->ITs=%!qKFYHhMLwyM?UPD!3bXwq{m5Aqy z9kb~Cj(XJgO!)3x`1V}5NOJ+k?VCd(x8H}uvB{|(0Zjc+Y+N*5lrIPWW_Y}%g3ouXew0` z_d<${r>U@u6A$hxD*;}U=n$_ct;&~rY}nY=^98PhA(67^j<9NG=YEpH2LgH zFAXXd?z!7nK!y}8|F;XluMcj%@lrjTT`g*g`10*0SB~fWj_Wd38=Y@=8oM1StUq&3 zE8e~PTrVvqtU6wF+LYy%}LX2Lf}*r3Y$Q;>!5?+v%8Dz~#$5M{Dqmf*D2VQGGODut-7Qe|DD{ zJA&EuHeYTfFkKpMO6no^NTKMBFV-_?Id(Lh#H5H5`oI|p!ow|7%dh_t*?fl8H^5u$ zuZRj6&3uf;HERqkIITNH6gAeEdK-QLa9_$PxHn54W7C!zf4s#F7s69~{`u`W^Mbf< z1JyQCSJZeD)kc+OO`HPt@^eN?pnR#p^4m?Y5m230s_N)PJ5 zMehh13Bqd@`6$u_i}A|iS=2`w7KMGN2R}BI!I?=G2b5DtKcKX*PZ~}Z%w36Wy2TDe zif?HS(HS!Y*=4Cdg-6%}$vLvqX!Ye)h@NVeulGd-K4eR1=p11u+*u&{YHlGG2>znz z&u6|hSSLYw0qozkI3U4`81*qDI@iGJVSNj#q|le8HAU5%=HD1W58!K)vzw zT?{)hEtZd+x(L09EEL$-e*KKT>Ci*$`e+Gt0(B6lC9`~&?yimu5oG?e5l-Le>$`a1@DKdq+;0?*FOEm#Pm|1^>9X3V_c{$^< zA(<~+bKo>^1~KrPAY%5$0uzEPQH0*$tw2JIgZG4hvYQSbWL&koIwvSJ;U`ZQk5CHE z?8^VH=j^a*K5Xmg z)tSh`d82$etH|OeCdfLPV<59R%m0VRQhEm$hJF<)poSg8G5$G02kAxq0=HigD?QRO zRuk{ovf`p{6jsG8Sc>Ndv1+iYYQ&LtU~0^Hu%{zyxwFSs;Q}I< z@85vuCm4A$V&-CmUq+0k)LF6ob7c5YU&13X?i}|qk~4J&(AE3zR#9uz%gmF5#Vzob z-$+?0!jnmKVvNTxP-0+1!qm#Q?y&^LVu~%Zgua|}@icPr#yF(;nP85XATJzk%2x2< z({L$s2O(#_ALW&WsS~NeP)15t z#BT|j-U??@$xw=0ATcC3njfvCda|e)Ojz;DWwjvMC3M+X7~VQB3hKNlr1;@7*!INb zu)?`wqN0uZO|x_5_wu1pLf^Zc9L{7s9!zt6b|Hc)M%tV)Z}5qc93m9LB|y-Z;rA+> zV@|8JmMN5S>TR+YV#hHI<7Fr*e{MbFyCq9+dD(KC9driK$G4-U<$M5 zpAYPT_A=OK)Se--kY<>fMpnA@PQV#b`l4S$klA4Rx^CJk+Mw(NV|vlGu3!pJ75*sE zsW$#Bu~^EPd=WhT7s6k7P}HP_`5!VFf^@-p>l|)|V*t^bh!~Nt?h{EnBLBcy6c!1B zGITTUrBcCX5oysu^8_T}W55QjP3VMX*&z;w4V|c2h2L{$29%i)egT0@ScuSnG^)`1 zF8)7*i^BLJa$fO#jf7!$JjijFY9kha(*&p~}X| z#&%dq;T{iwgpL0O7fXusYCa8Z`8LlU7HwV1WqiAri2tiBOO_h>wiE!5<9qZLXr#ff zS7}}%?=~`z8^-M$f7vah4ZE9u{efWeW^g9C8MwA7+!*|ZO5~7SVW{chU)jI)exSS` zlj_}SQbZc%xg-i_9R-Oj2dwTeJgzMTvs`L2_P+~;uiMIcEV|pH<9|qIMmk& zh6DEhi9e5-(Op9QynyZ3dKNdl#hhOwL#U{tk?`G=B$9EAyU6j=_{wTazV$h%jdkZ( ztO1gc0;k}!+;`2trw@3y8WChGK=J^-kc94X(ULRqg(|RaPOKrt>~Wz$*_=D zOGI?~p_3UWG;3H+Pbyd2i*|S_zC?9TCvXxAi=mmkNlJ0>Js~%3gjWhhI;MCMz@3jB z*#*6kXcK+g2zN;4Em|8tR1aI3kvFN4ERo8+gK53`rBx33g26kL z#1POpC~P&%{DjOY=m_d~Hk*mx6zP${^Y~&o^K}ZpNWe9M9T;eA;SyarI` zgD9W-A3sdt{sHZx%_IM~=NdnJ!E7PrDRS)jU6Pm1gf_5AI%?Po2fbFQe`9vUxFdp2 z)3GR;uFdr$Uhujqu<&{Flj@CU2Z0v*!g>5e=N$@%f{(u^e!g75s?8 zmM3H8<7alo?mI^jUWoxqg?D%)JpPTtLcNAQG% zvHaFHPVR{(Eg6_lPPvC(h2-px(RhnGDx3m*W5Fne+t?Et3a>2kLEF?}lg5fVI((Un zFl2~qVTZk?4Cxh(`OLv)soK9wC#bz>KvSZF`g+(kKllWSQb&gjSBs)&!c6tZdOij+ z)f^{+Bs|@Z&=o^W$J6bPgvh;Thlz17nVfk#?T%0Vaop7Adpu_L7i;04QV-xi(qN~u z?IiuzeRP*XKH9P!q3Dt|FB{|m1R_vbRU`AcgTEIP^EiDO`nNQ!K%vDmQ0qq-Rnp3& z5f||=CCt8g34p>7`q}T&2)~^>M?@2uqgvsRbWx}kzrckH3rpZ zjCnt!S}VfOE zsK0<0{!o0D`OX>W7Y_+Wys4>lQ(67M5yBtK64tXWdtY*8TAcS(9VC^TN z>H2{qPOJJW;XNx#J>CUeDm+6k6X8B5U zKv^ToT>A>zw&Osfn4R0o_gBTHKXTQ_)Z8N zq$+&{PzXEp8t`F;i2IScshRUUv%JpWxf?>w-2}SZeEbROOWBLT(puk?#L)u67jWsq z^G@1l1GVXsgFjT9=wgFD&+`J5DhASDmo`#rV_t?hctqma6*)Q zhI23^S6Pn1#e4GurUB6ta!JGQv@U1Kso^St=B`>uC)wa3=qmo5?pzm>_B8YkOlSj% zvzKuqCIlv}{N#HT2Xm^gumcbbU|ARu3Dzo$eaY4W5$%Tjp9yVEHYU{SEXA7n_xL=1 zh1vW!B2+=sv!LWo`AEO!loYf++XcTYySozeP$F8>QMU#1S~ybydUV?F z^MB@+sTA%trhVT(+SdM1URutp3Fg+Osb-(HYVAi5FS>}hx$k-{Sn_Av0;Qjwi6e-` z`o-LS@@wq7lXkZiv#OYrzz@;@AeUbis9o7_vkq#rrXtMYXDm!*u;Qx}tHO~Tk!$H( z*r3$_U0#Wt9(xNSBKUuDnmLi(imf$l;B(^sGxx*G;-u&W!Q-{WGxHYc8EcY`53-Gj zBy*kh+kqmMYL&6>&`jVZV-C#P&%XH3L^Scgmd=8qs^{y%7N|%HDBX=ncX#(C1VkF7 zQ_=$I?vn2AkXE`&kWkP|N_wRvl>g@UzV{Q%J!j6IJu_=P>y3$MMx)+mf`Zw2&zd(G zp+3HZ_`MjgCnUJ#MCxy<^UQ2?nl`kv>jiF6M3x;JZQZ-cV~e3@4KD-jRWKH(ap*7J zgu9*4kNsH8Qd{hIOjEq_PDQaaa_wCSY!0MS9&X$eB<@|M8!@$H_gNtOXw=>(rTwXy zT=lG>nKhi#E1tI#Daj!p_&)7n8THl$qXn@m21G@_zq3pqGe1_|4F!WPH$9 zAmY@^bkIlcUGU$2QuEY|>*(UigG-LQP;9b~SB2-fM-^i|tv!#vMyi4-8jN8*3{R)C znR&}T?VjFd&yPImHlWk)V6DyrKt;5QEih7g-;1;^q2J|k84*lyC@9LQ(#46kD>X$& z7Jido7QSk0fwS_Ksfw-8Z2(mRk5XV3hzHF9rzL78*<`?a}pVkQmC7Mm&xJw zF0sOM)w;TDTi}8>q${=l<`c8(X(A`WW- zVBmobXBOdmQ)^oltN3QYGXcLsXjd9`m(+B#W z-F`mKEmTO1BIA~p_Q&Xw0%tCeE0MH_sC^W2Cg3RtHIzpnRN17@5mJz(TBx zD5kRNvsVCx(wAag;m$C&5E%!<4TJGu;@eQQz6jMJgZMda)I*qzvdR~qZG1<^SkK=`1MUdIT-xp6g?n`MqRD<qNx|c=SzY8bQGjfs3DVX3}X@TgLF z`PGj$2bjJnBlm@9x_|Ex2la+aBVsTrZ3!4v(WeoUt?t#;W-FP`1Rk8z-NLTWA_YAe zvvC*`%K)Y3#4`}p#6EL%(4QX`YiX?d-bgnQ{&Q%2b7MsM`*+HA`YN_itSqYS^DBcv zK<4eME`p*G8PXWM4v>YqS?PuQ8xPyP>3CsNBo=}xhVy_r=yVzOcz;$^o=3&P;Xrm(8M zPvyV{x$XJmgxUJo-R?p~X|qvnkjy((O$B{4O=bjwzD351>p}qxd6|?->lt4j$!yGP zH$P|`%W#5^>c9h40GB=^?B_NQbo)~Mk+fIO@Kdf+n`p(qBk-&MDAGc9<%UWJ?)D@1 zwzysG$#`?Fc=`?7c3^(IWI1BjEiwoUZePE%^X$P>4coOlUxmx>`Xaz;aKnK2K9qOX z_rRSeVILf{K9Y7N9|<(#hN{kEKekvKtz!=+f&2XO-M6SYe5z$LQXg^;GPE^eO%}zo zIzyI*L}R9^r)rt+sEI7BY>Ge^qv#QH5!%e>?v;82gB*YNlR?E?1DM#9Ls7WF^&-M4pS^dy;{zl7 zT4VlXa4bs?l~BKxl=VdPW^~`x&WlLuBI~$G@wa7lD#ho{$9kWGvct-K?6s;~=?Hka zacW{ya1JE=>G!ijkJ^7OaymD`2=%dAqU?#v?U6eXim-MThqXG5Rb{>V7+TW&kf4d2 z!RB8QV`XrpzZ{)(C`!D`{*#w&B+GH=H9Lb6xqN-_kSU-}e>Dnj$2M8;-f;@K@T1{( zzGboMWPJRQ17BLL`U`k;)QWxV=O2F)U&7Nn;z%H-_>Ms~zsv5GOS*iF*vc$j65-Q# zIKTCzcay$hO=)xf4UF|&@lNq?+;9*mJV7TIZjoWs9@w%zp0FmuO2PJfNBowvCV~N* z^&DA7L8*8a7#n)2fB1Xy-E$h+<`-t%~3JzZ0S&f zEK0;9Ek8y5dEs_N?S;g@ZNGLV^RuXbgSF;xeIC^r%}_THT+WK2d~sFG-H3xQ=dCTc`-9EeP? zAJ$kSJ}?<@QWs4Cuih6rkEvIOGnMYX_AO3WkQ&an;3A0#=3JkvYPTtAe_EnX+RD zOx5Jiou3ye^pkC4cG7uB^{gOi)BkAV4W z_B`9Wn5N-)#v^w5ZL#W3{Qci^F~A| z`h=?y;i;7Bzti8ZQ6YA@H)kxWc!*yU>5;5hzI^;piM(x4i&1DuLGc4!Na@g?p4(fM zgrgi9?wN1;GqkO7yD+y-x7RwUzCX6|QAjgqyN9pS0ui&T+qpNzVo7oP!sqe-;#pwd zs16(i$^5ZWqn^P_uYQ{V7uPgy2cdD5nvkoht0lXw;NdruXGil4YX5{EXi;A-G4>IS^J~gq+Wzi{PI{NT@6_0_Ny;{{`fvaIc=lbNvE%+#XeVmxHP|B;_Qtnc{Q?o-<%E#j6{B`VM;6|yBrPaY_8Rum$Un|i| zm9tls6L%T>Ju(g?0a(!QW$o^Kx9M%FR2DaYz!z<>d|$Ip=!6o46GMG?MBLV$l9m?C zqP1l#!AlWwIvY<`*$_nQ{6}MElU!0w-sJ1jtIP6VDiAa{X<g0@;XmY*g zEYcvppue_KmP#YrC(Q<9*aiY#+Jo?bLqb@dckd{#7_-Ui$Oc;4Ij)%e{QFgdNsvF2 z4Tjy^8%W(__Vo2+c&;0Gj$K#qoCGL^R(1#_&$2jVs-+}r7M+y+xkzt~N+)vY?$F*L zGM7VxM|-vXRVJ*in^vvxo|>!L9Iz#j8X>>(@VGAkWBm;0_$(la56Ngl4PbL&G~B-1chjnG@xUh&s3MHFOYfC4-fOZb_WZozKccC zP`nsuB=QqUY}s&GLILzw)8jIM!|x^wE^`tM93kij5lv$gxaa>?uF8O{1Y$|-pJx0$ z9Kt0P6&Dc}<7&0Lsb>@vFjlm*R01N59Z(Po~SS+kKx}I2#?)7>^)@3Ql7+9h{VI^r&*? zm0mw)y+%kjbD{rxe{baOZ?`O$AjKaTq2AZqX*)k8^a7#EaF$J%xUa}jRkG&MRZCdw zuT%9jht!UwG^D~0x+GdS=!NP||K8r?Fzq0dh>M@x5g+$pmp9hwh50+nd0}X#aG$)| z_6s^^d!Aj)Y*3kL>$`CNd0b2AB$L(SnBJTed+G2R5jg9L+LLe1U|j;h=6>e)WgJ_)^4onn!(O}!RBq)9U_z#j zjjR(6^Z@^O8GSfPtYr8Rh0KikB%9NlAYVauD6ZEq?uq1=-}KgtUiAvV8rG%6H^k;)yQ2mh}R+mEK?)> zeLt82YHQ-Y7l*t;-p7=e^uisocGnX_J0WBN!2FHadWOep(71#Naf9asjwBX?$~@%g zecKzKqNqClo=o?aQwk)E-mC{-zWnQD9j zmR@re(E($59S4$f+yrB5et}k$y=LsP;o7|H2nXIDFQy;C5PSvrI5?TMUHKf!u5Hpo zJrhDOObA7!+$O>U$uf04`2&6~WV-B|khL9L;V z$*nnhRyeLU9{epeUR|nJIH6kc=7O~N7(t~~e(h=zM@kfiSk>-lm>+#$y9*N_Lvb;> z@!ivUY%ba;ZXPxpgh(hpFW0YYGhT)y3C5I;E?w6#Rook~zZ|N&AF9`@cc3~JC#$0F zpZr;_G}w?2l9TXd7n)U26eQJ@)KJ|CQP&=XixW7Fj71tF=o{5k)kw}579bsRQO*`X zg4$m+^5jXO_5$W2*M}=FAcA!^Rp{-A7$M^rBGI!a5qhzUsj}MHo;}oh$)cu4xyjY2 zT|X-IHF@MoiO=$B(K?3t7&vc1^9y{iOew~Pu2zR6JbcrOMEBZLx=nzD2!{yExaZdV za+pj)^R20)42h0rQo;~i$eW54A8$b*Q^7mq!32>BEzg)2$r73tq}#%13tNkrnJYq+ zYSN_TkWJ_t-bT!?lcqG6OC*j=w~{7prlO0_7p%!-Rchq^%EOrRR?__t-hmoF>d-_{ z<+OvGCrx8IopF?;eX7=s=&~N`OD^!P(a+_b)-dKBSfg}j;=kqlZ~Yvr3sAufUG(5x z4AyfMETXSeUJ_`}G?18~Mni+*h}LVAll8ei^7DEFeQ>goVDjDz4lC9)nirmQtu+fs z&wzQ1y4lDG+qql)`)$<6;blHxkt^V~E!yktQjsGrN}~Y*(gM@#)Y+dN?Pl895#$<@ zzKSOr+5izPUUa2rI%c{s^tad)LvghZrLSU)BF4j*_^nKqZd6E4iy(-#z4y~LC7{5- ziGq-;#=9g3)*S=9JMsuE8~Nn{ryJ&-0TL0F&Dvj6=joleRK+t={r!>T&;j}*|9bhl ze>9oJW)gx6gFwqKaE+s0c=4069c^lY{=L_#X*w$pf=X}mUC_|g;Yi(@{ldSHT0`EK zfwV*aN=Vz$BFE-ti^6bE$b2*orcqKn@1K1Lod`ivw$#VErpA7&_D4oaMZE^?mHVco zLqdL&n?%KosxaAp7MvREo~+3yEJM!1!=tF(>YUu1COH=Jm4-L8RIhNqdA-mGhGf2P zN$CB$qQyI-62j*w|Jl|JBG0OU>1a-^$fm`5TDH=)T=%fA>bKS?pb@*lFC&-_Fv zguH|$1XkzG0mXFl^q`>`2A@m}v|dJls$zsizm@&bUU7J6b@V2;u2e6{=o}=MIe;kU z?pLgGyZa29P17d5m3<(!{bA(!5v-h=sk!Ef`wGFE&EMg|bfKfmEh)DdOf=?Akl_tq&~HDK%-QhZx7ahGCe zA#EX_CUI^$>*qHnop<1LFHLhr;mYEn-S530h%fs&h*i!-Hm9BR3quK!9A_rWgwyrF z&dN@vI>|p0FX-qTAL@NyReM0bP~FfMX}!@`cNEPKE<`aDC6lxq*Vy9`1>d6$_gghq zZ4E!6|7L)7wo6*UOOh{GO_86I+^zcc#C_hszCa8;vpI%S1Ft(|C!PP!s`M_;ARLt| zIP`<)pg3GP+K^UGl6+2jnl+unodVKZP-x-cFM{vT{%%}OU?bRQks%Hr%zT|#$e25? zQRD75ThMZcAzN+=0*R!pN>4<|CSDgiuXziLJHa9z+_|iVL1kQ|Xpl>hG3+di+ki)S zedaA@7k3m6PM^IfG=iE-HDD~ae2ScnB?&Zj-#Xd9mKX{T`|8esse|s2VHD;^n|zwq zIT9!h5C{wLnIg3BFChZ9Q}nX4@&}(->~=K6-!p+rnFnqIb0N0t8Jr{;B~FNR9U(8) zLf-FcM*yW>M&FR+txY%Aeu&dAUSq#n zt}M%Y1Sjyr^JV%d*{l1ww?xCFTR)U)IwXEu__msOpv(8y+9ECzh-4&_z1 z^Ep^c%PCoI3#9%~S+7ZvKJ6ZJ zPq}uC-4oa#+Uz8sxLaLWfkBDH?vn)v6fy{TbJ6svL=^2deLAtQ%-i_~aVNu}G|QxkfI^=NM^9@_>|POy zA8f(QLqyxj3CWSV8s3L&T=#!31thuFOcO?+iLAkhp1cpQc7_)0T1n+*L)6_KYFqtSWIjzJ*{q=*on8z z+#Iev%b$~~#~ghNvBhpP{M-K%2|*`1WRtd51uG=$<+e;WTlB0f<1)0Z`g1giH0U%q zy1>T?0;pSGOFACe0FyL$ZZzDykxSvBKY(0CMg;+}cKl<5}_- zjMjMk?WG-h75G9WPfvfBXogfpR61?p_^!+8#CAmGy*35_Rs%qi^oHw~)3tIG4Xq+B z#?B_~Ow@4PfUd>kS|Z}eoglfM-pK18n9#uo2c~-VDWQVIZh*6MSBUXE$5cWSJZZz} zRiC=g`luC^`|DBXVOsW~0U*=~6pZ#WY;=gN#cWgG3`t>x$>Lmnkx3LwtTb5h3og6P zow<1~#clbl!mXOn+l<&LJCZ!wCwGF7OG@3NlEc}$SIv34)+Bl)rH1{}VIkbV!2SXD zrPqR*JrQDImn&(i^|WNfJe zeTIOM_hm@aDfEnf*zwUQj2;cGm*(oGjbIqd{=j}lVSLIeo#ANb2G>FUlM20JcYO3| z;V<#T5$ksoO-&GsOGPZt$&^R7U%&tCvaS>G>qm(^Lpk?iU#_sU zPx^=tEmLAKWN7h6ed>B8gOZ>&z0AUMW49+DAW;6VT4;>m9HMLQR~P1bi_}@fB+tAQ ztzG+5=L2$A-?79!A*1T0Xfn+^lIAOtHpBGF)J2hAit|r-)kgYACY0`1FsZ2$pU2#i ztd04x$WPm>z(Yqa*cdGMVZ+W7&;7?(^$oh(<=xVFkdDbV{i4!b>^-XBZOE%fo9 zj0PKgMN?N_5n3?)5f2Me>vTXbiU-pn$6m zxD03&NpD&JVpxG@#iB>~o}dg-Tu6wrRXU$C4J$EWgA5vd?r0w+yO}pc6RlXHhP+(b z#O`0Gj-^sax{B%vICv$jv+B}7b7;CNYm9$igK0~Rl_X&%0#P5q@5vfFz_L4X@2=RL z0nf5>YjK08`Ptd}npfSVznPi|;?~E{8|pzHZDu!BFd8H)Cz_5+SqxT*=>tZF2BJt~ z+2Hsc?Q03rh}pB%sBz!#=bm|>I0gOJ9-ARhEjAjV{tF9BgRn3f)+edGEXp*G+e4Pp z0!Pp@qG`Byh3`@S8~9Gi{jXoi7&lf1foE!T(U)b<2N?46x8AgE3t+8xOdb-cOt`&N z)(7!cS#+K~>&KRf*g6f7V72H^^eO0jvnrLVO25o#{>m*L22Bi?HyF^W-DVZgS9xmI z^@=A|%mW)y!OOxEGa`gSQk`luw`uu6yg6|D^-Z#vw$M^$w8Dk zYW+^xqip!4u*3dOQWACARXl|Dna8I)UrrwVkvzj;fO!k`=?EFobi+xBfv=9kOG>%_ zj|a4&roea}e#hp>>YKe|kvO{jlApplies to: Windows 10 + +Today, many enterprise customers have a mix of modern and legacy client and server operating systems. Managing the servicing and updating differences between those legacy operating systems and Windows 10 versions adds a level of complexity that is not well understood. This can be confusing. With the end of support for legacy [Windows 7 SP1](https://support.microsoft.com/help/4057281/windows-7-support-will-end-on-january-14-2020) and Windows Server 2008 R2 variants on January 14, 2020, System Administrators have a critical need critical to understand how best to leverage a modern workplace to support system updates. + +The following provides an initial overview of how updating client and server differs between the Windows 10-era operating systems (such as Windows 10 version 1709, Windows Server 2016) and legacy operating systems (such as Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2). + +>[!NOTE] +> A note on naming convention in this article: For brevity, "Windows 10" refers to all operating systems across client, server and IoT released since July 2015, while "legacy" refers to all operating systems prior to that period for client and server, including Windows 7, Window 8.1, Windows Server 2008 R2, Windows Server 2012 R2, etc. + +## Infinite fragmentation +Prior to Windows 10, all updates to operating system (OS) components were published individually. On "Update Tuesday," customers would pick and choose individual updates they wanted to apply. Most chose to update security fixes, while far fewer selected non-security fixes, updated drivers, or installed .NET Framework updates. + +As a result, each environment with the global Windows ecosystem that had only a subset of security and non-security fixes installed had a different set of binaries and behaviors than those that consistently installed every available update as tested by Microsoft. + +This resulted in a fragmented ecosystem that created diverse challenges in predictively testing interoperability, resulting in high update failure rates - which were subsequently mitigated by customers removing individual updates that were causing issues. Each customer that selectively removed individual updates amplified this fragmentation by creating more diverse environment permutations across the ecosystem. As an IT Administrator once quipped, "If you’ve seen one Windows 7 PC, you have seen one Windows 7 PC," suggesting no consistency or predictability across more than 250M commercial devices at the time. + +## Windows 10 – Next generation +Windows 10 provided an opportunity to end the era of infinite fragmentation. With Windows 10 and the Windows as a service model, updates came rolled together in the "latest cumulative update" (LCU) packages for both client and server. Every new update published includes all changes from previous updates, as well as new fixes. Since Windows client and server share the same code base, these LCUs This helps simplify servicing. Devices with the original Release to Market (RTM) version of a feature release installed could get up to date by installing the most recent LCU. + +Windows publishes the new LCU packages for each Windows 10 version (1607, 1709, etc.) on the second Tuesday of each month. This package is classified as a required security update and contains contents from the previous LCU as well as new security, non-security and Internet Explorer 11 (IE11) fixes. The security classification, by definition, requires a reboot of the device to complete installation of the update. + +![Servicing cadence](images/servicing-cadence.png) + +Another benefit of the LCU model is fewer steps. Devices that have the original Release to Market (RTM) version of a release can install the most recent LCU to get up to date in one step, rather than having to install multiple updates with reboots after each. + +This cumulative update model for Windows 10 has helped provide the Windows ecosystem with consistent update experiences that can be predicted by baseline testing before release. Even with highly complex updates with hundreds of fixes, the number of incidents with monthly security updates for Windows 10 have fallen month over month since the initial release of Windows 10. + +### Points to consider + +- Windows 10 does not have the concept of a Security-Only or Monthly Rollup for updates. All updates are an LCU package, which includes the last release plus anything new. +- Windows 10 no longer has the concept of a "hotfix" since all individual updates must be rolled into the cumulative packages. (Note: Any private fix is offered for customer validation only, and then rolled into an LCU.) +- [Updates for the .NET Framework](https://blogs.msdn.microsoft.com/dotnet/2016/10/11/net-framework-monthly-rollups-explained/) are NOT included in the Windows 10 LCU. They are separate packages with different behaviors depending on the version of .NET Framework being updated, and on which OS. As of October 2018, .NET Framework updates for Windows 10 will be separate and have their own cumulative update model. +- For Windows 10, available update types vary by publishing channel: + - For customers using Windows Server Update Services (WSUS) and for the Update Catalog, several different updates types for Windows 10 are rolled together for the core OS in a single LCU package, with exception of Servicing Stack Updates. + - Servicing Stack Updates (SSU) are available for download from the Update Catalog and can be imported through WSUS, but will not be automatically synced. (See this [example](https://support.microsoft.com/help/4132650/servicing-stack-update-for-windows-10-version-1709-may-21-2018) for Windows 10, version 1709). For more information on Servicing Stack Updates, please see this [blog](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-7-servicing-stack-updates-managing-change-and/ba-p/260434). + - For customers connecting to Windows Update, the new cloud update architecture uses a database of updates which break out all the different update types, including Servicing Stack Updates (SSU) and Dynamic Updates (DU). The update scanning in the Windows 10 servicing stack on the client automatically takes only the updates that are needed by the device to be completely up to date. +- Windows 7 and other legacy operating systems have cumulative updates that operate differently than in Windows 10 (see next section). + +## Windows 7 and legacy OS versions +While Windows 10 updates could have been controlled as cumulative from "Day 1," the legacy OS ecosystem for both client and server was highly fragmented. Recognizing the challenges of update quality in aa fragmented environment, we moved Windows 7 to a cumulative update model in October 2016. + +Customers saw the LCU model used for Windows 10 as having packages that were too large and represented too much of a change for legacy operating systems, so a different model was implemented. Windows instead offered two cumulative package types for all legacy operating systems: Monthly Rollups and Security-only updates. + +The Monthly Rollup includes new non-security, security updates, Internet Explorer (IE) updates, and all updates from the previous month, similar to the Windows 10 model. The Security-only package includes new security updates and all security updates from the previous month. Additionally, a cumulative package is offered for IE, which can be tested and installed separately, reducing the total update package size. The IE cumulative update includes both security and non-security fixes following the same model as Windows 10. + +Moving to the cumulative model for legacy OS versions continues to improve predictability of update quality. The Windows legacy environments have fully updated machines, which means that the baseline against which all legacy OS version updates are tested include all of the updates (security and non-security) prior to and after October 2016. Many customer environments do not have all updates prior to this change installed, which leaves some continued fragmentation in the ecosystem. This remaining fragmentation results in issues like those seen when the September 2016 Servicing Stack Update (SSU) was needed for smooth installation of the August 2018 security update. These environments did not have the SSU applied previously. + +### Points to consider +- Windows 7 and Windows 8 legacy operating system updates [moved from individual to cumulative in October 2016](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/More-on-Windows-7-and-Windows-8-1-servicing-changes/ba-p/166783). Devices with updates missing prior to that point are still missing those updates, as they were not included in the subsequent cumulative packages. +- "Hotfixes" are no longer published for legacy OS versions. All updates are rolled into the appropriate package depending on their classification as either non-security, security, or Internet Explorer updates. (Note: any private fix is offered for customer validation only. Once validated they are then rolled into a Monthly Rollup or IE cumulative update, as appropriate.) +- Both Monthly Rollups and Security-only updates released on Update Tuesday for legacy OS versions are identified as "security, critical" updates, because both have the full set of security updates in them. The Monthly Rollup has additional non-security updates that are not included in the Security Only update. The "security" classification requires the device be rebooted so the update can be fully installed. +- Despite the cumulative nature of both Monthly Rollups and Security-only updates, switching between these update types is not advised. Small differences in the baselines of these packages may result in installation errors and conflicts. Choosing one and staying on that update type – Monthly Rollup or Security-only – is recommended. +- In [February 2017](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Simplified-servicing-for-Windows-7-and-Windows-8-1-the-latest/ba-p/166798), Windows pulled IE updates out of the legacy OS versions Security-only updates, while leaving them in the Monthly Rollup updates. This was done specifically to reduce package size based on customer feedback. +- The IE cumulative update includes both security and non-security updates and is also needed for to help secure the entire environment. This update can be installed separately or as part of the Monthly Rollup. +- [Updates for the .NET Framework](https://blogs.msdn.microsoft.com/dotnet/2016/10/11/net-framework-monthly-rollups-explained/) are NOT included in legacy Monthly Rollup or Security Only packages. They are separate packages with different behaviors depending on the version of the .NET Framework, and which legacy OS, being updated. +- For [Windows Server 2008 SP2](https://cloudblogs.microsoft.com/windowsserver/2018/06/12/windows-server-2008-sp2-servicing-changes/), cumulative updates began in October 2018, and follow the same model as Windows 7. Updates for IE9 are included in those packages, as the last supported version of Internet Explorer for that Legacy OS version. + +## Public preview releases +Lastly, the cumulative update model directly impacts the public Preview releases offered in the 3rd and/or 4th weeks of the month. Update Tuesday, also referred to as the "B" week release occurs on the second Tuesday of the month. It is always a required security update across all operating systems. In addition to this monthly release, Windows also releases non-security update "previews" targeting the 3rd (C) and the 4th (D) weeks of the month. These preview releases include that month’s B-release plus a set of non-security updates for testing and validation as a cumulative package. We recommend IT Administrators uses the C/D previews to test the update in their environments. Any issues identified with the updates in the C/D releases are identified and then fixed or removed, prior to being rolled up in to the next month’s B release package together with new security updates. + +### Examples +Windows 10 version 1709: + +- (9B) September 11, 2018 Update Tuesday / B release - includes security, non-security and IE update. This update is categorized as "Required, Security" it requires a system reboot. +- (9C) September 26, 2018 Preview C release - includes everything from 9B PLUS some non-security updates for testing/validation. This update is qualified as not required, non-security. No system reboot is required. +- (10B) October 9, 2018 Update Tuesday / B release includes all fixes included in 9B, all fixes in 9C and introduces new security fixes and IE updates. This update is qualified as "Required, Security" and requires a system reboot. + +All of these updates are cumulative and build on each other for Windows 10. This is in contrast to legacy OS versions, where the 9C release becomes part of the "Monthly Rollup," but not the "Security Only" update. In other words, a Window 7 SP1 9C update is part of the cumulative "Monthly Rollup" but not included in the "Security Only" update because the fixes are qualified as "non-security". This is an important variation to note on the two models. + +![Servicing preview releases](images/servicing-previews.png) + +### Previews vs. on-demand releases +In 2018, we experienced incidents that required urgent remediation that didn’t map to the monthly update release cadence. These incidents were situations that required an immediate fix to an Update Tuesday release. While Windows engineering worked aggressively to respond within a week of the B-release, these "on-demand" releases created confusion with the C Preview releases. + +#### Points to consider: +- When Windows identifies an issue with a Update Tuesday release, engineering teams work to remediate or fix the issue as quickly as possible. The outcome is often a new update which may be released at any time, including during the 3rd or 4th week of the month. Such updates are independent of the regularly scheduled "C" and "D" update previews. These updates are created on-demand to remediate a customer impacting issue. In most cases they are qualified as a "non-security" update, and do not require a system reboot. +- Rarely do incidents with Update Tuesday releases impact more than .1% of the total population. With the new Windows Update (WU) architecture, updates can be targeted to affected devices. This targeting is not available through the Update Catalog or WSUS channels, however. +- On-demand releases address a specific issue with an Update Tuesday release and are often qualified as "non-security" for one of two reasons. First, the fix may not be an additional security fix, but a non-security change to the update. Second, the "non-security" designation allows individuals or companies to choose when and how to reboot the devices, rather than forcing a system reboot on all Windows devices receiving the update globally. This trade-off is rarely a difficult choice as it has the potential to impact customer experience across client and server, across consumer and commercial customers for more than one billion devices. +- Because the cumulative model is used across Window 10 and legacy Windows OS versions, despite variations between these OS versions, an out of band release will include all of the changes from the Update Tuesday release plus the fix that addresses the issue. And since Windows no longer releases hotfixes, everything is cumulative in some way. + +In closing, I hope this overview of the update model across current and legacy Windows OS versions highlights the benefits of the Windows 10 cumulative update model to help defragment the Windows ecosystem environments, simplify servicing and help make systems more secure. + + +## Resources +- [Simplifying updates for Windows 7 and 8.1](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Simplifying-updates-for-Windows-7-and-8-1/ba-p/166530) +- [Further simplifying servicing models for Windows 7 and Windows 8.1](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Further-simplifying-servicing-models-for-Windows-7-and-Windows-8/ba-p/166772) +- [More on Windows 7 and Windows 8.1 servicing changes](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/More-on-Windows-7-and-Windows-8-1-servicing-changes/ba-p/166783) +- [.NET Framework Monthly Rollups Explained](https://blogs.msdn.microsoft.com/dotnet/2016/10/11/net-framework-monthly-rollups-explained/) +- [Simplified servicing for Windows 7 and Windows 8.1: the latest improvements](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Simplified-servicing-for-Windows-7-and-Windows-8-1-the-latest/ba-p/166798) +- [Windows Server 2008 SP2 servicing changes](https://cloudblogs.microsoft.com/windowsserver/2018/06/12/windows-server-2008-sp2-servicing-changes/) +- [Windows 10 update servicing cadence](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-update-servicing-cadence/ba-p/222376) +- [Windows 7 servicing stack updates: managing change and appreciating cumulative updates](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-7-servicing-stack-updates-managing-change-and/ba-p/260434) \ No newline at end of file From 1fc74c4f1984b747f57503f6461c73b9f749528a Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Sat, 10 Nov 2018 00:07:33 +0000 Subject: [PATCH 6/7] Merged PR 12745: Late 11/09/18 PM publish Merged PR 12741: WaaS servicing white paper from marcom --- windows/deployment/TOC.md | 1 + .../update/images/servicing-cadence.png | Bin 0 -> 54411 bytes .../update/images/servicing-previews.png | Bin 0 -> 78290 bytes .../update/waas-servicing-differences.md | 106 ++++++++++++++++++ 4 files changed, 107 insertions(+) create mode 100644 windows/deployment/update/images/servicing-cadence.png create mode 100644 windows/deployment/update/images/servicing-previews.png create mode 100644 windows/deployment/update/waas-servicing-differences.md diff --git a/windows/deployment/TOC.md b/windows/deployment/TOC.md index aa375d690f..00acdc9318 100644 --- a/windows/deployment/TOC.md +++ b/windows/deployment/TOC.md @@ -215,6 +215,7 @@ ### [Quick guide to Windows as a service](update/waas-quick-start.md) #### [Servicing stack updates](update/servicing-stack-updates.md) ### [Overview of Windows as a service](update/waas-overview.md) +### [Understand how servicing differs in Windows 10](update/waas-servicing-differences.md) ### [Prepare servicing strategy for Windows 10 updates](update/waas-servicing-strategy-windows-10-updates.md) ### [Build deployment rings for Windows 10 updates](update/waas-deployment-rings-windows-10-updates.md) ### [Assign devices to servicing channels for Windows 10 updates](update/waas-servicing-channels-windows-10-updates.md) diff --git a/windows/deployment/update/images/servicing-cadence.png b/windows/deployment/update/images/servicing-cadence.png new file mode 100644 index 0000000000000000000000000000000000000000..cb79ff70be87615b9d11ac3e3b2b69c9f5209705 GIT binary patch literal 54411 zcmX6^1yEdFvs~QaBe+9w3GNO-LV~+nkl^m_?gY1>3GVLhF2UVpaff|3|D%f9T8eAu z&gq%y?uk&8mqtS-L@?@0Dvw46X7lCXcjP;vWLrXbKfxr~IEs=NN#TbPEb%qn+mj>vww z)8ezwA>IbqCzq8W-`IVeANb)okszU_`~U}s-Jj(&$#;lKaYIW-aKnvQY#PE@H+(^t1mx(%;7lbhw& zOG-YX*aK)xX{R8J9~#zbZ_TFhj}~PN_I|E=Y#)fK-|gjlTLOVYE-Qt2B3U}f?Ygc@ zk?AolR$;X&zUYXlVazVi$ju5O8fC-ErbXAYcAEE^xbJ-*eEt}gZVg^RYn)xV7~hG# zEkAhKc^<1O#n_-q*d~B1$Fs40c?35cck`Ui z(!wIr(ZD0q!lC%k2VUyz;qg<+qT^DK5>gmTy-vDqcW^=>vO2-Y;LJAi>c={NZ1}=a zj#fx!5MURebWL6$EL28aS6ElrNVI8Hd++mZ-oI^s`)1r5Ji?0fZ(-r-VccW{yf)Oh zbQ(gU|t$8UWoOlXb@^Pj_eWFd*;@j4SJX8stConsLNVKns_XP%l=yF zNyzBaH7s9&U9D@zb8Qsx?kOpv!Rf3|$WTLmIR|Z@z+bJrX6tn93K!1W)Dqn*K{*#E z*%|vXqss{&a=V2Mh~;ng{_EYz`#hRT?sfSQ^db8Sv#yo$5@%1Rmt)wig9qiZqwvPR z&f-Td6mX$BCZ!h7RCte{_RN0ZiNws~hQKrRJ*w*@;L3d;|99p3+ub__Ebq8;J)0=% zuGvfFW%nyd9OA|9x8*UcpTOR^H0`n6eS-rX7GrJVSsxNe2)B#okekQr%|qvTsVi-#J1J@D!Uto$Bt^du`Te)K`c;73yo;bXQ zxi@85F1$p+>CVaNDaqz4Ri6lU7grl^yOQr=e88V+O)$d ztZ+c@NKYY8j;j`o;Gi+SKJN{I2l|fmyI)cq`} zMc9@~ZiXsE`{mT!q;ig)8KfIS}zM#+*+Aenp=QzV6&K^()vO^?MRUdcdp z!RBrL9yESuzJu2Lm=iICV(@dRNsA+D)egzBF^fery<8ig5l+S)Yam2LTrzq^2#HQE znO+YOWMybn4m>QwmG^s0(?Z4$`h0LF|5XAjihso6zx|LylRG~zN7BeCcM~CvL!@x* zyH>hq7W5!jRUj`IM~g3rL1!v5c_-bXfQogw-$ z-8~wBfSr5jm{*yiHKTg-pUyd6#c{kTFLUZRobSB0F2uv6wq!TE9RzC|Ad`2IlfGt` zCVwp?TS2 zBRC|T(89(ex%vJoEXaAfLWM!FL^-}cwC=xp4}4-%p8u`46qP$lSeiNE({SFw8kZa4 z^>1}97^KG9+OI3eSjqy?O;{q6#8h5jk!j$ONeCqpSFo?HARuMU>~MOhpglH_5Zor#T4r;e#4t zFKT!h#jl+rJ;w&b=f^|2U8^y$H2!y-c4@|VT+v} zb^qgNp7T)@@d*meSgh<~Ix;VxG8qrK5=vsj+Ijqs`cVvnyK!~HjGNkk z;Z<0SEqnFG_G@@}HpSQ$a~ft&0O7ZX>lfcT@3D|TPC2K~UJ$)k{8J7B4&c%zXGKHL z=#~ykcRRUFrj8_qCIp;BnQmhCpO*?>GTgEQ5KOSsH}ROR(Qqqe)xjNF*HY_iZ%aA8 z2Ui>frvFZmy!ZY5!2O}Jder_=e;F*mshF_aJSX?p(IXWu(#$vd7Dze(xTwp*z}`J7 zHC^p4sovGR?Ek*G_mvB%5l&LV0@hsWv-{VIUlY%o+GI{2?OcTTqpfNB+xkd~CZhfmBqAQQChWUsv-^O$+Wgg8 zQRaxM^v1do)EzkCQ9yj~;WM10on!S6<9K`Z!hS!6djK)^@78s7jCxH9gMrta@H2X? z@mwP+g@!I~g~lmt%JbaY%id&ItYYE7-^}1={=1nCf3okZg&t5oq+=!$fHjDEY4VbA z6ZGC7)M!n>6I(4NC?Kd#LgZIZTr%7li~(#V??M?{)1%GCef}TV;LAhEbh8+f)RNaRX?i&zOd$wS;b0y!&<%N3X$lEq{+_yZt0zZ?WQ|4OBR; zl(x8Gf#U2#*A?QMH_OnxBAYg{Z{7lccn!|AGd?tZOh8UYtxI0K%kt4ig5VH?7QnaY z1T`Sa*`_+mUm;q<$4~UvT+U zEN6aW+N$o^)G!B~ODcS;prfW1hjmN@I{B3_WHcrlCjI0Y#9aiBndzH zu%%cQ0ysIP-S5xGF0_N*gSsai7oYX9oh;lmIF-I(rK>Hkwt|O{+U=85h7*sKvksmO z^{Kd@vw?#|SJu9!cn@?5OD9s(f(}M7AsYH>ZZ4~n!he2mJy%*~c%@jUsC*9$fZmt% z5?1s!&r!!!C$QjVH)41Gx8eUv=*=g1raP|(jpX&GZw|uf+B6^7&C3m!p%>hp)s0eT z;v~CmzxTc<@Ed@*;k0OS7{diqypE{}j{TCBIT^*-H$>hBR|%_K%$wwNR*>opH!GAS z0zp7F>2*Q>oBAd`6E4EiIWJ8-p#>ytSE_UdC^s^^{U@6%b7!TYn~Mm`tHX(=g*@}W zWM5DbS7%->ifSEp{|LUuwV_qeBrRNNYR5?zdh|EClUIHYc!ovJk3G~b?@-Sy_%-4E zXiM;0PiG|nTEK~D57nL1~hm%$%G`kwAE zn1HKfydW(5BRtz=JukiWS+Q7+V^&R;uK79U+mM=C@s3}OE#~^sw-C*{6G+p^ogd`t z{!e+2CHQVL^R7x{uF_%sZfXy0_|R^#7-D7Pd0ix~i)qHw_w;_4dyHV4x-&Jr+XAV3 zKJO=|K!ow-BlfY;qVkzXn@xK8RxnKaxg=TW*JGOzKa#qQS;lk~mR=o-EEV>k*<4iD6P1hDs0Fq-jq+#m zk4Nq7yDveWpYHtL?hkT)qu)y$QJjmYm*}}y4(%qcse3bZ{!nHuV=w?AquU@;cfNm_ zL^1t7753R<8g_YFIH~F%(!;Z?AGl#~oODY$pDc2+%b_M+dKu>FM_#{DUmtb;sw#3p{!w&rr7A~k9`_6 zWuo;(4TCK+{l8cgdX1#qW)fdP%MbqA0EZ7#S*?7^sieDn1wnDT;eS(a)u~eiKI&`tCc~%W;b*#}9g|i&d zQ$o2pvX0|FulQBTm3Vg@N28;Y8T%hLIoA=poodT%4vq*PydVYi03X)Aa{`4EL#YuA=_UfGo&x$y0lW|hn5rsnZlCLj2BZ} z$WgUS@e;%iE9Wj*OKpp>I^%r7n=kMvM$GjtT4SfJhj%yNUHQ}Q2m9o9U$|b}Oz3MM%V9AvfmTRFqFeXfTIvLFeOC5WM^^NkMBMhJ8Dn#wb>#mmkZh-|E ziw1|Gnw;(ZH+$>5QQY}jTH5$CyKTxO@825`Evj7bes+LcC&VB`Aj~R>!0!x)t6~3- z))8Y3X$AgnmfjIS8A!x1-8@mWP~&D}8Kj2aCaVjy2y*vSFNDPi1Xp!Y?>+z#Y$o-^ z-pbn_K(7zF9#nr2oG2%EF_1RFol389Toy@z!|9(zsOU2Vm=Vor9L)zxcLyP;L83}kq zLrwpdu@+OWk{s2o)9#(jse^(YRjzv~1EzjjiQHju9L zO;JXiuVkh^x4v4`JWGj4NnQUSMVMCZT>a>DKLVNV=sjwH03M3<$H`CeX%B;gPA`Pb z=YVE(ecqb!b0g9?Cbr)GTV~oZ3mYgb1{yO>t$Le(liWKE zku{jN4m{XqhY~$KQKG+{*Fmh~yVc8VxVJyX)U|IkKS+(p+KPZ;!H}IzCvONIg!I^9 zaw!NYkTcg)mty#06&@Xa=;zWx9py_byePFyi>{`or25U=5?5ooQi!4c)|GIl`TJXS zpqYTRK=R|V`A1$OUx#i z1J&p)?HOv_%wSstgtE>;5DdOy9@_7W}_v?>+!b(|C0J^iV1_Lvj1& zA?WoS@9U(#&cyn&LsViX=2YMvX5wIk2Boj=FDw?{mC{}udp>=+Hk+fLElP!bWTL?U zmjY?cwvG&w#vL4uXZTB2jd}^g^6}-=0So%*)XYA&8sLF+_OM(nQfL{DY00_&`%nqA zYTKBEIY#(USZH@9lC>u%rJ*M$Mao_L<{}UGLMIdmYD=55q5{4@0$l7)i9V?RK zHMF}|@dz4_U**BF``76qF7M`kStWK9McG8Dq&l^A;p&dr@F~zNwL)9TmFuv951oRk z_?x=QNxzq;9>0E;H<69C*ayz;ecbp~+SYg9u0IYWlnQ11x{*jab8Q( zW*|)ab?0TtW*%Rcc)lccuQC6>KJ+9kha;EXMT&fssS&B$h{GFNzYZwrr}rZv$5?b@ z(Sa?vM|^7o!6|r77>2*&Xaoos$&Jpn5#FSX(O@CD=e9eGi~|u@GkH`hFWXCP-k_+U zYac1}bR`_m@TrHx+*1dktF`bOA!vZ&q|TaH!fvV(N#qD$VrxdpqXq~L-_@L_K!JjE z#LS*UE#MtF6^hJh@T3EP8(JF*)Nt*g6I;)D-Yf@Zihkn{hdG#?3R{o9X0S8!yNgJ# z;v$`Vh@aU_Z_Lo*Myp0$ZD@f6%Kb&9*QbTjz zU7-vcD^T#_=j#)cmcY$FhT*`U+v}2sISJepW%%IML6miys;1JE{L&pK@M;>vJ3X4`%y?oZauHP44Y*}FCMByr+;{3AP2 zSxevAnh{%ub&L%aDrvA;E*|Bl-<&{UqU0xfUZJ-Kx?`*=z05Dl#9@X052tdzAr1Ks zKE2XKE5Dakw3%J&r@^vmBmZs8I#7k$CXpln%}b98#3&j3F1jGDG?+8aSam9O{P|e` zM|KTp7QABHm3iKqC1p}p*_t-qfSZ(#7|NOFBktgC+dVlw0jRO&voPKVp{jfo=Er`~ zZ6QoP9dPCEl*-Okr-H&h(Jv%ykFXy)MSxH^&tbBM0Q|kVv`nN`G->Y}cJP$X@>iU;dAvG#NBSa;&u|9DiWI`NJ>^p}R z3D}P_!v;-wo&k-kw?P&D*C$yejPvNWyuEZxf`NrW(kPz= zZmz7CV%KkaWfn?Vs2A_^tZZN2pz&Zxx^inMcFC+}?Hzo}Z`<6TdNr4^w1iI7|85gY z@bYOoAEBSWviKkS!;-VTd(~|(kKL>uNPWW{7{MDDyPW?fNttuKnK^Lsix#RVg1_!Y zo6Qol6bkDB2e>_!(ZEKoHqPm>A4%<@qg$Q8o*1Dxy%I;ietI8QsrAemdeG3l!$qvA4eN8Ehk8eS&f~6-4~JYz@J;Z%MDD-H-+piDeXZ|~ zzBB&svSDeVIj6g#%kBDY!Pi^FrQ}buW?!-v6#3x*KS&yNXNGH1>L7;vVhU+WKZ)M7FIn|>!s zek>o3K1)O|Tdy%|f;U0EFY<;+sAF6_pisj@-8x#>H2oTaXEw+w{K27Fmf?9I@zoxs zGowy~47X2Yv2dnI*YnTNo!@)50k9_pdZN?0u9sF3 z6c@8ZLm&vB6co~BGj+zQErv3;s!9Wx)8yu#$#`xx&?=O3+iUq zufNk~TX;)Co}Z0vbwRE$1YHI!p)4EAa>Z-3S!0mHjQW4l+so*w<=54Km%1`SudNob zil8kc*KP-C|4a+6YTARLFXjQ0eHxxQgZ*=k9?pfuHW3c|}3vNu{M9?re_x7}I5rb6l= z!1o5DUHJs&H?M%MnWx<>z6oRqFwvm!2~nT$UV(ca%G@mMF*O)Y+in>6fhL*e5#{~w zuRp)RgI;5&(I@%$y$mq=pC+u{TnkW(Wgr+vmx6g0zmko32|b?=Y*_zM>0o)~Ea`@4q%?XiR89>QIzH%G6I?X;or$MW1I+fOmK(4>}42#)F*_P=p zxoT*(d6vMd%Jl(>xnj8pP*lRcNUWqBVR-dZx+evWbheYb93DSj9v%U+S7&7VN?9fbzj?~nli)%o2PFvJ(SH*G!l6-EJ-~X- z5iD~=V-|-c^?iW+O-R>U5nI4>y48~d!Z6D|Cb%9ey)xz^Y)X(jbjtAH#mVA$jUPU= zrWduc$-*K~Jbs-gYl?2O2*{yPqgWPwf%wP$4{fDvtgNifa5QjH2NK^d5G`Mv3BLQJ zVh%nq)4C3|IZfSO9@B<}XVn!D;KL(6YW^1N3ys?`H+=k9Y#&CKQ~|W9_5FT8if7uB&kl%5;N0UWINrQ!v58+n52oAl*wrFvddq~Llxho z`4hBjsSQ}!5H-2(9lQU_`j0%EH$!L6B;PakC3hqZY4?Q{pm%?i^?FmM;B-y15 zgJrdazjL#E+=mHGE?U6)h?QFT6j@4?P6}77xpcUn4)g+Cpi!7p{58P70#cVhrawy{ zoPQN%2ei>%J?SF#mXIjD0xI@<4Tp-x%)kPP)YJEW!6dF4axOxZ@aM68v3H9N)YpTN zL;Ml?NepHOp>jMjemo+P>6=J&_;sdXOL?IDOHg;Z3VEL$E3FzBIDB3`<_bqh*z)^v68U_gTiSolV&oJt4@8buV z`;!);yeMQyquUs>hxR`Dj`trge=cHwEB|q$w{MDOU#J7@mb9_v*2<2wY+993pN_S2bYkl5jU%}UL`Z{ zXfhk?_>$RL4ODI_n}1a{EibtJc2IHfksoJ6)j2w!6ADQO<<=}n9KV~^T8fp= zv#8zz{)=Ho$3O%8t9LB~e_E*II0mZO#@hvWn(u&NVMuesG6QdL^skZI1$sQzz6O5* zS~u8^XH*>B@?njM57K^}-Y%xH2KDahJt|;(QH_0qwv(0eveP=Jz~H(`7b{Y6vzZC! z`v&k!y2Ixd3XKiYYEPGu4|#Qmmm;&GgNVG-!cMP{26BatI9SoF$;WIv=VGX1vC<>M z{(07!9rq^%9aSJ5CcLlne4P}m@FuV9bHh18%O&>lpFw#MRYA2XzFMmrU0;g&jBar? z@@5c_B|#X^s-MHrjHj4-PLI^_Hi!hXuaQt-(7_Hiu`t*|f-PTvd0Ie}&S>l}nlOaJ#rS z80eG%9c0Y8;yLsJy#U8!HdP?&R`U$Vw$&hjQ!dn}*KMP<3q- z5r53W`sBe>0cNzODFE8MA=!&aOLNH&ZzH?dV)S(94KR_z}p~^}6A3n$lij!{wt3%TplMDJX z=Jxy5LUSN-8Ue+VMH#Y3?SmQ8^&!wR$!nRn^{k}2fs1M;m_}?`0A}cAA%6>I8DN3q zZ?HCpf*uG*gXuy!uQGTfej zNO?m>^|tRg9;yZ=FyczW=K-#!7GQ*p6%I(6RghV#e~)&bk{`3JCUjIS$Vp$M!jVn) zZiq+Z>HgTL#qqa=T7j+Xth``Ur755WmQWN(g(`7jOQ`s|2;@|;2P3tP?!QG!egg_` zw!0?9Vk2i`WOB6YWd`6&kxnCPVmKW7f(i4t402ZYp1|S#VVHUkCwn`5 ztuGg-`v9@xqlSV|rRJUxf&p*l?1%P zZS}j2d9F(_#_s7i-$!H+++i`qqbNR{bl&Wk(|(y8o@ADzX*4&HxsQ0tTLqMcMsF ze~mkWL0o$TTKL55GoUNdpeh5DD3O#!fQfnG`05lUsrMKD4%*+wCX~fsyhh3Unn8%*>!5U~sQq^sy@IOZR`w^psC~%iAb>H}z7Q3Pw>8@Ah z1xpbH3bTo*#kA(Me63w_qqVtv~=1_amg?5L*E~dN=Up6FbNf5oMuC)-?_cp8A|Mw^o+ii zmdD?WtG0J}0IJWmA0sA>x3*`jK?1>{XQo6{x*6ngycte+E^0C{GxxrI+Pr})v*?#% z{WEJ|?h$jTFJBB}4?L9En%U_RU>@JrX(acq*1oaa+CQTS`Cz>%?%=qrFKwtw=ML+n z13KwY-*r^ zJRN>x7jt!j+$HV13<3!uEy=^Fpa^lfDQ&0VFTNDibUd)C7Fs@SU^W&%DgZ9NAXQYc z>#csYHO8xQ}@h z#ixJLIy>!%B>sAL6_+YqY~jp9X%n2qZtM{54&Xfl-1LFuHzo5UOHq9)R7$io-J9=) z)g#TuM&2T?Kpuys?y5ZvqoQ_3sM6+$CeAC~&Zn3v36AvLOz?QLP5;<6am;`($DPn< zIu(;>8iBm?(B*dQp1|tP(2Ny*^ic@&q#Nk|0L3AD5X0(uA>>^8;%CLipMbUqZHYA> zsn-I;o70Z8q?S`Wk_*-OQAgFZ$n0Tcdz}hz8A&Rp0 zT%H&k(hlBe19!A1(=0qx5-JwG5(aREd?>o58X`yA!Ji>5eMI*oeF zy4bWZS94Il|DF-He#bz0;V0U9JyRNL0dPgkWA5er*nRQL%To5fYM2W=XEr+TmFH++ zZ6*c(lv^JiGlsf>k;_m4IsOSemVrZ`-k-e<-+4IDy*1 Ht%6$|j(^(?xrFa#||x zqhW9!u&`m>dZ|lR&4RKJoe?p4_wu^hHt~BOB=Q}w`VX& z`h%gZ`%O}iB+7SF`cz~<6%+!O7`wQvlA6sA^6+?-H9j4&V`egj;uI~#!X=ODl*Si z7pG(uaohvtqE4oe5&T-p@~f;W2cJII33%QxwxMq_zVJz+X+-mzw3`#)3u9{tZ_NFxRfi)kpn(ju|)Bt?$(US{tPx?0C+r zDq>bWv!jw!KmUsI2^xNH*bZ|d{d$t+wcX&Xoij`bNK$5!UxtI3TvZACrv0D$?nse< z-TE`~qYr{Di`uE_1OrK`4re8CjFuT%qB1DfV4wX3@&5 zy!I8q7J2yU>^ucN)hN%)&MR!xp?)4pR-9S;@kjBS#t|C-JkTsoZ~XW zmlXf}$iO>4d8Gnq1>-hLbh13O`!%Lt>EkBT0LtL+Mb!7OsE(%`p^_*TI2+WdtpzCd!As7;p6(IZ+^gwLHcMm9O^Xhl}O~V8DaXj23xxnH|7vg=3m_T^1e+nzK^zA z4lbK5s1?