From 8cebc114a822ec6d9c27f1d5af82a507164b73b0 Mon Sep 17 00:00:00 2001
From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com>
Date: Fri, 11 Oct 2024 15:44:14 -0400
Subject: [PATCH] updates
---
...security-application-and-driver-control.md | 9 +++---
...lication-security-application-isolation.md | 2 +-
windows/security/book/conclusion.md | 5 ++--
windows/security/book/features-index.md | 2 +-
...ware-security-silicon-assisted-security.md | 26 ++++++++++++++----
windows/security/book/images/vbs-diagram.png | Bin 0 -> 566592 bytes
...erating-system-security-system-security.md | 6 ++--
7 files changed, 32 insertions(+), 18 deletions(-)
create mode 100644 windows/security/book/images/vbs-diagram.png
diff --git a/windows/security/book/application-security-application-and-driver-control.md b/windows/security/book/application-security-application-and-driver-control.md
index 97eb0855a0..03f9155e8e 100644
--- a/windows/security/book/application-security-application-and-driver-control.md
+++ b/windows/security/book/application-security-application-and-driver-control.md
@@ -32,23 +32,24 @@ Devices running previous versions of Windows 11 will have to be reset with a cle
## App Control for Business
-Your organization is only as secure as the applications that run on your devices. With application control, apps must earn trust to run, in contrast to an application trust model where all code is assumed trustworthy. By helping prevent unwanted or malicious code from running, application control is an important part of an effective security strategy. Many organizations cite application control as one of the most effective means of defending against executable file-based malware.
+Your organization is only as secure as the applications that run on your devices. With *application control*, apps must earn trust to run, in contrast to an application trust model where all code is assumed trustworthy. By helping prevent unwanted or malicious code from running, application control is an important part of an effective security strategy. Many organizations cite application control as one of the most effective means of defending against executable file-based malware.
-Windows 10 and above include App Control for Business (previously called Windows Defender Application Control) as well as AppLocker. App Control for Business is the next-generation app control solution for Windows and provides powerful control over what runs in your environment. Customers who were using AppLocker on previous versions of Windows can continue to use the feature as they consider whether to switch to App Control for Business for stronger protection.
+App Control for Business (previously called *Windows Defender Application Control*) and AppLocker are both included in Windows. App Control for Business is the next-generation app control solution for Windows and provides powerful control over what runs in your environment. Customers who were using AppLocker on previous versions of Windows can continue to use the feature as they consider whether to switch to App Control for Business for stronger protection.
-Customers using Microsoft Intune[\[9\]](conclusion.md#footnote9) to manage their devices are now able to configure App Control for Business in the admin console, including setting up Intune as a managed installer.
+Customers using Microsoft Intune to manage their devices are now able to configure App Control for Business in the admin console, including setting up Intune as a managed installer.
Customers can use some built-in options for App Control for Business or upload their own policy as an XML file for Intune to package and deploy.
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Application Control for Windows](/windows/security/application-security/application-control/windows-defender-application-control/wdac)
+- [Automatically allow apps deployed by a managed installer with App Control for Business](/windows/security/application-security/application-control/app-control-for-business/design/configure-authorized-apps-deployed-with-a-managed-installer)
## User Account Control
User Account Control (UAC) helps prevent malware from damaging a PC and enables organizations to deploy a better-managed desktop. With UAC, apps and tasks always run in the security context of a non-administrator account unless an administrator specifically authorizes administrator-level access to the system. UAC can block the automatic installation of unauthorized apps and prevent inadvertent changes to system settings.
-Organizations can use a device management solution like Microsoft Intune[\[9\]](conclusion.md#footnote9) to remotely configure UAC settings. For those without such a solution, settings can be adjusted directly on the device.
+Organizations can use a device management solution like Microsoft Intune to remotely configure UAC settings. For those without such a solution, settings can be adjusted directly on the device.
Enabling UAC helps prevent malware from altering PC settings and potentially gaining access to networks and sensitive data. UAC can also block the automatic installation of unauthorized
apps and prevent inadvertent changes to system settings.
diff --git a/windows/security/book/application-security-application-isolation.md b/windows/security/book/application-security-application-isolation.md
index b9a68056a0..97d0fab16c 100644
--- a/windows/security/book/application-security-application-isolation.md
+++ b/windows/security/book/application-security-application-isolation.md
@@ -74,7 +74,7 @@ These features can be set up using a device management solution such as Microsof
- [Intune setting for WSL][LINK-13]
- [Microsoft Defender for Endpoint plug-in for WSL][LINK-14]
-## Virtualization-based security enclave
+## Virtualization-based security enclaves
A **Virtualization-based security enclave** is a software-based trusted execution environment (TEE) inside a host application. VBS enclaves enable developers to use VBS to protect their application's secrets from admin-level attacks. VBS enclaves are available on Windows 10 onwards on both x64 and ARM64.
diff --git a/windows/security/book/conclusion.md b/windows/security/book/conclusion.md
index 067f25716d..f1089ebf05 100644
--- a/windows/security/book/conclusion.md
+++ b/windows/security/book/conclusion.md
@@ -17,9 +17,10 @@ New:
- [Config Refresh](operating-system-security-system-security.md#config-refresh)
- [Trusted signing](application-security-application-and-driver-control.md#trusted-signing)
-- [VBS Key Protection](identity-protection-advanced-credential-protection.md#vbs-key-protection)
-- [Virtualization-based security enclave](application-security-application-isolation.md#virtualization-based-security-enclave)
+- [VBS key protection](identity-protection-advanced-credential-protection.md#vbs-key-protection)
+- [Virtualization-based security enclaves](application-security-application-isolation.md#virtualization-based-security-enclaves)
- [Win32 app isolation](application-security-application-isolation.md#win32-app-isolation)
+- [Windows protected print mode](operating-system-security-system-security.md#windows-protected-print-mode)
Enhanced:
diff --git a/windows/security/book/features-index.md b/windows/security/book/features-index.md
index 7959d9daf5..52ce557b06 100644
--- a/windows/security/book/features-index.md
+++ b/windows/security/book/features-index.md
@@ -7,4 +7,4 @@ ms.date: 09/06/2024
# Features index
-[5G and eSIM](operating-system-security-network-security.md#5g-and-esim)
[Access management and control](identity-protection-advanced-credential-protection.md#access-management-and-control)
[Account lockout policies](identity-protection-advanced-credential-protection.md#account-lockout-policies)
[App containers](application-security-application-isolation.md#app-containers)
[App Control for Business](application-security-application-and-driver-control.md#app-control-for-business)
[Attack surface reduction rules](operating-system-security-virus-and-threat-protection.md#attack-surface-reduction-rules)
[BitLocker To Go](operating-system-security-encryption-and-data-protection.md#bitlocker-to-go)
[BitLocker](operating-system-security-encryption-and-data-protection.md#bitlocker)
[Bluetooth protection](operating-system-security-network-security.md#bluetooth-protection)
[Certificates](operating-system-security-system-security.md#certificates)
[Cloud-native device management](cloud-services-protect-your-work-information.md#cloud-native-device-management)
[Code signing and integrity](operating-system-security-system-security.md#code-signing-and-integrity)
[Common Criteria (CC)](security-foundation-certification.md#common-criteria-cc)
[Config Refresh](operating-system-security-system-security.md#config-refresh)
[Controlled folder access](operating-system-security-virus-and-threat-protection.md#controlled-folder-access)
[Credential Guard](identity-protection-advanced-credential-protection.md#credential-guard)
[Cryptography](operating-system-security-system-security.md#cryptography)
[Device Encryption](operating-system-security-encryption-and-data-protection.md#device-encryption)
[Device health attestation](operating-system-security-system-security.md#device-health-attestation)
[Domain Name System (DNS) security](operating-system-security-network-security.md#domain-name-system-dns-security)
[Email encryption](operating-system-security-encryption-and-data-protection.md#email-encryption)
[Encrypted hard drive](operating-system-security-encryption-and-data-protection.md#encrypted-hard-drive)
[Enhanced phishing protection in Microsoft Defender SmartScreen](identity-protection-passwordless-sign-in.md#enhanced-phishing-protection-in-microsoft-defender-smartscreen)
[Enhanced Sign-in Security (ESS)](identity-protection-passwordless-sign-in.md#enhanced-sign-in-security-ess)
[Exploit protection](operating-system-security-virus-and-threat-protection.md#exploit-protection)
[Federal Information Processing Standard (FIPS)](security-foundation-certification.md#federal-information-processing-standard-fips)
[Federated sign-in](identity-protection-passwordless-sign-in.md#federated-sign-in)
[FIDO2](identity-protection-passwordless-sign-in.md#fido2)
[Find my device](cloud-services-protect-your-personal-information.md#find-my-device)
[Kernel Direct Memory Access (DMA) protection](hardware-security-silicon-assisted-security.md#kernel-direct-memory-access-dma-protection)
[Kiosk mode](operating-system-security-system-security.md#kiosk-mode)
[Local Security Authority (LSA) protection](identity-protection-advanced-credential-protection.md#local-security-authority-lsa-protection)
[Microsoft Account](cloud-services-protect-your-personal-information.md#microsoft-account)
[Microsoft Authenticator](identity-protection-passwordless-sign-in.md#microsoft-authenticator)
[Microsoft Azure Attestation Service](cloud-services-protect-your-work-information.md#microsoft-azure-attestation-service)
[Microsoft Defender Antivirus](operating-system-security-virus-and-threat-protection.md#microsoft-defender-antivirus)
[Microsoft Defender for Endpoint](operating-system-security-virus-and-threat-protection.md#microsoft-defender-for-endpoint)
[Microsoft Defender SmartScreen](operating-system-security-virus-and-threat-protection.md#microsoft-defender-smartscreen)
[Microsoft Entra ID](cloud-services-protect-your-work-information.md#microsoft-entra-id)
[Microsoft Intune](cloud-services-protect-your-work-information.md#microsoft-intune)
[Microsoft Offensive Research and Security Engineering](security-foundation-offensive-research.md#microsoft-offensive-research-and-security-engineering)
[Microsoft Pluton security processor](hardware-security-hardware-root-of-trust.md#microsoft-pluton-security-processor)
[Microsoft security baselines](cloud-services-protect-your-work-information.md#microsoft-security-baselines)
[Microsoft Security Development Lifecycle (SDL)](security-foundation-offensive-research.md#microsoft-security-development-lifecycle-sdl)
[Microsoft vulnerable driver blocklist](application-security-application-and-driver-control.md#microsoft-vulnerable-driver-blocklist)
[Network protection](operating-system-security-virus-and-threat-protection.md#network-protection)
[OneDrive for personal](cloud-services-protect-your-personal-information.md#onedrive-for-personal)
[OneDrive for work or school](cloud-services-protect-your-work-information.md#onedrive-for-work-or-school)
[OneDrive Personal Vault](cloud-services-protect-your-personal-information.md#onedrive-personal-vault)
[OneFuzz service](security-foundation-offensive-research.md#onefuzz-service)
[Personal data encryption (PDE)](operating-system-security-encryption-and-data-protection.md#personal-data-encryption-pde)
[Privacy dashboard and report](privacy-controls.md#privacy-dashboard-and-report)
[Privacy resource usage](privacy-controls.md#privacy-resource-usage)
[Privacy transparency and controls](privacy-controls.md#privacy-transparency-and-controls)
[Remote Credential Guard](identity-protection-advanced-credential-protection.md#remote-credential-guard)
[Remote Wipe](cloud-services-protect-your-work-information.md#remote-wipe)
[Secure Future Initiative (SFI)](security-foundation-offensive-research.md#secure-future-initiative-sfi)
[Secured kernel](hardware-security-silicon-assisted-security.md#secured-kernel)
[Secured-core PC](hardware-security-silicon-assisted-security.md#secured-core-pc)
[Server Message Block file services](operating-system-security-network-security.md#server-message-block-file-services)
[Smart App Control](application-security-application-and-driver-control.md#smart-app-control)
[Smart cards](identity-protection-passwordless-sign-in.md#smart-cards)
[Software bill of materials (SBOM)](security-foundation-secure-supply-chain.md#software-bill-of-materials-sbom)
[Tamper protection](operating-system-security-virus-and-threat-protection.md#tamper-protection)
[Token protection](identity-protection-advanced-credential-protection.md#token-protection)
[Transport Layer Security (TLS)](operating-system-security-network-security.md#transport-layer-security-tls)
[Trusted Boot (Secure Boot + Measured Boot)](operating-system-security-system-security.md#trusted-boot-secure-boot--measured-boot)
[Trusted Platform Module (TPM)](hardware-security-hardware-root-of-trust.md#trusted-platform-module-tpm)
[Trusted signing](application-security-application-and-driver-control.md#trusted-signing)
[Universal Print](cloud-services-protect-your-work-information.md#universal-print)
[User Account Control](application-security-application-and-driver-control.md#user-account-control)
[VBS key protection](identity-protection-advanced-credential-protection.md#vbs-key-protection)
[Virtual private networks (VPN)](operating-system-security-network-security.md#virtual-private-networks-vpn)
[Web sign-in](identity-protection-passwordless-sign-in.md#web-sign-in)
[Wi-Fi connections](operating-system-security-network-security.md#wi-fi-connections)
[Win32 app isolation](application-security-application-isolation.md#win32-app-isolation)
[Windows App software development kit (SDK)](security-foundation-secure-supply-chain.md#windows-app-software-development-kit-sdk)
[Windows Autopatch](cloud-services-protect-your-work-information.md#windows-autopatch)
[Windows Autopilot](cloud-services-protect-your-work-information.md#windows-autopilot)
[Windows diagnostic data processor configuration](privacy-controls.md#windows-diagnostic-data-processor-configuration)
[Windows enrollment attestation](cloud-services-protect-your-work-information.md#windows-enrollment-attestation)
[Windows Firewall](operating-system-security-network-security.md#windows-firewall)
[Windows Hello for Business](identity-protection-passwordless-sign-in.md#windows-hello-for-business)
