From 7fbd7f1f6a70c97dba805ac62f2070b5d660aa5e Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 28 Feb 2018 15:56:05 -0800 Subject: [PATCH] split up steps topic --- .../change-history-for-threat-protection.md | 4 +- ...rd-enable-virtualization-based-security.md | 12 +++--- ...-on-the-device-guard-deployment-process.md | 35 ++++++------------ windows/security/threat-protection/index.md | 2 +- ...s-defender-application-control-policies.md | 2 +- .../windows-defender-exploit-guard/TOC.md | 2 +- .../turn-windows-features-on-or-off.png | Bin 0 -> 66484 bytes .../memory-integrity.md | 14 +------ ...tion-based-protection-of-code-integrity.md | 2 - 9 files changed, 25 insertions(+), 48 deletions(-) create mode 100644 windows/security/threat-protection/windows-defender-exploit-guard/images/turn-windows-features-on-or-off.png diff --git a/windows/security/threat-protection/change-history-for-threat-protection.md b/windows/security/threat-protection/change-history-for-threat-protection.md index c3e8151acd..fb567d6989 100644 --- a/windows/security/threat-protection/change-history-for-threat-protection.md +++ b/windows/security/threat-protection/change-history-for-threat-protection.md @@ -21,12 +21,12 @@ New or changed topic | Description ## January 2018 |New or changed topic |Description | |---------------------|------------| -|[Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md)|New topic. WDAC replaces cofigurable code integrity policies. | +|[Windows Defender Application Control](windows-defender-exploit-guardwindows-defender-application-control/windows-defender-application-control.md)|New topic. WDAC replaces cofigurable code integrity policies. | ## November 2017 |New or changed topic |Description | |---------------------|------------| -| [How to enable virtualization-based protection of code integrity](enable-virtualization-based-protection-of-code-integrity.md)| New. Explains how to enable HVCI. | +| [How to enable virtualization-based protection of code integrity](windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md)| New. Explains how to enable HVCI. | ## October 2017 diff --git a/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security.md b/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security.md index ab3baf28eb..019674779a 100644 --- a/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security.md +++ b/windows/security/threat-protection/device-guard/deploy-device-guard-enable-virtualization-based-security.md @@ -24,7 +24,7 @@ Use the following procedure to enable virtualization-based protection of code in 1. **Decide whether to use the procedures in this topic, or to use the Windows Defender Device Guard readiness tool**. To enable HVCI, you can use [the Device Guard and Credential Guard hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or follow the procedures in this topic. -2. **Verify that hardware and firmware requirements are met**. Verify that your client computers have the hardware and firmware to run HVCI. For a list of requirements, see [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). +2. **Verify that hardware and firmware requirements are met**. Verify that your client computers have the hardware and firmware to run HVCI. For a list of requirements, see [Requirements and deployment planning guidelines for virtualization-based protection of code integrity](./windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md). 3. **Enable the necessary Windows features**. You can use the [hardware readiness tool](https://www.microsoft.com/en-us/download/details.aspx?id=53337) or see [Windows feature requirements for virtualization-based security](#windows-feature-requirements-for-virtualization-based-protection-of-code-integrity). @@ -70,7 +70,7 @@ If you don't want to use the [hardware readiness tool](https://www.microsoft.com 5. Select the **Enabled** button. For **Select Platform Security Level**: - **Secure Boot** provides as much protection as a computer’s hardware can support. If the computer does not have input/output memory management units (IOMMUs), enable **Secure Boot**. - - **Secure Boot with DMA** enables Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can have WDAC enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by WDAC, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats). + - **Secure Boot with DMA** enables Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can have WDAC enabled. For **Virtualization Based Protection of Code Integrity**: @@ -90,10 +90,8 @@ If you don't want to use the [hardware readiness tool](https://www.microsoft.com Set the following registry keys to enable HVCI. This provides exactly the same set of configuration options provided by Group Policy. - - > [!IMPORTANT] -> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations, we recommend that you choose **Secure Boot**. This option provides Secure Boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have Secure Boot with DMA protection. A computer without IOMMUs will simply have Secure Boot enabled.
In contrast, with **Secure Boot with DMA**, the setting will enable Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can still have WDAC enabled.
For information about how VBS uses the hypervisor to strengthen protections provided by WDAC, see [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats).
+> - Among the commands that follow, you can choose settings for **Secure Boot** and **Secure Boot with DMA**. In most situations, we recommend that you choose **Secure Boot**. This option provides Secure Boot with as much protection as is supported by a given computer’s hardware. A computer with input/output memory management units (IOMMUs) will have Secure Boot with DMA protection. A computer without IOMMUs will simply have Secure Boot enabled.
In contrast, with **Secure Boot with DMA**, the setting will enable Secure Boot—and VBS itself—only on a computer that supports DMA, that is, a computer with IOMMUs. With this setting, any computer without IOMMUs will not have VBS or HVCI protection, although it can still have WDAC enabled.
> - All drivers on the system must be compatible with virtualization-based protection of code integrity; otherwise, your system may fail. We recommend that you enable these features on a group of test computers before you enable them on users' computers. #### For Windows 1607 and above @@ -196,7 +194,9 @@ reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "Unlocked" /t REG Windows 10 and Windows Server 2016 have a WMI class for related properties and features: *Win32\_DeviceGuard*. This class can be queried from an elevated Windows PowerShell session by using the following command: -` Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard` +```powershell +Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard +``` > [!NOTE] > The *Win32\_DeviceGuard* WMI class is only available on the Enterprise edition of Windows 10. diff --git a/windows/security/threat-protection/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md b/windows/security/threat-protection/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md index b2c2cb7926..400eeb9b69 100644 --- a/windows/security/threat-protection/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md +++ b/windows/security/threat-protection/device-guard/planning-and-getting-started-on-the-device-guard-deployment-process.md @@ -19,7 +19,7 @@ This topic provides a roadmap for planning and getting started on the Windows De ## Planning -1. **Review requirements, especially hardware requirements for VBS**. Review the virtualization-based security (VBS) features described in [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats). Then you can assess your end-user systems to see how many support the VBS features you are interested in, as described in [Hardware, firmware, and software requirements for Windows Defender Device Guard](requirements-and-deployment-planning-guidelines-for-device-guard.md#hardware-firmware-and-software-requirements-for-windows-defender-device-guard). +1. **Review requirements, especially hardware requirements for VBS**. Review the virtualization-based security (VBS) features described in [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats). Then you can assess your end-user systems to see how many support the VBS features you are interested in, as described in [Requirements and deployment planning guidelines for virtualization-based protection of code integrity](requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md). 2. **Group devices by degree of control needed**. Group devices according to the table in [Windows Defender Device Guard deployment in different scenarios: types of devices](requirements-and-deployment-planning-guidelines-for-device-guard.md#windows-defender-device-guard-deployment-in-different-scenarios-types-of-devices). Do most devices fit neatly into a few categories, or are they scattered across all categories? Are users allowed to install any application or must they choose from a list? Are users allowed to use their own peripheral devices?
Deployment is simpler if everything is locked down in the same way, but meeting individual departments’ needs, and working with a wide variety of devices, may require a more complicated and flexible deployment. @@ -33,46 +33,35 @@ This topic provides a roadmap for planning and getting started on the Windows De - Is there already a list of accepted applications?
A list of accepted applications can be used to help create a baseline WDAC policy.