~M0FmswoD#v5alK@1f={ftsn|nmI#1!19wqVvfJ66R3-TJv4ZQl3W~Znm z^_1A1GZXb0p^d`DVTaCp`st|{vCr@*Zx3cJgf?LpDWuJMk=Dx&6~l*bi!sAVd`gMb znfo{2i=2lvv{o5Bt-B-F) z4>n~%#I29-Svcu6bn@@<0)3qKsvEsAwf{=(kI$qJ4CGO-y%K;o+3@YH=_|v@GklI> zSXIX#z*|?$4F#qTt%9q?RFl`3;W0=YAqR3vJS+pRy&v}~r&~CPD4@f4Ex+}-w6$-# zX+%b;VS6iE`AD&vB!eG}35Ght4V}E>SpWz%AijW-QWn=s$`<8E=)Kb;JTg!a5_nms z>YpSiCFca)o9`ksm5fmI54-}Rf`+D5BmaL$<@2O<9jhkN=V-#e-wtyv@br%`dEcYa zm9`y%H{HsD+Y%Lo=6_?g!2Q%imuAUXOmTf}6mptij+vvWTlTWymj1PIc`lWX=lLX0 zzM7!N>Vv*U?~>E=cg3{jwbW9wHu4nOs9c1K+zaqgH+5)W%66&)y1afK58&)~ZPh{z z0v$ow;0rqJ`D)qJMVMI|{WO}I_;4iG+R-w1d@C=DMokN?%I$2P>I(GKvN|l23>Vd! zB>mHS2VuQy(E=5pJJ&z>ufIGB-^Sx=kjk830&d0lQ^XG1Qn?mYMAxu^=^2}S?&zer z8@z6&?)5^Hr|`&Yp=`!@=U;|de$P{@^V#c-wc5KtJtR*cG4bfkbz7E=%P%_&JN>|&_|l*8vzY?rp442_M5 zONegL{bt#mEsAAZYX!L@;WiKoh*|FMFq>qZ8iRWDk4w47&9R&2IjZk|ex6TVetrV9 zU$1=vds$@vwa%#q2?&0x2@$+kOf35wsPh|00piu~v1J33MbwgNp~+(*zi)m&&2_A@ z5_0C*DRtNtW1;*USpvXM47vWWSChb!w2GhI8`CgZrsw0d=52)FpUR&H=ASd4&gQ<( zdXY(_<;3!H{CACx3;2YiX%8IGxl48PBJiyW=7uc z-{4BivjB>J9K*Oy9%!QxsR#y)lX;ddN&^059$8K|qPjd0mmU6qT(YFbNpvOR zh@;W{5N@QEpD(%z$GH8cT}Pyc&Kk33IJtxad0@@Cc@d6u{XqHT3jr)Vl@-4xFoW0!cgd~@LGpm zA%vvk#>M|4gu-jPC1;N^U1q>UwD<9yG5FfY)??`vpZ-Py0sSk5VQRAqzns_llq8f9>2UbeRKi`8C%6(g&~~1Fj>4^g9K?z9CT| zS~LpP`m4gp7L2aSS}Q;j-D9<7OLE)tPZIUK8*8>UVSeuhP(U;!v7^TXgKrpj%Lnd< z`GMW)fJpTFaOM!TwjxLS&MwHp>>2`A4EE2&cP&B{^nz95DI! z95E)UxqLEl>D%@y^1E2{4;5&$iQU)`2+VMJKL&gW`)bbo#2qB?R!(6>MSaTZR>9^i zy!yh_s)BqH_)~J=DmyM4!6F?$D(S=}%i1lA-UrAt$NBi&sQEQ~AuKmS+Q{^G#y@P6 zQ3<{5yie887{VHyFgCUKf=1$ca~tM{@d77&|c zeBq$9U=4(O?AT;4*-s=p!>WdlVJ5Kq9uk_2v5!YPR!Da+geiBO$Cj zXz#|KC7dZ=DCM%`;ZGn_MF5{4t-niSXmke~@fFre>|fLp}6CZ%z6c z6Pk&VcRY*bJ5Bwl5(c26mbDXtJi>eq@)F~_E+v7%VC{J89d2)rhtW16oDjN%dL8(q z=+sm0wl|i?h^-DDj}}aMvB`>F!i47W1bTp`#fy;)0pNyr@eMEl^4%77*-n`--8G1Ad^`kff!7;x zPNujG2qe>i*Xd${{{f29R8)#Gb>HKA6tDxw#LJZ8mPw@!_Bbk^q4REgZpl%38E!d~Nhiw;bq|Iif5I4iP00um%=RcPs1d)?VU^+7`0K>Iu3 z4{Wo;4yw@l=?XXPgZ=toHnIW!@{2y8AU9?wvzPd7Dln}ypqFTkG(lFF1qfuShEK)& zGCn!~^=(4QiU^21zKVI2BsAZJlCF*n?bm&z?w5O_W9>UKl;U+*1m+SAN(rqp<(@-x zPKtAy(&Yfo^*@oEifDU+Y37vWgv5e}vDMb_f=!#oTpw*d7Aa&E|8&z_DA|8}5C6rM z^0LV+^%U*TCviVQHbJ!H8g-5vBxFR2HeasvLc;RI+l(*r`@J(egXi2W8BQ6h= zh<$$9mYM}3dD65< zRu~v&%f+0fho#BsmD^yw~~S>CRC9FGU1NdB`$)6WNZxzlJ**2>m@^?%1>)V z%&f@~gowQq<((qr)^-6+OaZZidf#Q;B*@{Q`W_}bjLcI}M_>B+(&l~x7+F1#kTHb1 z6lX_80mcv@^=e!^8E1Ki?ctjM*KO~kAMO0#XIgg?$KOY&P2X)t_X8u!&(>f&dwR7n z6H%t_)QL*+PTF{gC&auY%JxET%>bMLe3Mm{Ct|p4+yA@x{tMtgGGw@BNaE>ZQRU>* zO!h4L-4He2_bDw4c*$;DCB`E6mERamnUvBmX)k|AuxtGK20+E z>k_gb7mGFxfSA@sUtzlW)($N_yh*VUb)*ELPLW4?bT?V<&?LwAuBE z{#n#+Wvhdog2Coe@qLS(TGBL|0hxf*2>~MNb!yj4f|o+nUkAv%K3QG`_mvbE_M)aSkrcdoGv74|GIgH>n4|w`;RCe&anQ>0IFu-VvfVxbZP!t~`HS+ho3_ z9^~3gzrXpnNdHv}^?+3M_ND;wkJAZ%UjPVo+QR$|*qeA46__7}xYf-NR;iMNPNhr4aP^Xh&t;9$VqS~)#=oa5(}aYshmehdPR84mP z#fHLi`;CXu5P_Tkz({~CyF#=-aTpji`N@$DFqqhHz=RTjg~x>Hv)bRM1FUEF2ivik zofN+@5~W2!@Bny13gGFJx`0wd=hJ+1*Y_b>-Yct_Kn)BKH}4}Z@DI3o3kDhOw0OTh z>CR}XTXE_T)1WLn7XDfwc3?7BW_5VR>;F1eH~e0%o(c1VN0ae%B;h_BO3lZ%UPABh z#)1t@#>#}c4vQ#m2`mcW@%;&R?i{FDG84&b^aM2D8p_Sib-Fp5@L1J#tBWfZ4!j#` z+|CGR6FYZ|tkJ~7ugl~{YxE>~rAv#Z>&`T}<6GaqMRLbibjPlNovzXW*XLAf?aGCu zgX1CxlG+XtRq&KFM%PHyk#@&7nEhVWkt4$`Z!i{Jw9p@b)C(}b4&4WIfR@KB*lBDx zfMXZG((_P@5iuwuI+T*>j7i#dNDAQ%3Gbm*WED||FA=%cBt>2aIyk_*(mFD4R9`8p z^aLMeA2R8?;#mW#$|Mlu<__?KC@=r0d${OQ;RjT1$7;IQFX(50Dao}xK`Xc*^myAO z?I13j&@<4tX{7T;8}qpC>iMHTI)quj(#{0yP6U|L>lAGWSa4SxTJ!p-cUO6y7Z=|1+C%P_` z1`MoPRYkyU5qCj&c&rr+kW1auln~;CZxv$|;{U4>b`NuYr_G|xhC&Q_TsoV*O*_8? zi=F5BRijsSDRKg(t>49@I4DCqR0*^k%AyFooxsV9`W2EP(&U$rgl&BNFICXBaB2@f za-*hNZzF(uEvlaA3@D5}Jp`b#^Zw}iN}Bn9&KWrc!eaTXT?xKOUj}_zu$;N}*~ z+wbWo=|C{Z9XIEh5hvZC#a00~OXROj`oKB4ouv(jWi0 zsOD@)pHN5ecB^gA6hPj-)ce4DEDluxj|CHwIk`vazr6F?j*F`ylL*Ro8sUSh=2&AP zu}@y;cvMPW!>n@id!wfrEd38VeQ`c|&H9g83oDYIbm^k_n-Iy1s1rjx1%s(7o(-7# zc)&;x_^dN1RINmJZvxq(IqBHCl)3V;d*k+a&p(Ym)cXlv2_72){0syMSP;NvYKEPCk^D6S%b>lWdp&D=R{;Hgzqc2+Ck z2~gknhhFWIBM(UCC|jeci});pO9mclF8f?iIU(jPOiEBzLB%OXoB@gARvqc;LA`

q7#*Z}u4rEflcZtMj?gKV4~!5(@zkK4y!ZEA|5Xr}Nou0#`Cc#}98jL(RSt*ysORwj zGV{NtuUT^0sQ%}YTi-(8r~aFX)?1ah;s0altmC5Gy1z{$QX<_T2nf<8F{G5Vbc-O} zIh3>@Af3{Uq$17G($d}CF_a9=yU+7`|39AtGWYCz?QdM`!5eGm{PFa2BlYA9-+TW` zh1)iNFW0@7d*ZWBH8JqLai;y1u8-}H;BB;e8?`w7cyq-5F$eql!P0%+|Neml3+dpE zcnJ7cO+U@>Hk2HhQJCT53`gH06bT?5SLEVWd*%Uzvg!w4pu38P=jBlU>#{W>WC;Z$ zh%nl$Ssfgv9mQt1K1GI-H3ufqgzmBFPhTNvnBos0C)$Pgrq_MD*!nvG#uTwHt~IfqprxjM)2^E3c^QRgj*Bc`h$XHmwj26SRth{{mD9 z9}u*TkJpwIN+Ij4s4v_ucP6@hxKLt|zSn`762uIDPX&^-|2KJuU*Dpk9|j1iKd)o7 z!wD3KOm4pQ<~Ay#A8-I#W*4zB7bo)G!BfKimF!oCTmOAjz_ky`+tecEL>3i*UXm|b zQ!OzW3=~RbBdzzJg2#=ieFEeSFBe$?uRnQS1et6#)vep04zLuLpQqTTxus^@AV|{l z3%fr45Y{;$@^g`SlD7{{j5}Ub%bA2$W1Gm>`3@`#iH zS>1?F?y@qHl&sGW2q_HOpI%@Q9X322U@qf&s~>&VQoA!QsGI8h1L+!Ey&)kb;Qug@ z2W=#6`pw&TIlA&2bI!HdgDVMg8PL!FQj-X{KOy@1wrIKAT5iW}TEd+A`)F9EY|{P}Rvn5Ga5aXaw}=__eY#CJstS;5p*JgFls~ z=dF6u+9EFm*7bM&veu_h$w#>QnZG_JZ(jNImD2K0Cx$s2iu(VWRSYHF2Pf~1WM(RA zC=4Z`P5t;?WGMWY#AdyN}#uo=9)Y5%_VRK9fn378exVwV7#MBqDIrbL=r#dKsOr0WE-99ke(PtycT>JYk24r5%TA8@%P~>2`Ng% z2xg*xZMZ`_^K@OnrJ6460}Z~Wj^;37OrIth=ZbC2DI~6v=D*3S#VH&+8;3adbosYx ztL78*j=p7dVu|O-hxVY-kjVpi@mGkcoe4Gsp7I{x&?$A<}8*^4gH1^B) z-L-Ma?uX)sj8cbVMrr+JrR(KkM9rZI3*}nMn-+3TWUAK2v3S8W^Q5{l^Mmulxzv{C z4iFySdp)O$$ZANwQ1^@2BZrY#jakhsR9$#ocOGsxj=i5GH0B!ViE^qwJ<%Z7v-o?p zyzp}C{TkFCJ}(*_{UDY&xpodF=gGlP^8>!^xn_ExIf8K@eweg;uF!OwqN{fm=8Mdd zt+L|tx+0rgvgaeTLzI#b72Sa2Vrc$ce*j_AT3l$nU}xN<$32y9^Qh_Y^>Rwke1s${ zA2GVb14S}!em1s*yz~tvv}501g|e$%a@rmP3xDaAjE`JdTbed1?^sz8^M)B|@8Is3 zNff+AC##>53EgK*2~u;{pPM%k(|<_Z2j;R>EZNKdN+vbVEKM44%7;DXq=bh2Sg#II zV%|=L;%!3fmCs$vAeXk%ojvUpW5x%`P%@hHFB|#W_E1L=-Kvvzje}#1J^#xy^I#TC z9r$3bMPG%aGjz0m6_T{5^R9q$u1s)b_IMls;s7W4!1rJDUCe5!ZmsQqGrbX@79443 zOB566nss;a&pg`~X?daMXI1ZQFS2C@%#*v}mBcm6N*KBMdUW^xtV=GEa3E=q2KURi zHGGn}j)x+%{n*_L_qQUQ`Ydla(~1SS<)1ZhHWy9=;gebjj>N>Nn3feTJs#rRfvRX}S@|2`!JUWKTRQuOuT7&$e_qyE0R_ z2T4iB`LHc834;sjnvpHSe60m4@*1_k93~#0sDg_($>Q|YgiLQf;$i~dH1f>o*(iph zz@Yl#C`R|x7jT;_F@tf@U};WX@d_WmrgtQ&x`dadzaC70t=IVYZXB|_TB2$DH3akU zB&p%$#OX>!ih6T|T9xp)7xnamcEM&bJL`$x%8(|>XfgEq34#?zue|Rt|uQ=wsURnV++0$)2C6$wgw@LuHO4{ za$=J8fF?|ct%uFNfijDRv&vuwOFt1O+59;+A!kI24!@UmN~_K}ykvejUz+Zm{!r;O28g}3}lxmB~_$Yrb@d4Acy42?*| z49aBN*Y}c};h|cXVHer)E&IM=hY5N=-{owqMFG{Gf0=dDWf6t*dNc6W{s@9tYBO^5 zxoWRY7Yg0Qqxu6^6ooGeIydv#u9)aghT=Q-Y>ODQ{dC7zE+gq49+(;|4xY&%*h`z} z<7@fg<^Z?a^^>A#X#r0|9C@SNta}YtW`?ueq9KdMJUf1AIwkwPSuxWY^!S*v87Q4Sw|1y4Mf&yuHfD4NOe)%VL7jxDF+l zCeqxlkhKkxOF%>k;#5rZQ2D>)?bP(AtzUUV%M0VyW6ACyH6U{O^W#L?UCD;mhw1<@mWeqp0Qd?SMi83z5}VV9%R=KJA2(<(%ulCuik+sQ$kE<8yod?^}`3 z*mF%!WBU_E2~Pj)9F{Wvbsw$JqjR&q);VJ+-L`zN3*+uH71lmSP-B)XKa9yt1KnPZ zmdP^g1(7HL;}qZee&Y$d0oG&a4?EHO0-jUDj_;WiYD^jKZ$m$#)H1LRBVHz~<|G=` zRj!}EvZu=|zzz zuV=#?0{R4guGgc43KadjDbz>42=h4LJ6K_ZHE{6 zDkxGU#QevqN@0GrwkMSkZIFVuLe1U&RzmaM?D9DsVf*6hgY$#=Ya|_T|Gux$s$H`> zzP9xKBx&GR)<5moPxP93^N3fk3$$2(#NwBolS(d0qU{_!6m=DbsYaSUvc<4KkLi#Q z=!>sSS|U39+ZFZ>RwLfFpo9-Y%*L^ak+>Zh>@ zC3%7q{Ssn0<=~|0(={fGK`tlfGtHkn=s9VLhVPj}+|_sPbbl0I>M3Ipb1t$>B*zc& zov{jc2&;v|xNuO>$oj&}5*yXyr$qR{Xj=MoVIKESY~IJ}HxZ?{h;H|VDkAj5A^j%3 zHOkkUqR=tE=nyh|Tq?fiQ7%(@di-K1LNye`C&xDZ3kgG=_hvcFP4D;i>wsC2?e)IV z!*e==#Ualm2kFtrrg%v{So6&4M^OW+SGvY>Ba2G(-A?E!PLAntL}E!qUy64U^wr9W zQdwaBc3cG6^7GW~8-wb3ng_pjvAWt}9aLge3S@qBsesjHsMoCN(H=ALHL+1LLgO!0 zOG~JCm$dUz-C!u_){I2bCmgQwtrBz!My-ZnO*G>AsRvpkcxJ6WRSSdQ9>mnXwRLb0 zk#Bg$);tU;!x6~<<|EZ5c_(j-|1$}6<9g;uheki(QN*lh_!RV9V>@8WTYk~`nsT`V zZ`R^*FcPl9fMVoOe*ZnY+>cV|s~*cmjyp>Iit zCs$Qhg9@t#k07wzt0@AlEqNwi4DNtn7l}}m?-!v^Q3TdA0O|Qc+aKx*9KXCVT_l-zvc&89UjDNj_T#sOw3UJX}-!zwgm`Dnd*Ua)>9k@ zm4_r9tt(lz$?rybSvKkTq!LI!V`CLpZvp882$GV|4VCG~7frnq=G;zH_Q16y7p;SQ zl;CrD%4||VwZvC7W*U-qa2nm$E1Hz0Q_PFm#V(K9v?dw<27g+d$~KCZ!;AMLsO;-8 z)M=yieURM*g$|mAy=9Q(k5`VEu2i+N+3Q&U_Rvz9XG<{`6J>(BNPXfCPLVx_SrFQe z%ku3}@<%-p{5O{3pnce?UjEw3l|~fxyZ`Ho74O{D9eW!zy5Bu-zI;gA8<5z`iE7_s z;k;|(k*VF1>Hy3qKU>;UgQMv3^~;v}cibeHJ3)g4Sbk4TA_&+I8{={HJKYx1)r0-wn`oBP6ROnY*;e<=N zD`H1hkqOP|{5tI=f*=QCA!`nhK5=G^TbbA&KhYGaswtev#1xo|@W2TiH*Yua2bp~q zg%iF822I4Uowyr8>H_@qXkfMNtL^`8;y<|qs|RFDKami~$QIUhyWQKngZd=-;%k}^ zb3Qn^gpgFRDh{IoQwY_hv6t4AKMcd-6g*x)1=y|gqx-zPVT`vzm;1Qps}(m z_BsH(MRHy+VZ^b=df|K1f4H}6HVn!5HBZ%nS!=})LpqLpm1~aZiTHxAC?skOi-x-n z;9`qfF&oXJE0Yd_$$hiNh4VP^iz)``A7-@x3*S{0>r)?iMPrwXs$so{D#;n92U3RU zb_+LB304Vy2@Z%$!q`jfH)a3O0V2zX`z?j10=f95E*=GM^+vzg#ckJ0twE!{NcM9q zvP>oV?rxkyPla1aE$Z`by#LCx-%So#p0CZh4qCY6z@W%5w9&qko>fp*Rrm}@D6c#> z#X&*^ltOOmsnah0>Io3UteNF#tF1rs^Pi6^`kmjtq)hs^1OikX%4(}5tT8jy4}a)P zL8i!xtl`RlgXqdhj=~#>1skSKXxXn=w+MbVxLrw~U*fcgztn`$X_uDK-A|2}<8tXh zdZMpc1Gbqlp87B5fswHKi%1vc`xTp}E2+mp0sg%Od4+L$lo0H1?BJSj;tA^Kopua?fI%Eh$*+C8uU@o>l6 z;yPPf)VQ;Ie+I6#VvAUH0FX+Cfj3E;jYPly+$OO#H|8JZ{F4LDwdmFJ(pJ8vnzh!{ zhEDK?UbMm|e~wOixNXS9Nl>+M3+iTAG~5qpgd(TD$gL%13pci`d$rr>Cz|c$9rYWJ zpc?8{_zX=v8p2}Iq$gSb9>F>hW*UOTOyiElZ=(*o>uaeV|K18RS^PbdgEBc1`uJX| zUaTj-Y(1=_G9ueHY{o*6RDs2ef({5f6CeL!oN}~!!hA?w)I`SaMe;uw0@zj`D^v5% zGSooYy8>cmbZ8mCi4KOW$cC3#u|*!(qCaI$d7x$m`AOW6uAeCUHmvn459`Vy|1z0R zb1*PK%ZGw)5F+M1a4vCq{e)nNINnd}Y(Rt*`bUfw__82VW3Vztp2fM`ji6qFgGB#V zrU5qhdejE?Q&Db3T!=tyHl{9@37S#{7IF}v@0K~1ep|G$j+}BfF|22mfpEvZ{MJvRN$B?K zy{XTyaXcVzqjJ{jLQn!^^ebW$XvF^^UEmHE6-F5h3n zg_tf>%L4E;16*_NEWy|P=Nzq7w!f>CJZ^{F#y0Z+x3YmBLF3Pdcf^ScDM>o$i>8g; zXPS6eCh{s1Va zOI)rws`?3AfU3@2_O>Z|n|XmvEFL$#;WNQMbiCXwz^`<7Zz1E(J7@a!8j;0-he;n5 zuRr0LzUcrNLc`bt$y91to)8k(7b6;S$IM}||5U&*ttI%6Jv4r^u5&Q#JcQ~berg05 ztWGa1WlySN*e&GVAuY?m(e~Gf98mmEkSpF4CuwU=&VnyONlQr?jh;F)+EV~noTF|z zIRidhgS$V*)k8D1u{G{*hq*6YNNSL$c=3&RPmACPm?$%RWCg-UwLI9PlA7F2x|xxC zt)v2wRPJ28P<7nktdvclYWtm7QdoUyCM~t!Z@$4j2zl5ghysF8GFh>S7S2*E=EQmS z6Ca4GfM@n_+N80$4E0CmYOs6TrANk=a4=u3D6%7?n3kf-9V}u;+M~Chly}zDdi@fh z`^4?l^U5J3V{-ffBSUhC`zMDi3Iz4z@uw}t3La_5-UEKuG>5G$ zm2l_)xYdc8F$6w<-eIR8Qzj=%6$AUI1H6TyM6XE?uhZ3*4L867ygWazn+n;Hj}+UhZ6(TGZ81n=Q4COnh#xwfy)(+?ik6FXA!I5 z{^jSVs?m&2;ZNrqGky{OEhbjzBB#h_T_3ZTO6wbFL^@H|ekYw>LLPEmR~KsimDlQH z9n|S(`8F4?OO0*QgWb#*ZvA4=F`I_NV+B{+4pLvDz#VfV;S(aONR z(l=3EZtBw~Y5Wog9zl~B(phTmS8r>)Q+ke_KMb~A`@Sk$x|wt%o=|zS zV3O-<+P7z`7-OFL)+;QV)(F(3pPD_pB;30F4_^1%n$B08_l22W-g+2gVHvJM6qTAz z$FXzq`QUQ)EVzgPPTt2n%cH-jyvKlpB!EhOx$OPx!~37jc)xPh)Xe7!Gp|5hC5xfv zb+=H3M(3itw0oX$7w>Wj0`~$Hr?#|s*@|4nr{ZM=W^Rfut+G^ZossiyH&)(sil9b2^D7*pgjEG zU&q|?dCpFX#3^%!M*HcF0x`nFx3e?mYS}AAEK+<=10a$`=&SO|N`F{7BogV@`o~B; z7T=g4kXD=398>I)R|qC&sox$E=}-z#4gD)%hpL-{%0=&DImGMpf!m}d;*M`pny>Qj zi)!aI!En!0KfqwfUO2l?RIApk=~c2ok)s~`mzv+y{$e!?MEFIT`?WK_*>7(~qF?Fa zAE4i-!YyUwLC^4Z#4nik5H_9-_d^Xm|5(tlWv+qLW-0Toy*a$si{Og2HJebT2<=5Z z0nRC^JZeK)s}&Q1D5J4ao$*IQcn$F$F8ISdIbPQ@e0zrUHncr)>O-h6P@gLJ1w2#N zR@bK&t>RTEn2otbB79i&BOOEIvlW3K-cc1F7RzT)uhoJM|Gxl zs90Di){PUVQ`9o`(W`L&R9z|_i4zM~_b>Vq0ot*JUKO?;w#KZK6#`-XAA!XeM%$m8 z7$XN@fGUtmiE7})L^K_@2r8b48+x2TI(?hfJ+>8Oj3R$5*oD2+U$GH}786;YL!=-kb}3G7?*W&KEk%-CgP{*vc2Myqt=?TU8`&aPxckh)My<*sowe9 zXz9J{HmPY$hCq3T9Ki`n8IU$w7q%9RYub7=yS8Q!J^A; zyR+q|K%=rvFa5#);qK<~zAG}j{>SQ;;<^3_ho-tNebYeYd@@a&+9{wm2T$PdWYNfZ z>}gFsmVdtWFZaEFygvN|QpbjkgMR$VrD4d#lt+T6zLI`yb5ZyhqnB(lEDq+_<+R2h z1W^XqHgiZ`f`_b6$lQdtY*Ge^vRg`9Zk^p%wcBrIL-INcsvD>pfRY)h>SVct z=ljKX%LC zu(qmB@JXB8!iOm8IjBufl1HWWonU-b#GH`(5U3*n80X!ramZs=+E^>E__lyN58n-- zMSYfkAJk1ayhRH$dYZsj3^UUX3Awx^)h3s40e5y5Ltln*i8d6PM_?`hLh0#hph2NU zB(+%bt;+4qixVTRfX^#gKej!VJ`;lt4XsFo24&H0um zwMhJ(#12PPj4Q!pPBRtgIh;#RKqv%~F8^`3Zg20D`E`d^7#`S(~Q7XHw3v!a?k94!V3| za~+nCM4g8DMq)574m?fk8gxIx1(T8AA<3WgG7XNi#b4<*cz7mv?*~NSh~I#tgC21)skN&T;LXaH;-1zl z`5TYoo|gY~59bQ0OWapo3M_YOKMI>m91gQ6ECaR zX?*FLe=SA5z1+D4&`wc@Q<^Ow;hYSiT;KbzvT&H|bzd&pdcE&r@3C`snNU48A|&Ie6~UKuwRgNIy{vgx+Ie zPNoby60}Y>KruuOa`!Oe#K?a$*B2b<7?%79I!MU3wIFT>T1yD5MfpoGK$cLWJ%Rww ze+k2_I^ILYOo0=l&; zB;*Pi#M|1R?4V))Y8ns|Mkhg?iUIPor>BaLYLy9N`CS$Hj%v}y8iJYwB9B^GzN`=} z&YX-^-&$GFGizGY>3!9^U-Nk1Yv6!Sa)8+ylR&Hmc6PAmc>IBrz9WHCH_Ah*qOf@1{oaakI;1 zlFb;26w`)UG`0tCgtoDG-N@Hu#zJndDTP2d^DsP~zRyAS#<6HdY3q*Bn2Z#Y-luvm zourbcHLtFl$X#@Vp`PTC?4%SF=EVC-ZrS<48vr8qn3jjEk3pr>jOZA6l@h6Kr)A`; zj(&W2bkq`eiPb8n2}KKeS|q5~M}tFWjdt+J!R!Rt^9@`Yv#opcL8l`ObPa{C!~Z^7 z+3{8>sVigA=kKlhKo_9s&z<)^5x-dRXe{YH{5emJeEVBnVlaV-e~1ZW7{DtPPDu1a zCxT+(i45@!+4ft4W{uRPAaPGaHjMnL=f>~s1DEKW9!$%{ja zhO;SUi2MRLJHyXGFLr)OuVi*r9G>et>6_@-C&|9#*!H7~$}gk5$*q|L*(fBa_2&Bp zDoCZ}=&M&jO%2IQTn_JiVv0fIllfx`1?{ThV@9buzB`egJBykjTR zUzHtw`5ab#yN+>|g$%6$_dA)zILz2}n=bGz1bS52pZ*S~v!{FNVX@mDgWaUwWkUdT zj{oQ=6>y@CLB6XjoDJ_{cVN0-GhJ_%;#sL^9lCIhcuFGi=qVHk0|k>pL)P;0$HBLZ zGM^1bKeOj*RR@Z%-GYR_Yy$P8NCL=wEqS$&)we^eUj1TruZ71z>*u{`!w+2EiKL6L zgGy=5d3M(Jhu?^G2V*Zw;0)@Up{;aLq*A?}cVlW>8YMmVQ>V5;5o14eQlY7TLilvr zg29F)?oZahIZZ2O>|Hi4>roCJ0H;`of7hLPsFiv378Dep^< zCuhQ^@BoZQ>oT6}_w+=2xb%rbf(n={a zBa5-z4w-aoRAUt%tkABM@VTN;H_y-B%B(k{yv2J?VAnJRy%;Pcl;?7pENeGcgKjISiOme)iy1wMw6qm4GcCHY zSF4dMm7YG2=lEFps8?irFQ&d`d^zBRZ2SN{rqjP$U6T4TYA~9hh!3zE}0C_ z$i0psjF*z(;gvBlkTitnu%G{%73`}!_ZU*<6-4S0R}d(keZvUGR{1fH1xs8GVl8gr zmuEC03UGVz+89E;jd+?kK16SKo{1 z6;pu>afOC=ws|&&S%XA$5Bx1B+Bhi4Y6R)-Nw7q$!MTJ|-5x#C5BY~6u3^4+qFX-B zDrNcgf|~*9?%rNxqa0x3+f~=KV9WJ2bY>U`Q+1J(*S3L8@kxGa)EKx&Z+47T_+k8F zc@vPF{qIaeDJwpwJ%6E}RZwn4m;dvJ&eO39F@7a9ej|Oei@u|Sr6;@!%unY$5d8JozowRbRy}@D zs*Ca2fN)~T%=e-!+WL}3E357F+Pz|$1g~=A7sfj)D?3N2z>42I2{*XwHhlZ*n9t@t~ySJ!m-!YGRPi zb}8XY$?IcovlULw8Xmn*tI=`*igLsueZ}P!x8sIVo)SLuZKc>+KZkFr+X;j@XF;^F zpQDUliodxvEr@B8kVWZDifX@cfqfb+YPIFkRTru`XX)`X$nAr~He?@_2j%^e%nBm}1KS)#B}`m>1X6-HjzzH2e%rulPlWo%%f z`)q^8U^hQg6^nT6h*f6p_*dN&GsvmRFZ8f?yf6p7K!XcU*^iNkPI&>o|kLz_^ z<7j^4_dJ1HH265t_gZUe6f<2GQ+}tO^3z+87ERBpHhh{lmOvH204Lv}{%u8m>Rj+dMfO0paE$0Xqxf-hci};+o ze*KH*M&6()!Nwbs-hLx5E4z=eCnHM~WkaTXbN;mVu;{VK}XP}f~!{`+pDLf;S#tPrtq zLi{mD=FqSnUH- zSLw+~a?2?>nJkf&A;_PD@xac5$LDVM-X%rLa8w0|q~oIFU7lCQX|4+vDd^SC`l(l6 z%aO4zX-;KZXS66*7n`r<1qz%1C1hREC2yY48bUV7ud^;iD?>HN@3OD~T=lfG&j;=p zpuJ^A;dwY(n6in~M3VryWE9ekC+#6dx(V?=lb4#VUXd?LTRjsA9^*$}MPZ!v`Om}U zsJ7dyu6n25Xoq-%zW?ItAuc2%)&txU*3@Ts)tJz+K?8-g@#vAUvBLGmOOC8E92^JC zHnp+8;W$klpWQV^I2R^Q&b&+wkpY{q?JDSs85CnH+bpjqxlRG?c$#Cq1R4X)_lH9f z95>L)NW_~!I3Q5EPz$MnV|)CxQt-tw>APg?aUpLY&Cz{kOeOsi7-+g1u-EolU44Lk zDsHD92-`QIjZ|AP2F!1KW1__0o#_`h+*!~A-V0#C&-Z^`F=hlNc`UGw)kM7b+Y7le z?QYT~Q|bXml&YR1lk|g~WHYUbi-D?V`Vpx8HCPBTpaSOJLO*Nq!rQtE*oh(j!u-?| zcc}obEuJ|XzIvGJ=cq)Q^~35Du)qU7R=?^wurykYE+%Z(R+`U(E9ldAdy3?Mi8tmN)eeDQS=xuTrYfRsVhGK8Ybx>p({WS?A9OcPpe?Vc7WB$ zQR|7Te-@;xr=rK~!t=YtPo*XicY&7+@QhHwf{FBInvfjwltca8|2qOUKu$@C}%>RrT)?}3S(A2z`an6bR`Lj#^caoBuknapG z$vh7i6bCfvT5d!tiNOl2T&i`|o#x>I!IOKi84Tj-`vn_M@B(wZ?&xWn&8q!+i|?c6 zG?#q~8;482L|L?m%w>M1-L52?3qfm`IJXE7!|w)EEDe&Hp|6Qoja>@CI5;$@HIi*y z1P}?%DwwNj`Cl0iOw1KdMYU;u!d7ODXu~ADiHr2l>5)OB9zb2z+n{F$0H$_ z^DPA=7tx!ZEU6ay-z5#-pPAo*)CR4I1XC~^Swme5~3SL^;^ z0RNa>#{#r@7qMFJ6sE&il3(`C?;GIS{nwT^K6%0g@AO8E4eiVAx%KR_>oE59mF0!r zyDO^soZ#)@1OPZ~Itf!x%DRspX1f!zJ>fI+xcu`E?gU-VheV+V=aARKuX10^4jDrJ z$)0*Vw$^pS%oEsDAi>n%2acY^>5PHux$qZ=yV_{_$g{{zE=MH%+QVDU5UHAiL?MSX@{>%`#I98 zC>*w04GIChl*h$ja6jtXkwyA9#~iRf>#Aud0wa~@KlyJ81n|LVvvG$GWjI9YxexAn z+i(^3H4;B|;)+CZadqAX;1hg=d;wIj& zyc1yF;{-H1kmnC0cL$*&u(Il@cziRD-Z$v(-J81@=o4~8Hb<}fV-(+~_bUYOPRdi` z8yUY>UfBX@xAY2)Yx2k7?zNMpz0Q`1esq=B>gdCXTVat_`ENdbADp7Wcvhg9=qDtC z8b{~Sb8mv4_(Wo7THeKAH|YUc78hC-S=Aft+_;A`_XlS``*!8v&%(XW6Dyq7$TDkk zC+S7&_xy^sQ7heSJ*Ai^$5OMV72W&00tjsV{_YC!W{z|s zjDJulmVT2xme(kDqo`<#P*G!;UGjGnxO)DMun^ypx)B#QG_TlArNbwVE#URk#`u^2 zEiEp^1zgww+8EBKvniS0g(sCi1?pkHC$2~lZ42g{Ke&smzk9B*$Z`yQi*I*8(pvSO zxzi;@a}im$s+_Y4i)?$4$Eyajk{go25lCTbY2Zf?Hw{i*WqE9iCkc*5>}0M_`KlV- zHEHuG`j^?bbW!pHxaY+aINXLvLld{xLMozSuTAo)YPd{0h;5b8@s~H3J`Q4 zwDRMX4V>G56{@S!%`Y2Qw{@|7hg*!J6=fxev(vL9SZ;e& zF~#ov|1C`7fs{4=EG>JSM^5O@0>n{+lIxQ5K53~t_z<=6CXNc7e^J$l8fh&9KCME} z;WO${N#I&2Nk9(#v()B4y` zdKpIJ|HPsc`VmzyBb#78?@W<8S}!|2Dp3KAevmUMH0B68Ffm4?IQW~-C~9qhg9p6S z{%k6)e3u?0{yngyS^8t!9(+Op*6rk$`x6hcb)_B>QGe`S% z9MuSEfPzYK!7mZ;sbKm|1=9n6@m4tBe_o~1Q|H{L5g0i2t*ujb^$3uJCBMHvlu!X| z2;zT#4uqYGqYjhX0#6~xcbbWKg2={K6WUY9=`Z)bZy$foKRY?3HJ=34-ivbq{+(eL z$_bbIaaai%ODr#=V&hym*B9-VW#JQ?rR<}GDEUEDDieH1t;VpAWlw7fu2riOak-pR z2~=JegHC&#I>0jkKqpr&)Kr$@M4=PUnq2_1X1bIpWp;c8Ygg6k3Xj3M!1!QMde#^6 z z2Tc#1(jt9_n&%%qFOsLpz)XMx-ZNtA$WlQI?|QQ4n0QT49rkJ09bWKNJl z+&RhWNuTNW|8{1Q4)lP%W{dQA1#i_jU{KhzK8~7+Iu$k^)`!1jN-5HkqZM|58f8US z>H1z^o-QiJbwpn0<&40(=zxpYa?_r6~%f0}j1gaI!L`AU#>V0(sMA1$Ygraiu zK)nyQ*ClSG@2J(6Io&c9@Q%UC=^gP!g&`IO$6=3Ig+7)h#IU_2ZcQ%>ZM=w>#LpdX ztmQ1dNtHSs7xHh&`A+IErIkLD+x^i0imitY`g|Rqwo{#a0W;r56;g^68CAp)ybf^j zk}=iGuK8%gB%A>$NM3j&NTsd-jWHN1Wo^u+qY(~XJfJ}Hb?3ZIRjoZmii~q7Jr31{ z*ejAsRty-Hj2VOethN#l6G2WFmjh?|8XUyK-{R?T1_o^vJ5rPs*rc*Fr#(3-|0PI1 zv2{n;uou$mdlGliSd zA5?IN{$!5-yKJ>}s0UkEL(+jZd5UC7_vnWb3KF!p4oO7Lyt#BsOd|XJ!?xX^<*tHH z8XO4Ya_xEc^KINt-!%|DKr{zq!n4ifK-bWI*1wEs%Ke4s&nnVtvC{SGw=xE#ze3i* zx4$QzOoNwY9Q&*L;q}n zkY!9rhcPJRk@HKVv7^D87y~0o!v; zv@zUzH&kMn;Zgl53wB~3M4kPmki1dk-Wl8dcOwe@aAPf5uHaE903O8QBmVqRAgfJ| z)b48eej%6TV+=4p;I~>OY`2#+zh3NDU1o@aKfdq`ao3PG`czKwlx^#|9+$r6CtV^z z@ANxq<-ajW#M%Tg9`K6iJQVlpWHD%o42F3>Okb$=nOXZ`*Yjf*6#dv))VK$J@!Bav z0I6^^2e!WX&nSSt1RLmb{o6b_qkhkn_WbM;nrL|GZ~WfeusFvFm~ER9dYR4+iEfjB zsjZ5^&Qg(SLw0W}z0u5640 z2vB$)K`kuWp=@fI(wA;QOVjG7lU77&{z@{LF-H{q_D>_r`5Qr@XdTBMw4X|C3yhB2 zu)n}4$e(rtM4d2rTt4EQt*Ld1>)CZMy#i3(u)`WCSAk3|h=wzxJ(2xw zl4v?AL7rRSixLWm$iR+qD-tf4uxe%~F-pqAU?!M;+?7;C(Ld@(b;7hoXTnJ4f~C*GrF#&q_tlcyc?hTH7wz|Ngg;(J@BHN0!!#7vyO6rK%a> zCrj01dpbK5U*&-Vm9nf<)}dJJbDYf7XUg)H2$9xH{0)w98!X#>Cv3vSCMA`Yg?JKt z5X`2%1~!d37rV_-olDL)z5XxC3l?J0oveNg9Siox9wg3wJ#5{P5-n9sWc*axW<$C`uf8GeOz#jq!1pulESby9s8A@OX%K8?5Mu;}4nK zWhB`@6$)8z1kv4Z!P*+|3Lc}G=dp?*{VPo2K*{$akbLrrkN7wA+lZ+oS5@^sSs^Dd! zDc9@@99Y2lPMFYXeCYu@0fLY)xhn{%fi295Z>-ng%aG*h$Dg5Ya39^5VU7@2X^bUq zkkju}C+iH`s&UFM{}CK(3%ZTm*^g)~kXO3UZ7j;h9dL%JDjG$4S+CF1M&PskL;RdG{@DC_zKWeLp)8}8ozVi(P>~OQa&*ONZaXBnnNhR2s zzXx49Wcezu$aIhiKw;Y+H%`ba=$w|Hs`nf70*A*+tObAx1}fgKWj`pvArgA|+QE-? zChVow$Go@8<^uOkM&Bsb$)m-7*-5=+rirg;`cGTUm-Q{vlam(w~1*FE&Tf35F5nvwR9OU4M{w>MZ%FCUqdGr9;-}T*d zlx7CC9kT}Kc92Ez+$8EC(EJEud%BF{@l!GXar>VTMO7ewbCl~Bs3F{0PLFB5F95$) zMutxjg8E>nF*cxrw2#BbstK$rcz;Pjuk@7UzFK+7zFN;ddZpen`r4`ISzypP7Ngu` zvGq;zM;-ouj9|%A^9H$1rYQ@OV(u5_3^tak1B0BnxP=?n2=9+M3!c{!igz$&uu282 z`KD_l$V?6DJAGR7+Wf;nVdt+UAzJjX_2!eHD0!Z1-T!btfmy9#aZiIv(<}m_x4Uo4O z6^w(=i9ONyE!c!Si}PAV&fcUsZ%-#>drXd1G@&4D&?V zX*ZLk&=;QT12i*0G(-1Qef0>4pPY&1!8=;z>ZqBv`Rojo8nphpVtKrSqxv6J;~m-o z*%oH?(TAyVo(fWx!#9f2yc}<^dP?>qxYnQUJQ=E!`K#vZ)2Lj%d2OHX^pfPLTx7MlH$8UGwFi39Uz``?81E5({{Z3W` zuYg2Z$g&>4cL@5*RI%`K@xW>Xf260uP<6$Lm;5j4s}o-~Hcud@r{#Q9Ni~KR3?Xlz z&!Rhy-I$~kd;k=Ro$KLu!r+BRd=1=BN+hkHy)C3by78XaArN%GM|%|yVO##53e>0z z@mhvj-BLuoDp6t}2Ygk#uUfCAt)pzP;YAaK!);E*e9|E?wZwSKx_VO^aBgf2i?1#tAyt0W|4pC12M&o2K2l8wC08>bFSee zzk;4uyk_xxQv-g?qT(Tt|4MP<5CTCnA+>j4yuicmKjqYYwv(NR{&%%BLptIFyU4yO z&MN9*vwE4EeE+Pde58e76T3S5aRN~214ks}glWrwocGbO@%Cnp77NW+O%t1aK^ux1$U)Isg!tu0gV~{7s;<;U?O>Y>>@AG$OQ09 z>7A`(7Gn2w2*^spwBG9xwYozdvq*LDK=xN7`3Z>mq++ZKRKmDZi^}Yn%{Et~&>@LIA%J@7@bviy zncqNF>#I5z=FS8XNaK+cb{k|aXDjTTXak`4u&2xNbiA8u;5GO=dOdASM4OAxxKM~? zns~R9`=~$1H{y=S;=kPDQb;iT^UV-cmsfFTo^`y>+6{M?;n1MPLP(lew)0yBSV&^x>*A0}&BDV_j03Bt-sVQ1! zA@dO${Kefv(T!ZiwgnUIG?*}Ze4*$=Z5KWvL;*(GFt5krB;i;F3! zg4msf!*<$8la=fras}C#4vMshsFiJ0#AvLLCJ>|$)zuZtpUrch*kx=C9ufHE<7AfP zXj27{52m*l>R%Hk7)Y)Qq2?NDPQBIGV45WzrSLUVBLn*2|l ztA8ek5$Fe%a>?U%Zhe4XReI-rc#N!znvU4&lG0J|~2<>CKc|_35u`R*cY> zbA%ij|EjWjFd1zF;F%pq+{z8e{CbAPUB0?