[Windows Hello](identity-protection-passwordless-sign-in.md#windows-hello)
[Windows Insider and Bug Bounty program](security-foundation-offensive-research.md#windows-insider-and-bug-bounty-program)
[Windows Local Administrator Password Solution (LAPS)](cloud-services-protect-your-work-information.md#windows-local-administrator-password-solution-laps)
[Windows presence sensing](identity-protection-passwordless-sign-in.md#windows-presence-sensing)
[Windows protected print](operating-system-security-system-security.md#windows-protected-print)
[Windows Sandbox](application-security-application-isolation.md#windows-sandbox)
[Windows security policy settings and auditing](operating-system-security-system-security.md#windows-security-policy-settings-and-auditing)
[Windows security settings](operating-system-security-system-security.md#windows-security-settings)
[Windows Subsystem for Linux (WSL)](application-security-application-isolation.md#windows-subsystem-for-linux-wsl)
[Windows Update for Business](cloud-services-protect-your-work-information.md#windows-update-for-business)
+[5G and eSIM](operating-system-security-network-security.md#5g-and-esim)
[Access management and control](identity-protection-advanced-credential-protection.md#access-management-and-control)
[Account lockout policies](identity-protection-advanced-credential-protection.md#account-lockout-policies)
[App containers](application-security-application-isolation.md#app-containers)
[App Control for Business](application-security-application-and-driver-control.md#app-control-for-business)
[Attack surface reduction rules](operating-system-security-virus-and-threat-protection.md#attack-surface-reduction-rules)
[BitLocker To Go](operating-system-security-encryption-and-data-protection.md#bitlocker-to-go)
[BitLocker](operating-system-security-encryption-and-data-protection.md#bitlocker)
[Bluetooth protection](operating-system-security-network-security.md#bluetooth-protection)
[Certificates](operating-system-security-system-security.md#certificates)
[Cloud-native device management](cloud-services-protect-your-work-information.md#cloud-native-device-management)
[Code signing and integrity](operating-system-security-system-security.md#code-signing-and-integrity)
[Common Criteria (CC)](security-foundation-certification.md#common-criteria-cc)
[Config Refresh](operating-system-security-system-security.md#config-refresh)
[Controlled folder access](operating-system-security-virus-and-threat-protection.md#controlled-folder-access)
[Credential Guard](identity-protection-advanced-credential-protection.md#credential-guard)
[Cryptography](operating-system-security-system-security.md#cryptography)
[Device Encryption](operating-system-security-encryption-and-data-protection.md#device-encryption)
[Device health attestation](operating-system-security-system-security.md#device-health-attestation)
[Domain Name System (DNS) security](operating-system-security-network-security.md#domain-name-system-dns-security)
[Email encryption](operating-system-security-encryption-and-data-protection.md#email-encryption)
[Encrypted hard drive](operating-system-security-encryption-and-data-protection.md#encrypted-hard-drive)
[Enhanced phishing protection in Microsoft Defender SmartScreen](identity-protection-passwordless-sign-in.md#enhanced-phishing-protection-in-microsoft-defender-smartscreen)
[Enhanced Sign-in Security (ESS)](identity-protection-passwordless-sign-in.md#enhanced-sign-in-security-ess)
[Exploit protection](operating-system-security-virus-and-threat-protection.md#exploit-protection)
[Federal Information Processing Standard (FIPS)](security-foundation-certification.md#federal-information-processing-standard-fips)
[Federated sign-in](identity-protection-passwordless-sign-in.md#federated-sign-in)
[FIDO2](identity-protection-passwordless-sign-in.md#fido2)
[Find my device](cloud-services-protect-your-personal-information.md#find-my-device)
[Kernel Direct Memory Access (DMA) protection](hardware-security-silicon-assisted-security.md#kernel-direct-memory-access-dma-protection)
[Kiosk mode](operating-system-security-system-security.md#kiosk-mode)
[Local Security Authority (LSA) protection](identity-protection-advanced-credential-protection.md#local-security-authority-lsa-protection)
[Microsoft Account](cloud-services-protect-your-personal-information.md#microsoft-account)
[Microsoft Authenticator](identity-protection-passwordless-sign-in.md#microsoft-authenticator)
[Microsoft Azure Attestation Service](cloud-services-protect-your-work-information.md#microsoft-azure-attestation-service)
[Microsoft Defender Antivirus](operating-system-security-virus-and-threat-protection.md#microsoft-defender-antivirus)
[Microsoft Defender for Endpoint](operating-system-security-virus-and-threat-protection.md#microsoft-defender-for-endpoint)
[Microsoft Defender SmartScreen](operating-system-security-virus-and-threat-protection.md#microsoft-defender-smartscreen)
[Microsoft Entra ID](cloud-services-protect-your-work-information.md#microsoft-entra-id)
[Microsoft Intune](cloud-services-protect-your-work-information.md#microsoft-intune)
[Microsoft Offensive Research and Security Engineering](security-foundation-offensive-research.md#microsoft-offensive-research-and-security-engineering)
[Microsoft Pluton security processor](hardware-security-hardware-root-of-trust.md#microsoft-pluton-security-processor)
[Microsoft security baselines](cloud-services-protect-your-work-information.md#microsoft-security-baselines)
[Microsoft Security Development Lifecycle (SDL)](security-foundation-offensive-research.md#microsoft-security-development-lifecycle-sdl)
[Microsoft vulnerable driver blocklist](application-security-application-and-driver-control.md#microsoft-vulnerable-driver-blocklist)
[Network protection](operating-system-security-virus-and-threat-protection.md#network-protection)
[OneDrive for personal](cloud-services-protect-your-personal-information.md#onedrive-for-personal)
[OneDrive for work or school](cloud-services-protect-your-work-information.md#onedrive-for-work-or-school)
[OneDrive Personal Vault](cloud-services-protect-your-personal-information.md#onedrive-personal-vault)
[OneFuzz service](security-foundation-offensive-research.md#onefuzz-service)
[Personal data encryption (PDE)](operating-system-security-encryption-and-data-protection.md#personal-data-encryption-pde)
[Privacy dashboard and report](privacy-controls.md#privacy-dashboard-and-report)
[Privacy resource usage](privacy-controls.md#privacy-resource-usage)
[Privacy transparency and controls](privacy-controls.md#privacy-transparency-and-controls)
[Remote Credential Guard](identity-protection-advanced-credential-protection.md#remote-credential-guard)
[Remote Wipe](cloud-services-protect-your-work-information.md#remote-wipe)
[Secure Future Initiative (SFI)](security-foundation-offensive-research.md#secure-future-initiative-sfi)
[Secured kernel](hardware-security-silicon-assisted-security.md#secured-kernel)
[Secured-core PC](hardware-security-silicon-assisted-security.md#secured-core-pc)
[Server Message Block file services](operating-system-security-network-security.md#server-message-block-file-services)
[Smart App Control](application-security-application-and-driver-control.md#smart-app-control)
[Smart cards](identity-protection-passwordless-sign-in.md#smart-cards)
[Software bill of materials (SBOM)](security-foundation-secure-supply-chain.md#software-bill-of-materials-sbom)
[Tamper protection](operating-system-security-virus-and-threat-protection.md#tamper-protection)
[Token protection](identity-protection-advanced-credential-protection.md#token-protection)
[Transport Layer Security (TLS)](operating-system-security-network-security.md#transport-layer-security-tls)
[Trusted Boot (Secure Boot + Measured Boot)](operating-system-security-system-security.md#trusted-boot-secure-boot--measured-boot)
[Trusted Platform Module (TPM)](hardware-security-hardware-root-of-trust.md#trusted-platform-module-tpm)
[Trusted signing](application-security-application-and-driver-control.md#trusted-signing)
[Universal Print](cloud-services-protect-your-work-information.md#universal-print)
[User Account Control](application-security-application-and-driver-control.md#user-account-control)
[VBS key protection](identity-protection-advanced-credential-protection.md#vbs-key-protection)
[Virtual private networks (VPN)](operating-system-security-network-security.md#virtual-private-networks-vpn)
[Virtualization-based security enclaves](application-security-application-isolation.md#virtualization-based-security-enclaves)
[Web sign-in](identity-protection-passwordless-sign-in.md#web-sign-in)
[Wi-Fi connections](operating-system-security-network-security.md#wi-fi-connections)
[Win32 app isolation](application-security-application-isolation.md#win32-app-isolation)
[Windows App software development kit (SDK)](security-foundation-secure-supply-chain.md#windows-app-software-development-kit-sdk)
[Windows Autopatch](cloud-services-protect-your-work-information.md#windows-autopatch)
[Windows Autopilot](cloud-services-protect-your-work-information.md#windows-autopilot)
[Windows diagnostic data processor configuration](privacy-controls.md#windows-diagnostic-data-processor-configuration)
[Windows enrollment attestation](cloud-services-protect-your-work-information.md#windows-enrollment-attestation)
[Windows Firewall](operating-system-security-network-security.md#windows-firewall)
[Windows Hello for Business](identity-protection-passwordless-sign-in.md#windows-hello-for-business)
[Windows Hello](identity-protection-passwordless-sign-in.md#windows-hello)
[Windows Insider and Bug Bounty program](security-foundation-offensive-research.md#windows-insider-and-bug-bounty-program)
[Windows Local Administrator Password Solution (LAPS)](cloud-services-protect-your-work-information.md#windows-local-administrator-password-solution-laps)
[Windows presence sensing](identity-protection-passwordless-sign-in.md#windows-presence-sensing)
[Windows protected print mode](operating-system-security-system-security.md#windows-protected-print-mode)
[Windows Sandbox](application-security-application-isolation.md#windows-sandbox)
[Windows security policy settings and auditing](operating-system-security-system-security.md#windows-security-policy-settings-and-auditing)
[Windows security settings](operating-system-security-system-security.md#windows-security-settings)
[Windows Subsystem for Linux (WSL)](application-security-application-isolation.md#windows-subsystem-for-linux-wsl)
[Windows Update for Business](cloud-services-protect-your-work-information.md#windows-update-for-business)
diff --git a/windows/security/book/hardware-security-silicon-assisted-security.md b/windows/security/book/hardware-security-silicon-assisted-security.md
index 0e07746026..7ff7ad6c2b 100644
--- a/windows/security/book/hardware-security-silicon-assisted-security.md
+++ b/windows/security/book/hardware-security-silicon-assisted-security.md
@@ -15,19 +15,33 @@ In addition to a modern hardware root-of-trust, there are multiple capabilities
To secure the kernel, we have two key features: Virtualization-based security (VBS) and hypervisor-protected code integrity (HVCI). All Windows 11 devices support HVCI and most new devices come with VBS and HVCI protection turned on by default.
-**Virtualization-based security (VBS)**, also known as core isolation, is a critical building block in a secure system. VBS uses hardware virtualization features to host a secure kernel separated from the operating system. This means that even if the operating system is compromised, the secure kernel is still protected. The isolated VBS environment protects processes, such as security solutions and credential managers, from other processes running in memory. Even if malware gains access to the main OS kernel, the hypervisor and virtualization hardware help prevent the malware from executing unauthorized code or accessing platform secrets in the VBS environment. VBS
+### Virtualization-based security (VBS)
+
+:::row:::
+ :::column:::
+ Virtualization-based security (VBS), also known as core isolation, is a critical building block in a secure system. VBS uses hardware virtualization features to host a secure kernel separated from the operating system. This means that even if the operating system is compromised, the secure kernel is still protected. The isolated VBS environment protects processes, such as security solutions and credential managers, from other processes running in memory. Even if malware gains access to the main OS kernel, the hypervisor and virtualization hardware help prevent the malware from executing unauthorized code or accessing platform secrets in the VBS environment. VBS
implements virtual trust level 1 (VTL1), which has higher privilege than the virtual trust level 0 (VTL0) implemented in the main kernel.
Since more privileged virtual trust levels (VTLs) can enforce their own memory protections, higher VTLs can effectively protect areas of memory from lower VTLs. In practice, this allows a lower VTL to protect isolated memory regions by securing them with a higher VTL. For example, VTL0 could store a secret in VTL1, at which point only VTL1 could access it. Even if VTL0 is compromised, the secret would be safe.
-
-**Hypervisor-protected code integrity (HVCI)**, also called memory integrity, uses VBS to run Kernel Mode Code Integrity (KMCI) inside the secure VBS environment instead of the main Windows kernel. This helps prevent attacks that attempt to modify kernel-mode code for things like drivers. The KMCI checks that all kernel code is properly signed and hasn't been tampered with before it's allowed to run. HVCI ensures that only validated code can be executed in kernel mode. The hypervisor uses processor virtualization extensions to enforce memory protections that prevent kernel-mode software from executing code that hasn't been first validated by the code integrity subsystem. HVCI protects against common attacks like WannaCry that rely on the ability to inject malicious code into the kernel. HVCI can prevent injection of malicious kernel-mode code even when drivers and other kernel-mode software have bugs.
-
-With new installs of Windows 11, OS support for VBS and HVCI is turned on by default for all devices that meet prerequisites.
+ :::column-end:::
+ :::column:::
+:::image type="content" source="images/vbs-diagram.png" alt-text="Diagram of VBS architecture." lightbox="images/vbs-diagram.png"" border="false":::
+ :::column-end:::
+:::row-end:::
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs)
- [Enable virtualization-based protection of code integrity](../hardware-security/enable-virtualization-based-protection-of-code-integrity.md)
+
+### Hypervisor-protected code integrity (HVCI)
+
+Hypervisor-protected code integrity (HVCI), also called memory integrity, uses VBS to run Kernel Mode Code Integrity (KMCI) inside the secure VBS environment instead of the main Windows kernel. This helps prevent attacks that attempt to modify kernel-mode code for things like drivers. The KMCI checks that all kernel code is properly signed and hasn't been tampered with before it's allowed to run. HVCI ensures that only validated code can be executed in kernel mode. The hypervisor uses processor virtualization extensions to enforce memory protections that prevent kernel-mode software from executing code that hasn't been first validated by the code integrity subsystem. HVCI protects against common attacks like WannaCry that rely on the ability to inject malicious code into the kernel. HVCI can prevent injection of malicious kernel-mode code even when drivers and other kernel-mode software have bugs.