As of Windows 10, version 1703, it might also be useful to have a list of plug-ins, add-ins, or modules that you want to allow only in a specific app (such as a line-of-business app). Similarly, it might be useful to have a list of plug-ins, add-ins, or modules that you want to block in a specific app (such as a browser). - As part of a threat review process, have you reviewed systems for software that can load arbitrary DLLs or run code or scripts? - In day-to-day operations, your organization’s security policy may allow certain applications, code, or scripts to run on your systems depending on their role and the context. However, if your security policy requires that you run only trusted applications, code, and scripts on your systems, you may decide to lock these systems down securely with Windows Defender Application Control policies. You can also fine-tune your control by using Windows Defender Application Control in combination with AppLocker, as described in [Windows Defender Device Guard with AppLocker](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#windows-defender-device-guard-with-applocker). + In day-to-day operations, your organization’s security policy may allow certain applications, code, or scripts to run on your systems depending on their role and the context. However, if your security policy requires that you run only trusted applications, code, and scripts on your systems, you may decide to lock these systems down securely with Windows Defender Application Control policies. You can also fine-tune your control by using Windows Defender Application Control in combination with AppLocker, as described in [Windows Defender Device Guard with AppLocker](./windows-defender-application-control/windows-defender-application-control-and-applocker.md). Legitimate applications from trusted vendors provide valid functionality. However, an attacker could also potentially use that same functionality to run malicious executable code that could bypass WDAC. For operational scenarios that require elevated security, certain applications with known Code Integrity bypasses may represent a security risk if you whitelist them in your WDAC policies. Other applications where older versions of the application had vulnerabilities also represent a risk. Therefore, you may want to deny or block such applications from your WDAC policies. For applications with vulnerabilities, once the vulnerabilities are fixed you can create a rule that only allows the fixed or newer versions of that application. The decision to allow or block applications depends on the context and on how the reference system is being used. - Security professionals collaborate with Microsoft continuously to help protect customers. With the help of their valuable reports, Microsoft has identified a list of known applications that an attacker could potentially use to bypass Windows Defender Application Control. Depending on the context, you may want to block these applications. To view this list of applications and for use case examples, such as disabling msbuild.exe, see [Deploy Windows Defender Application Control: steps](steps-to-deploy-windows-defender-application-control.md). + Security professionals collaborate with Microsoft continuously to help protect customers. With the help of their valuable reports, Microsoft has identified a list of known applications that an attacker could potentially use to bypass Windows Defender Application Control. Depending on the context, you may want to block these applications. To view this list of applications and for use case examples, such as disabling msbuild.exe, see [Microsoft recommended block list](./windows-defender-application-control/microsoft-recommended-block-rules.md). - - - - - -4. **Identify LOB applications that are currently unsigned**. Although requiring signed code (through WDAC) protects against many threats, your organization might use unsigned LOB applications, for which the process of signing might be difficult. You might also have applications that are signed, but you want to add a secondary signature to them. If so, identify these applications, because you will need to create a catalog file for them. For a basic description of catalog files, see the table in [Introduction to Windows Defender Device Guard: virtualization-based security and Windows Defender Application Control](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md). For more background information about catalog files, see [Reviewing your applications: application signing and catalog files](requirements-and-deployment-planning-guidelines-for-device-guard.md#reviewing-your-applications-application-signing-and-catalog-files). +4. **Identify LOB applications that are currently unsigned**. Although requiring signed code (through WDAC) protects against many threats, your organization might use unsigned LOB applications, for which the process of signing might be difficult. You might also have applications that are signed, but you want to add a secondary signature to them. If so, identify these applications, because you will need to create a catalog file for them. For more background information about catalog files, see [Deploy catalog files to support WDAC](./windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md). ## Getting started on the deployment process -1. **Optionally, create a signing certificate for Windows Defender Application Control**. As you deploy WDAC, you might need to sign catalog files or WDAC policies internally. To do this, you will either need a publicly issued code signing certificate (that you purchase) or an internal CA. If you choose to use an internal CA, you will need to create a code signing certificate. For more information, see [Optional: Create a code signing certificate for Windows Defender Application Control](optional-create-a-code-signing-certificate-for-windows-defender-application-control.md). +1. **Optionally, create a signing certificate for Windows Defender Application Control**. As you deploy WDAC, you might need to sign catalog files or WDAC policies internally. To do this, you will either need a publicly issued code signing certificate (that you purchase) or an internal CA. If you choose to use an internal CA, you will need to create a code signing certificate. For more information, see [Optional: Create a code signing certificate for Windows Defender Application Control](./windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md). -2. **Create WDAC policies from “golden” computers**. When you have identified departments or roles that use distinctive or partly-distinctive sets of hardware and software, you can set up “golden” computers containing that software and hardware. In this respect, creating and managing WDAC policies to align with the needs of roles or departments can be similar to managing corporate images. From each “golden” computer, you can create a WDAC policy, and decide how to manage that policy. You can merge WDAC policies to create a broader policy or a master policy, or you can manage and deploy each policy individually. For more information, see: - - [Deploy Windows Defender Application Control: policy rules and file rules](deploy-windows-defender-application-control-policy-rules-and-file-rules.md) - - [Deploy Windows Defender Application Control: steps](steps-to-deploy-windows-defender-application-control.md)
+2. **Create WDAC policies from “golden” reference computers**. When you have identified departments or roles that use distinctive or partly-distinctive sets of hardware and software, you can set up “golden” computers containing that software and hardware. In this respect, creating and managing WDAC policies to align with the needs of roles or departments can be similar to managing corporate images. From each “golden” computer, you can create a WDAC policy, and decide how to manage that policy. You can merge WDAC policies to create a broader policy or a master policy, or you can manage and deploy each policy individually. + +3. **Audit the WDAC policy and capture information about applications that are outside the policy**. We recommend that you use “audit mode” to carefully test each WDAC policy before you enforce it. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. Later, you can expand the policy to allow these applications, as needed. For more information, see [Audit Windows Defender Application Control policies](./windows-defender-application-control/audit-windows-defender-application-control-policies.md). -3. **Audit the WDAC policy and capture information about applications that are outside the policy**. We recommend that you use “audit mode” to carefully test each WDAC policy before you enforce it. With audit mode, no application is blocked—the policy just logs an event whenever an application outside the policy is started. Later, you can expand the policy to allow these applications, as needed. For more information, see [Audit Windows Defender Application Control policies](steps-to-deploy-windows-defender-application-control.md#audit-windows-defender-application-control-policies). +4. **Create a “catalog file” for unsigned LOB applications**. Use the Package Inspector tool to create and sign a catalog file for your unsigned LOB applications. For more information, review step 4 **Identify LOB applications that are currently unsigned**, earlier in this list, and see [Deploy catalog files to support Windows Defender Application Control](./windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md). In later steps, you can merge the catalog file's signature into your WDAC policy, so that applications in the catalog will be allowed by the policy. -4. **Create a “catalog file” for unsigned LOB applications**. Use the Package Inspector tool to create and sign a catalog file for your unsigned LOB applications. For more information, review step 4 **Identify LOB applications that are currently unsigned**, earlier in this list, and see [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md). In later steps, you can merge the catalog file's signature into your WDAC policy, so that applications in the catalog will be allowed by the policy. - -6. **Capture needed policy information from the event log, and merge information into the existing policy as needed**. After a WDAC policy has been running for a time in audit mode, the event log will contain information about applications that are outside the policy. To expand the policy so that it allows for these applications, use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy. You can merge WDAC policies from other sources also, for flexibility in how you create your final WDAC policies. For more information, see: - - [Create a Windows Defender Application Control policy that captures audit information from the event log](steps-to-deploy-windows-defender-application-control.md#create-a-windows-defender-application-control-policy-that-captures-audit-information-from-the-event-log) - - [Merge Windows Defender Application Control policies](steps-to-deploy-windows-defender-application-control.md#merge-windows-defender-application-control-policies)
