From 27472730d85023f8b2ed54150ecb183f97d9509b Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Wed, 4 Mar 2020 11:23:19 -0800 Subject: [PATCH 01/30] intial input, Markdown --- .../windows-sandbox/images/1-dynamic-host.png | Bin 0 -> 33888 bytes .../images/2-dynamic-working.png | Bin 0 -> 18568 bytes .../images/3-memory-sharing.png | Bin 0 -> 20533 bytes .../images/4-integrated-kernal.png | Bin 0 -> 50049 bytes .../images/5-wddm-gpu-virtualization.png | Bin 0 -> 26778 bytes .../images/6-wddm-gpu-virtualization-2.png | Bin 0 -> 31102 bytes .../windows-sandbox-overview.md | 370 ++++++++++++++++++ 7 files changed, 370 insertions(+) create mode 100644 windows/threat-protection/windows-sandbox/images/1-dynamic-host.png create mode 100644 windows/threat-protection/windows-sandbox/images/2-dynamic-working.png create mode 100644 windows/threat-protection/windows-sandbox/images/3-memory-sharing.png create mode 100644 windows/threat-protection/windows-sandbox/images/4-integrated-kernal.png create mode 100644 windows/threat-protection/windows-sandbox/images/5-wddm-gpu-virtualization.png create mode 100644 windows/threat-protection/windows-sandbox/images/6-wddm-gpu-virtualization-2.png create mode 100644 windows/threat-protection/windows-sandbox/windows-sandbox-overview.md diff --git a/windows/threat-protection/windows-sandbox/images/1-dynamic-host.png b/windows/threat-protection/windows-sandbox/images/1-dynamic-host.png new file mode 100644 index 0000000000000000000000000000000000000000..ef004facabbf421b931df442f6320777437c7cc8 GIT binary patch literal 33888 zcmeFZXJ3;~yETlWpmYVLN>r3$p|?Y z5~M>ABr&uAp(O!wpZLG7y`R0W`vcrBo)^OJ)MRGPV~&|wYaMHheW<6!%)rAyLqo%? zeNW>N4Gk@hhUUbLGjzb;_;OyM0>4f`A8D!4l%e?Wz{4pARb5pYnhF@>f%R$N`Rt2( z#!woXOVP)FPQaEnpVQEU?`UhNKK8R%%RCLg^pg~I^PVZg?F+&Wb2vo2O@v26opR`I z7jXD8bn=?LRlHtj`t=l}s@hBpyRX{UGoHS3NU9QMmLREE-#BSkSszG14ifg(C(@+8 z`J&)^6G2@OY-(q&9RDzQY=?^c*F(%z0jTJ||Am7)4f^*Jz>nOX9ysH_AMR>m&HnlB zl?Y);N!-60x}uSo2WqOUDxL%$_AU9tM?wi}SN7#o1e=#cGEfyC0@7`2XiG2w9NfVgg*j&am zCQ5I`y}fWx*ohf2+|KXn8()pzdvA$Z*0)3To%?qVY8byO2ZtV93oORaj)mILuSgUY z?C=rowZDu{$gQE|L@UOEEw@(;2mJl7{yT?-8Aq^9q_Ak$`QNCqKr@#>%A)M`;_Z6O z&#gykL`kjxe%l`S+eiPE)dm-P;2wN7Repu=2LbgBZa>daxERykMDeM?dQ{q~NZ zuu5*v)bUH(K{;-!KBfWS2R`P5{jOgu3n!9M1(s%m5Uts8+3+jv1*A*Lgm-Dh? zw~fDbm{d7hLvg5`=VRS9U?}!kG|MH|g^pOH*&jIit7U}$TJ`wqPb146l2u#8S$<6J z-M2yYL;lGM|6X%3-?DSkiO<$Yi<4%3rrl~@{8F>*YArLV{(*~T;A; zIJf$xkGlx!L3fHoN5$G|rOmI1TgLfAwcB)!O|i2$u4TVd%(XvN z;(`k#QvQfE7}`)AwJI?pm`)PMH4>14$g!ZQDyQ9W&_QcgJg=l}jVMc;w=|eO zPF&_E7nz7s9Ats)Tb1u*$$4b);(Rf|;{iL%&)cI}2gm#MGZlXB&INk#id%)17x_Ta zGi_1DcorzqbyAX7!X{#efWc_O_}5l)yA=Du)obv;#jg0ZMVQL&3WL;Kg{_tx#S;}F z#sT{9*&yZLJLHGc%(HNi?~Lc}pFG&quolRT6|$dQ9-gG9(3=%PcA|8v99io_NcrWB zzu!Mt%?@YT@|RyJsa%bdLVdMvkD8QgA?Z#BtdzQqoBQtYtmLRiPhE-TTd4l6NNB1w z_g_jzvSNc^%DZ3L_2j?T8uSH|@kNxHL;RZ!T?E`(aIb| zNQpkg*zL>H^7r}g4L+>D-ylkg$av0e9$c8RV7TvakHJmsbaFs1l1**Yh^GPE{Xu1K z2D;nEC{`Cs=Uk0%k00)giw3v+isD_Ju!ZgT*Ui6XT(zW z&@f}L;^M7m^VRzua)G<9ErsSjlbv*|{Hwo&V5I+vB*Un(*N8I!~6+!xhWf zJBAssUI@^9^Vp@u(D_&N0ceUi){|Lrtttsd!^**MuwA55O(NnN!PIHY5mtAH&_WG? z!JvZ3w_?Z%7WsJ^4+YB~{-@HQ1{@2o(i&fUY?cd2jpvgS9=6i{+|6T0(B=B5zaetF zFpX2U?hULP%?=Q0H9QIHFTgCYHEOvTq41T$TnoSjjps zIa%mcdP53!+d)U-7*;rO0$5AI;^1@yyUO7Z7_vgyU0bPM-oAj4ad~>w)N9(Q6vA{xQCOZS6-=6}S(nwT~Xq!97t9007id*%EG{`Tp~CxdY3+7_>z+2Mt& z6vVZkhO?xp0-tqS>emZjK2C2f-CW(eDY{o^&D5YqEs+{js+@a6bQ%4Wm||i1a`P@?EGT(8#Uh|s&ik$YXPPu7@^EsS_eSXakzxCb#dtX~$S;W`K0E%q*6-xw z_5@%`HhaMSIX5AtMj4R9tR4;(FA0jNR{GF6HSSKi9LhIM|AFeU`)zS`4D9})*Sjg< zTql9QqvCZ#rswStCKLIm)!z!W$a99B(x0g~o>5|`K1j*Jt{M#8xviAU+Mxvv)KSm~ zDv0T?7iQSps0MAknME&qt;ppx?;s{54CsL{EGr^2nKR~Q_3DWy^po9< z?4ghy?cs>bSN_L%E7u(WDSRVc(k_pTQSO6fjL%ZyTZT4A@)xhT%FZn>=tP$~Lv%~Z zwSx)(U~?S22rxmp>?hCJch`P$8u&>IKL`5nhND}~ir4O>$+wJK1eRul#Uhc$);8RC zWnECDU6Ikf6i<%#LkIfDcxpK+$^wd#Rs{7u{OM()n&T$(#D}`-^#s69cv8vdsf#NQ zE*$SycBq0!@B95X|5646_7UvC(h=)an0Drm!bt3tGwLoLpdxQx_t!tZ{~jy``HL@{ z)&2pF7ND&NU@qIa#vNPp9~lWX*6t)jQYCxfDMH7qp$Gn;;944S;V+lT6^sD4><=%l zR*1?yi#8CO$Y{^1dD{NKQm*M`Ve@2BnkAzDFJ%1ReYO2~QeU-;951VINzZckZ4RlQ z-CVwYy|hcm)Xa4p;@jX2nj0(k*a5m+`kQ!?xJM$|*rxrzOzG3vP0>`zz}L+x))B$- zo_4vuKh*MsVBbh@?=NNwjj{e`2n>JB*8NCL5&O?KC=7apJ*;?+>f`*+Z?Qi$Vmh-o z%#NE3gNC?iWf%gyZ!1U$1D5inj32zRmNpdNMa< zz#ifzyOK6Cw(8(!Q@QBs)u?qyehjt90_+l-dw+M|H<4ZP?f$@k1VxyTu}X7j zo!&r=BY|dq8&jX)Dsz|kYv#9h9_l`x*s+ERU{zbN!)_&?P9^DW!d{*ZjL zXI~<4>z56$4R|3cMr>DCOp5s`;hbmwqIJNSvBP9NE^DRlL5k>(H&@{NB@%#*YDXkS zaHn0@nWIX0(nEk0ohr!bTWpEf&-h&UaBR}si(;jC?N4p3xRj>bh zs*cCg)JNU#RtexQVEf&&Xnx8Gntt7_@D<5*LX842hi2K(qacJni17@lEy&XQ=aUPj zULA^?0K%(MT(8S}w4eP>mA-#ZEM$`rflv;t$%LZ7yIs5<`&;E9J2wYuRb>aeycCc& z|F`w7E{E#|g*MH;XlKqE4*|{?H}W=K)~<(bkXB>hC5&IW#FsD!VFhSQ^)a$-i)5S~ z8d2hlS=<@7tleDfrby~!DNQ!`tfde39mDuJf83=|dPCdhoiS5NV1sF`J2KN`v&L`DJ@k%?7_P95$)f@z760b6KGsg(j0C<_=Gomdt2@Ba4 z@Q`T*`z(+4W^}a=h8{sZ4A{ON0=TIH0OVxJ&CwJkjm&i7c4Sx3mCoHq*8-U*m%Odj zI}I5+XlI88{LRGB%a4V1e9RS)J5S6zO_xoKpjp8oUreL6gRXp@@^zz}Ua>`?Jsn_a zPfJXB@n2UO#7fG+`XHfZ<&Ws;am@h4!;2W_2gDkdkB*t=cj<}sdK^D&@q?jW#c9Ti z`!#jgV}h|0yvU2$I3(|^IHZ_)#UA5s!f-5dyPm$fK57+N;G^RFrk_;wxmSjhp}hggK5g8h@g&liv-3y??fFx7 z&TEJ~2ImaOLa&T1kwiI+bd53T#B{hv$(LS|UHhmV!YX(GoIfsQnL+$Cfcz)0J#bt< zm;kp;0C%yd9K5j9=bs0H+90PWv9}^cYOBegPE>;)PTRPl&JOCnHJHsO!A!^qB+K;XWhto zFSoD<9{PDzW{(?F^L}K7qUY!kELc^YWjj};idLMCXSHx2$AlJVbVC-$2}c$BtK%-N zE-I+7-b**!V5F$eQ=@Rhk(oMA+feHZxq^d!5x)wy0IE-By!cu2r}0=fylC)kp%owJ z*u|O~!1BRHK46#r)QkLz#43%X3+kr-rer-Y#)H{dJPAF*9eqk;<;=T(+59I(I}~io zeyz!pi;tPe1W;SuCUShPM0!qjUs1nzx5y^=Fl=GOV-l z{hr`y25F;iKSRZ1+WVV1q{-;lcY4tFnm81zQyvd{0nm~I?utWzG&e<01N^cnk|y%} zuo-f70GyWG!zJS~)=%|3u+>*NeCe^Uv5nTJuwD<*aSFG%kw2I`ay?yB=U6aV3~*Lc zfQ}dH@_H;w1Z+E6TBP{hkE|<gb`W_H8I^r_y0;Nv)&X4Nx z55DzKw(rjLuTv&F+pfqJHzOQ!f_dHm^FrTrOLq39;mTZdqZk_VcEr5jT^HRnp@+C> zao=F%Qo)!@UJW(~I3B79!GypI53pk9_nXj&JH>dJq0v<+f?|ezi5#k6tN>=REYl@E zMRurmJ@>8Xw{rrT`(C;zfg?+4>a%2C;){WW%!f_R0c3NFpmF@mCw=^D zQuieAWuoppK0KjL#L zZNlLl^lu08y;X}5$2GN}NwQ^m4}&^$^#=S8&~+6bA^?dBQE@C20H>oId31d0^sEmB zkE&TjVS3Yu9bdZ-ZQtZD6%br<0(IiSg-z`-DQmx}d}}Q#3EubfY@4jY(#fk3X6ZL*%Zu0xhpRi0ICTysZ_aB-BVuksz&L3a>zE>=l6rMHutZkL@qBk$R zjkiJdzI*s+3s5<}J`()M!+77f=kl=tgcJ>V)~ZtXSw}AboFSp-uyvKsdc>1<<=d|? zZ@m0u7qX;}U#_{IwZMC2jPyuwp||VwIm`ZTX>73!#^&wqEg3ibp#YTgYrL)9ID060 zX5j$+RTM>g1`#jx0PY|win_vU?nmc%DYN_Ylh;1b(Q+?YS8Zc z+3leVy8#G?14z8dgbOoN5ANR6UA4tScx9+au5$R+PnLHlLn@Jkh??E0Y5i$Ym8o9j zx1FaxzeS?!R8`hqFS>5LOd~Q|qw+%82f1{AJj}s;8fu6U>jxj^(byWzR)n9aywVR| z@sDjLVKXek`BqLQBwJt)(Bto9a1pTW%l8N%S4SwsW$acUX(`1G5U-JNNVJ-hK;JnP z?7Y?fDu}+y>E~1~!B;7c<(2_`b%Ai_9FiG+b23 ztlfIJa(wr??DJBgA$+6or24#YNWRoH>5SIY4wXpInKa~tiaQ6D&)qTA zGDJMF;$*sb2aLg{WjkI_Jt{UKJs@U{$>dJq&1`>#UzIPI6S*TM5H4>{us%zHh^v2QWCzZ_Yv+xE)Wzo^&?7wMqcST$-@4e|jTjwA1-{J}Ooazx z!iR5k+#`x2;sQHrE(h!WJon2Ebu)vA7K04Cd=89r$J6l|##Dp^2Jx}eGW}1)^C%%o{%7r-k9j1@Dgj9>^z2EkWbwgnyc$`8L(VAtl~Tsv|EX&FdS4F zqx*sl3Qr|+z53vmPrGSzB5U?f*U3b^)0<6pE+}KVep%gt_JaZ#t7iyr8=Re!^8Uzc z?nECRD%kv{if4h#7|K6>(Mg+6E|8gb3JzUg<=kVsXNY&cumSm%$*wUWjvKvphc9Ji zNr9oDn2pj0R2DU6haV1rA1AX8mg$Qb)iRItHI09pMsozPmNRykqZd0XQVU@j1L%C> z4VSlHAYTmzz=!N3)jvEd|D=RT!Su{XaW%br&{UVc7| z_D1ps4JC>6R+TM=llB2S^L=}H(e5H{6*}$({({hFkwEr4$_^?(qVH%Xy}Dq-p_cBr zWlT$c4u8>hmK5^goRF^5V&&OYN}uJ?2*I{N{KO~iTonfHP2rqe>9>@3vaDu`-9^O= z;c5@BUI@SUI9WoMef&1mViHbWX|gTFbnNbq1(utP?^#xsfts>di5h*4&GwXESSm4O zSpc_JVu#}HDW&G`jvcmt^uZPYRAg^rpmy!3(tO4aZI>xNv-l7moiXT?>Gs%WpI!(5 zCm00=r4iw>b^~BMKmG#VNa^NiE_yT$ml0wv?O)W(g*WB+p<09GyCduJ(^i)J1oso*1T&%z}!ueC&wjT93G8Fx^w8!S))WQu*!>#@TT|C;?;L~WUIhM zBK+ZF9j)?rN@?&QO!!izSR#v;o59x~5^eCJjA|nFdTE^fR%97KssXVm>zIdUwl_xk zg8KT4h)cJ$_~A}|64=R$o?rC?()JgEe<;)}R!^wZ6zna{UZhApPx~6PRsuVGre%hg zpAZV1i@1{YvMyB(F4X}!N8jCJ;oHH9W4|GL7tkaxp>^qErY^fP=n9F`!IVE9aIs%C z`|`9jC^&AlTaNIokN_IMI>~wtsnU}gOg)-^wr{|4G^2Icxh*6+g2odCa)6$Z+;30*gD6gw48=fA;KYHYTRKGuyXgk6@e@sVgZu_6m|EtNPgB?n}PgYi2?? zb$Q9m6MHEJ9QB&%X+z!Ng#)YIkm0IGeX*}%RKqxW?&s_Dw0H7d_Pz)l6-na2i-!|m z>M^~M;|M3iwM#+JOzxh=s}O^E3B7`c#T1y*&mk8>B^mmk|iiT0=~UMC-|_-ve` z50Iz((6~BAoft0SU#^~~KP1w?ZZZYH)%$Jl#72{h0+jHc0O_f^((nJ$@K=3@AMqeU zBJW`wMfW?X@S_7mFV^^o8XebC3*Cf+7I6dLz3nGm2EaAGp$0UQ%0iA(iD-KH}+ zF~TvzI3mX&CQ;0Bl`TP9pcU@%tyhp#l@el~pOJ4c%n-eOC6L*(T=oOFh{TKQ+N4dN z4hHt2o!7<;ivF;NLwDroE}bZi9SKHh6Km%JTtc-pez`WSqBRQt$)JQNGpOi&M1VD_ zxVhkB6l@SZlg`A9O@%Du&$E(?Dp{mhMqMV-5gf5sS$zA|Bp z!gi0+kN#!@A-H37uBJV6jxyFC@NR9T%g5yHS_OMnXNx$8f zh1B8+3VS3dnPX;{E}x_O$o%E+~fFK!##D3?^Cb)`6|o@c*OOr;a@Y@{2a)2~d2KrWVq zR`lh~(PvW3{#aBdUBQrQ;gGharyK661UVr}Adglie z%paqS&;)QtoT1^lLrPi0@{Pf3);C`5NJqwbte%kRu{>DdBp!D6T6x{lQIy#jA43w1MFFxs{-!y!pEPeifWIMJyq`~7e}8;t;HTQjtE)Z=^|c>pv}HFYN(~bIOVHVjCBQ9ua)o+%bx!YTf#B-(?*kyabLLFM(&p^U|emOPb$1 zhfTJ1D7RM6fYK3u^IXk5byQTsm~;tuS564hd_Me7(EhJzi@H7;b}>Sk5#pxBMuFD<~0P29#KRg8_fLGsW74B3A_Eop0vKUe)yUn64>xNOwHq7Vl8u&hOzk z;W@(hp>P8KJ=U=;=G-h$UY!{dSjeNhaR$ndS)e7qcz>duORMxO_pP$C?G`<7EzBdb z*m)3+CDC}1Z*fY1_z~4}K@!L1K#nb<_sY9VvuSwmgeQT^``wOR2Q7s2PK&2=bMKw* z9dz4e=TQmPl6GmU8YcyP!+`WJQO4QcG`dE`BpcpME2WsEU=by42fZ(9SfwIY1Q7r= zC@uS<7XMmSi&}RO@>iGN?*smy>Ck?GUn~krh!gmJ_!m4l_s&Q_n)zlsWt0 z<-y|ty|%?{n{8|v%HI$CT5>d9PYQEdSrS&v4wn)0-dah zk~QkAR=Or1(;0?U_U`^H6;~Z7KkZtlj5rGo-aKym4Y=s$395P`G#owK~ul79dC%HaY327T*0T_2cGw`*q>`m81K;dF@a;;Y<>m+){({_CRUu$7NF}3*TENE*$@6 z;`giVwX#suLuv;n=I7$f2zSkD&@H3qC~mXjci^ITCl`>3lXk(W&<5s*F{*19_R?L1 zh}!n)gaNHr+JFLc2$+GADEGS%qO_i~t(OC~Sv%{{kzrHf{mRvZ15ll%=Oz3~-+5|i z8u17Ap#Op179j;K#>XD-?2M}S4LzV7)%-N7tqRPT`z=r=WfIsIGHCqe)j&|%t3`QH z>qU#AqK@{84Bx?OvQ=1vDq4YZW^;0bS=-wU#jW#Rt$ZJ@l}ZGvrzk3G;zf;0ABKM6 zQ9It#al_7n{dT*PZ;8{-u<-qb)Kn*?ms4=VI;~&NIjl6N1|d%hK)h&pk*VzoM8S8s zVb9rA=*T^CP7<q$9-y@* z@@rTrJH0@WiMJD;bS1|_PG;PImiOKFgQ;;Omb>NLg#jsn_WQTNg2~@|KNVz)$Y`M5 zo#TqnqSB$x99p9tA@~{cEp+u z2D8-Y-az6fG4EMot=;{9-v>QTsN>d25D{o9(sI#9(Dwmi;ErGPAl|-|PP%e1WW5ry zOrgBR)VwlOcuEqfiOQZzhnl434}ed*rA}6Xg-XxlJxc}`J&aeAbsl(?I5f#mtD~l% zdv@VqY#c7df9CWD)hkdv1#L2Y2dAe^A-C1-e(DVs#eE9}M8d2nmN4u8ykD|6V-(q>UBU8de@ELf0_>9(*vG z7+Z1M`;s-mtT9Cwzft$M#P`jhADqT2d3V(8-P!AT+MovzO?{}3r1GY=xa1c*XEtoo ziLp;Roe^5`KB*5S!&4_pz(N+zDO?7exhg_}A9XH7(j1o}${(wPMiOQRj0)X^IS2#b>z44@B!b+BE=)jC(?}W&Mwbz9!5> z7SjIo6Bh2qwin4HzfwOQmSdk5a%e_7u-ltmneb{qS4?<7-?)2cWc0)LL@sW`cfwV} zv#AVi!=p)%)Q;#)$I(v)NPYV!Y3Mt^{EFjXO_LhR}kjb0Z? zw4VNC?%8_P0>);d2Hp^dg@ahQ-ya*Tq?AW54+ka1F=JMqKg|AgB|(RS65;=r=PcQj z*7L4?)X^WiC&_$K_<{ ziJp?mc&bpO5C^iu%Fnp+{q+Us4Xl#HT0- z;baZ#1fW6+)(#eCT%!xUNg26VUvai(a-DZ~{z0vO4$WzX3J-Myw|?;LP`{@m;SIyj z>7f^$&IS+oi%wU&;Q9=pdf%@OK2}u5t1z437&d6 z`#q+c#;0{>DD#XTaxryO)9@=7UI;JXv;kB@@O`b#R|c+TzI}Q(QS($afaTPgvd-pz z&)@SLe3kxUWZ6~j1cSTC#u6jnohw4636AUh4>un0Josf__2P$x`a#R{zeWg=ZHTbY zk3%w#q_;DQ^h*P4x4-er!cdi&4VxGeEpcC7Log;-jV)MWQL#Sa?bo=AdTU+{yWF2* zb3WdX1T0%6MT7pS9uNmj_P(&V+c>TPEUj}?F*A(#W--Yc#p79ad)o4x_>>)8o;~*n zckQ-};io$){xLhN-QbSulbcD}A%y0=t-d>58MXxkF*Y$ACr(HA;%R}7*k6Kq_q&w) zD!TbsxN+Mwfp;*$k~O30Xr3z!^a~1~1a+fKjDd9|YROJE&aL$WODy-n zHiV6iIOEg9=+m7vZn6R#rJyn8-Kk8A75-lmiK{9$dcJ}9((YB1L)o4nar??%pkl~C zV80i_PFZFVR^zyO_>&NLbg_{#$-6pdFV`rqSLAE4SxA^XBq)T_`>h4`{{kZH4qD+Cj)^2K=Cu zmvX*XEApHW{x&`&zdIjhX2|rlxBBYbxqO@imnnJwxC*p>-N|`IF8jiHeDDnPa%qv` zqnYuEl&U1E{^%#eu-5vn#)!qMNKd`Gear5nSAXR~WB9qVMiA;;*&i083Ay?^TkKJOpEx)&V)ato_ zv>Oz75a9wy)l2=Jro8gWA+v~d%yzR?mfNUVQAR-}>;32=!6u58GGgPL!5buXo^?@M0`sZVEqk?OW<^$l4%9O$(sKJxe>NVcMhxyl4b8JgsVETpo z-6`f#YSyn`Dx8hnjjWCg-;u$+vltALHG8sRrEU>^9EdYlKIfraPy*pB zy^W2s44O+*(=yt1KSt`K?ftsd0FGa2U6KsnD5?r(KrA{ga45LzoK1oFl(444mR>65 ztb%EXcxa4U1!SF5gAWhA2a47am_6a>ejg1~+%dD1&Jouv!8)$p7$FXd7W`Hvr0t0o zJi{5KBGU&sV|JI>j|_RtAVo%t#{>tpJWfp=k{F29fQcs{Ie|huR0lodzr)t(LuDoLTUoU-Au4%QVeOopnVUNHA4y zlzQhsK3;=0`ylr}d^2phGslL;|LH0LTK*4%j#`WtU{U{H)|E2`>;K^zIdkR5rT?%7 zUD2rjPe(LpzP2Q;^Is15rT;Yd{J%O#C+OUM{M%C8#7FnAYsHYy-KigC ztsWIMfi2%37yeWR(`8(+EsF&YQW{Q_l`kC319k*YC?xdg;665pw6%14?~A@klV1g5 zrB?{i6a_{ArpiIisd9)@@B8Z^S%AXyw<2-o$`~+}9FgL1b@Zi~ z{g3DOFrh8~EZTpX{`mzu;5ZFdlTDuW>U4yx+vtfB7o> z40i$9vY(MFT@Lpwa?c!8?YMcrlf*fPgyb@+66TuSj@{va>u~_hIsq8TOSO{(cgZW| zoHHK5Kd&ZQs=s9>s@yp)oO=`IW{>?LRF$xQ-r(eMwml7f{{;+^sA*9iA=?L*43zHr zO;2Ad=3nt?B<#4j{&Y?kF8|ieAK0&_yz{sbaCOgYyPuJ9ewk(N7b2jDk9)BCK}u|w zqF&R8&8NWKC$vLsaics0Fg|}igc`%5A ziiPU7`rivm$F8m`bnb0`ZkZ!HKHf6DroChGmi@MA#b{__439q9eGriG!ku>E^))t= zCs$@dn|8RAhM(RtpI>2!GzWPi;l4_t+l!(cWwIt!FOc#4Drl1(J_jj>fnCAv$hOk* zx~P{@K4ec$1|!}9eUyJ!33#l4s=>SYouj1?%)3Eln`OvGvf2m%cdcULqXCy2&yNob z2C1(={k7+8IiKG8$?Q!!xNYn{=F-8J(R_Jatx$CSU`2sB4dNT=%_slG#;H9|`r+{< zETDD@nDBL+?7m*tCU-n7{gF0_6mXcHXT_40fWelQW)G34oV~AdN!VxYaHmPtczZGf zu1sDv?f#m89ig$k*~ziMjv~6u@3$BuEkUX}fA50*Ey!kly&(}kBqkA|4(U&WGTDf5 z%cD4j%^W9P-VBzP2)`7LT(ohNq!R>Pt-w3MKWKa)2WO_Loqj^pL~JH;0wIm zfK55#Q_Ej1O8H8hU-`Mp66z;7SgabLhBCpIl%of?Ny)K^k&o&>%Ig|2AX!uV!@Swb(hQ!uGI!1GhfBpM*-8dLj+&Z|@vUF{b?1 zG!m0Rr$aC=8R^I)wd+zp=XjLbyYx-XDr8C2>%Y!&Qj({37>+N))%~lv{+VwVzLerN zjAi|?k1Sa#O&L05G<3n$INC?0G}#|?ZsK@weWY%ghx0>jJxnXIFQaN%xD=l!meaSP z2Q8}c$76fO`A?|AUcKcpiNjD9IroF6ekY%VyTA!=lE19&WF@(g;m?s~Z|E*91f^-d zrF+)&vH-=kQU`F-6n6=GP=vcn4nFt$>XI#pD>#EDN@8|J+byu+h7lsjBe^AYa-R{AXtnIoa zNN)b;dQyo~^ycnxe&hwy@d){mH{QqZ>-g-S;9b?>jw&Z+<4M?gr^ToDU!bfl8d)=) zE|K;7EVX=0obv}k&%5cetzIMXM9$K$M|t+sNu}KYTlJDze*3X(oAT(>6OE3PrzL++ zZ_?j8UpsM*qO*mAk29nN_Ik@6@okhtYA#4XO;1}|*?aCOpUz=E;QjJTEj z#qIY5$$bRjqB6&L3w!I?Iwsum0~g8B>7C#u2jQ{f>yEiWf91J=Q&BgWcm{GYU${6} zM!HHK3)@}8>r)@4#F7NpozzX7$BkmPWuiaZOsy7-Ew71;HLY}LBsJZn9awOZ_+B-H zG+0a+*);Oy`@1$m|20GQH=RF7xTi|rY%?m{KF0&CI`&b=1kgp@a89yZ zk(kU-Ru|zd+pgDQKh%~=@r&Q=j@@MXQF^iY#*JCnhhn{U$wRavOX_+!-kV!`mJIt* zU3dqiXXaR$gwf2QXavpliLXV(zKCr58-~B0W({RpA_v{>tS8ZJ;*Y;SI$hSdKy!+( zYv-ZBf#zVZtWtefojuvUsQsfN-erluuGr$qLzASCP7$SjsG|eT za{|pD2{xYjDzs^@8~9E+>ln+*ivBg*>3>%`5uBJJ+9%`Cbtm~-?0rNaQ&9KbU|@Xe zQWO;1H1lWMEHHH^%ARL2Agv)s^K`$0RR@Vb1d&+jW@R%H$b!J{ee=DFJ=YcNejzH8 zOW-K^LYK1J6z^2?ajLxedwp?KUHqu`Hh}L7{Ej# zuj8TTfG#?s{@$ZpzGBS2{dgKi%*&`O0a7$_@K;+{G6^*Ve{u#xXVYDIr6Yo z|L50_kB;SkX8r!us1CfMgTkd=a+AJ23HkA*?#A!52M17>AbO>H(Yk|gWeD-(FO5EZ z4%Dz7Eb;Gi`%zLLN~YTOR6D-UG`*x)=ZJBo9`2=DN@I5 z)7_h{A(4W5mJ0&i-Exx>>tZjn=Bd2>N?rVm>)kmIvlrxLuA?dx?#dtMuh~CuqBE5` zB+adU$|?MbXw>y!WxPwxxuH9lw}Y3?vrC z@S)~8=r`rrbz6_kjV)95wd2i)`e||(H9@ja*Eb|}J}{bmZwKl)n&Sw)-5sfhGr6Z4 zU;%7L!WaJ8;gV!|>IoM5ME^Kl*PC)uZ98`5PLpq*xF4naaCxBZ#i}D8cm#-nKH`Diy|ldlcf8rGYB#+iS5H*c~> zPT2Eu_*5n55!_Sho#->1dsho>4)0;Qy?;(+*DKMYH#2v~19Wx?vxby}XYLp=IWOv0 z7?#Az$Q6D0b_hKhcdPR5gQrtlZ@!;*c_Y_ct{GWYAUJ;Q_b>oc<0S}mqiR{-V@`xm703jP~8o_r(3U1xtYwV$Aoq ztK72FH_R!qaf;!Md@9V{K8dP3wwjxMgeV*^UZ!iJega!OOhRuTC}Cc9&)6nZwmKw7)dP}6jy#z=Cn_d~GyxfEbHTYuTm z{fM4yEkmDlvgAFJQLaj5Q&Y2q{Bkk35hsH?%r`Vk+QXax+*rh4cg~q+uV_@88v0p^ zfTu1^UFMU)y`=Y7k-%^)Z2Jod=_uNm!>pxB$2W|}gwh-`qp!Grx*8Oq+_#<4J*tnW z9JTK^f9j+ZF?F6UB>02eVa}-X^B=*z3^q4_yN8Q^&$H`l3Pirb4?IZO;6jtekb2dH z*RFKUGm^7rn&fnG@e|`puG>nWn39!w?y(%IG%rw)&{D|`%i|+FP``2*YMSxNVY;DB zh_M)q^9|n=eT?R}QEri82q(w&a|dgd6J%f7e-;cK;0f;7TgrB&ndt+U&o56k|wm~)t82;H?Bf<0PCBBQ)UuL`#0Tz+2@z&8v%H3J7A1xE57IXK35ji`cO35jv!^5Vz!{f#d<;UMx%KY^S+>d+N#j1Wz z+-oOL+a3|;9~Uy4JAG|%zKA(6AXGS|$<~Y=-6K!m_py8nOO)+Uqq+A+ zP3+dSLlwQ7mVT8N-OlX0ng!AG=jr53myr5`&0<&Y?fi5p=JjBpxyL%kix5tG6xQvF zJ7<51s23X4<@`rd*obZD+xUlr7?S^WC+!durh>s7hQzsQ0AMy=-!5~kA5t`ExEw*b zV}0qg@QkTO!^0H2P<>u?PqQl;PXDCAeFcG!sJLNFa-5K^ZE>eS9?GFO-G|T8>1&nO zK+ki+gE1wEFupx(W(9FJu4&?VuEXyyE^2(9kv5r*6ZxTx#&=7dliMbQ(DA2RJRsoc zpgBfbuWD?W9Yn{a*lE3OY0kuY=EGgtfUT>9t6}>Iklg9-#{>d8=R^~EuKwg%6Liyv z+asCuXE`#p2AA(BalBxYE4{pLLxa1cD&nLgA-ru`qE`W9%MJNwN$V&;pP19VjoV+n z#y$-IqFsA}NKI94*QXgNhe=9Ov!1g^y`0^r;>^Gb;wcXk9jN74k*VM*eBD)~Ym?ez zEwZnn(Rr7IW>urhSu4W%R;~9&!n`lwg--KSb)`w$#_|%cfKWRXwD(jTBZoX&Uk28% zXaqvE4UaeL@|T&v5v>{nH#-i#%tA{u{`?TP=~vB4oNAf)wBW9_KyJaQ z?wcPHo^*;{@0Jqf|Rhpl01<3p7^>c&tQy^@FidOIfqC#-k2YQMw^eBJ{dc}U%>=Lw_lwW z(aEnrEK2`v3mfvLx7BxpIC0ss3~?e}cNbTtU`=Qq#~HUO4Qz?Li@W$#=1S&zL2|QJ zXM>U22jDuG+L_@yJ@yG)u5Z#g(;ZH7i#Xm(E2?{31`ZBYvNfKE3T zU?slZ3(8@M4lk6kBx#}Wm7ND|;G5>C`D3eUQjYlo?` z|DTVI2s5rP3k;Szh0)Ye%J0slTmHcb}=9IhT))eaN+2MH+B6&wkEU8bQ~r&m%Y6a`OGf z$fVIxqFd;Q>WC6~))tE?zDLU)_Cfj`cH1Ryh;&1jgZc0OUg3C$gkL_dX`>BbCnHD<`c)`Re=O@15+Pl28f=?*&Rf6IMge+btiKlI-xzz{>*g)=-P61#C8M`Dob> zavPJs;RDh_tu9; zEP$Z+ND~mHiu4X4SP-O(sHiAN?;wO0Ac;PRC{m>NM5RQOD!nT$MiL@K=@4lN9U(wS zLXy4keNVn`?6D8_;U0gE$Ox>J%r)1X_kFMH`rQisW=CwBi%{-!1lZ7H$P3F$9P|) zC@P;~CMC!fQ6%Zq^tTre2cJ zibMYvR(#`LsQ@O)Vp~5IR3%K{bW(@6A!eaw6R(DgwA+x!=Ioh#?&XS3`NxmXPShw%x=7m11c1vt$c=VmXL|8>!^ z{@eWy!=D;DH_~uv??o1I67gdt-^bn<85Az1*%oMf=J0>oDoqWo$r@{%rT9SYm)j+`#v` zazAtM`fO}+o?CZWFFG^1pJ&wa<;d^uHY?I{?Ymz^C9g}1^%j8&iXk=rZKXBu!mW&B zu{M2O7auONmKIN6etW#mA>rXK)-nk-TR1|zg|gi23*0E5H)D%5o0|{0ZjNskkYmVd z-!xE>Gc`8AB6`5BCvwfk>gyD->|6p+rYS;oZE1*_>)2Gr|8vSsc5$$?rzs>pWv0|0 z{rk1%!aoU7Suc@Osvki3B{QAT%I1>YMe32BNGWaU{l!BH6m!Dlwd}u|rO!jP;#|5? z`uBbsZ}atIeY;OOmwdeGmY_y=l~W0ZSX4v7xD)*3 zg6vHhXKZ)iy|<3oJ{Tmp-TrXAK25^-^45fOn}}K@vf*@;g4%MCN{E;!W8gvMOH3`n z##qYpZR5QxD;<|Mfx17@i>Pi&&Kr}HUKO|}Ac36Y?z&5I8wfKFD*kOE-}C&j(EHHW zZ%fF)^ZDjd!x*!afs#82pk_3+g(|7U*%jU?2%_Y^gDROjd8$>|AF<8eg51mS`38)< z-wzD6{B~-ICXiqfPjbI2d|nXpH_^J`-3OD`_P{v&{bw95xXZq`eZ#M&_4*AiR^C{j z+Ejg8(94Bz09tU^igsVkX9gSMIuUg|Z?U&v;4KD7s;xG?mHu5s>%pYnOIZx>pb5n# z6zOLp5k)9M?XmJ#+xM>XF9dW6ODHK0@*iU_kgS`(JPJ)awyFLyvi6k<#9Q0?(@CjK>5Rn zWs=+ZD7*GMHq}P%LefEVIb*5)wD5{2YSZ@JukXwRl`vtPf z{pmXAAL(kFpgMQn)azEGKv{9*GmUb$qr25^)>4fFXffS-M-!H01^a6xAo8_n3g@?!8D(g8WIx)eLe$6eH& zZTA|J9^g`RLO6_3fyRo37W2IW%Jx96o$&(KyKE@OJTi9a`Q;pL+obMwefTW$UWGt! z^9K@Zh2FQyI?B`Pk5v7z2~tVD?&M?>x^PGd19lA1dEQcrV3W^ zzZP$HHESZZrEiXXui8)JkEF<{i>mI%G=aVDyh-@iOTGxPjI;MS=X93Jw;y0z?lvmC z+H3j7Mapw6pF+-@{~CTq)sO@2JUinqis`eC6)3*U7`>Kq#|_O_{5yn_veh0R2LT`AaVL3J#xm!wULwD_=5o>Hb>r7FM+R<~d8W^b9Ce>= z0!rpNRt0T8G^T!JI{y&SLgwyVA=q_0c;yMa)BLrO=$Y+(YV8_v`$;IT1jbWhQJrc& zY&OJLRnUg@55^0iQmw>XE_?$F`@qmyGu$O}USyGS?_%>6UC(x-i%>BU;CI@fKHz3* zQ@MbWFS_=vW)(C3sz7ePSQPCS=htgE^NODBF?>{NNoSNIMrn$?Kki<@YSK=FU4{f0}j_p5-kq4)p%=yQ6}S%gBB4OUr}WD%@A|wBgjPHw&s`_b-dLCEd$lj+UY{ds3O)NyZWLqN9Nc!sTQXI$HmKf zf1>kuCl`gls5DUnXv*-4?QDZztVy8IyOM55r)K$;i#E8(zA3vhZ_LIHP}!QA(CRcX z3QsWjcWDNQ*0?u#G1Po`i7WEyTyA*50*fd|xPQO&bN&_Z6#n(3Q~ICmP%1y7G>z`r zz33q>H!_Jg`qU>0!&F2^7d<4-JrvVZ)@k;;9piFT>X;zG-tA3|`Blh}tbgyl^>8q2 z>m*nI#+jS1xD$Alp2_o{#QvP zey90o(oO%qNjXH|;p`oLK3>_s;KLbyAID<<>sU|8nOsRQh>NJv&z(@<3aG#3e)(bs;J`MjQ z2+_9ZZ}9t_V?Bp%xH^V58Qr_47@f!4EHG~~R&@T@vUQ7V)oPS=ICHkAZM89vdjtq| zeybLVn+uwY{b$y-e(#Dl8VfGVgZL2mJL*yR+y)Rz?>jIxnx$BNp~9+o9t<3D*@nr? zfK9xSjG8?Flmck@5Z+egHK}iTTL$3^agbGhGySSzU@TrsTkZB02Szb22?^hrhW_Df zT#;4>C~ej!Q~#;Il4@?u9-qI~? z>S90kZNBdtqxrnQ%l-Ocg`ZKdPE9(CFFL$=a_h$tCMLsh)gB#M8>77D(E%>3;e(nW`gStRfJve&G@pBbH*%b-h}sJ!m^(@5jC84-AOo zDZKQ>?x7Tb9qC+(#|5IoTSjD(#RC&1Kok8@3tx>*uitF@c`aFDwvLkNrVkE)zv2TS z_{E|(z}gG%oU+i$6Mft=!{N&cXuw>ExUFlM^Och^7d~ zSw)F&p9-zGUsYz;B{l~;EhD~64Y7+P$6#`2e1=hwjP2$Hn)cQ^r_&QQsqt^WWJz}r zYr<+alme(BAzw_nRtp^XYo1bMyce&TTj)IFmR+A`Q`X(jE02$xI5wfSby=95uR(}U zzWwcE%@0Ce^L2Rfi`{)>RJtP?y$HvyM+xN_7R7Md3uC`N-=|~5{`^PgLpihk(J%;+ z+XkLH>Z`Y97Iigs>8+#WUSplu=#QkvMf-X$`pKGq`c?}ug!-2R37Z8L{6>%BUeNNpvg<`|>kQ*rrjRkf06#O*IE zX>V6A+sz53Ga==1o2*}d8fx5kLPASAbr#E z`${L-;OK{u+RpulQ4NKo@xzdDo>e(BF*{HU8zj4kPmoKaqj}=eid)wW`%Pfj4MY@t|pQag%n9=w0%17nQfss_+I4iT0zNOOhgedGX!OTG*+3V@5`56opMRWD20 z>_Y*-5(>@)u4&YNp+Zm#@&n*2g#mAWy9a#Am6ZSJUFMZ?AZDpWV`ji{J+b+(J^?kK z|2e_`%@8@df$4LC_BdB*V&A)+uld8)L8$EKgUiKyAA_|iDfe8OBL`hGGKtgs2M1RsZTUxGzKB>#o8vQ zI``I4avxSGEH-BM8Xk3T(D@tiJ)7q(IlA7zM=-V|E*b6+RsC$%H6Htz+Ur+r-`00b z$}tSn_q%GRkWJmP$Q7b}c$s|q)-#8Ue8@#+bE!=>9wv*uWVrbJ?96@pYkQV2<&t8S zKGL)FvX;yjNl~D~_j;(O2};gX0%ip*XjnImG)uBw%-Pel`YLIcI&@W?qGdP1g)q7U zin}-8RW$f)ue}DTo=4r{Zpm6~oQ<$_oqVouUHVZPr*}#{burZW^S^xVAfid8Yf*Ad zJLa>rkjr#u?9M)qXRz1;28GQKkbzP|v{s^9a++gBU^fiF?X2Z8t^GW&dWP0bLz+il zG)*dc|4L7iC;{xA?QNX7;{m5f(e53dtBLId^7=Sqs$+|t9c(nT5}^IaJZ?LwCjZt2 zEec&oL1q1#m0;Xx*{8cYt1l;Bg|llsc#wUodBRk8Nh7~P=7bA`)G_SGNL${%k_5|U zsHH~i>7I#l4lbK(T`Cj-L}E)f*#?w*zeK)*)8wJbUjK1t@#j>ZHuV6U!? zoFzz?On7Kx4QXexTxD{i>*MH^Dukk2k*R=_X%GDSqB5=(oplS8h1EvHndH81ZJ3?1 zl8B6hfqrQt0*8Ubm~9Dzhoy%90;SFlX|Dy_nPpQ|qqE2Md6od@a+5pDzZ&)}U16vt zJkX))(NmSc>xJ1#iZGmJHGKYChW6uMmzGCs(EAdl=Fnvi!^o|wByoeW!;*9At`?aW zH+)4jJS@Q#`>qi%HHUC_xZ)u!Ct@h}g&Zuv6_Zp4kQ>LFLl#}mnHeW@hizb z>OQUGBPR#+MrC}ny9_;BS-J;$A8Vt|5@v@tJ7%3>o)r5reIZYK&sygkJ>k+*)+;Gs zy{t%&l8~TXsciSJsFJ9ZBe-pXdNr`=IBf!tNh@Mp(SO>M7DbN6j>P$)*Wq0|^qp{kfk4Z@+>8(e|3aLSAtfAeL}$v`-Zi#epz5KL@$={$cZxmx)f z$0l`G;m8~yCa}RFdbC-D;0u7)gM5s*PZ1giphc#YfLti{W!rqFgO7Uv&(mpMqMrAl zbe<8Sop5z1p%-cm(4E?U$Exf$x&3@^d!8SFfUNIs^22{~In?{*R7R0=JXb877^!uE zq^Yc7${vxj^}CCIyrF$tX&eAA_)+mX4JrtF-%cfh)#riBo*ti#9*)!P2Y5Yxn{!yP zA6tQ5!0NN4$FLI9Zuw~Vd#2oXPx-3QgYf5VEpN~d;ST4Wz_Y1oet@ye@nbua5MEah z#&Rsj=`Cs1*YRafd|_DmdD666M&X-%ldQWO{q?(Ipu$)C4C5~>(RlN3`En+|25UIC z7IjWBhO`|6ezHottCf;LI!JxH+_`aM3LgtQ|GMMj=xz0B1+Sxk+_`K*pd4v1|Fcv)p&TWs6LmL5H~iLq&E zUM%VGFc$m@zl!(l-}YpWAXes=BT$j$k(+SNWP8gD7$1IXX;@DAof zCV+`rG%@(GkJqU`UgJrq&kJlH1z@*Ht<^pGfz690LvODh23RHNj7#}K6vu^;&(Rk< zHhRV2Dr`2bBdUBKjkd~WuG8F)aX;Fa>GAFEO5fE(zeuJx$_1_HQatdvqx&qgC_ozx z(>o@5cE|mpJfrO}Ad8+!@J*Pl0mD{f?^~87Hktr_dp&e-bea`75TQHQ5JsXlj7$=y z9)%l1uBx{U+~@Q1i2<@34{^zQE;d6_gjiz-d(qP ztXMyvocA?vS|-Rw9FAr=xyZveX4gm3!VBE|QAPx1UDl;!M1!QCZ_QL2`ld#k3lMI7 zP>j_JWRHljE!oUQ(p^lJa@CGX{yO0rI!oof{8`_nWorvw#`peV>BVn$j*xb05~-H7 zvK`Z^m+Tqfo~q!PRUlcFrP}{LDuM? z42P4zTlU%|>q~{jL65&{2e7{r5YdYO+HL2eccC!m>%VG$)xMR{(rc4`^^lj>^rQOt^SkToDKTkq?32{)vnWN~CX{N&;Qzc-A%W{NpAsWXE#U1VyAi7dHxo2tx?xpC z$%&2wB(z@4L#S%go}Tow8q=m7n!Il~51SXKjDKuHe%d$rg)PxBrDTw;cMerD2szijdxT8#0i zl=exH{;U$A5H(itGb=mUXph9t64snQ{~(g&V*Z~ggqYvZ zSOxf6`G%ncY?G)e(zH99S0gXtV0L-50)0O8Te*cgE*ql$?H6z0^TFopE{}qI+0C+blIBiwTw7%ey8mLcv8KLB0aQ;er}fQuXm@j?t8(bV*x8%SJXEJ^oSbf zjO#x1x6XIC!le(r0f^N50I-|B!QAVspfesK`@HYUYR)(Nc9(tjvv}Bu^FCg1p3ghG z`-SJ;?nXfWKHRFg2_s;N*Ps|jln6ORR~ypj(%ShS=L5Gd=+Vx4^RlwR%!~6Y0Is(7 zuw=Aqhm!vdBGt1XG!wS*3P23SN}*9v`R8ddom`B?t7Yir&sI8_o4Alk`!~N zJu1P7M8@ZNR(7zPB>~-ae>Fg!|JmR=r*PnrA?B4R<3j>MYGw@BK1=f0lY0bfL(W~v zgw=AIV@-f$>zWqnnMkVe9Iy<2GLmTSFq|ZV1L4+oG$2X6;*gwna1I&4QvQQOTj!r5 zB z)u#?g)l_SPv-UnnH*Ua?|MJA|_Su*3S>TNqZL2RjSc3sgGm_dBoO0xe_k+9wa$J+r zc1bPI*ugxg8e$SNQF6BYv=BDmg6|4Fmx>`&S!vVrC!=Nu*b~MUr+6DYJJWDFhwfuo zkje*Ek*U?>CVU=sF2_w00axrqLT3V3B@y(dh9`?GvO7HgO3ub!bZRvvd&?VrAW^p~ zKkDhd)KPnUQ*ApCHRo)STi=oQw$c4Nw2K6fqN9#?8ya)khUWYbfz~2JBM!wI*7#hA zil5EkGq``{R=B=*C&HT5*3j)NNkX2{$&=mP{E<&*Pxq5P8Lf7-;B5wDCD-fQ#2FOS zd>4S5xD`y^13-^WEV51qmY?xljb9MH{j-Ue1Rzl6`^qp|`(XWcIACI^;X1DSxqdRt z!KwGR$pnOq+YqG(!l`)yGYDD>33~bSo69j}P%60|2)3e(f_EkXCf*-XeaRXCg0h7q zeNp*)TH(PP53xc?raNA5Yk8Oe2jCviyT|xczveUdLG;`Oji3JFes}&1CGqlcdHE;% zknsk)HwT0GnOlpq%Z0I@5gew|xL*x^1&GW(iX-+mrc5PbtapKPsvuMpRHu=)zYb{T z7%^9B+E7g3Z+s1a8w1w*WFHbg)eXoqX!}%_dVn!Ef?{vUjRRbQm3@TY!>H9dNBPY( z)Lu77=h--d!=iFa#z+i1hy!=CJDz?otH7`D^v))m)I=x>4R!^otIZ_lJ)k%TME(xe zSw&U_$0ux?(+?=Ho6@)YxZmF7zebqf2PRl@c(V$t#UCaFyV>G51HXwrdt;+jri4d>}C*)CMtst=rL{zOT zwx**eE7)pK;W~+#MQTv-Yk!IUXC+HH!~%Wv3^i%4fS?9mg4A?S&Fqg`@xq^_=@Ckc zaC*;A*Yp}?UY=eU7H3S++9_P9w+l6VKZZ`Sha3X8S*4eeU|8hToO-jtvwOv|LaJF? z;%IGg)kWa|p9%%(&vU)d*vkp-KK&vu_#mVrGr?g1D;8jtr@cKud>T<2TC$_>^Rz1; z?Ypfu&3h66`aX%*LhZ<5My_bK#ns+R^kqy?z!dJBfnT$C^ErSW2d1*}M3piSh+92Up`C2m+cBx&Xt#gX?-=jQ z`$S?*BubF$F%_F0OWqJ`&Zcusb0j3BbA^)yYa41?K3wULJfO7tBnG0DS$RQzys+KD%WCb6f|T#vt^;7c)A zpx%3}mUw!+kYOQw9095G;k|K9&|!$ri{>=Gljkt1V7l5uuD0u|?#E+S(6CE+DsX4w zT%!>c_c!p+rSdLNe_Jw#LV&PvAG*1Fz(&(QFqmex^K}&yh0hkcqXe5;Yg5y?l+Hia z_}<$cVjZ5EW7T@}qB9U;@;7aqFEN}xZ@`&uFsdzRrzK9v6R<%<5g$ZLaCYp*Mu(~7oJa8Udy^4=GRq;1cp0q?^j5FmOa5mRJuL|Lcp zd`u13b)H&=7IvT&b0E0L%?XzY1vdl6ddKD!?KL$eSNX=m*GQY9RO_-7S?OgHT3Zjz zUEtoaBO)qf3UFWSFQk+%)29!wa!46KfX|&Vc9-`&9_8H*1Cq>0;sU_D9rt};5V|xs z{dDZE53c4$OMmj~v3qaKv}7}LXLKEb6$wG&qm`nO_p4=1$9U0rJ&X(-r_BKFyJgsr z_qpQ<*-27{K+*ziRl*K$PUn>@+O~+_aJ7E=cOCADo(;-064`kmcf-!>3;la5&?=x~ zYtX_!%}N_9;A?JDLM!Uxooe}(F%~U8Bwlj(uHl055{pQoqz4fQM#Nqn@jYTh35AmyK9LSyf6Ok?0lDrX0 znx$X|0pC%T)3!C_y0g~l*n2j}4UHRH};5$JhVy_MC z{xVXF;$3Y`j<(83*Ru&()I;>MGJ$P$nI|uBsqaTL0k-alz)D8{vT1dS9Ll$gUn7H{ zL9V_bWm-Fj)TT*UHk@o!IM^4ht8J{4~UDNp^alasng3M3SO*tUiNkJFq` zjypij@u32a-j|G=hUr7OReOX($%xwJFzq7ZPscpiaHuJxxlE754{5)sMgg{Xh&8=H zD3~6eB*OFWtTe&xl^kIch8>}TDhJ;6_!P?2#1e&n^7y4*$EShI?aIFW4Ve6z{35|{CzRq3 zu@UwK8@W9RLZ24I6F?(-??^m!e2wNeYyMKhNt>*vMW`{UQyqlE!Nomi$|paSv`c*~ z!a*Z1HNJlvtLimC$sfQ@ckvt5mN!g|B^mDAb&`FM-ECWFG8*1a6|X#+EP5BL(aYXa z+Rtm-ppl=CP_iMpoAeJGXT>~``8pxUNDDr>t|agV8xn6yzs*Zja&UtTgQ#`-FppUCzL zDDpI#=W363?^7vr?q?ZLh9>eFfi4LV3o-RfWm53@%Op)4*lN6u?$3M6F6elWgz!N` zsfu4N$2gr)-s#Z!pFjNJu2u>(JZT)VWDZ(Wh8I<)d1})ubs!t0;*T zi@CvG|1ej8yii5;G=lO|!5$q#672A`5i`aWB?FIw&ZzdePN?zNz;{l#Okls7XSE^F zvB6ISUntUa=7>;9>eC+8$o$;%;zpQDKlMzFR01|jVHMrFn( zhO$1xF{d2@CcGQeXI$ZIik_2^J2M{@gnj8q#A|a$bje4ds6ei1j9_EdS1p{_E-stN z^*ohE#QqjCDU4l*9;Xi%q~K5il{BcVk^BQ-_eLPm zjXY@ry*yxx9Ey52gFF1b|xAyrgmP9s~W44#`hYMYCv!4SAV;(*DN`wOy`lhBLH3EqwdCYO9rS z{s8Y&;5gTdw} zL&>1rI^tomm~WTDZ=YbA?5Ppx9&dj=r2+`T>|dvq?l@OA>t}bq zAmNFEc=RQ`PSB6NFtHY&H*x3Tj50)HnG^hT!xc(rq)EJ|q$Ox$kNHk;PxsWREi=og zt4z)_^Pl;&K&DgRl_Zg*tdAXUK9=gyJXRH*HgSNPn#s40AfKZ6qH2f9-~ zi$q#KriBMF+L_dXqRZ<$jbD(61x??bU!_x%^YfVg-v<>tTDpe)Dp3eR?nLO#ijK&W z+Wm?!aXu><0P*#hlqasFmrG*W^{8 z*MiOn;9XzlejS)g)X8TpWbysrb~WEG21E&SUwZ{P5+h6jy7weRHt-2ZK zDv_#0_SV2*5F-F0k?qBBvdPoN_a=zUdW0Fr9!%Dq6}B9u#4A?(_U%cx^X;#`n|y-b zqd$MKoTpI|fT_3fH=hn!n;1PDQuy-#ZJ*5|kwo0(}Kt*7Zs#BD?T7Jp=ZgDT~P5g+n>@ z_K`ZLC8d>bdu1Y#!CUPCe}ki$9*9i3^tt6dkq#-WnDdAo^ZI}5WE55kM|_>&xJL*jz#T-_7!ETi2iMx>2PQde?RT;S&NK?hUtH zv*6A7Hv}ao{;ujw3jg)NGr0|}xMa{=7II2Jwl@i=|BFD9jux7nhM17%RsH>VAYw6z zJ?O9R^)TP5EdL=QCZA1+7EL%f-YM``-P(`))KXQSXzwZf_314w{$0(x-Ce&Rw_)ad z8s@qTufwCN!u|{=s#(1*BKJv+Q(vYMOk_7*l&jYE6%M)zbgu*VTqp91zbge}Ud*ai ziN}1dmK^S@+sM%!Li4F$l9p%E{G(~0{u8bQ*t_k6uwFW^XwcvU_|20ifAP#vS{Gyw z>{Ti^FPtOE?Vw8yXh|O1wu%I;$1A`yM@De%ix=?iQIFLJJgDB71>X+snMk1K#Z_ExgRvK%K%G<0yGsrOCujNu$$apo`F-`xub*nY23Dg4=^)$OJxU-eG z-TdHV)*Q?FsW=R)wi_^$77i+G(=g#({A>2hN^a3n-Z4g7AYxK>Q|ozmz9;eTOa+kf zRGsY0xJtw5^>HUip^a{5S%q%pNafo7eD9*_7vunvt?-y znyhy{?jTsnI-s;T$C|V@!4FY;J1xeL%WYILb)RfM|FpB zX9I;EumA; zhg@g|`i|z1^8)*YLX4e4jvW|;5f2vj8@jr|ezg}@He8rtYllFR7H9LwN=!qF)nHz2 z^Dy7zX7WU$^QQ_ZO|DfoZ!9PmRkOA^E;`zyvoHKTI_`PJVHwp;3vR%yc8c|Xa%ID^ zSpdL#B{i>qqlDUhtx*dHJt?_CEJMPqL6qwT09!u#Nwcf95sukOcrV3R`%{4Ak zFZ|ibQ$1g#kr>(S4UP1YU-6W95`2%{_WPpRZ`ge&=PWrwoQ?{rfXUV)#3MTLJqHhm z%!v5T*+oBp$r^qB#o8zhj4I-ZmMggYX04I&xMcxnH1_9#Ls-#4HqL%U zkfLIyl>t;E<_J-n(RN2L%=96zQI+i7n(XWiWh@ms*@K{d8I3R*-Ptmfqug(l2@=R! zPxC8u2RxZ71~dY@=XCD-j_q&P=;8jMw5bM}#gm5)M=zyhf(NdZG_yog%{%iC-#ee_ zc%18Ww>oj9{w&Ttw1^KbHRN%8)NvAecr-Mq-y3rO#THzR000wbBR|o&h*pUa(f=y% zSc&awE;jOr$IU_#mey392Pwyc97kvG2-V9Pj{x0BY%8mq+Nai);N#p@>kq!~eG2%T zp0qRlshy40ToYVgu&^%IcfK1JDQi+tRd{;4en64I1OpY*Pf{8!b6v%=Nuev$FN5HA zf@vRflxe|`?t{T{w*4p%YM9!8XZ)*Y3TRYd19#ffD@T=2^)nOXoU_BZQrwOUhs2iz z+Y;A`$$o|1>@+e~kZG>W%ObR8md7_@SBRR(s%n&4dA8Gr%NOc}%>BSDoil{JOXO%k z1CFtF+Il0WG@2+fQ1~X{G{JVWwMPTn-h^Wjn|Aj`&5b#ObE8UImc4M{5YFD%hqlF!)kyc9wdIF4Mo(ir^u&_9BayS1?QVKe16SQTfPlMw;7C>y z`h)I=V_ngocUIUzPOeVmd#JY4oz>vXr_iAuwY%1VmGLiH-sVvo9W7O?h-yRC;Ch&7 zNk*teXA$0@@IBh}X7cZDqTxN8{1>X4P(p7GQf_JsoRMCZJX=EZm%nfb;BuwhT(UkI zQDzbN3TooFO%DBM89G2TR`&lZ8m3;{n^fiJX`bk)uYoc=ZpZj}qWyL2(T5kJtN*O` zGdf9h@~D}P7y+yUiULWd*d|ltnXRgco*hkF zKi!