+
+With new installs of Windows 11, OS support for VBS and HVCI is turned on by default for all devices that meet prerequisites.
+
+:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
+
- [Hypervisor-protected Code Integrity (HVCI)](/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity)
### Hardware-enforced stack protection
@@ -36,7 +50,7 @@ Hardware-enforced stack protection integrates software and hardware for a modern
Application code includes a program processing stack that hackers seek to corrupt or disrupt in a type of attack called *stack smashing*. When defenses like executable space protection began thwarting such attacks, hackers turned to new methods like return-oriented programming. Return-oriented programming, a form of advanced stack smashing, can bypass defenses, hijack the data stack, and ultimately force a device to perform harmful operations. To guard against these control-flow hijacking attacks, the Windows kernel creates a separate *shadow stack* for return addresses. Windows 11 extends stack protection capabilities to provide both user mode and kernel mode support.
-**Hypervisor-enforced paging translation (HVPT)** is an overall security enhancement for the system. HVPT protects linear address translations from being tampered with, to protect sensitive system structures from write-what-where attacks. HVPT will be available on x64 machines as of Fall 2024.
+🆕 Starting in windows 11, version 24H2, **Hypervisor-enforced paging translation (HVPT)** is a security enhancement for the system. HVPT protects linear address translations from being tampered with, to protect sensitive system structures from write-what-where attacks.
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
diff --git a/windows/security/book/images/vbs-diagram.png b/windows/security/book/images/vbs-diagram.png
new file mode 100644
index 0000000000000000000000000000000000000000..c8a27ea370bde0fd25c315195e2b1ee522ab1153
GIT binary patch
literal 566592
zcmd42XH-+s5;jZ+DI!SkQbeUouR#z{>7atrgebjAuaPcNf=X`zQ9!DIfJg~7p%>{j
zK`ThnTKJeyiXt8NNUlJ)JSA{byo0hZv+yRq-Ly9EhGg-s$JD17PhiQwbcoczgIOWIwJcD~Pt0nS#k1_#>O|!NBzTxr1JtZ?q&5bp%OkQpMG7v~qq!}ug8VKK?OVOH6@wd<
z1^<$VC@ezO@~4IIKV$@%&156-w?q}q{@(?nMo{uAGSUPmspz=KPtTdluaC43$zR2CY
zr`Q7rF8BToVT5YvuMXDi9O$)IAg%v-zHUV<;@M{y2eb%BcD$g`LAH_kRphFrjV5g=)pveMQMl{~Oo8+9S%13vjr4(f9wB4aSkk
z|2BO_hNb*5nbvKgaHog`8r;}xp%4z-JzlX(0
zLqW*HZ~uSMU2^_aR=+?j1QUBS1HYWvnB2qf?)?E>76M5b^P<6*TUPog&wWA2f#6Y@
zTX5{ZQSN@TI!m_7s|Z>Vy6S=(*c&>91Hq1t0rCH|pMC*1ev#WUL}ZZ`*ryE)M{^F{
zd4%X)hXPn=;6JRn5uw@4mU#dMv&cqkHM3Pzrd=QbEVr@o2r{0G%TYvD^!b&?Mx4G~
z`6xi*93k86Vg9WAs04mqa-;=0(mG;cqpI5rIc*r^D*UJV8)$9tqD;9SI%=OaK0X0;
z(S+LSU;6726P+tJ9F1?BLV(kaa9Wl1?1g_h%2y5T8t(?Vn1P;mFAbkiSz(F(;nXI}
zO)*xNfGsJ?sEXhnr+>TfsCGj(1TDMHeVGqAD(e5|URq{#B%*77}PyL
zU$h_)q<6XZkjsfw
zFnXz{%<7bFtwF`%Drf~pqlp--l=25;F@JTF
zBTQa%c>YG&@Exg;Ls`fn_KR4)pBsQvvjXJw-p;tS+X#n
z8&H?!xGC6Wx_N$dJd-~KLKb0}pg?b_&0dFr=K_5kvM-iPf?65?;Atg5MZE4@`8?C2KYpogE3R
z)~Cdh#j{-gcojVQi?12=8HSv!*=y&Ot6`O29}lY0Wc5Or2=v}mM`S<;egs#{b7d-4
zG?kCJPi%%;T!$y;!_WHNRC*?MhmpA-tGP2%-Qwfx@fiu_O+K|+Y@VQROjo*EE*ux9
z?MwvX6lNA!Dt_nwe&(+9W>E>j9(q*i>S}h
zpp0#t>zNV!+y3pBO31MXj
zz1*Bo3~0J%dvVMKFL!a@W@-ah`pJxgnFqiapR08;uAGslp#_e1L$0}oqvthFbMrRqcpN>b(fT^aR)KSiQFm6al`F+QSxP+tG
zfC*<*CdcJpYtC#5pFml#vpBEXTsWh)o68r_%90Kzx_xp%u2;xA9PRA+ild>RF11L|
zM|!s0Qkie&shfE>juS<_kYRZmTfqbcWBPCu(RC
zFl==e&lR*Sp%!v`pN=Sgf(I)7I6?#XC!OlnVDWJ6gfwb|(%(>%Kx!+JTRtZt;m5AT
zYSj=Sg{VcNn_T?Nw>)*dR{+D&af2af{}9AM9{L&(Qc?~(Z{5Z<>KW4+y}E*I+!@NnY^j3cr{Wd
zF;?6TTrx8*Qq9ZRPp=#uKT%>+Yqf{j8Ye?i_?_OaKniF1ww{ddxGP#>E+no3dACR1
z9ZmlM`u<(V0X@*8hK4(cN=`Ssx6rn7Ca~SkF6*I%oBOtx`_6~ybnYyH^|}o!J9d3V
z?pEaI-76?lWXP$pl0a|B-cIdbPoEz*H}2MdxSZT$pYGhOZeaKIcVPA%+#PE4CT~gD
z^KELimO>PrQ67S`!Rsr+kliDnLB6kbUdJq)Rx=zkn77Zvw_htA_B!3qnY*kisqyh)
z3+4_CU6H_9m6-Tsas)GL!RLp!o=MD9oMOG5!oiI`R7-PuM_{G_Xj9GZOZXfIR5t-T
z%}6`(A)(sLi967@H63?)JB5?GK?1cxhO7}{vh#goE@bIjXSh4P^9j&CpKu-78^|%RiJ5$n=O^cyUq9yY!N1
zN}zeo_5QZkp|zX4`AF-oqOj|fyHMj;?U94;@J5oz&7l%TB`=`-TWufWBq&vg_lt_CzP|KHDPT0
z#m>&D*c6iHrEmE3`)1`IV_CV~yCh^gGPfLUP>e38O#G*l!ARi8X}d;JNyT)z*!`WS}jDF3(_q
zymIQirm}}qI9kBzLu#?$dD!EThJTCFwjJRC&(^EmLp67-3$T|(hoiMX!8&hn2&#Tc32rv)9<;J
zI-!adeK9)Y_u58@?8r1g*S9unxJ*&pb=Y__Jhk+$4-S~$yPU7)nsRjvF#DSmaNmn>
zkz<)7ViSktFJ+}hcErsG6WcO=ZJ{CnK1TF?-YZ@LWR|E-g
zva5LRc~;lqoP1aI=ZQ{pW|Vx<+s(M2e;FhCN&fZk>>S4*ljs^Ga-gP{X?yyU!&m6c
zj`%
zHgq^2`mR!3)iARV=M#GTmr8GNv1Q(qu7^A&_SUsTe@t@Hcnac^ckmsvKPB~2{EdX?
zDByprDa!<02mWS_+~mLQK3ah{-oppyI3_#SQ1~5GLF$)4ra`w0W|2+i2-Bm>i^K_C!OJWc7CsdM8;Rn|xoOa}nQteVS>C`Icq1Y|v<)
z9T|gNOyS(5-BU>Mi9CLK^hoA!&N@$ZMTMJ>mm36q;OwC03G~YruE@v1N3ZyEpuK$T
z=;Hnti;`X=zV0Mryf*7QSG;>y7bwnjRs`5otf2886?3gW59cJ=NC&Y8re9mH;`r)C
zn&S7rDdjvfn}-wb=uFv)L4hf?VK1WSxC?6zz0%tGZCqN&Nz+YfI5pdGZ=)~9A{D*skPtXDhvz-F?<30P*6OHt*|
zq`_8yVuA1DtHrRXW9wF^_BZ4agd*|44sv4mR+Baq^K(yKqI&1>h95Kpyp0LC
z@%!iBAmf{bidQ~=s^Da1Mce%V8GGOX(oXULJw`xe5ch!}f<{NzUv=N~G3{
zXeCbef=#cpK)9Lm=kbJbT4c6{v9G?jsHs8kbv0=rke&`doe6FjaOGs0R
z3Fyn8Bg&^F)g@xA>0o3AJAXX*X-^rz#sLR5-T8V64UX0F!U;Z;j+
z4rrFriQP$*GVI`U)TNVk9{4o+
zSZ!lH@(sIan&Kvgx=kZa-O@n`^92x^i^;)__)5$3x>e*aL_@HA+9k>Cek4>;B_l`w
z)HUfO%5h|dKh_)V7C*+cmE-yBOqe##!xwJjEoL25tMuw@WnMzaEk$cS8XIzzLH+1<
z`dXcZqd#XsPfxC9LNWP)YvP&L)dEAzMR{eKto~26PVC8lN^M8h23N!3-!+?ml}7%r
zWw-yQYl8nbaQgo)n~qTZ`DexLUxl2B4qCCif7PA-)0pU7zJKz!VDx|F|D~em|4qRw
zg7y!MzWhgt3BCU~_TMf&+T6GaI!Wgiq^AqP^7J_ia?N*PFZO8<+x;uiw7Q7O{K1tr
zAKRax1a%-^i~|O6SlDG^Gz&YLeO&iFIXX@yL?1i2fis0;3jOCVI1fC;Kd(;I9#I$t
zS2}y;t=)vnMZe8B(k-^zu8T87W;njRz+&ad)**cDd7J9`9F8Tp-ShPLJ6qwkDiRq@
z{-37<*^i~yJb%gn#F>`t+(=#)J4F-ukfk~^m^S!zaG>Om!ZXBZ%2e0#^t#xEL8G_G
zL%^7|E_JJj@5S*Wk?j)t&Jvy3L=
z?qakUREm@w3gzu+Y*KXk$m|0TRQJx6sia5~ypiu(88u!z$dzWB&I5uX0M(}qEY
z+7TT1#3qS6$?lTnhog)=P8QD&kcaQx#ec`_VL@@zSmgD10P2Sa#P>nTzEZ&z`=~QW
z`cDiB3-Q3gE6xA~Jg_MUc^9&*g{M85z)#Z-EJC&=LA!cvpGebQf6S;74{GLHZ`&n~
zlB9Y?YpcI1w6l{12IP)!{7R^0yK^1?WI=5zh~U(5@@Jb0Z*%qLf~Eh|R+rzsor;a~
zhvOSXfrVeI37S@%+=yQgl&uY?2sTTYjrglfVpJbGOw{jw5LLLRV!UJOPw(Uw(2&wG
z3P}+nP<%mcZZe(Q_eIQT4?kg(d=7tPUu=drkIZl&ZEQCN*Waom
zwyR5Bigc8b%nur{;^h#Rz?3cyZ35|KMeJLY&KJ=ko3~OX*<8RvGU5J5yG8i>4Q`2!=nyjVN})i`3i}U<+!?qgyjbAhRwU
zB628>%l*{hJLWr%kXJGRgmrwD&fe#6XQOl)9xWxRO{Dfu7DG!@
zu|fRSWJBR7Ihg|1r=^dAt1_dFSh6Zvm%t=tEUz$}@3OxWVobdeNjLAjuu;P~8NK=F
zi8B+OTC|#59>xwTF>(GtQIg-!Mxz=txMCp6{L8*Q{+SUFG8}Vo;Fr&en2N)fYa;m2
zVPhOSGY=?~gBmG9^y}uq+i&dy-`gjj@%u8o@4a5a&|D^_C3iaRr$YBS#QVX;`;SEA
zk36QqTCE^InFaX3r4%kYjVr1St1t0h@E~Yi9lq(?d1~0+*vpv#;dnU4t@}2(1a`GC
z(64*Lx0=#X>&?*+0fHkQXa!+85k)z{QoNVIA?o6GeVHMMu9udxg@fch5oz_gK!+qn
z`omm?=}scw;P4MD`>iNLEdeFNNt#3FZoq$DI$_ZvaB){s%kRG
zw{oapp{84v+$HaMdzGAXcr$T>L2Oi?8-KPEub9#(9HeOp1{6>mcMOGbjtZ>JvWz@N
z0QdC=GE@W^arqYdZ;?-fJ4UsZA@PK~@26(Y;2mAKx-Ccta33Wab<_LO?fmO$8J@Y3
zZ&?8!Pk4uenY+*Xxk7Cx5VP$d9O{0_g8O_Sqa!?M4rID;#X>NO4v&sQc6Jj!0J3iL
zLmCu5Lux$C9r>V@(bvI2YBxl)O_bEwSCY+doo9p|V|`Ov3?Cd4KBw>r*`pCK9*l6@
z@xP6rU{WZr6Af11LG+T8ix_prffC^9hg7$MyjLa0H7>1puf5EQsJF1Gam+%WVG_Z8
zpEnPtppU8E))d%J3Eaz%e)=;loaXwqgZ5IUB?gH|Id)X_g4C~dV<-=C=EhsOS1nexR(k40GfZ6rDiL>?H9<*MArSE-mFtrhbK
z;`wAh)TH@l)p44(1B(;#U|)k)j`JyX?qHjtdiZn22eae
zJt>c$A0s~^MInDwdP&GePw1=HhDJw|aLxNK
zUqeGVfyP!4h#1hu3w8ktqFUx3G;heNr!JbLX!At*n^VO{B`ZxlS%j7Wd!P-maF5f7M!QfW3tA~0yDt)l6
zK$4F)e^{0S%MWlTC#J0nQKrx5O{@W_0cSPob$
zl>>7X^QY&qv>scM)d{p~RK9r90_oCcZGX84>1k)zcdGZnu-lo=q*N$k*
ziPQB)#G`$5bBq)@H&;+qW7UHS$DF!S%5Z4jv3BHZP0AOts-Dg2c9
z0vti8`g{VnIr?2Pu%3z!h;A6_6$Mnv^-K
zLAO4X^HOxb^!}=)klB&?OTP3JyE{LyY%Z)zv}f1S>rOs_DceYd9gjvTALM!rGNHLL
zIDi0e5G8{=(_Cf$Le&RGFJo5Ar_~3&uZ+AG`dCTv(y0e=XEw9x-R;UPp{g#qfdkm+
zHkv2AFD3PU?!UdU)ALa>=*35WV;!3mlIK6(CH<_uktJ_0O5CQ%EGEtMNR_KjXeB=9
z1#aNCMbczGgJQLg9IIeL8}WNyknj}5_0f86>N3>)%j`q@-90?GcIaryR>t{SEg8zD
ze~t9qd=!z=mJUl-yGwe)pZGduhRT}~!pS&&3&4!RSnuQvwYqT*sFwp`+ZyzqG=GHf
z4}6MVnBb_K{S1zO&vZQ9gd|vatO{WTpB&bUEW4Bf;S()zw;v3+&r2{uAWwf*X%I`>
zjQAKE&iAagmry_=y}^OSHnwAupX(;@0LKY
zC~;SwG1PC@ZiIY|B|6yHz#7IkP2aieKvKCtQ~rZ4Wej^g|JMHV=Aa(>&%)?82H>jn
zH3sZ+^IxP>CK2nf@4wy*U?+I$JK;Uq`?QaTWJ$jS5&hjEapFVpOs*SF3}V-4@M5gM
zd(`iCogP_I*fl^)N7qae?_6pJXrWO@kKbL<7SCDC5_U}pORgmH8gJlFprR_(3a4e~
zT$p}HXP5iuRzX%+y0ZYkWrU`ON8A=hXXcZOTzalwG`?k?_H3(O@;
zj_H2oqFMI}zZiva7UO%mK3o3BSmv}cgng#iynfi;b?`;zMS)s;Xm$idFKS{b-Xmf?