+6. **Capture needed policy information from the event log, and merge information into the existing policy as needed**. After a WDAC policy has been running for a time in audit mode, the event log will contain information about applications that are outside the policy. To expand the policy so that it allows for these applications, use Windows PowerShell commands to capture the needed policy information from the event log, and then merge that information into the existing policy. You can merge WDAC policies from other sources also, for flexibility in how you create your final WDAC policies. For more information, see [Merge Windows Defender Application Control policies](./windows-defender-application-control/merge-windows-defender-application-control-policies.md). 7. **Deploy WDAC policies and catalog files**. After you confirm that you have completed all the preceding steps, you can begin deploying catalog files and taking WDAC policies out of auditing mode. We strongly recommend that you begin this process with a test group of users. This provides a final quality-control validation before you deploy the catalog files and WDAC policies more broadly. For more information, see: - - [Enforce Windows Defender Application Control policies](steps-to-deploy-windows-defender-application-control.md#enforce-windows-defender-application-control-policies) - - [Deploy and manage Windows Defender Application Control with Group Policy](steps-to-deploy-windows-defender-application-control.md#deploy-and-manage-windows-defender-application-control-with-group-policy)
+ - [Enforce Windows Defender Application Control policies](./windows-defender-application-control/enforce-windows-defender-application-control-policies.ms) + - [Deploy and manage Windows Defender Application Control with Group Policy](./windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy)
8. **Enable desired virtualization-based security (VBS) features**. Hardware-based security features—also called virtualization-based security (VBS) features—strengthen the protections offered by Windows Defender Application Control, as described in [How Windows Defender Device Guard features help protect against threats](introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md#how-windows-defender-device-guard-features-help-protect-against-threats). > [!WARNING] > Virtualization-based protection of code integrity may be incompatible with some devices and applications. We strongly recommend testing this configuration in your lab before enabling virtualization-based protection of code integrity on production systems. Failure to do so may result in unexpected failures up to and including data loss or a blue screen error (also called a stop error). - For information about enabling VBS features, see [Enable virtualization-based protection of code integrity](deploy-device-guard-enable-virtualization-based-security.md). -
diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 5f49f4f7ef..f2c623bd85 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -20,7 +20,7 @@ Learn more about how to help protect against threats in Windows 10 and Windows |[Windows Defender Antivirus in Windows 10](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)|Provides info about Windows Defender Antivirus, a built-in antimalware solution that helps provide security and antimalware management for desktops, portable computers, and servers. Includes a list of system requirements and new features.| |[Windows Defender Application Guard](windows-defender-application-guard/wd-app-guard-overview.md)|Provides info about Windows Defender Application Guard, the hardware-based virtualization solution that helps to isolate a device and operating system from an untrusted browser session.| |[Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md)|Explains how Windows Defender Application Control restricts the applications that users are allowed to run and the code that runs in the System Core (kernel).| -|[Enable HVCI](enable-virtualization-based-protection-of-code-integrity.md)|Explains how to enable HVCI to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code.| +|[Enable HVCI](windows-defender-exploit-guard/enable-virtualization-based-protection-of-code-integrity.md)|Explains how to enable HVCI to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code.| |[Windows Defender Smart​Screen](windows-defender-smartscreen/windows-defender-smartscreen-overview.md) |Learn more about Windows Defender SmartScreen.| |[Mitigate threats by using Windows 10 security features](overview-of-threat-mitigations-in-windows-10.md) |Learn more about mitigating threats in Windows 10.| |[Override Process Mitigation Options to help enforce app-related security policies](override-mitigation-options-for-app-related-security-policies.md) |Use Group Policy to override individual **Process Mitigation Options** settings and help to enforce specific app-related security policies.| diff --git a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md index 1a2d83fabe..3e2928127b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md @@ -48,5 +48,5 @@ To merge two WDAC policies, complete the following steps in an elevated Windows ` ConvertFrom-CIPolicy $MergedCIPolicy $CIPolicyBin ` -Now that you have created a new WDAC policy, you can deploy the policy binary to systems manually or by using Group Policy or Microsoft client management solutions. For information about how to deploy this new policy with Group Policy, see [Deploy and manage Windows Defender Application Control with Group Policy](deploy-windows-defender-application-control-policies-using-group-policy). +Now that you have created a new WDAC policy, you can deploy the policy binary to systems manually or by using Group Policy or Microsoft client management solutions. For information about how to deploy this new policy with Group Policy, see [Deploy and manage Windows Defender Application Control with Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md). diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/TOC.md b/windows/security/threat-protection/windows-defender-exploit-guard/TOC.md index 30de9b3380..eedb76c8dc 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/TOC.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/TOC.md @@ -11,7 +11,7 @@ ### [Customize Exploit protection](customize-exploit-protection.md) #### [Import, export, and deploy Exploit protection configurations](import-export-exploit-protection-emet-xml.md) ### [Memory integrity](memory-integrity.md) -#### [Requirements and deployment planning guidelines for virtualization-based protection of code integrity](requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) +#### [Requirements for virtualization-based protection of code integrity](requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) #### [Enable virtualization-based protection of code integrity](enable-virtualization-based-protection-of-code-integrity.md) ## [Attack surface reduction](attack-surface-reduction-exploit-guard.md) ### [Evaluate Attack surface reduction](evaluate-attack-surface-reduction.md) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/images/turn-windows-features-on-or-off.png b/windows/security/threat-protection/windows-defender-exploit-guard/images/turn-windows-features-on-or-off.png new file mode 100644 index 0000000000000000000000000000000000000000..8d47a53b51927ab39dffa35831707ebea9469991 GIT binary patch literal 66484 zcmd42cT|&2^goEN1r-4+SSU6?X;Bam5Q3s2Ql-~KMT)c_p@$?dDx#vG(xi(h9YQg5 zh=>{>R4D-hi3lN(0D*)gK-$LlySrz9|LvYVd(P&ZImyhEXP!Iv&b@O#pPA={t+kot z-s5}4#Ka`cZ(X+&6Wg93Du;LP617Mx+QCF$+n{!4*Tky&(Ym9NziPB%d?sIqeC@Y$qi< zR8Xl^)Ut-XuLU!3TIKWS4@N}7iix>=+nPH1_eb?p@~E7Tmc!|PM3t|02VN}P^1B1w z{rA#IxxZ~7K6F>db%bIz1A|3Zy zuPRj_Fg_x4M%hFY+}>L$|F_@4Kr87435jEy9HHR(p2sn120MsIA;DqLU6US#l~>&l zN-1|nmA-j@XO_m8&&HE~ea3~7dvaWz#Ba+V*O9*vzVlCIL)9A%cVj>Q!`uFL*@s^b zxeUaddfEHKQuj_sXj0NYk{?Rck|CC zQ}rktmk4P0_uoNp<7lYL5kJmPpXI~#Zh=W!&i0KT{`pLN?yY*c%60(d@FdtRCUGik zI7rKoTb5(Y-#*d8F}J7vXHmb(qNk?dSxyg5b}rKwQSxmjT3`5w$zY*`X|Xi-hnq9f zU@iF(4~%AQ?2YSAm9M&9>%FXS`)pV^WMvNjdN`WTvIwP)*fR>GgWk2!+dboNRvGRP z3H&%L$VOY-fgOqDXhd(!m_3MKf6TTwY^wkzfSmPy`CjYnyG^MArMy@Jrorefrg_}8 z=p(DdH*}=1qEzWs2`{=+Qm;#+fq1ro*!*+dErwRv@V?(KxMexQwT5xim58z18rlD1 z>LiknN0$FY;fy#_YLx!mcUVPaZ=1wlomEc6RlQ9*pRre-DxiS{@vW3L`dbuo`F*zz zdaz?v5m@Wm{`v9DfN%7qiQ;dy#tN8bWH2w$Ok}|${zgnKASz*J zG_x-tbnTB)v|!VDWTRF!)q?Retvqy@+Pau|DP=LmQO&vJP1KWC_T&-P*3M0Fy1N>Q zPvkgWkOO^0cHhFe1lk@fJ&@V^3il@auY`UA!_dNlDp#88-p4alWB-nK)mF;%x?4ST zDjQI0v-Y$vVHUO5+a`R+;Q=^lQ1;t2$ctN-wt~~@fhRGm5<(XRuCJowY=XDn0>zs- zU($-4g^@E5=aorZ;;Sp`gVUk3tTg{zwBw^fk5GilyWo4^%&0zoVa8n^HWG9^>ei)GQn1qIdVF zU!0!1}&-Bfg_NRPZZ0nvd2#7|jB9Gblpabm2ne=tkXX6hGH3 z`MtZVpEIgIlV~0e9iidDddxE2FOE0YFNfbsO5aGzH;%dGp{suAwC~)j=%MFZ4kojMD(og&6K48~hNybSeKqN7`xRq52(Luu@(YWJHOg7=cG#_|M zF^a^U+fI*exUSc3gAi=L7%enZe1mRo_$4?&{_O1BwJDq4-8)=P{!SvP0CJ2M#!67G z9&aptu39-FEAI`yu}aW-batr>eO~{gJvb~oP+P-RsJ7Tl2qR=cHxn zzvJZ{wgHW%S!rs{=ATeD>1JEro1?EhV0_7GYX>J%SW1N}JdyW(IuZv5vXXBQ71A1} z;l-`Y{^1~`PKmO~+3Q!FxL zif8x6lLFV!Z-%U(A?