|sqe0o$30|n^|5io_<&wea5^r4068kT;s}=Z~W~sLffX6@cKwf7H$ld<*7u*CS zhtg&@SEYf5X*B?aXB5C~?KipWbNK&!9wB$2>D`|uhJnBlQl)=d1IN_^Lb!Cp|2e^b zF4_NKi0(nAAS-zRIJL`dCkvI$w#^JNwY7j&chn4chrwHuLx^~1)oXmgs$7)w+VjF; z9Y%jHIrQ(kTci0#(a)5`LR&^_Wp}XMrpMM4&9)zY1Y2(& zwQ#EAU!MTvpy_f@2>4CYf7*vu@3#-NOf3@E4C-y>SMzu~-SYmx8vkC`qaTV>c6qJQ@G}c>nmoT~Zy9?(37E;u4#erEN?- z`4`>J2TqV=L6B@K*s7C6$*+C=uNHlN*589^qFpo)rrmT^kOKpRx}Rp!Y=X5Yl9p$j z2_4(7wU#&E*vOQEmz%6}fU(j_M;8(vEUlZ~RS&JT@`Gk2Mor&mHqsLh(Nc&Ei0YDr85ZNc!Jd;=dvUOovr0Q{I;vo@}{^620H1-WH;g#Z8m literal 0 HcmV?d00001 diff --git a/windows/threat-protection/windows-sandbox/images/2-dynamic-working.png b/windows/threat-protection/windows-sandbox/images/2-dynamic-working.png new file mode 100644 index 0000000000000000000000000000000000000000..8f94ffe3967133baa4ef0d2ac9358b7dc715f821 GIT binary patch literal 18568 zcmeHvc{r49|F@PqX(1{VAvZ0SXu(vrP>7Iy8B$c%F?aTCQ&Ng-2}MlyT}e#VX%i93 zo?)iNlCeydnPHfj_q^spJK`ZkM5)9y3RSz@A~MKBIfego}$C&&9R++4?o$NzZ$Ieel;RFB2V2u9DW>qu|3@Ck+D)F0Rs;jf)rm z0-r<9oi#fR{+2h1VZY+y^6%tQx93uI&w~3)C`~UPmt|NKBY{9p9{?WDe z;^NxD5B~M*ljkdmX~b8No4bGAS={X3 zu!mdaZ_FCv;l@=ljil>-|9$;mv-~$4{{Kz`+{Gr!W_0kS@ym_5N2hB1b0KK(Wo9l6 zA5dSk+ZniPdi0};Jkj}8W=j396M5H~PJXLA<>F-Q`_#yg%Gl!3SHL$d&Tc->AU~mvL~#CI`upHytt7F2 zBKT?;xrpr5uavc4PSxxlLC+h6z5J^WV@$Y-;H|Z~wTXG5!v^ zHtXAkw{42pe$V7UFVs(GQ8m`r;r(geU(ThOdqq>yepNSMTrkgwIxR7WW@`4Sy~TB^ z`wedlF8wvEKrw0~P~QjhhNltBf9x)@I^U*8-qGZD3_n7M@iS9)nqh$=`uzAxw2tK^~uvo30olEom=~GF*#bP5QP#s-dkr3e~&s8(mkwH`$f#qs(xzoxhm>Qh-`ApzLe zA^0FRIsLtT65|`WqhIOm#NQPNr{I}9)o0O+TX_}V3%6yp?D2V**174soL9uw=KZ_S zNyWX5svo+et8c#iELxg}qcKl=@goZBw2Yi}T#kx8^V#0g)yJPT;UCjkwum;ZxJ(Po zYLG@42{rSVmVOYKQvcAmW3Z+CYM*U1@?Dg9S>>H@*>+k0y}a<4lHWUaR$BazinQ-} zC<^h!oOgH$<6hk{d?t>U{fl{Vd3xrxxuFpyyL@?6zd7aTu}ae5j?93U!=<>E zf2!|Hv{;i=T=|MJL&PJB=Y;m6EXyy>&I|5OH1e#pQ_AQsJ2Uapi(ffXqMP{hlGntU z;sYLn)%3JrFR$@4^r&{?6~B&h1yiSS!-M&ATabnR*K;s#vIC#{%0-j1>z*G)H)s>i zBF>CQCAaLM717da5!8fmRI0w?0B?869+bSNj>mYoqS`=up<1SVE9GbLO+0eSWF&_Z zRExc*`)p;AK5ZgYwVUw^1|f$F!Z!*#A@%7F>W7HMqseC`ZusoBPwBTIRPrO;Bv^hV zrTk-+%y*d;`;|g{Ef>*bJ7JdwU)%n^1$v3OSAV*MLbrv-yKdie50bBr^jRy?0%b9d zj^+y4({|krg%xBA=b{PkvIErxty&Vq;UA`fO!SF;EQECcA$mfIDqqatr&ZSzXfJ86 zs!CrJ5RPIg#^%^|%l-bpx?htHKJNGRt;`R4)AF`K3`rLW+-DqozPQ6_&oNkda(H3I zw6=55bj4ZKgwVbp!ncRk`8+e!g;0yQZbM)-eIsEMe;C<9X_Z z$8Gi`U0-DAO4o*{&VHnm-?3_)N(}nL(84?IT63JHgrZlbTG25N)X+dzU9ENhi|;p_ z0zD}qCq1_DSx`lMDR$v?!EJZteO(IL^80LB1LBl!c9za&bvq0=oxSFOJW7;Pc95V; zA}OBLcT&S8XcI5WDe}pYFAK?$!k61T8~;WPuc;`>sI*Zg>*&_H9la}JLvDyhHn$;_ z9cAta7ZyvyDv5mNQH1?Y8wuVjZBnnV{^5nIqK zbhf~KwsvyPjUt~*pCINUBKuWFWvUDpcvHXSjBY^GPu;rQ@S(2Xe4LOx^v$UOHSxUg z#53M!I`$K$X4uZU^2b-*(YQc2N=)MBz=)&GE!q5pF^s8^``Y|UiXMWnYP8qebT>{U zPPouV=gSxGBJOdVn@q(I19!RNX z)7C@7-3L7AnW4UHV`9hd`$}&OsOwvyaS~5zJsk!vIEK}KmvDqteDf@#@_qf;- zD*Ly!98ic*evqgdo?4mP>(yS4Gdj^+;vn%t&}HnS<-)e?t%M0?pc`t^uF#k8AgG(V z^?(f$bg`nS}s$v0Qfl2Pbkdx(r-W?skVbCA3dX-==;_h@Fh zzJ2UpVoY8i5!K%>bXmuP8(BS0cqg&rnis05qQ#rwE{Dr5mM5+Y^dca~`w{2;BC-R! zVvJSHJkn;j+vNtMMm$XwGCws=Sk%gR9IPnz7k=zLF%jSTys&?Li)Y*CBxUNm8R>}u zH#dynY0FNJl;`R<$}H6AT5ZHqY2G5gOV@O~PE|D!3GNhS&!hd5%FV;wcW@eCEPX|7 zgvdJbZ5NW1>9q?t%cXsI61dt&|~5?zTv(CZw~9^r(JR)66K)t2+36D2ivn z;94PBPD%49dg5SYt6|AcLW*0VnuHtoW3aPv$5}g~-$$Zwj?>Lh0COA7Ov$Wy?zb zq5%Z=2H^(?7T5aK#j>Mr$i2Op8Zy-hpSDR64(!CXAqDh^Wmo6FYhe-K+ zhE!@z{5CFX?(|vNj`?#$-A(zHC)$IO>QvoaSJvu^*%n|pDfD=vmyv9T#I0V@NNsnS z$MEelPWvr^d8jTg!k^ZM#>3L}(x#DA|W zF){LaQ&}l;&gXG|?s)U}^hkgP`;eHj>Rwq?@RZUqrO344%n23I#9n1t6zQeCCk(Iimo^6c-_nEN2)yDN5i6ow!nAGxK3 zzr{t}}g>6g_p)|5OO26znkCx?pj&Tf<{VDspE0<#RM?eN@Km!0z&6 z-jZ(YI>d|aD_6tgOKOALt$h`_Evk9z`f~Hs@=-GVf&ia~aw!HCLzAk8w2qSwi+iFTQc2cE;WB3(oyrafTOK zP8osJscA9M`GOaD?1B5!PeC`DXc;QbC@XJY&(roDDx$U2ZMZJ+g)1JxKBvk{2Q0$n zBTC4;rIiD6p4C5*vMB~h{nJnCQz`mXDd= zfhykM%Ol;gRS~}K52~ZQ^D_a578Fc_4%R%8XeVNdbh#7 zBF#TVfjMDJK;{2bRw`6>7dCh5D_9s-UU+n-w>LZbrDGf+aOBJ6b4t-sgq9ww zA+=!I({1fO(eN>w_UZ(AhXYBPLFkc2K zAaY`|{}}C7N)6@fjA{Yd)V0mO%Ok6$fRG%Ncq_vVUBX?VvmD{k;ro0rL~E*2M4e+< z)!PbVA35a3vdI+6ucM|ijl${t$RVQVNZ+vmJ6fvG@Rcveb|<_`E2vg`*)PqTtjDQP z@9Gll)1Q|P~r=h$m2V$&*3xkh}nz|3ZC*lS?R8Joj zvs8?x--)oJMEbSTOK=fl=Cg^xrRDvJ!ERoZ!sr9Z&DvF8_y!P(+U^Os1%Q)-!xdhY z2N!6>-g4SdcRD}1EvQb%JXjCF5tO{$1MdgRWVhL&X8xJ&{!H|sO?*0`nl&yjcq@YF zkCbLaw~%=W+Fg&7QtC#@4e~geuXFvdZ*^l!?bF^A0?4M3QkfULI(tiV$#Q%pq(oX> z8Qf|ds7Oq5?(ls#(H~!N@3?Yl#?$^qxpSjWlkY~Wy7l-1{C^oZ z<6=4RD9}?vtee5u6oGp?;o?-YIodAW=a}@}>VnDMcx2c6 zzGOp~R#cYPXdCyb`DUfPxcKqQ-R;3$lhf9+6V4>V;+jIDtx%;Sswkp``qI23buhZz zScyKcAkyyZ6JuUZx1*+}gf}5i`wiGWrcQ`NI#lt$=;rI}YI1J0UPhi;o+vdd=u+V|y<`tMIsY z!h&O=N{!2SL`ggp^zs`Bs2*=B-vQt>waECAD*5sV-_P^rB;s}(lx4+uVF115<;bs{ zGk{UtXLzR+(=MMF(>>_bYFPAB#t+e!5t2Aj(z#*!eYd5E4LZ?JA7{)gYvn79$)lW8 zxA`<4Vmi}H)fy_!s8*}1vMwJH-X=29ro3BtcK~jp7}tvwd8p(`>O01|!{C0<@-{ui z$nR%?{oP<0^_v;|Xj=4l=RjIn|8~0};?Sp>M`%+cVtkA>y19k+$$U~iMk-pGQGvCg z?M_(`Dd_IgO;k02b(wBEFBB+)XpgHbrEG2*a4Ie@Ma;Bj$04UGw)iF1)?cYCbZ*U| zy*igkcbN-GON+GIQTv{nf^@%ir5lb$cPJVQ`>S``OzKY4`VP=QGi;0Een*g`Tef`9 z%SI3azN7x>wv8qfsSaHju(nursx&d?xLdso*@s= zN+Mc3Ek8dtn7EOCdaC2sgo^5pw{ihdV+dTo4Uv8TC8lg*)c0&?{9QzeEBe}a`}v`X za^vxW3Yu00;nKhtrRL1UNlCw=D5K=&xWZ0j(F$ol>3qzai!#zxJ<*rF#v%Yow(LKP zh%EPtJCU3kDAQy|KuL+7J5bSVcR3I+jN5{>d~fM9v$mV6f1dUr4!FAAb!j2SM|Zv$ z9(>mnf6%X|&Ebo5%z~?Be{WS&a3uLt=X$d5gNi1dx!KmCsV-Fus>k*gBWGOqz-csD ziqTX(SQ}3CtnRNw;BI;v`6Ojc$bhq){8F_jap_sC@qv`w5r>`f)0cM^pL?h5iMY6> z@>&~EyV*ZZ{>SLnR%gX-~2;oi^WD{OKKXH5j$yH_Qts`|ER2b`I{~k!ovk zql{L*d=0<4llwr2p>&77_E)q9um365x*EsWHKK9&RbcUTok8>~<#oru^3MzZzxTQt z6A~Qs%W@7;dqpT2>rEwjTj=qsN8_pon1VBSb#bN^i+cF`35R*d?Zfe}AEt$lBhGJE{h z#;`E!^*ov_!c%Qe)kj6%Y%I7*eVUEapt_y@MK@v``tBxyK80Z^QLPoCVh?Q;*T}mj zF~>TXbK)=N<_PIZW04G`BkB3FbU=8T|Y+&R?8c6x_ z*qO1foH4w^Q56zFPAT;kd`yXY(#rbCNCT&IU>N~LYxN!--G{eg_jHD>C6gS0!FBB1 z^-A@fCDms~(3+tS&g;(2&wzie=1q=0$wc0RzX>T6yC-YAfF_MK-_hB0K>YQcVF{hz z?+u{$*;@rPCt3WghsoOf0{5IbruwaVqmIWO%vOOg1x?MxNv6ai1(y%3{`&U6?=#kx zJsci3JFqYkgFywe_et*5U{)uQx6K;wNHG}~sLErtFe+m;b*;dB)aYetxulNnvl~m+ zFHz6s#7@fI<5CH+Tj~Pj?O$Pin8(F6mi$vD*u1j{igAvyV-0oJS1yn)Gy6?0fpb3B z@B`;^BxXHcahA8{o9AIH3LmoLfMzII5SVYMAqMuWmrIW%lVm^e=}b0wK2-Yh}~b3$wI!x4`~$brs6C8Ra|R%M*3Vpu3GK z6&CieE(z&K0uidDAbx{^dkCrAgEa-g{(+A<57~E%fC+>5EXO9FSNwM{(U@Zu5TnUr z0<>Aw*a9#s?4Gke8(hh#Pj$<&ry1Hg8+$Gb4eQbZr2ury4|)Sd-Gb$8&k2P=2}CTE zCuLf1V!VZKUA5wEa$|2g<_|w`mT$Ruoh`F6rJ=QmppoF>%w1iBQZ1^w3I- zGHsnbb@STkWhLtSCD$9XCt=8FUy%%C#qjO06Tw>r{t1PhDX-sgfLecKUE#+@;lsa} zDT@ac6eSf#7p!}*Ac~R^p-U!$qaugZa{qDX$JkFfAa)JU!3S(VYA(ZEwc;p)O+3_c zw~eOyo?&YxpzNz-sW7)~e6gb$xWUepJ;NT5Nbsip*c+EF1jD3<{PtC+-vJTRoP`zMVMgBxlz&TQ?;;+}kAe2)#1N-=A1_LoRqG_u6X8$Om zn{ZP15N!0kVsOw0CD^mFAI`L_=fP&9kQmK^0Q2vJ(;~w3 z6ILC=(o?Tr-KB>)`5WFkFX+x437!EuWN_+&cg_=WA9>cunaImvH@N}`pWbV}=^0HS zVWPKk%-Xvs<=iw7$+n7k)VCaJ2D-6A8+h#Psw)mDM*R&=4I0eDM7CfNcy*LPMfso67Z>|WdN~DdNjWzX*|*1;KXQxhE3#m#0>ml8 zZrmIemh^|;qNILK4=GFj!d9&K7ZfyoPZOs2Hy54EmxT1}ZtH zp~@B(pcN{~u`h_Hr(aAzDe$m&p$!Z&|0Ty-WB2Hh!qz^1!WwX!-lp(0ooU6I0g(*q z84QNhTWhTu6$y~jIZ)W!FXe2yx@;xaa_({PuxqXUHfFNUYyh7)l|AM7U#j;m{#&|

jkZX@6<1j!ur*O+}YpGyN2QcyURjrIgG2 z!Q{_{4aG^?j+`e>rvI46qbBN)0Glp|C)fYHRxXw4;>zcX!mO* z4Lzx$@rl3Q08F~iK%*`Em(I?=Ey7ICIAw>e)F0wz9!eG^wtf8FTFubyAdL(jg@*Xf zN95x)0-u3`DD>zEFDDyocL@yklpJJP1qegP0@aY-dojOqC3-svzjPKHwnx|8~f`#3_uVQ5yrC?BUibDQgR+* zX8-^ITL26rKt{6W5wsCpI<-M<@SOkHNjP*d`=RD+HU@Sqhy8%mwBjk{Aqe#khHEXI+QjyGJqvbD|v~zG^@0W|lzgg{hC- z4qs08#XfecD$E1{d$d;HA#giPY?P)NwstqDVqFXTf_7EY zOI*wp;$nJ&0w+rBkXr=)ImN8D97z)Y^0mC&Dkq2oig9SwH6;88l4eHiC)jSBGHz#o zJL@JL<~K02-Fhpmb=E-l)!luP!2DzL>mx^qOB51LG)eJv1SDj}HBiYSeI8sN)OP~* zdcY}0z@lEv$_INSy>p>z$N}e4`i`Tdoz+X5Gzz~41+7Q?+YGzmb<%pCW3EI{BOE9p zVWcXLTTsaZ+$C&nev)`Py|4T)7{6<+R|lYf_Swh^>k133;N|%`^);g@vDdeP(5$sw z9pE+0T(Jizh_wM2ZH~!-TLZ=<7AG5*eUdSJ5KHROX0_N>cHX7ke0mn`|WJ= zxt>@5gG=mhg?;{Q@~t7e$ilcKYw31gV%m~+h+jO$F*&DnoD%y+G%x#&Hu|2L*zm9^ z&JM#-fF10UTII8&*8O0jlu-r5)M0*Mr1d83k2O{w$MJ(p%vR`{gq3;^-CB2Noi9p5 z_mwfH2?%8Ji|#C6eD1g#>;UW;EFh4RwPXou!CD0cSJc78%~_jyR{9%kjk@WI#f?`B zrFg5uwt}g}2&L^YBmoZqojTTfzLG~v@hxHO#Ubd1BrbQhwaT331IHkNt@+%(wM-&6ThZbdVKCY%0D?W3cG2~KAXxqYe=d{)X=_iUm$EP)HU|)&B|}S40h_{uoG?KdeA2% zP};_4QEs~i+bCeR0NQ;{>FbsiZz=YDl#D5mPdsdOS(|u=)3Ztwu^;LwUqKfEF=nWr zE2``Dp7vK%WOs6a9JJXf0P$$Chtz`!HtRmuu^z|nfpCl3)FN8aiN6YWvgxXlAB{+D zRm*QHJr83_?=cX(;2_o_#143QHbCmFhZ+wk_$%6iwh1=pVSYFdM(vzq8L$NVG()u+ zN);g`b|w;%jeyG~IH_$IO<^DmZ8^9peQRw3q*xdU;{ov%!bcs6U{m({yKs|LEdDLr zkQLHN9f6J0zRk?#nF;&->qgv49O;;ra z?terMb3TS>Rj$a+VxiuFt{!w&4fgf17hG2q5M!SK(;S^HJe!1R=X=w$>=eeFeT!6W z_F}PWHru|t?J~zNXQ>j4j~VnftU6mP9`$IcaSSl0#h0kF=kfS<9Z~yC(D+l4qo!n% zc%X3L^F*lkXWHue=&_%SwP6GVvY?iRx&2g39;RVX~PaNBT!GXzUo|t*&h`!lZ zhGII$KeY5~JPm8eqy>DfdLaGrNTzwr^B~yP?R-=f_Aug+pHiVNA>w5)l1| zIWM}KB_ME#Q@Rg#MH<+3M%7dsc_}l0U@!?aYru$#Ly$n#%D=sq)PqHchmuHt!?TnVN&iSjlS%d=)aZxq8>4FY z0Y?S7Wu_H6Hr7Vi^7{Vca~${@Ey1QVk(f8BKGVEl;gS~-l5@4J#hsE?_qT!pK_m&o zx-ZEwr*_5_48+JHNEqUfRikTBzm zkLJ#{y;%!j4_H56E|F<7jZ46bTs)J;(FCrI?YumRS!F`Lq6grU_2(TrW?5FhXh(x( z0*`(XtOnzj`;TKibe}0iCDYET-`xf#9*R)6SDL@~Nq5v33B8YFy+)l9bq?zQOJ|in z+PKWgT0p{bS|f1!0F{KnV__SL9S2ATEC~9#5tR<3n|}crImKotp1t@4J~s!n%CRQA zJfpc*hlWTP4F5q`KsU*Ub>43oeoo8Q1I~~F^CDB(hf~ajLVsXq$Z1WHmq(eUCy!WF zb3z2*`ty(y%JH$0t!bl4t8VT+4k2ugUFfyp^Hd7!DUm-Ol^&OOoHO_+5PuCQY)$*G zza1bAI20{j?%OfHOa}b|=h&!IEdcjG83aqa*=+h(HoLd*;cpkqB|d5**#{NxY$Kkn zsE0BlL@rBMV7DEHb;KF$2_Uv-D~5gT==c>$j`egq$J@Xx>C9DT<;StSm5uVxyStXL z?1sk9d{DlylBYrf{a~zgR~UE#nxs@&U3tzDIpQlCFvE#;03Kkc(h#{l8+I=(2`tUe zU#wN@h<%PJx{1EBY&sBDx(G?oFEH5bhD&ivR?$w3J^$Q_ef~N9{>zbnb1ujZs?w|l zBfAtVPUnp7&ia&oyuefrVV*bfS9$#iiv6HLKx7&i^Bcc^g;arO7|%$Ux=R#{c{|9* zd>~`kS}A~S$twO!_Ru{P{K1x~oK5+KNd0yS1`<%V9%yMYqy)W#*&!0%@XDlV2kQWg z?E0HN`9bVCzxm8q{3CE^rzIF}(jQZ2qMaDsO(IKS4-80_8Etr~c#XX{uP$x>3R*fC z&MA)o7ITQV>6Su7nVM4ADUC_#NoRxi+Nn$E^TtH}oLcMT0L%_oNi(fCwHWq%N?8bK zbfIyDo$OI66FKu}-4g0?eC!d#oF`b;K8N@73Sn2eT5W)gayAQ$r9o3}iwT)zVqUyi z#skR5g)G%MjNse`C1;%A&+)Z{pZ6x-z z$dXwm>vN14EC8=dWTy>OMb<)Fbvtw_fPkoN680IaD2UlZQ%NC#$@zu01-A%)&a{aMmMX>p&fXMxWP8Woy+1^KNHDklU!a9?WmjKz3ZqVSXW4EtcJbhJOWz zsOa4*UJ^L~ywqdLxFJtk1-uH6-fXt#09E2{#V+OHnxXS}c93i^C_P=Agay!^sD>|S zQ&`FyFpnRI{U>*MYC4{hJZSk+iQL-%SZg{wA9R-(vz(9fT zgGSyLJ~R_zpBFsO z|4>2hiGZxmA)K+Uy3fib{e%RrTt+)iwH*O)=)I#^)}SIEBYgPzmN$$_wJtzs9z3?g zD@`=}Efv)Q^NWBlfq^uqoz6OOuBZp^lmp#qz%-^@`YclzYP&$}>G?eAwYjgX((&jE zn8zQ64(Mq+7#w1bbpb`&d2m4l_}+{=BHy@Ots~#QZVgB)_|ky{#^+EfQ2am*-FrNr zn;HK=QPSNd(3b(sUBIE@W@SQ9kObj{IrI`3ZQU429aD5SFyN0xJ2)IvQXSk_87WHc zEW)ri@dQ;`_j!SQU%CPz=`9gN5L*Dw&odVqrkToCZD?so9%vkNxC@;Pap7ec2(4w% z?^kzhV7NoI5aukLU7QCc8i3sfs9s*;;#bhAYg?Dm?>$8wduy3vblzm0(euywMxf)> zS$6tg%V6*UPC5d`lo@FAAb#ORrNmagO`@=krLF@vf|`*u$%#5Zm_Z{5R=80q*$gJy z_N3+9I&c(+to(=7GlwOo&gbc4h6}#xCL}}z9gOnmu&LM!xrrGbs=N6fpr(o z7{a~I|Lm;dy_J0BogypdTV%~xL(GGd2;}2z$09dJxIG9enZdw5|sL`v}@CdVzsf9Kta9auaF?J8Nh=eJ*3-bUo z%Y>yE0Fb39`A}$YpZE><703zD#eC&l5b7yPf`B&V$t-$HqILldm#;M#JWG~&`YjTICs z8>ndEF=SE-38(r)q{(I6Y&?p#U()dq59{Y&%XXJ zayuX1CgDz;(P>UO(3{6* zW!?UZ6A5q$4s3;j4gj?oeEk72SknM9Y3aVsHR4~Q899%fzqC{tq5InZ4CW6jk(nP7 zh8hB$sM5V4>7|f~wt;*I-=U7Yt=LCss+WWM59|iuVO3|Q?H_@y`qRO5DE@b7Kf&D3 z2s#2sDfLODL4wike}(oCcQ_x}aPpx65!c2Tpe%6=MKq;5;yCHxW5dF^!vs zLI!FcZg#i9PHn`AF7;B&x^fVH3F<&P0ZjqAay~C3yQp`m6f6@wjOJtPmja%4hJTJ? zn?78@;km&dhjQ-VZzjNz1hfO4ZSmgY9G@?lkhz}FM1o@mz8^3VDTfq>d%)IkaNU&< zX$ROcY>vQBjLJU{Whp3@ei#Gd086D{CA#6CLii(f8yIvn>kccAlRi`iT?~BK6eO+P z-PRnVicw={o^TbjU=PRqG@6N97_t0$tMBVk!@Ow}~mh{166;JiH(SZYa(=#1dXzsJ9)Yqy(BVg@bnvD)j<@ zsh0~{Gfi(%Enr2dZSoWrHD|v^?7@&8bM9Rw*Hv!r#2?-Jyrj%FavgA-0Ng}uP1*6s&su@|5PWD;k21qhMX&~}?FKAvXP zfm>t$yBZ!hix&+_$5@Rdgbq_!{%|Ae2`j1+d~$LFGq6Ko!5S)>vm6`)Z?{fn_-_me zkeZrzdvLEUSUJ5u7@$!mD=G;n1j+-XUzuX|e#wVm0Vu1`^2gv9c)Oe1A?cQ61!gfF zuTlrvgE-X(s^wuE<-n&e$?dSYmX(37W;xrvj)0_FlJ!{vUdnes4A=&s&fY&PWdMe= z`~Fbo->knRD=_}H>dBbjrd+mE&TQD)c%Y2cLwC#~lNy&L+7CHE_MWC@=v5%4oT!)> z;Sh5xYjNZUn*2T(C^Y$f?{UpHB8M7LFOOiJuA#Px>Di{mg6B=pa|7tP`*RU)=|V>q z^z^yL8QqtBK;oXW73!?pSDSVd_5!`_;x%}9aBueDzD2xdU=Nu{xm^RUs+36_T+f4e z3mz}b(2um#UAi5E)&S2b_V*HnF6Nnh^Na$@kW|%pco4w$-vaj&nuoGG zUj|8FNd5GE;IjT8Fv?u_>nhuf`^mo|pv6_-r(a&~2a=GE1-v<%qHnecEk?+F;1`&T z(C~OmH>h}fR=ND^E?|H<^kV@5k4W$oXHfCTMSU&w>|nltz$EkxvDrefN%SVP=?iGn zqtK@D_)6WOJ_fu(~QE~S(*BthgXM1R)P zeR&*wm+|9HIztvb>fop;3PPD0Hyc^Xd1lIaCI+5Od{Dygo^k<4|vR0arTcDqX~pLy}G-*xY{^X@lK0 zS3`;aTd<)nF zim!d=fsDVPsH@?BZ&e?Wl&#vtK&_bc2#IN&82B*<$5`Q6;!nq- z?`!7?TQyg=9%?+e;fIk5*RH~2S}fmN;O2CbXUe;`38fLHgJ>sk7YkIPS}NGqI|>_l{!n9W)gB^Uv0~ZXmd1#@Jw z|NGlD{`=cC{`=cC{xA9M8eG>G#4&5Q{z0&r6gD@PZ6zQ1Ovm)kNb9kCj-rDYT(BXcO6wlhN7-hv*16w?QUq?U|=YTVIn`+ z1K!=xR@YMo&qZ`%XrCDvyuT|z;5Q$A!GGFsVCS*R^V@}cZ>~Rhomn+f-hxf~&~)S& zduV(i#|f@`R_+XP4|8jVyn+(i^=VnjwSi!_=ZS|L5rpG7bzf_7)Dlx9^%qrj&E2`d`!z=NG)9WoW}7 z>%idkjlm+9;ik8~xs#OqEe4r~3<`Evq;4>{w=vvHXSnXlpcTmgsb!FU$aIjI!L6A= z_a%dVJcC0u!wnAx>tcpmfedC@47Y7-)t1LC2hsZ0BR?GJ-@vhp}scE9T_V|NAyjwAHH zJK8R+C@?T+?!A5UhMu?i;;2RpZ%h1#@kZ035N^M7J4RpbxrMqVG5omS-r>Qa?=m8_ zzZ4%A7aNw@hZQKhkZG{bQMkykjl3ytn*6!~dhY|G?&dn#-^htoSvV;0~@|e&2UQR%FZp#0s37+-iWk zv;xI^>v1f2Y=1p7b#2@xC);87WlY4eJOg8hdxO=S5(iK9^r=mO?mX!hZHS!vEbf~u z=BidQw_oS0@74$<2CKtMwY~x}S6hXht)@+GE82I$6BWpB=Cn!QhMp!`?&9x$_{m_m zmc3k26lKnQpXnvJM-<(T+kv4BDrbg$)(pKKCVILl!Sbg~lGRJJA3__f@{|@iig;>S zIThUurmi*LnST!F9{7@WhgFf|4vQ(}Ak%JylHe=<8g`Gs&Cz+M*Wzt_4w9Gf4~#sbFY1cZZ|U!?1MMkl8I%4$g$mm3eS4V2>H#FV1*gcH9?`!JozpOWa5T5Fb&pDBA3;Fb@ob^@T z;&T$eMcBJ(^YgrVQHNb)wZ%t@#;y4hG<%(#I@xs2h1tN-uJN1u@(VObW$&i)lpWc{ zZ20v0c8JBX$?=FPj>?_Axj?&X?tDe=tgNBA8UG-!>6tq_2!=nbRPr_(Eql1_K7||V z3qix!=BVTHaa<`omx>P?O9`u#X8s(@6<=A1u5Y^{?H1_H!Q~H`o@^XqJ8vFZ1K z%-0SJX)`aRFtc;>ku6!Z4CSB&uM4NzdUVt^;e1P({%1;G`$Yvw>*?*K1eP6B<8y#l z{(OInwaqzaDro44{G6a(z`3|nhMitovAHKZdB;mM2Tc}>6f2Jh37@)CIHLPSXMMN6 zEW6|2@)?-vQA;1uezOeWXBt1=Y3g4!{gQH4SNsdU$?_Y!|LCtXyx$91Z-vZ$Y%7!5 zywpAOh1hB4@vG2A#PgDu{P^7LVq%42e`&?#QdJ1zX-La{#BpR_a+^-)v%=ZygpZfb z<)V)f#9&T3t%RG0sZWV zr_Zh!dB6D;aaZ2#t{R)J_q5Xyxp;M;=BE0iAs4yt0!n^Sg?_Lhkesf2S#mM(&J?v72T8vvrsX>DJ8CKm4SwWeu z#NH)Kj9!PtRp^i2G}ct+TOkXr;e(C@*4M~vIVR18xm?+tcedTb2lRP&JD!UZM7W3& zpCjL)hq;PgoV^h_TsRd}#+&W?VGE01Y+{D3yz7Sr{z4;v`k9*nVy;ij+pu0&No)S! z;tv`wTb@={Y6z(loZGNJajWO>WyRCVrSI;3*FkbAD0~Yc&8&Y37&Lq*8WP}e$?goF zf~{;{s|GeX)lIPTtnTM_WFT8}kd06e}T1Uy9P&+}j}8r-DDT zwzlWg=Ny{iV~_BHOlXGR%vkV}_W7RpE+j7|_~is)vO)TO%&+Y02R8F2peHk&HDV8Y zBKbuk1kz>w9e7svwBW8Pj^2*__`LMP)YC53DqeO$PY)m)taAe) zhn!4%67Y;)>X5vGhO0L?n6sGM_}~_(m3UT<5WVu0;}Ls!u2^I|u7h_6@YJ7LBoc<-@FQwls3z&yB3_R4zZp4a}!2XGjF&7D_Du78rHBTX>2KHxp{WGedH;)m#cF-h+~W{Mk!I{$9E!8^r35yywWo8Gf3uAHXy}WZ~xoM007_l{q za$IK%Kp?+ce>m45xGel)_ORZ`p59iQlH3`!sqt*~`4VmJ`&Cxqq1i!(NUMsm>C!j7+iV0a6g#r9SiGyl7;aBda2De~zW#mx%=lE}Jj+PIP85>V*b- z*VW`nGnM#=!9Mr$hTmsrGn6Oc2f}k+;54Q#R+Y=d2ETvO-JUqp67TB;tPQUACm@FM z-s^f(+#>9W(d|~cNH%{V0ZsL~gEwcz9zZW;ebwvucMocNb*JL&DFNFWR_>QFh9Wn^ zk7**kuOBh;R_9h5$uKDRx&RrRyoJVz8YH=oIcV6fr1x?R12voo3FC!rT{KmLYqy6N0NFOmb!SBzj@ROx!92rPvm``1g)T z?0+K5&BBbX5_l#2pjP$`+TRCF1pBLRiB_#O_8`IcX#3 zGk;1XBBzl*ca-StRw|5aHQ9XqBv)PW^WsMxp98{+T~=xhdg39s0rAoG$>qc04FwWh zy!qSk(iMsrDAvy#ka@u(dWckx~ZJMz}>6|SELd_28^bx+;Z%WFKx#K!UqnN?@p zQQBgV!4$_L3~9G;KVy4`FM5Tf1h9p_b=M=_!DSyS%PnL`lWFc)>VcJ{q4xn-x^c64 zvRRvvb=61nl)c4g1+N&}U)tO?pBeC-Bit#DIf>_F+;VwYm_g}a?Uvc!7A8MD@k)~P zI>Y*X_{A!ndP&SIQ$)?mppGcpO5?(Z&&uJhKCb5N%twE3FS!Zk8MTMu<8SqjZ@IcZ z{9?{M!7S}zePzpj=Nw-DhLpUeq=J_RbOoKQ&Ix2sgg26pXjaZYT56c>u@NHa7>mbz zdO12RX7R=ndBnKKpwU*^BX2NBU<&P!jy{=t96Id8o$^k2(kfS6plb0Ymf)eErjy4u zJ|tFu?-}E(uFJ1N=6){B9RC3C(UZ(VD&f7obonEyorEJgBapi+v-UlE$ac(79%i1> z2KF~MNY+o*_Vw&X+$IOQl(NNTF1f~@eZyl~FSKTr<>B{JzK!E-{!k)+-mapwvl$Xe zS;yKfiOwXANtqx$LWpBbMDV+bb-Pe$V^8S|ENJ_OqWih{wB1+Ur4o+^DlaKw&#Iiu=o_B%9}9OtE{7hfKj{W!dpE87RQsRW=( z?uE4Iq?gBs04V?X4dumTo+ERWafaJyUa?$$Y}94-tkB?$&lJa3i0)9_7QEkpOiE7z zjeLtfx$@#-XY_%QqO%KUbM^H6Z<}trKK^w;)En(|M#Xb_d&@j5jSB`-VH}kU>TB9} zYTELI-ai)cHty%a>W`n^<9|j(vnGcz*mrqf@t|KWzM)??>mIvs1WL#8fRV8r#-?5K zgWnn3;Omi9iU+F-@3I#PvO^MLjLy7J)NNfnfE;#T?rJ-Br-FQQ-aUGaoHQ;7wzM|F zu#z2P%dO#8T$W6_{c(9pb*#`V@~=G6Rz;>QSc|PmpDQBo^l`eBQ)aX;zC^pN&G?s| zh%%*2JLsx@{ZU<^07l~mr|j!qtKQjVZ>%%?i{-@i`y_7mrg=nSru#Rw zMUX32rJ1EhHdH-=!vr#Gss;d61SG$C2`qgf>2UeqF3IcEdP>cdXnUO5ute3-9kQ3DLYBA{)N}G z(unx(%OQ#mm#QiB5Oo1PZ`1E@Xb=Z7jvlp^{PAh=0FhnjnXAH>ky={}lII+ zC4#9&?3dQ3TZT&$=jvZ9UV7Mf#*K3$)l*EN?b%b-Um$gO9 zykhME@{-`mv&Mq3Tf;ID(`)`%y-3EaTgxxrM%%3U5A-V8toqq{=$QMFvSLeUn+T7+wdjQZ(+YaKhUNUF0;PVz(6sTZ^ABd* zoi<=n`I_wYr)eTI9`h15R1AhGr-9Z@<}okjPN*MwMhh*QvmR%{)9|!$wiWJZMrt|b z+G=g^iir5#;&IS3in}YnSi}*Et$8j z!M?J{n}3&S4~G%S(3BW>~AKX4iV0{yQU&rD-{emVt2|<^M+ryi%9R)LQ&=x zSFxYvkg>3}2}v_Wf$H5CJ@!ZCN&XzaZsp|ReZ;(syLx?h;+))&e6JDO@fED^eEB=I z7mA7BK6D{icp59ht}x4qjKh_#qPqB+I!jdsYLCpf;BsX@|KlTStrH48E4?JUuWj%$$mn2dX+Ki1H_8!VM#u;yTQ^h6H*i|AdhI?7!4D? zallM5b1u(&5UlA=Te<|c6bu_ZIlJx>Qs>p}8=qth^Sb*E^+xc4=YW8|{M+#t) zeht?c9Xs7e&Q` zbtKvlL}JNr4*H3buNDmmD@|$Ym5e1C)J~yKe@RZ1oW~SaQ{|N|pp(!SXwwO%zpXGw zPHFYZFG2)`f!Qis5ueTvgl}s?nr2%%8jcjcs9wqG^a|##R`h3m>l*!mi~O&gI{xvZ zpR-{TdWF5_z37m0`M)g>7!&lm{h)Nz9*AP{sBq@!`)}vP^Hy9gpbL!_UN&0S^hgjT z;gk3N7GJ&6#4|PM@=){0KVEEU%&J7~z_!9hUP6?&6`cyZGUSZ3Or$INKZ0yS<^P67 zxD_`0ugf2>>)-!hTEJ5w!mLi~S*us36W+zSwc>9_PIiP_{vVqyZ`+;zVb8g!`;?j! z3JVuQ{;w|*VWyMhC^`JUIgG&nImoLuZzMZfIsXIwWBX8ul#;>o|9=+5MQkY0-*0e1 zOKQ&!5CLYd4F$SMIj{4*33>wn(yCH+OBHq>M8i*asdcomj4lL8s}e?e>eF9&)*Jc+ zgdfTUG|k)1`?AZX3N7T-i_FV3R4>nQ5ObYh!XPtTbL1M5HEAFwl;%%FM}s8gGB?NrL6ive35)$yUVGRpx%qxNopHZdHI*2EoqaVb zVS#QN-G_=RIB5H@XH*_g3v(1iL7W;nO+)p_d?!M2Yq*w)XPs;Cml&??5gNNj9Rr>2 z@e`rDjzSrA`W3?r}dAip9e9n*RIqFJHRRN4I?iXax6Ae zn1=ekB}g?EbI&(4Wg3H!C|eY=D97B%K59mnqPTKuE@AB^H6S{V`uVNei(WY(yNsU8 z&4D$Xg#x$y@T&5$RF|^B^I0v{=#FB^dX%)kVH@7XY>SsHcOU_@>H*cs4vpBKgE)dh z3=B?K`%R#&_7Vvv+BSDR6~1u?OE%HMX=5=I6aq$>m=-xXkI7$fDP1&xSDG4KWiEiF zzc1WUgGVRg>Ke0TJ3`W8zSM|jZUuX_SZD|r#N%FlUt`=0QiUQSJbNs|m$$kQhPLSY zxE$AVpW+u)r%|~`_9a0U3;j9X^V3iRTQW;eW2${aIj1nY3OtPqV8tcy*7bcW5HK0* z`qpI8M0n8_9139Q3Smj?koV7~O~OgiYeyH_kWS1R4(qV6W!6!=i&I^b1|E0A77bKQ zUfS}s;!290nj9Wym-{bNN^2?}#x!A6wM4308MUrC?E-qKENgspjC~%{-7~b!*c4_H zFgA&4>ZpX4Qv=8|hP#OTZ}jc$id=Y?)H)?B+3#(IFa+%A>XnAxu@sYDG+Y;t z+Y?UOGH58-#Ex#z(s>LM#4M%WgRb3})=G=f;d&dD0$8`h(iZzaiEz|dh6_~=<%q6* z7=$sS@92vWQ!DdFUi=%8FK_Swf<=T~Ui9Pm{8zdak{o%|ccls!E^-RYW87bFtsL%6 zEv$gfq`-KX$2}Mu0GUiHg0Tkm6@e8e&~3^}B%3(=X3d4sub&PgJ|e+>0ATLQ?>YRb zh2>jwB$`(U;S%=;Lbp6Y#LJs=%-W75V?FuL<$%t{*IYVRoIpgL=|C9M(sa{6{&?$d zIt&L)P_EBNM}3PmDL3hXOAOgh(|s%29O*_>tTTI3g=(mEQu9Ojz~mqPDInM=5(#3p ztzGNTuST@AzL70NOs=?O)hS`fHKv|}+;r<%mC6lQs8Ho{K5aXOIc;pLXaFIZLIoIT z=3c=qmi&3yg@D5WS|{$8anm`mqSjHkF5_|6I{(E-KdiWnui+YO<$$SfQ0w;oQRybx zZ(tsS9u@fu*B0vY2MlcqMELX;wi-8~nR8Jus1$5C77fDdkv2qnW6FXfEHrWrcWsI& z`Ipu|-lo=__^k?ukLf}e{ub}cic29K#u#ggUk%A7XiJr=UlH(@O~RY)ReG<{#<&$| zbjIk?n*~<-{8yF;Gbx0*tnMrYO3=jP8kS!CQNvd(=8j(|sSOy&+=}OwQy`6adlJJ0 z5a0kMN+M|fhdR?GZA#R_wW(&N5H#itu-$J{#dag&*O@`2F!>iPIF^q@|C=#EuG0;Z z1eqb2LvD~y{ckAzJptzf;8p?ZmF?-jMySjuh<}N97C{HyhZP(r;NKIW?pogo(#TYL z&iog&H_0jKH1nrxxT{_-VFG63Z7*O!B^pudHC`Iq=yy7|S|m!oLBp$(BfvAhhpB)D-Dz zUqEwA5Yp4deW`V%?bvdShUx=50{!R_3Ggeu;(|h8HJ)4AOS1IOSEfi&H-Oj%? zrbr$A;LGd$iCWii&R%sMGajk>v4!mC_b0l5V@-82*>C&Zw>6oozLWGdcxh=sZF1GY z5c@^2bpxe3_j{JiOZ74hkZhB?$SDA|+n%8uKrIBEMgT;D(4^-5A;qRnf!MYQP6s3(Z0OYRL8>>)9Z$YVb zJ5UJ2Vb#PJpAyNWXY&}75s_nWT%gnk-LB2NbPtsSI{Y27PzcUZLuy^h8aSwM^lk3% zJ4l3olq&=w##9M{)2=%LH>1@P+pD$-IGvt#{_QpI_ykW$4s>^wn_%Rp(slm4hJb;U)lt|^;HSp1jRr$Pa5|#EbTx@0@}!MpWj@4YMDtIt9RR}cSr&6S|IJ>A4T^#dkM&RkPvg8JKZf@$#PB$6J^-Thakn!2tFC;-L zsa|v7HN;M!*4KNZ+0i@{BIwKkHjJyQjF@_6+_xBo`U4qia`LjZ5}a3@Yn;zGa~woa z>q3Rk$f$~?uHcYk<5N71o`i{s>L>hbdo2|F=jPmMt|K?$ekW)fFKXR-A}V4qR>d%c zq+)FAI`W?FAg(dQc91(T#D!de5)CY)$_@1L_@5j*-Lyx9kO_k#_Khlz2psXP zN;gak=e+8GZHJvt^TCHLold@KFs{4e_{$3jfB{_Wa_C^<{wX zPYKi?_u%mP!B?$4}A4Jb({z5jqi%cP$%M)kSuZ&p;z;x(;9h0XpoK4GOq01`DL*AKDA8fosDR9GS?)A zwn4HuDgQva8v!FIEcI@lF}qiG-MYA<8{yZA?Jn*~fEi8@IB@a--Wwb3vsaYMuK!wu zPRniL^JQt3<5gy-Qwlw1j#`G^r*h6=SgvAnukk^>rV*~CL22f}YUX#8aH8!93+l{f z5C$F5n!M+o)>y#$ujQJ763MFcHJ7H^a~YFaF*^cJ8t~da`C+p$xtTM~AlV?V5Qt!N zEY|vI?9hhjT=NU8_LgbFViaiei7;wm77UnCfh6!XvZFZQRob4QMA}4C`s>@(b*Pig z^w2wu#}zBJ`VdoLQ#{;b#F$fEJA3ATwXQ)G-Y=s^6C%)iTx@_tjKAmh`Umx4R5Px?NsxkoE{ zbe42aHW0trkL#QtfBDw<^yS5kK9?~v(Vf&=5g53rEG4!>3$Gw}xzjfEB!aOU(K$mA z=^Hi#skGXBie#}xa)VDbD*U>2QAPI(B#P`8&qjp%w9CWRrV$H^F&k=PdDpFX;>-i^ zsq@zP%On*d+&}UDUR4F(6!?Sp%QF5s&Kpb1#0tJyWKR140+ZA}QzKcdP|~NIC&vOh6|Kuv&yhrM=xUtk*3bnF(GLw~jshVr~9^^PZ!>f^{QBzNJjrtLL zJ5m>l@22cI+ZR#IQeRiO%lkNDg0g}|A+lC*AY-BQiPTH!CBCTdGbh4VJM%Bo%on)w z$Y}93g-=1BKFV7hyg9AtG4UyxVPova7z(iqO;+E_3cH%%5IXHCyvtZ;Rb%*pG`g8g zy6sAqZ_}#GNnQY)wqj`bL`0~i6_txT_FesH)br%$Noo-Gu)r{x1?!%KuLwhjb_6fF zwsU^b4!53FNn95^ocw7BXF6`um;P*72H0q*JG~tUZ>D&%PL&HW%E}wJn@gUKTN5f* za>Q3tvt{h*j`M_8*%$ufe#e?*pUxjza-zt5By@JD9Yeo9kzfH!VXSw5@^v9_7E+Rt z#)H7fha5ZhZ9G)23H4(Idnk}fvY-;-+C?iko3)DdWEK*{>CEBe2+_#t@iKO|k!bWD zuM)F9^wpq8kUn1Clgv3sJx8u3!sj+67D<8U`2m$89dGq14TzDYQt&|-s|oc#$A zBE65JRS4RgP7%=L$oRw$veiN%T9-UxT^ThwDimvcx@~O#t6TaLaJ2AYP^$3Sf2er0 z(}SWJ6@|ww6nUfcH`D}3a_4RG(}kOkBj9T|?b5dKVULWm>*Aww5yuub^4N==$A6u9 zlk~XAcvgFY;7uf8sKj>6Jdfxn^1YNp1BWKy&tJicQ3)`+bc-t*G89rlcDlcV!fw;O z?-o*%Fbasf)KR$F@rSny-4k8?IfZ>La=@sv^OriZ)>1XH^RJ8ZAaDREaRm!rpORVX zjQ8E_n^5278Q|pD0EB)CoFc={;0`rFaXq6#Jvm(vqaadTp_LO8yD1C<*4N@VGmjal zlA=*H);Fv7lo_A)y%tbw--a-QABHmpui%Qz8nqFyLO-g|sJAec?Bi84qQwAQG*ny= zx#dJkt(Pk{E+xN9Ht*iqLj!q4qDa6I^RB`2beyg-jqb|! z+Oab>*)KHWTO?+k?&7UmVbqZX)@+?^3@^1S!aR!2nl5K5C1apR*g z>-vYD3??=&jyU6SCDf7(F+47drO-yW8?l%w;^#2rh4tG|(Ay#7T%*?B(MhRTH(S{N zS@8(a34($WU+S)hksGLw?hrHwW0(TgJ=s6bR;KtTLl-ANPVi}-rEz1CS=1zvL2$5t zlb}uL?#E)*L%(p#(43h>Bw|M z;jZjC3p<&|oEFI!w5X#!hlvDyDC#n#s6wPMYt5||HTU@9CX4alj**QErjSDul0?GD z6cL_oZJb`6;=JxuAFqK=y2(rHU?U?O>Vmvk)?Sm1^G)A+z~H1m&U z=!J2wx(2gC7;RRpUcRB-FvbE#*=U2`Zr?o?K*X|ouN+s1#!oMg;t*mQYbmM&aXdVf zHlvZQMLUY$hvsS@su`^);k;0~0&FcQ(0gzt5tW_?S;vh*srpvCZAOeZ7Zhw2BD}R?jmaqw?gml{2XOR`Dqu&Et{>1sib8uY2MfoRc$V)>xO^7%pxwGex8p;A(S5MuH&d-2MKlxstYz*dz~6^lt>7Yo5Dc*&;KH>Y+u*W zFAO>^pkXAe2<-sU3shBaQtRmFFz2!JrjYXP^n7#L()w9YIsrArTs%$oR@=#{6fD$T0-!fQOP z5>s9&h(J|#*S8`PU%-l?hGsj{6A+H3Cf7<5x2O>%kiE%1I30s1h|`xjYIe z!xy^WpIUo26~E{TEUC~ zTGJE~Er3(FIe&6sxHG4Z3Dg`nr!k3$c`)F;2ZiJnR}6zT0#Z3UDh@*myNt5oTVi65S%bMmZ3t;Dr>j-}B!EH*7a&Kap^H9+PT*3lPs# z3{I)KtaOGK>?r}qba1XogwiGap05`69Y%fgyJ}SZrh_Eqs}_aX*5D*&9#BUmbf;s4 zN%f$tBrI|Pi0hF=w9AD1Qv=$)He|tJLb@1cL2d>>I|>Yaew(#J%g7@CUlP%i7^km@ z5MZyD-ig}dE7+(xvfqm}oF*u#DS4OVpRCKefCe!0U?CEa`=#bF0{fx+ucY`>$q9tT z??4$oV!--JtJb!e@Bpf-n7K_g%6W)69h8Ywsdb>tIq(CE7&r~;b03hxpORrE3#qct z3-&Cp0DCD@113CaRVi69&fkkfTsd+PR z!w$go_rkU%5V18cBbxI~st_nu##>hhV{^N~Wj5|AU4oz1X*_ixhrbId3!Z^7!f7i& z3ojeja3-KH27qIH4=D0P<=au)+sB?Sbi*)}AXtFf5gxbpZ0@L6J+&@?ht3$_&uz+b zAh{=nTmuSzw-X6%;E{(-qAU9!j_8DjLSCs{b)D8GQ`l~B!~lT-Ob4OYbM;pinI*3Q zrY6E)T~qMpETvHg`3c=1NfF1yT-o&6uM~wLff8_iOcgLBGa$5D>p(cHCcJh8g+0E} z8`J=w;*L$i9pFsy;4Qs~h{_5$B-ynqxwR63Qfd9|ojGsS><6yWxHGmV61f5pQE;0y ztm;y@RfE!23%fHK#+Y&BuD|=e?<&fQAj5Vc;ZS1 z3W2=h3UE{9F%7#hw+K2B!pNjZHJO8S=Uv+*>>~hSw_;vP&fQZYY9wJUI&Oed#=_{1 zn*}NQ!aj+iW9u!D&8wU$_i`P#`qBm$yoOVm#597vh0;^J7k?MDo&aNtdr*Y}Gp!Wn zF`=N8W^cZ5@2c-Bm?SSvexjEd2p;cMN0n=&tkf9M*x{LLI6Bcnf_9EwN`e_Xn<}IvdMAakc-|Fzep06E+GAPNVr_65eV&W-gu6deF4GNxNnj) zaL4;v;i>oK96bG~BLkApA5PD3^RQt*O@12pjE>BybP&PZ>qt-A)6libr9|k!U9bZ{ zl7{NqeqWznMER6*HFq5uyq4Bp2P+{$rIc>`eC1T=l@1diRN94iY)Vdp82{Qc%`vpZ zeYaOM;nj)SP9DTgVRiq~!v3Wdm#J#6{RJ?qqAmm|xm=x>9^w|FRYEYfzbbh*KFnjF zkI8Ei`^Z95zj$uvIaP@zd#%+QXKEtZwN;f&^Z%PGq z{L#5UJWgp-bFl?P0ZApQ9Jr#(0^Kb18NeGp_L}DFRJqC`Gew*UiUV9a90tnwQ~(#q z%b?kY7i7&PR3XqT1@L%p5<~AW_pb@j0;4yfCNTblF8z9!8xTY|ve$1e! z2DCIaZ^G#fNWf)AwWytz1E;|=)F-ulAxFNQKlrW-_?|PJOECHFf1O+i??P`Piv53p zbC*D>-{F7ADXmqRp2nO>9>*dWZ)|D3u}>9o@~i52fi&o_0tv@GkgsK)Xkcux-Wpny zzJ?p4y%*h9({}F>u*4t$OPxZp@VP` z^Hb?fE_7p#b_-n#JZE!wyDtkU67x)v?{9fUzhk?J@rR#+05BhY0sZ$VPbYqW&FD2; z#UB>7o1(U11ndvSaHF|KUxM8K;MU{<7tp`a@&^{m080M~s%?b+K}6c`cK9E_wxKv0zPsljMxV-6If&9G614fAdV+S;<2%iE zcD;*@881R1+;&A`WF++j-m4uy7Uh2sTq8tr-Y1WJ%D8vNtTD-c62!h|g3Y*8URtxU zI3C>7D6vlvx?*7yf+vZ`zaq{=Ec<~>$Bi9~oy5FAZq&I?Vx%Heu*TkrXU(JJ!KqE=k`ZUqQbz|>zIdawX4o4cGw4$K~1e+=FUt+)(mvS_K7 z=sy645<>HuHEMqQ+Vatuy0{b_;C7gP5{gG z=YV(4u7DUV|C>|HqG0+%jC$3R<|;RE0=j9G(N$hhv{WFM`K@KNUdfgvYUjq6>2$m;fX}L2sY%g8=}hs@v3nA6K#o zPXS0lms;QX1x|od_*X;>oO)ht@GxBxOY1DP!D~R0O*pT-wXX$`q6h{qtv~t!xPxXP z1<}5G5isk399?7uKBKkKQ6QLnrg5cH)ex|M|>=s$o(GrIV!sGX9%@%#|AO zwq#5O%yz5`%q9*1aYKS;o5e(@N};n%r?LkF_e>DRo=*e0qyZRDC&Lunat=mf{P=*f z&+`LtJ-rWzLg2~{ZgSS@?jHe`FdK9(v6TyfRqb_YoNEra+E+$Te-eE zutm4We#7V=9{byXbZ%1&!X&M?_p!$jY;V;*-xkL|ITd5*KN(jUerf`~S8L!PAe`&@ zs`>~?DQ!9iZ+r28Y%m^vP0lPRP#m9e3Kji>QQj_m=LDSDWnfGxN3Cj?IKH8P^Rsdw z`QU5OK*){6$JlRQRm-L^n^t*ICnw-1J@$L=jq;but}vHymzOWB!7_IqN34OxFP|hn zX66xg2r#6*;0IrGgbEhkp=LkHD{cDAWp9r`N$|1>TlH>10Mps~!w~+oW(0GXawMkh z+xh#?ROCOfgjy-NUsc^EGe=)!#yo{YE^47(kr?To^Y;OS-#8VvY=)}J4=NYIGjAvs#`|Rg_-u_?xkFVpv@$tfEUF$m6xz2T7SE7v#by)x8 z`ICu>iB(Tm)0BznG=_=k#NOF6jK8=P6OX)0=`vyH2_~jC{$TW?|H1YryTqlZTH|=Pxw8^cFNg8Y zjwQ%y>?eC8Kv>y(P@$E{-USw6)l}>L+1i27%y%u;OHbxb0y@jwYLBI+=@x*H!U7}_ zv?XwQ%I5wjf)W56QpEK;;0K2$JGFUezDv6->hdE56OivT)31}i<3S_iKtlw*7LUY{ z-WU}C4%MW|;>YCrnKVqGfsTq9>ot}VsLq}G<$+!zjdJx_|uc+Nqhz*HtTG2n3`Nar~@rq+ao%HPdcTQ4@3v{TAi1P{DjB1XDb z7AyF`Mq{XDx=Z`CKJnes<&Nd2a(44=PpF4HXVmZonT#*~= z?bM=b?bYYekqGjg*g-GKPe8RK_AjmIOR+P(bkCa_TwpBLx0bVx_ZU}PPP>jqMaG`0 z4GAL~kLI}dvLDcx_sJv=-1z%Wv2iZ}>j6`Z_zw;R#Yo&imVTe>;teFXc;gn1B957h z{ZOUdYeIWo=T#3}UAl7(`^ZA-<0Ak<0=6h$9AE6N9_eV(+bvyozc;UTgEV~xfRIW7 zn*>-2ZtV|=j|V8p&Y;|FWB&q_cqrcQwTQEZH`j(wYOo5TGOi-*_;YLpz0f;my=J`@ z3zZm$0!8@wV9`M|AM7h@rjK%+F3HLDUFkw^-%}N_tTwEQInD?5YDuKx1kvtp=oAA-GRN~)bYK+6K2-(f}e&^h++JwXQ66Ve zS^pj1TL#yzfa7(+CGhGQ(Q>$hUmT~hf1O^e2YgHT#!N zG)jqBOG&ik7A6s&Yp-Fmbk?aL{#|uI&NsA+HQrxgYRqo-JydWZsF;)sUTe%Dt*3J? zD4TA5kbUPFjAN4%(5RW@g42q3 z;1@`)m9sYHKb_Si7O&}zyIe;8h-tcx5vlkSt*cJWRY!}vYH*(~8AN?4^I`(#Xxm)J z@GACmkZ`DMs1}uGef5{It0RsxSO;sPd}ByK;e9+v*jQ#FsW~-?f8SyX$O%mm-A#rMlAZZ?c#ZOiHF|#5{&55UJd8ryzBeIK3pbc z8C;|-_IdF#$9Hhi-K&=acqJ^-q`$>byv4132Yq5Vi<*r0a`allOk%C|pgK=om7KZ* zKW3!HuMa~9j&k6N$O}nm*P5&S7%JPjeSb76tGNAqQrBmR4&uJ`TpHm<-E^_cP>g_n zgBFW=pXL{E5ouw_0cb&lzB@Y%HBS@!uGmSq0l*qOE&lbLe?jDzR3&Bybq`aWODbFV z*x>BjBU={Rlj$P>54(1mNTgln=n#(t>h#Sn?aA9)F63t;`-H;bS-=SB3%ucXyA?6{ zvS9Og>T|H5o($ZT}Vpp`IZBDP|MAC2v92EH|V2zngunFcV%soXH|fCS|7JY`02j>9{i}sCq6} z{YyqqkFuj&#{kvLNS;MDrdr0x!RoSlY)@Y$@lSQ+UEpqLV>T%wqS!dCP?2t!`gN=g zD^7yVff<++H#M~AV8Db48BW1jT94i`KWAQWyFRHfc*wC*l6>&GC#)x|>JO(GgUu3d{+Hyu6Beang%i z@70EtJVPvbICZhk#zBjmOw0U>leE7A&&Nt$B33F-td~D3B!)PM zl!S-SMb?Ecgn1~HG#3c0mBfbM(?rGAgYX6kyX%SYe;YBsqOoA}hnN1rG)^l2s za#>aq#MT^Ub4vJgfa}Z>RQWB+Xa5B7?5jJ*6WED6Kr!NGqBA_AZa_AYAoIO175$nG zD0Gveloj!b1w9y#&4rh6E9!o6wQ{DqB0X>?_?m8ALi+v%j!l`Qn)(2nSnk^upRWv`-7uAQa zB$y^Fyea*eq6Z399byO`RR*Ala2w>$YXFX~hTPg(NJD0z!jO8eOTe@yk_&kCdR%fL zA#w0p>!=QyYW~Yi#Oy_5G_;8J(kBea`NZi(9cnz#b1xs`2F6?&(J=X{KUV>Mwz$VE zxZndwBEY_YI1Pa7=2=wHbpYtYYCueuM!pwWCMyH{^nQ6~w0NE?aAx~CgR|6;Fo=>a z541^H&b&u4fm@+DprRghdg}>b4CL4>sX5WN=>>kd_^Z4swEl>-4L;j`fwT`BlFgX` z%Y|+Q+t_PCI>>!rvD?J(W}hdLdO1@!f_tyW3GuuMsZ0BCf$1^5zm2pn0gN5~kGsI!D9*W9$;1`v5+iT~U2fWGeqJ-1n?nUmt2HbBj zq%9k)p&ZXvy`j+`5V7!PzjYx7r@M|83_k;x!-8?0GGj3+XAP?lb;@4Xru0FigNv~V zlFdYZOMm07SLUVSIf9S)^;Ix?