zc1KKsd-K6Jq@pwH5wWP4kH?4<8aMOEy3usyS5UWTNZ0*$Yd~-3QFid3fDMO8_{QxS
z)*S(Q-;A!=S%Q9t75eGaB8Cq2)cpI1h`}!K`iQq?o@BdDi>37X{vg$>5HftaeCL4x
z09t_kps8lgG&zJHeDh$0gCc`wg&+0+U7}%gDPG1_&l4rBMf^knVpH>w&)vwPGt_hu
zosxd?Y}x_5lJ5rKltUC^L_NO(33-Ay0jdt)F&Rc9am#fWE0*zogA7N4mP+r1EI{6!
zC8X^m5Gq}MW@W&cM}OnA{W}m|Qx2?L$Hmf=r)xgEudiPU#4zCoJ+qprV$8+%zTgWP
zfnCLtOR)JpO|JKAdbx2@bzDa3G-;H?jhgateBVlK-
z`YHDXf&F)~T=yHEPo1EL+D2K+B>KEuU#0TaE6>tD@P&U~D!7r}EZnvFn&6OeL3gbB
zbz;n$RkYmr*+T<^8;=IEG0cta=a(>i<0LBZnV13tJvJq
za1YaX-PILB{=h5sXZre%EfwbzG*_$q5fvHxHHIezCTh*q&ve+^Jep$U1fS}^Rdi;s
zlF;b9e#d++L>4RPN#Yj1<9&)Uci9{TS-o|=rILEA`yp*31>FM5UV_c8RXvOXLFifbMxjD}Iz4Q(N8do7
zM#chNaBFSs`d0!!;*Dg^==1szSxQ*f6BWIFIz;V^Q1=G-A#8b>t9J7A$xo4qvz_Xh
z+3-9JFa17D2}63zK|)!j-O_2nYU^PEa?z^lL-Y4ogDsS`nO_+02V2ph>Ul84Qz&&n9&tU^MKB#ok`71sbt*&~Ng1?a|C
zyx?yO04<+@b5l?gZbk8bB6o>w*w8o%`*i3PgQIKN2M<-O!KAmD*oCW*?zX^owA3_H(QC5
ziKY<=%Um%}{@AhS+$STh_E>o}u^Ud6}rc&?a}YYUb3#+5=r>eT$iV)7qf{V&-ByDQd#u9
zX1|`H9NZ%NF;F~BGxyDty}Lx8W>VL9Q}W*PX9~vQb#TV5aCv!VT;Mh_Y(JaEBSz`r
z%pj-!+)?DhAMexfbT7favVC<#<<@PWRnufaAw^aOV#bD>0glBAC-O;v4(>v
zk2LUe9RatmVIvGWUp>{n`=(o!OZa@qrmb>w_e(-MGliyFb7*VQD(s1I^!RWa#)j9!
zi@^NuA-LJi>D?nLon`{2>gusu)SjQe4c5Ce_XG^b%j79BF=VRbPsKz!-;7~dtMr%~
zUu9+RNr=B;bL5-o#7q8avEAKoyJ;NLS~#V3+hgeuG*T3N47HNp64SGnr)}Nj
zG43O?`qS>`D~qG7UF&@?eVJx}K@
zvy*N&9q4Z7>oNWJ=0xwp1aU)=HkHiwlC7_4V2*~*7)|NWo%oyZ_U<3c
zZe`6sq^|i}>%Go|txgtGAGt~s2kJ(jaUYhd;!o*ZS0Kl&BRH5#mrSSUA&9}UhRn`a
z!$**zKh;Msdn${zfd8!)G{e3?PFFOd#*kqx;tciFEtcKlR|Xd@u>KA&a#?EHz<~)8-vo`gu{ef=44-pvQ%=93>>FIX
zJ4KRv-7hBpxmk6OPL}v?*o<94@=sA@IYM*+Vl&{j(R-}8v#aw%USL~&`}iJ-BqpPe
zUI-jv6tdfLl}sIGW7pWR65K-b{|(5>AS7lOcz3U|9Ktj0Io~1
z*TgfnbR>@nInAovOE}JlNH)t=n}zI3>&g1RTSyV*w@Xk-RnCAb)r7kY=3W_u+d42F
zA2&9waqRGX|6DF@rIMm5$Z9+NhQOa@w|mh!dc!>eC*GzR;O%
zgEo9Bm(-y!Sh0WgAf-c5tp(%ptneBxMac%;;_P(Yp(3$<-^O!6E3_pJ>`(vcJ={h(
z(tdMPy!JeG(BZK$G77&)+oJwQWLmB*5_(sBt&cb^#5HEdZ`B}Cm4G6f(M`aUs+Ycd
zBI3z|Wqg|lia8FAEer$PkGHUeH*u0ZLRoypXl~QGtkxg)-HxH8Obi7lHDNCsH(xQ`
zvmmuLv+Y~U<)!IkrtOb{th7OwZ*;WKycANCymn9$#3JO0R?o7l`7U3y>M%x3K4A;{
zbw|%Y;r{FAB>yu;}uxJ%`dbs
zxt&tyxV;C?8gK2k(Y+4SXSj9KxK>+UQzr~}k9%9jFfVDX$XmJolSrvcyn13eS0rHX
zWOw&y4?E#+p*^x=mnZb=R!<7M(n$f06(*Pz9Z_p$
z9=8Z34%K0k#2J!2@ho7AFciz8i5x&MWDQ30+#FxDfA2s<+Zb_XC3D8j8SlCb=^d7U
zxe*v}?hTxyIFj9HXe`9JMn&5MtAh5B=ap*g_tYs^_
zt>>tA+|3!)nY?H7eeoX62eBxB>h&<(r}+NoK#64&eywQmS=Bx6xGU?!>)9S$!uArC
z#`%2e=VWQLN^r{bp=Qx3ud)+PlDB^+9YWZUNcu2u(Q#mCcpplJzVSBwbMN91#VGJv
z###@rF5qz+w>59^GD8vh4l=y})E@(8Eg)sz%RM$pn&e~98{EwWtKh^xnsJ?LFl^GR%KSBAeaH1?5e{hd8LTYxBeh6}U;T8Bub}f6T^AeOKGkZYuRw
z>l_Bhl?3l7=eQGo?6J$E*1Y{eamuiq#r%%TpS~^WX)%=L6N4lHLG91a4661bjNS%+
z4@%8@n<+oTgnhSdA5y>GK6OJp^zO25qvI>h{cXe?9kb;hLKQonxm5-i-l9jEmhDrC7}rg&F@ek2}c+E66Z
z{LTYkT}&9xm}C=HmvP75AwyQ(d>FRxhA{Fa%pBaio==K5SSk+iGI6tfm8Pl7%zc1nJXJRvdCeFJ`vn#vHr;*jFCCp
zc-;5#MgG~U?h%+BrT1u4lZ*X&CM7~PLZ;zV@}nR|@_FgRa8cX~|NX(}0Y*u0`$~gf
z35+B{imi%zN=;6ZP3`CX8FmkuQNrS&r^XEHg}U(xLE;M#yfRL2t-fWB>`SI)C`7?f
zc#+JUVC2q4G;h165H^Dz|S^Hsx+9ASQSWnllCpkrFWz*ZN;ObxzcY}|HX94rl>tl%8OR$rG5qGIDZQqk16l+_&#wE+Ln~0vw
zmdd}Kzs=Nfv0$B$kr1BaIP}U_h2y4IOA?_#&iauAOWbZJ`crhl+`X#FCyS$Oss<<3
zxn+E0tCfuTyKT%rB6newfiL(Q9Tfc=Uel!bZx@}8RN9)39uZJ!!N51a8Zk<;ODei~
zGQl5~qs867-3Z-?dg3AZFvz^}L=I;8czBKXi^S9$MP3SfogY-!nk7L`rg{%3d;O(T
z7_0&;nLkS;y8PxWZ(^R0e|>xBSy#W)?~Gd#k(mpbd^r-6?@~W7oIgIH
zt;?S1l_``(l5XmWe{fM!V-V+JV4+p`v?_kTsON>5%3UezoTGU}M#Gm%)06aL8aJjN
zRppw!OM{|`-)?B!hEqgH$1-EP^u8W!#3nh?9zOMaI4pBbiKJkSH7AaoV)1w0qKiP3
zhL$?lQDdKY$HEYA4oubQ@4A
z-~XiyaQo3k%RPhKcz_G1x!Wm}mZ5jY-4NY0u#x#{8EeAn?1ygot{8g!qLKMmv1x)t
znPrGJ76#nz*0^{XD&$29%p46)#pl7|zl9I6+UWJ%!