*qc{7WC+Pb6t)Aqi^&;3&JR64ORQ{=YY{XzCaEw|X| z0@Q&^xxE{-Ly6ZuVTd75MkZzZT#sDZm2fE3tup$-bx9vX<+B&B93^U(Nl8EHWVyBnCF^9Z1J{~GqgJ{9G&X$;)!lFQk4IOPXXw&D^TH}AVR-9zu~PXz_l z;qN}XRKps0{Q%H9a_UwaYLe(MLN9cKswySij#wGqM}>O@BS-T#LVwW>3wr7=uTK*G zJ=_k;7`T2dEvPzVEC|Y-QQ-3JI_txOL5D1V1T`Hg4<{Lfi#(~snk}7Sb^KqD?a}=( zoue@Z@tFlO&L~h{37|L=%ukD&r}y*1=YP)#A@jnGskq(@43FHqhEg2hEt3R6^Ao=L zeXVOhPh>iS5K7ExdaMeRHy{X5X31i;>yX-c(a~E-9B&#gOztfea$odDVz@=F6pD}o z@NN&Cqh$hxOibU|6yZ>B`KYCqKU*m)=MnTvrlnRH=h0d1OwQ%3ZrH@!bB)9Uq9wNb z)!vjivJnt0IrKREJi`5KmIM80s(bK*+Peiy^@|1T+#`VE^mRghgGXtQbbB%=KYQ6S zX%27*R5fYo6IvAIe!GUIp;;c%6toXU8uTimlrw7^qi(l>jO;^6shJOM{y@Efep9>C zj?fPWmG~X6#h~f#bx9&Wul$I#(Se#g>{C6{)2t7IhwCy0R@quO=PIoyd1K6&IH36Y zplzKU^!4x2BaFgwq%tISfz)#XVx$J~Xgv)9MGvq0P=!?J=4%|Ir@W5w^RsK_=1@7K zFi}nEG@hK*ZY~INpPNMM*R|_3OsR9GBQaAkv><c)YsgJy@7R*+m!T#%rIoFMzy%CksZzqv z8#{OF=$wMpqOIEt^M>C!H_i1tIQx*KCLB``Z1s8+U#Zv5uO`6ubq$)l9<3;wI`rfR zQhvk~6f`knd{M)ARA4O|eyF_XVFU3Zx(eP==Bk5?^$1FVy+4BJb=ORLCz*1pZECCr z(q|;f?l0vF@+Nw>E$ocPAKjJxewShC;!a6DH8@$cRxEPW=H{J+Z?814#Tji!06l6b zk5n~Ce>V-%dLGr^-xDt(+q=rZ0lMR5^D`j)g))!)eCM^0G!M@vO@j8~YdzvQHRp;D z`Qi7jXr|Rom86pAv%NWYz;)qc-7Fy0^ubDV=M?K%T!!QMC_>^%#a_lH$Ueo;;;Aj^ zO1;Ssa%!OVudkH`fo4YM^$*`Fsh=pBT)D#qMK`c_d*m;k!TyeExq1lp=LTM9Oo>Vl zcn=&eyl*w})GY>Sp({Q1OG`&b*=w!wyVpf1zW`HTUHQ>`4}llMu3W^5Vvm^Q9$IYC z>hbTOz0V~_<*4p99&LhW9{HYUAe;S|H~F#mTr?|Nt@=?hi4`YYR3J^uQcd;y-%|3B zpgjIs@*E4ViF@sz82~A2vcf)>X9T>5SlHF^kx$LX(I(49l~?-!sJNjgS`Vud zvfteEq&e3Qr{2CzqJ&&=Pn_p8glTx4)d~!-V{Y_=cX>x$KK0_oo|+#;r~z%j!auBK zcWCn8#qRi>GUs2_*8VX{C&%Qa!W}We2CA9QJ)+1rqG!m87W1300;8-R%o?t|BbPgM zH~3oP!n?cLA~Bv$01-rSsz^VPUinUM9+crr!FQ9pJVgm$D2wV?*WZqqPXDr&m<*Rp z3{uT(iNAqZQ1c5uX6IfXweRKmcY#=K-QCzD(9Mq z4^N*7C}*0FgdemI-My}mqCf~XM7~h=4*jWXez5}@>k;wH5nDg`EZlpb*o|G8@}Hgb zKR+(Omv5^n@cFzoc1X=h-C0^I)N^NRxvF|qvjG5dhe;XDU|2YVQYP>|pv@orPIR+6U_^g(3N@h$`LD9Wy3GQ{B{I&x z*V05IO59c>%89a5sW7>!=0|B$FiIOEsbN|rfDTV+B_|oqE&3u$9_Mx02uHZ&e!|L| zF7(dmyM1lHNO%CABI}U;s>EcYXiwZ$Oy_3w38`>}k&NS-U}AodzgxzVhDLwa&_{Qz zxw&9w$cPS8EqwW|_U7F;NXfej&WV`-e8FvmxcVkfj#>TZ^yeRwZ`TnmmL+SjoP$_*`;)FW5euO1)!FzDszy3Ca+V*QVKMt7N_@c-O5 z#miA?+qoGmoP6Z;DS&6wIY3`uk2WPgO_9GqCod}Yz87n{zZu#T!?M~G2VOiWoSUYn zp(9B?!C53(krBiCW^^*MVfJk|^-M;!LOUhZMtC#^wOp2r1tN%tKLmfH8djC|ikA+D zmUyUW8(+^eegM;!T<@Q_ZE6@KT~PWx;(WUmDfN3o=j_dT&hU$w!R*Q6;y+cxX$K}e zN5acUc%xeEgHB%7)!~O$)Hh3p9}hX)yET^E@^m@}<8d?~hXjU0w^jpa>#X=SlVi>E zb?whCSzttnOa9BNYS>jDoK>YZetU)eyo;k9w>^CRFNN^6Otcuc9o~OpZ^9PiYxI#n zW0meIC{V0pKT!D5BfmvCayq=Bb&IicbBI)qs%1hMV=$sBYD)bVlDT){V4KY| zSe$=T)UtO|%yQXYgfp2z)>BHULB}7cb3GQ#o}f5fj=dV+M;TdXhA#f1&2Rc|&=%~J z*VCvEevbYrm7T~yFUEAn-O=|ehXp2_ZT31aTwau=AeTPeZSH=;;lZt+zOmJEskhE5 zUu?@ce*f+BeOVt4rp@&>#(1A1t-T`RdHp`GI#~X}x0TmfF%#~HxtwWj^(R!L`xm*0 zN5hMW%a^<#Xf5%xPBmcWC!2o@sI^*pPo9cQf%>m5w?E1ogrs zGu^aJ!tF+_0R=U*aNb2J=q}2&k~>!VclI~CA`&9d(j`Q%qcQQ@?x4y~=tT70 z17mtUMfxH^llN75s-Q3k*I>9PGZ!T-pHLWZTanE?F()P4Y5HU&5!%rD#`P31#^_8y zFjxtyx*L>-^weyN9tykV1=B#Q_<@o6dtcu7mtuXuw}g^!yS8m9Gh-cNA)jtH4f;Zu zAL4fu$s9kLo1STYL_N%4P(IPpvIMYshoywPS!9MA0his?H}XR14BylIoMCUOT9)ou z5UPAA)W!%)YB&8Bb47B>xUg|g)m~54lM}|aOWei%$6hCOeVR;Pb1FJmhf!6RU4h&- zQW(nZpQEERoY9s3laO-NqmG)hwLjWFy+N6 zzw(!Jdjs5f0%tIR9O(e5XL-`kW8`Bzr*9S4EXnT-XqqTNETaTHs4iR`sz(tyBf*$e z1gB$+-@fbWacz3^qcW7~KmD3^ylJ_fFjv_?3jX#-0?>L+*4LNZ0<^~cD96vGO;EgV z%;`pRUrYDQ_tEXaF*e=XrT2A7>P?+YkVZQ05{KAdg{HMqjDSjLJx3pi#U+zeTCU+ z$i9Li!`DL{w$d4Z@_&o3P4|%1=6Du>E;1gRF{)RYKB`xKkLBN_3k3M)8LJf|LT(a0 z8kHe!Yfk#Y9wuW7ok8|27sT!3dstfMZdFaeNNtQ|$Y=7;6B#&^fC>z!|7B{#{Oa#2 zd6>>rzgcmaf2}t^vXRxg-V>b(Uq0eGhOrF3Gqd{4QLhJD2f$7E3PJrCcCETS3KKG; zzuA#J&=VvP*)xW$z9Cqlw-?W|aa>}9wei-FbXNF(1fpA^_soS`dMa>eur&xCmnxDM>cO)jT@U#EJTQ*x{agJ%-q~?`@env`y;q7ODFhcmg#@BYnT61=zgjH5ckvn|23XIpz~nq zQ`gc`MfQKz8JYb<)+3jzv;#=IeiAOZADjxwi~eck1rOmH&MiY)9E~@s^4}x}#}rS+ z46AZ1xs|SUKdlb@H^2|)!_M*Yg#)O}yO&!+3VTVRDD|mzT~`;DO!vBm9_mFeIIUez zRB*DNgum))i|8-+JQvPqC@$W*^*?4ZIRqEj2yY9P3xukuidM6#w&m$}u82bT>FoMT ztdkoqR-z_N93a*#xP{%yqXhv0`5P+0*}OpMZ>Roh{8AiBgJ(w-4`sDWcky0B?4h3D z_wKsNKe;h(N%2_+x1UtY6OkH;M&n~{*Z=ohZi#my*+3zfu`FBFGc_q~Q3Q$4qWy8a zu)9ng?(Cyf8#3Apc0nr>dPhP~qgK|=f>lgc3mtS`xJKgP>UaDf{hV8)3sSCZl8_Es zM{ibnrjsc)xXBZwH^{~rL^ReDa*>HiLs$!j?I~nxEX z92o3g{Li1tI0v7A{mw?r@XcxPD>U!;_q&(pj1v|>19@-z6gS^h+%Y{(o-cTn7|P>d zvNW`f0uhXlFewwR1GmnFXCP(*8SFC;r)X~-@3gZr5C6(lG_LO7(V2(>zZI&4y9qJ? zaw!o0Z+#}ua3wY|cA0~`LDc2yMdQqsy|QvZZ2^VR(tObJue^}=TRv=Auu-So?p>5T zo__?gTyRZsw@m;-=&D!u_-joUEI$>DclJi6m0#0~b~;EMH;P#Lm=gjO3%iB}Ch~g! zF#!zA4=#YraS_I|3$`06LVrud3<;37Zqa5u4eYuBc%q8oq@@wkv2 zeqntc(r5~DjcABQMHI|eTU78TxZWw*#%sMwdX62^+rg?y{98#a-JwZBvh?&wC1YWL zNG)RVAT8mZsh&tngCz}FZ)B{S)cZwuZ>);3YOz$=j5a-;<)iQ~yM*mqvrZEeo3_Ev zEpm@i3681zo~^9OVj}DW6N&=a=$R^M9E&hkdLcT&15V)1eeF)1IR0Je9QI`0^UlnL z{re>)@^L;!2xq?%vCA z|L0YD!_(xCa!5vYt-heItpCx6;=e|o4;TA)g#rlyuNgn{=RMJbye;Q!sGj^`RGj^q zT2$nEs$=lg2&}iCbeC8sKY2)M6wsDX$cf*_=`ozP2s;;jc3p>43eH+lO3a!RN^b(B zfvJT@vVR$?nI$)w&wh+0V;udGj&EE$olVk|ZZS87pVw!k;Gp$43kUi6;#|yFEHwB|DHv|pXWxfQE ztAacaeBUy?tNSbM@fmqJ7OZ~zOm+E`io0%0_qsGWKnZoK^&FTBm6gI1PbUj=Y+}e+ zg}br}%1kzQA4w2B#>6ue{aCfb+cfun(RS_Hlw+=fU&l6`>F%1dhCrYB*tK!yC|U3xnW}U=E%;jyBt+yZcl4bG zFDA5ye>cs?Z=*R)z-+<3#dJNE)dZ#Gh;$X0B$yd)9_zz6X$Y6<7-sqU8sfj2REbuq zVavRAaq`Tr$Iihm*CS%*z23db>WTB(l=eDDH z0-&)5cuxe`IHY`OV{q5z2$r6Lj^`e8l5uS=Owq2jiJw0dw>(56d~pgI22@E;7yV&= z?FTqa(^PYyrP>TLapXDQ5wZJA%xE1SAZm3X)+@ig=_ z-!wXq>wKaa;I*1ABQB`DK6;Nm*}?Trl(LM=v$oJNGvbgC@24ABaRDc2qb|o50Ab)X z9sf!Uuh|IVGiU3vsWgFoh>ln&G1*f`4}V*=(e6;$!%HPm4!_ zaa@+04xewQuM#5fhfq1R#oKy!WqlEn&FBGQN4y+;S_HK{gp5nK6dMLZ@q`&%=^R|w z@$N6~Oa@@V;pY;z7&G}pkBC~KwAN_(^J{|VVgaAi@*jej4K4Kp%b{*}ibOe(73sGz z@VmFLrZ&a@8lNPbB;n{nOpv`DoYV`$c_F)mz9yIu#m^vl&n&oFfSf47|m$8(s9?b%ryTl0Cl@`P@z@o50f$q^0wY=Z1o9=p zF+1|W{WR2eu`rBu6*6JHZLHR+0Tj3MtIx|JwD$o81lR}hsYXla?1j`;h7U%B1 z-sgFVJ|Xqgl>ftQ=MnzSGnqlu@bW7a**eW;`fPO3<|Krsd~=29z?oJ_7S?aY(^0Y& zRHwtA9rngF1&Hgx7l=!`^DzdJyGkKtcNdEE$^rLgRS%bhHqfeR z=1JuM^DSJ8Ah8Yh@ElrGc!PL}UniC%<Cm_%nR3}W%k zROPscn=XC>qnf*tEiSlZK`ZWZ$8H8S^$8-DySq@Gg1E1DC|85|!Fe+0)Sydyah{|E z4O?p!W2EvIbz*69rYeQ!h01Uy#}1Ozm>-w6W_gG37)^-#6I^)#x@nat z2sV@qy@2WVuWIeYh;iNUEP~#6_|tf{$%U?f`s|>8rp)7N?I=ESX6})nbsmP9OmwmYC>n73Al0L9(t1+c3_VpvXBa;7g9c+h@wR(n= z4o%P6-8*)VK6c`t+@6vB`_Ka1KqeA_J`>r0*Z+``_CY7)048Eu@xuOfMwY=YgPVIEDs25W{Dx_K zfYR%2k*NYnre4)GaXeygrU2&ViUZ z2}+<79wde{CV*)1-?VFS&|N46oLUSVY?(9Iu}4@Q9W{_0N0Y=8?TRKGXx@f_4<9#= zIVuPG1e}+6jFyJCx7K-k?4KOg-1byHBcTuNz7kagC|g}~jJ_5Bs&5U_v!**@di^S=WltxIP(=An**4jUDF+wIvv%*zKps0P1!yeT4JW!B7Rrf*UE#}g#HR+ zOrMBMKdvJWmq7TyiVBfub)3#smPlOG zV#P=xo+Vb=GCk0u@vR1e4+CS}$Z2U={j66m_d*hniqMtK7D!%?reFc|iD6nIV%x6B zwGFUBALa*_EAw;oKEHaL6HJT2*)H&K9qUzJ7pV8ZW9o@52V%prHE(HyZvq;`@o=^g! zY00-uGR`bN)!pKFt-yrYh2k|R`l9YsC^deuT#Yz!q~)>n4#I_wtkHv@@2s<5N z`9XGUy@8x!lfLyh_D+&e;Oy-@@!?VVmG4Aq`$on@v_~{hZ(dj82B8oquwV=pV?4v;!PQRT_=w2FU6=|(pO#-#-+sm9 zgQ2t`G`3mXMo6Sy+3oXHikGA3c2fiRzs}aQbyge_EwpD0C^p|%xgzwfr6!QxkO4^i zh;mlILC*^#!+d9uRzs-^Ye{deKSPknV{%XzarNBeo!5-UE7qN&dBaVE9}J_SEF;V5 z&#+0Q`*l`>^;raw=Pm>_9X}B;Y#1D2|9L0o-xHprJE+Fy3j3b6uS*1%v9_XDt?uIQ0TikQd^L8Xb#HXhE{4;@T4r)jO)@3Jw}5A@dK=#;lm6&O z-d$FZ_sx27u*w{0z;LhGc)8O$hBS|rv9`!y}8t!4e!D(&& ziuH}osfSx-KP+|(VSvzG!qPE`Oe9bT0DLluQBJ*F`3q*GP_vwItf&X`HOhR zSkUg{)tFYB*C;xV6>jxT@mg7+!tqALZCakY%jK;NxGDS;_vxgb@Wzxa7RqcH&7dTY zuI}t58GJ=_;K2ENGq-X!p00S>$M^Xiq3ydw)*x{GK*usl_q;?5vYcE)s;F>BnqGs| zQRjOF8VR=&6iG0j7t81EodSSW^`jcuh3VSZr9wx1(FS0)gM+7gIwI2kQ^~~J|FN@HrvHB@YyZFDk1tb_R30$rb!vTHD;x}+>JwKr)ZEjbEweaQ8%{t+ zV{)KSD!w;-8+omzim599gspf6k$@hv+c2tc{BlJukARur|Ld$Bn9i3gVB0Hxmo|zp zvCbJkn;o(AMm~Eg_U@1!=5TL@v@vv0j#ow7CMvDBvHyBGY)2#)=uFx|8$r53cEGug z4x=;vs=_8#FhU~7P?LKo+glrWb!UIK04_cfm9k_MZkeQ%^6pA{YQl2La!1Y8Hn&GB zA;upyMI8qJPp2Owl7{YgP{fW8GC~^JYoFu{ix6GgJ1Oi*aHgRYWdK-Yyh8yTkmuhF z1rtzSRK&tq0ws&N1N z@HH>rY>Ov(`AJsk|6jR%PkE_7N|&uRr1pq*bu$bjV=*mJYW?lxkkF6O0JXnMtg=a#63LeX${%75k;+j z>gUrmQdb2nQ~!p$18^K|vUggGw&xoJoX3Xt(7oROVHSq!>$WVZb%*!bZPYpCHghgM zfF;T>^Cgt(m!rOEf*G?#O8(;ltqo7-$D{}ZezXyi_LL5r$ZxU3ekk&CDF10ZP%)Mx zdvg>E*oVR1rY+HHK=|C5L0pt@#w{$#rp+eoyu)yrW{gNGBp{Fy2hor+EM(sx|) z+J;2Pbr}LxGrWdz?fdw+am4wFQwcVs#JAt2U$SeyvB$Qw8`zH`<$rIRaBeh4FZ(yJ zc0PU==q!DdSEcrZ6pp46N#SWpSJBuKr`Pa2SB)!xy$)LwWqUE$)SpSPLJU?W@s*;F zuP;F>XR@Wcm6X(ZZ$PnsDTGiryIT5@Vk1wSsgE?959xrCcM0>d*)k|7dxZGPU{s50 zadi#qvr2GS%|kRb~MAA-7d zAM55mfwbU2__Oc*^`>{i#|Mz%5pq(ly6%JwOdCtsYoy-YxyeNa3sw5svpITDw`9?b z`LY&iZUh7@Pqq8657L|K{pOgx0hH)FKL(uYR$;wH=SDt}yb`bC<4s||%C<90e_=l2 zjTt2|@dirm44uW7;LL3H?aV&Mh_3WOiekFPyq=FyfA`uf*Bg2I)Qi4ss}_IK&sNtY z#c<%+&k-v#8f;lXW?0uFKR(;>^Y@yEfuxr@2x9#ox$fxI-1!t|sU?flwxrTbvfV)Q zl2+NJZxV&GWg6H}DgkRp!MYvW-Q*2&$AN^`bntsiIfkQM8QFH+_uPp+!4Oj*lqylt zogmKcMzHi*=KP6I?Up6ZbEwpt@ADSrXyHhUBYyuAdfsu@DF!2$fcmE^l-6{$yNiT~gY)Z28P;T<}9=qSxh- zq}z*W%rS`Xnf$s$PU~-uOPr5D!ToG=W5X|nTEvGEYO`Y)Qw7?=C~6DcNNwL-tY|9@ z)jFTAWhIj}0Pb}U-R*Ia_+nYD{98?_Hz|hT#`4~H-`T`ouR-_$bq^V|q4o?>U!QUo7`X@3Mri7uTzpKxY4dPAw5lN9JFd94V zd0a|jQeM^|BLey2Aw}9=@3IP*`*Le=2uU_}nhKuO<@m{f`!MDTda5`oAbUf;HD!calfP(tJ|Zzxv)Z6D^$j>8o^u!nXqx zKVm_bc?!_Uby!70nCs}<~ms?3=og|=NS(Aau|bMueI7Vs=pQH*>|trx$fYiQIzm)Zuq5r#s|i% zMkdX^=h#pS8%iQ8p;)DRF#zhW_G2U4^s^#~G~E?8>UZB3~4) zWOSfEse$1JC(7KR4F|21bH(hrp;wlQhJIkWvRpM;73HD&E7EZKAhh`E4_ZaL9IiA{ zF<_{_wm~8NQ}D-6Me8u9NRW&jW)SE)Rbeh%8dqfU@^gC#?jop!3|{I2`EINhvtJ6{ z>#x3#L26?ede^ET$ewZ}w_N0b)KLNR8@<^nw?S!i-4KPtS~s&`>HaL8Z0|aQjXgSnPKx`siqb#k=}h-#;hj|ogk0l$x-?c$`gQhKuI8g@ z7&Q^ff|adhB`Bn5!#I;Em9sqXjrHIXY4bY8W)B5BaNZaW#PrSg>5-QhRxpZE*QF)K zvADa0hn-05@cHqPW=PtX`Bn{b&gP*x<>>XdRK#Wx$4FUv5nQqIenE>Z3#CMoNWGz@ zzMg44Yiew7>rH5}F?q}tuAgpCFdi#rd4sR(-Px-SW&)hx+CGl&nxE_dx08_(szH#A zQ0yUgRL~^1bc*-2Zw=aK0Y7vREl6K)b|JByMf!*t*%GP6psn2}uOV$@%MitgaAN8c z^8Qnd6D2}t3l{ixp+7*hElTw&4m`176?)BD?(#|Tk&yet$`du5>YS{~LcLRM{hfwO z+kgf5V#K02>fR`4UcbUPc3GmAJE53rAG)-*(qs!;p2dzt?BbXPk(1iWEZ;Gn!_A?Y zUXNVZG75=@s5LR9&YebvqiA@pfv(Pq`;E%W5Yr|=r6@_IB5caQE>w$zww0;i6wO&H zDsJN*y6r~prT=mp=cdprye1xe45bmdGEz8a5TK3?^`F4TpqrOE-;-(lAO0xr}i;-?yX02;bLNw zuSwA+<%>Q9PzKv+?}xMaLmp@JI6K8YsH_@F`>B09HRu&+6H?i_DSDY_I!^Ro*iglP z04@DoR@#4uQW*cs`5Cd9{eR)xhyVMHU(U-ZWPHyOAsi+`pECd93lw{(Ho8s~;OP@^ zux!2Ok+=JLvmMiYCTB^H;Esbmvi=%CX_{0!ml9FB%&b2?9l4Z+NjA|QWy=3!Qf>>p3-R>fJ!v|PpJuq_Sf?{5_H}K(JvE$ARX2b#4z1;Co zo?vHn*nX)K5gthjAt~ZXx*N_YQF5CPnoypAQQym1C@V#)pO+@6#1X?+8kcMW)BAD- zKBF3hxLA38P03gyyEl4dC&qpwv;39TKZ7@RCrBDJAoJgY+p^d5y`;N_ZvL8SLUlV^ zm#h_;k>8>toccSd8Cw;-{R%1A#JugzgeKH-il_K`_q6MDt$Y{$?W`S}S>KwcpL~2A z>*Fd1gjVwTILg6)gRflWNese%0>P4_{WhUsurn*sJo&{o#Vx&tqW=4Vwj?KJd`{8CT}m+L4mi>R?}? z-c%xXUs}?W7R}S#7*QbF={ie%M$LtOlNZP1$`*HCSQWhZt#hWVmBBfGr$GCOTe5l7 zv9s(1`4k?rxUqG#J`JV_H?m|Kt<&_%@h!!;%MGMFfC!mc6#E+kM|oEz6~9q3=G#2%KOdgh-KFE-=IyKIv_j^z(z z5oCp1W$EW_hmFU!5To+kvL03X)b11^GsST}rw43*sOQ(Y8u@2%;Wv)oB*hEYQ!