>{j)15SL+P-(}ef?mN`PIoaqi2(FnO-_Ej z!E>P3;>jhKOVrU-558CoXj1tT(J^Ky8{`{5aT^|ldaoW*9?oz6b>e2{1Vgm}4CQZp z&Xrt7zz~msuJG#No7uJ%91|O#NA1*QF9SafahT+Ssw~J?fR#y2UReoQrQ+E+D2`IX zbOz`H#v5UX(@m@(Ht)-sUtYo%bLI=zy)Fdnwmi|AtLrJ=PX54#<|6@ZN>7JN&)emL z77cgw@jZR}YN&cp>GN~J%5{Ci@@%fiJW~FjrILN;NiSY91j+pw@RSfX$P7OwvG4Bt zRK22p*dOwTW{d2Y9*_z431-71``>rp4Xy@O- z0FM@BT^c6d@oqp2*+a0#es8Y=53T3yDn451Ly&>4T4jjm>+%;V#rX~{Ss9OSEZUQS3E<` z4ehgjd6Et`iWsR&!G>7db4Salx%w1N%V^X&3xijz!#?Tv(*CqOqudynZagCfo%trnS z=9NUPLY1e6A|N|HplfEM)xH;zUl8J}e|FJJCgp8=rFpIFuZv7f%g=ePVSumRMG+x> zNHKA4^Y*hqUE#+vOL?yg#5E{)3-7AsnsXZK4faKwuh!){lyZ~@1Dl-%-HT!xhHw66 z2YRXf%{zI7x8h$6_b!dy9T`+Wb;jS#ETq{m8-231mQlDGoF8ooZCtJWy?j`)FCcCFj{F}lKE`aY5qeaGxyu!GP zv}rVgC?85W(4+#;Y7VlGkpfzY!~G5)jdBxe<~h*+0T8-CmhUZP5!UaK<)g-P3j?n# zpJI`)xSp(wk}P+B_ao<6_z&|bf7oiVQxu}U{`W{8#a0qnDp`ccmF~|5pMj=5b@q$} z#rc#?L5LdIY|8UqaDTJwytvwP+~oiJXO!Iq}|W z(`SwGwhOXLcCz(D-g|eLWv}&Pqj*wLucG416{^ArcUP`A@J*E1I2M~7r|qTfnA1o+NfJ zgA5(x|^3`E)U>g~sx-?NdQ0gvY zuI&lciiS$0*7&u%`xx()f))_?k|rGdyN||PHP}~|C%g2t+7Qqt){W6b4MOgMDCct-%+OTV)^@M6=oz%2&wZzhd7a)J)WV4?B+RD){fPL z00x!H1D;^A65_wPN7WCjfCX=1!ltZcFa9un-5Co1k@%b2B_lR}qVKHZ4W2w?0n&C@Nd5 zvlx)Sj5SU9X`X2k$1?O@V^s?-D`zwtUZ0{1vMQM4_zKfx_#&fgO3&O|zm zJV*0#yhMU%2x6ZW=^T#DWKAtojwU=5X9dw%q`9;)eSbpx;fn~1$OVlc;*$u5EN;XO znkDO3mpOEYAI~;QsQ7iQsOiwK>CX6BzOv7lXQ18mnA~YRs-R z3zZsy|0K>FR=7Cf1qmM#6zL|~Y#Jq#0<7nqON_1UXEMuU`f)WYldfYrZhP@E-av0zhL$r_# z>r$2|>8K}~LrFHtcW^m5hQ3EKCvu;er|Np=n>u$!>_evO=D8e0 z7YG=U_qUq15Ff01fF7RDV%S4k{!@JA^(h}cB~yrS@OVQ`M%b7(_fSr<*Xipg-omuT zDLhx}b+jw$+4$*~n3yP$rwXJ&l|M0qVN&%vxnYRU&YAfbN`6V0%VlM`rt>6qR(`C~ zz~yg=ZP<446!YN?-Q-Yey1KW;`0GE7zgtH?LJxXgDlsYv8mQo9Go-?4H-_SXdaM3r zZlx->MoW25AVNw?UEeoHY<%QYW`-=>|6=8cNokNJc(vEZr_^)t_&w^pjt!X<@LG8^ zf!S{a;}q|=%2V3?g@*{>1&i@;+l$`=T{E>q`vQ`JNc5uVBq27>Hn@hE(@-YgN-4XV zy9X|0maJ3ZB{PM0Ef)+H zj2285^c?BiF;L*O%# zcoTn7@021*E%9~vHn27QM;7ukDr@Z1jT!n}mS6PAox}b5;TPho(V7;k(fa9BUc-iYT|X^q z_7+?znB7;Iqxh@RZqy26wEaX~jcoq$`6Mwimql--RPawZU%qpv4<9VrTOp~&m47#U zyIcv32%2c7gN#oEnHLXOeow+tVpiV(`EOxF?1zwsf84KONz*9%iv1Zss4hI9DWfjo zFcfaaS^ML=FON8e#v}aEe7*#UjhDJouvv6W{i6N%_954LUd#1-jRsp$Jq-9RM(fUi z$*Qt8Q3!;~U2VvHmyN6ZM%+(7U&S0VF-G&~i27mdOUm>-=(_@m&|kOl$^p}?Eo){?~89b%c?#lR*F0MN}JJCi_|nd$%ef; znh70cL89q|Pi4RL^3g?xiDnITfTQ3@!&!Ah(x>4t(T50}(s zp;i5sz!`Yi4YHE;M-?Ndb5YVeWOD9O4ECJpyHz`8AviSFm)gE`^l{WQ?DyGtn^Zp+spow=4@TU# z?0)o9Y((GwV=swUxm8+nCSlgbr>gNYxN0uVPot`qj7k$j&+(*6a)8D3q`deh(9JnB z`zC;~@}Y-|ZPA|{Y&^>ALDX|VQJ|5h_#28nio|g%UxQ&DgyTFZ^13snp%@nCL;i`o z8vkeax%LH?{H>;(g4cX6VD3DCZyHRwtQ2|C!d~!hDGzP$OHxA39UMzl$`|s2Cn8RI zH8<|F4y<7XG~_!A(x*BMKbLnD*D znRn9S7X>PFqt9VIoXLiF2hv!yOo=yDx5j|n!`^j>@-TuPqec1uBk-c+@}wBSF`{*=y&|)P9cLa@#u~In@*hkMvld{7K;b$9L+r{9MqCE zJs8w_;qXmi{qXr<1p8KyFe-DijD&JTB+N6^Gi(OD7WuTYmeepn9lU#JN2h`{Bo;Lq zhGL|fa<}1>s|rR6b^F$|$R7$(h%!pkqRs2=TB2qF!{EFH77gkvgjC3?pMhm#!xs8Lw6P(7y(3!?GZ+Ygu|adfU!Tvoz zjq!`L49tEO&!3tlRF?)GAj%fK_b9Y~4cAt{qo$eu6w(^7=%sM_s3aP5W$2T-x=qV5 zgH6*G_a7YT;h&oup5A%j+lTn>Df`$YEl=TNywG$RZvmDz(GNuo#PlR*1uj|+F?5P;T{Bz!#W!@_tXHjdD?B&i22Qj;?hj>E z^B%?c4gxtO(U(ZRAwKz-^?nRAllzHYOAf&rWG)!aq4h}E}?VV4gahf*~lO1@&+ zkfbm`4X!ljp^Nj*MTYk=yLj@_8=Nl6v<$Ar=m(tp1HXh$GOf!o_<^Ec=x)Ab%I(dJ z#Q_0qNd4am9w=m?&n%JZc@73gOFl1A(tGC`%uvSS#fEFw^#qF=(_Z^{?*055QA$OC zZ1L#N38lk=>6Z*HGh&;kplPLj=Ie1!n!%of3R5FGs1&43?& z@p7Dle52HXH5Bxo4vF@KXBCAc_^y0BmmVrre}d^_2ntp_^_U2N`iO~3ZDnBYY8;od z68&Yjvc}h{3B2bvbkPCW1c9PjAs(4?b(F9%$q``jfw4Siv65M^9lDu@kiAerIFG%J z(Z>T5@(zbu#cE!~8e0|7D47f+=p5OZxH(J<7nnl7a&lkfQKwV)plp0AcH{IMQsF|` zW!79GRH9|Tb9VbH7UPf zxS-c-(b4Dgm;0mH2o-6C=Iwq1KYpqD&!u4k*5xJ({qFd;`a|?$(g_t&o*A(70UzWo z#ooL>Q-HkJx4m!8{b@{eH>^}r99&emhr6C1YfS#tA6_L{MLvT|UG&QjU9E5qBpc-2 zWnuc^@mm-?`rxfIUNVOTC+pgml)jgqg;&&bm3(rpKkuYk#2H55lCWSoFHxRQ&xKnm z+0duL`LLqKqdYc3{@d)Fq>`p$&IoCN54jr#NtV6(y}%Ch((lF$(I8!RDq9tM-`HPW zIjg5p+664rhBfYlEnt`KOn^sDRZDnDq!p|ND`dfZBMsND{cUOdzI?{?vVQgq09Wr% zb>)B4R*^nZ+NhO}!5`P=uAZO_7s0|}z@ViOSIC8!)m7BjRNNC3%j@bx#_?ZWhl>gS zo9%$_F}VEu2|1W+<2c^4OiYSgaaKjcZAnqsxVc+00%`dLn*Q!BYh#AWUgmx%K9eg2 zEyOrOxo0%XbTy?*ShjxSD?DpJx?X!pK@IN9(kdR-T%w=3`i1#=TA7f{1VN4bo%Hi5 z&ZX4B^_B%zoUOTa&9`W9lSK>7OS2&s81#1BoE7F1K@w-K)euALr(y(*5>|#EszJ7W z|AObRaQ@-}7)pEvviIFFuXSxw!LlXllJ?9-1>QuQ?b}XAj<4)#s-v%%tMsw9CS%f<`>XKJ!mWW50`gM{C zl!r?nn33q7J=2{B5-fPHk9Wc2r7RA?eRS0D>X^UvEd89`^Gs&O0cgrkgokhoG*EKP zXwAYM0_0_hg8p9YzrNNv|NrvorS=!k!4db}jt)L^g~p{RZ3|I8AP%)O)t(|Im?Wq4 z#3+#AW-@l1pCH*@+#tqtMc(2v+9z-=#5J{%P5yY;|C(b%P{Kd|&9UhD2IZxh+Oi0TPBJ9RI!*}$0+(AiJ3s7<`d=`+ zmp3rv7uNm=O_8o}UJ0+`gees*n05Bn&y5xrlT^(;7X$F+i)CAY5)pMs|8`_ikZR6`u(WGhcCCwB0NBw= ztD4lFTJ$U~Gj+h#Enwr$tg5>@UhsGD6t#9@Mx&!|u0Rc8{EVwC7T-b(&QD^^bEr%9lK+SOobIhP^q= zSnA>1#5ClS%iTK_*$kDo%l&(h=DV{$+p?-yd3WxO7pIGn5lT0(v8-y8dv?AE=85cq zchzqUu{r<-hYjCnSJk*3>DeV@r|uhAX^q8H?YUUD)=C*2223>71k3`=bPQ3>!+}G~ zuSK`b{=WL^IsKD&a9fc&e&{)!Jj_VTgj!9c=Wo z$xVmuvJPAF&_SUN=yl;CL}U2S!`OuuCY72dlDv@CX@QZYJtyRk#+FJo2Clb<^)xyb z_lr}{%$9R6Lsj*enAQau<@fUbW4Aq%$Tt8ZiWMkrn_9o;LVWn%93zs{mozXdKG2>5 zl%XnOuFZv-Y?>bJ5t`l|E=PK5Ni@c)C`^~niW}k{&<)Dm?mbigs%N+K9>K;y7tj%T zb1fm;-##7x_pLA)*Yuik=y5g7CGY?luw%2|A~aXWb;6$aT3v z-QMP>Bs0b1olkyvkEv?+g#|WO5;d+ClJ#L^?$;BRO?^@Hi%Pe#LW~hB*>{v*BPBD) zY$`Okhk{sAaf0t<95QZEfBGAXK?G`Y{P7?v!A$bKan^SG?w@f+E0P5o(wMvM?uiXbu`bs*}Tw!RxT&K z1fmsp1OtDH`1_8d-4h1ibO{*5agq3H$+KqAW02gTWA9*~44FCvD>|mlj5lT_jlbw} zfn@K}1{7I9Q$XXU?V*VfGj>;hYPa_0E%1|*OuHu;5PsSF+-tR;SyfJDsXce;`&yio zk+sRrFwtcy4qz0V=N2*+?f@7typ=h&^-^hYgs4*H`x~*%?kE^^5;G<>X z);-ORKiHW+1avmG-^@I6xa{sruJ_vkv$Y7qn)bZ5YIC`efW-4=S zGNiRoG)*53~xFnp_b1fkX%85e;re^oKB8aBcd@8uqv# z9yeyy2?i`>UOx(&UQs=!4U9Xj27>CKZ>j@{3bg`EOwZ5!=IoB@&L4@<3o5Fj4L^x` z#k?I|F3(bc^_`R{v&3!a=s`_1$FM_ZGJ9phEI_n}-WhTcFo3yi(OX%#lq+~nRpWMg1MC-5Sz7j+UG<5zkrhWvBp^{a>$wkPlUMM{^=bE-?=(k| zVQ13Hr{JE3g1ILPI|!ehL2nDo^39WZS{<`1SOx_vo+mLR*4t43csl*ZK)%J9RN+G< z`-j!&+0MZUEo|newl|vtlLCrzOLja?W48~d0)Ktg(^*q~W>`Jjo>Js1l`*xP+oY%M z7Wnda4|(v;c>q>^(r_&$;9;tmiol`T*JtB;BtkC$5M@ z7}bg!Y?Pa#c421y6bq>S^ep&hrgjGGMJ*$$mpi}PgC7%vs|% zn!JtZeegmzwd(423z^PL^E6LQTU$OzH4~G}yLYkKi~47y4VKIKpSOiL?I;}712$G) zEYs>hFZRer*6vdLi3S;U?^~y`@xKUkyL9+&%Ub=IuCv`5Ay3LV3)^wRiPq$qAdNGc zm>a^Z@r8WmcLM8Qp(_ybZ3bF0$9K}tbC8AY2Fha(v9ZiE>Na8@29J&Fd<@P;ha^c+ zUQ{0vPbNIyTX~&l`{C`z(A)lKK(=72eM;A(QXn`LScnm1;Ky^~;OA5NdHDP`sYAfK zv*Ko|@2#}pDO%n_hoq@qDT6Wu%q_-B0ctIQ&Ip$GgHagK@I%T$!yLoP zu|@1Hh@mEt)Kp1u;NJVw*1XqB>X2-CT<#4)L!m%^oo?F+_|L5zxt3qB+`~(*T3>Ka zVU%MeFdyP76?!Al*W}pfU#o4$H8+!w#)$FvLMo4!3iq1T&i=X)o{)8M*M7`SF-r8@ z%8t_ZMxbQN3`WQ<7`x?Ut*@hvE>pGHCC+ccBzAv%+C*fz3py6rA4?-dmi<8qcLFm< zY0a%Ylufz7J8oj}_4i=q!mppdD@Et}aFPvn2KMfzmuthhlDG93%sUrXT-$ zaTHWNh^q~2Q8R^J0`91$+Z}vP0D#KJ=liZghtcIBeraEvf-^q zUFax$pQnP+0{0qOsWjiE)m9?U>5N38kmC_8!N#PSD*>d`cQ2j;zkiW{sml*9-NxC| zWb+6*p1EM5x=vt^JfeeGb1KI@I!5+J7it91+X~e>mHk`o3fPgC-~K!5X=GjU z8n5NM3dxom4T$x{OVz@+m2|P4bp|#NifT3&XM)d@Uhm$DqTU!(q8d3( z9c=x$x!FANRBF{^69g?xrL%}UJr#obr>C;$Db$(Qw_!uQl{bW*32 zIpUuOs1wXw9npUYAnn=cS2x}dGZbMnpIute=ts47fo&lh7uBF$Sf)dskp_IGTZLHncOBbDSsaE7~ng71Ri_X~V|Ffthui5@?Ou+NyuCG&W zn3A#i#jEpGb`~D)$1Q5f@%w9;Vxv0i5uz6S&QG6a2Iw|Uvaf}J>!u@*8%g!jfl7BI z7WzplCabqD(^dwxk}VXLj@s6H6_vO5?cI}~lfyiYmzuKjc2pakRIgVL%4=_yg)Qf4 z#|8J)&#f_Lk=5IV-FnsBYRdo5>bVI?wvspWCVxaxp9^B zZ+Wt2=6(DGzY4aF8%leV^FhHkP9K2qq! zbJsRHFQH|(XQICN3DQFDp4-IJp2KBppKmA^-asYggN}DlL4k_n206Q@HOqb<4{tqY zW|T!6ok371ybN^RLhC0(Z26~te){adA$TrjxHm!nPDfYt?JEviV-}7qNm5n*3A(FM z#S1nTGENa0eDUu}+i%@nd%kmVleRaNE*OmOvT1E;G{ot*d!)r1My=z;o*zXKXVV=SUo*y-Fe5R)x%p zZVq~cjBIR0?S#14E7v9_j;pNOT%G?fW~zn$!{!@@ZQ9GA4 zp2W%4$(En#12K;9tRSy0`^_wWuJp|pmM)TZji1Y?G#w2S>WUx;EvNHN>P~gL#O`5$ zjVjLGhZ^d_%Q(7E-cmDDbvL=cVoonmzw}R1Sox^eh)*Z48&B0anGY35x0Yb3b+&t- zSf&n&$rA1>*WCoWtG9OtPX`-5Y?^=Nk6^!LTNgA3rYBO`L8ZC$!5HGaoa&LiB&3-z zG4u%*K0_ixyBj0lK(al%!{&4#-lQugyy~YY|IX<483vXr&&?ndZ^uCObu6#5!UbP0p4Czr@!qfVGAnb{$nsuK z(L6mn#0fTL>PY%Tji4N;9v@U&nV3B3$&l-{skGO6Y!z(v3Nwp%<}{2WtS z#%6#xs*y6{xew3KD0o2rXCfkex{&^MCYB1cA_?nSw`!Noh`5YyovHT~2ZE`Sdme#1 zEB41eh%C?DmVG7f+XK!oV6gog4fq6$)=V5lRXrl4~M>=9T?5#xnLVsjsb*dgYzWT1=>zhhN|kl zU!9L#4rg9p@>#ao@j`ciWCGDo8B^qVV`Gw{cRRmD0(dvJ6vd{ubB?9kE4EpVW-uwjLm zW?orNWg9>753I|*oww3~1dYF31EH-f#2l1dww*H4Z367bAqTaeSDoPUdv@T*#TQ4(2&!Ue*a>pFEhy`;jHJ9D2yXsGFFG%A4^kPE7aWcLU zAlI^|W*ce3Qad_;YkjZv?D#uN_Zq0oW&Q2d>=#E30Xt;>V@Y)8g#T3VJcU@gf~FV| zhg~;2WO=(+9k}a%ub59}g#-#Ktf@3QA@lDT{?;WJReILcUQ~*l3PTsnl`fZ9uLLzN zr=rECc1P-ijT!>zq7F&`>PLs8KqEiUR8A>H@s{olc6C@zbsWBZQ<@Y~jE9j4bEf{e>TK-=kb6SbmD_||JBw>*+LE%rTA@3eeSj|v=_d2SZH9s zU<#UCj^-BQ$JgNlFV{86)3%@w3995_%{OGRTensBS1o+>iQ7g^_n&oLws1jreUKlV zbfu5j6L)mXZ^`zSwDt)}Y!n&D7kh4O%g(#B{hLC63uO4=2z?oY77Un0V>76?G1%vY zyN9gI*@K&Z1n!(+G^FDl^Y6^nBy)!J^tequYvZ?be$d@!**O-Pv!GNxv&kxE8$6}i z>fDnbC-7e#2qV}!r81BDGV`-Hv;e!&PQQs6KrlSGskq~s@2|F3pG@3wJIMC9mDS>E zJ%HQX4WD07l?ytXU~Dgh3Fj&O3t;D(b+-*-si@bRZAz|sOrUSOyh4Qj3l`^oS)C`* zJ_ZbDkNJhzfA&`;^4VYKu#-9rpzh(B-(6;mX%z{^9&GZ|+Au@vz;WXATK8CUrJDNN zdcRf{ua(=-&#Bgu4SAkjLJM05k%t>sAO2Top&CvKJM1iUh>?GHmphi=QY;OXkP)s= z-E%3O5;szqnpA!RYgO6xVazHH6Pj>O?@q4t>XtZ|vJz+p?1mY0ZN9tH=x#VRQsp_; zp0YPczuX$R_AL7v>N=x}o7foyl6~3>;^ar(=~_K0+IyJaGwVCCvApiFqqs9)y?n^4 zIgUBpkI%ew%uRo5;-C`+y>mRcCT9~AIDIP5u`Wu&^yATg2i;RqY>>gmlhGt>2?mt6 zq;lL7a$tBjXh)WG)^ao!ZrER@SbhUN@k6vU(>J@K?_hahu}k{mqg!9Gt!+jx?)C<| zq?Fe9CE4Dm0oofes{f2sj!mJQbR|GTTMA2c7=KD=>Mdc1k(}P+0}ovoUO{E*)aK9i zooCwE0&HtM2g&|>m0fp!sldUIb8=wRq3e_X3=98J@FZ4)Z@V*XKkwuWAl6Zre7ZiY zSE4(B`DF}u41r@{-J<2LR}1gM`EqzN(a^g?0%cp{77j6smsC`@iJdvE`o0L}F!C03 zdT=U_2tWL1*(&rYK@+NBA&8&cQ-|h`q_3`yb7Qpmy}Eg+J7Dq_H~lOvZv`GGW(z-t zT%XL~$DdeLA4!}62koyIJsV#&VpIIlB^fzd&hwvX?0=Y-{CpPwlPX-S@s-wh*1y5rN@Q7c*c$V%>+p?wJ> zvvTa&W4{O{EY}R%N1k+DtIj{5QgF5oGOzhXFkcHx(DPx*Dn6XUhG5nY+uh&83b7SN zSKR(Nm`!gYUEPn%C<)wpu{n6Mx1k_9_%))^W4uSFrln||nr%^5 znXt$ja-IYPIo9qBYC-)x#_@578#%B33%zySjE;6Bi@HBeGWI&$ur8k8-AHeJ{U#$D z1OcV(SK*PJi{X z{PCto6Z$iFSIvgy+&(CCUt*HJ)uS`+bb{yK8}~n|Z2ZzY(Pja0G;-R^tX0&JPfpb_ zz)FkIu#I{0G&RU~kTZ`P=7$^xdACcTFqXK9>PaM zR+OGT8@O{@fwS9oS+p#(Nrvh(*eRsW=U2nH{CPKj{QX0J7k4qdC*=WsNKN9OE#xVi zQu)GYZ~TX?SjfVdDB}RjWz`2k3LnPMxGS7|kM-%t%BoALNN7_zBb$0Q9+OpHn~ocP zsq*>4vXhsqPtZ>NYkLAu&ZNH`IpxKl)}-V>Qv0eW75NZ4Hy3^LnUz*lO;$EYx%nE_ zjy}B#KeD|(*;1pSr`1-8Zj4K_!}~dqdE4FC85pxCws+5`Np*Q5habjh|bY{c2tTW4Cl_1idc62F>ngSXqDv17n3UJhO2l_3{NC0({b;~#Omd5KBPNX17;Trx@8RB-v5-u z=yV%Ctn@GcEWxnu5W!0a(H8OGMTKUXfn#?1@3EPLa0tt8!@gf%GQtdi8RkG0*70ad ziSGMtvx{I(SMdr?fE+M-M$eHQ=R}uMeeZ^iX~FSR9JVvFsP655zG}Qu`&Y zQ`Ld>b@s2K{);@x0n_Mw42+Stv@0sjG{z~Z-B@FUmqUL|K2^KddR7#Tq)(-BXI!}w zww_UM+tNUAQyziX0MHvnk7|v?7@xcS+dueQSWWYJ8um`+6(LChrrQ1D^h*CX`58y{ zg1PZEQxZ$*%vmJ|GmQvkkj#2%{n3*>0-AfuWWBb(YW&rDBi7hG&USjZRO8B6h z=wI(^T7n-6o%#px*o1NpvtBfRT=>CgE+w1!H~%J`7u(%Z)`27s`}TP&`sDf#z*L## z|Hsys$3wlh?>|pYIVDsoA)FG5ELpQxib|*)>sXR~8|#o|#!)9KTL>W}NtPMQSjI9l z*=1j6Y-40+23ckXWB9$D=RD6jo$v2&uh*E*`*XkV`?~M@x~>tdIc#wjoSd?$aZ2SJ zFH+H9C8P|V^q%XVr+4XWTv?;OCEhIQaZI{^G)nwUE({&OnZ4f1cMH`wa+f~;s#8F@ z#ozhbH(hV5-6;uEm!;|Hojl%=+>CpS2b~PA^i0^D#49Vdmv%0qLap$_weIuopab~Gdk@~EnRD#G-v9>D zo@`W;qp@>$_*H&>HBqW4bUG2HqeDocpIht*n`6|%hamFGqY*DJAx;y0HMfG?657|r zhH?-87pD9#oxD4j9nakV-!#U<&eB(}PZQUTk_^lSF87aP4`FTI`85t^OBRfMq$S#& zPRr&+coO~WB88i1Bl?hzj49sgyKXtR>ey{Yb5H$nZmDN|5Jh{qZ9-J^;2=yGJJndQ zX2K7)GNs%PoOTgkksP>9l(p|Q9Zs!Cij=YOY)SGAa`3(cJ@2WGqwz%gQdu zS{3t2)!P;jKASj`EBSI+FR{U#+ehIm_e@T-5f=Gs%l?Ju0^HQq{B<0OFj*1`4 zA1Y~i5Qb9zSRGvNJ}#_20p2`{N1^~{fji+XcyslsaEDQN$h-uqe?8Y-b76SlD?RV| zFaL=d#dDe*lhtA#)f<^>3-J#AiLRp|Yn`#P$9d@)PAk>{eQKhWOZ4fxOxY_fE0fzX z^}T6P9R_HY_A^~0m?-o12D-|QRs|8e~dO|;EdZz{#~<@_tTA3Q^eXq{aK ze^47|4(zzlRBMt1AmDO|hnA12uRl*gO;+#Ei1`loOQQ{?e)_Y6|0AO)s+6zu6c7uG zg0<&ePT9N-t=g4{`ez;BBQ47!%kN2p1~*|9!O#e*gO6=b~TT zKx|Dsxa8P-6wEs^=%oP94vWg?Vn9fiaO0JT9%EMq5%^aW6>^cnem_%#>B_W*t$lGx zUozsj{&(ndERQG{GTYfb;IM#KymU5kKnkxAm{5QbN`D-)Jp}vwdX7qJz@VOt>wp2Fp7Z=Qn#SVePuyl_HAej@9>Q5&XML-c-}uBxbXKRv{#pr8-Qme9;Q*`l|tJ{8@JF1lGr}n)P&7Sp-+`ac`)61^1PV{Sc^&L0Sc#L$x zZS1J#%`>K_OgmyPpx8UNs@qWG&2K8lgWA=1H>VmtmM2WbsC7|^MVVEPn~tFK^V0?x2TMyY7eBa zx)ydPoyfcP!lLv6F_cZZYy(wmLl8ZO7U{$l=_}~sv|4tkHA7ma5X(IsofgUHsCVLp zABXjR`T0MkZHZGY4Ku#8jB@P#V$#^MHPOUlMXpKL0957H;MI97$K7~q9{|*DdTVIW zOqj=PEj5F@121^9#<)%pt*ZUJPZ8==_IB1gM?LYRv+7TZw|1E;Y2=Xg=qdy&i23t) ziR0Ai_0lX~Fgdwk-9*D_e0m!(Yj8oc3yPh?-~ytrfJ6m`Lf|3&tyhxA)38G*gTd$) z>rgim)T74ok?@BuYN&s#DQW7C6ZJQAiJ^%1#w70-o!{-$ zC#lxp0@Q*5Sy$G1!-gSsQ9p#FZy|ZS3Fd&_8;zi?K=AjGp;1#SB${IVO`EX+kCLo1^aHg)kg}a`6@#GXS6mR=GW#!7MA${RW zCk^Ws)w{J{y0d|TWTI!?Q&66nAnFgxhaMHufHzp@GUn~~A9?-?%5#yKU*)6UNjS-W z`sU*icRJE3I4%+eCe6;a_A!E z7#!3y*d=>^sSEaH!3|v!sJYP60qM>!hVMw;KTq;U&D~8ClKp(4suetI*jGNM2*a+c zs9N)zDM220ny9xYt0%HO{adG_=F$T)z(hV~+8;;*yGQ|K4=zE~0n2K?yecTE`is~3 z-pPnTfzC*qSoLODL7kCs1xUolS0?#)S{BO%juX%Q?TLT$4aQYI`5H?%d_sB>SRWM~ zT)s3ixPKcrb~Iygif(ZriL8Ioo9cWegR9)zjuR=cLF_**;= z1Y`Y<+PRigRyfYXAcN`h=pNPi+&Nr}i&ZEc_m-UaO{}{WyO+YCD*?a z=((g{P{)ZM_KJVk=Fm$J136su7nBwkFVSH=m9v!lxK3`oim=WJBAb>)sdgjHE>>e! zq9EP5uUSvJs<9T_V#_9&*P)|l9>oZ%5iDz;lvFwDV`obPX8z2g7oTD>0P3#WQ2WnK zJ~#3Usv&!QzclGyx7@26ccQ ze$URdZJZ;bY(DJ^8EmxCfo_Nrl{Hq?EJ3y6{djFo+s-O+aJD59e`N)3TNt>e4+nQ1 z>wsYP7tv31I_;0b*t(Vz9%7)#Kg5VA9;ECe$WDa z{rWY`yO?wn_Hit9k2TwGsO1qOpxk9yRf-_$*IhQNXjb1#Y@JladbtWS2W}jD;r2r5 z1?BsE$bL$Fa14yj(R4*QwAvC(hmlE$%r zZQwO)Wqe-I@Q0~vM>0|DtzM{gm6dj=^W&DiF~zID)bS!%&#H3rZCfPL9=HevA&PeC z3$LQY-0pQ}IG43)lATANL~#8z01r2NiqWx*bc!^*T3CExOG?>Au=Vpv^bro0^A63hfUx}9gt%W(3rvu%KT|+>DE(4~Mx(7}{NN8CK772p zX~zmGeD&2vO1V44HoO1>HNOhii+p-1c_{bvQ{dlLcHJ^Uca9BQ%-Fv9CRijTMpmvg zQ$fxrc*U3A$+0MjlEm+f?@;ibMfld+D}E1aAQ>)CUVnZ zh@JponD2M0`{?kP-ZA0}w>T}Ot=IK^)83%%=z8HIErpuP(HDSZguH;i<=@~}p&>w6 z`0-VGwa43-v^e_v@=8cZbUb}}U>#MnEVsV4)gmw$ic zcdaJFQ|~4*Vt;7`sE-cO@W$%?je0gN`~-oMZW~fZKn~7UbEb6^AvQ&2HzF)-$tL$* z5q2yqn|!bhk-_Z^*Y18ZrHay~CTk8ADOkW<9Ws#~Ja5acqW3qR zfCaM;Okaq;aBD0dB1}iMr6m|OG{V3@`=F=P)zzy^S;cupA8Ie?daIxtPdhWEAXN=O z1VRc~pY5Cl2TGK;FSOVDYSfnX7o!o@FTgF^hhDiNSGpc;GVFS# zq}@~U=+wk|kS2p(_6!*Y;si(!C6) z{X*&3f-6di#jpB5GWXz7L7Abu+=*_#u}n$kJDuFK-lk)tUc>R@mxfzgJ1hH!oySAC zgBJ`q|C+@#o@i8@w3wdZtC>r_a1wLaO}q%3<{BeoSa1&2E@4F2U;aA_i$xja_$Faq zxk)~AL{w|fRpiM?niR_NN?SU|@X0raP)l0&@q^gCw~tn;Jd%n=?X5TSnT=6*3!b{j z4FBIVz%;_fQ93#XS#fdjBJBG^%u31@b;xCA|Iq^->hG-s))=jn+bCefUVMY^ereqT ziq|kIRgT=z8rV_08FRz8zN76L#TCZ%?b(aKE4PHeCoc!zA@OZ57e+_y78r6fFDt&T zs1ZQ=W-7_~3Mt3bx(f$?GvN5=gF8QMs*i7UT91q`Abl)f>)YRW*QQRY{!%2FdaE$o zUn*U(5hO^J?AZZi`v=3V&8gVV+>9UzSp)yiWy@qdzRFgcqECW)#&7`;Dr8DI>qm=w7UU3h_b)FrNW09oW2=x_gCkkS=}&u{E3K+3}J`JXHp} z5x+GVDRXFduU&?g#ywZUjq^J7N5mJzQnlQ3J^lLbgAD9(jQH(Oh@^1DndB zuoXyUg3;DifH5<}yIq5jw*{xJet!K9oL2@bKT+>|IVRTW|2zzv&bud$hzDz~%C<}P z^V0*e-pDsyt|J4Q_c)<^N~|8r-8sWrpMe`h6JmO^3~JZAX>n6PME2F2%bUH%W|9lf zKDlcw$0#?O5k1$DWy*a4yWe&fIe@+F-=a6&#L{VeQ#l((*VYNjRg0=fXH+Ib6O^nn zcfJAA|5D~^_4@2ba{+F3#_ZlmM4nnodW=R5(}*T)7A!tfu`?-5SF5C$(}!P5cUH58 zfqsMB+6r%V9$vi-a?#)B>wn~;5!)}VJh5FecXpff&C~*EOD9deH4unJNxE(QyxESo zb;K2pg0V*0AlO&o%b&QgQZKIDEF8u(QB|N}1!X1{fNq0pLL15dF=Vw8A-UQ+GUVk{ zGc8uWoe6mSV^mV#Osa}dei9L3!bRlgZe)9ml9qB{=jC(v)Hv|Fb-R2;YQDUoR)Z3h zk~vV2BCNPIix|HB61d{nfhSu&3*ECeGB|jATo1yKId)T6P)&sKI2*QnUqp1yE7)ah zpS|@T7TJHWsDIB-(OV7icz;l94#nQR(vlnzN%3AcQhw8+F#@|9Y26^Uw~o(=Bt>xW zp@%}|pLKT(f<;wkYjabfr|H`z>(m(uB-^F8+lck+!onx7#_=x~!CG#L$h*CVSux%k zM-=&Le@y55M?@xLx<&_EseUoWRhQ%qy6%+n5+bLHFmqXzPBJLQPtkxOC^t%0dy*LE zLqpKB77f-5vq$_xeTKvJX~H}~PFb!L6ZELO2muJ!oQ9m5AQl1lDuvwgd*v8@hPMKv z{+!o>Mf86_C%dzEr>zdfKydkz`-1|EiH-rcu(UnUrY)AfnvS9O)?-SX#}Al#Bcsgi zrOhhZc5f;PRX~wSOoQDqE3;9TI4xui{Kzxsnwq$j{@(mbUOr^0p<7Qm!QiKV1g4H< z!HI-8SekKO;6VPsPA0Z&oEq#{3AAY;#di{729oD=LyH5+zR+b4;e6|}0k_6k*;=2S z%VvY>lF6p&W2@gP3yqEku5~ykWUvANNU+lh>grq_KY09qJ2d{shbOD!BHhX-IX7zC z1M30FZg(}yrLyYl;zaG5|0{Eo;~;M)=f=FdD$`{Afi84q>w~0@F?7GFfQCB7v0l2X zhpeqztiQ7mb8uJm8tF^Oc)MfDJQ?0Er&br#y?o^8!Ia+OLwD8KerzB7k9enh^=Ij{ z7uxDLnix*a11?Om(hFACa-yHpx3?>mzZwr~&A^Epe4p9?Z91F}GjUyC22;5T2wLO)#Gb?Wibf za$yj;0ceOgbxYh3y;mY?z_Y3=D>a?fP(y}exITUup6s2uBfjJRJ#~6!W@*G_nwkRb zQ+<6UvNL|mW;nAgJ(ClX-(es+18U-($el}AYCkU@=f6`jNPW)f%&@o=cx3NKl7aHK z?TR14(TTaqpyV%tj40{>3R#lsFsh3d*bOm>6>ldX$wTk?@ScdrjYXidCUj|9z=vqX z96_|e;I4WaJ&T`{1Gnwp4({XBs-UX9ZV+9RFz5WDSE8~Cdja+L7(EY6ki{*$nMXGj zqfIO;G0Q)LH?OGUxa^hfkn3A0su;vL6?JcSNZ)KP;{m_)M{^9OLJs%AyfGtb_?EDZ zkHej&L#EyyIh5ZG^YPZW{Od%4)ti9p<$JT~p{e=O1$fVZA%t`5y9_SFPQ?)Pu`e2s0d6te{6KEP~-FR>9)fU0e+(!@L#vD2`YNbmJW5Kv_2 zjM1qDQD$bZRGlWL+AFIAr^p>t-l&Z+H@3{8tN$Gou}$(ne%VNCB3a9|)Z)Erd|DD5 z!WhF#@)Jab8{XKoURB^+K+Y#yotn>DxMAzkb`7vC-Vn)pV0{u%SuJFmvBnx&o7M(c z<^B5iJGz#pmRE)WR1(yY`Yio+^%iYb3bJH4*Y!0%k<#g=+XV;^cY}7{bV_k(V#v-~ zwHZVoLb*+3OlKiubNtKwxZLU82I~@|XP9v3sTY)|%36L>D~kzb?HM;Ld2W2j#GE27 z3=e}9i(6R9;)jkbz;vI@T7g^cmE5?j@O7d=M&At9vxQ9?jwldD`u3rP;qd3--Ofih zLaLpkdq26kF$Y(k3@p~bx*mz3*V9)o6dnH`_3>QNPvJ+l$UifS!q-RMs^IUON$&p5 zrvGyzEK)jx52=RdbAJ7OwD_0ffs4@}(d?(ip?@auUJSu@60BC;=^x>rWrMgf$9nZG z*ykE#Ld&#_)x=}n?QS%iJnui9%X@FH2HwUGVr)Ujkr0v%BjA@r)ui@sd<+J)xxpTM zr@>{HoD04a(6=l%(!N%;oZ%ZbU2NT6)$! ztXrUbho~_GpC3h=xDS^)K zVi(^M;51l5Hdy1)pSVT&)6V+N){ac{2 zx!}8VcIV5gQMZx&ro+^d>z}@ja40Znmm(}})ETDAE=wO7jn4;d_NtqA{hGAW3MvjY zmus$X@$Kik_MN<2o$S#l#`jloF8H+Ge4~Od(UBcgoKBj+PGEWo5W)PtBYw%@jpX|X zame&6qbi6yCd@h5rw0WidPf!)ftks!!=T0b_ef|OY2xdRc(t=@-E>CBru)}eNF|gM z$Zt&vK~!zzBK3=^Ls5V9`lb{c1Kh4K;Z~1x!HJLz-iE%L96$8Dlyn2jmB;pDPs-vl z*|W#r-Afq0MKS=xCiIHjLlm^xzU z&4%{n>y|4wCoQzK?fn*Q?d=)L7XI7GSP+B$?QzVLNf(N|69(%7y+dB90Hvd>x8Utt z7I`4pgRpW--vx9#gGcqv*mD`+xp~`7M>9(|vt8ZFw+K#JDNEKFGZKaAALk4qqvu1n zVLBNLOI|`ij-wMqn9`xVV@8=&U8474z)wZ=9`Y6xO6LY|L-SQp6AV-~cVmUS(H&z@ zo!MyiAw9e1E2h&V)^2UL(kQ-xHVa5T`D%2yU07UiL0zfuUWLZqfEeSeZRTZjM`6W% zCT{jtQ3hMCkl$=)%aDu=!nw~wreG~NIxdb`-77|f(KiJT|IqN#3_w#e^UlfMejigw zEB1M+4p>)PsWWvZMWCgs3L>9$&QPk)m**GC<>Z3LuRhgzb?wswv}w&@idN}REi1ig zmLW+T&Me!sbu0f!>mGeWxZ8f+D8prKBR6xypgJ#3}> zVy%pl$N1S$9;N*DiFo1AJXLHvkFbFF+-?KHc=b-ZL9W1pxiA=)7#xnup5ytkOPVsb zgwRk4C=DgqK!2Uwxv0}bLEEAir)#**q-;c|6>@d0Pd)5dodE$4;e!mj-x;o-PM}Ub z?{yereihU)y&RBC2>r-_BpPd>EO?b+yU~z}RQaTxYJC?{sn>SWMp(aCj=H9|7V}Lb zmp(2d1s)57Z>7eKFMNC=sQJ^6?|r2aHd;%H-gw6ahL$^Druo(4!LnOzxh*(ciWQi{ zGO`TKuYf9MUJ43rsB>aa9}9XXlexzJ)wNts#zW!$6PpVhgpr6Cfi^A3Ll_M%V>l)$ z1hJ@z^Ecut=wtpKmyy22`;Qs8VD4n~t>gv(?1Xe2TMz)5&jpGKW(xXGVxNofRA3HM zCXT|%*unitAkyJf=iP99tv*;x8XXX93EqvmDnK@AHX~N}%y)hB)#Cp2SJ@-4R13Ci zzg4a8xEtl!A#d{;e!lq&hH%hmTtCopO>3#Y#IChNb-1+y(YURyVGjn>UDo_SW$^dR zx0;C2tX=}Gau=B3j-5lKU_2`;hI6gpE4~F(^5mhCocy-h;QI^l&qhgo1Wosb+Y9A3 z2?cA1##HP#QaRK3)t}zE$EWDA9L|HPS|P#v(0fq)tMq4|l!YFZbp`co7jh{+3_j~F zL$dub6SQPupz!`-oglid3F=|?iQqi(jnG}pfK%iNoL9nN7N6oMc94d7H6S%Lmpkq* zEEiRH{TY4UdgHp2vbmKAAYu?>n2l6M-Fc?boR*2lkh?#hl}iQRP8L`u85BItYwtgV z3;h7+_rJW5?823EFB{f%74(-{AP@ZO$9V8;gtf=$^7EN zHs7H6D+X+?jXFT2=Z$17d89`oJY*x@k>}c$4UbygUu~*{R6t3tT2JwtK?~gwCMTRS zYPXlhcxzimA|V#lgu}dx)Mf>w&^%O8wLkeje-3~tSC11tkk#3XCVb`$a~RTzjps`9 zZ-6Jr2y2KB$GlwZsa-R9r2@s()S9%lC5#%T+TSc>3*b|+n>dw|C}5cbyB%a`>D*;j zI%ZkZE6iz%u&(@i*1BXsomDjgF_&C;Zd6er@z#3ygO_VKtB=)iCw4fUQZu)>2FWy&&wciNfyN?xFP!A$?D&ix%ZB>!+FGRlB!k4b%2! zKG}_uSr#Y7QpaZA`vxg`j?%s+FT-6rn)j)(!VWFy@%;OEb!cL_Thz~jN*skTM;GgVwKt9}W&jr~hEuz&2UW?aDqlbC(6&Y#JFnsm?PNM#vGV=I-JX|*xP7&X=#xbXaxO^7Kg zIh1U2MzpS~9pN>_kv^Kr7IS_>aqBPC=?@=!0(8Ltl~Up>a+FU_3mFu0Yb3U) z>*~feW-*l77rZ&`uKd6Xvi-(*D6?^BbvGIR);#Bwg+98MP&3Y=fT2jiy#} zCS}-^k8fBW)PN+q961bN{%07j*e-TZt%MySUQ&Po4(Gkn59W0c|FMz;zk#rQBD6y? zq5+qmKeC&pa`#h*O{l3^JubYB{y*Ks6i9q<$i&WEIo=INUnK? zZVz5gSM}6}?hz%qt}>FY>lCEzT=6Hxyq_^<=SQlN1m1qnF{bYg>)HK{#{p(h<-$!c z5Hw0vmvkHrGI~|#dd-MgV;GN~bL^aFGZY5(O(JG zC4`;ORlXyb1p48Eh|YY?r7FJJhLun#;`^Y?EVrA|NM^@;G0d&J%BR5*J=roin>M4@ zS)kh?Z-}(xa1(`3yh#LuIs9u``}!=pUX-wfpSq^3x<2Jy4RTL>+v8`we}u+OOXY6W z*47UANGtV?z;j#q$2Z4O?3ts?P_S}cJ;V&Csw;%xOSU^JH7#hBk;_kpRJ{fyv_Tua z8XBsK?@n}LgamDK!fhbR{uY6QjP#!4^ z=oe7eqrsRUszX|QR8Ql-i}?Q_>k+3()vAVbIzcT=(8qS40Y!PW_jOo}x;(Y9U|mQ4!SnJy z*Dr5i$RnR%(Cx8-t5wauS%CzcP7o9#A|L!ZF0Q}HaGmyJMS59+86Uj5)%?k1W*i+rFjo@YzA$!O3cR{V^h0OVa@ZvM@b0l>NgVvhW$GML)1m1L;Ajn z%?4cv@9@ADpu_#QJWk0booV&nn64~INYg4De}t&R$U2?5jJ6}f&)@sEMc zTxn66T%+?~RU-Dn^3@5dHF7OH%BmF6(7cpHG=@~B+G&0^OHLu}Aw*^tf%VV}>4oGa zbZ{C9322|DMXYYB=6jDyaUED|u0cQmVNMSw?1ONDCHFU7J>!^~vV*(C*F_L}%| z{g-Wg<^$nt-0GEc={4zut&T4rRf;|2pz5kUgR=6KPVbY$BL0#0u2~j*(*~%$(Cz82 zPCNCd;5?ZsExb$rAJBkjFst_oQ51dNkZ|TUkp5;%KJ4bx9Q$nin?Iilx&e4>bYnw0 zo+9i1qY$j&)!f9Emkam(ffDOoY|74F1$taV!?o3Sw??lQ#B@e?#IT|^3e}<$R0Z8+ zNay|$jW01Kk&_+NTwu?|7G9I7PXwdVY9@3Svd%rs$ zev?9V&(^0?bk-#`(sIuJF!>B(e?=J(Vi!oMf+K4mm$kOtPamN4ZZeGbZOuBiK*lkj>`~D*o(8;c|a`CO)Bzgq|q9jQc^~pJp|i7 za;H`+!h7EE8c4j$aGy@W@pGsyI!mXWR++OPmWhTnn>{$YT%!5oajaTe>NQt%T`HEy zV=!GpikHr>H?zfH=3^@Ho6EUNnR&gl{i5ypBeWp@5%Qj|?kn2QH9PccLg!Lahs6;s z>5;k?v%8YAezzTynz1q4%pY$SmaVaTF`X}6F1myIZGU?M#`irH$P%W!rx;*D11jJC zqi!L=esIjAthPeV`}(4YsIL)aAhKjMP2RfJzww>$sHSp`H4+Ko-u>dv9IHW5D#WEY za#$ythnUANgYZ&&U*O8P_@dG?6&70e&e*}a8tLuXdrQuWzyt{lTMd^#u zwPGUsOa9X=Oo+q4G!4ih%VxU5M9Dh~Pc;QK1XOR9b!{`oo%{qsHt{ukP1XlW-Wx+- z#l<1NMnI$dB}IO0|Ib8Hq70;>2!r1M;NU8*Sg^NW0G3m)H(H zYr)xSoM!JC0$?ki{>W<}ICMUAtx7*bNSLJ(G#L&SvV7nb2iAifkZ4lF#q&S*1Gm9o zqO5D-k^Sr&K=z8Q$PZR?AeP{5LgoUuL=%YaB>u!Iezrm@eAaeTi9B&<>4TazM~Cy$ zL8(%?5kL6jtxHzh(G|(p3Z47E9RpLosW9uG^*y633IhId1TQJsMWdtnl$~xcdvGi3 zFo;gJz3w{o&B^d8HN{q(;8N>0(w!0+n3O;yAY_ZdMjCi0=dyFF7&HVgE@ z4=lQF+w77knRNaar&3g^badzmI_)tJR2V-}WrQLrzjrYq#DC41!QK(0mC`*Acle@t zR_8gyGvvH(_RT>*j7Yf#YWR;=%Sf2)&?d zUa_4BmgYi%t5yNAPlD;&NJzG15z%AF9w)ooU}LzvdHd_W1Cwkj(s+byg$W`x>(4sr zA;v-)p2=XDbN<+X`J=!YnTNvlAP?Xgdx&|FkD1cYH!DpS1SS{FS+!+o+wjq{B>}mf=N1c)p*(4OW+p z^*Bl@Gi9fHw%b5uX?o|9a)rb@f185(yzWoD_kwA04Cv07$}UAX-3>I5_*#c=Z&IW< zKH*6DUTr_QrNt5UnCX_XNZt0Gg(b+Wp+=5zT|^6CV1j>4)yv1vgW4(<{j%axSbh^0 zo2~5?!%uPltShM)sQ)0B|c<{jS(sv0MMecnkx_}8y8uiQPnN- z4JN`~T~aIj9zL-p!oD?|-Bt%PFEe4ViA^$V!;O}rtVK(V^PeJ92aiem$)6W-dJ8KF zKw>{$|FN(JUjUVVxdO#De#KxRKf_*a=2%$Wm@;OeD(h)=#ZkWW$EUkLr_~B6gSMi6 zr%WH%C9d5S6C`~pN$9k?fR0x8C9ckhlXyaQO4d_7&OpW`+Rs3j9ghm*(t5{Vxp;8* zUdJAlLwhP(%-vHmcu1klKmD<(sA+<2J21@>2kC%z5@&oZcT`V6keN=Rd^b{M1l#J& z5CxXVOP?PCv6e{)-NSg9#}nm&=oeuF?tLwRI@?kaBiuHgUDaE8tC=C|4J*%l^&XSI z_Y@>XWWXZFwIzy5J~k;v@GT6pqV{{Z1m8Vd86@wISM0$_BHoJ45`?yf=b&v+v(Hmi zt)7)cp6Zh^_cjOhf7NX(zLYnMQRNc+092Z5=H|B+fz-HPuDRRU=RK>3_MuR2tF31$ zDKU3P9jCtJ8qD+kX_P^ViM5hkX|O^WVg*>w{e5x2befp@L{wx>bLtInj7e6oplje6 z#}`y$IWMQk1!$K=aC#4w1@1HKiYkwurPZ}fsZC?c$tsm&p7sQMj^84UTSEh|HGzS(kQN)r2?# zd)xusO2=Z%ft&*jrxLcO_2tf-Xp~eS8wIuO@uyTZAXnNH!{aJRbNoM4(Yw!@%A1S3 zIt1;?x^P6UkkO#Dwte^aUSvN9G zOjH)o#Hj<>+xkPgz=rp_#yxo-Z0L=ql07et7&$EuI{@O<*g5l=zrXG|c7hH_l^Kc_ z4jRI5zxb&IRsL8>U0!3L!&gZ8WwQcE^q!kc*rQY@LB9?M#x!=95J6Fb9`S8>Al`E% zcvX2ey9kFa>CY|-O^X{{$zgRZdasAgZPbqCU&yI~k;bOpKur@3B*{Rob||g#*A#|^ z@@zpPMF`V8^2S#CF=z#+3OVY-2*JcAXG9&2-e>V6)d>0?ljQD}0(ZEEb8v)llwCL& zVYQ9x*%Jm*MQ`ld9H>lOoaKY3sW5IR=8mIyGuhxnP zTc7QHIZw#Ws_=P>J(;x3ir%F&uganQn`@4-N`4nld=^Q4t06LXK(d=}!CWP5D+|bq z|9%$$i3Isn;i2t_>YS>GNC3t-P`^C+Hvz!If{o1t66dg2{b{K%3f42o106&<1l)3x zjrFDW$`+rO^b`F&btr#`UOHZ28vT1(eT$sdb~P4I{&I&y&jH7k>&J+HvL^h& zuOT^=RbN{B&Ld798fc|%gvX`$<^uE6i*AQC)^4=6%ll(#FYS0TgG5$6lM+#Yy70PNYj4c5)c)nxRIFC2fO3!=yI=Ody#>J!#^ttl@Y&is zYPpng@@*FZ{?*|!ltK6Qm;A`GisTzo8;i7LR>l*lZ(o6zh9We+x}sKAv*~impnJ_h zI^8}b5dH6*$W)<6__N>Rfe{TK61ifnL&u`lPdWH$_HSDw1V(%-N?uVG7ZmlIe<*@k3tzg(_o{>)USu>%ltg3bhY?$f7-% zAM7_`v7!TU&$^aL)Hl*Bn@jM}JCe#ebjH62-4SzBmTk*Q9uYFFg%Nm z!?1E*{TH*10>9{3>eON_80M!PEM37dQ+0*mWhqHXjqqXe-!c)Vkn4H0I29D?2TqYbR7|SMj&M+AbMl0qVBoaKthKA_ifDVF1wGA zaP?zS_@=8=xp)8UVu0gii-67N*hts1`Uta<$T)BCdtm`3J^4d84`ch#qaj*}gkf~q zU%WHe)rN3R4$C*0UiF6^8OtQLg`twE6*&m+V*e+7bY=MVZx|p6LYD4z=TC*6{LGMC z^vE-L&!^IG0C`Q`hs){1@*#9PYfC?k9xReIpl{$Q$-lR~b&>PjL$WiKx;m5RU?<5F zQ*6WWq+MDkZA?3Aqib>1(!GrO1T^gZz0Qd>-zvi;%=MxYJnxlOdX!CW*R0^=d3bm_ zH5g<4wHtkUY%`COrL8(lkQN8qny`%V(S5=#6`2J(rB5Fr z&m9Zi?fpb(@JFvKkh;5D7qsklA~=XBD`A@h!Sts^`398jX%1%P(v~=L=Gx`nt6;is zL)b*@(gi*K>Wl?rL{LSzZP(zho*}DEypEBlr4CT4VU*Kn9{#k*KDiAvaglK;%-d$^ zAB^d9I*#JeHIc7tRGgda(9k-(84wfmX3L_V(m@=hxK6D^j13#qDkV&9SM; zYlckNwad=^d5Liu$h14{t|2mtbI}@a4DEP{5odi~sJQf92ww11-=5F@cNYA69ebKy zvK;;<{4eIfLnF(8hi;Tk#Upn`MHo|GNH#ByFfE7XJVWu{yOvdAajWZ5w`@GeB?kl?yw}lCZFq61_U$^J?%%Zsrn? z$DDrt{COBm3R0nvEMp^NRsrN+>p&}{sKunBzmPe2r4=H$g`v2;U1k_wduy#-hK+YO zTQ^oI*DzBE(?hnwiBSX1A{}*`X0_mJ|VXZQaqAP8|;OI4Kw$eBE+%QZ;+33WU(0E$kIRB~w70>~-&v zzzhBW4bt>bi;V%s>6&-_U1b%k-Z7?62v}G3c!~i!q4OFV8uyiOAmr#L#zFxr=d)qbw7#eW^IQ=Xr3fkVXfbJ}h1gjn$z4yi?$P1E~M>g9}pUA2Ve_xAdZy zVpV3(`1XFdML&)IR(6Q&R)jq;dI^+*%&m!M+#`^k>v!(F3>>nJVBykzc2--`z(?m{ zn>@#!OhtzgXWX;xY+!@N^pWr|4C2Gs?dk;?ooYR96nXI^1dvh~kjyI#A42v#rM1?5bJuq&KK?T^mmF=RQyrOQYCB+;lE~VTxkeze9`f4?+g-6tU)M4 z<`7Qr-UT0>9I>)=yDCLFn#!%Q@fzExAcNoWS;tJpaNM3jcd1I=kNNCQ9VssW-)-OT zN`2>hgWDUMZG3Z=e@)(YyA1yA-Yx^r=8%WRwvp79F(SWwc@{X6XnH`ZE?w@|7LSoK z7qh_1Ae!rXyq@&oU@pdZa1r<{;i1m3T)P8Ng>lX7BlyM(@~NL>C%Z4(w2Z*!kx^=Th> z(u%JRkxno8my8RHrD zS4Jy~0=E}(iOvs@Q}a)2ft}v0fM=~O?t4AQET{6=ql}=%JfMWjE&)TENTyW9A}9Cr zLD8rEstjKdte(#V#}VsdxAFd$DQw}QoPx6FR}1Rnr;*Ud)i^#mv8Iq2FvgspcARZp z=sbWd)pJyo*M+}3ea6uqc$)Oe-Jx->XoF}5EBV;N4SKsgRjpg0RqT{Ob zcFzK1YIQiD%K3;@A;c4-#v~{~6E8tA35~{}E};g|x(+X3r`fRZvkIpxptbp9J&1jw zWnk|u-V_#-!CjdAv$V7{SD}%r-~1!Z^$vN*?hFk!ht!zdsl^gOKl!VoqN2Yf8gms` z*3t+Nw%DvSMgzCjQTIykspc=yj}yak)BRJoHu??I_QUx7Q4$d6v6T*AS|2#SGvZdn z`6e)aX}@T_?=TXasHUJe+(ib|?(!%K!v-FNty#>>flqVarP%Df8fwUw{##6HTRKJW zU>|i*%R2JQV&vu2=FIo3T~Ea?fO*-T0vNr!g=(A|DO;-DLpaf|N{Q5v^{Qg=IB46B zVS$1|gz%+{Db;k~)Hv9G6~O!@CvNNPajw*xdB(XWI*#;PV2fz|KH{d%oalDfvj1IE z^uqJl>eID=@drjqoG&O|=U-A*@OzqG$E8w2Ko()IKEr*aLb0V3=B!^` zZM$^MPXzXW1j0f5O|2aJjnj8weZ1t#Mu=1zsXVPo5cSnvK zK?nyxZoIFpRrk90(lb}l%*DlJ;w^l8M4c17>Qn}H}U zUifN=&G`OBUYlp`bj-c6NwJTW;;xCvE2aBJybrH>n38L&`TH(`(}Y4z6VZ)1IyM2jZ=Ri2dt#varDR#rh4KpgY^oaq zA9z_|Co!Di)jX7;9_Vu|Rs6z*pJH-+4Cb#4NLV^JT3cH`O0oD|&z>UY~)W%5lzS>VY3lszY3QhxjHny%KC-|8=)8lX|Pd!#<*Jk~dX z)s1l&ve_d!Ev)AlDN8dQ9LgX}1u(6XN3$$%Hyf|6zx)<$*w_+U>Te)S+*=b-)dvPYj^lf|8W3N0Dk%TQhIK*(G;DtY;irH$E1_)DwI&!;vy z>=JZ_x;b}#o2~iUp^~$35T2~y=#3<_E#_qVJn&W7Vc_>T-&~S#vJPdzf+^(Jn2IjT z_rzF%t{#Z%@ul!to1UO@=hOV>Zz7S38@gWY%lChEba}zOL@8V565YgT?R?jsD9T zVvCK*@GWh3bHI&AlffV#&HvlUU!?;PKEYG?wA^zdnELShi5nky{%}2Q06c6j1+lW` zChAy~@6gcO7z}i@!sGp*=|z4H2r^@kU*9gUI%~PLdNcW0PgC(tw2(5!p-dqD@Q48~ z$u%)4Gt)-IwNvchC}`&mBz7>zg6Vvb=jB=tQREQU*)zvZ291OI0lD_X(=bww9Z2m) zR{ZdLZ>KVzC}xfR_U(=g=h-9$kpURhkh|@E~kq`!=v0NCwGJr zgF(=ju9Oq4nOM>CXCkPE`UOiDzyCd!iZ?y^P4m{gT#AA;^vg8TcLZo1UFn`-+ltfo!K19t=C_l(>{RB zuHgMk&GdqD6}Up;z)7$F4iwkkZNq-iR1?|5GKwSkjnd#a3)L^o74(rN?O4@^RM#{iBl zOD0S&*Q{`<&sqhLPMw*vnDSrr%#HNB@abO4iJ|2lZEnu8F2eWoSq}o-a&szUkaO?7 z)d%Y#JQjD3sM7|F6s^-NJl$TL(7%y4wYOjxdgQ3@+SXj=C`92XIC)iT=kc+j?3D>I zT}^u5>Lu<|7cA+GlsnxTw4ljpC!GsY-aK8sZ4>d+-R!Yy-<~jCe(T=PfxoeF{k(DQ zVU;pSnO}PNT}!CV6^-R>YDnVh`K(eSZN$&zJ-bZup3n>V3&{emoJf;i)r##5Ro?;nK>!wMUVW6oXh)CiH6w@V1VhaQ3+2y}e^-us-wmRZ zqdN-Uv2|5#rDF}2s;|y$GkIq;HK{FgEe7Vw$VqhmzWR5EI_fY;mS&bqJj5{2nte7^c;ETZ37p&>^Xd@nmQ<61!T)RT+XI>2|NnJLP8XL_DUsx^t4q1eB@#*Q z$=zJiLd?=!8dgVT2q%h^QMydIgSKt9O4s`cdbcl$-a z(lEc^?RH*sx?8Q`bHZ1c9bV=il{v5 zlvT&FdM$29&&XikIWPYA`KFjkH*m&;Go>+aOhkkmFN?`aIr@3va5#}mgTE_o@M}sD zH4qVH*i$xk1P~36(e5x)X^-QpP96+yMLIE zkB|3FzMC1 z_z}VpR$kJsl^A+=jXPuqwBBHZ=CeDh;bgyHd1r;h7qtaR^ge!X=cMjzN=LsjyL>~!Rp*S8`N{-e znC78m&!U^ppXHxww{uZc#F<8SUe%O^LkZBI3rIJAG+$<;$rUXjnJvsLo?