z{K_VL+tX5>oaLnCdrB%@t*ha+ceYKHbx+unw#Twh2hBAG7@hk`jt7@T9#Wu2d<3r&
z2F#%WP_0EsGj$^{x0w#Uo~PbG{G%atLpMx*B+qWdi_U~?b#M}Q`Hz8z7WNT|4sLC@5NcZra(xChR$fa^~(W5)wUPa^Rp3e
zxDki&!Q^>L@W59_;JkAGBW93$?ilE-qMSuAq$$q7XaA)VSXjYo6MW2@3x1+0Nsh31
z**od(8%<6eOo_Zrqn;+(iN5E#uYX4zU$dY#R@Bo#z*9=gmeu~zS#Xjz4f8mZWS|@_
zm=?aZjM~(o`eRH?=lY_o_3^2>&){t4=uN2=mv9EdsNSUBl~>so*-tLaZXxl|d&s>8
z$w>Q_3F^WC$?X`YZVtBBC;W1SX>|`j3fjM7wTTE7_yU(b#OT~t`#yEuF^|jSg%Tmv
zJFYcjOJ=HfVcqxZMaM?f-kB6@M7VK?x0ZWyO?cmWy2B1@mzdA)l5j=PH8!8
zT`{mNru&|dAXV)T|1C1CdMO6ZWL2X|rZTj1ZJwQ)LiWk3oqIq7tL6hD$)yWyuQ6ki
z%x!AdFt8SPd$fFnsiGdX?q(>H{Z_2O(~LW0a`ftHql*>6p4+5~48o6u4f6fzi*@*a
zIlSVP$9JD}#p|;~i@Y1eShud>2S~8c#~4D#5=+^|k6?&>n<{Xuq|Cy`lM?57ZS
z*EmUx*vBsz6sEA6qxOhk^nT@);JBA-1U$
zmtnIE0o|P!>mK?~Eh+eMhhJFSm=8ycHb}A@hEphW=1p+izM7nMd7D;X;saoZKpbNw
zb6W}29mZI7mue&V@&8j{KERFOp|{0J%)hpBQ*Q!mlS%|eUoWJOiOlp`-305
zws-X_q6HRVUCH13sw|4C556t{&F5Cub)$e9p}-vqu4lmD;i`aZAZ2}$lSJ;jvGH>h
z5sVb%8E0yx%bdOV5;kWO*0}1R-aQVc&O)-q6VE@ZdJ4n}uO*taQ#v!5;@f4CCx&bZ
z?`f&gS?u1ZPrqDo7ZA<-_9GK+D(W{8B=+%LnsS~TzN|#7;gxyi3{2(27BIDObL3?+
zCEqwz+3P#qdds;F3ft^C9;ko3`C%;08z&6i>6qM2(9Ibt(u;a73UXUSN2?J&b>*id
zx32b8Chuq!VucJSetUnbR)=}if~_apX&&|6&lePd5&n7YYFl{bW#WQB2(@#VW-SjX
zPJCVDJRD5NV8mwiFxlBY&0{Ky>gKI`orR~EP-3W2+`1M)f{$AV)5q`cj%0Qf-*7z2
zNWy8n0;`%kOxt0IOHK^o$k5nb9yXp%&!nmk;0kOoS7QzxZWBlw
zdDxw*qsh{HkR9n%>$B?F7@uz*@p85O#u{$sJErS_>YV>!{g+_(k89Z$V4ctmp#gHS
zt`vB@-1mTCv!l5R1FH@yciGP`OjQ~uWFtpLzwxwtKGUC1R#qv_;~6!jKwe`}?$NtH
z^;`hG$@jYQrMg^kZC`_?yxG`v^F6%47cb|J+|meYQle*y)n|F!Kjf$#;y%#lQBPub
zvXB^BI#Dz%NRk+#kBO6yyodol0g^63;)p7=ysd(m8y%2Q&H*VsG;}UxmgB?u3q~9W
zE`-WR@1b3OVKEy`IkT6SN8BBJ=rdY!hPXLt$-$V5GL=-i>ze}KrIJs
zO!mO-`##ij40$9r_$em2Ffnj7HjXI0ud8Y
zms@gEofY5kg}Rp&jD=GpM5*~^oE
zzRy?6fNCvh**zxULI2Nz2kanm)5x+iJUnXx5ZnTdQmL8$!j2{rEVOszJbbVW#k4)$r%Nu2fpCT>~{Gm)84%hp6dF5^HK)#@i^EWhl5^b!ak{Ry2
z#IT;LN5yVN@=4@%6kLPKsF=nHX$V`N-neyXAHqWkbF_Le_)7Ts=-iJx8GI}(B!?6l
z&TW<7HYsg;wOE+nIm`E8U)cM0Vl$L?y?sp$uTpJ<}i9)kp8?lL>_ZD11s#M)ed$|Hs;%Ch4v;~
z7VR5e9|H>kqU@~};zQ&9v^T!VOTl6f%7U=T%txLmB@a%yRU+$J37ckJp7us#qOjp8
zCirck_7~4l!^xle-i!PqR68s0SBhS4J$CnD%Gah|B7HxB^Id@TTD=D7&G;YQpqrxd
zNn%_x#SG@qeqRE`bh6_lr#qKG!_RPsSET$JzT{Gyi~_HtH`0mTA7liswlM2MApr__
zT?%)~9FVU=6^IUSz%$I~mc{{3w!@b=62J)@g{w#!(pr*quiT5lF+c?N{+UCI>~g$F
zHX2g*Li&v?V2%OJ43Po5p=p4;fNBw~QcK2{j_hft1SPQwwNj(Zfm;$f#J?e(Ikz`W
zcg%;-rTWRa?NL97u(IuI3KskYpA|QO_lJwZRpUSgVIGQ}H1`{AkwZCJh_3m!A5=ol5f<=2B6B=bjWIQW225lg%
zA4XLRb|Q}|GdQd+cT+B|;M6ShQ}b~b=X+mPwCgvPUMBrv?V8Z(Jj;t$<&rjM)f4-I
zVXb(l{Yd~D^U7iM@k-utO4fe&V9#jjeMixh!wm8yhiUm{GKup1ys#E=Ce=Q9bFZpW
zyH`@Jxh(sE_v!Z@8^Jz5<_sib^}PMTkd)|KV4ML1v8z;Xl9G4Q8!%koIpJphli`Tf
zZ%4l(i^q>?1~^JT+#M`oPf@mvIq=?k)SA5a39zjq&f)zah?HSX)bBS4iL--HEmIq>
zcRulac0jvtNiA+*I`!OHr&zT07PNXjh=sOVSv1!wEscEU?)-{;+l>DY^uFcf{(ac}v)^)}a042cJq!0>%y~Uq1nq@C~nBpiYUKpt7P@u?fH@RoE<}-Y>DV+cxUT0L`t6fSz
zysyLhsUvQyT6pprnm0>pmh3r-3?FOo+B(@7y6`3(a{bLK^_M}Yt-CiT$Db95#2i&%
z!HRkQL_w<@0OsJJv$N*s4eOWrr70>3TqaGD3!tFcHK^m~Lg+Pw^t}vWtbWg%!Pv(x
z1K!K(NO&a+IEInh^`6}IWxbYn?5~f$aEW$=?`J*Ak_~SNytpv%~m>6eE@k?EE
z9uYEoC?rG+TX?m@O3D{i6}O~T+wItwmRxosI`oh$IKCwcQY!m1UX08nznG5XIn>v8nx4LVDV<2@%yux
za}=QW*o$ZISyA0pKEF-#N~=3{dW~E~4w*bTftd|u5NrUnj2kONv4&yPj73I(2!mia
zJ&qAd6Bxk?E{=a=91l=7y6v9Y%f#gXP68UL3`XY2$R3O|$~Yg!pW8L#E7_4}65^?2
zi``^vG#iMiBt?e6?u&ny334*eTP_UEVnI<0ZlUVigr)z1M|~ANM;Fjn=!)}S^0=<^
z!}$_(Nc}h>qVE2px@}4*uBqa`E?OcUt@uA8$_D?GNKwO4$j5O)-c>KrUi#kWiyXg7o2G!;#8~14s5<1J?bj41$}mJD@v0NG&F(HQXkk*
z+u%nPE7p#o9YZ^&d<^+uDR+NBoO##yuafQ0Ud4Y12wm{nf^AY<>`2D{bda!V?B{D+
zz(1Yg-waIQOSK|6{#=5?1^>z?K`el2BK>og*Ho`KF}{IEx2Z#e4EW)q*TDaj
zK^RQH%+8_tK6dP--WG?szJ|b@1hkw_vb`-$BjhOu0N3|L$opbybJn!+3#RQ+}8ww@g(<|wV3BJvb$AS
z0+tLqcSX!pXZ2#T()24y(ZV)?m{A_jt3G}ruT6=vk(T;@Ge&lo`f-9FpO-uanB`gZ
zzi910?{=y9pW|_<|50Q!g0H8b{%2nka-4|zKc#}?18i$O`*Q!Ik*()+bnyU#%*DpA
zXfzSPEl1tLY1c$+LVIRe2%Vl>4p5GL!7nHMx)3HKbKaD&(|)hJM4-rSwluRaN8qL<>~RE3R`3IhE}g)bdMU>8
zJc;kj3W8Njb0Gi)%}AJiYdVX;(D}%TPCV6{dTj?$`DNgd9P7o$Q#HjYM4J9^Lqz#b
zMx8Fr&?iy^1|PGWsVmGGnl-!3w&bcl<~0ml(ql%L(KyrxlDN|uPBrRDYO}PDz!NHT
zLA1}PS!I(X;|rfM-UQld2uKZL(?T5+NBphVX=4q4|L0A9*M8$9Dn$o_!1c
zx&CG3Cm*9_e#Ae~hlT$FekwsOy}uLxjQH2zzDN8s;MwrcwkhT{iz>r(qgTJfKR5XI
zYf56+S@BN=|H;qD$5fjjZX_1PfPV)3GvMFHy%YZ;CGMc^3;rX}=~DPk{AVGP%?NVy
zbMeoYC3fG$f4nc4H2J;Vj=5Kle>9UqLaKbqi}exnWt-{(o8Efd;Ko$^zw|BnU+X7T
ziCB#Yn;9ah#1rl9eP*|*cP&x94ufZb{Xf0?!!C*$?CaeG?w-zv)xR*J2q;f{L2i%m
zq_~>g3|!c|b82CC6(k2`n2#wUmUy4HQU8-Zxy})HPCtg+Z9K)h>
z+b+9qRsjB0dY#3X-@qm4e#
zk%aU5CPwl?V=(PzvTvG*-}Vz(+0m+I5<&n$aE&O>9vJ622pJR^%Yj;UR_7r;ewBhQ
zIUATW3sK&%81LSwGckFf;vzRiyk)7$bu^gsX?%%7z(9u2Pgz6bmnfnf1%Gf|VD^Gr
zkDNifYvGV@e&HvhV-gX5GRuo)JmVi7+=9F7z$1r!);S~5P0fHk;J4}t6?K?H{Be;0
zgKxe~9}|sPz<975p)GixA7??MAXE+{iYlox5Ng?uxilL^EKoGObiIoH4
zVi}AD;}3dcn<@VIS
z&H}TqNZrRrn>UgdBQYN(J;VF0FB(6$@y{Fl$GYt{{vl400|U4(JZaOH#Xkf7rws!C
zuyhI^nl!&xCiz?NO2>I?a})n;7jJSZE+i1IDuAb7U#2bu)Jf!6Gr>0eGUhc7e>An>
zbPVNV;a`a_-;rgFLCyMuDZS%(0%useSz1cz+?b
zL8Y{#ye=jSYBmPx0?@CxPbN8}i-mFMsW=~uPiNuh7gFybP(?WjrT{x=ys{V^jF8#K7}dN3%Cz9;WBR-RI%AB~_b&|3
zN5Z6WktHM$-vrVN32JNm95MiZMHt8-CYzlwf1|`RXB$R7_9)}$2?Ib3@AU@SIAkI1
zOE6ZlDTWBj$H7sFaGyS(sl9Yi)kjpCrW-UzG-raZid4>Ku^{+M91}lp
zGp&r-L*TQQ&q8e3{1}5)j!!$<#3rHwrhWWce6`3lg{^UPj1n6ul`(efcrc@D_=of0k3NxCDQ^S+
z!9z{-X8)9zcJX$>|9Tfrl3QLN|0jkZA?mO&f8bwtJ|a)TtVB!wV!uG+xwOU{7a;KL
zb(bp5J}Ye5BRw!;^RGTGK0Z0zjCCCe0>E5G5ko$)`5E)SD_`@!6#NritN(2^$5Brc
zCBB&6m-;^s4;KuL8L0osm%Yk!gjg)T8K$Vj1tY)-6=v`=g2D|3f@Q-1E31HW
zcT$SV>fD5($&})})QIl@IFru-$+3Y$lz?Eap;;Q7(l>x~6LJp7b?4TOllkoeGvI|N
zl7tk%NLtnAKqpJy&V(n-Ed>G^LooM%6&SM2m==gcv;|=S7?o@&NmhwN3ziWWL98A9
z5hc$^wo%Qgtt?8wXJ4mbv3Ieb*4ojW6vmjQ<7G2M=iV22J6_hAjwj^q7z2DM
zcelcw7oW)QO^?~0A7tU?k+2r`xD0-Gq=P;;Bv
zigNYH;Y7H|WV+(FT=+4`%@;OpPOK*CFUA59g#J2CofC~iOK#I+xWG6#)OHqTi1+Xh
zeE{%PukHuz`Db4y%&
zI{r7Vop?#nKJ=0CFJY(Ruh@Ix^SBTtSMXmK#*|ssRWugpRV~JnuD9$UqpTFt-GTqG
zq4xrtL~KKSt{bxv&y2%t0x(z_qv~i+DaNitp9Fx7&3tcy_&jLj*nl`)WlH#u4VMl6
zrPyFHNLS@9_{TMhjw9FdKhAmdLj1GJaFYKen#=aW%$c76{!{du5W#xpTK*T%JCxF~
zQ4q&GE|@?IcM_Wq1^uce;T#JyCFLe(GSQq*L8mZ9P~;#XQ>2J2%8$``uNCl0n?jQu
zdN{Dixf4CJ{x^L>OIVdEY*>nduP*w_doHX@S(ihLPGob8V9gfw|5U@R{&<{=O~P-8
z>1>@#*D4bqCq*0C%CSgug&e$j<
zU;k6piHlXov?~O)grQ9xa|{1-gJZLMv;{{}GL=gm-Zu<>;uLo77@rBzu6MaI6X^RI
zPi(T+oiiPaOAzs3QDg%CEN~>g;e*n|yar