+GA zWYANuL^?GU;lQkeTxuqL{ex$RY;0%U+Zgm}nfq6SoQo)zj+9vEyxE>?bXb5Jjs0r$ z7gn`ZW_piQoAY}N{|8hFE`*{+$BZ@e2>~b}L4-$GKNc^-<9;V~z6;!V$@56DOOZ@N zC(|90M^<9V0Xm3r$*w{l%z8vX6F)ZWYoEU=Yo>7`?IF9Z?6Q=!kq;`-7TXJe{`u;~ z7@P;bqqk&?7CH~?X_@vNsjcFTa1{qJQ><*-U`dZ!gU#0B_F9V|_i@cpgk>0>^aF+W z4!N6Qpd7vP4Pd#4YdKS2$~h0R6rOgZ7bbCESP57WE$#25rr*YHPo5{5GHJG^<4wyA z8kngp+g&=rW+iR|E&rg?U^NLqv~ydA+oxU%?h)QFo&Us<<9m}06`mTT)@~ZMp?%Dy zR}1kzH#cY~zRiBRthh) zgO%G;61$%f+n{l z(_lC{EhsqGrzuZgMVYV!;IL*7{%<)lkl$BSn{YU-KQF4)>JUWw3gIKg#|bL-nvb9CTbPrE8a7$ zo-*yJnH#wKnw-b?Abk2cLm&!fKR&C?Zy+b6=MEI{z9ES{irj;y6YvTOe}v~F=-pga z+p=6Y9Uq80u9|1hT5@kX6>E5#?tTcU=nl(a#GV?okv+_fi61 z-)xIvipV1vkkdHH6+`zGZG5qUk)b=uE$jn?hj)fFY^ax&eGpoorbc2(t(#n6HFWRt zxa-tx9*U*e>cbW%;ZG=wGV!Pu1(5styd>e#S)I73ZCmy&%4Meo&+5r3XmNb9%1_WSwh;peP=O0%)}@xl3l-1Kwd*631o z0)NvbLlv>&zZFP*N8dlambp*eI!G#^N%?(zEjVZ3Q=L`Ok~nJXprG^@c$y!2!>V#b z{7LseA|ND~<&smjhI?b5j~Abqr3W3Y1xiC|6xAh3%xay$5)Jzz1UEoms$Dy;d7Y|X z1A5smeNMW4SmyeI>^ge8f9ZXeTuKf!)MFVZxPI+mwq7<(lgCny}!+|OS7#33c??se>0WFp|!d8ZCQw2=!i6!(sY=| zaYs7Eq^+3?Exx#{hFcND2FAzq)c52MXE`+W=WR@gH`|!Ss0HO$17=^>A@%J=-?}!e`p_C?$Gqvv9Jr(4^eW)pCSEM)UZkNDPG;5V#@^n zQ~LuPKNu_56+4uSsnpX#OgIZ;i*%D^wI?fo42$+4+U102_}C-{@&+Wm83*T^JPI;+ z`Gs58WC)BbbC}8Thr33I^z4*~SV>=r+pg2RPLR)cen}ggCg>W ztq)r0*uDh>RkVH<*A;A$qizfB_Q{7Wr+&-^M2spPfJ2L{7z@Sk-Z@|fEu@lx9-WUi z;@-GTukifj%3ndGQ!G`FZ2g0lM!#X=5;GS3hh=5MlP?x(Mq|$ z`nCL4TLTP8i%)2N9eke1>j$seq5ZdxEzLDKmk^RHy!?f7ewNPgmDJ{&n0}JRvL-G^ z24Sq*^olwvFA^3n5;ka3^gcS`jR-hRT_fF^nhLOvm9fgB8;9UJoU^nY;G+MHxAzQ-s#&82 zRa8XMCn(rN1p&!OlcNHHAUWrpb4D5(P?7{eBsMwIfY9U|1SB?@CN^1eRG>lf?Djh| z_ndRjxpU`vX67f&PF1^h)q2;v-c@IojZ2f#8+LLe-n{A4&}mHXa1+K0;&DJI{OF4Vp3V$@*kn(OSnsm=14KrQ$u%IOez2QJ%hHHSowS4W;Rt zWnrmC|6{xJ(tAfWd|q!VB`=d^@N4;<6yHcd1MD@$?TKN;Aqo{I>J^#b;7|tdK7Y7K zt{)da(z04UZ#9Z(=gvsVu^$V+xHJ8czM2H>G3u-s&!uH7)Hd1al=!H0n@CVAe{JTY zG0bs-JXSon2 zbDZZjrAJveDfn3IpV|7~)pOg!%(&QGoqiqvH9hkT0YL$18r>&mFoFcDJVE7k#y_WB1 zIU8;F2sI62RfiCbqzZa0Toy%Qk@(1?Ac+35_E+ddQmW8bKRlR$kcpxHOZMg;KLH`^ zJ9-7ahTYVS&lJ&NqBO!NJIqoULPHpFEXo``mB{m62uL}Qpocy{qj7K*;oZWhHSDKECN(+K;^);+ zpnnXc2+tgUhwOP1+!)3g+)W%H-c>aUa$ncR=sUgBCuvB?*;~DNwWw zux+VKY7ou_LWAco1#SnV|8O*V`pI1i2dLMH2K-?}*JiJvYsooHLUZ zX5%ny+Q=8`w&Jk;y8uK%=3i2bZ+|9te4^xUD4Y=TKFIx3fKjH+wq{3!7s^gTMzo$G z{5;W6gdwKCN$QM_B_*)fCKpq{t*$b$F zqkjG@6>v%w*-}}_t*1^)756`qTXYT(o7>%$>^{Rl8f=z^{WpndP0N$McXyey>>AD= zj($m}h^?DJTtGj`vb7`~SE^VH;=3uz7iyu*tRmE^mGbSHq&7P#-|{CrO0w*UD*5gD>jBvQ;qt#z4h;VVwLk5^fRrhwS@G3g0iq0?wdPY zSf;0kzh&co9@v2gQ$El0oZ2n+<6|hqtIj~D)J0csy@aVVyi=Ttl}ID);C{SqtOK+@ za}{X(qkHcdk2WoHN;lyY_Mft#gNiA*o?K%C593$bY+&g`1Zz+$b4%CnLAR*W@0tzR zOeBgm$dHf~W)V(xokCZ+ zM(}05RD@eOHrYGc)sL{1mhE^aEk8Pir zW8zKFV+yS-S9OeBL(UQ)Pxr1 zUN{4|b2a9*l7tOv3B&Vt>W_I5-=r2%iNk}`WTDs@iO+!7w1B1W5o#(=Zfzr zoG4NO)0VV5McTDQ(;&mnlYY(&y1fSEPD|m_{0WU;N#yJW!jDIh@ms4^C{L8%#Q~}b z7)-{@hizqgICM*8a~0LWe7`pX;5bVtj3|w6-Yu@8d zMz^AZ_AV^{*m00Fq;hQCM`|czejVyoVV~QDg&=6|@n3kM4taL?(4Tm{QbkL;RdmFyEm3bmQ6?`IFtOmG4L5YQ@YV?Wi<~`YIXjCK6^U#SG%3C2yg>LR z?1gZq*VD-{D-Vm&Z#Aj&^gfL4mAdDlA@Y{`MbUlCvIJ+kT%sG!MeWBck@AUeLwH*Y z?zaTuVH`c@+I~15E5#SgpO|7ev}7^eL$>3d(NQk9om zY1^Ng*MWA6Y3?Y#029f<^(1F2!uc1*7pJ20c6uCY!b!Grvi8-)_*kyHZN`+JJ)=bf zT%l-2dW<>ZzS4QS9k+}p`ALu>fPir9&3pN57Vof{sjx`MNg};S9KFak(MA!{Y4dzS;a*cr`5lD;^#!8ex(O? zh6*rLeS8m})(fZIL>TtD0GIZj$4k_SV3pfIt0&zP{}7^&yDP%)rvLg)mWs7Opb2B# z_4r_GB+owfZcnH|m&XknxQ*HFfM}H%qTJb3EqnHP^YgZ55(u}|Q|-j`Y8ooIbM5tx z(t#N(;#J|3DTkXe&QqEk50k&G=aZA!U$}vWqfo7o_S^P6f2-W1EQD9R<#xg@cG3B&dSfRaJ2Y9TcU%YF3{>@_PuI#5D9@R5oWtW=};?bpAh5UDpgXB2?kNr)r2 zLQH%Q4u*vzcF^Ii0LIX){Il-L8R2eKvv>8&pCQ)M=t6#f*DF!K{owbx|7M=5gPp#F2GNvg6!1z z7XDV=ixFJ@>dRh>bFih;1; zUpj=PD^R|_lj!HR9r6)UvL~qF6s;req&A?D!w}CwTGEXEqV~?P?xf;m{Bv)U?#f+) z$i7!8iw*_CTg^u;otSe%BIM>uF5&Ose`>`?050T*D-$;e7E%ux)SG9h(K+h(VzwvU zUR69`esl{b&{3jD_@!)e3M4wQ$!hM~MpeIjRMO%X)g?PqQ;F4(+-Wf7rv=BZIm;hipDcY3R%F4BH5J?bj;(|tFmK_g zBP9Ni2*c$ibabKME^pM)$y=ignzP&?1(~BN5ZdH80VpOf)fq)_7~6KCD_BwHW_i#|$x z<$oTpX%GzqGA6(S&U{LiGp)}9AXa}rlWS!gdA@AO@Kk86%hV0TpXPIJ(N^aP7kBcS|Y zM~H;t#KGQityYKR&uhHk-R;@|dHUnz4zanfN7RkGkQ-)l%P}UfkHA*|QNKGodzNRx z#`io7^-EgLpt6^p~o|JL=HDl^x}Ni$#}vx>$Q`g?Rhu37($~$ z@;a*IKXo#Y?VzN+tks572GnQ8$XOG)3YI-j?b-A8!qhmmigfIBM{Qx+hU-G*B$Kk5 zwP__w^TOuB$W|!(xfYu!nHw@F&IlscwS46*{9V0X%g_mPzPuoQlvL2YQ~oh{C&It< zyZ7gG3ODLU^-swX%Lh-=fu1RQ4vb26Jw5Bd45E)heo>9uLXa|N|QxT4`k&q;Pjwk@W3?Fx&wp{cYKJ6 zicb{7qy~JV;U{loZI?fbO?C;j9d7b6p6!|!$>mDPLh~fkBsxu>d zR{Gyvu`?g>5fZ&Ml|Tq+(G-T6fFgHe!Fv|3ZD$h!h=6i4S^uOvJ|bz$%-|t?KLaxq zoQ7+qu}DRw*ke;|w03DwxgI1GwX_OE+yT1o1_BrFmX!`es);YEK=;>i6E~?LdeEO^ zV;s*Ll&z(=Vqko(hjZe){B`rby+Z{~n_O&+M$fEJjEczLzw0RS$E%t(U&K$P+l332 zy{>_A9x#0Pbf3n@oiCEn!m88$@w@#PS(wTy*kRsh)*TK8*DFlaYfUtzDdgRnH*UY1 z*1PC)zKhDz!$q|xH|rjA1`&m@s9Oe_7+Q(lLGu_W({P*2*J@LrbC)UdZT$KklYJ=+ z>1pi^qGG=10k-OIeB;8W{`BYPH?Gq0-BnPhIg^pddM?dc-+U_rpncLF1_EC-MUn2Q zXLJVIcGfBJMKRvG*V}NLb7k?(e1v=NB~`(3SV>ZH+-7#E6t1~@Eg^mw^eW{#z`lHw zi;J^+lI(S@L!mGI$)Zm*@uOxxV{0DrkGAuJYqHV1DlXD0`=aR?!vu4i(S&@Y6--Hr zcGImA4W2`{JK*wlRRV`c8;GE|L|)41zVo_F;V_&5TJJPbm4jHXWB%scOGw(?0XT`Y1pOF9+P+^P;{ zd~$Z`m_E;m=@~ra=Jvmmjj3Os`!QIq@KWQ(v`%)ilXdZByWg384Ik4vLyNh>=*OMX z<@86@JmMu*!YQ2-0rB2W4Co{7;n|vmOQczH#MX=`H9?2dwTerMFQL|m?m z_|;QmshX&nlRi6J5s&Xd!#~AIg2owb#e#qjK2t^CZA!6in=o)d4*CQ|f0*G{LKt#p zL>utWu-(379%7Ujn^0MR5nu>wd)fWOyQ8ecrte4VcXA$v{)sq;fmS|_IRAasS5M*d zyY_dl=PAt%>YKJxfI^@O|C@!970nV{Um+>ss7B6k{Dt}(8&`iBM^zUq5TSnO4N$(e zKqn;gVHFq(fKGsk^x$X_Cu`mlnjtAXd11$N>%eLwU`nxt(N6LW_fP7)II5aeBkFbG zeAvC*j__(91?6qe#xAz);O*iRrS^#mnO9)=W%=+l)sU_=SEJ?u6@h%@Vu5 z==m~&*Q2^Kf7&_|@Bm|*5htr#)E@9C0G`Dp~ga$;lVPPaKre7pIAw-yGa zHEPqQquy00c-o;`eQ~&jL~T-B7~363mO5Nv2hNihtHoYMZ2s)oL;?8;0{g@_OAE_e z*2bE>v!DWAmcc_UWh%EWBHPosp$Z zfrf2bGMDJ-691RU?T?}Jbaah7S^oLS-Ow%WKg$JGbV@J0{68=FJ?nRJFm@LM1@V2bFPeHv2TG ziyf$iLNr9@XJ-c=3`GO63wQ4zuGA$LedT(qRl%cXPS5rzT~>y$U6$Kju7R7m7S75c zOsZePqmq33g6A5(h5Y4px%e|vSCJhdp{Y+;p0u~|8qvYSO|WDep?aJS8Cg-}Eg-8u znYj6Uzj^$an25H56HGBZ=*nm=pzP=^dF;3oU!#WmV(z_so5GgeOzU4br^xl-daNIq zqhMB4^Ioou1H#ZrKe2PMELBl4IlmCwqJeRde3W3Gp&DvBvOd}pu>R^*)+ms|zVdjW za74x2({n;$e7`4#-m(dL?g=hk*%--j-J7k~=PHUJ;vp9Mok>7U+$gx}Fk3egsgy2a z(>0*!c{%i{cr?8>konlpdkLmC3Yg?xvMg@7sp=fdNZ>m?QQyKJhZJE<|Uy^**zH7HL< zG`ld;U|W0qs-8O>8;@k#I37=s*_N-!&qHZEc7L>phRqW0&p|Mj=*!~re%9T$$L~T* z__gxsW6z==IC^RZAHIZz%c%EodT{`Fn`fvqf_zSW{da%0$F?Te5fEG1&8m|Jb$D*u z3(O+q^Z+xw0AN9A`Pr|=8`=R_su^e^4A}wrSPXuG1v7BmrLw!tBt&}bJX9?QgfaYs za6IzAJc{RQnfm|G?F|d2M4`>D<@3wV|7XOIEMM9UoO)x}`)%o38LK{2Wu=ozqt_^w z)l0-AIdoJCt0LR*Ls4bdYtAyeD(RcA>cUb|z?Ju~lgbStAa-TGESB24xD$&?~{>f|D`lVg}k%X}>G2BqM%k->auui^S zuw-oT1lw!6fdCKi{&TIf&YkZO70YY56}*92W|t7rxeDi`Kjz7%FCIC%e{%_hP(?)d zPN~l{6Ai55Sjcy=JaU1^o315A7Uluh`IBocpD56@Z>G|~;zRrMXv#=Q06|mFWnD0PXgmB~L1DUEf#*@8$z`y(5M3`-b2=wMy*3ev0JBniKAMiZ3MASVx1&D$=NNuTr)PTze zTA<}OfFAVZ*nkDV1GAdfhVQ-6MFak)Y3yrXxfjSj}+OqEDWRoLS_T;d9Z3%>rZ(&3B4pDLfb88*L&nM zqRvduS0a6MUOY0EtaNog+% z04FIwcw-+b^xnhrNXSB>{UDdHuw$*>TGi{jT3PDgo3PzGXw`im4SFoJ+BKM3oNv@_ z^Rzgz(2uv1wq%q+frWmqP1da0Mq^s0CZmg?qvsVq5zv8e!*E!uTZ%&Hh=XwDHVwPW zCl=uGA(TsHY4XEJ1aH-V+<1>j$+ZWn3JT9~AJa;o08?<$=P#E%T!^bQey&!i6?hY* z(UvWsMbJY=`cl=^vTLw6R<1XscQc!@Ol%RZ{%|xa3W5lf{S|NMoqrr=!(5n3lV3Ik4X0mG)c1BRf|F4Y9_iN=^N|VZh^P+ujS^eb_Y5HT4yR zDsfI0Tt{7Ot%1wG~+z=u8;w6;x4?(|{-Kkw+klLfpi zOO*L;m)aHUHV>Fxx~?X>5}{}6z7p|wvKRL4QfL<##yA-tWy&Ypu`!uzCrai;y#sDq z_6!I_dxJzof4_v|WVZ}urP*ColioZ9yTANuREoErm9tBTvsu2oHyJwZS^za{hX5yDxxXbDP16v66aZBkCR93tJLkxk%s!G6VI>*0(ZJ47JOC z4OzStR=wWBBYiSJ(A{4Z>(R#tmft~c=jK+Ax*mOYyd_8%dzOE8$7aX~N2`&9H&c2F z6OU6dsGbABamC38ZwpP_;ZNcw&J1@|9UJ40bhIQXNh)wdDyT=y?MP~)3v&QkB_I!= zIW>i*R+D3rZD6&B17_^}$7<3l%3sI6!IQ+ar0%?z-W%a}c_yN-NX=}WP#BM|)Z%T< z?%TtvhC|UneFbUMwN>2qM@;mM-@*lS;Bi1Yty!XT2@~ik{oEk--S9C*icn4z8PIhJ zbO6hL2f>dTi}CC2H)8FBLWIO|@6xP_t0ZRql0|QZ*UK0IySUg0QY36tq#;&L0&H>% zo{3RW^yYa zoEw&`oxG;)F7pBB1Kzfk84sq@c3~P`_Z}Y0yg#VUC>$;|2Rghg2}^Y`3Df?C>4@x4 zzfMontf;N9mbk&@^rmZ0^s*xDixeFRxH+__&Ap%dIbN)Hc7 zdED>e`JlQLBG@bn(Wz9pqXF}1)hb>+?xc!XY=N5zSWDQce*yp4oBup9E!x3t9aRf; zn00?>F1!qa_4}7Nh1lPMdpFOVe0~B5A_C@tHH}H_H5_*?6&1B!s$Vh0{D8l7N`1^60`x#aVYGV!H*f2bDHcN8| zPZNFO`w<&AHP6P6KwG4xzt~>>Sl(+i1UC-0?|y99eLfbc8r-}IdbEN1pi*7S40z?L zGGnwI##ZEiK_3Cri6;2m6anf-lY7X^s9W=Pb2=HRD{C#yA4{4U3BSmSsuP-zwH5sl z+^vfc->=J)B6Bkm#m+5BgY?sJFNB4+^S8WKdLDr1TcC{~uM|KEk^HMSmT91Fy07%Q z{*v#p<=U>mC?}`LVcgNliL8GH1xjFaffEXaY{ZK3Q;&>U+K2uVlq5Cyft|WCMHSP8 zR`Z2^wBgeBTb7pS)h4^pPkhz+k)Pl!U|&7#{JW1|YF;3RQU4|CQLU3w5;m*@Y?eBy zh-@@x6lx9|4MVRGxCzEHT3VZO<^P$izk%_AbMqzX{@h)Gz?5 z8SJmm|K-QB+xu>HE0 zRxWm}l^ZagV;AWgRd2de;%P)7>gj%GHagnF)fUxb3NL8i0R^-b77;0GhE~A8U7srL z+AS#1T^6ry<+-_H#+_0abG--T&(9pdV;`H>%9H>X{%*%c8tfIR+jv8H;k;B=js7S5 zE5EvFy`r}&{jdE_tBuZiPvA|1Asw9c&Ku!PPVx6Y*7oFCUB%*mIBt+6y^E<1as0|? zukG7iuYH&9xj&`D1cCiRRj!P8AbzH`8i&V{x(|5+(*cb9sqY777e zmR~f|fWMoPWUy3jg9pIpW@Z!7q#+D;oG=4MK-!yDRI)Zc+-D6 zB+7Zpae79A^1}Tk>isZ*7(w!B8`tC1y{`bZtCo`>Gd{0V$HWBBqlxH90o(9)p>9KVXQHK!P$9kjtqGn9{Cl@c%~=D zoE|EL_lxe+@UyV=299xy8dw56>`{2!SCvERs<Q?Ia78UKb9NSy~uP?t-KKT~#xE#cWlg%IP{-Z(x$N3qU34guSIA6F}>QnN5W}do( zu6r{D&uI1O=`m|Z9kr7d}^oS`$&ZI8%#{}VhwhS?|oat3Oq#iR*NjQtL-fAk5Jo}my-fj=4 z{Opm>@`45J*)V7)N0=kI^opzhoAqy@E|~~Ku={-<>yoM2N7xttDySm>NFh$}pcHY1 z0S@#H3N7Zep3<%BxKj|BojGOGBAJ9Yor5-O0ABK3PF|pHFO4F!B*)P^+3uZC-MmzV z{wITi70j>@qYnjM8*s^&iCYasHd`Qw^iPPSDD`Gy{{=6YwT>Jjb?SRJokuljfw*{!SXu)N8#3cT$<0~ zr?KKOoc^as4?@UvwcTVxwTB?}Rexqm?98v(__xP`49i{d`mKJVN&F5 zye`?(G?@x!vwvd;_xLFJ9eIA7m4d#0-8suZI|Z6p0{V%|gLbfztiON8(MjQ}PxP0U zqmu=pVw-Mb4@4chJd>JNCoM2r;}!PP+-{U1QF76;_FPX3tyL}a-x@dxFt|X`VHF5q zV!qL^P^eZgt8OLodoghOpE)-a2~j9e%uHl-8qz~)g$ly|*sy%Oi+8AwNDi0j$9$lV z1%WtqT;5=T$G7FOqz)5={?}T8+2aQqXS6ld*qvI^y9O44djxcv_Ks6|1{ZUNH~r3K zIkj^IMB?&?!==`Ax;aPM@^?v@!x*j18+L;Ify_BpZ})D* z9NgwCckV4Bc)c3lswVKM~cw#d4BC9b2c)Q$@+mfPi8XS-}Ntt6=m_j;z$+ix~9{=#zf@ zFb=A_1@yMQ*BrHU*azR#280cEM2TM`kJ$AXiuca~*z`OaA?DYykym=}o1?Qp$Pb{D zwt-4)N;aS~$hppZvy7i9=8d#tgD@k~sbL{Vob>+OXB}s=!zqqfC>HR1%a*7d4H)t} zuH+UM-=`TbXl*qDGUIqysKdu9x*{?E;mv}AZHE?e{O$V6R`CL#!kfcn*f9oeng76N zz$C*_^DJu4Q}o8LTmCZ|Py!w(rnkS2puYab4fR0FythCeP-u#mn}>n}ErTn0;`Kfl zX}iwZ7oI}fGeHm%h1tfq@9pCOq>8q@R|sh=ux+4*9KhN=z|2e~>Dq3-iSATCg%h!Y{D265<1bXtF!+E^<8Q3={!-cO zny%KU{_@bQYUW#l1Iaiksf;>R@iTTA;=F!T&xG!_gsSU?HD&=dX69qwu3#1;r_`%0 z!dRY6GJ7{nI_EUdM;fJmJ=r|8fCE~1YgH93P%*$dF|T1hg*PieirG4A^GVT9J%292yd$}<&Ly4wN*Xn6#Z zs(v|}13AB=qq;~UY^?Ay@d*`~wzl?j!KRa(RBENEo>egKWO~!SsT93AaQf&9Z}N1Jh-YRsb+4#W&G@~cu74+ z2luNA>vpHIcX(CQT+pYlYsMZ<#)Jd;1yNqcU-kuT5I^~4wbf-6tSq<2EmaQrThYBA z3*K5Pqu#|2@Tb`(C!8_njX0>v@I3@k#m~{(rpooSxKgg$0xI2Nf?klC8fY+Ht<0Xj zD77mefTxFP=qXobF-8{+=+xF;^$1{A*%aJWeAIW z$C>W{UyO_Z+h1hAFaC67`j-;+sx~EDDe8LziyfITT7tl~%|VJ8*jH^dug7=K6q1Qo z$jCDi5rI^$x#{Rg_|u|^1i9YtKaImU+s@uzV6mk7^HGHt7}xlO^897ndJ4osALz46 z?5rF=d)iE5nSxxcg9@TFnsX>jG|wlfdKCmnH(d#}JbG9-3g8f)n8yii+|4QJ9^EVM z$4PKlA)YM!fZgzG)XB(usPmNJ+k&WC1L@Xa2-H3!yfF{uzq9M@shbw$2&#m#IB)Kb zWvMtQ?NOnWiZ7|z#$&B6(JCI(rRW47!