@5!VefaflXh*(&*A?D4R_zWmZ5R9im- z!&JB36Y&H6SuocXEUNa#KGGV3T&2zrMvAJD=gs+GKkkv_?f^>z0#gX);#&Mb=zZqO zhShM=3At&UEko{`)1}|HWZ8Wni^9_mA$Vbb-mQ7)h@1bDgL|$@z($v|8EP86ymV!- zRKdx*A6XsK8vZO*s5@MJ@6b&IBJTo5L@eoohUuZquE&vm+{zmj5#E#d~}h7V2iR0FRUYaObs7|)2;Ya z!b~rwGL8gKRhui)-c*?PerL3vo}_0khHr?CNm^rk1!>d)_$P?jNXMVoyoms_03G;7 z87gRVe6G+JJZ(7V=mGMTY2in%MA|z9&|8Iz8I)xxlgcELs$6M(FJ9N~`ZMoXZ_#x9 z5{RPPt_CYGFmLiAY+M(8GXX{3bZ67iJB4b)FJMOJ%*uKhu9VBVVbig)YVCeWn>`VJ zGK$Ko358oZUs|J0YQa*b8fI($0N{u#JQ2>A;};LtV{&2zMdZ2q<~Bnf-Q%=o?Eg|N zOgGvdfi%~5IREQZq0a{FamX@^?_7}fLRHhPLpsPq`_RfbX$TNyz29iVkY1Y%(|W$) zF}>BBS|{W;8?<9*y&U8`PW6-*2a`#Kfnz8SvaTC|!;{reDEhQ#c2`Am$Ht}3NhhDK z^9}>8E!lv>5f72gGWIXBT>=Fj^NmPiH~3g@U?=vI`BK^U&{v?tqW1K0U&iGzHr<*I zOv)H{5U5GW`RfBA-KL;JtBdv~3Dx8;I{3(nHd1p@bbjf;_TkDFTE{7|@+2Lf4{hc^HZzZ^<@HH?;VPX`)SVwK zj|lx`E`b?(`rWhcpW+0zxgroOn#+9;myl(xBBG)&M-Dk!XeEc0gMo;QQJ7n<;{R4O zTyy6fP=;Dz=MWbc3M_J}h_$V|X9r^u@X-Rv4IW&H|Hr@JX&4JUZmHDz0IQGx@yI@_ zHfhYN{@j=FPwL*8{%h3>>6>nxd(}sL;fCxCR1!aJ&&r1EGf3YA=7Z&h5s_|gO1@dX zUw%qy9wKHx^i^F=Yd~IRb5VoEa2XpGlsRd==bmBx zc?ls|Umnb!&Wq1rbn{Rw;4>ZSVs*GhKnBD5*7tudzk{KUOf-fFvNrK34xUQ{<+=9p zy}Hxcf}v4<9J@gmJE``2dKe?NyTkp%S4Vv%fz4B;r?b07)3LeM0)teY0G^=J?|2h zHS4wB1`9}y2h0#l7YXSYYomhDu$8FSwk+>$svB zn~E@kY?@nmeCLz#k2wKTsTCr@)~hb9?J0_=g6E*J&n(5632aG>Wf*X1^HGhUKUBsT z!)Vbqvhk%w2%CT%cL1*ajP^OZ6Zn-)C4&H!UJw6nKD!eUSCxlD*&1} zPO6KIPc5^}Q`0J|cg}i+fzhnJ$#lhfscM#I@qV2-C`if zph`7Pqh?UiRtj@-0po*ziabf@E@i6fpptC7A-zD)$lIr2Nhqa-2_ZLTkNWq=hq?)I zHDrKY@+(pffAIi{yN}R%8+M68my^ooNJ_{A82g~O zH9i2`@qFF|Wv~9pT@cAq+ngr^9K&dKv=l63Rj}7104*9sQ zCG^_&9-%KCj4e+;0kP-fXMa4i0E*e(uqZ;58tZvj$0JsRYonwRWi<-b%dkkLU+U)S*#b#cQXmUDXs!d#RScf9~?Bu5iuBg!!J+*k70 z`K6$8YEqGA3Q&Pf`pZ&cmDq1rdsDHL!PQ_519E^dI4^(>%Yv7nY->*as>;Sxz#(8A z_-powhi5r~ssKGSFYg`9^(R+1UF_e@=E=9tlF`p;dS!-qbcufx6y<5DUxO4vi9S9c zJ1?YOVLK*#n@&hQ{`Y!886W57&?8~vW<#|{2ia|#MY)d&kP;P#Pn ztT(o+LnWOV>^k+FtggbbE4l9$_?9T`o+A7sI-1V)l$}3nHjiW~l7NRpoN9uO)aHK} z$Tw=CT!fk&+&6*QeZ*-|nc#-dcox`Yf<1wymMaw>`3LJi*H66HxtZGA#0U~8Roh}M zAlWoxC$A9Wi^;DTnEcjYa42m3)>>0nqVcvn?FG5Xw8~mj1NPq&nW`ig2{`jrta-aa zpt`A%7o>0MOR?WT^cqQU4sq!PyKFnxY-?o5Mng3>LLmlNHL(fGw!NnR0ugtIQKfo+ zAmwA2`KfP(qpn-d-vXb}mMfTs?(3)JK6bbNq!X>$vQjx|bq7JFpevuG^@Ns2a+$^z zYVn>)^LZUi7|@L$AP--AxMn>gX30T)>)s9l#XWc*a<4VHu0Y0bRGs-@AKvlU!#*v$ zE-N4e<+_gqIlfq1nJI+BpLIC|3PYx{eO?n^?NleFzIiA80c0hX3Jw)#bY!bL8hj&{ zzBG(s`CX6UHE{=`A3+E)`f_P%i1S@X0hc94nADIM*ye-x7ch{|N$+&TsiQ58|KR0g zYozBuAJVlwZIvTC!p|WJalm4N9k1|39ZqOJg5Eu>PqW$A@4ZI#^CTNGPSWO5%uu7e zcR1A?ua?HZ&Im(sIPQ(#1|;8Ry3#<^M301pe2Q7l3Tr0W zGo;YH1shH2oO2Z`*5}h}z%hQdA9U60zJjk-eRMM*=LNk)gOkA_NI0BY&>GQ)Qm`#FFcWoa^%rs20;48gZi2eC2~LT z002MM?*Y>&_`q8fEn_0VbrnFbe5zA(m;Z%Y<9f*LbSmY>9e?u&D$z9UrAMepJeM9bd z0X{$L>D!{LTv2_DW3;uam(gGq@D@>wduE7p1&!bGy1LE}&ulN4^h_0+N9P2nyr#~g zr7@CDavWM=BuHbC*VeET$kLCrB0YRMfxoZoVBJ`~FaBA^<+9S(yytx)jfNC)}>>v1X73eL2k9ZB2_B{g&*!Dk-|TCT)l z3s8Ho;nq#?sZh(_8GQw@Od|+2L|Q=Y-fYY|dNF{A)L=j%a0Oh;V5=rkdjW&Sl3N5& zYTHTiG@(F-+5Dg=0JqPxlZxHh}=E=8V zhXH9aG`egCJC#Y_Rjbe;2A6Pt5HCDDA0#)j<_|c&Gy?{R#g? zl1=(lju`^X?zZRDwD`~c&dVAUI4JmWRF0_BG20A)P^ek(22}2-8VSL}^)n$9FU>+z z(2)YM#2&Ns(3lQ3BzF}oT7Ys$tQ}Nr4(Jj!4f!YVf)7v)+k#yBEk4y= z_%6s;T-P}Y)!uxl>P-9%&*7EhLuIDE+G*|;>r3@4J;%u1?V)!$od0lgK>I%j${&de>N9j}7Vu|7&sdnpxkx5&h58nG0433B}shY>SZ2EeBJXj@mMq|K;ACnHNo^_>{yI zI=6dxc?^_azCtX@jc1jJEpJLcd<$Cuw+0{MNmYKb-*A5iG`)4d;;S^eXd7`x(Tf3orTrd4{80E>1LhUn{e+3r zzs>HKY&Yl`ER6`l^+?e@FsIEYpbP`BUDa`Evk52*9PR2!4-f3r?D(f$un(*L3h>mQ zK7Yaf&&7WgrJc!s7acKc#|Dgs*X# zHHt)glTp-S-@uF(C^C|&{vUezZ{GIcj(rX{?O6orzF;^H7qP|vq9n|mv(D1Bb?au~4+th2CYV1E3!x#QMmxNy zMl%pnKkBTX_Kqy;u*OvGj$|AtNq;6}jKkpR3qUJ2O$gLx_ltxZXF$ZtHP{U#xyoYH z@#-HGj5YowC%zX;jmiUcpNZpQ^SAne_232EW*x;g1P&L`U_{cPu!|7FZ=bm1A#H{n zLx?mO_6dpw-c)7bHQ626|DBgsQ{A_1ft)r8gqBgft|L=t_d!tu}$UpO)J=c3# zoarc|Q~5m=d+^}~YU(okeqwKezU!li0HTi%(QCcJ0p^`&g^H;wJ)xWsUYx~o9ZIBk zbT?Uk(_dxRj3_(m+DENw6Yaah*Rg$QNoD38%TwXJUnuPmO|hM93h%NPHEyH|eO&Rg z=wH>T8Kh1ay)7|5H<7!*xOHz3^KcXzPBREpLCeYt!y2YhPOzX_lB27OMIpF$DW znI3cb1sw;s7$~hZXv_eh&lK5a>LE`nz+g5P>N_o*ELpY`;qrs zZ{^q1(Euih{%eUniMR2Y9Gq(!jo8eya|0GbB>4euROzti@YRU6iiYORo* z0GZuJJ#RJNv(RTS!TF=R>L0NL{h1sH5$pp54_OoVNC1_$0M7$j7#6R()~Eb>RXsJh zP%o^xInQfri6{G~wGCbC1v|vq*yjXi^YVOrc9r^OsdHHr;RkFTw2P@fty83g7Mt zIzKcyjH;ETB3L~9MW(SMkf3AmF7#jhueq)>a#JPf@bz-dp@VwaH{>%Aofi}q4p{6~ zGl7h@sZ0gI&ph#X~j+YW>gOWhJR9x?{DO&-K<~z%>b89VvW(-j+id#^$ z7f%Jrv)e#GN+BP@<}WM7kmq!ltm*A+p1F-S}Qr7t4+*3f1U8id;xcQa% zZah1dH%E%|+ znXqqUcfPY$MCAH4^67^axbJx`z)u=-+T;OXpkS=Sd(N~6TH;#*!5I6K7s_LJ(}!4H z^%aXZ?d|?iV?IK4%Y~?YA>w>td0E=1HYe&~rdE(I`2y#g~kF6DM;`&c;#0ZONX>}GMy`2=NhkOfO4rX zo6)~twdf5z{eSN%B|&!Jj|~i_u{Q?+D9XYb(62k&Dscc^4?mYF6IdNWkE3u>$?@dwehC1l^wMiD8kopEq}G~ zDTf;U&mAC}6(%uV14nzEj44szBN$d1jEr~r#;JtMhu#mMUbqLmZ+@;KxaQ23(&>6f za;+J55^5`d^I)>6+Hf${JMvMyORH%e7Ml0!VH~9j-auvUBTOfTk3@wWWq$IT z(nW&&8&J2x=%VROp}|d_0~J+ih8IbU`_$ltbPwAr(tsksR|tFrk#Xb-2Y|;|$ovaz zsCGHdd^#HH)Yc}^dl`)EuL0iq7Wx7C?oOffgW9s=MriiAklr;&vUT>R=U$U%Q=!0&P`xK#nZLbJ{I3z*Bs{auHbL+-GRhir&sB(?^G*l_>Ecjdo@lMLZkO0=7v=8;slEht_=}kNn7Hp2k3sjpd*$zNilGCA zKu98Q>v087QUIz0tH?tt4zv!h3#>V4q--3@=aV%LT9@rf-YfUNbx%Z~u-KUnT; z(t+5ei`RA_`l4%e`D~myC*r>S)E{gAM0y`Sxb0~y$> zPKR_Dw1;UfmhohoDvj5J&TBE+bc)6KKp)r;TEmy|XPG0CF$y@)X;4iB533qhL>J99 za+7q(^`dhOUBb|)qQc`{$5`N<_Y)b`fd zW6+`v%Ywos^0ut9?997qwz-=q9gneX#5Oj1mavM&Isk(|8(^BgZYM&Lz^Q~TzDKCE!rzN36>00}#qc%SkKlT=My5>!`^akpKr&F-kKQV|3)Gp8@!Z6XV|DejRQ z)`5bO?Of@HE41E|&xdloN#AmhPH^#AgQhkC{ObjoE)1S!Y%n*wJxM^gV97=aNLSfp zMd^$%NKIj6svNf7kY+&*^<9OYwG$&7`(`|?03AOd7Nj0j5$)yLYVTUq*&@_PhPxbM zj*ZH|XwsHhr4OS)VTtIgfH?wES3)W=&6M-twS7BpYHu5aXaI{f!_6V_YQ!oUl}8?t zx8vFKHuUpUhe6peN+VF;Oe`VP4PY9tFO0hMU2tE{;~+0!>Yh+Aeuiv(+@(TI;~nY~ z0!4+u=b0(6$iH`tOt?J498?B)i0SGanZfgoZOo8!V_OPnR=lz0>>cxFQll{8<(R&I zl9S=#V`fZ_{oxu;?#!`u+JO2muO8H;txiy-s44qndwiI%=w4B;KxWL`ZG~dZ+=bZF50eh3nmoD@pnWI=;dXO)4vDh%Z;vVBRnV1un;T)7^R_)bg8mQW%+cN=)q zulKXk0T5}^Cu8AVtjK!k9;OxfV|sd;mg4Lo1ZiQX03S2bPxNE1ZAE8E!_85|#IhI9 z{})Gbc7o{yg|9eNO2kEk=)D)rT(wf8AyWz4eWLzar|8|JqXPGEiQn*>18owP;NYLA z7aF+|*)Hts!2T~>{-Te7Fb9`D{Ksem$o2QjwU=P*$Tru7K1x`RFjGeU1$CPOkH4`d zBjp2>@g%gZCu!RA^x~%l4|$n;*s#L|iN;$vB#^af{x!kuXWx790JowV1C8OoVH0R} z7q54k?;^Xl0H*^S(D=(ye7pqU(>#>9I)RbjORL>VSJoV?jSS&qaxN&8SPnt7vKHXk zD*+KVAIrWp-=bAudR&a+Bo|i~H@^8ggk0MOWeET4&T~rD5rYr9vbmR}>I5}hxgeAZ zD(Z^%_*BQ&1k?TXmNMbUrlXZ9Nwe1M?_R|gXM1okt-`RZ?d=9z`0o(xVopuvbf4W+ zF8y|x#V*eqYye^_z3T~?$eV%8Ar6OdJAkn7`bIRe=jK7M8r2a$PXgQ+XeZYcXlT@d zXD5y66?TU@DZGUvKp$)+@1o*Jl~cgxLQ zHMTu}Rj;QggG{kIx`SVHz4^ym)}-~*+||cARl9n$&MQCs-6V44MyEL|XOeb9gsf?Q zLU*$7;l1rxK>bxXb5+?{64pWdWgFz}HZi=`F938f2bae%vp!bVDEh8RQ1M>!_O%8r z=DpLCDid33KL2u9U|!AVrpNI72uDgZ=tr4vax=Q?c|G#j0GKKrybISCxpq%=R}ipl zn&nI+LzVT{=UzC)yrm{}59$&ZGO3 z>8H0xf&a4d87N~=2n4~uR5faB&U;hi`^`?A`svp6PbG{EA?L-KyTvr8Vq-R2I~|zC zOvFDYt=UzPwi^lysKSVt&@%)K8-F5ZU;i;<0bs;sszb(J{*5%e^Q2Ap=^^fy*V!Jt z9wXsbtV};D71Z>9DQa;8<0oqq3=(;``K0aPH0S%OT0||aDb=p}qU^YD*Kr^x=Jw*G zp*rXeq_v8ACpn&c+W_&df&K6;Mo_wQU>C=*7}pH%{~IBa zC=z&7Ke(QdN<<$al7$(&Y~>t6`co`)2c8JYXeFpLR){`4FRH=WP%qpqWVR1g8XDE) zW1P{`28ob+-?whlC1Cam4Cl6#4sj!`;?dQZZ-fYkTy1zKuy)*tdag+hzpT&>HWwwM zek^pjL_8vw!0j$V9M}4li0rar_RuXL+3YhNl{)O&-#d|8(Oht|G8_(k)`%RDarc*% z&0CKDOBA;yF7-kDGHLMzvuvPRi_I1d4d{koJDB`w1m+n>xkbh4n`w<%M zFVG7ID?lH{@Oy4FlU>!8kKRATjEO~M_2LbvQFym}UPYCHW%f%rG@pFFmK~0+>wxwK zm9xBEgssD@;0IiT5MGdfJmoaFuV!p|5)X<3V5RVO-?F`$9zUOO>G#J5+QoH`oj(+x zjF-p-hQho|AI}TA9K=pvOk%*-?_aDpSJK#NIO(LwJR!8e){qc8V%3rjs<5aV!6v+s z5fQ_`#>0F@!(os-rGV)a#)qtsBMNY!l!QyGoJ?Qjf5Y(?*@h!dhm*^W8G8B|`ah5w zA1zz#t%qSkwGl>J51ZX>YiWGH3BHQj69STS?@-<)hffj{zzJ4MC3mwzLGr1Xj`vs@ z7jR)*oD`10Y69?JngS&{rt?T2Zp8-ADIMh3Lw%+l@6fO=+AJ*1R0KZ8?R{|kH2IVQ zbc9GP$QshjduP)rZasL<9~55M8sFc8>GwU_?#`Dm@VqNwe4zaE$7m`gGStO>^BUu)Pv+FQ*bVJDhJTP_&ThROeki^3g9*ci0a5@|!Gi~HazlU9?Ap&!kLXE%Cpaq*42RvVM?H_2=iHda zXd|Bs?yv92MuT}S#q8v&MeQD9h&3Z@xZ5aYqu(<&E6b+biLE`hNL{y8CqrtrtR0Nn zgv*a4NrFqy4!TU;i6kB>HNPU`nFb0NjNrPb4~wTl+f%L5wpn=8p8Dm{I4IcMx!K-D zme=;*Ij*zlOqYo#=9D)Odm8zOAFf3c7I>+U2jn8~bxaGKaSl>`p@08>Iy11`@XWXDXQ+}advpEsEGs2uni0+wT$|;C3sBtZBGX;B*&B|wiPkG;AK>66Lv}v-mWmLV zj+VU|y5(1Ou$L*}Z%t?6O=`y_WYCk3=t=Jj($TF>o!hVlm^qu8nkx_@zaE=LJ4ozU**5dAM_k#a^LM$&|n z-QT0yVSH-wo^w=CKOc;FJ91yGgesl{{ovQyAZTcmANiT`vhh(ziAKd#0dD+FN&ZmH<3*!}U(#um z{&mTF*|$%OQj+fH7VfuOZX<(jeFmmusr_~oCT)b8h&tGGaZ9vC5g!*Cu%lvbU>Ki^ zMF!j7a!!%()Ii>QHX2%39K5a(COT|2uzF^bfVuIj7$e?+e5HT1)%|T--M>X$NeK%J zzvUfP)K%LtIOkq66hRS6g!m;|owAp>25!EzcRy^lYSN#g_UGzr38F7(F_JZm1jj$; z_=F1WXQnqM1T|#LnEG=~253{pw6#>0BoU|`@plW0Cx@dJ7DwJmQ)Iqccrzi>$Zb4X4xTNsoN6&wmLSdt1Y&Bg_dgeOY6y!>Mxu105d0q~ z3&gvbzSO$*FP4QAfD0P4W_f-U_vy`t0y-M4P{zO<=Wusu`@SUgvyRbdmpZaLZqui+ ztAweES}*vZ=Pk*NF|^?l@9`rH_OzTJ*L4obpfjP~TI0Q4K9}Cp83cAB5#hfmk8vkR z5@j*JEbe74w-+n6n}5eKwppe1jju}xt58%=bARF@)mwY!_)EDZK#|HUq-?t*e=x_{ z>^Dpm31eWS!p>pVOO)nV6Y)bwiyNor#0ha4qh!Oo*ZWlj2@C49avu9~_>1!FvkC1S z-~#p!sEWpH_}uJ4RQ4rqecYahlZ{RT3IJ@-kINf1*SnOvJkP8K~_BO8&DaSi?)D-!IUM4UuLHzxJ8uGL_RApPEzb=sz`ga-K*`ieZ*ZA z^TG*W6Ov&3|N2HmF;*N47oXnhqp%M^BuM?>eoUPOoy?}>G_P%LH(;TM-c#5SoMmRPP!KRH&z$St*%YYZU|V3zxdo_5+-T3Jy$67=QNC2Oa>CK0y+P|vJq>QF zy!Eum8_}gL9699GPE*ZOp`YuRA-N%cZA&C4B`qXwALzwcP4waO%_AaXFx=PYv%Xi# zX1!3h-sBDB9uo6e{@zBm5m*aQj;xj9G8wS(D0rRaE2m(d8F08`TOP6{#Z`b{A5y8P z`{rl!_o55gfN<4=v8XRo6z6}Yk%vP{Uuvb?+JB*m3>G=;A*vqq*xb$cPwaLLdWSS3 zzd655{$w39n?!%8$1K(bC)A4y$Y8yZ)CpJ6_1#(C`Y$G7A;eYWcD0I%XISit0>u@@ zsP-cZ8)%swYiRwjvx5*L+(db~DSNv){oIO$EXNv*1*oH!SbjP*#AnI3H}OwHXTO;r zfAiBwg`ocb^XY>deX7MX=Q=Nb6jtDp!FRq&?NKEUi>%bhNolD^c8BP1$iyYoe2|MT!4cnB@icf}Zv$2jKU_U~Fk8aLS>`3LpiiN_GO z0vRGq#c^Z6YM{6YH}>Usx0Fw}m`U^MK&hPiyX34BPR~c1orE0Bo!%iH#Tg|1uF69t znaQpw^DmqVUC73X+DzYFkV6~6+oM``8eV)|Ak6iEedtm0TclvxW8w1Gu*l}mMIoy{ z(?fiCEKk1qrrBa1(o4$g*m&1kzg>U}m%Gn~Of#f+qi<h;b!h=bH^BhnlXDoqn;Ut^{d+-~kc9m77#qc6X72go&LysT6VvXN-2@OT5270! z9Dbzn!2{+8HhFQb0D=$LD&{8b<#&cUOtDJKd9RyeD= z0tQmrjgwt(UgNr@)v__JtQgS<>lcZjrYhxOO*XO!YwD*!1df!A zgmr0qid2F=EP1LTyE5Q z*g@E`Mz&yQl6P^K@wUQ$0bd=*|2yb8wM_YE#$Avo-4BJ)K@A8`2GJM($^L6ZMs!))%JNJMP4?)I&!G6tynq2@JvSeiiP+a-3iy3bG9q( z#70J#PTDkEr2O;FO@10Afk9l&K5k6w`aZaEl+jUO8)+?KG`V1r>t)V0rZV=#NzqEk zUI9~rz1A?G{Og2Pw67{2N%3ooiRq>;#4t7NlO)>P=$x}Tp1W_T$o2`e>{jFpnRsi`jB|78GM3mb%(1cOQoT#icz}j=M|v01fR$Kj*y}DX6bZ!!xgy| z59j^7=c}mf-!fJMOtfh4mmIF#BEtJls1#O(I;w65C`U2WdvB!sQ2~Nf>h1E?M0@zx zpuN1kjR^<+XQwB+*CnuR$4m9w2QhOfctFI~hXt6q2Z-Qz^L(K{`e<>H#cUz{Cv;hi zGvxB__1*BfFIAYVV|#)QBw_i$t0kIj5*JC#=G&iAETJi*qq7e!2$%uaUKI79#1e{E zGgCj1_(s{`-`?{0P7F1xZ|5rBX&ZED*fZ1*u&M29Vdm&LY3a25PNSkS2fjk4$2*PI zO>aFi>2lGFIztsO=D_}zz}s6cq6lHI(P&lURc2q9W!1r5TZP{eCL`-!cQunGyD%TBwL_kYcP$FCFT z-C|2%n~Kd7Pgwjx$M|5&gSTJy!`(D{)+bvW;Uncj_x&ZcKZSZ}UD4lC2gXf-PcHfU zIPy5|45n8bR^L(d=g#%;nL`*b4vmbig>`PUFzmXH9YG%EbHl@Qmc&E{qc@8#5CrBJv_Cx&}*Pi2=%nIjVE@dp{5oNS}vq&?iT` z!{gukb?CuW{%kJ&YDKcLvG*uCf2T7i)SChK?|H&iIs3Wx(9||t&7j2NZ%so_!sa5* z{zg#IgnskQM|v3gh_>Pp=^H%6F}JnPt>d5w6VH%p#lMYUUV;sg_XcOqvoNh#fVNV& zNzwPulqW5MPmv|2vwcD+suZ7g-#(44>i2TcT!<2)5}v3C$7z=g@+}7zG@^qe#S#Y! zcIIVmTILO+1}4K&iSFhaPAGZ@H0GnL!gjR)f*+f&l6|qZovv#k!YWd1{vHe((?+Ao zdZS#=-BPKW-mfpevV@c-dQC_sPTfIa+`ELNb+d)@P3R%vdhi`G3_Tu^2sY*mRS$Um zq$oPHO%ENy2v4ry#Eova2CX_|@mW^O+RlbHcg(b)@$0id8REz&gqhC~nUKn zet^8fY%MVWr6~$KaDNhx{oU|gDw)!C%DlL{E&`m>QjZOv4^(!*AbMqhgP~`kbRkA8 z$`!(JRNEilkxH$vMLEUT^foI`!{2)Gn?8J01T70<59UU6;Y>Cfblincf*wDIM2&!w zR(_R0E2NU6P5)mp*RWASzjqp!<_js>2gfFMw@4H&MU`Jm(kv6*Oi3IT1(Py2KV|bS zB|_v)7Z(5rl@T1N7+|O0=F?jRTf2AI{iJ;p^QvAMsy`N2JYVjChr!v?n}wj^=g))< zYJ+MvZy8%bo;N2u=+h$P4g3!ePNlC}PW$q<245#d#Sl{9-+C6f4EBfZOVg1e2Q@C^ z>7;C{51u5Dch2qIJPcSH)gaY2 zE_Zb&?U@&9k+hmv92ia@H>~8%jd z{}UJ2e=Jj*9R53pi7wfbVzXpR#gV*Iq54JM#5kGsS#IgV2s}^?{~jm-gvOU@)j8Kq zyP5ozFW{C=8T-MlvBg=-i4Xk{y5p~3?N=(B&1i?mIT&sQsEvC9o~#_q;;Wy_2mk7Q z-d>SsHC`Hxx~=?%DG~#zm5)cljz!4(aS4bb;Qbs@jh0evxr+jsc_|+y=wHJQIPCj@A)p#N9`fGkSW#pkF z7Y_5Md;PWN08Doj@i`e>6zzF+*SmSMH;(>I4BTOr6=31j)G|&U4a==#eg~xv(x8aw z(ce;3c)SZ*zu3;FK`gCAd5^SR_sPC$!s24Z!?fdUNY!9wcuoxViBP?618x1`CEbwM zHI#R!rK6eY5k!^8Y1xE?WpusAFAT0%;p{y;;S$82Uh8!o=sQX>WVAWjC+}v{Zfl-< z1x|$*zRI|$N%D$jnuaF9jgX0tH_3Bu%LKaX__>}fN9ehhZrk_}TsH<$L1 z^lL7)0VAa$JKYHWA@-6170nrdRaeq9aS)q)sT1P|{Y3`X_7V%{I?E-sY*$a|b)Cfi zgqm#ZaT7EbblMY>bkUY?COzEOA~JP}tP75Fs|-B>W{b`b8ew>GcvfvoeX(=vpLx=S zzWsJ9`L0%Rv}w7ze`@%Kt(;#kIP)au0=4_>G#`wt>%<=+b)7cGaPLa z|K4njVA1o))&IwKM~^^3 zHgf!Gb=kic6#rvh;j|TH3wFx4p06*Ew71%P@Te#-j%RpB!T6rxeZWv5SZyFfvsq^} zKW~tZi7$cZpP5myf?1go_({INRMX@cK=BL= z?*ka$GmHpyxPr zJ1#U_D>b*;!UMf%rfG4XxZAW~N7a;6vL`Qii1qWo4#QnVUNt5`FgaE9$BwF#_nPaP zT=Xg6-xh24RiSC~In9w<29e6n58MF3U?0`}6!^KR&6_VUF3(Zn=}%oDp1x9?c1V5h zL5p15Wp_Tw_9&Q+XL!%R_@3c?#-JhF-}_jlcc1^un0cx$agSo|X4#Sh)o1UwRMtBp zC4LlK-MtEJ*DbNRL}^p#x-9l^_drh|B&qA%ov)j>wQ_uta12)!fXwV;-2W1WyN7#- zJBdVUT%r*7c2}OZqOOy#vS70Ls<{$_aBJhLj`fLhtBM~FR|{s(g+&JJf%5wLl2o~b@)BL z;Gjo2y}i|q&KiRY`9Y(}!wblEhadC<;zt4j#+sN+3bv0MY^Q%_L)oWGN^!@yN=l?y z{hTc6&WjDjRW^Rs1vEPDc|~m}QZA*=$q%wb0uK$(4u_N|?YYa9h`m;uzpSS7PFdTjd(D>xCYi?3)aJEx`1sZQk#Kr?y}n?F zE6~>AkL)+52?5TKlB=4PDS=2O3%Wr3O!NINRn{JmgT5U+-X*5oqSz9 zAk^1q?(iY00+$a;^N{`~yRXICtFkCu8^|Pt!Z)FyLyba?zRpe-=91X$O#5A2-1Z+WtQwqy0~mP1S?;ijrRFRG2aL= z5IpUxr?+BUBH5@0_h(PO?rwP-KLw8m?kaBkQ0(jvgpiQo=^z!TZE~v&9*bkhK^eyJ z3?mtg?->|k0yv~6NS5zIzFQrBs`x=40~uscPU&#<)HS*C1;%y9>*j2deZ8g(^glXY z00ZZZ1n!53AI}x4gW=b&SC{|1QMUR>4YYWz!4)~3p2xr&$=~pvK&Y+L@AUKrLu5k6 zpab!PKM4kgkqXB53=D4?z8+G;wV;Ab8b~{+p1WBF?jOZfY#pCOR`-GaY3KjDxXcgV z8Q&b=AO8!of-Xt;aU!Wii$BiJlBFF|@4wo3r@XDM+3ocWDa2nGOu;iS3Yh}_t<;K&RllPh*O08-=sbuHz^}Y&< ze>K?^1H(uL<9h~%SB!zo^pafVa0fIkZjs6km3;W7VcYqJ)kkZV<*0t$ESr@n0V|K^ zCIEtl@dGS85AJCr8wU?-QSGVG6Vk*2KYX_Q(aa19uDd)}h3~NaLc^gO`pW{-BbB|b zdGIm#*b#M?7{N0zyjn26XJB~k7?iqRhR^(gkh?qB?(m!KKAp)^+vE}|ZFkGt&J?s9 zx@pKbS-19B?YiS(TYsW1agTCNmTd0kA#HY+Z1G+t4&;x*8Sv|oTZYpG&37x>gi1TE zf@_)V;YD%y4&iU}LSS^x!0?8__@05`tpMe}fh>r>4E*C;h+)2DDD+a90RscWD*@ws z28Op9!;?Li47`DC;MtdWBVU7of#Jo$_@04*fq{YHeaGX+{}1+e6`9T?^@bI&`m zW9_x}iBSC{i-Jgq2mt|sA}=SU4gmoTf`EYh0uKfJXC2)b75D?`qAn`|Q8h_?419q3 zDy}RJ0r4vi>CN;5@EO5T?z0O71WDMxU&y%qYjX&Qzs2%W;+mdDXB}ZWn(|$j?|--- zg)ciivRy8{a?;fxF-S;Uh`$ocl3?*G!q&l?P4YAHA0m?+(H>^GOir)620!YzW#H-$ zvFA_EJNV&MEVsFzE3}=|F`obZ8cM)vF`g2j>{9Z6c)INSG!hN`18EeWiQ~(l?aXq) zA*XQv8=Dgcsrg{^@*_8F)OZ^ED=zF#y66$O;%m~JRQYi_#)zv;Zb8T27y;O%iH@7M z6?UfuOZ)q!q*80_jm8}oXovM*mB!yq$l16w5o36=jMpv8d+YylegTFQ!Vi+R7*F%# zezmpkF^6D?@b#7`AxJJQU!|>Bp;aIp#B_O0ynUs57Jf9-yBw_FxeWTf$e15<@mL{5 zX1VX%*1O|eMzfGS+w~UZFQ|33dd&Os?%GpLcl*r=r_v3h^0hoL>?&o$?1Ch}>n#!; z->#G;l`_5+!e_0zm3YNdG({?GkWpbeF=-PGhdWxU;nRG*N~}_OJhmJ<_1IzYv8@qX zEC`rrD&c<AE8_(by+NNss=F_Z z*;S>S3*~eTFnUzzT)=ue(FjdX>_(YVW6cW_+47U}?c zl^JvoOh(m9b=V_kbHSX9B9{NXffLBis|mli#zuuGkQ$Ch*?gdjdKZ-mk0E;phL?-X zrn{-EN}_OzU9S?8plGp|;ej)Eh5hO_2=C*}5O!-L3$8JcrIkNnWnUBqj<>Fh^M9x4 zn^zccG<9&aSh~L|8Ox6uB3o+StgdZ0@V=6`p4{~!67H8F-m9$H zuCAehVsr9_)-6E|)QXjWhmqN%hLOhLM-q>5`4DI@KO2QgDfdO;7^~no049G6DNjmb z2D`8<3?yX+CCTd*4sM5gj{>IKx?Ul4U3B0qMMD0>*MbyVKGeTkJq{!p zy5;eT1Wx|DLjbp^F6ggidPmmjE%e$}I6a(L9;L8_*^2~)Jh(>AD3-PX<~him2c}=j z{ig>OMureL%vQpJVhq?uzQ45>roN1|2|7Hw3j#CjHd9KN7ITl)VD0eMZN z@zHvad)8@XqW0_0>q0X1#8%+hJ9* z=<^bx8Uz?D$TJ%Xdr>?~_3MegAmR~jI787Yi1gQ?bcxIg^NqN2@bR!WHUxH1@5}W8 z>GKtJI`4CwOccRsG-z;~Jf??|(*oAqvQl)-M1}q<>`>DF1eR3@boHzN3k*;5MrD1g zdh1``8Ndm6o1>ISLW*prBb%~__F;4b7>2{I*1&U3Ex}e!5#w=L6AB)R`-)7Q&d!PdrDixf z-IS2<#B}yEpO!9fM$*!wP|LZQW6*77WXB;QZ)?<2TLc731#!q0w7~sDus&WORYi7) zOHZJc72*Iy$oD%+7e+TriXM!t0?AdMDcnGE=s?1pAN7R+IE%47k4h*i)=`^bF;3K+ z7ExpW*#Z0+8Iex1MM<%Pf+{;^#)2Pb?eX}nzz=<#Z_hXmx08}SD*E1E>_1ew59>BL z?vW^%n0Z&LY93AV0JBFwkEX_=;ZKs9kua46yL1{l9eABj3?In($JIC&eNnyM4&nZ{ zH2tSR6EH#Dz}MZ{^c2$1{u6R?7Ki)OGLGB1hln1eQ~H;*5?FrPk~$cKS=h4FT=R=(XRvYd7Y9WeYG82-ao zWZZQ2*FO*2lgU5?Rc_;Ib3Jm?8)~SbZSqM5ykx00{D|;Ft7A`pZ06@-Sa3RSv?{h5 z`G^>gj+9k3&!6`JE!Xbq;a%|sz-PC{C&zbsR#2Bq_sHMFlHx4;!{^Ybdtd#!^%l^ z6x{Y(#mmLmN? zQSL^nwv_m(^dsE7ngu!~MI~1h6hpBfxbH&PYmfeoUWcEJnFX(#VdIqaw#D2sK_{2X z;O|tN7RKxUtm&cQJiF0aNnm}NKRsdd8(qo3vGza?XUMAG%_83+Q{BOPzaK5WGS#02 z8@}|kG;$$APqFA`H%?E`V(Xsm?d1EeZT{H$sNl@RaR{{XdICcF!)Ko{i(IMDI3T0t zv+Dx;b9)XQqw3Qop(;Y0w&8SPzApaPtlo?9*bMvPl>o#ZiFL{cGJE0L2KNL74aqiH z!a|9VB7E!#dSIxORAry%f9k=o`IjGC{~Imwyd#>Azqsr&sXx;D-Dqjmh;h}W1j24L zE@kg^*k!43-0nFoEv-}PF1@$!1E@dfp%CZTW6h-z0?kCs#82sygWW4NsnR)>z>uyn zun)PQ|7;NMwas0cTX=4bbAXY=H{tiebInQ9+=o*`>5A+T&t*i20^wu9d7D*W=mRa! zqpPEBNUp}+UDLM#<-6B(sJK@xmBf_~`;yAS9Q&KTM;Y6|&}3}?vP{S3pQ>xi3-CaM zH){wN-`dAbH_C4jZ>^Fy`leO)zxn>Mj4QMsCq$#)*m2JpuIn=Lr!QjX`GJR4 z`vA58lCLPiKP$Ua%Eh3$Nk6ccR}kME*b1eBq*?WK))7P+p;NbgvJAr~D?*SV7oLQPqiV@Ur^9El1wmsGQg@PY-PUMHgYW zfmZRDMK9J@)0<-J7aEGA&URdsaI_*$=(Z%LyF7 z7%7qT+?-!F07}2gmju`45ML9(z(%MAWy|XW@aw|s?vD{Vs56kbiel~Hat3q zAGQ3vx5f0UmEJ!MQJ&g>EIff2n*M!tt2sl5=ZU=P{&%**{7ozU`5BTAu(!DknuMhS z^$X$I5SLjj9*ksk^$3iiVRZLP18mkH3$}kRLlT~xJ^U#HqVrN;xu_qK+Q45+Y4^{Z zyNhMxl`nuprirMODji`T=Kl0NHE?-&#`PBd8H@4Yit=e9L@G3T9Jw3ta!z86sqrM< zH~*FciK6@D^&ZSmZZwz!s|*1^sG zvkknw^KTz|YwEqXB!6wpb4u)m6KE*17M>WyzZx*Qs6jH*+K{hsuawcxU_? z;U|nnYfGZ#U65#nG8RaSz>@VHA2tYG9F@|uHoxsSO*s6xi8&vRc5bxd!NQu`!7OLe zG`MS1{g%Zn^rxA&($U0ohuIo5JZua3&!&-908B_Q0R5->^qX+H!yvPe6wMeuI3mJI z&8ER6cH}G&U(^22_xtn#Xvxc;VWwNdw%`9@c%xHOaiC_vBw=a---`7F59%ms+V5sM&0E&}-V2Q6653pFWG#PIzU_}a)SHCDA zBFDQ;xc?-(ent9xC3Bhe9x2iHd^+OWcDmn{&Cu=8QD>}Jk?q3c9qyF+ei-GLDmsa~ z_2`}}MEnDFBa)SFz2T{&#}MRGdB!U0e17?3q(LyYtHr(Qu4>` zM`&}s7`2$JgQa(iEeCI2Rafecl13B5!+UF;GU{5joiY}i1OKLo`e5&;qs!|qSpK{f zV%82S95k?+;*m8#mv9GgfAskV{ND_Lah*k`rfowc2MI4v^d)Q1*plFDL-0pp)Q>%e z98qv7`nM7sg4eH4yM+CyUv&h#u*?Oe(z61!1>k`R^>&mx!&CTX{0`kbG@75WIYhJ* zefz#KVDt2_>>y6A`H{X0?UB37AdpUa3Uba2uUrJgSS~K)2gi!N9%;?;lSI;;^M5#@ z&H*GKmZccE9;9Jeer})S;EFdVzxneAXdB)n*tZ3LUUh?SagomMGq;7Cu+J%!{-BjaYip6b)|m$*Y8ju+ida=)W=J2@~X1i zJL0Wwengu*J0r}Zyf0bQ#iOco_=mXskmgPmh!ZVq6=D617Xip9T^A|i(RocL;LV{!kBtf5 z(U7PSHty~K*@q}O_u&`oWgsYkerDY-vVO{c+j0_HUOh=ZeXV7waCKA~l>;yH{;SqI z%e3m10-$4IlJe3GdMdv>$wiyIq)61=t(FB2R>^~w$L3?1javS4OhM_`-A|%Sob>i& zJRlIy$H)drM4t^G^tsYw9yx}fpw;kkl^l_Psj7RlTz(Bk+q{MQ5Q+F732Yqn?r<=Y z`WB+zX**Aorh2f3IpTT4+=bRTmIxMOg$&S#2n24vJ4BtGZYw({4_YnON(+T=257a1eLsdCs;E%e)TnoW=gb1yetRSc&B-T*b*f;|wao2d|Ryz9&t#Cfckq;~&VtR^3Uu+`Hd`}tGY)YVDF5%?J6a`}c+39MV zoAy$kkj(E>&kD1|ANY2p{rFBj))T*oLDPxU97L@AT@KI0dj+Ln4gP42rQXbsWqHR? zZzLVMJDzoG58lf%XbA&d*`tqMnscI*mjpRbiu`L#qFXvroFoA^Q5C}{3iNBc&CkV{ z-8Ay|J0eqq+Fiocnp zO8Ce)y5i0PrOFxG_I6}~h2+jp3l8eRQ#Dy%IC>G!qo}4-U4`!8Va6&X9ElH895V^+ z&yI|J{W2$Shvk-;BecoPv%9p>MEF872T874&$4VUCA!^II#i~OdGiu28pn#<9L!|* z4%cW&tb~E3Q+iR_ee$du3xBr(3_=aOWAI@(hM58uOhn^4U0io=onzFG-w%2OfCtC2 zhVf8(#PfxJIOK;kHV9E92a!Pq5dF$O31QV^qQJ%ndDqwca51^K;sRj!CJ-kxW#`7n zug1cre_n`a1(c(Ve-Dkpgq{mrV4$P8swlPBtjuw5HT>0kP`PbVvwQrtVc38iUJP!p zY1h*zt5m0Wwvz&TG3Jb4-;pX%=^)c)izo@Q`R`m)ys^wx2;neOWzDzCWr-T35a}2T z0iGXpb)I5}pa2J7!)hL1n%dYg*&2F#k94XH2^<7aBZn!Cm-49hN@ z2+%@S3uw*Y5F8flp&0qNp*H* zYAYdWeEc=cgsq0XVn}zZHc?Bz=D&0O zaeZcEqbCzO1 zedLUUYxLZ2-Kabv1ACw;_jKGZaC9evv$vKsJ~W(z&X{E6*4j2I$E#_Ble9P>uAnvz z5Ur&6)on^D^y%8kwAMLFCP?&;Ss1#P0I`KC^B2N2_VDtlgzfv%2`g#g_Fy-`cSICED z+SwLx%`Ym`cjhcuKF~`a*jJA{_FCvWHISN~iK4-tV1-$vLJVWUhPK1Vv4kYZjKy}< zH>PiBRaf}ymondZ;&(O%rCWMY?k^PmW7T5{#KR>-i9iXfnv9Q<>2Zaq? zX#UBi`kX2`%;x%O|B4o^R_xCv?y@XPiV{6nrQhsCj@dL3M18p%l+pVXGyys>2pdI- zegVJ%e@)U!7*C|Z(R&`yV|TO){?QOolTD14tl3Ic+T~nDN>k(1`}dVDINK%O7k@uB zU()qZ+Jm)!cP-L{$t+)MhbV9w&IrL$zuy{c7ili=llO7nv)(clQDZ`OqfnQ);5y-S zT#2H6{qqfuBjxigK4-SzeTbtB&uefU8Y z%w35kw`#Z1;>|xEl&x^Q7QJD$sSzNzY-k!DB`UU z110RzA{`Na@@_0$i@2j08zv%x9Bk+Lhj0;8b=}}Y+6Sm8#p3VB*&|+l)7_i(6%t6I6c6DlMSU^}0isN1EA=cr$F$YWLkSzB z?bAk_b^Ij+_tje6p8H!Tx^9;(YF2)WH!IVQru{v<>e=uBrU`-5$ho&CXP_%D6v5xq za9rG;ygYTj?hwG=0&6MAw>IiN*guvhl^@Hem$&H8u29*X(@3aB5y`~CB)x%(L!?s$ zlf@_r(^N1+q#L{mxgK)EIR4s!