z-I*vwrwVP{kv#rz-d#tTRvGC^@GQw(apY(-U2q@#5&go7v{c>Gc(56zZID-P*l3TtbrReNz+$tYH#pgAjqC4=9
za?vU>rRh23u+W!jMXKc=vbf2c&DL7*?-u~;xYedM524@SLJ4NLg0nmLT5QG4m;>hd
zRgQFgoO&a3VH&=4g)fO(aKXQxLtPUt7Ae&g*YTh7>CVp4W{dw5`@JaslYCi6IQJ?3
zHHmFy+cKs4-Qd5(PMROG-keADAa$T72(8b;O
zmnw(my=~0RF^o>~NA9t~KRXlEZ;1AJ{B*osJIThljsKJW_V@AmKMKm5`Crz}qG#v-
zjc&I1-`P(?6w^!Pf4L+7)3fsbTL0_fUt>1bmtcF+`G`{e?+UtI|3`a0mH8-O+0_4U
z{H~B&`QIV{Exr#i0yXhs_5Ui%mZ=wfC!bYD#!IDQ;KB_jTTMF0tWP
zOV5{c6ce;(bZru2|zeoWsr`fsB;+2p&tnET6!_3o=hQeUf#L|E#-=
z{}{7URzn#BAZea(gGi3@bz>|ASup)BB1-w6
zEJD^Cnv`7ujkRH-ZT?50(uOgGJO%%{*s|PexWm|-{Q{LhIj3d@pO*g(221|G%cfZ$
ziPd}ae>wQb{O{|vfK}l35%oXJy5b*n3AH3jO?6-E?biPm>{3iZ1wEqvcduUb%#Qz<
z#1d5&|GfT3!1;V(0WNbz?j(wGX-v(ud4$L9H{TchQ(Dhnum2_XdC1n;$%4$w{6+7$
zx#oUVd8HXgW7QSyJV~-9IFE=@*Q3N6_>*3_K!sl3j`gm@qQj<0ddca%u+
zPe};E+SK|S&Jgvux05;5@#}3q&U`=fA}>4ds3XAuB_Sh|C6S2qo>g2foogzyGG~sV
ztlENLj>R=W>a7ie!43W0HDp5{Y_UlxVTWj|&kk}d*ABx@8+cKqa+pIfm%zk|ArROr
zyzp3d^|4n}%FNkbhgk3zis;~R$ogZTQnTbm*fIVw4{TzDFH8rBNo_&OIW90%1Lm`n
z$yvcNnpb2Ac&di+kIJiG$VD2J12bZXdgH<~-YyOC+atTG%3a9bu+Q&2TZoQ>QSj^B
zLYV*6$K2(uuj(raN|`t*K}$*NHzI(CCofW`SK0z1;h!?DZKdKx%n~z9?+5-bE|GrW
zo8zB2Ha8^6Yqc9rK0DfE95^G3Py%uGas(SD|FX6u4Evxd&hdIB5El&~m!&w$$H|NS
z@EL~T!Up;!je1mnX+n6}+^~W?9|ylsJxty`RD|PeLJg+Ow`|dneT=MN^2s;&CrVdF
z*<%qd!UF$pGXQ)Q2{x~a^v)%7J}+6nSS#d~I)eF^eFun`Gb#UpktnTMSE)G_-CI#o8A@TuQ}i4lD}7CzESyzEG(()mX~Qmmer1K9#iM9;c$xk
zM7rp{xCJ9F9C(pv8?nlHWD}I3;43_FRs>mX`KbJ_F-s@h=6}e+Z{9?X7qTZ+r;iTR&VXO816=k7&jL&&95aJvdimL}#u
zN}BM@zh~mG7M=|BE~J?b5RjrN@=E<5^9rO~Gk|sqJ8+z*f`115!z83ZY3f!#sg3Pc
zB=bc>zV|J3W`E#Gtg>s0uODX)<4`er4vqI1qEh#jzrWhHA5F=}(cA!2>T
z(&Rl2thchMOHtgwQbmVkB)i0OcKqzTe}3*{-d1^t69QLJ
zVC+joOxKk0wv$s}qmziQ`oXFPzp|^g;;X&MD_;q|0spkq@s;`4DZ;t@y%i4FP5j@r
zI7i{|oU*_2prVWK60iJ9Mlu2ZQRaxVRO%Wvwaq_u9kLSI;);6Yjz>DyUKV_4wGYmx
z)mw7XnA0vu#dIQG0syYf6RF}qMOLyY1ghk7{D&H4x9~hWP9PbcH~&?~TE;+Lv&?bM
z!WWs3g)c_wwD3p-7$WlaJNaT440Lb4v&dfhQZ8q_#)7Nl95}uM{~P@y0cjT2F
zFKX9q{?GWY?ezHglGI@l5+W$p8LX=z8)`I`kZNGymu0aMMni
zj~A=|`9@t*#BKjX
zTJ(~7|5E>3$eW^MzVHhqQ6!BY{@8`c)9Qb^;#bR~7WO$R7$4kq6Y|6oSI<$%Ic0D`
zHnnOfM=X-qVb_sG3^M{{AA;oKu|DGLJa%@M&8{u5CXQk{_dVk+6>G|Ox)pUhwy~Y(
zm&zMuU*=o@0Fe@Z@IU|#B3qY8
z9w|mg9c30ZaqJXlx|qL72E0_BVeaZY$9NH4t2c9UPCd@~^OmoLhZ&Rd?TC9Y3rtH<
zF)%N4XlOliWSHBb$$K7CQWR(>n!VTL5XHdRID{D?#~!W)!NQQX<9(n^<8H>veB|7d
zHa~X#_Q{Z?F%BYT2(f-_hVc;T`690wL#$*
zRhJfWYH+l(&Vi4*<0Si{&tK-5Khd}P=)%i}Px8fy>@k2VpUm_X+-}&=3Ifr3qUVDD
zBy$=(>-3yB$yCPnQ&;d$3(oJu|8_iEM1#dsT9~G=c35kijl1#fO@}#AUffe&9O*=-
zSn)!N=v3`*3;)2=CMHH-=WWJ?yYPQSM;prcPrA%`8P~a?UY*Cn7K}+7-@I6G&XO?i^Uk&
zAq9Xrkmdg?G43?~Z~4gMV*lDNHcg5QcjbS2JNQ4%|7nb6?5p@csll%1e-+N4eVYFl
z{6DY$$3s-&%)Hy?M*iR6Uk8edx*Pm+#5>17=g&IFwfbLto?QQL@gg-2+Stn+ch>(@
zWYRHF>1Bh4^2MpiQtF4h(R4D7E9{Z=zdG17=#~24`7G-wb{1Dk8zgnjYW(lkW!^US
zC-#*5IzA0~FKl;w!}@gs}jagqvg6@ITsI
zaC5_FovBBazy!E89++5hZ~Josd~J59XWNS(=fuz)Q_Oi(92{%v()|+yVCYpr!yIu&
zmbzyCby$f7{5dO=-XWyf$R=W1Ij|{u>x~eeIbxYq8~DtV~*e$#_TjmN&wbDZ!1iFc)kmt#BsD8t504o?EcB_
z$6*OM>JBr7w?hHEU1`IrTE^qb8jKmLinhiBo}cI3_Os8TOIdLr$IMEcu;?*6+$VUo
z3_<}fM!U;gjEuwiiadrk&t9r6h)O&*eG80Na^oSp
zG$0yZJ;NSc*
z;)wbdg9sX%|D}{dD
z0Z6MS-3Tj~BtF4^nj^-u+-jbk>$~gt*LIAySf6P5}cS&(&A;3QYFNj?Moq6rN
z;Gdt1f5bIy@Ec|BvIGY6@GwPTzJ{_4nds
zR>gnHr{Ig#SeE}yx);X3MJmUCiieNS|1c){U&4R#OHM=1cUSU%!aqN|{+I35k+_TM
zH2)W4K_fwig<@Wg0iRL-=SH*spRM`$c$v@cG2)-om^Pk`jXc_s;)vV&A9=TSg2z=>
zSA}OqbK?sKFB**40S@C^K2|AJw#U~09$k`-4-VkkGzZ_Dwe1NI*1A@F3AV*DL@(o}
zaV2z_En|0Z0)M_fjgW0NbKS*;pN(Y65B&!Q;P5Hbbp!y5*{)y8R}EqmkO@Rb2#}8t
zSWa?N1gPmhaE`-ygaZE#a`Z?6oGErLE{wqbOe72OZzi1)Sa6WTbY4^-pjnOMMU+QC
z-=TBI62b~S5*2S$5$1h!>_8ykFzCf$0|6{F?Jvv+#V|4Kv`^!ja_4&?#4|@54wsuC
zWZSXksLpivNmWKda66NN$_yA<0(+>ZMmyi1Bj4NVtyQ8X2xV5(hzYuqTiiS{Au$Z
z6O}2i#3XS$t{B}Q5gN04pz<~);
zk2U53Bg*6PN!;T>5VFpJAwnIb_p-r1$VD~=j+K*_wc;fPU3B4V*k14-?^Oes7jWJk
zKR7>oAO?a(61g2M)uKMFeU_bljB?)V0NgB}V~Xj>+hA&EwYyajCO>DL6s_X99UrGDqqtd(N%OdRa`Phe3h=eVw
zM>F7`a|~n*c+ocdvjC6b4_NMz@vDEQ9E`C5_;vgzYjB1K`4#QE@o!=${8PcdE|el>
zNcc~TF*~dI4|!aHV!9RWEwsTuqYW%vG8wPQUWsq=ZO%cq2_}|DnFZNpW{8{P+(o|t
z_rfdu*^(fs0FT2z);{DhTu@~(rN2ADzhMfa(k=X};7sW_@=w7Zp-qZh#>{p6)1CMy
z_i@$51%#bWZ|^ni>o^7f%Q&ukjIlOfmhYbYFDZU|UrNM@G0*?u=a5)x=(v^t={Ei!
zmH!FwAKZaVPs{(t2!HO~@?DESigKa<@Bz@EO;FtTzTe;N2Q9Kp^AL^|K(QX}}Vz95zqhvpz=8||Wx
z=5fZ11^^R3gT;nEn#K18h&zrybz}3>d$Rt|&bR8GTu%^pYP=4d`O!}}WFrm-X+$&^
zF(b@DeDdl+)>n@22rFZHe-%cD;UWfp97T!-OX3g|bVU(Nf^+0Ek^*^X5}TfJ&NPm1
z7pXiPXfq$c4G(qts9b8$(70*CiqBnD2Mmh%)h6dvkGtK7AZW&~qG;Gx)-4)OXY?S!
z42TcgsIAFO&&<4Gvrs&S!TKXNoSw~%WEkp(-XKf*vf+@^hVhUS`epc=-PpasTf3Ob
z8|cL6DYt!QQ@wd30tvO;ddbT(vC$^E@uEe^DJ#ilI+{OW8Kr6&GaOSL(JNXvI=OFo
zCq`Dp|K*}k&iI|3ZLT5*d{+ptpD^M6m>cD|tzrlzJrGnfv+xBeR3Qwhs^EXZSqQR=
z9#7vR5bxO^TL2c5Jr(0QlqH=+2)S&bAKZdGF`rhux{yIWU_M=+5mzS@2qNiw3G8!@
zyNpiAOm!lOL=~rWoH>R5$Q5T<4k1_Q_6{>OboLVNr#!6o&0%U#7Yc0~OE%oFi1fPZwS
zvR<9%3;sFvN4XXuD*i8)D9j1;-&lN6j<4hnQsUNW{gj>nc3ujI>EmzOoc;j^FKlUmlgj{%Kv2bC@l)QH~-hZ569rU
zLQpj;{#WB<{4>D@1-7we6Fs~Br%nC8#sbR`u;+kbspNjMegpQJrx9IjR3^_zYj#;Jzn!tIz2yLc$PECJu#?BRqv}L3(kcS4^odWid>H!^Gqf!tDQsx
zGG-0gP(fm5B+mL?Fzg9mU<@hkYz&4th;}`WYxeXuHuSo|lb(0O_m85;USZD)88egD
zv#_?+Glt*zoT6VGU0uwospWZIs(zgclR2d(pzxRKUkm)Lc(ovw^>!2nj0=Mt3Mm$0
zp!ZXM-r>pAeO%p?Go9%q^Mq_FDbsmmsk%(6?P7K&+WE>R&dlLwQXi+@5aK`P3;a93
zDgaZsaxCQ61wC!_knjV3f`!x)i;}?M)VXnX_v?R
zQg>mM>d~;vKK}0UuTkW3Nte>MZFfA@_Tdw>$CKwb`1h>s)%+jnscdN8kN-#Ie@3Pk
zJ)7;%@Gpvgx`Kbi;12)tDE!m)JbDBF1emY*hxx5+;4qDye?0y}3m~7*675ijTm0t=
zz4#G|u<)dQLCf>}wD{^80P^OBtoUDK&waM|ryKb{v;=c{)cQxvo!QvCVUXKW2OejQ8XYTGm0ruJn`vbM9eap2$i
zr(`U%MeZ*eTX=5nQ0&?<%5?maiUt7HDD#i~_~+gPa~Tlc(Kun>`Ljc|%Q%OqpuhwM
zPJ6ryFRj}(DG;6|VfbPt%(vU%c{ncwS$F1LA)S*t&PinsLmIr*Ku_eG78q!3S3Nlr
z>X-DKq=fBv8Xe8bB^?TZMbIv&2jiR9yApCq6TVs9@Hp&6#i0mbqrA6(72#2o+ZIY}psRGt=I${pZmjv5#O-f!YRVN3B(ivL(t
z-@?Bvi4dCS(J6mo*TNEKQc_*<@6L3{D;fVA-{-U_GF@kWOP(rx;D95STzHeC@SPM+
z&3$c+$g~XrXs^l(&ck$rZ$d3m;bqd|Pm2SWSR{t$3FFcwMl=2u|9FQp<;}~4ADf7l
z`kx|hJOTe_^*>qcp*-eO@xS2->bZFsV_&ZS=|ultCj)y7t&ae5cl{q@8;5!%>*2Ki
zCpxSDtzCaQMfae95DQ!+vKv3~d+qgkL
z1K$L+Q<_MU989o+D*h0miNZj>VW)G9ZWntT%Y1598rsFjoOf`PObEiD
zm@&Zc82zN=lBBxu3))Z$Fe#vJ+T{hLB*4fn_{3NO{^@-e-Zz1ba^OgR>rR^8-jU3+
zx!}Xf53@ao7103nrn^++jwidtZV5Vp7A<1PLvGw~?d-fo-P$L!k~kO+L4QQs6H1;x8B{7N4pY?lte*yipv2Ds=!tF)=BL
zKtL|Vhl<9$2fv@UgU110Ha={Tsyd>uQE63Ti0L%9iXtz3aw!IiALx`+*E1z3SB4P(