-$5-ViU9wKjKk8t=eo$-bKr1K9ac_h6mEL zAc1V58ug!3=Z`m_PGb(vcg4tw(%21Z0OpkO3hi&{=~=V11eC#8ZoD=#GlK!!a9W14 zw;uRw0YGnL8$NNqaP0@KlAFe4T$?f;E?>v@HvROsz}RUTpWzo_Jc8`dxc*PmW$^^k38~HOBMUGR8)(4Yn4ASgW$H zp04J=%pEPinM*_WIkme6z#VTaE1c_r-Rz)`2z0C*^>SW2X_^XOG-Rvra#VjBKR}n% zOb_%jpXdt)qYbh|F0Uf%ykJx+2ttuT)ol)`y^~`q0H66TG*BuJ?qxFuR+E|N1?+0}RRM%lZIfrSeNnNZ_3mVQ$V!Le5!HC&KQS&7{kt9U4Vzy|-1 zEN(Irx*1y7*31!&PtAyXz$i13**=_Ex+*G&Y8KQ;BKSxJ~G-q1nu^ zCrYK0RQ~6XK+gX?$Ie=d@pDWk6wpby>Y;QZ_A@P{JjtOk z6LJfCPtR8`j;8Go`@#p9FFkK3^s3&>v}f&SA)I#CM(tGUk4+~N?mj#>fGGJ@b{!=p z`B~e}Bv#2Qd;%5$j$hjS`owDpGkmSBq~FH+avu9;t-limL#FM74|&~pECL^{5?DAl zLvx13^$EVJy?tb7FTBN$K8C-ue|YT%vX?g8cg_3#gS(u`u)8|^#*HJfc9ZwU?8Zxf z&l?Y#=7(>8|7J#g57To|U}P7Vbv22*_{LI^Y|y_=-b*u#f_LH7Ti|tWKtO-$Vp9uN zcWguzWlgz;Wna%{A}EVv_Sp)opSv`}t`9P_kYENr$_X#04%2$w+C_z5mk!+0p5&+x z!4=dHsiSJWKVbPa{eu&s`%FS;B#JIBAhAYv$dnOj@S$aCD zczb1N_+~k!xv(l;t|a<)h3_W`(d^R7h%b`b(bSX^!MH{L2y>P${eC~8y6321r<(jD zg<{PyT%6(D-lwbRmNmq_ao3kAIj$F^m*Z&b-`#Ctr9G~nHiHo}H0W-*189TE0Qnh3 zMnZqTc?~_q+(`7^czoo&8`}4QA=G{=gSP3idzO9+A-@`Z89Jj)!&23r!3{%&iuM zN_MJKdTkv`GwcS11r3^LuaZl<#?QqH^4tqz!KzK#5mC?q;4yUzXUkQ>{WzK-iL7SE zZ@LOJ-t_mc*pk#H?sbv_=IWJ3I@Z z&~5kj@%(s)TRQnTQ9BM#C)O!$&)CHrr09AE5w}~OUwQ<1ge-EqPTK6oLM;$;Y!AuG zL>36jK(_-(m1lA5hSjs~6(so=Ma<*A*tU z=$w|x-a9pUK8aFYAm!LW*0)@hj1C}Eo;oWmdY`eRE9b$EmYOzHV+xVnABX#MI50^r zi6>TbkSoS7pyJMImFvZ&04!36#UgiFbVKH|YRCVF8YF(F<*1*de*2dy-sGHrFc+zU zoNM5&I~`fXTYYF@)N49!>su07hWrkaxc7HtV~vVY;KMLk`ID%^#E8womq(u}Q#9E% zHET3E^Sl7&D%rqc<2RQ@pP7}%h_XW(KB6J@gGDjYD)5=YBY80DmslG*?)RYd(F;_! zle4xW6O#j>N{pl6@$OudJ)&9Y9qd43b-dzsDw?0#@9?;!F9SJ~fbZowR7Oy=dU2Y2 zGVOI_<_I-2x(fh|*8&6^`}>L5Fq4oFP%^mLZMzCxz+Uk)RsX1GP26#l`~Hcw-tQ8^ z@y1iT#KaQ$J5rueBO6t1MoL;k<|yUmsJfgU#G)@h1i$fuL}UN6YDE32>Xu9WYBKvf zWH1>I^T0uMD1D>d46y&D4GczAZZu^u9nO*g>#wsf=d=lj%y)CdRyD)6unkhTdkjmB z*&N{>AZlEjs&x@Q@>z{XoZ;D681Y*!?C|<|pOa~H%iKAE$=7Efg%Vh~pXj0R5M;=7 zB}hij$ODa1Ft;N2?Hg=2g>cMUr-%McOa9#9f1xGMyXE?ifR=^r1hbi?bT;cQrIb=m zZRvFCq0r!nSpbC_!wkEATO9H8KTEwJ;Pc3$^iGv4=b<2Rnk>2f(F z7}0pe+-G?bS^Jx@G|WILuB!CkB6K*(z~2_O5fp!WBmE<<@DI_-edNP^#-Y<5bd25Fvwi@hLx_$$w1Wya;#{-L2p8O$c|88W56YZqlfR1U}y z*MF{kGU^pO^K;x4Gb&hrwpFV@I@)BJ5525`*?c#2n<@Z=NM^ML#0g2vVKN~W64K_} zU=B$~N7lT8M`ONGakH0HqobCz#pr7snkXeW%;1E`L#t8jYceC_GR(r_OM7>nq;H z2yJX0aMGBT*F`FLypk<87652$6ZLF*dTtVrLx6S}b_Z5(q1!+(9#M)Zwt(x*=NIAP zYmHlrmC@Sn7_A($*82NJYEn*BD9F=_^tBJnZJ( z+8)nK-eTp~FT&z4kS}$+j^*Jlz+?*Wvtk@S#!wUhYg2W9sVsn421C?LUsht-NRHAb zww>9JNKZ@SBi=F2A0fl;7_JcNnyae#miAE!p-gTK5HrV)VQ)iw2$SX2f<5LSou`QX zQ_9NMA98R`I>)GYcLy-@x=}^6RQ9dCT|!cF|L0AmXoKf*KxJyEK6o`9s7oaP>Qbf8 z0X0JkkwvzIkUXvEGsd?JUVMg)d|c0dfMxX}-fe7rvF!uChOW8BG2Td+}c zne>*cw~Pkj-(I=n8No@sh`-}smoerjO4Ao%iMt;e*wxHj(1MD27QReEYt7@XE|WU) z&kQ>;fj7r_*d1g^`(Noev9cGh^f79uKhWSaQ_KGyKS=t9hM9XfNe0?W>e<*sfeBzu$+eWvUZ+|vSYfl>>xiTYwCjVJ5|6A;; zQ$PI!^8l?YCN8%TR)=y?7~ zgRpu*4Rmn08_@bUwJU5kQDT(2+2|U$7C$mF^#!W|!qk+ZVSReJBCJRTE9N2aw6Anb zVRbqY*y=MPL{Dsjw#`#G^*Rtk;`>RN>+|4vpHF^6C@F~$Tn}q61fj}i($wLPDk1NS znhmH++R?_afVI=6$^4{<=uO10<-@D}A7SDpw)Z&3gpX>@77Gdtl-;v{ z{m1CRf9g|{pXarxf%1d!8zQ0{ zKk}LSZF+xi?~tJJTUNGz=ClXQe6)6ze$-iIV5!d@3yaCsg}(!>AJI&MvjAy)TVwk9 z5ut+z^>-k?@;EOvEcdDM9^nGYI)iDeTgUGX64IB7xLJUA`=l9<&5@SI)+mwIF@v|D zxtg(NKYi&?lrSMdFWj$bjJM#EV{BU6I^iSKoZt&?kO<9>e91JJtbwjjRU$mE#9jXA z)WtfbAC5^jRK>V>u7~X9GI4*Elg_}Mc9Ur?m{#%N*k_G>1AO@nkC)0`ioQamTL=x_ z7Nx#tuz}=b)u2DDx|&oOJI?YORWS0_9kQl@;s;j*`WVm{<&a$kH>uWvU{s0r6F=`t zuNqG!UKB!2bzeov_qnUwU~Q#tuypBIsp3gMhnN>Dgmwa1uc)NUxR{cG`T@xqzS^n* zv0}p1A_Da{EG$aA3!d=UFJOfx=Mh>xs7P1Dg8C}bg?xh1TuIv$@lIadSwtY&e;)4E zp|Mz05bIiIyfot|49p?JP~d&qvwxs&Dcg@J0x<6XS~f4e$+`Sqk2#1C*Puip>kF@K zOJIWPQvT5{O@+~cQpNzER`r0|xaS^Q`R9eGZ`?X2yonxjuGkEgbmnp_pEios7i zysN89>n+@+zJOVN)@y0V+(8z;07Y~&&_uxOZeCUg5Ac|w8xzE6!o{Pq2BKJLVhJla zR;obmh;&Dt~Xc+lx(l6*J zjwmlT@Y23KOdeTFj+;m$i4tenCJ`+&w4`~XSQCz5xxS#Nk(5`}T57Lx>&`mG$ z&4QO?qNri8Lb-(cH!xSZlLMh=**7iZFj&54ED)&7MPr~uyZVQSw0k`nSvaQrKdHxV z3)__g88w7XQ7DmO%a7RMr-<%{Rvit?x{MCa(BDGRHL^Xr4{3wcTzd*S@_Crq>+r7X znrjeS`taQDn#P%~+~z&yG&MhitC{vv)vYApzHBCc;zdM4mRH>$MUp1kX*mNK;F)_h zPRjT)859MxVG-qI-I1k|(x6&acxTaTz^fZN7N{vqgWLCLEty|KK6 z)njdg!4jk-n3|z~Dx398-v6u1Lu}c042YB6pOdIpgsK^B!|5i^^gAScN^~;2O4SY^ z*3_}0pMnL8I*FTcQA zEiLbyNGPrEYb>fd99UF^S>Ip zlOqW@x7lnp6K*dds#$krH4=M0(MUT`p-{sMOt<8MCf&}}motHh2{cyghh2wm8L>+O zY{?c*wqH`r^x;C~n4G5(#4>Rf^R6(caaAhV?q{~FtYgyWrM8dXO-bwc8xtu zPcLx{aKZggRj?fwn0Jg1)m;eZ6MlhU@wh)j*_DdCj_(D^|7)faAC9fUY9obiEs6dL0(VPNceMX_@TsUa zork~d{~+$Gv`5%PyQ%C1<3IDFGxgZi7OyBR`=fN+J?2if6gIC zU+*25?)jJNoK^)iOClx1`f>#f@6pXX3Xj>(`>dXQ<$XI7#d5ThwT4>-Ky-$LO;1#y z$o>ZonUjz4MguMq=D~QOifs`GiPuq^^*?J{KiN+!2{u)0ne%vU5WcWWQNm^>+mT*} zk<*(k=}Fk8P{L(Rjhl>rkpBw6&;A;DY?~ed2l}B zEmiVhH1){;{JX4X`m3y#0r1z~9&0(|cY_=vW35bVZ3p{zfd0CWqKPJuL6nuC4 zLLv$L?)wHzbn?+w>GeTQLo@0tEMWI;5uVN{lcb@$a-kmyY-`lv@NmM1%B=(2Uyx*C?p}KyGaSIb4=hZl z(~ZUeis-J#t76;}yv~w{oSMc{7xT~Fn|ANrN^t|MD37Nrm@+u}#(v;c3}zsu_A)89 zefl3_*up`MDaqSGw*?Bgu-^GAS|Jsna%;!N%|J!ezGcjl;(L&x<8d4#$_~NW4lNj- zGz)AIU4|i9frl0=Kysqm!+@$ z#--kCg-)~1RqDza?$nQ!g|fjOFD1O-__lHWlcmT2`LGUbe&Z1Ma^SV-|J4Pjb6j}( z8ZYT@V%hN^D|Fy&U`?F?&Mu~|@SioaJKs<~+IBP6eRH>t?-A6eY3W87_(7@zRPSv* zh*b5*GHA@JQZcVH6-*7a(s9op`)In)dG>qVrn@h;{*+~Tkawm?`saOsf?VsFb}Lo- z?Vi~}isN5;5#9Qu;z@)C|0YqulB>bLU-x`U?yap#%JsJElwzM+SBhwr=lo zwdYe#EImOR`pMeH6|*On6nD!AK)+uKqO5H%)|=wiD+ca-|G&v$-LVn8G5Z6BA#WmX zUi;|qw{%ZZpOsEgmC`J_RDMq2-6)B%AyiK)EF3FOWWy1HSsTI5lT(cq@9u=CBZNM}AeKZ6uT1 zR)~z_IvoeH+*uOp{mR8S?@bk@o_%EloUc7RTt@9v^byXphav;W0-*CL?7?CQX4F}_ zizb3`0gwslR0K;!byBoQ{$~I9aNvoYSoWbN6QX6x9VFhkeXt$t``@kwr`T=V@L%%r zcYol{%&JXQjdRnbMrSWo7-GpF{_V(5rGr2q)$C(~g8B?Ige>&H^CS^MxU=qvfmYLY z`B~_hIT&{)Qhzix;3lWvx@KzTqsLM+n5!OL%QjN#cG{%`%X^8qEcz+;4H%If+QPo8 zLT+sgX|8dKgVob?VD&Vg9v7U-i$(e}Qq+Pxi$XhPj};f*@jU8?W}Um}Fl*1P9WB{qcZc8z*=`oSq_tPl`1;$n=Hb-OdO31G{ zE?LdN$Q=gu4Xy(>FZhqo;^o3-zXxhdpJ(t^teA43?`D{EfRT-_jB5M7=tLDB7Ob?V zbQ3d}Y#Hr@dYGFJH>(Mft&uipA{h@dLsEef@Du0 zT#o9#S?{1_y&m&D1)8m=ATh!I6*BYsVP9PBbL;5G9=4C0yyaqCp^AR&|m*ffSp$F*=AABQq>9Vui zv|_#(jt8a-w21GAPgF3SP9oHHPr4P3e2h0yFhpi@D_~hAZJeui8N> z$P~$jOCad1(6;~N)Q0pRGL!$5%X`PAF|DT0YeYVxaGzH1r~BM~1w_}0J#R_o<63ta z>6DM$vI@QEmcuVD7QOL4f8J}Ufj9%G#;oh}RoA%LbA*urzU7AfCkLUkW!_5_<=<3; zoi}*Sa+d{f-XKl5{%Fa$hsy}C4N2O-+I$Lg2s?e*PX1}$z60$9+4l(fghL3zL527h z;-C4}U(csB(?-2W9Bgr0o}ITZa+{Ofa#EG1R2ijj%+fE_u(zxi-!)ZGXb*`9wHmL` zpOqQUlk=7edT{aGbH(5K-ii3@lSybxZEt~X4K#Jr_$%%E*d=t`0M6`oVIz=E3$;W` zb{Dyv%#vH>i~@8p_liI3F%x7N_|^RQz9qL)mA7-=n}TZNowoMX0UVp5wN|Si=LPgh zJV*o6>AgxNcM3^m`uDB}DmY4Tsyf|sIsgZOE!__yALwy0lL=7Ku;C~E&I)tJQ;paY zV4;9)rmHS_r@KWIBP%3g!WVse0jn3F zs(P!CTY!iHkfp_WM5PSjk2m7=Z5>%v{ig_#l4Gxg3naiow_1d#XRR&bY*C5PA0hgz zW7Xz&xHDM4kw~=#&;{OtTXX#*Z=yr=q_pP!OMd2sn-dak233@$6{(RU;dc;8()TAx zuYqvi6}%V-(z(m60cp!<>dIN~Ogmw5PYEtEu6bO)=I=hfwpSaBDSpKaNP1825P?yN z@rY`Egg=gyAhEDz9seEZ^O5ab6V29x_4%KE5fVY})T&+$Ejh%an$`^6&&c&+k^_y> zvtG)JzD9OaXcySrY)__cvFGw4UUJtRtczcV7@FoJvPu(&0sq~V2J0QJ>{I}bX{t1$3X<^&2edh23LGI?S25bKs@>>l@u~f7; zMOs6Im!3+e*1FVL<)ZF5ocCR(r108xNwgmD5z%oG6=&8C<1&9JUkkl+2jU)R?j5m9pr}k`wIqR@A~g=st#k7oF4st3DFCZ-7Oy8 z>O}`+<^|}M;TI;xx$`dxOgb6~nLK;=W2YJnOvjf_m-Q9PvAnyz*V`=9RG!nP)p{>1 z&K@pQPQ^a7+~cDvkC$7@HoZQu!7GdJ6PjWR)2lt?%-gHc$g#po=KvM-5;Fi4L5(s* zB9^(Q@&-!`nSZ-YCIG7GfOInR--{{#?5a~#wHI3QtDHh5RAMzouN#mLJlBv_Q{NGw zN&DIXL5qPIWeX(A4+}_!MD4`my3Ai9V{#vo_iFuh46P{9WUlO6FU6rMQ*0^4>!Y_tsEKD)lL&GMFYi_9PJrm{sU!5-rgdgP;y5>{Y)R*S z#nV{Jrg15vM}KtAjK7-===jT`;&`1QV!J39vv6@z05rb(^+tC8hiA^WTIu0`c;-AQ zy?L=)-o>H+wYU!Ha2Pi|?lQgDdopubmwQgD?y!mR_#4&*rPqo-YB-3-Xem+Uuu>Um zoZYmZe|*ick1N?utH`BE%0iwczO_|Oa^KKX9{qNP%89fazLr$vP^*wcpM8!)=MAF8 zd7EBzLM;X^*m!3sJ$kxq_QLO1kd}P6n0osX^e+;FY;Nm6YjgK&+gLg5x*}oP-29x@ zR)wqU@r<95cRt&@VEvJ)rB1i;IAFO z3_yw}`!GmRYK*Xc=rskhEQ{2?l5%RE9glC(&@qY@z$`4sZ_}egK+S zP6n~fh4ZH_>OQ|sbmlT#;psT=mH6Z~I1HO-kk7#{vRnxM?Sx6RDEd4tnGjcS_)^P+*{{A3@@oYAqEBKiWqe)}MS zv31)A`%aeDS;Vw0Y`~~d_S_xzH8dbZN2vpJwPMD1a`h|W7k#~Ri$>tx`+mqBm#GIi zYbmTA0v85EPbd!n?@g2En1812jkOyBYTX8ol!VW@fI-=)5msoy)X$&e$}%v|$zF+l zH?Q6Sy7I{>ZHq*LP?>(B(C?U`QcbIV+aKscG&~o9A9v<$C+A~fSt|ThhFJU{O!}ab zd{|(TqV)^uKeP>5FO*<~2wIao@f!3*2Qg}A3|Q`2*>c33(-QeMC5bI^TI0txEbpNA zLB!ebucf*FBzK@=`XzUW+^JZJ=|skkQdY7zcKk`SxxH<{zqKaFLDv&`c2K=w3>59p z+<9SEn1Jw1I07~kFdLoUHkcn@@&76|p!{30A;&*WlCxgrM?SqQu~MW;>s`iYjE^}b ze&qPXq@}iioe5k43V`%p2MM|rKT)wNK>jV2kgqu(28my*{z3|2y){e|YWcZCX|6Dp z&K5vHZTRpX%M5c4(j_|Olt7)KUb-eA4v_2*s#|xx+%9CBst+M_reRds@Zfbwt-YLz z*Z%32WwfZxgzJ|2Lv*!Tw@X9rmo%e6uBbnd{i|&Nem*)emx)p`I7Xx?(&$YE(b!HM zj_X(K=r;l-9N7ft9bf14FR#8Oq0<6$g1&;eK>ingI;mV$92S=2y&sbcDH>LcVRZx} zHhd!af^M!C6cm=hMb+E#Zvv5JK0IHL$=hub)6dV3$1kk<%=KKOPc8ukVHfaOY?Sx~ z0939|s{{B5Z2=10=&-z05`t`Z#*;o14u>>wY{w*0gdtm_O+ZIk0CA-a#STb0Dv5_u z0VD3Gf_v$9OcXGT zM6!I_jx^>V4X>XaM}ISVC>PT6d?aU&vHv+eCK}C4K+pZ;``8-0U|Ha{1we8A8a1tF zpZvgkF3fPGo;qnfwN`e{%<;*{3D8oil6KD8oWz@bE^w}ax4?TX0K~deZ*5Ew%$nv}8mCR(^I6Ucjw>{5 zGbrrh4`kb=E4td3_pMottJckH5G7XVgMlDFOg6mOewE}MVz%S3dj3YalVv)kGoM zyukEK8V%VdOfT|}M1HkJuHD6#eK;^c=@PDxBb;!JD{48Jd-{gDxJawKHxQ;t0zsz+ zCnopU=f8g`(@lQ-p%ZXbdbVWT@_d7pwV`p)D4{&gvA|3SX=;wc9*_VBQr7`b*9L6% z{@wjXKO3*7zo#9_lCV8UuaphuH>Xoe#?fU7u&wC+&i75X`klo$V$Zx@PG91hYPaem z;?iemKQjA|{HV$wo0dsgAkGZqcL#P#%}uKA+kG92$B7jwG)gF4D9#ffx6|g@P+ams z{Y+A|5tYPRT^!5L0xVz!pY4MOImi_-1TlBs7aTg7ZzlQfiwfVN5@R;{9VSr!4%=l1 z6jQyBX{ds1>WgP9UY4NPVe!@pdJ$8!S*`hd1xv&9BZQX9T7W({Ore-8C!fYxK~mYq zl9x8K>#Op<9`<+*X^jp$#}%I(F_ujiS0o-x37z2syDY!Ga8OWQ-qoX;OYG=_3=wh? zR}vCkE5^L?sb@?>S}2ls0OAylx4P^P<(K`a!OgoOsx|x0#E~%s;-Td(3>F5QUc^^F zAyn$h(;`+3h%t6QlVEx+x`(R`gKGzr{-_pTXJNT?VF#p`6 zQuvn=e9%Wi^r`J5ZI>Ny^mZt0s`CU`HXOiEzO7THnU>jR)YDtNep znTp%AsHh-uMaAJ;N_(-reM5xzF6Lg;3}6j8hs`EP$;Os}RLI|YIyeb?Lrx8w>$C)? zAAdUJq>9C3bVyBX;q~|>QF-#AV4v%B9sdOghx;0A}yqj6#%a2PDB@zDh~i zKZGm>S$5&J{}8gUvNTPAt7hU~jlqY`rY8`duDzNgm*I5(x;%+p%82ZXN;7|p>=q{! zDCRhqC!)VtlW64G-O^v+Ei`yA0;&TK#=jHD(=+SqnaBCjf(ne58W?R_;fwJATY1Ya zCk^JA&6r?94aeK7Go3GctiGVM$8P)#zG_SCf)vqGvEt5niT_W^7pn}Z?eB35uKN9Q zloNLaUoDW%rVkXT*Gb+>qx7}uZx%!t>Sj(^CpY7;+Rcp%hRKrjvlJ(t8wuC!k+5CN z$<{+mUQ$);cYVHZ`g!pyAcW-*1l-Z_ zxwU7`gld7TwUk>Rl45<(3fV}!4E5KvxT5ht71y_ z_B$6^O#muID^DOs2Nsou^}jH({AB;AE2#EgtSmEc&p)^qX#lE6ut!