--DzdXwiPvn8D|_Vr&FYpTOpclC!Nj{6G|d1qFS% z@$kVNNbchZ$*|4lgu{IgIyt^mn@L`awlFgnVk zr;-@~`I$b{b{*>J2ErWqzg0w%pG9=*w>Kkc5kxrhZBJ6Ro{Q<1r};-1iProWzTx1> zl?<>1M)L?Ir2ra)aZw{x6!^FfAg`By{NovN9RhDCx|Z(s+nr~s3YQB}DCW$TtnI&K z06`CQon2}HF=tJ8POkySvCdqVc83ZJ!@D(4f+|Q#Q$L#{Jw2`fS4%(!%n;anRhkr&<*9&eVh`wgMpt*Wt?hk*2zW+ z>wEOb%tdIBt7pGqPSPq|Ej7_8AN-TKq@C9g2GKzlum@Nmhvb2fIWw*o;YmhV(c zMJdXVyb?7ifR~g7Sp?Ou{5|&HD+(gra`mcy0w@xfO)m)DX97i zh6%V84V3jf)dt4#)H!YNFcR zjs#`qGI`-a$y0vCMI-OQn4@ojMfmf23{`}7G`*v4by-6!g`_KmOFrs&=2`b9iV7lE z?uKzA)<3;x0%(svqG6o$gh1Vu@~Nz1b+F0%aMnQb3Vj#|{2k$J1ktJ+s(Onpk!Mw@ zL-0N_bYD}a>TuY`MSB0$sW3JtDI%Y2*Ih~iI?HPZ7(*Exp)*oa%SeV@%M9KHI(7kS zR zb|1~x=}`%)pRmAyO_u@eGq45gNDYO{cmip4&X)rhuP}KEoPpt`zX((78cmJvve3n2 zxd?gbhG-3`_yEc23SIXQ+28LXLR6mW4En>AL2Kovp8JojIS=p;s466U#xQV>u)4nJ zn~@(2N9>QmMyOUm{mi0c336^2TUVgc?{&x4s?ZyJH(nA|wk68cR94VJOg=a&R(H%1 zl}&kWprXrN%<(glP34YOObU>urdLOfj-vX|KoveV5nd8QY9@sx78exaMm5acj!&-D zQ-aXa5rA;DzXlvb!j)!$T$%v<-#cbs@a)XS6ptn7K@H%#mN!?{w3xW<5-pbieZkmX zvXiWPupHT_qS>!zsuD5S^Hs0V4V&)dJ^8hp zWHe$SS-n*a^~_0v2>%1h!sS=QZl%%XkU`~j%mC~)XkqbBA1x$zM+3HC1(eYjx%u4K zo56gJw5#^JIQwrEt*xjMStd+xc1Kw-(vT|K{1>RL!tSq}rWmf~ehs!JcN4U+HS+0* z&7p%h%0F{n(JYz8RXAMOvzB7W)vEUp-KcZDiU9q0TiZht?j zyiJSK9eE-HB&VLTQv+vvS?-`=r+CSQ+r^1B{Pxbs}kpJ6O_7cf1Ue_7s_mm!0JWN$FAi| zbgS5a8SGHBCyx#ydE&R?uiN-TkI%T27pDf&!yIp7Qj6q42E$D1#6==h4OXLD4Ag=N zrz$K2+x#5x{IBdmXG*YCNh+FWo`Jr`i^)8(GuF8TbsqnyW?r7hZ1u8qc}8N#Hl2t@ z0%dr+syhZk+914X$j@lu;)PHXG-)jo6#4d7ITSDIFYr6uE{Zma*xVn*^J4(3y zmL%{-t{-7>drLY#JgSKZeC+s=j)C+a%#@?iL^QnXN2ARfXwO)XrY`@ za0kAyq4yjdbN>j+7akTZ*{in7>Xd?OU5km=1oza4h~vIqs)xu-B5#_XPA&I`$l09i zemL7Pf!a@tI%5EFPYYUU!5UBN0pgv{7b;9QzUo)jzdOlm?$o7%ch*<{OJB{1<@4uy zi2GRjJ+^67r`C#8X;Z)SA?ECl{i2k831;2nsE%c!c@PqHBn@Z44qRC z_4nWHQ@S9Ye-PCJzhhkMUov6MdCXXUAD#s3$GriqcYPm1>613v*t_@RA}xJ4I}@r)pG{DFhR$iREh#0g>9Kqgpz zpK~UVG)j>M6#9DRtoh#?wAs^Kc`Dmj!hX$NGMk ztd=n``}cTPPlF%`bodb~t5RqW?nkg!QbN*ui2i*|*@ySWrBO?V9qYx+;eOz`JJvgA z;%dZ7`+aLyoobG2BP!TGUK7(((6h3JI?&sy*5spQ@u?Swr(5d(-;kEjs15Wb7a6)0 z*Rl$_IAtwbPhWju<3#>aW4X0BO@HlU*fl8)0*yT=1KI(C9x^vsr2RJ|E@KWC?1Fr87Z=vX;%}OQi5M{$+%K$k z(ssZr(?vJw@J363R@B}yE+|~92Fj6fNuu|Z;QG! z_qXO0MIcv+MXcT($Z-T@((Cd)3~xf)#5>H^y^?EpV89Gm zckaG++;1bs!il(zx#9l$y!wM|dr^2H(C9Up>InQBsL$A9BFMjf?|qe$s8`(k+}q<{ z3xr4Z_}_Ea9stqGLMg-=F*&trZ9D%+7=3mh0NkCIGQ&ZJXZJG3@rLSSAt%odR@xtU zk+^r%2M;(4F+jjf<{D4k;{1cIF+DZ!I?OB=)3*VdS9rK!9J5ksO%xg7VF?sBdd1hYjfqR_Wt=xLwl3L z<`^8OJgGElQKYf*wTBIPM!blYnsZ`ZBb+u#pF6TylKj&aE#@B3@`8D2ZMoZ$>c--M zU{3kpoD*^coQ{7gx@REqLGca~g3xOb(u-65l$17&EZe7p^C{Y}*QU8Gb>r%{fw=R* zZf&^kA(@fB+TpULcb`W{^WA%j6l=~GDNEc3Mr~~FqMM9a-k7`@2D^4cxqexr{S*cO z*N6H*C&TYu|Awi;j0#ibILsBJA0D)akLI{&np|;94Jz(;j4!g9R9Kvd`_T&WijQzg z!kmTa>1qt~SkCuPN#4Gii=x!W1St>dZgJc?j|V#U2U=MByVcFy^mQU!6(Y!^_V6l| zD9H4kgu1TurAIeH2syjB$8J5JQMT_o;RBj!zK6npto zLoNu27n^74QOFVx6m@_!Azq(|`B`2qL7aN72@i1tk!WM1E(8FEt^U%B1I;Et#DHpO znNpJNI$Mj<hXKOw z(N`4!x1>x@91T=5zZrkx(^ru>T;>uIYD~Sk*rBl{C?*B<)lP0i3=a0}4E7|f{CNv} zs9#&$YhO&-%h36S6Su>d8;ou2!zA*~^?3G9oEzY(_}A6t?_DA3uhlH7C9-cf)7I1@og!qy0vlA&q?A3y1=l8q#XEw~m>3J!!u93zD| zhunm6xIakS`E)7iJEk+s0Rd~8nZ4;Ujx%Jea#;emq`HuM5~P~2MZP54Jf86tG&Iy@ z64=1Pf4VLOROM)fAKg3j3DD=SsLPm{Dx!1*(sYFN))}l$wUFafR3J4s9JZv2z4b)O z@GnRmtjWsgFLALwKo-2gbPMg_3~jH}kK?;*bG*+iOSReE@?R6th*h4}X}l9{#x2-# zrNhBq(;T;3`zaJMDHMb8TBQ+grDbkM3Yn@J(`h7huUEM}rVcje2K<UTA%{N+x*Yj zaagM?Fx)`D*vnY8XJVLVP#e576gOIASYzq$8#UW2)<|^31fv-s;Ueb;FxMUY^=~ET z?^4khNM{xTHo3;uKFsWI_!}ViGR)==d!<*5P=qJmliQ|bfV*8_{=uf4f8-j_~*UCNT``<^J9)CeLx2ooDDml$G zfZs9|+&x4=b+t)M-Ij&*d=t6u@*2Fj3SYm#Y{1BaW~)UqMj?fI*M+HuK>H45*W3NA z!f`F9kG9z<@-5`pufVTZ%6*%BOiNClnmhp`0%6;jn#u%Q9_2=+mg+i=?kzO>N`+Up zq@CdkuI%f4Shzl>%?qM_D8nnQzU&Wg?2PMlf)JiBhxoNd0^FP&`4XmL;Bbrwpi+MH z(fW4wsdztG9h(T76q^FO2GYy0{M3-mTR5hn_1|1?Jt9>!`oOiu)Sci8NO3sgq{5Gz; zpj3Z0i-?-!PGrsK&VGQ0$s&o|@4tTl=j#e1o4p_wWM{PIC}!LYLuKG`8OMuLXY!5q z(^oeeeoa6#n5dNv6`2skGxA3IJnj(5bS7s*%tR1hpATUf)w^1vxkIBJ(;Gw?9C*jk z039-VYnlwSyi{(i1!guaE$5-nZrft3bx4f$7tysl{H)pDwS$?+ZR}qzdx6 z8DybX$ZS$qqNbuqhtnsSa54D3w)bKDu665bHWN*Hh}A+jS4G&D;~FjQw;coq#L&$0 zjHykPY^>NZxPC7oD*A(f5kCWPpCdSKp{+esIgj zUowqvWXyGH25OdSt^|S{@7bynszUZsTroWjRf70?~i$M4aUZbjnK-gLwP#oj^&t%KiXs+k!W`|86}s6`p{)q zzarhNs%zLl_bJ$mj0n4MuWoD38rgpzW<|xYfkfYuSb6S`!AQg*Ld6gjl=+zrO{@gV zXrHh@^T*YVd|2o&fIifWO1eV2?J$x5IOit#{mF|>jzs8n( z^^FC{Mb|yG*}Az?Qh-N(Y|=oZf=fd(p{n(dgp-Y#??U3?^Wi1@8uTo)3hkfogBu*b z!zT&rQ4OuelnHz}m59ZCa_$HMt>}@Y%_hxAI3BSFU_*u??_>+e34pW}t`i$Yu;>9p zT8+q(H@x3eJdcKrrs&gx!}CJ2(ziS3Mxu_r8NLxht1m_fkfC76Lp5xJ(qZP&D&rud80WqosQ=j(%i0>xB6QH71&)o~FFzpRqh_P2#bSQR z8lgLtK*~8`-2kWkVS3R!uh&puR8`S@dja%vP=b4lx01duzedGZ+Tx59()1cLKDNR! z(V7jQx6$~|K-;IiLXNkY1m78qIN0oaxw}cpeo!}u8+Brhicr~ciH`@T?wkLh$#q-$ z1&zEed;L_ZZERm-fi9w+vQELYgRLVY#Pmn|>+yyb?a-7PX$2pk?aMFB7G%(+Xkj74 zNqzqFlog$4NG5sRFXhmOzVAS4hjeA`OQE58?>VdF0ru=4iA9a!JLM2cIA3ZP%03+% zj}JSGi_;<8bXboDBemahzKOK%be7VPhInZ%zS>{zPN%gt8fNIRU2zomUAlD)?9VFa zn6+9U#YM9}niC31c_!VFve5R;S%1BeK8E&}-eEY8=Q=feV*ys-lOe(V&h^UU{62UL=KA1$(!buCTNl^IbQFB`=bt6~dhsl_D$17>^q z=rT`F(VtK4rH z&s5hV&7-oQL^`+t%B1SvZ+{-byfin4pY}f`C_9L$xvPlkrF`5Z*-E4g$D-tuaZ~t^`!_nQ}l( zRF%y>L>0ytmO_6N-gP$`bML2$*Cx_j8E_!0RBNw`Q~4XtP;G%7H(Q(s`(h_4{@PYY_!V=7iXLiS7J3#OC@gth|!5+y;ty$ z&Q_k+)y-!XkRUb(GmaCZ)i4JkiFgKFbqx~lZS1BSd*6%rs3!s1k^w=iP2%vi!Xp(Af;MhBr0`^w2B0G4@&hvGuif0<8>Ob40k~|#s2vpE6i)$WyztcFd5OK$rcEylUaxXnz}tX0_erSTd3U4~@ys z`JVJ^i8S@z0dQYrY#w!A)R!cCd5H@)YIFWY76;h-=~TlGxB#o|sM-9Hvmf;F5dh)Q zvRU1VH;2i3!R(NQpX+oF{Vnx6JY z-gTdwlt75jbv;_E6d^WCncq?6h(OI-f0}rXN4+w`-{$7>_nxctEez?@s@epgIyJrS zr3*Nc3GC#UjmCP%@z3?*ofvTy{>WWIjj4-i>jJauW_irv>;M83fceIjr*F;XtnIx< zRo1kB10DwiTGtN!XO7~IX8(F0)v7GcXVo$=vb=Y>w=-5nt|&Umqq6WGP7{`0rq`8o z1v*w68|R|aaQ_|7KK?JCqhg_Uz*9nS}8L+Y-!dM8^G(8Z4VeXwt7xel?;^Ha|Bsqc#E zV_IcO&k9MzdCTSQFH$MmlFN@m0iMX`ecuMDBH*x`qn3A4-S3QIb!_(wPc{t7%xo|I z#J*FNCxrf*{#m6lW&Myv|1_WlI`{}Qj>U=F<>{!gF@M}n_OJVD-`=c~nL2(jgwHft zO|Llz+|AM!1RHAJMe@yg;JpVR;$s9nCE}n3cpgbyr+;lQT{Z;7jl|lPic}mwtjdLs z=LoGS`)k9F-EVFY8CG9s~<7S?2)GS!s;!KbI%E2+@r+5hDfvtxwL|Isl2tMh$S zc}_c|{LuJ#W>XJBdP%uCC12rfe_{p@@c|vVl=!L~%~#5;M+CSeWNxN{+YS^O8g<`~ zynx$Ix0Zca3h{7;fj@Mb(>n{b1rsSOur37AOU)af_W-c%mAnYn5$51|UVPw@OqlF_ zxI4Oe_4q(Kgyp}>BgnN-rM&$RJZBT1*7^Miy=(Uk?P6*p+?OMhXxX6haH~%OUd^N# zFXDc_!ahAm}7;RR8kp0FHWLEf+cUJrm`>OkVCvYTqU?#sG^G2 zkG{GM1B^?-t3zN^tvaWZ4>Vl0mezpw6!*!xC0E(>trbWDj6{eZnG2N-F<*)HZTZJ~ zF*tgEf4WMW%RKac*z#8Y|JGfPG@2kLB@il#Ro>NS1=EwA6$Q9f|Zb)E_^q09dbTtJZ?g zD||19|JWj6bso4UPVG*>)i|c6gLHlbp!|R8s6v~%sJe_Fuau#V%r7T(vOYh3<=@D0 z53^uo+oTrroFaBA_;rU z|D@L&v*qO^+o;am6>slE=@h3>$Z|X`g4^&t1+EBRx#KfI-}~AULZ<2*<7fAedT%B8 zQSmsvC48EwO;1%krl7j+7AOTuqzxiG;(qmAr3Jgun;vlR73o!~K%?WO5O^r1&Q~^nl;;;#-lFb4_1YFoV~6&GP)kRt zy{qHdgoMR?eSyzU`U;92`3r)-^@Wpar@#s2dCAl%XqV#Kt01Qx7>xFug@zA)zbWat zsb%RIgZdUQkcxIjIRnAlt=h3`tcZ<^B*-yOxPX!~<^y?J5#DPi52sSB27%kL<1U|! zwQnfVO(`4P6`Z{G^9+L*If(~Fn+r8%=?+IKWnCCtGsLnMOX7|<(R}F zGbjCm(8ijmiX;)G?8idWhYJ9ad&i2(2OwWfC~y2aUH&u)K0OR-q-XLE%8`c8LCW|t zSOTj;^XC}IXrckG;dts1r@zJ|O(i%eAy;KjXiH?SE`QHYkNJvbs?I9gU^R}4P8d`r z(Jr*}5!N%c926VSbo98$JRNQf(7NsqAS+JPTbLBgaeLQQq3?w0kEe8AyQe$fxZdQF zYp&Cfm8qP3E=vE0lB%YW9?jcJ=|FI!&G1cj=T^{!)q zoUQGo+Lyxm;SBIN80A!&3bww-t7E@E1%&FVib%PHEvEwVM75RtvtL(pgsSopjzP&Y z7K2$U1tkfrz@D)$b31*pN#55h6bgphw|aE;t+V5E@F#S;9;ewMrqWIufeWi;S}Fm4c(cqcd7UjtP>vMq1_k(+ z_+{VlaK#JyW;-?HeXJCASmh&!-QaJ13I`2KV^V33Hw~-dq6{Xj6GNz9&(7n=u38H8 zg9Du?P2&Jq!&mqt4~_aj9SakkK0-?D4<&cJ_M>zA4nwZyedM7(e~FJOSWnD?_s_nu zQd6(khY;&XwcVzqUmYfiVSF7|l@r|QevRz9Z`Qayr$#bKr7p)TylO##ve=Y03j`+4`ZlIfE(?eX@IYmoXbzG8#>;7~bvfFs&MCdZz9DJFp=clKrem-pVg34;+YoG3!1*P#CP^78TJT)i@xC46*LHFp;{R`C{uftLLk z#xGkb%NAe^&*s0yH2WQ?$Y1YsSh`HgI;1E?u&P%R+pm*nV%>3Y1?XR%657&ylO}}4 zF%a=H0`9w1k*Ql@!um7mPUBs%bcYku*P5mmct~P0gedr{k$&M$dbsOV zZVOH`6big}g*qK@I92i%?6p94I~m+qD-2?CbT8%P4(kSrqihi}R8Y9;lO(N?TwUoo zBg}e2rKAQL6<&P86{L>%n$}B1OMi%2P?1lL)(MjQRg0?x9XxG8`Pf2K~easjX7zPEr zfDS^Hj#-`q$@FuB^c$RWw%i((wLA>h^!!=wk#B}iiejG@M7aF3rHr4h?lE(jS)f4a zDJ!a66BNUMworkrYsxx0Jor^XKStD_g8p6xb+wySr)l&yT-g%btQhQ6don0#iC+$0jqGZ*IZr)^2o)n)tNt^oeVV$G~V+Uy~{>uT^HVo9T4EuAp-S% z@xI1lfK}yKOmIz0RrJ5bx*hzPAAtbRGS-7-bYl5eQy-?&=GKj@uRW z?Pj;;K~DEJz|p5}-v@t$hEfYZy7)pU9jc=Ss|*Tq(HJ7H@r6V)Yg9I08bw^ z=4o7?P@^!mC1eVGi_H0B=ezi{f-lX|e>=7*rVS?RTjI&%(WXqEV}j9~eZWFmR>oC_ z2ql|N^|fIW7c)dyhOQiVIJw^iYRv@-)hf>zC1FC%LaY}#G?}s9XMTR<85fH+qi#mY zYbLp4XrM1upFZQfK+QtN6`29zXkrB?heu(y*auIUMaFzZLzXW0Y(9k8HrBrmH`7Ay zox9d*Urp0BD&|YyicRV(X<57OmooSN>dTBWRG|+*2^oFiDb%qOaJ>k9of^m!CJFV81J?e}Gk`(lDWHZ^K^s z67xreb5bTaO{{>LXB!Ce;)X|jJ09*5`vuEy|L%t0{`_5eL&79Xdu)kcq`a(U%MLUb zt&N!1vzo&gRc2=Phl@rxP&HvB-MgH_L8D{(S0s#p>lLedt^bQS-t36tAJ$Y|(nr#1 zSTpVS1_58et0~;@E#UQC1SJ7=6k8uf#4K>&zxHcp zO-t`-q%JZ?ZA3+GhiPIIm7((o-zNXm2iLtxVcwm*oe{LUNb(0PLmibrbj-4MD-&~t zW#kW$Mz01SGF0E=GE~Whx{rm*b1f`V`{u4+x`K|7B}=P0rGGQlna%4T-H8XT>L$GW z-}#X<=NvKpyGI$9KcS1;2Eu#=@6V!RxYiP9s=y8(h!M=rKat&B6!jt0yP-Oo?2|KA zdEh5>C6a%ICnlds$S8|3F9Lx#i*hXHEsv9|>@uSZOB9)fb?spMRa)&K8WoYq$$Kypmeze7wXXYFGFXB-@jK&MQ0fchxvYWk=7L=?Do zX1TGStb8Jd2Tci`5Nb~C{vGY&LYj+-!w1{CX9=lb-T4yBP{;K%YV8NiqO-^d+$9!6 z-n*;W`+2@-E%pm0@tEyiw{khrFls?-!fJ@z9~y!ork8^;Gfth0S$#2oKFnq)@|_U0 zLiH^QEzJuoof32oro{*+FZON4rUZwRJkDNDQS2zH{A5J4`8A^CI7nM#Yb7{-!D}NAO$_if+hru9G;biJ z_)#VeOWWDK=T5l+kzbPI)3>{_59KH~n5Oc8?f1^fH4?!wg@MLV{p$I1-uQ}w`Y6&q zP5N_jmiV9W)OB(fxt|U+Gbx-gy|NdMZ8|+mp+4=Xnq+6b&!@TvvV_G$9Z$`;RD;wK_x_kwzO#R4($FoOx_6ezMa z4l&tLeaA`48@Xq6WpCWAzC!ymVqV_lE`Qn8WvbAorCiXu^v?L<3cu zvca#xZJJoS3!Lx#eX(|J1SWF=n_<8BWL_~p|AT0atMP>QhRr{=%Lyj(8hK-|m&;0s zj~NR~z$St9Dj!-b6Sj^rDswveNpp>*%`gqH zK*HmXFmN*agIsgi(`aHg!PBz$c3|jASx8^!Eh+SpYEkh8n%UR$gn27P;?ZmivEf$` zmqs2fr`LWa4hX&?}a$6(W`8}yW*PnWSHsUt~wIO`= z;yz&AmtEFw9MltvmcF`Yx)f8hocyQ;O|mNuh6~-W%ESlndQW~ZykiKHvtm}|?InTZ z_lkz*@6^4QxT<6v`AT9ESbGY`ue2VcaK2n@N6Jg}oICP083R9`Qb0K5H1Xp0uO^6{ zNe+_qUzN&Do$rAp%aL|O;OZ)D~hD3CP(jCrE+nH?ezga!5Pf4i8o}ltwV%O-C#JJ^B zcwirdzavE8uQ(~Y{CZwCE+*BOt?l-J*zGvp>zaIWk}+-oTZsjw`o-(VKiJ9z2qAQ@6Yh-gA&kOwMh^r-k(44Mo#Mtt-(Z% zC-#v!vD%wZyzi<*idJW!_q?1v^QSb3i1<3W1l~IKIl4rnIE(QNCGb=xl3M%ZLE9oO zEPdPsjHc~3t_Bh*cDySV@b#ldhfKGGMUDj^0aDMNgT`PLCFM@8e%;wpH_PSCf#*~- zq2q3(66q5o$?bzeXIP>d$conW$_o8rwoCRm`EzhmZhJkiP)&P=u`lm6T$TqolCQCD zoZ;Ve(lhiCZ8M0FN@s9%#6n%AEBR$=&_?T{=sFiTwQFC*fwzFExm!`jwbpf~NYbXP z_Wd%F6;}<@AF#BnC^%j~Nap#w^dY^oI*vNxpXClKB;ti5>sXG=th;0!heny&yNf7* zl&S5f&zi2Eo`by}KS0)N8n@z_3wnpNSz(zetb;uaX2?5T_1weUZrb}Ox^5vFqIVP! zSb^_I+17~QCK6#F>auLV<5QgbDNv`*VujKi!ZFos z<4MuU@{uG^V46ZHxaDv{C z((ujoCpDHZ!F4xF2xgXR{Vh9bDmxkU=nBC$AK2aEEA?JTb*|t;nW^Q10IW1$Z689k+*bR^+>A#iUt z8-#mfZ9#tX191{t{V~PU&9U+$ZemAu@5)I=VKr{JVeiXFAr!yHPn@CPmyg{5% z+pz6H+^bx0NG}Kp?qn;!I$Wc??P3RoM*!y__QwFNAJ2O!JM7VLMe+o!*msv_q>VW1 zP;fw%#-QBNz@$I@*Vu$Q8B0FbDRDguH746b@|vk`-5&&@R80GTJ{DaD0cS~KWsITW zEwqNgQo(_`(2Nm&y~gEz7wYPA3WW)|9y8<`xhXsC{NWV{!2dHhM3T9)rK zdZhZmU8k>6S*}aK?iV(ja&S|j*>TppRt&l;?+AMx;4ZXXbd7vMq|Y*UNS z-3Sc!Pz~w4(3f==DmT92E(xn8YyTx?PKNTzgpEr;n>zWKp=kISg3t(Z8%n%N1n)9JfUw;`xrJvGwcOix6)dgrn#EkH2Mz9>uvcn?cnYvo3cP6mpy+ zgROa?JoTQ+$8MaS1a8v59pX5|@fWc$W$f9o{{3v9+XyO_8=7hRw)e~74i$0UD8*l8W5fC6Dqe*U19(7O7(v3AFrPFGTRf8 z(d4EBGVWXd@tX9^>>`L*GunE3OU0gCh44>|qSkc!Y>?)u=11&OP5*qj&}OL|D$itO9? zDaYD6f+@5gDL`rzai)zVeux&B6{Q-wLj;8C=Bdb_0k^sTUOLsrY{F8ZOvC^f0cq(9 zFVg#*Y?*&^fKqCi{ITMOn5EUC_*qq4D0Fpv$lyBN|0Xu#@N|iX?BI;hPO-xGAlrMC z%_K)NVr+ervJ{4;^O}nm)1UQZ@?#Ck{trhTvg_7G{yuNdlPO?DPGoWign1BuV8$s} zZ9?R7iqQTl{NQNvaQBFD%dC_k&9U%{x*c!LnJPboDF>Flp-##t1W?8DokVVmr7J83 zXUPB|$lpdkkAhwZgwU_IYmBeHyiwWTAbM4}b!lSIUJk#oD9KGVb(K@zN%iDut+Qyj z0KvA}@C#cMxv-AOz+sgySs>m`)Uc4i*~3RRX08JKe2U?_W75tGr^}O|N6u8~&M$WQ zg>v-A9=%$j{41kz%DDYq>RKFAID{UQdjJ0Z`jizgxoLxpyXDZ)UYpoO%0b%@TV`-$ zl2w(8y5Go{E#wj}Qj4pFGO@q9NR)B@u@0&In{n{!6#J0Xr6e6_%_!q#*Yw|~osaS3 zQ;v)pzME$TBk_G)u;=JU7{mibqyM}6$rOJ6LpD;pbM52Tt;MtZX;Ar9wXUn*Y5d;sG(MWvJJVWT zl*efqgZB{AU)VE8!Ooz%vPEY}bkOx*>*9dBi))%Mu9cw>S_n(+;xx4VY48lKN#^2wue@Q}QnCyaj&0Z&uf6yD zdrgPKmn%^Sdr(p2%!%@a)nKdvi*qDb;rGO2V~^Qj({(7GV5egP-8ikEhvQtT#ic^- zhggd+E$(Bd-Y?BqD^}<@od%k{DN=ZyfD55wtv$1=2mWJ1xcyf@D2Mn@-Ne=Y!|m-d z+-xLAN69pt(dJBta?3YCn(hQ>6vX_CXix zji)3PJ~B0!MEY1dOr7lerV8y2RazSIGQ>_O(_GS@?3ew7E#UnQc^RK*x~~gHi(%%- z(Uc>vqm%O{q?1D~-%z0Kjq*T=d9fc8@7Z{q*QFOQ5LpT8G1^HRsD` z*RpOJ)z;wgzLmRx<-y1jQD4#;P%;2HAo|R#9Q)>dur=yE(tS^@-JE6QQINNY8!+d7 z1t2|0F_cv1)eXnuaaC1?UGSAQsV%KPLEWE{(@5aR?rMrbjQ2(R_!C`LjRU1INB$p{ z3`3_BoZ;J<)pk6vW~bNr5sadgGAe-Q#&8+Ci_-Qhtfm3pKumeg3+b?bqHE7z(?$c# zk}~i7x4U$ux`UvEMy?jT*WXQxet$Lwk-lB`TE8lv-D>j)3?ZZ~ba6t4b@+o!Qn5QZ zd%PxO|2L{HT2j1$HnZpmkgS_yR^~a3d z+@2(B8MXt>{^2N6aJmRFT};?0iJ7`+9V0x8u0e6OQ##@`Q(-ri?JX{>H|A5nz&8*G z5QESr+!S_G2||_$i@EmR=$+u!ElYuX5pgm~KiP5OF%?~SwuWW$20p^bz+qdJ&Li=C z7Y;W$;U&JdCw&deD6R2Rw2z4QLSLam?OgW7Abm+qBPy3rY7d-MRFiF)g(89bd!cl`>= z&c1=2H7KEcHf{M8hIPL$?Kc(R+NJ=+(@zpZAVJ1mP=&q%vLyP%B)sVn*eg%aVDtUv zh`;B$;4ge&#q;ZVM3!fmT6OT0$xK&QqxnOIvkp;^!)VZ?)6^H&&9XB0?NOB`NN)+@KC6GA3k7 z(C}_C=v|QpBh5h(FP&;k6;~w?j;)fb#kDqPZW0-2%*My2=YHH&6#R=sC08(-J9sb0 zDyvbODOOSzR2(4L~!0AOl~v3#$-Qk>?~OrAvY%{EWYr zem(z0MJbM{?}IZ3O+fizCOp*D1x=h!)SV;j+L z@WGbr(-=Cv(nXI70zuW10fD*l&9B}qSmrXN)O3O}bRXS~t8N4lvrVWGFV^o1|EPl6 zlFheJ07g-8Z?X$z-g;F#Ii^~Z3-70}B%GQA-GR$QZD$8nz(J;Y3`%_*0OK*tL2-BB z*w12~Ii3e}U2IP0Y96OC#E>1FRu>KKS$+-R><0VQV;DIJUwj}hYD$jZayK^XrF!+$ z*^VDbUQRnDZtfTK(~3f(mCdBYd$f+3co;T(0>1gqn;b{4A|_O#=h^;b^Ml>??VdK?|%tmU*_tT&=8 z#VC8esT+6>bEft5sCi4PF*ja#`kttWUm=-77S>+O;pA_npX039;ljm4;A%1zMj8c)LYB#`O(SWVmhx={WKA(gRkEr$(Knz)ljF zw9nA7!msn>JX9l`fL7a0uZ{kGMCbLZ-nR6MRbo7-FFHbRqo#bzZc$WFr{kv6r3=(* zB#9PiC@qtV&ywUO0dU`AaW+CE(@yHv$Kgpic=>4->R?QT73~=cf&k%TLuA`|Mv5?I zb+~?Kn_KH5fS`_y@$n?xkD;SSW+0(UD6esK}U`jEfAV=7tRNGNKqA@$6(#%PPy;Fb2Ho7P7x2nCZE%a zVboCPo#)h!t3q7m;9SVc?lOgkz)N}vFr{LJi&ow_hpLBH%hQP2k>*~tk&70_!^Jow z613DGu!(sGAM{C1Q9@QxlhE9n7LCbMaHlnJtTrwYmYmfJ6E$Iar=)c>Hp-C_Hd;}) z;KKsVcI|9cODj4xGyppE%AY;&+3v90{9_m?35}6w^2+wOOde|4G_DnJvM6=RKexWr;WVSZD5 z%8%KN*g}J)>eCOHm4`o!>TSx_r8+)ZQ-^-K1cDhLq_v7QpH1ogp@x$#und;5?Bs8-sSTLb_8rilkYDu%YX;)k4NwynOtjQM)xo9&9 zK2(?XNOWG;Sa!iE(G#fbWtFt2!eC()^gSDnlu7@gSrz-puMOQ+z8KZO@;(lt{v2M! z4)(f&i-C9T?N($eI4$sJ9Q41ow*!ACa&c*?_Y(;?V7lAm6CD2nKT^?14_6!&+40W= zTf`Hl2l7m11h=0tPRarNEa69j4z=wQ{!C?0iVPHj$-P63s!I49>h=I+(0xb3IW(1R z)B=h`FW!H_)S#-#;C2)b3!a01Unk1fe4^R)nVV0QIG;^pL6rIU!~N%ikRgEo*{YFHOyV^eG>uS?!w}gM=V!i6HoBpC!)Mvy zksgfoeYPdDE4S7jLm`$S1Ub5Q2M8`R-tV;c69Z39WD1jQrzsY`hVF(p?2vY%#A9BZ zhyQF*F2sOjV#)Et#roPGx96p_vFh%EunOp9v0=zv44MnHd5cVqyC*nEgA0WA>t0|? zxRtlIxPed#F_z=WLT`$&vZaImz;=R=BJoKgesLlN6R5TUn8Zy;dcG_N+bL>@LH7|G zalwvIeu(t%%|89g-N9_0V;_Rg-^1)a0r7vJ<6g3@ft8FTehbA);Q5ash(~R+gY1je z&iV7=bwtw^?GBG)jNUzNlcJ*!g)y2NGTAo1ZHU?*x%!9?&t)W1ypTo8&dNno!QomB z=iVc0r71~gD{+17uP+|;$G{(bJGC$CJdv1-RLJCp{|!ftS596##)UYwF3G0{p=m?29jZae(q6o0g#CV- z81e7zQyz`)ZE{D&KsE%JN5sS#=jX(BKAMjG?4B^%W#yE~0>5B-D$W=|QkXRDesi1T zE@BO}f%w~b0S;FTLvK7KSY+(l{t{wvx67Aiej2=cOyqxsbigk((p;w5{-#aZHRY=Q7|W*ekz z(Va$C;xHO0m4O@nfs6%@dt{fXzRs-{u)`*D%u4b z9A*_O^P$6XnSl6NVO)2SMdC5dch}WYp#GAn!1-SS+lr{IG@aSq;!i?=A$LKk>t6@8 z2c)$R9K`)j?=%s5cT%A~X#Gs~;9I~gQz`#e#4R`@Vz`mKHEXE5Wr&>L-tSU+$y%&; z*g`WXBv0PUw#sur4uk#eHfk;PCwid5mp_R1W&%((U=WVd#Vj}du+;f-C<-45LLs1p zR+971{>&Pan;4Q7((DReaGS#lq05tPL3cd~y32-;36G0*c6K+#?$?*C#o)fF@`kSv zV(^Ox1f3F#Nf{sykK2gzcDjMB^}b2&=gip)M$7y>OF!@o?L+hizxxgmlDj!sa)12! zl%C>x8xYJgM^rI03--(Azfu9cg>g)T$j_0z!U(e*1wAcYxs)Licq- z(BprGs){o06(DN$LttfxVjI>RPY2SvGSGh3%3V&2!j>opU69gTz0fR>-wQ|$FYczb z6uCfwR0GvE4MKA#nKV1P6}fOyOOrqK)q|s}Z=K@GDV(dNi_OZp-nxyea%=0yToPea zlma~$&FmFE^tG-!9re#l6)44RtBwkf@^FFQNw#*?5FFg6-V%xhy6)2y?rECHtOD;V zA!tgU#%Wwr9Zm}ne$!n?P%_w!i3J1O(S*RnjKCyj>pt6g`~5XaoJv1rLTC{DhftRp z692D$-Hm($GrrT>VgP%v2_Uw53x_4uD0 zq0;^c_ziSBej?(wS0JQ95(*va@8x}d)Uk`ga7K~Zoi)Oz)acMl82Y9J2@U(U3x{We zNv{v{)b@@4P*NBZo@YIyfqQod%h_Fn3muqXsf=EwpB710>I-=y-B49NsP2 zB4?ebhZIIw4sm(AX#Cz#)e*5X1OWHh^@NLG$Q~#V0gxETW9Nmc25K!}vZ&Cz1#Eh( zuY*hro~?SugIni`FQBF>F25O=@+C8${!#H(Sa7F9IwkVN6uJwddY^NoiZg0LXVs6X zRO&r>k;`Hj_^C`z-j^WTeBOj)i* zhlg?|YXDIQ_3s#|-uS8FbsExs;kLvKv_9%Wxc`~iWt{0MlE6r}_>Ab`n8&WN>MlLt zIWXvVL_)UjZb$w9?xEP=O|2*Qp6ZnGYt zq`ah>?&*p$#suT{I^vq5dTBsjL4l$!?#|4lw;}ZC&=kY%!9RA70TxYbQMR>N`m}s{ z2~0Gnp#W^zf0xp*w_O$09SZNZ1G<`*^9xn$%wvcTZ{dBM!oBoTABS(IisurDbLvkw z9sFR^(a|M#j?q5D>V5HxiwE)Y%Lwj0$5)N{JdaQV@B(auJmX0R?di(dw){w^=oMle zcgrBZBK=aY-1(kig&3N#>qGAvSM*E4#N|z8emnvu!UjOb=WfBm*QRZ+2u4qI?$8Nr z$J_COfWhuWOt}jwqoZl`P(IJ5&8>T^qh>oEF%PG)yVQ=+x-Ss3!o#* zmdO&+?n{74`CHMFzfqF#f7mFj1ug8%En3BGA#1s&2@1Wh<;;FJ3VOCSKhFzcqAv5HqtjF|qnTuiDWM9XQLx z6Kvo2_C|uAKV^RFT8U9Y2}$1^X#B$Q;-pPeN==RZ((b(Nj-AKIX=?b{yR}d0A*cXP zmIeUjqJ*;EzruqpCJbRJS);a{Y`J4eYR#4)05o)gl?Y$Hy*+SkXWhSB)r8u$4$*k; z>^o=OoQz(_^>qg4cB1Jk-6z-R*M<09-)Z4*N?Mleih+YFUHz6o;%zam8odlIph++X zpp|RH*JdQ1g)uPf{}sV)?$@b$7%AlL7_kRE=pBsCzl_#!f+4Nf-!@@dDfO7AQKU06 z0iQ(*{Iik*sd@}g;v?Y1A4*64B;30~U1b z%(yiYItTolOQ(O{Ae5o&2PSO?KIw$lF53CnVITtWh?#Is*WOm&V(v`r_Slxjbkb=7i#QM_$92i%(b-6w|cJ$T?bZm zg-&SjN0tMa;iEqBRQ`#l!+y;)zjgOL@U85=yheR&^Ok4PJTg3`nM4vF1gs*s?{X|-JRpqB_oNO>PR+9C$ z4Ci@OxIe6L(VgU`#9NngMO(S^i6a3)2j1t+%yPlVOX#<@No^Z7#&?Ap6wuno*L1(q z*=(n6w@iRPT0ng%BYB8fiyRWeEZC58J}D_?9!XhEF@qj!A`iW_CNXhVJ`RONLK{di z`2&s}(7QGvJJ!2Ud_0cBdzyz^ueYl}mZ;)d0HkfER-K_n>Q4el82=>x4Fj4Er&{Pm zW?9m|CS*2~Sm=c(9C>opA%5oZgqej*K&JssE@aW*J#ZYw(Z2ez9MlE4PJo2}%&kw+ z_?0FfM z;bz|1t=xe+if)U=$8*BlW4FmY3jV_N#7Xqna9r{(+I$L&Xni=kb!!duSLY2JK`?Lz z{deVjiZey!d9KU8H__t-SE&P?{bEKOUR@~`7|_M+|Bx?Fm>&{!?%CcN0#$@G>LWC+ z0az9@bjZ@S(mpL~tqUy)z9%c0+1px4QDab-1!3<_>1>d41kdkyXJ}#CP)tWc%%9oO zhE5Qx-MRQ2I6@Nma-g`zG4?Y1+9qiSU63TECzObO8VUVub5^7G`dJo~V{_y-;~@;k zo5Z%S5QPl!3=rvi!erlnIdOZxyF|s(!x!QCWW@oXp%Kt?G*d6gqI}$3i)`~M8+r+A zS>HYpVSjeN(iH3aOMJzc*;1DD_>RIFj_Mc2N-+|1(2$$-zZe>Q*67TPLuI-U&##g6 zy{uYtDggp7Wgmqr*jlidHcM9~<=QrtG?v8*O@Fm$7~MFDpRu0}uhv+Z$Q6Mw_n4Rujf|o zqq>h&Yq@oOp=Fnw1~<7@_uF6vL$i2g27cNj7uu&Z_gfexw(mG-hB&Ygx%NowwPq`y zWm~V6IYd&QN5IMqR&Qq{nI*mOEK-y|k@uNSRoWJo4~ga!*u!-9T{2C*E^+rJPnyLZ zNEF>hj^gCjRv5O>q^jE%bV<#u5vxG9oQpDgSjuC28iRhTMur= zqWTA>e(J73uM*{>xPVitG47LL_u;3P)^5%5SFxuns zVg||_I#+y&VQN9*ksv>kj*UF2ibj?T&)W97BDND1)1-Zkh0II=rAh=$>`U2EM>P~}m-lon}(4~zM){}5r!-i->2((Bl*Q2CBjm7jkFZY9+Eqn?Y4IohkBXkybf zD~>(9%`J*f$bZM|ZRdQC)&pJ-pwL8%`4mu37O5PHYp7i7Mg8R?L<0|+=7Um`^0*8a z;pM?CiMox(_Gs9@`SrBop;OD5+vyG5Hn?KFT-jexy3OzgaXvBz`S_0A@vE9#F2UnN z_tfH%4TxMfk#8ue2+YZ2zkRd2hkmp~H%P!`*!WdQR&ZZ)u_(O5l}a51OZ3((W8Ov#EYg&r} zn=G1&vohATW10;hc?TAjfw;-Zu=?_b&N{?*r2EhM6Ylp40=p!=YxK_DAQs##K4^q; zx${HRNgY*ev--k(;Y3)i(Kl`NVNX`NHczed7fd8_eiPz*MrFuE$P-*phuI$OE1YN& z!Q9>y)Zk+}$?+pQP}tuSGOYnRG}u$Or-6H2XD;CRW*0Cr{31rJg)j2olRGFNOt&($z2b#-t$r_=lceQo*PWZXZt}9 zf0dtHveNgU$D4bQ(}=(&rBw4Y%Esm!0-q50VfI(>=45dCUhCJ%7I4gn;Q$TBl#vv- z+0r$J8;nog0uA(J4aYfD8t|j2(nxfW~%BOK<`a z`48qzRH%h6B+*E-JaYkixbgghZCPU1$kk&o+ei*v0TW<-w-X5MAFEIpY-c1((d50& z#^vlRX0p_3@KaG*(3U9|_NsCN1fb??KyWae_7THoGB`~q6u*eqseLjc?}Vc%7khD5 zvt0T3%<60JIk>cq)2Av2S7!zl|H^r zq`>0K?}rMREuY?(->e`BEyzU1S?~TFNJF+t;-V{_q5q;T+HqidQvtv@;F)^(OI^f% zaUa&sEzE_?0_1LmDkMb4?i=!vBa;psbVx3N4fCu&2s`i>G_F+C$vXq@aAXo}E-ZOI z6ncd#QuPkX8P}-{#;=fJo5hXbFgPN7bJqU0(9%Bh_ zm-Ug!a0k6M=)9uKEs69yr=>VMSzi^+puP0H_J0>s{;4WO0%~g{35?tN1j1=61$#!ucLhPDomj$gM~fmr^EC zg{N64jERlN=WB-Nlw`>}Npu{$r@?Q)R~>a@n@?m$Bu|$}dx`q^;FIMUim~#jOkgTC zN!QTn5t`(PGWFj`3Ylf9Ik~j!