zbnQ-ye5*AEXDEV6X83i6!Hu
zSWR7`C=KSpbV-BLe>ZmkWb@_sTNldVL2#kXNpU16Ja}+qjQ=6$j>i@MVQh}#TQK`V
zyR8c@x=q&$z*dg`jM=~@;$P13ABCOIiQ|Uu0z(mFfX9MwEAkTlLxx3%q(BuRiTGG-
zg!uP@(e2^)!xNU<75{DoDl~PAa%4PZGmUl|Tjh~l-8sI}i7y}rF-yc-0B<^vKC
zKtwq#-sT{yM{*$`tKFmir(#+V_mTDgZsF`ao2&$r6S<#4s7m!e+I)u%&;U>@RO5VH
zouTB$8ENDJfMVTvrT#CzaI^mBh^$y-5v}!qVkreY3hgjxI8$2z-)tC}kW1TC_N@G?YO*7j!v6`h
zDrst>IQTZ0M)znv#C!7wu3nYJWm>|-F%P=DN0kM)IYn7$*$yMi}zNRc^B_4ygFs
zF0ngL=k^Jzp`vi-+4Xe80LDpuB;w!3FViHGXDpaYQ;0zNDFvlDcHyzQ^N!aWv}7`~
zEMZ=*y79_jcK0AS__Xg}(GU-}%kwslctR4QlNgiwgKNkm7p4ta~xP}-@Y;YTTG?xV@j081pLzm
z|GCdO{-NEY&~{F%Pi)L|SN?xoK=M59B_`ru0{>woom9$WN`=!$D#h{^k?iqL%boan
z0(BqS$i^~`eb6r$+
zwH{A3e!6UD^}p2qgf;$we|ZCUS+Q*pMZHM7{Li%H28tj%^`)99an|EOlI5lA|Gizk
zJUXf%T?|n;CbUbRZxLKn6)H<6(^JXK#_pB+|M9fT|FYpzO-pABZeK53H3Jji=71?P
z9jA3+uNL9Faj?>aKQ9Rbf?3D}es(2dV9-f2s}_=v3FzrD>;HKMd|1aWMi;BncXQHC
z7x4LFgB(goF@PZID3V8`H?!WHFGg9XDO67TTPF71EuBMvZ&6Ls<#Is>;$5*2LqzBJ
z%(-(O&tx(m6!EJemz;mdj+<}VO$Kpr8q^C8u}Sr`%))J|@GzSGH0lyfE*Hi?AG%X*
z&yffgH)f)w3rTtsw<$zK?dw9%$yZQ%jFwE8&KAp!22cc@svhSv27qIGwdEV
zl~=l6Jkd;XP;Atp#S!$At&iwcF;$Et{x#5QqGh|lT67-$*FqPU1Hp-PSpR>V=jiOFSzfB#}-EYfx3-(Li|%Y|1A77l@R1O@-qxS1?Rlz
zF-w7x=1Ba5pMbs9FMK?WC!4&I@NbOL4*#A^3S24ST#BDE=m&UUN<|%C7W`B8bxXOm
zP2vsaq&(gXf2fn_Grc)tsRUb`F=#wr#lI9=9B{Z;H%*ae_)jvyUyJpOx+BN`;zQH<
zK;^UFg*lI{?;ZXJP!j&gKvSTigvYpsH^A={sEge@gFL_idCXJ
z^FQjX;(s%sJ2{)tY+wF{$%ew_
zXnWfZf}Ngx5e`!NyP)pq7XS!6a`9tszT$5!Bo{%7s1kK;e;f98t+%Lf0J|1X?wq_4ajLu7C-ff2dSCfuF{U2i`{OjkN>wn~p=GRqP6q-DM%{@3|xg`0s
z>WvL17~4Pd6F-HF$6X1>s?2Pvj)byM9J7`YJaI$b+svaCF
z!wNW>&WF`0MNqdk5`A4E9Bm=V6Q{F82`wxC#xf}&gi?gskVw5%E$)Iq9f!Sm!$gQ0
zHj#8b&$GLVcg`Y_J*qeW`9_HNimy@OEe+&X0ITmARfgPt
z#Z}6wE(UrAWvrnYa2Ack!DGI=&j*E67pRY`_C(;f?yr`AW7T3Foy6q`i@`;F#<7TU
zG>M{y3jB>H;^bZgdJxnxS%itj(pCHze}Um+91E&kz8fJaF2+4%a2$&3al@;WtB~&N
zvkB;dpv5WwPryI=qS-$JHW}MfCgL6Zp#TC~OO21{Go^K?(%yqamZOD_pB8;1Rw!ZL
z7DqWO%+L+|M=qWwR*a?oJHGK47yR$!4LxRSZ1E3stoWa`
zWZ<7R_!q}ymK#+O3=8C5_a|$pF6en?qfv`Bj-{*k7kvI-{Ob6f`9JUujy11Q3Zo1HK2@GtaO
z{EOm$UisU^(yE&*r2QNDpE==d&Hu(r#=rCOHDd%y3Pl0BvR
zUssi>{`Yp*cybu}XTW*7+oaZ`nKi(F2#V93;6G%+C4|U60G!qTemg_S|7k39dWW7G
zP94sz$wY8VmA8d3@5fU`iorpu_!g~WX9ZHpb#`kfpC6uwdBr4;+<`uhK*
z0AT#Z9FW(;VJQGo?>uD4mEkF=`DS~Vx
zqExxL!f34`J?l2;A3=44njohC7_Nn!*9
zKE&M=#IrH1|NO;~RIsd*MHJG1>aD*X$E7Z8!_Tt3B)$Mg5Uycl+;n@t`r7@lU+ojzb3
zflZ_>{{73rEdaU?s^1=s4nFR}e~AF@iitlWRF+Rvf^d#OZr7NT!@ep`y6e>1r^(V^
z%CTgJ|4p$aupwuRV)#xmjMj80Sd=oS4p{T!_?e%;KbEIi2R4@CU(!Ya%z>U?i_XOH
zp@3ie`~ObzH{M7*)bsEEfByrzjekn{zs82#ZvHzlP#h??vtS8wpWt8ibJ2T;e=4<4
z#lKYUeVpgxf2!co_@^a3WVK87*~v<5#M#)K=eYy_RPeuHz?4H7|8gh($v3ep{&(|4
z2@&$1<$rv;$^RTbh(Xu#f9hw(ypjJCvo)s(Is_5%2?po;a2(DfJ8uFbL;cUpTMasA
zbi4kak!svZ;8$reUfNh|KB!Zj;Gf*D3;t09zzXM$cY=ug7^TCMUfRpfl{3<$YTDI?k)3G>7JerwdLmZp(!g+Jg6pY$Z`H5(;lVjkt
z{*NGw{viZmX-n41#?oIoS-3RgB^?I?evEx{qDB$POE;ptaTSMAWPEH0Sw=tb_O80f
zu@+|d&h>witsZmrQxp{BNs{Oaj|_a~oM(q~{@)?f=Taa3gfp(p9G&gwV^DD+up_A!
zV(g4U3Ugti`vrfVhB0df^nGs+$At;O?k-y-jvRK+3nNZ%jIUW}OXMi!!D63;UMz^4
za@|;S6M_(bu4fct##hg1Q`HVRuV~|8G~*w}SpqCdpJ&XZF=N_*(0(3$jzp56>2Gav
z+)h0HLw=@m6o^pxA#WCBh0xv%OuAe}n8HJtX77h7Nib_}(?)scG!idCrkVZUkifD%X}8pGL23e%M#{=C(zv?y`%!;_!~dB
zEb#2G`J(1H$G^wHC=L>q^VEk=d4k}`tH=Z-I`oGE9Y}PkprsNnA;TxwWR#F?nyv+?
z6%}?IifKvnU{GdaoWuJ7Ec7{ESA^$6=a0iEVPCGyW81Z`%by6jopB5B?>u{G@dQ|h
ziZ{lW`|yf?=iKCo5$!vj4$m3y-$=TpIO{L_6{TE$OQ
zNLDDVSgU#LV!S{N82CSa^ZoE*ydh_g|A%}yjCBZsvde
z%qaku`X)_=?M6*$^*=igxsR=&DQ$FA{A&-t+ahW>PVn%yWsEc(k^gM&g9e}$WWfI%
zU(&@f<&sM7Wp`cYf!!pNN8JQeWkQ@XPs%w|OzB?i5X_Fgi4l<3l<9G8e#kp3pcvM3
zh9H4);c~|0>)7Ntvaq7g{DolGg59to;>DK^B9{MG8^!Wx>sOvfWy$|J7S6E<^1p2;
z*8C6nFZPf(*Yf{{yF*WT6GDTJP=p?PzEW47>4sci4`BO;0^s;A$Yoa!){1EF>9Q~i
z#iJKG?>x9!|69ECM^!Mq=$zsEoC;%!`DT9|-~CqcXIjR
z0`j(Zj)GtTM%fUGi{_lcF?jW~@^E33>&;B@l
z>W6-aKKaQ{S{wI1+YTunhs?7N?0g(TR|K39TZs{38I`zI*@qJ!N}cbtxRH;1(q
zr@OeZE}2bMP|{B3SdwG*tvxA-sp#__-W%fICR@n8H)`j`LWf9C)GfA}Bh
zzy5Fk$*%Z9T}7ZHTy%!5bqllj%aq_e|0h4P)JIh@Q}Lk=KF(i~PYe$14$Wi9#Blec
zO~W`B+r>!E_*Y}uGrbzF#S|`n8RIyA)Ehtgf25!JnV+Vg`0>xs5B<;&TD`$J+I!`j
zn8|oqJS#T(0-MEO{Y#4pv}N-$)r`2z5zHumK1v>!^0fKy?f`B;k-ywE;zzVy+evw|
z#Oko8nv52d`i%;52M=nCT`*Z2Vje-1l)jJgXTcJUn6hGk@c!1-3Ye02%-w!GeG_{=^lBR62#2dLV9B
zj4d%q9h^}K`cbw>!oNtLRb=QrB1<(kfG)T0)KAHaA
zXkZ%v^0}n%TloKQlzB&+r&@dOSruJtpEcUZm44U9%jcJ{NwGm2aW-FZ!Rkj!=0`V5
zW8Y*#lB;Gx3zJ*;W6HPfAb3xd&RYSJ@n6^?jDKXg(~tkf|N6hupZ@88N&oqu{#W$p
zfAJS_n|OgpzAM3UH=hMuyTqpXpV`Kkqnj~YDaYG?@Z0|nRfA+%?U>5_@BP32-;n#UWs>sAC6yZdrdFTp);MHzds94apbHX-^qqlZ8VQ@`t0py
zP^WmVc#nU$SQ~m=6QlRRFYU3RPGjO(j;`;qO*J@0TO9Lg`9BzyGck#-I;L#8+=BiI
z3(L7okw@rC|81WcT#J|F++=Yx)m!RIfAQykLI2sG{ud85$DhhWy}?-$)wez?XY(Dy
zz|Nr6AakRVw{k*(Q7_f`XQl|rHq|HQWRnvWOv5*q@wJW2Htd5k?moF3q)d;)_`F;=
z^k(J$aOf94_#*xCFa08Y@&`VNc5rUg9Qd{n)KOyYnkp
zrHqS-vL+4W+Q1vL?Rm?IHD;;fJCtEQPF&epP9yPV{FQQ_m3IB*O8a+0u+FjI2nTW-
z_aZ7q<0dN+0Nim&kUf}|teG+k;)~O8w81~d9;xR-5K3O)u_jGi-dlpeiT1~+B%E`4
zswSt5%Qb0)j?By=HzY?
z?&pfwjnCN?Q!Y`SYer4Hm@9(=f~%zTQ(%yFHII+G9DnH-|1b3UpZ#0(AN?o)DgWtz
z@n88k%l*5$!5;T~u`1FJQ1X1fP+ThUVHmR=gD|)mRf%^A_q2j#bgJ@Q8L+f9>1N%5
zj~Kwtk&Y!(j$ioT3;avJ_;1k<{J;-Tjhxxm0{)R>kf|&bO)+ip(~P!?qx=~&OCII9
z#3%3Lm@Mb7$FuXXi1yKh!nwHs4c;SWt|=kad1hkD0~P^=9i6lVfSUf4g1tO
zZWp>=-l$I5i}P_lIk#&=-j+|=lzR-kef_+_|B2t#8FK5`pUk;Nptn9oLPU7cPBthj
z7F_7;_!;fcdJQ492IMlrzRujg-}8@kg)DP=i@HD}2JJ-sA>h}?S@mtK3c$oKX<
z9C69>o}+Uu;2c4-ETf*+>1$tsbHGmUCwUBn@0$Nl#;0iH=OL_R&0ha}CLcClqcAV+
z-6GbfcGA2RH@)Q*B_%&0kC`>2ed<#`M1SX(e~Etn^FPb~|Nr=2tlHvsTE
zOG5XXqF_NL>H!J{ymb^BieGyX6^;25Fqz*FLSVPUe>FRZ=(CFkL|Ad#^J}0ZZ}&#z
z^tM@bn&bSheEILvFMR2X<$PGioF|XOIz~JLf=@?cTjtu0lj_PfD4;dtrky4ze64u)
zn^RKoC;>|#Xc$0|5j?gVn~2UXP}NP38iICI&&f%fm^-mf2)zi
zDB!{IsCE(ZO*)T#%%^c~*+54-6xUy~CqvGgpDphV9!BBuYk&X$PJjK=KT3b}AO8Pl
zNf|}K{NsBa7-DPwXS~hys31VM_D<}3J3u8KSXVid7_-K(p94+$<`i#W{%CRNn-KKR>ysD8EL!YB+NoU>cp5U;^$@d6&?Hc25{c^56+S6-rZ6B
zENdR4Gt5EkrZWp<8!(;Yx6a2f!X_hZs*d%N2==Rb*xA8H;I*!ugG#~;=HhyXdet4~
zSR5NSO47i_k>@cg7olSVWVv8X(Wb5i?IM2UEm}4?(nbsAbCtIx|0iB>{Vi!2#9^{k
z5p>aCnWy>zZQA?z5`Ue?B@prwJ;-$=+3Pj_Mc$kLe(HxmMgQ)v{eAxHfBn<+M}PDm
zTD>v*zLE6~fFjyBFDifXYTXc%P{DEIsq4UML_w{GGhVD(;1X4;scmzEgm$_A_||Mm
z=w?G8GyHD3&o;$UJuv^ffB)~v*xWGZoyyH{H3`@7X%1=$pP?PQbOSk6c+V
zNq?z)mc%oax#}hca)^K@TIFP7+9jhMU27+sV@z33D6!D_JhVF}r>?T?hdx5}JseD!