^Dk8ENR5iIf) zF4z3!W4YBdCzv(Zi!rAq;(KeTUIkM7F?peS6% z6c9gGb^OV-QXMciqg$xV+1FJ@7Fj^tZmT(c1U!LooXEgSJ=Zt3JGIr|&i|Vi)RDWA zdn=9NjF>o!B6|D*EY8}*ME5hrBjBzb8SXf}RE%x2m;8Cg{y+-Y-5LH*VKdq9VEPXU zjluT9raeISvMs8XPZQYA1HKQ(h!YAG4EoT4^BCoS;0wVyBLJy+n5~amrH1P*i?=2Y zxV&!zMWLs?T4ppKF$3d+JNd}Rj%8=ju*0Pdb%09+mw}Dr#Iv5%QPV5ARH0UJRff@B zp;lWgaW2%exo~Ye0z?t=?bm@u-x@RV|3y#5lRyp}UDM<)pM0*DcUW58z7XnZu@jVP!VYxqH z>BCkKSV^O!!90@P8XFMT9aG|(CJ?z!`OV#FRQaW4VO+Eu1tvFGR$igcd74#lT`wTd z(a*=8hg^-c!6Oc+3cV416y#FCf@dkXy#1{;&0Y`WXgDnYcO|i~THY!aK2eRIV3EJO zV<$*S{P#fEKXedGkfMT!ujWhXWlJ+j`tPBj*dpGUS&<7o;aJu0GV+6xrXD(hllAVg zSKTASiuyTNPIv}O}{E~sU!#k|q^nRilNFB9>j-w9}`Q={dUZHUWjUJv*6HwRVi12+VvPQiehK^Q;uU23N zP>0@&nMwtTke;6^(viKS!K42RNwRHoCH=GQ-7@*U;Lo26UR@+bC4B)TBV;MGyEPkW zQ&|URmeX+>kSu>$YnWMOR8)aym=FqW?wm0R(j;< zt1y6WVdxHcQ{xvLcjtW2&Ei?>HF%+oG!bj_6uVbvCdX^$bAhsS;S0I$qYQK>AcZbX zT0BYY3)~u<7z5JJ|7#BYrDEF-;ND10G4@A{4A7*Ov(grftct4qGL;}VgEr^&TQ#ZY zXO`U)-?y|8P?OOGvwHBW`Ns~p#weHkzh<4ZP>$_`&t`d?Ch}j#`(>rC+2KFt~Q>* zQG&N+&1_E|%xJ5?kGD`e=ZH4#Q%zt{^3*ta1GEN%MH`86&OA*kfrRTAcgq;-WK6r zyT`2TbYmYGV&U-@Y(ym9>PxOm<{EbxAJ;sXs45M!mdVZ{ul*KmYp>t|)Y@MsECrrU zyH*ZRM6Xc=M7o!myLrhOyIe<;%w@kQd22}%isEHpKL7FHOA^rI>zn2AF@VH{A&k(Z z4oCQJKw_2ksUn)+>}zbyTQ6>fpjUskj#S5wEX|}d1{xo9ssZSW&ry`BzEZRbf7UW! ze!KEvwU;y}T`o?g<=kXoO)hz^tqGeRk(cTt4ygUxh|hrX!8I9GBsp3uw^vxKoM}#W z-;nE?!%3W`j@=~t@+=pfxb*5x_4)6~GgmMA@USyp->1H(P4Tgw9iFxN4q_%r;{BwaEC@YYwcpPwz{AO8iI~#Wr_!B5FD$ntjB)i9%%kPK*4w}h~ zfJNw&UFr^K#SGbQ@5HEDvtYSfFA;DTe&{G^e}CCc5y8ogXZc%vK#cikA`8o>hCw-L zbVE>+^&6T}bEP*^HB}QCCERL0pq%z^J9%pu!1HGh2%imv$CH5C!ha5TX;8cQR3@Iq z+VJa|(d7n?Wa1$E!G>HhgS116Pude&Om$u+q-g>}v4SwPp|kJO&GEB4#kk}=z4=9cOE-kc3B#vLkV!Zisb znljF)YdH}lMULLQASEy`A*_#r$p2e{xh#s0V=d3ovDR$(f*2L$(G~UPF}+>waDsR( zmGym+mGtU)VBl&w2hpsBos`lE4i?|AjmFS(Yp2;ILZwnGx91Dqrk?NAUUBZV1bBE; zSE<(vmM4b;LJ+uK3ZQX|ysIGDP7r<~=pMvhYHVjR@&le#wnjsim=R!@bQxg{`OJ|< zIk*jhygQt{?OGF_AUbe$zHJb}@{V>Id-Dx#XD;sKS|bc-8&Y`jgxE3Dj^38vEQHz( zY^(jWj@QQ=GHR|IML6yh@U)V-k|i=2H3`sdKYeqBg9mjq$qvxbn;EbE`+&%aYNG#B zIEqC7T~;A{+8{FN%VX~@h{64fD`=vWRJiDb6_79(E>Bb}SBsE{V&@(E={Yk|$rO8D zPC$32ml@!>ICWb1)$OYRqJOoAA=LgC(SCxVzoyVz39>`4q4LsF_oE4RSg)j`vMIX@ zNxm)L9WXnzQk#+1y+B7u7nL)9$Ms-*yQP+e&y52BQ+nVM$R3)`TboSX&-)OfazI>( zw&QWr+@-Is{~(xbAI7%`{*!;>9#boGu||2ENncz@3o%?=7Qk+w6E0xoW0VD`G z8^_;-3Bi9RwO4-tC<`A0J2YCzPk!QatsrET)p>ii3p^YTglU_H9|K-2qa{_Tw%5V* zx4&acAm#+ZH$N&3r|IWqEwm@A(M9X!J+b_0tOFtzFFwt}Qn0{||GVj-Um7RnTHW64-u6i^6~WGj7ovo%_#O*6%>8o~_d(=Wd!GCGSM{f>bRouI zs!`lX$($inZ*R*K?o;HnUEH$>0^69DYoCr%faMA_A;Ltr8fIAes>bCBO!jEJiQ!#? zPRmgYqfR5GHy_-UZ~`utE)S}_#Q5c%uB{ksEPRG+K_X?m*2VuWupZpB?2RyK`#i7= zo&f@zKYR)QuYB_NINR?kN3$g&ddC!mm{3p}YD!!i=)i~=0%Y1X)(%d+yVjMXBFyWB z-usPGIlk38&Cc>=Emt;UA2`bsE%aM$ObNbC5uI_uoBi4&=A9Jt^4?XStcBb*p{1vmGVvq@9zk@xNBaeLCqf zl>BIX>jW61>uNKrV3Ep7N{ayi3m?KE2r5NrAvqno>Cd5*m~5PKjn<>p25xRt-KXd- z1Nwz4&7`-)zg1Z)h-oB^inNfONR$BAUQjvG?MEfRpb^evcKj)uOG{4xyWq2^3Zy_| zXRjD534m|ViF=+x>Jf_W%{Sce4gZhm)pQRT@&vA#-ut`?){tvU{{QBgF7LBR z2g~6;{&>hp!EB@go$|=-dJC>^`(U#Z|4XavrJJz(p#uP@4T$0XE(G8P#xt*Z>k!!= z``7DyuF(5hw^lY=or~rp-}T-Q!eYNKFC>+#zL|V^LiVVZB?pWBUO7<24Ho z#*L}&g@03EG;^{k3!`d%ApCRYj8*@BxfPi#`)aui@Jzcu37HJSL!FNAx_S>Zx#?a! z3Xyz+b`&Zs-+#`` zG7`@62@hIpl9fbNVH#3l>b_KQuzf_S0Db#WAe745eUm{z<7Ah)u|-~Ww#oYb+q-?0 z<3Y1;ql(wx+EarT*@>ThlfA0Jy(J)w;dPKkOD0SPb>Yg_S*btfN&k_h$9;6Q0V$5t z*e!l6(xTzH2;(w_N#C?z2n$tv9bmW@dcapckY*KcLI$ z_tVg$E~?GNGa;9Qd*cE3qp|pupnV}H*QMLQneKue`B$lj2od!&+bNE``Sa}2Vd}hQ z;Mmj_%~bdLyV#hx4(?7t$bM7HZFMjD5<-!eeI4tU_)GV&NL(B*uUAnlyS6j$`kicQ z6-iU(if~U|uOZllP1omEQ(T3upZU6!x0vA5)?!dnBK*96fG|4x_>>b*iJUr}o(0!h zmA#Uxe?60pI{#Lu(rh|#&^^@l*!4OeSk`63HBdRX zjg6Sg-IbzmJgvsYCx`-{o27cwaQS;z2R3NZVT@ZtEspB$XgLNhn|qpuzS;YH)oAbE zabG1AEp*%}M#IZ;h*Y)u{yMb=se!M5c*lLlGFloJRAi7O$ESvIK+dMDC(+ZFK&d&o z-}`W4C4?wlBZwvuN`H*T9Wk-xuVFJbd@`uy?j0-BOI0adG%Z>tyX(zhh7+$Q_k5yE z*{;yhU89&YVE~nhxsO1uVR2MNoXs)ut7t1m-lhV&vY3nHi}*>ain+U3NM!SfGv8E z;Gb?$TN0_3Ksl9?^+&m9rfg9ciJZQ!)F$CDl~Zh(Fh((1d2%a_k@U-dDqh%y93m<|_o;??}M#ay=4*=#GoVcGEI!(`QQ|1#) z-E=Cl7{4opxCy_^n<{ww-g*U3x0ceMW+KVX$YFByCc4DZr_&8YLm7 z^x_66$fM}0P(sIpM)EyRsI|oNmY!m>NZ`U)Wnp15umrUw^v=mNR%G!@_rw-1jxxcG z_bnHzX{ij5U__%1Xw>pxMmZdUO9B5Muv`}>mxeP>l`9MUNVrIR=va{(Ushx|knefZ z84MhF&2QO0OIEP}L6Bn*sS6+*~9}8x$$fca*>9MJ0hlXwZdNRyA}(V zqr_ZeITgL1+XN3?*QZ+yEw`v~AEEEO)Gx8CPm|%;t2FIN{Ky^|7fa8VW4dYB$EH`A zD5lKzZr|Uccb1Hpka_HF4jLMrwn^t&cehg#5#=m_dZCogv4& zN0yX=1MTvydHfd3v{1HT9*VcbHOE9aQ?p-}Z{JehL9V~jJ1Gt3$)R>wXhL7-(}#t5 zU#bdszfj93;U8?GnFw%63?7JZ^>{yHU-VQhQ)uSMldk=l-RJ5<&cb}*qbHdLLh(@Y za1AI!G zYc#(4@o=HUX-3V3d+<=fY>p6jJFBn!_mC`Q-U6&!tmGG4fP~5KPndz2F?g zBbz@4^3zM9oJ&B%nwf!966C9L+NAMF>G`(x6qN9MVe0vj+}kv}_o43et_LUJ!ddnq z?jFeNLV=B3Gimuzj@+FuIdN~)Mlg?0u)Ms+ay-2pu@{}Z3S&H!>K~A9sB?)1QLGtT zrRGSgrkeqa@R? z)3tP~r+o%*W^A{9#B6mrtoffV&o&FLd(DMgJvqB=2?SP9^gQo~qHt0nd5toiOzy>Z z6zWkf>0T#NmDO}KZRygZDXJKUOV`3fMsyrR;Oq#&9i*r+vPx;~8X2GZkr@7gG#{#W zKE?7IufyXlPMQlCRn|nP+i|!14x{d>SWpUw_I0)7S#qSzof>ZlZ8-4}OC-xcAF2M@3-6^B4L3hwyL9 zEI7EJBT$gpU<#YjT6J@?&Cg$-E@$v`AM%RY^HA%xtsD$ZZU;0tdGrIKnO?9g0g@$>E z-wmfSvTpRcH41FE*i?**KkoGJ z=y-?tRsW~zBoUq|uI0Ejm{x;Uk=!hg)KX`X{>`9@$CI5jR|+*3|8iSX+7Ot==W&DAGV z(ctn>fmhH@$l+zjA|lCN5!o=3e=3=xcbuPY4|=|01H zoK$UXM%1gNCrarDb`z23Ueyh%!bRnNjCye4h2uoDEEDA}kg47fEHq0bj(qD@5cx-h zeh2@~Gy3IaBYD}vk#><>vT3FY4Z9^zm?{d!U5gp6v}!bqfbZCun;!UOp(evf`;$97 zc(}2LZ7ZVn2m;Sfr7D%ioMWN^#0fdAyUK_rNSEIqKv6A9^c}zeT7n3AuEl8Q{n&1% zAqZWDunxVd@Up8hcd_itef7gS#O|?^YC-L|o0nB6qL=(5ai= zJ>k;oq1US}plYIm2n=!tP9gBzy-%_MI_<3 zQ_56SHW)p%q{e=eT7Ke2;_C$e-ok&`ewA{Iqr6D5IxuSdz8MsI5+lE#2}OmgEcRYY z!bjw30=qa%Ru}7`6%abB-99u)j8hBK3TwitT*{q4S$&42jz-Tsop-Nxa>b7c_nlM3 zp2vZDSOq@oLEu%Q2r*pmck~Gbt}KbO)8p-Z0Wl%rLyvcY`Z>}|(U2MuxLaK1EK|BU zO`oF~{ISPD3u%lxayyn>@S)sZXz4@%{h-}re|;4*5+f!zGRv6Wz@S?ZGvc)aE|+w*l%Xm$|8#~Mz`#X zwf;o<=&{(V@vjK)@Dz!?$=cI%C^o0h)t=>PxX1|fP(O_&(i`)P0ILm(anJwLbLn>J zIZMElt)e?}h{u7Kv4Z1tXW0T?e`BfcW`^AacW~7ZA=rGT(#HG7i&_~l`>3?{`CvNz zw7fdAwWIXIAUPb7Ij}sGs%RG=3O&Z8B2(=_3b1V8$8(N|SVB815e+F*@_SOl-ESHu zjiPxcA^O)~u~qS3!Qzj{e+d?|Y_Y6^XckNyy{d{J0VVT~68?@BTaLfEN6M>S2CDx? zi*}z+1^Isi#!-ruW%n;$lhP8)dMvej&o?IAK9p&-Mddn*I6Oy zLpi_5o@6h3wzgI>E18vSZ92=asqol`nPPfPC!(^7v552k^7VovYpwK0r zK~LX-ZI`t3i$NA&MQ7IPO|MmmPrf6XsLnXz3|r1nJQbiFt|A9->udA?tadLb13it zBBz#y5eRsPZS3bp8li#g4h@8&fS`?#uJx_vrGQQvJ=7+w*@>OJJ+N)jU2X~Zb~8glXmbvcprcQEZ2pYU$BusQg7{^YgtBpmSOEq zKjrMpT;N}#YPe5>3NZWV2F&S!vqt2sc?#Y@EZ(loIR`uZ8O6@^r5_%%5tg{WWFXR7 zT;vw`D-28NE>$I9WR%`2-QH~yb;Mh-PHop`QSaaRus07Wc`1DDdhD?^GJ@+hqlVug z#=J24sQX%OGfII(%G%c{wf)y@ud#K6nhssA3E^qce48JC@*4;e%aN%4rcVB?^qH&1WHJ#g;DerUKka2I(F2N5As6g4$iV<%R zoV@`#PYUG)B#>U%**osNBGQhKraE%q$=D=qUdnZq+vc35*UKuY`^Z|U+>%}R%QVWN z0=ah14HKfhV>D>!*{}hVaEa|&rSU=J^|U;8Mb%fuEalRlwJLit0=wBblHVWn8dE09 ze|e*U%ruqPh#2CaTlw%D;*oiz} zm#Tozd=Pw+CIV8s9j9P!#-VkQWgD zOqF<}(C0?Ay_8&IdX`l5cDJQHi+ii`RZd}u)0ydxo6X_Hp_{jk+-&gVq5!^#Pte+u zAlxHZoRFBI_|VJL%T6K4ml|mt@s5sy{=F(TDwk5k;Dc+8@jpN}M@!EpRa;MDUeo8X zFJRey!n{dCN5AC^TgZ>AxZQfr4#DEs6ir&}LP{mKwzAEyKi>_^l2BOT%BrZhCPNI{ zInxP`d4Mq!q4L%Qs#&h8H|a&Q$y4ZvP;B_hF2xQ{-CUNnrGX>ip$^E}R~UE|Z|;?i zZpuV&ZijixM#VH3-qS|idAq#1+edt#L&lRr`*^QmKyrd-e`kBAatjET*fD7b1HEq< zEYmG|WlsG03BK_Who1_4^Q@Vw(zd+zg(UbwnP28zMgkLGpTi#e^uq^4KjjKJ7F>nwn;T zfT^IUG0m*(C-ipP+H>uNE@!n$M>^>qfgVr@ZOI}<_O*R?woLGhF-)S#idOFqxqM%# zg@MSp1ofq1>`jqODNXC$PdBt#gDnD^OK0}%X|j{qz=MJDP3ZTLlSElfO~^#tZfahW z!q83kIfE*rD`NM%sag9qe&9~W1nzX&kUi`7w4}td^$={(AYXY!!YbUbOg=X^6gljk z9B2`yx_86Cp)e8W-XfJ&E44v4bpPl%uauoCHPyi; ztR>dmr*EZC*XkTzdD!pkkvg{6bm2dA-+!-Xjj*aKqI7cTYtwaIMtkzwdokHVP1>xP z2X+g-S|GGgA?aFYgmPKD9C+bQ-kh)m38Yx(_*PNDUe)jeKFdN}M;RJv-)`C{=xe@hAyc7(z@!(Dbr^2{c)4irth7^Chigo z5C7bKPyKZV?zP^B`}9;~ZaqgqWtR4PmchkRjg%k^Qa(>lPt$BAX!F*zorgv<8N^#J zMw=xe{^2g?5yF!C!iq1gXI!L>d&`6QmSMMLs;hQ5lp!0<%nDpTjP8)w%Q=AHNcc_)CC)y-GML81tfa`^E zZ7bFk_+oSEV)o^n;{eKCSzT*+ikV)XukN9h&9r;?v8NMlqr#xZ@Z%>gsRWTH__ZbN zR_TY!D$3$?LHV=Zw|q`KPl}JQ?CNI@WFWP(#yDS0A^ZP2qJC zN2{%^onW=_o4cQ}(wS9usw)mEmB!Nd$-X$a@XFF>tCykm4P_0=Oj1AJX zN=rnLB)LCr429X`xx&X={NMnwl*0?@Yt{TemGs^!)aKi;%^8=J*>RUAc{`22uRo zHU-$TfcJy3_a296t0v{uWwi7Coj2EGKk{EcyGQdN=-T8!DQhT2E%J&YLf|d+@3hGt z#=m7YFn^b+;owC6mf3g&=+R-@GG@!>QGX(bsdZCLZS4TwuYVFfLxzHa9-()2GVsjb z&hU93-3cl6&g81{i5049Ds@EK^2JpDzni5j|81a5A4D}SHJG{*1w!QN23>dtmP zt!$N$Ah|^Y04RmTsuM}2$gGM;Y(Hn}uS3B7guQ&EzPhC=(*==S>!gvm??LDLEMIdho?vNFwvz1UFE>}8IT zHRy&nl#lASQHGW2VxI&>uyV|z6+MH*lrNV6m;L(+$MYeg*=1VWB;vBBA}=S!UCC7k zPe%57jxxcmoS%kTRSfRvPppU#z_6^OOll?5>}*udkbbdRemh+yLjQ+z@I(5Ed9LrU z5e9XsJ_u5VY{vU+V(2ONSf$BTb|AfD=X^!Je?o(ey2Hki9{qqwAWx`c-254xb`)He z@Yy7en#N{N@rF4yu*&ZgZ32Q8;EGvroN)!kO$j8MhCcAd8cxcT-nm~)lXm|^Fq;$i z{&p&3^>tVfFMVy%yR=^!JM_OxKMI&~$ue0UC zJ_+c@XT``t1)dYa51AyI)$;Y_16iY&IoCKv>l;py9VI@dLY6*m&2PmfAr!>zsAbVC zJ7%{8Vj!j?e0Dwk(k>`rkwYvcXHL7jRv0m!2WkHLOrs<(S**#)Rl;dy_`=zz1EV!Z zmWJA7mZ*!&3%knE+Qlyr!VA29chY&%O^*IMzUwHLn-e^5{ZZLB;B5lKUnz%{i`f;g zZjKOF?I<2nuMpU?+b{4SD0;GxY1}XUK`<6(k#WE)t_5P$hAtX8|1d_Tn0|=MM}&N$ zB@lOE&6hLuhS}%6X1J%7+PsbE<;vO_)^{&-xkJxJn+whlX}Z!asq}_8?8n?yhVFXG z#`zvr%U9OCN=~VUR zQdtrd=P`LqVD>!)Sxu0ryIUHI)3JU^(oSWlOev%m{~6(~O`Oi|N1j#+q7JmmR;yd+ z`mK98?ivB->%-knN4J*l#0_4ibk;G|;U4JnZiB^Ua>Z=jQ^oJF%gxa#{$dc=y0=Gj zW#~Vu6{@B*x*fWXu9DvB7Od+@)I6Qs9?MrFi2uI71Pxznx~~m~Kw2GAF7A@Xb_Mni zQ}ypMw)U)Bmv62yT35Y}hJ5$DF4v-*4zJSrE_^G%0+-t|gB|DTyp4xG9oELGO!+C% z5MBEn(@#Q;jJ)-ZeX^B%O(|pi#Rv981(S5+x0A=SLPHEkRd;G$7i+!RnS<#b)jKAY zOs!{3(Mvk+2802DHdYB46_EnC<4tW9+hyEehSXI{QZ$54?gODo zM1Vgss9Q3_E_jpE*we&71>!uQ}Z){C4Uv5B-^OQ3RGan_A2Bj{E$!H zrMl=wa|ds#HK(og4X;*|jO6Sxfy5j(OZleBWla}b^oRM=;|A<(-5m@F@8m~9j!@hl z#D}fdOB206dK1R{ZZdGAplNZcP0loSd?iFDaq@al#neGF-fh3g^6hr6;sveS;z2{N zObmn&jQ4H=qKzo$$Wgp0MJ%o|b?Mq!hqUlw-zs?0rRP!ltzUHd$_XJO;7{;ZaTC?j)8d*vW~{O#j9e0}N%?#iYN?W~lqvm9@`slmXv{Pn(J6Gi zX$BL!61)ZTAhF~Vn}j{8=W zprdZ&qrF!d^qy^m*l-E@*fcoE1;XmDsdhm9wPj$S3_IUc&h0cZ%B%rLTD53`=Ydha z&XAwW^z9|`%Vuj<#q8pPt*^~ed@prYsoJ}TL#7XzP&Hq^YSTHOG#M~|r^(J1R-0ji zzE0(56ihkD#Uq$F;Zjs=Mr>6@2F0JX02rWf->qNS^GMNmM;jx)?rCh=R8&wCIt!LL zeDD~PX2A7yHMs%g+BsQPQV=efV`1E!YxQ9QWdlHqC}ozYKU`&1oWz2{LaEUC{jJ)r zwr8`cZA2|19#JHBa`ET{f{V4+t9DYu&2vPEwr`)Yy#S6!^Z-aA_CEMXzs#|g;`{tA z5l<20GXHY{oU$D2xG0FvwI+^HqR&dL$ngs}8A%U;bbPNu3_QXVZwnc`it|?g+9$Zn zMf(~eKbKNHR#o+?;m0aFlX$_#9%mw>?x}Ym%k&q4TDt^-G3)?2QJMj6mT0~}rLs1* z-hLIA&;Zf=iBc(@k@5$y@Fl@Sg_NiTnp$4G&NY-bL++RQ_=(yVTKA=iu?e#g;#oEm zGDV`+t!m?QQ$Yjb>$LAAdhppM$v6!z{DsH6!Nyw9i-kvD&EKRlbv8JLM@Q|?