-#IVrY$r%12e!9?t3Be_49ymYQt~gl>EER8VNe<- zhr{wR)@1UKf;k7nhZ|W>{Tg;p%rAm)WSttzc$@3ac524s3m90X7@2bXs<` zOlMqD*mBZ}nAuWnw`6EF?OrfoCny?`A%=lheEPAHQU97xD<~YSpkM$T2vl;8e6zS- zJ+FFYS%-8s;u;5-jW#B3dJ-&lz=#USUqtoXjmsZ3%vp&PuP_+Mx~%s(X=fW!QkGjc zKQ~2$fug}RxV2@Wk7z&33MzaUBl1sx;hc$=7~6MBq`XiZ3HWvk-B85zJqV8O@F;8g z2{vaE>(O?%2CLz@KZRl4V;+%Aos{-+w#0OK2{uo*W!yp>8zL(R{EC%cV(!j|e1WKe z!JesQpTmgpPIaA@5;#ueI*Vb;!wU!8M3Yi)pMCkQw;pWE!1)50G^rj(0VK`l_DkSk z$cANb)=Q$4cQBlCc8p(<{>rB6+MjX=X7x|SuR$Ib?7sxeN!0VD zr~}}Nx?;rnhiN0H8y(|~@`_-iDHHr)1E3W6GW6!BHQfUn+HHqgW84-!JQA^nYt@>c z?i>`XSRY0u=Hxi%fBM2uHvDVf2$ydz^e=4e;1Ox&zShaDb2xpU_iXsNhzAP2eL_i= za?0Byqern%xND@4GYgJYW(?$N_etKWz*imZ^VZa1RJ--v#{RoT`2jGLx|)g?d;9>a zN%*1Oavc@GHoW3Zij3(0k$UV#%gxc%FO=dAp?D@8GKyRgnA-Zm@L={j`8K^U#6na0U26{2TQI8a~fw9=UL%p;OfAWRY_Z`QeKLS-Z78wh-}8e>!8;BIPmWEHF{ad@esZnH>I6brbBiRK=4W-IL@wxOn-*FVkV#+k@ZyUa~= z$;H1*(!;P9=I_GAc@Eikrd{BFzR7Rn=(MTU;rM%~z;SA=c_a%}$98Ic$p`ZPW`-UO zO=QE_wlhPU{%LUu8=l5(wD+XRD1}CxuJT}?tkwRtH%H_C>e~}Kn0)o-Ja57?7$U{r z&Dm+|Sc8-)m!DpQBr{R-dr51&1GWr(b@OJaY6Uf|TG`1OzJ0Pef4!Cy!$#1gbqmM4 zbg`@Ya;l7Vf&Yxe0k4%NG)=#^-{mpx4Tp8z%GIsN4H-QXH&I33?T)c}^xs7(aQb@3 zToCAcXzb;R1ujl(eZJtwOE^ze0h-C`hSeZ*-TN!4>LmSl;?`op5#A0)4M+zC9@_SP z70|Jz1{@uZfS2?-tVvZ(PLx8pNr)$LsnbRB)7GrhQLA;E`eZaTsl|XkXq98r`~3zn ztC}reW&ecmt7XSjtmS!J^vS2d&~&8Lh47N@(-qd=A7>Pwlw4EXZX^`!^(X6rDt$0| zA;G=IHYg9D92n8VUSL$@xyKXb4N90%zB=jk{)G~)Wt2~BXFY|FlUgv4c=MBxah^WM zme%)zX6zpdG_*r&k!4%YNo~aBtWJ|&544&FEOstKpOSH|JD3#8N@O~AIhG-f%`;eD+^Sc4*p2}_Zee(mn?SK6IRbcQYe&dcyQyOV{TpveIQyHc5liR`!J@xCO+=oT zD-M()X-I>+84E$!r8DpYwpcBQ+W@;qTf`UV-E0JM8Im2`{K`I!fAf zPQd0Gh!@LRs)r`up$c)jN(*kf)viA)3M2*?%|+NYm$>%>6c_(4NK^sfr0s)NEB@Mz zM;-&61EB;j_#@mt z5n*$0u^P-PF#CfaV~Y~_J^;P@A0kQQkSlWgZEQ#c?Db(=U^@nH;uDa*HiZ?nrd|DKc+(AE#tZ>A&%{WG*L%56VOX>vpge_av0fbC2^y*@4D?Bs*^@zl zCa+Bs!pyW#0nZerpq1x3E)p?^ZxlT1<~CpK=;#px;+eF^^L_!rPaAE#|K9`pf{UWu z^H4xJ_#rrS`1WutmUI{9*;fu&kGQN(_9!dLPHMv53fmSKw)fMG{Y~1T?s1Qa5HIJH zOTgyy1&8cb8b7zxqiz{D4N>Je#)zhHN7}_PVdKjCZ`A>%$=~mNvT5HZ0Ikg`aw<4o z0={yCV&#QIZXc(&%Cf83tqoR`+y8HLTcXT*+^*Mds_mmA z90bC8V6wp9QO?Pwun56L%gRDto_vtP+_5{APx~zXbK!LJwLPyEoEwMDG`*uwcM3w{ zWJ0gzNG8Z~qw<1=PcB{N^6bR4mBgFp^acT29y%A2rOe#!$t&it7T{-|NgWJ=2BF-> z7alSsfI^wR}ECq*;};B4@@^p>$xkf1kH^{{kB z(4Z)hp9Fo|MH5$NMv0<|8P=j5)OBoxWAGq)4e|(3Fn#Qcymibl zm+doYw!;F(c7{8h^$|Wm*?eDn>tt_p3wXcRj*q-2T3^#VYV(;<{+)q~YOQcbGz2B_ zb0cPakePN_^wS@MNG1=sQMO^1ZnpC?ewUC87o{v`v5(iJmB0ouUF?IDw@7jqSsdiL zC)EmkvoZWks9QNgE>e3`zP7X9mabM}#o)jx+B;|bH3aAbhYnceAIR?0K&y=leU!6O zm)QZ4b2+bly*>G6;;a7h91_Zv{IOkJLW|mTd%o31z-|Uz=%xEZ1)NpiSMa4xCrXQ{ zPj(YK^u)@{@0sx2_(3z%h1no?}z@XR-}Z$EiWw@_iFc^*&9glqk+N zYcsb>i7LfILJSx&J^uznSjq(ZjhCZkYQ+35{XYne>ZIRh@OyczH(i)sUo!AiQ<5h# zTUv~DizV3KJv_&%@}kNfTs|LG#$$v^k{btf7F_hEIf8qa_I;()Hx^@fG-6`E&(k&elN_UHt zNH<8Aba$6@OLv#FAl=>FaOU@4oqgq%;%2QG;~nD}>hudz2x&(YiQ|pU$r2D$hX#B6 zHWh+p*y8|Wdz!speELU*6?j=nxJU3GUi*aaJYrO?kl2BY*_pOuL}C_(?+Yx>c6tl( z0DQ&R&I%LM&AWr);A2-?mLm*(mzhp@jmHOsU#QKt6yqQ)@n|X`dPaa2J127w^t6u> zNw{1@?hZALM9?M&W<(WqJbS!@oK}rwTC~`2EdG&Q-FDAhXT%(66se=?EoFG(kaO76 z7`fuUv9Q1!5~D|OlRJdd7er{V1Z)V<$ZXk)tI7>Pqf{!7^H?74TG>n+D^gQ1whwD;Y+lQ4{BsMmF!P4i8I`>LxMDi^_LKhEcY zlk;@1${1b#Q{v_<(u;@{$U7WYdS)nub&7ik^V~1WM9$SaIL)N>Fu?b|jAo8$eafuO zzcB*a3#|bQ6_YRNVlRnF zHp$zOYQQlqQF`QqmosqR+>086pt`Q5%8YfPB@|f<{^~_5AcpqZOD=pjCAJClor*Qw zhN=|k)$iZA(Ge6+wNRK!O(!(HT~%|ewkC2(v*^S z_jP#dNdZ}G$O31#;1GXEqtM|Ia3yzmyp+-m(x2L4w49n%KgwtR_xs*#vi3Mz=n1+y zN!n@f0w98y{B2}SV92izoA-oB!E2C}wkoBW>Lc_T9MH!9zl*MDh$+@$_4>X+| z7wM-*p*KJ=yA?X~vieS*Ni0;DVEQ-2(fUGOJ2}PxDm`ni_}Aa%LnQ2bcka>LS~^Wn z8?&M&D&)Q|MAFYFEX@?Ea+IT|+rQ)7y{jvyioPvG?Ww#no{kmCfFG^WY>Db)Y=dwA z>+pEgRPcHp(+})|GSXm(Y(@SqNP5{Roc9ScSXED4vRg(EiOimoeu30W26-tE?S2*q z3v`<^IX?PGW4P~dn1kT)=ut4725hIT_*S zRwZ(vWiIk}^fY6x42zzZnJ8Ly5nICYoPHD@Mxu3YX`p3XhA!C`>=5rSr8>w8$L2QDfHA*ZToKF>3ccdhUa%Si-Vn}HtS7<9&c>Bx333uzabyta zz+fcY5@-1fnp>DcrCt!D-*=b!RY0ba&1xd>O*XQ#6{8TA^}zNyCu<*ZP=pjOdpGlM zQCsMTzdb zahMt2Dh9?6AP=BR(cLSuw}?T!GoZjK&DNLYbq&>%8Gd&$eHCcgjg*L6im!$|G;+Cn zQL);LY-(R$5@7dq(N>wuYbe5t!l|G&Rz;$HLLGSRaIq9V-u{P~K(rVF54_TI1xzN8 zXq)d3kRv0x=kc8>jVG?2uM&k#RucLEY7Ni~M*WeCD~_AlYMJvWSYYn8t_Oe!RBx_U zlyFW+^#jW#-xNxaK2`ru?c3JF+w#-1&x!jhS&lR@Wc|y{;oFBT=~R%5_fkazij4^I zeQ!U?5ksP>QSFsmk1a?)-4&t`@yV7U27dY8_;tHwbKE*n8d78F>iKO6{8g_Hn?5v- z*stL1`FeBMDIs6E<+>%x@8uf;2HsL6F#Uv&^6gvR!oV{~UNQX%GD`0cM~T^MlAu{rQq-hUu?pX`EETq zUMo2YC>Q;zxX2v^_azuH{6Gqto_FoXG?RsMVf(r^mV3WuanZTe>unD1j5tmj5*JIs zFN)=3l_Eu}KSv!u(R3<}BB8%tBu0aJgOcZo}jBnm@L4)>Bx`F^4#U3W| zacX@>*1#=J13!=ow93#kJ2>JI>E$<)BV&-j(6$}p5mRdjHzIPwPAYusTdDn(KZrGDsoGaWF8P8-{Vn6il|rdK>N&TJn+y6`*QJ$!S4&vBFzs-MFsU zC>H7KFzYhPLzF^WiVcC`4a`s9eWhL^1OqydRQpDD0;tIO_I}9RDD!V8A&>C{GYpQRMvZU5~)OV};Suv*`uM<_fjgVPqijDS8EA~{|ykT zMdNgiUU}8>D$UbnR<>v*1EW6}MRu?-S=ji|S}>sIJVA0rG`S6)Fdl4EMS-Iy@a^41 zG+GsLtMmt|v5&vd5GJAqCN1+3-$MuW7g+U}o&r3>L9SVN$Ea;g#h3sRtXdTfai8C%9!&~?I#NQ|i(hg@d6HbGTW#MF z&)?uHPAH7x!~;w$iOkmk%irChY(f3c4Qf#8*{?#IjC(_VHG9Xu$O@|cj{L;@D zd3ff5M;0125!64Mrb%2FTSzCHs%P{3q7n?^wM2jFON)5d*fW@urHi^k_{(xXa!|rQ z(FrzN)AT6DqPgCm%C@^2V}3se7izHn7$gi0HgQq^ zx<+&?+~?Tm2o-I1gBPQl#)6+dliA8XL+r6|zY`=vZ5#vPAp{cZ8$HVjM1AkUgm)d7 zG(kY>82GFC9fV_cq+Z>dBFen1hkv+)E~%UAe>cqa&~awy1+f(Z=iGH6q;O#0i5`Lr zrf&al&z7>Cy}~}n*O24+o{AiZ)cCEk^02yzJzq62GFO_je~;XCM30S za9CBsGXCBz*;|~#6$b?0+S9(C5&wo{$nL*sSjB9E4gY*KK6MU_2aK)u1+_BA#1G-$ zuJQB-a*f`NNfNF|`~bx{^GlCr0uJ+9j!q8&;G(|{!5=j{*P3MMhp-S5RtP|kdf)al zmUlBl1~jYqUz0$;`ah~q%ks!^-6`NOJ+tisf;X;#{eQ_qgo*(Jb*sz=Oh5H# zoUjlZfEGWv(M1Mf3@l-ocBs#ggHGldEw7Y7a>t{P-W3}K!K7jJ>B<^fa0ak*Pd|f$ z2lL4Dq#~kIb*VYA&tOc$_x!k4=N+e=b&f6a0UFN}nBUc=TgBO)k=J6lzv`Q+Y*Ae> zz%bN=F{`67bfC#Xbvn3icf1Wm+WSy2i@PO(ARq>26{x)ptiW@-^-fGiR>jH}u%nZqJ`M}?QAdyN^Hys~50rzJ zAY#PFSW^DjCUdQ6nO(_&H#uZzn=n-YKAv|JbxJ}pmqwd_c;t4z!$_b44WvJ;-_&}; z^)mdD%Nq)3Iz>U`kNZ=n8`a0G*n-`zdaGe`WWcO_S|l}OH1^*3!bV~AE~p=u$Lmby zFVarEna)*h7unw!gAKFCQ*ojQp1(lo49M65)bJpWFubhFsolOqd=S!S80kt~4GPx@ zRd(wCfgx?(-%BL4cO>)+oPV4eag5etyRson<$im4S#5(MglJ1Yu;?Vi;)5iquZN$= zI{AyN^q$3505MtU=>V3#_ge5$_A*dtTFP`}%^N)pyDT;kC?0;3zozHNoeSBj5S zW;!G~4kV3D36{{I+qeG&QL&(yt+)>T8|o*5rC4LkfUL7WCj^Y!v3v+b7DV@2Gn)Iv zzc;9UBE5njA`(oX2v7_~8=16aGe+Ytr$A=!SM#>~51biHH;+~@Di6uS27(MQDV^Jb z&CN!hT(u?rGoUMhknK2#3sL;EgQ-Rk0DQfHvqwJ_@+V+FHTZ&asmv*?7?S(FN28m7 zn4Fr|Z4jaetTPqjk@?LL0NvX$>?kI;sYA`Dg=EZAz2_fRh8+>R?p-1SxE!|;-&_gf z%8KM#@99q}*-aZs0wSLB@P0_|Q|lL6ExvgFb$zCWH^RKX;JEpt;0p9)f2n%+>%qiH z>G(7FaFACu{Jh(E9S6DJbBiLdqgQ3e`Gbu=?uN-s^gk#|cfaO=9IVyX74fbZ-7yWW zc8h*gj(O`IFlQI`^H}6_)R;*}x7*f=w3daew<0K=%c5c_xXak}gPXwvo}5p+`q ziwU3_{W6DKuyht1%;R-9{*7jhulWFDAv@vk4dEp_22Admj<+rGjC6sD_H>z^BfP)A2IpC56c&09bizuZ}sfLTn%LvNVXu60_pyx5? zmyw;u0#!$f%~#U4W5Nkc8IZUFFsWgLTK$v-pgE7Y&x*Q*&H{b^gJln5PlUYWA4JBR z^md*!I403R1PU7%USj4f*eyI~Q}vr|WnQC4U@`lmOua*qpu0?xNG`1VH(e(FLVJ}z z!R0<47$r z(o*&^`Zy>Gp@bZ;Q+HuY4;*Vgr>D8atiG23L2HNi7Xhhl^|!*BylFfs568o*ckE9F1cBJXTe0AtB@Vfx2!&IL0Dxh_;udCyODClXt~G|N*v zl6~cPa!m(!i!YyAB16B9e6*LJR$OKOReV#hMBdZYiYf{R9W+Rh{%!2bNe-cp0 z1vJ9VE5tdjN3Oyo zZ?}s$(b#wd$UOHkfIZ0$P6U!2*qI>IAr){U)=4|X zR%ymRnXuilB5uI>!C8)sRjdv0X-Y&uCLKd|v0sV=0`DNBzbS06i7gJw65%e?pLORT zTAqN1OAMey$VcoBNZy!ODN0Dp@PJ!(wrSWAvdFXlq(^(ADN~QK3jXmw4%^7O!+(7X zu}Ai2(99>17;1Xr`iFs|Yhn2fbk@R^J+aNE4>Xj1 z^E9*g<*|F4;vMD^IHhki0wl~ub8T>vn}&RzAfe~d0^^6yRaA#b=Tz1TI~`BU!J4YL zeY3o~%0&r5{#`O=F-O9Kcol2?m1D@jX%h)6D>nOOh8ai#%9eJCgJZ=`?7_J_(lo^yLp9$f7Txh*jRY-LJsq`_ykfbj*6+{cn?+dU?I`>rX`U|Gw((d}4aE z3z$fi9X$WK)1)Y7*DZRcdNSpf)Ae2)>{J8~+>C0OTAp7)pPJs2IZv`>%IhZ$3hAom zzwa!6i;>H=*C|}l6+DLv`5&Y@=h9CY{-YbYCJ@KdQ)<0U@}uq}NsJ07^^f&cA!pbB6|aE{J5a59AZqf2)&+tbGe>i{& zc4ji}6H(O70)LBr!O-FL85Kt#o|OaTMRY-0vXjRL6mIYn{;)NoTtN!i8UHovXD!<- zXB(4nKonZ|+=E$)rbaF*eRjX1{Pk`>7^2$P(op4Q6v#?S550b?>I!Sp%NB7AFT1Mp z(N5`~S4(Y|nwthvtwS6F{%GsrxbPQX?%zggN)Rnw8vcr}L43^A6TJ0)5DuKfVY>qu zI?!=-V1|FA=mcsFZ-2i1!Acow>FZD+Hsu_DMKfXOoHWIkb}-YcH#;zWC7^Lt6k^MvBwYiRdwdrm8rMhr4FlrV1D2dfD?&~5gY>>Qt zd!wdkh#9L)M1y*tVbCl5864C**0IK^!WjsdS)Gta4_}k2Ev)IPTMa7JaNsdi=g*Xa{=>Ln0~f-4~MJ{-&O^h09aHYNUSnMN%kuyx(k|M#nGxYJ%Is(X@|L zD@v(K)}r+M=XM{CdDGUU(xtNPzYBzke-pmN+xJy!-vauegCNtI@A^Km;DzJ)yt5Q~ z%D6|+N|k$f5a<1bD) z@H(yhY|3;7iX%&Yi~WkfW%qw*5s%8b6q^J6LHXItA&NsGUzo_62W=!0`)^gBc*MJ1 zq8H|P^a8G~I<>Z_Jz?k#L zVolT3T`^PI7>T~c!De#->3Tt&dKC4Qi3DB6*b;L2bZ3Fc6CD~FL3S?Nk-=pebfh!QWj++>*ihdNJ zeTVs!`)Gnb#T)arTG?(&y})a&+T?6OoNLbG&z+Y=V!mBKD_^5of*Ei*f$voLgcT5t9be=!Hb%=$inc z?j$WIHieBfl|WyW0#KGd-KCD_&~n1R zFd2aF_XtWnU_xRcE^+_T0Itc|G4Xc|2bPhbkO&MPqw)>r94D^TO|h*Gv&~qQBa&T^ zVuqqHO);)Os4VE@!04KdII$sGD_~Kmk((a?iY}8;?R+ALspg^ZfNuwkx07KZyU->{ z@AC`d@wMC#x!%}^5$1dVjssoU?t)wT@QU&DW$xbVkRrjcWz$%J=bh#Qf;xc;X}`gQ z@Qh}HbLdCuAN130EzTyK4>_Z4uB@AQpcS|!WGHI%fB!jb)ft~hJnsOLnx5d#B9Qza zxSe<&AfC$mpAr91FwTLy)Z;5w+9->Jx@%BYaj3Q`ZxvK1cwr^{I~ftGH$GUnP@n$- zr8WQE>AlWxe8>==F=>2UGGQJ%@&MjHKSNfR&%6nB{6FV1-|O@$^VRxS&?;%?kQb`4kz5#0wl01i8Nv zIfIB+PF`z%eXk7ByYR%8XfWo5XC?9c`zIzcZ-t6wC&YAY72_t;|o3Sb=0F&{iNZv2Q=Jc zjNzEC22w88UFo1JBYQ5_O2y~T7#B){{-}$j&FdHUFOSx_8HTcrYNfwo)|Xv<_cD<* z7Lfq~kR#{oqz+K|X2-_dgi`J%B+~hjeC%;?=i*o^Gj`n?_3jtaH<~DC58RVMUIJXe&cl}LDK;%v7r^Y+ z2^Jc?2$&Oq!?tZemd`gkG!!t}H({TlZh#}MqucRA?71fvqOK{h(Ks@|i%fb4Yy-Zo zRKkj%Ey6iy8tKBbfY_)()IUgfcwh5K@Tt2DT*EQ24srR38jxx}RZ=j-Xx%(JO@9bP z?O54tE&2-!Vlo?glqw=yyiouN)~lWH1`a2fUmHKuoJKOXhJ4H3%a*}*)7*#sJYMu1 z6xzm$LVvKmF||+p9hkQzih(S%HhLi~4eX86{jkG9eZ$4bVv9NiAXzQKUkK29#u}Vl_(g})^>-e?~j0FmSO-d zmpPNC!xTpC5BiQsUwn(_){P;6_KlYV7Tl z)hhVcWqKEBy+>}d7E}KCUYFy2J01mS#QY@k4dz~2W3vYcv_T$+I!Vw!P>mkpdcJ_z zH*t)O`T~ozK^GzX2%Gsr?k5S-1Aend2MS{#LVupH7@#@KPnO&DOhta~#GF!aoQoMV zGG>3Dza_(zWx(pK4=GL66v+UKY{ph7H16?{H`*j@o!*#CoXT|0Z14K{u7qAK`FosCG~_4?{$82BDs2dE=bL zSzBHZ53d5#vcc=dRP^jew%|4X4_r6h${MN=&f$HA#`=exfeoPP99(ya!7VX@wUaEy zCRfImn7I-tYj$71&^O&PR!Zd~yQvo!HD#Ve*ni)%$T!mg!oV?zCWM4Ke|DHq7?SBW zfILW&2}sr-uZ3NiHp>3EdPdw#(MkdJ2FO+it|?tsq4}q5r=djMV&EXFf<`sp&f0V@ z>x8AYm;K4i#U;8iL!Li$Ur@4qhg-VmtHr^ee6i8-UnHq1gaq-Zz}qb$2~z*kUEo$_ z&)9Lvp3%55v0&SL?%ihPSzf_;4 ziXF(y=S2CIj1(E*d_=);KAR!8EN{>vu5gOfZe~`5yg0oM*Bw9yICV{j+F5Mrwl6F} z4naKuPz2f@_ymE>F++n&L;vaGo>V4}4humQ1K(7R>~N&aA%}Q2`)z#VoNtz?JWpvjOx{8Z1*7RCRy{2{gA^ z9BD>v z?Bd!op|?PA6d2S)zO*YE(=&quXX)%nnJIZ94*GwPtsrDE9nrDvwB&8qDcpLzYeu2c z#(Nt+tyKnK-LvPPfvZkgic_HSM*xmq(zt7v2p*sS_2mmwo{%M@QV0N%*S~=a;L3ze zTqmpK05}g8-%t=BaE^oKfI$x#o~}sR4skhJ?&%=Maa3vNZEaQ8tv|8eF#m0${m6Um z^XgsZM_;3lv;wI^W2RoT{#=o;{;->;r#AKLr}d&+;18%LBP-5m2gU+{piHLVb}?Kk zyYj=YPs6IM#|&*c#xer+E2yz#n?Ef?(>H(0ew1d8ldv|&40p>Ar!$9R))tf)C@cz> zYP;c%W%H)A3KKW|XYXo8&pv6vf#+%lZrnktHCDL+rV*3$F(d?vYy8g^7HF8j#McMH()_aTX z+i9u}dR;~}Nf4b;QQueTMK~#@$am}E6i4mUm5yB+AnQW=Yi-zPNty5@z*8`)>jbCh@`ajO zM{Z?wwk3J^H(O3%rP-5PTszxs6K)5gk`sk_E>twl+wMr6aX%$afo32l6P_4X(mhYj zuH~AfAQXsAVwGG^eC?j;-*l$z87g>Bg;%vjR~61C&RpAz$c8-8+JPB9slwa$+N8C> z@;kJ@=hjJW^{1hM}}3BK3nY4Y|&%!b6i)mSb_&@vOv=>{&bu6cs2KV=NVGW9rjjNjargenToE) zGBDs*wxAe`S2ILdxSPv3Ahvtv>WD@mD!G74OMq!4>;N;>D@BSMZkSN4F{G5R0Y+J- zAyWl1{bH^?rCqAtT*f|7CLJUxsgS@G|1> z2a>_ta=>S*N=2nectQl&sBy`GbYN(5oY1qkm2oMk@QtJ8kvyD zgW7Ucv={*CYV`g$-{>X;Zs-k@_lN&trPy*gxoD`pUqlg|h}5=hC*IHl37hWz`gnW3 z`VdgmlKN0Q>bsW(Y`GNu4WaUxIdZQQYTaV!l=xFk6>cET(S%UZ3+IApNP^Qy)f}vF zCJra2qj;9suFD)Z#Sz;7vQc(lIG+L^wB>W#_+;=Bas!jF6jyzAqj}5)3Xj?OqRQJ$ z4FhR(XY4T_QFtXCU%B22rcC$WRoq3d_Ov**GTgpB9K4MNuRT4Mtra zw$wzb?Jd~JB4s|CCGYC&I$1v7p>yb}@=2g--*S8K1{%j;eMoI~6SsDH>ai zr0|d{>FgUhV);|12W)ESn9SWy}EG0uozyDI7DtK0k+Y$6?eQGv7-p-e<0#K+(!YGYNM(UkCYPC$p&E16gP5OJ_*PWIl-~0k@RgAGM~2gnJ6v0c-0GyUrwgS z1%StD^W@d-0*C`^4E2{CKV7nmQ8lGLNN>KcCB7tdm4-lD+YqOPw+w2k8Rbn6X6(W8 ze!kjydzAW~RNp6;_T?P6GvWA0lvRfN`{U=ZQV&7M^H znD!->ZC(nV4{ADPgOXZb-v^V`C1RErElHS(5B2*tSzTdivKzD?A=9BO+X>ch6m@Yo zv0*VcRQeW>Bo7nh9Brk^FZDB4eEb4@7{f|X0W_~Fnf zR09|to_4>G*4#+Yl)!pA)Q5dhgt^nG=ibnvOoS{jea_+y24NwMoGI56$P=3(7|9h8 z`DURG&yu=`L;h}ed_x$8Bs^mOl z1iR2rNzTL&OM4t_f1Mkv*hKNfictjrrGfGl8e4y|>Ntgc2cIsCIIK_cqiA#nv!j24 zjJ6be5yAD(z^{C9_u+cNp=!dn_1+Xo#r*fOyl~sQoWI2Ds5C|qN41%w7*o*tyt218 z`yz}6cds`vr<1feT%}uoWQ*4Ocu%F*63|hJN_`%mDlkkP#uvDG-a#z!LovD2rB)M> z&JSX0iYhv?m}Uziv7F>(=>@7>yK(risnhk`dE974?_ZGqRT7#Ea&-{TiJycq7{6pZ zN^*+i-lPK+MSH9F3j>-MOto{=dbUI*Qk*}RJ7b0!4o1wNCE~S-HFPQAC~2GCY2H*< zcHZl?5K(p+xRVPm@@aYV?qLLyl+tZ_sc$1IBK`=5YbxM8YWat*EcLrz^ViI+_|1T( zut`59wHnwzLuWIR0)7A4Uf4fki!Hxrz8EZ*hAd#o(-cv<6m?1YYij!E>-Hm9TYkR; zh4L7XVMnlGdz{g-Kh=2& zDLY;?7ITsu5Kx>NAn=Yg=nYrVg%2c1^UNm^B-LrbpsiM<-Ju1>SIsW){wn`@?1+<~ zZ=PO!5ESPSCE1coBbafIeI$+MYkCc~h6o;Q_@ZZ(z*4@NI*jAjx*Nc2;{7X4OqLeP$MxU88Ul?BKR1ER z^WE1z=LQeQO_=TlZTg_v+y$saNtg|5)^xDo-`2-DrN8JP zm3Mzm(KL$pw}vp^vPB$=bHCu8G0afpy4_7WiXmyFhNP`io+g&Zlk4~>oqYaxgGN*7 zz#v(#=kvetgz%6d$!mP1oj`AF|n^_*seyJHpgvVk`84eph}E8P0)> z)f-_FWVPn}X$M1_SkP>BqXQDh&l(-xNF?ory8f4s(!=ZeE2ZGFQzYS;55fd{Ra!o?`&A9lkxhp^5uMqrerEc^p%ABtuXwOpL2c;<`kOyI7#O-IkmmkX(&ImT1S3-n0To(7h*20 zAD!%_4FCE86*a?a>OH7&_t~NKh*Kbj)x4GcLCLFyN3A>_^xkVS2;Ed>)&q9B+P(PF zZG@~z{AQ4nF5aHUiTKAbCfo>(*Ub_Ed}QcR(%0C8@KmJ-8!y3qPnY>NJx(v)kbA$z zVxN&_4Cyh6eJv5C2(C7~g-f#e2OPLEzC3xaO;r*tZ)7~b9cH`*l<+?%x?413G1J_~Fmd^m5y>R}1s<47HH zF{0f|tXRoi3^wTWj;qYec1Z`R#CXm~hq3`4xFO=*Vbr<`_|yQ>1R}e=ov zLhzt$sSU5nw+M4}R_b%}TY6`>W@sPV>Ju}p(bgRgoPO;7sKJor{1cp}^Hz0W^9#Ty z13Z^M?4HMw2BO=?bKKK>;>KiD+xd7MV9-9N&U|1>$6XS?+?8S$;Jk`FCcduC@HMNU z>@yKNNr|6$M&YZvNO*Ruul|i6CNo$`Si=~eU^^oiSFS4QP?E}7o`Zuv;3c>MjZ6bR zJH&|nTV(BpZMsm7rPGSbNpQ^<`;d>0l#7|3{JHV*MY}dPO=d9e z%JYWA#EsCIU&`M9_ig_7b)I1mx8{52z(}iC5_Dwj^jl-sqe)vzq5ExdPx%dh{IOQ; zeOHs`uALp6-ekbY$*P;k7lg}Riy)+UdT;gNR&vRq|A{SO1UH_r_um5wZ-P)+t*oUK zZ^z1m(>w*Nz4{`Lo+tGIerYuW_=v<#hReizTauLoSdysSW_()OlQwTzm8qOO&}%81 zDksoP@fOw=Vynda-n2PSpdT@*HLk^AQq!T@%*{8kdZcQe_npt=^tVH%w}UvZo6rvW z|NcGx%*mj^__uvRs&Iafo$qw2uTJ@c>dLIt;5GL|$`o_B&Fu2a7?pYLkm_h>nz-HC zAE@h}sIcXea>$H?2p!UrijH$2MRfFFbVgTTLb2Y{+5#J~rKXol4>Pg+tGcZUK}5Vy zCdj zI6?RsQD={67&$=x{kM zNv>;?{<}?IK9aQzt(>kDQ{JPbgYbkw+^AYX*RiC>nzZ2NRZ4xosE_klos=11Fwm;& zn@EZ0NB^;^J-Kh{E*=hFnM0fuqp=t|49&p{?`G%)%>!{hj{=8RilSoHqu+T7vJ{8m zSNvc9>J`an_F7x3$xrKDxB|6b9Kh-CCBISBS?t-*d`7>@)Kh=_)+537+WDeCS!(YK z)0sIB!t|lRs1Ej&ioY|ol>X&oWzFO2g;}AuYzdj!>uY?ASfugw9~GzP7jh`t-^P89 zSt#m{#z8jK=52`f`^05sM{MOrCW$k|A+lyX=lM*hl#5m2tRG@XnlpCXX_oe^A7B4F zxVb>qES=YaALo2?74s-1!QN<)L;L5)gu=<6>hVdY1$rB%4d{!@v2fo|t#JO-Kic8o z;$W2-B{1g}D9=l){g7o^(@o6gLp|B1at3}^JXZ6&FuZc|8opefSNEcAZ2Wq0X1LXg zft6q!eKGr`60M9_i-VO17ysHLS^E6p^OpNKqHLQvU2Ri%gavl-cNQ+pF(hwGWF1J7 zEBqM0FO;6|La==V;v3#fXzz;d*I$<38!tpQl|J#a*!O1=C-i891?8SVdG8v zyZey^p?P5T;7+t8Eko%OqZ+4DWyeEeQYiwYak-|0oD=3 zJjhmx3(dpOqswyX+>ox=Tc>39T;-U~>K@aG80{ALlOD7Hc3e~8?e#?Kv!%E${2=q7 zue|Z!vcuCT!M&>V$)R=N@DZ2A>V=*P(j1y`C1#nA%Z&IPw;C7INII=hH*z+B5FgRshr zS0Uc&x3{U%!W_Gf>fdD5>D1Jfcd>d;lzGRyb-dyR0_*Hz7qt5Ob~ znjP+64k8h1!@%vd7=FT8_|Y@OIfAzc{o72Xgp5D40X_I%DYHsmqCncU{2C1ZhyU7h zMLdx6-<1a_vnq=_zHgcA&a~a@LBZbiSt~~Mt6A#7a?O@~fNnY0?mlQL4Vg}AT72!v zx=3PI>|8BK$(XJFJBb7bO%P8MOVkR-9jPCdQ5w7L?{_|SD#-rb+<=F;O||_^JoTus zR(MZN*}XeE8vi@;@EZ@c?Kits0g>9SF`P z!NR&zKA@Y*0pX@2mdL0)Mtg{32*H#<5X&;LIYB;oXf3CS*Ht9f1+XT}sW7f~5e_>u=YfrWw#&bLg zW%Q50)_uPM`aiw0+NPf2aelmpUlb+qxGRJ4KEFtoY2?miU6K(AI0A!qFr1qP63qjm zyDtQd?W)3`N%yibl2&AG5!enDYzY}jly6e#oUNtO(corWtO(@$@>WDgg)+!F+=+o`_qC0pV%M?H<}!BpUC|XmP6!ZdZ1~q zk5lBUkmNPSXP#1pv5(IzRbQ?qT>HYeZWc5p{MYwHvgsE+D{&B=w-E^{yfD`ASWXm2 zjwZ?o$}BX0_ltCO)o*zt+j9>3$0hi&(y=_!03L z`BN@~2NTN9CQUt*B(xm&Wvn)B=c(vyk?+6ngR0&>^nzHb?jnsex!yTV=56+ROXgYi z2ASqOpRJrHgC0kcevZZE&J(O?!u-ia|JGiq`Rv?adRNoKB3A1>*0bi*YE~EEQ!ef= zP%LGoU8(>+)kW1ZzC&%%L#4Yn@{C_imvIOeg9-y47PQq4x*Ml zc>Yo*(P|JJtrK4yDavo}WRTKYxr-z29DDYw7o74)Nk2VX8s%aC)SHdnpeb15!Dm}Q zr5_@%oW$Jp%~ZPmxr~u^-n-zGtUKKWq?gU2;{VQlHdi#P++pf%= zcUW=6hQlq@&f4LmOXx-W-A8NFCIK7V<5@RMA+V%iVS{aQw8u>QULM0viA}BMwNz!F zS+~>FQxX->{d%DnjIUD;7uCUPK9!^Ux1@P;n0Iha0)@g)l84iXaf)M54kw%h+A2jk zB$|=t{_os++X$Y+z(t)ur_C(M7*VbKf`iUxEC0nt(uB``@_&CGYQ6i%6yeu3hnhGgwltVXEPn`DL2b^B1Y0-{9tkD2wp4Y)Nix;KQ2QOu_6TKf`xfN6oK8A( zp6A*p1T6ixFkTa;r%_1c|$?sUEQh6nUE@c8xqOm`W+0Du=g} znYWC0Ow1M3;o>HYXRR^a?~XQ`I1WbY+LMXQ-V;pz@lf~jOMT7hMK{b^jXj#mqY~8X z(ac{!2wiYtKA2CB^99dwe`ad?rA821^9AwhSEsw=ftrn?)sXxy@)THT0XsD`~1;4#Xx3PTubP>m6R^lSjs2}g$asD4b#Ya2mk zeSLsRCK&9`Zu(B-ZTBi>(4EFPvR}x5;cFSaSGYwv2tOK(M}8#hYs_>rICH3Rl8=cX z$@H)G6@|G#|Da;oG$tEN@r$*`oX7(4;+%4RBWXlrb9)$xpJNRe`d++oVJ#d zoPNeIe^wPpt*9hp#+&MVd~m}QEN^m1psW_}r^LuwfW=1CwN%Gh9sNI!uEDL(uMe*+ zF5AX(E!%F{#&RuNL$+<#GM2fpY}>Zodw%a9@V&0@^*rbKocr85Y6KTI{aDL6mQ`#d zX88OUV`+`+`rUL*zt|@B6R=s9FD7Uac79Fr8fO4-#$Ss=3_v}R!t0CD>cn*O+)SH? z4|;i_WtviW;XsUokI~9}*mOmAlofwP;+toU`_~^fn3C5CX%>HiaBki^{>%_7JhT^& z8F6qW!|(k;&+S6~WXVA={BojN{j_uWRpBVJ&^dT0=t;u)@%yN5l=Wj;5N$p~^#)~< ze8GwM8LD^;d6i^Tz^K2k?_XGh;q85d9)p>ZO)f5i;k2^vHFGmmGos|)%~~7s@ie?b{w4x%VoN~Lb4!NN;z;pNlxoIn-T>J zSOZ+phQ7`GbPY{3#XP>@A5d^NeH;HrF{o!MC)$RgIraoy-?1s1zd&-ejGbC(GUZa9 znaAk&H;sIZ+q|qTpFCqP3xU+{Fm^P~@0#aahiB1$!_%1OUqNgRqXj?`!eQWeF%5XW zErVU+X*4O*YlRx)24g0|1#v&TujDWEzTDw!h%1J;??FQ8LOXT3Zcd!+y_H$mi*~d4 zE-T7kSj)_z#sgdYlAEZ7LmJ(KQrQX3tS>Ltx>H3{3Pg=srri(gv&1W(Dy=bjxtHzn9jb`!^q4)dXFKPxB#%OLN z0>(5x+S`w0yCxAyXBz3xSUeM`{{r%OzmGg1G{7+|R8rBm2ot6>T^!p=e;AHyZa3-% zl(i9D`QYubNr8y(3AIj{2A+DICZs%H<=c1$BlTxM5^8%6cnC*bMOB{DXh?N~@r_6~ z&~yx^78Qf%JZ!jnKv+%WW9%9vqqux~g?k#a(=gal;1_C}_i*;G6XPK2a^#-hxaaMj z2XO2eGIrV3(95FUbwUel#AA?aC^gNVl)1sC3Ru<8#GEm4QO=SUubH)!|FUM_#rbEx zp;ITSKsh_2^|}a6XicV2Qn&b$#-S55po^!{%p*DT7?bYz8N^L=N)Eb3u?O{>iCF1C zX(}xfw;#Gpi04blwY<;RLuL=z$IkGX>BQJh_@f=uJBS%(W7cqkYA)+aJlSoyvMoa! z{PkB)>ZdPz?g6RX`yy`bdS7;YD8%2y_Hz7*)f+#jO6DqhuoN-0T%0KO0X_4kZr#Mp zFWafi_VM|$aZ-1ZBuI$wCiitNPW($P{~v>&dY)1lc*?%=e>p_Ba__6H@fF`I(T}xS z389J$i#ue{HX?u_q?DhvoyC`O`AI`6l;Xxhoml z^4a|9HZkSk!JzEtve46Ge{ON6;_|gc$c+nJW$_dcQ>ZP3Z6k$lLPqG9Gv+&)iG66SjIS48n_&c1-j+Hb zeKnMOMOXXS3w!DQxCp@uWKaM0V>`V;dCh0DL^%ro}8$TG$hgPlnj zW%iT;*33{=k!zqp*~^9n>7ur?s;0TSv)9KRG|EuMkIbQ;2U+j0LUPHYj=-@xfg{qo zh%j`5(hh}P9MCv$p-UHqsfyTq#9wM&_#E|UwsfoVS*=YANww)(8>^0~&~pB0v{CMV z7_}uO^>HFWOIB`j6z<)`sF18L+YH|2`VR9IM)n_%&Y-odRtjSom-mybRwiECpb5un zB6N$gpgysPLQXCG81#1_9JHo6NzJBmjVeR*rJf64^_l zNy1giH10zY9KH|p?h?2JD__TE=fh!_wX3IinYdjhx&4oUb}Al{Z;>Z4oYe(LICxV40ulS_ z!bb%6O|k?_v6Jn5qzL72VSvVj_bB`%pcO|^X!CI5W#tH`ZYe3HORZ#(E?fK|Yt z_+00(j2XE-!vd_XpyH-NJxY05dmH}PtyY)iRep(`CJd|fzYG<+C?aqnm6rGwm(HO& zSFt8V)p59Q%B|im}n0aGPm>uR1 zG?Rw%M*qq_L7?|dV7l>29*xAQWK6G;>Zu>Bmtf!Uc7Gh_iH%cjbk0qQy|k+_!&3Wz zx&1^QP-MVnl7w`NAje=MrUqoGh>AuSbbs1iH2GPVvbxW;+-Ovf&G+xnFAp}v3Vo!R7qudFlJZeWxfKtB$58d2AgdIuCwR=At9g}}@t~UvZ z(mTo%X7Z;5onwGJAPxiL`K2lVw`-KD9;rhH%RD^^xAm^8h^;k-mPerPF`^swYn115fFX)AkGxVm@QTjeJF|G(DN8- zOQX;C=X6HKRrZyG6dkNnz}zsJ*w^3%l(|4VKMp*~_h!t`w(ZHxJ;ktBQh#+Oh=~QJ z65856m0yQ`GIe{p2QT;a%}4>SBcV0I;u_j7M^3o5%)J%E&@82gO~xUwt!~?%TGnLB zB~|>0o}K{+U7PF^Y*(_C8@*nVb!)^l$wLAbIOhH~N1yiUl&Z3g9iV%L9u+fJy|7Sf zKWPt+k>O*2e6u$>XGJswheD2u#os7&JV&uzxr?rZyjb%bPA98cfU}ryTZ*8H2Ag}a zutQe-7GWL6e(EF~JqII_eL7Pb3yzP^l29dcX`mR^+5RKRQUSliD}Z+;S?U{$nQx z@{Oq(TUmD*K`x<4yB91$6va!r;!C5G&7f@V1e?|ji*Lx<_0>i043Tj(zkcs;SS4j; zUpA$j@rv4;qdjzSjewCqCm-WN%74WX=G{zS-u*>$^@1f-lGeC~gjHVm4ouUo9LJkZ zs%=Y_Z+A)Fk#uW+X-gj;kgk=mUj3eP+@_0mQm!-&^mz^pSGsJ-QkK=18At>xQB2c$<}KXUs*(%9P`X zA+Sd}9oRDKhMVZ-ZuYhqwuo9qsu(7AWDUU zDZuu0i&mlYvqguGeAW@ij&M$_-QydLm0vmoD+B-UAh;7iC+5Cc4PkaOE2T(DKP&_v z?g|wa^}1%pzU;{oQ`R@!SfM9a zb2W8{MB)hogMNFBqko8j1LRTG8f|vg@TpJW)A0%_8bs)I1`7pW2Jc@z^xlYXa6W(; zPCv@Z6(Y_D{)_=iVTXUAtC_U;IAOyFC^%=|+nyOlojoPX{M03|46q*(TtZwVYThr} zq?TD_a9#a2ddhj8A*eBmvl5dT1Q(+Vu|1b^Z4w$mnH#XHvqjZ9O%+!a*8`tu)z{*F zy7IiEzqQhp$dWu5bwwT@Gm`F(ShZ}Dbgu}`bml7NaY)j9h~M+z06}&zt;q8gLmkXN zeyPDTH)DC0KeU=tmO}~4!4&@>BCG==DPC$?