+8TE*iE{{iE@8iOpdkqx zK@HdvJM+i+aXne>IgIkv_OP+8a@fb}n(N25YslU?n6%-%{6RCE4Ymb6&wvhoetV}i z)o4~V)Fie$04J>c(7_otPJ%G6TgW1>MuC#_xH!d6l~kmnSW_zS59+2phI9Z zVu(ne0NPm{A1w4L9uUQT;*MB9ql1nED#c29pcnL|rS{tct!)Z}p)pfV(&i{SodrA28%+Wd3@p&j{7dj^A~?gupwC zvK&46n|eZ!=dT3^!xYb$6n6S@$7T|Yt4#?V_^IHl$b6=H}+f z6E-?hIEsA#32R$9chS@65+VJxUS+d%N86o=_ z8`Y(zW~AZnsf?GSm%#bupLZ*T5xtS1=`%gHk~l};_i$B6=MQ3{hf!(3|{tCMz>@B;{weKKs@L`G8F7>(MiNYTIrHyR>))zF@D~yp@XUD!WHUC-3RE<`7`5JN^LGsX zS|zJvzFgFJ@Rm2iFkd@hkma}5arC`}#o~J)CLTIo;Q{IHc%P2J{qp4j;B>o%G*4$n zolU*Z4#a$yU43Q#Nxm|d=O@Omt3X;#?2a>6si<%^$zFWB79ao_$q^ruWSu5? z*`ny0Th0-v6-2ck$H87~f^uHRve8wRu>q$$p66Y#;EF>|%c0f?-n*E8C;56ywvLz~ zfoy0FiY`W#B)~PBZ~cb^6+sHc5zBM7fW98j+b{Uo61qR_N7)w{xJN(ti95VjYn7El zO;^%Zo1aYbbM%F`l{?$dsw^%l16h#P@6falrH>S&f=nzYrr3GG4t8nn5Q1tH(g#5+ zWpBeASX>4LTAtD5{_sHc0a{K*FaZJ#;nZ;Lfr4h2s)jMqPM|a|sZi}QG@xns0BhS~V zZ{sL6M+9=88Yv}g2UU$fMT@8e|3{(qV}GOFot9Zq^eI!h-mm2Jz)+sD#bDJT5wHtv2 z3;*k}2)aX!CI_20_bQ$NA#-*v?P}17H5&FN9}vS*AW_BIPaf2%5m)?(IziXgh0ZMk zI=}@=1N|*SfMw>usw6FyDV#b48QBwWQY474zC8ZgMQ93PsEZg7UnsmBe zQ-x`u@83V_Gtr=Uy|ct9GOCy=K6ZFO@x)_eqXrm1bKSab9jk-dq5&S>uZR{aI>{@L0|EU1!tvNqh@p26M zM|USQzIySU0pi~MbBnLFBv&uT01}RWoHgFjCHtyYz9Pp7XnTb#`yuA!M8n6`n=(T4 z|E<9SK@pDmoo-0Gn>pgNMs0^p4piZuW$&ny1nkEk@iR-n$^(2P}D3Cw)tP(_Q*6i~$17szg-XS_5rs37)Jy#DH_25-}SSOIqE( z69f|9A%XDpLv0sUYEJ!7u$8o!HQ_ga%Kt#~xEQSl@h`;Jk9|(NY6YSUGfXpIamW{h z83{7vhs&0rYv_M?wHggz+cUWz4WWvw16bY(&y_O51RsH0$e*wZs z93aE%dY*TeDbR%@(1i>4xG>J!#ncM5p1A3sU5P$bZHHxSuw6hR2L%{J%bXA1{eNX< zV7Dgv&kiXi0yt}1;GXNL&9`V5_JJj>R=1v0*X@k0>i&070cm5qWXEr;kF*BADAS0GnLvq z5=N=8x9mpGX3@_``?800NECy&Wc<_vG}xSmLo8Ru$DD-v>VU1C(8#YeCl9$aE%~k5 zRXTk9?E9y1I9bHX1Kk&K%4;vzAj-P6>@gaeIXagG&nSLmRecHg>I;#eZticdE%@5E zM_#j2Z`5ts><1M)YtbMDe|Npw`h2&E$BUG_N4jcvZs~Fkt6aRNQd#C~qOjGg0r|KL z*5-P?j|xY71n{M~@lfZOka`a3;@(&7iEYp-@;)&TIV5akd+JWdlZVO3!m2v8+;B6x_YnAZ6L@G zFn;{x`+Sv(Z-a(6J{DJ?X?AulY4{#X69i4@FZ1Uo27xV$slg91AVr2)ffmS)mUYEa z1zcP;dT+^lbl-Xu#3)sp*xkAp4<^Wd4O0KG)N!I9Ig`m2v@?Z&H9lfRF33wv4OT49 zP*Sp85*XGu$u|nfF;E3N2xw#eVa?X!`R&C8l_6r6!(=@&9!3Wr0ePx?4%nZ3pRrol z6cVRkeHmE?(|47u$(LQg6%h4$azW<~4HXjpp1JF6SK2tcyHRiP=Ob?ekJBnuJkf`8( zus8UL*uSY6JdY&@MnkO@TnMon<`TLxQL^~)|EzQq4=(6RKcXtVtvKiu{N61^&YFJ~ zTyE?GZF;okUGrPv0(kEC&FJ{ zwf+josM~~9(8p=$e`OFt5J1^T>u&q0a#M&?O1;p1tEh8tI`EpavSIJI4SQ*ovK)mc z(^3k>O9TxL(URm;Bje_&swj&SFJA(lbI2WF80yg8%3jy>@GeI%`$Lm)izBFl1U=2Jrdh4ZdHHctHnzn?5JaVGtJz_^ zvwh20^|$Grs#dn>vRp$9KdecJUk zD)U6aTLeT9ph4Cm<6zEgE#3@zhk$FvYsh;mtH54$4zrM-R-ogmsZoOZXwZCekzyf6 z+o`=Bb0bA@fdZ+3c`;?cC_0!R{s|@omSvfW_pOYK{=(EVUQi2Jc| zpeciWCtY8w0Zq8z&z4wu*&C@=xT}p19GvC5GBEV*GJh2EknR-CFKq>3H<@&(_(h68=s0$T+=f){P{&o+r5dUe4A4!y+z zXd)>sR?Nl+G12>vXxMQBu$&L)OD^DjL9^Os9^?(-6X{L^>tEMk?Uqe*i2%_l}i#eUF#pier zG4(!7Qjh>kAh;KP=iCQ^z^uqcJV1uXqj$A(SgKVqXIj zSBKkY*lIA}+|;^CesnVi#^O2|I(2c3JGddX)01Na9oTxZc&fdJoa`%oLJ*DP2CIrc z=_$!=U5AXd#(eNzM;=O{&3@k0P@$2KOq1Sc1pX6`UPq3Pr_H`>b2diz@W$(K)-7(R z6Mm`Sjkl^}BON_(5Zl?8nQQ{G&7a$cYATVt4)a1WZqzD|a&9Lv!gkjL^0)V~jr>}C zZiMZsaYKl1?g>QH4Io!FUVov@DX83DEFSlsHcO^XJll)T^%djeY3<@8=;nKJ+1D%B zEsZ&J{Gfirl>L6h{FlxRWKKauA&0vz>^N*}YJdmxitgaSpr>D)Z>By9YV}NK&)GFh z%?azEyEd}k9Et2+viS}8$+NVR)x9z7q)P3V`?eQxz2=YP6B!-Q@cs^RO-ZsweC)(3 z`0SC$;Zl=p{aS51&Aa?X?vLe4<{?Fg=iJBFIk83LedDsw1IbfvZNYvmx3P1-ZKlfP zgbN8h^#MZ#35k_FQ$>3jP^Q^7VrzuJuMgNDM8T`jeus7Bmb)8+4bd+2h(^h6Lf*?E zOzOmA->aTdgp7U0M#e<&E;I0^<1YT0w*3BJ`CryLrj)}no%l`#TKTN<1IuJg8hlI0 z26D_)sMTxz+HK!HVFqMr;YyFNHh?ll*b+rSE_CNcEtgkqtJZ{KREw7g37x=IpHNN= z`k)(om!?mJ-_K_SnJ$yr1|}?Yu1l>rtJynX3}5z&iBU1z@4Jrt`~5L#vJ)W2ub)@;jWujsEl!()0Q!v6#-i zg)BlMuCOfP!mr>hALVh?%e_0;wdIoiT@_W+GZJ7*LI$6}Vm~!Dq^D%K@9k2Ad;*E0PB=8 z67xo6eP`FGyqmM@Km^foy7JwB<{<=x2cEnk|VSWRV5pb<;?>D@B zkFaB$o3GR?DZl@El61IUUklgpTKRW73`Gflewo$CAV$WNDMmE zp)#E_d!ZK@?lb3h_O(Ohx2XzQWcgktpj@V#3VZ-2UGS3-Tul`n#T7$I5L3Z#fsAO_K(%Lg(%Rbz35sJwpQyyi1V_Kx@L@Ox@np z^_oU*r%}so#J{a<)3L6B4)Rk`dl;qCI@JwZhte_BjGj3+zddu;%y~#_6XmtE%!jB} zX~-zO0n%!)%}nITKx&}TnK%AxX+2SLU-lR><8lTLVRhyVj3=YwUs$Ksk5)Qvsns7% zJurEzJFFz4cJpX#D0OL=3yBgPP1{jEa*Bff;=09#zH<>yZvy@Au>=U*qFT&iX5OLl z8ycokQ2TQCu_L)vgW}!p`d&l&?CP-^c)BwpAI06hL&YmeeZlia@fLU30Gqx-r1y6}cd>9dh zf#{HN2BrCBsYFQYs7>~C=L6OTWO#3JT{?Yd#-L4Z&k!`KpJr*h5`p9B*H>|7VhTFu zYS6pQ80yol^U;u29=wD)_OU~Se+C2bH=KUnoC`riG5VwPd-BVw8X>LINqs92xLP^$ z)?f?Bs@LjqA2LRn zydFoY?coZ4OVEE(-Z<|*-M4|M z-M4i2Dg>;EwGYb7yj1Pj1Bs#zMxjT&AMag-!0EmAz;}Q#DXsEjt21VI-{^7e=M_!# zU5>clRtqbgzB?E#mmIPDeUFuCPnX6k+Z!)$vUcrgo1&ZoG}>b<{(?K4^9Fvl%*`XS zpNC$LWRiRzOf$hX+#oeHZ&>arWz%I;-zlq9iHJmXH2EFL_(Fbp@XR~EBz=MwRjrYe z8(-aVZKosJF<6%rB8Gs$uylmc#wmjP<+3Ex9cqPy zfxMI(GhEtA@*KAb<0Y^v2O2`P`KjZiMarXHgc@K(Z!_%)XmjuEGH!qzd{2-kVtct|99?)wKjeiyAGrYQ zCj^51vH1?uo=xvq1UaU56>D04xG-C%7ACNWTILY{l-?_TlrN4{41_&B@h*xn2U!J5 z2f(UlTf%5qlWY9f-fG5siP*dxv@O1)heV8u7#%gN=eX?xfZ`A~0(-5|gB$YSCt&Tv zgE5eXeDsNIadQq@tYB_0(2hB4_w^3}B=>jjKoX=$zw#&05b?J)mz?;}+D+4hy0f*l z0NVhToV|6%^}U07vk~&cXQmJACBS`g!~6gYM38xekfx^+u=)gLBGz*%3)T>YGQRqH z-uYs+)<(L(Z}pEbMq^}XHmq@RU_8^M1W|i>_jpFGdQ+DJzGLnNPmzfI1BOzmnm&l{ zi0eK)d|A|CIcZn-&Zg!Ap zgN@li#6GL%z-&IXMoDF`R)G(M^dB6zVO7t#aT|eWXpNb=4In>Fkjb-gm(hVB@#TBQ z`lM(!DC)JQ-ldRMx`!-{dGf z?8gprNpb)T(S%5Imi}Z>BrZlv12~vFbFK)ZLT;Z|OxS(U0A_yo>W9?xO($4W3&<`s z0d97~!x34K*`W6fqe}|Ql0>F5q%Iyp$eJVS01dBZD<{@aPtt)INL|5 zgHM!cf&mK`2E6g2HnTh_NuBF}!oKwr1L^100(GovO2F&EQL>#tZ9y_kkkKfL=1wBE zY>aP?cT8bHOy32xQL^Fgc&);6Px-OO=v)YKjFSAJ!5#c=@#yd%rvT~67#aC;^ zP%k39s+7Vokl-j8=8@b8N-)l#Qf8_oF+$9U>Dr`|TeXpS^-eSYVoVXMl57Y(!7M%) z;j|-%HwnJ~bgaP8MvYZnj?NeKV~1Eg`!K2xmYE!JzXXR5Dy@pz1}9OxO7w|X_gaUM z^H|@jvy*yOkxw3GWAkZg>SZs~N7^3S>tO z2PhBYrbXhSR$F^$`j_f4O?&xf_znZ}N)STk$3}>3jWxjAXd!z0hgg;VF)WX>vEVa) zyeGg=KFC@_3u1kG(0+KwBiO2#7llzR9+FILXxvSpJ;I66>BkA!8lCaRgWN{v>?*qK zyD$PUZB!jA5@*N^9d?@XGWb_WND*u& z1h0Z!k>K@zfAPQa_+L2u|7H!9I;_%b{AB|BKc~R_a3aN(V+&3T-gG@4;xF-mdkKeD S;jan)YI)Gctk~51xBmkc!_Th( literal 0 HcmV?d00001 diff --git a/windows/threat-protection/windows-sandbox/images/5-wddm-gpu-virtualization.png b/windows/threat-protection/windows-sandbox/images/5-wddm-gpu-virtualization.png new file mode 100644 index 0000000000000000000000000000000000000000..ee8aa78bbcbc4db1024ce3e8d5c986a8ab5b00be GIT binary patch literal 26778 zcmeFZcT`hb_bwdd2o{Q!E*um^k4O>ekf^ADNU8BueN3A_)*e+TFqTz3=&*-?`toe|%$ncYOC`3`fXz@3rQd^O?_j z*4%6F1bbTx$!!YTKp>E$mF1aBAkbzs2(+nUix_Yu{Ayn#@Ffy-$>KDqq)TZQ`0LX9J(B4U0<7DAJ>8yq`?qbw*Ww<@UARd+zvoD?TEEzi zq%E~)MA~Iue0aWh&&^uHEzO@=Gwx-$$vr2th<)A29Izm$-VQg-08h_$znXJqVruL# zi!~G`?G+LS_Qyeg0<8P%=l6j_8;1h!#1c0CknkLm5dQK0#{WSFvL2AKCSImpujNB# zO1sO0y3-7?fQ_Djt?!-Im}&WXGvuYsGv1W)AWm9-#{rPi*An#z{vn7Qbmjjh#| zc(e$}@VtUfOrYtU+8ey_&2R;tW4&uu!mtB*yM9#t42w^)8fTmF6$Q{t=^VAI=E#Za-*Y9Aw0pUpswBEPxHRRx(x4 zSJ6atvAaVY$f2p%`0}ENewxWHkkIy`|y{g?NQIxY7;ft(|ULn*-r5;m}up7urF<$ ziVP%`V_aCOk#!}cha6eB$1?2IUbE|?IKvKoezwU%nbFvEKWdfjJ0F}4Zt|H6h|mpE7TP1)VdPE;Aw*bYuFNEe-U*2#h+>Q9~1AMM8{^38vgr z1R+x{M!~nGK%rQ#nu=&Wi7hfng15p#+x>lr-D(r0Hv7BjGpG8h z33OHEqBWx_|NRpQm@vu*zj(-6dWoV}HRdXJ)T1X8i6OMGs(j?Gt(W)d`zCXgSO)}= zY6$RB#n4LO1;3ecIid||k#iuK-5pH?i=5NLml?@qaIO3t#!)-wBZwDcU!{{mJiSu=cXJXdE;iV1JD-3Jp!8@9 z4yTlyf!6xpczy<1M@JM?^1d`aM$UgK!B{P0+5GXK)P|NG9T-u68HGPVac~Z8deien z`aE@YRq`XLrMuC`a^zVF#(EZS%UnZoYUrF~r*qf+({++tYqi)(2j;Lg{OBDO$=K$| zm=A@@`uH>te!h|*nUoZEpK4{+bt!qXD)L>DI;C3uW4L=)O*`dc@&Xmyns%GXZ-KSI zrjR>ScR@RXGFxRp$u8F%MC2^UKCSj|t>-Fw^$8+Q#EfTb?FJwFfl&t_Mzzwj{4=F8 zykD22mYPn)6}r^OGen%!#FCb(`c2N^(xExMdi|YIpDeFK#%e61qfaq?2Z9S>ntmoO z$`ok&6pymP>_B!ANJ+YJeYXNJ%-!!^;*&f2sG|-+mhysR*G9U0ohq(-sUksu!t1Or z)uNWd+j!?mEpY$KK=@4geLQPsQe}5IRTX)m0ZY*yESF>CMvlIkvadIaYe%WXw6~@? zM{atk&R!FM+bL%$dcIxajZ3yrVrg$n8kB!iuI9@V`cau2O&Fd30Ic;K6w@qB-@UvG zDp36kJjMhZImO~-Yjdr%)9QFgQ@2n>hE$tKrS87$gKi;GC z>D;&us+2YC5KUR~JWFJ$jPs{Zzmi^5EPK47@vC?m9+p}D#E@MiN4)!O1a3*UebWDM zD@#JVNN%oBJ-4sWXGlpabzS3=6+d5r=p*%r`JjQ;+M-F=EDDnAs^6xKjn>}V{I)Rq z_H*f9n7e~VVlS{CM-rWC;E}JU^j(@iKBoBP!*0u(R|Q8%^t!(oEMPkq!Fb$MlP~~W#g~Vf><4+o9o5p9SKB^a}=nn3^%W!$I9m+ zp;C27Rm`uIlJ$77j5)U3QsFKh*+(3&4juE4vASU7+r?_4%}=XAvknl#equERjJ&G5 z0RlBU0gg{+U4k_iMSstbPGg8%A!!?_T%ymtSzop#z*Z%z7!@TX+cTfVL*eU9a`^=d zB(Yfb@CR7)x56p=3L{WgT;Qti7mi||X`)a*a?Ya&{@O$W ze&vLE*d&9FTPWA!4H+%-CsitTc`I-nFEHpPh&0nhFRlUnSdKKvGaVP7p#EJ5987<` zSUViN{jE1Kgb_BgzdXKWe~$x3_5$d=+uI@#wL?5T@U*R_ZLgJAmwtC-r&i(#PC>Ng z*b0rGYex^hjoi!9gOT*Vc4$#TD5=q);c6UQ^s_#D$2<0tw9a?y^s||wpJvkfZY>Sv z!>h8hv-}k?xX~w2x>ClL z#}iO-mK5k{>0{)fpb99#|J8zS1{E-7cLH8La>51kE&AHh+9btUEja}ai3?A1FWiwp zha40PC+Ya+aE6Qs^FLFtMoL{;iZsCIl&h8r7#9jjL~iU!^AvY0ZeeSq4FWlW7(3iz zf@3#?9a*|Lx{?gl_7#g+0uWM|g1Mb0JH_A)qU_Y6xO@HrSHjb>%b zk9ZQ_Ym2>O^VdJqJxGsFAm^#mX)QcEvpdG#zX&YTxHk9J$i2kA8}&Bxx~osC3A-W0 zBe4l=maI2z#bbvu#SSsGP*Q1@d{D*Y+lh+%C2-pijVT5xxw2{NW^Ht|j<>UA{j$71 zouibmpPr@W@@k=TN=@eRP&GSW!J8wh@S#i|)aK=~`T04A?x)hZ?mdHhyg~~*s6V|3 z77HSC7C7<0R{+$EWew|TcZ%1iU{~Q+?=s767$5FNivFx}5)ZdwV0DDQ_vnWRFb;9@V_7TuUb_^w=*7P52P ztM9}>`EzN32fx=;Un=7bD9Q7)TM(8WUIU|;l$1LbEKs*HdZ3(75IKnJb-mVwR~-jj z?1n%mk=`zwZ$wAf?KSV>3c@5)$BB!5p*o;Pus#9HXy=SZEP*YLN- z%^sKm8<7p*w*3<-;v><`suuz^LJ4*Z19NvNk42GAP3TW;LIvQ$S0h({QY*Kg+-`}H zJ!!+<9Zj?dn84jVv1;-j6p++gzwP}RRw0-;Z$aGa`dUDB<63unkn{tcByy?kHAna#eXzHK%_64lKCz+F zQsvU1ui8SdD@0(@Y^R1preLWoNA?Q3=_(rB{2ol2065GXJd=dghMYRQ7?ySAiSm6@ z7fwgqyTGPu5&zM1;4B(*XsVgB%$$w%Wr_sV(;E;{I@gonZLE>i*wfc@AYu*VV9QHT zWnv;H2U23SyvC-guyTi^=yR{knb@;aa{6&PsO%}8bwb2BemLIV1UKe_?|P1R2YY#w z4k4sw8J47O#T&;jOQWe)O$%pjH7*4L^n7C1_G=h*&XAX>6Fv=&{eEUdrb$ik`jO?R z>vafUk+l_Mc;VV*5g<8-F3d8~F9^Gl`#E6upJ#O?vfOVBapUh>E+-MlI(&$rHl~Ev zy7ep}M|T(R=6qg+^OxPB*?ZB6r`!-tmP8Md5_e%lf1)W=ZP80fRHriegFC_ragL^G zXJ&E@kNOR*tvWQdP2=A$@nV3!vtND_@V4P|g-gW{&BNQLH5f^)dc~12a-5c%J$;mY}McsCpYqH}&qxVZCcumGyc#b-$*h<$Wdnq~_|d zl2oW9!UIEqh4GYLswb0AP_P+8P|}XDbi;};A~katk5PgTg8Hk}q^T$Z);2rhZ4rX; z+MzIs)}E$r^d1kTM7HUHYFe+-c^2Gb(~Yw5O%HYNQMb|`cPBmEterD7ZiS<-j8~6a znfYnu{7l_y6x+O1<+A;pCb`PmOBcU#V2SQ{V%@Y(y}T9=!-pIQ#BlFy1u1Fj>3}XA zh_%&uZ{5_PYMwWwAK6svI-f_^)~ilbK3XEnb3g;gd+DD9%R?o(ku?J&mVLjxY8`$N z=;_Hdp)2Mg6LU0IYiRieYGTV@qS~lCn@5Mdt{W)lnMby(VKM!e+gKQ6D4x!o+%AwL6(Klw5qLF)4K+uZ~ovEW9J>pY?!#VU`7j!*ARuUQ!` zP%#M~S| z0th6g3oL(u&kgN=4*cVf|6Mq|h^#ScKZ|a`)wR3W?LxIT5e4E4f+OG3ZZ#vzML9tD}GvjXyT%Ty?{wQ|R zx(Yz%uMbZ-MSekNj*u`D&&S5qAQ7oF+f?QB@T?a$60r=0hf2zk99q zsa0pEj~(J|i=rW3jhxgj-szHHa90_z>qgxrGtu|uiCA{GUFu-ljL34LLEU$?z>iju zzAvEVz~{DWww7h+!_41VHaZ1rxc7{5`3GF?SI8NfFJ4sl zHo2NSX@d?|_QpExUP@V`#^94Uu2uKo1v$iQ)sQo{_INvunmk*u9Hh()7pxNX`R zr%5;Tu%W)=4rzG-Xw=ziRR#>3G-=>KXTJCYS?K*>T&YxJ5pPa-__XoJ7!qFVaX{s*a)$|P)*#6}Udf+aDLIVxm%uHky+2-HEEeNI)JHv3rImL~OR%ku z#1b@4XSJfGMhv5VfyAR`nZHtXk2BpI*H?aD7VK>H9LYcBqei|*@R@NG`@_z#9owDy zs6v~GpL&jr`VFSzXoEl3IMmtgXIOae4oOkZhCM8~^jxIl$($T0*$IsLj6ACEI<4H{ zZ&;l`iM(LG7OufSEu8T6-06PuiPVVPlS!}ieSM|%)0q3aA7teW^%D2T5>B)R=t;JZ z6COU6#!w~B`aOf_lZy`}Kz_+cPL!)HtcboGeZ7Ui&{f($c+j!%N;4>+Gn4t6t1&&Z zGx=AEFW_ZSZFmG^YJQ zt7hB5IXDl}6f=BY7pv?a(4u%!r)(jpuw{s&XdbO*6M21q(3qxn$-j*Yf0RA=$%FT) zHXM$zy`A_iiW#WmTNobEr{JX&YxubD-o6CbYJz+Ghm&fVi)#FA%#nRKnVq6_a%~I8 zSNXA)HG6^6kEp~K+`H0m&mShh?;KXShPSByeeLkQMj2*HIYv4K-A1N3G9YSlRT4V2 z1XQycd5aYk)g7>SAbV>{HL6Mts+*Z03u{Pf!s$$S8MQDa$}YS~7WwK}MaZ*dDkguy zx6!^^V&U^g*Sk+RKWy=tg$HGqv%+3;Ywq=#YAjl>XS(UOc1Vv$|NIPTwwI@=(|Mj` zvGYve6z8_JFY(qqPcntlHe|P7!&ymscIdWLv%838`iheT<6A)gc*(u1=SMw>Iz~c& zBFVnSyR)dzZ~+eu&ZKhp@hl_zZl)W?dXU!qv&u2J*}kVPK6t>FzmPvYycb6reA-fTOetB9%_syXT zUl_X2^9;uYY21Bbzx z#ktXjS%{~HcWn#&-hwVEUo9ZThnR>lfb_ctq~8-(EFt0wA053E8I6fX z?7{6D&e~f*x!SqACL0rwp%{gXv#cl`f+DU~x#=dRNatmW`|OF_6J2krH|WA}zmPyP zfROjEq75c5p8Rss;87D!mBG0&bU_n(GZPb~g!cqbjIl0iMVOr%cU-Ku1y3X|jELEK z(ETOY@P~LYM%W^?uJH)OGgIp{Y2rT3veD7UB*!EBQ_Uj-w-EpvSa-<_39_|Io>%$N zyHKrJm@26xtpQz-QXV%15v07gv<6t{hubt-gCU=%9d%yVl#b=0;?vGBI`T07x~sr~ z8gj0Tt(XKb%eiRm1!G6jLxZmU*6H}_hKW|W;ejm{fm1d?jXnb>0APQj$GPcRDWPU- zXRciV2s+F>%v&msCHac!0hY-rEN2;9k)Se2@f`7pN0nw__`u!%G5IhCwA3d}Iyz4? ztcfkBmr}hDnFgS5B}MuxI)T?lt)wA99gpV}K*<-us5>SH3~|vEe?$Fgi>1uEBL8?8 zlmBv|8c&9*u&*EGlT6#&$}-NziyG~F9r$yNx6DvUn-N8S8;m0Fz>djX@T~@nI5Xnk zQkJ16Fb{KS9ySMZPl{!9^f+XS1YUOsVE>ekq@W#?;=)CqVz&1DsuIX8gstxDUo)0-_v#qOw(>JX zCa)ML7lnkkWORC~z|=kE^((fpO9}WLudNY>#!I@*yApLWnQ+DeH6hPin0Bj*I=+Y6 zeLRSPDbhuu*&!IMLbwbnnzJ^*7y9rFmM+&ei7{(kdRQUa8(2=0jGvNkZs?jL(2fm0 zfHP2T52=+vLo0i0p64vh9B8HYTEcP)Jlb14$V8rQ`!bYIX zer&RwRb$6@?sI9X1%SFkJiypKEPLNmOjDf?=&7s+=39Wobnj})RKpbjeDTq^Si z>0|V?gpej$hrA4xy#AQv>@)Ty*WgqON3=TnO*xQwkjH+j%Ytr1Oqh24!3hte@ka%Yw4$@A9C3p3SX z##(J)@hAjjq*?`_&V1fE33NjD!}ECaehU=>D$iR{Vjo}&BqwhH^^1_GGVf2xUB};$ zNS#98Zy02@QiQ!RN+;x`?{g7MsdG-*MRD4=Bh`hMna_ zaUvXHPn%ebcphgXsK%TLW?nUAZeJAAMO(N zcA*kZYPc)}O(iAXjTx9o)fQw8o5xzQU80x(pUiBPODJqK%6fFVlai9a*$MSg0HQy^%8lSCrE{hCw50J=GjaR--sVmP z817081V=waQ9sF!SQ6d!SNW^n{H0jn_OYK2bUf$}LuIzb=a!{f|FV%M7`>kAWWBiN zl<-rTF*SeQ+Jz595oJH_9=?ipD8{ z&KKpDDBPrKOAPLiaT|X`Ub;h)6cEe&_qMH?!u?Da3n z7tqgZ__`zx4{=BZY^SQY{Do}qxxHGwz1`Tl*?ymhb^alotSu zxvVq)7t|nTzzIsH3u99 z7uwh@eld;>3q6SS_d3!1t^kuasV~6>l-UIJ=Z6R3cA5Z@pc=zDhm@ry z1%dGfd&lJxa+%(g8}Y5`EWq#j9qRWT&|cC5s- zV@^0#JGsH|z}L!N9VKsN2yl9QeIhAQ_I2PYqCbG5`x~GUptA>b$D@)$w0P(2`il$< zbERhMHiPcSmS*?W%ibUFizni}RZ`XjYOb$dmExlhpP^)Tmonx}L?h;Tk5nV?1xLja zlpZz8^#vFvv>9r4VC0?Ky zWe6zL8(SsN_X;e5#@=hQxqwi?3=VNbZN2BeeIMf7@0HhY4u~bZzmz{M1G@3NJgyn& z+OXiq_j#`&iDqDLf^|xcGbqNbO<4-n1o`^p$M@lEH(d$f1dX$iej=b)`HjwEE-P$& zzX+CwSQ$?tjj-B1KraWwNmjjqkT#WhK*WHoHZIWdjXmEA-Sg<))ji`C)a|0c*g>Gf zXYaU+#JFjiTCG27u^#`|QPA@zZo0yH3h2IYrv&iPe*S;Zf%jjcI!j#`XHgNu=kx1L z=ZLP=MxS35#O4paR!wosD2jcdB-{~XQCe)Y>&?NS+YK%$*N(?kllHzj7;s$zEi%(> zrGCjLnV+9V5M3HXy*=|sd)+3?eTCF*d9i0=Zw)H^b{D9G_CO<>)Gm1>k4&Aq?epZ! zvrMN%XGyCE7tQxKANP?wWiPRFh<2(x>Uos1znviiXu;Ai!f2MMGpRr%bCm)#Yc-o#8@_w1YS}{tTuLBW-R0gkWGyt z=z_^#k--^r_(4}!c@6-roYGS zqWPWI@<8JofQ>}_6vNv#FKWB^G|g5au(#dqi}>%G5~HBI`P&72$?UVEE4CN;E#)nn zzD%e*+i=DHJ2Pc~EBccZj5m_PgJ&Ap2NAh}+PoqXSeItIECPQiy=D6^i>7blNm8rJ z$-M?+Jm+rS!)9;tsq=PXf!W-Ig9`>@w!~7a7Pv2#HZVFJrpuYgc^a zXZ1%?v8)qApKugz^*GHxy!%%g2Ls%xY*j^UR;%`DP!W7}61-g@n(tro*#%+bt3bja z?wmN&Ijd|E=BzO9`{niWVxb;UtEarF|BoZD$;@w`<)wCnM;tV$ODmD_`IIZMW zte@?O*Y%QE{eF9|-j)6yf)yvJV_?S~FPB6E9snuF+bWM;(@kbutkhwEkq>0Th$3T+ zrc#aD7nfkP``>%Q+%5&4Il$Kw^krYgEpg~0_0g7r_?67fDVjbUeppjlWoa!nlAvD2 zwaSZ#@uB|i;rs(n<6vy5yq%a;!5ZLj>dE!pb+Hyd(*8(5IXq)eJ>>)47}p?b>Hf}}Tt z+P+Z2M=L9FPuG($C`q;z&Rp2X zXmLLM-=Xj6Qu6~^H&k{EuPB% z-We*JJE&1Y$;u z23)X99|y*;yoTAfWV{QfTsIA0j9Mh_9SN8GuTR1?556PXxxh(FTJaln<6HOGkJ{2A(C>z>WvtAQ5d zQ5R}~C$wRI)lDf_&CyHNUu%CzGYo-NP<=1^(49S0H)jXwbriAEZ+FBee{$LS2t9me&f0J3X^}X$4T@o{q*(;h!HoHO zSA>%;lv@DB){l)X0%dGWWC)#PTqs1_?R|Pz9Qu2>7tKR97O?r#TR=m0|6)Owv4=i8 z#h(X-VndorM(Gs9jg?z9jSK6>4VheLGBDx5w782wR>Xue&4MPaNcYYIL+q?W&XhevBR{O-?QuEX50bTttD!Uxb#ct-WNOKapXu)Gw5o`ngj9qpEg7V>` z&P^eY(_ZJ+zl@ziDg1GCW7TS=0(y^Fj|s^NzT_ZW*OuyD4a5_1iyV~-&3gFeoNXNX zDD7Tx%~*&tA)3gflwq6Tq*c zNEFUDXCmy-HWTvZ^+iln$BRRd)Eu=vYc|43qsREp>yp>G?7Y~y&%))nBSd=i$IMZd zoMt-*$eP28A#ECqiO|)Q6T#2JXk>|8gCFPd_+pd*b@1;zO`CqYp&n;M2jwe- zqIcK=ScC(CG+;MutB7!RsexMtvYG_=RN>@W42A_9 zJYYe=CPASEZ@z9}e}o%eaCC7=SU1QG0YZGyoC(DHsj&D^j_|9S#emAO{lk%uO! z+l=;xJAXi390k-BextDR*Ac8R-*1S{Wf9@k`S4ZV$YbGpi6pFLG}%&48&~dNE+D^8 zIxLJ$ooLOjCas8k$8RhO|Ju~Q>l}`+XjS35E~SJ9ETHr&5`+;BVz0;XTF9HcWqdxD zoW4M;`-)^!2I;FON=+(j`*^FGy@U<0)VPwy=+5h$4F|6TefYO|%WwjG#%DD; zNOJI=3Q0;SY6TqImG4|Ba$L!`b{CVF1bJe`&EiF;Ua>y@A+{US2*m z7qPl`ykyg;!)RcWFpq;+2U8b4CTwLPR`)5NgiH78m$7s43dRkubB#B0rkA-1H2+H4 zP*y#=fA@y92OmxeGj4j@@m*)-3Cldh{(mcX~s) z=l)Zb`oE$q_xtkC@%_(@D#uDJk7byX79RHRGSvK0c=TdMzJc9Pf7d@F`Z3RSy*fzx z_Y3IdO^pl3Gk(_MeO;HsWGZB8-MKyWI(P0aU7d2p94cs9NbmTR@dhY~c^3n-edx;E&Obpg6bw9TFZx z5*ONyB|*2|oii`kV<3?idqb|-^Tv7Lio!Ipa&2Yu&r?GbK%Z|uiameCPwt%L2W_Cz|Kx2S$o`Pei7V#=o3-z3iPiBHE4-O4 z7IWMwFZa?z#n_AH+DUG@+6QSTKu_8gB%fXy-7proiEzZ}mB@<=gSTHl8IS$Pw12$z z57z#-(%|Vsj?MnNe+chmu$gIRB!OF4mo0(pvX=ppaE_6dze#rIPNO0&!wS^)EXM;B z^Ue{-#4xk=v%porGuPhtd>gKxS)bNd7m-7slM&{#SWIkqMcbyWpviybJgDae@bLMq ziXRN{&#!+x@%9TysY<|B^VXS1`$M*Z0z!K;B|uq^oU15bz5r%jjz zIV?u(0vRg6yZl10>VlrA785}4hv$MqD=IQY42}Q(@cD*+oqeFV8#tR3^5g7le}DK6 z%*()}NFMY#b?`Rmg~X3vF?qz$jjLX0cs~*YeeU`3>+2cBkE5pE*}%~h%-H-}Ptee( z?jP2v7x#fq8Ucmz>;VZ-hT+D5><B|J06%4~|L$$p7%^gX!!GaOU3{!)cI zyxNgJx^X-AjWK8rcw>V7ZnGe>h!(99?93^x+qetQWX<&V{84=4?9EJIn+tF!_fGF> zz3Z9JTkKz4c>!T-?#%c_=5&mQ`^J?OmJwe(%s*&k?eD{%-V$&@c=}5(nIl?}zK5Sb zxO{Wnaf?WDf}8G1o8`{^lV?$qn=1kyUQpSt`d$Z^qF*QEIOR9al;_@%u}zuvQ2oj9 z5O7af?~88Y6QL2EACDY|Yy1wvx0K1hI27rb!gz^~{msenY$58wj<3%Fbl%Xe&2+6}yUAaf?;?B_&f#ciJ7_GEznG4}s!&jvk-rs1%`A%tmcStL!o z)Vrzi7?iDxtd1n&!438EpSz0}xgS~8eg~R&p_ZV?sn`K=a0qX%T5F9t2=h$%Pq0nT zFL&N5e4fMZ5rXEyu`F5sN6uBPXeQo4h1)-UwGQP9Z=Pdm@;c}6f<6o9(y&1z!p8^} zv~jsprVGCP{5ryK?c<}OIQ}{`Cyadw0P%Zy;AvU_h!Ia_GCG7B5&N4=7Y0tR+`S&0LUAP{(voNmswE8kwP!< z2>||%BHO3a1r=eXu6%We64|zJJmV#j^I>pd+=Uq9l31XX znespiO^-}X&z@k@1fn;*eL+XlaRhG`= zl%&brcc~dz{appQMYTmG(voGe%6g>^1@6j{Bng~4nhuP-+Ki-X5sBVpyyu9Y)>!ux ztDNqY2Ju|dJx`e~!D~?bhr(1IIvJ8=KbEKl0gt2rJKCoML3dtwkw-8&PTkkfj70gq z*y2?iPOa~2)@x8VJ$*r0@$h+(?Ox3G zrNKh|hV zG${o}ZatsJE}1OJCnZDE&f{#;a64{$Qo8?GV8BuBxu{|9MRT3)Uj0K&7^Uss#O>bk zKK{C4%4gf$=BfV6db1h+$vNz)N*C7)-O;xt&;TPyqdiihfRu%*=iFqf_g2~j?d;fH zlLEd8Y58prXKp>K5NuZoBh5Fcz-7DOC@WoWjvD{dDUyoE?L)W)6Bh<~1!s;Bj8s!z z!M@E$UXX%!+6JkNC{uOYS5L3~p0+G+%#oA)8?S$s*UU<(hH_@klg9g4?FO3u;J{Uv z&P?wHLd7-1%ZnU;a4jMwrKO>?p@h=75G*qu>Bi0x8l$6BjNS?LeX)n$dqbQuP!C)kH{(WKC*}CSwrfB3cA;^vr;aG ztYfEPiJ=(vk!p_V>PPuRa}0FrokJxU@>BB4^XjqCb?k^A=fw8)q3zQf{+(WYQ06n^ z`zPX90TPq(r^M8rU+3n1%H2L)qE6t3l4L4ewmXo1Ga3At;om@CnmIp0FWKx#fz`OM z9*6ZG@X*RiF{d||c-$CVcHV+E_xck^M@R5;87rM$nFurefJ0s3-;(mxd%nlA5Roe| z+%lh8o$x@ji8B=T;e4V8Y5((_C*~w~nUNe{%<^YcrK|qb#|*48tAXuwX~~Qim)3fq z8if?h;2L~s3`|aBf}M<06dHylrX7baFt&h$Y}Cr}de7#*yQ|s8$UlU)2jg zECOC>Bvc>WqeJJqub-5nmEUvPTNZF`k)N2J!`WV{D)VUBLW+U=O%V#2Xg3n*rPoA% z&0Lw@-O3+NU{M;WmuVd%G8N0RUQAj6M;7X%+49Qir%lZ31JzNAsR%t12@3{VfS#0&OyB?ZZY+^H3NRtuu55AY61)Iu% z=i-GjsAknM($kEYF%@j4ubp^Wrt1lwM?qHcd-%(0a_&1Vkvi4vi5hyl!7lpfB!|;v z4XHrH`BU6OIRc&;EiAS#go?t03O#$b|TU&}K@RdP03a^UeAy*q5vREHq(!f*0 zVWe5c4tmyfdI9F5CNG+?P>fIn1p(=Y@_JH}eVo3ek5tIK&D9e0vu+HcHW=@K8Qm=U1(u(1-jy*vc+_|mfJWF1fr1c5YS4*`XRTfou@bVKJv zImliUC{TbviMa`zW9|ZFKM=@K!bSu1qywl#g5JB|b{BaetXYCUGUmItZ&V>bpfb5k zN6_JPpyCLMY3=!^>3Z?w?I$lTMx;i+Xgpee3=~i;thj(ct+PL>Dla6wVL*b$j4%JF$k@kL3U|Yw zObN~2sCFE-xP}2T^@Zi1%PGLy8Qxa^sC(S9@)0KWo}z_$PcJ>ulTN(~KsJNUcKoYI zf(Kqe1d2KP@0!VvpRMt_nZlyUE#aFD0dg2m+PF3YSfGGF&pcbd40C5hUfdLJa0gje zWI*no(T7BW4g+r}1c;*7cM7GHLO>~l&TqUNv+M+#eZb--GfzAwbz>*L2Emj6Y3E;> z$QhZ22-pL!z$Oyb)`1gim~c)~&g z-3`2wP~=6xY>4n#2bmrhkVjd(X#zUza*YId zLkGEkqA|S% z!q-{E6byB$r~~hxeU~qG?vEmU zXYJp0(IT&}{Fm|c0o3r~k~a)M;|6-$<@D`3%H(6t|Ji0eUo7MEQ3Id>fEk{i_Yr2> z26R0s83YVxbb3&b{4MBn2+^emtHJ&#i!EF4^a58@5rz^tJ6HuaqnKz?Q7JYuq*>Cy zSJMo7U4}G4tXm!NaWEigj)J8hFQHG(nH}R!cyI@Tmh8IV*1msLHI` zAU1)*C9K?P-=LU8D0jRV)@C~z7lvhKqn#U_B@;U0dj%?3>2h23_B#O7X8+6BgC)@r&Tw~$7U}~-nBm189`@*l`F9;xWueha zgZduoi_Jx@D}NA{Bh0e23MeqZp_@86hJ82zxi`?V+lkklDE!qz%rf|m99N39jfQnb;B3e-%XVA z=Sr_axXqA8AQZC-y=_0Q&DtT?2diu92(YWA@C6?O=PWu4DPTDOpx#$q!d$~c5Io>N zZG-+UAX#FifXU9p`x8LS!PAVRIL1+0M{2cOP?jXTG-}L;78y5@9M(u3>kz9hN^`@JUzXOb)drvER{bZMRvLIxhe zWtq_=vG@)=ml`}sHj5=7fq{Q5(hzevv&T~ zhEVQOGpmUX2ZBCh0jVcDp!-J80maah1-&D{EbxOOXBG6J5tC2R$5wp+`k7FbcH#*U z=9$>c<8}+UgZy;~Z|j?Xb5Y2^um8H}tBABCe8ya5#5b^3w(;v`XAbZ#rI?rb|4Dn@ zfigCqg%b#;1Od==wx^}@{=YyX$&Fe0S1;%RFTQ0KXaN}fzy{{LclAKh7(|T?Ha=Rr z|C^9Tr+WQ>>HEqr|KXsF0%ocQ)pde>rvP8VJ2b3kLoX2z%{LBQ`p%A znX$jI7qjx#3kHiC8C@T&ac!FWwRB{j?Fp+{(t|Sfiik~%A?RcEfPVNdAkG?&4$2yq z05$!Ib*Q>%|Kx7KkK{iE%W1vL=sFOsBB2@x05eihZ%dk1M+mMpdj8Zr72eETJ*|Xv zeT48A3cK7~RwvXs|HV;nVhPfbJ@>CV0I&jL;&QkB;NL`UGJ~M9_Fi1yS!r>zR``cO zJ}~ANhyTQwLe^krbidU?c1MvbA^}WSu4iD_89{6wMZjCRWd-m!4acWBbVm+WRF{NV zE=Ex}ehZ~OmWs$mdKi)wR#U=B#H}S3S!*=~SG2PE3@yRkmDKdcn>1r#k~$cS1~hvn z!d}%q0&Wrgm74kUUXTW?saReOj<-;wDVW9ZXE!>Hm=Bip2Ep+={UG?d~fN{ z=s3ZB2Y2}u1nxs3jZW#)P^~k&R77_*)40YcB$pZ{g_dsmJ8#*l99e2Jzy_|kP*z-M zs7IC&ONr1%tVSJ|(cvKYuEKBrF`d+E+30NH*I_ty#V{P5gZ1ZKly~8OmlgzsEVat| zyQqT|)UpX<{|n{QwF$*l_eB18UO$wp6!aoTiGFG-eOp(V8@OBN8XbA_}@YC?+O1e$=y~K zaqTZz04P82zoz5=)M@{tn{$t8>Wbqy&M+|ujWZFA!|vg-W$HRc2FswLQ_^f?>cV1G zz=B=y0d0r1B5f~Kw@Kz>^)(5wfzyyJ=_tBNp%i*ma1{ZWnp@CPt590FP->~S59+<$ z?`kj|+y3*9W&N``=j36x#EB^qs>=XSOCVt4Hv zf<;|L`=o_2ki^%7@r9txK8roPO4W-}go>uI_uh3MUlQOKKstRREUW?itaQ3SZYLwR z@hj1+Q~LurRIfUtiQZdSA_aarJwm7O@afQGHu-5ulVYkQK)aL9h%>vxLUch=PnCb; zQ7$@(RdG;D$DWAw&0#eZ_FJqsTQ>B_?TOr;k{e>_kg;^kxWW1`#(KU%sqY_pM@852 zIFliEzCai6-_dG_YAZ+I1hx@SP(!pf4VXV_oSfFQ- zw}9{ob#V^+(NByVHZX>;^~VGc?Z1-Ck#U8VGJn&NH&Y+Xb_jw8;#zWHXlsFIxG_by zg67MTDZZ?LM?T05`7zoWEGD`CkEL`pn!d8gnKYu{Q0zpbUj0P1uVowi6+j}FT*y<5 zipV;`xUOCB_!gLgFBg?`;%LYhg1?kFbh3CP2~&D3r8b$tAv5_d2!e}5Ek*xgWM=imsqR{`eWj06YU60V?lZI4+n>63 zx}toGbOfKP+}nPb zHNe_p8ChGrne0>qSiR;?onpXGyhthQ*98~phR+_}z@#3QC1<^Cw@uP#Y=1_5-k5P31md=B-#LuvVu(^(uGPxK`VOaEE<~NQJwgBF&Z=(1}Ksq=0FZ5{xbOb z+Xim|>g|^pY#D|xh$Gul`4R%-inNt$=U_~z&O(dB|JE^>XsKErE8d0B(!m2K_f$I6 z##GTRu7YsFKF<`%$&;Gp6){=IcE1;~9o0 zqBvbovs^Y}ZbZx`Vt@e+iDzC~a;tLI6v|ZW?1OTjwwD0euvL?;aC3-C<~cX8xL86G zy&~;)-;H8}n25K!LI+q^o9#OuqCr}?E&}tvj9^nU-y>Zleq=HV=#JRM|b6Jgoe^}0#a<7Qo)CpoG zGxqwEa1n@P<~rmmb5cLvJet&KQagi9_YXvytQlrl&X`8IRU-dEQD3uwW~Fjd>XbI> z`n=7aAikUD*#y6o+;=_ffhC&G2g*u^%e3Bvd`M0|JL8j#%%~Os4@^pGt|8;%8cctW zP~Cx`n#TG1{dPeHz*V4F*A#t4ZT8PoyC05tM#n7KCny-aW5c^ zvFiq>``7Oal6XL;D#arubrXk(axBr=PGoqg{g?dL4jEJJ33c%LyPfX`3{;3+v42z6 z3;BI=IHY>;acV31+5Ak~YKUz-n&-b_H{C^`x^80pU{)*U2Q+CxP3ty(@wd}8GT5J= z{amHJJ>Ip~hyy(ub*sd-3rghIJkP@EHy#}=q*KJp`SNn4~C z=@w>7M`~4cSyypV2j)5^XvmR(%q!I93agmxh*MqkJyz}xxJT)b!%<}+6DMo3kum5V zUG9%MN@pBc*8JSBt-^1_AIU_k>31a}KgaCditySqbh2o~HOg1fuB7LwrZR#@RqVO`vtd%ySI z=pNnu>(SkRFp5)S*V+4=z4lsj%{5nuysQ|~JM4F_UcEw+5EoW__3AYdzFPG*Qk{LVoXYVZo(@9ledQR(1N%A)Unep$jp z9J@ci#D0KB6DFe)uX^$ZSsjhyj~)m_wpMAbT})s9a*~sCk-2dxu`qGJxj$-L8-TqV z?(gp>!!h=bh88Fg6a@8c*s(jj^7UaA5L_!fV#h@mYaohnVKpHpQUvHiDbW{)jbz5` z-7d_%2d|UHquYJtx_;Yi{_trnpihFbRqtS>!K?7sox6W{db{kv*qy*YbJK%wczV68 z37t;mR*-!>PC?0;jQG!h8iayX-G<}nZ~jSAy~qf_UK^?HN4hX=t(th07P^?mCHnZ; z$Bvn^UiM)mrI}lDQdz+TXr+@xT_|`Y4Z6&0?azE7=N4QHtm23MRGDh9fiv;8OV)&q)lDsoSGDX#UdQA~DE z573JJNI@hfsej;%<{+W+6EZmPe|hj~o2cN#Q_MAXEAf+~uO7-^lP;<4uD6OYe(1CTW^CA(kbaEU&HWwl7Of6&Iv@)W>Wni+%7mRE0h-aBoP zZi{0{x4VS|l-cqC%A$#;*amx*b>e%YxK*$l@hKmtXmY|Gs96HDqRldnZe+(se%dZI z%j_jVUW_rr)eegk+~gkLorn37M~jw2fBkvp^D%wnnx+C+MuXaG5-j`FRm?ZsMa4Im zWzILWz7NXx8KgkLjBI;N6cx{{c);2YRC%1BhrFR-y@TJ>q(+Yi945`-KU+mIy!XAD z4@=M#ADdl(c}k*p=q)>KkZ^b$v(Y8@s(mgW*UA9V?IW&Thr} zIL%kbV)`sw@Dcf}kdgv_Ow;nrN-w%Fvqthn=@EG3FFJW=7oJK-L` zmdPNz0v22oSCg=$-Pwf z>T2JKgYcEMCoJeK*PExUf!py@qcOFkt!k^cRbjD+XGDV~uEmpzr!@u+o>ig4-15rq z5h2a`%?d8$m%slUD>V3+^MKN&!F+wL+)8pak+-P?MQW-m)LOKWXFl_XE7>Y5@2 znWcGs-T(pJp{!`pN_}%1^ndLnFd*8jbF=aNCI`vR1F~g(59M>?;qV3J9KC*(5@!ivDb2Qmz&zp^IHT|&VO(t#OpJ@Fr)0$K` zQPfGDb)MBUTrzWJCn|I|C_21tP-lE0=C2Gnu4Gb_SlK6iVZj9bAmRqRdn6_EqFz{P; z<==||k#5J9u|tgJol<37v{cO|3Exag{W7>``u||CdQ5bf z6!9Nt_KWnxef?kl76#2?19CTL>Go*(*6xvf=jVJTGbRG7ib-9rB;^u>88O0L;X5}4 z7-@}iJ~eAtnyLR83FtLl26v&7B;x48@{hV~6T*2N6?n3u8a6Qb3gT>CsNyi85%$_g z!}660iM#%L5Si73NBY@Bj>tg1%!Fs;rcIc^DnL-#_$aw*(<#3QEA{@7^mE#rutf7( z*_WtcH*SGZZ!Y3Y~;crJr1XJ#U!#ZrWKcSK%K9C=}7qd?yL zPk*F(yzZknZS=~U`-~3S(WOxD6Wq*mXw;k4F9@kZ?@xbeGjza*K=#X2uh$yXkgoXn zn4-wuWI$#S8KXEBu54LkoN3EUa6A6X>(9XZZuzAS!$O-I?E7>LzW&lE6&FM*9k2N1 zuckjeTRAasa@tVFmZ7)Oq9MjnL%=%iY9Cjq-=qt~k&a=yA|GB6z;`zcEzlM%8+VAm z*+^;C^F&93go5kdAJ}IZy8c`Z)*jNL($6{rzwZPtTr)$tsX@J8T)O{qA(1}?ayD4M zU2~>9%tV=cFv^bxnH>B7g&A-cP;e~rCiL0dXE{@t`9uY|Gop6xAP)$4qhxCa0Ts9$ zVS80!keQAH|Jx6C6XjP0nljymgdiq7=*=)~)%5=7EL*Ps>Ha`~TXh$+uLU(a?a3e> z+|3lk3Dk-+FIV|N5KCqQCKS-qY=`$Rd@~sHSd~5CAt+Q(k#H@PxX&d3*>B1SPTJVx zT-6_jBVTx^F8<5I`e*;Rhh9a>bDYTSy{wHOR`w6LETIq^&i@!RQe|#gj|lW~-J$z) z=Py--x@#48>c>7_HQp`VE{1b+*wp#-3uE#xJcV6f@W^I5T|N-0VZY;v{ysQkZkzUu9%ClL1F<)V2P|(Mg(PbGPH0 zAJdG%#OGRUd*7>T?C!|_=ZQiC?Xf!rG9NUF^X|0>ub$M*lfgX)l@BF_UHMp%4Ud)f zd~z%7B{t_8f4<9p!FKgNP`{rsPgst*ycoy&$*A`^uDR}tcIUu8^RKoj*`$^KvQ1-5 z>2|Pf7A)iC1+SrqE)|320PUO@1XqT(ItWqO!YV$buA z3&efCEm-|U8bI~|$121dTKl|#fo}PaQ~iGr4GIg+(t`}0_%uezs-#=Qx5vNS7h|e%o z5nqEZHSXGWp0wS>-e>t1c!`fg;{UadYD=S4_S6ikf=_R_McVkA>L%!z&D=T>aOExl z4(Paf$00YMM0`W`92%K?A{0p9n=IXp}(yK%}_PDqP%cOTjKoX*dxQYiS+(rsu=Nw~BBpt#d z@K_841s+rjOnFaki6`lY`QvvW0dA1lQb1gPV;0$%Xl)_bZ@2v?jP5C4eU7!8Yi?y6 zhCa>>0!1p5?(w}u7q3&Oyr#;CX~<}xhg0tj?t?XC&97=?@X<5dGIEnZPwV?Q+gq}R z+k0EGv8p&O(M0;4OTo5vxW+%mp425*9c-iT^Paa)rVc`Z3oKs;EmG>Y1Yad@d9;qL4vOvkAJ#^D zzhoA#%PKJ2cXX+=0DmJ3$JhYrWUaZiZ=JZ#zu?dL`&$$ny%CBprJ?GWFfCUFN z42&t`{)LrEF^-J|=zZ(v)n0E)2M+pj_+fq+lI&V5J5-<3cHmM_?D9#iTFuIkd($$8 zQBR|ATxMRjx2>5}wXJ;N@C6v+YA#I&Y z7>@NWe<2^qy}QdK&gOwf%i((*%-F5a zx{pFIF3DV2eFVrj$&TlbT}rr=iKPM+@@0iMPS<;#6eI5}TEkPHOT*QxgqD0k!dPXA z5GYPF);9UIqIDnNe9@*!1GZkrnr?1cUKCmisuaG*{pq*Lxz%Ihxkg;1gG};>T1RgN=_1B`8EaLun7!whWxr!KU)7J- z3F0ienMXe_2C=z6v62bU)P44ipXY^OV99}K%DhYA-(bbtMa>z(Lk7K!*_ia3FwhGm zg5YRb4MD~mvvw`dyBS}#;R9BHod_y57bmJxz6R3v^V7+R!-6u|b_Hz7AcZ#hAc8L{ z-DjtI?)w3XbMYB>hvksFgt7rzu*?Xq!+gxaF+YZBhDXc?ny*^4i4cHUJmWk`WjgFH z$4&hL&?9+xGtppnG2qeLPwN}sp5KeSWO0B@r_^QFT_MHn;jj(&e*b(Xfnil|fp=P3 zYUQlrucct#^HNrFX*HC}Wi+9565FTYO%!>D@Q%O~B(BL)W`Wnf5-Nzp}6^|Q& zfM-8#uXtY{HGR$jdXRc^)|MUM`Mg!{FXfWZ_F%)+yb%eTKV<4ZJv>rzA83d7XZxwp zHj^?wguQ8mLc`*8%&j}(5rWTyAn!LE@iHVI6)g8VpSk!oV9tp|b9N)aDoddW<1K&> z9QO}Wzz#8s;do=>{FBNu(kb(C)$W8vv_YfqEy8L7T3b~lk+Yws_bMAC<~DRKajG~A z=rALG>s|39vL(>bC+WDQ%erbcTtDu9o>=G9cD|CqrtVQD88CDw(FtswHk@XnvXgjU zj8P%fjyk8_{dqE3zUl|>gJ&|X`>ldv^K6=8<;1RUndGp!sWxGH5Y06E$49r#6t?() zFjz|@!G5sB_EXH$Opo&)r&nkwD6K+{ljlnoz#{*6ca!IE#0Fd!LPoLqN|w_0bsLhp z2Eu!WI3dNMHwF#O(>3wC@O_mD)pAMuKyBZO>ollukszOO0cWQa33C3#u3L`0Ts!72 zn-F)NNd@s9N`41SRuYsR=)SP zrz+l$T{)5@gjonMuQDJU{z2c_#eSJ(Zk+?lTvT$Gbt;;QW(+#E}M!^caz@`cVgp__OrA z&A5yhY{t}~b6L?9k;vbisvOxj)%`@iOH77Aeo*eh_qj0L&9`l#t+j<>_X8!VG4*sb zmA?0~n=YAiIvgVU+emdjfOxJP7#b~=oMMNICj!xcRCqy}^g|f~{x0TcEkzsZ`=(e_ z3`Ae+!4Ou1a<#HTPvEZcUYU#q)&$$4%d=rU)DUi&vp$EmW3RTw@3U#k>9+Do_PVAl-H*@&2NEpfAIEmv~|w>mI2lXakYb*#%<;ua;S z9$c>Ty{&xp`}YUr${r0dZ8L2_%qI+r{=KNMjHJtK85tYIf;!tkzDF&$ECW0;4g<9| z^uBuuK)P$F6QT{VfJJaMFllSLWJ8OF7A%?;Y^YqOt}6kT0|Z}Q#ZvpveBIfYM~KX} zl@;_r{ulCan8U{i3QLodlQN>v5Yr%R`-N4+Hu4=%ZDC5;jjc|)SSOD+@iYlv@$J#v z$#RL&lENY0z=5F9KBJ4nSq9zMQbO&Y_90A~-2q)W9)BX_3)I>$aZB4BY%lf&1XCom z)&E?!yN7Z|(qZaj@h6qz+48K9UA)eyz)aS&#THHm}vh>h*xku?Z%}D zMG9IKEi6fWLXZjL-Q!+1ZOvr}{)^}q^K!v~sc@6<1 zPMiKQb%9W8;#H$4fR}KXzxlq$){mdvdsxnEsAcP~&i-AT@6I*Xwy-4QWB)55E z9-XA4%8uy}HY>8CGH?)@SjaQMnooe>EEbh-8+4H?_bbPk`567&nkyA^C9;7^<=Ukp zso_!e-Q1rv`X?z7sXNb7WYR77lAIHArZVaWZ{W%|>`q@Rny7R2nFKRF1vjoI4*(kQ zdDVXVW>n5e$MfzGwc-zv#UUf;6FBZ&M&;oiUlcxa9QJoIzr%`F(}2F)%~ET4?~r+o zArSP(CwNFu<`UdH_*|0scl~*iRPoCz_g|g+4AeHyM$6r3c^^ z`xRrNS+JQk*Bv*0g^}Iq{jChP+^vxW!(jGZ#SrZobmh&QOJwFx&Pohc7cyK43TC2c zkrRB=B*qJ(OM-C9&3O_*Sy9MBi6fZs=jSC^aW}1W@O&DO)$;^EZhgRFlE8d&R$sSw z72$b^HYGG>o7atruzhrmaFvw#C~SO@nw4g<(wRs{qH=Jnj|==!Z1GQ;zc!_Z}B@BgG_$HIOh+vjPAaBnO;*`+GHAv}P(TRtPs-1TzcK8m}8!JLX2X~&L^s?Uuw-clW^vIMs5W)k;{R0a*&TnoulQ6;{7cqG9bDzx*%hZtsu9h9fTERfBFZw9_sE`u0xC*4JaWr6$w= zT^?W-HEP#Q+n2(?YoI(v(u#UqzB=(YiGj$1?&ZNPBl`P+x5<#t49jnpm9)H!MV<%a^_lPebz!L6Z8Jci^VExt7iCCJw&6>bo_YX@{;L(__DX z*oYsgNR2Q@7=!&$NK>{0(K!O4U-77tlyT`G#f({|iSx*1-@l%K0|CDqsw}+~Bol9$ zflW)68REq?V2Y!RJr)fqnv65?GCLCdWhsBL8K@*VKkzUmCrWbj0=&C8MfptdxQ!!r z7Q`xE68)Y>Cp3p`T&to5CcH2etJtMXf=Yr)4CJ?