{ zK0>9@Nt;V1YlxGuXEtVc1}0nM>`E>f8#Ng3`l^z6mxeQ{;00 zr?u}4YpPqf#e!HtMFpj*^hi;9M-UKDLPuIq>AjbPY6B6aLm>1TdXy@VP^8xY0YXP= z=#efE;4JXl`<{Ehv(J6@bI$sghyLKDZyT)#XL50(wUrh@>gu^_0A8o*ca7#inNGC%>aJgv3po z+SP4HdaO@vylKq>Dm!sxIzRppa5q_RS2@;-0bM0CZ?C2ZTyU*q?+%VM zr7M1XPn?dqO)=1YmGmT(U-Xt_8pSlLpm8rVDo^S837z12 z?jG-1V%~sD&FMP#;Zzvo?Ar2aBM{#0Wq4Byeqv0F34YoIO;BgJk zHXhsgMp$f!l}I*jO=U2|a?i}tE%?k6T!tDXnZaV>*N)E#`QU z#v1K2YBNatCKMW0$U30c6!KY?q;_W_&22PQ-%3Ykh~_Yk*X+DWYSu6p=}=_y>AS+B z*kikX#Ms)QBQiK*?IhFuMlFOOU?Z68WG!@z)rPLYLPu`_W?-zH!vP$FS{wcV3og^a z#NSzTySUhdZaoFhmqQ=KXlBY|T9~7S4@Pyt|}4yUwhOF9#GV65%_KoRh@O z?(deFwHUx99GORl?|Ad3IwYAvExt-L+kI=><#g$@Z8PesnW)fa^SS)6ux`-QSQ391 z9OQVtlUdTYQ3w(lrP7 z5%DTGLj*N|?7Bp$swis?e@2=bUU3`VozYzYj%jxVPMM6jlRMO#l9p>X8E;KVV)F%$ z6{<-YOvwbC!5-GGs68Z1cEgX|VHp8{XC-K|-`r%VqM~9g^2ww*B<`CWJ$*>Lh2!sb z;UHhPM8#+R95>5rj5LZVzxYsg-D!-1#T2S}P(tmfPLNiA5lUxA5fIf9!{uaHfXY#D z_LaGSGRkNG8J{_mE%`{`9bP!OpxM@Brmfv!XxZ|+=b@z9e# zm3Lf?bgr-Me))XJWp7svWR3JID>Q1&OA>G~gKn>V#YZ1kFafF*Q})rz7D;X2PMdge z-G`)9>339(aOFEKw*o83fYmH-YUy|EY?|t2gZcPo{Iy{4s3h)w&@B;Ked*0VAy+N) z-y$x?vl}H@Fs@GZu5B%S8;!_!vLnSa8Od9bwUv?3!N@tojk%A0j(cY_{g%KTF(>W3lx7zB{8Hy_y;J`(x&4vxL<(jsbiUqi z_u7gi$-nnH*|7gt_NM}Msa_I|^?(|h?sz4U`5*Y}>dDB`D>Ff(LVUM(=3CNh>XJA8 zW}bR?nYcgovd)f(%c4GMpw{ywv9`Uc$u-+;lH88FAL;`k_v7LaXdU90+tNef;*RYU zfKIdRkLSC(xJ25Iqm{h8Gz@Mf3N%Xil0>+9co3X*O+ERW;~1|^o0@GKYl-iA3jr6_ zf4{(mUh8DYq+mj;P#vx`=U%V^^W!!X?9CCqSo*9?y@hGQmOJGaA?^)t&l8(!PpFy+N`edYfK zuI(>N-@EWVgP&drnp@I2qjpD2YsraAsH5bdc2}+Ws^C$Nz^AeVl18}8NmGt|%U+Hg zf&tghemM@&LfXy+OdK8VbVl8UO^F|V-SMZWN}LX}0F~*GJc?4Fd2l8%KuGq3JtALGwA6 zDXT|W((K%dAKq&D^v}!2>Ss5}b2&YW0NwC>e%wnk5zDOVx$bp@1&*bW>N59*J(d(f zx#&Mg?hU~bCGPP2NR@W3ZX0`B4M)$xtTu8hHT{$g751%@_?ApW?H~7Zunb1tXqtbM z%J(Me;#F3@J}mtrnc6w`Y~S2#lDSBBt}121B?;S@`PXVA8k#mwKd>T@OE*Tdzdiq= z9KOC9VgOJGgiikeZ_p=J6~n#1UAy{qIK&Ap_Wt2M(Y5k^(2ntiVMs(8qu+N@8K}~` zXz@u4XS;h0QNnMqaQ?;T!QIj|9O@w$3Q>)65RWh z>|tDOn49$_x1a0)#QdIX=%w0o4~loIYo?v3Xzi6(E3%pFv`#jL(falD(f9z#SL~RN z=2od%(_|Wmf?KY*e)CA{OL|0AEf&63o_WH&^Ozf=l)P<@*O}wa2j4CEqeG~T7HDm| zX}sRLZ#pz=g1Q}6ZHJ4GG;`CJdX>eRqCP|Nl)}+&4YFMAAF&=rD^p3KNljO3K*yCi z$+mHQXa6wgA zIs&ejVRk_TK{qqx#7W^$DZj9LH?ihvO0f)A6R2Ed#6YV+N7Qc3Gq~+KO_a_aM6&MG zld^`oa}L#AOSW4Da)PCpr>Zxz$EV0fN(;D){X+bke=i1$G-GAwg!yZ7=TJG3jr%Vk z{O!6{Zc?cbXra+hm&Ej<8O4L}AMW3&4+d?qW!AggiC8YC^ap-YqadZ@E%W7%EFO`| zpf0h4nZ_-@UAUi8&3;wQ5*;%e4eg_w^GY(7Z>v>{H5jvp)^R_b4%E#NYhKfy$tD3h zZX+68&=PJtLxH-H-Z1@oRUA&t?#h$!@%?%9op<;g%CjQquFAsx%c1y5W>Y?$w(hhL z{{@%|_(JGLf}3ElYi81L5pA<{5-B8QC_~dNl<}nry}?pte(g76P~9wn{|p5n(gfHN zFBio!cDEaOw=z5&4rMYA7gpUAuH9f}yF<$rp{rClEPIoAc)=V&Pvh5%dl2YO^oGwL zdd<1Kox`JT25bvn6+W}6e_j9TIhX){Dto@t{oOK;E7`TLAqD-P^PhiF_`ub8@8$+{ zOCs4vhc_l+e=K0kwXNfpQ%DVHlGHTok~B?ku$>|0RC-DNB5d@;sAM>lZc$v@Wo zZsfgAc{y$$D(6wGL3g!H=77C@u~yA@m`r4L6p0a^(3x&s9MGyT{xmT@`jhj?hmAb+ zlQ5yN?`(2M`ej&(LA3%hj+UDgAC32V;SpCZf4I2LGUTte&O;RK)9eRJ zPW6gEKHcEdlAokoDm@0D5}r@9S9w~mA5}T~jGeQZvvpi^uLK0DCSM)k>Q^ArG^Do65G>)6j`S*c;?RK25BsnRdD=UuThH*P?3&psTnpMN;pg zw=tRX7m_&2HXQ28{a(nOvn&;qRT# z$8j#%zQuncf=02>F(2+GA3=Y-Ne!#*0s^O}QE1|S!k^f9i!F^m`GxZ!YG+9@6fEPL z{N|WWjdw#S_g^M9X@_RT`o2A_G$P>aoyK%TyJ1jeZSA-JgbQ0Z-#jO8eI375T+q4X zy?NX)pIug=972TC>N>M>ac@IKvT)Q|AH8T5RX@v)dW$Dfy#hdzp6WDJ-)uA+ko9!?A@W#Vi4r<3!;jb7OqF)tXr$*!hKDbE$nTViD)fZn79@4QC6`xA;cC{pQ zfj31WO?vLbzB1X?vUQ#htl1m~EEV^LtPd18Ng0XWtZr3;O=u++_U+}?i_jY3wUsK1 zsTWF~41~`XUve!l#0x%89aMEQJ>nck4wVlRIk^HS)Sjt_N<)0@R(MdR1Cx)Io|tWy zUKa~nim@1vvd|-k_Q*?@3-dfs6Y7`bX+^Gl&r(AL9HyTbz-L|6irUSgOh}M!VK35LkkYOT2qwVZB|$QEA36uXd@a>ls&qpP$4OtjU4hn<(? zpnfy_?(qa`MR;aVn=LOd$A0@=2*KnAfIuK?5xcGg(e!|kkrC_IlG>G{WkCj7u_{R>v_m zP1~VgDq><{`W$aGhcNJ)1d52z3uAx&f;(J4SQHD5B~$0J_p8bux2fOOA3WOO=&|U^eR=?tf_zAQ(jM71#ovgU|9~_6@BY8+PRH{TE}nB8xA}!2 z!0ecxY~5s(pWcy@hkJ+w`f@;plBm|fQ3N=(z@D$o$?tWOdkAcPf3?{MrK z2L^tx%l^#H{;9fGXN#}Xhvb>_I_@9som*M)eZq9u9%@OPq=pu5h@^RV)%CTuq zM&HAPlcT!H$d&^Ej_XuheULMU&y2d*-q1w){m{d6e!WNG_t!*2hwiTAq$-;uR8MA% z52TzKar@FO_X;O~%BFsOc?_x5mf9=@M=CPzqc0w6saZx8TLdf?Ly-JTCwG{)eXVuS zKP~r-2tXRb!V7bq@g?Q#rDi=!njO>4p}483w7BcGe(}-vvCN^Nf(Nucqw26US)2zQuk;boQoaxeiY%Qf^^E9Cg4RN_nkP6#|FLG7Oyqo;0LYEP zch-66v)h$;BB53Y6kYr40}UjF#@PEIK#w*9vI?i=sDp_Qw6fK2d1@bW36ssHAlWwcAj~ErhfVD*#H0mxv13=w{ZV9 ze)nwyuorOxMQ=pGVzV3axdN0+@VjRZtFxUK4g0362S)m`Z%}k;awQ|DYP;ArF~Ke? zvCecWAcjl;dSm815PXl*GO+}9r2pfcs~Up6o0+y5f4wYsp?~!J5LdjV2G%t(kIi7S zvkj=ZW~s}g*7;dZx;hTcoEe$!Y!h6TtDS3KVSQ!g`Ol}q5D{bC2Zyh_30Xw|X;Vp5m*IOJ^grX--)cWR@Va1y5!yF@8q7e!5F1_bE#ZnHOeDOfgb^!(iYKm z{t)8Wd3=|5^dfoM@M$c6K{9G0QGx=j(FZhfWMiYrO9q)vTQK->_jy*rmO z5Z*Ao{le7Q!qBH%=?gpR_MSq@^LV=4f{aioWdO^B!3-4T(OoL6bQ5eJcS|y)1_OOO zb~c2oVuL(A9Kl*$r$Z1>oQ0|QSd^EQxkeBj^Hj~;kjCjBY&+<7&nQ!<8QL%9&Fn1Q ztFTEt(_e8Id&>Ju)nyBhQB?8z1s&(U@E>j2u;BQ||H1@ZAuJV#2>z+sy zLb_&C-0xR}GGxOR!5~x{nR?-(63(xzUPHV%A z>l5uyU6i(H%wzcyP*%M_l5)Kt8*SgSh*ta<8HeoWR_tGIff}^viaa2@pvI#-d9w@H zSvY|yb&4);*l1tU+7bu%YbRU0i#!@8GRg>amxVC$?{kKP417oLHp^S zI1$Tyr2oKWZH=RyZLK!VzHYYCCq=3}+MKT2VFWuRLw;O`2!#DNS zJ$8EEe;3grmrs! zJB_n+^Z|8AeoT+BqlT(`;w&|3t)b{}G_HW)Hm4Z1yxU8VXRu+Ps5AtE zv(WhRud}r7q8H}Q?eLlzfwWgZ?Kka4;Be6!qO;L$ZeT~OU zZan>Aui^3}o0KDu-3ZS16f$kNnV%>toC3(c2o=0ZHM@V!0=Q;e7kXKvf8=U$b&XYd zh+D0N9`a~8qwbHKU;1BVo&wrM3h!zc)r#4z3h*(tw1)EL;+_j81x2%8k-qxN=OTcP z#m0|GiHbsyel!KJp`4K*cjF3rD$Kgc&STZoVh!E)xdL9Q0%ujC-^+L0Y!D5-n#<#+!UxQ zymcd?+f_HsAda8I-#VY92fetJZg?iCroC#y0p(_k8yQ`{ z$7{us1Qc5N_3z_t)TZ%wwsySng<-yK#&J_+99#B`0`IYhuHDy0ZQF(FoQ3t;lA<`B zJsWGywVcYOoh~GxQlI~vgS#ry7G~K3Tg$Suk)5>wmlo%(oLFogfog>xVK0XTn}_#F zS|p1!Bff86QO*U0DKUb3_dku^RsK;EKSL#9pxSy(x$R7CbfP0&% zO(XUJLqG96PW5F*p{ASnD>2U7g1jc*-HU)yF*Flji)itJFO%Rif?j(=3w>8Bla&$! zmadZh{3Y|R5WVKQL)P;BB8v^4q9>=TKB^|tI!E5rKE~-5$+2Z7Hx_D{qp1vv1$`pK zjLTe@fy3Z!R0o|emnWc!&)u$vgETRj2B)&&PP%y|bK2x0X_n24C{6z12`^JJIvEzI z9lM*vt7p!}2TeOwO2)`-qqnaRpF$Dv1{4GCnTKnA`@I3dtBx2Cv0bO=#;J=vVgzVDMUQ z&6u>5*-}41(Y^gFVN?G&_yAPVXIrqjBPH@A z4PO#s%5%6P@&G_hob(7^iESsa=$UKCO5f*rQH~e)$($~AA5J1>J$_Y#yFbf1X=7o?Tj~Lq zpTf&1I`A9OS$YX#8H@qpUCKnC+f!=x&dUH1`cV?%zQs-|Vn*uXZK5O>9yxxywMdw! z^G=Sg><3SpA-=H?idzyBa{VzOPh}6iq`eK~ap6Jx=Fi2%*A_oG@QDPKA6WkASA8$= zV|P&~wEdg})eG0e_+xum@gQekvYKJp?iKsKQ4f}3>sx0xA~U+qCTk2Rt)S~kO?VL) zk1Bii6+{f4cEgl`pl!&f7I`vT))PYut|`+!pLrKfHuFK6a>WD2&yEG;v}@ zNyT#kCtkTan=U8r;hWYRM<2}C^X}lKL+$LjSDS2(uYufxmu7ON78e+LsEBUiOjcHR ze}Z0$sdw-mputJD~df0Z)^d_}E$`-+$rLVX$}VDnw{}yMA7XeY#e2_CC1r z?5gQhGHUf(F5%QzbDMBxZe*;!L&1}iMO7decHjZ;%sWU*E2{KbtrwnM+AGxecy^az ztYw?EW{A8}r*J8L^;A!&+xN=__CxVN*@Hg!SrN~X2v5WHjJJXG6Qf=b{<2HHE*Q6v zz;+b|u-@2Js!uKwk)yg-Hxy6R-02`&Lv7h`5uKmslG=B}O|jQ_!$BxTSbv>m4SVEw z_xCxkm@ETsv;3K@A)4JKnUNaks>t!eJYcz@-nx|eQC+hS{?m`>HQ`dd+v$)?Gt{h9 zv^qDJH8kwFzjvKj0CZQaha~=0$HpY)U$166ZkJ2}Si8Kj`D@QY<2a~}* z0Lv8H^^T5LlqrX1@`%QQH~{LZ52Q-OU?husvIEfmvHh1MCWr-X)x3ypub{FX>$TkV zN3VSfa-!OE;Bg*BJxBMfq#VPt=XM2&?eOgRDY>$}u6HA)KHZ8$QxE zg`V{h9zx!R9z%^@YUt70<$YCo=_IAq_RymW23)EA#;O!k#P4Fi!)6kOU!l^ygP2eU z|3UFl`<6nK4f8V5`BghtO1^kgG~j-HJf`I!oiJym%@l4VSv5^n!M1Ym6z1n=PnL+f z%zeIN@8FR4suz%P7URE{WX?JMJ8Ie8V1BZX=Wc3WF?+KZVrZ7l zS?GnXJqr6~rjZ>vjWfJH7-oZ1k1|L0Mx5gHq#%ne0Vq<4ZwDqOg_)VGg7l5wOqx4r z1KAUruK&gGto_ZxaH6L@j@N-WL?P&}67T>|LjMU8Wkg3Qi_5NlCF!E%PH8Ou+B3mFZvj8p`XEW; z@!dq<7)bS|&{(xkJix3-i}*a@yMJ9WZ>m9eJ}3KFX$i*scvWWw+wQ#yV|+9D#%*b< znEnQ2fUq~KvRP&*UcTk#I{WGKL{|B%{@z=?Q6%eX-1JVxz zOFTzGpz%DC?bGzkzMbVOmNn(`2^TLbkq4lp3XnfeZ4QXSl#QNZdo#;-4W*9+pa%>; zFI2=pe8ycEJB0rHZ}IZL(&j`)DRQ*i__llf;aSOpMOKK$R6S}}+FukXWz&T@j8UYX8;3l0YZflt>Pkw-pYcM6cR8Qi zVP%-TTxho5uNQ*T>!N}6t-U{anO_Es+2(YIRg)Tjd2E80=EKIV#I%_&dUC~iJNdCY#wuU}}hgBcXC4 zBFwwEIQkN24b}Hy(L0SxMthIkii!H$W(z4f@u(3t<4J@L6VIQ=Q9H{}`M{%ZSwQh( zHowHPdxznv(-&Y#XHa#78_6lWzIvxI9xbSdy&)9kw(ow!hOsubu~*zj@Qs7ETeFHr z{K4W&3sJBHP+F2|)r`WrTC~Pk8$8|%>aX9c^m6#q24xOvd5$T)6O4P~Ut{8-kaR$Gn!fX%7RU_Zk2Z(V7PjL5I__#sK)fb07=h46iRBV6! z&vFp2?~uT$f?WLR%R9Fg1|2=GbWmfBoyb4#m7a0rldlQMH`olF(4^YQ*|FW0_Q>|a zJ=ciUcQ&AgA*u}p7{-3HCes`+>72iP3M5QMb|zNo$z!b(If3~QH8yh5;2jUng@7LC zB+U8d_-B^&AU^)7Y6(T;9Esv3S#{MY1?>(dWUrTTl zhl2EC-Hm)hlEl110DrG7=eW`pfI{SLZ#bZE>pevA24jYJk! zHf369l}fkbcK~^jhaPm&2V1l#!r~XCZNo_W*Nb?z;v1aiP0cfGl2oT~Be7eYIM0HG zB>L)j+?v|*{q9&PJmM=T?0B_B{1U2r#KBnOaoWX(4mTEfuT^zfl264B)#b&ZJ{2s& zj2AcC4iBP9D|e_-Htq{%Ap{W?+D063tkJ?<)I^o-osgNOUcXGoClQru{c)ew>oSO0^l>*h|x>S-i>(w#4bMdYKsweF=ZNacS7H7xaYDrLS4#4#PYPvU GzWony-!3u$ literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md b/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md index 3915a3405f..06270361cd 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/memory-integrity.md @@ -22,17 +22,7 @@ ms.date: 02/20/2018 **Applies to:** - Windows 10, version 1709 +- Windows Server 2016 - - -**Audience** - -- Enterprise security administrators - - -**Manageability available with** - -- Windows Defender Security Center app -- Group Policy -- PowerShell +Memory integrity is a powerful system mitigation that leverages hardware virtualization and the Windows Hyper-V hypervisor to protect Windows kernel-mode processes against the injection and execution of malicious or unverified code. Code integrity validation is performed in a secure environment that is resistant to attack from malicious software, and page permissions for kernel mode are set and maintained by the Hyper-V hypervisor. Memory integrity helps block many types of malware from running on computers that run Windows 10 and Windows Server 2016. diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md index 35bbc6bfd0..61166e5854 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md @@ -15,8 +15,6 @@ ms.date: 10/20/2017 - Windows 10 - Windows Server 2016 -## Hardware, firmware, and software requirements for Windows Defender Device Guard - Computers must meet certain hardware, firmware, and software requirements in order to take adavantage of all of the virtualization-based security (VBS) features in Windows Defender Device Guard. Computers lacking these requirements can still be protected by Windows Defender Application Control (WDAC) policies—the difference is that those computers will not be as hardened against certain threats. For example, hardware that includes CPU virtualization extensions and SLAT will be hardened against malware that attempts to gain access to the kernel, but without protected BIOS options such as “Boot only from internal hard drive,” the computer could be booted (by a malicious person who has physical access) into an operating system on bootable media.