^)$PBAbU^tiO2;CvUana;S6X_8;vw4 z&^wRT;tA*vhkuBfeC*G!bEG&{I`Qn#Ws|qw5Ag;VE3i0x|1i(kcPk73u}WR}^K;=W zo-9wTt@QiWevF?lgE8UzdmW7J!FS+ZA*7I{rdACU2S}tM<-73T{Q?O~6Xms8i^gY^ zF1HDVSn}Vja%3^rpfSVF{`vWHB;!j-lx~`m9#2G$|8h06|6D691dW|^c4|1?32cCU z?A<(hw^sFIGMbbpgu>7&6BWAPvAW4dm@%*{TBM6Dq1!j4(g(X@D@lfcf0`I6plku9 zI_cL?+OyLQy~%4gX)>GWCR-8qGX6mf%AikTNd)M;2{v|q1I)lKlz9mg-lX=!R21i1 zYeqgd7VgS&`QxeLD?Pb@ynsp1o~0uU4VEfR`v+C}QRw>deZ<{7g+mh9Rdx&iqf+k8 zQq&QuDGDd$mKOZAQE&|~zQ{*|;p_4J1oTv;;y%+3OuSu8#DN884K3^3fiKTZ!c@De zNW`rw5oMC?DuP_`@v^^6*4QMEy-D^uPkt}|MpZR=mw*?$sd{K|+R8rUTS=s`?#}bA zQljz~gkW6#cU-p{qdF!NdsQAs<+T(I#C_V~N$;(tJcT1?=;jhr4zO51Aq=>r5A86s zsqYMnTx$a|q1-l2XnlFM$F!9Ik_QLeZ~IvI`*mxegX!zlU?itM<*|IZSHW~dHKnjB z2Z59XdI1N~=7L72qOvlhNbcgIz4Q*hdl7Am&7fabqZxC-t*OOdIFb}cAPqU%u2Bis$$#e|4-2J2Wmr1%A|vDS-s{6T62F-rwCMh|IQ zKd4tBXtCCiUA?Q@oi>ZM0_x9hC+ikPy)VW2|Kg22mXZ2dk z-Jd+{Z~W1hEmiJCi1yZozpzm6{rJp02b0U;I+S)1iEJvFw8K^hqzubfn%3-9!(ILI zs-02hM!(&qK)O}b)F@~|QkvcO;E&>fyByNqo3du&`4fe=C9$P&tJLVMzF(+*zWpvl zFF;442CVR}K%p=t$Kr>K+>iY`cr91=`GHSMk$133*>)&h&^loPxHpEvx0hWNLhf!t z|MIZ#LIUq2|1j?$CJzI?okh6j@-*jaWJ60Ddd+iT4w%m5(jCB(y9xEx>G8OYk`;+A z_hA(;J*Y5!z&w=uXJ~Jfu;)Z4=W7!y&rx90!-Koh8uLX3nQiE=94)gV*``Yy;%%b7 zrJKkGsNNGz=&5mi)FVSSa5NgWlukBzuDU_6WV%SxoC`Ty6qS^gZW`X-mW@nVwP(K5 z7Q5=CZrSRhwv6PCKL>Ez7FW|zVMF^Zx!myvMgKUp-z{at$3vp*2CZVmPN8eb<+{|3 zkg+PwQWF*N4uBn2S?H8!b`?o(CrHdN;*j}e0doVENDDQTF2GM(?!FVslYSF&g;ekR z{e{U=L}MiuGWpYpUub4kPgY{1=JGrCv5lp*n852notX0eKmM)0{XTWL&K}?mf25#& z1(2sfrC0jlr40S-Hs%pns+lolR~|kLvwQY_L`?B&i|^Gln;JhIhOAq#VZr;48JNdIJ2p%i z!hWX*1Ji;@*N}*-y-c36Rx5OVA>ojB2$ngQF>bDz*Cbdng9);#-+3z_cVCW6`+UuU zmF!eMsR{xofTc8V%`FBGAht!zRrbSEoenC7r0K~FBB|bZ@{c9VdUvnOFH()(r+zC7 zSfD@bO>gEOAJ z0SInL-=$OKfs4=9y9KNk)thM1il4_dIco}--{r=PbMo^|f_=AWBlpKxdnY-=mH<)( z-h^L$+PRS~jqm?m;o2&OqAyOU(0C<|z%gc`TJr~tLVYuN-`phGbkvW4K5kKX(w0A_ zQWR;KbFTD5E=dbM)P&VoS)M|qUy^@Dcwik*Mzfno_=BkBgM_UG(QgVSea~;-?`ccl zg#jj(mEH`nTnX}#8WtyN536Omy*YFk!1H8Y=$AB|NXPA7)a>-*3l>dX9#iOO^(%VW z@DSN2He2Ujy;c!9gZA&&SYyFE>y+4tM@`NeO{q4TAp-|`TQm-r50bala>SiwLwsIJlvF@kY4kSh6l}|s@E5c+N%&C z&QyqrXv0Tc%Y$r>DY@-YZmer5^v=?WJ}DiyZ5x}Z`C_g|U7!tOEdr`tBL)pE&K9r_El7s+DX}Xly>0P1FXcR3jnFsFH+<~ zW)Zb^NO)@o3K(h)ky|=HB56k9i#5~Dt9EKYgTq);?93EWSnZCCFOUB8qHMD;SoU2G zyj$^cx%{wUbk4t&HvMFupP^52@N?4p*nLh(S?bWb#yzGZ4s4)gKc*s&&>76}}+~ zeao?owz0B2R)4jx8?U(zQwk+Z0vB)&w=0Kwfc@zTLH1Ljwc^(ImXCS_VQfELubY&( z3&*#XLQm6yDY&SM%Y#2Rg;rcfX7GV5 z54(4cEG+{3soFHM30}Q)9UT7P@5^g-(CnKYa?Xa*^fkat#s)sjxogbmS#y!GHg%(g z{QY%?KR3~kYn2E1q@Ns>hM9^rb%m&>`@&iaf%MMUGI1bWEpXAQUqI=r^O1MbCy&E3 zI>TAk&KtFUS89?;bWr~){~-rNvvlbqd|5rm{???SoJ*Z7eP-x~1$I6fn!Oli8gRHw zo9Jm1?4)a|;nJHF`r1a%7leaE+bp{2#+X33tlpz@|Idcu2yIIo!%B2s)bSk~-mHrW zDa``Dz1n=4S*k{;2MlHyeB@q9MimV+_5IN{d4RtEFE(aYY;J~&;rP=@-t^1}SJK)h zt|IPHJ;O7?>c(SmCO%E1P%PIV2?U$%JZiIi3>X%xaNX~(kjOu%fIG0t+wW;J7rfaz%W!z2`Ui%iPmWpt<}vr6NsOFjcvu z)w#~~q=>vy2|RP_b!*~Adxka4r>~Ukl9r|4Wy6o{dTeO5{?g?KrLGD{Ypb-K*c4<= zAd+#b`0$)Mfe7PNl0*RB92D7OZrZAi5hz21le;%kI$;Nzfqcr>;~23*~*?D zYnl0e*8@pQ<$06TRx%s?5mesKG840+t>kqirOtyXWI}Fr^pGGX`i0sO=V|N91?{!} z>a|!Fg+hkKXgcKje$#ZiOP&`V&Xe96mq%ECjZT<(FPlxMM$h9UBP!YKY|-O|W==wp zv&?^MsURZgelD(e#c!Lh6R;u`KZ5b;rmhS22W#cZJVJwA!Z{#&Y_D{!oU}5x!`1)A zFJikxt?TRJw>+k=+&}N7#D?ycM2um;!_Z=36C~=(|NF7{B(YDiEM5s{8ytFJTREU~6QKT>WAVPFOWWYB#7o%n|^Vb2K#A zze<;TgNWy>Zm9f}?x@d_>FkugNQjyR^qd{W#Hl5~%|z+BbErdLaZk_#8ZnrA6PZu$ zpz4mQbWC{u765#`a3PreADh1b#XJTfOPZ;O3*0A~TQo+lZBoEl?!djhO`WGjtZ@@v zjwx%=5f;?B;k>Ay@pF3SsVNBC?@G$zlzgD0st7}D?|N}UjseVrtN>bGTosTC|x~=pG*`3w0ut2<j zJq%Cw;UyJlf8N?&@hy=URZl=p1cvDkCw#qvgmlNaWG{Q+o&v)YNqXrY;(}qpl~AMt z9^VEsx0!b+Yyb3$?)yW3Zp-AlhPq!^k#AQ9GP2cf&z_V6vKL`C*bO06>3!8T2c5O1 z<};lNz?9cvTzFvW&!oN6ia>224$e^fqgCg;wE(n_g9x7UNVfT#uu%v5{}UI*&L%H| z)#fgx%Wn><)c@^>B2HlcAd5=3EtrhTl3BVkg~48Vus+>}#FvAPTd8eZ(rl5aDdR^3V39s`X*_CFRSz6|31>)=ifQ~gu3_1_SO zA7s~$E${MhA?&eCDy9k5O20CN#x@Fl$>rokjER#UZ0^|}oSc_vf=DFzJZ3E`F)UX& zAQ^IUs~-yv;(k%r$47lJ4vtk&z2<<7F~E5qt^ih~%4M-KLBh75y7UKVP<`JF5Mhs%)kK8(6WiN#{zBOV9g~@3l8oQqjU||WCx&ez+VZO+=uPa@Ofn)!euejBfV&Fo zVxiPqq+WAtzh0|YVEznvay&wi?f6u%qXdU(cQ_m*cN#aevwN0~f_uyJ*r zHx}||+eHY*i`KAWqh8w*po(;fblph)P3R2XR+hD=8pOgpNWE=Q)m+5`@w(bbn_joe zr8L@Z>QYAxt)q9X>CKhMa!Yvg_<7gg6J(QN>;`}m@)esqldJv^V)%Yfu=WR?^T*%^ z&{p!%0o>c`dodH|ln-_^#pjC9Oad{Ta(2CKcApc**Fn9yH)Aai)(p?rSO9yJ3=LJ? zp0!rMaZ9iw7k%t-M~0;nitbA8fg^{M#6Yv=^ji`n>QY7!e57EhTZ?La_5>C3M>-*&$b2C2Hroe|_s#^x>X?EM#qyiI(d$@FB~dYxnP>6$7=AKlz{?>3h7kL*3@3O#_%Hvrz!7 zczgu$1jM{VOt~I%Ukw-+ICKXVG!VPdoev-2{X%A(wNIL)dL2(GmU}b{Ztbe2oN2>-bPM`fTBTih-LO&A(j~IxUcIPX?o6k0fZ>6rYSdm6>nk1>PBkAlvqYv9H$Q5SHY*6Z1+PRDtmEj z#g8(TIrU7AZ<8ntfVH`xp zXGfS+wGZOjdm6U6untiY*4M4-wnLP@%59Yz^|!Q=pRT2Z>`g?HlvrSWIuFHlD&|j= zQwB^TQC!~s$zAjPQL$rwSgWW>-3bg^U}TeY z&6ukkcmn|6|?F$nBxldM5&&x-iy<7RW1`3!= zU=^C9hoN|bs2vHUU2mO;IGp&3V}TKf{$VhCyKHLlqg7SQb`2fxn!1RdYMygU6)(fnmyS6*UA{|fer212r zaom@FJ-Mt?O+1hJr@|sj^`aiCOujrB$Wlh#XFYW>A}pGt0Y9F;l!nZX=U&qqW6*@fp5&4f6Slx%)9ljpJ%=`4h*`GH~kXw!+%en zlz4`8-E!O+)T%}LC^>Oz9R5-JT}$@8z`OXfu}f0jYoiiiEJ0hcbL+l8=ub;7;q6_R zkexpB?@GD0A%|RiP1Xk9j)y#xg%YhER)0Ugy$%XV4N;%9oWgDL;G=Pxe^}pj#}X6V zG;8_`oymxW`bxK}^X#L8T)iYSZ^wY%6a1-%06)`bnRawoN9eqKseq+*Xr;0KZ6)i5 zw#{1P+x?64XWM|vNdEF}jk_(Kw=6-HS8F@0)5M-(_O(#k-WSw&2O;&RS~7cY$77z+ z;}x^Gq-^E4dZhEKP6b;sqM}8c->Nm21SSN3zg*y;hE1su-I-58(%3z~1v3ZtX`F7; z73=udp@sF6Jo~?tQ_A&c@DF5|hOe#=rM|6sv1%yrQlLjwJ%^514{5~Lo?CM&o%_^; zdTP!PqIF!=+B_|FZd7uoJkBM1qKsjJ8YL2@P0BN|IdGtA_vijcyl(E2X9HY;I2oF^ zAA2_e;T#5!5{A`At%1h~pK6#o)^2O~qzPi+d#uZP9daoi-DDO{I)g6k%C zBMDuF+Zr|O`S|n?OuiAaHR^hQT(g~Dk*(C}0eQf?0A1dfSU#kQd7rXqAE;Ks3gYkD z9WRQnzI>;qqWv#;uzwoZquUy;pU9y;PwJok`6xzpZS*a^4o1TsCQQ>ibMfar$*!W3 z6qatt$cfV}X&81+b1p?&Fs+zq=Zck-4u-sXofel{bub+;W=L`NpiBR>sHN#xWtw9- z4aQz3py0i1M1uPjErp`A5d9dTDaINu3AtKsR{QSaZ9^)j9402s9nx2MPQZvQ^{l5p zmkHIm63-*lYtezy-G4{Jx8b+_#HHAvR`BqOQ-!n1vI%oZMF>(OJXR~XkZt1_x4J%l zLZAO~H~L;L%$4P%Tr#j-=r+@}WQZ4h2E2h7jd&bq-|<<#rph{T17*HTf-k(;Lzd|?=~z(l{fNt@+f>MI3S^(pq;75<#ZC6gqM$QRe&IL#0z24(~6{r<1M z-uPaHxDc%UFkO(SQxlbDl__7$sG~+9*fHQvqr5|gPE;%-jvIvZM_|Pe$Uf{SDe{K? zBkk;OjC{f34AS>VpZ|PohD~vb@JGyeh}2lgoOy39QiiT**7BYBOlSjZPK7S|7hSO78S>1Px;5*Fuv&_S>$bKfXv%enhf57u3yZHiN!Wl zveJ`P(F!#zDt7VJ%K)naY)j69k;B}p!B*A5hPwZjHX80_eV-DEGV(NgWEbpvOT<5X zm5II7`=Ann0IUckC|V5nTN7liE)ZdtR33BLcy=%!-ZO*|0KI4qKe>dTN)E3D!~GHL zkJ(=AG9#+9By(R12cA=7{tQboU$S+WVKfc+S~I5te1VU&tNjsSrzQA{a8&W{0QWt! z#2xx$XXau0@NcTUgtZI#?8VqukZgEN$T?eAe{1usb_q^|BhE%>oeL;1ziXI>_CkYD z^*d;ZKayF~CxQl#g_O)8X~w^{Tz%`se-ew$(^rhsL~xI*lxqOzTO)%#pAi{)zw}j{ zrMTZwa^UQsm5ThQN%OX~H7^8}kB{6*Lk<~)?tbGQi86Jnb#-naoND_7&p(}x&2q#;$FmBiN0FnkSXm96j50-5mCU}vfj{wguR{_Eu&<- zDR-wPfnB#1IsQE4?MQ^@T*OMA9PJQI4(J1UnLV-oxcYfg+2()N60@3EI|T ze5hGqe*4fh&-6(3_p}NGlQzhjt_6C}i}0({Z(_mKw1YiZ)G>hnH(}yY=;6O}S9Pb6 z+H=1iWB+0p8To?Go2IDWqUd%Q_F2c|?8zyUwq;9UI>&SK-+8mo zf7b^4d?@UVUq{mnV`D>OPT>hp{V@44mL>+%4G_dSxD^kSJ=Eb0CS*iO%1^(Jf4t^? zy6Nyc0$oSK4!mM=F&6zOGnP{La~ zu$0lcwY`(5@eS%^J@Nm z)+$m{RiJDF_dB;1!o`0W5yJE5oIkAh4%H%t5CPs6O_4swIyo%j#}ZEJIUoG=peU5E z`}$n*c1o#0iyw;G4E(g^qdgU^{_=P@QzA#tcdKP!TY0rsz``#D9*eiL%;BZaCRhSZ z*~Fx%aZ%&^DCQQc2ojTvDakoJSf9Du@R0}4XVo{>dXdq>l)~FPvd-NGVV27SU82>Z z)&&GOrBb)&A}g-^GO2vSNp+SURkvtA@FGUI^$f)p1W^dH%suU~xzV*i&*=QRI(PE2 zlU5%ffqcA^gpZbkje7qMD*TgxjLlnRn^wOk#R@p>?ft-Op!5r?)3_CgtFj0jBy<^$x zeqgpl`(cXtb*yUlchv)0C0rjKv0Af(@Bw?@zl~g-WN`W=mVPeKkk{S;SwcX)W81DS zN0@7jXNJPG4epDO%fRsMihLq=gdN-^S-2>=!5rC=YD=w$gT=5w%2;J99LJuGNMIk7 z#owVs{OSmmQi0g019gIvv;upxgQSTHv z#?`31L>={vR;W+4CP|pSMbpigtj0MN5KL0E*hrOpJ{2_h$o>KDGUB_f{0{RqrPj|u z%2yK9u|-#?_$hS>`WkDjfLvRS7U6!H`hkmfrRpb~i5A6NAVLQVYA!R+@_wNjsT5}u zy<0Z&-vXXLMb$*e2a?U1{{GyBbal3MkGA)lH{;!@!)RpiJ(%57rfbJNKDQZ68H%`v zycqbeG*}Mk+x^bfuqn1IDHrq{J25OB>C||MN7`Nqu;0mJ-OHPa*KYr$^`{UT+>OMj zMw_H-*X~pP{3xjp{K12%;I|a0J)4nL-uog_Uz8S5dN!Fpg=toYHS)`y_V62hi+1=T zP15lf6L$P0$K-?xUuVz_wK<(XM}86QXs}itIpFQi*$*p@99$XWc*@|jZAyk->ITs=%!qKFYHhMLwyM?UPD!3bXwq{m5Aqy z9kb~Cj(XJgO!)3x`1V}5NOJ+k?VCd(x8H}uvB{|(0Zjc+Y+N*5lrIPWW_Y}%g3ouXew0` z_d<${r>U@u6A$hxD*;}U=n$_ct;&~rY}nY=^98PhA(67^j<9NG=YEpH2LgH zFAXXd?z!7nK!y}8|F;XluMcj%@lrjTT`g*g`10*0SB~fWj_Wd38=Y@=8oM1StUq&3 zE8e~PTrVvqtU6wF+LYy%}LX2Lf}*r3Y$Q;>!5?+v%8Dz~#$5M{Dqmf*D2VQGGODut-7Qe|DD{ zJA&EuHeYTfFkKpMO6no^NTKMBFV-_?Id(Lh#H5H5`oI|p!ow|7%dh_t*?fl8H^5u$ zuZRj6&3uf;HERqkIITNH6gAeEdK-QLa9_$PxHn54W7C!zf4s#F7s69~{`u`W^Mbf< z1JyQCSJZeD)kc+OO`HPt@^eN?pnR#p^4m?Y5m230s_N)PJ5 zMehh13Bqd@`6$u_i}A|iS=2`w7KMGN2R}BI!I?=G2b5DtKcKX*PZ~}Z%w36Wy2TDe zif?HS(HS!Y*=4Cdg-6%}$vLvqX!Ye)h@NVeulGd-K4eR1=p11u+*u&{YHlGG2>znz z&u6|hSSLYw0qozkI3U4`81*qDI@iGJVSNj#q|le8HAU5%=HD1W58!K)vzw zT?{)hEtZd+x(L09EEL$-e*KKT>Ci*$`e+Gt0(B6lC9`~&?yimu5oG?e5l-Le>$`a1@DKdq+;0?*FOEm#Pm|1^>9X3V_c{$^< zA(<~+bKo>^1~KrPAY%5$0uzEPQH0*$tw2JIgZG4hvYQSbWL&koIwvSJ;U`ZQk5CHE z?8^VH=j^a*K5Xmg z)tSh`d82$etH|OeCdfLPV<59R%m0VRQhEm$hJF<)poSg8G5$G02kAxq0=HigD?QRO zRuk{ovf`p{6jsG8Sc>Ndv1+iYYQ&LtU~0^Hu%{zyxwFSs;Q}I< z@85vuCm4A$V&-CmUq+0k)LF6ob7c5YU&13X?i}|qk~4J&(AE3zR#9uz%gmF5#Vzob z-$+?0!jnmKVvNTxP-0+1!qm#Q?y&^LVu~%Zgua|}@icPr#yF(;nP85XATJzk%2x2< z({L$s2O(#_ALW&WsS~NeP)15t z#BT|j-U??@$xw=0ATcC3njfvCda|e)Ojz;DWwjvMC3M+X7~VQB3hKNlr1;@7*!INb zu)?`wqN0uZO|x_5_wu1pLf^Zc9L{7s9!zt6b|Hc)M%tV)Z}5qc93m9LB|y-Z;rA+> zV@|8JmMN5S>TR+YV#hHI<7Fr*e{MbFyCq9+dD(KC9driK$G4-U<$M5 zpAYPT_A=OK)Se--kY<>fMpnA@PQV#b`l4S$klA4Rx^CJk+Mw(NV|vlGu3!pJ75*sE zsW$#Bu~^EPd=WhT7s6k7P}HP_`5!VFf^@-p>l|)|V*t^bh!~Nt?h{EnBLBcy6c!1B zGITTUrBcCX5oysu^8_T}W55QjP3VMX*&z;w4V|c2h2L{$29%i)egT0@ScuSnG^)`1 zF8)7*i^BLJa$fO#jf7!$JjijFY9kha(*&p~}X| z#&%dq;T{iwgpL0O7fXusYCa8Z`8LlU7HwV1WqiAri2tiBOO_h>wiE!5<9qZLXr#ff zS7}}%?=~`z8^-M$f7vah4ZE9u{efWeW^g9C8MwA7+!*|ZO5~7SVW{chU)jI)exSS` zlj_}SQbZc%xg-i_9R-Oj2dwTeJgzMTvs`L2_P+~;uiMIcEV|pH<9|qIMmk& zh6DEhi9e5-(Op9QynyZ3dKNdl#hhOwL#U{tk?`G=B$9EAyU6j=_{wTazV$h%jdkZ( ztO1gc0;k}!+;`2trw@3y8WChGK=J^-kc94X(ULRqg(|RaPOKrt>~Wz$*_=D zOGI?~p_3UWG;3H+Pbyd2i*|S_zC?9TCvXxAi=mmkNlJ0>Js~%3gjWhhI;MCMz@3jB z*#*6kXcK+g2zN;4Em|8tR1aI3kvFN4ERo8+gK53`rBx33g26kL z#1POpC~P&%{DjOY=m_d~Hk*mx6zP${^Y~&o^K}ZpNWe9M9T;eA;SyarI` zgD9W-A3sdt{sHZx%_IM~=NdnJ!E7PrDRS)jU6Pm1gf_5AI%?Po2fbFQe`9vUxFdp2 z)3GR;uFdr$Uhujqu<&{Flj@CU2Z0v*!g>5e=N$@%f{(u^e!g75s?8 zmM3H8<7alo?mI^jUWoxqg?D%)JpPTtLcNAQG% zvHaFHPVR{(Eg6_lPPvC(h2-px(RhnGDx3m*W5Fne+t?Et3a>2kLEF?}lg5fVI((Un zFl2~qVTZk?4Cxh(`OLv)soK9wC#bz>KvSZF`g+(kKllWSQb&gjSBs)&!c6tZdOij+ z)f^{+Bs|@Z&=o^W$J6bPgvh;Thlz17nVfk#?T%0Vaop7Adpu_L7i;04QV-xi(qN~u z?IiuzeRP*XKH9P!q3Dt|FB{|m1R_vbRU`AcgTEIP^EiDO`nNQ!K%vDmQ0qq-Rnp3& z5f||=CCt8g34p>7`q}T&2)~^>M?@2uqgvsRbWx}kzrckH3rpZ zjCnt!S}VfOE zsK0<0{!o0D`OX>W7Y_+Wys4>lQ(67M5yBtK64tXWdtY*8TAcS(9VC^TN z>H2{qPOJJW;XNx#J>CUeDm+6k6X8B5U zKv^ToT>A>zw&Osfn4R0o_gBTHKXTQ_)Z8N zq$+&{PzXEp8t`F;i2IScshRUUv%JpWxf?>w-2}SZeEbROOWBLT(puk?#L)u67jWsq z^G@1l1GVXsgFjT9=wgFD&+`J5DhASDmo`#rV_t?hctqma6*)Q zhI23^S6Pn1#e4GurUB6ta!JGQv@U1Kso^St=B`>uC)wa3=qmo5?pzm>_B8YkOlSj% zvzKuqCIlv}{N#HT2Xm^gumcbbU|ARu3Dzo$eaY4W5$%Tjp9yVEHYU{SEXA7n_xL=1 zh1vW!B2+=sv!LWo`AEO!loYf++XcTYySozeP$F8>QMU#1S~ybydUV?F z^MB@+sTA%trhVT(+SdM1URutp3Fg+Osb-(HYVAi5FS>}hx$k-{Sn_Av0;Qjwi6e-` z`o-LS@@wq7lXkZiv#OYrzz@;@AeUbis9o7_vkq#rrXtMYXDm!*u;Qx}tHO~Tk!$H( z*r3$_U0#Wt9(xNSBKUuDnmLi(imf$l;B(^sGxx*G;-u&W!Q-{WGxHYc8EcY`53-Gj zBy*kh+kqmMYL&6>&`jVZV-C#P&%XH3L^Scgmd=8qs^{y%7N|%HDBX=ncX#(C1VkF7 zQ_=$I?vn2AkXE`&kWkP|N_wRvl>g@UzV{Q%J!j6IJu_=P>y3$MMx)+mf`Zw2&zd(G zp+3HZ_`MjgCnUJ#MCxy<^UQ2?nl`kv>jiF6M3x;JZQZ-cV~e3@4KD-jRWKH(ap*7J zgu9*4kNsH8Qd{hIOjEq_PDQaaa_wCSY!0MS9&X$eB<@|M8!@$H_gNtOXw=>(rTwXy zT=lG>nKhi#E1tI#Daj!p_&)7n8THl$qXn@m21G@_zq3pqGe1_|4F!WPH$9 zAmY@^bkIlcUGU$2QuEY|>*(UigG-LQP;9b~SB2-fM-^i|tv!#vMyi4-8jN8*3{R)C znR&}T?VjFd&yPImHlWk)V6DyrKt;5QEih7g-;1;^q2J|k84*lyC@9LQ(#46kD>X$& z7Jido7QSk0fwS_Ksfw-8Z2(mRk5XV3hzHF9rzL78*<`?a}pVkQmC7Mm&xJw zF0sOM)w;TDTi}8>q${=l<`c8(X(A`WW- zVBmobXBOdmQ)^oltN3QYGXcLsXjd9`m(+B#W z-F`mKEmTO1BIA~p_Q&Xw0%tCeE0MH_sC^W2Cg3RtHIzpnRN17@5mJz(TBx zD5kRNvsVCx(wAag;m$C&5E%!<4TJGu;@eQQz6jMJgZMda)I*qzvdR~qZG1<^SkK=`1MUdIT-xp6g?n`MqRD<qNx|c=SzY8bQGjfs3DVX3}X@TgLF z`PGj$2bjJnBlm@9x_|Ex2la+aBVsTrZ3!4v(WeoUt?t#;W-FP`1Rk8z-NLTWA_YAe zvvC*`%K)Y3#4`}p#6EL%(4QX`YiX?d-bgnQ{&Q%2b7MsM`*+HA`YN_itSqYS^DBcv zK<4eME`p*G8PXWM4v>YqS?PuQ8xPyP>3CsNBo=}xhVy_r=yVzOcz;$^o=3&P;Xrm(8M zPvyV{x$XJmgxUJo-R?p~X|qvnkjy((O$B{4O=bjwzD351>p}qxd6|?->lt4j$!yGP zH$P|`%W#5^>c9h40GB=^?B_NQbo)~Mk+fIO@Kdf+n`p(qBk-&MDAGc9<%UWJ?)D@1 zwzysG$#`?Fc=`?7c3^(IWI1BjEiwoUZePE%^X$P>4coOlUxmx>`Xaz;aKnK2K9qOX z_rRSeVILf{K9Y7N9|<(#hN{kEKekvKtz!=+f&2XO-M6SYe5z$LQXg^;GPE^eO%}zo zIzyI*L}R9^r)rt+sEI7BY>Ge^qv#QH5!%e>?v;82gB*YNlR?E?1DM#9Ls7WF^&-M4pS^dy;{zl7 zT4VlXa4bs?l~BKxl=VdPW^~`x&WlLuBI~$G@wa7lD#ho{$9kWGvct-K?6s;~=?Hka zacW{ya1JE=>G!ijkJ^7OaymD`2=%dAqU?#v?U6eXim-MThqXG5Rb{>V7+TW&kf4d2 z!RB8QV`XrpzZ{)(C`!D`{*#w&B+GH=H9Lb6xqN-_kSU-}e>Dnj$2M8;-f;@K@T1{( zzGboMWPJRQ17BLL`U`k;)QWxV=O2F)U&7Nn;z%H-_>Ms~zsv5GOS*iF*vc$j65-Q# zIKTCzcay$hO=)xf4UF|&@lNq?+;9*mJV7TIZjoWs9@w%zp0FmuO2PJfNBowvCV~N* z^&DA7L8*8a7#n)2fB1Xy-E$h+<`-t%~3JzZ0S&f zEK0;9Ek8y5dEs_N?S;g@ZNGLV^RuXbgSF;xeIC^r%}_THT+WK2d~sFG-H3xQ=dCTc`-9EeP? zAJ$kSJ}?<@QWs4Cuih6rkEvIOGnMYX_AO3WkQ&an;3A0#=3JkvYPTtAe_EnX+RD zOx5Jiou3ye^pkC4cG7uB^{gOi)BkAV4W z_B`9Wn5N-)#v^w5ZL#W3{Qci^F~A| z`h=?y;i;7Bzti8ZQ6YA@H)kxWc!*yU>5;5hzI^;piM(x4i&1DuLGc4!Na@g?p4(fM zgrgi9?wN1;GqkO7yD+y-x7RwUzCX6|QAjgqyN9pS0ui&T+qpNzVo7oP!sqe-;#pwd zs16(i$^5ZWqn^P_uYQ{V7uPgy2cdD5nvkoht0lXw;NdruXGil4YX5{EXi;A-G4>IS^J~gq+Wzi{PI{NT@6_0_Ny;{{`fvaIc=lbNvE%+#XeVmxHP|B;_Qtnc{Q?o-<%E#j6{B`VM;6|yBrPaY_8Rum$Un|i| zm9tls6L%T>Ju(g?0a(!QW$o^Kx9M%FR2DaYz!z<>d|$Ip=!6o46GMG?MBLV$l9m?C zqP1l#!AlWwIvY<`*$_nQ{6}MElU!0w-sJ1jtIP6VDiAa{X<g0@;XmY*g zEYcvppue_KmP#YrC(Q<9*aiY#+Jo?bLqb@dckd{#7_-Ui$Oc;4Ij)%e{QFgdNsvF2 z4Tjy^8%W(__Vo2+c&;0Gj$K#qoCGL^R(1#_&$2jVs-+}r7M+y+xkzt~N+)vY?$F*L zGM7VxM|-vXRVJ*in^vvxo|>!L9Iz#j8X>>(@VGAkWBm;0_$(la56Ngl4PbL&G~B-1chjnG@xUh&s3MHFOYfC4-fOZb_WZozKccC zP`nsuB=QqUY}s&GLILzw)8jIM!|x^wE^`tM93kij5lv$gxaa>?uF8O{1Y$|-pJx0$ z9Kt0P6&Dc}<7&0Lsb>@vFjlm*R01N59Z(Po~SS+kKx}I2#?)7>^)@3Ql7+9h{VI^r&*? zm0mw)y+%kjbD{rxe{baOZ?`O$AjKaTq2AZqX*)k8^a7#EaF$J%xUa}jRkG&MRZCdw zuT%9jht!UwG^D~0x+GdS=!NP||K8r?Fzq0dh>M@x5g+$pmp9hwh50+nd0}X#aG$)| z_6s^^d!Aj)Y*3kL>$`CNd0b2AB$L(SnBJTed+G2R5jg9L+LLe1U|j;h=6>e)WgJ_)^4onn!(O}!RBq)9U_z#j zjjR(6^Z@^O8GSfPtYr8Rh0KikB%9NlAYVauD6ZEq?uq1=-}KgtUiAvV8rG%6H^k;)yQ2mh}R+mEK?)> zeLt82YHQ-Y7l*t;-p7=e^uisocGnX_J0WBN!2FHadWOep(71#Naf9asjwBX?$~@%g zecKzKqNqClo=o?aQwk)E-mC{-zWnQD9j zmR@re(E($59S4$f+yrB5et}k$y=LsP;o7|H2nXIDFQy;C5PSvrI5?TMUHKf!u5Hpo zJrhDOObA7!+$O>U$uf04`2&6~WV-B|khL9L;V z$*nnhRyeLU9{epeUR|nJIH6kc=7O~N7(t~~e(h=zM@kfiSk>-lm>+#$y9*N_Lvb;> z@!ivUY%ba;ZXPxpgh(hpFW0YYGhT)y3C5I;E?w6#Rook~zZ|N&AF9`@cc3~JC#$0F zpZr;_G}w?2l9TXd7n)U26eQJ@)KJ|CQP&=XixW7Fj71tF=o{5k)kw}579bsRQO*`X zg4$m+^5jXO_5$W2*M}=FAcA!^Rp{-A7$M^rBGI!a5qhzUsj}MHo;}oh$)cu4xyjY2 zT|X-IHF@MoiO=$B(K?3t7&vc1^9y{iOew~Pu2zR6JbcrOMEBZLx=nzD2!{yExaZdV za+pj)^R20)42h0rQo;~i$eW54A8$b*Q^7mq!32>BEzg)2$r73tq}#%13tNkrnJYq+ zYSN_TkWJ_t-bT!?lcqG6OC*j=w~{7prlO0_7p%!-Rchq^%EOrRR?__t-hmoF>d-_{ z<+OvGCrx8IopF?;eX7=s=&~N`OD^!P(a+_b)-dKBSfg}j;=kqlZ~Yvr3sAufUG(5x z4AyfMETXSeUJ_`}G?18~Mni+*h}LVAll8ei^7DEFeQ>goVDjDz4lC9)nirmQtu+fs z&wzQ1y4lDG+qql)`)$<6;blHxkt^V~E!yktQjsGrN}~Y*(gM@#)Y+dN?Pl895#$<@ zzKSOr+5izPUUa2rI%c{s^tad)LvghZrLSU)BF4j*_^nKqZd6E4iy(-#z4y~LC7{5- ziGq-;#=9g3)*S=9JMsuE8~Nn{ryJ&-0TL0F&Dvj6=joleRK+t={r!>T&;j}*|9bhl ze>9oJW)gx6gFwqKaE+s0c=4069c^lY{=L_#X*w$pf=X}mUC_|g;Yi(@{ldSHT0`EK zfwV*aN=Vz$BFE-ti^6bE$b2*orcqKn@1K1Lod`ivw$#VErpA7&_D4oaMZE^?mHVco zLqdL&n?%KosxaAp7MvREo~+3yEJM!1!=tF(>YUu1COH=Jm4-L8RIhNqdA-mGhGf2P zN$CB$qQyI-62j*w|Jl|JBG0OU>1a-^$fm`5TDH=)T=%fA>bKS?pb@*lFC&-_Fv zguH|$1XkzG0mXFl^q`>`2A@m}v|dJls$zsizm@&bUU7J6b@V2;u2e6{=o}=MIe;kU z?pLgGyZa29P17d5m3<(!{bA(!5v-h=sk!Ef`wGFE&EMg|bfKfmEh)DdOf=?Akl_tq&~HDK%-QhZx7ahGCe zA#EX_CUI^$>*qHnop<1LFHLhr;mYEn-S530h%fs&h*i!-Hm9BR3quK!9A_rWgwyrF z&dN@vI>|p0FX-qTAL@NyReM0bP~FfMX}!@`cNEPKE<`aDC6lxq*Vy9`1>d6$_gghq zZ4E!6|7L)7wo6*UOOh{GO_86I+^zcc#C_hszCa8;vpI%S1Ft(|C!PP!s`M_;ARLt| zIP`<)pg3GP+K^UGl6+2jnl+unodVKZP-x-cFM{vT{%%}OU?bRQks%Hr%zT|#$e25? zQRD75ThMZcAzN+=0*R!pN>4<|CSDgiuXziLJHa9z+_|iVL1kQ|Xpl>hG3+di+ki)S zedaA@7k3m6PM^IfG=iE-HDD~ae2ScnB?&Zj-#Xd9mKX{T`|8esse|s2VHD;^n|zwq zIT9!h5C{wLnIg3BFChZ9Q}nX4@&}(->~=K6-!p+rnFnqIb0N0t8Jr{;B~FNR9U(8) zLf-FcM*yW>M&FR+txY%Aeu&dAUSq#n zt}M%Y1Sjyr^JV%d*{l1ww?xCFTR)U)IwXEu__msOpv(8y+9ECzh-4&_z1 z^Ep^c%PCoI3#9%~S+7ZvKJ6ZJ zPq}uC-4oa#+Uz8sxLaLWfkBDH?vn)v6fy{TbJ6svL=^2deLAtQ%-i_~aVNu}G|QxkfI^=NM^9@_>|POy zA8f(QLqyxj3CWSV8s3L&T=#!31thuFOcO?+iLAkhp1cpQc7_)0T1n+*L)6_KYFqtSWIjzJ*{q=*on8z z+#Iev%b$~~#~ghNvBhpP{M-K%2|*`1WRtd51uG=$<+e;WTlB0f<1)0Z`g1giH0U%q zy1>T?0;pSGOFACe0FyL$ZZzDykxSvBKY(0CMg;+}cKl<5}_- zjMjMk?WG-h75G9WPfvfBXogfpR61?p_^!+8#CAmGy*35_Rs%qi^oHw~)3tIG4Xq+B z#?B_~Ow@4PfUd>kS|Z}eoglfM-pK18n9#uo2c~-VDWQVIZh*6MSBUXE$5cWSJZZz} zRiC=g`luC^`|DBXVOsW~0U*=~6pZ#WY;=gN#cWgG3`t>x$>Lmnkx3LwtTb5h3og6P zow<1~#clbl!mXOn+l<&LJCZ!wCwGF7OG@3NlEc}$SIv34)+Bl)rH1{}VIkbV!2SXD zrPqR*JrQDImn&(i^|WNfJe zeTIOM_hm@aDfEnf*zwUQj2;cGm*(oGjbIqd{=j}lVSLIeo#ANb2G>FUlM20JcYO3| z;V<#T5$ksoO-&GsOGPZt$&^R7U%&tCvaS>G>qm(^Lpk?iU#_sU zPx^=tEmLAKWN7h6ed>B8gOZ>&z0AUMW49+DAW;6VT4;>m9HMLQR~P1bi_}@fB+tAQ ztzG+5=L2$A-?79!A*1T0Xfn+^lIAOtHpBGF)J2hAit|r-)kgYACY0`1FsZ2$pU2#i ztd04x$WPm>z(Yqa*cdGMVZ+W7&;7?(^$oh(<=xVFkdDbV{i4!b>^-XBZOE%fo9 zj0PKgMN?N_5n3?)5f2Me>vTXbiU-pn$6m zxD03&NpD&JVpxG@#iB>~o}dg-Tu6wrRXU$C4J$EWgA5vd?r0w+yO}pc6RlXHhP+(b z#O`0Gj-^sax{B%vICv$jv+B}7b7;CNYm9$igK0~Rl_X&%0#P5q@5vfFz_L4X@2=RL z0nf5>YjK08`Ptd}npfSVznPi|;?~E{8|pzHZDu!BFd8H)Cz_5+SqxT*=>tZF2BJt~ z+2Hsc?Q03rh}pB%sBz!