$)3CKhk2}_>u<)-5GMW+o3kSv2 z7rb|bjKD(PH+PAFPy@K6WBfxoErvkemobG_e`}A^`O!fp3*FbF$CUG0fFBw$+dj#q z2-iPsKs*_Z_X%?^l)=#!UVjgpW-LP$@)d;N4P%xF)m#kxqWW zK9m;|L;PQ-ME`H`r~hT}@o!S2Bf=w=Z^i|Wx6DuTnF+s~%cnud?%Ws7TTv$nXx5Hx zHnj(^0Lc0vdAf^>#NfF&RvV8PeG-0dlEfI}2s&DS#=EOaNIDK9b5E65eZ62Gr(>vU zL>#tv=c7_&3gHKs><*$@r_Jvr6%AE{uaz8+4$-V_$EjM5*zA8pSOCvIyaFCt%~oEt z?6bt$NH9m|AOxlloi6Z!_+`nk@U8 z%L!ruh*F8ZunuBAnv7i7HpG@Vuf@2Zc+x@Od;Du9Z}CbJ9d;L&NW%@p^kxZcuSwPO zO#2LGOFluLdZI41l!Qs!NsVH~#_YD+Yg6A3Uj~VFHY;QHQYQ@6AQ>3ni zhix;d21FvDE{EW!17hjTd5&t&QR5svb7rdv%}6fBPS4xBaRvp}f;kb*WO26Trz~!b zBVbiKU2cbbXY(iWCVUN-00x=}8zq>U)>Aqx|G8utk$R^P*(&->Xz>oxG zBBV3`;m}&QA{pPq2KnAQE^J@$aSi5AwYSiCBqLrJje@N=GJ`v^2G&>V~Yn4AZXdy~>~# z9pnNFw|k_*-X=MQH5B%KcjJ`Myh+aS>Lt#lu_r3arVpZ15zOKpwhwox3u@sz;iA5z zRbji2C+XbEy3^=Tz8RXdHflo2E-wihSE<0V&dt9hP<^L8p$aziQe26;6cwFFvM znC>d^?be|j2@ybwhD#EZ<>-G(buIw39-f{zO{bGN4p&$CS4r`%zXqE%jee;v89Sj4 zN5I|R@G2^WYI&4ueN%?#;CNO)kZfNlOZ(~AZR{}XmNW=Yk^cFms7iq|``eiX z!vhW<2u%LYwt5!*(`h(`v$>-4@io~G@QKT;qa4qLXY*wV=#6?Le4Kr{EN6f>izT1p zXy=|JSz8!=r^YDv4RJGNo*~BJxP)Y9@kw-VK`8TJV^r`-I^7D0(;N|02QuB18enm9;BqymMbToRY>b zqg0eKi-;;r0d+5xw@9vyc)JI|X5x4*a8q2~6Ra)_rbljEbe#M(#6i=*GqR^hztk#8 zA~|IZ1s)ujUawiLYQI!1+X!Gd6W`@I=@Mo?UN6a6wB2^pAtg%QoFY6c_BKe;Y+;6J zNCN`8pEcrSTTmErJ@?+954Rr0Cs)uZYsm853qH;~5jN>R-`sRc6>E-A4Yi%BSaMvR z=5D7adKvYg#njR_eYI)7SHR-&NsC2)8vy;i|6JT|3XTD@DX(frz~ZfeCTywy(>Og1 z+$43_8fnr;y5dAM`ywb5PT`?fXzsxF>+><6M@^fS+P1m_R`o62Cc|g0b^dyjgSP8x zS*tQ;ze^xBUnMEC!?8;7={CYag8@~9c9YUdn*rI$I7o@!J;%Dd6+lzQgrbswKu=xr zXnqG|KMHGZsEcz|UIEj7-HrAM8#M$L8OqAn_>B_{KOgyI4eWOys(jvlVK9xBd)6-T zalN-0tJ}sixJHy?J0Fj1&%Y76Z+glKLPQr3qU)TrPSD5q?keb&j^(6+=o#=@i!bKs2|YnC6f_$1L3_@lbf_aKi>qt6o)}?3kdqc zt7IjELVOn0F~yHm(@OjKH4V^h@&|kfUm1`{k3!1fGltRK(3raUahRBwgA5Z~$UiGF zJ_x^3z(WhJ6=MGZ3RJ#?kc$=@dd@4)u6Sf>2U!tOd{-sh>i5=EItQ|3=hwbn&8uhK zpAVT`eKq9wN=7XShN^wX@ezRVPfKxpt@L$imU=SE6;~#ECytVw^ek4nZ(XmhTqK70 z=c6gE6d=lrVWt>Of01tr*_#@e&g*Xm37)o({=)riW63C<6lk>s^lli5cxU2b;qi}7S6+>8zlw?uCCQ>!nL634U zHT-)q^JVue*=dwThljX<(LmIFFQfsizYA)>jsHz9onBseqHR2O>nPG}{V;&29p-sqsQ7D(h^MMLS` z?AE4n8}T}~uaYMG9mN%)jJdarfItPW_j)5ypyBPLISvNdF@;LVKEC!`*-bV~yM2ld z$}BNsmKwf&^OdAYlLZ?LCaTxd7Qyp0Yfh%64GjsIO|vT0!6lT}`nilIk?+rA1eJ*h zckAFfk*d0;4nP2;vV>Q#x)K5}K#6$XieE$=^kXPUsz2a+I3a}rf~cSxexJX4fa7go zP?0Rh5w2U)a2ONI1M!!A*=loZ^9dgC8Z_0Imj2tkm8wn>j|^)5O?iYBxR3>2xD zW1XNMo`B6@$Z2iqb_k7;r%^+O=f`dH5h1W!f^g9Vb@!+vL0>~s-orx3X!<pU@tru}i znxyLZEv&D_o6;up=y7Xfg1IcZL>P2m-PN4Al>(!S%_VC;DMbzK;8c2_qT_jBzfClR zk$zPlol$i6qs0Qd7al#Ni}_wn@S$Z3%&-7zd#Y~v^wt#q*QTHS;dpOUqDQY$uZ%BZ zvY8d1LT!h}r=JLSXCo*Qlk{*120f`;;Kro#qGPfOgzc+IF6)`VnnJs1R7NVW^iM+z|xu!Jt%}Vag4C0cB6Hb3~gpYziAgSH#JeeZp}hD z5zHw#<1K=(0X#tWON|F|GF1F(rKJ7X1~e=B3x4J1w!N!^$xVDE%-N4BMpwIQN{SoY zPF?7XTH;QZ#}tp3Ls$WFb~tQTkE}w|8iz-u+kaWkF*5vuy%biRw0zk|Z(n;$_R&6) zCG|x?8TmohmmDxp;Ba-~zmq85^1hvS?ZFN(_#HbTh3uy`4m#&lmH!YH< zK=EKW?FkpKfvtv{9XopKDv^6b6yx(!0Gn&wI1FH|eM?tNm^e?avnkrXQJR*g&W z-&C6k1-yFuw}`!ZG;06>iSrQ02L9hP*om%;-~>2lsm~Xc3q!ZyBp{l=jmFw7&rN32 z8MTvu_8!6lI{a0CUOgntHXGh@Y=9SRJo=*4c=V~q&=!BF5hB!DGce)9E^Ba@INGaT z;mAlJrAs^8rcV{U_{Ni=j+U7ga|75NST(Hy>|+5Sxp>hRWx@16ydK_h^32foMlEv3 z$tF5{Kx5L~9(oQ@X1%Yg*4Q}&|8j}x9)p-&^*P_GFS+8%;D$IRCu2pe7y^iD<~_bt zi(SuRl+phVI-G29`-!)tTYCQusdjq4fKIWLTE*5X`^%eyYPru$_=SMXk%ptCX00{9 zv(^U2?I2#YwE5kYA{ULz*|9I|Q7#b%ZszXeE>TR2nHJd);pJa4LS(7n8+liv;}q4@ zVP9B+65GA=>n~BjyZ8;h=etb0{ch5&3xp2G9z}z0THgBa$&lKeIx?X+AI#*A9Mnb#ehHG zBo%ub*eU{4+_tf4=uE8{9t#zVATrVy$>y^I+B@{Hkik5_n-)l=_|jV2`zR&8t;qF7 z^jIWLwXz!r-*LX9guIHeW4-3;5)Qtd4V8OOsoS=V2S)lBml85mh^!{ReFk(-<99{H z0G*%OQ)P0T-oe~OuR(-=Q$Tt%s7wnp9$!NIvdfT+@sSJ+^xZE9IYsF^?*kiB0-rz~tAfy&bTc>a zvw8nE#K#c{%BJ^CT&VBjLdbOPcHnQ`5c@^nnk9tvG2t{Z&{XwfZo(2cGh zX-eB^ktAMsX(YFOoi^B1LLvVgmlh>{$CO!lr~Vl29JXr9B}|*`FPJXv+0n5}qNw5+ zAgpFd(NML3e;#Do4k`IaF=N?IfWHuWu((mSs@klF%f(q*Hd_$e%>+HG* z=;pJ-a`4=oq$^Qz=VV##l3(1=J0;s|b-~>2Q<5kdT^m1kWJVNnvRMR6dPA)DR)N8{ zHt(dqLtov+;t~7T5q@WFF9dN;*|MBucY>QtJP$+aoqL7~K>^!*wsu|^VF17G-+o4F zup#~XL|=mUo6zMZ8uSCJ7?!Ynx!DQkf@g@UCke3^Me$JIAe2|9l8*TE!(1ElNF^<6 zceFIbJahL92cwdzd@>5H`fXsm=O=QhZvTD+<|c+ra@Bl6a|oL{$Q7NMLvWlX8(~3# zZ}+-P z^PPFSmt(tH7&ftstedv`U_H#09Cv%tyGx4|E{7B_MK$Y9Zt_wdzhuXN8}X{5 zp{`C$)E-TS0%nCkdaOCO1Ika@GA#$X!=FSnljih*FJCXz*EKxwQKQ>!8l%J(r# z_p#QU$g3*f=py}F!$35lwD{ge34O7#pjMd3gKb-FTT5mcaWRM>kduf@JmrHyfLg@f zIF1SdX@K(&UP7WxrD#nWlLpzj6j7JHM71i!^g=K%@$~NB(bC6Fk8?T@)SqYKWxB~z z<|s|$--L)B`W)Il#k5?(byAuaX07kc5MrON))?#@P!vSQ1oyRekB6G2Mg=)+zqSHp zj+iw-N_068dbSFgkg*J1OAzC8?~MMN+OgqansK?RPv14eK-;081w0*LZ6KnCttR-kSRMYoBC)7&7A8V4ONi^o@7L=E z@3&3NRTtl#@ry@OJZlGB>seQwVv!CzhX%S6zFqvj!A`;1Mie_%~T-5=3T1TOkuQ}pXI;$SGn(DvuJW*$ajjnZR; ztM!A8Ykov&ehgYeJPQLFX?OAO+yOTZ!Ac4!RMy`=R8^Vz4;a9u!g5ru17DOO2PKSm z#efWMd)~ZP68t)KcsXBGgKxgM(snOOFNYRtHV|;RR1Xvr(oP{P)hS$kyp|y1)yxfM z9oG?0wnX{~_ScAhKp+_w#a5i}+e`zCCE3LsH z{PEJg$DRu|n?Cr+lCRgf${Q>j+}>=xtATUhcLE!t%~!yu=z&75A{Q=BWja@Vp-A+P z*+Y~M!87JpI2`ldJDwvW$;l}fUmCVXM4~hw&j3fCsN&eYGp&cu=#VS0j4-qx89Lf# zQubZ_SdUsVZin~$uzd4IvU35| zB$TPiA9xrgO*%~5y;)&5ob-v;{z;(QkkQ^3Su&(XL@Fj|r2Z}54DGcd(}Qe+2V!X& zv*h=QhGUs3)}#5mG#cIeFdD5635?2l(y;TEB79a$jq)LB^J()K&qkXt&#R+>KHxsKi$hj%xB#j;pWwyX$#FqkG?_;-Vh|*5gI8n#+gYd|`?yr@@g4@b98;4`br1A{< zLz#S@JZW(PmDBgo6mDqoUz?T6Nt*TCnYW%rhO!Fc|pGC2EGC%Q4K(eM&eSjSWHJ#WO^zt)|uz- zmTA;Wu6ka`aO`FIZ=V4OlIS}h6h$Mj^MScnT-S7Vx~R2&I@VuwX|vE+0OG}_1H;O4 zk@37+D&`pp&f9bW9wlrnq(gD2-D^s+93r8Z^clR}=;;PV7c;85LwrwXDCYB3*~b^8 zNbyukqN6-FT6cH5YFXC3Kadvz0DNi`zK5!KI&F=o`?crc5&F)uyDaV2Z<5SS z-XA}IjYfcIv37o^QFwtbV@RU76`!sueTEi`0u_y`=fgX=trxXH?17CR&Xj1~Js==Ig)w$*Fu zm-;+eCPdDy(oNfoeZX?vDhR zvp#g=&AyNplwX^vTrL#@MZDlWl9j^t*&Uje?Lqx{uZ0%t!e7tday5jeFw2t~pgI$f zg_1^=ZCMB7?G8aFtd<<>H%u->|GcUyUP2fx^6zAI-jD7P_j=XS<(jG&5tQKps~#sj zD{N>jCmr|k0faG`-e8GQt`qLNF`p-r!VLG4?U5uoZC<#D7T){AFFdf82$;uRP$*xM z!f&HrgAmXxX3J8JaX2Q9A#dZ>or4tWB-t`1$x9x)k08G$&g6f7|go6XM_V^pj@LpsdwRlJXv zN*vD*7sk(zH%Y7Q9w2*?Y=|j=yqUAoMUrqi5L@Z<-WJM;j^65!|9TX-I6Q0XJ~95! zK~q}r+c*ws%Vvs zG7c2}&G~pamC*Ex)T!^iSYE3k;RHuyJNkqN%S+qChcY5Pxl!C^^o67mp194Z4Q z?8r74RH<51tX!I?LDNkD(#hmk_a2=}LR;K)pB%f%=cu=S)Pu0ISDWZ!bZ zrR{J?7Q9MAk=+Ib(VLN;L}I-^`{D3AmE{UrAV6%3JDqboT4?*}{$#Gu3`WOnoBi%> zr5noLgcw1BV!mWPA07#+cA+dDt;?c$p+vVIG?~xSgJO;_yn2gMaiZ@p*8trt{?{B2 zr@hW=t9)-ziG_cNT#gH&>@${CyzFooYP*=Mpc^ctxWB;T@+%n5^WrxflifPM*N|P; z_tyvB>fw|c9~03ku#KxN2njOkL_pAOH&e}yrV+FepBM$#MjJe7sy2Fqq#&Wr_;kG+ zo8ZkX{sF0)jAjvRG-ml)wF|L()X#u(a-rdG4rLS3SVrE zRa*mA!}fR_(1y9-ZnSOf#A7Ll{6CUJU~=JS4(u+m2J_+5s{=)%#2Rz&Bijik?jhWr z3+i#}>U#7cFFXfsv9Qzp%WQviEVaSNTz~celCU{oOz7`I#{cOM871aCe0hXF0ugoL zp!7KTRo}lgC@&o{j*wOS(-ZU_@7tdj3K5rW)8zDyN>HA3{prLJ`9GO72?Bte1X2^! zI`Y*+h!iqHfSP|UApa=i!!5Ny#2`d~%pfEzMf9acX6ld~oJ|QzjnT=nzG%v^zH{0L z%%>5mVxVTpGb5WU4M9~oP%!O_#G*ZQT9tIPSx0`WawIcxBFg-%Lku_iNF#H#S%cr> znm>@@Go}yCA;>p+TL!JBBG!Z~(binW;4aaGtootPxCR@S(=HY-*hfCHC3*e~O;q>i&SgwoK~ii`p7+`LSnc%*TkD1eW!mmxuE0LVIK@f1;}|r^ZT8T zNHgDOLvbKWuDJ>!UxKs9RN1Kqa5E~^RceZdj~Z-eQ@@FpIT4;LG5-J=7n5rDDj(kZ04VLNH0f_2L$M1{k?o#&}) z0$(ssz-z2IFEe$7<8AS(W#r@DJ1@yDfI-L$vE-drE7>=n)Hot5*V<^wAyTO*9G{tZ zdxLfS=MRzPVEwQ%WWg4LBYJRUSvk`8{`;izJCP3cE63>HVEPD*@_ACwEZ_-PpRja$ z!J6`T1(Sjv@XXuODI`d*g`?JNtNL6vyEVT6GP?Zb%;X8yz+&5lJ&Nl16(~|LVL;d%Y$J@|FU|@vaSSR~jTzf!`n`TE~)WV~jv_I1s^4 zSe`y0@Z6*odJ&_m?bX9rld0yfm?VwgaaiUz)93t66~_VFHxiWZbBw)FI#q-8T@FGE z)b(A4^J^;1Qa|S0Sve{-Qz4p=LqWxFsYLp=yN!HXK!qWF4vF`D7Wx!`h@l5$PZD@u zX`!uw^f@`5(xag1M!x>_N~6g$&a>Vs_m^gifYQ?qW|f2VyC;-S&o^POgN>Oihki&~ z=axUHhHp%D&iV3LEoxvfyG1;qFzNwSo|{Bqy`mWQux?jGE8=B)6D_%Xkq#j`y-D9^ zjkL4Qe{KMitWt=vg`- zH^r@9^+jGibbZm}dEClbqXNl55NxzPjy2P$^y~NSsf@ zewm`c``(5f(6D@d$liPp3~_Lw^zkaM&gQ$AI-yp35B6HKj065yGz1nvu-*WtVZQ5? z!b|Uas+>B*%l!2U8psei-=|0VdJ>bpuQDgSrjMO7J|EmH2Ze0l<~-T!F7C6Spg1co zCajvT7S0sG{qPQRQs_?i`Eu6KlWN*Og`UmV{I3ed?_iXekFbxisw~fi6zJW&LMOud$vRPxhDZeWAllqJ-*QO9z|<=n06&ph_VCwA ze2-md@Z_h^_a^UB)sG(4Y*A3psOcK+d1C%%@aYoKb3V=Ib?r`JvY?FmgFE8SI`Tma zECzdL&RzhD+Ndp?YYOsYq)-xwZ#I|Pi^&S?<{>}(&V1G@QR;(5 z_k*pA8s$qLrY+3IbD^BB5frP6jr6UvTfv=`8{_i&uI6ZhhJM;JLksgI!MG|6c3jye z*OW8Em)EyRfRg~-59D$CP?PHqK|OkUdI`1+%ExYQv2}=@vR&lxMm_5W>uXn&!p&RI zFpGWKgSHU8|p9ZrUql7lFJCW|BVye3bCWhu9zIe#!k15bH?j{=BaBr1{x6 z#ZLOi4o~N-XDc~WBK$9wlWBMcg-RZKox`~q@VNeILJ7O2#15h-=)7J zg}U_080wvYy4LlXz9Pki4q%xvlnqt(rR)1KNPJpecG7bekbVg5dWbh(XR0zssCs>G z%z$N!+)2E>_VnN?(_FD4{-uy89MZcw!yVvg5v2Rprt0;zY1QicgX}1jfR5F(hqvZ9 zFgR7dgFbJ|al!Iu>E@|Suklfqws!iYH7s%bODqOG=#sO=SE6=}n3N~zjj@WNKgGS8 z^q=QM(j@9EK*F!$i1xlG8i{vei1;ns@H}Gdo{OUPslBHQaIl9ChgH*${f4#5917k3 zE5lL>0~~306k?Uf7^%^?;nUVTJKdKoQ=h#sNdO=v=Q?PzD^pP^qUb_E5|j|QB%G|xm1On8@;=s`1@R@ zA76F8q?!cs4a55Mv*a4*8UPUWHC+T_lLL~Se!F{?^Xiu}oW3u6C#|gqycGd45f41H z17Li<-1?IA5Y`MK%$rnw5jfLkWJwVZ>+OP3!K{GY;hrN`9-(SNKor#jR=IvUm9F_z z8zg{VRz-OaMb2nt8y=b8Pagw>YWTfr`2EYRgyF9Y1xzY{G&Ac5(p1}Go5CZpn2e;i zPenh0rY;<(sygVPnPsBh7XTqh2nh)uwH?eFhP@)lBfv)QYg{= z6@#m|fQss>%#ipTZ=0o+Q}b>491=Dmv0t)e<2O(zb+v0oSKnz z_{+Z+ce$SE|8qnPBv@ksB<}8a^_<`M7;>HvF1xgM6D`c3Ik4BD|Nn%|{x1Q-CtP@u zuo~<8kOp)h2kwu(WV?R>>UDU4xXZB-$8Y{32Bf}LO^l^q(Qor?v#!p1gRMq*lYBDp69;zvGZ zbY`(;{jckHp1;~9|He$um8j1S26n|`_H(8j^xS%1l<8v|0(dgBoLI@<{Mcj9`oC(E;U4Tx9Njq=3QrLC>-IMXcnN=Yrs+VRLLV<%kdZ1^w%ZT=@4HdQkG(7qMM9J^R)2 zLn(0hRuNvmSFBs}X@5?*M5`=;%+T}6YZ4BYFdVX!3<2Bz(E^A-9F!pK(aTsd;DDoE zZS|Z@H)Qk}e>TDzIt9{Lnt#8E*aA+*U8mg%!!@A8eeM?RVTMZU{=zsvY@IfbiB zgvDah^z{=yoKK#IE2E`4kBXtN-0^Y)J*^7EvQD@2<%oeNSkz2Y`mQnau0!H{KBso# zL)hP7j`Siaf1M>hZ!#Tk<;C@*XEHT*<;|zM^~jx)^#*vk28U%U>Qn>LqgJLXfH-Tt z=6YoLO+E<;74E;(;*xueg^n0~R}s5&UTNwpxj`)rKbhdlS} zU&jvMy~fBsTM7t>!4tnaUv0SVBv$RcO&~@WaDA~f)`#g4bK@1_Xx%-h&^jK+;hr-M zC(|h`@-YF&OW-uAOFBI!G+$LUC;}N6jXl3nV|Ea+z%g3%v*HagsuquM;nnWNA6I}n zF)_Q^d#MIW%X459v_7t(`l1%c_iVw#hL?!o7DnawhM;PvD*to((>N3`WMh+~^{b|G z?j%zGAdQJY!lwgHF+7(1Y7^omspo3nZuuWdZtoi1p?t7eD|kjfuiaciuVA3Gb#YLW z;TF9<=h!-t7XOxzH}CrDtaW>zJl{ffv@(OP6pvDHO9Bcr4Qsl-xOPrDiK8)4}h&a~D0750;y9aHJdR)5goy)5Y?$C>3A$}&{ zbt8~Cf3GVYMKhA~YSx+p>sIUKQS?1_O?k{)yiSV>tXcUdf#-$#(5F~bPJv3-yzU+7p3C{&8r8V4RX70RVnY`Qu}B zq=7h=be*Qy0$;Vwgks1raHS;xS90$(%uIkL^qrvpr6<=|u?B0gc15;Qj)Xyu?}FQy zvdwc7g&+z68!PICMvtjqurw(#FX2;%`yjunotO1z6AJ3pI}g~NyS_=ny>)ZKM#3lc zTIZlw95|=;WhbhkkS78T9WN=qu84Jd^rvufC};4G_yyve0>h%BbywgPz^-tZYnCJ7 zH>w!fLM;0&qUSW8K#Mdd{Jy76xX&GD1MlquKKogI@%^~1GwO%_@q41Ct6Lq$cqAo) zise4uZ@|xiN#BVAd1U}kGiApZjDT)_X#DMPcMPQfHr`_guY9UnsLHr{n|Iq$Th|J+ zETK3VS&VNd=X)y&9*IFt)fn z1>P*gCl7w6fY{I*U3rD(HF$Qk42o-lPnbsd4$t#0&*6J9m4XR;u=6mFD5%Urs{Gp@ z;U;)^?;5n??B@nO6?_d1?|nU=A?v=NrT;xT7OxGR4!^$($r=5EmCId@>gxXoIB*EMNlf}zJ{sOSRJgsmWJB4&lzUl zcmzfR5T5!MSO8?Yp8i@HnDOUdIy#jtDm)0C;B)FH$mpJ;Tu_}5AlliH-1Z@VXkpOq z{V299c5ca|bCzmsFGF(oHsa3~wXu=u9wfw_5Zh$9I>-Ev7$W1LPQb7q%Q`LIhIyEG z(eOAdut?~7RlEoQv|M^w`OhKW`nz(-7MAA1 zPEYa9_69yg7dW6uk93BtKiS5ArDCLy)Dk7)v8rfX6manE55GqtND_O`TIYTFkakRZriG^WxyNZG6p zhtrfVNyabxl-=ol8umH@Bqq>IkiYF7c2p;_+cSHwyuwfKt-o^Y7|nNrDY}?1GVsW1 zo(6l1m5V6+7v15P@&RK*coy5YWiOlyVJ@aEW9uhpqJ4m7Y_vkP{@>&W@CKznEIOz= z0|{UDn&n$X%@w%S_q$jeQmz9=Dv&I%ELUFJ*yI4(q6Ua5%*QW{+`qc+1AYbbZ^6`j zHiomX>L-%s-OsYlGv%%T71@c15^nF_G_lItk9*I0J1d@sW2t}jGfsFeH_>n)-~22G zj!=?_eSTepn9C2K<9Y`j7kIU-!u;j@iax0W$ZO`c&T@N%`;*k=N8;w7sy4=6$;V&e z;_X@7O0Br`tsLG6<7@4GUo82Q<RbL@S<5nInmXt z>^zD!n~TY4cz4D4R`W=8N%g+OQ;GmVAl0m;%8E%G+;@ZyORi}QC3r|1xEndrzt|B> z0#qXGGg5p9{n8A~*3`3_+t+ya~j7txPCB z8p*lbY`qw0EJK#)g;ig=H0iR$zZj5G?4ij~WtDJv@`0fsNnZl*WOZl$toKn6;n8;f z*RG4RfU82%``k3LGL&f4g2kWFz6B@MDk(u zQ`S+7Fv!P7C8#`xj5AN#7FvN~rifO^uwXI(I1|{0`KRr-HRE72l<$b+mj+>skCHo& zpRqa@w&C0|(f?FFlk|`bprz`QyoxeZcB+C&LNNtIpz=^hLcA0ZH$9A?HwdI;w8ff; zk8=~U*XjGR$S2Gq9HP0=X5-SW*E#@&0*?H<@qAIekRAcItx)t*FM!N*l z0I>|xwPTN^Xb^m)$buG4E#>=N*DFc`(wI-aKM`u=q>&W>+t{|=z+cDDW#IzQ zH-`5a>9a9Lz9(xR%*Iqn`U_o?3j&1mGt?0i}{lUJ^x z0}M7?NTy+&2NIJDde#s7`7m?d4E}o@Rc6T3qRs=fVvF>Y=;E2a$QP8m7@6J!qFt_L=N=p|$N)iFg@&acM)}i$^Gv zz)(Qal(Tc=NRD=!>7M^Xx+i6<^Fo~3r7ZeDF7wZ=Q3ou&YfZv(*?NV_F`gAte78k8 zuH3=?^>Z7T-S0Y4WSX8{|AGIBs@OVi*28GQ*A2I!nl(oDm~SXeuz{g`bA7=t+b2uOD1sMutGq3>*W>Ko)zljnlndSWDIvijCPYgq2siYe5e z*0U*A-_6T;f_PFTYf5sl3(T+)Zt+ZtmILk>aM5ZEssWkT>0IbHXo}Ief1%}QFasnWy64+259D47r_~coqrumTfyKt4V zB4tV;7u0U;dCvMm9CGi|SD}ub0g+LM@{5aC-3;_a-`5TvNlfCGUr0NZIn8;#?x`uw znw_kSgU`IT*0$&H>kz2!Io={%ZpiHExP3g~(M~aeIrU6vzL5vnZR!AHwdKvqhcl`? z-v2jZG2_e;auNs{BBoGhDOvy3*~bz@Z3ZUHdopgIh=ac>{qwRmGC_LSR>HFJ-0DCsWso2=5LC8zh5LlM+3)l7C&Tf9c``!?9agGhN+jXit&(T{NR)*Y`ZNdRB&N_li1cUrIiokzEH<*P8W>69s(xLYy2e zIru8qwF*2?`)egk?5}M2Bc>$9DEzCfSJiI@7U}27{`~T9Np#(BN(5k5shRGTCGt05 zV9t$*g{G->gGthVl?^sAeM~*KpR3(#)vZhUD-%iv>KdJgtB z`O}{;Zr|%xs`!QB|&{ z-o3tAnm8x_`B!zidmfepzr7B8noOutc*4n-xmK>Jo#OpFWXUCje~5B?@si093i5h1 zgZ(u$YKWDr2}Q-s_AauC`Oi>fkd*ixPw;0-Voo&#M*qF zgqnfME+nSpfZsGEP?39CtmXY?jK!jK_v`2ruL6J6(8;-F49R`3jv4GQ*Lv=~?$MCI zGQ-6d%NS;)3~jZt$((*AKttx`6#V=m?3kdzinLf@=y$ar6SZa!6ZxZUIICcxcZHqX zwMjHkH5x};Arpr@ESVjfRVC#uTv7n{lK)xQL?>2pWDV=2py@MslJR+WG|yLr!`@;< z&g3~!ITh)>CH-~LJt~xU=K4b@M?};Bn9`RfxW?U+t`m!6G8rpaEtbHB);G5te5>>8 zilwjb>xphYy3B$8xOjpT5S%zG^IEA49-62!=2%UK85y_kPyq<5QTY3H#4010GfAAc z5mNG;+i$Ore;v<>wy=fRAznpSz_$qyz6V`GZtH-J(Y=F}7Ol|++;&6&>P`ml`C2N_ z`T0R%_?IkahbO2{G^qR|nv8#CpRZ1sIw?mePxM$y-y>=Li#vnE+RVGUJa>z=-E{~~ z5qI8LJcMe6Fh8i|xAW4%fP^KHU?GlZKL5zPtJ?BDv?ts;|zGD@xgc z-QdYd(8becsFJVzfcBN|eWfMn@tcEz^M;(ygp9O5bI&xFuf%tiiD>ei66lQrkQ3(kPUO_D);~?SK z4`-UhgntR5XG}ncADD?V`??qm2{CMm58>Z+#nHfMbkcLJRb~@)jXP7X*V!E!HxK#Y z*69uUzFe{J&Z*6DWvZ|!f^;cqPIl4@Pxq{HW?5=Zt!}25hdhy>gk^|V?;9Q@z03-v zFh@geL1;(3;s=SMG$;PEz<28!abg=72DXvw5a`Eb@9KpQ-#Jy)PnRjYx%Vx?SdBE* z1C{9LODXm10r2u0Qc@A}H>*x8IQ8TWH$5TVXh8^USuie_b zppK=4UlU5IYd!l!-G%kFaNlPUa>`=1nI0P7><%8Ybw@EolGGAtbDz>my?&sRhaM7VnfKMsg71SI@NX_3 zwUwEe@TQph0dv2s{5rF7kk0asl%bNF)(a-jZ_Zct_@rdlZw{B$?tE^q35myMr}g~# zfx@UQru|lKDObuQ13+6;=^S9;M09N+;wUfAUZb7!s{n=(kCg%<&VKJy0}v%Tvx5}l z)o-63AP?QHs1j zY$8WRjnss236k=e6>ImBii49P-mCl3679JD;U!x$LY3$USs0zkv88jw7WB2Uy$aHG zAD^CQJYDqiwz$@Wc}2Vx5iV2CSK^C|=^84EI4O1RDhlCKlIKjeb!?Jbko0M*P(Ik! zO-Td0uS}ZgR1WevQ&ABK5$_lz9p*Cq!oCAX`;rH zve@y$C}AqYO&uQY2}YT(KZ{J@!)SEG+ZF=_ygEv-#7`6oIB`9PKgFfGP6mYB{Z^DR zyH({xL%z1SLXZiOZZXx4(MV-!e+*aJE5g@ zpq_m1x)^v8f@c$;~HIXF|!`K#{tgj6jNTM&Pgjs@^Cl(51e784ZB+1 zmtAOU;zkd>(T@5gozjC(5&Ryk-eNpBB2K@rjQ?dg|9{cz@!!!6;A_rM2ZidQDZ871 zg=*a4r;GK1V=-=KlP>a3)w`e#u2dlUx@eq;BKV|oP z7^O?q%KgoPI^|`&y4)4~(u;PrQm;BuM~&u_J^$8@|90EWg$!U~j~k)Jt?Ku;dD+pD zyGNvDQ(~p`{r|AsmrtI-Yx@};m6LM;w_aa{S^oGVvvokdt{B2YYW_OpvCAL%`EPgH zw}q7gW&KLiiDwGH{*ON_{xwE=wk6*4#lLIYC~YJGp&y#KLC43YX1}F=Qnu{Zp#7GF z%n4xT@#WKQeaCnHH`9K+Rh{zHj$C?;xy-B~Zql#6>DvJZKAS^&UoZL6KxnJjOFu;2XlW4F|zGOV+zmhX%kC|G8FxW+6lM zR9xQLQh0AN1zE#h{o%IJkmC}OkJ15{m~de+l?eGh3mffsYk!d`@a3vOroV+xVT#Cw z>Dk{ePA~RqAW-|+3c;dN-Hs{FX$aE^vk(^{F#3ShspNbzBgT#s5}Q(n(CH!gr$+vA ziTCR50%ZzvzG<#&ks(U)5_{^`k;-cc- z?AD*#c`@CGEm_miQ>rRyZ_I6Kp&*aiMOo7mpaDg&H$%yN_Ejm~z}Q)yMFNTV%XXV> z$?c0bs5(9$hH*JsWcP`QBdLAW9}sUdt&dBKLr^OlT(q zmHy@3F-4>F9aSS9K#|RvY}3qkyYMP)*ha}RKs7Frg(C^wPXKg8jq6BrtiSzqvNrx` zC>33HgWk*tqjqr$W?c{1iDZYO_Fn2oqgse3^CuD!v*ZZaQBnvlck`!EbgK}#z_oVP zc+wsbC+tI&V4tg_FT=}B4YignAw8t(l|&|4m3i(|B^a=OI8Eqt-qxRoFEu@^<0ndjuigBsL;b?>s|qZ9n2uAD|*EK6&aJsql=t z?s1uq(!{Uh3}8NWcE3hRW9~r6x=h!0wng4992xO#`T<&j%$n)jfVP&y3nd0?TE^Cway?gnhc;;E-k&xrbm19l1)BD<5N zvyx<{KT=mu3{JcXcWsQj)VeSciJi=Pqqg|x|9I93ZpT~Ez688sYhOd~lT#NF`p*Uz zDE!xj!rY=&`1^VL&_Y0m7PyI5(WtBXj|2ww zit@Yr`cdx=@bXWC!1yW31urQ=UA5rmoGyE1?BgDQC#(0QR`UHJW$!9_>r#$?8<4py z0gi$4mMiY&JMPl)N-jI12kisvqZ}294M5Uk`MFRqB?5Vo1#Av~Vd5Mxqg6BBSCE71 z7hq$C*2(<5NgszGX|zdD9;HSj9exk82-Gx1S3rPacwbh~d-{MOSuMO&p zh9_JGF;m&1+^LR}8{&op&Nb0mw2d5~!s^KK*S?Lj__bvTKQ&nb+_BL}Voy*3I#>JNbS9{p@_@Qyw&RnG}dFqnbB7bruG;kfyx3#s+HI$s%|K!0AzaqwSLmQU~)E z{WtAk(T(#&nRiFF^E=-y7eX9JF^{-P{p^kvjF>+LT(0K09CWC1e8}>@nNz4m*DKeTlUH45vX<>tgJ^j?e@-@{%qd-iH`Ux(gJ*fgrN05cF`Qro!Fm8hQfB ziIZdtpes_%M+MerXg958A#ac1y^eJPo7c<#nm~iAwaMi^ld*+e*D!Sy8x2 zj;B)9DdX`}rVCkwh-2d>ulu%>MUf8>c(Cy@(b3l|s!LE?n9}QwLJY<`v?+fgE3Gn9 zef+eHVP{#tG;fN+BPlOVTmeJ`$6N{V-O~F8o_*lRzsC?k`Z4=>Zk5^@+9^R7#(g z4DV?5vHeICg*&M9VwCPl^gXztZN+Zp}w5%3hkAA8v4=`uly zl%Pj+pI2{vFd=y&g|PzqT`l0A6AQwa5IZKeeYj-3`JfFi1DSZI4E6(PgOHsdI^>xb z*RPyAD7%mCP^cS%P?gj^(FFD=Ui^f@Ya^Un2`!_Nk>@~{%88hMuX@`$BYwm?NGtvQ z*$@f-{d>JsN9_z8K%$^taH|67NTB`%H_)APXWGc-u{^`eCG2RdTZPaw( zLEj7+VTBeiGb@PEUo|Oy(Q5WZju^(JRZ>jwrzL5XyZiLSZ#}Uw`tr@dt4L#dXYo^d=K1Wz zTh=-c$%2DJ>F%)nEHq&KWN{O;ydiLx6f?+?Q&eA6{$%1zq!;udARc?NpDieqPI#wn zWz|_yi-ea4evL^+rd9iT+_@uSH&Z$)VWY*|gDrYxmtQoo|X=uW<=&*{4jl6GJW{5SB}okpg7U|!&`#|!OU1h zt1KpXrd{Y5O&Qj}YgVhKmK$E+!e#No0Mvz~qBJ4HkG*mUnkfD*E5-klZgm|*8AKQO;d*WkAE81L;^+=GiV}AqEz#!5O?3|yEpA8lCY=U zf_p(!iS<(~e}9=chAOUc90NWQhby%6xWK?3Tf|KAMK7GJordTru_Im2U$g+(1&X9~ z?VKpDUj`)ONA%%Am@=iCfFL&9=o(URTJl{WrL*3Gw)_Kzln#qVS-eM2vuaVzFdbA6 zdV~7T;FzrdZaH;+mwS0jOEs9F=dPiaW?2akkiB2}u4Oy!b9!er`R50^E3fcmiG>*I zzKwBlN|r+&Qsy>q9hD^edLiP^iGWrR<+ENOI56x z*FfObA5Bh?>m9PxRFU-FE%tK~tyd#{5EwQc$&od!Y`4JUaM5Rq>081n-Hvn7adu-y zr4LV?8(*=}s!M#SLEY4t+;*S&NZs_#+Dr3$0N%^Tl6MkTak$!B$T+_hQ6_dxmHJ_TP7XSbya# zg&NGbeG30*mHwYw6#r%cmzLhU!=(-05pqsGR%E0nOO-_nR&juD&2GFS0JcF-lQKR( z3)n_t@wqrhk@@G}Q8DDoIo8=>TAOxF^QQj*95W%mXpA76%L4_d`1MhfqG-r1kXhbp z<@#v#1sd4R?ig=G&zW4#?|M~?F(BTC)@BABB-+8?2i zWuF~T72Mnbz#q(MPrLcI@Xw$u|_9s>qg08wdXvKulIb literal 0 HcmV?d00001 diff --git a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md new file mode 100644 index 0000000000..665a5d5850 --- /dev/null +++ b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -0,0 +1,370 @@ +--- +title: Windows Sandbox overview +description: +ms.prod: w10 +audience: ITPro +author: dansimp +ms.author: dansimp +manager: dansimp +ms.collection: +ms.topic: article +ms.localizationpriority: +ms.date: +ms.reviewer: +--- + +# Windows Sandbox + +### Overview + +Windows Sandbox provides a lightweight desktop environment for safely running applications in isolation. Software installed inside of the Sandbox environment remains in the sandboxed environment and cannot affect the host machine. Windows Sandbox is temporary; when it is closed, all the software, files, and state are permanently deleted. The user receives a brand-new instance of the Sandbox every time they open the application. + +Software and applications installed on the host are not directly available in Windows Sandbox. If specific applications need to be available inside the Windows Sandbox environment, they should be explicitly installed within the Sandbox environment. + +Windows Sandbox has the following properties: +- **Part of Windows**: Everything required for this feature ships with Windows 10 Pro and Enterprise. No need to download a VHD! +- **Pristine**: Every time Windows Sandbox runs, it’s as clean as a brand-new installation of Windows. +- **Disposable**: – nothing persists on the device; everything is discarded after the user closes the application. +- **Secure**: – uses hardware-based virtualization for kernel isolation, which relies on the Microsoft’s hypervisor to run a separate kernel which isolates Windows Sandbox from the host. +- **Efficient:** – uses integrated kernel scheduler, smart memory management, and virtual GPU. + +Windows Sandbox was announced in December of 2018 via a Windows Kernel Blog post. The following video provides an overview of Windows Sandbox. + +[embed Ignite 2019 Sandbox talk video here, link is here: https://myignite.techcommunity.microsoft.com/sessions/79739?source=sessions ] + +## Architecture + +### Dynamically generated image + +At its core, Windows Sandbox is a lightweight virtual machine, so it requires an operating system image to boot from. However, rather than giving the sandbox a separate copy of Windows to boot from, our Dynamic Base Image technology allows us to leverage the copy of Windows already installed on the host. + +Most OS files are immutable, and we can freely share these files with Windows Sandbox. A small percentage of files are mutable which we can’t share but Windows Sandbox contains pristine copies of these files. A full Windows image can be constructed as the composition of the sharable immutable files on the host and the pristine copies of mutable files. Using this scheme Windows Sandbox has a full Windows Installation to boot from without needing to download or store an additional copy of Windows. + +When Windows Sandbox is not installed, the dynamic base image is stored in a compressed 25MB package. Once installed, the dynamic base package occupies about 500MB of disk space. + +![ALT TEXT](images/1-dynamic-host.png) +GRAPHIC 1 + +### Memory management + +With traditional virtual machines (VMs) a portion of host memory is dedicated for exclusive use by the VM. If the host later comes under resource pressure, it can’t use the memory given to the VM. Nor can it make more memory available to the VM if available. With Windows Sandbox we attempt to treat memory more similarly to how memory is allocated to applications. All apps on the machine can request the amount of memory they need. What they get will be a function of what other apps are running and how much memory they need. The amount of memory available for use by an application can change over time. + +### Dynamic working set + +When using a VM, the user is effectively partitioning their machine. If the host is under memory pressure, it cannot use the memory already allocated to the VM. However, applications in the Sandbox are treated as equal to apps running on the host, so when applications in Sandbox are under memory pressure you can give more memory to the Sandbox (same with host). Guest physical pages provided are virtualized, that’s how that works. + +![ALT TEXT](images/2-dynamic-working.png) + +### Memory sharing + +Since Windows Sandbox runs the same operating system image as the host, it has been enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as “direct map”. For example, when ntdll.dll is loaded into memory in the Sandbox, it uses the same executable pages as those of the binary loaded on the host. Memory sharing between the host and Sandbox results in a smaller memory footprint when compared to traditional VMs without compromising valuable host secrets. + +![ALT TEXT](images/3-memory-sharing.png) + +### Integrated kernel scheduler + +With ordinary virtual machines (VMs), Microsoft’s hypervisor controls the scheduling of the virtual processors running in the VMs. However, Windows Sandbox uses a new technology called “integrated scheduling” which allows the host scheduler to decide when the Sandbox receives CPU cycles. + +GRAPHIC 4 +![ALT TEXT](images/4-integrated-kernal.png) + +Windows Sandbox employs a unique scheduling policy that allows the virtual processors of the Sandbox to be scheduled in the same way as threads would be scheduled for a process. High-priority tasks on the host can preempt less important work in the Sandbox. The benefit of using the integrated scheduler is that the host manages Windows Sandbox as a process rather than a virtual machine which results in a much more responsive host, similar to Linux KVM. + +The goal is to treat the Sandbox like an app but with the security guarantees of a virtual machine. + +### Snapshot and clone + +As stated above, Windows Sandbox uses Microsoft’s hypervisor. It essentially runs another copy of Windows which needs to be booted, and this can take some time. Rather than paying the full cost of booting the Sandbox operating system every time Windows Sandbox starts, two other technologies are utilized: “snapshot” and “clone.” + +Snapshot allows us to boot the Sandbox environment once and preserve the memory, CPU, and device state to disk. Then we can restore the Sandbox environment from disk and put it in the memory rather than booting it when we need a new instance of Windows Sandbox. By cloning the in-memory snapshot of Windows Sandbox, start time is significantly improved. + +### WDDM GPU virtualization + +Hardware accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intense or media-heavy use cases. However, virtual machines are isolated from their hosts and unable to access advanced devices like GPUs. The role of graphics virtualization technologies, therefore, is to bridge this gap and provide hardware acceleration in virtualized environments. + +More recently, Microsoft has worked with its graphics ecosystem partners to integrate modern graphics virtualization capabilities directly into DirectX and WDDM, the driver model used by display drivers on Windows. + +GRAPHIC 5 +![ALT TEXT](images/5-wddm-gpu-virtualization.png) + +At a high level, this form of graphics virtualization works as follows: + +- Apps running in a Hyper-V VM use graphics APIs as normal. +- Graphics components in the VM, which have been enlightened to support virtualization, coordinate across the VM boundary with the host to execute graphics workloads. +- The host allocates and schedules graphics resources among apps in the VM alongside the apps running natively. Conceptually, they behave as one pool of graphics clients. + +This process is illustrated below: + +![ALT TEXT](images/6-wddm-gpu-virtualization-2.png) + +This enables the Windows Sandbox VM to benefit from hardware accelerated rendering, with Windows dynamically allocating graphics resources where they are needed across the host and guest. The result is improved performance and responsiveness for apps running in Windows Sandbox, as well as improved battery life for graphics-heavy use cases. + +To take advantage of these benefits, a system with a compatible GPU and graphics drivers (WDDM 2.5 or newer) is required. Incompatible systems will render apps in Windows Sandbox with Microsoft’s CPU-based rendering technology (WARP). + +### Battery pass-through + +Windows Sandbox is also aware of the host’s battery state, which allows it to optimize power consumption. This is critical for a technology that will be used on laptops, where battery life is often critical to the user. + +## Install Windows Sandbox + +### Prerequisites + +- Windows 10 Pro or Enterprise build 18305 or later (Note: Windows Sandbox is currently not supported on Home SKUs) +- AMD64 architecture +- Virtualization capabilities enabled in BIOS +- At least 4GB of RAM (8GB recommended) +- At least 1GB of free disk space (SSD recommended) +- At least 2 CPU cores (4 cores with hyperthreading recommended) + +### Installation + +1. Make sure your machine is using a Windows 10 Pro or Enterprise build version 18305 or newer +2. Enable virtualization on the machine + - If you are using a physical machine, ensure virtualization capabilities are enabled in the BIOS + - If you are using a virtual machine, enable nested virtualization with this PowerShell command: Set -VMProcessor -VMName -ExposeVirtualizationExtensions $true +3. Use the search bar on the task bar and type “Turn Windows Features on and off”. Select Windows Sandbox and click “OK”, restarting the computer if prompted.