zQy*fksOLPg?3iKNZPq#NBI;z`py)dlPv}09-AA-S_PO)-M2m&Ev|*+_*XvmG%OPoP
zzZj{Gvk0?o&%E*xF>B@P`c-qBWB0dswfYOgXDf=_mtf&9C=almaZlSszTzK>0P-6N
zfz=KE%Y4jq1=qZ|Kx)UCH$P_Z;fRhiKg%XoRojIgEpA%$PM+iBcDq)bI|dq
z=db;}f5(IrvzZzVmC0ap&HoV`#%ErZH_`Wv_`NEm!jab&TOVa87W9k8r&GziS7LtW
znjX`b;@9_L3{0BG`PnacneRE|JB~l-glu!ee6H?_1g2LiE;!pVl{$ms7>FY42;__`
z{*rwK>1FZ1j^TfI?n`U8d)DUH^V=$S@K81-YjX-L5#TDd_jb|VO4ZZQyTN~AEe*~0
zSeq+D+m8;aJT9yFNP}h|Y7$
z`FRff1IO|2el{-c@ZB6=mbSJ2y(QhoQ%kFmtVVx3hPvdX7vFYQj{NU^`FwqIoEJIu
zUOwTo@{Dm0LD{IKwp((EOU@I2_jm&_3GGi6-73jzY$m6bI#*t5Fh
zpEq%T@G;ilf84q8b3gZaHitq*psBL6nG=U2#||FOy@I1|cvJxAd3TW96Ds}|!1>0x
z9I$vhmcY6EFFH}OL<(-WQ6OoI9j8LK^pF!oMv)~DAzG3FCIC)-*WG=-s+E;?0UpoU
z@msdTc0%V~QMHBhUnPu+R3^aSh<~jim-iK-{x{}uo;*3gT-Y`RX8Wvm^CAuV)ro^J
zc`Y`*$Cy;)NN7n7cAd(5kmJOfX9W&dS((-=sl2=?u&OpJFXMnQ$;TkIn6(6J{NkBpb$Y2og5a$@+=5`U3f?jt~!AMyQx!IEwLth*rN@?8#}ABl&vkdd^yKiKTmg
zv35C5B@I9xk<>nqwe(7|$;mr(>w2eP5^Jfi2uuh6h=VA$W|oBVYngK=}lHaF(j
zdYr%fpo^dT{NHlkQ2$bVgqF{=`CKI<2$P(T!MS-AH1HPK3H_Lg-!A^a#~JZY(cc(F
z*%^-2B+GkWm)m8;rU7r>Go9OpN}Gr*oZ1M<)rdrQ@Ud@lSI&n{SdZ!P^N6LE~6OYyN`B=oO^ZNhHH+bQR
zh-g<+)OvTuKc-sqMn1y%>xzI+=gakfCZX%P&Rp=KyKCh9@VaqQ?PAC9Z$+seLq99E
z(W%4g`&b{Yxbc-J^JY_{avXJ7UNh#lxVds1J=X0)xG3G-br)+?cx)&o3|itfM`s*}
zn0d7Y16IVU9>Q-qCniejOkqOfisY$?N}uufVJ%N%O?-+9947yT2)-HJsvL>$*pThxC39FiAAh6S8^LQU5q0ZWKmV|?@ud&S
zV=3t1;2XGEkw?J=0F~s8j!dV=)|vMt;4Em&yvamsMF>Gy^cIt7Vrd6*4kv3|C=z;P+oS_^NObmPO}
zllqD4`RlYvH)MEQJ&odS6<>Y8drVBTu`XWF8!eewds;d0gm-TKlK(biMBh!mB%ByG
zQg&{Ji=!AL>&6muE*4GR_#0S{e!FAQZ;_005yvO^=X72+V+hqd#PDy(C#e_Tfq!=V
zQ{nBDcz+(};(Ny`j_Fa`uxH
zv$C(^CKoNSEx+==$bl89SWruevHMyGTHM4xwqt95!
zGgk1g?acSj>ZRafeNP}>KFDeMUHs$Cd?~7J#=my#j6d4UgMVo|KH~p6@#%3JBVvs#
zS!vZq_3zNj-j6YMt$9+mT**~=IN73(w9`rC>$Uxz(6|pjA3Wz}y?Ybo^|*E1LFpS9hX(WthHWIc{|f$`{E_>4UJii_Z-qc8
zfvIjtI5S>o*q}K)+op!Bzdq#i{Ll}5ihlW*e{qv=@k{CGN@C`8&KO%-F`X_BaI6|k
zcR=P%ABHnEurpl?iuLLi_R3e6q$FK|QY&~lzZw~>n1u2TbjTAIpyuOyogimt=Xb}A
z7yy%kUCFnYcl~o=7yTv0s5(X-%FkiS$hOQjQm4&b#p&0k>lWk`h{>6(EM}r6&cB4gn0A1C3
zU==sXk{YP5>K(gUsd&4h1D-!8OHl7f`cfX}MaIv*{?af0+s5UVpWFGLeO!ev)f^fv
z!>@@p`JX4YtUbOrp1h#8F*z^{x}vAypZEArT*N>bf1FsYZBkz;O^a(758=BKyb{&U
z3l@tnWf^#f`fCLCU5=N}T#gs>$!Y%I6Ur+4008FTqWg8c^ZXC<@lH-&9mqRjBEonH
zOfu7Lt@Gwx%wciss^&P&8aYPRndEf#IDnWx$N$
z|0PFLUJum%Rf0Gk-zIcsVWId^|4L_lm?B@N{10)-;v3;{#24Vgu#q<@$nBNpX5>A)
zJ+2vJ!&&?@{@wWs_H{{_{jQGF*aYz%zo$_k?y}_$F&|s`ICLT44GdZpm9Huw#dTiI
zXnDu5&%kp?c^v;czdU{{I$gqKcMF9;gj
zF2JOR=cj=#<@wxl{s4qn@nq%@fpBF*IVAKB_K
zgWBFP0mtw@%Srp94AUy?%|
zk2hn~gv6z7L2J^6VKY1pnoEr17u#`MSftL6@!s{wMH}glj<_gD=v0eLgwgZ#`EDy*
zIAY9>($ss`rX1gqFTAVAnWHM}dTyhatl4abYgDJF&HLjs@6S~{V7xenTJpNkOqyt~56#TS{2a*1}+?S;JZd0`hdhXNC2jFao`#OP6{_#cqP+sKA*P9vT1
zdVY>i5+AwU$}V?l2t1?y!8U?iCjTyY#944^J(cVK!Ujbfd&AI<>0Aw`_}}!Y72%oc
z?!rHvliWDRRPnd=t+=jtatoZJ@}6Lfkb%>G75|cYu)tT8U1BKL7cjU8bzhF0T(vWL{ICU&2M6uL8={WXA>i+T12D-YRwrE?}W5C0*qM`&8m9bL{@2KJi=)3ufC
zIsUKvg_Q9hhkqtqOxkDL`Nyjec;(ctE;#X`fX)I|IdH^-w5D19~<9dSSZ_=qWOa9%0e}m
zkc6GMlP2eXXba3{89DeVqObXXb+%{WpQ8kg5n^6^{FNzhS|BfyX4$}>t~orpP3=&+
zyJ6QQ4FwLH1|!J11QUb}({9+M_iVS%$co)7TH-)R`>Ud$BXctxP+MXUU
zHqq9ZjwTo+xO_gDPmjl4NP)rhV8&LbXg6AFh-7Z2gny=zP9)x=-wItX8!FYd_*qWc
zUK{g1{O|kKK6EnQHvez_hCWyP3$68L9(Nam!rya^G&$zd7k_6YBPU}-(orrP;W#Es
z=4Y+l5E1w;7Wn8ht8JvbXUeF|vo3Q=){H@kwXsMEM?_^~hw?SpGM;nDrE-O_gUfTm
ztnqJs=>z(KPkxe#c(WR+o;6vRk(Vvw3a8(FS^P&<{|q57GTEo1I>{n4Zcz9)lB+Qp
z`{tlbWjuEr{^_6o>Eo7BDopW-3aA{lKD+kWS!&{y7=!MctcH;dUuM+N(i!x~)h
zedaUESz$oDal*}*^}So}gs){DB6@6a#lMIhA7`1LT_DqEoIzi(QC7(oU3n1_{k8!W
z3K3tNrA67^n$V2W#QO3Ddd)ZpD+zgg$zU>hzl50*5_Tz)PyPnq*mISO>1F5y{}xTt
zT@|WKt6pkR!dVC4NO`*IaGPepR_;ecsVFjj>iaa5;U96u>0D(4O}s9JxUjglMI@ZS
zj=-$Rr~Ej1yWlh037j__gjzr+W*RFpIoja&0{Ct30<(iZGuROC4zPYUd1M&Mid^)O
zkI}B*88N*$y$Fst{aM~WW5`6~E{^fjvAX!4cVnXO&*T18@VcniTO^KA?d}irP4*tiAqu_8^c>-#-uS7XqNCo}g-!#jzQ?dMm0+sj
z^qm+U#xcg&uuRJ>&XhvV=CkV}P6*s$obG(OivNfccj2FM%~ZW`r!uS7YW{c3+rNyX
zL8Rp9pX_T22i~ZjU+`~+tK-ymivZb%h0<_bc=3n*$>qtb0A6#79^;hbPI$B_pF#Wl
zA98RCxV(9xbs!m_E-;T`yMmv^j5U8t8K%gvh#*A!?=zs3%VOhQ|4OMDEuIMAE7{1V
zT=Rd%5dIAjjj1aBTK@-0eb2d#EVJ$32mWcx*D?=nJ+ff*7XHuqvG*9MBt;I^`K}ZI
z(2j_T{-qqR?=i;ayO_})yZO-eqCDnD{fX)(iRmc&34X?Q$RExNG5`d(o4iEnj`d^g
z($>cO<>41LXvp=4o7tW1GR+v;#cXZ8J
zWpOY9N36iz1+L6j4NN;|p7>(whkY12^QI%;7{l8^m4!U;rr%kRm6Kz@!)hB(Ud{yBl=(K>IDQUEqO^^-YlHX$g`NH!T{2`2$}8WHe65`<
zlf%NX%E23v_V|eLH(qm3g~2N>muYvhOBn-vW}SC)jCeCg;50VR*p@hy^#uG#;T+~l
zcPv<6n2Vu`Vi+^w-=Z5c!3{^-`7lYx0sweOeoG5J>KHy2@R_k2z9}3spDju;!Qrv`
z7wcX;SKlw=@cHL?a5GN9U~QN3~q}ZEnia4r91JN6G57dih|I`{90iyVsD;9eq
zxGbOx{+D_s^Ko_KaKZaE2jqR+TI9#`ygKz#Ldf};IG^e=@+U2#@Xh?clP@+bcI18y
z=g}T@Im!RI2Dc%Dr#Rr6OZh)LGH>Nt>7Ca9RLo50-dAJM-St0=YPH?j
z8gboN*w;vQ9Q#CDqP(72|HHZSoJ70zZRU@XEclcFB`(TVjDA?lXh`43**
zRuaSIV3h<|3sj=?-B|IL)47$BtJBIcC4H^Q9gm%loThjxRb{jPQvIxEL*n-q(R
zgMLdJ@WmY;oA{GABXU4oNhtdf>Nj57Um4<)v0d)-S+|54L(XsvGNmxgfEB$$E7;5W
zu`|Cs))CFOFI*T^{Mau%%0?9Y{CMI!&PN-5j(;ysM&Qr!${PUt_+UCt{BZ5V#m~94
zsW_s1j(1~5o3z=w>${Axk)!e<`CL3=f&BBsV*kg8>^p!wzUvoR=osVT#-Sle@nd{|
zBE@gth1#jArdHWOSNI^Xl&RMO3p`Me7sKO-9t$!M=xUP!)lUR-5<|JSE~^hagu
zLuWp6O6T@iO?Ar`jYWDIt?IoW|9pafaLG0QE5-;O!NGWTHUHE9&fL3y|9e&SfqQ>e
zOtO|FOqHaSBnl)dBq|pb5)=v6f;aFAwpQC|wQD-_!*tfn-!ZkF)!Uk>+E(lZ#8&VE
zL6iWRaFHmQ5F`OK0W}GBCB(IoxK{SO&vVW``?W9UdA~p3Z*b-$pYQv5&Sjr{_Sv_y
z&v~9_)V0&E?C9fZQPCt@*U)yB#hvw7Yp*rVSM*jgzA8sdCr;u3DbcmS8xs;LbxwuL
zoL~d2j}n%~4(RMu=6Q?(bH+V&;&elxKAxto=sT8Jlm9$&6XhM8=Rup&|MT^#azRwI
z(=VF+r#Tts{|9G^IsXw*jv3(W`Ts<<|L=xb&I)I8Pyr$(gh{mKW`rkHvh6OLM)+8t
z7jX8Zew7Ayy8BhX;@bE;yN)Z}O6G~&r-hlEuJe2;6Q=5N=M%HR?W=RcL>xrpV-dvG
zN(`#MZg*dK-L-l**Z;!-sJ^uZ_FvBgC3{H$ZyamR`v
zk1-Ff-9Vg_iApyt@VH$m*q_8b;JIo@9E3dGx%FL;d+#oaUx(@I{$rwrgNmb-f
zs@BhyS6(^t`wq!?3`P3=e2SW-VzeI7IM{zO`#*vbC~~3^x`3~szIW`xL_BAVr%suJ
z(dNv7Q
zsQPDJ0Ue?2BxwIbT|gOCJ39=4maY!Zat!VV6V#KCzpB4qE{+5p=TT$u%~(bmAC>k?f)8o1D*x2+e3+w)v;R>yaZ>Zx
z=k(uoz#=nm-~SgIE4HN||74v;AF8}Ib(2zHz6}))H_0E&uyR#brcdxcIHfg&YmB#X7C!ZrOn?MfJA_yyr)VkEj*q)
zje2>w4;;8pnEay1OcWmi9Fr&;MV1QRbtI}f22Xdb%L8v2(V%MkaRO@3=Io^!q=3KAYSHayofbb