#=bm|>I0gOJ9-ARhEjAjV{tF9BgRn3f)+edGEXp*G+e4Pp z0!Pp@qG`Byh3`@S8~9Gi{jXoi7&lf1foE!T(U)b<2N?46x8AgE3t+8xOdb-cOt`&N z)(7!cS#+K~>&KRf*g6f7V72H^^eO0jvnrLVO25o#{>m*L22Bi?HyF^W-DVZgS9xmI z^@=A|%mW)y!OOxEGa`gSQk`luw`uu6yg6|D^-Z#vw$M^$w8Dk zYW+^xqip!4u*3dOQWACARXl|Dna8I)UrrwVkvzj;fO!k`=?EFobi+xBfv=9kOG>%_ zj|a4&roea}e#hp>>YKe|kvO{jlApplies to: Windows 10 + +Today, many enterprise customers have a mix of modern and legacy client and server operating systems. Managing the servicing and updating differences between those legacy operating systems and Windows 10 versions adds a level of complexity that is not well understood. This can be confusing. With the end of support for legacy [Windows 7 SP1](https://support.microsoft.com/help/4057281/windows-7-support-will-end-on-january-14-2020) and Windows Server 2008 R2 variants on January 14, 2020, System Administrators have a critical need critical to understand how best to leverage a modern workplace to support system updates. + +The following provides an initial overview of how updating client and server differs between the Windows 10-era operating systems (such as Windows 10 version 1709, Windows Server 2016) and legacy operating systems (such as Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2). + +>[!NOTE] +> A note on naming convention in this article: For brevity, "Windows 10" refers to all operating systems across client, server and IoT released since July 2015, while "legacy" refers to all operating systems prior to that period for client and server, including Windows 7, Window 8.1, Windows Server 2008 R2, Windows Server 2012 R2, etc. + +## Infinite fragmentation +Prior to Windows 10, all updates to operating system (OS) components were published individually. On "Update Tuesday," customers would pick and choose individual updates they wanted to apply. Most chose to update security fixes, while far fewer selected non-security fixes, updated drivers, or installed .NET Framework updates. + +As a result, each environment with the global Windows ecosystem that had only a subset of security and non-security fixes installed had a different set of binaries and behaviors than those that consistently installed every available update as tested by Microsoft. + +This resulted in a fragmented ecosystem that created diverse challenges in predictively testing interoperability, resulting in high update failure rates - which were subsequently mitigated by customers removing individual updates that were causing issues. Each customer that selectively removed individual updates amplified this fragmentation by creating more diverse environment permutations across the ecosystem. As an IT Administrator once quipped, "If you’ve seen one Windows 7 PC, you have seen one Windows 7 PC," suggesting no consistency or predictability across more than 250M commercial devices at the time. + +## Windows 10 – Next generation +Windows 10 provided an opportunity to end the era of infinite fragmentation. With Windows 10 and the Windows as a service model, updates came rolled together in the "latest cumulative update" (LCU) packages for both client and server. Every new update published includes all changes from previous updates, as well as new fixes. Since Windows client and server share the same code base, these LCUs This helps simplify servicing. Devices with the original Release to Market (RTM) version of a feature release installed could get up to date by installing the most recent LCU. + +Windows publishes the new LCU packages for each Windows 10 version (1607, 1709, etc.) on the second Tuesday of each month. This package is classified as a required security update and contains contents from the previous LCU as well as new security, non-security and Internet Explorer 11 (IE11) fixes. The security classification, by definition, requires a reboot of the device to complete installation of the update. + +![Servicing cadence](images/servicing-cadence.png) + +Another benefit of the LCU model is fewer steps. Devices that have the original Release to Market (RTM) version of a release can install the most recent LCU to get up to date in one step, rather than having to install multiple updates with reboots after each. + +This cumulative update model for Windows 10 has helped provide the Windows ecosystem with consistent update experiences that can be predicted by baseline testing before release. Even with highly complex updates with hundreds of fixes, the number of incidents with monthly security updates for Windows 10 have fallen month over month since the initial release of Windows 10. + +### Points to consider + +- Windows 10 does not have the concept of a Security-Only or Monthly Rollup for updates. All updates are an LCU package, which includes the last release plus anything new. +- Windows 10 no longer has the concept of a "hotfix" since all individual updates must be rolled into the cumulative packages. (Note: Any private fix is offered for customer validation only, and then rolled into an LCU.) +- [Updates for the .NET Framework](https://blogs.msdn.microsoft.com/dotnet/2016/10/11/net-framework-monthly-rollups-explained/) are NOT included in the Windows 10 LCU. They are separate packages with different behaviors depending on the version of .NET Framework being updated, and on which OS. As of October 2018, .NET Framework updates for Windows 10 will be separate and have their own cumulative update model. +- For Windows 10, available update types vary by publishing channel: + - For customers using Windows Server Update Services (WSUS) and for the Update Catalog, several different updates types for Windows 10 are rolled together for the core OS in a single LCU package, with exception of Servicing Stack Updates. + - Servicing Stack Updates (SSU) are available for download from the Update Catalog and can be imported through WSUS, but will not be automatically synced. (See this [example](https://support.microsoft.com/help/4132650/servicing-stack-update-for-windows-10-version-1709-may-21-2018) for Windows 10, version 1709). For more information on Servicing Stack Updates, please see this [blog](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-7-servicing-stack-updates-managing-change-and/ba-p/260434). + - For customers connecting to Windows Update, the new cloud update architecture uses a database of updates which break out all the different update types, including Servicing Stack Updates (SSU) and Dynamic Updates (DU). The update scanning in the Windows 10 servicing stack on the client automatically takes only the updates that are needed by the device to be completely up to date. +- Windows 7 and other legacy operating systems have cumulative updates that operate differently than in Windows 10 (see next section). + +## Windows 7 and legacy OS versions +While Windows 10 updates could have been controlled as cumulative from "Day 1," the legacy OS ecosystem for both client and server was highly fragmented. Recognizing the challenges of update quality in aa fragmented environment, we moved Windows 7 to a cumulative update model in October 2016. + +Customers saw the LCU model used for Windows 10 as having packages that were too large and represented too much of a change for legacy operating systems, so a different model was implemented. Windows instead offered two cumulative package types for all legacy operating systems: Monthly Rollups and Security-only updates. + +The Monthly Rollup includes new non-security, security updates, Internet Explorer (IE) updates, and all updates from the previous month, similar to the Windows 10 model. The Security-only package includes new security updates and all security updates from the previous month. Additionally, a cumulative package is offered for IE, which can be tested and installed separately, reducing the total update package size. The IE cumulative update includes both security and non-security fixes following the same model as Windows 10. + +Moving to the cumulative model for legacy OS versions continues to improve predictability of update quality. The Windows legacy environments have fully updated machines, which means that the baseline against which all legacy OS version updates are tested include all of the updates (security and non-security) prior to and after October 2016. Many customer environments do not have all updates prior to this change installed, which leaves some continued fragmentation in the ecosystem. This remaining fragmentation results in issues like those seen when the September 2016 Servicing Stack Update (SSU) was needed for smooth installation of the August 2018 security update. These environments did not have the SSU applied previously. + +### Points to consider +- Windows 7 and Windows 8 legacy operating system updates [moved from individual to cumulative in October 2016](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/More-on-Windows-7-and-Windows-8-1-servicing-changes/ba-p/166783). Devices with updates missing prior to that point are still missing those updates, as they were not included in the subsequent cumulative packages. +- "Hotfixes" are no longer published for legacy OS versions. All updates are rolled into the appropriate package depending on their classification as either non-security, security, or Internet Explorer updates. (Note: any private fix is offered for customer validation only. Once validated they are then rolled into a Monthly Rollup or IE cumulative update, as appropriate.) +- Both Monthly Rollups and Security-only updates released on Update Tuesday for legacy OS versions are identified as "security, critical" updates, because both have the full set of security updates in them. The Monthly Rollup has additional non-security updates that are not included in the Security Only update. The "security" classification requires the device be rebooted so the update can be fully installed. +- Despite the cumulative nature of both Monthly Rollups and Security-only updates, switching between these update types is not advised. Small differences in the baselines of these packages may result in installation errors and conflicts. Choosing one and staying on that update type – Monthly Rollup or Security-only – is recommended. +- In [February 2017](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Simplified-servicing-for-Windows-7-and-Windows-8-1-the-latest/ba-p/166798), Windows pulled IE updates out of the legacy OS versions Security-only updates, while leaving them in the Monthly Rollup updates. This was done specifically to reduce package size based on customer feedback. +- The IE cumulative update includes both security and non-security updates and is also needed for to help secure the entire environment. This update can be installed separately or as part of the Monthly Rollup. +- [Updates for the .NET Framework](https://blogs.msdn.microsoft.com/dotnet/2016/10/11/net-framework-monthly-rollups-explained/) are NOT included in legacy Monthly Rollup or Security Only packages. They are separate packages with different behaviors depending on the version of the .NET Framework, and which legacy OS, being updated. +- For [Windows Server 2008 SP2](https://cloudblogs.microsoft.com/windowsserver/2018/06/12/windows-server-2008-sp2-servicing-changes/), cumulative updates began in October 2018, and follow the same model as Windows 7. Updates for IE9 are included in those packages, as the last supported version of Internet Explorer for that Legacy OS version. + +## Public preview releases +Lastly, the cumulative update model directly impacts the public Preview releases offered in the 3rd and/or 4th weeks of the month. Update Tuesday, also referred to as the "B" week release occurs on the second Tuesday of the month. It is always a required security update across all operating systems. In addition to this monthly release, Windows also releases non-security update "previews" targeting the 3rd (C) and the 4th (D) weeks of the month. These preview releases include that month’s B-release plus a set of non-security updates for testing and validation as a cumulative package. We recommend IT Administrators uses the C/D previews to test the update in their environments. Any issues identified with the updates in the C/D releases are identified and then fixed or removed, prior to being rolled up in to the next month’s B release package together with new security updates. + +### Examples +Windows 10 version 1709: + +- (9B) September 11, 2018 Update Tuesday / B release - includes security, non-security and IE update. This update is categorized as "Required, Security" it requires a system reboot. +- (9C) September 26, 2018 Preview C release - includes everything from 9B PLUS some non-security updates for testing/validation. This update is qualified as not required, non-security. No system reboot is required. +- (10B) October 9, 2018 Update Tuesday / B release includes all fixes included in 9B, all fixes in 9C and introduces new security fixes and IE updates. This update is qualified as "Required, Security" and requires a system reboot. + +All of these updates are cumulative and build on each other for Windows 10. This is in contrast to legacy OS versions, where the 9C release becomes part of the "Monthly Rollup," but not the "Security Only" update. In other words, a Window 7 SP1 9C update is part of the cumulative "Monthly Rollup" but not included in the "Security Only" update because the fixes are qualified as "non-security". This is an important variation to note on the two models. + +![Servicing preview releases](images/servicing-previews.png) + +### Previews vs. on-demand releases +In 2018, we experienced incidents that required urgent remediation that didn’t map to the monthly update release cadence. These incidents were situations that required an immediate fix to an Update Tuesday release. While Windows engineering worked aggressively to respond within a week of the B-release, these "on-demand" releases created confusion with the C Preview releases. + +#### Points to consider: +- When Windows identifies an issue with a Update Tuesday release, engineering teams work to remediate or fix the issue as quickly as possible. The outcome is often a new update which may be released at any time, including during the 3rd or 4th week of the month. Such updates are independent of the regularly scheduled "C" and "D" update previews. These updates are created on-demand to remediate a customer impacting issue. In most cases they are qualified as a "non-security" update, and do not require a system reboot. +- Rarely do incidents with Update Tuesday releases impact more than .1% of the total population. With the new Windows Update (WU) architecture, updates can be targeted to affected devices. This targeting is not available through the Update Catalog or WSUS channels, however. +- On-demand releases address a specific issue with an Update Tuesday release and are often qualified as "non-security" for one of two reasons. First, the fix may not be an additional security fix, but a non-security change to the update. Second, the "non-security" designation allows individuals or companies to choose when and how to reboot the devices, rather than forcing a system reboot on all Windows devices receiving the update globally. This trade-off is rarely a difficult choice as it has the potential to impact customer experience across client and server, across consumer and commercial customers for more than one billion devices. +- Because the cumulative model is used across Window 10 and legacy Windows OS versions, despite variations between these OS versions, an out of band release will include all of the changes from the Update Tuesday release plus the fix that addresses the issue. And since Windows no longer releases hotfixes, everything is cumulative in some way. + +In closing, I hope this overview of the update model across current and legacy Windows OS versions highlights the benefits of the Windows 10 cumulative update model to help defragment the Windows ecosystem environments, simplify servicing and help make systems more secure. + + +## Resources +- [Simplifying updates for Windows 7 and 8.1](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Simplifying-updates-for-Windows-7-and-8-1/ba-p/166530) +- [Further simplifying servicing models for Windows 7 and Windows 8.1](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Further-simplifying-servicing-models-for-Windows-7-and-Windows-8/ba-p/166772) +- [More on Windows 7 and Windows 8.1 servicing changes](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/More-on-Windows-7-and-Windows-8-1-servicing-changes/ba-p/166783) +- [.NET Framework Monthly Rollups Explained](https://blogs.msdn.microsoft.com/dotnet/2016/10/11/net-framework-monthly-rollups-explained/) +- [Simplified servicing for Windows 7 and Windows 8.1: the latest improvements](https://techcommunity.microsoft.com/t5/Windows-Blog-Archive/Simplified-servicing-for-Windows-7-and-Windows-8-1-the-latest/ba-p/166798) +- [Windows Server 2008 SP2 servicing changes](https://cloudblogs.microsoft.com/windowsserver/2018/06/12/windows-server-2008-sp2-servicing-changes/) +- [Windows 10 update servicing cadence](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-update-servicing-cadence/ba-p/222376) +- [Windows 7 servicing stack updates: managing change and appreciating cumulative updates](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-7-servicing-stack-updates-managing-change-and/ba-p/260434) \ No newline at end of file From a4da9500d3579f1c072114d3c75bb980dcfb0166 Mon Sep 17 00:00:00 2001 From: Liza Poggemeyer Date: Sat, 10 Nov 2018 00:22:25 +0000 Subject: [PATCH 7/7] Updated waas-servicing-differences.md - removed statement --- windows/deployment/update/waas-servicing-differences.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-servicing-differences.md b/windows/deployment/update/waas-servicing-differences.md index d4f38b30a4..91ff222523 100644 --- a/windows/deployment/update/waas-servicing-differences.md +++ b/windows/deployment/update/waas-servicing-differences.md @@ -88,7 +88,7 @@ In 2018, we experienced incidents that required urgent remediation that didn’t #### Points to consider: - When Windows identifies an issue with a Update Tuesday release, engineering teams work to remediate or fix the issue as quickly as possible. The outcome is often a new update which may be released at any time, including during the 3rd or 4th week of the month. Such updates are independent of the regularly scheduled "C" and "D" update previews. These updates are created on-demand to remediate a customer impacting issue. In most cases they are qualified as a "non-security" update, and do not require a system reboot. -- Rarely do incidents with Update Tuesday releases impact more than .1% of the total population. With the new Windows Update (WU) architecture, updates can be targeted to affected devices. This targeting is not available through the Update Catalog or WSUS channels, however. +- With the new Windows Update (WU) architecture, updates can be targeted to affected devices. This targeting is not available through the Update Catalog or WSUS channels, however. - On-demand releases address a specific issue with an Update Tuesday release and are often qualified as "non-security" for one of two reasons. First, the fix may not be an additional security fix, but a non-security change to the update. Second, the "non-security" designation allows individuals or companies to choose when and how to reboot the devices, rather than forcing a system reboot on all Windows devices receiving the update globally. This trade-off is rarely a difficult choice as it has the potential to impact customer experience across client and server, across consumer and commercial customers for more than one billion devices. - Because the cumulative model is used across Window 10 and legacy Windows OS versions, despite variations between these OS versions, an out of band release will include all of the changes from the Update Tuesday release plus the fix that addresses the issue. And since Windows no longer releases hotfixes, everything is cumulative in some way.