+ a. If the Windows Sandbox option is grayed out, your computer does not currently meet the requirements to run Windows Sandbox. If you believe this to be a mistake, please review the prerequisite list as well as steps 1 and 2. +4. Locate Windows Sandbox in the Start Menu, and click to run it for the first time. + +### Usage +1. Copy an executable file (and any other files needed to run the application) from the host into the Sandbox window +2. Run the executable file or installer inside of the Sandbox +3. When you are finished experimenting, close Windows Sandbox. A dialog box will appear; by clicking OK, you understand that all Sandbox content will be discarded and permanently deleted. +4. Confirm that your host machine does not exhibit any of the modifications that you made in Windows Sandbox. + +## Use a .wsb file to configure Windows Sandbox + +Windows Sandbox supports simple configuration files (with a .wsb file extension) which provide a minimal set of customization parameters for a Sandbox. This feature can be used with any Windows build numbered 18342 or higher. + +Sandbox configuration files are formatted as XML and are associated with Windows Sandbox via the .wsb file extension. To use a configuration file, double click it to open it in Windows Sandbox. It can also be invoked via the command line as shown:
+ **C:\Temp> MyConfigFile.wsb** + + A configuration file allows the user to control the following aspects of Windows Sandbox: +- **vGPU (virtualized GPU)** +
Enable or Disable the virtualized GPU. If vGPU is disabled, Sandbox will use WARP (software rasterizer). +- **Networking** +
Enable or Disable network access within the Sandbox. +- **Mapped folders** +
Share folders from the host with read or write permissions. Note that exposing host directories may allow malicious software to affect the system or steal data. +- **Logon Command** +
A command that will be executed when the Sandbox starts. +- **Audio Input** +
Shares the host’s microphone input into the Sandbox. +- **Video Input** + - Shares the host’s webcam input into the Sandbox. +- **Protected Client** + - Places increased security settings on the RDP session to the Sandbox. +- **Printer Redirection** + - Shares printers from the host into the Sandbox. +- **Clipboard Redirection** + - Shares the host clipboard with the Sandbox so that text and files may be pasted back and forth. +- **Memory in MB** +
The amount of memory, in megabytes, to assign to the Sandbox. + +### Keywords, values, and limits + +**vGPU** + +Enables or disables GPU sharing. + +`value` + +Supported values: +- **Enable**: enables vGPU support in the Sandbox. +- **Disable**: disables vGPU support in the Sandbox. If this value is set Windows Sandbox will use software rendering, which can be slower than virtualized GPU. +- **Default** – this is the default value for vGPU support; currently this means vGPU is disabled. + +> [!NOTE]> Enabling virtualized GPU can potentially increase the attack surface of the Sandbox. + +**Networking** + +Enables or disables networking in the Sandbox. Disabling network access can be used to decrease the attack surface exposed by the Sandbox. + +`value` + +Supported values: +- *Disable*: Disables networking in the Sandbox. +- *Default*: This is the default value for networking support. This enables networking by creating a virtual switch on the host, and connects the Sandbox to it via a virtual NIC. + +> [!NOTE] +> Enabling networking can expose untrusted applications to the internal network. + +**MappedFolders** + +Wraps a list of MappedFolder objects. + +`` + list of MappedFolder objects +`` + +> [!NOTE]> Files and folders mapped in from the host can be compromised by apps in the Sandbox or potentially affect the host. + +**MappedFolder** + +Specifies a single folder on the host machine which will be shared on the container desktop. Apps in the Sandbox are run under the user account “WDAGUtilityAccount”. If no Sandbox path is specified, a folder is mapped to the following path:
`C:\Users\WDAGUtilityAccount\Desktop` + +E.g. "C:\Test” will be mapped as “C:\users\WDAGUtilityAccount\Desktop\Test by default. + +``` + + path to the host folder + path to the sandbox folder + value + +``` + +*HostFolder*: Specifies the folder on the host machine to share to the Sandbox. Note that the folder must already exist on the host or the container will fail to start if the folder is not found. + +*SandboxFolder*: Specifies the destination in the Sandbox to map the folder to. If the folder does not exist, it will be created. + +*ReadOnly*: If true, enforces read-only access to the shared folder from within the container. Supported values: true/false. Defaults to false. + +> [!NOTE] Files and folders mapped in from the host can be compromised by apps in the Sandbox or potentially affect the host. + +**LogonCommand** +Specifies a single command which will be invoked automatically after the Sandbox logs on. + +``` + + command to be invoked + +``` + +*Command*: A path to an executable or script inside of the container that will be executed after login. + +> [!NOTE] +> Although very simple commands will work (launching an executable or script), more complicated scenarios involving multiple steps should be placed into a script file. This script file may be mapped into the container via a shared folder, and then executed via the LogonCommand directive. + +**Example 1:** + +The following config file can be used to easily test downloaded files inside of the Sandbox. To achieve this, the script disables networking and vGPU, and restricts the shared downloads folder to read-only access in the container. For convenience, the logon command opens the downloads folder inside of the container when it is started. + +*Downloads.wsb* + +``` + + Disable + Disable + + + C:\Users\Public\Downloads + true + + + + explorer.exe C:\users\WDAGUtilityAccount\Desktop\Downloads + + +``` + +**Example 2** + +The following config file installs Visual Studio Code in the Sandbox, which requires a slightly more complicated LogonCommand setup. + +Two folders are mapped into the Sandbox; the first (SandboxScripts) contains VSCodeInstall.cmd, which will install and run VSCode. The second folder (CodingProjects) is assumed to contain project files that the developer wants to modify using VSCode. + +With the VSCode installer script already mapped into the Sandbox, the LogonCommand can reference it. + +*VSCodeInstall.cmd* + +``` +REM Download VSCode +curl -L "https://update.code.visualstudio.com/latest/win32-x64-user/stable" --output C:\users\WDAGUtilityAccount\Desktop\vscode.exe + +REM Install and run VSCode +C:\users\WDAGUtilityAccount\Desktop\vscode.exe /verysilent /suppressmsgboxes +``` + +VSCode.wsb + +``` + + + + C:\SandboxScripts + true + + + C:\CodingProjects + false + + + + C:\users\wdagutilityaccount\desktop\SandboxScripts\VSCodeInstall.cmd + + +``` + +**Audio Input** + +Enables or disables audio input to the Sandbox. + +`value` + +Supported values: +- **Enable**: Enables audio input in the Sandbox. If this value is set, Windows Sandbox will be able to receive audio input from the user. Applications using a microphone may require this setting. +- **Disable**: Disables audio input in the Sandbox. If this value is set, Windows Sandbox will not be able to receive audio input from the user. Applications using a microphone may not function properly with this setting. +- **Default**: This is the default value for audio input support; currently this means audio input is enabled. + +**Video Input** + +Enables or disables video input to the Sandbox. + +`value` + +Supported values: +- **Enable**: Enables video input in the Sandbox. +- **Disable**: Disables video input into the Sandbox. Applications using video input may not function properly in the Sandbox. +- **Default**: This is the default value for video input support; currently this means video input is disabled. Applications using video input may not function properly in the Sandbox. + +**ProtectedClient** + +Places increased security settings on the Sandbox RDP session. These enhanced security mitigations decrease the attack surface of the Sandbox. + +`value` + +Supported values: +- **Enable**: Runs Windows Sandbox in Protected Client mode. If this value is set, Windows Sandbox will be run with extra security mitigations enabled. +- **Disable**: Runs Windows Sandbox in standard mode without extra security mitigations. +- **Default**: This is the default value for Protected Client mode; currently this means Windows Sandbox will not run in Protected Client mode. + +> [!NOTE] +> This setting may restrict the user’s ability to copy/paste files in and out of the Sandbox. + +**Printer Redirection** + +Enables or disables printer sharing from the host into the Sandbox. + +`value` + +Supported values: +- **Enable**: Enables sharing of host printers into the Sandbox. +- **Disable**: Disables printer redirection in the Sandbox. If this value is set, Windows Sandbox will not be able to view printers from the host. +- **Default**: This is the default value for printer redirection support; currently this means that printer redirection is disabled. + +**Clipboard Redirection** + +Enables or disables clipboard sharing with the Sandbox. + +`value` + +Supported values: +- **Disable**: Disables clipboard redirection in the Sandbox. If this value is set, copy/paste in and out of the Sandbox will be restricted. +- **Default**: This is the default value for clipboard redirection; currently this means that copy/paste between the host and Sandbox are permitted. + +**Memory in MB** + +Specifies the amount of memory that may be utilized by the Sandbox in megabytes (MB). + +`value` + +Supported values: An integer greater than 2048 (2GB). + +[Insert as comment: FAQ (future) + +[Insert as comment: Release Notes (future?) + +EnableVendorExtensions – Paul added new option for Windows Sandbox to enable/disable vGPU vendor extensions. This is as new as 12/2 +RailMode – allows a user to run programs in Rail mode rather than full desktop. Internal only at this time. + +[Insert as comment: Known Issues (future) ] From dd88d65279dc41c295c90a0e875dab37fedae93f Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Thu, 5 Mar 2020 13:03:40 -0800 Subject: [PATCH 02/30] edits --- .../windows-sandbox-overview.md | 205 +++++++++--------- 1 file changed, 100 insertions(+), 105 deletions(-) diff --git a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md index 665a5d5850..5d5641f480 100644 --- a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -17,18 +17,18 @@ ms.reviewer: ### Overview -Windows Sandbox provides a lightweight desktop environment for safely running applications in isolation. Software installed inside of the Sandbox environment remains in the sandboxed environment and cannot affect the host machine. Windows Sandbox is temporary; when it is closed, all the software, files, and state are permanently deleted. The user receives a brand-new instance of the Sandbox every time they open the application. +Windows Sandbox provides a lightweight desktop environment for safely running applications in isolation. Software that's installed inside the Sandbox environment remains in the "sandboxed" environment and can't affect the host machine. Windows Sandbox is temporary. When it's closed, all the software, files, and state are permanently deleted. You get a brand-new instance of the Sandbox every time you open the application. -Software and applications installed on the host are not directly available in Windows Sandbox. If specific applications need to be available inside the Windows Sandbox environment, they should be explicitly installed within the Sandbox environment. +Software and applications installed on the host are not directly available in Windows Sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the Sandbox environment. Windows Sandbox has the following properties: -- **Part of Windows**: Everything required for this feature ships with Windows 10 Pro and Enterprise. No need to download a VHD! -- **Pristine**: Every time Windows Sandbox runs, it’s as clean as a brand-new installation of Windows. -- **Disposable**: – nothing persists on the device; everything is discarded after the user closes the application. -- **Secure**: – uses hardware-based virtualization for kernel isolation, which relies on the Microsoft’s hypervisor to run a separate kernel which isolates Windows Sandbox from the host. -- **Efficient:** – uses integrated kernel scheduler, smart memory management, and virtual GPU. +- **Part of Windows**: Everything required for this feature is included in Windows 10 Pro and Enterprise. There's no need to download a VHD. +- **Pristine**: Every time Windows Sandbox runs, it's as clean as a brand-new installation of Windows. +- **Disposable**: Nothing persists on the device. Everything is discarded when the user closes the application. +- **Secure**: Uses hardware-based virtualization for kernel isolation, which relies on t he Microsoft hypervisor to run a separate kernel that isolates Windows Sandbox from the host. +- **Efficient:** Uses integrated kernel scheduler, smart memory management, and virtual GPU. -Windows Sandbox was announced in December of 2018 via a Windows Kernel Blog post. The following video provides an overview of Windows Sandbox. +The following video provides an overview of Windows Sandbox. [embed Ignite 2019 Sandbox talk video here, link is here: https://myignite.techcommunity.microsoft.com/sessions/79739?source=sessions ] @@ -36,56 +36,55 @@ Windows Sandbox was announced in December of 2018 via a Windows Kernel Blog post ### Dynamically generated image -At its core, Windows Sandbox is a lightweight virtual machine, so it requires an operating system image to boot from. However, rather than giving the sandbox a separate copy of Windows to boot from, our Dynamic Base Image technology allows us to leverage the copy of Windows already installed on the host. +At its core, Windows Sandbox is a lightweight virtual machine, so it requires an operating system image to boot from. But instead of giving the sandbox a separate copy of Windows to boot from, our Dynamic Base Image technology lets us use the copy of Windows that's already installed on the host. -Most OS files are immutable, and we can freely share these files with Windows Sandbox. A small percentage of files are mutable which we can’t share but Windows Sandbox contains pristine copies of these files. A full Windows image can be constructed as the composition of the sharable immutable files on the host and the pristine copies of mutable files. Using this scheme Windows Sandbox has a full Windows Installation to boot from without needing to download or store an additional copy of Windows. +Most OS files are immutable, and we can freely share these files with Windows Sandbox. A small portion of the Windows files are mutable and we can't be shared. Windows Sandbox contains pristine copies of these files. A full Windows image can be constructed from the sharable immutable files on the host and the pristine copies of mutable files. By using this scheme, Windows Sandbox has a full Windows Installation to boot from without needing to download or store an additional copy of Windows. -When Windows Sandbox is not installed, the dynamic base image is stored in a compressed 25MB package. Once installed, the dynamic base package occupies about 500MB of disk space. +When Windows Sandbox isn't installed, the dynamic base image is stored in a compressed 25-MB package. Once installed, the dynamic base package occupies about 500 MB of disk space. -![ALT TEXT](images/1-dynamic-host.png) -GRAPHIC 1 +![Chart compares dynamic image of files and links with host file system](images/1-dynamic-host.png) ### Memory management -With traditional virtual machines (VMs) a portion of host memory is dedicated for exclusive use by the VM. If the host later comes under resource pressure, it can’t use the memory given to the VM. Nor can it make more memory available to the VM if available. With Windows Sandbox we attempt to treat memory more similarly to how memory is allocated to applications. All apps on the machine can request the amount of memory they need. What they get will be a function of what other apps are running and how much memory they need. The amount of memory available for use by an application can change over time. +With traditional virtual machines (VMs) a portion of host memory is dedicated for exclusive use by the VM. If the host later comes under resource pressure, it can't use the memory dedicated to the VM. Nor can it provide more memory, if available, to the VM. Windows Sandbox treat memory more similarly to how memory is allocated to applications. All apps on the machine can request the amount of memory that they need. The amount that they get will be a function of what other apps are running and how much memory they need. The amount of memory available for use by an application can change over time. ### Dynamic working set -When using a VM, the user is effectively partitioning their machine. If the host is under memory pressure, it cannot use the memory already allocated to the VM. However, applications in the Sandbox are treated as equal to apps running on the host, so when applications in Sandbox are under memory pressure you can give more memory to the Sandbox (same with host). Guest physical pages provided are virtualized, that’s how that works. +When using a VM, the user is effectively partitioning their machine. If the host is under memory pressure, it can't use the memory already allocated to the VM. Buy applications in the Sandbox are treated as equal to apps running on the host, so when apps in Sandbox are under memory pressure, you can give more memory to the Sandbox (and the same applies to the host). Guest physical pages provided are virtualized. -![ALT TEXT](images/2-dynamic-working.png) +![Chart compares memory sharing in Windows Sandbox vs. a traditional VM](images/2-dynamic-working.png) ### Memory sharing -Since Windows Sandbox runs the same operating system image as the host, it has been enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as “direct map”. For example, when ntdll.dll is loaded into memory in the Sandbox, it uses the same executable pages as those of the binary loaded on the host. Memory sharing between the host and Sandbox results in a smaller memory footprint when compared to traditional VMs without compromising valuable host secrets. +Becuase Windows Sandbox runs the same operating system image as the host, it has been enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as "direct map." For example, when ntdll.dll is loaded into memory in the Sandbox, it uses the same executable pages as those of the binary loaded on the host. Memory sharing between the host and Sandbox results in a smaller memory footprint when compared to traditional VMs without compromising valuable host secrets. -![ALT TEXT](images/3-memory-sharing.png) +![Chart compares the memory footprint in Windows Sandbox vs. a traditional VM](images/3-memory-sharing.png) ### Integrated kernel scheduler -With ordinary virtual machines (VMs), Microsoft’s hypervisor controls the scheduling of the virtual processors running in the VMs. However, Windows Sandbox uses a new technology called “integrated scheduling” which allows the host scheduler to decide when the Sandbox receives CPU cycles. +With ordinary virtual machines, the Microsoft hypervisor controls the scheduling of the virtual processors running in the VMs. Windows Sandbox uses a new technology called "integrated scheduling," which allows the host scheduler to decide when the Sandbox receives CPU cycles. GRAPHIC 4 -![ALT TEXT](images/4-integrated-kernal.png) +![Chart compares the scheduling in Windows Sandbox vs. a traditional VM](images/4-integrated-kernal.png) -Windows Sandbox employs a unique scheduling policy that allows the virtual processors of the Sandbox to be scheduled in the same way as threads would be scheduled for a process. High-priority tasks on the host can preempt less important work in the Sandbox. The benefit of using the integrated scheduler is that the host manages Windows Sandbox as a process rather than a virtual machine which results in a much more responsive host, similar to Linux KVM. +Windows Sandbox employs a unique scheduling policy that allows the virtual processors of the Sandbox to be scheduled in the same way as threads would be scheduled for a process. High-priority tasks on the host can preempt less important work in the Sandbox. The benefit of the integrated scheduler is that the host manages Windows Sandbox as a process rather than a virtual machine, which results in a much more responsive host, similar to Linux KVM. -The goal is to treat the Sandbox like an app but with the security guarantees of a virtual machine. +The goal is to treat the Sandbox like an app but with the security guarantees of a virtual machine. ### Snapshot and clone -As stated above, Windows Sandbox uses Microsoft’s hypervisor. It essentially runs another copy of Windows which needs to be booted, and this can take some time. Rather than paying the full cost of booting the Sandbox operating system every time Windows Sandbox starts, two other technologies are utilized: “snapshot” and “clone.” +As noted earlier, Windows Sandbox uses the Microsoft hypervisor. It essentially runs another copy of Windows that needs to be booted, and this can take some time. Rather than paying the full cost of booting the Sandbox operating system every time Windows Sandbox starts, two other technologies are utilized: *snapshot* and *clone.* -Snapshot allows us to boot the Sandbox environment once and preserve the memory, CPU, and device state to disk. Then we can restore the Sandbox environment from disk and put it in the memory rather than booting it when we need a new instance of Windows Sandbox. By cloning the in-memory snapshot of Windows Sandbox, start time is significantly improved. +Snapshot allows us to boot the Sandbox environment once and preserve the memory, CPU, and device state to disk. Then we can restore the Sandbox environment from disk and put it in memory rather than booting it when we need a new instance of Sandbox. By cloning the in-memory snapshot of Windows Sandbox, start time is significantly improved. ### WDDM GPU virtualization -Hardware accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intense or media-heavy use cases. However, virtual machines are isolated from their hosts and unable to access advanced devices like GPUs. The role of graphics virtualization technologies, therefore, is to bridge this gap and provide hardware acceleration in virtualized environments. +Hardware-accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intense or media-heavy uses. But virtual machines are isolated from their hosts and unable to access advanced devices like GPUs. The role of graphics virtualization technologies is to bridge this gap and provide hardware acceleration in virtualized environments. -More recently, Microsoft has worked with its graphics ecosystem partners to integrate modern graphics virtualization capabilities directly into DirectX and WDDM, the driver model used by display drivers on Windows. +Microsoft has been working with its graphics ecosystem partners to integrate modern graphics virtualization capabilities directly into DirectX and WDDM, the driver model that's used for Windows display drivers. GRAPHIC 5 -![ALT TEXT](images/5-wddm-gpu-virtualization.png) +![Chart illustrates graphics kernal use in Sandbox managed alongside apps on the host](images/5-wddm-gpu-virtualization.png) At a high level, this form of graphics virtualization works as follows: @@ -93,117 +92,113 @@ At a high level, this form of graphics virtualization works as follows: - Graphics components in the VM, which have been enlightened to support virtualization, coordinate across the VM boundary with the host to execute graphics workloads. - The host allocates and schedules graphics resources among apps in the VM alongside the apps running natively. Conceptually, they behave as one pool of graphics clients. -This process is illustrated below: +This process is illustrated here: -![ALT TEXT](images/6-wddm-gpu-virtualization-2.png) +![Chart illustrates graphics resource use on the host and guest](images/6-wddm-gpu-virtualization-2.png) -This enables the Windows Sandbox VM to benefit from hardware accelerated rendering, with Windows dynamically allocating graphics resources where they are needed across the host and guest. The result is improved performance and responsiveness for apps running in Windows Sandbox, as well as improved battery life for graphics-heavy use cases. +This enables the Windows Sandbox VM to benefit from hardware-accelerated rendering, with Windows dynamically allocating graphics resources where they are needed across the host and guest. The result is improved performance and responsiveness for apps running in Windows Sandbox, as well as improved battery life for graphics-heavy use cases. -To take advantage of these benefits, a system with a compatible GPU and graphics drivers (WDDM 2.5 or newer) is required. Incompatible systems will render apps in Windows Sandbox with Microsoft’s CPU-based rendering technology (WARP). +To take advantage of these benefits, a system with a compatible GPU and graphics drivers (WDDM 2.5 or newer) is required. Incompatible systems will render apps in Windows Sandbox with Microsoft's CPU-based rendering technology (WARP). ### Battery pass-through -Windows Sandbox is also aware of the host’s battery state, which allows it to optimize power consumption. This is critical for a technology that will be used on laptops, where battery life is often critical to the user. +Windows Sandbox is also aware of the host's battery state, which allows it to optimize power consumption. This is critical for a technology that's used on laptops, where battery life is often critical. ## Install Windows Sandbox ### Prerequisites -- Windows 10 Pro or Enterprise build 18305 or later (Note: Windows Sandbox is currently not supported on Home SKUs) +- Windows 10 Pro or Enterprise build 18305 or later (*Windows Sandbox is currently not supported on Home SKUs*) - AMD64 architecture - Virtualization capabilities enabled in BIOS -- At least 4GB of RAM (8GB recommended) -- At least 1GB of free disk space (SSD recommended) +- At least 4 GB of RAM (8 GB recommended) +- At least 1 GB of free disk space (SSD recommended) - At least 2 CPU cores (4 cores with hyperthreading recommended) ### Installation -1. Make sure your machine is using a Windows 10 Pro or Enterprise build version 18305 or newer -2. Enable virtualization on the machine - - If you are using a physical machine, ensure virtualization capabilities are enabled in the BIOS - - If you are using a virtual machine, enable nested virtualization with this PowerShell command: Set -VMProcessor -VMName -ExposeVirtualizationExtensions $true -3. Use the search bar on the task bar and type “Turn Windows Features on and off”. Select Windows Sandbox and click “OK”, restarting the computer if prompted.
- a. If the Windows Sandbox option is grayed out, your computer does not currently meet the requirements to run Windows Sandbox. If you believe this to be a mistake, please review the prerequisite list as well as steps 1 and 2. -4. Locate Windows Sandbox in the Start Menu, and click to run it for the first time. +1. Make sure your machine is using a Windows 10 Pro or Enterprise build version 18305 or later. +2. Enable virtualization on the machine. + + - If you're using a physical machine, make sure virtualization capabilities are enabled in the BIOS. + - If you're using a virtual machine, run the following PowerShell command to enable nested virtualization:
**Set -VMProcessor -VMName -ExposeVirtualizationExtensions $true** +1. Use the search bar on the task bar and type **Turn Windows Features on and off**. Select **Windows Sandbox** and then **OK**. Restart the computer if you're prompted. + + - If the **Windows Sandbox** option is unavailable, your computer doesn't meet the requirements to run Windows Sandbox. If you think this is incorrect, review the prerequisite list as well as steps 1 and 2. +1. Locate and select **Windows Sandbox** on the Start menu to run it for the first time. ### Usage -1. Copy an executable file (and any other files needed to run the application) from the host into the Sandbox window -2. Run the executable file or installer inside of the Sandbox -3. When you are finished experimenting, close Windows Sandbox. A dialog box will appear; by clicking OK, you understand that all Sandbox content will be discarded and permanently deleted. -4. Confirm that your host machine does not exhibit any of the modifications that you made in Windows Sandbox. +1. Copy an executable file (and any other files needed to run the application) from the host into the Windows Sandbox window. +2. Run the executable file or installer inside Sandbox. +3. When you are finished experimenting, close Sandbox. A dialog box will state that all Sandbox content will be discarded and permanently deleted. Click **ok**. +4. Confirm that your host machine doesn't exhibit any of the modifications that you made in Windows Sandbox. ## Use a .wsb file to configure Windows Sandbox -Windows Sandbox supports simple configuration files (with a .wsb file extension) which provide a minimal set of customization parameters for a Sandbox. This feature can be used with any Windows build numbered 18342 or higher. +Windows Sandbox supports simple configuration files (that have a .wsb file extension), which provide a minimal set of customization parameters for Sandbox. This feature can be used with any Windows 10 build numbered 18342 or higher. -Sandbox configuration files are formatted as XML and are associated with Windows Sandbox via the .wsb file extension. To use a configuration file, double click it to open it in Windows Sandbox. It can also be invoked via the command line as shown:
- **C:\Temp> MyConfigFile.wsb** +Windows Sandbox configuration files are formatted as XML and are associated with Sandbox via the .wsb file extension. To use a configuration file, double click it to open it in Sandbox. You can also invoke it via the command line as shown here:
+ **C:\Temp> MyConfigFile.wsb** A configuration file allows the user to control the following aspects of Windows Sandbox: - **vGPU (virtualized GPU)** -
Enable or Disable the virtualized GPU. If vGPU is disabled, Sandbox will use WARP (software rasterizer). +
Enable or disable the virtualized GPU. If vGPU is disabled, Sandbox will use WARP (software rasterizer). - **Networking** -
Enable or Disable network access within the Sandbox. +
Enable or disable network access within the Sandbox. - **Mapped folders** -
Share folders from the host with read or write permissions. Note that exposing host directories may allow malicious software to affect the system or steal data. -- **Logon Command** -
A command that will be executed when the Sandbox starts. -- **Audio Input** -
Shares the host’s microphone input into the Sandbox. -- **Video Input** - - Shares the host’s webcam input into the Sandbox. -- **Protected Client** - - Places increased security settings on the RDP session to the Sandbox. -- **Printer Redirection** - - Shares printers from the host into the Sandbox. -- **Clipboard Redirection** - - Shares the host clipboard with the Sandbox so that text and files may be pasted back and forth. +
Share folders from the host with *read* or *write* permissions. Note that exposing host directories may allow malicious software to affect the system or steal data. +- **Logon command** +
A command that's executed when Sandbox starts. +- **Audio input** +
Shares the host's microphone input into Sandbox. +- **Video input** + - Shares the host's webcam input into Sandbox. +- **Protected client** + - Places increased security settings on the RDP session to Sandbox. +- **Printer redirection** + - Shares printers from the host into Sandbox. +- **Clipboard redirection** + - Shares the host clipboard with Sandbox so that text and files can be pasted back and forth. - **Memory in MB** -
The amount of memory, in megabytes, to assign to the Sandbox. +
The amount of memory, in megabytes, to assign to Sandbox. ### Keywords, values, and limits -**vGPU** - -Enables or disables GPU sharing. +**vGPU**: Enables or disables GPU sharing. `value` Supported values: -- **Enable**: enables vGPU support in the Sandbox. -- **Disable**: disables vGPU support in the Sandbox. If this value is set Windows Sandbox will use software rendering, which can be slower than virtualized GPU. -- **Default** – this is the default value for vGPU support; currently this means vGPU is disabled. +- *Enable*: Enables vGPU support in Sandbox. +- *Disable*: Disables vGPU support in Sandbox. If this value is set, Sandbox will use software rendering, which can be slower than virtualized GPU. +- *Default* This is the default value for vGPU support. Currently this means vGPU is disabled. -> [!NOTE]> Enabling virtualized GPU can potentially increase the attack surface of the Sandbox. +> [!NOTE] +> Enabling virtualized GPU can potentially increase the attack surface of Sandbox. -**Networking** - -Enables or disables networking in the Sandbox. Disabling network access can be used to decrease the attack surface exposed by the Sandbox. +**Networking**: Enables or disables networking in Sandbox. You can disable network access to decrease the attack surface exposed by Sandbox. `value` Supported values: -- *Disable*: Disables networking in the Sandbox. -- *Default*: This is the default value for networking support. This enables networking by creating a virtual switch on the host, and connects the Sandbox to it via a virtual NIC. +- *Disable*: Disables networking in Sandbox. +- *Default*: This is the default value for networking support. This value enables networking by creating a virtual switch on the host and connects Sandbox to it via a virtual NIC. > [!NOTE] > Enabling networking can expose untrusted applications to the internal network. -**MappedFolders** - -Wraps a list of MappedFolder objects. +**MappedFolders**: Wraps a list of MappedFolder objects. `` list of MappedFolder objects `` -> [!NOTE]> Files and folders mapped in from the host can be compromised by apps in the Sandbox or potentially affect the host. +> [!NOTE] +> Files and folders mapped in from the host can be compromised by apps in Sandbox or potentially affect the host. -**MappedFolder** +**MappedFolder**: Specifies a single folder on the host machine that will be shared on the container desktop. Apps in Sandbox are run under the user account *WDAGUtilityAccount*. If no Sandbox path is specified, a folder is mapped to the following path:
`C:\Users\WDAGUtilityAccount\Desktop` -Specifies a single folder on the host machine which will be shared on the container desktop. Apps in the Sandbox are run under the user account “WDAGUtilityAccount”. If no Sandbox path is specified, a folder is mapped to the following path:
`C:\Users\WDAGUtilityAccount\Desktop` - -E.g. "C:\Test” will be mapped as “C:\users\WDAGUtilityAccount\Desktop\Test by default. +Example: "C:\Test" will be mapped as "C:\users\WDAGUtilityAccount\Desktop\Test by default. ``` @@ -219,10 +214,10 @@ E.g. "C:\Test” will be mapped as “C:\users\WDAGUtilityAccount\Desktop\Test b *ReadOnly*: If true, enforces read-only access to the shared folder from within the container. Supported values: true/false. Defaults to false. -> [!NOTE] Files and folders mapped in from the host can be compromised by apps in the Sandbox or potentially affect the host. +> [!NOTE] +> Files and folders mapped in from the host can be compromised by apps in the Sandbox or potentially affect the host. -**LogonCommand** -Specifies a single command which will be invoked automatically after the Sandbox logs on. +**LogonCommand**: Specifies a single command that will be invoked automatically after the Sandbox logs on. ``` @@ -235,9 +230,9 @@ Specifies a single command which will be invoked automatically after the Sandbox > [!NOTE] > Although very simple commands will work (launching an executable or script), more complicated scenarios involving multiple steps should be placed into a script file. This script file may be mapped into the container via a shared folder, and then executed via the LogonCommand directive. -**Example 1:** +**Example 1** -The following config file can be used to easily test downloaded files inside of the Sandbox. To achieve this, the script disables networking and vGPU, and restricts the shared downloads folder to read-only access in the container. For convenience, the logon command opens the downloads folder inside of the container when it is started. +The following config file can be used to easily test downloaded files inside Sandbox. To achieve this, the script disables networking and vGPU and restricts the shared downloads folder to *read-only* access in the container. For convenience, the logon command opens the downloads folder inside the container when it is started. *Downloads.wsb* @@ -302,9 +297,9 @@ Enables or disables audio input to the Sandbox. `value` Supported values: -- **Enable**: Enables audio input in the Sandbox. If this value is set, Windows Sandbox will be able to receive audio input from the user. Applications using a microphone may require this setting. -- **Disable**: Disables audio input in the Sandbox. If this value is set, Windows Sandbox will not be able to receive audio input from the user. Applications using a microphone may not function properly with this setting. -- **Default**: This is the default value for audio input support; currently this means audio input is enabled. +- *Enable*: Enables audio input in the Sandbox. If this value is set, Windows Sandbox will be able to receive audio input from the user. Applications using a microphone may require this setting. +- *Disable*: Disables audio input in the Sandbox. If this value is set, Windows Sandbox will not be able to receive audio input from the user. Applications using a microphone may not function properly with this setting. +- *Default*: This is the default value for audio input support; currently this means audio input is enabled. **Video Input** @@ -313,9 +308,9 @@ Enables or disables video input to the Sandbox. `value` Supported values: -- **Enable**: Enables video input in the Sandbox. -- **Disable**: Disables video input into the Sandbox. Applications using video input may not function properly in the Sandbox. -- **Default**: This is the default value for video input support; currently this means video input is disabled. Applications using video input may not function properly in the Sandbox. +- *Enable*: Enables video input in the Sandbox. +- *Disable*: Disables video input into the Sandbox. Applications using video input may not function properly in the Sandbox. +- *Default*: This is the default value for video input support; currently this means video input is disabled. Applications using video input may not function properly in the Sandbox. **ProtectedClient** @@ -324,12 +319,12 @@ Places increased security settings on the Sandbox RDP session. These enhanced se `value` Supported values: -- **Enable**: Runs Windows Sandbox in Protected Client mode. If this value is set, Windows Sandbox will be run with extra security mitigations enabled. -- **Disable**: Runs Windows Sandbox in standard mode without extra security mitigations. -- **Default**: This is the default value for Protected Client mode; currently this means Windows Sandbox will not run in Protected Client mode. +- *Enable*: Runs Windows Sandbox in Protected Client mode. If this value is set, Windows Sandbox will be run with extra security mitigations enabled. +- *Disable*: Runs Windows Sandbox in standard mode without extra security mitigations. +- *Default*: This is the default value for Protected Client mode; currently this means Windows Sandbox will not run in Protected Client mode. > [!NOTE] -> This setting may restrict the user’s ability to copy/paste files in and out of the Sandbox. +> This setting may restrict the user's ability to copy/paste files in and out of the Sandbox. **Printer Redirection** @@ -338,9 +333,9 @@ Enables or disables printer sharing from the host into the Sandbox. `value` Supported values: -- **Enable**: Enables sharing of host printers into the Sandbox. -- **Disable**: Disables printer redirection in the Sandbox. If this value is set, Windows Sandbox will not be able to view printers from the host. -- **Default**: This is the default value for printer redirection support; currently this means that printer redirection is disabled. +- *Enable*: Enables sharing of host printers into the Sandbox. +- *Disable*: Disables printer redirection in the Sandbox. If this value is set, Windows Sandbox will not be able to view printers from the host. +- *Default*: This is the default value for printer redirection support; currently this means that printer redirection is disabled. **Clipboard Redirection** @@ -349,8 +344,8 @@ Enables or disables clipboard sharing with the Sandbox. `value` Supported values: -- **Disable**: Disables clipboard redirection in the Sandbox. If this value is set, copy/paste in and out of the Sandbox will be restricted. -- **Default**: This is the default value for clipboard redirection; currently this means that copy/paste between the host and Sandbox are permitted. +- *Disable*: Disables clipboard redirection in the Sandbox. If this value is set, copy/paste in and out of the Sandbox will be restricted. +- *Default*: This is the default value for clipboard redirection; currently this means that copy/paste between the host and Sandbox are permitted. **Memory in MB** From ca4d7c1ee9059fd442ba1506ce42954b3464f8dc Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Fri, 6 Mar 2020 13:23:31 -0800 Subject: [PATCH 03/30] Update windows-sandbox-overview.md --- .../windows-sandbox-overview.md | 68 ++++++++++--------- 1 file changed, 36 insertions(+), 32 deletions(-) diff --git a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md index 5d5641f480..7ca96f460a 100644 --- a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -232,7 +232,7 @@ Example: "C:\Test" will be mapped as "C:\users\WDAGUtilityAccount\Desktop\Test b **Example 1** -The following config file can be used to easily test downloaded files inside Sandbox. To achieve this, the script disables networking and vGPU and restricts the shared downloads folder to *read-only* access in the container. For convenience, the logon command opens the downloads folder inside the container when it is started. +The following config file can be used to easily test downloaded files inside Sandbox. To do this, the script disables networking and vGPU and restricts the shared downloads folder to *read-only* access in the container. For convenience, the logon command opens the downloads folder inside the container when it's started. *Downloads.wsb* @@ -256,17 +256,17 @@ The following config file can be used to easily test downloaded files inside San The following config file installs Visual Studio Code in the Sandbox, which requires a slightly more complicated LogonCommand setup. -Two folders are mapped into the Sandbox; the first (SandboxScripts) contains VSCodeInstall.cmd, which will install and run VSCode. The second folder (CodingProjects) is assumed to contain project files that the developer wants to modify using VSCode. +Two folders are mapped into the Sandbox. The first folder (SandboxScripts) contains VSCodeInstall.cmd, which will install and run Visual Studio Code. The second folder (CodingProjects) is assumed to contain project files that the developer wants to modify by using Visual Studio Code. -With the VSCode installer script already mapped into the Sandbox, the LogonCommand can reference it. +With the Visual Studio Code installer script already mapped into Sandbox, the LogonCommand can reference it. *VSCodeInstall.cmd* ``` -REM Download VSCode +REM Download Visual Studio Code curl -L "https://update.code.visualstudio.com/latest/win32-x64-user/stable" --output C:\users\WDAGUtilityAccount\Desktop\vscode.exe -REM Install and run VSCode +REM Install and run Visual Studio Code C:\users\WDAGUtilityAccount\Desktop\vscode.exe /verysilent /suppressmsgboxes ``` @@ -290,76 +290,80 @@ VSCode.wsb ``` -**Audio Input** +**AudioInput** -Enables or disables audio input to the Sandbox. +Enables or disables audio input to Sandbox. `value` Supported values: -- *Enable*: Enables audio input in the Sandbox. If this value is set, Windows Sandbox will be able to receive audio input from the user. Applications using a microphone may require this setting. -- *Disable*: Disables audio input in the Sandbox. If this value is set, Windows Sandbox will not be able to receive audio input from the user. Applications using a microphone may not function properly with this setting. -- *Default*: This is the default value for audio input support; currently this means audio input is enabled. +- *Enable*: Enables audio input in Sandbox. If this value is set, Sandbox will be able to receive audio input from the user. Applications that use a microphone may need this setting. +- *Disable*: Disables audio input in Sandbox. If this value is set, Sandbox can't receive audio input from the user. Applications that use a microphone may not function properly with this setting. +- *Default*: This is the default value for audio input support. Currently this means audio input is enabled. -**Video Input** +**VideoInput** -Enables or disables video input to the Sandbox. +Enables or disables video input to Sandbox. `value` Supported values: -- *Enable*: Enables video input in the Sandbox. -- *Disable*: Disables video input into the Sandbox. Applications using video input may not function properly in the Sandbox. -- *Default*: This is the default value for video input support; currently this means video input is disabled. Applications using video input may not function properly in the Sandbox. +- *Enable*: Enables video input in Sandbox. +- *Disable*: Disables video input in Sandbox. Applications that use video input may not function properly in Sandbox. +- *Default*: This is the default value for video input support. Currently this means video input is disabled. Applications that use video input may not function properly in Sandbox. **ProtectedClient** -Places increased security settings on the Sandbox RDP session. These enhanced security mitigations decrease the attack surface of the Sandbox. +Implements increased-security settings on the Sandbox RDP session. These settings decrease the attack surface of the Sandbox. `value` Supported values: -- *Enable*: Runs Windows Sandbox in Protected Client mode. If this value is set, Windows Sandbox will be run with extra security mitigations enabled. -- *Disable*: Runs Windows Sandbox in standard mode without extra security mitigations. -- *Default*: This is the default value for Protected Client mode; currently this means Windows Sandbox will not run in Protected Client mode. +- *Enable*: Runs Windows Sandbox in Protected Client mode. If this value is set, Sandbox runs with extra security mitigations enabled. +- *Disable*: Runs Sandbox in standard mode without extra security mitigations. +- *Default*: This is the default value for Protected Client mode. Currently, Sandbox doesn't run in Protected Client mode under *Default*. > [!NOTE] -> This setting may restrict the user's ability to copy/paste files in and out of the Sandbox. +> This setting may restrict the user's ability to copy/paste files in and out of Sandbox. -**Printer Redirection** +**PrinterRedirection** Enables or disables printer sharing from the host into the Sandbox. `value` Supported values: -- *Enable*: Enables sharing of host printers into the Sandbox. -- *Disable*: Disables printer redirection in the Sandbox. If this value is set, Windows Sandbox will not be able to view printers from the host. -- *Default*: This is the default value for printer redirection support; currently this means that printer redirection is disabled. +- *Enable*: Enables sharing of host printers into Sandbox. +- *Disable*: Disables printer redirection in Sandbox. If this value is set, Sandbox can't view printers from the host. +- *Default*: This is the default value for printer redirection support. Currently printer redirection is disabled under *Default*. -**Clipboard Redirection** +**ClipboardRedirection** Enables or disables clipboard sharing with the Sandbox. `value` Supported values: -- *Disable*: Disables clipboard redirection in the Sandbox. If this value is set, copy/paste in and out of the Sandbox will be restricted. -- *Default*: This is the default value for clipboard redirection; currently this means that copy/paste between the host and Sandbox are permitted. +- *Disable*: Disables clipboard redirection in Sandbox. If this value is set, copy/paste in and out of Sandbox will be restricted. +- *Default*: This is the default value for clipboard redirection. Currently copy/paste between the host and Sandbox are permitted under *Default*. -**Memory in MB** +**MemoryInMB** -Specifies the amount of memory that may be utilized by the Sandbox in megabytes (MB). +Specifies the amount of memory that Sandbox can use in megabytes (MB). `value` Supported values: An integer greater than 2048 (2GB). -[Insert as comment: FAQ (future) + \ No newline at end of file From d1ea1a88bf646ff59180df93e2c6ac809c061828 Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Mon, 9 Mar 2020 10:54:35 -0700 Subject: [PATCH 04/30] Update windows-sandbox-overview.md --- .../windows-sandbox-overview.md | 146 +++++++++--------- 1 file changed, 74 insertions(+), 72 deletions(-) diff --git a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md index 7ca96f460a..92294760e8 100644 --- a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -17,88 +17,90 @@ ms.reviewer: ### Overview -Windows Sandbox provides a lightweight desktop environment for safely running applications in isolation. Software that's installed inside the Sandbox environment remains in the "sandboxed" environment and can't affect the host machine. Windows Sandbox is temporary. When it's closed, all the software, files, and state are permanently deleted. You get a brand-new instance of the Sandbox every time you open the application. +Windows Sandbox provides a lightweight desktop environment for to safely run applications in isolation. Software that's installed inside the Windows Sandbox environment remains in the "sandboxed" environment and can't affect the host machine. A sandbox is temporary. When it's closed, all the software, files, and state are permanently deleted. You get a brand-new instance of the sandbox every time you open the application. -Software and applications installed on the host are not directly available in Windows Sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the Sandbox environment. +Software and applications installed on the host are not directly available in Windows Sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the environment. Windows Sandbox has the following properties: - **Part of Windows**: Everything required for this feature is included in Windows 10 Pro and Enterprise. There's no need to download a VHD. - **Pristine**: Every time Windows Sandbox runs, it's as clean as a brand-new installation of Windows. - **Disposable**: Nothing persists on the device. Everything is discarded when the user closes the application. -- **Secure**: Uses hardware-based virtualization for kernel isolation, which relies on t he Microsoft hypervisor to run a separate kernel that isolates Windows Sandbox from the host. +- **Secure**: Uses hardware-based virtualization for kernel isolation. It relies on the Microsoft hypervisor to run a separate kernel that isolates Windows Sandbox from the host. - **Efficient:** Uses integrated kernel scheduler, smart memory management, and virtual GPU. The following video provides an overview of Windows Sandbox. [embed Ignite 2019 Sandbox talk video here, link is here: https://myignite.techcommunity.microsoft.com/sessions/79739?source=sessions ] + + ## Architecture ### Dynamically generated image -At its core, Windows Sandbox is a lightweight virtual machine, so it requires an operating system image to boot from. But instead of giving the sandbox a separate copy of Windows to boot from, our Dynamic Base Image technology lets us use the copy of Windows that's already installed on the host. +At its core, Windows Sandbox is a lightweight virtual machine, so it needs an operating system image to boot from. Instead of giving the sandbox a separate copy of Windows to boot from, our Dynamic Base Image technology lets us use the copy of Windows that's already installed on the host. -Most OS files are immutable, and we can freely share these files with Windows Sandbox. A small portion of the Windows files are mutable and we can't be shared. Windows Sandbox contains pristine copies of these files. A full Windows image can be constructed from the sharable immutable files on the host and the pristine copies of mutable files. By using this scheme, Windows Sandbox has a full Windows Installation to boot from without needing to download or store an additional copy of Windows. +Most OS files are immutable, and we can freely share these files with Windows Sandbox. A small portion of the Windows files are mutable and we can't be shared. Windows Sandbox contains pristine copies of these files. A full Windows image can be constructed from a combination of the sharable immutable files on the host and the pristine copies of mutable files. By using this scheme, Windows Sandbox has a full Windows installation to boot from without needing to download or store an additional copy of Windows. When Windows Sandbox isn't installed, the dynamic base image is stored in a compressed 25-MB package. Once installed, the dynamic base package occupies about 500 MB of disk space. -![Chart compares dynamic image of files and links with host file system](images/1-dynamic-host.png) +![Chart compares scale of dynamic image of files and links with the host file system](images/1-dynamic-host.png) ### Memory management -With traditional virtual machines (VMs) a portion of host memory is dedicated for exclusive use by the VM. If the host later comes under resource pressure, it can't use the memory dedicated to the VM. Nor can it provide more memory, if available, to the VM. Windows Sandbox treat memory more similarly to how memory is allocated to applications. All apps on the machine can request the amount of memory that they need. The amount that they get will be a function of what other apps are running and how much memory they need. The amount of memory available for use by an application can change over time. +With traditional virtual machines (VMs) a portion of host memory is dedicated for exclusive use by the VM. If the host later comes under resource pressure, it can't use the memory that was dedicated to the VM. Nor can it provide more memory, if available, to the VM. Windows Sandbox treats memory more like how memory is allocated to applications. All apps on the machine can request the amount of memory that they need. The amount that they get will be a function of what other apps are running and how much memory they need. And the amount of memory available for use by an application can change over time. ### Dynamic working set -When using a VM, the user is effectively partitioning their machine. If the host is under memory pressure, it can't use the memory already allocated to the VM. Buy applications in the Sandbox are treated as equal to apps running on the host, so when apps in Sandbox are under memory pressure, you can give more memory to the Sandbox (and the same applies to the host). Guest physical pages provided are virtualized. +When using a VM, the user is effectively partitioning their machine. If the host is under memory pressure, it can't use the memory already allocated to the VM. But applications in the sandbox are treated as equal to apps running on the host, so when apps in sandbox are under memory pressure, you can give more memory to the sandbox (and the same applies to the host). Guest physical pages provided are virtualized. -![Chart compares memory sharing in Windows Sandbox vs. a traditional VM](images/2-dynamic-working.png) +![Chart compares memory sharing in Windows Sandbox versus a traditional VM](images/2-dynamic-working.png) ### Memory sharing -Becuase Windows Sandbox runs the same operating system image as the host, it has been enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as "direct map." For example, when ntdll.dll is loaded into memory in the Sandbox, it uses the same executable pages as those of the binary loaded on the host. Memory sharing between the host and Sandbox results in a smaller memory footprint when compared to traditional VMs without compromising valuable host secrets. +Because Windows Sandbox runs the same operating system image as the host, it has been enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as "direct map." For example, when ntdll.dll is loaded into memory in the sandbox, it uses the same executable pages as those of the binary when loaded on the host. Memory sharing between the host and sandbox results in a smaller memory footprint when compared to traditional VMs without compromising valuable host secrets. -![Chart compares the memory footprint in Windows Sandbox vs. a traditional VM](images/3-memory-sharing.png) +![Chart compares the memory footprint in Windows Sandbox versus a traditional VM](images/3-memory-sharing.png) ### Integrated kernel scheduler -With ordinary virtual machines, the Microsoft hypervisor controls the scheduling of the virtual processors running in the VMs. Windows Sandbox uses a new technology called "integrated scheduling," which allows the host scheduler to decide when the Sandbox receives CPU cycles. +With ordinary virtual machines, the Microsoft hypervisor controls the scheduling of the virtual processors running in the VMs. Windows Sandbox uses a new technology called "integrated scheduling," which allows the host scheduler to decide when the sandbox receives CPU cycles. -GRAPHIC 4 -![Chart compares the scheduling in Windows Sandbox vs. a traditional VM](images/4-integrated-kernal.png) +![Chart compares the scheduling in Windows Sandbox vervus a traditional VM](images/4-integrated-kernal.png) -Windows Sandbox employs a unique scheduling policy that allows the virtual processors of the Sandbox to be scheduled in the same way as threads would be scheduled for a process. High-priority tasks on the host can preempt less important work in the Sandbox. The benefit of the integrated scheduler is that the host manages Windows Sandbox as a process rather than a virtual machine, which results in a much more responsive host, similar to Linux KVM. +Windows Sandbox employs a unique scheduling policy that allows the virtual processors of the sandbox to be scheduled in the same way as threads would be scheduled for a process. High-priority tasks on the host can preempt less important work in the sandbox. The benefit of the integrated scheduler is that the host manages Windows Sandbox as a process rather than a virtual machine, which results in a much more responsive host, similar to Linux KVM. -The goal is to treat the Sandbox like an app but with the security guarantees of a virtual machine. +The goal is to treat Windows Sandbox like an app but with the security guarantees of a virtual machine. ### Snapshot and clone -As noted earlier, Windows Sandbox uses the Microsoft hypervisor. It essentially runs another copy of Windows that needs to be booted, and this can take some time. Rather than paying the full cost of booting the Sandbox operating system every time Windows Sandbox starts, two other technologies are utilized: *snapshot* and *clone.* +As noted earlier, Windows Sandbox uses the Microsoft hypervisor. It essentially runs another copy of Windows that needs to be booted, and this can take some time. Rather than paying the full cost of booting the Windows Sandbox operating system every time Sandbox starts, two other technologies are utilized: *snapshot* and *clone.* -Snapshot allows us to boot the Sandbox environment once and preserve the memory, CPU, and device state to disk. Then we can restore the Sandbox environment from disk and put it in memory rather than booting it when we need a new instance of Sandbox. By cloning the in-memory snapshot of Windows Sandbox, start time is significantly improved. +*Snapshot* allows us to boot the sandbox environment once and preserve the memory, CPU, and device state to disk. Then we can restore the sandbox environment from disk and put it in memory rather than booting it when we need a new instance of Windows Sandbox. By cloning the in-memory snapshot of Windows Sandbox, start time is significantly improved. ### WDDM GPU virtualization -Hardware-accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intense or media-heavy uses. But virtual machines are isolated from their hosts and unable to access advanced devices like GPUs. The role of graphics virtualization technologies is to bridge this gap and provide hardware acceleration in virtualized environments. +Hardware-accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intense or media-heavy uses. But virtual machines are isolated from their hosts and can't access advanced devices like GPUs. The role of graphics virtualization technologies is to bridge this gap and provide hardware acceleration in virtualized environments. Microsoft has been working with its graphics ecosystem partners to integrate modern graphics virtualization capabilities directly into DirectX and WDDM, the driver model that's used for Windows display drivers. -GRAPHIC 5 ![Chart illustrates graphics kernal use in Sandbox managed alongside apps on the host](images/5-wddm-gpu-virtualization.png) At a high level, this form of graphics virtualization works as follows: - Apps running in a Hyper-V VM use graphics APIs as normal. - Graphics components in the VM, which have been enlightened to support virtualization, coordinate across the VM boundary with the host to execute graphics workloads. -- The host allocates and schedules graphics resources among apps in the VM alongside the apps running natively. Conceptually, they behave as one pool of graphics clients. +- The host allocates and schedules graphics resources among apps in the VM alongside the apps that are running natively. Conceptually, they behave as one pool of graphics clients. This process is illustrated here: ![Chart illustrates graphics resource use on the host and guest](images/6-wddm-gpu-virtualization-2.png) -This enables the Windows Sandbox VM to benefit from hardware-accelerated rendering, with Windows dynamically allocating graphics resources where they are needed across the host and guest. The result is improved performance and responsiveness for apps running in Windows Sandbox, as well as improved battery life for graphics-heavy use cases. +This enables the Windows Sandbox VM to benefit from hardware-accelerated rendering, with Windows dynamically allocating graphics resources where they are needed across the host and guest. The result is improved performance and responsiveness for apps running in Windows Sandbox, as well as improved battery life for graphics-heavy uses. -To take advantage of these benefits, a system with a compatible GPU and graphics drivers (WDDM 2.5 or newer) is required. Incompatible systems will render apps in Windows Sandbox with Microsoft's CPU-based rendering technology (WARP). +To take advantage of these benefits, a system with a compatible GPU and graphics drivers (WDDM 2.5 or newer) is required. Incompatible systems will render apps in Windows Sandbox with the Microsoft CPU-based rendering technology, Windows Advanced Rasterization Platform (WARP). ### Battery pass-through @@ -118,49 +120,49 @@ Windows Sandbox is also aware of the host's battery state, which allows it to op ### Installation 1. Make sure your machine is using a Windows 10 Pro or Enterprise build version 18305 or later. -2. Enable virtualization on the machine. +1. Enable virtualization on the machine. - If you're using a physical machine, make sure virtualization capabilities are enabled in the BIOS. - If you're using a virtual machine, run the following PowerShell command to enable nested virtualization:
**Set -VMProcessor -VMName -ExposeVirtualizationExtensions $true** 1. Use the search bar on the task bar and type **Turn Windows Features on and off**. Select **Windows Sandbox** and then **OK**. Restart the computer if you're prompted. - If the **Windows Sandbox** option is unavailable, your computer doesn't meet the requirements to run Windows Sandbox. If you think this is incorrect, review the prerequisite list as well as steps 1 and 2. -1. Locate and select **Windows Sandbox** on the Start menu to run it for the first time. +1. Locate and select **Windows Sandbox** on the Start menu to run it for the first time. ### Usage 1. Copy an executable file (and any other files needed to run the application) from the host into the Windows Sandbox window. -2. Run the executable file or installer inside Sandbox. -3. When you are finished experimenting, close Sandbox. A dialog box will state that all Sandbox content will be discarded and permanently deleted. Click **ok**. +2. Run the executable file or installer inside the sandbox. +3. When you're finished experimenting, close the sandbox. A dialog box will state that all sthe sandbox content will be discarded and permanently deleted. Select **ok**. 4. Confirm that your host machine doesn't exhibit any of the modifications that you made in Windows Sandbox. ## Use a .wsb file to configure Windows Sandbox -Windows Sandbox supports simple configuration files (that have a .wsb file extension), which provide a minimal set of customization parameters for Sandbox. This feature can be used with any Windows 10 build numbered 18342 or higher. +Windows Sandbox supports simple configuration files (that have a .wsb file extension), which provide a minimal set of customization parameters for Sandbox. This feature can be used with any Windows 10 build 18342 or later. -Windows Sandbox configuration files are formatted as XML and are associated with Sandbox via the .wsb file extension. To use a configuration file, double click it to open it in Sandbox. You can also invoke it via the command line as shown here:
+Windows Sandbox configuration files are formatted as XML and are associated with Sandbox via the .wsb file extension. To use a configuration file, double-click it to open it in the sandbox. You can also invoke it via the command line as shown here:
**C:\Temp> MyConfigFile.wsb** - A configuration file allows the user to control the following aspects of Windows Sandbox: + A configuration file enables the user to control the following aspects of Windows Sandbox: - **vGPU (virtualized GPU)** -
Enable or disable the virtualized GPU. If vGPU is disabled, Sandbox will use WARP (software rasterizer). +
Enable or disable the virtualized GPU. If vGPU is disabled, the sandbox will use WARP (software rasterizer). - **Networking** -
Enable or disable network access within the Sandbox. +
Enable or disable network access within the sandbox. - **Mapped folders**
Share folders from the host with *read* or *write* permissions. Note that exposing host directories may allow malicious software to affect the system or steal data. - **Logon command** -
A command that's executed when Sandbox starts. +
A command that's executed when Windows Sandbox starts. - **Audio input** -
Shares the host's microphone input into Sandbox. +
Shares the host's microphone input into the andbox. - **Video input** - - Shares the host's webcam input into Sandbox. + - Shares the host's webcam input into the sandbox. - **Protected client** - - Places increased security settings on the RDP session to Sandbox. + - Places increased security settings on the RDP session to the sandbox. - **Printer redirection** - - Shares printers from the host into Sandbox. + - Shares printers from the host into the sandbox. - **Clipboard redirection** - - Shares the host clipboard with Sandbox so that text and files can be pasted back and forth. + - Shares the host clipboard with the sandbox so that text and files can be pasted back and forth. - **Memory in MB** -
The amount of memory, in megabytes, to assign to Sandbox. +
The amount of memory, in megabytes, to assign to the sandbox. ### Keywords, values, and limits @@ -169,20 +171,20 @@ Windows Sandbox configuration files are formatted as XML and are associated with `value` Supported values: -- *Enable*: Enables vGPU support in Sandbox. -- *Disable*: Disables vGPU support in Sandbox. If this value is set, Sandbox will use software rendering, which can be slower than virtualized GPU. +- *Enable*: Enables vGPU support in the sandbox. +- *Disable*: Disables vGPU support in the sandbox. If this value is set, the sandbox will use software rendering, which can be slower than virtualized GPU. - *Default* This is the default value for vGPU support. Currently this means vGPU is disabled. > [!NOTE] -> Enabling virtualized GPU can potentially increase the attack surface of Sandbox. +> Enabling virtualized GPU can potentially increase the attack surface of the sandbox. -**Networking**: Enables or disables networking in Sandbox. You can disable network access to decrease the attack surface exposed by Sandbox. +**Networking**: Enables or disables networking in the sandbox. You can disable network access to decrease the attack surface exposed by the sandbox. `value` Supported values: -- *Disable*: Disables networking in Sandbox. -- *Default*: This is the default value for networking support. This value enables networking by creating a virtual switch on the host and connects Sandbox to it via a virtual NIC. +- *Disable*: Disables networking in the sandbox. +- *Default*: This is the default value for networking support. This value enables networking by creating a virtual switch on the host and connects the sandbox to it via a virtual NIC. > [!NOTE] > Enabling networking can expose untrusted applications to the internal network. @@ -194,9 +196,9 @@ Supported values: `` > [!NOTE] -> Files and folders mapped in from the host can be compromised by apps in Sandbox or potentially affect the host. +> Files and folders mapped in from the host can be compromised by apps in the sandbox or potentially affect the host. -**MappedFolder**: Specifies a single folder on the host machine that will be shared on the container desktop. Apps in Sandbox are run under the user account *WDAGUtilityAccount*. If no Sandbox path is specified, a folder is mapped to the following path:
`C:\Users\WDAGUtilityAccount\Desktop` +**MappedFolder**: Specifies a single folder on the host machine that will be shared on the container desktop. Apps in the sandbox are run under the user account *WDAGUtilityAccount*. If no sandbox path is specified, a folder is mapped to the following path:
`C:\Users\WDAGUtilityAccount\Desktop` Example: "C:\Test" will be mapped as "C:\users\WDAGUtilityAccount\Desktop\Test by default. @@ -208,16 +210,16 @@ Example: "C:\Test" will be mapped as "C:\users\WDAGUtilityAccount\Desktop\Test b ``` -*HostFolder*: Specifies the folder on the host machine to share to the Sandbox. Note that the folder must already exist on the host or the container will fail to start if the folder is not found. +*HostFolder*: Specifies the folder on the host machine to share to the sandbox. Note that the folder must already exist on the host, or the container will fail to start if the folder isn't found. -*SandboxFolder*: Specifies the destination in the Sandbox to map the folder to. If the folder does not exist, it will be created. +*SandboxFolder*: Specifies the destination in the Sandbox to map the folder to. If the folder doesn't exist, it will be created. -*ReadOnly*: If true, enforces read-only access to the shared folder from within the container. Supported values: true/false. Defaults to false. +*ReadOnly*: If *true*, enforces *read-only* access to the shared folder from within the container. Supported values: true/false. Defaults to false. > [!NOTE] -> Files and folders mapped in from the host can be compromised by apps in the Sandbox or potentially affect the host. +> Files and folders mapped in from the host can be compromised by apps in the sandbox or potentially affect the host. -**LogonCommand**: Specifies a single command that will be invoked automatically after the Sandbox logs on. +**LogonCommand**: Specifies a single command that will be invoked automatically after the sandbox logs on. ``` @@ -228,11 +230,11 @@ Example: "C:\Test" will be mapped as "C:\users\WDAGUtilityAccount\Desktop\Test b *Command*: A path to an executable or script inside of the container that will be executed after login. > [!NOTE] -> Although very simple commands will work (launching an executable or script), more complicated scenarios involving multiple steps should be placed into a script file. This script file may be mapped into the container via a shared folder, and then executed via the LogonCommand directive. +> Although very simple commands work (such as launching an executable or script), more-complicated scenarios that have multiple steps should be placed in a script file. This script file can be mapped to the container via a shared folder and then executed via the *LogonCommand* directive. **Example 1** -The following config file can be used to easily test downloaded files inside Sandbox. To do this, the script disables networking and vGPU and restricts the shared downloads folder to *read-only* access in the container. For convenience, the logon command opens the downloads folder inside the container when it's started. +The following config file can be used to easily test downloaded files inside the sandbox. To do this, the script disables networking and vGPU and restricts the shared downloads folder to *read-only* access in the container. For convenience, the logon command opens the downloads folder inside the container when it's started. *Downloads.wsb* @@ -254,11 +256,11 @@ The following config file can be used to easily test downloaded files inside San **Example 2** -The following config file installs Visual Studio Code in the Sandbox, which requires a slightly more complicated LogonCommand setup. +The following config file installs Visual Studio Code in the sandbox, which requires a slightly more complicated LogonCommand setup. -Two folders are mapped into the Sandbox. The first folder (SandboxScripts) contains VSCodeInstall.cmd, which will install and run Visual Studio Code. The second folder (CodingProjects) is assumed to contain project files that the developer wants to modify by using Visual Studio Code. +Two folders are mapped into the sandbox. The first folder (SandboxScripts) contains VSCodeInstall.cmd, which installs and runs Visual Studio Code. The second folder (CodingProjects) is assumed to contain project files that the developer wants to modify by using Visual Studio Code. -With the Visual Studio Code installer script already mapped into Sandbox, the LogonCommand can reference it. +With the Visual Studio Code installer script already mapped into the sandbox, the LogonCommand can reference it. *VSCodeInstall.cmd* @@ -303,43 +305,43 @@ Supported values: **VideoInput** -Enables or disables video input to Sandbox. +Enables or disables video input to the sandbox. `value` Supported values: -- *Enable*: Enables video input in Sandbox. -- *Disable*: Disables video input in Sandbox. Applications that use video input may not function properly in Sandbox. -- *Default*: This is the default value for video input support. Currently this means video input is disabled. Applications that use video input may not function properly in Sandbox. +- *Enable*: Enables video input in the sandbox. +- *Disable*: Disables video input in the sandbox. Applications that use video input may not function properly in Windows Sandbox. +- *Default*: This is the default value for video input support. Currently this means video input is disabled. Applications that use video input may not function properly in Windows Sandbox. **ProtectedClient** -Implements increased-security settings on the Sandbox RDP session. These settings decrease the attack surface of the Sandbox. +Implements increased-security settings on the sandbox RDP session. These settings decrease the attack surface of the sandbox. `value` Supported values: -- *Enable*: Runs Windows Sandbox in Protected Client mode. If this value is set, Sandbox runs with extra security mitigations enabled. -- *Disable*: Runs Sandbox in standard mode without extra security mitigations. -- *Default*: This is the default value for Protected Client mode. Currently, Sandbox doesn't run in Protected Client mode under *Default*. +- *Enable*: Runs Windows Sandbox in Protected Client mode. If this value is set, the sandbox runs with extra security mitigations enabled. +- *Disable*: Runs the sandbox in standard mode without extra security mitigations. +- *Default*: This is the default value for Protected Client mode. Currently, this means the sandbox doesn't run in Protected Client mode. > [!NOTE] -> This setting may restrict the user's ability to copy/paste files in and out of Sandbox. +> This setting may restrict the user's ability to copy/paste files in and out of the sandbox. **PrinterRedirection** -Enables or disables printer sharing from the host into the Sandbox. +Enables or disables printer sharing from the host into the sandbox. `value` Supported values: -- *Enable*: Enables sharing of host printers into Sandbox. -- *Disable*: Disables printer redirection in Sandbox. If this value is set, Sandbox can't view printers from the host. -- *Default*: This is the default value for printer redirection support. Currently printer redirection is disabled under *Default*. +- *Enable*: Enables sharing of host printers into the sandbox. +- *Disable*: Disables printer redirection in the sandbox. If this value is set, the sandbox can't view printers from the host. +- *Default*: This is the default value for printer redirection support. Currently this means printer redirection is disabled. **ClipboardRedirection** -Enables or disables clipboard sharing with the Sandbox. +Enables or disables clipboard sharing with the sandbox. `value` @@ -349,7 +351,7 @@ Supported values: **MemoryInMB** -Specifies the amount of memory that Sandbox can use in megabytes (MB). +Specifies the amount of memory that the sandbox can use in megabytes (MB). `value` From 083e62c0970125a2a55d8cc70f0a327bf0711b46 Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Mon, 9 Mar 2020 11:15:14 -0700 Subject: [PATCH 05/30] Update windows-sandbox-overview.md --- .../windows-sandbox/windows-sandbox-overview.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md index 92294760e8..c87b5553f9 100644 --- a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -19,7 +19,7 @@ ms.reviewer: Windows Sandbox provides a lightweight desktop environment for to safely run applications in isolation. Software that's installed inside the Windows Sandbox environment remains in the "sandboxed" environment and can't affect the host machine. A sandbox is temporary. When it's closed, all the software, files, and state are permanently deleted. You get a brand-new instance of the sandbox every time you open the application. -Software and applications installed on the host are not directly available in Windows Sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the environment. +Software and applications installed on the host aren't directly available in Windows Sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the environment. Windows Sandbox has the following properties: - **Part of Windows**: Everything required for this feature is included in Windows 10 Pro and Enterprise. There's no need to download a VHD. @@ -42,7 +42,7 @@ RedTiger ID for embedding video requested 3/10 At its core, Windows Sandbox is a lightweight virtual machine, so it needs an operating system image to boot from. Instead of giving the sandbox a separate copy of Windows to boot from, our Dynamic Base Image technology lets us use the copy of Windows that's already installed on the host. -Most OS files are immutable, and we can freely share these files with Windows Sandbox. A small portion of the Windows files are mutable and we can't be shared. Windows Sandbox contains pristine copies of these files. A full Windows image can be constructed from a combination of the sharable immutable files on the host and the pristine copies of mutable files. By using this scheme, Windows Sandbox has a full Windows installation to boot from without needing to download or store an additional copy of Windows. +Most OS files are immutable, and we can freely share these files with Windows Sandbox. A small portion of the Windows files is mutable and we can't be shared. Windows Sandbox contains pristine copies of these files. A complete Windows image can be constructed from a combination of the sharable immutable files on the host and the pristine copies of mutable files. By using this scheme, Windows Sandbox has a full Windows installation to boot from without needing to download or store an additional copy of Windows. When Windows Sandbox isn't installed, the dynamic base image is stored in a compressed 25-MB package. Once installed, the dynamic base package occupies about 500 MB of disk space. @@ -68,7 +68,7 @@ Because Windows Sandbox runs the same operating system image as the host, it has With ordinary virtual machines, the Microsoft hypervisor controls the scheduling of the virtual processors running in the VMs. Windows Sandbox uses a new technology called "integrated scheduling," which allows the host scheduler to decide when the sandbox receives CPU cycles. -![Chart compares the scheduling in Windows Sandbox vervus a traditional VM](images/4-integrated-kernal.png) +![Chart compares the scheduling in Windows Sandbox versus a traditional VM](images/4-integrated-kernal.png) Windows Sandbox employs a unique scheduling policy that allows the virtual processors of the sandbox to be scheduled in the same way as threads would be scheduled for a process. High-priority tasks on the host can preempt less important work in the sandbox. The benefit of the integrated scheduler is that the host manages Windows Sandbox as a process rather than a virtual machine, which results in a much more responsive host, similar to Linux KVM. @@ -78,11 +78,11 @@ The goal is to treat Windows Sandbox like an app but with the security guarantee As noted earlier, Windows Sandbox uses the Microsoft hypervisor. It essentially runs another copy of Windows that needs to be booted, and this can take some time. Rather than paying the full cost of booting the Windows Sandbox operating system every time Sandbox starts, two other technologies are utilized: *snapshot* and *clone.* -*Snapshot* allows us to boot the sandbox environment once and preserve the memory, CPU, and device state to disk. Then we can restore the sandbox environment from disk and put it in memory rather than booting it when we need a new instance of Windows Sandbox. By cloning the in-memory snapshot of Windows Sandbox, start time is significantly improved. +*Snapshot* allows us to boot the sandbox environment once and preserve the memory, CPU, and device state to disk. Then we can restore the sandbox environment from disk and put it in memory, rather than booting it when we need a new instance of Windows Sandbox. By cloning the in-memory snapshot of Windows Sandbox, start time is significantly improved. ### WDDM GPU virtualization -Hardware-accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intense or media-heavy uses. But virtual machines are isolated from their hosts and can't access advanced devices like GPUs. The role of graphics virtualization technologies is to bridge this gap and provide hardware acceleration in virtualized environments. +Hardware-accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intense, or media-heavy uses. But virtual machines are isolated from their hosts and can't access advanced devices like GPUs. The role of graphics virtualization technologies is to bridge this gap and provide hardware acceleration in virtualized environments. Microsoft has been working with its graphics ecosystem partners to integrate modern graphics virtualization capabilities directly into DirectX and WDDM, the driver model that's used for Windows display drivers. From ef565979b08b074094d9e59ec61323d970cab20d Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Mon, 9 Mar 2020 11:44:07 -0700 Subject: [PATCH 06/30] Update windows-sandbox-overview.md --- .../windows-sandbox/windows-sandbox-overview.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md index c87b5553f9..890bbcbb8e 100644 --- a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -17,7 +17,7 @@ ms.reviewer: ### Overview -Windows Sandbox provides a lightweight desktop environment for to safely run applications in isolation. Software that's installed inside the Windows Sandbox environment remains in the "sandboxed" environment and can't affect the host machine. A sandbox is temporary. When it's closed, all the software, files, and state are permanently deleted. You get a brand-new instance of the sandbox every time you open the application. +Windows Sandbox provides a lightweight desktop environment to safely run applications in isolation. Software that's installed inside the Windows Sandbox environment remains in the "sandboxed" and can't affect the host machine. A sandbox is temporary. When it's closed, all the software and files and the state are permanently deleted. You get a brand-new instance of the sandbox every time you open the application. Software and applications installed on the host aren't directly available in Windows Sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the environment. @@ -26,14 +26,15 @@ Windows Sandbox has the following properties: - **Pristine**: Every time Windows Sandbox runs, it's as clean as a brand-new installation of Windows. - **Disposable**: Nothing persists on the device. Everything is discarded when the user closes the application. - **Secure**: Uses hardware-based virtualization for kernel isolation. It relies on the Microsoft hypervisor to run a separate kernel that isolates Windows Sandbox from the host. -- **Efficient:** Uses integrated kernel scheduler, smart memory management, and virtual GPU. +- **Efficient:** Uses the integrated kernel scheduler, smart memory management, and virtual GPU. The following video provides an overview of Windows Sandbox. [embed Ignite 2019 Sandbox talk video here, link is here: https://myignite.techcommunity.microsoft.com/sessions/79739?source=sessions ] +[!VIDEO https://www.microsoft.com/videoplayer/embed/***XXXXXX***] ## Architecture @@ -42,11 +43,11 @@ RedTiger ID for embedding video requested 3/10 At its core, Windows Sandbox is a lightweight virtual machine, so it needs an operating system image to boot from. Instead of giving the sandbox a separate copy of Windows to boot from, our Dynamic Base Image technology lets us use the copy of Windows that's already installed on the host. -Most OS files are immutable, and we can freely share these files with Windows Sandbox. A small portion of the Windows files is mutable and we can't be shared. Windows Sandbox contains pristine copies of these files. A complete Windows image can be constructed from a combination of the sharable immutable files on the host and the pristine copies of mutable files. By using this scheme, Windows Sandbox has a full Windows installation to boot from without needing to download or store an additional copy of Windows. +Most OS files are immutable and can be freely shared with Windows Sandbox. A small portion of the OS file are mutable and we can't be shared. Windows Sandbox contains pristine copies of these files. A complete Windows image can be constructed from a combination of the sharable immutable files on the host and the pristine copies of mutable files. By using this scheme, Windows Sandbox has a full Windows installation to boot from without needing to download or store an additional copy of Windows. -When Windows Sandbox isn't installed, the dynamic base image is stored in a compressed 25-MB package. Once installed, the dynamic base package occupies about 500 MB of disk space. +Before Windows Sandbox is installed, the dynamic base image is stored in a compressed 25-MB package. Once it's installed, the dynamic base package occupies about 500 MB of disk space. -![Chart compares scale of dynamic image of files and links with the host file system](images/1-dynamic-host.png) +![A chart compares scale of dynamic image of files and links with the host file system.](images/1-dynamic-host.png) ### Memory management @@ -56,7 +57,7 @@ With traditional virtual machines (VMs) a portion of host memory is dedicated fo When using a VM, the user is effectively partitioning their machine. If the host is under memory pressure, it can't use the memory already allocated to the VM. But applications in the sandbox are treated as equal to apps running on the host, so when apps in sandbox are under memory pressure, you can give more memory to the sandbox (and the same applies to the host). Guest physical pages provided are virtualized. -![Chart compares memory sharing in Windows Sandbox versus a traditional VM](images/2-dynamic-working.png) +![A chart compares memory sharing in Windows Sandbox versus a traditional VM.](images/2-dynamic-working.png) ### Memory sharing From 522edc7951b705854b51dcf194c1e08f6653efea Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Mon, 9 Mar 2020 14:41:01 -0700 Subject: [PATCH 07/30] Update windows-sandbox-overview.md --- .../windows-sandbox-overview.md | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md index 890bbcbb8e..b9913ac4f5 100644 --- a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -61,15 +61,15 @@ When using a VM, the user is effectively partitioning their machine. If the host ### Memory sharing -Because Windows Sandbox runs the same operating system image as the host, it has been enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as "direct map." For example, when ntdll.dll is loaded into memory in the sandbox, it uses the same executable pages as those of the binary when loaded on the host. Memory sharing between the host and sandbox results in a smaller memory footprint when compared to traditional VMs without compromising valuable host secrets. +Because Windows Sandbox runs the same operating system image as the host, it has been enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as "direct map." For example, when *ntdll.dll* is loaded into memory in the sandbox, it uses the same executable pages as those of the binary when loaded on the host. Memory sharing between the host and sandbox results in a smaller memory footprint when compared to traditional VMs without compromising valuable host secrets. -![Chart compares the memory footprint in Windows Sandbox versus a traditional VM](images/3-memory-sharing.png) +![A chart compares the memory footprint in Windows Sandbox versus a traditional VM.](images/3-memory-sharing.png) ### Integrated kernel scheduler -With ordinary virtual machines, the Microsoft hypervisor controls the scheduling of the virtual processors running in the VMs. Windows Sandbox uses a new technology called "integrated scheduling," which allows the host scheduler to decide when the sandbox receives CPU cycles. +With ordinary virtual machines, the Microsoft hypervisor controls the scheduling of the virtual processors running in the VMs. Windows Sandbox uses a new technology called "integrated scheduling," which allows the host scheduler to decide when the sandbox gets CPU cycles. -![Chart compares the scheduling in Windows Sandbox versus a traditional VM](images/4-integrated-kernal.png) +![A chart compares the scheduling in Windows Sandbox versus a traditional VM.](images/4-integrated-kernal.png) Windows Sandbox employs a unique scheduling policy that allows the virtual processors of the sandbox to be scheduled in the same way as threads would be scheduled for a process. High-priority tasks on the host can preempt less important work in the sandbox. The benefit of the integrated scheduler is that the host manages Windows Sandbox as a process rather than a virtual machine, which results in a much more responsive host, similar to Linux KVM. @@ -77,17 +77,17 @@ The goal is to treat Windows Sandbox like an app but with the security guarantee ### Snapshot and clone -As noted earlier, Windows Sandbox uses the Microsoft hypervisor. It essentially runs another copy of Windows that needs to be booted, and this can take some time. Rather than paying the full cost of booting the Windows Sandbox operating system every time Sandbox starts, two other technologies are utilized: *snapshot* and *clone.* +As we noted earlier, Windows Sandbox uses the Microsoft hypervisor. It essentially runs another copy of Windows that needs to be booted, and this can take some time. Rather than paying the full cost of booting the Windows Sandbox operating system every time Sandbox starts, two other technologies are utilized: *snapshot* and *clone.* -*Snapshot* allows us to boot the sandbox environment once and preserve the memory, CPU, and device state to disk. Then we can restore the sandbox environment from disk and put it in memory, rather than booting it when we need a new instance of Windows Sandbox. By cloning the in-memory snapshot of Windows Sandbox, start time is significantly improved. +*Snapshot* allows us to boot the Windows Sandbox environment once and preserve the memory, CPU, and device state to disk. Then we can restore the Sandbox environment from disk and put it in memory, rather than booting it when we need a new instance of Sandbox. By cloning the in-memory snapshot of Windows Sandbox, start time is significantly improved. ### WDDM GPU virtualization -Hardware-accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intense, or media-heavy uses. But virtual machines are isolated from their hosts and can't access advanced devices like GPUs. The role of graphics virtualization technologies is to bridge this gap and provide hardware acceleration in virtualized environments. +Hardware-accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intense or media-heavy uses. But virtual machines are isolated from their hosts and can't access advanced devices like GPUs. The role of graphics virtualization technologies is to bridge this gap and provide hardware acceleration in virtualized environments. -Microsoft has been working with its graphics ecosystem partners to integrate modern graphics virtualization capabilities directly into DirectX and WDDM, the driver model that's used for Windows display drivers. +Microsoft is working with its graphics ecosystem partners to integrate modern graphics virtualization capabilities directly into DirectX and Windows Display Driver Model (WDDM), the driver model that's used for Windows. -![Chart illustrates graphics kernal use in Sandbox managed alongside apps on the host](images/5-wddm-gpu-virtualization.png) +![A chart illustrates graphics kernal use in Sandbox managed alongside apps on the host.](images/5-wddm-gpu-virtualization.png) At a high level, this form of graphics virtualization works as follows: @@ -97,9 +97,9 @@ At a high level, this form of graphics virtualization works as follows: This process is illustrated here: -![Chart illustrates graphics resource use on the host and guest](images/6-wddm-gpu-virtualization-2.png) +![A chart illustrates graphics resource use on the host and guest.](images/6-wddm-gpu-virtualization-2.png) -This enables the Windows Sandbox VM to benefit from hardware-accelerated rendering, with Windows dynamically allocating graphics resources where they are needed across the host and guest. The result is improved performance and responsiveness for apps running in Windows Sandbox, as well as improved battery life for graphics-heavy uses. +This enables the Windows Sandbox VM to benefit from hardware-accelerated rendering, with Windows dynamically allocating graphics resources where they're needed across the host and guest. The result is improved performance and responsiveness for apps running in Windows Sandbox, as well as improved battery life for graphics-heavy uses. To take advantage of these benefits, a system with a compatible GPU and graphics drivers (WDDM 2.5 or newer) is required. Incompatible systems will render apps in Windows Sandbox with the Microsoft CPU-based rendering technology, Windows Advanced Rasterization Platform (WARP). @@ -120,11 +120,11 @@ Windows Sandbox is also aware of the host's battery state, which allows it to op ### Installation -1. Make sure your machine is using a Windows 10 Pro or Enterprise build version 18305 or later. -1. Enable virtualization on the machine. +1. Make sure your machine is using Windows 10 Pro or Enterprise build version 18305 or later. +2. Enable virtualization on the machine. - If you're using a physical machine, make sure virtualization capabilities are enabled in the BIOS. - - If you're using a virtual machine, run the following PowerShell command to enable nested virtualization:
**Set -VMProcessor -VMName -ExposeVirtualizationExtensions $true** + - If you're using a virtual machine, run the following PowerShell command to enable nested virtualization:
**Set -VMProcessor -VMName \ -ExposeVirtualizationExtensions $true** 1. Use the search bar on the task bar and type **Turn Windows Features on and off**. Select **Windows Sandbox** and then **OK**. Restart the computer if you're prompted. - If the **Windows Sandbox** option is unavailable, your computer doesn't meet the requirements to run Windows Sandbox. If you think this is incorrect, review the prerequisite list as well as steps 1 and 2. From 4635681d6652833dd68f7751ec810d007d304705 Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Mon, 9 Mar 2020 17:43:19 -0700 Subject: [PATCH 08/30] Update windows-sandbox-overview.md --- .../windows-sandbox-overview.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md index b9913ac4f5..e189d94b3f 100644 --- a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -43,7 +43,7 @@ RedTiger ID for embedding video requested 3/10 - Open WorkItem 25505527 At its core, Windows Sandbox is a lightweight virtual machine, so it needs an operating system image to boot from. Instead of giving the sandbox a separate copy of Windows to boot from, our Dynamic Base Image technology lets us use the copy of Windows that's already installed on the host. -Most OS files are immutable and can be freely shared with Windows Sandbox. A small portion of the OS file are mutable and we can't be shared. Windows Sandbox contains pristine copies of these files. A complete Windows image can be constructed from a combination of the sharable immutable files on the host and the pristine copies of mutable files. By using this scheme, Windows Sandbox has a full Windows installation to boot from without needing to download or store an additional copy of Windows. +Most OS files are immutable and can be freely shared with Windows Sandbox. A small portion of the OS files are mutable and we can't be shared. Windows Sandbox contains pristine copies of these files. A complete Windows image can be constructed from a combination of the sharable immutable files on the host and the pristine copies of mutable files. By using this scheme, Windows Sandbox has a full Windows installation to boot from without needing to download or store an additional copy of Windows. Before Windows Sandbox is installed, the dynamic base image is stored in a compressed 25-MB package. Once it's installed, the dynamic base package occupies about 500 MB of disk space. @@ -51,7 +51,7 @@ Before Windows Sandbox is installed, the dynamic base image is stored in a compr ### Memory management -With traditional virtual machines (VMs) a portion of host memory is dedicated for exclusive use by the VM. If the host later comes under resource pressure, it can't use the memory that was dedicated to the VM. Nor can it provide more memory, if available, to the VM. Windows Sandbox treats memory more like how memory is allocated to applications. All apps on the machine can request the amount of memory that they need. The amount that they get will be a function of what other apps are running and how much memory they need. And the amount of memory available for use by an application can change over time. +For traditional virtual machines (VMs), a portion of host memory is dedicated for exclusive use by the VM. If the host later comes under resource pressure, it can't use the memory that was dedicated to the VM. Nor can it provide more memory, if available, to the VM. Windows Sandbox treats memory more like how memory is allocated to applications. All apps on the machine can request the amount of memory that they need. The amount that they get will be a function of what other apps are running and how much memory they need. And the amount of memory available for use by an application can change over time. ### Dynamic working set @@ -116,7 +116,7 @@ Windows Sandbox is also aware of the host's battery state, which allows it to op - Virtualization capabilities enabled in BIOS - At least 4 GB of RAM (8 GB recommended) - At least 1 GB of free disk space (SSD recommended) -- At least 2 CPU cores (4 cores with hyperthreading recommended) +- At least two CPU cores (four cores with hyperthreading recommended) ### Installation @@ -133,12 +133,12 @@ Windows Sandbox is also aware of the host's battery state, which allows it to op ### Usage 1. Copy an executable file (and any other files needed to run the application) from the host into the Windows Sandbox window. 2. Run the executable file or installer inside the sandbox. -3. When you're finished experimenting, close the sandbox. A dialog box will state that all sthe sandbox content will be discarded and permanently deleted. Select **ok**. +3. When you're finished experimenting, close the sandbox. A dialog box will state that all sandbox content will be discarded and permanently deleted. Select **ok**. 4. Confirm that your host machine doesn't exhibit any of the modifications that you made in Windows Sandbox. ## Use a .wsb file to configure Windows Sandbox -Windows Sandbox supports simple configuration files (that have a .wsb file extension), which provide a minimal set of customization parameters for Sandbox. This feature can be used with any Windows 10 build 18342 or later. +Windows Sandbox supports simple configuration files (that have a .wsb file extension), which provide a minimal set of customization parameters for Sandbox. This feature can be used with Windows 10 build 18342 or later. Windows Sandbox configuration files are formatted as XML and are associated with Sandbox via the .wsb file extension. To use a configuration file, double-click it to open it in the sandbox. You can also invoke it via the command line as shown here:
**C:\Temp> MyConfigFile.wsb** @@ -215,7 +215,7 @@ Example: "C:\Test" will be mapped as "C:\users\WDAGUtilityAccount\Desktop\Test b *SandboxFolder*: Specifies the destination in the Sandbox to map the folder to. If the folder doesn't exist, it will be created. -*ReadOnly*: If *true*, enforces *read-only* access to the shared folder from within the container. Supported values: true/false. Defaults to false. +*ReadOnly*: If *true*, enforces *read-only* access to the shared folder from within the container. Supported values: *true*/*false*. Defaults to *false*. > [!NOTE] > Files and folders mapped in from the host can be compromised by apps in the sandbox or potentially affect the host. @@ -228,7 +228,7 @@ Example: "C:\Test" will be mapped as "C:\users\WDAGUtilityAccount\Desktop\Test b ``` -*Command*: A path to an executable or script inside of the container that will be executed after login. +*Command*: A path to an executable or script inside the container that will be executed after login. > [!NOTE] > Although very simple commands work (such as launching an executable or script), more-complicated scenarios that have multiple steps should be placed in a script file. This script file can be mapped to the container via a shared folder and then executed via the *LogonCommand* directive. @@ -295,13 +295,13 @@ VSCode.wsb **AudioInput** -Enables or disables audio input to Sandbox. +Enables or disables audio input to the sandbox. `value` Supported values: -- *Enable*: Enables audio input in Sandbox. If this value is set, Sandbox will be able to receive audio input from the user. Applications that use a microphone may need this setting. -- *Disable*: Disables audio input in Sandbox. If this value is set, Sandbox can't receive audio input from the user. Applications that use a microphone may not function properly with this setting. +- *Enable*: Enables audio input in the sandbox. If this value is set, the sandbox will be able to receive audio input from the user. Applications that use a microphone may need this setting. +- *Disable*: Disables audio input in the sandbox. If this value is set, the sandbox can't receive audio input from the user. Applications that use a microphone may not function properly with this setting. - *Default*: This is the default value for audio input support. Currently this means audio input is enabled. **VideoInput** @@ -312,8 +312,8 @@ Enables or disables video input to the sandbox. Supported values: - *Enable*: Enables video input in the sandbox. -- *Disable*: Disables video input in the sandbox. Applications that use video input may not function properly in Windows Sandbox. -- *Default*: This is the default value for video input support. Currently this means video input is disabled. Applications that use video input may not function properly in Windows Sandbox. +- *Disable*: Disables video input in the sandbox. Applications that use video input may not function properly in the sandbox. +- *Default*: This is the default value for video input support. Currently this means video input is disabled. Applications that use video input may not function properly in the sandbox. **ProtectedClient** From f4bc0490ae36c69d8f0097fd76ffc992cb48e998 Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Tue, 10 Mar 2020 11:54:41 -0700 Subject: [PATCH 09/30] Break into three articles and move; tweak format --- .../windows-sandbox/images/1-dynamic-host.png | Bin .../images/2-dynamic-working.png | Bin .../images/3-memory-sharing.png | Bin .../images/4-integrated-kernal.png | Bin .../images/5-wddm-gpu-virtualization.png | Bin .../images/6-wddm-gpu-virtualization-2.png | Bin .../windows-sandbox-architecture.md | 117 ++++++ ...indows-sandbox-configure-using-wsb-file.md | 228 +++++++++++ .../windows-sandbox-overview.md | 39 ++ .../windows-sandbox-overview.md | 372 ------------------ 10 files changed, 384 insertions(+), 372 deletions(-) rename windows/{ => security}/threat-protection/windows-sandbox/images/1-dynamic-host.png (100%) rename windows/{ => security}/threat-protection/windows-sandbox/images/2-dynamic-working.png (100%) rename windows/{ => security}/threat-protection/windows-sandbox/images/3-memory-sharing.png (100%) rename windows/{ => security}/threat-protection/windows-sandbox/images/4-integrated-kernal.png (100%) rename windows/{ => security}/threat-protection/windows-sandbox/images/5-wddm-gpu-virtualization.png (100%) rename windows/{ => security}/threat-protection/windows-sandbox/images/6-wddm-gpu-virtualization-2.png (100%) create mode 100644 windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md create mode 100644 windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md create mode 100644 windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md delete mode 100644 windows/threat-protection/windows-sandbox/windows-sandbox-overview.md diff --git a/windows/threat-protection/windows-sandbox/images/1-dynamic-host.png b/windows/security/threat-protection/windows-sandbox/images/1-dynamic-host.png similarity index 100% rename from windows/threat-protection/windows-sandbox/images/1-dynamic-host.png rename to windows/security/threat-protection/windows-sandbox/images/1-dynamic-host.png diff --git a/windows/threat-protection/windows-sandbox/images/2-dynamic-working.png b/windows/security/threat-protection/windows-sandbox/images/2-dynamic-working.png similarity index 100% rename from windows/threat-protection/windows-sandbox/images/2-dynamic-working.png rename to windows/security/threat-protection/windows-sandbox/images/2-dynamic-working.png diff --git a/windows/threat-protection/windows-sandbox/images/3-memory-sharing.png b/windows/security/threat-protection/windows-sandbox/images/3-memory-sharing.png similarity index 100% rename from windows/threat-protection/windows-sandbox/images/3-memory-sharing.png rename to windows/security/threat-protection/windows-sandbox/images/3-memory-sharing.png diff --git a/windows/threat-protection/windows-sandbox/images/4-integrated-kernal.png b/windows/security/threat-protection/windows-sandbox/images/4-integrated-kernal.png similarity index 100% rename from windows/threat-protection/windows-sandbox/images/4-integrated-kernal.png rename to windows/security/threat-protection/windows-sandbox/images/4-integrated-kernal.png diff --git a/windows/threat-protection/windows-sandbox/images/5-wddm-gpu-virtualization.png b/windows/security/threat-protection/windows-sandbox/images/5-wddm-gpu-virtualization.png similarity index 100% rename from windows/threat-protection/windows-sandbox/images/5-wddm-gpu-virtualization.png rename to windows/security/threat-protection/windows-sandbox/images/5-wddm-gpu-virtualization.png diff --git a/windows/threat-protection/windows-sandbox/images/6-wddm-gpu-virtualization-2.png b/windows/security/threat-protection/windows-sandbox/images/6-wddm-gpu-virtualization-2.png similarity index 100% rename from windows/threat-protection/windows-sandbox/images/6-wddm-gpu-virtualization-2.png rename to windows/security/threat-protection/windows-sandbox/images/6-wddm-gpu-virtualization-2.png diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md new file mode 100644 index 0000000000..36b8e115dd --- /dev/null +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md @@ -0,0 +1,117 @@ +--- +title: Windows Sandbox architecture +description: +ms.prod: w10 +audience: ITPro +author: dansimp +ms.author: dansimp +manager: dansimp +ms.collection: +ms.topic: article +ms.localizationpriority: +ms.date: +ms.reviewer: +--- + +# Windows Sandbox architecture + +This article describes the Windows Sandbox basics. + +## Fundamentals + +### Dynamically generated image + +At its core, Windows Sandbox is a lightweight virtual machine, so it needs an operating system image to boot from. Instead of giving the sandbox a separate copy of Windows to boot from, our Dynamic Base Image technology lets us use the copy of Windows that's already installed on the host. + +Most OS files are immutable and can be freely shared with Windows Sandbox. A small portion of the OS files are mutable and we can't be shared. Windows Sandbox contains pristine copies of these files. A complete Windows image can be constructed from a combination of the sharable immutable files on the host and the pristine copies of mutable files. By using this scheme, Windows Sandbox has a full Windows installation to boot from without needing to download or store an additional copy of Windows. + +Before Windows Sandbox is installed, the dynamic base image is stored in a compressed 25-MB package. Once it's installed, the dynamic base package occupies about 500 MB of disk space. + +![A chart compares scale of dynamic image of files and links with the host file system.](images/1-dynamic-host.png) + +### Memory management + +For traditional virtual machines (VMs), a portion of host memory is dedicated for exclusive use by the VM. If the host later comes under resource pressure, it can't use the memory that was dedicated to the VM. Nor can it provide more memory, if available, to the VM. Windows Sandbox treats memory more like how memory is allocated to applications. All apps on the machine can request the amount of memory that they need. The amount that they get will be a function of what other apps are running and how much memory they need. And the amount of memory available for use by an application can change over time. + +### Dynamic working set + +When using a VM, the user is effectively partitioning their machine. If the host is under memory pressure, it can't use the memory already allocated to the VM. But applications in the sandbox are treated as equal to apps running on the host, so when apps in sandbox are under memory pressure, you can give more memory to the sandbox (and the same applies to the host). Guest physical pages provided are virtualized. + +![A chart compares memory sharing in Windows Sandbox versus a traditional VM.](images/2-dynamic-working.png) + +### Memory sharing + +Because Windows Sandbox runs the same operating system image as the host, it has been enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as "direct map." For example, when *ntdll.dll* is loaded into memory in the sandbox, it uses the same executable pages as those of the binary when loaded on the host. Memory sharing between the host and sandbox results in a smaller memory footprint when compared to traditional VMs without compromising valuable host secrets. + +![A chart compares the memory footprint in Windows Sandbox versus a traditional VM.](images/3-memory-sharing.png) + +### Integrated kernel scheduler + +With ordinary virtual machines, the Microsoft hypervisor controls the scheduling of the virtual processors running in the VMs. Windows Sandbox uses a new technology called "integrated scheduling," which allows the host scheduler to decide when the sandbox gets CPU cycles. + +![A chart compares the scheduling in Windows Sandbox versus a traditional VM.](images/4-integrated-kernal.png) + +Windows Sandbox employs a unique scheduling policy that allows the virtual processors of the sandbox to be scheduled in the same way as threads would be scheduled for a process. High-priority tasks on the host can preempt less important work in the sandbox. The benefit of the integrated scheduler is that the host manages Windows Sandbox as a process rather than a virtual machine, which results in a much more responsive host, similar to Linux KVM. + +The goal is to treat Windows Sandbox like an app but with the security guarantees of a virtual machine. + +### Snapshot and clone + +As we noted earlier, Windows Sandbox uses the Microsoft hypervisor. It essentially runs another copy of Windows that needs to be booted, and this can take some time. Rather than paying the full cost of booting the Windows Sandbox operating system every time Sandbox starts, two other technologies are utilized: *snapshot* and *clone.* + +*Snapshot* allows us to boot the Windows Sandbox environment once and preserve the memory, CPU, and device state to disk. Then we can restore the Sandbox environment from disk and put it in memory, rather than booting it when we need a new instance of Sandbox. By cloning the in-memory snapshot of Windows Sandbox, start time is significantly improved. + +### WDDM GPU virtualization + +Hardware-accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intense or media-heavy uses. But virtual machines are isolated from their hosts and can't access advanced devices like GPUs. The role of graphics virtualization technologies is to bridge this gap and provide hardware acceleration in virtualized environments. + +Microsoft is working with its graphics ecosystem partners to integrate modern graphics virtualization capabilities directly into DirectX and Windows Display Driver Model (WDDM), the driver model that's used for Windows. + +![A chart illustrates graphics kernel use in Sandbox managed alongside apps on the host.](images/5-wddm-gpu-virtualization.png) + +At a high level, this form of graphics virtualization works as follows: + +- Apps running in a Hyper-V VM use graphics APIs as normal. +- Graphics components in the VM, which have been enlightened to support virtualization, coordinate across the VM boundary with the host to execute graphics workloads. +- The host allocates and schedules graphics resources among apps in the VM alongside the apps that are running natively. Conceptually, they behave as one pool of graphics clients. + +This process is illustrated here: + +![A chart illustrates graphics resource use on the host and guest.](images/6-wddm-gpu-virtualization-2.png) + +This enables the Windows Sandbox VM to benefit from hardware-accelerated rendering, with Windows dynamically allocating graphics resources where they're needed across the host and guest. The result is improved performance and responsiveness for apps running in Windows Sandbox, as well as improved battery life for graphics-heavy uses. + +To take advantage of these benefits, a system with a compatible GPU and graphics drivers (WDDM 2.5 or newer) is required. Incompatible systems will render apps in Windows Sandbox with the Microsoft CPU-based rendering technology, Windows Advanced Rasterization Platform (WARP). + +### Battery pass-through + +Windows Sandbox is also aware of the host's battery state, which allows it to optimize power consumption. This is critical for a technology that's used on laptops, where battery life is often critical. + +## Prerequites, installation, and basic use + +### Prerequisites + +- Windows 10 Pro or Enterprise build 18305 or later (*Windows Sandbox is currently not supported on Home SKUs*) +- AMD64 architecture +- Virtualization capabilities enabled in BIOS +- At least 4 GB of RAM (8 GB recommended) +- At least 1 GB of free disk space (SSD recommended) +- At least two CPU cores (four cores with hyperthreading recommended) + +### Installation + +1. Make sure your machine is using Windows 10 Pro or Enterprise build version 18305 or later. +2. Enable virtualization on the machine. + + - If you're using a physical machine, make sure virtualization capabilities are enabled in the BIOS. + - If you're using a virtual machine, run the following PowerShell command to enable nested virtualization:
**Set -VMProcessor -VMName \ -ExposeVirtualizationExtensions $true** +1. Use the search bar on the task bar and type **Turn Windows Features on and off**. Select **Windows Sandbox** and then **OK**. Restart the computer if you're prompted. + + - If the **Windows Sandbox** option is unavailable, your computer doesn't meet the requirements to run Windows Sandbox. If you think this is incorrect, review the prerequisite list as well as steps 1 and 2. +1. Locate and select **Windows Sandbox** on the Start menu to run it for the first time. + +### Usage +1. Copy an executable file (and any other files needed to run the application) from the host into the Windows Sandbox window. +2. Run the executable file or installer inside the sandbox. +3. When you're finished experimenting, close the sandbox. A dialog box will state that all sandbox content will be discarded and permanently deleted. Select **ok**. +4. Confirm that your host machine doesn't exhibit any of the modifications that you made in Windows Sandbox. diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md new file mode 100644 index 0000000000..20b66df936 --- /dev/null +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md @@ -0,0 +1,228 @@ +--- +title: Use a .wsb file to configure Windows Sandbox +description: +ms.prod: w10 +audience: ITPro +author: dansimp +ms.author: dansimp +manager: dansimp +ms.collection: +ms.topic: article +ms.localizationpriority: +ms.date: +ms.reviewer: +--- + +# Use a .wsb file to configure Windows Sandbox + +Windows Sandbox supports simple configuration files (that have a .wsb file extension), which provide a minimal set of customization parameters for Sandbox. This feature can be used with Windows 10 build 18342 or later. + +Windows Sandbox configuration files are formatted as XML and are associated with Sandbox via the .wsb file extension. To use a configuration file, double-click it to open it in the sandbox. You can also invoke it via the command line as shown here: + +**C:\Temp> MyConfigFile.wsb** + + A configuration file enables the user to control the following aspects of Windows Sandbox: +- **vGPU (virtualized GPU)**: Enable or disable the virtualized GPU. If vGPU is disabled, the sandbox will use WARP (software rasterizer). +- **Networking**: Enable or disable network access within the sandbox. +- **Mapped folders**: Share folders from the host with *read* or *write* permissions. Note that exposing host directories may allow malicious software to affect the system or steal data. +- **Logon command**: A command that's executed when Windows Sandbox starts. +- **Audio input**: Shares the host's microphone input into the sandbox. +- **Video input**: Shares the host's webcam input into the sandbox. +- **Protected client**: Places increased security settings on the RDP session to the sandbox. +- **Printer redirection**: Shares printers from the host into the sandbox. +- **Clipboard redirection**: Shares the host clipboard with the sandbox so that text and files can be pasted back and forth. +- **Memory in MB**: The amount of memory, in megabytes, to assign to the sandbox. + +**Keywords, values, and limits** + +**vGPU**: Enables or disables GPU sharing. + +`value` + +Supported values: +- *Enable*: Enables vGPU support in the sandbox. +- *Disable*: Disables vGPU support in the sandbox. If this value is set, the sandbox will use software rendering, which can be slower than virtualized GPU. +- *Default* This is the default value for vGPU support. Currently this means vGPU is disabled. + +> [!NOTE] +> Enabling virtualized GPU can potentially increase the attack surface of the sandbox. + +**Networking**: Enables or disables networking in the sandbox. You can disable network access to decrease the attack surface exposed by the sandbox. + +`value` + +Supported values: +- *Disable*: Disables networking in the sandbox. +- *Default*: This is the default value for networking support. This value enables networking by creating a virtual switch on the host and connects the sandbox to it via a virtual NIC. + +> [!NOTE] +> Enabling networking can expose untrusted applications to the internal network. + +**MappedFolders**: Wraps a list of MappedFolder objects. + +`` + list of MappedFolder objects +`` + +> [!NOTE] +> Files and folders mapped in from the host can be compromised by apps in the sandbox or potentially affect the host. + +**MappedFolder**: Specifies a single folder on the host machine that will be shared on the container desktop. Apps in the sandbox are run under the user account *WDAGUtilityAccount*. If no sandbox path is specified, a folder is mapped to the following path:
`C:\Users\WDAGUtilityAccount\Desktop` + +Example: "C:\Test" will be mapped as "C:\users\WDAGUtilityAccount\Desktop\Test by default. + +``` + + path to the host folder + path to the sandbox folder + value + +``` + +*HostFolder*: Specifies the folder on the host machine to share to the sandbox. The folder must already exist on the host, or the container will fail to start if the folder isn't found. + +*SandboxFolder*: Specifies the destination in the Sandbox to map the folder to. If the folder doesn't exist, it will be created. + +*ReadOnly*: If *true*, enforces *read-only* access to the shared folder from within the container. Supported values: *true*/*false*. Defaults to *false*. + +> [!NOTE] +> Files and folders mapped in from the host can be compromised by apps in the sandbox or potentially affect the host. + +**LogonCommand**: Specifies a single command that will be invoked automatically after the sandbox logs on. + +``` + + command to be invoked + +``` + +*Command*: A path to an executable or script inside the container that will be executed after login. + +> [!NOTE] +> Although very simple commands work (such as launching an executable or script), more-complicated scenarios that have multiple steps should be placed in a script file. This script file can be mapped to the container via a shared folder and then executed via the *LogonCommand* directive. + +***Example 1*** + +The following config file can be used to easily test downloaded files inside the sandbox. To do this, the script disables networking and vGPU and restricts the shared downloads folder to *read-only* access in the container. For convenience, the logon command opens the downloads folder inside the container when it's started. + +*Downloads.wsb* + +``` + + Disable + Disable + + + C:\Users\Public\Downloads + true + + + + explorer.exe C:\users\WDAGUtilityAccount\Desktop\Downloads + + +``` + +***Example 2*** + +The following config file installs Visual Studio Code in the sandbox, which requires a slightly more complicated LogonCommand setup. + +Two folders are mapped into the sandbox. The first folder (SandboxScripts) contains VSCodeInstall.cmd, which installs and runs Visual Studio Code. The second folder (CodingProjects) is assumed to contain project files that the developer wants to modify by using Visual Studio Code. + +With the Visual Studio Code installer script already mapped into the sandbox, the LogonCommand can reference it. + +*VSCodeInstall.cmd* + +``` +REM Download Visual Studio Code +curl -L "https://update.code.visualstudio.com/latest/win32-x64-user/stable" --output C:\users\WDAGUtilityAccount\Desktop\vscode.exe + +REM Install and run Visual Studio Code +C:\users\WDAGUtilityAccount\Desktop\vscode.exe /verysilent /suppressmsgboxes +``` + +VSCode.wsb + +``` + + + + C:\SandboxScripts + true + + + C:\CodingProjects + false + + + + C:\users\wdagutilityaccount\desktop\SandboxScripts\VSCodeInstall.cmd + + +``` + +**AudioInput**: Enables or disables audio input to the sandbox. + +`value` + +Supported values: +- *Enable*: Enables audio input in the sandbox. If this value is set, the sandbox will be able to receive audio input from the user. Applications that use a microphone may need this setting. +- *Disable*: Disables audio input in the sandbox. If this value is set, the sandbox can't receive audio input from the user. Applications that use a microphone may not function properly with this setting. +- *Default*: This is the default value for audio input support. Currently this means audio input is enabled. + +**VideoInput**: Enables or disables video input to the sandbox. + +`value` + +Supported values: +- *Enable*: Enables video input in the sandbox. +- *Disable*: Disables video input in the sandbox. Applications that use video input may not function properly in the sandbox. +- *Default*: This is the default value for video input support. Currently this means video input is disabled. Applications that use video input may not function properly in the sandbox. + +**ProtectedClient**: Implements increased-security settings on the sandbox RDP session. These settings decrease the attack surface of the sandbox. + +`value` + +Supported values: +- *Enable*: Runs Windows Sandbox in Protected Client mode. If this value is set, the sandbox runs with extra security mitigations enabled. +- *Disable*: Runs the sandbox in standard mode without extra security mitigations. +- *Default*: This is the default value for Protected Client mode. Currently, this means the sandbox doesn't run in Protected Client mode. + +> [!NOTE] +> This setting may restrict the user's ability to copy/paste files in and out of the sandbox. + +**PrinterRedirection**: Enables or disables printer sharing from the host into the sandbox. + +`value` + +Supported values: +- *Enable*: Enables sharing of host printers into the sandbox. +- *Disable*: Disables printer redirection in the sandbox. If this value is set, the sandbox can't view printers from the host. +- *Default*: This is the default value for printer redirection support. Currently this means printer redirection is disabled. + +**ClipboardRedirection**: Enables or disables clipboard sharing with the sandbox. + +`value` + +Supported values: +- *Disable*: Disables clipboard redirection in Sandbox. If this value is set, copy/paste in and out of Sandbox will be restricted. +- *Default*: This is the default value for clipboard redirection. Currently copy/paste between the host and Sandbox are permitted under *Default*. + +**MemoryInMB**: Specifies the amount of memory that the sandbox can use in megabytes (MB). + +`value` + +Supported values: An integer greater than 2048 (2 GB). + + \ No newline at end of file diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md new file mode 100644 index 0000000000..78e6c8e2f4 --- /dev/null +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -0,0 +1,39 @@ +--- +title: Windows Sandbox overview +description: +ms.prod: w10 +audience: ITPro +author: dansimp +ms.author: dansimp +manager: dansimp +ms.collection: +ms.topic: article +ms.localizationpriority: +ms.date: +ms.reviewer: +--- + +# Windows Sandbox overview + +Windows Sandbox provides a lightweight desktop environment to safely run applications in isolation. Software that's installed inside the Windows Sandbox environment remains in the "sandboxed" and can't affect the host machine. + +A sandbox is temporary. When it's closed, all the software and files and the state are permanently deleted. You get a brand-new instance of the sandbox every time you open the application. + +Software and applications installed on the host aren't directly available in the sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the environment. + +Windows Sandbox has the following properties: +- **Part of Windows**: Everything required for this feature is included in Windows 10 Pro and Enterprise. There's no need to download a VHD. +- **Pristine**: Every time Windows Sandbox runs, it's as clean as a brand-new installation of Windows. +- **Disposable**: Nothing persists on the device. Everything is discarded when the user closes the application. +- **Secure**: Uses hardware-based virtualization for kernel isolation. It relies on the Microsoft hypervisor to run a separate kernel that isolates Windows Sandbox from the host. +- **Efficient:** Uses the integrated kernel scheduler, smart memory management, and virtual GPU. + +The following video provides an overview of Windows Sandbox. + +[embed Ignite 2019 Sandbox talk video here, link is here: https://myignite.techcommunity.microsoft.com/sessions/79739?source=sessions ] + +[!VIDEO https://www.microsoft.com/videoplayer/embed/***XXXXXX***] + + diff --git a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md deleted file mode 100644 index e189d94b3f..0000000000 --- a/windows/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ /dev/null @@ -1,372 +0,0 @@ ---- -title: Windows Sandbox overview -description: -ms.prod: w10 -audience: ITPro -author: dansimp -ms.author: dansimp -manager: dansimp -ms.collection: -ms.topic: article -ms.localizationpriority: -ms.date: -ms.reviewer: ---- - -# Windows Sandbox - -### Overview - -Windows Sandbox provides a lightweight desktop environment to safely run applications in isolation. Software that's installed inside the Windows Sandbox environment remains in the "sandboxed" and can't affect the host machine. A sandbox is temporary. When it's closed, all the software and files and the state are permanently deleted. You get a brand-new instance of the sandbox every time you open the application. - -Software and applications installed on the host aren't directly available in Windows Sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the environment. - -Windows Sandbox has the following properties: -- **Part of Windows**: Everything required for this feature is included in Windows 10 Pro and Enterprise. There's no need to download a VHD. -- **Pristine**: Every time Windows Sandbox runs, it's as clean as a brand-new installation of Windows. -- **Disposable**: Nothing persists on the device. Everything is discarded when the user closes the application. -- **Secure**: Uses hardware-based virtualization for kernel isolation. It relies on the Microsoft hypervisor to run a separate kernel that isolates Windows Sandbox from the host. -- **Efficient:** Uses the integrated kernel scheduler, smart memory management, and virtual GPU. - -The following video provides an overview of Windows Sandbox. - -[embed Ignite 2019 Sandbox talk video here, link is here: https://myignite.techcommunity.microsoft.com/sessions/79739?source=sessions ] - -[!VIDEO https://www.microsoft.com/videoplayer/embed/***XXXXXX***] - - -## Architecture - -### Dynamically generated image - -At its core, Windows Sandbox is a lightweight virtual machine, so it needs an operating system image to boot from. Instead of giving the sandbox a separate copy of Windows to boot from, our Dynamic Base Image technology lets us use the copy of Windows that's already installed on the host. - -Most OS files are immutable and can be freely shared with Windows Sandbox. A small portion of the OS files are mutable and we can't be shared. Windows Sandbox contains pristine copies of these files. A complete Windows image can be constructed from a combination of the sharable immutable files on the host and the pristine copies of mutable files. By using this scheme, Windows Sandbox has a full Windows installation to boot from without needing to download or store an additional copy of Windows. - -Before Windows Sandbox is installed, the dynamic base image is stored in a compressed 25-MB package. Once it's installed, the dynamic base package occupies about 500 MB of disk space. - -![A chart compares scale of dynamic image of files and links with the host file system.](images/1-dynamic-host.png) - -### Memory management - -For traditional virtual machines (VMs), a portion of host memory is dedicated for exclusive use by the VM. If the host later comes under resource pressure, it can't use the memory that was dedicated to the VM. Nor can it provide more memory, if available, to the VM. Windows Sandbox treats memory more like how memory is allocated to applications. All apps on the machine can request the amount of memory that they need. The amount that they get will be a function of what other apps are running and how much memory they need. And the amount of memory available for use by an application can change over time. - -### Dynamic working set - -When using a VM, the user is effectively partitioning their machine. If the host is under memory pressure, it can't use the memory already allocated to the VM. But applications in the sandbox are treated as equal to apps running on the host, so when apps in sandbox are under memory pressure, you can give more memory to the sandbox (and the same applies to the host). Guest physical pages provided are virtualized. - -![A chart compares memory sharing in Windows Sandbox versus a traditional VM.](images/2-dynamic-working.png) - -### Memory sharing - -Because Windows Sandbox runs the same operating system image as the host, it has been enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as "direct map." For example, when *ntdll.dll* is loaded into memory in the sandbox, it uses the same executable pages as those of the binary when loaded on the host. Memory sharing between the host and sandbox results in a smaller memory footprint when compared to traditional VMs without compromising valuable host secrets. - -![A chart compares the memory footprint in Windows Sandbox versus a traditional VM.](images/3-memory-sharing.png) - -### Integrated kernel scheduler - -With ordinary virtual machines, the Microsoft hypervisor controls the scheduling of the virtual processors running in the VMs. Windows Sandbox uses a new technology called "integrated scheduling," which allows the host scheduler to decide when the sandbox gets CPU cycles. - -![A chart compares the scheduling in Windows Sandbox versus a traditional VM.](images/4-integrated-kernal.png) - -Windows Sandbox employs a unique scheduling policy that allows the virtual processors of the sandbox to be scheduled in the same way as threads would be scheduled for a process. High-priority tasks on the host can preempt less important work in the sandbox. The benefit of the integrated scheduler is that the host manages Windows Sandbox as a process rather than a virtual machine, which results in a much more responsive host, similar to Linux KVM. - -The goal is to treat Windows Sandbox like an app but with the security guarantees of a virtual machine. - -### Snapshot and clone - -As we noted earlier, Windows Sandbox uses the Microsoft hypervisor. It essentially runs another copy of Windows that needs to be booted, and this can take some time. Rather than paying the full cost of booting the Windows Sandbox operating system every time Sandbox starts, two other technologies are utilized: *snapshot* and *clone.* - -*Snapshot* allows us to boot the Windows Sandbox environment once and preserve the memory, CPU, and device state to disk. Then we can restore the Sandbox environment from disk and put it in memory, rather than booting it when we need a new instance of Sandbox. By cloning the in-memory snapshot of Windows Sandbox, start time is significantly improved. - -### WDDM GPU virtualization - -Hardware-accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intense or media-heavy uses. But virtual machines are isolated from their hosts and can't access advanced devices like GPUs. The role of graphics virtualization technologies is to bridge this gap and provide hardware acceleration in virtualized environments. - -Microsoft is working with its graphics ecosystem partners to integrate modern graphics virtualization capabilities directly into DirectX and Windows Display Driver Model (WDDM), the driver model that's used for Windows. - -![A chart illustrates graphics kernal use in Sandbox managed alongside apps on the host.](images/5-wddm-gpu-virtualization.png) - -At a high level, this form of graphics virtualization works as follows: - -- Apps running in a Hyper-V VM use graphics APIs as normal. -- Graphics components in the VM, which have been enlightened to support virtualization, coordinate across the VM boundary with the host to execute graphics workloads. -- The host allocates and schedules graphics resources among apps in the VM alongside the apps that are running natively. Conceptually, they behave as one pool of graphics clients. - -This process is illustrated here: - -![A chart illustrates graphics resource use on the host and guest.](images/6-wddm-gpu-virtualization-2.png) - -This enables the Windows Sandbox VM to benefit from hardware-accelerated rendering, with Windows dynamically allocating graphics resources where they're needed across the host and guest. The result is improved performance and responsiveness for apps running in Windows Sandbox, as well as improved battery life for graphics-heavy uses. - -To take advantage of these benefits, a system with a compatible GPU and graphics drivers (WDDM 2.5 or newer) is required. Incompatible systems will render apps in Windows Sandbox with the Microsoft CPU-based rendering technology, Windows Advanced Rasterization Platform (WARP). - -### Battery pass-through - -Windows Sandbox is also aware of the host's battery state, which allows it to optimize power consumption. This is critical for a technology that's used on laptops, where battery life is often critical. - -## Install Windows Sandbox - -### Prerequisites - -- Windows 10 Pro or Enterprise build 18305 or later (*Windows Sandbox is currently not supported on Home SKUs*) -- AMD64 architecture -- Virtualization capabilities enabled in BIOS -- At least 4 GB of RAM (8 GB recommended) -- At least 1 GB of free disk space (SSD recommended) -- At least two CPU cores (four cores with hyperthreading recommended) - -### Installation - -1. Make sure your machine is using Windows 10 Pro or Enterprise build version 18305 or later. -2. Enable virtualization on the machine. - - - If you're using a physical machine, make sure virtualization capabilities are enabled in the BIOS. - - If you're using a virtual machine, run the following PowerShell command to enable nested virtualization:
**Set -VMProcessor -VMName \ -ExposeVirtualizationExtensions $true** -1. Use the search bar on the task bar and type **Turn Windows Features on and off**. Select **Windows Sandbox** and then **OK**. Restart the computer if you're prompted. - - - If the **Windows Sandbox** option is unavailable, your computer doesn't meet the requirements to run Windows Sandbox. If you think this is incorrect, review the prerequisite list as well as steps 1 and 2. -1. Locate and select **Windows Sandbox** on the Start menu to run it for the first time. - -### Usage -1. Copy an executable file (and any other files needed to run the application) from the host into the Windows Sandbox window. -2. Run the executable file or installer inside the sandbox. -3. When you're finished experimenting, close the sandbox. A dialog box will state that all sandbox content will be discarded and permanently deleted. Select **ok**. -4. Confirm that your host machine doesn't exhibit any of the modifications that you made in Windows Sandbox. - -## Use a .wsb file to configure Windows Sandbox - -Windows Sandbox supports simple configuration files (that have a .wsb file extension), which provide a minimal set of customization parameters for Sandbox. This feature can be used with Windows 10 build 18342 or later. - -Windows Sandbox configuration files are formatted as XML and are associated with Sandbox via the .wsb file extension. To use a configuration file, double-click it to open it in the sandbox. You can also invoke it via the command line as shown here:
- **C:\Temp> MyConfigFile.wsb** - - A configuration file enables the user to control the following aspects of Windows Sandbox: -- **vGPU (virtualized GPU)** -
Enable or disable the virtualized GPU. If vGPU is disabled, the sandbox will use WARP (software rasterizer). -- **Networking** -
Enable or disable network access within the sandbox. -- **Mapped folders** -
Share folders from the host with *read* or *write* permissions. Note that exposing host directories may allow malicious software to affect the system or steal data. -- **Logon command** -
A command that's executed when Windows Sandbox starts. -- **Audio input** -
Shares the host's microphone input into the andbox. -- **Video input** - - Shares the host's webcam input into the sandbox. -- **Protected client** - - Places increased security settings on the RDP session to the sandbox. -- **Printer redirection** - - Shares printers from the host into the sandbox. -- **Clipboard redirection** - - Shares the host clipboard with the sandbox so that text and files can be pasted back and forth. -- **Memory in MB** -
The amount of memory, in megabytes, to assign to the sandbox. - -### Keywords, values, and limits - -**vGPU**: Enables or disables GPU sharing. - -`value` - -Supported values: -- *Enable*: Enables vGPU support in the sandbox. -- *Disable*: Disables vGPU support in the sandbox. If this value is set, the sandbox will use software rendering, which can be slower than virtualized GPU. -- *Default* This is the default value for vGPU support. Currently this means vGPU is disabled. - -> [!NOTE] -> Enabling virtualized GPU can potentially increase the attack surface of the sandbox. - -**Networking**: Enables or disables networking in the sandbox. You can disable network access to decrease the attack surface exposed by the sandbox. - -`value` - -Supported values: -- *Disable*: Disables networking in the sandbox. -- *Default*: This is the default value for networking support. This value enables networking by creating a virtual switch on the host and connects the sandbox to it via a virtual NIC. - -> [!NOTE] -> Enabling networking can expose untrusted applications to the internal network. - -**MappedFolders**: Wraps a list of MappedFolder objects. - -`` - list of MappedFolder objects -`` - -> [!NOTE] -> Files and folders mapped in from the host can be compromised by apps in the sandbox or potentially affect the host. - -**MappedFolder**: Specifies a single folder on the host machine that will be shared on the container desktop. Apps in the sandbox are run under the user account *WDAGUtilityAccount*. If no sandbox path is specified, a folder is mapped to the following path:
`C:\Users\WDAGUtilityAccount\Desktop` - -Example: "C:\Test" will be mapped as "C:\users\WDAGUtilityAccount\Desktop\Test by default. - -``` - - path to the host folder - path to the sandbox folder - value - -``` - -*HostFolder*: Specifies the folder on the host machine to share to the sandbox. Note that the folder must already exist on the host, or the container will fail to start if the folder isn't found. - -*SandboxFolder*: Specifies the destination in the Sandbox to map the folder to. If the folder doesn't exist, it will be created. - -*ReadOnly*: If *true*, enforces *read-only* access to the shared folder from within the container. Supported values: *true*/*false*. Defaults to *false*. - -> [!NOTE] -> Files and folders mapped in from the host can be compromised by apps in the sandbox or potentially affect the host. - -**LogonCommand**: Specifies a single command that will be invoked automatically after the sandbox logs on. - -``` - - command to be invoked - -``` - -*Command*: A path to an executable or script inside the container that will be executed after login. - -> [!NOTE] -> Although very simple commands work (such as launching an executable or script), more-complicated scenarios that have multiple steps should be placed in a script file. This script file can be mapped to the container via a shared folder and then executed via the *LogonCommand* directive. - -**Example 1** - -The following config file can be used to easily test downloaded files inside the sandbox. To do this, the script disables networking and vGPU and restricts the shared downloads folder to *read-only* access in the container. For convenience, the logon command opens the downloads folder inside the container when it's started. - -*Downloads.wsb* - -``` - - Disable - Disable - - - C:\Users\Public\Downloads - true - - - - explorer.exe C:\users\WDAGUtilityAccount\Desktop\Downloads - - -``` - -**Example 2** - -The following config file installs Visual Studio Code in the sandbox, which requires a slightly more complicated LogonCommand setup. - -Two folders are mapped into the sandbox. The first folder (SandboxScripts) contains VSCodeInstall.cmd, which installs and runs Visual Studio Code. The second folder (CodingProjects) is assumed to contain project files that the developer wants to modify by using Visual Studio Code. - -With the Visual Studio Code installer script already mapped into the sandbox, the LogonCommand can reference it. - -*VSCodeInstall.cmd* - -``` -REM Download Visual Studio Code -curl -L "https://update.code.visualstudio.com/latest/win32-x64-user/stable" --output C:\users\WDAGUtilityAccount\Desktop\vscode.exe - -REM Install and run Visual Studio Code -C:\users\WDAGUtilityAccount\Desktop\vscode.exe /verysilent /suppressmsgboxes -``` - -VSCode.wsb - -``` - - - - C:\SandboxScripts - true - - - C:\CodingProjects - false - - - - C:\users\wdagutilityaccount\desktop\SandboxScripts\VSCodeInstall.cmd - - -``` - -**AudioInput** - -Enables or disables audio input to the sandbox. - -`value` - -Supported values: -- *Enable*: Enables audio input in the sandbox. If this value is set, the sandbox will be able to receive audio input from the user. Applications that use a microphone may need this setting. -- *Disable*: Disables audio input in the sandbox. If this value is set, the sandbox can't receive audio input from the user. Applications that use a microphone may not function properly with this setting. -- *Default*: This is the default value for audio input support. Currently this means audio input is enabled. - -**VideoInput** - -Enables or disables video input to the sandbox. - -`value` - -Supported values: -- *Enable*: Enables video input in the sandbox. -- *Disable*: Disables video input in the sandbox. Applications that use video input may not function properly in the sandbox. -- *Default*: This is the default value for video input support. Currently this means video input is disabled. Applications that use video input may not function properly in the sandbox. - -**ProtectedClient** - -Implements increased-security settings on the sandbox RDP session. These settings decrease the attack surface of the sandbox. - -`value` - -Supported values: -- *Enable*: Runs Windows Sandbox in Protected Client mode. If this value is set, the sandbox runs with extra security mitigations enabled. -- *Disable*: Runs the sandbox in standard mode without extra security mitigations. -- *Default*: This is the default value for Protected Client mode. Currently, this means the sandbox doesn't run in Protected Client mode. - -> [!NOTE] -> This setting may restrict the user's ability to copy/paste files in and out of the sandbox. - -**PrinterRedirection** - -Enables or disables printer sharing from the host into the sandbox. - -`value` - -Supported values: -- *Enable*: Enables sharing of host printers into the sandbox. -- *Disable*: Disables printer redirection in the sandbox. If this value is set, the sandbox can't view printers from the host. -- *Default*: This is the default value for printer redirection support. Currently this means printer redirection is disabled. - -**ClipboardRedirection** - -Enables or disables clipboard sharing with the sandbox. - -`value` - -Supported values: -- *Disable*: Disables clipboard redirection in Sandbox. If this value is set, copy/paste in and out of Sandbox will be restricted. -- *Default*: This is the default value for clipboard redirection. Currently copy/paste between the host and Sandbox are permitted under *Default*. - -**MemoryInMB** - -Specifies the amount of memory that the sandbox can use in megabytes (MB). - -`value` - -Supported values: An integer greater than 2048 (2GB). - - \ No newline at end of file From 6e44b1ceeaa361418598092e71d8f3c853dd28e7 Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Tue, 10 Mar 2020 12:07:41 -0700 Subject: [PATCH 10/30] move video info to comment for now --- .../windows-sandbox/windows-sandbox-overview.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md index 78e6c8e2f4..64064931a0 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -28,6 +28,8 @@ Windows Sandbox has the following properties: - **Secure**: Uses hardware-based virtualization for kernel isolation. It relies on the Microsoft hypervisor to run a separate kernel that isolates Windows Sandbox from the host. - **Efficient:** Uses the integrated kernel scheduler, smart memory management, and virtual GPU. + +## Prerequisites + +- Windows 10 Pro or Enterprise build 18305 or later (*Windows Sandbox is currently not supported on Home SKUs*) +- AMD64 architecture +- Virtualization capabilities enabled in BIOS +- At least 4 GB of RAM (8 GB recommended) +- At least 1 GB of free disk space (SSD recommended) +- At least two CPU cores (four cores with hyperthreading recommended) + +## Installation + +1. Make sure your machine is using Windows 10 Pro or Enterprise build version 18305 or later. +2. Enable virtualization on the machine. + + - If you're using a physical machine, make sure virtualization capabilities are enabled in the BIOS. + - If you're using a virtual machine, run the following PowerShell command to enable nested virtualization:
**Set -VMProcessor -VMName \ -ExposeVirtualizationExtensions $true** +1. Use the search bar on the task bar and type **Turn Windows Features on and off**. Select **Windows Sandbox** and then **OK**. Restart the computer if you're prompted. + + - If the **Windows Sandbox** option is unavailable, your computer doesn't meet the requirements to run Windows Sandbox. If you think this is incorrect, review the prerequisite list as well as steps 1 and 2. +1. Locate and select **Windows Sandbox** on the Start menu to run it for the first time. + +## Usage +1. Copy an executable file (and any other files needed to run the application) from the host into the Windows Sandbox window. +2. Run the executable file or installer inside the sandbox. +3. When you're finished experimenting, close the sandbox. A dialog box will state that all sandbox content will be discarded and permanently deleted. Select **ok**. +4. Confirm that your host machine doesn't exhibit any of the modifications that you made in Windows Sandbox. From 5319a2c896426a8cdd91d6fff7369417527a7249 Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Wed, 11 Mar 2020 22:06:44 -0700 Subject: [PATCH 13/30] tweak video link --- .../windows-sandbox/windows-sandbox-overview.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md index e78dc5e9c7..89e0690f30 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -30,7 +30,8 @@ Windows Sandbox has the following properties: The following video provides an overview of Windows Sandbox. -[!VIDEO https://www.microsoft.com/videoplayer/embed/RE4rFAo] +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE2CyhW] + ## Prerequisites From f471df4550d866511053c9f4aa99e97b2d7d2d99 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 12 Mar 2020 06:26:42 -0700 Subject: [PATCH 14/30] Update TOC.md fixed casing for Windows Sandbox --- windows/security/threat-protection/TOC.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index ab883f207f..08013e1a74 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -607,9 +607,9 @@ #### [SmartScreen Group Policy and mobile device management (MDM) settings](windows-defender-smartscreen/windows-defender-smartscreen-available-settings.md) #### [Set up and use SmartScreen on individual devices](windows-defender-smartscreen/windows-defender-smartscreen-set-individual-device.md) -### [Windows sandbox](windows-sandbox/windows-sandbox-overview.md) -#### [Windows sandbox architecture](windows-sandbox/windows-sandbox-architecture.md) -#### [Windows sandbox configuration](windows-sandbox/windows-sandbox-configure-using-wsb-file.md) +### [Windows Sandbox](windows-sandbox/windows-sandbox-overview.md) +#### [Windows Sandbox architecture](windows-sandbox/windows-sandbox-architecture.md) +#### [Windows Sandbox configuration](windows-sandbox/windows-sandbox-configure-using-wsb-file.md) ### [Windows Defender Device Guard: virtualization-based security and WDAC](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) From 3d91ce3d27149c4990b068c94e59d3914d03bac2 Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Thu, 12 Mar 2020 12:29:41 -0700 Subject: [PATCH 15/30] fix vid --- .../windows-sandbox/windows-sandbox-overview.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md index 89e0690f30..2f5eefeaf0 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -30,8 +30,7 @@ Windows Sandbox has the following properties: The following video provides an overview of Windows Sandbox. -> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE2CyhW] - +> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4rFAo] ## Prerequisites From 3c04fbfa3d69e7b503b080e084a381834311dfc8 Mon Sep 17 00:00:00 2001 From: jborsecnik Date: Thu, 12 Mar 2020 16:55:16 -0700 Subject: [PATCH 16/30] updates per M doc --- .../windows-sandbox-architecture.md | 48 ++--- ...indows-sandbox-configure-using-wsb-file.md | 172 +++++++++--------- .../windows-sandbox-overview.md | 2 +- 3 files changed, 99 insertions(+), 123 deletions(-) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md index 202de62262..693bd37571 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md @@ -15,71 +15,47 @@ ms.reviewer: # Windows Sandbox architecture -This article describes the Windows Sandbox basics. +Windows Sandbox benefits from new container technology in Windows in order to achieve a combination of security, density, and performance that is not available in traditional VMs. ## Dynamically generated image -At its core, Windows Sandbox is a lightweight virtual machine, so it needs an operating system image to boot from. Instead of giving the sandbox a separate copy of Windows to boot from, our Dynamic Base Image technology lets us use the copy of Windows that's already installed on the host. +Containers requires an operating system image to boot from. Rather than providing a separate copy of Windows to boot from, Dynamic Base Image technology leverages the copy of Windows that's already installed on the host. -Most OS files are immutable and can be freely shared with Windows Sandbox. A small portion of the OS files are mutable and we can't be shared. Windows Sandbox contains pristine copies of these files. A complete Windows image can be constructed from a combination of the sharable immutable files on the host and the pristine copies of mutable files. By using this scheme, Windows Sandbox has a full Windows installation to boot from without needing to download or store an additional copy of Windows. +Most OS files are immutable and can be freely shared with Windows Sandbox. A small portion of the OS files are mutable and we can't be shared. But the container base image contains pristine copies of these files. A complete Windows image can be constructed from a combination of the sharable immutable files on the host and the pristine copies of mutable files. By using this scheme, Windows Sandbox has a full Windows installation to boot from without needing to download or store an additional copy of Windows. -Before Windows Sandbox is installed, the dynamic base image is stored in a compressed 25-MB package. Once it's installed, the dynamic base package occupies about 500 MB of disk space. +Before Windows Sandbox is installed, the dynamic base image package is stored as a compressed 30-MB package. Once it's installed, the dynamic base image occupies about 500 MB of disk space. ![A chart compares scale of dynamic image of files and links with the host file system.](images/1-dynamic-host.png) ## Memory management -For traditional virtual machines (VMs), a portion of host memory is dedicated for exclusive use by the VM. If the host later comes under resource pressure, it can't use the memory that was dedicated to the VM. Nor can it provide more memory, if available, to the VM. Windows Sandbox treats memory more like how memory is allocated to applications. All apps on the machine can request the amount of memory that they need. The amount that they get will be a function of what other apps are running and how much memory they need. And the amount of memory available for use by an application can change over time. - -## Dynamic working set - -When using a VM, the user is effectively partitioning their machine. If the host is under memory pressure, it can't use the memory already allocated to the VM. But applications in the sandbox are treated as equal to apps running on the host, so when apps in sandbox are under memory pressure, you can give more memory to the sandbox (and the same applies to the host). Guest physical pages provided are virtualized. +Traditional VM's apportion statically sized allocations of host memory. When resource needs change, classic VM's have limited mechanisms for adjusting their resource needs. On the other hand, containers collaborate with the host in order to dynamically determine how host resources are allocated. This is similar to how processes normally compete for memory on the host. If the host is under memory pressure, it is able to reclaim memory from the container much like it would with a process. ![A chart compares memory sharing in Windows Sandbox versus a traditional VM.](images/2-dynamic-working.png) ## Memory sharing -Because Windows Sandbox runs the same operating system image as the host, it has been enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as "direct map." For example, when *ntdll.dll* is loaded into memory in the sandbox, it uses the same executable pages as those of the binary when loaded on the host. Memory sharing between the host and sandbox results in a smaller memory footprint when compared to traditional VMs without compromising valuable host secrets. +Because Windows Sandbox runs the same operating system image as the host, it has been enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as "direct map." For example, when *ntdll.dll* is loaded into memory in the sandbox, it uses the same physical pages as those of the binary when loaded on the host. Memory sharing between the host and sandbox results in a smaller memory footprint when compared to traditional VMs without compromising valuable host secrets. ![A chart compares the memory footprint in Windows Sandbox versus a traditional VM.](images/3-memory-sharing.png) ## Integrated kernel scheduler -With ordinary virtual machines, the Microsoft hypervisor controls the scheduling of the virtual processors running in the VMs. Windows Sandbox uses a new technology called "integrated scheduling," which allows the host scheduler to decide when the sandbox gets CPU cycles. +With ordinary virtual machines, the Microsoft hypervisor controls the scheduling of the virtual processors running in the VMs. Windows Sandbox uses new technology called "integrated scheduling," which allows the host scheduler to decide when the sandbox gets CPU cycles. ![A chart compares the scheduling in Windows Sandbox versus a traditional VM.](images/4-integrated-kernal.png) -Windows Sandbox employs a unique scheduling policy that allows the virtual processors of the sandbox to be scheduled in the same way as threads would be scheduled for a process. High-priority tasks on the host can preempt less important work in the sandbox. The benefit of the integrated scheduler is that the host manages Windows Sandbox as a process rather than a virtual machine, which results in a much more responsive host, similar to Linux KVM. - -The goal is to treat Windows Sandbox like an app but with the security guarantees of a virtual machine. - -## Snapshot and clone - -As we noted earlier, Windows Sandbox uses the Microsoft hypervisor. It essentially runs another copy of Windows that needs to be booted, and this can take some time. Rather than paying the full cost of booting the Windows Sandbox operating system every time Sandbox starts, two other technologies are utilized: *snapshot* and *clone.* - -*Snapshot* allows us to boot the Windows Sandbox environment once and preserve the memory, CPU, and device state to disk. Then we can restore the Sandbox environment from disk and put it in memory, rather than booting it when we need a new instance of Sandbox. By cloning the in-memory snapshot of Windows Sandbox, start time is significantly improved. +Windows Sandbox employs a unique policy that allows the virtual processors of the Sandbox to be scheduled like host threads. Under this scheme, high-priority tasks on the host can preempt less important work in the Sandbox. This means that the most important work will be prioritized, whether it is on the host or in the container. ## WDDM GPU virtualization -Hardware-accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intense or media-heavy uses. But virtual machines are isolated from their hosts and can't access advanced devices like GPUs. The role of graphics virtualization technologies is to bridge this gap and provide hardware acceleration in virtualized environments. - -Microsoft is working with its graphics ecosystem partners to integrate modern graphics virtualization capabilities directly into DirectX and Windows Display Driver Model (WDDM), the driver model that's used for Windows. +Hardware accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intensive use cases. Microsoft has worked with its graphics ecosystem partners to integrate modern graphics virtualization capabilities directly into DirectX and WDDM, the driver model used by display drivers on Windows. + +This allows programs running inside of the Sandbox to compete for GPU resources with applications running on the host. ![A chart illustrates graphics kernel use in Sandbox managed alongside apps on the host.](images/5-wddm-gpu-virtualization.png) -At a high level, this form of graphics virtualization works as follows: - -- Apps running in a Hyper-V VM use graphics APIs as normal. -- Graphics components in the VM, which have been enlightened to support virtualization, coordinate across the VM boundary with the host to execute graphics workloads. -- The host allocates and schedules graphics resources among apps in the VM alongside the apps that are running natively. Conceptually, they behave as one pool of graphics clients. - -This process is illustrated here: - -![A chart illustrates graphics resource use on the host and guest.](images/6-wddm-gpu-virtualization-2.png) - -This enables the Windows Sandbox VM to benefit from hardware-accelerated rendering, with Windows dynamically allocating graphics resources where they're needed across the host and guest. The result is improved performance and responsiveness for apps running in Windows Sandbox, as well as improved battery life for graphics-heavy uses. - -To take advantage of these benefits, a system with a compatible GPU and graphics drivers (WDDM 2.5 or newer) is required. Incompatible systems will render apps in Windows Sandbox with the Microsoft CPU-based rendering technology, Windows Advanced Rasterization Platform (WARP). +To take advantage of these benefits, a system with a compatible GPU and graphics drivers (WDDM 2.5 or newer) is required. Incompatible systems will render apps in Windows Sandbox with Microsoft's CPU-based rendering technology (WARP). ## Battery pass-through diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md index 20b66df936..ba2f4e2d3d 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md @@ -15,7 +15,7 @@ ms.reviewer: # Use a .wsb file to configure Windows Sandbox -Windows Sandbox supports simple configuration files (that have a .wsb file extension), which provide a minimal set of customization parameters for Sandbox. This feature can be used with Windows 10 build 18342 or later. +Windows Sandbox supports simple configuration files, which provide a minimal set of customization parameters for Sandbox. This feature can be used with Windows 10 build 18342 or later. Windows Sandbox configuration files are formatted as XML and are associated with Sandbox via the .wsb file extension. To use a configuration file, double-click it to open it in the sandbox. You can also invoke it via the command line as shown here: @@ -25,7 +25,7 @@ Windows Sandbox configuration files are formatted as XML and are associated with - **vGPU (virtualized GPU)**: Enable or disable the virtualized GPU. If vGPU is disabled, the sandbox will use WARP (software rasterizer). - **Networking**: Enable or disable network access within the sandbox. - **Mapped folders**: Share folders from the host with *read* or *write* permissions. Note that exposing host directories may allow malicious software to affect the system or steal data. -- **Logon command**: A command that's executed when Windows Sandbox starts. +- **Logon command**: A command that's executed when Windows Sandbox starts. - **Audio input**: Shares the host's microphone input into the sandbox. - **Video input**: Shares the host's webcam input into the sandbox. - **Protected client**: Places increased security settings on the RDP session to the sandbox. @@ -58,37 +58,33 @@ Supported values: > [!NOTE] > Enabling networking can expose untrusted applications to the internal network. -**MappedFolders**: Wraps a list of MappedFolder objects. +**Mapped Folders**: An array of folders, each representing a location on the host machine which will be shared into the sandbox at the specified path. If no path is specified, the folder will be mapped to the container user's desktop. `` - list of MappedFolder objects + list of MappedFolder objects + path to the host folder + path to the sandbox folder + value + + + ... + + `` -> [!NOTE] -> Files and folders mapped in from the host can be compromised by apps in the sandbox or potentially affect the host. - -**MappedFolder**: Specifies a single folder on the host machine that will be shared on the container desktop. Apps in the sandbox are run under the user account *WDAGUtilityAccount*. If no sandbox path is specified, a folder is mapped to the following path:
`C:\Users\WDAGUtilityAccount\Desktop` - -Example: "C:\Test" will be mapped as "C:\users\WDAGUtilityAccount\Desktop\Test by default. - -``` - - path to the host folder - path to the sandbox folder - value - ``` -*HostFolder*: Specifies the folder on the host machine to share to the sandbox. The folder must already exist on the host, or the container will fail to start if the folder isn't found. +*HostFolder*: Specifies the folder on the host machine to share into the sandbox. Note that the folder must already exist on the host or the container will fail to start. -*SandboxFolder*: Specifies the destination in the Sandbox to map the folder to. If the folder doesn't exist, it will be created. +*SandboxFolder*: Specifies the destination in the sandbox to map the folder to. If the folder does not exist, it will be created. If no sandbox folder is specified, the folder will be mapped to the container desktop. + +*ReadOnly*: If *true*, enforces read-only access to the shared folder from within the container. Supported values: true/false. Defaults to false. -*ReadOnly*: If *true*, enforces *read-only* access to the shared folder from within the container. Supported values: *true*/*false*. Defaults to *false*. > [!NOTE] > Files and folders mapped in from the host can be compromised by apps in the sandbox or potentially affect the host. -**LogonCommand**: Specifies a single command that will be invoked automatically after the sandbox logs on. +**Logon Command**: Specifies a single command which will be invoked automatically after the sandbox logs on. Apps in the sandbox are run under the container user account. ``` @@ -99,11 +95,69 @@ Example: "C:\Test" will be mapped as "C:\users\WDAGUtilityAccount\Desktop\Test b *Command*: A path to an executable or script inside the container that will be executed after login. > [!NOTE] -> Although very simple commands work (such as launching an executable or script), more-complicated scenarios that have multiple steps should be placed in a script file. This script file can be mapped to the container via a shared folder and then executed via the *LogonCommand* directive. +> Although very simple commands will work (launching an executable or script), more complicated scenarios involving multiple steps should be placed into a script file. This script file may be mapped into the container via a shared folder, and then executed via the *LogonCommand* directive. -***Example 1*** +**AudioInput**: Enables or disables audio input to the sandbox. -The following config file can be used to easily test downloaded files inside the sandbox. To do this, the script disables networking and vGPU and restricts the shared downloads folder to *read-only* access in the container. For convenience, the logon command opens the downloads folder inside the container when it's started. +`value` + +Supported values: +- *Enable*: Enables audio input in the sandbox. If this value is set, the sandbox will be able to receive audio input from the user. Applications that use a microphone may need this setting. +- *Disable*: Disables audio input in the sandbox. If this value is set, the sandbox can't receive audio input from the user. Applications that use a microphone may not function properly with this setting. +- *Default*: This is the default value for audio input support. Currently this means audio input is enabled. + +> [!NOTE] +> There may be security implications of exposing host audio input to the container. + +**VideoInput**: Enables or disables video input to the sandbox. + +`value` + +Supported values: +- *Enable*: Enables video input in the sandbox. +- *Disable*: Disables video input in the sandbox. Applications that use video input may not function properly in the sandbox. +- *Default*: This is the default value for video input support. Currently this means video input is disabled. Applications that use video input may not function properly in the sandbox. + +> [!NOTE] +> There may be security implications of exposing host video input to the container. + +**Protected Client**: Implements increased-security settings on the sandbox RDP session. These settings decrease the attack surface of the sandbox. + +`value` + +Supported values: +- *Enable*: Runs Windows sandbox in Protected Client mode. If this value is set, the sandbox runs with extra security mitigations enabled. +- *Disable*: Runs the sandbox in standard mode without extra security mitigations. +- *Default*: This is the default value for Protected Client mode. Currently, this means the sandbox doesn't run in Protected Client mode. + +> [!NOTE] +> This setting may restrict the user's ability to copy/paste files in and out of the sandbox. + +**Printer Redirection**: Enables or disables printer sharing from the host into the sandbox. + +`value` + +Supported values: +- *Enable*: Enables sharing of host printers into the sandbox. +- *Disable*: Disables printer redirection in the sandbox. If this value is set, the sandbox can't view printers from the host. +- *Default*: This is the default value for printer redirection support. Currently this means printer redirection is disabled. + +**ClipboardRedirection**: Enables or disables sharing of the host clipboard with the sandbox. + +`value` + +Supported values: +- *Disable*: Disables clipboard redirection in the sandbox. If this value is set, copy/paste in and out of the sandbox will be restricted. +- *Default*: This is the default value for clipboard redirection. Currently copy/paste between the host and sandbox are permitted under *Default*. + +**MemoryInMB**: Specifies the amount of memory that the sandbox can use in megabytes (MB). + +`value` + +If the memory value specified is insufficient to boot a sandbox, it will be automatically increased to the required minimum amount. + +***Example 1*** +The following config file can be used to easily test downloaded files inside of the sandbox. To achieve this, the script disables networking and vGPU, and restricts the shared downloads folder to read-only access in the container. For convenience, the logon command opens the downloads folder inside of the container when it is started. *Downloads.wsb* @@ -114,34 +168,33 @@ The following config file can be used to easily test downloaded files inside the C:\Users\Public\Downloads + C:\Users\WDAGUtilityAccount\Downloads true - explorer.exe C:\users\WDAGUtilityAccount\Desktop\Downloads + explorer.exe C:\users\WDAGUtilityAccount\Downloads - + ``` - ***Example 2*** - The following config file installs Visual Studio Code in the sandbox, which requires a slightly more complicated LogonCommand setup. -Two folders are mapped into the sandbox. The first folder (SandboxScripts) contains VSCodeInstall.cmd, which installs and runs Visual Studio Code. The second folder (CodingProjects) is assumed to contain project files that the developer wants to modify by using Visual Studio Code. +Two folders are mapped into the sandbox; the first (SandboxScripts) contains VSCodeInstall.cmd, which will install and run VSCode. The second folder (CodingProjects) is assumed to contain project files that the developer wants to modify using VSCode. -With the Visual Studio Code installer script already mapped into the sandbox, the LogonCommand can reference it. +With the VSCode installer script already mapped into the sandbox, the LogonCommand can reference it. *VSCodeInstall.cmd* ``` -REM Download Visual Studio Code +REM Download VSCode curl -L "https://update.code.visualstudio.com/latest/win32-x64-user/stable" --output C:\users\WDAGUtilityAccount\Desktop\vscode.exe -REM Install and run Visual Studio Code +REM Install and run VSCode C:\users\WDAGUtilityAccount\Desktop\vscode.exe /verysilent /suppressmsgboxes ``` -VSCode.wsb +8VSCode.wsb* ``` @@ -161,59 +214,6 @@ VSCode.wsb ``` -**AudioInput**: Enables or disables audio input to the sandbox. - -`value` - -Supported values: -- *Enable*: Enables audio input in the sandbox. If this value is set, the sandbox will be able to receive audio input from the user. Applications that use a microphone may need this setting. -- *Disable*: Disables audio input in the sandbox. If this value is set, the sandbox can't receive audio input from the user. Applications that use a microphone may not function properly with this setting. -- *Default*: This is the default value for audio input support. Currently this means audio input is enabled. - -**VideoInput**: Enables or disables video input to the sandbox. - -`value` - -Supported values: -- *Enable*: Enables video input in the sandbox. -- *Disable*: Disables video input in the sandbox. Applications that use video input may not function properly in the sandbox. -- *Default*: This is the default value for video input support. Currently this means video input is disabled. Applications that use video input may not function properly in the sandbox. - -**ProtectedClient**: Implements increased-security settings on the sandbox RDP session. These settings decrease the attack surface of the sandbox. - -`value` - -Supported values: -- *Enable*: Runs Windows Sandbox in Protected Client mode. If this value is set, the sandbox runs with extra security mitigations enabled. -- *Disable*: Runs the sandbox in standard mode without extra security mitigations. -- *Default*: This is the default value for Protected Client mode. Currently, this means the sandbox doesn't run in Protected Client mode. - -> [!NOTE] -> This setting may restrict the user's ability to copy/paste files in and out of the sandbox. - -**PrinterRedirection**: Enables or disables printer sharing from the host into the sandbox. - -`value` - -Supported values: -- *Enable*: Enables sharing of host printers into the sandbox. -- *Disable*: Disables printer redirection in the sandbox. If this value is set, the sandbox can't view printers from the host. -- *Default*: This is the default value for printer redirection support. Currently this means printer redirection is disabled. - -**ClipboardRedirection**: Enables or disables clipboard sharing with the sandbox. - -`value` - -Supported values: -- *Disable*: Disables clipboard redirection in Sandbox. If this value is set, copy/paste in and out of Sandbox will be restricted. -- *Default*: This is the default value for clipboard redirection. Currently copy/paste between the host and Sandbox are permitted under *Default*. - -**MemoryInMB**: Specifies the amount of memory that the sandbox can use in megabytes (MB). - -`value` - -Supported values: An integer greater than 2048 (2 GB). - \ No newline at end of file From d6125fc24ff2a273ca9c2452d7307c50e06d161b Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik Date: Tue, 24 Mar 2020 17:19:08 -0700 Subject: [PATCH 26/30] add missing hyphen --- .../windows-sandbox/windows-sandbox-architecture.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md index 83a96c0261..db22ee475a 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md @@ -23,7 +23,7 @@ Rather than requiring a separate copy of Windows to boot the sandbox, Dynamic Ba Most OS files are immutable and can be freely shared with Windows Sandbox. A small subset of operating system files are mutable and cannot be shared, so the sandbox base image contains pristine copies of them. A complete Windows image can be constructed from a combination of the sharable immutable files on the host and the pristine copies of the mutable files. By using this scheme, Windows Sandbox has a full Windows installation to boot from without needing to download or store an additional copy of Windows. -Before Windows Sandbox is installed, the dynamic base image package is stored as a compressed 30MB package. Once it's installed, the dynamic base image occupies about 500 MB of disk space. +Before Windows Sandbox is installed, the dynamic base image package is stored as a compressed 30-MB package. Once it's installed, the dynamic base image occupies about 500 MB of disk space. ![A chart compares scale of dynamic image of files and links with the host file system.](images/1-dynamic-host.png) From 65508ab743cf5f01d6fa73d6fc1f8be463ec44e6 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik Date: Wed, 25 Mar 2020 11:34:25 -0700 Subject: [PATCH 27/30] small CELA changes via Margarit --- .../threat-protection/windows-sandbox/windows-sandbox-pbozza | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-pbozza b/windows/security/threat-protection/windows-sandbox/windows-sandbox-pbozza index 4ce7a64eb1..fa85062872 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-pbozza +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-pbozza @@ -15,9 +15,9 @@ ms.reviewer: # Windows Sandbox -Windows Sandbox provides a lightweight desktop environment to safely run applications in isolation. Software installed inside the Windows Sandbox environment remains "sandboxed" and can't affect the host machine. +Windows Sandbox provides a lightweight desktop environment to safely run applications in isolation. Software installed inside the Windows Sandbox environment remains "sandboxed" and runs separately from the host machine. -A sandbox is temporary. When it's closed, all the software and files and the state are permanently deleted. You get a brand-new instance of the sandbox every time you open the application. +A sandbox is temporary. When it's closed, all the software and files and the state are deleted. You get a brand-new instance of the sandbox every time you open the application. Software and applications installed on the host aren't directly available in the sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the environment. From 7a0590e747ac12c36768a4c4c16f64de08a53d6c Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik Date: Wed, 25 Mar 2020 15:17:42 -0700 Subject: [PATCH 28/30] update file name to match TOC --- .../{windows-sandbox-pbozza => windows-sandbox-overview} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename windows/security/threat-protection/windows-sandbox/{windows-sandbox-pbozza => windows-sandbox-overview} (100%) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-pbozza b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview similarity index 100% rename from windows/security/threat-protection/windows-sandbox/windows-sandbox-pbozza rename to windows/security/threat-protection/windows-sandbox/windows-sandbox-overview From aaad6c1bb4d3bdf1d19a6127a6dee52ecd53a9f3 Mon Sep 17 00:00:00 2001 From: Jeff Borsecnik Date: Wed, 25 Mar 2020 15:34:15 -0700 Subject: [PATCH 29/30] add file name extension to overview article --- .../{windows-sandbox-overview => windows-sandbox-overview.md} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename windows/security/threat-protection/windows-sandbox/{windows-sandbox-overview => windows-sandbox-overview.md} (100%) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md similarity index 100% rename from windows/security/threat-protection/windows-sandbox/windows-sandbox-overview rename to windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md From 00bb5bf330170c0baa40fa86d61b64ff1eb66394 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 27 Mar 2020 13:55:32 -0700 Subject: [PATCH 30/30] Added content types to code blocks --- .../windows-sandbox-configure-using-wsb-file.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md index 583fc49a5d..2ac125c33b 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md @@ -60,7 +60,7 @@ Supported values: **Mapped folders**: An array of folders, each representing a location on the host machine that will be shared into the sandbox at the specified path. At this time, relative paths are not supported. If no path is specified, the folder will be mapped to the container user's desktop. -``` +```xml absolute path to the host folder @@ -85,7 +85,7 @@ Supported values: **Logon command**: Specifies a single command that will be invoked automatically after the sandbox logs on. Apps in the sandbox are run under the container user account. -``` +```xml command to be invoked @@ -160,7 +160,7 @@ The following config file can be used to easily test downloaded files inside the *Downloads.wsb* -``` +```xml Disable Disable @@ -176,6 +176,7 @@ The following config file can be used to easily test downloaded files inside the ``` + ***Example 2*** The following config file installs Visual Studio Code in the sandbox, which requires a slightly more complicated LogonCommand setup. @@ -186,7 +187,7 @@ With the Visual Studio Code installer script already mapped into the sandbox, th *VSCodeInstall.cmd* -``` +```console REM Download Visual Studio Code curl -L "https://update.code.visualstudio.com/latest/win32-x64-user/stable" --output C:\users\WDAGUtilityAccount\Desktop\vscode.exe @@ -196,7 +197,7 @@ C:\users\WDAGUtilityAccount\Desktop\vscode.exe /verysilent /suppressmsgboxes *VSCode.wsb* -``` +```xml